diff --git a/ci/OWNERS b/ci/OWNERS
index 30b5c90ba2b4..97a2a4220afb 100644
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -299,6 +299,9 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/servers/http/nginx/ @raitobezarius
 /nixos/modules/services/web-servers/nginx/ @raitobezarius
 
+# D
+/pkgs/build-support/dlang @jtbx @TomaSajt
+
 # Dhall
 /pkgs/development/dhall-modules      @Gabriella439 @Profpatsch @ehmry
 /pkgs/development/interpreters/dhall @Gabriella439 @Profpatsch @ehmry
diff --git a/lib/systems/examples.nix b/lib/systems/examples.nix
index 3988e39f150c..de33fce3e8eb 100644
--- a/lib/systems/examples.nix
+++ b/lib/systems/examples.nix
@@ -215,6 +215,10 @@ rec {
     config = "arm-none-eabi";
     libc = "newlib";
   };
+  arm-embedded-nano = {
+    config = "arm-none-eabi";
+    libc = "newlib-nano";
+  };
   armhf-embedded = {
     config = "arm-none-eabihf";
     libc = "newlib";
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 02fc7ce7e660..9ce88535f269 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -10172,6 +10172,12 @@
     githubId = 7481521;
     name = "Balázs Lengyel";
   };
+  ilarvne = {
+    email = "ilarvne@proton.me";
+    github = "ilarvne";
+    githubId = 99905590;
+    name = "Nurali Aslanbekov";
+  };
   ilaumjd = {
     email = "ilaumjd@gmail.com";
     github = "ilaumjd";
diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index a061c2af21bf..16b9677ce907 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -419,6 +419,21 @@
 
 - [`system.stateVersion`](#opt-system.stateVersion) is now validated and must be in the `"YY.MM"` format, ideally corresponding to a prior NixOS release.
 
+- `services.mysql` now supports easy cluster setup via [`services.mysql.galeraCluster`](#opt-services.mysql.galeraCluster.enable) option.
+
+  Example:
+
+  ```nix
+  services.mysql = {
+    enable = true;
+    galeraCluster = {
+      enable = true;
+      localName = "Node 1";
+      localAddress = "galera_01";
+      nodeAddresses = [ "galera_01" "galera_02" "galera_03"];
+    };
+  };
+  ```
 
 - systemd's {manpage}`systemd-ssh-generator(8)` now works out of the box on NixOS.
   - You can ssh into VMs without any networking configuration if your hypervisor configures the vm to support AF_VSOCK.
diff --git a/nixos/modules/services/databases/mysql.nix b/nixos/modules/services/databases/mysql.nix
index a43482393641..23551f414a63 100644
--- a/nixos/modules/services/databases/mysql.nix
+++ b/nixos/modules/services/databases/mysql.nix
@@ -320,6 +320,83 @@ in
           description = "Port number on which the MySQL master server runs.";
         };
       };
+
+      galeraCluster = {
+        enable = lib.mkEnableOption "MariaDB Galera Cluster";
+
+        package = lib.mkOption {
+          type = lib.types.package;
+          description = "The MariaDB Galera package that provides the shared library 'libgalera_smm.so' required for cluster functionality.";
+          default = lib.literalExpression "pkgs.mariadb-galera";
+        };
+
+        name = lib.mkOption {
+          type = lib.types.str;
+          description = "The logical name of the Galera cluster. All nodes in the same cluster must use the same name.";
+          default = "galera";
+        };
+
+        sstMethod = lib.mkOption {
+          type = lib.types.enum [
+            "rsync"
+            "mariabackup"
+          ];
+          description = "Method for the initial state transfer (wsrep_sst_method) when a node joins the cluster. Be aware that rsync needs SSH keys to be generated and authorized on all nodes!";
+          default = "rsync";
+          example = "mariabackup";
+        };
+
+        localName = lib.mkOption {
+          type = lib.types.str;
+          description = "The unique name that identifies this particular node within the cluster. Each node must have a different name.";
+          example = "node1";
+        };
+
+        localAddress = lib.mkOption {
+          type = lib.types.str;
+          description = "IP address or hostname of this node that will be used for cluster communication. Must be reachable by all other nodes.";
+          example = "1.2.3.4";
+          default = cfg.galeraCluster.localName;
+          defaultText = lib.literalExpression "config.services.mysql.galeraCluster.localName";
+        };
+
+        nodeAddresses = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          description = "IP addresses or hostnames of all nodes in the cluster, including this node. This is used to construct the default clusterAddress connection string.";
+          example = lib.literalExpression ''["10.0.0.10" "10.0.0.20" "10.0.0.30"]'';
+          default = [ ];
+        };
+
+        clusterPassword = lib.mkOption {
+          type = lib.types.str;
+          description = "Optional password for securing cluster communications. If provided, it will be used in the clusterAddress for authentication between nodes.";
+          example = "SomePassword";
+          default = "";
+        };
+
+        clusterAddress = lib.mkOption {
+          type = lib.types.str;
+          description = "Full Galera cluster connection string. If nodeAddresses is set, this will be auto-generated, but you can override it with a custom value. Format is typically 'gcomm://node1,node2,node3' with optional parameters.";
+          example = "gcomm://10.0.0.10,10.0.0.20,10.0.0.30?gmcast.seg=1:SomePassword";
+          default =
+            if (cfg.galeraCluster.nodeAddresses == [ ]) then
+              ""
+            else
+              "gcomm://${builtins.concatStringsSep "," cfg.galeraCluster.nodeAddresses}"
+              + lib.optionalString (
+                cfg.galeraCluster.clusterPassword != ""
+              ) "?gmcast.seg=1:${cfg.galeraCluster.clusterPassword}";
+          defaultText = lib.literalExpression ''
+            if (config.services.mysql.galeraCluster.nodeAddresses == [ ]) then
+              ""
+            else
+              "gcomm://''${builtins.concatStringsSep \",\" config.services.mysql.galeraCluster.nodeAddresses}"
+              + lib.optionalString (config.services.mysql.galeraCluster.clusterPassword != "")
+                "?gmcast.seg=1:''${config.services.mysql.galeraCluster.clusterPassword}"
+          '';
+        };
+
+      };
     };
 
   };
@@ -327,6 +404,34 @@ in
   ###### implementation
 
   config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !cfg.galeraCluster.enable || isMariaDB;
+        message = "'services.mysql.galeraCluster.enable' expect services.mysql.package to be an mariadb variant";
+      }
+      {
+        assertion =
+          !cfg.galeraCluster.enable
+          || (
+            cfg.galeraCluster.localAddress != ""
+            && (cfg.galeraCluster.nodeAddresses != [ ] || cfg.galeraCluster.clusterAddress != "")
+          );
+        message = "mariadb galera cluster is enabled but the localAddress and (nodeAddresses or clusterAddress) are not set";
+      }
+      {
+        assertion = !(cfg.galeraCluster.clusterAddress != "" && cfg.galeraCluster.clusterPassword != "");
+        message = "mariadb galera clusterPassword is set but overwritten by clusterAddress";
+      }
+      {
+        assertion =
+          !(
+            cfg.galeraCluster.enable
+            && cfg.galeraCluster.nodeAddresses != [ ]
+            && cfg.galeraCluster.clusterAddress != ""
+          );
+        message = "When services.mysql.galeraCluster.clusterAddress is set, setting services.mysql.galeraCluster.nodeAddresses is redundant and will be overwritten by clusterAddress. Choose one approach.";
+      }
+    ];
 
     services.mysql.dataDir = lib.mkDefault (
       if lib.versionAtLeast config.system.stateVersion "17.09" then "/var/lib/mysql" else "/var/mysql"
@@ -351,8 +456,38 @@ in
       (lib.mkIf (!isMariaDB) {
         plugin-load-add = [ "auth_socket.so" ];
       })
+      (lib.mkIf cfg.galeraCluster.enable {
+        # Ensure Only InnoDB is used as galera clusters can only work with them
+        enforce_storage_engine = "InnoDB";
+        default_storage_engine = "InnoDB";
+
+        # galera only support this binlog format
+        binlog-format = "ROW";
+
+        bind_address = lib.mkDefault "0.0.0.0";
+      })
     ];
 
+    services.mysql.settings.galera = lib.optionalAttrs cfg.galeraCluster.enable {
+      wsrep_on = "ON";
+      wsrep_debug = lib.mkDefault "NONE";
+      wsrep_retry_autocommit = lib.mkDefault "3";
+      wsrep_provider = "${cfg.galeraCluster.package}/lib/galera/libgalera_smm.so";
+
+      wsrep_cluster_name = cfg.galeraCluster.name;
+      wsrep_cluster_address = cfg.galeraCluster.clusterAddress;
+
+      wsrep_node_address = cfg.galeraCluster.localAddress;
+      wsrep_node_name = "${cfg.galeraCluster.localName}";
+
+      # SST method using rsync
+      wsrep_sst_method = lib.mkDefault cfg.galeraCluster.sstMethod;
+      wsrep_sst_auth = lib.mkDefault "check_repl:check_pass";
+
+      binlog_format = "ROW";
+      innodb_autoinc_lock_mode = 2;
+    };
+
     users.users = lib.optionalAttrs (cfg.user == "mysql") {
       mysql = {
         description = "MySQL server user";
@@ -384,11 +519,29 @@ in
 
       unitConfig.RequiresMountsFor = cfg.dataDir;
 
-      path = [
-        # Needed for the mysql_install_db command in the preStart script
-        # which calls the hostname command.
-        pkgs.nettools
-      ];
+      path =
+        [
+          # Needed for the mysql_install_db command in the preStart script
+          # which calls the hostname command.
+          pkgs.nettools
+        ]
+        # tools 'wsrep_sst_rsync' needs
+        ++ lib.optionals cfg.galeraCluster.enable [
+          cfg.package
+          pkgs.bash
+          pkgs.gawk
+          pkgs.gnutar
+          pkgs.gzip
+          pkgs.inetutils
+          pkgs.iproute2
+          pkgs.netcat
+          pkgs.procps
+          pkgs.pv
+          pkgs.rsync
+          pkgs.socat
+          pkgs.stunnel
+          pkgs.which
+        ];
 
       preStart =
         if isMariaDB then
@@ -581,6 +734,17 @@ in
         })
       ];
     };
+
+    # Open firewall ports for MySQL (and Galera)
+    networking.firewall.allowedTCPPorts = lib.optionals cfg.galeraCluster.enable [
+      3306 # MySQL
+      4567 # Galera Cluster
+      4568 # Galera IST
+      4444 # SST
+    ];
+    networking.firewall.allowedUDPPorts = lib.optionals cfg.galeraCluster.enable [
+      4567 # Galera Cluster
+    ];
   };
 
   meta.maintainers = [ lib.maintainers._6543 ];
diff --git a/nixos/modules/services/misc/taskchampion-sync-server.nix b/nixos/modules/services/misc/taskchampion-sync-server.nix
index bab826829063..272cea170a4f 100644
--- a/nixos/modules/services/misc/taskchampion-sync-server.nix
+++ b/nixos/modules/services/misc/taskchampion-sync-server.nix
@@ -22,6 +22,12 @@ in
       type = types.str;
       default = "taskchampion";
     };
+    host = lib.mkOption {
+      description = "Host address on which to serve";
+      type = types.str;
+      default = "127.0.0.1";
+      example = "0.0.0.0";
+    };
     port = lib.mkOption {
       description = "Port on which to serve";
       type = types.port;
@@ -79,7 +85,7 @@ in
         DynamicUser = false;
         ExecStart = ''
           ${lib.getExe cfg.package} \
-            --port ${builtins.toString cfg.port} \
+            --listen "${cfg.host}:${builtins.toString cfg.port}" \
             --data-dir ${cfg.dataDir} \
             --snapshot-versions ${builtins.toString cfg.snapshot.versions} \
             --snapshot-days ${builtins.toString cfg.snapshot.days} \
diff --git a/nixos/modules/services/networking/bird-lg.nix b/nixos/modules/services/networking/bird-lg.nix
index f565c7f505fb..5d7b7c30f04c 100644
--- a/nixos/modules/services/networking/bird-lg.nix
+++ b/nixos/modules/services/networking/bird-lg.nix
@@ -187,7 +187,7 @@ in
         };
 
         extraArgs = lib.mkOption {
-          type = with lib.types; either lines (listOf str);
+          type = with lib.types; listOf str;
           default = [ ];
           description = ''
             Extra parameters documented [here](https://github.com/xddxdd/bird-lg-go#frontend).
@@ -247,14 +247,10 @@ in
         };
 
         extraArgs = lib.mkOption {
-          type = with lib.types; either lines (listOf str);
+          type = with lib.types; listOf str;
           default = [ ];
           description = ''
             Extra parameters documented [here](https://github.com/xddxdd/bird-lg-go#proxy).
-
-            :::{.note}
-            Passing lines (plain strings) is deprecated in favour of passing lists of strings.
-            :::
           '';
         };
       };
@@ -264,15 +260,6 @@ in
   ###### implementation
 
   config = {
-
-    warnings =
-      lib.optional (cfg.frontend.enable && builtins.isString cfg.frontend.extraArgs) ''
-        Passing strings to `services.bird-lg.frontend.extraOptions' is deprecated. Please pass a list of strings instead.
-      ''
-      ++ lib.optional (cfg.proxy.enable && builtins.isString cfg.proxy.extraArgs) ''
-        Passing strings to `services.bird-lg.proxy.extraOptions' is deprecated. Please pass a list of strings instead.
-      '';
-
     systemd.services = {
       bird-lg-frontend = lib.mkIf cfg.frontend.enable {
         enable = true;
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 6e992d83cdd8..8357b829ca5d 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1413,7 +1413,7 @@ in
   wakapi = runTest ./wakapi.nix;
   warzone2100 = handleTest ./warzone2100.nix { };
   wasabibackend = handleTest ./wasabibackend.nix { };
-  wastebin = handleTest ./wastebin.nix { };
+  wastebin = runTest ./wastebin.nix;
   watchdogd = handleTest ./watchdogd.nix { };
   webhook = runTest ./webhook.nix;
   weblate = handleTest ./web-apps/weblate.nix { };
diff --git a/nixos/tests/mysql/mariadb-galera.nix b/nixos/tests/mysql/mariadb-galera.nix
index 65705afbf82c..1f08eb697504 100644
--- a/nixos/tests/mysql/mariadb-galera.nix
+++ b/nixos/tests/mysql/mariadb-galera.nix
@@ -58,30 +58,6 @@ let
                 extraHosts = lib.concatMapStringsSep "\n" (i: "192.168.1.${toString i} galera_0${toString i}") (
                   lib.range 1 6
                 );
-                firewall.allowedTCPPorts = [
-                  3306
-                  4444
-                  4567
-                  4568
-                ];
-                firewall.allowedUDPPorts = [ 4567 ];
-              };
-              systemd.services.mysql = with pkgs; {
-                path = with pkgs; [
-                  bash
-                  gawk
-                  gnutar
-                  gzip
-                  inetutils
-                  iproute2
-                  netcat
-                  procps
-                  pv
-                  rsync
-                  socat
-                  stunnel
-                  which
-                ];
               };
               services.mysql = {
                 enable = true;
@@ -101,27 +77,24 @@ let
                     FLUSH PRIVILEGES;
                   ''
                 );
+
+                galeraCluster = {
+                  enable = true;
+                  package = galeraPackage;
+                  sstMethod = method;
+
+                  localAddress = address;
+                  localName = "galera_0${toString id}";
+
+                  clusterAddress =
+                    "gcomm://"
+                    + lib.optionalString (id == 2 || id == 3) "galera_01,galera_02,galera_03"
+                    + lib.optionalString (id == 5 || id == 6) "galera_04,galera_05,galera_06";
+                };
+
                 settings = {
-                  mysqld = {
-                    bind_address = "0.0.0.0";
-                  };
                   galera = {
-                    wsrep_on = "ON";
                     wsrep_debug = "NONE";
-                    wsrep_retry_autocommit = "3";
-                    wsrep_provider = "${galeraPackage}/lib/galera/libgalera_smm.so";
-                    wsrep_cluster_address =
-                      "gcomm://"
-                      + lib.optionalString (id == 2 || id == 3) "galera_01,galera_02,galera_03"
-                      + lib.optionalString (id == 5 || id == 6) "galera_04,galera_05,galera_06";
-                    wsrep_cluster_name = "galera";
-                    wsrep_node_address = address;
-                    wsrep_node_name = "galera_0${toString id}";
-                    wsrep_sst_method = method;
-                    wsrep_sst_auth = "check_repl:check_pass";
-                    binlog_format = "ROW";
-                    enforce_storage_engine = "InnoDB";
-                    innodb_autoinc_lock_mode = "2";
                   };
                 };
               };
diff --git a/nixos/tests/taskchampion-sync-server.nix b/nixos/tests/taskchampion-sync-server.nix
index 42dfb0cbeca3..659a900fd2c2 100644
--- a/nixos/tests/taskchampion-sync-server.nix
+++ b/nixos/tests/taskchampion-sync-server.nix
@@ -6,6 +6,7 @@ import ./make-test-python.nix (
     nodes = {
       server = {
         services.taskchampion-sync-server.enable = true;
+        services.taskchampion-sync-server.host = "0.0.0.0";
         services.taskchampion-sync-server.openFirewall = true;
       };
       client =
diff --git a/nixos/tests/wastebin.nix b/nixos/tests/wastebin.nix
index dde1f658b948..79d05229eb7f 100644
--- a/nixos/tests/wastebin.nix
+++ b/nixos/tests/wastebin.nix
@@ -1,24 +1,22 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "wastebin";
+{ lib, ... }:
+{
+  name = "wastebin";
 
-    meta = {
-      maintainers = with lib.maintainers; [ pinpox ];
+  meta = {
+    maintainers = with lib.maintainers; [ pinpox ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.wastebin = {
+        enable = true;
+      };
     };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.wastebin = {
-          enable = true;
-        };
-      };
-
-    testScript = ''
-      machine.wait_for_unit("wastebin.service")
-      machine.wait_for_open_port(8088)
-      machine.succeed("curl --fail http://localhost:8088/")
-    '';
-  }
-)
+  testScript = ''
+    machine.wait_for_unit("wastebin.service")
+    machine.wait_for_open_port(8088)
+    machine.succeed("curl --fail http://localhost:8088/")
+  '';
+}
diff --git a/pkgs/applications/editors/eclipse/build-eclipse.nix b/pkgs/applications/editors/eclipse/build-eclipse.nix
index 829ab15e622c..1b42cc2311fe 100644
--- a/pkgs/applications/editors/eclipse/build-eclipse.nix
+++ b/pkgs/applications/editors/eclipse/build-eclipse.nix
@@ -21,15 +21,15 @@
 }:
 
 {
-  name,
+  pname,
   src ? builtins.getAttr stdenv.hostPlatform.system sources,
   sources ? null,
   description,
-  productVersion,
+  version,
 }:
 
 stdenv.mkDerivation rec {
-  inherit name src;
+  inherit pname version src;
 
   desktopItem = makeDesktopItem {
     name = "Eclipse";
@@ -98,7 +98,7 @@ stdenv.mkDerivation rec {
       } \
       --prefix GIO_EXTRA_MODULES : "${glib-networking}/lib/gio/modules" \
       --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH" \
-      --add-flags "-configuration \$HOME/.eclipse/''${productId}_${productVersion}/configuration"
+      --add-flags "-configuration \$HOME/.eclipse/''${productId}_${version}/configuration"
 
     # Create desktop item.
     mkdir -p $out/share/applications
diff --git a/pkgs/applications/editors/eclipse/default.nix b/pkgs/applications/editors/eclipse/default.nix
index db85c9ccfb4c..d84e0b0e42bd 100644
--- a/pkgs/applications/editors/eclipse/default.nix
+++ b/pkgs/applications/editors/eclipse/default.nix
@@ -70,9 +70,7 @@ let
   };
   buildEclipse =
     eclipseData:
-    buildEclipseUnversioned (
-      eclipseData // { productVersion = "${platform_major}.${platform_minor}"; }
-    );
+    buildEclipseUnversioned (eclipseData // { version = "${platform_major}.${platform_minor}"; });
 
   generateEclipse =
     id:
@@ -85,7 +83,7 @@ let
       {
         name = "eclipse-${lib.strings.toLower id}";
         value = buildEclipse {
-          name = "eclipse-${lib.strings.toLower id}-${platform_major}.${platform_minor}";
+          pname = "eclipse-${lib.strings.toLower id}";
           inherit description;
           src = fetchurl {
             url =
diff --git a/pkgs/applications/editors/emacs/elisp-packages/recipes-archive-melpa.json b/pkgs/applications/editors/emacs/elisp-packages/recipes-archive-melpa.json
index 32a85169d3e3..6e40bc10a938 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/recipes-archive-melpa.json
+++ b/pkgs/applications/editors/emacs/elisp-packages/recipes-archive-melpa.json
@@ -33213,16 +33213,16 @@
   "repo": "sarg/emms-spotify",
   "unstable": {
    "version": [
-    20250322,
-    838
+    20250405,
+    915
    ],
    "deps": [
     "compat",
     "emms",
     "s"
    ],
-   "commit": "e553a2157fb2ebf4e0b00594067eea4c680a1940",
-   "sha256": "0avl3qz8l81mn6wnrvhlky7v50lbrb8s8ip9fsf6cdnf82l172n0"
+   "commit": "dec0d34736da7ff538117033b3758edde3b8e546",
+   "sha256": "1fhffnspnlw75523y5xma5i3wsyjd3h10p0z2h207cdlz1d1bwvv"
   },
   "stable": {
    "version": [
diff --git a/pkgs/applications/misc/devilspie2/default.nix b/pkgs/applications/misc/devilspie2/default.nix
index 89af855c7862..8fc86ff3a3ba 100644
--- a/pkgs/applications/misc/devilspie2/default.nix
+++ b/pkgs/applications/misc/devilspie2/default.nix
@@ -15,8 +15,8 @@ stdenv.mkDerivation rec {
   version = "0.44";
 
   src = fetchurl {
-    url = "https://download.savannah.gnu.org/releases/devilspie2/devilspie2-${version}.tar.xz";
-    sha256 = "Cp8erdKyKjGBY+QYAGXUlSIboaQ60gIepoZs0RgEJkA=";
+    url = "mirror://savannah/${pname}/${pname}-${version}.tar.xz";
+    hash = "sha256-Cp8erdKyKjGBY+QYAGXUlSIboaQ60gIepoZs0RgEJkA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 2255f3c544dc..bec5f8f88f8d 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -171,13 +171,13 @@
     "vendorHash": null
   },
   "bitbucket": {
-    "hash": "sha256-cHuBfF0R/n03Y5KNnbdsWcGeX24+NPT2HnsQpTivCf0=",
+    "hash": "sha256-UQbF6erjW3nGlgsDr2OFhHmyDyFGpjAfgQx91Mke1cE=",
     "homepage": "https://registry.terraform.io/providers/DrFaust92/bitbucket",
     "owner": "DrFaust92",
     "repo": "terraform-provider-bitbucket",
-    "rev": "v2.45.1",
+    "rev": "v2.46.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-iNY6Jz/SKOLynx33smDFbg371Wa31CouNtrOuV7lkcw="
+    "vendorHash": "sha256-XD7xvp8P9zaDJ5J07+cc+mFZA3F1JQDvK+1Tgqb6k/o="
   },
   "bitwarden": {
     "hash": "sha256-fUmwIfRiLpbhENPZwc9CWZsIugppfc68qGR1Iy1UyBE=",
@@ -317,13 +317,13 @@
     "vendorHash": "sha256-ZCMSmOCPEMxCSpl3DjIUGPj1W/KNJgyjtHpmQ19JquA="
   },
   "datadog": {
-    "hash": "sha256-nevuczChWR4HPDefChJnSAVI53TFuPFdyDwKsHM3SW8=",
+    "hash": "sha256-7V4nSuksCvy2fSyQbzVo0RlEaevUwCIlX61y3GEBqVk=",
     "homepage": "https://registry.terraform.io/providers/DataDog/datadog",
     "owner": "DataDog",
     "repo": "terraform-provider-datadog",
-    "rev": "v3.58.0",
+    "rev": "v3.59.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-tf0lVgueRNVXfttzrCyy0TSiQAVGcWIUCoDLyOWfW7s="
+    "vendorHash": "sha256-vOg972dcpX9MEZ/GaPGcm0OIC1xu+p6KMcflEUPx0hU="
   },
   "deno": {
     "hash": "sha256-7IvJrhXMeAmf8e21QBdYNSJyVMEzLpat4Tm4zHWglW8=",
@@ -516,13 +516,13 @@
     "vendorHash": "sha256-oGO+++WMiXUTCLFdBH2/uAzdN3RtrSNDSUBVMIYmI14="
   },
   "google-beta": {
-    "hash": "sha256-FybWpnUBQCxY1XQNSCk4slUg6vF8XDW1uQwgF0a2PgQ=",
+    "hash": "sha256-XocoPOGErjT2UMoJZA4Tpeq5lzLSXV9SWud+/zFSpfc=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "repo": "terraform-provider-google-beta",
-    "rev": "v6.26.0",
+    "rev": "v6.28.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-AQKukbsW+EYndMxUpUHIWPh3taaJINs6qY9xhkP/N54="
+    "vendorHash": "sha256-6dmNe/Ky+FACzDSjp3SCv4N4783K3CszhQ6eXRQ5qzM="
   },
   "googleworkspace": {
     "hash": "sha256-dedYnsKHizxJZibuvJOMbJoux0W6zgKaK5fxIofKqCY=",
@@ -534,13 +534,13 @@
     "vendorHash": "sha256-fqVBnAivVekV+4tpkl+E6eNA3wi8mhLevJRCs3W7L2g="
   },
   "grafana": {
-    "hash": "sha256-A6rCZbnLSbPHn+QQ5wMlINRqT04tEvil2rHkdr5iBQw=",
+    "hash": "sha256-uWRFi0jYGwlZ1b8qvVoL/NslI6e5bv76QmlWL5C7fA8=",
     "homepage": "https://registry.terraform.io/providers/grafana/grafana",
     "owner": "grafana",
     "repo": "terraform-provider-grafana",
-    "rev": "v3.22.0",
+    "rev": "v3.22.2",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-GFH2w4bdqYWl0eFBo1r6YL1pA0l5QMwrXQ9BvK3DmEI="
+    "vendorHash": "sha256-wqGNczKE2IFq/wLb8fj5+k07Vh1dR1oXwW06fIWV6Eg="
   },
   "gridscale": {
     "hash": "sha256-Ygt3L/dzwycccQZmuwbcaLHp9FBGNHgU19wSNmY8PzQ=",
@@ -615,11 +615,11 @@
     "vendorHash": "sha256-GoOKTT+EOhaPhpbgSW3SycYsE8LEQP0v4eQfiTEnPy8="
   },
   "huaweicloud": {
-    "hash": "sha256-VSnjbjfE551IfZNsJh24pye3MaznTB1GQlmbM4IsJK4=",
+    "hash": "sha256-kwtQQOVIJy03tW2tRURN0NhYW5MT8O65nRdydnkipx0=",
     "homepage": "https://registry.terraform.io/providers/huaweicloud/huaweicloud",
     "owner": "huaweicloud",
     "repo": "terraform-provider-huaweicloud",
-    "rev": "v1.73.3",
+    "rev": "v1.73.5",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -813,13 +813,13 @@
     "vendorHash": "sha256-QxbZv6YMa5/I4bTeQBNdmG3EKtLEmstnH7HMiZzFJrI="
   },
   "migadu": {
-    "hash": "sha256-80ke9CIl7kBUF3JRgydikXow2G3XhSVX8EZK7sd8xzA=",
+    "hash": "sha256-Bt4hy8GwEMAmNP8l8kvTxXV48EfJq4SPzihXL44JHSU=",
     "homepage": "https://registry.terraform.io/providers/metio/migadu",
     "owner": "metio",
     "repo": "terraform-provider-migadu",
-    "rev": "2025.3.20",
+    "rev": "2025.4.3",
     "spdx": "0BSD",
-    "vendorHash": "sha256-xORnddTfzbQ1ZwINLF2/Fwi/rJ1KyxPzBKfNkQKNg0w="
+    "vendorHash": "sha256-pKUgvL46lY9K2GBCYpQKkmudCQKhCViAXniMWtrSxbc="
   },
   "minio": {
     "hash": "sha256-OIdXZIy+W8yO3y7z/1JzG7QegJmMLTFSoC7FmioscmA=",
@@ -885,13 +885,13 @@
     "vendorHash": "sha256-YmZvHzrEZVvXI8CIcjX40s+MHTThPeXNQ05cnqkNbbE="
   },
   "ns1": {
-    "hash": "sha256-llJmz8QWwoApmhWEXlQMlVvteXSlkZhXh7tCWuMMbrc=",
+    "hash": "sha256-KvslOHWMEYFFrVCF2AOH3x2ENtoZeZQ+WC3ZvXiEcEc=",
     "homepage": "https://registry.terraform.io/providers/ns1-terraform/ns1",
     "owner": "ns1-terraform",
     "repo": "terraform-provider-ns1",
-    "rev": "v2.5.3",
+    "rev": "v2.6.2",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-jZAwCXozHYReks6ZGjqkvIitWeg19AVGm3R9r20XsMM="
+    "vendorHash": "sha256-1qFfXwlLRIAKUswrTeLtWVsZmOE/LfXrfnW8MgM8JaU="
   },
   "null": {
     "hash": "sha256-zvzBWnxWVXNOebnlgaP8lzwk6DMwwkGxx4i1QKCLSz0=",
@@ -967,13 +967,13 @@
     "vendorHash": "sha256-0Atbzx1DjInPMa1lNxyNKfNMILjN4S814TlIAQeTfdI="
   },
   "opentelekomcloud": {
-    "hash": "sha256-+ngMqXN5jrHTNZm0BJWppUzD/i6r6UznY8YsA26SdY4=",
+    "hash": "sha256-Wn5KjmQMIHeP99jXh+7ZVfj/DD6fZEZFHdQ0kAKa0yk=",
     "homepage": "https://registry.terraform.io/providers/opentelekomcloud/opentelekomcloud",
     "owner": "opentelekomcloud",
     "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.36.33",
+    "rev": "v1.36.34",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-v0Jr7yh2DCA89UxxOUU7sC7jQ1myv70T3+DjBPpz5pE="
+    "vendorHash": "sha256-hpMwKy+DfwM9dPojYO5kKz7RF5mWagxwh5Gl8lefXSc="
   },
   "openwrt": {
     "hash": "sha256-z78IceF2VJtiQpVqC+rTUDsph73LZawIK+az3rEhljA=",
@@ -1102,11 +1102,11 @@
     "vendorHash": "sha256-lkooWo0DbpL4zjNQ20TRw+hsHXWZP9u7u95n1WyzTQk="
   },
   "rootly": {
-    "hash": "sha256-KAeTOvh67bEpLVV/9jr1GI78wTA3Wu6zl69GlLKkPaA=",
+    "hash": "sha256-9D4dOPJAmSdKhJ3TLhQVHsmGxKoD7oiIDBgltCjxl6I=",
     "homepage": "https://registry.terraform.io/providers/rootlyhq/rootly",
     "owner": "rootlyhq",
     "repo": "terraform-provider-rootly",
-    "rev": "v2.24.2",
+    "rev": "v2.26.2",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-iq/Skuegzn9bz7aF6COYeoXQpXmKDkvKJJ/fnJqyJFg="
   },
@@ -1156,13 +1156,13 @@
     "vendorHash": "sha256-kCVJEIR+3DAOoDzqv1Dd2JUPmEpO3sGHcjbEbMZT4BM="
   },
   "sentry": {
-    "hash": "sha256-2JfzteVripOz96bAtQXC32wi8dWUQw8bry0HllNRQRA=",
+    "hash": "sha256-6GcO+r8Mp6cX33akQ8igjueJPlIXMYASiRlQrqfG4o8=",
     "homepage": "https://registry.terraform.io/providers/jianyuan/sentry",
     "owner": "jianyuan",
     "repo": "terraform-provider-sentry",
-    "rev": "v0.14.3",
+    "rev": "v0.14.4",
     "spdx": "MIT",
-    "vendorHash": "sha256-RbUBHX0/nUihgiK6ibbkR/2DKJOdJt9VYyCJgWsj2zo="
+    "vendorHash": "sha256-eBqhJY02JDZmtP8ccbcg5ZAJRejiDNr3cI/eBhbBNwE="
   },
   "shell": {
     "hash": "sha256-LTWEdXxi13sC09jh+EFZ6pOi1mzuvgBz5vceIkNE/JY=",
diff --git a/pkgs/applications/networking/feedreaders/tuifeed/default.nix b/pkgs/applications/networking/feedreaders/tuifeed/default.nix
index 9e8fc2a57c6a..acb9a3cd87e7 100644
--- a/pkgs/applications/networking/feedreaders/tuifeed/default.nix
+++ b/pkgs/applications/networking/feedreaders/tuifeed/default.nix
@@ -8,15 +8,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tuifeed";
-  version = "0.4.1";
+  version = "0.4.2";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-/13YC5ur633bCRq2pEQKWL+EwLFp5ZkJF6Pnipqo76s=";
+    hash = "sha256-CL6cd9OfvnA5N4W3rGl7XLcnlSrh3kcqA7idxexkjA4=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-xfva1kEJz/KjPB5YP11130pyQngYUWAyqH3dVU7WqI8=";
+  cargoHash = "sha256-A7kD46gfXWK/OlFVMULlMa7Z9Q1it9/rhGo6pjFa38k=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ Security ];
 
diff --git a/pkgs/applications/radio/klog/default.nix b/pkgs/applications/radio/klog/default.nix
index 9ac067a41897..f4729c183ed9 100644
--- a/pkgs/applications/radio/klog/default.nix
+++ b/pkgs/applications/radio/klog/default.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
   version = "1.3.2";
 
   src = fetchurl {
-    url = "https://download.savannah.nongnu.org/releases/klog/${pname}-${version}.tar.gz";
+    url = "mirror://savannah/${pname}/${pname}-${version}.tar.gz";
     sha256 = "1d5x7rq0mgfrqws3q1y4z8wh2qa3gvsmd0ssf2yqgkyq3fhdrb5c";
   };
 
diff --git a/pkgs/build-support/dlang/dub-to-nix/dub-to-nix.py b/pkgs/build-support/dlang/dub-to-nix/dub-to-nix.py
index b3cd3e511f09..879acc5f4acb 100644
--- a/pkgs/build-support/dlang/dub-to-nix/dub-to-nix.py
+++ b/pkgs/build-support/dlang/dub-to-nix/dub-to-nix.py
@@ -60,7 +60,7 @@ for pname in depsDict:
         command = ["nix-prefetch-git", strippedRepo, version]
         rawRes = subprocess.run(command, check=True, text=True, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL).stdout
         sha256 = json.loads(rawRes)["sha256"]
-        lockedDepsDict[pname] = {"version": version, "repository": repository, "sha256": sha256}
+        lockedDepsDict[pname] = {"version": version, "repository": strippedRepo, "sha256": sha256}
     else:
         eprint(f"Fetching {pname}@{version}")
         url = f"https://code.dlang.org/packages/{pname}/{version}.zip"
diff --git a/pkgs/build-support/fetchurl/mirrors.nix b/pkgs/build-support/fetchurl/mirrors.nix
index ea6ee11b23b3..731ad0104206 100644
--- a/pkgs/build-support/fetchurl/mirrors.nix
+++ b/pkgs/build-support/fetchurl/mirrors.nix
@@ -215,13 +215,19 @@
 
   # SAMBA
   samba = [
-    "https://www.samba.org/ftp/"
-    "http://www.samba.org/ftp/"
+    "https://download.samba.org/pub/"
+    "http://download.samba.org/pub/"
   ];
 
   # GNU Savannah
   savannah = [
-    # Mirrors from https://download-mirror.savannah.gnu.org/releases/00_MIRRORS.html
+    # Try the official HTTP(S) dispatchers first.
+    # These generate redirects to mirrors appropriate for the user.
+    "https://download.savannah.gnu.org/releases/"
+    "https://download.savannah.nongnu.org/releases/"
+
+    # If the above fail, try some individual mirrors.
+    # These are taken from https://download-mirror.savannah.gnu.org/releases/00_MIRRORS.html
     "https://mirror.easyname.at/nongnu/"
     "https://savannah.c3sl.ufpr.br/"
     "https://mirror.csclub.uwaterloo.ca/nongnu/"
diff --git a/pkgs/by-name/ac/act/package.nix b/pkgs/by-name/ac/act/package.nix
index 0243af57fe21..ed31c174d388 100644
--- a/pkgs/by-name/ac/act/package.nix
+++ b/pkgs/by-name/ac/act/package.nix
@@ -8,7 +8,7 @@
 }:
 
 let
-  version = "0.2.75";
+  version = "0.2.76";
 in
 buildGoModule {
   pname = "act";
@@ -18,10 +18,10 @@ buildGoModule {
     owner = "nektos";
     repo = "act";
     tag = "v${version}";
-    hash = "sha256-YIhgS1kQ9EKoIaSp/zGVQmWXyYZranEQU9onQW3gD0k=";
+    hash = "sha256-9Pn4Yzc0ZjOJy0ktJl/C1OXHkJ4vZrA0d4FJTooLvWU=";
   };
 
-  vendorHash = "sha256-LKNajCwb33syv9KcNHKYIGTnAN8r7PkGilDB3HnKkY4=";
+  vendorHash = "sha256-ak7JFh739SoHeiEWLjthqAn1KHamGujYJNa3ZIdhLLQ=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/ai/aide/package.nix b/pkgs/by-name/ai/aide/package.nix
index 43a9849688de..9ec1e6d05692 100644
--- a/pkgs/by-name/ai/aide/package.nix
+++ b/pkgs/by-name/ai/aide/package.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "aide";
-  version = "0.18.8";
+  version = "0.19";
 
   src = fetchurl {
     url = "https://github.com/aide/aide/releases/download/v${version}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-FmYtxjLRfixWMLgBdS+XkSqOIml8Bl694XXxzDe4OmA=";
+    sha256 = "sha256-5/ugIUvgEpnXY1m/8pdSM+0kEzLkz8//Wc0baomrpeQ=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/av/avbroot/package.nix b/pkgs/by-name/av/avbroot/package.nix
index eedf43f8f5f1..f6b7535271b3 100644
--- a/pkgs/by-name/av/avbroot/package.nix
+++ b/pkgs/by-name/av/avbroot/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "avbroot";
-  version = "3.14.0";
+  version = "3.15.0";
 
   src = fetchFromGitHub {
     owner = "chenxiaolong";
     repo = "avbroot";
     tag = "v${version}";
-    hash = "sha256-d0sYOTM9o100XJ+5WzjSGM41Ax+l6LHlM0/Lbwz8gVc=";
+    hash = "sha256-OICx08MiiiocqVB61fMiUSmG7QOpsrLfPkLuDktTXt0=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-LrjzDser5J7fIfviAGxeCmaoeu4XV/aG54ptiVI3Mn4=";
+  cargoHash = "sha256-iZUGFzg+x4aPL8AoPYVugjrB5ZSrmaCRWMcEovlcPx4=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/aw/aws-iam-authenticator/package.nix b/pkgs/by-name/aw/aws-iam-authenticator/package.nix
index 24e83364591f..d1bc599ae78c 100644
--- a/pkgs/by-name/aw/aws-iam-authenticator/package.nix
+++ b/pkgs/by-name/aw/aws-iam-authenticator/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "aws-iam-authenticator";
-  version = "0.6.30";
+  version = "0.6.31";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-pgAk2qhsJTXbaXtdmKkA5GUIJt2ShWJ1mG6h0Zuh+Ng=";
+    hash = "sha256-v0CWwDLgjMU9kjPx5yUUauWNnzP0gP5zm4xCzBMPZpE=";
   };
 
   vendorHash = "sha256-dR98s5g2KFGJIFbgYHmW2813GEhLFZZvV5nja84a0Ik=";
diff --git a/pkgs/by-name/be/better-commits/package.nix b/pkgs/by-name/be/better-commits/package.nix
new file mode 100644
index 000000000000..b29e209e3d64
--- /dev/null
+++ b/pkgs/by-name/be/better-commits/package.nix
@@ -0,0 +1,32 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  nodejs,
+  nix-update-script,
+}:
+
+buildNpmPackage rec {
+  pname = "better-commits";
+  version = "1.16.1";
+
+  src = fetchFromGitHub {
+    owner = "Everduin94";
+    repo = "better-commits";
+    tag = "v${version}";
+    hash = "sha256-70PEcktGGck7egDmaIteFEMCNpo6ZuWyIVPiOywr2tc=";
+  };
+
+  npmDepsHash = "sha256-g34UutgT5315BpsQSuGGLIU6Ga+hpEz74HNLKKOB+ec=";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = with lib; {
+    description = "CLI for creating better commits following the conventional commits specification";
+    homepage = "https://github.com/Everduin94/better-commits";
+    license = licenses.mit;
+    maintainers = [ maintainers.ilarvne ];
+    platforms = platforms.unix;
+    mainProgram = "better-commits";
+  };
+}
diff --git a/pkgs/by-name/bi/bird-lg/package.nix b/pkgs/by-name/bi/bird-lg/package.nix
index db6fb798c0d4..8bb1180a8fa2 100644
--- a/pkgs/by-name/bi/bird-lg/package.nix
+++ b/pkgs/by-name/bi/bird-lg/package.nix
@@ -9,13 +9,13 @@ let
     { modRoot, vendorHash }:
     buildGoModule rec {
       pname = "bird-lg-${modRoot}";
-      version = "1.3.5";
+      version = "1.3.8";
 
       src = fetchFromGitHub {
         owner = "xddxdd";
         repo = "bird-lg-go";
         rev = "v${version}";
-        hash = "sha256-lWpTIuN+wCSDBHmpRIfVG8Z1Qx1s55MnJomQPjczB5k=";
+        hash = "sha256-j81cfHqXNsTM93ofxXz+smkjN8OdJXxtm9z5LdzC+r8=";
       };
 
       doDist = false;
@@ -41,12 +41,12 @@ let
 
   bird-lg-frontend = generic {
     modRoot = "frontend";
-    vendorHash = "sha256-+M9Mlqck2E/ETW+NXsKwIeWlmZAaBU07fgDhKUU9PAI=";
+    vendorHash = "sha256-luJuIZ0xN8mdtWwTlfEDnAwMgt+Tzxlk2ZIDPIwHpcY=";
   };
 
   bird-lg-proxy = generic {
     modRoot = "proxy";
-    vendorHash = "sha256-nBTLQUX68f98D0RTlyX0gnvhQ+bu8d3Vv67J/YoXJxs=";
+    vendorHash = "sha256-OVyfPmLTHV5RFdLgRHEH/GqxuG5MnGt9Koz0DxpSg+4=";
   };
 in
 symlinkJoin {
diff --git a/pkgs/by-name/cf/cfspeedtest/package.nix b/pkgs/by-name/cf/cfspeedtest/package.nix
index 9f3adc36999b..e4fe48bb2b10 100644
--- a/pkgs/by-name/cf/cfspeedtest/package.nix
+++ b/pkgs/by-name/cf/cfspeedtest/package.nix
@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cfspeedtest";
-  version = "1.3.1";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner = "code-inflation";
     repo = "cfspeedtest";
     tag = "v${version}";
-    hash = "sha256-86PZlTwqplKCVZl6IG2Qch+IMdfiTfpBhdNf00XIXbU=";
+    hash = "sha256-Q1K5UcrSckEN+6W9UO2u07R3mZ6+J8E1ZYRZqnXif1s=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-54gIhBuVl77NDGotbgcOJsPxZL3XdJBnDEDbNpbVSNk=";
+  cargoHash = "sha256-moYovJamW9xX3niO10bG9K3choDMV3wtuUSCn/5g1Yw=";
 
   meta = with lib; {
     description = "Unofficial CLI for speed.cloudflare.com";
diff --git a/pkgs/by-name/ch/charm-freeze/package.nix b/pkgs/by-name/ch/charm-freeze/package.nix
index cfe6109d7bc6..d5da8ac2253c 100644
--- a/pkgs/by-name/ch/charm-freeze/package.nix
+++ b/pkgs/by-name/ch/charm-freeze/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "charm-freeze";
-  version = "0.2.0";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = "freeze";
     rev = "v${version}";
-    hash = "sha256-eV8X/vftF/GGuM0RnLCkIStSR98fN6nmW3BzoASPLH0=";
+    hash = "sha256-1zc62m1uS8Bl6x54SG2///PWfiKbZood6VBibbsFX7I=";
   };
 
-  vendorHash = "sha256-Y/UsqYtzXtOCE4bGf/mRAqJ0GxEtKq0qYecbitn0EhM=";
+  vendorHash = "sha256-BEMVjPexJ3Y4ScXURu7lbbmrrehc6B09kfr03b/SPg8=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ci/ciel/package.nix b/pkgs/by-name/ci/ciel/package.nix
index 343c1e116317..98bfd6f8e185 100644
--- a/pkgs/by-name/ci/ciel/package.nix
+++ b/pkgs/by-name/ci/ciel/package.nix
@@ -16,17 +16,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ciel";
-  version = "3.3.0";
+  version = "3.9.6";
 
   src = fetchFromGitHub {
     owner = "AOSC-Dev";
     repo = "ciel-rs";
     tag = "v${version}";
-    hash = "sha256-vV1qZLVVVc6KFZrpF4blKmbfQjf/Ltn+IhmM5Zqb2zU=";
+    hash = "sha256-J6mXNJuLkKVNzE5lRRQEOt0yb2ow5EctXkr22eqOfII=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-A52SV0Ng6exHEtlaZWBvVTEAqMKp6unQBhr1cozQTWo=";
+  cargoHash = "sha256-n9VCy3nlZ+WDm9krlc3XO/YgdrbEMJuODBvYRkznUgU=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ci/cinny-desktop/package.nix b/pkgs/by-name/ci/cinny-desktop/package.nix
index 06ace97cbaf7..cb03aff15db3 100644
--- a/pkgs/by-name/ci/cinny-desktop/package.nix
+++ b/pkgs/by-name/ci/cinny-desktop/package.nix
@@ -21,19 +21,19 @@
 rustPlatform.buildRustPackage rec {
   pname = "cinny-desktop";
   # We have to be using the same version as cinny-web or this isn't going to work.
-  version = "4.5.1";
+  version = "4.6.0";
 
   src = fetchFromGitHub {
     owner = "cinnyapp";
     repo = "cinny-desktop";
     tag = "v${version}";
-    hash = "sha256-xWHR0lg/3w2K+hExKCD84hdQ7UCZRrOnH2dNybaYMFE=";
+    hash = "sha256-tSZ7qSEoLNUnMICT1oVccMY9J6uVZu8QJGJA9NK8JwU=";
   };
 
   sourceRoot = "${src.name}/src-tauri";
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-iI0oWuETVVPuoKlWplsgocF7DEvwTVSp5r1WmQd7R04=";
+  cargoHash = "sha256-5rIbVYxSsjv+MvmZxviMhcfYN+jOFndvZa7PDO5DLn8=";
 
   postPatch =
     let
diff --git a/pkgs/by-name/ci/cinny-unwrapped/package.nix b/pkgs/by-name/ci/cinny-unwrapped/package.nix
index 66eacdb06d24..c8a1b5da5b19 100644
--- a/pkgs/by-name/ci/cinny-unwrapped/package.nix
+++ b/pkgs/by-name/ci/cinny-unwrapped/package.nix
@@ -13,16 +13,16 @@
 
 buildNpmPackage rec {
   pname = "cinny-unwrapped";
-  version = "4.5.1";
+  version = "4.6.0";
 
   src = fetchFromGitHub {
     owner = "cinnyapp";
     repo = "cinny";
     rev = "v${version}";
-    hash = "sha256-uwazJSd9I80ExKv22Ycg/fBDGZ1GuW4pcBo83lUwhoc=";
+    hash = "sha256-MyVKRWhLXxz4h2/2OtpmYrLYiZeNOMEetHwl4NklkOA=";
   };
 
-  npmDepsHash = "sha256-o5txGbuNl+ZMk5acu/0/5CTNTvdP+Tqyw7heFRaZ4lM=";
+  npmDepsHash = "sha256-WNK1ke5NEbt2Gb92hEItnwu65rI/5VsbZDfTSp6aKvg=";
 
   nativeBuildInputs = [
     python3
diff --git a/pkgs/by-name/ci/circumflex/package.nix b/pkgs/by-name/ci/circumflex/package.nix
index 926a660f0a66..b2d65ddb6479 100644
--- a/pkgs/by-name/ci/circumflex/package.nix
+++ b/pkgs/by-name/ci/circumflex/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "circumflex";
-  version = "3.7";
+  version = "3.8";
 
   src = fetchFromGitHub {
     owner = "bensadeh";
     repo = "circumflex";
     rev = version;
-    hash = "sha256-jjtjOT8lFPsk300Q9EtsX/w8Bck0pwrS/GyouoBsZ+0=";
+    hash = "sha256-qponQtfpAXQxpAhkXaylgzpsvbccTIz9kmhdI4tPuNQ=";
   };
 
-  vendorHash = "sha256-Nlv8H5YqHrqACW2kEXg+mkc3bCgXVudrSNfyu+xeFBA=";
+  vendorHash = "sha256-HTrV2zK4i5gN2msIl0KTwjdmEDLjFz5fMCig1YPIC1A=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/ck/ckbcomp/package.nix b/pkgs/by-name/ck/ckbcomp/package.nix
index 74a25d1a5c09..4d003bd16af9 100644
--- a/pkgs/by-name/ck/ckbcomp/package.nix
+++ b/pkgs/by-name/ck/ckbcomp/package.nix
@@ -8,14 +8,14 @@
 
 stdenv.mkDerivation rec {
   pname = "ckbcomp";
-  version = "1.235";
+  version = "1.236";
 
   src = fetchFromGitLab {
     domain = "salsa.debian.org";
     owner = "installer-team";
     repo = "console-setup";
     rev = version;
-    sha256 = "sha256-EGUPj5MesEhC+W6E+8Cute3HtpurwZk0TlcLBReepvI=";
+    sha256 = "sha256-b7ck48wRPga/ugCVbPCKRSRrpawIJCsEV1kbNeXDIHk=";
   };
 
   buildInputs = [ perl ];
diff --git a/pkgs/by-name/cl/clickhouse-backup/package.nix b/pkgs/by-name/cl/clickhouse-backup/package.nix
index 95cec6db8584..5ffa4cf9151c 100644
--- a/pkgs/by-name/cl/clickhouse-backup/package.nix
+++ b/pkgs/by-name/cl/clickhouse-backup/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "clickhouse-backup";
-  version = "2.6.9";
+  version = "2.6.13";
 
   src = fetchFromGitHub {
     owner = "Altinity";
     repo = "clickhouse-backup";
     rev = "v${version}";
-    hash = "sha256-zGyrPFLt+lKeTJ46qqTTr3MllA4q2bml3zFISQ+HEa0=";
+    hash = "sha256-8yvhDpSOklkWIi10o0QBd8bUB9qOF+nDhgaOD8G5FqU=";
   };
 
   vendorHash = "sha256-4qPZihOuaD8lKF31fhyTDG7gBa0gExLVavazGZWDyAk=";
diff --git a/pkgs/by-name/co/code-cursor/package.nix b/pkgs/by-name/co/code-cursor/package.nix
index 2af676d2d474..f601b788fa6d 100644
--- a/pkgs/by-name/co/code-cursor/package.nix
+++ b/pkgs/by-name/co/code-cursor/package.nix
@@ -48,26 +48,26 @@
 }:
 let
   pname = "cursor";
-  version = "0.48.6";
+  version = "0.48.7";
 
   inherit (stdenvNoCC) hostPlatform;
 
   sources = {
     x86_64-linux = fetchurl {
-      url = "https://downloads.cursor.com/production/1649e229afdef8fd1d18ea173f063563f1e722ef/linux/x64/Cursor-0.48.6-x86_64.AppImage";
-      hash = "sha256-ZiQpVRZRaFOJ8UbANRd1F+4uhv7W/t15d9wmGKshu80=";
+      url = "https://downloads.cursor.com/production/1d623c4cc1d3bb6e0fe4f1d5434b47b958b05876/linux/x64/Cursor-0.48.7-x86_64.AppImage";
+      hash = "sha256-LxAUhmEM02qCaeUUsHgjv0upAF7eerX+/QiGeKzRY4M=";
     };
     aarch64-linux = fetchurl {
-      url = "https://downloads.cursor.com/production/1649e229afdef8fd1d18ea173f063563f1e722ef/linux/arm64/Cursor-0.48.6-aarch64.AppImage";
-      hash = "sha256-PUnrQz/H4hfbyX4mumG5v4DcKG6N6yh6taMpnnG35hQ=";
+      url = "https://downloads.cursor.com/production/1d623c4cc1d3bb6e0fe4f1d5434b47b958b05876/linux/arm64/Cursor-0.48.7-aarch64.AppImage";
+      hash = "sha256-l1T0jLX7oWjq4KzxO4QniUAjzVbBu4SWA1r5aXGpDS4=";
     };
     x86_64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/production/1649e229afdef8fd1d18ea173f063563f1e722ef/darwin/x64/Cursor-darwin-x64.dmg";
-      hash = "sha256-S2l2Kz3rG6z4iKLyGFeKVeyrWq7eb09v1+knBln+Mgk=";
+      url = "https://downloads.cursor.com/production/1d623c4cc1d3bb6e0fe4f1d5434b47b958b05876/darwin/x64/Cursor-darwin-x64.dmg";
+      hash = "sha256-h9zcmZRpOcfBRK5Xw/AdY/rwlINEHYiUgpCoGXg6hSY=";
     };
     aarch64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/production/1649e229afdef8fd1d18ea173f063563f1e722ef/darwin/arm64/Cursor-darwin-arm64.dmg";
-      hash = "sha256-6QEH/A6qxKLyrJQQkFj4FFXF/BoVupov92ve7fO0ads=";
+      url = "https://downloads.cursor.com/production/1d623c4cc1d3bb6e0fe4f1d5434b47b958b05876/darwin/arm64/Cursor-darwin-arm64.dmg";
+      hash = "sha256-FsXabTXN1Bkn1g4ZkQVqa+sOx4JkSG9c09tp8lAcPKM=";
     };
   };
 
diff --git a/pkgs/by-name/co/comrak/package.nix b/pkgs/by-name/co/comrak/package.nix
index d12b2c2466d0..6f9de3711b87 100644
--- a/pkgs/by-name/co/comrak/package.nix
+++ b/pkgs/by-name/co/comrak/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "comrak";
-  version = "0.37.0";
+  version = "0.38.0";
 
   src = fetchFromGitHub {
     owner = "kivikakk";
     repo = "comrak";
     rev = "v${version}";
-    sha256 = "sha256-LnsYGRsQvKUIYTgeN3Z9BKga8hHmrHSA/ucH9dNDYPI=";
+    sha256 = "sha256-chgg/6BJlCTOWPQ0jnE4l5O/lk0iA4xSwdWURKMF+f8=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-YyOJr/Y7Q2yJ21u+wyYeDe9SDmFuKlPVRol3IclOOQU=";
+  cargoHash = "sha256-lP0eGjYZ3AOOH8O4N77QRCNt5Vd2FGfP95vdJN467rE=";
 
   meta = with lib; {
     description = "CommonMark-compatible GitHub Flavored Markdown parser and formatter";
diff --git a/pkgs/by-name/cu/cuyo/package.nix b/pkgs/by-name/cu/cuyo/package.nix
index f95a9d3b5a91..1f816b9fa00c 100644
--- a/pkgs/by-name/cu/cuyo/package.nix
+++ b/pkgs/by-name/cu/cuyo/package.nix
@@ -12,7 +12,7 @@ stdenv.mkDerivation {
   version = "2.1.0";
 
   src = fetchurl {
-    url = "https://download.savannah.gnu.org/releases/cuyo/cuyo-2.1.0.tar.gz";
+    url = "mirror://savannah/cuyo/cuyo-2.1.0.tar.gz";
     sha256 = "17yqv924x7yvwix7yz9jdhgyar8lzdhqvmpvv0any8rdkajhj23c";
   };
 
diff --git a/pkgs/by-name/da/dart-sass/package.nix b/pkgs/by-name/da/dart-sass/package.nix
index 0db5d2922fdc..d8247bf18f97 100644
--- a/pkgs/by-name/da/dart-sass/package.nix
+++ b/pkgs/by-name/da/dart-sass/package.nix
@@ -22,13 +22,13 @@ let
 in
 buildDartApplication rec {
   pname = "dart-sass";
-  version = "1.86.0";
+  version = "1.86.3";
 
   src = fetchFromGitHub {
     owner = "sass";
     repo = "dart-sass";
     rev = version;
-    hash = "sha256-TYjw3ACeScP1bf12mKB5U3DxPspkCsupQADc0CFDKLw=";
+    hash = "sha256-HYuKSZLLL3Eg1FPrHK25H1GLuyC/xL9i0DM9eQ6Ry9U=";
   };
 
   pubspecLock = lib.importJSON ./pubspec.lock.json;
diff --git a/pkgs/by-name/da/dart-sass/pubspec.lock.json b/pkgs/by-name/da/dart-sass/pubspec.lock.json
index bf2b9c210cb0..46debc0d3d30 100644
--- a/pkgs/by-name/da/dart-sass/pubspec.lock.json
+++ b/pkgs/by-name/da/dart-sass/pubspec.lock.json
@@ -394,11 +394,11 @@
       "dependency": "direct main",
       "description": {
         "name": "node_interop",
-        "sha256": "3af2420c728173806f4378cf89c53ba9f27f7f67792b898561bff9d390deb98e",
+        "sha256": "4848ac408c0cdd0f70136b755df816a8e4c96c244e5377a3fb3b8f8950666150",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.0"
+      "version": "2.2.0"
     },
     "node_preamble": {
       "dependency": "direct dev",
diff --git a/pkgs/by-name/dn/dns-over-https/package.nix b/pkgs/by-name/dn/dns-over-https/package.nix
index 524c957e8370..db100adceb15 100644
--- a/pkgs/by-name/dn/dns-over-https/package.nix
+++ b/pkgs/by-name/dn/dns-over-https/package.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule rec {
   pname = "dns-over-https";
-  version = "2.3.8";
+  version = "2.3.10";
 
   src = fetchFromGitHub {
     owner = "m13253";
     repo = "dns-over-https";
     tag = "v${version}";
-    hash = "sha256-0tjqj67PWPRChspUQQeZqtW68IB2G8N2vhebMwHNbX4=";
+    hash = "sha256-WQ6OyZfQMtW9nZcvlBjHk0R96NQr0Lc2mGB5taC0d6k=";
   };
 
-  vendorHash = "sha256-cASJYEglq2IrnxjqOCiepjExX/FmakeMjxPOsjUDTWM=";
+  vendorHash = "sha256-46BrN50G5IhdMwMVMU9Wdj/RFzUzIPoTRucCedMGu4g=";
 
   ldflags = [
     "-w"
diff --git a/pkgs/by-name/fa/fangfrisch/package.nix b/pkgs/by-name/fa/fangfrisch/package.nix
index 48e1726c7518..42e854feb3c5 100644
--- a/pkgs/by-name/fa/fangfrisch/package.nix
+++ b/pkgs/by-name/fa/fangfrisch/package.nix
@@ -2,6 +2,7 @@
   lib,
   python3,
   fetchFromGitHub,
+  nix-update-script,
 }:
 let
   version = "1.9.2";
@@ -30,6 +31,8 @@ python3.pkgs.buildPythonApplication {
 
   pythonImportsCheck = [ "fangfrisch" ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     description = "Update and verify unofficial Clam Anti-Virus signatures";
     homepage = "https://github.com/rseichter/fangfrisch";
diff --git a/pkgs/by-name/fa/fastjar/package.nix b/pkgs/by-name/fa/fastjar/package.nix
index c2d5f56dd08d..f7489cabea26 100644
--- a/pkgs/by-name/fa/fastjar/package.nix
+++ b/pkgs/by-name/fa/fastjar/package.nix
@@ -13,7 +13,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchzip {
     pname = "fastjar-source";
     inherit (finalAttrs) version;
-    url = "https://download.savannah.gnu.org/releases/fastjar/fastjar-${finalAttrs.version}.tar.gz";
+    url = "mirror://savannah/fastjar/fastjar-${finalAttrs.version}.tar.gz";
     hash = "sha256-8VyKNQaPLrXAy/UEm2QkBx56SSSoLdU/7w4IwrxbsQc=";
   };
 
diff --git a/pkgs/by-name/fe/fedistar/package.nix b/pkgs/by-name/fe/fedistar/package.nix
index 9403368fae8b..33b5d07a62e5 100644
--- a/pkgs/by-name/fe/fedistar/package.nix
+++ b/pkgs/by-name/fe/fedistar/package.nix
@@ -18,19 +18,19 @@
 let
   pnpm = pnpm_10;
   pname = "fedistar";
-  version = "1.11.1";
+  version = "1.11.2";
   src = fetchFromGitHub {
     owner = "h3poteto";
     repo = "fedistar";
     tag = "v${version}";
-    hash = "sha256-uAZUfYHFAfCToljXDq+yZhZp1P7vzmVUJ6rezbO1ykQ=";
+    hash = "sha256-W05vWCP4zHrijFzmdCPbX/aN4UbJ0ALXGMHyMAEEig4=";
   };
   fedistar-frontend = stdenvNoCC.mkDerivation (finalAttrs: {
     pname = "fedistar-frontend";
     inherit version src;
     pnpmDeps = pnpm.fetchDeps {
       inherit pname version src;
-      hash = "sha256-URMji1WTXVvX3gEYEG47IJGGTeh0wTJShy/eTZI5Xsw=";
+      hash = "sha256-s2Kz5+xsrjGB11zAChSTaJNUewGFA6JAcj4kuId+CDY=";
     };
     nativeBuildInputs = [
       pnpm.configHook
@@ -63,7 +63,7 @@ rustPlatform.buildRustPackage {
   sourceRoot = "${src.name}/src-tauri";
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Njan03/3D5KdN8IcGsfHBevXqy3b44SgfYj2exhAaVM=";
+  cargoHash = "sha256-0Z1V352rUXP+yKT55UOrH9ByJDYGJl/tYJG2ofJAKA0=";
 
   postPatch = ''
     substituteInPlace ./tauri.conf.json \
diff --git a/pkgs/by-name/ff/fflogs/package.nix b/pkgs/by-name/ff/fflogs/package.nix
index e9821fa90db2..66c57b296a66 100644
--- a/pkgs/by-name/ff/fflogs/package.nix
+++ b/pkgs/by-name/ff/fflogs/package.nix
@@ -6,10 +6,10 @@
 
 let
   pname = "fflogs";
-  version = "8.16.19";
+  version = "8.16.31";
   src = fetchurl {
     url = "https://github.com/RPGLogs/Uploaders-fflogs/releases/download/v${version}/fflogs-v${version}.AppImage";
-    hash = "sha256-qP/WpW1AYKrB0Cx/LpUlV1gw06mcFutxfGJybsAw1EQ=";
+    hash = "sha256-E/obhD5AwgF81oj4UXEjOmTGElHITxPalUrhbnN6IYs=";
   };
   extracted = appimageTools.extractType2 { inherit pname version src; };
 in
diff --git a/pkgs/by-name/gh/gh-skyline/package.nix b/pkgs/by-name/gh/gh-skyline/package.nix
index 21bd335c95f4..2e2024557344 100644
--- a/pkgs/by-name/gh/gh-skyline/package.nix
+++ b/pkgs/by-name/gh/gh-skyline/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "gh-skyline";
-  version = "0.1.3";
+  version = "0.1.4";
 
   src = fetchFromGitHub {
     owner = "github";
     repo = "gh-skyline";
     tag = "v${version}";
-    hash = "sha256-j8RAuujlze589+W+jvXJq1b7YX3uf+sd8qTvyZeKYUc=";
+    hash = "sha256-2i1f3iOrabTc+r5iUzghF3sJ7vgpTC1dmzY/z6h/oCg=";
   };
 
-  vendorHash = "sha256-rfv9KTTWs68pqSdgWo9dIn+PTe+77ZMOEhG0P37QwKo=";
+  vendorHash = "sha256-g4YqNts50RUBh1Gu9vSI29uvk0iHSnMgI1+KBFm5rNI=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/go/gocryptfs/package.nix b/pkgs/by-name/go/gocryptfs/package.nix
index f368a95fa11b..d894040fd55b 100644
--- a/pkgs/by-name/go/gocryptfs/package.nix
+++ b/pkgs/by-name/go/gocryptfs/package.nix
@@ -12,13 +12,13 @@
 
 buildGoModule rec {
   pname = "gocryptfs";
-  version = "2.5.2";
+  version = "2.5.3";
 
   src = fetchFromGitHub {
     owner = "rfjakob";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-H3J+1a4Y6/BqgU7D9j/PNtP6Ci3EjrtO/ADx3GpJMgI=";
+    sha256 = "sha256-0iCCIAOAzLIeZ+eZYJTVXgOyKIsQnKe/XazFVECZDTM=";
   };
 
   vendorHash = "sha256-WfTJ8TuFupEa391XQMDl3hKTjrmRHJqvYb1haAGHW/U=";
diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix
index ea27d21f4a1a..81dacf9f4956 100644
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -171,11 +171,11 @@ let
 
   linux = stdenv.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "134.0.6998.165";
+    version = "135.0.7049.52";
 
     src = fetchurl {
       url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-ibPD/V8oSeaPD236ryKfYc0LfJEDdbjs0u05iRpKjyU=";
+      hash = "sha256-SLRwm6XKgnM1xUhs8nVyUCSFhq3yH3fHoN2h8d2gpto=";
     };
 
     # With strictDeps on, some shebangs were not being patched correctly
@@ -274,11 +274,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "134.0.6998.166";
+    version = "135.0.7049.42";
 
     src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/drywet6kw733g5tvesvkdv5hlm_134.0.6998.166/GoogleChrome-134.0.6998.166.dmg";
-      hash = "sha256-jHD5L9mz/S9JSFjFVsNcHWx6xFFeCgOptEmclec6NiM=";
+      url = "http://dl.google.com/release2/chrome/acq3myotpqwugwaz3epmxxnjty3q_135.0.7049.42/GoogleChrome-135.0.7049.42.dmg";
+      hash = "sha256-/m05H4iD32Ro89J9NslEfGh8LMjQYAL989SenKxFNMM=";
     };
 
     dontPatch = true;
diff --git a/pkgs/by-name/gu/guile-reader/package.nix b/pkgs/by-name/gu/guile-reader/package.nix
index 8dc4a06fe080..ab79f2232cc3 100644
--- a/pkgs/by-name/gu/guile-reader/package.nix
+++ b/pkgs/by-name/gu/guile-reader/package.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   version = "0.6.3";
 
   src = fetchurl {
-    url = "http://download.savannah.nongnu.org/releases/${pname}/${pname}-${version}.tar.gz";
+    url = "mirror://savannah/${pname}/${pname}-${version}.tar.gz";
     hash = "sha256-OMK0ROrbuMDKt42QpE7D6/9CvUEMW4SpEBjO5+tk0rs=";
   };
 
diff --git a/pkgs/by-name/gu/gut/package.nix b/pkgs/by-name/gu/gut/package.nix
index c49ba59dfd81..4d854f5d43d4 100644
--- a/pkgs/by-name/gu/gut/package.nix
+++ b/pkgs/by-name/gu/gut/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "gut";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "julien040";
     repo = "gut";
     rev = version;
-    hash = "sha256-pjjeA0Nwc5M3LwxZLpBPnFqXJX0b6KDaj4YCPuGoUuU=";
+    hash = "sha256-3A6CwGIZGnTFkMRxDdDg/WpUQezNmGjjSz4Rj/6t1GI=";
   };
 
-  vendorHash = "sha256-G9oDMHLmdv/vQfofTqKAf21xaGp+lvW+sedLmaj+A5A=";
+  vendorHash = "sha256-EL+fsh603ydZfc3coI8VXkvAStQ0fwzBsJIOztB/VHc=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ha/hatsu/package.nix b/pkgs/by-name/ha/hatsu/package.nix
index d36a948d2c58..4d70666e56eb 100644
--- a/pkgs/by-name/ha/hatsu/package.nix
+++ b/pkgs/by-name/ha/hatsu/package.nix
@@ -7,17 +7,17 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "hatsu";
-  version = "0.3.2";
+  version = "0.3.3";
 
   src = fetchFromGitHub {
     owner = "importantimport";
     repo = "hatsu";
     tag = "v${version}";
-    hash = "sha256-lIuaG7xfBQ1r3SkgSsXj1Ph9apxwP3oI42uunMh+ijU=";
+    hash = "sha256-mqs26srbEkGeQzeF4OdqI7o18Ajs+mmAXGLlVfS52sk=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-gja8bVsnumJ0R3sN1WBV6WXAWjO9v/K+uBpNO1cTgRs=";
+  cargoHash = "sha256-5c6boVdq0XXbtVHqmIGoxJGQRh8lvn2jbmALPuOSMs4=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";
diff --git a/pkgs/by-name/in/inputplumber/package.nix b/pkgs/by-name/in/inputplumber/package.nix
index 6de63ac9ddba..e5f26e11ffc4 100644
--- a/pkgs/by-name/in/inputplumber/package.nix
+++ b/pkgs/by-name/in/inputplumber/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "inputplumber";
-  version = "0.49.6";
+  version = "0.50.0";
 
   src = fetchFromGitHub {
     owner = "ShadowBlip";
     repo = "InputPlumber";
     tag = "v${version}";
-    hash = "sha256-iLr7n+llvvIwS4JJMwZou4pDbT+sYOy6+un+g1YXrP4=";
+    hash = "sha256-sB3w9323lOw4wz/7wUu77mxiIjiuuAi5+j+MAK3rP7M=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-v0aMbaKoPL3wqcFHVcrGUGlvR5m3XhMTXD1k0YBz6OI=";
+  cargoHash = "sha256-zB1CM65OSQar8pY5I89eByNX8vEEwqIGvaGAxWhxTDM=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/je/jellyfin-web/package.nix b/pkgs/by-name/je/jellyfin-web/package.nix
index 8d9dd0f657dc..c9d29fb19d82 100644
--- a/pkgs/by-name/je/jellyfin-web/package.nix
+++ b/pkgs/by-name/je/jellyfin-web/package.nix
@@ -13,7 +13,7 @@
 }:
 buildNpmPackage rec {
   pname = "jellyfin-web";
-  version = "10.10.6";
+  version = "10.10.7";
 
   src =
     assert version == jellyfin.version;
@@ -21,7 +21,7 @@ buildNpmPackage rec {
       owner = "jellyfin";
       repo = "jellyfin-web";
       rev = "v${version}";
-      hash = "sha256-A6Y4tAJtocfRZ8R8Sio1RhgIDfvRG4Mk2JMhz2QZNwo=";
+      hash = "sha256-jX9Qut8YsJRyKI2L7Aww4+6G8z741WzN37CUx3KWQfY=";
     };
 
   nodejs = nodejs_20; # does not build with 22
@@ -31,7 +31,7 @@ buildNpmPackage rec {
       --replace-fail "git describe --always --dirty" "echo ${src.rev}" \
   '';
 
-  npmDepsHash = "sha256-ggRbZ7vjFe4KG+amcLEcjiZMtUc0JwSZoiKE9qwy0y4=";
+  npmDepsHash = "sha256-nfvqVByD3Kweq+nFJQY4R2uRX3mx/qJvGFiKiOyMUdw=";
 
   preBuild = ''
     # using sass-embedded fails at executing node_modules/sass-embedded-linux-x64/dart-sass/src/dart
diff --git a/pkgs/by-name/je/jellyfin/nuget-deps.json b/pkgs/by-name/je/jellyfin/nuget-deps.json
index 699cc8c76b3a..36a1b036aea9 100644
--- a/pkgs/by-name/je/jellyfin/nuget-deps.json
+++ b/pkgs/by-name/je/jellyfin/nuget-deps.json
@@ -121,8 +121,8 @@
   },
   {
     "pname": "LrcParser",
-    "version": "2024.728.2",
-    "hash": "sha256-fv0OkCfXEcXJqZcl70Ch3PduuomghPC2LscHU7nFtnc="
+    "version": "2025.228.1",
+    "hash": "sha256-1p471WX25rYpb0P/q3sEj35vLLa8QvokAbLO47D7wTM="
   },
   {
     "pname": "MetaBrainz.Common",
@@ -1246,8 +1246,8 @@
   },
   {
     "pname": "z440.atl.core",
-    "version": "6.16.0",
-    "hash": "sha256-J8Orzt/H84IscHZ9p7hEja7bkweuLsZNqu9XzmUjQM0="
+    "version": "6.20.0",
+    "hash": "sha256-8LdLU2wgdR21bEXTBw7+RdbLYBM0vHRZhKv2ZpiVL44="
   },
   {
     "pname": "zlib.net-mutliplatform",
diff --git a/pkgs/by-name/je/jellyfin/package.nix b/pkgs/by-name/je/jellyfin/package.nix
index 487c6fd34ecd..8c241d5f237a 100644
--- a/pkgs/by-name/je/jellyfin/package.nix
+++ b/pkgs/by-name/je/jellyfin/package.nix
@@ -13,13 +13,13 @@
 
 buildDotnetModule rec {
   pname = "jellyfin";
-  version = "10.10.6"; # ensure that jellyfin-web has matching version
+  version = "10.10.7"; # ensure that jellyfin-web has matching version
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin";
     rev = "v${version}";
-    hash = "sha256-QFXZtmdR07xIjh4wKgbx1usXgRg5X0jfzzLjsxKMniU=";
+    hash = "sha256-GWpzX8DvCafHb5V9it0ZPTXKm+NbLS7Oepe/CcMiFuI=";
   };
 
   propagatedBuildInputs = [ sqlite ];
diff --git a/pkgs/by-name/li/libmp3splt/fix-buffer-overflow.patch b/pkgs/by-name/li/libmp3splt/fix-buffer-overflow.patch
new file mode 100644
index 000000000000..69275215a807
--- /dev/null
+++ b/pkgs/by-name/li/libmp3splt/fix-buffer-overflow.patch
@@ -0,0 +1,106 @@
+From 2c0bb6891349ed880634352e4551ed48002e53eb Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?S=C3=A9rgio=20M=2E=20Basto?= <sergio@serjux.com>
+Date: Fri, 4 Aug 2023 13:54:03 +0100
+Subject: [PATCH] fix snprintf overflow
+
+fix *** buffer overflow detected ***: terminated
+
+fix #367
+---
+ src/oformat_parser.c | 20 ++++++++++----------
+ 1 file changed, 10 insertions(+), 10 deletions(-)
+
+diff --git a/src/oformat_parser.c b/src/oformat_parser.c
+index 7bc5edcf..3775d035 100644
+--- a/src/oformat_parser.c
++++ b/src/oformat_parser.c
+@@ -534,7 +534,7 @@ int splt_of_put_output_format_filename(splt_state *state, int current_split)
+               int max_number_of_digits = splt_u_get_requested_num_of_digits(state,
+                   state->oformat.format[i], &requested_num_of_digits, SPLT_FALSE);
+ 
+-              snprintf(temp + offset, temp_len, "%s", format);
++              snprintf(temp + offset, temp_len - offset, "%s", format);
+ 
+               fm_length = strlen(temp) + 1 + max_number_of_digits;
+               if ((fm = malloc(fm_length * sizeof(char))) == NULL)
+@@ -564,7 +564,7 @@ int splt_of_put_output_format_filename(splt_state *state, int current_split)
+           //
+           if (artist_or_performer != NULL)
+           {
+-            snprintf(temp+2,temp_len, "%s", state->oformat.format[i]+2);
++            snprintf(temp+2,temp_len-2, "%s", state->oformat.format[i]+2);
+ 
+             int artist_length = 0;
+             artist_length = strlen(artist_or_performer);
+@@ -609,7 +609,7 @@ int splt_of_put_output_format_filename(splt_state *state, int current_split)
+           //
+           if (artist != NULL)
+           {
+-            snprintf(temp+2,temp_len, "%s", state->oformat.format[i]+2);
++            snprintf(temp+2,temp_len-2, "%s", state->oformat.format[i]+2);
+ 
+             int artist_length = 0;
+             artist_length = strlen(artist);
+@@ -655,7 +655,7 @@ int splt_of_put_output_format_filename(splt_state *state, int current_split)
+           {
+             int album_length = 0;
+             album_length = strlen(album);
+-            snprintf(temp+2, temp_len, "%s", state->oformat.format[i]+2);
++            snprintf(temp+2, temp_len-2, "%s", state->oformat.format[i]+2);
+ 
+             fm_length = strlen(temp) + album_length + 1;
+           }
+@@ -699,7 +699,7 @@ int splt_of_put_output_format_filename(splt_state *state, int current_split)
+           {
+             int genre_length = 0;
+             genre_length = strlen(genre);
+-            snprintf(temp+2, temp_len, "%s", state->oformat.format[i]+2);
++            snprintf(temp+2, temp_len-2, "%s", state->oformat.format[i]+2);
+ 
+             fm_length = strlen(temp) + genre_length + 1;
+           }
+@@ -743,7 +743,7 @@ int splt_of_put_output_format_filename(splt_state *state, int current_split)
+           {
+             int title_length = 0;
+             title_length = strlen(title);
+-            snprintf(temp+2, temp_len, "%s", state->oformat.format[i]+2);
++            snprintf(temp+2, temp_len-2, "%s", state->oformat.format[i]+2);
+ 
+             fm_length = strlen(temp) + title_length + 1;
+           }
+@@ -787,7 +787,7 @@ int splt_of_put_output_format_filename(splt_state *state, int current_split)
+           {
+             int performer_length = 0;
+             performer_length = strlen(performer);
+-            snprintf(temp+2, temp_len, "%s", state->oformat.format[i]+2);
++            snprintf(temp+2, temp_len-2, "%s", state->oformat.format[i]+2);
+ 
+             fm_length = strlen(temp) + performer_length + 1;
+           }
+@@ -862,7 +862,7 @@ int splt_of_put_output_format_filename(splt_state *state, int current_split)
+             const char *format =
+               splt_u_get_format_ptr(state->oformat.format[i], temp, NULL);
+ 
+-            snprintf(temp + 4, temp_len, "%s", format + 2);
++            snprintf(temp + 4, temp_len-4, "%s", format + 2);
+             fm_length = strlen(temp) + 1 + max_num_of_digits;
+           }
+           else
+@@ -903,7 +903,7 @@ int splt_of_put_output_format_filename(splt_state *state, int current_split)
+             original_filename = strdup(splt_su_get_fname_without_path(splt_t_get_filename_to_split(state)));
+             if (original_filename)
+             {
+-              snprintf(temp+2,temp_len, "%s", state->oformat.format[i]+2);
++              snprintf(temp+2,temp_len-2 , "%s", state->oformat.format[i]+2);
+ 
+               splt_su_cut_extension(original_filename);
+ 
+@@ -934,7 +934,7 @@ int splt_of_put_output_format_filename(splt_state *state, int current_split)
+ 
+             if (last_dir)
+             {
+-              snprintf(temp+2, temp_len, "%s", state->oformat.format[i]+2);
++              snprintf(temp+2, temp_len-2, "%s", state->oformat.format[i]+2);
+ 
+               int last_dir_length = strlen(last_dir);
+ 
\ No newline at end of file
diff --git a/pkgs/by-name/li/libmp3splt/package.nix b/pkgs/by-name/li/libmp3splt/package.nix
index 92d9ee124830..95a2e33bdb46 100644
--- a/pkgs/by-name/li/libmp3splt/package.nix
+++ b/pkgs/by-name/li/libmp3splt/package.nix
@@ -16,6 +16,11 @@ stdenv.mkDerivation rec {
     sha256 = "1p1mn2hsmj5cp40fnc8g1yfvk72p8pjxi866gjdkgjsqrr7xdvih";
   };
 
+  patches = [
+    # Fix buffer overflow in string formatting: https://github.com/mp3splt/mp3splt/pull/368
+    ./fix-buffer-overflow.patch
+  ];
+
   outputs = [
     "out"
     "dev"
diff --git a/pkgs/by-name/lk/lk-jwt-service/package.nix b/pkgs/by-name/lk/lk-jwt-service/package.nix
index 9f43932bec96..e4bfee63f589 100644
--- a/pkgs/by-name/lk/lk-jwt-service/package.nix
+++ b/pkgs/by-name/lk/lk-jwt-service/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "lk-jwt-service";
-  version = "0.2.2";
+  version = "0.2.3";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "lk-jwt-service";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ONL2qKBXL2FtTv5Eao61qPKWP2h9t3KyoHlS5nAHMGA=";
+    hash = "sha256-DT9W+LFUDrSc/Twjanhrm2zXpQ63zpxLpRY1wf/o0q4=";
   };
 
   vendorHash = "sha256-47eJO1Ai78RuhlEPn/J1cd+YSqvmfUD8cuPZIqsdxvI=";
diff --git a/pkgs/by-name/m1/m17n_db/package.nix b/pkgs/by-name/m1/m17n_db/package.nix
index 4109b37a3613..416479917efc 100644
--- a/pkgs/by-name/m1/m17n_db/package.nix
+++ b/pkgs/by-name/m1/m17n_db/package.nix
@@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
   version = "1.8.9";
 
   src = fetchurl {
-    url = "https://download.savannah.gnu.org/releases/m17n/m17n-db-${version}.tar.gz";
-    sha256 = "sha256-SBJUo4CqnGbX9Ow6o3Kn4dL+R/w53252BEvUQBfEJKQ=";
+    url = "mirror://savannah/m17n/${pname}-${version}.tar.gz";
+    hash = "sha256-SBJUo4CqnGbX9Ow6o3Kn4dL+R/w53252BEvUQBfEJKQ=";
   };
 
   nativeBuildInputs = [ gettext ];
diff --git a/pkgs/by-name/ma/magic-wormhole-rs/package.nix b/pkgs/by-name/ma/magic-wormhole-rs/package.nix
index 9e6207a4c5b4..9125fe5b0378 100644
--- a/pkgs/by-name/ma/magic-wormhole-rs/package.nix
+++ b/pkgs/by-name/ma/magic-wormhole-rs/package.nix
@@ -8,17 +8,17 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "magic-wormhole-rs";
-  version = "0.7.5";
+  version = "0.7.6";
 
   src = fetchFromGitHub {
     owner = "magic-wormhole";
     repo = "magic-wormhole.rs";
     rev = version;
-    sha256 = "sha256-wah3Mkw3oFUx4rD6OkLvYyHsz6Z8pFFPhKlc0D7gIQA=";
+    sha256 = "sha256-01u1DJNd/06q9dH/Y4E5kj5gb2CA7EKdoPtMhzCLtso=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-qQAedjOHXYTu1K5fvoXWonXsJBSlBD4M8r3DGLSw7pI=";
+  cargoHash = "sha256-sZuvhJWgBlptfgsKglWvL6oxK5W3y2x0Gwf+r2pNRi8=";
 
   buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [ libxcb ];
 
diff --git a/pkgs/by-name/mi/mi2ly/package.nix b/pkgs/by-name/mi/mi2ly/package.nix
index 56fb4f5b3a87..f78d1df79a5e 100644
--- a/pkgs/by-name/mi/mi2ly/package.nix
+++ b/pkgs/by-name/mi/mi2ly/package.nix
@@ -9,8 +9,8 @@ stdenv.mkDerivation rec {
   version = "0.12";
 
   src = fetchurl {
-    url = "https://download.savannah.gnu.org/releases/mi2ly/mi2ly.${version}.tar.bz2";
-    sha256 = "sha256-lFbqH+syFaQDMbXfb+OUcWnyKnjfVz9yl7DbTTn7JKw=";
+    url = "mirror://savannah/${pname}/${pname}.${version}.tar.bz2";
+    hash = "sha256-lFbqH+syFaQDMbXfb+OUcWnyKnjfVz9yl7DbTTn7JKw=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/by-name/mi/mihomo/package.nix b/pkgs/by-name/mi/mihomo/package.nix
index e7abb69102c0..760dd240bcf3 100644
--- a/pkgs/by-name/mi/mihomo/package.nix
+++ b/pkgs/by-name/mi/mihomo/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "mihomo";
-  version = "1.19.3";
+  version = "1.19.4";
 
   src = fetchFromGitHub {
     owner = "MetaCubeX";
     repo = "mihomo";
     rev = "v${version}";
-    hash = "sha256-NzxH6rgr85oHmkMxh3rLbYXJoQKOsngeTazAV3SvRCg=";
+    hash = "sha256-A/+BUnW7ge4y99W2rAUBAAqxO1L0M9oO0WSnLN1NnXQ=";
   };
 
-  vendorHash = "sha256-dQNdOTFcfk53Snu01XLGB3PTiU1Ex/QQvykfopIdk2M=";
+  vendorHash = "sha256-VBDVtzI3GwxviLaAVUboHTtHaMQviiCUnB7ncgri+xc=";
 
   excludedPackages = [ "./test" ];
 
diff --git a/pkgs/by-name/mi/mitra/package.nix b/pkgs/by-name/mi/mitra/package.nix
index 13bce0bcd6b7..755eda4d303a 100644
--- a/pkgs/by-name/mi/mitra/package.nix
+++ b/pkgs/by-name/mi/mitra/package.nix
@@ -6,18 +6,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mitra";
-  version = "3.21.0";
+  version = "3.22.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "silverpill";
     repo = "mitra";
     rev = "v${version}";
-    hash = "sha256-xBcz9XNpEDtIZW7yfbfWYPklw3whYoNF+gx3vkHQXGI=";
+    hash = "sha256-TWU8df6IjzyvRyMLt3YE9Uuc9PoZBbzF62ojRaLzsvw=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-LO7xJBWxEGKLxocVs6EDWzGYLX/YtH4d9gSaVy+XxbM=";
+  cargoHash = "sha256-kRGhf/B6ni4gtl28ycQgIb5z+OP3CEHonTNId2MZsW4=";
 
   # require running database
   doCheck = false;
diff --git a/pkgs/by-name/ne/neovide/package.nix b/pkgs/by-name/ne/neovide/package.nix
index 05b6cf155a6e..3d574e2db026 100644
--- a/pkgs/by-name/ne/neovide/package.nix
+++ b/pkgs/by-name/ne/neovide/package.nix
@@ -26,17 +26,17 @@
 
 rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } rec {
   pname = "neovide";
-  version = "0.14.1";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "neovide";
     repo = "neovide";
     tag = version;
-    hash = "sha256-tXKTKE2JrDDJDpnipCv1hk7vS/0i7nrjzqMoMAy53qM=";
+    hash = "sha256-MLiLddF53OXDPYuJbTAscezxN09mxZkuSOZtQz07JSE=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-RKgpgM6quN0plYYE8fien5tUtHlN0YG0VTp5BGuzzuo=";
+  cargoHash = "sha256-1ni8AZIwAz5R2Ejt9Fj5qmybvL4KZV/M3BMqQx4HFLU=";
 
   SKIA_SOURCE_DIR =
     let
@@ -44,8 +44,8 @@ rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } rec {
         owner = "rust-skia";
         repo = "skia";
         # see rust-skia:skia-bindings/Cargo.toml#package.metadata skia
-        tag = "m132-0.81.0";
-        hash = "sha256-9DQgCaCiK0zgsl0wARPEiGjyXxmNLRSYaHf3690KuCM=";
+        tag = "m135-0.83.1";
+        hash = "sha256-TSGPJl9DfWQtrkNIhv40s8VcuudCjbiSh+QjLc0hKN4=";
       };
       # The externals for skia are taken from skia/DEPS
       externals = linkFarm "skia-externals" (
diff --git a/pkgs/by-name/nm/nmh/package.nix b/pkgs/by-name/nm/nmh/package.nix
index 0eebc1cb85e0..1faefd68d6c6 100644
--- a/pkgs/by-name/nm/nmh/package.nix
+++ b/pkgs/by-name/nm/nmh/package.nix
@@ -60,8 +60,8 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "New MH Mail Handling System";
     homepage = "https://nmh.nongnu.org/";
-    downloadPage = "http://download.savannah.nongnu.org/releases/nmh/";
-    changelog = "http://savannah.nongnu.org/news/?group=nmh";
+    downloadPage = "https://download.savannah.nongnu.org/releases/nmh/";
+    changelog = "https://savannah.nongnu.org/news/?group=nmh";
     license = [ lib.licenses.bsd3 ];
     longDescription = ''
       This is the nmh mail user agent (reader/sender), a command-line based
diff --git a/pkgs/by-name/no/notepad-next/package.nix b/pkgs/by-name/no/notepad-next/package.nix
index 09a761e24f14..ab44de46b983 100644
--- a/pkgs/by-name/no/notepad-next/package.nix
+++ b/pkgs/by-name/no/notepad-next/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "notepad-next";
-  version = "0.10";
+  version = "0.11";
 
   src = fetchFromGitHub {
     owner = "dail8859";
     repo = "NotepadNext";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DpqFu7Nt7l1rmQoJ7aQnFEGPxo8NDrowHxmyLdKIX4A=";
+    hash = "sha256-qpJXby355iSyAGzj19jJJFmFkKeBRgOGod2rrZJqU9Y=";
     # External dependencies - https://github.com/dail8859/NotepadNext/issues/135
     fetchSubmodules = true;
   };
diff --git a/pkgs/by-name/op/openapi-python-client/package.nix b/pkgs/by-name/op/openapi-python-client/package.nix
index 5440c203766f..834f6ff85784 100644
--- a/pkgs/by-name/op/openapi-python-client/package.nix
+++ b/pkgs/by-name/op/openapi-python-client/package.nix
@@ -11,7 +11,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "openapi-python-client";
-  version = "0.24.2";
+  version = "0.24.3";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -19,7 +19,7 @@ python3Packages.buildPythonApplication rec {
     owner = "openapi-generators";
     repo = "openapi-python-client";
     tag = "v${version}";
-    hash = "sha256-uGS5MearvggL7hPov3vgwyskKDXJFbHNzKdIu2WlA7A=";
+    hash = "sha256-EAHwICY8bjqYt0yGSG+SMcyTqeftfGCGTE4pJE120Mo=";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/ot/otb/package.nix b/pkgs/by-name/ot/otb/package.nix
index 8b66d8e8614e..b30b092ae6c6 100644
--- a/pkgs/by-name/ot/otb/package.nix
+++ b/pkgs/by-name/ot/otb/package.nix
@@ -27,6 +27,7 @@
   tinyxml,
 
   # otb modules
+  enableFFTW ? false,
   enableFeatureExtraction ? true,
   enableHyperspectral ? true,
   enableLearning ? true,
@@ -50,10 +51,16 @@ let
   # filter out gdcm, libminc from list of ITK deps as it's not needed for OTB
   itkVersion = "5.3.0";
   itkMajorMinorVersion = lib.versions.majorMinor itkVersion;
-  itkDepsToRemove = [
-    "gdcm"
-    "libminc"
-  ];
+  itkDepsToRemove =
+    [
+      "gdcm"
+      "libminc"
+    ]
+    ++ optionals (!enableFFTW) [
+      # remove fftw to avoid GPL contamination
+      # https://gitlab.orfeo-toolbox.org/orfeotoolbox/otb/-/issues/2454#note_112821
+      "fftw"
+    ];
   itkIsInDepsToRemove = dep: builtins.any (d: d == dep.name) itkDepsToRemove;
 
   # remove after https://gitlab.orfeo-toolbox.org/orfeotoolbox/otb/-/issues/2451
@@ -196,8 +203,8 @@ let
 
     propagatedBuildInputs =
       lib.lists.filter (pkg: !(itkIsInDepsToRemove pkg)) oldArgs.propagatedBuildInputs or [ ]
-      ++ [
-        # the only missing dependency for OTB from itk propagated list
+      ++ lib.optionals enableFFTW [
+        # the only missing dependency for OTB from itk propagated list if FFTW option is enabled
         fftwFloat
       ];
 
@@ -208,13 +215,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "otb";
-  version = "10.0-unstable-2025-02-13";
+  version = "10.0-unstable-2025-04-03";
 
   src = fetchFromGitHub {
     owner = "orfeotoolbox";
     repo = "otb";
-    rev = "34c96ef53bb94985a1358d5c3de1a5ac6dfecf18";
-    hash = "sha256-QCLuUryVi+r8sQGxvrh9G91uLxuRju6l3LxVJO3VzXM=";
+    rev = "93649b68f54975a1a48a0acd49f2602a55fc8032";
+    hash = "sha256-S6yhV//qlKdWWcT9J1p64WuVS0QNepIYTr/t4JvyEwE=";
   };
 
   patches = [
@@ -254,6 +261,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "OTBGroup_ThirdParty" enableThirdParty)
     (lib.cmakeBool "OTB_WRAP_PYTHON" enablePython)
     (lib.cmakeBool "BUILD_TESTING" finalAttrs.doInstallCheck)
+    (lib.cmakeBool "OTB_USE_FFTW" enableFFTW)
   ];
 
   propagatedBuildInputs =
@@ -267,7 +275,6 @@ stdenv.mkDerivation (finalAttrs: {
       muparserx
       opencv
       otb-itk
-      otb-shark
       perl
       tinyxml
     ]
diff --git a/pkgs/by-name/pi/pik/package.nix b/pkgs/by-name/pi/pik/package.nix
index 7a478fee9259..b4bf6065bd9c 100644
--- a/pkgs/by-name/pi/pik/package.nix
+++ b/pkgs/by-name/pi/pik/package.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pik";
-  version = "0.18.1";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "jacek-kurlit";
     repo = "pik";
     rev = version;
-    hash = "sha256-8+Q5j9PWiITVgZkJnX+oWbC6QnNDhFxX4jLiMDWnw/g=";
+    hash = "sha256-G4GTrS3zUQVLsdc/19qPl4GWZZe4U8jV+UOkX36fMWU=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-6U0QkLgGEONGRDfrDVkxeHSJy9QnfQqn2YiZEswunTk=";
+  cargoHash = "sha256-T8kgWjmmffPFewtp+5g15RoNXCoQH5bliTukM26JnlI=";
 
   passthru.tests.version = testers.testVersion { package = pik; };
 
diff --git a/pkgs/by-name/pi/pixi/package.nix b/pkgs/by-name/pi/pixi/package.nix
index 8af68081ed44..f130cc5b1210 100644
--- a/pkgs/by-name/pi/pixi/package.nix
+++ b/pkgs/by-name/pi/pixi/package.nix
@@ -14,17 +14,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "pixi";
-  version = "0.43.3";
+  version = "0.44.0";
 
   src = fetchFromGitHub {
     owner = "prefix-dev";
     repo = "pixi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FWUnab6mj4Xq3k3GLQFKrlZkWxX3fqHZujwuK3sbgbg=";
+    hash = "sha256-IHI4T2QKCvnyn6RgtJ9ZIF6mcUXUAguk05kfWURO+ds=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Ioqw8ddpJWiPB8wniLsteaWzDXIORoOsHitGVQ2uPBw=";
+  cargoHash = "sha256-TB3gOeYPLIyUWPhyAGM9rhFOZXWEUHn6mXoyL9D8hxc=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/po/pocketbase/package.nix b/pkgs/by-name/po/pocketbase/package.nix
index 76dfacdebf2b..812e0270b5ff 100644
--- a/pkgs/by-name/po/pocketbase/package.nix
+++ b/pkgs/by-name/po/pocketbase/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "pocketbase";
-  version = "0.26.3";
+  version = "0.26.6";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = "pocketbase";
     rev = "v${version}";
-    hash = "sha256-hzFA9EBYIU/BkpmWs/jKeYgSWyAjT9UUQiKhQYFTicM=";
+    hash = "sha256-PDHRMCICzvb7InHSvYRvlYDaB6hkESJyL7iiz+lO6+I=";
   };
 
-  vendorHash = "sha256-oi7jSZ1oys5Vrcl7fKgb4lCp8AR1DhTKwNnGuOA/YFQ=";
+  vendorHash = "sha256-qkVbtQeyhQ0w0H5BW1Nq4S7UPK7KXkGrueBm9nM/O68=";
 
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];
diff --git a/pkgs/by-name/pr/prometheus-modbus-exporter/package.nix b/pkgs/by-name/pr/prometheus-modbus-exporter/package.nix
new file mode 100644
index 000000000000..d9ae5c17902d
--- /dev/null
+++ b/pkgs/by-name/pr/prometheus-modbus-exporter/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+}:
+buildGoModule (finalAttrs: {
+  pname = "prometheus-modbus-exporter";
+  version = "0.4.1";
+
+  src = fetchFromGitHub {
+    owner = "richih";
+    repo = "modbus_exporter";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ZkES+CDthYZrNZ7wVO0oRx6pBMX23AyUOhU+OBTD42g=";
+  };
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=github.com/prometheus/common/version.BuildDate=1970-01-01T00:00:00Z"
+    "-X github.com/prometheus/common/version.BuildUser=nix@nixpkgs"
+    "-X github.com/prometheus/common/version.Branch=master"
+    "-X github.com/prometheus/common/version.Revision=${finalAttrs.src.rev}"
+    "-X github.com/prometheus/common/version.Version=${finalAttrs.version}"
+  ];
+
+  vendorHash = "sha256-RfpJLoYPR5Ura3GvLIAePg+fuiaiXig6XaSNCPhZ/Vg=";
+
+  passthru.updateScript = nix-update-script { };
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+  versionCheckProgram = "${placeholder "out"}/bin/${finalAttrs.meta.mainProgram}";
+  versionCheckProgramArg = "--version";
+
+  meta = {
+    changelog = "https://github.com/richih/modbus_exporter/releases/tag/v${finalAttrs.version}";
+    homepage = "https://paepcke.de/modbus_exporter";
+    description = "Prometheus exporter for the modbus interface. Basepackage for a large group of iot device exporters.";
+    license = lib.licenses.mit;
+    mainProgram = "modbus_exporter";
+    maintainers = with lib.maintainers; [ paepcke ];
+  };
+})
diff --git a/pkgs/by-name/pr/prometheus-solaredge-exporter/package.nix b/pkgs/by-name/pr/prometheus-solaredge-exporter/package.nix
new file mode 100644
index 000000000000..19afd4b89996
--- /dev/null
+++ b/pkgs/by-name/pr/prometheus-solaredge-exporter/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+}:
+buildGoModule (finalAttrs: {
+  pname = "prometheus-solaredge-exporter";
+  version = "0.1.5";
+
+  src = fetchFromGitHub {
+    owner = "paepckehh";
+    repo = "solaredge_exporter";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Aw6rMXE0jgqdUScQcFplNnpglwl13BRdTEN1gMQJSd0=";
+  };
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=github.com/prometheus/common/version.BuildDate=1970-01-01T00:00:00Z"
+    "-X github.com/prometheus/common/version.BuildUser=nix@nixpkgs"
+    "-X github.com/prometheus/common/version.Branch=master"
+    "-X github.com/prometheus/common/version.Revision=${finalAttrs.src.rev}"
+    "-X github.com/prometheus/common/version.Version=${finalAttrs.version}"
+  ];
+
+  vendorHash = "sha256-ltCjuihbm0/bj2SPkiITTHzYmcQsX12xvt+OpYROivU=";
+
+  passthru.updateScript = nix-update-script { };
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+  versionCheckProgram = "${placeholder "out"}/bin/${finalAttrs.meta.mainProgram}";
+  versionCheckProgramArg = "--version";
+
+  meta = {
+    changelog = "https://github.com/paepckehh/solaredge_exporter/releases/tag/v${finalAttrs.version}";
+    homepage = "https://paepcke.de/solaredge_exporter";
+    description = "Prometheus exporter for solaredge solar inverter local tcp modbus interface";
+    license = lib.licenses.mit;
+    mainProgram = "solaredge_exporter";
+    maintainers = with lib.maintainers; [ paepcke ];
+  };
+})
diff --git a/pkgs/by-name/pr/proto/package.nix b/pkgs/by-name/pr/proto/package.nix
index 6b55f079512e..c073a3a72c00 100644
--- a/pkgs/by-name/pr/proto/package.nix
+++ b/pkgs/by-name/pr/proto/package.nix
@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "proto";
-  version = "0.47.8";
+  version = "0.47.9";
 
   src = fetchFromGitHub {
     owner = "moonrepo";
     repo = "proto";
     rev = "v${version}";
-    hash = "sha256-RWUm96jn+2SFRteO0tO8Teis6hN9SBHgDID1zIYqOzM=";
+    hash = "sha256-cyRChMYYkqsTto91jZLxSrAbuYEeDcm3iXjLc23UqBI=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-OQLom6k8987QK64YBTDP/YmyGwuaTQmnHcnX0rvntKM=";
+  cargoHash = "sha256-aknPt5hDzuWKp91VurQ5I9izNDvbVNCHzlD6mLn7y+8=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     darwin.apple_sdk.frameworks.SystemConfiguration
diff --git a/pkgs/by-name/qt/qtractor/package.nix b/pkgs/by-name/qt/qtractor/package.nix
index 261c61a02a3f..0fd57977cf48 100644
--- a/pkgs/by-name/qt/qtractor/package.nix
+++ b/pkgs/by-name/qt/qtractor/package.nix
@@ -30,11 +30,11 @@
 
 stdenv.mkDerivation rec {
   pname = "qtractor";
-  version = "1.5.3";
+  version = "1.5.4";
 
   src = fetchurl {
     url = "mirror://sourceforge/qtractor/qtractor-${version}.tar.gz";
-    hash = "sha256-O0CB8LPbXPE52t97NkEwL47fMfOb9XF6f+EQUwY8JdU=";
+    hash = "sha256-gV6IgFA7GeneabRCk6HLZVMfnS94qbdgyJQGwwRO904=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/rq/rqlite/package.nix b/pkgs/by-name/rq/rqlite/package.nix
index be52bf837eda..590547f8a84a 100644
--- a/pkgs/by-name/rq/rqlite/package.nix
+++ b/pkgs/by-name/rq/rqlite/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "rqlite";
-  version = "8.36.14";
+  version = "8.36.16";
 
   src = fetchFromGitHub {
     owner = "rqlite";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-dEs9xMJyy2QdZ4N3E65fjN5EXmQW6KIqWhy+92ac5yg=";
+    sha256 = "sha256-mMsQJETeDyENMkCOmKb6TxDp9lYHSQIjaJtbsYzTJMs=";
   };
 
-  vendorHash = "sha256-AOebt6kA0WCgEbSySfIPzRp0QnNtwdnPlEFJJSDO978=";
+  vendorHash = "sha256-6Y15vVvu1KHWTJKDmDKjWt0Kolu6q0mmo94YAHMXs/E=";
 
   subPackages = [
     "cmd/rqlite"
diff --git a/pkgs/by-name/se/serialdv/package.nix b/pkgs/by-name/se/serialdv/package.nix
index 655831830da1..56f954feedb4 100644
--- a/pkgs/by-name/se/serialdv/package.nix
+++ b/pkgs/by-name/se/serialdv/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "serialdv";
-  version = "1.1.4";
+  version = "1.1.5";
 
   src = fetchFromGitHub {
     owner = "f4exb";
     repo = "serialdv";
     rev = "v${version}";
-    sha256 = "0d88h2wjhf79nisiv96bq522hkbknzm88wsv0q9k33mzmrwnrx93";
+    sha256 = "sha256-uswddoIpTXqsvjM2/ygdud9jZHTemLn9Dlv9FBXXKow=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/sh/shopware-cli/package.nix b/pkgs/by-name/sh/shopware-cli/package.nix
index 2428478cf7f6..ded484b7be57 100644
--- a/pkgs/by-name/sh/shopware-cli/package.nix
+++ b/pkgs/by-name/sh/shopware-cli/package.nix
@@ -10,12 +10,12 @@
 
 buildGoModule rec {
   pname = "shopware-cli";
-  version = "0.5.12";
+  version = "0.5.14";
   src = fetchFromGitHub {
     repo = "shopware-cli";
     owner = "FriendsOfShopware";
     tag = version;
-    hash = "sha256-GLa6I9DHGgWoShNRpqSbvOU8z2RlNTfEzEidUytByPI=";
+    hash = "sha256-2LzYEMsJilRKHsx5bwKYeRVUKkao9GSvVdCNNnmFXD4=";
   };
 
   nativeBuildInputs = [
@@ -27,7 +27,7 @@ buildGoModule rec {
     dart-sass
   ];
 
-  vendorHash = "sha256-z8nktXEyERWHqCUfeSgqrmYX3mxqYFyjr/cdP+yV5qE=";
+  vendorHash = "sha256-ZKETkvGez31PtaWr1vOzNH5Cljgc3+KPfOlHm5fVzg8=";
 
   postInstall = ''
     installShellCompletion --cmd shopware-cli \
diff --git a/pkgs/by-name/sk/skribilo/package.nix b/pkgs/by-name/sk/skribilo/package.nix
index 2fe0eb835f7a..35e715b3aece 100644
--- a/pkgs/by-name/sk/skribilo/package.nix
+++ b/pkgs/by-name/sk/skribilo/package.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
   version = "0.10.0";
 
   src = fetchurl {
-    url = "http://download.savannah.nongnu.org/releases/skribilo/skribilo-${finalAttrs.version}.tar.gz";
+    url = "mirror://savannah/skribilo/skribilo-${finalAttrs.version}.tar.gz";
     hash = "sha256-jP9I7hds7f1QMmSaNJpGlSvqUOwGcg+CnBzMopIS9Q4=";
   };
 
diff --git a/pkgs/by-name/sn/snort/package.nix b/pkgs/by-name/sn/snort/package.nix
index de8b5a6436d2..59761a4f73ce 100644
--- a/pkgs/by-name/sn/snort/package.nix
+++ b/pkgs/by-name/sn/snort/package.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "snort";
-  version = "3.7.1.0";
+  version = "3.7.2.0";
 
   src = fetchFromGitHub {
     owner = "snort3";
     repo = "snort3";
     tag = finalAttrs.version;
-    hash = "sha256-ni1HOEJNi1NWkxZ90sOzBylzsAY1BB3lP76LjCTZumg=";
+    hash = "sha256-/ObL48Wo8OPFljBxQP5X/ASvGPcdvPKueosjJm1BRTI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sp/spicetify-cli/package.nix b/pkgs/by-name/sp/spicetify-cli/package.nix
index 6e5f5b142145..24ba6b58db2c 100644
--- a/pkgs/by-name/sp/spicetify-cli/package.nix
+++ b/pkgs/by-name/sp/spicetify-cli/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "spicetify-cli";
-  version = "2.39.5";
+  version = "2.39.6";
 
   src = fetchFromGitHub {
     owner = "spicetify";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-vqif3oLDm9SUrkY+qEYHUEmHN+psoK6GNUB+kA6sQ4Q=";
+    hash = "sha256-rdyHVHKVgl9fOviFYQuXY8Ko+/XwpKlKDfriQAgkusE=";
   };
 
-  vendorHash = "sha256-3U/qV81UXS/Xh3K6OnMUyRKeMSBQUHLP64EOQl6TfMY=";
+  vendorHash = "sha256-sC8HmszcH5fYnuoPW6aElB8UXPwk3Lpp2odsBaiP4mI=";
 
   ldflags = [
     "-s -w"
diff --git a/pkgs/by-name/st/stevenblack-blocklist/package.nix b/pkgs/by-name/st/stevenblack-blocklist/package.nix
index 1dee7e58e94b..6e355c9fd398 100644
--- a/pkgs/by-name/st/stevenblack-blocklist/package.nix
+++ b/pkgs/by-name/st/stevenblack-blocklist/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "stevenblack-blocklist";
-  version = "3.15.26";
+  version = "3.15.29";
 
   src = fetchFromGitHub {
     owner = "StevenBlack";
     repo = "hosts";
     tag = finalAttrs.version;
-    hash = "sha256-D8Ebr02/O4avw/+60o8oZYII9pGz1veb+Gox6XOdQdg=";
+    hash = "sha256-Ph0Wc7tl5FHZatSK9BNMZ8lNhGdJKx9X3+Px9MaYKyI=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/st/storeBackup/package.nix b/pkgs/by-name/st/storeBackup/package.nix
index 8a58698c0cdf..35610056b2a5 100644
--- a/pkgs/by-name/st/storeBackup/package.nix
+++ b/pkgs/by-name/st/storeBackup/package.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation rec {
   buildInputs = [ perl ];
 
   src = fetchurl {
-    url = "https://download.savannah.gnu.org/releases/storebackup/storeBackup-${version}.tar.bz2";
+    url = "mirror://savannah/storebackup/storeBackup-${version}.tar.bz2";
     hash = "sha256-Ki1DT2zypFFiiMVd9Y8eSX7T+yr8moWMoALmAexjqWU=";
   };
 
diff --git a/pkgs/by-name/st/storj-uplink/package.nix b/pkgs/by-name/st/storj-uplink/package.nix
index 5865c1ff8968..402147fc0122 100644
--- a/pkgs/by-name/st/storj-uplink/package.nix
+++ b/pkgs/by-name/st/storj-uplink/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "storj-uplink";
-  version = "1.125.2";
+  version = "1.125.4";
 
   src = fetchFromGitHub {
     owner = "storj";
     repo = "storj";
     rev = "v${version}";
-    hash = "sha256-O4lp6NsUpxaikjpcDfpS+FZZHKOxjOn1Lr052PlD0W4=";
+    hash = "sha256-r0N9TpSlKkGy/hlVxKB+fMXFvQQOXC5L4Ryd5fP+Ud0=";
   };
 
   subPackages = [ "cmd/uplink" ];
diff --git a/pkgs/by-name/su/summon/package.nix b/pkgs/by-name/su/summon/package.nix
index 54b11f93d000..4c57b68d08c3 100644
--- a/pkgs/by-name/su/summon/package.nix
+++ b/pkgs/by-name/su/summon/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "summon";
-  version = "0.10.3";
+  version = "0.10.4";
 
   src = fetchFromGitHub {
     owner = "cyberark";
     repo = "summon";
     rev = "v${version}";
-    hash = "sha256-RCYi7nUJ+27pmH6k7jCav4Klea9JCK9Kzfu8ifYgORg=";
+    hash = "sha256-nAjaZh0bnGBZh2wK78M4gg8BGsM6kBQ8MNvfPI7TIOg=";
   };
 
-  vendorHash = "sha256-StcJvUtMfBh7p1sD8ucvHNJ572whRfqz3id6XsFoXtk=";
+  vendorHash = "sha256-B6sbMKmuIQ+xoJspFCRtqe9IOLW+AFF5XQBDSLhM9cI=";
 
   subPackages = [ "cmd" ];
 
diff --git a/pkgs/by-name/te/terraform-docs/package.nix b/pkgs/by-name/te/terraform-docs/package.nix
index 33c9620d541b..bbeb074c625d 100644
--- a/pkgs/by-name/te/terraform-docs/package.nix
+++ b/pkgs/by-name/te/terraform-docs/package.nix
@@ -7,16 +7,16 @@
 }:
 buildGoModule rec {
   pname = "terraform-docs";
-  version = "0.19.0";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "terraform-docs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-NOI9/2zGimsHMvdi2lGwl6YLVGpOET6g9C/l0xUZ/pI=";
+    hash = "sha256-DiKoYAe7vcNy35ormKHYZcZrGK/MEb6VmcHWPgrbmUg=";
   };
 
-  vendorHash = "sha256-/56Y3VE4h//8IlyP8ocMFiorgw/4ee32J5FQYxFCIU8=";
+  vendorHash = "sha256-ynyYpX41LJxGhf5kF2AULj+VKROjsvTjVPBnqG+JGSg=";
 
   excludedPackages = [ "scripts" ];
 
diff --git a/pkgs/by-name/ty/typstfmt/package.nix b/pkgs/by-name/ty/typstfmt/package.nix
index 73e750095fcf..4109ef87488b 100644
--- a/pkgs/by-name/ty/typstfmt/package.nix
+++ b/pkgs/by-name/ty/typstfmt/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "typstfmt";
-  version = "0.2.9";
+  version = "0.2.10";
 
   src = fetchFromGitHub {
     owner = "astrale-sharp";
     repo = "typstfmt";
     rev = version;
-    hash = "sha256-bSjUr6tHQrmni/YmApHrvY2cVz3xf1VKfg35BJjuOZM=";
+    hash = "sha256-JsNaHeFYr92VdruE87dLj2kPGc9M+ww7AGiGO4Gbbr0=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-C3kVmQcG2a4eg8bu36lTy2dDQcw2uX/iS6Wco6ambdE=";
+  cargoHash = "sha256-sY2LLBsyRt7Zc84//WZWNq6e7Vx/TtPC/zoDF2Ug7yQ=";
 
   meta = {
     changelog = "https://github.com/astrale-sharp/typstfmt/blob/${src.rev}/CHANGELOG.md";
diff --git a/pkgs/by-name/ve/velocity/package.nix b/pkgs/by-name/ve/velocity/package.nix
index 15b0c13e0593..fbec41ba1752 100644
--- a/pkgs/by-name/ve/velocity/package.nix
+++ b/pkgs/by-name/ve/velocity/package.nix
@@ -35,13 +35,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "velocity";
-  version = "3.4.0-unstable-2025-03-27";
+  version = "3.4.0-unstable-2025-04-03";
 
   src = fetchFromGitHub {
     owner = "PaperMC";
     repo = "Velocity";
-    rev = "d2cd79185b56bab1adbd45acb1caf0ea7f24d84e";
-    hash = "sha256-WnXDBofr2zkkNvuFYG/6AijgzuDR/8CISafmGDXazgc=";
+    rev = "c72a3eefdeee26d39d5382c30435f9ce1819153e";
+    hash = "sha256-mBVNZAuAarBBQRD4H7XR/Hp+VmO+yoOwrkj/tQeEOWA=";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/vi/virtnbdbackup/package.nix b/pkgs/by-name/vi/virtnbdbackup/package.nix
index 918994b4341d..f70230804102 100644
--- a/pkgs/by-name/vi/virtnbdbackup/package.nix
+++ b/pkgs/by-name/vi/virtnbdbackup/package.nix
@@ -7,13 +7,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "virtnbdbackup";
-  version = "2.23";
+  version = "2.26";
 
   src = fetchFromGitHub {
     owner = "abbbi";
     repo = "virtnbdbackup";
     tag = "v${version}";
-    hash = "sha256-lek2UND7Qmg2ar8YvCDSOVO/TqmiMff/mRLgfyVkAvg=";
+    hash = "sha256-wSfqWWXGjqnnmIY2sHW3XDIepie2QJGmFxfn7LXNREE=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/wa/watchyourlan/package.nix b/pkgs/by-name/wa/watchyourlan/package.nix
index 5cf2e91c4d53..2432d6e3c3f4 100644
--- a/pkgs/by-name/wa/watchyourlan/package.nix
+++ b/pkgs/by-name/wa/watchyourlan/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "watchyourlan";
-  version = "2.1.1";
+  version = "2.1.2";
 
   src = fetchFromGitHub {
     owner = "aceberg";
     repo = "WatchYourLAN";
     tag = version;
-    hash = "sha256-xiwDcqEfuNuqNQO2wtJ2XK0mPf91C1bapEqKKmKxw4c=";
+    hash = "sha256-BI/Ydp7YswgdhwaptmqohwCw1gvRefFF9cz3Bjc2cnA=";
   };
 
   vendorHash = "sha256-NUv90wq3nFHDtfk3BitwJ3ZfciPESUIDzS5S/6zafEQ=";
diff --git a/pkgs/by-name/wi/windsurf/info.json b/pkgs/by-name/wi/windsurf/info.json
index e18df78ee660..316eb343cda0 100644
--- a/pkgs/by-name/wi/windsurf/info.json
+++ b/pkgs/by-name/wi/windsurf/info.json
@@ -1,20 +1,20 @@
 {
   "aarch64-darwin": {
-    "version": "1.5.6",
-    "vscodeVersion": "1.94.0",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/164066c0badcfdea724847b1a24fd88eb96f9510/Windsurf-darwin-arm64-1.5.6.zip",
-    "sha256": "174fcd06dc73a760edf06105678af9b427303c8091cbe0f1454207107383076a"
+    "version": "1.6.2",
+    "vscodeVersion": "1.97.0",
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-arm64/stable/1eabbe10abd0f4843e53460086ba8422a1aebe02/Windsurf-darwin-arm64-1.6.2.zip",
+    "sha256": "42d071b20043eb16c8e23e82e4bd54115ef99e1a39f817538b9468d9467b2290"
   },
   "x86_64-darwin": {
-    "version": "1.5.6",
-    "vscodeVersion": "1.94.0",
-    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/164066c0badcfdea724847b1a24fd88eb96f9510/Windsurf-darwin-x64-1.5.6.zip",
-    "sha256": "a3891e831ab43452f791a6856f0fd3c63535348583ae673bfcdae4466f36f8df"
+    "version": "1.6.2",
+    "vscodeVersion": "1.97.0",
+    "url": "https://windsurf-stable.codeiumdata.com/darwin-x64/stable/1eabbe10abd0f4843e53460086ba8422a1aebe02/Windsurf-darwin-x64-1.6.2.zip",
+    "sha256": "e181206a8dc6bc663afd14160ab1e4d6548ee2c99011b3a6e25b67c9f737376a"
   },
   "x86_64-linux": {
-    "version": "1.5.6",
-    "vscodeVersion": "1.94.0",
-    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/164066c0badcfdea724847b1a24fd88eb96f9510/Windsurf-linux-x64-1.5.6.tar.gz",
-    "sha256": "5b01ce09139d7d8932be5c297a1c71a891a299825b2d5304f3fed22367188ecb"
+    "version": "1.6.2",
+    "vscodeVersion": "1.97.0",
+    "url": "https://windsurf-stable.codeiumdata.com/linux-x64/stable/1eabbe10abd0f4843e53460086ba8422a1aebe02/Windsurf-linux-x64-1.6.2.tar.gz",
+    "sha256": "54b31fdafe8c8893d8eab5a2769cacc9f7e89bf4744a7f65d41dc9d7301d48c7"
   }
 }
diff --git a/pkgs/by-name/xl/xlog/package.nix b/pkgs/by-name/xl/xlog/package.nix
index 5b3d66411233..a424c48df43f 100644
--- a/pkgs/by-name/xl/xlog/package.nix
+++ b/pkgs/by-name/xl/xlog/package.nix
@@ -12,8 +12,8 @@ stdenv.mkDerivation rec {
   version = "2.0.25";
 
   src = fetchurl {
-    url = "https://download.savannah.gnu.org/releases/xlog/${pname}-${version}.tar.gz";
-    sha256 = "sha256-NYC3LgoLXnJQURcZTc2xHOzOleotrWtOETMBgadf2qU=";
+    url = "mirror://savannah/${pname}/${pname}-${version}.tar.gz";
+    hash = "sha256-NYC3LgoLXnJQURcZTc2xHOzOleotrWtOETMBgadf2qU=";
   };
 
   # glib-2.62 deprecations
diff --git a/pkgs/by-name/xm/xmlsec/package.nix b/pkgs/by-name/xm/xmlsec/package.nix
index 80a6ed8b6ea7..f1b8f9b472e3 100644
--- a/pkgs/by-name/xm/xmlsec/package.nix
+++ b/pkgs/by-name/xm/xmlsec/package.nix
@@ -21,8 +21,13 @@ lib.fix (
     version = "1.3.7";
 
     src = fetchurl {
-      url = "https://www.aleksey.com/xmlsec/download/xmlsec1-${version}.tar.gz";
-      sha256 = "sha256-2C6TtpuKogWmFrYpF6JpMiv2Oj6q+zd1AU5hdSsgE+o=";
+      urls = [
+        "https://www.aleksey.com/xmlsec/download/xmlsec1-${version}.tar.gz"
+
+        # for when the ${version} gets older than the last two
+        "https://www.aleksey.com/xmlsec/download/older-releases/xmlsec1-${version}.tar.gz"
+      ];
+      hash = "sha256-2C6TtpuKogWmFrYpF6JpMiv2Oj6q+zd1AU5hdSsgE+o=";
     };
 
     patches = [
diff --git a/pkgs/development/libraries/libubox/default.nix b/pkgs/development/libraries/libubox/default.nix
index c001668c428e..55f1cb1a2c4a 100644
--- a/pkgs/development/libraries/libubox/default.nix
+++ b/pkgs/development/libraries/libubox/default.nix
@@ -13,12 +13,12 @@
 
 stdenv.mkDerivation {
   pname = "libubox";
-  version = "unstable-2023-12-18";
+  version = "0-unstable-2024-12-19";
 
   src = fetchgit {
     url = "https://git.openwrt.org/project/libubox.git";
-    rev = "6339204c212b2c3506554a8842030df5ec6fe9c6";
-    hash = "sha256-QgpORITt6MYgfzUpaI2T0Ge2a0iVHjDhdYI/nZ2HbJ8=";
+    rev = "3868f47c8f6c6570e62a3cdf8a7f26ffb1a67e6a";
+    hash = "sha256-rACcvyMhksw5A+Tkn6XiTqz1DHK23YKRHL7j3CEccr4=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/development/node-packages/aliases.nix b/pkgs/development/node-packages/aliases.nix
index e18fb6cd0ce1..6b2588d4b3da 100644
--- a/pkgs/development/node-packages/aliases.nix
+++ b/pkgs/development/node-packages/aliases.nix
@@ -173,6 +173,7 @@ mapAliases {
   pkg = pkgs.vercel-pkg; # added 2023-10-04
   inherit (pkgs) pm2; # added 2024-01-22
   inherit (pkgs) pnpm; # added 2024-06-26
+  postcss-cli = throw "postcss-cli has been removed because it was broken"; # added 2025-03-24
   prettier_d_slim = pkgs.prettier-d-slim; # added 2023-09-14
   prettier-plugin-toml = throw "prettier-plugin-toml was removed because it provides no executable"; # added 2025-03-23
   inherit (pkgs) prisma; # added 2024-08-31
diff --git a/pkgs/development/node-packages/main-programs.nix b/pkgs/development/node-packages/main-programs.nix
index 57593ddb6016..a79552d5f769 100644
--- a/pkgs/development/node-packages/main-programs.nix
+++ b/pkgs/development/node-packages/main-programs.nix
@@ -34,7 +34,6 @@
   lua-fmt = "luafmt";
   parsoid = "parse.js";
   poor-mans-t-sql-formatter-cli = "sqlformat";
-  postcss-cli = "postcss";
   prettier = "prettier";
   pulp = "pulp";
   purescript-language-server = "purescript-language-server";
diff --git a/pkgs/development/node-packages/node-packages.json b/pkgs/development/node-packages/node-packages.json
index 449245e8f041..33d1e81694b5 100644
--- a/pkgs/development/node-packages/node-packages.json
+++ b/pkgs/development/node-packages/node-packages.json
@@ -129,7 +129,6 @@
 , "peerflix-server"
 , "poor-mans-t-sql-formatter-cli"
 , "postcss"
-, "postcss-cli"
 , "prebuild-install"
 , "prettier"
 , "pscid"
diff --git a/pkgs/development/node-packages/node-packages.nix b/pkgs/development/node-packages/node-packages.nix
index d3a9cee446fb..d2cc1ac4c48d 100644
--- a/pkgs/development/node-packages/node-packages.nix
+++ b/pkgs/development/node-packages/node-packages.nix
@@ -61402,95 +61402,6 @@ in
     bypassCache = true;
     reconstructLock = true;
   };
-  postcss-cli = nodeEnv.buildNodePackage {
-    name = "postcss-cli";
-    packageName = "postcss-cli";
-    version = "11.0.1";
-    src = fetchurl {
-      url = "https://registry.npmjs.org/postcss-cli/-/postcss-cli-11.0.1.tgz";
-      sha512 = "0UnkNPSayHKRe/tc2YGW6XnSqqOA9eqpiRMgRlV1S6HdGi16vwJBx7lviARzbV1HpQHqLLRH3o8vTcB0cLc+5g==";
-    };
-    dependencies = [
-      sources."ansi-regex-5.0.1"
-      sources."ansi-styles-4.3.0"
-      sources."anymatch-3.1.3"
-      sources."binary-extensions-2.3.0"
-      sources."braces-3.0.3"
-      sources."chokidar-3.6.0"
-      sources."cliui-8.0.1"
-      sources."color-convert-2.0.1"
-      sources."color-name-1.1.4"
-      sources."dependency-graph-1.0.0"
-      sources."emoji-regex-8.0.0"
-      sources."esbuild-0.25.1"
-      sources."escalade-3.2.0"
-      (
-        sources."fdir-6.4.3"
-        // {
-          dependencies = [
-            sources."picomatch-4.0.2"
-          ];
-        }
-      )
-      sources."fill-range-7.1.1"
-      sources."fs-extra-11.3.0"
-      sources."get-caller-file-2.0.5"
-      sources."get-tsconfig-4.10.0"
-      sources."glob-parent-5.1.2"
-      sources."graceful-fs-4.2.11"
-      sources."is-binary-path-2.1.0"
-      sources."is-extglob-2.1.1"
-      sources."is-fullwidth-code-point-3.0.0"
-      sources."is-glob-4.0.3"
-      sources."is-number-7.0.0"
-      sources."jiti-2.4.2"
-      sources."jsonfile-6.1.0"
-      sources."lilconfig-3.1.3"
-      sources."nanoid-3.3.9"
-      sources."normalize-path-3.0.0"
-      sources."picocolors-1.1.1"
-      sources."picomatch-2.3.1"
-      sources."pify-2.3.0"
-      sources."postcss-8.5.3"
-      sources."postcss-load-config-5.1.0"
-      sources."postcss-reporter-7.1.0"
-      sources."pretty-hrtime-1.0.3"
-      sources."read-cache-1.0.0"
-      sources."readdirp-3.6.0"
-      sources."require-directory-2.1.1"
-      sources."resolve-pkg-maps-1.0.0"
-      sources."slash-5.1.0"
-      sources."source-map-js-1.2.1"
-      sources."string-width-4.2.3"
-      sources."strip-ansi-6.0.1"
-      sources."thenby-1.3.4"
-      (
-        sources."tinyglobby-0.2.12"
-        // {
-          dependencies = [
-            sources."picomatch-4.0.2"
-          ];
-        }
-      )
-      sources."to-regex-range-5.0.1"
-      sources."tsx-4.19.3"
-      sources."universalify-2.0.1"
-      sources."wrap-ansi-7.0.0"
-      sources."y18n-5.0.8"
-      sources."yaml-2.7.0"
-      sources."yargs-17.7.2"
-      sources."yargs-parser-21.1.1"
-    ];
-    buildInputs = globalBuildInputs;
-    meta = {
-      description = "CLI for PostCSS";
-      homepage = "https://github.com/postcss/postcss-cli#readme";
-      license = "MIT";
-    };
-    production = true;
-    bypassCache = true;
-    reconstructLock = true;
-  };
   prebuild-install = nodeEnv.buildNodePackage {
     name = "prebuild-install";
     packageName = "prebuild-install";
diff --git a/pkgs/development/node-packages/overrides.nix b/pkgs/development/node-packages/overrides.nix
index 0e5c7612adfd..dfa3dc4c2460 100644
--- a/pkgs/development/node-packages/overrides.nix
+++ b/pkgs/development/node-packages/overrides.nix
@@ -177,75 +177,6 @@ final: prev: {
       '';
   };
 
-  postcss-cli = prev.postcss-cli.override (
-    oldAttrs:
-    let
-      esbuild-version = (lib.findFirst (dep: dep.name == "esbuild") null oldAttrs.dependencies).version;
-      esbuild-linux-x64 = {
-        name = "_at_esbuild_slash_esbuild-linux-x64";
-        packageName = "@esbuild/linux-x64";
-        version = esbuild-version;
-        src = fetchurl {
-          url = "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-${esbuild-version}.tgz";
-          sha512 = "sha512-9yl91rHw/cpwMCNytUDxwj2XjFpxML0y9HAOH9pNVQDpQrBxHy01Dx+vaMu0N1CKa/RzBD2hB4u//nfc+Sd3Cw==";
-        };
-      };
-      esbuild-linux-arm64 = {
-        name = "_at_esbuild_slash_esbuild-linux-arm64";
-        packageName = "@esbuild/linux-arm64";
-        version = esbuild-version;
-        src = fetchurl {
-          url = "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-${esbuild-version}.tgz";
-          sha512 = "sha512-9QAQjTWNDM/Vk2bgBl17yWuZxZNQIF0OUUuPZRKoDtqF2k4EtYbpyiG5/Dk7nqeK6kIJWPYldkOcBqjXjrUlmg==";
-        };
-      };
-      esbuild-darwin-x64 = {
-        name = "_at_esbuild_slash_esbuild-darwin-x64";
-        packageName = "@esbuild/darwin-x64";
-        version = esbuild-version;
-        src = fetchurl {
-          url = "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-${esbuild-version}.tgz";
-          sha512 = "sha512-DgDaYsPWFTS4S3nWpFcMn/33ZZwAAeAFKNHNa1QN0rI4pUjgqf0f7ONmXf6d22tqTY+H9FNdgeaAa+YIFUn2Rg==";
-        };
-      };
-      esbuild-darwin-arm64 = {
-        name = "_at_esbuild_slash_esbuild-darwin-arm64";
-        packageName = "@esbuild/darwin-arm64";
-        version = esbuild-version;
-        src = fetchurl {
-          url = "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-${esbuild-version}.tgz";
-          sha512 = "sha512-mVwdUb5SRkPayVadIOI78K7aAnPamoeFR2bT5nszFUZ9P8UpK4ratOdYbZZXYSqPKMHfS1wdHCJk1P1EZpRdvw==";
-        };
-      };
-    in
-    {
-      nativeBuildInputs = [ pkgs.buildPackages.makeWrapper ];
-      dependencies =
-        oldAttrs.dependencies
-        ++ lib.optional (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86_64) esbuild-linux-x64
-        ++ lib.optional (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) esbuild-linux-arm64
-        ++ lib.optional (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) esbuild-darwin-x64
-        ++ lib.optional (
-          stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64
-        ) esbuild-darwin-arm64;
-      postInstall = ''
-        wrapProgram "$out/bin/postcss" \
-          --prefix NODE_PATH : ${final.postcss}/lib/node_modules \
-          --prefix NODE_PATH : ${pkgs.autoprefixer}/node_modules
-        ln -s '${final.postcss}/lib/node_modules/postcss' "$out/lib/node_modules/postcss"
-      '';
-      passthru.tests = {
-        simple-execution = callPackage ./package-tests/postcss-cli.nix {
-          inherit (final) postcss-cli;
-        };
-      };
-      meta = oldAttrs.meta // {
-        maintainers = with lib.maintainers; [ Luflosi ];
-        license = lib.licenses.mit;
-      };
-    }
-  );
-
   pulp = prev.pulp.override {
     # tries to install purescript
     npmFlags = builtins.toString [ "--ignore-scripts" ];
diff --git a/pkgs/development/node-packages/package-tests/postcss-cli.nix b/pkgs/development/node-packages/package-tests/postcss-cli.nix
deleted file mode 100644
index 6c5847ed1352..000000000000
--- a/pkgs/development/node-packages/package-tests/postcss-cli.nix
+++ /dev/null
@@ -1,44 +0,0 @@
-{ runCommand, postcss-cli }:
-
-let
-  inherit (postcss-cli) packageName version;
-in
-
-runCommand "${packageName}-tests" { meta.timeout = 60; } ''
-  # get version of installed program and compare with package version
-  claimed_version="$(${postcss-cli}/bin/postcss --version)"
-  if [[ "$claimed_version" != "${version}" ]]; then
-    echo "Error: program version does not match package version ($claimed_version != ${version})"
-    exit 1
-  fi
-
-  # run basic help command
-  ${postcss-cli}/bin/postcss --help > /dev/null
-
-  # basic autoprefixer test
-  config_dir="$(mktemp -d)"
-  clean_up() {
-    rm -rf "$config_dir"
-  }
-  trap clean_up EXIT
-  echo "
-    module.exports = {
-      plugins: {
-        'autoprefixer': { overrideBrowserslist: 'chrome 40' },
-      },
-    }
-  " > "$config_dir/postcss.config.js"
-  input='a{ user-select: none; }'
-  expected_output='a{ -webkit-user-select: none; user-select: none; }'
-  actual_output="$(echo $input | ${postcss-cli}/bin/postcss --no-map --config $config_dir)"
-  if [[ "$actual_output" != "$expected_output" ]]; then
-    echo "Error: autoprefixer did not output the correct CSS:"
-    echo "$actual_output"
-    echo "!="
-    echo "$expected_output"
-    exit 1
-  fi
-
-  # needed for Nix to register the command as successful
-  touch $out
-''
diff --git a/pkgs/development/python-modules/aider-chat/default.nix b/pkgs/development/python-modules/aider-chat/default.nix
index 519738bfad42..eb275da05fd8 100644
--- a/pkgs/development/python-modules/aider-chat/default.nix
+++ b/pkgs/development/python-modules/aider-chat/default.nix
@@ -124,7 +124,7 @@ let
     ];
   };
 
-  version = "0.81.0";
+  version = "0.81.1";
   aider-chat = buildPythonPackage {
     pname = "aider-chat";
     inherit version;
@@ -137,7 +137,7 @@ let
       owner = "Aider-AI";
       repo = "aider";
       tag = "v${version}";
-      hash = "sha256-xWOXsffLAVBZvJM8PuAJ12IrmNLfXuqHrbIMtPM1leE=";
+      hash = "sha256-TNSdsJBmF/9OCkFe1dZV0y7X2FSTjgp3YV4HGlA9GMc=";
     };
 
     pythonRelaxDeps = true;
diff --git a/pkgs/development/python-modules/commitizen/default.nix b/pkgs/development/python-modules/commitizen/default.nix
index 242d6cb855d2..e3a7ee28524d 100644
--- a/pkgs/development/python-modules/commitizen/default.nix
+++ b/pkgs/development/python-modules/commitizen/default.nix
@@ -31,7 +31,7 @@
 
 buildPythonPackage rec {
   pname = "commitizen";
-  version = "4.4.1";
+  version = "4.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     owner = "commitizen-tools";
     repo = "commitizen";
     tag = "v${version}";
-    hash = "sha256-nKX5mMqcUcQfL0r0uVj2tFTW3qaSCx42roSV6qaf0yU=";
+    hash = "sha256-J3jwCgiwM2SOJJ8tpXNxHodyhkMb631cb1Usr8Cnwx0=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/docling-core/default.nix b/pkgs/development/python-modules/docling-core/default.nix
index 9614ec86974c..3628c11f8679 100644
--- a/pkgs/development/python-modules/docling-core/default.nix
+++ b/pkgs/development/python-modules/docling-core/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "docling-core";
-  version = "2.24.0";
+  version = "2.25.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "docling-project";
     repo = "docling-core";
     tag = "v${version}";
-    hash = "sha256-WQmKBtbTTW7G2220GxVcxhVn+h4iL87/Cauol8mlUvs=";
+    hash = "sha256-Ri2oSfXScwFLwCHuWBRVut77O0ExK1vcVYg7XpRAugQ=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/elevenlabs/default.nix b/pkgs/development/python-modules/elevenlabs/default.nix
index 4dfe1dcc5741..bff558f91956 100644
--- a/pkgs/development/python-modules/elevenlabs/default.nix
+++ b/pkgs/development/python-modules/elevenlabs/default.nix
@@ -12,7 +12,7 @@
 }:
 
 let
-  version = "1.55.0";
+  version = "1.56.0";
   tag = "v${version}";
 in
 buildPythonPackage {
@@ -24,7 +24,7 @@ buildPythonPackage {
     owner = "elevenlabs";
     repo = "elevenlabs-python";
     inherit tag;
-    hash = "sha256-gcEffuhnwpxOMcKXZ54H1LJEnmTdFgN2ISzPRzxNh9Q=";
+    hash = "sha256-BDHfEhg8nj41jZa4Cuw1Ck2qWwY2GlKK8GQ9ZqMQHcs=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/flowmc/default.nix b/pkgs/development/python-modules/flowmc/default.nix
index 078106da6140..553f482162af 100644
--- a/pkgs/development/python-modules/flowmc/default.nix
+++ b/pkgs/development/python-modules/flowmc/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "flowmc";
-  version = "0.4.1";
+  version = "0.4.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kazewong";
     repo = "flowMC";
     tag = "flowMC-${version}";
-    hash = "sha256-ehmKXR01tT3H564ndjSwUoUuu2KmQCC6RwkB2nsk42E=";
+    hash = "sha256-Qsh5nvLdJeIx3EHACdhRE4GDdI31MHYvUDHephMs+2Y=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/langfuse/default.nix b/pkgs/development/python-modules/langfuse/default.nix
index 5eb100fe0c75..9a184c75ec1c 100644
--- a/pkgs/development/python-modules/langfuse/default.nix
+++ b/pkgs/development/python-modules/langfuse/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "langfuse";
-  version = "2.60.0";
+  version = "2.60.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langfuse";
     repo = "langfuse-python";
     tag = "v${version}";
-    hash = "sha256-POafeO7MqPnNp+kVSOCMJxV0Q6IDuEG9Kusb69dHtbo=";
+    hash = "sha256-ipiEd03X2uyxHlcwAGL55NmF0dle4/be96MQsSt/Vvg=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/linode-api/default.nix b/pkgs/development/python-modules/linode-api/default.nix
index 6d689d630203..5e6825cf64e6 100644
--- a/pkgs/development/python-modules/linode-api/default.nix
+++ b/pkgs/development/python-modules/linode-api/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "linode-api";
-  version = "5.28.0";
+  version = "5.29.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "linode";
     repo = "python-linode-api";
     tag = "v${version}";
-    hash = "sha256-NTI/T78/D95sgVugjrsRKEPxU2jArvRcKiuD+09tKCo=";
+    hash = "sha256-9dDEEjY9ajh/eMuXTLkLVSGb38TOi3RDmRIf2vKknkI=";
   };
 
   build-system = [ setuptools ];
@@ -51,6 +51,7 @@ buildPythonPackage rec {
   meta = {
     description = "Python library for the Linode API v4";
     homepage = "https://github.com/linode/python-linode-api";
+    changelog = "https://github.com/linode/linode_api4-python/releases/tag/${src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ glenns ];
   };
diff --git a/pkgs/development/python-modules/litellm/default.nix b/pkgs/development/python-modules/litellm/default.nix
index 5b7baadcf1d7..33ee938306f6 100644
--- a/pkgs/development/python-modules/litellm/default.nix
+++ b/pkgs/development/python-modules/litellm/default.nix
@@ -17,6 +17,7 @@
   importlib-metadata,
   jinja2,
   jsonschema,
+  mcp,
   openai,
   orjson,
   poetry-core,
@@ -40,7 +41,7 @@
 
 buildPythonPackage rec {
   pname = "litellm";
-  version = "1.63.11";
+  version = "1.65.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -49,7 +50,7 @@ buildPythonPackage rec {
     owner = "BerriAI";
     repo = "litellm";
     tag = "v${version}-stable";
-    hash = "sha256-j2RfuVffmWoeAAVcT579S9pU06haKEYYa7FcpMzu9uA=";
+    hash = "sha256-q6FDgSwU3G41bVvdofsTBVG90xoqi+NP6zUg9geNz9I=";
   };
 
   build-system = [ poetry-core ];
@@ -61,6 +62,7 @@ buildPythonPackage rec {
     importlib-metadata
     jinja2
     jsonschema
+    mcp
     openai
     pydantic
     python-dotenv
diff --git a/pkgs/development/python-modules/manim-slides/default.nix b/pkgs/development/python-modules/manim-slides/default.nix
index d27cd957495c..b5ad137f26b9 100644
--- a/pkgs/development/python-modules/manim-slides/default.nix
+++ b/pkgs/development/python-modules/manim-slides/default.nix
@@ -34,7 +34,7 @@
 }:
 buildPythonPackage rec {
   pname = "manim-slides";
-  version = "5.5.0";
+  version = "5.5.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -43,7 +43,7 @@ buildPythonPackage rec {
     owner = "jeertmans";
     repo = "manim-slides";
     tag = "v${version}";
-    hash = "sha256-TP+F4q/rnibU6kvAdfwDD++ITVTYAFgGoDng0p0SUIs=";
+    hash = "sha256-V1uopwyA6y+oTofaezA4pR+ewrh0TRmCwoYhIR/iH7I=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index 9e520493597b..735e13d74142 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -192,8 +192,8 @@ buildPythonPackage rec {
       doCheck = true;
       freetype = freetype.overrideAttrs (_: {
         src = fetchurl {
-          url = "https://download.savannah.gnu.org/releases/freetype/freetype-old/freetype-2.6.1.tar.gz";
-          sha256 = "sha256-Cjx9+9ptoej84pIy6OltmHq6u79x68jHVlnkEyw2cBQ=";
+          url = "mirror://savannah/freetype/freetype-old/freetype-2.6.1.tar.gz";
+          hash = "sha256-Cjx9+9ptoej84pIy6OltmHq6u79x68jHVlnkEyw2cBQ=";
         };
         patches = [ ];
       });
diff --git a/pkgs/development/python-modules/odc-stac/default.nix b/pkgs/development/python-modules/odc-stac/default.nix
index 5a55132db317..f4b3fa4a1214 100644
--- a/pkgs/development/python-modules/odc-stac/default.nix
+++ b/pkgs/development/python-modules/odc-stac/default.nix
@@ -4,13 +4,14 @@
   fetchFromGitHub,
 
   # build-system
-  setuptools,
+  hatchling,
 
   # dependencies
   affine,
   dask,
   numpy,
   odc-geo,
+  odc-loader,
   pandas,
   pystac,
   rasterio,
@@ -29,27 +30,18 @@
 
 buildPythonPackage rec {
   pname = "odc-stac";
-  version = "0.3.11";
+  version = "0.4.0rc2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "opendatacube";
     repo = "odc-stac";
     tag = "v${version}";
-    hash = "sha256-uudBzxVGt3RW4ppDrFYfA9LMa2xPfs3FTBzVS19FjB4=";
+    hash = "sha256-I25qAJEryYaYO7KIVIoTlgzLS6PWkNG6b4NFyhghyKQ=";
   };
 
-  # ImportError: cannot import name 'quote' from 'dask.base'
-  # https://github.com/dask/dask/issues/11843
-  postPatch = ''
-    substituteInPlace odc/loader/_builder.py \
-      --replace-fail \
-        "from dask.base import quote, tokenize" \
-        "from dask.base import tokenize; from dask.core import quote"
-  '';
-
   build-system = [
-    setuptools
+    hatchling
   ];
 
   dependencies = [
@@ -57,6 +49,7 @@ buildPythonPackage rec {
     dask
     numpy
     odc-geo
+    odc-loader
     pandas
     pystac
     rasterio
@@ -85,9 +78,6 @@ buildPythonPackage rec {
     # urllib url open error
     "test_norm_geom"
     "test_output_geobox"
-    "test_mem_reader"
-    "test_memreader_zarr"
-
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/python-modules/peft/default.nix b/pkgs/development/python-modules/peft/default.nix
index c0acbfd1ac70..e93638f1bff3 100644
--- a/pkgs/development/python-modules/peft/default.nix
+++ b/pkgs/development/python-modules/peft/default.nix
@@ -31,14 +31,14 @@
 
 buildPythonPackage rec {
   pname = "peft";
-  version = "0.15.0";
+  version = "0.15.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "peft";
     tag = "v${version}";
-    hash = "sha256-vR0FoBDsSMQiSGgqMegPqPvDgq00fqF7d+jKvqgeCAg=";
+    hash = "sha256-oGDRGg1FmDJPFyDy6n4CiWmQjG0VibW7tLXYGBNq25c=";
   };
 
   build-system = [ setuptools ];
@@ -107,7 +107,7 @@ buildPythonPackage rec {
   meta = {
     homepage = "https://github.com/huggingface/peft";
     description = "State-of-the art parameter-efficient fine tuning";
-    changelog = "https://github.com/huggingface/peft/releases/tag/v${version}";
+    changelog = "https://github.com/huggingface/peft/releases/tag/${src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ bcdarwin ];
   };
diff --git a/pkgs/development/python-modules/plotpy/default.nix b/pkgs/development/python-modules/plotpy/default.nix
index 3ef746b3cf35..f3cb2f24568c 100644
--- a/pkgs/development/python-modules/plotpy/default.nix
+++ b/pkgs/development/python-modules/plotpy/default.nix
@@ -32,14 +32,14 @@
 
 buildPythonPackage rec {
   pname = "plotpy";
-  version = "2.7.2";
+  version = "2.7.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PlotPyStack";
     repo = "PlotPy";
     tag = "v${version}";
-    hash = "sha256-X7HLsT+EKSrCE50u4wbfYr1jwJoSMS0YbvbKofznBL4=";
+    hash = "sha256-Z8aCDTBRdksbjjH5P+OXln3CHciw1MuYQN3K6KOcouk=";
   };
 
   build-system = [
@@ -112,7 +112,7 @@ buildPythonPackage rec {
   meta = {
     description = "Curve and image plotting tools for Python/Qt applications";
     homepage = "https://github.com/PlotPyStack/PlotPy";
-    changelog = "https://github.com/PlotPyStack/PlotPy/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/PlotPyStack/PlotPy/blob/${src.tag}/CHANGELOG.md";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ doronbehar ];
   };
diff --git a/pkgs/development/python-modules/pysaml2/default.nix b/pkgs/development/python-modules/pysaml2/default.nix
index dca55176f162..188bf2e3f80e 100644
--- a/pkgs/development/python-modules/pysaml2/default.nix
+++ b/pkgs/development/python-modules/pysaml2/default.nix
@@ -4,6 +4,7 @@
   cryptography,
   defusedxml,
   fetchFromGitHub,
+  fetchpatch,
   paste,
   poetry-core,
   pyasn1,
@@ -25,22 +26,25 @@
 
 buildPythonPackage rec {
   pname = "pysaml2";
-  version = "7.5.0";
-  format = "pyproject";
-
-  disabled = pythonOlder "3.9";
+  version = "7.5.2";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "IdentityPython";
     repo = "pysaml2";
     tag = "v${version}";
-    hash = "sha256-M/tdKGu6K38TeBZc8/dt376bHhPB0svHB3iis/se0DY=";
+    hash = "sha256-2mvAXTruZqoSBUgfT2VEAnWQXVdviG0e49y7LPK5x00=";
   };
 
   patches = [
     (replaceVars ./hardcode-xmlsec1-path.patch {
       inherit xmlsec;
     })
+    # Replaces usages of deprecated/removed pyopenssl APIs
+    (fetchpatch {
+      url = "https://github.com/IdentityPython/pysaml2/pull/977/commits/930a652a240c8cd1489429a7d70cf5fa7ef1606a.patch";
+      hash = "sha256-kBNvGk5pwVmpW1wsIWVH9wapu6kjFavaTt4e3Llaw2c=";
+    })
   ];
 
   postPatch = ''
@@ -86,6 +90,9 @@ buildPythonPackage rec {
     "test_load_remote_encoding"
     "test_load_external"
     "test_conf_syslog"
+
+    # Broken XML schema check in 7.5.2
+    "test_namespace_processing"
   ];
 
   pythonImportsCheck = [ "saml2" ];
@@ -96,8 +103,5 @@ buildPythonPackage rec {
     changelog = "https://github.com/IdentityPython/pysaml2/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
     maintainers = [ ];
-    # Does not support pyopenssl above 24.3.0 due to use of a deprecated API,
-    # see https://github.com/IdentityPython/pysaml2/issues/975
-    broken = true;
   };
 }
diff --git a/pkgs/development/python-modules/sagemaker-core/default.nix b/pkgs/development/python-modules/sagemaker-core/default.nix
index 97622ac59320..830451f1c4be 100644
--- a/pkgs/development/python-modules/sagemaker-core/default.nix
+++ b/pkgs/development/python-modules/sagemaker-core/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "sagemaker-core";
-  version = "1.0.25";
+  version = "1.0.28";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "sagemaker-core";
     tag = "v${version}";
-    hash = "sha256-VfqQJf0r11z+GT/jpcVBdP2nLWf1lsjvijb1IsbOILQ=";
+    hash = "sha256-RxkwBr+Xq5vIrcLnJsoJ8FYX1Kj5YK7sSFx//9YA5VU=";
   };
 
   build-system = [
@@ -87,7 +87,7 @@ buildPythonPackage rec {
   meta = {
     description = "Python object-oriented interface for interacting with Amazon SageMaker resources";
     homepage = "https://github.com/aws/sagemaker-core";
-    changelog = "https://github.com/aws/sagemaker-core/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/aws/sagemaker-core/blob/${src.tag}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ GaetanLepage ];
   };
diff --git a/pkgs/development/python-modules/sagemaker/default.nix b/pkgs/development/python-modules/sagemaker/default.nix
index 91fa4b164a93..ab856fd16d67 100644
--- a/pkgs/development/python-modules/sagemaker/default.nix
+++ b/pkgs/development/python-modules/sagemaker/default.nix
@@ -40,14 +40,14 @@
 
 buildPythonPackage rec {
   pname = "sagemaker";
-  version = "2.242.0";
+  version = "2.243.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "sagemaker-python-sdk";
     tag = "v${version}";
-    hash = "sha256-86FnB/HJ43RxFuezzbNADUVsifV0+HHVR0yfb+aQZ8M=";
+    hash = "sha256-Os26VMK/kR23plt+wq8kV3K+17PfP5XuBy7MIz9PQ6s=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/zarr/default.nix b/pkgs/development/python-modules/zarr/default.nix
index d7d232ebf2bd..5c652a8fb4c9 100644
--- a/pkgs/development/python-modules/zarr/default.nix
+++ b/pkgs/development/python-modules/zarr/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "zarr";
-  version = "2.18.3";
-  format = "pyproject";
+  version = "2.18.5";
+  pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-JYDYy23YRiF3GhDTHE13fcqKJ3BqGomyn0LS034t9c4=";
+    hash = "sha256-yWW/JbWCX8/PM5vabDKaVskJl98SMkNeJ7ZKoTbxQsc=";
   };
 
   build-system = [
diff --git a/pkgs/development/rocm-modules/5/clr/default.nix b/pkgs/development/rocm-modules/5/clr/default.nix
index 2add6e58c9b0..30f7f90a4fc2 100644
--- a/pkgs/development/rocm-modules/5/clr/default.nix
+++ b/pkgs/development/rocm-modules/5/clr/default.nix
@@ -139,6 +139,11 @@ stdenv.mkDerivation (finalAttrs: {
     # Replace rocm-opencl-icd functionality
     mkdir -p $icd/etc/OpenCL/vendors
     echo "$out/lib/libamdocl64.so" > $icd/etc/OpenCL/vendors/amdocl64.icd
+
+    # add version info to output (downstream rocmPackages look for this)
+    echo "HIP_VERSION_MAJOR=${builtins.elemAt (lib.splitVersion finalAttrs.version) 0}" > $out/bin/.hipVersion
+    echo "HIP_VERSION_MINOR=${builtins.elemAt (lib.splitVersion finalAttrs.version) 1}" >> $out/bin/.hipVersion
+    echo "HIP_VERSION_PATCH=${builtins.elemAt (lib.splitVersion finalAttrs.version) 2}" >> $out/bin/.hipVersion
   '';
 
   passthru = {
diff --git a/pkgs/shells/carapace/default.nix b/pkgs/shells/carapace/default.nix
index 327004106068..f5efb7306312 100644
--- a/pkgs/shells/carapace/default.nix
+++ b/pkgs/shells/carapace/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "carapace";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "carapace-sh";
     repo = "carapace-bin";
     rev = "v${version}";
-    hash = "sha256-MGg0L+a4tYHwbJxrOQ9QotsfpOvxnL6K0QX6ayGGXpI=";
+    hash = "sha256-ewZ06HPAS7UXmnRlrOaHegVrfYxwko/jyHqtQV/0JwY=";
   };
 
-  vendorHash = "sha256-kxd/bINrZxgEmgZ67KjTTfuIr9ekpd08s0/p0Sht5Ks=";
+  vendorHash = "sha256-+jOZ7EhMQZHvu4XToM7L1w2YCKCTOHKzZCOBsulLsH8=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/tools/inputmethods/m17n-lib/default.nix b/pkgs/tools/inputmethods/m17n-lib/default.nix
index da4d8d336db2..f40be071b0b9 100644
--- a/pkgs/tools/inputmethods/m17n-lib/default.nix
+++ b/pkgs/tools/inputmethods/m17n-lib/default.nix
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   version = "1.8.5";
 
   src = fetchurl {
-    url = "https://download.savannah.gnu.org/releases/m17n/m17n-lib-${version}.tar.gz";
+    url = "mirror://savannah/m17n/${pname}-${version}.tar.gz";
     hash = "sha256-e2xCX3ktBtFOT1sXIE02J+LI67Qj69rpLAxkZxDT1sc=";
   };
 
diff --git a/pkgs/tools/inputmethods/m17n-lib/otf.nix b/pkgs/tools/inputmethods/m17n-lib/otf.nix
index b92b57746e85..92dc9f5d0683 100644
--- a/pkgs/tools/inputmethods/m17n-lib/otf.nix
+++ b/pkgs/tools/inputmethods/m17n-lib/otf.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   version = "0.9.16";
 
   src = fetchurl {
-    url = "https://download.savannah.gnu.org/releases/m17n/${pname}-${version}.tar.gz";
+    url = "mirror://savannah/m17n/${pname}-${version}.tar.gz";
     sha256 = "0sq6g3xaxw388akws6qrllp3kp2sxgk2dv4j79k6mm52rnihrnv8";
   };
 
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index a489871452c4..d28d2dcb4910 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -186,7 +186,7 @@ lib.makeExtensible (
       nixComponents_2_27 = nixDependencies.callPackage ./modular/packages.nix {
         version = "2.27.1";
         inherit (self.nix_2_24.meta) maintainers;
-        otherSplices = generateSplicesForNixComponents "nixComponents_2_26";
+        otherSplices = generateSplicesForNixComponents "nixComponents_2_27";
         src = fetchFromGitHub {
           owner = "NixOS";
           repo = "nix";
diff --git a/pkgs/tools/package-management/nix/modular/README.md b/pkgs/tools/package-management/nix/modular/README.md
index 247bfc8badc5..e6488d2b1e32 100644
--- a/pkgs/tools/package-management/nix/modular/README.md
+++ b/pkgs/tools/package-management/nix/modular/README.md
@@ -4,3 +4,14 @@ This directory follows a directory structure similar to that in the upstream rep
 to make comparisons easier.
 
 The files are maintained separately from the upstream repo, so differences are expected.
+
+## Comparison
+
+### No filesets
+
+Using filesets with a fetched source would require "IFD", as the fetching happens in a derivation, but the filtering must come afterwards, and be done by the evaluator.
+
+### `workDir` attribute
+
+The Nixpkgs for Nix does inherit the `workDir` attribute that determines the location of the subproject to build.
+It is compared to this directory to produce the correct relative path, similar to upstream.
diff --git a/pkgs/tools/package-management/nix/modular/doc/manual/package.nix b/pkgs/tools/package-management/nix/modular/doc/manual/package.nix
index 8f5d0dfe1370..75ca70ae8fbd 100644
--- a/pkgs/tools/package-management/nix/modular/doc/manual/package.nix
+++ b/pkgs/tools/package-management/nix/modular/doc/manual/package.nix
@@ -17,25 +17,11 @@
   version,
 }:
 
-let
-  inherit (lib) fileset;
-in
-
 mkMesonDerivation (finalAttrs: {
   pname = "nix-manual";
   inherit version;
 
   workDir = ./.;
-  fileset =
-    fileset.difference
-      (fileset.unions [
-        ../../.version
-        # Too many different types of files to filter for now
-        ../../doc/manual
-        ./.
-      ])
-      # Do a blacklist instead
-      ../../doc/manual/package.nix;
 
   # TODO the man pages should probably be separate
   outputs = [
diff --git a/pkgs/tools/package-management/nix/modular/packaging/components.nix b/pkgs/tools/package-management/nix/modular/packaging/components.nix
index db53ff87555d..7e9dbb05a1fb 100644
--- a/pkgs/tools/package-management/nix/modular/packaging/components.nix
+++ b/pkgs/tools/package-management/nix/modular/packaging/components.nix
@@ -28,18 +28,6 @@ let
     pkg-config
     ;
 
-  baseVersion = version;
-
-  versionSuffix = lib.optionalString (!officialRelease) "pre";
-
-  fineVersionSuffix =
-    lib.optionalString (!officialRelease)
-      "pre${
-        builtins.substring 0 8 (src.lastModifiedDate or src.lastModified or "19700101")
-      }_${src.shortRev or "dirty"}";
-
-  fineVersion = baseVersion + fineVersionSuffix;
-
   root = ../.;
 
   # Indirection for Nixpkgs to override when package.nix files are vendored
@@ -217,8 +205,7 @@ in
 
 # This becomes the pkgs.nixComponents attribute set
 {
-  version = baseVersion + versionSuffix;
-  inherit versionSuffix;
+  inherit version;
   inherit maintainers;
 
   inherit filesetToSource;
@@ -365,15 +352,13 @@ in
 
   nix-cmd = callPackage ../src/libcmd/package.nix { };
 
-  nix-cli = callPackage ../src/nix/package.nix { version = fineVersion; };
+  nix-cli = callPackage ../src/nix/package.nix { };
 
-  nix-functional-tests = callPackage ../tests/functional/package.nix {
-    version = fineVersion;
-  };
+  nix-functional-tests = callPackage ../tests/functional/package.nix { };
 
-  nix-manual = callPackage ../doc/manual/package.nix { version = fineVersion; };
-  nix-internal-api-docs = callPackage ../src/internal-api-docs/package.nix { version = fineVersion; };
-  nix-external-api-docs = callPackage ../src/external-api-docs/package.nix { version = fineVersion; };
+  nix-manual = callPackage ../doc/manual/package.nix { };
+  nix-internal-api-docs = callPackage ../src/internal-api-docs/package.nix { };
+  nix-external-api-docs = callPackage ../src/external-api-docs/package.nix { };
 
   nix-perl-bindings = callPackage ../src/perl/package.nix { };
 
diff --git a/pkgs/tools/package-management/nix/modular/src/external-api-docs/package.nix b/pkgs/tools/package-management/nix/modular/src/external-api-docs/package.nix
index b194e16d4608..6c3950148f2d 100644
--- a/pkgs/tools/package-management/nix/modular/src/external-api-docs/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/external-api-docs/package.nix
@@ -9,32 +9,11 @@
   version,
 }:
 
-let
-  inherit (lib) fileset;
-in
-
 mkMesonDerivation (finalAttrs: {
   pname = "nix-external-api-docs";
   inherit version;
 
   workDir = ./.;
-  fileset =
-    let
-      cpp = fileset.fileFilter (file: file.hasExt "cc" || file.hasExt "h");
-    in
-    fileset.unions [
-      ./.version
-      ../../.version
-      ./meson.build
-      ./doxygen.cfg.in
-      ./README.md
-      # Source is not compiled, but still must be available for Doxygen
-      # to gather comments.
-      (cpp ../libexpr-c)
-      (cpp ../libflake-c)
-      (cpp ../libstore-c)
-      (cpp ../libutil-c)
-    ];
 
   nativeBuildInputs = [
     doxygen
diff --git a/pkgs/tools/package-management/nix/modular/src/internal-api-docs/package.nix b/pkgs/tools/package-management/nix/modular/src/internal-api-docs/package.nix
index 6c4f354aee5c..b857aefe5c74 100644
--- a/pkgs/tools/package-management/nix/modular/src/internal-api-docs/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/internal-api-docs/package.nix
@@ -9,28 +9,11 @@
   version,
 }:
 
-let
-  inherit (lib) fileset;
-in
-
 mkMesonDerivation (finalAttrs: {
   pname = "nix-internal-api-docs";
   inherit version;
 
   workDir = ./.;
-  fileset =
-    let
-      cpp = fileset.fileFilter (file: file.hasExt "cc" || file.hasExt "hh");
-    in
-    fileset.unions [
-      ./.version
-      ../../.version
-      ./meson.build
-      ./doxygen.cfg.in
-      # Source is not compiled, but still must be available for Doxygen
-      # to gather comments.
-      (cpp ../.)
-    ];
 
   nativeBuildInputs = [
     doxygen
diff --git a/pkgs/tools/package-management/nix/modular/src/libcmd/package.nix b/pkgs/tools/package-management/nix/modular/src/libcmd/package.nix
index d459d1c20fb5..f0ad6d0f5012 100644
--- a/pkgs/tools/package-management/nix/modular/src/libcmd/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libcmd/package.nix
@@ -30,25 +30,11 @@
   readlineFlavor ? if stdenv.hostPlatform.isWindows then "readline" else "editline",
 }:
 
-let
-  inherit (lib) fileset;
-in
-
 mkMesonLibrary (finalAttrs: {
   pname = "nix-cmd";
   inherit version;
 
   workDir = ./.;
-  fileset = fileset.unions [
-    ../../nix-meson-build-support
-    ./nix-meson-build-support
-    ../../.version
-    ./.version
-    ./meson.build
-    ./meson.options
-    (fileset.fileFilter (file: file.hasExt "cc") ./.)
-    (fileset.fileFilter (file: file.hasExt "hh") ./.)
-  ];
 
   buildInputs = [
     ({ inherit editline readline; }.${readlineFlavor})
diff --git a/pkgs/tools/package-management/nix/modular/src/libexpr-c/package.nix b/pkgs/tools/package-management/nix/modular/src/libexpr-c/package.nix
index 694fbc1fe789..6c01d359e203 100644
--- a/pkgs/tools/package-management/nix/modular/src/libexpr-c/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libexpr-c/package.nix
@@ -10,26 +10,11 @@
   version,
 }:
 
-let
-  inherit (lib) fileset;
-in
-
 mkMesonLibrary (finalAttrs: {
   pname = "nix-expr-c";
   inherit version;
 
   workDir = ./.;
-  fileset = fileset.unions [
-    ../../nix-meson-build-support
-    ./nix-meson-build-support
-    ../../.version
-    ./.version
-    ./meson.build
-    # ./meson.options
-    (fileset.fileFilter (file: file.hasExt "cc") ./.)
-    (fileset.fileFilter (file: file.hasExt "hh") ./.)
-    (fileset.fileFilter (file: file.hasExt "h") ./.)
-  ];
 
   propagatedBuildInputs = [
     nix-store-c
diff --git a/pkgs/tools/package-management/nix/modular/src/libexpr-test-support/package.nix b/pkgs/tools/package-management/nix/modular/src/libexpr-test-support/package.nix
index 44b0ff386313..0ed2dbfc3918 100644
--- a/pkgs/tools/package-management/nix/modular/src/libexpr-test-support/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libexpr-test-support/package.nix
@@ -13,25 +13,11 @@
   version,
 }:
 
-let
-  inherit (lib) fileset;
-in
-
 mkMesonLibrary (finalAttrs: {
   pname = "nix-util-test-support";
   inherit version;
 
   workDir = ./.;
-  fileset = fileset.unions [
-    ../../nix-meson-build-support
-    ./nix-meson-build-support
-    ../../.version
-    ./.version
-    ./meson.build
-    # ./meson.options
-    (fileset.fileFilter (file: file.hasExt "cc") ./.)
-    (fileset.fileFilter (file: file.hasExt "hh") ./.)
-  ];
 
   propagatedBuildInputs = [
     nix-store-test-support
diff --git a/pkgs/tools/package-management/nix/modular/src/libexpr-tests/package.nix b/pkgs/tools/package-management/nix/modular/src/libexpr-tests/package.nix
index 51d52e935bf5..1d5c72928778 100644
--- a/pkgs/tools/package-management/nix/modular/src/libexpr-tests/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libexpr-tests/package.nix
@@ -18,25 +18,11 @@
   resolvePath,
 }:
 
-let
-  inherit (lib) fileset;
-in
-
 mkMesonExecutable (finalAttrs: {
   pname = "nix-expr-tests";
   inherit version;
 
   workDir = ./.;
-  fileset = fileset.unions [
-    ../../nix-meson-build-support
-    ./nix-meson-build-support
-    ../../.version
-    ./.version
-    ./meson.build
-    # ./meson.options
-    (fileset.fileFilter (file: file.hasExt "cc") ./.)
-    (fileset.fileFilter (file: file.hasExt "hh") ./.)
-  ];
 
   buildInputs = [
     nix-expr
diff --git a/pkgs/tools/package-management/nix/modular/src/libexpr/package.nix b/pkgs/tools/package-management/nix/modular/src/libexpr/package.nix
index 533dae9f253c..5ff60bbf9c1b 100644
--- a/pkgs/tools/package-management/nix/modular/src/libexpr/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libexpr/package.nix
@@ -31,29 +31,11 @@
   enableGC ? !stdenv.hostPlatform.isWindows,
 }:
 
-let
-  inherit (lib) fileset;
-in
-
 mkMesonLibrary (finalAttrs: {
   pname = "nix-expr";
   inherit version;
 
   workDir = ./.;
-  fileset = fileset.unions [
-    ../../nix-meson-build-support
-    ./nix-meson-build-support
-    ../../.version
-    ./.version
-    ./meson.build
-    ./meson.options
-    ./primops/meson.build
-    (fileset.fileFilter (file: file.hasExt "cc") ./.)
-    (fileset.fileFilter (file: file.hasExt "hh") ./.)
-    ./lexer.l
-    ./parser.y
-    (fileset.difference (fileset.fileFilter (file: file.hasExt "nix") ./.) ./package.nix)
-  ];
 
   nativeBuildInputs = [
     bison
diff --git a/pkgs/tools/package-management/nix/modular/src/libfetchers-tests/package.nix b/pkgs/tools/package-management/nix/modular/src/libfetchers-tests/package.nix
index f6659130152e..62b86697800a 100644
--- a/pkgs/tools/package-management/nix/modular/src/libfetchers-tests/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libfetchers-tests/package.nix
@@ -18,25 +18,11 @@
   resolvePath,
 }:
 
-let
-  inherit (lib) fileset;
-in
-
 mkMesonExecutable (finalAttrs: {
   pname = "nix-fetchers-tests";
   inherit version;
 
   workDir = ./.;
-  fileset = fileset.unions [
-    ../../nix-meson-build-support
-    ./nix-meson-build-support
-    ../../.version
-    ./.version
-    ./meson.build
-    # ./meson.options
-    (fileset.fileFilter (file: file.hasExt "cc") ./.)
-    (fileset.fileFilter (file: file.hasExt "hh") ./.)
-  ];
 
   buildInputs =
     [
diff --git a/pkgs/tools/package-management/nix/modular/src/libfetchers/package.nix b/pkgs/tools/package-management/nix/modular/src/libfetchers/package.nix
index 3f52e987800e..a49a4b634fa6 100644
--- a/pkgs/tools/package-management/nix/modular/src/libfetchers/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libfetchers/package.nix
@@ -12,24 +12,11 @@
   version,
 }:
 
-let
-  inherit (lib) fileset;
-in
-
 mkMesonLibrary (finalAttrs: {
   pname = "nix-fetchers";
   inherit version;
 
   workDir = ./.;
-  fileset = fileset.unions [
-    ../../nix-meson-build-support
-    ./nix-meson-build-support
-    ../../.version
-    ./.version
-    ./meson.build
-    (fileset.fileFilter (file: file.hasExt "cc") ./.)
-    (fileset.fileFilter (file: file.hasExt "hh") ./.)
-  ];
 
   buildInputs = [
     libgit2
diff --git a/pkgs/tools/package-management/nix/modular/src/libflake-c/package.nix b/pkgs/tools/package-management/nix/modular/src/libflake-c/package.nix
index 1149508523e9..3ee6c6b4f8a6 100644
--- a/pkgs/tools/package-management/nix/modular/src/libflake-c/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libflake-c/package.nix
@@ -11,26 +11,11 @@
   version,
 }:
 
-let
-  inherit (lib) fileset;
-in
-
 mkMesonLibrary (finalAttrs: {
   pname = "nix-flake-c";
   inherit version;
 
   workDir = ./.;
-  fileset = fileset.unions [
-    ../../nix-meson-build-support
-    ./nix-meson-build-support
-    ../../.version
-    ./.version
-    ./meson.build
-    # ./meson.options
-    (fileset.fileFilter (file: file.hasExt "cc") ./.)
-    (fileset.fileFilter (file: file.hasExt "hh") ./.)
-    (fileset.fileFilter (file: file.hasExt "h") ./.)
-  ];
 
   propagatedBuildInputs = [
     nix-expr-c
diff --git a/pkgs/tools/package-management/nix/modular/src/libflake-tests/package.nix b/pkgs/tools/package-management/nix/modular/src/libflake-tests/package.nix
index 714f3791ad90..93429e53812b 100644
--- a/pkgs/tools/package-management/nix/modular/src/libflake-tests/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libflake-tests/package.nix
@@ -18,25 +18,11 @@
   resolvePath,
 }:
 
-let
-  inherit (lib) fileset;
-in
-
 mkMesonExecutable (finalAttrs: {
   pname = "nix-flake-tests";
   inherit version;
 
   workDir = ./.;
-  fileset = fileset.unions [
-    ../../nix-meson-build-support
-    ./nix-meson-build-support
-    ../../.version
-    ./.version
-    ./meson.build
-    # ./meson.options
-    (fileset.fileFilter (file: file.hasExt "cc") ./.)
-    (fileset.fileFilter (file: file.hasExt "hh") ./.)
-  ];
 
   buildInputs = [
     nix-flake
diff --git a/pkgs/tools/package-management/nix/modular/src/libflake/package.nix b/pkgs/tools/package-management/nix/modular/src/libflake/package.nix
index 5240ce5e3965..86ee4bb5c263 100644
--- a/pkgs/tools/package-management/nix/modular/src/libflake/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libflake/package.nix
@@ -13,24 +13,11 @@
   version,
 }:
 
-let
-  inherit (lib) fileset;
-in
-
 mkMesonLibrary (finalAttrs: {
   pname = "nix-flake";
   inherit version;
 
   workDir = ./.;
-  fileset = fileset.unions [
-    ../../nix-meson-build-support
-    ./nix-meson-build-support
-    ../../.version
-    ./.version
-    ./meson.build
-    (fileset.fileFilter (file: file.hasExt "cc") ./.)
-    (fileset.fileFilter (file: file.hasExt "hh") ./.)
-  ];
 
   propagatedBuildInputs = [
     nix-store
diff --git a/pkgs/tools/package-management/nix/modular/src/libmain-c/package.nix b/pkgs/tools/package-management/nix/modular/src/libmain-c/package.nix
index f019a917d360..ec1d3ba3eb05 100644
--- a/pkgs/tools/package-management/nix/modular/src/libmain-c/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libmain-c/package.nix
@@ -12,26 +12,11 @@
   version,
 }:
 
-let
-  inherit (lib) fileset;
-in
-
 mkMesonLibrary (finalAttrs: {
   pname = "nix-main-c";
   inherit version;
 
   workDir = ./.;
-  fileset = fileset.unions [
-    ../../nix-meson-build-support
-    ./nix-meson-build-support
-    ../../.version
-    ./.version
-    ./meson.build
-    # ./meson.options
-    (fileset.fileFilter (file: file.hasExt "cc") ./.)
-    (fileset.fileFilter (file: file.hasExt "hh") ./.)
-    (fileset.fileFilter (file: file.hasExt "h") ./.)
-  ];
 
   propagatedBuildInputs = [
     nix-util-c
diff --git a/pkgs/tools/package-management/nix/modular/src/libmain/package.nix b/pkgs/tools/package-management/nix/modular/src/libmain/package.nix
index c03697c48dab..6cf7e87f51d0 100644
--- a/pkgs/tools/package-management/nix/modular/src/libmain/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libmain/package.nix
@@ -12,24 +12,11 @@
   version,
 }:
 
-let
-  inherit (lib) fileset;
-in
-
 mkMesonLibrary (finalAttrs: {
   pname = "nix-main";
   inherit version;
 
   workDir = ./.;
-  fileset = fileset.unions [
-    ../../nix-meson-build-support
-    ./nix-meson-build-support
-    ../../.version
-    ./.version
-    ./meson.build
-    (fileset.fileFilter (file: file.hasExt "cc") ./.)
-    (fileset.fileFilter (file: file.hasExt "hh") ./.)
-  ];
 
   propagatedBuildInputs = [
     nix-util
diff --git a/pkgs/tools/package-management/nix/modular/src/libstore-c/package.nix b/pkgs/tools/package-management/nix/modular/src/libstore-c/package.nix
index fde17c78e017..2672cfd1a415 100644
--- a/pkgs/tools/package-management/nix/modular/src/libstore-c/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libstore-c/package.nix
@@ -10,26 +10,11 @@
   version,
 }:
 
-let
-  inherit (lib) fileset;
-in
-
 mkMesonLibrary (finalAttrs: {
   pname = "nix-store-c";
   inherit version;
 
   workDir = ./.;
-  fileset = fileset.unions [
-    ../../nix-meson-build-support
-    ./nix-meson-build-support
-    ../../.version
-    ./.version
-    ./meson.build
-    # ./meson.options
-    (fileset.fileFilter (file: file.hasExt "cc") ./.)
-    (fileset.fileFilter (file: file.hasExt "hh") ./.)
-    (fileset.fileFilter (file: file.hasExt "h") ./.)
-  ];
 
   propagatedBuildInputs = [
     nix-util-c
diff --git a/pkgs/tools/package-management/nix/modular/src/libstore-test-support/package.nix b/pkgs/tools/package-management/nix/modular/src/libstore-test-support/package.nix
index ccac25ee16a2..1211ef6b33e9 100644
--- a/pkgs/tools/package-management/nix/modular/src/libstore-test-support/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libstore-test-support/package.nix
@@ -13,25 +13,11 @@
   version,
 }:
 
-let
-  inherit (lib) fileset;
-in
-
 mkMesonLibrary (finalAttrs: {
   pname = "nix-store-test-support";
   inherit version;
 
   workDir = ./.;
-  fileset = fileset.unions [
-    ../../nix-meson-build-support
-    ./nix-meson-build-support
-    ../../.version
-    ./.version
-    ./meson.build
-    # ./meson.options
-    (fileset.fileFilter (file: file.hasExt "cc") ./.)
-    (fileset.fileFilter (file: file.hasExt "hh") ./.)
-  ];
 
   propagatedBuildInputs = [
     nix-util-test-support
diff --git a/pkgs/tools/package-management/nix/modular/src/libstore-tests/package.nix b/pkgs/tools/package-management/nix/modular/src/libstore-tests/package.nix
index b39ee7fa73c0..be9a51a784d2 100644
--- a/pkgs/tools/package-management/nix/modular/src/libstore-tests/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libstore-tests/package.nix
@@ -19,25 +19,11 @@
   filesetToSource,
 }:
 
-let
-  inherit (lib) fileset;
-in
-
 mkMesonExecutable (finalAttrs: {
   pname = "nix-store-tests";
   inherit version;
 
   workDir = ./.;
-  fileset = fileset.unions [
-    ../../nix-meson-build-support
-    ./nix-meson-build-support
-    ../../.version
-    ./.version
-    ./meson.build
-    # ./meson.options
-    (fileset.fileFilter (file: file.hasExt "cc") ./.)
-    (fileset.fileFilter (file: file.hasExt "hh") ./.)
-  ];
 
   # Hack for sake of the dev shell
   passthru.externalBuildInputs = [
diff --git a/pkgs/tools/package-management/nix/modular/src/libstore/package.nix b/pkgs/tools/package-management/nix/modular/src/libstore/package.nix
index bba96e07f312..63ea2c743687 100644
--- a/pkgs/tools/package-management/nix/modular/src/libstore/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libstore/package.nix
@@ -23,31 +23,11 @@
   embeddedSandboxShell ? stdenv.hostPlatform.isStatic,
 }:
 
-let
-  inherit (lib) fileset;
-in
-
 mkMesonLibrary (finalAttrs: {
   pname = "nix-store";
   inherit version;
 
   workDir = ./.;
-  fileset = fileset.unions [
-    ../../nix-meson-build-support
-    ./nix-meson-build-support
-    ../../.version
-    ./.version
-    ./meson.build
-    ./meson.options
-    ./linux/meson.build
-    ./unix/meson.build
-    ./windows/meson.build
-    (fileset.fileFilter (file: file.hasExt "cc") ./.)
-    (fileset.fileFilter (file: file.hasExt "hh") ./.)
-    (fileset.fileFilter (file: file.hasExt "sb") ./.)
-    (fileset.fileFilter (file: file.hasExt "md") ./.)
-    (fileset.fileFilter (file: file.hasExt "sql") ./.)
-  ];
 
   nativeBuildInputs = lib.optional embeddedSandboxShell unixtools.hexdump;
 
diff --git a/pkgs/tools/package-management/nix/modular/src/libutil-c/package.nix b/pkgs/tools/package-management/nix/modular/src/libutil-c/package.nix
index f26f57775d4f..70a678d82302 100644
--- a/pkgs/tools/package-management/nix/modular/src/libutil-c/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libutil-c/package.nix
@@ -9,26 +9,11 @@
   version,
 }:
 
-let
-  inherit (lib) fileset;
-in
-
 mkMesonLibrary (finalAttrs: {
   pname = "nix-util-c";
   inherit version;
 
   workDir = ./.;
-  fileset = fileset.unions [
-    ../../nix-meson-build-support
-    ./nix-meson-build-support
-    ../../.version
-    ./.version
-    ./meson.build
-    ./meson.options
-    (fileset.fileFilter (file: file.hasExt "cc") ./.)
-    (fileset.fileFilter (file: file.hasExt "hh") ./.)
-    (fileset.fileFilter (file: file.hasExt "h") ./.)
-  ];
 
   propagatedBuildInputs = [
     nix-util
diff --git a/pkgs/tools/package-management/nix/modular/src/libutil-test-support/package.nix b/pkgs/tools/package-management/nix/modular/src/libutil-test-support/package.nix
index fafd47c86c5e..e3305ea36a5c 100644
--- a/pkgs/tools/package-management/nix/modular/src/libutil-test-support/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libutil-test-support/package.nix
@@ -12,25 +12,11 @@
   version,
 }:
 
-let
-  inherit (lib) fileset;
-in
-
 mkMesonLibrary (finalAttrs: {
   pname = "nix-util-test-support";
   inherit version;
 
   workDir = ./.;
-  fileset = fileset.unions [
-    ../../nix-meson-build-support
-    ./nix-meson-build-support
-    ../../.version
-    ./.version
-    ./meson.build
-    # ./meson.options
-    (fileset.fileFilter (file: file.hasExt "cc") ./.)
-    (fileset.fileFilter (file: file.hasExt "hh") ./.)
-  ];
 
   propagatedBuildInputs = [
     nix-util
diff --git a/pkgs/tools/package-management/nix/modular/src/libutil-tests/package.nix b/pkgs/tools/package-management/nix/modular/src/libutil-tests/package.nix
index b8d54b76c42f..5bd2fd66542e 100644
--- a/pkgs/tools/package-management/nix/modular/src/libutil-tests/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libutil-tests/package.nix
@@ -18,25 +18,11 @@
   resolvePath,
 }:
 
-let
-  inherit (lib) fileset;
-in
-
 mkMesonExecutable (finalAttrs: {
   pname = "nix-util-tests";
   inherit version;
 
   workDir = ./.;
-  fileset = fileset.unions [
-    ../../nix-meson-build-support
-    ./nix-meson-build-support
-    ../../.version
-    ./.version
-    ./meson.build
-    # ./meson.options
-    (fileset.fileFilter (file: file.hasExt "cc") ./.)
-    (fileset.fileFilter (file: file.hasExt "hh") ./.)
-  ];
 
   buildInputs = [
     nix-util
diff --git a/pkgs/tools/package-management/nix/modular/src/libutil/package.nix b/pkgs/tools/package-management/nix/modular/src/libutil/package.nix
index e389fd59439c..3e96aa0660c8 100644
--- a/pkgs/tools/package-management/nix/modular/src/libutil/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libutil/package.nix
@@ -17,29 +17,11 @@
   version,
 }:
 
-let
-  inherit (lib) fileset;
-in
-
 mkMesonLibrary (finalAttrs: {
   pname = "nix-util";
   inherit version;
 
   workDir = ./.;
-  fileset = fileset.unions [
-    ../../nix-meson-build-support
-    ./nix-meson-build-support
-    ../../.version
-    ./.version
-    ./widecharwidth
-    ./meson.build
-    ./meson.options
-    ./linux/meson.build
-    ./unix/meson.build
-    ./windows/meson.build
-    (fileset.fileFilter (file: file.hasExt "cc") ./.)
-    (fileset.fileFilter (file: file.hasExt "hh") ./.)
-  ];
 
   buildInputs =
     [
diff --git a/pkgs/tools/package-management/nix/modular/src/nix/package.nix b/pkgs/tools/package-management/nix/modular/src/nix/package.nix
index 40a280437850..d96823a991c7 100644
--- a/pkgs/tools/package-management/nix/modular/src/nix/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/nix/package.nix
@@ -12,77 +12,11 @@
   version,
 }:
 
-let
-  inherit (lib) fileset;
-in
-
 mkMesonExecutable (finalAttrs: {
   pname = "nix";
   inherit version;
 
   workDir = ./.;
-  fileset = fileset.unions (
-    [
-      ../../nix-meson-build-support
-      ./nix-meson-build-support
-      ../../.version
-      ./.version
-      ./meson.build
-      ./meson.options
-
-      # Symbolic links to other dirs
-      ## exes
-      ./build-remote
-      ./doc
-      ./nix-build
-      ./nix-channel
-      ./nix-collect-garbage
-      ./nix-copy-closure
-      ./nix-env
-      ./nix-instantiate
-      ./nix-store
-      ## dirs
-      ./scripts
-      ../../scripts
-      ./misc
-      ../../misc
-
-      # Doc nix files for --help
-      ../../doc/manual/generate-manpage.nix
-      ../../doc/manual/utils.nix
-      ../../doc/manual/generate-settings.nix
-      ../../doc/manual/generate-store-info.nix
-
-      # Other files to be included as string literals
-      ../nix-channel/unpack-channel.nix
-      ../nix-env/buildenv.nix
-      ./get-env.sh
-      ./help-stores.md
-      ../../doc/manual/source/store/types/index.md.in
-      ./profiles.md
-      ../../doc/manual/source/command-ref/files/profiles.md
-
-      # Files
-    ]
-    ++
-      lib.concatMap
-        (dir: [
-          (fileset.fileFilter (file: file.hasExt "cc") dir)
-          (fileset.fileFilter (file: file.hasExt "hh") dir)
-          (fileset.fileFilter (file: file.hasExt "md") dir)
-        ])
-        [
-          ./.
-          ../build-remote
-          ../nix-build
-          ../nix-channel
-          ../nix-collect-garbage
-          ../nix-copy-closure
-          ../nix-env
-          ../nix-instantiate
-          ../nix-store
-        ]
-  );
 
   buildInputs = [
     nix-store
diff --git a/pkgs/tools/package-management/nix/modular/src/perl/package.nix b/pkgs/tools/package-management/nix/modular/src/perl/package.nix
index 5841570cd090..5c788ccdd8cd 100644
--- a/pkgs/tools/package-management/nix/modular/src/perl/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/perl/package.nix
@@ -12,30 +12,12 @@
   libsodium,
 }:
 
-let
-  inherit (lib) fileset;
-in
-
 perl.pkgs.toPerlModule (
   mkMesonDerivation (finalAttrs: {
     pname = "nix-perl";
     inherit version;
 
     workDir = ./.;
-    fileset = fileset.unions (
-      [
-        ./.version
-        ../../.version
-        ./MANIFEST
-        ./lib
-        ./meson.build
-        ./meson.options
-      ]
-      ++ lib.optionals finalAttrs.finalPackage.doCheck [
-        ./.yath.rc.in
-        ./t
-      ]
-    );
 
     nativeBuildInputs = [
       pkg-config
diff --git a/pkgs/tools/package-management/nix/modular/tests/functional/package.nix b/pkgs/tools/package-management/nix/modular/tests/functional/package.nix
index c479d6ca38d3..333149208c21 100644
--- a/pkgs/tools/package-management/nix/modular/tests/functional/package.nix
+++ b/pkgs/tools/package-management/nix/modular/tests/functional/package.nix
@@ -27,22 +27,12 @@
   test-daemon ? null,
 }:
 
-let
-  inherit (lib) fileset;
-in
-
 mkMesonDerivation (
   finalAttrs:
   {
     inherit pname version;
 
     workDir = ./.;
-    fileset = fileset.unions [
-      ../../scripts/nix-profile.sh.in
-      ../../.version
-      ../../tests/functional
-      ./.
-    ];
 
     # Hack for sake of the dev shell
     passthru.externalNativeBuildInputs =
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 6010ea721ff8..abceacfc1ba5 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1393,6 +1393,7 @@ mapAliases {
   pgroonga = postgresqlPackages.pgroonga;
   pgtap = postgresqlPackages.pgtap;
   plv8 = postgresqlPackages.plv8;
+  postcss-cli = throw "postcss-cli has been removed because it was broken"; # added 2025-03-24
   postgis = postgresqlPackages.postgis;
   tex-match = throw "'tex-match' has been removed due to lack of maintenance upstream. Consider using 'hieroglyphic' instead"; # Added 2024-09-24
   texinfo5 = throw "'texinfo5' has been removed from nixpkgs"; # Added 2024-09-10
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b2ed9d41c624..6f687147ea3b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8671,8 +8671,6 @@ with pkgs;
 
   polar = callPackage ../tools/misc/polar { };
 
-  inherit (nodePackages) postcss-cli;
-
   pyprof2calltree = with python3Packages; toPythonApplication pyprof2calltree;
 
   premake3 = callPackage ../development/tools/misc/premake/3.nix { };
diff --git a/pkgs/top-level/release-cross.nix b/pkgs/top-level/release-cross.nix
index fe0dca7cfed4..f15758260d33 100644
--- a/pkgs/top-level/release-cross.nix
+++ b/pkgs/top-level/release-cross.nix
@@ -262,6 +262,7 @@ in
   or1k = mapTestOnCross systems.examples.or1k embedded;
   avr = mapTestOnCross systems.examples.avr embedded;
   arm-embedded = mapTestOnCross systems.examples.arm-embedded embedded;
+  arm-embedded-nano = mapTestOnCross systems.examples.arm-embedded-nano embedded;
   armhf-embedded = mapTestOnCross systems.examples.armhf-embedded embedded;
   aarch64-embedded = mapTestOnCross systems.examples.aarch64-embedded embedded;
   aarch64be-embedded = mapTestOnCross systems.examples.aarch64be-embedded embedded;