diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index c4eac5567b54..94d2a94af5be 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -8625,6 +8625,12 @@
     githubId = 10290864;
     name = "Peter Frank";
   };
+  frantathefranta = {
+    github = "frantathefranta";
+    githubId = 64412753;
+    name = "Franta Bartik";
+    email = "fb@franta.us";
+  };
   franzmondlichtmann = {
     name = "Franz Schroepf";
     email = "franz-schroepf@t-online.de";
diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index c804ee2438e3..5f5ef2a31eea 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -90,6 +90,8 @@
 
 - [paisa](https://github.com/ananthakumaran/paisa), a personal finance tracker and dashboard. Available as [services.paisa](#opt-services.paisa.enable).
 
+- [conman](https://github.com/dun/conman), a serial console management program. Available as [services.conman](#opt-services.conman.enable).
+
 ## Backward Incompatibilities {#sec-release-25.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 8768117a12b6..4f2d56c7f86d 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -810,6 +810,7 @@
   ./services/misc/clipcat.nix
   ./services/misc/clipmenu.nix
   ./services/misc/confd.nix
+  ./services/misc/conman.nix
   ./services/misc/cpuminer-cryptonight.nix
   ./services/misc/db-rest.nix
   ./services/misc/devmon.nix
diff --git a/nixos/modules/services/misc/conman.nix b/nixos/modules/services/misc/conman.nix
new file mode 100644
index 000000000000..8d00b0353d6d
--- /dev/null
+++ b/nixos/modules/services/misc/conman.nix
@@ -0,0 +1,89 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  options = {
+    services.conman = {
+      enable = lib.mkEnableOption ''
+        Enable the conman Console manager.
+
+        Either `configFile` or `config` must be specified.
+      '';
+      package = lib.mkPackageOption pkgs "conman" { };
+
+      configFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
+        default = null;
+        example = "/run/secrets/conman.conf";
+        description = ''
+          The absolute path to the configuration file.
+
+          Either `configFile` or `config` must be specified.
+
+          See <https://github.com/dun/conman/wiki/Man-5-conman.conf#files>.
+        '';
+      };
+      config = lib.mkOption {
+        type = lib.types.nullOr lib.types.lines;
+        default = null;
+        example = ''
+          server coredump=off
+          server keepalive=on
+          server loopback=off
+          server timestamp=1h
+
+          # global config
+          global log="/var/log/conman/%N.log"
+          global seropts="9600,8n1"
+          global ipmiopts="U:<user>,P:<password>"
+        '';
+        description = ''
+          The configuration object.
+
+          Either `configFile` or `config` must be specified.
+
+          See <https://github.com/dun/conman/wiki/Man-5-conman.conf#files>.
+        '';
+      };
+    };
+  };
+  meta.maintainers = with lib.maintainers; [
+    frantathefranta
+  ];
+
+  config =
+    let
+      cfg = config.services.conman;
+      configFile =
+        if cfg.configFile != null then
+          cfg.configFile
+        else
+          pkgs.writeTextFile {
+            name = "conman.conf";
+            text = cfg.config;
+          };
+    in
+    lib.mkIf cfg.enable {
+      assertions = [
+        {
+          assertion =
+            (cfg.configFile != null) && (cfg.config == null) || (cfg.configFile == null && cfg.config != null);
+          message = "Either but not both `configFile` and `config` must be specified for conman.";
+        }
+      ];
+      environment.systemPackages = [ cfg.package ];
+      systemd.services.conmand = {
+        description = "serial console management program";
+        documentation = [ "man:conman(8)" ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          ExecStart = "${cfg.package}/bin/conmand -F -c ${configFile}";
+          KillMode = "process";
+        };
+      };
+    };
+}
diff --git a/pkgs/applications/audio/pragha/default.nix b/pkgs/applications/audio/pragha/default.nix
index e3ef9f3cdfc6..a96b037d8c5b 100644
--- a/pkgs/applications/audio/pragha/default.nix
+++ b/pkgs/applications/audio/pragha/default.nix
@@ -8,7 +8,6 @@
   dbus-glib,
   desktop-file-utils,
   hicolor-icon-theme,
-  pcre,
   qtbase,
   sqlite,
   taglib,
@@ -74,7 +73,6 @@ mkDerivation rec {
       gtk3
       hicolor-icon-theme
       libpeas
-      pcre
       qtbase
       sqlite
       taglib
diff --git a/pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix b/pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix
index 153405041cb6..1af8c7126f64 100644
--- a/pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix
@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "RooVeterinaryInc";
     name = "roo-cline";
-    version = "3.25.10";
-    hash = "sha256-j9ydB6hR+Qx4HvBDMrYGev2K/vsG6ASeOQHhhYheEuw=";
+    version = "3.25.13";
+    hash = "sha256-n9QJjcRd1958uJdf7X7rV/6nBdFX6VPiA8N03t8rzHQ=";
   };
 
   passthru.updateScript = vscode-extension-update-script { };
diff --git a/pkgs/applications/radio/gnuradio/shared.nix b/pkgs/applications/radio/gnuradio/shared.nix
index f0f712e8a916..0488393bc989 100644
--- a/pkgs/applications/radio/gnuradio/shared.nix
+++ b/pkgs/applications/radio/gnuradio/shared.nix
@@ -126,6 +126,8 @@ in
   preCheck = ''
     export HOME=$(mktemp -d)
     export QT_QPA_PLATFORM=offscreen
+  ''
+  + lib.optionalString (hasFeature "gr-qtgui") ''
     export QT_PLUGIN_PATH="${qt.qtbase.bin}/${qt.qtbase.qtPluginPrefix}"
   '';
 
diff --git a/pkgs/by-name/aa/aardvark-dns/package.nix b/pkgs/by-name/aa/aardvark-dns/package.nix
index f19dbce7bfa7..383e62b678a3 100644
--- a/pkgs/by-name/aa/aardvark-dns/package.nix
+++ b/pkgs/by-name/aa/aardvark-dns/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "aardvark-dns";
-  version = "1.15.0";
+  version = "1.16.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "aardvark-dns";
     tag = "v${version}";
-    hash = "sha256-drDu+YaqlylDRJHs6ctbDvhaec3UqQ+0GsUeHfhY4Zg=";
+    hash = "sha256-mC+PP5sXt2O0CgxxyzS2WjtQe0RjuKNCamrjRY7qBP8=";
   };
 
-  cargoHash = "sha256-YUgaXx/+rZrTtscQIg3bkIp4L1bnjmSiudrim+ZXa64=";
+  cargoHash = "sha256-e/VxQgpTOS4snM78BewvloWap9cU+Vzlahlr00BWmVY=";
 
   passthru.tests = { inherit (nixosTests) podman; };
 
diff --git a/pkgs/by-name/ad/addlicense/package.nix b/pkgs/by-name/ad/addlicense/package.nix
index 55d92b1cf306..72e31757a088 100644
--- a/pkgs/by-name/ad/addlicense/package.nix
+++ b/pkgs/by-name/ad/addlicense/package.nix
@@ -2,29 +2,19 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
-  fetchpatch,
 }:
 
 buildGoModule rec {
   pname = "addlicense";
-  version = "1.1.1";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "addlicense";
     tag = "v${version}";
-    sha256 = "sha256-YMMHj6wctKtJi/rrcMIrLmNw/uvO6wCwokgYRQxcsFw=";
+    sha256 = "sha256-SM2fPfSqtc6LO+6Uk/sb/IMThXdE8yvk52jK3vF9EfE=";
   };
 
-  patches = [
-    # Add support for Nix files. Upstream is slow with responding to PRs,
-    # patch backported from PR https://github.com/google/addlicense/pull/153.
-    (fetchpatch {
-      url = "https://github.com/google/addlicense/commit/e0fb3f44cc7670dcc5cbcec2211c9ad238c5f9f1.patch";
-      hash = "sha256-XCAvL+HEa1hGc0GAnl+oYHKzBJ3I5ArS86vgABrP/Js=";
-    })
-  ];
-
   vendorHash = "sha256-2mncc21ecpv17Xp8PA9GIodoaCxNBacbbya/shU8T9Y=";
 
   subPackages = [ "." ];
diff --git a/pkgs/by-name/al/alive2/package.nix b/pkgs/by-name/al/alive2/package.nix
index fce8f5472147..ce354f694c1c 100644
--- a/pkgs/by-name/al/alive2/package.nix
+++ b/pkgs/by-name/al/alive2/package.nix
@@ -5,7 +5,7 @@
   re2c,
   z3,
   hiredis,
-  llvm_18,
+  llvm,
   cmake,
   ninja,
   nix-update-script,
@@ -13,13 +13,13 @@
 
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "alive2";
-  version = "20.0";
+  version = "21.0";
 
   src = fetchFromGitHub {
     owner = "AliveToolkit";
     repo = "alive2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4QNrBRGH+rxXwb7zTRYAixxipN3ybcXuWCmO+BLU9r4=";
+    hash = "sha256-LL6/Epn6iHQJGKb8PX+U6zvXK/WTlvOIJPr6JuGRsSU=";
   };
 
   nativeBuildInputs = [
@@ -30,7 +30,7 @@ clangStdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     z3
     hiredis
-    llvm_18
+    llvm
   ];
   strictDeps = true;
 
@@ -42,7 +42,7 @@ clangStdenv.mkDerivation (finalAttrs: {
 
   env = {
     ALIVE2_HOME = "$PWD";
-    LLVM2_HOME = "${llvm_18}";
+    LLVM2_HOME = "${llvm}";
     LLVM2_BUILD = "$LLVM2_HOME/build";
   };
 
diff --git a/pkgs/by-name/ap/apt/package.nix b/pkgs/by-name/ap/apt/package.nix
index c50309557b97..af59490f2e52 100644
--- a/pkgs/by-name/ap/apt/package.nix
+++ b/pkgs/by-name/ap/apt/package.nix
@@ -34,14 +34,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "apt";
-  version = "3.1.3";
+  version = "3.1.4";
 
   src = fetchFromGitLab {
     domain = "salsa.debian.org";
     owner = "apt-team";
     repo = "apt";
     rev = finalAttrs.version;
-    hash = "sha256-1ZGYGXqWBR+kGCNMf6Kkm/v6ncOi7KA8kQ0uxE4SSSg=";
+    hash = "sha256-l0ZrtYUSX5CmzmtL+qXxvjGNNXG04RUuK9mu1/NJnq8=";
   };
 
   # cycle detection; lib can't be split
diff --git a/pkgs/by-name/br/brainflow/package.nix b/pkgs/by-name/br/brainflow/package.nix
index 40b70705ced5..a431e26e0bf2 100644
--- a/pkgs/by-name/br/brainflow/package.nix
+++ b/pkgs/by-name/br/brainflow/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "brainflow";
-  version = "5.18.0";
+  version = "5.18.1";
 
   src = fetchFromGitHub {
     owner = "brainflow-dev";
     repo = "brainflow";
     tag = finalAttrs.version;
-    hash = "sha256-jaDFi4lbaX6aOWBR9pvTS5UHuUdHomQ/nssj4IE/aOE=";
+    hash = "sha256-VcWYH7DXpm0I8IgeDUTFs/13NfEIR5Q74iKFbFWReIA=";
   };
 
   patches = [ ];
diff --git a/pkgs/by-name/br/brave/package.nix b/pkgs/by-name/br/brave/package.nix
index 79bd0f6aa5df..c6567c2ceead 100644
--- a/pkgs/by-name/br/brave/package.nix
+++ b/pkgs/by-name/br/brave/package.nix
@@ -3,24 +3,24 @@
 
 let
   pname = "brave";
-  version = "1.81.131";
+  version = "1.81.135";
 
   allArchives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-zMZSFNjbygITH7hn3QnDwg30BMgevEdz8VX9xvcTSC4=";
+      hash = "sha256-JXPvGcc6dLPaLGfHtyMa3JpOs4OF1V8GCGzoSJdSjRg=";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-EgZi6JKwM3xf+kecenLJTzE2MtcEBnjbG7cVpRZZFE0=";
+      hash = "sha256-M99LF0Pc74xsQmnH97ATCUxrAyFfiQ0Rw8KYIvkJoPc=";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-Q8CJn2JxFgQ6Daw2bJUjjKQ7vv/ce2pvIfGyxjygQP4=";
+      hash = "sha256-GpXGuxH2fuLNGXvMhTn7vu1b03YDAY+13lkcsW6zPe8=";
     };
     x86_64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-x64.zip";
-      hash = "sha256-SPAGx1PYrDtmAu3avi06UgJY0D0/DQCq2u4kJtHwSZ0=";
+      hash = "sha256-WzwarZxP/Gte+mVpY+Altaezcy6fTrPVwCkLJx4KjQA=";
     };
   };
 
diff --git a/pkgs/by-name/c2/c2patool/package.nix b/pkgs/by-name/c2/c2patool/package.nix
index 9fca96a1c17d..1d7b863a727b 100644
--- a/pkgs/by-name/c2/c2patool/package.nix
+++ b/pkgs/by-name/c2/c2patool/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "c2patool";
-  version = "0.19.1";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "contentauth";
     repo = "c2pa-rs";
     tag = "c2patool-v${finalAttrs.version}";
-    hash = "sha256-48qQwk0TwOmnzcG/cJCYkyPch+obj9pP/z8I1UFVCBE=";
+    hash = "sha256-GYqH1Gc3oGFvQDZ8vKuFOGUWvIRlDzoPKDK1rTU9H3Y=";
   };
 
-  cargoHash = "sha256-EA34It7DGGO8fTJuCCUkr4q/C6IgQ6d2dt4ZUfIv0OA=";
+  cargoHash = "sha256-anpm5touXTQviCAr3kJ1Wm7pAt5yGsJKMwHFYTnNPzI=";
 
   # use the non-vendored openssl
   env.OPENSSL_NO_VENDOR = 1;
diff --git a/pkgs/by-name/ci/cinny-desktop/package.nix b/pkgs/by-name/ci/cinny-desktop/package.nix
index 1686abaee9f0..88887908b2aa 100644
--- a/pkgs/by-name/ci/cinny-desktop/package.nix
+++ b/pkgs/by-name/ci/cinny-desktop/package.nix
@@ -18,18 +18,18 @@
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cinny-desktop";
   # We have to be using the same version as cinny-web or this isn't going to work.
-  version = "4.8.1";
+  version = "4.9.0";
 
   src = fetchFromGitHub {
     owner = "cinnyapp";
     repo = "cinny-desktop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Q9iCEJu/HgWnMqiT0EjtJUk7dp7o0hbLoamlkFEaR4M=";
+    hash = "sha256-C4wAl9H0ZCsUk5hJk8u0Om70UqX4D9/iWDYOgalksu8=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/src-tauri";
 
-  cargoHash = "sha256-lWU1NrUwcAXQR6mEiCr6Ze3TzpDYvCx5/fBIef9ao5I=";
+  cargoHash = "sha256-XQLp5copZLClscPv9Eb3ceOw0WGlNHwIH69MdFih84w=";
 
   postPatch =
     let
diff --git a/pkgs/by-name/co/conman/package.nix b/pkgs/by-name/co/conman/package.nix
new file mode 100644
index 000000000000..2826c65f7276
--- /dev/null
+++ b/pkgs/by-name/co/conman/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  freeipmi,
+  autoreconfHook,
+  pkg-config,
+  fetchFromGitHub,
+  tcp_wrappers,
+  stdenv,
+  expect,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "conman";
+  version = "0.3.1";
+
+  src = fetchFromGitHub {
+    owner = "dun";
+    repo = "conman";
+    tag = "conman-${finalAttrs.version}";
+    hash = "sha256-CHWvHYTmTiEpEfHm3TF5aCKBOW2GsT9Vv4ehpj775NQ=";
+  };
+
+  enableParallelBuilding = true;
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+
+  buildInputs = [
+    freeipmi # For libipmiconsole.so.2
+    tcp_wrappers # For libwrap.so.0
+    expect # For conman/*.exp scripts
+  ];
+
+  meta = {
+    description = "The Console Manager";
+    homepage = "https://github.com/dun/conman";
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      frantathefranta
+    ];
+  };
+
+})
diff --git a/pkgs/by-name/cr/crossplane-cli/package.nix b/pkgs/by-name/cr/crossplane-cli/package.nix
index 00ea2fb0161e..557e78203205 100644
--- a/pkgs/by-name/cr/crossplane-cli/package.nix
+++ b/pkgs/by-name/cr/crossplane-cli/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "crossplane-cli";
-  version = "1.20.0";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "crossplane";
     repo = "crossplane";
     rev = "v${version}";
-    hash = "sha256-A6HX3cTst/f/QbRHHxsB/M1wm+M+I7eEmn2Yq54fbBU=";
+    hash = "sha256-EIDrBQmtMaHlapVNUYABKejIj1I02g5R5h4cADZvtAg=";
   };
 
-  vendorHash = "sha256-GqEGtoDo7BeMwReUO9hOOj03qt7yuXCEwCOY2VD81Vw=";
+  vendorHash = "sha256-8VqKtWbnDGbmgxT13v2d4+nXHouZ4hi2c2m66SAd1KM=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/fi/fish-lsp/package.nix b/pkgs/by-name/fi/fish-lsp/package.nix
index 52f6af662810..db890e335e36 100644
--- a/pkgs/by-name/fi/fish-lsp/package.nix
+++ b/pkgs/by-name/fi/fish-lsp/package.nix
@@ -15,18 +15,18 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "fish-lsp";
-  version = "1.0.9-1";
+  version = "1.0.10";
 
   src = fetchFromGitHub {
     owner = "ndonfris";
     repo = "fish-lsp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NyEhvW5NMqvESdbauxur7xWAzQiQdTVklGMYhckNAnw=";
+    hash = "sha256-OZiqEef4jE1H47mweVCzhaRCSsFdpgUdCSuhWRz2n2M=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-xB4kWpPQbA1OkXNr5sozPIP96dLJhwoDUpesE6DORzg=";
+    hash = "sha256-N9P2mmqAfbg/Kpqx+vZbb+fhaD1I/3UjiJaEqFPJyO0=";
   };
 
   nativeBuildInputs = [
@@ -75,7 +75,16 @@ stdenv.mkDerivation (finalAttrs: {
 
   doDist = false;
 
-  passthru.updateScript = nix-update-script { };
+  # fish-lsp adds tags for all its pre-release versions, which leads to
+  # incorrect r-ryantm bumps. This regex allows a dash at the end followed by a
+  # number (like `v1.0.9-1`). but it prevents matches with a dash followed by
+  # text (like `v1.0.11-pre.10`). or, of course, no dash at all
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "v\\d+\\.\\d+\\.\\d+(?:-\\d+)?$"
+    ];
+  };
 
   meta = {
     description = "LSP implementation for the fish shell language";
diff --git a/pkgs/by-name/gv/gvproxy/package.nix b/pkgs/by-name/gv/gvproxy/package.nix
index 080ab380ffb8..96ec2c682430 100644
--- a/pkgs/by-name/gv/gvproxy/package.nix
+++ b/pkgs/by-name/gv/gvproxy/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "gvproxy";
-  version = "0.8.6";
+  version = "0.8.7";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "gvisor-tap-vsock";
     rev = "v${version}";
-    hash = "sha256-a/Gd1QUxZ+47sQtndbehx86UjC1DezhqwS5d5VTIjRc=";
+    hash = "sha256-ofxU4lUfBLGspe4N8Tr+U92fyLa+gFPm4LhPDYLMX2E=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ha/hacompanion/package.nix b/pkgs/by-name/ha/hacompanion/package.nix
index 9ec01b8dee44..b0c45b04b531 100644
--- a/pkgs/by-name/ha/hacompanion/package.nix
+++ b/pkgs/by-name/ha/hacompanion/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "hacompanion";
-  version = "1.0.21";
+  version = "1.0.23";
 
   src = fetchFromGitHub {
     owner = "tobias-kuendig";
     repo = "hacompanion";
     rev = "v${version}";
-    hash = "sha256-6fj9Gs/ezISx5Llele5mrTFR0IiQzzm1wWcAywTaFPk=";
+    hash = "sha256-C86XRgNwR0VD0Dph4D7ysB9ul6fBw1MTK++ODsJrE8k=";
   };
 
   vendorHash = "sha256-y2eSuMCDZTGdCs70zYdA8NKbuPPN5xmnRfMNK+AE/q8=";
diff --git a/pkgs/by-name/ho/homebridge-config-ui-x/package.nix b/pkgs/by-name/ho/homebridge-config-ui-x/package.nix
index 98a41f89a2e9..a789d454011c 100644
--- a/pkgs/by-name/ho/homebridge-config-ui-x/package.nix
+++ b/pkgs/by-name/ho/homebridge-config-ui-x/package.nix
@@ -11,23 +11,23 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "homebridge-config-ui-x";
-  version = "5.1.0";
+  version = "5.4.1";
 
   src = fetchFromGitHub {
     owner = "homebridge";
     repo = "homebridge-config-ui-x";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-asyNIiNv0bGD6fT4VTSp1W6f3dudkdZsVOc3KKOi4OY=";
+    hash = "sha256-EF2dluZ23lK4CGhpJtB24iWfzw0OM8hPNJMrOEulHCU=";
   };
 
   # Deps hash for the root package
-  npmDepsHash = "sha256-XkdpR8yDNuP+681JIsKwHnY/Us83JGaAXJNBnGIU2UI=";
+  npmDepsHash = "sha256-a19A7j2lGjmkuIL4BVFYq1jSe4PLcnKTBkrEtVnYyTg=";
 
   # Deps src and hash for ui subdirectory
   npmDeps_ui = fetchNpmDeps {
     name = "npm-deps-ui";
     src = "${finalAttrs.src}/ui";
-    hash = "sha256-vwJcls72nzbbtC4YXasgGWtgIVV4AMuNwIkEJuubP2Q=";
+    hash = "sha256-zKEsXxNEqCYm6LjKU6gr7QBNBJcdY22bod3CBf/8mHw=";
   };
 
   # Need to also run npm ci in the ui subdirectory
diff --git a/pkgs/by-name/jj/jj-fzf/package.nix b/pkgs/by-name/jj/jj-fzf/package.nix
index a6b11d075ab4..1b48f7688995 100644
--- a/pkgs/by-name/jj/jj-fzf/package.nix
+++ b/pkgs/by-name/jj/jj-fzf/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "jj-fzf";
-  version = "0.25.0";
+  version = "0.32.0";
 
   src = fetchFromGitHub {
     owner = "tim-janik";
     repo = "jj-fzf";
     tag = "v${version}";
-    hash = "sha256-StF0TKXTgtglFDbNTAU1c7Vw+6m70Mz2RvFon3difsk=";
+    hash = "sha256-xcPLFrCpncK+RYw7BnT7BR4zfvCYnatIF0YU0wYc3iI=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/ku/kubectl-gadget/package.nix b/pkgs/by-name/ku/kubectl-gadget/package.nix
index fc82a590c306..3b4f6a48571f 100644
--- a/pkgs/by-name/ku/kubectl-gadget/package.nix
+++ b/pkgs/by-name/ku/kubectl-gadget/package.nix
@@ -2,22 +2,20 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
-  kubectl-gadget,
-  testers,
 }:
 
 buildGoModule rec {
   pname = "kubectl-gadget";
-  version = "0.42.0";
+  version = "0.43.0";
 
   src = fetchFromGitHub {
     owner = "inspektor-gadget";
     repo = "inspektor-gadget";
     rev = "v${version}";
-    hash = "sha256-oLgcM5/FwZ81YpQCT3oc29nKYK9mdsSHmYS2UtAVSlw=";
+    hash = "sha256-j1tJTg9ZKVsthKH6A+zq+kJL0xC2mZu/AV6xS+0BtKM=";
   };
 
-  vendorHash = "sha256-pgaD6iTLhQ2tHmo+e4BtPKdK0PCKngqSQENgNAz6vRo=";
+  vendorHash = "sha256-0JbBVh5zQBQHx6Mfe8h3T+/Jvm0hmdEas6vOj1CNJwc=";
 
   env.CGO_ENABLED = 0;
 
@@ -35,12 +33,6 @@ buildGoModule rec {
 
   subPackages = [ "cmd/kubectl-gadget" ];
 
-  passthru.tests.version = testers.testVersion {
-    package = kubectl-gadget;
-    command = "kubectl-gadget version";
-    version = "v${version}";
-  };
-
   meta = with lib; {
     description = "Collection of gadgets for troubleshooting Kubernetes applications using eBPF";
     mainProgram = "kubectl-gadget";
diff --git a/pkgs/by-name/ku/kubernetes/package.nix b/pkgs/by-name/ku/kubernetes/package.nix
index 16d9c8b4f46b..2eff749f3a46 100644
--- a/pkgs/by-name/ku/kubernetes/package.nix
+++ b/pkgs/by-name/ku/kubernetes/package.nix
@@ -22,13 +22,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubernetes";
-  version = "1.33.3";
+  version = "1.33.4";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "kubernetes";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UZdrfQEEx0RRe4Bb4EAWcjgCCLq4CJL06HIriYuk1Io=";
+    hash = "sha256-KENE4d40LvrJf56S/2fYwbXT6e2KSk2a94ugVVT8vlQ=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/la/labwc-menu-generator/package.nix b/pkgs/by-name/la/labwc-menu-generator/package.nix
index 1c037f507d2a..d9f084921708 100644
--- a/pkgs/by-name/la/labwc-menu-generator/package.nix
+++ b/pkgs/by-name/la/labwc-menu-generator/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "labwc-menu-generator";
-  version = "0.2.0-unstable-2025-06-03";
+  version = "0.2.0-unstable-2025-08-10";
 
   src = fetchFromGitHub {
     owner = "labwc";
     repo = "labwc-menu-generator";
-    rev = "255ae8937598524c9929e3576149473ff90dab39";
-    hash = "sha256-/cpgdBsRSDZobdXEkqOo68W9buP3J1YkCSHu0ld69R0=";
+    rev = "19ea2d27eaea50a8ef031bc1ea0c2ccfebb92e3c";
+    hash = "sha256-3ym3qauTnC7RFrni39YMSN7FYS5CvaIKb3aUXJ/Q1ko=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/la/ladybird/package.nix b/pkgs/by-name/la/ladybird/package.nix
index d7a3509e6b1d..3238928b585e 100644
--- a/pkgs/by-name/la/ladybird/package.nix
+++ b/pkgs/by-name/la/ladybird/package.nix
@@ -33,13 +33,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ladybird";
-  version = "0-unstable-2025-08-04";
+  version = "0-unstable-2025-08-11";
 
   src = fetchFromGitHub {
     owner = "LadybirdWebBrowser";
     repo = "ladybird";
-    rev = "e4b2e7b131140072416d4301d5f60dea6d79b86d";
-    hash = "sha256-d3IRIzukntabRqWbOjjx8WgaiTMnFpFJT2tbMt5ws40=";
+    rev = "a64cee528c5b387d45441da80f6c887399d4affb";
+    hash = "sha256-YtWh5Unny3IU0+81N8riGDJJAtethO1g04cxNap520s=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/li/libdeltachat/package.nix b/pkgs/by-name/li/libdeltachat/package.nix
index 1791c73d77c5..f8e56b171ea0 100644
--- a/pkgs/by-name/li/libdeltachat/package.nix
+++ b/pkgs/by-name/li/libdeltachat/package.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libdeltachat";
-  version = "2.10.0";
+  version = "2.11.0";
 
   src = fetchFromGitHub {
     owner = "chatmail";
     repo = "core";
     tag = "v${version}";
-    hash = "sha256-boS8Awxp9Z/4TrYfqRF77K01dAcEZOfr+oOqMOEeUig=";
+    hash = "sha256-W1DEG72Fk98pp0lm5+AyVb9zcpE5c2mqElOHFpofx58=";
   };
 
   patches = [
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   cargoDeps = rustPlatform.fetchCargoVendor {
     pname = "chatmail-core";
     inherit version src;
-    hash = "sha256-fSuVq0ODYvKLU2peQuutfuSerZl2cfRCu/w0E6eQRV8=";
+    hash = "sha256-P/wIat9sflXfloboMdN15EGo1cqxgPZ0OBDYF/iB/7A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ma/magic-vlsi/package.nix b/pkgs/by-name/ma/magic-vlsi/package.nix
index 1149edbf576c..f2cb943c65e6 100644
--- a/pkgs/by-name/ma/magic-vlsi/package.nix
+++ b/pkgs/by-name/ma/magic-vlsi/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "magic-vlsi";
-  version = "8.3.530";
+  version = "8.3.541";
 
   src = fetchFromGitHub {
     owner = "RTimothyEdwards";
     repo = "magic";
     tag = "${version}";
-    sha256 = "sha256-OQPOEDcU0BuGdI7+saOTntosa8+mQcGbZuwzIlvRBSk=";
+    sha256 = "sha256-mv2fEbzYZc+DWKidhNb2U9s1LomrwM8qZHiQpJv9WMI=";
     leaveDotGit = true;
   };
 
diff --git a/pkgs/by-name/ma/matrix-conduit/package.nix b/pkgs/by-name/ma/matrix-conduit/package.nix
index 5ad7cc9aa148..15d9958ff143 100644
--- a/pkgs/by-name/ma/matrix-conduit/package.nix
+++ b/pkgs/by-name/ma/matrix-conduit/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "matrix-conduit";
-  version = "0.10.7";
+  version = "0.10.8";
 
   src = fetchFromGitLab {
     owner = "famedly";
     repo = "conduit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UI/xrdM4ztH9vhEwSOwl4jTF5jU3FBwgXY7h+0prIOI=";
+    hash = "sha256-wSh1RPJt0gXp1U4aCBUASSVmvmroTPyhxpH1Exik4ds=";
   };
 
-  cargoHash = "sha256-Capftx1mpo7xWb4w1pBgM7rBsRj1YqUrQCia9MkIOX0=";
+  cargoHash = "sha256-3wQGKeLfBeASj82xqAXRhcuESX3CEgkf9P4K/AvquvQ=";
 
   # Conduit enables rusqlite's bundled feature by default, but we'd rather use our copy of SQLite.
   preBuild = ''
diff --git a/pkgs/by-name/na/nats-server/package.nix b/pkgs/by-name/na/nats-server/package.nix
index c8e6c469c364..5a492adda30b 100644
--- a/pkgs/by-name/na/nats-server/package.nix
+++ b/pkgs/by-name/na/nats-server/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "nats-server";
-  version = "2.11.7";
+  version = "2.11.8";
 
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = "nats-server";
     rev = "v${version}";
-    hash = "sha256-S+IRHTJVpRcKgrBOuBI4fAMDmV0m/RkFu0Yjs7I9caE=";
+    hash = "sha256-4kxiyxV44O+PtxTqmBmS12RkH1Rcru/EXSV7CY+8eo0=";
   };
 
-  vendorHash = "sha256-VXwyGqPlROKK3K0Bu74L/xJjqAT5+JInAmXNmlVXsWQ=";
+  vendorHash = "sha256-+wQJijP3vOU7riz8xrPot0EecEU+KhZK9UQdcI72Vtg=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/ni/nix-fast-build/package.nix b/pkgs/by-name/ni/nix-fast-build/package.nix
index 90ea52a3f504..5944893ed5c2 100644
--- a/pkgs/by-name/ni/nix-fast-build/package.nix
+++ b/pkgs/by-name/ni/nix-fast-build/package.nix
@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "nix-fast-build";
-  version = "1.2.0";
+  version = "1.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = "nix-fast-build";
     rev = "refs/tags/${version}";
-    hash = "sha256-lOouOgusUU3x97wClX8+WdbzpneMiRTdCqDSxGc/RlU=";
+    hash = "sha256-6X4BW+3C2nfkorMfe+tuoeYrdddxPtLqOJ1rZxuxPrc=";
   };
 
   build-system = [ python3Packages.setuptools ];
diff --git a/pkgs/by-name/nm/nmap/package.nix b/pkgs/by-name/nm/nmap/package.nix
index 7593868d50d0..d16274c7342b 100644
--- a/pkgs/by-name/nm/nmap/package.nix
+++ b/pkgs/by-name/nm/nmap/package.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nmap";
-  version = "7.97";
+  version = "7.98";
 
   src = fetchurl {
     url = "https://nmap.org/dist/nmap-${version}.tar.bz2";
-    hash = "sha256-r5jyeSXGcMJX3Zap3fJyTgbLebL9Hg0IySBjFr4WRcA=";
+    hash = "sha256-zoRzE+qunlyfIXCOQtKre1bH4OuIA3KaMJL1iIbYl+Y=";
   };
 
   prePatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
diff --git a/pkgs/by-name/nt/ntfs3g/package.nix b/pkgs/by-name/nt/ntfs3g/package.nix
index 43b91dfc0f82..5d879a74b62d 100644
--- a/pkgs/by-name/nt/ntfs3g/package.nix
+++ b/pkgs/by-name/nt/ntfs3g/package.nix
@@ -12,6 +12,7 @@
   crypto ? false,
   libgcrypt,
   gnutls,
+  fuse,
 }:
 
 stdenv.mkDerivation rec {
@@ -35,13 +36,11 @@ stdenv.mkDerivation rec {
   buildInputs = [
     gettext
     libuuid
+    fuse
   ]
   ++ lib.optionals crypto [
     gnutls
     libgcrypt
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    macfuse-stubs
   ];
 
   # Note: libgcrypt is listed here non-optionally because its m4 macros are
@@ -68,6 +67,7 @@ stdenv.mkDerivation rec {
     "--enable-extras"
     "--with-mount-helper=${mount}/bin/mount"
     "--with-umount-helper=${mount}/bin/umount"
+    "--with-fuse=external"
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     "--with-modprobe-helper=${kmod}/bin/modprobe"
@@ -84,6 +84,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/tuxera/ntfs-3g";
     description = "FUSE-based NTFS driver with full write support";
     maintainers = with maintainers; [ dezgeg ];
+    mainProgram = "ntfs-3g";
     platforms = with platforms; darwin ++ linux;
     license = with licenses; [
       gpl2Plus # ntfs-3g itself
diff --git a/pkgs/by-name/op/openrct2/package.nix b/pkgs/by-name/op/openrct2/package.nix
index a670b97195e8..298c08ba67ae 100644
--- a/pkgs/by-name/op/openrct2/package.nix
+++ b/pkgs/by-name/op/openrct2/package.nix
@@ -33,26 +33,26 @@
 }:
 
 let
-  openrct2-version = "0.4.24";
+  openrct2-version = "0.4.25";
 
   # Those versions MUST match the pinned versions within the CMakeLists.txt
   # file. The REPLAYS repository from the CMakeLists.txt is not necessary.
-  objects-version = "1.7.1";
-  openmsx-version = "1.6";
-  opensfx-version = "1.0.5";
+  objects-version = "1.7.2";
+  openmsx-version = "1.6.1";
+  opensfx-version = "1.0.6";
   title-sequences-version = "0.4.14";
 
   objects = fetchurl {
     url = "https://github.com/OpenRCT2/objects/releases/download/v${objects-version}/objects.zip";
-    hash = "sha256-Z5ussyDgEG9MrPxmGaSy4yKTb1W9qMFEdEa8Jtv+oZM=";
+    hash = "sha256-tChvevaKYbD3/G43m6N79nlihtc+l8lnlYvzdOP5jzU=";
   };
   openmsx = fetchurl {
     url = "https://github.com/OpenRCT2/OpenMusic/releases/download/v${openmsx-version}/openmusic.zip";
-    hash = "sha256-8JfTpMzTn3VG+X2z7LG4vnNkj1O3p1lbhszL3Bp1V+Q=";
+    hash = "sha256-mUs1DTsYDuHLlhn+J/frrjoaUjKEDEvUeonzP6id4aE=";
   };
   opensfx = fetchurl {
     url = "https://github.com/OpenRCT2/OpenSoundEffects/releases/download/v${opensfx-version}/opensound.zip";
-    hash = "sha256-qVIUi+FkwSjk/TrqloIuXwUe3ZoLHyyE3n92KM47Lhg=";
+    hash = "sha256-BrkPPhnCFnUt9EHVUbJqnj4bp3Vb3SECUEtzv5k2CL4=";
   };
   title-sequences = fetchurl {
     url = "https://github.com/OpenRCT2/title-sequences/releases/download/v${title-sequences-version}/title-sequences.zip";
@@ -67,7 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "OpenRCT2";
     repo = "OpenRCT2";
     rev = "v${openrct2-version}";
-    hash = "sha256-kGayrRCPahs1aQgM5dXeVuMf4tIwTxc8G0Z857fjCRI=";
+    hash = "sha256-/rmq97I/cn7th9VSw5zL5A2esWdk8G/MFpWTky7yabc=";
   };
 
   nativeBuildInputs = [
@@ -103,10 +103,10 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   cmakeFlags = [
-    "-DDOWNLOAD_OBJECTS=OFF"
-    "-DDOWNLOAD_OPENMSX=OFF"
-    "-DDOWNLOAD_OPENSFX=OFF"
-    "-DDOWNLOAD_TITLE_SEQUENCES=OFF"
+    (lib.cmakeBool "DOWNLOAD_OBJECTS" false)
+    (lib.cmakeBool "DOWNLOAD_OPENMSX" false)
+    (lib.cmakeBool "DOWNLOAD_OPENSFX" false)
+    (lib.cmakeBool "DOWNLOAD_TITLE_SEQUENCES" false)
   ];
 
   postUnpack = ''
diff --git a/pkgs/by-name/ox/oxide-rs/package.nix b/pkgs/by-name/ox/oxide-rs/package.nix
index 09a4df824567..2c98ce80d8b7 100644
--- a/pkgs/by-name/ox/oxide-rs/package.nix
+++ b/pkgs/by-name/ox/oxide-rs/package.nix
@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "oxide-rs";
-  version = "0.12.0+20250604.0.0";
+  version = "0.13.0+20250730.0.0";
 
   src = fetchFromGitHub {
     owner = "oxidecomputer";
     repo = "oxide.rs";
     rev = "v${version}";
-    hash = "sha256-XtN/ZRaVrw4pB82cCmWijjTMZzte7VlUzx5BaCq2mCc=";
+    hash = "sha256-baEXsDzM4y4HmUwjIqVBJm+8L+q+llq9g2o1kEZU3vI=";
   };
 
   patches = [
@@ -33,7 +33,7 @@ rustPlatform.buildRustPackage rec {
     "--skip=test_cmd_auth_debug_logging"
   ];
 
-  cargoHash = "sha256-b3RYPjkKgmcE70wSYl5Lu2uMS2gALxRSbLoKzXisUx4=";
+  cargoHash = "sha256-radMOVLnHaV+5bUYanw5mswGM9A+xqNN/a4boe1jWDM=";
 
   cargoBuildFlags = [
     "--package=oxide-cli"
diff --git a/pkgs/by-name/pi/pixi/package.nix b/pkgs/by-name/pi/pixi/package.nix
index aa43a843407f..98224216e377 100644
--- a/pkgs/by-name/pi/pixi/package.nix
+++ b/pkgs/by-name/pi/pixi/package.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "pixi";
-  version = "0.51.0";
+  version = "0.52.0";
 
   src = fetchFromGitHub {
     owner = "prefix-dev";
     repo = "pixi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DuYfDy87HoJc+LL/vL91Omx6Spy7wO4HKI3Uary2DGs=";
+    hash = "sha256-zmFoIoyTYq/xqPNBuy90aK/Ao1DGx+3Jb1zzatNY7+Q=";
   };
 
-  cargoHash = "sha256-pqhoEWWEjgMDz9G4Bhom0cdP1R3fWydAI9Z3aX4sQD4=";
+  cargoHash = "sha256-FWjZiBMSUFBIi+Sx5FTp2UZa12b+pmtx1eqVETHQWEQ=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/qw/qwen-code/package.nix b/pkgs/by-name/qw/qwen-code/package.nix
index 763411b4661f..77f6d6dc0c0e 100644
--- a/pkgs/by-name/qw/qwen-code/package.nix
+++ b/pkgs/by-name/qw/qwen-code/package.nix
@@ -8,18 +8,18 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "qwen-code";
-  version = "0.0.5";
+  version = "0.0.6";
 
   src = fetchFromGitHub {
     owner = "QwenLM";
     repo = "qwen-code";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/PuykGiXpjk2Fp1Sif59hvOIepZ7KcJRvL/9RMatQJA=";
+    hash = "sha256-s4+1hqdlJh5jOy6uZz608n5DzuBR+v/s+7D85oFwQIY=";
   };
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-HzrN549MfI+TN7BKssisIsga7udGKvextruzuoLq8M4=";
+    hash = "sha256-cGO66hQxgpoxphtt/BPPDIBuAG8yQseCdzUdAO2mkr4=";
   };
 
   buildPhase = ''
@@ -50,6 +50,9 @@ buildNpmPackage (finalAttrs: {
     mainProgram = "qwen";
     license = lib.licenses.asl20;
     platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [ lonerOrz ];
+    maintainers = with lib.maintainers; [
+      lonerOrz
+      taranarmo
+    ];
   };
 })
diff --git a/pkgs/by-name/re/renode-dts2repl/package.nix b/pkgs/by-name/re/renode-dts2repl/package.nix
index 78c1a5e44bbb..eb5e17a4b397 100644
--- a/pkgs/by-name/re/renode-dts2repl/package.nix
+++ b/pkgs/by-name/re/renode-dts2repl/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication {
   pname = "renode-dts2repl";
-  version = "0-unstable-2025-08-01";
+  version = "0-unstable-2025-08-08";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "antmicro";
     repo = "dts2repl";
-    rev = "c281274af377459710de24eb44672bb9a37d10b1";
-    hash = "sha256-K2dlQHBKDNh5ndGvbRr35AMG/g1Bvmsumr9uBuRxHZ8=";
+    rev = "0e49cbea7b4047ffec3bb35a59f2ec6dc4606a48";
+    hash = "sha256-YfaOPWJ113UDjmKgj6eaN9bcIk9iW1nc2jeN3M+LyB8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/re/restate/package.nix b/pkgs/by-name/re/restate/package.nix
index 19adc8192e57..6ac10e20bda2 100644
--- a/pkgs/by-name/re/restate/package.nix
+++ b/pkgs/by-name/re/restate/package.nix
@@ -25,16 +25,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "restate";
-  version = "1.4.3";
+  version = "1.4.4";
 
   src = fetchFromGitHub {
     owner = "restatedev";
     repo = "restate";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-s7HoPuye31zATAtekWAqJz8gc/vy+vWoM68QwpjdH3o=";
+    hash = "sha256-OtDVYGYoUpocy3c9ZDKbE5ZqGRLewJMvABj2QQxJQ80=";
   };
 
-  cargoHash = "sha256-jkwi533Vem62vxq47EXIy/2mTHMB61DGmUyQfm3/BCE=";
+  cargoHash = "sha256-OWSFnVqyI2qV0IEXKOAp2QMs2qmjzS0UINVo+nu296g=";
 
   env = {
     PROTOC = lib.getExe protobuf;
diff --git a/pkgs/by-name/ri/rivercarro/deps.nix b/pkgs/by-name/ri/rivercarro/deps.nix
index 682e0e75542a..6a721c78e132 100644
--- a/pkgs/by-name/ri/rivercarro/deps.nix
+++ b/pkgs/by-name/ri/rivercarro/deps.nix
@@ -1,13 +1,17 @@
 # generated by zon2nix (https://github.com/nix-community/zon2nix)
 
-{ linkFarm, fetchzip }:
+{
+  linkFarm,
+  fetchzip,
+  fetchgit,
+}:
 
 linkFarm "zig-packages" [
   {
-    name = "1220b0f8f822c1625af7aae4cb3ab2c4ec1a4c0e99ef32867b2a8d88bb070b3e7f6d";
+    name = "wayland-0.3.0-lQa1kjPIAQDmhGYpY-zxiRzQJFHQ2VqhJkQLbKKdt5wl";
     path = fetchzip {
-      url = "https://codeberg.org/ifreund/zig-wayland/archive/v0.1.0.tar.gz";
-      hash = "sha256-VLEx8nRgmJZWgLNBRqrR7bZEkW0m5HTRv984HKwoIfA=";
+      url = "https://codeberg.org/ifreund/zig-wayland/archive/v0.3.0.tar.gz";
+      hash = "sha256-ydEavD9z20wRwn9ZVX56ZI2T5i1tnm3LupVxfa30o84=";
     };
   }
 ]
diff --git a/pkgs/by-name/ri/rivercarro/package.nix b/pkgs/by-name/ri/rivercarro/package.nix
index ac5ddf72f841..4df6d442b0f5 100644
--- a/pkgs/by-name/ri/rivercarro/package.nix
+++ b/pkgs/by-name/ri/rivercarro/package.nix
@@ -8,19 +8,22 @@
   wayland,
   wayland-protocols,
   wayland-scanner,
-  zig_0_12,
+  zig_0_14,
 }:
 
+let
+  zig = zig_0_14;
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "rivercarro";
-  version = "0.4.0";
+  version = "0.6.0-unstable-2025-03-19";
 
   src = fetchFromSourcehut {
     owner = "~novakane";
     repo = "rivercarro";
-    rev = "v${finalAttrs.version}";
+    rev = "199800235645a1771e2551a64d5b4f5e2601888c";
     fetchSubmodules = true;
-    hash = "sha256-nDKPv/roweW7ynEROsipUJPvs6VMmz3E4JzEFRBzE6s=";
+    hash = "sha256-im26hiRi24tLCSvLnIdcnIWml5kTs7YSCAC8o9mcR+M=";
   };
 
   nativeBuildInputs = [
@@ -29,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     wayland
     wayland-protocols
     wayland-scanner
-    zig_0_12.hook
+    zig.hook
   ];
 
   postPatch = ''
@@ -52,7 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://git.sr.ht/~novakane/rivercarro/refs/v${finalAttrs.version}";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ kraem ];
-    inherit (zig_0_12.meta) platforms;
+    inherit (zig.meta) platforms;
     mainProgram = "rivercarro";
   };
 })
diff --git a/pkgs/by-name/sh/shim-unsigned/package.nix b/pkgs/by-name/sh/shim-unsigned/package.nix
index 0c0fd8d790c6..37646180c9b9 100644
--- a/pkgs/by-name/sh/shim-unsigned/package.nix
+++ b/pkgs/by-name/sh/shim-unsigned/package.nix
@@ -21,13 +21,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "shim";
-  version = "16.0";
+  version = "16.1";
 
   src = fetchFromGitHub {
     owner = "rhboot";
     repo = "shim";
     tag = version;
-    hash = "sha256-KFpt//A4/T0FRBSPuTKQH/mEIqLVEiE+Lpvuq7ec6eo=";
+    hash = "sha256-qHZfr7ncJOsb1Cijlp6eJSMzxa34H1h4lACqceOzg+s=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/sy/system76-firmware/package.nix b/pkgs/by-name/sy/system76-firmware/package.nix
index dafb767df821..8a9eea086b3c 100644
--- a/pkgs/by-name/sy/system76-firmware/package.nix
+++ b/pkgs/by-name/sy/system76-firmware/package.nix
@@ -12,13 +12,13 @@
 rustPlatform.buildRustPackage rec {
   pname = "system76-firmware";
   # Check Makefile when updating, make sure postInstall matches make install
-  version = "1.0.71";
+  version = "1.0.74";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "system76-firmware";
     rev = version;
-    sha256 = "sha256-z4n1olvOSiJfHnEixUaWfz86519SntHfECOtWSeI4vk=";
+    sha256 = "sha256-lgBEzOxTmVAksZ7yo7dIUzP6Z8KKmUpEIDEpU7CL69Y=";
   };
 
   nativeBuildInputs = [
@@ -34,7 +34,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoBuildFlags = [ "--workspace" ];
 
-  cargoHash = "sha256-YgDWaxrEfG1xxZOqa7tk2NaPVfMIqoMNZdjejkY6Jow=";
+  cargoHash = "sha256-Xztvc8t3w6a5vf0zPU6roFIIgGLjebWmw18UaU1BdhA=";
 
   # Purposefully don't install systemd unit file, that's for NixOS
   postInstall = ''
diff --git a/pkgs/by-name/xr/xreader/package.nix b/pkgs/by-name/xr/xreader/package.nix
index 90d0a2544a70..c65424059903 100644
--- a/pkgs/by-name/xr/xreader/package.nix
+++ b/pkgs/by-name/xr/xreader/package.nix
@@ -36,13 +36,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xreader";
-  version = "4.2.8";
+  version = "4.2.9";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "xreader";
     rev = version;
-    hash = "sha256-Q/Hx43B+LmoAWzHPcz+kETjLzKyrO0Sn4gu9PmGfyUI=";
+    hash = "sha256-ZYzAkg0YP+ex8TUglWvZu8mnF1gYua2eYloQzRuuCns=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/xr/xremap/package.nix b/pkgs/by-name/xr/xremap/package.nix
index c6420e18e1d4..7eb03d6a1710 100644
--- a/pkgs/by-name/xr/xremap/package.nix
+++ b/pkgs/by-name/xr/xremap/package.nix
@@ -6,16 +6,16 @@
 }:
 let
   pname = "xremap";
-  version = "0.10.14";
+  version = "0.10.15";
 
   src = fetchFromGitHub {
     owner = "xremap";
     repo = "xremap";
     tag = "v${version}";
-    hash = "sha256-7bkLn8cGDxUjy9rMcGmgrzm1YGouScQEmQMlg1k+HCY=";
+    hash = "sha256-ghGlyjBqW9UyXno1l4+a6AzgIJx7RNuJEVCQkae2pww=";
   };
 
-  cargoHash = "sha256-CmlwXmQDqIr2BZrl3/uwTarRV/xGof+2mavAVUejiZE=";
+  cargoHash = "sha256-xP1UC8ViAS3/EXmvZjerDexH96Esj5vfRPx1GRzcICI=";
 
   buildXremap =
     {
diff --git a/pkgs/by-name/xw/xwin/package.nix b/pkgs/by-name/xw/xwin/package.nix
index f7d206647c0d..4efcd3e155e8 100644
--- a/pkgs/by-name/xw/xwin/package.nix
+++ b/pkgs/by-name/xw/xwin/package.nix
@@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "xwin";
-  version = "0.6.6";
+  version = "0.6.7";
 
   src = fetchFromGitHub {
     owner = "Jake-Shadle";
     repo = "xwin";
     tag = finalAttrs.version;
-    hash = "sha256-bow/TJ6aIXoNZDqCTlQYAMxEUiolby1axsKiLMk/jiA=";
+    hash = "sha256-od8QnUC0hU9GYE/gRB74BlQezlt9IZq2A4F331wHm7Q=";
   };
 
-  cargoHash = "sha256-S/3EjlG0Dr/KKAYSFaX/aFh/CIc19Bv+rKYzKPWC+MI=";
+  cargoHash = "sha256-77ArdZ9mOYEon4nzNUNSL0x0UlE1iVujFLwreAd9iMM=";
 
   doCheck = true;
   # Requires network access
diff --git a/pkgs/by-name/ze/zenmap/package.nix b/pkgs/by-name/ze/zenmap/package.nix
index 71253709da5e..702ec89a866f 100644
--- a/pkgs/by-name/ze/zenmap/package.nix
+++ b/pkgs/by-name/ze/zenmap/package.nix
@@ -21,6 +21,7 @@ python3Packages.buildPythonApplication rec {
 
   build-system = with python3Packages; [
     setuptools
+    setuptools-gettext
   ];
 
   buildInputs = [
diff --git a/pkgs/desktops/pantheon/apps/elementary-screenshot/default.nix b/pkgs/desktops/pantheon/apps/elementary-screenshot/default.nix
index 58384337a631..5b854127ecd2 100644
--- a/pkgs/desktops/pantheon/apps/elementary-screenshot/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-screenshot/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-screenshot";
-  version = "8.0.1";
+  version = "8.0.2";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "screenshot";
     rev = version;
-    hash = "sha256-qhXTOdxMpiCPJR0Gp65itr6Em9e6OzMn3m/OyS7YfcA=";
+    hash = "sha256-yCLaiwR1zRoQZI8QVt0oMMGyS7xjaO7gbj7XfphBL2o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/desktops/xfce/core/xfce4-panel/default.nix b/pkgs/desktops/xfce/core/xfce4-panel/default.nix
index 4bbd3cde2dfe..03bf0bac5d42 100644
--- a/pkgs/desktops/xfce/core/xfce4-panel/default.nix
+++ b/pkgs/desktops/xfce/core/xfce4-panel/default.nix
@@ -2,7 +2,6 @@
   stdenv,
   lib,
   mkXfceDerivation,
-  fetchpatch,
   python3,
   cairo,
   exo,
@@ -28,18 +27,9 @@
 mkXfceDerivation {
   category = "xfce";
   pname = "xfce4-panel";
-  version = "4.20.4";
+  version = "4.20.5";
 
-  sha256 = "sha256-P1EZefpGRZ0DQ5S4Okw9pyly23d+UdPp5xMj1wJc44c=";
-
-  patches = [
-    # Fixes panel not shown on external display after reconnecting
-    # https://gitlab.xfce.org/xfce/xfce4-panel/-/issues/925
-    (fetchpatch {
-      url = "https://gitlab.xfce.org/xfce/xfce4-panel/-/commit/e2451cacd950f4b7539efd1e5e36b067515dba9b.patch";
-      hash = "sha256-h2iPlghHJeHD9PJp6RJrRx4MBsaqXuNclAJW6CKHE4A=";
-    })
-  ];
+  sha256 = "sha256-Jftj+EmmsKfK9jk8rj5uMjpteFUHFgOpoEol8JReDNI=";
 
   nativeBuildInputs = [
     python3
diff --git a/pkgs/development/libraries/astal/source.nix b/pkgs/development/libraries/astal/source.nix
index 56636e07bb88..352af30abc0d 100644
--- a/pkgs/development/libraries/astal/source.nix
+++ b/pkgs/development/libraries/astal/source.nix
@@ -7,15 +7,15 @@ let
   originalDrv = fetchFromGitHub {
     owner = "Aylur";
     repo = "astal";
-    rev = "2c5eb54f39e1710c6e2c80915a240978beb3269a";
-    hash = "sha256-XULTToDUkIshNXEO+YP2mAHdQv8bxWDvKjbamBfOC8E=";
+    rev = "5d4eef66392b0dff99a63a4f39ff886624bd69dd";
+    hash = "sha256-kzU/3A4k+d3PsgMLohzSh4KJybTqvzqibUVqV2yXCGY=";
   };
 in
 originalDrv.overrideAttrs (
   final: prev: {
     name = "${final.pname}-${final.version}"; # fetchFromGitHub already defines name
     pname = "astal-source";
-    version = "0-unstable-2025-07-13";
+    version = "0-unstable-2025-08-11";
 
     meta = prev.meta // {
       description = "Building blocks for creating custom desktop shells (source)";
diff --git a/pkgs/development/python-modules/klayout/default.nix b/pkgs/development/python-modules/klayout/default.nix
index 4469433822e0..ef153202b311 100644
--- a/pkgs/development/python-modules/klayout/default.nix
+++ b/pkgs/development/python-modules/klayout/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage rec {
   pname = "klayout";
-  version = "0.30.2";
+  version = "0.30.3";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-HRuRnwKyTVecjAY0BzUuOahrdMMUlXLUiAoProNjS6U=";
+    hash = "sha256-zyj5s2pHjgrk7/l2cqvcvqCvhdxh7dNG7tlLNGFlOX8=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/langgraph-prebuilt/default.nix b/pkgs/development/python-modules/langgraph-prebuilt/default.nix
index e866d965871e..0cf2805c131c 100644
--- a/pkgs/development/python-modules/langgraph-prebuilt/default.nix
+++ b/pkgs/development/python-modules/langgraph-prebuilt/default.nix
@@ -31,14 +31,14 @@
 # It exists so the langgraph team can iterate on it without having to rebuild langgraph.
 buildPythonPackage rec {
   pname = "langgraph-prebuilt";
-  version = "0.6.3";
+  version = "0.6.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langgraph";
     tag = "prebuilt==${version}";
-    hash = "sha256-bASxPjOElhJhOAc0XiSqZ+i+dKETYi1KTFgamlJHA9Y=";
+    hash = "sha256-9jl16cKp3E7j79PXrr/3splrcJtfQQN7yFJ5sfa6c+I=";
   };
 
   sourceRoot = "${src.name}/libs/prebuilt";
diff --git a/pkgs/development/python-modules/svg-py/default.nix b/pkgs/development/python-modules/svg-py/default.nix
index 759e8bef0001..d9f06a3811c7 100644
--- a/pkgs/development/python-modules/svg-py/default.nix
+++ b/pkgs/development/python-modules/svg-py/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "svg-py";
-  version = "1.7.0";
+  version = "1.8.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "orsinium-labs";
     repo = "svg.py";
     tag = version;
-    hash = "sha256-WRPHNgaKjim91pLdM8iQ1/1DBm7+lU7hFH0vXTguG1s=";
+    hash = "sha256-wHbAsmFkJ3VGBuaKElB+qT8OaKleJ2DgGKr0LvojWws=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/misc/tmux-plugins/default.nix b/pkgs/misc/tmux-plugins/default.nix
index 8c581310ff8f..53edf5bb6a08 100644
--- a/pkgs/misc/tmux-plugins/default.nix
+++ b/pkgs/misc/tmux-plugins/default.nix
@@ -1103,12 +1103,12 @@ in
   tmux-toggle-popup = mkTmuxPlugin rec {
     pluginName = "tmux-toggle-popup";
     rtpFilePath = "toggle-popup.tmux";
-    version = "0.4.2";
+    version = "0.4.3";
     src = fetchFromGitHub {
       owner = "loichyan";
       repo = "tmux-toggle-popup";
       tag = "v${version}";
-      hash = "sha256-dlCUK+yrBkY0DnKoj/s9dJ6yITBMfWMgw3wnwzuxim4=";
+      hash = "sha256-uQihpmQTJbjx5euXSGOFlekFgCTYXGu7SQYqyZjKLM8=";
     };
     meta = with lib; {
       homepage = "https://github.com/loichyan/tmux-toggle-popup";
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index acb21f2dfe24..70e2d9a74350 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -329,7 +329,7 @@ let
       BONDING = module;
       NET_L3_MASTER_DEV = option yes;
       NET_FOU_IP_TUNNELS = option yes;
-      IP_NF_TARGET_REDIRECT = module;
+      IP_NF_TARGET_REDIRECT = whenOlder "6.17" module;
       NETKIT = whenAtLeast "6.7" yes;
 
       PPP_MULTILINK = yes; # PPP multilink support
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 2679c02e760f..16b9b4fd8254 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,11 +1,11 @@
 {
     "testing": {
-        "version": "6.16-rc7",
-        "hash": "sha256:071xwskg7rpa6j09khdxzzccqp8a2fk68l0p2bn7ycr51pyywxz9"
+        "version": "6.17-rc1",
+        "hash": "sha256:0dilsyjyx06b5f9wln6i58xi6nja2g5pj9p2kclfqqhbrgzxkyfl"
     },
     "6.1": {
-        "version": "6.1.147",
-        "hash": "sha256:1xv6whvxjcdmvv0cil7nnac4hs2hxjnc98agx08xiqs179k2b3r1"
+        "version": "6.1.148",
+        "hash": "sha256:18c024bqqc3srzv2gva55p95yghjc6x3p3f54v3hziki4wx3v86r"
     },
     "5.15": {
         "version": "5.15.189",
@@ -20,19 +20,19 @@
         "hash": "sha256:0fm73yqzbzclh2achcj8arpg428d412k2wgmlfmyy6xzb1762qrx"
     },
     "6.6": {
-        "version": "6.6.101",
-        "hash": "sha256:1h71zbqlsxcafrk218s0rip9rdrj0fzqvsl81ndqnlrnjy3g4kwc"
+        "version": "6.6.102",
+        "hash": "sha256:0p6yjifwyrqlppn40isgxb0b5vqmljggmnp7w75vlc2c6fvzxll0"
     },
     "6.12": {
-        "version": "6.12.41",
-        "hash": "sha256:09qfpxyxi3z8cd64r2r5mxvh54a5sx8p5mk4d50y4ga2k6pa66bb"
+        "version": "6.12.42",
+        "hash": "sha256:1yy17c06sn6l0skz8n1kxqhzldgwxxd0xhs11fd3086d56554128"
     },
     "6.15": {
-        "version": "6.15.9",
-        "hash": "sha256:0zcma8ycdwwzd4yci9752acsv85wh27lahclh5x2yc4jakw3lkz9"
+        "version": "6.15.10",
+        "hash": "sha256:01pxk3cnil1wbysp4s6ybh5djskxzf9llmk1qy7zfr2l4mwnbkd4"
     },
     "6.16": {
-        "version": "6.16",
-        "hash": "sha256:10ydzfzc3g0nhns6md08gpfshhjcyd58lylqr15alijjdgzf4jqs"
+        "version": "6.16.1",
+        "hash": "sha256:1fmcl66wzb4qwz60lgqjan8h9rwnrzw5gndjncaf9qdcqwdljhza"
     }
 }
diff --git a/pkgs/servers/plex/raw.nix b/pkgs/servers/plex/raw.nix
index 6fea6b095989..0531521ce318 100644
--- a/pkgs/servers/plex/raw.nix
+++ b/pkgs/servers/plex/raw.nix
@@ -14,7 +14,7 @@
 # server, and the FHS userenv and corresponding NixOS module should
 # automatically pick up the changes.
 stdenv.mkDerivation rec {
-  version = "1.41.9.9961-46083195d";
+  version = "1.42.1.10060-4e8b05daf";
   pname = "plexmediaserver";
 
   # Fetch the source
@@ -22,12 +22,12 @@ stdenv.mkDerivation rec {
     if stdenv.hostPlatform.system == "aarch64-linux" then
       fetchurl {
         url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_arm64.deb";
-        sha256 = "1gxiwzv799w2b18mlq1yx5z3x9k51f88yc9k7mmcn5a224a11kxf";
+        sha256 = "f10c635b17a8aedc3f3a3d5d6cad8dff9e7fb534384d601eb832a3e3de91b0e7";
       }
     else
       fetchurl {
         url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_amd64.deb";
-        sha256 = "0hnwsh9x48xx9grgv4j30ymbr7v9bdfkl3dnfwjbqr0g3zb22av2";
+        sha256 = "3a822dbc6d08a6050a959d099b30dcd96a8cb7266b94d085ecc0a750aa8197f4";
       };
 
   outputs = [