diff --git a/lib/fileset/internal.nix b/lib/fileset/internal.nix
index 675027c1fee0..3d32c5fc3ef7 100644
--- a/lib/fileset/internal.nix
+++ b/lib/fileset/internal.nix
@@ -349,24 +349,33 @@ rec {
     ```
   */
   _normaliseTreeFilter =
-    path: tree:
-    if tree == "directory" || isAttrs tree then
-      let
-        entries = _directoryEntries path tree;
-        normalisedSubtrees = mapAttrs (name: _normaliseTreeFilter (path + "/${name}")) entries;
-        subtreeValues = attrValues normalisedSubtrees;
-      in
-      # This triggers either when all files in a directory are filtered out
-      # Or when the directory doesn't contain any files at all
-      if all isNull subtreeValues then
-        null
-      # Triggers when we have the same as a `readDir path`, so we can turn it back into an equivalent "directory".
-      else if all isString subtreeValues then
-        "directory"
-      else
-        normalisedSubtrees
-    else
-      tree;
+    let
+      # Recurses into a tree that's already known to be a directory (either a "directory" or an attrset).
+      #
+      # Only directories need to be recursed into:
+      # Files are either null (excluded) or a file type string (included), which are already normalised.
+      #
+      # Checking this in the caller instead of here also avoids the thunk allocation for the path concatenation below.
+      recurse =
+        path: tree:
+        let
+          normalisedSubtrees = mapAttrs (
+            name: subtree:
+            if subtree == "directory" || isAttrs subtree then recurse (path + "/${name}") subtree else subtree
+          ) (_directoryEntries path tree);
+          subtreeValues = attrValues normalisedSubtrees;
+        in
+        # This triggers either when all files in a directory are filtered out
+        # Or when the directory doesn't contain any files at all
+        if all isNull subtreeValues then
+          null
+        # Triggers when we have the same as a `readDir path`, so we can turn it back into an equivalent "directory".
+        else if all isString subtreeValues then
+          "directory"
+        else
+          normalisedSubtrees;
+    in
+    path: tree: if tree == "directory" || isAttrs tree then recurse path tree else tree;
 
   /**
     A minimal normalisation of a filesetTree, intended for pretty-printing:
@@ -526,6 +535,9 @@ rec {
         else
           "/" + concatStringsSep "/" fileset._internalBaseComponents + "/";
 
+      getBaseStringPrefix = substring 0 baseLength;
+      removeBaseStringPrefix = substring baseLength (-1);
+
       baseLength = stringLength baseString;
 
       # Check whether a list of path components under the base path exists in the tree.
@@ -551,7 +563,12 @@ rec {
               # or a string ("directory" or "regular", etc.) in which case it's included
               localTree != null;
         in
-        recurse 0 tree;
+        # Start by recursing into the first element. This is guaranteed to be
+        # safe. components will never be empty (builtins.split can't make an
+        # empty list). Tree can be something other than an attrset, but if so,
+        # the isAttrs check will fail when being passed `or tree`, and the index
+        # being ahead doesn't matter.
+        recurse 2 (tree.${head components} or tree);
 
       # Filter suited when there's no files
       empty = _: _: false;
@@ -569,25 +586,34 @@ rec {
           pathSlash = path + "/";
         in
         (
+          # Same as `hasPrefix baseString pathSlash`, but more efficient.
+          # The path is either the base itself or underneath it,
+          # but only on the few paths above it, so its checked first.
+          # With base /foo/bar this matches /foo/bar and /foo/bar/baz
+          # hasPrefix "/foo/bar/" "/foo/bar/baz/"
+          if getBaseStringPrefix pathSlash == baseString then
+            if pathSlash == baseString then
+              # The path is the base directory itself, which is always included
+              true
+            else
+              # Same as `removePrefix baseString path`, but more efficient.
+              # From the above code we know that hasPrefix baseString pathSlash holds, so this is safe.
+              # We don't use pathSlash here because we only needed the trailing slash for the prefix matching.
+              # With base /foo and path /foo/bar/baz this gives
+              # inTree (split "/" (removePrefix "/foo/" "/foo/bar/baz"))
+              # == inTree (split "/" "bar/baz")
+              # == inTree [ "bar" "baz" ]
+              inTree (split "/" (removeBaseStringPrefix path))
           # Same as `hasPrefix pathSlash baseString`, but more efficient.
+          # The path is a proper ancestor of the base, which needs to be included for the base to be reachable:
           # With base /foo/bar we need to include /foo:
           # hasPrefix "/foo/" "/foo/bar/"
-          if substring 0 (stringLength pathSlash) baseString == pathSlash then
+          else if substring 0 (stringLength pathSlash) baseString == pathSlash then
             true
-          # Same as `! hasPrefix baseString pathSlash`, but more efficient.
-          # With base /foo/bar we need to exclude /baz
-          # ! hasPrefix "/baz/" "/foo/bar/"
-          else if substring 0 baseLength pathSlash != baseString then
-            false
           else
-            # Same as `removePrefix baseString path`, but more efficient.
-            # From the above code we know that hasPrefix baseString pathSlash holds, so this is safe.
-            # We don't use pathSlash here because we only needed the trailing slash for the prefix matching.
-            # With base /foo and path /foo/bar/baz this gives
-            # inTree (split "/" (removePrefix "/foo/" "/foo/bar/baz"))
-            # == inTree (split "/" "bar/baz")
-            # == inTree [ "bar" "baz" ]
-            inTree (split "/" (substring baseLength (-1) path))
+            # The path is unrelated to the base, so nothing from it is included
+            # With base /foo/bar this matches e.g. /baz
+            false
         )
         # This is a way have an additional check in case the above is true without any significant performance cost
         && (
@@ -802,21 +828,34 @@ rec {
   */
   _unionTrees =
     trees:
-    let
-      stringIndex = findFirstIndex isString null trees;
-      withoutNull = filter (tree: tree != null) trees;
-    in
-    if stringIndex != null then
+    if length trees == 1 then
+      # The union of a single tree simply returns the first element
+      head trees
+    else
+      let
+        # Like lib.findFirstIndex but without indexing.
+        # This is a hot path so the indexing arithmetic adds up.
+        firstStr = foldl' (
+          found: tree:
+          if found != null then
+            found
+          else if isString tree then
+            tree
+          else
+            found # null
+        ) null trees;
+        nonNulls = filter (tree: tree != null) trees;
+      in
       # If there's a string, it's always a fully included tree (dir or file),
       # no need to look at other elements
-      elemAt trees stringIndex
-    else if withoutNull == [ ] then
-      # If all trees are null, then the resulting tree is also null
-      null
-    else
-      # The non-null elements have to be attribute sets representing partial trees
-      # We need to recurse into those
-      zipAttrsWith (name: _unionTrees) withoutNull;
+      if firstStr != null then
+        firstStr
+      else if nonNulls == [ ] then
+        null
+      else
+        # The non-null elements have to be attribute sets representing partial trees
+        # We need to recurse into those
+        zipAttrsWith (name: _unionTrees) nonNulls;
 
   /**
     Computes the intersection of two filesets.
diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index 262cb722a090..77e7a8f99ef4 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -151,7 +151,24 @@ let
           );
 
         # Derived meta-data
-        useLLVM = final.isFreeBSD || final.isOpenBSD;
+        useLLVM =
+          final.isFreeBSD
+          || final.isOpenBSD
+          || final.isUefi
+          || final.isMsvc
+          ||
+            # because GCC does not support this platform yet
+            (with final; isWindows && isAarch64);
+
+        # Use the split GCC package set (`gccNGPackages`) instead of the
+        # monolithic `gcc`. No platform selects it yet; it is opt-in, set
+        # explicitly on a platform spec, so that the split set can be exercised
+        # before anything depends on it.
+        #
+        # I (@Ericson2314) plan on making obscure low-tier platforms (e.g.
+        # NetBSD) use it soon, so we can dogfood GCC NG and thereby iron out its
+        # bugs.
+        useGccNG = false;
 
         libc =
           if final.isDarwin then
@@ -176,9 +193,7 @@ let
             "uclibc"
           else if final.isAndroid then
             "bionic"
-          else if
-            final.isLinux # default
-          then
+          else if final.isLinux then
             "glibc"
           else if final.isFreeBSD then
             "fblibc"
@@ -190,6 +205,8 @@ let
             "avrlibc"
           else if final.isGhcjs then
             null
+          else if final.isUefi then
+            null
           else if final.isNone then
             "newlib"
           # TODO(@Ericson2314) think more about other operating systems
diff --git a/lib/systems/examples.nix b/lib/systems/examples.nix
index d0eac0eb030a..88207cb845c1 100644
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@@ -93,7 +93,6 @@ rec {
     config = "aarch64-unknown-linux-android";
     androidSdkVersion = "35";
     androidNdkVersion = "27";
-    libc = "bionic";
     useAndroidPrebuilt = false;
     useLLVM = true;
   };
@@ -169,22 +168,18 @@ rec {
 
   riscv64-embedded = {
     config = "riscv64-none-elf";
-    libc = "newlib";
   };
 
   riscv32-embedded = {
     config = "riscv32-none-elf";
-    libc = "newlib";
   };
 
   mips64-embedded = {
     config = "mips64-none-elf";
-    libc = "newlib";
   };
 
   mips-embedded = {
     config = "mips-none-elf";
-    libc = "newlib";
   };
 
   # https://github.com/loongson/la-softdev-convention/blob/master/la-softdev-convention.adoc#10-operating-system-package-build-requirements
@@ -201,17 +196,17 @@ rec {
 
   mmix = {
     config = "mmix-unknown-mmixware";
+    # Not `isNone`: the OS here is `mmixware`, so the bare-metal default does
+    # not apply.
     libc = "newlib";
   };
 
   rx-embedded = {
     config = "rx-none-elf";
-    libc = "newlib";
   };
 
   msp430 = {
     config = "msp430-elf";
-    libc = "newlib";
   };
 
   avr = {
@@ -220,12 +215,10 @@ rec {
 
   vc4 = {
     config = "vc4-elf";
-    libc = "newlib";
   };
 
   or1k = {
     config = "or1k-elf";
-    libc = "newlib";
   };
 
   m68k = {
@@ -250,7 +243,6 @@ rec {
 
   arm-embedded = {
     config = "arm-none-eabi";
-    libc = "newlib";
   };
   arm-embedded-nano = {
     config = "arm-none-eabi";
@@ -258,7 +250,6 @@ rec {
   };
   armhf-embedded = {
     config = "arm-none-eabihf";
-    libc = "newlib";
     # GCC8+ does not build without this
     # (https://www.mail-archive.com/gcc-bugs@gcc.gnu.org/msg552339.html):
     gcc = {
@@ -269,38 +260,31 @@ rec {
 
   aarch64-embedded = {
     config = "aarch64-none-elf";
-    libc = "newlib";
     rust.rustcTarget = "aarch64-unknown-none";
   };
 
   aarch64be-embedded = {
     config = "aarch64_be-none-elf";
-    libc = "newlib";
   };
 
   ppc-embedded = {
     config = "powerpc-none-eabi";
-    libc = "newlib";
   };
 
   ppcle-embedded = {
     config = "powerpcle-none-eabi";
-    libc = "newlib";
   };
 
   i686-embedded = {
     config = "i686-elf";
-    libc = "newlib";
   };
 
   x86_64-embedded = {
     config = "x86_64-elf";
-    libc = "newlib";
   };
 
   microblaze-embedded = {
     config = "microblazeel-none-elf";
-    libc = "newlib";
   };
 
   #
@@ -338,16 +322,10 @@ rec {
 
   x86_64-unknown-uefi = {
     config = "x86_64-unknown-uefi";
-    libc = null;
-    useLLVM = true;
-    linker = "lld";
   };
 
   aarch64-unknown-uefi = {
     config = "aarch64-unknown-uefi";
-    libc = null;
-    useLLVM = true;
-    linker = "lld";
   };
 
   #
@@ -382,12 +360,11 @@ rec {
   };
 
   # mingw-w64 with ucrt for Aarch64, default compiler (which is LLVM
-  # because GCC does not support this platform yet).
+  # see ./default.nix).
   mingw-ucrt-aarch64 = {
     config = "aarch64-w64-mingw32";
     libc = "ucrt";
     rust.rustcTarget = "aarch64-pc-windows-gnullvm";
-    useLLVM = true;
   };
 
   # mingw-64 back compat
@@ -400,12 +377,10 @@ rec {
   # Target the MSVC ABI
   x86_64-windows = {
     config = "x86_64-pc-windows-msvc";
-    useLLVM = true;
   };
 
   aarch64-windows = {
     config = "aarch64-pc-windows-msvc";
-    useLLVM = true;
   };
 
   x86_64-cygwin = {
@@ -416,12 +391,10 @@ rec {
 
   aarch64-freebsd = {
     config = "aarch64-unknown-freebsd";
-    useLLVM = true;
   };
 
   x86_64-freebsd = {
     config = "x86_64-unknown-freebsd";
-    useLLVM = true;
   };
 
   x86_64-netbsd = {
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 067dadb64638..0f5da199bbd3 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -63,6 +63,12 @@
 {
   # keep-sorted start case=no numeric=no block=yes
 
+  "3mp3ri0r" = {
+    email = "christoforus@xendit.co";
+    github = "3mp3ri0r";
+    githubId = 3140815;
+    name = "Christoforus Surjoputro";
+  };
   _0b11stan = {
     name = "Tristan Auvinet Pinaudeau";
     email = "tristan@tic.sh";
@@ -7123,6 +7129,12 @@
     githubId = 15774340;
     name = "Thomas Depierre";
   };
+  dibenzepin = {
+    name = "Fumnanya";
+    email = "fmowete@outlook.com";
+    github = "dibenzepin";
+    githubId = 87488715;
+  };
   DictXiong = {
     email = "me@beardic.cn";
     github = "DictXiong";
@@ -22807,12 +22819,6 @@
     githubId = 4201956;
     name = "pongo1231";
   };
-  poopsicles = {
-    name = "Fumnanya";
-    email = "fmowete@outlook.com";
-    github = "dibenzepin";
-    githubId = 87488715;
-  };
   PopeRigby = {
     name = "PopeRigby";
     github = "poperigby";
diff --git a/nixos/doc/manual/development/settings-options.section.md b/nixos/doc/manual/development/settings-options.section.md
index e5532f00f371..3b03a087e834 100644
--- a/nixos/doc/manual/development/settings-options.section.md
+++ b/nixos/doc/manual/development/settings-options.section.md
@@ -395,7 +395,7 @@ have a predefined type and string generator already declared under
 
     `mkRaw pythonCode`
 
-    :   Outputs the given string as raw Python code
+    :   Outputs the given string as raw Python code. Note that the final result will be stripped of any comments.
 
     `_imports`
 
diff --git a/nixos/doc/manual/development/state-revision.section.md b/nixos/doc/manual/development/state-revision.section.md
new file mode 100644
index 000000000000..8a8f13aeda74
--- /dev/null
+++ b/nixos/doc/manual/development/state-revision.section.md
@@ -0,0 +1,57 @@
+# State revision {#sec-state-revision}
+
+NixOS includes a {option}`system.stateVersion` option, used by some modules for a
+variety of reasons related to non-backward-compatible changes to software or
+the module itself.
+Module authors are discouraged from adding new uses of
+{option}`system.stateVersion` to their module.
+
+However, when the alternatives are impractical, modules that wish to consume
+{option}`system.stateVersion` should instead define their own `stateRevision`
+option using `utils.mkStateRevisionOption`.
+There should be no uses of `config.system.stateVersion` directly in the module.
+
+(Note the name difference: the {option}`system.stateVersion` option, with a V,
+takes a value that looks like "YY.MM".
+A `stateRevision` option, with an R, takes a non-negative integer value.)
+
+Modules should also add the value of their `stateRevision` option to
+`system.moduleStateRevisions."your.module.stateRevision"`, when the module is
+enabled.
+This is a purely informative option that exists to help describe the effects of
+changing {option}`system.stateVersion`.
+
+Example:
+
+```nix
+{
+  lib,
+  config,
+  utils,
+  ...
+}:
+let
+  cfg = config.services.whatever;
+in
+{
+  options.services.whatever = {
+    enable = lib.mkEnableOption "whatever, a service that does whatever";
+    stateRevision = utils.mkStateRevisionOption {
+      descriptionName = "the whatever service";
+      migrations = {
+        "26.05" = "Rename `/var/lib/old_name` to `/var/lib/new_name`.";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.whatever = {
+      # ...
+      serviceConfig.StateDirectory = if cfg.stateRevision < 1 then "old_name" else "new_name";
+    };
+
+    # Important: this is inside the `lib.mkIf cfg.enable`
+    system.moduleStateRevisions."services.whatever.stateRevision" = cfg.stateRevision;
+  };
+}
+```
diff --git a/nixos/doc/manual/development/writing-modules.chapter.md b/nixos/doc/manual/development/writing-modules.chapter.md
index a58ebb1709ab..626834fc3e66 100644
--- a/nixos/doc/manual/development/writing-modules.chapter.md
+++ b/nixos/doc/manual/development/writing-modules.chapter.md
@@ -220,4 +220,5 @@ importing-modules.section.md
 replace-modules.section.md
 freeform-modules.section.md
 settings-options.section.md
+state-revision.section.md
 ```
diff --git a/nixos/doc/manual/redirects.json b/nixos/doc/manual/redirects.json
index 6e8a587f02c4..9901e543a346 100644
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -253,6 +253,9 @@
   "sec-override-nixos-test": [
     "index.html#sec-override-nixos-test"
   ],
+  "sec-state-revision": [
+    "index.html#sec-state-revision"
+  ],
   "sec-wireless-declarative": [
     "index.html#sec-wireless-declarative"
   ],
diff --git a/nixos/lib/test-driver/default.nix b/nixos/lib/test-driver/default.nix
index efc7d8fa9a85..b2221e06629c 100644
--- a/nixos/lib/test-driver/default.nix
+++ b/nixos/lib/test-driver/default.nix
@@ -60,7 +60,7 @@ buildPythonApplication {
     util-linux
     vde2
   ]
-  ++ lib.optionals stdenv.isLinux [
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
     vhost-device-vsock
   ]
   ++ lib.optionals enableNspawn [
diff --git a/nixos/lib/utils.nix b/nixos/lib/utils.nix
index 487b20f53d8c..224d7ad90330 100644
--- a/nixos/lib/utils.nix
+++ b/nixos/lib/utils.nix
@@ -6,8 +6,10 @@
 
 let
   inherit (lib)
+    all
     any
     attrNames
+    concatImapStringsSep
     concatMapStringsSep
     concatStringsSep
     elem
@@ -27,8 +29,11 @@ let
     isList
     isPath
     isString
+    length
     listToAttrs
+    literalMD
     mapAttrs
+    mkOption
     nameValuePair
     optionalString
     removePrefix
@@ -36,8 +41,10 @@ let
     splitString
     stringToCharacters
     types
+    versionOlder
     ;
 
+  inherit (lib.lists) findFirstIndex;
   inherit (lib.strings) toJSON escapeC;
 in
 
@@ -604,6 +611,122 @@ let
         lib.listToAttrs
       ];
     };
+
+    /**
+      Creates a per-module `stateRevision` option that takes an int value, with a
+      default that is derived from `system.stateVersion`.
+
+      # Inputs
+
+      `descriptionName`
+      : A human-friendly name for your module, used for the description of the
+        created option.
+
+      `migrations`
+      : Attribute set that maps from values of `system.stateVersion`
+        (representing the breakpoints at which the default value of this option
+        will change) to Markdown instructions to users for manually migrating
+        their data to this breakpoint. The migration instructions will be
+        included in the NixOS documentation for this option. (These instructions
+        must only contain Markdown inlines, because they will be rendered as
+        items in an ordered list. In particular, nested lists will not render
+        correctly.)
+
+        `migrations` will also be exposed as an attribute on the result.
+
+      # Examples
+      :::{.example}
+      ## `lib.options.mkStateRevisionOption` usage example
+
+      ```nix
+      exampleModule =
+        { lib, config, utils, ... }:
+        {
+          options.services.whatever = {
+            stateRevision = utils.mkStateRevisionOption {
+              descriptionName = "the whatever service";
+              migrations = {
+                "26.05" = "Rename `/var/lib/old_name` to `/var/lib/new_name`.";
+                "26.11" = "Run the `upgrade_whatever` utility.";
+                };
+              };
+            };
+          };
+        }
+
+      (pkgs.nixos [
+        exampleModule
+        { system.stateVersion = "25.11"; }
+      ]).config.services.whatever.stateRevision # => 0
+      (pkgs.nixos [
+        exampleModule
+        { system.stateVersion = "26.05"; }
+      ]).config.services.whatever.stateRevision # => 1
+      (pkgs.nixos [
+        exampleModule
+        { system.stateVersion = "27.05"; }
+      ]).config.services.whatever.stateRevision # => 2
+      ```
+
+      :::
+
+      Modules should use this function when they change how data managed by the
+      module is persisted on the system between NixOS releases.
+
+      The default value of the option will be the number of attributes in the
+      `migrations` parameter with name less than or equal to the value of
+      `system.stateVersion`.
+
+      When using this function, don't forget to add the option's value to
+      `system.moduleStateRevisions."your.module.stateRevision"` when your module is
+      enabled.
+    */
+    mkStateRevisionOption =
+      {
+        descriptionName,
+        migrations,
+      }:
+      let
+        versions = attrNames migrations;
+        maxVal = length versions;
+      in
+      assert all (v: builtins.match "[0-9]{2}\\.[0-9]{2}" v != null) versions;
+      mkOption {
+        type = types.ints.between 0 maxVal;
+        description = ''
+          This option versions the format of state persisted by
+          ${descriptionName}. Its default value depends on the value of
+          {option}`system.stateVersion`.
+
+          Users who wish to increment this option will need to take manual
+          migration steps to preserve their data. **If you perform these
+          migrations, rolling back to an older generation will require also
+          reversing the migrations to the state expected by that generation.**
+          The migrations needed to advance to each value of this option are as
+          follows (perform all instructions after the row for the current
+          `stateRevision`, up to and including the row for the new
+          `stateRevision`):
+
+          0. (none)
+          ${concatImapStringsSep "\n" (
+            v: sv: "${toString v}. ${replaceStrings [ "\n" ] [ " " ] migrations.${sv}}"
+          ) versions}
+
+          Note that you do **not** need to change {option}`system.stateVersion`
+          in order to update this option. {option}`system.stateVersion` only
+          determines the default value of this option. Most users should not
+          change {option}`system.stateVersion` at all.
+        '';
+        default = findFirstIndex (versionOlder config.system.stateVersion) maxVal versions;
+        defaultText = literalMD ''
+          If {option}`system.stateVersion` is:
+          ${concatImapStringsSep "\n" (v: sv: "* &lt;${sv}: ${toString (v - 1)}") versions}
+          * otherwise: ${toString maxVal}
+        '';
+      }
+      // {
+        inherit migrations;
+      };
   };
 in
 utils
diff --git a/nixos/modules/hardware/video/nvidia.nix b/nixos/modules/hardware/video/nvidia.nix
index dc3d6cb134f7..bd553409cff6 100644
--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@@ -482,7 +482,7 @@ in
               combineIcdPkgs =
                 icd: pkgs:
                 pkgs.symlinkJoin {
-                  name = "nvidia-egl-external-platforms${lib.optionalString pkgs.stdenv.is32bit "-x32"}";
+                  name = "nvidia-egl-external-platforms${lib.optionalString pkgs.stdenv.hostPlatform.is32bit "-x32"}";
                   paths = lib.attrVals icd pkgs;
                   # Remediate reversed priorities in pre-595 drivers,
                   # https://github.com/NixOS/nixpkgs/pull/497342#issuecomment-4034876793
diff --git a/nixos/modules/misc/version.nix b/nixos/modules/misc/version.nix
index b61e00d647b2..6270eb663db8 100644
--- a/nixos/modules/misc/version.nix
+++ b/nixos/modules/misc/version.nix
@@ -254,6 +254,30 @@ in
       '';
     };
 
+    moduleStateRevisions = mkOption {
+      type =
+        let
+          baseType = types.attrsOf types.ints.unsigned;
+          isStateRevisionOption = x: lib.isOption x && x ? migrations;
+        in
+        types.addCheck baseType (
+          attrs:
+          builtins.all (
+            attrPath: isStateRevisionOption (lib.attrByPath (lib.splitString "." attrPath) null options)
+          ) (builtins.attrNames attrs)
+        )
+        // {
+          description = "${baseType.description}, in which every attribute name is the path to an option created with mkStateRevisionOption";
+        };
+      default = { };
+      internal = true;
+      description = ''
+        NixOS modules should set attributes on this option. Users should leave
+        it alone. Future tooling may use it to determine the consequences of
+        updating {option}`system.stateVersion`.
+      '';
+    };
+
     configurationRevision = mkOption {
       type = types.nullOr types.str;
       default = null;
diff --git a/nixos/modules/security/isolate.nix b/nixos/modules/security/isolate.nix
index 9f0060e305ac..88dde22b31cf 100644
--- a/nixos/modules/security/isolate.nix
+++ b/nixos/modules/security/isolate.nix
@@ -79,7 +79,7 @@ in
     };
 
     firstUid = mkOption {
-      type = types.numbers.between 1000 65533;
+      type = types.ints.between 1000 65533;
       default = 60000;
       description = ''
         Start of block of UIDs reserved for sandboxes.
@@ -87,7 +87,7 @@ in
     };
 
     firstGid = mkOption {
-      type = types.numbers.between 1000 65533;
+      type = types.ints.between 1000 65533;
       default = 60000;
       description = ''
         Start of block of GIDs reserved for sandboxes.
@@ -95,7 +95,7 @@ in
     };
 
     numBoxes = mkOption {
-      type = types.numbers.between 1000 65533;
+      type = types.ints.between 1000 65533;
       default = 1000;
       description = ''
         Number of UIDs and GIDs to reserve, starting from
diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix
index 7d4182799c15..37acac016c7a 100644
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@@ -574,7 +574,7 @@ in
               # and automatically migrates when needed (e.g. with v2 -> v3 swapping from Whoosh to Tantivy)
               ${lib.getExe cfg.package} document_index reindex --if-needed --no-progress-bar
 
-            if ${lib.boolToString (cfg.passwordFile != null)} || [[ -n $PAPERLESS_ADMIN_PASSWORD ]]; then
+            if ${lib.boolToString (cfg.passwordFile != null)} || [[ -n ''${PAPERLESS_ADMIN_PASSWORD-} ]]; then
               export PAPERLESS_ADMIN_USER="''${PAPERLESS_ADMIN_USER:-admin}"
               if [[ -e $CREDENTIALS_DIRECTORY/PAPERLESS_ADMIN_PASSWORD ]]; then
                 PAPERLESS_ADMIN_PASSWORD=$(cat "$CREDENTIALS_DIRECTORY/PAPERLESS_ADMIN_PASSWORD")
diff --git a/nixos/modules/services/misc/seerr.nix b/nixos/modules/services/misc/seerr.nix
index fc91fd8ba30d..e194216e1fc7 100644
--- a/nixos/modules/services/misc/seerr.nix
+++ b/nixos/modules/services/misc/seerr.nix
@@ -2,13 +2,14 @@
   config,
   pkgs,
   lib,
+  utils,
   ...
 }:
 let
   cfg = config.services.seerr;
-  # 26.05 introduced a breaking change which is guarded behind stateVersion to avoid
-  # breaking users.
-  useNewConfigLocation = lib.versionAtLeast config.system.stateVersion "26.05";
+  # 26.05 introduced a breaking change which is guarded behind stateRevision to
+  # avoid breaking users.
+  useNewConfigLocation = cfg.stateRevision >= 1;
 in
 {
   imports = [
@@ -39,8 +40,23 @@ in
     configDir = lib.mkOption {
       type = lib.types.path;
       default = if useNewConfigLocation then "/var/lib/seerr/" else "/var/lib/jellyseerr/config";
+      defaultText = lib.literalMD "{file}`/var/lib/seerr` (or {file}`/var/lib/jellyseerr/config` if {option}`services.seerr.stateRevision` < 1)";
       description = "Config data directory";
     };
+
+    stateRevision = utils.mkStateRevisionOption {
+      descriptionName = "Seerr";
+      migrations = {
+        "26.05" = ''
+          Move {file}`/var/lib/private/jellyseerr/config` to
+          {file}`/var/lib/private/seerr`, if you have not set
+          {option}`services.seerr.configDir`. (If you have set
+          {option}`services.seerr.configDir`, you should also have forced
+          {option}`systemd.services.seerr.serviceConfig.StateDirectory`, and in
+          that case `stateRevision` does not affect your configuration.)
+        '';
+      };
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -81,5 +97,7 @@ in
     networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ cfg.port ];
     };
+
+    system.moduleStateRevisions."services.seerr.stateRevision" = cfg.stateRevision;
   };
 }
diff --git a/nixos/modules/services/monitoring/uptime-kuma.nix b/nixos/modules/services/monitoring/uptime-kuma.nix
index 5c2100607c73..e1b4bcf15c10 100644
--- a/nixos/modules/services/monitoring/uptime-kuma.nix
+++ b/nixos/modules/services/monitoring/uptime-kuma.nix
@@ -73,6 +73,7 @@ in
         PrivateMounts = true;
         PrivateTmp = true;
         PrivateUsers = true;
+        ProcSubset = "pid";
         ProtectClock = true;
         ProtectControlGroups = "strict";
         ProtectHome = true;
diff --git a/nixos/modules/services/networking/eternal-terminal.nix b/nixos/modules/services/networking/eternal-terminal.nix
index 0c1a339929bd..a8e16728d8ec 100644
--- a/nixos/modules/services/networking/eternal-terminal.nix
+++ b/nixos/modules/services/networking/eternal-terminal.nix
@@ -53,6 +53,14 @@ in
           The maximum log size.
         '';
       };
+
+      telemetry = lib.mkOption {
+        default = false;
+        type = lib.types.bool;
+        description = ''
+          Collects anonymous usage data and crash reports.
+        '';
+      };
     };
   };
 
@@ -71,8 +79,8 @@ in
         wantedBy = [ "multi-user.target" ];
         after = [ "network.target" ];
         serviceConfig = {
-          Type = "forking";
-          ExecStart = "${pkgs.eternal-terminal}/bin/etserver --daemon --cfgfile=${pkgs.writeText "et.cfg" ''
+          Type = "exec";
+          ExecStart = "${pkgs.eternal-terminal}/bin/etserver --logtostdout --cfgfile=${pkgs.writeText "et.cfg" ''
             ; et.cfg : Config file for Eternal Terminal
             ;
 
@@ -83,15 +91,15 @@ in
             verbose = ${toString cfg.verbosity}
             silent = ${if cfg.silent then "1" else "0"}
             logsize = ${toString cfg.logSize}
+            telemetry = ${lib.boolToString cfg.telemetry}
           ''}";
           Restart = "on-failure";
-          KillMode = "process";
         };
       };
     };
   };
 
   meta = {
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ tomasrivera ];
   };
 }
diff --git a/nixos/modules/services/web-servers/apache-httpd/default.nix b/nixos/modules/services/web-servers/apache-httpd/default.nix
index a2474fcfa6f2..f102db4b3c0d 100644
--- a/nixos/modules/services/web-servers/apache-httpd/default.nix
+++ b/nixos/modules/services/web-servers/apache-httpd/default.nix
@@ -90,6 +90,7 @@ let
     "unixd"
     "slotmem_shm"
     "socache_shmcb"
+    "systemd"
     "mpm_${cfg.mpm}"
   ]
   ++ (if cfg.mpm == "prefork" then [ "cgi" ] else [ "cgid" ])
@@ -992,12 +993,12 @@ in
       '';
 
       serviceConfig = {
-        ExecStart = "@${pkg}/bin/httpd httpd -f /etc/httpd/httpd.conf";
-        ExecStop = "${pkg}/bin/httpd -f /etc/httpd/httpd.conf -k graceful-stop";
+        ExecStart = "${pkg}/bin/httpd -D FOREGROUND -f /etc/httpd/httpd.conf";
         ExecReload = "${pkg}/bin/httpd -f /etc/httpd/httpd.conf -k graceful";
+        KillMode = "mixed";
         User = cfg.user;
         Group = cfg.group;
-        Type = "forking";
+        Type = "notify";
         PIDFile = "${runtimeDir}/httpd.pid";
         Restart = "always";
         RestartSec = "5s";
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 7bb6c1c1b5e8..142da6ccb52b 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1059,6 +1059,7 @@ in
   modularService = pkgs.callPackage ../modules/system/service/systemd/test.nix {
     inherit evalSystem;
   };
+  moduleStateRevisions = pkgs.callPackage ./moduleStateRevisions.nix { };
   molly-brown = runTest ./molly-brown.nix;
   mollysocket = runTest ./mollysocket.nix;
   monado = runTest ./monado.nix;
@@ -1234,6 +1235,7 @@ in
   ntfy-sh-migration = handleTest ./ntfy-sh-migration.nix { };
   ntpd = runTest ./ntpd.nix;
   ntpd-rs = runTest ./ntpd-rs.nix;
+  nullmailer = runTest ./nullmailer.nix;
   nushell = runTest ./nushell.nix;
   nvidia-container-toolkit = runTest ./nvidia-container-toolkit.nix;
   nvme-rs = runTest ./nvme-rs.nix;
@@ -1841,7 +1843,7 @@ in
   userborn-mutable-users = runTest ./userborn-mutable-users.nix;
   userborn-static = runTest ./userborn-static.nix;
   ustreamer = runTest ./ustreamer.nix;
-  utils = import ./utils { inherit runTest; };
+  utils = pkgs.callPackage ./utils { inherit runTest; };
   utmp = runTest ./utmp.nix;
   uwsgi = runTest ./uwsgi.nix;
   v2ray = runTest ./v2ray.nix;
diff --git a/nixos/tests/moduleStateRevisions.nix b/nixos/tests/moduleStateRevisions.nix
new file mode 100644
index 000000000000..3bce4c312488
--- /dev/null
+++ b/nixos/tests/moduleStateRevisions.nix
@@ -0,0 +1,25 @@
+{
+  lib,
+  emptyFile,
+  nixos,
+}:
+let
+  evalModuleStateRevisions =
+    cfg:
+    (nixos [
+      { system.stateVersion = lib.trivial.release; }
+      cfg
+    ]).config.system.moduleStateRevisions;
+
+  # For modules that follow the <module>.enable, <module>.stateRevision pattern:
+  testModule =
+    path:
+    evalModuleStateRevisions (lib.setAttrByPath path { enable = true; })
+    ? "${builtins.concatStringsSep "." path}.stateRevision";
+in
+assert evalModuleStateRevisions { } == { };
+assert testModule [
+  "services"
+  "seerr"
+];
+emptyFile
diff --git a/nixos/tests/nullmailer.nix b/nixos/tests/nullmailer.nix
new file mode 100644
index 000000000000..19e941226429
--- /dev/null
+++ b/nixos/tests/nullmailer.nix
@@ -0,0 +1,85 @@
+{ lib, ... }:
+{
+  name = "nullmailer";
+
+  meta = {
+    maintainers = with lib.maintainers; [ h7x4 ];
+  };
+
+  nodes = {
+    mail =
+      { config, ... }:
+      {
+        imports = [ ./common/user-account.nix ];
+
+        virtualisation.vlans = [ 1 ];
+
+        networking = {
+          useNetworkd = true;
+          useDHCP = false;
+          firewall.allowedTCPPorts = [ 25 ];
+          domain = "example.com";
+          hosts."10.0.0.2" = [ "machine.example.com" ];
+        };
+
+        systemd.network.networks."01-eth1" = {
+          name = "eth1";
+          networkConfig.Address = "10.0.0.1/24";
+        };
+
+        services.postfix = {
+          enable = true;
+
+          localRecipients = [ "alice" ];
+
+          settings = {
+            main = {
+              myhostname = config.networking.hostName;
+              mydomain = config.networking.domain;
+              mynetworks = [ "0.0.0.0/0" ];
+              mydestination = [ "$mydomain" ];
+
+              smtpd_recipient_restrictions = "permit_mynetworks, reject";
+            };
+          };
+        };
+      };
+
+    machine =
+      { config, ... }:
+      {
+        virtualisation.vlans = [ 1 ];
+
+        networking = {
+          useNetworkd = true;
+          useDHCP = false;
+          domain = "example.com";
+          hosts."10.0.0.1" = [ "mail.example.com" ];
+        };
+
+        systemd.network.networks."01-eth1" = {
+          name = "eth1";
+          networkConfig.Address = "10.0.0.2/24";
+        };
+
+        services.nullmailer = {
+          enable = true;
+          config = {
+            me = "${config.networking.fqdn}";
+            remotes = "mail.example.com smtp --port=25";
+          };
+        };
+      };
+  };
+
+  testScript = ''
+    start_all()
+
+    machine.wait_for_open_port(25, "mail.example.com")
+    machine.wait_for_unit("nullmailer.service")
+    machine.succeed('printf "To: alice@example.com\r\n\r\nthis is the body of the email" | sendmail -t -i -f sender@example.com')
+
+    mail.wait_for_console_text("delivered to maildir")
+    print(mail.succeed("grep 'this is the body of the email' /var/spool/mail/alice/new/*"))
+  '';
+}
diff --git a/nixos/tests/rosenpass.nix b/nixos/tests/rosenpass.nix
index 10c25a070d5b..f05b7ea17ef1 100644
--- a/nixos/tests/rosenpass.nix
+++ b/nixos/tests/rosenpass.nix
@@ -41,6 +41,7 @@ in
             };
           };
 
+          networking.useNetworkd = true;
           networking.firewall.allowedUDPPorts = [ 9999 ];
 
           systemd.network = {
@@ -72,6 +73,7 @@ in
       server = {
         imports = [ (shared server) ];
 
+        networking.useNetworkd = true;
         networking.firewall.allowedUDPPorts = [ server.wg.listen ];
 
         systemd.network.netdevs."10-${deviceName}" = {
@@ -118,7 +120,7 @@ in
   testScript =
     { ... }:
     ''
-      from os import system
+      import subprocess
 
       # Full path to rosenpass in the store, to avoid fiddling with `$PATH`.
       rosenpass = "${pkgs.rosenpass}/bin/rosenpass"
@@ -137,7 +139,10 @@ in
 
       for (name, machine, remote) in [("server", server, client), ("client", client, server)]:
           pk, sk = f"{name}.pqpk", f"{name}.pqsk"
-          system(f"{rosenpass} gen-keys --force --secret-key {sk} --public-key {pk}")
+          subprocess.run(
+              [rosenpass, "gen-keys", "--force", "--secret-key", sk, "--public-key", pk],
+              check=True,
+          )
           machine.copy_from_host(sk, f"{etc}/pqsk")
           machine.copy_from_host(pk, f"{etc}/pqpk")
           remote.copy_from_host(pk, f"{etc}/peers/{name}/pqpk")
diff --git a/nixos/tests/utils/default.nix b/nixos/tests/utils/default.nix
index a7c5f242c822..fdcf766ffbac 100644
--- a/nixos/tests/utils/default.nix
+++ b/nixos/tests/utils/default.nix
@@ -1,5 +1,9 @@
-{ runTest }:
+{
+  callPackage,
+  runTest,
+}:
 
 {
   genJqSecretsReplacement = runTest ./genJqSecretsReplacement.nix;
+  mkStateRevisionOption = callPackage ./mkStateRevisionOption.nix { };
 }
diff --git a/nixos/tests/utils/mkStateRevisionOption.nix b/nixos/tests/utils/mkStateRevisionOption.nix
new file mode 100644
index 000000000000..b32a27cec266
--- /dev/null
+++ b/nixos/tests/utils/mkStateRevisionOption.nix
@@ -0,0 +1,39 @@
+{
+  emptyFile,
+  nixos,
+}:
+let
+  result = nixos (
+    { utils, ... }:
+    {
+      options = {
+        stateRevision1 = utils.mkStateRevisionOption {
+          descriptionName = "...";
+          migrations = {
+            "27.05" = "...";
+          };
+        };
+        stateRevision2 = utils.mkStateRevisionOption {
+          descriptionName = "...";
+          migrations = {
+            "26.11" = "...";
+          };
+        };
+        stateRevision3 = utils.mkStateRevisionOption {
+          descriptionName = "...";
+          migrations = {
+            "24.05" = "...";
+            "27.05" = "...";
+          };
+        };
+      };
+      config.system.stateVersion = "26.11";
+    }
+  );
+  inherit (result) config options;
+in
+assert config.stateRevision1 == 0;
+assert config.stateRevision2 == 1;
+assert config.stateRevision3 == 1;
+assert options.stateRevision1.migrations == { "27.05" = "..."; };
+emptyFile
diff --git a/pkgs/applications/audio/deadbeef/plugins/playlist-manager.nix b/pkgs/applications/audio/deadbeef/plugins/playlist-manager.nix
index 23e5d09955e6..6e75d3ee5475 100644
--- a/pkgs/applications/audio/deadbeef/plugins/playlist-manager.nix
+++ b/pkgs/applications/audio/deadbeef/plugins/playlist-manager.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation {
   pname = "deadbeef-playlist-manager-plugin";
-  version = "unstable-2021-05-02";
+  version = "1-unstable-2021-05-02";
 
   src = fetchFromGitHub {
     owner = "kpcee";
     repo = "deadbeef-playlist-manager";
     rev = "b1393022b2d9ea0a19b845420146e0fc56cd9c0a";
-    sha256 = "sha256-dsKthlQ0EuX4VhO8K9VTyX3zN8ytzDUbSi/xSMB4xRw=";
+    hash = "sha256-dsKthlQ0EuX4VhO8K9VTyX3zN8ytzDUbSi/xSMB4xRw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 85781847e374..64617dcc6b1c 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1190,8 +1190,8 @@ let
         mktplcRef = {
           publisher = "DanielSanMedium";
           name = "dscodegpt";
-          version = "3.24.39";
-          hash = "sha256-r1XkER09s+38uCbUxK9MM5bHRNp3UnMj6VJCHUMZM1Q=";
+          version = "3.24.43";
+          hash = "sha256-Y3pCg0qauVu4K6qz610QGRizyodnRpDigGSSIn6m6gw=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/DanielSanMedium.dscodegpt/changelog";
@@ -1242,8 +1242,8 @@ let
         mktplcRef = {
           name = "databricks";
           publisher = "databricks";
-          version = "2.12.4";
-          hash = "sha256-29xG0/AhBhidM8Hd7vHUWxESCDt8MwACIkBpmfvhD2Q=";
+          version = "2.13.0";
+          hash = "sha256-4Fa1UABo7JUO7+IECjsYEq9zyscHTGUlrUCa3aBdhoI=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/databricks.databricks/changelog";
diff --git a/pkgs/applications/editors/vscode/extensions/tekumara.typos-vscode/default.nix b/pkgs/applications/editors/vscode/extensions/tekumara.typos-vscode/default.nix
index f7aafb38d63a..abda3122d485 100644
--- a/pkgs/applications/editors/vscode/extensions/tekumara.typos-vscode/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/tekumara.typos-vscode/default.nix
@@ -14,15 +14,15 @@ let
     {
       x86_64-linux = {
         arch = "linux-x64";
-        hash = "sha256-jAQJh1JqomJDUFeb2N452ICo0azFelT8vHvEsBqXi8w=";
+        hash = "sha256-3FE2tZtkDZttZlD7foqt1qgcb1w37mT0/RC30HYEvNA=";
       };
       aarch64-linux = {
         arch = "linux-arm64";
-        hash = "sha256-Z3cRojI4mCCS2t3aLojgImULQOobq5liDwoeHuzKEhY=";
+        hash = "sha256-xxniWRtMkh3NE9OWJkR9xUARJTBnQkoTRlXrQa95K/k=";
       };
       aarch64-darwin = {
         arch = "darwin-arm64";
-        hash = "sha256-rHgMl71YCs9ea0nFnx+E2U8isL4zQzIvvE9tgxM7IiA=";
+        hash = "sha256-/pj6HPuqvAYXrBVX/FoOZRDYL5xvdnM+PPM27/5+hxw=";
       };
     }
     .${system} or (throw "Unsupported system: ${system}");
@@ -34,7 +34,7 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
     # Please update the corresponding binary (typos-lsp)
     # when updating this extension.
     # See pkgs/by-name/ty/typos-lsp/package.nix
-    version = "0.1.51";
+    version = "0.1.55";
     inherit (extInfo) hash arch;
   };
 
diff --git a/pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix b/pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix
index 7ccbd7c83281..6424a435994e 100644
--- a/pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/tombi-toml.tombi/default.nix
@@ -7,15 +7,15 @@
 let
   supported = {
     x86_64-linux = {
-      hash = "sha256-LuES+anP3Kd1uOZrteb3yy5nsec5gAX0PYeslJ8orBg=";
+      hash = "sha256-Fy745lZuOz7lLPRp6XXmHGr9asLj2kynlJbaHe6kgCg=";
       arch = "linux-x64";
     };
     aarch64-linux = {
-      hash = "sha256-vMLc5Yhtif8jN9V7DXER8BxFxYYv3sY7yKNMvse6CmQ=";
+      hash = "sha256-AULA4binavpDoxwpfpdBnl81HshNuChYiyOjte+aQw4=";
       arch = "linux-arm64";
     };
     aarch64-darwin = {
-      hash = "sha256-0ktwL6NkSGrpIUzc0IARoql2hxcluxvK0CTZkX4UEUE=";
+      hash = "sha256-DKu+dUPCDNOCm1KlpNIeIPmIAFYbVQLD8w4Q3dy3pPI=";
       arch = "darwin-arm64";
     };
   };
@@ -30,7 +30,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = base // {
     name = "tombi";
     publisher = "tombi-toml";
-    version = "1.2.5";
+    version = "1.2.8";
   };
   meta = {
     description = "TOML Language Server";
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index 2fe7c7ab6701..26ca26ba96be 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,10 +1,10 @@
 {
   "chromium": {
-    "version": "151.0.7922.108",
+    "version": "151.0.7922.137",
     "chromedriver": {
-      "version": "151.0.7922.109",
-      "hash_darwin": "sha256-VzMu90gOs02icI3PgvpNYXeE5c0QjCVB9CpM287roZo=",
-      "hash_darwin_aarch64": "sha256-5djEbPAayOVr8hr2VfXvlU4W6F+Kd/wiCt5NvQtgoOY="
+      "version": "151.0.7922.138",
+      "hash_darwin": "sha256-SW+gKW+GuPwVrJwFdFw6WmECOVXzfRT6tWCIRHoYrok=",
+      "hash_darwin_aarch64": "sha256-qUVhQo3JTPU5MP0RkVSAyk3iQTy/MWvE7Kab1BoI+Vg="
     },
     "deps": {
       "depot_tools": {
@@ -21,8 +21,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "4744b886309d987d292e43232776d2206cccb13d",
-        "hash": "sha256-1i2IAA5sXyMPBzh6xOIY3CllEDtIS9Buk8Z2Vm1JnYw=",
+        "rev": "8f5d36bc16f57115aeeff34baf4ad6aa964d509c",
+        "hash": "sha256-OSqLGAnfiGRVC4RRMnjXFx0JvKh2qY+9zlf2xJZT19Q=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -657,8 +657,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "86bb2f25f46f4d620b4a26e738f59a9b6c22d2eb",
-        "hash": "sha256-tnUcFuwWtw0uGNIsU38M54V1MAYFs7/2yjP9Cs1fEHo="
+        "rev": "66cca05ab345fb894cc80ed412e2fa79f687f5d9",
+        "hash": "sha256-lDMn7ReDCdGKGmypIZszE29DWGFebJemFPluKZYeg7k="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -827,8 +827,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "20ad8d002c17ccc7ccfbefc6c4dcf1242fe80921",
-        "hash": "sha256-J2dblSPMoZTpotDpuPp6beRYv+KtCirqNxEGEQKpqcQ="
+        "rev": "00c2754b59cf5f79b323950c63b07cfb1a8377d4",
+        "hash": "sha256-dXWiFX049YVnrtNdEznEiwT8lDyGJn9BEehB2yhCxqI="
       },
       "src/agents/shared": {
         "url": "https://chromium.googlesource.com/chromium/agents.git",
@@ -838,7 +838,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "151.0.7922.108",
+    "version": "151.0.7922.137",
     "deps": {
       "depot_tools": {
         "rev": "94e89b10b92cc9d6e58fc8d1b6474b7d29e8a114",
@@ -850,16 +850,16 @@
         "hash": "sha256-T2LdISIkp8fcUli5ZetTqrESBAc7coJhWdJv7I+o9kk="
       },
       "ungoogled-patches": {
-        "rev": "151.0.7922.108-1",
-        "hash": "sha256-EhnX4fkuKTTIF6wztKWitrjNzKUf36fAnr7lUkJqJtQ="
+        "rev": "151.0.7922.137-1",
+        "hash": "sha256-QIkhRquVqD22P1UBJ+Qv0LEI118v7PDt3hQCIl1ScQ4="
       },
       "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "4744b886309d987d292e43232776d2206cccb13d",
-        "hash": "sha256-1i2IAA5sXyMPBzh6xOIY3CllEDtIS9Buk8Z2Vm1JnYw=",
+        "rev": "8f5d36bc16f57115aeeff34baf4ad6aa964d509c",
+        "hash": "sha256-OSqLGAnfiGRVC4RRMnjXFx0JvKh2qY+9zlf2xJZT19Q=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -1494,8 +1494,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "86bb2f25f46f4d620b4a26e738f59a9b6c22d2eb",
-        "hash": "sha256-tnUcFuwWtw0uGNIsU38M54V1MAYFs7/2yjP9Cs1fEHo="
+        "rev": "66cca05ab345fb894cc80ed412e2fa79f687f5d9",
+        "hash": "sha256-lDMn7ReDCdGKGmypIZszE29DWGFebJemFPluKZYeg7k="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1664,8 +1664,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "20ad8d002c17ccc7ccfbefc6c4dcf1242fe80921",
-        "hash": "sha256-J2dblSPMoZTpotDpuPp6beRYv+KtCirqNxEGEQKpqcQ="
+        "rev": "00c2754b59cf5f79b323950c63b07cfb1a8377d4",
+        "hash": "sha256-dXWiFX049YVnrtNdEznEiwT8lDyGJn9BEehB2yhCxqI="
       },
       "src/agents/shared": {
         "url": "https://chromium.googlesource.com/chromium/agents.git",
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 3ef1c691bc9b..dd70143a541d 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -337,13 +337,13 @@
     "vendorHash": "sha256-fP6brpY/wRI1Yjgapzi+FfOci65gxWeOZulXbGdilrE="
   },
   "dnsimple_dnsimple": {
-    "hash": "sha256-8ZanbgHaszFiorzY/ulpVvUesmyx7O3SKXmwOi5WUSU=",
+    "hash": "sha256-YkoBGPcNKBeAHWcsRldHSsZ/hvWngCiySjK5zzI9jNE=",
     "homepage": "https://registry.terraform.io/providers/dnsimple/dnsimple",
     "owner": "dnsimple",
     "repo": "terraform-provider-dnsimple",
-    "rev": "v2.1.2",
+    "rev": "v2.2.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-1CpswocnTe6aj4TP7fMGy6mv0d/yX8FcYAKkAW5k7kk="
+    "vendorHash": "sha256-SuwDjQMgzcnNsBf/wXZvys6VINgnFeaWcV7jIMbNXo8="
   },
   "dnsmadeeasy_dme": {
     "hash": "sha256-JH9YcM9Fvd1x0BJpLUZCm6a9hZZxySrkFVLP89FO3fU=",
@@ -409,13 +409,13 @@
     "vendorHash": null
   },
   "fastly_fastly": {
-    "hash": "sha256-fblscW6k/iWGr3HTLASrfD11asYsssDuXkGUnzGoUFY=",
+    "hash": "sha256-n1C/sRIPaZJJ/0irMNhDbi+hzXaof0+Kgu7XgDkGS3o=",
     "homepage": "https://registry.terraform.io/providers/fastly/fastly",
     "owner": "fastly",
     "repo": "terraform-provider-fastly",
-    "rev": "v9.4.0",
+    "rev": "v9.6.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-DhETt9f9GaAI5V/A53H3Bhph9uZyffUM1bsWDrW4CLE="
+    "vendorHash": "sha256-tDiNj7Xbda10gUBYJ1bwzlYsrwa2ZSK9ZxsbXziI2pU="
   },
   "flexibleenginecloud_flexibleengine": {
     "hash": "sha256-yEZ9JiUSqFFbfqzOOD59ZBv4yFCeUBBKlp6aiUqDqiM=",
@@ -1247,13 +1247,13 @@
     "vendorHash": "sha256-gva4QLCNANCaDSjv84N2oFv9VlsU8oUZOUTx6nTRIcA="
   },
   "splunk-terraform_signalfx": {
-    "hash": "sha256-xdB2VAacBGFAeVd60Zy6MWSmx6BFJ7ciZKSTXYdRZY0=",
+    "hash": "sha256-KoPLEVzR/MtMTrufqvxrOuVsfjCUXQ9UMbqjosAy2oc=",
     "homepage": "https://registry.terraform.io/providers/splunk-terraform/signalfx",
     "owner": "splunk-terraform",
     "repo": "terraform-provider-signalfx",
-    "rev": "v9.33.0",
+    "rev": "v9.34.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-m7Op/K3Xo9nKgVg9bTHmpmPiFpCB6Ek/kgj76P+ViGQ="
+    "vendorHash": "sha256-mNEzE2eACy63BGoFOamG52JD8mvC7okhSN9hMuesTlg="
   },
   "spotinst_spotinst": {
     "hash": "sha256-pkYrrtsbIHSyy/TjoHBegrwwwIi6Vn6aT4Ic3C/QgyY=",
@@ -1283,11 +1283,11 @@
     "vendorHash": "sha256-nbiLH+J051XxTx+z8xGrp/DPYB7g9S4clFSWcZUKnAg="
   },
   "sysdiglabs_sysdig": {
-    "hash": "sha256-VeIgHhCHyNgAcv2NIBAWCJIwGHE3nqYeCxGd4VSUymU=",
+    "hash": "sha256-MfwzmTzikzZAg0U7W5Dmjww6Oadnr4Oq+uIQSZaRHEo=",
     "homepage": "https://registry.terraform.io/providers/sysdiglabs/sysdig",
     "owner": "sysdiglabs",
     "repo": "terraform-provider-sysdig",
-    "rev": "v3.9.0",
+    "rev": "v3.9.1",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-HjrB7C0KaLJz9NVLfZdq5EZbNbF9lJPxSkQwnWUF978="
   },
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-darkwindow.nix b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-darkwindow.nix
index c165932cf0b4..85d0fb434740 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-darkwindow.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hypr-darkwindow.nix
@@ -7,7 +7,7 @@
 
 mkHyprlandPlugin (finalAttrs: {
   pluginName = "hypr-darkwindow";
-  version = "0.56.1";
+  version = "0.56.2";
 
   src = fetchFromGitHub {
     owner = "micha4w";
diff --git a/pkgs/build-support/cc-wrapper/default.nix b/pkgs/build-support/cc-wrapper/default.nix
index bf079f1b0e53..d926d85425a3 100644
--- a/pkgs/build-support/cc-wrapper/default.nix
+++ b/pkgs/build-support/cc-wrapper/default.nix
@@ -804,9 +804,15 @@ stdenvNoCC.mkDerivation {
       include -cxx-isystem "${getDev libcxx}/include/c++/v1" >> $out/nix-support/libcxx-cxxflags
       echo "-stdlib=libc++" >> $out/nix-support/libcxx-ldflags
     ''
-    # GCC NG friendly libc++
+    # This is the GCC NG case, libstdc++ is being built as a separate package.
+    #
+    # Point at `include-cxx`, not `include`. `libcxx` is also a propagated
+    # target-target dep, so the generic setup hook puts its `include` on the *C*
+    # include path -- and libstdc++ ships headers named after C headers
+    # (`math.h`, `stdlib.h`, `stdckdint.h`, ...) that are only meant to shadow
+    # the C ones in C++. A sibling directory the setup hook ignores is enough.
     + optionalString (libcxx != null && libcxx.isGNU or false) ''
-      include -isystem "${getDev libcxx}/include" >> $out/nix-support/libcxx-cxxflags
+      include -isystem "${getDev libcxx}/include-cxx" >> $out/nix-support/libcxx-cxxflags
     ''
 
     ##
diff --git a/pkgs/by-name/_1/_1password-cli/package.nix b/pkgs/by-name/_1/_1password-cli/package.nix
index 6595b170e8e3..c1756687e2c5 100644
--- a/pkgs/by-name/_1/_1password-cli/package.nix
+++ b/pkgs/by-name/_1/_1password-cli/package.nix
@@ -24,13 +24,13 @@ let
     if extension == "zip" then fetchzip args else fetchurl args;
 
   pname = "1password-cli";
-  version = "2.34.1";
+  version = "2.38.1";
   sources = {
-    aarch64-linux = fetch "linux_arm64" "sha256-uEukRq71eeayvNguD9XepvP1Br5AkE2Ag/Chv2idf4A=" "zip";
-    i686-linux = fetch "linux_386" "sha256-p/F3YZLJnlimrVE2qxTHvIB4m47kuwhoCWTC40VIvMs=" "zip";
-    x86_64-linux = fetch "linux_amd64" "sha256-oAABMlwwv5X91TT6FK2aPpg+e2CvmHT1rqIVRTjQNCQ=" "zip";
+    aarch64-linux = fetch "linux_arm64" "sha256-RmpJkrrLrKwbmbw50+sTg0aFa0+M2EFPZ6+QSc3aV5M=" "zip";
+    i686-linux = fetch "linux_386" "sha256-hnpVsbNgofmfw/XobVZ2MnbGIcAjxH1MvVJNc5T1kuk=" "zip";
+    x86_64-linux = fetch "linux_amd64" "sha256-k268YiTC/2MJZhVqMI/e9bsrf4Sr4Wj8M/h/hbmmcqY=" "zip";
     aarch64-darwin =
-      fetch "apple_universal" "sha256-vp1Y1M6DUanx1CAVhLrqgBovwws6Y/5jOgnwTZE8Hhc="
+      fetch "apple_universal" "sha256-pLlEsqCL5j9QCuLkQxK/Mmz647lKbCYhOUiPch2MMuE="
         "pkg";
   };
   platforms = builtins.attrNames sources;
diff --git a/pkgs/by-name/_1/_1password-cli/update.sh b/pkgs/by-name/_1/_1password-cli/update.sh
index 4f04279fcea6..0ef07bf6ab48 100755
--- a/pkgs/by-name/_1/_1password-cli/update.sh
+++ b/pkgs/by-name/_1/_1password-cli/update.sh
@@ -27,7 +27,7 @@ replace_sha() {
   sed -i "s|\"$1\" \"sha256-.\{44\}\"|\"$1\" \"$2\"|" "$NIX_DRV"
 }
 
-CLI_VERSION="$(curl -Ls https://app-updates.agilebits.com/product_history/CLI2 | xq -q 'h3' | head -n1)"
+CLI_VERSION="$(curl -Ls https://app-updates.agilebits.com/product_history/CLI2 | xq -q 'article:not(.beta) h3' | head -n1)"
 
 CLI_LINUX_AARCH64_SHA256=$(fetch_linux "$CLI_VERSION" "linux_arm64")
 CLI_LINUX_I686_SHA256=$(fetch_linux "$CLI_VERSION" "linux_386")
diff --git a/pkgs/by-name/ak/aks-mcp-server/package.nix b/pkgs/by-name/ak/aks-mcp-server/package.nix
index 49cee658330d..3d27238a9789 100644
--- a/pkgs/by-name/ak/aks-mcp-server/package.nix
+++ b/pkgs/by-name/ak/aks-mcp-server/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "aks-mcp-server";
-  version = "0.0.19";
+  version = "0.0.20";
 
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "aks-mcp";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Zu/caWrTuyzS4ejJ5LTOCyLTsmJOFrkX0kUGM0zDfFs=";
+    hash = "sha256-K0BVDH0HT4kQBGMpVDtLihDCPlpcVpdGEF7f5DY8SvQ=";
   };
 
-  vendorHash = "sha256-eipcHVKKHBOey2fUGB4lf2pE/wdwGgsbYvCrvDG1JK8=";
+  vendorHash = "sha256-EdDiLibw3OXtTmAaD6PIi6xiW7+x8TUeAezdjpu8IjY=";
 
   subPackages = [ "cmd/aks-mcp" ];
 
diff --git a/pkgs/by-name/ar/arcanist/package.nix b/pkgs/by-name/ar/arcanist/package.nix
index 4c76f60e4fb6..287a40c7d53c 100644
--- a/pkgs/by-name/ar/arcanist/package.nix
+++ b/pkgs/by-name/ar/arcanist/package.nix
@@ -57,7 +57,7 @@ stdenv.mkDerivation {
     php
   ];
 
-  postPatch = lib.optionalString stdenv.isAarch64 ''
+  postPatch = lib.optionalString stdenv.hostPlatform.isAarch64 ''
     substituteInPlace support/xhpast/Makefile \
       --replace "-minline-all-stringops" ""
   '';
diff --git a/pkgs/by-name/aw/awk-language-server/package.nix b/pkgs/by-name/aw/awk-language-server/package.nix
index 0d16e1e253aa..d0c861ef3ade 100644
--- a/pkgs/by-name/aw/awk-language-server/package.nix
+++ b/pkgs/by-name/aw/awk-language-server/package.nix
@@ -12,7 +12,7 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  name = "awk-language-server";
+  pname = "awk-language-server";
   version = "0.10.6";
 
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/bl/blast/package.nix b/pkgs/by-name/bl/blast/package.nix
index 7096ef83ed36..32480e38aac6 100644
--- a/pkgs/by-name/bl/blast/package.nix
+++ b/pkgs/by-name/bl/blast/package.nix
@@ -105,7 +105,7 @@ stdenv.mkDerivation (finalAttrs: {
     bzip2
     sqlite
   ]
-  ++ lib.optionals stdenv.isDarwin [
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     llvmPackages.openmp
   ];
 
diff --git a/pkgs/by-name/ca/cargo-chef/package.nix b/pkgs/by-name/ca/cargo-chef/package.nix
index 9936be8c8032..23f14bdbec5f 100644
--- a/pkgs/by-name/ca/cargo-chef/package.nix
+++ b/pkgs/by-name/ca/cargo-chef/package.nix
@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-chef";
-  version = "0.1.77";
+  version = "0.1.78";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-R2on81B11ploV9QwiV5VCvRUCLQWbP21dazNliqkhGA=";
+    hash = "sha256-gFtmKaznJNlmhlCzpHraEdZfDV5fAwYVphJo29qcftw=";
   };
 
-  cargoHash = "sha256-iOZjyqoykCwrNsXN7nMF6deuSSlyD6r2+atxPeNmX2c=";
+  cargoHash = "sha256-m29qIc/TsmropBMFeyEPIWwQgFh9PKqUexFRrbGFHSg=";
 
   meta = {
     description = "Cargo-subcommand to speed up Rust Docker builds using Docker layer caching";
diff --git a/pkgs/by-name/ca/cargo-rdme/package.nix b/pkgs/by-name/ca/cargo-rdme/package.nix
index 6cea4afc2800..cc681ad2c34c 100644
--- a/pkgs/by-name/ca/cargo-rdme/package.nix
+++ b/pkgs/by-name/ca/cargo-rdme/package.nix
@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-rdme";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-U5JD3VMuIagaMKxHoRRhbFyl7keuaJ0zNzD3Hjhxe/Y=";
+    hash = "sha256-f0MxJVWTcBNiURJFE60Xbv0/xcj51ZoZmJEzvIP79f4=";
   };
 
-  cargoHash = "sha256-Es1K4MmThAS9whsfSQ8dUtjPjunCDCQc5FU8vsbeJPw=";
+  cargoHash = "sha256-U2tw/tzFSktrKAIUk4fxyRCMVuw98uHXDkZ/YpC2aCA=";
 
   meta = {
     description = "Cargo command to create the README.md from your crate's documentation";
diff --git a/pkgs/by-name/ca/carps-cups/package.nix b/pkgs/by-name/ca/carps-cups/package.nix
index efed07a5e156..6b27271c275e 100644
--- a/pkgs/by-name/ca/carps-cups/package.nix
+++ b/pkgs/by-name/ca/carps-cups/package.nix
@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation {
   pname = "carps-cups";
-  version = "unstable-2018-03-05";
+  version = "0-unstable-2018-03-05";
 
   src = fetchFromGitHub {
     owner = "ondrej-zary";
@@ -35,8 +35,8 @@ stdenv.mkDerivation {
 
   meta = {
     description = "CUPS Linux drivers for Canon printers";
-    homepage = "https://www.canon.com/";
-    license = lib.licenses.gpl3Plus;
+    homepage = "https://github.com/ondrej-zary/carps-cups";
+    license = lib.licenses.gpl3Only;
     broken = stdenv.hostPlatform.isDarwin;
     maintainers = with lib.maintainers; [
       ewok
diff --git a/pkgs/by-name/ch/chirpstack-mqtt-forwarder/package.nix b/pkgs/by-name/ch/chirpstack-mqtt-forwarder/package.nix
index 93dfb45c5c24..020d80780142 100644
--- a/pkgs/by-name/ch/chirpstack-mqtt-forwarder/package.nix
+++ b/pkgs/by-name/ch/chirpstack-mqtt-forwarder/package.nix
@@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "chirpstack-mqtt-forwarder";
-  version = "4.6.0";
+  version = "4.6.1";
 
   src = fetchFromGitHub {
     owner = "chirpstack";
     repo = "chirpstack-mqtt-forwarder";
     rev = "v${version}";
-    hash = "sha256-frEwQrGfB1J7ZY5jSkmgAyyCJwWUyu29QuZqMWlOPSk=";
+    hash = "sha256-xt94DxiDkyS0o9sSV6ye1vRi08ey4rmh1acpNI38fUE=";
   };
 
-  cargoHash = "sha256-5/8f5eSLfCu8fOfT+jTEfJj+fSB6rJt34C6eJwyFIfo=";
+  cargoHash = "sha256-qGN6AhPV6EOEo5xdwlHCENUmKzWhquOXCvXP7X0Y2WE=";
 
   nativeBuildInputs = [ protobuf ];
 
diff --git a/pkgs/by-name/ch/chrony/package.nix b/pkgs/by-name/ch/chrony/package.nix
index 9a8cda9e9610..892ae4217962 100644
--- a/pkgs/by-name/ch/chrony/package.nix
+++ b/pkgs/by-name/ch/chrony/package.nix
@@ -77,7 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
         darwin
         illumos
       ];
-    broken = stdenv.isDarwin;
+    broken = stdenv.hostPlatform.isDarwin;
     maintainers = with lib.maintainers; [
       thoughtpolice
       vifino
diff --git a/pkgs/by-name/cp/cpond/package.nix b/pkgs/by-name/cp/cpond/package.nix
index 95fb3e96bd1b..733478e6ecdf 100644
--- a/pkgs/by-name/cp/cpond/package.nix
+++ b/pkgs/by-name/cp/cpond/package.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
     substituteInPlace Makefile \
       --replace-fail '$(eflags)$(ncursesw_macros)' '$(eflags) $(ncursesw_macros)'
   ''
-  + lib.optionalString stdenv.isDarwin ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
     substituteInPlace Makefile \
       --replace-fail '-lncursesw' '-lncurses'
   '';
diff --git a/pkgs/by-name/cr/croncpp/package.nix b/pkgs/by-name/cr/croncpp/package.nix
index 5f41addad414..981e8edc6601 100644
--- a/pkgs/by-name/cr/croncpp/package.nix
+++ b/pkgs/by-name/cr/croncpp/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "croncpp";
-  version = "2023.03.30";
+  version = "2026.08.12";
 
   src = fetchFromGitHub {
     owner = "mariusbancila";
     repo = "croncpp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SBjNzy54OGEMemBp+c1gaH90Dc7ySL915z4E64cBWTI=";
+    hash = "sha256-qdl9494mpmozt6Rmd20MUeGeILWmNGHaxDgW2JnlUvs=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/cs/csfml_2/package.nix b/pkgs/by-name/cs/csfml_2/package.nix
index 0011871c2bb7..f0f169dc97c0 100644
--- a/pkgs/by-name/cs/csfml_2/package.nix
+++ b/pkgs/by-name/cs/csfml_2/package.nix
@@ -42,6 +42,6 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     license = lib.licenses.zlib;
     maintainers = [ lib.maintainers.jpdoyle ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
 })
diff --git a/pkgs/by-name/da/davinci-resolve/package.nix b/pkgs/by-name/da/davinci-resolve/package.nix
index 0569e5991ab3..fa369141cf79 100644
--- a/pkgs/by-name/da/davinci-resolve/package.nix
+++ b/pkgs/by-name/da/davinci-resolve/package.nix
@@ -56,7 +56,7 @@ let
   davinci = (
     stdenv.mkDerivation rec {
       pname = "davinci-resolve${lib.optionalString studioVariant "-studio"}";
-      version = "21.0.3";
+      version = "21.0.4";
 
       nativeBuildInputs = [
         appimageTools.appimage-exec
@@ -78,9 +78,9 @@ let
             outputHashAlgo = "sha256";
             outputHash =
               if studioVariant then
-                "sha256-pEJF+FQlBngEi5YlKq/pFNCzBiQgqjQrTnfrlKEEi6s="
+                "sha256-FwaSnK3DAIRGCz6kiWxE4o0Cd0en2qoyuWCDHat1xHQ="
               else
-                "sha256-3SymaLm3ibyk8yOWcUS9fOfnKEmgVA5XXc5tls27qfo=";
+                "sha256-oX/abUHhnl1AW3xb53x8l7WIdSKc9e2Ocp0qtGAOv/A=";
 
             impureEnvVars = lib.fetchers.proxyImpureEnvVars;
 
diff --git a/pkgs/by-name/de/dejagnu/package.nix b/pkgs/by-name/de/dejagnu/package.nix
index c0fc616b9892..ced881d1030f 100644
--- a/pkgs/by-name/de/dejagnu/package.nix
+++ b/pkgs/by-name/de/dejagnu/package.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
   configureScript = "../configure";
 
-  doCheck = !(with stdenv; isDarwin && isAarch64);
+  doCheck = !(with stdenv.hostPlatform; isDarwin && isAarch64);
 
   # Note: The test-suite *requires* /dev/pts among the `build-chroot-dirs' of
   # the build daemon when building in a chroot.  See
diff --git a/pkgs/by-name/di/disko/package.nix b/pkgs/by-name/di/disko/package.nix
index 8e76815b5976..692ebc38d660 100644
--- a/pkgs/by-name/di/disko/package.nix
+++ b/pkgs/by-name/di/disko/package.nix
@@ -28,7 +28,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     cp -r install-cli.nix cli.nix default.nix disk-deactivate lib $out/share/disko
 
     scripts=(disko)
-    ${lib.optionalString (!stdenvNoCC.isDarwin) ''
+    ${lib.optionalString (!stdenvNoCC.hostPlatform.isDarwin) ''
       scripts+=(disko-install)
     ''}
 
@@ -44,7 +44,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
               coreutils
               xcp
             ]
-            ++ lib.optional (!stdenvNoCC.isDarwin) nixos-install
+            ++ lib.optional (!stdenvNoCC.hostPlatform.isDarwin) nixos-install
           )
         }
     done
@@ -54,7 +54,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   installCheckPhase = ''
     runHook preInstallCheck
     $out/bin/disko --help
-    ${lib.optionalString (!stdenvNoCC.isDarwin) ''
+    ${lib.optionalString (!stdenvNoCC.hostPlatform.isDarwin) ''
       $out/bin/disko-install --help
     ''}
     runHook postInstallCheck
diff --git a/pkgs/by-name/ee/eepers/package.nix b/pkgs/by-name/ee/eepers/package.nix
index eed8e26e1191..2f1ed5700410 100644
--- a/pkgs/by-name/ee/eepers/package.nix
+++ b/pkgs/by-name/ee/eepers/package.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postBuild
   '';
 
-  postFixup = lib.optionalString stdenv.isLinux ''
+  postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
     patchelf $out/bin/eepers \
       --add-needed libwayland-client.so \
       --add-needed libwayland-cursor.so \
diff --git a/pkgs/by-name/fr/freifunk-meshviewer/package.nix b/pkgs/by-name/fr/freifunk-meshviewer/package.nix
index 30aa0fb80645..712ea00afd05 100644
--- a/pkgs/by-name/fr/freifunk-meshviewer/package.nix
+++ b/pkgs/by-name/fr/freifunk-meshviewer/package.nix
@@ -7,7 +7,7 @@
 buildNpmPackage (finalAttrs: {
   pname = "freifunk-meshviewer";
 
-  version = "13.1.0";
+  version = "13.2.0";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -16,10 +16,10 @@ buildNpmPackage (finalAttrs: {
     owner = "freifunk";
     repo = "meshviewer";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-u9lX7B402KFOHyaReyg3f5rDYDshbO/lyMYo7XxgJR8=";
+    sha256 = "sha256-ni5Ln9K+Bqq88oi+nwOyCqibJz3TesVreHDWEec6Xzk=";
   };
 
-  npmDepsHash = "sha256-BaFtFdOu+WArH75nPtasSpecdGjMxTchFcF+K7krNpM=";
+  npmDepsHash = "sha256-gdGaJSwT5EYcrL/VBId4c6VFmyEbQ9v2LEJP1jc8yO8=";
 
   installPhase = ''
     mkdir -p $out/share/freifunk-meshviewer/
diff --git a/pkgs/by-name/gc/gcli/package.nix b/pkgs/by-name/gc/gcli/package.nix
index 9f1ea40297f7..e8b20d046b56 100644
--- a/pkgs/by-name/gc/gcli/package.nix
+++ b/pkgs/by-name/gc/gcli/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gcli";
-  version = "2.12.0";
+  version = "2.13.0";
 
   src = fetchFromSourcehut {
     owner = "~herrhotzenplotz";
     repo = "gcli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-k691ocg5rkvGJZDp6X9PRIDaNvVPLcJRoXvwPbyxjLE=";
+    hash = "sha256-Ow899ehIln+2E5j/MNA7XCRSBNCeaJ16ePR/u0qXvos=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gx/gxmatcheq-lv2/package.nix b/pkgs/by-name/gx/gxmatcheq-lv2/package.nix
index a687a0e2c1bb..c81753a5df49 100644
--- a/pkgs/by-name/gx/gxmatcheq-lv2/package.nix
+++ b/pkgs/by-name/gx/gxmatcheq-lv2/package.nix
@@ -1,20 +1,15 @@
 {
   lib,
   stdenv,
-  gcc13Stdenv,
   fetchFromGitHub,
+  fetchpatch,
   libx11,
   xorgproto,
   cairo,
   lv2,
   pkg-config,
 }:
-let
-  # see: https://github.com/brummer10/GxMatchEQ.lv2/issues/8
-  # Use gcc13 on Linux, but default stdenv (clang) elsewhere
-  buildStdenv = if stdenv.hostPlatform.isLinux then gcc13Stdenv else stdenv;
-in
-buildStdenv.mkDerivation (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
   pname = "GxMatchEQ.lv2";
   version = "0.1";
 
@@ -25,6 +20,22 @@ buildStdenv.mkDerivation (finalAttrs: {
     hash = "sha256-4jg6DYkNRuNuQpOnsZfwJAZljBmBRzS6NcJKjv+r7Ss=";
   };
 
+  patches = [
+    # _LV2UI_Descriptor was mistakenly used instead of LV2UI_Descriptor in one
+    # signature.
+    (fetchpatch {
+      name = "use-lv2ui_descriptor-name.patch";
+      url = "https://github.com/brummer10/GxMatchEQ.lv2/commit/4ca70be32220729a5253c0bb46f5aded5ba3d00a.patch";
+      hash = "sha256-EKlv6UptUpP+LOG7S30L21o0/upeDj6WB1PZ44XtNRU=";
+    })
+  ];
+
+  # without the Xresource.h header, compilation on gcc versions > 13 fails with
+  # gui/gx_matcheq_x11ui.c:360:27: error: implicit declaration of function 'XrmUniqueQuark' [-Wimplicit-function-declaration]
+  postPatch = ''
+    sed -e '1i #include <X11/Xresource.h>' -i gui/gx_matcheq_x11ui.c
+  '';
+
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     libx11
diff --git a/pkgs/by-name/ha/handheld-daemon-ui/package.nix b/pkgs/by-name/ha/handheld-daemon-ui/package.nix
index 8219a4e1d25c..24247f3457f5 100644
--- a/pkgs/by-name/ha/handheld-daemon-ui/package.nix
+++ b/pkgs/by-name/ha/handheld-daemon-ui/package.nix
@@ -33,7 +33,7 @@ appimageTools.wrapType2 {
   meta = {
     description = "UI for the Handheld Daemon";
     homepage = "https://github.com/hhd-dev/hhd-ui";
-    license = lib.licenses.gpl3Only;
+    license = lib.licenses.lgpl21Plus;
     maintainers = with lib.maintainers; [ toast ];
     mainProgram = "hhd-ui";
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/by-name/hu/hunk/package.nix b/pkgs/by-name/hu/hunk/package.nix
index d3a07d79ee59..51ce4609c060 100644
--- a/pkgs/by-name/hu/hunk/package.nix
+++ b/pkgs/by-name/hu/hunk/package.nix
@@ -71,6 +71,16 @@ stdenv.mkDerivation {
     writableTmpDirAsHomeHook
   ];
 
+  # Teach `hunk skill path` to find the FHS layout under share/skills/$pname
+  # (https://github.com/NixOS/nixpkgs/issues/547426) instead of $out/skills.
+  postPatch = ''
+    substituteInPlace src/core/paths.ts \
+      --replace-fail \
+        'join("node_modules", "hunkdiff", HUNK_REVIEW_SKILL_RELATIVE_PATH),' \
+        'join("node_modules", "hunkdiff", HUNK_REVIEW_SKILL_RELATIVE_PATH),
+    join("share", "skills", "hunk", "hunk-review", "SKILL.md"),'
+  '';
+
   configurePhase = ''
     runHook preConfigure
 
@@ -100,9 +110,8 @@ stdenv.mkDerivation {
     runHook preInstall
 
     install -Dm755 hunk $out/bin/hunk
-    mkdir -p $out/share/hunk
-    cp -R skills $out/share/hunk/skills
-    ln -s share/hunk/skills $out/skills
+    mkdir -p $out/share/skills/hunk/hunk-review
+    cp skills/hunk-review/SKILL.md $out/share/skills/hunk/hunk-review/SKILL.md
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/ke/keepassxc-go/package.nix b/pkgs/by-name/ke/keepassxc-go/package.nix
index e39c4d894dd9..11356e8dcbfa 100644
--- a/pkgs/by-name/ke/keepassxc-go/package.nix
+++ b/pkgs/by-name/ke/keepassxc-go/package.nix
@@ -8,18 +8,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "keepassxc-go";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "MarkusFreitag";
     repo = "keepassxc-go";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Z4SbPxhs+umsUlby7idxofCjP+uLPvp/2oUCpnAS2/A=";
+    hash = "sha256-0VQw12o4XTzKOz+45sHIKSsIjBxDcdxtgYUItFznsO4=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
 
-  vendorHash = "sha256-+cgf2FxpbLu+Yuhk6T0ZBnDH7We2DVu65xFaruk9I0E=";
+  vendorHash = "sha256-p7Lj2x0+F3kmAMi+2gtBYkg1w8jmgWm3kgYAoIagERs=";
 
   checkFlags = [
     # Test tries to monkey-patch the stdlib, fails with permission denied error.
diff --git a/pkgs/by-name/ke/keepmenu/package.nix b/pkgs/by-name/ke/keepmenu/package.nix
index 76645611964f..9468e009466e 100644
--- a/pkgs/by-name/ke/keepmenu/package.nix
+++ b/pkgs/by-name/ke/keepmenu/package.nix
@@ -10,14 +10,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "keepmenu";
-  version = "1.4.2";
+  version = "1.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "firecat53";
     repo = "keepmenu";
     rev = finalAttrs.version;
-    hash = "sha256-Kzt2RqyYvOWnbkflwTHzlnpUaruVQvdGys57DDpH9o8=";
+    hash = "sha256-MUtwQ9V5PcczR2mISMs8EcFGkDAPmuYSvNW+COC4Bhw=";
   };
 
   nativeBuildInputs = with python3Packages; [
diff --git a/pkgs/by-name/kr/krunkit/package.nix b/pkgs/by-name/kr/krunkit/package.nix
index 8048432093ba..ed2a5da280f2 100644
--- a/pkgs/by-name/kr/krunkit/package.nix
+++ b/pkgs/by-name/kr/krunkit/package.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
   dontStrip = true;
 
   passthru = {
-    tests.boot = lib.optional stdenv.isDarwin (
+    tests.boot = lib.optional stdenv.hostPlatform.isDarwin (
       callPackage ./boot-test.nix { krunkit = finalAttrs.finalPackage; }
     );
     updateScript = nix-update-script { };
diff --git a/pkgs/by-name/la/lasuite-meet/frontend.nix b/pkgs/by-name/la/lasuite-meet/frontend.nix
index 56871f8a9134..80a000547394 100644
--- a/pkgs/by-name/la/lasuite-meet/frontend.nix
+++ b/pkgs/by-name/la/lasuite-meet/frontend.nix
@@ -17,7 +17,7 @@ buildNpmPackage (finalAttrs: {
       src
       sourceRoot
       ;
-    hash = "sha256-PArNKjdLqKJSEEKe94mguzKiNSwpYk56inenU3GL1mI=";
+    hash = "sha256-ZvdfLM0GlIZPaKbpDK9ymSgARVMsJE+cop8lKq3R7fE=";
   };
   npmBuildScript = "build";
 
diff --git a/pkgs/by-name/la/lasuite-meet/mail.nix b/pkgs/by-name/la/lasuite-meet/mail.nix
index d1e8e4634d60..dc03dc73bbf5 100644
--- a/pkgs/by-name/la/lasuite-meet/mail.nix
+++ b/pkgs/by-name/la/lasuite-meet/mail.nix
@@ -22,7 +22,7 @@ buildNpmPackage (finalAttrs: {
     pname = "${finalAttrs.pname}-npm-deps";
     inherit version src;
     inherit (finalAttrs) sourceRoot;
-    hash = "sha256-rqtLjMp0nCfo1wDAeB5WxVtmL/TR3Ky3qaMaBohnH1M=";
+    hash = "sha256-Ojk0giCc7tTFAGOIisirMywfe5j7JCKoTnWGk/hR+U8=";
   };
   npmBuildScript = "build";
 
diff --git a/pkgs/by-name/la/lasuite-meet/package.nix b/pkgs/by-name/la/lasuite-meet/package.nix
index 188830cf085b..f27c946dd496 100644
--- a/pkgs/by-name/la/lasuite-meet/package.nix
+++ b/pkgs/by-name/la/lasuite-meet/package.nix
@@ -6,13 +6,13 @@
   python3,
 }:
 let
-  version = "1.25.2";
+  version = "1.26.0";
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "meet";
     tag = "v${version}";
-    hash = "sha256-gtChKd6sr2nHEmi0Z/nbuCCNsOD8iVIAFjqonZFgQ/Y=";
+    hash = "sha256-WiyVSqkyKDXYYPvzcA/fHcxQJrUThNGfNu+z/KcHK3g=";
   };
 
   meta = {
diff --git a/pkgs/by-name/la/lazygit/package.nix b/pkgs/by-name/la/lazygit/package.nix
index 992226a265ab..37e92d69d113 100644
--- a/pkgs/by-name/la/lazygit/package.nix
+++ b/pkgs/by-name/la/lazygit/package.nix
@@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "lazygit";
-  version = "0.64.0";
+  version = "0.64.1";
 
   src = fetchFromGitHub {
     owner = "jesseduffield";
     repo = "lazygit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iN1QEZBS4TxfBMe3+NoYx33wIrgLUSG7I8rNBSTinfc=";
+    hash = "sha256-UYyIrSHk+efKvHvxQs7FsOGA7e0uM9mg+1O1WRJIeEU=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/li/libertinus/package.nix b/pkgs/by-name/li/libertinus/package.nix
index ea11f10d53c0..94d23a1e7d8d 100644
--- a/pkgs/by-name/li/libertinus/package.nix
+++ b/pkgs/by-name/li/libertinus/package.nix
@@ -6,12 +6,15 @@
   zstd,
 }:
 
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "libertinus";
   version = "7.051";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src = fetchurl {
-    url = "https://github.com/alerque/libertinus/releases/download/v${version}/Libertinus-${version}.tar.zst";
+    url = "https://github.com/alerque/libertinus/releases/download/v${finalAttrs.version}/Libertinus-${finalAttrs.version}.tar.zst";
     hash = "sha256-JQZ3ySnTd1owkTZDWUN5ryZKwu8oAQNaody+MLm+I6Y=";
   };
 
@@ -38,4 +41,4 @@ stdenvNoCC.mkDerivation rec {
     maintainers = with lib.maintainers; [ siddharthist ];
     platforms = lib.platforms.all;
   };
-}
+})
diff --git a/pkgs/by-name/li/libjxl/package.nix b/pkgs/by-name/li/libjxl/package.nix
index c9bd4d79d174..92806f98b041 100644
--- a/pkgs/by-name/li/libjxl/package.nix
+++ b/pkgs/by-name/li/libjxl/package.nix
@@ -173,7 +173,7 @@ stdenv.mkDerivation rec {
 
   # FIXME x86_64-darwin:
   # https://github.com/NixOS/nixpkgs/pull/204030#issuecomment-1352768690
-  doCheck = with stdenv; !(hostPlatform.isi686 || isDarwin && isx86_64);
+  doCheck = with stdenv.hostPlatform; !(isi686 || isDarwin && isx86_64);
 
   disabledTests = lib.optionals stdenv.hostPlatform.isBigEndian [
     # https://github.com/libjxl/libjxl/issues/3629
diff --git a/pkgs/by-name/li/libretro-shaders-slang/package.nix b/pkgs/by-name/li/libretro-shaders-slang/package.nix
index ba57b54b7425..9699ce15d038 100644
--- a/pkgs/by-name/li/libretro-shaders-slang/package.nix
+++ b/pkgs/by-name/li/libretro-shaders-slang/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "libretro-shaders-slang";
-  version = "0-unstable-2026-08-03";
+  version = "0-unstable-2026-08-08";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "slang-shaders";
-    rev = "620114039b453ebb2e3de1a5846b0d9b05676bf4";
-    hash = "sha256-ox5Mo9ShWAVQDT6tboA72Mugny3aCQaN1QLpTs4bR6Y=";
+    rev = "a7f04a0698908015c6f9e3a3f446b3d17083269c";
+    hash = "sha256-Zz5EqEyGZwMZcFgowUpW2b3/cRcmOHL5R/Z78sg4dm8=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/li/libtorrent-rakshasa/package.nix b/pkgs/by-name/li/libtorrent-rakshasa/package.nix
index 72edce1f6f01..d2e05ad6560a 100644
--- a/pkgs/by-name/li/libtorrent-rakshasa/package.nix
+++ b/pkgs/by-name/li/libtorrent-rakshasa/package.nix
@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libtorrent-rakshasa";
-  version = "0.16.19";
+  version = "0.16.20";
 
   __structuredAttrs = true;
 
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "rakshasa";
     repo = "libtorrent";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-D+RPDp8r2ZKhNpiLKpm269h/5MBN+QhHf/qeXEzM92M=";
+    hash = "sha256-PEldSXGOFCOa1zo/9wT3efUvf3ZZ9gqZLqioXOdFnt0=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/li/limitcpu/package.nix b/pkgs/by-name/li/limitcpu/package.nix
index 8f9919765675..10ab5b831da5 100644
--- a/pkgs/by-name/li/limitcpu/package.nix
+++ b/pkgs/by-name/li/limitcpu/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-Wf/rGjUXr+RZmHFL6EGSYKQ2MvfOwI8LAmwezN/1fPw=";
   };
 
-  buildFlags = with stdenv; [
+  buildFlags = with stdenv.hostPlatform; [
     (
       if isDarwin then
         "osx"
diff --git a/pkgs/by-name/lu/luwen/package.nix b/pkgs/by-name/lu/luwen/package.nix
index f9a80ad2fa3c..706f584d8d59 100644
--- a/pkgs/by-name/lu/luwen/package.nix
+++ b/pkgs/by-name/lu/luwen/package.nix
@@ -6,21 +6,21 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "luwen";
-  version = "0.8.5";
+  version = "0.9.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "tenstorrent";
     repo = "luwen";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lY7cZ+8C0UEGGYxufl4Vi8g0L4AJFXaGqn7XE2ivTcQ=";
+    hash = "sha256-pc/7G9YxBTg2uYn47ONxI7zsfdK3Ex4zndLASRtDQyk=";
   };
 
   nativeBuildInputs = [
     protobuf
   ];
 
-  cargoHash = "sha256-QBGXbRiBk4WIQFopq1OccmUHgx5GzR/PKhMH4Ie+fyg=";
+  cargoHash = "sha256-2ibAZnfv++eyCB57F0uD7XFJ3MP9SnAApOn6uelo3Po=";
 
   meta = {
     description = "Tenstorrent system interface tools";
diff --git a/pkgs/by-name/ma/mailspring/mailsync.nix b/pkgs/by-name/ma/mailspring/mailsync.nix
index 6f77d031ec29..49197fc78ed2 100644
--- a/pkgs/by-name/ma/mailspring/mailsync.nix
+++ b/pkgs/by-name/ma/mailspring/mailsync.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation {
     cmake
     pkg-config
   ]
-  ++ lib.optionals stdenv.isLinux [
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
     autoPatchelfHook
   ];
 
@@ -64,7 +64,7 @@ stdenv.mkDerivation {
     xz
     zlib
   ]
-  ++ lib.optionals stdenv.isDarwin [
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv
   ];
 
@@ -99,7 +99,7 @@ stdenv.mkDerivation {
     # Transforms 'NAMES libfoo.a libfoo' into 'NAMES foo'
     sed -i -E 's/NAMES lib([a-zA-Z0-9]+)\.a lib\1/NAMES \1/g' CMakeLists.txt
   ''
-  + lib.optionalString stdenv.isDarwin ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
     # UUID_LIB is provided by system frameworks
     substituteInPlace CMakeLists.txt \
       --replace-fail "find_library(UUID_LIB NAMES uuid)" "set(UUID_LIB \"\")"
diff --git a/pkgs/by-name/me/megabasterd/package.nix b/pkgs/by-name/me/megabasterd/package.nix
index 7c1e2b8d6ce4..41dd23b5e871 100644
--- a/pkgs/by-name/me/megabasterd/package.nix
+++ b/pkgs/by-name/me/megabasterd/package.nix
@@ -6,7 +6,7 @@
   maven,
 }:
 let
-  version = "8.57";
+  version = "8.58";
 in
 maven.buildMavenPackage {
   pname = "megabasterd";
@@ -16,7 +16,7 @@ maven.buildMavenPackage {
     owner = "tonikelope";
     repo = "megabasterd";
     tag = "v${version}";
-    hash = "sha256-6PKBzQA3lBa9/7J8bymGmnW3OPsRV4GgZ7dc7H6fOuE=";
+    hash = "sha256-cF0OU/b4BthRmWYUB0ZjE/gRO//T73njgp3iZt+USgA=";
   };
 
   mvnHash = "sha256-JZ8INISDHPVhxylKwQc2DybPqxfwcGpkWxDhq8Fpqt8=";
diff --git a/pkgs/by-name/me/metapac/package.nix b/pkgs/by-name/me/metapac/package.nix
index 3d59bf23ceca..69fe834a5b50 100644
--- a/pkgs/by-name/me/metapac/package.nix
+++ b/pkgs/by-name/me/metapac/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "metapac";
-  version = "0.10.0";
+  version = "0.10.1";
 
   src = fetchFromGitHub {
     owner = "ripytide";
     repo = "metapac";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zp45oaLRHv6NdBQEpTEtG93gF04V8YayluXO2IV8LkI=";
+    hash = "sha256-6Nw4CUTx0/KcHHguRrUH6Sa+DZhPJqdsTEeVBb0eEqw=";
   };
 
-  cargoHash = "sha256-sw9MPnhbQPifkDJoO33RbMBtTsSyRmuiNVyjlteAAcM=";
+  cargoHash = "sha256-hUd9qWXXErOyJV0mjmkMUb8KPuUhp1XI3GNYwpt1Xow=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
diff --git a/pkgs/by-name/mo/mochi/package.nix b/pkgs/by-name/mo/mochi/package.nix
index ad637755bee2..afdc636fbac8 100644
--- a/pkgs/by-name/mo/mochi/package.nix
+++ b/pkgs/by-name/mo/mochi/package.nix
@@ -72,7 +72,7 @@ let
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     maintainers = with lib.maintainers; [
       piotrkwiecinski
-      poopsicles
+      dibenzepin
     ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
diff --git a/pkgs/by-name/mu/musl/package.nix b/pkgs/by-name/mu/musl/package.nix
index 3df1b2289934..3cfdae35710a 100644
--- a/pkgs/by-name/mu/musl/package.nix
+++ b/pkgs/by-name/mu/musl/package.nix
@@ -174,7 +174,14 @@ stdenv.mkDerivation (finalAttrs: {
     install -D ${tree_h} $dev/include/sys/tree.h
   '';
 
-  passthru.linuxHeaders = linuxHeaders;
+  passthru = {
+    linuxHeaders = linuxHeaders;
+
+    # musl's threads are POSIX threads. `libgcc` and `libstdc++` have to be
+    # configured for the same threading model as each other, so rather than
+    # have each guess, they take it from the libc they are built against.
+    threadModel = "posix";
+  };
 
   meta = {
     description = "Efficient, small, quality libc implementation";
diff --git a/pkgs/by-name/na/namespace-cli/package.nix b/pkgs/by-name/na/namespace-cli/package.nix
index 0829e6516e15..87c2d6288c16 100644
--- a/pkgs/by-name/na/namespace-cli/package.nix
+++ b/pkgs/by-name/na/namespace-cli/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "namespace-cli";
-  version = "0.0.551";
+  version = "0.0.556";
 
   src = fetchFromGitHub {
     owner = "namespacelabs";
     repo = "foundation";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-utBatGjHNLTT+hdYde5NIZmD7c+oS9zFl9dCyrtMx2s=";
+    hash = "sha256-Vq9aOhQKz2nyjy+zXnaUxGbTrPBmyWeR0n26kReRd3I=";
   };
 
-  vendorHash = "sha256-1MjkgJvn2u2zcO6lMAHdEbiGVp24D3Gv98GQZxGk27Y=";
+  vendorHash = "sha256-x4GWkINfOzcLFg7mCHG80Dpz7tkdcEDMj1oPAXM2n8w=";
 
   subPackages = [
     "cmd/nsc"
diff --git a/pkgs/by-name/na/nats-server/package.nix b/pkgs/by-name/na/nats-server/package.nix
index 31a5d4c09ad4..b008ceae3f7b 100644
--- a/pkgs/by-name/na/nats-server/package.nix
+++ b/pkgs/by-name/na/nats-server/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "nats-server";
-  version = "2.14.4";
+  version = "2.14.5";
 
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = "nats-server";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Jbw+R1na8tjTLyKJC/KDPhA1G1jgNxMhC+xD38IWH2k=";
+    hash = "sha256-rsbvFUJcprWEZx0SPfIr+M0IyyCYbDncBLenOBniumM=";
   };
 
-  vendorHash = "sha256-Lmbacb85+hTe4QoeO72aPOytZQiMQCymOelmGwh0/2E=";
+  vendorHash = "sha256-VB4x100hSSsY6fqODuIefanzchOHlfyfJrNSJUea42U=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/nc/ncdu/package.nix b/pkgs/by-name/nc/ncdu/package.nix
index a6851492c9d5..a5e05e5ee732 100644
--- a/pkgs/by-name/nc/ncdu/package.nix
+++ b/pkgs/by-name/nc/ncdu/package.nix
@@ -69,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     homepage = "https://github.com/BratishkaErik/ncdu";
     description = "Disk usage analyzer with an ncurses interface";
-    changelog = "https://github.com/BratishkaErik/ncdu/releases";
+    changelog = "https://github.com/BratishkaErik/ncdu/releases/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       pSub
diff --git a/pkgs/by-name/ne/nerva/package.nix b/pkgs/by-name/ne/nerva/package.nix
index 6062dd703e7e..25fd5eac38b4 100644
--- a/pkgs/by-name/ne/nerva/package.nix
+++ b/pkgs/by-name/ne/nerva/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "nerva";
-  version = "1.64.2";
+  version = "1.64.3";
 
   src = fetchFromGitHub {
     owner = "praetorian-inc";
     repo = "nerva";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vZ03tcYvo+0s/ix+TCLUm9xAyi22mYXYm/15IYMomtE=";
+    hash = "sha256-LqJrrZg/UyMqDYuESHqHR0jOAe7gmGKJToNUg/ABOcc=";
   };
 
   vendorHash = "sha256-Z0MSD+1/1VzrJ+pz5x0JvxrCxtJe59ckaTqHK/+TVN8=";
diff --git a/pkgs/by-name/ni/nix-direnv/package.nix b/pkgs/by-name/ni/nix-direnv/package.nix
index 98861db15dda..a52ca907e8f4 100644
--- a/pkgs/by-name/ni/nix-direnv/package.nix
+++ b/pkgs/by-name/ni/nix-direnv/package.nix
@@ -14,7 +14,7 @@ resholve.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "nix-direnv";
-    rev = finalAttrs.version;
+    tag = finalAttrs.version;
     hash = "sha256-dNJeSRuuqA2avtLpTse7mTTmnYdVnC5BxRsofuLXiqE=";
   };
 
@@ -68,6 +68,7 @@ resholve.mkDerivation (finalAttrs: {
   meta = {
     description = "Fast, persistent use_nix implementation for direnv";
     homepage = "https://github.com/nix-community/nix-direnv";
+    changelog = "https://github.com/nix-community/nix-direnv/releases/${finalAttrs.version}";
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/nu/nullmailer/package.nix b/pkgs/by-name/nu/nullmailer/package.nix
index 08a6333df655..563366d72112 100644
--- a/pkgs/by-name/nu/nullmailer/package.nix
+++ b/pkgs/by-name/nu/nullmailer/package.nix
@@ -4,6 +4,7 @@
   lib,
   tls ? true,
   gnutls,
+  nixosTests,
 }:
 
 gccStdenv.mkDerivation (finalAttrs: {
@@ -42,6 +43,8 @@ gccStdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
+  passthru.tests.nixos = nixosTests.nullmailer;
+
   meta = {
     homepage = "http://untroubled.org/nullmailer/";
     description = ''
diff --git a/pkgs/by-name/nu/nusmv/package.nix b/pkgs/by-name/nu/nusmv/package.nix
index f56d1d41aed7..b892a44c51f0 100644
--- a/pkgs/by-name/nu/nusmv/package.nix
+++ b/pkgs/by-name/nu/nusmv/package.nix
@@ -10,7 +10,7 @@ stdenv.mkDerivation (finalAttrs: {
   version = "2.7.0";
 
   src =
-    with stdenv;
+    with stdenv.hostPlatform;
     fetchurl (
       if isx86_64 && isLinux then
         {
diff --git a/pkgs/by-name/on/onnxruntime/package.nix b/pkgs/by-name/on/onnxruntime/package.nix
index ef4d70237ce0..fd4edb828952 100644
--- a/pkgs/by-name/on/onnxruntime/package.nix
+++ b/pkgs/by-name/on/onnxruntime/package.nix
@@ -25,7 +25,7 @@
   pythonSupport ? (stdenv.buildPlatform.canExecute stdenv.hostPlatform),
   cudaSupport ? config.cudaSupport,
   ncclSupport ? cudaSupport && cudaPackages.nccl.meta.available,
-  openvinoSupport ? stdenv.isLinux,
+  openvinoSupport ? stdenv.hostPlatform.isLinux,
   rocmSupport ? config.rocmSupport,
   coremlSupport ? stdenv.hostPlatform.isDarwin,
   withFullProtobuf ? false,
diff --git a/pkgs/by-name/op/open-policy-agent/package.nix b/pkgs/by-name/op/open-policy-agent/package.nix
index 13e3b8758f3b..7152f89cbd14 100644
--- a/pkgs/by-name/op/open-policy-agent/package.nix
+++ b/pkgs/by-name/op/open-policy-agent/package.nix
@@ -84,11 +84,6 @@ buildGoModule (finalAttrs: {
       getGoDirs() {
         go list ./... | grep -v -e e2e ${lib.optionalString stdenv.hostPlatform.isDarwin "-e wasm"}
       }
-    ''
-    # remove tests that have "too many open files"/"no space left on device" issues on darwin in hydra
-    + lib.optionalString stdenv.hostPlatform.isDarwin ''
-      rm v1/server/server_test.go
-      rm v1/server/server_bench_test.go
     '';
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
diff --git a/pkgs/by-name/op/opencloud/idp-web.nix b/pkgs/by-name/op/opencloud/idp-web.nix
index 46e322e7424f..d2dd3553de39 100644
--- a/pkgs/by-name/op/opencloud/idp-web.nix
+++ b/pkgs/by-name/op/opencloud/idp-web.nix
@@ -20,7 +20,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     pnpm = pnpm_11;
     sourceRoot = "${finalAttrs.src.name}/${finalAttrs.pnpmRoot}";
     fetcherVersion = 4;
-    hash = "sha256-buDYvRw4NTLxFSdDRZHiuXMVe9fJbe2iu5hr+zh6KLs=";
+    hash = "sha256-rj6KFrzuINVpxrrel2p2iWtJVH8Zg1jrZEIAs8S+8Qs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/op/opencloud/package.nix b/pkgs/by-name/op/opencloud/package.nix
index 6f9b665171fd..6d60fad24ad3 100644
--- a/pkgs/by-name/op/opencloud/package.nix
+++ b/pkgs/by-name/op/opencloud/package.nix
@@ -28,13 +28,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "opencloud";
-  version = "7.3.0";
+  version = "7.4.0";
 
   src = fetchFromGitHub {
     owner = "opencloud-eu";
     repo = "opencloud";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2YwDH4qD4PCbfi/nNGPqwtJIpf8MPMGrVRslNWOoDPM=";
+    hash = "sha256-/j3aXAzsIWPHNIRcHLlbi6Y53be5d5GBqrVIZCk0bEw=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/op/opencloud/web.nix b/pkgs/by-name/op/opencloud/web.nix
index 13e0d4a25879..5ad4db8f03a5 100644
--- a/pkgs/by-name/op/opencloud/web.nix
+++ b/pkgs/by-name/op/opencloud/web.nix
@@ -10,20 +10,20 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencloud-web";
-  version = "7.2.0";
+  version = "7.3.0";
 
   src = fetchFromGitHub {
     owner = "opencloud-eu";
     repo = "web";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BiOue8+zQ3+6RLiDbLMnxKEen2aav3bljji4d+0Hr5c=";
+    hash = "sha256-v1VmX3q2YQUd3PvRVVEvDvpsgVcNklflXRXRvtHOuCU=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_11;
     fetcherVersion = 4;
-    hash = "sha256-gCsgnOEi9rvtwTZy8J/i63D92Gl2V9ZihxCJ+Y5hLUE=";
+    hash = "sha256-Y/Xz62ZS7pU6WB3dxewfhNI4POW/r/DGodpEy+xw/ww=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/op/openttd-jgrpp/package.nix b/pkgs/by-name/op/openttd-jgrpp/package.nix
index 61783b73c081..e853251532dc 100644
--- a/pkgs/by-name/op/openttd-jgrpp/package.nix
+++ b/pkgs/by-name/op/openttd-jgrpp/package.nix
@@ -7,13 +7,13 @@
 
 openttd.overrideAttrs (oldAttrs: rec {
   pname = "openttd-jgrpp";
-  version = "0.73.0";
+  version = "0.73.1";
 
   src = fetchFromGitHub {
     owner = "JGRennison";
     repo = "OpenTTD-patches";
     rev = "jgrpp-${version}";
-    hash = "sha256-eFUKJSpHLhyGXvKo/uSB01+5nGv5Y7yUTIU3U81Qx5U=";
+    hash = "sha256-L99u4J/yiaQB2TTP63gIX6N4OrVOuM4/1bpLkCzVvXU=";
   };
   patches = [ ];
 
diff --git a/pkgs/by-name/op/openwith/package.nix b/pkgs/by-name/op/openwith/package.nix
deleted file mode 100644
index 7ff5bc4c8d82..000000000000
--- a/pkgs/by-name/op/openwith/package.nix
+++ /dev/null
@@ -1,41 +0,0 @@
-{
-  lib,
-  swiftPackages,
-  fetchFromGitHub,
-}:
-
-let
-  inherit (swiftPackages) stdenv swift;
-  inherit (stdenv.hostPlatform) darwinArch;
-in
-stdenv.mkDerivation {
-  pname = "openwith";
-  version = "unstable-2022-10-28";
-
-  src = fetchFromGitHub {
-    owner = "jdek";
-    repo = "openwith";
-    rev = "a8a99ba0d1cabee7cb470994a1e2507385c30b6e";
-    hash = "sha256-lysleg3qM2MndXeKjNk+Y9Tkk40urXA2ZdxY5KZNANo=";
-  };
-
-  nativeBuildInputs = [ swift ];
-
-  makeFlags = [ "openwith_${darwinArch}" ];
-
-  installPhase = ''
-    runHook preInstall
-    install openwith_${darwinArch} -D $out/bin/openwith
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "Utility to specify which application bundle should open specific file extensions";
-    homepage = "https://github.com/jdek/openwith";
-    license = lib.licenses.unlicense;
-    maintainers = with lib.maintainers; [ zowoq ];
-    platforms = [
-      "aarch64-darwin"
-    ];
-  };
-}
diff --git a/pkgs/by-name/pc/pcb2gcode/package.nix b/pkgs/by-name/pc/pcb2gcode/package.nix
index 2fb79f1b4be9..784d1da3ef47 100644
--- a/pkgs/by-name/pc/pcb2gcode/package.nix
+++ b/pkgs/by-name/pc/pcb2gcode/package.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "PCB2GCODE_COMPILE_WARNING_AS_ERROR" false)
   ];
 
-  preConfigure = lib.optionalString stdenv.isDarwin ''
+  preConfigure = lib.optionalString stdenv.hostPlatform.isDarwin ''
     export CXXFLAGS="$CXXFLAGS -fpermissive -Wno-error=c++20-extensions -Wno-error=invalid-constexpr"
   '';
 
diff --git a/pkgs/by-name/pi/piped/package.nix b/pkgs/by-name/pi/piped/package.nix
index e09939daa812..a14333f7e5bf 100644
--- a/pkgs/by-name/pi/piped/package.nix
+++ b/pkgs/by-name/pi/piped/package.nix
@@ -12,13 +12,13 @@ let
 in
 buildNpmPackage rec {
   pname = "piped";
-  version = "0-unstable-2026-07-06";
+  version = "0-unstable-2026-08-09";
 
   src = fetchFromGitHub {
     owner = "TeamPiped";
     repo = "piped";
-    rev = "335b10d0c02e407b4ba9113e32912b0d783ad455";
-    hash = "sha256-vcXmsgDZJ3v/1XNXtU3v9GWlDJBatXK9peTPVQe5De0=";
+    rev = "5ef4a0d0072753521cb7584075346623b8282402";
+    hash = "sha256-8vuanaSjspGkminCO2fTrGhecpoGgTcpEtl7YT2ZDYA=";
   };
 
   nativeBuildInputs = [ pnpm ];
@@ -39,7 +39,7 @@ buildNpmPackage rec {
       pnpm
       ;
     fetcherVersion = 4;
-    hash = "sha256-55nG7tfXtxnyfZop+8Wg8rSFOHQi0TjRc0QT16erX1E=";
+    hash = "sha256-mBEzm+GzF/V3W/6JPOn81YawAMaSTw8THtOUb3qtmvc=";
   };
 
   passthru.updateScript = nix-update-script {
diff --git a/pkgs/by-name/pr/prometheus-snowflake-exporter/package.nix b/pkgs/by-name/pr/prometheus-snowflake-exporter/package.nix
new file mode 100644
index 000000000000..85f2e0152755
--- /dev/null
+++ b/pkgs/by-name/pr/prometheus-snowflake-exporter/package.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "prometheus-snowflake-exporter";
+  # No tagged release upstream (only a moving `latest` tag), so pin the commit and
+  # use nixpkgs' unstable versioning. Bump the date + rev on update.
+  version = "0-unstable-2026-07-02";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "grafana";
+    repo = "snowflake-prometheus-exporter";
+    rev = "d9447d3401aa81b26c091775606c502bf8e2d7cd";
+    hash = "sha256-3yaZ2kk2k5ivUNgRNazYjA38zY4dvsTOrkvftQpCW5A=";
+  };
+
+  vendorHash = "sha256-HvlZ5g1LqAoXuFuidmHCMTeFfivqUR2ryAh0hQayxnc=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/prometheus/common/version.Version=${finalAttrs.version}"
+    "-X github.com/prometheus/common/version.Branch=master"
+    "-X github.com/prometheus/common/version.BuildUser=nixbld@nixpkgs"
+  ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
+
+  meta = {
+    description = "Prometheus exporter for Snowflake metrics";
+    homepage = "https://github.com/grafana/snowflake-prometheus-exporter";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ rhousand ];
+    mainProgram = "snowflake-exporter";
+  };
+})
diff --git a/pkgs/by-name/ra/radicle-ci-broker/package.nix b/pkgs/by-name/ra/radicle-ci-broker/package.nix
index d74f46f73b55..f9989d01d7f4 100644
--- a/pkgs/by-name/ra/radicle-ci-broker/package.nix
+++ b/pkgs/by-name/ra/radicle-ci-broker/package.nix
@@ -14,14 +14,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "radicle-ci-broker";
-  version = "0.30.0";
+  version = "0.31.0";
 
   src = fetchFromRadicle {
     seed = "seed.radicle.dev";
     repo = "zwTxygwuz5LDGBq255RA2CbNGrz8";
     node = "z6MkgEMYod7Hxfy9qCvDv5hYHkZ4ciWmLFgfvm3Wn1b2w2FV";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-30+s//C9uMpGgA976RRduHmnmF6YEYmmG+V5P/1TYhA=";
+    hash = "sha256-yY2ke4JBAn0ZTaZ7HV8GCPF5Yqj1j+7GvjFXQQVM3ME=";
     leaveDotGit = true;
     postFetch = ''
       git -C $out rev-parse --short HEAD > $out/.git_head
@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     '';
   };
 
-  cargoHash = "sha256-9DzdeJcjl8IpmDR+kXdbEHrGi/5e9P26HsZJ9OPZRSA=";
+  cargoHash = "sha256-+XB2+k18gWEO7tpsQK+ua133PcZ0mxV+txle7VutXIk=";
 
   postPatch = ''
     substituteInPlace build.rs \
diff --git a/pkgs/by-name/ra/radicle-node/package.nix b/pkgs/by-name/ra/radicle-node/package.nix
index d42e6c7ba95d..a1b450ae3617 100644
--- a/pkgs/by-name/ra/radicle-node/package.nix
+++ b/pkgs/by-name/ra/radicle-node/package.nix
@@ -15,9 +15,9 @@
   xdg-utils,
   versionCheckHook,
 
-  version ? "1.10.0",
-  srcHash ? "sha256-msKnRL6T9Z+bSxknRvhKSE6rDlGA0e8aWwM1/PhUzZw=",
-  cargoHash ? "sha256-g23LqCXZt+/JX+1Nb9JCORxI0P/LJL2MZHg3lATKLd8=",
+  version ? "1.10.1",
+  srcHash ? "sha256-F+64o9z/al0iaLFyQHAYk/3jjf5T0FdgqaU3nEWIheg=",
+  cargoHash ? "sha256-TLffetbkVwIbUDoI+96T99+lfYu2SIpGtwC0DbuJXnU=",
   updateScript ? ./update.sh,
 }:
 
diff --git a/pkgs/by-name/ra/radicle-node/unstable.nix b/pkgs/by-name/ra/radicle-node/unstable.nix
index 6461906e6651..e4b98a70f3be 100644
--- a/pkgs/by-name/ra/radicle-node/unstable.nix
+++ b/pkgs/by-name/ra/radicle-node/unstable.nix
@@ -1,8 +1,8 @@
 { radicle-node }:
 
 radicle-node.override {
-  version = "1.10.0";
-  srcHash = "sha256-msKnRL6T9Z+bSxknRvhKSE6rDlGA0e8aWwM1/PhUzZw=";
-  cargoHash = "sha256-g23LqCXZt+/JX+1Nb9JCORxI0P/LJL2MZHg3lATKLd8=";
+  version = "1.10.1";
+  srcHash = "sha256-F+64o9z/al0iaLFyQHAYk/3jjf5T0FdgqaU3nEWIheg=";
+  cargoHash = "sha256-TLffetbkVwIbUDoI+96T99+lfYu2SIpGtwC0DbuJXnU=";
   updateScript = ./update-unstable.sh;
 }
diff --git a/pkgs/by-name/re/reprepro/package.nix b/pkgs/by-name/re/reprepro/package.nix
index 9994497a538a..130181b51627 100644
--- a/pkgs/by-name/re/reprepro/package.nix
+++ b/pkgs/by-name/re/reprepro/package.nix
@@ -15,7 +15,7 @@
 }:
 
 let
-  theStdenv = if stdenv.isDarwin then gcc14Stdenv else stdenv;
+  theStdenv = if stdenv.hostPlatform.isDarwin then gcc14Stdenv else stdenv;
 in
 theStdenv.mkDerivation (finalAttrs: {
   pname = "reprepro";
diff --git a/pkgs/by-name/re/rerun/package.nix b/pkgs/by-name/re/rerun/package.nix
index 76f68ffc0857..1a07bae47aa6 100644
--- a/pkgs/by-name/re/rerun/package.nix
+++ b/pkgs/by-name/re/rerun/package.nix
@@ -40,7 +40,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rerun";
-  version = "0.35.0";
+  version = "0.36.0";
 
   __structuredAttrs = true;
 
@@ -53,7 +53,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "rerun-io";
     repo = "rerun";
     tag = finalAttrs.version;
-    hash = "sha256-PPur5of8zoStXl+3Eq/sgDZ0E9ADUnks6nJ55mzJTuI=";
+    hash = "sha256-t/OvWxMFfkTKrTYvaw7xcmL6oDyNaKoyW0sa/n5yVMs=";
   };
 
   # The path in `build.rs` is wrong for some reason, so we patch it to make the passthru tests work
@@ -62,7 +62,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail '"rerun_sdk/rerun_cli/rerun"' '"rerun_sdk/rerun"'
   '';
 
-  cargoHash = "sha256-yapmDUOCCqvxmFFe/nQjeBWytTEnMw2opd/U7aXI4jQ=";
+  cargoHash = "sha256-VXKMEilmgHLHAq6Y7gDvKNJywRIV4fv/XHmNFCMjJws=";
 
   cargoBuildFlags = [
     "--package"
diff --git a/pkgs/by-name/rh/rhash/package.nix b/pkgs/by-name/rh/rhash/package.nix
index e8ef05814fee..54c326c95677 100644
--- a/pkgs/by-name/rh/rhash/package.nix
+++ b/pkgs/by-name/rh/rhash/package.nix
@@ -51,6 +51,6 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Console utility and library for computing and verifying hash sums of files";
     license = lib.licenses.bsd0;
     platforms = lib.platforms.all;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ graysontinker ];
   };
 })
diff --git a/pkgs/by-name/ri/rime-moegirl/package.nix b/pkgs/by-name/ri/rime-moegirl/package.nix
index 7ba321506998..3a88e169e2e9 100644
--- a/pkgs/by-name/ri/rime-moegirl/package.nix
+++ b/pkgs/by-name/ri/rime-moegirl/package.nix
@@ -5,10 +5,10 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "rime-moegirl";
-  version = "20260713";
+  version = "20260812";
   src = fetchurl {
     url = "https://github.com/outloudvi/mw2fcitx/releases/download/${finalAttrs.version}/moegirl.dict.yaml";
-    hash = "sha256-Fca5vWdmqaRnP6id4TqVGFsTxnynAoQTMgAWntF5eY0=";
+    hash = "sha256-WDbIdQdBX03NsPxFrs9N166CGDplDN15MOHmY+MuOiQ=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/ri/rizin/sigdb.nix b/pkgs/by-name/ri/rizin/sigdb.nix
index 5bbe6685ca8b..197577bf4d6b 100644
--- a/pkgs/by-name/ri/rizin/sigdb.nix
+++ b/pkgs/by-name/ri/rizin/sigdb.nix
@@ -6,7 +6,7 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "rizin-sigdb";
-  version = "unstable-2023-08-23";
+  version = "0-unstable-2023-08-23";
 
   src = fetchFromGitHub {
     owner = "rizinorg";
diff --git a/pkgs/by-name/rm/rmatrix/package.nix b/pkgs/by-name/rm/rmatrix/package.nix
new file mode 100644
index 000000000000..d5602e9c3cbc
--- /dev/null
+++ b/pkgs/by-name/rm/rmatrix/package.nix
@@ -0,0 +1,33 @@
+{
+  rustPlatform,
+  fetchFromGitHub,
+  lib,
+  versionCheckHook,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "rmatrix";
+  version = "0.3.3";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "Tripstack-Corp";
+    repo = "rmatrix";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-sViNj7paMY/3x9u6dKHKf+XQRgv+EYsYsooZSTAwrA4=";
+  };
+
+  cargoHash = "sha256-em16fNb4BZeTsZuaT5Bu/u2cc75iSjOcSDYU0qazefM=";
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  meta = {
+    description = "Digital rain for modern terminals";
+    maintainers = with lib.maintainers; [ yarn ];
+    platforms = lib.platforms.all;
+    license = lib.licenses.mit;
+    homepage = "https://github.com/Tripstack-Corp/rmatrix";
+    mainProgram = "rmatrix";
+  };
+})
diff --git a/pkgs/by-name/rt/rtorrent/package.nix b/pkgs/by-name/rt/rtorrent/package.nix
index fddee3463204..b8673174374a 100644
--- a/pkgs/by-name/rt/rtorrent/package.nix
+++ b/pkgs/by-name/rt/rtorrent/package.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rtorrent";
-  version = "0.16.19";
+  version = "0.16.20";
 
   __structuredAttrs = true;
 
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "rakshasa";
     repo = "rtorrent";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oMErraDUyCiuRxFZ5CoBvoW9vXHG+eLHnAKzm6kWt2Y=";
+    hash = "sha256-fwMyzRBMO45djYXGAE8RcadM/lMJ5m9yi9DEomzO1Es=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/sf/sfml_2/package.nix b/pkgs/by-name/sf/sfml_2/package.nix
index d03771f27d6a..fa60a4821ac4 100644
--- a/pkgs/by-name/sf/sfml_2/package.nix
+++ b/pkgs/by-name/sf/sfml_2/package.nix
@@ -67,9 +67,5 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     license = lib.licenses.zlib;
     platforms = lib.platforms.unix;
-    badPlatforms = [
-      # error: implicit instantiation of undefined template 'std::char_traits<unsigned int>'
-      lib.systems.inspect.patterns.isDarwin
-    ];
   };
 })
diff --git a/pkgs/by-name/sh/shadps4-qtlauncher/package.nix b/pkgs/by-name/sh/shadps4-qtlauncher/package.nix
index 943d5c60e7ea..ffce5fba7fb1 100644
--- a/pkgs/by-name/sh/shadps4-qtlauncher/package.nix
+++ b/pkgs/by-name/sh/shadps4-qtlauncher/package.nix
@@ -10,26 +10,26 @@
   fmt,
   sdl3,
   toml11,
+  zarchive,
+  zstd,
 
   shadps4,
 }:
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "shadps4-qtlauncher";
-  version = "0-unstable-2026-06-07";
+  version = "0-unstable-2026-08-08";
 
   src = fetchFromGitHub {
     owner = "shadps4-emu";
     repo = "shadps4-qtlauncher";
-    rev = "eadffe744d6f2bb7b21aedeef2cc0f66cdffd6ed";
-    hash = "sha256-tlCP8Cu3UVoclaQ0cIVr89q7wwgkzFVwhMSqpVB6FnM=";
+    rev = "a12b988ef35d98f2222a614c05498b27fef87121";
+    hash = "sha256-ux9iXNV5QiBCyLCyDYTN1WtO+DyMlXrr+8xWX/4TmD4=";
 
     postCheckout = ''
-      cd "$out"
+      git -C "$out" rev-parse --short=8 HEAD > $out/COMMIT
+      date -u -d "@$(git -C "$out" log -1 --pretty=%ct)" "+%Y-%m-%dT%H:%M:%SZ" > $out/SOURCE_DATE_EPOCH
 
-      git rev-parse --short=8 HEAD > $out/COMMIT
-      date -u -d "@$(git log -1 --pretty=%ct)" "+%Y-%m-%dT%H:%M:%SZ" > $out/SOURCE_DATE_EPOCH
-
-      git -C externals submodule update --init --recursive \
+      git -C "$out/externals" submodule update --init --recursive \
         volk \
         json \
         openal-soft \
@@ -64,6 +64,9 @@ clangStdenv.mkDerivation (finalAttrs: {
       --replace-fail "@shadps4-qt@" "$out"
   '';
 
+  # System Zstd is not linked by default
+  env.NIX_LDFLAGS = "-lzstd";
+
   nativeBuildInputs = [
     cmake
     pkg-config
@@ -74,6 +77,8 @@ clangStdenv.mkDerivation (finalAttrs: {
     fmt
     sdl3
     toml11
+    zarchive
+    zstd
     qt6.qtbase
     qt6.qttools
     qt6.qtmultimedia
@@ -94,13 +99,15 @@ clangStdenv.mkDerivation (finalAttrs: {
 
   meta = {
     inherit (shadps4.meta)
+      homepage
+      downloadPage
+      donationPage
       platforms
       license
       maintainers
       ;
 
     description = shadps4.meta.description + " (Qt UI)";
-    homepage = "https://github.com/shadps4-emu/shadps4-qtlauncher";
     mainProgram = "shadPS4QtLauncher";
   };
 })
diff --git a/pkgs/by-name/sh/shadps4/package.nix b/pkgs/by-name/sh/shadps4/package.nix
index 250bcf430d9a..4111f4b3ca71 100644
--- a/pkgs/by-name/sh/shadps4/package.nix
+++ b/pkgs/by-name/sh/shadps4/package.nix
@@ -2,6 +2,7 @@
   lib,
   clangStdenv,
   fetchFromGitHub,
+  fetchpatch2,
   makeWrapper,
 
   nixosTests,
@@ -12,7 +13,9 @@
   cryptopp,
   ffmpeg,
   fmt,
+  freetype,
   half,
+  httplib,
   jack2,
   libdecor,
   libpng,
@@ -21,6 +24,7 @@
   libusb1,
   magic-enum,
   minimp3,
+  miniupnpc,
   miniz,
   nlohmann_json,
   libgbm,
@@ -49,27 +53,37 @@
   vulkan-memory-allocator,
   xbyak,
   xxhash,
+  zarchive,
+  zstd,
   zlib,
   nix-update-script,
+
+  withRpc ? true,
 }:
 
+let
+  abseilCppSrc = fetchFromGitHub {
+    owner = "abseil";
+    repo = "abseil-cpp";
+    tag = "20250512.1";
+    hash = "sha256-eB7OqTO9Vwts9nYQ/Mdq0Ds4T1KgmmpYdzU09VPWOhk=";
+  };
+in
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "shadps4";
-  version = "0.16.0";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "shadps4-emu";
     repo = "shadPS4";
     tag = "v.${finalAttrs.version}";
-    hash = "sha256-SavSUHtnJeRi2mzIyUhLfLk37Y/PSuI3bbbqWA7qVbg=";
+    hash = "sha256-Z3UwxK+0D3RXKTM0ybYG4U42bInjF05KlMXzxN4UcNg=";
 
     postCheckout = ''
-      cd "$out"
+      git -C "$out" rev-parse --short=8 HEAD > $out/COMMIT
+      date -u -d "@$(git -C "$out" log -1 --pretty=%ct)" "+%Y-%m-%dT%H:%M:%SZ" > $out/SOURCE_DATE_EPOCH
 
-      git rev-parse --short=8 HEAD > $out/COMMIT
-      date -u -d "@$(git log -1 --pretty=%ct)" "+%Y-%m-%dT%H:%M:%SZ" > $out/SOURCE_DATE_EPOCH
-
-      git -C externals submodule update --init --recursive \
+      git -C "$out/externals" submodule update --init --recursive \
         glslang \
         zydis \
         sirit \
@@ -83,10 +97,23 @@ clangStdenv.mkDerivation (finalAttrs: {
         aacdec/fdk-aac \
         spdlog \
         libressl \
-        ImGuiFileDialog
+        ImGuiFileDialog \
+        protobuf
     '';
   };
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  patches = [
+    # https://github.com/shadps4-emu/shadPS4/pull/4786
+    (fetchpatch2 {
+      name = "use-system-zarchive.patch";
+      url = "https://github.com/shadps4-emu/shadPS4/commit/71c48b43570ac8df545d3d96261b0ec7fa37c808.patch?full_index=1";
+      hash = "sha256-MQiw+DGi/85nTSAVrNw2GmwhbBD7/Xy3lCIDMg1HxxU=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace src/common/scm_rev.cpp.in \
       --replace-fail @APP_VERSION@ ${finalAttrs.version} \
@@ -96,6 +123,15 @@ clangStdenv.mkDerivation (finalAttrs: {
       --replace-fail @BUILD_DATE@ $(cat SOURCE_DATE_EPOCH)
   '';
 
+  # System Zstd is not linked by default
+  env.NIX_LDFLAGS = "-lzstd";
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    makeWrapper
+  ];
+
   buildInputs = [
     alsa-lib
     boost
@@ -103,7 +139,9 @@ clangStdenv.mkDerivation (finalAttrs: {
     cryptopp
     ffmpeg
     fmt
+    freetype
     half
+    httplib
     jack2
     libdecor
     libpng
@@ -120,6 +158,7 @@ clangStdenv.mkDerivation (finalAttrs: {
     libxtst
     magic-enum
     minimp3
+    miniupnpc
     miniz
     libgbm
     nlohmann_json
@@ -139,17 +178,17 @@ clangStdenv.mkDerivation (finalAttrs: {
     vulkan-memory-allocator
     xbyak
     xxhash
+    zarchive
+    zstd
     zlib
   ];
 
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-    makeWrapper
-  ];
-
   cmakeFlags = [
+    (lib.cmakeBool "ENABLE_DISCORD_RPC" withRpc)
+    (lib.cmakeBool "ENABLE_TESTS" false)
     (lib.cmakeBool "ENABLE_UPDATER" false)
+    (lib.cmakeBool "ENABLE_SYSTEM_LIBRARIES" true)
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_ABSL" "${abseilCppSrc}")
   ];
 
   # Still in development, help with debugging
@@ -183,7 +222,9 @@ clangStdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Early in development PS4 emulator";
-    homepage = "https://github.com/shadps4-emu/shadPS4";
+    homepage = "https://shadps4.net";
+    downloadPage = "https://shadps4.net/downloads";
+    donationPage = "https://ko-fi.com/shadps4";
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [
       ryand56
diff --git a/pkgs/by-name/sn/snooze/package.nix b/pkgs/by-name/sn/snooze/package.nix
index 1c3432259a8b..179c146f6712 100644
--- a/pkgs/by-name/sn/snooze/package.nix
+++ b/pkgs/by-name/sn/snooze/package.nix
@@ -5,12 +5,12 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "snooze";
-  version = "0.5.1";
+  version = "0.6";
   src = fetchFromGitHub {
     owner = "leahneukirchen";
     repo = "snooze";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-ghWQ/bslWJCcsQ8OqS3MHZiiuGzbgzat6mkG2avSbEk=";
+    sha256 = "sha256-nPJ1W/37duJoyKopkQl/UHDv+MaRFHGuiQI16VIU6HA=";
   };
   makeFlags = [
     "DESTDIR=$(out)"
diff --git a/pkgs/by-name/sp/spec-kit/package.nix b/pkgs/by-name/sp/spec-kit/package.nix
index 1c3d33667716..3005c3a5429a 100644
--- a/pkgs/by-name/sp/spec-kit/package.nix
+++ b/pkgs/by-name/sp/spec-kit/package.nix
@@ -7,13 +7,13 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "spec-kit";
-  version = "0.0.90";
+  version = "0.16.1";
 
   src = fetchFromGitHub {
     owner = "github";
     repo = "spec-kit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ulAii6//DT9uqLxYk6qmX6dwWWjhuARbBmjH5u1YGGM=";
+    hash = "sha256-Js/yEO63OG4rZ32Vm5qGDOFlVnitxqr/NIIQS6kwdRs=";
   };
 
   pyproject = true;
@@ -22,17 +22,17 @@ python3Packages.buildPythonApplication (finalAttrs: {
     hatchling
   ];
 
-  dependencies =
-    with python3Packages;
-    [
-      typer
-      rich
-      httpx
-      platformdirs
-      readchar
-      truststore
-    ]
-    ++ httpx.optional-dependencies.socks;
+  dependencies = with python3Packages; [
+    click
+    json5
+    packaging
+    pathspec
+    platformdirs
+    pyyaml
+    readchar
+    rich
+    typer
+  ];
 
   pythonImportsCheck = [
     "specify_cli"
@@ -45,7 +45,10 @@ python3Packages.buildPythonApplication (finalAttrs: {
     homepage = "https://github.com/github/spec-kit";
     changelog = "https://github.com/github/spec-kit/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ luochen1990 ];
+    maintainers = [
+      lib.maintainers.luochen1990
+      lib.maintainers."3mp3ri0r"
+    ];
     mainProgram = "specify";
   };
 })
diff --git a/pkgs/by-name/sq/squawk/package.nix b/pkgs/by-name/sq/squawk/package.nix
index c07e786f30a4..01caac06e766 100644
--- a/pkgs/by-name/sq/squawk/package.nix
+++ b/pkgs/by-name/sq/squawk/package.nix
@@ -51,6 +51,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     homepage = "https://squawkhq.com";
     changelog = "https://github.com/sbdchd/squawk/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.gpl3Only;
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.dibenzepin ];
   };
 })
diff --git a/pkgs/by-name/su/sundtek/package.nix b/pkgs/by-name/su/sundtek/package.nix
index 733b36702a35..61845738a6b9 100644
--- a/pkgs/by-name/su/sundtek/package.nix
+++ b/pkgs/by-name/su/sundtek/package.nix
@@ -10,7 +10,7 @@ let
     "$out/bin"
   ];
   platform =
-    with stdenv;
+    with stdenv.hostPlatform;
     if isx86_64 then
       "64bit"
     else if isi686 then
@@ -18,7 +18,7 @@ let
     else
       throw "${system} not considered in build derivation. Might still be supported.";
   sha256 =
-    with stdenv;
+    with stdenv.hostPlatform;
     if isx86_64 then
       "1jfsng5n3phw5rqpkid9m5j7m7zgj5bifh7swvba7f97y6imdaax"
     else
diff --git a/pkgs/by-name/te/tensorflow-lite/package.nix b/pkgs/by-name/te/tensorflow-lite/package.nix
index 3ed4c29c06e3..5de65d593658 100644
--- a/pkgs/by-name/te/tensorflow-lite/package.nix
+++ b/pkgs/by-name/te/tensorflow-lite/package.nix
@@ -32,7 +32,7 @@ let
       or (throw "unsupported host system ${hostPlatform.system} with build system ${buildPlatform.system}");
 in
 buildBazelPackage rec {
-  name = "tensorflow-lite";
+  pname = "tensorflow-lite";
   version = "2.13.0";
 
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/tu/turingdb/package.nix b/pkgs/by-name/tu/turingdb/package.nix
index 49fd998bb6c5..bc13009de94d 100644
--- a/pkgs/by-name/tu/turingdb/package.nix
+++ b/pkgs/by-name/tu/turingdb/package.nix
@@ -105,7 +105,7 @@ turingstdenv.mkDerivation (finalAttrs: {
     pugixml
     zlib
   ]
-  ++ lib.optionals turingstdenv.isDarwin [ llvmPackages_20.openmp ]
+  ++ lib.optionals turingstdenv.hostPlatform.isDarwin [ llvmPackages_20.openmp ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [ stdenv.cc.cc.lib ]
   ++ lib.optionals cudaSupport [
     cudaPackages.cuda_cudart
diff --git a/pkgs/by-name/ty/typos-lsp/package.nix b/pkgs/by-name/ty/typos-lsp/package.nix
index 1d548fba4ce8..c00a352c115d 100644
--- a/pkgs/by-name/ty/typos-lsp/package.nix
+++ b/pkgs/by-name/ty/typos-lsp/package.nix
@@ -7,16 +7,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pname = "typos-lsp";
   # Please update the corresponding VSCode extension too.
   # See pkgs/applications/editors/vscode/extensions/tekumara.typos-vscode/default.nix
-  version = "0.1.54";
+  version = "0.1.55";
 
   src = fetchFromGitHub {
     owner = "tekumara";
     repo = "typos-lsp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UP8kh67z++ILNFjBKYmfadmXKOrVKybXg5K0c9ELct8=";
+    hash = "sha256-VcYBzaldmnFb5Y3O+wWapEs7pkBI/n4N6FEM8fBhYZs=";
   };
 
-  cargoHash = "sha256-EbC1ij/58LDEpJIqmDH1J45sEpLrs742BVW1gL5Op+4=";
+  cargoHash = "sha256-JV0LDkJvdM1zZbYDXGcEZPbwbm7vV9+K5WjQxZX0au4=";
 
   # fix for compilation on aarch64
   # see https://github.com/NixOS/nixpkgs/issues/145726
diff --git a/pkgs/by-name/un/unblob/package.nix b/pkgs/by-name/un/unblob/package.nix
index 552040ab866e..baab150401e8 100644
--- a/pkgs/by-name/un/unblob/package.nix
+++ b/pkgs/by-name/un/unblob/package.nix
@@ -42,7 +42,7 @@ let
     zstd
     lz4
   ]
-  ++ lib.optional stdenvNoCC.isLinux partclone;
+  ++ lib.optional stdenvNoCC.hostPlatform.isLinux partclone;
 in
 python3.pkgs.buildPythonApplication rec {
   pname = "unblob";
diff --git a/pkgs/by-name/vi/virter/package.nix b/pkgs/by-name/vi/virter/package.nix
index 84e25a1cf210..c076d0967271 100644
--- a/pkgs/by-name/vi/virter/package.nix
+++ b/pkgs/by-name/vi/virter/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "virter";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "LINBIT";
     repo = "virter";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Kjk/kLDWwFDgr+PnwBNgsZEP/C4YS8/i1l1lTndpS8Q=";
+    hash = "sha256-N8IJGhjnCbUqtZvQ5Et9a3JvG3RctXM9mVM6hBZroE0=";
   };
 
-  vendorHash = "sha256-h/4yQmSPoeAm0p7bYv7xQVk316zl7PB1IcRQlOEDHVQ=";
+  vendorHash = "sha256-XOMxe+pG4OB15l+TKuYR2tJPPcPbsnipxHlnDH0XukA=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/vi/virtnbdbackup/package.nix b/pkgs/by-name/vi/virtnbdbackup/package.nix
index 29a0180f68fe..12c0812f918e 100644
--- a/pkgs/by-name/vi/virtnbdbackup/package.nix
+++ b/pkgs/by-name/vi/virtnbdbackup/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "virtnbdbackup";
-  version = "2.48";
+  version = "2.49";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "abbbi";
     repo = "virtnbdbackup";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qbuTyu3j9775s0VmL+RJLEVYAd2vNqjhETJc2idZ45M=";
+    hash = "sha256-Z6lHU28pqO3Xf9470mVInJdv0hh/sgNPnMIt57WFbFk=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/wl/wl-freeze/package.nix b/pkgs/by-name/wl/wl-freeze/package.nix
index e9dfdae1bb96..74466397909d 100644
--- a/pkgs/by-name/wl/wl-freeze/package.nix
+++ b/pkgs/by-name/wl/wl-freeze/package.nix
@@ -8,11 +8,14 @@
   procps,
   psmisc,
   libnotify,
+  xdotool,
+  kdotool,
+  kdePackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wl-freeze";
-  version = "2.0.2";
+  version = "2.1.0";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -21,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "Zerodya";
     repo = "wl-freeze";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-miyDiUN86Zy9RfVm1MefKrYihX4+bFv6Jr4Cl4GzGz8=";
+    hash = "sha256-WY1XB17ARU34dAlU7CqMg3AXVlE0qilXwfGMpYeeiwk=";
   };
 
   dontConfigure = true;
@@ -55,6 +58,9 @@ stdenv.mkDerivation (finalAttrs: {
           procps
           psmisc
           libnotify
+          xdotool
+          kdotool
+          kdePackages.qttools
         ]
       }
   '';
diff --git a/pkgs/by-name/yb/yb/package.nix b/pkgs/by-name/yb/yb/package.nix
index 198e7cc97dc9..5b5b174c3243 100644
--- a/pkgs/by-name/yb/yb/package.nix
+++ b/pkgs/by-name/yb/yb/package.nix
@@ -49,7 +49,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     installShellFiles
   ];
 
-  buildInputs = lib.optionals stdenv.isLinux [ pcsclite ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pcsclite ];
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     # Bash completion: patch two clap_complete quirks:
@@ -107,7 +107,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
           pkg-config
           llvmPackages.libclang
         ];
-        buildInputs = lib.optionals stdenv.isLinux [ pcsclite ];
+        buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pcsclite ];
 
         LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
         BINDGEN_EXTRA_CLANG_ARGS = "-I${llvmPackages.libclang.lib}/lib/clang/${lib.versions.major llvmPackages.release_version}/include";
diff --git a/pkgs/by-name/yo/yosys/package.nix b/pkgs/by-name/yo/yosys/package.nix
index ba16eb81928d..81fe33e81d20 100644
--- a/pkgs/by-name/yo/yosys/package.nix
+++ b/pkgs/by-name/yo/yosys/package.nix
@@ -79,13 +79,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "yosys";
-  version = "0.67";
+  version = "0.68";
 
   src = fetchFromGitHub {
     owner = "YosysHQ";
     repo = "yosys";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sJaekoBnLEn7j56duQOFMkT4fELHNgkYCbcY6E8hgyA=";
+    hash = "sha256-cf3L3Il717ReAcPTPNHZLwldDeCwuPqHYoxeQusBOOg=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/compilers/chicken/4/chicken.nix b/pkgs/development/compilers/chicken/4/chicken.nix
index 21999870e3b2..fa96639f85db 100644
--- a/pkgs/development/compilers/chicken/4/chicken.nix
+++ b/pkgs/development/compilers/chicken/4/chicken.nix
@@ -10,7 +10,7 @@
 let
   version = "4.13.0";
   platform =
-    with stdenv;
+    with stdenv.hostPlatform;
     if isDarwin then
       "macosx"
     else if isCygwin then
diff --git a/pkgs/development/compilers/chicken/5/chicken.nix b/pkgs/development/compilers/chicken/5/chicken.nix
index 06b9dd6c1485..7df46bcebe8b 100644
--- a/pkgs/development/compilers/chicken/5/chicken.nix
+++ b/pkgs/development/compilers/chicken/5/chicken.nix
@@ -10,7 +10,7 @@
 
 let
   platform =
-    with stdenv;
+    with stdenv.hostPlatform;
     if isDarwin then
       "macosx"
     else if isCygwin then
diff --git a/pkgs/development/compilers/dotnet/source/vmr.nix b/pkgs/development/compilers/dotnet/source/vmr.nix
index 56e8cfa311c3..fec51026975d 100644
--- a/pkgs/development/compilers/dotnet/source/vmr.nix
+++ b/pkgs/development/compilers/dotnet/source/vmr.nix
@@ -43,11 +43,10 @@ let
   stdenv = llvmPackages.stdenv;
 
   inherit (stdenv)
-    isLinux
-    isDarwin
     buildPlatform
     targetPlatform
     ;
+  inherit (stdenv.hostPlatform) isLinux isDarwin;
   inherit (swiftPackages) swift;
 
   releaseManifest = lib.importJSON releaseManifestFile;
diff --git a/pkgs/development/compilers/fpc/lazarus.nix b/pkgs/development/compilers/fpc/lazarus.nix
index 96e8b93a0951..b93013b15e1c 100644
--- a/pkgs/development/compilers/fpc/lazarus.nix
+++ b/pkgs/development/compilers/fpc/lazarus.nix
@@ -5,11 +5,12 @@
   makeWrapper,
   writeText,
   fpc,
-  gtk2,
+  gtk3,
   glib,
   pango,
   atk,
   gdk-pixbuf,
+  harfbuzz,
   libxi,
   xorgproto,
   libx11,
@@ -27,7 +28,7 @@
 #  1. the build date is embedded in the binary through `$I %DATE%` - we should dump that
 
 let
-  version = "4.4-0";
+  version = "4.8-0";
 
   # as of 2.0.10 a suffix is being added. That may or may not disappear and then
   # come back, so just leave this here.
@@ -43,7 +44,7 @@ let
     )
   );
 
-  LCL_PLATFORM = if withQt then "qt${qtVersion}" else "gtk2";
+  LCL_PLATFORM = if withQt then "qt${qtVersion}" else "gtk3";
 
   qtVersion = lib.versions.major qtbase.version;
 in
@@ -53,7 +54,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://sourceforge/lazarus/Lazarus%20Zip%20_%20GZip/Lazarus%20${majorMinorPatch version}/lazarus-${version}.tar.gz";
-    hash = "sha256-GQ7ce3p7GEMFAslkpF399UGP8Wu8rVwEQjszoJ0izAY=";
+    hash = "sha256-a0yeyU/nn+TlgCfde/ENm2w1ycsvkdtZMLdYC0ogGpk=";
   };
 
   postPatch = ''
@@ -61,9 +62,9 @@ stdenv.mkDerivation rec {
   '';
 
   buildInputs = [
-    # we need gtk2 unconditionally as that is the default target when building applications with lazarus
+    # we need gtk unconditionally as that is the default target when building applications with lazarus
     fpc
-    gtk2
+    gtk3
     glib
     libxi
     xorgproto
@@ -73,6 +74,7 @@ stdenv.mkDerivation rec {
     atk
     stdenv.cc
     gdk-pixbuf
+    harfbuzz
   ]
   ++ lib.optionals withQt [
     libqtpas
@@ -109,11 +111,13 @@ stdenv.mkDerivation rec {
         "-lc"
         "-lcairo"
         "-lgcc_s"
-        "-lgdk-x11-2.0"
+        "-lgdk-3"
         "-lgdk_pixbuf-2.0"
         "-lglib-2.0"
-        "-lgtk-x11-2.0"
+        "-lgtk-3"
         "-lpango-1.0"
+        "-lharfbuzz"
+        "-lharfbuzz-gobject"
       ]
       ++ lib.optionals withQt [
         "-L${lib.getLib libqtpas}/lib"
diff --git a/pkgs/development/compilers/gcc/ng/15/libstdcxx/force-regular-dirs.patch b/pkgs/development/compilers/gcc/ng/15/libstdcxx/force-regular-dirs.patch
index e80cffdce1e7..2812ba748e80 100644
--- a/pkgs/development/compilers/gcc/ng/15/libstdcxx/force-regular-dirs.patch
+++ b/pkgs/development/compilers/gcc/ng/15/libstdcxx/force-regular-dirs.patch
@@ -1,9 +1,21 @@
 From db427c55334dd2edc11397d3a92d55dc9c06d1c3 Mon Sep 17 00:00:00 2001
 From: John Ericson <git@JohnEricson.me>
 Date: Sun, 20 Jul 2025 14:20:00 -0400
-Subject: [PATCH] libstdc++: Force regular include/lib dir
+Subject: [PATCH] libstdc++: Force regular lib dir, headers in include-cxx
 
 Delete a bunch of unneeded logic to do this.
+
+The library goes straight in $(libdir), with no version-specific or
+target-specific subdirectory.
+
+The headers go in $(includedir)-cxx rather than $(includedir). libstdc++
+intentionally ships headers named after C headers -- `math.h`, `stdlib.h`,
+`complex.h`, `stdckdint.h` and friends -- whose whole purpose is to shadow
+the C ones when compiling C++. Installed into the ordinary include dir they
+shadow them when compiling *C* too, because the generic setup hook puts that
+directory on the C include path. A sibling directory keeps them out of C's
+way while staying findable for C++; no version or target subdirectory is
+needed, since the store path already separates one libstdc++ from another.
 ---
  libstdc++-v3/acinclude.m4        | 80 ++------------------------------
  libstdc++-v3/include/Makefile.am |  2 +-
@@ -21,7 +33,7 @@ index a0094c2dd95..a0718dff394 100644
 -  glibcxx_toolexeclibdir=no
 +  glibcxx_toolexecdir='$(libdir)'
 +  glibcxx_toolexeclibdir='$(libdir)'
-+  gxx_include_dir='$(includedir)'
++  gxx_include_dir='$(includedir)-cxx'
    glibcxx_prefixdir=$prefix
  
 -  AC_MSG_CHECKING([for gxx-include-dir])
diff --git a/pkgs/development/compilers/gcc/ng/README.md b/pkgs/development/compilers/gcc/ng/README.md
index b40070caebc6..0bbde4ef5cbf 100644
--- a/pkgs/development/compilers/gcc/ng/README.md
+++ b/pkgs/development/compilers/gcc/ng/README.md
@@ -1,3 +1,58 @@
 # GCC Next-Generation
 
-Experimental split GCC package set based on the LLVM package set design.
+Experimental split GCC package set, based on the LLVM package set design.
+
+The monolithic `gcc` derivation builds the compiler and every runtime library in one go, so a change to the target libc rebuilds the compiler too.
+This set separates them — `gcc`, `libgcc`, `libstdcxx` and the rest are individual packages — so the compiler stops depending on the libc, and each piece can be rebuilt on its own.
+Because GCC is not a multi-target compiler — a single target is baked into the binary with CPP — we still need to rebuild it more than we do LLVM, but someday that should change.
+
+A platform opts in with `useGccNG`, in the same way it would opt into `useLLVM`.
+
+## The bootstrap chain
+
+The libc and libgcc depend on each other: a libc's own sources call into libgcc for integer and floating-point helpers and for stack unwinding, and a libgcc that can use the libc's threads needs the libc.
+
+The way out we currently use is the same one the LLVM set takes with `compiler-rt-no-libc` and `compiler-rt-libc` — build the runtime twice, either side of the libc.
+It is unclear whether this works in general to resolve the circularity, but we shall see.
+
+That gives four compilers, each one step further along:
+
+| compiler | libc | libgcc | used to build |
+|---|---|---|---|
+| `gccNoLibgcc` | headers, or nothing | — | `libgcc-no-libc` |
+| `gccWithLibgcc` | headers, or nothing | `libgcc-no-libc` | the libc |
+| `gccWithLibcAndBasicLibgcc` | real | `libgcc-no-libc` | `libgcc-libc` |
+| `gccWithLibc` / `gcc` | real | `libgcc-libc` | everything else |
+
+`libgcc` resolves to `libgcc-libc` wherever a libc exists; only those first three stages ever see `libgcc-no-libc`.
+The bootstrap one is single-threaded and compiled against the libc's headers at best, so it is not intended for use beyond building the libc.
+
+Nothing is passed down to say which stage is which.
+It follows from the compiler: each package reads `stdenv.cc.libc` and needs no flag of its own.
+That is also how the two `libgcc`s differ — same expression, different `stdenv`.
+
+## Where the pre-libc stage is written down
+
+`binutilsNoLibc` carries `preLibcHeaders` as its `libc`: the header-only stand-in for platforms that have one, and nothing at all for platforms that do not.
+`wrapCCWith` defaults `libc` to `bintools.libc`, so the bootstrap compilers inherit it, and everything built with them reads `stdenv.cc.libc`.
+
+Setting a sysroot as well is unusual for nixpkgs, since headers normally reach a compiler through the wrapper, as they do here.
+It is needed because `gcc/configure` takes `target_header_dir` from `--with-sysroot`, and `target_header_dir` is what decides `inhibit_libc`.
+A libgcc built with `inhibit_libc` still compiles, links and installs, just with pieces silently missing.
+
+Given that, the sysroot is derived from `stdenv.cc.libc` too, so it cannot disagree with the headers.
+
+## Threading
+
+Which threading model is available is a property of the libc, so the libc declares it as `passthru.threadModel`; `libgcc` reads it from there, and `libstdcxx` takes both the model and the generated `gthr-default.h` from `libgcc`.
+
+Reading it from the compiler instead, with `$CC -v | sed -n 's/^Thread model: //p'`, reports the wrong component: in this set the compiler is configured separately from libgcc, so the two can disagree.
+A platform whose libc declares nothing gets `single`.
+
+## Relationship to the monolithic set
+
+Both are packaged from the same sources and, for now, the same version: `gccNGPackages` tracks `default-gcc-version` with no fallback, so bumping the monolithic default past what is packaged here is an evaluation error rather than a silent version skew.
+
+Nothing selects GGN NG yet by default.
+The plan is for very exotic package sets to switch to this first.
+The main tier-1 native Linux package sets cached on `cache.nixos.org` will come later.
diff --git a/pkgs/development/compilers/gcc/ng/common/default.nix b/pkgs/development/compilers/gcc/ng/common/default.nix
index 0e040fdb1320..9929fee1e655 100644
--- a/pkgs/development/compilers/gcc/ng/common/default.nix
+++ b/pkgs/development/compilers/gcc/ng/common/default.nix
@@ -131,6 +131,7 @@ makeScopeWithSplicing' {
           "-B${targetGccPackages.libssp}/lib"
           "-B${targetGccPackages.libatomic}/lib"
           "-B${targetGccPackages.libgomp}/lib"
+          "-B${targetGccPackages.libstdcxx}/lib"
           "-B${targetGccPackages.libgfortran}/lib/"
         ];
       };
@@ -163,10 +164,20 @@ makeScopeWithSplicing' {
           "-B${targetGccPackages.libssp}/lib"
           "-B${targetGccPackages.libatomic}/lib"
           "-B${targetGccPackages.libgomp}/lib"
+          # `libcxx` above tells cc-wrapper where the C++ *headers* are; it does
+          # not put the library itself on the link path for a GNU compiler. So
+          # every C++ link failed with `cannot find -lstdc++` until this was
+          # added, in the same style as the other runtime libraries.
+          "-B${targetGccPackages.libstdcxx}/lib"
           "-I${targetGccPackages.libgomp}/lib/gcc/${metadata.release_version}/include"
         ];
       };
 
+      # Stage 1 of the bootstrap chain; see ../README.md.
+      #
+      # No `libc` is passed: `wrapCCWith` defaults it to `bintools.libc`, and
+      # `binutilsNoLibc` carries `preLibcHeaders`. That is the only place the
+      # pre-libc stage is written down.
       gccNoLibgcc = wrapCCWith {
         cc = gccPackages.gcc-unwrapped;
         libcxx = null;
@@ -177,10 +188,51 @@ makeScopeWithSplicing' {
         ];
       };
 
-      libgcc = callPackage ./libgcc {
+      # Built before there is a libc, and not intended for use beyond getting
+      # one built. Note the two differ only by `stdenv`: which stage this is
+      # follows from the compiler, never from an argument.
+      libgcc-no-libc = callPackage ./libgcc {
         stdenv = overrideCC stdenv buildGccPackages.gccNoLibgcc;
       };
 
+      # The real one, built against the finished libc, so it can use that
+      # libc's threads. This is what everything above the libc gets.
+      libgcc-libc = callPackage ./libgcc {
+        stdenv = overrideCC stdenv buildGccPackages.gccWithLibcAndBasicLibgcc;
+      };
+
+      libgcc =
+        if stdenv.hostPlatform.libc == null then gccPackages.libgcc-no-libc else gccPackages.libgcc-libc;
+
+      # Stage 2: libgcc available, libc not yet — what compiling a libc needs.
+      # `binutilsNoLibc` is what keeps the libc out, so nothing here refers to
+      # a libc derivation and the cycle stays broken.
+      gccWithLibgcc = wrapCCWith {
+        cc = gccPackages.gcc-unwrapped;
+        libcxx = null;
+        bintools = binutilsNoLibc;
+        extraPackages = [
+          targetGccPackages.libgcc-no-libc
+        ];
+        nixSupport.cc-cflags = [
+          "-B${targetGccPackages.libgcc-no-libc}/lib"
+        ];
+      };
+
+      # Stage 3: real libc, bootstrap libgcc still. The finished libgcc is what
+      # this is about to build.
+      gccWithLibcAndBasicLibgcc = wrapCCWith {
+        cc = gccPackages.gcc-unwrapped;
+        libcxx = null;
+        bintools = binutils;
+        extraPackages = [
+          targetGccPackages.libgcc-no-libc
+        ];
+        nixSupport.cc-cflags = [
+          "-B${targetGccPackages.libgcc-no-libc}/lib"
+        ];
+      };
+
       gccWithLibc = wrapCCWith {
         cc = gccPackages.gcc-unwrapped;
         libcxx = null;
diff --git a/pkgs/development/compilers/gcc/ng/common/gcc/default.nix b/pkgs/development/compilers/gcc/ng/common/gcc/default.nix
index 1c7a57d9a6cc..fd282acfda67 100644
--- a/pkgs/development/compilers/gcc/ng/common/gcc/default.nix
+++ b/pkgs/development/compilers/gcc/ng/common/gcc/default.nix
@@ -27,11 +27,18 @@
   texinfo,
   which,
   gettext,
+  flex,
+  bison,
+  # Whether `monorepoSrc` is a VCS checkout rather than a release tarball. A
+  # checkout lacks the generated sources (gengtype-lex.cc and friends) that a
+  # tarball ships pre-built, so they have to be regenerated with flex and bison.
+  fromVCS ? false,
   getVersionFile,
   buildGccPackages,
-  targetPackages,
-  libc,
   bintools,
+  # Build the shared runtime libraries, and so have the driver's specs emit
+  # `-lgcc_s`. Derived the way the monolithic build derives it.
+  enableTargetShared ? stdenv.targetPlatform.hasSharedLibraries,
 }:
 let
   inherit (stdenv) targetPlatform hostPlatform;
@@ -81,6 +88,36 @@ stdenv.mkDerivation (finalAttrs: {
       hash = "sha256-54/HzM+aeWq8CTkQu8Pualqc/LgRLS0+8EY8uPUsD+s=";
     })
 
+    # Not upstream yet; a follow-up to the series above (drop the `/raw` to
+    # read them). They extend that series' `<target>-as` preference to `PATH`,
+    # where we put the cross toolchain, so a cross compiler finds its tools
+    # the way a native one does. See below for the problems `--with-as` and
+    # `--with-ld` cause, and thus why we want to avoid them.
+    (fetchpatch {
+      name = "driver-factor-out-env-path-parsing.patch";
+      url = "https://inbox.sourceware.org/gcc-patches/20260810065714.2215299-1-git@JohnEricson.me/raw";
+      hash = "sha256-2qUUMWuyxX4mVaBPeNnHIiMl/aN7ejWM5stTSFWxD7g=";
+    })
+    (fetchpatch {
+      name = "driver-search-PATH-ourselves.patch";
+      url = "https://inbox.sourceware.org/gcc-patches/20260810065714.2215299-2-git@JohnEricson.me/raw";
+      # The posted patch is against trunk, which spells this cast with the C++
+      # operator.  GCC 15 still uses the CONST_CAST macro, and the line is
+      # context rather than a change, so it cannot fuzz-match.  Rewrite it
+      # here rather than keeping a forked copy of the whole patch.
+      postFetch = ''
+        substituteInPlace "$out" \
+          --replace-fail 'string, const_cast<char **> (commands[i].argv),' \
+                         'string, CONST_CAST (char **, commands[i].argv),'
+      '';
+      hash = "sha256-uD8xJxQus2qyNgNDN/63WnURNuUJFDkhaXPph7g/DIk=";
+    })
+    (fetchpatch {
+      name = "driver-search-PATH-machine-prefix.patch";
+      url = "https://inbox.sourceware.org/gcc-patches/20260810065714.2215299-3-git@JohnEricson.me/raw";
+      hash = "sha256-Q5CJpJKD11kadIKselQdHgNe26GqojpyAAmlAyHnsB0=";
+    })
+
     (getVersionFile "gcc/fix-collect2-paths.diff")
   ];
 
@@ -93,12 +130,39 @@ stdenv.mkDerivation (finalAttrs: {
   strictDeps = true;
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
+
+  # The target assembler and linker have to be *runnable here*, during
+  # configure. GCC probes them for capabilities, and a probe it cannot run is
+  # not an error -- it silently records "no". Without the target `ld` on
+  # `PATH`, every `gcc_cv_ld_*` probe fails that way, and the two that matter
+  # most are `HAVE_GAS_HIDDEN` (which needs `gcc_cv_as_hidden` *and*
+  # `gcc_cv_ld_hidden`) and `HAVE_LD_EH_FRAME_HDR`.
+  #
+  # Losing `HAVE_GAS_HIDDEN` is the nasty one: `-fvisibility=hidden` degrades
+  # into a no-op that merely warns, so every symbol stays preemptible and GCC's
+  # own same-translation-unit `R_X86_64_PC32` references become invalid when
+  # linking a shared library.
+  #
+  # The *unwrapped* bintools: `as` and `ld` proper carry no target-libc
+  # reference, so the decoupling this package set exists for still holds.
+  #
+  # Note this is `PATH` rather than `--with-as`/`--with-ld` on purpose. We want
+  # configure to *ask* the real tools what they support, and we want it to bake
+  # nothing else: those flags record `DEFAULT_ASSEMBLER`/`DEFAULT_LINKER` as
+  # absolute store paths, and the driver then runs exactly those binaries
+  # instead of the wrapped ones it is meant to defer to.
+  depsBuildTarget = [ (bintools.bintools or bintools) ];
+
   nativeBuildInputs = [
     texinfo
     which
     gettext
   ]
-  ++ lib.optional (perl != null) perl;
+  ++ lib.optional (perl != null) perl
+  ++ lib.optionals fromVCS [
+    flex
+    bison
+  ];
 
   buildInputs = [
     gmp
@@ -197,7 +261,11 @@ stdenv.mkDerivation (finalAttrs: {
     "--disable-install-libiberty"
     "--disable-multilib"
     "--disable-nls"
-    "--disable-shared"
+    # Derived rather than forced off: the driver's specs only emit `-lgcc_s`
+    # for a target that has shared libraries, so hardcoding this leaves every
+    # throwing C++ program unlinkable even though `libgcc_s.so` is built and
+    # findable. Same predicate the monolithic build uses.
+    (lib.enableFeature enableTargetShared "shared")
     "--enable-default-pie"
     "--enable-languages=${
       lib.concatStrings (
@@ -218,12 +286,26 @@ stdenv.mkDerivation (finalAttrs: {
     "--without-headers"
     "--with-gnu-as"
     "--with-gnu-ld"
-    "--with-as=${lib.getExe' bintools "${bintools.targetPrefix}as"}"
+    # Deliberately no `--with-as` / `--with-ld`. Those bake
+    # `DEFAULT_ASSEMBLER` and `DEFAULT_LINKER` -- absolute store paths -- into
+    # the compiler, so the driver runs exactly those binaries and stops
+    # deferring to the wrapped tools it is meant to use.
+    #
+    # Nothing has to be baked. At configure time the tools are on `PATH` via
+    # `depsBuildTarget`, which is what the capability probes need; at use time
+    # the driver finds them on `PATH` under their target-prefixed names, via
+    # the `find_a_program` patches above.
     "--with-system-zlib"
     "--without-included-gettext"
     "--enable-linker-build-id"
-    "--with-sysroot=${lib.getDev (targetPackages.libc or libc)}"
-    "--with-native-system-header-dir=/include"
+    # Deliberately *no* `--with-sysroot` / `--with-native-system-header-dir`
+    # pointing at the target libc. Baking a libc store path into the compiler
+    # makes every libc change rebuild the compiler, which is precisely the
+    # coupling this split package set exists to remove. cc-wrapper already
+    # supplies the target libc (`-idirafter <libc.dev>/include` and the
+    # corresponding `-B`/`-L` flags), so the compiler proper does not need to
+    # know about it -- exactly as in the LLVM package set, where `clang`
+    # likewise carries no libc reference (`--without-headers` above).
   ]
   ++ lib.optionals enablePlugin [
     "--enable-plugin"
@@ -236,6 +318,20 @@ stdenv.mkDerivation (finalAttrs: {
       "--with-multilib-list="
     ];
 
+  # `LIMITS_H_TEST` decides whether gcc's generated `syslimits.h` chains to the
+  # target libc's `limits.h` (`#include_next`) or is emitted self-contained. It
+  # defaults to a `[ -f $(BUILD_SYSTEM_HEADER_DIR)/limits.h ]` probe, which
+  # necessarily fails here: we deliberately do not point the compiler at a
+  # sysroot (see `configureFlags`), so there is no libc for it to find at build
+  # time.
+  #
+  # Self-contained is the wrong answer regardless. Every target in this package
+  # set is hosted, and cc-wrapper always supplies a libc, so the chained header
+  # is what resolves correctly at *use* time. Without it, anything the libc's
+  # `limits.h` defines and gcc's does not -- `PATH_MAX` being the common one --
+  # goes missing from every libgcc source that needs it.
+  makeFlags = [ "LIMITS_H_TEST=true" ];
+
   doCheck = false;
 
   postInstall = ''
diff --git a/pkgs/development/compilers/gcc/ng/common/libatomic/default.nix b/pkgs/development/compilers/gcc/ng/common/libatomic/default.nix
index db4261a186cc..ce51cf4dd520 100644
--- a/pkgs/development/compilers/gcc/ng/common/libatomic/default.nix
+++ b/pkgs/development/compilers/gcc/ng/common/libatomic/default.nix
@@ -14,29 +14,34 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "libatomic";
   inherit version;
 
-  src = runCommand "libatomic-src-${version}" { src = monorepoSrc; } ''
-    runPhase unpackPhase
+  src = runCommand "libatomic-src-${version}" { src = monorepoSrc; } (
+    ''
+      runPhase unpackPhase
 
-    mkdir -p "$out/gcc"
-    cp gcc/BASE-VER "$out/gcc"
-    cp gcc/DATESTAMP "$out/gcc"
+      mkdir -p "$out/gcc"
+      cp gcc/BASE-VER "$out/gcc"
+      cp gcc/DATESTAMP "$out/gcc"
 
-    cp -r libatomic "$out"
+      cp -r libatomic "$out"
 
-    cp -r config "$out"
-    cp -r multilib.am "$out"
-    cp -r libtool.m4 "$out"
+      cp -r config "$out"
+      cp -r multilib.am "$out"
+      cp -r libtool.m4 "$out"
 
-    cp config.guess "$out"
-    cp config.rpath "$out"
-    cp config.sub "$out"
-    cp config-ml.in "$out"
-    cp ltmain.sh "$out"
-    cp install-sh "$out"
-    cp mkinstalldirs "$out"
+      cp config.guess "$out"
+      cp config.rpath "$out"
+      cp config.sub "$out"
+      cp config-ml.in "$out"
+      cp ltmain.sh "$out"
+      cp install-sh "$out"
+      cp mkinstalldirs "$out"
 
-    [[ -f MD5SUMS ]]; cp MD5SUMS "$out"
-  '';
+    ''
+    # `MD5SUMS` exists only in release tarballs, not in a VCS checkout.
+    + ''
+      if [[ -f MD5SUMS ]]; then cp MD5SUMS "$out"; fi
+    ''
+  );
 
   patches = [
     (fetchpatch {
diff --git a/pkgs/development/compilers/gcc/ng/common/libbacktrace/default.nix b/pkgs/development/compilers/gcc/ng/common/libbacktrace/default.nix
index 307a7061bc57..75cf777746a7 100644
--- a/pkgs/development/compilers/gcc/ng/common/libbacktrace/default.nix
+++ b/pkgs/development/compilers/gcc/ng/common/libbacktrace/default.nix
@@ -11,28 +11,33 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "libbacktrace";
   inherit version;
 
-  src = runCommand "libbacktrace-src-${version}" { src = monorepoSrc; } ''
-    runPhase unpackPhase
+  src = runCommand "libbacktrace-src-${version}" { src = monorepoSrc; } (
+    ''
+      runPhase unpackPhase
 
-    mkdir -p "$out/gcc"
-    cp gcc/BASE-VER "$out/gcc"
-    cp gcc/DATESTAMP "$out/gcc"
+      mkdir -p "$out/gcc"
+      cp gcc/BASE-VER "$out/gcc"
+      cp gcc/DATESTAMP "$out/gcc"
 
-    cp -r include "$out"
-    cp -r libbacktrace "$out"
+      cp -r include "$out"
+      cp -r libbacktrace "$out"
 
-    cp config.guess "$out"
-    cp config.rpath "$out"
-    cp config.sub "$out"
-    cp config-ml.in "$out"
-    cp ltmain.sh "$out"
-    cp install-sh "$out"
-    cp move-if-change "$out"
-    cp mkinstalldirs "$out"
-    cp test-driver "$out"
+      cp config.guess "$out"
+      cp config.rpath "$out"
+      cp config.sub "$out"
+      cp config-ml.in "$out"
+      cp ltmain.sh "$out"
+      cp install-sh "$out"
+      cp move-if-change "$out"
+      cp mkinstalldirs "$out"
+      cp test-driver "$out"
 
-    [[ -f MD5SUMS ]]; cp MD5SUMS "$out"
-  '';
+    ''
+    # `MD5SUMS` exists only in release tarballs, not in a VCS checkout.
+    + ''
+      if [[ -f MD5SUMS ]]; then cp MD5SUMS "$out"; fi
+    ''
+  );
 
   outputs = [
     "out"
diff --git a/pkgs/development/compilers/gcc/ng/common/libgcc/default.nix b/pkgs/development/compilers/gcc/ng/common/libgcc/default.nix
index d88c2e6c0ae5..29220191a26d 100644
--- a/pkgs/development/compilers/gcc/ng/common/libgcc/default.nix
+++ b/pkgs/development/compilers/gcc/ng/common/libgcc/default.nix
@@ -12,9 +12,37 @@
   buildPackages,
   which,
   python3,
+  # Build `libgcc_s` as well as `libgcc.a`, deriving it the way the monolithic
+  # build does rather than forcing it off.
+  enableShared ? stdenv.hostPlatform.hasSharedLibraries,
 }:
+let
+  # A libc needs libgcc to build, and a libgcc that can use the libc's threads
+  # needs the libc, so this package is instantiated twice — see
+  # `libgcc-no-libc` and `libgcc-libc` in the package set, the same split the
+  # LLVM package set makes with `compiler-rt-no-libc` and `compiler-rt-libc`.
+  #
+  # Nothing here says which of the two it is. The difference is entirely in the
+  # compiler it is handed: the bootstrap wrapper's `libc` is `preLibcHeaders`
+  # (or nothing at all, on platforms without one), the later wrapper's is the
+  # finished libc. Everything below reads that one value.
+  libc = stdenv.cc.libc or null;
+
+  # Which threading model may be used is decided by the libc, so take it from
+  # there rather than guess — and pass it on in `passthru` so that `libstdcxx`,
+  # which has to agree, reads the same answer instead of probing for its own.
+  #
+  # This is what makes the bootstrap build single-threaded without being told
+  # to be: a headers-only package declares no `threadModel`, and a real libc
+  # does. That build exists only to get the libc built and is thrown away
+  # afterwards, so there is nothing to be gained from threading it, and plenty
+  # to go wrong: `gthr-posix.h` includes `<pthread.h>` unconditionally, which
+  # at that point is either absent or a stand-in for a libc that does not exist
+  # yet.
+  threadModel = if libc == null then "single" else libc.threadModel or "single";
+in
 stdenv.mkDerivation (finalAttrs: {
-  pname = "libgcc";
+  pname = "libgcc" + lib.optionalString (libc == null) "-no-libc";
   inherit version;
 
   src = monorepoSrc;
@@ -83,9 +111,37 @@ stdenv.mkDerivation (finalAttrs: {
     buildRoot=$(readlink -e "./build")
   '';
 
-  postPatch = ''
-    sourceRoot=$(readlink -e "./libgcc")
-  '';
+  postPatch =
+    # `SHLIB_LC` defaults to `-lc`, so the `libgcc_s.so` rule cannot link
+    # before libc exists.  The monolithic build clobbers it for exactly this
+    # reason; do the same rather than giving up on shared libgcc.  Runs while
+    # the working directory is still the monorepo root, before `sourceRoot`
+    # is repointed below.
+    lib.optionalString enableShared (
+      import ../../../common/libgcc-buildstuff.nix { inherit lib stdenv; }
+    )
+    # gcc's installed `limits.h` chains to the target libc's with
+    # `#include_next`. Where the compiler has a libc — headers-only or real —
+    # that resolves, and it has to: some targets build libgcc sources that need
+    # what only the libc header defines. Where it does not, the chain has
+    # nowhere to land, and
+    # even configure's `AC_PROG_CPP` probe fails -- it includes `<limits.h>`
+    # precisely because that "exists even on freestanding compilers" -- after
+    # which configure falls back to `/lib/cpp` and reports that as the error.
+    #
+    # Only in that case, put gcc's own `glimits.h` earlier on the include path
+    # for this build. That is the self-contained variant, the same file gcc
+    # installs when configured against no libc, so nothing is invented here.
+    # The compiler keeps shipping the chained header either way, which is what
+    # has to stay correct for everything compiled against a real libc later.
+    + lib.optionalString (libc == null) ''
+      mkdir -p "$NIX_BUILD_TOP/freestanding-include"
+      cp gcc/glimits.h "$NIX_BUILD_TOP/freestanding-include/limits.h"
+      export NIX_CFLAGS_COMPILE="-isystem $NIX_BUILD_TOP/freestanding-include ''${NIX_CFLAGS_COMPILE-}"
+    ''
+    + ''
+      sourceRoot=$(readlink -e "./libgcc")
+    '';
 
   enableParallelBuilding = true;
 
@@ -100,6 +156,35 @@ stdenv.mkDerivation (finalAttrs: {
     cd "$buildRoot/gcc"
 
     (
+  ''
+  # `AS`, `CC`, `CPP` and `LD` still name the *target* tools at this point,
+  # under their machine-prefixed names. Snapshot them before the
+  # `*_FOR_BUILD` assignments below overwrite them.
+  #
+  # Deriving `AS_FOR_TARGET` from `$AS` *after* `AS=$AS_FOR_BUILD` asked for
+  # the basename of the build assembler -- plain `as` -- inside the target
+  # compiler's `bin`, and a cross wrapper installs only prefixed names, so
+  # the path did not exist. Likewise `ld`.
+  #
+  # That is not an error `gcc/configure` reports. It probes the target
+  # assembler and linker for capabilities, and a probe it cannot run simply
+  # records "no"; with neither tool found, *every* `gcc_cv_as_*`/`gcc_cv_ld_*`
+  # answer came back "no". The one that matters here is
+  # `HAVE_LD_EH_FRAME_HDR`: `unwind-dw2-fde-dip.c` gates `USE_PT_GNU_EH_FRAME`
+  # on it, so without it the unwinder is compiled with no `dl_iterate_phdr`
+  # lookup at all -- only the `__register_frame` registry, which nothing
+  # populates for normally linked objects. libgcc and libstdc++ then build,
+  # link and install perfectly cleanly, and every C++ `throw` finds no FDE
+  # and calls `std::terminate`.
+  #
+  # `CPP` in particular is not always exported, so fall back to the
+  # machine-prefixed name the wrappers install.
+  + ''
+    targetAs=$(basename "''${AS:-${stdenv.hostPlatform.config}-as}")
+    targetCc=$(basename "''${CC:-${stdenv.hostPlatform.config}-cc}")
+    targetCpp=$(basename "''${CPP:-${stdenv.hostPlatform.config}-cpp}")
+    targetLd=$(basename "''${LD:-${stdenv.hostPlatform.config}-ld}")
+
     export AS_FOR_BUILD=${lib.getExe' buildPackages.stdenv.cc "$(basename $AS_FOR_BUILD)"}
     export CC_FOR_BUILD=${lib.getExe' buildPackages.stdenv.cc "$(basename $CC_FOR_BUILD)"}
     export CPP_FOR_BUILD=${lib.getExe' buildPackages.stdenv.cc "$(basename $CPP_FOR_BUILD)"}
@@ -112,10 +197,10 @@ stdenv.mkDerivation (finalAttrs: {
     export CXX=$CXX_FOR_BUILD
     export LD=$LD_FOR_BUILD
 
-    export AS_FOR_TARGET=${lib.getExe' stdenv.cc "$(basename $AS)"}
-    export CC_FOR_TARGET=${lib.getExe' stdenv.cc "$(basename $CC)"}
-    export CPP_FOR_TARGET=${lib.getExe' stdenv.cc "$(basename $CPP)"}
-    export LD_FOR_TARGET=${lib.getExe' stdenv.cc.bintools "$(basename $LD)"}
+    export AS_FOR_TARGET=${lib.getExe' stdenv.cc "$targetAs"}
+    export CC_FOR_TARGET=${lib.getExe' stdenv.cc "$targetCc"}
+    export CPP_FOR_TARGET=${lib.getExe' stdenv.cc "$targetCpp"}
+    export LD_FOR_TARGET=${lib.getExe' stdenv.cc.bintools "$targetLd"}
 
     export NIX_CFLAGS_COMPILE_FOR_BUILD+=' -DGENERATOR_FILE=1'
 
@@ -184,6 +269,21 @@ stdenv.mkDerivation (finalAttrs: {
 
     "--with-system-zlib"
   ]
+  # `gcc/configure` sets `inhibit_libc=true` when host != target and
+  # `$target_header_dir/stdio.h` does not exist. `inhibit_libc` makes
+  # `tsystem.h` skip <unistd.h> and friends, which is fine for the generic
+  # sources but breaks the target-specific ones that genuinely need libc
+  # declarations -- the profiling support files are the usual casualty.
+  #
+  # `target_header_dir` is derived from `--with-sysroot`, *not* from
+  # `--with-headers`, so the sysroot pair is what has to be set. Point it at
+  # whichever libc the compiler carries, which in the bootstrap build is the
+  # headers-only one. This affects only the `gcc/configure` run that generates
+  # libgcc's makefile fragments, not the compiler that gets shipped.
+  ++ lib.optionals (libc != null) [
+    "--with-sysroot=${lib.getDev libc}"
+    "--with-native-system-header-dir=/include"
+  ]
   ++
     lib.optional (!stdenv.hostPlatform.isRiscV)
       # RISC-V does not like it being empty
@@ -202,13 +302,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   configureFlags = [
     "--disable-dependency-tracking"
-    "gcc_cv_target_thread_file=single"
+    "gcc_cv_target_thread_file=${threadModel}"
     # $CC cannot link binaries, let alone run then
     "cross_compiling=true"
-    # Do not have dynamic linker without libc
     "--enable-static"
-    "--disable-shared"
-  ];
+  ]
+  # `libgcc_s` needs no libc: it comes out with an empty `DT_NEEDED`, which is
+  # why the monolithic build ships one even from its nolibc stage.
+  ++ lib.optional (!enableShared) "--disable-shared";
 
   # Set the variable back the way it was, see corresponding code in
   # `preConfigure`.
@@ -226,6 +327,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     isGNU = true;
+    inherit threadModel;
   };
 
   meta = gcc_meta // {
diff --git a/pkgs/development/compilers/gcc/ng/common/libgomp/default.nix b/pkgs/development/compilers/gcc/ng/common/libgomp/default.nix
index 9053e88a80f9..19b74a3da0d9 100644
--- a/pkgs/development/compilers/gcc/ng/common/libgomp/default.nix
+++ b/pkgs/development/compilers/gcc/ng/common/libgomp/default.nix
@@ -13,30 +13,35 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "libgomp";
   inherit version;
 
-  src = runCommand "libgomp-src-${version}" { src = monorepoSrc; } ''
-    runPhase unpackPhase
+  src = runCommand "libgomp-src-${version}" { src = monorepoSrc; } (
+    ''
+      runPhase unpackPhase
 
-    mkdir -p "$out/gcc"
-    cp gcc/BASE-VER "$out/gcc"
-    cp gcc/DATESTAMP "$out/gcc"
+      mkdir -p "$out/gcc"
+      cp gcc/BASE-VER "$out/gcc"
+      cp gcc/DATESTAMP "$out/gcc"
 
-    cp -r libgomp "$out"
-    cp -r include "$out"
+      cp -r libgomp "$out"
+      cp -r include "$out"
 
-    cp -r config "$out"
-    cp -r multilib.am "$out"
-    cp -r libtool.m4 "$out"
+      cp -r config "$out"
+      cp -r multilib.am "$out"
+      cp -r libtool.m4 "$out"
 
-    cp config.guess "$out"
-    cp config.rpath "$out"
-    cp config.sub "$out"
-    cp config-ml.in "$out"
-    cp ltmain.sh "$out"
-    cp install-sh "$out"
-    cp mkinstalldirs "$out"
+      cp config.guess "$out"
+      cp config.rpath "$out"
+      cp config.sub "$out"
+      cp config-ml.in "$out"
+      cp ltmain.sh "$out"
+      cp install-sh "$out"
+      cp mkinstalldirs "$out"
 
-    [[ -f MD5SUMS ]]; cp MD5SUMS "$out"
-  '';
+    ''
+    # `MD5SUMS` exists only in release tarballs, not in a VCS checkout.
+    + ''
+      if [[ -f MD5SUMS ]]; then cp MD5SUMS "$out"; fi
+    ''
+  );
 
   outputs = [
     "out"
diff --git a/pkgs/development/compilers/gcc/ng/common/libiberty/default.nix b/pkgs/development/compilers/gcc/ng/common/libiberty/default.nix
index a83d9580dabc..28a099b9f9fb 100644
--- a/pkgs/development/compilers/gcc/ng/common/libiberty/default.nix
+++ b/pkgs/development/compilers/gcc/ng/common/libiberty/default.nix
@@ -11,26 +11,31 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "libiberty";
   inherit version;
 
-  src = runCommand "libiberty-src-${version}" { src = monorepoSrc; } ''
-    runPhase unpackPhase
+  src = runCommand "libiberty-src-${version}" { src = monorepoSrc; } (
+    ''
+      runPhase unpackPhase
 
-    mkdir -p "$out/gcc"
-    cp gcc/BASE-VER "$out/gcc"
-    cp gcc/DATESTAMP "$out/gcc"
+      mkdir -p "$out/gcc"
+      cp gcc/BASE-VER "$out/gcc"
+      cp gcc/DATESTAMP "$out/gcc"
 
-    cp -r include "$out"
-    cp -r libiberty "$out"
+      cp -r include "$out"
+      cp -r libiberty "$out"
 
-    cp config.guess "$out"
-    cp config.rpath "$out"
-    cp config.sub "$out"
-    cp config-ml.in "$out"
-    cp ltmain.sh "$out"
-    cp install-sh "$out"
-    cp mkinstalldirs "$out"
+      cp config.guess "$out"
+      cp config.rpath "$out"
+      cp config.sub "$out"
+      cp config-ml.in "$out"
+      cp ltmain.sh "$out"
+      cp install-sh "$out"
+      cp mkinstalldirs "$out"
 
-    [[ -f MD5SUMS ]]; cp MD5SUMS "$out"
-  '';
+    ''
+    # `MD5SUMS` exists only in release tarballs, not in a VCS checkout.
+    + ''
+      if [[ -f MD5SUMS ]]; then cp MD5SUMS "$out"; fi
+    ''
+  );
 
   outputs = [
     "out"
diff --git a/pkgs/development/compilers/gcc/ng/common/libquadmath/default.nix b/pkgs/development/compilers/gcc/ng/common/libquadmath/default.nix
index 982b4177b749..41e309459027 100644
--- a/pkgs/development/compilers/gcc/ng/common/libquadmath/default.nix
+++ b/pkgs/development/compilers/gcc/ng/common/libquadmath/default.nix
@@ -11,25 +11,30 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "libquadmath";
   inherit version;
 
-  src = runCommand "libquadmath-src-${version}" { src = monorepoSrc; } ''
-    runPhase unpackPhase
+  src = runCommand "libquadmath-src-${version}" { src = monorepoSrc; } (
+    ''
+      runPhase unpackPhase
 
-    mkdir -p "$out/gcc"
-    cp gcc/BASE-VER "$out/gcc"
-    cp gcc/DATESTAMP "$out/gcc"
+      mkdir -p "$out/gcc"
+      cp gcc/BASE-VER "$out/gcc"
+      cp gcc/DATESTAMP "$out/gcc"
 
-    cp -r libquadmath "$out"
+      cp -r libquadmath "$out"
 
-    cp config.guess "$out"
-    cp config.rpath "$out"
-    cp config.sub "$out"
-    cp config-ml.in "$out"
-    cp ltmain.sh "$out"
-    cp install-sh "$out"
-    cp mkinstalldirs "$out"
+      cp config.guess "$out"
+      cp config.rpath "$out"
+      cp config.sub "$out"
+      cp config-ml.in "$out"
+      cp ltmain.sh "$out"
+      cp install-sh "$out"
+      cp mkinstalldirs "$out"
 
-    [[ -f MD5SUMS ]]; cp MD5SUMS "$out"
-  '';
+    ''
+    # `MD5SUMS` exists only in release tarballs, not in a VCS checkout.
+    + ''
+      if [[ -f MD5SUMS ]]; then cp MD5SUMS "$out"; fi
+    ''
+  );
 
   sourceRoot = "${finalAttrs.src.name}/libquadmath";
 
diff --git a/pkgs/development/compilers/gcc/ng/common/libsanitizer/default.nix b/pkgs/development/compilers/gcc/ng/common/libsanitizer/default.nix
index b42736d122bd..c90ed42e5848 100644
--- a/pkgs/development/compilers/gcc/ng/common/libsanitizer/default.nix
+++ b/pkgs/development/compilers/gcc/ng/common/libsanitizer/default.nix
@@ -12,25 +12,30 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "libsanitizer";
   inherit version;
 
-  src = runCommand "libsanitizer-src-${version}" { src = monorepoSrc; } ''
-    runPhase unpackPhase
+  src = runCommand "libsanitizer-src-${version}" { src = monorepoSrc; } (
+    ''
+      runPhase unpackPhase
 
-    mkdir -p "$out/gcc"
-    cp gcc/BASE-VER "$out/gcc"
-    cp gcc/DATESTAMP "$out/gcc"
+      mkdir -p "$out/gcc"
+      cp gcc/BASE-VER "$out/gcc"
+      cp gcc/DATESTAMP "$out/gcc"
 
-    cp -r libsanitizer "$out"
+      cp -r libsanitizer "$out"
 
-    cp config.guess "$out"
-    cp config.rpath "$out"
-    cp config.sub "$out"
-    cp config-ml.in "$out"
-    cp ltmain.sh "$out"
-    cp install-sh "$out"
-    cp mkinstalldirs "$out"
+      cp config.guess "$out"
+      cp config.rpath "$out"
+      cp config.sub "$out"
+      cp config-ml.in "$out"
+      cp ltmain.sh "$out"
+      cp install-sh "$out"
+      cp mkinstalldirs "$out"
 
-    [[ -f MD5SUMS ]]; cp MD5SUMS "$out"
-  '';
+    ''
+    # `MD5SUMS` exists only in release tarballs, not in a VCS checkout.
+    + ''
+      if [[ -f MD5SUMS ]]; then cp MD5SUMS "$out"; fi
+    ''
+  );
 
   sourceRoot = "${finalAttrs.src.name}/libsanitizer";
 
diff --git a/pkgs/development/compilers/gcc/ng/common/libssp/default.nix b/pkgs/development/compilers/gcc/ng/common/libssp/default.nix
index bcc5d4b9c2e3..45840d75f3bb 100644
--- a/pkgs/development/compilers/gcc/ng/common/libssp/default.nix
+++ b/pkgs/development/compilers/gcc/ng/common/libssp/default.nix
@@ -14,28 +14,33 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "libssp";
   inherit version;
 
-  src = runCommand "libssp-src-${version}" { src = monorepoSrc; } ''
-    runPhase unpackPhase
+  src = runCommand "libssp-src-${version}" { src = monorepoSrc; } (
+    ''
+      runPhase unpackPhase
 
-    mkdir -p "$out/gcc"
-    cp gcc/BASE-VER "$out/gcc"
-    cp gcc/DATESTAMP "$out/gcc"
+      mkdir -p "$out/gcc"
+      cp gcc/BASE-VER "$out/gcc"
+      cp gcc/DATESTAMP "$out/gcc"
 
-    cp -r libssp "$out"
+      cp -r libssp "$out"
 
-    cp -r config "$out"
-    cp -r multilib.am "$out"
+      cp -r config "$out"
+      cp -r multilib.am "$out"
 
-    cp config.guess "$out"
-    cp config.rpath "$out"
-    cp config.sub "$out"
-    cp config-ml.in "$out"
-    cp ltmain.sh "$out"
-    cp install-sh "$out"
-    cp mkinstalldirs "$out"
+      cp config.guess "$out"
+      cp config.rpath "$out"
+      cp config.sub "$out"
+      cp config-ml.in "$out"
+      cp ltmain.sh "$out"
+      cp install-sh "$out"
+      cp mkinstalldirs "$out"
 
-    [[ -f MD5SUMS ]]; cp MD5SUMS "$out"
-  '';
+    ''
+    # `MD5SUMS` exists only in release tarballs, not in a VCS checkout.
+    + ''
+      if [[ -f MD5SUMS ]]; then cp MD5SUMS "$out"; fi
+    ''
+  );
 
   outputs = [
     "out"
diff --git a/pkgs/development/compilers/gcc/ng/common/libstdcxx/default.nix b/pkgs/development/compilers/gcc/ng/common/libstdcxx/default.nix
index 8e43df2ab635..08865b5ff519 100644
--- a/pkgs/development/compilers/gcc/ng/common/libstdcxx/default.nix
+++ b/pkgs/development/compilers/gcc/ng/common/libstdcxx/default.nix
@@ -10,41 +10,55 @@
   autoreconfHook269,
   runCommand,
   gettext,
+  libgcc,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libstdcxx";
   inherit version;
 
-  src = runCommand "libstdcxx-src-${version}" { src = monorepoSrc; } ''
-    runPhase unpackPhase
+  src = runCommand "libstdcxx-src-${version}" { src = monorepoSrc; } (
+    ''
+      runPhase unpackPhase
 
-    mkdir -p "$out/gcc"
-    cp gcc/BASE-VER "$out/gcc"
-    cp gcc/DATESTAMP "$out/gcc"
+      mkdir -p "$out/gcc"
+      cp gcc/BASE-VER "$out/gcc"
+      cp gcc/DATESTAMP "$out/gcc"
 
-    mkdir -p "$out/libgcc"
-    cp libgcc/gthr*.h "$out/libgcc"
-    cp libgcc/unwind-pe.h "$out/libgcc"
+      mkdir -p "$out/libgcc"
+      cp libgcc/gthr*.h "$out/libgcc"
+      cp libgcc/unwind-pe.h "$out/libgcc"
 
-    cp -r libstdc++-v3 "$out"
+      cp -r libstdc++-v3 "$out"
 
-    cp -r libiberty "$out"
-    cp -r include "$out"
-    cp -r contrib "$out"
+      cp -r libiberty "$out"
+      cp -r include "$out"
+      cp -r contrib "$out"
 
-    cp -r config "$out"
-    cp -r multilib.am "$out"
+      cp -r config "$out"
+      cp -r multilib.am "$out"
 
-    cp config.guess "$out"
-    cp config.rpath "$out"
-    cp config.sub "$out"
-    cp config-ml.in "$out"
-    cp ltmain.sh "$out"
-    cp install-sh "$out"
-    cp mkinstalldirs "$out"
+      cp config.guess "$out"
+      cp config.rpath "$out"
+      cp config.sub "$out"
+      cp config-ml.in "$out"
+      cp ltmain.sh "$out"
+      cp install-sh "$out"
+      cp mkinstalldirs "$out"
 
-    [[ -f MD5SUMS ]]; cp MD5SUMS "$out"
-  '';
+    ''
+    # `src/Makefile` runs this to compute `LTLDFLAGS`, reaching out of the
+    # subdirectory for it as `$(top_srcdir)/../libtool-ldflags`. Missing, the
+    # shell says "No such file or directory" and `LTLDFLAGS` silently comes out
+    # empty, dropping our `LDFLAGS` from every library link.
+    + ''
+      cp libtool-ldflags "$out"
+
+    ''
+    # `MD5SUMS` exists only in release tarballs, not in a VCS checkout.
+    + ''
+      if [[ -f MD5SUMS ]]; then cp MD5SUMS "$out"; fi
+    ''
+  );
 
   outputs = [
     "out"
@@ -85,6 +99,59 @@ stdenv.mkDerivation (finalAttrs: {
     cd "$buildRoot"
     configureScript=$sourceRoot/configure
     chmod +x "$configureScript"
+
+  ''
+  # Build libstdc++ with the *C* driver, not `g++`. `g++` implies `-lstdc++`,
+  # which cannot be satisfied while building the very library that provides
+  # it, and the link fails with `cannot find -lstdc++`.
+  #
+  # This is not our invention; it is what a monolithic build does, and
+  # `libstdc++-v3/src/Makefile.am` says so where it defines `CXXLINK`:
+  #
+  #     We cannot allow g++ to be used since this would add -lstdc++ to the
+  #     link line which of course is problematic at this point.  So, we get
+  #     the top-level directory to configure libstdc++-v3 to use gcc as the
+  #     C++ compilation driver.
+  #
+  # The top level does that through `RAW_CXX_FOR_TARGET`, which is `xgcc`
+  # -- not `xg++` -- plus `-shared-libgcc` and `-nostdinc++`. Building
+  # standalone there is no top level to arrange it, so arrange it here. The
+  # C driver still compiles `.cc` as C++ by extension; what it drops is the
+  # implicit `-lstdc++`. `-shared-libgcc` puts back the linkage `g++` would
+  # have chosen, which the C driver does not default to, and `-nostdinc++`
+  # keeps any already-installed C++ headers out of a build whose whole
+  # purpose is to produce them.
+  + ''
+    cxxForLibstdcxx="$CC -shared-libgcc -nostdinc++"
+
+  ''
+  # Put libgcc's `gthr-default.h` where libstdc++ expects to find it.
+  #
+  # It is not a source file. In a monolithic build libgcc's Makefile creates
+  # it by copying whichever `gthr-<model>.h` matches the target's thread
+  # model, and libstdc++ -- configured inside that same build tree -- picks
+  # it up. Standalone there is no such tree, so take the one `libgcc`
+  # installed. The two implement a single threading model between them, and
+  # copying libgcc's own answer is what makes them agree by construction
+  # rather than by two independent guesses that can drift apart. `libgcc`
+  # decided it from the libc; `gcc_cv_target_thread_file` below repeats the
+  # same value.
+  #
+  # The consequence of getting this wrong is worth spelling out, because the
+  # installed headers do not show it. `GLIBCXX_CHECK_GTHREADS` compiles
+  # `#include "gthr.h"` and requires `__GTHREADS_CXX0X`, which
+  # `gthr-posix.h` defines unconditionally. With no posix `gthr-default.h`
+  # on the include path that test fails, configure concludes there are no
+  # gthreads, and `_GLIBCXX_HAS_GTHREADS` is left undefined in
+  # `c++config.h` -- so `<mutex>` compiles away and `std::mutex` does not
+  # exist. Stating the intent with `--enable-threads=posix` does not help:
+  # the probe overrides intent with an empirical answer, so the header has
+  # to actually be there.
+  + ''
+    cp ${lib.getDev libgcc}/include/gthr-default.h "$sourceRoot/../libgcc/gthr-default.h"
+
+    export CXX="$cxxForLibstdcxx"
+    echo "libstdcxx: building with CXX=$CXX"
   '';
 
   configurePlatforms = [
@@ -94,11 +161,19 @@ stdenv.mkDerivation (finalAttrs: {
 
   configureFlags = [
     "--disable-dependency-tracking"
-    "gcc_cv_target_thread_file=posix"
+    # The same answer `libgcc` used, and the model of the `gthr-default.h`
+    # copied in above. A mismatch here is silent: the unwinder's locks vanish
+    # while `libstdc++` still hands out `std::thread`.
+    "gcc_cv_target_thread_file=${libgcc.threadModel}"
     "cross_compiling=true"
     "--disable-multilib"
 
-    "--enable-clocale=gnu"
+    # `gnu` is the glibc locale model: `config/locale/gnu/ctype_members.cc`
+    # reads `__ctype_b`, which only glibc has. Forcing it everywhere breaks any
+    # other libc -- on musl the build fails converting `const unsigned short *`
+    # to `const ctype_base::mask *`. Configure picks the right model from the
+    # host triple on its own, as it does for the monolithic build, which passes
+    # no `--enable-clocale` at all.
     "--disable-libstdcxx-pch"
     "--disable-vtable-verify"
     "--enable-libstdcxx-visibility"
diff --git a/pkgs/development/compilers/llvm/common/flang-rt/default.nix b/pkgs/development/compilers/llvm/common/flang-rt/default.nix
index 01a1d6ca8584..40944ccf2adc 100644
--- a/pkgs/development/compilers/llvm/common/flang-rt/default.nix
+++ b/pkgs/development/compilers/llvm/common/flang-rt/default.nix
@@ -15,7 +15,10 @@ let
 
   minDarwinVersion = "10.12";
   effectiveDarwinVersion =
-    if stdenv.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinMinVersion minDarwinVersion then
+    if
+      stdenv.hostPlatform.isDarwin
+      && lib.versionOlder stdenv.hostPlatform.darwinMinVersion minDarwinVersion
+    then
       minDarwinVersion
     else
       stdenv.hostPlatform.darwinMinVersion;
@@ -57,7 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
     libllvm
   ];
 
-  env = lib.optionalAttrs stdenv.isDarwin {
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
     MACOSX_DEPLOYMENT_TARGET = effectiveDarwinVersion;
     NIX_CFLAGS_COMPILE = "-mmacosx-version-min=${effectiveDarwinVersion}";
   };
@@ -70,7 +73,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeFeature "LLVM_DIR" "${libllvm.dev}/lib/cmake/llvm")
     (lib.cmakeFeature "LLVM_ENABLE_RUNTIMES" "flang-rt")
   ]
-  ++ lib.optionals stdenv.isDarwin [
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     (lib.cmakeFeature "CMAKE_OSX_DEPLOYMENT_TARGET" effectiveDarwinVersion)
   ];
 
diff --git a/pkgs/development/compilers/swift/wrapper/default.nix b/pkgs/development/compilers/swift/wrapper/default.nix
index e446bec66868..b3c42685a4cf 100644
--- a/pkgs/development/compilers/swift/wrapper/default.nix
+++ b/pkgs/development/compilers/swift/wrapper/default.nix
@@ -53,7 +53,6 @@ stdenv.mkDerivation (
       stdenv.targetPlatform.darwinMinVersion
     );
 
-    passAsFile = [ "buildCommand" ];
     buildCommand = ''
       mkdir -p $out/bin $out/nix-support
 
diff --git a/pkgs/development/lean-modules/mathlib/default.nix b/pkgs/development/lean-modules/mathlib/default.nix
index 8b76f66964c4..eda7d235adba 100644
--- a/pkgs/development/lean-modules/mathlib/default.nix
+++ b/pkgs/development/lean-modules/mathlib/default.nix
@@ -72,11 +72,11 @@ in
 runCommand mathlib__archive.name
   {
     nativeBuildInputs = [ leangz-raw ];
+    inherit (mathlib__archive) pname version;
     passthru = {
       inherit mathlib__archive;
       inherit (mathlib__archive)
         src
-        version
         lakePackageName
         lean4
         allLeanDeps
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 2181d2e4a26d..0188703a78fc 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -70,20 +70,20 @@
   withDav1d ? withHeadlessDeps, # AV1 decoder (focused on speed and correctness)
   withDavs2 ? withFullDeps && withGPL, # AVS2 decoder
   withDc1394 ? withFullDeps && !stdenv.hostPlatform.isDarwin, # IIDC-1394 grabbing (ieee 1394)
-  withDrm ? withHeadlessDeps && (with stdenv; isLinux || isFreeBSD), # libdrm support
+  withDrm ? withHeadlessDeps && (with stdenv.hostPlatform; isLinux || isFreeBSD), # libdrm support
   withDvdnav ? withFullDeps && withGPL && lib.versionAtLeast version "7", # needed for DVD demuxing
   withDvdread ? withFullDeps && withGPL && lib.versionAtLeast version "7", # needed for DVD demuxing
   withFdkAac ? withFullDeps && (!withGPL || withUnfree), # Fraunhofer FDK AAC de/encoder
   withNvcodec ?
     withHeadlessDeps
     && (
-      with stdenv;
+      with stdenv.hostPlatform;
       !isDarwin
       && !isAarch32
-      && !hostPlatform.isLoongArch64
-      && !hostPlatform.isRiscV
-      && !(hostPlatform.isPower && hostPlatform.isBigEndian)
-      && hostPlatform == buildPlatform
+      && !isLoongArch64
+      && !isRiscV
+      && !(isPower && isBigEndian)
+      && stdenv.hostPlatform == stdenv.buildPlatform
     ), # dynamically linked Nvidia code
   withFlite ? withFullDeps, # Voice Synthesis
   withFontconfig ? withHeadlessDeps, # Needed for drawtext filter
@@ -152,8 +152,8 @@
   withUavs3d ? withFullDeps, # AVS3 decoder
   withV4l2 ? withHeadlessDeps && stdenv.hostPlatform.isLinux, # Video 4 Linux support
   withV4l2M2m ? withV4l2,
-  withVaapi ? withHeadlessDeps && (with stdenv; isLinux || isFreeBSD), # Vaapi hardware acceleration
-  withVdpau ? withSmallDeps && (with stdenv; isLinux || isFreeBSD), # Vdpau hardware acceleration
+  withVaapi ? withHeadlessDeps && (with stdenv.hostPlatform; isLinux || isFreeBSD), # Vaapi hardware acceleration
+  withVdpau ? withSmallDeps && (with stdenv.hostPlatform; isLinux || isFreeBSD), # Vdpau hardware acceleration
   withVidStab ? withHeadlessDeps && withGPL, # Video stabilization
   withVmaf ? withFullDeps && lib.versionAtLeast version "5", # Netflix's VMAF (Video Multi-Method Assessment Fusion)
   withVoAmrwbenc ? withFullDeps && withVersion3, # AMR-WB encoder
diff --git a/pkgs/development/libraries/fmt/default.nix b/pkgs/development/libraries/fmt/default.nix
index 641a91d75629..6c63ba589886 100644
--- a/pkgs/development/libraries/fmt/default.nix
+++ b/pkgs/development/libraries/fmt/default.nix
@@ -106,7 +106,7 @@ in
     version = "12.2.0";
     hash = "sha256-Tc7PmNxUv7ajw6GaHPGEEtrD/fl6is7RB8TPestJa1o=";
 
-    patches = lib.optionals stdenv.is32bit [
+    patches = lib.optionals stdenv.hostPlatform.is32bit [
       # fix build on 32-bit targets
       # FIXME: remove in next update
       (fetchpatch {
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 5e391970a271..6ce41321494e 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -278,6 +278,11 @@ stdenv.mkDerivation (
     passthru = {
       inherit version;
       minorRelease = version;
+
+      # glibc's threads are POSIX threads. `libgcc` and `libstdc++` have to be
+      # configured for the same threading model as each other, so rather than
+      # have each guess, they take it from the libc they are built against.
+      threadModel = "posix";
     };
   }
 
diff --git a/pkgs/development/python-modules/aioghost/default.nix b/pkgs/development/python-modules/aioghost/default.nix
index db86aafd313b..35fdc9bd8020 100644
--- a/pkgs/development/python-modules/aioghost/default.nix
+++ b/pkgs/development/python-modules/aioghost/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aioghost";
-  version = "0.4.22";
+  version = "0.4.23";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TryGhost";
     repo = "aioghost";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UGRi+MoKkh/muxwubMG4DySTpK/lqmGCloWznFvN2pc=";
+    hash = "sha256-bgWBZvkHkUE1o2a6L6vC1YK41Da0SayPhTLJeTbnYxk=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/aiopnsense/default.nix b/pkgs/development/python-modules/aiopnsense/default.nix
index 20814cab7208..310cb1a54d7f 100644
--- a/pkgs/development/python-modules/aiopnsense/default.nix
+++ b/pkgs/development/python-modules/aiopnsense/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aiopnsense";
-  version = "1.1.5";
+  version = "1.1.7";
   pyproject = true;
 
   disabled = pythonOlder "3.14";
@@ -24,7 +24,7 @@ buildPythonPackage (finalAttrs: {
     owner = "Snuffy2";
     repo = "aiopnsense";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-amXqUp77L72fv6xxz4Nm7fMj4xxWaYrsy1EPxccKm+Q=";
+    hash = "sha256-xVbbbhxQMNeK56d4k274Z8+X8ggScJjYKH9V4CfwrRk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/bittensor-core/default.nix b/pkgs/development/python-modules/bittensor-core/default.nix
index 524fa9e0c788..2c2eb82ea129 100644
--- a/pkgs/development/python-modules/bittensor-core/default.nix
+++ b/pkgs/development/python-modules/bittensor-core/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "bittensor-core";
-  version = "0.1.1";
+  version = "0.1.2";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -18,7 +18,7 @@ buildPythonPackage (finalAttrs: {
   src = fetchPypi {
     pname = "bittensor_core";
     inherit (finalAttrs) version;
-    hash = "sha256-xAw0uZhjc0uoh/6bzFFp4IvqyV7vc6cPnrjkMLIvjLU=";
+    hash = "sha256-PsnNAB69iou4LgmPtsLwdrCI0mjygc4GH8qysm1I7DQ=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
diff --git a/pkgs/development/python-modules/cyclonedx-python-lib/default.nix b/pkgs/development/python-modules/cyclonedx-python-lib/default.nix
index 7d8b3a7c96c8..4b73854c0d7b 100644
--- a/pkgs/development/python-modules/cyclonedx-python-lib/default.nix
+++ b/pkgs/development/python-modules/cyclonedx-python-lib/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "cyclonedx-python-lib";
-  version = "11.11.1";
+  version = "11.11.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "CycloneDX";
     repo = "cyclonedx-python-lib";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-y9sAbo0O1JIna6PODpvS3Js6UF1nKUFc4s8jx8UqLwY=";
+    hash = "sha256-VszqYukH8MGt3BUSc0ohhuQAc2t3NXGkvEm8rcuTJac=";
   };
 
   pythonRelaxDeps = [ "py-serializable" ];
diff --git a/pkgs/development/python-modules/datafusion/default.nix b/pkgs/development/python-modules/datafusion/default.nix
index e45818b9c6fa..1fc347993392 100644
--- a/pkgs/development/python-modules/datafusion/default.nix
+++ b/pkgs/development/python-modules/datafusion/default.nix
@@ -4,6 +4,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   rustPlatform,
+  pythonOlder,
 
   # nativeBuildInputs
   protoc,
@@ -12,6 +13,7 @@
   protobuf,
 
   # dependencies
+  cloudpickle,
   pyarrow,
   typing-extensions,
 
@@ -26,7 +28,7 @@
 buildPythonPackage (finalAttrs: {
   pname = "datafusion";
   # WARNING: Ensure rerun-sdk is compatible with this version of datafusion
-  version = "53.0.0";
+  version = "54.0.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -37,12 +39,12 @@ buildPythonPackage (finalAttrs: {
     tag = finalAttrs.version;
     # Fetch arrow-testing and parquet-testing (tests assets)
     fetchSubmodules = true;
-    hash = "sha256-3plgAJuh2rrnvzkQVy3gUgEoHHT4FSjDp5DZx1keD+g=";
+    hash = "sha256-Kh8w8L3AJCs9a3KA9RHaA0btbJEBdYZge1VK7AX0lX0=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname src version;
-    hash = "sha256-kHGlUaPNSs1Nh3HCU+yUVQq/IXp9PUwpDmfAon8eRBk=";
+    hash = "sha256-s4+Y2axZKL7wKiw8Z6c12eWAnf1zGPAFFvWS45vFrlo=";
   };
 
   nativeBuildInputs = with rustPlatform; [
@@ -56,7 +58,10 @@ buildPythonPackage (finalAttrs: {
   ];
 
   dependencies = [
+    cloudpickle
     pyarrow
+  ]
+  ++ lib.optionals (pythonOlder "3.13") [
     typing-extensions
   ];
 
diff --git a/pkgs/development/python-modules/django-hcaptcha/default.nix b/pkgs/development/python-modules/django-hcaptcha/default.nix
index 9f51677dbdaa..cb0017420cb5 100644
--- a/pkgs/development/python-modules/django-hcaptcha/default.nix
+++ b/pkgs/development/python-modules/django-hcaptcha/default.nix
@@ -2,13 +2,14 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
   django,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "django-hcaptcha";
   version = "0.2.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) version;
@@ -16,7 +17,9 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-slGerwzJeGWscvglMBEixc9h4eSFLWiVmUFgIirLbBo=";
   };
 
-  propagatedBuildInputs = [ django ];
+  build-system = [ setuptools ];
+
+  dependencies = [ django ];
 
   # No tests
   doCheck = false;
diff --git a/pkgs/development/python-modules/django-health-check/default.nix b/pkgs/development/python-modules/django-health-check/default.nix
index ba4f3d30eff9..25c83dd8fe5f 100644
--- a/pkgs/development/python-modules/django-health-check/default.nix
+++ b/pkgs/development/python-modules/django-health-check/default.nix
@@ -69,7 +69,7 @@ buildPythonPackage (finalAttrs: {
     "test_check_status__nonexistent_hostname"
     "test_check_status__no_answer"
   ]
-  ++ lib.optionals stdenv.isDarwin [
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # sensors_temperatures is not available on darwin: https://psutil.readthedocs.io/stable/index.html#psutil.sensors_temperatures
     "TestTemperature"
     # some metrics aren't available on darwin: https://psutil.readthedocs.io/stable/index.html#psutil.virtual_memory
diff --git a/pkgs/development/python-modules/django-ipware/default.nix b/pkgs/development/python-modules/django-ipware/default.nix
index 01c66883d04b..95cf8140e306 100644
--- a/pkgs/development/python-modules/django-ipware/default.nix
+++ b/pkgs/development/python-modules/django-ipware/default.nix
@@ -1,28 +1,41 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   django,
   python-ipware,
+  setuptools,
+  pytestCheckHook,
+  pytest-django,
 }:
 
 buildPythonPackage rec {
   pname = "django-ipware";
   version = "7.0.1";
-  format = "setuptools";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-2exD0r983yFv7Y1JSghN61dhpUhgpTsudDRqTzhM/0c=";
+  src = fetchFromGitHub {
+    owner = "un33k";
+    repo = "django-ipware";
+    tag = "v${version}";
+    hash = "sha256-jLEHhJ6oNT1tsSqMbfPw1tb2Z/iQa8V6LpbT4ChLKI4=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     django
     python-ipware
   ];
 
-  # django.core.exceptions.ImproperlyConfigured: Requested setting IPWARE_TRUSTED_PROXY_LIST, but settings are not configured. You must either define the environment variable DJANGO_SETTINGS_MODULE or call settings.configure() before accessing settings.
-  doCheck = false;
+  env.DJANGO_SETTINGS_MODULE = "ipware.tests.testsettings";
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-django
+  ];
+
+  enabledTestPaths = [ "ipware/tests/tests*.py" ];
 
   # pythonImportsCheck fails with:
   # django.core.exceptions.ImproperlyConfigured: Requested setting IPWARE_META_PRECEDENCE_ORDER, but settings are not configured. You must either define the environment variable DJANGO_SETTINGS_MODULE or call settings.configure() before accessing settings.
diff --git a/pkgs/development/python-modules/django-tenants/default.nix b/pkgs/development/python-modules/django-tenants/default.nix
index 345e01ead7cd..ee702b8bbdb4 100644
--- a/pkgs/development/python-modules/django-tenants/default.nix
+++ b/pkgs/development/python-modules/django-tenants/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "django-tenants";
-  version = "3.12.0";
+  version = "3.14.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "django-tenants";
     repo = "django-tenants";
     tag = "v${version}";
-    hash = "sha256-0HFkLG2GDECiaG9OKYR4V1q5oy0vzmthlKoiSM5IIFc=";
+    hash = "sha256-3A4ClGinyN1t5bt441BVZncpw9Ie7b81M/5Tfsbz4kw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/docling-slim/default.nix b/pkgs/development/python-modules/docling-slim/default.nix
index 368a0e9cf5a5..8ab9c98d5f45 100644
--- a/pkgs/development/python-modules/docling-slim/default.nix
+++ b/pkgs/development/python-modules/docling-slim/default.nix
@@ -87,6 +87,7 @@
   # tests
   ffmpeg-headless,
   gitMinimal,
+  pytest-xdist,
   pytestCheckHook,
   writableTmpDirAsHomeHook,
 }:
@@ -283,6 +284,7 @@ buildPythonPackage (finalAttrs: {
     openpyxl
     pylatexenc
     pypdfium2
+    pytest-xdist
     pytestCheckHook
     python-docx
     python-pptx
diff --git a/pkgs/development/python-modules/elevenlabs/default.nix b/pkgs/development/python-modules/elevenlabs/default.nix
index 2734615eab7b..4b87bd6759b7 100644
--- a/pkgs/development/python-modules/elevenlabs/default.nix
+++ b/pkgs/development/python-modules/elevenlabs/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "elevenlabs";
-  version = "2.60.0";
+  version = "2.63.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "elevenlabs";
     repo = "elevenlabs-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Foe5icwDNVD/g/tss1UG9wzrzXmECzXr/3Ql6yA4YHY=";
+    hash = "sha256-Fm7gB892mm0K8HgYAC2pGEMQaB90cX7jwiMZqF27lgk=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/hishel/default.nix b/pkgs/development/python-modules/hishel/default.nix
index 32acc70f5075..95c5ae5558e6 100644
--- a/pkgs/development/python-modules/hishel/default.nix
+++ b/pkgs/development/python-modules/hishel/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "hishel";
-  version = "1.3.0";
+  version = "1.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "karpetrosyan";
     repo = "hishel";
     tag = version;
-    hash = "sha256-aD6sHMM7dzy6n1EJN/+K+7H5nu5ohGfru224pSAf1Nc=";
+    hash = "sha256-KVfbWhGpbLGzK3fQOuT+KtBi13z5ZZBP8NOsIIfObMc=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/hist/default.nix b/pkgs/development/python-modules/hist/default.nix
index 97284cd81450..ea689543c8b7 100644
--- a/pkgs/development/python-modules/hist/default.nix
+++ b/pkgs/development/python-modules/hist/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "hist";
-  version = "2.10.1";
+  version = "2.11.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-3sjmrHmm1k7Ihzzzaz7wOUx5r/Ow6Kvtcf3Hf9xCGy4=";
+    hash = "sha256-kusfoMo5utYZ9/cEs7qTxEs1U7BEX22ywXxnwBuctTQ=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/langgraph-runtime-inmem/default.nix b/pkgs/development/python-modules/langgraph-runtime-inmem/default.nix
index b71f232b093c..48f64d24b0ca 100644
--- a/pkgs/development/python-modules/langgraph-runtime-inmem/default.nix
+++ b/pkgs/development/python-modules/langgraph-runtime-inmem/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langgraph-runtime-inmem";
-  version = "0.31.2";
+  version = "0.32.3";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -22,7 +22,7 @@ buildPythonPackage (finalAttrs: {
   src = fetchPypi {
     pname = "langgraph_runtime_inmem";
     inherit (finalAttrs) version;
-    hash = "sha256-VE7gXsjV+pXhz85rZnD9mhgwp5QRXvxEjdgF7tjNBAE=";
+    hash = "sha256-k5ATRuxkds7dDZx3lxGJUL+vUgVFHe8/BaAZqoaaxd4=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/otter-grader/default.nix b/pkgs/development/python-modules/otter-grader/default.nix
index 7821be272a4d..42b5bbd5c31c 100644
--- a/pkgs/development/python-modules/otter-grader/default.nix
+++ b/pkgs/development/python-modules/otter-grader/default.nix
@@ -122,7 +122,7 @@ buildPythonPackage (finalAttrs: {
     # this R Markdown test, causing a partial credit output mismatch
     "test_rmd"
   ]
-  ++ lib.optionals stdenv.isDarwin [
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # socket.bind() fails under macOS sandbox
     "test_otter_example"
     "test_jupyterlite"
diff --git a/pkgs/development/python-modules/pillow-jxl-plugin/default.nix b/pkgs/development/python-modules/pillow-jxl-plugin/default.nix
index 4d6363dd7ac1..395cb68d412c 100644
--- a/pkgs/development/python-modules/pillow-jxl-plugin/default.nix
+++ b/pkgs/development/python-modules/pillow-jxl-plugin/default.nix
@@ -59,7 +59,7 @@ buildPythonPackage (finalAttrs: {
     changelog = "https://github.com/Isotr0py/pillow-jpegxl-plugin/releases/tag/v${finalAttrs.version}";
     description = "Pillow plugin that adds support for JPEG XL files";
     homepage = "https://github.com/Isotr0py/pillow-jpegxl-plugin";
-    license = lib.licenses.gpl3Only;
+    license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [
       dandellion
       KunyaKud
diff --git a/pkgs/development/python-modules/plumbum/default.nix b/pkgs/development/python-modules/plumbum/default.nix
index 4b08a851a397..137a7a66dd59 100644
--- a/pkgs/development/python-modules/plumbum/default.nix
+++ b/pkgs/development/python-modules/plumbum/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "plumbum";
-  version = "2.0.1";
+  version = "2.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tomerfiliba";
     repo = "plumbum";
     tag = "v${version}";
-    hash = "sha256-XwsEcAHvVhWQG5trznOvkfP8Al7kfMGSG2wR0sXY+eI=";
+    hash = "sha256-i99HpT/QuF9JwX92IwwOqpEVUc/1k39E7N9v9TZ4Qvg=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/py-dactyl/default.nix b/pkgs/development/python-modules/py-dactyl/default.nix
index 8bed0ba855bc..6b5e3b929c43 100644
--- a/pkgs/development/python-modules/py-dactyl/default.nix
+++ b/pkgs/development/python-modules/py-dactyl/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "py-dactyl";
-  version = "2.1.2";
+  version = "2.1.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "iamkubi";
     repo = "pydactyl";
     tag = "v${version}";
-    hash = "sha256-/bmk4RIS8pEi+RbJ+6tOchwFj246hdoTXv6WBNisKuc=";
+    hash = "sha256-WgsykxwcpUasbYJdhM2s/+a7SaORzA7mW+9AhORxcbA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pycdlib/default.nix b/pkgs/development/python-modules/pycdlib/default.nix
index 494f8075f0fa..deaccd228afe 100644
--- a/pkgs/development/python-modules/pycdlib/default.nix
+++ b/pkgs/development/python-modules/pycdlib/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pycdlib";
-  version = "1.16.0";
+  version = "1.20.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "clalancette";
     repo = "pycdlib";
     tag = "v${version}";
-    hash = "sha256-uJ9rMriRCLXpKekG8vGsIw+s0e6wlfX0soAYs6HGe0Y=";
+    hash = "sha256-4FkB1QkvbZ/GIlBM14jiGbc6m7MA5EIlq1LjeXGVXC0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pygame-ce/default.nix b/pkgs/development/python-modules/pygame-ce/default.nix
index fd6efdd93aee..7ffb8bcdbc29 100644
--- a/pkgs/development/python-modules/pygame-ce/default.nix
+++ b/pkgs/development/python-modules/pygame-ce/default.nix
@@ -42,7 +42,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pygame-ce";
-  version = "2.5.7";
+  version = "2.5.8";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -50,7 +50,7 @@ buildPythonPackage (finalAttrs: {
     owner = "pygame-community";
     repo = "pygame-ce";
     tag = finalAttrs.version;
-    hash = "sha256-Yjs2SLgPVMOy8DCS+Pfk0fs0G//sY20jfGQNJ5rN58Q=";
+    hash = "sha256-1aUrnTllhaMjsCd/vVQ6aPDgcUdjBTPTeLzfrI6YLCI=";
     # Unicode files cause different checksums on HFS+ vs. other filesystems
     postFetch = "rm -rf $out/docs/reST";
   };
@@ -78,10 +78,10 @@ buildPythonPackage (finalAttrs: {
     # cython was pinned to fix windows build hangs (pygame-community/pygame-ce/pull/3015)
     ''
       substituteInPlace pyproject.toml \
-        --replace-fail "meson-python<=0.18.0" "meson-python" \
-        --replace-fail "meson<=1.10.0" "meson" \
+        --replace-fail "meson-python<=0.20.0" "meson-python" \
+        --replace-fail "meson<=1.11.2" "meson" \
         --replace-fail "ninja<=1.13.0" "ninja" \
-        --replace-fail "cython<=3.2.4" "cython" \
+        --replace-fail "cython<=3.2.9" "cython" \
         --replace-fail "sphinx<=8.2.3" "sphinx" \
         --replace-fail "astroid<4.0.0" "astroid" \
         --replace-fail "sphinx-autoapi<=3.6.0" "sphinx-autoapi" \
diff --git a/pkgs/development/python-modules/pyimouapi/default.nix b/pkgs/development/python-modules/pyimouapi/default.nix
index 5b3e673949f8..0e31748b5f50 100644
--- a/pkgs/development/python-modules/pyimouapi/default.nix
+++ b/pkgs/development/python-modules/pyimouapi/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyimouapi";
-  version = "1.3.3";
+  version = "1.3.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Imou-OpenPlatform";
     repo = "Py-Imou-Open-Api";
     tag = finalAttrs.version;
-    hash = "sha256-g70zYBmhQXlk1EUExqWuHWDenx8ZCcnMvh8wo1hLS4g=";
+    hash = "sha256-rX6BQFxUktrlZAhjRySheQRbEu6TFKxZwpjIi1wx85I=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/ray/default.nix b/pkgs/development/python-modules/ray/default.nix
index 9ced1b9c373c..b3e46194b649 100644
--- a/pkgs/development/python-modules/ray/default.nix
+++ b/pkgs/development/python-modules/ray/default.nix
@@ -60,6 +60,8 @@
   scipy,
   # serve
   fastapi,
+  jinja2,
+  mmh3,
   starlette,
   uvicorn,
   watchfiles,
@@ -73,7 +75,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ray";
-  version = "2.56.1";
+  version = "2.57.0";
   format = "wheel";
   __structuredAttrs = true;
 
@@ -91,22 +93,22 @@ buildPythonPackage (finalAttrs: {
       # Results are in ./ray-hashes.nix
       hashes = {
         x86_64-linux = {
-          cp311 = "sha256-5wA6R6Qu8q0z7As03Ftq+wP2P+WUZeb0yPbQVJLZ5KY=";
-          cp312 = "sha256-5dMXNpaDETTHa9CUUd/pXDLXLCcSU7DWsJ0t+ZlKpmA=";
-          cp313 = "sha256-gfLbICzDG8P1xKz57xVNEPHzns5gLZ0tMQiHXEm/AcM=";
-          cp314 = "sha256-rpH+V4+t6jjBOiCKD+wn4c7SOMzfX/+V7z4wrDBx3sk=";
+          cp311 = "sha256-sMw9Q1vvbn/+hIgW5zadMO4pfojEwavGMjzJOD/zgm8=";
+          cp312 = "sha256-WV0Iix/RrdZGVMbOviA+JZA3h7ZQ01xKPcAI1FHkikE=";
+          cp313 = "sha256-caocUv54AM0he2Ab+f9VfCo//l+tWwD2eS2ppniyyRQ=";
+          cp314 = "sha256-AssrX99BJG9rkwbIUkfucTG/7unTak7a5UZT4C7XiQw=";
         };
         aarch64-linux = {
-          cp311 = "sha256-TfRfM8wXaxHGkZHv3PtKzq7qIv7Pp4T2SFtlBO+MiyY=";
-          cp312 = "sha256-j91rCWIVkGzx+azceJjJ1hQGBvLSckV3i4OFqfGebLA=";
-          cp313 = "sha256-f9xH3k4jDw23xsZoqeFh+GTaxUi9MiMJhuCww244brU=";
-          cp314 = "sha256-6jcsf5WxTx928L3Sq8lgLFboi8MGmdIij3gTPndJsvE=";
+          cp311 = "sha256-epgm4zv69GUhmrMp4F8D4/apGfzl0haS9axWakQnfLM=";
+          cp312 = "sha256-7rHRrbYb0div/cX7VVrwSU/tj+xTuDV21MYPgR4GvpQ=";
+          cp313 = "sha256-Xi2SWPdRZ291gdwK0wfC2RKQglRCNmEoye0MzQ9guEU=";
+          cp314 = "sha256-4kiTkpbwyPRrPnNCFVV3YJSXKx28c9SAJHm5kXfCJp4=";
         };
         aarch64-darwin = {
-          cp311 = "sha256-XuvXds1GHt68WHTS37owBRR7a0VkXYoWplSTEcXv/+o=";
-          cp312 = "sha256-RLwAAMW/rYWy/24O+R6V+QHRotL91y+U8IoEbrSUzWE=";
-          cp313 = "sha256-k97atlgzSvgYd7bthAxOX4Xi4LGzZBsg6q7jfK2DXMY=";
-          cp314 = "sha256-dvYmimacHZkQ8de3OQPePt6YUO2U0+KDGNSVVZvTfQ4=";
+          cp311 = "sha256-oBbWJYtTVxlS8qglFXGy1z2PawmBvmxh4WDMkBtxGHE=";
+          cp312 = "sha256-jvWRV1xTF5P+t/d3RMUsNFCf9YtIsw0KO8tqFmYlawI=";
+          cp313 = "sha256-IbZ+3cdRuoxl3u6GVAdcK0KFEQTJNs5CynlExLbsR5k=";
+          cp314 = "sha256-eYoe4k5O3jnpAPzJNdhttfCA0np0xX4yOKUAS6kXEgA=";
         };
       };
     in
@@ -215,10 +217,16 @@ buildPythonPackage (finalAttrs: {
     serve = lib.unique (
       [
         fastapi
+        # Undeclared upstream: `ray.serve._private.haproxy`, imported by the serve controller since
+        # 2.57.0, needs it
+        jinja2
+        mmh3
         requests
         starlette
         uvicorn
         watchfiles
+        # `ray-haproxy` (upstream, linux-only) is not packaged: it only ships an HAProxy binary, and
+        # ray falls back to `haproxy` from PATH
       ]
       ++ self.default
     );
diff --git a/pkgs/development/python-modules/redisvl/default.nix b/pkgs/development/python-modules/redisvl/default.nix
index b013caa48ec0..b95b33a9b86d 100644
--- a/pkgs/development/python-modules/redisvl/default.nix
+++ b/pkgs/development/python-modules/redisvl/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "redisvl";
-  version = "0.25.0";
+  version = "0.25.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "redis";
     repo = "redis-vl-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+b27+c3S/XNRTIyXyqgjV6Z5MD9GnuqjrpME09qyEog=";
+    hash = "sha256-SDNcGmARLaRdAqqzmJf5lBeGsiPCj5xbsdyzYdaYl0w=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/rerun-notebook/default.nix b/pkgs/development/python-modules/rerun-notebook/default.nix
index 208fa166fa35..90d78ca850c2 100644
--- a/pkgs/development/python-modules/rerun-notebook/default.nix
+++ b/pkgs/development/python-modules/rerun-notebook/default.nix
@@ -22,7 +22,7 @@ buildPythonPackage (finalAttrs: {
     inherit (finalAttrs) version;
     format = "wheel";
     python = "py2.py3";
-    hash = "sha256-PMhHz/rTB3yIOg80g/dt/ktq4pHZ6hNrCYdlp70dcOI=";
+    hash = "sha256-2w2Jvoz/L5VPx4dGcYyQkdcitoPO+NJCzuAxeJR9JHM=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/rerun-sdk/default.nix b/pkgs/development/python-modules/rerun-sdk/default.nix
index ca0f5893deb4..c09a4905d7ea 100644
--- a/pkgs/development/python-modules/rerun-sdk/default.nix
+++ b/pkgs/development/python-modules/rerun-sdk/default.nix
@@ -12,10 +12,9 @@
   # dependencies
   attrs,
   numpy,
-  opencv4,
   pillow,
+  psutil,
   pyarrow,
-  semver,
   typing-extensions,
 
   # tests
@@ -23,9 +22,10 @@
   datafusion,
   inline-snapshot,
   polars,
-  pytest-snapshot,
   pytestCheckHook,
   rerun-notebook,
+  semver,
+  syrupy,
   tomli,
   torch,
   torchvision,
@@ -67,7 +67,7 @@ buildPythonPackage {
     # dependencies), so they are never codegen'd and runtime dispatch falls back to the equivalent
     # AVX2 / scalar kernels.
     + ''
-      lanceDistance="$cargoDepsCopy/source-registry-0/lance-linalg-8.0.0/src/distance"
+      lanceDistance="$cargoDepsCopy/source-registry-0/lance-linalg-9.0.0/src/distance"
 
       substituteInPlace "$lanceDistance/dot_u8.rs" \
         --replace-fail "return |a, b| unsafe { x86::dot_u8_avx512_vnni(a, b) };" ""
@@ -89,10 +89,9 @@ buildPythonPackage {
   dependencies = [
     attrs
     numpy
-    opencv4
     pillow
+    psutil
     pyarrow
-    semver
     typing-extensions
   ];
 
@@ -115,9 +114,10 @@ buildPythonPackage {
     datafusion
     inline-snapshot
     polars
-    pytest-snapshot
     pytestCheckHook
     rerun-notebook
+    semver
+    syrupy
     tomli
     torch
     torchvision
@@ -126,11 +126,15 @@ buildPythonPackage {
   inherit (rerun) addDlopenRunpaths addDlopenRunpathsPhase;
   postPhases = lib.optionals stdenv.hostPlatform.isLinux [ "addDlopenRunpathsPhase" ];
 
+  pytestFlags = [
+    # Some checked-in `.ambr` entries belong to tests skipped below (and to tests upstream has since
+    # removed). syrupy fails the whole session over unused snapshots by default.
+    "--snapshot-warn-unused"
+  ];
+
   disabledTests = [
     # RuntimeError: MP4 error: MP4 demux: MP4 error: file contains a box with a larger size than it
-    "test_allow_b_frames_opts_in_to_b_frame_inputs"
     "test_asset_mode_timeline_type_timestamp_applies_to_index_chunk"
-    "test_b_frames_in_stream_mode_raise"
     "test_custom_entity_path_applies_to_every_chunk"
     "test_default_mode_produces_video_stream_chunks"
     "test_output_codec_same_as_source_stays_on_the_direct_path"
@@ -154,14 +158,6 @@ buildPythonPackage {
     "test_server_with_multiple_datasets"
     "test_viewer_dies_on_client_close"
 
-    # TypeError: 'Snapshot' object is not callable
-    "test_chunk_record_batch"
-    "test_schema_recording"
-
-    # pytest_snapshot mismatch: serialized schema/summary output drifted in 0.32.0
-    "test_schema"
-    "test_summary_format"
-
     # AttributeError: 'datetime.datetime' object has no attribute 'value'
     "test_lenses_time_extraction"
 
@@ -188,6 +184,10 @@ buildPythonPackage {
     # real binaries (rerun.src is fetched without fetchLFS).
     "rerun_py/tests/integration/test_hdf5_reader.py"
 
+    # ModuleNotFoundError: No module named 'mdlint'. It sits next to the test file, which is
+    # not on `sys.path` as `scripts/ci` has no `__init__.py`.
+    "scripts/ci/mdlint_test.py"
+
     # "fixture 'benchmark' not found"
     "tests/python/log_benchmark/test_log_benchmark.py"
     "tests/python/log_benchmark/test_micro_benchmark.py"
@@ -198,7 +198,8 @@ buildPythonPackage {
     # ConnectionError: Connection: connecting to server: transport error
     "rerun_py/tests/api_sandbox/"
 
-    # RuntimeError: Failed to load URDF file: No elements found
+    # RuntimeError: Failed to load URDF file: No elements found. `so100.urdf` is a Git LFS
+    # pointer file, not the real model (rerun.src is fetched without fetchLFS).
     "rerun_py/tests/unit/test_urdf_tree.py"
   ];
 
diff --git a/pkgs/development/python-modules/simple-pid/default.nix b/pkgs/development/python-modules/simple-pid/default.nix
index 2871d0521912..a1a8baa5f6c5 100644
--- a/pkgs/development/python-modules/simple-pid/default.nix
+++ b/pkgs/development/python-modules/simple-pid/default.nix
@@ -27,7 +27,7 @@ buildPythonPackage (finalAttrs: {
     "simple_pid"
   ];
 
-  doCheck = !stdenv.isDarwin;
+  doCheck = !stdenv.hostPlatform.isDarwin;
 
   nativeCheckInputs = [
     pytestCheckHook
diff --git a/pkgs/development/python-modules/stripe/default.nix b/pkgs/development/python-modules/stripe/default.nix
index b6a50ee469de..8e693fad891c 100644
--- a/pkgs/development/python-modules/stripe/default.nix
+++ b/pkgs/development/python-modules/stripe/default.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "stripe";
-  version = "15.4.0";
+  version = "15.5.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+UwngKdyjF+0l4ng+7GOmEJn+T+nJOhACzGuvzbQGx4=";
+    hash = "sha256-a3EEiycKBsE5nJ/2F55pB8eCXsOU9XmpczQNXCuFda4=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/python-modules/uhashring/default.nix b/pkgs/development/python-modules/uhashring/default.nix
index 513dd2ddab72..06c7534bebf6 100644
--- a/pkgs/development/python-modules/uhashring/default.nix
+++ b/pkgs/development/python-modules/uhashring/default.nix
@@ -8,14 +8,14 @@
 }:
 buildPythonPackage rec {
   pname = "uhashring";
-  version = "2.4";
+  version = "2.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ultrabug";
     repo = "uhashring";
     tag = version;
-    hash = "sha256-6zNPExbcwTUne0lT8V6xp2Gf6J1VgG7Q93qizVOAc+k=";
+    hash = "sha256-rxYAqzyGqS+Pp70jD36bvXJHvMshUWbTvmqB+H+3BAM=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/wandb/default.nix b/pkgs/development/python-modules/wandb/default.nix
index cc5467662ba6..4a9e2274a95b 100644
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -13,6 +13,9 @@
   ## wandb-xpu
   rustPlatform,
 
+  ## parquet-rust-wrapper
+  cacert,
+
   ## wandb
   buildPythonPackage,
 
@@ -21,6 +24,7 @@
 
   # dependencies
   click,
+  opentelemetry-api,
   packaging,
   platformdirs,
   protobuf,
@@ -76,22 +80,22 @@
 }:
 
 let
-  version = "0.28.1";
+  version = "0.28.2";
   src = fetchFromGitHub {
     owner = "wandb";
     repo = "wandb";
     tag = "v${version}";
-    hash = "sha256-yXsSHyPOh3QXRRkTL4Rj8lLuFjp1LIKfPiacy4+obAk=";
+    hash = "sha256-kmgLHb+1NjStqcjMOYPPU2v2js4m8O3b2OpM6BiSbXI=";
   };
 
   wandb-xpu = rustPlatform.buildRustPackage {
     pname = "wandb-xpu";
-    version = "0.7.0";
+    version = "0.7.1";
     inherit src;
 
     sourceRoot = "${src.name}/xpu";
 
-    cargoHash = "sha256-vB0LZjfnf//U1BXCzvaQBjlXLlGx/4g+emSZWcS+oGU=";
+    cargoHash = "sha256-YKuXtttLam4NmJsJPQH8sFbj1Qs5Gc2uoFJEvTYxkew=";
 
     checkFlags = [
       # fails in sandbox
@@ -116,12 +120,19 @@ let
 
   parquet-rust-wrapper = rustPlatform.buildRustPackage {
     pname = "arrow-rs-wrapper";
-    version = "0.1.0";
+    version = "0.1.1";
     inherit src;
 
     sourceRoot = "${src.name}/parquet-rust-wrapper";
 
-    cargoHash = "sha256-BkeSRbZoehYGHj15KcInugRBvOLXJlh1NqTHhRnNOK8=";
+    cargoHash = "sha256-F68Rvfc04eI/y0Z5tGtQn4zEmqLuMZGZiKEh2HMFi/g=";
+
+    nativeCheckInputs = [
+      # The `httpfile` tests serve a local HTTP server, but reqwest's rustls backend refuses to
+      # build a client at all without system CA certificates.
+      # Its setup hook exports `SSL_CERT_FILE`.
+      cacert
+    ];
 
     # The original build script renames the library:
     # https://github.com/wandb/wandb/blob/v0.26.0/parquet-rust-wrapper/build.sh#L37-L68
@@ -139,15 +150,8 @@ let
     sourceRoot = "${src.name}/core";
 
     postPatch =
-      # Relax the Go toolchain requirement; nixpkgs ships 1.26.2.
-      ''
-        substituteInPlace go.mod \
-          --replace-fail \
-            "go 1.26.4" \
-            "go 1.26.2"
-      ''
       # hardcode the `wandb-xpu` binary path.
-      + ''
+      ''
         substituteInPlace internal/monitor/xpuresourcemanager.go \
           --replace-fail \
             'cmdPath, err := getXPUCmdPath()' \
@@ -234,6 +238,7 @@ buildPythonPackage (finalAttrs: {
 
   dependencies = [
     click
+    opentelemetry-api
     packaging
     platformdirs
     protobuf
@@ -322,6 +327,12 @@ buildPythonPackage (finalAttrs: {
   ];
 
   disabledTests = [
+    # The conftest mocks out `read_many_from_queue`, which is the agent loop's only throttle.
+    # It then spins while the child runs, and the `MagicMock` API retains every heartbeat
+    # call (~270MiB/s), OOM-killing the pytest worker.
+    "test_agent_config_whitespace_cli_agent"
+    "test_agent_subprocess_with_import_readline"
+
     # Probably failing because of lack of internet access
     # AttributeError: module 'wandb.sdk.launch.registry' has no attribute 'azure_container_registry'. Did you mean: 'elastic_container_registry'?
     "test_registry_from_uri"
@@ -392,6 +403,7 @@ buildPythonPackage (finalAttrs: {
     "test_log_media_prefixed_with_multiple_slashes"
     "test_log_media_saves_to_run_directory"
     "test_log_media_with_path_traversal"
+    "test_table_logging_mode_incremental_warns_after_100_increments"
 
     # HandleAbandonedError / SystemExit when run in sandbox
     "test_makedirs_raises_oserror__uses_temp_dir"
diff --git a/pkgs/development/python-modules/warp-nn/default.nix b/pkgs/development/python-modules/warp-nn/default.nix
index 39ced41c0bd8..cbf8973ad740 100644
--- a/pkgs/development/python-modules/warp-nn/default.nix
+++ b/pkgs/development/python-modules/warp-nn/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "warp-nn";
-  version = "0.3.0";
+  version = "0.3.1";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -26,7 +26,7 @@ buildPythonPackage (finalAttrs: {
     owner = "NVIDIA";
     repo = "warp-nn";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dziGJhuuLHy8gEB39tvpLTHjPOwz6YVhsCB6KbIb7vI=";
+    hash = "sha256-bs0YXYXPIwXKlFrsiZ5hdJ/E4uT4x3Ex/dJEWfurVcg=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/zhong-hong-hvac/default.nix b/pkgs/development/python-modules/zhong-hong-hvac/default.nix
index 76f19fbd9491..649c468e2312 100644
--- a/pkgs/development/python-modules/zhong-hong-hvac/default.nix
+++ b/pkgs/development/python-modules/zhong-hong-hvac/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "zhong-hong-hvac";
-  version = "1.0.15";
+  version = "1.0.18";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "crhan";
     repo = "ZhongHongHVAC";
     tag = "v${version}";
-    hash = "sha256-ZCbo7U6bevnzybVVplSgdFLiuz9+HXiE0r/8sYJ+euQ=";
+    hash = "sha256-X+zlakXGSmmCBYjdSR6sw1w9p7Mt65IyrgrFK7UkYE8=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/tcl-modules/by-name/ex/expect/fix-build-time-run-tcl.patch b/pkgs/development/tcl-modules/by-name/ex/expect/fix-build-time-run-tcl.patch
index 8edc4bea39d6..213251101530 100644
--- a/pkgs/development/tcl-modules/by-name/ex/expect/fix-build-time-run-tcl.patch
+++ b/pkgs/development/tcl-modules/by-name/ex/expect/fix-build-time-run-tcl.patch
@@ -1,11 +1,13 @@
---- a/Makefile.in	2022-09-07 21:46:37.090519258 +0200
-+++ b/Makefile.in	2022-09-07 21:46:21.462592279 +0200
-@@ -380,7 +380,7 @@
- 	cp $(DIST_ROOT)/$(PKG_DIR).tar.gz $(top_builddir)
- 
- $(SCRIPTS):
--	$(TCLSH) $(srcdir)/fixline1 $(SHORT_BINDIR) < $(srcdir)/example/$@ > $@
-+	@tcl@ $(srcdir)/fixline1 $(SHORT_BINDIR) < $(srcdir)/example/$@ > $@
- 
- ## We cannot use TCL_LIBS below (after TCL_LIB_SPEC) because its
- ## expansion references the contents of LIBS, which contains linker
+diff --git a/Makefile.in b/Makefile.in
+index 36feb62..ac77b25 100644
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -380,7 +380,7 @@ dist: dist-clean doc
+ 	cp $(DIST_ROOT)/$(PKG_DIR).tar.gz $(top_builddir)
+ 
+ $(SCRIPTS):
+-	$(TCLSH) $(srcdir)/fixline1 $(SHORT_BINDIR) < $(srcdir)/example/$@ > $@
++	@tcl@ $(srcdir)/fixline1 $(SHORT_BINDIR) < $(srcdir)/example/$@ > $@
+ 
+ ## We cannot use TCL_LIBS below (after TCL_LIB_SPEC) because its
+ ## expansion references the contents of LIBS, which contains linker
diff --git a/pkgs/development/tcl-modules/by-name/ex/expect/package.nix b/pkgs/development/tcl-modules/by-name/ex/expect/package.nix
index 8e4b2b0caa54..72686130f169 100644
--- a/pkgs/development/tcl-modules/by-name/ex/expect/package.nix
+++ b/pkgs/development/tcl-modules/by-name/ex/expect/package.nix
@@ -2,40 +2,29 @@
   lib,
   stdenv,
   buildPackages,
-  fetchurl,
+  fetchFromGitHub,
   tcl,
   makeWrapper,
   autoreconfHook,
-  fetchpatch,
   replaceVars,
+  dejagnu,
 }:
 
-tcl.mkTclDerivation rec {
+tcl.mkTclDerivation (finalAttrs: {
   pname = "expect";
-  version = "5.45.4";
+  version = "6.0a2";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/expect/Expect/${version}/expect${version}.tar.gz";
-    hash = "sha256-Safag7C92fRtBKBN7sGcd2e7mjI+QMR4H4nK92C5LDQ=";
+  src = fetchFromGitHub {
+    owner = "tcltk-depot";
+    repo = "expect";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-cVs8wU8WlJ0XtEv5Femhb4lwKtyVkPHjosXLbQ8QR4g=";
   };
 
   patches = [
     (replaceVars ./fix-build-time-run-tcl.patch {
       tcl = "${buildPackages.tcl}/bin/tclsh";
     })
-    # The following patches fix compilation with clang 15+
-    (fetchpatch {
-      url = "https://sourceforge.net/p/expect/patches/24/attachment/0001-Add-prototype-to-function-definitions.patch";
-      hash = "sha256-X2Vv6VVM3KjmBHo2ukVWe5YTVXRmqe//Kw2kr73OpZs=";
-    })
-    (fetchpatch {
-      url = "https://sourceforge.net/p/expect/patches/_discuss/thread/b813ca9895/6759/attachment/expect-configure-c99.patch";
-      hash = "sha256-PxQQ9roWgVXUoCMxkXEgu+it26ES/JuzHF6oML/nk54=";
-    })
-    ./0004-enable-cross-compilation.patch
-    # Include `sys/ioctl.h` and `util.h` on Darwin, which are required for `ioctl` and `openpty`.
-    # Include `termios.h` on FreeBSD for `openpty`
-    ./fix-darwin-bsd-clang16.patch
     # Remove some code which causes it to link against a file that does not exist at build time on native FreeBSD
     ./freebsd-unversioned.patch
   ];
@@ -49,24 +38,17 @@ tcl.mkTclDerivation rec {
     makeWrapper
   ];
 
+  __structuredAttrs = true;
+
   strictDeps = true;
 
-  env = {
-    NIX_CFLAGS_COMPILE = toString (
-      # Needed to avoid errors when building with GCC 15.
-      lib.optionals stdenv.cc.isGNU [ "-Wno-error=incompatible-pointer-types" ]
-      # Autoconf 2.73 defaults to C23, but Expect uses K&R style function declarations.
-      ++ [ "-std=gnu17" ]
-    );
-  };
-
-  hardeningDisable = [ "format" ];
-
   postInstall = ''
     tclWrapperArgs+=(--prefix PATH : ${lib.makeBinPath [ tcl ]})
-    ${lib.optionalString stdenv.hostPlatform.isDarwin "tclWrapperArgs+=(--prefix DYLD_LIBRARY_PATH : $out/lib/expect${version})"}
+    ${lib.optionalString stdenv.hostPlatform.isDarwin "tclWrapperArgs+=(--prefix DYLD_LIBRARY_PATH : $out/lib/expect${finalAttrs.version})"}
   '';
 
+  doCheck = true;
+  installCheckTarget = "test";
   tclRequiresCheck = [ "Expect" ];
 
   outputs = [
@@ -74,6 +56,10 @@ tcl.mkTclDerivation rec {
     "dev"
   ];
 
+  passthru.tests = {
+    inherit dejagnu;
+  };
+
   meta = {
     description = "Tool for automating interactive applications";
     homepage = "https://expect.sourceforge.net/";
@@ -81,6 +67,5 @@ tcl.mkTclDerivation rec {
     platforms = lib.platforms.unix;
     mainProgram = "expect";
     maintainers = with lib.maintainers; [ SuperSandro2000 ];
-    broken = tcl.isTcl9;
   };
-}
+})
diff --git a/pkgs/development/tcl-modules/by-name/ex/expect/0004-enable-cross-compilation.patch b/pkgs/development/tcl-modules/by-name/ex/expect_5/0004-enable-cross-compilation.patch
similarity index 100%
rename from pkgs/development/tcl-modules/by-name/ex/expect/0004-enable-cross-compilation.patch
rename to pkgs/development/tcl-modules/by-name/ex/expect_5/0004-enable-cross-compilation.patch
diff --git a/pkgs/development/tcl-modules/by-name/ex/expect_5/fix-build-time-run-tcl.patch b/pkgs/development/tcl-modules/by-name/ex/expect_5/fix-build-time-run-tcl.patch
new file mode 100644
index 000000000000..8edc4bea39d6
--- /dev/null
+++ b/pkgs/development/tcl-modules/by-name/ex/expect_5/fix-build-time-run-tcl.patch
@@ -0,0 +1,11 @@
+--- a/Makefile.in	2022-09-07 21:46:37.090519258 +0200
++++ b/Makefile.in	2022-09-07 21:46:21.462592279 +0200
+@@ -380,7 +380,7 @@
+ 	cp $(DIST_ROOT)/$(PKG_DIR).tar.gz $(top_builddir)
+ 
+ $(SCRIPTS):
+-	$(TCLSH) $(srcdir)/fixline1 $(SHORT_BINDIR) < $(srcdir)/example/$@ > $@
++	@tcl@ $(srcdir)/fixline1 $(SHORT_BINDIR) < $(srcdir)/example/$@ > $@
+ 
+ ## We cannot use TCL_LIBS below (after TCL_LIB_SPEC) because its
+ ## expansion references the contents of LIBS, which contains linker
diff --git a/pkgs/development/tcl-modules/by-name/ex/expect/fix-darwin-bsd-clang16.patch b/pkgs/development/tcl-modules/by-name/ex/expect_5/fix-darwin-bsd-clang16.patch
similarity index 100%
rename from pkgs/development/tcl-modules/by-name/ex/expect/fix-darwin-bsd-clang16.patch
rename to pkgs/development/tcl-modules/by-name/ex/expect_5/fix-darwin-bsd-clang16.patch
diff --git a/pkgs/development/tcl-modules/by-name/ex/expect_5/freebsd-unversioned.patch b/pkgs/development/tcl-modules/by-name/ex/expect_5/freebsd-unversioned.patch
new file mode 100644
index 000000000000..345fa4f6277f
--- /dev/null
+++ b/pkgs/development/tcl-modules/by-name/ex/expect_5/freebsd-unversioned.patch
@@ -0,0 +1,14 @@
+--- expect5.45.4/tclconfig/tcl.m4.orig	2024-05-29 11:24:56.150656190 -0700
++++ expect5.45.4/tclconfig/tcl.m4	2024-05-29 11:25:22.850790934 -0700
+@@ -1643,11 +1643,6 @@
+ 		LIBS=`echo $LIBS | sed s/-pthread//`
+ 		CFLAGS="$CFLAGS $PTHREAD_CFLAGS"
+ 		LDFLAGS="$LDFLAGS $PTHREAD_LIBS"])
+-	    # Version numbers are dot-stripped by system policy.
+-	    TCL_TRIM_DOTS=`echo ${VERSION} | tr -d .`
+-	    UNSHARED_LIB_SUFFIX='${TCL_TRIM_DOTS}.a'
+-	    SHARED_LIB_SUFFIX='${TCL_TRIM_DOTS}\$\{DBGX\}.so.1'
+-	    TCL_LIB_VERSIONS_OK=nodots
+ 	    ;;
+ 	Darwin-*)
+ 	    CFLAGS_OPTIMIZE="-Os"
diff --git a/pkgs/development/tcl-modules/by-name/ex/expect_5/package.nix b/pkgs/development/tcl-modules/by-name/ex/expect_5/package.nix
new file mode 100644
index 000000000000..8e4b2b0caa54
--- /dev/null
+++ b/pkgs/development/tcl-modules/by-name/ex/expect_5/package.nix
@@ -0,0 +1,86 @@
+{
+  lib,
+  stdenv,
+  buildPackages,
+  fetchurl,
+  tcl,
+  makeWrapper,
+  autoreconfHook,
+  fetchpatch,
+  replaceVars,
+}:
+
+tcl.mkTclDerivation rec {
+  pname = "expect";
+  version = "5.45.4";
+
+  src = fetchurl {
+    url = "mirror://sourceforge/expect/Expect/${version}/expect${version}.tar.gz";
+    hash = "sha256-Safag7C92fRtBKBN7sGcd2e7mjI+QMR4H4nK92C5LDQ=";
+  };
+
+  patches = [
+    (replaceVars ./fix-build-time-run-tcl.patch {
+      tcl = "${buildPackages.tcl}/bin/tclsh";
+    })
+    # The following patches fix compilation with clang 15+
+    (fetchpatch {
+      url = "https://sourceforge.net/p/expect/patches/24/attachment/0001-Add-prototype-to-function-definitions.patch";
+      hash = "sha256-X2Vv6VVM3KjmBHo2ukVWe5YTVXRmqe//Kw2kr73OpZs=";
+    })
+    (fetchpatch {
+      url = "https://sourceforge.net/p/expect/patches/_discuss/thread/b813ca9895/6759/attachment/expect-configure-c99.patch";
+      hash = "sha256-PxQQ9roWgVXUoCMxkXEgu+it26ES/JuzHF6oML/nk54=";
+    })
+    ./0004-enable-cross-compilation.patch
+    # Include `sys/ioctl.h` and `util.h` on Darwin, which are required for `ioctl` and `openpty`.
+    # Include `termios.h` on FreeBSD for `openpty`
+    ./fix-darwin-bsd-clang16.patch
+    # Remove some code which causes it to link against a file that does not exist at build time on native FreeBSD
+    ./freebsd-unversioned.patch
+  ];
+
+  postPatch = ''
+    sed -i "s,/bin/stty,$(type -p stty),g" configure.in
+  '';
+
+  nativeBuildInputs = [
+    autoreconfHook
+    makeWrapper
+  ];
+
+  strictDeps = true;
+
+  env = {
+    NIX_CFLAGS_COMPILE = toString (
+      # Needed to avoid errors when building with GCC 15.
+      lib.optionals stdenv.cc.isGNU [ "-Wno-error=incompatible-pointer-types" ]
+      # Autoconf 2.73 defaults to C23, but Expect uses K&R style function declarations.
+      ++ [ "-std=gnu17" ]
+    );
+  };
+
+  hardeningDisable = [ "format" ];
+
+  postInstall = ''
+    tclWrapperArgs+=(--prefix PATH : ${lib.makeBinPath [ tcl ]})
+    ${lib.optionalString stdenv.hostPlatform.isDarwin "tclWrapperArgs+=(--prefix DYLD_LIBRARY_PATH : $out/lib/expect${version})"}
+  '';
+
+  tclRequiresCheck = [ "Expect" ];
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  meta = {
+    description = "Tool for automating interactive applications";
+    homepage = "https://expect.sourceforge.net/";
+    license = lib.licenses.publicDomain;
+    platforms = lib.platforms.unix;
+    mainProgram = "expect";
+    maintainers = with lib.maintainers; [ SuperSandro2000 ];
+    broken = tcl.isTcl9;
+  };
+}
diff --git a/pkgs/os-specific/bsd/netbsd/pkgs/libc.nix b/pkgs/os-specific/bsd/netbsd/pkgs/libc.nix
index e23ba1a4fd36..a67bc775f92e 100644
--- a/pkgs/os-specific/bsd/netbsd/pkgs/libc.nix
+++ b/pkgs/os-specific/bsd/netbsd/pkgs/libc.nix
@@ -47,5 +47,11 @@ symlinkJoin {
     fixupPhase
   '';
 
+  # NetBSD's threads are POSIX threads — `libpthread` is joined in above.
+  # `libgcc` and `libstdc++` have to be configured for the same threading model
+  # as each other, so rather than have each guess, they take it from the libc
+  # they are built against.
+  passthru.threadModel = "posix";
+
   meta.platforms = lib.platforms.netbsd;
 }
diff --git a/pkgs/pkgs-lib/formats.nix b/pkgs/pkgs-lib/formats.nix
index a38b92f9444f..71b22076e0e5 100644
--- a/pkgs/pkgs-lib/formats.nix
+++ b/pkgs/pkgs-lib/formats.nix
@@ -967,36 +967,44 @@ optionalAttrs allowAliases aliases
               # otherwise removeAttrs will fail.
               value = removeAttrs value [ "_imports" ];
               pythonGen = pkgs.writeText "pythonGen" ''
+                import ast
                 import json
                 import os
 
-                def recursive_repr(value: any) -> str:
+                def gen_ast_node(value: any) -> ast.expr:
                     if type(value) is list:
-                        return '\n'.join([
-                            "[",
-                            *[recursive_repr(x) + "," for x in value],
-                            "]",
-                        ])
-                    elif type(value) is dict and value.get("_type") == "raw":
-                        return value.get("value")
+                        return ast.List(elts=[gen_ast_node(x) for x in value])
                     elif type(value) is dict:
-                        return '\n'.join([
-                            "{",
-                            *[f"'{k.replace('\''', '\\\''')}': {recursive_repr(v)}," for k, v in value.items()],
-                            "}",
-                        ])
+                        if value.get("_type") == "raw":
+                            return ast.parse(value["value"], mode="eval").body
+                        else:
+                            return ast.Dict(
+                                keys=[ast.Constant(k) for k in value],
+                                values=[gen_ast_node(v) for v in value.values()],
+                            )
                     else:
-                        return repr(value)
+                        return ast.Constant(value)
+
+
+                tree = ast.Module(body=[], type_ignores=[])
 
                 with open(os.environ["NIX_ATTRS_JSON_FILE"], "r") as f:
                     attrs = json.load(f)
+
                     if attrs["imports"] is not None:
                         for i in attrs["imports"]:
-                            print(f"import {i}")
-                        print()
+                            tree.body.append(ast.parse(f"import {i}").body[0])
+
+                    for key, val in attrs["value"].items():
+                        tree.body.append(ast.Assign(
+                            targets=[ast.Name(id=key, ctx=ast.Store())],
+                            value=gen_ast_node(val),
+                        ))
+
+                ast.fix_missing_locations(tree)
+
+                print(ast.unparse(tree))
 
-                    for key, value in attrs["value"].items():
-                        print(f"{key} = {recursive_repr(value)}")
               '';
               preferLocalBuild = true;
               __structuredAttrs = true;
diff --git a/pkgs/pkgs-lib/tests/formats.nix b/pkgs/pkgs-lib/tests/formats.nix
index 56ce50ed6953..80f34ab047a4 100644
--- a/pkgs/pkgs-lib/tests/formats.nix
+++ b/pkgs/pkgs-lib/tests/formats.nix
@@ -1148,21 +1148,12 @@ runBuildTests {
         import re
         import a.b.c
 
-        attrs = {
-            "conditional": 1 if True else 2,
-            "foo": None,
-        }
+        attrs = {"conditional": 1 if True else 2, "foo": None}
         bool = True
         float = 3.141
-        func = re.findall(r"\bf[a-z]*", "which foot or hand fell fastest")
+        func = re.findall("\\bf[a-z]*", "which foot or hand fell fastest")
         int = 10
-        list = [
-            None,
-            1,
-            "str",
-            True,
-            1 if True else 2,
-        ]
+        list = [None, 1, "str", True, 1 if True else 2]
         null = None
         str = "foo"
         str_special = "foo\ntesthello''''"
diff --git a/pkgs/servers/http/apache-httpd/2.4.nix b/pkgs/servers/http/apache-httpd/2.4.nix
index e762b8501afc..43f3cd60b7e7 100644
--- a/pkgs/servers/http/apache-httpd/2.4.nix
+++ b/pkgs/servers/http/apache-httpd/2.4.nix
@@ -3,6 +3,8 @@
   stdenv,
   fetchurl,
   fetchpatch2,
+  autoreconfHook,
+  pkg-config,
   perl,
   zlib,
   apr,
@@ -30,6 +32,8 @@
   brotli,
   luaSupport ? false,
   lua5,
+  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
+  systemdLibs,
 }:
 
 stdenv.mkDerivation rec {
@@ -63,6 +67,8 @@ stdenv.mkDerivation rec {
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
   nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
     perl
     which
   ];
@@ -76,13 +82,17 @@ stdenv.mkDerivation rec {
   ++ lib.optional sslSupport openssl
   ++ lib.optional ldapSupport openldap
   # there is no --with-ldap flag
+  ++ lib.optional luaSupport lua5
   ++ lib.optional libxml2Support libxml2
   ++ lib.optional http2Support nghttp2
-  ++ lib.optional stdenv.hostPlatform.isDarwin libiconv;
+  ++ lib.optional stdenv.hostPlatform.isDarwin libiconv
+  ++ lib.optional systemdSupport systemdLibs;
 
   postPatch = ''
     sed -i config.layout -e "s|installbuilddir:.*|installbuilddir: $dev/share/build|"
-    sed -i configure -e 's|perlbin=.*|perlbin="/usr/bin/env perl"|'
+    sed -i configure.in \
+      -e 's|AC_PATH_PROG|AC_PATH_TOOL|' \
+      -e 's|perlbin=.*|perlbin="/usr/bin/env perl"|'
     ${lib.optionalString withLynx "sed -i support/apachectl.in -e 's|@LYNX_PATH@|${lynx}/bin/lynx|'"}
   '';
 
@@ -104,19 +114,14 @@ stdenv.mkDerivation rec {
     "--enable-imagemap"
     "--enable-cgi"
     "--includedir=${placeholder "dev"}/include"
+    "--docdir=$(doc)/share/doc"
     (lib.enableFeature proxySupport "proxy")
     (lib.enableFeature sslSupport "ssl")
     (lib.withFeatureAs libxml2Support "libxml2" "${libxml2.dev}/include/libxml2")
-    "--docdir=$(doc)/share/doc"
-
     (lib.enableFeature brotliSupport "brotli")
-    (lib.withFeatureAs brotliSupport "brotli" brotli)
-
     (lib.enableFeature http2Support "http2")
-    (lib.withFeature http2Support "nghttp2")
-
+    (lib.enableFeature systemdSupport "systemd")
     (lib.enableFeature luaSupport "lua")
-    (lib.withFeatureAs luaSupport "lua" lua5)
   ]
   ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
     # skip bad config check when cross compiling
diff --git a/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix b/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix
index f10029c330b7..099a1a8e1ea4 100644
--- a/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix
@@ -2,8 +2,8 @@
 
 grafanaPlugin {
   pname = "grafana-lokiexplore-app";
-  version = "2.4.0";
-  zipHash = "sha256-x+LxpkDN+iKW9QBDEg6oDURWuLUYNAC3UDWDmfoYcYo=";
+  version = "2.5.0";
+  zipHash = "sha256-n+jIw5mvhXtpJlDPK7stsNhSV5y/sW382+DI7Shx4PI=";
   meta = {
     description = "Browse Loki logs without the need for writing complex queries";
     license = lib.licenses.agpl3Only;
diff --git a/pkgs/servers/monitoring/grafana/plugins/grafana-opensearch-datasource/default.nix b/pkgs/servers/monitoring/grafana/plugins/grafana-opensearch-datasource/default.nix
index 5a414111d888..076c88971f97 100644
--- a/pkgs/servers/monitoring/grafana/plugins/grafana-opensearch-datasource/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/grafana-opensearch-datasource/default.nix
@@ -2,11 +2,11 @@
 
 grafanaPlugin {
   pname = "grafana-opensearch-datasource";
-  version = "2.34.0";
+  version = "2.34.3";
   zipHash = {
-    x86_64-linux = "sha256-/NG+38zeIcoiQTm/QJFwwZSpo0zdovh1a4QntndcphE=";
-    aarch64-linux = "sha256-jGRMlbOsOd7fglTMmdOSGxNv4GiV9aiusXz6CnCefaY=";
-    aarch64-darwin = "sha256-WzhbYvgkuIzB8coJMinLiEyW3RIFxftM2ZGPG9rGGxU=";
+    x86_64-linux = "sha256-P5NlM7TZWLVbKbYFy9TzqwRiKQZkXsOxmUJbWx+6TAI=";
+    aarch64-linux = "sha256-MLpS4NHu0F7a1eQOTMYuZi3N/ESn+jXKMhspl2DoqhE=";
+    aarch64-darwin = "sha256-PIqemTwdml2c9y6RKfOrYB6IIqwgmy0zB33CKizCwqY=";
   };
   meta = {
     description = "Empowers you to seamlessly integrate JSON data into Grafana";
diff --git a/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix b/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
index 7d40097abf6a..4df95e952937 100644
--- a/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
+++ b/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
@@ -25,16 +25,18 @@ buildPgrxExtension (finalAttrs: {
 
   cargoHash = "sha256-IXOCzKJArNOcb/2TcJbLz1XdCquUpyF/cLHYU5vmlko=";
 
-  patches = lib.optional (lib.versionOlder rustc.llvm.version "22.0.0" && stdenv.isx86_64) [
-    # Due to a bug in LLVM 21, build fails on x86_64 with:
-    # `rustc-LLVM ERROR: Cannot select: intrinsic %llvm.x86.avx512.vpdpbusd.512`.
-    # This has been fixed in Rust's build of LLVM and LLVM 22 with https://github.com/rust-lang/llvm-project/commit/94e2c19f86a699d7a19ff0f4130b696699189c8d,
-    # but this is not reflected in nixpkgs' packaging of rustc.
-    # For this reason, we temporarily disable avx512vnni support until this is fixed in nixpkgs.
-    # This might cause a performance penalty, but should not affect correctness.
-    # See https://github.com/NixOS/nixpkgs/pull/537113#issuecomment-4846239887
-    ./0001-disable-avx512vnni.patch
-  ];
+  patches =
+    lib.optional (lib.versionOlder rustc.llvm.version "22.0.0" && stdenv.hostPlatform.isx86_64)
+      [
+        # Due to a bug in LLVM 21, build fails on x86_64 with:
+        # `rustc-LLVM ERROR: Cannot select: intrinsic %llvm.x86.avx512.vpdpbusd.512`.
+        # This has been fixed in Rust's build of LLVM and LLVM 22 with https://github.com/rust-lang/llvm-project/commit/94e2c19f86a699d7a19ff0f4130b696699189c8d,
+        # but this is not reflected in nixpkgs' packaging of rustc.
+        # For this reason, we temporarily disable avx512vnni support until this is fixed in nixpkgs.
+        # This might cause a performance penalty, but should not affect correctness.
+        # See https://github.com/NixOS/nixpkgs/pull/537113#issuecomment-4846239887
+        ./0001-disable-avx512vnni.patch
+      ];
 
   # Include upgrade scripts in the final package
   # https://github.com/supervc-stack/VectorChord/blob/0.5.0/crates/make/src/main.rs#L366
diff --git a/pkgs/stdenv/cross/default.nix b/pkgs/stdenv/cross/default.nix
index f2adc91e2bb1..98d93014faf2 100644
--- a/pkgs/stdenv/cross/default.nix
+++ b/pkgs/stdenv/cross/default.nix
@@ -127,6 +127,8 @@ lib.init bootStages
                 buildPackages.zig.cc
               else if crossSystem.useArocc or false then
                 buildPackages.arocc
+              else if crossSystem.useGccNG or false then
+                buildPackages.gccNGPackages.gcc
               else
                 buildPackages.gcc;
 
diff --git a/pkgs/stdenv/generic/default.nix b/pkgs/stdenv/generic/default.nix
index 95d9228d7da2..6d78cc0f0c14 100644
--- a/pkgs/stdenv/generic/default.nix
+++ b/pkgs/stdenv/generic/default.nix
@@ -201,25 +201,35 @@ let
         extraSandboxProfile
         ;
 
-      # Utility flags to test the type of platform.
-      inherit (hostPlatform)
-        isDarwin
-        isLinux
-        isSunOS
-        isCygwin
-        isBSD
-        isFreeBSD
-        isOpenBSD
-        isi686
-        isx86_32
-        isx86_64
-        is32bit
-        is64bit
-        isAarch32
-        isAarch64
-        isMips
-        isBigEndian
-        ;
+    }
+    // lib.optionalAttrs config.allowAliases (
+      lib.mapAttrs
+        (
+          name: value: lib.warn "stdenv.${name} is deprecated, use stdenv.hostPlatform.${name} instead" value
+        )
+        {
+          # Added 2026-05-09
+          inherit (hostPlatform)
+            isDarwin
+            isLinux
+            isSunOS
+            isCygwin
+            isBSD
+            isFreeBSD
+            isOpenBSD
+            isi686
+            isx86_32
+            isx86_64
+            is32bit
+            is64bit
+            isAarch32
+            isAarch64
+            isMips
+            isBigEndian
+            ;
+        }
+    )
+    // {
 
       # Override `system` so that packages can get the system of the host
       # platform through `stdenv.system`. `system` is originally set to the
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix
index 8502124a24d0..9b503d054571 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix
@@ -16,13 +16,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "fcitx5-qt${majorVersion}";
-  version = "5.1.13";
+  version = "5.1.14";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = "fcitx5-qt";
     rev = version;
-    hash = "sha256-CrrQQPtWQwE6eZOJB+uLVUjPJMKW/sz/tij41dyEe0U=";
+    hash = "sha256-fyqejCb6c6VuPb44UPQDLrdZ93mHTxlX29jCN6KcZ5I=";
   };
 
   postPatch = ''
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 79054c6798f2..e4d0b99b1728 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1871,6 +1871,7 @@ mapAliases {
   opensyclWithRocm = throw "'opensyclWithRocm' has been renamed to/replaced by 'adaptivecppWithRocm'"; # Converted to throw 2025-10-27
   opentofu-ls = warnAlias "'opentofu-ls' has been renamed to 'tofu-ls'" tofu-ls; # Added 2025-06-10
   opentracing-cpp = throw "'opentracingc-cpp' has been removed as it was archived upstream in 2024"; # Added 2025-10-19
+  openwith = throw "'openwith' has been removed, doesn't seem to work correctly on macOS 26 or newer"; # Added 2026-08-12
   openzwave = throw "openzwave was removed because upstream is no longer maintained. Consider using zwave-js-server"; # Added 2026-05-14
   opera = throw "'opera' has been removed due to lack of maintenance in nixpkgs"; # Added 2025-05-19
   opusTools = warnAlias "'opusTools' has been renamed to 'opus-tools'" opus-tools; # Added 2026-02-12
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2d6479031204..479ef887d380 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -88,6 +88,8 @@ with pkgs;
       (
         if stdenvNoCC.hostPlatform.isDarwin || stdenvNoCC.hostPlatform.useLLVM or false then
           overrideCC stdenvNoCC buildPackages.llvmPackages.clangNoCompilerRt
+        else if stdenvNoCC.hostPlatform.useGccNG or false then
+          overrideCC stdenvNoCC buildPackages.gccNGPackages.gccNoLibgcc
         else
           gccCrossLibcStdenv
       )
@@ -99,6 +101,11 @@ with pkgs;
       (
         if stdenvNoCC.hostPlatform.isDarwin || stdenvNoCC.hostPlatform.useLLVM or false then
           overrideCC stdenvNoCC buildPackages.llvmPackages.clangNoLibc
+        else if stdenvNoCC.hostPlatform.useGccNG or false then
+          # The split package set can express the two rungs separately, the way
+          # the LLVM set does: no libgcc above, libgcc but no libc here. The
+          # monolithic `gccCrossLibcStdenv` has to serve both.
+          overrideCC stdenvNoCC buildPackages.gccNGPackages.gccWithLibgcc
         else
           gccCrossLibcStdenv
       )
@@ -1995,7 +2002,7 @@ with pkgs;
 
   exiftool = perlPackages.ImageExifTool;
 
-  expect = tclPackages.expect;
+  expect = tcl8Packages.expect_5;
 
   Fabric = with python3Packages; toPythonApplication fabric;
 
@@ -3244,9 +3251,11 @@ with pkgs;
       # NOTE: keep this with the "NG" label until we're ready to drop the monolithic GCC
       gccNGPackagesSet = recurseIntoAttrs (callPackages ../development/compilers/gcc/ng { });
       gccNGPackages_15 = gccNGPackagesSet."15";
+      gccNGPackages = gccNGPackagesSet.${toString default-gcc-version};
       mkGCCNGPackages = gccNGPackagesSet.mkPackage;
     })
     gccNGPackages_15
+    gccNGPackages
     mkGCCNGPackages
     ;
 
@@ -3256,7 +3265,7 @@ with pkgs;
       ccWrapper.override (prev: {
         cc = prev.cc.override {
           reproducibleBuild = false;
-          profiledCompiler = with stdenv; (!isDarwin && hostPlatform.isx86);
+          profiledCompiler = with stdenv.hostPlatform; (!isDarwin && isx86);
         };
       })
     else
@@ -5622,11 +5631,22 @@ with pkgs;
     if stdenv.hostPlatform != stdenv.buildPlatform then
       {
         stdenv = gccCrossLibcStdenv; # doesn't compile without gcc
-        libgcc = callPackage ../development/libraries/gcc/libgcc {
-          gcc = gccCrossLibcStdenv.cc;
-          glibc = glibc.override { libgcc = null; };
-          stdenvNoLibs = gccCrossLibcStdenv;
-        };
+        # glibc `dlopen`s `libgcc_s.so` without consulting the usual search
+        # path, so it has to name one that already exists. The monolithic
+        # build gets there by building glibc twice: the inner `libgcc = null`
+        # one names no libgcc at all, and is used for nothing but building the
+        # libgcc the real one names. The split package set already has that
+        # rung as a package of its own — `libgcc-no-libc` is what exists
+        # before any libc does — so there is nothing left to open-code here.
+        libgcc =
+          if stdenv.hostPlatform.useGccNG or false then
+            gccNGPackages.libgcc-no-libc
+          else
+            callPackage ../development/libraries/gcc/libgcc {
+              gcc = gccCrossLibcStdenv.cc;
+              glibc = glibc.override { libgcc = null; };
+              stdenvNoLibs = gccCrossLibcStdenv;
+            };
       }
     else
       {
diff --git a/pkgs/top-level/darwin-aliases.nix b/pkgs/top-level/darwin-aliases.nix
index 72a7dbc9434a..ae22c028f23b 100644
--- a/pkgs/top-level/darwin-aliases.nix
+++ b/pkgs/top-level/darwin-aliases.nix
@@ -141,7 +141,7 @@ stubs
   ### O ###
 
   opencflite = pkgs.opencflite; # added 2024-05-02
-  openwith = pkgs.openwith; # added 2025-11-28
+  openwith = throw "'openwith' has been removed, doesn't seem to work correctly on macOS 26 or newer"; # Added 2026-08-12
 
   ### P ###
   postLinkSignHook = throw "'darwin.postLinkSignHook' has been removed because it is obsolete"; # added 2025-02-23