diff --git a/lib/trivial.nix b/lib/trivial.nix
index 7dd908a7efcd..2987c734a2fe 100644
--- a/lib/trivial.nix
+++ b/lib/trivial.nix
@@ -1264,14 +1264,7 @@ in
     if match != null then
       (fromTOML "v=0x${builtins.elemAt match 1}").v
     else
-      # TODO: Turn this into a `throw` in 26.05.
-      assert lib.warn "fromHexString: ${
-        lib.generators.toPretty { } str
-      } is not a valid input and will be rejected in 26.05" true;
-      let
-        noPrefix = lib.strings.removePrefix "0x" (lib.strings.toLower str);
-      in
-      (fromTOML "v=0x${noPrefix}").v;
+      throw "fromHexString: ${lib.generators.toPretty { } str} is not a valid input";
 
   /**
     Convert the given positive integer to a string of its hexadecimal
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index efd49ce2910a..6d26cf7b7477 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -26194,6 +26194,12 @@
     githubId = 171470;
     name = "Sam Hug";
   };
+  samirbgno = {
+    email = "samirbgno@gmail.com";
+    github = "samirbgno";
+    githubId = 96266166;
+    name = "Samir Bugueño";
+  };
   SamirTalwar = {
     email = "lazy.git@functional.computer";
     github = "SamirTalwar";
diff --git a/nixos/modules/services/continuous-integration/hydra/default.nix b/nixos/modules/services/continuous-integration/hydra/default.nix
index cc5a1a2ed868..4d69118d0c3c 100644
--- a/nixos/modules/services/continuous-integration/hydra/default.nix
+++ b/nixos/modules/services/continuous-integration/hydra/default.nix
@@ -894,8 +894,8 @@ in
 
         ${lib.optionalString haveLocalDB ''
           if ! [ -e ${baseDir}/.db-created ]; then
-            runuser -u ${config.services.postgresql.superUser} ${config.services.postgresql.package}/bin/createuser hydra
-            runuser -u ${config.services.postgresql.superUser} ${config.services.postgresql.package}/bin/createdb -- -O hydra hydra
+            runuser -u ${config.services.postgresql.superUser} -- ${config.services.postgresql.package}/bin/createuser hydra
+            runuser -u ${config.services.postgresql.superUser} -- ${config.services.postgresql.package}/bin/createdb -O hydra hydra
             touch ${baseDir}/.db-created
           fi
           echo "create extension if not exists pg_trgm" | runuser -u ${config.services.postgresql.superUser} -- ${config.services.postgresql.package}/bin/psql hydra
diff --git a/nixos/tests/incus/default.nix b/nixos/tests/incus/default.nix
index af33c6c78316..c6600ca8e761 100644
--- a/nixos/tests/incus/default.nix
+++ b/nixos/tests/incus/default.nix
@@ -23,7 +23,8 @@ in
   all = incusRunTest {
     name = "all";
     appArmor = true;
-    feature.user = true;
+    # https://github.com/lxc/incus/issues/4297
+    # feature.user = true;
 
     instances = {
       c1 = {
diff --git a/pkgs/applications/networking/instant-messengers/linphone/bc-mbedtls/default.nix b/pkgs/applications/networking/instant-messengers/linphone/bc-mbedtls/default.nix
index 28b5858e8f15..e262ad151db5 100644
--- a/pkgs/applications/networking/instant-messengers/linphone/bc-mbedtls/default.nix
+++ b/pkgs/applications/networking/instant-messengers/linphone/bc-mbedtls/default.nix
@@ -79,5 +79,12 @@ stdenv.mkDerivation {
     ];
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ naxdy ];
+    knownVulnerabilities = [
+      ''
+        bc-mbedtls is a fork of mbedtls 3.6.1, which does not keep up with security fixes in mainline mbedtls.
+        mbedtls 3.6.1 was released 2024-08-30, with the linphone fork receiving a total of 10 commits since, most of which build fixes rather than security fixes.
+        For more information of potential security issues of such ancient mbedtls, see https://nvd.nist.gov/vuln/search?cpeFilterMode=cpe&cpeName=cpe:2.3:a:arm:mbed_tls:3.6.1:*:*:*:*:*:*:*
+      ''
+    ];
   };
 }
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index fd6a81ab9628..1be9a5b523c0 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -86,8 +86,8 @@ rec {
   thunderbird = thunderbird-latest;
 
   thunderbird-latest = common {
-    version = "158.0";
-    sha512 = "fe19e0e7540ef27af0bdb730963a9b4ad91472a9ab8b0c5eddd291c2d234ab7ac68ddf71c8595090b87cfd0deeaebc66dbce15c65c90fd09183b05db4bdce263";
+    version = "159.0";
+    sha512 = "97d993f8825b74854ba87248aa823d8573af84fe1c0baf38bc826234671d1b4e614c3ec1efc85058449b7552920baacc438359fd0212092f1d9bfd069649d664";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-latest";
diff --git a/pkgs/by-name/ar/artalk/package.nix b/pkgs/by-name/ar/artalk/package.nix
index e9002751d97a..0b8fb704910f 100644
--- a/pkgs/by-name/ar/artalk/package.nix
+++ b/pkgs/by-name/ar/artalk/package.nix
@@ -7,6 +7,7 @@
   stdenv,
   nixosTests,
   versionCheckHook,
+  writableTmpDirAsHomeHook,
   nix-update-script,
 }:
 
@@ -14,6 +15,8 @@ buildGoModule (finalAttrs: {
   pname = "artalk";
   version = "2.10.1";
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "ArtalkJS";
     repo = "artalk";
@@ -33,7 +36,10 @@ buildGoModule (finalAttrs: {
 
   env.CGO_ENABLED = 0;
 
-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [
+    installShellFiles
+    writableTmpDirAsHomeHook
+  ];
 
   # TestAuthSSOExchange
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/by-name/br/bruno-cli/package.nix b/pkgs/by-name/br/bruno-cli/package.nix
index 1b9f25f19bf0..ec7f87bb4cd6 100644
--- a/pkgs/by-name/br/bruno-cli/package.nix
+++ b/pkgs/by-name/br/bruno-cli/package.nix
@@ -7,6 +7,8 @@
   bruno,
   pkg-config,
   pango,
+  jq,
+  moreutils,
   testers,
   bruno-cli,
 }:
@@ -20,7 +22,12 @@ buildNpmPackage {
   # since they only make releases and git tags for bruno,
   # we lie about bruno-cli's version and say it's the same as bruno's
   # to keep them in sync with easier maintenance
-  inherit (bruno) version src npmDepsHash;
+  inherit (bruno)
+    version
+    src
+    npmDepsHash
+    npmDepsFetcherVersion
+    ;
 
   # npm dependency install fails with nodejs_24: https://github.com/NixOS/nixpkgs/issues/474535
   nodejs = nodejs_22;
@@ -37,9 +44,14 @@ buildNpmPackage {
     pango
   ];
 
+  postPatch = ''
+    # prevent 'prepare' from invoking tsx before patchShebangs fixes the interpreter
+    ${jq}/bin/jq 'del(.scripts.prepare)' packages/bruno-sqlite/package.json | ${moreutils}/bin/sponge packages/bruno-sqlite/package.json
+  '';
+
   postConfigure = ''
-    # sh: line 1: /build/source/packages/bruno-converters/node_modules/.bin/rimraf: cannot execute: required file not found
-    patchShebangs packages/*/node_modules
+    # patch shebangs for node_modules binaries (rollup, tsx) to prevent bad interpreter errors
+    patchShebangs node_modules packages/*/node_modules
   '';
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
@@ -127,6 +139,7 @@ buildNpmPackage {
       kashw2
       mattpolzin
       water-sucks
+      samirbgno
     ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
diff --git a/pkgs/by-name/br/bruno/package.nix b/pkgs/by-name/br/bruno/package.nix
index c487d2c8a48b..5aca9aeb4c82 100644
--- a/pkgs/by-name/br/bruno/package.nix
+++ b/pkgs/by-name/br/bruno/package.nix
@@ -21,13 +21,13 @@
 
 buildNpmPackage rec {
   pname = "bruno";
-  version = "4.0.0";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner = "usebruno";
     repo = "bruno";
     tag = "v${version}";
-    hash = "sha256-M4oNx3nSe8hSAtZMVyXIW0qQIQkaOeQgpPsfjmmJ30E=";
+    hash = "sha256-VP7MrfmsH1A/p4Cik0T93+tENCAVYYCRPuPNxbNU/YA=";
 
     postFetch = ''
       ${lib.getExe npm-lockfile-fix} $out/package-lock.json
@@ -36,7 +36,8 @@ buildNpmPackage rec {
 
   nodejs = nodejs_22;
 
-  npmDepsHash = "sha256-Jrlpztg1JxuPaLD4O9elOaU1eFH3dmr6oWwi4Ch9Zv8=";
+  npmDepsFetcherVersion = 2;
+  npmDepsHash = "sha256-knLLTC6xAw1ycqYLYfNtnZsfTjRHuV6vAXc8JQ6u8HM=";
   npmFlags = [ "--legacy-peer-deps" ];
 
   nativeBuildInputs = [
@@ -81,11 +82,14 @@ buildNpmPackage rec {
     # disable remote image download to prevent network calls to comply with build sandboxing
     substituteInPlace packages/bruno-app/plugins/remote-images/loader.cjs \
       --replace-fail 'const urls = findRemoteImageUrls(source, domains);' 'const urls = [];'
+
+    # prevent 'prepare' from invoking tsx before patchShebangs fixes the interpreter
+    ${jq}/bin/jq 'del(.scripts.prepare)' packages/bruno-sqlite/package.json | ${moreutils}/bin/sponge packages/bruno-sqlite/package.json
   '';
 
   postConfigure = ''
-    # sh: line 1: /build/source/packages/bruno-common/node_modules/.bin/rollup: cannot execute: required file not found
-    patchShebangs packages/*/node_modules
+    # patch shebangs for node_modules binaries (rollup, tsx) to prevent bad interpreter errors
+    patchShebangs node_modules packages/*/node_modules
   '';
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
@@ -112,6 +116,7 @@ buildNpmPackage rec {
     npm run build --workspace=packages/bruno-query
     npm run build --workspace=packages/bruno-filestore
     npm run build --workspace=packages/bruno-requests
+    npm run build --workspace=packages/bruno-sqlite
 
     npm run sandbox:bundle-libraries --workspace=packages/bruno-js
 
@@ -203,6 +208,7 @@ buildNpmPackage rec {
       mattpolzin
       water-sucks
       starsep
+      samirbgno
     ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
diff --git a/pkgs/by-name/em/emplace/package.nix b/pkgs/by-name/em/emplace/package.nix
index 9586b020e5db..3fface5a0a80 100644
--- a/pkgs/by-name/em/emplace/package.nix
+++ b/pkgs/by-name/em/emplace/package.nix
@@ -2,15 +2,15 @@
   lib,
   rustPlatform,
   fetchpatch,
-  fetchFromGitHub,
+  fetchFromCodeberg,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "emplace";
   version = "1.6.0";
 
-  src = fetchFromGitHub {
-    owner = "tversteeg";
+  src = fetchFromCodeberg {
+    owner = "fosk";
     repo = "emplace";
     tag = "v${finalAttrs.version}";
     sha256 = "sha256-FZ+lvf5HRSruUdmkm/Hqz0aRa95SjfIa43WQczRCGNg=";
@@ -18,7 +18,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoPatches = [
     (fetchpatch {
-      url = "https://github.com/tversteeg/emplace/pull/397/commits/fe32ab280234b1fb1a81a22f78bbc8af188b5fa7.patch";
+      url = "https://codeberg.org/fosk/emplace/commit/ea39f5826f6d0501aa3073f620b8a764900d3dc5.patch";
       hash = "sha256-9O0J9cJlXUGdQ9fqWeW8OIFA48qlYxGl+2yHHt3MaMU=";
     })
   ];
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   meta = {
     description = "Mirror installed software on multiple machines";
-    homepage = "https://github.com/tversteeg/emplace";
+    homepage = "https://codeberg.org/fosk/emplace";
     license = lib.licenses.agpl3Plus;
     mainProgram = "emplace";
   };
diff --git a/pkgs/by-name/fy/fyne/package.nix b/pkgs/by-name/fy/fyne/package.nix
index 6a2802c4a77d..f781ddd7d44c 100644
--- a/pkgs/by-name/fy/fyne/package.nix
+++ b/pkgs/by-name/fy/fyne/package.nix
@@ -15,13 +15,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "fyne";
-  version = "1.7.3";
+  version = "1.7.4";
 
   src = fetchFromGitHub {
     owner = "fyne-io";
     repo = "tools";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2N59UDuXDIIfxMX3m+MYCmBC/Zr5UmqvZkUAwe7oapU=";
+    hash = "sha256-NY0YfqvM1JMtlYnO/yzQK4CsNPnmPigTMdNJ7bA4QWI=";
   };
 
   vendorHash = "sha256-brLtfcKdsUg/X39ARPwbk/5QJQyOBUL2a7W2mvD9dtw=";
diff --git a/pkgs/by-name/in/incus/package.nix b/pkgs/by-name/in/incus/package.nix
index a27d61a7b0e4..9a4fba5ce577 100644
--- a/pkgs/by-name/in/incus/package.nix
+++ b/pkgs/by-name/in/incus/package.nix
@@ -1,7 +1,7 @@
 import ./generic.nix {
-  hash = "sha256-Kqz1fF/0jvqOtYqYSPI37M5vmqNrpfdZx2isbLcJTJg=";
-  version = "7.5.1";
-  vendorHash = "sha256-erg2ull2Dvw4lXIcjDyS/HVObqYUIh7k4GUsTJ61giY=";
+  hash = "sha256-JO6qZvsy3EcMYVXF3SjQljOSAEG1RlQTK+eiQIT9c1s=";
+  version = "7.6.0";
+  vendorHash = "sha256-3T3NXH3GVfn1K6dfObOji4GCkcYzio8yRfdV5nyOAtE=";
   nixUpdateExtraArgs = [
     "--override-filename=pkgs/by-name/in/incus/package.nix"
   ];
diff --git a/pkgs/by-name/li/libetebase/package.nix b/pkgs/by-name/li/libetebase/package.nix
index 247ca10c3b7d..8ac432988762 100644
--- a/pkgs/by-name/li/libetebase/package.nix
+++ b/pkgs/by-name/li/libetebase/package.nix
@@ -2,6 +2,7 @@
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
+  libsodium,
   openssl,
   lib,
   stdenv,
@@ -21,9 +22,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-ZLQFERi38+0SUxWaYAL4AepgVuAQKo9pxjcMkzA55BM=";
 
+  env.SODIUM_USE_PKG_CONFIG = true;
+
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ openssl ];
+  buildInputs = [
+    libsodium
+    openssl
+  ];
 
   postInstall = ''
     install -d $out/lib/pkgconfig
diff --git a/pkgs/by-name/so/sonarqube-cli/package.nix b/pkgs/by-name/so/sonarqube-cli/package.nix
index 8e46162b10f6..0b5ebff466de 100644
--- a/pkgs/by-name/so/sonarqube-cli/package.nix
+++ b/pkgs/by-name/so/sonarqube-cli/package.nix
@@ -9,7 +9,7 @@ stdenv.mkDerivation (finalAttrs: {
   __structuredAttrs = true;
 
   pname = "sonarqube-cli";
-  version = "1.10.0.16040";
+  version = "1.11.0.16877";
 
   src =
     let
@@ -18,15 +18,15 @@ stdenv.mkDerivation (finalAttrs: {
     {
       x86_64-linux = fetchurl {
         url = "${baseUrl}/linux/sonarqube-cli-${finalAttrs.version}-linux-x86-64.bin";
-        hash = "sha256-0PgF8pmEiIUEz8dQ8wy03hroFyoqw4+I558FelGcvJ4=";
+        hash = "sha256-A7czalWXnFubR+NWlqI9f81TBr1vghf9KerhBleNBCg=";
       };
       aarch64-linux = fetchurl {
         url = "${baseUrl}/linux/sonarqube-cli-${finalAttrs.version}-linux-arm64.bin";
-        hash = "sha256-oEsZAM8kxVYL4FwpDwY0m3yeOWepRRXbdFNTouVonwM=";
+        hash = "sha256-S0dhm9ra18IaGW1zUmhFk8JdD8ZwfdK2FSsFY0hzDr0=";
       };
       aarch64-darwin = fetchurl {
         url = "${baseUrl}/macos/sonarqube-cli-${finalAttrs.version}-macos-arm64.bin";
-        hash = "sha256-LZ/dE5QxtcMEQy189qeSE27qZ52y/1OV3g2sygzW2sQ=";
+        hash = "sha256-j+V3SsI80FQY5t5TePahqQydKb13X0lNTSlglzYJk24=";
       };
     }
     .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
diff --git a/pkgs/by-name/vu/vue-language-server/package.nix b/pkgs/by-name/vu/vue-language-server/package.nix
index 6fed01c5ed81..12a17927418a 100644
--- a/pkgs/by-name/vu/vue-language-server/package.nix
+++ b/pkgs/by-name/vu/vue-language-server/package.nix
@@ -16,13 +16,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "vue-language-server";
-  version = "3.3.12";
+  version = "3.3.13";
 
   src = fetchFromGitHub {
     owner = "vuejs";
     repo = "language-tools";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-JISymYGk10A2wyjKuJ6c3YKNKQkuN0/PCWFDYOnsy/Q=";
+    hash = "sha256-7PDscQkBmL47vxGqH4eap+UA5CRnIyfN2iWYnjexcPY=";
   };
 
   pnpmDeps = fetchPnpmDeps {