diff --git a/.git-blame-ignore-revs b/.git-blame-ignore-revs
index b8aeaadf4141..8724f5d5c3a7 100644
--- a/.git-blame-ignore-revs
+++ b/.git-blame-ignore-revs
@@ -229,3 +229,9 @@ adb9714bd909df283c66bbd641bd631ff50a4260
 
 # tmuxPlugins sha-to-sri.py script
 516b1e74c358a9c4b06e5591f8c1a2897aad0c33
+
+# treewide: migrate comments in lib to rfc145 style
+ef85e0daa092c9eae0d32c7ce16b889728a5fbc0
+d89ad6c70e0e89aaae75e9f886878ea4e103965a
+e0fe216f4912dd88a021d12a44155fd2cfeb31c8
+80d5b411f6397d5c3e755a0635d95742f76f3c75
diff --git a/doc/release-notes/rl-2505.section.md b/doc/release-notes/rl-2505.section.md
index ebc26f4b115e..c6983069ebc1 100644
--- a/doc/release-notes/rl-2505.section.md
+++ b/doc/release-notes/rl-2505.section.md
@@ -8,6 +8,14 @@
 
 - `services.rippleDataApi` has been removed, as `ripple-data-api` was broken and had not been updated since 2022.
 
+- The [`no-broken-symlinks` hook](#no-broken-symlinks.sh) was added to catch builds containing dangling or reflexive symlinks, as these are indicative of problems with packaging.
+  The hook can be disabled by providing `dontCheckForBrokenSymlinks = true;` as an argument to `mkDerivation`.
+  For more information, [check the docs](#no-broken-symlinks.sh) or [see this PR](https://github.com/NixOS/nixpkgs/pull/370750).
+
+- The `nixLog*` family of functions made available through the standard environment have been rewritten to prefix messages with both the debug level and the function name of the caller.
+  The `nixLog` function, which logs unconditionally, was also re-introduced and modified to prefix messages with the function name of the caller.
+  For more information, [see this PR](https://github.com/NixOS/nixpkgs/pull/370742).
+
 - The `rustPlatform.fetchCargoTarball` function is deprecated, because it relied on `cargo vendor` not changing its output format to keep fixed-output derivation hashes the same, which is a Nix invariant, and Cargo 1.84.0 changed `cargo vendor`'s output format.
   It should generally be replaced with `rustPlatform.fetchCargoVendor`, but `rustPlatform.importCargoLock` may also be appropriate in some circumstances.
   `rustPlatform.buildRustPackage` users must set `useFetchCargoVendor` to `true` and regenerate the `cargoHash`.
diff --git a/lib/fileset/internal.nix b/lib/fileset/internal.nix
index 7f002216bc7f..4674a321b3ae 100644
--- a/lib/fileset/internal.nix
+++ b/lib/fileset/internal.nix
@@ -267,7 +267,7 @@ rec {
       # Set all entries not present to null
       mapAttrs (name: value: null) (readDir path) // value;
 
-  /*
+  /**
     A normalisation of a filesetTree suitable filtering with `builtins.path`:
     - Replace all directories that have no files with `null`.
       This removes directories that would be empty
@@ -276,7 +276,21 @@ rec {
 
     Note that this function is strict, it evaluates the entire tree
 
-    Type: Path -> filesetTree -> filesetTree
+    # Inputs
+
+    `path`
+
+    : 1\. Function argument
+
+    `tree`
+
+    : 2\. Function argument
+
+    # Type
+
+    ```
+    Path -> filesetTree -> filesetTree
+    ```
   */
   _normaliseTreeFilter =
     path: tree:
@@ -298,7 +312,7 @@ rec {
     else
       tree;
 
-  /*
+  /**
     A minimal normalisation of a filesetTree, intended for pretty-printing:
     - If all children of a path are recursively included or empty directories, the path itself is also recursively included
     - If all children of a path are fully excluded or empty directories, the path itself is an empty directory
@@ -307,7 +321,21 @@ rec {
 
     Note that this function is partially lazy.
 
-    Type: Path -> filesetTree -> filesetTree (with "emptyDir"'s)
+    # Inputs
+
+    `path`
+
+    : 1\. Function argument
+
+    `tree`
+
+    : 2\. Function argument
+
+    # Type
+
+    ```
+    Path -> filesetTree -> filesetTree (with "emptyDir"'s)
+    ```
   */
   _normaliseTreeMinimal =
     path: tree:
diff --git a/lib/licenses.nix b/lib/licenses.nix
index f72efa5a6145..5d0aff11b7a3 100644
--- a/lib/licenses.nix
+++ b/lib/licenses.nix
@@ -24,10 +24,11 @@ let
 
 in
 lib.mapAttrs mkLicense ({
-  /* License identifiers from spdx.org where possible.
-   * If you cannot find your license here, then look for a similar license or
-   * add it to this list. The URL mentioned above is a good source for inspiration.
-   */
+  /**
+    License identifiers from spdx.org where possible.
+    If you cannot find your license here, then look for a similar license or
+    add it to this list. The URL mentioned above is a good source for inspiration.
+  */
 
   abstyles = {
     spdxId = "Abstyles";
@@ -37,7 +38,9 @@ lib.mapAttrs mkLicense ({
   acsl14 = {
     fullName = "Anti-Capitalist Software License v1.4";
     url = "https://anticapitalist.software/";
-    /* restrictions on corporations apply for both use and redistribution */
+    /**
+      restrictions on corporations apply for both use and redistribution
+    */
     free = false;
     redistributable = false;
   };
diff --git a/lib/modules.nix b/lib/modules.nix
index 4d2d8e0b08b6..935ef4baabad 100644
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -74,14 +74,16 @@ let
           decls
       ));
 
-  /* See https://nixos.org/manual/nixpkgs/unstable/#module-system-lib-evalModules
-     or file://./../doc/module-system/module-system.chapter.md
+  /**
+    See https://nixos.org/manual/nixpkgs/unstable/#module-system-lib-evalModules
+    or file://./../doc/module-system/module-system.chapter.md
 
-     !!! Please think twice before adding to this argument list! The more
-     that is specified here instead of in the modules themselves the harder
-     it is to transparently move a set of modules to be a submodule of another
-     config (as the proper arguments need to be replicated at each call to
-     evalModules) and the less declarative the module set is. */
+    !!! Please think twice before adding to this argument list! The more
+    that is specified here instead of in the modules themselves the harder
+    it is to transparently move a set of modules to be a submodule of another
+    config (as the proper arguments need to be replicated at each call to
+    evalModules) and the less declarative the module set is.
+  */
   evalModules = evalModulesArgs@
                 { modules
                 , prefix ? []
@@ -378,30 +380,30 @@ let
         else
           m: m;
 
-      /*
-      Collects all modules recursively into the form
+      /**
+        Collects all modules recursively into the form
 
-        {
-          disabled = [ <list of disabled modules> ];
-          # All modules of the main module list
-          modules = [
-            {
-              key = <key1>;
-              module = <module for key1>;
-              # All modules imported by the module for key1
-              modules = [
-                {
-                  key = <key1-1>;
-                  module = <module for key1-1>;
-                  # All modules imported by the module for key1-1
-                  modules = [ ... ];
-                }
-                ...
-              ];
-            }
-            ...
-          ];
-        }
+          {
+            disabled = [ <list of disabled modules> ];
+            # All modules of the main module list
+            modules = [
+              {
+                key = <key1>;
+                module = <module for key1>;
+                # All modules imported by the module for key1
+                modules = [
+                  {
+                    key = <key1-1>;
+                    module = <module for key1-1>;
+                    # All modules imported by the module for key1-1
+                    modules = [ ... ];
+                  }
+                  ...
+                ];
+              }
+              ...
+            ];
+          }
       */
       collectStructuredModules =
         let
@@ -459,12 +461,42 @@ let
     in modulesPath: initialModules: args:
       filterModules modulesPath (collectStructuredModules unknownModule "" initialModules args);
 
-  /* Wrap a module with a default location for reporting errors. */
+  /**
+    Wrap a module with a default location for reporting errors.
+
+
+    # Inputs
+
+    `file`
+
+    : 1\. Function argument
+
+    `m`
+
+    : 2\. Function argument
+  */
   setDefaultModuleLocation = file: m:
     { _file = file; imports = [ m ]; };
 
-  /* Massage a module into canonical form, that is, a set consisting
-     of ‘options’, ‘config’ and ‘imports’ attributes. */
+  /**
+    Massage a module into canonical form, that is, a set consisting
+    of ‘options’, ‘config’ and ‘imports’ attributes.
+
+
+    # Inputs
+
+    `file`
+
+    : 1\. Function argument
+
+    `key`
+
+    : 2\. Function argument
+
+    `m`
+
+    : 3\. Function argument
+  */
   unifyModuleSyntax = file: key: m:
     let
       addMeta = config: if m ? meta
@@ -528,26 +560,38 @@ let
       # works.
     in f (args // extraArgs);
 
-  /* Merge a list of modules.  This will recurse over the option
-     declarations in all modules, combining them into a single set.
-     At the same time, for each option declaration, it will merge the
-     corresponding option definitions in all machines, returning them
-     in the ‘value’ attribute of each option.
+  /**
+    Merge a list of modules.  This will recurse over the option
+    declarations in all modules, combining them into a single set.
+    At the same time, for each option declaration, it will merge the
+    corresponding option definitions in all machines, returning them
+    in the ‘value’ attribute of each option.
 
-     This returns a set like
-       {
-         # A recursive set of options along with their final values
-         matchedOptions = {
-           foo = { _type = "option"; value = "option value of foo"; ... };
-           bar.baz = { _type = "option"; value = "option value of bar.baz"; ... };
-           ...
-         };
-         # A list of definitions that weren't matched by any option
-         unmatchedDefns = [
-           { file = "file.nix"; prefix = [ "qux" ]; value = "qux"; }
-           ...
-         ];
-       }
+    This returns a set like
+      {
+        # A recursive set of options along with their final values
+        matchedOptions = {
+          foo = { _type = "option"; value = "option value of foo"; ... };
+          bar.baz = { _type = "option"; value = "option value of bar.baz"; ... };
+          ...
+        };
+        # A list of definitions that weren't matched by any option
+        unmatchedDefns = [
+          { file = "file.nix"; prefix = [ "qux" ]; value = "qux"; }
+          ...
+        ];
+      }
+
+
+    # Inputs
+
+    `prefix`
+
+    : 1\. Function argument
+
+    `modules`
+
+    : 2\. Function argument
   */
   mergeModules = prefix: modules:
     mergeModules' prefix modules
@@ -740,17 +784,30 @@ let
     in
     throw (concatStringsSep "\n\n" paragraphs);
 
-  /* Merge multiple option declarations into a single declaration.  In
-     general, there should be only one declaration of each option.
-     The exception is the ‘options’ attribute, which specifies
-     sub-options.  These can be specified multiple times to allow one
-     module to add sub-options to an option declared somewhere else
-     (e.g. multiple modules define sub-options for ‘fileSystems’).
+  /**
+    Merge multiple option declarations into a single declaration.  In
+    general, there should be only one declaration of each option.
+    The exception is the ‘options’ attribute, which specifies
+    sub-options.  These can be specified multiple times to allow one
+    module to add sub-options to an option declared somewhere else
+    (e.g. multiple modules define sub-options for ‘fileSystems’).
 
-     'loc' is the list of attribute names where the option is located.
+    'loc' is the list of attribute names where the option is located.
 
-     'opts' is a list of modules.  Each module has an options attribute which
-     correspond to the definition of 'loc' in 'opt.file'. */
+    'opts' is a list of modules.  Each module has an options attribute which
+    correspond to the definition of 'loc' in 'opt.file'.
+
+
+    # Inputs
+
+    `loc`
+
+    : 1\. Function argument
+
+    `opts`
+
+    : 2\. Function argument
+  */
   mergeOptionDecls =
    loc: opts:
     foldl' (res: opt:
@@ -819,8 +876,25 @@ let
           } // typeSet
     ) { inherit loc; declarations = []; declarationPositions = []; options = []; } opts;
 
-  /* Merge all the definitions of an option to produce the final
-     config value. */
+  /**
+    Merge all the definitions of an option to produce the final
+    config value.
+
+
+    # Inputs
+
+    `loc`
+
+    : 1\. Function argument
+
+    `opt`
+
+    : 2\. Function argument
+
+    `defs`
+
+    : 3\. Function argument
+  */
   evalOptionValue = loc: opt: defs:
     let
       # Add in the default value for this option, if any.
@@ -902,20 +976,28 @@ let
       else {};
   };
 
-  /* Given a config set, expand mkMerge properties, and push down the
-     other properties into the children.  The result is a list of
-     config sets that do not have properties at top-level.  For
-     example,
+  /**
+    Given a config set, expand mkMerge properties, and push down the
+    other properties into the children.  The result is a list of
+    config sets that do not have properties at top-level.  For
+    example,
 
-       mkMerge [ { boot = set1; } (mkIf cond { boot = set2; services = set3; }) ]
+      mkMerge [ { boot = set1; } (mkIf cond { boot = set2; services = set3; }) ]
 
-     is transformed into
+    is transformed into
 
-       [ { boot = set1; } { boot = mkIf cond set2; services = mkIf cond set3; } ].
+      [ { boot = set1; } { boot = mkIf cond set2; services = mkIf cond set3; } ].
 
-     This transform is the critical step that allows mkIf conditions
-     to refer to the full configuration without creating an infinite
-     recursion.
+    This transform is the critical step that allows mkIf conditions
+    to refer to the full configuration without creating an infinite
+    recursion.
+
+
+    # Inputs
+
+    `cfg`
+
+    : 1\. Function argument
   */
   pushDownProperties = cfg:
     if cfg._type or "" == "merge" then
@@ -927,15 +1009,23 @@ let
     else # FIXME: handle mkOrder?
       [ cfg ];
 
-  /* Given a config value, expand mkMerge properties, and discharge
-     any mkIf conditions.  That is, this is the place where mkIf
-     conditions are actually evaluated.  The result is a list of
-     config values.  For example, ‘mkIf false x’ yields ‘[]’,
-     ‘mkIf true x’ yields ‘[x]’, and
+  /**
+    Given a config value, expand mkMerge properties, and discharge
+    any mkIf conditions.  That is, this is the place where mkIf
+    conditions are actually evaluated.  The result is a list of
+    config values.  For example, ‘mkIf false x’ yields ‘[]’,
+    ‘mkIf true x’ yields ‘[x]’, and
 
-       mkMerge [ 1 (mkIf true 2) (mkIf true (mkIf false 3)) ]
+      mkMerge [ 1 (mkIf true 2) (mkIf true (mkIf false 3)) ]
 
-     yields ‘[ 1 2 ]’.
+    yields ‘[ 1 2 ]’.
+
+
+    # Inputs
+
+    `def`
+
+    : 1\. Function argument
   */
   dischargeProperties = def:
     if def._type or "" == "merge" then
@@ -951,24 +1041,32 @@ let
     else
       [ def ];
 
-  /* Given a list of config values, process the mkOverride properties,
-     that is, return the values that have the highest (that is,
-     numerically lowest) priority, and strip the mkOverride
-     properties.  For example,
+  /**
+    Given a list of config values, process the mkOverride properties,
+    that is, return the values that have the highest (that is,
+    numerically lowest) priority, and strip the mkOverride
+    properties.  For example,
 
-       [ { file = "/1"; value = mkOverride 10 "a"; }
-         { file = "/2"; value = mkOverride 20 "b"; }
-         { file = "/3"; value = "z"; }
-         { file = "/4"; value = mkOverride 10 "d"; }
-       ]
+      [ { file = "/1"; value = mkOverride 10 "a"; }
+        { file = "/2"; value = mkOverride 20 "b"; }
+        { file = "/3"; value = "z"; }
+        { file = "/4"; value = mkOverride 10 "d"; }
+      ]
 
-     yields
+    yields
 
-       [ { file = "/1"; value = "a"; }
-         { file = "/4"; value = "d"; }
-       ]
+      [ { file = "/1"; value = "a"; }
+        { file = "/4"; value = "d"; }
+      ]
 
-     Note that "z" has the default priority 100.
+    Note that "z" has the default priority 100.
+
+
+    # Inputs
+
+    `defs`
+
+    : 1\. Function argument
   */
   filterOverrides = defs: (filterOverrides' defs).values;
 
@@ -982,9 +1080,18 @@ let
       inherit highestPrio;
     };
 
-  /* Sort a list of properties.  The sort priority of a property is
-     defaultOrderPriority by default, but can be overridden by wrapping the property
-     using mkOrder. */
+  /**
+    Sort a list of properties.  The sort priority of a property is
+    defaultOrderPriority by default, but can be overridden by wrapping the property
+    using mkOrder.
+
+
+    # Inputs
+
+    `defs`
+
+    : 1\. Function argument
+  */
   sortProperties = defs:
     let
       strip = def:
@@ -1004,14 +1111,24 @@ let
     else opt // { type = opt.type.substSubModules opt.options; options = []; };
 
 
-  /*
+  /**
     Merge an option's definitions in a way that preserves the priority of the
     individual attributes in the option value.
 
     This does not account for all option semantics, such as readOnly.
 
-    Type:
-      option -> attrsOf { highestPrio, value }
+
+    # Inputs
+
+    `opt`
+
+    : 1\. Function argument
+
+    # Type
+
+    ```
+    option -> attrsOf { highestPrio, value }
+    ```
   */
   mergeAttrDefinitionsWithPrio = opt:
         let
@@ -1038,7 +1155,20 @@ let
                   })
                 defsByAttr;
 
-  /* Properties. */
+  /**
+    Properties.
+
+
+    # Inputs
+
+    `condition`
+
+    : 1\. Function argument
+
+    `content`
+
+    : 2\. Function argument
+  */
 
   mkIf = condition: content:
     { _type = "if";
@@ -1116,21 +1246,46 @@ let
   mkAliasIfDef = option:
     mkIf (isOption option && option.isDefined);
 
-  /* Compatibility. */
+  /**
+    Compatibility.
+
+
+    # Inputs
+
+    `modules`
+
+    : 1\. Function argument
+
+    `args`
+
+    : 2\. Function argument
+  */
   fixMergeModules = modules: args: evalModules { inherit modules args; check = false; };
 
 
-  /* Return a module that causes a warning to be shown if the
-     specified option is defined. For example,
+  /**
+    Return a module that causes a warning to be shown if the
+    specified option is defined. For example,
 
-       mkRemovedOptionModule [ "boot" "loader" "grub" "bootDevice" ] "<replacement instructions>"
+      mkRemovedOptionModule [ "boot" "loader" "grub" "bootDevice" ] "<replacement instructions>"
 
-     causes a assertion if the user defines boot.loader.grub.bootDevice.
+    causes a assertion if the user defines boot.loader.grub.bootDevice.
 
-     replacementInstructions is a string that provides instructions on
-     how to achieve the same functionality without the removed option,
-     or alternatively a reasoning why the functionality is not needed.
-     replacementInstructions SHOULD be provided!
+    replacementInstructions is a string that provides instructions on
+    how to achieve the same functionality without the removed option,
+    or alternatively a reasoning why the functionality is not needed.
+    replacementInstructions SHOULD be provided!
+
+
+    # Inputs
+
+    `optionName`
+
+    : 1\. Function argument
+
+    `replacementInstructions`
+
+    : 2\. Function argument
   */
   mkRemovedOptionModule = optionName: replacementInstructions:
     { options, ... }:
@@ -1148,18 +1303,30 @@ let
         }];
     };
 
-  /* Return a module that causes a warning to be shown if the
-     specified "from" option is defined; the defined value is however
-     forwarded to the "to" option. This can be used to rename options
-     while providing backward compatibility. For example,
+  /**
+    Return a module that causes a warning to be shown if the
+    specified "from" option is defined; the defined value is however
+    forwarded to the "to" option. This can be used to rename options
+    while providing backward compatibility. For example,
 
-       mkRenamedOptionModule [ "boot" "copyKernels" ] [ "boot" "loader" "grub" "copyKernels" ]
+      mkRenamedOptionModule [ "boot" "copyKernels" ] [ "boot" "loader" "grub" "copyKernels" ]
 
-     forwards any definitions of boot.copyKernels to
-     boot.loader.grub.copyKernels while printing a warning.
+    forwards any definitions of boot.copyKernels to
+    boot.loader.grub.copyKernels while printing a warning.
 
-     This also copies over the priority from the aliased option to the
-     non-aliased option.
+    This also copies over the priority from the aliased option to the
+    non-aliased option.
+
+
+    # Inputs
+
+    `from`
+
+    : 1\. Function argument
+
+    `to`
+
+    : 2\. Function argument
   */
   mkRenamedOptionModule = from: to: doRename {
     inherit from to;
@@ -1169,12 +1336,16 @@ let
   };
 
   mkRenamedOptionModuleWith = {
-    /* Old option path as list of strings. */
+    /**
+      Old option path as list of strings.
+    */
     from,
-    /* New option path as list of strings. */
+    /**
+      New option path as list of strings.
+    */
     to,
 
-    /*
+    /**
       Release number of the first release that contains the rename, ignoring backports.
       Set it to the upcoming release, matching the nixpkgs/.version file.
     */
@@ -1188,33 +1359,49 @@ let
       "Obsolete option `${showOption from}' is used. It was renamed to `${showOption to}'.";
   };
 
-  /* Return a module that causes a warning to be shown if any of the "from"
-     option is defined; the defined values can be used in the "mergeFn" to set
-     the "to" value.
-     This function can be used to merge multiple options into one that has a
-     different type.
+  /**
+    Return a module that causes a warning to be shown if any of the "from"
+    option is defined; the defined values can be used in the "mergeFn" to set
+    the "to" value.
+    This function can be used to merge multiple options into one that has a
+    different type.
 
-     "mergeFn" takes the module "config" as a parameter and must return a value
-     of "to" option type.
+    "mergeFn" takes the module "config" as a parameter and must return a value
+    of "to" option type.
 
-       mkMergedOptionModule
-         [ [ "a" "b" "c" ]
-           [ "d" "e" "f" ] ]
-         [ "x" "y" "z" ]
-         (config:
-           let value = p: getAttrFromPath p config;
-           in
-           if      (value [ "a" "b" "c" ]) == true then "foo"
-           else if (value [ "d" "e" "f" ]) == true then "bar"
-           else "baz")
+      mkMergedOptionModule
+        [ [ "a" "b" "c" ]
+          [ "d" "e" "f" ] ]
+        [ "x" "y" "z" ]
+        (config:
+          let value = p: getAttrFromPath p config;
+          in
+          if      (value [ "a" "b" "c" ]) == true then "foo"
+          else if (value [ "d" "e" "f" ]) == true then "bar"
+          else "baz")
 
-     - options.a.b.c is a removed boolean option
-     - options.d.e.f is a removed boolean option
-     - options.x.y.z is a new str option that combines a.b.c and d.e.f
-       functionality
+    - options.a.b.c is a removed boolean option
+    - options.d.e.f is a removed boolean option
+    - options.x.y.z is a new str option that combines a.b.c and d.e.f
+      functionality
 
-     This show a warning if any a.b.c or d.e.f is set, and set the value of
-     x.y.z to the result of the merge function
+    This show a warning if any a.b.c or d.e.f is set, and set the value of
+    x.y.z to the result of the merge function
+
+
+    # Inputs
+
+    `from`
+
+    : 1\. Function argument
+
+    `to`
+
+    : 2\. Function argument
+
+    `mergeFn`
+
+    : 3\. Function argument
   */
   mkMergedOptionModule = from: to: mergeFn:
     { config, options, ... }:
@@ -1240,33 +1427,62 @@ let
                (mergeFn config)));
     };
 
-  /* Single "from" version of mkMergedOptionModule.
-     Return a module that causes a warning to be shown if the "from" option is
-     defined; the defined value can be used in the "mergeFn" to set the "to"
-     value.
-     This function can be used to change an option into another that has a
-     different type.
+  /**
+    Single "from" version of mkMergedOptionModule.
+    Return a module that causes a warning to be shown if the "from" option is
+    defined; the defined value can be used in the "mergeFn" to set the "to"
+    value.
+    This function can be used to change an option into another that has a
+    different type.
 
-     "mergeFn" takes the module "config" as a parameter and must return a value of
-     "to" option type.
+    "mergeFn" takes the module "config" as a parameter and must return a value of
+    "to" option type.
 
-       mkChangedOptionModule [ "a" "b" "c" ] [ "x" "y" "z" ]
-         (config:
-           let value = getAttrFromPath [ "a" "b" "c" ] config;
-           in
-           if   value > 100 then "high"
-           else "normal")
+      mkChangedOptionModule [ "a" "b" "c" ] [ "x" "y" "z" ]
+        (config:
+          let value = getAttrFromPath [ "a" "b" "c" ] config;
+          in
+          if   value > 100 then "high"
+          else "normal")
 
-     - options.a.b.c is a removed int option
-     - options.x.y.z is a new str option that supersedes a.b.c
+    - options.a.b.c is a removed int option
+    - options.x.y.z is a new str option that supersedes a.b.c
 
-     This show a warning if a.b.c is set, and set the value of x.y.z to the
-     result of the change function
+    This show a warning if a.b.c is set, and set the value of x.y.z to the
+    result of the change function
+
+
+    # Inputs
+
+    `from`
+
+    : 1\. Function argument
+
+    `to`
+
+    : 2\. Function argument
+
+    `changeFn`
+
+    : 3\. Function argument
   */
   mkChangedOptionModule = from: to: changeFn:
     mkMergedOptionModule [ from ] to changeFn;
 
-  /* Like ‘mkRenamedOptionModule’, but doesn't show a warning. */
+  /**
+    Like ‘mkRenamedOptionModule’, but doesn't show a warning.
+
+
+    # Inputs
+
+    `from`
+
+    : 1\. Function argument
+
+    `to`
+
+    : 2\. Function argument
+  */
   mkAliasOptionModule = from: to: doRename {
     inherit from to;
     visible = true;
@@ -1274,13 +1490,15 @@ let
     use = id;
   };
 
-  /* Transitional version of mkAliasOptionModule that uses MD docs.
+  /**
+    Transitional version of mkAliasOptionModule that uses MD docs.
 
-     This function is no longer necessary and merely an alias of `mkAliasOptionModule`.
+    This function is no longer necessary and merely an alias of `mkAliasOptionModule`.
   */
   mkAliasOptionModuleMD = mkAliasOptionModule;
 
-  /* mkDerivedConfig : Option a -> (a -> Definition b) -> Definition b
+  /**
+    mkDerivedConfig : Option a -> (a -> Definition b) -> Definition b
 
     Create config definitions with the same priority as the definition of another option.
     This should be used for option definitions where one option sets the value of another as a convenience.
@@ -1288,6 +1506,17 @@ let
     value using `mkDerivedConfig options.text (pkgs.writeText "filename.conf")`.
 
     It takes care of setting the right priority using `mkOverride`.
+
+
+    # Inputs
+
+    `opt`
+
+    : 1\. Function argument
+
+    `f`
+
+    : 2\. Function argument
   */
   # TODO: make the module system error message include information about `opt` in
   # error messages about conflicts. E.g. introduce a variation of `mkOverride` which
@@ -1300,10 +1529,10 @@ let
       (opt.highestPrio or defaultOverridePriority)
       (f opt.value);
 
-  /*
+  /**
     Return a module that help declares an option that has been renamed.
     When a value is defined for the old option, it is forwarded to the `to` option.
-   */
+  */
   doRename = {
     # List of strings representing the attribute path of the old option.
     from,
@@ -1450,18 +1679,34 @@ let
     modulePath: staticArg:
       lib.setDefaultModuleLocation modulePath (import modulePath staticArg);
 
-  /* Use this function to import a JSON file as NixOS configuration.
+  /**
+    Use this function to import a JSON file as NixOS configuration.
 
-     modules.importJSON :: path -> attrs
+    modules.importJSON :: path -> attrs
+
+
+    # Inputs
+
+    `file`
+
+    : 1\. Function argument
   */
   importJSON = file: {
     _file = file;
     config = lib.importJSON file;
   };
 
-  /* Use this function to import a TOML file as NixOS configuration.
+  /**
+    Use this function to import a TOML file as NixOS configuration.
 
-     modules.importTOML :: path -> attrs
+    modules.importTOML :: path -> attrs
+
+
+    # Inputs
+
+    `file`
+
+    : 1\. Function argument
   */
   importTOML = file: {
     _file = file;
diff --git a/lib/network/internal.nix b/lib/network/internal.nix
index 3e05be90c547..20a18e073af5 100644
--- a/lib/network/internal.nix
+++ b/lib/network/internal.nix
@@ -16,7 +16,7 @@ let
 
   inherit (lib.lists) last;
 
-  /*
+  /**
     IPv6 addresses are 128-bit identifiers. The preferred form is 'x:x:x:x:x:x:x:x',
     where the 'x's are one to four hexadecimal digits of the eight 16-bit pieces of
     the address. See RFC 4291.
@@ -138,7 +138,7 @@ let
   parseIpv6FromString = addr: parseExpandedIpv6 (expandIpv6 addr);
 in
 {
-  /*
+  /**
     Internally, an IPv6 address is stored as a list of 16-bit integers with 8
     elements. Wherever you see `IPv6` in internal functions docs, it means that
     it is a list of integers produced by one of the internal parsers, such as
diff --git a/lib/options.nix b/lib/options.nix
index fe665040ad03..08ac385ff46f 100644
--- a/lib/options.nix
+++ b/lib/options.nix
@@ -426,18 +426,29 @@ rec {
     else if all isInt list && all (x: x == head list) list then head list
     else throw "Cannot merge definitions of `${showOption loc}'. Definition values:${showDefs defs}";
 
-  /*
+  /**
     Require a single definition.
 
     WARNING: Does not perform nested checks, as this does not run the merge function!
   */
   mergeOneOption = mergeUniqueOption { message = ""; };
 
-  /*
+  /**
     Require a single definition.
 
     NOTE: When the type is not checked completely by check, pass a merge function for further checking (of sub-attributes, etc).
-   */
+
+
+    # Inputs
+
+    `loc`
+
+    : 2\. Function argument
+
+    `defs`
+
+    : 3\. Function argument
+  */
   mergeUniqueOption = args@{
       message,
       # WARNING: the default merge function assumes that the definition is a valid (option) value. You MUST pass a merge function if the return value needs to be
@@ -452,7 +463,20 @@ rec {
         assert length defs > 1;
         throw "The option `${showOption loc}' is defined multiple times while it's expected to be unique.\n${message}\nDefinition values:${showDefs defs}\n${prioritySuggestion}";
 
-  /* "Merge" option definitions by checking that they all have the same value. */
+  /**
+    "Merge" option definitions by checking that they all have the same value.
+
+
+    # Inputs
+
+    `loc`
+
+    : 1\. Function argument
+
+    `defs`
+
+    : 2\. Function argument
+  */
   mergeEqualOption = loc: defs:
     if defs == [] then abort "This case should never happen."
     # Return early if we only have one element
@@ -465,23 +489,47 @@ rec {
       else
         first) (head defs) (tail defs)).value;
 
-  /* Extracts values of all "value" keys of the given list.
+  /**
+    Extracts values of all "value" keys of the given list.
 
-     Type: getValues :: [ { value :: a; } ] -> [a]
+    # Type
 
-     Example:
-       getValues [ { value = 1; } { value = 2; } ] // => [ 1 2 ]
-       getValues [ ]                               // => [ ]
+    ```
+    getValues :: [ { value :: a; } ] -> [a]
+    ```
+
+    # Examples
+    :::{.example}
+    ## `getValues` usage example
+
+    ```nix
+    getValues [ { value = 1; } { value = 2; } ] // => [ 1 2 ]
+    getValues [ ]                               // => [ ]
+    ```
+
+    :::
   */
   getValues = map (x: x.value);
 
-  /* Extracts values of all "file" keys of the given list
+  /**
+    Extracts values of all "file" keys of the given list
 
-     Type: getFiles :: [ { file :: a; } ] -> [a]
+    # Type
 
-     Example:
-       getFiles [ { file = "file1"; } { file = "file2"; } ] // => [ "file1" "file2" ]
-       getFiles [ ]                                         // => [ ]
+    ```
+    getFiles :: [ { file :: a; } ] -> [a]
+    ```
+
+    # Examples
+    :::{.example}
+    ## `getFiles` usage example
+
+    ```nix
+    getFiles [ { file = "file1"; } { file = "file2"; } ] // => [ "file1" "file2" ]
+    getFiles [ ]                                         // => [ ]
+    ```
+
+    :::
   */
   getFiles = map (x: x.file);
 
@@ -530,16 +578,24 @@ rec {
         [ docOption ] ++ optionals subOptionsVisible subOptions) (collect isOption options);
 
 
-  /* This function recursively removes all derivation attributes from
-     `x` except for the `name` attribute.
+  /**
+    This function recursively removes all derivation attributes from
+    `x` except for the `name` attribute.
 
-     This is to make the generation of `options.xml` much more
-     efficient: the XML representation of derivations is very large
-     (on the order of megabytes) and is not actually used by the
-     manual generator.
+    This is to make the generation of `options.xml` much more
+    efficient: the XML representation of derivations is very large
+    (on the order of megabytes) and is not actually used by the
+    manual generator.
 
-     This function was made obsolete by renderOptionValue and is kept for
-     compatibility with out-of-tree code.
+    This function was made obsolete by renderOptionValue and is kept for
+    compatibility with out-of-tree code.
+
+
+    # Inputs
+
+    `x`
+
+    : 1\. Function argument
   */
   scrubOptionValue = x:
     if isDerivation x then
@@ -549,8 +605,16 @@ rec {
     else x;
 
 
-  /* Ensures that the given option value (default or example) is a `_type`d string
-     by rendering Nix values to `literalExpression`s.
+  /**
+    Ensures that the given option value (default or example) is a `_type`d string
+    by rendering Nix values to `literalExpression`s.
+
+
+    # Inputs
+
+    `v`
+
+    : 1\. Function argument
   */
   renderOptionValue = v:
     if v ? _type && v ? text then v
@@ -560,10 +624,18 @@ rec {
     } v);
 
 
-  /* For use in the `defaultText` and `example` option attributes. Causes the
-     given string to be rendered verbatim in the documentation as Nix code. This
-     is necessary for complex values, e.g. functions, or values that depend on
-     other values or packages.
+  /**
+    For use in the `defaultText` and `example` option attributes. Causes the
+    given string to be rendered verbatim in the documentation as Nix code. This
+    is necessary for complex values, e.g. functions, or values that depend on
+    other values or packages.
+
+
+    # Inputs
+
+    `text`
+
+    : 1\. Function argument
   */
   literalExpression = text:
     if ! isString text then throw "literalExpression expects a string."
@@ -571,9 +643,17 @@ rec {
 
   literalExample = lib.warn "lib.literalExample is deprecated, use lib.literalExpression instead, or use lib.literalMD for a non-Nix description." literalExpression;
 
-  /* For use in the `defaultText` and `example` option attributes. Causes the
-     given MD text to be inserted verbatim in the documentation, for when
-     a `literalExpression` would be too hard to read.
+  /**
+    For use in the `defaultText` and `example` option attributes. Causes the
+    given MD text to be inserted verbatim in the documentation, for when
+    a `literalExpression` would be too hard to read.
+
+
+    # Inputs
+
+    `text`
+
+    : 1\. Function argument
   */
   literalMD = text:
     if ! isString text then throw "literalMD expects a string."
@@ -581,18 +661,34 @@ rec {
 
   # Helper functions.
 
-  /* Convert an option, described as a list of the option parts to a
-     human-readable version.
+  /**
+    Convert an option, described as a list of the option parts to a
+    human-readable version.
 
-     Example:
-       (showOption ["foo" "bar" "baz"]) == "foo.bar.baz"
-       (showOption ["foo" "bar.baz" "tux"]) == "foo.\"bar.baz\".tux"
-       (showOption ["windowManager" "2bwm" "enable"]) == "windowManager.\"2bwm\".enable"
 
-     Placeholders will not be quoted as they are not actual values:
-       (showOption ["foo" "*" "bar"]) == "foo.*.bar"
-       (showOption ["foo" "<name>" "bar"]) == "foo.<name>.bar"
-       (showOption ["foo" "<myPlaceholder>" "bar"]) == "foo.<myPlaceholder>.bar"
+    # Inputs
+
+    `parts`
+
+    : 1\. Function argument
+
+
+    # Examples
+    :::{.example}
+    ## `showOption` usage example
+
+    ```nix
+    (showOption ["foo" "bar" "baz"]) == "foo.bar.baz"
+      (showOption ["foo" "bar.baz" "tux"]) == "foo.\"bar.baz\".tux"
+      (showOption ["windowManager" "2bwm" "enable"]) == "windowManager.\"2bwm\".enable"
+
+    Placeholders will not be quoted as they are not actual values:
+      (showOption ["foo" "*" "bar"]) == "foo.*.bar"
+      (showOption ["foo" "<name>" "bar"]) == "foo.<name>.bar"
+      (showOption ["foo" "<myPlaceholder>" "bar"]) == "foo.<myPlaceholder>.bar"
+    ```
+
+    :::
   */
   showOption = parts: let
     # If the part is a named placeholder of the form "<...>" don't escape it.
diff --git a/lib/path/default.nix b/lib/path/default.nix
index e8f0c646c545..4ffee65e1cf5 100644
--- a/lib/path/default.nix
+++ b/lib/path/default.nix
@@ -165,7 +165,7 @@ in
 # No rec! Add dependencies on this file at the top.
 {
 
-  /*
+  /**
     Append a subpath string to a path.
 
     Like `path + ("/" + string)` but safer, because it errors instead of returning potentially surprising results.
@@ -178,34 +178,54 @@ in
 
           append p s == append p (subpath.normalise s)
 
-    Type:
-      append :: Path -> String -> Path
+    # Inputs
 
-    Example:
-      append /foo "bar/baz"
-      => /foo/bar/baz
+    `path`
 
-      # subpaths don't need to be normalised
-      append /foo "./bar//baz/./"
-      => /foo/bar/baz
+    : The absolute path to append to
 
-      # can append to root directory
-      append /. "foo/bar"
-      => /foo/bar
+    `subpath`
 
-      # first argument needs to be a path value type
-      append "/foo" "bar"
-      => <error>
+    : The subpath string to append
 
-      # second argument needs to be a valid subpath string
-      append /foo /bar
-      => <error>
-      append /foo ""
-      => <error>
-      append /foo "/bar"
-      => <error>
-      append /foo "../bar"
-      => <error>
+    # Type
+
+    ```
+    append :: Path -> String -> Path
+    ```
+
+    # Examples
+    :::{.example}
+    ## `append` usage example
+
+    ```nix
+    append /foo "bar/baz"
+    => /foo/bar/baz
+
+    # subpaths don't need to be normalised
+    append /foo "./bar//baz/./"
+    => /foo/bar/baz
+
+    # can append to root directory
+    append /. "foo/bar"
+    => /foo/bar
+
+    # first argument needs to be a path value type
+    append "/foo" "bar"
+    => <error>
+
+    # second argument needs to be a valid subpath string
+    append /foo /bar
+    => <error>
+    append /foo ""
+    => <error>
+    append /foo "/bar"
+    => <error>
+    append /foo "../bar"
+    => <error>
+    ```
+
+    :::
   */
   append =
     # The absolute path to append to
@@ -219,7 +239,7 @@ in
           ${subpathInvalidReason subpath}'';
     path + ("/" + subpath);
 
-  /*
+  /**
     Whether the first path is a component-wise prefix of the second path.
 
     Laws:
@@ -228,18 +248,34 @@ in
 
     - `hasPrefix` is a [non-strict partial order](https://en.wikipedia.org/wiki/Partially_ordered_set#Non-strict_partial_order) over the set of all path values.
 
-    Type:
-      hasPrefix :: Path -> Path -> Bool
+    # Inputs
 
-    Example:
-      hasPrefix /foo /foo/bar
-      => true
-      hasPrefix /foo /foo
-      => true
-      hasPrefix /foo/bar /foo
-      => false
-      hasPrefix /. /foo
-      => true
+    `path1`
+
+    : 1\. Function argument
+
+    # Type
+
+    ```
+    hasPrefix :: Path -> Path -> Bool
+    ```
+
+    # Examples
+    :::{.example}
+    ## `hasPrefix` usage example
+
+    ```nix
+    hasPrefix /foo /foo/bar
+    => true
+    hasPrefix /foo /foo
+    => true
+    hasPrefix /foo/bar /foo
+    => false
+    hasPrefix /. /foo
+    => true
+    ```
+
+    :::
   */
   hasPrefix =
     path1:
@@ -261,7 +297,7 @@ in
     take (length path1Deconstructed.components) path2Deconstructed.components
     == path1Deconstructed.components;
 
-  /*
+  /**
     Remove the first path as a component-wise prefix from the second path.
     The result is a [normalised subpath string](#function-library-lib.path.subpath.normalise).
 
@@ -271,18 +307,34 @@ in
 
           removePrefix p (append p s) == subpath.normalise s
 
-    Type:
-      removePrefix :: Path -> Path -> String
+    # Inputs
 
-    Example:
-      removePrefix /foo /foo/bar/baz
-      => "./bar/baz"
-      removePrefix /foo /foo
-      => "./."
-      removePrefix /foo/bar /foo
-      => <error>
-      removePrefix /. /foo
-      => "./foo"
+    `path1`
+
+    : 1\. Function argument
+
+    # Type
+
+    ```
+    removePrefix :: Path -> Path -> String
+    ```
+
+    # Examples
+    :::{.example}
+    ## `removePrefix` usage example
+
+    ```nix
+    removePrefix /foo /foo/bar/baz
+    => "./bar/baz"
+    removePrefix /foo /foo
+    => "./."
+    removePrefix /foo/bar /foo
+    => <error>
+    removePrefix /. /foo
+    => "./foo"
+    ```
+
+    :::
   */
   removePrefix =
     path1:
@@ -310,7 +362,7 @@ in
           second argument: "${toString path2}" with root "${toString path2Deconstructed.root}"'';
     joinRelPath components;
 
-  /*
+  /**
     Split the filesystem root from a [path](https://nixos.org/manual/nix/stable/language/values.html#type-path).
     The result is an attribute set with these attributes:
     - `root`: The filesystem root of the path, meaning that this directory has no parent directory.
@@ -328,22 +380,38 @@ in
 
           dirOf (splitRoot p).root == (splitRoot p).root
 
-    Type:
-      splitRoot :: Path -> { root :: Path, subpath :: String }
+    # Inputs
 
-    Example:
-      splitRoot /foo/bar
-      => { root = /.; subpath = "./foo/bar"; }
+    `path`
 
-      splitRoot /.
-      => { root = /.; subpath = "./."; }
+    : The path to split the root off of
 
-      # Nix neutralises `..` path components for all path values automatically
-      splitRoot /foo/../bar
-      => { root = /.; subpath = "./bar"; }
+    # Type
 
-      splitRoot "/foo/bar"
-      => <error>
+    ```
+    splitRoot :: Path -> { root :: Path, subpath :: String }
+    ```
+
+    # Examples
+    :::{.example}
+    ## `splitRoot` usage example
+
+    ```nix
+    splitRoot /foo/bar
+    => { root = /.; subpath = "./foo/bar"; }
+
+    splitRoot /.
+    => { root = /.; subpath = "./."; }
+
+    # Nix neutralises `..` path components for all path values automatically
+    splitRoot /foo/../bar
+    => { root = /.; subpath = "./bar"; }
+
+    splitRoot "/foo/bar"
+    => <error>
+    ```
+
+    :::
   */
   splitRoot =
     # The path to split the root off of
@@ -358,7 +426,7 @@ in
       subpath = joinRelPath deconstructed.components;
     };
 
-  /*
+  /**
     Whether a [path](https://nixos.org/manual/nix/stable/language/values.html#type-path)
     has a [store path](https://nixos.org/manual/nix/stable/store/store-path.html#store-path)
     as a prefix.
@@ -371,33 +439,49 @@ in
     which occur when Nix files in the store use relative path expressions.
     :::
 
-    Type:
-      hasStorePathPrefix :: Path -> Bool
+    # Inputs
 
-    Example:
-      # Subpaths of derivation outputs have a store path as a prefix
-      hasStorePathPrefix /nix/store/nvl9ic0pj1fpyln3zaqrf4cclbqdfn1j-foo/bar/baz
-      => true
+    `path`
 
-      # The store directory itself is not a store path
-      hasStorePathPrefix /nix/store
-      => false
+    : 1\. Function argument
 
-      # Derivation outputs are store paths themselves
-      hasStorePathPrefix /nix/store/nvl9ic0pj1fpyln3zaqrf4cclbqdfn1j-foo
-      => true
+    # Type
 
-      # Paths outside the Nix store don't have a store path prefix
-      hasStorePathPrefix /home/user
-      => false
+    ```
+    hasStorePathPrefix :: Path -> Bool
+    ```
 
-      # Not all paths under the Nix store are store paths
-      hasStorePathPrefix /nix/store/.links/10gg8k3rmbw8p7gszarbk7qyd9jwxhcfq9i6s5i0qikx8alkk4hq
-      => false
+    # Examples
+    :::{.example}
+    ## `hasStorePathPrefix` usage example
 
-      # Store derivations are also store paths themselves
-      hasStorePathPrefix /nix/store/nvl9ic0pj1fpyln3zaqrf4cclbqdfn1j-foo.drv
-      => true
+    ```nix
+    # Subpaths of derivation outputs have a store path as a prefix
+    hasStorePathPrefix /nix/store/nvl9ic0pj1fpyln3zaqrf4cclbqdfn1j-foo/bar/baz
+    => true
+
+    # The store directory itself is not a store path
+    hasStorePathPrefix /nix/store
+    => false
+
+    # Derivation outputs are store paths themselves
+    hasStorePathPrefix /nix/store/nvl9ic0pj1fpyln3zaqrf4cclbqdfn1j-foo
+    => true
+
+    # Paths outside the Nix store don't have a store path prefix
+    hasStorePathPrefix /home/user
+    => false
+
+    # Not all paths under the Nix store are store paths
+    hasStorePathPrefix /nix/store/.links/10gg8k3rmbw8p7gszarbk7qyd9jwxhcfq9i6s5i0qikx8alkk4hq
+    => false
+
+    # Store derivations are also store paths themselves
+    hasStorePathPrefix /nix/store/nvl9ic0pj1fpyln3zaqrf4cclbqdfn1j-foo.drv
+    => true
+    ```
+
+    :::
   */
   hasStorePathPrefix =
     path:
@@ -414,7 +498,7 @@ in
       "lib.path.hasStorePathPrefix: Argument has a filesystem root (${toString deconstructed.root}) that's not /, which is currently not supported.";
     componentsHaveStorePathPrefix deconstructed.components;
 
-  /*
+  /**
     Whether a value is a valid subpath string.
 
     A subpath string points to a specific file or directory within an absolute base directory.
@@ -428,39 +512,55 @@ in
 
     - The string doesn't contain any `..` path components.
 
-    Type:
-      subpath.isValid :: String -> Bool
+    # Inputs
 
-    Example:
-      # Not a string
-      subpath.isValid null
-      => false
+    `value`
 
-      # Empty string
-      subpath.isValid ""
-      => false
+    : The value to check
 
-      # Absolute path
-      subpath.isValid "/foo"
-      => false
+    # Type
 
-      # Contains a `..` path component
-      subpath.isValid "../foo"
-      => false
+    ```
+    subpath.isValid :: String -> Bool
+    ```
 
-      # Valid subpath
-      subpath.isValid "foo/bar"
-      => true
+    # Examples
+    :::{.example}
+    ## `subpath.isValid` usage example
 
-      # Doesn't need to be normalised
-      subpath.isValid "./foo//bar/"
-      => true
+    ```nix
+    # Not a string
+    subpath.isValid null
+    => false
+
+    # Empty string
+    subpath.isValid ""
+    => false
+
+    # Absolute path
+    subpath.isValid "/foo"
+    => false
+
+    # Contains a `..` path component
+    subpath.isValid "../foo"
+    => false
+
+    # Valid subpath
+    subpath.isValid "foo/bar"
+    => true
+
+    # Doesn't need to be normalised
+    subpath.isValid "./foo//bar/"
+    => true
+    ```
+
+    :::
   */
   subpath.isValid =
     # The value to check
     value: subpathInvalidReason value == null;
 
-  /*
+  /**
     Join subpath strings together using `/`, returning a normalised subpath string.
 
     Like `concatStringsSep "/"` but safer, specifically:
@@ -492,30 +592,46 @@ in
 
           ps != [] -> subpath.join ps == subpath.normalise (concatStringsSep "/" ps)
 
-    Type:
-      subpath.join :: [ String ] -> String
+    # Inputs
 
-    Example:
-      subpath.join [ "foo" "bar/baz" ]
-      => "./foo/bar/baz"
+    `subpaths`
 
-      # normalise the result
-      subpath.join [ "./foo" "." "bar//./baz/" ]
-      => "./foo/bar/baz"
+    : The list of subpaths to join together
 
-      # passing an empty list results in the current directory
-      subpath.join [ ]
-      => "./."
+    # Type
 
-      # elements must be valid subpath strings
-      subpath.join [ /foo ]
-      => <error>
-      subpath.join [ "" ]
-      => <error>
-      subpath.join [ "/foo" ]
-      => <error>
-      subpath.join [ "../foo" ]
-      => <error>
+    ```
+    subpath.join :: [ String ] -> String
+    ```
+
+    # Examples
+    :::{.example}
+    ## `subpath.join` usage example
+
+    ```nix
+    subpath.join [ "foo" "bar/baz" ]
+    => "./foo/bar/baz"
+
+    # normalise the result
+    subpath.join [ "./foo" "." "bar//./baz/" ]
+    => "./foo/bar/baz"
+
+    # passing an empty list results in the current directory
+    subpath.join [ ]
+    => "./."
+
+    # elements must be valid subpath strings
+    subpath.join [ /foo ]
+    => <error>
+    subpath.join [ "" ]
+    => <error>
+    subpath.join [ "/foo" ]
+    => <error>
+    subpath.join [ "../foo" ]
+    => <error>
+    ```
+
+    :::
   */
   subpath.join =
     # The list of subpaths to join together
@@ -537,7 +653,7 @@ in
                 ${subpathInvalidReason path}''
       ) 0 subpaths;
 
-  /*
+  /**
     Split [a subpath](#function-library-lib.path.subpath.isValid) into its path component strings.
     Throw an error if the subpath isn't valid.
     Note that the returned path components are also [valid subpath strings](#function-library-lib.path.subpath.isValid), though they are intentionally not [normalised](#function-library-lib.path.subpath.normalise).
@@ -548,18 +664,34 @@ in
 
           subpath.join (subpath.components s) == subpath.normalise s
 
-    Type:
-      subpath.components :: String -> [ String ]
+    # Inputs
 
-    Example:
-      subpath.components "."
-      => [ ]
+    `subpath`
 
-      subpath.components "./foo//bar/./baz/"
-      => [ "foo" "bar" "baz" ]
+    : The subpath string to split into components
 
-      subpath.components "/foo"
-      => <error>
+    # Type
+
+    ```
+    subpath.components :: String -> [ String ]
+    ```
+
+    # Examples
+    :::{.example}
+    ## `subpath.components` usage example
+
+    ```nix
+    subpath.components "."
+    => [ ]
+
+    subpath.components "./foo//bar/./baz/"
+    => [ "foo" "bar" "baz" ]
+
+    subpath.components "/foo"
+    => <error>
+    ```
+
+    :::
   */
   subpath.components =
     # The subpath string to split into components
@@ -569,7 +701,7 @@ in
           ${subpathInvalidReason subpath}'';
     splitRelPath subpath;
 
-  /*
+  /**
     Normalise a subpath. Throw an error if the subpath isn't [valid](#function-library-lib.path.subpath.isValid).
 
     - Limit repeating `/` to a single one.
@@ -602,45 +734,61 @@ in
 
           builtins.tryEval (subpath.normalise p)).success == subpath.isValid p
 
-    Type:
-      subpath.normalise :: String -> String
+    # Inputs
 
-    Example:
-      # limit repeating `/` to a single one
-      subpath.normalise "foo//bar"
-      => "./foo/bar"
+    `subpath`
 
-      # remove redundant `.` components
-      subpath.normalise "foo/./bar"
-      => "./foo/bar"
+    : The subpath string to normalise
 
-      # add leading `./`
-      subpath.normalise "foo/bar"
-      => "./foo/bar"
+    # Type
 
-      # remove trailing `/`
-      subpath.normalise "foo/bar/"
-      => "./foo/bar"
+    ```
+    subpath.normalise :: String -> String
+    ```
 
-      # remove trailing `/.`
-      subpath.normalise "foo/bar/."
-      => "./foo/bar"
+    # Examples
+    :::{.example}
+    ## `subpath.normalise` usage example
 
-      # Return the current directory as `./.`
-      subpath.normalise "."
-      => "./."
+    ```nix
+    # limit repeating `/` to a single one
+    subpath.normalise "foo//bar"
+    => "./foo/bar"
 
-      # error on `..` path components
-      subpath.normalise "foo/../bar"
-      => <error>
+    # remove redundant `.` components
+    subpath.normalise "foo/./bar"
+    => "./foo/bar"
 
-      # error on empty string
-      subpath.normalise ""
-      => <error>
+    # add leading `./`
+    subpath.normalise "foo/bar"
+    => "./foo/bar"
 
-      # error on absolute path
-      subpath.normalise "/foo"
-      => <error>
+    # remove trailing `/`
+    subpath.normalise "foo/bar/"
+    => "./foo/bar"
+
+    # remove trailing `/.`
+    subpath.normalise "foo/bar/."
+    => "./foo/bar"
+
+    # Return the current directory as `./.`
+    subpath.normalise "."
+    => "./."
+
+    # error on `..` path components
+    subpath.normalise "foo/../bar"
+    => <error>
+
+    # error on empty string
+    subpath.normalise ""
+    => <error>
+
+    # error on absolute path
+    subpath.normalise "/foo"
+    => <error>
+    ```
+
+    :::
   */
   subpath.normalise =
     # The subpath string to normalise
diff --git a/lib/sources.nix b/lib/sources.nix
index 168e58225889..e165439998a1 100644
--- a/lib/sources.nix
+++ b/lib/sources.nix
@@ -18,10 +18,20 @@ let
     pathIsRegularFile
     ;
 
-  /*
+  /**
     A basic filter for `cleanSourceWith` that removes
     directories of version control system, backup files (*~)
     and some generated files.
+
+    # Inputs
+
+    `name`
+
+    : 1\. Function argument
+
+    `type`
+
+    : 2\. Function argument
   */
   cleanSourceFilter =
     name: type:
@@ -52,11 +62,24 @@ let
         (type == "unknown")
     );
 
-  /*
+  /**
     Filters a source tree removing version control files and directories using cleanSourceFilter.
 
-    Example:
-             cleanSource ./.
+    # Inputs
+
+    `src`
+
+    : 1\. Function argument
+
+    # Examples
+    :::{.example}
+    ## `cleanSource` usage example
+
+    ```nix
+    cleanSource ./.
+    ```
+
+    :::
   */
   cleanSource =
     src:
@@ -65,23 +88,30 @@ let
       inherit src;
     };
 
-  /*
+  /**
     Like `builtins.filterSource`, except it will compose with itself,
     allowing you to chain multiple calls together without any
     intermediate copies being put in the nix store.
 
-    Example:
-        lib.cleanSourceWith {
-          filter = f;
-          src = lib.cleanSourceWith {
-            filter = g;
-            src = ./.;
-          };
-        }
-        # Succeeds!
+    # Examples
+    :::{.example}
+    ## `cleanSourceWith` usage example
 
-        builtins.filterSource f (builtins.filterSource g ./.)
-        # Fails!
+    ```nix
+    lib.cleanSourceWith {
+      filter = f;
+      src = lib.cleanSourceWith {
+        filter = g;
+        src = ./.;
+      };
+    }
+    # Succeeds!
+
+    builtins.filterSource f (builtins.filterSource g ./.)
+    # Fails!
+    ```
+
+    :::
   */
   cleanSourceWith =
     {
@@ -107,10 +137,20 @@ let
       name = if name != null then name else orig.name;
     };
 
-  /*
+  /**
     Add logging to a source, for troubleshooting the filtering behavior.
-    Type:
-      sources.trace :: sourceLike -> Source
+
+    # Inputs
+
+    `src`
+
+    : Source to debug. The returned source will behave like this source, but also log its filter invocations.
+
+    # Type
+
+    ```
+    sources.trace :: sourceLike -> Source
+    ```
   */
   trace =
     # Source to debug. The returned source will behave like this source, but also log its filter invocations.
@@ -133,10 +173,28 @@ let
       satisfiesSubpathInvariant = src ? satisfiesSubpathInvariant && src.satisfiesSubpathInvariant;
     };
 
-  /*
+  /**
     Filter sources by a list of regular expressions.
 
-    Example: src = sourceByRegex ./my-subproject [".*\.py$" "^database.sql$"]
+    # Inputs
+
+    `src`
+
+    : 1\. Function argument
+
+    `regexes`
+
+    : 2\. Function argument
+
+    # Examples
+    :::{.example}
+    ## `sourceByRegex` usage example
+
+    ```nix
+    src = sourceByRegex ./my-subproject [".*\.py$" "^database.sql$"]
+    ```
+
+    :::
   */
   sourceByRegex =
     src: regexes:
@@ -155,16 +213,37 @@ let
       inherit src;
     };
 
-  /*
+  /**
     Get all files ending with the specified suffices from the given
     source directory or its descendants, omitting files that do not match
     any suffix. The result of the example below will include files like
     `./dir/module.c` and `./dir/subdir/doc.xml` if present.
 
-    Type: sourceLike -> [String] -> Source
+    # Inputs
 
-    Example:
-      sourceFilesBySuffices ./. [ ".xml" ".c" ]
+    `src`
+
+    : Path or source containing the files to be returned
+
+    `exts`
+
+    : A list of file suffix strings
+
+    # Type
+
+    ```
+    sourceLike -> [String] -> Source
+    ```
+
+    # Examples
+    :::{.example}
+    ## `sourceFilesBySuffices` usage example
+
+    ```nix
+    sourceFilesBySuffices ./. [ ".xml" ".c" ]
+    ```
+
+    :::
   */
   sourceFilesBySuffices =
     # Path or source containing the files to be returned
@@ -183,10 +262,24 @@ let
 
   pathIsGitRepo = path: (_commitIdFromGitRepoOrError path) ? value;
 
-  /*
+  /**
     Get the commit id of a git repo.
 
-    Example: commitIdFromGitRepo <nixpkgs/.git>
+    # Inputs
+
+    `path`
+
+    : 1\. Function argument
+
+    # Examples
+    :::{.example}
+    ## `commitIdFromGitRepo` usage example
+
+    ```nix
+    commitIdFromGitRepo <nixpkgs/.git>
+    ```
+
+    :::
   */
   commitIdFromGitRepo =
     path:
diff --git a/lib/strings-with-deps.nix b/lib/strings-with-deps.nix
index 900827fe0e4b..e22e19def581 100644
--- a/lib/strings-with-deps.nix
+++ b/lib/strings-with-deps.nix
@@ -1,44 +1,44 @@
 { lib }:
-/*
-Usage:
+/**
+  Usage:
 
-  You define you custom builder script by adding all build steps to a list.
-  for example:
-       builder = writeScript "fsg-4.4-builder"
-               (textClosure [doUnpack addInputs preBuild doMake installPhase doForceShare]);
+    You define you custom builder script by adding all build steps to a list.
+    for example:
+         builder = writeScript "fsg-4.4-builder"
+                 (textClosure [doUnpack addInputs preBuild doMake installPhase doForceShare]);
 
-  a step is defined by noDepEntry, fullDepEntry or packEntry.
-  To ensure that prerequisite are met those are added before the task itself by
-  textClosureDupList. Duplicated items are removed again.
+    a step is defined by noDepEntry, fullDepEntry or packEntry.
+    To ensure that prerequisite are met those are added before the task itself by
+    textClosureDupList. Duplicated items are removed again.
 
-  See trace/nixpkgs/trunk/pkgs/top-level/builder-defs.nix for some predefined build steps
+    See trace/nixpkgs/trunk/pkgs/top-level/builder-defs.nix for some predefined build steps
 
-  Attention:
+    Attention:
 
-  let
-    pkgs = (import <nixpkgs>) {};
-  in let
-    inherit (pkgs.stringsWithDeps) fullDepEntry packEntry noDepEntry textClosureMap;
-    inherit (pkgs.lib) id;
+    let
+      pkgs = (import <nixpkgs>) {};
+    in let
+      inherit (pkgs.stringsWithDeps) fullDepEntry packEntry noDepEntry textClosureMap;
+      inherit (pkgs.lib) id;
 
-    nameA = noDepEntry "Text a";
-    nameB = fullDepEntry "Text b" ["nameA"];
-    nameC = fullDepEntry "Text c" ["nameA"];
+      nameA = noDepEntry "Text a";
+      nameB = fullDepEntry "Text b" ["nameA"];
+      nameC = fullDepEntry "Text c" ["nameA"];
 
-    stages = {
-      nameHeader = noDepEntry "#! /bin/sh \n";
-      inherit nameA nameB nameC;
-    };
-  in
-    textClosureMap id stages
-    [ "nameHeader" "nameA" "nameB" "nameC"
-      nameC # <- added twice. add a dep entry if you know that it will be added once only [1]
-      "nameB" # <- this will not be added again because the attr name (reference) is used
-    ]
+      stages = {
+        nameHeader = noDepEntry "#! /bin/sh \n";
+        inherit nameA nameB nameC;
+      };
+    in
+      textClosureMap id stages
+      [ "nameHeader" "nameA" "nameB" "nameC"
+        nameC # <- added twice. add a dep entry if you know that it will be added once only [1]
+        "nameB" # <- this will not be added again because the attr name (reference) is used
+      ]
 
-  # result: Str("#! /bin/sh \n\nText a\nText b\nText c\nText c",[])
+    # result: Str("#! /bin/sh \n\nText a\nText b\nText c\nText c",[])
 
-  [1] maybe this behaviour should be removed to keep things simple (?)
+    [1] maybe this behaviour should be removed to keep things simple (?)
 */
 
 let
diff --git a/lib/tests/modules.sh b/lib/tests/modules.sh
index 243fbce1ecb5..d6614822ea00 100755
--- a/lib/tests/modules.sh
+++ b/lib/tests/modules.sh
@@ -398,6 +398,10 @@ checkConfigError 'infinite recursion encountered' config.nonLazyResult ./lazy-at
 checkConfigOutput '^"mergedName.<id>.nested"$' config.result ./name-merge-attrsWith-1.nix
 checkConfigError 'The option .mergedName. in .*\.nix. is already declared in .*\.nix' config.mergedName ./name-merge-attrsWith-2.nix
 
+# Test the attrsOf functor.wrapped warning
+# shellcheck disable=2016
+NIX_ABORT_ON_WARN=1 checkConfigError 'The deprecated `type.functor.wrapped` attribute of the option `mergedLazyLazy` is accessed, use `type.nestedTypes.elemType` instead.' options.mergedLazyLazy.type.functor.wrapped ./lazy-attrsWith.nix
+
 # Even with multiple assignments, a type error should be thrown if any of them aren't valid
 checkConfigError 'A definition for option .* is not of type .*' \
   config.value ./declare-int-unsigned-value.nix ./define-value-list.nix ./define-value-int-positive.nix
diff --git a/lib/versions.nix b/lib/versions.nix
index 32b4b5fbf945..2355655f179a 100644
--- a/lib/versions.nix
+++ b/lib/versions.nix
@@ -3,62 +3,138 @@
 
 rec {
 
-  /*
+  /**
     Break a version string into its component parts.
 
-    Example:
-      splitVersion "1.2.3"
-      => ["1" "2" "3"]
+    # Examples
+    :::{.example}
+    ## `splitVersion` usage example
+
+    ```nix
+    splitVersion "1.2.3"
+    => ["1" "2" "3"]
+    ```
+
+    :::
   */
   splitVersion = builtins.splitVersion;
 
-  /*
+  /**
     Get the major version string from a string.
 
-    Example:
-      major "1.2.3"
-      => "1"
+    # Inputs
+
+    `v`
+
+    : 1\. Function argument
+
+    # Examples
+    :::{.example}
+    ## `major` usage example
+
+    ```nix
+    major "1.2.3"
+    => "1"
+    ```
+
+    :::
   */
   major = v: builtins.elemAt (splitVersion v) 0;
 
-  /*
+  /**
     Get the minor version string from a string.
 
-    Example:
-      minor "1.2.3"
-      => "2"
+    # Inputs
+
+    `v`
+
+    : 1\. Function argument
+
+    # Examples
+    :::{.example}
+    ## `minor` usage example
+
+    ```nix
+    minor "1.2.3"
+    => "2"
+    ```
+
+    :::
   */
   minor = v: builtins.elemAt (splitVersion v) 1;
 
-  /*
+  /**
     Get the patch version string from a string.
 
-    Example:
-      patch "1.2.3"
-      => "3"
+    # Inputs
+
+    `v`
+
+    : 1\. Function argument
+
+    # Examples
+    :::{.example}
+    ## `patch` usage example
+
+    ```nix
+    patch "1.2.3"
+    => "3"
+    ```
+
+    :::
   */
   patch = v: builtins.elemAt (splitVersion v) 2;
 
-  /*
+  /**
     Get string of the first two parts (major and minor)
     of a version string.
 
-    Example:
-      majorMinor "1.2.3"
-      => "1.2"
+    # Inputs
+
+    `v`
+
+    : 1\. Function argument
+
+    # Examples
+    :::{.example}
+    ## `majorMinor` usage example
+
+    ```nix
+    majorMinor "1.2.3"
+    => "1.2"
+    ```
+
+    :::
   */
   majorMinor = v: builtins.concatStringsSep "." (lib.take 2 (splitVersion v));
 
-  /*
+  /**
     Pad a version string with zeros to match the given number of components.
 
-    Example:
-      pad 3 "1.2"
-      => "1.2.0"
-      pad 3 "1.3-rc1"
-      => "1.3.0-rc1"
-      pad 3 "1.2.3.4"
-      => "1.2.3"
+    # Inputs
+
+    `n`
+
+    : 1\. Function argument
+
+    `version`
+
+    : 2\. Function argument
+
+    # Examples
+    :::{.example}
+    ## `pad` usage example
+
+    ```nix
+    pad 3 "1.2"
+    => "1.2.0"
+    pad 3 "1.3-rc1"
+    => "1.3.0-rc1"
+    pad 3 "1.2.3.4"
+    => "1.2.3"
+    ```
+
+    :::
   */
   pad =
     n: version:
diff --git a/maintainers/scripts/kde/generate-sources.py b/maintainers/scripts/kde/generate-sources.py
index b03ef3cc5f6b..e4241cced120 100755
--- a/maintainers/scripts/kde/generate-sources.py
+++ b/maintainers/scripts/kde/generate-sources.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i python3 -p "python3.withPackages(ps: [ ps.beautifulsoup4 ps.click ps.httpx ps.jinja2 ps.pyyaml ])"
+#!nix-shell -i python3 -p "python3.withPackages(ps: [ ps.beautifulsoup4 ps.click ps.httpx ps.jinja2 ps.packaging ps.pyyaml ])"
 import base64
 import binascii
 import json
@@ -11,6 +11,7 @@ import bs4
 import click
 import httpx
 import jinja2
+import packaging.version as v
 
 import utils
 
@@ -104,6 +105,12 @@ def main(set: str, version: str, nixpkgs: pathlib.Path, sources_url: Optional[st
         hash = client.get(url + ".sha256").text.split(" ", maxsplit=1)[0]
         assert hash
 
+        if existing := results.get(project_name):
+            old_version = existing["version"]
+            if v.parse(old_version) > v.parse(version):
+                print(f"{project_name} {old_version} is newer than {version}, skipping...")
+                continue
+
         results[project_name] = {
             "version": version,
             "url": "mirror://kde" + urlparse(url).path,
diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index bdb71156dc38..c655d4b993b7 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -69,6 +69,8 @@
 
 - [Homer](https://homer-demo.netlify.app/), a very simple static homepage for your server. Available as [services.homer](options.html#opt-services.homer).
 
+- [Ghidra](https://ghidra-sre.org/), a software reverse engineering (SRE) suite of tools. Available as [programs.ghidra](options.html#opt-programs.ghidra).
+
 - [Omnom](https://github.com/asciimoo/omnom), a webpage bookmarking and snapshotting service. Available as [services.omnom](options.html#opt-services.omnom.enable).
 
 - [Yggdrasil-Jumper](https://github.com/one-d-wide/yggdrasil-jumper) is an independent project that aims to transparently reduce latency of a connection over Yggdrasil network, utilizing NAT traversal to automatically bypass intermediary nodes.
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 41b2c21ba690..14aed8fdb3af 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -209,6 +209,7 @@
   ./programs/gamescope.nix
   ./programs/gdk-pixbuf.nix
   ./programs/geary.nix
+  ./programs/ghidra.nix
   ./programs/git.nix
   ./programs/git-worktree-switcher.nix
   ./programs/gnome-disks.nix
diff --git a/nixos/modules/programs/ghidra.nix b/nixos/modules/programs/ghidra.nix
new file mode 100644
index 000000000000..a832a2161e76
--- /dev/null
+++ b/nixos/modules/programs/ghidra.nix
@@ -0,0 +1,47 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.programs.ghidra;
+in
+{
+  options.programs.ghidra = {
+    enable = lib.mkEnableOption "Ghidra, a software reverse engineering (SRE) suite of tools";
+
+    gdb = lib.mkOption {
+      default = true;
+      type = lib.types.bool;
+      description = ''
+        Whether to add to gdbinit the python modules required to make Ghidra's debugger work.
+      '';
+    };
+
+    package = lib.mkPackageOption pkgs "ghidra" { example = "ghidra-bin"; };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment = {
+      systemPackages = [ cfg.package ];
+
+      etc = lib.mkIf cfg.gdb {
+        "gdb/gdbinit.d/ghidra-modules.gdb".text = with pkgs.python3.pkgs; ''
+          python
+          import sys
+          [sys.path.append(p) for p in "${
+            (makePythonPath [
+              psutil
+              protobuf
+            ])
+          }".split(":")]
+          end
+        '';
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ govanify ];
+}
diff --git a/nixos/modules/services/misc/moonraker.nix b/nixos/modules/services/misc/moonraker.nix
index 620eb71bd74f..43d46a690915 100644
--- a/nixos/modules/services/misc/moonraker.nix
+++ b/nixos/modules/services/misc/moonraker.nix
@@ -110,6 +110,8 @@ in
           for details on what clients are able to do.
         '';
       };
+
+      analysis.enable = lib.mkEnableOption "Runtime analysis with klipper-estimator";
     };
   };
 
@@ -170,9 +172,15 @@ in
       in
       format.generate "moonraker.cfg" fullConfig;
 
-    systemd.tmpfiles.rules = [
-      "d '${cfg.stateDir}' - ${cfg.user} ${cfg.group} - -"
-    ] ++ lib.optional (cfg.configDir != null) "d '${cfg.configDir}' - ${cfg.user} ${cfg.group} - -";
+    systemd.tmpfiles.rules =
+      [
+        "d '${cfg.stateDir}' - ${cfg.user} ${cfg.group} - -"
+      ]
+      ++ lib.optional (cfg.configDir != null) "d '${cfg.configDir}' - ${cfg.user} ${cfg.group} - -"
+      ++ lib.optionals cfg.analysis.enable [
+        "d '${cfg.stateDir}/tools/klipper_estimator' - ${cfg.user} ${cfg.group} - -"
+        "L+ '${cfg.stateDir}/tools/klipper_estimator/klipper_estimator_linux' - - - - ${lib.getExe pkgs.klipper-estimator}"
+      ];
 
     systemd.services.moonraker = {
       description = "Moonraker, an API web server for Klipper";
@@ -206,10 +214,16 @@ in
       };
     };
 
-    # set this to false, otherwise we'll get a warning indicating that `/etc/klipper.cfg`
-    # is not located in the moonraker config directory.
-    services.moonraker.settings = lib.mkIf (!config.services.klipper.mutableConfig) {
-      file_manager.check_klipper_config_path = false;
+    services.moonraker.settings = {
+      # set this to false, otherwise we'll get a warning indicating that `/etc/klipper.cfg`
+      # is not located in the moonraker config directory.
+      file_manager.check_klipper_config_path = lib.mkIf (!config.services.klipper.mutableConfig) false;
+
+      # enable analysis with our own klipper-estimator, disable updating it
+      analysis = lib.mkIf (cfg.analysis.enable) {
+        platform = "linux";
+        enable_estimator_updates = false;
+      };
     };
 
     security.polkit.extraConfig = lib.optionalString cfg.allowSystemControl ''
diff --git a/nixos/modules/system/activation/switch-to-configuration.pl b/nixos/modules/system/activation/switch-to-configuration.pl
index 672291541d03..8eee52bfa332 100755
--- a/nixos/modules/system/activation/switch-to-configuration.pl
+++ b/nixos/modules/system/activation/switch-to-configuration.pl
@@ -95,7 +95,7 @@ if (!-f "/etc/NIXOS" && (read_file("/etc/os-release", err_mode => "quiet") // ""
 
 make_path("/run/nixos", { mode => oct(755) });
 open(my $stc_lock, '>>', '/run/nixos/switch-to-configuration.lock') or die "Could not open lock - $!";
-flock($stc_lock, LOCK_EX) or die "Could not acquire lock - $!";
+flock($stc_lock, LOCK_EX|LOCK_NB) or die "Could not acquire lock - $!";
 openlog("nixos", "", LOG_USER);
 
 # run pre-switch checks
diff --git a/nixos/modules/virtualisation/nixos-containers.nix b/nixos/modules/virtualisation/nixos-containers.nix
index d2abb17f447d..9e999e479638 100644
--- a/nixos/modules/virtualisation/nixos-containers.nix
+++ b/nixos/modules/virtualisation/nixos-containers.nix
@@ -118,7 +118,7 @@ let
       NIX_BIND_OPT=""
       if [ -n "$PRIVATE_USERS" ]; then
         extraFlags+=("--private-users=$PRIVATE_USERS")
-        if [ "$PRIVATE_USERS" = "pick" ] || ( [ "$PRIVATE_USERS" != "identity" ] && [ "$PRIVATE_USERS" -gt 0 ] ); then
+        if [ "$PRIVATE_USERS" = "pick" ] || { [ "$PRIVATE_USERS" != "identity" ] && [ "$PRIVATE_USERS" -gt 0 ]; }; then
           # when user namespacing is enabled, we use `idmap` mount option
           # so that bind mounts under /nix get proper owner (and not nobody/nogroup).
           NIX_BIND_OPT=":idmap"
diff --git a/nixos/tests/switch-test.nix b/nixos/tests/switch-test.nix
index 4ad08b726bf5..ba1a6f329cd3 100644
--- a/nixos/tests/switch-test.nix
+++ b/nixos/tests/switch-test.nix
@@ -732,6 +732,23 @@ in {
         out = switch_to_specialisation("${machine}", "modifiedSystemConf")
         assert_contains(out, "starting the following units: ${dbusService}\n")
 
+    with subtest("aborts on already locked lock file"):
+        (exitcode, _) = machine.execute(
+            'flock -x --nb /run/nixos/switch-to-configuration.lock -c "${otherSystem}/bin/switch-to-configuration test"',
+            timeout=5
+        )
+        # See man timeout, exit codes above 124 come from the timeout command
+        # We want to make sure that stc actually exited with an error code,
+        # if instead we hit the timeout, then it means that stc hangs, which is
+        # what we don't want
+        # TODO: We cannot match on the exact exit code since it's not consistent between
+        # stc and stc-ng, since errno/last_os_error is not a very stable interface,
+        # we should probably get rid of that in stc-ng once we got rid of the
+        # perl implementation
+        assert exitcode < 124, \
+          "switch-to-configuration did not abort as expected, " + \
+          f"probably it timed out instead (exit code: {exitcode}), 124 means timeout"
+
     with subtest("fstab mounts"):
         switch_to_specialisation("${machine}", "")
         # add a mountpoint
diff --git a/pkgs/applications/misc/klipper-estimator/default.nix b/pkgs/applications/misc/klipper-estimator/default.nix
index 967eac699f01..609414f21d7f 100644
--- a/pkgs/applications/misc/klipper-estimator/default.nix
+++ b/pkgs/applications/misc/klipper-estimator/default.nix
@@ -24,6 +24,8 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-wMgFkzgoHjvE+5t+cA5OW2COXbUj/5tWXz0Zp9cd5lw=";
 
+  env.TOOL_VERSION = "v${version}";
+
   buildInputs =
     [ openssl ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
diff --git a/pkgs/by-name/dd/ddcutil/package.nix b/pkgs/by-name/dd/ddcutil/package.nix
index cd0ad0b31990..12754468dea7 100644
--- a/pkgs/by-name/dd/ddcutil/package.nix
+++ b/pkgs/by-name/dd/ddcutil/package.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ddcutil";
-  version = "2.1.4";
+  version = "2.2.0";
 
   src = fetchurl {
     url = "https://www.ddcutil.com/tarballs/ddcutil-${version}.tar.gz";
-    hash = "sha256-4U/igqtgw2rwyuhEkV1pWYPIyNZEt2N6hlXJ9bDUyRw=";
+    hash = "sha256-7Qx58cWCafSRuNyhcdSSuf7xM0JzcOG6UFiWa5K5VS4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fi/filesender/package.nix b/pkgs/by-name/fi/filesender/package.nix
index 32eb0249d55b..bfaa8b09db89 100644
--- a/pkgs/by-name/fi/filesender/package.nix
+++ b/pkgs/by-name/fi/filesender/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "filesender";
-  version = "2.51";
+  version = "2.52";
 
   src = fetchFromGitHub {
     owner = "filesender";
     repo = "filesender";
     tag = "filesender-${finalAttrs.version}";
-    hash = "sha256-HQ5/Df4F4Gwon0OhlIRTZ0NHTb9SJgQD+BDbH/aIeKw=";
+    hash = "sha256-Nl/3Kpo67dr5t/9+EWTyPmzi+sqW8pg5lzLC/jVtCkg=";
   };
 
   patches = [
diff --git a/pkgs/by-name/fl/fluidd/hardcode-version.patch b/pkgs/by-name/fl/fluidd/hardcode-version.patch
new file mode 100644
index 000000000000..4b12a7823464
--- /dev/null
+++ b/pkgs/by-name/fl/fluidd/hardcode-version.patch
@@ -0,0 +1,15 @@
+diff --git a/vite.config.inject-version.ts b/vite.config.inject-version.ts
+index d1321fcf..fb3e4c6d 100644
+--- a/vite.config.inject-version.ts
++++ b/vite.config.inject-version.ts
+@@ -29,9 +29,7 @@ const vitePluginInjectVersion = (): Plugin => {
+   return {
+     name: 'version',
+     config: () => {
+-      const git_hash = child_process
+-        .execSync('git rev-parse --short HEAD')
+-        .toString()
++      const git_hash = '@version@'
+
+       return {
+         define: {
diff --git a/pkgs/by-name/fl/fluidd/package.nix b/pkgs/by-name/fl/fluidd/package.nix
index 275be923db0e..dea7aeb2f819 100644
--- a/pkgs/by-name/fl/fluidd/package.nix
+++ b/pkgs/by-name/fl/fluidd/package.nix
@@ -1,28 +1,33 @@
-{ lib, stdenvNoCC, fetchurl, unzip, nixosTests }:
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  replaceVars,
+  nixosTests,
+}:
 
-stdenvNoCC.mkDerivation rec {
+buildNpmPackage rec {
   pname = "fluidd";
-  version = "1.31.4";
+  version = "1.32.3";
 
-  src = fetchurl {
-    name = "fluidd-v${version}.zip";
-    url = "https://github.com/fluidd-core/fluidd/releases/download/v${version}/fluidd.zip";
-    sha256 = "sha256-gqwVZg37pZA+XjT3FpTMYkrOIT1KKUN6upg7e1vh1t0=";
+  src = fetchFromGitHub {
+    owner = "fluidd-core";
+    repo = "fluidd";
+    tag = "v${version}";
+    hash = "sha256-3sfjwwfanmRy45hrjG9X0lYVPsC41S2oZkbISz6YzYo=";
   };
 
-  nativeBuildInputs = [ unzip ];
+  patches = [
+    (replaceVars ./hardcode-version.patch {
+      inherit version;
+    })
+  ];
 
-  dontConfigure = true;
-  dontBuild = true;
-
-  unpackPhase = ''
-    mkdir fluidd
-    unzip $src -d fluidd
-  '';
+  npmDepsHash = "sha256-bwdlBXq1Z6ZoxwGhfMtPQy74/oxRt2aGxh+HXjREWMQ=";
 
   installPhase = ''
     mkdir -p $out/share/fluidd
-    cp -r fluidd $out/share/fluidd/htdocs
+    cp -r dist $out/share/fluidd/htdocs
   '';
 
   passthru.tests = { inherit (nixosTests) fluidd; };
diff --git a/pkgs/by-name/h2/h2o/package.nix b/pkgs/by-name/h2/h2o/package.nix
index d908919589d4..66f1e5712bef 100644
--- a/pkgs/by-name/h2/h2o/package.nix
+++ b/pkgs/by-name/h2/h2o/package.nix
@@ -13,7 +13,7 @@
   libuv,
   wslay,
   zlib,
-  withMruby ? false,
+  withMruby ? true,
   bison,
   ruby,
 }:
diff --git a/pkgs/by-name/li/libdaq/package.nix b/pkgs/by-name/li/libdaq/package.nix
index c182572de779..36c4df30b053 100644
--- a/pkgs/by-name/li/libdaq/package.nix
+++ b/pkgs/by-name/li/libdaq/package.nix
@@ -5,6 +5,7 @@
   autoreconfHook,
   pkg-config,
   libpcap,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -46,6 +47,8 @@ stdenv.mkDerivation (finalAttrs: {
     done
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Data AcQuisition library (libDAQ), for snort packet I/O";
     homepage = "https://www.snort.org";
@@ -53,6 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
       aycanirican
       brianmcgillion
     ];
+    changelog = "https://github.com/snort3/libdaq/releases/tag/v${finalAttrs.version}/changelog.md";
     license = lib.licenses.gpl2;
     outputsToInstall = [
       "lib"
diff --git a/pkgs/by-name/mo/moonraker/package.nix b/pkgs/by-name/mo/moonraker/package.nix
index 7e4f3bd45acb..300b4edfedff 100644
--- a/pkgs/by-name/mo/moonraker/package.nix
+++ b/pkgs/by-name/mo/moonraker/package.nix
@@ -25,7 +25,7 @@ let
       zeroconf
       preprocess-cancellation
       jinja2
-      dbus-next
+      dbus-fast
       apprise
       python-periphery
       ldap3
@@ -35,13 +35,13 @@ let
 in
 stdenvNoCC.mkDerivation rec {
   pname = "moonraker";
-  version = "0.9.3-unstable-2024-11-17";
+  version = "0.9.3-unstable-2025-02-18";
 
   src = fetchFromGitHub {
     owner = "Arksine";
     repo = "moonraker";
-    rev = "ccfe32f2368a5ff6c2497478319909daeeeb8edf";
-    sha256 = "sha256-aCYE3EmflMRIHnGnkZ/0+zScVA5liHSbavScQ7XRf/4=";
+    rev = "62051108ea16d5db5fa382651e01a51d89c041c9";
+    sha256 = "sha256-mKbWnEnpCWhoiYY9T5HrNI0vVGM4LwrJqAzhJa+Rj4Y=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/op/opencomposite/package.nix b/pkgs/by-name/op/opencomposite/package.nix
index 620f58daf5d8..72263a013b89 100644
--- a/pkgs/by-name/op/opencomposite/package.nix
+++ b/pkgs/by-name/op/opencomposite/package.nix
@@ -16,14 +16,14 @@
 
 stdenv.mkDerivation {
   pname = "opencomposite";
-  version = "0-unstable-2025-01-23";
+  version = "0-unstable-2025-02-08";
 
   src = fetchFromGitLab {
     owner = "znixian";
     repo = "OpenOVR";
-    rev = "d37c9e7a4bc41f2b636282064eb39efb9e50d48b";
+    rev = "175e3b3a5408ff120bd21036faa703deb57159fc";
     fetchSubmodules = true;
-    hash = "sha256-Bc+lQdQeiojaHjglj7gZhXB5BMho0vb/HErfh50pcmA=";
+    hash = "sha256-kwu8eM/rQBcZfs91loh7QAB46a01F9n5Xm1DmMd53MQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/op/optinix/package.nix b/pkgs/by-name/op/optinix/package.nix
index 1f0e0466b5f9..044b190e4e20 100644
--- a/pkgs/by-name/op/optinix/package.nix
+++ b/pkgs/by-name/op/optinix/package.nix
@@ -3,6 +3,7 @@
   fetchFromGitLab,
   buildGoModule,
   installShellFiles,
+  nix-update-script,
 }:
 buildGoModule rec {
   pname = "optinix";
@@ -11,7 +12,7 @@ buildGoModule rec {
   src = fetchFromGitLab {
     owner = "hmajid2301";
     repo = "optinix";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-OuzLTygfJj1ILT0lAcBC28vU5YLuq0ErZHsLHoQNWBA=";
   };
 
@@ -31,11 +32,16 @@ buildGoModule rec {
       --zsh <($out/bin/optinix completion zsh)
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Tool for searching options in Nix";
     homepage = "https://gitlab.com/hmajid2301/optinix";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ hmajid2301 ];
+    maintainers = with lib.maintainers; [
+      hmajid2301
+      brianmcgillion
+    ];
     changelog = "https://gitlab.com/hmajid2301/optinix/-/releases/v${version}";
     mainProgram = "optinix";
   };
diff --git a/pkgs/by-name/re/retrospy/package.nix b/pkgs/by-name/re/retrospy/package.nix
index 9b0d85e0f082..3f4e951ed29a 100644
--- a/pkgs/by-name/re/retrospy/package.nix
+++ b/pkgs/by-name/re/retrospy/package.nix
@@ -8,13 +8,13 @@
   runCommandLocal,
 }:
 let
-  version = "6.8.2";
+  version = "6.8.3";
 
   src = fetchFromGitHub {
     owner = "retrospy";
     repo = "RetroSpy";
     rev = "v${version}";
-    hash = "sha256-0f4rtBGjPSdCl3M72YPD6A6T4pOnpm9fde6ktvHcPLY=";
+    hash = "sha256-NuLfFSRGOIB6h4b5XZ7Qs8y5L+fqozQfMr8q0xZAurQ=";
   };
 
   executables = [
diff --git a/pkgs/by-name/sn/snort/package.nix b/pkgs/by-name/sn/snort/package.nix
index 0fd10533ad91..390edbac2cd8 100644
--- a/pkgs/by-name/sn/snort/package.nix
+++ b/pkgs/by-name/sn/snort/package.nix
@@ -14,17 +14,18 @@
   pkg-config,
   zlib,
   xz,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "snort";
-  version = "3.6.3.0";
+  version = "3.7.0.0";
 
   src = fetchFromGitHub {
     owner = "snort3";
     repo = "snort3";
-    rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-loMmmpoaEncW31FUIE9Zf9w635Prvke6vCY+mIt6oGI=";
+    tag = finalAttrs.version;
+    hash = "sha256-KwKgKY+zcH7bZrtfMpkwb0LopGeImTwOf79hqZeYv/k=";
   };
 
   nativeBuildInputs = [
@@ -53,6 +54,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Network intrusion prevention and detection system (IDS/IPS)";
     homepage = "https://www.snort.org";
@@ -60,6 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
       aycanirican
       brianmcgillion
     ];
+    changelog = "https://github.com/snort3/snort3/releases/tag/${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.gpl2;
     platforms = with lib.platforms; linux;
   };
diff --git a/pkgs/by-name/sw/switch-to-configuration-ng/src/src/main.rs b/pkgs/by-name/sw/switch-to-configuration-ng/src/src/main.rs
index a64d8566225b..64fc71e85aed 100644
--- a/pkgs/by-name/sw/switch-to-configuration-ng/src/src/main.rs
+++ b/pkgs/by-name/sw/switch-to-configuration-ng/src/src/main.rs
@@ -1037,7 +1037,7 @@ fn do_system_switch(action: Action) -> anyhow::Result<()> {
         die();
     };
 
-    let Ok(_lock) = Flock::lock(lock, FlockArg::LockExclusive) else {
+    let Ok(_lock) = Flock::lock(lock, FlockArg::LockExclusiveNonblock) else {
         eprintln!("Could not acquire lock");
         die();
     };
diff --git a/pkgs/development/python-modules/aiocomelit/default.nix b/pkgs/development/python-modules/aiocomelit/default.nix
index fe285194d4b5..cd329446bef3 100644
--- a/pkgs/development/python-modules/aiocomelit/default.nix
+++ b/pkgs/development/python-modules/aiocomelit/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "aiocomelit";
-  version = "0.10.1";
+  version = "0.11.0";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "chemelli74";
     repo = "aiocomelit";
     tag = "v${version}";
-    hash = "sha256-1XH2RwdnXDi57FUf1R7HLiFFNxyT3A6MroZ+kk1xIGo=";
+    hash = "sha256-6eTeBisAt5vP1+140qfMJ3GqSqclzHGiNpN3lzBvoqQ=";
   };
 
   build-system = [ poetry-core ];
@@ -43,7 +43,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library to control Comelit Simplehome";
     homepage = "https://github.com/chemelli74/aiocomelit";
-    changelog = "https://github.com/chemelli74/aiocomelit/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/chemelli74/aiocomelit/blob/${src.tag}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/browserforge/default.nix b/pkgs/development/python-modules/browserforge/default.nix
new file mode 100644
index 000000000000..a9c9b50ac338
--- /dev/null
+++ b/pkgs/development/python-modules/browserforge/default.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  aiofiles,
+  buildPythonPackage,
+  click,
+  fetchFromGitHub,
+  httpx,
+  orjson,
+  poetry-core,
+  pythonOlder,
+  rich,
+}:
+
+buildPythonPackage rec {
+  pname = "browserforge";
+  version = "1.1.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.11";
+
+  src = fetchFromGitHub {
+    owner = "daijro";
+    repo = "browserforge";
+    tag = "v${version}";
+    hash = "sha256-+uBKVugPScr0gggYaxAdelLKKrmXGY6rWTwhFqBMTcA=";
+  };
+
+  build-system = [ poetry-core ];
+
+  dependencies = [
+    aiofiles
+    click
+    httpx
+    orjson
+    rich
+  ];
+
+  # Module has no test
+  doCheck = false;
+
+  pythonImportsCheck = [ "browserforge" ];
+
+  meta = {
+    description = "Intelligent browser header & fingerprint generator";
+    homepage = "https://github.com/daijro/browserforge";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}
diff --git a/pkgs/development/python-modules/cvss/default.nix b/pkgs/development/python-modules/cvss/default.nix
index 0ada48e67d44..791bd43df9fe 100644
--- a/pkgs/development/python-modules/cvss/default.nix
+++ b/pkgs/development/python-modules/cvss/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "cvss";
-  version = "3.3";
+  version = "3.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "RedHatProductSecurity";
     repo = "cvss";
     tag = "v${version}";
-    hash = "sha256-+8aKNPcHFPcDyBvOO9QCVb1OIbpQHAEeJgt8fob0+lM=";
+    hash = "sha256-g6+ccoIgqs7gZPrTuKm3em+PzLvpupb9JXOGMqf2Uv0=";
   };
 
   build-system = [ setuptools ];
@@ -38,7 +38,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Library for CVSS2/3/4";
     homepage = "https://github.com/RedHatProductSecurity/cvss";
-    changelog = "https://github.com/RedHatProductSecurity/cvss/releases/tag/v${version}";
+    changelog = "https://github.com/RedHatProductSecurity/cvss/releases/tag/${src.tag}";
     license = licenses.lgpl3Plus;
     maintainers = with maintainers; [ fab ];
     mainProgram = "cvss_calculator";
diff --git a/pkgs/development/python-modules/linode-api/default.nix b/pkgs/development/python-modules/linode-api/default.nix
index a32ed18f7194..20be7c053f3b 100644
--- a/pkgs/development/python-modules/linode-api/default.nix
+++ b/pkgs/development/python-modules/linode-api/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "linode-api";
-  version = "5.26.0";
+  version = "5.27.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "linode";
     repo = "python-linode-api";
     tag = "v${version}";
-    hash = "sha256-+Co8c0JJKzA2IBj/RUrY+iNTCI0nCvqQUW1F7Crd2mc=";
+    hash = "sha256-hMxCRSba0hjOsq+TFyrb04uMfy13GZEO7elAKmqgnzY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/m2crypto/default.nix b/pkgs/development/python-modules/m2crypto/default.nix
index 4b1f3ca07aa2..1767050052fc 100644
--- a/pkgs/development/python-modules/m2crypto/default.nix
+++ b/pkgs/development/python-modules/m2crypto/default.nix
@@ -3,6 +3,7 @@
   stdenv,
   buildPythonPackage,
   fetchPypi,
+  fetchurl,
   openssl,
   pytestCheckHook,
   pythonOlder,
@@ -12,15 +13,21 @@
 
 buildPythonPackage rec {
   pname = "m2crypto";
-  version = "0.43.0";
+  version = "0.44.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-bCwce7DoqnaPfKgD2n28JmbUADsmvXrfcCM6/FnYzzM=";
+    hash = "sha256-OEu0y9F47g50AVMRt7H58sN342huA/oHCz7C9JRnHA8=";
   };
+  patches = [
+    (fetchurl {
+      url = "https://sources.debian.org/data/main/m/m2crypto/0.42.0-2.1/debian/patches/0004-swig-Workaround-for-reading-sys-select.h-ending-with.patch";
+      hash = "sha256-/Bkuqu/Od+S56AUWo0ZzpZF7FGMxP766K2GJnfKXrOI=";
+    })
+  ];
 
   build-system = [ setuptools ];
 
diff --git a/pkgs/development/python-modules/pygmt/default.nix b/pkgs/development/python-modules/pygmt/default.nix
index 9bd66ac91c0c..2be1633af886 100644
--- a/pkgs/development/python-modules/pygmt/default.nix
+++ b/pkgs/development/python-modules/pygmt/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "pygmt";
-  version = "0.14.1";
+  version = "0.14.2";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "GenericMappingTools";
     repo = "pygmt";
     tag = "v${version}";
-    hash = "sha256-F0BwKr8DTYa5mHvVpTFd4rds/esQ+tgPJn8shr3VUsk=";
+    hash = "sha256-UwqkJxO+LbJz7BVbQnulxm4sMrKHoY3ayqLHfZy7Ji4=";
   };
 
   postPatch = ''
@@ -65,7 +65,7 @@ buildPythonPackage rec {
     description = "Python interface for the Generic Mapping Tools";
     homepage = "https://github.com/GenericMappingTools/pygmt";
     license = lib.licenses.bsd3;
-    changelog = "https://github.com/GenericMappingTools/pygmt/releases/tag/v${version}";
+    changelog = "https://github.com/GenericMappingTools/pygmt/releases/tag/${src.tag}";
     maintainers = lib.teams.geospatial.members;
   };
 }
diff --git a/pkgs/development/web/nodejs/v20.nix b/pkgs/development/web/nodejs/v20.nix
index 66dbd357f028..dca76d89b8b4 100644
--- a/pkgs/development/web/nodejs/v20.nix
+++ b/pkgs/development/web/nodejs/v20.nix
@@ -1,4 +1,3 @@
-
 {
   callPackage,
   fetchpatch2,
diff --git a/pkgs/kde/frameworks/breeze-icons/default.nix b/pkgs/kde/frameworks/breeze-icons/default.nix
index e7c75aad85fb..e01f7f6b1896 100644
--- a/pkgs/kde/frameworks/breeze-icons/default.nix
+++ b/pkgs/kde/frameworks/breeze-icons/default.nix
@@ -2,6 +2,7 @@
   mkKdeDerivation,
   python3,
   libxml2,
+  qtsvg,
 }:
 mkKdeDerivation {
   pname = "breeze-icons";
@@ -11,6 +12,11 @@ mkKdeDerivation {
     libxml2
   ];
 
+  # This package contains an SVG icon theme and an API forcing its use
+  extraPropagatedBuildInputs = [
+    qtsvg
+  ];
+
   # lots of icons, takes forever, does absolutely nothing
   dontStrip = true;
 }
diff --git a/pkgs/kde/generated/sources/plasma.json b/pkgs/kde/generated/sources/plasma.json
index 9b10cdc176d1..fa0a9437ff7f 100644
--- a/pkgs/kde/generated/sources/plasma.json
+++ b/pkgs/kde/generated/sources/plasma.json
@@ -195,9 +195,9 @@
     "hash": "sha256-kaSXmq4aChMZSLCz+JcIvREGsH59sPwdU708omjaYSc="
   },
   "plasma-desktop": {
-    "version": "6.3.1",
-    "url": "mirror://kde/stable/plasma/6.3.1/plasma-desktop-6.3.1.tar.xz",
-    "hash": "sha256-EZydNhJ0NnBIMghky6/8YSUwy6TqYtbf1QTz7+WyVKQ="
+    "version": "6.3.1.1",
+    "url": "mirror://kde/stable/plasma/6.3.1/plasma-desktop-6.3.1.1.tar.xz",
+    "hash": "sha256-zgKHR9MeF2vem/RoA7LaVKy8Beu8/52cWFzALpsmrP0="
   },
   "plasma-dialer": {
     "version": "6.3.1",
@@ -315,9 +315,9 @@
     "hash": "sha256-vy5JcIKk5bYpa4NZKYkNI9qbobPbSU+GEjfWlvbEmb8="
   },
   "spectacle": {
-    "version": "6.3.1",
-    "url": "mirror://kde/stable/plasma/6.3.1/spectacle-6.3.1.tar.xz",
-    "hash": "sha256-DzZLBd/MDGPB62luWTGPg6nIPUFi9WVrT6X+KdrMgU4="
+    "version": "6.3.1.2",
+    "url": "mirror://kde/stable/plasma/6.3.1/spectacle-6.3.1.2.tar.xz",
+    "hash": "sha256-g35ejQ745SL01qN9pInk+G2DZJkfz3lsWP0FJvgc+go="
   },
   "systemsettings": {
     "version": "6.3.1",
diff --git a/pkgs/kde/plasma/plasma-desktop/default.nix b/pkgs/kde/plasma/plasma-desktop/default.nix
index 2a8e8df9d740..7933541b4501 100644
--- a/pkgs/kde/plasma/plasma-desktop/default.nix
+++ b/pkgs/kde/plasma/plasma-desktop/default.nix
@@ -43,11 +43,6 @@ mkKdeDerivation {
     (replaceVars ./wallpaper-paths.patch {
       wallpapers = "${lib.getBin breeze}/share/wallpapers";
     })
-
-    # Fix build failure due to C++ template nonsense
-    # Submitted upstream: https://invent.kde.org/plasma/plasma-desktop/-/merge_requests/2833
-    # FIXME: remove when merged
-    ./fix-build.patch
   ];
 
   extraNativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/kde/plasma/plasma-desktop/fix-build.patch b/pkgs/kde/plasma/plasma-desktop/fix-build.patch
deleted file mode 100644
index 9729ffb46bb5..000000000000
--- a/pkgs/kde/plasma/plasma-desktop/fix-build.patch
+++ /dev/null
@@ -1,107 +0,0 @@
-diff --git a/kcms/libkwindevices/inputdevice.cpp b/kcms/libkwindevices/inputdevice.cpp
-index 9a437137077390a61152be96ac69b4f5e992d062..aea0952143a29a4b2bf06777f737a84cbd6e5b6d 100644
---- a/kcms/libkwindevices/inputdevice.cpp
-+++ b/kcms/libkwindevices/inputdevice.cpp
-@@ -10,44 +10,6 @@
- 
- #include "logging.h"
- 
--template<typename T>
--bool InputDevice::Prop<T>::save()
--{
--    if (!isSupported() || !m_value || m_prop.isConstant()) {
--        qCDebug(LIBKWINDEVICES) << "skipping" << this << m_value.has_value() << isSupported() << m_prop.name();
--        return false;
--    }
--
--    auto iface = m_device->m_iface.get();
--    const bool ret = m_prop.write(iface, *m_value);
--    if (ret) {
--        m_configValue = *m_value;
--    }
--    return ret;
--}
--
--template<typename T>
--void InputDevice::Prop<T>::set(T newVal)
--{
--    if (!m_value) {
--        value();
--    }
--
--    Q_ASSERT(isSupported());
--    if (m_value != newVal) {
--        m_value = newVal;
--        if (m_changedSignalFunction) {
--            (m_device->*m_changedSignalFunction)();
--        }
--    }
--}
--
--template<typename T>
--bool InputDevice::Prop<T>::changed() const
--{
--    return m_value.has_value() && m_value.value() != m_configValue;
--}
--
- InputDevice::InputDevice(const QString &dbusName, QObject *parent)
-     : QObject(parent)
- {
-diff --git a/kcms/libkwindevices/inputdevice.h b/kcms/libkwindevices/inputdevice.h
-index 93f9753cfae3c8795c5493566f7e51c806710983..f5589b095f39aa76071f67b8ee544a71585a479a 100644
---- a/kcms/libkwindevices/inputdevice.h
-+++ b/kcms/libkwindevices/inputdevice.h
-@@ -269,12 +269,29 @@ private:
-             }
-         }
- 
--        void set(T newVal);
-+        void set(T newVal) {
-+            if (!m_value) {
-+                value();
-+            }
-+        
-+            Q_ASSERT(isSupported());
-+            if (m_value != newVal) {
-+                m_value = newVal;
-+                if (m_changedSignalFunction) {
-+                    (m_device->*m_changedSignalFunction)();
-+                }
-+            }
-+        }
-+
-         T defaultValue() const
-         {
-             return m_defaultValueFunction ? (m_device->m_iface.get()->*m_defaultValueFunction)() : T();
-         }
--        bool changed() const;
-+        
-+        bool changed() const {
-+            return m_value.has_value() && m_value.value() != m_configValue;
-+        }
-+
-         void set(const Prop<T> &p)
-         {
-             set(p.value());
-@@ -286,7 +303,20 @@ private:
-             return !m_supportedFunction || (iface->*m_supportedFunction)();
-         }
- 
--        bool save();
-+        bool save() {
-+            if (!isSupported() || !m_value || m_prop.isConstant()) {
-+                qDebug() << "skipping" << this << m_value.has_value() << isSupported() << m_prop.name();
-+                return false;
-+            }
-+        
-+            auto iface = m_device->m_iface.get();
-+            const bool ret = m_prop.write(iface, *m_value);
-+            if (ret) {
-+                m_configValue = *m_value;
-+            }
-+            return ret;
-+        }
-+
-         bool isDefaults() const
-         {
-             return m_value == defaultValue();
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 3284b4d54aa0..c0508af46707 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -28,8 +28,8 @@
         "hash": "sha256:1z2913y38clnlmhvwj49h7p4pic24s4d8np7nmd4lk7m2xz8w532"
     },
     "6.12": {
-        "version": "6.12.14",
-        "hash": "sha256:054gi5fp60d2536z06b1lmys9zlraixh22yb75z42xfqnjzz88wl"
+        "version": "6.12.15",
+        "hash": "sha256:02k3yzlri0h9s4hcx20sif5jvafhjk9vab9h6wsca8hfxa2bvxaz"
     },
     "6.13": {
         "version": "6.13.3",
diff --git a/pkgs/servers/home-assistant/custom-components/solis-sensor/package.nix b/pkgs/servers/home-assistant/custom-components/solis-sensor/package.nix
index ca9f788e2454..2d1a056407cf 100644
--- a/pkgs/servers/home-assistant/custom-components/solis-sensor/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/solis-sensor/package.nix
@@ -9,13 +9,13 @@
 buildHomeAssistantComponent rec {
   owner = "hultenvp";
   domain = "solis";
-  version = "3.8.1";
+  version = "3.9.0";
 
   src = fetchFromGitHub {
     owner = "hultenvp";
     repo = "solis-sensor";
     rev = "v${version}";
-    hash = "sha256-sjLHridYiF2x5XzW869BNjH9y2WtfvXXsNICKUmpOYM=";
+    hash = "sha256-RgsKIav3ozWYO9CXzvhMVmvOW74L/AHGOW8OWOMFBcQ=";
   };
 
   dependencies = [ aiofiles ];
diff --git a/pkgs/servers/sql/postgresql/13.nix b/pkgs/servers/sql/postgresql/13.nix
index 72a8dd8bb392..8f1493c6c366 100644
--- a/pkgs/servers/sql/postgresql/13.nix
+++ b/pkgs/servers/sql/postgresql/13.nix
@@ -1,6 +1,8 @@
 import ./generic.nix {
-  version = "13.18";
-  hash = "sha256-zuqSq+4qjBlAjSeLaN5qeLa9PbtPotZT+nynRdZmqrE=";
+  version = "13.20";
+  # "Stamp 13.20"
+  rev = "c8f198c3acb59ed858b5b9b88b4fbc55cece544e";
+  hash = "sha256-GkDtzqwjMJipvr0wykM9Z5Tb0R7WgJA/PGPTVUXxf7Q=";
   muslPatches = {
     disable-test-collate-icu-utf8 = {
       url = "https://git.alpinelinux.org/aports/plain/main/postgresql13/disable-test-collate.icu.utf8.patch?id=69faa146ec9fff3b981511068f17f9e629d4688b";
diff --git a/pkgs/servers/sql/postgresql/14.nix b/pkgs/servers/sql/postgresql/14.nix
index e5011f5314ca..bee593a35fd2 100644
--- a/pkgs/servers/sql/postgresql/14.nix
+++ b/pkgs/servers/sql/postgresql/14.nix
@@ -1,6 +1,8 @@
 import ./generic.nix {
-  version = "14.15";
-  hash = "sha256-AuiR4xS06e4ky9eAKNq3xz+cG6PjCDW8vvcf4iBAH8U=";
+  version = "14.17";
+  # "Stamp 14.17"
+  rev = "e5cabe28006995d90cc9ebc613dad072c44c7f4a";
+  hash = "sha256-BvmfxHHTcxRkWZoawvHanQeAuqHnQIh77RQjxPo5fuI=";
   muslPatches = {
     disable-test-collate-icu-utf8 = {
       url = "https://git.alpinelinux.org/aports/plain/main/postgresql14/disable-test-collate.icu.utf8.patch?id=56999e6d0265ceff5c5239f85fdd33e146f06cb7";
diff --git a/pkgs/servers/sql/postgresql/15.nix b/pkgs/servers/sql/postgresql/15.nix
index bf17a088f2bd..c9d7f2f22a2a 100644
--- a/pkgs/servers/sql/postgresql/15.nix
+++ b/pkgs/servers/sql/postgresql/15.nix
@@ -1,6 +1,8 @@
 import ./generic.nix {
-  version = "15.10";
-  hash = "sha256-VavnONRB8OWGWLPsb4gJenE7XjtzE59iMNe1xMOJ5XM=";
+  version = "15.12";
+  # "Stamp 15.12"
+  rev = "50d3d22baba63613d1f1406b2ed460dc9b03c3fc";
+  hash = "sha256-6my9UzW05iYwTWR9y/VTZ1RQVNudavMFfUT9dpUQ15o=";
   muslPatches = {
     dont-use-locale-a = {
       url = "https://git.alpinelinux.org/aports/plain/main/postgresql15/dont-use-locale-a-on-musl.patch?id=f424e934e6d076c4ae065ce45e734aa283eecb9c";
diff --git a/pkgs/servers/sql/postgresql/16.nix b/pkgs/servers/sql/postgresql/16.nix
index fd1957b89386..6213c4d1b25c 100644
--- a/pkgs/servers/sql/postgresql/16.nix
+++ b/pkgs/servers/sql/postgresql/16.nix
@@ -1,6 +1,8 @@
 import ./generic.nix {
-  version = "16.6";
-  hash = "sha256-Izac2szUUnCsXcww+p2iBdW+M/pQXh8XoEGNLK7KR3s=";
+  version = "16.8";
+  # "Stamp 16.8"
+  rev = "71eb35c0b18de96537bd3876ec9bf8075bfd484f";
+  hash = "sha256-nVUGBuvCDFXozTyEDAAQa+IR3expCdztH90J68FhAXQ=";
   muslPatches = {
     dont-use-locale-a = {
       url = "https://git.alpinelinux.org/aports/plain/main/postgresql16/dont-use-locale-a-on-musl.patch?id=08a24be262339fd093e641860680944c3590238e";
diff --git a/pkgs/servers/sql/postgresql/17.nix b/pkgs/servers/sql/postgresql/17.nix
index 34d2ddeccb27..130ef4216ef8 100644
--- a/pkgs/servers/sql/postgresql/17.nix
+++ b/pkgs/servers/sql/postgresql/17.nix
@@ -1,6 +1,8 @@
 import ./generic.nix {
-  version = "17.2";
-  hash = "sha256-gu8nwK83UWldf2Ti2WNYMAX7tqDD32PQ5LQiEdcCEWQ=";
+  version = "17.4";
+  # "Stamp 17.4"
+  rev = "f8554dee417ffc4540c94cf357f7bf7d4b6e5d80";
+  hash = "sha256-TEpvX28chR3CXiOQsNY12t8WfM9ywoZVX1e/6mj9DqE=";
   muslPatches = {
     dont-use-locale-a = {
       url = "https://git.alpinelinux.org/aports/plain/main/postgresql17/dont-use-locale-a-on-musl.patch?id=d69ead2c87230118ae7f72cef7d761e761e1f37e";
diff --git a/pkgs/servers/sql/postgresql/generic.nix b/pkgs/servers/sql/postgresql/generic.nix
index 00b9f0e15ce1..ca157411536e 100644
--- a/pkgs/servers/sql/postgresql/generic.nix
+++ b/pkgs/servers/sql/postgresql/generic.nix
@@ -4,6 +4,7 @@ let
     # utils
     {
       stdenv,
+      fetchFromGitHub,
       fetchpatch,
       fetchurl,
       lib,
@@ -13,6 +14,7 @@ let
       # source specification
       hash,
       muslPatches ? { },
+      rev,
       version,
 
       # runtime dependencies
@@ -130,9 +132,12 @@ let
       inherit version;
       pname = pname + lib.optionalString jitSupport "-jit";
 
-      src = fetchurl {
-        url = "mirror://postgresql/source/v${version}/${pname}-${version}.tar.bz2";
-        inherit hash;
+      src = fetchFromGitHub {
+        owner = "postgres";
+        repo = "postgres";
+        # rev, not tag, on purpose: allows updating when new versions
+        # are "stamped" a few days before release (tag).
+        inherit hash rev;
       };
 
       __structuredAttrs = true;
@@ -215,22 +220,20 @@ let
 
       nativeBuildInputs =
         [
+          bison
+          docbook-xsl-nons
+          docbook_xml_dtd_45
+          flex
           libxml2
+          libxslt
           makeWrapper
+          perl
           pkg-config
           removeReferencesTo
         ]
         ++ lib.optionals jitSupport [
           llvmPackages.llvm.dev
           nukeReferences
-        ]
-        ++ lib.optionals (atLeast "17") [
-          bison
-          flex
-          perl
-          docbook_xml_dtd_45
-          docbook-xsl-nons
-          libxslt
         ];
 
       enableParallelBuilding = true;
@@ -299,11 +302,6 @@ let
           ./patches/paths-for-split-outputs.patch
           ./patches/paths-with-postgresql-suffix.patch
 
-          (fetchpatch {
-            url = "https://github.com/postgres/postgres/commit/8108674f0e5639baebcf03b54b7ccf9e9a8662a2.patch";
-            hash = "sha256-EQJkDR0eb7QWCjyMzXMn+Vbcwx3MMdC83oN7XSVJP0U=";
-          })
-
           (replaceVars ./patches/locale-binary-path.patch {
             locale = "${
               if stdenv.hostPlatform.isDarwin then darwin.adv_cmds else lib.getBin stdenv.cc.libc
diff --git a/pkgs/servers/sql/postgresql/libpq.nix b/pkgs/servers/sql/postgresql/libpq.nix
index 0c064e45cf99..16f361b1f2a2 100644
--- a/pkgs/servers/sql/postgresql/libpq.nix
+++ b/pkgs/servers/sql/postgresql/libpq.nix
@@ -1,7 +1,7 @@
 {
   # utils
   stdenv,
-  fetchurl,
+  fetchFromGitHub,
   lib,
 
   # runtime dependencies
@@ -29,11 +29,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libpq";
-  version = "17.2";
+  version = "17.4";
 
-  src = fetchurl {
-    url = "mirror://postgresql/source/v${finalAttrs.version}/postgresql-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-gu8nwK83UWldf2Ti2WNYMAX7tqDD32PQ5LQiEdcCEWQ=";
+  src = fetchFromGitHub {
+    owner = "postgres";
+    repo = "postgres";
+    # rev, not tag, on purpose: see generic.nix.
+    rev = "f8554dee417ffc4540c94cf357f7bf7d4b6e5d80";
+    hash = "sha256-TEpvX28chR3CXiOQsNY12t8WfM9ywoZVX1e/6mj9DqE=";
   };
 
   __structuredAttrs = true;
diff --git a/pkgs/tools/security/schleuder/Gemfile.lock b/pkgs/tools/security/schleuder/Gemfile.lock
index 96970097b875..5fa592457fe8 100644
--- a/pkgs/tools/security/schleuder/Gemfile.lock
+++ b/pkgs/tools/security/schleuder/Gemfile.lock
@@ -16,7 +16,7 @@ GEM
       tzinfo (~> 2.0)
       zeitwerk (~> 2.3)
     bcrypt (3.1.20)
-    charlock_holmes (0.7.7)
+    charlock_holmes (0.7.9)
     concurrent-ruby (1.3.1)
     daemons (1.4.1)
     eventmachine (1.2.7)
diff --git a/pkgs/tools/security/schleuder/gemset.nix b/pkgs/tools/security/schleuder/gemset.nix
index ec334c67ac5f..025c6aa9e997 100644
--- a/pkgs/tools/security/schleuder/gemset.nix
+++ b/pkgs/tools/security/schleuder/gemset.nix
@@ -56,10 +56,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0hybw8jw9ryvz5zrki3gc9r88jqy373m6v46ynxsdzv1ysiyr40p";
+      sha256 = "1c1dws56r7p8y363dhyikg7205z59a3bn4amnv2y488rrq8qm7ml";
       type = "gem";
     };
-    version = "0.7.7";
+    version = "0.7.9";
   };
   concurrent-ruby = {
     groups = [ "default" ];
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index f28a79a55b1f..4258565766fd 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1936,6 +1936,8 @@ self: super: with self; {
 
   browser-cookie3 = callPackage ../development/python-modules/browser-cookie3 { };
 
+  browserforge = callPackage ../development/python-modules/browserforge { };
+
   brunt = callPackage ../development/python-modules/brunt { };
 
   bsddb3 = callPackage ../development/python-modules/bsddb3 { };
diff --git a/pkgs/top-level/ruby-packages.nix b/pkgs/top-level/ruby-packages.nix
index 3bf08ddf5be8..b321a80017f4 100644
--- a/pkgs/top-level/ruby-packages.nix
+++ b/pkgs/top-level/ruby-packages.nix
@@ -322,10 +322,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0hybw8jw9ryvz5zrki3gc9r88jqy373m6v46ynxsdzv1ysiyr40p";
+      sha256 = "1c1dws56r7p8y363dhyikg7205z59a3bn4amnv2y488rrq8qm7ml";
       type = "gem";
     };
-    version = "0.7.7";
+    version = "0.7.9";
   };
   childprocess = {
     dependecnies = ["logger"];