diff --git a/ci/github-script/reminders/docs-styleguide.md b/ci/github-script/reminders/docs-styleguide.md
index 7947d5fac888..db30873ca5bf 100644
--- a/ci/github-script/reminders/docs-styleguide.md
+++ b/ci/github-script/reminders/docs-styleguide.md
@@ -1,12 +1,12 @@
-Thanks for contributing to the documentation
+Thanks for contributing to the documentation.
 
-Make sure you follow the [documentation style guide](https://github.com/NixOS/nixpkgs/blob/master/doc/styleguide.md), most notably:
+Follow the [documentation style guide](https://github.com/NixOS/nixpkgs/blob/master/doc/styleguide.md), especially:
 
-- Show, don't tell: lead with a minimal working example; explanation follows the code.
-- No meta-commentary: don't write "This section explains how to…", just do it.
-- Imperative mood and active voice: "Run the command", not "The user should run the following command".
-- Present tense: "This creates a folder", not "This will create a folder".
-- Be confident: no hedging with "should", "might", "typically", "usually".
-- Cut filler words: "simply", "just", "easily", "basically"; "to", not "in order to".
+- Show, don’t tell. Start with a minimal working example. Explain after the code.
+- Avoid meta-commentary. Don’t write "This section explains how to…".
+- Use present tense, imperative mood, and active voice. For example: "Run the command," not "The user should run the following command."
+- Avoid vague references like "this" when the referent is unclear. Write "This command creates a folder," not "This will create a folder."
+- Be direct. Avoid "should", "might", "typically", and "usually".
+- Cut filler words like "simply", "just", "easily", and "basically". Use "to" instead of "in order to".
 
-For larger changes, like adding or removing whole sections, ask the NixOS documentation team for a review.
+For larger changes, such as adding or removing whole sections, ask the NixOS documentation team for review.
diff --git a/doc/build-helpers/trivial-build-helpers.chapter.md b/doc/build-helpers/trivial-build-helpers.chapter.md
index 590cd691c019..6bf75c8be1b2 100644
--- a/doc/build-helpers/trivial-build-helpers.chapter.md
+++ b/doc/build-helpers/trivial-build-helpers.chapter.md
@@ -225,15 +225,13 @@ writeShellScript "evaluate-my-file.sh" ''
 
 ### `makeDesktopItem` {#trivial-builder-makeDesktopItem}
 
-Write an [XDG desktop file](https://specifications.freedesktop.org/desktop-entry-spec/1.4/) to the Nix store.
+Write an [XDG desktop file](https://specifications.freedesktop.org/desktop-entry-spec/latest) to the Nix store.
 
 This function is usually used to add desktop items to a package through the `copyDesktopItems` hook.
 
-`makeDesktopItem` adheres to version 1.4 of the specification.
-
 #### Inputs {#trivial-builder-makeDesktopItem-inputs}
 
-`makeDesktopItem` takes an attribute set that accepts most values from the [XDG specification](https://specifications.freedesktop.org/desktop-entry-spec/1.4/ar01s06.html).
+`makeDesktopItem` takes an attribute set that accepts most values from the [XDG specification](https://specifications.freedesktop.org/desktop-entry-spec/latest/ar01s06.html).
 
 All recognised keys from the specification are supported with the exception of the "Hidden" field. The keys are converted into camelCase format, but correspond 1:1 to their equivalent in the specification: `genericName`, `noDisplay`, `comment`, `icon`, `onlyShowIn`, `notShowIn`, `dbusActivatable`, `tryExec`, `exec`, `path`, `terminal`, `mimeTypes`, `categories`, `implements`, `keywords`, `startupNotify`, `startupWMClass`, `url`, `prefersNonDefaultGPU`.
 
diff --git a/doc/hooks/perl.section.md b/doc/hooks/perl.section.md
index 06942bd3c0e1..362a237d9b19 100644
--- a/doc/hooks/perl.section.md
+++ b/doc/hooks/perl.section.md
@@ -1,3 +1,4 @@
 # Perl {#setup-hook-perl}
 
-Adds the `lib/site_perl` subdirectory of each build input to the `PERL5LIB` environment variable. For instance, if `buildInputs` contains Perl, then the `lib/site_perl` subdirectory of each input is added to the `PERL5LIB` environment variable.
+Adds the `lib/perl5/site_perl` subdirectory of each build input to the `PERL5LIB` environment variable.
+The hook applies when `perl` is in `buildInputs`.
diff --git a/doc/hooks/xfce4-dev-tools.section.md b/doc/hooks/xfce4-dev-tools.section.md
index a18295f4db67..465317480351 100644
--- a/doc/hooks/xfce4-dev-tools.section.md
+++ b/doc/hooks/xfce4-dev-tools.section.md
@@ -1,5 +1,14 @@
 # `xfce4-dev-tools` {#xfce4-dev-tools}
 
-This setup hook attempts to run `xdt-autogen` in `xdtAutogenPhase`, which is part of `preConfigurePhases`.
+This setup hook adds an `xdtAutogenPhase` that runs `xdt-autogen` before configure.
 
-[]{#dontUseXdtAutogenPhase} This behavior can be disabled by setting `dontUseXdtAutogenPhase` to `true`.
+Use this hook for Xfce packages that need `xdt-autogen` before configure.
+Add `xfce4-dev-tools` to `nativeBuildInputs` to enable the phase.
+
+```nix
+{
+  nativeBuildInputs = [ xfce4-dev-tools ];
+}
+```
+
+[]{#dontUseXdtAutogenPhase} Disable this behavior by setting `dontUseXdtAutogenPhase` to `true`.
diff --git a/doc/packages/weechat.section.md b/doc/packages/weechat.section.md
index cdc9ccba5a96..60e99302879a 100644
--- a/doc/packages/weechat.section.md
+++ b/doc/packages/weechat.section.md
@@ -86,8 +86,7 @@ weechat.override {
     { availablePlugins, ... }:
     {
       scripts = with pkgs.weechatScripts; [
-        weechat-xmpp
-        weechat-matrix-bridge
+        weechat-matrix
         wee-slack
       ];
       init = ''
diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index b0e6bbab75b6..599faa3f2147 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -247,6 +247,11 @@
   [pnpm `fetcherVersion` section](#javascript-pnpm-fetcherVersion) of the manual
   for details.
 
+- `services.opencloud.package` now requires explicit package selection. Possibilities are `opencloud` (the previous default) and `opencloud-production` to reflect [upstream release cycle](https://docs.opencloud.eu/docs/admin/resources/lifecycle/).
+ - Users updating from `nixos-26.05` will prefer the new `opencloud-production` package.
+ - Users updating from `nixos-unstable` will prefer to keep using the existing `opencloud` package.
+ - Please note upstream does not support downgrading existing installations. Switching from `opencloud` to `opencloud-production` is considered a downgrade.
+
 - `makeSetupHook` now uses structured attributes and only makes substitutions based on the values of the `substitutions` argument - other derivation attributes are no longer considered.
 
 - `rebuilderd` has been updated to 0.27.0 introducing breaking changes. See upstream changelog for details: [0.26.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.26.0), [0.27.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.27.0)
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index dc60d1380936..7b7196a33188 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -401,6 +401,11 @@
     github = "a-camarillo";
     githubId = 58638902;
   };
+  a-hassanin = {
+    github = "a-hassanin";
+    name = "Ahmed Hassanin";
+    githubId = 112945643;
+  };
   a-jay98 = {
     email = "ali@jamadi.me";
     github = "A-jay98";
@@ -9425,6 +9430,11 @@
     githubId = 84565547;
     name = "fernvenue";
   };
+  ferris-qq = {
+    name = "heki";
+    github = "ferris-qq";
+    githubId = 186204649;
+  };
   feyorsh = {
     email = "george@feyor.sh";
     github = "Feyorsh";
@@ -10917,10 +10927,10 @@
   };
   grimmauld = {
     name = "Sören Bender";
-    email = "soeren@benjos.de";
-    github = "LordGrimmauld";
+    email = "grimmauld@grimmauld.de";
+    github = "GrimmTheShrimp";
     githubId = 49513131;
-    matrix = "@grimmauld:grimmauld.de";
+    matrix = "@grimmauld:m.grimmauld.de";
   };
   grindhold = {
     name = "grindhold";
@@ -22091,6 +22101,11 @@
     githubId = 1538622;
     name = "Michael Reilly";
   };
+  onaips = {
+    github = "oNaiPs";
+    githubId = 374130;
+    name = "José Luis Pereira";
+  };
   onatustun = {
     email = "contact@onatustun.com";
     name = "Onat Ustun";
@@ -22385,6 +22400,13 @@
     githubId = 5948762;
     name = "Berk Özkütük";
   };
+  ozozka = {
+    email = "ozkaya.ogzhn@gmail.com";
+    matrix = "@oguzhanozkaya:matrix.org";
+    github = "ozozka";
+    githubId = 53692091;
+    name = "Oğuzhan Özkaya";
+  };
   ozturkkl = {
     email = "97kemalozturk@gmail.com";
     github = "ozturkkl";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 47b3b8f6ae60..943dedca55f1 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -760,6 +760,7 @@ with lib.maintainers;
     ];
     scope = "Maintain Swift compiler suite for NixOS.";
     shortName = "Swift";
+    enableFeatureFreezePing = true;
   };
 
   systemd = {
diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index 7427d7232f42..e855f9077971 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -270,6 +270,8 @@
   `services.bazarr.listenPort` is now `services.bazarr.settings.general.port`; existing configurations continue working via `mkRenamedOptionModule`.
   [`services.bazarr.settings.analytics.enabled`](#opt-services.bazarr.settings.analytics.enabled) defaults to `false` on NixOS to opt users out of upstream's enabled-by-default telemetry.
 
+- The [bazarr](#opt-services.bazarr.enable) systemd service has been security hardened. If you are storing/accessing data in `/home`, you will need to adjust the `ProtectHome` option.
+
 - `security.polkit.enablePkexecWrapper` has been introduced, making the `pkexec` setuid wrapper opt-in.
 
 - `services.pghero` has been removed because the `pghero` package was unmaintained and thus dropped from Nixpkgs.
diff --git a/nixos/lib/test-driver/src/test_driver/driver.py b/nixos/lib/test-driver/src/test_driver/driver.py
index a3891313b817..7903e7e5c266 100644
--- a/nixos/lib/test-driver/src/test_driver/driver.py
+++ b/nixos/lib/test-driver/src/test_driver/driver.py
@@ -9,7 +9,7 @@ import tempfile
 import threading
 import traceback
 import warnings
-from collections.abc import Callable, Generator, Iterator
+from collections.abc import Callable, Generator
 from contextlib import AbstractContextManager, contextmanager
 from dataclasses import dataclass
 from pathlib import Path
@@ -314,7 +314,7 @@ class Driver:
 
     def test_symbols(self) -> dict[str, Any]:
         @contextmanager
-        def subtest(name: str) -> Iterator[None]:
+        def subtest(name: str) -> Generator[None]:
             return self.subtest(name)
 
         general_symbols = dict(
diff --git a/nixos/lib/test-driver/src/test_driver/logger.py b/nixos/lib/test-driver/src/test_driver/logger.py
index 7b786b351417..517a30a67876 100644
--- a/nixos/lib/test-driver/src/test_driver/logger.py
+++ b/nixos/lib/test-driver/src/test_driver/logger.py
@@ -4,7 +4,7 @@ import sys
 import time
 import unicodedata
 from abc import ABC, abstractmethod
-from collections.abc import Iterator
+from collections.abc import Generator
 from contextlib import ExitStack, contextmanager
 from enum import IntEnum
 from pathlib import Path
@@ -31,12 +31,12 @@ class AbstractLogger(ABC):
 
     @abstractmethod
     @contextmanager
-    def subtest(self, name: str, attributes: dict[str, str] = {}) -> Iterator[None]:
+    def subtest(self, name: str, attributes: dict[str, str] = {}) -> Generator[None]:
         pass
 
     @abstractmethod
     @contextmanager
-    def nested(self, message: str, attributes: dict[str, str] = {}) -> Iterator[None]:
+    def nested(self, message: str, attributes: dict[str, str] = {}) -> Generator[None]:
         pass
 
     @abstractmethod
@@ -94,7 +94,7 @@ class JunitXMLLogger(AbstractLogger):
             self.tests[self.currentSubtest].stdout += message + os.linesep
 
     @contextmanager
-    def subtest(self, name: str, attributes: dict[str, str] = {}) -> Iterator[None]:
+    def subtest(self, name: str, attributes: dict[str, str] = {}) -> Generator[None]:
         old_test = self.currentSubtest
         self.tests.setdefault(name, self.TestCaseState())
         self.currentSubtest = name
@@ -104,7 +104,7 @@ class JunitXMLLogger(AbstractLogger):
         self.currentSubtest = old_test
 
     @contextmanager
-    def nested(self, message: str, attributes: dict[str, str] = {}) -> Iterator[None]:
+    def nested(self, message: str, attributes: dict[str, str] = {}) -> Generator[None]:
         self.log(message)
         yield
 
@@ -185,14 +185,14 @@ class CompositeLogger(AbstractLogger):
             logger.log(message, attributes)
 
     @contextmanager
-    def subtest(self, name: str, attributes: dict[str, str] = {}) -> Iterator[None]:
+    def subtest(self, name: str, attributes: dict[str, str] = {}) -> Generator[None]:
         with ExitStack() as stack:
             for logger in self.logger_list:
                 stack.enter_context(logger.subtest(name, attributes))
             yield
 
     @contextmanager
-    def nested(self, message: str, attributes: dict[str, str] = {}) -> Iterator[None]:
+    def nested(self, message: str, attributes: dict[str, str] = {}) -> Generator[None]:
         with ExitStack() as stack:
             for logger in self.logger_list:
                 stack.enter_context(logger.nested(message, attributes))
@@ -250,12 +250,12 @@ class TerminalLogger(AbstractLogger):
         self._eprint(self.maybe_prefix(message, attributes))
 
     @contextmanager
-    def subtest(self, name: str, attributes: dict[str, str] = {}) -> Iterator[None]:
+    def subtest(self, name: str, attributes: dict[str, str] = {}) -> Generator[None]:
         with self.nested("subtest: " + name, attributes):
             yield
 
     @contextmanager
-    def nested(self, message: str, attributes: dict[str, str] = {}) -> Iterator[None]:
+    def nested(self, message: str, attributes: dict[str, str] = {}) -> Generator[None]:
         self._eprint(
             self.maybe_prefix(
                 Style.BRIGHT + Fore.GREEN + message + Style.RESET_ALL,  # ty: ignore[unsupported-operator]
@@ -381,12 +381,12 @@ class XMLLogger(AbstractLogger):
             pass
 
     @contextmanager
-    def subtest(self, name: str, attributes: dict[str, str] = {}) -> Iterator[None]:
+    def subtest(self, name: str, attributes: dict[str, str] = {}) -> Generator[None]:
         with self.nested("subtest: " + name, attributes):
             yield
 
     @contextmanager
-    def nested(self, message: str, attributes: dict[str, str] = {}) -> Iterator[None]:
+    def nested(self, message: str, attributes: dict[str, str] = {}) -> Generator[None]:
         self.xml.startElement("nest", attrs=AttributesImpl({}))
         self.xml.startElement("head", attrs=AttributesImpl(attributes))
         self.xml.characters(message)
diff --git a/nixos/lib/test-driver/src/test_driver/machine/qmp.py b/nixos/lib/test-driver/src/test_driver/machine/qmp.py
index f8d2b4e887d8..6a5612e8a0c4 100644
--- a/nixos/lib/test-driver/src/test_driver/machine/qmp.py
+++ b/nixos/lib/test-driver/src/test_driver/machine/qmp.py
@@ -14,9 +14,10 @@ logger = logging.getLogger(__name__)
 class QMPAPIError(RuntimeError):
     def __init__(self, message: dict[str, Any]):
         assert "error" in message, "Not an error message!"
+        error = message["error"]
         try:
-            self.class_name = message["class"]
-            self.description = message["desc"]
+            self.class_name = error["class"]
+            self.description = error["desc"]
             # NOTE: Some errors can occur before the Server is able to read the
             # id member; in these cases the id member will not be part of the
             # error response, even if provided by the client.
diff --git a/nixos/modules/config/nix.nix b/nixos/modules/config/nix.nix
index db9e70bb9c3f..c9407050b724 100644
--- a/nixos/modules/config/nix.nix
+++ b/nixos/modules/config/nix.nix
@@ -347,7 +347,6 @@ in
             trusted-users = mkOption {
               type = types.listOf types.str;
               example = [
-                "root"
                 "alice"
                 "@wheel"
               ];
@@ -357,8 +356,9 @@ in
                 additional binary caches, or to import unsigned NARs. You
                 can also specify groups by prefixing them with
                 `@`; for instance,
-                `@wheel` means all users in the wheel
-                group.
+                `@wheel` means all users in the wheel group.
+                `root` is included as a regular definition, so you do not have to repeat it.
+                Furthermore, `root` normally bypasses the daemon.
               '';
             };
 
diff --git a/nixos/modules/hardware/video/nvidia.nix b/nixos/modules/hardware/video/nvidia.nix
index 68ed2cb3a3fb..91424fbb643d 100644
--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@@ -777,7 +777,7 @@ in
               })
             ];
 
-          services.acpid.enable = true;
+          services.acpid.enable = lib.mkDefault true;
 
           services.dbus.packages = lib.optional cfg.dynamicBoost.enable nvidia_x11.bin;
 
diff --git a/nixos/modules/security/wrappers/default.nix b/nixos/modules/security/wrappers/default.nix
index 907b6ac01b21..941a99323f9b 100644
--- a/nixos/modules/security/wrappers/default.nix
+++ b/nixos/modules/security/wrappers/default.nix
@@ -361,16 +361,18 @@ in
 
     ###### wrappers consistency checks
     system.checks = lib.singleton (
-      pkgs.runCommandLocal "ensure-all-wrappers-paths-exist"
+      pkgs.runCommandLocal "ensure-wrapper-integrity"
         {
-          nativeBuildInputs = [ pkgs.libcap-text-verifier ];
+          nativeBuildInputs = [
+            pkgs.libcap-text-verifier
+          ];
           preferLocalBuild = true;
         }
         ''
           # make sure we produce output
           mkdir -p $out
 
-          echo -n "Checking that Nix store paths of all wrapped programs exist... "
+          echo -n "Checking that Nix store paths of all wrapped programs exist and are ELF executables... "
           ${lib.toShellVar "wrappers" (lib.mapAttrs (n: v: v.source) wrappers)}
           for name in "''${!wrappers[@]}"; do
             path="''${wrappers[$name]}"
@@ -382,6 +384,15 @@ in
               test -t 1 && echo -ne '\033[0m'
               exit 1
             fi
+            read -r -n 4 magic < "$path"
+            if ! [[ "$magic" = $'\x7fELF' ]]; then
+              test -t 1 && echo -ne '\033[1;31m'
+              echo "FAIL"
+              echo "The target executable $path is not an ELF! This is a security risk."
+              echo "Script wrappers (e.g. bash or python) are commonly susceptible to dangerous env var injections."
+              test -t 1 && echo -ne '\033[0m'
+              exit 1
+            fi
           done
           echo "OK"
 
diff --git a/nixos/modules/services/continuous-integration/hydra/default.nix b/nixos/modules/services/continuous-integration/hydra/default.nix
index b15840252cdf..cc5a1a2ed868 100644
--- a/nixos/modules/services/continuous-integration/hydra/default.nix
+++ b/nixos/modules/services/continuous-integration/hydra/default.nix
@@ -599,6 +599,11 @@ in
                   Whether builders upload to S3 themselves instead of the queue
                   runner. Requires an S3 remote store as well as substitution on
                   the builders, see {option}`forcedSubstituters`.
+
+                  Presigned URLs stop working when the credentials that signed
+                  them expire. With temporary credentials, such as instance
+                  profiles or STS, uploads can fail before
+                  `presigned-url-expiry` is reached.
                 '';
               };
 
@@ -1264,10 +1269,9 @@ in
         pkgs.jq
         hydra-package # hydra-eval-jobset
       ];
-      restartTriggers = [
-        hydraConf
-        config.environment.etc."hydra/evaluator.toml".source
-      ];
+      # Not `hydra.conf`: only the Perl the evaluator runs reads it, and that
+      # starts afresh for each evaluation.
+      restartTriggers = [ config.environment.etc."hydra/evaluator.toml".source ];
       environment = env // {
         HYDRA_DATABASE_URL = dbUrlWithAppName "hydra-evaluator";
       };
diff --git a/nixos/modules/services/desktop-managers/pantheon.nix b/nixos/modules/services/desktop-managers/pantheon.nix
index 9ff9d1a02539..7cfcb21454e0 100644
--- a/nixos/modules/services/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/desktop-managers/pantheon.nix
@@ -324,12 +324,12 @@ in
     })
 
     (mkIf serviceCfg.apps.enable {
-      programs.evince.enable = mkDefault (notExcluded pkgs.evince);
-
       environment.systemPackages = utils.removePackagesByName (
         [
+          pkgs.epiphany
           pkgs.gnome-font-viewer
           pkgs.file-roller
+          pkgs.papers
         ]
         ++ (
           with pkgs.pantheon;
@@ -348,7 +348,6 @@ in
             elementary-tasks
             elementary-terminal
             elementary-videos
-            epiphany
           ]
           ++ lib.optionals config.services.flatpak.enable [
             # Only install appcenter if flatpak is enabled before
diff --git a/nixos/modules/services/misc/bazarr.nix b/nixos/modules/services/misc/bazarr.nix
index f6064efcc965..34a2ff1fe160 100644
--- a/nixos/modules/services/misc/bazarr.nix
+++ b/nixos/modules/services/misc/bazarr.nix
@@ -193,6 +193,41 @@ in
         KillSignal = "SIGINT";
         SuccessExitStatus = "0 156";
         LoadCredential = credentials;
+
+        # Hardening
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateIPC = true;
+        PrivateTmp = "disconnected";
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = "strict";
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "full";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallErrorNumber = "EPERM";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
       };
       unitConfig.RequiresMountsFor = [ cfg.dataDir ];
     };
diff --git a/nixos/modules/services/misc/forgejo.nix b/nixos/modules/services/misc/forgejo.nix
index 5ed68d6df619..a1d01f8db214 100644
--- a/nixos/modules/services/misc/forgejo.nix
+++ b/nixos/modules/services/misc/forgejo.nix
@@ -801,9 +801,11 @@ in
       // lib.listToAttrs (map (e: lib.nameValuePair e.env "%d/${e.env}") secrets);
     };
 
-    services.openssh.settings.AcceptEnv = mkIf (!cfg.settings.server.START_SSH_SERVER or false) [
-      "GIT_PROTOCOL"
-    ];
+    services.openssh.extraConfig = mkIf (!cfg.settings.server.START_SSH_SERVER or false) ''
+      Match User ${cfg.user}
+        AcceptEnv GIT_PROTOCOL
+      Match All
+    '';
 
     users.users = mkIf (cfg.user == "forgejo") {
       forgejo = {
diff --git a/nixos/modules/services/misc/soft-serve.nix b/nixos/modules/services/misc/soft-serve.nix
index 63b4fc120638..fe63d92443f1 100644
--- a/nixos/modules/services/misc/soft-serve.nix
+++ b/nixos/modules/services/misc/soft-serve.nix
@@ -64,7 +64,7 @@ in
         # Hooks must be executable, but DynamicUser mounts /var/lib/private as noexec
         ExecPaths = "${stateDir}/repos";
 
-        StateDirectory = "soft-serve";
+        StateDirectory = "soft-serve soft-serve/repos";
         WorkingDirectory = stateDir;
         ProcSubset = "pid";
         ProtectProc = "invisible";
diff --git a/nixos/modules/services/monitoring/netdata.nix b/nixos/modules/services/monitoring/netdata.nix
index e80650df3965..25d7db8fd15d 100644
--- a/nixos/modules/services/monitoring/netdata.nix
+++ b/nixos/modules/services/monitoring/netdata.nix
@@ -76,7 +76,7 @@ in
 {
   options = {
     services.netdata = {
-      enable = lib.mkEnableOption "netdata";
+      enable = lib.mkEnableOption "Netdata";
 
       package = lib.mkPackageOption pkgs "netdata" { };
 
@@ -180,7 +180,7 @@ in
       config = lib.mkOption {
         type = lib.types.attrsOf lib.types.attrs;
         default = { };
-        description = "netdata.conf configuration as nix attributes. cannot be combined with configText.";
+        description = "Configuration for `netdata.conf` as Nix attributes, cannot be combined with `configText`.";
         example = lib.literalExpression ''
           global = {
             "debug log" = "syslog";
@@ -194,13 +194,15 @@ in
         type = lib.types.attrsOf lib.types.path;
         default = { };
         description = ''
-          Complete netdata config directory except netdata.conf.
+          Complete netdata config directory except `netdata.conf`.
           The default configuration is merged with changes
           defined in this option.
+
           Each top-level attribute denotes a path in the configuration
-          directory as in environment.etc.
+          directory as in `environment.etc`.
+
           Its value is the absolute path and must be readable by netdata.
-          Cannot be combined with configText.
+          Cannot be combined with `configText`.
         '';
         example = lib.literalExpression ''
           "health_alarm_notify.conf" = pkgs.writeText "health_alarm_notify.conf" '''
diff --git a/nixos/modules/services/monitoring/ups.nix b/nixos/modules/services/monitoring/ups.nix
index f82806b014eb..6995c9fe03d9 100644
--- a/nixos/modules/services/monitoring/ups.nix
+++ b/nixos/modules/services/monitoring/ups.nix
@@ -93,7 +93,7 @@ let
   upsdUsers = pkgs.writeText "upsd.users" (
     let
       # This looks like INI, but it's not quite because the
-      # 'upsmon' option lacks a '='. See: man upsd.users
+      # 'upsmon' option lacks a '='. See: man upsd.users(5)
       userConfig =
         name: user:
         lib.concatStringsSep "\n      " (
@@ -128,7 +128,7 @@ let
         port = lib.mkOption {
           type = lib.types.str;
           description = ''
-            The serial port to which your UPS is connected.  /dev/ttyS0 is
+            The serial port to which your UPS is connected.  {file}`/dev/ttyS0` is
             usually the first port on Linux boxes, for example.
           '';
         };
@@ -176,7 +176,7 @@ let
           default = "";
           type = lib.types.lines;
           description = ''
-            Lines which would be added inside ups.conf for handling this UPS.
+            Lines which would be added inside {file}`ups.conf` for handling this UPS.
           '';
         };
 
@@ -203,7 +203,7 @@ let
         type = lib.types.str;
         description = ''
           Address of the interface for `upsd` to listen on.
-          See `man upsd.conf` for details.
+          See {manpage}`upsd.conf(5)` for details.
         '';
       };
 
@@ -212,7 +212,7 @@ let
         default = defaultPort;
         description = ''
           TCP port for `upsd` to listen on.
-          See `man upsd.conf` for details.
+          See {manpage}`upsd.conf(5)` for details.
         '';
       };
     };
@@ -240,7 +240,7 @@ let
         ];
         description = ''
           Address of the interface for `upsd` to listen on.
-          See `man upsd` for details`.
+          See {manpage}`upsd(8)` for details`.
         '';
       };
 
@@ -248,7 +248,7 @@ let
         type = lib.types.lines;
         default = "";
         description = ''
-          Additional lines to add to `upsd.conf`.
+          Additional lines to add to {file}`upsd.conf`.
         '';
       };
     };
@@ -272,7 +272,7 @@ let
           default = name;
           description = ''
             Identifier of the UPS to monitor, in this form: `<upsname>[@<hostname>[:<port>]]`
-            See `upsmon.conf` for details.
+            See {manpage}`upsmon.conf(5)` for details.
           '';
         };
 
@@ -281,7 +281,7 @@ let
           default = 1;
           description = ''
             Number of power supplies that the UPS feeds on this system.
-            See `upsmon.conf` for details.
+            See {file}`upsmon.conf` for details.
           '';
         };
 
@@ -289,7 +289,7 @@ let
           type = lib.types.str;
           description = ''
             Username from `upsd.users` for accessing this UPS.
-            See `upsmon.conf` for details.
+            See {manpage}`upsmon.conf(5)` for details.
           '';
         };
 
@@ -300,7 +300,7 @@ let
             The full path to a file containing the password from
             `upsd.users` for accessing this UPS. The password file
             is read on service start.
-            See `upsmon.conf` for details.
+            See {manpage}`upsmon.conf(5)` for details.
           '';
         };
 
@@ -309,7 +309,7 @@ let
           default = "master";
           description = ''
             The relationship with `upsd`.
-            See `upsmon.conf` for details.
+            See {manpage}`upsmon.conf(5)` for details.
           '';
         };
       };
@@ -331,7 +331,7 @@ let
         type = lib.types.str;
         default = "nutmon";
         description = ''
-          User to run `upsmon` as. `upsmon.conf` will have its owner set to this
+          User to run `upsmon` as. {file}`upsmon.conf` will have its owner set to this
           user. If not specified, a default user will be created.
         '';
       };
@@ -348,7 +348,7 @@ let
         type = with lib.types; attrsOf (submodule monitorOptions);
         default = { };
         description = ''
-          Set of UPS to monitor. See `man upsmon.conf` for details.
+          Set of UPS to monitor. See {manpage}`upsmon.conf(5)` for details.
         '';
       };
 
@@ -364,7 +364,7 @@ let
             SHUTDOWNCMD = "''${config.systemd.package}/bin/shutdown now";
           }
         '';
-        description = "Additional settings to add to `upsmon.conf`.";
+        description = "Additional settings to add to {file}`upsmon.conf`.";
         example = lib.literalMD ''
           {
             MINSUPPLIES = 2;
@@ -418,7 +418,7 @@ let
         default = [ ];
         description = ''
           Allow the user to do certain things with upsd.
-          See `man upsd.users` for details.
+          See {manpage}`upsd.users(5)` for details.
         '';
       };
 
@@ -427,7 +427,7 @@ let
         default = [ ];
         description = ''
           Let the user initiate specific instant commands. Use "ALL" to grant all commands automatically. For the full list of what your UPS supports, use "upscmd -l".
-          See `man upsd.users` for details.
+          See {manpage}`upsd.users(5)` for details.
         '';
       };
 
@@ -441,7 +441,7 @@ let
         default = null;
         description = ''
           Add the necessary actions for a upsmon process to work.
-          See `man upsd.users` for details.
+          See {manpage}`upsd.users(5)` for details.
         '';
       };
     };
@@ -524,7 +524,7 @@ in
       upsmon = lib.mkOption {
         default = { };
         description = ''
-          Options for the `upsmon.conf` configuration file.
+          Options for the {file}`upsmon.conf` configuration file.
         '';
         type = lib.types.submodule upsmonOptions;
       };
@@ -532,7 +532,7 @@ in
       upsd = lib.mkOption {
         default = { };
         description = ''
-          Options for the `upsd.conf` configuration file.
+          Options for the {file}`upsd.conf` configuration file.
         '';
         type = lib.types.submodule upsdOptions;
       };
@@ -551,7 +551,7 @@ in
       users = lib.mkOption {
         default = { };
         description = ''
-          Users that can access upsd. See `man upsd.users`.
+          Users that can access upsd. See {manpage}`upsd.users(5)`.
         '';
         type = with lib.types; attrsOf (submodule userOptions);
       };
diff --git a/nixos/modules/services/networking/hylafax/options.nix b/nixos/modules/services/networking/hylafax/options.nix
index ec7adf5af49f..862ce4b63f0a 100644
--- a/nixos/modules/services/networking/hylafax/options.nix
+++ b/nixos/modules/services/networking/hylafax/options.nix
@@ -199,13 +199,15 @@ in
       type = path;
       default = "/etc/hosts.hfaxd";
       description = ''
-        The {file}`hosts.hfaxd`
-        file entry in the spooling area
+        The {file}`hosts.hfaxd` file entry in the spooling area
         will be symlinked to the location given here.
-        This file must exist and be
-        readable only by the `uucp` user.
+        This file must exist and be readable only by the `uucp` user.
         See {manpage}`hosts.hfaxd(5)` for details.
-        This configuration permits access for all users:
+        The example shown below permits access for all users.
+        Note that host-based access can be controlled with
+        {option}`config.systemd.sockets.hylafax-hfaxd.listenStreams`;
+        by default, only `127.0.0.1` is permitted to connect.
+
         ```
           environment.etc."hosts.hfaxd" = {
             mode = "0600";
@@ -213,9 +215,6 @@ in
             text = ".*";
           };
         ```
-        Note that host-based access can be controlled with
-        {option}`config.systemd.sockets.hylafax-hfaxd.listenStreams`;
-        by default, only 127.0.0.1 is permitted to connect.
       '';
     };
 
@@ -306,7 +305,7 @@ in
       default = null;
       example = "daily";
       description = ''
-        purging old files from the spooling area with
+        Purges old files from the spooling area with
         {file}`faxcron` with the given frequency
         (see {manpage}`systemd.time(7)`)
       '';
@@ -346,7 +345,7 @@ in
       default = null;
       example = "daily";
       description = ''
-        Purge old files from the spooling area with
+        Purges old files from the spooling area with
         {file}`faxcron` with the given frequency
         (see {manpage}`systemd.time(7)`).
       '';
diff --git a/nixos/modules/services/web-apps/opencloud.nix b/nixos/modules/services/web-apps/opencloud.nix
index 21b3a139ea6a..cacb7ac7eb85 100644
--- a/nixos/modules/services/web-apps/opencloud.nix
+++ b/nixos/modules/services/web-apps/opencloud.nix
@@ -19,9 +19,29 @@ in
     services.opencloud = {
       enable = lib.mkEnableOption "OpenCloud";
 
-      package = lib.mkPackageOption pkgs "opencloud" { };
-      webPackage = lib.mkPackageOption pkgs [ "opencloud" "web" ] { };
-      idpWebPackage = lib.mkPackageOption pkgs [ "opencloud" "idp-web" ] { };
+      package = lib.mkPackageOption pkgs "opencloud" {
+        default = null;
+        extraDescription = ''
+          OpenCloud has 2 release cycles, explained on https://docs.opencloud.eu/docs/admin/resources/lifecycle.
+
+          Use `pkgs.opencloud` package for the rolling release (every 3 weeks).
+          Use `pkgs.opencloud-production` package for the production release (about every 6 months).
+
+          OpenCloud does not support downgrading existing installations. Switching from `pkgs.opencloud` to `pkgs.opencloud-production` is considered a downgrade.
+        '';
+      };
+      webPackage = lib.mkOption {
+        type = lib.types.package;
+        default = config.services.opencloud.package.web;
+        defaultText = "config.services.opencloud.package.web";
+        description = "The web package to use.";
+      };
+      idpWebPackage = lib.mkOption {
+        type = lib.types.package;
+        default = config.services.opencloud.package.idp-web;
+        defaultText = "config.services.opencloud.package.idp-web";
+        description = "The idp-web package to use.";
+      };
 
       user = lib.mkOption {
         type = types.str;
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 5b2eb1e4fc9d..ad22f4294f87 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -193,6 +193,7 @@ in
     extra-python-packages = runTest ./nixos-test-driver/extra-python-packages.nix;
     lib-extend = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./nixos-test-driver/lib-extend.nix { };
     node-name = runTest ./nixos-test-driver/node-name.nix;
+    qmp-api-error = runTest ./nixos-test-driver/qmp-api-error.nix;
     busybox = runTest ./nixos-test-driver/busybox.nix;
     ssh-backdoor = runTestOn [ "x86_64-linux" ] ./nixos-test-driver/ssh-backdoor.nix;
     console-log = runTest ./nixos-test-driver/console-log.nix;
@@ -595,6 +596,7 @@ in
   ejabberd = runTest ./xmpp/ejabberd.nix;
   elk = handleTestOn [ "x86_64-linux" ] ./elk.nix { };
   elk-zone = runTest ./web-apps/elk.nix;
+  emacs = runTest ./emacs;
   emacs-daemon = runTest ./emacs-daemon.nix;
   endlessh = runTest ./endlessh.nix;
   endlessh-go = runTest ./endlessh-go.nix;
@@ -785,6 +787,7 @@ in
   gotify-server = runTest ./gotify-server.nix;
   gotosocial = runTest ./web-apps/gotosocial.nix;
   goupile = runTest ./web-apps/goupile;
+  gpauth-tls = runTest ./gpauth-tls.nix;
   grafana = import ./grafana {
     inherit runTest;
   };
@@ -1395,7 +1398,16 @@ in
   openarena = runTest ./openarena.nix;
   openbao = runTest ./openbao.nix;
   openbao-agent = runTest ./openbao-agent.nix;
-  opencloud = runTest ./opencloud.nix;
+  opencloud = runTest {
+    imports = [ ./opencloud.nix ];
+    _module.args.opencloudPackage = pkgs.opencloud;
+    _module.args.name = "opencloud";
+  };
+  opencloud-production = runTest {
+    imports = [ ./opencloud.nix ];
+    _module.args.opencloudPackage = pkgs.opencloud-production;
+    _module.args.name = "opencloud-production";
+  };
   openldap = runTest ./openldap.nix;
   openresty-lua = runTest ./openresty-lua.nix;
   opensearch = discoverTests (import ./opensearch.nix);
@@ -1865,6 +1877,7 @@ in
   systemd-no-tainted = runTest ./systemd-no-tainted.nix;
   systemd-nspawn = runTest ./systemd-nspawn.nix;
   systemd-nspawn-configfile = runTest ./systemd-nspawn-configfile.nix;
+  systemd-nsresourced-mountfsd = runTest ./systemd-nsresourced-mountfsd.nix;
   systemd-oomd = runTest ./systemd-oomd.nix;
   systemd-portabled = runTest ./systemd-portabled.nix;
   systemd-pstore = runTest ./systemd-pstore.nix;
diff --git a/nixos/tests/atuin-programs.nix b/nixos/tests/atuin-programs.nix
index 14477bae9b08..821a963205e7 100644
--- a/nixos/tests/atuin-programs.nix
+++ b/nixos/tests/atuin-programs.nix
@@ -26,7 +26,8 @@
     machine.succeed("atuin --version")
 
     # Check shell integration - verify the init scripts can be sourced without error
-    machine.succeed("bash -c 'eval \"$(atuin init bash)\"'")
+    # bash init only runs in interactive shells; skip bashrc, which already sources it
+    machine.succeed("bash --norc -ic 'eval \"$(atuin init bash)\"'")
     machine.succeed("zsh -c 'eval \"$(atuin init zsh)\"'")
     machine.succeed("fish -c 'atuin init fish | source'")
 
@@ -34,6 +35,8 @@
     machine.succeed("grep -q 'auto_sync = false' /etc/atuin/config.toml")
 
     # Verify daemon socket unit is enabled
-    machine.succeed("systemctl --user --machine=root@ is-enabled atuin-daemon.socket")
+    # needs a running user manager for root
+    machine.succeed("loginctl enable-linger root")
+    machine.wait_until_succeeds("systemctl --user --machine=root@ is-enabled atuin-daemon.socket")
   '';
 }
diff --git a/nixos/tests/emacs/default.nix b/nixos/tests/emacs/default.nix
new file mode 100644
index 000000000000..7740024b627b
--- /dev/null
+++ b/nixos/tests/emacs/default.nix
@@ -0,0 +1,132 @@
+{
+  lib,
+  nodes,
+  ...
+}:
+
+{
+  name = "emacs";
+  meta.maintainers = lib.teams.emacs.members;
+
+  defaults =
+    {
+      lib,
+      pkgs,
+      config,
+      ...
+    }:
+    {
+      options.tests.emacs = {
+        package = lib.mkPackageOption pkgs "Emacs" {
+          default = [ "emacs" ];
+          example = [ "emacs-nox" ];
+        };
+        wrappedPackage = lib.mkOption {
+          type = lib.types.package;
+          default = config.tests.emacs.package.pkgs.withPackages (epkgs: [
+            epkgs.project-nix-store
+          ]);
+          defaultText = lib.literalExpression ''
+            package.pkgs.withPackages (epkgs: [ epkgs.project-nix-store ])
+          '';
+          readOnly = true;
+          description = "Emacs wrapped by withPackages.";
+        };
+      };
+    };
+
+  nodes.local =
+    {
+      pkgs,
+      config,
+      lib,
+      ...
+    }:
+    let
+      cfg = config.tests.emacs;
+      mkEpkg = import ../../../pkgs/applications/editors/emacs/build-support/tests/mk-epkg.nix {
+        inherit lib;
+      };
+    in
+    {
+      environment.systemPackages = [
+        # Make sure closure of this machine contains both unwrapped and wrapped Emacs
+        # so that we can run them in the test script.
+        cfg.wrappedPackage
+
+        # Tests
+        (cfg.package.pkgs.callPackage (mkEpkg {
+          pname = "nixos";
+          src = ./nixos.el;
+        }) { })
+      ]
+      ++ [
+        cfg.package.pkgs.orderless
+        pkgs.cmatrix
+      ];
+      users.users.root.packages = [
+        cfg.package.pkgs.dash
+        pkgs.hello
+      ];
+
+      environment.etc.ssh-private-key = {
+        source = (import ../ssh-keys.nix pkgs).snakeOilEd25519PrivateKey;
+        mode = "0600";
+      };
+      programs.ssh.extraConfig = ''
+        StrictHostKeyChecking=no
+        IdentityFile=/etc/${config.environment.etc.ssh-private-key.target}
+      '';
+      systemd.targets.network-online.wantedBy = [ "multi-user.target" ];
+      systemd.services.wait-ssh-to-remote = {
+        description = "Wait for SSH to Remote";
+        documentation = [
+          "https://systemd.io/NETWORK_ONLINE/#modifying-the-meaning-of-network-onlinetarget"
+          "man:systemd.special(7)"
+        ];
+        after = [ "nss-lookup.target" ];
+        before = [ "network-online.target" ];
+        wantedBy = [ "network-online.target" ];
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+        };
+        path = [ config.programs.ssh.package ];
+        script = ''
+          until ssh -o ConnectTimeout=1 ${nodes.remote.networking.hostName} true
+          do
+            sleep 1
+          done
+        '';
+      };
+
+      environment.sessionVariables = {
+        EMACS_TEST_VERBOSE = 1; # Make ERT output verbose
+      };
+    };
+
+  nodes.remote = { pkgs, ... }: {
+    environment.systemPackages = [
+      pkgs.sl
+    ];
+    security.sudo.enable = true;
+
+    services.openssh.enable = true;
+    users.users.root.openssh.authorizedKeys.keys = [
+      (import ../ssh-keys.nix pkgs).snakeOilEd25519PublicKey
+    ];
+  };
+
+  testScript = ''
+    start_all()
+
+    for machine in (local, remote):
+      machine.wait_for_unit("default.target")
+
+    for emacs in (
+      "${lib.getExe nodes.local.tests.emacs.package}",
+      "${lib.getExe nodes.local.tests.emacs.wrappedPackage}",
+    ):
+      local.succeed(f'{emacs} --batch --load=nixos --funcall=ert-run-tests-batch-and-exit')
+  '';
+}
diff --git a/nixos/tests/emacs/nixos.el b/nixos/tests/emacs/nixos.el
new file mode 100644
index 000000000000..58c0c63fa439
--- /dev/null
+++ b/nixos/tests/emacs/nixos.el
@@ -0,0 +1,90 @@
+;;; nixos.el --- Emacs tests related to Nix or NixOS  -*- lexical-binding: t; -*-
+
+;; Version: 0.1.0
+;; Package-Requires: ((emacs "29.1"))
+;; URL: https://example.com
+
+;;; Commentary:
+
+;; Emacs tests related to Nix or NixOS.
+
+;;; Code:
+
+(require 'ert)
+(eval-when-compile (require 'cl-lib))
+(require 'woman)
+(require 'info)
+
+;;;; Utils
+
+(defun nixos--locate-eln-file (library)
+  "Locate the natively-compiled LIBRARY file."
+  (declare-function comp-el-to-eln-rel-filename "comp.c")
+  (locate-eln-file (comp-el-to-eln-rel-filename (find-library-name library))))
+
+(defun nixos--ancestor-dir-of-file-p (dir file)
+  "Return t if DIR is an ancestor of FILE."
+  (locate-dominating-file file
+                          (lambda (current-dir)
+                            (string= current-dir (file-name-as-directory dir)))))
+
+(defun nixos--in-nix-profiles-p (file)
+  "Return t if FILE is in nix profiles."
+  (declare-function nix--profile-paths "site-start")
+  (cl-loop for profile-dir in (nix--profile-paths)
+           thereis (nixos--ancestor-dir-of-file-p profile-dir file)))
+
+;;;; Tests
+
+(ert-deftest nixos-packages-in-nix-profiles-are-available ()
+  (ert-info ("nix system profile")
+    (should (package-installed-p 'orderless)))
+  (ert-info ("nix user profile")
+    (should (package-installed-p 'dash))))
+
+(ert-deftest nixos-aot-native-comp-eln-files-of-packages-in-nix-profiles-are-available ()
+  (skip-unless (native-comp-available-p))
+  (ert-info ("nix system profile")
+    (should (nixos--in-nix-profiles-p (nixos--locate-eln-file "orderless"))))
+  (ert-info ("nix user profile")
+    (should (nixos--in-nix-profiles-p (nixos--locate-eln-file "dash")))))
+
+(ert-deftest nixos-woman-can-find-manuals-in-nix-profiles ()
+  (ert-info ("nix system profile")
+    (should (woman-file-name "cmatrix")))
+  (ert-info ("nix user profile")
+    (should (woman-file-name "hello"))))
+
+(ert-deftest nixos-info-manuals-of-packages-in-nix-profiles-are-available ()
+  "Test https://debbugs.gnu.org/cgi/bugreport.cgi?bug=81105."
+  (unless package--activated
+    (package-activate-all))
+  (ert-info ("nix system profile")
+    (should (Info-find-file "orderless" t)))
+  (ert-info ("nix user profile")
+    (should (Info-find-file "dash" t))))
+
+(ert-deftest nixos-tramp-knows-nix-specific-path ()
+  ;; Security wrappers are added to two PATH dirs:
+  ;;   /run/wrappers/bin/ and /run/current-system/sw/bin.
+  ;; So, in addition to testing if the security wrapper can be found,
+  ;; we also test if the found security wrapper is the right one.
+  (cl-loop
+   for (program program-dir) in '(("sl")
+                                  ("sudo" "/run/wrappers/bin"))
+   do
+   (ert-info ((format "program %s is found remotely" program))
+     (let ((found-program (let ((default-directory "/ssh:remote:"))
+                            (executable-find program t))))
+       (should found-program)
+       (when program-dir
+         (should (equal found-program
+                        (expand-file-name program program-dir))))))))
+
+(provide 'nixos)
+
+;;; nixos.el ends here
+
+;; Local Variables:
+;; checkdoc-force-docstrings-flag: nil
+;; End:
diff --git a/nixos/tests/gpauth-tls.nix b/nixos/tests/gpauth-tls.nix
new file mode 100644
index 000000000000..1fb85dc654cc
--- /dev/null
+++ b/nixos/tests/gpauth-tls.nix
@@ -0,0 +1,72 @@
+{ config, ... }:
+
+{
+  name = "gpauth-tls";
+
+  meta.maintainers = config.node.pkgs.gpauth.meta.maintainers;
+
+  nodes.machine =
+    { pkgs, ... }:
+    let
+      httpsServer = pkgs.writeText "gpauth-test-server.py" ''
+        import ssl
+        from http.server import BaseHTTPRequestHandler, HTTPServer
+
+        class Handler(BaseHTTPRequestHandler):
+            def do_GET(self):
+                body = b"<html><body>authenticated</body></html>"
+                self.send_response(200)
+                self.send_header("Content-Type", "text/html")
+                self.send_header("Content-Length", str(len(body)))
+                self.send_header("saml-auth-status", "1")
+                self.send_header("saml-username", "fixture-user")
+                self.send_header("prelogin-cookie", "fixture-cookie")
+                self.end_headers()
+                self.wfile.write(body)
+
+            def log_message(self, format, *args):
+                pass
+
+        context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+        context.load_cert_chain("cert.pem", "key.pem")
+
+        server = HTTPServer(("127.0.0.1", 4443), Handler)
+        server.socket = context.wrap_socket(server.socket, server_side=True)
+        server.serve_forever()
+      '';
+    in
+    {
+      imports = [ ./common/x11.nix ];
+
+      environment.systemPackages = [ pkgs.gpauth ];
+
+      systemd.services.gpauth-test-server = {
+        description = "gpauth test SAML endpoint";
+        wantedBy = [ "multi-user.target" ];
+        preStart = ''
+          ${pkgs.openssl}/bin/openssl req -x509 -newkey rsa:2048 -noenc \
+            -subj /CN=localhost -keyout key.pem -out cert.pem
+        '';
+        serviceConfig = {
+          ExecStart = "${pkgs.python3}/bin/python ${httpsServer}";
+          RuntimeDirectory = "gpauth-test-server";
+          WorkingDirectory = "/run/gpauth-test-server";
+        };
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_x()
+    machine.wait_for_unit("gpauth-test-server.service")
+    machine.wait_for_open_port(4443)
+
+    output = machine.succeed(
+      "DISPLAY=:0 timeout 30s gpauth localhost "
+      "--saml-request https://127.0.0.1:4443/ "
+      # self-signed cert is used
+      "--ignore-tls-errors"
+    )
+    assert "fixture-user" in output
+    assert "fixture-cookie" in output
+  '';
+}
diff --git a/nixos/tests/nixos-test-driver/qmp-api-error.nix b/nixos/tests/nixos-test-driver/qmp-api-error.nix
new file mode 100644
index 000000000000..30a322721943
--- /dev/null
+++ b/nixos/tests/nixos-test-driver/qmp-api-error.nix
@@ -0,0 +1,22 @@
+{
+  name = "qmp-api-error";
+
+  nodes.machine = { };
+
+  testScript = ''
+    from test_driver.machine.qmp import QMPAPIError
+
+    machine.start()
+
+    assert machine.qmp_client is not None
+
+    try:
+        machine.qmp_client.send("this-command-does-not-exist")
+    except QMPAPIError as error:
+        t.assertEqual(error.class_name, "CommandNotFound")
+        t.assertTrue(error.description)
+        t.assertIsNone(error.transaction_id)
+    else:
+        raise AssertionError("expected QMPAPIError")
+  '';
+}
diff --git a/nixos/tests/opencloud.nix b/nixos/tests/opencloud.nix
index 25bd5295f68c..f754374d80c6 100644
--- a/nixos/tests/opencloud.nix
+++ b/nixos/tests/opencloud.nix
@@ -1,4 +1,10 @@
-{ lib, pkgs, ... }:
+{
+  lib,
+  pkgs,
+  name,
+  opencloudPackage,
+  ...
+}:
 
 let
   certs = import ./common/acme/server/snakeoil-certs.nix;
@@ -49,7 +55,7 @@ let
 in
 
 {
-  name = "opencloud";
+  inherit name;
 
   meta.maintainers = with lib.maintainers; [
     christoph-heiss
@@ -69,6 +75,7 @@ in
 
     services.opencloud = {
       enable = true;
+      package = opencloudPackage;
       url = "https://${domain}:9200";
       environment = {
         ADMIN_PASSWORD = adminPassword;
diff --git a/nixos/tests/systemd-nsresourced-mountfsd.nix b/nixos/tests/systemd-nsresourced-mountfsd.nix
new file mode 100644
index 000000000000..e8afb3aced17
--- /dev/null
+++ b/nixos/tests/systemd-nsresourced-mountfsd.nix
@@ -0,0 +1,68 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  name = "systemd-nsresourced-mountfsd";
+
+  meta.maintainers = with lib.maintainers; [ raitobezarius ];
+
+  nodes.machine = { config, ... }: {
+    # Currently, kernel BTF enabled systemd is not the default yet.
+    systemd.package = config.boot.kernelPackages.systemd;
+    systemd.additionalUpstreamSystemUnits = [
+      "systemd-nsresourced.socket"
+      "systemd-nsresourced.service"
+      "systemd-mountfsd.socket"
+      "systemd-mountfsd.service"
+    ];
+  };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+
+    with subtest("BPF LSM is active"):
+        lsm = machine.succeed("cat /sys/kernel/security/lsm")
+        assert "bpf" in lsm, f"BPF LSM is not active: {lsm}"
+
+    with subtest("nsresourced and mountfsd sockets are available"):
+        machine.systemctl("start systemd-nsresourced.socket systemd-mountfsd.socket")
+        machine.wait_for_unit("systemd-nsresourced.socket")
+        machine.wait_for_unit("systemd-mountfsd.socket")
+
+    with subtest("nsresourced serves its varlink interface and delegates a user namespace"):
+        machine.succeed("varlinkctl introspect /run/systemd/userdb/io.systemd.NamespaceResource")
+        machine.succeed(
+            "unshare --user varlinkctl --exec call "
+            "--push-fd=/proc/self/ns/user "
+            "/run/systemd/userdb/io.systemd.NamespaceResource "
+            "io.systemd.NamespaceResource.AllocateUserRange "
+            "'{\"name\":\"nixos-test\",\"size\":65536,\"userNamespaceFileDescriptor\":0}' "
+            "-- cat /proc/self/uid_map"
+        )
+
+    with subtest("mountfsd serves its varlink interface"):
+        machine.succeed("varlinkctl introspect /run/systemd/io.systemd.MountFileSystem")
+
+    with subtest("mountfsd mounts a DDI on behalf of a client"):
+        machine.succeed("mkdir -p /tmp/ddi-defs")
+        machine.succeed("echo '[Partition]' > /tmp/ddi-defs/10-root.conf")
+        machine.succeed("echo 'Type=root' >> /tmp/ddi-defs/10-root.conf")
+        machine.succeed("echo 'Format=ext4' >> /tmp/ddi-defs/10-root.conf")
+        machine.succeed(
+            "PATH=${pkgs.e2fsprogs}/bin:$PATH "
+            "systemd-repart --empty=create --size=64M "
+            "--definitions=/tmp/ddi-defs --offline=yes /var/tmp/ddi.raw"
+        )
+        # SYSTEMD_USE_MOUNTFSD forces systemd-dissect to go through
+        # systemd-mountfsd (and systemd-nsresourced) instead of mounting the
+        # image locally.
+        # NOTE: image-policy should be restricted but I failed to do so.
+        machine.succeed(
+            "SYSTEMD_USE_MOUNTFSD=1 systemd-dissect "
+            "--image-policy='*' --mtree /var/tmp/ddi.raw"
+        )
+  '';
+}
diff --git a/pkgs/applications/editors/android-studio/linux.nix b/pkgs/applications/editors/android-studio/linux.nix
index 7a79ab2d3bd9..4ea463cfecdb 100644
--- a/pkgs/applications/editors/android-studio/linux.nix
+++ b/pkgs/applications/editors/android-studio/linux.nix
@@ -64,7 +64,7 @@
   setxkbmap,
   lib,
   stdenv,
-  systemd,
+  systemdLibs,
   unzip,
   usbutils,
   which,
@@ -190,7 +190,7 @@ let
             libpng
             nspr
             nss_latest
-            systemd
+            systemdLibs
 
             # For GTKLookAndFeel
             gtk3
diff --git a/pkgs/applications/editors/eclipse/plugins.nix b/pkgs/applications/editors/eclipse/plugins.nix
index fef09c0a3ca6..32e2c1cf9318 100644
--- a/pkgs/applications/editors/eclipse/plugins.nix
+++ b/pkgs/applications/editors/eclipse/plugins.nix
@@ -317,7 +317,7 @@ rec {
     };
 
     meta = {
-      homepage = "http://eclipsecolorthemes.org/";
+      homepage = "https://github.com/eclipse-color-theme/eclipse-color-theme";
       description = "Plugin to switch color themes conveniently and without side effects";
       sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
       license = lib.licenses.epl10;
diff --git a/pkgs/applications/editors/emacs/build-support/generic.nix b/pkgs/applications/editors/emacs/build-support/generic.nix
index d0124876c6b2..b8f7314a516d 100644
--- a/pkgs/applications/editors/emacs/build-support/generic.nix
+++ b/pkgs/applications/editors/emacs/build-support/generic.nix
@@ -38,12 +38,16 @@ lib.extendMkDerivation {
         args.unpackCmd or ''
           case "$curSrc" in
             *.el)
-              # keep original source filename without the hash
-              local filename=$(basename "$curSrc")
-              filename="''${filename:33}"
-              cp $curSrc $filename
-              chmod +w $filename
-              sourceRoot="."
+              if [ -f "$curSrc" ]; then
+                # keep original source filename without the hash
+                local filename=$(basename "$curSrc")
+                filename="''${filename:33}"
+                cp $curSrc $filename
+                chmod +w $filename
+                sourceRoot="."
+              else
+                _defaultUnpack "$curSrc"
+              fi
               ;;
             *)
               _defaultUnpack "$curSrc"
diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/default.el b/pkgs/applications/editors/emacs/build-support/tests/default.el
similarity index 100%
rename from pkgs/applications/editors/emacs/build-support/wrapper-test/default.el
rename to pkgs/applications/editors/emacs/build-support/tests/default.el
diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/early-default.el b/pkgs/applications/editors/emacs/build-support/tests/early-default.el
similarity index 100%
rename from pkgs/applications/editors/emacs/build-support/wrapper-test/early-default.el
rename to pkgs/applications/editors/emacs/build-support/tests/early-default.el
diff --git a/pkgs/applications/editors/emacs/build-support/tests/mk-epkg.nix b/pkgs/applications/editors/emacs/build-support/tests/mk-epkg.nix
new file mode 100644
index 000000000000..f3e5615724b3
--- /dev/null
+++ b/pkgs/applications/editors/emacs/build-support/tests/mk-epkg.nix
@@ -0,0 +1,61 @@
+{
+  lib,
+}:
+
+{
+  pname,
+  version ? "0.1.0", # a dummy value
+  src ? lib.path.append ./. "${pname}.el",
+  doLint ? true,
+}:
+
+{
+  melpaBuild,
+  package-lint,
+}:
+melpaBuild {
+  inherit pname version src;
+  turnCompilationWarningToError = true;
+
+  packageRequires = lib.optional doLint package-lint;
+
+  doInstallCheck = doLint;
+  preInstallCheck = ''
+    lintEachFile() {
+      find $out/share/emacs \
+        -type f -name '*.el' \
+        -not -name "*-pkg.el" -not -name "*-autoloads.el" \
+        -print0 \
+      | xargs --verbose -0 -I {} -n 1 -P "$NIX_BUILD_CORES" "$@"
+    }
+
+    lintEachFile \
+      emacs --batch \
+        --funcall=package-activate-all \
+        --funcall=package-lint-batch-and-exit "{}"
+
+    lintEachFile \
+      emacs --batch \
+        "{}" \
+        --eval='(setopt checkdoc-arguments-in-order-flag t)' \
+        --funcall=checkdoc-batch
+
+    lintEachFile \
+      emacs --batch \
+        "{}" \
+        --eval='
+          (progn
+            ;; load indentation settings, if any, see (info "(emacs) Lisp Indent")
+            (eval-buffer)
+            (indent-region (point-min) (point-max))
+            (with-current-buffer
+                (diff-no-select buffer-file-name (current-buffer) nil t)
+              (goto-char (point-min))
+              (condition-case nil
+                  (let ((case-fold-search nil))
+                    (search-forward "Diff finished (no differences)"))
+                (search-failed
+                 (princ (buffer-string))
+                 (error "%s" "File indentation is wrong")))))'
+  '';
+}
diff --git a/pkgs/applications/editors/emacs/build-support/tests/unwrapped.nix b/pkgs/applications/editors/emacs/build-support/tests/unwrapped.nix
new file mode 100644
index 000000000000..a9ac70dcc384
--- /dev/null
+++ b/pkgs/applications/editors/emacs/build-support/tests/unwrapped.nix
@@ -0,0 +1,33 @@
+{
+  runCommand,
+  emacs,
+  writeShellApplication,
+}:
+
+let
+  run-test = writeShellApplication {
+    name = "run-test";
+    runtimeInputs = [
+      emacs
+    ];
+    runtimeEnv = {
+      EMACS_TEST_VERBOSE = 1; # make ERT output verbose
+    };
+    text = ''
+      emacs --batch \
+        --load=${./with-packages.el} \
+        --eval="(ert-run-tests-batch-and-exit '(tag :shared-with-unwrapped))"
+    '';
+  };
+in
+runCommand "test-emacs-unwrapped"
+  {
+    nativeBuildInputs = [
+      run-test
+    ];
+  }
+  ''
+    run-test
+
+    touch $out
+  ''
diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el b/pkgs/applications/editors/emacs/build-support/tests/with-packages.el
similarity index 50%
rename from pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
rename to pkgs/applications/editors/emacs/build-support/tests/with-packages.el
index 30735966656d..7b61d22692e2 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
+++ b/pkgs/applications/editors/emacs/build-support/tests/with-packages.el
@@ -1,9 +1,17 @@
 ;;; with-packages.el --- Utils and ERT tests for withPackages  -*- lexical-binding: t; -*-
 
+;; Version: 0.1.0
+;; Package-Requires: ((emacs "29.1"))
+;; URL: https://example.com
+
+;;; Commentary:
+
+;; Utils and ERT tests for emacs.pkgs.withPackages.
+
 ;;; Code:
 
 (require 'ert)
-(eval-when-compile (require 'cl-lib))
+(require 'cl-lib)
 (require 'server)
 (require 'info)
 
@@ -26,33 +34,46 @@ which is generated by nix when building this elisp package."
          (`(,store-dir) store-dir))
      (error "@storeDir@"))))
 
-(defun with-packages--nix-store-file-p (file)
-  "Return t if FILE is in nix store."
+(defun with-packages--in-nix-store-p (file-or-dir)
+  "Return t if FILE-OR-DIR is in nix store."
   (cl-loop
    with store-dir = (with-packages--nix-store-dir)
-   for parent = (file-name-parent-directory file) then (file-name-parent-directory parent)
+   for parent = (file-name-parent-directory file-or-dir) then (file-name-parent-directory parent)
    while parent
    thereis (string= parent store-dir)))
 
 (defun with-packages--locate-eln-file (library)
   "Locate the natively-compiled LIBRARY file."
+  (declare-function comp-el-to-eln-rel-filename "comp.c")
   (locate-eln-file (comp-el-to-eln-rel-filename (find-library-name library))))
 
 (defun with-packages-unwrapped-site-start-is-loaded ()
   (fboundp 'nix--profile-paths))
 
-(defun with-packages-eval-in-sub-emacs (form)
-  "Evaluate FORM in a subprocess Emacs and return its result."
+(cl-defun with-packages-eval-in-sub-emacs (form &optional (emacs-program "emacs"))
+  "Evaluate FORM in a subprocess Emacs and return its result.
+EMACS-PROGRAM specifies the subprocess Emacs to start."
   (pcase-exhaustive
-      (process-lines "emacs" "--batch"
+      (process-lines emacs-program "--batch"
                      "--eval" (format "(prin1 %S)" form))
     (`(,result) (read result))))
 
+(defvar with-packages-unwrapped-emacs-program nil
+  "Absoluate file of an unwrapped Emacs binary.
+Set this variable before running related tests.")
+
 ;;;; Tests that can be run in a batch Emacs
 
 (ert-deftest with-packages-requested-packages-are-available ()
   (should (package-installed-p 'dash))
-  (should (package-installed-p 'flx-ido)))
+  (should (package-installed-p 'flx-ido))
+  ;; Test 23d4bfb6661ca57a9e331a2cf4184232d38ac38b.
+  (ert-info ("unwrapped subprocess Emacs does not have requested packages installed")
+    (should (file-name-absolute-p with-packages-unwrapped-emacs-program))
+    (should-not (with-packages-eval-in-sub-emacs '(package-installed-p 'dash)
+                                                 with-packages-unwrapped-emacs-program))
+    (should-not (with-packages-eval-in-sub-emacs '(package-installed-p 'flx-ido)
+                                                 with-packages-unwrapped-emacs-program))))
 
 (ert-deftest with-packages-deps-of-requested-packages-are-available ()
   "Test https://github.com/NixOS/nixpkgs/issues/388829."
@@ -71,18 +92,41 @@ which is generated by nix when building this elisp package."
 (ert-deftest with-packages-aot-native-comp-eln-files-are-available ()
   (skip-unless (native-comp-available-p))
   (ert-info ("search eln files of Emacs proper")
-    (should (with-packages--nix-store-file-p (with-packages--locate-eln-file "files"))))
+    (should (with-packages--in-nix-store-p (with-packages--locate-eln-file "files"))))
   (ert-info ("search eln files of requested packages")
-    (should (with-packages--nix-store-file-p (with-packages--locate-eln-file "dash")))))
+    (should (with-packages--in-nix-store-p (with-packages--locate-eln-file "dash"))))
+  ;; `load' does not try to find .eln files if it cannot find .elc or .el files.
+  ;; Assuming unwrapped subprocess Emacs cannot find .elc or .el files of requested packages,
+  ;; which is tested in `with-packages-requested-packages-are-available',
+  ;; probably, the tested code in our site-start.el and this test are unnecessary.
+  ;; In addition, what we really want to test is that unwrapped subprocess Emacs does not
+  ;; see eln files of requested packages, which is not easy to test.
+  ;; So we test an easier-to-test proxy, which unfortunately can be seen as
+  ;; implementation detail of the wrapper.
+  (ert-info ("subprocess does not see wrapper-modified EMACSNATIVELOADPATH")
+    (let ((eln-dirs-added-by-wrapper
+           (cl-set-difference
+            (parse-colon-path (getenv-internal "EMACSNATIVELOADPATH" initial-environment))
+            (parse-colon-path (getenv "EMACSNATIVELOADPATH"))
+            :test #'string=)))
+      (should (equal (length eln-dirs-added-by-wrapper) 1))
+      (let ((eln-dir-added-by-wrapper (car eln-dirs-added-by-wrapper)))
+        (should (with-packages--in-nix-store-p eln-dir-added-by-wrapper))
+        (cl-flet ((ancestor-dir-of-file-p (dir file)
+                    (locate-dominating-file file
+                                            (lambda (current-dir)
+                                              (string= current-dir dir)))))
+          (should (ancestor-dir-of-file-p eln-dir-added-by-wrapper
+                                          (with-packages--locate-eln-file "dash"))))))))
 
 (ert-deftest with-packages-unwrapped-site-start-is-loaded ()
   (should (with-packages-unwrapped-site-start-is-loaded)))
 
 (ert-deftest with-packages-binaries-of-requested-packages-are-available ()
   (ert-info ("find binary via PATH")
-    (should (equal (call-process-shell-command "cowsay") 0)))
+    (should (equal (call-process-shell-command "hello") 0)))
   (ert-info ("find binary via exec-path")
-    (should (executable-find "cowsay")))
+    (should (executable-find "hello")))
   (ert-info ("each item is unique")
     (cl-flet ((item-should-be-unique (items)
                 (should (equal items
@@ -101,16 +145,44 @@ which is generated by nix when building this elisp package."
   (skip-unless (treesit-available-p))
   (should (treesit-language-available-p 'nix)))
 
+(ert-deftest with-packages-invocation-name-and-directory-are-wrapped ()
+  "Test https://github.com/NixOS/nixpkgs/pull/361145."
+  ;; Generally, to a build filename, `expand-file-name' is better than `concat',
+  ;; because `expand-file-name' accepts a dir not ending with "/".
+  ;; We use `concat' because we want to support existing `concat' usages, such as esup.el:
+  ;; https://github.com/jschaf/esup/blob/4b49c8d599d4cc0fbf994e9e54a9c78e5ab62a5f/esup.el#L161
+  (ert-info ("wrapped Emacs has correct invocation-name and -directory")
+    (should (equal (file-truename (executable-find "emacs"))
+                   (concat invocation-directory invocation-name))))
+  (ert-info ("unwrapped subprocess Emacs has correct invocation-name and -directory")
+    (should (file-name-absolute-p with-packages-unwrapped-emacs-program))
+    (should
+     (equal with-packages-unwrapped-emacs-program
+            (with-packages-eval-in-sub-emacs '(concat invocation-directory invocation-name)
+                                             with-packages-unwrapped-emacs-program)))))
+
+(ert-deftest with-packages-c-source-is-available ()
+  :tags '(:shared-with-unwrapped)
+  (let ((function-to-find 'eval))
+    (ert-info ("this function is written in C")
+      (should (subr-primitive-p (symbol-function function-to-find))))
+    (ert-info ("C source code of this function can be found")
+      (should find-function-C-source-directory)
+      (should (cdr (find-function-noselect function-to-find))))))
+
 ;;;; Utils for non-batch tests
 
 (defmacro define-with-packages-non-batch-test-via-bound-and-true-p (test-name)
+  "Define a function named TEST-NAME which tests symbol TEST-NAME."
   (declare (indent 1) (debug (symbolp)))
   (cl-check-type test-name symbol)
   `(defun ,test-name ()
      (list (bound-and-true-p ,test-name))))
 
 (defmacro define-with-packages-non-batch-tests-via-bound-and-true-p (&rest test-names)
-  "See also `define-with-packages-non-batch-test-via-bound-and-true-p'."
+  "TEST-NAMES is a list of symbols.
+Each of them is passed to
+`define-with-packages-non-batch-test-via-bound-and-true-p'."
   (declare (indent 0) (debug (&rest symbolp)))
   `(progn
      ,@(cl-loop
@@ -137,11 +209,20 @@ Return test result, a list of values.  Each is non-nil if the test passes."
      ;; Run the non-batch test and return test result.
      (eval-in-non-batch-emacs `(,test-name)))))
 
-(defmacro define-with-packages-non-batch-ert-test (test-name)
-  "See `with-packages--run-non-batch-test' for how the test is run."
-  (declare (indent 1) (debug (symbolp)))
+(defmacro define-with-packages-non-batch-ert-test (test-name &rest ert-forms)
+  "Define an ERT test named TEST-NAME.
+
+That test first asks a non-batch Emacs to run function TEST-NAME.
+See `with-packages--run-non-batch-test' for how function TEST-NAME is run.
+The test then retrieves the result of function TEST-NAME.
+Depending on the result, the test passes or fails.
+
+ERT-FORMS are placed at the start of the ERT test,
+which can be used to add skip condition and :expected-result."
+  (declare (indent 1) (debug (symbolp &rest sexp)))
   (cl-check-type test-name symbol)
   `(ert-deftest ,test-name ()
+     ,@ert-forms
      (should (stringp with-packages-non-batch-emacs-socket))
      (should (file-readable-p with-packages-non-batch-emacs-socket))
      (let ((test-result (with-packages--run-non-batch-test (quote ,test-name))))
@@ -152,7 +233,8 @@ Return test result, a list of values.  Each is non-nil if the test passes."
                                collect (or item t)))))))
 
 (defmacro define-with-packages-non-batch-ert-tests (&rest test-names)
-  "See also `define-with-packages-non-batch-ert-test'."
+  "TEST-NAMES is a list of symbols.
+Each of them is passed to `define-with-packages-non-batch-ert-test'."
   (declare (indent 0) (debug (&rest symbolp)))
   `(progn
      ,@(cl-loop for test-name in test-names
@@ -168,7 +250,7 @@ Return test result, a list of values.  Each is non-nil if the test passes."
 (defun with-packages-unwrapped-site-start-is-loaded-quietly ()
   (list (with-packages-unwrapped-site-start-is-loaded)
         (not (save-excursion
-               (with-current-buffer "*Messages*"
+               (with-current-buffer (messages-buffer)
                  (goto-char (point-min))
                  (save-match-data
                    (re-search-forward (rx line-start
@@ -181,28 +263,34 @@ Return test result, a list of values.  Each is non-nil if the test passes."
 (defun with-packages-no-jit-native-comp ()
   "Test no JIT native-comp is triggered during non-batch tests.
 This is a regression test for URL `https://github.com/NixOS/nixpkgs/pull/538964'."
-  (if (not (native-comp-available-p))
-      (list t)
-    ;; Give Emacs some time to generate JIT native-comp results.
-    ;; It is possible that this test passes even if there is JIT native-comp
-    ;; because we use a hardcoded time span as the synchronization point.
-    ;; Ideally, we should use a more robust synchronization point.
-    (sleep-for 2.5)
-    (list (not (cl-loop for buffer being each buffer
-                        thereis (string= (buffer-name buffer)
-                                         "*Async-native-compile-log*")))
-          (let ((eln-dir (car native-comp-eln-load-path)))
-            (or (directory-empty-p eln-dir)
-                (and (not (file-exists-p eln-dir))
-                     (file-exists-p (file-name-parent-directory eln-dir))))))))
+  ;; Give Emacs some time to generate JIT native-comp results.
+  ;; It is possible that this test passes even if there is JIT native-comp
+  ;; because we use a hardcoded time span as the synchronization point.
+  ;; Ideally, we should use a more robust synchronization point.
+  (sleep-for 2.5)
+  (defvar native-comp-eln-load-path)
+  (defvar comp-async-buffer-name)
+  (list (not (cl-loop for buffer being each buffer
+                      thereis (string= (buffer-name buffer) comp-async-buffer-name)))
+        (let ((eln-dir (car native-comp-eln-load-path)))
+          (or (directory-empty-p eln-dir)
+              (and (not (file-exists-p eln-dir))
+                   (file-exists-p (file-name-parent-directory eln-dir)))))))
 
 (define-with-packages-non-batch-ert-tests
   with-packages-early-default-is-loaded
   with-packages-default-is-loaded
   with-packages-early-default-is-loaded-before-default
-  with-packages-unwrapped-site-start-is-loaded-quietly
-  with-packages-no-jit-native-comp)
+  with-packages-unwrapped-site-start-is-loaded-quietly)
+
+(define-with-packages-non-batch-ert-test
+    with-packages-no-jit-native-comp
+  (skip-unless (native-comp-available-p)))
 
 (provide 'with-packages)
 
 ;;; with-packages.el ends here
+
+;; Local Variables:
+;; checkdoc-force-docstrings-flag: nil
+;; End:
diff --git a/pkgs/applications/editors/emacs/build-support/tests/with-packages.nix b/pkgs/applications/editors/emacs/build-support/tests/with-packages.nix
new file mode 100644
index 000000000000..5125cce2e5b8
--- /dev/null
+++ b/pkgs/applications/editors/emacs/build-support/tests/with-packages.nix
@@ -0,0 +1,73 @@
+{
+  runCommand,
+  emacs,
+  hello,
+  replaceVarsWith,
+  lib,
+  writeShellApplication,
+}:
+
+let
+  mkEpkg = import ./mk-epkg.nix { inherit lib; };
+
+  run-test = writeShellApplication {
+    name = "run-test";
+    runtimeInputs = [
+      (emacs.pkgs.withPackages (epkgs: [
+        epkgs.dash
+        epkgs.flx-ido
+        (epkgs.callPackage (mkEpkg {
+          pname = "with-packages";
+          src = replaceVarsWith {
+            src = ./with-packages.el;
+            replacements = { inherit (builtins) storeDir; };
+
+            # generate a file in a store path dir
+            #   /nix/store/hash-with-packages.el/with-packages.el
+            # instead of a store path file, which checkdoc doesn't like
+            #   /nix/store/hash-with-packages.el
+            dir = "/";
+          };
+        }) { })
+        (epkgs.callPackage (mkEpkg {
+          pname = "early-default";
+          doLint = false; # no need to lint this simple file
+        }) { })
+        (epkgs.callPackage (mkEpkg {
+          pname = "default";
+          doLint = false; # no need to lint this simple file
+        }) { })
+        hello
+        (epkgs.treesit-grammars.with-grammars (ps: [ ps.tree-sitter-nix ]))
+      ]))
+    ];
+    runtimeEnv = {
+      # emulate a default NixOS env where INFOPATH is set like this (not ending with a ":")
+      INFOPATH = "/fake-info-dir1:/fake-info-dir2";
+      EMACS_TEST_VERBOSE = 1; # make ERT output verbose
+    };
+    text = ''
+      # Give Emacs a HOME to emulate a real user environment.
+      HOME="$PWD"
+
+      nonBatchEmacsSocket="$PWD/non-batch-emacs-socket"
+      emacs --daemon="$nonBatchEmacsSocket"
+
+      emacs --batch --load=with-packages \
+        --eval="(setq with-packages-non-batch-emacs-socket \"$nonBatchEmacsSocket\")" \
+        --eval='(setq with-packages-unwrapped-emacs-program "${lib.getExe emacs}")' \
+        --funcall=ert-run-tests-batch-and-exit
+    '';
+  };
+in
+runCommand "test-emacs-withPackages-wrapper"
+  {
+    nativeBuildInputs = [
+      run-test
+    ];
+  }
+  ''
+    run-test
+
+    touch $out
+  ''
diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix b/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
deleted file mode 100644
index 09ba02c3aefb..000000000000
--- a/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
+++ /dev/null
@@ -1,51 +0,0 @@
-{
-  runCommand,
-  emacs,
-  writeText,
-  cowsay,
-  replaceVars,
-}:
-
-let
-  mkEpkg =
-    pname: src: melpaBuild:
-    melpaBuild {
-      inherit pname src;
-      version = "0.1.0"; # a dummy value
-      turnCompilationWarningToError = true;
-    };
-in
-runCommand "test-emacs-withPackages-wrapper"
-  {
-    nativeBuildInputs = [
-      (emacs.pkgs.withPackages (epkgs: [
-        epkgs.dash
-        epkgs.flx-ido
-        (mkEpkg "with-packages" (replaceVars ./with-packages.el {
-          inherit (builtins) storeDir;
-        }) epkgs.melpaBuild)
-        (mkEpkg "early-default" ./early-default.el epkgs.melpaBuild)
-        (mkEpkg "default" ./default.el epkgs.melpaBuild)
-        cowsay
-        (epkgs.treesit-grammars.with-grammars (ps: [ ps.tree-sitter-nix ]))
-      ]))
-    ];
-    env = {
-      # emulate a default NixOS env where INFOPATH is set like this (not ending with a ":")
-      INFOPATH = "/fake-info-dir1:/fake-info-dir2";
-      EMACS_TEST_VERBOSE = 1; # make ERT output verbose
-    };
-  }
-  ''
-    # Give Emacs a HOME to emulate a real user environment.
-    HOME="$PWD"
-
-    nonBatchEmacsSocket="$PWD/non-batch-emacs-socket"
-    emacs --daemon="$nonBatchEmacsSocket"
-
-    emacs --batch --load=with-packages \
-      --eval="(setq with-packages-non-batch-emacs-socket \"$nonBatchEmacsSocket\")" \
-      --funcall=ert-run-tests-batch-and-exit
-
-    touch $out
-  ''
diff --git a/pkgs/applications/editors/emacs/build-support/wrapper.nix b/pkgs/applications/editors/emacs/build-support/wrapper.nix
index 310d41d7a031..2a27d2a3dbbb 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper.nix
+++ b/pkgs/applications/editors/emacs/build-support/wrapper.nix
@@ -175,6 +175,37 @@ runCommand (lib.appendToName "with-packages" emacs).name
           ${lib.optionalString withTreeSitter ''
             (add-to-list 'treesit-extra-load-path "$out/lib/")
           ''}
+
+          ;; Remove wrapper-added dir from EMACSLOADPATH so it's not propagated
+          ;; to any other Emacsen that might be started as subprocesses.
+          ;; Also do it for EMACSNATIVELOADPATH, which probably unnecessary.
+          (let ((restore-load-path
+                 (lambda (load-path-env-var wrapper-dir-env-var)
+                   (when-let* ((wrapper-dir (getenv wrapper-dir-env-var)))
+                     (setenv wrapper-dir-env-var nil)
+                     (when-let* ((env-load-path (getenv load-path-env-var)))
+                       (let* ((env-load-path-list (split-string env-load-path
+                                                                path-separator))
+                              (restored-env-load-path-list (remove wrapper-dir
+                                                                   env-load-path-list)))
+                         (setenv load-path-env-var
+                                 (when restored-env-load-path-list
+                                   (string-join restored-env-load-path-list
+                                                path-separator)))))))))
+            (funcall restore-load-path
+                     "EMACSLOADPATH" "emacsWithPackages_siteLisp")
+            (funcall restore-load-path
+                     "EMACSNATIVELOADPATH" "emacsWithPackages_siteLispNative"))
+
+          (let ((set-from-env (lambda (symbol env-var &optional modify)
+                                (when-let* ((value (getenv env-var)))
+                                  (set symbol (funcall (or modify #'identity) value))
+                                  (setenv env-var nil)))))
+            (funcall set-from-env
+                     'invocation-directory "emacsWithPackages_invocationDirectory"
+                     #'file-name-as-directory)
+            (funcall set-from-env
+                     'invocation-name "emacsWithPackages_invocationName"))
           EOF
 
           # Generate a subdirs.el that statically adds all subdirectories to load-path.
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix
index b0ec9c32f574..c2bc461573d1 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix
@@ -58,13 +58,13 @@ in
 melpaBuild (finalAttrs: {
   pname = "ghostel";
 
-  version = "0.56.0";
+  version = "0.57.0";
 
   src = fetchFromGitHub {
     owner = "dakra";
     repo = "ghostel";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NpfnlggAcThNw9uY7Uq4qFPEJ+md8aZ8i32CQSUKz+w=";
+    hash = "sha256-vPegePT5n11cI+eq9VWl0u068b2o50A4Wo8qcdYwJ34=";
   };
 
   # these can be put into mkModule, but we put them here to ease user overrideAttrs
diff --git a/pkgs/applications/editors/emacs/make-emacs.nix b/pkgs/applications/editors/emacs/make-emacs.nix
index 0f7e1f71879c..435e2750b213 100644
--- a/pkgs/applications/editors/emacs/make-emacs.nix
+++ b/pkgs/applications/editors/emacs/make-emacs.nix
@@ -485,7 +485,15 @@ stdenv.mkDerivation (finalAttrs: {
     pkgs = lib.recurseIntoAttrs (emacsPackagesFor finalAttrs.finalPackage);
     tests = {
       inherit (nixosTests) emacs-daemon;
-      withPackages = callPackage ./build-support/wrapper-test {
+      nixos = nixosTests.emacs.extendNixOS {
+        module = {
+          tests.emacs.package = finalAttrs.finalPackage;
+        };
+      };
+      withPackages = callPackage ./build-support/tests/with-packages.nix {
+        emacs = finalAttrs.finalPackage;
+      };
+      unwrapped = callPackage ./build-support/tests/unwrapped.nix {
         emacs = finalAttrs.finalPackage;
       };
     };
diff --git a/pkgs/applications/editors/emacs/site-start.el b/pkgs/applications/editors/emacs/site-start.el
index 06e13c756759..dea915528e6b 100644
--- a/pkgs/applications/editors/emacs/site-start.el
+++ b/pkgs/applications/editors/emacs/site-start.el
@@ -16,38 +16,10 @@ least specific (the system profile)"
     (when (file-exists-p default-directory)
       (setq load-path (cons default-directory load-path))
       (normal-top-level-add-subdirs-to-load-path))))
-
-;;; Remove wrapper site-lisp from EMACSLOADPATH so it's not propagated
-;;; to any other Emacsen that might be started as subprocesses.
-(let ((wrapper-site-lisp (getenv "emacsWithPackages_siteLisp"))
-      (env-load-path (getenv "EMACSLOADPATH")))
-  (when wrapper-site-lisp
-    (setenv "emacsWithPackages_siteLisp" nil))
-  (when (and wrapper-site-lisp env-load-path)
-    (let* ((env-list (split-string env-load-path ":"))
-           (new-env-list (delete wrapper-site-lisp env-list)))
-      (setenv "EMACSLOADPATH" (when new-env-list
-                                (mapconcat 'identity new-env-list ":"))))))
-
-(let ((wrapper-site-lisp (getenv "emacsWithPackages_siteLispNative"))
-      (env-load-path (getenv "EMACSNATIVELOADPATH")))
-  (when wrapper-site-lisp
-    (setenv "emacsWithPackages_siteLispNative" nil))
-  (when (and wrapper-site-lisp env-load-path)
-    (let* ((env-list (split-string env-load-path ":"))
-           (new-env-list (delete wrapper-site-lisp env-list)))
-      (setenv "EMACSNATIVELOADPATH" (when new-env-list
-                                (mapconcat 'identity new-env-list ":"))))))
-
-(let ((wrapper-invocation-directory (getenv "emacsWithPackages_invocationDirectory")))
-  (when wrapper-invocation-directory
-    (setq invocation-directory (file-name-as-directory wrapper-invocation-directory))
-    (setenv "emacsWithPackages_invocationDirectory" nil)))
-
-(let ((wrapper-invocation-name (getenv "emacsWithPackages_invocationName")))
-  (when wrapper-invocation-name
-    (setq invocation-name wrapper-invocation-name)
-    (setenv "emacsWithPackages_invocationName" nil)))
+;; The default/standard value of `package-directory-list' depends on `load-path'.
+;; So we re-compute `package-directory-list' after modifying `load-path'.
+;; See Emacs bug https://debbugs.gnu.org/cgi/bugreport.cgi?bug=81982.
+(custom-reevaluate-setting 'package-directory-list)
 
 ;;; Set up native-comp load path.
 (when (featurep 'native-compile)
@@ -86,9 +58,7 @@ least specific (the system profile)"
   ;; TODO: We should also add the other `NIX_PROFILES' to this path.
   ;; However, these are user-specific, so we would need to discover
   ;; them dynamically after connecting via `tramp'
-  '(progn
-     (add-to-list 'tramp-remote-path "/run/current-system/sw/bin")
-     (add-to-list 'tramp-remote-path "/run/wrappers/bin")))
+  '(add-to-list 'tramp-remote-path "/run/wrappers/bin"))
 
 ;;; C source directory
 ;;;
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 0254b17d5cd6..262bc4359909 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -122,20 +122,6 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
-  filemarks-nvim = buildVimPlugin {
-    pname = "filemarks.nvim";
-    version = "1.6.0";
-    src = fetchFromGitHub {
-      owner = "anoopkcn";
-      repo = "filemarks.nvim";
-      tag = "1.6.0";
-      hash = "sha256-qSHHsBb7MAceNV3QnZiTFN4d1i2zH8CItlzQWsYNjno=";
-    };
-    meta.homepage = "https://github.com/anoopkcn/filemarks.nvim/";
-    meta.license = getLicenseFromSpdxId "MIT";
-    meta.hydraPlatforms = [ ];
-  };
-
   FTerm-nvim = buildVimPlugin {
     pname = "FTerm.nvim";
     version = "0-unstable-2022-11-13";
@@ -6063,6 +6049,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  filemarks-nvim = buildVimPlugin {
+    pname = "filemarks.nvim";
+    version = "1.6.0";
+    src = fetchFromGitHub {
+      owner = "anoopkcn";
+      repo = "filemarks.nvim";
+      tag = "1.6.0";
+      hash = "sha256-qSHHsBb7MAceNV3QnZiTFN4d1i2zH8CItlzQWsYNjno=";
+    };
+    meta.homepage = "https://github.com/anoopkcn/filemarks.nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   filemention-nvim = buildVimPlugin {
     pname = "filemention.nvim";
     version = "0-unstable-2026-05-30";
@@ -18446,12 +18446,12 @@ final: prev: {
 
   toggable-term-nvim = buildVimPlugin {
     pname = "toggable-term-nvim";
-    version = "0-unstable-2026-10-05";
+    version = "0-unstable-2026-10-11";
     src = fetchFromGitHub {
       owner = "sergioia-dev";
       repo = "toggable-term-nvim";
-      rev = "713633355ced060f5337e6ce5271db67367bbf16";
-      hash = "sha256-Bs3elJzzzi1WiqwP0TnXEkUdwjizO2OckaNBTX6iGRM=";
+      rev = "f16258898a1fe879ad69402edeb9915518cd691b";
+      hash = "sha256-Maco2xfRvwxCXHAZQ3bMdCbqhhOBHd+92tegEvgdrg0=";
     };
     meta.homepage = "https://github.com/sergioia-dev/toggable-term-nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -20603,6 +20603,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  vim-dadbod-manager-ui = buildVimPlugin {
+    pname = "vim-dadbod-manager-ui";
+    version = "0-unstable-2026-10-11";
+    src = fetchFromGitHub {
+      owner = "sergioia-dev";
+      repo = "vim-dadbod-manager-ui";
+      rev = "3aba12f946f72e3d0797a26786851c9759260657";
+      hash = "sha256-pqLM7r4q7QYrc+OkOAH2gGPN3AJheabscYsbddqSe5g=";
+    };
+    meta.homepage = "https://github.com/sergioia-dev/vim-dadbod-manager-ui/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   vim-dadbod-ui = buildVimPlugin {
     pname = "vim-dadbod-ui";
     version = "0-unstable-2026-06-19";
@@ -24831,20 +24845,6 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
-  vim-textobj-xmlattr = buildVimPlugin {
-    pname = "vim-textobj-xmlattr";
-    version = "0.1.1";
-    src = fetchFromGitHub {
-      owner = "whatyouhide";
-      repo = "vim-textobj-xmlattr";
-      tag = "0.1.1";
-      hash = "sha256-EFn7Ql7SFWwcjR5WdQkl2/lJZY9qZN9ml6625lGtTzY=";
-    };
-    meta.homepage = "https://github.com/whatyouhide/vim-textobj-xmlattr/";
-    meta.license = getLicenseFromSpdxId "WTFPL";
-    meta.hydraPlatforms = [ ];
-  };
-
   vim-textobj-variable-segment = buildVimPlugin {
     pname = "vim-textobj-variable-segment";
     version = "0-unstable-2024-09-06";
@@ -24859,6 +24859,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  vim-textobj-xmlattr = buildVimPlugin {
+    pname = "vim-textobj-xmlattr";
+    version = "0.1.1";
+    src = fetchFromGitHub {
+      owner = "whatyouhide";
+      repo = "vim-textobj-xmlattr";
+      tag = "0.1.1";
+      hash = "sha256-EFn7Ql7SFWwcjR5WdQkl2/lJZY9qZN9ml6625lGtTzY=";
+    };
+    meta.homepage = "https://github.com/whatyouhide/vim-textobj-xmlattr/";
+    meta.license = getLicenseFromSpdxId "WTFPL";
+    meta.hydraPlatforms = [ ];
+  };
+
   vim-themis = buildVimPlugin {
     pname = "vim-themis";
     version = "1.7.0-unstable-2025-08-29";
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 2d7db76b1f32..6b813a6772d1 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -5118,6 +5118,16 @@ assertNoAdditions {
     };
   });
 
+  vim-dadbod-manager-ui = super.vim-dadbod-manager-ui.overrideAttrs {
+    # Only vim-dadbod: the drawer this plugin extends is vendored, and upstream
+    # states that a separate vim-dadbod-ui "must not be installed next to it",
+    # so it is deliberately not listed here.
+    dependencies = [ self.vim-dadbod ];
+
+    doInstallCheck = true;
+    vimCommandCheck = "DBManager";
+  };
+
   vim-dadbod-ui = super.vim-dadbod-ui.overrideAttrs {
     dependencies = [ self.vim-dadbod ];
 
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 07a699ba53d5..7ade42295186 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -7,7 +7,6 @@ https://github.com/vim-scripts/Colour-Sampler-Pack/,,
 https://github.com/CopilotC-Nvim/CopilotChat.nvim/,,
 https://github.com/whonore/Coqtail/,,
 https://github.com/vim-scripts/DoxygenToolkit.vim/,,
-https://github.com/anoopkcn/filemarks.nvim/,,
 https://github.com/numToStr/FTerm.nvim/,,
 https://github.com/antoinemadec/FixCursorHold.nvim/,,
 https://github.com/Aaronik/GPTModels.nvim/,,
@@ -431,6 +430,7 @@ https://github.com/micampe/fennel.vim/,,
 https://github.com/wincent/ferret/,,
 https://github.com/bogado/file-line/,,
 https://github.com/lewis6991/fileline.nvim/,,
+https://github.com/anoopkcn/filemarks.nvim/,,
 https://github.com/not-manu/filemention.nvim/,,
 https://github.com/VonHeikemen/fine-cmdline.nvim/,,
 https://github.com/glacambre/firenvim/,,
@@ -1469,6 +1469,7 @@ https://github.com/itchyny/vim-cursorword/,,
 https://github.com/ehamberg/vim-cute-python/,,
 https://github.com/tpope/vim-dadbod/,,
 https://github.com/kristijanhusak/vim-dadbod-completion/,,
+https://github.com/sergioia-dev/vim-dadbod-manager-ui/,,
 https://github.com/kristijanhusak/vim-dadbod-ui/,,
 https://github.com/sunaku/vim-dasht/,,
 https://github.com/ajmwagar/vim-deus/,,
@@ -1771,8 +1772,8 @@ https://github.com/kana/vim-textobj-line/,,
 https://github.com/osyo-manga/vim-textobj-multiblock/,,
 https://github.com/preservim/vim-textobj-quote/,,
 https://github.com/kana/vim-textobj-user/,,
-https://github.com/whatyouhide/vim-textobj-xmlattr/,,
 https://github.com/Julian/vim-textobj-variable-segment/,,
+https://github.com/whatyouhide/vim-textobj-xmlattr/,,
 https://github.com/thinca/vim-themis/,,
 https://github.com/tmux-plugins/vim-tmux/,,
 https://github.com/roxma/vim-tmux-clipboard/,,
diff --git a/pkgs/applications/emulators/wine/sources.nix b/pkgs/applications/emulators/wine/sources.nix
index 7d5f252b7515..910e6678d680 100644
--- a/pkgs/applications/emulators/wine/sources.nix
+++ b/pkgs/applications/emulators/wine/sources.nix
@@ -151,9 +151,9 @@ rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the hash for staging as well.
-    version = "11.18";
+    version = "11.19";
     url = "https://dl.winehq.org/wine/source/11.x/wine-${version}.tar.xz";
-    hash = "sha256-xigvbU2uzxHzq5+aK2xZj2e+fijDY7osroo8RLYR56Q=";
+    hash = "sha256-SCAGbtpo5VPTMCOf/GKBZKNI0cYj5J0FjgEcWnzalfE=";
 
     patches = [
       # Also look for root certificates at $NIX_SSL_CERT_FILE
@@ -163,7 +163,7 @@ rec {
     # see https://gitlab.winehq.org/wine/wine-staging
     staging = fetchFromGitLab {
       inherit version;
-      hash = "sha256-KZCkra0y3XFNrbD2lZ+YUCLyq1POC30Sd4sGCJZuwgQ=";
+      hash = "sha256-Dnb/CjzxWDdMDXfJB/hiWHhQLjU49F6OyM6qqC0g/v0=";
       domain = "gitlab.winehq.org";
       owner = "wine";
       repo = "wine-staging";
diff --git a/pkgs/applications/emulators/wine/winetricks.nix b/pkgs/applications/emulators/wine/winetricks.nix
index 346b14c453f3..621f9c858c5e 100644
--- a/pkgs/applications/emulators/wine/winetricks.nix
+++ b/pkgs/applications/emulators/wine/winetricks.nix
@@ -82,6 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "winetricks";
     license = lib.licenses.lgpl21;
     homepage = "https://github.com/Winetricks/winetricks";
+    maintainers = with lib.maintainers; [ ferris-qq ];
     platforms = with lib.platforms; linux ++ darwin;
   };
 })
diff --git a/pkgs/applications/graphics/gimp/plugins/default.nix b/pkgs/applications/graphics/gimp/plugins/default.nix
index 23e9d79732f2..6bf0409a0a89 100644
--- a/pkgs/applications/graphics/gimp/plugins/default.nix
+++ b/pkgs/applications/graphics/gimp/plugins/default.nix
@@ -208,7 +208,7 @@ lib.makeScope pkgs.newScope (
       meta = {
         broken = gimp.apiVersion != "2.0";
         description = "GIMP plug-in to do the fourier transform";
-        homepage = "https://people.via.ecp.fr/~remi/soft/gimp/gimp_plugin_en.php3#fourier";
+        homepage = "https://www.lprp.fr/gimp_plugin_en/";
         license = lib.licenses.gpl3Plus;
       };
     };
@@ -359,7 +359,7 @@ lib.makeScope pkgs.newScope (
         broken = gimp.apiVersion != "2.0";
         description = "GIMP plugin to correct lens distortion using the lensfun library and database";
 
-        homepage = "http://lensfun.sebastiankraft.net/";
+        homepage = "https://seebk.github.io/GIMP-Lensfun/";
 
         license = lib.licenses.gpl3Plus;
         maintainers = [ ];
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index bdf3d4544709..d6c146a8ea43 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -45,11 +45,11 @@
     "vendorHash": "sha256-HlX2EfTgDa7K7qkzmR/9Rsamyi/f4EXT3T7eaReGeK4="
   },
   "aliyun_alicloud": {
-    "hash": "sha256-u4u8p3+Gxwa+gCDgcqZqi1RXYG9c+O27uZoOlc+RoKc=",
+    "hash": "sha256-D2/3OuB+7MeMZhydRAYKS1trQjRyKkr1+ulDDfntWBo=",
     "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
     "owner": "aliyun",
     "repo": "terraform-provider-alicloud",
-    "rev": "v1.293.0",
+    "rev": "v1.294.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-GIKSIlWD+TTm0EsUu9ga3emENwGLXMDYqp//BmjNwDA="
   },
@@ -454,13 +454,13 @@
     "vendorHash": "sha256-FcxAh8EOvnT8r1GHu0Oj2C5Jgbr2WPwD7/vY4/qIvTA="
   },
   "gitlabhq_gitlab": {
-    "hash": "sha256-t37l0B8fHIQNPJKV2ryKOy/2y7SogMdl36XdR3Emcj0=",
+    "hash": "sha256-ceM9uXqefS7kvGWmWWR3KjnuGoWEihliwkkfOTCZQWI=",
     "homepage": "https://registry.terraform.io/providers/gitlabhq/gitlab",
     "owner": "gitlabhq",
     "repo": "terraform-provider-gitlab",
-    "rev": "v19.3.0",
+    "rev": "v19.4.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-w72kbVx+4J0BmOT0k3ZY892Tp7dvSA0QKH9u0I1D/tE="
+    "vendorHash": "sha256-14LfF5ryqFVLici3iOrbJfqRYMBnDM2D+jky+NUAL1w="
   },
   "go-gandi_gandi": {
     "hash": "sha256-fsCtmwyxkXfOtiZG27VEb010jglK35yr4EynnUWlFog=",
@@ -914,11 +914,11 @@
     "vendorHash": "sha256-8Zj4nrEJ38Tz0LOYtghlMnJZJnD2zJjsqawVMTEX0Wk="
   },
   "metio_migadu": {
-    "hash": "sha256-3RCE2KCWgS8j30Ggh0HfX0D9ZPpgiTtgIk7+YmzYSfc=",
+    "hash": "sha256-hcHx/pFGBzXfa0EoIUW5L8ZLrT+pUpHfx4r7NxEk5uw=",
     "homepage": "https://registry.terraform.io/providers/metio/migadu",
     "owner": "metio",
     "repo": "terraform-provider-migadu",
-    "rev": "2026.9.24",
+    "rev": "2026.10.1",
     "spdx": "0BSD",
     "vendorHash": "sha256-b2YIkwpeYCGsENzXSAPD7nhvmZ1Phxfcm3S5xsiC2t0="
   },
@@ -1148,11 +1148,11 @@
     "vendorHash": "sha256-6M6jTrukO0VhyZRdYbbICm22upbGyOkUSuHqMLTPcEM="
   },
   "rootlyhq_rootly": {
-    "hash": "sha256-sWCG6mD7fYi2Yon5Wu/54+m+T8KcUYd38yDt8M3LS+E=",
+    "hash": "sha256-lkMgGYayDMrhqmbwLysqoQ8L7mUvXoT4xDZ9ltxnSy8=",
     "homepage": "https://registry.terraform.io/providers/rootlyhq/rootly",
     "owner": "rootlyhq",
     "repo": "terraform-provider-rootly",
-    "rev": "v5.23.0",
+    "rev": "v5.23.3",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-Lusa+8VL8wQGIHYMiuiNTy4tqza4zO1A4ROpZ7X42KM="
   },
@@ -1247,13 +1247,13 @@
     "vendorHash": "sha256-skswuFKhN4FFpIunbom9rM/FVRJVOFb1WwHeAIaEjn8="
   },
   "spacelift-io_spacelift": {
-    "hash": "sha256-Kn43SQM/uxNd32g+nm40fmLStPXyHhuGUX48g16AvKw=",
+    "hash": "sha256-MTxohgv1eMkzixc66sICFa6CC+uBRGjYQ64lBwlxiRE=",
     "homepage": "https://registry.terraform.io/providers/spacelift-io/spacelift",
     "owner": "spacelift-io",
     "repo": "terraform-provider-spacelift",
-    "rev": "v1.55.0",
+    "rev": "v1.57.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-XpXZqb6j6WdTFowdwNf3e8i9lg69tavzb2H65LyQJvE="
+    "vendorHash": "sha256-raw9hcAvzBKy8bLbUNM36JZTYYE//r7b3HdZ3qFLtPY="
   },
   "splunk-terraform_signalfx": {
     "hash": "sha256-TjJQdzxB7X7RbiBJnaCvAGJTtDwfeOxc7lApl7jjrA8=",
@@ -1355,11 +1355,11 @@
     "vendorHash": "sha256-SF11E60OQiRdf+Pf6XyJg60yGRnGOcSzhrYccrWaeYE="
   },
   "terraform-lxd_lxd": {
-    "hash": "sha256-U/x3CkUynyMvB9FWzlYgXIfC6/RWeNRV++4ceGW3Rnc=",
+    "hash": "sha256-9+3sVezHfhlbfytxt6h871ybdIaXDko16WLQNNzrNNQ=",
     "homepage": "https://registry.terraform.io/providers/terraform-lxd/lxd",
     "owner": "terraform-lxd",
     "repo": "terraform-provider-lxd",
-    "rev": "v3.1.0",
+    "rev": "v3.1.1",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-OHCnxqn09NyqsdTCRUJseNAL1DMpvl6Icu3YEzjLgPM="
   },
diff --git a/pkgs/applications/networking/irc/weechat/scripts/default.nix b/pkgs/applications/networking/irc/weechat/scripts/default.nix
index 6898a56a6357..251c662ad51f 100644
--- a/pkgs/applications/networking/irc/weechat/scripts/default.nix
+++ b/pkgs/applications/networking/irc/weechat/scripts/default.nix
@@ -1,6 +1,5 @@
 {
   callPackage,
-  lua52Packages,
   perlPackages,
   python3Packages,
 }:
@@ -20,10 +19,6 @@
 
   weechat-grep = callPackage ./weechat-grep { };
 
-  weechat-matrix-bridge = callPackage ./weechat-matrix-bridge {
-    inherit (lua52Packages) cjson luaffi;
-  };
-
   weechat-matrix = python3Packages.callPackage ./weechat-matrix { };
 
   weechat-notify-send = python3Packages.callPackage ./weechat-notify-send { };
diff --git a/pkgs/applications/networking/irc/weechat/scripts/weechat-matrix-bridge/default.nix b/pkgs/applications/networking/irc/weechat/scripts/weechat-matrix-bridge/default.nix
deleted file mode 100644
index 29c761b6fbed..000000000000
--- a/pkgs/applications/networking/irc/weechat/scripts/weechat-matrix-bridge/default.nix
+++ /dev/null
@@ -1,64 +0,0 @@
-{
-  lib,
-  stdenv,
-  curl,
-  fetchFromGitHub,
-  cjson,
-  olm,
-  luaffi,
-}:
-
-stdenv.mkDerivation {
-  pname = "weechat-matrix-bridge";
-  version = "unstable-2018-11-19";
-  src = fetchFromGitHub {
-    owner = "torhve";
-    repo = "weechat-matrix-protocol-script";
-    rev = "8d32e90d864a8f3f09ecc2857cd5dd6e39a8c3f7";
-    sha256 = "0qqd6qmkrdc0r3rnl53c3yp93fbcz7d3mdw3vq5gmdqxyym4s9lj";
-  };
-
-  patches = [
-    ./library-path.patch
-  ];
-
-  buildInputs = [
-    curl
-    cjson
-    olm
-    luaffi
-  ];
-
-  postPatch = ''
-    substituteInPlace matrix.lua \
-      --replace "/usr/bin/curl" "${curl}/bin/curl" \
-      --replace "__NIX_LIB_PATH__" "$out/lib/?.so" \
-      --replace "__NIX_OLM_PATH__" "$out/share/?.lua"
-
-    substituteInPlace olm.lua \
-      --replace "__NIX_LIB_PATH__" "$out/lib/?.so"
-  '';
-
-  passthru.scripts = [ "matrix.lua" ];
-
-  installPhase = ''
-    mkdir -p $out/{share,lib}
-
-    cp {matrix.lua,olm.lua} $out/share
-    cp ${cjson}/lib/lua/${cjson.lua.luaversion}/cjson.so $out/lib/cjson.so
-    cp ${olm}/lib/libolm.so $out/lib/libolm.so
-    cp ${luaffi}/lib/lua/${luaffi.lua.luaversion}/ffi.so $out/lib/ffi.so
-  '';
-
-  meta = {
-    description = "WeeChat script in Lua that implements the matrix.org chat protocol";
-    homepage = "https://github.com/torhve/weechat-matrix-protocol-script";
-    maintainers = [ ];
-    license = lib.licenses.mit; # see https://github.com/torhve/weechat-matrix-protocol-script/blob/0052e7275ae149dc5241226391c9b1889ecc3c6b/matrix.lua#L53
-    platforms = lib.platforms.unix;
-
-    # As of 2019-06-30, all of the dependencies are available on macOS but the
-    # package itself does not build.
-    broken = stdenv.hostPlatform.isDarwin;
-  };
-}
diff --git a/pkgs/applications/networking/irc/weechat/scripts/weechat-matrix-bridge/library-path.patch b/pkgs/applications/networking/irc/weechat/scripts/weechat-matrix-bridge/library-path.patch
deleted file mode 100644
index d9945c2993b7..000000000000
--- a/pkgs/applications/networking/irc/weechat/scripts/weechat-matrix-bridge/library-path.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-diff --git a/matrix.lua b/matrix.lua
-index b79f500..32b37a2 100644
---- a/matrix.lua
-+++ b/matrix.lua
-@@ -43,6 +43,9 @@ This script maps this as follows:
- 
- ]]
- 
-+package.cpath = package.cpath .. ";__NIX_LIB_PATH__"
-+package.path = package.path .. ";__NIX_OLM_PATH__"
-+
- local json = require 'cjson' -- apt-get install lua-cjson
- local olmstatus, olm = pcall(require, 'olm') -- LuaJIT olm FFI binding ln -s ~/olm/olm.lua /usr/local/share/lua/5.1
- local w = weechat
-diff --git a/olm.lua b/olm.lua
-index 114649c..4828371 100644
---- a/olm.lua
-+++ b/olm.lua
-@@ -17,6 +17,9 @@
-  * limitations under the License.
-  */
- --]]
-+
-+package.cpath = package.cpath .. ";__NIX_LIB_PATH__"
-+
- local ffi = require'ffi'
- 
- ffi.cdef[[
diff --git a/pkgs/applications/office/libreoffice/wrapper.nix b/pkgs/applications/office/libreoffice/wrapper.nix
index ad9f219dc14b..d03994364fb3 100644
--- a/pkgs/applications/office/libreoffice/wrapper.nix
+++ b/pkgs/applications/office/libreoffice/wrapper.nix
@@ -100,7 +100,12 @@ let
       (lib.escapeShellArg ''
         if ! ( test -n "$DBUS_SESSION_BUS_ADDRESS" ); then
             dbus_tmp_dir="/run/user/$(id -u)/libreoffice-dbus"
-            if ! test -d "$dbus_tmp_dir" && test -d "/run"; then
+            # Sometimes /run exists but is not writeable, (like when running in
+            # a linux builder on darwin) giving
+            # `mkdir: cannot create directory '/run/user': Permission denied`
+            # instead of going to the next fallback.  Ensure we test with `-w`
+            # and not `-d`.
+            if ! test -d "$dbus_tmp_dir" && test -w "/run"; then
                     mkdir -p "$dbus_tmp_dir"
             fi
             if ! test -d "$dbus_tmp_dir"; then
diff --git a/pkgs/by-name/_1/_1oom/package.nix b/pkgs/by-name/_1/_1oom/package.nix
index 96e1c4c3d1c8..81c65dfb5d0c 100644
--- a/pkgs/by-name/_1/_1oom/package.nix
+++ b/pkgs/by-name/_1/_1oom/package.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
   passthru.updateScript = gitUpdater { rev-prefix = "v"; };
 
   meta = {
-    homepage = "https://fork1oom.sourcecraft.site/";
+    homepage = "https://sourcecraft.dev/fork1oom/1oom";
     changelog = "https://sourcecraft.dev/fork1oom/1oom/releases/v${finalAttrs.version}";
     description = "Master of Orion (1993) game engine recreation; a more updated fork";
     license = lib.licenses.gpl2Only;
diff --git a/pkgs/by-name/_3/_3proxy/package.nix b/pkgs/by-name/_3/_3proxy/package.nix
index daf6746a2fc2..85a86b6a10e5 100644
--- a/pkgs/by-name/_3/_3proxy/package.nix
+++ b/pkgs/by-name/_3/_3proxy/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "3proxy";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "3proxy";
     repo = "3proxy";
     tag = finalAttrs.version;
-    sha256 = "sha256-JRoSCmoTIXHsUWZt9OyDVp1Veuy2w1ZPFe0rUGdJv0k=";
+    sha256 = "sha256-hLxafFU6nJ3I3NT3R24LPD7PBmQ1IZEbrVqvfmMZHIM=";
   };
 
   # They use 'install -s', that calls the native strip instead of the cross.
diff --git a/pkgs/by-name/ab/abracadabra/package.nix b/pkgs/by-name/ab/abracadabra/package.nix
index 7f24a9e435cd..ce208ece0990 100644
--- a/pkgs/by-name/ab/abracadabra/package.nix
+++ b/pkgs/by-name/ab/abracadabra/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "abracadabra";
-  version = "4.2.1";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner = "KejPi";
     repo = "AbracaDABra";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-35E2a3UXyxcDixN5OAsiqlV0X+wkhS2vI6myHlpA2GA=";
+    hash = "sha256-wc2DuBUnD5AWjDUez2ZlgnJ4Kh2kizoJyW0evV3Iics=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ad/adscan/package.nix b/pkgs/by-name/ad/adscan/package.nix
index bb3e2f517c52..543e8f596f6b 100644
--- a/pkgs/by-name/ad/adscan/package.nix
+++ b/pkgs/by-name/ad/adscan/package.nix
@@ -7,7 +7,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "adscan";
-  version = "13.1.0";
+  version = "13.2.0";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -16,7 +16,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "ADScanPro";
     repo = "adscan";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BmzXsbgS4gE5osU5Vt2GZrSYKOgKRkiPPoK2gurAk0I=";
+    hash = "sha256-5sMoN+aH+u9Fp+AWorhrm4TlKaIWTwjVhuvO33SnMGg=";
   };
 
   pythonRelaxDeps = [ "credsweeper" ];
diff --git a/pkgs/by-name/ai/airtame/package.nix b/pkgs/by-name/ai/airtame/package.nix
index 54ca7d7333a7..20e774b63ceb 100644
--- a/pkgs/by-name/ai/airtame/package.nix
+++ b/pkgs/by-name/ai/airtame/package.nix
@@ -31,7 +31,7 @@
   lib,
   libnotify,
   libappindicator,
-  systemd,
+  systemdLibs,
   pciutils,
 }:
 let
@@ -86,7 +86,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = deps;
   runtimeDependencies = [
-    (lib.getLib systemd)
+    (lib.getLib systemdLibs)
     libnotify
     libappindicator
     pulseaudio
diff --git a/pkgs/by-name/al/alfaview/package.nix b/pkgs/by-name/al/alfaview/package.nix
index ce7c9c69dcae..404fb22e4bc2 100644
--- a/pkgs/by-name/al/alfaview/package.nix
+++ b/pkgs/by-name/al/alfaview/package.nix
@@ -20,7 +20,7 @@
   libxkbcommon,
   libgbm,
   openssl,
-  systemd,
+  systemdLibs,
   libxcb-cursor,
   libxcb-wm,
   libxcb-render-util,
@@ -63,7 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
     libgbm
     openssl
     stdenv.cc.cc
-    systemd
+    systemdLibs
     libxcb-cursor
     libx11
     libxcb-wm
diff --git a/pkgs/by-name/al/alire/package.nix b/pkgs/by-name/al/alire/package.nix
index 19311fab482b..069081082610 100644
--- a/pkgs/by-name/al/alire/package.nix
+++ b/pkgs/by-name/al/alire/package.nix
@@ -1,12 +1,12 @@
 {
   lib,
-  stdenv,
+  stdenvNoCC,
   fetchFromGitHub,
   gprbuild,
   gnat,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "alire";
   version = "2.1.1";
 
diff --git a/pkgs/by-name/al/alistral/package.nix b/pkgs/by-name/al/alistral/package.nix
index 0ac3f3e8e833..b159d738ad8d 100644
--- a/pkgs/by-name/al/alistral/package.nix
+++ b/pkgs/by-name/al/alistral/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "alistral";
-  version = "0.6.9";
+  version = "0.6.10";
 
   src = fetchFromGitHub {
     owner = "RustyNova016";
     repo = "Alistral";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tujuv6+V7n8uthV+3yc2aqZydgMRJDlunWi1ITofl14=";
+    hash = "sha256-G/DC2JtdnElm1iQf2TLWroej8eNsRAb9ZoeDYrEMdJg=";
   };
 
-  cargoHash = "sha256-kzrWhE2S6XXU6wLDfYp76kMRnk3juxXWX4EdL3NjgSo=";
+  cargoHash = "sha256-77NF6t1WMHi7wtbJf1NjyYoj4amXh69/AJvFT/aEsQY=";
 
   buildNoDefaultFeatures = true;
   # Would be cleaner with an "--all-features" option
diff --git a/pkgs/by-name/al/all-the-package-names/package.nix b/pkgs/by-name/al/all-the-package-names/package.nix
index 25db9428b5cd..315ad7931927 100644
--- a/pkgs/by-name/al/all-the-package-names/package.nix
+++ b/pkgs/by-name/al/all-the-package-names/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "all-the-package-names";
-  version = "2.0.2578";
+  version = "2.0.2590";
 
   src = fetchFromGitHub {
     owner = "nice-registry";
     repo = "all-the-package-names";
     tag = "v${version}";
-    hash = "sha256-fFJuN1MPpnpYCotAiQoRU5qEsyC6HjOTrjxfnyWj/+o=";
+    hash = "sha256-j8x2SSo7TaPy37ET1NWYz6GU/zMjjOL9jzFP0mRCwZ8=";
   };
 
-  npmDepsHash = "sha256-8xzyypPgtfxYxPcVIJYLNL0a6EE7L93eISanWqPFGM4=";
+  npmDepsHash = "sha256-sA4kiDo4Q8WPqhxuIYIvU6R9cGYTTzxNMR224U864Gk=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/an/antigravity-hub/package.nix b/pkgs/by-name/an/antigravity-hub/package.nix
index ec8105d975c0..83f6f7d263de 100644
--- a/pkgs/by-name/an/antigravity-hub/package.nix
+++ b/pkgs/by-name/an/antigravity-hub/package.nix
@@ -36,7 +36,7 @@
   nss,
   pango,
   pipewire,
-  systemd,
+  systemdLibs,
   unzip,
   wrapGAppsHook3,
 }:
@@ -113,7 +113,7 @@ stdenv.mkDerivation (finalAttrs: {
     nspr
     nss
     pango
-    systemd
+    systemdLibs
   ];
 
   # Loaded with dlopen() by the main binary, so autoPatchelfHook cannot discover them.
diff --git a/pkgs/by-name/ap/apfel/package.nix b/pkgs/by-name/ap/apfel/package.nix
index 71ff36540574..675b5201380e 100644
--- a/pkgs/by-name/ap/apfel/package.nix
+++ b/pkgs/by-name/ap/apfel/package.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "PDF Evolution Library";
-    homepage = "https://apfel.mi.infn.it/";
+    homepage = "https://github.com/scarrazza/apfel";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ veprbl ];
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/ap/appfire-cli/package.nix b/pkgs/by-name/ap/appfire-cli/package.nix
index 3514e508ffa3..013624d025b0 100644
--- a/pkgs/by-name/ap/appfire-cli/package.nix
+++ b/pkgs/by-name/ap/appfire-cli/package.nix
@@ -76,7 +76,7 @@ stdenv.mkDerivation (finalAttrs: {
       Since the /nix/store is not writable, you can instead place the file
       at {file}`$HOME/acli.properties` to achieve the same effect.
     '';
-    homepage = "https://apps.appf.re/acli";
+    homepage = "https://support.appfire.com/space/ACLI/60555464/Appfire+Command+Line+Interface+(CLI)";
     license = lib.licenses.unfreeRedistributable;
     sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
     maintainers = with lib.maintainers; [ twey ];
diff --git a/pkgs/by-name/ar/arduino-language-server/package.nix b/pkgs/by-name/ar/arduino-language-server/package.nix
index 9ea573df9e17..041b4ff1a4bf 100644
--- a/pkgs/by-name/ar/arduino-language-server/package.nix
+++ b/pkgs/by-name/ar/arduino-language-server/package.nix
@@ -37,7 +37,7 @@ buildGoModule (finalAttrs: {
     mainProgram = "arduino-language-server";
     homepage = "https://github.com/arduino/arduino-language-server";
     changelog = "https://github.com/arduino/arduino-language-server/releases/tag/${finalAttrs.version}";
-    license = lib.licenses.asl20;
+    license = lib.licenses.agpl3Only;
     maintainers = with lib.maintainers; [ BattleCh1cken ];
   };
 })
diff --git a/pkgs/by-name/as/asmc-linux/package.nix b/pkgs/by-name/as/asmc-linux/package.nix
index 05877430e0d3..85576efa2570 100644
--- a/pkgs/by-name/as/asmc-linux/package.nix
+++ b/pkgs/by-name/as/asmc-linux/package.nix
@@ -6,12 +6,12 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "asmc-linux";
-  version = "2.39.07";
+  version = "2.40";
   src = fetchFromGitHub {
     owner = "nidud";
     repo = "asmc_linux";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JtJsyaw4UqMf9epMLGH+iQA0FYYlE9k2NG1aPOu6pec=";
+    hash = "sha256-5fbfLYQEoeAJJqZJ4Rs8WcHm2hD05OZOirNVxY66SdM=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/at/atmos/package.nix b/pkgs/by-name/at/atmos/package.nix
index 3a22a2c933ed..da9b82ec7165 100644
--- a/pkgs/by-name/at/atmos/package.nix
+++ b/pkgs/by-name/at/atmos/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "atmos";
-  version = "1.230.0";
+  version = "1.231.0";
 
   src = fetchFromGitHub {
     owner = "cloudposse";
     repo = "atmos";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2iyRkQQ+NKER60jBiGrcq+QKBO8+pt3nfHm9Tn3e+iU=";
+    hash = "sha256-8jTwgmqoz4/W61JvCnoIq+l0eFTmU+Y5aaYqUivfDXo=";
   };
 
-  vendorHash = "sha256-J5TNPXzEz4gaNi2mEqkQ+t1JzmocbRRLwUwzLgAZU40=";
+  vendorHash = "sha256-Mzi4xP9cDmdnOYaVWfKaWnZ/HM/rCbdgPb+gBBTrASE=";
 
   env.CGO_ENABLED = 0; # Compiles a pure statically linked Go binary.
 
diff --git a/pkgs/by-name/at/atuin/package.nix b/pkgs/by-name/at/atuin/package.nix
index 166007ec881b..cbd861321beb 100644
--- a/pkgs/by-name/at/atuin/package.nix
+++ b/pkgs/by-name/at/atuin/package.nix
@@ -1,7 +1,10 @@
 {
   lib,
+  bashInteractive,
   fetchFromGitHub,
+  gitMinimal,
   installShellFiles,
+  ncurses,
   nix-update-script,
   nixosTests,
   openssl,
@@ -12,16 +15,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "atuin";
-  version = "18.21.0";
+  version = "18.23.0";
 
   src = fetchFromGitHub {
     owner = "atuinsh";
     repo = "atuin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kz8qdgxg79jX3hfPi7EY9c9SmFqUK6lWnMTLb3TKDQQ=";
+    hash = "sha256-NBn7C9ssLSXYrHWv5qWM5dZ2E8URbRJZOOCvHaNgxW4=";
   };
 
-  cargoHash = "sha256-chuGpLq8XAZrCCtx2L/tVQSXNLrTgG2rnBGcCEvDjFg=";
+  cargoHash = "sha256-rkDDs8gviBpoLR4mrrKRu2eTlmlpvjICVRFu22AeOaU=";
 
   # atuin's default features include 'check-updates', which do not make sense
   # for distribution builds. List all other default features.
@@ -45,6 +48,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
     openssl
   ];
 
+  # e2e_pty tests drive an interactive bash (needs readline), run `clear`,
+  # and create git repositories for workspace filtering
+  nativeCheckInputs = [
+    bashInteractive
+    gitMinimal
+    ncurses
+  ];
+
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd atuin \
       --bash <($out/bin/atuin gen-completions -s bash) \
diff --git a/pkgs/by-name/au/aurulent-sans/package.nix b/pkgs/by-name/au/aurulent-sans/package.nix
index 62d438afb654..444b5797e184 100644
--- a/pkgs/by-name/au/aurulent-sans/package.nix
+++ b/pkgs/by-name/au/aurulent-sans/package.nix
@@ -24,7 +24,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   meta = {
     description = "Aurulent Sans";
     longDescription = "Aurulent Sans is a humanist sans serif intended to be used as an interface font";
-    homepage = "http://delubrum.org/";
+    homepage = "https://github.com/deepfire/hartke-aurulent-sans";
     maintainers = with lib.maintainers; [ pancaek ];
     license = lib.licenses.ofl;
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/aw/aws-lc/package.nix b/pkgs/by-name/aw/aws-lc/package.nix
index 548d1a2b0498..3aefbade8655 100644
--- a/pkgs/by-name/aw/aws-lc/package.nix
+++ b/pkgs/by-name/aw/aws-lc/package.nix
@@ -13,13 +13,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-lc";
-  version = "5.10.0";
+  version = "5.11.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-lc";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-fQl7rh9edy+ZtFZ1aB8FezP9ORJkqlRkR16y3Ke1vQQ=";
+    hash = "sha256-2gsjaMgP8NcJVSdW2g4hGFySVfTfKJuSkjSrG8KTKWI=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/az/azpainter/package.nix b/pkgs/by-name/az/azpainter/package.nix
index 585f0d2e0f06..132da25b120c 100644
--- a/pkgs/by-name/az/azpainter/package.nix
+++ b/pkgs/by-name/az/azpainter/package.nix
@@ -63,7 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Full color painting software for illustration drawing";
-    homepage = "http://azsky2.html.xdomain.jp/soft/azpainter.html";
+    homepage = "https://azelpg.gitlab.io/azsky2/";
     license = lib.licenses.gpl3Plus;
     maintainers = [ ];
     platforms = with lib.platforms; linux ++ darwin;
diff --git a/pkgs/by-name/az/azuredatastudio/package.nix b/pkgs/by-name/az/azuredatastudio/package.nix
index 6739d0cac653..aef772b50d4c 100644
--- a/pkgs/by-name/az/azuredatastudio/package.nix
+++ b/pkgs/by-name/az/azuredatastudio/package.nix
@@ -27,7 +27,7 @@
   nss,
   openssl,
   pango,
-  systemd,
+  systemdLibs,
   wrapGAppsHook3,
   libxrandr,
   libxfixes,
@@ -183,7 +183,7 @@ stdenv.mkDerivation rec {
       libxkbfile
       pango
       stdenv.cc.cc
-      systemd
+      systemdLibs
     ])
     targetPath
     sqltoolsserviceRpath
diff --git a/pkgs/by-name/ba/base91/package.nix b/pkgs/by-name/ba/base91/package.nix
index 7acf2197edf8..0529cdc840e9 100644
--- a/pkgs/by-name/ba/base91/package.nix
+++ b/pkgs/by-name/ba/base91/package.nix
@@ -1,38 +1,68 @@
 {
   lib,
   stdenv,
+  rustPlatform,
   fetchFromGitHub,
+  installShellFiles,
+  versionCheckHook,
+  nix-update-script,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "base91";
-  version = "0.1.0";
+  version = "0.3.2";
+
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "douzebis";
     repo = "base91";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-Lx569OtNU0z884763FSByH0yXIq6GzeXyp5NVvMejco="; # update as needed
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-1v/kvv+IUoYmrs6MrBmnA4UYIRjN4KICW/Q0zaiiGq0=";
   };
 
-  makeFlags = [
-    "CC=cc"
-    "-C"
-    "src"
-    "all"
-  ];
-  installFlags = [
-    "-C"
-    "src"
-    "install"
-    "prefix=$(out)"
-  ];
+  cargoRoot = "rust";
+  buildAndTestSubdir = "rust/base91-cli";
+
+  cargoHash = "sha256-5ubqTQQz0OBZoe3Ql/e1H5S1cL1EhYVabcZ9FkfQzao=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    ln -s base91 $out/bin/b91enc
+    ln -s base91 $out/bin/b91dec
+  ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    $out/bin/base91 --man > base91.1
+    installManPage base91.1
+    ln -s base91.1 $out/share/man/man1/b91enc.1
+    ln -s base91.1 $out/share/man/man1/b91dec.1
+    installShellCompletion --cmd base91 \
+      --bash <($out/bin/base91 --completions bash) \
+      --zsh <($out/bin/base91 --completions zsh) \
+      --fish <($out/bin/base91 --completions fish)
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
 
   meta = {
-    description = "CLI tool for encoding binary data as ASCII characters";
+    description = "Binary-to-text encoder and decoder for the basE91 format";
+    longDescription = ''
+      base91 encodes binary data as printable ASCII with about 23% overhead
+      (base64: 33%). It reads and writes Joachim Henke's basE91 format, as
+      the original C tool does. It also offers a fixed-width variant of the
+      format (--simd), designed for SIMD instructions: with SSE4.1, AVX2 or
+      NEON, it encodes and decodes at several GiB/s. b91enc and b91dec are
+      the encoder and decoder under their traditional names.
+    '';
     homepage = "https://github.com/douzebis/base91";
+    changelog = "https://github.com/douzebis/base91/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ douzebis ];
+    mainProgram = "base91";
     platforms = lib.platforms.unix;
   };
 })
diff --git a/pkgs/by-name/be/beekeeper-studio/package.nix b/pkgs/by-name/be/beekeeper-studio/package.nix
index 77a6dd9db7d1..03bb6df51867 100644
--- a/pkgs/by-name/be/beekeeper-studio/package.nix
+++ b/pkgs/by-name/be/beekeeper-studio/package.nix
@@ -32,7 +32,7 @@
   libxkbcommon,
   libgbm,
   vulkan-loader,
-  systemd,
+  systemdLibs,
   libGL,
   krb5,
   unixodbc,
@@ -100,7 +100,7 @@ stdenv.mkDerivation (finalAttrs: {
     unixodbc
   ];
 
-  runtimeDependencies = lib.optionals stdenv.hostPlatform.isLinux (lib.getLib systemd);
+  runtimeDependencies = lib.optionals stdenv.hostPlatform.isLinux (lib.getLib systemdLibs);
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/by-name/be/beeper/package.nix b/pkgs/by-name/be/beeper/package.nix
index 123548f7790e..0198bde29fc3 100644
--- a/pkgs/by-name/be/beeper/package.nix
+++ b/pkgs/by-name/be/beeper/package.nix
@@ -14,23 +14,23 @@
 }:
 let
   pname = "beeper";
-  version = "4.3.73";
+  version = "4.3.160";
 
   inherit (stdenv.hostPlatform) system;
 
   sources = {
     x86_64-linux = fetchurl {
       url = "https://beeper-desktop.download.beeper.com/builds/Beeper-${version}-x86_64.AppImage";
-      hash = "sha256-j6HTTqU7+z8AJ20hYgia6wOH0/n3gxrUocCpMPmgQvQ=";
+      hash = "sha256-by07u75l8YjMnuL8VZWkAUjTkGmP/qwJoopIMtJX7Tc=";
     };
     aarch64-linux = fetchurl {
       url = "https://beeper-desktop.download.beeper.com/builds/Beeper-${version}-arm64.AppImage";
-      hash = "sha256-kWlKMZdicJ+DhGgYXCTqvSCYinI9QD0pJD4nb4yYdpI=";
+      hash = "sha256-4mUxNwPrHbJvYQmX4KdYZcEmfV2MuSOEXrQKgl7DIa0=";
     };
     aarch64-darwin = fetchurl {
       # Zip unpacks cleanly with unzip; the download API redirects to a .dmg.
       url = "https://beeper-desktop.download.beeper.com/builds/Beeper-${version}-arm64-mac.zip";
-      hash = "sha256-79T3pPLEt+tQQ2xoC3XBAI/xpxMdnY11qSmVA2VFiVw=";
+      hash = "sha256-XrFxN57uOXIbgL8va/tgWtAaFTDVp9IxDWGJU0Kskbs=";
     };
   };
 
@@ -97,16 +97,19 @@ let
           linuxConfigFilename=$appRoot/build/main/linux-*.mjs
           echo "export function registerLinuxConfig() {}" > $linuxConfigFilename
 
-          # Disable scheduled update checks.
-          autoUpdateConfigFilename=$(
-            grep -lF 'c=d??{},p=c.hw_acceleration??!0' $appRoot/build/main/index-*.mjs
-          )
-          substituteInPlace "$autoUpdateConfigFilename" \
-            --replace-fail 'c=d??{},p=c.hw_acceleration??!0' 'c={...(d??{}),auto_update_disabled:true},p=c.hw_acceleration??!0'
+          # Disable (no-op) updater setup and checks without removing the methods
+          updateEntryFilename=$appRoot/build/main/main-entry-*.mjs
+          for method in 'async checkForUpdates' 'async runCheck' scheduleNextAutomaticCheck; do
+            signature="$method\([^)]*\)\{"
+            [ "$(grep -oE "$signature" $updateEntryFilename | wc -l)" -eq 1 ] \
+              || (echo "Expected one $method updater method" >&2; exit 1)
+            sed -i -E "s/$signature/&return;/" $updateEntryFilename
+          done
 
-          # Disable user-triggered update checks, which ignore auto_update_disabled.
-          substituteInPlace $appRoot/build/main/main-entry-*.mjs \
-            --replace-fail 'async checkForUpdates(r=!1){' 'async checkForUpdates(r=!1){return;'
+          signature='(register\([^)]*\)\{)([^{}]*\.on\("error",this\.onError\))'
+          [ "$(grep -oE "$signature" $updateEntryFilename | wc -l)" -eq 1 ] \
+            || (echo "Expected one updater register method" >&2; exit 1)
+          sed -i -E "s/$signature/\1return;\2/" $updateEntryFilename
         '';
       };
     in
diff --git a/pkgs/by-name/bl/bluesky-pds/package.nix b/pkgs/by-name/bl/bluesky-pds/package.nix
index cb5a998ca0ae..4cd06de8f17a 100644
--- a/pkgs/by-name/bl/bluesky-pds/package.nix
+++ b/pkgs/by-name/bl/bluesky-pds/package.nix
@@ -27,13 +27,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pds";
-  version = "0.4.5034";
+  version = "0.4.5037";
 
   src = fetchFromGitHub {
     owner = "bluesky-social";
     repo = "pds";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fsbnD9y0wxXq3NmVe5vMhI613G4HlZyqsv7+DNKzZzY=";
+    hash = "sha256-4llWhrtPZ6ZsA2CIDquNdR7WAdl4aKeG6WP0Q1sTyjs=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/service";
@@ -63,7 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     inherit pnpm;
     fetcherVersion = 4;
-    hash = "sha256-nnhtJNw/D6Tir3n6rrURjL/cw1EWocs4/r4K7Yq4Fdk=";
+    hash = "sha256-Tfhv/PWnkPK/CuPzQ/vxS3UIO/TBjWBsshFRatjbcX4=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/bo/bosh-cli/package.nix b/pkgs/by-name/bo/bosh-cli/package.nix
index 0bcf8a0ed4b2..be0c350756a0 100644
--- a/pkgs/by-name/bo/bosh-cli/package.nix
+++ b/pkgs/by-name/bo/bosh-cli/package.nix
@@ -39,7 +39,10 @@ buildGoModule (finalAttrs: {
     homepage = "https://bosh.io";
     changelog = "https://github.com/cloudfoundry/bosh-cli/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ ris ];
+    maintainers = with lib.maintainers; [
+      ris
+      a-hassanin
+    ];
     mainProgram = "bosh";
   };
 })
diff --git a/pkgs/by-name/bo/box2d/package.nix b/pkgs/by-name/bo/box2d/package.nix
index 881f29239669..7d3e5695043f 100644
--- a/pkgs/by-name/bo/box2d/package.nix
+++ b/pkgs/by-name/bo/box2d/package.nix
@@ -85,6 +85,19 @@ stdenv.mkDerivation (finalAttrs: {
     (cmakeBool "BOX2D_BUILD_UNIT_TESTS" finalAttrs.finalPackage.doCheck)
   ];
 
+  doCheck =
+    stdenv.buildPlatform.canExecute stdenv.hostPlatform
+    # b2Hash calls get struct reinterpreted as byte array for input, results not stable across endiannesses
+    && stdenv.hostPlatform.isLittleEndian;
+
+  checkPhase = ''
+    runHook preCheck
+
+    ./bin/test
+
+    runHook postCheck
+  '';
+
   passthru = {
     updateScript = nix-update-script { };
   };
diff --git a/pkgs/by-name/bs/bsdgames/package.nix b/pkgs/by-name/bs/bsdgames/package.nix
index 9fca2faa5ffd..807e915f908b 100644
--- a/pkgs/by-name/bs/bsdgames/package.nix
+++ b/pkgs/by-name/bs/bsdgames/package.nix
@@ -102,7 +102,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
-    homepage = "http://www.t2-project.org/packages/bsd-games.html";
+    homepage = "https://t2linux.com/packages/bsd-games.html";
     description = "Ports of all the games from NetBSD-current that are free";
     license = lib.licenses.free;
     maintainers = with lib.maintainers; [ viric ];
diff --git a/pkgs/by-name/bu/bullet/package.nix b/pkgs/by-name/bu/bullet/package.nix
index ed46639f290b..0cb491932a32 100644
--- a/pkgs/by-name/bu/bullet/package.nix
+++ b/pkgs/by-name/bu/bullet/package.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
       Bullet 3D Game Multiphysics Library provides state of the art collision
       detection, soft body and rigid body dynamics.
     '';
-    homepage = "http://bulletphysics.org";
+    homepage = "https://github.com/bulletphysics/bullet3";
     license = lib.licenses.zlib;
     maintainers = with lib.maintainers; [ aforemny ];
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/bu/bulwark/package.nix b/pkgs/by-name/bu/bulwark/package.nix
index 3778fae6c781..3fbf044c8122 100644
--- a/pkgs/by-name/bu/bulwark/package.nix
+++ b/pkgs/by-name/bu/bulwark/package.nix
@@ -10,13 +10,13 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "bulwark";
-  version = "1.12.0";
+  version = "1.13.0";
 
   src = fetchFromGitHub {
     owner = "bulwarkmail";
     repo = "webmail";
     tag = finalAttrs.version;
-    hash = "sha256-Lt25tZBtxhqMiSM8lYP3M3MIQEItRC3L360WOEYTL84=";
+    hash = "sha256-oEpJj5w4nb3bp5WDmukn0Xn/OCZL3Clz1K2F09kJYWY=";
     leaveDotGit = true;
     postFetch = ''
       cd "$out"
@@ -24,7 +24,7 @@ buildNpmPackage (finalAttrs: {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  npmDepsHash = "sha256-9p9Dn20U//UpFrDV/dksjWkfTD8almHR07lHF5Vtm8g=";
+  npmDepsHash = "sha256-ufEJsieashae6hAvRDowEOG6yD178lCr+228KhZ41lk=";
 
   strictDeps = true;
 
diff --git a/pkgs/by-name/ca/caesura/package.nix b/pkgs/by-name/ca/caesura/package.nix
index ff1ef9060abe..3b16e91fe402 100644
--- a/pkgs/by-name/ca/caesura/package.nix
+++ b/pkgs/by-name/ca/caesura/package.nix
@@ -1,9 +1,7 @@
 {
   lib,
   fetchFromGitHub,
-  fetchpatch2,
   rustPlatform,
-  cacert,
   writableTmpDirAsHomeHook,
   flac,
   lame,
@@ -19,39 +17,25 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "caesura";
-  version = "0.31.0";
+  version = "0.32.0";
 
   src = fetchFromGitHub {
     owner = "RogueOneEcho";
     repo = "caesura";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+REt+MKImO7fnYWJ32P6mKzulGJTnxc+9ednVF5aCJU=";
+    hash = "sha256-7PRYjKwnLiHLQ0+egzwf3YAmyu6+/2ysHfMmyv/VUZY=";
   };
 
-  patches = [
-    (fetchpatch2 {
-      name = "normalize-sox-dependent-full-spectrogram-widths.patch";
-      url = "https://github.com/RogueOneEcho/caesura/commit/3af818ae35a3e18f444c889d9d3b88294f4f110f.patch?full_index=1";
-      hash = "sha256-znAbk6hFVj198BUUwwDo76SWei0cKINeXzlYEFvTwHA=";
-    })
-  ];
-
   cargoHash = "sha256-0+vZma8AC44XqVHzmJT/roV7sy8w6DYhujRK9N91J5c=";
 
   nativeBuildInputs = [
     makeBinaryWrapper
   ];
   nativeCheckInputs = [
-    cacert
     writableTmpDirAsHomeHook
   ]
   ++ runtimeDeps;
 
-  env = {
-    CAESURA_NIX = "1";
-    SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
-  };
-
   postPatch = ''
     substituteInPlace Cargo.toml crates/*/Cargo.toml \
       --replace-fail 'version = "0.0.0"' 'version = "${finalAttrs.version}"'
@@ -68,6 +52,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --prefix PATH : ${lib.makeBinPath finalAttrs.passthru.runtimeDeps}
   '';
 
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/caesura version --offline
+  '';
+
   passthru = {
     inherit runtimeDeps;
   };
diff --git a/pkgs/by-name/ca/cagebreak/package.nix b/pkgs/by-name/ca/cagebreak/package.nix
index adabf5144bfc..eed7ab693f65 100644
--- a/pkgs/by-name/ca/cagebreak/package.nix
+++ b/pkgs/by-name/ca/cagebreak/package.nix
@@ -17,7 +17,7 @@
   pixman,
   pkg-config,
   scdoc,
-  systemd,
+  systemdLibs,
   wayland,
   wayland-protocols,
   wayland-scanner,
@@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
     libxcb-wm
     pango
     pixman
-    systemd
+    systemdLibs
     wayland
     wayland-protocols
     wlroots_0_19
diff --git a/pkgs/by-name/ca/canokey-usbip/package.nix b/pkgs/by-name/ca/canokey-usbip/package.nix
index 4fde140277b4..56f339e4b716 100644
--- a/pkgs/by-name/ca/canokey-usbip/package.nix
+++ b/pkgs/by-name/ca/canokey-usbip/package.nix
@@ -37,6 +37,9 @@ stdenv.mkDerivation (finalAttrs: {
   env = {
     NIX_CFLAGS_COMPILE = toString [
       "-Wno-error=incompatible-pointer-types"
+      # GCC 16 warns about set-but-unused variables/parameters in the vendored mbedtls
+      "-Wno-error=unused-but-set-variable"
+      "-Wno-error=unused-but-set-parameter"
       (lib.optionalString stdenv.cc.isClang "-Wno-error=documentation")
     ];
   };
diff --git a/pkgs/by-name/ca/casacore/package.nix b/pkgs/by-name/ca/casacore/package.nix
index 13323464fef4..e3bb41b2d06b 100644
--- a/pkgs/by-name/ca/casacore/package.nix
+++ b/pkgs/by-name/ca/casacore/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   gfortran,
   flex,
@@ -87,6 +88,13 @@ stdenv.mkDerivation (finalAttrs: {
     # leaving it empty, and remove hardcoded absolute cmake build paths from
     # Cflags (which would embed /nix/store paths from the build environment).
     ./casacore-pkgconfig.patch
+
+    # Fix undefined Dysco encoder template symbols with GCC 16
+    (fetchpatch {
+      url = "https://github.com/casacore/casacore/commit/60923a924d6380de04ee32042290c7e7426e3509.patch";
+      includes = [ "tables/Dysco/*" ];
+      hash = "sha256-j/Ukc6hvfGpWTlw3YZDjgu/UihFxfOoHMatpPP9KcO8=";
+    })
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/ca/catatonit/package.nix b/pkgs/by-name/ca/catatonit/package.nix
index 6b1827e827c7..03af1754594d 100644
--- a/pkgs/by-name/ca/catatonit/package.nix
+++ b/pkgs/by-name/ca/catatonit/package.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   doInstallCheck = true;
   installCheckPhase = ''
-    readelf -d $out/bin/catatonit | grep 'There is no dynamic section in this file.'
+    ${stdenv.cc.targetPrefix}readelf -d $out/bin/catatonit | grep 'There is no dynamic section in this file.'
   '';
 
   passthru.tests = { inherit (nixosTests) podman; };
diff --git a/pkgs/by-name/cb/cbirds/package.nix b/pkgs/by-name/cb/cbirds/package.nix
new file mode 100644
index 000000000000..08aadf84aa77
--- /dev/null
+++ b/pkgs/by-name/cb/cbirds/package.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "cbirds";
+  version = "1.6.0";
+
+  src = fetchFromGitHub {
+    owner = "clainstone";
+    repo = "cbirds";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-MMctTFtEUYt3xn7gFYWcMlRFLkFXW+wu6/hTtTkO6Og=";
+  };
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  installFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  doCheck = true;
+  checkTarget = "test";
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Flock of birds (Craig Reynolds' boids) in your terminal";
+    homepage = "https://github.com/clainstone/cbirds";
+    changelog = "https://github.com/clainstone/cbirds/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ tbutter ];
+    mainProgram = "cbirds";
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/cc/cctv-viewer/package.nix b/pkgs/by-name/cc/cctv-viewer/package.nix
index 089b55b0c568..bfa3192e0b23 100644
--- a/pkgs/by-name/cc/cctv-viewer/package.nix
+++ b/pkgs/by-name/cc/cctv-viewer/package.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Viewer and mounter for video streams";
-    homepage = "https://cctv-viewer.org";
+    homepage = "https://github.com/iEvgeny/cctv-viewer";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ teohz ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/cd/cd-hit/package.nix b/pkgs/by-name/cd/cd-hit/package.nix
index 11eb2fe7646f..819357235139 100644
--- a/pkgs/by-name/cd/cd-hit/package.nix
+++ b/pkgs/by-name/cd/cd-hit/package.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
   '';
   meta = {
     description = "Clustering and comparing protein or nucleotide sequences";
-    homepage = "http://weizhongli-lab.org/cd-hit/";
+    homepage = "https://github.com/weizhongli/cdhit";
     license = lib.licenses.gpl2;
     maintainers = [ lib.maintainers.bzizou ];
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/cd/cdist/package.nix b/pkgs/by-name/cd/cdist/package.nix
index b877f383572e..6da2bdf4608e 100644
--- a/pkgs/by-name/cd/cdist/package.nix
+++ b/pkgs/by-name/cd/cdist/package.nix
@@ -59,7 +59,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   meta = {
     description = "Minimalistic configuration management system";
-    homepage = "https://www.sdi.st";
+    homepage = "https://www.cdi.st";
     changelog = "https://code.ungleich.ch/ungleich-public/cdist/src/tag/${finalAttrs.version}/docs/changelog";
 
     # Mostly. There are still couple types that are gpl3-only.
diff --git a/pkgs/by-name/cd/cdncheck/package.nix b/pkgs/by-name/cd/cdncheck/package.nix
index 9186aa7d00f6..4205ccfd54fb 100644
--- a/pkgs/by-name/cd/cdncheck/package.nix
+++ b/pkgs/by-name/cd/cdncheck/package.nix
@@ -8,7 +8,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "cdncheck";
-  version = "1.3.1";
+  version = "1.3.2";
 
   __structuredAttrs = true;
 
@@ -16,7 +16,7 @@ buildGoModule (finalAttrs: {
     owner = "projectdiscovery";
     repo = "cdncheck";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lM+sw5AhM5gkrvcLqOZXwcKEtS3UBQYMmM5pPSS4xxQ=";
+    hash = "sha256-QBggYJ8DOTi1mLJZCv2sQ9BeZHPQ1clj9zTb9Abu/Fw=";
   };
 
   vendorHash = "sha256-TYCYAKhytk249YJkRrgFrH8RWl0yrxr5z0dNONKBufU=";
diff --git a/pkgs/by-name/ce/celestegame/package.nix b/pkgs/by-name/ce/celestegame/package.nix
index e67c0a2749cd..6a45ec6fac3c 100644
--- a/pkgs/by-name/ce/celestegame/package.nix
+++ b/pkgs/by-name/ce/celestegame/package.nix
@@ -99,7 +99,7 @@ buildFHSEnv {
       util-linux.lib
       libselinux
       nspr
-      systemd
+      systemdLibs
       gtk3
       pango
       harfbuzz
diff --git a/pkgs/by-name/ch/chatgpt/launcher.nix b/pkgs/by-name/ch/chatgpt/launcher.nix
new file mode 100644
index 000000000000..403b9b45e3bc
--- /dev/null
+++ b/pkgs/by-name/ch/chatgpt/launcher.nix
@@ -0,0 +1,67 @@
+# Electron rewrites bundled plugin manifests, so they need a writable copy.
+{
+  coreutils,
+  flock,
+  writeShellApplication,
+}:
+
+writeShellApplication {
+  name = "chatgpt-launcher";
+
+  runtimeInputs = [
+    coreutils
+    flock
+  ];
+
+  text = ''
+    : "''${CHATGPT_EXECUTABLE:?}"
+    : "''${CHATGPT_RESOURCES_SOURCE:?}"
+    : "''${CHATGPT_RESOURCES_CACHE_KEY:?}"
+
+    cacheHome="''${XDG_CACHE_HOME:-''${HOME:?XDG_CACHE_HOME and HOME are unset}/.cache}"
+    cacheRoot="$cacheHome/chatgpt/bundled-plugins-v2"
+    resourcesPath="$cacheRoot/$CHATGPT_RESOURCES_CACHE_KEY"
+
+    mkdir -p "$cacheRoot"
+    exec {initLockFd}> "$cacheRoot.lock"
+    flock --exclusive "$initLockFd"
+
+    # tmpfiles may remove the directory before its lock is acquired.
+    while true; do
+      mkdir -p "$resourcesPath"
+      if exec {resourcesLockFd}< "$resourcesPath"; then
+        flock --shared "$resourcesLockFd"
+        [[ "$resourcesPath" -ef "/proc/self/fd/$resourcesLockFd" ]] && break
+        exec {resourcesLockFd}>&-
+      else
+        [[ ! -d "$resourcesPath" ]] || exit 1
+      fi
+    done
+
+    if [[ ! -f "$resourcesPath/.complete" ]]; then
+      ln -sfn -t "$resourcesPath" \
+        "$CHATGPT_RESOURCES_SOURCE"/{codex,codex-code-mode-host,cua_node,native,rg,tectonic}
+      mkdir -p "$resourcesPath/plugins"
+      chmod -R u+w "$resourcesPath/plugins"
+      cp -RT --preserve=mode "$CHATGPT_RESOURCES_SOURCE/plugins" "$resourcesPath/plugins"
+      chmod -R u+w "$resourcesPath/plugins"
+      sync --file-system "$resourcesPath"
+      touch "$resourcesPath/.complete"
+      sync --file-system "$resourcesPath"
+    fi
+    exec {initLockFd}>&-
+
+    export CODEX_ELECTRON_BUNDLED_PLUGINS_RESOURCES_PATH="$resourcesPath"
+
+    waylandFlags=()
+    if [[ -n "''${NIXOS_OZONE_WL:-}" && -n "''${WAYLAND_DISPLAY:-}" ]]; then
+      waylandFlags=(
+        --ozone-platform=wayland
+        --enable-features=WaylandWindowDecorations
+        --enable-wayland-ime=true
+      )
+    fi
+
+    exec "$CHATGPT_EXECUTABLE" "''${waylandFlags[@]}" "$@"
+  '';
+}
diff --git a/pkgs/by-name/ch/chatgpt/package.nix b/pkgs/by-name/ch/chatgpt/package.nix
index d9e32b3ae907..adb41649dc17 100644
--- a/pkgs/by-name/ch/chatgpt/package.nix
+++ b/pkgs/by-name/ch/chatgpt/package.nix
@@ -1,49 +1,278 @@
 {
   lib,
-  stdenvNoCC,
+  stdenv,
+  callPackage,
   fetchurl,
+
+  # hooks
+  autoPatchelfHook,
+  makeWrapper,
+  versionCheckHook,
+  wrapGAppsHook3,
+  writableTmpDirAsHomeHook,
+
+  # native build inputs
+  asar,
+  dpkg,
+  patchelf,
   unzip,
+
+  # build inputs
+  alsa-lib,
+  at-spi2-atk,
+  at-spi2-core,
+  atk,
+  cairo,
+  cups,
+  dbus,
+  dconf,
+  expat,
+  gdk-pixbuf,
+  glib,
+  gtk3,
+  libgbm,
+  libnotify,
+  libusb1,
+  libx11,
+  libxcb,
+  libxcomposite,
+  libxdamage,
+  libxext,
+  libxfixes,
+  libxkbcommon,
+  libxrandr,
+  nspr,
+  nss,
+  pango,
+  qt6,
+  systemdLibs,
+
+  # runtime deps
+  bubblewrap,
+  coreutils,
+  gitMinimal,
+  libGL,
+  libpulseaudio,
+  libsecret,
+  lsb-release,
+  nodejs-slim,
+  pipewire,
+  ripgrep,
+  tectonic-unwrapped,
+  vulkan-loader,
+  xdg-utils,
+  # override to null to use bundled codex
+  codex,
 }:
-
 let
-  source = import ./source.nix;
+  inherit (stdenv.hostPlatform) isLinux isDarwin system;
+  inherit (stdenv.hostPlatform.node) arch platform;
 in
-stdenvNoCC.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "chatgpt";
-  inherit (source) version;
+  inherit (finalAttrs.passthru.source) version;
 
-  src = fetchurl source.src;
+  src = fetchurl finalAttrs.passthru.source.src;
 
   strictDeps = true;
   __structuredAttrs = true;
 
+  postPatch = lib.optionalString isLinux ''
+    # autoPatchelf moves PT_INTERP beyond detect-libc's 2 KiB limit.
+    # Its process.report fallback crashes Electron.
+    asar extract usr/lib/chatgpt/resources/app.asar app
+    substituteInPlace app/node_modules/@parcel/watcher/index.js \
+      --replace-fail 'const family = familySync();' "const family = '${stdenv.hostPlatform.libc}';"
+    # Don't pack packages that were originally unpacked
+    unpackedDirs="$(
+      # Only descend into @scope directories
+      find usr/lib/chatgpt/resources/app.asar.unpacked/node_modules \
+        -mindepth 1 -maxdepth 2 \
+        ! -name '@*' -printf '%P\n' -prune |
+        paste -sd,
+    )"
+    asar pack app usr/lib/chatgpt/resources/app.asar \
+      --unpack-dir "node_modules/{$unpackedDirs}"
+  '';
+
   nativeBuildInputs = [
+    makeWrapper
+  ]
+  ++ lib.optionals isDarwin [
     unzip
+    patchelf
+  ]
+  ++ lib.optionals isLinux [
+    asar
+    autoPatchelfHook
+    dpkg
+    qt6.wrapQtAppsHook
+    wrapGAppsHook3
   ];
 
-  sourceRoot = ".";
+  buildInputs = lib.optionals isLinux [
+    alsa-lib
+    at-spi2-atk
+    at-spi2-core
+    atk
+    cairo
+    cups
+    dbus
+    dconf
+    expat
+    gdk-pixbuf
+    glib
+    gtk3
+    libgbm
+    libnotify
+    libusb1
+    libx11
+    libxcb
+    libxcomposite
+    libxdamage
+    libxext
+    libxfixes
+    libxkbcommon
+    libxrandr
+    nspr
+    nss
+    pango
+    qt6.qtbase
+    stdenv.cc.cc.lib
+    systemdLibs
+  ];
+
+  runtimeDependencies = lib.optionals isLinux [
+    libGL
+    libnotify
+    libpulseaudio
+    libsecret
+    pipewire
+    vulkan-loader
+  ];
+
+  dontWrapGApps = true;
+  dontWrapQtApps = true;
+
+  sourceRoot = if isLinux then "root" else ".";
 
   installPhase = ''
     runHook preInstall
+  ''
+  + (
+    if isDarwin then
+      ''
+        mkdir -p "$out/Applications" "$out/bin"
+        cp -a ChatGPT.app "$out/Applications"
+        makeWrapper "$out/Applications/ChatGPT.app/Contents/MacOS/ChatGPT" "$out/bin/ChatGPT"
+      ''
+    else
+      ''
+        mkdir -p "$out"
+        cp -r usr/* "$out"
 
-    mkdir -p "$out/Applications"
-    mkdir -p "$out/bin"
-    cp -a ChatGPT.app "$out/Applications"
-    ln -s "$out/Applications/ChatGPT.app/Contents/MacOS/ChatGPT" "$out/bin/ChatGPT"
+        # Remove the unused Qt 5 fallback shim.
+        rm -f "$out/lib/chatgpt/libqt5_shim.so"
 
+        # Keep only the native prebuild for this platform and architecture.
+        resources="$out/lib/chatgpt/resources"
+        find "$resources" -type d -name prebuilds -print0 | while IFS= read -r -d "" prebuildsPath; do
+          find "$prebuildsPath" -mindepth 1 -maxdepth 1 \
+            ! -name "*${platform}-${arch}" \
+            -exec rm -rf -- {} +
+        done
+      ''
+      + lib.optionalString stdenv.hostPlatform.isGnu ''
+        find "$resources" -type f -name '*.musl.node' -delete
+      ''
+      + ''
+
+        ln -sf ${lib.getExe tectonic-unwrapped} "$resources/tectonic/tectonic"
+        ln -sf ${lib.getExe ripgrep} "$resources/rg"
+        mkdir -p "$resources/cua_node/bin"
+        ln -sf ${lib.getExe nodejs-slim} "$resources/cua_node/bin/node"
+
+        install -Dm755 ${lib.getExe finalAttrs.passthru.launcher} "$out/bin/chatgpt"
+        install -Dm644 ${./tmpfiles.conf} "$out/share/user-tmpfiles.d/chatgpt.conf"
+      ''
+      + lib.optionalString (codex != null) ''
+        ln -sf ${lib.getExe codex} "$resources/codex"
+        ln -sf ${lib.getExe' codex "codex-code-mode-host"} "$resources/codex-code-mode-host"
+      ''
+      + ''
+        # The launcher assumes this bundled-plugin resource layout.
+        for resource in codex codex-code-mode-host cua_node native rg tectonic plugins; do
+          if [[ ! -e "$resources/$resource" ]]; then
+            echo "Missing ChatGPT bundled-plugin resource: $resources/$resource" >&2
+            exit 1
+          fi
+        done
+      ''
+  )
+  + ''
     runHook postInstall
   '';
 
-  passthru.updateScript = ./update.sh;
+  postFixup = lib.optionalString isLinux ''
+    wrapProgram "$out/bin/chatgpt" \
+      "''${gappsWrapperArgs[@]}" \
+      "''${qtWrapperArgs[@]}" \
+      --set CHATGPT_EXECUTABLE "$out/lib/chatgpt/ChatGPT" \
+      --set CHATGPT_RESOURCES_SOURCE "$out/lib/chatgpt/resources" \
+      --set CHATGPT_RESOURCES_CACHE_KEY "''${out##*/}" \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          bubblewrap
+          coreutils
+          gitMinimal
+          lsb-release
+          nodejs-slim
+          nodejs-slim.npm
+          xdg-utils
+        ]
+      } \
+      --set-default CODEX_BROWSER_USE_NODE_PATH ${lib.getExe nodejs-slim} \
+      --set-default NODE_REPL_NODE_PATH ${lib.getExe nodejs-slim} \
+      ${lib.escapeShellArgs (
+        lib.optionals (codex != null) [
+          "--set-default"
+          "CODEX_CLI_PATH"
+          (lib.getExe codex)
+        ]
+      )}
+  '';
+
+  dontStrip = isLinux;
+  dontPatchELF = isDarwin;
+  dontPatchShebangs = isDarwin;
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+  versionCheckKeepEnvironment = [ "HOME" ];
+
+  passthru = {
+    updateScript = ./update.sh;
+    sources = lib.importJSON ./source.json;
+    source = finalAttrs.passthru.sources.${system} or (throw "chatgpt is not supported on ${system}");
+    launcher = callPackage ./launcher.nix { };
+  };
 
   meta = {
     description = "Desktop application for ChatGPT";
-    homepage = "https://openai.com/chatgpt/desktop/";
-    changelog = "https://help.openai.com/en/articles/9703738-macos-app-release-notes";
+    homepage = "https://developers.openai.com/codex/app";
+    changelog = "https://learn.chatgpt.com/docs/changelog?type=codex-app";
     license = lib.licenses.unfree;
-    maintainers = with lib.maintainers; [ wattmto ];
-    platforms = lib.platforms.darwin;
+    maintainers = with lib.maintainers; [
+      wattmto
+      moraxyc
+      mdaniels5757
+    ];
+    broken = stdenv.hostPlatform.isMusl;
+    platforms = lib.attrNames finalAttrs.passthru.sources;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    mainProgram = "ChatGPT";
+    mainProgram = if isDarwin then "ChatGPT" else "chatgpt";
   };
-}
+})
diff --git a/pkgs/by-name/ch/chatgpt/source.json b/pkgs/by-name/ch/chatgpt/source.json
new file mode 100644
index 000000000000..bc508c9a0ac6
--- /dev/null
+++ b/pkgs/by-name/ch/chatgpt/source.json
@@ -0,0 +1,23 @@
+{
+  "aarch64-darwin": {
+    "version": "26.1007.30912",
+    "src": {
+      "url": "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-arm64-26.1007.30912.zip",
+      "hash": "sha256-tpmowtWi8jysWdxnOI4lr0v1/C+2qzD/okOpaOT4FaM="
+    }
+  },
+  "aarch64-linux": {
+    "version": "26.1007.21434",
+    "src": {
+      "url": "https://persistent.oaistatic.com/codex-app-prod/linux/deb/pool/main/c/chatgpt/chatgpt_26.1007.21434_arm64.deb",
+      "hash": "sha256-Vfrh4/sdYGmpBiDp5wc33Pi/IlVgTRV+KCzGdIobr0k="
+    }
+  },
+  "x86_64-linux": {
+    "version": "26.1007.21434",
+    "src": {
+      "url": "https://persistent.oaistatic.com/codex-app-prod/linux/deb/pool/main/c/chatgpt/chatgpt_26.1007.21434_amd64.deb",
+      "hash": "sha256-J2tTQcPXSyYdOtUhBvf6ft3gaEHkdn/ipAy1QJmx8+0="
+    }
+  }
+}
diff --git a/pkgs/by-name/ch/chatgpt/source.nix b/pkgs/by-name/ch/chatgpt/source.nix
deleted file mode 100644
index cff4771c84e4..000000000000
--- a/pkgs/by-name/ch/chatgpt/source.nix
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  version = "26.803.81509";
-  src = {
-    url = "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-arm64-26.803.81509.zip";
-    hash = "sha256-NMfmKWeK1dY6Y57GlKW4O4X04b18Ie4qvP77sEEJW5w=";
-  };
-}
diff --git a/pkgs/by-name/ch/chatgpt/tmpfiles.conf b/pkgs/by-name/ch/chatgpt/tmpfiles.conf
new file mode 100644
index 000000000000..05be7f0f21b2
--- /dev/null
+++ b/pkgs/by-name/ch/chatgpt/tmpfiles.conf
@@ -0,0 +1 @@
+e %C/chatgpt/bundled-plugins-v2 - - - 0
diff --git a/pkgs/by-name/ch/chatgpt/update.sh b/pkgs/by-name/ch/chatgpt/update.sh
index 37fc5cf5d264..fd5078d2be60 100755
--- a/pkgs/by-name/ch/chatgpt/update.sh
+++ b/pkgs/by-name/ch/chatgpt/update.sh
@@ -1,23 +1,103 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl libxml2
+#!nix-shell -i bash -p curl gzip jq libxml2
+# shellcheck shell=bash
 
-XML_URL="https://persistent.oaistatic.com/codex-app-prod/appcast.xml"
+set -o errexit
+set -o nounset
+set -o pipefail
 
-XML_DATA=$(curl -s $XML_URL)
+BASE_URL="https://persistent.oaistatic.com/codex-app-prod"
+DARWIN_APPCAST_URL="$BASE_URL/appcast.xml"
+LINUX_REPOSITORY_URL="$BASE_URL/linux/deb"
 
-LATEST_VERSION=$(echo "$XML_DATA" | xmllint --xpath '/rss/channel/item[1]/*[local-name()="shortVersionString"]/text()' -)
-DOWNLOAD_URL=$(echo "$XML_DATA" | xmllint --xpath 'string(//item[1]/enclosure/@url)' -)
+SOURCE_JSON=${SOURCE_JSON:-"$(dirname "${BASH_SOURCE[0]}")/source.json"}
 
-HASH=$(nix-prefetch-url $DOWNLOAD_URL | xargs nix --extra-experimental-features nix-command hash convert --hash-algo sha256)
+get_field() {
+  local field="$1"
+  local metadata="$2"
 
-SOURCE_NIX="$(dirname ${BASH_SOURCE[0]})/source.nix"
-
-cat > "${SOURCE_NIX}" << _EOF_
-{
-  version = "$LATEST_VERSION";
-  src = {
-    url = "$DOWNLOAD_URL";
-    hash = "$HASH";
-  };
+  sed -n "s/^$field: //p" <<< "$metadata" | head -n 1
 }
-_EOF_
+
+fetch_linux_metadata() {
+  local architecture="$1"
+
+  curl --fail --location --silent --show-error \
+    "$LINUX_REPOSITORY_URL/dists/stable/main/binary-$architecture/Packages.gz" \
+    | gzip --decompress --stdout
+}
+
+DARWIN_XML=$(curl --fail --location --silent --show-error "$DARWIN_APPCAST_URL")
+DARWIN_VERSION=$(xmllint --xpath '/rss/channel/item[1]/*[local-name()="shortVersionString"]/text()' - <<< "$DARWIN_XML")
+DARWIN_URL=$(xmllint --xpath 'string(//item[1]/enclosure/@url)' - <<< "$DARWIN_XML")
+
+for pair in \
+  "x86_64-linux amd64" \
+  "aarch64-linux arm64"; do
+  read -r system architecture <<< "$pair"
+  metadata=$(fetch_linux_metadata "$architecture")
+
+  [[ $(get_field Package "$metadata") == chatgpt ]]
+  [[ $(get_field Architecture "$metadata") == "$architecture" ]]
+
+  version=$(get_field Version "$metadata")
+  filename=$(get_field Filename "$metadata")
+
+  if [[ "$system" == x86_64-linux ]]; then
+    AMD64_VERSION=$version
+    AMD64_URL="$LINUX_REPOSITORY_URL/$filename"
+  else
+    ARM64_VERSION=$version
+    ARM64_URL="$LINUX_REPOSITORY_URL/$filename"
+  fi
+done
+
+if [[ -f "$SOURCE_JSON" ]] && jq -e \
+  --arg darwin_version "$DARWIN_VERSION" \
+  --arg darwin_url "$DARWIN_URL" \
+  --arg amd64_version "$AMD64_VERSION" \
+  --arg amd64_url "$AMD64_URL" \
+  --arg arm64_version "$ARM64_VERSION" \
+  --arg arm64_url "$ARM64_URL" \
+  '.["aarch64-darwin"].version == $darwin_version
+    and .["aarch64-darwin"].src.url == $darwin_url
+    and .["x86_64-linux"].version == $amd64_version
+    and .["x86_64-linux"].src.url == $amd64_url
+    and .["aarch64-linux"].version == $arm64_version
+    and .["aarch64-linux"].src.url == $arm64_url' \
+  "$SOURCE_JSON" >/dev/null; then
+  echo "chatgpt is already up to date" >&2
+  exit 0
+fi
+
+DARWIN_HASH=$(nix --extra-experimental-features nix-command hash convert \
+  --hash-algo sha256 "$(nix-prefetch-url "$DARWIN_URL")")
+AMD64_HASH=$(nix --extra-experimental-features nix-command hash convert \
+  --hash-algo sha256 "$(nix-prefetch-url "$AMD64_URL")")
+ARM64_HASH=$(nix --extra-experimental-features nix-command hash convert \
+  --hash-algo sha256 "$(nix-prefetch-url "$ARM64_URL")")
+
+jq -n \
+  --arg darwin_version "$DARWIN_VERSION" \
+  --arg darwin_url "$DARWIN_URL" \
+  --arg darwin_hash "$DARWIN_HASH" \
+  --arg amd64_version "$AMD64_VERSION" \
+  --arg amd64_url "$AMD64_URL" \
+  --arg amd64_hash "$AMD64_HASH" \
+  --arg arm64_version "$ARM64_VERSION" \
+  --arg arm64_url "$ARM64_URL" \
+  --arg arm64_hash "$ARM64_HASH" \
+  '{
+    "aarch64-darwin": {
+      "version": $darwin_version,
+      "src": { "url": $darwin_url, "hash": $darwin_hash }
+    },
+    "aarch64-linux": {
+      "version": $arm64_version,
+      "src": { "url": $arm64_url, "hash": $arm64_hash }
+    },
+    "x86_64-linux": {
+      "version": $amd64_version,
+      "src": { "url": $amd64_url, "hash": $amd64_hash }
+    }
+  }' > "$SOURCE_JSON"
diff --git a/pkgs/by-name/ch/checkov/package.nix b/pkgs/by-name/ch/checkov/package.nix
index d359fb3b638a..2182e08bac01 100644
--- a/pkgs/by-name/ch/checkov/package.nix
+++ b/pkgs/by-name/ch/checkov/package.nix
@@ -35,14 +35,14 @@ let
 in
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "checkov";
-  version = "3.3.9";
+  version = "3.3.26";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     tag = finalAttrs.version;
-    hash = "sha256-XbfuMOXpG1sQgqiq42kJB3zmcKrBGhgLaopvSV0fFVY=";
+    hash = "sha256-q2aZfFoeBvg78uCLQxws4KaWH7yaE9CDm5TIOokscTs=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/ci/citrix-workspace/package.nix b/pkgs/by-name/ci/citrix-workspace/package.nix
index 5e8d68ded2ab..b43d11cf6565 100644
--- a/pkgs/by-name/ci/citrix-workspace/package.nix
+++ b/pkgs/by-name/ci/citrix-workspace/package.nix
@@ -55,7 +55,7 @@
   sane-backends,
   speex,
   symlinkJoin,
-  systemd,
+  systemdLibs,
   tzdata,
   which,
   woff2,
@@ -194,7 +194,7 @@ stdenv.mkDerivation (finalAttrs: {
     sane-backends
     speex
     stdenv.cc.cc
-    (lib.getLib systemd)
+    (lib.getLib systemdLibs)
     woff2
     webkitgtk_4_1
     libxscrnsaver
diff --git a/pkgs/by-name/cl/clutter-gst/package.nix b/pkgs/by-name/cl/clutter-gst/package.nix
index 29d424469a71..c9329b10f4d0 100644
--- a/pkgs/by-name/cl/clutter-gst/package.nix
+++ b/pkgs/by-name/cl/clutter-gst/package.nix
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "GStreamer bindings for clutter";
 
-    homepage = "http://www.clutter-project.org/";
+    homepage = "https://gitlab.gnome.org/Archive/clutter-gst";
 
     license = lib.licenses.lgpl2Plus;
 
diff --git a/pkgs/by-name/cl/clutter-gtk/package.nix b/pkgs/by-name/cl/clutter-gtk/package.nix
index 036171764216..e87e95a6469d 100644
--- a/pkgs/by-name/cl/clutter-gtk/package.nix
+++ b/pkgs/by-name/cl/clutter-gtk/package.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Clutter-GTK";
-    homepage = "http://www.clutter-project.org/";
+    homepage = "https://gitlab.gnome.org/Archive/clutter-gtk";
     license = lib.licenses.lgpl2Plus;
     maintainers = [ ];
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/cl/clutter/package.nix b/pkgs/by-name/cl/clutter/package.nix
index 1c2c1ed2876f..b76a8d078031 100644
--- a/pkgs/by-name/cl/clutter/package.nix
+++ b/pkgs/by-name/cl/clutter/package.nix
@@ -109,7 +109,7 @@ stdenv.mkDerivation {
     '';
 
     license = lib.licenses.lgpl2Plus;
-    homepage = "http://www.clutter-project.org/";
+    homepage = "https://gitlab.gnome.org/Archive/clutter";
 
     maintainers = [ ];
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/co/codex/nix-package-layout.patch b/pkgs/by-name/co/codex/nix-package-layout.patch
new file mode 100644
index 000000000000..486464dac63a
--- /dev/null
+++ b/pkgs/by-name/co/codex/nix-package-layout.patch
@@ -0,0 +1,30 @@
+diff --git a/app-server-daemon/src/backend/pid.rs b/app-server-daemon/src/backend/pid.rs
+index 22e34d9..298c989 100644
+--- a/app-server-daemon/src/backend/pid.rs
++++ b/app-server-daemon/src/backend/pid.rs
+@@ -732,7 +732,7 @@ async fn read_process_start_time(pid: u32) -> Result<String> {
+
+ #[cfg(unix)]
+ async fn read_process_details(pid: u32) -> Result<(String, String)> {
+-    let output = Command::new("ps")
++    let output = Command::new("@ps@")
+         .args(["-p", &pid.to_string(), "-o", "stat=", "-o", "lstart="])
+         .output()
+         .await
+diff --git a/app-server-daemon/src/prepare_install.rs b/app-server-daemon/src/prepare_install.rs
+index 290ceae..2c3c966 100644
+--- a/app-server-daemon/src/prepare_install.rs
++++ b/app-server-daemon/src/prepare_install.rs
+@@ -373,8 +373,11 @@ fn package_tree(root: &Path, destination: Option<&Path>) -> Result<String> {
+         {
+             continue;
+         }
++        let canonical = path.canonicalize()?;
++        let is_nix_package_file = std::env::split_paths("@packageLinkRoots@")
++            .any(|root| canonical.starts_with(&root) && canonical != root);
+         anyhow::ensure!(
+-            path.canonicalize()?.starts_with(&canonical_root),
++            canonical.starts_with(&canonical_root) || is_nix_package_file,
+             "package link escapes its root"
+         );
+         let metadata = path.metadata()?;
diff --git a/pkgs/by-name/co/codex/nix-voice-runtime.patch b/pkgs/by-name/co/codex/nix-voice-runtime.patch
new file mode 100644
index 000000000000..0bed0e9f5295
--- /dev/null
+++ b/pkgs/by-name/co/codex/nix-voice-runtime.patch
@@ -0,0 +1,20 @@
+diff --git a/voice-host/src/runtime.rs b/voice-host/src/runtime.rs
+index 0c795188d452..52b61449cd5e 100644
+--- a/voice-host/src/runtime.rs
++++ b/voice-host/src/runtime.rs
+@@ -127,10 +127,13 @@ impl Runtime {
+
+ fn private_file(root: &Path, relative: &str) -> io::Result<PathBuf> {
+     let path = root.join(relative);
+-    if path.canonicalize()? != path || !path.is_file() {
++    let canonical = path.canonicalize()?;
++    let is_nix_runtime_file = std::env::split_paths("@voiceRuntimeRoots@")
++        .any(|root| canonical.starts_with(&root) && canonical != root);
++    if !path.is_file() || (canonical != path && !is_nix_runtime_file) {
+         return Err(runtime_error());
+     }
+-    Ok(path)
++    Ok(canonical)
+ }
+
+ fn load(path: &Path) -> io::Result<ManuallyDrop<Library>> {
diff --git a/pkgs/by-name/co/codex/package.nix b/pkgs/by-name/co/codex/package.nix
index 37c7ea40cc76..93dbf78b925b 100644
--- a/pkgs/by-name/co/codex/package.nix
+++ b/pkgs/by-name/co/codex/package.nix
@@ -5,28 +5,67 @@
   rustPlatform,
   fetchFromGitHub,
   installShellFiles,
+  alsa-lib,
   bubblewrap,
   clang,
   cmake,
   gitMinimal,
+  gst_all_1,
   libcap,
   libclang,
+  libopus,
   librusty_v8 ? callPackage ./librusty_v8.nix {
     inherit (callPackage ./fetchers.nix { }) fetchLibrustyV8;
   },
   librusty_v8_src_binding ? callPackage ./librusty_v8_src_binding.nix {
     inherit (callPackage ./fetchers.nix { }) fetchLibrustyV8SrcBinding;
   },
+  linkFarm,
   lld,
-  makeBinaryWrapper,
   nix-update-script,
   pkg-config,
   openssl,
+  ps,
+  replaceVars,
   ripgrep,
   versionCheckHook,
+  writeText,
   installShellCompletions ? stdenv.buildPlatform.canExecute stdenv.hostPlatform,
   _experimental-update-script-combinators,
 }:
+let
+  supportsVoice =
+    stdenv.hostPlatform.isDarwin || (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu);
+  voiceRuntimeRoots = [
+    (lib.getLib gst_all_1.gstreamer)
+    (lib.getLib gst_all_1.gst-plugins-base)
+    (lib.getLib gst_all_1.gst-plugins-good)
+  ];
+  # Voice loads a fixed package-relative runtime, ignoring GStreamer discovery.
+  voiceRuntime =
+    let
+      pluginDirectory = if stdenv.hostPlatform.isDarwin then "plugins" else "lib/gstreamer-1.0";
+      pluginSuffix = stdenv.hostPlatform.extensions.sharedLibrary;
+      plugin = package: name: {
+        path = "${lib.getLib package}/lib/gstreamer-1.0/libgst${name}${pluginSuffix}";
+        name = "${pluginDirectory}/libgst${name}${pluginSuffix}";
+      };
+      coreSuffix = if stdenv.hostPlatform.isDarwin then "0.dylib" else "so.0";
+    in
+    linkFarm "codex-voice-runtime" [
+      {
+        path = "${lib.getLib gst_all_1.gstreamer}/lib/libgstreamer-1.0.${coreSuffix}";
+        name = "lib/libgstreamer-1.0.${coreSuffix}";
+      }
+      (plugin gst_all_1.gstreamer "coreelements")
+      (plugin gst_all_1.gst-plugins-base "app")
+      (plugin gst_all_1.gst-plugins-base "audioconvert")
+      (plugin gst_all_1.gst-plugins-base "audioresample")
+      (plugin gst_all_1.gst-plugins-base "opus")
+      (plugin gst_all_1.gst-plugins-good "rtp")
+      (plugin gst_all_1.gst-plugins-good "rtpmanager")
+    ];
+in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codex";
   version = "0.162.1";
@@ -34,13 +73,34 @@ rustPlatform.buildRustPackage (finalAttrs: {
   src = fetchFromGitHub {
     owner = "openai";
     repo = "codex";
-    tag = "rust-v${finalAttrs.version}";
+    rev = finalAttrs.buildCommit;
     hash = "sha256-vYVQoXQdaK0bejUzcpf9uVrzNWWWAct9AsO/t261FAs=";
   };
 
+  # Matching client/helper stamps; build_id() requires a full commit SHA.
+  buildCommit = "092d3acd6bec3e3a14bdc7e7a2810ab628ab759d";
+
   sourceRoot = "${finalAttrs.src.name}/codex-rs";
 
   cargoHash = "sha256-UTu+ws1DqL375C+1jaVI9HBqDHnTuAQr7/h1rSzsEzg=";
+  # Disable bundled Opus so OPUS_LIB_DIR selects nixpkgs' libopus.
+  cargoDeps =
+    (rustPlatform.fetchCargoVendor {
+      inherit (finalAttrs)
+        pname
+        version
+        src
+        sourceRoot
+        ;
+      hash = finalAttrs.cargoHash;
+    }).overrideAttrs
+      (previousAttrs: {
+        buildCommand = previousAttrs.buildCommand + ''
+          chmod +w "$out/source-registry-0/opusic-sys-0.7.5/Cargo.toml"
+          substituteInPlace "$out/source-registry-0/opusic-sys-0.7.5/Cargo.toml" \
+            --replace-fail 'default = ["bundled"]' 'default = []'
+        '';
+      });
 
   __structuredAttrs = true;
 
@@ -51,15 +111,40 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "codex-cli"
     "--package"
     "codex-code-mode-host"
+  ]
+  ++ lib.optionals supportsVoice [
+    "--package"
+    "codex-voice-host"
   ];
   cargoCheckFlags = [
     "--package"
     "codex-cli"
     "--package"
     "codex-code-mode-host"
+  ]
+  ++ lib.optionals supportsVoice [
+    "--package"
+    "codex-voice-host"
   ];
 
   patches = [
+    # Allow declared store links through daemon package validation.
+    (replaceVars ./nix-package-layout.patch {
+      ps = lib.getExe ps;
+      packageLinkRoots = lib.concatStringsSep ":" (
+        [ (toString (lib.getBin ripgrep)) ]
+        ++ lib.optionals stdenv.hostPlatform.isLinux [ (toString (lib.getBin bubblewrap)) ]
+        ++ lib.optionals supportsVoice (map toString voiceRuntimeRoots)
+      );
+    })
+  ]
+  ++ lib.optionals supportsVoice [
+    # Likewise for the voice loader, independently of daemon mode.
+    (replaceVars ./nix-voice-runtime.patch {
+      voiceRuntimeRoots = lib.concatStringsSep ":" (map toString voiceRuntimeRoots);
+    })
+  ]
+  ++ [
     # https://github.com/openai/codex/issues/48195
     ./no-daemon_auto_start.patch
   ];
@@ -77,7 +162,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     cmake
     gitMinimal
     installShellFiles
-    makeBinaryWrapper
     pkg-config
   ];
 
@@ -85,6 +169,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
     libclang
     openssl
   ]
+  ++ lib.optionals supportsVoice [
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
+    libopus
+  ]
+  ++ lib.optionals (supportsVoice && stdenv.hostPlatform.isLinux) [
+    alsa-lib
+  ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     libcap
   ];
@@ -94,6 +187,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # stringop-overflow in BoringSSL's a_bitstr.cc) while keeping Clang's
   # character-conversion warning-as-error disabled.
   env = {
+    CODEX_BUILD_COMMIT = finalAttrs.buildCommit;
     LIBCLANG_PATH = "${lib.getLib libclang}/lib";
     NIX_CFLAGS_COMPILE = toString (
       lib.optionals stdenv.cc.isGNU [
@@ -105,6 +199,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     );
     RUSTY_V8_ARCHIVE = librusty_v8;
     RUSTY_V8_SRC_BINDING_PATH = librusty_v8_src_binding;
+    STABLE_GIT_COMMIT = finalAttrs.buildCommit;
+  }
+  // lib.optionalAttrs supportsVoice {
+    OPUS_LIB_DIR = "${lib.getLib libopus}/lib";
   }
   // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
     # Link with lld on Darwin. nixpkgs' classic open-source ld64 fails to insert
@@ -120,23 +218,50 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # the future once this software stabilizes.
   doCheck = false;
 
-  postInstall = lib.optionalString installShellCompletions ''
+  # Metadata enables voice package discovery even without a daemon.
+  # Patch ps and package rg/bwrap directly: a wrapper fails the daemon's
+  # staged-vs-running executable content check.
+  postInstall = ''
+    install -Dm444 \
+      ${
+        writeText "codex-package.json" (
+          builtins.toJSON {
+            layoutVersion = 1;
+            version = finalAttrs.version;
+            target = stdenv.hostPlatform.rust.rustcTarget;
+            variant = "codex";
+            entrypoint = "bin/codex";
+            resourcesDir = "codex-resources";
+          }
+        )
+      } \
+      $out/codex-package.json
+
+    # Daemon validation requires packaged rg/bwrap despite their PATH fallback.
+    install -d $out/codex-path
+    ln -s ${lib.getExe ripgrep} $out/codex-path/rg
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
+    install -d $out/codex-resources
+    ln -s ${lib.getExe bubblewrap} $out/codex-resources/bwrap
+  ''
+  + lib.optionalString supportsVoice ''
+    install -d $out/codex-resources/voice/bin
+    mv $out/bin/codex-voice-host $out/codex-resources/voice/bin/
+    cp -a ${voiceRuntime}/. $out/codex-resources/voice/
+  ''
+  + lib.optionalString installShellCompletions ''
     installShellCompletion --cmd codex \
       --bash <($out/bin/codex completion bash) \
       --fish <($out/bin/codex completion fish) \
       --zsh <($out/bin/codex completion zsh)
   '';
 
-  postFixup = ''
-    wrapProgram $out/bin/codex --prefix PATH : ${
-      lib.makeBinPath ([ ripgrep ] ++ lib.optionals stdenv.hostPlatform.isLinux [ bubblewrap ])
-    }
-  '';
-
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
 
   passthru.updateScript = _experimental-update-script-combinators.sequence [
+    ./update-build-commit.sh
     (nix-update-script {
       extraArgs = [
         "--use-github-releases"
@@ -147,6 +272,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ./update-librusty.sh
   ];
 
+  passthru.tests = {
+    app-server-daemon = callPackage ./test-app-server-daemon.nix { codex = finalAttrs.finalPackage; };
+  }
+  // lib.optionalAttrs supportsVoice {
+    voice-runtime = callPackage ./test-voice-runtime.nix { codex = finalAttrs.finalPackage; };
+  };
+
   meta = {
     description = "Lightweight coding agent that runs in your terminal";
     homepage = "https://github.com/openai/codex";
diff --git a/pkgs/by-name/co/codex/test-app-server-daemon.nix b/pkgs/by-name/co/codex/test-app-server-daemon.nix
new file mode 100644
index 000000000000..99d08212e3ab
--- /dev/null
+++ b/pkgs/by-name/co/codex/test-app-server-daemon.nix
@@ -0,0 +1,22 @@
+{
+  codex,
+  lib,
+  runCommand,
+}:
+let
+  codexBin = lib.getExe codex;
+in
+runCommand "${codex.name}-app-server-daemon-test"
+  {
+    meta.platforms = lib.platforms.linux;
+  }
+  ''
+    export CODEX_HOME="$TMPDIR/codex-home"
+    mkdir -p "$CODEX_HOME/app-server-daemon"
+    printf '%s\n' '{ "shutdownGraceSeconds": 0 }' > "$CODEX_HOME/app-server-daemon/settings.json"
+
+    ${codexBin} app-server daemon start
+    ${codexBin} app-server daemon stop
+
+    touch $out
+  ''
diff --git a/pkgs/by-name/co/codex/test-voice-runtime.nix b/pkgs/by-name/co/codex/test-voice-runtime.nix
new file mode 100644
index 000000000000..298ba206dabf
--- /dev/null
+++ b/pkgs/by-name/co/codex/test-voice-runtime.nix
@@ -0,0 +1,15 @@
+{
+  codex,
+  python3,
+  runCommand,
+}:
+runCommand "${codex.name}-voice-runtime-test"
+  {
+    nativeBuildInputs = [ python3 ];
+  }
+  ''
+    python3 ${./test-voice-runtime.py} \
+      ${codex} \
+      ${codex.buildCommit}
+    touch $out
+  ''
diff --git a/pkgs/by-name/co/codex/test-voice-runtime.py b/pkgs/by-name/co/codex/test-voice-runtime.py
new file mode 100644
index 000000000000..e7ff2ad07946
--- /dev/null
+++ b/pkgs/by-name/co/codex/test-voice-runtime.py
@@ -0,0 +1,71 @@
+import json
+import os
+from pathlib import Path
+import select
+import struct
+import subprocess
+import sys
+
+
+package = Path(sys.argv[1])
+build_commit = sys.argv[2]
+
+runtime_environment = {
+    "GST_PLUGIN_PATH": "",
+    "GST_PLUGIN_PATH_1_0": "",
+    "GST_PLUGIN_SYSTEM_PATH": "",
+    "GST_PLUGIN_SYSTEM_PATH_1_0": "",
+    "GST_REGISTRY": "/dev/null",
+    "GST_REGISTRY_UPDATE": "no",
+    "GST_REGISTRY_FORK": "no",
+}
+
+
+def frame(message: dict[str, object]) -> bytes:
+    payload = json.dumps(message, separators=(",", ":")).encode()
+    return struct.pack(">I", len(payload)) + payload
+
+
+def read_exact(stream: subprocess.Popen[bytes], size: int) -> bytes:
+    output = bytearray()
+    assert stream.stdout is not None
+    while len(output) < size:
+        readable, _, _ = select.select([stream.stdout], [], [], 10)
+        if not readable:
+            raise TimeoutError("voice helper response timed out")
+        chunk = os.read(stream.stdout.fileno(), size - len(output))
+        if not chunk:
+            raise EOFError("voice helper exited before replying")
+        output.extend(chunk)
+    return bytes(output)
+
+
+def exchange(stream: subprocess.Popen[bytes], message: dict[str, object]) -> object:
+    assert stream.stdin is not None
+    stream.stdin.write(frame(message))
+    stream.stdin.flush()
+    length = struct.unpack(">I", read_exact(stream, 4))[0]
+    return json.loads(read_exact(stream, length))
+
+
+environment = os.environ.copy()
+environment.update(runtime_environment)
+process = subprocess.Popen(
+    [package / "codex-resources/voice/bin/codex-voice-host"],
+    cwd=package,
+    env=environment,
+    stdin=subprocess.PIPE,
+    stdout=subprocess.PIPE,
+    stderr=subprocess.PIPE,
+    bufsize=0,
+)
+assert exchange(
+    process, {"type": "hello", "protocol": 1, "buildCommit": build_commit}
+) == {"type": "ready"}
+assert exchange(process, {"type": "initializeRuntime"}) == {"type": "runtimeReady"}
+assert exchange(process, {"type": "close"}) == {"type": "closed"}
+assert process.stdin is not None
+assert process.stderr is not None
+process.stdin.close()
+status = process.wait(timeout=10)
+assert status == 0, process.stderr.read().decode(errors="replace")
diff --git a/pkgs/by-name/co/codex/update-build-commit.sh b/pkgs/by-name/co/codex/update-build-commit.sh
new file mode 100755
index 000000000000..1962e9df2b7c
--- /dev/null
+++ b/pkgs/by-name/co/codex/update-build-commit.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq gnused
+# shellcheck shell=bash
+
+set -eu -o pipefail
+
+package_dir=$(dirname "$(readlink --canonicalize-existing "${BASH_SOURCE[0]}")")
+package_file="$package_dir/package.nix"
+release=$(curl ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} --silent --fail --location \
+  "https://api.github.com/repos/openai/codex/releases/latest")
+tag=$(jq --exit-status --raw-output '.tag_name' <<<"$release")
+commit=$(curl ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} --silent --fail --location \
+  "https://api.github.com/repos/openai/codex/commits/$tag" \
+  | jq --exit-status --raw-output '.sha')
+
+sed --in-place --regexp-extended \
+  "s|buildCommit = \"[0-9a-f]{40}\";|buildCommit = \"$commit\";|" \
+  "$package_file"
diff --git a/pkgs/by-name/co/colormake/package.nix b/pkgs/by-name/co/colormake/package.nix
index 2a352f0cad87..956426095036 100644
--- a/pkgs/by-name/co/colormake/package.nix
+++ b/pkgs/by-name/co/colormake/package.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Simple wrapper around make to colorize the output";
-    homepage = "https://bre.klaki.net/programs/colormake/";
+    homepage = "https://github.com/pagekite/Colormake";
     license = lib.licenses.gpl2;
     platforms = lib.platforms.unix;
   };
diff --git a/pkgs/by-name/co/colorpanes/package.nix b/pkgs/by-name/co/colorpanes/package.nix
index 7606aac7673f..32cf12da3240 100644
--- a/pkgs/by-name/co/colorpanes/package.nix
+++ b/pkgs/by-name/co/colorpanes/package.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "annaaurora";
     repo = "colorpanes";
     rev = "v${finalAttrs.version}";
-    sha256 = "qaOH+LXNDq+utwyI1yzHWNt25AvdAXCTAziGV9ElroU=";
+    hash = "sha256-qaOH+LXNDq+utwyI1yzHWNt25AvdAXCTAziGV9ElroU=";
   };
 
   cargoHash = "sha256-+ltcTuLksNwe7KIt8apYNZkMoA2w4EObG5dhJliRb6Y=";
diff --git a/pkgs/by-name/co/comic-neue/package.nix b/pkgs/by-name/co/comic-neue/package.nix
index c57c3661b2a9..7b601f6b8555 100644
--- a/pkgs/by-name/co/comic-neue/package.nix
+++ b/pkgs/by-name/co/comic-neue/package.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    homepage = "http://comicneue.com/";
+    homepage = "https://github.com/crozynski/comicneue";
     description = "Casual type face: Make your lemonade stand look like a fortune 500 company";
     longDescription = ''
       ComicNeue is inspired by Comic Sans but more regular. It was
diff --git a/pkgs/by-name/co/cook-cli/package.nix b/pkgs/by-name/co/cook-cli/package.nix
index 38cf3ca4e31d..0537066a5048 100644
--- a/pkgs/by-name/co/cook-cli/package.nix
+++ b/pkgs/by-name/co/cook-cli/package.nix
@@ -11,16 +11,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cook-cli";
-  version = "0.37.0";
+  version = "0.38.1";
 
   src = fetchFromGitHub {
     owner = "cooklang";
     repo = "cookcli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-tHPVKigUqHZo84E+2wnky21UQfE7bQ1ZB1vZZNPlm7E=";
+    hash = "sha256-XvEUpPrkgWxtBoInx6jM0gHF3igZcyf5ykR9Z3wQScc=";
   };
 
-  cargoHash = "sha256-DOXHQMYWyuArVwS+odyjImGCfzS4flNZM7NRSnLkLfc=";
+  cargoHash = "sha256-gbJo6qzj2c3tzZuEjP8/XxJQjbZrYbjZAWIkqfpwhiM=";
 
   # Build without the self-updating feature
   buildNoDefaultFeatures = true;
@@ -40,7 +40,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-n/pxjcgDqhlUC09ynWExxClVT9WixahpPYRU3GAvzBc=";
+    hash = "sha256-zAtFsSpJFdthb0E8FLVRGWzGcReDsZxZF+NvHZ+wcY4=";
   };
 
   preBuild = ''
diff --git a/pkgs/by-name/co/cosmic-comp/package.nix b/pkgs/by-name/co/cosmic-comp/package.nix
index 3c9665ec757b..1e32dcb5f675 100644
--- a/pkgs/by-name/co/cosmic-comp/package.nix
+++ b/pkgs/by-name/co/cosmic-comp/package.nix
@@ -11,12 +11,12 @@
   pixman,
   seatd,
   udev,
-  systemd,
+  systemdLibs,
   xrdb,
   nix-update-script,
   nixosTests,
 
-  useSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
+  useSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
   withXWayland ? true,
 }:
 
@@ -53,7 +53,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     seatd
     udev
   ]
-  ++ lib.optional useSystemd systemd;
+  ++ lib.optional useSystemd systemdLibs;
 
   makeFlags = [
     "prefix=${placeholder "out"}"
diff --git a/pkgs/by-name/co/cosmopolitan/package.nix b/pkgs/by-name/co/cosmopolitan/package.nix
index cd72590a18e3..6c68a1500736 100644
--- a/pkgs/by-name/co/cosmopolitan/package.nix
+++ b/pkgs/by-name/co/cosmopolitan/package.nix
@@ -80,6 +80,8 @@ stdenv.mkDerivation (finalAttrs: {
         "test/libc/calls/cachestat_test.c"
         "test/libc/calls/getprogramexecutablename_test.c"
         "test/libc/proc/posix_spawn_test.c"
+        # asserts st_blocks of a sparse file, which depends on the builder's filesystem
+        "test/tool/net/lunix_test.lua"
       ];
     in
     lib.concatStringsSep ";\n" (map (t: "rm -v ${t}") failingTests);
diff --git a/pkgs/by-name/co/cozy/package.nix b/pkgs/by-name/co/cozy/package.nix
index 4cb9fcfbb301..29e66f3446cc 100644
--- a/pkgs/by-name/co/cozy/package.nix
+++ b/pkgs/by-name/co/cozy/package.nix
@@ -75,7 +75,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   meta = {
     description = "Modern audio book player for Linux";
-    homepage = "https://cozy.geigi.de/";
+    homepage = "https://github.com/geigi/cozy";
     maintainers = with lib.maintainers; [
       makefu
       aleksana
diff --git a/pkgs/by-name/cr/crush/package.nix b/pkgs/by-name/cr/crush/package.nix
index 5090923c65d3..67911d5e46d3 100644
--- a/pkgs/by-name/cr/crush/package.nix
+++ b/pkgs/by-name/cr/crush/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   buildGo127Module,
   fetchFromGitHub,
+  git,
   installShellFiles,
   nix-update-script,
   writableTmpDirAsHomeHook,
@@ -11,16 +12,16 @@
 
 buildGo127Module (finalAttrs: {
   pname = "crush";
-  version = "0.96.1";
+  version = "0.98.1";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = "crush";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iaZ0rw9585iLVj+HSWCiQnaj2XZ+eYr6zprpUs/47z0=";
+    hash = "sha256-sz/jlpWH43pgUqKDzaRVKJPK2u7smJLoL2eNrGkXtOY=";
   };
 
-  vendorHash = "sha256-ADDHgngAChNch8Sp6Zltw52eSlk7swEQG+R4fCxDbY8=";
+  vendorHash = "sha256-yEV/cBQ2XsmbsYrSWiyEj/dznzSVrpY9QHXMpuw2lpc=";
 
   ldflags = [
     "-s"
@@ -46,7 +47,10 @@ buildGo127Module (finalAttrs: {
 
   __darwinAllowLocalNetworking = true;
 
-  nativeCheckInputs = [ writableTmpDirAsHomeHook ];
+  nativeCheckInputs = [
+    git
+    writableTmpDirAsHomeHook
+  ];
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
diff --git a/pkgs/by-name/cr/cryptopp/package.nix b/pkgs/by-name/cr/cryptopp/package.nix
index d1aaf2dbd1d1..1f8c01294b8e 100644
--- a/pkgs/by-name/cr/cryptopp/package.nix
+++ b/pkgs/by-name/cr/cryptopp/package.nix
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Free C++ class library of cryptographic schemes";
-    homepage = "https://cryptopp.com/";
+    homepage = "https://github.com/weidai11/cryptopp";
     changelog = [
       "https://raw.githubusercontent.com/weidai11/cryptopp/CRYPTOPP_${underscoredVersion}/History.txt"
       "https://github.com/weidai11/cryptopp/releases/tag/CRYPTOPP_${underscoredVersion}"
diff --git a/pkgs/by-name/cs/csol/package.nix b/pkgs/by-name/cs/csol/package.nix
index 501aa1489ecc..300b251cfa9f 100644
--- a/pkgs/by-name/cs/csol/package.nix
+++ b/pkgs/by-name/cs/csol/package.nix
@@ -30,6 +30,8 @@ stdenv.mkDerivation (finalAttrs: {
   ];
   buildInputs = [ ncurses ];
 
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-D_DARWIN_C_SOURCE";
+
   postFixup = ''
     wrapProgram $out/bin/csol \
       --add-flags "-c $out/etc/xdg/csol/csolrc"
diff --git a/pkgs/by-name/cx/cxxtools/package.nix b/pkgs/by-name/cx/cxxtools/package.nix
index bad3b441dcaf..262941f94da3 100644
--- a/pkgs/by-name/cx/cxxtools/package.nix
+++ b/pkgs/by-name/cx/cxxtools/package.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
   enableParallelBuilding = true;
 
   meta = {
-    homepage = "http://www.tntnet.org/cxxtools.html";
+    homepage = "https://github.com/maekitalo/cxxtools";
     description = "Comprehensive C++ class library for Unix and Linux";
     platforms = lib.platforms.linux;
     license = lib.licenses.lgpl21;
diff --git a/pkgs/by-name/da/dalfox/package.nix b/pkgs/by-name/da/dalfox/package.nix
index 4e0469d46494..dceaaae29585 100644
--- a/pkgs/by-name/da/dalfox/package.nix
+++ b/pkgs/by-name/da/dalfox/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dalfox";
-  version = "3.2.3";
+  version = "3.2.4";
 
   src = fetchFromGitHub {
     owner = "hahwul";
     repo = "dalfox";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NhYoxsV1xxCbteI691ld6rHdlBGyJr6yn0ZJvDHEt8w=";
+    hash = "sha256-sh4Occkkk3rK+NVCitO1KrcCf7TmueTwhc/3LhAfD4E=";
   };
 
-  cargoHash = "sha256-huOPIV2sblLQ5P5dO+qrBDl5F7LokTieyecjhjmhmP0=";
+  cargoHash = "sha256-KJwREnnqu0gAsGbDQX1rZmhKyJaKkMIjoWakbX9deX0=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/da/databricks-cli/package.nix b/pkgs/by-name/da/databricks-cli/package.nix
index 06284e99f7f5..1b31ee86bba7 100644
--- a/pkgs/by-name/da/databricks-cli/package.nix
+++ b/pkgs/by-name/da/databricks-cli/package.nix
@@ -9,7 +9,7 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "databricks-cli";
-  version = "1.18.0";
+  version = "1.20.0";
 
   __structuredAttrs = true;
 
@@ -17,10 +17,10 @@ buildGoModule (finalAttrs: {
     owner = "databricks";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-I0w62sVpL27gtnir8mZtGs6PbsNH8nwWc5JyCXfnlqI=";
+    hash = "sha256-RFtDUvoJskKikLQyunVo5DN0Hr5s/hlKjgl8Y+c2W48=";
   };
 
-  vendorHash = "sha256-6b++JxHIU6Zhv4357nEH4VHnCOty9KOMbwM6gVHU2qE=";
+  vendorHash = "sha256-moXbF1k1zg5DwVxysaK0ULYx7Ldh4V7SBt9PXI4NAdk=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/de/deadbeef/package.nix b/pkgs/by-name/de/deadbeef/package.nix
index 919017ab9d6b..c29fa77ed966 100644
--- a/pkgs/by-name/de/deadbeef/package.nix
+++ b/pkgs/by-name/de/deadbeef/package.nix
@@ -162,6 +162,7 @@ clangStdenv.mkDerivation (finalAttrs: {
     platforms = [
       "x86_64-linux"
       "i686-linux"
+      "riscv64-linux"
     ];
     maintainers = [ ];
   };
diff --git a/pkgs/by-name/de/dependabot-cli/package.nix b/pkgs/by-name/de/dependabot-cli/package.nix
index a8e98d93e3d8..d8e281ecd05b 100644
--- a/pkgs/by-name/de/dependabot-cli/package.nix
+++ b/pkgs/by-name/de/dependabot-cli/package.nix
@@ -12,20 +12,20 @@
 }:
 let
   pname = "dependabot-cli";
-  version = "1.93.0";
+  version = "1.94.0";
 
   # `tag` is what `dependabot` uses to find the relevant docker images.
   tag = "nixpkgs-dependabot-cli-${version}";
 
   # Get these hashes from
   # nix run nixpkgs#nix-prefetch-docker -- --image-name ghcr.io/dependabot/proxy --image-tag latest --final-image-name dependabot-update-job-proxy --final-image-tag ${tag}
-  updateJobProxy.imageDigest = "sha256:56d8f53a1ea2da7ddd61cc4c36e68cdd0c3ae8dfcc64bdc20979d28be6dbbf92";
-  updateJobProxy.hash = "sha256-wqeihcbVo+x/SXGqvjtccjrFu9seOAoY1zMLiTeVhxw=";
+  updateJobProxy.imageDigest = "sha256:a39e7ef7188c9a4b36692df47a0e8f876e83199e657cd0b6be00e736fbe03c2f";
+  updateJobProxy.hash = "sha256-5/2v869kKBjxhrhWz7M8eVqLfKghPZw8lbyazdOJ9bs=";
 
   # Get these hashes from
   # nix run nixpkgs#nix-prefetch-docker -- --image-name ghcr.io/dependabot/dependabot-updater-github-actions --image-tag latest --final-image-name dependabot-updater-github-actions --final-image-tag ${tag}
-  updaterGitHubActions.imageDigest = "sha256:75f4843d57695da308d73940c9d885cc57ed8f1fbaf96affdee38b260812dcad";
-  updaterGitHubActions.hash = "sha256-jL38pYoGFV6cpkzTVQn0UZ39gJvOBfQrI6ywefCNwMU=";
+  updaterGitHubActions.imageDigest = "sha256:463c173f72e3f1824d0255a864fc0e075e7704a58448973878ad8c1b94f79d52";
+  updaterGitHubActions.hash = "sha256-0zYX1raxkOU30hwLpXOzQQ747xt6WsCxgJY55nlJNlc=";
 in
 buildGoModule {
   inherit pname version;
@@ -34,10 +34,10 @@ buildGoModule {
     owner = "dependabot";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-5cVLfaAw9179JAWpCvXgEb2EmkwalPPKyBeQMgAC274=";
+    hash = "sha256-m7dyJqd1kmjcyqiVTKF/06VRrKHi0n+Gcqp9GDiPJgs=";
   };
 
-  vendorHash = "sha256-me7iH8XRAagnZFfijnWzCh3CZ3sbd1R7Xp8nFhTk0i4=";
+  vendorHash = "sha256-48OdlduXPRXzDmfTzM2Kn/gUpdYZ58TDQe5R30FiSDY=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/de/depot-cli/package.nix b/pkgs/by-name/de/depot-cli/package.nix
index 971821f4d51d..fbaf68991136 100644
--- a/pkgs/by-name/de/depot-cli/package.nix
+++ b/pkgs/by-name/de/depot-cli/package.nix
@@ -10,7 +10,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "depot-cli";
-  version = "2.102.14";
+  version = "2.102.19";
 
   __structuredAttrs = true;
   __darwinAllowLocalNetworking = true;
@@ -19,7 +19,7 @@ buildGoModule (finalAttrs: {
     owner = "depot";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9/XgZKG4amV04Mu9SPDVszsfAngDaCbRn+kZlu7fnKo=";
+    hash = "sha256-7LfluyZP8FL4OYG3/ovdiMJkm21EAkuSeqIISUjLrFs=";
   };
 
   vendorHash = "sha256-VCd0qdEmjuTB5HvQ9jEVoKKSKJpPxQ7iHOFQoifPIgY=";
diff --git a/pkgs/by-name/df/dfl-login1/package.nix b/pkgs/by-name/df/dfl-login1/package.nix
index 528b6687d933..51d169c45a35 100644
--- a/pkgs/by-name/df/dfl-login1/package.nix
+++ b/pkgs/by-name/df/dfl-login1/package.nix
@@ -6,7 +6,7 @@
   ninja,
   pkg-config,
   qt6,
-  systemd,
+  systemdLibs,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     qt6.qtbase
-    systemd
+    systemdLibs
   ];
 
   dontWrapQtApps = true;
diff --git a/pkgs/by-name/di/didu/package.nix b/pkgs/by-name/di/didu/package.nix
index 8bb7998517eb..3302fee980aa 100644
--- a/pkgs/by-name/di/didu/package.nix
+++ b/pkgs/by-name/di/didu/package.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "annaaurora";
     repo = "didu";
     rev = "v${finalAttrs.version}";
-    sha256 = "szYWRN1NZbfpshipwMMJSWJw/NG4w7I+aqwtmqpT0R0=";
+    hash = "sha256-szYWRN1NZbfpshipwMMJSWJw/NG4w7I+aqwtmqpT0R0=";
   };
 
   cargoHash = "sha256-NDri4VuTI/ZsY3ZvpWmu/2I5GpmldQaoUSzyjGlq9lE=";
diff --git a/pkgs/by-name/di/diffoscope/package.nix b/pkgs/by-name/di/diffoscope/package.nix
index c0a7887ff6ee..3858158f9d5a 100644
--- a/pkgs/by-name/di/diffoscope/package.nix
+++ b/pkgs/by-name/di/diffoscope/package.nix
@@ -112,12 +112,12 @@ in
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
 python.pkgs.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "332";
+  version = "333";
   pyproject = true;
 
   src = fetchurl {
     url = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    hash = "sha256-eNmrIxt0yQlby20WRXgKBVXZ2jNnNLpksOvr25dXJvI=";
+    hash = "sha256-KHjYLCd2f5DRQRhG0L97Og8b20dZUyJq4BtWShVKFos=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/di/discord/darwin.nix b/pkgs/by-name/di/discord/darwin.nix
index 50379bfb098e..59eec51f185d 100644
--- a/pkgs/by-name/di/discord/darwin.nix
+++ b/pkgs/by-name/di/discord/darwin.nix
@@ -102,8 +102,8 @@ stdenv.mkDerivation (finalAttrs: {
 
     ${lib.concatStringsSep "\n" (
       lib.mapAttrsToList (name: src: ''
-        mkdir -p "$out/Applications/${desktopName}.app/Contents/Resources/modules/${name}"
-        extractDistro ${src} "$out/Applications/${desktopName}.app/Contents/Resources/modules/${name}"
+        mkdir -p "$out/share/${pname}/modules/${name}"
+        extractDistro ${src} "$out/share/${pname}/modules/${name}"
       '') moduleSrcs
     )}
 
@@ -111,7 +111,7 @@ stdenv.mkDerivation (finalAttrs: {
     mkdir -p $out/bin
     makeWrapper "$out/Applications/${desktopName}.app/Contents/MacOS/${binaryName}" "$out/bin/${binaryName}" \
       ${lib.strings.optionalString disableUpdates "--run ${lib.getExe finalAttrs.disableBreakingUpdates}"} \
-      --run "${finalAttrs.stageModules} \"$out/Applications/${desktopName}.app/Contents/Resources/modules\"" \
+      --run "${finalAttrs.stageModules} \"$out/share/${pname}/modules\"" \
       --add-flags ${lib.escapeShellArg commandLineArgs}
 
     runHook postInstall
diff --git a/pkgs/by-name/di/discord/linux.nix b/pkgs/by-name/di/discord/linux.nix
index 392fc60771e6..4a57cf4f4d96 100644
--- a/pkgs/by-name/di/discord/linux.nix
+++ b/pkgs/by-name/di/discord/linux.nix
@@ -65,7 +65,6 @@
   libglvnd,
   libnotify,
   libxcomposite,
-  libunity,
   libva,
   libxcursor,
   libxext,
@@ -118,7 +117,6 @@ let
         libnotify
         libx11
         libxcomposite
-        libunity
         libuuid
         libva
         libxcursor
diff --git a/pkgs/by-name/dm/dmenu-mac/package.nix b/pkgs/by-name/dm/dmenu-mac/package.nix
new file mode 100644
index 000000000000..50b12880a1bc
--- /dev/null
+++ b/pkgs/by-name/dm/dmenu-mac/package.nix
@@ -0,0 +1,54 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  unzip,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "dmenu-mac";
+  version = "0.8.0";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  # Upstream builds with Xcode; install the signed and notarized release,
+  # like maccy and aerospace do, so the app keeps its Developer ID signature.
+  src = fetchurl {
+    url = "https://github.com/oNaiPs/dmenu-mac/releases/download/${finalAttrs.version}/dmenu-mac.zip";
+    hash = "sha256-6SIzisxQmjWIICb7Zva5RnnliM2Gf6TrVylCC2xZqLA=";
+  };
+
+  nativeBuildInputs = [ unzip ];
+
+  sourceRoot = ".";
+
+  dontConfigure = true;
+  dontBuild = true;
+  # Keep the Developer ID signature and notarization intact.
+  dontFixup = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/Applications $out/bin
+    cp -R dmenu-mac.app $out/Applications/
+    ln -s $out/Applications/dmenu-mac.app/Contents/Resources/dmenu-mac $out/bin/dmenu-mac
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Keyboard-only application launcher for macOS";
+    homepage = "https://github.com/oNaiPs/dmenu-mac";
+    changelog = "https://github.com/oNaiPs/dmenu-mac/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.gpl3Only;
+    maintainers = [ lib.maintainers.onaips ];
+    mainProgram = "dmenu-mac";
+    platforms = lib.platforms.darwin;
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+  };
+})
diff --git a/pkgs/by-name/dn/dnslink-std-go/package.nix b/pkgs/by-name/dn/dnslink-std-go/package.nix
deleted file mode 100644
index a94aa8567519..000000000000
--- a/pkgs/by-name/dn/dnslink-std-go/package.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  fetchFromGitHub,
-}:
-
-buildGoModule (finalAttrs: {
-  pname = "dnslink";
-  version = "0.6.0";
-  src = fetchFromGitHub {
-    owner = "dnslink-std";
-    repo = "go";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-aATnNDUogNS4jBoWxUAFYFMa2ZS0+th3XH+1KWqwfWQ=";
-  };
-  vendorHash = "sha256-RH55yfIO9jHLbjtEdUF5QpL5ILV5ctX2hBYBJWutmUA=";
-  doCheck = false; # Uses network, unsurprisingly.
-  meta = {
-    changelog = "https://github.com/dnslink-std/go/releases/tag/v${finalAttrs.version}";
-    description = "Reference implementation for DNSLink in golang";
-    homepage = "https://dnslink.org/";
-    license = lib.licenses.mit;
-    mainProgram = "dnslink";
-  };
-})
diff --git a/pkgs/by-name/dn/dnsmon-go/package.nix b/pkgs/by-name/dn/dnsmon-go/package.nix
deleted file mode 100644
index 2757812bf968..000000000000
--- a/pkgs/by-name/dn/dnsmon-go/package.nix
+++ /dev/null
@@ -1,32 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  fetchFromGitHub,
-  libpcap,
-}:
-
-buildGoModule {
-  pname = "dnsmon-go";
-  version = "0-unstable-2022-05-13";
-
-  src = fetchFromGitHub {
-    owner = "jonpulsifer";
-    repo = "dnsmon-go";
-    rev = "ec1d59f1f1314ce310ad4c04d2924e0ebd857f1d";
-    hash = "sha256-lAJ2bjs5VLzrHd09eFK4X0V/cCee2QsgdgiKq+y2c10=";
-  };
-
-  vendorHash = "sha256-aiX+NGUsFK0N9vC5baAHHMr28CbF5Xa4WgYLFFLBYTs=";
-
-  buildInputs = [
-    libpcap
-  ];
-
-  meta = {
-    description = "Tool to collect DNS traffic";
-    homepage = "https://github.com/jonpulsifer/dnsmon-go";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ fab ];
-    mainProgram = "dnsmon-go";
-  };
-}
diff --git a/pkgs/by-name/dr/drawio-headless/package.nix b/pkgs/by-name/dr/drawio-headless/package.nix
index 44349752154c..9fdd07d37e94 100644
--- a/pkgs/by-name/dr/drawio-headless/package.nix
+++ b/pkgs/by-name/dr/drawio-headless/package.nix
@@ -41,6 +41,6 @@ writeTextFile {
       tfc
     ];
     mainProgram = "drawio";
-    license = lib.licenses.mit; # Wrapper itself is MIT
+    inherit (drawio.meta) license;
   };
 }
diff --git a/pkgs/by-name/ds/dsview/package.nix b/pkgs/by-name/ds/dsview/package.nix
index 20f0fc1ae928..939193198248 100644
--- a/pkgs/by-name/ds/dsview/package.nix
+++ b/pkgs/by-name/ds/dsview/package.nix
@@ -57,6 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "GUI program for supporting various instruments from DreamSourceLab, including logic analyzer, oscilloscope, etc";
     mainProgram = "DSView";
+    mainDarwinApp = "DSView.app";
     homepage = "https://www.dreamsourcelab.com/";
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/ea/eas-cli/package.nix b/pkgs/by-name/ea/eas-cli/package.nix
index 3f61e5f469ea..69a2d1e6364d 100644
--- a/pkgs/by-name/ea/eas-cli/package.nix
+++ b/pkgs/by-name/ea/eas-cli/package.nix
@@ -11,12 +11,12 @@
   python3,
 }:
 let
-  version = "20.4.0";
+  version = "24.8.0";
   src = fetchFromGitHub {
     owner = "expo";
     repo = "eas-cli";
     rev = "v${version}";
-    hash = "sha256-WfzCV304xgTqiKBCsZc5rnzaC+UHA6c155FG+HWBY7s=";
+    hash = "sha256-HypTLf16HxL2Jile5ACulNJw8L6Xr+Bxgt6eNFRWYo8=";
 
     # Remove after upstream updates to Yarn 4.15
     # https://github.com/expo/eas-cli/blob/main/package.json#L38
@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   yarnOfflineCache = yarn-berry_4.fetchYarnBerryDeps {
     inherit src missingHashes;
-    hash = "sha256-Iqdk0MpXeiKm5hgF68XOKvl0a+5LpXsNNcelCcbfj3s=";
+    hash = "sha256-oSy6t6vDeFVfkUp6Dw5PNt1+6MXx2FQIEnzJCPW0ufw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/eg/egl-wayland/package.nix b/pkgs/by-name/eg/egl-wayland/package.nix
index ea05058a1bec..99d1cfc81c3e 100644
--- a/pkgs/by-name/eg/egl-wayland/package.nix
+++ b/pkgs/by-name/eg/egl-wayland/package.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "egl-wayland";
-  version = "1.1.23";
+  version = "1.1.24";
 
   outputs = [
     "out"
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "NVIDIA";
     repo = "egl-wayland";
     tag = finalAttrs.version;
-    hash = "sha256-M+s2R0vSDCEN9lMma6RiJTqzUgClnszwS4aKBJeBvFQ=";
+    hash = "sha256-FoDxYIFhjatrt+q1S24ZP6inFAvF4nNxfOb3MqAxr9M=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ei/eigen/package.nix b/pkgs/by-name/ei/eigen/package.nix
index 8b1c86f12fd8..7700878c1122 100644
--- a/pkgs/by-name/ei/eigen/package.nix
+++ b/pkgs/by-name/ei/eigen/package.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
   __structuredAttrs = true;
 
   meta = {
-    homepage = "https://eigen.tuxfamily.org";
+    homepage = "https://libeigen.gitlab.io/";
     description = "C++ template library for linear algebra: vectors, matrices, and related algorithms";
     license = lib.licenses.lgpl3Plus;
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/ei/eigen2/package.nix b/pkgs/by-name/ei/eigen2/package.nix
index 660d758f827f..b8d59d996eb2 100644
--- a/pkgs/by-name/ei/eigen2/package.nix
+++ b/pkgs/by-name/ei/eigen2/package.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [ ./cmake-4-build.patch ];
 
   meta = {
-    homepage = "https://eigen.tuxfamily.org";
+    homepage = "https://libeigen.gitlab.io/";
     description = "C++ template library for linear algebra: vectors, matrices, and related algorithms";
     license = lib.licenses.lgpl3Plus;
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/ei/eigen_3_4_0/package.nix b/pkgs/by-name/ei/eigen_3_4_0/package.nix
index 774c9e89e651..b92fc2660b7b 100644
--- a/pkgs/by-name/ei/eigen_3_4_0/package.nix
+++ b/pkgs/by-name/ei/eigen_3_4_0/package.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ cmake ];
 
   meta = {
-    homepage = "https://eigen.tuxfamily.org";
+    homepage = "https://libeigen.gitlab.io/";
     description = "C++ template library for linear algebra: vectors, matrices, and related algorithms";
     license = lib.licenses.lgpl3Plus;
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/ei/eigen_5/package.nix b/pkgs/by-name/ei/eigen_5/package.nix
index 83c2928b6eb6..a3af1ffc779a 100644
--- a/pkgs/by-name/ei/eigen_5/package.nix
+++ b/pkgs/by-name/ei/eigen_5/package.nix
@@ -64,7 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
   passthru.updateScript = nix-update-script { };
 
   meta = {
-    homepage = "https://eigen.tuxfamily.org";
+    homepage = "https://libeigen.gitlab.io/";
     description = "C++ template library for linear algebra: vectors, matrices, and related algorithms";
     changelog = "https://gitlab.com/libeigen/eigen/-/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.lgpl3Plus;
diff --git a/pkgs/by-name/en/envision/package.nix b/pkgs/by-name/en/envision/package.nix
index 830615a493de..35c0e2a67ac5 100644
--- a/pkgs/by-name/en/envision/package.nix
+++ b/pkgs/by-name/en/envision/package.nix
@@ -94,7 +94,7 @@ buildFHSEnv {
         openxr-loader
         pipewire
         pulseaudio
-        systemd
+        systemdLibs
         vulkan-loader
         x264
       ])
diff --git a/pkgs/by-name/et/eternal-terminal/cmake-cxx-version.patch b/pkgs/by-name/et/eternal-terminal/cmake-cxx-version.patch
new file mode 100644
index 000000000000..5f8d69219f40
--- /dev/null
+++ b/pkgs/by-name/et/eternal-terminal/cmake-cxx-version.patch
@@ -0,0 +1,11 @@
+--- result/CMakeLists.txt	1970-01-01 01:00:01.000000000 +0100
++++ ./CMakeLists.txt	2026-10-02 01:44:39.238936270 +0200
+@@ -249,7 +250,7 @@
+ endif()
+ 
+ # Enable C++-17
+-set(CMAKE_CXX_STANDARD 17)
++set(CMAKE_CXX_STANDARD 20)
+ set(CMAKE_CXX_STANDARD_REQUIRED ON)
+ 
+ # Enable compile commands export for vscode
diff --git a/pkgs/by-name/et/eternal-terminal/package.nix b/pkgs/by-name/et/eternal-terminal/package.nix
index 399a1d539608..3e5488c92d07 100644
--- a/pkgs/by-name/et/eternal-terminal/package.nix
+++ b/pkgs/by-name/et/eternal-terminal/package.nix
@@ -24,6 +24,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-uZnjtSubTljFlbIZEznfEmNRaUWsuZotRapn0wexkow=";
   };
 
+  patches = [
+    ./cmake-cxx-version.patch
+    ./thread-pool-c++20-result-of.patch
+  ];
+
   nativeBuildInputs = [
     cmake
   ];
@@ -47,10 +52,6 @@ stdenv.mkDerivation (finalAttrs: {
     "-DDISABLE_CRASH_LOG=TRUE"
   ];
 
-  env = lib.optionalAttrs stdenv.cc.isClang {
-    CXXFLAGS = toString [ "-std=c++17" ];
-  };
-
   doCheck = true;
   doInstallCheck = true;
 
diff --git a/pkgs/by-name/et/eternal-terminal/thread-pool-c++20-result-of.patch b/pkgs/by-name/et/eternal-terminal/thread-pool-c++20-result-of.patch
new file mode 100644
index 000000000000..da7df85a9be4
--- /dev/null
+++ b/pkgs/by-name/et/eternal-terminal/thread-pool-c++20-result-of.patch
@@ -0,0 +1,30 @@
+--- 1/external_imported/ThreadPool/ThreadPool.h
++++ 2/external_imported/ThreadPool/ThreadPool.h
+@@ -10,13 +10,14 @@
+ #include <future>
+ #include <functional>
+ #include <stdexcept>
++#include <type_traits>
+ 
+ class ThreadPool {
+ public:
+     ThreadPool(size_t);
+     template<class F, class... Args>
+     auto enqueue(F&& f, Args&&... args) 
+-        -> std::future<typename std::result_of<F(Args...)>::type>;
++        -> std::future<typename std::invoke_result<F, Args...>::type>;
+     ~ThreadPool();
+ private:
+     // need to keep track of threads so we can join them
+@@ -61,9 +62,9 @@ inline ThreadPool::ThreadPool(size_t threads)
+ // add new work item to the pool
+ template<class F, class... Args>
+ auto ThreadPool::enqueue(F&& f, Args&&... args) 
+-    -> std::future<typename std::result_of<F(Args...)>::type>
++    -> std::future<typename std::invoke_result<F, Args...>::type>
+ {
+-    using return_type = typename std::result_of<F(Args...)>::type;
++    using return_type = typename std::invoke_result<F, Args...>::type;
+ 
+     auto task = std::make_shared< std::packaged_task<return_type()> >(
+             std::bind(std::forward<F>(f), std::forward<Args>(args)...)
diff --git a/pkgs/by-name/ev/evans/package.nix b/pkgs/by-name/ev/evans/package.nix
index 5d66dfad7e8f..2cf754f8119a 100644
--- a/pkgs/by-name/ev/evans/package.nix
+++ b/pkgs/by-name/ev/evans/package.nix
@@ -22,7 +22,7 @@ buildGoModule (finalAttrs: {
   meta = {
     description = "More expressive universal gRPC client";
     mainProgram = "evans";
-    homepage = "https://evans.syfm.me/";
+    homepage = "https://github.com/ktr0731/evans";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ diogox ];
   };
diff --git a/pkgs/by-name/ev/evcc/package.nix b/pkgs/by-name/ev/evcc/package.nix
index 0df3e2e36afd..fc9bca5a58e2 100644
--- a/pkgs/by-name/ev/evcc/package.nix
+++ b/pkgs/by-name/ev/evcc/package.nix
@@ -17,13 +17,13 @@
 }:
 
 let
-  version = "0.317.0";
+  version = "0.317.1";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = "evcc";
     tag = version;
-    hash = "sha256-3M3R/rqHgcoWHZ8qaK2Hhrp9+lJfwiOK+zk9A6DN81c=";
+    hash = "sha256-wtqqmmhb0zdwmA+aYPTEK/mMK8lQefJgJxmZEBu2Ayc=";
   };
 
   vendorHash = "sha256-0u3qIry84kZoj/pqL20uaVn2p+vRfmT5lYY43G0q9RI=";
diff --git a/pkgs/by-name/ev/everest-bin/package.nix b/pkgs/by-name/ev/everest-bin/package.nix
index 573827cf4fbb..13a6cb3892ac 100644
--- a/pkgs/by-name/ev/everest-bin/package.nix
+++ b/pkgs/by-name/ev/everest-bin/package.nix
@@ -8,15 +8,15 @@
 
 let
   pname = "everest";
-  version = "6580";
+  version = "6623";
   phome = "$out/lib/Celeste";
 in
 stdenvNoCC.mkDerivation {
   inherit pname version;
   src = fetchzip {
-    url = "https://github.com/EverestAPI/Everest/releases/download/stable-1.6580.0/main.zip";
+    url = "https://github.com/EverestAPI/Everest/releases/download/stable-1.6623.0/main.zip";
     extension = "zip";
-    hash = "sha256-O2/VfrP53HtA7ajsrlfalAsvYvjY4ABCYWCOwUKYio0=";
+    hash = "sha256-nGQggGBSEq/NAaE3AKau6BAFrWIUtKIt4Nswi4clXOM=";
   };
   buildInputs = [
     icu
diff --git a/pkgs/by-name/ev/everest/package.nix b/pkgs/by-name/ev/everest/package.nix
index d88af39198ba..329ff88cc1a3 100644
--- a/pkgs/by-name/ev/everest/package.nix
+++ b/pkgs/by-name/ev/everest/package.nix
@@ -11,8 +11,8 @@
 
 let
   pname = "everest";
-  version = "6580";
-  rev = "082e21b0b6dd7ff7c96d65b2ca2c632f4fd8df75";
+  version = "6623";
+  rev = "47d6a61fa918c17b8085b93b61ee59a7465968f8";
   phome = "$out/lib/Celeste";
 in
 buildDotnetModule {
@@ -25,7 +25,7 @@ buildDotnetModule {
     fetchSubmodules = true;
     # TODO: use leaveDotGit = true and modify external/MonoMod in postFetch to please SourceLink
     # Microsoft.SourceLink.Common.targets(53,5): warning : Source control information is not available - the generated source link is empty.
-    hash = "sha256-SGcrNjKiLlUik7dsGN9JkBd0TCtKUYRBp+q9ET0v3oo=";
+    hash = "sha256-u21rht+XimQ557RP1Sy3xhGzfhwcbvFRHw12HGccIFg=";
   };
 
   nativeBuildInputs = [ autoPatchelfHook ];
diff --git a/pkgs/by-name/ex/exodus/package.nix b/pkgs/by-name/ex/exodus/package.nix
index 0294e7751c55..64d1bb88d2db 100644
--- a/pkgs/by-name/ex/exodus/package.nix
+++ b/pkgs/by-name/ex/exodus/package.nix
@@ -4,7 +4,7 @@
   requireFile,
   unzip,
   glib,
-  systemd,
+  systemdLibs,
   nss,
   nspr,
   gtk3-x11,
@@ -95,7 +95,7 @@ stdenv.mkDerivation (finalAttrs: {
         at-spi2-core
         cups.lib
         libpulseaudio
-        systemd
+        systemdLibs
         vivaldi-ffmpeg-codecs
         libxkbcommon
         libgbm
diff --git a/pkgs/by-name/fa/fable/package.nix b/pkgs/by-name/fa/fable/package.nix
index df4d3cf7ffc2..0fbee50db548 100644
--- a/pkgs/by-name/fa/fable/package.nix
+++ b/pkgs/by-name/fa/fable/package.nix
@@ -7,9 +7,9 @@
 
 buildDotnetGlobalTool (finalAttrs: {
   pname = "fable";
-  version = "5.18.0";
+  version = "5.20.0";
 
-  nugetHash = "sha256-zaa7UJnn5IM7fhGUBmogRUDe/2rpH79UR+k6dym7kmQ=";
+  nugetHash = "sha256-sMzIlCx/XiCTqFq/3N2naZXX7HbSsq74F48D6aMDqpg=";
 
   dotnet-sdk = dotnetCorePackages.sdk_10_0;
   dotnet-runtime = dotnetCorePackages.runtime_10_0;
diff --git a/pkgs/by-name/fa/fastd/package.nix b/pkgs/by-name/fa/fastd/package.nix
index 6c53a65b74b4..386e5d5dffa5 100644
--- a/pkgs/by-name/fa/fastd/package.nix
+++ b/pkgs/by-name/fa/fastd/package.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Fast and Secure Tunneling Daemon";
-    homepage = "https://projects.universe-factory.net/projects/fastd/wiki";
+    homepage = "https://fastd.readthedocs.io/";
     license = with lib.licenses; [
       bsd2
       bsd3
diff --git a/pkgs/by-name/fb/fbset/package.nix b/pkgs/by-name/fb/fbset/package.nix
index b774a3906eca..cee8247b4edd 100644
--- a/pkgs/by-name/fb/fbset/package.nix
+++ b/pkgs/by-name/fb/fbset/package.nix
@@ -33,10 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Framebuffer device maintenance program";
-    # NOTE: the website of the original author disappeared, the only remaining
-    # repository is maintained by the debian maintainer of the package at
-    # https://github.com/sudipm-mukherjee/fbset
-    homepage = "http://users.telenet.be/geertu/Linux/fbdev/";
+    homepage = "https://github.com/sudipm-mukherjee/fbset";
     license = lib.licenses.gpl2Only;
     mainProgram = "fbset";
     maintainers = with lib.maintainers; [ baloo ];
diff --git a/pkgs/by-name/fe/feishu/package.nix b/pkgs/by-name/fe/feishu/package.nix
index ebf04b023ce9..0c04b3f4c445 100644
--- a/pkgs/by-name/fe/feishu/package.nix
+++ b/pkgs/by-name/fe/feishu/package.nix
@@ -53,7 +53,7 @@
   pipewire,
   pixman,
   stdenv,
-  systemd,
+  systemdLibs,
   wayland,
   xdg-utils,
   writeScript,
@@ -127,7 +127,7 @@ let
     pipewire
     pixman
     stdenv.cc.cc
-    systemd
+    systemdLibs
     wayland
     xdg-utils
   ];
diff --git a/pkgs/by-name/fi/fixedsys-excelsior/package.nix b/pkgs/by-name/fi/fixedsys-excelsior/package.nix
index f0d4154b98fd..1549d1b19a9b 100644
--- a/pkgs/by-name/fi/fixedsys-excelsior/package.nix
+++ b/pkgs/by-name/fi/fixedsys-excelsior/package.nix
@@ -24,7 +24,7 @@ stdenvNoCC.mkDerivation rec {
   '';
 
   meta = {
-    homepage = "http://www.fixedsysexcelsior.com/";
+    homepage = "https://github.com/chrissimpkins/codeface";
     description = "Pan-unicode version of Fixedsys, a classic DOS font";
     platforms = lib.platforms.all;
     license = lib.licenses.publicDomain;
diff --git a/pkgs/by-name/fl/florist/package.nix b/pkgs/by-name/fl/florist/package.nix
index 712bdd17f597..c6f21d8d9a55 100644
--- a/pkgs/by-name/fl/florist/package.nix
+++ b/pkgs/by-name/fl/florist/package.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Posix Ada Bindings";
     homepage = "https://github.com/adacore/florist";
-    license = lib.licenses.mit;
+    license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ lutzberger ];
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/by-name/fo/forecast/package.nix b/pkgs/by-name/fo/forecast/package.nix
index 37ca504f2eff..41a6f02abb4b 100644
--- a/pkgs/by-name/fo/forecast/package.nix
+++ b/pkgs/by-name/fo/forecast/package.nix
@@ -16,13 +16,14 @@
 
 rustPlatform.buildRustPackage {
   pname = "forecast";
-  version = "0-unstable-2026-09-29";
+  version = "0-unstable-2026-10-01";
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "cosmic-utils";
     repo = "forecast";
-    rev = "5e4d33ebe06eae86612213c1cd153b3de0cbeb05";
-    hash = "sha256-ESjZ1N/tZxJ44DE0YBOqxboU4QQCxYymzYmJ6J/DCxM=";
+    rev = "86b44fa1643e72e127933a8a7e9599b84d4c73b5";
+    hash = "sha256-acr3o76CQoJAMXvFGl6y6gcoiJlbOS9f5xS3SxnhueQ=";
   };
 
   cargoHash = "sha256-S27A8pn+mrbUmuo5Wd1C9R9r6UxGFAAL9od6tpsBWPY=";
diff --git a/pkgs/by-name/fo/forgejo-mcp/package.nix b/pkgs/by-name/fo/forgejo-mcp/package.nix
index dc0dd473817e..e3c7676fa879 100644
--- a/pkgs/by-name/fo/forgejo-mcp/package.nix
+++ b/pkgs/by-name/fo/forgejo-mcp/package.nix
@@ -8,17 +8,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "forgejo-mcp";
-  version = "3.0.1";
+  version = "3.2.0";
 
   # Plain git fetch: upstream's Forgejo instance has source-archive
   # downloads disabled, so fetchFromForgejo (tarball-based) cannot be used.
   src = fetchgit {
     url = "https://git.b4mad.industries/agentic-forges/forgejo-mcp.git";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Cq99Bj9I9oXM00fL9IBGq/EKj7Jv/fODffohR8APeik=";
+    hash = "sha256-dZ7k2c0abejHuwdRkXcOMKCnDeY193PYkIg0LVzbvII=";
   };
 
-  vendorHash = "sha256-Za1lwQQr+qeMIokRLSn2ywRg+5GxMS4KEg+99P1YHy0=";
+  vendorHash = "sha256-3RFWaohlUd6RpU531/DQH5wgVtjOi/Lh19Hyget7Bhw=";
 
   ldflags = [
     "-s"
@@ -40,7 +40,10 @@ buildGoModule (finalAttrs: {
     homepage = "https://git.b4mad.industries/agentic-forges/forgejo-mcp";
     changelog = "https://git.b4mad.industries/agentic-forges/forgejo-mcp/src/tag/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ malik ];
+    maintainers = with lib.maintainers; [
+      malik
+      byteflavour
+    ];
     mainProgram = "forgejo-mcp";
   };
 })
diff --git a/pkgs/by-name/fo/fosrl-newt/package.nix b/pkgs/by-name/fo/fosrl-newt/package.nix
index edd0317d2dc5..78ed0cf77c0e 100644
--- a/pkgs/by-name/fo/fosrl-newt/package.nix
+++ b/pkgs/by-name/fo/fosrl-newt/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "newt";
-  version = "1.18.0";
+  version = "1.18.1";
 
   src = fetchFromGitHub {
     owner = "fosrl";
     repo = "newt";
     tag = finalAttrs.version;
-    hash = "sha256-1ZS3KmEldOq2r+p4ayF852IS94/Wmkhqdw/Jx/W0Wcg=";
+    hash = "sha256-rzovIgrVKzO3sJFoRYdDWthFUF2anUOoXVSAmGCX4yk=";
   };
 
-  vendorHash = "sha256-VOXZWcPnBSc8EKYLKhsrQTHSjXvpaEYoewYLCxJ8Nk8=";
+  vendorHash = "sha256-Ijuc5/1Pv//6Z+tFgkHGe1W1Bw7q6WNTPCwukk91414=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 
diff --git a/pkgs/by-name/fo/fosrl-olm/package.nix b/pkgs/by-name/fo/fosrl-olm/package.nix
index c50a3040218f..2b7b7edbbab0 100644
--- a/pkgs/by-name/fo/fosrl-olm/package.nix
+++ b/pkgs/by-name/fo/fosrl-olm/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "olm";
-  version = "1.10.0";
+  version = "1.10.1";
 
   src = fetchFromGitHub {
     owner = "fosrl";
     repo = "olm";
     tag = finalAttrs.version;
-    hash = "sha256-A3SpDzl/cW/4tCVFWrRpWoaLmBD8J3eniKf/p9ZX/g8=";
+    hash = "sha256-/FhfpVwBEwx7HoaTzdgqSdN0rd2rqkx/FwC+GWofSlo=";
   };
 
-  vendorHash = "sha256-p4ClY6MT7JNGYI4qOdLBAGyyEAqW4DVlwRta+xSmd9E=";
+  vendorHash = "sha256-L0317eHaf0mt79kcquIh1IN5vVsGn3XyVQC6rdrayPA=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 
diff --git a/pkgs/by-name/fr/freenect/package.nix b/pkgs/by-name/fr/freenect/package.nix
index 96de60571fe8..4f7d2fc8a9dc 100644
--- a/pkgs/by-name/fr/freenect/package.nix
+++ b/pkgs/by-name/fr/freenect/package.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Drivers and libraries for the Xbox Kinect device on Windows, Linux, and macOS";
-    homepage = "http://openkinect.org";
+    homepage = "https://github.com/OpenKinect/libfreenect";
     license = with lib.licenses; [
       gpl2
       asl20
diff --git a/pkgs/by-name/fr/frida-tools/package.nix b/pkgs/by-name/fr/frida-tools/package.nix
index c432e3780099..54cb3e99a6e5 100644
--- a/pkgs/by-name/fr/frida-tools/package.nix
+++ b/pkgs/by-name/fr/frida-tools/package.nix
@@ -6,13 +6,13 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "frida-tools";
-  version = "14.10.4";
+  version = "14.11.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) version;
     pname = "frida_tools";
-    hash = "sha256-eixUS1RdCVBA//vTdoooekJjQ9rYkJW0ok9LIDgtkmo=";
+    hash = "sha256-uMdy5ZUCvkO3bfn+zK3V00K1yjJQZt0MI4TmP6iNqSE=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/fx/fxlinuxprint/package.nix b/pkgs/by-name/fx/fxlinuxprint/package.nix
index be2b75c669fa..f89af12cb5d6 100644
--- a/pkgs/by-name/fx/fxlinuxprint/package.nix
+++ b/pkgs/by-name/fx/fxlinuxprint/package.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
       DocuCentre-VI C2271/C3370/C3371/C4471/C5571/C6671/C7771
       DocuPrint 3205 d/3208 d/3505 d/3508 d/4405 d/4408 d
     '';
-    homepage = "https://onlinesupport.fujixerox.com";
+    homepage = "https://support-fb.fujifilm.com/";
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     maintainers = [ ];
diff --git a/pkgs/by-name/fx/fxlinuxprintutil/package.nix b/pkgs/by-name/fx/fxlinuxprintutil/package.nix
index 2bc0a978e924..119d5de7e92c 100644
--- a/pkgs/by-name/fx/fxlinuxprintutil/package.nix
+++ b/pkgs/by-name/fx/fxlinuxprintutil/package.nix
@@ -78,7 +78,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Optional configuration tool for fxlinuxprint";
-    homepage = "https://onlinesupport.fujixerox.com";
+    homepage = "https://support-fb.fujifilm.com/";
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     maintainers = [ ];
diff --git a/pkgs/by-name/fz/fzf/package.nix b/pkgs/by-name/fz/fzf/package.nix
index ef3e4c9f499f..7c23e0c4e80e 100644
--- a/pkgs/by-name/fz/fzf/package.nix
+++ b/pkgs/by-name/fz/fzf/package.nix
@@ -11,7 +11,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "fzf";
-  version = "0.74.4";
+  version = "0.74.5";
 
   __structuredAttrs = true;
 
@@ -19,7 +19,7 @@ buildGoModule (finalAttrs: {
     owner = "junegunn";
     repo = "fzf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QQ4hwbTeZ6MSojjCFn7dlISz1aGQbewGq4wnfs3/4K0=";
+    hash = "sha256-+v3oSlf3HBpPkNqS3QxRV/B1yHYb07/a70WYuS0aopY=";
   };
 
   vendorHash = "sha256-NojjUf/3c4q4B96eQ/qcI+GdRvHakHUyMRaQ6/IZpEw=";
diff --git a/pkgs/by-name/ga/game-devices-udev-rules/package.nix b/pkgs/by-name/ga/game-devices-udev-rules/package.nix
index 12d0a898d999..46a5059951e6 100644
--- a/pkgs/by-name/ga/game-devices-udev-rules/package.nix
+++ b/pkgs/by-name/ga/game-devices-udev-rules/package.nix
@@ -1,45 +1,53 @@
 {
   lib,
   stdenv,
-  fetchFromCodeberg,
   bash,
+  fetchFromCodeberg,
+  meson,
+  ninja,
+  nix-update-script,
   udevCheckHook,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "game-devices-udev-rules";
-  version = "1.0";
+  version = "1.1";
+
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src = fetchFromCodeberg {
     owner = "fabiscafe";
     repo = "game-devices-udev";
     tag = finalAttrs.version;
-    hash = "sha256-J4LfRifTqBM+B/dryLHERaVa1UUWEbfjEUj+exCFVsU=";
+    hash = "sha256-EWEfmKSSnJqVYx8oTxJu2el7bA6hEngHQ0a0kiffdNA=";
   };
 
+  postPatch = ''
+    substituteInPlace src/powera-gdu.rules \
+      --replace-fail '"/bin/sh -c' '"${lib.getExe bash} -c'
+  '';
+
   nativeBuildInputs = [
+    meson
+    ninja
     udevCheckHook
   ];
 
   doInstallCheck = true;
-
-  postInstall = ''
-    install -Dm444 -t "$out/lib/udev/rules.d" src/*.rules
-    substituteInPlace $out/lib/udev/rules.d/powera-gdu.rules \
-      --replace-fail "/bin/sh" "${bash}/bin/bash"
-  '';
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Udev rules to make supported controllers available with user-grade permissions";
-    homepage = "https://codeberg.org/fabiscafe/game-devices-udev";
-    license = lib.licenses.mit;
     longDescription = ''
       These udev rules are intended to be used as a package under 'services.udev.packages'.
       They will not be activated if installed as 'environment.systemPackages' or 'users.user.<user>.packages'.
-
       Additionally, you may need to enable 'hardware.uinput'.
     '';
-    platforms = lib.platforms.linux;
+    homepage = "https://codeberg.org/fabiscafe/game-devices-udev";
+    changelog = "https://codeberg.org/fabiscafe/game-devices-udev/src/tag/${finalAttrs.version}/NEWS.md";
+    license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ keenanweaver ];
+    platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/by-name/ga/gamemode/package.nix b/pkgs/by-name/ga/gamemode/package.nix
index ed512d32f76a..f260059dde5e 100644
--- a/pkgs/by-name/ga/gamemode/package.nix
+++ b/pkgs/by-name/ga/gamemode/package.nix
@@ -9,7 +9,7 @@
   pkg-config,
   dbus,
   inih,
-  systemd,
+  systemdLibs,
   appstream,
   findutils,
   gawk,
@@ -65,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     dbus
     inih
-    systemd
+    systemdLibs
   ];
 
   mesonFlags = [
diff --git a/pkgs/by-name/ge/genimage/package.nix b/pkgs/by-name/ge/genimage/package.nix
index c7a9d80a72f4..5fa6e839fe27 100644
--- a/pkgs/by-name/ge/genimage/package.nix
+++ b/pkgs/by-name/ge/genimage/package.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     broken = stdenv.hostPlatform.isDarwin;
-    homepage = "https://git.pengutronix.de/cgit/genimage";
+    homepage = "https://github.com/pengutronix/genimage";
     description = "Generate filesystem images from directory trees";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/ge/genymotion/package.nix b/pkgs/by-name/ge/genymotion/package.nix
index 08b406a5b03c..55a128b9f1dd 100644
--- a/pkgs/by-name/ge/genymotion/package.nix
+++ b/pkgs/by-name/ge/genymotion/package.nix
@@ -15,7 +15,7 @@
   libxrender,
   fontconfig,
   freetype,
-  systemd,
+  systemdLibs,
   libpulseaudio,
   cairo,
   gdk-pixbuf,
@@ -46,7 +46,7 @@ let
     libxrender
     fontconfig
     freetype
-    systemd
+    systemdLibs
     libpulseaudio
     cairo
     gdk-pixbuf
diff --git a/pkgs/by-name/gh/gh-stack/package.nix b/pkgs/by-name/gh/gh-stack/package.nix
index c5652e927b7c..f223a4c1bf79 100644
--- a/pkgs/by-name/gh/gh-stack/package.nix
+++ b/pkgs/by-name/gh/gh-stack/package.nix
@@ -10,7 +10,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "gh-stack";
-  version = "0.1.1";
+  version = "0.2.1";
 
   __structuredAttrs = true;
 
@@ -18,10 +18,15 @@ buildGoModule (finalAttrs: {
     owner = "github";
     repo = "gh-stack";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jwfqiCnCOOW0AKA52hbgvCCoLzfFX+QfM+vXABkzZgw=";
+    hash = "sha256-Mq4jAqeSHDuCiDYSa40okrq06UhC3dZGjgCXJKMbgzU=";
   };
 
-  vendorHash = "sha256-0Xtr/MOpX4u5GnbRdNxKPA0GpSzi8PIbVc9MmP05De4=";
+  vendorHash = "sha256-TC1mSXYjOQo00fb2yuGdk1rl6z6rp0WT3AmzXomPzis=";
+
+  # the go-modules derivation inherits the installAgentSkills hook but has no pname
+  overrideModAttrs = _: {
+    dontInstallAgentSkills = true;
+  };
 
   ldflags = [
     "-s"
@@ -34,6 +39,11 @@ buildGoModule (finalAttrs: {
 
   nativeCheckInputs = [ gitMinimal ];
 
+  # some tests resolve branches through git and need to run inside a repository
+  preCheck = ''
+    git init --quiet
+  '';
+
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
 
diff --git a/pkgs/by-name/gi/git-credential-gopass/package.nix b/pkgs/by-name/gi/git-credential-gopass/package.nix
index 2c9ec2ea8619..ba59675c1cb3 100644
--- a/pkgs/by-name/gi/git-credential-gopass/package.nix
+++ b/pkgs/by-name/gi/git-credential-gopass/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "git-credential-gopass";
-  version = "1.17.0";
+  version = "1.17.3";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
     repo = "git-credential-gopass";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-V+SEkV4I925S6sL9YC0QtEp76xENUaQO+XixWzsSqvs=";
+    hash = "sha256-aVH4C8KVJusUxgU+EtQSdlV432y2fB6M215i1jHzY70=";
   };
 
-  vendorHash = "sha256-OgwsQQRaJSwdh0+n1FdqAJzJ4pyggaejwg7oMEzEd9Q=";
+  vendorHash = "sha256-vjKqYKycTcal6YQG1kFPvWVxZGfnatB3UzkW9uIUOWM=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/gi/git/package.nix b/pkgs/by-name/gi/git/package.nix
index 0356eed7243a..b84bf8a6c4d6 100644
--- a/pkgs/by-name/gi/git/package.nix
+++ b/pkgs/by-name/gi/git/package.nix
@@ -62,6 +62,7 @@
 assert osxkeychainSupport -> stdenv.hostPlatform.isDarwin;
 assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
+assert withBreakingChanges -> rustSupport;
 
 let
   version = "2.55.0";
diff --git a/pkgs/by-name/gl/glance-agent/package.nix b/pkgs/by-name/gl/glance-agent/package.nix
new file mode 100644
index 000000000000..cc3de3194337
--- /dev/null
+++ b/pkgs/by-name/gl/glance-agent/package.nix
@@ -0,0 +1,33 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  lib,
+}:
+buildGoModule (finalAttrs: {
+  pname = "glance-agent";
+  version = "0.1.0";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "glanceapp";
+    repo = "agent";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-eNhOelHR3EB3RWWMe7fG6vklgADX7XFy6QMI4Lfr8oM=";
+  };
+
+  vendorHash = "sha256-vjcyZctfgnAhzFEF0c+GhtWQqa4gVvLLj0E3sCLS0RE=";
+
+  ldflags = [
+    "-s"
+    "-X github.com/glanceapp/agent/internal/agent.buildVersion=${finalAttrs.version}"
+  ];
+
+  meta = {
+    homepage = "https://github.com/glanceapp/agent";
+    description = "Lightweight service that exposes system metrics via an HTTP API";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "agent";
+    maintainers = with lib.maintainers; [ yarn ];
+  };
+})
diff --git a/pkgs/by-name/gn/gnome-frog/package.nix b/pkgs/by-name/gn/gnome-frog/package.nix
index 6ef2f26f875e..091f2e09b944 100644
--- a/pkgs/by-name/gn/gnome-frog/package.nix
+++ b/pkgs/by-name/gn/gnome-frog/package.nix
@@ -89,7 +89,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   '';
 
   meta = {
-    homepage = "https://getfrog.app/";
+    homepage = "https://github.com/TenderOwl/Frog";
     description = "Intuitive text extraction tool (OCR) for GNOME desktop";
     license = lib.licenses.mit;
     mainProgram = "frog";
diff --git a/pkgs/by-name/go/gohai/package.nix b/pkgs/by-name/go/gohai/package.nix
deleted file mode 100644
index c8b2e18af574..000000000000
--- a/pkgs/by-name/go/gohai/package.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  fetchFromGitHub,
-}:
-
-buildGoModule {
-  pname = "gohai";
-  version = "0-unstable-2022-04-12";
-
-  src = fetchFromGitHub {
-    owner = "DataDog";
-    repo = "gohai";
-    rev = "c614f513e87f04d3d19b2d4ae853cc5703f3a9bc";
-    sha256 = "sha256-vdzGGTg9SHYS0OQUn3VvrQGpKxzqxBRXDKOm0c7FvYY=";
-  };
-
-  vendorHash = "sha256-aN1fwGbBm45e6qdRu+4wnv2ZI7SOsIPONB4vF9o2vlI=";
-
-  ldflags = [
-    "-s"
-    "-w"
-  ];
-
-  doCheck = false;
-
-  meta = {
-    description = "System information collector";
-    homepage = "https://github.com/DataDog/gohai";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ tazjin ];
-    longDescription = ''
-      Gohai is a tool which collects an inventory of system
-      information. It is used by the Datadog agent to provide detailed
-      system metrics.
-    '';
-    mainProgram = "gohai";
-  };
-}
diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix
index 3c6a8aefa306..2a51b56fdfd8 100644
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -55,7 +55,7 @@
   commandLineArgs ? "",
 
   # Will crash without.
-  systemd,
+  systemdLibs,
 
   # Loaded at runtime.
   libexif,
@@ -159,7 +159,7 @@ let
     pipewire
     snappy
     speechd-minimal
-    systemd
+    systemdLibs
     util-linux
     vulkan-loader
     wayland
diff --git a/pkgs/by-name/go/gopass-hibp/package.nix b/pkgs/by-name/go/gopass-hibp/package.nix
index f88307fe6765..08235b6c1d82 100644
--- a/pkgs/by-name/go/gopass-hibp/package.nix
+++ b/pkgs/by-name/go/gopass-hibp/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gopass-hibp";
-  version = "1.17.3";
+  version = "1.17.4";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
     repo = "gopass-hibp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Dc+lZrOP8XbHlJJqET1i9/KeSZUeHOV3huGPt9ieRZY=";
+    hash = "sha256-IJE/3Mi6tmxhbaxM09QgzvGmJ0FN6f7ciNeu99Ej4Fo=";
   };
 
-  vendorHash = "sha256-9BNnieu+IbZxYfWtwaWgdk86yv0gdK2z8fMbebkO5L8=";
+  vendorHash = "sha256-O3lcvqkLHvByXyWDdspnUyvk41c2iJX3mFMQpFi1ThI=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/go/gopass-jsonapi/package.nix b/pkgs/by-name/go/gopass-jsonapi/package.nix
index ae7f2d43c344..e7ed9fef83b1 100644
--- a/pkgs/by-name/go/gopass-jsonapi/package.nix
+++ b/pkgs/by-name/go/gopass-jsonapi/package.nix
@@ -25,16 +25,16 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "gopass-jsonapi";
-  version = "1.17.3";
+  version = "1.17.4";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
     repo = "gopass-jsonapi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eVvZvicLoS/3Y1Fcl9HgAUhyYFKnqvFQ3BDukGtr1ho=";
+    hash = "sha256-LHC1cFq25/3qdOACve4rbBPIw3sxZzmKw/lytsHNpds=";
   };
 
-  vendorHash = "sha256-aFJ7VPpD5A7bvwESFj9m2VZ7KsCAKl3La4iQzRhbuHc=";
+  vendorHash = "sha256-X+Z6QBoqFGi8uLDKefDDTqj/ACSfloFRkZEWDGLySJc=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/go/gopass-summon-provider/package.nix b/pkgs/by-name/go/gopass-summon-provider/package.nix
index 21860d975851..4f44926e4577 100644
--- a/pkgs/by-name/go/gopass-summon-provider/package.nix
+++ b/pkgs/by-name/go/gopass-summon-provider/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gopass-summon-provider";
-  version = "1.17.3";
+  version = "1.17.4";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
     repo = "gopass-summon-provider";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bb9kxaDosx3xrjPcu+n2ROdFdyETTePvObWIGkKOcrM=";
+    hash = "sha256-RUwTnDMa0ZVhVnRTOulTH5XiaKG+0Ml9hgwf3dPMp+w=";
   };
 
-  vendorHash = "sha256-9BNnieu+IbZxYfWtwaWgdk86yv0gdK2z8fMbebkO5L8=";
+  vendorHash = "sha256-O3lcvqkLHvByXyWDdspnUyvk41c2iJX3mFMQpFi1ThI=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/go/gotosocial/package.nix b/pkgs/by-name/go/gotosocial/package.nix
index 07b2455c1e61..c65ac3fa4767 100644
--- a/pkgs/by-name/go/gotosocial/package.nix
+++ b/pkgs/by-name/go/gotosocial/package.nix
@@ -23,13 +23,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "gotosocial";
-  version = "0.22.1";
+  version = "0.22.2";
 
   src = fetchFromCodeberg {
     owner = "superseriousbusiness";
     repo = "gotosocial";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fRMQISOYf0rGcnNBpdlDeYWO0vvVwW0UPXdeT1y0+Ec=";
+    hash = "sha256-gzTiXcDiE7QwX/xcvtLOroDd1p1TU+XyH/On00Q51gU=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/go/govulncheck/package.nix b/pkgs/by-name/go/govulncheck/package.nix
index ce44fd0ffc85..8872dca1b8da 100644
--- a/pkgs/by-name/go/govulncheck/package.nix
+++ b/pkgs/by-name/go/govulncheck/package.nix
@@ -8,13 +8,13 @@
 
 buildGoLatestModule (finalAttrs: {
   pname = "govulncheck";
-  version = "1.8.0";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "golang";
     repo = "vuln";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OvgAEWf7WtPNXZEZYNeSqy7dZP9cF3wfQSt9WU79OIM=";
+    hash = "sha256-XChu+f2RVp9flyk6R7n090Xbcgzi2ThQPuTqktkOC+U=";
   };
 
   patches = [
@@ -24,7 +24,7 @@ buildGoLatestModule (finalAttrs: {
     })
   ];
 
-  vendorHash = "sha256-wSSxsmEzpFiaDfRsgFWOtA9UnoENm57VVltB+MA6y0E=";
+  vendorHash = "sha256-vPBwW2DtmJbX1UeJeC3J8wnRvq9+C/XDazbsXKkHkaQ=";
 
   subPackages = [
     "cmd/govulncheck"
diff --git a/pkgs/by-name/go/gowebly/package.nix b/pkgs/by-name/go/gowebly/package.nix
index ae484dc3f453..4dde6bcf3657 100644
--- a/pkgs/by-name/go/gowebly/package.nix
+++ b/pkgs/by-name/go/gowebly/package.nix
@@ -60,7 +60,7 @@ buildGoModule rec {
       with Go on the backend, using htmx, hyperscript or Alpine.js,
       and the most popular CSS frameworks on the frontend.
     '';
-    homepage = "https://gowebly.org";
+    homepage = "https://github.com/gowebly/gowebly";
     changelog = "https://github.com/gowebly/gowebly/releases/tag/v${version}";
     license = lib.licenses.asl20;
     mainProgram = "gowebly";
diff --git a/pkgs/by-name/gp/gpauth/package.nix b/pkgs/by-name/gp/gpauth/package.nix
index 8fde45e7e549..7480e97f8080 100644
--- a/pkgs/by-name/gp/gpauth/package.nix
+++ b/pkgs/by-name/gp/gpauth/package.nix
@@ -9,6 +9,7 @@
   webkitgtk_4_1,
   wrapGAppsHook3,
   stdenv,
+  nixosTests,
   nix-update-script,
 }:
 
@@ -49,7 +50,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "--skip=cli::tests::client_version_arg_sets_profile_client_version"
   ];
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.runtime-tls = nixosTests.gpauth-tls;
+  };
 
   meta = {
     changelog = "https://github.com/${finalAttrs.src.owner}/${finalAttrs.src.repo}/blob/${finalAttrs.src.rev}/changelog.md";
diff --git a/pkgs/by-name/gr/graphicsmagick/package.nix b/pkgs/by-name/gr/graphicsmagick/package.nix
index 29e669edc997..c403b3f9b1e4 100644
--- a/pkgs/by-name/gr/graphicsmagick/package.nix
+++ b/pkgs/by-name/gr/graphicsmagick/package.nix
@@ -28,11 +28,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "graphicsmagick";
-  version = "1.3.48";
+  version = "1.3.49";
 
   src = fetchurl {
     url = "mirror://sourceforge/graphicsmagick/GraphicsMagick-${finalAttrs.version}.tar.xz";
-    hash = "sha256-khjreBeREPkTcQZqt1yztN0DS5u0ZLKc6bq3oRl5Iys=";
+    hash = "sha256-fvoHDcMRFrQxUGGzn4S8cYHosGC/YSFOya+FETGvnIE=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/gr/gravit/package.nix b/pkgs/by-name/gr/gravit/package.nix
deleted file mode 100644
index 9f96fb30e3fc..000000000000
--- a/pkgs/by-name/gr/gravit/package.nix
+++ /dev/null
@@ -1,91 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchpatch,
-  SDL,
-  SDL_ttf,
-  SDL_image,
-  libsm,
-  libice,
-  libGLU,
-  libGL,
-  libpng,
-  lua5_2_compat,
-  autoconf,
-  automake,
-  mesa,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "gravit";
-  version = "0.5.1";
-
-  src = fetchFromGitHub {
-    owner = "gak";
-    repo = "gravit";
-    rev = finalAttrs.version;
-    hash = "sha256-JuqnLLD5+Ec8kQI0SK98V1O6TTbGM6+yKn5KCHe85eM=";
-  };
-
-  patches = [
-    # Pull fix pending upstream inclusion for -fno-common toolchains:
-    #   https://github.com/gak/gravit/pull/100
-    (fetchpatch {
-      name = "fno-common.patch";
-      url = "https://github.com/gak/gravit/commit/0f848834889212f16201fd404d2d5b9bb5b47d23.patch";
-      hash = "sha256-k1aMIg7idMt53o6dFgIKJflOMp0Jp5NwgWEijcIwXrQ=";
-    })
-  ];
-
-  buildInputs = [
-    libGLU
-    libGL
-    SDL
-    SDL_ttf
-    SDL_image
-    lua5_2_compat
-    libpng
-    libsm
-    libice
-  ];
-
-  nativeBuildInputs = [
-    autoconf
-    automake
-  ];
-
-  preConfigure = ''
-    ./autogen.sh
-
-    # Build fails on Linux with windres.
-    export ac_cv_prog_WINDRES=
-  '';
-
-  enableParallelBuilding = true;
-
-  env.NIX_CFLAGS_COMPILE = toString [
-    "-DSDL_INCLUDE_GLU_H"
-  ];
-
-  meta = {
-    broken = (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64);
-    homepage = "https://github.com/gak/gravit";
-    description = "Beautiful OpenGL-based gravity simulator";
-    mainProgram = "gravit";
-    license = lib.licenses.gpl2Plus;
-
-    longDescription = ''
-      Gravit is a gravity simulator which runs under Linux, Windows and
-      macOS. It uses Newtonian physics using the Barnes-Hut N-body
-      algorithm. Although the main goal of Gravit is to be as accurate
-      as possible, it also creates beautiful looking gravity patterns.
-      It records the history of each particle so it can animate and
-      display a path of its travels. At any stage you can rotate your
-      view in 3D and zoom in and out.
-    '';
-
-    inherit (mesa.meta) platforms;
-    hydraPlatforms = lib.platforms.linux; # darwin times out
-  };
-})
diff --git a/pkgs/by-name/gr/greenbone-feed-sync/package.nix b/pkgs/by-name/gr/greenbone-feed-sync/package.nix
index 9dad061a3111..9786f0b1a199 100644
--- a/pkgs/by-name/gr/greenbone-feed-sync/package.nix
+++ b/pkgs/by-name/gr/greenbone-feed-sync/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "greenbone-feed-sync";
-  version = "25.4.2";
+  version = "25.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "greenbone-feed-sync";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Nh5Nw2Rq+Zw4IiBOwcLzayO2J/dFSOJpjHPYcJ/L3Fs=";
+    hash = "sha256-y7eWpLOTq8MWsmgeF7/CsuequBHU7ESrnJUOF1DbXRo=";
   };
 
   build-system = with python3.pkgs; [ hatchling ];
diff --git a/pkgs/by-name/gr/grsync/package.nix b/pkgs/by-name/gr/grsync/package.nix
index 514a194af9f7..0435423cafe7 100644
--- a/pkgs/by-name/gr/grsync/package.nix
+++ b/pkgs/by-name/gr/grsync/package.nix
@@ -2,13 +2,9 @@
   lib,
   stdenv,
   fetchurl,
-  dee,
   gtk3,
   intltool,
-  libdbusmenu-gtk3,
-  libunity,
   pkg-config,
-  rsync,
   wrapGAppsHook3,
 }:
 
@@ -28,11 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    dee
     gtk3
-    libdbusmenu-gtk3
-    libunity
-    rsync
   ];
 
   meta = {
diff --git a/pkgs/by-name/ha/hakuneko/package.nix b/pkgs/by-name/ha/hakuneko/package.nix
index bab7e86d7799..1083ad949081 100644
--- a/pkgs/by-name/ha/hakuneko/package.nix
+++ b/pkgs/by-name/ha/hakuneko/package.nix
@@ -11,7 +11,7 @@
   alsa-lib,
   nss,
   nspr,
-  systemd,
+  systemdLibs,
   libxtst,
   libxscrnsaver,
 }:
@@ -64,7 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
     nspr
     libxscrnsaver
     libxtst
-    systemd
+    systemdLibs
   ];
 
   unpackPhase = ''
diff --git a/pkgs/by-name/ha/hamster/package.nix b/pkgs/by-name/ha/hamster/package.nix
index 537356bf9f5d..66f4fdbba5ea 100644
--- a/pkgs/by-name/ha/hamster/package.nix
+++ b/pkgs/by-name/ha/hamster/package.nix
@@ -68,7 +68,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   meta = {
     description = "Time tracking application";
     mainProgram = "hamster";
-    homepage = "http://projecthamster.org/";
+    homepage = "https://github.com/projecthamster/hamster";
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.all;
     maintainers = [ lib.maintainers.fabianhauser ];
diff --git a/pkgs/by-name/ha/hanazono/package.nix b/pkgs/by-name/ha/hanazono/package.nix
index 3afed4dbb3a2..e011e66be55f 100644
--- a/pkgs/by-name/ha/hanazono/package.nix
+++ b/pkgs/by-name/ha/hanazono/package.nix
@@ -27,7 +27,7 @@ stdenvNoCC.mkDerivation rec {
 
   meta = {
     description = "Japanese Mincho-typeface TrueType font";
-    homepage = "https://fonts.jp/hanazono/";
+    homepage = "https://glyphwiki.org/hanazono/";
     longDescription = ''
       Hanazono Mincho typeface is a Japanese TrueType font that developed with a
       support of Grant-in-Aid for Publication of Scientific Research Results
diff --git a/pkgs/by-name/he/hey-mail/package.nix b/pkgs/by-name/he/hey-mail/package.nix
index 156699f2c79c..24316e0dcc5b 100644
--- a/pkgs/by-name/he/hey-mail/package.nix
+++ b/pkgs/by-name/he/hey-mail/package.nix
@@ -22,7 +22,7 @@
   atk,
   libgbm,
   cups,
-  systemd,
+  systemdLibs,
   alsa-lib,
   at-spi2-atk,
   at-spi2-core,
@@ -63,7 +63,7 @@ let
     atk
     libgbm
     cups
-    systemd
+    systemdLibs
     alsa-lib
     at-spi2-atk
     at-spi2-core
diff --git a/pkgs/by-name/ho/home-assistant-matter-hub/package.nix b/pkgs/by-name/ho/home-assistant-matter-hub/package.nix
index 40561297251b..02968b1fd0c7 100644
--- a/pkgs/by-name/ho/home-assistant-matter-hub/package.nix
+++ b/pkgs/by-name/ho/home-assistant-matter-hub/package.nix
@@ -14,13 +14,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "home-assistant-matter-hub";
-  version = "2.0.57";
+  version = "2.0.58";
 
   src = fetchFromGitHub {
     owner = "RiDDiX";
     repo = "home-assistant-matter-hub";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3Pi069urd/FAT0eWz2tpcx/JbP/90iTcoswdAZt1viQ=";
+    hash = "sha256-Mytoc24bhq7nHvkD4vKHE8LxEGtqJh1nRr8lMXh+2mE=";
   };
 
   # The bundled cli.js imports transitive dependencies (e.g. @noble/curves)
@@ -38,7 +38,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       ;
     inherit pnpm;
     fetcherVersion = 4;
-    hash = "sha256-h4oQ01Bmj9bbm2YY7t/lJukIgJ99YQwRqyERHZlBXj4=";
+    hash = "sha256-y1Q6b9W0MxGThRhbaAJ8TigO4sfM8T3Rz4WDxrlwoFU=";
   };
 
   __structuredAttrs = true;
diff --git a/pkgs/by-name/hu/hunk/package.nix b/pkgs/by-name/hu/hunk/package.nix
index 37b679ceed69..85fb957f6d07 100644
--- a/pkgs/by-name/hu/hunk/package.nix
+++ b/pkgs/by-name/hu/hunk/package.nix
@@ -12,13 +12,13 @@
 
 let
   pname = "hunk";
-  version = "0.22.0";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "modem-dev";
     repo = "hunk";
     tag = "v${version}";
-    hash = "sha256-dc4/xLAyQe7mL/KMcpjsjgHzgf0tRomQAemVABwUWFY=";
+    hash = "sha256-JQRNs0JG3v7lN1rFNikMyevAQjV0vfCCXjfPxmcKmqQ=";
   };
 
   node_modules = stdenv.mkDerivation {
@@ -58,7 +58,7 @@ let
 
     dontFixup = true;
 
-    outputHash = "sha256-hWfG2T3Tfa69nX50OFW5XNRQxMc5lideDEUPw6G26qA=";
+    outputHash = "sha256-svON/Z2rtRHLQlbks65si2U/vjrwOw2G4QziXTGVWjo=";
     outputHashMode = "recursive";
   };
 in
diff --git a/pkgs/by-name/hy/hydra-ad-hoc/package.nix b/pkgs/by-name/hy/hydra-ad-hoc/package.nix
index 4b145d3fca03..9734aadc2b71 100644
--- a/pkgs/by-name/hy/hydra-ad-hoc/package.nix
+++ b/pkgs/by-name/hy/hydra-ad-hoc/package.nix
@@ -14,7 +14,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   inherit (hydra) version src;
   __structuredAttrs = true;
 
-  cargoHash = "sha256-TYFxKCXxe5oCbmjWaaQM98VjInKBgVRr8Ygy+2LKUew=";
+  cargoHash = "sha256-Hkf6DS/MUrxqD/xp9mIv0CjbRq2FL3QNGIkZMw8BehY=";
 
   cargoBuildFlags = [
     "--package"
diff --git a/pkgs/by-name/hy/hydra-builder/package.nix b/pkgs/by-name/hy/hydra-builder/package.nix
index 9897b79d8ddf..ec1a5e6e0cb7 100644
--- a/pkgs/by-name/hy/hydra-builder/package.nix
+++ b/pkgs/by-name/hy/hydra-builder/package.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   inherit (hydra) version src;
   __structuredAttrs = true;
 
-  cargoHash = "sha256-TYFxKCXxe5oCbmjWaaQM98VjInKBgVRr8Ygy+2LKUew=";
+  cargoHash = "sha256-Hkf6DS/MUrxqD/xp9mIv0CjbRq2FL3QNGIkZMw8BehY=";
 
   cargoBuildFlags = [
     "--package"
diff --git a/pkgs/by-name/hy/hydra-evaluator/package.nix b/pkgs/by-name/hy/hydra-evaluator/package.nix
index 41f22cb466bb..41a551876d1d 100644
--- a/pkgs/by-name/hy/hydra-evaluator/package.nix
+++ b/pkgs/by-name/hy/hydra-evaluator/package.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   inherit (hydra) version src;
   __structuredAttrs = true;
 
-  cargoHash = "sha256-TYFxKCXxe5oCbmjWaaQM98VjInKBgVRr8Ygy+2LKUew=";
+  cargoHash = "sha256-Hkf6DS/MUrxqD/xp9mIv0CjbRq2FL3QNGIkZMw8BehY=";
 
   cargoBuildFlags = [
     "--package"
diff --git a/pkgs/by-name/hy/hydra-queue-runner/package.nix b/pkgs/by-name/hy/hydra-queue-runner/package.nix
index e9d3ce3bb95f..82a82273c15f 100644
--- a/pkgs/by-name/hy/hydra-queue-runner/package.nix
+++ b/pkgs/by-name/hy/hydra-queue-runner/package.nix
@@ -13,7 +13,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   inherit (hydra) version src;
   __structuredAttrs = true;
 
-  cargoHash = "sha256-TYFxKCXxe5oCbmjWaaQM98VjInKBgVRr8Ygy+2LKUew=";
+  cargoHash = "sha256-Hkf6DS/MUrxqD/xp9mIv0CjbRq2FL3QNGIkZMw8BehY=";
 
   cargoBuildFlags = [
     "--package"
diff --git a/pkgs/by-name/hy/hydra-ws/package.nix b/pkgs/by-name/hy/hydra-ws/package.nix
index c9a6ceac22ed..dcc283de1ea9 100644
--- a/pkgs/by-name/hy/hydra-ws/package.nix
+++ b/pkgs/by-name/hy/hydra-ws/package.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   inherit (hydra) version src;
   __structuredAttrs = true;
 
-  cargoHash = "sha256-TYFxKCXxe5oCbmjWaaQM98VjInKBgVRr8Ygy+2LKUew=";
+  cargoHash = "sha256-Hkf6DS/MUrxqD/xp9mIv0CjbRq2FL3QNGIkZMw8BehY=";
 
   cargoBuildFlags = [
     "--package"
diff --git a/pkgs/by-name/hy/hydra/package.nix b/pkgs/by-name/hy/hydra/package.nix
index ec8343f60c20..1ee249927370 100644
--- a/pkgs/by-name/hy/hydra/package.nix
+++ b/pkgs/by-name/hy/hydra/package.nix
@@ -45,13 +45,13 @@ let
   # Keep in sync with the nix input of https://github.com/NixOS/hydra/blob/master/flake.nix
   nixComponents = nixVersions.nixComponents_2_35;
 
-  version = "0-unstable-2026-10-04";
+  version = "0-unstable-2026-10-08";
 
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "hydra";
-    rev = "588f42497842e9c0172067c8156f8d1b1ea691ff";
-    hash = "sha256-GifY4tTG00WPp8RZCFqv/quwuG9rxwuGmTyAUbAgEJ0=";
+    rev = "35d9058fa00edcc9c4a1d3489f929a9cbfc75208";
+    hash = "sha256-or1nAWkxlPbKegdarYmXKjQfNixpxb4Dlrbp2jrUDdk=";
   };
 
   nix-perl = callPackage ./nix-perl.nix {
diff --git a/pkgs/by-name/hy/hypridle/package.nix b/pkgs/by-name/hy/hypridle/package.nix
index 0c0c883f3392..ed692e9e7769 100644
--- a/pkgs/by-name/hy/hypridle/package.nix
+++ b/pkgs/by-name/hy/hypridle/package.nix
@@ -59,9 +59,6 @@ gcc16Stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.bsd3;
     teams = [ lib.teams.hyprland ];
     mainProgram = "hypridle";
-    platforms = [
-      "aarch64-linux"
-      "x86_64-linux"
-    ];
+    platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/by-name/hy/hyprland/package.nix b/pkgs/by-name/hy/hyprland/package.nix
index 163dba3f7589..9e28edd5de79 100644
--- a/pkgs/by-name/hy/hyprland/package.nix
+++ b/pkgs/by-name/hy/hyprland/package.nix
@@ -37,7 +37,7 @@
   python3,
   re2,
   readline,
-  systemd,
+  systemdLibs,
   tomlplusplus,
   udis86,
   uwsm,
@@ -52,7 +52,7 @@
   xwayland,
   debug ? false,
   enableXWayland ? true,
-  withSystemd ? lib.meta.availableOn gcc16Stdenv.hostPlatform systemd,
+  withSystemd ? lib.meta.availableOn gcc16Stdenv.hostPlatform systemdLibs,
   wrapRuntimeDeps ? true,
 }:
 let
@@ -190,7 +190,7 @@ customStdenv.mkDerivation (finalAttrs: {
       libxdmcp
       xwayland
     ])
-    (optionals withSystemd [ systemd ])
+    (optionals withSystemd [ systemdLibs ])
   ];
 
   cmakeBuildType = if debug then "Debug" else "RelWithDebInfo";
diff --git a/pkgs/by-name/ii/iina/package.nix b/pkgs/by-name/ii/iina/package.nix
index b7a6ff958d1e..127d0bf3de54 100644
--- a/pkgs/by-name/ii/iina/package.nix
+++ b/pkgs/by-name/ii/iina/package.nix
@@ -8,17 +8,20 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "iina";
-  version = "1.4.4";
+  version = "1.5.0";
 
   src = fetchurl {
     url = "https://github.com/iina/iina/releases/download/v${finalAttrs.version}/IINA.v${finalAttrs.version}.dmg";
-    hash = "sha256-3Q/AvUs3+1ehyNMNbjIBs6ZLr9KZWf5WlTlkYTI3vrE=";
+    hash = "sha256-j61QR5sQ4JZFBTRXzsRr1T0FTO0iQs/mj3RYZzWiDcc=";
   };
 
   nativeBuildInputs = [ undmg ];
 
   sourceRoot = "IINA.app";
 
+  # Patching shebangs in the app bundle invalidates its code signature.
+  dontPatchShebangs = true;
+
   installPhase = ''
     mkdir -p $out/{bin,Applications/IINA.app}
     cp -R . "$out/Applications/IINA.app"
diff --git a/pkgs/by-name/in/instead/package.nix b/pkgs/by-name/in/instead/package.nix
index cc82efbb821a..8a15fddf3931 100644
--- a/pkgs/by-name/in/instead/package.nix
+++ b/pkgs/by-name/in/instead/package.nix
@@ -94,7 +94,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Simple text adventure interpreter for Unix and Windows";
-    homepage = "https://instead.syscall.ru/";
+    homepage = "https://sourceforge.net/projects/instead";
     license = lib.licenses.mit;
     platforms = with lib.platforms; linux;
     maintainers = with lib.maintainers; [ pSub ];
diff --git a/pkgs/by-name/ip/ipam/package.nix b/pkgs/by-name/ip/ipam/package.nix
index 32afc82dff79..553ed9d3d89b 100644
--- a/pkgs/by-name/ip/ipam/package.nix
+++ b/pkgs/by-name/ip/ipam/package.nix
@@ -42,7 +42,7 @@ buildGoModule (finalAttrs: {
 
   meta = {
     description = "Cli based IPAM written in Go with PowerDNS support";
-    homepage = "https://ipam.lauka.net/";
+    homepage = "https://ipam.adora.codes/";
     changelog = "https://codeberg.org/lauralani/ipam/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl3Plus;
     maintainers = [ ];
diff --git a/pkgs/by-name/ir/ir-lv2/package.nix b/pkgs/by-name/ir/ir-lv2/package.nix
index 4cf18e18afbf..7ad02d12b1e9 100644
--- a/pkgs/by-name/ir/ir-lv2/package.nix
+++ b/pkgs/by-name/ir/ir-lv2/package.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
-    homepage = "http://factorial.hu/plugins/lv2/ir";
+    homepage = "https://tomscii.sig7.se/plugins/ir.lv2/";
     description = "Low-latency, realtime, high performance signal convolver especially for creating reverb effects.";
     license = lib.licenses.gpl2;
     maintainers = [ lib.maintainers.magnetophon ];
diff --git a/pkgs/by-name/ir/ironbar/package.nix b/pkgs/by-name/ir/ironbar/package.nix
index e412b8efc7a9..16ee62131ad8 100644
--- a/pkgs/by-name/ir/ironbar/package.nix
+++ b/pkgs/by-name/ir/ironbar/package.nix
@@ -23,7 +23,7 @@
   libinput,
   libevdev,
   features ? [ ],
-  systemd,
+  systemdLibs,
   dbus,
 }:
 
@@ -54,7 +54,7 @@ rustPlatform.buildRustPackage rec {
     hicolor-icon-theme
     gsettings-desktop-schemas
     libxkbcommon
-    systemd
+    systemdLibs
     dbus
   ]
   ++ lib.optionals (hasFeature "volume") [ libpulseaudio ]
diff --git a/pkgs/by-name/is/isso/package.nix b/pkgs/by-name/is/isso/package.nix
index 0ffaead83077..71b4ab9a4d09 100644
--- a/pkgs/by-name/is/isso/package.nix
+++ b/pkgs/by-name/is/isso/package.nix
@@ -73,7 +73,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   meta = {
     description = "Commenting server similar to Disqus";
     mainProgram = "isso";
-    homepage = "https://posativ.org/isso/";
+    homepage = "https://isso-comments.de";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fgaz ];
   };
diff --git a/pkgs/by-name/ja/jan/package.nix b/pkgs/by-name/ja/jan/package.nix
index ed7871c99459..48a5bbc4cb4a 100644
--- a/pkgs/by-name/ja/jan/package.nix
+++ b/pkgs/by-name/ja/jan/package.nix
@@ -2,29 +2,26 @@
   lib,
   appimageTools,
   fetchurl,
-  config,
-  cudaPackages,
-  cudaSupport ? config.cudaSupport,
   stdenvNoCC,
   fetchzip,
   makeWrapper,
 }:
 
 let
-  version = "0.8.4";
+  version = "0.8.6";
 
   darwin-src = fetchzip {
     url = "https://github.com/janhq/jan/releases/download/v${version}/jan-mac-universal-${version}.zip";
-    hash = "sha256-hK9cu9c2kJRCJ3iy0CucRP0whgDgF5K29JgR4AIKXVg=";
+    hash = "sha256-jQIY69PT+jMh3bUd2tgscKzvT/TBy8TqF6pFrsl7XAg=";
   };
 
   linux-src = fetchurl {
     url = "https://github.com/janhq/jan/releases/download/v${version}/Jan_${version}_amd64.AppImage";
-    hash = "sha256-NNTIq02kisIjINS2TCh0Rb2UyRMSlJLR2+uzZmWxSVo=";
+    hash = "sha256-L+cPsIhHOnvbSZ5c4HHVpXPFR1VpFIJduYnsHdEFIGY=";
   };
 
   appimageContents = appimageTools.extract {
-    pname = "Jan";
+    pname = "jan";
     inherit version;
     src = linux-src;
   };
@@ -37,7 +34,7 @@ let
     homepage = "https://github.com/janhq/jan";
     license = lib.licenses.asl20;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    mainProgram = "Jan";
+    mainProgram = "Jan-Desktop";
     maintainers = with lib.maintainers; [ dfjay ];
     platforms =
       lib.platforms.darwin
@@ -45,22 +42,22 @@ let
   };
 
   linux = appimageTools.wrapType2 {
-    pname = "Jan";
+    pname = "jan";
     inherit version;
     src = linux-src;
 
+    executableName = "Jan-Desktop";
+
     extraInstallCommands = ''
       install -Dm444 ${appimageContents}/Jan.desktop -t $out/share/applications
       cp -r ${appimageContents}/usr/share/icons $out/share
     '';
 
-    extraPkgs = pkgs: lib.optionals cudaSupport [ cudaPackages.cuda_cudart ];
-
     inherit passthru meta;
   };
 
   darwin = stdenvNoCC.mkDerivation {
-    pname = "Jan";
+    pname = "jan";
     inherit version;
 
     strictDeps = true;
@@ -80,9 +77,7 @@ let
       mkdir -p $out/Applications/Jan.app
       mkdir -p $out/bin
       cp -R $src/. $out/Applications/Jan.app/
-      if [ -x "$out/Applications/Jan.app/Contents/MacOS/Jan" ]; then
-        makeWrapper "$out/Applications/Jan.app/Contents/MacOS/Jan" $out/bin/Jan
-      fi
+      makeWrapper "$out/Applications/Jan.app/Contents/MacOS/Jan-Desktop" $out/bin/Jan-Desktop
 
       runHook postInstall
     '';
diff --git a/pkgs/by-name/ji/jimtcl/package.nix b/pkgs/by-name/ji/jimtcl/package.nix
index e551e07e3308..bb64472872f6 100644
--- a/pkgs/by-name/ji/jimtcl/package.nix
+++ b/pkgs/by-name/ji/jimtcl/package.nix
@@ -75,7 +75,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Open source small-footprint implementation of the Tcl programming language";
-    homepage = "http://jim.tcl.tk/";
+    homepage = "https://msteveb.github.io/jimtcl/";
     license = lib.licenses.bsd2;
     platforms = lib.platforms.all;
     mainProgram = "jimsh";
diff --git a/pkgs/by-name/js/jshon/package.nix b/pkgs/by-name/js/jshon/package.nix
index b2bfd1290487..f45b5b9660f6 100644
--- a/pkgs/by-name/js/jshon/package.nix
+++ b/pkgs/by-name/js/jshon/package.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation {
   '';
 
   meta = {
-    homepage = "http://kmkeen.com/jshon";
+    homepage = "https://github.com/keenerd/jshon";
     description = "JSON parser designed for maximum convenience within the shell";
     mainProgram = "jshon";
     license = lib.licenses.free;
diff --git a/pkgs/by-name/jx/jxrlib/package.nix b/pkgs/by-name/jx/jxrlib/package.nix
index 0ef86f2bc480..29d6f4f03fa9 100644
--- a/pkgs/by-name/jx/jxrlib/package.nix
+++ b/pkgs/by-name/jx/jxrlib/package.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Implementation of the JPEG XR image codec standard";
-    homepage = "https://jxrlib.codeplex.com";
+    homepage = "https://salsa.debian.org/debian-phototools-team/jxrlib";
     license = lib.licenses.bsd2;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ romildo ];
diff --git a/pkgs/by-name/ke/keystone/package.nix b/pkgs/by-name/ke/keystone/package.nix
index 11b8ff7da8c4..f562438a7c61 100644
--- a/pkgs/by-name/ke/keystone/package.nix
+++ b/pkgs/by-name/ke/keystone/package.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Lightweight multi-platform, multi-architecture assembler framework";
-    homepage = "https://www.keystone-engine.org";
+    homepage = "https://github.com/keystone-engine/keystone";
     license = lib.licenses.gpl2Only;
     maintainers = [ ];
     mainProgram = "kstool";
diff --git a/pkgs/by-name/ki/kitty-bin/package.nix b/pkgs/by-name/ki/kitty-bin/package.nix
index 4613e18acd8a..d9fff66f8e59 100644
--- a/pkgs/by-name/ki/kitty-bin/package.nix
+++ b/pkgs/by-name/ki/kitty-bin/package.nix
@@ -45,6 +45,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     platforms = lib.platforms.darwin;
     mainProgram = "kitty";
+    mainDarwinApp = "kitty.app";
     maintainers = with lib.maintainers; [ carlossless ];
   };
 })
diff --git a/pkgs/by-name/kv/kvmtool/package.nix b/pkgs/by-name/kv/kvmtool/package.nix
index f89324a5909d..147ea7b6425c 100644
--- a/pkgs/by-name/kv/kvmtool/package.nix
+++ b/pkgs/by-name/kv/kvmtool/package.nix
@@ -5,19 +5,23 @@
   dtc,
 }:
 
+let
+  withLibfdt = stdenv.hostPlatform.isAarch64 || stdenv.hostPlatform.isRiscV64;
+in
+
 stdenv.mkDerivation {
   pname = "kvmtool";
-  version = "0-unstable-2024-04-09";
+  version = "0-unstable-2026-08-06";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/linux/kernel/git/will/kvmtool.git";
-    rev = "da4cfc3e540341b84c4bbad705b5a15865bc1f80";
-    hash = "sha256-05tNsZauOXe1L1y1YchzvLZm3xOctPJhHCjyAyRnwy4=";
+    rev = "f67bc0bdae9433a9cfd05e65ea2c1bb6102566d9";
+    hash = "sha256-eVE3lM0Xsv11T9IQ694639rLqvjjaee1Ob60vq3Ho3g=";
   };
 
   patches = [ ./strlcpy-glibc-2.38-fix.patch ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isAarch64 [ dtc ];
+  buildInputs = lib.optionals withLibfdt [ dtc ];
 
   # glibc 2.43 C23 const-preserving strchr/strstr macros
   env.NIX_CFLAGS_COMPILE = "-Wno-error=discarded-qualifiers";
@@ -29,7 +33,7 @@ stdenv.mkDerivation {
     "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
     "ARCH=${stdenv.hostPlatform.linuxArch}"
   ]
-  ++ lib.optionals stdenv.hostPlatform.isAarch64 [
+  ++ lib.optionals withLibfdt [
     "LIBFDT_DIR=${dtc}/lib"
   ];
 
@@ -45,6 +49,7 @@ stdenv.mkDerivation {
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
+      "riscv64-linux"
     ];
     mainProgram = "lkvm";
   };
diff --git a/pkgs/by-name/la/ladybird/package.nix b/pkgs/by-name/la/ladybird/package.nix
index 31f9c28fb95e..843b6ad9fed5 100644
--- a/pkgs/by-name/la/ladybird/package.nix
+++ b/pkgs/by-name/la/ladybird/package.nix
@@ -312,7 +312,6 @@ stdenv.mkDerivation (finalAttrs: {
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
-      "riscv64-linux"
       "aarch64-darwin"
     ];
     mainProgram = "Ladybird";
diff --git a/pkgs/by-name/la/lazygit/package.nix b/pkgs/by-name/la/lazygit/package.nix
index 66c6b57091bd..7c6b68b0a82c 100644
--- a/pkgs/by-name/la/lazygit/package.nix
+++ b/pkgs/by-name/la/lazygit/package.nix
@@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "lazygit";
-  version = "0.66.0";
+  version = "0.66.1";
 
   src = fetchFromGitHub {
     owner = "jesseduffield";
     repo = "lazygit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2edvYQQxCkGNj3CJrLibaUgFF+uxnwULlO7G6SdgWPU=";
+    hash = "sha256-87OrUGi7xhQhAzV6S3r5evlLWt/1anheCd58v6GW42g=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ld/ldapin/package.nix b/pkgs/by-name/ld/ldapin/package.nix
new file mode 100644
index 000000000000..0d4225c944d7
--- /dev/null
+++ b/pkgs/by-name/ld/ldapin/package.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+  rustPlatform,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "ldapin";
+  version = "0.1.1";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "affolter-engineering";
+    repo = "ldapin";
+    tag = finalAttrs.version;
+    hash = "sha256-bo0TY9EVIe2etJKeVJBbhYdS7DEe4XgeClkYq8NGDfA=";
+  };
+
+  cargoHash = "sha256-0wKHutC6ZXPKQT7ucjZSXd6VbrzrzTlXGjI0ll0ZQvU=";
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "CLI tool to perform basic LDAP task for security assessments";
+    homepage = "https://github.com/affolter-engineering/ldapin";
+    changelog = "https://github.com/affolter-engineering/ldapin/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "ldapin";
+  };
+})
diff --git a/pkgs/by-name/le/legends-of-equestria/package.nix b/pkgs/by-name/le/legends-of-equestria/package.nix
index 65539a30db33..f187814b4a4c 100644
--- a/pkgs/by-name/le/legends-of-equestria/package.nix
+++ b/pkgs/by-name/le/legends-of-equestria/package.nix
@@ -12,7 +12,7 @@
   cairo,
   dbus,
   xorg_sys_opengl,
-  systemd,
+  systemdLibs,
   libcap,
   libdrm,
   pulseaudio,
@@ -61,7 +61,7 @@ let
   runtimeDeps = [
     dbus.lib
     xorg_sys_opengl
-    systemd
+    systemdLibs
     libcap.lib
     libdrm
     pulseaudio
diff --git a/pkgs/by-name/li/libcpr/package.nix b/pkgs/by-name/li/libcpr/package.nix
index 82a38e7be001..082c36caa981 100644
--- a/pkgs/by-name/li/libcpr/package.nix
+++ b/pkgs/by-name/li/libcpr/package.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "C++ wrapper around libcurl";
-    homepage = "https://docs.libcpr.org/";
+    homepage = "https://docs.libcpr.dev/";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       phodina
diff --git a/pkgs/by-name/li/libdeltachat/package.nix b/pkgs/by-name/li/libdeltachat/package.nix
index e7d1c3d07b90..44cc70529349 100644
--- a/pkgs/by-name/li/libdeltachat/package.nix
+++ b/pkgs/by-name/li/libdeltachat/package.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdeltachat";
-  version = "2.62.0";
+  version = "2.63.0";
 
   src = fetchFromGitHub {
     owner = "chatmail";
     repo = "core";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qjbxxcOvHkb8g4IMWXYXmnYhbEx3G5ptiysOvpTcCCI=";
+    hash = "sha256-asnP4ODHmbKb5coX1SSa5hdrNhqHF0vVjeevGq/6pnI=";
   };
 
   patches = [
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
   cargoDeps = rustPlatform.fetchCargoVendor {
     pname = "chatmail-core";
     inherit (finalAttrs) version src;
-    hash = "sha256-ceXhO8/k3+dphPQ74S+ZgEZzUWjgqBm6wcePvTqxHrE=";
+    hash = "sha256-ItwjZo1KCVVpqtdLWqnPwCDmjEXFdKc3Xdn6av51xXk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/liblzf/cmake.patch b/pkgs/by-name/li/liblzf/cmake.patch
new file mode 100644
index 000000000000..a2b27f0ab260
--- /dev/null
+++ b/pkgs/by-name/li/liblzf/cmake.patch
@@ -0,0 +1,65 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index e1944f4564..f360948c1b 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -45,7 +45,7 @@
+ add_library(${PROJECT_NAME} lzf_c.c lzf_d.c lzf.h lzfP.h)
+ target_include_directories(${PROJECT_NAME} PUBLIC
+ 	$<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}>
+-	$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}/${PROJECT_NAME}>
++	$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>
+ )
+ set_target_properties(${PROJECT_NAME} PROPERTIES
+ 	VERSION ${API_VERSION}
+@@ -57,7 +57,7 @@
+ add_library(embed INTERFACE)
+ target_include_directories(embed INTERFACE
+ 	$<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}>
+-	$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}/${PROJECT_NAME}>
++	$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>
+ )
+ target_sources(embed INTERFACE
+ 	$<BUILD_INTERFACE:lzf_c.c> $<BUILD_INTERFACE:lzf_d.c>
+@@ -95,3 +95,21 @@
+ 	${CMAKE_CURRENT_BINARY_DIR}/${PROJECT_NAME}-config-version.cmake
+ 	DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME}
+ )
++
++include(CheckIncludeFile)
++include(CheckFunctionExists)
++
++check_include_file(getopt.h HAVE_GETOPT_H)
++check_function_exists(getopt_long HAVE_GETOPT_LONG)
++
++configure_file(config.h.cmake.in config.h)
++
++add_executable(lzf-bin lzf.c)
++set_target_properties(lzf-bin PROPERTIES OUTPUT_NAME lzf)
++target_include_directories(lzf-bin PRIVATE "${CMAKE_CURRENT_BINARY_DIR}")
++target_link_libraries(lzf-bin PRIVATE liblzf)
++
++install(
++  TARGETS lzf-bin
++  RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
++)
+diff --git a/config.h.cmake.in b/config.h.cmake.in
+new file mode 100644
+index 0000000000..854a88f142
+--- /dev/null
++++ b/config.h.cmake.in
+@@ -0,0 +1,2 @@
++#cmakedefine HAVE_GETOPT_H 1
++#cmakedefine HAVE_GETOPT_LONG 1
+diff --git a/liblzf.pc.in b/liblzf.pc.in
+index 1da19e3eeb..619287c82f 100644
+--- a/liblzf.pc.in
++++ b/liblzf.pc.in
+@@ -1,6 +1,6 @@
+ prefix=@CMAKE_INSTALL_PREFIX@
+-includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@/@PROJECT_NAME@
+-libdir=${prefix}/@CMAKE_INSTALL_LIBDIR@
++includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@
++libdir=@CMAKE_INSTALL_FULL_LIBDIR@
+ 
+ Name: @PROJECT_NAME@
+ Description: A very small data compression library
diff --git a/pkgs/by-name/li/liblzf/lib_test.c b/pkgs/by-name/li/liblzf/lib_test.c
index 04655d35a1e4..7f5137146cb7 100644
--- a/pkgs/by-name/li/liblzf/lib_test.c
+++ b/pkgs/by-name/li/liblzf/lib_test.c
@@ -1,4 +1,4 @@
-#include "lzf.h"
+#include <liblzf/lzf.h>
 #include <stdio.h>
 #include <string.h>
 
diff --git a/pkgs/by-name/li/liblzf/package.nix b/pkgs/by-name/li/liblzf/package.nix
index b75d4013d2ef..46c75dbd7124 100644
--- a/pkgs/by-name/li/liblzf/package.nix
+++ b/pkgs/by-name/li/liblzf/package.nix
@@ -2,76 +2,98 @@
   lib,
   stdenv,
   fetchDebianPatch,
-  fetchpatch,
   fetchurl,
-  pkg-config,
   testers,
   validatePkgConfig,
-  autoconf,
-  automake,
-  libtool,
+
+  cmake,
+  pkg-config,
 }:
+let
+  debianRevision = toString 4;
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "liblzf";
   version = "3.6";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src = fetchurl {
     url = "https://dist.schmorp.de/liblzf/liblzf-${finalAttrs.version}.tar.gz";
     hash = "sha256-nF3gH3ucyuQMP2GdJqer7JmGwGw20mDBec7dBLiftGo=";
   };
 
+  outputs = [
+    "out"
+    "bin"
+    "dev"
+  ];
+
+  prePatch =
+    let
+      debianBaseUrl = "https://sources.debian.org/data/main/libl/liblzf/${finalAttrs.version}-${debianRevision}/debian";
+
+      debianCmakeLists = fetchurl {
+        url = "${debianBaseUrl}/extras/CMakeLists.txt";
+        hash = "sha256-QlgWq7xLhgvhBvtZ1e2ngMTpA/Dp6USdVgN+RfgO5x4=";
+      };
+
+      debianCmakeConfig = fetchurl {
+        url = "${debianBaseUrl}/extras/liblzf-config.cmake.in";
+        hash = "sha256-WvQ+QAFGxaPCz80ne3OA4L5cc/vUp5iMQe/2wGfoTMw=";
+      };
+
+      debianPkgConfig = fetchurl {
+        url = "${debianBaseUrl}/extras/liblzf.pc.in";
+        hash = "sha256-0KBA1duW420/DgaXQiyNlKBkQpVBH6LPucf11e4b8go=";
+      };
+    in
+    ''
+      cp --no-preserve=mode ${debianCmakeLists} CMakeLists.txt
+      cp --no-preserve=mode ${debianCmakeConfig} liblzf-config.cmake.in
+      cp --no-preserve=mode ${debianPkgConfig} liblzf.pc.in
+    '';
+
   patches = [
     (fetchDebianPatch {
       inherit (finalAttrs) pname version;
-      debianRevision = "4";
+      inherit debianRevision;
       patch = "0001-Make-sure-that-the-library-is-linked-with-C-symbols.patch";
       hash = "sha256-Rgfp/TysRcEJaogOo/Xno+G4HZzj9Loa69DL43Bp1Ok=";
     })
-    (
-      let
-        name = "liblzf-3.6-autoconf-20140314.patch";
-      in
-      fetchpatch {
-        inherit name;
-        url = "https://src.fedoraproject.org/rpms/liblzf/raw/53da654eead51a24ac81a28e1b1c531eb1afab28/f/${name}";
-        hash = "sha256-rkhI8w0HV3fGiDfHiXBzrnxqGDE/Yo5ntePrsscMiyg=";
-      }
-    )
+    ./cmake.patch
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_SHARED_LIBS" true)
   ];
 
   nativeBuildInputs = [
-    autoconf
-    automake
-    libtool
+    cmake
     pkg-config
     validatePkgConfig
   ];
 
-  preConfigure = ''
-    sh ./bootstrap.sh
-  '';
-
   postInstall = ''
-    pushd $out/bin
-    ln -s lzf unlzf
-    popd
+    ln -s lzf $bin/bin/unlzf
+    ln -s liblzf/lzf.h $dev/include/lzf.h
   '';
 
-  outputs = [
-    "out"
-    "dev"
-  ];
-
   passthru.tests = {
+    cmakeConfigTest = testers.hasCmakeConfigModules {
+      package = finalAttrs.finalPackage;
+      moduleNames = [ "liblzf" ];
+    };
+
     pkgConfigTest = testers.hasPkgConfigModules {
       package = finalAttrs.finalPackage;
-      version = "${finalAttrs.version}.0";
       versionCheck = true;
     };
 
     exeTest = testers.runCommand {
       name = "${finalAttrs.pname}-exe-test";
-      buildInputs = [ finalAttrs.finalPackage ];
+      buildInputs = [ finalAttrs.finalPackage.bin ];
       script = ''
         lzf -h 2> /dev/null
 
@@ -89,8 +111,6 @@ stdenv.mkDerivation (finalAttrs: {
           exit 1
         fi
 
-        echo "Decompressed output matches test string (lzf & unlzf)"
-
         touch $out
       '';
     };
@@ -101,16 +121,20 @@ stdenv.mkDerivation (finalAttrs: {
       nativeBuildInputs = [ pkg-config ];
       buildInputs = [
         finalAttrs.finalPackage.dev
-        finalAttrs.finalPackage
       ];
-      # tests both the library and pkg-config file
       script = ''
-        $CC -g ${./lib_test.c} -o lib_test \
+        substitute ${./lib_test.c} lib_test.c \
+          --replace-fail '#include <liblzf/lzf.h>' '#include <lzf.h>'
+        $CC -g lib_test.c -o lib_test \
           $(pkg-config --cflags --libs liblzf)
 
         ./lib_test >/dev/null
 
-        echo "Built and tested file linked against liblzf using pkg-config"
+        $CC -g ${./lib_test.c} -o lib_test-namespaced \
+          $(pkg-config --cflags --libs liblzf)
+
+        ./lib_test-namespaced >/dev/null
+
         touch $out
       '';
     };
diff --git a/pkgs/by-name/li/libmng/package.nix b/pkgs/by-name/li/libmng/package.nix
index 13b8b2fc4e9a..3d9d9dee4165 100644
--- a/pkgs/by-name/li/libmng/package.nix
+++ b/pkgs/by-name/li/libmng/package.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Reference library for reading, displaying, writing and examining Multiple-Image Network Graphics";
-    homepage = "http://www.libmng.com";
+    homepage = "https://sourceforge.net/projects/libmng/";
     license = lib.licenses.zlib;
     maintainers = [ ];
     platforms = lib.platforms.unix ++ lib.platforms.windows;
diff --git a/pkgs/by-name/li/libsepol/package.nix b/pkgs/by-name/li/libsepol/package.nix
index a81941faaf6c..1d28815ffb93 100644
--- a/pkgs/by-name/li/libsepol/package.nix
+++ b/pkgs/by-name/li/libsepol/package.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "SELinux binary policy manipulation library";
-    homepage = "http://userspace.selinuxproject.org";
+    homepage = "https://github.com/SELinuxProject/selinux";
     platforms = lib.platforms.linux;
     # Note: changing maintainers here changes maintainers for all SELinux-related libraries
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/li/libunity/fix-vala.patch b/pkgs/by-name/li/libunity/fix-vala.patch
deleted file mode 100644
index 555c2ad7bcb0..000000000000
--- a/pkgs/by-name/li/libunity/fix-vala.patch
+++ /dev/null
@@ -1,12 +0,0 @@
---- a/protocol/protocol-icon.vala	2013-08-27 12:53:57 +0000
-+++ b/protocol/protocol-icon.vala	2021-04-13 22:34:41 +0000
-@@ -185,7 +185,7 @@
-   }
- 
-   /* Added to GIcon interface in 2.37 */
--  private Variant serialize ()
-+  private Variant? serialize ()
-   {
-     Variant? ret = null;
-     return ret;
-
diff --git a/pkgs/by-name/li/libunity/package.nix b/pkgs/by-name/li/libunity/package.nix
deleted file mode 100644
index 2aa39b5e3ba1..000000000000
--- a/pkgs/by-name/li/libunity/package.nix
+++ /dev/null
@@ -1,75 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchgit,
-  pkg-config,
-  glib,
-  vala,
-  dee,
-  gobject-introspection,
-  libdbusmenu,
-  gtk3,
-  intltool,
-  python3,
-  autoreconfHook,
-}:
-
-stdenv.mkDerivation {
-  pname = "libunity";
-  version = "7.1.4-unstable-2021-02-01";
-
-  outputs = [
-    "out"
-    "dev"
-    "py"
-  ];
-
-  # Obtained from https://git.launchpad.net/ubuntu/+source/libunity/log/
-  src = fetchgit {
-    url = "https://git.launchpad.net/ubuntu/+source/libunity";
-    rev = "import/7.1.4+19.04.20190319-5";
-    sha256 = "LHUs6kl1srS6Xektx+jmm4SXLR47VuQ9IhYbBxf2Wc8=";
-  };
-
-  patches = [
-    # Fix builf with latest Vala
-    # https://code.launchpad.net/~jtojnar/libunity/libunity
-    # Did not send upstream because Ubuntu is stuck on Vala 0.48.
-    ./fix-vala.patch
-  ];
-
-  nativeBuildInputs = [
-    autoreconfHook
-    gobject-introspection
-    intltool
-    pkg-config
-    python3
-    vala
-  ];
-
-  buildInputs = [
-    glib
-    gtk3
-  ];
-
-  propagatedBuildInputs = [
-    dee
-    libdbusmenu
-  ];
-
-  preConfigure = ''
-    intltoolize
-  '';
-
-  configureFlags = [
-    "--with-pygi-overrides-dir=${placeholder "py"}/${python3.sitePackages}/gi/overrides"
-  ];
-
-  meta = {
-    description = "Library for instrumenting and integrating with all aspects of the Unity shell";
-    homepage = "https://launchpad.net/libunity";
-    license = lib.licenses.lgpl3;
-    platforms = lib.platforms.linux;
-    maintainers = [ ];
-  };
-}
diff --git a/pkgs/by-name/li/libxc/package.nix b/pkgs/by-name/li/libxc/package.nix
index 4a70bc0610c3..68804d5519d3 100644
--- a/pkgs/by-name/li/libxc/package.nix
+++ b/pkgs/by-name/li/libxc/package.nix
@@ -73,7 +73,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Library of exchange-correlation functionals for density-functional theory";
     mainProgram = "xc-info";
-    homepage = "https://www.tddft.org/programs/Libxc/";
+    homepage = "https://libxc.gitlab.io";
     license = lib.licenses.mpl20;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ markuskowa ];
diff --git a/pkgs/by-name/li/lightlocker/package.nix b/pkgs/by-name/li/lightlocker/package.nix
index 1f155094a21c..6040dc709eb7 100644
--- a/pkgs/by-name/li/lightlocker/package.nix
+++ b/pkgs/by-name/li/lightlocker/package.nix
@@ -14,7 +14,7 @@
   libxscrnsaver,
   libxxf86vm,
   libxext,
-  systemd,
+  systemdLibs,
   pantheon,
   wrapGAppsHook3,
 }:
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
     libxscrnsaver
     libxext
     libxxf86vm
-    systemd
+    systemdLibs
   ];
 
   mesonFlags = [
diff --git a/pkgs/by-name/lm/lms/package.nix b/pkgs/by-name/lm/lms/package.nix
index 322d11f5457c..ae02ebb1f80a 100644
--- a/pkgs/by-name/lm/lms/package.nix
+++ b/pkgs/by-name/lm/lms/package.nix
@@ -5,7 +5,7 @@
   cmake,
   pkg-config,
   gtest,
-  boost,
+  boost190,
   wt,
   taglib,
   libconfig,
@@ -20,15 +20,18 @@
   onnxruntime,
 }:
 
+let
+  boost = boost190;
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "lms";
-  version = "3.80.0";
+  version = "3.81.0";
 
   src = fetchFromGitHub {
     owner = "epoupon";
     repo = "lms";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-TXtSsQ6qsZd5WpW9d9o/ELcvkGEMj9Sih376AoyyaFA=";
+    hash = "sha256-wyMTnTlKMS4N3zTY4C574BTB88nRugsi21QWjDeLZrg=";
   };
 
   strictDeps = true;
@@ -52,6 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
     xxhash
     pugixml
     onnxruntime
+    ffmpeg
   ];
 
   postPatch = ''
@@ -59,7 +63,6 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   postInstall = ''
-    substituteInPlace $out/share/lms/lms.conf --replace-fail "/usr/bin/ffmpeg" "${lib.getExe ffmpeg}"
     substituteInPlace $out/share/lms/lms.conf --replace-fail "/usr/share/Wt/resources" "${wt}/share/Wt/resources"
     substituteInPlace $out/share/lms/lms.conf --replace-fail "/usr/share/lms" "$out/share/lms"
     substituteInPlace $out/share/lms/default.service --replace-fail "/usr/bin/lms" "$out/bin/lms"
diff --git a/pkgs/by-name/ma/marvin/package.nix b/pkgs/by-name/ma/marvin/package.nix
index bd952865e877..b28b0d12b8c9 100644
--- a/pkgs/by-name/ma/marvin/package.nix
+++ b/pkgs/by-name/ma/marvin/package.nix
@@ -88,7 +88,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Chemical modelling, analysis and structure drawing program";
-    homepage = "https://chemaxon.com/products/marvin";
+    homepage = "https://www.certara.com/marvin/";
     maintainers = with lib.maintainers; [ fusion809 ];
     license = lib.licenses.unfree;
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/mc/mc/package.nix b/pkgs/by-name/mc/mc/package.nix
index 8bc916ea2253..fa63ec0295b2 100644
--- a/pkgs/by-name/mc/mc/package.nix
+++ b/pkgs/by-name/mc/mc/package.nix
@@ -83,12 +83,14 @@ stdenv.mkDerivation (finalAttrs: {
       --replace /bin/rm ${coreutils}/bin/rm
   '';
 
-  postFixup = lib.optionalString ((!stdenv.hostPlatform.isDarwin) && x11Support) ''
-    # libX11.so is loaded dynamically so autopatch doesn't detect it
-    patchelf \
-      --add-needed ${libx11}/lib/libX11.so \
-      $out/bin/mc
-  '';
+  postFixup =
+    lib.optionalString (!stdenv.hostPlatform.isDarwin && x11Support && !stdenv.hostPlatform.isStatic)
+      ''
+        # libX11.so is loaded dynamically so autopatch doesn't detect it
+        patchelf \
+          --add-needed ${libx11}/lib/libX11.so \
+          $out/bin/mc
+      '';
 
   passthru.updateScript = writeScript "update-mc" ''
     #!/usr/bin/env nix-shell
diff --git a/pkgs/by-name/mc/mcp-searxng/package.nix b/pkgs/by-name/mc/mcp-searxng/package.nix
index c839d0f1834f..879cfd239011 100644
--- a/pkgs/by-name/mc/mcp-searxng/package.nix
+++ b/pkgs/by-name/mc/mcp-searxng/package.nix
@@ -6,7 +6,7 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "mcp-searxng";
-  version = "2.5.0";
+  version = "2.5.1";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -15,10 +15,10 @@ buildNpmPackage (finalAttrs: {
     owner = "ihor-sokoliuk";
     repo = "mcp-searxng";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yfxnYD1onNw5J6yLq2RxqAtlNnH319DWD1Zu3JM8eq0=";
+    hash = "sha256-TqDj86FTOekTswNQkTkiC8Q/H46bz4iigr5GRlM9Tno=";
   };
 
-  npmDepsHash = "sha256-QhUqB/+R3BGwx8gH0MDn+PiMEtira3vZdosJj8oMsaI=";
+  npmDepsHash = "sha256-WuN8xzG5uU1wZdMLdiT2GfUn1BeHTdtIkBc4x2kz81Q=";
 
   meta = {
     description = "Private web search for AI assistants via SearXNG — supports Claude, Cursor, and any MCP client";
diff --git a/pkgs/by-name/mc/mcpelauncher-client/package.nix b/pkgs/by-name/mc/mcpelauncher-client/package.nix
index 9b3e3b66db12..7f6d690d8dde 100644
--- a/pkgs/by-name/mc/mcpelauncher-client/package.nix
+++ b/pkgs/by-name/mc/mcpelauncher-client/package.nix
@@ -32,7 +32,7 @@ in
 # Bionic libc part doesn't compile with GCC
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "mcpelauncher-client";
-  version = "1.7.6-qt6";
+  version = "1.8.4-qt6";
 
   # NOTE: check mcpelauncher-ui-qt when updating
   src = fetchFromGitHub {
@@ -40,7 +40,7 @@ clangStdenv.mkDerivation (finalAttrs: {
     repo = "mcpelauncher-manifest";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-KAHAr1cAkG6B15CTwxRWZWT9IdTcvCSal3jrPe8C4wE=";
+    hash = "sha256-F54XFbXB0dkssva95pmKwPjmmnjupBHCxShySClFUgY=";
   };
 
   patches = [
diff --git a/pkgs/by-name/mc/mcpelauncher-ui-qt/package.nix b/pkgs/by-name/mc/mcpelauncher-ui-qt/package.nix
index 4731dac82c22..9a382a9e5df0 100644
--- a/pkgs/by-name/mc/mcpelauncher-ui-qt/package.nix
+++ b/pkgs/by-name/mc/mcpelauncher-ui-qt/package.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
     repo = "mcpelauncher-ui-manifest";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-Oibi7+LJK7K1a1fFN2SKy4XiA0gSC4u7Wmk0t86SHaw=";
+    hash = "sha256-AFQEcSLcjuPZJI/w9LI0/Y/lrPpPXVqgAIULqToCqu8=";
   };
 
   patches = [
diff --git a/pkgs/by-name/mi/microsoft-edge/package.nix b/pkgs/by-name/mi/microsoft-edge/package.nix
index 73481a602e34..7cfd8ec51171 100644
--- a/pkgs/by-name/mi/microsoft-edge/package.nix
+++ b/pkgs/by-name/mi/microsoft-edge/package.nix
@@ -56,7 +56,7 @@
   commandLineArgs ? "",
 
   # Will crash without.
-  systemd,
+  systemdLibs,
 
   # Loaded at runtime.
   libexif,
@@ -169,7 +169,7 @@ let
     pipewire
     snappy
     speechd-minimal
-    systemd
+    systemdLibs
     util-linux
     vulkan-loader
     wayland
diff --git a/pkgs/by-name/mi/mio/package.nix b/pkgs/by-name/mi/mio/package.nix
index 845408564c58..d3f1fef08065 100644
--- a/pkgs/by-name/mi/mio/package.nix
+++ b/pkgs/by-name/mi/mio/package.nix
@@ -7,7 +7,10 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mio";
-  version = "unstable-2023-03-03";
+  version = "0-unstable-2023-03-03";
+
+  strictDeps = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "vimpunk";
diff --git a/pkgs/by-name/mi/mistral-rs/package.nix b/pkgs/by-name/mi/mistral-rs/package.nix
index 00745ebebd18..e7e48296088c 100644
--- a/pkgs/by-name/mi/mistral-rs/package.nix
+++ b/pkgs/by-name/mi/mistral-rs/package.nix
@@ -294,6 +294,18 @@ rustPlatform.buildRustPackage (finalAttrs: {
         [ "x86_64-linux" ]
       else
         lib.platforms.unix;
-    broken = mklSupport;
+    problems =
+      lib.optionalAttrs mklSupport {
+        broken-mkl-support = {
+          kind = "broken";
+          message = "mistral-rs' MKL support is currently broken.";
+        };
+      }
+      // lib.optionalAttrs (cudaSupport && (cudaPackages.cudaAtLeast "13.4")) {
+        unsupported-cuda-toolkit = {
+          kind = "broken";
+          message = "mistral-rs is not compatible with CUDA ${cudaPackages.cudaMajorMinorVersion}.";
+        };
+      };
   };
 })
diff --git a/pkgs/by-name/mo/modem-manager-gui/package.nix b/pkgs/by-name/mo/modem-manager-gui/package.nix
index bece7293f5ed..8756d8eda82c 100644
--- a/pkgs/by-name/mo/modem-manager-gui/package.nix
+++ b/pkgs/by-name/mo/modem-manager-gui/package.nix
@@ -79,7 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
       functions. You can check balance of your SIM card, send or receive SMS
       messages, control mobile traffic consumption and more.
     '';
-    homepage = "https://linuxonly.ru/page/modem-manager-gui";
+    homepage = "https://salsa.debian.org/debian/modem-manager-gui";
     license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [
       ahuzik
diff --git a/pkgs/by-name/mo/mongodb-compass/package.nix b/pkgs/by-name/mo/mongodb-compass/package.nix
index 03b84e869b1a..5805255434a4 100644
--- a/pkgs/by-name/mo/mongodb-compass/package.nix
+++ b/pkgs/by-name/mo/mongodb-compass/package.nix
@@ -38,7 +38,7 @@
   libxkbcommon,
   libgbm,
   vulkan-loader,
-  systemd,
+  systemdLibs,
   libGL,
   krb5,
   fontconfig,
@@ -99,7 +99,7 @@ let
     nss
     pango
     stdenv.cc.cc
-    systemd
+    systemdLibs
     libx11
     libxscrnsaver
     libxcomposite
diff --git a/pkgs/by-name/mo/mountpoint-s3/package.nix b/pkgs/by-name/mo/mountpoint-s3/package.nix
index dafb8e5d5c27..4c6e805ac802 100644
--- a/pkgs/by-name/mo/mountpoint-s3/package.nix
+++ b/pkgs/by-name/mo/mountpoint-s3/package.nix
@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mountpoint-s3";
-  version = "1.22.3";
+  version = "1.24.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "mountpoint-s3";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-22tx8ozXkzBNAflDPc7cdfUh9TWD6aB/Fe/z/dPZ694=";
+    hash = "sha256-UDL1y7xmVhv/KlWiDOdvRahUF831kXGBIOcSmDRJCGs=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-SSSXqgJ3OERCVw81iXqXRRpVXgdwhlefHhI/qvQyl4g=";
+  cargoHash = "sha256-N2Rf6ikEBSsTQBsb5xGPWj0ElHjKnCx5FSd85DLqKM4=";
 
   # thread 'main' panicked at cargo-auditable/src/collect_audit_data.rs:77:9:
   # cargo metadata failure: error: none of the selected packages contains these features: libfuse3
@@ -42,6 +42,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ];
 
   checkFlags = [
+    "--skip=io::tls::test::build_tls_connection_options"
+    "--skip=s3::client::tests::tls_connection_options_wiring"
+    "--skip=s3::config::tests::test_read_part_size_exceeds_budget_default_clamps"
+    "--skip=mountpoint-s3-client/src/lib.rs"
+
     #thread 's3_crt_client::tests::test_expected_bucket_owner' panicked at mountpoint-s3-client/src/s3_crt_client.rs:1123:47:
     #Create test client: ProviderFailure(Error(1173, "aws-c-io: AWS_IO_TLS_ERROR_DEFAULT_TRUST_STORE_NOT_FOUND, Default TLS trust store not found on this system. Trusted CA certificates must be installed, or \"override default trust store\" must be used while creating the TLS context."))
     #
diff --git a/pkgs/by-name/mr/mro-unicode/package.nix b/pkgs/by-name/mr/mro-unicode/package.nix
index 8b87d66f2cb4..45c17cfec91e 100644
--- a/pkgs/by-name/mr/mro-unicode/package.nix
+++ b/pkgs/by-name/mr/mro-unicode/package.nix
@@ -6,7 +6,10 @@
 
 stdenvNoCC.mkDerivation {
   pname = "mro-unicode";
-  version = "unstable-2013-05-25";
+  version = "0-unstable-2013-05-31";
+
+  strictDeps = true;
+  __structuredAttrs = true;
 
   src = fetchurl {
     url = "https://github.com/phjamr/MroUnicode/raw/f297de070f7eba721a47c850e08efc119d3bfbe8/MroUnicode-Regular.ttf";
diff --git a/pkgs/by-name/mt/mtkclient/package.nix b/pkgs/by-name/mt/mtkclient/package.nix
index e6e67a53a8eb..6f272686c00f 100644
--- a/pkgs/by-name/mt/mtkclient/package.nix
+++ b/pkgs/by-name/mt/mtkclient/package.nix
@@ -52,6 +52,11 @@ python3Packages.buildPythonApplication rec {
   #       systemd 258 or newer and 51-edl.rules only applies to Qualcomm (i.e. not MTK).
   postInstall = ''
     install -Dm444 Setup/Linux/52-mtk.rules -t $out/lib/udev/rules.d
+
+    for size in 32 64 256 512; do
+      install -Dm444 mtkclient/gui/images/logo_$size.png \
+        $out/share/icons/hicolor/''${size}x''${size}/apps/mtkclient.png
+    done
   '';
 
   desktopItems = [
@@ -60,6 +65,7 @@ python3Packages.buildPythonApplication rec {
       desktopName = "MTKClient";
       comment = "Mediatek Flash and Repair Utility";
       exec = "mtk_gui";
+      icon = "mtkclient";
       categories = [
         "Development"
       ];
diff --git a/pkgs/by-name/mu/museum/package.nix b/pkgs/by-name/mu/museum/package.nix
index a3157e99aae6..2f042f648fda 100644
--- a/pkgs/by-name/mu/museum/package.nix
+++ b/pkgs/by-name/mu/museum/package.nix
@@ -10,17 +10,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "museum";
-  version = "1.3.64";
+  version = "1.3.65";
 
   src = fetchFromGitHub {
     owner = "ente";
     repo = "ente";
     sparseCheckout = [ "server" ];
     tag = "photos-v${finalAttrs.version}";
-    hash = "sha256-QX+XrA2lAbmP5O36ViAwBmR1yRJw+35SH4PaG9qOuyw=";
+    hash = "sha256-VzeawAO4nGE5lwaRMSznbX0qwrvCbTaZxoi7hxCvTj8=";
   };
 
-  vendorHash = "sha256-iiytPsRsu0iBqDwSr5NavRfWOd/7ZLd5KBpLDuTkbz0=";
+  vendorHash = "sha256-NADYbTkO0ng3lYll9+W7ICGOkUuYim8FRLtkoraMgRY=";
 
   sourceRoot = "${finalAttrs.src.name}/server";
 
diff --git a/pkgs/by-name/mu/music-assistant/librespot.patch b/pkgs/by-name/mu/music-assistant/librespot.patch
index 840a10e27df5..891a1d8969a5 100644
--- a/pkgs/by-name/mu/music-assistant/librespot.patch
+++ b/pkgs/by-name/mu/music-assistant/librespot.patch
@@ -1,17 +1,16 @@
 diff --git a/music_assistant/providers/spotify/helpers.py b/music_assistant/providers/spotify/helpers.py
-index d0f5512b0..b8ac0f329 100644
+index 58623de63..ba3b2ca75 100644
 --- a/music_assistant/providers/spotify/helpers.py
 +++ b/music_assistant/providers/spotify/helpers.py
-@@ -6,6 +6,7 @@
- import os
- import platform
+@@ -9,6 +9,7 @@ import platform
+ import re
+ import tempfile
  import time
 +from shutil import which
  from contextlib import suppress
  from pathlib import Path
  from typing import TYPE_CHECKING, Any
- 
-@@ -28,16 +29,12 @@ async def check_librespot(librespot_path: str) -> str | None:
+@@ -59,16 +60,12 @@ async def get_librespot_binary() -> str:
          except OSError:
              return None
  
diff --git a/pkgs/by-name/na/naev/package.nix b/pkgs/by-name/na/naev/package.nix
index a988a316c909..efe70d6916ec 100644
--- a/pkgs/by-name/na/naev/package.nix
+++ b/pkgs/by-name/na/naev/package.nix
@@ -123,7 +123,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "2D action/rpg space game";
     mainProgram = "naev";
-    homepage = "http://www.naev.org";
+    homepage = "http://naev.org";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ ralismark ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/nd/ndg/package.nix b/pkgs/by-name/nd/ndg/package.nix
index 2ae61dc755c3..5ece13d67cbd 100644
--- a/pkgs/by-name/nd/ndg/package.nix
+++ b/pkgs/by-name/nd/ndg/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ndg";
-  version = "2.10.1";
+  version = "2.10.2";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "feel-co";
     repo = "ndg";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yytpu/au9gPC9ItFvSkHBl7lbsR8W4+J5qXaVYpLyj4=";
+    hash = "sha256-BjReQjJR7LJxHmkqLIGEvulq/vvv8bzgGtK0J8CvAvk=";
   };
 
-  cargoHash = "sha256-loFStzNGs0WRvf1KzS3Sw9Hd0NWds6ZRbcZqYJNpVLA=";
+  cargoHash = "sha256-H+IiwGS08l2mR5pjnIhmzVnw3Xyz++/jmjAyh/TVGcc=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ne/nemu/package.nix b/pkgs/by-name/ne/nemu/package.nix
index af1be5c21d61..d179cc9fd407 100644
--- a/pkgs/by-name/ne/nemu/package.nix
+++ b/pkgs/by-name/ne/nemu/package.nix
@@ -21,7 +21,7 @@
   socat,
   sqlite,
   stdenv,
-  systemd,
+  systemdLibs,
   tigervnc,
 }:
 
@@ -65,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
     qemu
     socat
     sqlite
-    systemd # for libudev
+    systemdLibs # for libudev
     tigervnc
   ];
 
diff --git a/pkgs/by-name/ne/newsboat/package.nix b/pkgs/by-name/ne/newsboat/package.nix
index f803c4446e68..3ec056f6b321 100644
--- a/pkgs/by-name/ne/newsboat/package.nix
+++ b/pkgs/by-name/ne/newsboat/package.nix
@@ -21,18 +21,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "newsboat";
-  version = "2.44";
+  version = "2.45";
 
   src = fetchFromGitHub {
     owner = "newsboat";
     repo = "newsboat";
     tag = "r${finalAttrs.version}";
-    hash = "sha256-OV7WpM0NBfqOtFv9Co728UwHut4HhT2u5qgvamy/FAg=";
+    hash = "sha256-3joEytlm0KPLF7hbIG+9X6X+D6ydeLFTRrWf14j3p+E=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-HJZnbQ7TDJ9zg0Rav1PCMEymaYy/mSxnrr2gkv4pTX0=";
+    hash = "sha256-Tp1P/kE21jtM8vxBwy0FmScPU2LTHx9EH6YfhCWn0kE=";
   };
 
   # allow other ncurses versions on Darwin
diff --git a/pkgs/by-name/ne/nextcloud-spreed-signaling/package.nix b/pkgs/by-name/ne/nextcloud-spreed-signaling/package.nix
index 9591312f9c39..bf80c02464a5 100644
--- a/pkgs/by-name/ne/nextcloud-spreed-signaling/package.nix
+++ b/pkgs/by-name/ne/nextcloud-spreed-signaling/package.nix
@@ -8,6 +8,7 @@
 buildGoModule (finalAttrs: {
   pname = "nextcloud-spreed-signaling";
   version = "2.1.1";
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "strukturag";
@@ -30,6 +31,10 @@ buildGoModule (finalAttrs: {
     maintainers = with lib.maintainers; [
       hensoko
     ];
-    platforms = [ "x86_64-linux" ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "riscv64-linux"
+    ];
   };
 })
diff --git a/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix b/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix
index cf9e5cbececd..45bbf6859007 100644
--- a/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix
+++ b/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix
@@ -24,7 +24,7 @@
   gtk3,
   libGL,
   libglvnd,
-  systemd,
+  systemdLibs,
   patchelf,
   undmg,
   makeWrapper,
@@ -110,7 +110,7 @@ let
     runtimeDependencies = [
       # Required to launch the application and proceed past the zygote_linux fork() process
       # Fixes `Zygote could not fork`
-      systemd
+      systemdLibs
 
       # Fixes input/output audio device selection
       libpulseaudio
diff --git a/pkgs/by-name/nf/nfswolf/package.nix b/pkgs/by-name/nf/nfswolf/package.nix
index db0c91400b47..ac270a103c56 100644
--- a/pkgs/by-name/nf/nfswolf/package.nix
+++ b/pkgs/by-name/nf/nfswolf/package.nix
@@ -37,5 +37,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "nfswolf";
+    platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/by-name/ni/ninka/package.nix b/pkgs/by-name/ni/ninka/package.nix
index 8af94d092272..4e3564294074 100644
--- a/pkgs/by-name/ni/ninka/package.nix
+++ b/pkgs/by-name/ni/ninka/package.nix
@@ -40,7 +40,7 @@ perlPackages.buildPerlPackage {
   meta = {
     description = "Sentence based license detector";
     mainProgram = "ninka";
-    homepage = "http://ninka.turingmachine.org/";
+    homepage = "https://github.com/dmgerman/ninka";
     license = lib.licenses.gpl2;
     maintainers = [ ];
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/ni/nix-check-deps/package.nix b/pkgs/by-name/ni/nix-check-deps/package.nix
index 9dff89cdbe75..7b9831d97a99 100644
--- a/pkgs/by-name/ni/nix-check-deps/package.nix
+++ b/pkgs/by-name/ni/nix-check-deps/package.nix
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage {
   version = "0-unstable-2025-04-09";
 
   src = fetchFromGitHub {
-    owner = "LordGrimmauld";
+    owner = "GrimmTheShrimp";
     repo = "nix-check-deps";
     rev = "263701905ec40a19c52d23d0fdceb1126e20c99e";
     hash = "sha256-RaPk8Cd5ovskxFFvFd0+auIopCo1YHyH+6199qK+d18=";
diff --git a/pkgs/by-name/ni/nix-weather/package.nix b/pkgs/by-name/ni/nix-weather/package.nix
index 48ab325dc19f..419571635816 100644
--- a/pkgs/by-name/ni/nix-weather/package.nix
+++ b/pkgs/by-name/ni/nix-weather/package.nix
@@ -67,8 +67,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
       Heavily inspired by guix weather.
     '';
-    homepage = "https://git.fem.gg/cafkafk/nix-weather";
-    changelog = "https://git.fem.gg/cafkafk/nix-weather/releases/tag/v${finalAttrs.version}";
+    homepage = "https://github.com/cafkafk/nix-weather";
+    changelog = "https://github.com/cafkafk/nix-weather/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.eupl12;
     mainProgram = "nix-weather";
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index e7782b545828..fdc41a27f902 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -286,6 +286,7 @@ def find_file(file: str, nix_flags: Args | None = None) -> Path | None:
 def get_build_image_name(
     build_attr: BuildAttr,
     image_variant: str,
+    specialisation: str | None,
     instantiate_flags: Args | None = None,
 ) -> str:
     path = (
@@ -305,7 +306,7 @@ def get_build_image_name(
               value = import {path};
               set = if builtins.isFunction value then value {{}} else value;
             in
-              set.{build_attr.to_attr("config.system.build.images", image_variant, "passthru", "filePath")}
+              set.{build_attr.to_attr(get_build_image_attr(specialisation), image_variant, "passthru", "filePath")}
             """),
             *dict_to_flags(instantiate_flags),
         ],
@@ -318,6 +319,7 @@ def get_build_image_name(
 def get_build_image_name_flake(
     flake: Flake,
     image_variant: str,
+    specialisation: str | None,
     eval_flags: Args | None = None,
 ) -> str:
     r = run_wrapper(
@@ -327,7 +329,7 @@ def get_build_image_name_flake(
             "eval",
             "--json",
             flake.to_attr(
-                "config.system.build.images", image_variant, "passthru", "filePath"
+                get_build_image_attr(specialisation), image_variant, "passthru", "filePath"
             ),
             *dict_to_flags(eval_flags),
         ],
@@ -339,6 +341,7 @@ def get_build_image_name_flake(
 
 def get_build_image_variants(
     build_attr: BuildAttr,
+    specialisation: str | None,
     instantiate_flags: Args | None = None,
 ) -> ImageVariants:
     path = (
@@ -358,7 +361,7 @@ def get_build_image_variants(
               value = import {path};
               set = if builtins.isFunction value then value {{}} else value;
             in
-              builtins.attrNames set.{build_attr.to_attr("config.system.build.images")}
+              builtins.attrNames set.{build_attr.to_attr(get_build_image_attr(specialisation))}
             """),
             *dict_to_flags(instantiate_flags),
         ],
@@ -370,6 +373,7 @@ def get_build_image_variants(
 
 def get_build_image_variants_flake(
     flake: Flake,
+    specialisation: str | None,
     eval_flags: Args | None = None,
 ) -> ImageVariants:
     r = run_wrapper(
@@ -378,7 +382,7 @@ def get_build_image_variants_flake(
             *FLAKE_FLAGS,
             "eval",
             "--json",
-            flake.to_attr("config.system.build.images"),
+            flake.to_attr(get_build_image_attr(specialisation)),
             "--apply",
             "builtins.attrNames",
             *dict_to_flags(eval_flags),
@@ -388,6 +392,10 @@ def get_build_image_variants_flake(
     j: ImageVariants = json.loads(r.stdout.strip())
     return j
 
+def get_build_image_attr(specialisation: str | None) -> str:
+    if specialisation:
+        return f"config.specialisation.{specialisation}.configuration.system.build.images"
+    return "config.system.build.images"
 
 def get_nixpkgs_rev(nixpkgs_path: Path | None) -> str | None:
     """Get Nixpkgs path as a Git revision.
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
index 018705d3a03a..2b1b3280e67e 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
@@ -96,20 +96,26 @@ def _get_system_attr(
     grouped_nix_args: GroupedNixArgs,
 ) -> str:
     match action:
-        case Action.BUILD_IMAGE if flake:
-            variants = nix.get_build_image_variants_flake(
-                flake,
-                eval_flags=grouped_nix_args.flake_eval_flags,
-            )
+        case Action.BUILD_IMAGE:
+            variants: ImageVariants = {}
+            if flake:
+                variants = nix.get_build_image_variants_flake(
+                    flake,
+                    args.specialisation,
+                    eval_flags=grouped_nix_args.flake_eval_flags,
+                )
+            elif build_attr:
+                variants = nix.get_build_image_variants(
+                    build_attr,
+                    args.specialisation,
+                    instantiate_flags=grouped_nix_args.common_flags,
+                )
+            else:
+                raise NixOSRebuildError("failed to get image variants: both `flake` and `build_attr` are None")
+
             _validate_image_variant(args.image_variant, variants)
-            return f"config.system.build.images.{args.image_variant}"
-        case Action.BUILD_IMAGE if build_attr:
-            variants = nix.get_build_image_variants(
-                build_attr,
-                instantiate_flags=grouped_nix_args.common_flags,
-            )
-            _validate_image_variant(args.image_variant, variants)
-            return f"config.system.build.images.{args.image_variant}"
+            return f"{nix.get_build_image_attr(args.specialisation)}.{args.image_variant}"
+
         case Action.BUILD_VM:
             if args.specialisation:
                 return f"config.specialisation.{args.specialisation}.configuration.system.build.vm"
@@ -261,12 +267,14 @@ def _activate_system(
                 image_name = nix.get_build_image_name_flake(
                     flake,
                     args.image_variant,
+                    args.specialisation,
                     eval_flags=grouped_nix_args.flake_eval_flags,
                 )
             else:
                 image_name = nix.get_build_image_name(
                     build_attr,
                     args.image_variant,
+                    args.specialisation,
                     instantiate_flags=grouped_nix_args.common_flags,
                 )
             disk_path = path_to_config / image_name
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
index 91c3bf93c729..403dca07c585 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
@@ -467,6 +467,159 @@ def test_execute_nix_build_vm_with_bootloader_and_specialisation(
         ),
     ]
 
+@patch.dict(os.environ, {}, clear=True)
+@patch("subprocess.run", autospec=True)
+def test_execute_nix_build_image(mock_run: Mock, tmp_path: Path) -> None:
+    config_path = tmp_path / "test"
+    config_path.touch()
+
+    def run_side_effect(args: list[str], **kwargs: Any) -> CompletedProcess[str]:
+        if args[0] == "nix-instantiate" and "--eval" in args:
+            return CompletedProcess(
+                [],
+                0,
+                '"nixos-image-azure-25.05.20250102.6df2492-x86_64-linux.vhd"',
+            )
+        elif args[0] == "nix-build":
+            return CompletedProcess([], 0, str(config_path))
+        elif args[0] == "nix-instantiate":
+            return CompletedProcess([], 1)
+        else:
+            return CompletedProcess([], 0)
+
+    mock_run.side_effect = run_side_effect
+
+    nr.execute(
+        [
+            "nixos-rebuild",
+            "build-image",
+            "--image-variant",
+            "azure",
+            "--no-flake",
+        ]
+    )
+
+    assert mock_run.mock_calls == [
+        call(
+            ["nix-instantiate", "--find-file", "nixos-system"],
+            check=False,
+            capture_output=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix-instantiate",
+                "--eval",
+                "--strict",
+                "--json",
+                "--expr", "\nlet\n  value = import <nixpkgs/nixos>;\n  set = if builtins.isFunction value then value {} else value;\nin\n  builtins.attrNames set.config.system.build.images\n"
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix-build",
+                "<nixpkgs/nixos>",
+                "--attr",
+                "config.system.build.images.azure"
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix-instantiate",
+                "--eval",
+                "--strict",
+                "--json",
+                "--expr", "\nlet\n  value = import <nixpkgs/nixos>;\n  set = if builtins.isFunction value then value {} else value;\nin\n  set.config.system.build.images.azure.passthru.filePath\n"
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+    ]
+
+@patch.dict(os.environ, {}, clear=True)
+@patch("subprocess.run", autospec=True)
+def test_execute_nix_build_image_and_specialisation(mock_run: Mock, tmp_path: Path) -> None:
+    config_path = tmp_path / "test"
+    config_path.touch()
+
+    def run_side_effect(args: list[str], **kwargs: Any) -> CompletedProcess[str]:
+        if args[0] == "nix-instantiate" and "--eval" in args:
+            return CompletedProcess(
+                [],
+                0,
+                '"nixos-image-azure-25.05.20250102.6df2492-x86_64-linux.vhd"',
+            )
+        elif args[0] == "nix-build":
+            return CompletedProcess([], 0, str(config_path))
+        elif args[0] == "nix-instantiate":
+            return CompletedProcess([], 1)
+        else:
+            return CompletedProcess([], 0)
+
+    mock_run.side_effect = run_side_effect
+
+    nr.execute(
+        [
+            "nixos-rebuild",
+            "build-image",
+            "--image-variant",
+            "azure",
+            "--no-flake",
+            "--specialisation",
+            "custom-specialisation",
+        ]
+    )
+
+    assert mock_run.mock_calls == [
+        call(
+            ["nix-instantiate", "--find-file", "nixos-system"],
+            check=False,
+            capture_output=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix-instantiate",
+                "--eval",
+                "--strict",
+                "--json",
+                "--expr", "\nlet\n  value = import <nixpkgs/nixos>;\n  set = if builtins.isFunction value then value {} else value;\nin\n  builtins.attrNames set.config.specialisation.custom-specialisation.configuration.system.build.images\n"
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix-build",
+                "<nixpkgs/nixos>",
+                "--attr",
+                "config.specialisation.custom-specialisation.configuration.system.build.images.azure"
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix-instantiate",
+                "--eval",
+                "--strict",
+                "--json",
+                "--expr", "\nlet\n  value = import <nixpkgs/nixos>;\n  set = if builtins.isFunction value then value {} else value;\nin\n  set.config.specialisation.custom-specialisation.configuration.system.build.images.azure.passthru.filePath\n"
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+    ]
 
 @patch.dict(os.environ, {}, clear=True)
 @patch("subprocess.run", autospec=True)
@@ -551,6 +704,91 @@ def test_execute_nix_build_image_flake(mock_run: Mock, tmp_path: Path) -> None:
         ),
     ]
 
+@patch.dict(os.environ, {}, clear=True)
+@patch("subprocess.run", autospec=True)
+def test_execute_nix_build_image_flake_and_specialisation(mock_run: Mock, tmp_path: Path) -> None:
+    config_path = tmp_path / "test"
+    config_path.touch()
+
+    def run_side_effect(args: list[str], **kwargs: Any) -> CompletedProcess[str]:
+        if args[0] == "nix" and "eval" in args:
+            return CompletedProcess(
+                [],
+                0,
+                '"nixos-image-azure-25.05.20250102.6df2492-x86_64-linux.vhd"',
+            )
+        elif args[0] == "nix":
+            return CompletedProcess([], 0, str(config_path))
+        elif args[0] == "nix-instantiate":
+            return CompletedProcess([], 1)
+        else:
+            return CompletedProcess([], 0)
+
+    mock_run.side_effect = run_side_effect
+
+    nr.execute(
+        [
+            "nixos-rebuild",
+            "build-image",
+            "--image-variant",
+            "azure",
+            "--flake",
+            "/path/to/config#hostname",
+            "--specialisation",
+            "custom-specialisation",
+        ]
+    )
+
+    assert mock_run.mock_calls == [
+        call(
+            ["nix-instantiate", "--find-file", "nixos-system"],
+            check=False,
+            capture_output=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix",
+                "--extra-experimental-features",
+                "nix-command flakes",
+                "eval",
+                "--json",
+                '/path/to/config#nixosConfigurations."hostname".config.specialisation.custom-specialisation.configuration.system.build.images',
+                "--apply",
+                "builtins.attrNames",
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix",
+                "--extra-experimental-features",
+                "nix-command flakes",
+                "build",
+                "--print-out-paths",
+                '/path/to/config#nixosConfigurations."hostname".config.specialisation.custom-specialisation.configuration.system.build.images.azure',
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix",
+                "--extra-experimental-features",
+                "nix-command flakes",
+                "eval",
+                "--json",
+                '/path/to/config#nixosConfigurations."hostname".config.specialisation.custom-specialisation.configuration.system.build.images.azure.passthru.filePath',
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+    ]
+
 
 @patch.dict(
     os.environ,
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
index fcad913e1b68..70ef43b44c9c 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@@ -351,7 +351,7 @@ def test_edit_flake(mock_run: Mock) -> None:
 )
 def test_get_build_image_variants(mock_run: Mock, tmp_path: Path) -> None:
     build_attr = m.BuildAttr("<nixpkgs/nixos>", None)
-    assert n.get_build_image_variants(build_attr) == {
+    assert n.get_build_image_variants(build_attr, None) == {
         "azure": "nixos-image-azure-25.05.20250102.6df2492-x86_64-linux.vhd",
         "vmware": "nixos-image-vmware-25.05.20250102.6df2492-x86_64-linux.vmdk",
     }
@@ -374,7 +374,7 @@ def test_get_build_image_variants(mock_run: Mock, tmp_path: Path) -> None:
     )
 
     build_attr = m.BuildAttr(tmp_path, "preAttr")
-    assert n.get_build_image_variants(build_attr, {"inst_flag": True}) == {
+    assert n.get_build_image_variants(build_attr, None, {"inst_flag": True}) == {
         "azure": "nixos-image-azure-25.05.20250102.6df2492-x86_64-linux.vhd",
         "vmware": "nixos-image-vmware-25.05.20250102.6df2492-x86_64-linux.vmdk",
     }
@@ -414,7 +414,7 @@ def test_get_build_image_variants(mock_run: Mock, tmp_path: Path) -> None:
 )
 def test_get_build_image_variants_flake(mock_run: Mock) -> None:
     flake = m.Flake("/flake.nix", "myAttr")
-    assert n.get_build_image_variants_flake(flake, {"eval_flag": True}) == {
+    assert n.get_build_image_variants_flake(flake, None, {"eval_flag": True}) == {
         "azure": "nixos-image-azure-25.05.20250102.6df2492-x86_64-linux.vhd",
         "vmware": "nixos-image-vmware-25.05.20250102.6df2492-x86_64-linux.vmdk",
     }
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_services.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_services.py
index 2d158da1be70..ac16ac3eb3bd 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_services.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_services.py
@@ -4,6 +4,7 @@ from pathlib import Path
 from subprocess import CompletedProcess
 from unittest.mock import ANY, Mock, call, patch
 
+import pytest
 from pytest import MonkeyPatch
 
 import nixos_rebuild as n
@@ -20,13 +21,13 @@ grouped_nix_args = n.models.GroupedNixArgs(
 )
 
 
-# TODO: add tests for Action.BUILD_IMAGE
 def test__get_system_attr() -> None:
     args = argparse.Namespace(specialisation=None)
     tests = {
         n.models.Action.BOOT: "config.system.build.toplevel",
         n.models.Action.BUILD_VM: "config.system.build.vm",
         n.models.Action.BUILD_VM_WITH_BOOTLOADER: "config.system.build.vmWithBootLoader",
+        # Action.BUILD_IMAGE is handled in the below test
     }
     for action, expected_system_attr in tests.items():
         assert (
@@ -45,6 +46,7 @@ def test__get_system_attr() -> None:
         n.models.Action.BOOT: "config.system.build.toplevel",
         n.models.Action.BUILD_VM: "config.specialisation.custom-specialisation.configuration.system.build.vm",
         n.models.Action.BUILD_VM_WITH_BOOTLOADER: "config.specialisation.custom-specialisation.configuration.system.build.vmWithBootLoader",
+        # Action.BUILD_IMAGE is handled in the below test
     }
     for action, expected_system_attr in tests.items():
         assert (
@@ -58,6 +60,82 @@ def test__get_system_attr() -> None:
             == expected_system_attr
         )
 
+@patch(
+    get_qualified_name(n.nix.run_wrapper, n.nix),
+    autospec=True,
+    return_value=CompletedProcess([], 0, stdout='["amazon","azure","cloudstack","digital-ocean","google-compute","hyperv","iso","iso-installer","kexec","kubevirt","linode","lxc","lxc-metadata","oci","openstack","openstack-zfs","proxmox","proxmox-lxc","qemu","qemu-efi","raw","raw-efi","sd-card","vagrant-virtualbox","virtualbox","vmware"]\n'),
+)
+def test__get_system_attr__build_image(
+    mock_run: Mock,
+    monkeypatch: MonkeyPatch,
+    tmpdir: Path,
+) -> None:
+    monkeypatch.chdir(tmpdir)
+
+    # both `flake` & `build_attr` None
+    args = argparse.Namespace(specialisation=None)
+    with pytest.raises(Exception) as e:
+        s._get_system_attr(
+            action=n.models.Action.BUILD_IMAGE,
+            args=args,
+            flake=None,
+            build_attr=None,
+            grouped_nix_args=grouped_nix_args,
+        )
+
+    # no specialisation
+    ## flake
+    args = argparse.Namespace(image_variant="iso", specialisation=None)
+    assert (
+        s._get_system_attr(
+            action=n.models.Action.BUILD_IMAGE,
+            args=args,
+            flake=n.models.Flake.parse("/flake.nix#hostname"),
+            build_attr=None,
+            grouped_nix_args=grouped_nix_args,
+        )
+        == "config.system.build.images.iso"
+    )
+
+    ## build_attr
+    args = argparse.Namespace(image_variant="iso", specialisation=None)
+    assert (
+        s._get_system_attr(
+            action=n.models.Action.BUILD_IMAGE,
+            args=args,
+            flake=None,
+            build_attr=n.BuildAttr.from_arg(None, None),
+            grouped_nix_args=grouped_nix_args,
+        )
+        == "config.system.build.images.iso"
+    )
+
+    # with specialisation
+    ## flake
+    args = argparse.Namespace(image_variant="iso", specialisation="custom-specialisation")
+    assert (
+        s._get_system_attr(
+            action=n.models.Action.BUILD_IMAGE,
+            args=args,
+            flake=n.models.Flake.parse("/flake.nix#hostname"),
+            build_attr=None,
+            grouped_nix_args=grouped_nix_args,
+        )
+        == "config.specialisation.custom-specialisation.configuration.system.build.images.iso"
+    )
+
+    ## build_attr
+    args = argparse.Namespace(image_variant="iso", specialisation="custom-specialisation")
+    assert (
+        s._get_system_attr(
+            action=n.models.Action.BUILD_IMAGE,
+            args=args,
+            flake=None,
+            build_attr=n.BuildAttr.from_arg(None, None),
+            grouped_nix_args=grouped_nix_args,
+        )
+        == "config.specialisation.custom-specialisation.configuration.system.build.images.iso"
+    )
 
 @patch.dict(os.environ, {}, clear=True)
 @patch("os.execve", autospec=True)
diff --git a/pkgs/by-name/no/nordpass/package.nix b/pkgs/by-name/no/nordpass/package.nix
index 9c1f9e310da9..108de6ef1746 100644
--- a/pkgs/by-name/no/nordpass/package.nix
+++ b/pkgs/by-name/no/nordpass/package.nix
@@ -32,7 +32,7 @@
   libpng,
   libnotify,
   libgcrypt,
-  systemd,
+  systemdLibs,
   fontconfig,
   dbus,
   expat,
@@ -83,7 +83,7 @@ let
     nss_latest
     pango
     stdenv.cc.cc
-    systemd
+    systemdLibs
     libice
     libsm
     libx11
diff --git a/pkgs/by-name/nw/nwg-panel/package.nix b/pkgs/by-name/nw/nwg-panel/package.nix
index a33a524a55e2..9b18dd4480a7 100644
--- a/pkgs/by-name/nw/nwg-panel/package.nix
+++ b/pkgs/by-name/nw/nwg-panel/package.nix
@@ -23,14 +23,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "nwg-panel";
-  version = "0.10.15";
+  version = "0.12.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-panel";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zRoOsVnwn2DQctB9ZP0pAAnf9Ragd2RZGHZGN1KnMsQ=";
+    hash = "sha256-KGaBDb2CXK0zel2mPGhdSXC2j8nysV9ktWn6wn8a8eQ=";
   };
 
   # No tests
diff --git a/pkgs/by-name/nw/nwjs/package.nix b/pkgs/by-name/nw/nwjs/package.nix
index a1261e82f52a..848f22d8e041 100644
--- a/pkgs/by-name/nw/nwjs/package.nix
+++ b/pkgs/by-name/nw/nwjs/package.nix
@@ -46,7 +46,7 @@
   nss,
   pango,
   sqlite,
-  systemd,
+  systemdLibs,
   udev,
 
   # update script
@@ -160,7 +160,7 @@ stdenv.mkDerivation (finalAttrs: {
     cp -R * $out/share/nwjs
     find $out/share/nwjs
 
-    ln -s ${lib.getLib systemd}/lib/libudev.so $out/share/nwjs/libudev.so.0
+    ln -s ${lib.getLib systemdLibs}/lib/libudev.so $out/share/nwjs/libudev.so.0
 
     mkdir -p $out/bin
     ln -s $out/share/nwjs/nw $out/bin
diff --git a/pkgs/by-name/ob/obexd/package.nix b/pkgs/by-name/ob/obexd/package.nix
index eb20f172618f..98b6cd9e8ace 100644
--- a/pkgs/by-name/ob/obexd/package.nix
+++ b/pkgs/by-name/ob/obexd/package.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ pkg-config ];
 
   meta = {
-    homepage = "https://www.bluez.org/";
+    homepage = "https://bluez.github.io/";
     platforms = lib.platforms.linux;
     license = lib.licenses.gpl3;
   };
diff --git a/pkgs/by-name/oc/ocaml_make/package.nix b/pkgs/by-name/oc/ocaml_make/package.nix
index 0f1431e07418..2e3e91da1c8f 100644
--- a/pkgs/by-name/oc/ocaml_make/package.nix
+++ b/pkgs/by-name/oc/ocaml_make/package.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation {
   setupHook = ./setup-hook.sh;
 
   meta = {
-    homepage = "http://www.ocaml.info/home/ocaml_sources.html";
+    homepage = "https://mmottl.github.io/ocaml-makefile/";
     description = "Generic OCaml Makefile for GNU Make";
     license = with lib.licenses; [
       lgpl21Only
diff --git a/pkgs/by-name/om/omp/package.nix b/pkgs/by-name/om/omp/package.nix
index 7ed1309ebf45..b41c684e369e 100644
--- a/pkgs/by-name/om/omp/package.nix
+++ b/pkgs/by-name/om/omp/package.nix
@@ -32,7 +32,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "omp";
-  version = "18.8.7";
+  version = "18.9.2";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -41,12 +41,12 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "can1357";
     repo = "oh-my-pi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nWuBvVNeJW9rgrSMhx5JP4CjFFJnfuMzjOlaGDCPVUU=";
+    hash = "sha256-thp9cUYJJqbwLlYBBuGkbmQLG0nKlOxCKoZBQHIDJ+w=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
-    hash = "sha256-wfGvns/9Supk3QUuVfchUy7talfwhJswbLd8LWoZMXU=";
+    hash = "sha256-WF7MYb81AqteoeMuuw8movvQHMFWJL7DkdplddFF8dE=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/on/onlyoffice-desktopeditors/package.nix b/pkgs/by-name/on/onlyoffice-desktopeditors/package.nix
index 482374cbdd0d..a6ab63978120 100644
--- a/pkgs/by-name/on/onlyoffice-desktopeditors/package.nix
+++ b/pkgs/by-name/on/onlyoffice-desktopeditors/package.nix
@@ -192,7 +192,10 @@ buildFHSEnv {
         --replace-fail "/usr/bin/onlyoffice-desktopeditors" "$out/bin/onlyoffice-desktopeditors"
   '';
 
-  passthru.updateScript = ./update.sh;
+  passthru = {
+    updateScript = ./update.sh;
+    inherit derivation;
+  };
 
   meta = {
     description = "Office suite that combines text, spreadsheet and presentation editors allowing to create, view and edit local documents";
diff --git a/pkgs/by-name/on/onlyoffice-desktopeditors/update.sh b/pkgs/by-name/on/onlyoffice-desktopeditors/update.sh
old mode 100644
new mode 100755
index d7b0bc106fa2..499030834cd7
--- a/pkgs/by-name/on/onlyoffice-desktopeditors/update.sh
+++ b/pkgs/by-name/on/onlyoffice-desktopeditors/update.sh
@@ -1,5 +1,6 @@
 #!/usr/bin/env nix-shell
 #!nix-shell -i bash -p curl jq common-updater-scripts
+set -euo pipefail
 
-version="$(curl -sL "https://api.github.com/repos/ONLYOFFICE/DesktopEditors/releases?per_page=1" | jq -r ".[0].tag_name" | sed 's/^v//')"
-update-source-version onlyoffice-bin "$version"
+version="$(curl -fsSL ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://api.github.com/repos/ONLYOFFICE/DesktopEditors/releases?per_page=1" | jq -er ".[0].tag_name" | sed 's/^v//')"
+update-source-version onlyoffice-desktopeditors.derivation "$version"
diff --git a/pkgs/by-name/op/open-sans/package.nix b/pkgs/by-name/op/open-sans/package.nix
index 2c76c42b6e9c..aaa348263d4b 100644
--- a/pkgs/by-name/op/open-sans/package.nix
+++ b/pkgs/by-name/op/open-sans/package.nix
@@ -25,7 +25,7 @@ stdenvNoCC.mkDerivation {
       Open Sans is a humanist sans serif typeface designed by Steve Matteson,
       Type Director of Ascender Corp.
     '';
-    homepage = "https://www.opensans.com";
+    homepage = "https://salsa.debian.org/fonts-team/fonts-open-sans";
     license = lib.licenses.asl20;
     platforms = lib.platforms.all;
     teams = [ lib.teams.pantheon ];
diff --git a/pkgs/by-name/op/open-webui/package.nix b/pkgs/by-name/op/open-webui/package.nix
index 0109a8b25530..96cc08615278 100644
--- a/pkgs/by-name/op/open-webui/package.nix
+++ b/pkgs/by-name/op/open-webui/package.nix
@@ -8,13 +8,13 @@
 }:
 let
   pname = "open-webui";
-  version = "0.11.4";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "open-webui";
     repo = "open-webui";
     tag = "v${version}";
-    hash = "sha256-Z7pc1o6AK9XySZLYF8YNSnHyrp85nh8ZmiCw4FWCwW8=";
+    hash = "sha256-x8Mxy7KHGqC1qmOp6/UsO7ntq07l1jrKTaR9XiOK2d0=";
   };
 
   # we need datasets_3 for SpeechT5 embeddings
@@ -35,7 +35,7 @@ let
       url = "https://github.com/pyodide/pyodide/releases/download/${pyodideVersion}/pyodide-${pyodideVersion}.tar.bz2";
     };
 
-    npmDepsHash = "sha256-hdgWZAJstRqYtzNuCTeiRIi+rjRsogulSfWXr8EP2UI=";
+    npmDepsHash = "sha256-FD433gQae9Ip5awPau83UqCezbsnyUbOgpnSka+nFng=";
 
     npmFlags = [ "--force" ];
 
@@ -142,6 +142,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
       onnxruntime
       openai
       opencv-python-headless
+      openpyxl
+      opensearch-py
       opentelemetry-api
       opentelemetry-exporter-otlp
       opentelemetry-instrumentation
@@ -153,8 +155,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
       opentelemetry-instrumentation-requests
       opentelemetry-instrumentation-sqlalchemy
       opentelemetry-sdk
-      openpyxl
-      opensearch-py
       orjson
       pandas
       pillow
@@ -167,6 +167,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
       pyjwt
       pymdown-extensions
       pymysql
+      pyotp
       pypandoc
       pypdf
       python-docx
@@ -178,6 +179,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
       pytube
       pytz
       pyxlsb
+      qrcode
       rank-bm25
       rapidocr
       redis
diff --git a/pkgs/by-name/op/opencloud/generic.nix b/pkgs/by-name/op/opencloud/generic.nix
new file mode 100644
index 000000000000..b69442b723e5
--- /dev/null
+++ b/pkgs/by-name/op/opencloud/generic.nix
@@ -0,0 +1,248 @@
+{
+  version,
+  production ? false,
+  hash,
+  webVersion,
+  webHash,
+  webPnpmDepsHash,
+  idpWebPnpmDepsHash,
+  nixUpdateExtraArgs ? [ ],
+}:
+
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  ncurses,
+  gettext,
+  pigeon,
+  protoc-go-inject-tag,
+  libxcrypt,
+  vips,
+  pkg-config,
+  nixosTests,
+  nix-update-script,
+  versionCheckHook,
+  stdenvNoCC,
+  nodejs,
+  pnpm_11,
+  fetchPnpmDeps,
+  pnpmBuildHook,
+  pnpmConfigHook,
+}:
+
+let
+  maintainers = with lib.maintainers; [
+    christoph-heiss
+    k900
+    deadbaed
+  ];
+  src = fetchFromGitHub {
+    owner = "opencloud-eu";
+    repo = "opencloud";
+    tag = "v${version}";
+    inherit hash;
+  };
+  bingoBinsMakefile = builtins.concatStringsSep "\n" (
+    lib.mapAttrsToList (n: v: "${n} := ${v}\n\\$(${n}):") {
+      GO_XGETTEXT = "xgettext";
+      # no need to generate mocks, as they are in-repo already
+      MOCKERY = "true";
+      PIGEON = "pigeon";
+      PROTOC_GO_INJECT_TAG = "protoc-go-inject-tag";
+    }
+  );
+  web = stdenvNoCC.mkDerivation (finalAttrs: {
+    pname = "opencloud-web";
+    version = webVersion;
+
+    src = fetchFromGitHub {
+      owner = "opencloud-eu";
+      repo = "web";
+      tag = "v${finalAttrs.version}";
+      hash = webHash;
+    };
+
+    pnpmDeps = fetchPnpmDeps {
+      inherit (finalAttrs) pname version src;
+      pnpm = pnpm_11;
+      fetcherVersion = 4;
+      hash = webPnpmDepsHash;
+    };
+
+    nativeBuildInputs = [
+      nodejs
+      pnpmConfigHook
+      pnpm_11
+    ];
+
+    buildPhase = ''
+      runHook preBuild
+      pnpm build
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      mkdir $out
+      cp -r dist/* $out
+      runHook postInstall
+    '';
+
+    passthru.updateScript = nix-update-script { };
+
+    meta = {
+      description = "Web UI for OpenCloud built with Vue.js and TypeScript";
+      homepage = "https://github.com/opencloud-eu/web";
+      changelog = "https://github.com/opencloud-eu/web/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+      license = lib.licenses.agpl3Only;
+      platforms = lib.platforms.all;
+      inherit maintainers;
+    };
+  });
+
+  idp-web = stdenvNoCC.mkDerivation (finalAttrs: {
+    pname = "opencloud-idp-web";
+
+    inherit src version;
+
+    pnpmRoot = "services/idp";
+
+    pnpmDeps = fetchPnpmDeps {
+      inherit (finalAttrs) pname version src;
+      pnpm = pnpm_11;
+      sourceRoot = "${finalAttrs.src.name}/${finalAttrs.pnpmRoot}";
+      fetcherVersion = 4;
+      hash = idpWebPnpmDepsHash;
+    };
+
+    nativeBuildInputs = [
+      nodejs
+      pnpmConfigHook
+      pnpmBuildHook
+      pnpm_11
+    ];
+
+    postBuild = ''
+      mkdir -p services/idp/assets/identifier/static
+      cp -v services/idp/src/images/favicon.svg services/idp/assets/identifier/static/favicon.svg
+      cp -v services/idp/src/images/icon-lilac.svg services/idp/assets/identifier/static/icon-lilac.svg
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir $out
+      cp -r services/idp/assets $out
+
+      runHook postInstall
+    '';
+
+    meta = {
+      description = "OpenCloud - IDP Web UI";
+      homepage = "https://github.com/opencloud-eu/opencloud";
+      changelog = "https://github.com/opencloud-eu/opencloud/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+      license = lib.licenses.asl20;
+      platforms = lib.platforms.all;
+      inherit maintainers;
+    };
+  });
+in
+buildGoModule (finalAttrs: {
+  inherit version src;
+  pname = "opencloud" + lib.optionalString production "-production";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  postPatch = ''
+    echo "${bingoBinsMakefile}" >.bingo/Variables.mk
+
+    # tries to build web assets, done separately
+    substituteInPlace services/idp/Makefile \
+      --replace-fail 'node-generate-prod: assets' 'node-generate-prod:'
+    # tries to download something web assets ..
+    substituteInPlace services/web/Makefile \
+      --replace-fail 'node-generate-prod: download-assets' 'node-generate-prod:'
+
+    # tries to build some random binaries off the internet and
+    # no need to build protobuf bindings anyway, as they are in-repo already
+    sed -i -e '/\$(BINGO) get/d' -e '/\$(BUF) generate/d' .make/protobuf.mk
+  '';
+
+  vendorHash = null;
+
+  preConfigure = ''
+    export HOME=$(mktemp -d)
+    make generate
+  '';
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X"
+    "github.com/opencloud-eu/opencloud/pkg/version.String=nixos"
+    "-X"
+    "github.com/opencloud-eu/opencloud/pkg/version.Tag=${finalAttrs.version}"
+    "-X"
+    "github.com/opencloud-eu/opencloud/pkg/version.Date=19700101"
+  ];
+
+  tags = [ "enable_vips" ];
+
+  nativeBuildInputs = [
+    ncurses
+    gettext
+    pigeon
+    protoc-go-inject-tag
+    pkg-config
+  ];
+
+  buildInputs = [
+    libxcrypt
+    vips
+  ];
+
+  # wants testcontainers and docker, and we don't have a good way to skip tests
+  # based on package name and not test name
+  preCheck = ''
+    rm services/search/pkg/opensearch/*_test.go
+  '';
+
+  # The activitylog tests start a local NATS server.
+  __darwinAllowLocalNetworking = true;
+
+  env = {
+    # avoids 'make generate' calling `git`, otherwise no-op
+    STRING = finalAttrs.version;
+    VERSION = finalAttrs.version;
+    # avoids weird test failure
+    AUTOMEMLIMIT = "off";
+  };
+
+  excludedPackages = [ "tests/*" ];
+
+  passthru = {
+    inherit web idp-web;
+    tests = if production then nixosTests.opencloud-production else nixosTests.opencloud;
+    updateScript = nix-update-script {
+      extraArgs = nixUpdateExtraArgs ++ [
+        "--version-regex"
+        "v(${if production then lib.versions.majorMinor else lib.versions.major version}\\.[0-9.]+)"
+      ];
+    };
+  };
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = [ "version" ];
+
+  meta = {
+    description = "OpenCloud gives you a secure and private way to store, access, and share your files";
+    homepage = "https://github.com/opencloud-eu/opencloud";
+    changelog = "https://github.com/opencloud-eu/opencloud/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    mainProgram = "opencloud";
+    inherit maintainers;
+  };
+})
diff --git a/pkgs/by-name/op/opencloud/idp-web.nix b/pkgs/by-name/op/opencloud/idp-web.nix
deleted file mode 100644
index d2dd3553de39..000000000000
--- a/pkgs/by-name/op/opencloud/idp-web.nix
+++ /dev/null
@@ -1,59 +0,0 @@
-{
-  stdenvNoCC,
-  lib,
-  opencloud,
-  pnpm_11,
-  fetchPnpmDeps,
-  pnpmConfigHook,
-  pnpmBuildHook,
-  nodejs,
-}:
-stdenvNoCC.mkDerivation (finalAttrs: {
-  pname = "opencloud-idp-web";
-
-  inherit (opencloud) src version;
-
-  pnpmRoot = "services/idp";
-
-  pnpmDeps = fetchPnpmDeps {
-    inherit (finalAttrs) pname version src;
-    pnpm = pnpm_11;
-    sourceRoot = "${finalAttrs.src.name}/${finalAttrs.pnpmRoot}";
-    fetcherVersion = 4;
-    hash = "sha256-rj6KFrzuINVpxrrel2p2iWtJVH8Zg1jrZEIAs8S+8Qs=";
-  };
-
-  nativeBuildInputs = [
-    nodejs
-    pnpmConfigHook
-    pnpmBuildHook
-    pnpm_11
-  ];
-
-  postBuild = ''
-    mkdir -p services/idp/assets/identifier/static
-    cp -v services/idp/src/images/favicon.svg services/idp/assets/identifier/static/favicon.svg
-    cp -v services/idp/src/images/icon-lilac.svg services/idp/assets/identifier/static/icon-lilac.svg
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir $out
-    cp -r services/idp/assets $out
-
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "OpenCloud - IDP Web UI";
-    homepage = "https://github.com/opencloud-eu/opencloud";
-    changelog = "https://github.com/opencloud-eu/opencloud/blob/${finalAttrs.src.tag}/CHANGELOG.md";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [
-      christoph-heiss
-      k900
-    ];
-    platforms = lib.platforms.all;
-  };
-})
diff --git a/pkgs/by-name/op/opencloud/package.nix b/pkgs/by-name/op/opencloud/package.nix
index 5288e2454db0..340cf30ff6db 100644
--- a/pkgs/by-name/op/opencloud/package.nix
+++ b/pkgs/by-name/op/opencloud/package.nix
@@ -1,129 +1,13 @@
-{
-  lib,
-  callPackage,
-  buildGoModule,
-  fetchFromGitHub,
-  ncurses,
-  gettext,
-  pigeon,
-  protoc-go-inject-tag,
-  libxcrypt,
-  vips,
-  pkg-config,
-  nixosTests,
-  nix-update-script,
-  versionCheckHook,
-}:
-
-let
-  bingoBinsMakefile = builtins.concatStringsSep "\n" (
-    lib.mapAttrsToList (n: v: "${n} := ${v}\n\\$(${n}):") {
-      GO_XGETTEXT = "xgettext";
-      # no need to generate mocks, as they are in-repo already
-      MOCKERY = "true";
-      PIGEON = "pigeon";
-      PROTOC_GO_INJECT_TAG = "protoc-go-inject-tag";
-    }
-  );
-in
-buildGoModule (finalAttrs: {
-  pname = "opencloud";
+import ./generic.nix {
   version = "7.5.0";
-
-  src = fetchFromGitHub {
-    owner = "opencloud-eu";
-    repo = "opencloud";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-OMQuNfm9xqXaDexuoDRvvSEoEb7hXEMF7ynRU3CawbI=";
-  };
-
-  postPatch = ''
-    echo "${bingoBinsMakefile}" >.bingo/Variables.mk
-
-    # tries to build web assets, done separately
-    substituteInPlace services/idp/Makefile \
-      --replace-fail 'node-generate-prod: assets' 'node-generate-prod:'
-    # tries to download something web assets ..
-    substituteInPlace services/web/Makefile \
-      --replace-fail 'node-generate-prod: download-assets' 'node-generate-prod:'
-
-    # tries to build some random binaries off the internet and
-    # no need to build protobuf bindings anyway, as they are in-repo already
-    sed -i -e '/\$(BINGO) get/d' -e '/\$(BUF) generate/d' .make/protobuf.mk
-  '';
-
-  vendorHash = null;
-
-  preConfigure = ''
-    export HOME=$(mktemp -d)
-    make generate
-  '';
-
-  ldflags = [
-    "-s"
-    "-w"
-    "-X"
-    "github.com/opencloud-eu/opencloud/pkg/version.String=nixos"
-    "-X"
-    "github.com/opencloud-eu/opencloud/pkg/version.Tag=${finalAttrs.version}"
-    "-X"
-    "github.com/opencloud-eu/opencloud/pkg/version.Date=19700101"
+  production = false;
+  hash = "sha256-OMQuNfm9xqXaDexuoDRvvSEoEb7hXEMF7ynRU3CawbI=";
+  webVersion = "7.4.0";
+  webHash = "sha256-idoR5R97k5ZfYBh7vboXzg2CdbVX5TBPrpL6s1k9qPA=";
+  webPnpmDepsHash = "sha256-h2QNq51GE8qnLsvPhDobzT/8am0jzbW6Mx6tnungY/k=";
+  idpWebPnpmDepsHash = "sha256-rj6KFrzuINVpxrrel2p2iWtJVH8Zg1jrZEIAs8S+8Qs=";
+  nixUpdateExtraArgs = [
+    "--override-filename"
+    "pkgs/by-name/op/opencloud/package.nix"
   ];
-
-  tags = [ "enable_vips" ];
-
-  nativeBuildInputs = [
-    ncurses
-    gettext
-    pigeon
-    protoc-go-inject-tag
-    pkg-config
-  ];
-
-  buildInputs = [
-    libxcrypt
-    vips
-  ];
-
-  # wants testcontainers and docker, and we don't have a good way to skip tests
-  # based on package name and not test name
-  preCheck = ''
-    rm services/search/pkg/opensearch/*_test.go
-  '';
-
-  # The activitylog tests start a local NATS server.
-  __darwinAllowLocalNetworking = true;
-
-  env = {
-    # avoids 'make generate' calling `git`, otherwise no-op
-    STRING = finalAttrs.version;
-    VERSION = finalAttrs.version;
-    # avoids weird test failure
-    AUTOMEMLIMIT = "off";
-  };
-
-  excludedPackages = [ "tests/*" ];
-
-  passthru = {
-    web = callPackage ./web.nix { };
-    idp-web = callPackage ./idp-web.nix { };
-    tests = { inherit (nixosTests) opencloud; };
-    updateScript = nix-update-script { };
-  };
-
-  doInstallCheck = true;
-  nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgramArg = [ "version" ];
-
-  meta = {
-    description = "OpenCloud gives you a secure and private way to store, access, and share your files";
-    homepage = "https://github.com/opencloud-eu/opencloud";
-    changelog = "https://github.com/opencloud-eu/opencloud/blob/${finalAttrs.src.tag}/CHANGELOG.md";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [
-      christoph-heiss
-      k900
-    ];
-    mainProgram = "opencloud";
-  };
-})
+}
diff --git a/pkgs/by-name/op/opencloud/production.nix b/pkgs/by-name/op/opencloud/production.nix
new file mode 100644
index 000000000000..82cfab6702a5
--- /dev/null
+++ b/pkgs/by-name/op/opencloud/production.nix
@@ -0,0 +1,13 @@
+import ./generic.nix {
+  version = "7.2.3";
+  production = true;
+  hash = "sha256-5wmXBLO6wmlBRu0FWDGMzFipRSARyK2LED1BR0Vwnt0=";
+  webVersion = "7.1.4";
+  webHash = "sha256-Wg4VGweWBiTRGDRIbe4spFQB1MEC25zXZBAIa4+YttY=";
+  webPnpmDepsHash = "sha256-YEdZ5B11I6U140qam7e1TMOacRqUeINhr/TI13ddAa0=";
+  idpWebPnpmDepsHash = "sha256-pQ01vBvC29B5oxDWtt7anI5QtFbvQFFBVamQtA2WTNo=";
+  nixUpdateExtraArgs = [
+    "--override-filename"
+    "pkgs/by-name/op/opencloud/production.nix"
+  ];
+}
diff --git a/pkgs/by-name/op/opencloud/web.nix b/pkgs/by-name/op/opencloud/web.nix
deleted file mode 100644
index f6ab914c9099..000000000000
--- a/pkgs/by-name/op/opencloud/web.nix
+++ /dev/null
@@ -1,61 +0,0 @@
-{
-  lib,
-  stdenvNoCC,
-  fetchFromGitHub,
-  nodejs,
-  pnpm_11,
-  fetchPnpmDeps,
-  pnpmConfigHook,
-  nix-update-script,
-}:
-stdenvNoCC.mkDerivation (finalAttrs: {
-  pname = "opencloud-web";
-  version = "7.4.0";
-
-  src = fetchFromGitHub {
-    owner = "opencloud-eu";
-    repo = "web";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-idoR5R97k5ZfYBh7vboXzg2CdbVX5TBPrpL6s1k9qPA=";
-  };
-
-  pnpmDeps = fetchPnpmDeps {
-    inherit (finalAttrs) pname version src;
-    pnpm = pnpm_11;
-    fetcherVersion = 4;
-    hash = "sha256-h2QNq51GE8qnLsvPhDobzT/8am0jzbW6Mx6tnungY/k=";
-  };
-
-  nativeBuildInputs = [
-    nodejs
-    pnpmConfigHook
-    pnpm_11
-  ];
-
-  buildPhase = ''
-    runHook preBuild
-    pnpm build
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-    mkdir $out
-    cp -r dist/* $out
-    runHook postInstall
-  '';
-
-  passthru.updateScript = nix-update-script { };
-
-  meta = {
-    description = "Web UI for OpenCloud built with Vue.js and TypeScript";
-    homepage = "https://github.com/opencloud-eu/web";
-    changelog = "https://github.com/opencloud-eu/web/blob/${finalAttrs.src.tag}/CHANGELOG.md";
-    license = lib.licenses.agpl3Only;
-    maintainers = with lib.maintainers; [
-      christoph-heiss
-      k900
-    ];
-    platforms = lib.platforms.all;
-  };
-})
diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index b099934384b2..4c093283769c 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -77,14 +77,14 @@ let
       # NOTE: Required else we get errors that our fixed-output derivation references store paths
       dontFixup = true;
 
-      outputHash = "sha256-cQLuGI8MBh9l8GisM2k5WXBcZrsdgrNsXUOsYzZVwYY=";
+      outputHash = "sha256-RLHrfyBM6fMglKyEkdkW+Mmfzzr6q/U7R38goaQcIhA=";
       outputHashAlgo = "sha256";
       outputHashMode = "recursive";
     };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "opencode";
-  version = "1.18.35";
+  version = "1.19.0";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -93,7 +93,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "anomalyco";
     repo = "opencode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NM5AbX99hDW+oIojiHSRA+QDz27d8L/v42bwZY+6Imk=";
+    hash = "sha256-XL76Qpm4GEFEn7Pt7g84sx+djEKnlpTTZXRgXJF3NRs=";
   };
 
   postPatch =
diff --git a/pkgs/by-name/op/openonload/package.nix b/pkgs/by-name/op/openonload/package.nix
index 6673efd090e8..3808956a737c 100644
--- a/pkgs/by-name/op/openonload/package.nix
+++ b/pkgs/by-name/op/openonload/package.nix
@@ -149,7 +149,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "OpenOnLoad high performance network stack from Solarflare";
-    homepage = "https://www.openonload.org";
+    homepage = "https://github.com/Xilinx-CNS/onload";
     license = lib.licenses.gpl2;
     maintainers = with lib.maintainers; [ YorikSar ];
     # ARM64 build fails, see https://github.com/Xilinx-CNS/onload/issues/253
diff --git a/pkgs/by-name/op/openroad/package.nix b/pkgs/by-name/op/openroad/package.nix
index b5cf5f46a198..fbc293eadba1 100644
--- a/pkgs/by-name/op/openroad/package.nix
+++ b/pkgs/by-name/op/openroad/package.nix
@@ -18,7 +18,7 @@
   versionCheckHook,
 
   # buildInputs
-  boost,
+  boost192,
   cbc,
   cimg,
   clp,
@@ -66,7 +66,9 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    boost
+    # boost 1.91 + gcc16 segfaults in dbSta's Boost.JSON cell-usage report; fixed in 1.92.
+    # Drop this override once the default boost is bumped to 1.92 (see #571409).
+    boost192
     cbc
     cimg
     clp
@@ -151,7 +153,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "CMAKE_RULE_MESSAGES" false)
     (lib.cmakeFeature "TCL_HEADER" "${tcl}/include/tcl.h")
     (lib.cmakeFeature "TCL_LIBRARY" "${tcl}/lib/libtcl${stdenv.hostPlatform.extensions.sharedLibrary}")
-    (lib.cmakeFeature "BOOST_ROOT" "${boost}")
+    (lib.cmakeFeature "BOOST_ROOT" "${boost192}")
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     (lib.cmakeFeature "CMAKE_CXX_FLAGS" "-DBOOST_STACKTRACE_GNU_SOURCE_NOT_REQUIRED -Wno-error=deprecated-declarations")
diff --git a/pkgs/by-name/pa/pachyderm/package.nix b/pkgs/by-name/pa/pachyderm/package.nix
index fe7b49b712b8..5bf6eacb7910 100644
--- a/pkgs/by-name/pa/pachyderm/package.nix
+++ b/pkgs/by-name/pa/pachyderm/package.nix
@@ -27,7 +27,7 @@ buildGoModule (finalAttrs: {
 
   meta = {
     description = "Containerized Data Analytics";
-    homepage = "https://www.pachyderm.com/";
+    homepage = "https://github.com/pachyderm/pachyderm";
     license = lib.licenses.asl20;
     maintainers = [ ];
     mainProgram = "pachctl";
diff --git a/pkgs/by-name/pa/packetry/package.nix b/pkgs/by-name/pa/packetry/package.nix
index a58af37bc1d7..ca9f36a9e9cb 100644
--- a/pkgs/by-name/pa/packetry/package.nix
+++ b/pkgs/by-name/pa/packetry/package.nix
@@ -72,6 +72,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ carlossless ];
     mainProgram = "packetry";
+    mainDarwinApp = "Packetry.app";
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
 })
diff --git a/pkgs/games/papermc/derivation.nix b/pkgs/by-name/pa/papermc/derivation.nix
similarity index 100%
rename from pkgs/games/papermc/derivation.nix
rename to pkgs/by-name/pa/papermc/derivation.nix
diff --git a/pkgs/by-name/pa/papermc/package.nix b/pkgs/by-name/pa/papermc/package.nix
new file mode 100644
index 000000000000..11888c3dc69e
--- /dev/null
+++ b/pkgs/by-name/pa/papermc/package.nix
@@ -0,0 +1,16 @@
+{
+  callPackage,
+  javaPackages,
+  lib,
+  ...
+}:
+
+let
+  versions = builtins.fromJSON (builtins.readFile ./versions.json);
+  latestVersion = lib.last (builtins.sort lib.versionOlder (builtins.attrNames versions));
+  getJavaVersion = v: (builtins.getAttr "openjdk${toString v}" javaPackages.compiler).headless;
+in
+callPackage ./derivation.nix {
+  inherit (versions.${latestVersion}) url version hash;
+  jre = getJavaVersion versions.${latestVersion}.javaVersion;
+}
diff --git a/pkgs/games/papermc/update.py b/pkgs/by-name/pa/papermc/update.py
similarity index 100%
rename from pkgs/games/papermc/update.py
rename to pkgs/by-name/pa/papermc/update.py
diff --git a/pkgs/games/papermc/versions.json b/pkgs/by-name/pa/papermc/versions.json
similarity index 100%
rename from pkgs/games/papermc/versions.json
rename to pkgs/by-name/pa/papermc/versions.json
diff --git a/pkgs/games/papermc/default.nix b/pkgs/by-name/pa/papermc/versions.nix
similarity index 99%
rename from pkgs/games/papermc/default.nix
rename to pkgs/by-name/pa/papermc/versions.nix
index 20c4a349c3db..e7912079b561 100644
--- a/pkgs/games/papermc/default.nix
+++ b/pkgs/by-name/pa/papermc/versions.nix
@@ -1,6 +1,3 @@
-let
-  versions = builtins.fromJSON (builtins.readFile ./versions.json);
-in
 {
   callPackage,
   javaPackages,
@@ -8,6 +5,7 @@ in
   ...
 }:
 let
+  versions = builtins.fromJSON (builtins.readFile ./versions.json);
   latestVersion = lib.last (builtins.sort lib.versionOlder (builtins.attrNames versions));
   escapeVersion = builtins.replaceStrings [ "." ] [ "_" ];
   getJavaVersion = v: (builtins.getAttr "openjdk${toString v}" javaPackages.compiler).headless;
diff --git a/pkgs/by-name/pd/pdfcpu/package.nix b/pkgs/by-name/pd/pdfcpu/package.nix
index d7624851c2fe..e63bee88408b 100644
--- a/pkgs/by-name/pd/pdfcpu/package.nix
+++ b/pkgs/by-name/pd/pdfcpu/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "pdfcpu";
-  version = "0.16.0";
+  version = "0.16.1";
 
   src = fetchFromGitHub {
     owner = "pdfcpu";
     repo = "pdfcpu";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-aOU4biSZObEr62FPvyr0RCYR4yEvbST132dbPHNNC5E=";
+    hash = "sha256-kVSzMa1Jil2moY3BP5cu3O4482OBMxUlMVPiDwJz1zs=";
     # Apparently upstream requires that the compiled executable will know the
     # commit hash and the date of the commit. This information is also presented
     # in the output of `pdfcpu version` which we use as a sanity check in the
@@ -38,7 +38,7 @@ buildGoModule (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-OcS5pMV6dVx8VkDH4Lkks88OBRN/Rd8gjldtMnCl124=";
+  vendorHash = "sha256-iSDCCftx3hFZ2M3Cxeeq0Dta8hMXBYcviYRMgdrQfKI=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/pe/pencil/package.nix b/pkgs/by-name/pe/pencil/package.nix
index b68c4797c766..0e315c1ab1c6 100644
--- a/pkgs/by-name/pe/pencil/package.nix
+++ b/pkgs/by-name/pe/pencil/package.nix
@@ -35,7 +35,7 @@
   libxcomposite,
   libx11,
   libxcb,
-  systemd,
+  systemdLibs,
 }:
 let
 
@@ -129,7 +129,7 @@ stdenv.mkDerivation (finalAttrs: {
         $out/opt/pencil/pencil
 
       # fix missing libudev
-      ln -s ${lib.getLib systemd}/lib/libudev.so.1 $out/opt/pencil/libudev.so.1
+      ln -s ${lib.getLib systemdLibs}/lib/libudev.so.1 $out/opt/pencil/libudev.so.1
       wrapProgram $out/opt/pencil/pencil \
         --prefix LD_LIBRARY_PATH : $out/opt/pencil
     '';
diff --git a/pkgs/by-name/ph/phosh/package.nix b/pkgs/by-name/ph/phosh/package.nix
index 353a27887e98..490ba74c9ae2 100644
--- a/pkgs/by-name/ph/phosh/package.nix
+++ b/pkgs/by-name/ph/phosh/package.nix
@@ -26,7 +26,7 @@
   gnome-shell,
   gcr_3,
   pam,
-  systemd,
+  systemdLibs,
   upower,
   wayland,
   dbus,
@@ -118,7 +118,7 @@ stdenv.mkDerivation (finalAttrs: {
     gnome-session
     gtk4
     pam
-    systemd
+    systemdLibs
     upower
     wayland
     feedbackd
diff --git a/pkgs/by-name/pi/picard/package.nix b/pkgs/by-name/pi/picard/package.nix
index 581ce38d5002..d1885ce1fb96 100644
--- a/pkgs/by-name/pi/picard/package.nix
+++ b/pkgs/by-name/pi/picard/package.nix
@@ -17,7 +17,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "picard";
-  version = "3.0";
+  version = "3.0.2";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -25,7 +25,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "metabrainz";
     repo = "picard";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-aUiXmiGZTg2nQtHlE8B1/DFgvK5jLVOzN8i21fPsNk4=";
+    hash = "sha256-Br7mBWB16jv6p7VoYipCa2TXTQabx9oV8DaS5gxIxzg=";
   };
 
   nativeBuildInputs = [
@@ -66,6 +66,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       pyobjc-core
       pyobjc-framework-Cocoa
+      pyobjc-framework-MediaPlayer
     ]
   );
 
diff --git a/pkgs/by-name/pi/pineflash/package.nix b/pkgs/by-name/pi/pineflash/package.nix
index 59d5b32c7d23..fc71c1851129 100644
--- a/pkgs/by-name/pi/pineflash/package.nix
+++ b/pkgs/by-name/pi/pineflash/package.nix
@@ -11,7 +11,7 @@
   glib,
   gtk3,
   openssl,
-  systemd,
+  systemdLibs,
   imagemagick,
   libGL,
   libxkbcommon,
@@ -44,7 +44,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     glib
     gtk3
     openssl
-    systemd
+    systemdLibs
   ];
 
   runtimeDependencies = [
diff --git a/pkgs/by-name/pi/pinless/package.nix b/pkgs/by-name/pi/pinless/package.nix
new file mode 100644
index 000000000000..745db720953a
--- /dev/null
+++ b/pkgs/by-name/pi/pinless/package.nix
@@ -0,0 +1,29 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  lib,
+}:
+buildGoModule {
+  pname = "pinless";
+  version = "0-unstable-2026-08-06";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "bunk-im";
+    repo = "pinless";
+    rev = "87b560c911186b64b6337baa2e64658977891c7e";
+    hash = "sha256-IVPSFqutAUH4AWnGXjuN81Q004YeaY5sO0uf+/cqC7Q=";
+  };
+
+  vendorHash = "sha256-Ef2XLxGq8TO3WVh9EvLE30Is2CBwH4pqXxkq1tcuR0Q=";
+
+  meta = {
+    homepage = "https://github.com/bunk-im/pinless";
+    description = "Privacy-focused frontend for Pinterest";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ yarn ];
+    platforms = lib.platforms.unix;
+    mainProgram = "pinless";
+  };
+}
diff --git a/pkgs/by-name/pi/pipelight/package.nix b/pkgs/by-name/pi/pipelight/package.nix
index d0b4c77d26e6..09a0b76e0b72 100644
--- a/pkgs/by-name/pi/pipelight/package.nix
+++ b/pkgs/by-name/pi/pipelight/package.nix
@@ -78,7 +78,7 @@ stdenv'.mkDerivation (finalAttrs: {
   enableParallelBuilding = true;
 
   meta = {
-    homepage = "http://pipelight.net/";
+    homepage = "https://bitbucket.org/mmueller2012/pipelight";
     license = with lib.licenses; [
       mpl11
       gpl2Only
diff --git a/pkgs/by-name/pl/plasticity/package.nix b/pkgs/by-name/pl/plasticity/package.nix
index 8012b208add8..7a45c6ef7767 100644
--- a/pkgs/by-name/pl/plasticity/package.nix
+++ b/pkgs/by-name/pl/plasticity/package.nix
@@ -25,7 +25,7 @@
   pango,
   rpmextract,
   stdenv,
-  systemd,
+  systemdLibs,
   trash-cli,
   vulkan-loader,
   wrapGAppsHook3,
@@ -82,7 +82,7 @@ stdenv.mkDerivation rec {
   ];
 
   runtimeDependencies = [
-    systemd
+    systemdLibs
     libglvnd
     vulkan-loader # may help with nvidia users
     libx11
diff --git a/pkgs/by-name/po/pods/package.nix b/pkgs/by-name/po/pods/package.nix
index 47994603b8ea..8fe86a2d3f16 100644
--- a/pkgs/by-name/po/pods/package.nix
+++ b/pkgs/by-name/po/pods/package.nix
@@ -23,18 +23,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pods";
-  version = "3.1.1";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "marhkb";
     repo = "pods";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tI3ZFR4DYdcIH+MYpRgjRXnbL0HOVcPG3x7mrMWwGOY=";
+    hash = "sha256-9uZMERhCh3OFdJ7XnVDRm0ponRuSIIj/7lq3vVopv0s=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-g1xk4Haz8Q04ASOpfoiRC36oaszl3pqkLV0rgiJgGN4=";
+    hash = "sha256-Qje5GJG6LnFQAPIZkxo7xinU1AlFUXHMK/yBLO7+mPw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/po/positron-bin/package.nix b/pkgs/by-name/po/positron-bin/package.nix
index 1de17268cfc3..52bb3509aafe 100644
--- a/pkgs/by-name/po/positron-bin/package.nix
+++ b/pkgs/by-name/po/positron-bin/package.nix
@@ -2,7 +2,7 @@
   lib,
   _7zz,
   alsa-lib,
-  systemd,
+  systemdLibs,
   wrapGAppsHook4,
   autoPatchelfHook,
   blas,
@@ -95,7 +95,7 @@ stdenv.mkDerivation {
 
   runtimeDependencies = lib.optionals stdenv.hostPlatform.isLinux [
     # Needed to fix the "Zygote could not fork" error.
-    (lib.getLib systemd)
+    (lib.getLib systemdLibs)
   ];
 
   installPhase =
diff --git a/pkgs/by-name/po/postlight-parser/package.nix b/pkgs/by-name/po/postlight-parser/package.nix
index 2a7f2418fcd1..19a630787e64 100644
--- a/pkgs/by-name/po/postlight-parser/package.nix
+++ b/pkgs/by-name/po/postlight-parser/package.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     changelog = "https://github.com/postlight/parser/blob/${finalAttrs.src.rev}/CHANGELOG.md";
-    homepage = "https://reader.postlight.com";
+    homepage = "https://github.com/postlight/parser";
     description = "Extracts the bits that humans care about from any URL you give it";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ viraptor ];
diff --git a/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix b/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix
index a20ac02513b6..6fe839bcea75 100644
--- a/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix
+++ b/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix
@@ -1,14 +1,14 @@
 {
-  version = "1.84.0";
+  version = "1.84.1";
   hashes = {
-    linux-aarch_64 = "sha256-2TV3YbTmndx6vsPTqA4QlrXto+JdbtbQserQcGZgCoY=";
-    linux-ppcle_64 = "sha256-/CsKC+8AIRHWDJGsHGayu1heJ8+SOC3ZC6CI2Um2J2M=";
-    linux-s390_64 = "sha256-ugcWqz1IrtGsHhyEYobtQH2o7fW5f04cQvrTZAjeBnw=";
-    linux-x86_32 = "sha256-gPff10mQtLlDNmG3PE3p5okrSvH8tniVTnyrathlE2Q=";
-    linux-x86_64 = "sha256-kHwtTvwrrpshytp1wxs284IeFbe+ljEeIUpr5lvNIKo=";
-    osx-aarch_64 = "sha256-Saq55WowqEhOnDLTa+EqNR1Xg+AL2q/p7Cwv2MkClQQ=";
-    osx-x86_64 = "sha256-Saq55WowqEhOnDLTa+EqNR1Xg+AL2q/p7Cwv2MkClQQ=";
-    windows-x86_32 = "sha256-5NbC2ei2ZF/PwBGRv6F6Lg6b0DbF8LTZyY4P83UiazM=";
-    windows-x86_64 = "sha256-HQtYT0NsJSFUKpiRTY5sQroKpdhrRZvGMuTDiEo7XU0=";
+    linux-aarch_64 = "sha256-Gx5EUj2xBQiNXw5+3FO2XKymsCXHXXlOVNqN9y+eQDs=";
+    linux-ppcle_64 = "sha256-0QDXmHTqzS4fHuC7B+YmnFzDCaUHqp0T1XTKz4hKiDI=";
+    linux-s390_64 = "sha256-3Smte68bNqJj4Q2w1iq2DILTLNcqwFlEAB/unLFilmg=";
+    linux-x86_32 = "sha256-E/QAINeeVMGK+EP8scvHBjnxmu1+s62NsZL57wLnJB0=";
+    linux-x86_64 = "sha256-Gq6RJ48NgYdkGGJxB0jfLBY1gtffChd+VJ99gjipo/4=";
+    osx-aarch_64 = "sha256-ieV9tBgsrGhUDsDaSZYmSbTj5+7eOD7JIjHiy6aODWU=";
+    osx-x86_64 = "sha256-ieV9tBgsrGhUDsDaSZYmSbTj5+7eOD7JIjHiy6aODWU=";
+    windows-x86_32 = "sha256-XPRy9dyyDqDm0+q5OppiimE5/Gy0/nwlA1k7sH7Wqx0=";
+    windows-x86_64 = "sha256-xSGYOkC31sQl7y/kewPTNhoQa1hcWr9hz7P+SwZGmsY=";
   };
 }
diff --git a/pkgs/by-name/pr/prototext/package.nix b/pkgs/by-name/pr/prototext/package.nix
new file mode 100644
index 000000000000..b1b587f27e46
--- /dev/null
+++ b/pkgs/by-name/pr/prototext/package.nix
@@ -0,0 +1,79 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+  installShellFiles,
+  protobuf,
+  versionCheckHook,
+
+  # passthru
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "prototext";
+  version = "0.3.0";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "douzebis";
+    repo = "prototools";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ka/Pg/YMrRPYaUO4M1fdevLSPyZ+8XhWYa2EQu3Xq6o=";
+  };
+
+  cargoHash = "sha256-5DgWKXYzrEB/3l2uDs2vc/VwRMlZ5trwJhor4ZnHEaw=";
+
+  cargoBuildFlags = [
+    "-p"
+    "prototext"
+  ];
+  cargoTestFlags = [
+    "-p"
+    "prototext"
+  ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  # The roundtrip tests compare with protoc's decoding; without it, they skip.
+  nativeCheckInputs = [ protobuf ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd prototext \
+      --bash <(PROTOTEXT_COMPLETE=bash $out/bin/prototext) \
+      --zsh <(PROTOTEXT_COMPLETE=zsh $out/bin/prototext) \
+      --fish <(PROTOTEXT_COMPLETE=fish $out/bin/prototext)
+    $out/bin/prototext-gen-man $out/share/man/man1
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  # Only v-prefixed release tags: the repository also has workshop tags
+  # (grehack2026-*), which are not versions.
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "^v(\\d+\\.\\d+\\.\\d+)$"
+    ];
+  };
+
+  meta = {
+    description = "Lossless converter between binary protobuf and enhanced textproto";
+    longDescription = ''
+      prototext decodes binary protobuf to an enhanced textproto and encodes
+      it back, byte for byte, with or without the message's schema. Given a
+      schema database it infers the message type, and it reports every
+      encoding anomaly it meets (non-canonical varints, unknown fields,
+      wire-type mismatches) in the text, so that the round trip stays
+      lossless.
+    '';
+    homepage = "https://github.com/douzebis/prototools";
+    changelog = "https://github.com/douzebis/prototools/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ douzebis ];
+    mainProgram = "prototext";
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/pr/pry/package.nix b/pkgs/by-name/pr/pry/package.nix
index 357a8ef0c434..38671b241790 100644
--- a/pkgs/by-name/pr/pry/package.nix
+++ b/pkgs/by-name/pr/pry/package.nix
@@ -13,7 +13,7 @@ bundlerApp {
 
   meta = {
     description = "Ruby runtime developer console and IRB alternative";
-    homepage = "https://pryrepl.org";
+    homepage = "https://pry.github.io/";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.tckmn ];
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/pu/pulsar/package.nix b/pkgs/by-name/pu/pulsar/package.nix
index 63455c752aa4..3c890139c87e 100644
--- a/pkgs/by-name/pu/pulsar/package.nix
+++ b/pkgs/by-name/pu/pulsar/package.nix
@@ -35,7 +35,7 @@
   libsecret,
   libxkbcommon,
   pango,
-  systemd,
+  systemdLibs,
   hunspellDicts,
   useHunspell ? true,
   languages ? [ "en_US" ],
@@ -75,7 +75,7 @@ let
     libxkbfile
     pango
     stdenv.cc.cc
-    systemd
+    systemdLibs
   ];
 
   # Hunspell
diff --git a/pkgs/by-name/pu/pulseaudio-dlna/0001-setup.py-remove-dbus-python-from-list.patch b/pkgs/by-name/pu/pulseaudio-dlna/0001-setup.py-remove-dbus-python-from-list.patch
deleted file mode 100644
index 2f38386f96c0..000000000000
--- a/pkgs/by-name/pu/pulseaudio-dlna/0001-setup.py-remove-dbus-python-from-list.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From a4bf7df795146c843696daee8c02826ba0034298 Mon Sep 17 00:00:00 2001
-From: Florian Klink <flokli@flokli.de>
-Date: Sun, 21 Nov 2021 12:04:48 +0100
-Subject: [PATCH] setup.py: remove dbus-python from list
-
-I wasn't able to convince setuptools to find this.
----
- setup.py | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/setup.py b/setup.py
-index 61d6831..013fff3 100644
---- a/setup.py
-+++ b/setup.py
-@@ -42,7 +42,6 @@ setuptools.setup(
-     install_requires=[
-     'docopt',
-     'chardet',
--    'dbus-python',
-     'docopt',
-     'requests',
-     'setproctitle',
--- 
-2.33.1
-
diff --git a/pkgs/by-name/pu/pulseaudio-dlna/package.nix b/pkgs/by-name/pu/pulseaudio-dlna/package.nix
deleted file mode 100644
index f8fc1118d21b..000000000000
--- a/pkgs/by-name/pu/pulseaudio-dlna/package.nix
+++ /dev/null
@@ -1,80 +0,0 @@
-{
-  fetchFromGitHub,
-  lib,
-  python3Packages,
-  mp3Support ? true,
-  lame,
-  opusSupport ? true,
-  opus-tools,
-  faacSupport ? false,
-  faac,
-  flacSupport ? true,
-  flac,
-  soxSupport ? true,
-  sox,
-  vorbisSupport ? true,
-  vorbis-tools,
-  pulseaudio,
-}:
-
-python3Packages.buildPythonApplication {
-  pname = "pulseaudio-dlna";
-  version = "unstable-2021-11-09";
-  format = "setuptools";
-
-  src = fetchFromGitHub {
-    owner = "Cygn";
-    repo = "pulseaudio-dlna";
-    rev = "637a2e7bba2277137c5f12fb58e63100dab7cbe6";
-    sha256 = "sha256-Oda+zQQJE2D3fiNWTzxYvI8cZVHG5JAoV2Wf5Z6IU3M=";
-  };
-
-  patches = [
-    ./0001-setup.py-remove-dbus-python-from-list.patch
-  ];
-
-  propagatedBuildInputs =
-    with python3Packages;
-    [
-      dbus-python
-      docopt
-      requests
-      setproctitle
-      protobuf
-      psutil
-      chardet
-      netifaces
-      notify2
-      pyroute2
-      pygobject3
-      pychromecast
-      lxml
-      setuptools
-      zeroconf
-    ]
-    ++ lib.optional mp3Support lame
-    ++ lib.optional opusSupport opus-tools
-    ++ lib.optional faacSupport faac
-    ++ lib.optional flacSupport flac
-    ++ lib.optional soxSupport sox
-    ++ lib.optional vorbisSupport vorbis-tools;
-
-  # pulseaudio-dlna shells out to pactl to configure sinks and sources.
-  # As pactl might not be in $PATH, add --suffix it (so pactl configured by the
-  # user get priority)
-  makeWrapperArgs = [ "--suffix PATH : ${lib.makeBinPath [ pulseaudio ]}" ];
-
-  # upstream has no tests
-  checkPhase = ''
-    $out/bin/pulseaudio-dlna --help > /dev/null
-  '';
-
-  meta = {
-    description = "Lightweight streaming server which brings DLNA / UPNP and Chromecast support to PulseAudio and Linux";
-    mainProgram = "pulseaudio-dlna";
-    homepage = "https://github.com/Cygn/pulseaudio-dlna";
-    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ mog ];
-    platforms = lib.platforms.linux;
-  };
-}
diff --git a/pkgs/by-name/py/pyroscope/package.nix b/pkgs/by-name/py/pyroscope/package.nix
index 9baa7857e015..feb40bbc2e4a 100644
--- a/pkgs/by-name/py/pyroscope/package.nix
+++ b/pkgs/by-name/py/pyroscope/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "pyroscope";
-  version = "2.3.1";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "pyroscope";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-kKqIe+3q+qHcgKhEXtVxLLIE822G5ryFW7SD0pEWznY=";
+    hash = "sha256-fU8EKYEfj78xWfoxJe7uNdv8U57OuRcxiutqR6abdfs=";
   };
 
-  vendorHash = "sha256-KBdVCQZA2mDynpsWBzF06MMHb0rX++mXpFTHW0SFN9U=";
+  vendorHash = "sha256-7hV66g9SZb9qglWUdjastCtxJrCP5RDiZeMF6sp1aPQ=";
   proxyVendor = true;
 
   subPackages = [
diff --git a/pkgs/by-name/qe/qemu/package.nix b/pkgs/by-name/qe/qemu/package.nix
index 7089a36f3e5f..be5822e4ef36 100644
--- a/pkgs/by-name/qe/qemu/package.nix
+++ b/pkgs/by-name/qe/qemu/package.nix
@@ -140,11 +140,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString nixosTestRunner "-for-vm-tests"
     + lib.optionalString toolsOnly "-utils"
     + lib.optionalString userOnly "-user";
-  version = "11.1.1";
+  version = "11.1.2";
 
   src = fetchurl {
     url = "https://download.qemu.org/qemu-${finalAttrs.version}.tar.xz";
-    hash = "sha256-B5/7/4pxEbvIkCIQfLq/O7/WFNX8nXzGdZkRlqyhJII=";
+    hash = "sha256-cxtWgeS7GL4xMjFXm479ApbFsBX6NtxTOHS2ObqDgBY=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/by-name/qm/qm-dsp/package.nix b/pkgs/by-name/qm/qm-dsp/package.nix
index d1a40ccf04e5..c0ef2009fd91 100644
--- a/pkgs/by-name/qm/qm-dsp/package.nix
+++ b/pkgs/by-name/qm/qm-dsp/package.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "C++ library of functions for DSP and Music Informatics purposes";
-    homepage = "https://code.soundsoftware.ac.uk/projects/qm-dsp";
+    homepage = "https://github.com/c4dm/qm-dsp";
     license = lib.licenses.gpl2Plus;
     maintainers = [ ];
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/qq/qq/package.nix b/pkgs/by-name/qq/qq/package.nix
index a711590a247c..ff933c90fa6f 100644
--- a/pkgs/by-name/qq/qq/package.nix
+++ b/pkgs/by-name/qq/qq/package.nix
@@ -20,7 +20,7 @@
   libGL,
   nss,
   libxdamage,
-  systemd,
+  systemdLibs,
   runCommandLocal,
   stdenv,
   undmg,
@@ -147,7 +147,7 @@ else
     dontWrapGApps = true;
 
     runtimeDependencies = map lib.getLib [
-      systemd
+      systemdLibs
       libkrb5
     ];
 
diff --git a/pkgs/by-name/ra/ratman/package.nix b/pkgs/by-name/ra/ratman/package.nix
index 0c7e2422d2a7..47fc1f35d1c6 100644
--- a/pkgs/by-name/ra/ratman/package.nix
+++ b/pkgs/by-name/ra/ratman/package.nix
@@ -71,7 +71,7 @@ rustPlatform.buildRustPackage rec {
 
   meta = {
     description = "Modular decentralised peer-to-peer packet router and associated tools";
-    homepage = "https://git.irde.st/we/irdest";
+    homepage = "https://codeberg.org/irdest/irdest";
     platforms = lib.platforms.unix;
     license = lib.licenses.agpl3Only;
     maintainers = with lib.maintainers; [ spacekookie ];
diff --git a/pkgs/by-name/ra/ratox/package.nix b/pkgs/by-name/ra/ratox/package.nix
index 499b5e788b06..dd8acb713934 100644
--- a/pkgs/by-name/ra/ratox/package.nix
+++ b/pkgs/by-name/ra/ratox/package.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation {
   meta = {
     description = "FIFO based tox client";
     mainProgram = "ratox";
-    homepage = "http://ratox.2f30.org/";
+    homepage = "https://git.2f30.org/ratox/file/README.html";
     license = lib.licenses.isc;
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/by-name/ra/ratty/package.nix b/pkgs/by-name/ra/ratty/package.nix
index 6493c24d0a68..0eba2c9ac846 100644
--- a/pkgs/by-name/ra/ratty/package.nix
+++ b/pkgs/by-name/ra/ratty/package.nix
@@ -14,16 +14,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ratty";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = "ratty";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gQ9qeR9IyPUCy4V2ynnnXeN15Fs7aNDEwjQ+33gonRU=";
+    hash = "sha256-oCz5PWfESX6eDNkMnbLsMHsOlyxAn/sjhxwN8qZ5s+s=";
   };
 
-  cargoHash = "sha256-mSb7QCYQ4EL76S7wmSdHBkjE5wzbVK8ln6oPdAv5BuA=";
+  cargoHash = "sha256-HHrAJy/XuTqkEpfvrbiS+CFPKBRJsB21s5TdmBpD7Nk=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ra/raycast/package.nix b/pkgs/by-name/ra/raycast/package.nix
index 30662a247f6d..45ca493b8dc2 100644
--- a/pkgs/by-name/ra/raycast/package.nix
+++ b/pkgs/by-name/ra/raycast/package.nix
@@ -11,15 +11,15 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "raycast";
-  version = "2.6.3.0";
+  version = "2.7.3.0";
 
   __structuredAttrs = true;
   strictDeps = true;
 
   src = fetchurl {
     name = "Raycast.dmg";
-    url = "https://x-r2.raycast-releases.com/Raycast_2.6.3.0_2bca862541_arm64.dmg";
-    hash = "sha256-s5xIV0SN6mzkLoBWdfoqTu/hUhIXUzQOmRyIygVZCLE=";
+    url = "https://x-r2.raycast-releases.com/Raycast_2.7.3.0_758e1a8dbb_arm64.dmg";
+    hash = "sha256-7b20Mc93W48NTOm/68d+YwXQLTPFJfBdEfrKFztihuw=";
   };
 
   dontPatch = true;
diff --git a/pkgs/by-name/rc/rcshist/package.nix b/pkgs/by-name/rc/rcshist/package.nix
index 098a9308178a..e7a5b0437636 100644
--- a/pkgs/by-name/rc/rcshist/package.nix
+++ b/pkgs/by-name/rc/rcshist/package.nix
@@ -13,6 +13,9 @@ stdenv.mkDerivation {
 
   buildInputs = lib.optional stdenv.hostPlatform.isMusl musl-fts;
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchurl {
     url = "https://web.archive.org/web/20220508220019/https://invisible-island.net/datafiles/release/rcshist.tar.gz";
     sha256 = "01ab3xwgm934lxr8bm758am3vxwx4hxx7cc9prbgqj5nh30vdg1n";
diff --git a/pkgs/by-name/re/re-intentbuilderc/package.nix b/pkgs/by-name/re/re-intentbuilderc/package.nix
index ff26751b8ff3..7e40fd0f738b 100644
--- a/pkgs/by-name/re/re-intentbuilderc/package.nix
+++ b/pkgs/by-name/re/re-intentbuilderc/package.nix
@@ -20,7 +20,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   meta = {
     mainProgram = "intentbuilderc";
     description = "Open reimplementation of Apple's intentbuilderc";
-    homepage = "https://codeberg.com/viraptor/re-intentbuilderc";
+    homepage = "https://codeberg.org/viraptor/re-intentbuilderc";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ viraptor ];
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/re/rectangle/package.nix b/pkgs/by-name/re/rectangle/package.nix
index d69aac301038..5440b05aa691 100644
--- a/pkgs/by-name/re/rectangle/package.nix
+++ b/pkgs/by-name/re/rectangle/package.nix
@@ -125,13 +125,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "rectangle";
-  version = "2.0.2";
+  version = "2.0.3";
 
   src = fetchFromGitHub {
     owner = "rxhanson";
     repo = "Rectangle";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-A/wQd68hXckjW7YrS9FnX91cvC0qgFg/AMNe9nnlWgU=";
+    hash = "sha256-pcDl+GHBgPHysS5q0pQgQbbMOAzsTvA/KJ2N+OlPIoA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/re/reindeer/package.nix b/pkgs/by-name/re/reindeer/package.nix
index dcf4e5b4170e..a21fed03a314 100644
--- a/pkgs/by-name/re/reindeer/package.nix
+++ b/pkgs/by-name/re/reindeer/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "reindeer";
-  version = "2026.09.28.00";
+  version = "2026.10.05.00";
 
   src = fetchFromGitHub {
     owner = "facebookincubator";
     repo = "reindeer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ruOXPHqLJfk/Y6EHssb4wF1iFHgVKPmjJ6ydtU2hE44=";
+    hash = "sha256-ZaK2T/v7oVwzzQHsHUiM4hEdpmd7g7yRCRqVIwMCL8k=";
   };
 
-  cargoHash = "sha256-WMzXFVdl80PREiRG1uP+dPBEr5So9eV/gg1g+AeGDLc=";
+  cargoHash = "sha256-C/3mmSDv9g1rrkJxwBIk6Jb5YBxNRXNi6UEgaguOpmc=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/re/remind/package.nix b/pkgs/by-name/re/remind/package.nix
index afe903c242e2..7a5283e7c96a 100644
--- a/pkgs/by-name/re/remind/package.nix
+++ b/pkgs/by-name/re/remind/package.nix
@@ -16,11 +16,11 @@
 
 tcl.mkTclDerivation (finalAttrs: {
   pname = "remind";
-  version = "06.03.05";
+  version = "06.03.06";
 
   src = fetchzip {
     url = "https://dianne.skoll.ca/projects/remind/download/remind-${finalAttrs.version}.tar.gz";
-    hash = "sha256-4TESOZrPqa2LahojSy27qgIzkuS/tr8ElAS7nw/t5Fo=";
+    hash = "sha256-5x6SbABTQHAu61/Cg0PJgY5k9py/YsrN0bNxEoSSEhI=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/re/resterm/package.nix b/pkgs/by-name/re/resterm/package.nix
index 0b84e59ecda8..328488eaecbc 100644
--- a/pkgs/by-name/re/resterm/package.nix
+++ b/pkgs/by-name/re/resterm/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "resterm";
-  version = "1.10.2";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner = "unkn0wn-root";
     repo = "resterm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wzH/5TN2cIcGqUk+n56qFlKS6XPOpqc2UkXudekeuOI=";
+    hash = "sha256-YOpKdFTnIN5KwmOeLmP/yLCTt5akG9na0o9AYb6nbaw=";
   };
 
-  vendorHash = "sha256-8nu7E7jwj2EodR2yICPQpbpLUJlXY32SzEEGm783s0A=";
+  vendorHash = "sha256-sAcV1O5ns7gAVomai68rkcrMYPHNoQZp7BKv3bEvD40=";
 
   # modernc.org/libc (via modernc.org/sqlite) tries to read /etc/protocols
   modPostBuild = ''
diff --git a/pkgs/by-name/ri/rinf_cli/package.nix b/pkgs/by-name/ri/rinf_cli/package.nix
index 669d0b1bc12b..ed54ef11ae9d 100644
--- a/pkgs/by-name/ri/rinf_cli/package.nix
+++ b/pkgs/by-name/ri/rinf_cli/package.nix
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   meta = {
     description = "Framework for creating cross-platform Rust apps leveraging Flutter";
-    homepage = "https://rinf.cunarist.com";
+    homepage = "https://cunarist.github.io/rinf";
     changelog = "https://github.com/cunarist/rinf/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ Noah765 ];
diff --git a/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix b/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix
index 5ebefb264ad5..a50e679ba970 100644
--- a/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix
+++ b/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix
@@ -7,16 +7,16 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "roave-backward-compatibility-check";
-  version = "8.22.0";
+  version = "8.23.0";
 
   src = fetchFromGitHub {
     owner = "Roave";
     repo = "BackwardCompatibilityCheck";
     tag = finalAttrs.version;
-    hash = "sha256-RRfjaqelRIsjAOl1vgXZ/OGObBjd62o8C23LNVtqkKE=";
+    hash = "sha256-CiE6Yfj2lyVAOz6DhZHhqrvbkATponGUiZFXjdAjgeE=";
   };
 
-  vendorHash = "sha256-ODcA2rQVZ48VpKTW0XortUAWRZvhyCj2gbiF/GzKs+0=";
+  vendorHash = "sha256-quVGTY6teiKTePFZUcX20aDoQ0ydNHqYuoR4H9Hc37E=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/ru/run0-sudo-shim/package.nix b/pkgs/by-name/ru/run0-sudo-shim/package.nix
index e9e8eb0ff4c4..3cd6e0e643c1 100644
--- a/pkgs/by-name/ru/run0-sudo-shim/package.nix
+++ b/pkgs/by-name/ru/run0-sudo-shim/package.nix
@@ -13,7 +13,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   version = "1.4.2";
 
   src = fetchFromGitHub {
-    owner = "LordGrimmauld";
+    owner = "GrimmTheShrimp";
     repo = "run0-sudo-shim";
     tag = finalAttrs.version;
     hash = "sha256-J/I7VPXpOwNtEk9H+lbZVT+xJYBsSKgnMlwzlVIJSWk=";
diff --git a/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix b/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
index fbf780d664c5..fc9617022d8d 100644
--- a/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
+++ b/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
@@ -13,15 +13,15 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rust-analyzer-unwrapped";
-  version = "2026-09-28";
+  version = "2026-10-05";
 
-  cargoHash = "sha256-pCbofUTBCIRID5icso1SKdMNjO8Eowy2c/pVBJplaqY=";
+  cargoHash = "sha256-bkogttBcSy+X1Xeft6q9gD0C2yBne6ZWMq5zwvhGxvo=";
 
   src = fetchFromGitHub {
     owner = "rust-lang";
     repo = "rust-analyzer";
     rev = finalAttrs.version;
-    hash = "sha256-j8y/AO3AMDF9p+11aIDhnA21JnNj5PjvcejTI43vI8Q=";
+    hash = "sha256-KlPoiDKQ7xCoUAaxJzCYctw2acbtunTD3SFjO79MXzE=";
   };
 
   cargoBuildFlags = [
diff --git a/pkgs/by-name/sa/sail/package.nix b/pkgs/by-name/sa/sail/package.nix
index 80ed47e8eef8..fa4d7dd14936 100644
--- a/pkgs/by-name/sa/sail/package.nix
+++ b/pkgs/by-name/sa/sail/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sail";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "lakehq";
     repo = "sail";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UJP2d56IF0h9s/kZhNWVkCp/YfTf1RpQStM1NjzJKK4=";
+    hash = "sha256-IKGUK0BkgrnfRYe36X9MwRf/0/+x4u6cKSwUv4WRCvg=";
   };
 
-  cargoHash = "sha256-a0NOVMH5dObFpwUaEsB6w66XVSjnWQRiK5i/KylEgAU=";
+  cargoHash = "sha256-RjgvMjtRKiVe9QufzlTblEt9tReqjWuVJeTEMwAis3E=";
 
   cargoBuildFlags = [
     "-p"
diff --git a/pkgs/by-name/sb/sbc/package.nix b/pkgs/by-name/sb/sbc/package.nix
index adee703fa660..f68b63a270cd 100644
--- a/pkgs/by-name/sb/sbc/package.nix
+++ b/pkgs/by-name/sb/sbc/package.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "SubBand Codec Library";
-    homepage = "https://www.bluez.org/";
+    homepage = "https://bluez.github.io/";
     changelog = "https://git.kernel.org/pub/scm/bluetooth/sbc.git/tree/ChangeLog?h=${finalAttrs.version}";
     license = lib.licenses.gpl2;
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/sb/sbsigntool/package.nix b/pkgs/by-name/sb/sbsigntool/package.nix
index 1b9cad610339..8b546b35fd53 100644
--- a/pkgs/by-name/sb/sbsigntool/package.nix
+++ b/pkgs/by-name/sb/sbsigntool/package.nix
@@ -79,6 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
+      "riscv64-linux"
     ]; # Broken on i686
     license = lib.licenses.gpl3;
   };
diff --git a/pkgs/by-name/sc/scopehal-apps/package.nix b/pkgs/by-name/sc/scopehal-apps/package.nix
index 307b9a9a5a4d..ac7a139465e0 100644
--- a/pkgs/by-name/sc/scopehal-apps/package.nix
+++ b/pkgs/by-name/sc/scopehal-apps/package.nix
@@ -112,6 +112,7 @@ stdenv.mkDerivation {
     homepage = "https://www.ngscopeclient.org/";
     license = lib.licenses.bsd3;
     mainProgram = "ngscopeclient";
+    mainDarwinApp = "ngscopeclient.app";
     maintainers = with lib.maintainers; [
       bgamari
       carlossless
diff --git a/pkgs/by-name/sc/scrolls/package.nix b/pkgs/by-name/sc/scrolls/package.nix
index a30251275389..2b5a48e589f6 100644
--- a/pkgs/by-name/sc/scrolls/package.nix
+++ b/pkgs/by-name/sc/scrolls/package.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Strategy collectible card game";
-    homepage = "https://scrolls.com/";
+    homepage = "https://mojang.github.io/CallersBaneSiteArchive/";
     # http://www.reddit.com/r/Scrolls/comments/2j3pxw/linux_client_experimental/
 
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/by-name/se/secrethound/package.nix b/pkgs/by-name/se/secrethound/package.nix
index 1e90e726faf2..293bd2d84aee 100644
--- a/pkgs/by-name/se/secrethound/package.nix
+++ b/pkgs/by-name/se/secrethound/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "secrethound";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "rafabd1";
     repo = "SecretHound";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ca0AwD1oFBB8F2J4gLMtaDssacczugAkkSYdBTvT4VQ=";
+    hash = "sha256-wTed0dJNhh8LpTYN/R6uyuWPyuHGAJdnR8Sbv+UPV5c=";
   };
 
-  vendorHash = "sha256-oTyI3/+evDTzyH+BjfSP0A1r2bYVAMxtWRsg0G1d2zQ=";
+  vendorHash = "sha256-Gpbz7Cc6CyQDd3BaNfVIVKL36W/u+sM5g7dJ0Ey+6y8=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/se/selendroid/package.nix b/pkgs/by-name/se/selendroid/package.nix
index 656297f77272..dd4affc7e286 100644
--- a/pkgs/by-name/se/selendroid/package.nix
+++ b/pkgs/by-name/se/selendroid/package.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation {
   '';
 
   meta = {
-    homepage = "https://selendroid.io/";
+    homepage = "https://selendroid.github.io/selendroid.io/";
     description = "Test automation for native or hybrid Android apps and the mobile web";
     maintainers = [ ];
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/sg/sgdboop/package.nix b/pkgs/by-name/sg/sgdboop/package.nix
index fdf0d134da15..d4ff60b206a2 100644
--- a/pkgs/by-name/sg/sgdboop/package.nix
+++ b/pkgs/by-name/sg/sgdboop/package.nix
@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "sgdboop";
-  version = "1.4.3";
+  version = "1.4.4";
 
   src = fetchFromGitHub {
     owner = "SteamGridDB";
     repo = "SGDBoop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-l4l5CWupL/V/qlnFZIgqUBagc5qg0DDv/zz2yc0mtng=";
+    hash = "sha256-OO4DXZlmCMaVl+z24Xy7BHVKc36QkWxVzilkNnAXkUA=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/si/sidequest/package.nix b/pkgs/by-name/si/sidequest/package.nix
index 74d69551017b..6dd529821df3 100644
--- a/pkgs/by-name/si/sidequest/package.nix
+++ b/pkgs/by-name/si/sidequest/package.nix
@@ -31,7 +31,7 @@
   libxkbcommon,
   libxshmfence,
   pango,
-  systemd,
+  systemdLibs,
   icu,
   openssl,
   zlib,
@@ -112,7 +112,7 @@ let
             libxkbfile
             pango
             (lib.getLib stdenv.cc.cc)
-            systemd
+            systemdLibs
           ]
         }:$out/libexec/sidequest" \
         --add-needed libGL.so.1 \
diff --git a/pkgs/by-name/sn/snooze/package.nix b/pkgs/by-name/sn/snooze/package.nix
index 179c146f6712..64cc45a97fbd 100644
--- a/pkgs/by-name/sn/snooze/package.nix
+++ b/pkgs/by-name/sn/snooze/package.nix
@@ -6,6 +6,10 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "snooze";
   version = "0.6";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "leahneukirchen";
     repo = "snooze";
diff --git a/pkgs/by-name/so/soft-serve/package.nix b/pkgs/by-name/so/soft-serve/package.nix
index 2e37a261940c..716b760a106b 100644
--- a/pkgs/by-name/so/soft-serve/package.nix
+++ b/pkgs/by-name/so/soft-serve/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "soft-serve";
-  version = "0.12.2";
+  version = "0.12.3";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = "soft-serve";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QrLm88lcJRhgJw9RN7m3BsipOFEpAe1weEI5F3u+Bqw=";
+    hash = "sha256-uq6gWf61UFMtlSJ+IOMLYLHOPEHFDLJpaUVLCXfu9gg=";
   };
 
-  vendorHash = "sha256-Ri/njTAjpVCd/rXQt/ZxNe1iTfDWZb6JzoFipj/1UlA=";
+  vendorHash = "sha256-6QYgEuWTYQwJ7zPAjVv+GZ/4lKJxiS5x4Rp69Gnjt5c=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/so/solanum/package.nix b/pkgs/by-name/so/solanum/package.nix
index 4a18388d7fb1..5ab017dbeded 100644
--- a/pkgs/by-name/so/solanum/package.nix
+++ b/pkgs/by-name/so/solanum/package.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "solanum";
-  version = "0-unstable-2026-09-13";
+  version = "0-unstable-2026-09-22";
 
   src = fetchFromGitHub {
     owner = "solanum-ircd";
     repo = "solanum";
-    rev = "96b2cfa1a13a8ad30a6dd85af540cd0f6f74a621";
-    hash = "sha256-q1OAi6pEpmuc4G2PiiEBPBANKIkg7tvFw/jJigxTRH0=";
+    rev = "03503ff488ea5757a0fdfd62b7509b02b41904ab";
+    hash = "sha256-Z6ujkb4VzgoMdUKnKoUdDpX8DDjxcb06YqrbojNXfFc=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/so/soundfont-arachno/package.nix b/pkgs/by-name/so/soundfont-arachno/package.nix
index 7c28074bced8..364d26e54973 100644
--- a/pkgs/by-name/so/soundfont-arachno/package.nix
+++ b/pkgs/by-name/so/soundfont-arachno/package.nix
@@ -1,25 +1,31 @@
 {
   lib,
   stdenvNoCC,
-  fetchzip,
+  fetchurl,
+  unzip,
 }:
 
 stdenvNoCC.mkDerivation rec {
   pname = "soundfont-arachno";
   version = "1.0";
 
-  src = fetchzip {
+  # Many of the files in this archive have non-UTF-8 characters in their names,
+  # which causes it to fail to unpack correctly on e.g. macOS/APFS when using
+  # fetchzip. So instead, use fetchurl and extract the correct file directly.
+  src = fetchurl {
     # Linked on http://www.arachnosoft.com/main/download.php?id=soundfont-sf2:
     url = "https://www.dropbox.com/s/2rnpya9ecb9m4jh/arachno-soundfont-${
       builtins.replaceStrings [ "." ] [ "" ] version
     }-sf2.zip";
-    hash = "sha256-Z5ETe0AKPCi4KlM2xOlNcyQn1xvCuor3S/tcrF+AwNQ=";
-    stripRoot = false;
+    hash = "sha256-XAxXOr5sXho8zOul1SpCKdskKDYgyaPrH0AwGOKqIt8=";
   };
+  dontUnpack = true;
+  nativeBuildInputs = [ unzip ];
 
   installPhase = ''
     runHook preInstall
-    install -Dm444 Arachno*.sf2 $out/share/soundfonts/arachno.sf2
+    mkdir -p $out/share/soundfonts
+    unzip -p $src 'Arachno*.sf2' > $out/share/soundfonts/arachno.sf2
     runHook postInstall
   '';
 
diff --git a/pkgs/by-name/sp/spectral/package.nix b/pkgs/by-name/sp/spectral/package.nix
new file mode 100644
index 000000000000..54b10605dde0
--- /dev/null
+++ b/pkgs/by-name/sp/spectral/package.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  installFonts,
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "spectral";
+  version = "2.005";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
+  src = fetchFromGitHub {
+    owner = "productiontype";
+    repo = "Spectral";
+    rev = "e1179c4fc05c1ba7efd40038e203312b4c90c376";
+    hash = "sha256-hoihZUeY8JC0pCnLfTwBAoX1OiTKyG/4B4XeXyc3iVg=";
+  };
+
+  nativeBuildInputs = [ installFonts ];
+
+  meta = {
+    homepage = "https://github.com/productiontype/Spectral/";
+    description = "Serif typeface designed for text-rich, screen-first environments";
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ ozozka ];
+  };
+}
diff --git a/pkgs/by-name/sp/spotify/linux.nix b/pkgs/by-name/sp/spotify/linux.nix
index 44906e981492..962e4a2569f7 100644
--- a/pkgs/by-name/sp/spotify/linux.nix
+++ b/pkgs/by-name/sp/spotify/linux.nix
@@ -35,7 +35,7 @@
   libpng,
   libnotify,
   libgcrypt,
-  systemd,
+  systemdLibs,
   fontconfig,
   dbus,
   expat,
@@ -100,7 +100,7 @@ let
     pango
     pciutils
     stdenv.cc.cc
-    systemd
+    systemdLibs
     libice
     libsm
     libx11
diff --git a/pkgs/by-name/ss/sshp/package.nix b/pkgs/by-name/ss/sshp/package.nix
index d0e0fea6110b..a8876d82272d 100644
--- a/pkgs/by-name/ss/sshp/package.nix
+++ b/pkgs/by-name/ss/sshp/package.nix
@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sshp";
-  version = "1.1.4";
+  version = "1.1.5";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "bahamas10";
     repo = "sshp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4DrNGQQ1ETKuLiB3N+3KnRxx4BEhrCOgskpowbF/KWc=";
+    hash = "sha256-5sVXBqu/bqBCf7FjT7WxirrVG8XX9461jNdpNY31RXQ=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ss/sssd/package.nix b/pkgs/by-name/ss/sssd/package.nix
index 489f6eb38e45..efff3b18e927 100644
--- a/pkgs/by-name/ss/sssd/package.nix
+++ b/pkgs/by-name/ss/sssd/package.nix
@@ -5,7 +5,6 @@
   fetchpatch2,
   autoreconfHook,
   makeWrapper,
-  glibc,
   adcli,
   augeas,
   bashNonInteractive,
@@ -23,6 +22,7 @@
   python3,
   pam,
   popt,
+  realmd,
   talloc,
   tdb,
   tevent,
@@ -90,6 +90,13 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/SSSD/sssd/commit/ba207eab76ff5253662a763b9b6e9ea42f03d31b.patch?full_index=1";
       hash = "sha256-55V8RfIcGF49GGebg+pgCLPU9MGY2S/7PaOGIqwNL0w=";
     })
+
+    # Remove once a release containing this upstream fix is packaged.
+    (fetchpatch2 {
+      name = "CVE-2026-68742.patch";
+      url = "https://github.com/SSSD/sssd/commit/db60088e31d9c0c51c12206f069c305c7f4288a4.patch?full_index=1";
+      hash = "sha256-MOchRnq7/MMEzzGFXsfo3m36ljFTo6AIccjcyPwCb+0=";
+    })
   ];
 
   postPatch = ''
@@ -104,9 +111,6 @@ stdenv.mkDerivation (finalAttrs: {
   separateDebugInfo = true;
 
   env = {
-    NIX_CFLAGS_COMPILE = toString [
-      "-DRENEWAL_PROG_PATH=\"${adcli}/bin/adcli\""
-    ];
     KRB5_CONFIG = lib.getExe' (lib.getDev libkrb5) "krb5-config";
     NSUPDATE = lib.getExe' dnsutils "nsupdate";
     XMLLINT = lib.getExe' libxml2 "xmllint";
@@ -128,12 +132,12 @@ stdenv.mkDerivation (finalAttrs: {
       --with-syslog=journald
       --with-initscript=systemd
       --without-selinux
-      --without-semanage
       --with-xml-catalog-path=''${SGML_CATALOG_FILES%%:*}
       --with-ldb-lib-dir=$out/modules/ldb
-      --with-nscd=${glibc.bin}/sbin/nscd
       --with-sssd-user=root
       --with-ldb-modules-path="${placeholder "out"}/modules/ldb:${ldb}/modules/ldb"
+      --with-adcli-path=${lib.meta.getExe adcli}
+      --with-realm-path=${lib.meta.getExe realmd}
     )
   ''
   + lib.optionalString withSudo ''
diff --git a/pkgs/by-name/st/staruml/package.nix b/pkgs/by-name/st/staruml/package.nix
index 5c6e99f2b7a1..6aaeae91adc4 100644
--- a/pkgs/by-name/st/staruml/package.nix
+++ b/pkgs/by-name/st/staruml/package.nix
@@ -7,7 +7,7 @@
   hicolor-icon-theme,
   gtk3,
   glib,
-  systemd,
+  systemdLibs,
   libxtst,
   libxrender,
   libxrandr,
@@ -71,7 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     mkdir -p $out/lib
     ln -s ${lib.getLib stdenv.cc.cc}/lib/libstdc++.so.6 $out/lib/
-    ln -s ${lib.getLib systemd}/lib/libudev.so.1 $out/lib/libudev.so.0
+    ln -s ${lib.getLib systemdLibs}/lib/libudev.so.1 $out/lib/libudev.so.0
 
     patchelf --interpreter ${bintools.dynamicLinker} --add-needed libGL.so.1 $out/opt/StarUML/staruml
 
diff --git a/pkgs/by-name/st/stevia/package.nix b/pkgs/by-name/st/stevia/package.nix
index 360abbd01815..f21bd9af3927 100644
--- a/pkgs/by-name/st/stevia/package.nix
+++ b/pkgs/by-name/st/stevia/package.nix
@@ -20,7 +20,7 @@
   json-glib,
   libhandy,
   libxkbcommon,
-  systemd,
+  systemdLibs,
   nix-update-script,
   dconf,
 }:
@@ -69,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
     json-glib
     libhandy
     libxkbcommon
-    systemd
+    systemdLibs
     dconf
   ];
 
diff --git a/pkgs/by-name/st/still/package.nix b/pkgs/by-name/st/still/package.nix
index 0539fd2a6eea..bcc6010aeedc 100644
--- a/pkgs/by-name/st/still/package.nix
+++ b/pkgs/by-name/st/still/package.nix
@@ -14,13 +14,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "still";
-  version = "0.0.10";
+  version = "0.1.0";
 
   src = fetchFromGitHub {
     owner = "faergeek";
     repo = "still";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4ysI2U4k93ccC8gRoA+AcgTamSIL1ficLfqS8bc8vlY=";
+    hash = "sha256-AGArWr/T8VMZpEVbr/SIvERGTOAgoREH+68PSL6k6yg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/st/stoat-desktop/package.nix b/pkgs/by-name/st/stoat-desktop/package.nix
index 294eecdda758..8127ced50379 100644
--- a/pkgs/by-name/st/stoat-desktop/package.nix
+++ b/pkgs/by-name/st/stoat-desktop/package.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
   fetchPnpmDeps,
   makeDesktopItem,
-  desktopToDarwinBundle,
+  darwin,
   pnpmConfigHook,
   makeWrapper,
   removeReferencesTo,
@@ -12,6 +12,8 @@
   pnpm_11,
   nodejs,
   electron_43,
+  resvg,
+  libicns,
   zip,
   nix-update-script,
 }:
@@ -21,19 +23,34 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "stoat-desktop";
-  version = "1.5.3";
+  version = "1.5.4";
 
   src = fetchFromGitHub {
     owner = "stoatchat";
     repo = "for-desktop";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-UKMuMtBTfiA31K2i1buCFOtL9lf9xbv6BXVD5m4TARo=";
+    hash = "sha256-ouC+90Ulra+qbZbW4TeDS4IZraFULo+U/wKRYBwWR04=";
   };
 
   postPatch = ''
     # Disable auto-updates
     sed -i '/updateElectronApp([^)]*)/d' src/main.ts
+
+    # `@electron/fuses` tries to run `codesign` and fails, ad-hoc signing is
+    # done by autoSignDarwinBinariesHook instead
+    substituteInPlace forge.config.ts \
+      --replace-fail "version: FuseVersion.V1," "version: FuseVersion.V1, resetAdHocDarwinSignature: false,"
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    # Compiling the Icon Composer bundle needs actool from Xcode 26, which is
+    # unavailable in the sandbox. @electron/packager falls back to the icns
+    # variant of the same basename, so render one from the svg instead.
+    for size in 16 32 128 256 512; do
+      resvg --width "$size" --height "$size" assets/desktop/icon.svg "icon-$size.png"
+    done
+    png2icns assets/desktop/icon.icns icon-*.png
+    rm -r assets/desktop/icon.icon icon-*.png
   '';
 
   strictDeps = true;
@@ -44,13 +61,17 @@ stdenv.mkDerivation (finalAttrs: {
     pnpmConfigHook
     removeReferencesTo
     makeWrapper
-    copyDesktopItems
     nodejs
     pnpm_11
     zip
   ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    copyDesktopItems
+  ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    desktopToDarwinBundle
+    darwin.autoSignDarwinBinariesHook
+    resvg
+    libicns
   ];
 
   pnpmDeps = fetchPnpmDeps {
@@ -61,7 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     fetcherVersion = 4;
     pnpm = pnpm_11;
-    hash = "sha256-uiKTkXU0THzW46FiAfftqMWfrnFPCfgS/30ZuWmpHMI=";
+    hash = "sha256-ETP0S3H0MSzu7+5WvqnYGup2Nt4OJxQBMPUf7so92OU=";
   };
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
@@ -103,11 +124,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   installPhase = lib.concatStringsSep "\n" [
     "runHook preInstall"
-    # Make freedesktop stuff, then the convert hook should make them for Darwin
-    ''
-      install -Dm444 "assets/desktop/icon.svg" "$out/share/icons/hicolor/scalable/apps/stoat-desktop.svg"
-    ''
     (lib.optionalString stdenv.hostPlatform.isLinux ''
+      install -Dm444 "assets/desktop/icon.svg" "$out/share/icons/hicolor/scalable/apps/stoat-desktop.svg"
+
       # remove references to nodejs
       find out/*/resources/app/node_modules -type f -executable -exec remove-references-to -t ${nodejs} '{}' \;
 
@@ -121,8 +140,9 @@ stdenv.mkDerivation (finalAttrs: {
         --inherit-argv0
     '')
     (lib.optionalString stdenv.hostPlatform.isDarwin ''
-      mkdir -p "$out/Applications"
-      cp -r out/*/Stoat.app
+      # electron-forge already produces a complete application bundle
+      mkdir -p "$out/Applications" "$out/bin"
+      cp -r out/*/Stoat.app "$out/Applications/"
 
       makeWrapper "$out/Applications/Stoat.app/Contents/MacOS/stoat-desktop" "$out/bin/stoat-desktop" \
         --set ELECTRON_FORCE_IS_PACKAGED 1 \
@@ -158,7 +178,7 @@ stdenv.mkDerivation (finalAttrs: {
       v3rm1n0
       RossSmyth
     ];
-    platforms = with lib.platforms; linux ++ darwin;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
     mainProgram = "stoat-desktop";
   };
 })
diff --git a/pkgs/by-name/st/structurizr-cli/package.nix b/pkgs/by-name/st/structurizr-cli/package.nix
index 5db3e8af4252..56aae51b8796 100644
--- a/pkgs/by-name/st/structurizr-cli/package.nix
+++ b/pkgs/by-name/st/structurizr-cli/package.nix
@@ -93,6 +93,7 @@ stdenv.mkDerivation (finalAttrs: {
     cp -r build/install/structurizr-cli $out/lib/structurizr-cli
 
     makeBinaryWrapper $out/lib/structurizr-cli/bin/structurizr-cli $out/bin/structurizr-cli \
+      --set JAVA_HOME "${jre.home}" \
       --prefix PATH : "${
         lib.makeBinPath [
           coreutils
diff --git a/pkgs/by-name/su/supertuxkart/package.nix b/pkgs/by-name/su/supertuxkart/package.nix
index cb3ec3a73ead..2a80bf75c6c3 100644
--- a/pkgs/by-name/su/supertuxkart/package.nix
+++ b/pkgs/by-name/su/supertuxkart/package.nix
@@ -197,5 +197,8 @@ stdenv.mkDerivation (finalAttrs: {
     ];
     platforms = lib.platforms.all;
     changelog = "https://github.com/supertuxkart/stk-code/blob/${finalAttrs.version}/CHANGELOG.md";
+    # supertuxkart-server never built on darwin since first introduction in nixpkgs
+    # see https://hydra.nixos.org/build/345422087
+    broken = stdenv.hostPlatform.isDarwin && serverOnly;
   };
 })
diff --git a/pkgs/by-name/sw/sway-unwrapped/package.nix b/pkgs/by-name/sw/sway-unwrapped/package.nix
index 6764aa45dbdd..44d3cc9ba7b7 100644
--- a/pkgs/by-name/sw/sway-unwrapped/package.nix
+++ b/pkgs/by-name/sw/sway-unwrapped/package.nix
@@ -29,8 +29,8 @@
   isNixOS ? false,
   enableXWayland ? true,
   libxcb-wm,
-  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd,
-  systemd,
+  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
+  systemdLibs,
   trayEnabled ? systemdSupport,
 }:
 
diff --git a/pkgs/by-name/sw/swayfx-unwrapped/package.nix b/pkgs/by-name/sw/swayfx-unwrapped/package.nix
index 59968a93d18a..bf7aed390dbd 100644
--- a/pkgs/by-name/sw/swayfx-unwrapped/package.nix
+++ b/pkgs/by-name/sw/swayfx-unwrapped/package.nix
@@ -2,7 +2,7 @@
   lib,
   fetchFromGitHub,
   stdenv,
-  systemd,
+  systemdLibs,
   meson,
   replaceVars,
   swaybg,
@@ -31,7 +31,7 @@
   # Used by the NixOS module:
   isNixOS ? false,
   enableXWayland ? true,
-  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd,
+  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
   trayEnabled ? systemdSupport,
 }:
 
diff --git a/pkgs/by-name/sw/swaylock-plugin/package.nix b/pkgs/by-name/sw/swaylock-plugin/package.nix
index 5dfa969f69f3..c37e916f68ec 100644
--- a/pkgs/by-name/sw/swaylock-plugin/package.nix
+++ b/pkgs/by-name/sw/swaylock-plugin/package.nix
@@ -14,7 +14,7 @@
   scdoc,
   stdenv,
   swaybg,
-  systemd,
+  systemdLibs,
   versionCheckHook,
   wayland,
   wayland-protocols,
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
     gdk-pixbuf
     libxkbcommon
     pam
-    systemd
+    systemdLibs
     wayland
     wayland-protocols
   ];
diff --git a/pkgs/by-name/sw/swingsane/package.nix b/pkgs/by-name/sw/swingsane/package.nix
index eeb2a0203a64..e523d2f90651 100644
--- a/pkgs/by-name/sw/swingsane/package.nix
+++ b/pkgs/by-name/sw/swingsane/package.nix
@@ -64,7 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
       simultaneous scan jobs, image transformation jobs (deskew, binarize,
       crop, etc), PDF and PNG output.
     '';
-    homepage = "http://swingsane.com/";
+    homepage = "https://sourceforge.net/projects/swingsane/";
     sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
     license = lib.licenses.asl20;
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/sy/syswatch/package.nix b/pkgs/by-name/sy/syswatch/package.nix
index 9358daa90150..7fb2fd3a82ac 100644
--- a/pkgs/by-name/sy/syswatch/package.nix
+++ b/pkgs/by-name/sy/syswatch/package.nix
@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "syswatch";
-  version = "0.14.2";
+  version = "0.14.3";
 
   src = fetchFromGitHub {
     owner = "matthart1983";
     repo = "syswatch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-udVUX1qNaPDBI+nEjm7LQ+2+HG6TBlgsjyQOP8pBqao=";
+    hash = "sha256-39GA6OnrCRKlqFN7guaPzOXXdSnpFjjSNMU9Iie38lA=";
   };
 
   __structuredAttrs = true;
 
-  cargoHash = "sha256-iFqECXUMODxvjXQ4o0mD4dTdG9RYbpOBeyJzvteZZmI=";
+  cargoHash = "sha256-sokTz+OFFsDn6SbZ9lXoCgXz6iFPOOEMheF16aLKFAc=";
 
   nativeCheckInputs = [ versionCheckHook ];
 
diff --git a/pkgs/by-name/ta/tango-cpp/package.nix b/pkgs/by-name/ta/tango-cpp/package.nix
index 04e942f66b5b..f6da0bf01c50 100644
--- a/pkgs/by-name/ta/tango-cpp/package.nix
+++ b/pkgs/by-name/ta/tango-cpp/package.nix
@@ -16,14 +16,14 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "tango-cpp";
-  version = "10.3.3";
+  version = "10.3.4.1";
 
   src = fetchFromGitLab {
     owner = "tango-controls";
     repo = "cppTango";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-hiJHnv6H4IAW1tUVX2Oux6TleaZBI/+0mZMiKSkM4fA=";
+    hash = "sha256-bxP3UH2efUyrOSIHs5SgXWsm+ZvL1lUVJeYxUZT92GQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/tc/tcpdirect/package.nix b/pkgs/by-name/tc/tcpdirect/package.nix
index b1361b7919e2..79576ad7f320 100644
--- a/pkgs/by-name/tc/tcpdirect/package.nix
+++ b/pkgs/by-name/tc/tcpdirect/package.nix
@@ -76,7 +76,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Ultra low latency kernel bypass TCP and UDP implementation for AMD Solarflare network adapters";
-    homepage = "https://www.openonload.org";
+    homepage = "https://github.com/Xilinx-CNS/tcpdirect";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ YorikSar ];
     # ARM64 build fails, see https://github.com/Xilinx-CNS/onload/issues/253
diff --git a/pkgs/by-name/tg/tgrep/package.nix b/pkgs/by-name/tg/tgrep/package.nix
index 620b9adf463a..01b194cb6b54 100644
--- a/pkgs/by-name/tg/tgrep/package.nix
+++ b/pkgs/by-name/tg/tgrep/package.nix
@@ -10,7 +10,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tgrep";
-  version = "1.0.11";
+  version = "1.1.0";
   __structuredAttrs = true;
   __darwinAllowLocalNetworking = true;
 
@@ -18,10 +18,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "microsoft";
     repo = "tgrep";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TkllXBOyxEl1NVXIRmRYOVlUqm65GRCNnoetGcR7kyE=";
+    hash = "sha256-Sr7xFT3dbpkCjalQ2CtUzIaWUrSDC3lPs1WV0Iiqk/U=";
   };
 
-  cargoHash = "sha256-xPXLkW/YeCBbRCGf4+VYLQqm4D5WkKo2yIJhkLOxO+s=";
+  cargoHash = "sha256-+28RGFPraepj4nrTATb51pwoYTewexhjcSkURbP+Xr4=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
@@ -45,6 +45,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "--skip=watcher_reconciles_forced_add_and_rm_cached_inside_an_ignored_tree"
     "--skip=native_watcher_tracks_hidden_updates_ignore_transitions_and_restart"
     "--skip=git_metadata_stays_out_of_native_and_persisted_indexes"
+    "--skip=native_watching_includes_searchable_nested_tgrep_directories"
+    "--skip=polling_and_native_events_reconcile_without_queries"
+    "--skip=stateful::seeded_shared_search_parity_native_watcher"
   ];
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/by-name/th/throne/package.nix b/pkgs/by-name/th/throne/package.nix
index 93d66872fbc0..70f896671b24 100644
--- a/pkgs/by-name/th/throne/package.nix
+++ b/pkgs/by-name/th/throne/package.nix
@@ -28,13 +28,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "throne";
-  version = "1.3.1";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner = "throneproj";
     repo = "Throne";
     tag = finalAttrs.version;
-    hash = "sha256-G1i8nFMabkg7qUbqYq/GYXsREXRcSXtDSO+RgiuulIE=";
+    hash = "sha256-Jj8IVXUm+36sE/195DdrU2l/MpaN4WJtW3ST/j8xKVU=";
   };
 
   # NKR_ELEVATION_HINT contains spaces
@@ -120,7 +120,7 @@ stdenv.mkDerivation (finalAttrs: {
     # the main package has no tests, checkPhase would only rebuild all deps without -trimpath
     doCheck = false;
 
-    vendorHash = "sha256-L189eeaYDdDKGJYT5vr412YpTgHptVfC4jpNSjNcyuk=";
+    vendorHash = "sha256-NWTXF1f9yNxhzqgF9A7eYWCmGrJ2DV/z/wKW4Yf94ZA=";
 
     nativeBuildInputs = [
       protobuf
diff --git a/pkgs/by-name/ti/ticktick/package.nix b/pkgs/by-name/ti/ticktick/package.nix
index 02c1ac8bf960..065855bcbfcf 100644
--- a/pkgs/by-name/ti/ticktick/package.nix
+++ b/pkgs/by-name/ti/ticktick/package.nix
@@ -12,7 +12,7 @@
   libgbm,
   alsa-lib,
   xdg-utils,
-  systemd,
+  systemdLibs,
 }:
 let
   baseUrl = "https://d2atcrkye2ik4e.cloudfront.net/download";
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   # Needed to make the process get past zygote_linux fork()'ing
-  runtimeDependencies = [ systemd ];
+  runtimeDependencies = [ systemdLibs ];
 
   unpackPhase = ''
     runHook preUnpack
diff --git a/pkgs/by-name/ti/tidal-hifi/package.nix b/pkgs/by-name/ti/tidal-hifi/package.nix
index 9c0c90ec1b17..8236582fcd07 100644
--- a/pkgs/by-name/ti/tidal-hifi/package.nix
+++ b/pkgs/by-name/ti/tidal-hifi/package.nix
@@ -35,7 +35,7 @@
   libxrandr,
   libxkbfile,
   pango,
-  systemd,
+  systemdLibs,
   pciutils,
   libnotify,
   pipewire,
@@ -76,7 +76,7 @@ let
     pango
     pciutils
     stdenv.cc.cc
-    systemd
+    systemdLibs
     libnotify
     pipewire
     libsecret
diff --git a/pkgs/by-name/ti/tidyp/package.nix b/pkgs/by-name/ti/tidyp/package.nix
index 2e7ac31337f5..5e21f253dc17 100644
--- a/pkgs/by-name/ti/tidyp/package.nix
+++ b/pkgs/by-name/ti/tidyp/package.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Program that can validate your HTML, as well as modify it to be more clean and standard";
     mainProgram = "tidyp";
-    homepage = "http://tidyp.com/";
+    homepage = "https://github.com/petdance/tidyp";
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ pSub ];
     license = lib.licenses.bsd3;
diff --git a/pkgs/by-name/tr/tradingview/package.nix b/pkgs/by-name/tr/tradingview/package.nix
index 723776a88bf0..d4762b5a66e0 100644
--- a/pkgs/by-name/tr/tradingview/package.nix
+++ b/pkgs/by-name/tr/tradingview/package.nix
@@ -17,7 +17,7 @@
   libGL,
   pango,
   sqlite,
-  systemd,
+  systemdLibs,
   wayland,
   libxext,
   libx11,
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
     libGL
     pango
     sqlite
-    systemd
+    systemdLibs
     wayland
     libxcb
     libx11
diff --git a/pkgs/by-name/tr/trickle/package.nix b/pkgs/by-name/tr/trickle/package.nix
index f1d606714a0f..869ce26368c1 100644
--- a/pkgs/by-name/tr/trickle/package.nix
+++ b/pkgs/by-name/tr/trickle/package.nix
@@ -62,7 +62,7 @@ stdenv.mkDerivation {
   meta = {
     description = "Lightweight userspace bandwidth shaper";
     license = lib.licenses.bsd3;
-    homepage = "https://monkey.org/~marius/pages/?page=trickle";
+    homepage = "https://github.com/mariusae/trickle";
     platforms = lib.platforms.linux;
     mainProgram = "trickle";
   };
diff --git a/pkgs/by-name/tu/turtle-build/package.nix b/pkgs/by-name/tu/turtle-build/package.nix
index d057cbdad8df..db0679d72fb9 100644
--- a/pkgs/by-name/tu/turtle-build/package.nix
+++ b/pkgs/by-name/tu/turtle-build/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "turtle-build";
-  version = "0.5.7";
+  version = "0.5.15";
 
   src = fetchFromGitHub {
     owner = "raviqqe";
     repo = "turtle-build";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-WWPrTVCVLMVH28WitTFh3OE7ig0GwSBSh9RhGfOYCG4=";
+    hash = "sha256-9zCAZHG7GtVvOb+7Sva76VoRLg2ZzlJy77Xa17Mjclw=";
   };
 
-  cargoHash = "sha256-537IZEfCIRyJhAD3nv6l2iuuloosJmgmwHTFueTsTEk=";
+  cargoHash = "sha256-+blVNeolxnrf5hHk7ob6dXccfq28+Z1N/caPLILMlhU=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
diff --git a/pkgs/by-name/tw/twiggy/package.nix b/pkgs/by-name/tw/twiggy/package.nix
index 814db9513754..f1faca43b918 100644
--- a/pkgs/by-name/tw/twiggy/package.nix
+++ b/pkgs/by-name/tw/twiggy/package.nix
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoHash = "sha256-FaoEqCdMb3h93zGvc+EZ8LfYgMPY3dT/fScpRgGVeAo=";
 
   meta = {
-    homepage = "https://rustwasm.github.io/twiggy/";
+    homepage = "https://alexene.dev/twiggy/";
     description = "Code size profiler for Wasm";
     mainProgram = "twiggy";
     license = with lib.licenses; [
diff --git a/pkgs/by-name/tw/twinejs/package.nix b/pkgs/by-name/tw/twinejs/package.nix
index 5f5a5d138e74..22b318f413e3 100644
--- a/pkgs/by-name/tw/twinejs/package.nix
+++ b/pkgs/by-name/tw/twinejs/package.nix
@@ -14,16 +14,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "twine";
-  version = "2.12.0";
+  version = "2.12.1";
 
   src = fetchFromGitHub {
     owner = "klembot";
     repo = "twinejs";
     tag = finalAttrs.version;
-    hash = "sha256-3/0pEzN90ZAeAoN7i+f604DvJl4VaQWkoOia1r5yQZY=";
+    hash = "sha256-zVBZ8LfrbatwfSSJSCRnx9GbjOlmYfaIWYD+abnG6HE=";
   };
 
-  npmDepsHash = "sha256-k2OHeLcGcVCurTSefEqtqwUzolZ72rKA4WRFJifUPyY=";
+  npmDepsHash = "sha256-ubreU9dwZptQhRIhlXVfsFUf9mJZ9GIqroOlMhMcn4I=";
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
   env.PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD = "1";
diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index 8465175cf9b8..13ce1472760e 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -13,11 +13,12 @@
   buildPackages,
   versionCheckHook,
   nix-update-script,
+  nixosTests,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.84";
+  version = "0.0.86";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
@@ -25,7 +26,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-nIk35Ih3xuGHx06Cxaiw1gkClwfQ+sW61XbbwkU/+ds=";
+    hash = "sha256-LlKVXb7S57t5cLe1iUcfcEkQSYtPHs6pBM+lkcZ36co=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -39,7 +40,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-iF+KUQMeACujyPoVRxjzslg7cmUFoYF+kXEWqIMaTqI=";
+  cargoHash = "sha256-Fv5SwPXdn9Ggo0Yy2Y2NSP2n6FP1mlRePIA2+vOmnjM=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ rust-jemalloc-sys ];
@@ -95,6 +96,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   passthru = {
     updateScript = nix-update-script { };
+
+    # ensure that an update doesn't break the test-driver.
+    tests = lib.optionalAttrs stdenv.hostPlatform.isLinux {
+      nixos-test-driver-busybox = nixosTests.nixos-test-driver.busybox;
+    };
   };
 
   requiredSystemFeatures = [ "big-parallel" ];
diff --git a/pkgs/by-name/ty/typescript-language-server/package.nix b/pkgs/by-name/ty/typescript-language-server/package.nix
index b5572ad7980c..2df906a9e92b 100644
--- a/pkgs/by-name/ty/typescript-language-server/package.nix
+++ b/pkgs/by-name/ty/typescript-language-server/package.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_12;
     fetcherVersion = 4;
-    hash = "sha256-MUSxDMlbG21KSesGdEvqa2kEpuVfLlXRUX1qV/FGsSo=";
+    hash = "sha256-xR/EF60lVBsITKgH7wCM2wHM46PFQevD51KfCENSUH4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/un/unciv/package.nix b/pkgs/by-name/un/unciv/package.nix
index 5af0b1ea8b9a..423cecb1cb0c 100644
--- a/pkgs/by-name/un/unciv/package.nix
+++ b/pkgs/by-name/un/unciv/package.nix
@@ -12,7 +12,7 @@
   nix-update-script,
 }:
 let
-  version = "4.22.5";
+  version = "4.22.8";
 
   desktopItem = makeDesktopItem {
     name = "unciv";
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/yairm210/Unciv/releases/download/${version}/Unciv.jar";
-    hash = "sha256-fIdv48YxqcKlBNhflhwUkhBkBs9q7pbc8PQ3bwqRXYg=";
+    hash = "sha256-BCVNMG6e3qDSWklcGIt9VGpQCcXNtYUPj8hmaei0KOM=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/up/upwork/package.nix b/pkgs/by-name/up/upwork/package.nix
index 1c2611612547..c7061e79a844 100644
--- a/pkgs/by-name/up/upwork/package.nix
+++ b/pkgs/by-name/up/upwork/package.nix
@@ -40,7 +40,7 @@
   nss,
   openssl,
   pango,
-  systemd,
+  systemdLibs,
 }:
 
 stdenv.mkDerivation rec {
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     libcxx
-    systemd
+    systemdLibs
     libpulseaudio
     stdenv.cc.cc
     alsa-lib
@@ -96,7 +96,7 @@ stdenv.mkDerivation rec {
     nspr
     nss
     pango
-    systemd
+    systemdLibs
   ];
 
   libPath = lib.makeLibraryPath buildInputs;
diff --git a/pkgs/by-name/ut/utpm/package.nix b/pkgs/by-name/ut/utpm/package.nix
index 8524b5ab1f14..958ec5582adb 100644
--- a/pkgs/by-name/ut/utpm/package.nix
+++ b/pkgs/by-name/ut/utpm/package.nix
@@ -7,6 +7,7 @@
   stdenv,
   buildPackages,
   installShellFiles,
+  libgit2,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "utpm";
@@ -23,8 +24,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   env.OPENSSL_NO_VENDOR = 1;
 
+  env.LIBGIT2_NO_VENDOR = 1;
+
   buildInputs = [
     openssl
+    libgit2
   ];
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/uw/uwsm/package.nix b/pkgs/by-name/uw/uwsm/package.nix
index 3dd6fceee2ec..bc0717b3b2af 100644
--- a/pkgs/by-name/uw/uwsm/package.nix
+++ b/pkgs/by-name/uw/uwsm/package.nix
@@ -14,7 +14,7 @@
   libnotify,
   newt,
   python3Packages,
-  systemd,
+  systemdLibs,
   util-linux,
   fumonSupport ? true,
   uuctlSupport ? true,
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     newt # whiptail
     libnotify # notify-send
     bash # sh
-    systemd
+    systemdLibs
     python
   ]
   ++ lib.optionals uuctlSupport [ dmenu ];
diff --git a/pkgs/by-name/va/vacuum-tube/package.nix b/pkgs/by-name/va/vacuum-tube/package.nix
index f68fa7fb8a6a..dc6b74df3c2c 100644
--- a/pkgs/by-name/va/vacuum-tube/package.nix
+++ b/pkgs/by-name/va/vacuum-tube/package.nix
@@ -10,16 +10,16 @@
 
 buildNpmPackage rec {
   pname = "vacuum-tube";
-  version = "1.8.2";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "shy1132";
     repo = "VacuumTube";
     tag = "v${version}";
-    hash = "sha256-KgXV6fSvV6jl8V2YEjJm+CIG8ATvb1/iEhLog91DPY0=";
+    hash = "sha256-OA3UjqJTELqe2nn2y2/ztQxipENt873Iw5WDsjyjjRc=";
   };
 
-  npmDepsHash = "sha256-Wtyft343sSs018v5bagCvvta5z+yzU9IgkJ4LH+HQzs=";
+  npmDepsHash = "sha256-kKyOjpl6LwUOdWP5+AN8m2RxMcDhzov3YLw1rhUna3k=";
   makeCacheWritable = true;
 
   env = {
diff --git a/pkgs/by-name/vi/vivaldi/package.nix b/pkgs/by-name/vi/vivaldi/package.nix
index 30a48e961149..4665e9a68a6d 100644
--- a/pkgs/by-name/vi/vivaldi/package.nix
+++ b/pkgs/by-name/vi/vivaldi/package.nix
@@ -23,7 +23,7 @@
   dbus,
   cups,
   libexif,
-  systemd,
+  systemdLibs,
   libva,
   libGL,
   freetype,
@@ -130,7 +130,7 @@ stdenv.mkDerivation rec {
     gtk3
     gdk-pixbuf
     libexif
-    systemd
+    systemdLibs
     libva
     qt6.qtbase
     qt6.qtwayland
diff --git a/pkgs/by-name/vo/voxtype/package.nix b/pkgs/by-name/vo/voxtype/package.nix
index 4d1b6de9f8d8..75c02daf2d74 100644
--- a/pkgs/by-name/vo/voxtype/package.nix
+++ b/pkgs/by-name/vo/voxtype/package.nix
@@ -19,6 +19,7 @@
   libnotify,
   openssl,
   pciutils,
+  pulseaudio,
   wl-clipboard,
   wtype,
   which,
@@ -160,6 +161,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
         (lib.makeBinPath (
           [
             libnotify
+            pulseaudio # pactl for media ducking
             which
           ]
           ++ lib.optionals vulkanSupport [
diff --git a/pkgs/by-name/wa/waydroid-helper/package.nix b/pkgs/by-name/wa/waydroid-helper/package.nix
index 33eeb4bc76b7..e9cffd51d4b9 100644
--- a/pkgs/by-name/wa/waydroid-helper/package.nix
+++ b/pkgs/by-name/wa/waydroid-helper/package.nix
@@ -19,7 +19,7 @@
   fakeroot,
   libadwaita,
   libxml2,
-  systemd,
+  systemdLibs,
   unzip,
   vte-gtk4,
   nix-update-script,
@@ -83,7 +83,7 @@ python3Packages.buildPythonApplication {
     dbus
     libadwaita
     libxml2
-    systemd
+    systemdLibs
     vte-gtk4
   ];
 
diff --git a/pkgs/by-name/wa/waydroid/package.nix b/pkgs/by-name/wa/waydroid/package.nix
index 661e6fe6581d..be2fae3d76dc 100644
--- a/pkgs/by-name/wa/waydroid/package.nix
+++ b/pkgs/by-name/wa/waydroid/package.nix
@@ -98,6 +98,10 @@ python3Packages.buildPythonApplication rec {
 
   meta = {
     description = "Container-based approach to boot a full Android system on a regular GNU/Linux system";
+    longDescription = ''
+      A container-based approach to boot a full Android system on regular GNU/Linux systems running Wayland based desktop environments.
+      To install on NixOS, please use the option `virtualisation.waydroid.enable = true`.
+    '';
     mainProgram = "waydroid";
     homepage = "https://github.com/waydroid/waydroid";
     license = lib.licenses.gpl3Only;
diff --git a/pkgs/by-name/we/wealthfolio/package.nix b/pkgs/by-name/we/wealthfolio/package.nix
index 49aacefcc789..eb15b3b476ec 100644
--- a/pkgs/by-name/we/wealthfolio/package.nix
+++ b/pkgs/by-name/we/wealthfolio/package.nix
@@ -19,20 +19,20 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "wealthfolio";
-  version = "3.8.0";
+  version = "3.9.1";
 
   src = fetchFromGitHub {
     owner = "wealthfolio";
     repo = "wealthfolio";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-5CqLHnwBzqA+yf/sQM2ie3xuO+5aM5EDA0bhZ6r1VIM=";
+    hash = "sha256-ozdNgUytQMWzPf7N+8x2boNC/GgxMmzGzAnioGW20VA=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) src pname version;
     pnpm = pnpm_10;
     fetcherVersion = 4;
-    hash = "sha256-I9s1hFNb7oHYH5OhKmtMbMsmQZXE6ovpupusN6M1YKc=";
+    hash = "sha256-j9rqB5RYpoyQP58erDE5r1Kx7Aq9vOQbiOTBzGVoe9k=";
   };
 
   cargoRoot = ".";
@@ -45,7 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
       src
       cargoRoot
       ;
-    hash = "sha256-PFMmpQhQubMzomvLWMJZrriH9emwEzO/rTFCovzFt6w=";
+    hash = "sha256-skElXNXFcTwPv+rLKY90He8XLZfVrOJ8jYC4kL2vj9c=";
   };
 
   nativeBuildInputs = [
@@ -66,6 +66,8 @@ stdenv.mkDerivation (finalAttrs: {
     webkitgtk_4_1
   ];
 
+  env.OPENSSL_NO_VENDOR = "1";
+
   postPatch = ''
     jq \
       '.plugins.updater.endpoints = [ ]
diff --git a/pkgs/by-name/we/wechat-uos/package.nix b/pkgs/by-name/we/wechat-uos/package.nix
index f400ca0d0a1c..c5a559c5a567 100644
--- a/pkgs/by-name/we/wechat-uos/package.nix
+++ b/pkgs/by-name/we/wechat-uos/package.nix
@@ -51,7 +51,7 @@
   libexif,
   ffmpeg,
   pulseaudio,
-  systemd,
+  systemdLibs,
   libuuid,
   expat,
   bzip2,
@@ -133,7 +133,7 @@ let
     libdrm
     libgbm
     vulkan-loader
-    systemd
+    systemdLibs
     wayland
     pulseaudio
     qt6.qt5compat
diff --git a/pkgs/by-name/we/wezterm/package.nix b/pkgs/by-name/we/wezterm/package.nix
index 8f3e650b5684..c97fed74abd3 100644
--- a/pkgs/by-name/we/wezterm/package.nix
+++ b/pkgs/by-name/we/wezterm/package.nix
@@ -29,14 +29,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wezterm";
-  version = "0-unstable-2026-09-17";
+  version = "0-unstable-2026-09-29";
 
   src = fetchFromGitHub {
     owner = "wezterm";
     repo = "wezterm";
-    rev = "b09b56c29c1e367e598b60ca266e2cc9038751e0";
+    rev = "cab25161054c50fd6c705db4ceefef0f1e5a9575";
     fetchSubmodules = true;
-    hash = "sha256-wVK9IcPezoEWeTlDkD/foGyRH2tnwEHX3ZgChpIX3Vw=";
+    hash = "sha256-u1cB9tKZ0nVmV8UHi6zq0esnSFX4flh3K0JjIQh5CE8=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/wh/whatsapp-for-mac/package.nix b/pkgs/by-name/wh/whatsapp-for-mac/package.nix
index 9e59bd17f557..ae02fa961448 100644
--- a/pkgs/by-name/wh/whatsapp-for-mac/package.nix
+++ b/pkgs/by-name/wh/whatsapp-for-mac/package.nix
@@ -10,13 +10,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "whatsapp-for-mac";
-  version = "2.26.31.27";
+  version = "2.26.40.20";
 
   src = fetchzip {
     extension = "zip";
     name = "WhatsApp.app";
     url = "https://web.whatsapp.com/desktop/mac_native/release/?version=${finalAttrs.version}&extension=zip&configuration=Release&branch=master";
-    hash = "sha256-bB4RVqk+v5QdsOvgTc4hA6EF/s1KIBnrL+HXwsm89/c=";
+    hash = "sha256-WN2mOYL/rQgStXIgV4YqC8mGAKdQXPY0a4qeawnnJjA=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/wi/wivrn/package.nix b/pkgs/by-name/wi/wivrn/package.nix
index 4d7f2d9413bf..60985cce8f8f 100644
--- a/pkgs/by-name/wi/wivrn/package.nix
+++ b/pkgs/by-name/wi/wivrn/package.nix
@@ -40,7 +40,7 @@
   qt6,
   sdl2-compat,
   shaderc,
-  systemd,
+  systemdLibs,
   udev,
   vulkan-headers,
   vulkan-loader,
@@ -120,7 +120,7 @@ stdenv.mkDerivation (finalAttrs: {
     libxrandr
     openxr-loader
     shaderc
-    systemd
+    systemdLibs
     udev
     vulkan-headers
     vulkan-loader
diff --git a/pkgs/by-name/xa/xarcan/package.nix b/pkgs/by-name/xa/xarcan/package.nix
index df3ccaf4a28d..6f7da8d1ccc9 100644
--- a/pkgs/by-name/xa/xarcan/package.nix
+++ b/pkgs/by-name/xa/xarcan/package.nix
@@ -29,7 +29,7 @@
   openssl,
   pixman,
   pkg-config,
-  systemd,
+  systemdLibs,
   libxcb-util,
   libxcb-wm,
   libxcb-image,
@@ -82,7 +82,7 @@ stdenv.mkDerivation (finalPackages: rec {
     nettle
     openssl
     pixman
-    systemd
+    systemdLibs
     libxcb-util
     libxcb-wm
     libxcb-image
diff --git a/pkgs/by-name/xe/xenomapper/package.nix b/pkgs/by-name/xe/xenomapper/package.nix
index bfb24b7dfeea..0cac135be760 100644
--- a/pkgs/by-name/xe/xenomapper/package.nix
+++ b/pkgs/by-name/xe/xenomapper/package.nix
@@ -18,8 +18,6 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
 
   build-system = with python3.pkgs; [ setuptools ];
 
-  dependencies = with python3.pkgs; [ statistics ];
-
   pythonImportsCheck = [
     "xenomapper.xenomapper"
     "xenomapper.mappability"
diff --git a/pkgs/by-name/xm/xmind/package.nix b/pkgs/by-name/xm/xmind/package.nix
index c18c9bf0b28e..65a4d0ab6748 100644
--- a/pkgs/by-name/xm/xmind/package.nix
+++ b/pkgs/by-name/xm/xmind/package.nix
@@ -26,7 +26,7 @@
   libxkbfile,
   libxcb,
   libgbm,
-  systemd,
+  systemdLibs,
   libGL,
 }:
 
@@ -71,7 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   runtimeDependencies = map lib.getLib [
-    systemd
+    systemdLibs
   ];
 
   installPhase = ''
diff --git a/pkgs/by-name/xo/xournalpp/package.nix b/pkgs/by-name/xo/xournalpp/package.nix
index 572623c45554..1db08d3f993e 100644
--- a/pkgs/by-name/xo/xournalpp/package.nix
+++ b/pkgs/by-name/xo/xournalpp/package.nix
@@ -25,7 +25,7 @@
   zlib,
   # plugins
   withLua ? true,
-  lua5_3,
+  lua5_5,
   nix-update-script,
 }:
 
@@ -63,7 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
     zlib
   ]
   ++ lib.optional stdenv.hostPlatform.isLinux alsa-lib
-  ++ lib.optional withLua lua5_3;
+  ++ lib.optional withLua lua5_5;
 
   buildFlags = [ "translations" ];
 
diff --git a/pkgs/by-name/xw/xwayland/package.nix b/pkgs/by-name/xw/xwayland/package.nix
index 6e601a598632..05d2799c66c2 100644
--- a/pkgs/by-name/xw/xwayland/package.nix
+++ b/pkgs/by-name/xw/xwayland/package.nix
@@ -41,7 +41,7 @@
   pkg-config,
   pixman,
   stdenv,
-  systemd,
+  systemdLibs,
   wayland,
   wayland-protocols,
   wayland-scanner,
@@ -116,7 +116,7 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     libtirpc
-    systemd
+    systemdLibs
   ]
   ++ lib.optionals stdenv.hostPlatform.isFreeBSD [
     epoll-shim
diff --git a/pkgs/by-name/ze/zerobyte/package.nix b/pkgs/by-name/ze/zerobyte/package.nix
index 89f8b90efc3e..2815066868ec 100644
--- a/pkgs/by-name/ze/zerobyte/package.nix
+++ b/pkgs/by-name/ze/zerobyte/package.nix
@@ -68,14 +68,14 @@ let
       # Required, otherwise the fixed-output derivation references store paths.
       dontFixup = true;
 
-      outputHash = "sha256-dW1OJ2AE4HaaJQAHPuyLu5vyv7It3r6OeXlAzEc4OlI=";
+      outputHash = "sha256-4MuYKmi4Vit50g5kUQhHuTTyz7aL73igFcD0yaLRckw=";
       outputHashAlgo = "sha256";
       outputHashMode = "recursive";
     };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "zerobyte";
-  version = "0.43.1";
+  version = "0.43.2";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -84,7 +84,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "nicotsx";
     repo = "zerobyte";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iZmXWxPnp7vYt3joPbluYQ3GXKGoN9qcrUfkWTO3Y7c=";
+    hash = "sha256-Bv2ZFOWYiKEwjVLHnAY/N8+KqZVaF03mRGl9rkNyohI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/zo/zoneminder/package.nix b/pkgs/by-name/zo/zoneminder/package.nix
index 4a8d3c29205a..c8ed6602fb6c 100644
--- a/pkgs/by-name/zo/zoneminder/package.nix
+++ b/pkgs/by-name/zo/zoneminder/package.nix
@@ -89,13 +89,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "zoneminder";
-  version = "1.38.4";
+  version = "1.38.6";
 
   src = fetchFromGitHub {
     owner = "ZoneMinder";
     repo = "zoneminder";
     tag = version;
-    hash = "sha256-bowVUTRtrTyS1zSaF+wKua6Wx5F7C5S40y7BKr6q9sE=";
+    hash = "sha256-sSFEarFMbCHDMbrWRJT1Y/0owLJqr033t0eaVDPjzdw=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/zs/zsh-powerlevel9k/package.nix b/pkgs/by-name/zs/zsh-powerlevel9k/package.nix
deleted file mode 100644
index 160e39d2f44a..000000000000
--- a/pkgs/by-name/zs/zsh-powerlevel9k/package.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-}:
-
-stdenv.mkDerivation {
-  pname = "powerlevel9k";
-  version = "2017-11-10";
-  src = fetchFromGitHub {
-    owner = "Powerlevel9k";
-    repo = "powerlevel9k";
-    rev = "87acc51acab3ed4fd33cda2386abed6f98c80720";
-    sha256 = "0v1dqg9hvycdkcvklg2njff97xwr8rah0nyldv4xm39r77f4yfvq";
-  };
-
-  strictDeps = true;
-  installPhase = ''
-    install -D powerlevel9k.zsh-theme --target-directory=$out/share/zsh/themes/powerlevel9k
-    install -D functions/* --target-directory=$out/share/zsh/themes/powerlevel9k/functions
-    ln -s $out/share/zsh/themes/powerlevel9k $out/share/zsh-powerlevel9k
-  '';
-
-  meta = {
-    description = "Beautiful theme for zsh";
-    longDescription = ''
-      To make use of this derivation, use
-      `programs.zsh.promptInit = "source ''${pkgs.zsh-powerlevel9k}/share/zsh-powerlevel9k/powerlevel9k.zsh-theme";`
-    '';
-    homepage = "https://github.com/Powerlevel9k/powerlevel9k";
-    license = lib.licenses.mit;
-
-    platforms = lib.platforms.unix;
-    maintainers = [ lib.maintainers.pierrechevalier83 ];
-  };
-}
diff --git a/pkgs/desktops/enlightenment/ephoto/default.nix b/pkgs/desktops/enlightenment/ephoto/default.nix
index bc26507df812..7aba470668f1 100644
--- a/pkgs/desktops/enlightenment/ephoto/default.nix
+++ b/pkgs/desktops/enlightenment/ephoto/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Image viewer and editor written using the Enlightenment Foundation Libraries";
     mainProgram = "ephoto";
-    homepage = "https://www.smhouston.us/ephoto/";
+    homepage = "https://www.enlightenment.org/about-ephoto";
     license = lib.licenses.bsd2;
     platforms = lib.platforms.linux;
     teams = [ lib.teams.enlightenment ];
diff --git a/pkgs/desktops/gnome/default.nix b/pkgs/desktops/gnome/default.nix
index 1fd527d60fc3..0375cc05d60f 100644
--- a/pkgs/desktops/gnome/default.nix
+++ b/pkgs/desktops/gnome/default.nix
@@ -17,9 +17,6 @@ lib.makeScope pkgs.newScope (
     # This will go away, do not use outside Nixpkgs.
     _gdkPixbufCacheBuilder_DO_NOT_USE = callPackage ./gdk-pixbuf-cache-builder.nix { };
 
-    # ISO installer
-    # installerIso = callPackage ./installer.nix {};
-
     #### Core (http://ftp.acc.umu.se/pub/GNOME/core/)
 
     gvfs = pkgs.gvfs.override { gnomeSupport = true; };
diff --git a/pkgs/desktops/gnome/installer.nix b/pkgs/desktops/gnome/installer.nix
deleted file mode 100644
index 3076a9a872cd..000000000000
--- a/pkgs/desktops/gnome/installer.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{
-  isoBaseName ? "nixos-graphical-gnome",
-  system ? builtins.currentSystem,
-  extraModules ? [ ],
-}:
-
-let
-
-  module = ../../../../nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix;
-
-  config =
-    (import ../../../../nixos/lib/eval-config.nix {
-      inherit system;
-      modules = [
-        module
-        { image.baseName = isoBaseName; }
-      ]
-      ++ extraModules;
-    }).config;
-
-in
-config.system.build.isoImage
diff --git a/pkgs/desktops/pantheon/apps/elementary-files/default.nix b/pkgs/desktops/pantheon/apps/elementary-files/default.nix
index 57a7c71d414d..96cd136a3506 100644
--- a/pkgs/desktops/pantheon/apps/elementary-files/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-files/default.nix
@@ -27,7 +27,7 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-files";
-  version = "7.3.2";
+  version = "7.3.3";
 
   outputs = [
     "out"
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     owner = "elementary";
     repo = "files";
     rev = version;
-    hash = "sha256-DFW2C9Uoa9RIqP7DoskEK0X0RQxb0nYe85xsgogOaKs=";
+    hash = "sha256-Na5aiIgdAogSRwysz4v6U47tphVYVWleJ6OokXT+HMw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/pantheon/desktop/gala/default.nix b/pkgs/desktops/pantheon/desktop/gala/default.nix
index c63880cf5d01..bba228b8b64e 100644
--- a/pkgs/desktops/pantheon/desktop/gala/default.nix
+++ b/pkgs/desktops/pantheon/desktop/gala/default.nix
@@ -30,13 +30,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gala";
-  version = "8.6.1";
+  version = "8.6.2";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "gala";
     tag = finalAttrs.version;
-    hash = "sha256-q2GoJSa/ECn54UM0t8Z86bdTVea6XAflotkMoEOXK0Q=";
+    hash = "sha256-M3EqQS7xJbNryQ2emJdhOZfm1l2iO6qmG0X/6cRwpN4=";
   };
 
   depsBuildBuild = [ pkg-config ];
diff --git a/pkgs/development/ada-modules/gnatcoll/bindings.nix b/pkgs/development/ada-modules/gnatcoll/bindings.nix
index a370cc5f015e..2d5d34e3da57 100644
--- a/pkgs/development/ada-modules/gnatcoll/bindings.nix
+++ b/pkgs/development/ada-modules/gnatcoll/bindings.nix
@@ -1,5 +1,5 @@
 {
-  stdenv,
+  stdenvNoCC,
   lib,
   fetchFromGitHub,
   gnat,
@@ -34,7 +34,7 @@ let
   };
 in
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "gnatcoll-${component}";
   version = "25.0.0";
 
diff --git a/pkgs/development/ada-modules/gnatcoll/core.nix b/pkgs/development/ada-modules/gnatcoll/core.nix
index e60230332945..86ef32a21910 100644
--- a/pkgs/development/ada-modules/gnatcoll/core.nix
+++ b/pkgs/development/ada-modules/gnatcoll/core.nix
@@ -1,5 +1,5 @@
 {
-  stdenv,
+  stdenvNoCC,
   lib,
   gnat,
   gprbuild,
@@ -18,7 +18,7 @@
 # gnatcoll-projects depends on gnatcoll-core
 assert enableGnatcollProjects -> enableGnatcollCore;
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "gnatcoll-core";
   version = "25.0.0";
 
@@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
     "prefix=${placeholder "out"}"
     "PROCESSORS=$(NIX_BUILD_CORES)"
     # confusingly, for gprbuild --target is autoconf --host
-    "TARGET=${stdenv.hostPlatform.config}"
+    "TARGET=${stdenvNoCC.hostPlatform.config}"
     "GNATCOLL_MINIMAL_ONLY=${lib.boolToYesNo (!enableGnatcollCore)}"
     "GNATCOLL_PROJECTS=${lib.boolToYesNo enableGnatcollProjects}"
   ];
diff --git a/pkgs/development/ada-modules/gnatprove/default.nix b/pkgs/development/ada-modules/gnatprove/default.nix
index d4e39a3506d1..1710885326cc 100644
--- a/pkgs/development/ada-modules/gnatprove/default.nix
+++ b/pkgs/development/ada-modules/gnatprove/default.nix
@@ -1,7 +1,8 @@
 {
-  stdenv,
+  stdenvNoCC,
   lib,
   fetchFromGitHub,
+  clang,
   gnat,
   gnatcoll-core,
   gprbuild,
@@ -57,6 +58,9 @@ let
       };
       commit_date = "2023-01-05";
       patches = [
+        # Suppress warnings on aarch64: https://github.com/AdaCore/spark2014/issues/54
+        ./0002-mute-aarch64-warnings.patch
+
         # Changes to the GNAT frontend: https://github.com/AdaCore/spark2014/issues/58
         ./0003-Adjust-after-category-change-for-N_Formal_Package_De.patch
       ];
@@ -99,7 +103,7 @@ let
       or (throw "GNATprove depends on a specific GNAT version and can't be built using GNAT ${gnat_version}.");
 
 in
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   pname = "gnatprove";
   version = "fsf-${gnat_version}_${thisSpark.commit_date}";
 
@@ -117,7 +121,8 @@ stdenv.mkDerivation {
     ocaml
     findlib
     menhir
-  ]);
+  ])
+  ++ lib.optional stdenvNoCC.targetPlatform.isDarwin clang;
 
   buildInputs = [
     gnatcoll-core
@@ -149,6 +154,8 @@ stdenv.mkDerivation {
     # gnat2why/gnat_src points to the GNAT sources
     tar xf ${gnat.cc.src} --wildcards 'gcc-*/gcc/ada'
     mv gcc-*/gcc/ada gnat2why/gnat_src
+
+    mv src/common/aarch64-darwin src/common/arm64-darwin
   '';
 
   configurePhase = ''
diff --git a/pkgs/development/ada-modules/gpr2/default.nix b/pkgs/development/ada-modules/gpr2/default.nix
index f984a0892f3f..781b603d0ebd 100644
--- a/pkgs/development/ada-modules/gpr2/default.nix
+++ b/pkgs/development/ada-modules/gpr2/default.nix
@@ -48,6 +48,7 @@ stdenv.mkDerivation rec {
   # fool make into thinking pregenerated targets are up to date
   preBuild = lib.optionalString (gpr2kbdir == null) ''
     touch .build/kb/{*.adb,*.ads,collect_kb}
+    chmod +x .build/kb/collect_kb
   '';
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/ada-modules/gprbuild/boot.nix b/pkgs/development/ada-modules/gprbuild/boot.nix
index f23628f37b7a..ff7b5a17c708 100644
--- a/pkgs/development/ada-modules/gprbuild/boot.nix
+++ b/pkgs/development/ada-modules/gprbuild/boot.nix
@@ -1,6 +1,7 @@
 {
   stdenv,
   lib,
+  applyPatches,
   fetchFromGitHub,
   fetchpatch2,
   gnat,
@@ -11,15 +12,36 @@
 let
   version = "25.0.0";
 
-  gprConfigKbSrc = fetchFromGitHub {
-    name = "gprconfig-kb-${version}-src";
-    owner = "AdaCore";
-    repo = "gprconfig_kb";
-    rev = "v${version}";
-    sha256 = "09x1njq0i0z7fbwg0mg39r5ghy7369avbqvdycfj67lpmw17gb1r";
+  gprconfig_kb = applyPatches {
+    src = fetchFromGitHub {
+      owner = "AdaCore";
+      repo = "gprconfig_kb";
+      tag = "v${version}";
+      hash = "sha256-Oax3Aq+XHiMd823jtVUy43j4Sk7jVfD4cueDCLC0oSc=";
+    };
+
+    patches = [
+      ./gprconfig_kb-darwin.patch
+    ];
+
+    postPatch = ''
+      # Install custom compiler description which can detect nixpkgs'
+      # GNAT wrapper as a proper Ada compiler. The default compiler
+      # description expects the runtime library to be installed in
+      # the same prefix which isn't the case for nixpkgs. As a
+      # result, it would detect the unwrapped GNAT as a proper
+      # compiler which is unable to produce working binaries.
+      #
+      # Our compiler description is very similar to the upstream
+      # GNAT description except that we use a symlink in $out/nix-support
+      # created by the cc-wrapper to find the associated runtime
+      # libraries and use gnatmake instead of gnatls to find GNAT's
+      # bin directory.
+
+      install -m644 ${./nixpkgs-gnat.xml} db/nixpkgs-gnat.xml
+    '';
   };
 in
-
 stdenv.mkDerivation {
   pname = "gprbuild-boot";
   inherit version;
@@ -29,7 +51,7 @@ stdenv.mkDerivation {
     owner = "AdaCore";
     repo = "gprbuild";
     rev = "v${version}";
-    sha256 = "1mqsmc0q5bzg8223ls18kbvaz6mhzjz7ik8d3sqhhn24c0j6wjaw";
+    hash = "sha256-XEluJGBEWAixHg3NeL78sJqv9pooaDqEQO+vggGrGtc=";
   };
 
   nativeBuildInputs = [
@@ -84,23 +106,9 @@ stdenv.mkDerivation {
 
     ./bootstrap.sh \
       --with-xmlada=${xmlada.src} \
-      --with-kb=${gprConfigKbSrc} \
+      --with-kb=${gprconfig_kb} \
       --prefix=$out
 
-    # Install custom compiler description which can detect nixpkgs'
-    # GNAT wrapper as a proper Ada compiler. The default compiler
-    # description expects the runtime library to be installed in
-    # the same prefix which isn't the case for nixpkgs. As a
-    # result, it would detect the unwrapped GNAT as a proper
-    # compiler which is unable to produce working binaries.
-    #
-    # Our compiler description is very similar to the upstream
-    # GNAT description except that we use a symlink in $out/nix-support
-    # created by the cc-wrapper to find the associated runtime
-    # libraries and use gnatmake instead of gnatls to find GNAT's
-    # bin directory.
-    install -m644 ${./nixpkgs-gnat.xml} $out/share/gprconfig/nixpkgs-gnat.xml
-
     runHook postInstall
   '';
 
@@ -110,11 +118,5 @@ stdenv.mkDerivation {
     license = lib.licenses.gpl3Plus;
     maintainers = [ lib.maintainers.sternenseemann ];
     platforms = lib.platforms.all;
-    # gprbuild-boot builds on darwin, but `gprconfig` stack overflows whenever
-    # it runs during the enumeration of available toolchains
-    # This doesn't seem to be a problem with our compiler definition `./nixpkgs-gnat.xml`
-    # as a gprbuild system without that configuration also stack faults.
-    # Maybe a linker issue?
-    broken = stdenv.hostPlatform.isDarwin;
   };
 }
diff --git a/pkgs/development/ada-modules/gprbuild/default.nix b/pkgs/development/ada-modules/gprbuild/default.nix
index b722f012d431..cf9df1247d6a 100644
--- a/pkgs/development/ada-modules/gprbuild/default.nix
+++ b/pkgs/development/ada-modules/gprbuild/default.nix
@@ -47,13 +47,7 @@ stdenv.mkDerivation {
     NIX_LDFLAGS = "-headerpad_max_install_names";
   };
 
-  patches =
-    gprbuild-boot.patches
-    # Fixes gprbuild being linked statically always. Based on the AUR's patch:
-    # https://aur.archlinux.org/cgit/aur.git/plain/0001-Makefile-build-relocatable-instead-of-static-binary.patch?h=gprbuild&id=bac524c76cd59c68fb91ef4dfcbe427357b9f850
-    ++ lib.optionals (!stdenv.hostPlatform.isStatic) [
-      ./gprbuild-relocatable-build.patch
-    ];
+  patches = gprbuild-boot.patches;
 
   buildFlags = [
     "all"
diff --git a/pkgs/development/ada-modules/gprbuild/gprconfig_kb-darwin.patch b/pkgs/development/ada-modules/gprbuild/gprconfig_kb-darwin.patch
new file mode 100644
index 000000000000..cbb62339c1c7
--- /dev/null
+++ b/pkgs/development/ada-modules/gprbuild/gprconfig_kb-darwin.patch
@@ -0,0 +1,49 @@
+--- a/db/fallback_targets.xml
++++ b/db/fallback_targets.xml
+@@ -14,6 +14,7 @@
+   <fallback_targets>
+     <target>x86_64-darwin</target>
+     <target>aarch64-darwin</target>
++    <target>arm64-darwin</target>
+   </fallback_targets>
+ 
+ </gprconfig>
+diff --git a/db/linker.xml b/db/linker.xml
+index e2489e88..0aa264e6 100644
+--- a/db/linker.xml
++++ b/db/linker.xml
+@@ -1207,6 +1207,7 @@
+        <target name="^powerpc-.*darwin.*$" />
+        <target name="^x86_64-.*darwin.*$" />
+        <target name="^aarch64-.*darwin.*$" />
++       <target name="^arm64-.*darwin.*$" />
+     </targets>
+     <config>
+    for Library_Builder use "${GPRCONFIG_PREFIX}libexec/gprbuild/gprlib";
+@@ -1242,6 +1243,8 @@
+        <target name="^i.86-.*darwin.*$" />
+        <target name="^powerpc-.*darwin.*$" />
+        <target name="^x86_64-.*darwin.*$" />
++       <target name="^aarch64.*darwin.*$" />
++       <target name="^arm64.*darwin.*$" />
+     </targets>
+     <config>
+     for Library_Rpath_Options ("C++") use ("-print-file-name=libstdc++.dylib");
+diff --git a/db/targetset.xml b/db/targetset.xml
+index 3fdda73e..a096e392 100644
+--- a/db/targetset.xml
++++ b/db/targetset.xml
+@@ -129,6 +129,13 @@
+     <target>x86_64-.*windows-gnu</target>
+   </targetset>
+ 
++  <!-- arm64-darwin -->
++  <targetset canonical="arm64-darwin">
++    <target>arm64-ios</target>
++    <target>arm64-darwin</target>
++    <target>arm64.*-darwin.*</target>
++  </targetset>
++
+   <!-- aarch64-darwin (iOS 64bit) -->
+   <targetset canonical="aarch64-darwin">
+     <target>aarch64-ios</target>
diff --git a/pkgs/development/compilers/gcc/patches/default.nix b/pkgs/development/compilers/gcc/patches/default.nix
index 4d5ffabe73a3..f93b2c1c8c0e 100644
--- a/pkgs/development/compilers/gcc/patches/default.nix
+++ b/pkgs/development/compilers/gcc/patches/default.nix
@@ -180,6 +180,8 @@ optionals noSysDirs (
   is13 && langAda && stdenv.targetPlatform.isDarwin
 ) ./13/gnat13-aarch64-darwin-trampoline.patch
 
+++ optional (langAda && stdenv.targetPlatform.isDarwin) ./gnat-darwin-trampoline.patch
+
 ++ optional (targetPlatform.isWindows || targetPlatform.isCygwin) (fetchpatch {
   name = "libstdc-fix-compilation-in-freestanding-win32.patch";
   url = "https://inbox.sourceware.org/gcc-patches/20250922182808.2599390-2-corngood@gmail.com/raw";
diff --git a/pkgs/development/compilers/gcc/patches/gnat-darwin-trampoline.patch b/pkgs/development/compilers/gcc/patches/gnat-darwin-trampoline.patch
new file mode 100644
index 000000000000..00aae7f49fc6
--- /dev/null
+++ b/pkgs/development/compilers/gcc/patches/gnat-darwin-trampoline.patch
@@ -0,0 +1,22 @@
+Ada makes extensive use of nested functions, and gcc by default uses trampolines
+to avoid using fat pointers (carry link to parent stack frame along with link to
+actual function body). However, executable stack has been disabled on darwin
+since version 20 (macOS 11). Thus, make heap trampolines unconditionally used on
+darwin as we only support macOS version 13+
+--- a/gcc/config.gcc
++++ b/gcc/config.gcc
+@@ -1177,13 +1177,13 @@ esac
+ # Figure out if we need to enable heap trampolines
+ # and variadic functions handling.
+ case ${target} in
+-aarch64*-*-darwin2*)
++aarch64*-*-darwin* | arm64*-*-darwin*)
+   # This applies to arm64 Darwin variadic funtions.
+   tm_defines="$tm_defines STACK_USE_CUMULATIVE_ARGS_INIT=1"
+   # Executable stack is forbidden.
+   tm_defines="$tm_defines HEAP_TRAMPOLINES_INIT=1"
+   ;;
+-*-*-darwin2*)
++*-*-darwin*)
+   tm_defines="$tm_defines STACK_USE_CUMULATIVE_ARGS_INIT=0"
+   # Currently, we do this for macOS 11 and above.
diff --git a/pkgs/development/libraries/qcustomplot/default.nix b/pkgs/development/libraries/qcustomplot/default.nix
index 89f490b70f6f..ed5294bc8186 100644
--- a/pkgs/development/libraries/qcustomplot/default.nix
+++ b/pkgs/development/libraries/qcustomplot/default.nix
@@ -58,7 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
-    homepage = "https://qtcustomplot.com/";
+    homepage = "https://www.qcustomplot.com/";
     description = "Qt C++ widget for plotting and data visualization";
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.unix;
diff --git a/pkgs/development/libraries/spglib/default.nix b/pkgs/development/libraries/spglib/default.nix
index 83ec38c364ce..795e310a9f67 100644
--- a/pkgs/development/libraries/spglib/default.nix
+++ b/pkgs/development/libraries/spglib/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spglib";
-  version = "2.7.0"; # N.B: if you change this, please update: pythonPackages.spglib
+  version = "2.8.0"; # N.B: if you change this, please update: pythonPackages.spglib
 
   src = fetchFromGitHub {
     owner = "spglib";
     repo = "spglib";
     rev = "v${version}";
-    hash = "sha256-RFvd/j/14YRIcQTpnYPx5edeF3zbHbi90jb32i3ZU/c=";
+    hash = "sha256-lnD/tUY/fXxgOS/aB8tesTyLcqpOBzjZaMO2Kjznf1M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 6a278055e950..65ee34162a9d 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -110,6 +110,16 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
+  # capi3c.test is a copy of capi3.test, but upstream only disabled the
+  # intentional use-after-free cases in the original. They segfault with
+  # allocators that return freed memory to the OS eagerly, such as musl's.
+  ${if stdenv.hostPlatform.isMusl then "postPatch" else null} = ''
+    substituteInPlace test/capi3c.test \
+      --replace-fail \
+        'if {[clang_sanitize_address]==0} {' \
+        'if {0 && [clang_sanitize_address]==0} {'
+  '';
+
   buildInputs = [
     zlib
   ]
@@ -199,6 +209,9 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = stdenv.hostPlatform.isLinux;
   # When tcl is not available, only run test targets that don't need it.
   checkTarget = lib.optionalString stdenv.hostPlatform.isStatic "fuzztest sourcetest";
+  # Neither GCC's libsanitizer nor compiler-rt's sanitizers are built for
+  # musl, so the fuzzcheck-asan and fuzzcheck-ubsan programs cannot be linked.
+  ${if stdenv.hostPlatform.isMusl then "checkFlags" else null} = [ "TSTRNNR_OPTS=~fuzzcheck-%san" ];
 
   passthru = {
     tests = {
diff --git a/pkgs/development/libraries/tinyxml/2.6.2.nix b/pkgs/development/libraries/tinyxml/2.6.2.nix
index 1d91b57e262c..70524ce15b03 100644
--- a/pkgs/development/libraries/tinyxml/2.6.2.nix
+++ b/pkgs/development/libraries/tinyxml/2.6.2.nix
@@ -91,7 +91,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Simple, small, C++ XML parser that can be easily integrating into other programs";
-    homepage = "http://www.grinninglizard.com/tinyxml/index.html";
+    homepage = "https://sourceforge.net/projects/tinyxml/";
     license = lib.licenses.zlib;
     platforms = lib.platforms.unix;
   };
diff --git a/pkgs/development/php-packages/mongodb/default.nix b/pkgs/development/php-packages/mongodb/default.nix
index 59aa5193a49b..23335da9157d 100644
--- a/pkgs/development/php-packages/mongodb/default.nix
+++ b/pkgs/development/php-packages/mongodb/default.nix
@@ -15,13 +15,13 @@
 
 buildPecl rec {
   pname = "mongodb";
-  version = "2.5.3";
+  version = "2.5.4";
 
   src = fetchFromGitHub {
     owner = "mongodb";
     repo = "mongo-php-driver";
     rev = version;
-    hash = "sha256-zhF1YF/jZpXS0PfVwZ2uDluHY8HTqWhXVa0J1TGo5aA=";
+    hash = "sha256-tBWkKsHDd25E1nIMYOUgKSlzk5OXBkWLUxj29UrjktQ=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/php-packages/phalcon/default.nix b/pkgs/development/php-packages/phalcon/default.nix
index eec3382df576..ad92cb197d3d 100644
--- a/pkgs/development/php-packages/phalcon/default.nix
+++ b/pkgs/development/php-packages/phalcon/default.nix
@@ -9,13 +9,13 @@
 
 buildPecl rec {
   pname = "phalcon";
-  version = "5.10.0";
+  version = "5.22.1";
 
   src = fetchFromGitHub {
     owner = "phalcon";
     repo = "cphalcon";
     rev = "v${version}";
-    hash = "sha256-2dk/AjOWG2oJ3BoBODO9H4S32Jc/Z+W3qxvMkfR5oKE=";
+    hash = "sha256-eMb11feNg7BTEBy+FjQGAqDC0sBfdGqOzr6gLe/LWHY=";
   };
 
   internalDeps = [
diff --git a/pkgs/development/php-packages/phpinsights/default.nix b/pkgs/development/php-packages/phpinsights/default.nix
index 686ffc0ae3a2..5b10af685cf6 100644
--- a/pkgs/development/php-packages/phpinsights/default.nix
+++ b/pkgs/development/php-packages/phpinsights/default.nix
@@ -27,7 +27,7 @@ php.buildComposerProject2 (finalAttrs: {
   meta = {
     changelog = "https://github.com/nunomaduro/phpinsights/releases/tag/v${finalAttrs.version}";
     description = "Instant PHP quality checks from your console";
-    homepage = "https://phpinsights.com/";
+    homepage = "https://github.com/nunomaduro/phpinsights";
     license = lib.licenses.mit;
     mainProgram = "phpinsights";
     teams = [ lib.teams.php ];
diff --git a/pkgs/development/php-packages/wikidiff2/default.nix b/pkgs/development/php-packages/wikidiff2/default.nix
index 295e68783a7f..dd18af029da6 100644
--- a/pkgs/development/php-packages/wikidiff2/default.nix
+++ b/pkgs/development/php-packages/wikidiff2/default.nix
@@ -8,13 +8,13 @@
 
 buildPecl rec {
   pname = "wikidiff2";
-  version = "1.14.1";
+  version = "1.14.2";
 
   src = fetchFromGitHub {
     owner = "wikimedia";
     repo = "mediawiki-php-wikidiff2";
     tag = version;
-    hash = "sha256-UTOfLXv2QWdjThxfrPQDLB8Mqo4js6LzOKXePivdp9k=";
+    hash = "sha256-rBVwqeNioLXOd6Tr2I/Jw8phL7nYsWseYwk+lZDH2tw=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/python-modules/aiounifi/default.nix b/pkgs/development/python-modules/aiounifi/default.nix
index cef82ef59f3b..2407b091051d 100644
--- a/pkgs/development/python-modules/aiounifi/default.nix
+++ b/pkgs/development/python-modules/aiounifi/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aiounifi";
-  version = "96";
+  version = "97";
   pyproject = true;
 
   disabled = pythonOlder "3.13";
@@ -27,7 +27,7 @@ buildPythonPackage (finalAttrs: {
     owner = "Kane610";
     repo = "aiounifi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tDob4Hq78tfVoOZ89cdjmTW34Of0r6Y9c9GtFSCKXqw=";
+    hash = "sha256-dOY+Tps7l/9TybTOzff4DpaA1BvSMYAXDMCySDtX038=";
   };
 
   postPatch = ''
@@ -54,6 +54,8 @@ buildPythonPackage (finalAttrs: {
     trustme
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   pythonImportsCheck = [ "aiounifi" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/aircot/default.nix b/pkgs/development/python-modules/aircot/default.nix
index 7aecb9951168..9f08de388143 100644
--- a/pkgs/development/python-modules/aircot/default.nix
+++ b/pkgs/development/python-modules/aircot/default.nix
@@ -27,7 +27,7 @@ buildPythonPackage (finalAttrs: {
 
   meta = {
     description = "Display Ships in TAK - AIS to TAK Gateway";
-    homepage = "https://aircot.rtfd.io";
+    homepage = "https://aircot.readthedocs.io";
     changelog = "https://github.com/snstac/aircot/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ felbinger ];
diff --git a/pkgs/development/python-modules/apycula/default.nix b/pkgs/development/python-modules/apycula/default.nix
index fda52ff2746b..653cfad7e7c0 100644
--- a/pkgs/development/python-modules/apycula/default.nix
+++ b/pkgs/development/python-modules/apycula/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "apycula";
-  version = "0.33";
+  version = "0.34";
   pyproject = true;
 
   # The Pypi archive contains necessary files generated with proprietary tools.
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-njVvWr8sH2UABEDxvTSDXBuTgaZNIHfphwiHB14IbhY=";
+    hash = "sha256-sLFRh1vlKJ66OF1Mb6YtGzvkkobfcPB+B2ra+RZ4siw=";
   };
 
   build-system = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/asyncua/default.nix b/pkgs/development/python-modules/asyncua/default.nix
index 4641a20d9fba..2d86f5500c52 100644
--- a/pkgs/development/python-modules/asyncua/default.nix
+++ b/pkgs/development/python-modules/asyncua/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "asyncua";
-  version = "2.0.1";
+  version = "2.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "FreeOpcUa";
     repo = "opcua-asyncio";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZbLY6Qu8EikD70ZHLeLz9NMhVGBu65o0CICafuTLOuM=";
+    hash = "sha256-8IyTMKk+cPZZI0m/PW5CvxMSgngmMeQkznT7IlN6Qxs=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/aubio-ledfx/default.nix b/pkgs/development/python-modules/aubio-ledfx/default.nix
index 91a0842961f1..4e90fdbc49ec 100644
--- a/pkgs/development/python-modules/aubio-ledfx/default.nix
+++ b/pkgs/development/python-modules/aubio-ledfx/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aubio-ledfx";
-  version = "0.4.11";
+  version = "0.4.12";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "LedFx";
     repo = "aubio-ledfx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ec6QiTj1AOza+ggJPl3EULNDB/rrpCDZW0HaSywy/4E=";
+    hash = "sha256-g/VdeoQSkq8FB3uWK0A+KME7OCmQTa4gjr7iGDwq0gU=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/autobahn/default.nix b/pkgs/development/python-modules/autobahn/default.nix
index c0c31b346e2e..5b02ba077ad1 100644
--- a/pkgs/development/python-modules/autobahn/default.nix
+++ b/pkgs/development/python-modules/autobahn/default.nix
@@ -142,7 +142,7 @@ buildPythonPackage (finalAttrs: {
 
   meta = {
     description = "WebSocket and WAMP in Python for Twisted and asyncio";
-    homepage = "https://crossbar.io/autobahn";
+    homepage = "https://autobahn.readthedocs.io";
     downloadPage = "https://github.com/crossbario/autobahn-python";
     changelog = "https://github.com/crossbario/autobahn-python/blob/${finalAttrs.src.tag}/docs/changelog.rst";
     license = lib.licenses.mit;
diff --git a/pkgs/development/python-modules/axisregistry/default.nix b/pkgs/development/python-modules/axisregistry/default.nix
index fb955db78325..823d92eded58 100644
--- a/pkgs/development/python-modules/axisregistry/default.nix
+++ b/pkgs/development/python-modules/axisregistry/default.nix
@@ -42,7 +42,7 @@ buildPythonPackage rec {
   meta = {
     description = "Google Fonts registry of OpenType variation axis tags";
     homepage = "https://github.com/googlefonts/axisregistry";
-    changelog = "https://github.com/googlefonts/axisregistry/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/googlefonts/axisregistry/releases/tag/v${version}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       danc86
diff --git a/pkgs/development/python-modules/connect-box/default.nix b/pkgs/development/python-modules/connect-box/default.nix
index f32defffe207..630d68ff3ce9 100644
--- a/pkgs/development/python-modules/connect-box/default.nix
+++ b/pkgs/development/python-modules/connect-box/default.nix
@@ -5,28 +5,28 @@
   buildPythonPackage,
   defusedxml,
   fetchFromGitHub,
+  hatchling,
   pytest-asyncio,
-  pytestCheckHook,
-  setuptools,
   pytest-vcr,
+  pytestCheckHook,
   syrupy,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "connect-box";
-  version = "0.4.0";
+  version = "0.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-ecosystem";
     repo = "python-connect-box";
-    tag = version;
-    hash = "sha256-zUvZRnxVzg9izvUbp7QVcyu6Bw3dUXHOr0kOQRWEZVc=";
+    tag = finalAttrs.version;
+    hash = "sha256-lQfa/GP9XSQJrPBIIR7PZR8F0cmDueTcFDIJTbopRv4=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ hatchling ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiohttp
     attrs
     defusedxml
@@ -41,11 +41,6 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "connect_box" ];
 
-  pytestFlags = [
-    "--vcr-record=none"
-    "-Wignore::DeprecationWarning"
-  ];
-
   meta = {
     description = "Interact with a Compal CH7465LG cable modem/router";
     longDescription = ''
@@ -55,8 +50,8 @@ buildPythonPackage rec {
       Hub 3.0 (IE), Ziggo Connectbox (NL) or Unitymedia Connect Box (DE).
     '';
     homepage = "https://github.com/home-assistant-ecosystem/python-connect-box";
-    changelog = "https://github.com/home-assistant-ecosystem/python-connect-box/releases/tag/${version}";
+    changelog = "https://github.com/home-assistant-ecosystem/python-connect-box/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/cuda-tile/default.nix b/pkgs/development/python-modules/cuda-tile/default.nix
index 639f44217785..a47e2bbf8fd2 100644
--- a/pkgs/development/python-modules/cuda-tile/default.nix
+++ b/pkgs/development/python-modules/cuda-tile/default.nix
@@ -46,6 +46,10 @@ buildPythonPackage.override { stdenv = cudaPackages.backendStdenv; } (finalAttrs
     hash = "sha256-R5V69nJLQ3/1995ezH1/WuueA6cm1vhKZdOECqbwPbU=";
   };
 
+  patches = [
+    ./xla_ffi-include-python-first.patch
+  ];
+
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail "setuptools==80.10.2" "setuptools"
diff --git a/pkgs/development/python-modules/cuda-tile/xla_ffi-include-python-first.patch b/pkgs/development/python-modules/cuda-tile/xla_ffi-include-python-first.patch
new file mode 100644
index 000000000000..dbd23d81d14f
--- /dev/null
+++ b/pkgs/development/python-modules/cuda-tile/xla_ffi-include-python-first.patch
@@ -0,0 +1,21 @@
+Include Python.h before any glibc header in xla_ffi.cpp
+
+g++ defines _GNU_SOURCE, so glibc 2.44's features.h now defines
+_POSIX_C_SOURCE/_XOPEN_SOURCE. xla_ffi.cpp includes c_api.h (-> stdint.h ->
+features.h) before py.h/Python.h, so Python's pyconfig.h then redefines
+those macros, which the project's -Werror turns into a build failure.
+
+Include Python.h first so pyconfig.h sets the macros before features.h,
+which #undefs before redefining them.
+
+--- a/cext/xla_ffi.cpp
++++ b/cext/xla_ffi.cpp
+@@ -2,6 +2,8 @@
+ //
+ // SPDX-License-Identifier: Apache-2.0
+ 
++#include <Python.h>
++
+ #ifdef _WIN32
+ 
+ #include "xla/ffi/api/c_api.h"
diff --git a/pkgs/development/python-modules/datamodeldict/default.nix b/pkgs/development/python-modules/datamodeldict/default.nix
index 1e6a85a5292e..e9480eaddb81 100644
--- a/pkgs/development/python-modules/datamodeldict/default.nix
+++ b/pkgs/development/python-modules/datamodeldict/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "datamodeldict";
-  version = "0.9.10";
+  version = "0.9.11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "usnistgov";
     repo = "DataModelDict";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4tyf3zlzxbtHkvADP+Kmw3/XMugAGi4FNO0qM16m8DU=";
+    hash = "sha256-/wvA/CS3DKuD7kBmzaIvhElkpdEPjRA3UiJUvzCSths=";
   };
 
   build-system = [ uv-build ];
diff --git a/pkgs/development/python-modules/debugpy/hardcode-lldb.patch b/pkgs/development/python-modules/debugpy/hardcode-lldb.patch
index 07c5ff8c7d03..72bc2aaabe51 100644
--- a/pkgs/development/python-modules/debugpy/hardcode-lldb.patch
+++ b/pkgs/development/python-modules/debugpy/hardcode-lldb.patch
@@ -11,3 +11,16 @@ index ba7221fe..24efc1ed 100644
          "--no-lldbinit",  # Do not automatically parse any '.lldbinit' files.
          # '--attach-pid',
          # str(pid),
+diff --git a/tests/debugpy/server/test_add_code_to_python_process.py b/tests/debugpy/server/test_add_code_to_python_process.py
+--- a/tests/debugpy/server/test_add_code_to_python_process.py
++++ b/tests/debugpy/server/test_add_code_to_python_process.py
+@@ -117,8 +117,8 @@ def test_lldb_command(acpp):
+     (cmd,), kwargs = check_call.call_args
+     assert kwargs["shell"]
+ 
+-    assert cmd.startswith("lldb --no-lldbinit --script-language Python ")
++    assert cmd.startswith("@lldb@/bin/lldb --no-lldbinit --script-language Python ")
+     assert "-o 'process attach --pid 4242'" in cmd
+     assert "-o 'command script import \"%s\"'" % (lldb_prepare,) in cmd
+     assert '-o \'load_lib_and_attach "%s" 0 "print(1)" 7\'' % (target_dll,) in cmd
+     assert "-o 'process detach'" in cmd
diff --git a/pkgs/development/python-modules/docloud/default.nix b/pkgs/development/python-modules/docloud/default.nix
index a15fc3ba7255..246b06fad485 100644
--- a/pkgs/development/python-modules/docloud/default.nix
+++ b/pkgs/development/python-modules/docloud/default.nix
@@ -27,7 +27,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "IBM Decision Optimization on Cloud Python client";
-    homepage = "https://onboarding-oaas.docloud.ibmcloud.com/software/analytics/docloud/";
+    homepage = "https://community.ibm.com/community/user/groups/community-home?communitykey=ab7de0fd-6f43-47a9-8261-33578a231bb7";
     license = lib.licenses.asl20;
     maintainers = [ ];
   };
diff --git a/pkgs/development/python-modules/docplex/default.nix b/pkgs/development/python-modules/docplex/default.nix
index f9bf7f9a907c..fee63c378efa 100644
--- a/pkgs/development/python-modules/docplex/default.nix
+++ b/pkgs/development/python-modules/docplex/default.nix
@@ -36,7 +36,7 @@ buildPythonPackage (finalAttrs: {
 
   meta = {
     description = "IBM Decision Optimization CPLEX Modeling for Python";
-    homepage = "https://onboarding-oaas.docloud.ibmcloud.com/software/analytics/docloud/";
+    homepage = "https://ibmdecisionoptimization.github.io/docplex-doc/";
     license = lib.licenses.asl20;
     maintainers = [ ];
   };
diff --git a/pkgs/development/python-modules/dtw-python/default.nix b/pkgs/development/python-modules/dtw-python/default.nix
index c6fb04539644..b55abe826b7b 100644
--- a/pkgs/development/python-modules/dtw-python/default.nix
+++ b/pkgs/development/python-modules/dtw-python/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "dtw-python";
-  version = "1.7.5";
+  version = "1.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "DynamicTimeWarping";
     repo = "dtw-python";
     tag = "v${version}";
-    hash = "sha256-4OP6Fop04HLHURUagLMW4D93zTv9FwAtZ6xyNFbJILA=";
+    hash = "sha256-H0eYRS8cMz8pTRm4pmSX8RPkTxC7uMGArxTsmbSsL2E=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/esp-pylib/default.nix b/pkgs/development/python-modules/esp-pylib/default.nix
index 0db9a8f014a6..f15d9bb786aa 100644
--- a/pkgs/development/python-modules/esp-pylib/default.nix
+++ b/pkgs/development/python-modules/esp-pylib/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "esp-pylib";
-  version = "1.1.5";
+  version = "1.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "espressif";
     repo = "esp-pylib";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-omkTO5a8aqAoYqp0W3KaW2P/O8KJYeYZ51uGcOIPQew=";
+    hash = "sha256-wj9Enkaxj6LlNfJlmditKFZ8lKfVq9SbQg8f5xIyXP8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/faker/default.nix b/pkgs/development/python-modules/faker/default.nix
index a1b4270087bd..afb5dee4c3c8 100644
--- a/pkgs/development/python-modules/faker/default.nix
+++ b/pkgs/development/python-modules/faker/default.nix
@@ -46,7 +46,7 @@ buildPythonPackage rec {
   meta = {
     description = "Python library for generating fake user data";
     mainProgram = "faker";
-    homepage = "http://faker.rtfd.org";
+    homepage = "https://faker.readthedocs.io";
     license = lib.licenses.mit;
     maintainers = [ ];
   };
diff --git a/pkgs/development/python-modules/fastjet/default.nix b/pkgs/development/python-modules/fastjet/default.nix
index b74816bc1269..6fe940ed4b32 100644
--- a/pkgs/development/python-modules/fastjet/default.nix
+++ b/pkgs/development/python-modules/fastjet/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "fastjet";
-  version = "3.5.1.4";
+  version = "3.5.2.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -33,7 +33,7 @@ buildPythonPackage (finalAttrs: {
     repo = "fastjet";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-Q2ukR7aA12d0+mRm/y8hAMpOo3vRkFo3B/fx6XChARI=";
+    hash = "sha256-uR7HK00s3uuojJ2x5LmNhvJHJ+umCOua4SUXafH0NEk=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/firebase-admin/default.nix b/pkgs/development/python-modules/firebase-admin/default.nix
index 8e95d23de5af..e089a99e1794 100644
--- a/pkgs/development/python-modules/firebase-admin/default.nix
+++ b/pkgs/development/python-modules/firebase-admin/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "firebase-admin";
-  version = "7.6.0";
+  version = "7.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "firebase";
     repo = "firebase-admin-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-y+7EXenVmBfd1IDBRzen1tNiralQkVQPadXmhY1N03k=";
+    hash = "sha256-epAACgTYIe4hgWXgXgKGjDwpMrhxVS3Kml8s/Ij4P5Y=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/firecrawl-anydoc/default.nix b/pkgs/development/python-modules/firecrawl-anydoc/default.nix
new file mode 100644
index 000000000000..165df6bfd403
--- /dev/null
+++ b/pkgs/development/python-modules/firecrawl-anydoc/default.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  rustPlatform,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "firecrawl-anydoc";
+  version = "0.2.4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "firecrawl";
+    repo = "anydoc";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-rGv3Bh+zmF9xFUgf8RaSmfyB/gfuQ13iC389i6VZIlM=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/python";
+
+  nativeBuildInputs = with rustPlatform; [
+    cargoSetupHook
+    maturinBuildHook
+  ];
+
+  # The workspace root is outside of `sourceRoot`, hence not writable
+  env.CARGO_TARGET_DIR = "./target";
+
+  cargoRoot = "..";
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      cargoRoot
+      sourceRoot
+      ;
+    hash = "sha256-yhW5HSzVrZCms4x36J2NGIn1e5YLIgjuNKXM9EJ9J8c=";
+  };
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  preCheck = ''
+    rm -r anydoc/
+  '';
+
+  __darwinAllowLocalNetworking = true;
+
+  meta = {
+    description = "Convert documents (doc, docx, odt, rtf, epub, pdf, presentations, spreadsheets, csv) to GitHub-Flavored Markdown";
+    changelog = "https://github.com/firecrawl/anydoc/releases/tag/${finalAttrs.src.tag}";
+    homepage = "https://github.com/firecrawl/anydoc";
+    maintainers = with lib.maintainers; [ SuperSandro2000 ];
+    license = lib.licenses.mit;
+  };
+})
diff --git a/pkgs/development/python-modules/formencode/default.nix b/pkgs/development/python-modules/formencode/default.nix
index 71625b5d7ba3..2644a08942f1 100644
--- a/pkgs/development/python-modules/formencode/default.nix
+++ b/pkgs/development/python-modules/formencode/default.nix
@@ -45,7 +45,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "FormEncode validates and converts nested structures";
-    homepage = "http://formencode.org";
+    homepage = "https://www.formencode.org";
     license = lib.licenses.mit;
     maintainers = [ ];
   };
diff --git a/pkgs/development/python-modules/freenub/default.nix b/pkgs/development/python-modules/freenub/default.nix
index ee075de2559b..b7aa4ed9d85e 100644
--- a/pkgs/development/python-modules/freenub/default.nix
+++ b/pkgs/development/python-modules/freenub/default.nix
@@ -14,16 +14,16 @@
   requests,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "freenub";
-  version = "0.1.0";
+  version = "0.1.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bdraco";
     repo = "freenub";
-    tag = "v${version}";
-    hash = "sha256-UkW/7KUQ4uCu3cxDSL+kw0gjKjs4KnmxRIOLVP4hwyA=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-2yUuopr7sT2FvsiXlHnc7AnXcCAAEAyD0Rpc4j/nGmQ=";
   };
 
   build-system = [ poetry-core ];
@@ -50,8 +50,8 @@ buildPythonPackage rec {
   meta = {
     description = "Fork of pubnub";
     homepage = "https://github.com/bdraco/freenub";
-    changelog = "https://github.com/bdraco/freenub/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/bdraco/freenub/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/google-cloud-network-connectivity/default.nix b/pkgs/development/python-modules/google-cloud-network-connectivity/default.nix
index e373320d3ce4..faf368c67323 100644
--- a/pkgs/development/python-modules/google-cloud-network-connectivity/default.nix
+++ b/pkgs/development/python-modules/google-cloud-network-connectivity/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "google-cloud-network-connectivity";
-  version = "2.17.0";
+  version = "2.18.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) version;
     pname = "google_cloud_network_connectivity";
-    hash = "sha256-L7sJtKXR7CTeFnCn5DzmlFxvZRnyHYDsA8ESuXJ2rmM=";
+    hash = "sha256-YNYELqtjHDzKQ8HA9w5G+iZSuxqoh+35c+cop7O8/O0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-resource-manager/default.nix b/pkgs/development/python-modules/google-cloud-resource-manager/default.nix
index 1724591a76f9..f19ffc2c3f85 100644
--- a/pkgs/development/python-modules/google-cloud-resource-manager/default.nix
+++ b/pkgs/development/python-modules/google-cloud-resource-manager/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "google-cloud-resource-manager";
-  version = "1.18.0";
+  version = "1.19.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_resource_manager";
     inherit (finalAttrs) version;
-    hash = "sha256-22ifgAoUxm0EEZan+7i7iq6NyH8owpKeEBpex2axVRI=";
+    hash = "sha256-aOXSjtkJGrGt8Ep3h2sJ1VPpekQPungWP2zitf5fJVg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-tasks/default.nix b/pkgs/development/python-modules/google-cloud-tasks/default.nix
index ab5c98271127..42703a4cb7a0 100644
--- a/pkgs/development/python-modules/google-cloud-tasks/default.nix
+++ b/pkgs/development/python-modules/google-cloud-tasks/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-tasks";
-  version = "2.25.0";
+  version = "2.26.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_tasks";
     inherit version;
-    hash = "sha256-UeG5GBiSUSTD73KAGbFA8NSlBo2HHw8noXxtqAMy8eQ=";
+    hash = "sha256-3zO+V0EcV715FGHQu81tBLTg5V+cZbaGgnBsrSR8WwY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-trace/default.nix b/pkgs/development/python-modules/google-cloud-trace/default.nix
index 0166e8e10dfc..d606457365f7 100644
--- a/pkgs/development/python-modules/google-cloud-trace/default.nix
+++ b/pkgs/development/python-modules/google-cloud-trace/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-trace";
-  version = "1.20.0";
+  version = "1.21.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_trace";
     inherit version;
-    hash = "sha256-9ab5uNpTC3bEUhY7g+UIHBaW8bT2cpDIeLDnNw8ekQo=";
+    hash = "sha256-Xg4CtR253vC+0vg2J/pQQ6juzQDkd6f7mNHgTDGnE8A=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-workflows/default.nix b/pkgs/development/python-modules/google-cloud-workflows/default.nix
index 5c147f3c176b..f99d6157c706 100644
--- a/pkgs/development/python-modules/google-cloud-workflows/default.nix
+++ b/pkgs/development/python-modules/google-cloud-workflows/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "google-cloud-workflows";
-  version = "1.23.0";
+  version = "1.24.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_workflows";
     inherit (finalAttrs) version;
-    hash = "sha256-vo4IpdE0GG2834Z8BbFZrYrH3jtkJbIb76q39PJY1Kg=";
+    hash = "sha256-AP3XgkAq8gqoI9gargPd+JSxu3YcfZTLsqkQWaBthCI=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/helper/default.nix b/pkgs/development/python-modules/helper/default.nix
index 12cdd3ac1d15..2ebf33e32ae6 100644
--- a/pkgs/development/python-modules/helper/default.nix
+++ b/pkgs/development/python-modules/helper/default.nix
@@ -33,7 +33,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "Development library for quickly writing configurable applications and daemons";
-    homepage = "https://helper.readthedocs.org/";
+    homepage = "https://github.com/gmr/helper";
     license = lib.licenses.bsd3;
   };
 }
diff --git a/pkgs/development/python-modules/hsaudiotag3k/default.nix b/pkgs/development/python-modules/hsaudiotag3k/default.nix
index 0b56ee91e224..a0ab3f77d2b6 100644
--- a/pkgs/development/python-modules/hsaudiotag3k/default.nix
+++ b/pkgs/development/python-modules/hsaudiotag3k/default.nix
@@ -21,7 +21,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "Pure Python library that lets one to read metadata from media files";
-    homepage = "http://hg.hardcoded.net/hsaudiotag/";
+    homepage = "https://github.com/chrrrisw/hsaudiotag";
     license = lib.licenses.bsd3;
   };
 }
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index a3beb2d06cda..5807aa3e334a 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202610101";
+  version = "0.1.202610111";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NVC45Tp53PqZ8oiiaf9OfKP3TP5UNjubhI0HktImLvk=";
+    hash = "sha256-RihrWdIJBURHdgSWjUEXysuA4JOza7z1gISvbnW7JDo=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix b/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
index 95e3642d9361..df519540468f 100644
--- a/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
+++ b/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ibm-cloud-sdk-core";
-  version = "3.26.2";
+  version = "3.28.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "IBM";
     repo = "python-sdk-core";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-i3j4E8egDjO8sJt3wLn4ZyJH8jS0BF8y5LY0iEhJpLo=";
+    hash = "sha256-kqpoV65z4lr+VGZJDL0hQsQ5oWpdFSJBISxDtl75KH4=";
   };
 
   pythonRelaxDeps = [ "requests" ];
diff --git a/pkgs/development/python-modules/ida-domain/default.nix b/pkgs/development/python-modules/ida-domain/default.nix
index 3574a4ee0c93..f23b15c7fcd3 100644
--- a/pkgs/development/python-modules/ida-domain/default.nix
+++ b/pkgs/development/python-modules/ida-domain/default.nix
@@ -3,19 +3,19 @@
   buildPythonPackage,
   fetchFromGitHub,
   graphviz,
+  hatchling,
   idapro,
   nix-update-script,
   packaging,
   pytest-cov-stub,
   pytestCheckHook,
-  setuptools,
   typing-extensions,
   writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "ida-domain";
-  version = "0.5.0";
+  version = "0.5.1";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -24,10 +24,10 @@ buildPythonPackage (finalAttrs: {
     owner = "HexRaysSA";
     repo = "ida-domain";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oa3VQgWDEr4tPQ166EugfS7QrW1DlRb/hwypwKP+Xv4=";
+    hash = "sha256-vlVJnRaRNMelQ3w1SgCDvtIQJKBuULLOqKKdAvDK2y4=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ hatchling ];
 
   dependencies = [
     idapro
diff --git a/pkgs/development/python-modules/ida-hcli/default.nix b/pkgs/development/python-modules/ida-hcli/default.nix
index a8ffdb60c9ec..fde793025e70 100644
--- a/pkgs/development/python-modules/ida-hcli/default.nix
+++ b/pkgs/development/python-modules/ida-hcli/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ida-hcli";
-  version = "0.18.5";
+  version = "0.21.0";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -36,7 +36,7 @@ buildPythonPackage (finalAttrs: {
     owner = "HexRaysSA";
     repo = "ida-hcli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-n8hLgVgxqaU7Au6HVgOEUKOm1LV3Wx/v42gi2gOD3Jk=";
+    hash = "sha256-GCR+DcZ3RZevfS2OO44LpkiQ7Fk1WtZpivLh2VONbHg=";
   };
 
   build-system = [ setuptools ];
@@ -73,7 +73,6 @@ buildPythonPackage (finalAttrs: {
     "tests/integration/"
     "tests/lib/test_ida_python.py"
     "tests/lib/test_ida.py"
-    "tests/lib/test_plugin_bundle_install.py"
     "tests/lib/test_plugin_collisions.py"
     "tests/lib/test_plugin_install.py"
     "tests/lib/test_plugin_records.py"
diff --git a/pkgs/development/python-modules/keystone-engine/default.nix b/pkgs/development/python-modules/keystone-engine/default.nix
index a9d537cbc8c1..45dacca71297 100644
--- a/pkgs/development/python-modules/keystone-engine/default.nix
+++ b/pkgs/development/python-modules/keystone-engine/default.nix
@@ -40,7 +40,7 @@ buildPythonPackage (finalAttrs: {
 
   meta = {
     description = "Lightweight multi-platform, multi-architecture assembler framework";
-    homepage = "https://www.keystone-engine.org";
+    homepage = "https://github.com/keystone-engine/keystone";
     maintainers = with lib.maintainers; [ dump_stack ];
     license = lib.licenses.gpl2Only;
   };
diff --git a/pkgs/development/python-modules/kuzu/default.nix b/pkgs/development/python-modules/kuzu/default.nix
index 106e14d3313d..4f787daea054 100644
--- a/pkgs/development/python-modules/kuzu/default.nix
+++ b/pkgs/development/python-modules/kuzu/default.nix
@@ -28,7 +28,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "Python bindings for Kuzu, an embeddable property graph database management system";
-    homepage = "https://kuzudb.com/";
+    homepage = "https://github.com/kuzudb/kuzu";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ sdht0 ];
   };
diff --git a/pkgs/development/python-modules/langchain-huggingface/default.nix b/pkgs/development/python-modules/langchain-huggingface/default.nix
index c2e9cd8c0ec2..8d8bd5fb1c43 100644
--- a/pkgs/development/python-modules/langchain-huggingface/default.nix
+++ b/pkgs/development/python-modules/langchain-huggingface/default.nix
@@ -33,7 +33,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langchain-huggingface";
-  version = "1.2.2";
+  version = "1.2.3";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -41,7 +41,7 @@ buildPythonPackage (finalAttrs: {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-huggingface==${finalAttrs.version}";
-    hash = "sha256-jMbFqui0XoKZ15B+5kJAamW5Dasv/JCIZS2KtteRBXg=";
+    hash = "sha256-muibdSyBybUR1YTVsWr00mg0uSgUm2zwKRM3KU9Ju38=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/partners/huggingface";
diff --git a/pkgs/development/python-modules/leather/default.nix b/pkgs/development/python-modules/leather/default.nix
index bec3ea53e10a..dcb9b22fb9a0 100644
--- a/pkgs/development/python-modules/leather/default.nix
+++ b/pkgs/development/python-modules/leather/default.nix
@@ -27,7 +27,7 @@ buildPythonPackage rec {
   ];
 
   meta = {
-    homepage = "http://leather.rtfd.io";
+    homepage = "https://leather.readthedocs.io";
     description = "Python charting library";
     license = lib.licenses.mit;
     platforms = lib.platforms.all;
diff --git a/pkgs/development/python-modules/lg-rs232-tv/default.nix b/pkgs/development/python-modules/lg-rs232-tv/default.nix
index ee78cae64c73..2d871e34cb58 100644
--- a/pkgs/development/python-modules/lg-rs232-tv/default.nix
+++ b/pkgs/development/python-modules/lg-rs232-tv/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "lg-rs232-tv";
-  version = "1.2.0";
+  version = "1.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = "lg-rs232-tv";
     tag = finalAttrs.version;
-    hash = "sha256-gMjRyZ/gUMAsS0v465ISD38YAlrOB8N/5VAFZkXtyAE=";
+    hash = "sha256-dnXu5UVqUlKMQTBOsFDa/9Jco2OR07UDR1yhWKftQ4o=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/lizard/default.nix b/pkgs/development/python-modules/lizard/default.nix
index 9f3447e0ecb1..145b063c40fe 100644
--- a/pkgs/development/python-modules/lizard/default.nix
+++ b/pkgs/development/python-modules/lizard/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "lizard";
-  version = "1.24.0";
+  version = "1.24.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "terryyin";
     repo = "lizard";
     tag = finalAttrs.version;
-    hash = "sha256-npxnl9QrsAMLgrSDGsmWTb17VLwJ9sYCi9dhROCblhg=";
+    hash = "sha256-vVnk/GMPiLwnFiRD8IA08u5zS2f85cTcbQTPUnc58f4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/meinheld/default.nix b/pkgs/development/python-modules/meinheld/default.nix
index fa0b6fccec7b..62781ee9b265 100644
--- a/pkgs/development/python-modules/meinheld/default.nix
+++ b/pkgs/development/python-modules/meinheld/default.nix
@@ -35,7 +35,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "High performance asynchronous Python WSGI Web Server";
-    homepage = "https://meinheld.org/";
+    homepage = "https://github.com/mopemope/meinheld";
     license = lib.licenses.bsd3;
   };
 }
diff --git a/pkgs/development/python-modules/minichain/default.nix b/pkgs/development/python-modules/minichain/default.nix
index 58475976b568..d651e9587a2f 100644
--- a/pkgs/development/python-modules/minichain/default.nix
+++ b/pkgs/development/python-modules/minichain/default.nix
@@ -63,7 +63,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "Tiny library for coding with large language models";
-    homepage = "https://srush-minichain.hf.space";
+    homepage = "https://github.com/srush/MiniChain";
     changelog = "https://github.com/srush/MiniChain/releases/tag/v${version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ samuela ];
diff --git a/pkgs/development/python-modules/mlflow-skinny/default.nix b/pkgs/development/python-modules/mlflow-skinny/default.nix
index 81bf46519e69..c13ec54236e4 100644
--- a/pkgs/development/python-modules/mlflow-skinny/default.nix
+++ b/pkgs/development/python-modules/mlflow-skinny/default.nix
@@ -41,7 +41,7 @@ buildPythonPackage (finalAttrs: {
     owner = "mlflow";
     repo = "mlflow";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gJzEKig5txbfi17AikC2ecdSJMaSoAb9ATIIZuVXkMw=";
+    hash = "sha256-uEvUfr1PM1BAMgvQ6Q6IVjZd0q40ZUXqhojlDUB3tvQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/mlflow-tracing/default.nix b/pkgs/development/python-modules/mlflow-tracing/default.nix
index 471bac86d607..b674dfbcbc2b 100644
--- a/pkgs/development/python-modules/mlflow-tracing/default.nix
+++ b/pkgs/development/python-modules/mlflow-tracing/default.nix
@@ -27,7 +27,7 @@ buildPythonPackage (finalAttrs: {
     owner = "mlflow";
     repo = "mlflow";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gJzEKig5txbfi17AikC2ecdSJMaSoAb9ATIIZuVXkMw=";
+    hash = "sha256-uEvUfr1PM1BAMgvQ6Q6IVjZd0q40ZUXqhojlDUB3tvQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/mlflow/default.nix b/pkgs/development/python-modules/mlflow/default.nix
index e921d5d535a9..42f172da219f 100644
--- a/pkgs/development/python-modules/mlflow/default.nix
+++ b/pkgs/development/python-modules/mlflow/default.nix
@@ -28,7 +28,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "mlflow";
-  version = "3.16.1";
+  version = "3.17.0";
   format = "wheel";
   __structuredAttrs = true;
 
@@ -40,7 +40,7 @@ buildPythonPackage (finalAttrs: {
     format = "wheel";
     dist = "py3";
     python = "py3";
-    hash = "sha256-5N/mnOrjHfx7hIDnb/5qfzZ1K9+sMOBY5kMK3h+1kgs=";
+    hash = "sha256-OVTqqZjU3UrIdyiUKTooW7XjpCj2+bN8rCmOeHQj6v0=";
   };
 
   # Nix-wrapped python populates sys.path via NIX_PYTHONPATH/site hooks,
diff --git a/pkgs/development/python-modules/monai-deploy/default.nix b/pkgs/development/python-modules/monai-deploy/default.nix
index a32d6ae8918a..600990c760ad 100644
--- a/pkgs/development/python-modules/monai-deploy/default.nix
+++ b/pkgs/development/python-modules/monai-deploy/default.nix
@@ -66,7 +66,7 @@ buildPythonPackage rec {
   meta = {
     description = "Framework and tools to design, develop and verify AI applications in healthcare imaging";
     mainProgram = "monai-deploy";
-    homepage = "https://monai.io/deploy.html";
+    homepage = "https://github.com/Project-MONAI/monai-deploy-app-sdk";
     changelog = "https://github.com/Project-MONAI/monai-deploy-app-sdk/blob/main/docs/source/release_notes/${src.tag}.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ bcdarwin ];
diff --git a/pkgs/development/python-modules/nextdns/default.nix b/pkgs/development/python-modules/nextdns/default.nix
index 855af2b44075..8bd3042bb59c 100644
--- a/pkgs/development/python-modules/nextdns/default.nix
+++ b/pkgs/development/python-modules/nextdns/default.nix
@@ -26,12 +26,10 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-+ih7QHmtQmWsi6HZZ3xepYBDYlCOyMKo0pQtr6oXpFs=";
   };
 
-  nativeBuildInputs = [
-    pyprojectVersionPatchHook
-  ];
-
   build-system = [ setuptools ];
 
+  nativeBuildInputs = [ pyprojectVersionPatchHook ];
+
   dependencies = [
     aiohttp
     tenacity
@@ -46,6 +44,11 @@ buildPythonPackage (finalAttrs: {
     syrupy_6
   ];
 
+  disabledTests = [
+    # Test is outdated
+    "test_valid_data"
+  ];
+
   pythonImportsCheck = [ "nextdns" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/nvidia-ml-py/default.nix b/pkgs/development/python-modules/nvidia-ml-py/default.nix
index abe4a675a1ca..9afbab7bf7cd 100644
--- a/pkgs/development/python-modules/nvidia-ml-py/default.nix
+++ b/pkgs/development/python-modules/nvidia-ml-py/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "nvidia-ml-py";
-  version = "13.610.43";
+  version = "13.615.71";
   pyproject = true;
   __structuredAttrs = true;
 
   src = fetchPypi {
     pname = "nvidia_ml_py";
     inherit (finalAttrs) version;
-    hash = "sha256-ZUN+tz1o0MYskxyk1FA4Ry+v8DvQuHKau6S4mfcNYPI=";
+    hash = "sha256-vr5OSPUbHcdQKMCBXLe/oUoxpbuAvnDJ2YDGA2lT/D0=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/odp-amsterdam/default.nix b/pkgs/development/python-modules/odp-amsterdam/default.nix
index f152a50c2819..460d9fa17734 100644
--- a/pkgs/development/python-modules/odp-amsterdam/default.nix
+++ b/pkgs/development/python-modules/odp-amsterdam/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "odp-amsterdam";
-  version = "7.1.0";
+  version = "7.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "klaasnicolaas";
     repo = "python-odp-amsterdam";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YUO8L40FjqjdDWLcmDldQ+5hkdVgBQHvAhd1rBTfDLg=";
+    hash = "sha256-aK6BGOkkHdKkiojg56qxkyZklpdstQWNzaTLM1s8//s=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pexif/default.nix b/pkgs/development/python-modules/pexif/default.nix
index 7deb1e0c22e7..e5b1970b4fe3 100644
--- a/pkgs/development/python-modules/pexif/default.nix
+++ b/pkgs/development/python-modules/pexif/default.nix
@@ -16,7 +16,7 @@ buildPythonPackage (finalAttrs: {
 
   meta = {
     description = "Module for editing JPEG EXIF data";
-    homepage = "http://www.benno.id.au/code/pexif/";
+    homepage = "https://github.com/bennoleslie/pexif";
     license = lib.licenses.mit;
   };
 })
diff --git a/pkgs/development/python-modules/potr/default.nix b/pkgs/development/python-modules/potr/default.nix
index 50a0a1e6d3fc..7614880eae9f 100644
--- a/pkgs/development/python-modules/potr/default.nix
+++ b/pkgs/development/python-modules/potr/default.nix
@@ -19,7 +19,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "Pure Python OTR implementation";
-    homepage = "http://python-otr.pentabarf.de/";
+    homepage = "https://github.com/python-otr/pure-python-otr";
     license = lib.licenses.lgpl3Plus;
     maintainers = [ ];
   };
diff --git a/pkgs/development/python-modules/publicsuffixlist/default.nix b/pkgs/development/python-modules/publicsuffixlist/default.nix
index 15fa35bb6edf..864ec61af74d 100644
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@@ -2,21 +2,21 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  hatchling,
   pandoc,
+  publicsuffix-list,
   pytestCheckHook,
   requests,
-  setuptools,
-  publicsuffix-list,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "publicsuffixlist";
-  version = "1.0.2.20261007";
+  version = "1.1.0.20261010";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-TxvtwsLFzEsLYLJwxXnUdcdYDmRB0mLR/Pxi89RaWOA=";
+    hash = "sha256-Hr1Mntreimyb0BmVpvnmciCUjcpYebH9SKVly0Kdmus=";
   };
 
   postPatch = ''
@@ -24,7 +24,7 @@ buildPythonPackage (finalAttrs: {
     ln -s ${publicsuffix-list}/share/publicsuffix/public_suffix_list.dat publicsuffixlist/public_suffix_list.dat
   '';
 
-  build-system = [ setuptools ];
+  build-system = [ hatchling ];
 
   optional-dependencies = {
     update = [ requests ];
diff --git a/pkgs/development/python-modules/pycrdt/Cargo.lock b/pkgs/development/python-modules/pycrdt/Cargo.lock
index 544a494e48e8..0e9d520932e8 100644
--- a/pkgs/development/python-modules/pycrdt/Cargo.lock
+++ b/pkgs/development/python-modules/pycrdt/Cargo.lock
@@ -30,7 +30,7 @@ checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.6",
+ "syn 3.0.7",
 ]
 
 [[package]]
@@ -149,9 +149,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.189"
+version = "0.2.190"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
 
 [[package]]
 name = "lock_api"
@@ -216,7 +216,7 @@ dependencies = [
 
 [[package]]
 name = "pycrdt"
-version = "0.14.6"
+version = "0.14.8"
 dependencies = [
  "futures-task",
  "pyo3",
@@ -227,9 +227,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3"
-version = "0.29.2"
+version = "0.29.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4688ddedf473e32662b9b067670129a8afb8c18e351482c70d62ba4a88171e8b"
+checksum = "700d18fa267b73b9b521fd7e13580e2f446916f176cacee1ab63fcc8191f1655"
 dependencies = [
  "libc",
  "once_cell",
@@ -241,18 +241,18 @@ dependencies = [
 
 [[package]]
 name = "pyo3-build-config"
-version = "0.29.2"
+version = "0.29.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f41027e41b4bd03f6e60f9f417fe24a6341a6bb744edd62b6f709f2a52ea30e9"
+checksum = "7b3fc0c4d08f6bb10e71fe39dfb9e2f59c6eb6854e22ec8092f50c69a4499adb"
 dependencies = [
  "target-lexicon",
 ]
 
 [[package]]
 name = "pyo3-ffi"
-version = "0.29.2"
+version = "0.29.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e591a95526fead067432c3b3a33fc74770b87b1e04e73671090d9c2055a2b327"
+checksum = "dfc0b8e19df29aad7086cf977bb0c2a2f143e30567eb113e9cf72b62ca698330"
 dependencies = [
  "libc",
  "pyo3-build-config",
@@ -260,9 +260,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros"
-version = "0.29.2"
+version = "0.29.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73225868fc1cd84eef2c3c230ddb91273bf1de46aeb8a4248da76d32a0924a1c"
+checksum = "6100e8a4b5eba53afaa5ed078364851a0b2499c553a44c31026b929049b49dc6"
 dependencies = [
  "proc-macro2",
  "pyo3-macros-backend",
@@ -272,9 +272,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros-backend"
-version = "0.29.2"
+version = "0.29.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "571575aa3749fa6216757dd47d2a3e7ef360f329a40f0666a9fbd14889024952"
+checksum = "6143877a16e82b5a727b7127ff4cd86858a24a28d745d72f43e6f227c7b1bdb3"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -345,14 +345,14 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.6",
+ "syn 3.0.7",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.151"
+version = "1.0.152"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+checksum = "1741ab7a6cc54a03a89b5d563ed60075c277d9e3cfa73ad0c1f23f23974703c6"
 dependencies = [
  "itoa",
  "memchr",
@@ -372,9 +372,9 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.16.2"
+version = "1.16.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9395f0f0eee849a9b707b2f06bb92a6a422090e2123bb2ef8e87a0e61892a8e"
+checksum = "5b3dc8af474f516a851ff4bd12db780f948b9250ad37211e4eec0bccea54e01b"
 
 [[package]]
 name = "syn"
@@ -389,9 +389,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "3.0.6"
+version = "3.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee"
+checksum = "d62a2e0561533f2ca2561d0cf27fd9fedb640a1bf2616ff5d5c80d99017faadc"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -421,7 +421,7 @@ checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.6",
+ "syn 3.0.7",
 ]
 
 [[package]]
@@ -462,7 +462,7 @@ dependencies = [
  "bumpalo",
  "proc-macro2",
  "quote",
- "syn 3.0.6",
+ "syn 3.0.7",
  "wasm-bindgen-shared",
 ]
 
@@ -483,9 +483,9 @@ checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
 [[package]]
 name = "yrs"
-version = "0.27.4"
+version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3987db9bdbe6f0f49c58ec3d0daf4750a70b40019c190f6c6708abfcdfe6bea0"
+checksum = "52c70dc8beca8666c77612a96889106ca3cd65318609721f464624ff79685da9"
 dependencies = [
  "arc-swap",
  "async-lock",
diff --git a/pkgs/development/python-modules/pycrdt/default.nix b/pkgs/development/python-modules/pycrdt/default.nix
index ab82b6f75bf4..6fda103349a0 100644
--- a/pkgs/development/python-modules/pycrdt/default.nix
+++ b/pkgs/development/python-modules/pycrdt/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pycrdt";
-  version = "0.14.6";
+  version = "0.14.8";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -28,7 +28,7 @@ buildPythonPackage (finalAttrs: {
     owner = "y-crdt";
     repo = "pycrdt";
     tag = finalAttrs.version;
-    hash = "sha256-gO1QReYcrsCJLkCLPt0ihydPjAarJlYnISZG6NfMj6o=";
+    hash = "sha256-HnmufoV91CA/036BkTGo62je7cKFDytrU6FgVjI/dEI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pycurl/default.nix b/pkgs/development/python-modules/pycurl/default.nix
index c7c32e9e20d3..2ec4c2da4391 100644
--- a/pkgs/development/python-modules/pycurl/default.nix
+++ b/pkgs/development/python-modules/pycurl/default.nix
@@ -98,7 +98,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "Python Interface To The cURL library";
-    homepage = "http://pycurl.io/";
+    homepage = "https://pycurl.github.io/";
     changelog =
       "https://github.com/pycurl/pycurl/blob/REL_"
       + lib.replaceStrings [ "." ] [ "_" ] version
diff --git a/pkgs/development/python-modules/pyfakefs/default.nix b/pkgs/development/python-modules/pyfakefs/default.nix
index 16ae4ce87ead..3b8eeb90130e 100644
--- a/pkgs/development/python-modules/pyfakefs/default.nix
+++ b/pkgs/development/python-modules/pyfakefs/default.nix
@@ -60,7 +60,7 @@ let
 
     meta = {
       description = "Fake file system that mocks the Python file system modules";
-      homepage = "https://pyfakefs.org/";
+      homepage = "https://pytest-pyfakefs.readthedocs.io";
       changelog = "https://github.com/jmcgeheeiv/pyfakefs/blob/v${finalAttrs.version}/CHANGES.md";
       license = lib.licenses.asl20;
       maintainers = [ ];
diff --git a/pkgs/development/python-modules/pygal/default.nix b/pkgs/development/python-modules/pygal/default.nix
index d394c200ffd9..503b3d2fc833 100644
--- a/pkgs/development/python-modules/pygal/default.nix
+++ b/pkgs/development/python-modules/pygal/default.nix
@@ -64,7 +64,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "Module for dynamic SVG charting";
-    homepage = "http://www.pygal.org";
+    homepage = "https://www.pygal.org";
     changelog = "https://github.com/Kozea/pygal/blob/${version}/docs/changelog.rst";
     downloadPage = "https://github.com/Kozea/pygal";
     license = lib.licenses.lgpl3Plus;
diff --git a/pkgs/development/python-modules/pygame-original/default.nix b/pkgs/development/python-modules/pygame-original/default.nix
index f3c18549dfc7..34e95a42fbf4 100644
--- a/pkgs/development/python-modules/pygame-original/default.nix
+++ b/pkgs/development/python-modules/pygame-original/default.nix
@@ -132,7 +132,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "Python library for games (original distribution)";
-    homepage = "https://www.pygame.org/";
+    homepage = "https://github.com/pygame/pygame";
     changelog = "https://github.com/pygame/pygame/releases/tag/${src.tag}";
     license = lib.licenses.lgpl21Plus;
     maintainers = with lib.maintainers; [ emilytrau ];
diff --git a/pkgs/development/python-modules/pykka/default.nix b/pkgs/development/python-modules/pykka/default.nix
index 96b37163576f..f181052353f1 100644
--- a/pkgs/development/python-modules/pykka/default.nix
+++ b/pkgs/development/python-modules/pykka/default.nix
@@ -31,7 +31,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "pykka" ];
 
   meta = {
-    homepage = "https://www.pykka.org/";
+    homepage = "https://pykka.readthedocs.io/";
     description = "Python implementation of the actor model";
     changelog = "https://github.com/jodal/pykka/releases/tag/${src.tag}";
     maintainers = [ ];
diff --git a/pkgs/development/python-modules/pyowm/default.nix b/pkgs/development/python-modules/pyowm/default.nix
index 3f0ca9fbd483..118f39a49c2f 100644
--- a/pkgs/development/python-modules/pyowm/default.nix
+++ b/pkgs/development/python-modules/pyowm/default.nix
@@ -9,7 +9,7 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pyowm";
   version = "3.5.0";
   pyproject = true;
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "csparpa";
     repo = "pyowm";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-D1Cl3uWoEIUqA0R+bjRL2YgsVKj5inuBAVLJYluADg0=";
   };
 
@@ -29,7 +29,6 @@ buildPythonPackage rec {
     geojson
     pysocks
     requests
-    setuptools
   ];
 
   nativeCheckInputs = [ pytestCheckHook ];
@@ -42,8 +41,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python wrapper around the OpenWeatherMap web API";
     homepage = "https://pyowm.readthedocs.io/";
-    changelog = "https://github.com/csparpa/pyowm/releases/tag/${version}";
+    changelog = "https://github.com/csparpa/pyowm/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/pypdfium2/default.nix b/pkgs/development/python-modules/pypdfium2/default.nix
index 1afeb15d1181..fbeaa7e823e9 100644
--- a/pkgs/development/python-modules/pypdfium2/default.nix
+++ b/pkgs/development/python-modules/pypdfium2/default.nix
@@ -3,54 +3,59 @@
   lib,
   pkgsCross,
   buildPythonPackage,
+  common-updater-scripts,
+  coreutils,
+  curl,
+  diffutils,
   fetchFromGitHub,
-  gitUpdater,
-  setuptools-scm,
+  gnutar,
+  gzip,
+  jq,
+  nix,
+  nix-update,
+  packaging,
+  setuptools,
   pdfium,
   numpy,
   pillow,
   pytestCheckHook,
   removeReferencesTo,
   python,
+  writeShellApplication,
 }:
 
 let
-  # They demand their own fork of ctypesgen
-  ctypesgen = buildPythonPackage rec {
-    pname = "ctypesgen";
-    version = "1.1.1+g${src.rev}"; # the most recent tag + git version
-    pyproject = true;
-
-    src = fetchFromGitHub {
-      owner = "pypdfium2-team";
-      repo = "ctypesgen";
-      rev = "3961621c3e057015362db82471e07f3a57822b15";
-      hash = "sha256-0OBY7/Zn12rG20jNYG65lANTRVRIFvE0SgUdYGFpRtU=";
-    };
-
-    build-system = [
-      setuptools-scm
-    ];
+  # Use the fork revision bundled with this release's source distribution.
+  ctypesgen = fetchFromGitHub {
+    owner = "pypdfium2-team";
+    repo = "ctypesgen";
+    rev = "4ddc2b2cdc4daefb0be450e8b5152e11337e9e3c";
+    hash = "sha256-S98kIimLZa3wJ5aKlADYOkqxsOhUlLqLHogC7Id0vVo=";
   };
-
 in
 buildPythonPackage rec {
   pname = "pypdfium2";
-  version = "5.13.0";
+  version = "5.14.0";
   pyproject = true;
 
+  # Use GitHub because the PyPI source distribution excludes the test suite.
   src = fetchFromGitHub {
     owner = "pypdfium2-team";
     repo = "pypdfium2";
     tag = version;
-    hash = "sha256-DbCbJUvYzjWIlGJyrUbJfzebHrPpRFEx60DYqs1UrkQ=";
+    hash = "sha256-KnZkIbV1ke0tL+VdUOkHElZXVrJixNBBoD0fpLPHNbY=";
   };
 
   build-system = [
-    ctypesgen
-    setuptools-scm
+    packaging
+    setuptools
   ];
 
+  postPatch = ''
+    mkdir -p deps
+    ln -s ${ctypesgen} deps/ctypesgen
+  '';
+
   nativeBuildInputs = [
     removeReferencesTo
   ];
@@ -78,6 +83,9 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  # Avoid collecting ctypesgen's tests, which also define tests.conftest.
+  enabledTestPaths = [ "tests" ];
+
   disabledTestPaths = [
     # does not work on ZFS with normalization
     "tests/test_opener.py::test_open_garbled_filename"
@@ -88,9 +96,23 @@ buildPythonPackage rec {
   ];
 
   passthru = {
-    updateScript = gitUpdater {
-      allowedVersions = "^[.0-9]+$";
-    };
+    inherit ctypesgen;
+
+    updateScript = lib.getExe (writeShellApplication {
+      name = "pypdfium2-update";
+      runtimeInputs = [
+        common-updater-scripts
+        coreutils
+        curl
+        diffutils
+        gnutar
+        gzip
+        jq
+        nix
+        nix-update
+      ];
+      text = builtins.readFile ./update.sh;
+    });
     tests.cross = pkgsCross.aarch64-multiplatform.python3Packages.pypdfium2;
   };
 
diff --git a/pkgs/development/python-modules/pypdfium2/update.sh b/pkgs/development/python-modules/pypdfium2/update.sh
new file mode 100644
index 000000000000..0cf55c18bdd5
--- /dev/null
+++ b/pkgs/development/python-modules/pypdfium2/update.sh
@@ -0,0 +1,50 @@
+nix-update "$UPDATE_NIX_ATTR_PATH" --version-regex='^([0-9.]+)$' "$@"
+
+version=$(nix eval --raw --file . "$UPDATE_NIX_ATTR_PATH.version")
+release_date=$(
+  curl -fsSL "https://api.github.com/repos/pypdfium2-team/pypdfium2/commits/$version" |
+    jq -er '.commit.committer.date'
+)
+
+# The fork has no release tags. Select its head at the time of the release,
+# then verify it against the source bundled in the published distribution.
+rev=$(
+  curl -fsSL --get "https://api.github.com/repos/pypdfium2-team/ctypesgen/commits" \
+    --data-urlencode 'sha=pypdfium2' \
+    --data-urlencode "until=$release_date" \
+    --data-urlencode 'per_page=1' |
+    jq -er '.[0].sha'
+)
+
+sdist_url=$(
+  curl -fsSL "https://pypi.org/pypi/pypdfium2/$version/json" |
+    jq -er '.urls[] | select(.packagetype == "sdist") | .url'
+)
+
+workdir=$(mktemp -d)
+trap 'rm -rf "$workdir"' EXIT
+
+extract_archive() {
+  local url="$1"
+  local destination="$2"
+
+  mkdir -p "$destination"
+  curl -fsSL "$url" | tar -xz --strip-components=1 -C "$destination"
+}
+
+extract_archive "$sdist_url" "$workdir/pypdfium2"
+extract_archive "https://github.com/pypdfium2-team/ctypesgen/archive/$rev.tar.gz" "$workdir/ctypesgen"
+
+if ! diff -qr "$workdir/pypdfium2/deps/ctypesgen/src" "$workdir/ctypesgen/src"; then
+  echo "ctypesgen $rev does not match the source bundled with pypdfium2 $version" >&2
+  exit 1
+fi
+
+current_rev=$(nix eval --raw --file . "$UPDATE_NIX_ATTR_PATH.ctypesgen.rev")
+if [[ "$rev" != "$current_rev" ]]; then
+  update-source-version \
+    "$UPDATE_NIX_ATTR_PATH" \
+    --source-key=ctypesgen \
+    --rev="$rev" \
+    --ignore-same-version
+fi
diff --git a/pkgs/development/python-modules/pyrss2gen/default.nix b/pkgs/development/python-modules/pyrss2gen/default.nix
index 0f525c4fef79..c3efd81888b0 100644
--- a/pkgs/development/python-modules/pyrss2gen/default.nix
+++ b/pkgs/development/python-modules/pyrss2gen/default.nix
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   doCheck = false;
 
   meta = {
-    homepage = "http://www.dalkescientific.om/Python/PyRSS2Gen.html";
+    homepage = "http://dalkescientific.com/Python/PyRSS2Gen.html";
     description = "Library for generating RSS 2.0 feeds";
     license = lib.licenses.bsd2;
     maintainers = [ ];
diff --git a/pkgs/development/python-modules/pysail/default.nix b/pkgs/development/python-modules/pysail/default.nix
index 60e48aaea6c2..8081bf3097be 100644
--- a/pkgs/development/python-modules/pysail/default.nix
+++ b/pkgs/development/python-modules/pysail/default.nix
@@ -1,11 +1,10 @@
 {
   lib,
   buildPythonPackage,
-  fetchFromGitHub,
   rustPlatform,
-  nix-update-script,
   testers,
   pysail,
+  sail,
 
   protoc,
   protobuf,
@@ -13,21 +12,9 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pysail";
-  version = "0.7.1";
+  inherit (sail) version src cargoDeps; # nixpkgs-update: no auto update
   pyproject = true;
 
-  src = fetchFromGitHub {
-    owner = "lakehq";
-    repo = "sail";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-UJP2d56IF0h9s/kZhNWVkCp/YfTf1RpQStM1NjzJKK4=";
-  };
-
-  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) pname src version;
-    hash = "sha256-a0NOVMH5dObFpwUaEsB6w66XVSjnWQRiK5i/KylEgAU=";
-  };
-
   # The `generate-import-lib` PyO3 feature only matters when building Windows
   # import libraries; on other platforms it just pulls in the `python3-dll-a`
   # crate, which is not vendored. Drop it so the offline maturin build resolves.
@@ -55,11 +42,8 @@ buildPythonPackage (finalAttrs: {
   # heavyweight optional dependencies (pyspark-client, duckdb, ...).
   doCheck = false;
 
-  passthru = {
-    updateScript = nix-update-script { };
-    tests.version = testers.testVersion {
-      package = pysail;
-    };
+  passthru.tests.version = testers.testVersion {
+    package = pysail;
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/pystray/default.nix b/pkgs/development/python-modules/pystray/default.nix
index 107d5508098c..b7e72d47950d 100644
--- a/pkgs/development/python-modules/pystray/default.nix
+++ b/pkgs/development/python-modules/pystray/default.nix
@@ -73,10 +73,7 @@ buildPythonPackage rec {
   meta = {
     homepage = "https://github.com/moses-palmer/pystray";
     description = "This library allows you to create a system tray icon";
-    license = with lib.licenses; [
-      gpl3Plus
-      lgpl3Plus
-    ];
+    license = lib.licenses.lgpl3Plus;
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ jojosch ];
   };
diff --git a/pkgs/development/python-modules/python-calamine/default.nix b/pkgs/development/python-modules/python-calamine/default.nix
index a9adcbd8bb8d..ffadaa09d098 100644
--- a/pkgs/development/python-modules/python-calamine/default.nix
+++ b/pkgs/development/python-modules/python-calamine/default.nix
@@ -13,19 +13,19 @@
 
 buildPythonPackage rec {
   pname = "python-calamine";
-  version = "0.6.0";
+  version = "0.8.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dimastbk";
     repo = "python-calamine";
     tag = "v${version}";
-    hash = "sha256-vPI2SWOMwEpN0w7BWvFFz1eeXiU9t4xhdl3TpO39l/Q=";
+    hash = "sha256-7P75jGsBMfdC6AusyRTdOx0NA3kadReacLUm9tY551g=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-DR84RulbTpwipYKHLtXdCa8Yr2Irv1W1o3NrCT8FRq4=";
+    hash = "sha256-ESp1ig2IQqN3TOcAMQ1vHCeeJMuj3cYs0O+8w8NA/2k=";
   };
 
   buildInputs = [ libiconv ];
diff --git a/pkgs/development/python-modules/python-roborock/default.nix b/pkgs/development/python-modules/python-roborock/default.nix
index d442cfbd461d..6a5494cb1eee 100644
--- a/pkgs/development/python-modules/python-roborock/default.nix
+++ b/pkgs/development/python-modules/python-roborock/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "python-roborock";
-  version = "7.12.1";
+  version = "7.12.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Python-roborock";
     repo = "python-roborock";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZOCUCMaVpn45c6ZWYv/qNQMIeC43C3JdrJGzFBYuY84=";
+    hash = "sha256-rxDyZmq/ETOLIDNmtCvN+3OJM9MXOwMgVjVZQcBQ2CM=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/python-uinput/default.nix b/pkgs/development/python-modules/python-uinput/default.nix
index d2598e60f84b..e4ad3d4704b2 100644
--- a/pkgs/development/python-modules/python-uinput/default.nix
+++ b/pkgs/development/python-modules/python-uinput/default.nix
@@ -23,7 +23,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "Pythonic API to Linux uinput kernel module";
-    homepage = "https://tjjr.fi/sw/python-uinput/";
+    homepage = "https://github.com/pyinput/python-uinput";
     license = lib.licenses.gpl3Plus;
     maintainers = [ ];
   };
diff --git a/pkgs/development/python-modules/pyupgrade/default.nix b/pkgs/development/python-modules/pyupgrade/default.nix
index b1e4744e31f0..e7342745bcdb 100644
--- a/pkgs/development/python-modules/pyupgrade/default.nix
+++ b/pkgs/development/python-modules/pyupgrade/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyupgrade";
-  version = "3.21.2";
+  version = "3.22.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "asottile";
     repo = "pyupgrade";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-u4iudzPhVuAOS9cL3z6FCVpWKJZHg7UGpe9aHnN7Byc=";
+    hash = "sha256-B3x1ykS+8gzaDIYb1f6locaHw/wBMdGfniEbthDdrL4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyvista-validation/default.nix b/pkgs/development/python-modules/pyvista-validation/default.nix
new file mode 100644
index 000000000000..c8fcee83cbf4
--- /dev/null
+++ b/pkgs/development/python-modules/pyvista-validation/default.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  setuptools-scm,
+  numpy,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pyvista-validation";
+  version = "0.2.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "pyvista";
+    repo = "pyvista-validation";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-LuY3AYWmsETjItFdgKcK6nRm5GYlqWbrznxYO+EaUYY=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [
+    numpy
+  ];
+
+  pythonImportsCheck = [
+    "pyvista_validation"
+  ];
+
+  meta = {
+    description = "Validate and standardize array-like input";
+    homepage = "https://github.com/pyvista/pyvista-validation";
+    changelog = "https://github.com/pyvista/pyvista-validation/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ wegank ];
+  };
+})
diff --git a/pkgs/development/python-modules/pyvista/default.nix b/pkgs/development/python-modules/pyvista/default.nix
index 7f8617da10e1..fee524bab9dd 100644
--- a/pkgs/development/python-modules/pyvista/default.nix
+++ b/pkgs/development/python-modules/pyvista/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
   cyclopts,
@@ -7,6 +8,8 @@
   numpy,
   pillow,
   pooch,
+  pyobjc-framework-Cocoa,
+  pyvista-validation,
   scooby,
   setuptools,
   typing-extensions,
@@ -15,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "pyvista";
-  version = "0.48.4";
+  version = "0.49.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pyvista";
     repo = "pyvista";
     tag = "v${version}";
-    hash = "sha256-VF84EMS/FnLl0y1LpWaYosyG0qEWI/QghZQq32ktlLg=";
+    hash = "sha256-Qq6oJ/0Er2acaYMHYCLSSO49aZRPUvIKkkWRXsQ1RoA=";
   };
 
   build-system = [ setuptools ];
@@ -33,9 +36,13 @@ buildPythonPackage rec {
     numpy
     pillow
     pooch
+    pyvista-validation
     scooby
     typing-extensions
     vtk
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    pyobjc-framework-Cocoa
   ];
 
   # Fatal Python error: Aborted
diff --git a/pkgs/development/python-modules/radio-beam/default.nix b/pkgs/development/python-modules/radio-beam/default.nix
index 9ad35951491c..4b562dde5be2 100644
--- a/pkgs/development/python-modules/radio-beam/default.nix
+++ b/pkgs/development/python-modules/radio-beam/default.nix
@@ -1,31 +1,41 @@
 {
   lib,
-  fetchPypi,
   buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
   setuptools-scm,
+
+  # dependencies
   astropy,
   numpy,
   matplotlib,
   scipy,
   six,
+
+  # tests
   pytestCheckHook,
   pytest-astropy,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "radio-beam";
-  version = "0.3.9";
+  version = "0.3.10";
   pyproject = true;
+  __structuredAttrs = true;
 
-  src = fetchPypi {
-    inherit version;
-    pname = "radio_beam"; # Tarball was uploaded with an underscore in this version
-    hash = "sha256-m1/qe8ybJlQyE3hGM7MugWMMnAhVB3t6v0tGz42E5kQ=";
+  src = fetchFromGitHub {
+    owner = "radio-astro-tools";
+    repo = "radio-beam";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-EO3tyT2wF3TeXDRCt7WUoSEd1s+umciGEkdgA4Bfmqs=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [
+    setuptools-scm
+  ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     astropy
     numpy
     scipy
@@ -33,9 +43,9 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    pytestCheckHook
     matplotlib
     pytest-astropy
+    pytestCheckHook
   ];
 
   pythonImportsCheck = [ "radio_beam" ];
@@ -43,8 +53,8 @@ buildPythonPackage rec {
   meta = {
     description = "Tools for Beam IO and Manipulation";
     homepage = "http://radio-astro-tools.github.io";
-    changelog = "https://github.com/radio-astro-tools/radio-beam/releases/tag/v${version}";
+    changelog = "https://github.com/radio-astro-tools/radio-beam/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ smaret ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/radon/default.nix b/pkgs/development/python-modules/radon/default.nix
index 3fb25b1a1dde..f1dbbbcd2ea3 100644
--- a/pkgs/development/python-modules/radon/default.nix
+++ b/pkgs/development/python-modules/radon/default.nix
@@ -57,7 +57,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "Various code metrics for Python code";
-    homepage = "https://radon.readthedocs.org";
+    homepage = "https://radon.readthedocs.io";
     changelog = "https://github.com/rubik/radon/blob/v${version}/CHANGELOG";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ t4ccer ];
diff --git a/pkgs/development/python-modules/rapidgzip/default.nix b/pkgs/development/python-modules/rapidgzip/default.nix
index 26bf7b15bb14..b3d0f94e5c07 100644
--- a/pkgs/development/python-modules/rapidgzip/default.nix
+++ b/pkgs/development/python-modules/rapidgzip/default.nix
@@ -17,6 +17,9 @@ buildPythonPackage rec {
     hash = "sha256-ixJPKbwS3kJJq4HoPlrTXmd0KhqP9Ky2G3TA2f2hwU4=";
   };
 
+  # Newer setuptools removed the dry_run compiler constructor argument.
+  patches = [ ./setuptools-compiler-api.patch ];
+
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail "setuptools >= 61.2, < 72" setuptools
diff --git a/pkgs/development/python-modules/rapidgzip/setuptools-compiler-api.patch b/pkgs/development/python-modules/rapidgzip/setuptools-compiler-api.patch
new file mode 100644
index 000000000000..04eaade85b8f
--- /dev/null
+++ b/pkgs/development/python-modules/rapidgzip/setuptools-compiler-api.patch
@@ -0,0 +1,13 @@
+diff --git a/nasm_extension/nasmcompiler.py b/nasm_extension/nasmcompiler.py
+--- a/nasm_extension/nasmcompiler.py
++++ b/nasm_extension/nasmcompiler.py
+@@ -30,7 +30,8 @@ class NasmCompiler(UnixCCompiler):
+ 
+     def __init__(self, verbose=0, dry_run=0, force=0):
+ 
+-        UnixCCompiler.__init__(self, verbose, dry_run, force)
++        UnixCCompiler.__init__(self, verbose=verbose, force=force)
++        self.dry_run = dry_run
+         self.set_executable("compiler", "nasm")
+ 
+     def _is_gcc(self, compiler_name):
diff --git a/pkgs/development/python-modules/rawkit/default.nix b/pkgs/development/python-modules/rawkit/default.nix
index eae89d508da0..ec1191875a27 100644
--- a/pkgs/development/python-modules/rawkit/default.nix
+++ b/pkgs/development/python-modules/rawkit/default.nix
@@ -39,7 +39,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "CTypes based LibRaw bindings for Python";
-    homepage = "https://rawkit.readthedocs.org/";
+    homepage = "https://rawkit.readthedocs.io/";
     license = lib.licenses.mit;
     maintainers = [ ];
   };
diff --git a/pkgs/development/python-modules/raygeo/default.nix b/pkgs/development/python-modules/raygeo/default.nix
index 0a3922e2374a..934b54d47c28 100644
--- a/pkgs/development/python-modules/raygeo/default.nix
+++ b/pkgs/development/python-modules/raygeo/default.nix
@@ -15,17 +15,17 @@
 
 buildPythonPackage rec {
   pname = "raygeo";
-  version = "1.53.0";
+  version = "1.61.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-J+K+dj+72RLkV2DQgbGMQanf23HdQnHfBYkTRnC9F5w=";
+    hash = "sha256-4oy/gCMPGAAcuJVSQBduagw6AHCRXP/WpuL5UJ0sxpQ=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-svCZ63IdEbb7wIXPX9n2zsXyG88d49/LIzSjv4LbEgE=";
+    hash = "sha256-OxnLS0MbhfpNNJ6l0XNCdcBLU8S9JmpgYTr9sdzlkHQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/redisvl/default.nix b/pkgs/development/python-modules/redisvl/default.nix
index 498a906f213a..a6cd41aa677a 100644
--- a/pkgs/development/python-modules/redisvl/default.nix
+++ b/pkgs/development/python-modules/redisvl/default.nix
@@ -45,7 +45,7 @@ buildPythonPackage (finalAttrs: {
 
   meta = {
     description = "Python client library and CLI for using Redis as a vector database";
-    homepage = " https://redisvl.com";
+    homepage = "https://redisvl.com";
     changelog = "https://github.com/redis/redis-vl-python/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
     mainProgram = "rvl";
diff --git a/pkgs/development/python-modules/repoze-lru/default.nix b/pkgs/development/python-modules/repoze-lru/default.nix
index 45f5a7fedcc4..9055f1f58db8 100644
--- a/pkgs/development/python-modules/repoze-lru/default.nix
+++ b/pkgs/development/python-modules/repoze-lru/default.nix
@@ -35,7 +35,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "Tiny LRU cache implementation and decorator";
-    homepage = "http://www.repoze.org/";
+    homepage = "https://github.com/repoze/repoze.lru";
     changelog = "https://github.com/repoze/repoze.lru/blob/${version}/CHANGES.rst";
     license = lib.licenses.bsd0;
     maintainers = [ ];
diff --git a/pkgs/development/python-modules/requests-toolbelt/default.nix b/pkgs/development/python-modules/requests-toolbelt/default.nix
index 59354d41092b..c029912372e0 100644
--- a/pkgs/development/python-modules/requests-toolbelt/default.nix
+++ b/pkgs/development/python-modules/requests-toolbelt/default.nix
@@ -44,7 +44,7 @@ buildPythonPackage (finalAttrs: {
 
   meta = {
     description = "Toolbelt of useful classes and functions to be used with requests";
-    homepage = "http://toolbelt.rtfd.org";
+    homepage = "https://toolbelt.readthedocs.io";
     changelog = "https://github.com/requests/toolbelt/blob/${finalAttrs.version}/HISTORY.rst";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ matthiasbeyer ];
diff --git a/pkgs/development/python-modules/ropgadget/default.nix b/pkgs/development/python-modules/ropgadget/default.nix
index 270ff4c0ae2c..f023b503a3db 100644
--- a/pkgs/development/python-modules/ropgadget/default.nix
+++ b/pkgs/development/python-modules/ropgadget/default.nix
@@ -30,7 +30,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Tool to search for gadgets in binaries to facilitate ROP exploitation";
     mainProgram = "ROPgadget";
-    homepage = "http://shell-storm.org/project/ROPgadget/";
+    homepage = "https://github.com/JonathanSalwan/ROPgadget";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ bennofs ];
   };
diff --git a/pkgs/development/python-modules/rucio/default.nix b/pkgs/development/python-modules/rucio/default.nix
index 933939dd5d2f..4408cafa3ef0 100644
--- a/pkgs/development/python-modules/rucio/default.nix
+++ b/pkgs/development/python-modules/rucio/default.nix
@@ -39,13 +39,13 @@
 }:
 
 let
-  version = "41.3.0";
+  version = "41.4.0";
 
   src = fetchFromGitHub {
     owner = "rucio";
     repo = "rucio";
     tag = version;
-    hash = "sha256-POVV0conRsDBbvK2tmy8USv2WpgPKhNvGB3aXAGcuMc=";
+    hash = "sha256-C1COIE3q9Fozw8pFikhzS/tR1huLJcZtwd/DOYvz6+o=";
   };
 in
 buildPythonPackage {
diff --git a/pkgs/development/python-modules/ruida-pa/default.nix b/pkgs/development/python-modules/ruida-pa/default.nix
index 0fd86c48bf3c..1b344d952392 100644
--- a/pkgs/development/python-modules/ruida-pa/default.nix
+++ b/pkgs/development/python-modules/ruida-pa/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "ruida-pa";
-  version = "0.20.4";
+  version = "0.22.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "ruida_pa";
     inherit version;
-    hash = "sha256-qvIdg0qkOmIn0ydapleONZHazueO6jzcB+PpsuiW02w=";
+    hash = "sha256-+O1lB9N5xPWU5EZRkj6Eo54Vvp6H4h/GdXUt1rWJesc=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/saiph/default.nix b/pkgs/development/python-modules/saiph/default.nix
index 7e809c6e20a6..14983c27c9ca 100644
--- a/pkgs/development/python-modules/saiph/default.nix
+++ b/pkgs/development/python-modules/saiph/default.nix
@@ -6,6 +6,7 @@
   pytestCheckHook,
   doubles,
   msgspec,
+  matplotlib,
   numpy,
   pandas,
   pydantic,
@@ -14,26 +15,26 @@
   toolz,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "saiph";
-  version = "2.0.8";
+  version = "3.0.1";
+  pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "octopize";
     repo = "saiph";
-    tag = "saiph-v${version}";
-    hash = "sha256-3KcCiGgcJ+1WLQPvxDJyGrn8TEiBVIh/9TsCMkku3ls=";
+    tag = "saiph-v${finalAttrs.version}";
+    hash = "sha256-e41fa0C3ZT8mg+oHLU6VsQKgnCh59uO3bksO46A4t1M=";
   };
 
-  pyproject = true;
-
   build-system = [
     hatchling
   ];
 
   dependencies = [
-    doubles
     msgspec
+    matplotlib
     numpy
     pandas
     pydantic
@@ -42,16 +43,22 @@ buildPythonPackage rec {
     toolz
   ];
 
-  # No need for benchmarks
-  disabledTests = [
-    "benchmark_test.py"
-  ];
-
   nativeCheckInputs = [
     pytestCheckHook
+    doubles
   ];
 
-  pythonRelaxDeps = true;
+  disabledTests = [
+    # No need for benchmarks
+    "benchmark_test.py"
+
+    # pluggy.PluggyTeardownRaisedWarning: A plugin raised an exception during an old-style hookwrapper teardown.
+    "test_encode_decode_model"
+    "test_fit_mix"
+    "test_var_cor"
+    "test_var_ratio"
+    "test_get_variable_contributions"
+  ];
 
   pythonImportsCheck = [
     "saiph"
@@ -63,4 +70,4 @@ buildPythonPackage rec {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ b-rodrigues ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/sendspin/default.nix b/pkgs/development/python-modules/sendspin/default.nix
index 4ef44584596a..3e5bd1c9470c 100644
--- a/pkgs/development/python-modules/sendspin/default.nix
+++ b/pkgs/development/python-modules/sendspin/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "sendspin";
-  version = "7.5.0";
+  version = "7.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Sendspin";
     repo = "sendspin-cli";
     tag = finalAttrs.version;
-    hash = "sha256-Oux9hEtN5AiPf3gAqXGVinDfDIuNVugchUNuLMfMoYc=";
+    hash = "sha256-unNlx0A5Jh3mkPp4G86DY41UExA5IEwMM8E0/jfaBkY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/snakemake-logger-plugin-rich/default.nix b/pkgs/development/python-modules/snakemake-logger-plugin-rich/default.nix
index a5e094a715af..309cd192666a 100644
--- a/pkgs/development/python-modules/snakemake-logger-plugin-rich/default.nix
+++ b/pkgs/development/python-modules/snakemake-logger-plugin-rich/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "snakemake-logger-plugin-rich";
-  version = "0.4.2";
+  version = "0.5.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -28,7 +28,7 @@ buildPythonPackage (finalAttrs: {
     owner = "cademirch";
     repo = "snakemake-logger-plugin-rich";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vdPM1nRovZ5QhKudzCebMNMndzOWPvTmI5I1oTbzg9o=";
+    hash = "sha256-SoxmCp12S8PE3/qbEpa1VGccPS/VRmaqfSEOB1D+nyk=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/soco/default.nix b/pkgs/development/python-modules/soco/default.nix
index 44887ef0c547..3c40957c9795 100644
--- a/pkgs/development/python-modules/soco/default.nix
+++ b/pkgs/development/python-modules/soco/default.nix
@@ -53,7 +53,7 @@ buildPythonPackage (finalAttrs: {
 
   meta = {
     description = "CLI and library to control Sonos speakers";
-    homepage = "http://python-soco.com/";
+    homepage = "https://github.com/SoCo/SoCo";
     changelog = "https://github.com/SoCo/SoCo/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ lovesegfault ];
diff --git a/pkgs/development/python-modules/spectral-cube/default.nix b/pkgs/development/python-modules/spectral-cube/default.nix
index 7ae803f315c6..b70bf47d25fc 100644
--- a/pkgs/development/python-modules/spectral-cube/default.nix
+++ b/pkgs/development/python-modules/spectral-cube/default.nix
@@ -24,16 +24,17 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "spectral-cube";
-  version = "0.6.7";
+  version = "0.7.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "radio-astro-tools";
     repo = "spectral-cube";
-    tag = "v${version}";
-    hash = "sha256-l5r7oeWr/JrmGOmUo4po2VlGldh8y7E3ufd+Gw1/JmM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-G/G3OtyhJ84KfnsmrOMK8Z6I/QTp8Wr8Fdo5R1CRnwU=";
   };
 
   build-system = [
@@ -84,8 +85,8 @@ buildPythonPackage rec {
   meta = {
     description = "Library for reading and analyzing astrophysical spectral data cubes";
     homepage = "https://spectral-cube.readthedocs.io";
-    changelog = "https://github.com/radio-astro-tools/spectral-cube/releases/tag/v${version}";
+    changelog = "https://github.com/radio-astro-tools/spectral-cube/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ smaret ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/starlette/default.nix b/pkgs/development/python-modules/starlette/default.nix
index b2024f5c8496..66ba7c5e50eb 100644
--- a/pkgs/development/python-modules/starlette/default.nix
+++ b/pkgs/development/python-modules/starlette/default.nix
@@ -65,7 +65,7 @@ buildPythonPackage rec {
   meta = {
     changelog = "https://github.com/Kludex/starlette/blob/${src.tag}/docs/release-notes.md";
     downloadPage = "https://github.com/Kludex/starlette";
-    homepage = "https://www.starlette.io/";
+    homepage = "https://starlette.dev";
     description = "Little ASGI framework that shines";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ wd15 ];
diff --git a/pkgs/development/python-modules/statistics/default.nix b/pkgs/development/python-modules/statistics/default.nix
deleted file mode 100644
index 5664dc2eaefb..000000000000
--- a/pkgs/development/python-modules/statistics/default.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-{
-  lib,
-  fetchPypi,
-  buildPythonPackage,
-  docutils,
-}:
-
-buildPythonPackage rec {
-  pname = "statistics";
-  version = "1.0.3.5";
-  format = "setuptools";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "2dc379b80b07bf2ddd5488cad06b2b9531da4dd31edb04dc9ec0dc226486c138";
-  };
-
-  propagatedBuildInputs = [ docutils ];
-
-  # statistics package does not have any tests
-  doCheck = false;
-
-  meta = {
-    description = "Python 2.* port of 3.4 Statistics Module";
-    homepage = "https://github.com/digitalemagine/py-statistics";
-    license = lib.licenses.asl20;
-    maintainers = [ ];
-  };
-}
diff --git a/pkgs/development/python-modules/telegram-text/default.nix b/pkgs/development/python-modules/telegram-text/default.nix
index 89519d28d993..b68d55a3db78 100644
--- a/pkgs/development/python-modules/telegram-text/default.nix
+++ b/pkgs/development/python-modules/telegram-text/default.nix
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   meta = {
     description = "Python markup module for Telegram messenger";
     downloadPage = "https://github.com/SKY-ALIN/telegram-text";
-    homepage = "https://telegram-text.alinsky.tech/";
+    homepage = "https://github.com/SKY-ALIN/telegram-text";
     changelog = "https://github.com/SKY-ALIN/telegram-text/blob/v${version}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ sikmir ];
diff --git a/pkgs/development/python-modules/ttp-templates/default.nix b/pkgs/development/python-modules/ttp-templates/default.nix
index 6a6fc414f73d..01c902e862b4 100644
--- a/pkgs/development/python-modules/ttp-templates/default.nix
+++ b/pkgs/development/python-modules/ttp-templates/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ttp-templates";
-  version = "0.6.10";
+  version = "0.6.14";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dmulyalin";
     repo = "ttp_templates";
     tag = finalAttrs.version;
-    hash = "sha256-j//8gAzBXyQkSmmnJZofi2Q/lYklT/QjiU8k0a3ENDg=";
+    hash = "sha256-KTXUbxmXKTg5Xj5p4pnU3abvBgphaXjI+6NPdIJ3xIY=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/twiggy/default.nix b/pkgs/development/python-modules/twiggy/default.nix
index 420cc3336f49..3d50f8dcccee 100644
--- a/pkgs/development/python-modules/twiggy/default.nix
+++ b/pkgs/development/python-modules/twiggy/default.nix
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   doCheck = false;
 
   meta = {
-    homepage = "http://twiggy.wearpants.org";
+    homepage = "https://github.com/wearpants/twiggy";
     # Taken from http://i.wearpants.org/blog/meet-twiggy/
     description = "Twiggy is the first totally new design for a logger since log4j";
     license = lib.licenses.bsd3;
diff --git a/pkgs/development/python-modules/uritools/default.nix b/pkgs/development/python-modules/uritools/default.nix
index 4c6de860c585..b31f324f3c8f 100644
--- a/pkgs/development/python-modules/uritools/default.nix
+++ b/pkgs/development/python-modules/uritools/default.nix
@@ -1,29 +1,38 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
+  pytestCheckHook,
   setuptools,
+  setuptools-scm,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "uritools";
-  version = "6.0.2";
+  version = "6.1.3";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-TWccO4yiMKXUfvpfimk/PQFTHzj09SMXApm+c0zJhRs=";
+  src = fetchFromGitHub {
+    owner = "tkem";
+    repo = "uritools";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-pZzsdl/q5Piul1Q2cLPkeRmZbW12ACKuI2OYbnG+rMc=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
 
   pythonImportsCheck = [ "uritools" ];
 
   meta = {
     description = "RFC 3986 compliant, Unicode-aware, scheme-agnostic replacement for urlparse";
     homepage = "https://github.com/tkem/uritools/";
-    changelog = "https://github.com/tkem/uritools/blob/v${version}/CHANGELOG.rst";
+    changelog = "https://github.com/tkem/uritools/blob/v${finalAttrs.version}/CHANGELOG.rst";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ rvolosatovs ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/uvicorn/default.nix b/pkgs/development/python-modules/uvicorn/default.nix
index 79d6596c40af..faffbe3d50ed 100644
--- a/pkgs/development/python-modules/uvicorn/default.nix
+++ b/pkgs/development/python-modules/uvicorn/default.nix
@@ -62,7 +62,7 @@ buildPythonPackage rec {
   };
 
   meta = {
-    homepage = "https://www.uvicorn.org/";
+    homepage = "https://uvicorn.dev";
     changelog = "https://github.com/Kludex/uvicorn/blob/${src.tag}/docs/release-notes.md";
     description = "Lightning-fast ASGI server";
     mainProgram = "uvicorn";
diff --git a/pkgs/development/python-modules/virtualenv/default.nix b/pkgs/development/python-modules/virtualenv/default.nix
index ffdd174c3b66..fb5d18fd3b94 100644
--- a/pkgs/development/python-modules/virtualenv/default.nix
+++ b/pkgs/development/python-modules/virtualenv/default.nix
@@ -74,7 +74,7 @@ buildPythonPackage rec {
   meta = {
     description = "Tool to create isolated Python environments";
     mainProgram = "virtualenv";
-    homepage = "http://www.virtualenv.org";
+    homepage = "https://virtualenv.pypa.io/en/latest/";
     changelog = "https://github.com/pypa/virtualenv/blob/${version}/docs/changelog.rst";
     license = lib.licenses.mit;
     maintainers = [ ];
diff --git a/pkgs/development/python-modules/vllm/0003-propagate-pythonpath.patch b/pkgs/development/python-modules/vllm/0003-propagate-pythonpath.patch
index b7ca770d45d6..afafe28c0287 100644
--- a/pkgs/development/python-modules/vllm/0003-propagate-pythonpath.patch
+++ b/pkgs/development/python-modules/vllm/0003-propagate-pythonpath.patch
@@ -7,7 +7,7 @@ index a2de597c8..4c2410209 100644
          # contains relative imports
          returned = subprocess.run(
 -            _SUBPROCESS_COMMAND, input=input_bytes, capture_output=True
-+            _SUBPROCESS_COMMAND, input=input_bytes, capture_output=True, env={'PYTHONPATH': ':'.join(sys.path)},
++            _SUBPROCESS_COMMAND, input=input_bytes, capture_output=True, env={**os.environ, 'PYTHONPATH': ':'.join(sys.path)},
          )
  
          # check if the subprocess is successful
diff --git a/pkgs/development/python-modules/yalexs/default.nix b/pkgs/development/python-modules/yalexs/default.nix
index b38360cc643f..17cb89ccfa0d 100644
--- a/pkgs/development/python-modules/yalexs/default.nix
+++ b/pkgs/development/python-modules/yalexs/default.nix
@@ -68,6 +68,7 @@ buildPythonPackage (finalAttrs: {
   disabledTests = [
     # aiohttp api breakage, remove when bumping to 9.2.8 or newer
     "test__raise_response_exceptions"
+    "test_async_refresh_token"
   ];
 
   pythonImportsCheck = [ "yalexs" ];
diff --git a/pkgs/development/python-modules/zwave-js-server-python/default.nix b/pkgs/development/python-modules/zwave-js-server-python/default.nix
index 43e06c64c75e..db687315557e 100644
--- a/pkgs/development/python-modules/zwave-js-server-python/default.nix
+++ b/pkgs/development/python-modules/zwave-js-server-python/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "zwave-js-server-python";
-  version = "0.73.1";
+  version = "0.74.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = "zwave-js-server-python";
     tag = finalAttrs.version;
-    hash = "sha256-KhVXaqGFbLnaLaP0LbFWV7GiRXycQ00EYaNR8VqtWe8=";
+    hash = "sha256-a4OYCR+Bi1GvE7BgnGm74GDo3xlRAPdIsWMGXwpBolc=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/rocm-modules/rocm-smi/default.nix b/pkgs/development/rocm-modules/rocm-smi/default.nix
index ecb5485b23c3..188d78465252 100644
--- a/pkgs/development/rocm-modules/rocm-smi/default.nix
+++ b/pkgs/development/rocm-modules/rocm-smi/default.nix
@@ -25,6 +25,9 @@ stdenv.mkDerivation (finalAttrs: {
   };
   sourceRoot = "${finalAttrs.src.name}/projects/rocm-smi-lib";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   propagatedBuildInputs = [
     libdrm
   ];
@@ -38,10 +41,10 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     # Manually define CMAKE_INSTALL_<DIR>
     # See: https://github.com/NixOS/nixpkgs/pull/197838
-    "-DCMAKE_INSTALL_BINDIR=bin"
-    "-DCMAKE_INSTALL_LIBDIR=lib"
-    "-DCMAKE_INSTALL_LIBEXECDIR=libexec"
-    "-DCMAKE_INSTALL_INCLUDEDIR=include"
+    (lib.cmakeFeature "CMAKE_INSTALL_BINDIR" "bin")
+    (lib.cmakeFeature "CMAKE_INSTALL_LIBDIR" "lib")
+    (lib.cmakeFeature "CMAKE_INSTALL_LIBEXECDIR" "libexec")
+    (lib.cmakeFeature "CMAKE_INSTALL_INCLUDEDIR" "include")
   ];
 
   postInstall =
@@ -65,7 +68,9 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "System management interface for AMD GPUs supported by ROCm";
     homepage = "https://github.com/ROCm/rocm-systems/tree/develop/projects/rocm-smi-lib";
+    changelog = "https://github.com/ROCm/rocm-systems/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
+    mainProgram = "rocm-smi";
     maintainers = with lib.maintainers; [ lovesegfault ];
     teams = [ lib.teams.rocm ];
     platforms = [ "x86_64-linux" ];
diff --git a/pkgs/games/openra_2019/mods.nix b/pkgs/games/openra_2019/mods.nix
index f26c9c86c289..b2fc7456e69c 100644
--- a/pkgs/games/openra_2019/mods.nix
+++ b/pkgs/games/openra_2019/mods.nix
@@ -315,7 +315,7 @@ in
     version = "431.git.128dc53";
     title = "Red Alert Unplugged";
     meta.description = "Re-imagination of the original Command & Conquer: Red Alert game";
-    meta.homepage = "http://redalertunplugged.com/";
+    meta.homepage = "https://github.com/RAunplugged/uRA";
     src = fetchFromGitHub {
       owner = "RAunplugged";
       repo = "uRA";
diff --git a/pkgs/games/xonotic/default.nix b/pkgs/games/xonotic/default.nix
index 3dced799e8dc..82f8120be1e1 100644
--- a/pkgs/games/xonotic/default.nix
+++ b/pkgs/games/xonotic/default.nix
@@ -204,7 +204,7 @@ let
             --add-needed ${libtheora}/lib/libtheora.so \
             $out/bin/xonotic-sdl
       '';
-
+    meta.platforms = lib.platforms.linux;
     meta.mainProgram = "xonotic-${
       if withSDL then
         "sdl"
diff --git a/pkgs/os-specific/linux/kernel/build.nix b/pkgs/os-specific/linux/kernel/build.nix
index 390238c89ba0..892d58b439cf 100644
--- a/pkgs/os-specific/linux/kernel/build.nix
+++ b/pkgs/os-specific/linux/kernel/build.nix
@@ -188,11 +188,13 @@ lib.makeOverridable (
       "pic"
     ];
 
-    ${if isModular then "outputs" else null} = [
+    # `dev` carries `vmlinux` (with its .BTF section) so that BPF consumers
+    # (e.g. systemd's nsresourced/mountfsd) can derive a matching vmlinux.h.
+    outputs = [
       "out"
       "dev"
-      "modules"
-    ];
+    ]
+    ++ lib.optional isModular "modules";
 
     # We remove a bunch of stuff that is symlinked from other places to save space,
     # which trips the broken symlink check. So, just skip it. We'll know if it explodes.
@@ -218,24 +220,73 @@ lib.makeOverridable (
           });
 
     buildFlags = [
-      "KBUILD_BUILD_VERSION=1-NixOS"
       target
-      "vmlinux" # for "perf" and things like that
       "scripts_gdb"
     ]
     ++ optional isModular "modules"
     ++ optionals buildDTBs [
       "dtbs"
-      "DTC_FLAGS=-@"
-    ]
-    ++ extraMakeFlags;
+    ];
 
     installFlags = [
       "INSTALL_PATH=${placeholder "out"}"
+
+      # All we really need to do here is copy the final image and System.map to $out,
+      # and use the kernel's modules_install, firmware_install, dtbs_install, etc. targets
+      # for the rest. Easy, right?
+      #
+      # Unfortunately for us, the obvious way of getting the built image path,
+      # make -s image_name, does not work correctly, because some architectures
+      # (*cough* aarch64 *cough*) change KBUILD_IMAGE on the fly in their install targets,
+      # so we end up attempting to install the thing we didn't actually build.
+      #
+      # Thankfully, there's a way out that doesn't involve just hardcoding everything.
+      #
+      # The kernel has an install target, which runs a pretty simple shell script
+      # (located at scripts/install.sh or arch/$arch/boot/install.sh, depending on
+      # which kernel version you're looking at) that tries to do something sensible.
+      #
+      # (it would be great to hijack this script immediately, as it has all the
+      #   information we need passed to it and we don't need it to try and be smart,
+      #   but unfortunately, the exact location of the scripts differs between kernel
+      #   versions, and they're seemingly not considered to be public API at all)
+      #
+      # One of the ways it tries to discover what "something sensible" actually is
+      # is by delegating to what's supposed to be a user-provided install script
+      # located at ~/bin/installkernel.
+      #
+      # (the other options are:
+      #   - a distribution-specific script at /sbin/installkernel,
+      #        which we can't really create in the sandbox easily
+      #   - an architecture-specific script at arch/$arch/boot/install.sh,
+      #        which attempts to guess _something_ and usually guesses very wrong)
+      #
+      # More specifically, the install script exec's into ~/bin/installkernel, if one
+      # exists, with the following arguments:
+      #
+      # $1: $KERNELRELEASE - full kernel version string
+      # $2: $KBUILD_IMAGE - the final image path
+      # $3: System.map - path to System.map file, seemingly hardcoded everywhere
+      # $4: $INSTALL_PATH - path to the destination directory as specified in installFlags
+      #
+      # $2 is exactly what we want, so hijack the script and use the knowledge given to it
+      # by the makefile overlords for our own nefarious ends.
+      #
+      # Note that the makefiles specifically look in ~/bin/installkernel, and
+      # writeShellScriptBin writes the script to <store path>/bin/installkernel,
+      # so HOME needs to be set to just the store path.
+      #
+      # FIXME: figure out a less roundabout way of doing this.
+      "HOME=${buildPackages.writeShellScriptBin "installkernel" ''
+        cp -av $2 $4
+        cp -av $3 $4
+      ''}"
+    ]
+    ++ optionals isModular [
+      "INSTALL_MOD_PATH=${placeholder "modules"}"
+      "INSTALL_MOD_STRIP=$(if $(dontStrip),,1)"
     ]
-    ++ (optional isModular "INSTALL_MOD_PATH=${placeholder "modules"}")
     ++ optionals buildDTBs [
-      "dtbs_install"
       "INSTALL_DTBS_PATH=${placeholder "out"}/dtbs"
     ];
 
@@ -271,11 +322,22 @@ lib.makeOverridable (
 
       # avoid leaking Rust source file names into the final binary, which adds
       # a false dependency on rust-lib-src on targets with uncompressed kernels
-      KRUSTFLAGS = lib.optionalString withRust "--remap-path-prefix ${rustPlatform.rustLibSrc}=/";
+      KRUSTFLAGS = lib.optionalString withRust (
+        "--remap-path-prefix ${rustPlatform.rustLibSrc}=/"
+        # Apply the equivalent of upstream commit
+        # dda135077ecc9f15c407f094dcfe7800376be867 to older versions to
+        # avoid cyclic output dependency issues when building
+        # uncompressed kernel images.
+        + lib.optionalString (lib.versionOlder version "7.0") " --remap-path-prefix=${placeholder "dev"}/lib/modules/${modDirVersion}/source/= --remap-path-scope=macro"
+      );
     };
 
     makeFlags = [
       "O=$(buildRoot)"
+      "KBUILD_BUILD_TIMESTAMP=@$(SOURCE_DATE_EPOCH)"
+      "KBUILD_BUILD_VERSION=1-NixOS"
+
+      "DTC_FLAGS=-@"
 
       # We have a `modules` variable in the environment for our
       # split output, but the kernel Makefiles also define their
@@ -290,16 +352,24 @@ lib.makeOverridable (
       # variable before any Makefiles are read, ensuring that the
       # kernel’s definition creates a new, unexported variable.
       "--eval=undefine modules"
+
+      # unset $src because the build system tries to use it and spams a bunch of warnings
+      # see: https://github.com/torvalds/linux/commit/b1992c3772e69a6fd0e3fc81cd4d2820c8b6eca0
+      "--eval=undefine src"
     ]
     ++ commonMakeFlags;
 
+    preUnpack = ''
+      mkdir -p "$dev/lib/modules/${modDirVersion}"
+      cd "$dev/lib/modules/${modDirVersion}"
+    '';
+
+    postUnpack = ''
+      mv -Tn "$sourceRoot" source
+      sourceRoot=source
+    '';
+
     postPatch = ''
-      # Ensure that depmod gets resolved through PATH
-      sed -i Makefile -e 's|= /sbin/depmod|= depmod|'
-
-      # Some linux-hardened patches now remove certain files in the scripts directory, so the file may not exist.
-      [[ -f scripts/ld-version.sh ]] && patchShebangs scripts/ld-version.sh
-
       # Set randstruct seed to a deterministic but diversified value. Note:
       # we could have instead patched gen-random-seed.sh to take input from
       # the buildFlags, but that would require also patching the kernel's
@@ -320,17 +390,13 @@ lib.makeOverridable (
       for i in $(find arch -name install.sh); do
           patchShebangs "$i"
       done
-
-      # unset $src because the build system tries to use it and spams a bunch of warnings
-      # see: https://github.com/torvalds/linux/commit/b1992c3772e69a6fd0e3fc81cd4d2820c8b6eca0
-      unset src
     '';
 
     configurePhase = ''
       runHook preConfigure
 
-      mkdir build
-      export buildRoot="$(pwd)/build"
+      export buildRoot="$NIX_BUILD_TOP/build"
+      mkdir -- "$buildRoot"
 
       echo "manual-config configurePhase buildRoot=$buildRoot pwd=$PWD"
 
@@ -345,71 +411,69 @@ lib.makeOverridable (
       make "''${makeFlags[@]}" oldconfig
       runHook postConfigure
 
-      make "''${makeFlags[@]}" prepare
+      make "''${makeFlags[@]}" include/config/kernel.release
       actualModDirVersion="$(cat $buildRoot/include/config/kernel.release)"
       if [ "$actualModDirVersion" != "${modDirVersion}" ]; then
         echo "Error: modDirVersion ${modDirVersion} specified in the Nix expression is wrong, it should be: $actualModDirVersion"
         exit 1
       fi
-
-      buildFlags+=("KBUILD_BUILD_TIMESTAMP=$(date -u -d @$SOURCE_DATE_EPOCH)")
-
-      cd $buildRoot
     '';
 
-    postInstall = optionalString isModular ''
-      mkdir -p $dev
-      cp vmlinux $dev/
+    postInstall = ''
+      # Keep some extra files.
+      shopt -s extglob
+      keepPaths=(
+        # Required for building external modules with BTF information.
+        "$buildRoot/vmlinux"
+        "$buildRoot/tools/bpf/resolve_btfids/resolve_btfids"
 
-      mkdir -p $dev/lib/modules/${modDirVersion}/build/scripts
-      # Installing from source dir instead of $buildRoot so as to omit intermediate artifacts.
-      cp -rL ../scripts/gdb/ $dev/lib/modules/${modDirVersion}/build/scripts
-      # Installing `constants.py` from `$buildRoot` as it's generated.
-      cp scripts/gdb/linux/constants.py $dev/lib/modules/${modDirVersion}/build/scripts/gdb/linux
+        # Possibly not required by anything, but we kept it before,
+        # Fedora and Arch keep it around, and it seems like it might be
+        # generally useful.
+        "$buildRoot/.config"
 
-      if [ -z "''${dontStrip-}" ]; then
-        installFlags+=("INSTALL_MOD_STRIP=1")
-      fi
-      make modules_install "''${makeFlags[@]}" "''${installFlags[@]}"
-      unlink $modules/lib/modules/${modDirVersion}/build
+        # Required for building external modules on some PowerPC
+        # configurations.
+        "$buildRoot/arch/powerpc/lib/crtsavres.o"
+      )
+      shopt -u extglob
 
-      mkdir -p $dev/lib/modules/${modDirVersion}/{build,source}
-
-      # To save space, exclude a bunch of unneeded stuff when copying.
-      (cd .. && rsync --archive --prune-empty-dirs \
-          --exclude='/build/' \
-          * $dev/lib/modules/${modDirVersion}/source/)
-
-      cd $dev/lib/modules/${modDirVersion}/source
-
-      cp $buildRoot/{.config,Module.symvers} $dev/lib/modules/${modDirVersion}/build
-      make modules_prepare "''${makeFlags[@]}" O=$dev/lib/modules/${modDirVersion}/build
-
-      # For reproducibility, removes accidental leftovers from a `cc1` call
-      # from a `try-run` call from the Makefile
-      rm -f $dev/lib/modules/${modDirVersion}/build/.[0-9]*.d
-
-      # Keep some extra files on some arches (powerpc, aarch64)
-      for f in arch/powerpc/lib/crtsavres.o arch/arm64/kernel/ftrace-mod.o; do
-        if [ -f "$buildRoot/$f" ]; then
-          mkdir -p "$(dirname $dev/lib/modules/${modDirVersion}/build/$f)"
-          cp $buildRoot/$f $dev/lib/modules/${modDirVersion}/build/$f
+      keepRoot=$(mktemp -d)
+      for path in "''${keepPaths[@]}"; do
+        if [[ -e $path ]]; then
+          keepPath=''${path/#"$buildRoot"/"$keepRoot"}
+          mkdir -p -- "''${keepPath%/*}"
+          mv -- "$path" "$keepPath"
         fi
       done
 
+      make "''${makeFlags[@]}" clean
+
+      find -- "$buildRoot" -type d -empty -delete
+      mv -- "$buildRoot" ..
+      buildRoot="$dev/lib/modules/${modDirVersion}/build"
+      cp -a -- "$keepRoot/." "$buildRoot/"
+
+      # Ensure that `KBUILD_OUTPUT` is set correctly in the retained
+      # build tree’s Makefile; otherwise e.g. the ZFS build breaks.
+      make "''${makeFlags[@]}" outputmakefile
+
+      ln -s "$buildRoot/vmlinux" "$dev/"
+
+      if [[ -v modules ]]; then
+        unlink $modules/lib/modules/${modDirVersion}/build
+      fi
+
       # !!! No documentation on how much of the source tree must be kept
       # If/when kernel builds fail due to missing files, you can add
       # them here. Note that we may see packages requiring headers
       # from drivers/ in the future; it adds 50M to keep all of its
       # headers on 3.10 though.
 
-      chmod u+w -R ..
-      buildArchDir="$dev/lib/modules/${modDirVersion}/build/arch"
-
       # Remove unused arches
       for d in $(cd arch/; ls); do
-        if [ -d "$buildArchDir/$d" ]; then continue; fi
-        if [ -d "$buildArchDir/arm64" ] && [ "$d" = arm ]; then continue; fi
+        if [ -d "$buildRoot/arch/$d" ]; then continue; fi
+        if [ -d "$buildRoot/arch/arm64" ] && [ "$d" = arm ]; then continue; fi
         rm -rf arch/$d
       done
 
@@ -438,69 +502,15 @@ lib.makeOverridable (
       find -empty -type d -delete
     '';
 
-    preInstall =
-      let
-        # All we really need to do here is copy the final image and System.map to $out,
-        # and use the kernel's modules_install, firmware_install, dtbs_install, etc. targets
-        # for the rest. Easy, right?
-        #
-        # Unfortunately for us, the obvious way of getting the built image path,
-        # make -s image_name, does not work correctly, because some architectures
-        # (*cough* aarch64 *cough*) change KBUILD_IMAGE on the fly in their install targets,
-        # so we end up attempting to install the thing we didn't actually build.
-        #
-        # Thankfully, there's a way out that doesn't involve just hardcoding everything.
-        #
-        # The kernel has an install target, which runs a pretty simple shell script
-        # (located at scripts/install.sh or arch/$arch/boot/install.sh, depending on
-        # which kernel version you're looking at) that tries to do something sensible.
-        #
-        # (it would be great to hijack this script immediately, as it has all the
-        #   information we need passed to it and we don't need it to try and be smart,
-        #   but unfortunately, the exact location of the scripts differs between kernel
-        #   versions, and they're seemingly not considered to be public API at all)
-        #
-        # One of the ways it tries to discover what "something sensible" actually is
-        # is by delegating to what's supposed to be a user-provided install script
-        # located at ~/bin/installkernel.
-        #
-        # (the other options are:
-        #   - a distribution-specific script at /sbin/installkernel,
-        #        which we can't really create in the sandbox easily
-        #   - an architecture-specific script at arch/$arch/boot/install.sh,
-        #        which attempts to guess _something_ and usually guesses very wrong)
-        #
-        # More specifically, the install script exec's into ~/bin/installkernel, if one
-        # exists, with the following arguments:
-        #
-        # $1: $KERNELRELEASE - full kernel version string
-        # $2: $KBUILD_IMAGE - the final image path
-        # $3: System.map - path to System.map file, seemingly hardcoded everywhere
-        # $4: $INSTALL_PATH - path to the destination directory as specified in installFlags
-        #
-        # $2 is exactly what we want, so hijack the script and use the knowledge given to it
-        # by the makefile overlords for our own nefarious ends.
-        #
-        # Note that the makefiles specifically look in ~/bin/installkernel, and
-        # writeShellScriptBin writes the script to <store path>/bin/installkernel,
-        # so HOME needs to be set to just the store path.
-        #
-        # FIXME: figure out a less roundabout way of doing this.
-        installkernel = buildPackages.writeShellScriptBin "installkernel" ''
-          cp -av $2 $4
-          cp -av $3 $4
-        '';
-      in
-      ''
-        installFlags+=("-j$NIX_BUILD_CORES")
-        export HOME=${installkernel}
-      '';
+    stripDebugList = [
+      "lib"
 
-    preFixup = ''
-      if [ -z "''${dontStrip-}" -a -e $out/vmlinux ]; then
-        $STRIP -v -S -p $out/vmlinux
-      fi
-    '';
+      # Only relevant for `$out/vmlinux` when that target is used; this
+      # doesn’t strip `$dev/vmlinux`, as it’s a symbolic link.
+      "vmlinux"
+    ];
+
+    stripExclude = [ "lib/modules/${modDirVersion}/build/vmlinux" ];
 
     requiredSystemFeatures = [ "big-parallel" ];
 
@@ -545,7 +555,9 @@ lib.makeOverridable (
         else
           "install"
       )
-    ];
+    ]
+    ++ lib.optionals isModular [ "modules_install" ]
+    ++ lib.optionals buildDTBs [ "dtbs_install" ];
 
     karch = stdenv.hostPlatform.linuxArch;
 
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 53008b3434e7..f0fbaa099d35 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -1539,8 +1539,8 @@ let
             SPARSEMEM = yes;
 
             # Bump the maximum number of CPUs to support systems like EC2 x1.*
-            # instances and Xeon Phi.
-            NR_CPUS = freeform "384";
+            # instances and Xeon Phi or AMD EPYC.
+            NR_CPUS = freeform "512";
 
             # Enable LEDS to display link-state status of PHY devices (i.e. eth lan/wan interfaces)
             LED_TRIGGER_PHY = yes;
diff --git a/pkgs/os-specific/linux/kernel/ebpf-headers.nix b/pkgs/os-specific/linux/kernel/ebpf-headers.nix
new file mode 100644
index 000000000000..559f237d62d2
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/ebpf-headers.nix
@@ -0,0 +1,29 @@
+{
+  lib,
+  bpftools,
+  kernel,
+  runCommand,
+}:
+
+# BTF is architecture-independent, so the extraction can run on the build
+# machine even when the kernel targets another architecture.
+runCommand "linux-${kernel.version}-ebpf-headers"
+  {
+    nativeBuildInputs = [ bpftools ];
+
+    passthru = {
+      inherit kernel;
+    };
+
+    meta = {
+      description = "vmlinux.h (kernel BTF) for BPF programs, from Linux ${kernel.version}";
+      homepage = "https://docs.kernel.org/bpf/btf.html";
+      license = lib.licenses.gpl2Only;
+      platforms = lib.platforms.linux;
+      teams = [ lib.teams.linux-kernel ];
+    };
+  }
+  ''
+    mkdir -p $out
+    bpftool btf dump file ${kernel.dev}/vmlinux format c > $out/vmlinux.h
+  ''
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 284f3f1e1820..5790a2daeec7 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -162,7 +162,6 @@ lib.makeOverridable (
 
     configfile = stdenv.mkDerivation {
       inherit
-        ignoreConfigErrors
         autoModules
         preferBuiltin
         kernelArch
@@ -173,22 +172,12 @@ lib.makeOverridable (
 
       generateConfig = ./generate-config.pl;
 
-      depsBuildBuild = [ buildPackages.stdenv.cc ];
-      nativeBuildInputs = [
-        perl
-        gmp
-        libmpc
-        mpfr
-        bison
-        flex
-      ]
-      ++ lib.optional (lib.versionAtLeast version "5.2") pahole
-      ++ lib.optionals withRust [
-        rust-bindgen-unwrapped
-        rustc-unwrapped
-      ];
+      inherit (kernel) depsBuildBuild nativeBuildInputs;
 
-      env.RUST_LIB_SRC = lib.optionalString withRust rustPlatform.rustLibSrc;
+      env = {
+        RUST_LIB_SRC = lib.optionalString withRust rustPlatform.rustLibSrc;
+        inherit ignoreConfigErrors;
+      };
 
       makeFlags = import ./common-flags.nix {
         inherit
@@ -205,8 +194,6 @@ lib.makeOverridable (
         sed -e '/fflush(stdout);/i\printf("###");' -i scripts/kconfig/conf.c
       '';
 
-      preUnpack = kernel.preUnpack or "";
-
       inherit (kernel) src patches;
 
       buildPhase =
@@ -221,17 +208,16 @@ lib.makeOverridable (
           export buildRoot="''${buildRoot:-build}"
 
           # Get a basic config file for later refinement with $generateConfig.
-          make $makeFlags \
+          make "''${makeFlags[@]}" \
               -C . O="$buildRoot" ${kernelBaseConfig} \
               ARCH=$kernelArch CROSS_COMPILE=${stdenv.cc.targetPrefix} \
-              $makeFlags
 
           # Create the config file.
           echo "generating kernel configuration..."
           ln -s "${kernelIntermediateConfig}" "$buildRoot/kernel-config"
           DEBUG=1 ARCH=$kernelArch CROSS_COMPILE=${stdenv.cc.targetPrefix} \
             KERNEL_CONFIG="$buildRoot/kernel-config" AUTO_MODULES=$autoModules \
-            PREFER_BUILTIN=$preferBuiltin BUILD_ROOT="$buildRoot" SRC=. MAKE_FLAGS="$makeFlags" \
+            PREFER_BUILTIN=$preferBuiltin BUILD_ROOT="$buildRoot" SRC=. MAKE_FLAGS="''${makeFlags[*]@Q}" \
             perl -w $generateConfig
         ''
         + lib.optionalString stdenv.cc.isClang ''
@@ -257,6 +243,8 @@ lib.makeOverridable (
 
       enableParallelBuilding = true;
 
+      __structuredAttrs = true;
+
       passthru = rec {
         module = import ../../../../nixos/modules/system/boot/kernel_config.nix;
         # used also in apache
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index f18f063c3fe6..4d2fed9dbe0b 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -20,13 +20,13 @@
         "lts": true
     },
     "6.18": {
-        "version": "6.18.55",
-        "hash": "sha256:1yadaa2gz74nh3pawpwv6lamalnd7wpiv1xb88pw2rd1c606647l",
+        "version": "6.18.56",
+        "hash": "sha256:12dzxyn3ljxg65ajcik95v3mjrqx8lv1417lg8maypmr5bdbncs6",
         "lts": true
     },
     "7.2": {
-        "version": "7.2.9",
-        "hash": "sha256:1fnqp28vrikz9gqhb42k0dsggqf8i07j0s9qy33scr53a6zdzidl",
+        "version": "7.2.10",
+        "hash": "sha256:1wzbyb7kh1c5aj073nd38npq3q38h66hgjd5wqdm87z9ac2agsig",
         "lts": false
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index 7106cca710db..698d447beffe 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -15,14 +15,14 @@ let
   variants = {
     # ./update-xanmod.sh lts
     lts = {
-      version = "6.18.55";
-      hash = "sha256-iaXQh/16QepauEYqDTrDpb2nR/pYpXVFbjAh4PFbf4Q=";
+      version = "6.18.56";
+      hash = "sha256-kUTu56sFisfwyJfa0svToWAEkDBhPmNQbBNWkidBRLM=";
       isLTS = true;
     };
     # ./update-xanmod.sh main
     main = {
-      version = "7.2.9";
-      hash = "sha256-BQU4U4YdDVxUGasAiCgoZ7jWMkPcTfkHDiimyKIhwQ4=";
+      version = "7.2.10";
+      hash = "sha256-mix9hVthsoqJdf/2vZ/qltl2wb+yIMw8Kw6o5rkkzQg=";
     };
   };
 
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 958c424ba30e..b2e9e731c107 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -80,6 +80,10 @@
   bpftools,
   libbpf,
 
+  # vmlinux.h (kernel BTF) for the systemd BPF programs.
+  # This is used for the linuxPackages*.systemd packages.
+  vmlinux-btf ? null,
+
   # Needed to produce a ukify that works for cross compiling UKIs.
   targetPackages,
 
@@ -158,6 +162,10 @@
   # attempt to load a service which does not exist, resulting in errors.
   withUtmp ? !stdenv.hostPlatform.isMusl,
   withVmspawn ? true,
+  # The BPF programs backing nsresourced/mountfsd need a vmlinux.h, which is
+  # only available when a kernel BTF is provided (see vmlinux-btf above).
+  withNsresourced ? withLibBPF && vmlinux-btf != null,
+  withMountfsd ? withLibBPF && vmlinux-btf != null,
   # kernel-install shouldn't usually be used on NixOS, but can be useful, e.g. for
   # building disk images for non-NixOS systems. To save users from trying to use it
   # on their live NixOS system, we disable it by default.
@@ -186,6 +194,8 @@ assert withHomed -> withPam;
 assert withHomed -> withOpenSSL;
 assert withFido2 -> withOpenSSL;
 assert withSysupdate -> withOpenSSL;
+assert withNsresourced -> withLibBPF;
+assert withMountfsd -> withLibBPF;
 assert withImportd -> (withGcrypt || withOpenSSL);
 assert withUkify -> (withEfi && withBootloader);
 assert withRepart -> withCryptsetup;
@@ -559,6 +569,16 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonBool "smack" true)
     (lib.mesonBool "b_pie" true)
   ]
+  ++ lib.optionals withNsresourced [
+    (lib.mesonBool "nsresourced" withNsresourced)
+  ]
+  ++ lib.optionals withMountfsd [
+    (lib.mesonBool "mountfsd" withMountfsd)
+  ]
+  ++ lib.optionals (withLibBPF && vmlinux-btf != null) [
+    (lib.mesonOption "vmlinux-h" "provided")
+    (lib.mesonOption "vmlinux-h-path" "${vmlinux-btf}/vmlinux.h")
+  ]
   ++ lib.optionals withVConsole [
     (lib.mesonOption "loadkeys-path" "${kbd}/bin/loadkeys")
     (lib.mesonOption "setfont-path" "${kbd}/bin/setfont")
@@ -710,6 +730,8 @@ stdenv.mkDerivation (finalAttrs: {
       withLogind
       withMachined
       withNetworkd
+      withNsresourced
+      withMountfsd
       withNspawn
       withRepart
       withPortabled
@@ -804,6 +826,7 @@ stdenv.mkDerivation (finalAttrs: {
           systemd
           systemd-analyze
           systemd-bpf
+          systemd-nsresourced-mountfsd
           systemd-confinement
           systemd-coredump
           systemd-cryptenroll
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/tankerkoenig-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/tankerkoenig-card/package.nix
index 157b03edab84..0ef45e28059a 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/tankerkoenig-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/tankerkoenig-card/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "tankerkoenig-card";
-  version = "1.9.1";
+  version = "1.9.2";
 
   src = fetchFromGitHub {
     owner = "timmaurice";
     repo = "lovelace-tankerkoenig-card";
     tag = finalAttrs.version;
-    hash = "sha256-XSeTrmnGQ5O711z99ELzVIh06pHEyw4GXksuxkkfCpA=";
+    hash = "sha256-CLO6kQXm+Xbsi5hJLjT9I/xYg8mEptFqdRSw56CGuaE=";
   };
 
-  npmDepsHash = "sha256-ewTbWFTnT/yz13CT0UIuW0PHLr2hDqfO66z8H0jzdAQ=";
+  npmDepsHash = "sha256-PvljUtxp7mbUqSZ/0ynTjMo3rlPXvhWFMJ5UJk6jrVw=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/servers/http/apache-modules/mod_crl/default.nix b/pkgs/servers/http/apache-modules/mod_crl/default.nix
index eb840288de78..24d8f25c1882 100644
--- a/pkgs/servers/http/apache-modules/mod_crl/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_crl/default.nix
@@ -9,12 +9,12 @@
   stdenv,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mod_crl";
   version = "0.2.4";
 
   src = fetchurl {
-    url = "https://redwax.eu/dist/rs/${pname}-${version}.tar.gz";
+    url = "https://redwax.eu/dist/rs/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
     hash = "sha256-w8YIhed9J1uo5uwhfOVe5LhNLUvFZCgUO4FrHm344Rg=";
   };
 
@@ -40,4 +40,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ dirkx ];
   };
-}
+})
diff --git a/pkgs/servers/http/apache-modules/mod_csr/default.nix b/pkgs/servers/http/apache-modules/mod_csr/default.nix
index 5e8b8faa6b40..f4fabdcd616b 100644
--- a/pkgs/servers/http/apache-modules/mod_csr/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_csr/default.nix
@@ -9,12 +9,12 @@
   stdenv,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mod_csr";
   version = "0.2.4";
 
   src = fetchurl {
-    url = "https://redwax.eu/dist/rs/${pname}-${version}.tar.gz";
+    url = "https://redwax.eu/dist/rs/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
     hash = "sha256-JVd5N5UnAxDwq6AavEHA0HsY2TRa+9RmLLJeRZbj+4Q=";
   };
 
@@ -40,4 +40,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ dirkx ];
   };
-}
+})
diff --git a/pkgs/servers/http/apache-modules/mod_ocsp/default.nix b/pkgs/servers/http/apache-modules/mod_ocsp/default.nix
index 92bdbcee2fa9..9a8502c13deb 100644
--- a/pkgs/servers/http/apache-modules/mod_ocsp/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_ocsp/default.nix
@@ -9,12 +9,12 @@
   stdenv,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mod_ocsp";
   version = "0.2.3";
 
   src = fetchurl {
-    url = "https://redwax.eu/dist/rs/${pname}-${version}.tar.gz";
+    url = "https://redwax.eu/dist/rs/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
     hash = "sha256-G+m/KdJCCTlSMeJzUnCRJkBEQ8cOQ+rJhA3NPrwh1Us=";
   };
 
@@ -40,4 +40,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ dirkx ];
   };
-}
+})
diff --git a/pkgs/servers/http/apache-modules/mod_perl/default.nix b/pkgs/servers/http/apache-modules/mod_perl/default.nix
index 4c08d2aaf22d..b6dd43ce4fe3 100644
--- a/pkgs/servers/http/apache-modules/mod_perl/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_perl/default.nix
@@ -8,12 +8,12 @@
   stdenv,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mod_perl";
   version = "2.0.13";
 
   src = fetchurl {
-    url = "mirror://apache/perl/${pname}-${version}.tar.gz";
+    url = "mirror://apache/perl/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
     sha256 = "sha256-reO+McRHuESIaf7N/KziWNbVh7jGx3PF8ic19w2C1to=";
   };
 
@@ -55,4 +55,4 @@ stdenv.mkDerivation rec {
     maintainers = [ ];
     platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/servers/http/apache-modules/mod_pkcs12/default.nix b/pkgs/servers/http/apache-modules/mod_pkcs12/default.nix
index d7a216b6ee07..f6bab9b9b78b 100644
--- a/pkgs/servers/http/apache-modules/mod_pkcs12/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_pkcs12/default.nix
@@ -9,12 +9,12 @@
   stdenv,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mod_pkcs12";
   version = "0.2.3";
 
   src = fetchurl {
-    url = "https://redwax.eu/dist/rs/${pname}-${version}.tar.gz";
+    url = "https://redwax.eu/dist/rs/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
     hash = "sha256-k7BZ5d0WigyTmoUyFds7UCJ/tFBiUxd5pS4cVxmAI1g=";
   };
 
@@ -40,4 +40,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ dirkx ];
   };
-}
+})
diff --git a/pkgs/servers/http/nginx/modules/vod/package.nix b/pkgs/servers/http/nginx/modules/vod/package.nix
index 564dba5c8ec3..04f4e660eea1 100644
--- a/pkgs/servers/http/nginx/modules/vod/package.nix
+++ b/pkgs/servers/http/nginx/modules/vod/package.nix
@@ -12,13 +12,13 @@
 
 mkNginxPlugin (finalAttrs: {
   pname = "vod";
-  version = "1.10.0";
+  version = "1.10.1";
 
   src = fetchFromGitHub {
     owner = "dio-az";
     repo = "nginx-vod-module";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1c9KyxZq45/AsAg9wRUD+RWfTgrCOJJwAceFYNXnVsU=";
+    hash = "sha256-DuQ6648BHhjTUsCEYmcgl8nWgwwRy8PNzgzQwthiDZk=";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/http/tomcat/tomcat-native.nix b/pkgs/servers/http/tomcat/tomcat-native.nix
index 4691081c523f..e292da8a3dfe 100644
--- a/pkgs/servers/http/tomcat/tomcat-native.nix
+++ b/pkgs/servers/http/tomcat/tomcat-native.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tomcat-native";
-  version = "2.0.15";
+  version = "2.0.16";
 
   src = fetchurl {
     url = "mirror://apache/tomcat/tomcat-connectors/native/${version}/source/${pname}-${version}-src.tar.gz";
-    hash = "sha256-jasJ8hrVGcnknlKH+NjeibsXal45aEefJ5SMMbKjtrQ=";
+    hash = "sha256-eF/dmaIC9EKwhbxxjS++s5O4WXmqSilDMCEYxKzWhjA=";
   };
 
   sourceRoot = "${pname}-${version}-src/native";
diff --git a/pkgs/servers/sql/postgresql/ext/pg-semver.nix b/pkgs/servers/sql/postgresql/ext/pg-semver.nix
index 1f598447f027..287aa4d31bbc 100644
--- a/pkgs/servers/sql/postgresql/ext/pg-semver.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg-semver.nix
@@ -8,13 +8,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "pg-semver";
-  version = "0.41.0";
+  version = "0.42.0";
 
   src = fetchFromGitHub {
     owner = "theory";
     repo = "pg-semver";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-b/fXPOPjjwSAy4GlyHjZsPVFEvdYYO4qkwFAfrmY+OE=";
+    hash = "sha256-PxhywN53nTkvu7Uvc12UUFVrjYQ7fosd5J4ple7LSoU=";
   };
 
   passthru.tests = {
diff --git a/pkgs/servers/sql/postgresql/ext/pg_bigm.nix b/pkgs/servers/sql/postgresql/ext/pg_bigm.nix
index 1cf6ea0a1547..2635113d73c2 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_bigm.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_bigm.nix
@@ -20,7 +20,7 @@ postgresqlBuildExtension (finalAttrs: {
 
   meta = {
     description = "Text similarity measurement and index searching based on bigrams";
-    homepage = "https://pgbigm.osdn.jp/";
+    homepage = "https://github.com/pgbigm/pg_bigm";
     maintainers = [ ];
     platforms = postgresql.meta.platforms;
     license = lib.licenses.postgresql;
diff --git a/pkgs/servers/sql/postgresql/ext/wal2json.nix b/pkgs/servers/sql/postgresql/ext/wal2json.nix
index 44a54bf17a9e..3aa405eb52b2 100644
--- a/pkgs/servers/sql/postgresql/ext/wal2json.nix
+++ b/pkgs/servers/sql/postgresql/ext/wal2json.nix
@@ -9,13 +9,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "wal2json";
-  version = "2.6";
+  version = "2.7";
 
   src = fetchFromGitHub {
     owner = "eulerto";
     repo = "wal2json";
     tag = "wal2json_${lib.replaceString "." "_" finalAttrs.version}";
-    hash = "sha256-+QoACPCKiFfuT2lJfSUmgfzC5MXf75KpSoc2PzPxKyM=";
+    hash = "sha256-9MgrR5szMoFskiyG162AuqNw3k+YznN/sjIAScLFP/8=";
   };
 
   makeFlags = [ "USE_PGXS=1" ];
diff --git a/pkgs/servers/web-apps/wordpress/default.nix b/pkgs/servers/web-apps/wordpress/default.nix
index e8087365d306..e2cc6a34e315 100644
--- a/pkgs/servers/web-apps/wordpress/default.nix
+++ b/pkgs/servers/web-apps/wordpress/default.nix
@@ -2,15 +2,15 @@
 builtins.mapAttrs (_: callPackage ./generic.nix) rec {
   wordpress = wordpress_7_1;
   wordpress_6_9 = {
-    version = "6.9.9";
-    hash = "sha256-MiMbmsvnY6hhOOi7t7XE8/EjvsnWX8OJi8s7ZFBqc1g=";
+    version = "6.9.10";
+    hash = "sha256-ocDcEuInHGr6q/Mp1a96l2+NLIxZJ3MXiluq6vwtT0o=";
   };
   wordpress_7_0 = {
-    version = "7.0.6";
-    hash = "sha256-W+/iSslL8f8YKSoaHzD9DHEbAJ+Rz9ytqo/rbgr6dc0=";
+    version = "7.0.7";
+    hash = "sha256-5PEraQhT5M9lqmdNAYU21cRqWGmDE8WZfKDF0sa4ug0=";
   };
   wordpress_7_1 = {
-    version = "7.1.2";
-    hash = "sha256-wMZmaJ1muHDYglUAu45ALtBN5SYCxhpvUWxiNrjJrGc=";
+    version = "7.1.3";
+    hash = "sha256-0qCay2oV47nEcdclV3U8Jm1vQaee0Zv+BMv+SeKDsqU=";
   };
 }
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 6d9b64d53b6d..66cee724da4f 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -214,12 +214,12 @@ lib.makeExtensible (
           src = fetchFromGitHub {
             owner = "NixOS";
             repo = "nix";
-            rev = "203f85b2e851fc52e253e8e33eff5fb92936736a";
-            hash = "sha256-ahm58Y+ASv19VGVzC2IwNsQpkVR8rgEwwHDYwnMadkI=";
+            rev = "979a87c97bef7b96cd4ec4b142188089851e47ad";
+            hash = "sha256-B9oFHwWHisWIvsjo7jeoke0OzxRYZYFhpBm/ancphUk=";
           };
         in
         (nixDependencies.callPackage ./modular/packages.nix {
-          version = "2.36pre20260912_${lib.substring 0 8 src.rev}";
+          version = "2.36pre20261010_${lib.substring 0 8 src.rev}";
           inherit teams;
           otherSplices = generateSplicesForNixComponents "nixComponents_git";
           src = removeFunctionalTests commonDisabledTests src;
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index a567eb21d2bf..b50cb5171c17 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -721,6 +721,8 @@ mapAliases {
   dleyna-renderer = throw "'dleyna-renderer' has been renamed to/replaced by 'dleyna'"; # Converted to throw 2025-10-27
   dleyna-server = throw "'dleyna-server' has been renamed to/replaced by 'dleyna'"; # Converted to throw 2025-10-27
   dnscrypt-proxy2 = throw "'dnscrypt-proxy2' has been renamed to/replaced by 'dnscrypt-proxy'"; # Converted to throw 2025-10-27
+  dnslink-std-go = throw "'dnslink-std-go' has been removed as it is broken, unmaintained, and upstream archived the project in July 2026"; # Added 2026-09-18
+  dnsmon-go = throw "'dnsmon-go' has been removed because upstream archived the project in August 2025."; # Added 2026-09-02
   docker-distribution = throw "'docker-distribution' has been renamed to/replaced by 'distribution'"; # Converted to throw 2025-10-27
   docker-machine-hyperkit = throw "docker-machine-hyperkit has been removed as it only supported x86_64-darwin"; # Added 2026-07-12
   docker-sync = throw "'docker-sync' has been removed because it was broken and unmaintained"; # Added 2025-08-26
@@ -1102,6 +1104,7 @@ mapAliases {
   godot_4-export-templates = throw "'godot_4-export-templates' has been renamed to/replaced by 'godot_4-export-templates-bin'"; # Converted to throw 2025-10-27
   godot_4_3-export-templates = throw "'godot_4_3-export-templates' has been renamed to/replaced by 'godot_4_3-export-templates-bin'"; # Converted to throw 2025-10-27
   godot_4_4-export-templates = throw "'godot_4_4-export-templates' has been renamed to/replaced by 'godot_4_4-export-templates-bin'"; # Converted to throw 2025-10-27
+  gohai = throw "'gohai' has been removed because upstream archived the project in November 2023."; # Added 2026-09-02
   goldendict = throw "'goldendict' has been removed as upstream goldendict/goldendict is unmaintained and depends on deprecated qtwebkit; use the actively-developed Qt6 fork 'goldendict-ng' instead"; # Added 2026-04-26
   goldwarden = throw "'goldwarden' has been removed, as it no longer works with new Bitwarden versions and is abandoned upstream"; # Added 2025-09-16
   gomuks = throw "'gomuks' has been removed as the old terminal client was discontinued. Consider using `gomuks-web` or `gomuks-desktop` instead."; # Added 2026-09-12
@@ -1130,6 +1133,7 @@ mapAliases {
   graphia = throw "'graphia' has been removed due to being unmaintained and broken"; # Added 2026-05-05
   graphite-gtk-theme = throw "'graphite-gtk-theme' has been removed because it depended on 'gtk-engine-murrine', which was removed because it was unmaintained upstream and depended on GTK 2."; # Added 2026-07-22
   graphite-kde-theme = throw "'graphite-kde-theme' has been removed, as it is only compatible with Plasma 5, which is EOL"; # Added 2025-08-20
+  gravit = throw "'gravit' has been removed, as it has been unmaintained upstream since June 2022"; # Added 2026-10-11
   grepm = throw "'grepm' has been removed as it was unmaintained"; # Added 2026-09-20
   grig = throw "'grig' has been removed as it depended on the deprecated GTK 2 engine."; # Added 2026-08-14
   gringo = throw "'gringo' has been renamed to/replaced by 'clingo'"; # Converted to throw 2025-10-27
@@ -1468,6 +1472,7 @@ mapAliases {
   libubox-wolfssl = throw "'libubox-wolfssl' has been removed, use 'libubox' or 'libubox-mbedtls'"; # Added 2026-03-29
   libuinputplus = throw "'libuinputplus' has been removed, as it was unmaintained upstream since 2021, no longer builds, and is no longer used by anything"; # Added 2025-11-02
   libunique = throw "'libunique' has been removed, as it depended on the deprecated GTK2 engine."; # Added 2026-08-11
+  libunity = throw "'libunity' has been removed as it is no longer required and is unmaintained"; # Added 2026-10-04
   libva1 = throw "'libva1' has been removed, as it is no longer required. Please use libva."; # Added 2026-05-14
   libva1-minimal = throw "'libva1-minimal' has been removed, as it is no longer required. Please use libva-minimal."; # Added 2026-05-14
   libviper = throw "'libviper' was removed as it is broken and not maintained upstream"; # Added 2025-05-17
@@ -2190,6 +2195,7 @@ mapAliases {
   psi = throw "'psi' has been removed as it depended on EOL qt5 webengine. Consider moving to psi-plus, a somewhat more maintained fork."; # Added 2026-04-15
   publii = throw "'publii' has been removed due to lack of maintence in nixpkgs and using an EOL Electron"; # Added 2026-09-17
   pulp = throw "'pulp' has been removed because it was unmaintained upstream"; # Added 2025-12-12
+  pulseaudio-dlna = throw "'pulseaudio-dlna' has been removed because its upstream fork is inactive and Debian removed it as RC-buggy; use 'pa-dlna' instead."; # Added 2026-09-02
   puppet = warnAlias "'puppet' has been replaced by 'openvox'" openvox; # Added 2026-07-07
   purescript-psa = throw "'purescript-psa' has been removed because it was unmaintained within nixpkgs"; # Added 2025-12-12
   purple-discord = throw "'purple-discord' has been renamed to/replaced by 'pidginPackages.purple-discord'"; # Converted to throw 2025-10-27
@@ -3210,6 +3216,7 @@ mapAliases {
   zq = throw "zq has been replaced by super"; # Converted to throw 2025-10-26
   zscroll = throw "zscroll has been removed due to lack of maintenance."; # Added 2026-05-29
   zsh-git-prompt = throw "zsh-git-prompt was removed as it is unmaintained upstream"; # Added 2025-08-28
+  zsh-powerlevel9k = throw "'zsh-powerlevel9k' has been removed because Powerlevel9k is archived and unmaintained; use 'zsh-powerlevel10k' instead."; # Added 2026-09-02
   zuki-themes = throw "'zuki-themes' has been removed because it depended on 'gtk-engine-murrine', which was removed because it was unmaintained upstream and depended on GTK 2."; # Added 2026-07-22
   zulu23 = throw "Zulu OpenJDK 23 was removed as it has reached its end of life"; # Added 2025-11-14
   zulu24 = throw "Zulu OpenJDK 24 was removed as it has reached its end of life"; # Added 2025-11-14
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8cc3584fd6e7..f7cc56a27ae1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1842,7 +1842,7 @@ with pkgs;
 
   cudaPackages_13 = cudaPackages_13_4;
 
-  cudaPackages = recurseIntoAttrs cudaPackages_12;
+  cudaPackages = recurseIntoAttrs cudaPackages_13;
 
   dconf2nix = callPackage ../development/tools/haskell/dconf2nix { };
 
@@ -3350,84 +3350,99 @@ with pkgs;
     }
   );
 
-  gnat14 = wrapCC (
-    gcc14.cc.override {
-      name = "gnat";
-      langC = true;
-      langCC = false;
-      langAda = true;
-      profiledCompiler = false;
-      # As per upstream instructions building a cross compiler
-      # should be done with a (native) compiler of the same version.
-      # If we are cross-compiling GNAT, we may as well do the same.
-      gnat-bootstrap =
-        if stdenv.hostPlatform == stdenv.targetPlatform && stdenv.buildPlatform == stdenv.hostPlatform then
-          buildPackages.gnat-bootstrap14
-        else
-          buildPackages.gnat14;
-      stdenv =
-        if
-          stdenv.hostPlatform == stdenv.targetPlatform
-          && stdenv.buildPlatform == stdenv.hostPlatform
-          && stdenv.buildPlatform.isDarwin
-        then
-          overrideCC gccStdenv gnat-bootstrap14
-        else
-          stdenv;
+  gnat14 = wrapCCWith (
+    {
+      cc = gcc14.cc.override {
+        name = "gnat";
+        langC = true;
+        langCC = false;
+        langAda = true;
+        profiledCompiler = false;
+        # As per upstream instructions building a cross compiler
+        # should be done with a (native) compiler of the same version.
+        # If we are cross-compiling GNAT, we may as well do the same.
+        gnat-bootstrap =
+          if stdenv.hostPlatform == stdenv.targetPlatform && stdenv.buildPlatform == stdenv.hostPlatform then
+            buildPackages.gnat-bootstrap14
+          else
+            buildPackages.gnat14;
+        stdenv =
+          if
+            stdenv.hostPlatform == stdenv.targetPlatform
+            && stdenv.buildPlatform == stdenv.hostPlatform
+            && stdenv.buildPlatform.isDarwin
+          then
+            overrideCC gccStdenv gnat-bootstrap14
+          else
+            stdenv;
+      };
+    }
+    // lib.optionalAttrs stdenv.targetPlatform.isDarwin {
+      apple-sdk = apple-sdk_15;
     }
   );
 
-  gnat15 = wrapCC (
-    gcc15.cc.override {
-      name = "gnat";
-      langC = true;
-      langCC = false;
-      langAda = true;
-      profiledCompiler = false;
-      # As per upstream instructions building a cross compiler
-      # should be done with a (native) compiler of the same version.
-      # If we are cross-compiling GNAT, we may as well do the same.
-      gnat-bootstrap =
-        if stdenv.hostPlatform == stdenv.targetPlatform && stdenv.buildPlatform == stdenv.hostPlatform then
-          buildPackages.gnat-bootstrap15
-        else
-          buildPackages.gnat15;
-      stdenv =
-        if
-          stdenv.hostPlatform == stdenv.targetPlatform
-          && stdenv.buildPlatform == stdenv.hostPlatform
-          && stdenv.buildPlatform.isDarwin
-        then
-          overrideCC gccStdenv gnat-bootstrap15
-        else
-          stdenv;
+  gnat15 = wrapCCWith (
+    {
+      cc = gcc15.cc.override {
+        name = "gnat";
+        langC = true;
+        langCC = false;
+        langAda = true;
+        profiledCompiler = false;
+        # As per upstream instructions building a cross compiler
+        # should be done with a (native) compiler of the same version.
+        # If we are cross-compiling GNAT, we may as well do the same.
+        gnat-bootstrap =
+          if stdenv.hostPlatform == stdenv.targetPlatform && stdenv.buildPlatform == stdenv.hostPlatform then
+            buildPackages.gnat-bootstrap15
+          else
+            buildPackages.gnat15;
+        stdenv =
+          if
+            stdenv.hostPlatform == stdenv.targetPlatform
+            && stdenv.buildPlatform == stdenv.hostPlatform
+            && stdenv.buildPlatform.isDarwin
+          then
+            overrideCC gccStdenv gnat-bootstrap15
+          else
+            stdenv;
+      };
+    }
+    // lib.optionalAttrs stdenv.targetPlatform.isDarwin {
+      apple-sdk = apple-sdk_15;
     }
   );
 
-  gnat16 = wrapCC (
-    gcc16.cc.override {
-      name = "gnat";
-      langC = true;
-      langCC = false;
-      langAda = true;
-      profiledCompiler = false;
-      # As per upstream instructions building a cross compiler
-      # should be done with a (native) compiler of the same version.
-      # If we are cross-compiling GNAT, we may as well do the same.
-      gnat-bootstrap =
-        if stdenv.hostPlatform == stdenv.targetPlatform && stdenv.buildPlatform == stdenv.hostPlatform then
-          buildPackages.gnat-bootstrap16
-        else
-          buildPackages.gnat16;
-      stdenv =
-        if
-          stdenv.hostPlatform == stdenv.targetPlatform
-          && stdenv.buildPlatform == stdenv.hostPlatform
-          && stdenv.buildPlatform.isDarwin
-        then
-          overrideCC gccStdenv gnat-bootstrap16
-        else
-          stdenv;
+  gnat16 = wrapCCWith (
+    {
+      cc = gcc16.cc.override {
+        name = "gnat";
+        langC = true;
+        langCC = false;
+        langAda = true;
+        profiledCompiler = false;
+        # As per upstream instructions building a cross compiler
+        # should be done with a (native) compiler of the same version.
+        # If we are cross-compiling GNAT, we may as well do the same.
+        gnat-bootstrap =
+          if stdenv.hostPlatform == stdenv.targetPlatform && stdenv.buildPlatform == stdenv.hostPlatform then
+            buildPackages.gnat-bootstrap16
+          else
+            buildPackages.gnat16;
+        stdenv =
+          if
+            stdenv.hostPlatform == stdenv.targetPlatform
+            && stdenv.buildPlatform == stdenv.hostPlatform
+            && stdenv.buildPlatform.isDarwin
+          then
+            overrideCC gccStdenv gnat-bootstrap16
+          else
+            stdenv;
+      };
+    }
+    // lib.optionalAttrs stdenv.targetPlatform.isDarwin {
+      apple-sdk = apple-sdk_15;
     }
   );
 
@@ -7295,6 +7310,8 @@ with pkgs;
 
   nsdiff = perlPackages.nsdiff;
 
+  opencloud-production = callPackage ../by-name/op/opencloud/production.nix { };
+
   openresty = callPackage ../servers/http/openresty {
     zlib-ng = zlib;
     withPerl = false;
@@ -7837,6 +7854,7 @@ with pkgs;
     withImportd = false;
     withImds = false;
     withLibBPF = false;
+    vmlinux-btf = null;
     withLibidn2 = false;
     withLocaled = false;
     withLogind = false;
@@ -9734,9 +9752,7 @@ with pkgs;
 
   openraPackages = recurseIntoAttrs (callPackage ../by-name/op/openra/engines { });
 
-  papermcServers = callPackages ../games/papermc { };
-
-  papermc = papermcServers.papermc;
+  papermcServers = callPackage ../by-name/pa/papermc/versions.nix { };
 
   pokerth-server = pokerth.override { target = "server"; };
 
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index e639646e1b03..bf483fe0105d 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -206,6 +206,21 @@ in
       {
         inherit callPackage;
         kernel = kernel_;
+
+        # vmlinux.h derived from this kernel's BTF, for BPF consumers such as
+        # systemd's nsresourced/mountfsd.
+        # This derivation requires CONFIG_DEBUG_INFO_BTF-built kernel (this is
+        # the case in nixpkgs), otherwise it will fail.
+        ebpf-headers = callPackage ../os-specific/linux/kernel/ebpf-headers.nix {
+          inherit kernel;
+        };
+
+        # systemd compiled against this kernel's BTF, so its BPF programs
+        # (nsresourced/mountfsd, networkd) match the kernel that will run.
+        systemd = pkgs.systemd.override {
+          vmlinux-btf = self.ebpf-headers;
+        };
+
         inherit (kernel) stdenv; # in particular, use the same compiler by default
 
         # to help determine module compatibility
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 2017277d6ec3..a9ecc5c495e1 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -736,6 +736,7 @@ mapAliases {
   sqlalchemy-views = throw "'sqlalchemy-views' has been removed as it was broken and unmaintained upstream"; # Added 2025-11-09
   sqlalchemy_1_3 = throw "'sqlalchemy_1_3' has been removed because it was actually version 1.4.54"; # added 2026-07-20
   sqlalchemy_migrate = throw "'sqlalchemy_migrate' has been renamed to/replaced by 'sqlalchemy-migrate'"; # Converted to throw 2025-10-29
+  statistics = throw "'statistics' has been removed because it is unmaintained upstream"; # Added 2026-09-05
   steamship = throw "'steamship' has been removed because it is broken and unmaintained upstream"; # Added 2026-05-06
   steamworkspy = warnAlias "'steamworkspy' has been renamed to 'steamworks' to match the upstream distribution name" steamworks; # Added 2026-09-19
   stookalert = throw "'stookalert' has been removed because it is unmaintained upstream"; # Added 2026-08-04
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 0b97a62ab826..46aabeeefd87 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6145,6 +6145,8 @@ self: super: with self; {
 
   firebase-messaging = callPackage ../development/python-modules/firebase-messaging { };
 
+  firecrawl-anydoc = callPackage ../development/python-modules/firecrawl-anydoc { };
+
   firecrawl-py = callPackage ../development/python-modules/firecrawl-py { };
 
   firedrake = callPackage ../development/python-modules/firedrake { };
@@ -17551,6 +17553,8 @@ self: super: with self; {
 
   pyvista = callPackage ../development/python-modules/pyvista { };
 
+  pyvista-validation = callPackage ../development/python-modules/pyvista-validation { };
+
   pyviz-comms = callPackage ../development/python-modules/pyviz-comms { };
 
   pyvlx = callPackage ../development/python-modules/pyvlx { };
@@ -20061,8 +20065,6 @@ self: super: with self; {
 
   staticvectors = callPackage ../development/python-modules/staticvectors { };
 
-  statistics = callPackage ../development/python-modules/statistics { };
-
   statmake = callPackage ../development/python-modules/statmake { };
 
   statsd = callPackage ../development/python-modules/statsd { };