diff --git a/nixos/modules/programs/fzf.nix b/nixos/modules/programs/fzf.nix
index d4a7f62d45fd..20e9c9910917 100644
--- a/nixos/modules/programs/fzf.nix
+++ b/nixos/modules/programs/fzf.nix
@@ -44,7 +44,7 @@ in
       };
 
       fish.interactiveShellInit = lib.optionalString cfg.keybindings ''
-        source ${pkgs.fzf}/share/fzf/key-bindings.fish
+        source ${pkgs.fzf}/share/fzf/key-bindings.fish && fzf_key_bindings
       '';
     };
   };
diff --git a/nixos/modules/programs/yubikey-manager.nix b/nixos/modules/programs/yubikey-manager.nix
index 1dc2b15e202c..3f38beabf474 100644
--- a/nixos/modules/programs/yubikey-manager.nix
+++ b/nixos/modules/programs/yubikey-manager.nix
@@ -12,6 +12,8 @@ in
   options = {
     programs.yubikey-manager = {
       enable = lib.mkEnableOption "yubikey-manager";
+
+      package = lib.mkPackageOption pkgs "yubikey-manager" { };
     };
   };
 
diff --git a/nixos/modules/services/web-apps/nextcloud.md b/nixos/modules/services/web-apps/nextcloud.md
index 0c038347c913..eadc90a6a610 100644
--- a/nixos/modules/services/web-apps/nextcloud.md
+++ b/nixos/modules/services/web-apps/nextcloud.md
@@ -65,8 +65,8 @@ The management command [`occ`](https://docs.nextcloud.com/server/stable/admin_ma
 invoked by using the `nextcloud-occ` wrapper that's globally available on a system with Nextcloud enabled.
 
 It requires elevated permissions to become the `nextcloud` user. Given the way the privilege
-escalation is implemented, parameters passed via the environment to Nextcloud (e.g. `OC_PASS`) are
-currently ignored.
+escalation is implemented, parameters passed via the environment to Nextcloud are
+currently ignored, except for `OC_PASS` and `NC_PASS`.
 
 Custom service units that need to run `nextcloud-occ` either need elevated privileges
 or the systemd configuration from `nextcloud-setup.service` (recommended):
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index 0572b9529c04..98d829c1a827 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -163,17 +163,23 @@ let
             --wait \
             --collect \
             --service-type=exec \
+            --setenv OC_PASS \
+            --setenv NC_PASS \
             --quiet \
             ${command}
         elif [[ "$USER" != nextcloud ]]; then
           if [[ -x /run/wrappers/bin/sudo ]]; then
             exec /run/wrappers/bin/sudo \
               --preserve-env=CREDENTIALS_DIRECTORY \
+              --preserve-env=OC_PASS \
+              --preserve-env=NC_PASS \
               --user=nextcloud \
               ${command}
           else
             exec ${lib.getExe' pkgs.util-linux "runuser"} \
               --whitelist-environment=CREDENTIALS_DIRECTORY \
+              --whitelist-environment=OC_PASS \
+              --whitelist-environment=NC_PASS \
               --user=nextcloud \
               ${command}
           fi
diff --git a/pkgs/applications/networking/cluster/terraform-providers/default.nix b/pkgs/applications/networking/cluster/terraform-providers/default.nix
index b20c1b54dbcf..a861f464e45b 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/default.nix
+++ b/pkgs/applications/networking/cluster/terraform-providers/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   buildGoModule,
+  buildGo125Module,
   fetchFromGitHub,
   fetchFromGitLab,
   callPackage,
@@ -109,6 +110,8 @@ let
       propagatedBuildInputs = [ cdrtools ];
     });
     minio = automated-providers.minio.override { spdx = "AGPL-3.0-only"; };
+    # requires go >= 1.25.0
+    talos = automated-providers.talos.override { mkProviderGoModule = buildGo125Module; };
   };
 
   # Put all the providers we not longer support in this list.
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 7d395f40facd..77062323ecb9 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1093,13 +1093,13 @@
     "vendorHash": "sha256-mnKXYT0GfIS+ODzBCS9l4rLF1ugadesmpgdOgj74nLg="
   },
   "proxmox": {
-    "hash": "sha256-vrlZ2bt2Eczst+Xu5BZZqFp2aJzb1WrHZS/p3f99gRI=",
+    "hash": "sha256-1aKKlOIk1mH4yx66eD635d1IaUWXIiBGHEt4A2F2mGM=",
     "homepage": "https://registry.terraform.io/providers/Telmate/proxmox",
     "owner": "Telmate",
     "repo": "terraform-provider-proxmox",
-    "rev": "v3.0.2-rc01",
+    "rev": "v3.0.2-rc04",
     "spdx": "MIT",
-    "vendorHash": "sha256-H8nmIaBwyBLO61Wys16YZgMHVFcCLe0eP+VbUUMc47c="
+    "vendorHash": "sha256-Hzq97ElAjs7Y4tmJ2x7+g4j74MEdEvI2bD8pkvi5ZXg="
   },
   "rabbitmq": {
     "hash": "sha256-ArteHTNNUxgiBJamnR1bJFDrvNnqjbJ6D3mj1XlpVUA=",
@@ -1336,13 +1336,13 @@
     "vendorHash": "sha256-nTKqpoJKabvtMDdI++Luq41vB0X2NWS6gufJbru2ZPI="
   },
   "talos": {
-    "hash": "sha256-O5S0XYdTyNGihPx4hQhYN5+ApnMuCaIcWlHA9D9/3nM=",
+    "hash": "sha256-PPD4blyXt4/IalzwEn4+lvuD1Qx7VuUD/CUJILDRI5k=",
     "homepage": "https://registry.terraform.io/providers/siderolabs/talos",
     "owner": "siderolabs",
     "repo": "terraform-provider-talos",
-    "rev": "v0.8.1",
+    "rev": "v0.9.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-V0dK5G3zheyyqexBud+9Hg9ExYI/9X1wuYx+lEn6pVg="
+    "vendorHash": "sha256-J2fLyYvlnefFIaJ6UwRfJ5nas86JCuOHAdWalr9T9fw="
   },
   "temporalcloud": {
     "hash": "sha256-tXNnDoUskOcmOKPpgBIcLcup0jMqRVWkhwSU3GKjAFI=",
diff --git a/pkgs/by-name/al/allure/package.nix b/pkgs/by-name/al/allure/package.nix
index d3168ee1aed9..f87114e476c1 100644
--- a/pkgs/by-name/al/allure/package.nix
+++ b/pkgs/by-name/al/allure/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "allure";
-  version = "2.34.1";
+  version = "2.35.0";
 
   src = fetchurl {
     url = "https://github.com/allure-framework/allure2/releases/download/${finalAttrs.version}/allure-${finalAttrs.version}.tgz";
-    hash = "sha256-3xPFiDQp7dUEGiTW0HKolE5lJ00ddqRB/UXSWFURNJo=";
+    hash = "sha256-LUbwg2jOORIqHbw5EritSBHbsVJgRYyc1cFMuAy3nAg=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/fz/fzf/package.nix b/pkgs/by-name/fz/fzf/package.nix
index 8c6c82c5fe0b..c99a382e5e0e 100644
--- a/pkgs/by-name/fz/fzf/package.nix
+++ b/pkgs/by-name/fz/fzf/package.nix
@@ -65,12 +65,6 @@ buildGoModule rec {
 
     # Install shell integrations
     install -D shell/* -t $out/share/fzf/
-    install -D shell/key-bindings.fish $out/share/fish/vendor_functions.d/fzf_key_bindings.fish
-    mkdir -p $out/share/fish/vendor_conf.d
-    cat << EOF > $out/share/fish/vendor_conf.d/load-fzf-key-bindings.fish
-      status is-interactive; or exit 0
-      fzf_key_bindings
-    EOF
 
     cat <<SCRIPT > $out/bin/fzf-share
     #!${runtimeShell}
diff --git a/pkgs/by-name/go/gokapi/package.nix b/pkgs/by-name/go/gokapi/package.nix
index 9f1caae438b6..89e095fd5618 100644
--- a/pkgs/by-name/go/gokapi/package.nix
+++ b/pkgs/by-name/go/gokapi/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "gokapi";
-  version = "2.0.1";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "Forceu";
     repo = "Gokapi";
     tag = "v${version}";
-    hash = "sha256-sYosoG4bZ5B024tFr2tEjf5EezoWmtO3vFE6W6grm1M=";
+    hash = "sha256-GEdg79Rl4MqaVIJz9fAVs02hN270SIStq54fvxzL7UU=";
   };
 
-  vendorHash = "sha256-GeS+lfFw7jUuXX1qQPiu9eKjz6nswpRtbZXjqu4DnHg=";
+  vendorHash = "sha256-gP9bCnRN40y7NWwh3V8dv1yOBqpmzlcp8Bf6IkdjoWU=";
 
   patches = [ ];
 
diff --git a/pkgs/by-name/re/renode-dts2repl/package.nix b/pkgs/by-name/re/renode-dts2repl/package.nix
index 55bcc62cdce1..773e9e60875d 100644
--- a/pkgs/by-name/re/renode-dts2repl/package.nix
+++ b/pkgs/by-name/re/renode-dts2repl/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication {
   pname = "renode-dts2repl";
-  version = "0-unstable-2025-08-21";
+  version = "0-unstable-2025-09-01";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "antmicro";
     repo = "dts2repl";
-    rev = "94e40c3622d08312226bed788b5d7970e06283c6";
-    hash = "sha256-a8QlQujBQT1ho9JbZjKH2v0l5LugemlGzBKoSSheFMA=";
+    rev = "f0ecb42d5fd3a8d9d4b215c532b2824e8d22cf99";
+    hash = "sha256-jI0zpv3OpLWh+CUGP+duyr7s2waPZu0+ULxzX9VmHY8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sl/slack/darwin.nix b/pkgs/by-name/sl/slack/darwin.nix
new file mode 100644
index 000000000000..9d2245433d21
--- /dev/null
+++ b/pkgs/by-name/sl/slack/darwin.nix
@@ -0,0 +1,30 @@
+{
+  pname,
+  version,
+  src,
+  passthru,
+  meta,
+
+  stdenvNoCC,
+  undmg,
+}:
+stdenvNoCC.mkDerivation {
+  inherit
+    pname
+    version
+    src
+    passthru
+    meta
+    ;
+
+  nativeBuildInputs = [ undmg ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/Applications
+    cp -a Slack.app $out/Applications
+    runHook postInstall
+  '';
+}
diff --git a/pkgs/by-name/sl/slack/linux.nix b/pkgs/by-name/sl/slack/linux.nix
new file mode 100644
index 000000000000..03f6f10b21d0
--- /dev/null
+++ b/pkgs/by-name/sl/slack/linux.nix
@@ -0,0 +1,154 @@
+{
+  pname,
+  version,
+  src,
+  passthru,
+  meta,
+
+  lib,
+  stdenv,
+  dpkg,
+  makeWrapper,
+  asar,
+  alsa-lib,
+  at-spi2-atk,
+  at-spi2-core,
+  atk,
+  cairo,
+  cups,
+  curl,
+  dbus,
+  expat,
+  fontconfig,
+  freetype,
+  gdk-pixbuf,
+  glib,
+  gtk3,
+  libGL,
+  libappindicator-gtk3,
+  libdrm,
+  libnotify,
+  libpulseaudio,
+  libuuid,
+  libxcb,
+  libxkbcommon,
+  libgbm,
+  nspr,
+  nss,
+  pango,
+  pipewire,
+  systemd,
+  wayland,
+  xdg-utils,
+  xorg,
+}:
+stdenv.mkDerivation rec {
+  inherit
+    pname
+    version
+    src
+    passthru
+    meta
+    ;
+
+  rpath =
+    lib.makeLibraryPath [
+      alsa-lib
+      at-spi2-atk
+      at-spi2-core
+      atk
+      cairo
+      cups
+      curl
+      dbus
+      expat
+      fontconfig
+      freetype
+      gdk-pixbuf
+      glib
+      gtk3
+      libGL
+      libappindicator-gtk3
+      libdrm
+      libnotify
+      libpulseaudio
+      libuuid
+      libxcb
+      libxkbcommon
+      libgbm
+      nspr
+      nss
+      pango
+      pipewire
+      stdenv.cc.cc
+      systemd
+      wayland
+      xorg.libX11
+      xorg.libXScrnSaver
+      xorg.libXcomposite
+      xorg.libXcursor
+      xorg.libXdamage
+      xorg.libXext
+      xorg.libXfixes
+      xorg.libXi
+      xorg.libXrandr
+      xorg.libXrender
+      xorg.libXtst
+      xorg.libxkbfile
+      xorg.libxshmfence
+    ]
+    + ":${lib.getLib stdenv.cc.cc}/lib64";
+
+  buildInputs = [
+    gtk3 # needed for GSETTINGS_SCHEMAS_PATH
+  ];
+
+  nativeBuildInputs = [
+    dpkg
+    makeWrapper
+    asar
+  ];
+
+  dontUnpack = true;
+  dontBuild = true;
+  dontPatchELF = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    # The deb file contains a setuid binary, so 'dpkg -x' doesn't work here
+    dpkg --fsys-tarfile $src | tar --extract
+    rm -rf usr/share/lintian
+
+    mkdir -p $out
+    mv usr/* $out
+
+    # Otherwise it looks "suspicious"
+    chmod -R g-w $out
+
+    for file in $(find $out -type f \( -perm /0111 -o -name \*.so\* \) ); do
+      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$file" || true
+      patchelf --set-rpath ${rpath}:$out/lib/slack $file || true
+    done
+
+    # Replace the broken bin/slack symlink with a startup wrapper.
+    # Make xdg-open overrideable at runtime.
+    rm $out/bin/slack
+    makeWrapper $out/lib/slack/slack $out/bin/slack \
+      --prefix XDG_DATA_DIRS : $GSETTINGS_SCHEMAS_PATH \
+      --suffix PATH : ${lib.makeBinPath [ xdg-utils ]} \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations,WebRTCPipeWireCapturer --enable-wayland-ime=true}}"
+
+    # Fix the desktop link
+    substituteInPlace $out/share/applications/slack.desktop \
+      --replace /usr/bin/ $out/bin/ \
+      --replace /usr/share/pixmaps/slack.png slack \
+      --replace bin/slack "bin/slack -s"
+
+    # Prevent Un-blacklist pipewire integration to enable screen sharing on wayland.
+    # https://github.com/flathub/com.slack.Slack/issues/101#issuecomment-1807073763
+    sed -i -e 's/,"WebRTCPipeWireCapturer"/,"LebRTCPipeWireCapturer"/' $out/lib/slack/resources/app.asar
+
+    runHook postInstall
+  '';
+}
diff --git a/pkgs/by-name/sl/slack/package.nix b/pkgs/by-name/sl/slack/package.nix
index 6259f4dfee21..1ccc339a2409 100644
--- a/pkgs/by-name/sl/slack/package.nix
+++ b/pkgs/by-name/sl/slack/package.nix
@@ -1,96 +1,29 @@
 {
-  lib,
-  stdenv,
+  callPackage,
   fetchurl,
-  dpkg,
-  undmg,
-  makeWrapper,
-  asar,
-  alsa-lib,
-  at-spi2-atk,
-  at-spi2-core,
-  atk,
-  cairo,
-  cups,
-  curl,
-  dbus,
-  expat,
-  fontconfig,
-  freetype,
-  gdk-pixbuf,
-  glib,
-  gtk3,
-  libGL,
-  libappindicator-gtk3,
-  libdrm,
-  libnotify,
-  libpulseaudio,
-  libuuid,
-  libxcb,
-  libxkbcommon,
-  libxshmfence,
-  libgbm,
-  nspr,
-  nss,
-  pango,
-  pipewire,
-  systemd,
-  wayland,
-  xdg-utils,
-  xorg,
+  lib,
+  stdenvNoCC,
 }:
 
 let
-  inherit (stdenv.hostPlatform) system;
-  throwSystem = throw "slack does not support system: ${system}";
+  inherit (stdenvNoCC.hostPlatform) system;
+  sources = import ./sources.nix { inherit fetchurl; };
 
   pname = "slack";
 
-  x86_64-darwin-version = "4.45.64";
-  x86_64-darwin-sha256 = "0skhh16lc0czxd5ifkqy39hibk4ydlfhn41zdif3hl0sd4vcqbvb";
+  passthru = {
+    updateScript = ./update.sh;
+  };
 
-  x86_64-linux-version = "4.45.64";
-  x86_64-linux-sha256 = "7c6af86ab1d5778aec930d4e7d77b9f9948a83a87e8458e821d6f9e8dfed180f";
-
-  aarch64-darwin-version = "4.45.64";
-  aarch64-darwin-sha256 = "136crd17ybaznp680qb2rl0c8cllkkv21ymf3dck2jhkqbp7v2kj";
-
-  version =
-    {
-      x86_64-darwin = x86_64-darwin-version;
-      x86_64-linux = x86_64-linux-version;
-      aarch64-darwin = aarch64-darwin-version;
-    }
-    .${system} or throwSystem;
-
-  src =
-    let
-      base = "https://downloads.slack-edge.com";
-    in
-    {
-      x86_64-darwin = fetchurl {
-        url = "${base}/desktop-releases/mac/universal/${version}/Slack-${version}-macOS.dmg";
-        sha256 = x86_64-darwin-sha256;
-      };
-      x86_64-linux = fetchurl {
-        url = "${base}/desktop-releases/linux/x64/${version}/slack-desktop-${version}-amd64.deb";
-        sha256 = x86_64-linux-sha256;
-      };
-      aarch64-darwin = fetchurl {
-        url = "${base}/desktop-releases/mac/arm64/${version}/Slack-${version}-macOS.dmg";
-        sha256 = aarch64-darwin-sha256;
-      };
-    }
-    .${system} or throwSystem;
-
-  meta = with lib; {
+  meta = {
     description = "Desktop client for Slack";
     homepage = "https://slack.com";
     changelog = "https://slack.com/release-notes";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.unfree;
-    maintainers = with maintainers; [
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [
       mmahut
+      prince213
       teutat3s
     ];
     platforms = [
@@ -100,141 +33,8 @@ let
     ];
     mainProgram = "slack";
   };
-
-  linux = stdenv.mkDerivation rec {
-    inherit
-      pname
-      version
-      src
-      meta
-      ;
-
-    passthru.updateScript = ./update.sh;
-
-    rpath =
-      lib.makeLibraryPath [
-        alsa-lib
-        at-spi2-atk
-        at-spi2-core
-        atk
-        cairo
-        cups
-        curl
-        dbus
-        expat
-        fontconfig
-        freetype
-        gdk-pixbuf
-        glib
-        gtk3
-        libGL
-        libappindicator-gtk3
-        libdrm
-        libnotify
-        libpulseaudio
-        libuuid
-        libxcb
-        libxkbcommon
-        libgbm
-        nspr
-        nss
-        pango
-        pipewire
-        stdenv.cc.cc
-        systemd
-        wayland
-        xorg.libX11
-        xorg.libXScrnSaver
-        xorg.libXcomposite
-        xorg.libXcursor
-        xorg.libXdamage
-        xorg.libXext
-        xorg.libXfixes
-        xorg.libXi
-        xorg.libXrandr
-        xorg.libXrender
-        xorg.libXtst
-        xorg.libxkbfile
-        xorg.libxshmfence
-      ]
-      + ":${lib.getLib stdenv.cc.cc}/lib64";
-
-    buildInputs = [
-      gtk3 # needed for GSETTINGS_SCHEMAS_PATH
-    ];
-
-    nativeBuildInputs = [
-      dpkg
-      makeWrapper
-      asar
-    ];
-
-    dontUnpack = true;
-    dontBuild = true;
-    dontPatchELF = true;
-
-    installPhase = ''
-      runHook preInstall
-
-      # The deb file contains a setuid binary, so 'dpkg -x' doesn't work here
-      dpkg --fsys-tarfile $src | tar --extract
-      rm -rf usr/share/lintian
-
-      mkdir -p $out
-      mv usr/* $out
-
-      # Otherwise it looks "suspicious"
-      chmod -R g-w $out
-
-      for file in $(find $out -type f \( -perm /0111 -o -name \*.so\* \) ); do
-        patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" "$file" || true
-        patchelf --set-rpath ${rpath}:$out/lib/slack $file || true
-      done
-
-      # Replace the broken bin/slack symlink with a startup wrapper.
-      # Make xdg-open overrideable at runtime.
-      rm $out/bin/slack
-      makeWrapper $out/lib/slack/slack $out/bin/slack \
-        --prefix XDG_DATA_DIRS : $GSETTINGS_SCHEMAS_PATH \
-        --suffix PATH : ${lib.makeBinPath [ xdg-utils ]} \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations,WebRTCPipeWireCapturer --enable-wayland-ime=true}}"
-
-      # Fix the desktop link
-      substituteInPlace $out/share/applications/slack.desktop \
-        --replace /usr/bin/ $out/bin/ \
-        --replace /usr/share/pixmaps/slack.png slack \
-        --replace bin/slack "bin/slack -s"
-    ''
-    + lib.optionalString stdenv.hostPlatform.isLinux ''
-      # Prevent Un-blacklist pipewire integration to enable screen sharing on wayland.
-      # https://github.com/flathub/com.slack.Slack/issues/101#issuecomment-1807073763
-      sed -i -e 's/,"WebRTCPipeWireCapturer"/,"LebRTCPipeWireCapturer"/' $out/lib/slack/resources/app.asar
-    ''
-    + ''
-      runHook postInstall
-    '';
-  };
-
-  darwin = stdenv.mkDerivation {
-    inherit
-      pname
-      version
-      src
-      meta
-      ;
-
-    passthru.updateScript = ./update.sh;
-
-    nativeBuildInputs = [ undmg ];
-
-    sourceRoot = "Slack.app";
-
-    installPhase = ''
-      runHook preInstall
-      mkdir -p $out/Applications/Slack.app
-      cp -R . $out/Applications/Slack.app
-      runHook postInstall
-    '';
-  };
 in
-if stdenv.hostPlatform.isDarwin then darwin else linux
+callPackage (if stdenvNoCC.hostPlatform.isDarwin then ./darwin.nix else ./linux.nix) {
+  inherit pname passthru meta;
+  inherit (sources.${system} or (throw "Unsupported system: ${system}")) version src;
+}
diff --git a/pkgs/by-name/sl/slack/sources.nix b/pkgs/by-name/sl/slack/sources.nix
new file mode 100644
index 000000000000..74b6d61ef559
--- /dev/null
+++ b/pkgs/by-name/sl/slack/sources.nix
@@ -0,0 +1,26 @@
+# Generated by ./update.sh - do not update manually!
+# Last updated: 2025-08-29
+{ fetchurl }:
+{
+  aarch64-darwin = {
+    version = "4.45.69";
+    src = fetchurl {
+      url = "https://downloads.slack-edge.com/desktop-releases/mac/arm64/4.45.69/Slack-4.45.69-macOS.dmg";
+      hash = "sha256-MaPwj0niehwNYiSl8GdzKSF1mezKtIFiAmZzBWbwq9A=";
+    };
+  };
+  x86_64-darwin = {
+    version = "4.45.69";
+    src = fetchurl {
+      url = "https://downloads.slack-edge.com/desktop-releases/mac/x64/4.45.69/Slack-4.45.69-macOS.dmg";
+      hash = "sha256-iO5hGzYYmrHoTznw++AEhGjTKiTngzA9/ho+oFGXVeI=";
+    };
+  };
+  x86_64-linux = {
+    version = "4.45.69";
+    src = fetchurl {
+      url = "https://downloads.slack-edge.com/desktop-releases/linux/x64/4.45.69/slack-desktop-4.45.69-amd64.deb";
+      hash = "sha256-CwM8oEyRBkE5FSBO5rl4ygRuLtaRefVVZpAEHKxXKcw=";
+    };
+  };
+}
diff --git a/pkgs/by-name/sl/slack/update.sh b/pkgs/by-name/sl/slack/update.sh
index 9a47575b1e7a..c54a9a5e7c29 100755
--- a/pkgs/by-name/sl/slack/update.sh
+++ b/pkgs/by-name/sl/slack/update.sh
@@ -1,47 +1,57 @@
 #!/usr/bin/env nix-shell
-#! nix-shell -i bash -p curl gnused
+#! nix-shell -i bash --pure -p cacert curl jq nix
 
-set -eou pipefail
+set -euo pipefail
 
-latest_linux_data="$(curl -s 'https://slack.com/api/desktop.latestRelease?arch=x64&variant=deb')"
-latest_mac_data="$(curl -s 'https://slack.com/api/desktop.latestRelease?arch=universal&variant=dmg')"
-latest_mac_arm_data="$(curl -s 'https://slack.com/api/desktop.latestRelease?arch=arm64&variant=dmg')"
+cd $(readlink -e $(dirname "${BASH_SOURCE[0]}"))
 
-latest_linux_version="$(echo ${latest_linux_data} | jq -rc '.version')"
-latest_mac_version="$(echo ${latest_mac_data} | jq -rc '.version')"
-latest_mac_arm_version="$(echo ${latest_mac_arm_data} | jq -rc '.version')"
+aarch64_darwin_data=$(curl -s 'https://slack.com/api/desktop.latestRelease?arch=arm64&variant=dmg')
+x86_64_darwin_data=$(curl -s 'https://slack.com/api/desktop.latestRelease?arch=x64&variant=dmg')
+x86_64_linux_data=$(curl -s 'https://slack.com/api/desktop.latestRelease?arch=x64&variant=deb')
 
-nixpkgs="$(git rev-parse --show-toplevel)"
-slack_nix="$nixpkgs/pkgs/by-name/sl/slack/package.nix"
-nixpkgs_linux_version=$(cat "$slack_nix" | sed -n 's/.*x86_64-linux-version = \"\([0-9\.]\+\)\";.*/\1/p')
-nixpkgs_mac_version=$(cat "$slack_nix" | sed -n 's/.*x86_64-darwin-version = \"\([0-9\.]\+\)\";.*/\1/p')
-nixpkgs_mac_arm_version=$(cat "$slack_nix" | sed -n 's/.*aarch64-darwin-version = \"\([0-9\.]\+\)\";.*/\1/p')
+aarch64_darwin_version=$(jq -r .version <<< "$aarch64_darwin_data")
+x86_64_darwin_version=$(jq -r .version <<< "$x86_64_darwin_data")
+x86_64_linux_version=$(jq -r .version <<< "$x86_64_linux_data")
 
-if [[ "$nixpkgs_linux_version" == "$latest_linux_version" && \
-      "$nixpkgs_mac_version" == "$latest_mac_version" && \
-      "$nixpkgs_mac_arm_version" == "$latest_mac_version" ]]; then
-  echo "nixpkgs versions are all up to date!"
-  exit 0
-fi
+aarch64_darwin_url=$(jq -r .download_url <<< "$aarch64_darwin_data")
+x86_64_darwin_url=$(jq -r .download_url <<< "$x86_64_darwin_data")
+x86_64_linux_url=$(jq -r .download_url <<< "$x86_64_linux_data")
 
-linux_url="$(echo ${latest_linux_data} | jq -rc '.download_url')"
-mac_url="$(echo ${latest_mac_data} | jq -rc '.download_url')"
-mac_arm_url="$(echo ${latest_mac_arm_data} | jq -rc '.download_url')"
-linux_sha256=$(nix-prefetch-url ${linux_url})
-mac_sha256=$(nix-prefetch-url ${mac_url})
-mac_arm_sha256=$(nix-prefetch-url ${mac_arm_url})
+aarch64_darwin_hash=$(nix-prefetch-url "$aarch64_darwin_url")
+x86_64_darwin_hash=$(nix-prefetch-url "$x86_64_darwin_url")
+x86_64_linux_hash=$(nix-prefetch-url "$x86_64_linux_url")
 
-sed -i "s/x86_64-linux-version = \".*\"/x86_64-linux-version = \"${latest_linux_version}\"/" "$slack_nix"
-sed -i "s/x86_64-darwin-version = \".*\"/x86_64-darwin-version = \"${latest_mac_version}\"/" "$slack_nix"
-sed -i "s/aarch64-darwin-version = \".*\"/aarch64-darwin-version = \"${latest_mac_version}\"/" "$slack_nix"
-sed -i "s/x86_64-linux-sha256 = \".*\"/x86_64-linux-sha256 = \"${linux_sha256}\"/" "$slack_nix"
-sed -i "s/x86_64-darwin-sha256 = \".*\"/x86_64-darwin-sha256 = \"${mac_sha256}\"/" "$slack_nix"
-sed -i "s/aarch64-darwin-sha256 = \".*\"/aarch64-darwin-sha256 = \"${mac_arm_sha256}\"/" "$slack_nix"
+# use friendlier hashes
 
-if ! nix-build -A slack "$nixpkgs" --arg config '{ allowUnfree = true; }'; then
-  echo "The updated slack failed to build."
-  exit 1
-fi
+aarch64_darwin_hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$aarch64_darwin_hash")
+x86_64_darwin_hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$x86_64_darwin_hash")
+x86_64_linux_hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$x86_64_linux_hash")
 
-echo "Successfully updated"
-echo "slack: $nixpkgs_linux_version -> $latest_linux_version"
+cat >sources.nix <<EOF
+# Generated by ./update.sh - do not update manually!
+# Last updated: $(date +%F)
+{ fetchurl }:
+{
+  aarch64-darwin = {
+    version = "$aarch64_darwin_version";
+    src = fetchurl {
+      url = "$aarch64_darwin_url";
+      hash = "$aarch64_darwin_hash";
+    };
+  };
+  x86_64-darwin = {
+    version = "$x86_64_darwin_version";
+    src = fetchurl {
+      url = "$x86_64_darwin_url";
+      hash = "$x86_64_darwin_hash";
+    };
+  };
+  x86_64-linux = {
+    version = "$x86_64_linux_version";
+    src = fetchurl {
+      url = "$x86_64_linux_url";
+      hash = "$x86_64_linux_hash";
+    };
+  };
+}
+EOF
diff --git a/pkgs/by-name/wx/wxsqlite3/package.nix b/pkgs/by-name/wx/wxsqlite3/package.nix
index e49a7bfde48a..9199d8e7ef29 100644
--- a/pkgs/by-name/wx/wxsqlite3/package.nix
+++ b/pkgs/by-name/wx/wxsqlite3/package.nix
@@ -18,6 +18,8 @@ stdenv.mkDerivation rec {
     hash = "sha256-3t8SQJdB7ivuCnsr5TxmgslQNkvz+O/mE3NB+R/kXHM=";
   };
 
+  enableParallelBuilding = true;
+
   nativeBuildInputs = [
     autoreconfHook
   ];
@@ -27,6 +29,16 @@ stdenv.mkDerivation rec {
     wxGTK32
   ];
 
+  doCheck = true;
+
+  checkPhase = ''
+    runHook preCheck
+
+    ./samples/minimal -t -s ./samples
+
+    runHook postCheck
+  '';
+
   meta = with lib; {
     homepage = "https://utelle.github.io/wxsqlite3/";
     description = "C++ wrapper around the public domain SQLite 3.x for wxWidgets";
diff --git a/pkgs/development/interpreters/php/8.4.nix b/pkgs/development/interpreters/php/8.4.nix
index 1591c2c5aad9..3f45bf634d80 100644
--- a/pkgs/development/interpreters/php/8.4.nix
+++ b/pkgs/development/interpreters/php/8.4.nix
@@ -4,8 +4,8 @@ let
   base = callPackage ./generic.nix (
     _args
     // {
-      version = "8.4.11";
-      hash = "sha256-LDnHW1TfibARlbcq0O4fzUkMcdsYvFK81h+y/7V7Jvo=";
+      version = "8.4.12";
+      hash = "sha256-Lr1TgusJDWAwh9pkntId5ksHlha8mgKrvFMribF+NGg=";
     }
   );
 in
diff --git a/pkgs/development/python-modules/cvxpy/default.nix b/pkgs/development/python-modules/cvxpy/default.nix
index 96fc42273e21..31fb45f2f5b0 100644
--- a/pkgs/development/python-modules/cvxpy/default.nix
+++ b/pkgs/development/python-modules/cvxpy/default.nix
@@ -25,14 +25,14 @@
 
 buildPythonPackage rec {
   pname = "cvxpy";
-  version = "1.7.1";
+  version = "1.7.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cvxpy";
     repo = "cvxpy";
     tag = "v${version}";
-    hash = "sha256-gJL9j2hA+PvNhN1twv31dxb5Gz+q8uoIzwhXB12aIr4=";
+    hash = "sha256-kt/PFPztYhz1pkj50z9FYJNWlHYpqlxsGa1WctBfBy0=";
   };
 
   postPatch =
diff --git a/pkgs/development/python-modules/open-interpreter/default.nix b/pkgs/development/python-modules/open-interpreter/default.nix
index c6b93896adb1..6ba57d82594f 100644
--- a/pkgs/development/python-modules/open-interpreter/default.nix
+++ b/pkgs/development/python-modules/open-interpreter/default.nix
@@ -57,6 +57,7 @@ buildPythonPackage rec {
   pythonRelaxDeps = [
     "anthropic"
     "google-generativeai"
+    "html2text"
     "psutil"
     "rich"
     "starlette"
diff --git a/pkgs/development/python-modules/python-barbicanclient/default.nix b/pkgs/development/python-modules/python-barbicanclient/default.nix
index 43a43e908de2..0ee886673918 100644
--- a/pkgs/development/python-modules/python-barbicanclient/default.nix
+++ b/pkgs/development/python-modules/python-barbicanclient/default.nix
@@ -2,14 +2,13 @@
   lib,
   buildPythonPackage,
   cliff,
-  fetchFromGitea,
+  fetchFromGitHub,
   keystoneauth1,
   openstackdocstheme,
   oslo-i18n,
   oslo-serialization,
   oslo-utils,
   pbr,
-  pythonOlder,
   requests-mock,
   requests,
   setuptools,
@@ -20,17 +19,14 @@
 
 buildPythonPackage rec {
   pname = "python-barbicanclient";
-  version = "7.1.0";
+  version = "7.2.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
-  src = fetchFromGitea {
-    domain = "opendev.org";
+  src = fetchFromGitHub {
     owner = "openstack";
     repo = "python-barbicanclient";
-    rev = version;
-    hash = "sha256-VEK3MDuvciF4hpyNKTKWX2v3pSCcVi+YGgSKCLaWAuI=";
+    tag = version;
+    hash = "sha256-HhWWUM0lK0B0ySItrT6z5QCXzStuiJzDZFoEb+WRodA=";
   };
 
   env.PBR_VERSION = version;
diff --git a/pkgs/development/python-modules/python-magnumclient/default.nix b/pkgs/development/python-modules/python-magnumclient/default.nix
index a20e7f524343..4e8ebe83e953 100644
--- a/pkgs/development/python-modules/python-magnumclient/default.nix
+++ b/pkgs/development/python-modules/python-magnumclient/default.nix
@@ -6,8 +6,8 @@
   fetchFromGitHub,
   fixtures,
   keystoneauth1,
+  openstacksdk,
   openstackdocstheme,
-  os-client-config,
   osc-lib,
   oslo-i18n,
   oslo-log,
@@ -18,7 +18,6 @@
   pbr,
   prettytable,
   python-openstackclient,
-  pythonOlder,
   requests-mock,
   requests,
   setuptools,
@@ -30,16 +29,14 @@
 
 buildPythonPackage rec {
   pname = "python-magnumclient";
-  version = "4.8.1";
+  version = "4.9.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
   src = fetchFromGitHub {
     owner = "openstack";
     repo = "python-magnumclient";
     tag = version;
-    hash = "sha256-rXLJnvGc5VHkHghCoBLRhARwl3hhS/oI2VOsGWfESkM=";
+    hash = "sha256-Ok211QgvsKqkotXrC4HwMyonLv7LzuCjs2hjruGDEvY=";
   };
 
   env.PBR_VERSION = version;
@@ -60,7 +57,7 @@ buildPythonPackage rec {
     cryptography
     decorator
     keystoneauth1
-    os-client-config
+    openstacksdk
     osc-lib
     oslo-i18n
     oslo-log
diff --git a/pkgs/development/python-modules/python-mistralclient/default.nix b/pkgs/development/python-modules/python-mistralclient/default.nix
index e4af29877349..4b43ff247fde 100644
--- a/pkgs/development/python-modules/python-mistralclient/default.nix
+++ b/pkgs/development/python-modules/python-mistralclient/default.nix
@@ -2,10 +2,10 @@
   lib,
   buildPythonPackage,
   cliff,
-  fetchFromGitea,
+  fetchFromGitHub,
   keystoneauth1,
   openstackdocstheme,
-  os-client-config,
+  openstacksdk,
   osc-lib,
   oslo-i18n,
   oslo-serialization,
@@ -13,7 +13,6 @@
   oslotest,
   osprofiler,
   pbr,
-  pythonOlder,
   pyyaml,
   requests-mock,
   requests,
@@ -27,17 +26,14 @@
 
 buildPythonPackage rec {
   pname = "python-mistralclient";
-  version = "5.4.0";
+  version = "6.0.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
-  src = fetchFromGitea {
-    domain = "opendev.org";
+  src = fetchFromGitHub {
     owner = "openstack";
     repo = "python-mistralclient";
-    rev = version;
-    hash = "sha256-c1kMDyRNMZKnDvL993WvZSsjkXgYLM2+9KBmF+I4vnM=";
+    tag = version;
+    hash = "sha256-zdCqBua6S+a7iS3VzELM02oJKwLlI24tHWfx4Pt3nQw=";
   };
 
   env.PBR_VERSION = version;
@@ -69,7 +65,7 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    os-client-config
+    openstacksdk
     oslotest
     osprofiler
     requests-mock
diff --git a/pkgs/development/python-modules/python-neutronclient/default.nix b/pkgs/development/python-modules/python-neutronclient/default.nix
index 9124ab84071e..0a75d7196e10 100644
--- a/pkgs/development/python-modules/python-neutronclient/default.nix
+++ b/pkgs/development/python-modules/python-neutronclient/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   setuptools,
   # Build and Runtime
   pbr,
@@ -36,12 +36,15 @@ buildPythonPackage rec {
   version = "11.6.0";
   pyproject = true;
 
-  src = fetchPypi {
-    pname = "python_neutronclient";
-    inherit version;
-    hash = "sha256-PGlYCI0YyGdqEKv52UuNvxqYR0HLuYhVTyFogHl+By8=";
+  src = fetchFromGitHub {
+    owner = "openstack";
+    repo = "python-neutronclient";
+    tag = version;
+    hash = "sha256-nz7KiFe8IWJypGCjFgrEgGTEsC0xlW3YG/QRNJUzcpc=";
   };
 
+  env.PBR_VERSION = version;
+
   build-system = [
     setuptools
     pbr
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 702637e5a529..f20572526606 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8644,6 +8644,7 @@ with pkgs;
   magnumclient = with python313Packages; toPythonApplication python-magnumclient;
   manilaclient = with python313Packages; toPythonApplication python-manilaclient;
   mistralclient = with python313Packages; toPythonApplication python-mistralclient;
+  neutronclient = with python313Packages; toPythonApplication python-neutronclient;
   swiftclient = with python313Packages; toPythonApplication python-swiftclient;
   troveclient = with python313Packages; toPythonApplication python-troveclient;
   watcherclient = with python313Packages; toPythonApplication python-watcherclient;