diff --git a/lib/sources.nix b/lib/sources.nix
index 43bc2ab2dbe3..43a374c16e73 100644
--- a/lib/sources.nix
+++ b/lib/sources.nix
@@ -7,12 +7,19 @@ let
     match
     split
     storeDir
+    escapeRegex
+    removePrefix
     ;
   inherit (lib)
     boolToString
     filter
     isString
     readFile
+    concatStrings
+    length
+    elemAt
+    isList
+    any
     ;
   inherit (lib.filesystem)
     pathIsRegularFile
@@ -513,6 +520,113 @@ let
     else
       throw "repoRevToName: invalid kind";
 
+  /**
+    Filter a source tree by a list of doublestar-style glob patterns,
+    returning a source that only contains paths matching at least one
+    pattern. `*` matches a single path component, and `**` matches any
+    number of components.
+
+    # Inputs
+
+    `src`
+
+    : The source tree to filter.
+
+    `patterns`
+
+    : List of glob patterns to include, e.g. `[ "*.py" "src/**" ]`.
+      A leading `**` (e.g. `**\/*.py` for all `.py` files at any depth)
+      is also supported; the `\` here is just a Nix string escape used
+      to avoid closing this comment.
+
+    # Examples
+    :::{.example}
+    ## `sourceByGlobs` usage example
+
+    - Include everything under a subdirectory
+    ```nix
+    src = sourceByGlobs ./. [ "src/**" "tests/**" ]
+    ```
+
+    - Include all .py files in root directory only
+    ```nix
+    src = sourceByGlobs ./. [ "*.py" ]
+    ```
+
+    :::
+  */
+  sourceByGlobs =
+    let
+      splitPath = path: filter isString (split "/" path);
+      # Make component regex
+      mkRe =
+        s:
+        if s == "**" then
+          ".*" # Has special handling below
+        else
+          concatStrings (map (tok: if isList tok then "[^/]*" else escapeRegex tok) (split "\\*+" s));
+
+      # Make a source filter function from pattern
+      mkMatcher =
+        pat:
+        let
+          globs = map mkRe (splitPath pat);
+          glen = length globs;
+        in
+        path: type:
+        let
+          path' = splitPath path;
+          plen = length path';
+
+          recurse =
+            gi: pi:
+            let
+              g = elemAt globs gi;
+              p = elemAt path' pi;
+              m = match g p != null;
+            in
+            if pi >= plen then # Reached end of path
+              gi >= glen || (type == "directory" || type == "symlink") # Only allow partial matches for directories
+            else if gi >= glen then # Reached end of globs
+              false
+            else if g == ".*" then # Special handling for **
+              (
+                # Lookahead for next glob match
+                if (gi + 1) == glen then
+                  true
+                else if (match (elemAt globs (gi + 1)) p != null) then
+                  recurse (gi + 1) pi
+                else if m then
+                  recurse gi (pi + 1)
+                else
+                  false
+              )
+            else if m then
+              recurse (gi + 1) (pi + 1)
+            else
+              false;
+
+        in
+        recurse 0 0;
+
+      mkSourceFilter =
+        root: patterns:
+        let
+          root' = "${toString root}/";
+          matchers = map mkMatcher patterns;
+        in
+        name: type:
+        let
+          name' = removePrefix root' name;
+        in
+        any (m: m name' type) matchers;
+
+    in
+    src: patterns:
+    lib.cleanSourceWith {
+      filter = mkSourceFilter src patterns;
+      inherit src;
+    };
 in
 {
   inherit
@@ -532,6 +646,7 @@ in
 
     sourceByRegex
     sourceFilesBySuffices
+    sourceByGlobs
 
     trace
     ;
diff --git a/lib/tests/sources.sh b/lib/tests/sources.sh
index 079c7eea5657..08315a303bc2 100755
--- a/lib/tests/sources.sh
+++ b/lib/tests/sources.sh
@@ -70,4 +70,16 @@ dir="$(nix-instantiate --eval --strict --read-write-mode --json --expr '(with im
 EOF
 ) || die "cleanSourceWith + cleanSource"
 
+
+dir="$(nix-instantiate --eval --strict --read-write-mode --json --expr '(with import <nixpkgs/lib>; "${
+  sources.sourceByGlobs '"$work"' [ "*.md" "**/*.o" ]
+}")' | crudeUnquoteJSON)"
+(cd "$dir"; find) | sort -f | diff -U10 - <(cat <<EOF
+.
+./module.o
+./README.md
+EOF
+) || die "sourceByGlobs 1"
+
+
 echo >&2 tests ok
diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index 30ed07c24604..4b5b1ec1f0f4 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -78,6 +78,8 @@
 
 - [ImmichFrame](https://immichframe.dev/), display your photos from Immich as a digital photo frame. Available as [services.immichframe](#opt-services.immichframe.enable).
 
+- [adw-bluetooth](https://github.com/ezratweaver/adw-bluetooth), a GNOME-inspired LibAdwaita Bluetooth applet. Available as [services.adw-bluetooth](#opt-services.adw-bluetooth.enable).
+
 - [PdfDing](https://www.pdfding.com/), manage, view and edit your PDFs seamlessly on all your devices wherever you are. Available as [services.pdfding](#opt-services.pdfding.enable).
 
 - [mangowc](https://github.com/DreamMaoMao/mangowc), a lightweight and feature-rich Wayland compositor based on dwl. Available as [programs.mangowc](#opt-programs.mangowc.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 83a7574f5a52..6134fee6a1ab 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -558,6 +558,7 @@
   ./services/databases/victoriametrics.nix
   ./services/databases/victoriatraces.nix
   ./services/desktops/accountsservice.nix
+  ./services/desktops/adw-bluetooth.nix
   ./services/desktops/ayatana-indicators.nix
   ./services/desktops/bamf.nix
   ./services/desktops/blueman.nix
diff --git a/nixos/modules/services/desktops/adw-bluetooth.nix b/nixos/modules/services/desktops/adw-bluetooth.nix
new file mode 100644
index 000000000000..43c6cfe4e436
--- /dev/null
+++ b/nixos/modules/services/desktops/adw-bluetooth.nix
@@ -0,0 +1,34 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.adw-bluetooth;
+in
+{
+  meta.maintainers = with lib.maintainers; [ ezratweaver ];
+
+  options.services.adw-bluetooth = {
+    enable = lib.mkEnableOption "Adwaita Bluetooth daemon";
+    package = lib.mkPackageOption pkgs "adw-bluetooth" { };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+    services.dbus.packages = [ cfg.package ];
+
+    systemd.user.services.adw-bluetooth-daemon = {
+      description = "AdwBluetooth Daemon";
+      wantedBy = [ "default.target" ];
+      after = [ "bluetooth.target" ];
+      serviceConfig = {
+        Type = "dbus";
+        BusName = "com.ezratweaver.AdwBluetoothDaemon";
+        ExecStart = "${cfg.package}/libexec/adw-bluetooth-daemon";
+      };
+    };
+  };
+}
diff --git a/nixos/tests/mattermost/default.nix b/nixos/tests/mattermost/default.nix
index 075781583c00..1fd46f19abfa 100644
--- a/nixos/tests/mattermost/default.nix
+++ b/nixos/tests/mattermost/default.nix
@@ -66,12 +66,7 @@ import ../make-test-python.nix (
 
             # Upgrade to the latest Mattermost.
             specialisation.latest.configuration = {
-              services.mattermost.package = lib.mkForce (
-                pkgs.mattermostLatest.override {
-                  removeFreeBadge = true;
-                  removeUserLimit = true;
-                }
-              );
+              services.mattermost.package = lib.mkForce pkgs.mattermostLatest;
               system.stateVersion = lib.mkVMOverride (lib.versions.majorMinor lib.version);
             };
           }
diff --git a/pkgs/applications/editors/vim/plugins/utils/updater.nix b/pkgs/applications/editors/vim/plugins/utils/updater.nix
index 2ed61a25c83a..0c77e7ce745c 100644
--- a/pkgs/applications/editors/vim/plugins/utils/updater.nix
+++ b/pkgs/applications/editors/vim/plugins/utils/updater.nix
@@ -43,7 +43,7 @@ buildPythonApplication {
         neovim-unwrapped
         nurl
       ]
-    }" --prefix PYTHONPATH : "${./.}" )
+    }" --prefix PYTHONPATH : "${lib.sources.sourceByGlobs ./. [ "**/*.py" ]}" )
     wrapPythonPrograms
   '';
 
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index f09df527aea4..6bcf1dcc1c68 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -77,8 +77,8 @@ rec {
   thunderbird = thunderbird-latest;
 
   thunderbird-latest = common {
-    version = "152.0";
-    sha512 = "51b950af634e7c7dfb7c043d69f925ed6d50d4c44341761e7e3ef02d5db28d2c539cd8d9286195e3facf84869f57b12a58760105b5195c449b4e1e4c9b6200d2";
+    version = "152.0.1";
+    sha512 = "f66c87de4dd73c3c45e420a55d76c3cb6ac091a61794ccf58ba59d1a40cf8001dee19a6a7f4c6bef7d36ea94ed4e4f677449d3006b2004abbd3fab42ad1c9228";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-latest";
diff --git a/pkgs/by-name/ad/adw-bluetooth/package.nix b/pkgs/by-name/ad/adw-bluetooth/package.nix
index fde7d2367c9a..f0b700ee9c9b 100644
--- a/pkgs/by-name/ad/adw-bluetooth/package.nix
+++ b/pkgs/by-name/ad/adw-bluetooth/package.nix
@@ -2,6 +2,7 @@
   stdenv,
   lib,
   fetchFromGitHub,
+  buildGoModule,
   meson,
   ninja,
   pkg-config,
@@ -13,17 +14,27 @@
   libadwaita,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
-  pname = "adw-bluetooth";
-  version = "1.0.0";
+let
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "ezratweaver";
     repo = "adw-bluetooth";
-    tag = finalAttrs.version;
-    hash = "sha256-/KJpB9i6tFDnB3C0tPtJtt8tTDfNftIkHmP1JSVSZNY=";
+    tag = version;
+    hash = "sha256-h3cHtecwBsx3j33qXVn/zaq4FZext71P7flzunCHqHg=";
   };
 
+  daemon = buildGoModule {
+    pname = "adw-bluetooth-daemon";
+    inherit version;
+    src = src + "/daemon";
+    vendorHash = "sha256-7tiSwNhq6e4LEh4lUkfh2i4tEdWWL6TxQpYYwYKsfog=";
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "adw-bluetooth";
+  inherit version src;
+
   nativeBuildInputs = [
     meson
     ninja
@@ -39,6 +50,13 @@ stdenv.mkDerivation (finalAttrs: {
     libadwaita
   ];
 
+  mesonFlags = [ "-Dbuild_daemon=false" ];
+
+  postInstall = ''
+    mkdir -p $out/libexec
+    ln -s ${daemon}/bin/daemon $out/libexec/adw-bluetooth-daemon
+  '';
+
   meta = {
     description = "GNOME Inspired LibAdwaita Bluetooth Applet";
     homepage = "https://github.com/ezratweaver/adw-bluetooth";
diff --git a/pkgs/by-name/as/asn1c/package.nix b/pkgs/by-name/as/asn1c/package.nix
index 1072090c2112..9f07efcb9169 100644
--- a/pkgs/by-name/as/asn1c/package.nix
+++ b/pkgs/by-name/as/asn1c/package.nix
@@ -1,39 +1,64 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  autoreconfHook,
+  versionCheckHook,
+  fetchFromGitHub,
   perl,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "asn1c";
-  version = "0.9.28";
+  version = "0.9.29";
 
-  src = fetchurl {
-    url = "https://lionet.info/soft/asn1c-${finalAttrs.version}.tar.gz";
-    hash = "sha256-gAdEC2R+8t2ftz2THDOsEXZOavskN9vmOLtOX8gjhrk=";
+  src = fetchFromGitHub {
+    owner = "vlm";
+    repo = "asn1c";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ms4+tzlVdV0pVGhdBod8sepjHGS4OVxJb3HdrFKv9Cc=";
   };
 
   outputs = [
     "out"
     "doc"
     "man"
+
+    # for the one perl utility
+    "crfc2asn1"
+  ];
+
+  postPatch = ''
+    patchShebangs examples/crfc2asn1.pl
+  '';
+
+  nativeBuildInputs = [
+    autoreconfHook
+    versionCheckHook
   ];
 
   buildInputs = [ perl ];
 
-  preConfigure = ''
-    patchShebangs examples/crfc2asn1.pl
-  '';
+  enableParallelBuilding = true;
 
   postInstall = ''
     cp -r skeletons/standard-modules $out/share/asn1c
   '';
 
-  doCheck = true;
+  # Barely anyone uses this, so make it a split-output
+  # so we don't carry the dependency on perl into bin.
+  postFixup = ''
+    mkdir -p $crfc2asn1/bin
+    mv $out/bin/crfc2asn1.pl $crfc2asn1/bin/crfc2asn1
+  '';
+
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
 
   meta = {
-    homepage = "http://lionet.info/asn1c/compiler.html";
+    mainProgram = "asn1c";
+    homepage = "https://lionet.info/asn1c/compiler.html";
     description = "Open Source ASN.1 Compiler";
     license = lib.licenses.bsd2;
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/el/electron-mail/package.nix b/pkgs/by-name/el/electron-mail/package.nix
index 22ed742e22d5..335241bfcf75 100644
--- a/pkgs/by-name/el/electron-mail/package.nix
+++ b/pkgs/by-name/el/electron-mail/package.nix
@@ -10,20 +10,20 @@
 
 let
   pname = "electron-mail";
-  version = "5.3.7";
+  version = "5.3.8";
 
   sources = {
     x86_64-linux = fetchurl {
       url = "https://github.com/vladimiry/ElectronMail/releases/download/v${version}/electron-mail-${version}-linux-x86_64.AppImage";
-      hash = "sha256-VJbCQ/4yIuBE4NPDFUbp8t2G/QjUclphH/MghvamDVo=";
+      hash = "sha256-twqB1D3zLlZJuxQWD4dGF70w57yYv6i3abGBidERsss=";
     };
     aarch64-darwin = fetchurl {
       url = "https://github.com/vladimiry/ElectronMail/releases/download/v${version}/electron-mail-${version}-mac-arm64.dmg";
-      hash = "sha256-ulB+dlp6ZBhcBJiLY4k+E/oEWy9XSIuIzd5rTzEq9+4=";
+      hash = "sha256-V32Wi0oCU9dLfzqxg3OdseiILX7wPiBGNz7KuG0vlZY=";
     };
     x86_64-darwin = fetchurl {
       url = "https://github.com/vladimiry/ElectronMail/releases/download/v${version}/electron-mail-${version}-mac-x64.dmg";
-      hash = "sha256-LbAqUj34m8qSq8sQ1xgCQj9+MfJHoFDRMq+/waMKtzM=";
+      hash = "sha256-I1UvFMSdAwkqgkhn+mkBGslA8v+VTajO/Za0lJ5uYZ8=";
     };
   };
 
diff --git a/pkgs/by-name/gh/gh/package.nix b/pkgs/by-name/gh/gh/package.nix
index 75907d8c9ea5..6e4bbbbc4380 100644
--- a/pkgs/by-name/gh/gh/package.nix
+++ b/pkgs/by-name/gh/gh/package.nix
@@ -10,7 +10,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "gh";
-  version = "2.93.0";
+  version = "2.96.0";
 
   __structuredAttrs = true;
 
@@ -18,10 +18,10 @@ buildGoModule (finalAttrs: {
     owner = "cli";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-r/+JFdMOUIb32St+VkUw+Q7Lb2L6IiPczmONFE4hwDw=";
+    hash = "sha256-+Roh0eR3Cm+ktLRHwWkvTiEvMGxsj7ngODJnjajL2x4=";
   };
 
-  vendorHash = "sha256-eMPcla1XKfq+zBb633Zz4cn820FWuEaRrXQJ1TQ8Lkg=";
+  vendorHash = "sha256-pQNepOGVEHF8rwdgnaUCnFe/mzDxabYqhouN2V0WkOo=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/gr/grav/package.nix b/pkgs/by-name/gr/grav/package.nix
index 284a3f8a09a9..f8e2888e4cc2 100644
--- a/pkgs/by-name/gr/grav/package.nix
+++ b/pkgs/by-name/gr/grav/package.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "1.7.53";
+  version = "1.7.53.2";
 in
 stdenvNoCC.mkDerivation {
   pname = "grav";
@@ -14,7 +14,7 @@ stdenvNoCC.mkDerivation {
 
   src = fetchzip {
     url = "https://github.com/getgrav/grav/releases/download/${version}/grav-admin-v${version}.zip";
-    hash = "sha256-Ug8sIEMwIoCUyHpxk5NaGHaJA7lThgbUuu+8NpmI9YI=";
+    hash = "sha256-6cQotHwIwWFR5phFQI9r79jpd+iYA1HpFBbYIzEVBsc=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ir/iredis/package.nix b/pkgs/by-name/ir/iredis/package.nix
index a8fbb956c9ef..bef043b7dcbd 100644
--- a/pkgs/by-name/ir/iredis/package.nix
+++ b/pkgs/by-name/ir/iredis/package.nix
@@ -1,34 +1,34 @@
 {
   lib,
   stdenv,
-  python3,
+  python3Packages,
   fetchFromGitHub,
+  versionCheckHook,
 }:
 
-python3.pkgs.buildPythonApplication (finalAttrs: {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "iredis";
-  version = "1.15.2";
+  version = "1.16.1";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "laixintao";
     repo = "iredis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-g/gQb9QOyfa7kyHCUZf/kLZRO5IE8389BUCYz8Sqr8o=";
+    hash = "sha256-m8XDNzHgMWBgcN3AyFlb8K/UNXbGhH4toKBiX5Q4/QY=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail 'packaging = "^23.0"' 'packaging = "*"' \
-      --replace-fail 'wcwidth = "0.1.9"' 'wcwidth = "*"' \
-      --replace-fail 'redis = "^5.0.0"' 'redis = "*"'
-  '';
+  pythonRelaxDeps = [
+    "packaging"
+    "redis"
+  ];
 
-  nativeBuildInputs = with python3.pkgs; [
+  build-system = with python3Packages; [
     poetry-core
   ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3Packages; [
     click
     configobj
     mistune
@@ -37,10 +37,9 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     pygments
     python-dateutil
     redis
-    wcwidth
   ];
 
-  nativeCheckInputs = with python3.pkgs; [
+  nativeCheckInputs = with python3Packages; [
     freezegun
     pexpect
     pytestCheckHook
@@ -65,6 +64,11 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
 
   pythonImportsCheck = [ "iredis" ];
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+
   meta = {
     description = "Terminal Client for Redis with AutoCompletion and Syntax Highlighting";
     changelog = "https://github.com/laixintao/iredis/blob/${finalAttrs.src.tag}/CHANGELOG.md";
diff --git a/pkgs/by-name/ke/keycloak/package.nix b/pkgs/by-name/ke/keycloak/package.nix
index 437dd9f436f9..921923d1c323 100644
--- a/pkgs/by-name/ke/keycloak/package.nix
+++ b/pkgs/by-name/ke/keycloak/package.nix
@@ -24,11 +24,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "keycloak";
-  version = "26.6.3";
+  version = "26.6.4";
 
   src = fetchzip {
     url = "https://github.com/keycloak/keycloak/releases/download/${finalAttrs.version}/keycloak-${finalAttrs.version}.zip";
-    hash = "sha256-MlWWiTnQVB/JjBhEk3wUv/1WPWnEx9h2iULwzCxUKHU=";
+    hash = "sha256-rb3Wdzc3g8jMvUffOfMfJ4Uw9HJomznXzLtPOrHoWU8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ma/mastodon/gemset.nix b/pkgs/by-name/ma/mastodon/gemset.nix
index 9e0500f11092..d2e16e05e7fa 100644
--- a/pkgs/by-name/ma/mastodon/gemset.nix
+++ b/pkgs/by-name/ma/mastodon/gemset.nix
@@ -804,10 +804,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0pfl5c0pyqaparxaqxi6s4gfl21bdldwiawrc0aknyvflli60lfw";
+      sha256 = "15djj19ynz3sbw54fsf8n7y3sha8a333f2mgvjfwhr46jhcqg1ll";
       type = "gem";
     };
-    version = "1.0.6";
+    version = "1.0.7";
   };
   css_parser = {
     dependencies = [
@@ -2274,10 +2274,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0v68nyl07xira30iyhn3118a4g59ar5748laq0cx2pwnsdy7ivrz";
+      sha256 = "18g6ps30z6m365bly7sfialavnsf6m6qamdxsr84w96k51j4mnlb";
       type = "gem";
     };
-    version = "1.8.1";
+    version = "1.8.3";
   };
   multi_json = {
     groups = [ "default" ];
diff --git a/pkgs/by-name/ma/mastodon/source.nix b/pkgs/by-name/ma/mastodon/source.nix
index dc6982dca446..7d292595b1b4 100644
--- a/pkgs/by-name/ma/mastodon/source.nix
+++ b/pkgs/by-name/ma/mastodon/source.nix
@@ -5,14 +5,14 @@
   patches ? [ ],
 }:
 let
-  version = "4.6.2";
+  version = "4.6.3";
 in
 applyPatches {
   src = fetchFromGitHub {
     owner = "mastodon";
     repo = "mastodon";
     rev = "v${version}";
-    hash = "sha256-RA9yGmWyzwiD/skPxOB27hqRxMqKGFmMMDOvHR5FjqI=";
+    hash = "sha256-NMeI8Ev0CSIf0dfbjqVAmFuTU9MFC8Y3qO9gI3p8Y+4=";
     passthru = {
       inherit version;
       yarnHash = "sha256-G1keSWDDpp0vBAOqQI8y8n7bmAeo9Hrdbo7R+cVZQwE=";
diff --git a/pkgs/by-name/ma/mattermost/package.nix b/pkgs/by-name/ma/mattermost/package.nix
index d241c440c42a..077e35239ed7 100644
--- a/pkgs/by-name/ma/mattermost/package.nix
+++ b/pkgs/by-name/ma/mattermost/package.nix
@@ -35,6 +35,11 @@
   ...
 }:
 
+assert lib.warnIf (latestVersionInfo != null && (removeUserLimit || removeFreeBadge)) ''
+  The user limit and free badge patches are not tested with this Mattermost version
+  (${latestVersionInfo.version}).
+'' true;
+
 let
   /*
     Helper function that sets the `withTests` and `withoutTests` passthru correctly,
diff --git a/pkgs/by-name/ma/mattermostLatest/package.nix b/pkgs/by-name/ma/mattermostLatest/package.nix
index e0fd905a82d2..e98f1f7032b5 100644
--- a/pkgs/by-name/ma/mattermostLatest/package.nix
+++ b/pkgs/by-name/ma/mattermostLatest/package.nix
@@ -15,10 +15,10 @@ mattermost.override (
       # and make sure the version regex is up to date here.
       # Ensure you also check ../mattermost/package.nix for ESR releases.
       regex = "^v(11\\.[0-9]+\\.[0-9]+)$";
-      version = "11.8.1";
-      srcHash = "sha256-9EIbTwnEeZQKg5uixkMp3sp/n+9I2N9W7hxsW5juF3M=";
+      version = "11.8.2";
+      srcHash = "sha256-XZ4yr7nbGum6UQaBjze50L8Yc/MLjo4NQBh263CNRtI=";
       vendorHash = "sha256-F2QMrLbio7812ZTGQZZPTqHWtIXbwbDmjUhtvv0DJ9s=";
-      npmDepsHash = "sha256-9GRM0VXrh1eR16ocSGEV/F2eflOflzkhrhRRnm9uB6s=";
+      npmDepsHash = "sha256-WIPLpi6lQvq9wieqvOACiRh7v1znxzcf+jyKXSjWzNc=";
       autoUpdate = ./package.nix;
     };
   }
diff --git a/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix b/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
index 6cb63b4bba03..287ed23699bb 100644
--- a/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
+++ b/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
@@ -31,13 +31,13 @@ in
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "modrinth-app-unwrapped";
-  version = "0.14.8";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "modrinth";
     repo = "code";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-s34vmm0Apy20FrfSjESXtj+uggvr4ODpOrxfapAKtlc=";
+    hash = "sha256-kF808vT/CO1Aklv+P23GWdxSBqDshFphL8hx0PYSgQk=";
   };
 
   patches = [
@@ -67,7 +67,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail '1.0.0-local' '${finalAttrs.version}'
   '';
 
-  cargoHash = "sha256-JU8QhdDikqe9a/MXVe2jSsXATvwdgpyjWr7pV/75C9E=";
+  cargoHash = "sha256-GQmhyTGN+MItwQEVyZ5Ai0cowvOxp++THuSrXsrRG1A=";
 
   mitmCache = gradle.fetchDeps {
     inherit (finalAttrs) pname;
diff --git a/pkgs/by-name/ob/obsidian/package.nix b/pkgs/by-name/ob/obsidian/package.nix
index d18f4f243409..ba5471ecedf0 100644
--- a/pkgs/by-name/ob/obsidian/package.nix
+++ b/pkgs/by-name/ob/obsidian/package.nix
@@ -3,7 +3,7 @@
   fetchurl,
   lib,
   makeWrapper,
-  electron_40, # see https://github.com/NixOS/nixpkgs/pull/521495
+  electron,
   makeDesktopItem,
   imagemagick,
   asar,
@@ -102,7 +102,7 @@ let
         --replace-fail "supportFetchAPI: true," "supportFetchAPI: true, corsEnabled: true,"
       asar pack app-src resources/app.asar
 
-      makeWrapper ${electron_40}/bin/electron $out/bin/obsidian \
+      makeWrapper ${electron}/bin/electron $out/bin/obsidian \
         --add-flags $out/share/obsidian/app.asar \
         --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-wayland-ime=true --wayland-text-input-version=3}}" \
         --add-flags ${lib.escapeShellArg commandLineArgs}
diff --git a/pkgs/by-name/sp/space-station-14-launcher/deps.json b/pkgs/by-name/sp/space-station-14-launcher/deps.json
index 7534e52508cb..297016604a97 100644
--- a/pkgs/by-name/sp/space-station-14-launcher/deps.json
+++ b/pkgs/by-name/sp/space-station-14-launcher/deps.json
@@ -49,11 +49,6 @@
     "version": "11.2.4",
     "hash": "sha256-MvxivGjYerXcr70JpWe9CCXO6MU9QQgCkmZfjZCFdJM="
   },
-  {
-    "pname": "Avalonia.ReactiveUI",
-    "version": "11.2.4",
-    "hash": "sha256-LqwLUDCIbJowol6BNTTsK7a7KjcLLbCM3y3KKvuHRGw="
-  },
   {
     "pname": "Avalonia.Remote.Protocol",
     "version": "11.2.4",
@@ -94,11 +89,6 @@
     "version": "8.4.1",
     "hash": "sha256-r+haH5VlmZFJTEJ3UedsYybw+oddn/CSvfm6x7PrrQ4="
   },
-  {
-    "pname": "Fody",
-    "version": "6.6.4",
-    "hash": "sha256-Xe9sGzIdQ970f0RwxD3KhdfqvGUoTpim2u2oqYHkDcI="
-  },
   {
     "pname": "Fody",
     "version": "6.9.2",
@@ -204,20 +194,10 @@
     "version": "25.4.0",
     "hash": "sha256-jwsuS+Kp+sD31S41tTHv/zkFqnzxnGOEty2iZVmBb6E="
   },
-  {
-    "pname": "ReactiveUI",
-    "version": "20.1.1",
-    "hash": "sha256-p9l2GMzBRchKb4gW9pQ3DIKhs2O9fX3t/V7jDDztBqE="
-  },
-  {
-    "pname": "ReactiveUI.Fody",
-    "version": "18.4.26",
-    "hash": "sha256-ucLfi/HB3cJIdmNssfazZAXPC8QJ35YVA+GtWKVU6UQ="
-  },
   {
     "pname": "Robust.Natives",
-    "version": "0.2.3",
-    "hash": "sha256-EwaSVnPsDSjY61vBIHaRSs/xpigGPqRStjYLcz+xaB0="
+    "version": "0.2.5",
+    "hash": "sha256-XHTGa14j5A/rycs7Y7iEOmDFpbyG8abVH0pBYmvtk00="
   },
   {
     "pname": "Robust.Natives.Angle",
@@ -246,8 +226,8 @@
   },
   {
     "pname": "Robust.Natives.Sdl3",
-    "version": "0.1.1-sdl3.2.20",
-    "hash": "sha256-dQPO/zME+e/Hsmic32hn5YIy4+LKfjDk064o6N7PKvM="
+    "version": "0.1.3-sdl3.4.8",
+    "hash": "sha256-jPwa4krPM9I3zbYtWcs4JIOBDlolNKZSUfioo+X1c/k="
   },
   {
     "pname": "Robust.Natives.Swnfd",
@@ -321,8 +301,8 @@
   },
   {
     "pname": "Splat",
-    "version": "15.1.1",
-    "hash": "sha256-WipAVaUx2HrYNQ9LcYm496LndmSpVbuzJxzP9FA6Ohg="
+    "version": "15.3.1",
+    "hash": "sha256-1MlkqywOtLr5TbQ+zAqzw0l92LK9+9h2+sJgmfV32RU="
   },
   {
     "pname": "SQLitePCLRaw.bundle_e_sqlite3",
@@ -344,11 +324,6 @@
     "version": "2.1.4",
     "hash": "sha256-Zdj676VT6j6k9ZCL2hYVl4F8bi4TK/ldvQBPmW0oDi0="
   },
-  {
-    "pname": "System.ComponentModel.Annotations",
-    "version": "5.0.0",
-    "hash": "sha256-0pST1UHgpeE6xJrYf5R+U7AwIlH3rVC3SpguilI/MAg="
-  },
   {
     "pname": "System.Net.Http.WinHttpHandler",
     "version": "8.0.0",
@@ -359,11 +334,6 @@
     "version": "6.0.0",
     "hash": "sha256-hXB18OsiUHSCmRF3unAfdUEcbXVbG6/nZxcyz13oe9Y="
   },
-  {
-    "pname": "System.Reactive",
-    "version": "6.0.1",
-    "hash": "sha256-Lo5UMqp8DsbVSUxa2UpClR1GoYzqQQcSxkfyFqB/d4Q="
-  },
   {
     "pname": "TerraFX.Interop.Windows",
     "version": "10.0.26100.2",
diff --git a/pkgs/by-name/sp/space-station-14-launcher/package.nix b/pkgs/by-name/sp/space-station-14-launcher/package.nix
index e318204281be..09262aa781c7 100644
--- a/pkgs/by-name/sp/space-station-14-launcher/package.nix
+++ b/pkgs/by-name/sp/space-station-14-launcher/package.nix
@@ -39,7 +39,7 @@
 }:
 let
   pname = "space-station-14-launcher";
-  version = "0.38.0";
+  version = "0.39.0";
 in
 buildDotnetModule rec {
   inherit pname;
@@ -52,7 +52,7 @@ buildDotnetModule rec {
     owner = "space-wizards";
     repo = "SS14.Launcher";
     tag = "v${version}";
-    hash = "sha256-/FPNCNDC09NMg1bTSZHNFfzabxYQ2FhV1t6Ire9WBtg=";
+    hash = "sha256-i5jcaB1wa+Toj6orpEQ9sK3EX1CLWadnhTEQDOU7QU4=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/um/umami/package.nix b/pkgs/by-name/um/umami/package.nix
index 849a61176dd3..2e68c5304f4b 100644
--- a/pkgs/by-name/um/umami/package.nix
+++ b/pkgs/by-name/um/umami/package.nix
@@ -46,12 +46,12 @@ let
   # to guarantee compatibility.
   prisma-engines' = prisma-engines_7.overrideAttrs (
     finalAttrs: prevAttrs: {
-      version = "7.6.0";
+      version = "7.8.0";
       src = fetchFromGitHub {
         owner = "prisma";
         repo = "prisma-engines";
         tag = finalAttrs.version;
-        hash = "sha256-NMoAaiTa68i51lR6iMCyHyCAsFuuhPx2+tHFSSoqWqA=";
+        hash = "sha256-nquIcOmFz+ikD0x/YEPZ5NVKCFPCdR5MSCHldn+b9jI=";
       };
       cargoHash = "sha256-uiFvzxwVJXCW9LUDFRC6ZkzSa7LQk+9ZJcaJw8mrBX4=";
 
@@ -65,23 +65,23 @@ let
   );
   prisma' = (prisma_7.override { prisma-engines_7 = prisma-engines'; }).overrideAttrs (
     finalAttrs: prevAttrs: {
-      version = "7.6.0";
+      version = "7.8.0";
       src = fetchFromGitHub {
         owner = "prisma";
         repo = "prisma";
         tag = finalAttrs.version;
-        hash = "sha256-BesX2ySfgew6+9Q6fnhZ8gMnnxh4D4fefaA5BhehlHE=";
+        hash = "sha256-89q5433z54h3oGX+lEYDQykN2mNltGz4+LWlYSE75/E=";
       };
       pnpmDeps = prevAttrs.pnpmDeps.override {
         inherit (finalAttrs) src version;
-        hash = "sha256-ZOpNt+W5b1troicfkCi4wCCDtwhTB4VlPgxYMZetcs0=";
+        hash = "sha256-mrFU5SAF4QuTBJj5TP8tUkYDG4zchttjcQMLtx6OBnI=";
       };
     }
   );
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "umami";
-  version = "3.1.0";
+  version = "3.2.0";
 
   nativeBuildInputs = [
     makeWrapper
@@ -94,7 +94,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     owner = "umami-software";
     repo = "umami";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EH3ebwTbajcNasn25ets2w068ZmCQRYUY2XON39J5HA=";
+    hash = "sha256-0nfCcaST06cTg43Rz1rCV8GYYDjQLP+6TrVRJF2/Yuk=";
   };
 
   # Umami uses next/font/google, which tries to download from Google Fonts at build time.
@@ -114,11 +114,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       src
       ;
     inherit pnpm;
-    fetcherVersion = 3;
-    hash = "sha256-QNWmCsVFh8xpsO4ZPTaKGszwuRaxTrWLMVh/6VV5oIw=";
+    fetcherVersion = 4;
+    hash = "sha256-6ho5xoVdqZdihThL5q8+RhVPfaSwu1y3+p9d8DnfO3o=";
   };
 
-  env.CYPRESS_INSTALL_BINARY = "0";
   env.NODE_ENV = "production";
   env.NEXT_TELEMETRY_DISABLED = "1";
 
@@ -150,7 +149,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   checkPhase = ''
     runHook preCheck
 
-    pnpm test
+    # Tests fail if NODE_ENV=production
+    NODE_ENV=development pnpm test
 
     runHook postCheck
   '';
diff --git a/pkgs/by-name/um/umami/sources.json b/pkgs/by-name/um/umami/sources.json
index 30d51dfd4329..0680e40a0888 100644
--- a/pkgs/by-name/um/umami/sources.json
+++ b/pkgs/by-name/um/umami/sources.json
@@ -1,7 +1,7 @@
 {
   "geocities": {
-    "rev": "6a3ef689a4673ff2bf292548716e7cc6c5a2c903",
-    "date": "2026-04-16",
-    "hash": "sha256-GUUeFU1DKGL+NpzK1oJlsyB/VrFWe6Lj7U7yJXj8mNo="
+    "rev": "04017f13909e499135afea605a1e07427e845641",
+    "date": "2026-07-02",
+    "hash": "sha256-4IYGsxNGdzilI0mYXlwEo43auqNug307pYyPuilR3aw="
   }
 }
diff --git a/pkgs/by-name/vr/vrcx/package.nix b/pkgs/by-name/vr/vrcx/package.nix
index 08d7785d22c2..2db225e37a5f 100644
--- a/pkgs/by-name/vr/vrcx/package.nix
+++ b/pkgs/by-name/vr/vrcx/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   nodejs_24,
-  electron_40,
+  electron_41,
   makeWrapper,
   fetchFromGitHub,
   buildNpmPackage,
@@ -13,7 +13,7 @@
 }:
 let
   node = nodejs_24;
-  electron = electron_40;
+  electron = electron_41;
   dotnet = dotnetCorePackages.dotnet_9;
 in
 buildNpmPackage (finalAttrs: {
diff --git a/pkgs/by-name/wo/wol/package.nix b/pkgs/by-name/wo/wol/package.nix
index f1fc0f08c67d..ba903ed75cdf 100644
--- a/pkgs/by-name/wo/wol/package.nix
+++ b/pkgs/by-name/wo/wol/package.nix
@@ -21,6 +21,11 @@ stdenv.mkDerivation (finalAttrs: {
     ./macos-10_7-getline.patch
   ];
 
+  env = lib.optionalAttrs stdenv.cc.isClang {
+    # wol's bundled gettext sources do not compile as gnu23 with clang.
+    NIX_CFLAGS_COMPILE = "-std=gnu17";
+  };
+
   nativeBuildInputs = [
     perl # for pod2man in order to get a manpage
     autoreconfHook # for the patch
diff --git a/pkgs/by-name/xa/xaos/package.nix b/pkgs/by-name/xa/xaos/package.nix
index 23541c81ea66..7561b57d19a2 100644
--- a/pkgs/by-name/xa/xaos/package.nix
+++ b/pkgs/by-name/xa/xaos/package.nix
@@ -28,6 +28,8 @@ stdenv.mkDerivation (finalAttrs: {
     qt6.qmake
     qt6.qttools
     qt6.wrapQtAppsHook
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
     copyDesktopItems
   ];
 
@@ -53,7 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
         "QMAKE_APPLE_DEVICE_ARCHS = ${if stdenv.hostPlatform.isAarch64 then "arm64" else "x86_64"}"
   '';
 
-  desktopItems = [ "xdg/xaos.desktop" ];
+  desktopItems = [ "xdg/io.github.xaos_project.XaoS.desktop" ];
 
   postInstall = ''
     mkdir -p "${datapath}"
diff --git a/pkgs/by-name/xo/xorg-server/package.nix b/pkgs/by-name/xo/xorg-server/package.nix
index 01e8f819be54..25dd29a82489 100644
--- a/pkgs/by-name/xo/xorg-server/package.nix
+++ b/pkgs/by-name/xo/xorg-server/package.nix
@@ -152,8 +152,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dxkb_bin_dir=${xkbcomp}/bin"
     "-Dxkb_dir=${xkeyboard-config}/share/X11/xkb"
     "-Dxkb_output_dir=$out/share/X11/xkb/compiled"
-  ]
-  ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+
     "-Dxcsecurity=true"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
@@ -177,6 +176,9 @@ stdenv.mkDerivation (finalAttrs: {
       --subst-var-by XQUARTZ_APP "$out/Applications/XQuartz.app"
   '';
 
+  # avoid linux rebuilds
+  ${if stdenv.hostPlatform.isDarwin then "hardeningDisable" else null} = [ "strictflexarrays1" ];
+
   # default X install symlinks this to Xorg, we want XQuartz
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     ln -sf $out/bin/Xquartz $out/bin/X
diff --git a/pkgs/by-name/xq/xquartz/package.nix b/pkgs/by-name/xq/xquartz/package.nix
index a3a33b92d458..008e213e97e4 100644
--- a/pkgs/by-name/xq/xquartz/package.nix
+++ b/pkgs/by-name/xq/xquartz/package.nix
@@ -240,12 +240,12 @@ stdenv.mkDerivation {
     cp ${fontsConf} $fontsConfPath
 
     substituteInPlace $out/bin/startx \
-      --replace "bindir=${xinit}/bin" "bindir=$out/bin" \
-      --replace 'defaultserver=${xorg-server}/bin/X' "defaultserver=$out/bin/Xquartz" \
-      --replace "${xinit}" "$out" \
-      --replace "${xorg-server}" "$out" \
-      --replace "eval xinit" "eval $out/bin/xinit" \
-      --replace "sysclientrc=/etc/X11/xinit/xinitrc" "sysclientrc=$out/etc/X11/xinit/xinitrc"
+      --replace-fail "${xinit}" "$out" \
+      --replace-fail "xserver=\"${xorg-server}/bin/X\"" "xserver=\"$out/bin/Xquartz\"" \
+      --replace-fail 'xinit="xinit"' "xinit=$out/bin/xinit" \
+      --replace-fail '"xauth"' "${lib.getExe xauth}" \
+      --replace-fail "xauth " '"$xauth" ' \
+      --replace-fail "sysclientrc=/etc/X11/xinit/xinitrc" "sysclientrc=$out/etc/X11/xinit/xinitrc"
 
     wrapProgram $out/bin/Xquartz \
       --set XQUARTZ_APP $out/Applications/XQuartz.app
@@ -262,9 +262,9 @@ stdenv.mkDerivation {
     EOF
 
     substituteInPlace $out/etc/X11/xinit/xinitrc \
-      --replace ${xinit} $out \
-      --replace xmodmap ${xmodmap}/bin/xmodmap \
-      --replace xrdb ${xrdb}/bin/xrdb
+      --replace-fail ${xinit} $out \
+      --replace-fail '"xmodmap"' ${xmodmap}/bin/xmodmap \
+      --replace-fail '"xrdb"' ${xrdb}/bin/xrdb
 
     mkdir -p $out/etc/X11/xinit/xinitrc.d
 
@@ -281,7 +281,7 @@ stdenv.mkDerivation {
     chmod +x $out/etc/X11/xinit/xinitrc.d/99-quartz-wm.sh
 
     substituteInPlace $out/etc/X11/xinit/privileged_startx.d/20-font_cache \
-      --replace ${xinit} $out
+      --replace-fail ${xinit} $out
 
     cp ${./font_cache} $out/bin/font_cache
     substituteInPlace $out/bin/font_cache \
diff --git a/pkgs/development/compilers/purescript/purescript/test-minimal-module/default.nix b/pkgs/development/compilers/purescript/purescript/test-minimal-module/default.nix
index a8503e1b9aae..2a0010b061a5 100644
--- a/pkgs/development/compilers/purescript/purescript/test-minimal-module/default.nix
+++ b/pkgs/development/compilers/purescript/purescript/test-minimal-module/default.nix
@@ -1,11 +1,17 @@
 {
+  lib,
   runCommand,
   purescript,
   nodejs,
 }:
 
 runCommand "purescript-test-minimal-module" { } ''
-  ${purescript}/bin/purs compile -o ./output ${./.}/Main.purs
+  ${purescript}/bin/purs compile -o ./output ${
+    lib.sources.sourceByGlobs ./. [
+      "*.purs"
+      "*.js"
+    ]
+  }/Main.purs
 
   echo 'import {main} from "./output/Main/index.js"; main()' > node.mjs
 
diff --git a/pkgs/development/tools/misc/coreboot-toolchain/default.nix b/pkgs/development/tools/misc/coreboot-toolchain/default.nix
index 2279ff8e5d4f..64359f53bd22 100644
--- a/pkgs/development/tools/misc/coreboot-toolchain/default.nix
+++ b/pkgs/development/tools/misc/coreboot-toolchain/default.nix
@@ -26,12 +26,12 @@ let
 
       stdenvNoCC.mkDerivation (finalAttrs: {
         pname = "coreboot-toolchain-${arch}";
-        version = "26.03";
+        version = "26.06";
 
         src = fetchgit {
           url = "https://review.coreboot.org/coreboot";
           rev = finalAttrs.version;
-          hash = "sha256-9ollzu6vtU+uHibvV/B5N70ZVl701kuI/orWlFZLjIU=";
+          hash = "sha256-MESai+UGo/Ref5t1VcgCrgQk+2ZeZW4Vh0xk3Z5v8ZE=";
           fetchSubmodules = false;
           leaveDotGit = true;
           postFetch = ''
diff --git a/pkgs/development/tools/misc/coreboot-toolchain/stable.nix b/pkgs/development/tools/misc/coreboot-toolchain/stable.nix
index 192c1e3fe3e0..008cf2d4e1ed 100644
--- a/pkgs/development/tools/misc/coreboot-toolchain/stable.nix
+++ b/pkgs/development/tools/misc/coreboot-toolchain/stable.nix
@@ -22,31 +22,38 @@
     };
   }
   {
-    name = "gcc-14.2.0.tar.xz";
+    name = "gcc-15.2.0.tar.xz";
     archive = fetchurl {
-      sha256 = "1j9wdznsp772q15w1kl5ip0gf0bh8wkanq2sdj12b7mzkk39pcx7";
-      url = "mirror://gnu/gcc/gcc-14.2.0/gcc-14.2.0.tar.xz";
+      sha256 = "0knj4ph6y7r7yhnp1v4339af7mki5nkh7ni9b948433bhabdk3s3";
+      url = "mirror://gnu/gcc/gcc-15.2.0/gcc-15.2.0.tar.xz";
     };
   }
   {
-    name = "binutils-2.45.tar.xz";
+    name = "binutils-2.45.1.tar.xz";
     archive = fetchurl {
-      sha256 = "1lpmpszs3lk9mcg7yn0m312745kbc8vlazn95h79i25ikizhw365";
-      url = "mirror://gnu/binutils/binutils-2.45.tar.xz";
+      sha256 = "199sa5igipbvz2zg0j1zgvrybphgcznq2bcnjpngs64xzvk03qaz";
+      url = "mirror://gnu/binutils/binutils-2.45.1.tar.xz";
     };
   }
   {
-    name = "acpica-unix-20250807.tar.gz";
+    name = "acpica-unix-20251212.tar.gz";
     archive = fetchurl {
-      sha256 = "0cwfm7i5a2fqq35hznnal38pgxgmnkm0v2xkb82jm1yv9014rjpa";
-      url = "https://downloadmirror.intel.com/864114/acpica-unix-20250807.tar.gz";
+      sha256 = "06azmpymppycmri6wf64pgf100k7gl2sxaddnl5xsm41bwj26r28";
+      url = "https://github.com/acpica/acpica/releases/download/20251212/acpica-unix-20251212.tar.gz";
     };
   }
   {
-    name = "nasm-2.16.03.tar.bz2";
+    name = "cmake-4.0.3.tar.gz";
     archive = fetchurl {
-      sha256 = "0mwynbnn7c4ay4rpcsyp99j49sa6j3p8gk5pigwssqfdkcaxxwxy";
-      url = "https://www.nasm.us/pub/nasm/releasebuilds/2.16.03/nasm-2.16.03.tar.bz2";
+      sha256 = "1yrzkwkr2nxl8hcjkk333l9ycbw9prkg363k4km609kknyvkfdcd";
+      url = "https://cmake.org/files/v4.0/cmake-4.0.3.tar.gz";
+    };
+  }
+  {
+    name = "nasm-3.01.tar.bz2";
+    archive = fetchurl {
+      sha256 = "1cf08p8ak15sksbzfyjxaiqggkjwc35f9yzjc9w29wzfn3riyyvs";
+      url = "https://www.nasm.us/pub/nasm/releasebuilds/3.01/nasm-3.01.tar.bz2";
     };
   }
 ]
diff --git a/pkgs/pkgs-lib/formats/java-properties/test/default.nix b/pkgs/pkgs-lib/formats/java-properties/test/default.nix
index 2ea787a90341..68cd5cfa1bcf 100644
--- a/pkgs/pkgs-lib/formats/java-properties/test/default.nix
+++ b/pkgs/pkgs-lib/formats/java-properties/test/default.nix
@@ -72,8 +72,8 @@ stdenv.mkDerivation {
     )
   );
 
-  src = lib.sourceByRegex ./. [
-    ".*\\.java"
+  src = lib.sources.sourceByGlobs ./. [
+    "**/*.java"
   ];
   # On Linux, this can be C.UTF-8, but darwin + zulu requires en_US.UTF-8
   LANG = "en_US.UTF-8";