diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index 62569c217ac1..a46069a428f7 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -38,6 +38,10 @@
 - `zabbix.<package>` now defaults to version 7.4. If you want to keep using Zabbix 6.0, use `pkgs.zabbix60.<package>`.
   Note that Zabbix 6.0 is in limited support, and will be deprecated on February 28, 2027. Consider upgrading.
 
+- `zabbix-agent2-plugin-postgresql` is now moved to `zabbix{60,70,74}.plugins.postgresql`.
+
+- Official Zabbix plugins (ember-plus, mongodb, and mssql) have been added under `zabbix{60,70,74}.plugins.<plugin>`.
+
 - `perlPackages.NetOAuth` has been updated from 0.28 to 0.33.
   Callers that verify messages must now set `allowed_signature_methods` per message or configure `@Net::OAuth::ALLOWED_SIGNATURE_METHODS`; `verify` otherwise throws an exception.
   See the [upstream changelog](https://metacpan.org/dist/Net-OAuth/changes) for details.
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index eb87aa7e5776..7c09d9f3ebb1 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -28992,6 +28992,13 @@
     github = "thelissimus";
     githubId = 70096720;
   };
+  thelolcoder2007 = {
+    name = "thelolcoder2007";
+    github = "thelolcoder2007";
+    githubId = 52106896;
+    matrix = "@erents:dapperepoging.nl";
+    keys = [ { fingerprint = "E374 815F C754 462B 1C34  3562 FDC3 99DE 8F7E 200B"; } ];
+  };
   themadbit = {
     name = "Mark Tanui";
     email = "marktanui75@gmail.com";
diff --git a/nixos/modules/config/nix-channel.nix b/nixos/modules/config/nix-channel.nix
index 4d6e19975508..583052aebdb7 100644
--- a/nixos/modules/config/nix-channel.nix
+++ b/nixos/modules/config/nix-channel.nix
@@ -42,7 +42,7 @@ in
         };
       };
 
-      nixPath = mkOption {
+      settings.nix-path = mkOption {
         type = types.listOf types.str;
         default =
           if cfg.channel.enable then
@@ -80,8 +80,11 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  imports = [
+    (lib.mkRenamedOptionModule [ "nix" "nixPath" ] [ "nix" "settings" "nix-path" ])
+  ];
 
+  config = mkIf cfg.enable {
     environment.extraInit = mkIf cfg.channel.enable ''
       if [ -e "$HOME/.nix-defexpr/channels" ]; then
         export NIX_PATH="$HOME/.nix-defexpr/channels''${NIX_PATH:+:$NIX_PATH}"
@@ -95,7 +98,7 @@ in
     # NIX_PATH has a non-empty default according to Nix docs, so we don't unset
     # it when empty.
     environment.sessionVariables = {
-      NIX_PATH = cfg.nixPath;
+      NIX_PATH = cfg.settings.nix-path;
     };
 
     systemd.tmpfiles.rules = lib.mkIf cfg.channel.enable [
diff --git a/nixos/modules/misc/nixpkgs-flake.nix b/nixos/modules/misc/nixpkgs-flake.nix
index 10549999fd7b..d192c3e1735d 100644
--- a/nixos/modules/misc/nixpkgs-flake.nix
+++ b/nixos/modules/misc/nixpkgs-flake.nix
@@ -102,7 +102,7 @@ in
         # because we would need some kind of evil shim taking the *calling* flake's self path,
         # perhaps, to ever make that work (in order to know where the Nix expr for the system came
         # from and how to call it).
-        nix.nixPath = lib.mkDefault (
+        nix.settings.nix-path = lib.mkDefault (
           [ "nixpkgs=flake:nixpkgs" ]
           ++ lib.optional config.nix.channel.enable "/nix/var/nix/profiles/per-user/root/channels"
         );
diff --git a/nixos/modules/services/monitoring/beszel-agent.nix b/nixos/modules/services/monitoring/beszel-agent.nix
index e1ac8ffe25f6..756d729f8cef 100644
--- a/nixos/modules/services/monitoring/beszel-agent.nix
+++ b/nixos/modules/services/monitoring/beszel-agent.nix
@@ -136,6 +136,7 @@ in
       path =
         cfg.extraPath
         ++ lib.optionals cfg.smartmon.enable [ cfg.smartmon.package ]
+        ++ lib.optionals config.boot.zfs.enabled [ config.boot.zfs.package ]
         ++ lib.optionals (builtins.elem "nvidia" config.services.xserver.videoDrivers) [
           (lib.getBin config.hardware.nvidia.package)
         ]
@@ -182,9 +183,9 @@ in
 
         LockPersonality = true;
         NoNewPrivileges = !cfg.smartmon.enable;
-        PrivateDevices = !cfg.smartmon.enable;
+        PrivateDevices = !cfg.smartmon.enable && !config.boot.zfs.enabled;
         PrivateTmp = true;
-        PrivateUsers = !cfg.smartmon.enable && !cfg.environment.SKIP_SYSTEMD;
+        PrivateUsers = !cfg.smartmon.enable && !config.boot.zfs.enabled && !cfg.environment.SKIP_SYSTEMD;
         ProtectClock = true;
         ProtectControlGroups = "strict";
         ProtectHome = "read-only";
diff --git a/nixos/modules/services/web-apps/homebox.nix b/nixos/modules/services/web-apps/homebox.nix
index 86d5a22a9326..54232535e8e4 100644
--- a/nixos/modules/services/web-apps/homebox.nix
+++ b/nixos/modules/services/web-apps/homebox.nix
@@ -43,7 +43,7 @@ in
       type = types.submodule { freeformType = types.attrsOf (types.nullOr types.str); };
       defaultText = lib.literalExpression ''
         {
-          HBOX_STORAGE_CONN_STRING = "file:///var/lib/homebox";
+          HBOX_STORAGE_CONN_STRING = "file:///var/lib/homebox?no_tmp_dir=1";
           HBOX_STORAGE_PREFIX_PATH = "data";
           HBOX_DATABASE_DRIVER = "sqlite3";
           HBOX_DATABASE_SQLITE_PATH = "/var/lib/homebox/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1";
@@ -51,7 +51,6 @@ in
           HBOX_OPTIONS_GITHUB_RELEASE_CHECK = "false";
           HBOX_MODE = "production";
           HOME = "/var/lib/homebox";
-          TMPDIR = "/var/lib/homebox/tmp";
         }
       '';
       description = ''
@@ -125,7 +124,9 @@ in
 
     services.homebox.settings = lib.mkMerge [
       (lib.mapAttrs (_: mkDefault) {
-        HBOX_STORAGE_CONN_STRING = "file:///var/lib/homebox";
+        # We cannot use a tempdir as homebox wants to rename the file, which does not work across filesystem boundaries
+        # also see: https://github.com/google/go-cloud/issues/3294 and https://pkg.go.dev/gocloud.dev/blob/fileblob#URLOpener
+        HBOX_STORAGE_CONN_STRING = "file:///var/lib/homebox?no_tmp_dir=1";
         HBOX_STORAGE_PREFIX_PATH = "data";
         HBOX_DATABASE_DRIVER = "sqlite3";
         HBOX_DATABASE_SQLITE_PATH = "/var/lib/homebox/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1";
@@ -134,10 +135,8 @@ in
         HBOX_MODE = "production";
         # Fix this startup issue:
         #   failed to create modcache index dir: mkdir /var/empty/.cache: read-only file system
+        # TODO: remove once https://github.com/golang/tools/commit/03cb4551c662c0e078502fe5f317ca4114b89cd8 is available
         HOME = "/var/lib/homebox";
-        # Fix uploading/saving attachments/images:
-        # [...] rename /tmp/ced4804c80b1ed1f6e88060f6d829db421e6dbf3a189715265900b5d6b0243ed.1889b3d16ab36e22.tmp /var/lib/homebox/data/5f42f81b-e9ad-4495-b6a6-9e9f704db30e/documents/ced4804c80b1ed1f6e88060f6d829db421e6dbf3a189715265900b5d6b0243ed: invalid cross-device link" [...]
-        TMPDIR = "/var/lib/homebox/tmp";
       })
 
       (mkIf cfg.database.createLocally {
diff --git a/nixos/tests/homebox.nix b/nixos/tests/homebox.nix
index 5842668479e0..1d086305d8ab 100644
--- a/nixos/tests/homebox.nix
+++ b/nixos/tests/homebox.nix
@@ -14,6 +14,8 @@ in
           services.homebox = {
             enable = true;
             settings.HBOX_WEB_PORT = port;
+            settings.HBOX_OPTIONS_ALLOW_REGISTRATION = "true";
+            settings.HBOX_LOG_LEVEL = "trace";
           };
         };
 
@@ -50,6 +52,7 @@ in
     in
     self;
   testScript = ''
+    import json
     def test_homebox(node):
       node.wait_for_unit("homebox.service")
       node.wait_for_open_port(${port})
@@ -57,6 +60,29 @@ in
       node.succeed("curl --fail -X GET 'http://localhost:${port}/'")
       out = node.succeed("curl --fail 'http://localhost:${port}/api/v1/status'")
       assert '"health":true' in out
+      node.succeed("curl --request POST --fail 'http://localhost:${port}/api/v1/users/register' \
+        --data '{\"email\":\"a@b.c\",\"name\":\"test\",\"password\":\"password\"}' \
+      ")
+      login = node.succeed("curl --request POST --fail 'http://localhost:${port}/api/v1/users/login' \
+        --data-urlencode 'password=password' \
+        --data-urlencode 'username=a@b.c' \
+      ")
+      login_data = json.loads(login)
+      token = login_data["token"]
+      locations = node.succeed(f"curl --request GET --fail 'http://localhost:${port}/api/v1/entities?isLocation=true' \
+        --header 'Authorization: {token}' \
+      ")
+      location_id = json.loads(locations)["items"][0]["id"]
+      item = node.succeed(f"curl --request POST --fail 'http://localhost:${port}/api/v1/entities' \
+        --header 'Authorization: {token}' \
+        --data '{{\"name\":\"testitem\",\"parentId\":\"{location_id}\"}}' \
+      ")
+      item_id = json.loads(item)["id"]
+      node.succeed(f"curl --request POST --fail 'http://localhost:${port}/api/v1/entities/{item_id}/attachments' \
+        --header 'Authorization: {token}' \
+        --form 'file=test;type=text/plain;filename=test.txt' \
+        --form name=test.txt \
+      ")
 
     test_homebox(simple)
     simple.send_monitor_command("quit")
diff --git a/nixos/tests/nix-required-mounts/default.nix b/nixos/tests/nix-required-mounts/default.nix
index 267d077583b3..18f04a5f7d28 100644
--- a/nixos/tests/nix-required-mounts/default.nix
+++ b/nixos/tests/nix-required-mounts/default.nix
@@ -12,10 +12,12 @@ in
     {
       virtualisation.writableStore = true;
       system.extraDependencies = [ (pkgs.runCommand "deps" { } "mkdir $out").inputDerivation ];
-      nix.nixPath = [ "nixpkgs=${../../..}" ];
-      nix.settings.substituters = lib.mkForce [ ];
-      nix.settings.system-features = [ "supported-feature" ];
-      nix.settings.experimental-features = [ "nix-command" ];
+      nix.settings = {
+        experimental-features = [ "nix-command" ];
+        nix-path = [ "nixpkgs=${../../..}" ];
+        substituters = lib.mkForce [ ];
+        system-features = [ "supported-feature" ];
+      };
       nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
       programs.nix-required-mounts.enable = true;
       programs.nix-required-mounts.allowedPatterns.supported-feature = {
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 6b83d356670c..ae3545baac06 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -27,13 +27,13 @@
     "vendorHash": null
   },
   "aiven_aiven": {
-    "hash": "sha256-OOEtFEs8EBOlvAoAOVKS1yFCYBzJ/75G7arDkkjS5LA=",
+    "hash": "sha256-By/CEi2DEZSvrfyV9KTBp6VlaIK1m4xF71KEpJbtrG8=",
     "homepage": "https://registry.terraform.io/providers/aiven/aiven",
     "owner": "aiven",
     "repo": "terraform-provider-aiven",
-    "rev": "v4.62.0",
+    "rev": "v4.63.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-TXeJPVyb3+t1wJyHXNbmy6iPrPTG47bedHB0UyEUv98="
+    "vendorHash": "sha256-jrr657aGldXtq4XHfYYpgr1HQpe+cg1mWa7gwRj30io="
   },
   "akamai_akamai": {
     "hash": "sha256-ui8w8z9kROptw0tCvtT645bbNJV/BRd10aVomwhl+hI=",
@@ -598,13 +598,13 @@
     "vendorHash": "sha256-9DiGgBQyN2lv7w4IkjMuWGNo9oTIvdK1qcdEpKpy5NE="
   },
   "hashicorp_google-beta": {
-    "hash": "sha256-EvcjgQupjAPKkbPObTTXNUsyyo7Udwc6rriD4/K7UhE=",
+    "hash": "sha256-JNPZ9nL5mkoqH0HNQr6mNWNadtnK1iZlMhy1UDds/v8=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "repo": "terraform-provider-google-beta",
-    "rev": "v8.3.0",
+    "rev": "v8.4.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-t3lzDRh0v6vMbw8qLXTOjKNUtaBlXOZkqNO+mJyP9NQ="
+    "vendorHash": "sha256-KI1hUXlJVoKGRyDODIfHJCBmN08Hml5JK+BSYiWGeXQ="
   },
   "hashicorp_helm": {
     "hash": "sha256-O3QcQf+TBmSB/mY5wybk/8BUG5RTjLhJYU+9jOOUqBI=",
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index c91b7064d808..a5a3a240e75f 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -86,8 +86,8 @@ rec {
   thunderbird = thunderbird-latest;
 
   thunderbird-latest = common {
-    version = "156.0";
-    sha512 = "8fd524f9d622f007e9bd5e8bcc440f185427a928a04d3aae14fc476e011ff1c15b68607292624ea4c4e4d596722193dda88e233cdfb6bbf5d05bd180870532ba";
+    version = "156.0.1";
+    sha512 = "e9262a4666e0107c7bc45fc2ad4bac4d6e5db4bfd3325d1d1c418f00adee777db969f8c12d8f310f45fdfda61b26e31bd0eea8b7d64ed1ee0050b5ee9235cfb0";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-latest";
diff --git a/pkgs/by-name/ad/adminerevo/package.nix b/pkgs/by-name/ad/adminerevo/package.nix
index ea8d1a939637..5c7e99c4fa21 100644
--- a/pkgs/by-name/ad/adminerevo/package.nix
+++ b/pkgs/by-name/ad/adminerevo/package.nix
@@ -64,7 +64,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Database management in a single PHP file";
-    homepage = "https://docs.adminerevo.org";
+    homepage = "https://github.com/adminerevo/adminerevo";
     license = with lib.licenses; [
       asl20
       gpl2Only
diff --git a/pkgs/by-name/an/analog/package.nix b/pkgs/by-name/an/analog/package.nix
index 38da846cc176..1fe5fc0d2662 100644
--- a/pkgs/by-name/an/analog/package.nix
+++ b/pkgs/by-name/an/analog/package.nix
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
-    homepage = "https://www.c-amie.co.uk/software/analog/";
+    homepage = "https://github.com/c-amie/analog-ce";
     license = lib.licenses.gpl2Only;
     description = "Powerful tool to generate web server statistics";
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/ar/argus-clients/package.nix b/pkgs/by-name/ar/argus-clients/package.nix
index 85bdb5c20d43..e7f6c5dea193 100644
--- a/pkgs/by-name/ar/argus-clients/package.nix
+++ b/pkgs/by-name/ar/argus-clients/package.nix
@@ -57,7 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
       know what is going on in your network, right now or historically,
       you will find Argus a useful tool.
     '';
-    homepage = "http://qosient.com/argus";
+    homepage = "https://openargus.org";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/by-name/ar/argus/package.nix b/pkgs/by-name/ar/argus/package.nix
index 9a008f0cc9a3..67bebb95a1ac 100644
--- a/pkgs/by-name/ar/argus/package.nix
+++ b/pkgs/by-name/ar/argus/package.nix
@@ -69,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
       know what is going on in your network, right now or historically,
       you will find Argus a useful tool.
     '';
-    homepage = "http://qosient.com/argus";
+    homepage = "https://openargus.org";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/by-name/au/audiality2/package.nix b/pkgs/by-name/au/audiality2/package.nix
index dd640126a078..a2b1f8586518 100644
--- a/pkgs/by-name/au/audiality2/package.nix
+++ b/pkgs/by-name/au/audiality2/package.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Realtime scripted modular audio engine for video games and musical applications";
     mainProgram = "a2play";
-    homepage = "http://audiality.org";
+    homepage = "https://olofson.github.io/audiality2/";
     license = lib.licenses.zlib;
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ fgaz ];
diff --git a/pkgs/by-name/bo/bossa/package.nix b/pkgs/by-name/bo/bossa/package.nix
index 72b7f2a9a18b..edec7fea75ef 100644
--- a/pkgs/by-name/bo/bossa/package.nix
+++ b/pkgs/by-name/bo/bossa/package.nix
@@ -84,7 +84,7 @@ stdenv.mkDerivation (finalAttrs: {
       Atmel's SAM-BA software. BOSSA is an acronym for Basic Open
       Source SAM-BA Application to reflect that goal.
     '';
-    homepage = "http://www.shumatech.com/web/products/bossa";
+    homepage = "https://github.com/shumatech/BOSSA";
     license = lib.licenses.bsd3;
     platforms = lib.platforms.unix;
   };
diff --git a/pkgs/by-name/br/brutalmaze/package.nix b/pkgs/by-name/br/brutalmaze/package.nix
index f4118c4dd8cb..bd83f5ce34be 100644
--- a/pkgs/by-name/br/brutalmaze/package.nix
+++ b/pkgs/by-name/br/brutalmaze/package.nix
@@ -36,7 +36,7 @@ python312Packages.buildPythonApplication (finalAttrs: {
   meta = {
     description = "Minimalist thrilling shoot 'em up game";
     mainProgram = "brutalmaze";
-    homepage = "https://brutalmaze.rtfd.io";
+    homepage = "https://brutalmaze.readthedocs.io";
     license = lib.licenses.agpl3Plus;
     maintainers = [ lib.maintainers.McSinyx ];
   };
diff --git a/pkgs/by-name/ca/cabin/package.nix b/pkgs/by-name/ca/cabin/package.nix
index 53869193e01a..fa1c758ea3d3 100644
--- a/pkgs/by-name/ca/cabin/package.nix
+++ b/pkgs/by-name/ca/cabin/package.nix
@@ -38,7 +38,7 @@ stdenvNoCC.mkDerivation rec {
       adjusted. The curved stem endings have a 10 degree angle. E and F have
       shorter center arms. M is splashed.
     '';
-    homepage = "http://www.impallari.com/cabin";
+    homepage = "https://github.com/impallari/Cabin";
     license = lib.licenses.ofl;
     maintainers = [ ];
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/ca/cargo-tarpaulin/package.nix b/pkgs/by-name/ca/cargo-tarpaulin/package.nix
index 858c5ddb275a..d0083ba7abd3 100644
--- a/pkgs/by-name/ca/cargo-tarpaulin/package.nix
+++ b/pkgs/by-name/ca/cargo-tarpaulin/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-tarpaulin";
-  version = "0.37.2";
+  version = "0.37.5";
 
   src = fetchFromGitHub {
     owner = "xd009642";
     repo = "tarpaulin";
     tag = finalAttrs.version;
-    hash = "sha256-oD8k/M5PChKzG1ek1uH8UP7PoaL9LYot3HCO4Hmetsw=";
+    hash = "sha256-m3z4hBoktmFZTOhXmsQW9tsmbBGQwL1Pi9163tabjcY=";
   };
 
-  cargoHash = "sha256-lZ4wRI1PEcHDxGe8R1mnp/Gk0IDzqXLvosfzkZOIhug=";
+  cargoHash = "sha256-3dbDxnPTjSsU242gSiEUhhLCRuqsHLFN0ZVJ7oKROeo=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ch/chunkfs/fuse3.diff b/pkgs/by-name/ch/chunkfs/fuse3.diff
new file mode 100644
index 000000000000..fda8a524b7d6
--- /dev/null
+++ b/pkgs/by-name/ch/chunkfs/fuse3.diff
@@ -0,0 +1,157 @@
+--- a/Makefile
++++ b/Makefile
+@@ -3,8 +3,11 @@ PREFIX?=/usr/local
+ 
+ VERSION=0.8
+ 
+-CFLAGS=-std=c99 -DVERSION='"$(VERSION)"' -O2 -Wall
+-LDFLAGS=-s -lfuse
++FUSE_CFLAGS:=$(shell pkg-config --cflags fuse3)
++CFLAGS=-std=c99 -DVERSION='"$(VERSION)"' -O2 -Wall $(FUSE_CFLAGS)
++LDFLAGS=-s
++FUSE_LIBS:=$(shell pkg-config --libs fuse3)
++LDLIBS=$(FUSE_LIBS)
+ 
+ all: chunkfs unchunkfs chunkfs.1.gz
+ 
+diff --git a/chunkfs.c b/chunkfs.c
+index 825553d..09b5e19 100644
+--- a/chunkfs.c
++++ b/chunkfs.c
+@@ -19,7 +19,7 @@
+ 
+ #define _FILE_OFFSET_BITS 64
+ #define _XOPEN_SOURCE 500
+-#define FUSE_USE_VERSION 25
++#define FUSE_USE_VERSION 317
+ 
+ #include <sys/types.h>
+ #include <unistd.h>
+@@ -87,7 +87,7 @@ static int resolve_path(const char *path,struct chunk_stat *st){
+ 	return 0;
+ }
+ 
+-static int chunkfs_getattr(const char *path,struct stat *buf){
++static int chunkfs_getattr(const char *path,struct stat *buf, struct fuse_file_info *fileinfo){
+ 	int r;
+ 	struct chunk_stat st;
+ 
+@@ -109,7 +109,7 @@ static int chunkfs_getattr(const char *path,struct stat *buf){
+ 	return 0;
+ }
+ 
+-static int chunkfs_readdir(const char *path,void *buf,fuse_fill_dir_t filler,off_t offset,struct fuse_file_info *fi){
++static int chunkfs_readdir(const char *path,void *buf,fuse_fill_dir_t filler,off_t offset,struct fuse_file_info *fi, enum fuse_readdir_flags flags){
+ 	int r;
+ 	struct chunk_stat st;
+ 	uint64_t chunks_per_entry;
+@@ -117,12 +117,12 @@ static int chunkfs_readdir(const char *path,void *buf,fuse_fill_dir_t filler,off
+ 	if((r=resolve_path(path,&st))<0)return r;
+ 	if(!S_ISDIR(st.mode))return -ENOTDIR;
+ 	chunks_per_entry=1ULL<<((8-1-st.level)*8);
+-	filler(buf,".",NULL,0);
+-	filler(buf,"..",NULL,0);
++	filler(buf,".",NULL,0,FUSE_FILL_DIR_DEFAULTS);
++	filler(buf,"..",NULL,0,FUSE_FILL_DIR_DEFAULTS);
+ 	for(uint64_t x=0;x<256&&(uint64_t)st.chunk+x*chunks_per_entry<(uint64_t)image_chunks;x++){
+ 		char nbuf[3];
+ 		sprintf(nbuf,"%02" PRIx64,x);
+-		filler(buf,nbuf,NULL,0);
++		filler(buf,nbuf,NULL,0,FUSE_FILL_DIR_DEFAULTS);
+ 	}
+ 	return 0;
+ }
+@@ -203,13 +203,13 @@ int main(int argc,char **argv){
+ 			"    -V                     print version\n"
+ 			"\n",
+ 			*argv);
+-		fake_argv[1]="-ho";
+-		fuse_main(2,fake_argv,&chunkfs_ops);
++		fake_argv[1]="--help";
++		fuse_main(2,fake_argv,&chunkfs_ops,NULL);
+ 		ret=validation_error;
+ 	}else if(show_version){
+ 		fprintf(stderr,"ChunkFS v" VERSION "\n");
+ 		fake_argv[1]="-V";
+-		fuse_main(2,fake_argv,&chunkfs_ops);
++		fuse_main(2,fake_argv,&chunkfs_ops,NULL);
+ 	}else{
+ 		errno=0;
+ 		chunk_size=strtoll(argv[optind],&end,10);
+@@ -228,7 +228,7 @@ int main(int argc,char **argv){
+ 		if(image_size%chunk_size)image_chunks++;
+ 		argv[optind]=argv[optind+2];
+ 		argc-=2;
+-		ret=fuse_main(argc,argv,&chunkfs_ops);
++		ret=fuse_main(argc,argv,&chunkfs_ops,NULL);
+ 	}
+ 	return ret;
+ }
+diff --git a/unchunkfs.c b/unchunkfs.c
+index 6302019..b8293e2 100644
+--- a/unchunkfs.c
++++ b/unchunkfs.c
+@@ -19,7 +19,7 @@
+ 
+ #define _FILE_OFFSET_BITS 64
+ #define _XOPEN_SOURCE 500
+-#define FUSE_USE_VERSION 25
++#define FUSE_USE_VERSION 317
+ 
+ #include <sys/types.h>
+ #include <unistd.h>
+@@ -72,7 +72,7 @@ static void gen_chunk_name(char *buf,off_t num){
+ 	}
+ }
+ 
+-static int unchunkfs_getattr(const char *path,struct stat *buf){
++static int unchunkfs_getattr(const char *path,struct stat *buf, struct fuse_file_info *fileinfo){
+ 	int r;
+ 	mode_t mode;
+ 
+@@ -94,15 +94,15 @@ static int unchunkfs_getattr(const char *path,struct stat *buf){
+ 	return 0;
+ }
+ 
+-static int unchunkfs_readdir(const char *path,void *buf,fuse_fill_dir_t filler,off_t offset,struct fuse_file_info *fi){
++static int unchunkfs_readdir(const char *path,void *buf,fuse_fill_dir_t filler,off_t offset,struct fuse_file_info *fi, enum fuse_readdir_flags flags){
+ 	int r;
+ 	mode_t mode;
+ 
+ 	if((r=resolve_path(path,&mode))<0)return r;
+ 	if(!S_ISDIR(mode))return -ENOTDIR;
+-	filler(buf,".",NULL,0);
+-	filler(buf,"..",NULL,0);
+-	filler(buf,"image",NULL,0);
++	filler(buf,".",NULL,0,FUSE_FILL_DIR_DEFAULTS);
++	filler(buf,"..",NULL,0,FUSE_FILL_DIR_DEFAULTS);
++	filler(buf,"image",NULL,0,FUSE_FILL_DIR_DEFAULTS);
+ 	return 0;
+ }
+ 
+@@ -190,13 +190,13 @@ int main(int argc,char **argv){
+ 			"    -V                     print version\n"
+ 			"\n",
+ 			*argv);
+-		fake_argv[1]="-ho";
+-		fuse_main(2,fake_argv,&unchunkfs_ops);
++		fake_argv[1]="--help";
++		fuse_main(2,fake_argv,&unchunkfs_ops,NULL);
+ 		ret=validation_error;
+ 	}else if(show_version){
+ 		fprintf(stderr,"UnChunkFS v" VERSION "\n");
+ 		fake_argv[1]="-V";
+-		fuse_main(2,fake_argv,&unchunkfs_ops);
++		fuse_main(2,fake_argv,&unchunkfs_ops,NULL);
+ 	}else{
+ 		if((cwd_fd=open(".",O_RDONLY))<0)die(true,"open(.)");
+ 		if((chunkdir_fd=open(argv[optind],O_RDONLY))<0)die(true,"open(<chunk dir>)");
+@@ -226,7 +226,7 @@ int main(int argc,char **argv){
+ 		argv[optind]=argv[optind+1];
+ 		argc--;
+ 		if(fchdir(cwd_fd)<0)die(true,"fchdir(<start cwd>)");
+-		ret=fuse_main(argc,argv,&unchunkfs_ops);
++		ret=fuse_main(argc,argv,&unchunkfs_ops,NULL);
+ 	}
+ 	return ret;
+ }
diff --git a/pkgs/by-name/ch/chunkfs/package.nix b/pkgs/by-name/ch/chunkfs/package.nix
index 1709df4f5fb9..e361f91ab1f3 100644
--- a/pkgs/by-name/ch/chunkfs/package.nix
+++ b/pkgs/by-name/ch/chunkfs/package.nix
@@ -3,21 +3,30 @@
   stdenv,
   fetchurl,
   perl,
-  fuse,
+  fuse3,
+  pkg-config,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "chunkfs";
   version = "0.8";
 
+  patches = [
+    ./fuse3.diff
+  ];
+
   src = fetchurl {
     url = "https://chunkfs.florz.de/chunkfs_${finalAttrs.version}.tar.xz";
     hash = "sha256-HFv51ta2eNW9Qt9CUp2oTTlC8Lpwc1XKR/uYzMDfd88=";
   };
 
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
   buildInputs = [
     perl
-    fuse
+    fuse3
   ];
 
   makeFlags = [
@@ -25,6 +34,8 @@ stdenv.mkDerivation (finalAttrs: {
     "PREFIX="
   ];
 
+  enableParallelBuilding = true;
+
   preInstall = ''
     mkdir -p $out/bin
     mkdir -p $out/share/man/man1
diff --git a/pkgs/by-name/un/unifiedpush-common-proxies/package.nix b/pkgs/by-name/co/common-proxies/package.nix
similarity index 70%
rename from pkgs/by-name/un/unifiedpush-common-proxies/package.nix
rename to pkgs/by-name/co/common-proxies/package.nix
index 068ac02a1461..dc5a24307898 100644
--- a/pkgs/by-name/un/unifiedpush-common-proxies/package.nix
+++ b/pkgs/by-name/co/common-proxies/package.nix
@@ -5,21 +5,24 @@
 }:
 
 buildGoModule (finalAttrs: {
-  pname = "unifiedpush-common-proxies";
+  pname = "common-proxies";
   version = "3.1.0";
 
   src = fetchFromCodeberg {
     owner = "UnifiedPush";
     repo = "common-proxies";
     rev = finalAttrs.version;
-    sha256 = "sha256-VRxwEsQt1LlcMIMEkGqkVtMrqJ7f4tYh3OExE9VITh4=";
+    hash = "sha256-VRxwEsQt1LlcMIMEkGqkVtMrqJ7f4tYh3OExE9VITh4=";
   };
 
   vendorHash = "sha256-rGsSuO7cnb9e4A1SnIwfgfz4vu18JzxKtLnDfCSQqck=";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   meta = {
     description = "Set of rewrite proxies and gateways for UnifiedPush";
-    homepage = "https://github.com/UnifiedPush/common-proxies";
+    homepage = "https://codeberg.org/UnifiedPush/common-proxies";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.zimward ];
     mainProgram = "common-proxies";
diff --git a/pkgs/by-name/cu/cubicsdr/package.nix b/pkgs/by-name/cu/cubicsdr/package.nix
index f7a4e54aab96..76bb89e13aab 100644
--- a/pkgs/by-name/cu/cubicsdr/package.nix
+++ b/pkgs/by-name/cu/cubicsdr/package.nix
@@ -65,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
-    homepage = "https://cubicsdr.com";
+    homepage = "https://github.com/cjcliffe/CubicSDR";
     description = "Software Defined Radio application";
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ lasandell ];
diff --git a/pkgs/by-name/de/defuddle/package.nix b/pkgs/by-name/de/defuddle/package.nix
index 451eb3a25391..9c73700cb56c 100644
--- a/pkgs/by-name/de/defuddle/package.nix
+++ b/pkgs/by-name/de/defuddle/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "defuddle";
-  version = "0.19.3";
+  version = "0.19.4";
 
   src = fetchFromGitHub {
     owner = "kepano";
     repo = "defuddle";
     tag = version;
-    hash = "sha256-fSJsNWShWjv1Riiq0DxkUnmUDlM2rQoqgdM9eD9aMts=";
+    hash = "sha256-H6/hZVe5nj6GNv00RMu1tKDRhCTvB7PX5gc70JWh9ik=";
   };
 
-  npmDepsHash = "sha256-BxGIVt2gkNQkWXQyLnPQQAtCNFJKlXmTctKVAxFzjfM=";
+  npmDepsHash = "sha256-B5uX7lIfII9nlCHn6d3zchsokpZFOuP1fuRRLJb7g1M=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/do/dosis/package.nix b/pkgs/by-name/do/dosis/package.nix
index da8a0e4a2076..2a0635a3e939 100644
--- a/pkgs/by-name/do/dosis/package.nix
+++ b/pkgs/by-name/do/dosis/package.nix
@@ -37,7 +37,7 @@ stdenvNoCC.mkDerivation rec {
       It comes in 7 incremental weights: ExtraLight, Light, Book, Medium,
       Semibold, Bold & ExtraBold
     '';
-    homepage = "http://www.impallari.com/dosis";
+    homepage = "https://github.com/impallari/Dosis";
     license = lib.licenses.ofl;
     maintainers = [ ];
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/do/doublecmd/package.nix b/pkgs/by-name/do/doublecmd/package.nix
index d0676d41c7c5..c63c7b213f3a 100644
--- a/pkgs/by-name/do/doublecmd/package.nix
+++ b/pkgs/by-name/do/doublecmd/package.nix
@@ -9,6 +9,7 @@
   lazarus,
   libx11,
   libsForQt5,
+  lua,
   writableTmpDirAsHomeHook,
 }:
 
@@ -61,6 +62,13 @@ stdenv.mkDerivation (finalAttrs: {
 
     install/linux/install.sh -I $out
 
+    cd $out/lib64/doublecmd
+
+    ln -vs ${lib.getLib lua}/lib/liblua.so.${lua.version}
+
+    ln -vs ./liblua.so.${lua.version} ./liblua.so
+    ln -vs ./liblua.so.${lua.version} ./liblua.so.${lib.versions.majorMinor lua.version}
+
     runHook postInstall
   '';
 
diff --git a/pkgs/by-name/ep/epson-escpr2/package.nix b/pkgs/by-name/ep/epson-escpr2/package.nix
index c6b8c5103101..93645e37b8f6 100644
--- a/pkgs/by-name/ep/epson-escpr2/package.nix
+++ b/pkgs/by-name/ep/epson-escpr2/package.nix
@@ -8,15 +8,16 @@
 
 stdenv.mkDerivation {
   pname = "epson-inkjet-printer-escpr2";
-  version = "1.2.37";
+  version = "1.2.42";
 
   src = fetchurl {
     # To find the most recent version go to
     # https://support.epson.net/linux/Printer/LSB_distribution_pages/en/escpr2.php
     # and retrieve the download link for source package for arm CPU for the tar.gz (the x86 link targets to rpm source files)
-
-    url = "https://download-center.epson.com/f/module/1316b6b0-77cd-438c-95e1-c71e760a7579/epson-inkjet-printer-escpr2-1.2.37-1.tar.gz";
-    hash = "sha256-jSh2HVb490CYJ/C+Eh1T5TmnBF7hmBmsGHuVbiWTHQ0=";
+    # or check https://download-center.epson.com/api/v1/modules/?device_id=XP-970%20Series&os=DEBARM32&region=US&language=en
+    curlOpts = "--user-agent ''";
+    url = "https://download-center.epson.com/f/module/4d70b84a-1686-4134-8ce0-4ac8a838f31c/epson-inkjet-printer-escpr2-1.2.42-1.tar.gz";
+    hash = "sha256-/gj4K6VPouXwS6p0Bc7dgF/j9Vl6YRVqH8pym1E/Tf4=";
   };
 
   buildInputs = [ cups ];
@@ -38,8 +39,6 @@ stdenv.mkDerivation {
     "--with-cupsppddir=${placeholder "out"}/share/cups/model"
   ];
 
-  passthru.updateScript = ./update.sh;
-
   meta = {
     homepage = "http://download.ebz.epson.net/dsc/search/01/search/";
     description = "ESC/P-R 2 Driver (generic driver)";
diff --git a/pkgs/by-name/ep/epson-escpr2/update.sh b/pkgs/by-name/ep/epson-escpr2/update.sh
deleted file mode 100755
index b2082decd74a..000000000000
--- a/pkgs/by-name/ep/epson-escpr2/update.sh
+++ /dev/null
@@ -1,21 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p bash curl jq common-updater-scripts
-set -eou pipefail
-
-result=$(curl -sSL 'https://download-center.epson.com/api/v1/modules/?device_id=XP-970%20Series&os=DEBARM32&region=US&language=en' | jq -r '.items[] | select(.module_name == "Epson Inkjet Printer Driver 2 (ESC/P-R) for Linux" and .cti_category == "Sources")')
-
-latestVersion=$(jq '.version' <<< "$result" | tr -d '"')
-currentVersion=$(nix-instantiate --eval -E "with import ./. {}; (lib.getVersion epson-escpr2)" | tr -d '"')
-
-echo "latest  version: $latestVersion"
-echo "current version: $currentVersion"
-
-if [[ "$latestVersion" == "$currentVersion" ]]; then
-    echo "package is up-to-date"
-    exit 0
-fi
-
-url=$(jq '.url' <<< "$result" | tr -d '"')
-
-hash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri $(nix-prefetch-url $url))
-update-source-version epson-escpr2 $latestVersion $hash $url --ignore-same-version
diff --git a/pkgs/by-name/eu/euro-office-desktopeditors/package.nix b/pkgs/by-name/eu/euro-office-desktopeditors/package.nix
new file mode 100644
index 000000000000..fd259e2dbc6a
--- /dev/null
+++ b/pkgs/by-name/eu/euro-office-desktopeditors/package.nix
@@ -0,0 +1,234 @@
+{
+  stdenv,
+  lib,
+  fetchurl,
+  buildFHSEnv,
+  unzip,
+  patchelfUnstable,
+  # Alphabetic ordering below
+  alsa-lib,
+  at-spi2-atk,
+  atk,
+  autoPatchelfHook,
+  cairo,
+  curl,
+  dbus,
+  dconf,
+  dpkg,
+  firebird,
+  fontconfig,
+  gcc-unwrapped,
+  gdk-pixbuf,
+  glib,
+  glibc,
+  gsettings-desktop-schemas,
+  gst_all_1,
+  gtk2,
+  gtk3,
+  libGL,
+  libdrm,
+  libgbm,
+  libmysqlclient,
+  libnotify,
+  libpulseaudio,
+  libudev0-shim,
+  libx11,
+  libxcb,
+  libxcb-cursor,
+  libxcomposite,
+  libxcursor,
+  libxdamage,
+  libxext,
+  libxfixes,
+  libxi,
+  libxrandr,
+  libxrender,
+  libxscrnsaver,
+  libxtst,
+  makeWrapper,
+  noto-fonts-cjk-sans,
+  nspr,
+  nss,
+  pulseaudio,
+  qt6,
+  wrapGAppsHook3,
+  xkeyboard_config,
+}:
+let
+
+  # Note on fonts:
+  #
+  # EuroOffice does not distribute unfree fonts, but makes it easy to pick up
+  # any fonts you install. See:
+  #
+  # * https://helpcenter.onlyoffice.com/en/installation/docs-community-install-fonts-linux.aspx
+  # * https://www.onlyoffice.com/blog/2020/04/how-to-add-new-fonts-to-onlyoffice-desktop-editors/
+  #
+  # As recommended there, you should download
+  #
+  #     arial.ttf, calibri.ttf, cour.ttf, symbol.ttf, times.ttf, wingding.ttf
+  #
+  # into `~/.local/share/fonts/`, otherwise the default template fonts, and
+  # things like bullet points, will not look as expected.
+
+  # TODO: Find out which of these fonts we'd be allowed to distribute along
+  #       with this package, or how to make this easier for users otherwise.
+
+  runtimeLibs = lib.makeLibraryPath [
+    curl
+    glibc
+    gcc-unwrapped.lib
+    libudev0-shim
+    pulseaudio
+  ];
+
+  derivation = stdenv.mkDerivation (finalAttrs: {
+    pname = "euro-office-desktopeditors";
+    # No release yet, pinning to latest version where Linux artifacts
+    # where provided.
+    version = "9.3.1-dev.1";
+    # Manual uploaded Github CI artifact (actions run 28295624289,
+    # artifact 7926798036) of linux-packages-amd64 tarball.
+    src = fetchurl {
+      url = "https://archive.org/download/euro-office-desktopeditors-9.3.1-dev.1-linux-amd64/linux-packages-amd64.zip";
+      hash = "sha256-OV3abn9nYq/FeBkpft+27iGt34Rqi2VkJkAZwBHu1lM=";
+    };
+
+    unpackPhase = ''
+      mkdir -p source
+      cd source
+      unzip $src
+      dpkg-deb -x euro-office-desktopeditors_*.deb .
+    '';
+
+    nativeBuildInputs = [
+      autoPatchelfHook
+      dpkg
+      makeWrapper
+      patchelfUnstable
+      unzip
+      wrapGAppsHook3
+    ];
+
+    buildInputs = [
+      alsa-lib
+      at-spi2-atk
+      atk
+      cairo
+      dbus
+      dconf
+      firebird
+      fontconfig
+      gdk-pixbuf
+      glib
+      gsettings-desktop-schemas
+      gst_all_1.gst-plugins-base
+      gst_all_1.gstreamer
+      gtk2
+      gtk3
+      libdrm
+      libgbm
+      libmysqlclient
+      libnotify
+      libpulseaudio
+      libx11
+      libxcb
+      libxcb-cursor
+      libxcomposite
+      libxcursor
+      libxdamage
+      libxext
+      libxfixes
+      libxi
+      libxrandr
+      libxrender
+      libxscrnsaver
+      libxtst
+      nspr
+      nss
+      qt6.qtbase
+      qt6.qtdeclarative
+      qt6.qtquick3d
+      qt6.qtsvg
+      qt6.qtwayland
+    ];
+
+    dontWrapQtApps = true;
+
+    dontStrip = 1;
+
+    autoPatchelfIgnoreMissingDeps = [
+      # 'mysql80' reached end of life on 2026-04-30 and has been removed.
+      "libmysqlclient.so.21"
+      # These libraries are not available in nixpkgs. They are Oracle Instant Client
+      # (libclntsh.so.23.1) and UCanAccess/Mimer SQL (libmimerapi.so) drivers that
+      # are bundled with Qt's SQlite database plugins (libqsqlora, libqsqlmimer).
+      "libclntsh.so.23.1"
+      "libmimerapi.so"
+    ];
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/{bin,lib,share}
+
+      mv usr/bin/* $out/bin
+      mv usr/share/* $out/share/
+      mv opt/euro-office/desktopeditors $out/share
+
+      substituteInPlace $out/bin/euro-office-desktopeditors \
+        --replace-fail "/opt/euro-office/" "$out/share/"
+
+      ln -s $out/share/desktopeditors/DesktopEditors $out/bin/DesktopEditors
+
+      runHook postInstall
+    '';
+
+    preFixup = ''
+      gappsWrapperArgs+=(
+        --prefix LD_LIBRARY_PATH : "${runtimeLibs}" \
+        --set QT_XKB_CONFIG_ROOT "${xkeyboard_config}/share/X11/xkb" \
+        --set QTCOMPOSE "${libx11.out}/share/X11/locale" \
+        --set QT_QPA_PLATFORM "xcb"
+        # the bundled version of qt does not support wayland
+      )
+    '';
+  });
+
+in
+
+# In order to download plugins, Euro-Office uses /usr/bin/curl so we have to wrap it.
+# Curl still needs to be in runtimeLibs because the library is used directly in other parts of the code.
+# Fonts are also discovered by looking in /usr/share/fonts, so adding fonts to targetPkgs will include them
+buildFHSEnv {
+  inherit (derivation) pname version;
+
+  targetPkgs = pkgs': [
+    curl
+    derivation
+    noto-fonts-cjk-sans
+    libGL
+  ];
+
+  runScript = "/bin/euro-office-desktopeditors";
+
+  extraInstallCommands = ''
+    mkdir -p $out/share
+    ln -s ${derivation}/share/icons $out/share
+    cp -r ${derivation}/share/applications $out/share
+    substituteInPlace $out/share/applications/euro-office-desktopeditors.desktop \
+        --replace-fail "/usr/bin/euro-office-desktopeditors" "$out/bin/euro-office-desktopeditors"
+  '';
+
+  meta = {
+    description = "Office suite that combines text, spreadsheet and presentation editors allowing to create, view and edit local documents";
+    homepage = "https://github.com/Euro-Office/DesktopEditors";
+    downloadPage = "https://github.com/Euro-Office/DesktopEditors/releases";
+    changelog = "https://github.com/Euro-Office/DesktopEditors/blob/v9.3.1/CHANGELOG.md";
+    platforms = [ "x86_64-linux" ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    license = lib.licenses.agpl3Plus;
+    maintainers = [ lib.maintainers.onny ];
+    mainProgram = "euro-office-desktopeditors";
+  };
+}
diff --git a/pkgs/by-name/gn/gnome-shell/icon-theme-directory-identity.patch b/pkgs/by-name/gn/gnome-shell/icon-theme-directory-identity.patch
new file mode 100644
index 000000000000..dd45044af18c
--- /dev/null
+++ b/pkgs/by-name/gn/gnome-shell/icon-theme-directory-identity.patch
@@ -0,0 +1,44 @@
+diff --git a/src/st/st-icon-theme.c b/src/st/st-icon-theme.c
+--- a/src/st/st-icon-theme.c
++++ b/src/st/st-icon-theme.c
+@@ -220,6 +220,8 @@ typedef struct
+ {
+   char *dir;
+   time_t mtime;
++  dev_t device;
++  ino_t inode;
+   StIconCache *cache;
+   gboolean exists;
+ } IconThemeDirMtime;
+@@ -792,6 +794,8 @@ insert_theme (StIconTheme *icon_theme,
+       dir_mtime->dir = path;
+       if (g_stat (path, &stat_buf) == 0 && S_ISDIR (stat_buf.st_mode)) {
+         dir_mtime->mtime = stat_buf.st_mtime;
++        dir_mtime->device = stat_buf.st_dev;
++        dir_mtime->inode = stat_buf.st_ino;
+         dir_mtime->exists = TRUE;
+       } else {
+         dir_mtime->mtime = 0;
+@@ -1029,6 +1033,8 @@ load_themes (StIconTheme *icon_theme)
+       if (g_stat (dir, &stat_buf) != 0 || !S_ISDIR (stat_buf.st_mode))
+         continue;
+       dir_mtime->mtime = stat_buf.st_mtime;
++      dir_mtime->device = stat_buf.st_dev;
++      dir_mtime->inode = stat_buf.st_ino;
+       dir_mtime->exists = TRUE;
+ 
+       dir_mtime->cache = st_icon_cache_new_for_path (dir);
+@@ -2120,10 +2126,12 @@ rescan_themes (StIconTheme *icon_theme)
+-      /* dir mtime didn't change */
++      /* dir identity and mtime didn't change. */
+       if (stat_res == 0 && dir_mtime->exists &&
+           S_ISDIR (stat_buf.st_mode) &&
++          dir_mtime->device == stat_buf.st_dev &&
++          dir_mtime->inode == stat_buf.st_ino &&
+           dir_mtime->mtime == stat_buf.st_mtime)
+         continue;
+       /* didn't exist before, and still doesn't */
+       if (!dir_mtime->exists &&
+           (stat_res != 0 || !S_ISDIR (stat_buf.st_mode)))
+         continue;
+ 
diff --git a/pkgs/by-name/gn/gnome-shell/package.nix b/pkgs/by-name/gn/gnome-shell/package.nix
index d0b8d6bd6b67..5e43836fbfa1 100644
--- a/pkgs/by-name/gn/gnome-shell/package.nix
+++ b/pkgs/by-name/gn/gnome-shell/package.nix
@@ -100,6 +100,9 @@ stdenv.mkDerivation (finalAttrs: {
     # Make D-Bus services wrappable.
     ./wrap-services.patch
 
+    # Detect profile switches even when icon directory mtimes are unchanged.
+    ./icon-theme-directory-identity.patch
+
     # Fix greeter logo being too big.
     # https://gitlab.gnome.org/GNOME/gnome-shell/issues/2591
     # Reverts https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/1101
diff --git a/pkgs/by-name/hu/hunk/package.nix b/pkgs/by-name/hu/hunk/package.nix
index 2562fa3b9cca..37b679ceed69 100644
--- a/pkgs/by-name/hu/hunk/package.nix
+++ b/pkgs/by-name/hu/hunk/package.nix
@@ -12,13 +12,13 @@
 
 let
   pname = "hunk";
-  version = "0.21.1";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "modem-dev";
     repo = "hunk";
     tag = "v${version}";
-    hash = "sha256-8faDOqDXSdp5j8WP07rTW0L44keCPpv9mWoXGKXgvpY=";
+    hash = "sha256-dc4/xLAyQe7mL/KMcpjsjgHzgf0tRomQAemVABwUWFY=";
   };
 
   node_modules = stdenv.mkDerivation {
@@ -58,7 +58,7 @@ let
 
     dontFixup = true;
 
-    outputHash = "sha256-r3LXoIx7fHWyTTs19N4CU9mIWYsQxP0QVpstlvAu3D0=";
+    outputHash = "sha256-hWfG2T3Tfa69nX50OFW5XNRQxMc5lideDEUPw6G26qA=";
     outputHashMode = "recursive";
   };
 in
@@ -75,16 +75,6 @@ stdenv.mkDerivation {
     writableTmpDirAsHomeHook
   ];
 
-  # Teach `hunk skill path` to find the FHS layout under share/skills/$pname
-  # (https://github.com/NixOS/nixpkgs/issues/547426) instead of $out/skills.
-  postPatch = ''
-    substituteInPlace src/core/run/paths.ts \
-      --replace-fail \
-        'join("node_modules", "hunkdiff", skillRelativePath),' \
-        'join("node_modules", "hunkdiff", skillRelativePath),
-    join("share", "skills", "hunk", name, "SKILL.md"),'
-  '';
-
   configurePhase = ''
     runHook preConfigure
 
@@ -98,13 +88,15 @@ stdenv.mkDerivation {
   buildPhase = ''
     runHook preBuild
 
+    # Entry points mirror upstream's scripts/build/build-bin.ts.
     mkdir -p .bun-tmp .bun-install
     BUN_TMPDIR=$PWD/.bun-tmp \
     BUN_INSTALL=$PWD/.bun-install \
       bun build --compile \
         --no-compile-autoload-bunfig \
         --no-compile-autoload-dotenv \
-        src/main.tsx \
+        packages/hunk/src/main.tsx \
+        packages/hunk/src/highlightWorkerEntry.ts \
         --outfile hunk
 
     runHook postBuild
@@ -115,8 +107,12 @@ stdenv.mkDerivation {
     runHook preInstall
 
     installBin hunk
-    installSkill skills/hunk-extensions hunk
-    installSkill skills/hunk-review hunk
+    for skill in packages/hunk/skills/*; do
+      installSkill "$skill"
+    done
+
+    # `hunk skill path` looks for skills/<name>/SKILL.md above the executable.
+    ln -s share/skills/${pname} $out/skills
 
     runHook postInstall
   '';
@@ -134,9 +130,8 @@ stdenv.mkDerivation {
   installCheckPhase = ''
     runHook preInstallCheck
 
-    $out/bin/hunk --version | grep -F ${version}
-    test -f "$($out/bin/hunk skill path)"
-    test -f "$($out/bin/hunk skill path hunk-extensions)"
+    cmp "$out/share/skills/${pname}/hunk-review/SKILL.md" "$($out/bin/hunk skill path)"
+    cmp "$out/share/skills/${pname}/hunk-extensions/SKILL.md" "$($out/bin/hunk skill path hunk-extensions)"
 
     runHook postInstallCheck
   '';
diff --git a/pkgs/by-name/ke/keycard-cli/package.nix b/pkgs/by-name/ke/keycard-cli/package.nix
index d33861d1b020..e65728def411 100644
--- a/pkgs/by-name/ke/keycard-cli/package.nix
+++ b/pkgs/by-name/ke/keycard-cli/package.nix
@@ -32,7 +32,7 @@ buildGoModule (finalAttrs: {
   meta = {
     description = "Command line tool and shell to manage keycards";
     mainProgram = "keycard-cli";
-    homepage = "https://keycard.status.im";
+    homepage = "https://keycard.tech/";
     license = lib.licenses.mpl20;
     maintainers = [ lib.maintainers.zimbatm ];
     broken = stdenv.hostPlatform.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/keycard-cli.x86_64-darwin
diff --git a/pkgs/by-name/ki/kiln/package.nix b/pkgs/by-name/ki/kiln/package.nix
index 2a0550b87de7..3b004a9695d0 100644
--- a/pkgs/by-name/ki/kiln/package.nix
+++ b/pkgs/by-name/ki/kiln/package.nix
@@ -31,7 +31,7 @@ buildGoModule (finalAttrs: {
 
   meta = {
     description = "Simple static site generator for Gemini";
-    homepage = "https://kiln.adnano.co/";
+    homepage = "https://git.sr.ht/~adnano/kiln";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ sikmir ];
     mainProgram = "kiln";
diff --git a/pkgs/by-name/kl/klog/package.nix b/pkgs/by-name/kl/klog/package.nix
index f6d13a2b05ad..005b40793cd7 100644
--- a/pkgs/by-name/kl/klog/package.nix
+++ b/pkgs/by-name/kl/klog/package.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
       KLog provides QSO management, useful QSL management DX-Cluster client, DXCC management,
       ClubLog integration, WSJT-X, DX-Marathon support and much more.
     '';
-    homepage = "https://www.klog.xyz/";
+    homepage = "https://github.com/ea4k/klog";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ pulsation ];
diff --git a/pkgs/by-name/ku/kubernetes/package.nix b/pkgs/by-name/ku/kubernetes/package.nix
index da7d2037e2ee..b1be6841796c 100644
--- a/pkgs/by-name/ku/kubernetes/package.nix
+++ b/pkgs/by-name/ku/kubernetes/package.nix
@@ -23,13 +23,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubernetes";
-  version = "1.37.0";
+  version = "1.37.1";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "kubernetes";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-irRDtPf+bk2uQ/QOcAXzYcrm/0pys/e4M5ITyL6omqs=";
+    hash = "sha256-9p7t8EN6Iv3Q2ClJgCgSUJP1Qdp7B47fOe0roP5jZbg=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ku/kuzu/package.nix b/pkgs/by-name/ku/kuzu/package.nix
index e63600462c99..151fe3dedee6 100644
--- a/pkgs/by-name/ku/kuzu/package.nix
+++ b/pkgs/by-name/ku/kuzu/package.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     changelog = "https://github.com/kuzudb/kuzu/releases/tag/v${finalAttrs.version}";
     description = "Embeddable property graph database management system";
-    homepage = "https://kuzudb.com/";
+    homepage = "https://github.com/kuzudb/kuzu";
     license = lib.licenses.mit;
     mainProgram = "kuzu";
     maintainers = with lib.maintainers; [ sdht0 ];
diff --git a/pkgs/by-name/la/ladspaPlugins/package.nix b/pkgs/by-name/la/ladspaPlugins/package.nix
index 4f61faacdab6..4a0ad4efabde 100644
--- a/pkgs/by-name/la/ladspaPlugins/package.nix
+++ b/pkgs/by-name/la/ladspaPlugins/package.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
-    homepage = "http://plugin.org.uk/";
+    homepage = "https://github.com/swh/ladspa";
     description = "LADSPA format audio plugins";
     license = lib.licenses.gpl2Only;
     maintainers = [ lib.maintainers.magnetophon ];
diff --git a/pkgs/by-name/lc/lcab/package.nix b/pkgs/by-name/lc/lcab/package.nix
index ac481c70019c..461ebe4de3bc 100644
--- a/pkgs/by-name/lc/lcab/package.nix
+++ b/pkgs/by-name/lc/lcab/package.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Create cabinet (.cab) archives";
-    homepage = "http://ohnopub.net/~ohnobinki/lcab";
+    homepage = "https://salsa.debian.org/debian/lcab";
     license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [ emilytrau ];
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/ld/ldmud/package.nix b/pkgs/by-name/ld/ldmud/package.nix
index 554efc4eb9ee..30d6053f4ace 100644
--- a/pkgs/by-name/ld/ldmud/package.nix
+++ b/pkgs/by-name/ld/ldmud/package.nix
@@ -116,7 +116,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Gamedriver for LPMuds including a LPC compiler, interpreter and runtime";
-    homepage = "https://ldmud.eu";
+    homepage = "https://github.com/ldmud/ldmud";
     changelog = "https://github.com/ldmud/ldmud/blob/${finalAttrs.version}/HISTORY";
     longDescription = ''
       LDMud started as a project to clean up and modernize Amylaar's LPMud
diff --git a/pkgs/by-name/li/libcint/package.nix b/pkgs/by-name/li/libcint/package.nix
index 6eb43b814c2f..1875bba32488 100644
--- a/pkgs/by-name/li/libcint/package.nix
+++ b/pkgs/by-name/li/libcint/package.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
       It provides C/Fortran API to evaluate one-electron / two-electron
       integrals for Cartesian / real-spheric / spinor Gaussian type functions.
     '';
-    homepage = "http://wiki.sunqm.net/libcint";
+    homepage = "https://github.com/sunqm/libcint";
     downloadPage = "https://github.com/sunqm/libcint";
     changelog = "https://github.com/sunqm/libcint/blob/master/ChangeLog";
     license = lib.licenses.bsd2;
diff --git a/pkgs/by-name/li/libeconf/package.nix b/pkgs/by-name/li/libeconf/package.nix
index f6533a2ae9f0..f0df643b1abf 100644
--- a/pkgs/by-name/li/libeconf/package.nix
+++ b/pkgs/by-name/li/libeconf/package.nix
@@ -5,6 +5,7 @@
   meson,
   ninja,
   nix-update-script,
+  testers,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -18,6 +19,13 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-jIEsfX3Oz/koX0srLPGII99WaeFjKtXvB4kzMu7LbWs=";
   };
 
+  # unsupported flags that we can just remove
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace meson.build \
+      --replace-fail "'-ffat-lto-objects'," "" \
+      --replace-fail "version_flag = ['-Wl,--version-script,@0@/@1@'.format(meson.current_source_dir(), mapfile)]" "version_flag = []"
+  '';
+
   __structuredAttrs = true;
   strictDeps = true;
 
@@ -26,7 +34,10 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
   ];
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    updateScript = nix-update-script { };
+  };
 
   meta = {
     description = "Enhanced config file parser, which merges config files placed in several locations into one";
@@ -36,5 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [ grimmauld ];
     mainProgram = "econftool";
     platforms = lib.platforms.all;
+    pkgConfigModules = [ "libeconf" ];
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "opensuse" finalAttrs.version;
   };
 })
diff --git a/pkgs/by-name/li/libfm/package.nix b/pkgs/by-name/li/libfm/package.nix
index 6f4a69dcdc92..69d652684143 100644
--- a/pkgs/by-name/li/libfm/package.nix
+++ b/pkgs/by-name/li/libfm/package.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     broken = stdenv.hostPlatform.isDarwin;
-    homepage = "https://blog.lxde.org/category/pcmanfm/";
+    homepage = "https://github.com/lxde/libfm";
     license = lib.licenses.lgpl21Plus;
     description = "Glib-based library for file management";
     maintainers = [ ];
diff --git a/pkgs/by-name/li/liblogging/package.nix b/pkgs/by-name/li/liblogging/package.nix
index 7eaf16f30db3..fe43ffa83637 100644
--- a/pkgs/by-name/li/liblogging/package.nix
+++ b/pkgs/by-name/li/liblogging/package.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
   env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-int -Wno-error=implicit-function-declaration";
 
   meta = {
-    homepage = "http://www.liblogging.org/";
+    homepage = "https://github.com/rsyslog/liblogging";
     description = "Lightweight signal-safe logging library";
     mainProgram = "stdlogctl";
     license = lib.licenses.bsd2;
diff --git a/pkgs/by-name/li/libre-baskerville/package.nix b/pkgs/by-name/li/libre-baskerville/package.nix
index bc7cedf6ed14..d00a88a28cf8 100644
--- a/pkgs/by-name/li/libre-baskerville/package.nix
+++ b/pkgs/by-name/li/libre-baskerville/package.nix
@@ -30,7 +30,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       counters and less contrast that allow it to work on small sizes in any
       screen.
     '';
-    homepage = "http://www.impallari.com/projects/overview/libre-baskerville";
+    homepage = "https://github.com/impallari/Libre-Baskerville";
     license = lib.licenses.ofl;
     maintainers = with lib.maintainers; [ pancaek ];
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/li/libre-caslon/package.nix b/pkgs/by-name/li/libre-caslon/package.nix
index 18ad5a292589..fe147d234c0b 100644
--- a/pkgs/by-name/li/libre-caslon/package.nix
+++ b/pkgs/by-name/li/libre-caslon/package.nix
@@ -42,7 +42,10 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Caslon fonts based on hand-lettered American Caslons of 1960s";
-    homepage = "http://www.impallari.com/librecaslon";
+    homepage = [
+      "https://github.com/impallari/Libre-Caslon-Text"
+      "https://github.com/impallari/Libre-Caslon-Display/"
+    ];
     license = lib.licenses.ofl;
     maintainers = [ ];
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/li/libsieve/package.nix b/pkgs/by-name/li/libsieve/package.nix
index 5b21c3cba574..20f49ed919c8 100644
--- a/pkgs/by-name/li/libsieve/package.nix
+++ b/pkgs/by-name/li/libsieve/package.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Interpreter for RFC 3028 Sieve and various extensions";
-    homepage = "http://sodabrew.com/libsieve/";
+    homepage = "https://github.com/sodabrew/libsieve";
     license = lib.licenses.lgpl21;
     platforms = lib.platforms.unix;
   };
diff --git a/pkgs/by-name/lk/lklug-sinhala/package.nix b/pkgs/by-name/lk/lklug-sinhala/package.nix
index e290d0dca176..ee9e2cf9981a 100644
--- a/pkgs/by-name/lk/lklug-sinhala/package.nix
+++ b/pkgs/by-name/lk/lklug-sinhala/package.nix
@@ -23,7 +23,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Unicode Sinhala font by Lanka Linux User Group";
-    homepage = "http://www.lug.lk/fonts/lklug";
+    homepage = "https://sinhala.sourceforge.net/";
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ serge ];
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/lo/loxodo/package.nix b/pkgs/by-name/lo/loxodo/package.nix
index 3bfa9295b56b..6665e2bba1d7 100644
--- a/pkgs/by-name/lo/loxodo/package.nix
+++ b/pkgs/by-name/lo/loxodo/package.nix
@@ -46,7 +46,7 @@ python3.pkgs.buildPythonApplication {
   meta = {
     description = "Password Safe V3 compatible password vault";
     mainProgram = "loxodo";
-    homepage = "https://www.christoph-sommer.de/loxodo/";
+    homepage = "https://github.com/sommer/loxodo";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;
     maintainers = [ ];
diff --git a/pkgs/by-name/lx/lxsession/package.nix b/pkgs/by-name/lx/lxsession/package.nix
index d23101981afe..d82ea1c50f8c 100644
--- a/pkgs/by-name/lx/lxsession/package.nix
+++ b/pkgs/by-name/lx/lxsession/package.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [ ./repect-xml-catalog-file-var.patch ];
 
   meta = {
-    homepage = "https://wiki.lxde.org/en/LXSession";
+    homepage = "https://github.com/lxde/lxsession";
     description = "Classic LXDE session manager";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/me/meli/package.nix b/pkgs/by-name/me/meli/package.nix
index f4332eba458c..633ffb9d93fb 100644
--- a/pkgs/by-name/me/meli/package.nix
+++ b/pkgs/by-name/me/meli/package.nix
@@ -81,7 +81,7 @@ rustPlatform.buildRustPackage rec {
   meta = {
     description = "Terminal e-mail client and e-mail client library";
     mainProgram = "meli";
-    homepage = "https://meli.delivery";
+    homepage = "https://meli-email.org/";
     license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [
       _0x4A6F
diff --git a/pkgs/by-name/mo/moonshine/package.nix b/pkgs/by-name/mo/moonshine/package.nix
index 43972b89d676..b76ffa4001d3 100644
--- a/pkgs/by-name/mo/moonshine/package.nix
+++ b/pkgs/by-name/mo/moonshine/package.nix
@@ -29,19 +29,19 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "moonshine";
-  version = "0.16.0";
+  version = "0.16.1";
 
   src = fetchFromGitHub {
     owner = "hgaiser";
     repo = "moonshine";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SpDGhIi6FTYAWDzMZwPdNbwPmDEA3w/xOi2z5wRR1Qc=";
+    hash = "sha256-CmSOU263HD4qDFwGRxyozo2u2BlM+bT8AE7EwFPEhnA=";
   };
 
   __structuredAttrs = true;
   strictDeps = true;
 
-  cargoHash = "sha256-GhHjXPx3aEYPO9OsuB1ZAiwvessXoOOQ8MqFwmORJOs=";
+  cargoHash = "sha256-g9X9tiO+mUW4eTYi16nvesHIvWsQgAft7ZLEK1/CQHg=";
 
   # Build Moonshine binary and Vulkan layer
   cargoBuildFlags = [
diff --git a/pkgs/by-name/mo/mozillavpn/package.nix b/pkgs/by-name/mo/mozillavpn/package.nix
index 365d85d8fff1..182ddaeabe56 100644
--- a/pkgs/by-name/mo/mozillavpn/package.nix
+++ b/pkgs/by-name/mo/mozillavpn/package.nix
@@ -128,7 +128,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Client for the Mozilla VPN service";
     mainProgram = "mozillavpn";
-    homepage = "https://vpn.mozilla.org/";
+    homepage = "https://www.mozilla.org/en-US/products/vpn/";
     license = lib.licenses.mpl20;
     maintainers = with lib.maintainers; [ andersk ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/mp/mps/package.nix b/pkgs/by-name/mp/mps/package.nix
index 2d3f6a522ab5..2b6ac2e2ab4d 100644
--- a/pkgs/by-name/mp/mps/package.nix
+++ b/pkgs/by-name/mp/mps/package.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Flexible memory management and garbage collection library";
-    homepage = "https://www.ravenbrook.com/project/mps";
+    homepage = "https://github.com/Ravenbrook/mps";
     license = lib.licenses.sleepycat;
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
     maintainers = [ lib.maintainers.thoughtpolice ];
diff --git a/pkgs/by-name/mr/mrsh/package.nix b/pkgs/by-name/mr/mrsh/package.nix
index a9a8a1ef3221..f5bc8518f5c8 100644
--- a/pkgs/by-name/mr/mrsh/package.nix
+++ b/pkgs/by-name/mr/mrsh/package.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation {
   meta = {
     description = "Minimal POSIX shell";
     mainProgram = "mrsh";
-    homepage = "https://mrsh.sh";
+    homepage = "https://github.com/emersion/mrsh";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ matthiasbeyer ];
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/ne/ne/package.nix b/pkgs/by-name/ne/ne/package.nix
index fe98c81a2018..1e66a2085226 100644
--- a/pkgs/by-name/ne/ne/package.nix
+++ b/pkgs/by-name/ne/ne/package.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Nice editor";
-    homepage = "https://ne.di.unimi.it/";
+    homepage = "https://github.com/vigna/ne";
     changelog = "https://github.com/vigna/ne/releases/tag/${finalAttrs.version}";
     downloadPage = "https://github.com/vigna/ne";
     longDescription = ''
diff --git a/pkgs/by-name/or/orioledb/extension.nix b/pkgs/by-name/or/orioledb/extension.nix
index f998b2ae0642..40a6f5e989f4 100644
--- a/pkgs/by-name/or/orioledb/extension.nix
+++ b/pkgs/by-name/or/orioledb/extension.nix
@@ -10,14 +10,14 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "orioledb";
-  # SQL extension version is 1.9, official version is beta17
-  version = "1.9-beta17";
+  # SQL extension version is 1.10, official version is beta18
+  version = "1.10-beta18";
 
   src = fetchFromGitHub {
     owner = "orioledb";
     repo = "orioledb";
-    tag = "beta17";
-    hash = "sha256-gDX28/CHlbLj+jC3Qx6z/Hg6M73K4mFPw3iysc1Xv6I=";
+    tag = "beta18";
+    hash = "sha256-kmNfneISVhlD9Pmnl69pkiAX77MzpzyJQB/5wQ1wiZc=";
   };
 
   buildInputs = postgresql.buildInputs ++ [
diff --git a/pkgs/by-name/or/orioledb/package.nix b/pkgs/by-name/or/orioledb/package.nix
index 724c33e27b90..d2e2fc1dea3a 100644
--- a/pkgs/by-name/or/orioledb/package.nix
+++ b/pkgs/by-name/or/orioledb/package.nix
@@ -8,13 +8,13 @@ let
   orioledb-postgres = postgresql_18.overrideAttrs (
     finalAttrs: oldAttrs: {
       pname = "orioledb-postgres";
-      version = "18.2";
+      version = "18.3";
 
       src = fetchFromGitHub {
         owner = "orioledb";
         repo = "postgres";
-        tag = "patches18_2";
-        hash = "sha256-n/Bl48D20evMo9c0PwdSCvdICDd3Z41OCJEuP3MJ8B4=";
+        tag = "patches18_3";
+        hash = "sha256-XzUVkPSVt6DTMrEWV80KLYoMuNdVVtZvg8Iqq1RSlAs=";
       };
 
       # Configure extracts the patch version from the git tag. This
diff --git a/pkgs/by-name/pc/pcmanfm/package.nix b/pkgs/by-name/pc/pcmanfm/package.nix
index 57f59547b037..4da19f012ac2 100644
--- a/pkgs/by-name/pc/pcmanfm/package.nix
+++ b/pkgs/by-name/pc/pcmanfm/package.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
   passthru.updateScript = nix-update-script { };
 
   meta = {
-    homepage = "https://blog.lxde.org/category/pcmanfm/";
+    homepage = "https://github.com/lxde/pcmanfm";
     license = lib.licenses.gpl2Plus;
     description = "File manager with GTK interface";
     maintainers = [ ];
diff --git a/pkgs/by-name/pr/prl-tools/package.nix b/pkgs/by-name/pr/prl-tools/package.nix
index 5443ddbc49a1..56e245a568e6 100644
--- a/pkgs/by-name/pr/prl-tools/package.nix
+++ b/pkgs/by-name/pr/prl-tools/package.nix
@@ -44,13 +44,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "prl-tools";
-  version = "27.0.1-58670";
+  version = "27.0.2-58673";
 
   # We download the full distribution to extract prl-tools-lin.iso from
   # => ${dmg}/Parallels\ Desktop.app/Contents/Resources/Tools/prl-tools-lin.iso
   src = fetchurl {
     url = "https://download.parallels.com/desktop/v${lib.versions.major finalAttrs.version}/${finalAttrs.version}/ParallelsDesktop-${finalAttrs.version}.dmg";
-    hash = "sha256-ZchIQQ/FyzLmcL2ust1YAqlSsRZWJmDO3t3Ywxo39P0=";
+    hash = "sha256-/buPuva2r9dxSpLdNI9Qg/YTk0Y82XRwFt2XhF24wh0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pr/proj-datumgrid/package.nix b/pkgs/by-name/pr/proj-datumgrid/package.nix
index 5e7cb6e3ce35..aa8a8dd48ea1 100644
--- a/pkgs/by-name/pr/proj-datumgrid/package.nix
+++ b/pkgs/by-name/pr/proj-datumgrid/package.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Repository for proj datum grids";
-    homepage = "https://proj4.org";
+    homepage = "https://proj.org";
     license = lib.licenses.mit;
     maintainers = [ ];
     mainProgram = "nad2bin";
diff --git a/pkgs/by-name/pr/proxytunnel/package.nix b/pkgs/by-name/pr/proxytunnel/package.nix
index 6a556f1ed14e..e392c8051ab9 100644
--- a/pkgs/by-name/pr/proxytunnel/package.nix
+++ b/pkgs/by-name/pr/proxytunnel/package.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     mainProgram = "proxytunnel";
-    homepage = "http://proxytunnel.sf.net/";
+    homepage = "https://proxytunnel.sourceforge.io";
     description = "Stealth tunneling through HTTP(S) proxies";
     platforms = lib.platforms.unix;
     license = lib.licenses.gpl2Only;
diff --git a/pkgs/by-name/px/px0/package.nix b/pkgs/by-name/px/px0/package.nix
new file mode 100644
index 000000000000..48f8959990c2
--- /dev/null
+++ b/pkgs/by-name/px/px0/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "px0";
+  version = "0.1.4";
+
+  src = fetchFromGitHub {
+    owner = "px0-ai";
+    repo = "px0";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-1r000izgL1EFsBpIkyb8u6+RVhV58qHf+AshSYtINmY=";
+  };
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  vendorHash = "sha256-71+6I0u3en/Aw3PVMXx6dF+NQtCiE1T+kd7MENCKnlk=";
+
+  checkFlags = lib.optionals stdenv.hostPlatform.isDarwin [
+    "-skip"
+    "TestListenPortFallback|TestTelemetrySessionLifecycle"
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "-version";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Fast, ultra-light, remote-first IDE for code navigation and review in your browser";
+    homepage = "https://github.com/px0-ai/px0";
+    changelog = "https://github.com/px0-ai/px0/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ sheeeng ];
+    mainProgram = "px0";
+  };
+})
diff --git a/pkgs/by-name/ro/rofi-games/package.nix b/pkgs/by-name/ro/rofi-games/package.nix
index 51efa1e744b0..0727b6dd3d13 100644
--- a/pkgs/by-name/ro/rofi-games/package.nix
+++ b/pkgs/by-name/ro/rofi-games/package.nix
@@ -19,18 +19,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rofi-games";
-  version = "1.18.0";
+  version = "1.19.0";
 
   src = fetchFromGitHub {
     owner = "Rolv-Apneseth";
     repo = "rofi-games";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6/UeQ+j38NeQFkeP0Pb2UKUbwruPgUos3e9TUQwv9WI=";
+    hash = "sha256-+2I4WR5SOLYSWnPUrJFlRwhnebu4RNy3Dd4/gKW8xXU=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-oWmfzlt/qqg1CYfk1pKWhaapiP3iqFU4Idn6pBivjko=";
+    hash = "sha256-dPm9+rxEtx32HVaXLrbxZiVyUrYwFPvuk/gRQR4Fo+s=";
   };
 
   patches = [
diff --git a/pkgs/by-name/sh/shelter/package.nix b/pkgs/by-name/sh/shelter/package.nix
index 9133a9a0642e..7f2e41a12c89 100644
--- a/pkgs/by-name/sh/shelter/package.nix
+++ b/pkgs/by-name/sh/shelter/package.nix
@@ -10,12 +10,12 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "shelter";
-  version = "0-unstable-2026-09-06";
+  version = "0-unstable-2026-09-16";
   src = fetchFromGitHub {
     owner = "uwu";
     repo = "shelter";
-    rev = "ee10d4ecb2fd62fb86ebfdbd37a4e28df9e72f11";
-    hash = "sha256-Ew6RUhIS2gRuCNkbNCNtlmtYSGtjBR4h+UebuDVWhmk=";
+    rev = "0397ffe539fce088f8cab25cc086055d4a5feb71";
+    hash = "sha256-Qagye5ksJyvoOIpoozfWmHTO8Or2F7KWOyXQgbK2vVY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/su/subnetcalc/package.nix b/pkgs/by-name/su/subnetcalc/package.nix
index e6bace3a9cbb..c835347c116e 100644
--- a/pkgs/by-name/su/subnetcalc/package.nix
+++ b/pkgs/by-name/su/subnetcalc/package.nix
@@ -5,17 +5,19 @@
   cmake,
   ninja,
   gettext,
+  libidn2,
+  libmaxminddb,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "subnetcalc";
-  version = "2.6.6";
+  version = "2.7.5";
 
   src = fetchFromGitHub {
     owner = "dreibh";
     repo = "subnetcalc";
     tag = "subnetcalc-${finalAttrs.version}";
-    hash = "sha256-8tC8hBeKy8nxi6nUhWNwnwDgS6NV/9g5L75dsM097IA=";
+    hash = "sha256-xMWEd8F6tQuKVL4aybdwsidBbmPItuNd6iCZUfzjVLA=";
   };
 
   nativeBuildInputs = [
@@ -24,9 +26,14 @@ stdenv.mkDerivation (finalAttrs: {
     gettext
   ];
 
+  buildInputs = [
+    libidn2
+    libmaxminddb
+  ];
+
   meta = {
     description = "IPv4/IPv6 subnet address calculator";
-    homepage = "https://www.uni-due.de/~be0001/subnetcalc/";
+    homepage = "https://www.nntb.no/~dreibh/subnetcalc/";
     license = lib.licenses.gpl3Plus;
     longDescription = ''
       SubNetCalc is an IPv4/IPv6 subnet address calculator. For given IPv4 or
diff --git a/pkgs/by-name/tr/tre/package.nix b/pkgs/by-name/tr/tre/package.nix
index 268f561fbaf5..7be8eda8a933 100644
--- a/pkgs/by-name/tr/tre/package.nix
+++ b/pkgs/by-name/tr/tre/package.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Lightweight and robust POSIX compliant regexp matching library";
-    homepage = "https://laurikari.net/tre/";
+    homepage = "https://github.com/laurikari/tre";
     changelog = "https://github.com/laurikari/tre/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.bsd2;
     mainProgram = "agrep";
diff --git a/pkgs/by-name/tr/treefmt/check-wrapper.nix b/pkgs/by-name/tr/treefmt/check-wrapper.nix
index a7f16e0bdf90..4442f05c45e1 100644
--- a/pkgs/by-name/tr/treefmt/check-wrapper.nix
+++ b/pkgs/by-name/tr/treefmt/check-wrapper.nix
@@ -2,7 +2,8 @@
   lib,
   gitMinimal,
   runCommandLocal,
-  stdenv,
+  gitSetupHook,
+  stdenvNoCC,
   wrapper,
 }:
 /**
@@ -17,12 +18,13 @@ runCommandLocal "${lib.getName wrapper}-check"
     strictDeps = true;
     nativeBuildInputs = [
       gitMinimal
+      gitSetupHook
       wrapper
     ];
     inherit project;
     env = {
-      LANG = if stdenv.buildPlatform.isDarwin then "en_US.UTF-8" else "C.UTF-8";
-      LC_ALL = if stdenv.buildPlatform.isDarwin then "en_US.UTF-8" else "C.UTF-8";
+      LANG = if stdenvNoCC.buildPlatform.isDarwin then "en_US.UTF-8" else "C.UTF-8";
+      LC_ALL = if stdenvNoCC.buildPlatform.isDarwin then "en_US.UTF-8" else "C.UTF-8";
     };
     meta.description = "Check that the project tree is formatted";
   }
@@ -34,8 +36,6 @@ runCommandLocal "${lib.getName wrapper}-check"
 
     # Setup a git repo
     git init --initial-branch main
-    git config user.name nixbld
-    git config user.email nixbld@example.com
     git add .
     git commit -m init --quiet
 
diff --git a/pkgs/by-name/tr/trezor-suite/package.nix b/pkgs/by-name/tr/trezor-suite/package.nix
index a62f0aa87c3c..9b3d72cedd45 100644
--- a/pkgs/by-name/tr/trezor-suite/package.nix
+++ b/pkgs/by-name/tr/trezor-suite/package.nix
@@ -10,7 +10,7 @@
 
 let
   pname = "trezor-suite";
-  version = "26.8.2";
+  version = "26.9.2";
 
   suffix =
     {
@@ -24,8 +24,8 @@ let
     hash =
       {
         # curl -Lfs https://github.com/trezor/trezor-suite/releases/download/v${version}/latest-linux{-arm64,}.yml | grep ^sha512 | sed 's/: /-/'
-        aarch64-linux = "sha512-vbMku80aY5zTa6ObmkuZNkCeONZYsLxnjVxL7QBv14OcDE+vENQ3lyQzVe+spqufMRhCe3hy2ehpA8CewFQKBA==";
-        x86_64-linux = "sha512-bnosz6dtKFaUXaFHXtJSSChSHbW2bj9CK2Dn5X6btB/Xpcsm9Rbnm3If4qh9w1yQYwTlIDBPTRrh8Mh0BGgcag==";
+        aarch64-linux = "sha512-TYPJbatTO9FPsOCSDY+a74xCaiMHozsktSpfW8EaL0yd/74jy0+0VNM8gkHbGANiC7CASygsHfomEe5o5fvBXQ==";
+        x86_64-linux = "sha512-Hd7tkGqLeQJqjnrEVzeULpPxTRpnPS/IZLTU6tyq0PQClrsl/Z2ADuPydfH4g2QlCmMGZMF0TBRvSzRIIrwchw==";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
diff --git a/pkgs/by-name/tr/trimal/package.nix b/pkgs/by-name/tr/trimal/package.nix
index e66e3a25b2bb..481ac27d3006 100644
--- a/pkgs/by-name/tr/trimal/package.nix
+++ b/pkgs/by-name/tr/trimal/package.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Tool for the automated removal of spurious sequences or poorly aligned regions from a multiple sequence alignment";
     license = lib.licenses.gpl3;
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
-    homepage = "http://trimal.cgenomics.org";
+    homepage = "https://trimal.readthedocs.io/en/latest/";
     maintainers = [ lib.maintainers.bzizou ];
   };
 })
diff --git a/pkgs/by-name/vl/vlc/package.nix b/pkgs/by-name/vl/vlc/package.nix
index 9924f98000ee..3148af6652b2 100644
--- a/pkgs/by-name/vl/vlc/package.nix
+++ b/pkgs/by-name/vl/vlc/package.nix
@@ -101,14 +101,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "${optionalString onlyLibVLC "lib"}vlc";
-  version = "3.0.23-2";
+  version = "3.0.24";
 
   src = fetchFromGitLab {
     domain = "code.videolan.org";
     owner = "videolan";
     repo = "vlc";
     rev = finalAttrs.version;
-    hash = "sha256-vg/kKNrIpGF7Olz8EiA1ZsW5SB4iHlvFbREDp4JokB0=";
+    hash = "sha256-WzgWspA1Jpc6FZ3kaEsxNEOI3Xj37Zp43NNbn6LamXg=";
   };
 
   depsBuildBuild = optionals waylandSupport [ pkg-config ];
diff --git a/pkgs/by-name/wa/wavelog/package.nix b/pkgs/by-name/wa/wavelog/package.nix
index 92fb72a95962..9e85ec111071 100644
--- a/pkgs/by-name/wa/wavelog/package.nix
+++ b/pkgs/by-name/wa/wavelog/package.nix
@@ -8,7 +8,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "wavelog";
-  version = "3.2.2";
+  version = "3.2.3";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -17,7 +17,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     owner = "wavelog";
     repo = "wavelog";
     tag = finalAttrs.version;
-    hash = "sha256-jB096icPC4q24/yylkmwuOswMxqxJxsUUVCKb4Xq7dw=";
+    hash = "sha256-ccpUHvoXYBqLvWh6seq7d6uwrKBzIJlzPN055+CBRJY=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/wp/wpa_supplicant/package.nix b/pkgs/by-name/wp/wpa_supplicant/package.nix
index 26a57bb38bbc..49f144995205 100644
--- a/pkgs/by-name/wp/wpa_supplicant/package.nix
+++ b/pkgs/by-name/wp/wpa_supplicant/package.nix
@@ -28,6 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./multiple-configs.patch
+    ./revert-change-breaking-auth-broadcom.patch
   ]
   ++ lib.optional unprivileged ./unprivileged-daemon.patch;
 
diff --git a/pkgs/by-name/wp/wpa_supplicant/revert-change-breaking-auth-broadcom.patch b/pkgs/by-name/wp/wpa_supplicant/revert-change-breaking-auth-broadcom.patch
new file mode 100644
index 000000000000..587716df234e
--- /dev/null
+++ b/pkgs/by-name/wp/wpa_supplicant/revert-change-breaking-auth-broadcom.patch
@@ -0,0 +1,47 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Janne Grunau <janne-fdr@jannau.net>
+Date: Sun, 4 Aug 2024 13:24:42 +0200
+Subject: [PATCH] Revert "Mark authorization completed on driver indication
+ during 4-way HS offload"
+
+This reverts commit 41638606054a09867fe3f9a2b5523aa4678cbfa5.
+---
+ wpa_supplicant/events.c | 25 ++++++++-----------------
+ 1 file changed, 8 insertions(+), 17 deletions(-)
+
+diff --git a/wpa_supplicant/events.c b/wpa_supplicant/events.c
+index 4f85da193608..919a0732b813 100644
+--- a/wpa_supplicant/events.c
++++ b/wpa_supplicant/events.c
+@@ -4925,23 +4925,14 @@ static int wpa_supplicant_event_assoc(struct wpa_supplicant *wpa_s,
+ 		    wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) ||
+ 		   ((wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_OWE_OFFLOAD_STA) &&
+ 		    wpa_s->key_mgmt == WPA_KEY_MGMT_OWE)) {
+-		if (already_authorized) {
+-			/*
+-			 * We are done; the driver will take care of RSN 4-way
+-			 * handshake.
+-			 */
+-			wpa_supplicant_cancel_auth_timeout(wpa_s);
+-			wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
+-			eapol_sm_notify_portValid(wpa_s->eapol, true);
+-			eapol_sm_notify_eap_success(wpa_s->eapol, true);
+-		} else {
+-			/* Update port, WPA_COMPLETED state from the
+-			 * EVENT_PORT_AUTHORIZED handler when the driver is done
+-			 * with the 4-way handshake.
+-			 */
+-			wpa_msg(wpa_s, MSG_DEBUG,
+-				"ASSOC INFO: wait for driver port authorized indication");
+-		}
++		/*
++		 * We are done; the driver will take care of RSN 4-way
++		 * handshake.
++		 */
++		wpa_supplicant_cancel_auth_timeout(wpa_s);
++		wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
++		eapol_sm_notify_portValid(wpa_s->eapol, true);
++		eapol_sm_notify_eap_success(wpa_s->eapol, true);
+ 	} else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_8021X) &&
+ 		   wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
+ 		/*
diff --git a/pkgs/by-name/xp/xpra/package.nix b/pkgs/by-name/xp/xpra/package.nix
index e767c33397dc..0abf548e580a 100644
--- a/pkgs/by-name/xp/xpra/package.nix
+++ b/pkgs/by-name/xp/xpra/package.nix
@@ -294,8 +294,7 @@ effectiveBuildPythonApplication rec {
   };
 
   meta = {
-    homepage = "https://xpra.org/";
-    downloadPage = "https://xpra.org/src/";
+    homepage = "https://github.com/Xpra-org/xpra";
     description = "Persistent remote applications for X";
     changelog = "https://github.com/Xpra-org/xpra/releases/tag/v${version}";
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/xr/xremap/package.nix b/pkgs/by-name/xr/xremap/package.nix
index ad65e67a37c6..04ba66e34142 100644
--- a/pkgs/by-name/xr/xremap/package.nix
+++ b/pkgs/by-name/xr/xremap/package.nix
@@ -58,13 +58,13 @@ assert (
 );
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "xremap${variant.suffix or ""}";
-  version = "0.15.13";
+  version = "0.15.14";
 
   src = fetchFromGitHub {
     owner = "xremap";
     repo = "xremap";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EOZjn1mObQV1C4VevrVdSPRdqw0q5vCLxDJOlIR19C4=";
+    hash = "sha256-KwKIHFBnlq2nIh4E1OeVdr4QSPwa+/zn8B44/84rJko=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -72,7 +72,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   buildNoDefaultFeatures = true;
   buildFeatures = variant.features;
 
-  cargoHash = "sha256-fE4lwnC1AtdK2Ev+NT77Q4PqWU07sHccBbEpzd4YATA=";
+  cargoHash = "sha256-lkg1bnTEGUO7ce1Y6a1iK5khoswG3trlSthtp3otem4=";
 
   passthru = lib.mapAttrs (name: lib.const (xremap.override { withVariant = name; })) variants;
 
diff --git a/pkgs/by-name/yo/yoda/package.nix b/pkgs/by-name/yo/yoda/package.nix
index c341372ccd89..858a2b6c3241 100644
--- a/pkgs/by-name/yo/yoda/package.nix
+++ b/pkgs/by-name/yo/yoda/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "yoda";
-  version = "2.1.2";
+  version = "2.1.4";
 
   src = fetchFromGitLab {
     owner = "hepcedar";
     repo = "yoda";
     rev = "yoda-${finalAttrs.version}";
-    hash = "sha256-cgThoxqPX6dVyGNTLXatW3uQV+41o38fTfkvHXsDs9A=";
+    hash = "sha256-nj/hvwVqYRqRBiDs5dSXSX/HHEmIXPc8rl5MXXhWhyw=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/za/zabbix-agent2-plugin-postgresql/package.nix b/pkgs/by-name/za/zabbix-agent2-plugin-postgresql/package.nix
deleted file mode 100644
index 938cbf8e9889..000000000000
--- a/pkgs/by-name/za/zabbix-agent2-plugin-postgresql/package.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  fetchurl,
-}:
-
-buildGoModule (finalAttrs: {
-  pname = "zabbix-agent2-plugin-postgresql";
-  version = "7.4.14";
-
-  src = fetchurl {
-    url = "https://cdn.zabbix.com/zabbix-agent2-plugins/sources/postgresql/zabbix-agent2-plugin-postgresql-${finalAttrs.version}.tar.gz";
-    hash = "sha256-H+WwJ9RrITeWKErMW+vcEG/Z2rAjbznVg/dK3ZM7j0I=";
-  };
-
-  vendorHash = null;
-
-  meta = {
-    description = "Required tool for Zabbix agent integrated PostgreSQL monitoring";
-    mainProgram = "postgresql";
-    homepage = "https://www.zabbix.com/integrations/postgresql";
-    license =
-      if (lib.versions.major finalAttrs.version >= "7") then
-        lib.licenses.agpl3Only
-      else
-        lib.licenses.gpl2Plus;
-    maintainers = with lib.maintainers; [ gador ];
-    platforms = lib.platforms.linux;
-  };
-})
diff --git a/pkgs/by-name/zu/zulip/package.nix b/pkgs/by-name/zu/zulip/package.nix
index a71e30515fc9..8ac5545f098c 100644
--- a/pkgs/by-name/zu/zulip/package.nix
+++ b/pkgs/by-name/zu/zulip/package.nix
@@ -19,13 +19,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "zulip";
-  version = "5.13.1";
+  version = "5.13.2";
 
   src = fetchFromGitHub {
     owner = "zulip";
     repo = "zulip-desktop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bYN63EQo+c0SIz3BBIwkAS1QqS7+sg7JdpoOekVYq5Q=";
+    hash = "sha256-QFKyslnO+C64ursHyFWFbBzOqFHFXwiavDNfA13eJww=";
   };
 
   __structuredAttrs = true;
diff --git a/pkgs/development/haskell-modules/configuration-darwin.nix b/pkgs/development/haskell-modules/configuration-darwin.nix
index bdab68723322..ea76a96800e8 100644
--- a/pkgs/development/haskell-modules/configuration-darwin.nix
+++ b/pkgs/development/haskell-modules/configuration-darwin.nix
@@ -16,18 +16,6 @@ self: super:
     # see: https://github.com/psibi/shell-conduit/issues/12
     shell-conduit = dontCheck super.shell-conduit;
 
-    conduit-extra = overrideCabal (drv: {
-      __darwinAllowLocalNetworking = true;
-    }) super.conduit-extra;
-
-    spacecookie = overrideCabal (_: {
-      __darwinAllowLocalNetworking = true;
-    }) super.spacecookie;
-
-    streaming-commons = overrideCabal (_: {
-      __darwinAllowLocalNetworking = true;
-    }) super.streaming-commons;
-
     # Hakyll's tests are broken on Darwin (3 failures); and they require util-linux
     hakyll = overrideCabal {
       testToolDepends = [ ];
@@ -134,12 +122,6 @@ self: super:
       + (oldAttrs.preCompileBuildDriver or "");
     }) super.llvm-hs;
 
-    yesod-core = overrideCabal (drv: {
-      # Allow access to local networking when the Darwin sandbox is enabled, so yesod-core can
-      # run tests that access localhost.
-      __darwinAllowLocalNetworking = true;
-    }) super.yesod-core;
-
     hidapi = super.hidapi.override { systemd = null; };
 
     # Ensure the necessary frameworks are propagatedBuildInputs on darwin
@@ -234,12 +216,6 @@ self: super:
     # Otherwise impure gcc is used, which is Apple's weird wrapper
     c2hsc = addTestToolDepends [ pkgs.gcc ] super.c2hsc;
 
-    http2 = overrideCabal (drv: {
-      # Allow access to local networking when the Darwin sandbox is enabled, so http2 can run tests
-      # that access localhost.
-      __darwinAllowLocalNetworking = true;
-    }) super.http2;
-
     # https://hydra.nixos.org/build/230964714/nixlog/1
     inline-c-cpp = appendPatch (pkgs.fetchpatch {
       url = "https://github.com/fpco/inline-c/commit/e8dc553b13bb847409fdced649a6a863323cff8a.patch";
@@ -252,45 +228,57 @@ self: super:
     # Tests fail on macOS https://github.com/mrkkrp/zip/issues/112
     zip = dontCheck super.zip;
 
-    dap = overrideCabal (drv: {
-      __darwinAllowLocalNetworking = true;
-    }) super.dap;
-
-    essence-of-live-coding-warp = overrideCabal (drv: {
-      __darwinAllowLocalNetworking = true;
-    }) super.essence-of-live-coding-warp;
-
-    http-streams = overrideCabal (drv: {
-      __darwinAllowLocalNetworking = true;
-    }) super.http-streams;
-
-    io-streams = overrideCabal (drv: {
-      __darwinAllowLocalNetworking = true;
-    }) super.io-streams;
-
-    io-streams-haproxy = overrideCabal (drv: {
-      __darwinAllowLocalNetworking = true;
-    }) super.io-streams-haproxy;
-
-    jsaddle-warp = overrideCabal (drv: {
-      __darwinAllowLocalNetworking = true;
-    }) super.jsaddle-warp;
-
-    openssl-streams = overrideCabal (drv: {
-      __darwinAllowLocalNetworking = true;
-    }) super.openssl-streams;
-
-    servant-auth-client = overrideCabal (drv: {
-      __darwinAllowLocalNetworking = true;
-    }) super.servant-auth-client;
-
-    servant-client = overrideCabal (drv: {
-      __darwinAllowLocalNetworking = true;
-    }) super.servant-client;
-
-    snap = overrideCabal (drv: {
-      __darwinAllowLocalNetworking = true;
-    }) super.snap;
+    inherit
+      (lib.mapAttrs (
+        _:
+        overrideCabal (drv: {
+          __darwinAllowLocalNetworking = true;
+        })
+      ) super)
+      cisco-spark-api
+      conduit-extra
+      context-http-client
+      context-wai-middleware
+      dap
+      essence-of-live-coding-warp
+      haskell-bee-redis
+      http-client-websockets
+      http-io-streams
+      http-streams
+      http2
+      io-streams
+      io-streams-haproxy
+      jsaddle-warp
+      katip-wai
+      keter
+      monad-metrics-extensible
+      mysql-haskell
+      network
+      network-transport-tcp
+      network-wait
+      om-socket
+      openssl-streams
+      polysemy-webserver
+      port-utils
+      servant-auth-client
+      servant-client
+      servant-hmac-auth
+      servant-prometheus
+      snap
+      spacecookie
+      streaming-commons
+      sydtest-servant
+      sydtest-wai
+      sydtest-yesod
+      wai-app-file-cgi
+      wai-make-assets
+      wai-token-bucket-ratelimiter
+      webex-teams-api
+      webex-teams-pipes
+      ws-chans
+      yesod-core
+      zeromq4-haskell
+      ;
 
     warp = overrideCabal (drv: {
       __darwinAllowLocalNetworking = true;
@@ -376,10 +364,6 @@ self: super:
     servant-auth-server = dontCheck super.servant-auth-server;
 
     sysinfo = dontCheck super.sysinfo;
-
-    network = overrideCabal (drv: {
-      __darwinAllowLocalNetworking = true;
-    }) super.network;
   }
   // lib.optionalAttrs pkgs.stdenv.hostPlatform.isAarch64 {
     # aarch64-darwin
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index f4860b62760d..83844b8c2759 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -98,6 +98,12 @@ in
 
   cjson = prev.lua-cjson;
 
+  cosmo = prev.cosmo.overrideAttrs (old: {
+    meta = (old.meta or { }) // {
+      homepage = "https://github.com/mascarenhas/cosmo";
+    };
+  });
+
   cqueues = prev.cqueues.overrideAttrs (old: {
     # Parse out a version number without the Lua version inserted
     version =
@@ -348,6 +354,7 @@ in
     '';
     meta = (old.meta or { }) // {
       broken = luaOlder "5.1" || luaAtLeast "5.3";
+      homepage = "https://github.com/justincormack/ljsyscall";
     };
 
     propagatedBuildInputs = old.propagatedBuildInputs ++ lib.optional (!isLuaJIT) final.luaffi;
@@ -1310,6 +1317,7 @@ in
 
   vicious = prev.vicious.overrideAttrs (old: {
     meta = (old.meta or { }) // {
+      homepage = "https://vicious.readthedocs.io/";
       changelog = "https://github.com/vicious-widgets/vicious/blob/v${old.version}/CHANGELOG.rst";
       maintainers = with lib.maintainers; [
         makefu
diff --git a/pkgs/development/python-modules/detect-secrets/default.nix b/pkgs/development/python-modules/detect-secrets/default.nix
index 2b5e7229b48e..9a705caca43b 100644
--- a/pkgs/development/python-modules/detect-secrets/default.nix
+++ b/pkgs/development/python-modules/detect-secrets/default.nix
@@ -65,8 +65,20 @@ buildPythonPackage rec {
     "test_make_decisions"
     "test_saves_to_baseline"
     "test_start_halfway"
+  ]
+  ++ lib.optionals (!withGibberish) [
+    "test_load_and_output"
+    "test_quit_if_baseline_is_changed_but_not_staged"
   ];
 
+  disabledTestPaths =
+    lib.optionals (!withGibberish) [
+      "tests/filters/gibberish_filter_test.py"
+    ]
+    ++ lib.optionals (!withWordList) [
+      "tests/filters/wordlist_filter_test.py"
+    ];
+
   pythonImportsCheck = [ "detect_secrets" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/notobuilder/default.nix b/pkgs/development/python-modules/notobuilder/default.nix
index b100feb1f214..8c0eb436c1d0 100644
--- a/pkgs/development/python-modules/notobuilder/default.nix
+++ b/pkgs/development/python-modules/notobuilder/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage {
   pname = "notobuilder";
-  version = "0-unstable-2026-06-26";
+  version = "0-unstable-2026-09-24";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "notofonts";
     repo = "notobuilder";
-    rev = "5b55818eb3f535481135a5f57a337eec6d28cda0";
-    hash = "sha256-pdfWl8rp4tizgb7j0UR7hOW/Ae2dPhTSw1IHljM15LE=";
+    rev = "efda64ea4bdb249cfa69cad28d9cf2febfc7b0c8";
+    hash = "sha256-xAddENwuFPc3Yk0xqWZKbnUAdj3Ka7hoOl+YmYSh3XI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pdf2image/default.nix b/pkgs/development/python-modules/pdf2image/default.nix
index b18981d2ab62..5347ffbb5d08 100644
--- a/pkgs/development/python-modules/pdf2image/default.nix
+++ b/pkgs/development/python-modules/pdf2image/default.nix
@@ -20,7 +20,9 @@ buildPythonPackage rec {
     # replace all default values of paths to poppler-utils
     substituteInPlace pdf2image/pdf2image.py \
       --replace-fail 'poppler_path: Union[str, PurePath] = None' \
-                     'poppler_path: Union[str, PurePath] = "${poppler-utils}/bin"'
+                     'poppler_path: Union[str, PurePath] = "${poppler-utils}/bin"' \
+      --replace-fail 'poppler_path: str = None' \
+                     'poppler_path: str = "${poppler-utils}/bin"'
   '';
 
   propagatedBuildInputs = [ pillow ];
diff --git a/pkgs/development/python-modules/pyfribidi/default.nix b/pkgs/development/python-modules/pyfribidi/default.nix
deleted file mode 100644
index 69e91b171cc2..000000000000
--- a/pkgs/development/python-modules/pyfribidi/default.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{
-  lib,
-  stdenv,
-  buildPythonPackage,
-  fetchPypi,
-  isPyPy,
-  six,
-}:
-
-buildPythonPackage rec {
-  version = "0.12.0";
-  format = "setuptools";
-  pname = "pyfribidi";
-  disabled = isPyPy;
-
-  src = fetchPypi {
-    inherit pname version;
-    extension = "zip";
-    sha256 = "64726a4a56783acdc79c6b9b3a15f16e6071077c897a0b999f3b43f744bc621c";
-  };
-
-  patches = lib.optional stdenv.cc.isClang ./pyfribidi-clang.patch;
-
-  propagatedBuildInputs = [ six ];
-
-  meta = {
-    description = "Simple wrapper around fribidi";
-    homepage = "https://github.com/pediapress/pyfribidi";
-    license = lib.licenses.gpl2;
-  };
-}
diff --git a/pkgs/development/python-modules/pyfribidi/pyfribidi-clang.patch b/pkgs/development/python-modules/pyfribidi/pyfribidi-clang.patch
deleted file mode 100644
index c570843f7e8b..000000000000
--- a/pkgs/development/python-modules/pyfribidi/pyfribidi-clang.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-diff --git a/pyfribidi.c b/pyfribidi.c
-index 9a0120d..238134a 100644
---- a/pyfribidi.c
-+++ b/pyfribidi.c
-@@ -148,10 +148,11 @@ init_pyfribidi (void)
- {
- #if PY_MAJOR_VERSION >= 3
-         PyObject *module = PyModule_Create (&pyfribidi_moduledef);
-+        if (module == NULL) return NULL;
- #else
-         PyObject *module = Py_InitModule ("_pyfribidi", PyfribidiMethods);
-+        if (module == NULL) return;
- #endif
--	if (module == NULL) return NULL;
- 
- 	PyModule_AddIntConstant (module, "RTL", (long) FRIBIDI_TYPE_RTL);
- 	PyModule_AddIntConstant (module, "LTR", (long) FRIBIDI_TYPE_LTR);
diff --git a/pkgs/development/python-modules/sphinx-fortran/default.nix b/pkgs/development/python-modules/sphinx-fortran/default.nix
index 76e1f9f24e06..4d835b25630d 100644
--- a/pkgs/development/python-modules/sphinx-fortran/default.nix
+++ b/pkgs/development/python-modules/sphinx-fortran/default.nix
@@ -37,7 +37,7 @@ buildPythonPackage {
 
   meta = {
     description = "Fortran domain and autodoc extensions to Sphinx";
-    homepage = "http://sphinx-fortran.readthedocs.org/";
+    homepage = "http://sphinx-fortran.readthedocs.io/";
     license = lib.licenses.cecill21;
     maintainers = with lib.maintainers; [ loicreynier ];
   };
diff --git a/pkgs/development/tools/rust/cargo-pgrx/buildPgrxExtension.nix b/pkgs/development/tools/rust/cargo-pgrx/buildPgrxExtension.nix
index ecffd2a3f5f5..df4cc7fa1202 100644
--- a/pkgs/development/tools/rust/cargo-pgrx/buildPgrxExtension.nix
+++ b/pkgs/development/tools/rust/cargo-pgrx/buildPgrxExtension.nix
@@ -124,6 +124,8 @@ lib.extendMkDerivation {
       cargoPgrxFlags' = lib.escapeShellArgs cargoPgrxFlags;
     in
     {
+      __structuredAttrs = true;
+
       buildInputs = (args.buildInputs or [ ]);
 
       nativeBuildInputs =
diff --git a/pkgs/servers/monitoring/zabbix/versions.nix b/pkgs/servers/monitoring/zabbix/versions.nix
index 7cc388aaaeb3..560193b68883 100644
--- a/pkgs/servers/monitoring/zabbix/versions.nix
+++ b/pkgs/servers/monitoring/zabbix/versions.nix
@@ -2,13 +2,25 @@ generic: {
   v74 = generic {
     version = "7.4.14";
     hash = "sha256-795fbxmJbwIAu1JF44ZgNWZyccex6EYm0mCV8kpvu0I=";
+    emberPlusHash = "sha256-riwnpB9ziZhIy9Lqt+JBEfdMR89ZRDmaGC1ibKu6fcU=";
+    mongodbHash = "sha256-zW4wmh422+BlMgtR8+zrrOgTMMtWJbXPRu9MgZwNUt8=";
+    mssqlHash = "sha256-wygP7Li39+MfX+b3h5YJmYhDQKd/ta/sMuLtZI6UgiE=";
+    postgresqlHash = "sha256-H+WwJ9RrITeWKErMW+vcEG/Z2rAjbznVg/dK3ZM7j0I=";
   };
   v70 = generic {
     version = "7.0.30";
     hash = "sha256-wMpAeRGa3uxBNeM1HRuEkVet4HbDUsAGco5zLxcHIyw=";
+    emberPlusHash = "sha256-BXFaELxPrUSIF8+/Jpv+WfGYpJA4VK8wdL4oDFPn+/A=";
+    mongodbHash = "sha256-DhDqLXjGAQXBn9U5fVhZgxsP0MHMKgz35YI8K74mWxo=";
+    mssqlHash = "sha256-Ow15PXUq+kKyeM7j/TNZe/LKKDcmdpB04XE3SkagdRI=";
+    postgresqlHash = "sha256-7BFLstJRAh+rdDW9G7kspMYqRubdfXS9AimMDuMB8UM=";
   };
   v60 = generic {
     version = "6.0.48";
     hash = "sha256-cIibBi7O1e5YKjznoyli/lq7gX/UhoPEc8K8a1kDZJw=";
+    emberPlusHash = "sha256-KtypkgjExw0aajGGr8gFi6VCpofaI/fd+BgBUqdvgBQ=";
+    mongodbHash = "sha256-5RC9rYj4/2MkGPpCmR/hVERp1NxDSTcyn0DZRarFAIM=";
+    mssqlHash = "sha256-UoIHydaa8CPRF2uXXLQAGnX+ImMyMqE3vdMB8e8Zn1c=";
+    postgresqlHash = "sha256-uBkcF5J9BgmqNPTiMPGf4EgUHbidqrLygud7dHFLSe0=";
   };
 }
diff --git a/pkgs/servers/monitoring/zabbix/zabbix-agent2-plugins/ember-plus.nix b/pkgs/servers/monitoring/zabbix/zabbix-agent2-plugins/ember-plus.nix
new file mode 100644
index 000000000000..9c312ba7e7b9
--- /dev/null
+++ b/pkgs/servers/monitoring/zabbix/zabbix-agent2-plugins/ember-plus.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  buildGoModule,
+  fetchurl,
+}:
+
+import ../versions.nix (
+  { version, emberPlusHash, ... }:
+  buildGoModule (finalAttrs: {
+    pname = "zabbix-agent2-plugin-ember-plus";
+    inherit version;
+
+    src = fetchurl {
+      url = "https://cdn.zabbix.com/zabbix-agent2-plugins/sources/ember-plus/zabbix-agent2-plugin-ember-plus-${finalAttrs.version}.tar.gz";
+      hash = emberPlusHash;
+    };
+
+    vendorHash = null;
+
+    meta = {
+      description = "Zabbix agent2 plugin for monitoring Ember Plus";
+      mainProgram = "ember-plus";
+      homepage = "https://www.zabbix.com/documentation/current/en/manual/appendix/config/zabbix_agent2_plugins/ember_plus_plugin";
+      license =
+        if (lib.versions.major finalAttrs.version >= "7") then
+          lib.licenses.agpl3Only
+        else
+          lib.licenses.gpl2Plus;
+      maintainers = with lib.maintainers; [ thelolcoder2007 ];
+      platforms = lib.platforms.linux;
+    };
+  })
+)
diff --git a/pkgs/servers/monitoring/zabbix/zabbix-agent2-plugins/mongodb.nix b/pkgs/servers/monitoring/zabbix/zabbix-agent2-plugins/mongodb.nix
new file mode 100644
index 000000000000..059205cc9645
--- /dev/null
+++ b/pkgs/servers/monitoring/zabbix/zabbix-agent2-plugins/mongodb.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  buildGoModule,
+  fetchurl,
+}:
+
+import ../versions.nix (
+  { version, mongodbHash, ... }:
+  buildGoModule (finalAttrs: {
+    pname = "zabbix-agent2-plugin-mongodb";
+    inherit version;
+
+    src = fetchurl {
+      url = "https://cdn.zabbix.com/zabbix-agent2-plugins/sources/mongodb/zabbix-agent2-plugin-mongodb-${finalAttrs.version}.tar.gz";
+      hash = mongodbHash;
+    };
+
+    vendorHash = null;
+
+    meta = {
+      description = "Zabbix agent2 plugin for monitoring Mongodb";
+      mainProgram = "mongodb";
+      homepage = "https://www.zabbix.com/documentation/current/en/manual/appendix/config/zabbix_agent2_plugins/mongodb_plugin";
+      license =
+        if (lib.versions.major finalAttrs.version >= "7") then
+          lib.licenses.agpl3Only
+        else
+          lib.licenses.gpl2Plus;
+      maintainers = with lib.maintainers; [ thelolcoder2007 ];
+      platforms = lib.platforms.linux;
+    };
+  })
+)
diff --git a/pkgs/servers/monitoring/zabbix/zabbix-agent2-plugins/mssql.nix b/pkgs/servers/monitoring/zabbix/zabbix-agent2-plugins/mssql.nix
new file mode 100644
index 000000000000..295ee9324432
--- /dev/null
+++ b/pkgs/servers/monitoring/zabbix/zabbix-agent2-plugins/mssql.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  buildGoModule,
+  fetchurl,
+}:
+
+import ../versions.nix (
+  { version, mssqlHash, ... }:
+  buildGoModule (finalAttrs: {
+    pname = "zabbix-agent2-plugin-mssql";
+    inherit version;
+
+    src = fetchurl {
+      url = "https://cdn.zabbix.com/zabbix-agent2-plugins/sources/mssql/zabbix-agent2-plugin-mssql-${finalAttrs.version}.tar.gz";
+      hash = mssqlHash;
+    };
+
+    vendorHash = null;
+
+    meta = {
+      description = "Zabbix agent2 plugin for monitoring Microsoft SQL servers";
+      mainProgram = "mssql";
+      homepage = "https://www.zabbix.com/documentation/current/en/manual/appendix/config/zabbix_agent2_plugins/mssql_plugin";
+      license =
+        if (lib.versions.major finalAttrs.version >= "7") then
+          lib.licenses.agpl3Only
+        else
+          lib.licenses.gpl2Plus;
+      maintainers = with lib.maintainers; [ thelolcoder2007 ];
+      platforms = lib.platforms.linux;
+    };
+  })
+)
diff --git a/pkgs/servers/monitoring/zabbix/zabbix-agent2-plugins/postgresql.nix b/pkgs/servers/monitoring/zabbix/zabbix-agent2-plugins/postgresql.nix
new file mode 100644
index 000000000000..54d7b9a54a2f
--- /dev/null
+++ b/pkgs/servers/monitoring/zabbix/zabbix-agent2-plugins/postgresql.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  buildGoModule,
+  fetchurl,
+}:
+
+import ../versions.nix (
+  { version, postgresqlHash, ... }:
+  buildGoModule (finalAttrs: {
+    pname = "zabbix-agent2-plugin-postgresql";
+    inherit version;
+
+    src = fetchurl {
+      url = "https://cdn.zabbix.com/zabbix-agent2-plugins/sources/postgresql/zabbix-agent2-plugin-postgresql-${finalAttrs.version}.tar.gz";
+      hash = postgresqlHash;
+    };
+
+    vendorHash = null;
+
+    meta = {
+      description = "Required tool for Zabbix agent integrated PostgreSQL monitoring";
+      mainProgram = "postgresql";
+      homepage = "https://www.zabbix.com/integrations/postgresql";
+      license =
+        if (lib.versions.major finalAttrs.version >= "7") then
+          lib.licenses.agpl3Only
+        else
+          lib.licenses.gpl2Plus;
+      maintainers = with lib.maintainers; [
+        gador
+        thelolcoder2007
+      ];
+      platforms = lib.platforms.linux;
+    };
+  })
+)
diff --git a/pkgs/servers/sql/postgresql/ext/tsja.nix b/pkgs/servers/sql/postgresql/ext/tsja.nix
index 1610f414f038..141d7652fa03 100644
--- a/pkgs/servers/sql/postgresql/ext/tsja.nix
+++ b/pkgs/servers/sql/postgresql/ext/tsja.nix
@@ -24,6 +24,9 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace tsja.c --replace-fail /usr/local/lib/mecab ${mecab}/lib/mecab
   '';
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   buildInputs = [
     mecab
     postgresql
diff --git a/pkgs/servers/sql/postgresql/postgresqlBuildExtension.nix b/pkgs/servers/sql/postgresql/postgresqlBuildExtension.nix
index 1fc3574fc77e..bcb566f722fd 100644
--- a/pkgs/servers/sql/postgresql/postgresqlBuildExtension.nix
+++ b/pkgs/servers/sql/postgresql/postgresqlBuildExtension.nix
@@ -89,6 +89,7 @@ lib.extendMkDerivation {
         };
 
       strictDeps = true;
+      __structuredAttrs = true;
       buildInputs = [ postgresql ] ++ prevAttrs.buildInputs or [ ];
       nativeBuildInputs = [ postgresql.pg_config ] ++ prevAttrs.nativeBuildInputs or [ ];
 
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 48d26cdfeea8..616fbfa30137 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -2565,6 +2565,7 @@ mapAliases {
   theme-jade1 = throw "'theme-jade1' has been removed because it depended on 'gtk-engine-murrine', which was removed because it was unmaintained upstream and depended on GTK 2."; # Added 2026-07-22
   theme-obsidian2 = throw "'theme-obsidian2' has been removed because it depended on 'gtk-engine-murrine', which was removed because it was unmaintained upstream and depended on GTK 2."; # Added 2026-07-22
   theme-vertex = throw "'theme-vertex' has been removed because it depended on 'gtk-engine-murrine', which was removed because it was unmaintained upstream and depended on GTK 2."; # Added 2026-07-22
+  themes = throw "'themes' has ben removed because it was unused"; # Added 2026-09-27
   thinkingRock = throw "'thinkingRock' has been removed due to being unmaintained decades old software"; # Added 2026-02-12
   thrust = throw "'thrust' has been removed due to lack of maintenance"; # Added 2025-08-21
   thunderbird-128 = throw "Thunderbird 128 support ended in August 2025"; # Added 2025-09-30
@@ -2632,6 +2633,7 @@ mapAliases {
   uhttpmock_1_0 = warnAlias "'uhttpmock_1_0' has been renamed to 'uhttpmock'" uhttpmock; # Added 2026-05-30
   unicap = throw "'unicap' has been removed because it is unmaintained"; # Added 2025-05-17
   unifi-poller = throw "'unifi-poller' has been renamed to/replaced by 'unpoller'"; # Converted to throw 2025-10-27
+  unifiedpush-common-proxies = warnAlias "'unifiedpush-common-proxies' has been renamed to 'common-proxies'" common-proxies; # Added 2026-09-27
   unixODBC = warnAlias "'unixODBC' has been renamed to 'unixodbc'" unixodbc; # Added 2026-02-12
   unixODBCDrivers = warnAlias "'unixODBCDrivers' has been renamed to 'unixodbcDrivers'" unixodbcDrivers; # Added 2026-02-12
   unrar_6 = throw "'unrar_6' has been renamed to/replaced by 'unrar'"; # Added 2026-03-11
@@ -3144,6 +3146,7 @@ mapAliases {
   yubikey-manager-qt = throw "'yubikey-manager-qt' has been removed due to being archived upstream. Consider using 'yubioath-flutter' instead."; # Added 2025-06-07
   yubikey-personalization-gui = throw "'yubikey-personalization-gui' has been removed due to being archived upstream. Consider using 'yubioath-flutter' instead."; # Added 2025-06-07
   zabbix72 = throw "'zabbix72' was removed as it has reached its end of life"; # Added 2026-02-11
+  zabbix-agent2-plugin-postgresql = throw "'zabbix-agent2-plugin-postgresql' is moved to 'zabbix74.plugins.postgresql'"; # Added 2026-09-27
   zandronum-alpha = throw "'zandronum-alpha' has been removed as it was broken and the stable version has caught up"; # Added 2025-10-19
   zandronum-alpha-server = throw "'zandronum-alpha-server' has been removed as it was broken and the stable version has caught up"; # Added 2025-10-19
   zap-chip-gui = throw "the gui variant of zap-chip was removed as it was not really functional"; # Added 2026-05-30
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 05de70d4f7da..2f0517bfbe9d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7519,6 +7519,18 @@ with pkgs;
     web = (callPackages ../servers/monitoring/zabbix/web.nix { }).${version};
     agent2 = (callPackages ../servers/monitoring/zabbix/agent2.nix { }).${version};
 
+    plugins = {
+      ember-plus =
+        (callPackages ../servers/monitoring/zabbix/zabbix-agent2-plugins/ember-plus.nix { }).${version};
+      mongodb =
+        (callPackages ../servers/monitoring/zabbix/zabbix-agent2-plugins/mongodb.nix { }).${version};
+      mssql = (callPackages ../servers/monitoring/zabbix/zabbix-agent2-plugins/mssql.nix { }).${version};
+      nvidia-gpu =
+        (callPackages ../servers/monitoring/zabbix/zabbix-agent2-plugins/nvidia-gpu.nix { }).${version};
+      postgresql =
+        (callPackages ../servers/monitoring/zabbix/zabbix-agent2-plugins/postgresql.nix { }).${version};
+    };
+
     # backwards compatibility
     server = server-pgsql;
   };
@@ -8202,8 +8214,6 @@ with pkgs;
     source-han-serif-vf-ttf
     ;
 
-  themes = name: callPackage (../data/misc/themes + ("/" + name + ".nix")) { };
-
   tex-gyre = recurseIntoAttrs (callPackages ../data/fonts/tex-gyre { });
 
   tex-gyre-math = recurseIntoAttrs (callPackages ../data/fonts/tex-gyre-math { });
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index e139173982f4..3c5c2369bcd8 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -534,6 +534,7 @@ mapAliases {
   pyfantom = throw "pyfantom has been removed because it does not work with python3 and has not been updated for 12 years"; # added 2025-03-25
   pyflick = throw "pyflick was removed because Flick Electric no longer exists"; # added 2025-12-03
   pyflunearyou = throw "'pyflunearyou' has been renamed to/replaced by 'pyoutbreaksnearme'"; # Converted to throw 2025-10-29
+  pyfribidi = throw "'pyfribidi' has been removed because it is unmaintained upstream"; # added 2026-09-27
   pygame_sdl2 = throw "'pygame_sdl2' has been renamed to/replaced by 'pygame-sdl2'"; # Converted to throw 2025-10-29
   PyGithub = throw "'PyGithub' has been renamed to/replaced by 'pygithub'"; # Converted to throw 2025-10-29
   pygls_2 = pygls; # added 2026-01-05
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 1b13ee04f9dc..3558dc880ff7 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -15012,8 +15012,6 @@ self: super: with self; {
 
   pyfreshr = callPackage ../development/python-modules/pyfreshr { };
 
-  pyfribidi = callPackage ../development/python-modules/pyfribidi { };
-
   pyfritzhome = callPackage ../development/python-modules/pyfritzhome { };
 
   pyfronius = callPackage ../development/python-modules/pyfronius { };