diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index 0ca429421891..3e44f8cdb0a6 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -72,8 +72,8 @@ jobs:
               maxConcurrent: 1,
               // Hourly limit is at 5000, but other jobs need some, too!
               // https://docs.github.com/en/rest/using-the-rest-api/rate-limits-for-the-rest-api
-              reservoir: 1000,
-              reservoirRefreshAmount: 1000,
+              reservoir: 500,
+              reservoirRefreshAmount: 500,
               reservoirRefreshInterval: 60 * 60 * 1000
             })
             // Pause between mutative requests
@@ -152,7 +152,17 @@ jobs:
                     status: prEventCondition ? 'in_progress' : 'success',
                     exclude_pull_requests: true,
                     head_sha: pull_request.head.sha
-                  })).data.workflow_runs[0]?.id
+                  })).data.workflow_runs[0]?.id ??
+                    // TODO: Remove this after 2025-09-17, at which point all eval.yml artifacts will have expired.
+                    (await github.rest.actions.listWorkflowRuns({
+                      ...context.repo,
+                      // In older PRs, we need eval.yml instead of pr.yml.
+                      workflow_id: 'eval.yml',
+                      event: 'pull_request_target',
+                      status: 'success',
+                      exclude_pull_requests: true,
+                      head_sha: pull_request.head.sha
+                    })).data.workflow_runs[0]?.id
 
                   // Newer PRs might not have run Eval to completion, yet. We can skip them, because this
                   // job will be run as part of that Eval run anyway.
@@ -186,7 +196,11 @@ jobs:
 
                   // Get all currently set labels that we manage
                   const before =
-                    pull_request.labels.map(({ name }) => name)
+                    (await github.paginate(github.rest.issues.listLabelsOnIssue, {
+                      ...context.repo,
+                      issue_number: pull_request.number
+                    }))
+                    .map(({ name }) => name)
                     .filter(name =>
                       name.startsWith('10.rebuild') ||
                       name == '11.by: package-maintainer' ||
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 8e92b5aed816..368ede03ffe7 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -8,6 +8,7 @@ on:
       - .github/workflows/eval.yml
       - .github/workflows/lint.yml
       - .github/workflows/pr.yml
+      - .github/workflows/labels.yml
       - .github/workflows/reviewers.yml # needs eval results from the same event type
   pull_request_target:
 
diff --git a/ci/eval/compare/default.nix b/ci/eval/compare/default.nix
index 8b609cc8f2c4..302a2df90611 100644
--- a/ci/eval/compare/default.nix
+++ b/ci/eval/compare/default.nix
@@ -100,7 +100,7 @@ let
           (getLabels rebuildCountByKernel)
           # Adds "10.rebuild-*-stdenv" label if the "stdenv" attribute was changed
           ++ lib.mapAttrsToList (kernel: _: "10.rebuild-${kernel}-stdenv") (
-            lib.filterAttrs (_: kernelRebuilds: kernelRebuilds ? "stdenv") rebuildsByKernel
+            lib.filterAttrs (_: lib.elem "stdenv") rebuildsByKernel
           )
           # Adds the "11.by: package-maintainer" label if all of the packages directly
           # changed are maintained by the PR's author. (https://github.com/NixOS/ofborg/blob/df400f44502d4a4a80fa283d33f2e55a4e43ee90/ofborg/src/tagger.rs#L83-L88)
diff --git a/lib/systems/examples.nix b/lib/systems/examples.nix
index bfb7a73d547e..e7e5d502ad5d 100644
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@@ -21,9 +21,13 @@ rec {
     config = "powerpc64le-unknown-linux-musl";
   };
 
-  ppc64 = {
+  ppc64-elfv1 = {
+    config = "powerpc64-unknown-linux-gnuabielfv1";
+  };
+  ppc64-elfv2 = {
     config = "powerpc64-unknown-linux-gnuabielfv2";
   };
+  ppc64 = ppc64-elfv2;
   ppc64-musl = {
     config = "powerpc64-unknown-linux-musl";
     gcc = {
diff --git a/nixos/modules/services/networking/ntp/chrony.nix b/nixos/modules/services/networking/ntp/chrony.nix
index 3a9d911b8048..dcfd211470d6 100644
--- a/nixos/modules/services/networking/ntp/chrony.nix
+++ b/nixos/modules/services/networking/ntp/chrony.nix
@@ -237,7 +237,7 @@ in
 
       unitConfig.ConditionCapability = "CAP_SYS_TIME";
       serviceConfig = {
-        Type = "simple";
+        Type = "notify";
         ExecStart = "${chronyPkg}/bin/chronyd ${builtins.toString chronyFlags}";
 
         # Proc filesystem
@@ -318,6 +318,13 @@ in
           Alternatively, disable this behaviour by `services.chrony.enableRTCTrimming = false;`
         '';
       }
+      {
+        assertion = !(cfg.enable && config.environment.memoryAllocator.provider == "graphene-hardened");
+        message = ''
+          Chrony doesn't work with the graphene-hardened memory allocator set by
+          `environment.memoryAllocator.provider`.
+        '';
+      }
     ];
   };
 }
diff --git a/nixos/tests/chrony.nix b/nixos/tests/chrony.nix
index e3999596fd22..88c75d5648d0 100644
--- a/nixos/tests/chrony.nix
+++ b/nixos/tests/chrony.nix
@@ -13,7 +13,6 @@ import ./make-test-python.nix (
 
         specialisation.hardened.configuration = {
           services.chrony.enableMemoryLocking = true;
-          environment.memoryAllocator.provider = "graphene-hardened";
         };
       };
     };
diff --git a/pkgs/applications/editors/vscode/extensions/hashicorp.terraform/default.nix b/pkgs/applications/editors/vscode/extensions/hashicorp.terraform/default.nix
index 1fdbc79eb4ee..c59a4e271284 100644
--- a/pkgs/applications/editors/vscode/extensions/hashicorp.terraform/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/hashicorp.terraform/default.nix
@@ -11,8 +11,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "terraform";
     publisher = "hashicorp";
-    version = "2.34.4";
-    hash = "sha256-gTU37q7kh51CxqQE7KylSwEK4ubiUU5uihbFew/Fg98=";
+    version = "2.34.5";
+    hash = "sha256-t5ULeB0jvkt9a1m3gA5Du0Kl1FI1ZncqyAQlXBwyyfE=";
   };
 
   postInstall = ''
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index 95577143cb10..31eb296037f2 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -44,16 +44,19 @@ let
         url = "mirror://mozilla/thunderbird/releases/${version}/source/thunderbird-${version}.source.tar.xz";
         inherit sha512;
       };
-      extraPatches = [
-        # The file to be patched is different from firefox's `no-buildconfig-ffx90.patch`.
-        ./no-buildconfig.patch
-        # clang-19 fixes for char_traits build issue
-        # https://github.com/rnpgp/rnp/pull/2242/commits/e0790a2c4ff8e09d52522785cec1c9db23d304ac
-        # https://github.com/rnpgp/sexpp/pull/54/commits/46744a14ffc235330bb99cebfaf294829c31bba4
-        # Remove when upstream bumps bundled rnp version: https://bugzilla.mozilla.org/show_bug.cgi?id=1893950
-        ./0001-Removed-lookup-against-basic_string-uint8_t.patch
-        ./0001-Implemented-char_traits-for-SEXP-octet_t.patch
-      ];
+      extraPatches =
+        [
+          # The file to be patched is different from firefox's `no-buildconfig-ffx90.patch`.
+          ./no-buildconfig.patch
+        ]
+        ++ lib.optionals (lib.versionOlder version "139") [
+          # clang-19 fixes for char_traits build issue
+          # https://github.com/rnpgp/rnp/pull/2242/commits/e0790a2c4ff8e09d52522785cec1c9db23d304ac
+          # https://github.com/rnpgp/sexpp/pull/54/commits/46744a14ffc235330bb99cebfaf294829c31bba4
+          # Remove when upstream bumps bundled rnp version: https://bugzilla.mozilla.org/show_bug.cgi?id=1893950
+          ./0001-Removed-lookup-against-basic_string-uint8_t.patch
+          ./0001-Implemented-char_traits-for-SEXP-octet_t.patch
+        ];
 
       extraPassthru = {
         icu73 = icu73';
@@ -92,8 +95,8 @@ rec {
   thunderbird = thunderbird-latest;
 
   thunderbird-latest = common {
-    version = "138.0.1";
-    sha512 = "2e71ee537292ec1a49237e93c43ed4c1a9eae58becfc7fa9ca0daf1e982c38704cb6d44e92b1bf7b45c5b8c27b23eb3aa7f48b375580f49ee60884dadc5d85b5";
+    version = "139.0.2";
+    sha512 = "edb20c692674dc5c3ba70673f7dd03710bf7ac0ce2be614a7a4b3d2b40b20b4974aab2a621dd5b43720c412a590c08f8b78abeb9b61f288f3217c6a04cc1e8ff";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-latest";
diff --git a/pkgs/by-name/af/affine/package.nix b/pkgs/by-name/af/affine/package.nix
index ecb3eb7e60fc..51045670eb1f 100644
--- a/pkgs/by-name/af/affine/package.nix
+++ b/pkgs/by-name/af/affine/package.nix
@@ -43,12 +43,12 @@ in
 stdenv.mkDerivation (finalAttrs: {
   pname = binName;
 
-  version = "0.22.3";
+  version = "0.22.4";
   src = fetchFromGitHub {
     owner = "toeverything";
     repo = "AFFiNE";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LTNJsW7ETIca3uADuoa0ROOOMQT8+LN8+B8VVUyDZSY=";
+    hash = "sha256-IvVNnh8EDRSnIGeomLkO+I9fpbzrxC8jOStCh//RF8A=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
@@ -98,7 +98,7 @@ stdenv.mkDerivation (finalAttrs: {
       '';
     dontInstall = true;
     outputHashMode = "recursive";
-    outputHash = "sha256-fwvv3OXDorcyikixEoOMnu3dv24ClGBS6h3oWAk0uas=";
+    outputHash = "sha256-6Co65RkzLnk4U9ibiN0cO0bWRvbUHECzd+GQ8pwIxBE=";
   };
 
   buildInputs = lib.optionals hostPlatform.isDarwin [
diff --git a/pkgs/by-name/as/ashell/package.nix b/pkgs/by-name/as/ashell/package.nix
index a270b3fb92a2..1197f97b5fb6 100644
--- a/pkgs/by-name/as/ashell/package.nix
+++ b/pkgs/by-name/as/ashell/package.nix
@@ -14,17 +14,17 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "ashell";
-  version = "0.4.1";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "MalpenZibo";
     repo = "ashell";
     tag = version;
-    hash = "sha256-J97MRYYkNx8Ze4vcxZTDVOSQLCANyIBcDtqZEsEZ80w=";
+    hash = "sha256-4OJHnYy3LcABDaSraqoXdTpdfcjRQd+B4hc2AOM/oi8=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-XDcCCKq/NOzaKTDwVu0GCeGV70IlJ2TvD0w8ib+lEhg=";
+  cargoHash = "sha256-6NNWdAUZQY2yPW8OGeQUjOCV+REI+LU2wpJGitqq5hI=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/br/bruno/package.nix b/pkgs/by-name/br/bruno/package.nix
index 45f3d2d7856c..a9e3b9577ba7 100644
--- a/pkgs/by-name/br/bruno/package.nix
+++ b/pkgs/by-name/br/bruno/package.nix
@@ -19,20 +19,20 @@
 
 buildNpmPackage rec {
   pname = "bruno";
-  version = "2.5.0";
+  version = "2.6.1";
 
   src = fetchFromGitHub {
     owner = "usebruno";
     repo = "bruno";
     tag = "v${version}";
-    hash = "sha256-5kCYKktD71LdknIITSXzl/r5IRUyBUCKL9mmjsMwYRI=";
+    hash = "sha256-GR/TmBuZbt/8cB9gtRPgzSVnzdrB1BKhYjahfJ3ErgQ=";
 
     postFetch = ''
       ${lib.getExe npm-lockfile-fix} $out/package-lock.json
     '';
   };
 
-  npmDepsHash = "sha256-AA+f6xVd1hmZUum7AlhHivqNez7xP1kEd/GXd798QCI=";
+  npmDepsHash = "sha256-/u7xyd1+RXNN7khVOglzYGMCI+fPjyiuSF2BSZAqEtI=";
   npmFlags = [ "--legacy-peer-deps" ];
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/ca/cargo-psp/package.nix b/pkgs/by-name/ca/cargo-psp/package.nix
new file mode 100644
index 000000000000..03957e7599a3
--- /dev/null
+++ b/pkgs/by-name/ca/cargo-psp/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  fetchCrate,
+  rustPlatform,
+  makeBinaryWrapper,
+  nix-update-script,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "cargo-psp";
+  version = "0.2.8";
+
+  src = fetchCrate {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-Jud89nYJq4xZn2HudmSA82hOYwItrrTblhIfeqqIqm8=";
+  };
+
+  cargoHash = "sha256-oL2KbhpqvPhtN7hpAuR6a383pPKlW1XuXkoew0ZvPUo=";
+
+  nativeBuildInputs = [
+    makeBinaryWrapper
+  ];
+
+  postInstall = ''
+    wrapProgram "$out/bin/cargo-psp" \
+      --prefix PATH : "$out/bin"
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Cargo build wrapper for creating Sony PSP executables";
+    homepage = "https://github.com/overdrivenpotato/rust-psp/tree/master/cargo-psp";
+    changelog = "https://github.com/overdrivenpotato/rust-psp/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    mainProgram = "cargo-psp";
+    platforms = with lib.platforms; linux ++ darwin;
+    maintainers = with lib.maintainers; [
+      griffi-gh
+    ];
+  };
+})
diff --git a/pkgs/by-name/ch/chirp/package.nix b/pkgs/by-name/ch/chirp/package.nix
index 48e3db76a449..0562d1170760 100644
--- a/pkgs/by-name/ch/chirp/package.nix
+++ b/pkgs/by-name/ch/chirp/package.nix
@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication {
   pname = "chirp";
-  version = "0.4.0-unstable-2025-06-03";
+  version = "0.4.0-unstable-2025-06-19";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kk7ds";
     repo = "chirp";
-    rev = "c61c1e464d7f7cbc74beb118e27b10d40a2aa9e0";
-    hash = "sha256-7OFLUrwdSGYvShjSRIOiecNjkvCx2vBhV33aQVtGNYI=";
+    rev = "e669e01f3e23c4f03e5e9499dbafae0095339047";
+    hash = "sha256-ilyCq9qdvLVk6Gpgs79WjyfXHBROI9W4A4HqxNjsYko=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/co/cosmic-protocols/package.nix b/pkgs/by-name/co/cosmic-protocols/package.nix
index 915552203b0b..01db9b8bf909 100644
--- a/pkgs/by-name/co/cosmic-protocols/package.nix
+++ b/pkgs/by-name/co/cosmic-protocols/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation {
   pname = "cosmic-protocols";
-  version = "0-unstable-2025-05-02";
+  version = "0-unstable-2025-06-19";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-protocols";
-    rev = "1425bd44ed2b318a552201cc752ae11f2f483ef5";
-    hash = "sha256-rzLust1BKbITEgN7Hwjy1CT+4iOipv+4VIixfUAuCms=";
+    rev = "408af98de5122577a0df80a64b85c7e1c5c7b6e0";
+    hash = "sha256-yfCtv0HfxlyCABCVTRUiutHxfPEu0Anp+cdkdVwyyRY=";
   };
 
   makeFlags = [ "PREFIX=${placeholder "out"}" ];
diff --git a/pkgs/by-name/cs/csdp/package.nix b/pkgs/by-name/cs/csdp/package.nix
index 305e98e851a6..f858bb526114 100644
--- a/pkgs/by-name/cs/csdp/package.nix
+++ b/pkgs/by-name/cs/csdp/package.nix
@@ -24,6 +24,8 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace Makefile --replace /usr/local/bin $out/bin
+    substituteInPlace lib/Makefile \
+      --replace-fail 'ar cr' '${stdenv.cc.targetPrefix}ar cr'
   '';
 
   preInstall = ''
diff --git a/pkgs/by-name/ec/ecapture/package.nix b/pkgs/by-name/ec/ecapture/package.nix
index e58685562df4..2e588fbe8d06 100644
--- a/pkgs/by-name/ec/ecapture/package.nix
+++ b/pkgs/by-name/ec/ecapture/package.nix
@@ -22,13 +22,13 @@
 
 buildGoModule rec {
   pname = "ecapture";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "gojue";
     repo = "ecapture";
     tag = "v${version}";
-    hash = "sha256-mYnAa4zh7MqTTS2iU97YOhRbrCLd8C7D5furHNSO0F8=";
+    hash = "sha256-4cdjdTJjblI6ywpVE1/ZuM4gGkD2uZdfwfFx2gtr5yE=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/fi/filesender/package.nix b/pkgs/by-name/fi/filesender/package.nix
index 8e85b598c5f1..5f38afdc1845 100644
--- a/pkgs/by-name/fi/filesender/package.nix
+++ b/pkgs/by-name/fi/filesender/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "filesender";
-  version = "2.54";
+  version = "2.56";
 
   src = fetchFromGitHub {
     owner = "filesender";
     repo = "filesender";
     tag = "filesender-${finalAttrs.version}";
-    hash = "sha256-FmTjnOlst3KfKTHKw2KqkLNhK0IhfYVAbVv7tMSg6e8=";
+    hash = "sha256-nGmjhki3RKwpZXd90Nh2VAhwNFIZE0GSdKPjsRJEP0k=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ga/gauge-unwrapped/package.nix b/pkgs/by-name/ga/gauge-unwrapped/package.nix
index 814c75ee3971..46df45b420ea 100644
--- a/pkgs/by-name/ga/gauge-unwrapped/package.nix
+++ b/pkgs/by-name/ga/gauge-unwrapped/package.nix
@@ -6,7 +6,7 @@
 
 buildGoModule rec {
   pname = "gauge";
-  version = "1.6.17";
+  version = "1.6.18";
 
   patches = [
     # adds a check which adds an error message when trying to
@@ -18,7 +18,7 @@ buildGoModule rec {
     owner = "getgauge";
     repo = "gauge";
     tag = "v${version}";
-    hash = "sha256-2ThnmniL2YQKBBKlBPNdO/xkHTj1JFQ0xZ5mFAjwRMg=";
+    hash = "sha256-kO+cTpRBmtWHfHNWYBFMatrB+YmdfI1l0dgx4WdLkCo=";
   };
 
   vendorHash = "sha256-bOsuFGxYTxQ2qju4JsXFsk8/SrDxo5/PthwuLZSMfsI=";
diff --git a/pkgs/by-name/gd/gdbuspp/package.nix b/pkgs/by-name/gd/gdbuspp/package.nix
index 1d371de5192f..178de797b65f 100644
--- a/pkgs/by-name/gd/gdbuspp/package.nix
+++ b/pkgs/by-name/gd/gdbuspp/package.nix
@@ -6,6 +6,7 @@
   ninja,
   glib,
   pkg-config,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation rec {
@@ -30,6 +31,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [ glib ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "GDBus++ - a glib2 D-Bus wrapper for C++";
     longDescription = ''
diff --git a/pkgs/by-name/gn/gnss-sdr/fix_libcpu_features_install_path.patch b/pkgs/by-name/gn/gnss-sdr/fix_libcpu_features_install_path.patch
index 4ff86bfab4be..39b18c15945a 100644
--- a/pkgs/by-name/gn/gnss-sdr/fix_libcpu_features_install_path.patch
+++ b/pkgs/by-name/gn/gnss-sdr/fix_libcpu_features_install_path.patch
@@ -1,6 +1,8 @@
---- i/CMakeLists.txt
-+++ w/CMakeLists.txt
-@@ -1233,7 +1233,7 @@ if(NOT VOLKGNSSSDR_FOUND)
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 839744f3a..3639bc1c4 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -1314,7 +1314,7 @@ if(NOT VOLKGNSSSDR_FOUND)
              BINARY_DIR ${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/build
              CMAKE_ARGS ${VOLK_GNSSSDR_CMAKE_ARGS}
                  -DCMAKE_BUILD_TYPE=$<$<CONFIG:None>:None>$<$<CONFIG:Debug>:Debug>$<$<CONFIG:Release>:Release>$<$<CONFIG:RelWithDebInfo>:RelWithDebInfo>$<$<CONFIG:MinSizeRel>:MinSizeRel>$<$<CONFIG:NoOptWithASM>:NoOptWithASM>$<$<CONFIG:Coverage>:Coverage>$<$<CONFIG:O2WithASM>:O2WithASM>$<$<CONFIG:O3WithASM>:O3WithASM>$<$<CONFIG:ASAN>:ASAN>
@@ -9,7 +11,16 @@
              DOWNLOAD_COMMAND ""
              UPDATE_COMMAND ""
              PATCH_COMMAND ""
-@@ -1274,7 +1274,7 @@ if(NOT VOLKGNSSSDR_FOUND)
+@@ -1324,7 +1324,7 @@ if(NOT VOLKGNSSSDR_FOUND)
+     else()
+         if(SUPPORTED_CPU_FEATURES_ARCH)
+             set(VOLK_GNSSSDR_BUILD_BYPRODUCTS
+-                ${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/install/${CMAKE_INSTALL_LIBDIR}/${CMAKE_FIND_LIBRARY_PREFIXES}volk_gnsssdr${CMAKE_STATIC_LIBRARY_SUFFIX}
++                ${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/install/lib/${CMAKE_FIND_LIBRARY_PREFIXES}volk_gnsssdr${CMAKE_STATIC_LIBRARY_SUFFIX}
+                 ${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/install/bin/volk_gnsssdr_profile
+             )
+             if(ENABLE_CPUFEATURES)
+@@ -1355,7 +1355,7 @@ if(NOT VOLKGNSSSDR_FOUND)
                      )
                      set(VOLK_GNSSSDR_BUILD_BYPRODUCTS
                          ${VOLK_GNSSSDR_BUILD_BYPRODUCTS}
@@ -18,7 +29,7 @@
                      )
                  endif()
              endif()
-@@ -1287,7 +1287,7 @@ if(NOT VOLKGNSSSDR_FOUND)
+@@ -1368,7 +1368,7 @@ if(NOT VOLKGNSSSDR_FOUND)
                  BINARY_DIR ${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/build
                  CMAKE_ARGS ${VOLK_GNSSSDR_CMAKE_ARGS}
                      -DCMAKE_BUILD_TYPE=$<$<CONFIG:None>:None>$<$<CONFIG:Debug>:Debug>$<$<CONFIG:Release>:Release>$<$<CONFIG:RelWithDebInfo>:RelWithDebInfo>$<$<CONFIG:MinSizeRel>:MinSizeRel>$<$<CONFIG:NoOptWithASM>:NoOptWithASM>$<$<CONFIG:Coverage>:Coverage>$<$<CONFIG:O2WithASM>:O2WithASM>$<$<CONFIG:O3WithASM>:O3WithASM>$<$<CONFIG:ASAN>:ASAN>
@@ -27,7 +38,7 @@
                  DOWNLOAD_COMMAND ""
                  UPDATE_COMMAND ""
                  PATCH_COMMAND ""
-@@ -1306,7 +1306,7 @@ if(NOT VOLKGNSSSDR_FOUND)
+@@ -1387,12 +1387,12 @@ if(NOT VOLKGNSSSDR_FOUND)
                  BINARY_DIR ${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/build
                  CMAKE_ARGS ${VOLK_GNSSSDR_CMAKE_ARGS}
                      -DCMAKE_BUILD_TYPE=$<$<CONFIG:None>:None>$<$<CONFIG:Debug>:Debug>$<$<CONFIG:Release>:Release>$<$<CONFIG:RelWithDebInfo>:RelWithDebInfo>$<$<CONFIG:MinSizeRel>:MinSizeRel>$<$<CONFIG:NoOptWithASM>:NoOptWithASM>$<$<CONFIG:Coverage>:Coverage>$<$<CONFIG:O2WithASM>:O2WithASM>$<$<CONFIG:O3WithASM>:O3WithASM>$<$<CONFIG:ASAN>:ASAN>
@@ -36,7 +47,31 @@
                  DOWNLOAD_COMMAND ""
                  UPDATE_COMMAND ""
                  PATCH_COMMAND ""
-@@ -1346,7 +1346,7 @@ if(NOT VOLKGNSSSDR_FOUND)
+                 BUILD_COMMAND ${VOLK_GNSSSDR_BUILD_COMMAND}
+-                BUILD_BYPRODUCTS ${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/install/${CMAKE_INSTALL_LIBDIR}/${CMAKE_FIND_LIBRARY_PREFIXES}volk_gnsssdr${CMAKE_STATIC_LIBRARY_SUFFIX}
++                BUILD_BYPRODUCTS ${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/install/lib/${CMAKE_FIND_LIBRARY_PREFIXES}volk_gnsssdr${CMAKE_STATIC_LIBRARY_SUFFIX}
+                     ${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/install/bin/volk_gnsssdr_profile
+                     ${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/install/bin/volk_gnsssdr-config-info
+                 INSTALL_DIR ${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/install
+@@ -1406,7 +1406,7 @@ if(NOT VOLKGNSSSDR_FOUND)
+     endif()
+ 
+     add_library(volk_gnsssdr UNKNOWN IMPORTED)
+-    set_property(TARGET volk_gnsssdr PROPERTY IMPORTED_LOCATION ${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/install/${CMAKE_INSTALL_LIBDIR}/libvolk_gnsssdr${CMAKE_STATIC_LIBRARY_SUFFIX})
++    set_property(TARGET volk_gnsssdr PROPERTY IMPORTED_LOCATION ${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/install/lib/libvolk_gnsssdr${CMAKE_STATIC_LIBRARY_SUFFIX})
+     set(VOLK_GNSSSDR_INCLUDE_DIRS "${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/build/include/;${GNSSSDR_SOURCE_DIR}/src/algorithms/libs/volk_gnsssdr_module/volk_gnsssdr/include;${ORC_INCLUDE_DIRS}")
+     set(VOLK_GNSSSDR_LIBRARIES volk_gnsssdr ${ORC_LIBRARIES_STATIC})
+     if(CPUFEATURES_FOUND)
+@@ -1419,7 +1419,7 @@ if(NOT VOLKGNSSSDR_FOUND)
+         add_dependencies(Volkgnsssdr::volkgnsssdr volk_gnsssdr_module)
+         set_target_properties(Volkgnsssdr::volkgnsssdr PROPERTIES
+             IMPORTED_LINK_INTERFACE_LANGUAGES "CXX"
+-            IMPORTED_LOCATION "${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/install/${CMAKE_INSTALL_LIBDIR}/libvolk_gnsssdr${CMAKE_STATIC_LIBRARY_SUFFIX}"
++            IMPORTED_LOCATION "${GNSSSDR_BINARY_DIR}/volk_gnsssdr_module/install/lib/libvolk_gnsssdr${CMAKE_STATIC_LIBRARY_SUFFIX}"
+             INCLUDE_DIRECTORIES "${VOLK_GNSSSDR_INCLUDE_DIRS}"
+             INTERFACE_INCLUDE_DIRECTORIES "${VOLK_GNSSSDR_INCLUDE_DIRS}"
+             INTERFACE_LINK_LIBRARIES "${VOLK_GNSSSDR_LIBRARIES}"
+@@ -1427,7 +1427,7 @@ if(NOT VOLKGNSSSDR_FOUND)
          if(CMAKE_VERSION VERSION_GREATER 3.0 AND SUPPORTED_CPU_FEATURES_ARCH)
              if(NOT CPUFEATURES_FOUND AND ENABLE_CPUFEATURES)
                  set_target_properties(Volkgnsssdr::volkgnsssdr PROPERTIES
diff --git a/pkgs/by-name/gn/gnss-sdr/package.nix b/pkgs/by-name/gn/gnss-sdr/package.nix
index e3a242b42d53..3ed4bc4e415a 100644
--- a/pkgs/by-name/gn/gnss-sdr/package.nix
+++ b/pkgs/by-name/gn/gnss-sdr/package.nix
@@ -19,17 +19,18 @@
   matio,
   pugixml,
   protobuf,
+  enableOsmosdr ? true,
 }:
 
 gnuradio.pkgs.mkDerivation rec {
   pname = "gnss-sdr";
-  version = "0.0.19.1";
+  version = "0.0.20";
 
   src = fetchFromGitHub {
     owner = "gnss-sdr";
     repo = "gnss-sdr";
     rev = "v${version}";
-    sha256 = "sha256-IbkYdw1pwI+FMnZMChsxMz241Kv4EzMcBb0mm6/jq1k=";
+    hash = "sha256-kQv8I4dcWeRuAfYtD5EAAMwvfnOTi+QWDogUZb4M/qQ=";
   };
 
   patches = [
@@ -81,6 +82,9 @@ gnuradio.pkgs.mkDerivation rec {
     ]
     ++ lib.optionals (gnuradio.hasFeature "gr-pdu") [
       gnuradio.unwrapped.libad9361
+    ]
+    ++ lib.optionals (enableOsmosdr) [
+      gnuradio.pkgs.osmosdr
     ];
 
   cmakeFlags = [
@@ -98,9 +102,13 @@ gnuradio.pkgs.mkDerivation rec {
     (lib.cmakeBool "ENABLE_UHD" (gnuradio.hasFeature "gr-uhd"))
     (lib.cmakeBool "ENABLE_FMCOMMS2" (gnuradio.hasFeature "gr-iio" && gnuradio.hasFeature "gr-pdu"))
     (lib.cmakeBool "ENABLE_PLUTOSDR" (gnuradio.hasFeature "gr-iio"))
-    (lib.cmakeBool "ENABLE_AD9361" (gnuradio.hasFeature "gr-pdu"))
+    (lib.cmakeBool "ENABLE_OSMOSDR" enableOsmosdr)
     (lib.cmakeBool "ENABLE_UNIT_TESTING" false)
 
+    # Requires unpackaged gnsstk
+    # Only relevant if you want to run gnss-sdr on FPGA SoCs like Zynq
+    # (lib.cmakeBool "ENABLE_AD9361" (gnuradio.hasFeature "gr-pdu"))
+
     # gnss-sdr doesn't truly depend on BLAS or LAPACK, as long as
     # armadillo is built using both, so skip checking for them.
     (lib.cmakeFeature "BLAS_LIBRARIES" "-lblas")
diff --git a/pkgs/by-name/go/go-musicfox/package.nix b/pkgs/by-name/go/go-musicfox/package.nix
index 1125622d4752..81178025bb2d 100644
--- a/pkgs/by-name/go/go-musicfox/package.nix
+++ b/pkgs/by-name/go/go-musicfox/package.nix
@@ -11,18 +11,18 @@
 
 buildGoModule rec {
   pname = "go-musicfox";
-  version = "4.6.0";
+  version = "4.6.2";
 
   src = fetchFromGitHub {
     owner = "go-musicfox";
     repo = "go-musicfox";
     rev = "v${version}";
-    hash = "sha256-pzB57XeDD8lfJMkP9/k1rrszYXYYzQt2UekH2Atiqjw=";
+    hash = "sha256-GpzbHShQvsgPNnUjk52PSDhvmxEuJVXNXI7z8ESv6QQ=";
   };
 
   deleteVendor = true;
 
-  vendorHash = "sha256-IO/UlOW6pLZp6JaU5P9vUJ0qx0Srvmb5vjpX1pSdaeM=";
+  vendorHash = "sha256-RK0mBnRzh9cbqrdJHQk5eJPREFDKGbjnQyEIF23xrvU=";
 
   subPackages = [ "cmd/musicfox.go" ];
 
diff --git a/pkgs/by-name/gr/gradia/package.nix b/pkgs/by-name/gr/gradia/package.nix
new file mode 100644
index 000000000000..4b1bfb819231
--- /dev/null
+++ b/pkgs/by-name/gr/gradia/package.nix
@@ -0,0 +1,63 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  meson,
+  ninja,
+  appstream,
+  desktop-file-utils,
+  gobject-introspection,
+  wrapGAppsHook4,
+  blueprint-compiler,
+  libadwaita,
+  libportal-gtk4,
+}:
+python3Packages.buildPythonApplication rec {
+  pname = "gradia";
+  version = "1.4.3";
+  pyproject = false;
+
+  src = fetchFromGitHub {
+    owner = "AlexanderVanhee";
+    repo = "Gradia";
+    tag = "v${version}";
+    hash = "sha256-cH8aL1nvDNAnvN+TYAtGez5Ot5DmwpmxugBPS36rY+Q=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    appstream
+    desktop-file-utils
+    gobject-introspection
+    wrapGAppsHook4
+    blueprint-compiler
+  ];
+
+  buildInputs = [
+    libadwaita
+    libportal-gtk4
+  ];
+
+  dependencies = with python3Packages; [
+    pygobject3
+    pillow
+  ];
+
+  dontWrapGApps = true;
+
+  makeWrapperArgs = [ "\${gappsWrapperArgs[@]}" ];
+
+  meta = {
+    description = "Make your screenshots ready for the world";
+    homepage = "https://github.com/AlexanderVanhee/Gradia";
+    changelog = "https://github.com/AlexanderVanhee/Gradia/releases/tag/${src.tag}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [
+      Cameo007
+      quadradical
+    ];
+    mainProgram = "gradia";
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/in/insulator2/package.nix b/pkgs/by-name/in/insulator2/package.nix
index 9e5d2c2eac0f..b74147d0e620 100644
--- a/pkgs/by-name/in/insulator2/package.nix
+++ b/pkgs/by-name/in/insulator2/package.nix
@@ -1,26 +1,26 @@
 {
   lib,
-  cmake,
-  dbus,
+  stdenv,
+
   fetchFromGitHub,
   fetchYarnDeps,
-  openssl,
-  pkg-config,
-  freetype,
-  libsoup_2_4,
-  gtk3,
-  webkitgtk_4_0,
-  perl,
-  cyrus_sasl,
-  stdenv,
-  yarnConfigHook,
-  nodejs-slim,
-  cargo-tauri_1,
+
   cargo,
-  rustPlatform,
-  rustc,
+  cargo-tauri_1,
+  cmake,
   jq,
   moreutils,
+  nodejs-slim,
+  pkg-config,
+  rustc,
+  rustPlatform,
+  yarnConfigHook,
+
+  cyrus_sasl,
+  freetype,
+  libsoup_2_4,
+  openssl,
+  webkitgtk_4_0,
 }:
 
 stdenv.mkDerivation rec {
@@ -60,36 +60,33 @@ stdenv.mkDerivation rec {
   cargoRoot = "backend/";
   buildAndTestSubdir = cargoRoot;
 
+  strictDeps = true;
+
   dontUseCmakeConfigure = true;
 
-  preInstall = ''
-    mkdir -p "$out"
-  '';
-
   nativeBuildInputs = [
-    cmake
-    pkg-config
-    perl
-    rustPlatform.cargoSetupHook
     cargo
-    rustc
     cargo-tauri_1.hook
-    yarnConfigHook
-    nodejs-slim
-    cyrus_sasl
+    cmake
     jq
     moreutils # for sponge
+    nodejs-slim
+    pkg-config
+    rustc
+    rustPlatform.cargoSetupHook
+    yarnConfigHook
   ];
 
   buildInputs = [
-    dbus
-    openssl.out
+    cyrus_sasl
     freetype
     libsoup_2_4
-    gtk3
+    openssl
     webkitgtk_4_0
   ];
 
+  env.OPENSSL_NO_VENDOR = 1;
+
   meta = with lib; {
     description = "Client UI to inspect Kafka topics, consume, produce and much more";
     homepage = "https://github.com/andrewinci/insulator2";
diff --git a/pkgs/by-name/je/jetbrains-toolbox/package.nix b/pkgs/by-name/je/jetbrains-toolbox/package.nix
index c2ffbfd54493..eb4b612bdab3 100644
--- a/pkgs/by-name/je/jetbrains-toolbox/package.nix
+++ b/pkgs/by-name/je/jetbrains-toolbox/package.nix
@@ -1,18 +1,16 @@
 {
   lib,
-  stdenv,
-  appimageTools,
+  stdenvNoCC,
+  buildFHSEnv,
   fetchzip,
   fetchurl,
-  makeWrapper,
-  icu,
-  libappindicator-gtk3,
+  appimageTools,
   undmg,
 }:
 
 let
   pname = "jetbrains-toolbox";
-  version = "2.6.2.41321";
+  version = "2.6.3.43718";
 
   updateScript = ./update.sh;
 
@@ -20,7 +18,8 @@ let
     description = "Jetbrains Toolbox";
     homepage = "https://jetbrains.com/";
     license = lib.licenses.unfree;
-    maintainers = with lib.maintainers; [ AnatolyPopov ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    maintainers = with lib.maintainers; [ ners ];
     platforms = [
       "aarch64-linux"
       "aarch64-darwin"
@@ -31,70 +30,77 @@ let
   };
 
   selectSystem =
-    attrs:
-    attrs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+    let
+      inherit (stdenvNoCC.hostPlatform) system;
+    in
+    attrs: attrs.${system} or (throw "Unsupported system: ${system}");
 
-  linux = appimageTools.wrapAppImage rec {
-    inherit pname version meta;
+  selectKernel =
+    let
+      inherit (stdenvNoCC.hostPlatform.parsed) kernel;
+    in
+    attrs: attrs.${kernel.name} or (throw "Unsupported kernel: ${kernel.name}");
 
-    source =
-      let
-        arch = selectSystem {
-          x86_64-linux = "";
-          aarch64-linux = "-arm64";
-        };
-      in
-      fetchzip {
-        url = "https://download.jetbrains.com/toolbox/jetbrains-toolbox-${version}${arch}.tar.gz";
-        hash = selectSystem {
-          x86_64-linux = "sha256-nIvlO313GZhIpgyCUhp2FUzllD3tk0oRrxFzxtHSIQA=";
-          aarch64-linux = "sha256-iggrnpjqLEqiteXnmA+eynTB7cs9YeOnNW4DWGP6mk0=";
-        };
+  selectCpu =
+    let
+      inherit (stdenvNoCC.hostPlatform.parsed) cpu;
+    in
+    attrs: attrs.${cpu.name} or (throw "Unsupported CPU: ${cpu.name}");
+
+  sourceForVersion =
+    version:
+    let
+      archSuffix = selectCpu {
+        x86_64 = "";
+        aarch64 = "-arm64";
       };
-
-    src = appimageTools.extractType2 {
-      inherit pname version;
-      src = source + "/jetbrains-toolbox";
+      hash = selectSystem {
+        x86_64-linux = "sha256-qsj2Jsf4P03LeekaAcUQLVloKpY1pjnT0ffdo0LSD3M=";
+        aarch64-linux = "sha256-QkavbPl1EnucbHWwqUcResuOFybMZLGlhZzv+YGqzeY=";
+        x86_64-darwin = "sha256-3CzUKAp+Y/sCnGgI7UkMun4XnNEUSIg9dWFile1MLk4=";
+        aarch64-darwin = "sha256-A4smWImeHwgQa9oaRpt/WPRxG+DWCdQ7ZrjNNKwV06I=";
+      };
+    in
+    selectKernel {
+      linux = fetchzip {
+        url = "https://download-cdn.jetbrains.com/toolbox/jetbrains-toolbox-${version}${archSuffix}.tar.gz";
+        inherit hash;
+      };
+      darwin = fetchurl {
+        url = "https://download-cdn.jetbrains.com/toolbox/jetbrains-toolbox-${version}${archSuffix}.dmg";
+        inherit hash;
+      };
+    };
+in
+selectKernel {
+  linux =
+    let
+      src = sourceForVersion version;
+    in
+    buildFHSEnv {
+      inherit pname version meta;
+      passthru = {
+        inherit src updateScript;
+      };
+      multiPkgs =
+        pkgs:
+        with pkgs;
+        [
+          icu
+          libappindicator-gtk3
+        ]
+        ++ appimageTools.defaultFhsEnvArgs.multiPkgs pkgs;
+      runScript = "${src}/bin/jetbrains-toolbox --update-failed";
     };
 
-    nativeBuildInputs = [ makeWrapper ];
+  darwin = stdenvNoCC.mkDerivation (finalAttrs: {
+    inherit
+      pname
+      version
+      meta
+      ;
 
-    extraInstallCommands = ''
-      install -Dm644 ${src}/jetbrains-toolbox.desktop $out/share/applications/jetbrains-toolbox.desktop
-      install -Dm644 ${src}/.DirIcon $out/share/icons/hicolor/scalable/apps/jetbrains-toolbox.svg
-      wrapProgram $out/bin/jetbrains-toolbox \
-        --prefix LD_LIBRARY_PATH : ${
-          lib.makeLibraryPath [
-            icu
-            libappindicator-gtk3
-          ]
-        } \
-        --append-flags "--update-failed"
-    '';
-
-    passthru = {
-      src = source;
-      inherit updateScript;
-    };
-  };
-
-  darwin = stdenv.mkDerivation (finalAttrs: {
-    inherit pname version meta;
-
-    src =
-      let
-        arch = selectSystem {
-          x86_64-darwin = "";
-          aarch64-darwin = "-arm64";
-        };
-      in
-      fetchurl {
-        url = "https://download.jetbrains.com/toolbox/jetbrains-toolbox-${finalAttrs.version}${arch}.dmg";
-        hash = selectSystem {
-          x86_64-darwin = "sha256-518Ew3yhj6wrTfPklNTC6La0EOb/XmrFcNmoeNbod8k=";
-          aarch64-darwin = "sha256-Enyn4iJn8qLUdrvin44bGLv0dzl5VOL6KPi4AODhtPE=";
-        };
-      };
+    src = sourceForVersion finalAttrs.version;
 
     nativeBuildInputs = [ undmg ];
 
@@ -114,5 +120,4 @@ let
       inherit updateScript;
     };
   });
-in
-if stdenv.hostPlatform.isDarwin then darwin else linux
+}
diff --git a/pkgs/by-name/je/jetbrains-toolbox/update.sh b/pkgs/by-name/je/jetbrains-toolbox/update.sh
index a6b1d812c9d9..6e0619033962 100755
--- a/pkgs/by-name/je/jetbrains-toolbox/update.sh
+++ b/pkgs/by-name/je/jetbrains-toolbox/update.sh
@@ -4,7 +4,7 @@
 set -eou pipefail
 
 latestVersion=$(curl -Ls 'https://data.services.jetbrains.com/products?code=TBA&release.type=release' | jq -r '.[0].releases | flatten | .[0].build')
-currentVersion=$(nix-instantiate --eval -E "with import ./. {}; jetbrains-toolbox.version or (lib.getVersion jetbrains-toolbox)" | tr -d '"')
+currentVersion=$(nix-instantiate --eval -E "with import ./. {}; jetbrains-toolbox.version" | tr -d '"')
 
 echo "latest  version: $latestVersion"
 echo "current version: $currentVersion"
@@ -14,28 +14,20 @@ if [[ "$latestVersion" == "$currentVersion" ]]; then
     exit 0
 fi
 
-linux_systems=(
-    "x86_64-linux:"
-    "aarch64-linux:-arm64"
-)
+update-source-version jetbrains-toolbox $latestVersion
 
-for entry in "${linux_systems[@]}"; do
-    arch="${entry%%:*}"
-    suffix="${entry#*:}"
-    prefetch=$(nix-prefetch-url --unpack "https://download.jetbrains.com/toolbox/jetbrains-toolbox-$latestVersion$suffix.tar.gz")
+systems=$(nix-instantiate --eval --json -E 'with import ./. {}; jetbrains-toolbox.meta.platforms' | jq -r '.[]')
+
+for system in $systems; do
+    arch="${system%%:*}"
+    suffix="${system#*:}"
+    url=$(nix-instantiate --eval --json -E "with import ./. { system = \"$system\"; }; jetbrains-toolbox.src.url" | jq -r)
+    if [[ $url == *.tar.gz ]]; then
+      unpack="--unpack"
+    else
+      unpack=""
+    fi
+    prefetch=$(nix-prefetch-url $unpack "$url")
     hash=$(nix hash convert --hash-algo sha256 --to sri $prefetch)
-    update-source-version jetbrains-toolbox $latestVersion $hash --system=$arch --ignore-same-version
-done
-
-darwin_systems=(
-    "x86_64-darwin:"
-    "aarch64-darwin:-arm64"
-)
-
-for entry in "${darwin_systems[@]}"; do
-    arch="${entry%%:*}"
-    suffix="${entry#*:}"
-    prefetch=$(nix-prefetch-url "https://download.jetbrains.com/toolbox/jetbrains-toolbox-$latestVersion$suffix.dmg")
-    hash=$(nix hash convert --hash-algo sha256 --to sri $prefetch)
-    update-source-version jetbrains-toolbox $latestVersion $hash --system=$arch --ignore-same-version
+    update-source-version jetbrains-toolbox $latestVersion $hash --system=$system --ignore-same-version
 done
diff --git a/pkgs/by-name/jo/josm/package.nix b/pkgs/by-name/jo/josm/package.nix
index 82bfac60ac5d..dd0598ffbec4 100644
--- a/pkgs/by-name/jo/josm/package.nix
+++ b/pkgs/by-name/jo/josm/package.nix
@@ -11,21 +11,21 @@
 }:
 let
   pname = "josm";
-  version = "19396";
+  version = "19412";
   srcs = {
     jar = fetchurl {
       url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-      hash = "sha256-M4fm/tpsCsAhSvTGkgSi6IurGe0pJsqdT0XsCxgmzEo=";
+      hash = "sha256-lT7DoB4VJm9yBuQL+qYc4om/SFaJm8mH29R3P3mULjY=";
     };
     macosx = fetchurl {
       url = "https://josm.openstreetmap.de/download/macosx/josm-macos-${version}-java21.zip";
-      hash = "sha256-2Mn903WIyQAQ9nXyTi5kZHKnCUUfa+1UCAx0Yoj2AMU=";
+      hash = "sha256-INChmimPk8K0UuDHDIh5prjj/gx26Pv1g1MJhhHVd+8=";
     };
     pkg = fetchFromGitHub {
       owner = "JOSM";
       repo = "josm";
       tag = "${version}-tested";
-      hash = "sha256-9xEqf3SZN7in8CBoCBXGGQ5CS3Sf9ifZv7PAzJ2tO4k=";
+      hash = "sha256-5XOVDQzjZ6g5iGWTqhhO/yAxgBy4jSthDeHu4QpJxaY=";
     };
   };
 
diff --git a/pkgs/by-name/lu/lunasvg/package.nix b/pkgs/by-name/lu/lunasvg/package.nix
index 605d6dafc0d1..24c02f2d1571 100644
--- a/pkgs/by-name/lu/lunasvg/package.nix
+++ b/pkgs/by-name/lu/lunasvg/package.nix
@@ -7,13 +7,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "lunasvg";
-  version = "3.2.1";
+  version = "3.3.0";
 
   src = fetchFromGitHub {
     owner = "sammycage";
     repo = "lunasvg";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CBhz117Y8e7AdD1JJtNkR/EthsfyiQ05HW41beaY95I=";
+    hash = "sha256-1Cj6En0XedAeNPsLWCedxiiq8xPdJ4VpKmF4vYu4SC8=";
   };
 
   nativeBuildInputs = [
@@ -24,14 +24,14 @@ stdenv.mkDerivation (finalAttrs: {
     plutovg
   ];
 
-  patches = [
-    # https://github.com/sammycage/lunasvg/pull/219
-    # can be removed when the PR 219 and a new release is created
-    ./use_system_plutovg.patch
-  ];
-
   cmakeFlags = [
     (lib.cmakeBool "USE_SYSTEM_PLUTOVG" true)
+    # the cmake package does not handle absolute CMAKE_INSTALL_INCLUDEDIR correctly
+    # (setting it to an absolute path causes include files to go to $out/$out/include,
+    #  because the absolute path is interpreted with root at $out).
+    "-DCMAKE_INSTALL_INCLUDEDIR=include"
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+
   ];
 
   meta = {
diff --git a/pkgs/by-name/lu/lunasvg/use_system_plutovg.patch b/pkgs/by-name/lu/lunasvg/use_system_plutovg.patch
deleted file mode 100644
index b2e56f7866dd..000000000000
--- a/pkgs/by-name/lu/lunasvg/use_system_plutovg.patch
+++ /dev/null
@@ -1,47 +0,0 @@
-From 18d25de94046ed8223fe8987ca55b44f8b5f902c Mon Sep 17 00:00:00 2001
-From: eymeric <eymericdechelette@gmail.com>
-Date: Tue, 15 Apr 2025 22:16:50 +0200
-Subject: [PATCH] Refactor CMakeLists.txt to conditionally use system plutovg
- library
-
----
- CMakeLists.txt | 18 ++++++++++++++++--
- 1 file changed, 16 insertions(+), 2 deletions(-)
-
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 08cee28..9724827 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -6,8 +6,17 @@ set(LUNASVG_VERSION_MICRO 1)
- 
- project(lunasvg LANGUAGES CXX VERSION ${LUNASVG_VERSION_MAJOR}.${LUNASVG_VERSION_MINOR}.${LUNASVG_VERSION_MICRO})
- 
--find_package(plutovg 0.0.4 QUIET)
-+option(USE_SYSTEM_PLUTOVG "Use system plutovg library" OFF)
-+
-+if(USE_SYSTEM_PLUTOVG)
-+    find_package(plutovg 1.0.0 QUIET)
-+    if(NOT plutovg_FOUND)
-+        message(WARNING "Could not find: plutovg>=1.0.0. Falling back to plutovg submodule.")
-+    endif()
-+endif()
-+
- if(NOT plutovg_FOUND)
-+    message(STATUS "Using plutovg submodule.")
-     add_subdirectory(plutovg)
- endif()
- 
-@@ -57,7 +66,12 @@ target_include_directories(lunasvg PUBLIC
-     $<INSTALL_INTERFACE:include/lunasvg>
- )
- 
--target_link_libraries(lunasvg PRIVATE plutovg::plutovg)
-+if(USE_SYSTEM_PLUTOVG AND plutovg_FOUND)
-+    target_link_libraries(lunasvg PRIVATE plutovg::plutovg)
-+else()
-+    target_link_libraries(lunasvg PRIVATE plutovg)
-+endif()
-+
- target_compile_definitions(lunasvg PRIVATE LUNASVG_BUILD)
- if(NOT BUILD_SHARED_LIBS)
-     target_compile_definitions(lunasvg PUBLIC LUNASVG_BUILD_STATIC)
diff --git a/pkgs/by-name/md/mdns-scanner/package.nix b/pkgs/by-name/md/mdns-scanner/package.nix
new file mode 100644
index 000000000000..17e9f15247b6
--- /dev/null
+++ b/pkgs/by-name/md/mdns-scanner/package.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "mdns-scanner";
+  version = "0.12.1";
+
+  src = fetchFromGitHub {
+    owner = "CramBL";
+    repo = "mdns-scanner";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-I0/ms1FFTGgSk101GBascTSMBCLAmzqk2yiNYskedvU=";
+  };
+
+  cargoHash = "sha256-JdeIEaSfiMCQ9n3Y4DpTWhheHaA54zJKUsG/e4Xo9LU=";
+
+  meta = {
+    homepage = "https://github.com/CramBL/mdns-scanner";
+    description = "Scan a network and create a list of IPs and associated hostnames, including mDNS hostnames and other aliases";
+    changelog = "https://github.com/CramBL/mdns-scanner/releases/tag/${finalAttrs.src.tag}";
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    maintainers = with lib.maintainers; [ Cameo007 ];
+    mainProgram = "mdns-scanner";
+  };
+})
diff --git a/pkgs/by-name/ms/mslicer/package.nix b/pkgs/by-name/ms/mslicer/package.nix
index 9f288a65925f..1d01ee8c689e 100644
--- a/pkgs/by-name/ms/mslicer/package.nix
+++ b/pkgs/by-name/ms/mslicer/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mslicer";
-  version = "0.2.1";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "connorslade";
     repo = "mslicer";
     rev = finalAttrs.version;
-    hash = "sha256-VgbHFUQpxlQcYh3TNyw1IX7vyaWrHRxl4Oe5jake9Qg=";
+    hash = "sha256-37EOdMM/stMKwTTpQ0LWYZVUw2Y3CkoEGHWNthyQnSA=";
   };
 
-  cargoHash = "sha256-Bs/mQTMEQxRvKK9ibIAf4KLv9jzGv3hnduXFYEdjljc=";
+  cargoHash = "sha256-nkNoyoMqcFLCuQ8TqRn4e5L2zbgjw615HIAuLVqg0vQ=";
 
   buildInputs = [
     libglvnd
diff --git a/pkgs/by-name/ne/netns-proxy/package.nix b/pkgs/by-name/ne/netns-proxy/package.nix
new file mode 100644
index 000000000000..dd80465f5edf
--- /dev/null
+++ b/pkgs/by-name/ne/netns-proxy/package.nix
@@ -0,0 +1,32 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "netns-proxy";
+  version = "0.2.1";
+
+  src = fetchFromGitHub {
+    owner = "fooker";
+    repo = "netns-proxy";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-sTOhoiBCKognc5SIj9SVfhyjnuatHbIRNtQ73SxWX+Q=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-rf4cazRrHxHdT4U58sJtAHU2pfZ5+oAerSVdEt9/bGA=";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Simple and slim proxy to forward ports from and into linux network namespaces";
+    homepage = "https://github.com/fooker/netns-proxy";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    mainProgram = "netns-proxy";
+    maintainers = with lib.maintainers; [ fooker ];
+  };
+})
diff --git a/pkgs/by-name/op/openvpn3/package.nix b/pkgs/by-name/op/openvpn3/package.nix
index cf25ba7abce8..e6055468bc69 100644
--- a/pkgs/by-name/op/openvpn3/package.nix
+++ b/pkgs/by-name/op/openvpn3/package.nix
@@ -22,12 +22,12 @@
   gdbuspp,
   cmake,
   git,
+  nix-update-script,
   enableSystemdResolved ? true,
 }:
 
 stdenv.mkDerivation rec {
   pname = "openvpn3";
-  # also update openvpn3-core
   version = "24.1";
 
   src = fetchFromGitHub {
@@ -114,6 +114,8 @@ stdenv.mkDerivation rec {
 
   NIX_LDFLAGS = "-lpthread";
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "OpenVPN 3 Linux client";
     license = lib.licenses.agpl3Plus;
diff --git a/pkgs/by-name/ox/oxker/package.nix b/pkgs/by-name/ox/oxker/package.nix
index 1dc3cb54219e..ee7bbcd2acd5 100644
--- a/pkgs/by-name/ox/oxker/package.nix
+++ b/pkgs/by-name/ox/oxker/package.nix
@@ -7,15 +7,15 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "oxker";
-  version = "0.10.3";
+  version = "0.10.5";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-2xLTR5+0xtyYhc5+gYG78EMP/B5Vk6ZqEGsZwM2bAok=";
+    hash = "sha256-PRV++3s25xqrfVQ8stXBfc8fpAEzFNNeyJI2MrYbWy8=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-d6jaOtB6S8R6cdqLUnuPhDP6q9Hl6FTieFEiBibiDDE=";
+  cargoHash = "sha256-V72uikTto8M9BM0qQINHQ4HGFhXIf+JvzArhM/wg1wc=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/pr/presenterm/package.nix b/pkgs/by-name/pr/presenterm/package.nix
index fe868c832eb9..3e270de606b9 100644
--- a/pkgs/by-name/pr/presenterm/package.nix
+++ b/pkgs/by-name/pr/presenterm/package.nix
@@ -3,12 +3,15 @@
   stdenv,
   rustPlatform,
   fetchFromGitHub,
+  makeBinaryWrapper,
   lld,
   libsixel,
   versionCheckHook,
   nix-update-script,
 }:
-
+let
+  inherit (stdenv.hostPlatform) isDarwin isx86_64;
+in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "presenterm";
   version = "0.14.0";
@@ -20,9 +23,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-vBEHk0gQe4kUTtH4qtc0jVfDvYGabnkJrwPxmxt10hs=";
   };
 
-  nativeBuildInputs = lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
-    lld
-  ];
+  nativeBuildInputs =
+    lib.optionals isDarwin [
+      makeBinaryWrapper
+    ]
+    ++ lib.optionals (isDarwin && isx86_64) [
+      lld
+    ];
 
   buildInputs = [
     libsixel
@@ -35,7 +42,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   useFetchCargoVendor = true;
   cargoHash = "sha256-u0wOWKAfzi1Fxmx6x2ckrIv/PKgtqKrDiDauD4/BY24=";
 
-  env = lib.optionalAttrs (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) {
+  env = lib.optionalAttrs (isDarwin && isx86_64) {
     NIX_CFLAGS_LINK = "-fuse-ld=lld";
   };
 
@@ -48,6 +55,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "--skip=external_snippet"
   ];
 
+  # sixel-sys is dynamically linked to libsixel
+  postInstall = lib.optionalString isDarwin ''
+    wrapProgram $out/bin/presenterm \
+      --prefix DYLD_LIBRARY_PATH : "${lib.makeLibraryPath [ libsixel ]}"
+  '';
+
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
diff --git a/pkgs/by-name/re/readest/package.nix b/pkgs/by-name/re/readest/package.nix
index 6fb23209872a..6c5a7f7fe674 100644
--- a/pkgs/by-name/re/readest/package.nix
+++ b/pkgs/by-name/re/readest/package.nix
@@ -20,13 +20,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "readest";
-  version = "0.9.58";
+  version = "0.9.59";
 
   src = fetchFromGitHub {
     owner = "readest";
     repo = "readest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OXKYPcAugMW55TTID2iHeBPIdRiRzLJQ5pG4/kTIn/4=";
+    hash = "sha256-dGtu1BaKfsMOFp4b6S7nNdUrZLZ47c2TQQJ9V6rcjnE=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/rp/rpcs3/0001-cmake-add-option-to-use-system-cubeb.patch b/pkgs/by-name/rp/rpcs3/0001-cmake-add-option-to-use-system-cubeb.patch
deleted file mode 100644
index 0ae9f29ca514..000000000000
--- a/pkgs/by-name/rp/rpcs3/0001-cmake-add-option-to-use-system-cubeb.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-From 5af2b630da7a6a450ec6bc4f07fc7ad9a825361d Mon Sep 17 00:00:00 2001
-From: Marcin Serwin <marcin@serwin.dev>
-Date: Sat, 24 May 2025 18:51:09 +0200
-Subject: [PATCH] cmake: add option to use system cubeb
-
-Signed-off-by: Marcin Serwin <marcin@serwin.dev>
----
- 3rdparty/CMakeLists.txt | 9 ++++++++-
- CMakeLists.txt          | 1 +
- 2 files changed, 9 insertions(+), 1 deletion(-)
-
-diff --git a/3rdparty/CMakeLists.txt b/3rdparty/CMakeLists.txt
-index 044fd464e..6c49a889b 100644
---- a/3rdparty/CMakeLists.txt
-+++ b/3rdparty/CMakeLists.txt
-@@ -131,7 +131,14 @@ add_subdirectory(stblib)
- add_subdirectory(discord-rpc)
- 
- # Cubeb
--add_subdirectory(cubeb EXCLUDE_FROM_ALL)
-+if(USE_SYSTEM_CUBEB)
-+	find_package(cubeb REQUIRED GLOBAL)
-+	message(STATUS "Using system cubeb version '${cubeb_VERSION}'")
-+	add_library(3rdparty::cubeb ALIAS cubeb::cubeb)
-+else()
-+	message(STATUS "Using static cubeb from 3rdparty")
-+	add_subdirectory(cubeb EXCLUDE_FROM_ALL)
-+endif()
- 
- # SoundTouch
- add_subdirectory(SoundTouch EXCLUDE_FROM_ALL)
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 9d2edd836..39aa150c2 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -31,6 +31,7 @@ option(USE_SYSTEM_FFMPEG "Prefer system ffmpeg instead of the prebuild one" OFF)
- option(USE_SYSTEM_OPENAL "Prefer system OpenAL instead of the prebuild one" ON)
- option(USE_SYSTEM_CURL "Prefer system Curl instead of the prebuild one" ON)
- option(USE_SYSTEM_OPENCV "Prefer system OpenCV instead of the builtin one" ON)
-+option(USE_SYSTEM_CUBEB "Prefer system cubeb instead of the builtin one" OFF)
- option(HAS_MEMORY_BREAKPOINTS "Add support for memory breakpoints to the interpreter" OFF)
- option(USE_LTO "Use LTO for building" ON)
- option(BUILD_RPCS3_TESTS "Build RPCS3 unit tests." OFF)
--- 
-2.49.0
-
diff --git a/pkgs/by-name/rp/rpcs3/fix-qt6.9-compilation.patch b/pkgs/by-name/rp/rpcs3/fix-qt6.9-compilation.patch
deleted file mode 100644
index 13ca314d3022..000000000000
--- a/pkgs/by-name/rp/rpcs3/fix-qt6.9-compilation.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-From 600e4604169464c64cbf548e7629e483ad2aad1e Mon Sep 17 00:00:00 2001
-From: Megamouse <studienricky89@googlemail.com>
-Date: Mon, 7 Apr 2025 20:49:15 +0200
-Subject: [PATCH] Fix compilation with newer Qt
-
----
- rpcs3/rpcs3qt/game_list_base.cpp         | 2 +-
- rpcs3/rpcs3qt/game_list_frame.cpp        | 4 ++--
- rpcs3/rpcs3qt/ps_move_tracker_dialog.cpp | 4 ++--
- 3 files changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/rpcs3/rpcs3qt/game_list_base.cpp b/rpcs3/rpcs3qt/game_list_base.cpp
-index 72b45d33bfbb..21640906ee7e 100644
---- a/rpcs3/rpcs3qt/game_list_base.cpp
-+++ b/rpcs3/rpcs3qt/game_list_base.cpp
-@@ -25,7 +25,7 @@ void game_list_base::repaint_icons(std::vector<game_info>& game_data, const QCol
- 	for (game_info& game : game_data)
- 	{
- 		game->pxmap = placeholder;
--	
-+
- 		if (movie_item_base* item = game->item)
- 		{
- 			item->set_icon_load_func([this, game, device_pixel_ratio, cancel = item->icon_loading_aborted()](int)
-diff --git a/rpcs3/rpcs3qt/game_list_frame.cpp b/rpcs3/rpcs3qt/game_list_frame.cpp
-index a294d69cc68e..439913760053 100644
---- a/rpcs3/rpcs3qt/game_list_frame.cpp
-+++ b/rpcs3/rpcs3qt/game_list_frame.cpp
-@@ -2363,7 +2363,7 @@ void game_list_frame::BatchActionBySerials(progress_dialog* pdlg, const std::set
- 
- 		connect(future_watcher, &QFutureWatcher<void>::finished, this, [=, this]()
- 		{
--			pdlg->setLabelText(progressLabel.arg(*index).arg(serials_size));
-+			pdlg->setLabelText(progressLabel.arg(index->load()).arg(serials_size));
- 			pdlg->setCancelButtonText(tr("OK"));
- 			QApplication::beep();
- 
-@@ -2396,7 +2396,7 @@ void game_list_frame::BatchActionBySerials(progress_dialog* pdlg, const std::set
- 			return;
- 		}
- 
--		pdlg->setLabelText(progressLabel.arg(*index).arg(serials_size));
-+		pdlg->setLabelText(progressLabel.arg(index->load()).arg(serials_size));
- 		pdlg->setCancelButtonText(tr("OK"));
- 		connect(pdlg, &progress_dialog::canceled, this, [pdlg](){ pdlg->deleteLater(); });
- 		QApplication::beep();
-diff --git a/rpcs3/rpcs3qt/ps_move_tracker_dialog.cpp b/rpcs3/rpcs3qt/ps_move_tracker_dialog.cpp
-index 45fbe6f59e7d..4b9bc5dd6e4f 100644
---- a/rpcs3/rpcs3qt/ps_move_tracker_dialog.cpp
-+++ b/rpcs3/rpcs3qt/ps_move_tracker_dialog.cpp
-@@ -362,7 +362,7 @@ void ps_move_tracker_dialog::update_saturation_threshold(bool update_slider)
- }
- void ps_move_tracker_dialog::update_min_radius(bool update_slider)
- {
--	ui->minRadiusGb->setTitle(tr("Min Radius: %0 %").arg(g_cfg_move.min_radius));
-+	ui->minRadiusGb->setTitle(tr("Min Radius: %0 %").arg(g_cfg_move.min_radius.get()));
- 
- 	if (update_slider)
- 	{
-@@ -372,7 +372,7 @@ void ps_move_tracker_dialog::update_min_radius(bool update_slider)
- 
- void ps_move_tracker_dialog::update_max_radius(bool update_slider)
- {
--	ui->maxRadiusGb->setTitle(tr("Max Radius: %0 %").arg(g_cfg_move.max_radius));
-+	ui->maxRadiusGb->setTitle(tr("Max Radius: %0 %").arg(g_cfg_move.max_radius.get()));
- 
- 	if (update_slider)
- 	{
diff --git a/pkgs/by-name/rp/rpcs3/package.nix b/pkgs/by-name/rp/rpcs3/package.nix
index 607f0728b6d7..097f83d4c951 100644
--- a/pkgs/by-name/rp/rpcs3/package.nix
+++ b/pkgs/by-name/rp/rpcs3/package.nix
@@ -2,6 +2,8 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
+  nix-update-script,
   cmake,
   pkg-config,
   git,
@@ -35,12 +37,6 @@
 }:
 
 let
-  # Keep these separate so the update script can regex them
-  rpcs3GitVersion = "17736-c86a25079";
-  rpcs3Version = "0.0.36-17736-c86a25079";
-  rpcs3Revision = "c86a25079518032d73395a79979970acb2581a91";
-  rpcs3Hash = "sha256-e+mT3qn1oz1fh2bqu5YM+m774Can34If57Kd1T1EGbk=";
-
   inherit (qt6Packages)
     qtbase
     qtmultimedia
@@ -48,31 +44,31 @@ let
     qtwayland
     ;
 in
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "rpcs3";
-  version = rpcs3Version;
+  version = "0.0.37";
 
   src = fetchFromGitHub {
     owner = "RPCS3";
     repo = "rpcs3";
-    rev = rpcs3Revision;
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-/ve1qe76Rc+mXHemq8DI2U9IP6+tPV5m5SNh/wmppEw=";
     fetchSubmodules = true;
-    hash = rpcs3Hash;
   };
 
   patches = [
-    # Modified from https://github.com/RPCS3/rpcs3/pull/17009; doesn't apply cleanly due to intermediate commits
-    ./fix-qt6.9-compilation.patch
-
-    # https://github.com/RPCS3/rpcs3/pull/17246
-    ./0001-cmake-add-option-to-use-system-cubeb.patch
+    (fetchpatch2 {
+      # https://github.com/RPCS3/rpcs3/pull/17316
+      url = "https://github.com/RPCS3/rpcs3/commit/bad6e992586264344ee1a3943423863d2bd39b45.patch?full_index=1";
+      hash = "sha256-rSyA1jcmRiV6m8rPKqTnDFuBh9WYFTGmyTSU2qrd+Go=";
+    })
   ];
 
-  passthru.updateScript = ./update.sh;
+  passthru.updateScript = nix-update-script { };
 
   preConfigure = ''
     cat > ./rpcs3/git-version.h <<EOF
-    #define RPCS3_GIT_VERSION "${rpcs3GitVersion}"
+    #define RPCS3_GIT_VERSION "nixpkgs"
     #define RPCS3_GIT_FULL_BRANCH "RPCS3/rpcs3/master"
     #define RPCS3_GIT_BRANCH "HEAD"
     #define RPCS3_GIT_VERSION_NO_UPDATE 1
@@ -170,4 +166,4 @@ stdenv.mkDerivation {
     ];
     mainProgram = "rpcs3";
   };
-}
+})
diff --git a/pkgs/by-name/rp/rpcs3/update.sh b/pkgs/by-name/rp/rpcs3/update.sh
deleted file mode 100755
index b53d23f88fce..000000000000
--- a/pkgs/by-name/rp/rpcs3/update.sh
+++ /dev/null
@@ -1,60 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash --pure --keep GITHUB_TOKEN -p nix gnused jq nix-prefetch-git curl cacert
-
-set -eou pipefail
-
-ROOT="$(dirname "$(readlink -f "$0")")"
-if [[ ! "$(basename $ROOT)" == "rpcs3" || ! -f "$ROOT/package.nix" ]]; then
-    echo "ERROR: Not in the rpcs3 folder"
-    exit 1
-fi
-
-if [[ ! -v GITHUB_TOKEN ]]; then
-    echo "ERROR: \$GITHUB_TOKEN not set"
-    exit 1
-fi
-
-payload=$(jq -cn --rawfile query /dev/stdin '{"query": $query}' <<EOF | curl -s -H "Authorization: bearer $GITHUB_TOKEN" -d '@-' https://api.github.com/graphql
-{
-  repository(owner: "RPCS3", name: "rpcs3") {
-    branch: ref(qualifiedName: "refs/heads/master") {
-      target {
-        oid
-        ... on Commit {
-          history {
-            totalCount
-          }
-        }
-      }
-    }
-
-    tag: refs(refPrefix: "refs/tags/", first: 1, orderBy: {field: TAG_COMMIT_DATE, direction: DESC}) {
-      nodes {
-        name
-      }
-    }
-  }
-}
-EOF
-)
-
-commit_sha=$(jq -r .data.repository.branch.target.oid <<< "$payload")
-major_ver=$(jq -r .data.repository.tag.nodes[0].name <<< "$payload" | sed 's/^v//g')
-commit_count=$(jq -r .data.repository.branch.target.history.totalCount <<< "$payload")
-git_ver="$commit_count-${commit_sha::9}"
-final_ver="$major_ver-$git_ver"
-
-
-echo "INFO: Latest commit is $commit_sha"
-echo "INFO: Latest version is $final_ver"
-
-nix_hash=$(nix-prefetch-git --quiet --fetch-submodules https://github.com/RPCS3/rpcs3.git "$commit_sha" | jq -r .sha256)
-nix_hash=$(nix hash to-sri --type sha256 "$nix_hash")
-echo "INFO: Hash is $nix_hash"
-
-sed -i -E \
-    -e "s/rpcs3GitVersion\s*=\s*\"[\.a-z0-9-]+\";$/rpcs3GitVersion = \"${git_ver}\";/g" \
-    -e "s/rpcs3Version\s*=\s*\"[\.a-z0-9-]+\";$/rpcs3Version = \"${final_ver}\";/g" \
-    -e "s/rpcs3Revision\s*=\s*\"[a-z0-9]+\";$/rpcs3Revision = \"${commit_sha}\";/g" \
-    -e "s|rpcs3Hash\s*=\s*\"sha256-.*\";$|rpcs3Hash = \"${nix_hash}\";|g" \
-    "$ROOT/package.nix"
diff --git a/pkgs/by-name/rs/rsyncy/package.nix b/pkgs/by-name/rs/rsyncy/package.nix
new file mode 100644
index 000000000000..131d894de0f5
--- /dev/null
+++ b/pkgs/by-name/rs/rsyncy/package.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  makeWrapper,
+  rsync,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "rsyncy";
+  version = "2.1.0";
+
+  src = fetchFromGitHub {
+    owner = "laktak";
+    repo = "rsyncy";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-sy0aMYT7xrBfXB3YxLGL49jKVnRpWo5k+3mjQNAOagU=";
+  };
+
+  vendorHash = "sha256-vexWkbUQdkWrDJVvu2T4z4hbiCANuW0qLNFNSiTmYtY=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.appVersion=${finalAttrs.version}"
+  ];
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  postInstall = ''
+    wrapProgram $out/bin/rsyncy \
+      --prefix PATH : "${lib.makeBinPath [ rsync ]}"
+  '';
+
+  meta = {
+    description = "Progress bar wrapper for rsync";
+    homepage = "https://github.com/laktak/rsyncy";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ marie ];
+    mainProgram = "rsyncy";
+  };
+})
diff --git a/pkgs/by-name/ru/rust-parallel/package.nix b/pkgs/by-name/ru/rust-parallel/package.nix
index 76ca93565f68..eef06ce127c0 100644
--- a/pkgs/by-name/ru/rust-parallel/package.nix
+++ b/pkgs/by-name/ru/rust-parallel/package.nix
@@ -3,6 +3,8 @@
   fetchFromGitHub,
   lib,
   rustPlatform,
+  versionCheckHook,
+  nix-update-script,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -32,12 +34,17 @@ rustPlatform.buildRustPackage rec {
     "--skip=runs_regex_from_input_file_badline_j1"
   ];
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Rust shell tool to run commands in parallel with a similar interface to GNU parallel";
     homepage = "https://github.com/aaronriekenberg/rust-parallel";
     license = lib.licenses.mit;
     mainProgram = "rust-parallel";
     maintainers = with lib.maintainers; [ sedlund ];
-    platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/by-name/sc/scala-cli/sources.json b/pkgs/by-name/sc/scala-cli/sources.json
index 627553efc7f6..8aa44699e8b3 100644
--- a/pkgs/by-name/sc/scala-cli/sources.json
+++ b/pkgs/by-name/sc/scala-cli/sources.json
@@ -1,21 +1,21 @@
 {
-  "version": "1.8.0",
+  "version": "1.8.2",
   "assets": {
     "aarch64-darwin": {
       "asset": "scala-cli-aarch64-apple-darwin.gz",
-      "sha256": "0q4di7f3kfkh8lbzgad1ra6zjgnqfnvjz3a9b6frxr7hcvb7nndw"
+      "sha256": "1sc2ay5mka4widdls50fic4fhvbsw31wwjhzvziq2zz4mp6f60dm"
     },
     "aarch64-linux": {
       "asset": "scala-cli-aarch64-pc-linux.gz",
-      "sha256": "0gx5v3q9hcmg17cgsi14k1jw112fflkwh31pzh8s8zi9ch3za7x9"
+      "sha256": "0h5b3dh0sdw496wx4y2xz9p513prl7y4sgbz4rgz6vxkhv6sdns3"
     },
     "x86_64-darwin": {
       "asset": "scala-cli-x86_64-apple-darwin.gz",
-      "sha256": "1s13nbdl242637a0hiwb1cmjqyxm02jgyhk97cj8z1aq8cmg8vnp"
+      "sha256": "1ar3mfrbrw1dqc7bdk1snh08h3gqraqd2kvmhlxbck4ba1vn86nx"
     },
     "x86_64-linux": {
       "asset": "scala-cli-x86_64-pc-linux.gz",
-      "sha256": "1k81g4kphqyd1xfsn1hih1smir191gp5r8smfxg4fk7lbwl509id"
+      "sha256": "0nk7z4h47jk1mr89clkalnw34xvhzsmr408gd0xzf7wvmyfh9kwg"
     }
   }
 }
diff --git a/pkgs/by-name/sp/spiffe-vault/package.nix b/pkgs/by-name/sp/spiffe-vault/package.nix
new file mode 100644
index 000000000000..23f29f3d16b8
--- /dev/null
+++ b/pkgs/by-name/sp/spiffe-vault/package.nix
@@ -0,0 +1,61 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "spiffe-vault";
+  version = "0.6.2";
+
+  src = fetchFromGitHub {
+    owner = "philips-labs";
+    repo = "spiffe-vault";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-KwfsusCrh+IlgipFFALnJWfw8LJucThT4p3j+XKk84s=";
+    # populate values that require us to use git. By doing this in postFetch we
+    # can delete .git afterwards and maintain better reproducibility of the src.
+    leaveDotGit = true;
+    postFetch = ''
+      cd "$out"
+      git rev-parse HEAD > $out/COMMIT
+      # '0000-00-00T00:00:00Z'
+      date -u -d "@$(git log -1 --pretty=%ct)" "+%Y-%m-%dT%H:%M:%SZ" > $out/SOURCE_DATE_EPOCH
+      find "$out" -name .git -print0 | xargs -0 rm -rf
+    '';
+  };
+
+  vendorHash = "sha256-lNKcnYh2BaDzimIZuzUWA6Qwn+/Jqi1UpLKupQUpVMQ=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/philips-labs/spiffe-vault/cmd/spiffe-vault/cli.GitVersion=v${finalAttrs.version}"
+    "-X github.com/philips-labs/spiffe-vault/cmd/spiffe-vault/cli.gitTreeState=clean"
+  ];
+
+  preBuild = ''
+    ldflags+=" -X github.com/philips-labs/spiffe-vault/cmd/spiffe-vault/cli.gitCommit=$(cat COMMIT)"
+    ldflags+=" -X \"github.com/philips-labs/spiffe-vault/cmd/spiffe-vault/cli.buildDate=$(cat SOURCE_DATE_EPOCH)\""
+  '';
+
+  preCheck = ''
+    # tests expect version ldflags not to be set
+    unset ldflags
+  '';
+
+  doInstallCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/${finalAttrs.meta.mainProgram}";
+  versionCheckProgramArg = "version";
+
+  meta = {
+    description = "Integrates Spiffe and Vault to have secretless authentication";
+    homepage = "https://github.com/philips-labs/spiffe-vault";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jk ];
+    mainProgram = "spiffe-vault";
+  };
+})
diff --git a/pkgs/by-name/tr/trezor-suite/package.nix b/pkgs/by-name/tr/trezor-suite/package.nix
index 7d1bfc916c82..67a8e4ceadad 100644
--- a/pkgs/by-name/tr/trezor-suite/package.nix
+++ b/pkgs/by-name/tr/trezor-suite/package.nix
@@ -10,7 +10,7 @@
 
 let
   pname = "trezor-suite";
-  version = "25.5.2";
+  version = "25.6.2";
 
   suffix =
     {
@@ -24,8 +24,8 @@ let
     hash =
       {
         # curl -Lfs https://github.com/trezor/trezor-suite/releases/download/v${version}/latest-linux{-arm64,}.yml | grep ^sha512 | sed 's/: /-/'
-        aarch64-linux = "sha512-WfEFKfmILqJADNvYq5C5OOuZgCJmri6i/i6/QHFukeDrvAsUmIqcIIN1zpCoPyJBS4tc+mAlOXIEx0AkYfJVVA==";
-        x86_64-linux = "sha512-ZGdqXkwlvjLhOFIEhpwCdmLodODmi/oq92+qSLRmKO37XvSJEvCNAHriLJiaIofqy8XSJmjT2MuHRzh0W+83sw==";
+        aarch64-linux = "sha512-0As+Hh8fMwTaxMwe1KjBwcDfireKjc+hgDtHfefRTKIVlF5FNb3fuVLN3aaZACuo0J+Hwd0KIaoacRAlV6EOsw==";
+        x86_64-linux = "sha512-vOrOOJsvYkrDpYd2E9ojbmL3PSKMpnYG+oznVUUS4dKfvmSP2sb5eXUjP6k6fYlDER2q/7YfXBnVycPqHLXm2Q==";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
diff --git a/pkgs/by-name/wa/warp-terminal/versions.json b/pkgs/by-name/wa/warp-terminal/versions.json
index 242c03f5a5af..4182beae12c9 100644
--- a/pkgs/by-name/wa/warp-terminal/versions.json
+++ b/pkgs/by-name/wa/warp-terminal/versions.json
@@ -1,14 +1,14 @@
 {
   "darwin": {
-    "hash": "sha256-xkrJqFLzKKEBPWr49JqpCC70CGEGpwrhb5GLCoGZiWI=",
-    "version": "0.2025.06.04.08.11.stable_03"
+    "hash": "sha256-wlFmfHBSwBh9UFq6by52fGYN2EftP793u3L57XSDDKQ=",
+    "version": "0.2025.06.18.08.11.stable_03"
   },
   "linux_x86_64": {
-    "hash": "sha256-OVS84RwWqspkE6Wfji/FuoaXvS2ZA2vWkI0kfQrEWSk=",
-    "version": "0.2025.06.04.08.11.stable_03"
+    "hash": "sha256-7CfqTRUMkqLXmJg7RQK0liVEhucMOgMtsJl4/lrg4XI=",
+    "version": "0.2025.06.18.08.11.stable_03"
   },
   "linux_aarch64": {
-    "hash": "sha256-K/RC1hYe7G+3symQVR8If/B1/VCACCTcq5JTSKLREIM=",
-    "version": "0.2025.06.04.08.11.stable_03"
+    "hash": "sha256-iDXAchU/b2ApDsmV0dnkXI1o0VOaegYWz4DufHtPFJM=",
+    "version": "0.2025.06.18.08.11.stable_03"
   }
 }
diff --git a/pkgs/by-name/wp/wpsoffice/package.nix b/pkgs/by-name/wp/wpsoffice/package.nix
index d6d96127ee03..c51e005b2919 100644
--- a/pkgs/by-name/wp/wpsoffice/package.nix
+++ b/pkgs/by-name/wp/wpsoffice/package.nix
@@ -21,6 +21,7 @@
   coreutils,
   cacert,
   libjpeg,
+  libxml2,
 }:
 let
   pkgVersion = "11.1.0.11723";
@@ -119,6 +120,10 @@ stdenv.mkDerivation rec {
     patchelf --add-needed libjpeg.so $out/opt/kingsoft/wps-office/office6/libwpsmain.so
     # dlopen dependency
     patchelf --add-needed libudev.so.1 $out/opt/kingsoft/wps-office/office6/addons/cef/libcef.so
+
+    # Fix libxml2 breakage. See https://github.com/NixOS/nixpkgs/pull/396195#issuecomment-2881757108
+    mkdir -p "$out/lib"
+    ln -s "${lib.getLib libxml2}/lib/libxml2.so" "$out/lib/libxml2.so.2"
   '';
 
   meta = with lib; {
diff --git a/pkgs/by-name/xm/xmenu/package.nix b/pkgs/by-name/xm/xmenu/package.nix
index 23569e6a12c7..f18d19f31021 100644
--- a/pkgs/by-name/xm/xmenu/package.nix
+++ b/pkgs/by-name/xm/xmenu/package.nix
@@ -8,15 +8,15 @@
   libXinerama,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "xmenu";
-  version = "4.5.5";
+  version = "4.6.1";
 
   src = fetchFromGitHub {
     owner = "phillbush";
     repo = "xmenu";
-    rev = "v${version}";
-    sha256 = "sha256-Gg4hSBBVBOB/wlY44C5bJOuOnLoA/tPvcNZamXae/WE=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-pCjL6cTH6hMzSV1L6wdMjfA2Dbf85KKCnBxmI9ibc7Y=";
   };
 
   buildInputs = [
@@ -26,14 +26,18 @@ stdenv.mkDerivation rec {
     libXinerama
   ];
 
-  postPatch = "sed -i \"s:/usr/local:$out:\" config.mk";
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+    "LOCALINC=${placeholder "out"}/include"
+    "LOCALLIB=${placeholder "out"}/lib"
+  ];
 
-  meta = with lib; {
+  meta = {
     description = "Menu utility for X";
     homepage = "https://github.com/phillbush/xmenu";
-    license = licenses.mit;
-    maintainers = with maintainers; [ neonfuz ];
-    platforms = platforms.all;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ neonfuz ];
+    platforms = lib.platforms.all;
     mainProgram = "xmenu";
   };
-}
+})
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 67bbec6bc452..9378824b7d87 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -99,7 +99,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.191.6";
+  version = "0.191.7";
 
   outputs =
     [ "out" ]
@@ -111,7 +111,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GQzAXjOvtjbkBgBkX9Xp6mn3uP5wXStpsaC6rQMwTvs=";
+    hash = "sha256-Kx9VolPqKR0ML7F7ITnp5GPT4ULJvmTsRHKgkKZPGwQ=";
   };
 
   patches = [
@@ -138,7 +138,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-ZDL9arQpYsMzQrIHNejkBcsBNlKeSPOU+Ev0nsa9yIE=";
+  cargoHash = "sha256-MMQYbhv/6s+9zxP9E5bcCDS9TUYSbapkX5sklVpNHnI=";
 
   nativeBuildInputs =
     [
diff --git a/pkgs/development/python-modules/gbinder-python/default.nix b/pkgs/development/python-modules/gbinder-python/default.nix
index e2226c211af3..35a811c9398e 100644
--- a/pkgs/development/python-modules/gbinder-python/default.nix
+++ b/pkgs/development/python-modules/gbinder-python/default.nix
@@ -2,37 +2,42 @@
   lib,
   fetchFromGitHub,
   buildPythonPackage,
-  cython_0,
+  cython,
   pkg-config,
   libgbinder,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "gbinder-python";
-  version = "1.1.1";
-  format = "setuptools";
+  version = "1.1.2";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "erfanoabdi";
     repo = "gbinder-python";
-    rev = version;
-    sha256 = "1X9gAux9w/mCEVmE3Yqvvq3kU7hu4iAFaZWNZZZxt3E=";
+    tag = version;
+    hash = "sha256-up1EDuR05a7TlCErd2BXkp01oqi6hEskt7xVxsJqquM=";
   };
 
+  build-system = [
+    cython
+    setuptools
+  ];
+
   buildInputs = [ libgbinder ];
 
   nativeBuildInputs = [
-    cython_0
     pkg-config
   ];
 
   postPatch = ''
     # Fix pkg-config name for cross-compilation
-    substituteInPlace setup.py --replace "pkg-config" "$PKG_CONFIG"
+    substituteInPlace setup.py \
+      --replace-fail "pkg-config" "$PKG_CONFIG" \
+      --replace-fail "USE_CYTHON = False" "USE_CYTHON = True"
   '';
 
-  setupPyGlobalFlags = [ "--cython" ];
-
   meta = {
     description = "Python bindings for libgbinder";
     homepage = "https://github.com/erfanoabdi/gbinder-python";
diff --git a/pkgs/development/python-modules/pyhomee/default.nix b/pkgs/development/python-modules/pyhomee/default.nix
index ae9e1acd2038..fba7bb83d474 100644
--- a/pkgs/development/python-modules/pyhomee/default.nix
+++ b/pkgs/development/python-modules/pyhomee/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "pyhomee";
-  version = "1.2.9";
+  version = "1.2.10";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Taraman17";
     repo = "pyHomee";
     tag = "v${version}";
-    hash = "sha256-1o0g6MCgRtEkZ1ZFwSb+AnmKbzqczOThfoYYhrs5y6M=";
+    hash = "sha256-pfWDVvEm/YXU83gSCLaU5/C5qwxJH3NFm0jpahpgMx4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/qutip/default.nix b/pkgs/development/python-modules/qutip/default.nix
index aa0ef036c02c..006db381e8a6 100644
--- a/pkgs/development/python-modules/qutip/default.nix
+++ b/pkgs/development/python-modules/qutip/default.nix
@@ -5,7 +5,7 @@
   fetchFromGitHub,
 
   # build-system
-  cython_0,
+  cython,
   oldest-supported-numpy,
   setuptools,
 
@@ -47,7 +47,7 @@ buildPythonPackage rec {
     '';
 
   build-system = [
-    cython_0
+    cython
     oldest-supported-numpy
     setuptools
   ];
diff --git a/pkgs/development/python-modules/tpm2-pytss/default.nix b/pkgs/development/python-modules/tpm2-pytss/default.nix
index 807f51dabe42..9560b1e694ed 100644
--- a/pkgs/development/python-modules/tpm2-pytss/default.nix
+++ b/pkgs/development/python-modules/tpm2-pytss/default.nix
@@ -44,6 +44,12 @@ buildPythonPackage rec {
         url = "https://github.com/tpm2-software/tpm2-pytss/pull/593.patch";
         hash = "sha256-CNJnSIvUQ0Yvy0o7GdVfFZ7kHJd2hBt5Zv1lqgOeoks=";
       })
+      # support cryptography >= 45.0.0
+      # https://github.com/tpm2-software/tpm2-pytss/pull/643
+      (fetchpatch {
+        url = "https://github.com/tpm2-software/tpm2-pytss/commit/6ab4c74e6fb3da7cd38e97c1f8e92532312f8439.patch";
+        hash = "sha256-01Qe4qpD2IINc5Z120iVdPitiLBwdr8KNBjLFnGgE7E=";
+      })
     ]
     ++ lib.optionals isCross [
       # pytss will regenerate files from headers of tpm2-tss.
diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index f8ad1f892962..50c5d9683760 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -1,5 +1,6 @@
 {
   buildPackages,
+  pkgsBuildBuild,
   callPackage,
   perl,
   bison ? null,
@@ -83,6 +84,7 @@ let
 
       stdenv ? args'.stdenv,
       buildPackages ? args'.buildPackages,
+      pkgsBuildBuild ? args'.pkgsBuildBuild,
 
       ...
     }@args:
@@ -317,9 +319,9 @@ let
             # Adds dependencies needed to edit the config:
             # nix-shell '<nixpkgs>' -A linux.configEnv --command 'make nconfig'
             configEnv = finalAttrs.finalPackage.overrideAttrs (previousAttrs: {
-              nativeBuildInputs =
-                previousAttrs.nativeBuildInputs or [ ]
-                ++ (with buildPackages; [
+              depsBuildBuild =
+                previousAttrs.depsBuildBuild or [ ]
+                ++ (with pkgsBuildBuild; [
                   pkg-config
                   ncurses
                 ]);
diff --git a/pkgs/servers/mail/mailman/hyperkitty.nix b/pkgs/servers/mail/mailman/hyperkitty.nix
index be9dbbcf2d1b..3e394eb1a1b9 100644
--- a/pkgs/servers/mail/mailman/hyperkitty.nix
+++ b/pkgs/servers/mail/mailman/hyperkitty.nix
@@ -26,6 +26,12 @@ buildPythonPackage rec {
       url = "https://gitlab.com/mailman/hyperkitty/-/commit/2d69f420c603356a639a6b6243e1059a0089b7eb.patch";
       hash = "sha256-zo+dK8DFMkHlMrOVSUtelhAq+cxJE4gLG00LvuAlWKA=";
     })
+    # Fix test with python 3.13
+    # https://gitlab.com/mailman/hyperkitty/-/merge_requests/657
+    (fetchpatch {
+      url = "https://gitlab.com/mailman/hyperkitty/-/commit/6c3d402dc0981e545081a3baf13db7e491356e75.patch";
+      hash = "sha256-ep9cFZe9/sIfIP80pLBOMYkJKWvNT7DRqg80DQSdRFw=";
+    })
   ];
 
   build-system = [
diff --git a/pkgs/tools/audio/yabridge/default.nix b/pkgs/tools/audio/yabridge/default.nix
index 78bf12e51018..6fa9b6b1994f 100644
--- a/pkgs/tools/audio/yabridge/default.nix
+++ b/pkgs/tools/audio/yabridge/default.nix
@@ -98,6 +98,8 @@ multiStdenv.mkDerivation (finalAttrs: {
   '';
 
   patches = [
+    ./libyabridge-drop-32-bit-support.patch
+
     # Hard code bitbridge & runtime dependencies
     (replaceVars ./hardcode-dependencies.patch {
       libdbus = dbus.lib;
diff --git a/pkgs/tools/audio/yabridge/hardcode-dependencies.patch b/pkgs/tools/audio/yabridge/hardcode-dependencies.patch
index e5ab00293858..beb4766c8561 100644
--- a/pkgs/tools/audio/yabridge/hardcode-dependencies.patch
+++ b/pkgs/tools/audio/yabridge/hardcode-dependencies.patch
@@ -5,7 +5,7 @@ index 9e69128d..8c53ac88 100644
 @@ -226,7 +226,7 @@ if is_64bit_system
    xcb_64bit_dep = dependency('xcb')
  endif
- if with_32bit_libraries or with_bitbridge
+ if with_bitbridge
 -  xcb_32bit_dep = winegcc.find_library('xcb')
 +  xcb_32bit_dep = winegcc.find_library('xcb', dirs: ['@libxcb32@/lib'])
  endif
diff --git a/pkgs/tools/audio/yabridge/libyabridge-drop-32-bit-support.patch b/pkgs/tools/audio/yabridge/libyabridge-drop-32-bit-support.patch
new file mode 100644
index 000000000000..c1fb0d47763a
--- /dev/null
+++ b/pkgs/tools/audio/yabridge/libyabridge-drop-32-bit-support.patch
@@ -0,0 +1,97 @@
+From 0002273e4df7c9448b52ce54ef38a93cf753fbfd Mon Sep 17 00:00:00 2001
+From: Robbert van der Helm <mail@robbertvanderhelm.nl>
+Date: Sun, 1 Jun 2025 22:22:20 +0200
+Subject: [PATCH] Drop the 32-bit libyabridge support for EnergyXT
+
+I don't think anyone is using this, and it's triggering a bug in recent
+Meson versions so just removing it for now should be fine.
+---
+ CHANGELOG.md |  9 +++++++++
+ README.md    | 20 --------------------
+ meson.build  | 12 +-----------
+ 3 files changed, 10 insertions(+), 31 deletions(-)
+
+diff --git a/CHANGELOG.md b/CHANGELOG.md
+index 687e73b3..262ee298 100644
+--- a/CHANGELOG.md
++++ b/CHANGELOG.md
+@@ -15,6 +15,15 @@ Versioning](https://semver.org/spec/v2.0.0.html).
+   consuming too much memory. This only affected the prebuilt binaries from the
+   releases page.
+ 
++### Removed
++
++- Out of the box support for building a 32-bit version of yabridge for use in
++  64-bit machines has been dropped as part of solving a compatibility issue with
++  newer Meson versions
++  ([#431](https://github.com/robbert-vdh/yabridge/issues/431)). This was only
++  relevant for using 64-bit Windows plugins in the old 32-bit Linux version of
++  **EnergyXT**, and should not affect most users.
++
+ ### yabridgectl
+ 
+ - Fixed a regression that caused `yabridgectl set --path-auto` to no longer
+diff --git a/README.md b/README.md
+index 55155705..6019b67a 100644
+--- a/README.md
++++ b/README.md
+@@ -886,26 +886,6 @@ Yabridge will detect whether the plugin you're trying to load is 32-bit or
+ 64-bit, and will run either the regular version or the `*-32.exe` variant
+ accordingly.
+ 
+-### 32-bit libraries
+-
+-It also possible to build 32-bit versions of yabridge's libraries, which would
+-let you use both 32-bit and 64-bit Windows VST2, VST3, and CLAP plugins from a
+-32-bit Linux plugin host. This is mostly untested since 32-bit only Linux
+-applications don't really exist anymore, but it should work! The build system
+-will still assume you're compiling from a 64-bit system, so if you're compiling
+-on an actual 32-bit system you would need to comment out the 64-bit
+-`yabridge-host` and `yabridge-group` binaries in `meson.build`:
+-
+-```shell
+-meson setup build --buildtype=release --cross-file=cross-wine.conf --unity=on --unity-size=1000 -Dbitbridge=true -Dbuild.cpp_args='-m32' -Dbuild.cpp_link_args='-m32'
+-ninja -C build
+-```
+-
+-Like the above commands, you might need to tweak the unity size based on the
+-amount of system memory available. See the CI build definitions for some
+-examples on how to add static linking in the mix if you're going to run this
+-version of yabridge on some other machine.
+-
+ ## Debugging
+ 
+ Wine's error messages and warning are usually very helpful whenever a plugin
+diff --git a/meson.build b/meson.build
+index 9e69128d..98bf607e 100644
+--- a/meson.build
++++ b/meson.build
+@@ -20,19 +17,12 @@ project(
+ # need to pass `-Dbitbridge=true`. We just make sure that we won't build
+ # any 64-bit binaries in that situation.
+ is_64bit_system = build_machine.cpu_family() not in ['x86', 'arm']
+-with_32bit_libraries = (not is_64bit_system) or get_option('build.cpp_args').contains('-m32')
+ with_bitbridge = get_option('bitbridge')
+ with_clap = get_option('clap')
+ with_system_asio = get_option('system-asio')
+ with_winedbg = get_option('winedbg')
+ with_vst3 = get_option('vst3')
+ 
+-# Cookies can't be stored correctly when the native host is 32-bit and the
+-# bridged plugin is 64-bit
+-if with_clap and with_32bit_libraries and is_64bit_system
+-  error('CLAP support will not work correctly when using 32-bit yabridge libraries together with 64-bit host binaries.')
+-endif
+-
+ #
+ # Compiler flags
+ #
+@@ -225,7 +215,7 @@ winegcc = meson.get_compiler('cpp', native : false)
+ if is_64bit_system
+   xcb_64bit_dep = dependency('xcb')
+ endif
+-if with_32bit_libraries or with_bitbridge
++if with_bitbridge
+   xcb_32bit_dep = winegcc.find_library('xcb')
+ endif
+ 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f430ec940b03..9a1e6f14f641 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10397,7 +10397,7 @@ with pkgs;
     nodejs = nodejs_20;
   };
 
-  mailmanPackages = callPackage ../servers/mail/mailman { };
+  mailmanPackages = recurseIntoAttrs (callPackage ../servers/mail/mailman { });
   inherit (mailmanPackages) mailman mailman-hyperkitty;
   mailman-web = mailmanPackages.web;