diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index c3c78a70aa02..a146eb093c96 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11289,6 +11289,11 @@
     github = "HigherOrderLogic";
     githubId = 73709188;
   };
+  highghlow = {
+    name = "Alex Kravchenko";
+    github = "unhighghlow";
+    githubId = 132668972;
+  };
   hirenashah = {
     email = "hiren@hiren.io";
     github = "hirenashah";
diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 10dd33eac8c2..acfb213b98e0 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -259,27 +259,7 @@ in
 
   options.systemd = {
 
-    package = mkPackageOption pkgs "systemd" { } // {
-      # audit 4.2 rejects overlong values (max 15 bytes) for the kernel comm.
-      # systemd attempts to send the full 19 bytes of "systemd-update-utmp",
-      # and the systemd-update-utmp service fails to start. this patch shortens
-      # the kernel comm entry to "update-utmp".
-      # TODO: revert on staging when updating to audit 4.2.1
-      # original commit: https://github.com/linux-audit/audit-userspace/commit/d7ea98263ebdb974b383a4057856a5ec339776fc
-      # switch to truncate: https://github.com/linux-audit/audit-userspace/commit/d7ea98263ebdb974b383a4057856a5ec339776fc
-      # systemd pr: https://github.com/systemd/systemd/pull/43144
-      apply =
-        pkg:
-        pkg.overrideAttrs (prevAttrs: {
-          patches = prevAttrs.patches or [ ] ++ [
-            (pkgs.fetchpatch {
-              name = "systemd-update-utmp-shorten-comm.patch";
-              url = "https://github.com/systemd/systemd/commit/b8968c492108506952ab2748c4a44ce32fc9477c.patch";
-              hash = "sha256-d0rMssj1+cDw3+KOk8ecjqIIuBhjDixIH+7MJfC+I+M=";
-            })
-          ];
-        });
-    };
+    package = mkPackageOption pkgs "systemd" { };
 
     enableStrictShellChecks = mkEnableOption "" // {
       description = ''
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 32ac9eda7d70..b426fb633b52 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1840,6 +1840,7 @@ in
   userborn-static = runTest ./userborn-static.nix;
   ustreamer = runTest ./ustreamer.nix;
   utils = import ./utils { inherit runTest; };
+  utmp = runTest ./utmp.nix;
   uwsgi = runTest ./uwsgi.nix;
   v2ray = runTest ./v2ray.nix;
   varnish80 = runTest {
diff --git a/nixos/tests/shadow/system.nix b/nixos/tests/shadow/system.nix
index fbed9be8beba..ddba233e3c5a 100644
--- a/nixos/tests/shadow/system.nix
+++ b/nixos/tests/shadow/system.nix
@@ -4,6 +4,7 @@ let
   controllerPython = pkgs.python3.withPackages (ps: [
     ps.flaky
     ps.jc
+    ps.passlib
     ps.pytest
     ps.pytest-mh
     ps.pytest-ticket
@@ -35,6 +36,7 @@ in
         environment.systemPackages = with pkgs; [
           shadow
           expect
+          vim
         ];
 
         users.defaultUserShell = "/bin/sh";
diff --git a/nixos/tests/utmp.nix b/nixos/tests/utmp.nix
new file mode 100644
index 000000000000..c2d80c17cb76
--- /dev/null
+++ b/nixos/tests/utmp.nix
@@ -0,0 +1,65 @@
+{ lib, ... }:
+{
+
+  name = "utmp";
+
+  meta = {
+    maintainers = with lib.maintainers; [ grimmauld ];
+  };
+
+  nodes = {
+    machine = {
+      imports = [ ./common/user-account.nix ];
+      security.audit.enable = true;
+      security.auditd.enable = true;
+    };
+  };
+
+  testScript = ''
+    import re
+
+    def extract_utmp_fields(line: str) -> tuple[str, str] | None:
+      m = re.match(r"^\[\d*\]\s*\[\d*\]\s*\[([^\]\s]*)\s*]\s*\[([^\]\s]*)\s*]", line)
+      if not m:
+          return None
+      return m.group(1), m.group(2)
+
+    machine.wait_for_unit("auditd.service")
+    machine.wait_for_unit("systemd-update-utmp.service")
+    machine.wait_for_file("/run/utmp")
+
+    with subtest("systemd updated utmp"):
+      utmp = machine.succeed("utmpdump /run/utmp").strip().split("\n")
+      print(utmp)
+      assert extract_utmp_fields(utmp[0]) == ("~~", "reboot") # first entry is the reboot
+
+    with subtest("Test utmp entries are created by logins"):
+      machine.wait_for_unit("multi-user.target")
+      machine.wait_until_tty_matches("1", "login: ")
+      machine.send_chars("alice\n")
+      machine.wait_until_tty_matches("1", "Password: ")
+      machine.send_chars("foobar\n")
+      machine.wait_until_succeeds("pgrep -u alice bash")
+      utmp = machine.succeed("utmpdump /run/utmp").strip().split("\n")
+      print(utmp)
+      assert extract_utmp_fields(utmp[1]) == ("tty1", "alice") # second entry is alice login
+      machine.send_chars("exit\n")
+      machine.wait_until_fails("pgrep -u alice bash")
+
+    with subtest("Test utmp entries are cleaned after logout"):
+      utmp = machine.succeed("utmpdump /run/utmp").strip().split("\n")
+      print(utmp)
+      assert extract_utmp_fields(utmp[1]) in [("tty1", ""), ("tty1", "LOGIN")] # tty1 previously in use by alice is now clear
+
+    with subtest("audit logs utmp system boot"):
+      audit_log = machine.succeed("ausearch -m SYSTEM_BOOT")
+      print(audit_log)
+      # audit 4.2.1 truncates too long comm entries, while systemd shortened the entry from `systemd-update-utmp` (truncated) to `update-utmp`
+      # see also:
+      # - systemd: https://github.com/systemd/systemd/pull/43144
+      # - audit: https://github.com/linux-audit/audit-userspace/commit/d7ea98263ebdb974b383a4057856a5ec339776fc
+      # accept either fix in this test
+      assert 'comm="update-utmp"' in audit_log or f'comm="{"systemd-update-utmp"[:15]}"' in audit_log
+  '';
+
+}
diff --git a/pkgs/build-support/setup-hooks/strip.sh b/pkgs/build-support/setup-hooks/strip.sh
index f340ac49acd4..c0553c05ef99 100644
--- a/pkgs/build-support/setup-hooks/strip.sh
+++ b/pkgs/build-support/setup-hooks/strip.sh
@@ -71,7 +71,7 @@ stripDirs() {
     paths=${pathsNew}
 
     if [ -n "${paths}" ]; then
-        echo "stripping (with command $cmd and flags $stripFlags) in $paths"
+        echo "stripping (with command $cmd and flags $stripFlags) in$paths"
         local striperr
         striperr="$(mktemp --tmpdir="$TMPDIR" 'striperr.XXXXXX')"
         # Make sure we process files only once. `strip`ping the same file through different
diff --git a/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh b/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh
index ef2c02dff02e..a9b8b393c8da 100644
--- a/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh
+++ b/pkgs/build-support/setup-hooks/wrap-gapps-hook/wrap-gapps-hook.sh
@@ -14,6 +14,16 @@ gappsWrapperArgsHook() {
         gappsWrapperArgs+=(--set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE")
     fi
 
+    # Per the XDG Base Directories Specification, XDG_DATA_DIRS
+    # defaults to /usr/local/share/:/usr/share/ if unset.  To preserve
+    # the transparency of the wrapper, continue including these paths
+    # if XDG_DATA_DIRS is not set outside the wrapper.  This is
+    # important for programs to work properly on non-NixOS systems
+    # where these paths exist.
+    if [ -n "$GSETTINGS_SCHEMAS_PATH" ] || [ -d "${prefix:?}/share" ]; then
+        gappsWrapperArgs+=(--set-default XDG_DATA_DIRS /usr/local/share/:/usr/share/)
+    fi
+
     if [ -n "$GSETTINGS_SCHEMAS_PATH" ]; then
         gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH")
     fi
diff --git a/pkgs/by-name/al/alsa-plugins/package.nix b/pkgs/by-name/al/alsa-plugins/package.nix
index e86e24ba25f7..0cdecfd9b168 100644
--- a/pkgs/by-name/al/alsa-plugins/package.nix
+++ b/pkgs/by-name/al/alsa-plugins/package.nix
@@ -1,6 +1,7 @@
 {
   stdenv,
   fetchurl,
+  fetchpatch,
   lib,
   pkg-config,
   alsa-lib,
@@ -21,6 +22,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-e9ioPTBOji2GoliV2Nyw7wJFqN8y4nGVnNvcavObZvI=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "ffmpeg-9-compatibility.patch";
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/alsa-plugins/-/raw/7f250af93b76e9b3d552af509beb8ea1356114d1/ffmpeg9.patch";
+      hash = "sha256-heAl6Ym3iYI8mhuuQpwBpc0FeFYsQZRHx4UUvqiVtBo=";
+    })
+  ];
+
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [
diff --git a/pkgs/by-name/am/amf-headers/package.nix b/pkgs/by-name/am/amf-headers/package.nix
index a03ba327914d..b0744966b877 100644
--- a/pkgs/by-name/am/amf-headers/package.nix
+++ b/pkgs/by-name/am/amf-headers/package.nix
@@ -12,7 +12,8 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "GPUOpen-LibrariesAndSDKs";
     repo = "AMF";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-+jVYm/Zmt+1bzKnKTiClgoMRsyhqpuKZj79DvGHpPTM=";
+    sha256 = "sha256-ardO9GojOIQUnuSa2fGOCfFHI5PJYBsffCpNCh2dyRw=";
+    sparseCheckout = [ "amf/public/include" ];
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/as/assimp/package.nix b/pkgs/by-name/as/assimp/package.nix
index cdf66afdb6bd..b703276b365d 100644
--- a/pkgs/by-name/as/assimp/package.nix
+++ b/pkgs/by-name/as/assimp/package.nix
@@ -3,6 +3,9 @@
   stdenv,
   fetchFromGitHub,
   cmake,
+  pugixml,
+  rapidjson,
+  utf8cpp,
   zlib,
   nix-update-script,
 }:
@@ -23,6 +26,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-QWBi1pl5C76UtPhB6SmFipm9oEdnfhELMT3MqfV6oxg=";
   };
 
+  # assimp vendors many libraries that we have available in Nixpkgs, and offers no good way of pulling them from non-vendored sources.
+  # We thus patch the CMake declarations to do so.
+  # https://github.com/assimp/assimp/issues/5286
+  # also see:
+  # https://src.fedoraproject.org/rpms/assimp/blob/e0ca8c040bfd661b6d68551b6dc189ba33ffdac1/f/assimp-unbundle.patch
+  # https://salsa.debian.org/debian/assimp/-/tree/c60e93150d63590d671d9aab165cf259c71f5df9/debian/patches
+  patches = [ ./use-system-libraries.patch ];
+
   postPatch = ''
     # nix build sandbox does not set /var/tmp up:
     #   https://github.com/assimp/assimp/issues/6270
@@ -33,6 +44,9 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ cmake ];
 
   buildInputs = [
+    pugixml
+    rapidjson
+    utf8cpp
     zlib
   ];
 
diff --git a/pkgs/by-name/as/assimp/use-system-libraries.patch b/pkgs/by-name/as/assimp/use-system-libraries.patch
new file mode 100644
index 000000000000..72db82300d46
--- /dev/null
+++ b/pkgs/by-name/as/assimp/use-system-libraries.patch
@@ -0,0 +1,86 @@
+diff --git a/code/CMakeLists.txt b/code/CMakeLists.txt
+index b7b08de3b7..1c07aee928 100644
+--- a/code/CMakeLists.txt
++++ b/code/CMakeLists.txt
+@@ -1117,13 +1117,7 @@
+   hunter_add_package(pugixml)
+   find_package(pugixml CONFIG REQUIRED)
+ ELSEIF(NOT TARGET pugixml::pugixml)
+-  SET( Pugixml_SRCS
+-    ../contrib/pugixml/src/pugiconfig.hpp
+-    ../contrib/pugixml/src/pugixml.cpp
+-    ../contrib/pugixml/src/pugixml.hpp
+-  )
+-  INCLUDE_DIRECTORIES("../contrib/pugixml/src")
+-  SOURCE_GROUP( Contrib\\Pugixml FILES ${Pugixml_SRCS})
++  find_package(pugixml REQUIRED)
+ ENDIF()
+ 
+ # utf8
+@@ -1131,7 +1125,7 @@
+   hunter_add_package(utf8)
+   find_package(utf8cpp CONFIG REQUIRED)
+ ELSE()
+-  INCLUDE_DIRECTORIES("../contrib/utf8cpp/source")
++  find_package(utf8cpp REQUIRED)
+ ENDIF()
+ 
+ # polyclipping
+@@ -1287,7 +1281,8 @@
+   hunter_add_package(RapidJSON)
+   find_package(RapidJSON CONFIG REQUIRED)
+ ELSE()
+-  INCLUDE_DIRECTORIES("../contrib/rapidjson/include")
++  find_package(RapidJSON CONFIG REQUIRED)
++  include_directories(${RapidJSON_INCLUDE_DIRS})
+   ADD_DEFINITIONS( -DRAPIDJSON_HAS_STDSTRING=1)
+   option( ASSIMP_RAPIDJSON_NO_MEMBER_ITERATOR "Suppress rapidjson warning on MSVC (NOTE: breaks android build)" ON )
+   if(ASSIMP_RAPIDJSON_NO_MEMBER_ITERATOR)
+@@ -1353,7 +1348,7 @@
+   ${ASSIMP_EXPORTER_SRCS}
+ 
+   ${FBX_COMMON_SRCS}
+-  
++
+   # Third-party libraries
+   ${unzip_compile_SRCS}
+   ${Poly2Tri_SRCS}
+@@ -1497,13 +1492,11 @@
+     target_link_libraries(assimp PRIVATE ${draco_LIBRARIES})
+   endif()
+ ELSE()
+-  TARGET_LINK_LIBRARIES(assimp ${ZLIB_LIBRARIES} ${OPENDDL_PARSER_LIBRARIES})
++  TARGET_LINK_LIBRARIES(assimp PRIVATE ${ZLIB_LIBRARIES} ${OPENDDL_PARSER_LIBRARIES})
+   if (ASSIMP_BUILD_DRACO)
+     target_link_libraries(assimp ${draco_LIBRARIES})
+   endif()
+-  if(TARGET pugixml::pugixml)
+-    target_link_libraries(assimp pugixml::pugixml)
+-  endif()
++  target_link_libraries(assimp PRIVATE pugixml utf8::cpp)
+ ENDIF()
+ 
+ if(ASSIMP_ANDROID_JNIIOSYSTEM)
+@@ -1608,7 +1601,7 @@
+ 
+ # Add RT-extension library for glTF importer with Open3DGC-compression.
+ IF (RT_FOUND AND ASSIMP_IMPORTER_GLTF_USE_OPEN3DGC)
+-  TARGET_LINK_LIBRARIES(assimp rt)
++  TARGET_LINK_LIBRARIES(assimp PRIVATE rt)
+ ENDIF ()
+ 
+ IF(ASSIMP_INSTALL)
+diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt
+index 362a43be05..368b52b126 100644
+--- a/test/CMakeLists.txt
++++ b/test/CMakeLists.txt
+@@ -263,7 +263,8 @@
+   hunter_add_package(RapidJSON)
+   find_package(RapidJSON CONFIG REQUIRED)
+ ELSE()
+-  INCLUDE_DIRECTORIES("../contrib/rapidjson/include")
++  find_package(RapidJSON CONFIG REQUIRED)
++  include_directories(${RapidJSON_INCLUDE_DIRS})
+   ADD_DEFINITIONS( -DRAPIDJSON_HAS_STDSTRING=1)
+   option( ASSIMP_RAPIDJSON_NO_MEMBER_ITERATOR "Suppress rapidjson warning on MSVC (NOTE: breaks android build)" ON )
+   if(ASSIMP_RAPIDJSON_NO_MEMBER_ITERATOR)
diff --git a/pkgs/by-name/at/at-spi2-core/package.nix b/pkgs/by-name/at/at-spi2-core/package.nix
index a2e90ac00a30..6e7303d9b120 100644
--- a/pkgs/by-name/at/at-spi2-core/package.nix
+++ b/pkgs/by-name/at/at-spi2-core/package.nix
@@ -29,7 +29,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "at-spi2-core";
-  version = "2.60.4";
+  version = "2.60.6";
 
   outputs = [
     "out"
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/at-spi2-core/${lib.versions.majorMinor finalAttrs.version}/at-spi2-core-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Gh9bqYBZF/QfxqpoI9z4h6KR1gekJ+LVr7a136ZQcMc=";
+    hash = "sha256-qJtkqLIXqAQr3w41y/q2Kc7uNWQNunXfV4r96ap4nVc=";
   };
 
   nativeBuildInputs = [
@@ -79,15 +79,14 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = false;
 
   mesonFlags = [
-    # Provide dbus-daemon fallback when it is not already running when
-    # at-spi2-bus-launcher is executed. This allows us to avoid
-    # including the entire dbus closure in libraries linked with
-    # the at-spi2-core libraries.
-    "-Ddbus_daemon=/run/current-system/sw/bin/dbus-daemon"
+    # Allows at-spi2-bus-launcher to use dbus-daemon from PATH.
+    # This allows us to avoid including the entire dbus closure in libraries
+    # linked with the at-spi2-core libraries.
+    "-Ddbus_daemon=dbus-daemon"
   ]
   ++ lib.optionals systemdSupport [
     # Same as the above, but for dbus-broker
-    "-Ddbus_broker=/run/current-system/sw/bin/dbus-broker-launch"
+    "-Ddbus_broker=dbus-broker-launch"
   ]
   ++ lib.optionals (!systemdSupport) [
     "-Duse_systemd=false"
@@ -108,10 +107,17 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   postFixup = ''
-    # Cannot use wrapGAppsHook'due to a dependency cycle
-    wrapProgram $out/libexec/at-spi-bus-launcher \
-      ${lib.optionalString withDconf ''--prefix GIO_EXTRA_MODULES : "${lib.getLib dconf}/lib/gio/modules"''} \
+    busLauncherWrapperArgs=(
+      # Prefer dbus-daemon and dbus-broker-launch from system locations.
+      --prefix PATH : "/run/current-system/sw/bin:/usr/bin"
+
+      # Access to accessibility settings.
+      ${lib.optionalString withDconf ''--prefix GIO_EXTRA_MODULES : "${lib.getLib dconf}/lib/gio/modules"''}
       --prefix XDG_DATA_DIRS : ${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}
+    )
+
+    # Cannot use wrapGAppsHook'due to a dependency cycle
+    wrapProgram "$out/libexec/at-spi-bus-launcher" "''${busLauncherWrapperArgs[@]}"
   '';
 
   meta = {
diff --git a/pkgs/by-name/au/audit/package.nix b/pkgs/by-name/au/audit/package.nix
index 657e74647d6f..722eb7039611 100644
--- a/pkgs/by-name/au/audit/package.nix
+++ b/pkgs/by-name/au/audit/package.nix
@@ -30,13 +30,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "audit";
-  version = "4.2";
+  version = "4.2.1";
 
   src = fetchFromGitHub {
     owner = "linux-audit";
     repo = "audit-userspace";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-poldhsF+ccutCxK7KE/gYpxa1x3wUQJWoCwU6pGFj6A=";
+    hash = "sha256-W8VyeOYQGPAvvmQUe3F22u5ldWwIuxrVJ/sXyu0Qrl4=";
   };
 
   postPatch = ''
@@ -153,7 +153,7 @@ stdenv.mkDerivation (finalAttrs: {
       musl = pkgsMusl.audit or null;
       static = pkgsStatic.audit or null;
       pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      inherit (nixosTests) audit audit-testsuite;
+      inherit (nixosTests) audit audit-testsuite utmp;
       # Broken on a hardened kernel
       package = finalAttrs.finalPackage.overrideAttrs (previousAttrs: {
         pname = previousAttrs.pname + "-test";
diff --git a/pkgs/by-name/bc/bcachefs-tools/package.nix b/pkgs/by-name/bc/bcachefs-tools/package.nix
index 0c7bd211bd33..79f2831f6f52 100644
--- a/pkgs/by-name/bc/bcachefs-tools/package.nix
+++ b/pkgs/by-name/bc/bcachefs-tools/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   pkg-config,
   libuuid,
   libsodium,
@@ -32,29 +31,20 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bcachefs-tools";
-  version = "1.38.8";
+  version = "1.39.1";
 
   src = fetchFromGitHub {
     owner = "koverstreet";
     repo = "bcachefs-tools";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9sDE7ua3WMCfV9ZbwQdAbpatv2IhvcwHzzPr+/l2au0=";
+    hash = "sha256-KJBzVbK5DL+ZK27Oyyn8vCWRQUHrIAelrex1oX+fWq4=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
-    hash = "sha256-F1+FeAlYSqOxeWJI8vHShpXrOZqYXjNGvty/s6f6u8w=";
+    hash = "sha256-Yb2DaFLuhAkwYED+s9SRKsjxluWoES4RSvKPKfd/kyE=";
   };
 
-  patches = [
-    # Fix compile-time assertion failure on big-endian
-    (fetchpatch {
-      name = "0001-bcachefs-tools-debug-copy-packed-bkey-fields-before-asserting.patch";
-      url = "https://evilpiepirate.org/git/bcachefs-tools.git/patch/?id=79f119c4cd6900ab9ea27b0aa671f68300d9d38e";
-      hash = "sha256-ACrpad93wrZOXhc73otnXBNQvyoDeZSfgtwze5nKaUE=";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace Makefile \
       --replace-fail "target/release/bcachefs" "target/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/bcachefs"
@@ -113,6 +103,12 @@ stdenv.mkDerivation (finalAttrs: {
     "CARGO_TARGET_${stdenv.hostPlatform.rust.cargoEnvVarTarget}_LINKER" = "${stdenv.cc.targetPrefix}cc";
   };
 
+  # Workaround for RISCV cross-compilation issue
+  # https://github.com/koverstreet/bcachefs-tools/issues/850
+  preBuild = lib.optionalString stdenv.hostPlatform.isRiscV ''
+    export BINDGEN_EXTRA_CLANG_ARGS="$BINDGEN_EXTRA_CLANG_ARGS --target=riscv64-unknown-linux-gnu -march=rv64gc"
+  '';
+
   # FIXME: Try enabling this once the default linux kernel is at least 6.7
   doCheck = false; # needs bcachefs module loaded on builder
 
@@ -163,6 +159,5 @@ stdenv.mkDerivation (finalAttrs: {
     ];
     platforms = lib.platforms.linux;
     mainProgram = "bcachefs";
-    broken = stdenv.hostPlatform.isi686; # error: stack smashing detected
   };
 })
diff --git a/pkgs/by-name/bl/bluez-headers/package.nix b/pkgs/by-name/bl/bluez-headers/package.nix
index f7fe5582a8e6..cdf05a44b4c5 100644
--- a/pkgs/by-name/bl/bluez-headers/package.nix
+++ b/pkgs/by-name/bl/bluez-headers/package.nix
@@ -11,14 +11,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bluez-headers";
-  version = "5.86";
+  version = "5.87";
 
   # This package has the source, because of the emulatorAvailable check in the
   # bluez function args, that causes an infinite recursion with Python on cross
   # builds.
   src = fetchurl {
     url = "mirror://kernel/linux/bluetooth/bluez-${finalAttrs.version}.tar.xz";
-    hash = "sha256-mfFEVAxgcFkeTFO8uXfrQmZMYrezbLNaKc9y3tM5Yh0=";
+    hash = "sha256-Jr3PLOvXMQxvWYhQYGsDfvDFFf5mCOvFTSLFDEwys18=";
   };
 
   dontConfigure = true;
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = {
-    homepage = "https://www.bluez.org/";
+    homepage = "https://bluez.github.io/";
     description = "Official Linux Bluetooth protocol stack";
     changelog = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/tree/ChangeLog?h=${finalAttrs.version}";
     license = with lib.licenses; [
diff --git a/pkgs/by-name/bl/bluez/lreadline.patch b/pkgs/by-name/bl/bluez/lreadline.patch
index 3e3b6a1818bc..43f000e3f3d8 100644
--- a/pkgs/by-name/bl/bluez/lreadline.patch
+++ b/pkgs/by-name/bl/bluez/lreadline.patch
@@ -1,10 +1,9 @@
-# Adjusted version of https://lore.kernel.org/linux-bluetooth/20250703182908.2370130-1-hi@alyssa.is/raw
 diff --git a/Makefile.tools b/Makefile.tools
-index 2080f0978..885371de9 100644
+index 1a4e56608..a8bff6df3 100644
 --- a/Makefile.tools
 +++ b/Makefile.tools
-@@ -19,7 +19,7 @@ client_bluetoothctl_SOURCES = client/main.c \
- 					client/telephony.h client/telephony.c
+@@ -20,7 +20,7 @@ client_bluetoothctl_SOURCES = client/main.c \
+ 					client/cs.h client/cs.c
  client_bluetoothctl_LDADD = lib/libbluetooth-internal.la \
  			gdbus/libgdbus-internal.la src/libshared-glib.la \
 -			$(GLIB_LIBS) $(DBUS_LIBS) -lreadline
@@ -12,16 +11,16 @@ index 2080f0978..885371de9 100644
  endif
  
  if ZSH_COMPLETIONS
-@@ -385,7 +385,7 @@ tools_meshctl_SOURCES = tools/meshctl.c \
+@@ -389,7 +389,7 @@ tools_meshctl_SOURCES = tools/meshctl.c \
  				tools/mesh-gatt/onoff-model.c
  tools_meshctl_LDADD = gdbus/libgdbus-internal.la src/libshared-glib.la \
  				lib/libbluetooth-internal.la \
 -				$(GLIB_LIBS) $(DBUS_LIBS) -ljson-c -lreadline
 +				$(GLIB_LIBS) $(DBUS_LIBS) -ljson-c $(READLINE_LIBS)
- 
- EXTRA_DIST += tools/mesh-gatt/local_node.json tools/mesh-gatt/prov_db.json
  endif
-@@ -404,7 +404,7 @@ tools_mesh_cfgclient_SOURCES = tools/mesh-cfgclient.c \
+ 
+ bin_PROGRAMS +=  tools/mesh-cfgclient
+@@ -406,7 +406,7 @@ tools_mesh_cfgclient_SOURCES = tools/mesh-cfgclient.c \
  				mesh/crypto.h mesh/crypto.c
  
  tools_mesh_cfgclient_LDADD = lib/libbluetooth-internal.la src/libshared-ell.la \
@@ -30,7 +29,7 @@ index 2080f0978..885371de9 100644
  
  bin_PROGRAMS +=  tools/mesh-cfgtest
  
-@@ -512,7 +512,7 @@ noinst_PROGRAMS += tools/btmgmt tools/obex-client-tool tools/obex-server-tool \
+@@ -489,7 +489,7 @@ noinst_PROGRAMS += tools/btmgmt tools/obex-client-tool tools/obex-server-tool \
  tools_obex_client_tool_SOURCES = $(gobex_sources) $(btio_sources) \
  						tools/obex-client-tool.c
  tools_obex_client_tool_LDADD = lib/libbluetooth-internal.la \
@@ -39,7 +38,7 @@ index 2080f0978..885371de9 100644
  
  tools_obex_server_tool_SOURCES = $(gobex_sources) $(btio_sources) \
  						tools/obex-server-tool.c
-@@ -523,16 +523,16 @@ tools_bluetooth_player_SOURCES = tools/bluetooth-player.c client/print.c \
+@@ -500,16 +500,16 @@ tools_bluetooth_player_SOURCES = tools/bluetooth-player.c client/print.c \
  				client/player.c
  tools_bluetooth_player_LDADD = gdbus/libgdbus-internal.la \
  				src/libshared-glib.la \
@@ -59,7 +58,7 @@ index 2080f0978..885371de9 100644
  if DEPRECATED
  noinst_PROGRAMS += attrib/gatttool
  
-@@ -542,7 +542,7 @@ attrib_gatttool_SOURCES = attrib/gatttool.c attrib/att.c attrib/gatt.c \
+@@ -519,7 +519,7 @@ attrib_gatttool_SOURCES = attrib/gatttool.c attrib/att.c attrib/gatt.c \
  				attrib/utils.c src/log.c client/display.c \
  				client/display.h
  attrib_gatttool_LDADD = lib/libbluetooth-internal.la \
@@ -68,18 +67,18 @@ index 2080f0978..885371de9 100644
  
  endif
  endif
-@@ -592,5 +592,5 @@ tools/btpclient.$(OBJEXT): src/libshared-ell.la ell/internal
+@@ -575,5 +575,5 @@ client/btpclient/btpclient.$(OBJEXT): src/libshared-ell.la ell/internal
  
- tools_btpclientctl_SOURCES = tools/btpclientctl.c client/display.c
- tools_btpclientctl_LDADD = src/libshared-mainloop.la src/libshared-glib.la \
+ client_btpclient_btpclientctl_SOURCES = client/btpclient/btpclientctl.c client/display.c
+ client_btpclient_btpclientctl_LDADD = src/libshared-mainloop.la src/libshared-glib.la \
 -				lib/libbluetooth-internal.la -lreadline
 +				lib/libbluetooth-internal.la $(READLINE_LIBS)
  endif
 diff --git a/configure.ac b/configure.ac
-index 52de7d665..f110ab103 100644
+index b011e9b0a..10f1af4af 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -338,8 +338,7 @@ AC_ARG_ENABLE(client, AS_HELP_STRING([--disable-client],
+@@ -340,8 +340,7 @@ AC_ARG_ENABLE(client, AS_HELP_STRING([--disable-client],
  AM_CONDITIONAL(CLIENT, test "${enable_client}" != "no")
  
  if (test "${enable_client}" != "no" || test "${enable_mesh}" = "yes"); then
diff --git a/pkgs/by-name/bl/bluez/package.nix b/pkgs/by-name/bl/bluez/package.nix
index 81ec00b045ca..e18ccdd4bdcc 100644
--- a/pkgs/by-name/bl/bluez/package.nix
+++ b/pkgs/by-name/bl/bluez/package.nix
@@ -32,23 +32,6 @@ stdenv.mkDerivation (finalAttrs: {
   inherit (bluez-headers) version src;
 
   patches = [
-    # https://github.com/bluez/bluez/issues/1896
-    # Remove the following 2 in the next release
-    (fetchpatch2 {
-      name = "fix-btctl-noninteractive-regression";
-      url = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/patch/?id=b33e923b55e4d0e9d78a83cfcb541fd1f687ef54";
-      hash = "sha256-q7eN4ktw7DtdwMHHi7GU7fbvHAdMttKF1kDSWzZqa6A=";
-    })
-    (fetchpatch2 {
-      name = "fix-btctl-noninteractive-regression-2";
-      url = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/patch/?id=21e13976f2e375d701b8b7032ba5c1b2e56c305f";
-      hash = "sha256-JrdmYiC+U0KeMP8oVg12Z8CvkMEKWBVgiiUACx0E7dY=";
-    })
-    (fetchpatch2 {
-      name = "support-libical-4.0.patch";
-      url = "https://git.kernel.org/pub/scm/bluetooth/bluez.git/patch/?id=e60d07255327db3fc4e3a28d7fcc792cd42c34d0";
-      hash = "sha256-1uw+5nTjh+t1/L++fRNIlQWblwDwTJifH0EvAn3dym8=";
-    })
     ./lreadline.patch
   ];
 
diff --git a/pkgs/tools/misc/coreutils/CVE-2026-56391.patch b/pkgs/by-name/co/coreutils/CVE-2026-56391.patch
similarity index 100%
rename from pkgs/tools/misc/coreutils/CVE-2026-56391.patch
rename to pkgs/by-name/co/coreutils/CVE-2026-56391.patch
diff --git a/pkgs/tools/misc/coreutils/CVE-2026-56392.patch b/pkgs/by-name/co/coreutils/CVE-2026-56392.patch
similarity index 100%
rename from pkgs/tools/misc/coreutils/CVE-2026-56392.patch
rename to pkgs/by-name/co/coreutils/CVE-2026-56392.patch
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/by-name/co/coreutils/package.nix
similarity index 100%
rename from pkgs/tools/misc/coreutils/default.nix
rename to pkgs/by-name/co/coreutils/package.nix
diff --git a/pkgs/by-name/db/dbus/package.nix b/pkgs/by-name/db/dbus/package.nix
index 264f6d944497..2e1f36b7831e 100644
--- a/pkgs/by-name/db/dbus/package.nix
+++ b/pkgs/by-name/db/dbus/package.nix
@@ -127,6 +127,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonEnable "launchd" stdenv.hostPlatform.isDarwin)
     (lib.mesonEnable "systemd" enableSystemd)
     "-Dselinux=disabled"
+    "-Dc_args=-Wno-error=incompatible-pointer-types"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # D-Bus defaults to launchd-activation on Darwin, but that requires the launch agent be installed. It also breaks
diff --git a/pkgs/by-name/du/duckdb/versions.json b/pkgs/by-name/du/duckdb/versions.json
index 0f1ac213431c..09a078b65907 100644
--- a/pkgs/by-name/du/duckdb/versions.json
+++ b/pkgs/by-name/du/duckdb/versions.json
@@ -1,6 +1,6 @@
 {
-  "version": "1.5.4",
-  "rev": "08e34c447bae34eaee3723cac61f2878b6bdf787",
-  "hash": "sha256-6xpKZKfH5/nwE2nU5kcpgITKFm3ilb1PYf9QEk+bKoM=",
-  "python_hash": "sha256-2TgMuaeAehJ5rvpfA57KTmHtTZnvfa/nl/Y9ASCwVs0="
+  "version": "1.5.5",
+  "rev": "d8cdaa33fda8df955cc76ef58a280f68f4cd43fa",
+  "hash": "sha256-vFXrMcWF5KDYYRjWZb6iJdhGnCAb6SMlSgzlcr+FQ8Y=",
+  "python_hash": "sha256-O4tYdPz6H2By7WXT9GzfyBGNeJruCkzSmTYIbiEq2dQ="
 }
diff --git a/pkgs/by-name/ed/eden/package.nix b/pkgs/by-name/ed/eden/package.nix
index 6335c7d44f28..74c0c2b0e608 100644
--- a/pkgs/by-name/ed/eden/package.nix
+++ b/pkgs/by-name/ed/eden/package.nix
@@ -13,7 +13,8 @@
   fetchFromGitHub,
   fetchurl,
   ffmpeg-headless,
-  fmt,
+  # FIXME: unpin when upstream supports fmt 12
+  fmt_11,
   frozen-containers,
   gamemode,
   glslang,
@@ -102,7 +103,7 @@ stdenv.mkDerivation (finalAttrs: {
     cubeb
     enet
     ffmpeg-headless
-    fmt
+    fmt_11
     frozen-containers
     gamemode
     httplib'
diff --git a/pkgs/by-name/fo/fontforge/package.nix b/pkgs/by-name/fo/fontforge/package.nix
index 4cdcfacbb326..8197a82a0c25 100644
--- a/pkgs/by-name/fo/fontforge/package.nix
+++ b/pkgs/by-name/fo/fontforge/package.nix
@@ -82,7 +82,12 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   # do not use x87's 80-bit arithmetic, rounding errors result in very different font binaries
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isi686 "-msse2 -mfpmath=sse";
+  env.NIX_CFLAGS_COMPILE = lib.join " " (
+    [
+      "-Wno-error=incompatible-pointer-types"
+    ]
+    ++ lib.optional stdenv.hostPlatform.isi686 "-msse2 -mfpmath=sse"
+  );
 
   strictDeps = true;
 
diff --git a/pkgs/by-name/gb/gbenchmark/package.nix b/pkgs/by-name/gb/gbenchmark/package.nix
index a35f4781dba1..fffc36fdfbbf 100644
--- a/pkgs/by-name/gb/gbenchmark/package.nix
+++ b/pkgs/by-name/gb/gbenchmark/package.nix
@@ -52,7 +52,10 @@ stdenv.mkDerivation (finalAttrs: {
     #
     # This might be a problem with our Clang, as it does not reproduce
     # with Xcode, but we just work around it by silencing the warning.
-    NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-c++17-attribute-extensions";
+    NIX_CFLAGS_COMPILE = lib.join " " (
+      lib.optional stdenv.cc.isClang "-Wno-error=c2y-extensions"
+      ++ lib.optional stdenv.cc.isClang "-Wno-c++17-attribute-extensions"
+    );
   }
   // lib.optionalAttrs stdenv.hostPlatform.isGnu {
     # For test:locale_impermeability_test
diff --git a/pkgs/by-name/gd/gdk-pixbuf/package.nix b/pkgs/by-name/gd/gdk-pixbuf/package.nix
index 0a1e32428806..a55bfa0909c6 100644
--- a/pkgs/by-name/gd/gdk-pixbuf/package.nix
+++ b/pkgs/by-name/gd/gdk-pixbuf/package.nix
@@ -1,7 +1,6 @@
 {
   stdenv,
   fetchurl,
-  fetchpatch,
   nixosTests,
   fixDarwinDylibNames,
   meson,
@@ -29,7 +28,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gdk-pixbuf";
-  version = "2.44.6";
+  version = "2.44.7";
 
   outputs = [
     "out"
@@ -41,19 +40,12 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gdk-pixbuf/${lib.versions.majorMinor finalAttrs.version}/gdk-pixbuf-${finalAttrs.version}.tar.xz";
-    hash = "sha256-FAwtC4mfz4U+6SsmNzydwijbzeCCCkJGaT9DKKJ0Zvo=";
+    hash = "sha256-Fy+A42JuwxUgqXBADxo2lOBHGPbCzSiF91JQ+1pplaQ=";
   };
 
   patches = [
     # Move installed tests to a separate output
     ./installed-tests-path.patch
-
-    # Fix loading of xpm module if built-in
-    # https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/merge_requests/267
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gdk-pixbuf/-/commit/62b8f9fd0bb3b862823cd34afce4b389fbd27569.patch";
-      hash = "sha256-ECEIt8lq/jBtDdBetErKpap2PWGav10vqCXKCpIQSyA=";
-    })
   ];
 
   # gdk-pixbuf-thumbnailer is not wrapped therefore strictDeps will work
diff --git a/pkgs/by-name/gj/gjs/package.nix b/pkgs/by-name/gj/gjs/package.nix
index 30b62ac129a9..08cfe8bd2db4 100644
--- a/pkgs/by-name/gj/gjs/package.nix
+++ b/pkgs/by-name/gj/gjs/package.nix
@@ -41,7 +41,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gjs";
-  version = "1.88.0";
+  version = "1.88.1";
 
   outputs = [
     "out"
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gjs/${lib.versions.majorMinor finalAttrs.version}/gjs-${finalAttrs.version}.tar.xz";
-    hash = "sha256-MKC58zF+jmCxiW2ykDxw6LDNM9+VPDKHVYA6dRkdxFM=";
+    hash = "sha256-dnurgOZl1nLLAFY8JfCzkqnsjCmW7R1EVMaYtMLwo9k=";
   };
 
   patches = [
diff --git a/pkgs/by-name/gl/glib/package.nix b/pkgs/by-name/gl/glib/package.nix
index dc943d5d04a2..d504331900ce 100644
--- a/pkgs/by-name/gl/glib/package.nix
+++ b/pkgs/by-name/gl/glib/package.nix
@@ -82,7 +82,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glib";
-  version = "2.88.1";
+  version = "2.88.3";
 
   outputs = [
     "bin"
@@ -95,7 +95,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/glib/${lib.versions.majorMinor finalAttrs.version}/glib-${finalAttrs.version}.tar.xz";
-    hash = "sha256-UauATFb26rPlBFx3TRKQrF5Mkj1Pmj2OMxI77kXBhA4=";
+    hash = "sha256-qyTSTmmN+h5Ai3vNtQj0qvyQYYWouM5y/febu9ybODs=";
   };
 
   patches =
diff --git a/pkgs/by-name/gl/glslang/package.nix b/pkgs/by-name/gl/glslang/package.nix
index c8b19772c622..9e731fb4f47b 100644
--- a/pkgs/by-name/gl/glslang/package.nix
+++ b/pkgs/by-name/gl/glslang/package.nix
@@ -12,13 +12,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "glslang";
-  version = "16.3.0";
+  version = "16.4.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "glslang";
     tag = finalAttrs.version;
-    hash = "sha256-wclcJ0NfqFXSUHGVsxjn2I8XxWbrkzOB4WXqsN1XtmE=";
+    hash = "sha256-nPXwBROAj/zYccM5Lydwws13e/nW96gm+f4218sQhE8=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/gn/gn/package.nix b/pkgs/by-name/gn/gn/package.nix
index 3488f91204fd..cd823096d79a 100644
--- a/pkgs/by-name/gn/gn/package.nix
+++ b/pkgs/by-name/gn/gn/package.nix
@@ -36,6 +36,9 @@ stdenv.mkDerivation {
     '';
   };
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   nativeBuildInputs = [
     ninja
     python3
diff --git a/pkgs/by-name/gr/graphify/package.nix b/pkgs/by-name/gr/graphify/package.nix
index 8c06ea6fd493..4b6a64684572 100644
--- a/pkgs/by-name/gr/graphify/package.nix
+++ b/pkgs/by-name/gr/graphify/package.nix
@@ -8,34 +8,49 @@
 python3Packages.buildPythonApplication rec {
   __structuredAttrs = true;
   pname = "graphify";
-  version = "0.4.23";
+  version = "0.9.28";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Graphify-Labs";
     repo = "graphify";
     tag = "v${version}";
-    hash = "sha256-QEzB1tFBqGhpmI7oudMRC1Ia0CDcm+GYt6AgxMA5zDo=";
+    hash = "sha256-iu/ARF1ylyrDUWke70kLpji4azfIeBSDSQ6uS+CKYiw=";
   };
 
   build-system = [
     python3.pkgs.setuptools
   ];
 
+  # The bindings in python3Packages.tree-sitter-grammars track the grammar
+  # repos, whose versions drift from the pins upstream declares.
+  pythonRelaxDeps = [
+    "tree-sitter-fortran"
+    "tree-sitter-groovy"
+    "tree-sitter-julia"
+    "tree-sitter-kotlin"
+  ];
+
   dependencies =
     with python3.pkgs;
     [
       networkx
+      numpy
+      rapidfuzz
       tree-sitter
     ]
     ++ (with python3.pkgs.tree-sitter-grammars; [
+      tree-sitter-bash
       tree-sitter-c
       tree-sitter-c-sharp
       tree-sitter-cpp
       tree-sitter-elixir
+      tree-sitter-fortran
       tree-sitter-go
+      tree-sitter-groovy
       tree-sitter-java
       tree-sitter-javascript
+      tree-sitter-json
       tree-sitter-julia
       tree-sitter-kotlin
       tree-sitter-lua
@@ -53,11 +68,21 @@ python3Packages.buildPythonApplication rec {
     ]);
 
   optional-dependencies = with python3.pkgs; {
+    anthropic = [
+      anthropic
+    ];
+    bedrock = [
+      boto3
+    ];
+    chinese = [
+      jieba
+    ];
     leiden = [
       graspologic
     ];
     mcp = [
       mcp
+      starlette
     ];
     neo4j = [
       neo4j
@@ -66,10 +91,17 @@ python3Packages.buildPythonApplication rec {
       openpyxl
       python-docx
     ];
+    openai = [
+      openai
+      tiktoken
+    ];
     pdf = [
-      html2text
+      markdownify
       pypdf
     ];
+    postgres = [
+      psycopg
+    ];
     svg = [
       matplotlib
     ];
@@ -82,11 +114,24 @@ python3Packages.buildPythonApplication rec {
     ];
   };
 
+  pythonImportsCheck = [ "graphify" ];
+
+  # The attribute and the command are `graphify`, but upstream publishes the
+  # distribution as `graphifyy`. pythonMetadataCheckPhase resolves the
+  # distribution by `pname`, so it cannot find it:
+  #   nix-build -E 'with import ./. {};
+  #     python3.withPackages (_: [ (python3.pkgs.toPythonModule graphify) ])'
+  #   => PackageNotFoundError: No package metadata was found for graphify
+  dontCheckPythonMetadata = true;
+
   meta = {
     description = "AI coding assistant skill. Turn any folder of code, docs, papers, images, or videos into a queryable knowledge graph.";
     homepage = "https://github.com/Graphify-Labs/graphify";
-    changelog = "https://github.com/Graphify-Labs/graphify/blob/${src.rev}/CHANGELOG.md";
-    license = lib.licenses.mit;
+    changelog = "https://github.com/Graphify-Labs/graphify/blob/${src.tag}/CHANGELOG.md";
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
     maintainers = with lib.maintainers; [ stunkymonkey ];
     mainProgram = "graphify";
   };
diff --git a/pkgs/by-name/gr/grpc/package.nix b/pkgs/by-name/gr/grpc/package.nix
index 7688baf9284e..105e69cc23ee 100644
--- a/pkgs/by-name/gr/grpc/package.nix
+++ b/pkgs/by-name/gr/grpc/package.nix
@@ -25,7 +25,7 @@
 # nixpkgs-update: no auto update
 stdenv.mkDerivation (finalAttrs: {
   pname = "grpc";
-  version = "1.82.1"; # N.B: if you change this, please update:
+  version = "1.83.0"; # N.B: if you change this, please update:
   # pythonPackages.grpcio
   # pythonPackages.grpcio-channelz
   # pythonPackages.grpcio-health-checking
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "grpc";
     repo = "grpc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-w4tl1y1GITlfeHTsSAZm45d8HQVzqSBVEQXoEqO0h5g=";
+    hash = "sha256-A2QtLdsunMOulbpyaSOoAID9caK0tpuiyZJ5C5zrr+k=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/gs/gssdp_1_6/package.nix b/pkgs/by-name/gs/gssdp_1_6/package.nix
index 47c18a41e48b..13627a19cfe7 100644
--- a/pkgs/by-name/gs/gssdp_1_6/package.nix
+++ b/pkgs/by-name/gs/gssdp_1_6/package.nix
@@ -13,6 +13,10 @@
   glib,
   gnome,
   gssdp-tools,
+  withIntrospection ?
+    lib.meta.availableOn stdenv.hostPlatform gobject-introspection
+    && stdenv.hostPlatform.emulatorAvailable buildPackages,
+  buildPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -22,6 +26,8 @@ stdenv.mkDerivation (finalAttrs: {
   outputs = [
     "out"
     "dev"
+  ]
+  ++ lib.optionals withIntrospection [
     "devdoc"
   ];
 
@@ -38,10 +44,12 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
     pkg-config
+    glib
+  ]
+  ++ lib.optionals withIntrospection [
     gobject-introspection
     vala
     gi-docgen
-    python3
   ];
 
   buildInputs = [
@@ -53,16 +61,17 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   mesonFlags = [
-    "-Dgtk_doc=true"
     "-Dsniffer=false"
     # This packages only has manpages for gssdp-device-sniffer, which we disabled above.
     "-Dmanpages=false"
+    (lib.mesonBool "gtk_doc" withIntrospection)
+    (lib.mesonBool "introspection" withIntrospection)
   ];
 
   # On Darwin: Failed to bind socket, Operation not permitted
   doCheck = !stdenv.hostPlatform.isDarwin;
 
-  postFixup = ''
+  postFixup = lib.optionalString withIntrospection ''
     # Move developer documentation to devdoc output.
     # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
     find -L "$out/share/doc" -type f -regex '.*\.devhelp2?' -print0 \
diff --git a/pkgs/by-name/hw/hwdata/package.nix b/pkgs/by-name/hw/hwdata/package.nix
index e88507d495f7..35e01d9db4ed 100644
--- a/pkgs/by-name/hw/hwdata/package.nix
+++ b/pkgs/by-name/hw/hwdata/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hwdata";
-  version = "0.409";
+  version = "0.410";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-WJ7oe94rTb+gzuawafpx7YyNTUzZe7ZWE0ZWWQKoyCA=";
+    hash = "sha256-9yw0z1fTcUjb2oWSFj91wY3W8GgPDqnqFMTpoR36mak=";
   };
 
   doCheck = false; # this does build machine-specific checks (e.g. enumerates PCI bus)
diff --git a/pkgs/by-name/im/imagemagick/package.nix b/pkgs/by-name/im/imagemagick/package.nix
index 17d4c51f32f2..559182767ad6 100644
--- a/pkgs/by-name/im/imagemagick/package.nix
+++ b/pkgs/by-name/im/imagemagick/package.nix
@@ -157,7 +157,7 @@ stdenv.mkDerivation (finalAttrs: {
     moveToOutput "bin/*-config" "$dev"
     moveToOutput "lib/ImageMagick-*/config-Q16HDRI" "$dev" # includes configure params
     configDestination=($out/share/ImageMagick-*)
-    grep -v '/nix/store' $dev/lib/ImageMagick-*/config-Q16HDRI/configure.xml > $configDestination/configure.xml
+    grep -v "$NIX_STORE" $dev/lib/ImageMagick-*/config-Q16HDRI/configure.xml > $configDestination/configure.xml
     for file in "$dev"/bin/*-config; do
       substituteInPlace "$file" --replace-fail "$PKG_CONFIG" \
         "PKG_CONFIG_PATH='$dev/lib/pkgconfig' '$(command -v $PKG_CONFIG)'"
diff --git a/pkgs/by-name/le/lerc/package.nix b/pkgs/by-name/le/lerc/package.nix
index 7765b5e8b9a6..bb308c0ea2b8 100644
--- a/pkgs/by-name/le/lerc/package.nix
+++ b/pkgs/by-name/le/lerc/package.nix
@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lerc";
-  version = "4.1.1";
+  version = "4.2.0";
 
   outputs = [
     "out"
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "esri";
     repo = "lerc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YTNIydQLCBzsuvPWA6qnOkOIPf9JlByJdNHkTevE7Z0=";
+    hash = "sha256-ysD+0B5yMOdNOKe9MS2T8o0KgqygdxLYiLMr8XeG4JE=";
   };
 
   # Required to get the freebsd-ports patch to apply.
diff --git a/pkgs/by-name/li/libadwaita/package.nix b/pkgs/by-name/li/libadwaita/package.nix
index fdad6431655b..c158da4ee9af 100644
--- a/pkgs/by-name/li/libadwaita/package.nix
+++ b/pkgs/by-name/li/libadwaita/package.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libadwaita";
-  version = "1.9.2";
+  version = "1.9.3";
 
   outputs = [
     "out"
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "GNOME";
     repo = "libadwaita";
     tag = finalAttrs.version;
-    hash = "sha256-XKKjnZz4CII6w9fKFptPK3aTNa5eMfyE7rcerbgaDco=";
+    hash = "sha256-1V3L10YgRnOoJud/lybfSj2AYOY0kRAJdfamJg+S1fo=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/by-name/li/libmodplug/package.nix b/pkgs/by-name/li/libmodplug/package.nix
index f8ee283758bc..5c7a2279dc99 100644
--- a/pkgs/by-name/li/libmodplug/package.nix
+++ b/pkgs/by-name/li/libmodplug/package.nix
@@ -14,10 +14,15 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "1pnri98a603xk47smnxr551svbmgbzcw018mq1k6srbrq6kaaz25";
   };
 
-  # Unfortunately, upstream appears inactive and the patches from the fork don’t apply cleanly.
-  # Modify `src/fastmix.cpp` to remove usage of the register storage class, which is
-  # not allowed in C++17 and is an error in clang 16.
-  prePatch = "substituteInPlace src/fastmix.cpp --replace 'register ' ''";
+  postPatch = ''
+    # Unfortunately, upstream appears inactive and the patches from the fork don’t apply cleanly.
+    # Modify `src/fastmix.cpp` to remove usage of the register storage class, which is
+    # not allowed in C++17 and is an error in clang 16.
+    substituteInPlace src/fastmix.cpp --replace-fail 'register ' ""
+
+    substituteInPlace libmodplug.pc.in \
+      --replace-fail 'includedir=''${prefix}/include' 'includedir=@includedir@'
+  '';
 
   outputs = [
     "out"
diff --git a/pkgs/by-name/li/libmpack/package.nix b/pkgs/by-name/li/libmpack/package.nix
index 3e50880ecde5..ca0a865dd807 100644
--- a/pkgs/by-name/li/libmpack/package.nix
+++ b/pkgs/by-name/li/libmpack/package.nix
@@ -15,6 +15,10 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "0rai5djdkjz7bsn025k5489in7r1amagw1pib0z4qns6b52kiar2";
   };
 
+  preBuild = lib.optionalString stdenv.hostPlatform.isStatic ''
+    mkdir -p build/release/src build/release/test/deps/tap
+  '';
+
   makeFlags = [
     "LIBTOOL=${libtool}/bin/libtool"
     "PREFIX=$(out)"
diff --git a/pkgs/by-name/li/libraqm/package.nix b/pkgs/by-name/li/libraqm/package.nix
index 3010acb5cde6..e2236249055e 100644
--- a/pkgs/by-name/li/libraqm/package.nix
+++ b/pkgs/by-name/li/libraqm/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libraqm";
-  version = "0.10.5";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "HOST-Oman";
     repo = "libraqm";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-6STgs9//BQRu1TTxf+L6+Jj0Z7rkaBFodXzQVRyybE4=";
+    sha256 = "sha256-3wE2Xr07kFMDw5j6cWwv1cutL2bg7Ia7CdkAx4ysa5A=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/li/libssh/package.nix b/pkgs/by-name/li/libssh/package.nix
index b8a4ef7a8f92..c98fe05e6f7c 100644
--- a/pkgs/by-name/li/libssh/package.nix
+++ b/pkgs/by-name/li/libssh/package.nix
@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libssh";
-  version = "0.12.1";
+  version = "0.12.2";
 
   src = fetchurl {
     url = "https://www.libssh.org/files/${lib.versions.majorMinor finalAttrs.version}/libssh-${finalAttrs.version}.tar.xz";
-    hash = "sha256-05Qa8KLXjV2C7Xo2mI6RM5lDEvA1uWWabkP42zloeEw=";
+    hash = "sha256-SVYPZ32W43BqkErC3hEW4l82gJN9UeXJIZj8ukocHp8=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/li/libssh2/package.nix b/pkgs/by-name/li/libssh2/package.nix
index 4237f6d421fa..b7c88dfc5eb7 100644
--- a/pkgs/by-name/li/libssh2/package.nix
+++ b/pkgs/by-name/li/libssh2/package.nix
@@ -27,18 +27,21 @@ stdenv.mkDerivation (finalAttrs: {
     # https://github.com/libssh2/libssh2/commit/256d04b60d80bf1190e96b0ad1e91b2174d744b1
     ./CVE-2026-7598.patch
 
+    # backport of https://github.com/libssh2/libssh2/commit/2dae3024897e1898d389835151f4e9606227721d
     (fetchurl {
       name = "CVE-2025-15661.patch";
       url = "https://salsa.debian.org/debian/libssh2/-/raw/1d4906e6ebe85a9da2931ba33677ead96a61f07f/debian/patches/CVE-2025-15661.patch";
       hash = "sha256-Rz6i/881CbObUDcZbcPlgVPaKizSp6ZRTdmJNJ9HLHE=";
     })
 
+    # backport of https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4
     (fetchurl {
       name = "CVE-2026-55199.patch";
       url = "https://salsa.debian.org/debian/libssh2/-/raw/1d4906e6ebe85a9da2931ba33677ead96a61f07f/debian/patches/CVE-2026-55199.patch";
       hash = "sha256-AFZa5kohha62aE0if5ckmAdJ0TZNcjfP32yDznoEhNo=";
     })
 
+    # backport of https://github.com/libssh2/libssh2/commit/97acf3dfda80c91c3a8c9f2372546301d4a1a7a8
     (fetchurl {
       name = "CVE-2026-55200.patch";
       url = "https://salsa.debian.org/debian/libssh2/-/raw/1d4906e6ebe85a9da2931ba33677ead96a61f07f/debian/patches/CVE-2026-55200.patch";
@@ -53,16 +56,47 @@ stdenv.mkDerivation (finalAttrs: {
     })
 
     # https://github.com/libssh2/libssh2/issues/1925#issuecomment-4938515829
+    # backport of https://github.com/libssh2/libssh2/commit/34497525929b9a47f03dfb81887ac896202b7e12
     (fetchurl {
       name = "CVE-2026-58050.patch";
       url = "https://raw.githubusercontent.com/JuliaPackaging/Yggdrasil/9404aa5dd96c945a790c425a5f49af19ed2a93b0/L/LibSSH2/LibSSH2%401.11/bundled/patches/CVE-2026-58050-3449752.patch";
       hash = "sha256-BZ1ewZgrroev2gkJwdoHCMFJK4wiRmA/Y4tzwaQqBd8=";
     })
+
+    # backport of https://github.com/libssh2/libssh2/commit/a9758da45a52bc8c630ec9493804d0c6ea30b24a
     (fetchurl {
       name = "CVE-2026-58051.patch";
       url = "https://github.com/JuliaPackaging/Yggdrasil/raw/9404aa5dd96c945a790c425a5f49af19ed2a93b0/L/LibSSH2/LibSSH2%401.11/bundled/patches/CVE-2026-58051-a9758da.patch";
       hash = "sha256-fduXIH02uwzqWV2RDidZmaDBy51V8yuC4XKlGYacjxg=";
     })
+
+    # backport of https://github.com/libssh2/libssh2/commit/5e4776146552d898b9c0e1b313cd093fa8dc92d0
+    (fetchurl {
+      name = "CVE-2026-66032.patch";
+      url = "https://salsa.debian.org/debian/libssh2/-/raw/fe2e3c0848f8501bf729d61790360761a20c75f2/debian/patches/CVE-2026-66032.patch";
+      hash = "sha256-H6VXhVc7uCFxj/k3Xouyg+8GYpsn/9IecXZrPkzsgks=";
+    })
+
+    # backport of https://github.com/libssh2/libssh2/commit/a2ed82d40964bbc0d64cd717aa0a5a892117d2e6
+    (fetchurl {
+      name = "CVE-2026-66033.patch";
+      url = "https://salsa.debian.org/debian/libssh2/-/raw/fe2e3c0848f8501bf729d61790360761a20c75f2/debian/patches/CVE-2026-66033.patch";
+      hash = "sha256-To2ul9ibaAkn0BWNu7fUbpaqHqEX+juUsBbjA0BGF6s=";
+    })
+
+    # backport of https://github.com/libssh2/libssh2/commit/a13bb6c773f0d55ad1628cede57e99803cd898d9
+    (fetchurl {
+      name = "CVE-2026-66034.patch";
+      url = "https://salsa.debian.org/debian/libssh2/-/raw/fe2e3c0848f8501bf729d61790360761a20c75f2/debian/patches/CVE-2026-66034.patch";
+      hash = "sha256-xYg9qh87KlExI38snAq5E5hF51mIoaJ1wOX9e1uEdmk=";
+    })
+
+    # backport of https://github.com/libssh2/libssh2/commit/42e33d81577ed4b95d4b4f6f845e5ee8efe5eeb4
+    (fetchurl {
+      name = "CVE-2026-66035.patch";
+      url = "https://salsa.debian.org/debian/libssh2/-/raw/fe2e3c0848f8501bf729d61790360761a20c75f2/debian/patches/CVE-2026-66035.patch";
+      hash = "sha256-+Wr9dp+g347pgKaJYRNRx+EXHA3iOKgOO4tjxi7zkD8=";
+    })
   ];
 
   # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion
diff --git a/pkgs/by-name/li/libxfont_2/package.nix b/pkgs/by-name/li/libxfont_2/package.nix
index 0156515019d1..beb3abd0d329 100644
--- a/pkgs/by-name/li/libxfont_2/package.nix
+++ b/pkgs/by-name/li/libxfont_2/package.nix
@@ -15,7 +15,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libxfont_2";
-  version = "2.0.8";
+  version = "2.0.9";
 
   outputs = [
     "out"
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://xorg/individual/lib/libXfont2-${finalAttrs.version}.tar.xz";
-    hash = "sha256-9VbA4Qk6TmkRzJC8SxBtIBkC7hh/10ryBv8WL35qJNU=";
+    hash = "sha256-8EKjcGZoFee5Qem3AZAkdVvRxsKVSvv6UVrzeCUXmeI=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/ll/llhttp/package.nix b/pkgs/by-name/ll/llhttp/package.nix
index 4487a4518360..a1909b67b458 100644
--- a/pkgs/by-name/ll/llhttp/package.nix
+++ b/pkgs/by-name/ll/llhttp/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "llhttp";
-  version = "9.4.2";
+  version = "9.4.3";
 
   src = fetchFromGitHub {
     owner = "nodejs";
     repo = "llhttp";
     tag = "release/v${finalAttrs.version}";
-    hash = "sha256-LS8HS8CnXJ3X8WlIvtxBLc0h1wLL/HmTqZWHlvBjTEo=";
+    hash = "sha256-wz87FgdZn0vtdlTWOZL5/Ujhs/uzSwFMHzQ6D9S7dH8=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ma/makeBinaryWrapper/make-binary-wrapper.sh b/pkgs/by-name/ma/makeBinaryWrapper/make-binary-wrapper.sh
index 232bc2b5c3cd..595574468ffa 100644
--- a/pkgs/by-name/ma/makeBinaryWrapper/make-binary-wrapper.sh
+++ b/pkgs/by-name/ma/makeBinaryWrapper/make-binary-wrapper.sh
@@ -366,10 +366,10 @@ void set_env_prefix(char *env, char *sep, char *prefix) {
         return;
       }
       unsigned long sep_len = strlen(sep);
-      int n_before = existing_prefix - existing_env;
+      int n_before = existing_prefix - existing_env - sep_len;
       assert_success(asprintf(&val, \"%s%s%.*s%s\", prefix, sep,
                               n_before, existing_env,
-                              existing_prefix + prefix_len + sep_len));
+                              existing_prefix + prefix_len));
     } else {
       assert_success(asprintf(&val, \"%s%s%s\", prefix, sep, existing_env));
     }
diff --git a/pkgs/by-name/ml/mlt/package.nix b/pkgs/by-name/ml/mlt/package.nix
index ce23dccb8185..539f0b2acd07 100644
--- a/pkgs/by-name/ml/mlt/package.nix
+++ b/pkgs/by-name/ml/mlt/package.nix
@@ -7,7 +7,8 @@
   cmake,
   pkg-config,
   which,
-  ffmpeg,
+  # FIXME: unpin when opencv supports ffmpeg 9
+  ffmpeg_8,
   fftw,
   fontconfig,
   frei0r,
@@ -82,11 +83,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     gdk-pixbuf
-    (opencv4.override { ffmpeg-headless = ffmpeg; })
-    ffmpeg
+    (opencv4.override { ffmpeg_8-headless = ffmpeg_8; })
+    ffmpeg_8
     fftw
     fontconfig
-    (frei0r.override { opencv = opencv4.override { ffmpeg-headless = ffmpeg; }; })
+    (frei0r.override { opencv = opencv4.override { ffmpeg_8-headless = ffmpeg_8; }; })
     libdv
     libebur128
     libexif
@@ -146,7 +147,7 @@ stdenv.mkDerivation (finalAttrs: {
   preFixup = ''
     wrapProgram $out/bin/melt \
       --prefix FREI0R_PATH : ${
-        (frei0r.override { opencv = opencv4.override { ffmpeg-headless = ffmpeg; }; })
+        (frei0r.override { opencv = opencv4.override { ffmpeg_8-headless = ffmpeg_8; }; })
       }/lib/frei0r-1 \
       ${lib.optionalString enableJackrack "--prefix LADSPA_PATH : ${ladspaPlugins}/lib/ladspa"} \
       ${lib.optionalString (qtbase != null) "\${qtWrapperArgs[@]}"}
@@ -159,7 +160,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru = {
-    inherit ffmpeg;
+    ffmpeg = ffmpeg_8;
   };
 
   passthru.updateScript = gitUpdater {
diff --git a/pkgs/by-name/mo/moltenvk/package.nix b/pkgs/by-name/mo/moltenvk/package.nix
index d39bb52b35e9..adc664b83fe8 100644
--- a/pkgs/by-name/mo/moltenvk/package.nix
+++ b/pkgs/by-name/mo/moltenvk/package.nix
@@ -21,7 +21,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "MoltenVK";
-  version = "1.4.1";
+  version = "1.4.2";
 
   strictDeps = true;
 
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "KhronosGroup";
     repo = "MoltenVK";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-7S10p/XrQ/oMXuCnOU6gqnWMGMfP5vhimec1ThxmuIE=";
+    hash = "sha256-iyYxuWZZfk2W3DW9OX3m77RLk0e8GTTpEV3Th7mIrXY=";
   };
 
   postPatch = ''
@@ -55,7 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
     while IFS= read -d "" proj; do
       echo "Updating deployment target to ${stdenv.hostPlatform.darwinMinVersion}: $proj"
       substituteInPlace "$proj" \
-        --replace-fail 'MACOSX_DEPLOYMENT_TARGET = 11.0' "MACOSX_DEPLOYMENT_TARGET = $MACOSX_DEPLOYMENT_TARGET"
+        --replace-fail 'MACOSX_DEPLOYMENT_TARGET = 12.0' "MACOSX_DEPLOYMENT_TARGET = $MACOSX_DEPLOYMENT_TARGET"
     done < <(grep -Z -rl --include=project.pbxproj MACOSX_DEPLOYMENT_TARGET)
 
     # Move `mvkGitRevDerived.h` to a stable location
diff --git a/pkgs/by-name/mp/mpg123/package.nix b/pkgs/by-name/mp/mpg123/package.nix
index 9bba89330c5c..538daa4a574d 100644
--- a/pkgs/by-name/mp/mpg123/package.nix
+++ b/pkgs/by-name/mp/mpg123/package.nix
@@ -21,11 +21,11 @@ assert withConplay -> !libOnly;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "${lib.optionalString libOnly "lib"}mpg123";
-  version = "1.33.6";
+  version = "1.33.7";
 
   src = fetchurl {
     url = "mirror://sourceforge/mpg123/mpg123-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-kpp8GLpmK4knrtTeIprZroqytIBt0PMLkBE+sbTiGVo=";
+    hash = "sha256-MdDjWkylZ+ybXr2mwwYrtENdbT6s1u8NlcrdeFTcA+4=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/pi/pipewire/package.nix b/pkgs/by-name/pi/pipewire/package.nix
index f2dadfc6aa94..144def6c59a9 100644
--- a/pkgs/by-name/pi/pipewire/package.nix
+++ b/pkgs/by-name/pi/pipewire/package.nix
@@ -13,7 +13,7 @@
   libinotify-kqueue,
   epoll-shim,
   systemd,
-  enableSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd, # enableSystemd=false maintained by maintainers.qyliss.
+  enableSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd, # enableSystemd=false maintained by maintainers.highghlow.
   pkg-config,
   docutils,
   doxygen,
@@ -229,6 +229,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonEnable "pipewire-v4l2" stdenv.hostPlatform.isLinux)
     (lib.mesonEnable "libsystemd" enableSystemd)
     (lib.mesonEnable "systemd-system-service" enableSystemd)
+    (lib.mesonEnable "systemd-user-service" enableSystemd)
     (lib.mesonEnable "udev" stdenv.hostPlatform.isLinux)
     (lib.mesonEnable "ffmpeg" true)
     (lib.mesonEnable "pw-cat-ffmpeg" true)
diff --git a/pkgs/by-name/po/polkit/package.nix b/pkgs/by-name/po/polkit/package.nix
index 31231f32d736..723f80bcdc74 100644
--- a/pkgs/by-name/po/polkit/package.nix
+++ b/pkgs/by-name/po/polkit/package.nix
@@ -22,8 +22,8 @@
   docbook_xml_dtd_412,
   gtk-doc,
   coreutils,
-  useSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdMinimal,
-  systemdMinimal,
+  useSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
+  systemdLibs,
   elogind,
   buildPackages,
   withIntrospection ?
@@ -97,7 +97,7 @@ stdenv.mkDerivation rec {
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     # On Linux, fall back to elogind when systemd support is off.
-    (if useSystemd then systemdMinimal else elogind)
+    (if useSystemd then systemdLibs else elogind)
   ];
 
   propagatedBuildInputs = [
diff --git a/pkgs/by-name/pr/protobufc/package.nix b/pkgs/by-name/pr/protobufc/package.nix
index c71242bd98dd..8e3537d9a224 100644
--- a/pkgs/by-name/pr/protobufc/package.nix
+++ b/pkgs/by-name/pr/protobufc/package.nix
@@ -36,6 +36,21 @@ stdenv.mkDerivation (finalAttrs: {
     zlib
   ];
 
+  # The upstream macro is vendored from a very old autoconf archive:
+  # https://github.com/protobuf-c/protobuf-c/commit/42612b4ba4b11d48b76e3643fa6d42f617e661b6
+  # and the build system appears to arbitrarily require C++17 specifically:
+  # https://github.com/protobuf-c/protobuf-c/blob/4719fdd7760624388c2c5b9d6759eb6a47490626/configure.ac#L72
+  # However, the default standard version used by GCC continues to increase
+  # (e.g. C++20 for GCC 16), and so protobuf-c's dependencies do as well. In
+  # particular, abseil-cpp has headers that protobuf-c includes and are
+  # sensitive to the standard version. While we could override the standard
+  # version used by these dependents, it is simpler to drop the requirement and
+  # allow the compiler default standard to be used.
+  postPatch = ''
+    substituteInPlace configure.ac --replace-fail \
+      "AX_CXX_COMPILE_STDCXX(17, noext, mandatory)" ""
+  '';
+
   env.PROTOC = lib.getExe buildPackages.protobuf_33;
 
   meta = {
diff --git a/pkgs/by-name/pu/publicsuffix-list/package.nix b/pkgs/by-name/pu/publicsuffix-list/package.nix
index 7dd02eb4f21d..d6c15745fa64 100644
--- a/pkgs/by-name/pu/publicsuffix-list/package.nix
+++ b/pkgs/by-name/pu/publicsuffix-list/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "publicsuffix-list";
-  version = "0-unstable-2026-06-24";
+  version = "0-unstable-2026-07-25";
 
   src = fetchFromGitHub {
     owner = "publicsuffix";
     repo = "list";
-    rev = "18ecca5d54471f21918798da451dd8d03a18f3c7";
-    hash = "sha256-xvOAZpWhuOU3koEHgNfVK6aHy+VMYRoHj3fq9PxaAFo=";
+    rev = "e1b8015c3b2f0f4f8c18659c2480fc1a22c07b20";
+    hash = "sha256-F+OmANpg7I4dBFL7PM3oJlhpDzfxrRTfo+50lQHdU2M=";
   };
 
   dontBuild = true;
diff --git a/pkgs/by-name/sh/shadow/package.nix b/pkgs/by-name/sh/shadow/package.nix
index 51a216b27684..f47476196c2a 100644
--- a/pkgs/by-name/sh/shadow/package.nix
+++ b/pkgs/by-name/sh/shadow/package.nix
@@ -20,7 +20,6 @@
   withTcb ? lib.meta.availableOn stdenv.hostPlatform tcb,
   tcb,
   cmocka,
-  fetchpatch,
 }:
 let
   glibc' =
@@ -34,13 +33,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "shadow";
-  version = "4.19.4";
+  version = "4.20.0";
 
   src = fetchFromGitHub {
     owner = "shadow-maint";
     repo = "shadow";
     tag = finalAttrs.version;
-    hash = "sha256-vR6dwB3EttGY2DgQ20nOr9kNhF+nsAaBEyklcJAZ20Y=";
+    hash = "sha256-UafTyfK+pmW2wyAQnvHov9KIorf1HSc6haskfv7auHs=";
   };
 
   outputs = [
@@ -150,36 +149,6 @@ stdenv.mkDerivation (finalAttrs: {
         cp -r . $out/
       '';
       dontBuild = true;
-      patches = [
-        # tests: update useradd tests to expect ID 1001
-        (fetchpatch {
-          name = "update-useradd-tests.patch";
-          url = "https://github.com/shadow-maint/shadow/commit/59fbe8415dab17f1e702fbdee96956886c86c737.patch";
-          hash = "sha256-U0+NSCd4AfTuHMddTx9+wNtpdJt9t8+D5ApW0OCNgsY=";
-          stripLen = 2;
-        })
-        # tests: update usermod tests to expect ID 1001
-        (fetchpatch {
-          name = "update-usermod-tests.patch";
-          url = "https://github.com/shadow-maint/shadow/commit/91c2ad44ababca2e32cdb71152b0f7f2a7c546be.patch";
-          hash = "sha256-v1EEvMfUYoE/ZnBM0k/+kUBK3W1dXr588OQzvFmnXLI=";
-          stripLen = 2;
-        })
-        # tests: update groupadd tests to expect GID 1001
-        (fetchpatch {
-          name = "update-groupadd-tests.patch";
-          url = "https://github.com/shadow-maint/shadow/commit/60568eaec13d1e417f56f0e59ac9573c0e3b9a83.patch";
-          hash = "sha256-tLmGeW4Y7UcZqMhW3IXgygKPhCmbZkkW5XTJ7CFz9vg=";
-          stripLen = 2;
-        })
-        # tests: update newgrp tests to expect GID 1002
-        (fetchpatch {
-          name = "update-newgrp-tests.patch";
-          url = "https://github.com/shadow-maint/shadow/commit/49ff9bf33a7b6af57cb26688c3139f014302c9d9.patch";
-          hash = "sha256-1760t4Ezd5Ke4PFZ70Njb+k+1kp17aT/7uqu1PswVss=";
-          stripLen = 2;
-        })
-      ];
       postPatch = ''
         # Replace the gshadow existence check in the test framework with a more NixOS-friendly one, since NixOS does not have /etc/gshadow as a regular file
         substituteInPlace framework/hosts/shadow.py \
diff --git a/pkgs/by-name/sh/shotcut/package.nix b/pkgs/by-name/sh/shotcut/package.nix
index 5054989f5f6c..bf20d32bfa21 100644
--- a/pkgs/by-name/sh/shotcut/package.nix
+++ b/pkgs/by-name/sh/shotcut/package.nix
@@ -15,7 +15,7 @@
   qt6Packages,
   cmake,
   gitUpdater,
-  ffmpeg,
+  ffmpeg_8,
   wrapGAppsHook3,
 }:
 
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     SDL2
-    (frei0r.override { opencv = opencv4.override { ffmpeg-headless = ffmpeg; }; })
+    (frei0r.override { opencv = opencv4.override { ffmpeg_8-headless = ffmpeg_8; }; })
     ladspaPlugins
     gettext
     qt6Packages.mlt
@@ -60,7 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     (replaceVars ./fix-mlt-ffmpeg-path.patch {
-      inherit ffmpeg;
+      ffmpeg = ffmpeg_8;
       mlt = qt6Packages.mlt;
     })
   ];
@@ -69,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   qtWrapperArgs = [
     "--set FREI0R_PATH ${
-      (frei0r.override { opencv = opencv4.override { ffmpeg-headless = ffmpeg; }; })
+      (frei0r.override { opencv = opencv4.override { ffmpeg_8-headless = ffmpeg_8; }; })
     }/lib/frei0r-1"
     "--set LADSPA_PATH ${ladspaPlugins}/lib/ladspa"
     "--prefix LD_LIBRARY_PATH : ${
diff --git a/pkgs/by-name/si/simdjson/package.nix b/pkgs/by-name/si/simdjson/package.nix
index 3cb507297c47..3c6396b93ade 100644
--- a/pkgs/by-name/si/simdjson/package.nix
+++ b/pkgs/by-name/si/simdjson/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "simdjson";
-  version = "4.6.4";
+  version = "4.6.5";
 
   src = fetchFromGitHub {
     owner = "simdjson";
     repo = "simdjson";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8oQzsR7DSaNTN9su1uI9tRQ9HvOwXShPwSrnQj8+lGM=";
+    hash = "sha256-mN8k98+vqhehDvTXoP1wB/V25oKnGQYCVXrvh/rVssw=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/sp/spirv-cross/package.nix b/pkgs/by-name/sp/spirv-cross/package.nix
index ed353a8f884a..0ecc74bb557c 100644
--- a/pkgs/by-name/sp/spirv-cross/package.nix
+++ b/pkgs/by-name/sp/spirv-cross/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spirv-cross";
-  version = "1.4.350.0";
+  version = "1.4.357.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Cross";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-JdVAS5uVSfe0mOGtyodkgmvgD4of9Amq8PbDSAtgaXc=";
+    hash = "sha256-HjAVP+yMeybM8VQQO3aKmuxpvjA03EGjKUPWVQKoRuc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sp/spirv-headers/package.nix b/pkgs/by-name/sp/spirv-headers/package.nix
index ddb49d7af092..49436e90d8e9 100644
--- a/pkgs/by-name/sp/spirv-headers/package.nix
+++ b/pkgs/by-name/sp/spirv-headers/package.nix
@@ -2,36 +2,20 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spirv-headers";
-  version = "1.4.350.0";
+  version = "1.4.357.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Headers";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-nwzhJlkdN8DaExHvnuVc5rZmlrkPYb7Qmj1fx3O5Zpw=";
+    hash = "sha256-tGY4H3+5p9M5LBK/xxRdMT9CX+qq3e7fPkaftnpjU9I=";
   };
 
-  patches = [
-    # backport to fix glslang tests
-    # FIXME: remove in next update
-    (fetchpatch {
-      url = "https://github.com/KhronosGroup/SPIRV-Headers/commit/1a22b167081842915a1c78a0b5b5a353a23284aa.diff";
-      hash = "sha256-XUHfPHnk7bWK4vnozfW/84vaZN+rbFJUZSa6Og8GUAU=";
-    })
-    # Backport new predicated load/store instructions, needed by spirv-llvm-translator
-    # Not in any tagged releases yet, should exist in the next release after 1.4.350.1.
-    (fetchpatch {
-      url = "https://github.com/KhronosGroup/SPIRV-Headers/commit/b8a32968473ce852a809b9de5f04f02a5a9dfa78.patch";
-      hash = "sha256-59jmN28ifEhAxySXCpuGZ62jo1WVsRPnVosK8X4yrjM=";
-    })
-  ];
-
   nativeBuildInputs = [ cmake ];
 
   meta = {
diff --git a/pkgs/by-name/sp/spirv-tools/package.nix b/pkgs/by-name/sp/spirv-tools/package.nix
index 97b842561e42..241551253cc3 100644
--- a/pkgs/by-name/sp/spirv-tools/package.nix
+++ b/pkgs/by-name/sp/spirv-tools/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
   python3,
   spirv-headers,
@@ -10,30 +9,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spirv-tools";
-  version = "1.4.350.0";
+  version = "1.4.357.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "SPIRV-Tools";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-tR3POZH/LXaAljMUS9aHBBvIvlr6o7d6+YUtJCRMS1w=";
+    hash = "sha256-ne2JF68MJNriPIiA/fRCb6VYH3vWsoyov4S82QQY2AI=";
   };
 
   patches = [
     # https://github.com/KhronosGroup/SPIRV-Tools/pull/6483
     ./0001-Fix-generated-pkg-config-modules-with-absolute-insta.patch
-
-    # backport to fix glslang tests
-    # FIXME: remove in next update
-    (fetchpatch {
-      url = "https://github.com/KhronosGroup/SPIRV-Tools/commit/2ec8457ab33d539b6f1fecc998360c0b8b05ed4f.diff";
-      hash = "sha256-YHbYBwXMm4rTKpmMW6I3LUafhA4RuNUdXqUBUAXwXpE=";
-    })
-
-    (fetchpatch {
-      url = "https://github.com/KhronosGroup/SPIRV-Tools/commit/0db9162641d9709c63c92a13e66fd88905180e89.diff";
-      hash = "sha256-eoS35Zxb+frQTTTNCaZ4TV/QZjaK45mW1OzzIlXQ1C0=";
-    })
   ]
   # The cmake options are sufficient for turning on static building, but not
   # for disabling shared building, just trim the shared lib from the CMake
diff --git a/pkgs/by-name/sv/sv-lang/package.nix b/pkgs/by-name/sv/sv-lang/package.nix
index 91c2b1383460..b23f3d0512c8 100644
--- a/pkgs/by-name/sv/sv-lang/package.nix
+++ b/pkgs/by-name/sv/sv-lang/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   boost,
   catch2_3,
   cmake,
@@ -23,6 +24,20 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-popHzwX0qwv2POAl7/qX3e//OwJRXGtSl9xogpSn2LI=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "fmt-12.2.patch";
+      url = "https://github.com/MikePopoloski/slang/commit/5a898b4b9225d281902fcd59fe4732b1561677d2.patch";
+      excludes = [ "tests/unittests/diagnostics/WaiverTests.cpp" ];
+      hash = "sha256-Y+GG8UINWXh7eTXEweM42oPY8ByP4DQYgTjSLukz4I4=";
+    })
+  ];
+
+  patchFlags = [
+    "-p1"
+    "-F3"
+  ];
+
   cmakeFlags = [
     # fix for https://github.com/NixOS/nixpkgs/issues/144170
     "-DCMAKE_INSTALL_INCLUDEDIR=include"
diff --git a/pkgs/by-name/sw/swtpm/package.nix b/pkgs/by-name/sw/swtpm/package.nix
index ffa3d5760e31..6fce8b666fb0 100644
--- a/pkgs/by-name/sw/swtpm/package.nix
+++ b/pkgs/by-name/sw/swtpm/package.nix
@@ -46,6 +46,11 @@ stdenv.mkDerivation (finalAttrs: {
     python3
     autoreconfHook
     makeWrapper
+    # configure.ac does AC_CHECK_PROG([OPENSSL_CLITOOL], [openssl], ...) and
+    # errors out when the tool is not on PATH. openssl is in buildInputs for
+    # the library, which puts its bin dir on PATH only when build == host, so
+    # the check fails when cross-compiling.
+    openssl
   ];
 
   nativeCheckInputs = [
diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index 0a57be97ee5f..d71e6974b5bb 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -17,7 +17,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.69";
+  version = "0.0.70";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-bu/2vHmhHYS/3EZM9Ibh8Y0v/aigriDwWu7Wn7gNvds=";
+    hash = "sha256-rlhU/987KaTAXukZDUDY0XyDUQiC6qHGIXS2epg6ziI=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -39,7 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-DUCTpqnzsGPH3OQkutduqrCZd7uuOgbZZmnXNCC8YdY=";
+  cargoHash = "sha256-eM+MdAxx6UqvFSTnUmCk7Nx1MuprrYrv/64Jy90nE0c=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ rust-jemalloc-sys ];
diff --git a/pkgs/by-name/uc/ucx/package.nix b/pkgs/by-name/uc/ucx/package.nix
index c429cba6c36a..581c39a7ecf1 100644
--- a/pkgs/by-name/uc/ucx/package.nix
+++ b/pkgs/by-name/uc/ucx/package.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
   strictDeps = true;
 
   pname = "ucx";
-  version = "1.21.0";
+  version = "1.22.0";
 
   src = fetchFromGitHub {
     owner = "openucx";
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     # Otherwise compilation fails with:
     #   fatal error: gpunetio/common/doca_gpunetio_verbs_def.h: No such file or directory
     fetchSubmodules = true;
-    hash = "sha256-Td6L5wXDadIbHfk251bj6k9J3kIjqCYVx5lDso/u76M=";
+    hash = "sha256-R/uUjkYLPtY9c3vZWrkzKaSgK9Z/cppJCwQ1V1cuwPc=";
   };
 
   # UCX uses the `#pragma omp master` declaration which is deprecated since
diff --git a/pkgs/by-name/vu/vulkan-extension-layer/package.nix b/pkgs/by-name/vu/vulkan-extension-layer/package.nix
index eb36c08cf7ce..4d4931f7a1cd 100644
--- a/pkgs/by-name/vu/vulkan-extension-layer/package.nix
+++ b/pkgs/by-name/vu/vulkan-extension-layer/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-extension-layer";
-  version = "1.4.350.0";
+  version = "1.4.357.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-ExtensionLayer";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-6ZtPp6OqzzppmijIU1/77qcUvwCck/eMZOUh5pSwVc8=";
+    hash = "sha256-R9hs69SvZeK0w7YF7rhhVp9mRQing3y8NffWfRlXBQI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/vu/vulkan-headers/package.nix b/pkgs/by-name/vu/vulkan-headers/package.nix
index 956a3725941a..7b1b5e59ebe7 100644
--- a/pkgs/by-name/vu/vulkan-headers/package.nix
+++ b/pkgs/by-name/vu/vulkan-headers/package.nix
@@ -7,7 +7,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-headers";
-  version = "1.4.350.0";
+  version = "1.4.357.0";
 
   # Adding `ninja` here to enable Ninja backend. Otherwise on gcc-14 or
   # later the build fails as:
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "KhronosGroup";
     repo = "Vulkan-Headers";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-RcUVurC+Rc0MyWpQLaLVmdn7FZO1GWWzTZZAOwvKwb4=";
+    hash = "sha256-tAYvYx/Mqvf/I177xmx7oLZVc7S7GK3MArY3i+FCYuw=";
   };
 
   passthru.updateScript = ./update.sh;
diff --git a/pkgs/by-name/vu/vulkan-loader/package.nix b/pkgs/by-name/vu/vulkan-loader/package.nix
index 3987debfef12..ceecfa9ea58f 100644
--- a/pkgs/by-name/vu/vulkan-loader/package.nix
+++ b/pkgs/by-name/vu/vulkan-loader/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-loader";
-  version = "1.4.350.0";
+  version = "1.4.357.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Loader";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-jgibBetbMpqRJ+OJpJgNxgC6phECewNqtla9CCJj56U=";
+    hash = "sha256-sPv3pA/oclV75CuxsYeIAZ6zH3C6FPmhdI0+djxRExk=";
   };
 
   patches = [ ./fix-pkgconfig.patch ];
diff --git a/pkgs/by-name/vu/vulkan-tools-lunarg/package.nix b/pkgs/by-name/vu/vulkan-tools-lunarg/package.nix
index 7ccc9cfa11cc..ee130c8cd015 100644
--- a/pkgs/by-name/vu/vulkan-tools-lunarg/package.nix
+++ b/pkgs/by-name/vu/vulkan-tools-lunarg/package.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-tools-lunarg";
-  version = "1.4.350.0";
+  version = "1.4.357.0";
 
   src = fetchFromGitHub {
     owner = "LunarG";
     repo = "VulkanTools";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-tKt/OrGIVfg2/aK9dYPuOB4+05ayUheP9T7Ny5MfWTk=";
+    hash = "sha256-7nrEXdt0c02D2Z270W45YBwbfzsTwt854tKx+HlTHYA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/vu/vulkan-tools/package.nix b/pkgs/by-name/vu/vulkan-tools/package.nix
index f6bbd8c69f5b..be038ba8db3a 100644
--- a/pkgs/by-name/vu/vulkan-tools/package.nix
+++ b/pkgs/by-name/vu/vulkan-tools/package.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vulkan-tools";
-  version = "1.4.350.0";
+  version = "1.4.357.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Tools";
     rev = "vulkan-sdk-${version}";
-    hash = "sha256-qtEq1ZQT5JXE4bXzy8W053CRF/dOFVV7d7NE9uNYssI=";
+    hash = "sha256-kbySCu2c5nh6icnPQV6qplfg1gHFnGPEYOG6G6TG8EU=";
   };
 
   patches = [ ./wayland-scanner.patch ];
diff --git a/pkgs/by-name/vu/vulkan-utility-libraries/package.nix b/pkgs/by-name/vu/vulkan-utility-libraries/package.nix
index 2ea2fc62a0be..7d42890bd2a1 100644
--- a/pkgs/by-name/vu/vulkan-utility-libraries/package.nix
+++ b/pkgs/by-name/vu/vulkan-utility-libraries/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-utility-libraries";
-  version = "1.4.350.0";
+  version = "1.4.357.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-Utility-Libraries";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-E0T5eSI30eDB7//6srjwlkX9HfUp1UiyCPWDyK+ZEi8=";
+    hash = "sha256-WcSiUe3vB7zUO0vpqcVJkKqhnZXz76ApWaoMO49efXg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/vu/vulkan-validation-layers/package.nix b/pkgs/by-name/vu/vulkan-validation-layers/package.nix
index 0ec1066690c0..9d77abaee8b3 100644
--- a/pkgs/by-name/vu/vulkan-validation-layers/package.nix
+++ b/pkgs/by-name/vu/vulkan-validation-layers/package.nix
@@ -26,13 +26,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "vulkan-validation-layers";
-  version = "1.4.350.0";
+  version = "1.4.357.0";
 
   src = fetchFromGitHub {
     owner = "KhronosGroup";
     repo = "Vulkan-ValidationLayers";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-3qUZP/R29eqTR4IAWH6jBGgmRqE0d1ahcdKbxUOAmTY=";
+    hash = "sha256-AO1ci608M6CoCrPR6UI2ZjCRlyzOeN8lkimZZODazb0=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/vu/vulkan-volk/package.nix b/pkgs/by-name/vu/vulkan-volk/package.nix
index 613867ceee19..7a80de1c0cec 100644
--- a/pkgs/by-name/vu/vulkan-volk/package.nix
+++ b/pkgs/by-name/vu/vulkan-volk/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "volk";
-  version = "1.4.350.0";
+  version = "1.4.357.0";
 
   src = fetchFromGitHub {
     owner = "zeux";
     repo = "volk";
     rev = "vulkan-sdk-${finalAttrs.version}";
-    hash = "sha256-7JsOWhMTnxeJfsTVgnnHQt5gYJ8tqELT+s3VDHTPof8=";
+    hash = "sha256-iaKwjY4oJz4IdZ4JYuinOmWIFo6TkF7VikWZRhCWfNk=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/we/webrtc-audio-processing/package.nix b/pkgs/by-name/we/webrtc-audio-processing/package.nix
index 6dfea3582b92..4038bde5548f 100644
--- a/pkgs/by-name/we/webrtc-audio-processing/package.nix
+++ b/pkgs/by-name/we/webrtc-audio-processing/package.nix
@@ -46,7 +46,11 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   propagatedBuildInputs = [
-    abseil-cpp
+    # webrtc-audio-processing specifies C++17, so abseil must match. Otherwise,
+    # abseil exposes a different (incompatible) interface based on the default
+    # C++ standard of the compiler.
+    # https://gitlab.freedesktop.org/pulseaudio/webrtc-audio-processing/-/blob/d0569cfa50c1858ee279d77b3fc8870be6902441/meson.build#L7
+    (abseil-cpp.override { cxxStandard = "17"; })
   ];
 
   mesonFlags =
diff --git a/pkgs/by-name/wh/which/package.nix b/pkgs/by-name/wh/which/package.nix
index 6c28c95eb844..51043d18ab47 100644
--- a/pkgs/by-name/wh/which/package.nix
+++ b/pkgs/by-name/wh/which/package.nix
@@ -31,6 +31,8 @@ stdenv.mkDerivation (finalAttrs: {
     "man"
   ];
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://www.gnu.org/software/which/";
     description = "Shows the full path of (shell) commands";
diff --git a/pkgs/by-name/wi/wildmidi/package.nix b/pkgs/by-name/wi/wildmidi/package.nix
index 59d1aeaaaa64..ce30cdbb8dfa 100644
--- a/pkgs/by-name/wi/wildmidi/package.nix
+++ b/pkgs/by-name/wi/wildmidi/package.nix
@@ -13,13 +13,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "wildmidi";
-  version = "0.4.6";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "Mindwerks";
     repo = "wildmidi";
     rev = "${pname}-${version}";
-    sha256 = "sha256-syjs8y75M2ul7whiZxnWMSskRJd0ixFqnep7qsTbiDE=";
+    sha256 = "sha256-KFJW2m7TJ0RExK/C0XHyOefKGFLUszl7Jh6l10NjeHM=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/zx/zxing-cpp/package.nix b/pkgs/by-name/zx/zxing-cpp/package.nix
index 182630f30259..8a6b3e6b0a3e 100644
--- a/pkgs/by-name/zx/zxing-cpp/package.nix
+++ b/pkgs/by-name/zx/zxing-cpp/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zxing-cpp";
-  version = "3.0.2";
+  version = "3.1.1";
 
   src = fetchFromGitHub {
     owner = "zxing-cpp";
     repo = "zxing-cpp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZtjvHBnuPJkc9kU998jH7IPlX3jF/RGtLNWDzsb0v4A=";
+    hash = "sha256-dCqn2qYQGHY/nmwwkgd4uGoKp0YeQxWiHpS0Hhsm+UE=";
   };
 
   strictDeps = true;
@@ -38,6 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-DZXING_DEPENDENCIES=LOCAL"
     "-DZXING_EXAMPLES=OFF"
     "-DZXING_USE_BUNDLED_ZINT=OFF"
+    (lib.cmakeFeature "ZXING_WRITERS" "BOTH")
   ];
 
   passthru = {
diff --git a/pkgs/development/compilers/sbcl/default.nix b/pkgs/development/compilers/sbcl/default.nix
index 7af5780c6d93..f7f8a8d1fbee 100644
--- a/pkgs/development/compilers/sbcl/default.nix
+++ b/pkgs/development/compilers/sbcl/default.nix
@@ -32,8 +32,8 @@ let
     "2.4.10".sha256 = "sha256-zus5a2nSkT7uBIQcKva+ylw0LOFGTD/j5FPy3hDF4vg=";
     # By unofficial and very loose convention we keep the latest version of
     # SBCL, and the previous one in case someone quickly needs to roll back.
-    "2.6.5".sha256 = "sha256-kex19kclLtbmrq6bGhP0fHxs/ZtoSI3Gnxpv6lrMtEA=";
     "2.6.6".sha256 = "sha256-plp6MIEqr1SSXRGSubnoEPUnx5kRxgALdUgQWu99o0s=";
+    "2.6.7".sha256 = "sha256-Hr3DXJ3I4nG4zRrESWXgC/JV+cAiFlD8t38Ps0wtOt4=";
   };
   # Collection of pre-built SBCL binaries for platforms that need them for
   # bootstrapping. Ideally these are to be avoided.  If ECL (or any other
diff --git a/pkgs/development/compilers/zulu/common.nix b/pkgs/development/compilers/zulu/common.nix
index 0038ab2e7bf4..f7fcff839b1c 100644
--- a/pkgs/development/compilers/zulu/common.nix
+++ b/pkgs/development/compilers/zulu/common.nix
@@ -79,6 +79,9 @@ let
     pname = "zulu-${javaPackage}";
     version = dist.jdkVersion;
 
+    __structuredAttrs = true;
+    strictDeps = true;
+
     src = fetchurl {
       url = "https://cdn.azul.com/zulu/bin/zulu${dist.zuluVersion}-${javaPackage}${dist.jdkVersion}-${platform}_${arch}.tar.gz";
       inherit (dist) hash;
diff --git a/pkgs/development/haskell-modules/configuration-nix.nix b/pkgs/development/haskell-modules/configuration-nix.nix
index 870f2fac7cf2..399297c71260 100644
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -404,6 +404,13 @@ builtins.intersectAttrs super {
     postInstall = ''
       ${drv.postInstall or ""}
       ln -s "''${!outputBin}/bin/pandoc" "''${!outputBin}/bin/pandoc-server"
+    ''
+    # Assert the lua and server features are enabled by default
+    # c.f. https://github.com/NixOS/nixpkgs/issues/540900
+    # FIXME: overrideCabal does not allow configuring installCheckPhase, so use postInstall
+    + lib.optionalString canExecute ''
+      "''${!outputBin}/bin/pandoc" --version | grep -qF '+lua'
+      "''${!outputBin}/bin/pandoc" --version | grep -qF '+server'
     '';
   }) super.pandoc-cli;
 
diff --git a/pkgs/development/interpreters/luajit/default.nix b/pkgs/development/interpreters/luajit/default.nix
index 91c706e4efa8..fede20472a1e 100644
--- a/pkgs/development/interpreters/luajit/default.nix
+++ b/pkgs/development/interpreters/luajit/default.nix
@@ -72,7 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
   luaversion = "5.1";
 
   postPatch = ''
-    substituteInPlace Makefile --replace ldconfig :
+    substituteInPlace Makefile --replace-fail ldconfig :
     if test -n "''${dontStrip-}"; then
       # CCDEBUG must be non-empty or everything will be stripped, -g being
       # passed by nixpkgs CC wrapper is insufficient on its own
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 03cc59038ff2..fc4cd0db1219 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -20,10 +20,10 @@
         sourceVersion = {
           major = "3";
           minor = "14";
-          patch = "6";
+          patch = "7";
           suffix = "";
         };
-        hash = "sha256-FDsd3e+uw70uIeO4ObNKK3+5hCJyiDxXZCDWBenzDGM=";
+        hash = "sha256-O0jayPtZ9i6qZ6yDwesSvaG3oIQG3ShuJSwRpmvif4E=";
       };
     };
 
@@ -59,10 +59,10 @@
       sourceVersion = {
         major = "3";
         minor = "13";
-        patch = "14";
+        patch = "15";
         suffix = "";
       };
-      hash = "sha256-Y55DJDxiCjCPloIT354A8vj2IzL3rbqnp+65eDBXxpA=";
+      hash = "sha256-HmanlFpIOQ7kwqQmig5BhYhAWaE8SqttFIqiCN7qSnY=";
       inherit passthruFun;
     };
 
diff --git a/pkgs/development/interpreters/python/hooks/python-metadata-check-hook.sh b/pkgs/development/interpreters/python/hooks/python-metadata-check-hook.sh
index f942e5bee76a..de61a8228940 100644
--- a/pkgs/development/interpreters/python/hooks/python-metadata-check-hook.sh
+++ b/pkgs/development/interpreters/python/hooks/python-metadata-check-hook.sh
@@ -7,20 +7,21 @@ pythonMetadataCheckPhase() {
   echo "Executing pythonMetadataCheckPhase"
 
   # shellcheck disable=SC2154
-  pythonMetadataCheckOutput="$out"
+  local pythonMetadataCheckOutput="$out"
   if [[ -n "${python-}" ]]; then
     echo "Using python specific output \$python for metadata check"
     pythonMetadataCheckOutput=$python
   fi
   # shellcheck disable=SC2154
-  derivationPname="$pname"
+  local derivationPname="$pname"
   # shellcheck disable=SC2154
-  derivationVersion="$version"
+  local derivationVersion="$version"
   # `python -P` avoids picking up egg-info dirs in $PWD
+  local metadataVersion
   metadataVersion="$(PYTHONPATH="$pythonMetadataCheckOutput/@pythonSitePackages@:$PYTHONPATH" \
     @pythonInterpreter@ -P -c 'from importlib.metadata import version; import sys; print(version(sys.argv[1]))' "$derivationPname")"
 
-  # chethat both versions can be parsed
+  # check that both versions can be parsed
   @pythonWithPackaging@ -c "from packaging.version import Version; from sys import argv; Version(argv[1]); Version(argv[2])" "$derivationVersion" "$metadataVersion"
 
   if @pythonWithPackaging@ -c "from packaging.version import Version; from sys import argv, exit; exit(Version(argv[1]) == Version(argv[2]))" "$derivationVersion" "$metadataVersion"; then
diff --git a/pkgs/development/libraries/boost/generic.nix b/pkgs/development/libraries/boost/generic.nix
index f19bf0ebf689..f7e9bde5524f 100644
--- a/pkgs/development/libraries/boost/generic.nix
+++ b/pkgs/development/libraries/boost/generic.nix
@@ -194,6 +194,35 @@ stdenv.mkDerivation {
       extraPrefix = "libs/context/";
       sha256 = "sha256-bCfLL7bD1Rn4Ie/P3X+nIcgTkbXdCX6FW7B9lHsmVW8=";
     })
+    # Backports https://github.com/boostorg/context/pull/331, which prevents
+    # an optimisation that breaks coroutine migration between threads.
+    # (mostly needed to avoid conflicts when applying the patch below,
+    # but it's a meaningful standalone fix too).
+    ++
+      lib.optional (lib.versionAtLeast version "1.88.0" && lib.versionOlder version "1.92.0")
+        (fetchpatch {
+          url = "https://github.com/boostorg/context/commit/0921b9fd5c776aec7748475c6c10807e0d51bc6d.patch";
+          relative = "include";
+          hash = "sha256-nQYMd3HFsDLxijnGdyas0ZHs3ylQVMGQL14K7F6MkF0=";
+        })
+    # Backports https://github.com/boostorg/context/pull/337 which fixes a regression that breaks
+    # std::uncaught_exceptions for abandoned coroutines under libstdc++ and fcontext implementation.
+    # This bug also caused subtle breakage in Nix. See https://github.com/NixOS/nix/issues/16174.
+    ++
+      lib.optional (lib.versionAtLeast version "1.88.0" && lib.versionOlder version "1.93.0")
+        (fetchpatch {
+          url = "https://github.com/boostorg/context/commit/5883212311535a0046031d74d1568ae173c1e35b.patch";
+          relative = "include";
+          hash = "sha256-CytNLi2d0wjI/lY5lDv98mwwQaEt7qeIs4UkE6QgCBU=";
+        })
+    ++
+      # This also broke Nix https://github.com/NixOS/nix/issues/13145 and probably much more dependants too.
+      lib.optional (lib.versionAtLeast version "1.88.0" && lib.versionOlder version "1.89.0")
+        (fetchpatch {
+          url = "https://github.com/boostorg/context/commit/c79564d0de69422ed33f2fbc892908ad510e6a19.patch";
+          relative = "include";
+          hash = "sha256-5iZ+rSdtyOupBUYws6U8whd43XMkTlQlApW5xvE0ZB4=";
+        })
     # This fixes another issue regarding ill-formed constant expressions, which is a default error
     # in clang 16 and will be a hard error in clang 17.
     ++ lib.optional (lib.versionOlder version "1.80") (fetchpatch {
diff --git a/pkgs/development/libraries/ffmpeg/default.nix b/pkgs/development/libraries/ffmpeg/default.nix
index 28e51a85d4dd..9a37a2d12637 100644
--- a/pkgs/development/libraries/ffmpeg/default.nix
+++ b/pkgs/development/libraries/ffmpeg/default.nix
@@ -75,7 +75,7 @@ rec {
   # unversioned aliases to allow for quicker migration to new releases,
   # but can pin one of the versioned variants if they do not work with
   # the current default version.
-  ffmpeg = ffmpeg_8;
-  ffmpeg-headless = ffmpeg_8-headless;
-  ffmpeg-full = ffmpeg_8-full;
+  ffmpeg = ffmpeg_9;
+  ffmpeg-headless = ffmpeg_9-headless;
+  ffmpeg-full = ffmpeg_9-full;
 }
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 965cc45b58dc..2181d2e4a26d 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -838,7 +838,7 @@ stdenv.mkDerivation (
       in
       "remove-references-to ${lib.concatMapStringsSep " " (o: "-t ${o}") toStrip} config.h";
 
-    __structuredAttrs = versionAtLeast version "9";
+    __structuredAttrs = true;
     strictDeps = true;
 
     nativeBuildInputs = [
diff --git a/pkgs/development/libraries/fmt/default.nix b/pkgs/development/libraries/fmt/default.nix
index 538d53284787..641a91d75629 100644
--- a/pkgs/development/libraries/fmt/default.nix
+++ b/pkgs/development/libraries/fmt/default.nix
@@ -103,7 +103,16 @@ in
   };
 
   fmt_12 = generic {
-    version = "12.1.0";
-    hash = "sha256-ZmI1Dv0ZabPlxa02OpERI47jp7zFfjpeWCy1WyuPYZ0=";
+    version = "12.2.0";
+    hash = "sha256-Tc7PmNxUv7ajw6GaHPGEEtrD/fl6is7RB8TPestJa1o=";
+
+    patches = lib.optionals stdenv.is32bit [
+      # fix build on 32-bit targets
+      # FIXME: remove in next update
+      (fetchpatch {
+        url = "https://github.com/fmtlib/fmt/commit/588b3a0f8f6a8bcf2a959cae882d5b2703e86737.patch";
+        hash = "sha256-DiE3nwYrtNDJ6cqYreU499Y0auH6dsAW21TRPe16Tx8=";
+      })
+    ];
   };
 }
diff --git a/pkgs/development/libraries/gstreamer/base/default.nix b/pkgs/development/libraries/gstreamer/base/default.nix
index 69848aa4973f..4415abbd5931 100644
--- a/pkgs/development/libraries/gstreamer/base/default.nix
+++ b/pkgs/development/libraries/gstreamer/base/default.nix
@@ -17,7 +17,7 @@
   isocodes,
   libjpeg,
   libpng,
-  tremor, # provides 'virbisidec'
+  libvorbis,
   libGL,
   withIntrospection ?
     lib.meta.availableOn stdenv.hostPlatform gobject-introspection
@@ -98,7 +98,7 @@ stdenv.mkDerivation (finalAttrs: {
     isocodes
     libpng
     libjpeg
-    tremor
+    libvorbis
     pango
   ]
   ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
@@ -143,6 +143,8 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonEnable "introspection" withIntrospection)
     (lib.mesonEnable "doc" enableDocumentation)
     (lib.mesonEnable "libvisual" false)
+    (lib.mesonEnable "tremor" false) # unmaintained in nixpkgs, just use regular libvorbis instead
+    (lib.mesonEnable "vorbis" true)
   ]
   ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
     "-Dtests=disabled"
diff --git a/pkgs/development/libraries/gstreamer/libav/default.nix b/pkgs/development/libraries/gstreamer/libav/default.nix
index 92c906d4c1a9..3714fb286d9c 100644
--- a/pkgs/development/libraries/gstreamer/libav/default.nix
+++ b/pkgs/development/libraries/gstreamer/libav/default.nix
@@ -9,7 +9,8 @@
   gstreamer,
   gst-plugins-base,
   gettext,
-  ffmpeg-headless,
+  # FIXME: unpin when upstream supports ffmpeg 9
+  ffmpeg_8-headless,
   # Checks meson.is_cross_build(), so even canExecute isn't enough.
   enableDocumentation ? stdenv.hostPlatform == stdenv.buildPlatform,
   hotdoc,
@@ -50,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     gstreamer
     gst-plugins-base
-    ffmpeg-headless
+    ffmpeg_8-headless
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     apple-sdk_gstreamer
diff --git a/pkgs/development/libraries/libva/default.nix b/pkgs/development/libraries/libva/default.nix
index d8b9cb278773..f3e996ec48ae 100644
--- a/pkgs/development/libraries/libva/default.nix
+++ b/pkgs/development/libraries/libva/default.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libva" + lib.optionalString minimal "-minimal";
-  version = "2.24.0";
+  version = "2.24.1";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "libva";
     rev = finalAttrs.version;
-    sha256 = "sha256-NDh8XI1JJPegDXO2nH2XKVywp25Su/ytgR1OHI7nvdI=";
+    sha256 = "sha256-kgFvqyUlBZApc8D2i3BX6bHkUVNon5bL4asZ9myhQEM=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/libxcrypt/default.nix b/pkgs/development/libraries/libxcrypt/default.nix
index 4387d24a61e4..c648cc46383a 100644
--- a/pkgs/development/libraries/libxcrypt/default.nix
+++ b/pkgs/development/libraries/libxcrypt/default.nix
@@ -97,6 +97,8 @@ stdenv.mkDerivation (finalAttrs: {
     ];
   };
 
+  __structuredAttrs = true;
+
   meta = {
     changelog = "https://github.com/besser82/libxcrypt/blob/v${finalAttrs.version}/NEWS";
     description = "Extended crypt library for descrypt, md5crypt, bcrypt, and others";
diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index 1c4a1b08f1fd..dcadbf7d405c 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -59,7 +59,8 @@
   enableVtk ? false,
   vtk,
   enableFfmpeg ? true,
-  ffmpeg-headless,
+  # FIXME: unpin once upstream has ffmpeg 9 support
+  ffmpeg_8-headless,
   enableGStreamer ? true,
   elfutils,
   gst_all_1,
@@ -386,7 +387,7 @@ effectiveStdenv.mkDerivation {
     openjpeg
   ]
   ++ optionals enableFfmpeg [
-    ffmpeg-headless
+    ffmpeg_8-headless
   ]
   ++ optionals (enableGStreamer && effectiveStdenv.hostPlatform.isLinux) [
     elfutils
diff --git a/pkgs/development/libraries/protobuf/fix-BoolKeys-test-on-be.patch b/pkgs/development/libraries/protobuf/fix-BoolKeys-test-on-be.patch
new file mode 100644
index 000000000000..b8eaa6e94d73
--- /dev/null
+++ b/pkgs/development/libraries/protobuf/fix-BoolKeys-test-on-be.patch
@@ -0,0 +1,32 @@
+From 02774a2aea957c552383cc6cae43076f5436d867 Mon Sep 17 00:00:00 2001
+From: Sai Sindhuri Avulamanda <sai.sindhuri.avulamanda@ibm.com>
+Date: Wed, 11 Feb 2026 11:00:05 +0530
+Subject: [PATCH] Fix BoolKeys test to use integer-to-bool cast
+
+Signed-off-by: saisindhuri91 <Sai.Sindhuri.Avulamanda@ibm.com>
+---
+ upb/hash/test.cc | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/upb/hash/test.cc b/upb/hash/test.cc
+index 546df9d71c1f0..fcb7deaa8e4bc 100644
+--- a/upb/hash/test.cc
++++ b/upb/hash/test.cc
+@@ -336,7 +336,7 @@ TEST(IntTableTest, BoolKeys) {
+   // First element.
+   EXPECT_TRUE(upb_inttable_next(&t, &key, &val, &iter));
+   bool key_bool;
+-  memcpy(&key_bool, &key, sizeof(key_bool));
++  key_bool = static_cast<bool>(key);
+   EXPECT_EQ(key_bool, false);
+   EXPECT_EQ(upb_inttable_iter_key(&t, iter), false);
+   EXPECT_EQ(val.val, true);
+@@ -345,7 +345,7 @@ TEST(IntTableTest, BoolKeys) {
+ 
+   // Second element.
+   EXPECT_TRUE(upb_inttable_next(&t, &key, &val, &iter));
+-  memcpy(&key_bool, &key, sizeof(key_bool));
++  key_bool = static_cast<bool>(key);
+   EXPECT_EQ(key_bool, true);
+   EXPECT_EQ(upb_inttable_iter_key(&t, iter), true);
+   EXPECT_EQ(val.val, false);
diff --git a/pkgs/development/libraries/protobuf/generic.nix b/pkgs/development/libraries/protobuf/generic.nix
index b5efadf53ab3..9b9301fef135 100644
--- a/pkgs/development/libraries/protobuf/generic.nix
+++ b/pkgs/development/libraries/protobuf/generic.nix
@@ -73,6 +73,8 @@ stdenv.mkDerivation (finalAttrs: {
         url = "https://github.com/protocolbuffers/protobuf/commit/8282f0f8ecf8b847e5964a308e041ba3b049811c.patch";
         hash = "sha256-4c/yLuAd29Cxrz6I9F2Lj02lW2bazIcGb+86uxZY7qA=";
       })
+    ]
+    ++ lib.optionals ((lib.versionAtLeast version "33") && (lib.versionOlder version "36")) [
       # Fix packed enum decoding on big-endian platforms
       # https://github.com/protocolbuffers/protobuf/pull/25683
       ./fix-upb-packed-enum-be.patch
@@ -83,6 +85,10 @@ stdenv.mkDerivation (finalAttrs: {
       # entries in `linkarr_upb_AllExts` during test builds.
       # Context: https://github.com/protocolbuffers/protobuf/issues/21021
       ./fix-upb-linkarr-sentinel-init.patch
+
+      # Fix BoolKeys test on big-endian
+      # https://github.com/protocolbuffers/protobuf/pull/25862
+      ./fix-BoolKeys-test-on-be.patch
     ];
 
   postPatch =
diff --git a/pkgs/development/libraries/tpm2-tss/default.nix b/pkgs/development/libraries/tpm2-tss/default.nix
index 6bf372a5dd92..e910c11533bd 100644
--- a/pkgs/development/libraries/tpm2-tss/default.nix
+++ b/pkgs/development/libraries/tpm2-tss/default.nix
@@ -31,13 +31,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tpm2-tss";
-  version = "4.1.3";
+  version = "4.2.0";
 
   src = fetchFromGitHub {
     owner = "tpm2-software";
     repo = finalAttrs.pname;
     rev = finalAttrs.version;
-    hash = "sha256-BP28utEUI9g1VNv3lCXuiKrDtEImFQxxZfIjLiE3Wr8=";
+    hash = "sha256-MNrVKoA2sW3wKaQsq27UtakzdKmfirtDCoPWu0EEndw=";
   };
 
   outputs = [
@@ -87,17 +87,6 @@ stdenv.mkDerivation (finalAttrs: {
     # Do not rely on dynamic loader path
     # TCTI loader relies on dlopen(), this patch prefixes all calls with the output directory
     ./no-dynamic-loader-path.patch
-
-    # Configure script expects tools from shadow (e.g. useradd) but they are
-    # actually optional (and we can’t use them in Nix sandbox anyway). Make the
-    # check in configure.ac a warning instead of an error so that we can run
-    # configure phase on platforms that don’t have shadow package (e.g. macOS).
-    # Note that *on platforms* does not mean *for platform* i.e. this is for
-    # cross-compilation, tpm2-tss does not support macOS, see upstream issue:
-    # https://github.com/tpm2-software/tpm2-tss/issues/2629
-    # See also
-    # https://github.com/tpm2-software/tpm2-tss/blob/6c46325b466f35d40c2ed1043bfdfcfb8a367a34/Makefile.am#L880-L898
-    ./no-shadow.patch
   ];
 
   postPatch = ''
@@ -115,11 +104,6 @@ stdenv.mkDerivation (finalAttrs: {
     done
     substituteInPlace src/tss2-fapi/ifapi_config.c \
       --replace-fail 'SYSCONFDIR' '"/etc"'
-
-    # https://github.com/tpm2-software/tpm2-tss/pull/3041
-    substituteInPlace test/unit/tcti-libtpms.c \
-      --replace-fail 'check_expected_ptr(st);' 'check_expected(st);' \
-      --replace-fail 'check_expected_ptr(buf_len);' 'check_expected(buf_len);'
   ''
   # tcti tests rely on mocking function calls, which appears not to be supported
   # on clang
diff --git a/pkgs/development/libraries/tpm2-tss/no-dynamic-loader-path.patch b/pkgs/development/libraries/tpm2-tss/no-dynamic-loader-path.patch
index fcbfaca299fd..a2eedd60a937 100644
--- a/pkgs/development/libraries/tpm2-tss/no-dynamic-loader-path.patch
+++ b/pkgs/development/libraries/tpm2-tss/no-dynamic-loader-path.patch
@@ -1,8 +1,6 @@
-diff --git a/src/tss2-tcti/tctildr-dl.c b/src/tss2-tcti/tctildr-dl.c
-index d26219d2..92d2b6a3 100644
 --- a/src/tss2-tcti/tctildr-dl.c
 +++ b/src/tss2-tcti/tctildr-dl.c
-@@ -88,14 +88,24 @@ handle_from_name(const char *file,
+@@ -84,14 +84,24 @@
      const char *formats[] = {
          /* <name> */
          "%s",
@@ -27,479 +25,457 @@ index d26219d2..92d2b6a3 100644
      };
  
      if (handle == NULL) {
-diff --git a/test/unit/tctildr-dl.c b/test/unit/tctildr-dl.c
-index 135e1b14..7d654d1f 100644
 --- a/test/unit/tctildr-dl.c
 +++ b/test/unit/tctildr-dl.c
-@@ -168,6 +168,10 @@ test_handle_from_name_second_dlopen_success (void **state)
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+@@ -153,6 +153,9 @@
+     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_A);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
- 
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" TEST_TCTI_TRY_A);
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_B);
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, TEST_HANDLE);
-@@ -186,10 +190,18 @@ test_handle_from_name_third_dlopen_success (void **state)
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
  
+     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_B);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+@@ -170,10 +173,16 @@
+     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_A);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" TEST_TCTI_TRY_A);
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_B);
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
  
+     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_B);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" TEST_TCTI_TRY_B);
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_C);
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, TEST_HANDLE);
-@@ -208,14 +220,26 @@ test_handle_from_name_fourth_dlopen_success (void **state)
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
  
+     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_C);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+@@ -191,14 +200,23 @@
+     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_A);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" TEST_TCTI_TRY_A);
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
-+
+ 
      expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_B);
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
- 
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" TEST_TCTI_TRY_B);
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_C);
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
  
+     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_C);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" TEST_TCTI_TRY_C);
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_D);
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, TEST_HANDLE);
-@@ -234,18 +258,34 @@ test_handle_from_name_fifth_dlopen_success (void **state)
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
  
+     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_D);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+@@ -216,18 +234,30 @@
+     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_A);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" TEST_TCTI_TRY_A);
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
-+
+ 
      expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_B);
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
- 
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" TEST_TCTI_TRY_B);
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
-+
+ 
      expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_C);
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
- 
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" TEST_TCTI_TRY_C);
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_D);
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
  
+     expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_D);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" TEST_TCTI_TRY_D);
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
-+
+ 
      expect_string(__wrap_dlopen, filename, TEST_TCTI_TRY_E);
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, TEST_HANDLE);
-@@ -281,22 +321,42 @@ test_get_info_default_success (void **state)
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
- 
-+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-default.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
-+    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-default.so.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
- 
-+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-default.so.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
-+    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-default.so.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
- 
-+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-default.so.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
-+    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-default.so.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
- 
-+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-default.so.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
-+    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-default.so.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
- 
-+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-default.so.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
-+    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, "libtss2-tcti-tabrmd.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, HANDLE);
-@@ -321,22 +381,42 @@ test_get_info_default_info_fail (void **state)
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
- 
-+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-default.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
-+    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-default.so.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
- 
-+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-default.so.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
-+    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-default.so.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
- 
-+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-default.so.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
-+    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-default.so.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
- 
-+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-default.so.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
-+    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-default.so.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, NULL);
- 
-+    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-default.so.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
-+    will_return(__wrap_dlopen, NULL);
-+
-     expect_string(__wrap_dlopen, filename, "libtss2-tcti-tabrmd.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
-     will_return(__wrap_dlopen, HANDLE);
-@@ -483,120 +563,225 @@ test_tcti_fail_all (void **state)
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+@@ -265,22 +295,37 @@
      expect_string(__wrap_dlopen, filename, "libtss2-tcti-default.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-default.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
+ 
      expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-default.so.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-default.so.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
+ 
      expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-default.so.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-default.so.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
+ 
      expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-default.so.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-default.so.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
+ 
      expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-default.so.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-default.so.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
++    will_return(__wrap_dlopen, NULL);
+ 
+     expect_string(__wrap_dlopen, filename, "libtss2-tcti-tabrmd.so.0");
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+@@ -306,22 +351,37 @@
+     expect_string(__wrap_dlopen, filename, "libtss2-tcti-default.so");
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
++    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-default.so");
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
++    will_return(__wrap_dlopen, NULL);
+ 
+     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-default.so.so.0");
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
++    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-default.so.so.0");
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
++    will_return(__wrap_dlopen, NULL);
+ 
+     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-default.so.so");
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
++    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-default.so.so");
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
++    will_return(__wrap_dlopen, NULL);
+ 
+     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-default.so.so.0");
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
++    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-default.so.so.0");
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
++    will_return(__wrap_dlopen, NULL);
+ 
+     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-default.so.so");
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
++    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-default.so.so");
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
++    will_return(__wrap_dlopen, NULL);
+ 
+     expect_string(__wrap_dlopen, filename, "libtss2-tcti-tabrmd.so.0");
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+@@ -463,120 +523,225 @@
+     expect_string(__wrap_dlopen, filename, "libtss2-tcti-default.so");
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
++    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-default.so");
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
++    will_return(__wrap_dlopen, NULL);
+     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-default.so.so.0");
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
++    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-default.so.so.0");
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
++    will_return(__wrap_dlopen, NULL);
+     expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-default.so.so");
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
++    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-default.so.so");
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
++    will_return(__wrap_dlopen, NULL);
+     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-default.so.so.0");
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
++    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-default.so.so.0");
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
++    will_return(__wrap_dlopen, NULL);
+     expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-default.so.so");
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
+     will_return(__wrap_dlopen, NULL);
++    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-default.so.so");
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
  
      /* Skip over libtss2-tcti-tabrmd.so */
      expect_string(__wrap_dlopen, filename, "libtss2-tcti-tabrmd.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-tabrmd.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-tabrmd.so.0.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-tabrmd.so.0.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-tabrmd.so.0.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-tabrmd.so.0.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-tabrmd.so.0.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-tabrmd.so.0.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-tabrmd.so.0.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-tabrmd.so.0.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
  
      /* Skip over libtss2-tcti-device.so, /dev/tpmrm0 */
      expect_string(__wrap_dlopen, filename, "libtss2-tcti-device.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-device.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-device.so.0.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-device.so.0.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-device.so.0.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-device.so.0.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-device.so.0.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-device.so.0.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-device.so.0.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-device.so.0.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
  
      /* Skip over libtss2-tcti-device.so, /dev/tpm0 */
      expect_string(__wrap_dlopen, filename, "libtss2-tcti-device.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-device.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-device.so.0.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-device.so.0.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-device.so.0.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-device.so.0.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-device.so.0.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-device.so.0.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-device.so.0.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-device.so.0.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
  
      /* Skip over libtss2-tcti-device.so, /dev/tcm0 */
      expect_string(__wrap_dlopen, filename, "libtss2-tcti-device.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-device.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-device.so.0.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-device.so.0.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-device.so.0.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-device.so.0.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-device.so.0.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-device.so.0.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-device.so.0.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-device.so.0.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
  
      /* Skip over libtss2-tcti-swtpm.so */
      expect_string(__wrap_dlopen, filename, "libtss2-tcti-swtpm.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-swtpm.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-swtpm.so.0.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-swtpm.so.0.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-swtpm.so.0.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-swtpm.so.0.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-swtpm.so.0.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-swtpm.so.0.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-swtpm.so.0.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-swtpm.so.0.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
  
      /* Skip over libtss2-tcti-mssim.so */
      expect_string(__wrap_dlopen, filename, "libtss2-tcti-mssim.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-mssim.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-mssim.so.0.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-mssim.so.0.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-tcti-libtss2-tcti-mssim.so.0.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-libtss2-tcti-mssim.so.0.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-mssim.so.0.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-mssim.so.0.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-libtss2-tcti-mssim.so.0.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-libtss2-tcti-mssim.so.0.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
  
-     TSS2_RC r;
+     TSS2_RC            r;
      TSS2_TCTI_CONTEXT *tcti;
-@@ -619,18 +804,33 @@ test_info_from_name_handle_fail (void **state)
+@@ -597,18 +762,33 @@
      expect_string(__wrap_dlopen, filename, "foo");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "foo");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-tcti-foo.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-foo.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-tcti-foo.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-foo.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-foo.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-foo.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-foo.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-foo.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
  
-     TSS2_RC rc = info_from_name ("foo", &info, &data);
-     assert_int_equal (rc, TSS2_TCTI_RC_NOT_SUPPORTED);
-@@ -741,18 +941,33 @@ test_tctildr_get_info_from_name (void **state)
+     TSS2_RC rc = info_from_name("foo", &info, &data);
+     assert_int_equal(rc, TSS2_TCTI_RC_NOT_SUPPORTED);
+@@ -719,18 +899,33 @@
      expect_string(__wrap_dlopen, filename, "foo");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "foo");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-tcti-foo.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-foo.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-tcti-foo.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-tcti-foo.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-foo.so.0");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-foo.so.0");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
      expect_string(__wrap_dlopen, filename, "libtss2-foo.so");
-     expect_value(__wrap_dlopen, flags, RTLD_NOW);
+     expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
      will_return(__wrap_dlopen, NULL);
 +    expect_string(__wrap_dlopen, filename, "@PREFIX@" "libtss2-foo.so");
-+    expect_value(__wrap_dlopen, flags, RTLD_NOW);
++    expect_int_value(__wrap_dlopen, flags, RTLD_NOW);
 +    will_return(__wrap_dlopen, NULL);
  
-     TSS2_RC rc = tctildr_get_info ("foo", &info, &data);
-     assert_int_equal (rc, TSS2_TCTI_RC_NOT_SUPPORTED);
+     TSS2_RC rc = tctildr_get_info("foo", &info, &data);
+     assert_int_equal(rc, TSS2_TCTI_RC_NOT_SUPPORTED);
diff --git a/pkgs/development/libraries/tpm2-tss/no-shadow.patch b/pkgs/development/libraries/tpm2-tss/no-shadow.patch
deleted file mode 100644
index a42bf06771d0..000000000000
--- a/pkgs/development/libraries/tpm2-tss/no-shadow.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/configure.ac b/configure.ac
-index e2d579b8..0eac4ff3 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -672,9 +672,9 @@ AS_IF([test "$HOSTOS" = "Linux" && test "x$systemd_sysusers" != "xyes"],
-       AC_CHECK_PROG(adduser, adduser, yes)
-       AC_CHECK_PROG(addgroup, addgroup, yes)
-       AS_IF([test "x$addgroup" != "xyes" && test "x$groupadd" != "xyes" ],
--         [AC_MSG_ERROR([addgroup or groupadd are needed.])])
-+         [AC_MSG_WARN([addgroup or groupadd are needed.])])
-       AS_IF([test "x$adduser" != "xyes" && test "x$useradd" != "xyes" ],
--         [AC_MSG_ERROR([adduser or useradd are needed.])])])
-+         [AC_MSG_WARN([adduser or useradd are needed.])])])
- 
- AC_SUBST([PATH])
- 
diff --git a/pkgs/development/lua-modules/luv/lib.nix b/pkgs/development/lua-modules/luv/lib.nix
index d13961b8259e..d6e6933d4817 100644
--- a/pkgs/development/lua-modules/luv/lib.nix
+++ b/pkgs/development/lua-modules/luv/lib.nix
@@ -13,7 +13,8 @@ stdenv.mkDerivation {
   inherit (lua.pkgs.luv) version src meta;
 
   cmakeFlags = [
-    "-DBUILD_SHARED_LIBS=ON"
+    (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
+    (lib.cmakeBool "BUILD_STATIC_LIBS" stdenv.hostPlatform.isStatic)
     "-DBUILD_MODULE=OFF"
     "-DWITH_SHARED_LIBUV=ON"
     "-DLUA_BUILD_TYPE=System"
@@ -30,10 +31,7 @@ stdenv.mkDerivation {
     lua
   ];
 
-  nativeBuildInputs = [
-    cmake
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ fixDarwinDylibNames ];
+  nativeBuildInputs = [ cmake ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ fixDarwinDylibNames ];
 
   passthru.tests = {
     # Test luv too
diff --git a/pkgs/development/python-modules/cryptography/default.nix b/pkgs/development/python-modules/cryptography/default.nix
index f0560b576078..2fedc1d11f32 100644
--- a/pkgs/development/python-modules/cryptography/default.nix
+++ b/pkgs/development/python-modules/cryptography/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   stdenv,
-  fetchpatch,
   buildPythonPackage,
   callPackage,
   setuptools,
@@ -22,30 +21,21 @@
 
 buildPythonPackage rec {
   pname = "cryptography";
-  version = "49.0.0";
+  version = "50.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pyca";
     repo = "cryptography";
     tag = version;
-    hash = "sha256-yHUIGauFZYnjcoROvocT1UqQ0B8ZuVTaJ0ZAfri6T1E=";
+    hash = "sha256-KHxEVSYr8yrODSVsGNgZowI/YnhG3qnFgae9877H+VE=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-yMCBu/RGRcEQST8tEWCNgVvlQsp2KamOqt60qvOYdt8=";
+    hash = "sha256-heJGLh0MgDPpksWyPLaIkZ5gVEWx8UnaJKv4GvclpmI=";
   };
 
-  patches = [
-    (fetchpatch {
-      # Add test marks where malloc failure is expected on systems with overcommit enabled
-      name = "malloc-overcommit-mark.patch";
-      url = "https://github.com/pyca/cryptography/commit/2efeba9cc67809b67e659bea8eaea680df2135e8.patch";
-      hash = "sha256-06Z+sk2JTJ50CCnPf2vXyPL5BZeI98oc43LpccenzNg=";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail "--benchmark-disable" ""
diff --git a/pkgs/development/python-modules/django/5.nix b/pkgs/development/python-modules/django/5.nix
index 74dff79704f1..d9ec648838c7 100644
--- a/pkgs/development/python-modules/django/5.nix
+++ b/pkgs/development/python-modules/django/5.nix
@@ -41,14 +41,14 @@
 
 buildPythonPackage rec {
   pname = "django";
-  version = "5.2.16";
+  version = "5.2.17";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "django";
     repo = "django";
     tag = version;
-    hash = "sha256-DZa3OkqnrgXp1A/HerKYdUdanvi5jxHndo1DV4RVs0M=";
+    hash = "sha256-7it3opzsiN/hHhpipZz4ogmRKGz7E9/LmTF03/UYIB0=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/gitpython/default.nix b/pkgs/development/python-modules/gitpython/default.nix
index d612c47d5830..2b5b14a297b5 100644
--- a/pkgs/development/python-modules/gitpython/default.nix
+++ b/pkgs/development/python-modules/gitpython/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "gitpython";
-  version = "3.1.51";
+  version = "3.1.58";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "gitpython-developers";
     repo = "GitPython";
     tag = finalAttrs.version;
-    hash = "sha256-c8tjBvWjVR7krR59Tfx5jKoJc/fcLWVt5D4xk15DvP4=";
+    hash = "sha256-C6hrN7SRWngwkD/NYvsoEVQUagdurkxzWbnn42EJOHE=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/grpcio-channelz/default.nix b/pkgs/development/python-modules/grpcio-channelz/default.nix
index a3f96b4f0b39..6741c9d8bc80 100644
--- a/pkgs/development/python-modules/grpcio-channelz/default.nix
+++ b/pkgs/development/python-modules/grpcio-channelz/default.nix
@@ -12,13 +12,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-channelz";
-  version = "1.82.1";
+  version = "1.83.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "grpcio_channelz";
     inherit version;
-    hash = "sha256-/Q6lQDfasOu4BAaiqH6AmyTUEKLp209mL6IqKZ8AUOs=";
+    hash = "sha256-gaqgIn5UGWGvsnhNNcmWO9sPdmtGQ9JAODmBeKYc9lw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/grpcio-health-checking/default.nix b/pkgs/development/python-modules/grpcio-health-checking/default.nix
index ab1c0bb04f81..ef962e09a7a2 100644
--- a/pkgs/development/python-modules/grpcio-health-checking/default.nix
+++ b/pkgs/development/python-modules/grpcio-health-checking/default.nix
@@ -11,13 +11,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-health-checking";
-  version = "1.82.1";
+  version = "1.83.0";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "grpcio_health_checking";
     inherit version;
-    hash = "sha256-hiVeBOHTnxyXpmMtQbYySTUUCN5cWOhe7eh6/X2YKN0=";
+    hash = "sha256-rWvE1aEQOtcE0lzNgt7zAN+ieZaxhcqz5Mzu7yxoZ9Q=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/grpcio-reflection/default.nix b/pkgs/development/python-modules/grpcio-reflection/default.nix
index 7d28689e7ee0..d697034b9bb0 100644
--- a/pkgs/development/python-modules/grpcio-reflection/default.nix
+++ b/pkgs/development/python-modules/grpcio-reflection/default.nix
@@ -12,13 +12,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-reflection";
-  version = "1.82.1";
+  version = "1.83.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "grpcio_reflection";
     inherit version;
-    hash = "sha256-LslD6tPhe0P44HR6XLQXs6ZDV/49m0p73Dmkwz6pgA0=";
+    hash = "sha256-aiowpGKsLDxtFJc0qP5lX6dhfBf6LNqZSQBvO/B/Wz4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/grpcio-status/default.nix b/pkgs/development/python-modules/grpcio-status/default.nix
index 479a1e105efb..57e252eae475 100644
--- a/pkgs/development/python-modules/grpcio-status/default.nix
+++ b/pkgs/development/python-modules/grpcio-status/default.nix
@@ -12,13 +12,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-status";
-  version = "1.82.1";
+  version = "1.83.0";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "grpcio_status";
     inherit version;
-    hash = "sha256-2d6Kw0djzUaBMP3SkjKUr3w9KNCUJvbEUiHSfCWTETA=";
+    hash = "sha256-g3IZxt6a/cy29vcrNLxx4VGiAR7wQEDj+qynRqV+VK4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/grpcio-testing/default.nix b/pkgs/development/python-modules/grpcio-testing/default.nix
index 59f7e88b533e..9f0f81ecb5b8 100644
--- a/pkgs/development/python-modules/grpcio-testing/default.nix
+++ b/pkgs/development/python-modules/grpcio-testing/default.nix
@@ -12,13 +12,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-testing";
-  version = "1.82.1";
+  version = "1.83.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "grpcio_testing";
     inherit version;
-    hash = "sha256-2fxmLSRf10IpLQOJkCQtDdDmkvAKAvIQvRI0FFzxM0E=";
+    hash = "sha256-/6p6o+ckGsNXDBePfNbpRYEUK1Eh60esk5g+1gfwa90=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/grpcio-tools/default.nix b/pkgs/development/python-modules/grpcio-tools/default.nix
index 9d4d7f1bc435..0274dd2ead83 100644
--- a/pkgs/development/python-modules/grpcio-tools/default.nix
+++ b/pkgs/development/python-modules/grpcio-tools/default.nix
@@ -13,13 +13,13 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio-tools";
-  version = "1.82.1";
+  version = "1.83.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "grpcio_tools";
     inherit version;
-    hash = "sha256-K9MXbM2/fNH0Y+t1t7g1RMfWQp9cqKD394S3YJfayJE=";
+    hash = "sha256-UVkHJl0U+pl10MdyP5Wp2gFGPXrGB1RqA/h0H4ahuwc=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/grpcio/default.nix b/pkgs/development/python-modules/grpcio/default.nix
index 9f22f9b94416..3f39101e34d8 100644
--- a/pkgs/development/python-modules/grpcio/default.nix
+++ b/pkgs/development/python-modules/grpcio/default.nix
@@ -18,12 +18,12 @@
 # nixpkgs-update: no auto update
 buildPythonPackage rec {
   pname = "grpcio";
-  version = "1.82.1";
+  version = "1.83.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-cHskq9kPyx5FvMCAV32h2/mXHRB0kFiblTmvjh53tLU=";
+    hash = "sha256-dnRYckj7uyrG5O7Pg6ig89kako+UHeVxrP06LwB/vCQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/imap-tools/default.nix b/pkgs/development/python-modules/imap-tools/default.nix
index 0fa04d23c463..a7d349b0d16f 100644
--- a/pkgs/development/python-modules/imap-tools/default.nix
+++ b/pkgs/development/python-modules/imap-tools/default.nix
@@ -30,6 +30,10 @@ buildPythonPackage (finalAttrs: {
     "test_folders"
     "test_idle"
     "test_live"
+    # broken on Python 3.14.7
+    # reported upstream: https://github.com/ikvk/imap_tools/issues/271
+    "test_login_quotes_plain_username"
+    "test_login_quotes_username_with_special_chars"
   ];
 
   pythonImportsCheck = [ "imap_tools" ];
diff --git a/pkgs/development/python-modules/mediapy/default.nix b/pkgs/development/python-modules/mediapy/default.nix
index 1081b0cc331e..aca87a7276c9 100644
--- a/pkgs/development/python-modules/mediapy/default.nix
+++ b/pkgs/development/python-modules/mediapy/default.nix
@@ -9,7 +9,7 @@
   numpy,
   pillow,
   absl-py,
-  ffmpeg-headless,
+  ffmpeg_8-headless,
   pytestCheckHook,
 }:
 
@@ -41,7 +41,7 @@ buildPythonPackage (finalAttrs: {
 
   nativeCheckInputs = [
     absl-py
-    ffmpeg-headless
+    ffmpeg_8-headless
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/meson-python/default.nix b/pkgs/development/python-modules/meson-python/default.nix
index 15bb426b61ff..b618b5a5856a 100644
--- a/pkgs/development/python-modules/meson-python/default.nix
+++ b/pkgs/development/python-modules/meson-python/default.nix
@@ -51,18 +51,6 @@ buildPythonPackage rec {
 
   dontUseCmakeConfigure = true;
 
-  # meson-python respects MACOSX_DEPLOYMENT_TARGET, but compares it with the
-  # actual platform version during tests, which mismatches.
-  # https://github.com/mesonbuild/meson-python/issues/760
-  # FIXME: drop in 0.19.0
-  preCheck =
-    if stdenv.hostPlatform.isDarwin then
-      ''
-        unset MACOSX_DEPLOYMENT_TARGET
-      ''
-    else
-      null;
-
   setupHooks = [ ./add-build-flags.sh ];
 
   meta = {
diff --git a/pkgs/development/python-modules/oslo-log/default.nix b/pkgs/development/python-modules/oslo-log/default.nix
index c221fb175b4c..50bb52bcb7cb 100644
--- a/pkgs/development/python-modules/oslo-log/default.nix
+++ b/pkgs/development/python-modules/oslo-log/default.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
 
@@ -11,11 +10,11 @@
   debtcollector,
   oslo-config,
   oslo-context,
+  oslo-i18n,
   oslo-serialization,
   oslo-utils,
   pbr,
   python-dateutil,
-  pyinotify,
 
   # tests
   eventlet,
@@ -25,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "oslo-log";
-  version = "8.1.0";
+  version = "8.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "openstack";
     repo = "oslo.log";
     tag = version;
-    hash = "sha256-ThRJ2rfVStnVOwcu8ZaKDjqb4jT6YE+n+iOFtmR8rwQ=";
+    hash = "sha256-teESuCQg8fxCWPMUWTTYyBIGSn9m916Uoy3UkWArVVs=";
   };
 
   # Manually set version because prb wants to get it from the git upstream repository (and we are
@@ -45,12 +44,12 @@ buildPythonPackage rec {
     debtcollector
     oslo-config
     oslo-context
+    oslo-i18n
     oslo-serialization
     oslo-utils
     pbr
     python-dateutil
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isLinux [ pyinotify ];
+  ];
 
   nativeCheckInputs = [
     eventlet
@@ -59,11 +58,10 @@ buildPythonPackage rec {
   ];
 
   disabledTests = [
-    # not compatible with sandbox
-    "test_logging_handle_error"
     # Incompatible Exception Representation, displaying natively
-    "test_rate_limit"
-    "test_rate_limit_except_level"
+    "test_logging_handle_error"
+    "test_rotate_log"
+    "test_timed_rotate_log"
   ];
 
   pythonImportsCheck = [ "oslo_log" ];
diff --git a/pkgs/development/python-modules/python-pkcs11/default.nix b/pkgs/development/python-modules/python-pkcs11/default.nix
index cad6d6d32ca5..bca6d487117f 100644
--- a/pkgs/development/python-modules/python-pkcs11/default.nix
+++ b/pkgs/development/python-modules/python-pkcs11/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "python-pkcs11";
-  version = "0.9.3";
+  version = "0.9.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "danni";
     repo = "python-pkcs11";
     tag = "v${version}";
-    sha256 = "sha256-ursQHwyTUz4kCg66+Rnvo8bI3fzA3k9FsmbnUvpq/aY=";
+    hash = "sha256-9RVUtUe+Af5nTDaMeipdijLK4Un/SGRAQIztVKQZZzQ=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/tkinter/default.nix b/pkgs/development/python-modules/tkinter/default.nix
index 497a42e91c6c..78cf4fae1726 100644
--- a/pkgs/development/python-modules/tkinter/default.nix
+++ b/pkgs/development/python-modules/tkinter/default.nix
@@ -77,6 +77,10 @@ buildPythonPackage {
   preCheck = ''
     cd "$python_src"/Lib
     export HOME=$TMPDIR
+
+    # fix test that ignores PYTHONPATH and can't find tkinter
+    substituteInPlace test/support/script_helper.py \
+      --replace-fail "__cached_interp_requires_environment = None" "__cached_interp_requires_environment = True"
   ''
   + lib.optionalString (pythonAtLeast "3.13" && pythonOlder "3.15") ''
     # https://github.com/python/cpython/pull/143570
@@ -88,7 +92,7 @@ buildPythonPackage {
       test/test_tkinter/support.py \
         --replace-fail \
           "support.get_resource_value('wantobjects')" \
-          "0"
+          "1"
   '';
 
   checkPhase =
diff --git a/pkgs/development/python-modules/torchaudio/default.nix b/pkgs/development/python-modules/torchaudio/default.nix
index 34595c98d830..d32064e0da90 100644
--- a/pkgs/development/python-modules/torchaudio/default.nix
+++ b/pkgs/development/python-modules/torchaudio/default.nix
@@ -117,10 +117,6 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
   disabledTestPaths = [
     # Require internet access
     "test/integration_tests"
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    # Passes, but hangs the build after Pytest completes
-    "test/torchaudio_unittest/models/models_test.py::TestConvTasNet"
   ];
 
   disabledTests = [
@@ -140,6 +136,9 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
     "AutogradCPUTest"
     "TestAutogradLfilterCPU"
     "TestWav2Vec2Model"
+
+    # Massive RAM usage
+    "TestConvTasNet"
   ]
   ++ lib.optionals (hostPlatform.isLinux && hostPlatform.isAarch64) [
     # AssertionError: Tensor-likes are not close!
diff --git a/pkgs/development/python-modules/torchcodec/default.nix b/pkgs/development/python-modules/torchcodec/default.nix
index 8523ebbe076c..4fad1e12ec0f 100644
--- a/pkgs/development/python-modules/torchcodec/default.nix
+++ b/pkgs/development/python-modules/torchcodec/default.nix
@@ -8,7 +8,8 @@
   pkg-config,
 
   # buildInputs
-  ffmpeg,
+  # FIXME: unpin when upstream supports ffmpeg 9
+  ffmpeg_8,
 
   # build-system
   cmake,
@@ -45,17 +46,17 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
       test/test_encoders.py \
       --replace-fail \
         '"ffprobe"' \
-        '"${lib.getExe' ffmpeg "ffprobe"}"'
+        '"${lib.getExe' ffmpeg_8 "ffprobe"}"'
 
     substituteInPlace test/test_encoders.py \
       --replace-fail \
         '"ffmpeg"' \
-        '"${lib.getExe ffmpeg}"'
+        '"${lib.getExe ffmpeg_8}"'
 
     substituteInPlace test/test_transform_ops.py \
       --replace-fail \
         'ffmpeg_cli = "ffmpeg"' \
-        'ffmpeg_cli = "${lib.getExe ffmpeg}"'
+        'ffmpeg_cli = "${lib.getExe ffmpeg_8}"'
   '';
 
   nativeBuildInputs = [
@@ -69,7 +70,7 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
   ];
 
   buildInputs = [
-    ffmpeg
+    ffmpeg_8
   ]
   ++ lib.optionals cudaSupport (
     with cudaPackages;
diff --git a/pkgs/development/python-modules/tpm2-pytss/default.nix b/pkgs/development/python-modules/tpm2-pytss/default.nix
index 9c1fa30570b7..a389da6bef3d 100644
--- a/pkgs/development/python-modules/tpm2-pytss/default.nix
+++ b/pkgs/development/python-modules/tpm2-pytss/default.nix
@@ -24,50 +24,16 @@ let
 in
 buildPythonPackage rec {
   pname = "tpm2-pytss";
-  version = "2.3.0";
+  version = "3.0.0rc1";
   format = "setuptools";
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-IAcRKTeWVvXzw7wW02RhJnKxR9gRkftOufn/n77khBA=";
+    inherit version;
+    pname = "tpm2_pytss";
+    hash = "sha256-9Wj7RKjcjCzPqlsA4PxgVGQBvqQKuANG2tMb/cI3ihE=";
   };
 
   patches = [
-    # libtpms (underneath swtpm) bumped the TPM revision
-    # https://github.com/tpm2-software/tpm2-pytss/pull/593
-    (fetchpatch {
-      url = "https://github.com/tpm2-software/tpm2-pytss/pull/593.patch";
-      hash = "sha256-CNJnSIvUQ0Yvy0o7GdVfFZ7kHJd2hBt5Zv1lqgOeoks=";
-    })
-    # support cryptography >= 45.0.0
-    # https://github.com/tpm2-software/tpm2-pytss/pull/643
-    (fetchpatch {
-      url = "https://github.com/tpm2-software/tpm2-pytss/commit/6ab4c74e6fb3da7cd38e97c1f8e92532312f8439.patch";
-      hash = "sha256-01Qe4qpD2IINc5Z120iVdPitiLBwdr8KNBjLFnGgE7E=";
-    })
-    # support cryptography >= 47.0.0, which made __deepcopy__ an abstract
-    # method on the private-key base classes
-    # https://github.com/tpm2-software/tpm2-pytss/pull/689
-    (fetchpatch {
-      url = "https://github.com/tpm2-software/tpm2-pytss/commit/5d15cad4bde28902a4becb8e2a8e915aba8abbd0.patch";
-      hash = "sha256-b2zVD7KJGVzJ765HO8LFAe9MyQmjOTpERmEqUrIg3oM=";
-    })
-    # Properly restore environment variables upon exit from
-    # FAPIConfig context. Accepted into upstream, not yet released.
-    (fetchpatch2 {
-      url = "https://github.com/tpm2-software/tpm2-pytss/commit/afdee627d0639eb05711a2191f2f76e460793da9.patch?full_index=1";
-      hash = "sha256-Y6drcBg4gnbSvnCGw69b42Q/QfLI3u56BGRUEkpdB0M=";
-    })
-    # Fix build with gcc15 by using c99 for preprocessing
-    # The first patch is needed to apply the second; it doesn't affect us
-    (fetchpatch {
-      url = "https://github.com/tpm2-software/tpm2-pytss/commit/55d28b259f1a68f60c937ea8be7815685d32757f.patch";
-      hash = "sha256-sGxUyQ2W2Jl9ROSt1w0E0dVTgFPAmYWlNgcpHcTVv90=";
-    })
-    (fetchpatch {
-      url = "https://github.com/tpm2-software/tpm2-pytss/commit/61d00b4dcca131b3f03f674ceabf4260bdbd6a61.patch";
-      hash = "sha256-0dwfyW0Fi5FkzYnaMOb2ua9O6eyCnMgJqT09tTT56vY=";
-    })
   ]
   ++ lib.optionals isCross [
     # pytss will regenerate files from headers of tpm2-tss.
diff --git a/pkgs/development/python-modules/typing-inspection/default.nix b/pkgs/development/python-modules/typing-inspection/default.nix
index ce85c5b0d5b6..2da9cae3ad60 100644
--- a/pkgs/development/python-modules/typing-inspection/default.nix
+++ b/pkgs/development/python-modules/typing-inspection/default.nix
@@ -31,6 +31,12 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # broken by intentional 3.14.7 behavior change
+    # reported upstream: https://github.com/pydantic/typing-inspection/issues/55
+    "test_literal_values_unhashable_type"
+  ];
+
   meta = {
     changelog = "https://github.com/pydantic/typing-inspection/blob/${src.tag}/HISTORY.md";
     description = "Runtime typing introspection tools";
diff --git a/pkgs/development/python-modules/unidiff/default.nix b/pkgs/development/python-modules/unidiff/default.nix
index f3babe48eb5c..f70534eed63f 100644
--- a/pkgs/development/python-modules/unidiff/default.nix
+++ b/pkgs/development/python-modules/unidiff/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "unidiff";
-  version = "0.7.5";
+  version = "1.0.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    sha256 = "2e5f0162052248946b9f0970a40e9e124236bf86c82b70821143a6fc1dea2574";
+    sha256 = "sha256-Xl1c+rLcmL6Bm3R0erfZ9a+GlTaeyHELk/mrDwrmpEk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/zxing-cpp/default.nix b/pkgs/development/python-modules/zxing-cpp/default.nix
index 47e30e3667a2..d12b3db74505 100644
--- a/pkgs/development/python-modules/zxing-cpp/default.nix
+++ b/pkgs/development/python-modules/zxing-cpp/default.nix
@@ -1,14 +1,16 @@
 {
+  lib,
   buildPythonPackage,
   cmake,
-  setuptools-scm,
+  ninja,
+  scikit-build-core,
   numpy,
   pillow,
-  pybind11,
+  nanobind,
   libzxing-cpp,
-  pyprojectVersionPatchHook,
   pytestCheckHook,
   libzint,
+  python,
 }:
 
 buildPythonPackage {
@@ -18,32 +20,31 @@ buildPythonPackage {
 
   sourceRoot = "${libzxing-cpp.src.name}/wrappers/python";
 
-  # we don't need pybind11 in the root environment
-  # https://pybind11.readthedocs.io/en/stable/installing.html#include-with-pypi
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail "pybind11[global]" "pybind11"
-
-    substituteInPlace setup.py \
-      --replace-fail "cfg = 'Debug' if self.debug else 'Release'" "cfg = 'Release'" \
-      --replace-fail "f'-DPython_EXECUTABLE={sys.executable}'," "f'-DPython_EXECUTABLE={sys.executable}', '-DZXING_DEPENDENCIES=LOCAL', '-DZXING_USE_BUNDLED_ZINT=OFF',"
-  '';
-
   dontUseCmakeConfigure = true;
 
+  env = {
+    nanobind_DIR = "${nanobind}/${python.sitePackages}/nanobind/cmake";
+  };
+
+  cmakeFlags = [
+    (lib.cmakeBool "ZXING_USE_BUNDLED_ZINT" false)
+  ];
+
   build-system = [
-    setuptools-scm
-    pybind11
+    scikit-build-core
+    nanobind
   ];
 
   dependencies = [ numpy ];
 
   nativeBuildInputs = [
     cmake
-    pyprojectVersionPatchHook
+    ninja
   ];
 
-  buildInputs = [ libzint ];
+  buildInputs = [
+    libzint
+  ];
 
   nativeCheckInputs = [
     pillow
diff --git a/pkgs/development/rocm-modules/rocprofiler-register/default.nix b/pkgs/development/rocm-modules/rocprofiler-register/default.nix
index 0577493ae599..96b1ee7a90c9 100644
--- a/pkgs/development/rocm-modules/rocprofiler-register/default.nix
+++ b/pkgs/development/rocm-modules/rocprofiler-register/default.nix
@@ -44,6 +44,14 @@ stdenv.mkDerivation (finalAttrs: {
       hash = "sha256-VloRKV6kUzIfIInltx/bV1EM0FUfeQZrVAx6qgdsLyg=";
       relative = "projects/rocprofiler-register";
     })
+    (fetchpatch {
+      # fix(rocprofiler-sdk): include fmt/format.h instead of fmt/core.h for fmt::format
+      # fmt 12.2.0 changes the meaning of fmt/core.h so it no longer includes
+      # fmt::format, so this upstream commit switches to the correct header.
+      url = "https://github.com/ROCm/rocm-systems/commit/e2f588592ecfb0653ed5b3078753186325adf70a.patch";
+      hash = "sha256-ip/s7tmUptcXMen3fyQJYKiZKwoe3SH0XqTVb0YBA7k=";
+      relative = "projects/rocprofiler-register";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/rocm-modules/rocprofiler-sdk/0010-fmt-12.2.0-format.h.patch b/pkgs/development/rocm-modules/rocprofiler-sdk/0010-fmt-12.2.0-format.h.patch
new file mode 100644
index 000000000000..15d0b8e15ef9
--- /dev/null
+++ b/pkgs/development/rocm-modules/rocprofiler-sdk/0010-fmt-12.2.0-format.h.patch
@@ -0,0 +1,529 @@
+From 4a06d995696453b4c65217e0b11228112fb444be Mon Sep 17 00:00:00 2001
+From: Darren Lao <Darren.Lao@amd.com>
+Date: Wed, 22 Jul 2026 11:46:17 -0400
+Subject: [PATCH] fix(rocprofiler-sdk): include fmt/format.h instead of
+ fmt/core.h for fmt::format (#8203)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+## Motivation
+
+Since fmt v12.2.0, `<fmt/core.h>` was made equivalent to `<fmt/base.h>`
+by default (fmtlib/fmt@0007426c). `base.h` is a lightweight subset that
+no longer declares the `std::string`-returning `fmt::format` /
+`fmt::vformat`, which now live only in `<fmt/format.h>`.
+
+As a result, any source that does `#include <fmt/core.h>` and calls
+`fmt::format(...)` fails to compile against system fmt 12.2.0:
+
+```
+error: 'format' is not a member of 'fmt'
+```
+
+Resolves ROCm/rocm-systems#8183.
+
+## Technical Details
+
+Replace `#include <fmt/core.h>` with `#include <fmt/format.h>` in the
+files that call `fmt::format` / `fmt::vformat`, across
+`rocprofiler-register`, `rocprofiler-sdk`, and `profiler-hub` (44
+files).
+
+- Only files that use the format.h-only symbols are changed; files that
+use just `fmt::print` / `fmt::format_to` (satisfied by `base.h`) are
+left on `core.h`.
+- Where a file already included `<fmt/format.h>` next to `<fmt/core.h>`,
+the redundant `core.h` line is dropped.
+- The change is backward compatible: `<fmt/format.h>` is a strict
+superset of `<fmt/core.h>` and has provided `fmt::format` in every fmt
+version these components build against. Verified against the pinned
+submodule (fmt 11.1.4) and system fmt 12.2.0.
+
+## Test Plan
+
+Built each affected component against a locally-installed fmt 12.2.0,
+forcing the `find_package(fmt)` path (`*_BUILD_FMT=OFF`) that the report
+hits:
+
+- `rocprofiler-register` — full library build
+- `rocprofiler-sdk` — full object/shared libraries plus the changed test
+targets (`counter-tests`, `aql-test`, `parser-test`)
+- `profiler-hub` — full static + shared library build
+
+## Test Result
+
+- With the fix: all three components build cleanly against fmt 12.2.0 (0
+compile errors).
+
+## Submission Checklist
+
+- [x] Look over the contributing guidelines at
+https://github.com/ROCm/ROCm/blob/develop/CONTRIBUTING.md#pull-requests.
+
+---------
+---
+ source/lib/common/stringize_arg.hpp                             | 2 +-
+ source/lib/output/format_path.cpp                               | 2 +-
+ source/lib/output/generatePerfetto.cpp                          | 2 +-
+ source/lib/output/metadata.cpp                                  | 1 -
+ source/lib/output/metadata.hpp                                  | 2 +-
+ source/lib/output/output_stream.cpp                             | 1 -
+ source/lib/rocprofiler-sdk-rocpd/sql.cpp                        | 2 +-
+ source/lib/rocprofiler-sdk-tool/config.cpp                      | 2 +-
+ source/lib/rocprofiler-sdk-tool/tool.cpp                        | 2 +-
+ source/lib/rocprofiler-sdk/agent.cpp                            | 1 -
+ source/lib/rocprofiler-sdk/aql/helpers.cpp                      | 2 +-
+ source/lib/rocprofiler-sdk/aql/packet_construct.cpp             | 2 +-
+ source/lib/rocprofiler-sdk/counters.cpp                         | 2 +-
+ source/lib/rocprofiler-sdk/counters/evaluate_ast.cpp            | 2 +-
+ source/lib/rocprofiler-sdk/counters/metrics.hpp                 | 2 +-
+ source/lib/rocprofiler-sdk/counters/parser/raw_ast.hpp          | 2 +-
+ source/lib/rocprofiler-sdk/counters/parser/scanner.cpp          | 2 +-
+ source/lib/rocprofiler-sdk/counters/parser/scanner.l            | 2 +-
+ source/lib/rocprofiler-sdk/counters/tests/core.cpp              | 2 +-
+ source/lib/rocprofiler-sdk/counters/tests/device_counting.cpp   | 2 +-
+ source/lib/rocprofiler-sdk/counters/tests/dimension.cpp         | 2 +-
+ source/lib/rocprofiler-sdk/counters/tests/evaluate_ast_test.cpp | 2 +-
+ source/lib/rocprofiler-sdk/hip/utils.hpp                        | 2 +-
+ source/lib/rocprofiler-sdk/hsa/agent_cache.cpp                  | 2 +-
+ source/lib/rocprofiler-sdk/hsa/aql_packet.cpp                   | 2 +-
+ source/lib/rocprofiler-sdk/hsa/utils.hpp                        | 2 +-
+ source/lib/rocprofiler-sdk/kfd/kfd.cpp                          | 2 +-
+ source/lib/rocprofiler-sdk/marker/utils.hpp                     | 2 +-
+ source/lib/rocprofiler-sdk/ompt.cpp                             | 2 +-
+ source/lib/rocprofiler-sdk/ompt/utils.hpp                       | 2 +-
+ .../rocprofiler-sdk/pc_sampling/parser/pc_record_interface.hpp  | 2 +-
+ source/lib/rocprofiler-sdk/rocdecode/utils.hpp                  | 2 +-
+ source/lib/rocprofiler-sdk/tests/agent.cpp                      | 2 +-
+ 33 files changed, 30 insertions(+), 33 deletions(-)
+
+diff --git a/source/lib/common/stringize_arg.hpp b/source/lib/common/stringize_arg.hpp
+index d211fdd549..6b4b3ebdc5 100644
+--- a/source/lib/common/stringize_arg.hpp
++++ b/source/lib/common/stringize_arg.hpp
+@@ -25,7 +25,7 @@
+ #include "lib/common/container/small_vector.hpp"
+ #include "lib/common/mpl.hpp"
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <fmt/ranges.h>
+ 
+ #include <cstdint>
+diff --git a/source/lib/output/format_path.cpp b/source/lib/output/format_path.cpp
+index 19d6f14737..9e5816903f 100644
+--- a/source/lib/output/format_path.cpp
++++ b/source/lib/output/format_path.cpp
+@@ -35,7 +35,7 @@
+ 
+ #include <rocprofiler-sdk/cxx/details/tokenize.hpp>
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ #include <linux/limits.h>
+ #include <unistd.h>
+diff --git a/source/lib/output/generatePerfetto.cpp b/source/lib/output/generatePerfetto.cpp
+index 7935aae95a..998f05281f 100644
+--- a/source/lib/output/generatePerfetto.cpp
++++ b/source/lib/output/generatePerfetto.cpp
+@@ -33,7 +33,7 @@
+ #include <rocprofiler-sdk/cxx/operators.hpp>
+ #include <rocprofiler-sdk/cxx/perfetto.hpp>
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ #include <atomic>
+ #include <future>
+diff --git a/source/lib/output/metadata.cpp b/source/lib/output/metadata.cpp
+index abe9e00b50..f68d46de5b 100644
+--- a/source/lib/output/metadata.cpp
++++ b/source/lib/output/metadata.cpp
+@@ -41,7 +41,6 @@
+ #include <rocprofiler-sdk/rocprofiler.h>
+ #include <rocprofiler-sdk/cxx/details/tokenize.hpp>
+ 
+-#include <fmt/core.h>
+ #include <fmt/format.h>
+ 
+ #include <dlfcn.h>
+diff --git a/source/lib/output/metadata.hpp b/source/lib/output/metadata.hpp
+index 069401f962..a283896f29 100644
+--- a/source/lib/output/metadata.hpp
++++ b/source/lib/output/metadata.hpp
+@@ -45,7 +45,7 @@
+ #include <rocprofiler-sdk/cxx/name_info.hpp>
+ #include <rocprofiler-sdk/cxx/operators.hpp>
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ #include <cstdint>
+ #include <map>
+diff --git a/source/lib/output/output_stream.cpp b/source/lib/output/output_stream.cpp
+index 7c1307e5e7..fbfffe5014 100644
+--- a/source/lib/output/output_stream.cpp
++++ b/source/lib/output/output_stream.cpp
+@@ -25,7 +25,6 @@
+ #include "lib/common/filesystem.hpp"
+ #include "lib/common/logging.hpp"
+ 
+-#include <fmt/core.h>
+ #include <fmt/format.h>
+ 
+ #include <string_view>
+diff --git a/source/lib/rocprofiler-sdk-rocpd/sql.cpp b/source/lib/rocprofiler-sdk-rocpd/sql.cpp
+index b052ec51c3..7fd5421fe3 100644
+--- a/source/lib/rocprofiler-sdk-rocpd/sql.cpp
++++ b/source/lib/rocprofiler-sdk-rocpd/sql.cpp
+@@ -35,7 +35,7 @@
+ 
+ #include <rocprofiler-sdk/cxx/details/tokenize.hpp>
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <fmt/ranges.h>
+ 
+ #include <dlfcn.h>
+diff --git a/source/lib/rocprofiler-sdk-tool/config.cpp b/source/lib/rocprofiler-sdk-tool/config.cpp
+index f172d74c1b..35fff5b170 100644
+--- a/source/lib/rocprofiler-sdk-tool/config.cpp
++++ b/source/lib/rocprofiler-sdk-tool/config.cpp
+@@ -34,7 +34,7 @@
+ 
+ #include <rocprofiler-sdk/cxx/details/tokenize.hpp>
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ #include <linux/limits.h>
+ #include <unistd.h>
+diff --git a/source/lib/rocprofiler-sdk-tool/tool.cpp b/source/lib/rocprofiler-sdk-tool/tool.cpp
+index e36582550d..6ddb2274e5 100644
+--- a/source/lib/rocprofiler-sdk-tool/tool.cpp
++++ b/source/lib/rocprofiler-sdk-tool/tool.cpp
+@@ -78,7 +78,7 @@
+ #include <rocprofiler-sdk/cxx/hash.hpp>
+ #include <rocprofiler-sdk/cxx/operators.hpp>
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <fmt/ranges.h>
+ 
+ #include <time.h>
+diff --git a/source/lib/rocprofiler-sdk/agent.cpp b/source/lib/rocprofiler-sdk/agent.cpp
+index fe5af0c1d6..89b912b822 100644
+--- a/source/lib/rocprofiler-sdk/agent.cpp
++++ b/source/lib/rocprofiler-sdk/agent.cpp
+@@ -34,7 +34,6 @@
+ #include <rocprofiler-sdk/fwd.h>
+ #include <rocprofiler-sdk/cxx/details/tokenize.hpp>
+ 
+-#include <fmt/core.h>
+ #include <fmt/format.h>
+ #include <fmt/ranges.h>
+ #include <hsa/hsa.h>
+diff --git a/source/lib/rocprofiler-sdk/aql/helpers.cpp b/source/lib/rocprofiler-sdk/aql/helpers.cpp
+index 35842b1233..eaf7f5dd2a 100644
+--- a/source/lib/rocprofiler-sdk/aql/helpers.cpp
++++ b/source/lib/rocprofiler-sdk/aql/helpers.cpp
+@@ -30,7 +30,7 @@
+ 
+ #include <rocprofiler-sdk/fwd.h>
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ namespace rocprofiler
+ {
+diff --git a/source/lib/rocprofiler-sdk/aql/packet_construct.cpp b/source/lib/rocprofiler-sdk/aql/packet_construct.cpp
+index 3417bd090d..e51f103ff5 100644
+--- a/source/lib/rocprofiler-sdk/aql/packet_construct.cpp
++++ b/source/lib/rocprofiler-sdk/aql/packet_construct.cpp
+@@ -24,7 +24,7 @@
+ #include "lib/common/logging.hpp"
+ #include "lib/rocprofiler-sdk/hsa/details/fmt.hpp"
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <hsa/hsa_ext_amd.h>
+ #include "glog/logging.h"
+ 
+diff --git a/source/lib/rocprofiler-sdk/counters.cpp b/source/lib/rocprofiler-sdk/counters.cpp
+index 96667ee75e..026dcab909 100644
+--- a/source/lib/rocprofiler-sdk/counters.cpp
++++ b/source/lib/rocprofiler-sdk/counters.cpp
+@@ -41,7 +41,7 @@
+ #include <rocprofiler-sdk/cxx/constants.hpp>
+ #include <rocprofiler-sdk/cxx/operators.hpp>
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ namespace rocprofiler
+ {
+diff --git a/source/lib/rocprofiler-sdk/counters/evaluate_ast.cpp b/source/lib/rocprofiler-sdk/counters/evaluate_ast.cpp
+index bbc3ea1a95..61d9a6c492 100644
+--- a/source/lib/rocprofiler-sdk/counters/evaluate_ast.cpp
++++ b/source/lib/rocprofiler-sdk/counters/evaluate_ast.cpp
+@@ -34,7 +34,7 @@
+ #include <rocprofiler-sdk/fwd.h>
+ #include <rocprofiler-sdk/rocprofiler.h>
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <fmt/ranges.h>
+ 
+ #include <algorithm>
+diff --git a/source/lib/rocprofiler-sdk/counters/metrics.hpp b/source/lib/rocprofiler-sdk/counters/metrics.hpp
+index 7915bc8805..a65b98f6ad 100644
+--- a/source/lib/rocprofiler-sdk/counters/metrics.hpp
++++ b/source/lib/rocprofiler-sdk/counters/metrics.hpp
+@@ -25,7 +25,7 @@
+ #include <rocprofiler-sdk/agent.h>
+ #include <rocprofiler-sdk/fwd.h>
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <fmt/ranges.h>
+ #include <hsa/hsa_ven_amd_aqlprofile.h>
+ 
+diff --git a/source/lib/rocprofiler-sdk/counters/parser/raw_ast.hpp b/source/lib/rocprofiler-sdk/counters/parser/raw_ast.hpp
+index 2f1d6f4dd4..ff5ea7abd9 100644
+--- a/source/lib/rocprofiler-sdk/counters/parser/raw_ast.hpp
++++ b/source/lib/rocprofiler-sdk/counters/parser/raw_ast.hpp
+@@ -26,7 +26,7 @@
+ #include "lib/common/utility.hpp"
+ #include "lib/rocprofiler-sdk/counters/id_decode.hpp"
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <fmt/ranges.h>
+ 
+ #include <map>
+diff --git a/source/lib/rocprofiler-sdk/counters/parser/scanner.cpp b/source/lib/rocprofiler-sdk/counters/parser/scanner.cpp
+index 57acd7186d..c08171e866 100644
+--- a/source/lib/rocprofiler-sdk/counters/parser/scanner.cpp
++++ b/source/lib/rocprofiler-sdk/counters/parser/scanner.cpp
+@@ -470,7 +470,7 @@ int        yy_flex_debug = 0;
+ char* yytext;
+ #line 1 "scanner.l"
+ #line 4 "scanner.l"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ #include "parser.h"
+ #include "raw_ast.hpp"
+diff --git a/source/lib/rocprofiler-sdk/counters/parser/scanner.l b/source/lib/rocprofiler-sdk/counters/parser/scanner.l
+index a1f7edf7ea..196bf2c3a1 100644
+--- a/source/lib/rocprofiler-sdk/counters/parser/scanner.l
++++ b/source/lib/rocprofiler-sdk/counters/parser/scanner.l
+@@ -1,7 +1,7 @@
+ %option noyywrap nodefault yylineno nounput
+ 
+ %{
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ #include "raw_ast.hpp"
+ #include "parser.h"
+diff --git a/source/lib/rocprofiler-sdk/counters/tests/core.cpp b/source/lib/rocprofiler-sdk/counters/tests/core.cpp
+index 5ecbf5e3cc..61d2721c87 100644
+--- a/source/lib/rocprofiler-sdk/counters/tests/core.cpp
++++ b/source/lib/rocprofiler-sdk/counters/tests/core.cpp
+@@ -41,7 +41,7 @@
+ #include <rocprofiler-sdk/rocprofiler.h>
+ #include <rocprofiler-sdk/cxx/operators.hpp>
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <gtest/gtest.h>
+ #include <hsa/hsa.h>
+ #include <hsa/hsa_api_trace.h>
+diff --git a/source/lib/rocprofiler-sdk/counters/tests/device_counting.cpp b/source/lib/rocprofiler-sdk/counters/tests/device_counting.cpp
+index d82a6ec40b..514e129ad3 100644
+--- a/source/lib/rocprofiler-sdk/counters/tests/device_counting.cpp
++++ b/source/lib/rocprofiler-sdk/counters/tests/device_counting.cpp
+@@ -38,7 +38,7 @@
+ #include <rocprofiler-sdk/registration.h>
+ #include <rocprofiler-sdk/rocprofiler.h>
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <fmt/ranges.h>
+ #include <gtest/gtest.h>
+ #include <hsa/hsa.h>
+diff --git a/source/lib/rocprofiler-sdk/counters/tests/dimension.cpp b/source/lib/rocprofiler-sdk/counters/tests/dimension.cpp
+index 22fcda9bf7..6583ae0897 100644
+--- a/source/lib/rocprofiler-sdk/counters/tests/dimension.cpp
++++ b/source/lib/rocprofiler-sdk/counters/tests/dimension.cpp
+@@ -38,7 +38,7 @@
+ #include <rocprofiler-sdk/registration.h>
+ #include <rocprofiler-sdk/rocprofiler.h>
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <fmt/ranges.h>
+ #include <gtest/gtest.h>
+ #include <hsa/hsa.h>
+diff --git a/source/lib/rocprofiler-sdk/counters/tests/evaluate_ast_test.cpp b/source/lib/rocprofiler-sdk/counters/tests/evaluate_ast_test.cpp
+index b7aca0c638..40c4c88bbf 100644
+--- a/source/lib/rocprofiler-sdk/counters/tests/evaluate_ast_test.cpp
++++ b/source/lib/rocprofiler-sdk/counters/tests/evaluate_ast_test.cpp
+@@ -28,7 +28,7 @@
+ 
+ #include <rocprofiler-sdk/fwd.h>
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <gtest/gtest.h>
+ 
+ #include <algorithm>
+diff --git a/source/lib/rocprofiler-sdk/hip/utils.hpp b/source/lib/rocprofiler-sdk/hip/utils.hpp
+index 53916cbb5d..360577a5e8 100644
+--- a/source/lib/rocprofiler-sdk/hip/utils.hpp
++++ b/source/lib/rocprofiler-sdk/hip/utils.hpp
+@@ -29,7 +29,7 @@
+ #include "lib/rocprofiler-sdk/hip/details/format.hpp"
+ #include "lib/rocprofiler-sdk/hip/details/ostream.hpp"
+ 
+-#include "fmt/core.h"
++#include "fmt/format.h"
+ #include "fmt/ranges.h"
+ 
+ #include <sstream>
+diff --git a/source/lib/rocprofiler-sdk/hsa/agent_cache.cpp b/source/lib/rocprofiler-sdk/hsa/agent_cache.cpp
+index 196a122abc..251ddaf75c 100644
+--- a/source/lib/rocprofiler-sdk/hsa/agent_cache.cpp
++++ b/source/lib/rocprofiler-sdk/hsa/agent_cache.cpp
+@@ -24,7 +24,7 @@
+ #include "lib/common/environment.hpp"
+ #include "lib/common/logging.hpp"
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <stdexcept>
+ 
+ #include "lib/rocprofiler-sdk/context/context.hpp"
+diff --git a/source/lib/rocprofiler-sdk/hsa/aql_packet.cpp b/source/lib/rocprofiler-sdk/hsa/aql_packet.cpp
+index f1c0c3a56e..389a182e9d 100644
+--- a/source/lib/rocprofiler-sdk/hsa/aql_packet.cpp
++++ b/source/lib/rocprofiler-sdk/hsa/aql_packet.cpp
+@@ -21,7 +21,7 @@
+ // THE SOFTWARE.
+ 
+ #include "lib/rocprofiler-sdk/hsa/aql_packet.hpp"
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <cstdlib>
+ #include <iostream>
+ #include "lib/common/logging.hpp"
+diff --git a/source/lib/rocprofiler-sdk/hsa/utils.hpp b/source/lib/rocprofiler-sdk/hsa/utils.hpp
+index 004cb466b9..1560ef6a9e 100644
+--- a/source/lib/rocprofiler-sdk/hsa/utils.hpp
++++ b/source/lib/rocprofiler-sdk/hsa/utils.hpp
+@@ -27,7 +27,7 @@
+ #include "lib/common/stringize_arg.hpp"
+ #include "lib/rocprofiler-sdk/hsa/details/fmt.hpp"
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <fmt/ranges.h>
+ #include <hsa/hsa.h>
+ #include <hsa/hsa_ext_amd.h>
+diff --git a/source/lib/rocprofiler-sdk/kfd/kfd.cpp b/source/lib/rocprofiler-sdk/kfd/kfd.cpp
+index 83fef31bbc..fdeb6f9bd5 100644
+--- a/source/lib/rocprofiler-sdk/kfd/kfd.cpp
++++ b/source/lib/rocprofiler-sdk/kfd/kfd.cpp
+@@ -40,7 +40,7 @@
+ #include <rocprofiler-sdk/hsa/api_id.h>
+ #include <rocprofiler-sdk/hsa/table_id.h>
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ 
+ #include <sys/poll.h>
+ #include <unistd.h>
+diff --git a/source/lib/rocprofiler-sdk/marker/utils.hpp b/source/lib/rocprofiler-sdk/marker/utils.hpp
+index c0dd168575..4a50b91d83 100644
+--- a/source/lib/rocprofiler-sdk/marker/utils.hpp
++++ b/source/lib/rocprofiler-sdk/marker/utils.hpp
+@@ -28,7 +28,7 @@
+ #include "lib/common/mpl.hpp"
+ #include "lib/common/stringize_arg.hpp"
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <fmt/ranges.h>
+ 
+ #include <sstream>
+diff --git a/source/lib/rocprofiler-sdk/ompt.cpp b/source/lib/rocprofiler-sdk/ompt.cpp
+index a9ccc571c8..0d7166465a 100644
+--- a/source/lib/rocprofiler-sdk/ompt.cpp
++++ b/source/lib/rocprofiler-sdk/ompt.cpp
+@@ -31,7 +31,7 @@
+ #include <rocprofiler-sdk/ompt/api_args.h>
+ #include <rocprofiler-sdk/ompt/omp-tools.h>
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <cstdint>
+ #include <iostream>
+ 
+diff --git a/source/lib/rocprofiler-sdk/ompt/utils.hpp b/source/lib/rocprofiler-sdk/ompt/utils.hpp
+index 32da94c011..29f3780448 100644
+--- a/source/lib/rocprofiler-sdk/ompt/utils.hpp
++++ b/source/lib/rocprofiler-sdk/ompt/utils.hpp
+@@ -27,7 +27,7 @@
+ 
+ #include <rocprofiler-sdk/ompt/omp-tools.h>
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <fmt/ranges.h>
+ 
+ #include <sstream>
+diff --git a/source/lib/rocprofiler-sdk/pc_sampling/parser/pc_record_interface.hpp b/source/lib/rocprofiler-sdk/pc_sampling/parser/pc_record_interface.hpp
+index 9652c8426c..736e6bc65f 100644
+--- a/source/lib/rocprofiler-sdk/pc_sampling/parser/pc_record_interface.hpp
++++ b/source/lib/rocprofiler-sdk/pc_sampling/parser/pc_record_interface.hpp
+@@ -31,7 +31,7 @@
+ #include <rocprofiler-sdk/cxx/hash.hpp>
+ #include <rocprofiler-sdk/cxx/operators.hpp>
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <sys/types.h>
+ #include <cassert>
+ #include <condition_variable>
+diff --git a/source/lib/rocprofiler-sdk/rocdecode/utils.hpp b/source/lib/rocprofiler-sdk/rocdecode/utils.hpp
+index 996419c015..42e5bbe0fc 100644
+--- a/source/lib/rocprofiler-sdk/rocdecode/utils.hpp
++++ b/source/lib/rocprofiler-sdk/rocdecode/utils.hpp
+@@ -25,7 +25,7 @@
+ #include "lib/common/stringize_arg.hpp"
+ #include "lib/rocprofiler-sdk/rocdecode/details/format.hpp"
+ 
+-#include "fmt/core.h"
++#include "fmt/format.h"
+ #include "fmt/ranges.h"
+ 
+ #include <sstream>
+diff --git a/source/lib/rocprofiler-sdk/tests/agent.cpp b/source/lib/rocprofiler-sdk/tests/agent.cpp
+index e951160899..7f6689b73f 100644
+--- a/source/lib/rocprofiler-sdk/tests/agent.cpp
++++ b/source/lib/rocprofiler-sdk/tests/agent.cpp
+@@ -31,7 +31,7 @@
+ #include <rocprofiler-sdk/cxx/operators.hpp>
+ #include <rocprofiler-sdk/cxx/utility.hpp>
+ 
+-#include <fmt/core.h>
++#include <fmt/format.h>
+ #include <gtest/gtest.h>
+ #include <hsa/hsa.h>
+ #include <hsa/hsa_api_trace.h>
+-- 
+2.55.0
+
diff --git a/pkgs/development/rocm-modules/rocprofiler-sdk/default.nix b/pkgs/development/rocm-modules/rocprofiler-sdk/default.nix
index 5806bc23c40f..d5caa277fe46 100644
--- a/pkgs/development/rocm-modules/rocprofiler-sdk/default.nix
+++ b/pkgs/development/rocm-modules/rocprofiler-sdk/default.nix
@@ -142,6 +142,12 @@ stdenv.mkDerivation (finalAttrs: {
     # "[rocprofiler-sdk] Migrate from glog to Abseil Logging (#4668)", which
     # is too invasive (40 files + new abseil submodule) to backport.
     ./0009-rocprofiler-sdk-guard-ompt-auto-start.patch
+
+    # fmt v12.2.0 changed the structure of fmt/core.h, so this switches uses of
+    # fmt/core.h to fmt/format.h. backport of the relevant parts of
+    # https://github.com/ROCm/rocm-systems/commit/e2f588592ecfb0653ed5b3078753186325adf70a
+    # as upstream has changed significantly since 7.2.3.
+    ./0010-fmt-12.2.0-format.h.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/development/tools/misc/luarocks/default.nix b/pkgs/development/tools/misc/luarocks/default.nix
index 75327f83f184..4ccddabf2e30 100644
--- a/pkgs/development/tools/misc/luarocks/default.nix
+++ b/pkgs/development/tools/misc/luarocks/default.nix
@@ -47,6 +47,10 @@ stdenv.mkDerivation (finalAttrs: {
   #   Error: Unknown flag: --build=x86_64-unknown-linux-gnu
   configurePlatforms = [ ];
 
+  # ... nor the --enable-static/--disable-shared that pkgsStatic injects:
+  #   Error: Unknown flag: --enable-static
+  dontAddStaticConfigureFlags = true;
+
   preConfigure = ''
     lua -e "" || {
         luajit -e "" && {
diff --git a/pkgs/development/web/nodejs/v24.nix b/pkgs/development/web/nodejs/v24.nix
index 262990f1826e..578c94262c53 100644
--- a/pkgs/development/web/nodejs/v24.nix
+++ b/pkgs/development/web/nodejs/v24.nix
@@ -29,22 +29,13 @@ let
       [ ];
 in
 buildNodejs {
-  version = "24.18.1";
-  sha256 = "86d40d594bbdfcf69009a62fdf43cb19ae72b6cb5822d2bdd8349c5a1b2fa628";
+  version = "24.19.0";
+  sha256 = "f6d95e10a0431ee1067fc6aabe9f762908b4716dd35324e1ddb4b1466b76659f";
   patches =
-    (
-      if (stdenv.hostPlatform.emulatorAvailable buildPackages) then
-        [
-          ./configure-emulator.patch
-        ]
-      else
-        [
-          (fetchpatch2 {
-            url = "https://raw.githubusercontent.com/buildroot/buildroot/2f0c31bffdb59fb224387e35134a6d5e09a81d57/package/nodejs/nodejs-src/0003-include-obj-name-in-shared-intermediate.patch";
-            hash = "sha256-3g4aS+NmmUYNOYRNc6UMJKYoaTlpP5Knt9UHegx+o0Y=";
-          })
-        ]
-    )
+    (lib.optional (!(stdenv.hostPlatform.emulatorAvailable buildPackages)) (fetchpatch2 {
+      url = "https://raw.githubusercontent.com/buildroot/buildroot/2f0c31bffdb59fb224387e35134a6d5e09a81d57/package/nodejs/nodejs-src/0003-include-obj-name-in-shared-intermediate.patch";
+      hash = "sha256-3g4aS+NmmUYNOYRNc6UMJKYoaTlpP5Knt9UHegx+o0Y=";
+    }))
     ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform && stdenv.hostPlatform.isFreeBSD) [
       # This patch is concerning.
       # https://github.com/nodejs/node/issues/54576
diff --git a/pkgs/os-specific/darwin/by-name/ad/adv_cmds/package.nix b/pkgs/os-specific/darwin/by-name/ad/adv_cmds/package.nix
index 3f0e13b38f2a..6ea659f142aa 100644
--- a/pkgs/os-specific/darwin/by-name/ad/adv_cmds/package.nix
+++ b/pkgs/os-specific/darwin/by-name/ad/adv_cmds/package.nix
@@ -74,8 +74,10 @@ mkAppleDerivation {
         --replace-fail '/usr/local' "$out"
     done
   '';
-
-  env.NIX_CFLAGS_COMPILE = "-I${privateHeaders}/include";
+  env.NIX_CFLAGS_COMPILE = lib.join " " [
+    "-I${privateHeaders}/include"
+    "-Wno-error=incompatible-pointer-types"
+  ];
 
   buildInputs = [
     libxo
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix b/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix
index e29e884a2dfd..92f8e2dea338 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/binutils/static.nix
@@ -33,6 +33,8 @@ let
   ];
 
   configureFlags = [
+    # otherwise the binary links dynamically and pulls gcc into the closure
+    "LDFLAGS=--static"
     "--prefix=${placeholder "out"}"
     "--build=${buildPlatform.config}"
     "--host=${hostPlatform.config}"
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/default.nix b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
index ac31f89dfa66..b0fad7145a70 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/default.nix
+++ b/pkgs/os-specific/linux/minimal-bootstrap/default.nix
@@ -274,6 +274,25 @@ lib.makeScope
 
         heirloom-devtools = callPackage ./heirloom-devtools { tinycc = tinycc-mes; };
 
+        libgmp = callPackage ./gcc/gmp.nix {
+          gcc-buildbuild = gcc-latest;
+          gcc = gcc-latest;
+          gnumake = gnumake-musl;
+          gnutar = gnutar-latest;
+        };
+
+        libmpc = callPackage ./gcc/mpc.nix {
+          gcc = gcc-latest;
+          gnumake = gnumake-musl;
+          gnutar = gnutar-latest;
+        };
+
+        libmpfr = callPackage ./gcc/mpfr.nix {
+          gcc = gcc-latest;
+          gnumake = gnumake-musl;
+          gnutar = gnutar-latest;
+        };
+
         linux-headers = callPackage ./linux-headers {
           gcc = gcc-latest;
           gnumake = gnumake-musl;
@@ -303,6 +322,12 @@ lib.makeScope
           gnumake = gnumake-musl;
         };
 
+        musl-headers = callPackage ./musl/headers.nix {
+          gcc = gcc46;
+          gnumake = gnumake-musl;
+          gnutar = gnutar-latest;
+        };
+
         musl-static = callPackage ./musl/static.nix {
           libgcc = gcc-latest-unwrapped;
           gcc = gcc-latest;
@@ -471,6 +496,13 @@ lib.makeScope
           gnutar = gnutar-latest;
           gnugrep = gnugrep-static;
         };
+
+        glibc-headers = callPackage ./glibc/headers.nix {
+          gcc = gcc-latest;
+          binutils-build = binutils;
+          gnumake = gnumake-musl;
+          gnutar = gnutar-latest;
+        };
       }
     )
   )
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/gmp.nix b/pkgs/os-specific/linux/minimal-bootstrap/gcc/gmp.nix
new file mode 100644
index 000000000000..87f205ebe9af
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/gmp.nix
@@ -0,0 +1,83 @@
+{
+  lib,
+  buildPlatform,
+  hostPlatform,
+  fetchurl,
+  bash,
+  coreutils,
+  gcc-buildbuild,
+  gcc,
+  binutils,
+  gnumake,
+  gnused,
+  gnugrep,
+  gawk,
+  diffutils,
+  findutils,
+  gnutar,
+  gzip,
+  bzip2,
+  xz,
+}:
+let
+  pname = "gmp";
+  version = "6.3.0";
+
+  src = fetchurl {
+    url = "mirror://gnu/gmp/gmp-${version}.tar.xz";
+    hash = "sha256-o8K4AgG4nmhhb0rTC8Zq7kknw85Q4zkpyoGdXENTiJg=";
+  };
+in
+bash.runCommand "${pname}-${version}"
+  {
+    inherit pname version;
+
+    nativeBuildInputs = [
+      gcc
+      gcc-buildbuild
+      binutils
+      gnumake
+      gnused
+      gnugrep
+      gawk
+      diffutils
+      findutils
+      gnutar
+      gzip
+      bzip2
+      xz
+    ];
+
+    meta = {
+      description = "The GNU Multiple Precision Arithmetic Library, version ${version}";
+      homepage = "https://gmplib.org/";
+      license = with lib.licenses; [
+        lgpl3Only
+        gpl2Only
+      ];
+      teams = [ lib.teams.minimal-bootstrap ];
+      platforms = lib.platforms.unix;
+    };
+  }
+  ''
+    # Unpack
+    tar xf ${src}
+    cd gmp-${version}
+
+    # Configure
+    bash ./configure \
+      --prefix=$out \
+      --build=${buildPlatform.config} \
+      --host=${hostPlatform.config} \
+      --disable-dependency-tracking \
+      --with-pic \
+      --disable-assembly \
+      CFLAGS=-std=c99 \
+      M4=false
+
+    # Build
+    make -j $NIX_BUILD_CORES
+
+    # Install
+    make -j $NIX_BUILD_CORES install-strip
+  ''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/mpc.nix b/pkgs/os-specific/linux/minimal-bootstrap/gcc/mpc.nix
new file mode 100644
index 000000000000..0bba4f4498f3
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/mpc.nix
@@ -0,0 +1,77 @@
+{
+  lib,
+  buildPlatform,
+  hostPlatform,
+  fetchurl,
+  bash,
+  coreutils,
+  gcc,
+  binutils,
+  gnumake,
+  gnused,
+  gnugrep,
+  gawk,
+  diffutils,
+  findutils,
+  gnutar,
+  gzip,
+  bzip2,
+  xz,
+  libgmp,
+  libmpfr,
+}:
+let
+  pname = "mpc";
+  version = "1.3.1";
+  src = fetchurl {
+    url = "mirror://gnu/mpc/mpc-${version}.tar.gz";
+    hash = "sha256-q2QkkvXPiCt0qgy3MM1BCoHtzb7IlRg86TDnBsHHWbg=";
+  };
+in
+bash.runCommand "${pname}-${version}"
+  {
+    inherit pname version;
+
+    nativeBuildInputs = [
+      gcc
+      binutils
+      gnumake
+      gnused
+      gnugrep
+      gawk
+      diffutils
+      findutils
+      gnutar
+      gzip
+      bzip2
+      xz
+    ];
+
+    meta = {
+      description = "GNU Multiple Precision Complex Library, version ${version}";
+      homepage = "https://www.multiprecision.org/";
+      license = lib.licenses.lgpl3Plus;
+      teams = [ lib.teams.minimal-bootstrap ];
+      platforms = lib.platforms.unix;
+    };
+  }
+  ''
+    # Unpack
+    tar xf ${src}
+    cd mpc-${version}
+
+    # Configure
+    bash ./configure \
+      --prefix=$out \
+      --build=${buildPlatform.config} \
+      --host=${hostPlatform.config} \
+      --disable-dependency-tracking \
+      --with-gmp=${libgmp} \
+      --with-mpfr=${libmpfr}
+
+    # Build
+    make -j $NIX_BUILD_CORES
+
+    # Install
+    make -j $NIX_BUILD_CORES install-strip
+  ''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/mpfr.nix b/pkgs/os-specific/linux/minimal-bootstrap/gcc/mpfr.nix
new file mode 100644
index 000000000000..11807a44350f
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/mpfr.nix
@@ -0,0 +1,71 @@
+{
+  lib,
+  buildPlatform,
+  hostPlatform,
+  fetchurl,
+  bash,
+  gcc,
+  binutils,
+  gnumake,
+  gnused,
+  gnugrep,
+  gawk,
+  diffutils,
+  findutils,
+  gnutar,
+  xz,
+  libgmp,
+}:
+let
+  pname = "mpfr";
+  version = "4.2.2";
+
+  src = fetchurl {
+    url = "mirror://gnu/mpfr/mpfr-${version}.tar.xz";
+    hash = "sha256-tnugOD736KhWNzTi6InvXsPDuJigHQD6CmhprYHGzgE=";
+  };
+in
+bash.runCommand "${pname}-${version}"
+  {
+    inherit pname version;
+
+    nativeBuildInputs = [
+      gcc
+      binutils
+      gnumake
+      gnused
+      gnugrep
+      gawk
+      diffutils
+      findutils
+      gnutar
+      xz
+    ];
+
+    meta = {
+      description = "The GNU Multiple Precision Floating-Point Reliable Library, version ${version}";
+      homepage = "https://www.mpfr.org/";
+      license = lib.licenses.lgpl3Plus;
+      teams = [ lib.teams.minimal-bootstrap ];
+      platforms = lib.platforms.unix;
+    };
+  }
+  ''
+    # Unpack
+    tar xf ${src}
+    cd mpfr-${version}
+
+    # Configure
+    bash ./configure \
+      --prefix=$out \
+      --build=${buildPlatform.config} \
+      --host=${hostPlatform.config} \
+      --disable-dependency-tracking \
+      --with-gmp=${libgmp}
+
+    # Build
+    make -j $NIX_BUILD_CORES
+
+    # Install
+    make -j $NIX_BUILD_CORES install-strip
+  ''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/wrapper.sh b/pkgs/os-specific/linux/minimal-bootstrap/gcc/wrapper.sh
index 45720ce02d4a..45c4d3e1245f 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gcc/wrapper.sh
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/wrapper.sh
@@ -41,7 +41,7 @@ done
 exec -a "@origname@" @gcc@ -Wl,-dynamic-linker=@dynlinker@ \
   @extraflags@ \
   $extraRpath \
-  -Wl,-rpath,@libc@,-rpath,@libgcc@ \
+  -Wl,-rpath,@libc@ \
   -B@libc@/.. \
   -B@libgcc@ \
   -B@libc@ \
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/gcc/wrappercxx.sh b/pkgs/os-specific/linux/minimal-bootstrap/gcc/wrappercxx.sh
index c567b0313f08..9007d4aa1604 100644
--- a/pkgs/os-specific/linux/minimal-bootstrap/gcc/wrappercxx.sh
+++ b/pkgs/os-specific/linux/minimal-bootstrap/gcc/wrappercxx.sh
@@ -43,7 +43,7 @@ done
 exec -a "@origname@" @gcc@ -Wl,-dynamic-linker=@dynlinker@ \
   @extraflags@ \
   $extraRpath \
-  -Wl,-rpath,@libc@,-rpath,@libgcc@,-rpath,@libstdcxx@ \
+  -Wl,-rpath,@libc@,-rpath,@libstdcxx@ \
   -I @libstdcxxarchinc@ \
   -I @libstdcxxinc@ \
   -B@libc@/.. \
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/glibc/headers.nix b/pkgs/os-specific/linux/minimal-bootstrap/glibc/headers.nix
new file mode 100644
index 000000000000..2a4676231f2f
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/glibc/headers.nix
@@ -0,0 +1,82 @@
+{
+  lib,
+  buildPlatform,
+  hostPlatform,
+  fetchurl,
+  bash,
+  gcc,
+  binutils,
+  binutils-build,
+  linux-headers,
+  gnumake,
+  gnused,
+  gnugrep,
+  gawk,
+  diffutils,
+  findutils,
+  python,
+  bison,
+  gnutar,
+  xz,
+}:
+let
+  pname = "glibc-headers";
+  version = "2.42";
+
+  src = fetchurl {
+    url = "mirror://gnu/libc/glibc-${version}.tar.xz";
+    hash = "sha256-0XdeMuRijmTvkw9DW2e7Y691may2viszW58Z8WUJ8X8=";
+  };
+in
+bash.runCommand "${pname}-${version}"
+  {
+    inherit pname version;
+
+    nativeBuildInputs = [
+      gcc
+      binutils
+      binutils-build
+      gnumake
+      gnused
+      gnugrep
+      gawk
+      diffutils
+      findutils
+      python
+      bison
+      gnutar
+      xz
+    ];
+
+    meta = {
+      description = "The GNU C Library";
+      homepage = "https://www.gnu.org/software/libc/";
+      license = lib.licenses.lgpl2Plus;
+      platforms = lib.platforms.linux;
+      teams = [ lib.teams.minimal-bootstrap ];
+    };
+  }
+  ''
+    # Unpack
+    tar xf ${src}
+    cd glibc-${version}
+
+    # Configure
+    mkdir build
+    cd build
+    # libstdc++.so is built against musl and fails to link
+    export CXX=false
+    bash ../configure \
+      --prefix=$out \
+      --build=${buildPlatform.config} \
+      --host=${hostPlatform.config} \
+      --with-headers=${linux-headers}/include \
+      --disable-dependency-tracking
+
+    # Install
+    make -j $NIX_BUILD_CORES INSTALL_UNCOMPRESSED=yes install-headers install-bootstrap-headers=yes
+    ln -s $(ls -d ${linux-headers}/include/* | grep -v scsi\$) $out/include/
+
+    # https://sources.debian.org/patches/glibc/2.43-1/any/local-bootstrap-headers.diff/
+    touch $out/include/gnu/stubs.h
+  ''
diff --git a/pkgs/os-specific/linux/minimal-bootstrap/musl/headers.nix b/pkgs/os-specific/linux/minimal-bootstrap/musl/headers.nix
new file mode 100644
index 000000000000..f356c3842508
--- /dev/null
+++ b/pkgs/os-specific/linux/minimal-bootstrap/musl/headers.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  buildPlatform,
+  hostPlatform,
+  fetchurl,
+  bash,
+  gcc,
+  binutils,
+  gnumake,
+  gnugrep,
+  gnused,
+  gnutar,
+  gzip,
+}:
+let
+  inherit (import ./common.nix { inherit lib; }) pname meta;
+  version = "1.2.6";
+
+  src = fetchurl {
+    url = "https://musl.libc.org/releases/musl-${version}.tar.gz";
+    hash = "sha256-1YX9O2E8ZhUfwySejtRPdwIMtebB5jWmFtP5+CRgUSo=";
+  };
+in
+bash.runCommand "${pname}-${version}"
+  {
+    inherit pname version meta;
+
+    nativeBuildInputs = [
+      gcc
+      binutils
+      gnumake
+      gnused
+      gnugrep
+      gnutar
+      gzip
+    ];
+  }
+  ''
+    # Unpack
+    tar xzf ${src}
+    cd musl-${version}
+
+    # Patch
+    # https://github.com/ZilchOS/bootstrap-from-tcc/blob/2e0c68c36b3437386f786d619bc9a16177f2e149/using-nix/2a3-intermediate-musl.nix
+    sed -i 's|/bin/sh|${bash}/bin/bash|' \
+      tools/*.sh
+
+    # Configure
+    # Use build-gcc, since we won't be compiling anything
+    bash ./configure \
+      --prefix=$out \
+      --build=${buildPlatform.config} \
+      --host=${hostPlatform.config} \
+      --syslibdir=$out/lib \
+      --enable-wrapper \
+      CC=gcc
+
+    # Install
+    make -j $NIX_BUILD_CORES install-headers
+  ''
diff --git a/pkgs/test/make-binary-wrapper/combination/combination.c b/pkgs/test/make-binary-wrapper/combination/combination.c
index ae90263c45a5..33a003ca6a9a 100644
--- a/pkgs/test/make-binary-wrapper/combination/combination.c
+++ b/pkgs/test/make-binary-wrapper/combination/combination.c
@@ -42,10 +42,10 @@ void set_env_prefix(char *env, char *sep, char *prefix) {
         return;
       }
       unsigned long sep_len = strlen(sep);
-      int n_before = existing_prefix - existing_env;
+      int n_before = existing_prefix - existing_env - sep_len;
       assert_success(asprintf(&val, "%s%s%.*s%s", prefix, sep,
                               n_before, existing_env,
-                              existing_prefix + prefix_len + sep_len));
+                              existing_prefix + prefix_len));
     } else {
       assert_success(asprintf(&val, "%s%s%s", prefix, sep, existing_env));
     }
diff --git a/pkgs/test/make-binary-wrapper/default.nix b/pkgs/test/make-binary-wrapper/default.nix
index 715b28f912e4..7d2e4b1a7cd2 100644
--- a/pkgs/test/make-binary-wrapper/default.nix
+++ b/pkgs/test/make-binary-wrapper/default.nix
@@ -59,6 +59,7 @@ let
       "overlength-strings"
       "prefix"
       "suffix"
+      "prefix-dedup-last"
     ] makeGoldenTest
     // lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
       cross =
diff --git a/pkgs/test/make-binary-wrapper/overlength-strings/overlength-strings.c b/pkgs/test/make-binary-wrapper/overlength-strings/overlength-strings.c
index 6a5107d5a4de..0dde8218c3bf 100644
--- a/pkgs/test/make-binary-wrapper/overlength-strings/overlength-strings.c
+++ b/pkgs/test/make-binary-wrapper/overlength-strings/overlength-strings.c
@@ -42,10 +42,10 @@ void set_env_prefix(char *env, char *sep, char *prefix) {
         return;
       }
       unsigned long sep_len = strlen(sep);
-      int n_before = existing_prefix - existing_env;
+      int n_before = existing_prefix - existing_env - sep_len;
       assert_success(asprintf(&val, "%s%s%.*s%s", prefix, sep,
                               n_before, existing_env,
-                              existing_prefix + prefix_len + sep_len));
+                              existing_prefix + prefix_len));
     } else {
       assert_success(asprintf(&val, "%s%s%s", prefix, sep, existing_env));
     }
diff --git a/pkgs/test/make-binary-wrapper/prefix-dedup-last/prefix-dedup-last.c b/pkgs/test/make-binary-wrapper/prefix-dedup-last/prefix-dedup-last.c
new file mode 100644
index 000000000000..8f13278a7537
--- /dev/null
+++ b/pkgs/test/make-binary-wrapper/prefix-dedup-last/prefix-dedup-last.c
@@ -0,0 +1,64 @@
+#define _GNU_SOURCE         /* See feature_test_macros(7) */
+#include <unistd.h>
+#include <stdlib.h>
+#include <assert.h>
+#include <stdio.h>
+#include <string.h>
+
+#define assert_success(e) do { if ((e) < 0) { perror(#e); abort(); } } while (0)
+
+int is_surrounded_by_sep(char *env, char *ptr, unsigned long len, char *sep) {
+  unsigned long sep_len = strlen(sep);
+
+  // Check left side (if not at start)
+  if (env != ptr) {
+    if (ptr - env < sep_len)
+      return 0;
+    if (strncmp(sep, ptr - sep_len, sep_len) != 0) {
+      return 0;
+    }
+  }
+  // Check right side (if not at end)
+  char *end_ptr = ptr + len;
+  if (*end_ptr != '\0') {
+    if (strncmp(sep, ptr + len, sep_len) != 0) {
+      return 0;
+    }
+  }
+
+  return 1;
+}
+
+void set_env_prefix(char *env, char *sep, char *prefix) {
+  char *existing_env = getenv(env);
+  if (existing_env) {
+    char *val;
+
+    char *existing_prefix = strstr(existing_env, prefix);
+    unsigned long prefix_len = strlen(prefix);
+    // If the prefix already exists, remove the original
+    if (existing_prefix && is_surrounded_by_sep(existing_env, existing_prefix, prefix_len, sep)) {
+      if (existing_env == existing_prefix) {
+        return;
+      }
+      unsigned long sep_len = strlen(sep);
+      int n_before = existing_prefix - existing_env - sep_len;
+      assert_success(asprintf(&val, "%s%s%.*s%s", prefix, sep,
+                              n_before, existing_env,
+                              existing_prefix + prefix_len));
+    } else {
+      assert_success(asprintf(&val, "%s%s%s", prefix, sep, existing_env));
+    }
+    assert_success(setenv(env, val, 1));
+    free(val);
+  } else {
+    assert_success(setenv(env, prefix, 1));
+  }
+}
+
+int main(int argc, char **argv) {
+    putenv("PATH=/usr/bin:/usr/local/bin");
+    set_env_prefix("PATH", ":", "/usr/local/bin");
+    argv[0] = "/send/me/flags";
+    return execv("/send/me/flags", argv);
+}
diff --git a/pkgs/test/make-binary-wrapper/prefix-dedup-last/prefix-dedup-last.cmdline b/pkgs/test/make-binary-wrapper/prefix-dedup-last/prefix-dedup-last.cmdline
new file mode 100644
index 000000000000..ec2d43b44031
--- /dev/null
+++ b/pkgs/test/make-binary-wrapper/prefix-dedup-last/prefix-dedup-last.cmdline
@@ -0,0 +1,2 @@
+--set PATH /usr/bin:/usr/local/bin \
+--prefix PATH : /usr/local/bin
diff --git a/pkgs/test/make-binary-wrapper/prefix-dedup-last/prefix-dedup-last.env b/pkgs/test/make-binary-wrapper/prefix-dedup-last/prefix-dedup-last.env
new file mode 100644
index 000000000000..6f8f684af379
--- /dev/null
+++ b/pkgs/test/make-binary-wrapper/prefix-dedup-last/prefix-dedup-last.env
@@ -0,0 +1,3 @@
+PATH=/usr/local/bin:/usr/bin
+CWD=SUBST_CWD
+SUBST_ARGV0
diff --git a/pkgs/test/make-binary-wrapper/prefix/prefix.c b/pkgs/test/make-binary-wrapper/prefix/prefix.c
index 205ecd0dcaef..a74cb49861ea 100644
--- a/pkgs/test/make-binary-wrapper/prefix/prefix.c
+++ b/pkgs/test/make-binary-wrapper/prefix/prefix.c
@@ -42,10 +42,10 @@ void set_env_prefix(char *env, char *sep, char *prefix) {
         return;
       }
       unsigned long sep_len = strlen(sep);
-      int n_before = existing_prefix - existing_env;
+      int n_before = existing_prefix - existing_env - sep_len;
       assert_success(asprintf(&val, "%s%s%.*s%s", prefix, sep,
                               n_before, existing_env,
-                              existing_prefix + prefix_len + sep_len));
+                              existing_prefix + prefix_len));
     } else {
       assert_success(asprintf(&val, "%s%s%s", prefix, sep, existing_env));
     }
diff --git a/pkgs/tools/misc/file/default.nix b/pkgs/tools/misc/file/default.nix
index 0fae703c4c4a..99786b8e4dd7 100644
--- a/pkgs/tools/misc/file/default.nix
+++ b/pkgs/tools/misc/file/default.nix
@@ -58,6 +58,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
 
+  __structuredAttrs = true;
+
   meta = {
     homepage = "https://darwinsys.com/file";
     description = "Program that shows the type of files";
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1a741d12181d..b45722165d7d 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1848,12 +1848,11 @@ with pkgs;
 
   comet-gog_heroic = callPackage ../by-name/co/comet-gog/package.nix { comet-gog_kind = "heroic"; };
 
-  coreutils = callPackage ../tools/misc/coreutils { };
-
-  # The coreutils above are built with dependencies from
-  # bootstrapping. We cannot override it here, because that pulls in
-  # openssl from the previous stage as well.
-  coreutils-full = callPackage ../tools/misc/coreutils { minimal = false; };
+  # The `coreutils` package (in pkgs/by-name) is built with dependencies from
+  # bootstrapping. We cannot override it for `coreutils-full`, because that
+  # pulls in openssl from the previous stage as well.
+  # `coreutils-prefixed` does not use openssl, though, so it can be overridden.
+  coreutils-full = callPackage ../by-name/co/coreutils/package.nix { minimal = false; };
   coreutils-prefixed = coreutils.override {
     withPrefix = true;
     singleBinary = false;
@@ -7005,14 +7004,6 @@ with pkgs;
     ];
   };
 
-  sbcl_2_6_5 = wrapLisp {
-    pkg = callPackage ../development/compilers/sbcl { version = "2.6.5"; };
-    faslExt = "fasl";
-    flags = [
-      "--dynamic-space-size"
-      "3000"
-    ];
-  };
   sbcl_2_6_6 = wrapLisp {
     pkg = callPackage ../development/compilers/sbcl { version = "2.6.6"; };
     faslExt = "fasl";
@@ -7021,7 +7012,15 @@ with pkgs;
       "3000"
     ];
   };
-  sbcl = sbcl_2_6_6;
+  sbcl_2_6_7 = wrapLisp {
+    pkg = callPackage ../development/compilers/sbcl { version = "2.6.7"; };
+    faslExt = "fasl";
+    flags = [
+      "--dynamic-space-size"
+      "3000"
+    ];
+  };
+  sbcl = sbcl_2_6_7;
 
   sbclPackages = recurseIntoAttrs sbcl.pkgs;