diff --git a/doc/doc-support/python-interpreter-table.nix b/doc/doc-support/python-interpreter-table.nix
index 0ea478812872..84e6c7003616 100644
--- a/doc/doc-support/python-interpreter-table.nix
+++ b/doc/doc-support/python-interpreter-table.nix
@@ -61,7 +61,7 @@ let
 
 in
 writeText "python-interpreter-table.md" ''
-  | Package | Aliases | Interpeter |
-  |---------|---------|------------|
+  | Package | Aliases | Interpreter |
+  |---------|---------|-------------|
   ${toMarkdown result}
 ''
diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 487b7d4b3401..61c211c0dfcb 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -55,6 +55,7 @@ sets are
 * `pkgs.python312Packages`
 * `pkgs.python313Packages`
 * `pkgs.python314Packages`
+* `pkgs.python315Packages`
 * `pkgs.pypy27Packages`
 * `pkgs.pypy310Packages`
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 5bf33f795348..df4562d252b1 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -14897,7 +14897,7 @@
     name = "Isaac Silverstein";
   };
   loicreynier = {
-    email = "loic@loicreynier.fr";
+    email = "contact@loicreynier.fr";
     github = "loicreynier";
     githubId = 88983487;
     name = "Loïc Reynier";
diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 555f22a151a9..a030c95c8f8e 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -325,6 +325,8 @@
 
 - `services.dnscrypt-proxy` gains a `package` option to specify dnscrypt-proxy package to use.
 
+- `services.limesurvey` now supports nginx as reverse-proxy. Available through [services.limesurvey.webserver](#opt-services.limesurvey.webserver).
+
 - `services.nextcloud.configureRedis` now defaults to `true` in accordance with upstream recommendations to have caching for file locking. See the [upstream doc](https://docs.nextcloud.com/server/31/admin_manual/configuration_files/files_locking_transactional.html) for further details.
 
 - mate-wayland-session 1.28.4 is now using the default wayfire decorator instead of firedecor, thus `services.xserver.desktopManager.mate.enableWaylandSession` is no longer shipping firedecor. If you are experiencing broken window decorations after upgrade, backup and remove `~/.config/mate/wayfire.ini` and re-login.
diff --git a/nixos/modules/services/security/tsidp.nix b/nixos/modules/services/security/tsidp.nix
index f79c4eceaf3e..4b854cf183ca 100644
--- a/nixos/modules/services/security/tsidp.nix
+++ b/nixos/modules/services/security/tsidp.nix
@@ -23,6 +23,8 @@ let
     nullOr
     ;
 
+  stateDir = "/var/lib/tsidp";
+
   cfg = config.services.tsidp;
 in
 {
@@ -154,7 +156,7 @@ in
         ];
 
         environment = {
-          HOME = "/var/lib/tsidp";
+          HOME = stateDir;
           TAILSCALE_USE_WIP_CODE = "1"; # Needed while tsidp is in development (< v1.0.0).
         };
 
@@ -163,6 +165,7 @@ in
           ExecStart =
             let
               args = lib.cli.toGNUCommandLineShell { mkOptionName = k: "-${k}"; } {
+                dir = stateDir;
                 hostname = cfg.settings.hostName;
                 port = cfg.settings.port;
                 local-port = cfg.settings.localPort;
@@ -179,8 +182,8 @@ in
           RestartSec = "15";
 
           DynamicUser = true;
-          StateDirectory = "tsidp";
-          WorkingDirectory = "/var/lib/tsidp";
+          StateDirectory = baseNameOf stateDir;
+          WorkingDirectory = stateDir;
           ReadWritePaths = mkIf (cfg.settings.useLocalTailscaled) [
             "/var/run/tailscale" # needed due to `ProtectSystem = "strict";`
             "/var/lib/tailscale"
diff --git a/nixos/modules/services/web-apps/limesurvey.nix b/nixos/modules/services/web-apps/limesurvey.nix
index cb1b1ed7d2ff..8065efb7fcf8 100644
--- a/nixos/modules/services/web-apps/limesurvey.nix
+++ b/nixos/modules/services/web-apps/limesurvey.nix
@@ -8,6 +8,8 @@
 let
 
   inherit (lib)
+    literalExpression
+    mapAttrs
     mkDefault
     mkEnableOption
     mkForce
@@ -15,20 +17,21 @@ let
     mkMerge
     mkOption
     mkPackageOption
-    ;
-  inherit (lib)
-    literalExpression
-    mapAttrs
+    mkRenamedOptionModule
     optional
     optionalString
+    recursiveUpdate
     types
     ;
 
   cfg = config.services.limesurvey;
   fpm = config.services.phpfpm.pools.limesurvey;
 
+  # https://github.com/LimeSurvey/LimeSurvey/blob/master/.github/workflows/main.yml
+  php = pkgs.php83;
+
   user = "limesurvey";
-  group = config.services.httpd.group;
+  group = config.services.${cfg.webserver}.group;
   stateDir = "/var/lib/limesurvey";
 
   configType =
@@ -62,6 +65,13 @@ let
 
 in
 {
+  imports = [
+    (mkRenamedOptionModule
+      [ "services" "limesurvey" "virtualHost" ]
+      [ "services" "limesurvey" "httpd" "virtualHost" ]
+    )
+  ];
+
   # interface
 
   options.services.limesurvey = {
@@ -190,7 +200,19 @@ in
       };
     };
 
-    virtualHost = mkOption {
+    webserver = mkOption {
+      type = types.enum [
+        "httpd"
+        "nginx"
+      ];
+      default = "httpd";
+      example = "nginx";
+      description = ''
+        Webserver to configure for reverse-proxying limesurvey.
+      '';
+    };
+
+    httpd.virtualHost = mkOption {
       type = types.submodule (import ../web-servers/apache-httpd/vhost-options.nix);
       example = literalExpression ''
         {
@@ -206,6 +228,23 @@ in
       '';
     };
 
+    nginx.virtualHost = mkOption {
+      type = types.submodule (
+        recursiveUpdate (import ../web-servers/nginx/vhost-options.nix { inherit config lib; }) { }
+      );
+      example = literalExpression ''
+        {
+          serverName = "survey.example.org";
+          forceSSL = true;
+          enableACME = true;
+        }
+      '';
+      description = ''
+        Nginx configuration can be done by adapting `services.nginx.virtualHosts.<name>`.
+        See [](#opt-services.nginx.virtualHosts) for further information.
+      '';
+    };
+
     poolConfig = mkOption {
       type =
         with types;
@@ -241,192 +280,123 @@ in
 
   # implementation
 
-  config = mkIf cfg.enable {
-
-    assertions = [
-      {
-        assertion = cfg.database.createLocally -> cfg.database.type == "mysql";
-        message = "services.limesurvey.createLocally is currently only supported for database type 'mysql'";
-      }
-      {
-        assertion = cfg.database.createLocally -> cfg.database.user == user;
-        message = "services.limesurvey.database.user must be set to ${user} if services.limesurvey.database.createLocally is set true";
-      }
-      {
-        assertion = cfg.database.createLocally -> cfg.database.socket != null;
-        message = "services.limesurvey.database.socket must be set if services.limesurvey.database.createLocally is set to true";
-      }
-      {
-        assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;
-        message = "a password cannot be specified if services.limesurvey.database.createLocally is set to true";
-      }
-      {
-        assertion = cfg.encryptionKey != null || cfg.encryptionKeyFile != null;
-        message = ''
-          You must set `services.limesurvey.encryptionKeyFile` to a file containing a 32-character uppercase hex string.
-
-          If this message appears when updating your system, please turn off encryption
-          in the LimeSurvey interface and create backups before filling the key.
-        '';
-      }
-      {
-        assertion = cfg.encryptionNonce != null || cfg.encryptionNonceFile != null;
-        message = ''
-          You must set `services.limesurvey.encryptionNonceFile` to a file containing a 24-character uppercase hex string.
-
-          If this message appears when updating your system, please turn off encryption
-          in the LimeSurvey interface and create backups before filling the nonce.
-        '';
-      }
-    ];
-
-    services.limesurvey.config = mapAttrs (name: mkDefault) {
-      runtimePath = "${stateDir}/tmp/runtime";
-      components = {
-        db = {
-          connectionString =
-            "${cfg.database.type}:dbname=${cfg.database.name};host=${
-              if pgsqlLocal then cfg.database.socket else cfg.database.host
-            };port=${toString cfg.database.port}"
-            + optionalString mysqlLocal ";socket=${cfg.database.socket}";
-          username = cfg.database.user;
-          password = mkIf (
-            cfg.database.passwordFile != null
-          ) "file_get_contents(\"${toString cfg.database.passwordFile}\");";
-          tablePrefix = "limesurvey_";
-        };
-        assetManager.basePath = "${stateDir}/tmp/assets";
-        urlManager = {
-          urlFormat = "path";
-          showScriptName = false;
-        };
-      };
-      config = {
-        tempdir = "${stateDir}/tmp";
-        uploaddir = "${stateDir}/upload";
-        userquestionthemerootdir = "${stateDir}/upload/themes/question";
-        force_ssl = mkIf (
-          cfg.virtualHost.addSSL || cfg.virtualHost.forceSSL || cfg.virtualHost.onlySSL
-        ) "on";
-        config.defaultlang = "en";
-      };
-    };
-
-    services.mysql = mkIf mysqlLocal {
-      enable = true;
-      package = mkDefault pkgs.mariadb;
-      ensureDatabases = [ cfg.database.name ];
-      ensureUsers = [
+  config = mkIf (cfg.enable) (mkMerge [
+    {
+      assertions = [
         {
-          name = cfg.database.user;
-          ensurePermissions = {
-            "${cfg.database.name}.*" = "SELECT, CREATE, INSERT, UPDATE, DELETE, ALTER, DROP, INDEX";
-          };
+          assertion = cfg.database.createLocally -> cfg.database.type == "mysql";
+          message = "services.limesurvey.createLocally is currently only supported for database type 'mysql'";
         }
-      ];
-    };
-
-    services.phpfpm.pools.limesurvey = {
-      inherit user group;
-      phpPackage = pkgs.php83;
-      phpEnv.DBENGINE = "${cfg.database.dbEngine}";
-      phpEnv.LIMESURVEY_CONFIG = "${limesurveyConfig}";
-      # App code cannot access credentials directly since the service starts
-      # with the root user so we copy the credentials to a place accessible to Limesurvey
-      phpEnv.CREDENTIALS_DIRECTORY = "${stateDir}/credentials";
-      settings = {
-        "listen.owner" = config.services.httpd.user;
-        "listen.group" = config.services.httpd.group;
-      }
-      // cfg.poolConfig;
-    };
-    systemd.services.phpfpm-limesurvey.serviceConfig = {
-      ExecStartPre = pkgs.writeShellScript "limesurvey-phpfpm-exec-pre" ''
-        cp -f "''${CREDENTIALS_DIRECTORY}"/encryption_key "${stateDir}/credentials/encryption_key"
-        chown ${user}:${group} "${stateDir}/credentials/encryption_key"
-        cp -f "''${CREDENTIALS_DIRECTORY}"/encryption_nonce "${stateDir}/credentials/encryption_nonce"
-        chown ${user}:${group} "${stateDir}/credentials/encryption_nonce"
-      '';
-      LoadCredential = [
-        "encryption_key:${
-          if cfg.encryptionKeyFile != null then
-            cfg.encryptionKeyFile
-          else
-            pkgs.writeText "key" cfg.encryptionKey
-        }"
-        "encryption_nonce:${
-          if cfg.encryptionNonceFile != null then
-            cfg.encryptionNonceFile
-          else
-            pkgs.writeText "nonce" cfg.encryptionKey
-        }"
-      ];
-    };
-
-    services.httpd = {
-      enable = true;
-      adminAddr = mkDefault cfg.virtualHost.adminAddr;
-      extraModules = [ "proxy_fcgi" ];
-      virtualHosts.${cfg.virtualHost.hostName} = mkMerge [
-        cfg.virtualHost
         {
-          documentRoot = mkForce "${cfg.package}/share/limesurvey";
-          extraConfig = ''
-            Alias "/tmp" "${stateDir}/tmp"
-            <Directory "${stateDir}">
-              AllowOverride all
-              Require all granted
-              Options -Indexes +FollowSymlinks
-            </Directory>
+          assertion = cfg.database.createLocally -> cfg.database.user == user;
+          message = "services.limesurvey.database.user must be set to ${user} if services.limesurvey.database.createLocally is set true";
+        }
+        {
+          assertion = cfg.database.createLocally -> cfg.database.socket != null;
+          message = "services.limesurvey.database.socket must be set if services.limesurvey.database.createLocally is set to true";
+        }
+        {
+          assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;
+          message = "a password cannot be specified if services.limesurvey.database.createLocally is set to true";
+        }
+        {
+          assertion = cfg.encryptionKey != null || cfg.encryptionKeyFile != null;
+          message = ''
+            You must set `services.limesurvey.encryptionKeyFile` to a file containing a 32-character uppercase hex string.
 
-            Alias "/upload" "${stateDir}/upload"
-            <Directory "${stateDir}/upload">
-              AllowOverride all
-              Require all granted
-              Options -Indexes
-            </Directory>
+            If this message appears when updating your system, please turn off encryption
+            in the LimeSurvey interface and create backups before filling the key.
+          '';
+        }
+        {
+          assertion = cfg.encryptionNonce != null || cfg.encryptionNonceFile != null;
+          message = ''
+            You must set `services.limesurvey.encryptionNonceFile` to a file containing a 24-character uppercase hex string.
 
-            <Directory "${cfg.package}/share/limesurvey">
-              <FilesMatch "\.php$">
-                <If "-f %{REQUEST_FILENAME}">
-                  SetHandler "proxy:unix:${fpm.socket}|fcgi://localhost/"
-                </If>
-              </FilesMatch>
-
-              AllowOverride all
-              Options -Indexes
-              DirectoryIndex index.php
-            </Directory>
+            If this message appears when updating your system, please turn off encryption
+            in the LimeSurvey interface and create backups before filling the nonce.
           '';
         }
       ];
-    };
 
-    systemd.tmpfiles.rules = [
-      "d ${stateDir} 0750 ${user} ${group} - -"
-      "d ${stateDir}/tmp 0750 ${user} ${group} - -"
-      "d ${stateDir}/tmp/assets 0750 ${user} ${group} - -"
-      "d ${stateDir}/tmp/runtime 0750 ${user} ${group} - -"
-      "d ${stateDir}/tmp/upload 0750 ${user} ${group} - -"
-      "d ${stateDir}/credentials 0700 ${user} ${group} - -"
-      "C ${stateDir}/upload 0750 ${user} ${group} - ${cfg.package}/share/limesurvey/upload"
-    ];
+      users.users.${user} = {
+        group = group;
+        isSystemUser = true;
+      };
 
-    systemd.services.limesurvey-init = {
-      wantedBy = [ "multi-user.target" ];
-      before = [ "phpfpm-limesurvey.service" ];
-      after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.target";
-      environment.DBENGINE = "${cfg.database.dbEngine}";
-      environment.LIMESURVEY_CONFIG = limesurveyConfig;
-      script = ''
-        # update or install the database as required
-        ${pkgs.php83}/bin/php ${cfg.package}/share/limesurvey/application/commands/console.php updatedb || \
-        ${pkgs.php83}/bin/php ${cfg.package}/share/limesurvey/application/commands/console.php install admin password admin admin@example.com verbose
-      '';
-      serviceConfig = {
-        User = user;
-        Group = group;
-        Type = "oneshot";
+      systemd.services.limesurvey-init = {
+        wantedBy = [ "multi-user.target" ];
+        before = [ "phpfpm-limesurvey.service" ];
+        after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.target";
+        environment.DBENGINE = "${cfg.database.dbEngine}";
+        environment.LIMESURVEY_CONFIG = limesurveyConfig;
+        script = ''
+          # update or install the database as required
+          ${lib.getExe php} ${cfg.package}/share/limesurvey/application/commands/console.php updatedb || \
+          ${lib.getExe php} ${cfg.package}/share/limesurvey/application/commands/console.php install admin password admin admin@example.com verbose
+        '';
+        serviceConfig = {
+          User = user;
+          Group = group;
+          Type = "oneshot";
+          LoadCredential = [
+            "encryption_key:${
+              if cfg.encryptionKeyFile != null then
+                cfg.encryptionKeyFile
+              else
+                pkgs.writeText "key" cfg.encryptionKey
+            }"
+            "encryption_nonce:${
+              if cfg.encryptionNonceFile != null then
+                cfg.encryptionNonceFile
+              else
+                pkgs.writeText "nonce" cfg.encryptionKey
+            }"
+          ];
+        };
+      };
+
+      services.limesurvey.config = mapAttrs (name: mkDefault) {
+        runtimePath = "${stateDir}/tmp/runtime";
+        components = {
+          db = {
+            connectionString =
+              "${cfg.database.type}:dbname=${cfg.database.name};host=${
+                if pgsqlLocal then cfg.database.socket else cfg.database.host
+              };port=${toString cfg.database.port}"
+              + optionalString mysqlLocal ";socket=${cfg.database.socket}";
+            username = cfg.database.user;
+            password = mkIf (
+              cfg.database.passwordFile != null
+            ) "file_get_contents(\"${toString cfg.database.passwordFile}\");";
+            tablePrefix = "limesurvey_";
+          };
+          assetManager.basePath = "${stateDir}/tmp/assets";
+          urlManager = {
+            urlFormat = "path";
+            showScriptName = false;
+          };
+        };
+        config = {
+          tempdir = "${stateDir}/tmp";
+          uploaddir = "${stateDir}/upload";
+          userquestionthemerootdir = "${stateDir}/upload/themes/question";
+          force_ssl = mkIf (
+            cfg.${cfg.webserver}.virtualHost.addSSL
+            || cfg.${cfg.webserver}.virtualHost.forceSSL
+            || cfg.${cfg.webserver}.virtualHost.onlySSL
+          ) "on";
+          config.defaultlang = "en";
+        };
+      };
+
+      systemd.services.phpfpm-limesurvey.serviceConfig = {
+        ExecStartPre = pkgs.writeShellScript "limesurvey-phpfpm-exec-pre" ''
+          cp -f "''${CREDENTIALS_DIRECTORY}"/encryption_key "${stateDir}/credentials/encryption_key"
+          chown ${user}:${group} "${stateDir}/credentials/encryption_key"
+          cp -f "''${CREDENTIALS_DIRECTORY}"/encryption_nonce "${stateDir}/credentials/encryption_nonce"
+          chown ${user}:${group} "${stateDir}/credentials/encryption_nonce"
+        '';
         LoadCredential = [
           "encryption_key:${
             if cfg.encryptionKeyFile != null then
@@ -442,15 +412,118 @@ in
           }"
         ];
       };
-    };
 
-    systemd.services.httpd.after =
-      optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.target";
+      services.phpfpm.pools.limesurvey = {
+        inherit user group;
+        phpPackage = php;
+        phpEnv.DBENGINE = "${cfg.database.dbEngine}";
+        phpEnv.LIMESURVEY_CONFIG = "${limesurveyConfig}";
+        # App code cannot access credentials directly since the service starts
+        # with the root user so we copy the credentials to a place accessible to Limesurvey
+        phpEnv.CREDENTIALS_DIRECTORY = "${stateDir}/credentials";
+        settings = {
+          "listen.owner" = config.services.${cfg.webserver}.user;
+          "listen.group" = config.services.${cfg.webserver}.group;
+        }
+        // cfg.poolConfig;
+      };
 
-    users.users.${user} = {
-      group = group;
-      isSystemUser = true;
-    };
+      systemd.tmpfiles.rules = [
+        "d ${stateDir} 0750 ${user} ${group} - -"
+        "d ${stateDir}/tmp 0750 ${user} ${group} - -"
+        "d ${stateDir}/tmp/assets 0750 ${user} ${group} - -"
+        "d ${stateDir}/tmp/runtime 0750 ${user} ${group} - -"
+        "d ${stateDir}/tmp/upload 0750 ${user} ${group} - -"
+        "d ${stateDir}/credentials 0700 ${user} ${group} - -"
+        "C ${stateDir}/upload 0750 ${user} ${group} - ${cfg.package}/share/limesurvey/upload"
+      ];
+    }
 
-  };
+    (mkIf mysqlLocal {
+      services.mysql = {
+        enable = true;
+        package = mkDefault pkgs.mariadb;
+        ensureDatabases = [ cfg.database.name ];
+        ensureUsers = [
+          {
+            name = cfg.database.user;
+            ensurePermissions = {
+              "${cfg.database.name}.*" = "SELECT, CREATE, INSERT, UPDATE, DELETE, ALTER, DROP, INDEX";
+            };
+          }
+        ];
+      };
+    })
+
+    (mkIf (cfg.webserver == "httpd") {
+      services.httpd = {
+        enable = true;
+        adminAddr = mkDefault cfg.httpd.virtualHost.adminAddr;
+        extraModules = [ "proxy_fcgi" ];
+        virtualHosts.${cfg.httpd.virtualHost.hostName} = mkMerge [
+          cfg.httpd.virtualHost
+          {
+            documentRoot = mkForce "${cfg.package}/share/limesurvey";
+            extraConfig = ''
+              Alias "/tmp" "${stateDir}/tmp"
+              <Directory "${stateDir}">
+                AllowOverride all
+                Require all granted
+                Options -Indexes +FollowSymlinks
+              </Directory>
+
+              Alias "/upload" "${stateDir}/upload"
+              <Directory "${stateDir}/upload">
+                AllowOverride all
+                Require all granted
+                Options -Indexes
+              </Directory>
+
+              <Directory "${cfg.package}/share/limesurvey">
+                <FilesMatch "\.php$">
+                  <If "-f %{REQUEST_FILENAME}">
+                    SetHandler "proxy:unix:${fpm.socket}|fcgi://localhost/"
+                  </If>
+                </FilesMatch>
+
+                AllowOverride all
+                Options -Indexes
+                DirectoryIndex index.php
+              </Directory>
+            '';
+          }
+        ];
+      };
+      systemd.services.httpd.after =
+        optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.target";
+    })
+
+    (mkIf (cfg.webserver == "nginx") {
+      services.nginx = {
+        enable = true;
+        virtualHosts.${cfg.nginx.virtualHost.serverName} = lib.mkMerge [
+          cfg.nginx.virtualHost
+          {
+            root = lib.mkForce "${cfg.package}/share/limesurvey";
+            locations = {
+              "/" = {
+                index = "index.php";
+                tryFiles = "$uri /index.php?$args";
+              };
+
+              "~ \.php$".extraConfig = ''
+                fastcgi_pass unix:${config.services.phpfpm.pools."limesurvey".socket};
+              '';
+              "/tmp".root = "/var/lib/limesurvey";
+              "/upload/".root = "/var/lib/limesurvey";
+
+            };
+          }
+        ];
+      };
+
+      systemd.services.nginx.after =
+        optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.service";
+    })
+  ]);
 }
diff --git a/nixos/tests/limesurvey.nix b/nixos/tests/limesurvey.nix
index 9f90b4d16820..3e24040c9903 100644
--- a/nixos/tests/limesurvey.nix
+++ b/nixos/tests/limesurvey.nix
@@ -1,31 +1,50 @@
 { lib, pkgs, ... }:
+
 {
   name = "limesurvey";
   meta.maintainers = [ lib.maintainers.aanderse ];
 
-  nodes.machine =
-    { ... }:
-    {
-      services.limesurvey = {
-        enable = true;
-        virtualHost = {
-          hostName = "example.local";
-          adminAddr = "root@example.local";
-        };
-        encryptionKeyFile = pkgs.writeText "key" (lib.strings.replicate 32 "0");
-        encryptionNonceFile = pkgs.writeText "nonce" (lib.strings.replicate 24 "0");
+  nodes.machine = {
+    services.limesurvey = {
+      enable = true;
+      httpd.virtualHost = {
+        hostName = "example.local";
+        adminAddr = "root@example.local";
       };
-
-      # limesurvey won't work without a dot in the hostname
-      networking.hosts."127.0.0.1" = [ "example.local" ];
+      encryptionKeyFile = pkgs.writeText "key" (lib.strings.replicate 32 "0");
+      encryptionNonceFile = pkgs.writeText "nonce" (lib.strings.replicate 24 "0");
     };
 
-  testScript = ''
-    start_all()
+    # limesurvey won't work without a dot in the hostname
+    networking.hosts."127.0.0.1" = [ "example.local" ];
 
-    machine.wait_for_unit("phpfpm-limesurvey.service")
-    assert "The following surveys are available" in machine.succeed(
-        "curl -f http://example.local/"
-    )
-  '';
+    specialisation.nginx = {
+      inheritParentConfig = true;
+      configuration.services.limesurvey = {
+        webserver = "nginx";
+        nginx.virtualHost.serverName = "example.local";
+      };
+    };
+  };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      def test():
+        machine.wait_until_succeeds("curl --fail --silent http://example.local/ | grep -q 'The following surveys are available'")
+
+      start_all()
+
+      machine.wait_for_unit("phpfpm-limesurvey.service")
+      machine.wait_for_unit("httpd.service")
+      machine.wait_for_open_port(80)
+      test()
+
+      machine.execute("${nodes.machine.system.build.toplevel}/specialisation/nginx/bin/switch-to-configuration test")
+
+      machine.wait_for_unit("nginx.service")
+      test()
+
+
+    '';
 }
diff --git a/pkgs/by-name/al/alistral/package.nix b/pkgs/by-name/al/alistral/package.nix
index 30f1aa77e88b..613c2fced83e 100644
--- a/pkgs/by-name/al/alistral/package.nix
+++ b/pkgs/by-name/al/alistral/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "alistral";
-  version = "0.5.14";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "RustyNova016";
     repo = "Alistral";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PffZx2rkOdwwhZ4LYE6ZiAWa68oZT3Gly6Is9gRPWdw=";
+    hash = "sha256-IJ12v/mmrs6jW6jWPHEjtS74lSLWSIvJejQz4BTFbEQ=";
   };
 
-  cargoHash = "sha256-FfTySXynezMs/Nkuai+jZCSJnIo5D3obh3LboYYGhVk=";
+  cargoHash = "sha256-x695jOKR/s5J/51LUqPlNMgGzsoq8D8KR9gLjyLPfkA=";
 
   buildNoDefaultFeatures = true;
   # Would be cleaner with an "--all-features" option
diff --git a/pkgs/by-name/cl/cliqr/package.nix b/pkgs/by-name/cl/cliqr/package.nix
index 2f5774a48419..1d9fddf98708 100644
--- a/pkgs/by-name/cl/cliqr/package.nix
+++ b/pkgs/by-name/cl/cliqr/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "cliqr";
-  version = "0.1.29";
+  version = "0.1.30";
 
   src = fetchFromGitHub {
     owner = "paepckehh";
     repo = "cliqr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fhNMiUaCTk4xYGJRMuZCHeYvzGeVwkS7E7LU1L+LuBg=";
+    hash = "sha256-+HP7RDh/8gIsHAO1adtClKZbBg70LSxvf88aS0hFBJs=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/en/envoy-bin/package.nix b/pkgs/by-name/en/envoy-bin/package.nix
index 641c61bd5f21..f447be7d017d 100644
--- a/pkgs/by-name/en/envoy-bin/package.nix
+++ b/pkgs/by-name/en/envoy-bin/package.nix
@@ -8,7 +8,7 @@
   versionCheckHook,
 }:
 let
-  version = "1.35.3";
+  version = "1.35.4";
   inherit (stdenv.hostPlatform) system;
   throwSystem = throw "envoy-bin is not available for ${system}.";
 
@@ -21,8 +21,8 @@ let
 
   hash =
     {
-      aarch64-linux = "sha256-NN5VDwIYLTHSYpVljAQQOdRjQavNGn5BLmpOK+Azg18=";
-      x86_64-linux = "sha256-JBwXAvDtHA26MTOauqtCKQakKVzJJkD1uDLBMe44V2c=";
+      aarch64-linux = "sha256-iTZilcY0Tc6xjMCSOEdwyzyJeRhd+5A4WIhq89817bc=";
+      x86_64-linux = "sha256-hBy2DmJlTADt9E3V81CKlFXkM17q52gN5Eq/l4F+qcw=";
     }
     .${system} or throwSystem;
 in
diff --git a/pkgs/by-name/eq/equilux-theme/package.nix b/pkgs/by-name/eq/equilux-theme/package.nix
index 785c3e0f68bd..4dc7b7fff8db 100644
--- a/pkgs/by-name/eq/equilux-theme/package.nix
+++ b/pkgs/by-name/eq/equilux-theme/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   gnome-shell,
-  gnome-themes-extra,
   glib,
   libxml2,
   gtk-engine-murrine,
@@ -12,15 +11,15 @@
   bc,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "equilux-theme";
   version = "20181029";
 
   src = fetchFromGitHub {
     owner = "ddnexus";
     repo = "equilux-theme";
-    rev = "equilux-v${version}";
-    sha256 = "0lv2yyxhnmnkwxp576wnb01id4fp734b5z5n0l67sg5z7vc2h8fc";
+    tag = "equilux-v${finalAttrs.version}";
+    hash = "sha256-zCEo2D6/PH0MBbb8ssg415EWA1iWm1Nu59NWC7v3YlM=";
   };
 
   nativeBuildInputs = [
@@ -30,7 +29,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gnome-themes-extra
     gdk-pixbuf
     librsvg
   ];
@@ -49,11 +47,11 @@ stdenv.mkDerivation rec {
     rm $out/share/themes/*/COPYING
   '';
 
-  meta = with lib; {
-    inherit (src.meta) homepage;
+  meta = {
+    inherit (finalAttrs.src.meta) homepage;
     description = "Material Design theme for GNOME/GTK based desktop environments";
-    license = licenses.gpl2;
-    platforms = platforms.all;
-    maintainers = [ maintainers.fpletz ];
+    license = lib.licenses.gpl2;
+    platforms = lib.platforms.all;
+    maintainers = [ lib.maintainers.fpletz ];
   };
-}
+})
diff --git a/pkgs/by-name/ev/evil-winrm/Gemfile.lock b/pkgs/by-name/ev/evil-winrm/Gemfile.lock
index 63d93e828e22..0c88daea6d14 100644
--- a/pkgs/by-name/ev/evil-winrm/Gemfile.lock
+++ b/pkgs/by-name/ev/evil-winrm/Gemfile.lock
@@ -1,11 +1,11 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    base64 (0.2.0)
-    bigdecimal (3.1.9)
+    base64 (0.3.0)
+    bigdecimal (3.3.1)
     builder (3.3.0)
     erubi (1.13.1)
-    ffi (1.17.1)
+    ffi (1.17.2)
     fileutils (1.7.3)
     gssapi (1.3.1)
       ffi (>= 1.0.1)
@@ -15,19 +15,19 @@ GEM
     httpclient (2.9.0)
       mutex_m
     little-plugger (1.1.4)
-    logger (1.6.6)
+    logger (1.7.0)
     logging (2.4.0)
       little-plugger (~> 1.1)
       multi_json (~> 1.14)
-    multi_json (1.15.0)
+    multi_json (1.17.0)
     mutex_m (0.3.0)
     nori (2.7.1)
       bigdecimal
-    rexml (3.4.1)
+    rexml (3.4.4)
     rubyntlm (0.6.5)
       base64
     rubyzip (2.4.1)
-    stringio (3.1.5)
+    stringio (3.1.7)
     winrm (2.3.9)
       builder (>= 2.1.2)
       erubi (~> 1.8)
@@ -55,4 +55,4 @@ DEPENDENCIES
   winrm-fs
 
 BUNDLED WITH
-   2.6.2
+   2.7.1
diff --git a/pkgs/by-name/ev/evil-winrm/gemset.nix b/pkgs/by-name/ev/evil-winrm/gemset.nix
index 7eb90702fa47..54c38cb871a5 100644
--- a/pkgs/by-name/ev/evil-winrm/gemset.nix
+++ b/pkgs/by-name/ev/evil-winrm/gemset.nix
@@ -4,20 +4,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "01qml0yilb9basf7is2614skjp8384h2pycfx86cr8023arfj98g";
+      sha256 = "0yx9yn47a8lkfcjmigk79fykxvr80r4m1i35q82sxzynpbm7lcr7";
       type = "gem";
     };
-    version = "0.2.0";
+    version = "0.3.0";
   };
   bigdecimal = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1k6qzammv9r6b2cw3siasaik18i6wjc5m0gw5nfdc6jj64h79z1g";
+      sha256 = "0612spks81fvpv2zrrv3371lbs6mwd7w6g5zafglyk75ici1x87a";
       type = "gem";
     };
-    version = "3.1.9";
+    version = "3.3.1";
   };
   builder = {
     groups = [ "default" ];
@@ -44,10 +44,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0fgwn1grxf4zxmyqmb9i4z2hr111585n9jnk17y6y7hhs7dv1xi6";
+      sha256 = "19kdyjg3kv7x0ad4xsd4swy5izsbb1vl1rpb6qqcqisr5s23awi9";
       type = "gem";
     };
-    version = "1.17.1";
+    version = "1.17.2";
   };
   fileutils = {
     groups = [ "default" ];
@@ -110,10 +110,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "05s008w9vy7is3njblmavrbdzyrwwc1fsziffdr58w9pwqj8sqfx";
+      sha256 = "00q2zznygpbls8asz5knjvvj2brr3ghmqxgr83xnrdj4rk3xwvhr";
       type = "gem";
     };
-    version = "1.6.6";
+    version = "1.7.0";
   };
   logging = {
     dependencies = [
@@ -134,10 +134,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0pb1g1y3dsiahavspyzkdy39j4q377009f6ix0bh1ag4nqw43l0z";
+      sha256 = "06sabsvnw0x1aqdcswc6bqrqz6705548bfd8z22jxgxfjrn1yn3n";
       type = "gem";
     };
-    version = "1.15.0";
+    version = "1.17.0";
   };
   mutex_m = {
     groups = [ "default" ];
@@ -165,10 +165,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1jmbf6lf7pcyacpb939xjjpn1f84c3nw83dy3p1lwjx0l2ljfif7";
+      sha256 = "0hninnbvqd2pn40h863lbrn9p11gvdxp928izkag5ysx8b1s5q0r";
       type = "gem";
     };
-    version = "3.4.1";
+    version = "3.4.4";
   };
   rubyntlm = {
     dependencies = [ "base64" ];
@@ -196,10 +196,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1j1mgvrgkxhadi6nb6pz1kcff7gsb5aivj1vfhsia4ssa5hj9adw";
+      sha256 = "1yh78pg6lm28c3k0pfd2ipskii1fsraq46m6zjs5yc9a4k5vfy2v";
       type = "gem";
     };
-    version = "3.1.5";
+    version = "3.1.7";
   };
   winrm = {
     dependencies = [
diff --git a/pkgs/by-name/ev/evil-winrm/package.nix b/pkgs/by-name/ev/evil-winrm/package.nix
index 681f38d8bae7..8179f1edd858 100644
--- a/pkgs/by-name/ev/evil-winrm/package.nix
+++ b/pkgs/by-name/ev/evil-winrm/package.nix
@@ -5,6 +5,9 @@
   makeWrapper,
   bundlerEnv,
   bundlerUpdateScript,
+  writeText,
+  krb5,
+  sslLegacyProvider ? false,
 }:
 let
   rubyEnv = bundlerEnv {
@@ -13,16 +16,32 @@ let
     lockfile = ./Gemfile.lock;
     gemset = ./gemset.nix;
   };
+  openssl_conf = writeText "openssl.conf" ''
+    openssl_conf = openssl_init
+
+    [openssl_init]
+    providers = provider_sect
+
+    [provider_sect]
+    default = default_sect
+    legacy = legacy_sect
+
+    [default_sect]
+    activate = 1
+
+    [legacy_sect]
+    activate = 1
+  '';
 in
 stdenv.mkDerivation rec {
   pname = "evil-winrm";
-  version = "3.5";
+  version = "3.7";
 
   src = fetchFromGitHub {
     owner = "Hackplayers";
     repo = "evil-winrm";
     tag = "v${version}";
-    hash = "sha256-8Lyo7BgypzrHMEcbYlxo/XWwOtBqs2tczYnc3+XEbeA=";
+    hash = "sha256-jr8glS732UvSt+qFkhhLFZUB7OIRpRj3SzXm6mVikrE=";
   };
 
   nativeBuildInputs = [
@@ -38,6 +57,12 @@ stdenv.mkDerivation rec {
     cp evil-winrm.rb $out/bin/evil-winrm
   '';
 
+  postFixup = lib.optionalString sslLegacyProvider ''
+    wrapProgram $out/bin/evil-winrm \
+      --prefix OPENSSL_CONF : "${openssl_conf}" \
+      --prefix LD_LIBRARY_PATH : ${krb5.lib}/lib
+  '';
+
   passthru.updateScript = bundlerUpdateScript "evil-winrm";
 
   meta = {
diff --git a/pkgs/by-name/fo/fortitude/package.nix b/pkgs/by-name/fo/fortitude/package.nix
new file mode 100644
index 000000000000..216151c00df0
--- /dev/null
+++ b/pkgs/by-name/fo/fortitude/package.nix
@@ -0,0 +1,30 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "fortitude";
+  version = "0.7.5-unstable-2025-10-14";
+
+  src = fetchFromGitHub {
+    owner = "PlasmaFAIR";
+    repo = "fortitude";
+    rev = "ca65546d69947500eeb37a2bbc58151012ab40d9";
+    hash = "sha256-PKOPQnVQbvqEoCPO9K3ofajbcId83uLbma6R9RiBzys=";
+  };
+
+  cargoHash = "sha256-hNAONXSy1uxm7AHvMHWNboL9NpQfvEOfTQivushp7S4=";
+
+  meta = {
+    description = "Fortran linter written in Rust inspired by Ruff";
+    homepage = "https://fortitude.readthedocs.io/en/stable/";
+    downloadPage = "https://github.com/PlasmaFAIR/fortitude";
+    changelog = "https://github.com/PlasmaFAIR/fortitude/blob/main/CHANGELOG.md";
+    license = lib.licenses.mit;
+    mainProgram = "fortitude";
+    maintainers = with lib.maintainers; [ loicreynier ];
+    platforms = with lib.platforms; windows ++ darwin ++ linux;
+  };
+}
diff --git a/pkgs/by-name/li/limesurvey/package.nix b/pkgs/by-name/li/limesurvey/package.nix
index 5fad276e4eda..a56fc5bf834e 100644
--- a/pkgs/by-name/li/limesurvey/package.nix
+++ b/pkgs/by-name/li/limesurvey/package.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   writeText,
   nixosTests,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation rec {
@@ -33,8 +34,9 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  passthru.tests = {
-    smoke-test = nixosTests.limesurvey;
+  passthru = {
+    tests = { inherit (nixosTests) limesurvey; };
+    updateScript = nix-update-script { };
   };
 
   meta = with lib; {
diff --git a/pkgs/by-name/ll/llama-swap/package.nix b/pkgs/by-name/ll/llama-swap/package.nix
index 8361419894df..18f8c1ea75dd 100644
--- a/pkgs/by-name/ll/llama-swap/package.nix
+++ b/pkgs/by-name/ll/llama-swap/package.nix
@@ -16,13 +16,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "llama-swap";
-  version = "156";
+  version = "165";
 
   src = fetchFromGitHub {
     owner = "mostlygeek";
     repo = "llama-swap";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-z0262afVjsdGe6WPoWO1wbccLO538fXBuxOOqLnJHRU=";
+    hash = "sha256-3NlA4LnAJ1qCy1+Jcv6wrPg/7trQhpwx00Sk98V7ZdY=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -38,12 +38,15 @@ buildGoModule (finalAttrs: {
   vendorHash = "sha256-5mmciFAGe8ZEIQvXejhYN+ocJL3wOVwevIieDuokhGU=";
 
   passthru.ui = callPackage ./ui.nix { llama-swap = finalAttrs.finalPackage; };
-  passthru.npmDepsHash = "sha256-Sbvz3oudMVf+PxOJ6s7LsDaxFwvftNc8ZW5KPpbI/cA=";
+  passthru.npmDepsHash = "sha256-F6izMZY4554M6PqPYjKcjNol3A6BZHHYA0CIcNrU5JA=";
 
   nativeBuildInputs = [
     versionCheckHook
   ];
 
+  # required for testing
+  __darwinAllowLocalNetworking = true;
+
   ldflags = [
     "-s"
     "-w"
@@ -71,6 +74,29 @@ buildGoModule (finalAttrs: {
     "misc/simple-responder"
   ];
 
+  checkFlags =
+    let
+      skippedTests = lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [
+        # Fail only on x86_64-darwin intermittently
+        # https://github.com/mostlygeek/llama-swap/issues/320
+        "TestProcess_AutomaticallyStartsUpstream"
+        "TestProcess_WaitOnMultipleStarts"
+        "TestProcess_BrokenModelConfig"
+        "TestProcess_UnloadAfterTTL"
+        "TestProcess_LowTTLValue"
+        "TestProcess_HTTPRequestsHaveTimeToFinish"
+        "TestProcess_SwapState"
+        "TestProcess_ShutdownInterruptsHealthCheck"
+        "TestProcess_ExitInterruptsHealthCheck"
+        "TestProcess_ConcurrencyLimit"
+        "TestProcess_StopImmediately"
+        "TestProcess_ForceStopWithKill"
+        "TestProcess_StopCmd"
+        "TestProcess_EnvironmentSetCorrectly"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+
   # some tests expect to execute `simple-something` and proxy/helpers_test.go
   # checks the file exists
   doCheck = canExecute;
diff --git a/pkgs/by-name/ma/mark/package.nix b/pkgs/by-name/ma/mark/package.nix
index c71ff3bda690..3ed2f30bf763 100644
--- a/pkgs/by-name/ma/mark/package.nix
+++ b/pkgs/by-name/ma/mark/package.nix
@@ -8,16 +8,16 @@
 # https://github.com/kovetskiy/mark/pull/581#issuecomment-2797872996
 buildGoModule rec {
   pname = "mark";
-  version = "14.1.1";
+  version = "15.0.0";
 
   src = fetchFromGitHub {
     owner = "kovetskiy";
     repo = "mark";
-    rev = "${version}";
-    sha256 = "sha256-jKc5QugqfdjSQjK7SbLG02a9+YdFcweS+91LhdR0Dzg=";
+    rev = "v${version}";
+    sha256 = "sha256-OYLL96xvyrsnfIc0h+kQhZeW1ImyO7IG2ybD2SMBn/U=";
   };
 
-  vendorHash = "sha256-AHtIVp2n5v4YoYfWAsE7eD1QcEFKdjSqzGIlR7+mnxg=";
+  vendorHash = "sha256-y7MDgCYOvrFF4IMy8zpWXqyaOel1Xjei7h2OkiE6r+g=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/mu/mujoco/package.nix b/pkgs/by-name/mu/mujoco/package.nix
index 3acbbe9e1fc2..709d6ee9dd74 100644
--- a/pkgs/by-name/mu/mujoco/package.nix
+++ b/pkgs/by-name/mu/mujoco/package.nix
@@ -18,14 +18,14 @@ let
     abseil-cpp = fetchFromGitHub {
       owner = "abseil";
       repo = "abseil-cpp";
-      rev = "987c57f325f7fa8472fa84e1f885f7534d391b0d";
-      hash = "sha256-6Ro7miql9+wcArsOKTjlyDSyD91rmmPsIfO5auk9kiI=";
+      rev = "d38452e1ee03523a208362186fd42248ff2609f6";
+      hash = "sha256-SCQDORhmJmTb0CYm15zjEa7dkwc+lpW2s1d4DsMRovI=";
     };
     benchmark = fetchFromGitHub {
       owner = "google";
       repo = "benchmark";
-      rev = "049f6e79cc3e8636cec21bbd94ed185b4a5f2653";
-      hash = "sha256-VmSKKCsBvmvXSnFbw6GJRgiGjlne8rw22+RCLBV/kD4=";
+      rev = "5f7d66929fb66869d96dfcbacf0d8a586b33766d";
+      hash = "sha256-G9jMWq8BxKvRGP4D2/tcogdLwmek4XGYESqepnZIlCw=";
     };
     ccd = fetchFromGitHub {
       owner = "danfis";
@@ -36,8 +36,8 @@ let
     eigen3 = fetchFromGitLab {
       owner = "libeigen";
       repo = "eigen";
-      rev = "4be7e6b4e0a82853e853c0c7c4ef72f395e1f497";
-      hash = "sha256-SOTQ9j8YCsEuxNULsulQ0bmtxOZJKF7zc4GZOQlrmdo=";
+      rev = "4033cfcc1dd45b3cdf7285afd93556f2cfbe9425";
+      hash = "sha256-E1jfbHldIQOwonHvMn0feQiLI9zq3zB8Q9a0ufw1HuY=";
     };
     googletest = fetchFromGitHub {
       owner = "google";
@@ -86,7 +86,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mujoco";
-  version = "3.3.6";
+  version = "3.3.7";
 
   # Bumping version? Make sure to look though the MuJoCo's commit
   # history for bumped dependency pins!
@@ -94,7 +94,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "google-deepmind";
     repo = "mujoco";
     tag = finalAttrs.version;
-    hash = "sha256-6lZ36XFMsjzck/ouSSiX47+dxbEzXgrMhw1Mi3PEnq4=";
+    hash = "sha256-qetgQDgXtaDAuAo/PakZJEsevnvZFJB5EYXPMWeaEqo=";
   };
 
   patches = [ ./mujoco-system-deps-dont-fetch.patch ];
@@ -127,7 +127,10 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s ${pin.qhull} build/_deps/qhull-src
     ln -s ${pin.tinyobjloader} build/_deps/tinyobjloader-src
     ln -s ${pin.tinyxml2} build/_deps/tinyxml2-src
-    ln -s ${pin.trianglemeshdistance} build/_deps/trianglemeshdistance-src
+  ''
+  # Mujoco's cmake apply a patch on the trianglemeshdistance source code. Requires write permission.
+  + ''
+    cp -r ${pin.trianglemeshdistance} build/_deps/trianglemeshdistance-src
     ln -s ${pin.marchingcubecpp} build/_deps/marchingcubecpp-src
   '';
 
diff --git a/pkgs/by-name/rc/rclip/package.nix b/pkgs/by-name/rc/rclip/package.nix
index ecb9e22f09d8..9495eb01fea6 100644
--- a/pkgs/by-name/rc/rclip/package.nix
+++ b/pkgs/by-name/rc/rclip/package.nix
@@ -6,14 +6,14 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "rclip";
-  version = "2.0.8";
+  version = "2.0.11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "yurijmikhalevich";
     repo = "rclip";
     tag = "v${version}";
-    hash = "sha256-ScNyy5qWDskKgqxjfRU7y8WBCdThXTjlE3x0oIa8fhU=";
+    hash = "sha256-TXJpaMCSKCeOiWPVb9//czux+JV8VlJsiWH8fUb1tkw=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/re/redict/package.nix b/pkgs/by-name/re/redict/package.nix
index 636fe7882489..633130d51f2a 100644
--- a/pkgs/by-name/re/redict/package.nix
+++ b/pkgs/by-name/re/redict/package.nix
@@ -24,14 +24,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "redict";
-  version = "7.3.2";
+  version = "7.3.6";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "redict";
     repo = "redict";
-    rev = finalAttrs.version;
-    hash = "sha256-MY4OWoYQ4a5efqcUTN6lNL/kd1VrJ/OBqKw27cQ5WC8=";
+    tag = finalAttrs.version;
+    hash = "sha256-ye2uO6EQzfyonRvM0/+pVPoNZe2f9WO/2yafy52G10M=";
   };
 
   patches = lib.optionals useSystemJemalloc [
@@ -99,7 +99,8 @@ stdenv.mkDerivation (finalAttrs: {
       --timeout 2000 \
       --clients $NIX_BUILD_CORES \
       --tags -leaks \
-      --skipunit integration/failover # flaky and slow
+      --skipunit integration/failover \
+      --skipunit integration/aof-multi-part
 
     runHook postCheck
   '';
diff --git a/pkgs/by-name/re/restic-browser/package.nix b/pkgs/by-name/re/restic-browser/package.nix
index 3a94a4936704..3a4d48430c47 100644
--- a/pkgs/by-name/re/restic-browser/package.nix
+++ b/pkgs/by-name/re/restic-browser/package.nix
@@ -4,36 +4,37 @@
   rustPlatform,
   fetchFromGitHub,
   fetchNpmDeps,
-  cargo-tauri_1,
+  cargo-tauri,
   nodejs,
   npmHooks,
   pkg-config,
   wrapGAppsHook3,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   dbus,
   nix-update-script,
+  restic,
 }:
 rustPlatform.buildRustPackage rec {
   pname = "restic-browser";
-  version = "0.3.2";
+  version = "0.3.3";
 
   src = fetchFromGitHub {
     owner = "emuell";
     repo = "restic-browser";
     rev = "v${version}";
-    hash = "sha256-magf19hA5PVAZafRcQXFaAD50qGofztpiluVc2aCeOk=";
+    hash = "sha256-K8JEt1kOvu/G3S1O6W/ee2JM968bgPR/FeGaBKP6elU=";
   };
 
-  cargoHash = "sha256-5wSxa8jgto+v+tJHbenc2nvGlLaOBYyRrCqFyCPnncc=";
+  cargoHash = "sha256-/EgSr46mJV84s/MG/3nUnU6XQ8RtEWiWo0gFtegblEQ=";
 
   npmDeps = fetchNpmDeps {
     name = "${pname}-npm-deps-${version}";
     inherit src;
-    hash = "sha256-U82hVPfVd12vBeDT3PHexwmc9OitkuxTugYRe4Z/3eo=";
+    hash = "sha256-uyn5cXMKm7+LLuF+n94pBTypLiPvfAs5INDEtd9cHs0=";
   };
 
   nativeBuildInputs = [
-    cargo-tauri_1.hook
+    cargo-tauri.hook
 
     nodejs
     npmHooks.npmConfigHook
@@ -44,8 +45,9 @@ rustPlatform.buildRustPackage rec {
   ];
 
   buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
-    webkitgtk_4_0
+    webkitgtk_4_1
     dbus
+    restic
   ];
 
   cargoRoot = "src-tauri";
diff --git a/pkgs/by-name/yt/yt-dlp/package.nix b/pkgs/by-name/yt/yt-dlp/package.nix
index b6f1857ec672..ae0b2733f6b9 100644
--- a/pkgs/by-name/yt/yt-dlp/package.nix
+++ b/pkgs/by-name/yt/yt-dlp/package.nix
@@ -19,14 +19,14 @@ python3Packages.buildPythonApplication rec {
   # The websites yt-dlp deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2025.09.26";
+  version = "2025.10.14";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "yt-dlp";
     repo = "yt-dlp";
     tag = version;
-    hash = "sha256-/uzs87Vw+aDNfIJVLOx3C8RyZvWLqjggmnjrOvUX1Eg=";
+    hash = "sha256-x7vpuXUihlC4jONwjmWnPECFZ7xiVAOFSDUgBNvl+aA=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/compilers/ocaml/4.00.1.nix b/pkgs/development/compilers/ocaml/4.00.1.nix
deleted file mode 100644
index e6b80294592f..000000000000
--- a/pkgs/development/compilers/ocaml/4.00.1.nix
+++ /dev/null
@@ -1,99 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  fetchpatch,
-  ncurses,
-  libX11,
-}:
-
-let
-  useX11 = !stdenv.hostPlatform.isAarch32 && !stdenv.hostPlatform.isMips;
-  useNativeCompilers = !stdenv.hostPlatform.isMips;
-  inherit (lib) optional optionals optionalString;
-in
-
-stdenv.mkDerivation rec {
-  pname = "ocaml";
-  version = "4.00.1";
-
-  src = fetchurl {
-    url = "https://caml.inria.fr/pub/distrib/ocaml-4.00/${pname}-${version}.tar.bz2";
-    sha256 = "33c3f4acff51685f5bfd7c260f066645e767d4e865877bf1613c176a77799951";
-  };
-
-  # Compatibility with Glibc 2.34
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/ocaml/ocaml/commit/60b0cdaf2519d881947af4175ac4c6ff68901be3.patch";
-      sha256 = "sha256:07g9q9sjk4xsbqix7jxggfp36v15pmqw4bms80g5car0hfbszirn";
-    })
-  ];
-
-  # Workaround build failure on -fno-common toolchains like upstream
-  # gcc-10. Otherwise build fails as:
-  #   ld: libcamlrun.a(startup.o):(.bss+0x800): multiple definition of
-  #     `caml_code_fragments_table'; libcamlrun.a(backtrace.o):(.bss+0x20): first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
-
-  prefixKey = "-prefix ";
-  configureFlags = [
-    "-no-tk"
-  ]
-  ++ optionals useX11 [
-    "-x11lib"
-    libX11
-  ];
-  buildFlags = [
-    "world"
-  ]
-  ++ optionals useNativeCompilers [
-    "bootstrap"
-    "world.opt"
-  ];
-  buildInputs = [ ncurses ] ++ optionals useX11 [ libX11 ];
-  installTargets = "install" + optionalString useNativeCompilers " installopt";
-  preConfigure = ''
-    CAT=$(type -tp cat)
-    sed -e "s@/bin/cat@$CAT@" -i config/auto-aux/sharpbang
-  '';
-  postBuild = ''
-    mkdir -p $out/include
-    ln -sv $out/lib/ocaml/caml $out/include/caml
-  '';
-
-  passthru = {
-    nativeCompilers = useNativeCompilers;
-  };
-
-  meta = with lib; {
-    homepage = "http://caml.inria.fr/ocaml";
-    branch = "4.00";
-    license = with licenses; [
-      qpl # compiler
-      lgpl2 # library
-    ];
-    description = "Most popular variant of the Caml language";
-
-    longDescription = ''
-      OCaml is the most popular variant of the Caml language.  From a
-      language standpoint, it extends the core Caml language with a
-      fully-fledged object-oriented layer, as well as a powerful module
-      system, all connected by a sound, polymorphic type system featuring
-      type inference.
-
-      The OCaml system is an industrial-strength implementation of this
-      language, featuring a high-performance native-code compiler (ocamlopt)
-      for 9 processor architectures (IA32, PowerPC, AMD64, Alpha, Sparc,
-      Mips, IA64, HPPA, StrongArm), as well as a bytecode compiler (ocamlc)
-      and an interactive read-eval-print loop (ocaml) for quick development
-      and portability.  The OCaml distribution includes a comprehensive
-      standard library, a replay debugger (ocamldebug), lexer (ocamllex) and
-      parser (ocamlyacc) generators, a pre-processor pretty-printer (camlp4)
-      and a documentation generator (ocamldoc).
-    '';
-
-    platforms = with platforms; linux;
-  };
-
-}
diff --git a/pkgs/development/compilers/ocaml/4.01.0.nix b/pkgs/development/compilers/ocaml/4.01.0.nix
deleted file mode 100644
index 55347bb3a20e..000000000000
--- a/pkgs/development/compilers/ocaml/4.01.0.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-import ./generic.nix {
-  major_version = "4";
-  minor_version = "01";
-  patch_version = "0";
-  patches = [
-    ./fix-clang-build-on-osx.diff
-
-    # Compatibility with Glibc 2.34
-    {
-      url = "https://github.com/ocaml/ocaml/commit/d111407bf4ff71171598d30825c8e59ed5f75fd6.patch";
-      sha256 = "sha256:08mpy7lsiwv8m5qrqc4xzyiv2hri5713gz2qs1nfz02hz1bd79mc";
-    }
-  ];
-  sha256 = "03d7ida94s1gpr3gadf4jyhmh5rrszd5s4m4z59daaib25rvfyv7";
-
-  # Workaround build failure on -fno-common toolchains like upstream
-  # gcc-10. Otherwise build fails as:
-  #   ld: libcamlrun.a(startup.o):(.bss+0x800): multiple definition of
-  #     `caml_code_fragments_table'; libcamlrun.a(backtrace.o):(.bss+0x20): first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
-}
diff --git a/pkgs/development/compilers/ocaml/4.02.nix b/pkgs/development/compilers/ocaml/4.02.nix
deleted file mode 100644
index 0d54d0aaae96..000000000000
--- a/pkgs/development/compilers/ocaml/4.02.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-import ./generic.nix {
-  major_version = "4";
-  minor_version = "02";
-  patch_version = "3";
-  patches = [
-    ./ocamlbuild.patch
-
-    # Compatibility with Glibc 2.34
-    {
-      url = "https://github.com/ocaml/ocaml/commit/9de2b77472aee18a94b41cff70caee27fb901225.patch";
-      sha256 = "sha256:12sw512kpwk0xf2g6j0h5vqgd8xcmgrvgyilx6fxbd6bnfv1yib9";
-    }
-    # Compatibility with Binutils 2.29
-    {
-      url = "https://github.com/ocaml/ocaml/commit/bcc7a767279ff70518b3f4219cc0b9bffec7dd43.patch";
-      sha256 = "sha256-z3xrqN6bh/EW9dkPg6Hz8mT79DFm26yGRoPbE+RMYi0=";
-    }
-  ];
-  sha256 = "1qwwvy8nzd87hk8rd9sm667nppakiapnx4ypdwcrlnav2dz6kil3";
-
-  # Workaround build failure on -fno-common toolchains like upstream
-  # gcc-10. Otherwise build fails as:
-  #   ld: libcamlrun.a(startup.o):(.bss+0x800): multiple definition of
-  #     `caml_code_fragments_table'; libcamlrun.a(backtrace.o):(.bss+0x20): first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
-}
diff --git a/pkgs/development/compilers/ocaml/4.03.nix b/pkgs/development/compilers/ocaml/4.03.nix
deleted file mode 100644
index 58dec68b892d..000000000000
--- a/pkgs/development/compilers/ocaml/4.03.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-import ./generic.nix {
-  major_version = "4";
-  minor_version = "03";
-  patch_version = "0";
-  sha256 = "09p3iwwi55r6rbrpyp8f0wmkb0ppcgw67yxw6yfky60524wayp39";
-
-  patches = [
-    # Compatibility with Glibc 2.34
-    {
-      url = "https://github.com/ocaml/ocaml/commit/a8b2cc3b40f5269ce8525164ec2a63b35722b22b.patch";
-      sha256 = "sha256:1rrknmrk86xrj2k3hznnjk1gwnliyqh125zabg1hvy6dlvml9b0x";
-    }
-    # Compatibility with Binutils 2.29
-    {
-      url = "https://github.com/ocaml/ocaml/commit/c204f07bfb20174f9e1c9ff586fb7b2f42b8bf18.patch";
-      sha256 = "sha256-AAXyMZ7ujO67SGz+tGXKZkVcINAwvccHlFHmKnUt848=";
-    }
-  ];
-
-  # Workaround build failure on -fno-common toolchains like upstream
-  # gcc-10. Otherwise build fails as:
-  #   ld: libcamlrun.a(startup.o):(.bss+0x800): multiple definition of
-  #     `caml_code_fragments_table'; libcamlrun.a(backtrace.o):(.bss+0x20): first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
-}
diff --git a/pkgs/development/compilers/ocaml/4.04.nix b/pkgs/development/compilers/ocaml/4.04.nix
deleted file mode 100644
index 030d7c36c6f4..000000000000
--- a/pkgs/development/compilers/ocaml/4.04.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-import ./generic.nix {
-  major_version = "4";
-  minor_version = "04";
-  patch_version = "2";
-  sha256 = "0bhgjzi78l10824qga85nlh18jg9lb6aiamf9dah1cs6jhzfsn6i";
-
-  # If the executable is stripped it does not work
-  dontStrip = true;
-
-  patches = [
-    # Compatibility with Glibc 2.34
-    {
-      url = "https://github.com/ocaml/ocaml/commit/6bcff7e6ce1a43e088469278eb3a9341e6a2ca5b.patch";
-      sha256 = "sha256:1hd45f7mwwrrym2y4dbcwklpv0g94avbz7qrn81l7w8mrrj3bngi";
-    }
-    # Compatibility with Binutils 2.29
-    {
-      url = "https://github.com/ocaml/ocaml/commit/db11f141a0e35c7fbaec419a33c4c39d199e2635.patch";
-      sha256 = "sha256-oIwmbXOCzDGyASpbQ7hd7SCs4YHjd9hBBksJ74V3GiY=";
-    }
-  ];
-
-  # Workaround build failure on -fno-common toolchains like upstream
-  # gcc-10. Otherwise build fails as:
-  #   ld: libcamlrun.a(startup.o):(.bss+0x800): multiple definition of
-  #     `caml_code_fragments_table'; libcamlrun.a(backtrace.o):(.bss+0x20): first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
-}
diff --git a/pkgs/development/compilers/ocaml/4.05.nix b/pkgs/development/compilers/ocaml/4.05.nix
deleted file mode 100644
index 7a6aef47d22c..000000000000
--- a/pkgs/development/compilers/ocaml/4.05.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-import ./generic.nix {
-  major_version = "4";
-  minor_version = "05";
-  patch_version = "0";
-  sha256 = "1y9fw1ci9pwnbbrr9nwr8cq8vypcxwdf4akvxard3mxl2jx2g984";
-
-  # If the executable is stipped it does not work
-  dontStrip = true;
-
-  patches = [
-    # Compatibility with Glibc 2.34
-    {
-      url = "https://github.com/ocaml/ocaml/commit/50c2d1275e537906ea144bd557fde31e0bf16e5f.patch";
-      sha256 = "sha256:0ck9b2dpgg5k2p9ndbgniql24h35pn1bbpxjvk69j715lswzy4mh";
-    }
-    # Compatibility with Binutils 2.29
-    {
-      url = "https://github.com/ocaml/ocaml/commit/b00000c6679804731692362b0baac27fa3fddfd5.patch";
-      sha256 = "sha256-CuEXGK3EsOevyUrc9TmSZo9DVBwjunQX7mKnDVHFpkY=";
-    }
-  ];
-
-  # Workaround build failure on -fno-common toolchains like upstream
-  # gcc-10. Otherwise build fails as:
-  #   ld: libcamlrun.a(startup.o):(.bss+0x800): multiple definition of
-  #     `caml_code_fragments_table'; libcamlrun.a(backtrace.o):(.bss+0x20): first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
-}
diff --git a/pkgs/development/compilers/ocaml/4.06.nix b/pkgs/development/compilers/ocaml/4.06.nix
deleted file mode 100644
index e14ef4e16807..000000000000
--- a/pkgs/development/compilers/ocaml/4.06.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-import ./generic.nix {
-  major_version = "4";
-  minor_version = "06";
-  patch_version = "1";
-  sha256 = "1n3pygfssd6nkrq876wszm5nm3v4605q4k16a66h1nmq9wvf01vg";
-
-  # If the executable is stripped it does not work
-  dontStrip = true;
-
-  patches = [
-    # Compatibility with Glibc 2.34
-    {
-      url = "https://github.com/ocaml/ocaml/commit/137a4ad167f25fe1bee792977ed89f30d19bcd74.patch";
-      sha256 = "sha256:0izsf6rm3677vbbx0snkmn9pkfcsayrdwz3ipiml5wjiaysnchjz";
-    }
-  ];
-
-  # Workaround build failure on -fno-common toolchains like upstream
-  # gcc-10. Otherwise build fails as:
-  #   ld: libcamlrun.a(startup.o):(.bss+0x800): multiple definition of
-  #     `caml_code_fragments_table'; libcamlrun.a(backtrace.o):(.bss+0x20): first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
-}
diff --git a/pkgs/development/compilers/ocaml/4.07.nix b/pkgs/development/compilers/ocaml/4.07.nix
deleted file mode 100644
index d6b91add256d..000000000000
--- a/pkgs/development/compilers/ocaml/4.07.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-import ./generic.nix {
-  major_version = "4";
-  minor_version = "07";
-  patch_version = "1";
-  sha256 = "1f07hgj5k45cylj1q3k5mk8yi02cwzx849b1fwnwia8xlcfqpr6z";
-
-  # If the executable is stripped it does not work
-  dontStrip = true;
-
-  patches = [
-    # Compatibility with Glibc 2.34
-    {
-      url = "https://github.com/ocaml/ocaml/commit/00b8c4d503732343d5d01761ad09650fe50ff3a0.patch";
-      sha256 = "sha256:02cfya5ff5szx0fsl5x8ax76jyrla9zmf3qxavf3adhwq5ssrfcv";
-    }
-  ];
-
-  # Workaround build failure on -fno-common toolchains like upstream
-  # gcc-10. Otherwise build fails as:
-  #   ld: libcamlrun.a(startup.o):(.bss+0x800): multiple definition of
-  #     `caml_code_fragments_table'; libcamlrun.a(backtrace.o):(.bss+0x20): first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
-}
diff --git a/pkgs/development/compilers/ocaml/4.08.nix b/pkgs/development/compilers/ocaml/4.08.nix
deleted file mode 100644
index a163955a6148..000000000000
--- a/pkgs/development/compilers/ocaml/4.08.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-import ./generic.nix {
-  major_version = "4";
-  minor_version = "08";
-  patch_version = "1";
-  sha256 = "18sycl3zmgb8ghpxymriy5d72gvw7m5ra65v51hcrmzzac21hkyd";
-
-  # If the executable is stripped it does not work
-  dontStrip = true;
-
-  # Breaks build with Clang
-  hardeningDisable = [ "strictoverflow" ];
-
-  patches = [
-    # Compatibility with Glibc 2.34
-    {
-      url = "https://github.com/ocaml/ocaml/commit/17df117b4939486d3285031900587afce5262c8c.patch";
-      sha256 = "sha256:1b3jc6sj2k23yvfwrv6nc1f4x2n2biqbhbbp74aqb6iyqyjsq35n";
-    }
-  ];
-
-  # Workaround build failure on -fno-common toolchains like upstream
-  # gcc-10. Otherwise build fails as:
-  #   ld: libcamlrun.a(startup.o):(.bss+0x800): multiple definition of
-  #     `caml_code_fragments_table'; libcamlrun.a(backtrace.o):(.bss+0x20): first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
-}
diff --git a/pkgs/development/compilers/ocaml/fix-clang-build-on-osx.diff b/pkgs/development/compilers/ocaml/fix-clang-build-on-osx.diff
deleted file mode 100644
index d7d9c863858f..000000000000
--- a/pkgs/development/compilers/ocaml/fix-clang-build-on-osx.diff
+++ /dev/null
@@ -1,20 +0,0 @@
-diff --git a/configure b/configure
-index d45e88f..25d872b 100755
---- a/configure
-+++ b/configure
-@@ -322,7 +322,14 @@ case "$bytecc,$target" in
-     bytecccompopts="-fno-defer-pop $gcc_warnings -DSHRINKED_GNUC"
-     mathlib="";;
-   *,*-*-darwin*)
--    bytecccompopts="-fno-defer-pop $gcc_warnings"
-+    # On recent version of OSX, gcc is a symlink to clang
-+    if $bytecc --version | grep -q clang; then
-+        # -fno-defer-pop is not supported by clang, and make recent
-+        # versions of clang to fail
-+        bytecccompopts="$gcc_warnings"
-+    else
-+        bytecccompopts="-fno-defer-pop $gcc_warnings"
-+    fi
-     mathlib=""
-     mkexe="$mkexe -Wl,-no_compact_unwind"
-     # Tell gcc that we can use 32-bit code addresses for threaded code
diff --git a/pkgs/development/compilers/ocaml/ocamlbuild.patch b/pkgs/development/compilers/ocaml/ocamlbuild.patch
deleted file mode 100644
index d153fb67d419..000000000000
--- a/pkgs/development/compilers/ocaml/ocamlbuild.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-Author: Vincent Laporte <Vincent.Laporte@gmail.com>
-Date:   Sun Feb 1 11:19:50 2015 +0100
-
-    ocamlbuild: use ocamlfind to discover camlp4 path
-    
-    and default to `+camlp4`
-
-diff --git a/ocamlbuild/ocaml_specific.ml b/ocamlbuild/ocaml_specific.ml
-index b902810..a73b7a5 100644
---- a/ocamlbuild/ocaml_specific.ml
-+++ b/ocamlbuild/ocaml_specific.ml
-@@ -698,15 +698,25 @@ ocaml_lib ~extern:true ~tag_name:"use_toplevel" "toplevellib";;
- ocaml_lib ~extern:true ~dir:"+ocamldoc" "ocamldoc";;
- ocaml_lib ~extern:true ~dir:"+ocamlbuild" ~tag_name:"use_ocamlbuild" "ocamlbuildlib";;
- 
--ocaml_lib ~extern:true ~dir:"+camlp4" ~tag_name:"use_camlp4" "camlp4lib";;
--ocaml_lib ~extern:true ~dir:"+camlp4" ~tag_name:"use_old_camlp4" "camlp4";;
--ocaml_lib ~extern:true ~dir:"+camlp4" ~tag_name:"use_camlp4_full" "camlp4fulllib";;
-+let camlp4dir =
-+  Findlib.(
-+    try
-+      if sys_command "sh -c 'ocamlfind list >/dev/null' 2>/dev/null" != 0
-+      then raise (Findlib_error Cannot_run_ocamlfind);
-+      (query "camlp4").location
-+    with Findlib_error _ ->
-+      "+camlp4"
-+  );;
-+
-+ocaml_lib ~extern:true ~dir:camlp4dir ~tag_name:"use_camlp4" "camlp4lib";;
-+ocaml_lib ~extern:true ~dir:camlp4dir ~tag_name:"use_old_camlp4" "camlp4";;
-+ocaml_lib ~extern:true ~dir:camlp4dir ~tag_name:"use_camlp4_full" "camlp4fulllib";;
- flag ["ocaml"; "compile"; "use_camlp4_full"]
--     (S[A"-I"; A"+camlp4/Camlp4Parsers";
--        A"-I"; A"+camlp4/Camlp4Printers";
--        A"-I"; A"+camlp4/Camlp4Filters"]);;
--flag ["ocaml"; "use_camlp4_bin"; "link"; "byte"] (A"+camlp4/Camlp4Bin.cmo");;
--flag ["ocaml"; "use_camlp4_bin"; "link"; "native"] (A"+camlp4/Camlp4Bin.cmx");;
-+     (S[A"-I"; A(camlp4dir^"/Camlp4Parsers");
-+        A"-I"; A(camlp4dir^"/Camlp4Printers");
-+        A"-I"; A(camlp4dir^"/Camlp4Filters")]);;
-+flag ["ocaml"; "use_camlp4_bin"; "link"; "byte"] (A(camlp4dir^"/Camlp4Bin.cmo"));;
-+flag ["ocaml"; "use_camlp4_bin"; "link"; "native"] (A(camlp4dir^"/Camlp4Bin.cmx"));;
- 
- flag ["ocaml"; "debug"; "compile"; "byte"] (A "-g");;
- flag ["ocaml"; "debug"; "link"; "byte"; "program"] (A "-g");;
diff --git a/pkgs/development/interpreters/python/cpython/3.15/no-ldconfig.patch b/pkgs/development/interpreters/python/cpython/3.15/no-ldconfig.patch
new file mode 100644
index 000000000000..d7e148b510d9
--- /dev/null
+++ b/pkgs/development/interpreters/python/cpython/3.15/no-ldconfig.patch
@@ -0,0 +1,40 @@
+diff --git a/Lib/ctypes/util.py b/Lib/ctypes/util.py
+index 378f12167c6..21710702e69 100644
+--- a/Lib/ctypes/util.py
++++ b/Lib/ctypes/util.py
+@@ -374,34 +374,7 @@ def find_library(name, is64 = False):
+     else:
+ 
+         def _findSoname_ldconfig(name):
+-            import struct
+-            if struct.calcsize('l') == 4:
+-                machine = os.uname().machine + '-32'
+-            else:
+-                machine = os.uname().machine + '-64'
+-            mach_map = {
+-                'x86_64-64': 'libc6,x86-64',
+-                'ppc64-64': 'libc6,64bit',
+-                'sparc64-64': 'libc6,64bit',
+-                's390x-64': 'libc6,64bit',
+-                'ia64-64': 'libc6,IA-64',
+-                }
+-            abi_type = mach_map.get(machine, 'libc6')
+-
+-            # XXX assuming GLIBC's ldconfig (with option -p)
+-            regex = r'\s+(lib%s\.[^\s]+)\s+\(%s'
+-            regex = os.fsencode(regex % (re.escape(name), abi_type))
+-            try:
+-                with subprocess.Popen(['/sbin/ldconfig', '-p'],
+-                                      stdin=subprocess.DEVNULL,
+-                                      stderr=subprocess.DEVNULL,
+-                                      stdout=subprocess.PIPE,
+-                                      env={'LC_ALL': 'C', 'LANG': 'C'}) as p:
+-                    res = re.search(regex, p.stdout.read())
+-                    if res:
+-                        return os.fsdecode(res.group(1))
+-            except OSError:
+-                pass
++            return None
+ 
+         def _findLib_ld(name):
+             # See issue #9998 for why this is needed
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 4bd13788e44f..a59a3cff42aa 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -97,6 +97,19 @@
       hash = "sha256-Ipna5ULTlc44g6ygDTyRAwfNaOCy9zNgmMjnt+7p8+k=";
       inherit passthruFun;
     };
+
+    python315 = callPackage ./cpython {
+      self = __splicedPackages.python315;
+      sourceVersion = {
+        major = "3";
+        minor = "15";
+        patch = "0";
+        suffix = "a1";
+      };
+      hash = "sha256-MZSTnUiO6u79z5kNNVQtmtHOeIeJxOIwWiBg63BY5aQ=";
+      inherit passthruFun;
+    };
+
     # Minimal versions of Python (built without optional dependencies)
     python3Minimal =
       (callPackage ./cpython (
diff --git a/pkgs/development/python-modules/ariadne/default.nix b/pkgs/development/python-modules/ariadne/default.nix
index b279311510ae..3ec6f131f8fd 100644
--- a/pkgs/development/python-modules/ariadne/default.nix
+++ b/pkgs/development/python-modules/ariadne/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "ariadne";
-  version = "0.26.2";
+  version = "0.27.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mirumee";
     repo = "ariadne";
     tag = version;
-    hash = "sha256-zkxRg11O/P7+qU+vdDG3i8Tpn6dXByaGLN9t+e2dhyE=";
+    hash = "sha256-y09w1y+NV2HX8cXGMqv6LvPqGXxFfoaz4DS+oH25dNg=";
   };
 
   patches = [ ./remove-opentracing.patch ];
diff --git a/pkgs/development/python-modules/fast-array-utils/default.nix b/pkgs/development/python-modules/fast-array-utils/default.nix
index 9d8fc827f752..2c6675ac026a 100644
--- a/pkgs/development/python-modules/fast-array-utils/default.nix
+++ b/pkgs/development/python-modules/fast-array-utils/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "fast-array-utils";
-  version = "1.2.3";
+  version = "1.2.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scverse";
     repo = "fast-array-utils";
     tag = "v${version}";
-    hash = "sha256-uvTViDaLey+jxWyic9m542Ip4x8cCfGaNUfYp8cQPXo=";
+    hash = "sha256-R8pOID9Lws29OCMWb7RZNDsWakEYDf7bya6iSXp8Ips=";
   };
 
   # hatch-min-requirements tries to talk to PyPI by default. See https://github.com/tlambert03/hatch-min-requirements?tab=readme-ov-file#environment-variables.
diff --git a/pkgs/development/python-modules/hawkmoth/default.nix b/pkgs/development/python-modules/hawkmoth/default.nix
index ff0d98f2334b..03520ea155a6 100644
--- a/pkgs/development/python-modules/hawkmoth/default.nix
+++ b/pkgs/development/python-modules/hawkmoth/default.nix
@@ -3,13 +3,18 @@
   buildPythonPackage,
   fetchFromGitHub,
   hatchling,
+  llvmPackages_20,
   libclang,
   sphinx,
-  clang,
   pytestCheckHook,
   strictyaml,
 }:
+let
+  libclang_20 = libclang.override {
+    llvmPackages = llvmPackages_20;
+  };
 
+in
 buildPythonPackage rec {
   pname = "hawkmoth";
   version = "0.21.0";
@@ -25,13 +30,13 @@ buildPythonPackage rec {
   build-system = [ hatchling ];
 
   dependencies = [
-    libclang
+    libclang_20
     sphinx
   ];
-  propagatedBuildInputs = [ clang ];
+  propagatedBuildInputs = [ llvmPackages_20.clang ];
 
   nativeCheckInputs = [
-    clang
+    llvmPackages_20.clang
     pytestCheckHook
     strictyaml
   ];
diff --git a/pkgs/development/python-modules/mujoco/default.nix b/pkgs/development/python-modules/mujoco/default.nix
index 91020733522d..69ccd0ec6a77 100644
--- a/pkgs/development/python-modules/mujoco/default.nix
+++ b/pkgs/development/python-modules/mujoco/default.nix
@@ -38,7 +38,7 @@ buildPythonPackage rec {
   # in the project's CI.
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Emv7DbRC62QHd23E+Yx8AilUlHkx4Dw5XsRfpYRj+14=";
+    hash = "sha256-lw28RAEzccLeZF+cN6m0Hxi0/DaK3IxfgFeYgSG+YQs=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/zulip/default.nix b/pkgs/development/python-modules/zulip/default.nix
index 54cd375944b8..358a8b9daeb1 100644
--- a/pkgs/development/python-modules/zulip/default.nix
+++ b/pkgs/development/python-modules/zulip/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   buildPythonPackage,
-  pythonOlder,
   fetchFromGitHub,
   setuptools,
   requests,
@@ -14,24 +13,20 @@
 
 buildPythonPackage rec {
   pname = "zulip";
-  version = "0.9.0";
-
-  disabled = pythonOlder "3.8";
-
+  version = "0.9.1";
   pyproject = true;
 
-  # no sdist on PyPI
   src = fetchFromGitHub {
     owner = "zulip";
     repo = "python-zulip-api";
-    rev = version;
-    hash = "sha256-YnNXduZ2KOjRHGwhojkqpMP2mwhflk8/f4FVZL8NvHU=";
+    tag = version;
+    hash = "sha256-mcqIfha+4nsqlshayLQ2Sd+XOYVKf1FkoczjiFRNybc=";
   };
   sourceRoot = "${src.name}/zulip";
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     requests
     distro
     click
@@ -46,10 +41,10 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "zulip" ];
 
-  meta = with lib; {
+  meta = {
     description = "Bindings for the Zulip message API";
     homepage = "https://github.com/zulip/python-zulip-api";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ dotlambda ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ dotlambda ];
   };
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index eba51249aa5e..f6a9f374dc97 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5944,6 +5944,11 @@ with pkgs;
     pythonAttr = "python314FreeThreading";
     enableGIL = false;
   };
+  python315FreeThreading = python315.override {
+    self = python315FreeThreading;
+    pythonAttr = "python315FreeThreading";
+    enableGIL = false;
+  };
 
   pythonInterpreters = callPackage ./../development/interpreters/python { };
   inherit (pythonInterpreters)
@@ -5953,6 +5958,7 @@ with pkgs;
     python312
     python313
     python314
+    python315
     python3Minimal
     pypy27
     pypy310
@@ -5969,6 +5975,7 @@ with pkgs;
   python312Packages = recurseIntoAttrs python312.pkgs;
   python313Packages = recurseIntoAttrs python313.pkgs;
   python314Packages = python314.pkgs;
+  python315Packages = python315.pkgs;
   pypyPackages = pypy.pkgs;
   pypy2Packages = pypy2.pkgs;
   pypy27Packages = pypy27.pkgs;
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 4cfb1604df2a..8b30769c3e46 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -2247,56 +2247,6 @@ in
 rec {
   inherit mkOcamlPackages;
 
-  ocamlPackages_4_00_1 = mkOcamlPackages (
-    callPackage ../development/compilers/ocaml/4.00.1.nix {
-      stdenv = pkgs.gcc13Stdenv;
-    }
-  );
-
-  ocamlPackages_4_01_0 = mkOcamlPackages (
-    callPackage ../development/compilers/ocaml/4.01.0.nix {
-      stdenv = pkgs.gcc13Stdenv;
-    }
-  );
-
-  ocamlPackages_4_02 = mkOcamlPackages (
-    callPackage ../development/compilers/ocaml/4.02.nix {
-      stdenv = pkgs.gcc13Stdenv;
-    }
-  );
-
-  ocamlPackages_4_03 = mkOcamlPackages (
-    callPackage ../development/compilers/ocaml/4.03.nix {
-      stdenv = pkgs.gcc13Stdenv;
-    }
-  );
-
-  ocamlPackages_4_04 = mkOcamlPackages (
-    callPackage ../development/compilers/ocaml/4.04.nix {
-      stdenv = pkgs.gcc13Stdenv;
-    }
-  );
-
-  ocamlPackages_4_05 = mkOcamlPackages (
-    callPackage ../development/compilers/ocaml/4.05.nix {
-      stdenv = pkgs.gcc13Stdenv;
-    }
-  );
-
-  ocamlPackages_4_06 = mkOcamlPackages (
-    callPackage ../development/compilers/ocaml/4.06.nix {
-      stdenv = pkgs.gcc13Stdenv;
-    }
-  );
-
-  ocamlPackages_4_07 = mkOcamlPackages (
-    callPackage ../development/compilers/ocaml/4.07.nix {
-      stdenv = pkgs.gcc13Stdenv;
-    }
-  );
-
-  ocamlPackages_4_08 = mkOcamlPackages (callPackage ../development/compilers/ocaml/4.08.nix { });
-
   ocamlPackages_4_09 = mkOcamlPackages (callPackage ../development/compilers/ocaml/4.09.nix { });
 
   ocamlPackages_4_10 = mkOcamlPackages (callPackage ../development/compilers/ocaml/4.10.nix { });
@@ -2331,3 +2281,22 @@ rec {
     }
   );
 }
+// lib.optionalAttrs config.allowAliases {
+  ocamlPackages_4_00_1 = throw "ocamlPackages_4_00_1 has been removed. Please use a newer version of OCaml.";
+
+  ocamlPackages_4_01_0 = throw "ocamlPackages_4_01_0 has been removed. Please use a newer version of OCaml.";
+
+  ocamlPackages_4_02 = throw "ocamlPackages_4_02 has been removed. Please use a newer version of OCaml.";
+
+  ocamlPackages_4_03 = throw "ocamlPackages_4_03 has been removed. Please use a newer version of OCaml.";
+
+  ocamlPackages_4_04 = throw "ocamlPackages_4_04 has been removed. Please use a newer version of OCaml.";
+
+  ocamlPackages_4_05 = throw "ocamlPackages_4_05 has been removed. Please use a newer version of OCaml.";
+
+  ocamlPackages_4_06 = throw "ocamlPackages_4_06 has been removed. Please use a newer version of OCaml.";
+
+  ocamlPackages_4_07 = throw "ocamlPackages_4_07 has been removed. Please use a newer version of OCaml.";
+
+  ocamlPackages_4_08 = throw "ocamlPackages_4_08 has been removed. Please use a newer version of OCaml.";
+}