diff --git a/ci/check-cherry-picks.sh b/ci/check-cherry-picks.sh
index 51efb543ad3f..113828f6ee1c 100755
--- a/ci/check-cherry-picks.sh
+++ b/ci/check-cherry-picks.sh
@@ -66,9 +66,11 @@ while read -r new_commit_sha ; do
   git rev-list --max-count=1 --format=medium "$new_commit_sha"
   echo "-------------------------------------------------"
 
+  # Using the last line with "cherry" + hash, because a chained backport
+  # can result in multiple of those lines. Only the last one counts.
   original_commit_sha=$(
     git rev-list --max-count=1 --format=format:%B "$new_commit_sha" \
-    | grep -Ei -m1 "cherry.*[0-9a-f]{40}" \
+    | grep -Ei "cherry.*[0-9a-f]{40}" | tail -n1 \
     | grep -Eoi -m1 '[0-9a-f]{40}' || true
   )
   if [ -z "$original_commit_sha" ] ; then
diff --git a/doc/languages-frameworks/beam.section.md b/doc/languages-frameworks/beam.section.md
index ada05b0ddc22..0eb5bcbce699 100644
--- a/doc/languages-frameworks/beam.section.md
+++ b/doc/languages-frameworks/beam.section.md
@@ -259,13 +259,13 @@ in
     wantedBy = [ "multi-user.target" ];
     after = [
       "network.target"
-      "postgresql.service"
+      "postgresql.target"
     ];
     # note that if you are connecting to a postgres instance on a different host
-    # postgresql.service should not be included in the requires.
+    # postgresql.target should not be included in the requires.
     requires = [
       "network-online.target"
-      "postgresql.service"
+      "postgresql.target"
     ];
     description = "my app";
     environment = {
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 8b518ec9136c..17c86233489e 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -8160,6 +8160,16 @@
     githubId = 26925347;
     keys = [ { fingerprint = "0797 D238 9769 CA1E 57B7 2ED9 2BA7 8116 87C9 0DE4"; } ];
   };
+  felipe-9 = {
+    name = "Felipe Pinto";
+    email = "felipealexandrepinto@icloud.com";
+    github = "Felipe-9";
+    githubId = 32753781;
+    keys = [
+      { fingerprint = "1533 0D57 3312 0936 AB38  3C9B 7D36 1E4B 83CD AEFB"; }
+      { fingerprint = "2BD0 AD01 F91D A0DC 47DF  0AEE 7AA1 649F 6B71 42F2"; }
+    ];
+  };
   felipeqq2 = {
     name = "Felipe Silva";
     email = "nixpkgs@felipeqq2.rocks";
diff --git a/nixos/doc/manual/redirects.json b/nixos/doc/manual/redirects.json
index 95470dcdb816..3cabffb61df8 100644
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -1316,22 +1316,14 @@
   "module-services-postgres-initializing-extra-permissions": [
     "index.html#module-services-postgres-initializing-extra-permissions"
   ],
-  "module-services-postgres-initializing-extra-permissions-superuser": [
-    "index.html#module-services-postgres-initializing-extra-permissions-superuser"
-  ],
   "module-services-postgres-initializing-extra-permissions-superuser-post-start": [
-    "index.html#module-services-postgres-initializing-extra-permissions-superuser-post-start"
-  ],
-  "module-services-postgres-initializing-extra-permissions-superuser-oneshot": [
-    "index.html#module-services-postgres-initializing-extra-permissions-superuser-oneshot"
-  ],
-  "module-services-postgres-initializing-extra-permissions-service-user": [
+    "index.html#module-services-postgres-initializing-extra-permissions-superuser-post-start",
+    "index.html#module-services-postgres-initializing-extra-permissions-superuser",
+    "index.html#module-services-postgres-initializing-extra-permissions-service-user-pre-start",
     "index.html#module-services-postgres-initializing-extra-permissions-service-user"
   ],
-  "module-services-postgres-initializing-extra-permissions-service-user-pre-start": [
-    "index.html#module-services-postgres-initializing-extra-permissions-service-user-pre-start"
-  ],
-  "module-services-postgres-initializing-extra-permissions-service-user-oneshot": [
+  "module-services-postgres-initializing-extra-permissions-superuser-oneshot": [
+    "index.html#module-services-postgres-initializing-extra-permissions-superuser-oneshot",
     "index.html#module-services-postgres-initializing-extra-permissions-service-user-oneshot"
   ],
   "module-services-postgres-authentication": [
diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 26642e9ce784..2b56d3047356 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -66,8 +66,12 @@
 
 - The `yeahwm` package and `services.xserver.windowManager.yeahwm` module were removed due to the package being broken and unmaintained upstream.
 
+- The `services.postgresql` module now sets up a systemd unit `postgresql.target`. Depending on `postgresql.target` guarantees that postgres is in read-write mode and initial/ensure scripts were executed. Depending on `postgresql.service` only guarantees a read-only connection.
+
 - The `services.siproxd` module has been removed as `siproxd` is unmaintained and broken with libosip 5.x.
 
+- `netbox-manage` script created by the `netbox` module no longer uses `sudo -u netbox` internally. It can be run as root and will change it's user to `netbox` using `runuser`
+
 - `services.dwm-status.extraConfig` was replaced by [RFC0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md)-compliant [](#opt-services.dwm-status.settings), which is used to generate the config file. `services.dwm-status.order` is now moved to [](#opt-services.dwm-status.settings.order), as it's a part of the config file.
 
 - `gitversion` was updated to 6.3.0, which includes a number of breaking changes, old configurations may need updating or they will cause the tool to fail to run.
diff --git a/nixos/modules/services/admin/pgadmin.nix b/nixos/modules/services/admin/pgadmin.nix
index 79cc14b828ec..772c1628032a 100644
--- a/nixos/modules/services/admin/pgadmin.nix
+++ b/nixos/modules/services/admin/pgadmin.nix
@@ -182,7 +182,7 @@ in
       requires = [ "network.target" ];
       # we're adding this optionally so just in case there's any race it'll be caught
       # in case postgres doesn't start, pgadmin will just start normally
-      wants = [ "postgresql.service" ];
+      wants = [ "postgresql.target" ];
 
       path = [
         config.services.postgresql.package
diff --git a/nixos/modules/services/backup/bacula.nix b/nixos/modules/services/backup/bacula.nix
index a35350646c9b..cc2e603bf3f9 100644
--- a/nixos/modules/services/backup/bacula.nix
+++ b/nixos/modules/services/backup/bacula.nix
@@ -720,7 +720,7 @@ in
     systemd.services.bacula-dir = mkIf dir_cfg.enable {
       after = [
         "network.target"
-        "postgresql.service"
+        "postgresql.target"
       ];
       description = "Bacula Director Daemon";
       wantedBy = [ "multi-user.target" ];
diff --git a/nixos/modules/services/backup/postgresql-backup.nix b/nixos/modules/services/backup/postgresql-backup.nix
index 8a3a8173354e..b32c0bbc5252 100644
--- a/nixos/modules/services/backup/postgresql-backup.nix
+++ b/nixos/modules/services/backup/postgresql-backup.nix
@@ -35,7 +35,7 @@ let
 
       description = "Backup of ${db} database(s)";
 
-      requires = [ "postgresql.service" ];
+      requires = [ "postgresql.target" ];
 
       path = [
         pkgs.coreutils
diff --git a/nixos/modules/services/continuous-integration/hydra/default.nix b/nixos/modules/services/continuous-integration/hydra/default.nix
index db83c9fe06fd..817adfb2112e 100644
--- a/nixos/modules/services/continuous-integration/hydra/default.nix
+++ b/nixos/modules/services/continuous-integration/hydra/default.nix
@@ -334,8 +334,8 @@ in
 
     systemd.services.hydra-init = {
       wantedBy = [ "multi-user.target" ];
-      requires = lib.optional haveLocalDB "postgresql.service";
-      after = lib.optional haveLocalDB "postgresql.service";
+      requires = lib.optional haveLocalDB "postgresql.target";
+      after = lib.optional haveLocalDB "postgresql.target";
       environment = env // {
         HYDRA_DBI = "${env.HYDRA_DBI};application_name=hydra-init";
       };
diff --git a/nixos/modules/services/databases/pgmanage.nix b/nixos/modules/services/databases/pgmanage.nix
index 472aefdaade5..f638aefb4b52 100644
--- a/nixos/modules/services/databases/pgmanage.nix
+++ b/nixos/modules/services/databases/pgmanage.nix
@@ -185,8 +185,8 @@ in
   config = lib.mkIf cfg.enable {
     systemd.services.pgmanage = {
       description = "pgmanage - PostgreSQL Administration for the web";
-      wants = [ "postgresql.service" ];
-      after = [ "postgresql.service" ];
+      wants = [ "postgresql.target" ];
+      after = [ "postgresql.target" ];
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
         User = pgmanage;
diff --git a/nixos/modules/services/databases/postgres-websockets.nix b/nixos/modules/services/databases/postgres-websockets.nix
index a83054a507cb..bd5b75b8e6b9 100644
--- a/nixos/modules/services/databases/postgres-websockets.nix
+++ b/nixos/modules/services/databases/postgres-websockets.nix
@@ -156,7 +156,7 @@ in
       wants = [ "network-online.target" ];
       after = [
         "network-online.target"
-        "postgresql.service"
+        "postgresql.target"
       ];
 
       environment =
diff --git a/nixos/modules/services/databases/postgresql.md b/nixos/modules/services/databases/postgresql.md
index a83918efc7cc..aa38ebb3a249 100644
--- a/nixos/modules/services/databases/postgresql.md
+++ b/nixos/modules/services/databases/postgresql.md
@@ -89,29 +89,29 @@ database migrations.
 
 **NOTE:** please make sure that any added migrations are idempotent (re-runnable).
 
-#### as superuser {#module-services-postgres-initializing-extra-permissions-superuser}
+#### in database's setup `postStart` {#module-services-postgres-initializing-extra-permissions-superuser-post-start}
 
-**Advantage:** compatible with postgres < 15, because it's run
-as the database superuser `postgres`.
-
-##### in database `postStart` {#module-services-postgres-initializing-extra-permissions-superuser-post-start}
-
-**Disadvantage:** need to take care of ordering yourself. In this
-example, `mkAfter` ensures that permissions are assigned after any
-databases from `ensureDatabases` and `extraUser1` from `ensureUsers`
-are already created.
+`ensureUsers` is run in `postgresql-setup`, so this is where `postStart` must be added to:
 
 ```nix
   {
-    systemd.services.postgresql.postStart = lib.mkAfter ''
-      $PSQL service1 -c 'GRANT SELECT ON ALL TABLES IN SCHEMA public TO "extraUser1"'
-      $PSQL service1 -c 'GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO "extraUser1"'
+    systemd.services.postgresql-setup.postStart = ''
+      psql service1 -c 'GRANT SELECT ON ALL TABLES IN SCHEMA public TO "extraUser1"'
+      psql service1 -c 'GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO "extraUser1"'
       # ....
     '';
   }
 ```
 
-##### in intermediate oneshot service {#module-services-postgres-initializing-extra-permissions-superuser-oneshot}
+#### in intermediate oneshot service {#module-services-postgres-initializing-extra-permissions-superuser-oneshot}
+
+Make sure to run this service after `postgresql.target`, not `postgresql.service`.
+
+They differ in two aspects:
+- `postgresql.target` includes `postgresql-setup`, so users managed via `ensureUsers` are already created.
+- `postgresql.target` will wait until PostgreSQL is in read-write mode after restoring from backup, while `postgresql.service` will already be ready when PostgreSQL is still recovering in read-only mode.
+
+Both can lead to unexpected errors either during initial database creation or restore, when using `postgresql.service`.
 
 ```nix
   {
@@ -119,54 +119,13 @@ are already created.
       serviceConfig.Type = "oneshot";
       requiredBy = "service1.service";
       before = "service1.service";
-      after = "postgresql.service";
+      after = "postgresql.target";
       serviceConfig.User = "postgres";
-      environment.PSQL = "psql --port=${toString services.postgresql.settings.port}";
+      environment.PGPORT = toString services.postgresql.settings.port;
       path = [ postgresql ];
       script = ''
-        $PSQL service1 -c 'GRANT SELECT ON ALL TABLES IN SCHEMA public TO "extraUser1"'
-        $PSQL service1 -c 'GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO "extraUser1"'
-        # ....
-      '';
-    };
-  }
-```
-
-#### as service user {#module-services-postgres-initializing-extra-permissions-service-user}
-
-**Advantage:** re-uses systemd's dependency ordering;
-
-**Disadvantage:** relies on service user having grant permission. To be combined with `ensureDBOwnership`.
-
-##### in service `preStart` {#module-services-postgres-initializing-extra-permissions-service-user-pre-start}
-
-```nix
-  {
-    environment.PSQL = "psql --port=${toString services.postgresql.settings.port}";
-    path = [ postgresql ];
-    systemd.services."service1".preStart = ''
-      $PSQL -c 'GRANT SELECT ON ALL TABLES IN SCHEMA public TO "extraUser1"'
-      $PSQL -c 'GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO "extraUser1"'
-      # ....
-    '';
-  }
-```
-
-##### in intermediate oneshot service {#module-services-postgres-initializing-extra-permissions-service-user-oneshot}
-
-```nix
-  {
-    systemd.services."migrate-service1-db1" = {
-      serviceConfig.Type = "oneshot";
-      requiredBy = "service1.service";
-      before = "service1.service";
-      after = "postgresql.service";
-      serviceConfig.User = "service1";
-      environment.PSQL = "psql --port=${toString services.postgresql.settings.port}";
-      path = [ postgresql ];
-      script = ''
-        $PSQL -c 'GRANT SELECT ON ALL TABLES IN SCHEMA public TO "extraUser1"'
-        $PSQL -c 'GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO "extraUser1"'
+        psql service1 -c 'GRANT SELECT ON ALL TABLES IN SCHEMA public TO "extraUser1"'
+        psql service1 -c 'GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO "extraUser1"'
         # ....
       '';
     };
diff --git a/nixos/modules/services/databases/postgresql.nix b/nixos/modules/services/databases/postgresql.nix
index 2c0a8f5d4106..29cef9b40e18 100644
--- a/nixos/modules/services/databases/postgresql.nix
+++ b/nixos/modules/services/databases/postgresql.nix
@@ -751,12 +751,23 @@ in
       cfg.checkConfig && pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform
     ) configFileCheck;
 
+    systemd.targets.postgresql = {
+      description = "PostgreSQL";
+      wantedBy = [ "multi-user.target" ];
+      bindsTo = [
+        "postgresql.service"
+        "postgresql-setup.service"
+      ];
+    };
+
     systemd.services.postgresql = {
       description = "PostgreSQL Server";
 
-      wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
 
+      # To trigger the .target also on "systemctl start postgresql".
+      bindsTo = [ "postgresql.target" ];
+
       environment.PGDATA = cfg.dataDir;
 
       path = [ cfg.finalPackage ];
@@ -776,49 +787,6 @@ in
         ln -sfn "${configFile}/postgresql.conf" "${cfg.dataDir}/postgresql.conf"
       '';
 
-      # Wait for PostgreSQL to be ready to accept connections.
-      postStart =
-        ''
-          PSQL="psql --port=${builtins.toString cfg.settings.port}"
-
-          while ! $PSQL -d postgres -c "" 2> /dev/null; do
-              if ! kill -0 "$MAINPID"; then exit 1; fi
-              sleep 0.1
-          done
-
-          if test -e "${cfg.dataDir}/.first_startup"; then
-            ${optionalString (cfg.initialScript != null) ''
-              $PSQL -f "${cfg.initialScript}" -d postgres
-            ''}
-            rm -f "${cfg.dataDir}/.first_startup"
-          fi
-        ''
-        + optionalString (cfg.ensureDatabases != [ ]) ''
-          ${concatMapStrings (database: ''
-            $PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = '${database}'" | grep -q 1 || $PSQL -tAc 'CREATE DATABASE "${database}"'
-          '') cfg.ensureDatabases}
-        ''
-        + ''
-          ${concatMapStrings (
-            user:
-            let
-              dbOwnershipStmt = optionalString user.ensureDBOwnership ''$PSQL -tAc 'ALTER DATABASE "${user.name}" OWNER TO "${user.name}";' '';
-
-              filteredClauses = filterAttrs (name: value: value != null) user.ensureClauses;
-
-              clauseSqlStatements = attrValues (mapAttrs (n: v: if v then n else "no${n}") filteredClauses);
-
-              userClauses = ''$PSQL -tAc 'ALTER ROLE "${user.name}" ${concatStringsSep " " clauseSqlStatements}' '';
-            in
-            ''
-              $PSQL -tAc "SELECT 1 FROM pg_roles WHERE rolname='${user.name}'" | grep -q 1 || $PSQL -tAc 'CREATE USER "${user.name}"'
-              ${userClauses}
-
-              ${dbOwnershipStmt}
-            ''
-          ) cfg.ensureUsers}
-        '';
-
       serviceConfig = mkMerge [
         {
           ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
@@ -891,11 +859,74 @@ in
 
       unitConfig.RequiresMountsFor = "${cfg.dataDir}";
     };
+
+    systemd.services.postgresql-setup = {
+      description = "PostgreSQL Setup Scripts";
+
+      requires = [ "postgresql.service" ];
+      after = [ "postgresql.service" ];
+
+      serviceConfig = {
+        User = "postgres";
+        Group = "postgres";
+        Type = "oneshot";
+        RemainAfterExit = true;
+      };
+
+      path = [ cfg.finalPackage ];
+      environment.PGPORT = builtins.toString cfg.settings.port;
+
+      # Wait for PostgreSQL to be ready to accept connections.
+      script =
+        ''
+          check-connection() {
+            psql -d postgres -v ON_ERROR_STOP=1 <<-'  EOF'
+              SELECT pg_is_in_recovery() \gset
+              \if :pg_is_in_recovery
+              \i still-recovering
+              \endif
+            EOF
+          }
+          while ! check-connection 2> /dev/null; do
+              if ! systemctl is-active --quiet postgresql.service; then exit 1; fi
+              sleep 0.1
+          done
+
+          if test -e "${cfg.dataDir}/.first_startup"; then
+            ${optionalString (cfg.initialScript != null) ''
+              psql -f "${cfg.initialScript}" -d postgres
+            ''}
+            rm -f "${cfg.dataDir}/.first_startup"
+          fi
+        ''
+        + optionalString (cfg.ensureDatabases != [ ]) ''
+          ${concatMapStrings (database: ''
+            psql -tAc "SELECT 1 FROM pg_database WHERE datname = '${database}'" | grep -q 1 || psql -tAc 'CREATE DATABASE "${database}"'
+          '') cfg.ensureDatabases}
+        ''
+        + ''
+          ${concatMapStrings (
+            user:
+            let
+              dbOwnershipStmt = optionalString user.ensureDBOwnership ''psql -tAc 'ALTER DATABASE "${user.name}" OWNER TO "${user.name}";' '';
+
+              filteredClauses = filterAttrs (name: value: value != null) user.ensureClauses;
+
+              clauseSqlStatements = attrValues (mapAttrs (n: v: if v then n else "no${n}") filteredClauses);
+
+              userClauses = ''psql -tAc 'ALTER ROLE "${user.name}" ${concatStringsSep " " clauseSqlStatements}' '';
+            in
+            ''
+              psql -tAc "SELECT 1 FROM pg_roles WHERE rolname='${user.name}'" | grep -q 1 || psql -tAc 'CREATE USER "${user.name}"'
+              ${userClauses}
+
+              ${dbOwnershipStmt}
+            ''
+          ) cfg.ensureUsers}
+        '';
+    };
   };
 
   meta.doc = ./postgresql.md;
-  meta.maintainers = with lib.maintainers; [
-    thoughtpolice
-    danbst
-  ];
+  meta.maintainers = pkgs.postgresql.meta.maintainers;
 }
diff --git a/nixos/modules/services/databases/postgrest.nix b/nixos/modules/services/databases/postgrest.nix
index 5cd90db3609a..262a8e9433a3 100644
--- a/nixos/modules/services/databases/postgrest.nix
+++ b/nixos/modules/services/databases/postgrest.nix
@@ -256,7 +256,7 @@ in
       wants = [ "network-online.target" ];
       after = [
         "network-online.target"
-        "postgresql.service"
+        "postgresql.target"
       ];
 
       serviceConfig = {
diff --git a/nixos/modules/services/development/zammad.nix b/nixos/modules/services/development/zammad.nix
index ac659e9fa527..63dcea187eda 100644
--- a/nixos/modules/services/development/zammad.nix
+++ b/nixos/modules/services/development/zammad.nix
@@ -275,13 +275,13 @@ in
           "systemd-tmpfiles-setup.service"
         ]
         ++ lib.optionals (cfg.database.createLocally) [
-          "postgresql.service"
+          "postgresql.target"
         ]
         ++ lib.optionals cfg.redis.createLocally [
           "redis-${cfg.redis.name}.service"
         ];
       requires = lib.optionals (cfg.database.createLocally) [
-        "postgresql.service"
+        "postgresql.target"
       ];
       description = "Zammad web";
       wantedBy = [ "multi-user.target" ];
diff --git a/nixos/modules/services/finance/libeufin/common.nix b/nixos/modules/services/finance/libeufin/common.nix
index 20b99ce9c396..2058f070eac9 100644
--- a/nixos/modules/services/finance/libeufin/common.nix
+++ b/nixos/modules/services/finance/libeufin/common.nix
@@ -123,8 +123,8 @@ libeufinComponent:
                   echo "Bank initialisation complete"
                 fi
               '';
-            requires = lib.optionals cfg.createLocalDatabase [ "postgresql.service" ];
-            after = [ "network.target" ] ++ lib.optionals cfg.createLocalDatabase [ "postgresql.service" ];
+            requires = lib.optionals cfg.createLocalDatabase [ "postgresql.target" ];
+            after = [ "network.target" ] ++ lib.optionals cfg.createLocalDatabase [ "postgresql.target" ];
           };
       };
 
diff --git a/nixos/modules/services/finance/odoo.nix b/nixos/modules/services/finance/odoo.nix
index ec0c4992566e..9177a7f25a54 100644
--- a/nixos/modules/services/finance/odoo.nix
+++ b/nixos/modules/services/finance/odoo.nix
@@ -119,13 +119,13 @@ in
         wantedBy = [ "multi-user.target" ];
         after = [
           "network.target"
-          "postgresql.service"
+          "postgresql.target"
         ];
 
         # pg_dump
         path = [ config.services.postgresql.package ];
 
-        requires = [ "postgresql.service" ];
+        requires = [ "postgresql.target" ];
 
         serviceConfig = {
           ExecStart = "${cfg.package}/bin/odoo";
diff --git a/nixos/modules/services/finance/taler/common.nix b/nixos/modules/services/finance/taler/common.nix
index 891562c90ff8..0f175128a125 100644
--- a/nixos/modules/services/finance/taler/common.nix
+++ b/nixos/modules/services/finance/taler/common.nix
@@ -89,8 +89,8 @@ in
             Restart = "on-failure";
             RestartSec = "5s";
           };
-          requires = [ "postgresql.service" ];
-          after = [ "postgresql.service" ];
+          requires = [ "postgresql.target" ];
+          after = [ "postgresql.target" ];
         };
       }
     ];
diff --git a/nixos/modules/services/home-automation/home-assistant.nix b/nixos/modules/services/home-automation/home-assistant.nix
index 2887e5754173..3267e8107cc7 100644
--- a/nixos/modules/services/home-automation/home-assistant.nix
+++ b/nixos/modules/services/home-automation/home-assistant.nix
@@ -623,7 +623,7 @@ in
 
         # prevent races with database creation
         "mysql.service"
-        "postgresql.service"
+        "postgresql.target"
       ];
       reloadTriggers =
         optionals (cfg.config != null) [ configFile ]
diff --git a/nixos/modules/services/mail/dspam.nix b/nixos/modules/services/mail/dspam.nix
index 7baae1f78e47..c3090c15373b 100644
--- a/nixos/modules/services/mail/dspam.nix
+++ b/nixos/modules/services/mail/dspam.nix
@@ -107,7 +107,7 @@ in
         systemd.services.dspam = {
           description = "dspam spam filtering daemon";
           wantedBy = [ "multi-user.target" ];
-          after = [ "postgresql.service" ];
+          after = [ "postgresql.target" ];
           restartTriggers = [ cfgfile ];
 
           serviceConfig = {
diff --git a/nixos/modules/services/mail/listmonk.nix b/nixos/modules/services/mail/listmonk.nix
index 1000bce88d61..5732467db1bf 100644
--- a/nixos/modules/services/mail/listmonk.nix
+++ b/nixos/modules/services/mail/listmonk.nix
@@ -193,7 +193,7 @@ in
 
     systemd.services.listmonk = {
       description = "Listmonk - newsletter and mailing list manager";
-      after = [ "network.target" ] ++ lib.optional cfg.database.createLocally "postgresql.service";
+      after = [ "network.target" ] ++ lib.optional cfg.database.createLocally "postgresql.target";
       wantedBy = [ "multi-user.target" ];
       serviceConfig = {
         Type = "exec";
diff --git a/nixos/modules/services/mail/mailman.nix b/nixos/modules/services/mail/mailman.nix
index d9940cb4d98f..f31969b1aa91 100644
--- a/nixos/modules/services/mail/mailman.nix
+++ b/nixos/modules/services/mail/mailman.nix
@@ -575,9 +575,9 @@ in
           after =
             [ "network.target" ]
             ++ lib.optional cfg.enablePostfix "postfix-setup.service"
-            ++ lib.optional withPostgresql "postgresql.service";
+            ++ lib.optional withPostgresql "postgresql.target";
           restartTriggers = [ mailmanCfgFile ];
-          requires = lib.optional withPostgresql "postgresql.service";
+          requires = lib.optional withPostgresql "postgresql.target";
           wantedBy = [ "multi-user.target" ];
           serviceConfig = {
             ExecStart = "${mailmanEnv}/bin/mailman start";
@@ -609,8 +609,8 @@ in
             "hyperkitty.service"
           ];
           path = with pkgs; [ jq ];
-          after = lib.optional withPostgresql "postgresql.service";
-          requires = lib.optional withPostgresql "postgresql.service";
+          after = lib.optional withPostgresql "postgresql.target";
+          requires = lib.optional withPostgresql "postgresql.target";
           serviceConfig.RemainAfterExit = true;
           serviceConfig.Type = "oneshot";
           script = ''
@@ -709,11 +709,11 @@ in
           in
           {
             wantedBy = [ "multi-user.target" ];
-            after = lib.optional withPostgresql "postgresql.service";
+            after = lib.optional withPostgresql "postgresql.target";
             requires = [
               "mailman-uwsgi.socket"
               "mailman-web-setup.service"
-            ] ++ lib.optional withPostgresql "postgresql.service";
+            ] ++ lib.optional withPostgresql "postgresql.target";
             restartTriggers = [ config.environment.etc."mailman3/settings.py".source ];
             serviceConfig = {
               # Since the mailman-web settings.py obstinately creates a logs
diff --git a/nixos/modules/services/mail/postfixadmin.nix b/nixos/modules/services/mail/postfixadmin.nix
index 0f453d24e52f..bb3a6c81658d 100644
--- a/nixos/modules/services/mail/postfixadmin.nix
+++ b/nixos/modules/services/mail/postfixadmin.nix
@@ -148,8 +148,8 @@ in
     # objects owners and extensions; for now we tack on what's needed
     # here.
     systemd.services.postfixadmin-postgres = lib.mkIf localDB {
-      after = [ "postgresql.service" ];
-      bindsTo = [ "postgresql.service" ];
+      after = [ "postgresql.target" ];
+      bindsTo = [ "postgresql.target" ];
       wantedBy = [ "multi-user.target" ];
       path = [
         pgsql.package
diff --git a/nixos/modules/services/mail/roundcube.nix b/nixos/modules/services/mail/roundcube.nix
index c31c4b069928..15a114a7354e 100644
--- a/nixos/modules/services/mail/roundcube.nix
+++ b/nixos/modules/services/mail/roundcube.nix
@@ -273,8 +273,8 @@ in
 
     systemd.services.roundcube-setup = lib.mkMerge [
       (lib.mkIf localDB {
-        requires = [ "postgresql.service" ];
-        after = [ "postgresql.service" ];
+        requires = [ "postgresql.target" ];
+        after = [ "postgresql.target" ];
       })
       {
         wants = [ "network-online.target" ];
diff --git a/nixos/modules/services/matrix/appservice-irc.nix b/nixos/modules/services/matrix/appservice-irc.nix
index 1360969203b5..1e842353e3fa 100644
--- a/nixos/modules/services/matrix/appservice-irc.nix
+++ b/nixos/modules/services/matrix/appservice-irc.nix
@@ -196,7 +196,7 @@ in
       description = "Matrix-IRC bridge";
       before = [ "matrix-synapse.service" ]; # So the registration can be used by Synapse
       after = lib.optionals (cfg.settings.database.engine == "postgres") [
-        "postgresql.service"
+        "postgresql.target"
       ];
       wantedBy = [ "multi-user.target" ];
 
diff --git a/nixos/modules/services/matrix/maubot.nix b/nixos/modules/services/matrix/maubot.nix
index 6a7f36378e3d..382c5436e07b 100644
--- a/nixos/modules/services/matrix/maubot.nix
+++ b/nixos/modules/services/matrix/maubot.nix
@@ -440,7 +440,7 @@ in
 
     systemd.services.maubot = rec {
       description = "maubot - a plugin-based Matrix bot system written in Python";
-      after = [ "network.target" ] ++ wants ++ lib.optional hasLocalPostgresDB "postgresql.service";
+      after = [ "network.target" ] ++ wants ++ lib.optional hasLocalPostgresDB "postgresql.target";
       # all plugins get automatically disabled if maubot starts before synapse
       wants = lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit;
       wantedBy = [ "multi-user.target" ];
diff --git a/nixos/modules/services/matrix/synapse-auto-compressor.nix b/nixos/modules/services/matrix/synapse-auto-compressor.nix
index ac749602af6a..54838328e80d 100644
--- a/nixos/modules/services/matrix/synapse-auto-compressor.nix
+++ b/nixos/modules/services/matrix/synapse-auto-compressor.nix
@@ -119,7 +119,7 @@ in
     systemd.services.synapse-auto-compressor = {
       description = "synapse-auto-compressor";
       requires = lib.optionals synapseUsesLocalPostgresql [
-        "postgresql.service"
+        "postgresql.target"
       ];
       inherit (cfg) startAt;
       serviceConfig = {
diff --git a/nixos/modules/services/matrix/synapse.nix b/nixos/modules/services/matrix/synapse.nix
index b13488940e81..b0859facd039 100644
--- a/nixos/modules/services/matrix/synapse.nix
+++ b/nixos/modules/services/matrix/synapse.nix
@@ -1439,7 +1439,7 @@ in
     systemd.targets.matrix-synapse = lib.mkIf hasWorkers {
       description = "Synapse Matrix parent target";
       wants = [ "network-online.target" ];
-      after = [ "network-online.target" ] ++ optional hasLocalPostgresDB "postgresql.service";
+      after = [ "network-online.target" ] ++ optional hasLocalPostgresDB "postgresql.target";
       wantedBy = [ "multi-user.target" ];
     };
 
@@ -1451,13 +1451,13 @@ in
               partOf = [ "matrix-synapse.target" ];
               wantedBy = [ "matrix-synapse.target" ];
               unitConfig.ReloadPropagatedFrom = "matrix-synapse.target";
-              requires = optional hasLocalPostgresDB "postgresql.service";
+              requires = optional hasLocalPostgresDB "postgresql.target";
             }
           else
             {
               wants = [ "network-online.target" ];
-              after = [ "network-online.target" ] ++ optional hasLocalPostgresDB "postgresql.service";
-              requires = optional hasLocalPostgresDB "postgresql.service";
+              after = [ "network-online.target" ] ++ optional hasLocalPostgresDB "postgresql.target";
+              requires = optional hasLocalPostgresDB "postgresql.target";
               wantedBy = [ "multi-user.target" ];
             };
         baseServiceConfig = {
diff --git a/nixos/modules/services/misc/atuin.nix b/nixos/modules/services/misc/atuin.nix
index e7a793fe834b..0ac8850c644d 100644
--- a/nixos/modules/services/misc/atuin.nix
+++ b/nixos/modules/services/misc/atuin.nix
@@ -92,13 +92,13 @@ in
 
     systemd.services.atuin = {
       description = "atuin server";
-      requires = lib.optionals cfg.database.createLocally [ "postgresql.service" ];
+      requires = lib.optionals cfg.database.createLocally [ "postgresql.target" ];
       after = [
         "network-online.target"
-      ] ++ lib.optionals cfg.database.createLocally [ "postgresql.service" ];
+      ] ++ lib.optionals cfg.database.createLocally [ "postgresql.target" ];
       wants = [
         "network-online.target"
-      ] ++ lib.optionals cfg.database.createLocally [ "postgresql.service" ];
+      ] ++ lib.optionals cfg.database.createLocally [ "postgresql.target" ];
       wantedBy = [ "multi-user.target" ];
 
       serviceConfig = {
diff --git a/nixos/modules/services/misc/disnix.nix b/nixos/modules/services/misc/disnix.nix
index 8c808d5143e0..1a71c171be87 100644
--- a/nixos/modules/services/misc/disnix.nix
+++ b/nixos/modules/services/misc/disnix.nix
@@ -77,7 +77,7 @@ in
           [ "dbus.service" ]
           ++ lib.optional config.services.httpd.enable "httpd.service"
           ++ lib.optional config.services.mysql.enable "mysql.service"
-          ++ lib.optional config.services.postgresql.enable "postgresql.service"
+          ++ lib.optional config.services.postgresql.enable "postgresql.target"
           ++ lib.optional config.services.tomcat.enable "tomcat.service"
           ++ lib.optional config.services.svnserve.enable "svnserve.service"
           ++ lib.optional config.services.mongodb.enable "mongodb.service"
diff --git a/nixos/modules/services/misc/forgejo.nix b/nixos/modules/services/misc/forgejo.nix
index 7da42084550d..9f2245e4f10b 100644
--- a/nixos/modules/services/misc/forgejo.nix
+++ b/nixos/modules/services/misc/forgejo.nix
@@ -663,7 +663,7 @@ in
           "network.target"
         ]
         ++ optionals usePostgresql [
-          "postgresql.service"
+          "postgresql.target"
         ]
         ++ optionals useMysql [
           "mysql.service"
@@ -673,7 +673,7 @@ in
         ];
       requires =
         optionals (cfg.database.createDatabase && usePostgresql) [
-          "postgresql.service"
+          "postgresql.target"
         ]
         ++ optionals (cfg.database.createDatabase && useMysql) [
           "mysql.service"
diff --git a/nixos/modules/services/misc/gammu-smsd.nix b/nixos/modules/services/misc/gammu-smsd.nix
index ea237e78d99f..85f3d2fa94a9 100644
--- a/nixos/modules/services/misc/gammu-smsd.nix
+++ b/nixos/modules/services/misc/gammu-smsd.nix
@@ -238,7 +238,7 @@ in
 
       wants =
         with cfg.backend;
-        [ ] ++ lib.optionals (service == "sql" && sql.driver == "native_pgsql") [ "postgresql.service" ];
+        [ ] ++ lib.optionals (service == "sql" && sql.driver == "native_pgsql") [ "postgresql.target" ];
 
       preStart =
         with cfg.backend;
diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix
index 3293094f994f..2034547db67e 100644
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@@ -758,10 +758,10 @@ in
       description = "gitea";
       after =
         [ "network.target" ]
-        ++ optional usePostgresql "postgresql.service"
+        ++ optional usePostgresql "postgresql.target"
         ++ optional useMysql "mysql.service";
       requires =
-        optional (cfg.database.createDatabase && usePostgresql) "postgresql.service"
+        optional (cfg.database.createDatabase && usePostgresql) "postgresql.target"
         ++ optional (cfg.database.createDatabase && useMysql) "mysql.service";
       wantedBy = [ "multi-user.target" ];
       path = [
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index 09dafdda600a..dcd39b27710f 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -1295,8 +1295,8 @@ in
         pgsql = config.services.postgresql;
       in
       mkIf databaseActuallyCreateLocally {
-        after = [ "postgresql.service" ];
-        bindsTo = [ "postgresql.service" ];
+        after = [ "postgresql.target" ];
+        bindsTo = [ "postgresql.target" ];
         wantedBy = [ "gitlab.target" ];
         partOf = [ "gitlab.target" ];
         path = [
@@ -1561,12 +1561,12 @@ in
     systemd.services.gitlab-db-config = {
       after = [
         "gitlab-config.service"
-        "gitlab-postgresql.service"
-        "postgresql.service"
+        "gitlab-postgresql.target"
+        "postgresql.target"
       ];
       wants =
-        optional (cfg.databaseHost == "") "postgresql.service"
-        ++ optional databaseActuallyCreateLocally "gitlab-postgresql.service";
+        optional (cfg.databaseHost == "") "postgresql.target"
+        ++ optional databaseActuallyCreateLocally "gitlab-postgresql.target";
       bindsTo = [ "gitlab-config.service" ];
       wantedBy = [ "gitlab.target" ];
       partOf = [ "gitlab.target" ];
@@ -1596,7 +1596,7 @@ in
       after = [
         "network.target"
         "redis-gitlab.service"
-        "postgresql.service"
+        "postgresql.target"
         "gitlab-config.service"
         "gitlab-db-config.service"
       ];
@@ -1604,7 +1604,7 @@ in
         "gitlab-config.service"
         "gitlab-db-config.service"
       ];
-      wants = [ "redis-gitlab.service" ] ++ optional (cfg.databaseHost == "") "postgresql.service";
+      wants = [ "redis-gitlab.service" ] ++ optional (cfg.databaseHost == "") "postgresql.target";
       wantedBy = [ "gitlab.target" ];
       partOf = [ "gitlab.target" ];
       environment =
@@ -1847,7 +1847,7 @@ in
         "gitlab-config.service"
         "gitlab-db-config.service"
       ];
-      wants = [ "redis-gitlab.service" ] ++ optional (cfg.databaseHost == "") "postgresql.service";
+      wants = [ "redis-gitlab.service" ] ++ optional (cfg.databaseHost == "") "postgresql.target";
       requiredBy = [ "gitlab.target" ];
       partOf = [ "gitlab.target" ];
       environment = gitlabEnv;
diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix
index c66a6df50721..fc7563e91814 100644
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@@ -491,18 +491,18 @@ in
               fi
             fi
           '';
-          requires = lib.optional cfg.database.createLocally "postgresql.service";
+          requires = lib.optional cfg.database.createLocally "postgresql.target";
           after =
             lib.optional enableRedis "redis-paperless.service"
-            ++ lib.optional cfg.database.createLocally "postgresql.service";
+            ++ lib.optional cfg.database.createLocally "postgresql.target";
         };
 
         systemd.services.paperless-task-queue = {
           description = "Paperless Celery Workers";
-          requires = lib.optional cfg.database.createLocally "postgresql.service";
+          requires = lib.optional cfg.database.createLocally "postgresql.target";
           after = [
             "paperless-scheduler.service"
-          ] ++ lib.optional cfg.database.createLocally "postgresql.service";
+          ] ++ lib.optional cfg.database.createLocally "postgresql.target";
           serviceConfig = defaultServiceConfig // {
             User = cfg.user;
             ExecStart = "${cfg.package}/bin/celery --app paperless worker --loglevel INFO";
@@ -520,10 +520,10 @@ in
           # Bind to `paperless-scheduler` so that the consumer never runs
           # during migrations
           bindsTo = [ "paperless-scheduler.service" ];
-          requires = lib.optional cfg.database.createLocally "postgresql.service";
+          requires = lib.optional cfg.database.createLocally "postgresql.target";
           after = [
             "paperless-scheduler.service"
-          ] ++ lib.optional cfg.database.createLocally "postgresql.service";
+          ] ++ lib.optional cfg.database.createLocally "postgresql.target";
           serviceConfig = defaultServiceConfig // {
             User = cfg.user;
             ExecStart = "${cfg.package}/bin/paperless-ngx document_consumer";
@@ -541,10 +541,10 @@ in
           # Bind to `paperless-scheduler` so that the web server never runs
           # during migrations
           bindsTo = [ "paperless-scheduler.service" ];
-          requires = lib.optional cfg.database.createLocally "postgresql.service";
+          requires = lib.optional cfg.database.createLocally "postgresql.target";
           after = [
             "paperless-scheduler.service"
-          ] ++ lib.optional cfg.database.createLocally "postgresql.service";
+          ] ++ lib.optional cfg.database.createLocally "postgresql.target";
           # Setup PAPERLESS_SECRET_KEY.
           # If this environment variable is left unset, paperless-ngx defaults
           # to a well-known value, which is insecure.
diff --git a/nixos/modules/services/misc/redmine.nix b/nixos/modules/services/misc/redmine.nix
index 1fe448d3b3ca..7a736d3caa7b 100644
--- a/nixos/modules/services/misc/redmine.nix
+++ b/nixos/modules/services/misc/redmine.nix
@@ -374,7 +374,7 @@ in
       after =
         [ "network.target" ]
         ++ lib.optional mysqlLocal "mysql.service"
-        ++ lib.optional pgsqlLocal "postgresql.service";
+        ++ lib.optional pgsqlLocal "postgresql.target";
       wantedBy = [ "multi-user.target" ];
       environment.RAILS_ENV = "production";
       environment.RAILS_CACHE = "${cfg.stateDir}/cache";
diff --git a/nixos/modules/services/misc/sourcehut/service.nix b/nixos/modules/services/misc/sourcehut/service.nix
index dce07c6d1182..65df1a05b86e 100644
--- a/nixos/modules/services/misc/sourcehut/service.nix
+++ b/nixos/modules/services/misc/sourcehut/service.nix
@@ -52,10 +52,10 @@ let
       {
         after =
           [ "network.target" ]
-          ++ optional cfg.postgresql.enable "postgresql.service"
+          ++ optional cfg.postgresql.enable "postgresql.target"
           ++ optional cfg.redis.enable "redis-sourcehut-${srvsrht}.service";
         requires =
-          optional cfg.postgresql.enable "postgresql.service"
+          optional cfg.postgresql.enable "postgresql.target"
           ++ optional cfg.redis.enable "redis-sourcehut-${srvsrht}.service";
         path = [ pkgs.gawk ];
         environment.HOME = runDir;
@@ -482,11 +482,9 @@ in
             && lib.strings.versionAtLeast config.services.postgresql.package.version "15.0"
           )
           {
-            postgresql.postStart = (
-              lib.mkAfter ''
-                $PSQL -tAc 'ALTER DATABASE "${srvCfg.postgresql.database}" OWNER TO "${srvCfg.user}";'
-              ''
-            );
+            postgresql-setup.postStart = ''
+              psql -tAc 'ALTER DATABASE "${srvCfg.postgresql.database}" OWNER TO "${srvCfg.user}";'
+            '';
           }
         )
       ];
diff --git a/nixos/modules/services/monitoring/grafana.nix b/nixos/modules/services/monitoring/grafana.nix
index a4156137e3f9..eccd7ef05fa7 100644
--- a/nixos/modules/services/monitoring/grafana.nix
+++ b/nixos/modules/services/monitoring/grafana.nix
@@ -2020,7 +2020,7 @@ in
       wantedBy = [ "multi-user.target" ];
       after =
         [ "networking.target" ]
-        ++ lib.optional usePostgresql "postgresql.service"
+        ++ lib.optional usePostgresql "postgresql.target"
         ++ lib.optional useMysql "mysql.service";
       script = ''
         set -o errexit -o pipefail -o nounset -o errtrace
diff --git a/nixos/modules/services/monitoring/zabbix-proxy.nix b/nixos/modules/services/monitoring/zabbix-proxy.nix
index db9d9376aa4d..29578cfb14ee 100644
--- a/nixos/modules/services/monitoring/zabbix-proxy.nix
+++ b/nixos/modules/services/monitoring/zabbix-proxy.nix
@@ -337,7 +337,7 @@ in
       description = "Zabbix Proxy";
 
       wantedBy = [ "multi-user.target" ];
-      after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.service";
+      after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.target";
 
       path = [ "/run/wrappers" ] ++ cfg.extraPackages;
       preStart =
diff --git a/nixos/modules/services/monitoring/zabbix-server.nix b/nixos/modules/services/monitoring/zabbix-server.nix
index 7a65ac96a994..f3606f1c2835 100644
--- a/nixos/modules/services/monitoring/zabbix-server.nix
+++ b/nixos/modules/services/monitoring/zabbix-server.nix
@@ -328,7 +328,7 @@ in
       description = "Zabbix Server";
 
       wantedBy = [ "multi-user.target" ];
-      after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.service";
+      after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.target";
 
       path = [ "/run/wrappers" ] ++ cfg.extraPackages;
       preStart =
@@ -374,7 +374,7 @@ in
 
     systemd.services.httpd.after =
       optional (config.services.zabbixWeb.enable && mysqlLocal) "mysql.service"
-      ++ optional (config.services.zabbixWeb.enable && pgsqlLocal) "postgresql.service";
+      ++ optional (config.services.zabbixWeb.enable && pgsqlLocal) "postgresql.target";
 
   };
 
diff --git a/nixos/modules/services/networking/atticd.nix b/nixos/modules/services/networking/atticd.nix
index 39aef744bd7f..9eada4062c83 100644
--- a/nixos/modules/services/networking/atticd.nix
+++ b/nixos/modules/services/networking/atticd.nix
@@ -169,8 +169,8 @@ in
 
     systemd.services.atticd = {
       wantedBy = [ "multi-user.target" ];
-      after = [ "network-online.target" ] ++ lib.optionals hasLocalPostgresDB [ "postgresql.service" ];
-      requires = lib.optionals hasLocalPostgresDB [ "postgresql.service" ];
+      after = [ "network-online.target" ] ++ lib.optionals hasLocalPostgresDB [ "postgresql.target" ];
+      requires = lib.optionals hasLocalPostgresDB [ "postgresql.target" ];
       wants = [ "network-online.target" ];
 
       serviceConfig = {
diff --git a/nixos/modules/services/networking/firezone/server.nix b/nixos/modules/services/networking/firezone/server.nix
index 04ffa1b7d64c..f79e162cf179 100644
--- a/nixos/modules/services/networking/firezone/server.nix
+++ b/nixos/modules/services/networking/firezone/server.nix
@@ -1105,8 +1105,8 @@ in
       systemd.services.firezone-initialize = {
         description = "Backend initialization service for the Firezone zero-trust access platform";
 
-        after = mkIf cfg.enableLocalDB [ "postgresql.service" ];
-        requires = mkIf cfg.enableLocalDB [ "postgresql.service" ];
+        after = mkIf cfg.enableLocalDB [ "postgresql.target" ];
+        requires = mkIf cfg.enableLocalDB [ "postgresql.target" ];
         wantedBy = [ "firezone.target" ];
         partOf = [ "firezone.target" ];
 
diff --git a/nixos/modules/services/networking/pleroma.nix b/nixos/modules/services/networking/pleroma.nix
index 01baa58879da..df8834925101 100644
--- a/nixos/modules/services/networking/pleroma.nix
+++ b/nixos/modules/services/networking/pleroma.nix
@@ -122,7 +122,7 @@ in
           wants = [ "network-online.target" ];
           after = [
             "network-online.target"
-            "postgresql.service"
+            "postgresql.target"
           ];
           wantedBy = [ "pleroma.service" ];
           environment.RELEASE_COOKIE = "/var/lib/pleroma/.cookie";
diff --git a/nixos/modules/services/networking/powerdns.nix b/nixos/modules/services/networking/powerdns.nix
index ed4ec232b8d1..0df9b1f38f6d 100644
--- a/nixos/modules/services/networking/powerdns.nix
+++ b/nixos/modules/services/networking/powerdns.nix
@@ -53,7 +53,7 @@ in
       after = [
         "network.target"
         "mysql.service"
-        "postgresql.service"
+        "postgresql.target"
         "openldap.service"
       ];
 
diff --git a/nixos/modules/services/networking/quassel.nix b/nixos/modules/services/networking/quassel.nix
index d699c9b6f155..dc43ef3f60ef 100644
--- a/nixos/modules/services/networking/quassel.nix
+++ b/nixos/modules/services/networking/quassel.nix
@@ -120,7 +120,7 @@ in
       wantedBy = [ "multi-user.target" ];
       after =
         [ "network.target" ]
-        ++ optional config.services.postgresql.enable "postgresql.service"
+        ++ optional config.services.postgresql.enable "postgresql.target"
         ++ optional config.services.mysql.enable "mysql.service";
 
       serviceConfig = {
diff --git a/nixos/modules/services/security/canaille.nix b/nixos/modules/services/security/canaille.nix
index 4489b5f71c1e..43c75fee2f1a 100644
--- a/nixos/modules/services/security/canaille.nix
+++ b/nixos/modules/services/security/canaille.nix
@@ -283,7 +283,7 @@ in
     systemd.services.canaille-install = {
       # We want this on boot, not on socket activation
       wantedBy = [ "multi-user.target" ];
-      after = optional createLocalPostgresqlDb "postgresql.service";
+      after = optional createLocalPostgresqlDb "postgresql.target";
       serviceConfig = commonServiceConfig // {
         Type = "oneshot";
         ExecStart = "${getExe finalPackage} install";
@@ -296,7 +296,7 @@ in
       after = [
         "network.target"
         "canaille-install.service"
-      ] ++ optional createLocalPostgresqlDb "postgresql.service";
+      ] ++ optional createLocalPostgresqlDb "postgresql.target";
       requires = [
         "canaille-install.service"
         "canaille.socket"
diff --git a/nixos/modules/services/torrent/bitmagnet.nix b/nixos/modules/services/torrent/bitmagnet.nix
index c0929b69f451..9387a6360392 100644
--- a/nixos/modules/services/torrent/bitmagnet.nix
+++ b/nixos/modules/services/torrent/bitmagnet.nix
@@ -127,8 +127,8 @@ in
       wantedBy = [ "multi-user.target" ];
       after = [
         "network.target"
-      ] ++ optional cfg.useLocalPostgresDB "postgresql.service";
-      requires = optional cfg.useLocalPostgresDB "postgresql.service";
+      ] ++ optional cfg.useLocalPostgresDB "postgresql.target";
+      requires = optional cfg.useLocalPostgresDB "postgresql.target";
       serviceConfig = {
         Type = "simple";
         DynamicUser = true;
diff --git a/nixos/modules/services/web-apps/akkoma.nix b/nixos/modules/services/web-apps/akkoma.nix
index 61aba30fcc80..f88e8db6fa5b 100644
--- a/nixos/modules/services/web-apps/akkoma.nix
+++ b/nixos/modules/services/web-apps/akkoma.nix
@@ -1231,7 +1231,7 @@ in
       requiredBy = [ "akkoma.service" ];
       after = [
         "akkoma-config.service"
-        "postgresql.service"
+        "postgresql.target"
       ];
       before = [ "akkoma.service" ];
 
@@ -1269,7 +1269,7 @@ in
           "akkoma-config.target"
           "network.target"
           "network-online.target"
-          "postgresql.service"
+          "postgresql.target"
         ];
 
         confinement.packages = mkIf isConfined runtimeInputs;
diff --git a/nixos/modules/services/web-apps/crabfit.nix b/nixos/modules/services/web-apps/crabfit.nix
index d58027a6965d..d86708f03710 100644
--- a/nixos/modules/services/web-apps/crabfit.nix
+++ b/nixos/modules/services/web-apps/crabfit.nix
@@ -109,7 +109,7 @@ in
         description = "The API for Crab Fit.";
 
         wantedBy = [ "multi-user.target" ];
-        after = [ "postgresql.service" ];
+        after = [ "postgresql.target" ];
 
         serviceConfig = {
           # TODO: harden
diff --git a/nixos/modules/services/web-apps/davis.nix b/nixos/modules/services/web-apps/davis.nix
index ad724dc1d1a2..e75752d2e00e 100644
--- a/nixos/modules/services/web-apps/davis.nix
+++ b/nixos/modules/services/web-apps/davis.nix
@@ -444,11 +444,11 @@ in
         before = [ "phpfpm-davis.service" ];
         after =
           lib.optional mysqlLocal "mysql.service"
-          ++ lib.optional pgsqlLocal "postgresql.service"
+          ++ lib.optional pgsqlLocal "postgresql.target"
           ++ [ "davis-env-setup.service" ];
         requires =
           lib.optional mysqlLocal "mysql.service"
-          ++ lib.optional pgsqlLocal "postgresql.service"
+          ++ lib.optional pgsqlLocal "postgresql.target"
           ++ [ "davis-env-setup.service" ];
         wantedBy = [ "multi-user.target" ];
         serviceConfig = defaultServiceConfig // {
@@ -483,7 +483,7 @@ in
           "davis-db-migrate.service"
         ]
         ++ lib.optional mysqlLocal "mysql.service"
-        ++ lib.optional pgsqlLocal "postgresql.service";
+        ++ lib.optional pgsqlLocal "postgresql.target";
       systemd.services.phpfpm-davis.serviceConfig.ReadWritePaths = [ cfg.dataDir ];
 
       services.nginx = lib.mkIf (cfg.nginx != null) {
diff --git a/nixos/modules/services/web-apps/dependency-track.nix b/nixos/modules/services/web-apps/dependency-track.nix
index 32f25e81f242..52504714e095 100644
--- a/nixos/modules/services/web-apps/dependency-track.nix
+++ b/nixos/modules/services/web-apps/dependency-track.nix
@@ -535,9 +535,9 @@ in
     };
 
     systemd.services.dependency-track-postgresql-init = lib.mkIf cfg.database.createLocally {
-      after = [ "postgresql.service" ];
+      after = [ "postgresql.target" ];
       before = [ "dependency-track.service" ];
-      bindsTo = [ "postgresql.service" ];
+      bindsTo = [ "postgresql.target" ];
       path = [ config.services.postgresql.package ];
       serviceConfig = {
         Type = "oneshot";
@@ -572,7 +572,7 @@ in
           if cfg.database.createLocally then
             [
               "dependency-track-postgresql-init.service"
-              "postgresql.service"
+              "postgresql.target"
             ]
           else
             [ ];
diff --git a/nixos/modules/services/web-apps/dex.nix b/nixos/modules/services/web-apps/dex.nix
index 392a2f5b16b5..38367f01e5d9 100644
--- a/nixos/modules/services/web-apps/dex.nix
+++ b/nixos/modules/services/web-apps/dex.nix
@@ -100,7 +100,7 @@ in
       wantedBy = [ "multi-user.target" ];
       after = [
         "networking.target"
-      ] ++ (optional (cfg.settings.storage.type == "postgres") "postgresql.service");
+      ] ++ (optional (cfg.settings.storage.type == "postgres") "postgresql.target");
       path = with pkgs; [ replace-secret ];
       restartTriggers = restartTriggers;
       serviceConfig =
diff --git a/nixos/modules/services/web-apps/discourse.nix b/nixos/modules/services/web-apps/discourse.nix
index b454ed97744f..ffb34abab7d1 100644
--- a/nixos/modules/services/web-apps/discourse.nix
+++ b/nixos/modules/services/web-apps/discourse.nix
@@ -705,8 +705,8 @@ in
         pgsql = config.services.postgresql;
       in
       lib.mkIf databaseActuallyCreateLocally {
-        after = [ "postgresql.service" ];
-        bindsTo = [ "postgresql.service" ];
+        after = [ "postgresql.target" ];
+        bindsTo = [ "postgresql.target" ];
         wantedBy = [ "discourse.service" ];
         partOf = [ "discourse.service" ];
         path = [
@@ -732,16 +732,16 @@ in
       wantedBy = [ "multi-user.target" ];
       after = [
         "redis-discourse.service"
-        "postgresql.service"
-        "discourse-postgresql.service"
+        "postgresql.target"
+        "discourse-postgresql.target"
       ];
       bindsTo =
         [
           "redis-discourse.service"
         ]
         ++ lib.optionals (cfg.database.host == null) [
-          "postgresql.service"
-          "discourse-postgresql.service"
+          "postgresql.target"
+          "discourse-postgresql.target"
         ];
       path = cfg.package.runtimeDeps ++ [
         postgresqlPackage
diff --git a/nixos/modules/services/web-apps/fider.nix b/nixos/modules/services/web-apps/fider.nix
index c716fb7bfd4e..51bd69deba36 100644
--- a/nixos/modules/services/web-apps/fider.nix
+++ b/nixos/modules/services/web-apps/fider.nix
@@ -87,8 +87,8 @@ in
       wantedBy = [ "multi-user.target" ];
       after = [
         "network.target"
-      ] ++ lib.optionals (cfg.database.url == "local") [ "postgresql.service" ];
-      requires = lib.optionals (cfg.database.url == "local") [ "postgresql.service" ];
+      ] ++ lib.optionals (cfg.database.url == "local") [ "postgresql.target" ];
+      requires = lib.optionals (cfg.database.url == "local") [ "postgresql.target" ];
       environment =
         let
           localPostgresqlUrl = "postgres:///fider?host=/run/postgresql";
diff --git a/nixos/modules/services/web-apps/filesender.nix b/nixos/modules/services/web-apps/filesender.nix
index bc8d465643f2..a1c4c7b0846f 100644
--- a/nixos/modules/services/web-apps/filesender.nix
+++ b/nixos/modules/services/web-apps/filesender.nix
@@ -227,7 +227,7 @@ in
         "multi-user.target"
         "phpfpm-filesender.service"
       ];
-      after = [ "postgresql.service" ];
+      after = [ "postgresql.target" ];
 
       restartIfChanged = true;
 
diff --git a/nixos/modules/services/web-apps/firefly-iii.nix b/nixos/modules/services/web-apps/firefly-iii.nix
index 436e1228e6fc..732095c22277 100644
--- a/nixos/modules/services/web-apps/firefly-iii.nix
+++ b/nixos/modules/services/web-apps/firefly-iii.nix
@@ -308,7 +308,7 @@ in
 
     systemd.services.firefly-iii-setup = {
       after = [
-        "postgresql.service"
+        "postgresql.target"
         "mysql.service"
       ];
       requiredBy = [ "phpfpm-firefly-iii.service" ];
@@ -325,7 +325,7 @@ in
     systemd.services.firefly-iii-cron = {
       after = [
         "firefly-iii-setup.service"
-        "postgresql.service"
+        "postgresql.target"
         "mysql.service"
       ];
       wants = [ "firefly-iii-setup.service" ];
diff --git a/nixos/modules/services/web-apps/froide-govplan.nix b/nixos/modules/services/web-apps/froide-govplan.nix
index e5c7c0b19676..85294f10ea88 100644
--- a/nixos/modules/services/web-apps/froide-govplan.nix
+++ b/nixos/modules/services/web-apps/froide-govplan.nix
@@ -163,9 +163,9 @@ in
     systemd = {
       services = {
 
-        postgresql.serviceConfig.ExecStartPost =
+        postgresql-setup.serviceConfig.ExecStartPost =
           let
-            sqlFile = pkgs.writeText "immich-pgvectors-setup.sql" ''
+            sqlFile = pkgs.writeText "froide-govplan-postgis-setup.sql" ''
               CREATE EXTENSION IF NOT EXISTS postgis;
             '';
           in
@@ -184,7 +184,7 @@ in
             Group = "govplan";
           };
           after = [
-            "postgresql.service"
+            "postgresql.target"
             "network.target"
             "systemd-tmpfiles-setup.service"
           ];
diff --git a/nixos/modules/services/web-apps/gancio.nix b/nixos/modules/services/web-apps/gancio.nix
index aec066112132..6e6cd3bfba37 100644
--- a/nixos/modules/services/web-apps/gancio.nix
+++ b/nixos/modules/services/web-apps/gancio.nix
@@ -211,7 +211,7 @@ in
         wantedBy = [ "multi-user.target" ];
         after = [
           "network.target"
-        ] ++ optional (cfg.settings.db.dialect == "postgres") "postgresql.service";
+        ] ++ optional (cfg.settings.db.dialect == "postgres") "postgresql.target";
 
         environment = {
           NODE_ENV = "production";
diff --git a/nixos/modules/services/web-apps/glitchtip.nix b/nixos/modules/services/web-apps/glitchtip.nix
index 18fb21510c3a..ecf762c8c29c 100644
--- a/nixos/modules/services/web-apps/glitchtip.nix
+++ b/nixos/modules/services/web-apps/glitchtip.nix
@@ -171,11 +171,11 @@ in
 
           wants = [ "network-online.target" ];
           requires =
-            lib.optional cfg.database.createLocally "postgresql.service"
+            lib.optional cfg.database.createLocally "postgresql.target"
             ++ lib.optional cfg.redis.createLocally "redis-glitchtip.service";
           after =
             [ "network-online.target" ]
-            ++ lib.optional cfg.database.createLocally "postgresql.service"
+            ++ lib.optional cfg.database.createLocally "postgresql.target"
             ++ lib.optional cfg.redis.createLocally "redis-glitchtip.service";
 
           inherit environment;
diff --git a/nixos/modules/services/web-apps/gotosocial.nix b/nixos/modules/services/web-apps/gotosocial.nix
index b1e9a46a601c..2555b12a84dd 100644
--- a/nixos/modules/services/web-apps/gotosocial.nix
+++ b/nixos/modules/services/web-apps/gotosocial.nix
@@ -144,8 +144,8 @@ in
     systemd.services.gotosocial = {
       description = "ActivityPub social network server";
       wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ] ++ lib.optional cfg.setupPostgresqlDB "postgresql.service";
-      requires = lib.optional cfg.setupPostgresqlDB "postgresql.service";
+      after = [ "network.target" ] ++ lib.optional cfg.setupPostgresqlDB "postgresql.target";
+      requires = lib.optional cfg.setupPostgresqlDB "postgresql.target";
       restartTriggers = [ configFile ];
 
       serviceConfig = {
diff --git a/nixos/modules/services/web-apps/homebox.nix b/nixos/modules/services/web-apps/homebox.nix
index 132cc874d5c1..8a45616b8c1f 100644
--- a/nixos/modules/services/web-apps/homebox.nix
+++ b/nixos/modules/services/web-apps/homebox.nix
@@ -81,8 +81,8 @@ in
       ];
     };
     systemd.services.homebox = {
-      requires = lib.optional cfg.database.createLocally "postgresql.service";
-      after = lib.optional cfg.database.createLocally "postgresql.service";
+      requires = lib.optional cfg.database.createLocally "postgresql.target";
+      after = lib.optional cfg.database.createLocally "postgresql.target";
       environment = cfg.settings;
       serviceConfig = {
         User = "homebox";
diff --git a/nixos/modules/services/web-apps/immich.nix b/nixos/modules/services/web-apps/immich.nix
index 86b29e657cd6..a31a2eeef048 100644
--- a/nixos/modules/services/web-apps/immich.nix
+++ b/nixos/modules/services/web-apps/immich.nix
@@ -254,7 +254,7 @@ in
         search_path = "\"$user\", public, vectors";
       };
     };
-    systemd.services.postgresql.serviceConfig.ExecStartPost =
+    systemd.services.postgresql-setup.serviceConfig.ExecStartPost =
       let
         sqlFile = pkgs.writeText "immich-pgvectors-setup.sql" ''
           CREATE EXTENSION IF NOT EXISTS unaccent;
diff --git a/nixos/modules/services/web-apps/invidious.nix b/nixos/modules/services/web-apps/invidious.nix
index 64bd8751bb3d..89795c72ee84 100644
--- a/nixos/modules/services/web-apps/invidious.nix
+++ b/nixos/modules/services/web-apps/invidious.nix
@@ -19,8 +19,8 @@ let
   commonInvidousServiceConfig = {
     description = "Invidious (An alternative YouTube front-end)";
     wants = [ "network-online.target" ];
-    after = [ "network-online.target" ] ++ lib.optional cfg.database.createLocally "postgresql.service";
-    requires = lib.optional cfg.database.createLocally "postgresql.service";
+    after = [ "network-online.target" ] ++ lib.optional cfg.database.createLocally "postgresql.target";
+    requires = lib.optional cfg.database.createLocally "postgresql.target";
     wantedBy = [ "multi-user.target" ];
 
     serviceConfig = {
diff --git a/nixos/modules/services/web-apps/keycloak.nix b/nixos/modules/services/web-apps/keycloak.nix
index a97f3037e0f0..fa7d0970707e 100644
--- a/nixos/modules/services/web-apps/keycloak.nix
+++ b/nixos/modules/services/web-apps/keycloak.nix
@@ -602,9 +602,9 @@ in
         ];
 
       systemd.services.keycloakPostgreSQLInit = mkIf createLocalPostgreSQL {
-        after = [ "postgresql.service" ];
+        after = [ "postgresql.target" ];
         before = [ "keycloak.service" ];
-        bindsTo = [ "postgresql.service" ];
+        bindsTo = [ "postgresql.target" ];
         path = [ config.services.postgresql.package ];
         serviceConfig = {
           Type = "oneshot";
@@ -690,7 +690,7 @@ in
             if createLocalPostgreSQL then
               [
                 "keycloakPostgreSQLInit.service"
-                "postgresql.service"
+                "postgresql.target"
               ]
             else if createLocalMySQL then
               [
diff --git a/nixos/modules/services/web-apps/lasuite-docs.nix b/nixos/modules/services/web-apps/lasuite-docs.nix
index 26808c2e7f55..e18fcb15a0e4 100644
--- a/nixos/modules/services/web-apps/lasuite-docs.nix
+++ b/nixos/modules/services/web-apps/lasuite-docs.nix
@@ -350,10 +350,10 @@ in
       description = "Docs from SuiteNumérique";
       after =
         [ "network.target" ]
-        ++ (optional cfg.postgresql.createLocally "postgresql.service")
+        ++ (optional cfg.postgresql.createLocally "postgresql.target")
         ++ (optional cfg.redis.createLocally "redis-lasuite-docs.service");
       wants =
-        (optional cfg.postgresql.createLocally "postgresql.service")
+        (optional cfg.postgresql.createLocally "postgresql.target")
         ++ (optional cfg.redis.createLocally "redis-lasuite-docs.service");
       wantedBy = [ "multi-user.target" ];
 
@@ -398,10 +398,10 @@ in
       description = "Docs Celery broker from SuiteNumérique";
       after =
         [ "network.target" ]
-        ++ (optional cfg.postgresql.createLocally "postgresql.service")
+        ++ (optional cfg.postgresql.createLocally "postgresql.target")
         ++ (optional cfg.redis.createLocally "redis-lasuite-docs.service");
       wants =
-        (optional cfg.postgresql.createLocally "postgresql.service")
+        (optional cfg.postgresql.createLocally "postgresql.target")
         ++ (optional cfg.redis.createLocally "redis-lasuite-docs.service");
       wantedBy = [ "multi-user.target" ];
 
diff --git a/nixos/modules/services/web-apps/lemmy.nix b/nixos/modules/services/web-apps/lemmy.nix
index 02ba3acf06ca..d75ecb4fa02e 100644
--- a/nixos/modules/services/web-apps/lemmy.nix
+++ b/nixos/modules/services/web-apps/lemmy.nix
@@ -325,9 +325,9 @@ in
 
           wantedBy = [ "multi-user.target" ];
 
-          after = [ "pict-rs.service" ] ++ lib.optionals cfg.database.createLocally [ "postgresql.service" ];
+          after = [ "pict-rs.service" ] ++ lib.optionals cfg.database.createLocally [ "postgresql.target" ];
 
-          requires = lib.optionals cfg.database.createLocally [ "postgresql.service" ];
+          requires = lib.optionals cfg.database.createLocally [ "postgresql.target" ];
 
           # substitute secrets and prevent others from reading the result
           # if somehow $CREDENTIALS_DIRECTORY is not set we fail
diff --git a/nixos/modules/services/web-apps/limesurvey.nix b/nixos/modules/services/web-apps/limesurvey.nix
index c1d4d01b6a6a..b214cff212d7 100644
--- a/nixos/modules/services/web-apps/limesurvey.nix
+++ b/nixos/modules/services/web-apps/limesurvey.nix
@@ -413,7 +413,7 @@ in
     systemd.services.limesurvey-init = {
       wantedBy = [ "multi-user.target" ];
       before = [ "phpfpm-limesurvey.service" ];
-      after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.service";
+      after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.target";
       environment.DBENGINE = "${cfg.database.dbEngine}";
       environment.LIMESURVEY_CONFIG = limesurveyConfig;
       script = ''
@@ -444,7 +444,7 @@ in
 
     systemd.services.httpd.after =
       optional mysqlLocal "mysql.service"
-      ++ optional pgsqlLocal "postgresql.service";
+      ++ optional pgsqlLocal "postgresql.target";
 
     users.users.${user} = {
       group = group;
diff --git a/nixos/modules/services/web-apps/mastodon.nix b/nixos/modules/services/web-apps/mastodon.nix
index a415e8d7f771..10c988796d61 100644
--- a/nixos/modules/services/web-apps/mastodon.nix
+++ b/nixos/modules/services/web-apps/mastodon.nix
@@ -126,10 +126,10 @@ let
     SystemCallArchitectures = "native";
   };
 
-  # Services that all Mastodon units After= and Requires= on
-  commonServices =
+  # Units that all Mastodon units After= and Requires= on
+  commonUnits =
     lib.optional redisActuallyCreateLocally "redis-mastodon.service"
-    ++ lib.optional databaseActuallyCreateLocally "postgresql.service"
+    ++ lib.optional databaseActuallyCreateLocally "postgresql.target"
     ++ lib.optional cfg.automaticMigrations "mastodon-init-db.service";
 
   envFile = pkgs.writeText "mastodon.env" (
@@ -170,8 +170,8 @@ let
         after = [
           "network.target"
           "mastodon-init-dirs.service"
-        ] ++ commonServices;
-        requires = [ "mastodon-init-dirs.service" ] ++ commonServices;
+        ] ++ commonUnits;
+        requires = [ "mastodon-init-dirs.service" ] ++ commonUnits;
         description = "Mastodon sidekiq${jobClassLabel}";
         wantedBy = [ "mastodon.target" ];
         environment = env // {
@@ -209,8 +209,8 @@ let
         after = [
           "network.target"
           "mastodon-init-dirs.service"
-        ] ++ commonServices;
-        requires = [ "mastodon-init-dirs.service" ] ++ commonServices;
+        ] ++ commonUnits;
+        requires = [ "mastodon-init-dirs.service" ] ++ commonUnits;
         wantedBy = [
           "mastodon.target"
           "mastodon-streaming.target"
@@ -998,18 +998,18 @@ in
           after = [
             "network.target"
             "mastodon-init-dirs.service"
-          ] ++ lib.optional databaseActuallyCreateLocally "postgresql.service";
+          ] ++ lib.optional databaseActuallyCreateLocally "postgresql.target";
           requires = [
             "mastodon-init-dirs.service"
-          ] ++ lib.optional databaseActuallyCreateLocally "postgresql.service";
+          ] ++ lib.optional databaseActuallyCreateLocally "postgresql.target";
         };
 
         systemd.services.mastodon-web = {
           after = [
             "network.target"
             "mastodon-init-dirs.service"
-          ] ++ commonServices;
-          requires = [ "mastodon-init-dirs.service" ] ++ commonServices;
+          ] ++ commonUnits;
+          requires = [ "mastodon-init-dirs.service" ] ++ commonUnits;
           wantedBy = [ "mastodon.target" ];
           description = "Mastodon web";
           environment =
diff --git a/nixos/modules/services/web-apps/mattermost.nix b/nixos/modules/services/web-apps/mattermost.nix
index dce0774b07ee..4ff983fbe7e5 100644
--- a/nixos/modules/services/web-apps/mattermost.nix
+++ b/nixos/modules/services/web-apps/mattermost.nix
@@ -840,7 +840,7 @@ in
         wantedBy = [ "multi-user.target" ];
         after = mkMerge [
           [ "network.target" ]
-          (mkIf (cfg.database.driver == "postgres" && cfg.database.create) [ "postgresql.service" ])
+          (mkIf (cfg.database.driver == "postgres" && cfg.database.create) [ "postgresql.target" ])
           (mkIf (cfg.database.driver == "mysql" && cfg.database.create) [ "mysql.service" ])
         ];
         requires = after;
@@ -946,7 +946,7 @@ in
         ];
 
         unitConfig.JoinsNamespaceOf = mkMerge [
-          (mkIf (cfg.database.driver == "postgres" && cfg.database.create) [ "postgresql.service" ])
+          (mkIf (cfg.database.driver == "postgres" && cfg.database.create) [ "postgresql.target" ])
           (mkIf (cfg.database.driver == "mysql" && cfg.database.create) [ "mysql.service" ])
         ];
       };
diff --git a/nixos/modules/services/web-apps/mealie.nix b/nixos/modules/services/web-apps/mealie.nix
index b8f65b1fb98e..d86c99771731 100644
--- a/nixos/modules/services/web-apps/mealie.nix
+++ b/nixos/modules/services/web-apps/mealie.nix
@@ -66,8 +66,8 @@ in
     systemd.services.mealie = {
       description = "Mealie, a self hosted recipe manager and meal planner";
 
-      after = [ "network-online.target" ] ++ lib.optional cfg.database.createLocally "postgresql.service";
-      requires = lib.optional cfg.database.createLocally "postgresql.service";
+      after = [ "network-online.target" ] ++ lib.optional cfg.database.createLocally "postgresql.target";
+      requires = lib.optional cfg.database.createLocally "postgresql.target";
       wants = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
 
diff --git a/nixos/modules/services/web-apps/mediagoblin.nix b/nixos/modules/services/web-apps/mediagoblin.nix
index 6fa5fac9f5c9..081bfa763f9b 100644
--- a/nixos/modules/services/web-apps/mediagoblin.nix
+++ b/nixos/modules/services/web-apps/mediagoblin.nix
@@ -339,11 +339,11 @@ in
         mediagoblin-paster = lib.recursiveUpdate serviceDefaults {
           after = [
             "mediagoblin-celeryd.service"
-            "postgresql.service"
+            "postgresql.target"
           ];
           requires = [
             "mediagoblin-celeryd.service"
-            "postgresql.service"
+            "postgresql.target"
           ];
           preStart = ''
             cp --remove-destination ${pasteConfig} /var/lib/mediagoblin/paste.ini
diff --git a/nixos/modules/services/web-apps/mediawiki.nix b/nixos/modules/services/web-apps/mediawiki.nix
index 273c5564bdbf..1b8df02f9984 100644
--- a/nixos/modules/services/web-apps/mediawiki.nix
+++ b/nixos/modules/services/web-apps/mediawiki.nix
@@ -707,7 +707,7 @@ in
       before = [ "phpfpm-mediawiki.service" ];
       after =
         optional (cfg.database.type == "mysql" && cfg.database.createLocally) "mysql.service"
-        ++ optional (cfg.database.type == "postgres" && cfg.database.createLocally) "postgresql.service";
+        ++ optional (cfg.database.type == "postgres" && cfg.database.createLocally) "postgresql.target";
       script = ''
         if ! test -e "${stateDir}/secret.key"; then
           tr -dc A-Za-z0-9 </dev/urandom 2>/dev/null | head -c 64 > ${stateDir}/secret.key
@@ -754,7 +754,7 @@ in
       ) "mysql.service"
       ++ optional (
         cfg.webserver == "apache" && cfg.database.createLocally && cfg.database.type == "postgres"
-      ) "postgresql.service";
+      ) "postgresql.target";
 
     users.users.${user} = {
       inherit group;
diff --git a/nixos/modules/services/web-apps/miniflux.nix b/nixos/modules/services/web-apps/miniflux.nix
index 098c920ab264..6743006b0eb5 100644
--- a/nixos/modules/services/web-apps/miniflux.nix
+++ b/nixos/modules/services/web-apps/miniflux.nix
@@ -107,10 +107,10 @@ in
 
     systemd.services.miniflux-dbsetup = lib.mkIf cfg.createDatabaseLocally {
       description = "Miniflux database setup";
-      requires = [ "postgresql.service" ];
+      requires = [ "postgresql.target" ];
       after = [
         "network.target"
-        "postgresql.service"
+        "postgresql.target"
       ];
       serviceConfig = {
         Type = "oneshot";
@@ -126,7 +126,7 @@ in
       after =
         [ "network.target" ]
         ++ lib.optionals cfg.createDatabaseLocally [
-          "postgresql.service"
+          "postgresql.target"
           "miniflux-dbsetup.service"
         ];
 
diff --git a/nixos/modules/services/web-apps/misskey.nix b/nixos/modules/services/web-apps/misskey.nix
index 8a5c4bd92766..32d0b6806863 100644
--- a/nixos/modules/services/web-apps/misskey.nix
+++ b/nixos/modules/services/web-apps/misskey.nix
@@ -319,7 +319,7 @@ in
     systemd.services.misskey = {
       after = [
         "network-online.target"
-        "postgresql.service"
+        "postgresql.target"
       ];
       wants = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
diff --git a/nixos/modules/services/web-apps/mobilizon.nix b/nixos/modules/services/web-apps/mobilizon.nix
index 584f6c7a04b0..35efbeb767d6 100644
--- a/nixos/modules/services/web-apps/mobilizon.nix
+++ b/nixos/modules/services/web-apps/mobilizon.nix
@@ -366,7 +366,7 @@ in
     systemd.services.mobilizon-postgresql = mkIf isLocalPostgres {
       description = "Mobilizon PostgreSQL setup";
 
-      after = [ "postgresql.service" ];
+      after = [ "postgresql.target" ];
       before = [
         "mobilizon.service"
         "mobilizon-setup-secrets.service"
diff --git a/nixos/modules/services/web-apps/moodle.nix b/nixos/modules/services/web-apps/moodle.nix
index e49f7a89d0de..37e0d1c33af5 100644
--- a/nixos/modules/services/web-apps/moodle.nix
+++ b/nixos/modules/services/web-apps/moodle.nix
@@ -351,7 +351,7 @@ in
     systemd.services.moodle-init = {
       wantedBy = [ "multi-user.target" ];
       before = [ "phpfpm-moodle.service" ];
-      after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.service";
+      after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.target";
       environment.MOODLE_CONFIG = moodleConfig;
       script = ''
         ${phpExt}/bin/php ${cfg.package}/share/moodle/admin/cli/check_database_schema.php && rc=$? || rc=$?
@@ -394,7 +394,7 @@ in
 
     systemd.services.httpd.after =
       optional mysqlLocal "mysql.service"
-      ++ optional pgsqlLocal "postgresql.service";
+      ++ optional pgsqlLocal "postgresql.target";
 
     users.users.${user} = {
       group = group;
diff --git a/nixos/modules/services/web-apps/movim.nix b/nixos/modules/services/web-apps/movim.nix
index e9a00878606a..42d9a821c122 100644
--- a/nixos/modules/services/web-apps/movim.nix
+++ b/nixos/modules/services/web-apps/movim.nix
@@ -165,9 +165,9 @@ let
   fpm = config.services.phpfpm.pools.${pool};
   phpExecutionUnit = "phpfpm-${pool}";
 
-  dbService =
+  dbUnit =
     {
-      "postgresql" = "postgresql.service";
+      "postgresql" = "postgresql.target";
       "mariadb" = "mysql.service";
     }
     .${cfg.database.type};
@@ -843,8 +843,8 @@ in
         requiredBy = [ "${phpExecutionUnit}.service" ];
         before = [ "${phpExecutionUnit}.service" ];
         wants = [ "local-fs.target" ];
-        requires = lib.optional cfg.database.createLocally dbService;
-        after = lib.optional cfg.database.createLocally dbService;
+        requires = lib.optional cfg.database.createLocally dbUnit;
+        after = lib.optional cfg.database.createLocally dbUnit;
 
         serviceConfig =
           {
@@ -899,8 +899,8 @@ in
         requiredBy = [ "movim.service" ];
         before = [ "movim.service" ] ++ lib.optional (webServerService != null) webServerService;
         wants = [ "network.target" ];
-        requires = [ "movim-data-setup.service" ] ++ lib.optional cfg.database.createLocally dbService;
-        after = [ "movim-data-setup.service" ] ++ lib.optional cfg.database.createLocally dbService;
+        requires = [ "movim-data-setup.service" ] ++ lib.optional cfg.database.createLocally dbUnit;
+        after = [ "movim-data-setup.service" ] ++ lib.optional cfg.database.createLocally dbUnit;
       };
 
       services.movim = {
@@ -915,14 +915,14 @@ in
             "movim-data-setup.service"
             "${phpExecutionUnit}.service"
           ]
-          ++ lib.optional cfg.database.createLocally dbService
+          ++ lib.optional cfg.database.createLocally dbUnit
           ++ lib.optional (webServerService != null) webServerService;
         after =
           [
             "movim-data-setup.service"
             "${phpExecutionUnit}.service"
           ]
-          ++ lib.optional cfg.database.createLocally dbService
+          ++ lib.optional cfg.database.createLocally dbUnit
           ++ lib.optional (webServerService != null) webServerService;
         environment = {
           PUBLIC_URL = "//${cfg.domain}";
diff --git a/nixos/modules/services/web-apps/netbox.nix b/nixos/modules/services/web-apps/netbox.nix
index eefa274cc5fd..b008e46a7529 100644
--- a/nixos/modules/services/web-apps/netbox.nix
+++ b/nixos/modules/services/web-apps/netbox.nix
@@ -39,7 +39,14 @@ let
     (writeScriptBin "netbox-manage" ''
       #!${stdenv.shell}
       export PYTHONPATH=${pkg.pythonPath}
-      sudo -u netbox ${pkg}/bin/netbox "$@"
+      case "$(whoami)" in
+      "root")
+        ${util-linux}/bin/runuser -u netbox -- ${pkg}/bin/netbox "$@";;
+      "netbox")
+        ${pkg}/bin/netbox "$@";;
+      *)
+        echo "This must be run by either by root 'netbox' user"
+      esac
     '');
 
 in
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index 6e8328716d0e..9d14ffa345c6 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -1167,8 +1167,8 @@ in
             wantedBy = [ "multi-user.target" ];
             wants = [ "nextcloud-update-db.service" ];
             before = [ "phpfpm-nextcloud.service" ];
-            after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.service";
-            requires = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.service";
+            after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.target";
+            requires = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.target";
             path = [ occ ];
             restartTriggers = [ overrideConfig ];
             script = ''
diff --git a/nixos/modules/services/web-apps/nipap.nix b/nixos/modules/services/web-apps/nipap.nix
index 3a8e082ad037..8f7f9b26b835 100644
--- a/nixos/modules/services/web-apps/nipap.nix
+++ b/nixos/modules/services/web-apps/nipap.nix
@@ -234,8 +234,8 @@ in
             after = [
               "network.target"
               "systemd-tmpfiles-setup.service"
-            ] ++ lib.optional (cfg.settings.nipapd.db_host == "") "postgresql.service";
-            requires = lib.optional (cfg.settings.nipapd.db_host == "") "postgresql.service";
+            ] ++ lib.optional (cfg.settings.nipapd.db_host == "") "postgresql.target";
+            requires = lib.optional (cfg.settings.nipapd.db_host == "") "postgresql.target";
             wantedBy = [ "multi-user.target" ];
             preStart = lib.optionalString (cfg.settings.auth.default_backend == defaultAuthBackend) ''
               # Create/upgrade local auth database
diff --git a/nixos/modules/services/web-apps/onlyoffice.nix b/nixos/modules/services/web-apps/onlyoffice.nix
index 48e51b13bb39..004a5cc1781f 100644
--- a/nixos/modules/services/web-apps/onlyoffice.nix
+++ b/nixos/modules/services/web-apps/onlyoffice.nix
@@ -235,12 +235,12 @@ in
         after = [
           "network.target"
           "onlyoffice-docservice.service"
-          "postgresql.service"
+          "postgresql.target"
         ];
         requires = [
           "network.target"
           "onlyoffice-docservice.service"
-          "postgresql.service"
+          "postgresql.target"
         ];
         wantedBy = [ "multi-user.target" ];
         serviceConfig = {
@@ -314,9 +314,9 @@ in
           description = "onlyoffice documentserver";
           after = [
             "network.target"
-            "postgresql.service"
+            "postgresql.target"
           ];
-          requires = [ "postgresql.service" ];
+          requires = [ "postgresql.target" ];
           wantedBy = [ "multi-user.target" ];
           serviceConfig = {
             ExecStart = "${cfg.package.fhs}/bin/onlyoffice-wrapper DocService/docservice /run/onlyoffice/config";
diff --git a/nixos/modules/services/web-apps/outline.nix b/nixos/modules/services/web-apps/outline.nix
index c0791445e1cf..8943f5242138 100644
--- a/nixos/modules/services/web-apps/outline.nix
+++ b/nixos/modules/services/web-apps/outline.nix
@@ -634,10 +634,10 @@ in
         wantedBy = [ "multi-user.target" ];
         after =
           [ "networking.target" ]
-          ++ lib.optional (cfg.databaseUrl == "local") "postgresql.service"
+          ++ lib.optional (cfg.databaseUrl == "local") "postgresql.target"
           ++ lib.optional (cfg.redisUrl == "local") "redis-outline.service";
         requires =
-          lib.optional (cfg.databaseUrl == "local") "postgresql.service"
+          lib.optional (cfg.databaseUrl == "local") "postgresql.target"
           ++ lib.optional (cfg.redisUrl == "local") "redis-outline.service";
         path = [
           pkgs.openssl # Required by the preStart script
diff --git a/nixos/modules/services/web-apps/part-db.nix b/nixos/modules/services/web-apps/part-db.nix
index 85adf2d7b7e5..d296d25c7739 100644
--- a/nixos/modules/services/web-apps/part-db.nix
+++ b/nixos/modules/services/web-apps/part-db.nix
@@ -195,8 +195,8 @@ in
       services = {
         part-db-migrate = {
           before = [ "phpfpm-part-db.service" ];
-          after = [ "postgresql.service" ];
-          requires = [ "postgresql.service" ];
+          after = [ "postgresql.target" ];
+          requires = [ "postgresql.target" ];
           wantedBy = [ "multi-user.target" ];
           serviceConfig = {
             Type = "oneshot";
@@ -216,7 +216,7 @@ in
           after = [ "part-db-migrate.service" ];
           requires = [
             "part-db-migrate.service"
-            "postgresql.service"
+            "postgresql.target"
           ];
           # ensure nginx can access the php-fpm socket
           postStart = ''
diff --git a/nixos/modules/services/web-apps/peertube.nix b/nixos/modules/services/web-apps/peertube.nix
index c4b0186a77b4..d4c9c25a9280 100644
--- a/nixos/modules/services/web-apps/peertube.nix
+++ b/nixos/modules/services/web-apps/peertube.nix
@@ -439,9 +439,9 @@ in
       description = "Initialization database for PeerTube daemon";
       after = [
         "network.target"
-        "postgresql.service"
+        "postgresql.target"
       ];
-      requires = [ "postgresql.service" ];
+      requires = [ "postgresql.target" ];
 
       script =
         let
@@ -475,13 +475,13 @@ in
         [ "network.target" ]
         ++ lib.optional cfg.redis.createLocally "redis-peertube.service"
         ++ lib.optionals cfg.database.createLocally [
-          "postgresql.service"
+          "postgresql.target"
           "peertube-init-db.service"
         ];
       requires =
         lib.optional cfg.redis.createLocally "redis-peertube.service"
         ++ lib.optionals cfg.database.createLocally [
-          "postgresql.service"
+          "postgresql.target"
           "peertube-init-db.service"
         ];
       wantedBy = [ "multi-user.target" ];
diff --git a/nixos/modules/services/web-apps/pixelfed.nix b/nixos/modules/services/web-apps/pixelfed.nix
index a8c57f284964..c20947aa6f87 100644
--- a/nixos/modules/services/web-apps/pixelfed.nix
+++ b/nixos/modules/services/web-apps/pixelfed.nix
@@ -53,9 +53,9 @@ let
       "mysql" = "/run/mysqld/mysqld.sock";
     }
     .${cfg.database.type};
-  dbService =
+  dbUnit =
     {
-      "pgsql" = "postgresql.service";
+      "pgsql" = "postgresql.target";
       "mysql" = "mysql.service";
     }
     .${cfg.database.type};
@@ -355,7 +355,7 @@ in
         "pixelfed-horizon.service"
         "pixelfed-data-setup.service"
       ]
-      ++ lib.optional cfg.database.createLocally dbService
+      ++ lib.optional cfg.database.createLocally dbUnit
       ++ lib.optional cfg.redis.createLocally redisService;
     # Ensure image optimizations programs are available.
     systemd.services.phpfpm-pixelfed.path = extraPrograms;
@@ -368,7 +368,7 @@ in
       ];
       requires =
         [ "pixelfed-data-setup.service" ]
-        ++ (lib.optional cfg.database.createLocally dbService)
+        ++ (lib.optional cfg.database.createLocally dbUnit)
         ++ (lib.optional cfg.redis.createLocally redisService);
       wantedBy = [ "multi-user.target" ];
       # Ensure image optimizations programs are available.
@@ -412,8 +412,8 @@ in
     systemd.services.pixelfed-data-setup = {
       description = "Pixelfed setup: migrations, environment file update, cache reload, data changes";
       wantedBy = [ "multi-user.target" ];
-      after = lib.optional cfg.database.createLocally dbService;
-      requires = lib.optional cfg.database.createLocally dbService;
+      after = lib.optional cfg.database.createLocally dbUnit;
+      requires = lib.optional cfg.database.createLocally dbUnit;
       path =
         with pkgs;
         [
diff --git a/nixos/modules/services/web-apps/plausible.nix b/nixos/modules/services/web-apps/plausible.nix
index 36482f0e4306..2da839687f13 100644
--- a/nixos/modules/services/web-apps/plausible.nix
+++ b/nixos/modules/services/web-apps/plausible.nix
@@ -196,13 +196,13 @@ in
           after =
             optional cfg.database.clickhouse.setup "clickhouse.service"
             ++ optionals cfg.database.postgres.setup [
-              "postgresql.service"
+              "postgresql.target"
               "plausible-postgres.service"
             ];
           requires =
             optional cfg.database.clickhouse.setup "clickhouse.service"
             ++ optionals cfg.database.postgres.setup [
-              "postgresql.service"
+              "postgresql.target"
               "plausible-postgres.service"
             ];
 
@@ -309,7 +309,7 @@ in
       (mkIf cfg.database.postgres.setup {
         # `plausible' requires the `citext'-extension.
         plausible-postgres = {
-          after = [ "postgresql.service" ];
+          after = [ "postgresql.target" ];
           partOf = [ "plausible.service" ];
           serviceConfig = {
             Type = "oneshot";
diff --git a/nixos/modules/services/web-apps/pretalx.nix b/nixos/modules/services/web-apps/pretalx.nix
index c7d35d029963..4a995e6e395f 100644
--- a/nixos/modules/services/web-apps/pretalx.nix
+++ b/nixos/modules/services/web-apps/pretalx.nix
@@ -434,7 +434,7 @@ in
               "redis-pretalx.service"
             ]
             ++ lib.optionals (cfg.settings.database.backend == "postgresql") [
-              "postgresql.service"
+              "postgresql.target"
             ]
             ++ lib.optionals (cfg.settings.database.backend == "mysql") [
               "mysql.service"
@@ -484,7 +484,7 @@ in
                 "redis-pretalx.service"
               ]
               ++ lib.optionals (cfg.settings.database.backend == "postgresql") [
-                "postgresql.service"
+                "postgresql.target"
               ]
               ++ lib.optionals (cfg.settings.database.backend == "mysql") [
                 "mysql.service"
diff --git a/nixos/modules/services/web-apps/pretix.nix b/nixos/modules/services/web-apps/pretix.nix
index 75c95464d6fa..9c28790845a2 100644
--- a/nixos/modules/services/web-apps/pretix.nix
+++ b/nixos/modules/services/web-apps/pretix.nix
@@ -533,7 +533,7 @@ in
           after = [
             "network.target"
             "redis-pretix.service"
-            "postgresql.service"
+            "postgresql.target"
           ];
           wantedBy = [ "multi-user.target" ];
           preStart = ''
@@ -574,7 +574,7 @@ in
           after = [
             "network.target"
             "redis-pretix.service"
-            "postgresql.service"
+            "postgresql.target"
           ];
           wantedBy = [ "multi-user.target" ];
           serviceConfig = {
diff --git a/nixos/modules/services/web-apps/reposilite.nix b/nixos/modules/services/web-apps/reposilite.nix
index ac9c9937bcfa..469a1d83e030 100644
--- a/nixos/modules/services/web-apps/reposilite.nix
+++ b/nixos/modules/services/web-apps/reposilite.nix
@@ -398,7 +398,7 @@ in
       after =
         [ "network.target" ]
         ++ (lib.optional useMySQL "mysql.service")
-        ++ (lib.optional usePostgres "postgresql.service");
+        ++ (lib.optional usePostgres "postgresql.target");
 
       script =
         lib.optionalString (cfg.keyPasswordFile != null && cfg.settings.keyPassword == null) ''
diff --git a/nixos/modules/services/web-apps/shiori.nix b/nixos/modules/services/web-apps/shiori.nix
index fac667d93090..5f38703558c8 100644
--- a/nixos/modules/services/web-apps/shiori.nix
+++ b/nixos/modules/services/web-apps/shiori.nix
@@ -62,7 +62,7 @@ in
       description = "Shiori simple bookmarks manager";
       wantedBy = [ "multi-user.target" ];
       after = [
-        "postgresql.service"
+        "postgresql.target"
         "mysql.service"
       ];
       environment =
diff --git a/nixos/modules/services/web-apps/sogo.nix b/nixos/modules/services/web-apps/sogo.nix
index ddf673dcaf42..f5123abd7443 100644
--- a/nixos/modules/services/web-apps/sogo.nix
+++ b/nixos/modules/services/web-apps/sogo.nix
@@ -104,7 +104,7 @@ in
     systemd.services.sogo = {
       description = "SOGo groupware";
       after = [
-        "postgresql.service"
+        "postgresql.target"
         "mysql.service"
         "memcached.service"
         "openldap.service"
@@ -191,7 +191,7 @@ in
       description = "SOGo email alarms";
 
       after = [
-        "postgresql.service"
+        "postgresql.target"
         "mysqld.service"
         "memcached.service"
         "openldap.service"
diff --git a/nixos/modules/services/web-apps/tt-rss.nix b/nixos/modules/services/web-apps/tt-rss.nix
index b02acd26731e..acc114ea1626 100644
--- a/nixos/modules/services/web-apps/tt-rss.nix
+++ b/nixos/modules/services/web-apps/tt-rss.nix
@@ -667,11 +667,11 @@ in
         };
 
         wantedBy = [ "multi-user.target" ];
-        requires = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.service";
+        requires = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.target";
         after =
           [ "network.target" ]
           ++ optional mysqlLocal "mysql.service"
-          ++ optional pgsqlLocal "postgresql.service";
+          ++ optional pgsqlLocal "postgresql.target";
       };
     };
 
diff --git a/nixos/modules/services/web-apps/vikunja.nix b/nixos/modules/services/web-apps/vikunja.nix
index 4a6bae2d123a..9cf06e0f1568 100644
--- a/nixos/modules/services/web-apps/vikunja.nix
+++ b/nixos/modules/services/web-apps/vikunja.nix
@@ -117,7 +117,7 @@ in
       description = "vikunja";
       after =
         [ "network.target" ]
-        ++ lib.optional usePostgresql "postgresql.service"
+        ++ lib.optional usePostgresql "postgresql.target"
         ++ lib.optional useMysql "mysql.service";
       wantedBy = [ "multi-user.target" ];
       path = [ cfg.package ];
diff --git a/nixos/modules/services/web-apps/wakapi.nix b/nixos/modules/services/web-apps/wakapi.nix
index f833c0c0e45f..67f2761b5e53 100644
--- a/nixos/modules/services/web-apps/wakapi.nix
+++ b/nixos/modules/services/web-apps/wakapi.nix
@@ -135,10 +135,10 @@ in
       description = "Wakapi (self-hosted WakaTime-compatible backend)";
       wants = [
         "network-online.target"
-      ] ++ optional (cfg.database.dialect == "postgres") "postgresql.service";
+      ] ++ optional (cfg.database.dialect == "postgres") "postgresql.target";
       after = [
         "network-online.target"
-      ] ++ optional (cfg.database.dialect == "postgres") "postgresql.service";
+      ] ++ optional (cfg.database.dialect == "postgres") "postgresql.target";
       wantedBy = [ "multi-user.target" ];
 
       script = ''
diff --git a/nixos/modules/services/web-apps/weblate.nix b/nixos/modules/services/web-apps/weblate.nix
index 921330db4422..1af45a29cbf8 100644
--- a/nixos/modules/services/web-apps/weblate.nix
+++ b/nixos/modules/services/web-apps/weblate.nix
@@ -251,7 +251,7 @@ in
 
     systemd.services.weblate-postgresql-setup = {
       description = "Weblate PostgreSQL setup";
-      after = [ "postgresql.service" ];
+      after = [ "postgresql.target" ];
       serviceConfig = {
         Type = "oneshot";
         User = "postgres";
@@ -290,7 +290,7 @@ in
       after = [
         "network.target"
         "redis-weblate.service"
-        "postgresql.service"
+        "postgresql.target"
       ];
       # We want this to be active on boot, not just on socket activation
       wantedBy = [ "multi-user.target" ];
diff --git a/nixos/modules/services/web-apps/windmill.nix b/nixos/modules/services/web-apps/windmill.nix
index bc600b730a8c..a588adf0f77b 100644
--- a/nixos/modules/services/web-apps/windmill.nix
+++ b/nixos/modules/services/web-apps/windmill.nix
@@ -134,39 +134,37 @@ in
         # coming from https://github.com/windmill-labs/windmill/blob/main/init-db-as-superuser.sql
         # modified to not grant privileges on all tables
         # create role windmill_user and windmill_admin only if they don't exist
-        postgresql.postStart = lib.mkIf cfg.database.createLocally (
-          lib.mkAfter ''
-                  $PSQL -tA <<"EOF"
-            DO $$
-            BEGIN
-                IF NOT EXISTS (
-                    SELECT FROM pg_catalog.pg_roles
-                    WHERE rolname = 'windmill_user'
-                ) THEN
-                    CREATE ROLE windmill_user;
-                    GRANT ALL PRIVILEGES ON DATABASE ${cfg.database.name} TO windmill_user;
-                ELSE
-                  RAISE NOTICE 'Role "windmill_user" already exists. Skipping.';
-                END IF;
-                IF NOT EXISTS (
-                    SELECT FROM pg_catalog.pg_roles
-                    WHERE rolname = 'windmill_admin'
-                ) THEN
-                  CREATE ROLE windmill_admin WITH BYPASSRLS;
-                  GRANT windmill_user TO windmill_admin;
-                ELSE
-                  RAISE NOTICE 'Role "windmill_admin" already exists. Skipping.';
-                END IF;
-                GRANT windmill_admin TO windmill;
-            END
-            $$;
-            EOF
-          ''
-        );
+        postgresql.postStart = lib.mkIf cfg.database.createLocally ''
+          psql -tA <<"EOF"
+          DO $$
+          BEGIN
+              IF NOT EXISTS (
+                  SELECT FROM pg_catalog.pg_roles
+                  WHERE rolname = 'windmill_user'
+              ) THEN
+                  CREATE ROLE windmill_user;
+                  GRANT ALL PRIVILEGES ON DATABASE ${cfg.database.name} TO windmill_user;
+              ELSE
+                RAISE NOTICE 'Role "windmill_user" already exists. Skipping.';
+              END IF;
+              IF NOT EXISTS (
+                  SELECT FROM pg_catalog.pg_roles
+                  WHERE rolname = 'windmill_admin'
+              ) THEN
+                CREATE ROLE windmill_admin WITH BYPASSRLS;
+                GRANT windmill_user TO windmill_admin;
+              ELSE
+                RAISE NOTICE 'Role "windmill_admin" already exists. Skipping.';
+              END IF;
+              GRANT windmill_admin TO windmill;
+          END
+          $$;
+          EOF
+        '';
 
         windmill-server = {
           description = "Windmill server";
-          after = [ "network.target" ] ++ lib.optional cfg.database.createLocally "postgresql.service";
+          after = [ "network.target" ] ++ lib.optional cfg.database.createLocally "postgresql.target";
           wantedBy = [ "multi-user.target" ];
 
           serviceConfig = serviceConfig // {
@@ -183,7 +181,7 @@ in
 
         windmill-worker = {
           description = "Windmill worker";
-          after = [ "network.target" ] ++ lib.optional cfg.database.createLocally "postgresql.service";
+          after = [ "network.target" ] ++ lib.optional cfg.database.createLocally "postgresql.target";
           wantedBy = [ "multi-user.target" ];
 
           serviceConfig = serviceConfig // {
@@ -201,7 +199,7 @@ in
 
         windmill-worker-native = {
           description = "Windmill worker native";
-          after = [ "network.target" ] ++ lib.optional cfg.database.createLocally "postgresql.service";
+          after = [ "network.target" ] ++ lib.optional cfg.database.createLocally "postgresql.target";
           wantedBy = [ "multi-user.target" ];
 
           serviceConfig = serviceConfig // {
diff --git a/nixos/modules/services/web-apps/zipline.nix b/nixos/modules/services/web-apps/zipline.nix
index 86cb3a1d7e81..397aeff78058 100644
--- a/nixos/modules/services/web-apps/zipline.nix
+++ b/nixos/modules/services/web-apps/zipline.nix
@@ -93,8 +93,8 @@ in
       wantedBy = [ "multi-user.target" ];
 
       wants = [ "network-online.target" ];
-      after = [ "network-online.target" ] ++ lib.optional cfg.database.createLocally "postgresql.service";
-      requires = lib.optional cfg.database.createLocally "postgresql.service";
+      after = [ "network-online.target" ] ++ lib.optional cfg.database.createLocally "postgresql.target";
+      requires = lib.optional cfg.database.createLocally "postgresql.target";
 
       environment = lib.mapAttrs (_: value: toString value) cfg.settings;
 
diff --git a/nixos/modules/services/web-servers/keter/default.nix b/nixos/modules/services/web-servers/keter/default.nix
index 515d44f7ee5b..4a1b08bfd933 100644
--- a/nixos/modules/services/web-servers/keter/default.nix
+++ b/nixos/modules/services/web-servers/keter/default.nix
@@ -182,7 +182,7 @@ in
         after = [
           "network.target"
           "local-fs.target"
-          "postgresql.service"
+          "postgresql.target"
         ];
       };
 
diff --git a/nixos/tests/coder.nix b/nixos/tests/coder.nix
index 9b0b2c334a0b..a13aba87b97a 100644
--- a/nixos/tests/coder.nix
+++ b/nixos/tests/coder.nix
@@ -14,7 +14,7 @@
 
   testScript = ''
     machine.start()
-    machine.wait_for_unit("postgresql.service")
+    machine.wait_for_unit("postgresql.target")
     machine.wait_for_unit("coder.service")
     machine.wait_for_open_port(3000)
 
diff --git a/nixos/tests/davis.nix b/nixos/tests/davis.nix
index 0dfa08342801..4aa666dede95 100644
--- a/nixos/tests/davis.nix
+++ b/nixos/tests/davis.nix
@@ -55,7 +55,7 @@
   testScript = ''
     start_all()
 
-    machine1.wait_for_unit("postgresql.service")
+    machine1.wait_for_unit("postgresql.target")
     machine1.wait_for_unit("davis-env-setup.service")
     machine1.wait_for_unit("davis-db-migrate.service")
     machine1.wait_for_unit("phpfpm-davis.service")
diff --git a/nixos/tests/documize.nix b/nixos/tests/documize.nix
index 4565033a9349..e918fdd93e70 100644
--- a/nixos/tests/documize.nix
+++ b/nixos/tests/documize.nix
@@ -18,8 +18,8 @@
       };
 
       systemd.services.documize-server = {
-        after = [ "postgresql.service" ];
-        requires = [ "postgresql.service" ];
+        after = [ "postgresql.target" ];
+        requires = [ "postgresql.target" ];
       };
 
       services.postgresql = {
diff --git a/nixos/tests/ferretdb.nix b/nixos/tests/ferretdb.nix
index 8148bb344576..cfa01b132231 100644
--- a/nixos/tests/ferretdb.nix
+++ b/nixos/tests/ferretdb.nix
@@ -29,8 +29,8 @@ with import ../lib/testing-python.nix { inherit system; };
         };
 
         systemd.services.ferretdb.serviceConfig = {
-          Requires = "postgresql.service";
-          After = "postgresql.service";
+          Requires = "postgresql.target";
+          After = "postgresql.target";
         };
 
         services.postgresql = {
diff --git a/nixos/tests/firefly-iii.nix b/nixos/tests/firefly-iii.nix
index 35a695a057ac..6c1ff99d9c91 100644
--- a/nixos/tests/firefly-iii.nix
+++ b/nixos/tests/firefly-iii.nix
@@ -105,7 +105,7 @@ in
     fireflySqlite.succeed("systemctl start firefly-iii-cron.service")
     fireflyPostgresql.wait_for_unit("phpfpm-firefly-iii.service")
     fireflyPostgresql.wait_for_unit("nginx.service")
-    fireflyPostgresql.wait_for_unit("postgresql.service")
+    fireflyPostgresql.wait_for_unit("postgresql.target")
     fireflyPostgresql.succeed("curl -fvvv -Ls http://localhost/ | grep 'Firefly III'")
     fireflyPostgresql.succeed("systemctl start firefly-iii-cron.service")
     fireflyMysql.wait_for_unit("phpfpm-firefly-iii.service")
diff --git a/nixos/tests/freshrss/pgsql.nix b/nixos/tests/freshrss/pgsql.nix
index a3f3f938db98..971ea7b15bc4 100644
--- a/nixos/tests/freshrss/pgsql.nix
+++ b/nixos/tests/freshrss/pgsql.nix
@@ -38,8 +38,8 @@ import ../make-test-python.nix (
         };
 
         systemd.services."freshrss-config" = {
-          requires = [ "postgresql.service" ];
-          after = [ "postgresql.service" ];
+          requires = [ "postgresql.target" ];
+          after = [ "postgresql.target" ];
         };
       };
 
diff --git a/nixos/tests/gancio.nix b/nixos/tests/gancio.nix
index 6cd487008670..2f4e244f8cb9 100644
--- a/nixos/tests/gancio.nix
+++ b/nixos/tests/gancio.nix
@@ -67,7 +67,7 @@ in
   testScript = ''
     start_all()
 
-    server.wait_for_unit("postgresql")
+    server.wait_for_unit("postgresql.target")
     server.wait_for_unit("gancio")
     server.wait_for_unit("nginx")
     server.wait_for_file("/run/gancio/socket")
diff --git a/nixos/tests/gitlab.nix b/nixos/tests/gitlab.nix
index cead8f538a86..ce2edac32386 100644
--- a/nixos/tests/gitlab.nix
+++ b/nixos/tests/gitlab.nix
@@ -488,7 +488,7 @@ in
       gitlab.systemctl("start gitlab-backup.service")
       gitlab.wait_for_unit("gitlab-backup.service")
       gitlab.wait_for_file("${nodes.gitlab.services.gitlab.statePath}/backup/dump_gitlab_backup.tar")
-      gitlab.systemctl("stop postgresql.service gitlab-config.service gitlab.target")
+      gitlab.systemctl("stop postgresql gitlab-config.service gitlab.target")
       gitlab.succeed(
           "find ${nodes.gitlab.services.gitlab.statePath} -mindepth 1 -maxdepth 1 -not -name backup -execdir rm -r {} +"
       )
diff --git a/nixos/tests/grafana/basic.nix b/nixos/tests/grafana/basic.nix
index 3b0d5a6a3258..dbb211537447 100644
--- a/nixos/tests/grafana/basic.nix
+++ b/nixos/tests/grafana/basic.nix
@@ -63,7 +63,7 @@ import ../make-test-python.nix (
             }
           ];
         };
-        systemd.services.grafana.after = [ "postgresql.service" ];
+        systemd.services.grafana.after = [ "postgresql.target" ];
       };
 
       mysql = {
@@ -133,7 +133,7 @@ import ../make-test-python.nix (
 
       with subtest("Successful API query as admin user with postgresql db"):
           postgresql.wait_for_unit("grafana.service")
-          postgresql.wait_for_unit("postgresql.service")
+          postgresql.wait_for_unit("postgresql.target")
           postgresql.wait_for_open_port(3000)
           postgresql.wait_for_open_port(5432)
           postgresql.succeed(
diff --git a/nixos/tests/hedgedoc.nix b/nixos/tests/hedgedoc.nix
index 826e35289900..75a81e69b61c 100644
--- a/nixos/tests/hedgedoc.nix
+++ b/nixos/tests/hedgedoc.nix
@@ -13,7 +13,7 @@
     hedgedocPostgresWithTCPSocket =
       { ... }:
       {
-        systemd.services.hedgedoc.after = [ "postgresql.service" ];
+        systemd.services.hedgedoc.after = [ "postgresql.target" ];
         services = {
           hedgedoc = {
             enable = true;
@@ -47,7 +47,7 @@
     hedgedocPostgresWithUNIXSocket =
       { ... }:
       {
-        systemd.services.hedgedoc.after = [ "postgresql.service" ];
+        systemd.services.hedgedoc.after = [ "postgresql.target" ];
         services = {
           hedgedoc = {
             enable = true;
@@ -83,14 +83,14 @@
         hedgedocSqlite.wait_until_succeeds("curl -sSf http://localhost:3000/new")
 
     with subtest("HedgeDoc postgres with TCP socket"):
-        hedgedocPostgresWithTCPSocket.wait_for_unit("postgresql.service")
+        hedgedocPostgresWithTCPSocket.wait_for_unit("postgresql.target")
         hedgedocPostgresWithTCPSocket.wait_for_unit("hedgedoc.service")
         hedgedocPostgresWithTCPSocket.wait_for_open_port(5432)
         hedgedocPostgresWithTCPSocket.wait_for_open_port(3000)
         hedgedocPostgresWithTCPSocket.wait_until_succeeds("curl -sSf http://localhost:3000/new")
 
     with subtest("HedgeDoc postgres with UNIX socket"):
-        hedgedocPostgresWithUNIXSocket.wait_for_unit("postgresql.service")
+        hedgedocPostgresWithUNIXSocket.wait_for_unit("postgresql.target")
         hedgedocPostgresWithUNIXSocket.wait_for_unit("hedgedoc.service")
         hedgedocPostgresWithUNIXSocket.wait_for_open_port(5432)
         hedgedocPostgresWithUNIXSocket.wait_for_open_port(3000)
diff --git a/nixos/tests/hydra/default.nix b/nixos/tests/hydra/default.nix
index 6fbce3b4f826..91913102bd98 100644
--- a/nixos/tests/hydra/default.nix
+++ b/nixos/tests/hydra/default.nix
@@ -18,7 +18,7 @@ in
     # let the system boot up
     machine.wait_for_unit("multi-user.target")
     # test whether the database is running
-    machine.wait_for_unit("postgresql.service")
+    machine.wait_for_unit("postgresql.target")
     # test whether the actual hydra daemons are running
     machine.wait_for_unit("hydra-init.service")
     machine.require_unit_state("hydra-queue-runner.service")
diff --git a/nixos/tests/invidious.nix b/nixos/tests/invidious.nix
index 24efe642784a..be091b590358 100644
--- a/nixos/tests/invidious.nix
+++ b/nixos/tests/invidious.nix
@@ -144,7 +144,7 @@
       curl_assert_status_code("http://invidious.example.com/search", 200)
       machine.succeed("journalctl -eu invidious.service | grep -o \"SigHelper: Using helper at 'tcp://127.0.0.1:2999'\"")
 
-      postgres_tcp.wait_for_unit("postgresql.service")
+      postgres_tcp.wait_for_unit("postgresql.target")
       activate_specialisation("postgres-tcp")
       machine.wait_for_open_port(port)
       curl_assert_status_code(f"{url}/search", 200)
diff --git a/nixos/tests/listmonk.nix b/nixos/tests/listmonk.nix
index 31c2a59b8b65..7535f07c44c9 100644
--- a/nixos/tests/listmonk.nix
+++ b/nixos/tests/listmonk.nix
@@ -41,7 +41,7 @@ import ./make-test-python.nix (
          return f'curl -u "{basic_auth}" -X {type} "http://localhost:9000/api/{url}" -H "Content-Type: application/json; charset=utf-8" --data-raw \'{json_data}\'''
 
       machine.wait_for_unit("mailhog.service")
-      machine.wait_for_unit("postgresql.service")
+      machine.wait_for_unit("postgresql.target")
       machine.wait_for_unit("listmonk.service")
       machine.wait_for_open_port(1025)
       machine.wait_for_open_port(8025)
diff --git a/nixos/tests/matrix/synapse.nix b/nixos/tests/matrix/synapse.nix
index 296480548718..a1c0ba231e17 100644
--- a/nixos/tests/matrix/synapse.nix
+++ b/nixos/tests/matrix/synapse.nix
@@ -233,7 +233,7 @@ in
     serverpostgres.wait_until_succeeds(
         "journalctl -u matrix-synapse.service | grep -q 'Connected to redis'"
     )
-    serverpostgres.require_unit_state("postgresql.service")
+    serverpostgres.require_unit_state("postgresql.target")
     serverpostgres.succeed("REQUESTS_CA_BUNDLE=${ca_pem} register_new_matrix_user -u ${testUser} -p ${testPassword} -a -k ${registrationSharedSecret} https://localhost:8448/")
     serverpostgres.succeed("obtain-token-and-register-email")
     serversqlite.wait_for_unit("matrix-synapse.service")
diff --git a/nixos/tests/miniflux.nix b/nixos/tests/miniflux.nix
index e13214a148a8..b7c2ec8f38b0 100644
--- a/nixos/tests/miniflux.nix
+++ b/nixos/tests/miniflux.nix
@@ -80,7 +80,7 @@ in
             host sameuser miniflux samenet scram-sha-256
           '';
         };
-        systemd.services.postgresql.postStart = lib.mkAfter ''
+        systemd.services.postgresql-setup.postStart = lib.mkAfter ''
           $PSQL -tAd miniflux -c 'CREATE EXTENSION hstore;'
         '';
         networking.firewall.allowedTCPPorts = [ config.services.postgresql.settings.port ];
@@ -123,7 +123,7 @@ in
     runTest(withoutSudo, ${toString defaultPort}, "${defaultUsername}:${defaultPassword}")
     runTest(customized, ${toString port}, "${username}:${password}")
 
-    postgresTcp.wait_for_unit("postgresql.service")
+    postgresTcp.wait_for_unit("postgresql.target")
     externalDb.start()
     runTest(externalDb, ${toString defaultPort}, "${defaultUsername}:${defaultPassword}")
   '';
diff --git a/nixos/tests/nextcloud/with-declarative-redis-and-secrets.nix b/nixos/tests/nextcloud/with-declarative-redis-and-secrets.nix
index fb1a9c9baba0..fd02a0c1d3b3 100644
--- a/nixos/tests/nextcloud/with-declarative-redis-and-secrets.nix
+++ b/nixos/tests/nextcloud/with-declarative-redis-and-secrets.nix
@@ -65,14 +65,14 @@ runTest (
           };
 
           systemd.services.nextcloud-setup = {
-            requires = [ "postgresql.service" ];
-            after = [ "postgresql.service" ];
+            requires = [ "postgresql.target" ];
+            after = [ "postgresql.target" ];
           };
 
           services.postgresql = {
             enable = true;
           };
-          systemd.services.postgresql.postStart = lib.mkAfter ''
+          systemd.services.postgresql-setup.postStart = ''
             password=$(cat ${config.services.nextcloud.config.dbpassFile})
             ${config.services.postgresql.package}/bin/psql <<EOF
               CREATE ROLE ${adminuser} WITH LOGIN PASSWORD '$password' CREATEDB;
diff --git a/nixos/tests/pgadmin4.nix b/nixos/tests/pgadmin4.nix
index 2d08e95a2c18..f874c24833c0 100644
--- a/nixos/tests/pgadmin4.nix
+++ b/nixos/tests/pgadmin4.nix
@@ -55,7 +55,7 @@
 
   testScript = ''
     with subtest("Check pgadmin module"):
-      machine.wait_for_unit("postgresql")
+      machine.wait_for_unit("postgresql.target")
       machine.wait_for_unit("pgadmin")
       machine.wait_until_succeeds("curl -sS localhost:5051")
       machine.wait_until_succeeds("curl -sS localhost:5051/login | grep \"<title>pgAdmin 4</title>\" > /dev/null")
@@ -80,7 +80,7 @@
       machine.succeed("wget -nv --level=1 --spider --recursive localhost:5050/browser")
 
     with subtest("Check pgadmin minimum password length"):
-      machine2.wait_for_unit("postgresql")
+      machine2.wait_for_unit("postgresql.target")
       machine2.wait_for_console_text("Password must be at least 12 characters long")
   '';
 }
diff --git a/nixos/tests/pgbackrest/posix.nix b/nixos/tests/pgbackrest/posix.nix
index d5bfaa6d310c..aede13ff5cf8 100644
--- a/nixos/tests/pgbackrest/posix.nix
+++ b/nixos/tests/pgbackrest/posix.nix
@@ -27,6 +27,13 @@ in
           CREATE TABLE t(c text);
           INSERT INTO t VALUES ('hello world');
         '';
+        # To make sure we're waiting for read-write after recovery.
+        ensureUsers = [
+          {
+            name = "app-user";
+            ensureClauses.login = true;
+          }
+        ];
       };
 
       services.pgbackrest = {
@@ -141,7 +148,7 @@ in
         primary.succeed("sudo -u postgres pgbackrest --stanza=default restore --delta")
 
         primary.systemctl("start postgresql")
-        primary.wait_for_unit("postgresql.service")
+        primary.wait_for_unit("postgresql.target")
         assert "hello world" in primary.succeed("sudo -u postgres psql -c 'TABLE t;'")
     '';
 }
diff --git a/nixos/tests/pgbackrest/sftp.nix b/nixos/tests/pgbackrest/sftp.nix
index 8e97fb679980..efc2b2b7aa69 100644
--- a/nixos/tests/pgbackrest/sftp.nix
+++ b/nixos/tests/pgbackrest/sftp.nix
@@ -89,7 +89,7 @@ in
         primary.succeed("sudo -u postgres pgbackrest --stanza=default restore --delta")
 
         primary.systemctl("start postgresql")
-        primary.wait_for_unit("postgresql.service")
+        primary.wait_for_unit("postgresql.target")
         assert "hello world" in primary.succeed("sudo -u postgres psql -c 'TABLE t;'")
     '';
 }
diff --git a/nixos/tests/pgbouncer.nix b/nixos/tests/pgbouncer.nix
index ffe2c3c137bf..7e55d344c00f 100644
--- a/nixos/tests/pgbouncer.nix
+++ b/nixos/tests/pgbouncer.nix
@@ -10,7 +10,7 @@
     one =
       { pkgs, ... }:
       {
-        systemd.services.postgresql = {
+        systemd.services.postgresql-setup = {
           postStart = ''
             ${pkgs.postgresql}/bin/psql -U postgres -c "ALTER ROLE testuser WITH LOGIN PASSWORD 'testpass'";
             ${pkgs.postgresql}/bin/psql -U postgres -c "ALTER DATABASE testdb OWNER TO testuser;";
diff --git a/nixos/tests/pghero.nix b/nixos/tests/pghero.nix
index 1673877f90c5..ff384752ccb3 100644
--- a/nixos/tests/pghero.nix
+++ b/nixos/tests/pghero.nix
@@ -53,7 +53,7 @@ in
         assert http_code.split("\n")[-1].strip() == code, \
           f"expected HTTP status code {code} but got {http_code}"
 
-    machine.wait_for_unit("postgresql.service")
+    machine.wait_for_unit("postgresql.target")
     machine.wait_for_unit("pghero.service")
 
     with subtest("requires HTTP Basic Auth credentials"):
diff --git a/nixos/tests/pgweb.nix b/nixos/tests/pgweb.nix
index 3939ae958d70..70894e6e34e4 100644
--- a/nixos/tests/pgweb.nix
+++ b/nixos/tests/pgweb.nix
@@ -19,7 +19,7 @@
           ExecStart = "${pkgs.pgweb}/bin/pgweb --url postgresql://postgres@localhost:5432/postgres";
         };
         path = [ pkgs.getent ];
-        after = [ "postgresql.service" ];
+        after = [ "postgresql.target" ];
         wantedBy = [ "multi-user.target" ];
       };
     };
diff --git a/nixos/tests/pleroma.nix b/nixos/tests/pleroma.nix
index fa5f88068719..dec5840bec3c 100644
--- a/nixos/tests/pleroma.nix
+++ b/nixos/tests/pleroma.nix
@@ -266,7 +266,7 @@ import ./make-test-python.nix (
     testScript =
       { nodes, ... }:
       ''
-        pleroma.wait_for_unit("postgresql.service")
+        pleroma.wait_for_unit("postgresql.target")
         pleroma.wait_until_succeeds("ls /var/lib/pleroma")
         pleroma.succeed("provision-db")
         pleroma.wait_for_file("/var/lib/pleroma")
diff --git a/nixos/tests/postfixadmin.nix b/nixos/tests/postfixadmin.nix
index 2994efcfca47..d36bec212c26 100644
--- a/nixos/tests/postfixadmin.nix
+++ b/nixos/tests/postfixadmin.nix
@@ -23,7 +23,7 @@
 
   testScript = ''
     postfixadmin.start
-    postfixadmin.wait_for_unit("postgresql.service")
+    postfixadmin.wait_for_unit("postgresql.target")
     postfixadmin.wait_for_unit("phpfpm-postfixadmin.service")
     postfixadmin.wait_for_unit("nginx.service")
     postfixadmin.succeed(
diff --git a/nixos/tests/postgres-websockets.nix b/nixos/tests/postgres-websockets.nix
index c3badf22383e..c31bd4864bfc 100644
--- a/nixos/tests/postgres-websockets.nix
+++ b/nixos/tests/postgres-websockets.nix
@@ -58,7 +58,7 @@
       token = jwt.encode({ "mode": "rw" }, "reallyreallyreallyreallyverysafe")
 
       def test():
-          machine.wait_for_unit("postgresql.service")
+          machine.wait_for_unit("postgresql.target")
           machine.wait_for_unit("postgres-websockets.service")
 
           machine.succeed(f"echo 'hi there' | websocat --no-close 'ws://localhost:3000/test/{token}' > output &")
diff --git a/nixos/tests/postgresql/anonymizer.nix b/nixos/tests/postgresql/anonymizer.nix
index 77c38f9344ef..2da7ed506111 100644
--- a/nixos/tests/postgresql/anonymizer.nix
+++ b/nixos/tests/postgresql/anonymizer.nix
@@ -28,7 +28,7 @@ let
       testScript = ''
         start_all()
         machine.wait_for_unit("multi-user.target")
-        machine.wait_for_unit("postgresql.service")
+        machine.wait_for_unit("postgresql.target")
 
         with subtest("Setup"):
             machine.succeed("sudo -u postgres psql --command 'create database demo'")
diff --git a/nixos/tests/postgresql/pgjwt.nix b/nixos/tests/postgresql/pgjwt.nix
index 7ba246a778f6..6fc43d771b92 100644
--- a/nixos/tests/postgresql/pgjwt.nix
+++ b/nixos/tests/postgresql/pgjwt.nix
@@ -40,7 +40,7 @@ let
         in
         ''
           start_all()
-          master.wait_for_unit("postgresql")
+          master.wait_for_unit("postgresql.target")
           master.succeed(
               "${pkgs.sudo}/bin/sudo -u ${sqlSU} ${pgProve}/bin/pg_prove -d postgres -v -f ${pgjwt.src}/test.sql"
           )
diff --git a/nixos/tests/postgresql/postgresql-jit.nix b/nixos/tests/postgresql/postgresql-jit.nix
index 53d35b3e9d64..fd9567182a20 100644
--- a/nixos/tests/postgresql/postgresql-jit.nix
+++ b/nixos/tests/postgresql/postgresql-jit.nix
@@ -29,7 +29,7 @@ let
 
       testScript = ''
         machine.start()
-        machine.wait_for_unit("postgresql.service")
+        machine.wait_for_unit("postgresql.target")
 
         with subtest("JIT is enabled"):
             machine.succeed("sudo -u postgres psql <<<'show jit;' | grep 'on'")
diff --git a/nixos/tests/postgresql/postgresql-wal-receiver.nix b/nixos/tests/postgresql/postgresql-wal-receiver.nix
index 70f9983700c2..c233a582546c 100644
--- a/nixos/tests/postgresql/postgresql-wal-receiver.nix
+++ b/nixos/tests/postgresql/postgresql-wal-receiver.nix
@@ -62,7 +62,7 @@ let
 
       testScript = ''
         # make an initial base backup
-        machine.wait_for_unit("postgresql")
+        machine.wait_for_unit("postgresql.target")
         machine.wait_for_unit("postgresql-wal-receiver-main")
         # WAL receiver healthchecks PG every 5 seconds, so let's be sure they have connected each other
         # required only for 9.4
@@ -99,7 +99,7 @@ let
         machine.systemctl("start postgresql")
         machine.wait_for_file("${postgresqlDataDir}/recovery.done")
         machine.systemctl("restart postgresql")
-        machine.wait_for_unit("postgresql")
+        machine.wait_for_unit("postgresql.target")
 
         # check that our records have been restored
         machine.succeed(
diff --git a/nixos/tests/postgresql/postgresql.nix b/nixos/tests/postgresql/postgresql.nix
index ecf1b5552804..e77ec7897547 100644
--- a/nixos/tests/postgresql/postgresql.nix
+++ b/nixos/tests/postgresql/postgresql.nix
@@ -82,7 +82,7 @@ let
 
 
           machine.start()
-          machine.wait_for_unit("postgresql")
+          machine.wait_for_unit("postgresql.target")
 
           with subtest("Postgresql is available just after unit start"):
               machine.succeed(
@@ -94,7 +94,7 @@ let
               import time
               time.sleep(2)
               machine.start()
-              machine.wait_for_unit("postgresql")
+              machine.wait_for_unit("postgresql.target")
 
           machine.fail(check_count("SELECT * FROM sth;", 3))
           machine.succeed(check_count("SELECT * FROM sth;", 5))
@@ -219,7 +219,7 @@ let
         ''
           import json
           machine.start()
-          machine.wait_for_unit("postgresql")
+          machine.wait_for_unit("postgresql.target")
 
           with subtest("All user permissions are set according to the ensureClauses attr"):
               clauses = json.loads(
diff --git a/nixos/tests/postgresql/wal2json.nix b/nixos/tests/postgresql/wal2json.nix
index 1252264353f8..708c24ebabd6 100644
--- a/nixos/tests/postgresql/wal2json.nix
+++ b/nixos/tests/postgresql/wal2json.nix
@@ -27,7 +27,7 @@ let
       };
 
       testScript = ''
-        machine.wait_for_unit("postgresql")
+        machine.wait_for_unit("postgresql.target")
         machine.succeed(
             "sudo -u postgres psql -qAt -f ${./wal2json/example2.sql} postgres > /tmp/example2.out"
         )
diff --git a/nixos/tests/postgrest.nix b/nixos/tests/postgrest.nix
index bc503c41893c..9e8204e8492e 100644
--- a/nixos/tests/postgrest.nix
+++ b/nixos/tests/postgrest.nix
@@ -57,7 +57,7 @@
     ''
       import jwt
 
-      machine.wait_for_unit("postgresql.service")
+      machine.wait_for_unit("postgresql.target")
 
       def wait_for_postgrest():
           machine.wait_for_unit("postgrest.service")
diff --git a/nixos/tests/powerdns-admin.nix b/nixos/tests/powerdns-admin.nix
index 0ed31f46607f..9165fb15de81 100644
--- a/nixos/tests/powerdns-admin.nix
+++ b/nixos/tests/powerdns-admin.nix
@@ -92,7 +92,7 @@ let
           '';
         };
         systemd.services.powerdns-admin = {
-          after = [ "postgresql.service" ];
+          after = [ "postgresql.target" ];
           serviceConfig.BindPaths = "/run/postgresql";
         };
 
diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix
index 9cc455466bdf..010e912b563a 100644
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@@ -1121,7 +1121,7 @@ let
         };
       };
       exporterTest = ''
-        wait_for_unit("postgresql.service")
+        wait_for_unit("postgresql.target")
         wait_for_unit("pgbouncer.service")
         wait_for_unit("prometheus-pgbouncer-exporter.service")
         wait_for_open_port(9127)
@@ -1254,18 +1254,18 @@ let
       exporterTest = ''
         wait_for_unit("prometheus-postgres-exporter.service")
         wait_for_open_port(9187)
-        wait_for_unit("postgresql.service")
+        wait_for_unit("postgresql.target")
         succeed(
             "curl -sSf http://localhost:9187/metrics | grep 'pg_exporter_last_scrape_error 0'"
         )
         succeed("curl -sSf http://localhost:9187/metrics | grep 'pg_up 1'")
-        systemctl("stop postgresql.service")
+        systemctl("stop postgresql")
         succeed(
             "curl -sSf http://localhost:9187/metrics | grep -v 'pg_exporter_last_scrape_error 0'"
         )
         succeed("curl -sSf http://localhost:9187/metrics | grep 'pg_up 0'")
-        systemctl("start postgresql.service")
-        wait_for_unit("postgresql.service")
+        systemctl("start postgresql")
+        wait_for_unit("postgresql.target")
         succeed(
             "curl -sSf http://localhost:9187/metrics | grep 'pg_exporter_last_scrape_error 0'"
         )
@@ -1609,7 +1609,7 @@ let
             GRANT SELECT ON points TO "prometheus-sql-exporter";
           '';
         };
-        systemd.services.prometheus-sql-exporter.after = [ "postgresql.service" ];
+        systemd.services.prometheus-sql-exporter.after = [ "postgresql.target" ];
       };
       exporterTest = ''
         wait_for_unit("prometheus-sql-exporter.service")
diff --git a/nixos/tests/roundcube.nix b/nixos/tests/roundcube.nix
index c631c97d6827..0010d3141e33 100644
--- a/nixos/tests/roundcube.nix
+++ b/nixos/tests/roundcube.nix
@@ -30,7 +30,7 @@
 
   testScript = ''
     roundcube.start
-    roundcube.wait_for_unit("postgresql.service")
+    roundcube.wait_for_unit("postgresql.target")
     roundcube.wait_for_unit("phpfpm-roundcube.service")
     roundcube.wait_for_unit("nginx.service")
     roundcube.succeed("curl -sSfL http://roundcube/ | grep 'Keep me logged in'")
diff --git a/nixos/tests/sftpgo.nix b/nixos/tests/sftpgo.nix
index 883f39966246..c2090c8bb180 100644
--- a/nixos/tests/sftpgo.nix
+++ b/nixos/tests/sftpgo.nix
@@ -216,7 +216,7 @@ in
         };
 
         systemd.services.sftpgo = {
-          after = [ "postgresql.service" ];
+          after = [ "postgresql.target" ];
           environment = {
             # Update existing users
             SFTPGO_LOADDATA_MODE = "0";
diff --git a/nixos/tests/tandoor-recipes.nix b/nixos/tests/tandoor-recipes.nix
index 0b2211af22fa..09a803c98855 100644
--- a/nixos/tests/tandoor-recipes.nix
+++ b/nixos/tests/tandoor-recipes.nix
@@ -29,7 +29,7 @@
 
       systemd.services = {
         tandoor-recipes = {
-          after = [ "postgresql.service" ];
+          after = [ "postgresql.target" ];
         };
       };
     };
diff --git a/nixos/tests/vault-postgresql.nix b/nixos/tests/vault-postgresql.nix
index b0ccb6ae0456..bf5f1ee8ab7e 100644
--- a/nixos/tests/vault-postgresql.nix
+++ b/nixos/tests/vault-postgresql.nix
@@ -25,7 +25,7 @@
 
       systemd.services.vault = {
         after = [
-          "postgresql.service"
+          "postgresql.target"
         ];
         # Try for about 10 minutes rather than the default of 5 attempts.
         serviceConfig.RestartSec = 1;
diff --git a/nixos/tests/vaultwarden.nix b/nixos/tests/vaultwarden.nix
index 69436044ce47..d367d372ae9d 100644
--- a/nixos/tests/vaultwarden.nix
+++ b/nixos/tests/vaultwarden.nix
@@ -138,7 +138,7 @@ let
 
                     services.vaultwarden.config.databaseUrl = "postgresql:///vaultwarden?host=/run/postgresql";
 
-                    systemd.services.vaultwarden.after = [ "postgresql.service" ];
+                    systemd.services.vaultwarden.after = [ "postgresql.target" ];
                   };
 
                   sqlite = {
diff --git a/nixos/tests/web-apps/gotosocial.nix b/nixos/tests/web-apps/gotosocial.nix
index ecbf62fe8b6b..d9e50ecaa150 100644
--- a/nixos/tests/web-apps/gotosocial.nix
+++ b/nixos/tests/web-apps/gotosocial.nix
@@ -20,7 +20,7 @@
 
   testScript = ''
     machine.wait_for_unit("gotosocial.service")
-    machine.wait_for_unit("postgresql.service")
+    machine.wait_for_unit("postgresql.target")
     machine.wait_for_open_port(8081)
     # Database migrations are running, wait until gotosocial no longer serves 503
     machine.wait_until_succeeds("curl -sS -f http://localhost:8081/readyz", timeout=300)
diff --git a/nixos/tests/web-apps/mastodon/remote-databases.nix b/nixos/tests/web-apps/mastodon/remote-databases.nix
index 24709fe0df07..8b49a908de42 100644
--- a/nixos/tests/web-apps/mastodon/remote-databases.nix
+++ b/nixos/tests/web-apps/mastodon/remote-databases.nix
@@ -207,7 +207,7 @@ import ../../make-test-python.nix (
         nginx.wait_for_unit("nginx.service")
         nginx.wait_for_open_port(443)
         databases.wait_for_unit("redis-mastodon.service")
-        databases.wait_for_unit("postgresql.service")
+        databases.wait_for_unit("postgresql.target")
         databases.wait_for_open_port(31637)
         databases.wait_for_open_port(5432)
       '';
diff --git a/nixos/tests/web-apps/mastodon/standard.nix b/nixos/tests/web-apps/mastodon/standard.nix
index 3437900741a9..d4769d4b39ec 100644
--- a/nixos/tests/web-apps/mastodon/standard.nix
+++ b/nixos/tests/web-apps/mastodon/standard.nix
@@ -101,7 +101,7 @@ import ../../make-test-python.nix (
         server.wait_for_unit("nginx.service")
         server.wait_for_open_port(443)
         server.wait_for_unit("redis-mastodon.service")
-        server.wait_for_unit("postgresql.service")
+        server.wait_for_unit("postgresql.target")
         server.wait_for_open_port(5432)
       '';
     };
diff --git a/nixos/tests/web-apps/peertube.nix b/nixos/tests/web-apps/peertube.nix
index e260786458e4..c3e1320c8d5a 100644
--- a/nixos/tests/web-apps/peertube.nix
+++ b/nixos/tests/web-apps/peertube.nix
@@ -142,7 +142,7 @@ import ../make-test-python.nix (
     testScript = ''
       start_all()
 
-      database.wait_for_unit("postgresql.service")
+      database.wait_for_unit("postgresql.target")
       database.wait_for_unit("redis-peertube.service")
 
       database.wait_for_open_port(5432)
diff --git a/nixos/tests/wiki-js.nix b/nixos/tests/wiki-js.nix
index 947f3a9afe9d..9129ca688dcc 100644
--- a/nixos/tests/wiki-js.nix
+++ b/nixos/tests/wiki-js.nix
@@ -27,8 +27,8 @@
         ];
       };
       systemd.services.wiki-js = {
-        requires = [ "postgresql.service" ];
-        after = [ "postgresql.service" ];
+        requires = [ "postgresql.target" ];
+        after = [ "postgresql.target" ];
       };
       environment.systemPackages = with pkgs; [ jq ];
     };
diff --git a/nixos/tests/zammad.nix b/nixos/tests/zammad.nix
index d5b668e1e878..03778784cbfc 100644
--- a/nixos/tests/zammad.nix
+++ b/nixos/tests/zammad.nix
@@ -21,7 +21,7 @@
 
   testScript = ''
     start_all()
-    machine.wait_for_unit("postgresql.service")
+    machine.wait_for_unit("postgresql.target")
     machine.wait_for_unit("redis-zammad.service")
     machine.wait_for_unit("zammad-web.service")
     machine.wait_for_unit("zammad-websocket.service")
diff --git a/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix b/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix
index c731d9bc3535..d9445f9b7205 100644
--- a/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix
+++ b/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-pce-fast";
-  version = "0-unstable-2025-04-18";
+  version = "0-unstable-2025-06-27";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-pce-fast-libretro";
-    rev = "baa35513545b011faa8b0b5db334d24ba15539ed";
-    hash = "sha256-jEvbHCK9AB4u3raWbAivscHqBiH9s+RkgExTVW1yvnk=";
+    rev = "04a6f2e85c7b4e79bb1bb402a8ea7d8f55132ad3";
+    hash = "sha256-xA2owDEe9o0+roxZ+GBM4LD7sBDGC9ZY5atwWVA8HC8=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/beetle-pce.nix b/pkgs/applications/emulators/libretro/cores/beetle-pce.nix
index 346ebc6cb3b6..bac547cb0458 100644
--- a/pkgs/applications/emulators/libretro/cores/beetle-pce.nix
+++ b/pkgs/applications/emulators/libretro/cores/beetle-pce.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-pce";
-  version = "0-unstable-2024-11-15";
+  version = "0-unstable-2025-06-22";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-pce-libretro";
-    rev = "af28fb0385d00e0292c4703b3aa7e72762b564d2";
-    hash = "sha256-W+74RTIidSUdviihLy926OvlSdqMECvOLEEiWMtB50w=";
+    rev = "9a301c0773c53702a882bbaa42ee9cbc6d523787";
+    hash = "sha256-RS5omi6LthQy8fFfouSEpYtaeD7QDlRENm0YuqHzUc0=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/picodrive.nix b/pkgs/applications/emulators/libretro/cores/picodrive.nix
index 59ab241ed787..3243a67b17b1 100644
--- a/pkgs/applications/emulators/libretro/cores/picodrive.nix
+++ b/pkgs/applications/emulators/libretro/cores/picodrive.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "picodrive";
-  version = "0-unstable-2025-04-10";
+  version = "0-unstable-2025-05-31";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "picodrive";
-    rev = "c4332d608c1005a46ce51236ade9894e0d32e52b";
-    hash = "sha256-qu5pnqHHO/k8OO2XXwd/H7AQsutmnMz+RBT6ZZFXZgk=";
+    rev = "975cdafb613e84e305f87b43e70d1e19df7e60e0";
+    hash = "sha256-hRM3DtaTVz35QEkUrPoNXHdS7TgazWIFKU1e+jjfigg=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/graphics/apitrace/default.nix b/pkgs/applications/graphics/apitrace/default.nix
index 6db2925644d5..6d32b12e7115 100644
--- a/pkgs/applications/graphics/apitrace/default.nix
+++ b/pkgs/applications/graphics/apitrace/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "apitrace";
-  version = "12.0";
+  version = "13.0";
 
   src = fetchFromGitHub {
     owner = "apitrace";
     repo = "apitrace";
     rev = version;
-    hash = "sha256-Y2ceE0F7q5tP64Mtvkc7JHOZQN30MDVCPHfiWDnfTSQ=";
+    hash = "sha256-ZZ2RL9nvwvHBEuKSDr1tgRhxBeg+XJKPUvSiHz6g/cg=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/misc/lyx/default.nix b/pkgs/applications/misc/lyx/default.nix
index 8a89807bd6fe..991f6f809bf2 100644
--- a/pkgs/applications/misc/lyx/default.nix
+++ b/pkgs/applications/misc/lyx/default.nix
@@ -13,12 +13,12 @@
 }:
 
 mkDerivation rec {
-  version = "2.4.3";
+  version = "2.4.4";
   pname = "lyx";
 
   src = fetchurl {
     url = "ftp://ftp.lyx.org/pub/lyx/stable/2.4.x/${pname}-${version}.tar.xz";
-    hash = "sha256-+mdh9ZilkVr1CkI90qYHBIvbxUCm1XI4X+Qi31ge6/Y=";
+    hash = "sha256-/6zTdIDzIPPz+PMERf5AiX6d9EyU7oe6BBPjZAhvS5A=";
   };
 
   # LaTeX is used from $PATH, as people often want to have it with extra pkgs
diff --git a/pkgs/applications/misc/qcad/default.nix b/pkgs/applications/misc/qcad/default.nix
index 699afb8a6a5f..95735cbaf14e 100644
--- a/pkgs/applications/misc/qcad/default.nix
+++ b/pkgs/applications/misc/qcad/default.nix
@@ -19,14 +19,14 @@
 
 stdenv.mkDerivation rec {
   pname = "qcad";
-  version = "3.32.1.0";
+  version = "3.32.3.1";
 
   src = fetchFromGitHub {
     name = "qcad-${version}-src";
     owner = "qcad";
     repo = "qcad";
     rev = "v${version}";
-    hash = "sha256-3P6iudD/swpNDPL4G8isJI6zxqc6/rmHAMpPnEwnuiM=";
+    hash = "sha256-YK5x0TbmJYOvciDZGj4rHN4bo89oS1t2Zulk9kJscj8=";
   };
 
   patches = [
diff --git a/pkgs/applications/networking/cluster/calico/default.nix b/pkgs/applications/networking/cluster/calico/default.nix
index c6c50c4cb9df..c4f5415c4cb9 100644
--- a/pkgs/applications/networking/cluster/calico/default.nix
+++ b/pkgs/applications/networking/cluster/calico/default.nix
@@ -14,16 +14,16 @@ builtins.mapAttrs
     }:
     buildGoModule rec {
       inherit pname;
-      version = "3.30.0";
+      version = "3.30.1";
 
       src = fetchFromGitHub {
         owner = "projectcalico";
         repo = "calico";
         rev = "v${version}";
-        hash = "sha256-twq0Yp2M1f9qtcAQ+kcZoBxXXtw1VrV9ZrtEnEPv+Ks=";
+        hash = "sha256-MtUoVLF46Z+wnxahZqTAfZwbLOC9gfHAUtIAwAJGUn0=";
       };
 
-      vendorHash = "sha256-hvAFSr64YsGaSbbG3aEsSO+gprtQy51/BsdYAhAgH3Q=";
+      vendorHash = "sha256-5VFjiKFBZIXorc0yd9Vafyaj5ZInkhAD1GIdAw4yaEs=";
 
       inherit doCheck subPackages;
 
diff --git a/pkgs/applications/networking/instant-messengers/psi-plus/default.nix b/pkgs/applications/networking/instant-messengers/psi-plus/default.nix
index 95d847a77b9f..f34afe35601e 100644
--- a/pkgs/applications/networking/instant-messengers/psi-plus/default.nix
+++ b/pkgs/applications/networking/instant-messengers/psi-plus/default.nix
@@ -46,12 +46,12 @@ assert enablePsiMedia -> enablePlugins;
 mkDerivation rec {
   pname = "psi-plus";
 
-  version = "1.5.2072";
+  version = "1.5.2081";
   src = fetchFromGitHub {
     owner = "psi-plus";
     repo = "psi-plus-snapshots";
     rev = version;
-    sha256 = "sha256-RlZwMBWjhCTEEV08UHbf8NvuqmuihXwR1aA/vMmD1BM=";
+    sha256 = "sha256-C5EFC6HpUEFb5P3yGAwlhpj7MhS16P6fkKD5GjC3J9I=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/applications/office/mendeley/default.nix b/pkgs/applications/office/mendeley/default.nix
index 35f8a12384f3..2e08508ef6f5 100644
--- a/pkgs/applications/office/mendeley/default.nix
+++ b/pkgs/applications/office/mendeley/default.nix
@@ -8,13 +8,13 @@
 
 let
   pname = "mendeley";
-  version = "2.134.0";
+  version = "2.135.0";
 
   executableName = "${pname}-reference-manager";
 
   src = fetchurl {
     url = "https://static.mendeley.com/bin/desktop/mendeley-reference-manager-${version}-x86_64.AppImage";
-    hash = "sha256-Wl4d89PjPeoiNe+7TIpJiW0GLZhfNTM0+z4n8ExjAQk=";
+    hash = "sha256-fJ2rW3VKN4TqwDCCDlPpSFckoBjBtmMOvXanqqMS7AM=";
   };
 
   appimageContents = appimageTools.extractType2 {
diff --git a/pkgs/applications/science/misc/boinc/default.nix b/pkgs/applications/science/misc/boinc/default.nix
index c9e047fba632..cdf2609e6372 100644
--- a/pkgs/applications/science/misc/boinc/default.nix
+++ b/pkgs/applications/science/misc/boinc/default.nix
@@ -28,14 +28,14 @@
 
 stdenv.mkDerivation rec {
   pname = "boinc";
-  version = "8.2.2";
+  version = "8.2.4";
 
   src = fetchFromGitHub {
     name = "${pname}-${version}-src";
     owner = "BOINC";
     repo = "boinc";
     rev = "client_release/${lib.versions.majorMinor version}/${version}";
-    hash = "sha256-Q++34JKmJCciK53fmMPUxOPr35+Nd7YPYR4SwKOldQA=";
+    hash = "sha256-VRYkh7MM8Oq1/alSbZL1w76DtUc0731VAMLUZW32rA8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix b/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
index d03faf8c63c7..ffd253934ab6 100644
--- a/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/advanced-scene-switcher/default.nix
@@ -36,13 +36,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "advanced-scene-switcher";
-  version = "1.30.1";
+  version = "1.30.2";
 
   src = fetchFromGitHub {
     owner = "WarmUpTill";
     repo = "SceneSwitcher";
     rev = version;
-    hash = "sha256-UTgOZK4SFjTcbAGQGY4kQbaskWhKA5fAkHBPNlPYzxo=";
+    hash = "sha256-Qn6tezrqLAvNeHlyW0VYPr8DWw25GUOARY9n6m3KsA8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/_1/_1password-gui/sources.json b/pkgs/by-name/_1/_1password-gui/sources.json
index c8641d52ce56..da7be0cc192d 100644
--- a/pkgs/by-name/_1/_1password-gui/sources.json
+++ b/pkgs/by-name/_1/_1password-gui/sources.json
@@ -1,28 +1,28 @@
 {
   "stable": {
     "linux": {
-      "version": "8.10.80",
+      "version": "8.10.82",
       "sources": {
         "x86_64": {
-          "url": "https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.10.80.x64.tar.gz",
-          "hash": "sha256-fxhLeeJzzbIhRZcrLnkBvrwAA+jzGeOhnmiH3ErlDTE="
+          "url": "https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.10.82.x64.tar.gz",
+          "hash": "sha256-/mpp+HRQO7Xu+faYUzq00LxFrDRTod7Wvro3IoVGFAg="
         },
         "aarch64": {
-          "url": "https://downloads.1password.com/linux/tar/stable/aarch64/1password-8.10.80.arm64.tar.gz",
-          "hash": "sha256-Ffr7Xow6ZMGE4Spf3QfDoSydR3OXasMpM3ttiiPup+Q="
+          "url": "https://downloads.1password.com/linux/tar/stable/aarch64/1password-8.10.82.arm64.tar.gz",
+          "hash": "sha256-DiZVlq0xVGeCh6x5Bt8KP7B0iC15prvQrd9dnAmjWCI="
         }
       }
     },
     "darwin": {
-      "version": "8.10.80",
+      "version": "8.10.82",
       "sources": {
         "x86_64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.10.80-x86_64.zip",
-          "hash": "sha256-4b7mocNt/H9xiai9E9pqT5LWNsRi6Skr+F1vctfmU3k="
+          "url": "https://downloads.1password.com/mac/1Password-8.10.82-x86_64.zip",
+          "hash": "sha256-LATm0OcX+i02X3byaKQA32PpOXDyQFzyJVOgNzgtfYM="
         },
         "aarch64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.10.80-aarch64.zip",
-          "hash": "sha256-8PJq6VVTAMQWLP9rLwOhtK02KZckn7ps4evDPL6EvYs="
+          "url": "https://downloads.1password.com/mac/1Password-8.10.82-aarch64.zip",
+          "hash": "sha256-uXtXDfCE+CFaOXqpSEKh2x7lzeYOhrHoH017NzNS2p8="
         }
       }
     }
@@ -42,15 +42,15 @@
       }
     },
     "darwin": {
-      "version": "8.10.82-27.BETA",
+      "version": "8.11.0-25.BETA",
       "sources": {
         "x86_64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.10.82-27.BETA-x86_64.zip",
-          "hash": "sha256-jCxzPxRvb7gjhDeZVcTcuED4N436aJsivpfgae9dVc0="
+          "url": "https://downloads.1password.com/mac/1Password-8.11.0-25.BETA-x86_64.zip",
+          "hash": "sha256-9cE31VdYoxFnxsO0jOLQsXA2SEBUdy7ABvUIfsGEE04="
         },
         "aarch64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.10.82-27.BETA-aarch64.zip",
-          "hash": "sha256-PibtIpKpyp0+jkzZ9odNow6Gew/fjWy9EvdIgeewpA4="
+          "url": "https://downloads.1password.com/mac/1Password-8.11.0-25.BETA-aarch64.zip",
+          "hash": "sha256-bxBoJZSt7znOhiIu20Nuq5MzNyS1HzLkNyt/cgY1dBg="
         }
       }
     }
diff --git a/pkgs/by-name/ab/abbaye-des-morts/package.nix b/pkgs/by-name/ab/abbaye-des-morts/package.nix
index 779d0a03c355..baed89f1b682 100644
--- a/pkgs/by-name/ab/abbaye-des-morts/package.nix
+++ b/pkgs/by-name/ab/abbaye-des-morts/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "abbaye-des-morts";
-  version = "2.0.4";
+  version = "2.0.5";
 
   src = fetchFromGitHub {
     owner = "nevat";
     repo = "abbayedesmorts-gpl";
     tag = "v${version}";
-    sha256 = "sha256-IU7E1zmeif9CdoBxzmh7MG2jElGGnEZyKnK7eYFrjsQ=";
+    sha256 = "sha256-muJt1cml0nYdgl0v8cudpUXcdSntc49e6zICTCwzkks=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/ac/activemq/package.nix b/pkgs/by-name/ac/activemq/package.nix
index 427e8e81bf7c..56ba6f4e4915 100644
--- a/pkgs/by-name/ac/activemq/package.nix
+++ b/pkgs/by-name/ac/activemq/package.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "6.1.6";
+  version = "6.1.7";
 in
 stdenvNoCC.mkDerivation {
   pname = "activemq";
@@ -13,7 +13,7 @@ stdenvNoCC.mkDerivation {
 
   src = fetchurl {
     url = "mirror://apache/activemq/${version}/apache-activemq-${version}-bin.tar.gz";
-    hash = "sha256-MqxpLaSG1+goGVht08VmG7u11tQlmYMqSUeXBYYI8KQ=";
+    hash = "sha256-dcxBEJqJd0XUSsonNYVo88vgzVj8a7/wNag8Td9I0xY=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/ap/apt/package.nix b/pkgs/by-name/ap/apt/package.nix
index b9dc36c49317..0e7f33d3ba14 100644
--- a/pkgs/by-name/ap/apt/package.nix
+++ b/pkgs/by-name/ap/apt/package.nix
@@ -34,14 +34,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "apt";
-  version = "3.1.0";
+  version = "3.1.2";
 
   src = fetchFromGitLab {
     domain = "salsa.debian.org";
     owner = "apt-team";
     repo = "apt";
     rev = finalAttrs.version;
-    hash = "sha256-Yw72q6o1Q6HPEMbgd/WE6erPqMDfyn2Ax5n1O9BVmRU=";
+    hash = "sha256-Mz8WCOPdEVStH9WLmpHAN22bsn59h8eQoK0h7ssDQrQ=";
   };
 
   # cycle detection; lib can't be split
diff --git a/pkgs/by-name/aw/aws-iam-authenticator/package.nix b/pkgs/by-name/aw/aws-iam-authenticator/package.nix
index dd8ebcf2987e..10ae6c911a40 100644
--- a/pkgs/by-name/aw/aws-iam-authenticator/package.nix
+++ b/pkgs/by-name/aw/aws-iam-authenticator/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "aws-iam-authenticator";
-  version = "0.7.2";
+  version = "0.7.3";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = "aws-iam-authenticator";
     tag = "v${version}";
-    hash = "sha256-ZoK6GYAGNIRNzKAn1m5SaytBwEpufqDBWo2oJB4YA8c=";
+    hash = "sha256-mr13gHMq7ZtoxToQu0WokTec0JC2e8msYUIB05U4zfw=";
   };
 
-  vendorHash = "sha256-OEiU9m5oQ7zQDp6OAj2L7wk61ul7zSDXyxIVthfkpQg=";
+  vendorHash = "sha256-mne3oVfcsfZ5ECYiJujhJU6dxSax972TG5nM2oMGuCE=";
 
   ldflags =
     let
diff --git a/pkgs/by-name/aw/aws-lc/package.nix b/pkgs/by-name/aw/aws-lc/package.nix
index bff516e152c7..de89ba8f5897 100644
--- a/pkgs/by-name/aw/aws-lc/package.nix
+++ b/pkgs/by-name/aw/aws-lc/package.nix
@@ -10,13 +10,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-lc";
-  version = "1.52.0";
+  version = "1.53.1";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-lc";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-C9xtkE0aUtvhRzsN7T7zeQKX7TwA5E+bFq6qSmU2+C8=";
+    hash = "sha256-1liZ1xellboNNsL7D6vqYk9sHFpWN5c0o8B1S9B5Gnc=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/bc/bcc/package.nix b/pkgs/by-name/bc/bcc/package.nix
index 448ba00b68bf..c45d4b854b7e 100644
--- a/pkgs/by-name/bc/bcc/package.nix
+++ b/pkgs/by-name/bc/bcc/package.nix
@@ -22,7 +22,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "bcc";
-  version = "0.34.0";
+  version = "0.35.0";
 
   disabled = !stdenv.hostPlatform.isLinux;
 
@@ -30,7 +30,7 @@ python3Packages.buildPythonApplication rec {
     owner = "iovisor";
     repo = "bcc";
     tag = "v${version}";
-    hash = "sha256-sSHEsvTtqPpfxSevmjciQ+xFj+4G4GE4ExWoIYc+DQI=";
+    hash = "sha256-eP/VEq7cPALi2oDKAZFQGQ3NExdmcBKyi6ddRZiYmbI=";
   };
   format = "other";
 
diff --git a/pkgs/by-name/be/benthos/package.nix b/pkgs/by-name/be/benthos/package.nix
index 3f7de08e3406..a6d44799fd9c 100644
--- a/pkgs/by-name/be/benthos/package.nix
+++ b/pkgs/by-name/be/benthos/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "benthos";
-  version = "4.52.0";
+  version = "4.53.0";
 
   src = fetchFromGitHub {
     owner = "redpanda-data";
     repo = "benthos";
     tag = "v${version}";
-    hash = "sha256-TGGDZzjVgRADJq5u4b5RznVzIxk2EUKM3Y2rbhgv7yQ=";
+    hash = "sha256-IcyU7YjAEqQnCDrUNnyBAQmnum8C17zQTbN0YWVyodA=";
   };
 
   proxyVendor = true;
@@ -22,7 +22,7 @@ buildGoModule rec {
     "cmd/benthos"
   ];
 
-  vendorHash = "sha256-lNn/lqY1Q/8mRERrgPuE9GEun6tqrVQjtVUGRJk5W+0=";
+  vendorHash = "sha256-4Za0meD/cI20rLU79oUdwaKCGBLgQQhkisKUNX/Koow=";
 
   #  doCheck = false;
 
diff --git a/pkgs/by-name/bl/bluemap/package.nix b/pkgs/by-name/bl/bluemap/package.nix
index a0bcb5135a3e..bf58ad0b2e46 100644
--- a/pkgs/by-name/bl/bluemap/package.nix
+++ b/pkgs/by-name/bl/bluemap/package.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "bluemap";
-  version = "5.7";
+  version = "5.8";
 
   src = fetchurl {
     url = "https://github.com/BlueMap-Minecraft/BlueMap/releases/download/v${version}/BlueMap-${version}-cli.jar";
-    hash = "sha256-8udZYJgrr4bi2mjRYrASd8JwUoUVZW1tZpOLRgafAIw=";
+    hash = "sha256-9sIs4+YMiGPmIuHABDUl/QWjyjKxLFd4kzwJ8PYwPsk=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/bo/bootstrap-studio/package.nix b/pkgs/by-name/bo/bootstrap-studio/package.nix
index 7b891dfdf98e..c98eb7e5e54c 100644
--- a/pkgs/by-name/bo/bootstrap-studio/package.nix
+++ b/pkgs/by-name/bo/bootstrap-studio/package.nix
@@ -6,10 +6,10 @@
 
 let
   pname = "bootstrap-studio";
-  version = "7.0.3";
+  version = "7.1.1";
   src = fetchurl {
     url = "https://releases.bootstrapstudio.io/${version}/Bootstrap%20Studio.AppImage";
-    sha256 = "sha256-QfIZ2Gn1XT27Y6B0452MMWiHnJfPEWy79VY5vZxtlyE=";
+    sha256 = "sha256-R9cgCLJGFO8B1PB/7YHtWyXidElW84hJCwxRME5kYGc=";
   };
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
 in
diff --git a/pkgs/by-name/br/broot/package.nix b/pkgs/by-name/br/broot/package.nix
index 78e33f9a819c..82a961dae3c6 100644
--- a/pkgs/by-name/br/broot/package.nix
+++ b/pkgs/by-name/br/broot/package.nix
@@ -16,17 +16,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "broot";
-  version = "1.46.5";
+  version = "1.47.0";
 
   src = fetchFromGitHub {
     owner = "Canop";
     repo = "broot";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ySW7bEM74D83Id1Jp5UBEjqJROjwcoHrDY8wbgEVCGM=";
+    hash = "sha256-BX54J43bUa73WCxCmYQ2VgXhURRiJG5Do1ofsFFY38Y=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-rSX+DdvqqThCxA1ONAYQbhWrdYDQHOMiXURqd+KSw64=";
+  cargoHash = "sha256-7F93oPDXHznwkZZVqdgEuIb5sxa7uElBkwUr/PDIsdo=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/br/bruno-cli/package.nix b/pkgs/by-name/br/bruno-cli/package.nix
index 343ebd315164..3f7e1f9cfddf 100644
--- a/pkgs/by-name/br/bruno-cli/package.nix
+++ b/pkgs/by-name/br/bruno-cli/package.nix
@@ -30,6 +30,11 @@ buildNpmPackage {
     pango
   ];
 
+  postConfigure = ''
+    # sh: line 1: /build/source/packages/bruno-converters/node_modules/.bin/rimraf: cannot execute: required file not found
+    patchShebangs packages/*/node_modules
+  '';
+
   ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
 
   buildPhase = ''
@@ -37,6 +42,7 @@ buildNpmPackage {
 
     npm run build --workspace=packages/bruno-common
     npm run build --workspace=packages/bruno-graphql-docs
+    npm run build --workspace=packages/bruno-converters
     npm run build --workspace=packages/bruno-query
     npm run build --workspace=packages/bruno-requests
 
@@ -59,7 +65,7 @@ buildNpmPackage {
     rm node_modules/@usebruno/{app,tests,toml,schema}
 
     # heavy dependencies that seem to be unused
-    rm -rf node_modules/{@tabler,pdfjs-dist,*redux*,*babel*,prettier,@types*,*react*,*graphiql*}
+    rm -rf node_modules/{@tabler,pdfjs-dist,*redux*,prettier,@types*,*react*,*graphiql*}
     rm -r node_modules/.bin
 
     # unused file types
diff --git a/pkgs/by-name/ch/checkstyle/package.nix b/pkgs/by-name/ch/checkstyle/package.nix
index bd8c68623eaf..b730eeeeaced 100644
--- a/pkgs/by-name/ch/checkstyle/package.nix
+++ b/pkgs/by-name/ch/checkstyle/package.nix
@@ -7,12 +7,12 @@
 }:
 
 stdenvNoCC.mkDerivation rec {
-  version = "10.25.0";
+  version = "10.25.1";
   pname = "checkstyle";
 
   src = fetchurl {
     url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-${version}/checkstyle-${version}-all.jar";
-    sha256 = "sha256-CnzGj5jVQIzv5BZ5h0cDLJZrB0DgdRXWIYdKbzWtOA0=";
+    sha256 = "sha256-dRihSzEcq/IEBwrvrXoYfx13PHhdzPt7ldv0EuU1RiE=";
   };
 
   nativeBuildInputs = [ makeBinaryWrapper ];
diff --git a/pkgs/by-name/ch/cherry-studio/package.nix b/pkgs/by-name/ch/cherry-studio/package.nix
index 0e54d0850aa8..1d55db5e78fa 100644
--- a/pkgs/by-name/ch/cherry-studio/package.nix
+++ b/pkgs/by-name/ch/cherry-studio/package.nix
@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "cherry-studio";
-  version = "1.4.2";
+  version = "1.4.3";
 
   src = fetchFromGitHub {
     owner = "CherryHQ";
     repo = "cherry-studio";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-P7nam15AhwFIy3qisp2cogJeCGe0sgNnF+eFl4ssf0Q=";
+    hash = "sha256-XDz5JJF9ntVYPzItRsdnTiiIPSHmtfCdZrhD0KpJNyI=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/co/coroot-node-agent/package.nix b/pkgs/by-name/co/coroot-node-agent/package.nix
index 296ebec01e9a..9912cd7b839e 100644
--- a/pkgs/by-name/co/coroot-node-agent/package.nix
+++ b/pkgs/by-name/co/coroot-node-agent/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "coroot-node-agent";
-  version = "1.24.0";
+  version = "1.25.1";
 
   src = fetchFromGitHub {
     owner = "coroot";
     repo = "coroot-node-agent";
     rev = "v${version}";
-    hash = "sha256-48bKV1z5D8FhRIm5cl5PcJ2pVGux6sV985Hk855B8Ng=";
+    hash = "sha256-efQDMPPkuECz1gdQmoUqNwGBlwPbuabM/xicUkG4fbs=";
   };
 
-  vendorHash = "sha256-wOR0xdI+5oP+wZwyXKgWHQyUVMNH7yRk1h1m4vCEXTs=";
+  vendorHash = "sha256-QvdFW/o481F85WuXNdz99Q9MBiGRjVSWvPRytq67vYU=";
 
   buildInputs = [ systemdLibs ];
 
diff --git a/pkgs/by-name/co/coturn/package.nix b/pkgs/by-name/co/coturn/package.nix
index 26cd5ab12e56..8752afe1c2a2 100644
--- a/pkgs/by-name/co/coturn/package.nix
+++ b/pkgs/by-name/co/coturn/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "coturn";
-  version = "4.6.3";
+  version = "4.7.0";
 
   src = fetchFromGitHub {
     owner = "coturn";
     repo = "coturn";
     tag = version;
-    hash = "sha256-GG8aQJoCBV5wolPEzSuZhqNn//ytaTAptjY42YKga4E=";
+    hash = "sha256-nvImelAvcbHpv6JTxX+sKpldVXG6u9Biu+VDt95r9I4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cr/crosvm/package.nix b/pkgs/by-name/cr/crosvm/package.nix
index f7dd05a63c6a..53e5b50e475a 100644
--- a/pkgs/by-name/cr/crosvm/package.nix
+++ b/pkgs/by-name/cr/crosvm/package.nix
@@ -21,19 +21,19 @@
 
 rustPlatform.buildRustPackage {
   pname = "crosvm";
-  version = "0-unstable-2025-06-17";
+  version = "0-unstable-2025-06-26";
 
   src = fetchgit {
     url = "https://chromium.googlesource.com/chromiumos/platform/crosvm";
-    rev = "49e226a57f905b00e44a996c93d9a2439dcb86f3";
-    hash = "sha256-+HtF9nBv6unnrav5Z84xSOhK+RrlOFBHed6SiuHAcfs=";
+    rev = "4c8cd6ddfd940a1f61178bb469a2bb7274bc07b1";
+    hash = "sha256-6Io0Vj5QG6BwAlcgB0KyQlsRU3Z/elvd1oXt2w+hgBM=";
     fetchSubmodules = true;
   };
 
   separateDebugInfo = true;
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-3NcQQZCsR3ekPBbe/ai8ke3MxBy0ONg1TJO9qLSH7jM=";
+  cargoHash = "sha256-k4lVgUNvQ8ySYs33nlyTcUgGxtXpiNEG/cFCAJNpJ+c=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/cr/crowdsec/package.nix b/pkgs/by-name/cr/crowdsec/package.nix
index dac2621c3506..4d0ec7135a5c 100644
--- a/pkgs/by-name/cr/crowdsec/package.nix
+++ b/pkgs/by-name/cr/crowdsec/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "crowdsec";
-  version = "1.6.8";
+  version = "1.6.9";
 
   src = fetchFromGitHub {
     owner = "crowdsecurity";
     repo = "crowdsec";
     tag = "v${version}";
-    hash = "sha256-/NTlj0kYCOMxShfoKdmouJTiookDjccUj5HFHLPn5HI=";
+    hash = "sha256-Gu4Ds9o4CsimMoKqJV2weAQYH34Z7GN3rPbhbtoVuHU=";
   };
 
-  vendorHash = "sha256-7587ezh/9C69UzzQGq3DVGBzNEvTzho/zhRlG6g6tkk=";
+  vendorHash = "sha256-xUzYHVhqyMUQQH5ICkwgaDiFi/L4exROjvJNWS2j9ZU=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/cr/crun/package.nix b/pkgs/by-name/cr/crun/package.nix
index 15b96802f5de..10a4e2bd7b93 100644
--- a/pkgs/by-name/cr/crun/package.nix
+++ b/pkgs/by-name/cr/crun/package.nix
@@ -40,13 +40,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "crun";
-  version = "1.21";
+  version = "1.22";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "crun";
     rev = version;
-    hash = "sha256-uAB/IJ1psGKvOTVhj00VlNadxSKTXvg1eU97bngVblw=";
+    hash = "sha256-6XhwGuV9btN7wuwJuQITHtVTKBcawTuMG8lY22RMdWk=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/do/dotenvx/package.nix b/pkgs/by-name/do/dotenvx/package.nix
index e0dfa9329b8b..3bc9b53d0209 100644
--- a/pkgs/by-name/do/dotenvx/package.nix
+++ b/pkgs/by-name/do/dotenvx/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "dotenvx";
-  version = "1.44.2";
+  version = "1.45.1";
 
   src = fetchFromGitHub {
     owner = "dotenvx";
     repo = "dotenvx";
     tag = "v${version}";
-    hash = "sha256-1G0byz6kaW60yz+eN6TyFxTzyp72RfAWC9y8ZHe0FAQ=";
+    hash = "sha256-qNKRFgZWfIoLwYzB+1fCKR8FOesZEci3bPf/o081wig=";
   };
 
-  npmDepsHash = "sha256-OQJZ9yicdF2xdiomyKDcrmeqXxPtPO/DNtpdQJaSls8=";
+  npmDepsHash = "sha256-qrtVQGbxcyxypyyV2IFcdHs4msJqXBhxISEELR812AA=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/dp/dpkg/package.nix b/pkgs/by-name/dp/dpkg/package.nix
index b5e9ca516b20..c8b0adb974dd 100644
--- a/pkgs/by-name/dp/dpkg/package.nix
+++ b/pkgs/by-name/dp/dpkg/package.nix
@@ -19,12 +19,12 @@
 
 stdenv.mkDerivation rec {
   pname = "dpkg";
-  version = "1.22.19";
+  version = "1.22.20";
 
   src = fetchgit {
     url = "https://git.launchpad.net/ubuntu/+source/dpkg";
     rev = "applied/${version}";
-    hash = "sha256-lSuq5VqBj5yKusZaT50sOf82/wd2FeS4g2ILaZT0HPM=";
+    hash = "sha256-Sw4darMZNFWwvDVBuf0EEdG5Qo2ceiooBrbXWJfCw4o=";
   };
 
   configureFlags = [
diff --git a/pkgs/by-name/ec/ecs-agent/package.nix b/pkgs/by-name/ec/ecs-agent/package.nix
index ddf1b2ec3f89..c94e84423236 100644
--- a/pkgs/by-name/ec/ecs-agent/package.nix
+++ b/pkgs/by-name/ec/ecs-agent/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "amazon-ecs-agent";
-  version = "1.92.0";
+  version = "1.95.0";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "aws";
     repo = "amazon-ecs-agent";
-    hash = "sha256-g0yIJ0W71UGgPZ5m/BaeTCOTAfQ6589wAvYZ15Izt8o=";
+    hash = "sha256-HJrio/Hr2ms33g9NM1sytLaig6D1ixYp1W16AE7OlGo=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/en/endgame-singularity/package.nix b/pkgs/by-name/en/endgame-singularity/package.nix
index 6bc2829622be..94be17b6d783 100644
--- a/pkgs/by-name/en/endgame-singularity/package.nix
+++ b/pkgs/by-name/en/endgame-singularity/package.nix
@@ -5,7 +5,6 @@
   unzip,
   python3,
   enableDefaultMusicPack ? true,
-  unstableGitUpdater,
 }:
 
 let
@@ -15,8 +14,8 @@ let
   main_src = fetchFromGitHub {
     owner = "singularity";
     repo = "singularity";
-    rev = "8bbc2322ad1a0e83f78f5af731dfa97b6bd63f9c";
-    hash = "sha256-HiFE746JtGjZJbiKhB3ubfb376tJmz78jUfdu3/RQic=";
+    tag = "v${version}";
+    hash = "sha256-wYXuhlGp7gisgN2iRXKTpe0Om2AA8u0eBwKHHIYuqbk=";
   };
 
   music_src = fetchurl {
@@ -45,14 +44,6 @@ python3.pkgs.buildPythonApplication {
           # ↑ we cannot glob on [...]/music, it doesn't exist yet
   '';
 
-  passthru = {
-    # for the updater
-    src = main_src;
-    updateScript = unstableGitUpdater {
-      tagPrefix = "v";
-    };
-  };
-
   meta = {
     homepage = "http://www.emhsoft.com/singularity/";
     description = "Simulation game about strong AI";
diff --git a/pkgs/by-name/fl/flix/package.nix b/pkgs/by-name/fl/flix/package.nix
index 9ed61907d595..22db5a4ab256 100644
--- a/pkgs/by-name/fl/flix/package.nix
+++ b/pkgs/by-name/fl/flix/package.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "flix";
-  version = "0.59.0";
+  version = "0.60.0";
 
   src = fetchurl {
     url = "https://github.com/flix/flix/releases/download/v${version}/flix.jar";
-    sha256 = "sha256-Rh1i0wL6+Td0j+eJ4qCYYSz8dmG1Op7Z0cGBBjjJ68Q=";
+    sha256 = "sha256-mSCxB8m060K/F8b1VhQbTMjtv//feS3pobxShFBc08U=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/fl/flrig/package.nix b/pkgs/by-name/fl/flrig/package.nix
index 083ff5bc48b5..3951bf1d30f4 100644
--- a/pkgs/by-name/fl/flrig/package.nix
+++ b/pkgs/by-name/fl/flrig/package.nix
@@ -9,12 +9,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "2.0.05";
+  version = "2.0.07";
   pname = "flrig";
 
   src = fetchurl {
     url = "mirror://sourceforge/fldigi/${pname}-${version}.tar.gz";
-    sha256 = "sha256-Mc3AJfBdtIn9m6CH602Mj4UWj8OqnPlf5IiwLXgMYrA=";
+    sha256 = "sha256-Rls6w9DWaepmJrppH2j+gVF2C3bSirnlBHcFMrGA9e8=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/fu/furnace/package.nix b/pkgs/by-name/fu/furnace/package.nix
index 1a30bce02c33..321b7e00ca9c 100644
--- a/pkgs/by-name/fu/furnace/package.nix
+++ b/pkgs/by-name/fu/furnace/package.nix
@@ -29,14 +29,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "furnace";
-  version = "0.6.8.2";
+  version = "0.6.8.3";
 
   src = fetchFromGitHub {
     owner = "tildearrow";
     repo = "furnace";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-lhtuNYZySq5MHJiNIMNmUmGLjwE8696tpNyUoAvY94E=";
+    hash = "sha256-miS0CMeb0KNIsFtGBDM73U/mZyDhT6hQ6o4Vc0gVNM4=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
diff --git a/pkgs/by-name/ga/garnet/package.nix b/pkgs/by-name/ga/garnet/package.nix
index d79c2532dd09..00c4e20796a3 100644
--- a/pkgs/by-name/ga/garnet/package.nix
+++ b/pkgs/by-name/ga/garnet/package.nix
@@ -8,13 +8,13 @@
 
 buildDotnetModule rec {
   pname = "garnet";
-  version = "1.0.70";
+  version = "1.0.72";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "garnet";
     tag = "v${version}";
-    hash = "sha256-E+fwtD0AcUCHhHrnR7OV2mnDtGUnkJkLBKl6DbXlooU=";
+    hash = "sha256-2hJl1JwwfAWZFEo1eUPXCoglj11qu1IzFkQlMl9lxm8=";
   };
 
   projectFile = "main/GarnetServer/GarnetServer.csproj";
diff --git a/pkgs/by-name/gc/gcsfuse/package.nix b/pkgs/by-name/gc/gcsfuse/package.nix
index f44363a51103..4392079e3a87 100644
--- a/pkgs/by-name/gc/gcsfuse/package.nix
+++ b/pkgs/by-name/gc/gcsfuse/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "gcsfuse";
-  version = "2.12.2";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "googlecloudplatform";
     repo = "gcsfuse";
     rev = "v${version}";
-    hash = "sha256-WuCrwL7iM9U4qXtLNntLeOxELe+tR7dsbsJyvdLHVaI=";
+    hash = "sha256-9qm3GmNzjIUdOa3w0cp+UpgTI3VX44qNKHPjoaPL1wc=";
   };
 
-  vendorHash = "sha256-aj3NvgKuaBiAfPNLYK9g7kzBcdeMkC4I6jjtvFHxsU8=";
+  vendorHash = "sha256-7aJ9Nqz4kg1oFCh+VlYPTWFZxACH9uACdhzAwGbAjbc=";
 
   subPackages = [
     "."
diff --git a/pkgs/by-name/go/go-ios/package.nix b/pkgs/by-name/go/go-ios/package.nix
index 0771c76b7bec..bf68f6271810 100644
--- a/pkgs/by-name/go/go-ios/package.nix
+++ b/pkgs/by-name/go/go-ios/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "go-ios";
-  version = "1.0.177";
+  version = "1.0.180";
 
   src = fetchFromGitHub {
     owner = "danielpaulus";
     repo = "go-ios";
     rev = "v${version}";
-    sha256 = "sha256-PfFDM/thq+OP3PeiX7qfBZYG//el0U3CkpJWzFbzVqs=";
+    sha256 = "sha256-X9CtiG2kl32ErWyNwzr5WjUl2DnweKiegy0GXyLL81E=";
   };
 
   proxyVendor = true;
diff --git a/pkgs/by-name/gp/gpupad/package.nix b/pkgs/by-name/gp/gpupad/package.nix
index 59b8011623c5..59045737053e 100644
--- a/pkgs/by-name/gp/gpupad/package.nix
+++ b/pkgs/by-name/gp/gpupad/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gpupad";
-  version = "2.6.1";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "houmain";
     repo = "gpupad";
     tag = finalAttrs.version;
-    hash = "sha256-U2qLMIEss7WWHjfV9HbbSd1MBCcSsuToe8r+mIZ0xXg=";
+    hash = "sha256-Y0LNz8qHNfYhkh+ukJFi56zdaNIy5Gfvena+gSo0oOo=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/gr/grml-zsh-config/package.nix b/pkgs/by-name/gr/grml-zsh-config/package.nix
index 149079d515ab..4d39810fd783 100644
--- a/pkgs/by-name/gr/grml-zsh-config/package.nix
+++ b/pkgs/by-name/gr/grml-zsh-config/package.nix
@@ -7,13 +7,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "grml-zsh-config";
-  version = "0.19.19";
+  version = "0.19.21";
 
   src = fetchFromGitHub {
     owner = "grml";
     repo = "grml-etc-core";
     rev = "v${version}";
-    sha256 = "sha256-47C1yq9IMaOLvehy3ekvjmAVl06hhJbKDxkCJFAALs0=";
+    sha256 = "sha256-OazsDuIMFnyJrmd4Idt6ciV0huC9QmtcqBxEVD4nf6g=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/gr/grpc-gateway/package.nix b/pkgs/by-name/gr/grpc-gateway/package.nix
index 994dab141fd2..1f9dc8232834 100644
--- a/pkgs/by-name/gr/grpc-gateway/package.nix
+++ b/pkgs/by-name/gr/grpc-gateway/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "grpc-gateway";
-  version = "2.27.0";
+  version = "2.27.1";
 
   src = fetchFromGitHub {
     owner = "grpc-ecosystem";
     repo = "grpc-gateway";
     tag = "v${version}";
-    sha256 = "sha256-q1jYruLeXjXu5KmUpwSxzwLusKxSrf2RMirwdPN0Uf4=";
+    sha256 = "sha256-a7i3tONdSzKq0pWx3okIu65XFTFcXbJd21UItCFz7TA=";
   };
 
   vendorHash = "sha256-Sa2AOwX0McSGQs1Y0evVhdhpjHNNcgyouOtu6H9/AYI=";
diff --git a/pkgs/by-name/ha/handheld-daemon-ui/package.nix b/pkgs/by-name/ha/handheld-daemon-ui/package.nix
index 84ef6b091681..e541759a2ebf 100644
--- a/pkgs/by-name/ha/handheld-daemon-ui/package.nix
+++ b/pkgs/by-name/ha/handheld-daemon-ui/package.nix
@@ -5,11 +5,11 @@
 }:
 let
   pname = "handheld-daemon-ui";
-  version = "3.3.6";
+  version = "3.3.7";
 
   src = fetchurl {
     url = "https://github.com/hhd-dev/hhd-ui/releases/download/v${version}/hhd-ui.Appimage";
-    hash = "sha256-M9YTP4Q27bqeTD5JhO58ltPDxgMuGAftOXYAGHQNmhc=";
+    hash = "sha256-+Rahmj+Y50NPXyeHdI9iXAe8FX9Gq5b4vQQBkzD6+ms=";
   };
   extractedFiles = appimageTools.extractType2 { inherit pname version src; };
 in
diff --git a/pkgs/by-name/ha/hatari/package.nix b/pkgs/by-name/ha/hatari/package.nix
index 235851e2ba95..a3cdb73db740 100644
--- a/pkgs/by-name/ha/hatari/package.nix
+++ b/pkgs/by-name/ha/hatari/package.nix
@@ -9,14 +9,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hatari";
-  version = "2.5.0";
+  version = "2.6.0";
 
   src = fetchFromGitLab {
     domain = "framagit.org";
     owner = "hatari";
     repo = "hatari";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RC+KA6rNG4Hk3dvTtejiHl9+pPHImALF0Ho5QuTtjz4=";
+    hash = "sha256-0KXnLsDmvLPzXsRE1QSymzcx/aX7kNxXSWYcZ2qZ0pw=";
   };
 
   # For pthread_cancel
diff --git a/pkgs/by-name/he/hermitcli/package.nix b/pkgs/by-name/he/hermitcli/package.nix
index bafde8c09fb0..cead30d849c8 100644
--- a/pkgs/by-name/he/hermitcli/package.nix
+++ b/pkgs/by-name/he/hermitcli/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "hermit";
-  version = "0.44.8";
+  version = "0.44.9";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "cashapp";
     repo = "hermit";
-    hash = "sha256-euSuOYHroTJTifUcthHr4oQktTmE62qf2y6p6fBy9fI=";
+    hash = "sha256-nnDpwVYQvNxCH05DQboRTeyDBIWmdgU9qQD1mD9cSqE=";
   };
 
-  vendorHash = "sha256-GnZqM5ZKpg2yKAzUaXLOOKspbpjNnihscftkDT/7P9w=";
+  vendorHash = "sha256-9WaAyf1DHoQRW+m8sgH9eQoHBSDDvqDsGy40mkmdhFA=";
 
   subPackages = [ "cmd/hermit" ];
 
diff --git a/pkgs/by-name/he/heroku/package.nix b/pkgs/by-name/he/heroku/package.nix
index a4489828b18b..1a7923808e82 100644
--- a/pkgs/by-name/he/heroku/package.nix
+++ b/pkgs/by-name/he/heroku/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation {
   pname = "heroku";
-  version = "10.10.0";
+  version = "10.10.1";
 
   src = fetchzip {
-    url = "https://cli-assets.heroku.com/versions/10.10.0/552ceae/heroku-v10.10.0-552ceae-linux-x64.tar.xz";
-    hash = "sha256-D1Bjyry7Yumxe9cl7KSoBrqEUP9EQsbsa9cd5muSr/Q=";
+    url = "https://cli-assets.heroku.com/versions/10.10.1/4856ed8/heroku-v10.10.1-4856ed8-linux-x64.tar.xz";
+    hash = "sha256-oavGeVFRJBWDIYh05C3pS48tPR9WYX1uIj3yQlQVzQE=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/ht/htmlhint/package.nix b/pkgs/by-name/ht/htmlhint/package.nix
index 4f8521aca347..28021fb075dd 100644
--- a/pkgs/by-name/ht/htmlhint/package.nix
+++ b/pkgs/by-name/ht/htmlhint/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "htmlhint";
-  version = "1.5.1";
+  version = "1.6.3";
 
   src = fetchFromGitHub {
     owner = "htmlhint";
     repo = "HTMLHint";
     rev = "v${version}";
-    hash = "sha256-lyfn2M5Xxeo/qxhMBMsZpEa+UwJqgJwRsv2cMoKKcPo=";
+    hash = "sha256-OId1uuNWry9tXWkewVhOJlWIRlfDPIN18gmYQ43TYdQ=";
   };
 
-  npmDepsHash = "sha256-XHgjIDJpp7tLaXUuLaq2x1Pllw1OupMV0wijevMPGzU=";
+  npmDepsHash = "sha256-H9zw04Y9yD044qc3pylQge16QojaUCndHO1haw6FJ5s=";
 
   meta = {
     changelog = "https://github.com/htmlhint/HTMLHint/blob/${src.rev}/CHANGELOG.md";
diff --git a/pkgs/by-name/hy/hyprpanel/package.nix b/pkgs/by-name/hy/hyprpanel/package.nix
index 2d52a4de3a5a..c2324be13cd3 100644
--- a/pkgs/by-name/hy/hyprpanel/package.nix
+++ b/pkgs/by-name/hy/hyprpanel/package.nix
@@ -37,7 +37,7 @@
 }:
 ags.bundle {
   pname = "hyprpanel";
-  version = "0-unstable-2025-06-20";
+  version = "0-unstable-2025-06-22";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -45,8 +45,8 @@ ags.bundle {
   src = fetchFromGitHub {
     owner = "Jas-SinghFSU";
     repo = "HyprPanel";
-    rev = "d563cdb1f6499d981901336bd0f86303ab95c4a5";
-    hash = "sha256-oREAoOQeAExqWMkw2r3BJfiaflh7QwHFkp8Qm0qDu6o=";
+    rev = "2c0c66a8ddcdff69b2ff694fefbcd8df4387a9e7";
+    hash = "sha256-wn6XV23Sz/nsDPI+1FGjtyMfAWJWcXRpNcryS47DJdY=";
   };
 
   # keep in sync with https://github.com/Jas-SinghFSU/HyprPanel/blob/master/flake.nix#L42
diff --git a/pkgs/by-name/ic/icewm/package.nix b/pkgs/by-name/ic/icewm/package.nix
index d5d0ed8eae36..0b9ccda46f30 100644
--- a/pkgs/by-name/ic/icewm/package.nix
+++ b/pkgs/by-name/ic/icewm/package.nix
@@ -41,13 +41,13 @@
 
 gccStdenv.mkDerivation (finalAttrs: {
   pname = "icewm";
-  version = "3.7.5";
+  version = "3.8.0";
 
   src = fetchFromGitHub {
     owner = "ice-wm";
     repo = "icewm";
     tag = finalAttrs.version;
-    hash = "sha256-YGEgAO/H21yfv75LnCKYqCRtQtV6bqA7HRFXxDIll/c=";
+    hash = "sha256-PHbBjwGxFxHnecuXXX2nT8SwmgJD0DzThiFEwKKDASU=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/je/jellyseerr/package.nix b/pkgs/by-name/je/jellyseerr/package.nix
index 608d73029486..0c90d98157bc 100644
--- a/pkgs/by-name/je/jellyseerr/package.nix
+++ b/pkgs/by-name/je/jellyseerr/package.nix
@@ -17,18 +17,18 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "jellyseerr";
-  version = "2.5.2";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "Fallenbagel";
     repo = "jellyseerr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EbBvgaTTMA4B7uBwiftIy54oo0K5hCvIAWhBHjeM5WU=";
+    hash = "sha256-JzJYRwrwDk8LQZAfWwym+SFTn8YhALghpZb2Dd+3nP4=";
   };
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-4odVuAhjc9lUxorWOqPd2ODgexk5PDSS2HtFyq0csU0=";
+    hash = "sha256-Ym16jPHMHKmojMQOuMamDsW/u+oP1UhbCP5dooTUzFQ=";
   };
 
   buildInputs = [ sqlite ];
diff --git a/pkgs/by-name/ji/jibri/package.nix b/pkgs/by-name/ji/jibri/package.nix
index 924be5720873..f48e2b903005 100644
--- a/pkgs/by-name/ji/jibri/package.nix
+++ b/pkgs/by-name/ji/jibri/package.nix
@@ -23,10 +23,10 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "jibri";
-  version = "8.0-177-g3325e37";
+  version = "8.0-183-g7b406bf";
   src = fetchurl {
     url = "https://download.jitsi.org/stable/${pname}_${version}-1_all.deb";
-    sha256 = "35Bwc+T/l0Z3lBdoUF0obS8fiGiD2ICNMR20rtruf48=";
+    sha256 = "QF7BkLizAsEzjC6PdTyPFAFf82AzukTnxHxLHyz5Kco=";
   };
 
   dontBuild = true;
diff --git a/pkgs/by-name/ji/jicofo/package.nix b/pkgs/by-name/ji/jicofo/package.nix
index 9d25ef6ad6c0..79f7b2df22ce 100644
--- a/pkgs/by-name/ji/jicofo/package.nix
+++ b/pkgs/by-name/ji/jicofo/package.nix
@@ -9,10 +9,10 @@
 
 let
   pname = "jicofo";
-  version = "1.0-1128";
+  version = "1.0-1138";
   src = fetchurl {
     url = "https://download.jitsi.org/stable/${pname}_${version}-1_all.deb";
-    sha256 = "pWTOAvsvWGWgt4q9jNyp0faZrbRx0De3R5U5j+GNTDA=";
+    sha256 = "YLzWyeeWWgsqfGAKXPIKIkfIq3McFEjcZGYLhi2Otew=";
   };
 in
 stdenv.mkDerivation {
diff --git a/pkgs/by-name/ji/jitsi-meet-prosody/package.nix b/pkgs/by-name/ji/jitsi-meet-prosody/package.nix
index d85f8a0ec3e1..76deae00bb45 100644
--- a/pkgs/by-name/ji/jitsi-meet-prosody/package.nix
+++ b/pkgs/by-name/ji/jitsi-meet-prosody/package.nix
@@ -8,10 +8,10 @@
 
 stdenv.mkDerivation rec {
   pname = "jitsi-meet-prosody";
-  version = "1.0.8542";
+  version = "1.0.8648";
   src = fetchurl {
     url = "https://download.jitsi.org/stable/${pname}_${version}-1_all.deb";
-    sha256 = "dVqKnDq8rNmLbhMUvDGAT2pKLPZjW4ZXUwvz1wxM2Rs=";
+    sha256 = "JqnLAAWEI57VR5DrQrz4XrIyHE1Z6P0AjtUaTNuWYLE=";
   };
 
   nativeBuildInputs = [ dpkg ];
diff --git a/pkgs/by-name/ji/jitsi-videobridge/package.nix b/pkgs/by-name/ji/jitsi-videobridge/package.nix
index 5a2877421328..e3ad1ddf8d6f 100644
--- a/pkgs/by-name/ji/jitsi-videobridge/package.nix
+++ b/pkgs/by-name/ji/jitsi-videobridge/package.nix
@@ -11,10 +11,10 @@
 
 let
   pname = "jitsi-videobridge2";
-  version = "2.3-220-g7cda0a66";
+  version = "2.3-236-g95ef6210";
   src = fetchurl {
     url = "https://download.jitsi.org/stable/${pname}_${version}-1_all.deb";
-    sha256 = "5jl2K3EL7zS3hw14LuK6WqL9SDgvLN+pZlRqJew0LJE=";
+    sha256 = "GUihengE21ISqXozFwTsdiQurDi0ft/btj+DcbGH/Rg=";
   };
 in
 stdenv.mkDerivation {
diff --git a/pkgs/by-name/ko/komga/package.nix b/pkgs/by-name/ko/komga/package.nix
index a51548102929..49ced0d5dd64 100644
--- a/pkgs/by-name/ko/komga/package.nix
+++ b/pkgs/by-name/ko/komga/package.nix
@@ -4,6 +4,7 @@
   fetchurl,
   makeWrapper,
   jdk23_headless,
+  libwebp, # Fixes https://github.com/gotson/komga/issues/1294
   nixosTests,
 }:
 
@@ -21,7 +22,8 @@ stdenvNoCC.mkDerivation rec {
   ];
 
   buildCommand = ''
-    makeWrapper ${jdk23_headless}/bin/java $out/bin/komga --add-flags "-jar $src"
+    makeWrapper ${jdk23_headless}/bin/java $out/bin/komga --add-flags "-jar $src" \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libwebp ]}
   '';
 
   passthru.tests = {
diff --git a/pkgs/by-name/ku/kubelogin/package.nix b/pkgs/by-name/ku/kubelogin/package.nix
index db9c6e79b050..5a1356ead223 100644
--- a/pkgs/by-name/ku/kubelogin/package.nix
+++ b/pkgs/by-name/ku/kubelogin/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "kubelogin";
-  version = "0.2.8";
+  version = "0.2.9";
 
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "kubelogin";
     rev = "v${version}";
-    sha256 = "sha256-aajo43ysA/ItOxFxZbw1i7VQpEm4aqfXFiMUTZt3QDk=";
+    sha256 = "sha256-5qIGUI7hw4Yvpb0Pub3P2lYMnTuMfu7I2x8Xq0Gsuag=";
   };
 
   vendorHash = "sha256-fILOPZnSsEX9f1nWxC1jTN2wNGmlz15fFmeVvXMA25w=";
diff --git a/pkgs/by-name/ku/kubeshark/package.nix b/pkgs/by-name/ku/kubeshark/package.nix
index 07a3e3728cf8..f5c1ae167e9a 100644
--- a/pkgs/by-name/ku/kubeshark/package.nix
+++ b/pkgs/by-name/ku/kubeshark/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "kubeshark";
-  version = "52.7.7";
+  version = "52.7.8";
 
   src = fetchFromGitHub {
     owner = "kubeshark";
     repo = "kubeshark";
     rev = "v${version}";
-    hash = "sha256-gF1Q0amsgKyog+98zeHMidU8vzlTynr69alC6BhGAqI=";
+    hash = "sha256-bGfqJ+XXflO2FcYRDkdDrDchpuIF2VBsVQkApd+2YoU=";
   };
 
   vendorHash = "sha256-kzyQW4bVE7oMOlHVG7LKG1AMTRYa5GLiiEhdarIhMSo=";
diff --git a/pkgs/by-name/le/level-zero/package.nix b/pkgs/by-name/le/level-zero/package.nix
index 489c12d049e9..e921448cddb3 100644
--- a/pkgs/by-name/le/level-zero/package.nix
+++ b/pkgs/by-name/le/level-zero/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "level-zero";
-  version = "1.21.9";
+  version = "1.22.4";
 
   src = fetchFromGitHub {
     owner = "oneapi-src";
     repo = "level-zero";
     tag = "v${version}";
-    hash = "sha256-I9jCS4ZDEfOH/2kgIgeNne96Z5YZdzsmUGXza8PmXZI=";
+    hash = "sha256-9MZcxpRyr0YMLHKTgxqJnm72rAYLkTdrn7Egky8mM48=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libdigidocpp/package.nix b/pkgs/by-name/li/libdigidocpp/package.nix
index 9788e8c092f8..649e389eef9f 100644
--- a/pkgs/by-name/li/libdigidocpp/package.nix
+++ b/pkgs/by-name/li/libdigidocpp/package.nix
@@ -16,12 +16,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "4.1.0";
+  version = "4.2.0";
   pname = "libdigidocpp";
 
   src = fetchurl {
     url = "https://github.com/open-eid/libdigidocpp/releases/download/v${version}/libdigidocpp-${version}.tar.gz";
-    hash = "sha256-lY7UVAhdWadLUKR21ezUfWc1Xdv/MWhfI/by4btcvr8=";
+    hash = "sha256-d3AqTTVi3lzzu9Tw7p+KilNa0Q7cJBGwb6VoNNLeskE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libgpiod/package.nix b/pkgs/by-name/li/libgpiod/package.nix
index 236d73339636..b40cb39b86ff 100644
--- a/pkgs/by-name/li/libgpiod/package.nix
+++ b/pkgs/by-name/li/libgpiod/package.nix
@@ -11,12 +11,12 @@
 
 stdenv.mkDerivation rec {
   pname = "libgpiod";
-  version = "2.2.1";
+  version = "2.2.2";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/libgpiod/libgpiod.git";
     tag = "v${version}";
-    hash = "sha256-BVVHyRmgLLUgc3qLHOXiLYaTjsPMntvIP1os9eL8v74=";
+    hash = "sha256-MePv6LsK+8zCxG8l4vyiiZPSVqv9F4H4KQB0gHjm0YM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libndctl/package.nix b/pkgs/by-name/li/libndctl/package.nix
index 4551b80eaa4f..37c1580b7a16 100644
--- a/pkgs/by-name/li/libndctl/package.nix
+++ b/pkgs/by-name/li/libndctl/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libndctl";
-  version = "81";
+  version = "82";
 
   src = fetchFromGitHub {
     owner = "pmem";
     repo = "ndctl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-geOfaI5XehucLanNS8KTIyOAXOS5YSjs61hfrWbmqSs=";
+    hash = "sha256-zTIYGKUVIINeSisSCghImfjtJLdecQGL2i6ftxf8QXc=";
   };
 
   patches = lib.optionals (!stdenv.hostPlatform.isGnu) [
diff --git a/pkgs/by-name/li/librecast/package.nix b/pkgs/by-name/li/librecast/package.nix
index c87f65fd4ffe..4b40b6f77774 100644
--- a/pkgs/by-name/li/librecast/package.nix
+++ b/pkgs/by-name/li/librecast/package.nix
@@ -7,14 +7,14 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "librecast";
-  version = "0.10.0";
+  version = "0.11.2";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "librecast";
     repo = "librecast";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-uM7S7EBoLd49+JFZjX/Pq8WbTPN25alLY5slCeqHBxI=";
+    hash = "sha256-FFumVHTobvcty3x26IAMHP8M3fYrnfLtxt/RJ/4vKBg=";
   };
   buildInputs = [
     lcrq
diff --git a/pkgs/by-name/ma/magic-vlsi/package.nix b/pkgs/by-name/ma/magic-vlsi/package.nix
index 00c5906785e4..fd1d5a6909c0 100644
--- a/pkgs/by-name/ma/magic-vlsi/package.nix
+++ b/pkgs/by-name/ma/magic-vlsi/package.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "magic-vlsi";
-  version = "8.3.528";
+  version = "8.3.529";
 
   src = fetchurl {
     url = "http://opencircuitdesign.com/magic/archive/magic-${version}.tgz";
-    sha256 = "sha256-GueeY+UfiTJN05elfIrBq3OL+f4RNLs5navee5GSE44=";
+    sha256 = "sha256-O5NauR2TYRS2bzEVQlhCqkshlojIGqM1Y3KLN00YP40=";
   };
 
   nativeBuildInputs = [ python3 ];
diff --git a/pkgs/by-name/me/mermaid-cli/package.nix b/pkgs/by-name/me/mermaid-cli/package.nix
index a9b6495f47f3..00f4667861ae 100644
--- a/pkgs/by-name/me/mermaid-cli/package.nix
+++ b/pkgs/by-name/me/mermaid-cli/package.nix
@@ -7,7 +7,7 @@
   nix-update-script,
 }:
 let
-  version = "11.4.3";
+  version = "11.6.0";
 in
 buildNpmPackage {
   pname = "mermaid-cli";
@@ -17,14 +17,14 @@ buildNpmPackage {
     owner = "mermaid-js";
     repo = "mermaid-cli";
     rev = version;
-    hash = "sha256-vf6FwQlgSvbOL+areHrAI0MnsfXg/7lC6PZTyFfOE78=";
+    hash = "sha256-9Ozi5mAeFVdwGMjvlLG4hMWnCGi552SsT5RuvRiF9ww=";
   };
 
   patches = [
     ./remove-puppeteer-from-dev-deps.patch # https://github.com/mermaid-js/mermaid-cli/issues/830
   ];
 
-  npmDepsHash = "sha256-+X3WJalbcCt1dClp8DcbvtfdYS4DFxZW6TgQMddLXFc=";
+  npmDepsHash = "sha256-SHGYv/IwrCB02M8w5HsEsB7BwWVRFYNDYJFRDgG3a14=";
 
   env = {
     PUPPETEER_SKIP_DOWNLOAD = true;
diff --git a/pkgs/by-name/mo/mongodb-atlas-cli/package.nix b/pkgs/by-name/mo/mongodb-atlas-cli/package.nix
index 2864e52b48ce..b861bfa2e3c9 100644
--- a/pkgs/by-name/mo/mongodb-atlas-cli/package.nix
+++ b/pkgs/by-name/mo/mongodb-atlas-cli/package.nix
@@ -10,15 +10,15 @@
 
 buildGoModule rec {
   pname = "mongodb-atlas-cli";
-  version = "1.43.2";
+  version = "1.44.0";
 
-  vendorHash = "sha256-Pem+3HH/bdf1SulsLo/5hsFYN8p7kQve0vXptUFnvsM=";
+  vendorHash = "sha256-FSf+JbIbM7EumkVmQ/ASRCIu7X6tyerhRx01/Rn0+LM=";
 
   src = fetchFromGitHub {
     owner = "mongodb";
     repo = "mongodb-atlas-cli";
     rev = "refs/tags/atlascli/v${version}";
-    sha256 = "sha256-Xb/6kgqee38DqbLPLkel8NhXxdjq4UYX4E/y3xUW7og=";
+    sha256 = "sha256-1XSIXLI0ItQPOcFXhswnnrKN5LqWRs/th4EdfvdS/G8=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/by-name/mu/museeks/package.nix b/pkgs/by-name/mu/museeks/package.nix
index 8ad5aac0f8da..6082e2ed8c02 100644
--- a/pkgs/by-name/mu/museeks/package.nix
+++ b/pkgs/by-name/mu/museeks/package.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "museeks";
-  version = "0.21.1";
+  version = "0.22.2";
 
   src = fetchurl {
     url = "https://github.com/martpie/museeks/releases/download/${finalAttrs.version}/Museeks_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-4UHMh8rZUDGNlz59EMGTgV/jfd6K9RyXVpMr2sinPUQ=";
+    hash = "sha256-yK29t0cMPuZ14NEPoM/ekknXVgY9rxNm8eulgDCg0uw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/na/narsil/package.nix b/pkgs/by-name/na/narsil/package.nix
index c182ee06aa0a..68271a98ed48 100644
--- a/pkgs/by-name/na/narsil/package.nix
+++ b/pkgs/by-name/na/narsil/package.nix
@@ -13,13 +13,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "narsil";
-  version = "1.4.0-61-gb724a9e67";
+  version = "1.4.0-62-g781c0f9c3";
 
   src = fetchFromGitHub {
     owner = "NickMcConnell";
     repo = "NarSil";
     tag = version;
-    hash = "sha256-fRGSlgtbjDyhbEJEMG8eTMCxeIbA/tBO+MplCXTgWm8=";
+    hash = "sha256-FdQqvxj7K5wcF6eeqj18H8MVkytkNiB5fxrzyt/EnZ4=";
   };
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/by-name/na/nats-server/package.nix b/pkgs/by-name/na/nats-server/package.nix
index b57c8f4732c3..88b56c39a043 100644
--- a/pkgs/by-name/na/nats-server/package.nix
+++ b/pkgs/by-name/na/nats-server/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "nats-server";
-  version = "2.11.4";
+  version = "2.11.5";
 
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = "nats-server";
     rev = "v${version}";
-    hash = "sha256-LlAvT+u/FLuufWmUno/RM2E9/EEXSyM585My8eR156E=";
+    hash = "sha256-7EY1fRy8YMg4vAduwCKFG9ooEwbdimFIZWQxtIGLRcM=";
   };
 
-  vendorHash = "sha256-d83bZWfZ+obEi79RHQJaucwlRfuLj1bleOfCVJpc7bU=";
+  vendorHash = "sha256-b2L1Ef/vqS+OpZTaBbJ/saHWCFjq0jmLrvs4ujgk4ro=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/ne/nelua/package.nix b/pkgs/by-name/ne/nelua/package.nix
index 339601a12d07..7854a27bceac 100644
--- a/pkgs/by-name/ne/nelua/package.nix
+++ b/pkgs/by-name/ne/nelua/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "nelua";
-  version = "0-unstable-2024-12-14";
+  version = "0-unstable-2025-06-24";
 
   src = fetchFromGitHub {
     owner = "edubart";
     repo = "nelua-lang";
-    rev = "a69a12d1e1e5ee0bfab299350e5d707ff7b2e744";
-    hash = "sha256-Du6fRfAdHvdNWWkpd8dR4ZwkCETN9FWsEgq5JkwW0DY=";
+    rev = "a58450563e2d2ec49bff499865c8b5cfdf6ff81a";
+    hash = "sha256-JBARpQXqQ7bMt+Za28v3c5fFvUdT4JgMq/C33HTnJCk=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/nw/nwg-drawer/package.nix b/pkgs/by-name/nw/nwg-drawer/package.nix
index f38232fbec1a..e31155c69989 100644
--- a/pkgs/by-name/nw/nwg-drawer/package.nix
+++ b/pkgs/by-name/nw/nwg-drawer/package.nix
@@ -13,16 +13,16 @@
 
 let
   pname = "nwg-drawer";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-drawer";
     rev = "v${version}";
-    hash = "sha256-M0+4/lr79CYBy2+ysB1Wb1obD7B/Qi8MBwNhIsiIDak=";
+    hash = "sha256-vORjD6nMy0h2Udo6Sy6aD0td+sLBUusDRiuT6jssais=";
   };
 
-  vendorHash = "sha256-1uZTZ7/p1l4Rue3mxlaMRSDfyARo94wR4KIKkQXBUMQ=";
+  vendorHash = "sha256-ftE8u0m1KGyEdLVbmpFKCeuDFnBcY3AyqmWNGPST27k=";
 in
 buildGoModule {
   inherit
diff --git a/pkgs/by-name/ol/olympus-unwrapped/package.nix b/pkgs/by-name/ol/olympus-unwrapped/package.nix
index 2df334577e59..de1036b85677 100644
--- a/pkgs/by-name/ol/olympus-unwrapped/package.nix
+++ b/pkgs/by-name/ol/olympus-unwrapped/package.nix
@@ -31,9 +31,9 @@ let
 
   phome = "$out/lib/olympus";
   # The following variables are to be updated by the update script.
-  version = "25.06.17.01";
-  buildId = "4899"; # IMPORTANT: This line is matched with regex in update.sh.
-  rev = "dc90221a4528e92e147de5746a6657d87b1856fa";
+  version = "25.06.24.02";
+  buildId = "4914"; # IMPORTANT: This line is matched with regex in update.sh.
+  rev = "cc34c867daadaa5ee5c53ed951bc1f64f4dc6565";
 in
 buildDotnetModule {
   pname = "olympus-unwrapped";
@@ -44,7 +44,7 @@ buildDotnetModule {
     owner = "EverestAPI";
     repo = "Olympus";
     fetchSubmodules = true; # Required. See upstream's README.
-    hash = "sha256-s73gIjqxTloYr5gwL9fHPhBh+fq5d1RFp8PeLe6bI84=";
+    hash = "sha256-FypX89fdH+dr12iC/2CoM6BAvUS6bGcSp04IiJjZtc4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/op/open-vm-tools/package.nix b/pkgs/by-name/op/open-vm-tools/package.nix
index 191092b4798f..7fc04a329ab1 100644
--- a/pkgs/by-name/op/open-vm-tools/package.nix
+++ b/pkgs/by-name/op/open-vm-tools/package.nix
@@ -52,13 +52,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "open-vm-tools";
-  version = "12.5.2";
+  version = "13.0.0";
 
   src = fetchFromGitHub {
     owner = "vmware";
     repo = "open-vm-tools";
     tag = "stable-${finalAttrs.version}";
-    hash = "sha256-gKtPyLsmTrbA3aG/Jiod/oAl5aMpVm3enuCe+b7jsY4=";
+    hash = "sha256-1ZW1edwKW3okKNdWw6rBgfeOt9afESbhe1L1TNp0+Kc=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/open-vm-tools";
diff --git a/pkgs/by-name/ox/oxlint/package.nix b/pkgs/by-name/ox/oxlint/package.nix
index cf921b197f5e..5422fb1d4a5e 100644
--- a/pkgs/by-name/ox/oxlint/package.nix
+++ b/pkgs/by-name/ox/oxlint/package.nix
@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "oxlint";
-  version = "0.18.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
-    owner = "web-infra-dev";
+    owner = "oxc-project";
     repo = "oxc";
-    rev = "oxlint_v${version}";
-    hash = "sha256-Q4qtyJc+2KvBENZi8F8UoMlbZ+ilhnIwMkca4YCFDtc=";
+    tag = "oxlint_v${version}";
+    hash = "sha256-+K8hc6uU/p/hT3bkaGPZpVcK9itSGJM9Mdhfw3DSZJw=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-9owX2ZTUZolJ+U2g+vx/l76bSAoUPUazlL8iqh2ATqo=";
+  cargoHash = "sha256-D0YEodCzBpf7g3VnKyydEDtjzGUu+XsGc2BpXU4CR6Q=";
 
   buildInputs = [
     rust-jemalloc-sys
@@ -31,12 +31,12 @@ rustPlatform.buildRustPackage rec {
   ];
   cargoTestFlags = cargoBuildFlags;
 
-  meta = with lib; {
-    description = "Suite of high-performance tools for JavaScript and TypeScript written in Rust";
-    homepage = "https://github.com/web-infra-dev/oxc";
-    changelog = "https://github.com/web-infra-dev/oxc/releases/tag/${src.rev}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ figsoda ];
+  meta = {
+    description = "Collection of JavaScript tools written in Rust";
+    homepage = "https://github.com/oxc-project/oxc";
+    changelog = "https://github.com/oxc-project/oxc/releases/tag/${src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ figsoda ];
     mainProgram = "oxlint";
   };
 }
diff --git a/pkgs/by-name/pc/pcsx2/package.nix b/pkgs/by-name/pc/pcsx2/package.nix
index 7971f6396755..fd7992bb18b5 100644
--- a/pkgs/by-name/pc/pcsx2/package.nix
+++ b/pkgs/by-name/pc/pcsx2/package.nix
@@ -34,8 +34,8 @@ let
   pcsx2_patches = fetchFromGitHub {
     owner = "PCSX2";
     repo = "pcsx2_patches";
-    rev = "49d2f7bb0b4387e9cb7c68233e2bdc156850542b";
-    hash = "sha256-WByW40lf5h1hlnxxiiP9WyEhk8NwxATZDguWQj+j3iA=";
+    rev = "6448ff90bbf2fddb4498dcfdae0e6d3ec8c23479";
+    hash = "sha256-ZXAZekllZHYjfU1q1QrbEdRlRAUAB6VOXLeAfn1GqW0=";
   };
 
   inherit (qt6)
@@ -48,13 +48,13 @@ let
 in
 llvmPackages.stdenv.mkDerivation (finalAttrs: {
   pname = "pcsx2";
-  version = "2.3.407";
+  version = "2.3.424";
   src = fetchFromGitHub {
     pname = "pcsx2-source";
     owner = "PCSX2";
     repo = "pcsx2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3/nnGdEr7flA8g9jPC8clAyvZlwQh12/YH4+t0O9OuU=";
+    hash = "sha256-EdFkSsat6O/1tXtJVHOPviseSaixd5LB1TNtfqhqR1E=";
   };
 
   patches = [
diff --git a/pkgs/by-name/pe/peergos/package.nix b/pkgs/by-name/pe/peergos/package.nix
index 30ece6ef17f6..cd565f6e5c36 100644
--- a/pkgs/by-name/pe/peergos/package.nix
+++ b/pkgs/by-name/pe/peergos/package.nix
@@ -41,12 +41,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "peergos";
-  version = "1.5.0";
+  version = "1.6.0";
   src = fetchFromGitHub {
     owner = "Peergos";
     repo = "web-ui";
     rev = "v${version}";
-    hash = "sha256-wvOhxHK5UkVD6mu39y5wpFcf69kadKFqt6WumSnzqmQ=";
+    hash = "sha256-Y2oGvYqLEAuF732DAOFLmXqwDX48/ZeYW0kPc17Z+oU=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/pi/pixi-pack/package.nix b/pkgs/by-name/pi/pixi-pack/package.nix
index 8be13f2aa4bd..f83cd8702559 100644
--- a/pkgs/by-name/pi/pixi-pack/package.nix
+++ b/pkgs/by-name/pi/pixi-pack/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "pixi-pack";
-  version = "0.6.6";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "Quantco";
     repo = "pixi-pack";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-U5I/wc0HDoi+EHQ3JIs2S/ky/uH5pA1KaTuTo6Bllus=";
+    hash = "sha256-JY/8otWV0pclai9DTC17YmxbUNFsV2/u/EPcB/gOxM8=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-RqTaBs+kU8j6TmeX7cROZPEN4CeTKojwRJtXvfj2f8w=";
+  cargoHash = "sha256-AhAEz3NFImEY6bPRfPKznKw9cFV/vBPF1uzd0wOrZSY=";
 
   buildInputs = [ openssl ];
 
diff --git a/pkgs/by-name/po/poptracker/package.nix b/pkgs/by-name/po/poptracker/package.nix
index 285f106a6648..8ce7a266e95f 100644
--- a/pkgs/by-name/po/poptracker/package.nix
+++ b/pkgs/by-name/po/poptracker/package.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "poptracker";
-  version = "0.31.0";
+  version = "0.32.1";
 
   src = fetchFromGitHub {
     owner = "black-sliver";
     repo = "PopTracker";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-uGzgkXOXmpByXewDuo0NieXHYT6fzaHqyfP60V5fMOY=";
+    hash = "sha256-DFJfuDOzcVdiXLv5EzO5TL3UJLCZPM1bTZharp2ww5U=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/po/positron-bin/package.nix b/pkgs/by-name/po/positron-bin/package.nix
index b165b93dac47..11817b657faf 100644
--- a/pkgs/by-name/po/positron-bin/package.nix
+++ b/pkgs/by-name/po/positron-bin/package.nix
@@ -22,7 +22,7 @@
 }:
 let
   pname = "positron-bin";
-  version = "2025.06.0-146";
+  version = "2025.07.0-112";
 in
 stdenv.mkDerivation {
   inherit version pname;
@@ -31,17 +31,17 @@ stdenv.mkDerivation {
     if stdenv.hostPlatform.isDarwin then
       fetchurl {
         url = "https://cdn.posit.co/positron/dailies/mac/universal/Positron-${version}.dmg";
-        hash = "sha256-V9ADtOskxEbGZryXD/6aiUDeTvqPzoY372f/Vo5195s=";
+        hash = "sha256-vprBr+0XBndCiFTauiOa3gjOlxj/w2ZhQlXNJdly7oU=";
       }
     else if stdenv.hostPlatform.system == "aarch64-linux" then
       fetchurl {
         url = "https://cdn.posit.co/positron/dailies/deb/arm64/Positron-${version}-arm64.deb";
-        hash = "sha256-FiCTF5Bmfp4id9HXuB4luSGT9A7OoquaRW/QIh0A3ZY=";
+        hash = "sha256-TYFBW3sRpgsdVC66WB9SYNsmAxGCq/3gQSexOVtvGZs=";
       }
     else
       fetchurl {
         url = "https://cdn.posit.co/positron/dailies/deb/x86_64/Positron-${version}-x64.deb";
-        hash = "sha256-FnNoLV9uqgUeumYpHtRJuHrFA6mL65KI4jru7Ebq0/o=";
+        hash = "sha256-yueD2PEBXiG8FPghRWvBS6TPtyZ1Q8utKOS8QDMNlk8=";
       };
 
   buildInputs =
diff --git a/pkgs/by-name/pr/proton-pass/package.nix b/pkgs/by-name/pr/proton-pass/package.nix
index 504a570d11f8..4f678ca8f4e7 100644
--- a/pkgs/by-name/pr/proton-pass/package.nix
+++ b/pkgs/by-name/pr/proton-pass/package.nix
@@ -9,11 +9,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "proton-pass";
-  version = "1.31.5";
+  version = "1.32.0";
 
   src = fetchurl {
     url = "https://proton.me/download/pass/linux/x64/proton-pass_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-PNBqnVpLLIpi/S0MLyhCBE6ggnjHJ8aEmBJuYC3DcwQ=";
+    hash = "sha256-b45u7S9syw9KvCthQlNKzUusPKSBDnY4k6pC6H4TcnU=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/py/pysolfc/package.nix b/pkgs/by-name/py/pysolfc/package.nix
index 38ddf835ecd4..f7c7262a414c 100644
--- a/pkgs/by-name/py/pysolfc/package.nix
+++ b/pkgs/by-name/py/pysolfc/package.nix
@@ -12,20 +12,20 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pysolfc";
-  version = "3.2.0";
+  version = "3.4.0";
 
   src = fetchzip {
     url = "mirror://sourceforge/pysolfc/PySolFC-${version}.tar.xz";
-    hash = "sha256-0Thvg9sNNXkF0GJ03A4qt3yobezVtBsGT4U4Nd44Ftg=";
+    hash = "sha256-xMZaRW6NDrKfBaWEZNcvZD/OPOcpL83WLvI8vEK9NFw=";
   };
 
   cardsets = stdenv.mkDerivation rec {
     pname = "pysol-cardsets";
-    version = "3.0";
+    version = "3.1";
 
     src = fetchzip {
       url = "mirror://sourceforge/pysolfc/PySolFC-Cardsets-${version}.tar.bz2";
-      hash = "sha256-UP0dQjoZJg+iSKVOrWbkLj1KCzMWws8ZBVSBLly1a/Y=";
+      hash = "sha256-NyCnMlMZ6d5+IiyG4cVn/zlDlArLJSs0dIqZiD7Nv4M=";
     };
 
     installPhase = ''
diff --git a/pkgs/by-name/qu/quarkus/package.nix b/pkgs/by-name/qu/quarkus/package.nix
index 8f0c63d2765b..f91d1f1bec5e 100644
--- a/pkgs/by-name/qu/quarkus/package.nix
+++ b/pkgs/by-name/qu/quarkus/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "quarkus-cli";
-  version = "3.23.3";
+  version = "3.23.4";
 
   src = fetchurl {
     url = "https://github.com/quarkusio/quarkus/releases/download/${finalAttrs.version}/quarkus-cli-${finalAttrs.version}.tar.gz";
-    hash = "sha256-vDoakW0Wp+bqK++EdIgheo5ojZyZgQ4Ror2itKP/a+8=";
+    hash = "sha256-drN28p+tHCxvVFfBw+nlPZxtiF6sIseiW16/FxwxRLI=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/ra/railway/package.nix b/pkgs/by-name/ra/railway/package.nix
index b4242a85d87b..434ec261b383 100644
--- a/pkgs/by-name/ra/railway/package.nix
+++ b/pkgs/by-name/ra/railway/package.nix
@@ -7,17 +7,17 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "railway";
-  version = "4.5.3";
+  version = "4.5.4";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-Z8ZjpD6uyqlCFItSHqAqVkdthhnwweSZasEVzg4dbpY=";
+    hash = "sha256-Ov7s7Pl57rh8+aDi0rXP386ON2U9j4xHJEgEKbwsymk=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-k3wzGEs3rRI9DG5LW7GrAGCmT0GjkUGoL73rUa9nj50=";
+  cargoHash = "sha256-oo9vV6oFzyVCiSLXqme/HOchZcNwPxYyrufwFTnxdoU=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/re/re-flex/package.nix b/pkgs/by-name/re/re-flex/package.nix
index 19f4ce49d5f6..d4518b48a1b9 100644
--- a/pkgs/by-name/re/re-flex/package.nix
+++ b/pkgs/by-name/re/re-flex/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "re-flex";
-  version = "5.5.0";
+  version = "6.0.0";
 
   src = fetchFromGitHub {
     owner = "Genivia";
     repo = "RE-flex";
     rev = "v${version}";
-    hash = "sha256-BTzKR9C4J9DOszKGtcd+7Tiw+OkohPJuKKjbXZ8wX7k=";
+    hash = "sha256-p04o2e7Dxx7N6ByCwERz4hKz+vfTIuuZ//AoWSC1qao=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/re/readsb/package.nix b/pkgs/by-name/re/readsb/package.nix
index 70a1a993e37e..bd48bf6cd134 100644
--- a/pkgs/by-name/re/readsb/package.nix
+++ b/pkgs/by-name/re/readsb/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "readsb";
-  version = "3.14.1666";
+  version = "3.14.1683";
 
   src = fetchFromGitHub {
     owner = "wiedehopf";
     repo = "readsb";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gsiWUi8rLyugmCxzEFRz6vgxNhYa72AekiKPqyFcPPo=";
+    hash = "sha256-X2Z9vPXJle5IKSuCWiM6l6FBq4GomguStFB4YJ0Y+EE=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/re/reindeer/package.nix b/pkgs/by-name/re/reindeer/package.nix
index 08c68ee81200..59c523dbd685 100644
--- a/pkgs/by-name/re/reindeer/package.nix
+++ b/pkgs/by-name/re/reindeer/package.nix
@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "reindeer";
-  version = "2025.06.16.00";
+  version = "2025.06.23.00";
 
   src = fetchFromGitHub {
     owner = "facebookincubator";
     repo = "reindeer";
     tag = "v${version}";
-    hash = "sha256-tvDOGt0fLwj0YhwBMTdsXYqCLY2+M4bQCNgf3Bq5hkU=";
+    hash = "sha256-4g5CbKFsZaZWSNCw04G1zMR873VeW3fdtvIM9HrrVJc=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-ZAefAr8uXqaIm4NOqHaz2rDVxGRJfoobAzPOa+3GqNE=";
+  cargoHash = "sha256-sL15ziVSW70m4XhqpQoCeZBvmp7bB6tKPUCvwUFqvRg=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/re/renode-unstable/package.nix b/pkgs/by-name/re/renode-unstable/package.nix
index e2f8983b2923..374e4a413e7c 100644
--- a/pkgs/by-name/re/renode-unstable/package.nix
+++ b/pkgs/by-name/re/renode-unstable/package.nix
@@ -7,11 +7,11 @@
 renode.overrideAttrs (
   finalAttrs: _: {
     pname = "renode-unstable";
-    version = "1.15.3+20250528gitc8bcc4cd7";
+    version = "1.15.3+20250627git13a58e863";
 
     src = fetchurl {
       url = "https://builds.renode.io/renode-${finalAttrs.version}.linux-dotnet.tar.gz";
-      hash = "sha256-bt4IWsZXiOmv+FU4vlKg7Uehk3cinumCXC2LHNjtdZ4=";
+      hash = "sha256-FLFWi17ThhxXzKVYjUhF7rKqiDsiLQaGWB3dKrIgl2w=";
     };
 
     passthru.updateScript =
diff --git a/pkgs/by-name/rn/rnp/package.nix b/pkgs/by-name/rn/rnp/package.nix
index f8cd8b45da9d..21f82ba999f0 100644
--- a/pkgs/by-name/rn/rnp/package.nix
+++ b/pkgs/by-name/rn/rnp/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rnp";
-  version = "0.17.1";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "rnpgp";
     repo = "rnp";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-jUh7BxRnB6KePCk1jIvKzXgxSmWdKlQYmxshZZY4SBQ";
+    hash = "sha256-DixJhN4/iSgMkcJ0run4gwFZoUeMMiNSwWDGjT94cNM=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/ro/rocketchat-desktop/package.nix b/pkgs/by-name/ro/rocketchat-desktop/package.nix
index 7f0f59d2d2bd..ee6a8d4cf694 100644
--- a/pkgs/by-name/ro/rocketchat-desktop/package.nix
+++ b/pkgs/by-name/ro/rocketchat-desktop/package.nix
@@ -10,11 +10,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "rocketchat-desktop";
-  version = "4.5.0";
+  version = "4.6.0";
 
   src = fetchurl {
     url = "https://github.com/RocketChat/Rocket.Chat.Electron/releases/download/${version}/rocketchat-${version}-linux-amd64.deb";
-    hash = "sha256-GCCVIfo7Q5n7hQsWG9oTdfaz1ol0+NX8TaHRheJhU3I=";
+    hash = "sha256-5jIpCZfAjkYntVFXTe7j0WOMf6Y11RLVlcBnXMq7qjo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ro/rockstarlang/package.nix b/pkgs/by-name/ro/rockstarlang/package.nix
index e7fbafe4a3a9..25cb0e0f0d20 100644
--- a/pkgs/by-name/ro/rockstarlang/package.nix
+++ b/pkgs/by-name/ro/rockstarlang/package.nix
@@ -7,13 +7,13 @@
 
 buildDotnetModule (finalAttrs: {
   pname = "rockstarlang";
-  version = "2.0.30";
+  version = "2.0.31";
 
   src = fetchFromGitHub {
     owner = "RockstarLang";
     repo = "rockstar";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-IqdObwJm+TiNnNkDg1cbvDI029RLn9i3hxP+wFW730g=";
+    hash = "sha256-243rN8hVaIfkEkkbgHZr2HKmqvG9KBVhvvoYJwoWgQs=";
   };
 
   projectFile = "Starship/Rockstar/Rockstar.csproj";
diff --git a/pkgs/by-name/rq/rqlite/package.nix b/pkgs/by-name/rq/rqlite/package.nix
index 2143d7275841..a1e9314b9219 100644
--- a/pkgs/by-name/rq/rqlite/package.nix
+++ b/pkgs/by-name/rq/rqlite/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "rqlite";
-  version = "8.37.4";
+  version = "8.38.2";
 
   src = fetchFromGitHub {
     owner = "rqlite";
     repo = "rqlite";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PMoQg3QjG0hyWKWIf5JIj7X9XbjpHpy1Hwo9DMsutW0=";
+    hash = "sha256-ZdfChx4K2YnKsFO1N8RQSremP0Yz3guq66XCw/Mrxoc=";
   };
 
-  vendorHash = "sha256-3ZoMpmWOf3wIK0R1mY2GRzPA+Xb6YIdk+hLfzsC84/U=";
+  vendorHash = "sha256-qzg55fVF7GJlwqRgfLzVIWS95BfiWuty7stw+loR6/o=";
 
   subPackages = [
     "cmd/rqlite"
diff --git a/pkgs/by-name/ru/rutorrent/package.nix b/pkgs/by-name/ru/rutorrent/package.nix
index c7ed3f0da999..56679265cd5e 100644
--- a/pkgs/by-name/ru/rutorrent/package.nix
+++ b/pkgs/by-name/ru/rutorrent/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rutorrent";
-  version = "5.2.9";
+  version = "5.2.10";
 
   src = fetchFromGitHub {
     owner = "Novik";
     repo = "ruTorrent";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-a2MZAwR/JoFvKVuBjNyT4hZPe1Mx0hpvdJUTuch0Ayw=";
+    hash = "sha256-g1CjwK0GLAdRLWbQeyF8H+OFaL8WgibGrQti9kHz2iM=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/sc/schemacrawler/package.nix b/pkgs/by-name/sc/schemacrawler/package.nix
index 143a362bb491..a6e9808d6846 100644
--- a/pkgs/by-name/sc/schemacrawler/package.nix
+++ b/pkgs/by-name/sc/schemacrawler/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "schemacrawler";
-  version = "16.26.1";
+  version = "16.26.2";
 
   src = fetchzip {
     url = "https://github.com/schemacrawler/SchemaCrawler/releases/download/v${finalAttrs.version}/schemacrawler-${finalAttrs.version}-bin.zip";
-    hash = "sha256-dXaHL9LBd/XKwPqVL7RxmepkzVXInQ19iKD35jYb4Y4=";
+    hash = "sha256-JQHV88+B7lNKgi8Isbk3gv3JN13YzVjeiPU8qauEhY0=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/se/seamly2d/package.nix b/pkgs/by-name/se/seamly2d/package.nix
index d125d56fb4d7..76c5325bd667 100644
--- a/pkgs/by-name/se/seamly2d/package.nix
+++ b/pkgs/by-name/se/seamly2d/package.nix
@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "seamly2d";
-  version = "2025.6.9.216";
+  version = "2025.6.16.216";
 
   src = fetchFromGitHub {
     owner = "FashionFreedom";
     repo = "Seamly2D";
     tag = "v${version}";
-    hash = "sha256-2fQFCVoSap1kv3mD91UEvol9JvZjXL7f9KR3St+XqaU=";
+    hash = "sha256-eRHnqeZAxdJYCpm9ybaDiwtUf0wpMqHQlYA/E01GbOA=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/se/sem/package.nix b/pkgs/by-name/se/sem/package.nix
index 6af0750f26c8..d5d677fbbeea 100644
--- a/pkgs/by-name/se/sem/package.nix
+++ b/pkgs/by-name/se/sem/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "sem";
-  version = "0.31.0";
+  version = "0.32.0";
 
   src = fetchFromGitHub {
     owner = "semaphoreci";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-w/QxN8ntfyoHKVLRIawN0SoUI2oTQg8gNzVUiXR7Klc=";
+    sha256 = "sha256-w9j7Lv8aSTWqH75ttazHjop+B1JbcgSuUIIGbJpR2vc=";
   };
 
   vendorHash = "sha256-p8+M+pRp12P7tYlFpXjU94JcJOugQpD8rFdowhonh74=";
diff --git a/pkgs/by-name/so/source-meta-json-schema/package.nix b/pkgs/by-name/so/source-meta-json-schema/package.nix
index 84728525e17e..b5c15f0f0140 100644
--- a/pkgs/by-name/so/source-meta-json-schema/package.nix
+++ b/pkgs/by-name/so/source-meta-json-schema/package.nix
@@ -5,7 +5,7 @@
   cmake,
 }:
 let
-  version = "9.3.5";
+  version = "9.3.7";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "source-meta-json-schema";
@@ -15,7 +15,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "sourcemeta";
     repo = "jsonschema";
     rev = "v${version}";
-    hash = "sha256-wTayFVsnDchd3lZV5F2+8PTDHVzPiSQunZGVz7L9ZZs=";
+    hash = "sha256-eqFIsdwPwgQnWR36wE+nWCZxFKudVnxtPoGMVSdmZco=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sp/spring-boot-cli/package.nix b/pkgs/by-name/sp/spring-boot-cli/package.nix
index ef8082f264dc..13e2b15178d1 100644
--- a/pkgs/by-name/sp/spring-boot-cli/package.nix
+++ b/pkgs/by-name/sp/spring-boot-cli/package.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spring-boot-cli";
-  version = "3.5.0";
+  version = "3.5.3";
 
   src = fetchzip {
     url = "mirror://maven/org/springframework/boot/spring-boot-cli/${finalAttrs.version}/spring-boot-cli-${finalAttrs.version}-bin.zip";
-    hash = "sha256-sc99w/MjLgDTfDuBFhgVrv1gB9RIrL1gI+ZNGydWe+Q=";
+    hash = "sha256-cUpzXm5YEtbbJwgSPxEpgJXlmXNQe/XfD3kkgQs534Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sq/sqlboiler/package.nix b/pkgs/by-name/sq/sqlboiler/package.nix
index ed15064493c9..b7eb6f471d09 100644
--- a/pkgs/by-name/sq/sqlboiler/package.nix
+++ b/pkgs/by-name/sq/sqlboiler/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "sqlboiler";
-  version = "4.19.1";
+  version = "4.19.2";
 
   src = fetchFromGitHub {
     owner = "volatiletech";
     repo = "sqlboiler";
     tag = "v${version}";
-    hash = "sha256-BZZL1nRd2YGj5wJNKkla+Ve4OQ1iU/8r82yjJxmc43M=";
+    hash = "sha256-rT0aNF7+AMO7oin5qh/IXZWt3+3b9PU4ytH6TKieEZY=";
   };
 
-  vendorHash = "sha256-AFpJjngGZJ14Gfg6FEavZOR6WdboJYAweaLtqB9jm1k=";
+  vendorHash = "sha256-LMHFDOKZQa0DJLHehRBzGGlb7apppnMDbjnJ4spuZtA=";
 
   tags = [
     "mysql"
diff --git a/pkgs/by-name/sq/squawk/package.nix b/pkgs/by-name/sq/squawk/package.nix
index 9401f769db56..c48bc2bb41c1 100644
--- a/pkgs/by-name/sq/squawk/package.nix
+++ b/pkgs/by-name/sq/squawk/package.nix
@@ -10,18 +10,18 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "squawk";
-  version = "2.10.0";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "sbdchd";
     repo = "squawk";
     tag = "v${version}";
-    hash = "sha256-YNVxtfS2N6+ll8oxykVD3FCFJAdLksX5QJggMXi3G4s=";
+    hash = "sha256-im608G2A2458lZmxHZaciFI4y+gI9MseP1N1Wm9Z0BA=";
   };
 
   useFetchCargoVendor = true;
 
-  cargoHash = "sha256-nuAsZmaPCYvmKnJZsQzCVy/QNpY9ZQSAORL2U6NjsNY=";
+  cargoHash = "sha256-3pnrMPl6xvy16UexWcV4N7CshVAwM8SfNbs2WCQa564=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/st/steampipe/package.nix b/pkgs/by-name/st/steampipe/package.nix
index f07a29aa4083..34ce97439438 100644
--- a/pkgs/by-name/st/steampipe/package.nix
+++ b/pkgs/by-name/st/steampipe/package.nix
@@ -11,7 +11,7 @@
 
 buildGoModule rec {
   pname = "steampipe";
-  version = "1.1.4";
+  version = "2.0.1";
 
   env.CGO_ENABLED = 0;
 
@@ -19,10 +19,10 @@ buildGoModule rec {
     owner = "turbot";
     repo = "steampipe";
     tag = "v${version}";
-    hash = "sha256-kK06lYUQZGvRZs1WN/dVXc1BDRNFbQUfxpzTl1l5PBU=";
+    hash = "sha256-wex82Vfym6Lf9aLCBGudYg06fGTMiegnJNMFfNXKHy0=";
   };
 
-  vendorHash = "sha256-3SQH3TG7DwhaAPesNCIRZLEXqsLWhtWfuWYgQUqSp2o=";
+  vendorHash = "sha256-Mm5wLLcpcgCl9Vz6bqJPrrSu7CgqJKpYSbXD++F95/I=";
   proxyVendor = true;
 
   postPatch = ''
diff --git a/pkgs/by-name/su/sudachidict/package.nix b/pkgs/by-name/su/sudachidict/package.nix
index fa1d3e323906..dca17f1093a0 100644
--- a/pkgs/by-name/su/sudachidict/package.nix
+++ b/pkgs/by-name/su/sudachidict/package.nix
@@ -7,20 +7,20 @@
 
 let
   pname = "sudachidict";
-  version = "20250129";
+  version = "20250515";
 
   srcs = {
     core = fetchzip {
       url = "https://github.com/WorksApplications/SudachiDict/releases/download/v${version}/sudachi-dictionary-${version}-core.zip";
-      hash = "sha256-aoUS+PM/gBGBU8HJqJB9Pbw7FNCWu8sp81DamtlFsXc=";
+      hash = "sha256-+N6B1eW8ScDJSjMWjSNJlQAEOCNh5Q0lcsAWrY9eRVE=";
     };
     small = fetchzip {
       url = "https://github.com/WorksApplications/SudachiDict/releases/download/v${version}/sudachi-dictionary-${version}-small.zip";
-      hash = "sha256-+50hcgXmtVZ7rFCInmSjoGGJCLOnax9UcqN5CmQcgGI=";
+      hash = "sha256-+0pg2wXS1Y/5LGnVvEbtEpws2LqFPv88jCHsV+Oxb5E=";
     };
     full = fetchzip {
       url = "https://github.com/WorksApplications/SudachiDict/releases/download/v${version}/sudachi-dictionary-${version}-full.zip";
-      hash = "sha256-2dKHI3TKF3aIWdN2lhcCbjRdJOH91rJNsdC7o0Wdlj0=";
+      hash = "sha256-jYFZax9LDLX6knGuQDhbhdDU3WGjevVkDFF/XZx2kg0=";
     };
   };
 in
diff --git a/pkgs/by-name/sv/svelte-language-server/package-lock.json b/pkgs/by-name/sv/svelte-language-server/package-lock.json
index b84c9cd20be9..ad55564d9c0a 100644
--- a/pkgs/by-name/sv/svelte-language-server/package-lock.json
+++ b/pkgs/by-name/sv/svelte-language-server/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "svelte-language-server",
-  "version": "0.17.15",
+  "version": "0.17.16",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "svelte-language-server",
-      "version": "0.17.15",
+      "version": "0.17.16",
       "license": "MIT",
       "dependencies": {
         "@jridgewell/trace-mapping": "^0.3.25",
@@ -239,9 +239,9 @@
       "license": "MIT"
     },
     "node_modules/@types/lodash": {
-      "version": "4.17.17",
-      "resolved": "https://registry.npmjs.org/@types/lodash/-/lodash-4.17.17.tgz",
-      "integrity": "sha512-RRVJ+J3J+WmyOTqnz3PiBLA501eKwXl2noseKOrNo/6+XEHjTAxO4xHvxQB6QuNm+s4WRbn6rSiap8+EA+ykFQ==",
+      "version": "4.17.18",
+      "resolved": "https://registry.npmjs.org/@types/lodash/-/lodash-4.17.18.tgz",
+      "integrity": "sha512-KJ65INaxqxmU6EoCiJmRPZC9H9RVWCRd349tXM2M3O5NA7cY6YL7c0bHAHQ93NOfTObEQ004kd2QVHs/r0+m4g==",
       "dev": true,
       "license": "MIT"
     },
@@ -253,9 +253,9 @@
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "18.19.103",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-18.19.103.tgz",
-      "integrity": "sha512-hHTHp+sEz6SxFsp+SA+Tqrua3AbmlAw+Y//aEwdHrdZkYVRWdvWD3y5uPZ0flYOkgskaFWqZ/YGFm3FaFQ0pRw==",
+      "version": "18.19.112",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-18.19.112.tgz",
+      "integrity": "sha512-i+Vukt9POdS/MBI7YrrkkI5fMfwFtOjphSmt4WXYLfwqsfr6z/HdCx7LqT9M7JktGob8WNgj8nFB4TbGNE4Cog==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -303,9 +303,9 @@
       "license": "MIT"
     },
     "node_modules/acorn": {
-      "version": "8.14.1",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.14.1.tgz",
-      "integrity": "sha512-OvQ/2pUDKmgfCg++xsTX1wGxfTaszcHVcTctW4UJB4hibJx2HXxxO5UmVgyjMa+ZDsiaf5wWLXYpRWMmBI0QHg==",
+      "version": "8.15.0",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.15.0.tgz",
+      "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
       "license": "MIT",
       "bin": {
         "acorn": "bin/acorn"
@@ -430,9 +430,9 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.11",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
-      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "version": "1.1.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
+      "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -544,9 +544,9 @@
       }
     },
     "node_modules/code-red/node_modules/@types/estree": {
-      "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.7.tgz",
-      "integrity": "sha512-w28IoSUCJpidD/TGviZwwMJckNESJZXFu7NBZ5YJ4mEUnNraUn9Pm8HSZm/jDF1pDWYKspWE7oVphigUPRakIQ==",
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
+      "integrity": "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==",
       "license": "MIT"
     },
     "node_modules/code-red/node_modules/estree-walker": {
@@ -746,9 +746,9 @@
       "license": "MIT"
     },
     "node_modules/fdir": {
-      "version": "6.4.4",
-      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.4.4.tgz",
-      "integrity": "sha512-1NZP+GK4GfuAv3PqKvxQRDMjdSRZjnkq7KfhlNrCNNlZ0ygQFpebfrnfnq/W7fpUnAv9aGWmY1zKx7FYL3gwhg==",
+      "version": "6.4.6",
+      "resolved": "https://registry.npmjs.org/fdir/-/fdir-6.4.6.tgz",
+      "integrity": "sha512-hiFoqpyZcfNm1yc4u8oWCf9A2c4D3QjCrks3zmoVKVxpQRzmPNar1hUJcBG2RQHvEVGDN+Jm81ZheVLAQMK6+w==",
       "license": "MIT",
       "peerDependencies": {
         "picomatch": "^3 || ^4"
@@ -1010,9 +1010,9 @@
       }
     },
     "node_modules/is-reference/node_modules/@types/estree": {
-      "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.7.tgz",
-      "integrity": "sha512-w28IoSUCJpidD/TGviZwwMJckNESJZXFu7NBZ5YJ4mEUnNraUn9Pm8HSZm/jDF1pDWYKspWE7oVphigUPRakIQ==",
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
+      "integrity": "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==",
       "license": "MIT"
     },
     "node_modules/is-unicode-supported": {
@@ -1418,9 +1418,9 @@
       }
     },
     "node_modules/periscopic/node_modules/@types/estree": {
-      "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.7.tgz",
-      "integrity": "sha512-w28IoSUCJpidD/TGviZwwMJckNESJZXFu7NBZ5YJ4mEUnNraUn9Pm8HSZm/jDF1pDWYKspWE7oVphigUPRakIQ==",
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
+      "integrity": "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==",
       "license": "MIT"
     },
     "node_modules/periscopic/node_modules/estree-walker": {
@@ -1694,9 +1694,9 @@
       }
     },
     "node_modules/svelte/node_modules/@types/estree": {
-      "version": "1.0.7",
-      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.7.tgz",
-      "integrity": "sha512-w28IoSUCJpidD/TGviZwwMJckNESJZXFu7NBZ5YJ4mEUnNraUn9Pm8HSZm/jDF1pDWYKspWE7oVphigUPRakIQ==",
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.8.tgz",
+      "integrity": "sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==",
       "license": "MIT"
     },
     "node_modules/svelte/node_modules/estree-walker": {
@@ -1709,9 +1709,9 @@
       }
     },
     "node_modules/svelte2tsx": {
-      "version": "0.7.39",
-      "resolved": "https://registry.npmjs.org/svelte2tsx/-/svelte2tsx-0.7.39.tgz",
-      "integrity": "sha512-NX8a7eSqF1hr6WKArvXr7TV7DeE+y0kDFD7L5JP7TWqlwFidzGKaG415p992MHREiiEWOv2xIWXJ+mlONofs0A==",
+      "version": "0.7.40",
+      "resolved": "https://registry.npmjs.org/svelte2tsx/-/svelte2tsx-0.7.40.tgz",
+      "integrity": "sha512-Fgqe2lzC9DWT/kQTIXqN39O2ot9rUqzUu9dqpbuI6EsaEJ6+RSXVmXnxcNYMlKb2LRPDoIg9TVzXYWwi0zhCmQ==",
       "license": "MIT",
       "dependencies": {
         "dedent-js": "^1.0.1",
@@ -1842,9 +1842,9 @@
       "license": "MIT"
     },
     "node_modules/vscode-css-languageservice": {
-      "version": "6.3.5",
-      "resolved": "https://registry.npmjs.org/vscode-css-languageservice/-/vscode-css-languageservice-6.3.5.tgz",
-      "integrity": "sha512-ehEIMXYPYEz/5Svi2raL9OKLpBt5dSAdoCFoLpo0TVFKrVpDemyuQwS3c3D552z/qQCg3pMp8oOLMObY6M3ajQ==",
+      "version": "6.3.6",
+      "resolved": "https://registry.npmjs.org/vscode-css-languageservice/-/vscode-css-languageservice-6.3.6.tgz",
+      "integrity": "sha512-fU4h8mT3KlvfRcbF74v/M+Gzbligav6QMx4AD/7CbclWPYOpGb9kgIswfpZVJbIcOEJJACI9iYizkNwdiAqlHw==",
       "license": "MIT",
       "dependencies": {
         "@vscode/l10n": "^0.0.18",
diff --git a/pkgs/by-name/sv/svelte-language-server/package.nix b/pkgs/by-name/sv/svelte-language-server/package.nix
index ec53da7d2384..5bc549af5e0a 100644
--- a/pkgs/by-name/sv/svelte-language-server/package.nix
+++ b/pkgs/by-name/sv/svelte-language-server/package.nix
@@ -4,7 +4,7 @@
   fetchurl,
 }:
 let
-  version = "0.17.15";
+  version = "0.17.16";
 in
 buildNpmPackage {
   pname = "svelte-language-server";
@@ -12,10 +12,10 @@ buildNpmPackage {
 
   src = fetchurl {
     url = "https://registry.npmjs.org/svelte-language-server/-/svelte-language-server-${version}.tgz";
-    hash = "sha256-xjA17Dn1XxT5ghNXrkMtgcesMpRqtBP40RT/3AcU6lw=";
+    hash = "sha256-CvTP46+jXfeM+jLKBsW/uYtwpJs5KhE+E6I3aY7PQFw=";
   };
 
-  npmDepsHash = "sha256-jsjnbjM4PkFgbbmkMNmOCrZ7HgLHDELOHe+MSr05o1A=";
+  npmDepsHash = "sha256-xPOllyDdrk+33UFHUkmStC0pnNvtK4oEn+Vdp6dPabI=";
 
   postPatch = ''
     ln -s ${./package-lock.json} package-lock.json
diff --git a/pkgs/by-name/sy/symbolicator/package.nix b/pkgs/by-name/sy/symbolicator/package.nix
index c0c14a024ecc..f727509ea6d3 100644
--- a/pkgs/by-name/sy/symbolicator/package.nix
+++ b/pkgs/by-name/sy/symbolicator/package.nix
@@ -10,18 +10,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "symbolicator";
-  version = "25.5.1";
+  version = "25.6.1";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "symbolicator";
     rev = version;
-    hash = "sha256-4w7HC4m+aoIYPYQx2bgLcB/xfqXEX4XzYU4wR44OLRg=";
+    hash = "sha256-11FxkZwMIbGQC3FXVoialDFLaXSuQshC84bSB/EogSI=";
     fetchSubmodules = true;
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-vKIpVe5NDyk5RurUlUN8RdMMl1EAKa8rsCHXsFW6h8I=";
+  cargoHash = "sha256-WkwpVFFUrcef1Hql5o/GqCKWLpQtWkmhpBBA/tc7iTU=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/sy/systemd-lsp/package.nix b/pkgs/by-name/sy/systemd-lsp/package.nix
new file mode 100644
index 000000000000..5fae4ff54d38
--- /dev/null
+++ b/pkgs/by-name/sy/systemd-lsp/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+  rustPlatform,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "systemd-lsp";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "JFryy";
+    repo = "systemd-lsp";
+    rev = "43e0a26b12653b97939612ce8f4e2f3bae562ea1";
+    hash = "sha256-l2/8khzXZjyga4nEdl4pcl3AOscCBxZHH3tW3Cv+RUk=";
+  };
+
+  cargoHash = "sha256-bYksgHTXomeEJuSk800+/PYXzMvrixSjfPnoqxStWAA=";
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script {
+      extraArgs = [ "--version=branch" ];
+    };
+  };
+
+  meta = {
+    description = "Language server implementation for systemd unit files made in Rust";
+    homepage = "https://github.com/JFryy/systemd-lsp";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ mahyarmirrashed ];
+    mainProgram = "systemd-lsp";
+  };
+})
diff --git a/pkgs/by-name/ta/tailwindcss_4/package.nix b/pkgs/by-name/ta/tailwindcss_4/package.nix
index 23c412a3ceb4..a7d0e41d6400 100644
--- a/pkgs/by-name/ta/tailwindcss_4/package.nix
+++ b/pkgs/by-name/ta/tailwindcss_4/package.nix
@@ -7,7 +7,7 @@
   makeWrapper,
 }:
 let
-  version = "4.1.10";
+  version = "4.1.11";
   inherit (stdenv.hostPlatform) system;
   throwSystem = throw "tailwindcss has not been packaged for ${system} yet.";
 
@@ -22,10 +22,10 @@ let
 
   hash =
     {
-      aarch64-darwin = "sha256-80qFp1sfLeLH5Kn7xPuXbmSieAmA6EPfh9nBP1VfSkw=";
-      aarch64-linux = "sha256-Z+tiC7QEwgRtPBJ9vy1/mSFZUGVHXn0tUo45wbszybY=";
-      x86_64-darwin = "sha256-R6EwxfY5OERW4KyKDWC5XXSQYYcxSk28N+fB3b63E64=";
-      x86_64-linux = "sha256-CoWj5TPy55g725HAjqRPDqs77MJ15gs7qt3xj3HTkL8=";
+      aarch64-darwin = "sha256-9ZhLnABcPmeEHDOQbHp8kuheQF9h4Cnpu2LogN1mLnk=";
+      aarch64-linux = "sha256-BAmqQiKWn0f6b0Fg/lOH55v3Jp56/g6LIvdTLJjh0xQ=";
+      x86_64-darwin = "sha256-duJzJlBtENUOZbdReV8FN/kwTssQCr6DXsE4xBd084w=";
+      x86_64-linux = "sha256-ZIBbhK9CkuBD6m+G0kLxkcCsdTWcGkmEVd/mxkKv26s=";
     }
     .${system} or throwSystem;
 in
diff --git a/pkgs/by-name/ta/tarlz/package.nix b/pkgs/by-name/ta/tarlz/package.nix
index b6c1be7bafd4..ceb5cf32e3a7 100644
--- a/pkgs/by-name/ta/tarlz/package.nix
+++ b/pkgs/by-name/ta/tarlz/package.nix
@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tarlz";
-  version = "0.27.1";
+  version = "0.28";
   outputs = [
     "out"
     "man"
@@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://savannah/lzip/tarlz/tarlz-${finalAttrs.version}.tar.lz";
-    sha256 = "7091968e8f9b5333730e7a558ebf5aa9089d9f0528e6aea994c6f24a9d46a03f";
+    sha256 = "sha256-6kE/UanxWMuqqidFGiA10ukyInXarPI39/aENHwJ8ik=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/ta/task-master-ai/package.nix b/pkgs/by-name/ta/task-master-ai/package.nix
index a726c6343059..c702b814c98b 100644
--- a/pkgs/by-name/ta/task-master-ai/package.nix
+++ b/pkgs/by-name/ta/task-master-ai/package.nix
@@ -7,16 +7,16 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "task-master-ai";
-  version = "0.17.1";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "eyaltoledano";
     repo = "claude-task-master";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1k17Eiwu+Fj45VCYVzf9Obj7MniyOuWerm76rNX4E8E=";
+    hash = "sha256-RnbquGcanpBH5A++MZOVNLXEdn7qVJIVWxUOZEBpF/o=";
   };
 
-  npmDepsHash = "sha256-0usq016nVWxhDx36ijk5O7oN1pkdTu38mgjfBPIBqss=";
+  npmDepsHash = "sha256-GjRxjafbJ5DqikvO3Z7YPtuUHaG5ezxdrQq9f7WDEi4=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/th/thin-provisioning-tools/package.nix b/pkgs/by-name/th/thin-provisioning-tools/package.nix
index 216e37afb3b7..ee802ced59fa 100644
--- a/pkgs/by-name/th/thin-provisioning-tools/package.nix
+++ b/pkgs/by-name/th/thin-provisioning-tools/package.nix
@@ -10,13 +10,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "thin-provisioning-tools";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "jthornber";
     repo = "thin-provisioning-tools";
     rev = "v${version}";
-    hash = "sha256-gpUiLUdg+EpVkJzDg43gI5oXhy611QwndwZZVVgg4Lg=";
+    hash = "sha256-gjsURDzA4LRTTgKZPzzTcvTdi1mXx4FkWmyoPcpdPfU=";
   };
 
   nativeBuildInputs = [
@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage rec {
   ];
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-cjNgp+StWkqtR1Y4caLv8EWhHsinSpbc/hgUUG7CGtE=";
+  cargoHash = "sha256-H5GRAZpFl2t/bH8THyPkZq5ptS70XkhSCxQ6ko+0RC8=";
 
   passthru.tests = {
     inherit (nixosTests.lvm2) lvm-thinpool-linux-latest;
diff --git a/pkgs/by-name/ti/tidal-hifi/package.nix b/pkgs/by-name/ti/tidal-hifi/package.nix
index c7314ecfa706..bbfa8be84b00 100644
--- a/pkgs/by-name/ti/tidal-hifi/package.nix
+++ b/pkgs/by-name/ti/tidal-hifi/package.nix
@@ -87,7 +87,7 @@ let
     vulkan-loader
   ];
 in
-buildNpmPackage {
+buildNpmPackage (self: {
   pname = "tidal-hifi";
   inherit version;
 
@@ -125,24 +125,23 @@ buildNpmPackage {
 
   desktopItems = [
     (makeDesktopItem {
-      exec = "tidal-hifi";
-      name = "TIDAL Hi-Fi";
-      desktopName = "tidal-hifi";
-      genericName = "TIDAL Hi-Fi";
-      comment = "The web version of listen.tidal.com running in electron with hifi support thanks to widevine.";
+      name = self.pname;
+      desktopName = "TIDAL Hi-Fi";
+      genericName = "Music Player";
+      comment = self.meta.description;
       icon = "tidal-hifi";
-      startupNotify = true;
+      exec = self.meta.mainProgram;
       terminal = false;
-      type = "Application";
-      categories = [
-        "Network"
-        "Application"
-        "AudioVideo"
-        "Audio"
-        "Video"
-      ];
-      startupWMClass = "tidal-hifi";
       mimeTypes = [ "x-scheme-handler/tidal" ];
+      categories = [
+        "Audio"
+        "Music"
+        "Player"
+        "Network"
+        "AudioVideo"
+      ];
+      startupNotify = true;
+      startupWMClass = "tidal-hifi";
       extraConfig.X-PulseAudio-Properties = "media.role=music";
     })
   ];
@@ -190,7 +189,7 @@ buildNpmPackage {
 
   meta = {
     changelog = "https://github.com/Mastermindzh/tidal-hifi/releases/tag/${version}";
-    description = "Web version of Tidal running in electron with hifi support thanks to widevine";
+    description = "Web version of Tidal running in Electron with Hi-Fi support thanks to Widevine";
     homepage = "https://github.com/Mastermindzh/tidal-hifi";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
@@ -201,4 +200,4 @@ buildNpmPackage {
     platforms = lib.platforms.linux;
     mainProgram = "tidal-hifi";
   };
-}
+})
diff --git a/pkgs/by-name/tr/trealla/package.nix b/pkgs/by-name/tr/trealla/package.nix
index 952a6e9206e7..9d57b01e4a0e 100644
--- a/pkgs/by-name/tr/trealla/package.nix
+++ b/pkgs/by-name/tr/trealla/package.nix
@@ -23,13 +23,13 @@ assert lib.elem lineEditingLibrary [
 ];
 stdenv.mkDerivation (finalAttrs: {
   pname = "trealla";
-  version = "2.73.3";
+  version = "2.73.16";
 
   src = fetchFromGitHub {
     owner = "trealla-prolog";
     repo = "trealla";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-CaSn2WErUMutdlBf+Clck5srwlUhrF6S+j0IpUMh3i0=";
+    hash = "sha256-9Qac5Ac0cyqD5OlsFwBQFt9uwwv5wfm5h9Y5ZsZMHsc=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/tr/trgui-ng-web/package.nix b/pkgs/by-name/tr/trgui-ng-web/package.nix
new file mode 100644
index 000000000000..bddf9e87a322
--- /dev/null
+++ b/pkgs/by-name/tr/trgui-ng-web/package.nix
@@ -0,0 +1 @@
+{ trgui-ng }: trgui-ng.passthru.frontend
diff --git a/pkgs/by-name/tr/trgui-ng/package.nix b/pkgs/by-name/tr/trgui-ng/package.nix
new file mode 100644
index 000000000000..8c36115b2c44
--- /dev/null
+++ b/pkgs/by-name/tr/trgui-ng/package.nix
@@ -0,0 +1,109 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  alsa-lib,
+  buildNpmPackage,
+  cargo-tauri,
+  dbip-country-lite,
+  glib,
+  libayatana-appindicator,
+  nix-update-script,
+  openssl,
+  pkg-config,
+  rustPlatform,
+  webkitgtk_4_1,
+}:
+let
+  version = "1.4.0-unstable-2025-05-18";
+
+  src = fetchFromGitHub {
+    owner = "openscopeproject";
+    repo = "TrguiNG";
+    rev = "d2cd93ecc724f196d93c701fa27afa4288d2a37c";
+    hash = "sha256-Y3ZSpXmG+wi7x7qanKpRp917alssqF78L27Yt9K9Khs=";
+  };
+
+  meta = {
+    description = "Remote GUI for Transmission torrent daemon";
+    homepage = "https://github.com/openscopeproject/TrguiNG";
+    license = lib.licenses.agpl3Plus;
+    maintainers = with lib.maintainers; [ ambroisie ];
+  };
+
+  frontend = buildNpmPackage (finalAttrs: {
+    pname = "TrguiNG-frontend";
+    inherit version src;
+    npmDepsHash = "sha256-sHZHAlV3zVeCmVTlIr0NeS1zxRCKfRMv1w9bW0tOg3g=";
+
+    npmBuildScript = "webpack-prod";
+
+    installPhase = ''
+      runHook preInstall
+
+      cp -r dist/ $out
+
+      runHook postInstall
+    '';
+
+    env.TRGUING_VERSION = finalAttrs.version;
+
+    meta = meta // {
+      description = "Web UI for Transmission torrent daemon";
+    };
+  });
+in
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "TrguiNG";
+  inherit version src;
+
+  cargoHash = "sha256-TflzT1BNAciMcxcejrlmIOIjXc1tpm/zX0kjk+dpGiM=";
+
+  postPatch =
+    ''
+      cp ${dbip-country-lite}/share/dbip/dbip-country-lite.mmdb src-tauri/dbip.mmdb
+
+      # Copy pre-built frontend and remove `beforeBuildCommand` to build it
+      cp -r ${finalAttrs.passthru.frontend} dist/
+      substituteInPlace src-tauri/tauri.conf.json \
+        --replace-fail '"npm run webpack-prod"' '""'
+    ''
+    + lib.optionalString stdenv.hostPlatform.isLinux ''
+      substituteInPlace $cargoDepsCopy/libappindicator-sys-*/src/lib.rs \
+        --replace-fail "libayatana-appindicator3.so.1" "${libayatana-appindicator}/lib/libayatana-appindicator3.so.1"
+    '';
+
+  nativeBuildInputs = [
+    cargo-tauri.hook
+    pkg-config
+  ];
+
+  buildInputs =
+    [
+      openssl
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      alsa-lib
+      glib
+      libayatana-appindicator
+      webkitgtk_4_1
+    ];
+
+  cargoRoot = "src-tauri";
+  buildAndTestSubdir = "src-tauri";
+
+  passthru = {
+    updateScript = nix-update-script {
+      extraArgs = [
+        "-s"
+        "frontend"
+      ];
+    };
+    inherit frontend;
+  };
+
+  meta = meta // {
+    mainProgram = "TrguiNG";
+  };
+})
diff --git a/pkgs/by-name/tr/triforce-lv2/package.nix b/pkgs/by-name/tr/triforce-lv2/package.nix
index 657233da0b8d..e52a62ef43c5 100644
--- a/pkgs/by-name/tr/triforce-lv2/package.nix
+++ b/pkgs/by-name/tr/triforce-lv2/package.nix
@@ -2,35 +2,59 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  stdenv,
+  nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "triforce-lv2";
   version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "chadmed";
     repo = "triforce";
-    rev = version;
+    tag = finalAttrs.version;
     hash = "sha256-f4i0S6UaVfs1CUeQRqo22PRgMNwYDNoMunHidI1XzBk=";
   };
 
-  useFetchCargoVendor = true;
-  cargoHash = "sha256-2FC6wlFJkQryA/bcjF0GjrMQVb8hlUY+muFqPqShWss=";
-
-  installPhase = ''
-    export LIBDIR=$out/lib
-    mkdir -p $LIBDIR
-
-    make
-    make install
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace-fail "target/release" \
+                     "target/${stdenv.hostPlatform.rust.cargoShortTarget}/$cargoBuildType"
   '';
 
-  meta = with lib; {
-    homepage = "https://github.com/chadmed/triforce";
-    description = "Minimum Variance Distortionless Response adaptive beamformer for the microphone array found in some Apple Silicon laptops";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ yuka ];
-    platforms = platforms.linux;
+  cargoHash = "sha256-2FC6wlFJkQryA/bcjF0GjrMQVb8hlUY+muFqPqShWss=";
+
+  dontCargoInstall = true;
+
+  installFlags = [
+    "DESTDIR=$(out)"
+    "LIBDIR=lib"
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
   };
-}
+
+  meta = {
+    homepage = "https://github.com/chadmed/triforce";
+    description = "Beamformer for Apple Silicon laptops";
+    longDescription = ''
+      Triforce implements a Minimum Variance Distortionless Response
+      adaptive beamformer for the microphone array found in the
+      following Apple Silicon laptops:
+
+      - MacBook Pro 13" (M1/M2)
+      - MacBook Air 13" (M1/M2)
+      - MacBook Pro 14" (M1 Pro/Max, M2 Pro/Max)
+      - MacBook Pro 16" (M1 Pro/Max, M2 Pro/Max)
+      - MacBook Air 15" (M2)
+    '';
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [
+      normalcea
+      yuka
+    ];
+    platforms = [ "aarch64-linux" ];
+  };
+})
diff --git a/pkgs/by-name/tu/tutanota-desktop/package.nix b/pkgs/by-name/tu/tutanota-desktop/package.nix
index bd9e16e3af1e..a010b6fbb24a 100644
--- a/pkgs/by-name/tu/tutanota-desktop/package.nix
+++ b/pkgs/by-name/tu/tutanota-desktop/package.nix
@@ -7,11 +7,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "tutanota-desktop";
-  version = "287.250602.0";
+  version = "293.250624.0";
 
   src = fetchurl {
     url = "https://github.com/tutao/tutanota/releases/download/tutanota-desktop-release-${version}/tutanota-desktop-linux.AppImage";
-    hash = "sha256-HHr2XaVYy0o/HdVcyGi1+5iHDhqlkFp0wlRpr7v61OA=";
+    hash = "sha256-drt5RCky5ChefZb/aICIj7YfSjY+WvKiaMufZLj1UHU=";
   };
 
   extraPkgs = pkgs: [ pkgs.libsecret ];
diff --git a/pkgs/by-name/tw/twilio-cli/package.nix b/pkgs/by-name/tw/twilio-cli/package.nix
index 780a73fbd8f6..1bfc3d3e3f0b 100644
--- a/pkgs/by-name/tw/twilio-cli/package.nix
+++ b/pkgs/by-name/tw/twilio-cli/package.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "twilio-cli";
-  version = "5.23.1";
+  version = "6.0.0";
 
   src = fetchzip {
     url = "https://twilio-cli-prod.s3.amazonaws.com/twilio-v${finalAttrs.version}/twilio-v${finalAttrs.version}.tar.gz";
-    hash = "sha256-GPOISOR3N8CTS7eNtDYQkzX1bjZYfOMz4zj//K32Dsw=";
+    hash = "sha256-Trg5UIySxPbwDoXYF4xNSVjP2xXqBVxMHEqOdzpIiaI=";
   };
 
   buildInputs = [ nodejs-slim ];
diff --git a/pkgs/by-name/tw/twitterBootstrap/package.nix b/pkgs/by-name/tw/twitterBootstrap/package.nix
index 901428cfff5f..9123480770df 100644
--- a/pkgs/by-name/tw/twitterBootstrap/package.nix
+++ b/pkgs/by-name/tw/twitterBootstrap/package.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bootstrap";
-  version = "5.3.6";
+  version = "5.3.7";
 
   src = fetchurl {
     url = "https://github.com/twbs/bootstrap/releases/download/v${finalAttrs.version}/bootstrap-${finalAttrs.version}-dist.zip";
-    hash = "sha256-BbjBwQPqm89SqqZs2aE+w+7KujEwFLcJLMSvCtKtYl8=";
+    hash = "sha256-nuEoO1JVD4UE0VZZTxddacpVp79o771fpi3ZHLJ/qGs=";
   };
 
   nativeBuildInputs = [ unzip ];
diff --git a/pkgs/by-name/ty/typeinc/package.nix b/pkgs/by-name/ty/typeinc/package.nix
new file mode 100644
index 000000000000..a38ab3d9adf6
--- /dev/null
+++ b/pkgs/by-name/ty/typeinc/package.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+  nix-update-script,
+  installShellFiles,
+  versionCheckHook,
+}:
+python3Packages.buildPythonApplication rec {
+  pname = "typeinc";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "AnirudhG07";
+    repo = "Typeinc";
+    tag = "v${version}";
+    hash = "sha256-p549vz4PoZgFybu/X/6BZfEnQAeQEA1jZAgqB5nD5UM=";
+  };
+
+  pyproject = true;
+  build-system = [ python3Packages.hatchling ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  dependencies = with python3Packages; [
+    setuptools
+    pyttsx3
+    pyperclip
+    keyboard
+  ];
+
+  postInstall = ''
+    installManPage docs/man/typeinc.1
+  '';
+
+  nativeCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Terminal tool to test your typing speed with various difficulty levels";
+    homepage = "https://github.com/AnirudhG07/Typeinc";
+    mainProgram = "typeinc";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ lonerOrz ];
+  };
+}
diff --git a/pkgs/by-name/ub/ubports-pdk/package.nix b/pkgs/by-name/ub/ubports-pdk/package.nix
index 06f4c5ccc5aa..a22e26a14fe6 100644
--- a/pkgs/by-name/ub/ubports-pdk/package.nix
+++ b/pkgs/by-name/ub/ubports-pdk/package.nix
@@ -15,13 +15,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "ubports-pdk";
-  version = "0-unstable-2025-04-06";
+  version = "0-unstable-2025-06-23";
 
   src = fetchFromGitHub {
     owner = "ubports";
     repo = "ubports-pdk";
-    rev = "9140e410a0c9b8ba775a2eaff89992ff3ee27f9f";
-    hash = "sha256-u0v7rUsIEvGmVr7gIbcH0pX+WagWyMEu2tqASwL5lEg=";
+    rev = "f97daec1a96f9427b23e35c8cc12e7c21fe893fd";
+    hash = "sha256-s9GC5TiIQSn5JGRy3TU5COdbcW9cDZZ8eQpflSffyOw=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/ux/uxn/package.nix b/pkgs/by-name/ux/uxn/package.nix
index 3e3d9bf4e803..c30a958f905f 100644
--- a/pkgs/by-name/ux/uxn/package.nix
+++ b/pkgs/by-name/ux/uxn/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "uxn";
-  version = "1.0-unstable-2025-05-17";
+  version = "1.0-unstable-2025-06-16";
 
   src = fetchFromSourcehut {
     owner = "~rabbits";
     repo = "uxn";
-    rev = "d609a6eed101d0e69eb9a5516b59cd6b1d31740e";
-    hash = "sha256-0uLMqd/WBDqJgP08qqlmsi+RksSn3Hz0Gz7steqScnA=";
+    rev = "97bcf2108b1d87ad80f4344bfc1aca447abe8108";
+    hash = "sha256-G+0oeqrCMHtG0V5DZafZVx1rKIncH6rDgBealGInMho=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ve/verifast/package.nix b/pkgs/by-name/ve/verifast/package.nix
index 2f5ead199807..13742f3bf75a 100644
--- a/pkgs/by-name/ve/verifast/package.nix
+++ b/pkgs/by-name/ve/verifast/package.nix
@@ -45,11 +45,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "verifast";
-  version = "25.02";
+  version = "25.06";
 
   src = fetchurl {
     url = "https://github.com/verifast/verifast/releases/download/${version}/${pname}-${version}-linux.tar.gz";
-    sha256 = "sha256-XVyH0Rs9c19Ew/DKUq68iePE0RGdmO8lGI0Hy1etZeg=";
+    sha256 = "sha256-cIFAjZmFNiCnn7/Ddn82fW9sz9ryamOx8wo4JImqy1o=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/wa/waydroid/package.nix b/pkgs/by-name/wa/waydroid/package.nix
index 446c15d1bf83..7c69c637fe9c 100644
--- a/pkgs/by-name/wa/waydroid/package.nix
+++ b/pkgs/by-name/wa/waydroid/package.nix
@@ -21,14 +21,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "waydroid";
-  version = "1.5.2";
+  version = "1.5.4";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "waydroid";
     repo = "waydroid";
     tag = version;
-    hash = "sha256-wDLnkHcVdHqjaR1Sfu+bhfZO2nfHadG3LgJtYJw6bsQ=";
+    hash = "sha256-K4uJ9MVmr5+7O1em1yUJXZj6H8bpfm2ZAE2uqgiyDBQ=";
   };
 
   patches = [
diff --git a/pkgs/by-name/we/weaviate/package.nix b/pkgs/by-name/we/weaviate/package.nix
index 676628b83b60..e527528cccbc 100644
--- a/pkgs/by-name/we/weaviate/package.nix
+++ b/pkgs/by-name/we/weaviate/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "weaviate";
-  version = "1.31.1";
+  version = "1.31.2";
 
   src = fetchFromGitHub {
     owner = "weaviate";
     repo = "weaviate";
     rev = "v${version}";
-    hash = "sha256-df+/ZMkTpx5Z1LJ+0frUXWxyCoGPMaovC+9zfNqhDxg=";
+    hash = "sha256-yTSWOWmMxHi3/r3/s+q9EiGPG10uewumV2crxAmAwik=";
   };
 
-  vendorHash = "sha256-mYGWG253nH4KfrJxZpMs0Byw9YrzeNuzB28fyhbjLqg=";
+  vendorHash = "sha256-xAP9jrkpQFoGovTL5nymG2CYxwseJ3Be3NoVVrWXDYs=";
 
   subPackages = [ "cmd/weaviate-server" ];
 
diff --git a/pkgs/by-name/we/web-ext/package.nix b/pkgs/by-name/we/web-ext/package.nix
index 98823048496a..9066140c0940 100644
--- a/pkgs/by-name/we/web-ext/package.nix
+++ b/pkgs/by-name/we/web-ext/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "web-ext";
-  version = "8.7.1";
+  version = "8.8.0";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "web-ext";
     rev = version;
-    hash = "sha256-B0wlGOg4ZfFRBVrHdERHMv3BPKfLX28YYtdyDphQTcE=";
+    hash = "sha256-119LxYhTqzobcwJZ0DSawNUIVMWxWSQp/XtkGEK2L7k=";
   };
 
-  npmDepsHash = "sha256-J7uDivhLjdMVQyuejcrCL7m7EsAs/DeeKD7r1Cv81qQ=";
+  npmDepsHash = "sha256-Na0caulpTMMIvsXC04+x8GUWDCyX6f6vVNmlnN694BE=";
 
   npmBuildFlags = [ "--production" ];
 
diff --git a/pkgs/by-name/wh/whisparr/package.nix b/pkgs/by-name/wh/whisparr/package.nix
index 157ae52dede6..2988538496da 100644
--- a/pkgs/by-name/wh/whisparr/package.nix
+++ b/pkgs/by-name/wh/whisparr/package.nix
@@ -29,16 +29,16 @@ let
     ."${system}" or (throw "Unsupported system: ${system}");
   hash =
     {
-      arm64-linux-hash = "sha256-sMhZ2QPIkuomUdgKYMoPwyQH5k0ziqdJSoCvV51tVNQ=";
-      arm64-osx-hash = "sha256-uubRkA6ER/kQeUXys9Jcf4Aii7FFkrKPgh/niK/3jO0=";
-      x64-linux-hash = "sha256-S2Ow+5AdvFZ10lA0xnvT5egdi1QbFTy97XzvSI5FtRk=";
-      x64-osx-hash = "sha256-7PvYkhJ9Tlulk0t/s8qAJUAHguUeilAQsQ0qU+DBVQM=";
+      arm64-linux-hash = "sha256-iiyaPJm/x6rRIc7vWrzK72sB84xGgJTGV3YkxYsIpvY=";
+      arm64-osx-hash = "sha256-YQhVeFPl5L+VR/W3iFjdujNP/oZaxyWydy+Gw/wmEtU=";
+      x64-linux-hash = "sha256-IkxfmNRW77B5TENu7kg7i4aD9cHDDGu0A15AHFAX3h4=";
+      x64-osx-hash = "sha256-Ef03sYPk99xYferbofsYBVbacWD4g67LM0idtVLMxgA=";
     }
     ."${arch}-${os}-hash";
 in
 stdenv.mkDerivation rec {
   pname = "whisparr";
-  version = "2.0.0.987";
+  version = "2.0.0.1112";
 
   src = fetchurl {
     name = "${pname}-${arch}-${os}-${version}.tar.gz";
diff --git a/pkgs/by-name/wh/whistle/package.nix b/pkgs/by-name/wh/whistle/package.nix
index a2d0af536486..0e54868edec6 100644
--- a/pkgs/by-name/wh/whistle/package.nix
+++ b/pkgs/by-name/wh/whistle/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "whistle";
-  version = "2.9.98";
+  version = "2.9.99";
 
   src = fetchFromGitHub {
     owner = "avwo";
     repo = "whistle";
     rev = "v${version}";
-    hash = "sha256-G19vNz9tn21HETkExiYR77CjwMkBdvRPWLPwc422M7E=";
+    hash = "sha256-9OHx2iVHiRxIOB/a/Za5bWDl4EVA+XpvHCzBq960U/c=";
   };
 
-  npmDepsHash = "sha256-c5WNiUza6r++j+JhCkTOfGE/cUAYpYVDVsJhPu1Jpy8=";
+  npmDepsHash = "sha256-rI7FQTyBQvMwvtUK5yzTNTmvUGmVYvZ/iXv6dx+FcWg=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/wo/worker/package.nix b/pkgs/by-name/wo/worker/package.nix
index fe1a7953b7b3..18b6386f9a7e 100644
--- a/pkgs/by-name/wo/worker/package.nix
+++ b/pkgs/by-name/wo/worker/package.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "worker";
-  version = "5.2.1";
+  version = "5.2.2";
 
   src = fetchurl {
     url = "http://www.boomerangsworld.de/cms/worker/downloads/worker-${finalAttrs.version}.tar.gz";
-    hash = "sha256-xlWeCOOPXlm71nWP/Uq9i1xswWOgzX0xmkwZwmMWTl0=";
+    hash = "sha256-xJxdOb6eEr8suf3u/vouYCGzTFugJpLtoKyCMeuoJv4=";
   };
 
   buildInputs = [ libX11 ];
diff --git a/pkgs/by-name/wv/wvkbd/package.nix b/pkgs/by-name/wv/wvkbd/package.nix
index debeceb021ad..59a7ce4f8d28 100644
--- a/pkgs/by-name/wv/wvkbd/package.nix
+++ b/pkgs/by-name/wv/wvkbd/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "wvkbd";
-  version = "0.16";
+  version = "0.17";
 
   src = fetchFromGitHub {
     owner = "jjsullivan5196";
     repo = "wvkbd";
     tag = "v${version}";
-    hash = "sha256-8KRJsx0Zv1VH/lR/QEE9kkzEY2qWihHaog2YxgNd4Rs=";
+    hash = "sha256-Vjbj3rxTe60Q+6IcX43WCBHMyPFECjc8w9D6qed0w0I=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/xm/xmrig-proxy/package.nix b/pkgs/by-name/xm/xmrig-proxy/package.nix
index 3bbc7ee70883..eda345ef3f55 100644
--- a/pkgs/by-name/xm/xmrig-proxy/package.nix
+++ b/pkgs/by-name/xm/xmrig-proxy/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xmrig-proxy";
-  version = "6.22.0";
+  version = "6.24.0";
 
   src = fetchFromGitHub {
     owner = "xmrig";
     repo = "xmrig-proxy";
     rev = "v${version}";
-    hash = "sha256-qRn/FiYvogGFUIUj3CojtfO6fXRZghH+bgRP+ysI6mc=";
+    hash = "sha256-4Kqxf9i5OTplWg72ihTJ4QHvwWC8r73EACErYNZ7wjc=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/xm/xmrig/package.nix b/pkgs/by-name/xm/xmrig/package.nix
index d7b4335293fd..0f9fc4a67236 100644
--- a/pkgs/by-name/xm/xmrig/package.nix
+++ b/pkgs/by-name/xm/xmrig/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xmrig";
-  version = "6.22.3";
+  version = "6.24.0";
 
   src = fetchFromGitHub {
     owner = "xmrig";
     repo = "xmrig";
     rev = "v${version}";
-    hash = "sha256-MS1JDYajtLCvc9kVATKmZrFwXNcAbdGSSUseL2S+tiQ=";
+    hash = "sha256-AbiTInOMHZ/YOUyl8IMU62ETZtbSTUqaP4vCJKAOCYM=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ya/yandex-cloud/sources.json b/pkgs/by-name/ya/yandex-cloud/sources.json
index 5886d634a592..b8e66f5154c8 100644
--- a/pkgs/by-name/ya/yandex-cloud/sources.json
+++ b/pkgs/by-name/ya/yandex-cloud/sources.json
@@ -1,25 +1,25 @@
 {
-  "version": "0.150.0",
+  "version": "0.152.0",
   "binaries": {
     "aarch64-darwin": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.150.0/darwin/arm64/yc",
-      "hash": "sha256-jIK8gCqzDZTp8pM7FSEmeNmdZUIEtD2KwUegkHm8VoY="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.152.0/darwin/arm64/yc",
+      "hash": "sha256-DGQGckyCdG5Rj9dPacyml4rHWsZ+x9v2LcBtuCRoadQ="
     },
     "aarch64-linux": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.150.0/linux/arm64/yc",
-      "hash": "sha256-B639QeVd3d+lLnLNxmToAFFxUa+/9zBUhR749wVuZi0="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.152.0/linux/arm64/yc",
+      "hash": "sha256-99ioFWZNj9V3R+KalfngrrtqcrvihBOFzZ1w14UW9XA="
     },
     "i686-linux": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.150.0/linux/386/yc",
-      "hash": "sha256-4Rf9el3Qs9c9AKIWDH6lojIxBJthGsjK+qYYqRjcPvI="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.152.0/linux/386/yc",
+      "hash": "sha256-2bMVdGz7kHccYXqutGxtLidpjLMxdzLNogp326du6TI="
     },
     "x86_64-darwin": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.150.0/darwin/amd64/yc",
-      "hash": "sha256-3V9s5kl/rZn2nN2/a3p3WYCdUeF/LA9ATCVNxYADg+U="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.152.0/darwin/amd64/yc",
+      "hash": "sha256-hzYzAOGBEk2vi+dg38nP/A0V3BicjZay4Q5Qy/vZ9G0="
     },
     "x86_64-linux": {
-      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.150.0/linux/amd64/yc",
-      "hash": "sha256-vKENaNar/rHGqAoOPuo7b/tU29STk2ak6FqUxFqeOto="
+      "url": "https://storage.yandexcloud.net/yandexcloud-yc/release/0.152.0/linux/amd64/yc",
+      "hash": "sha256-qnHDkqrCPphGiEnqz3iw+N4QoFi2xDjJSQDqHgoXZ+U="
     }
   }
 }
diff --git a/pkgs/by-name/ya/yandex-music/package.nix b/pkgs/by-name/ya/yandex-music/package.nix
index c1f5ee2f3396..1d2410fb8455 100644
--- a/pkgs/by-name/ya/yandex-music/package.nix
+++ b/pkgs/by-name/ya/yandex-music/package.nix
@@ -29,13 +29,13 @@ assert lib.assertMsg (trayStyle >= 1 && trayStyle <= 3) "Tray style must be with
 assert lib.assertMsg (vibeAnimationMaxFps >= 0) "Vibe animation max FPS must be greater then 0";
 stdenvNoCC.mkDerivation rec {
   pname = "yandex-music";
-  version = "5.54.0";
+  version = "5.56.0";
 
   src = fetchFromGitHub {
     owner = "cucumber-sp";
     repo = "yandex-music-linux";
     rev = "v${version}";
-    hash = "sha256-/ZZIL3DZY/L28fCq4CD9vVuvX7xJK2hsyDY6gymdUWo=";
+    hash = "sha256-H2sqHkNQUzNm2C1+u89TOdQTM+I4ht8oC+3ONU5YfXU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ya/yandex-music/ym_info.json b/pkgs/by-name/ya/yandex-music/ym_info.json
index 122cecaac775..e61029cafdb6 100644
--- a/pkgs/by-name/ya/yandex-music/ym_info.json
+++ b/pkgs/by-name/ya/yandex-music/ym_info.json
@@ -1,6 +1,6 @@
 {
-  "version": "5.54.0",
-  "exe_name": "Yandex_Music_x64_5.54.0.exe",
-  "exe_link": "https://music-desktop-application.s3.yandex.net/stable/Yandex_Music_x64_5.54.0.exe",
-  "exe_hash": "sha256-Q3uDrE5VPqGBxt3PrsL7Xn9YgpUZDc+lJ4RfKdGaaCo="
+  "version": "5.56.0",
+  "exe_name": "Yandex_Music_x64_5.56.0.exe",
+  "exe_link": "https://music-desktop-application.s3.yandex.net/stable/Yandex_Music_x64_5.56.0.exe",
+  "exe_hash": "sha256-Z3hmCKOMNIYtPJIhcw5692+c6ZTO2eRO/ZrCQnSM00M="
 }
diff --git a/pkgs/by-name/ya/yazi/plugins/gitui/default.nix b/pkgs/by-name/ya/yazi/plugins/gitui/default.nix
new file mode 100644
index 000000000000..bb1fff2babae
--- /dev/null
+++ b/pkgs/by-name/ya/yazi/plugins/gitui/default.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  fetchFromGitHub,
+  mkYaziPlugin,
+}:
+let
+  pname = "gitui.yazi";
+in
+mkYaziPlugin {
+  inherit pname;
+  version = "0-unstable-2025-05-26";
+
+  src = fetchFromGitHub {
+    owner = "gclarkjr5";
+    repo = pname;
+    rev = "397e9cf9cff536a43e746d72e0e81fd5c3050d2d";
+    hash = "sha256-Bo16/5XuSxRhN6URwTBxuw0FTMHLF3nV1UDBQQJFHMM=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+    cp -r . $out
+    mv $out/init.lua $out/main.lua
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Plugin for Yazi to manage git repos with gitui";
+    homepage = "https://github.com/gclarkjr5/gitui.yazi";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ felipe-9 ];
+  };
+}
diff --git a/pkgs/by-name/yo/youtubeuploader/package.nix b/pkgs/by-name/yo/youtubeuploader/package.nix
index e43d728ba85c..c8063d9fe8fc 100644
--- a/pkgs/by-name/yo/youtubeuploader/package.nix
+++ b/pkgs/by-name/yo/youtubeuploader/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "youtubeuploader";
-  version = "1.24.4";
+  version = "1.25.1";
 
   src = fetchFromGitHub {
     owner = "porjo";
     repo = "youtubeuploader";
     tag = "v${version}";
-    hash = "sha256-93VqB8tnl5o6YRY2cNBF/uARrJI6ywNg83lXGMxtgYM=";
+    hash = "sha256-hffi1/+j5u8/7kOaEGcE0iSMWt3nPmNaE2lg0WBu/BM=";
   };
 
-  vendorHash = "sha256-FgAfUcgY2dY8Jj3YcxrIGOpzQeAAICELeKL+scblZq0=";
+  vendorHash = "sha256-wVfJnN9QgF7c2aI3OghfJW9Z6McZ+irgMRSkWvVi1DM=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/yu/yubikey-touch-detector/package.nix b/pkgs/by-name/yu/yubikey-touch-detector/package.nix
index 8b6576eb3b72..560de6887dad 100644
--- a/pkgs/by-name/yu/yubikey-touch-detector/package.nix
+++ b/pkgs/by-name/yu/yubikey-touch-detector/package.nix
@@ -11,15 +11,15 @@
 
 buildGoModule rec {
   pname = "yubikey-touch-detector";
-  version = "1.12.5";
+  version = "1.13.0";
 
   src = fetchFromGitHub {
     owner = "maximbaz";
     repo = "yubikey-touch-detector";
     rev = version;
-    hash = "sha256-eNRwDGTNxBtDepQvf2TXCH/5fb4kRYBn80tzvI4fzME=";
+    hash = "sha256-aHR/y8rAKS+dMvRdB3oAmOiI7hTA6qlF4Z05OjwYOO4=";
   };
-  vendorHash = "sha256-x8Fmhsk6MtgAtLxgH/V3KusM0BXAOaSU+2HULR5boJQ=";
+  vendorHash = "sha256-oHEcpu3QvcVC/YCtGtP7nNT9++BSU8BPT5pf8NdLrOo=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/zo/zoekt/package.nix b/pkgs/by-name/zo/zoekt/package.nix
index 1f1acff8286e..bb45a5eed12d 100644
--- a/pkgs/by-name/zo/zoekt/package.nix
+++ b/pkgs/by-name/zo/zoekt/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule {
   pname = "zoekt";
-  version = "3.7.2-2-unstable-2025-06-04";
+  version = "3.7.2-2-unstable-2025-06-26";
 
   src = fetchFromGitHub {
     owner = "sourcegraph";
     repo = "zoekt";
-    rev = "fd39c591438fbce188ed9dd0211aefc56bc7322a";
-    hash = "sha256-gmpa3Jxh1UPpyWEiAkcTaNEXODVaKEn1b82mDFD/I68=";
+    rev = "bf9caa2750947b52df419fb4dd3d0ab000bd182f";
+    hash = "sha256-5LuKn3GjtUk7tJE2uxjuDU1kTiRDzc9KruJbzg6DKCI=";
   };
 
   vendorHash = "sha256-1WfQbvT5pKZRfs2DWv6+jBpHKGpcxhYAnc+NXvMT6WE=";
diff --git a/pkgs/by-name/zs/zsh-you-should-use/package.nix b/pkgs/by-name/zs/zsh-you-should-use/package.nix
index 4460275bffba..cea990d28ef0 100644
--- a/pkgs/by-name/zs/zsh-you-should-use/package.nix
+++ b/pkgs/by-name/zs/zsh-you-should-use/package.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "zsh-you-should-use";
-  version = "1.9.0";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "MichaelAquilina";
     repo = "zsh-you-should-use";
     tag = finalAttrs.version;
-    hash = "sha256-+3iAmWXSsc4OhFZqAMTwOL7AAHBp5ZtGGtvqCnEOYc0=";
+    hash = "sha256-dG6E6cOKu2ZvtkwxMXx/op3rbevT1QSOQTgw//7GmSk=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/zw/zwave-js-server/package.nix b/pkgs/by-name/zw/zwave-js-server/package.nix
index e8db52393690..082f3d130edc 100644
--- a/pkgs/by-name/zw/zwave-js-server/package.nix
+++ b/pkgs/by-name/zw/zwave-js-server/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "zwave-js-server";
-  version = "3.0.2";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "zwave-js";
     repo = "zwave-js-server";
     rev = version;
-    hash = "sha256-wIWpVFeo5oy7Fqiu7P9ifEhK04XKw7F8gHIOEwKNxsQ=";
+    hash = "sha256-3IlqBdBP/c4hyEV3VXSksSR798vKaVWdU2HI90POqzs=";
   };
 
-  npmDepsHash = "sha256-Px8Hs6Nol3fYvLPWFv+RK2ltqFN/hAxtuGtR3dA+4yI=";
+  npmDepsHash = "sha256-ztkYzN8TtaCDbxETvgtP2GLCXWVCwWZL+AugePQBK6w=";
 
   # For some reason the zwave-js dependency is in devDependencies
   npmFlags = [ "--include=dev" ];
diff --git a/pkgs/development/libraries/libcec/default.nix b/pkgs/development/libraries/libcec/default.nix
index 5a97e5c6d889..4ef46e3c216c 100644
--- a/pkgs/development/libraries/libcec/default.nix
+++ b/pkgs/development/libraries/libcec/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libcec";
-  version = "7.0.0";
+  version = "7.1.0";
 
   src = fetchFromGitHub {
     owner = "Pulse-Eight";
     repo = "libcec";
     rev = "libcec-${version}";
-    sha256 = "sha256-yCJq7vEDFYzT0y/cA8s12tW9c86lQyvBRYrSQIxZA+U=";
+    sha256 = "sha256-VamOv26n8aXdoZZ/XqkogECqwQcpAdQE/WAeVyvv9l8=";
   };
 
   # Fix dlopen path
diff --git a/pkgs/development/ocaml-modules/bitwuzla-cxx/default.nix b/pkgs/development/ocaml-modules/bitwuzla-cxx/default.nix
index 873394f1c01a..f8daec215ef2 100644
--- a/pkgs/development/ocaml-modules/bitwuzla-cxx/default.nix
+++ b/pkgs/development/ocaml-modules/bitwuzla-cxx/default.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "0.6.1";
+  version = "0.8.0";
 in
 
 buildDunePackage {
@@ -17,7 +17,7 @@ buildDunePackage {
 
   src = fetchurl {
     url = "https://github.com/bitwuzla/ocaml-bitwuzla/releases/download/${version}/bitwuzla-cxx-${version}.tbz";
-    hash = "sha256-QgZy0a4QPVkgiB+lhEw40pE9TeuOOeMowtUb0F+BN6c=";
+    hash = "sha256-t8Vgbiec5m6CYV8bINJqs6uhx0YAJcRZeaWRGNoD6AQ=";
   };
 
   propagatedBuildInputs = [ zarith ];
diff --git a/pkgs/development/ocaml-modules/hxd/default.nix b/pkgs/development/ocaml-modules/hxd/default.nix
index 9f52f4217b0e..530351a27dac 100644
--- a/pkgs/development/ocaml-modules/hxd/default.nix
+++ b/pkgs/development/ocaml-modules/hxd/default.nix
@@ -10,13 +10,13 @@
 
 buildDunePackage rec {
   pname = "hxd";
-  version = "0.3.3";
+  version = "0.3.4";
 
   minimalOCamlVersion = "4.08";
 
   src = fetchurl {
     url = "https://github.com/dinosaure/hxd/releases/download/v${version}/hxd-${version}.tbz";
-    sha256 = "sha256-Tt4jUpal4qJZl3bIvOtIU8Fk735XNXCh7caKTAyQQz4=";
+    sha256 = "sha256-jor8KLUvHqgt37Dnh3JRB/eMIYSevVzGEBsvG4quDmI=";
   };
 
   propagatedBuildInputs = lib.optional withLwt lwt;
diff --git a/pkgs/development/ocaml-modules/iri/default.nix b/pkgs/development/ocaml-modules/iri/default.nix
index a8f0bf5d7769..106e62e630b0 100644
--- a/pkgs/development/ocaml-modules/iri/default.nix
+++ b/pkgs/development/ocaml-modules/iri/default.nix
@@ -9,7 +9,7 @@
 
 buildDunePackage rec {
   pname = "iri";
-  version = "1.0.0";
+  version = "1.1.0";
 
   minimalOCamlVersion = "4.12";
 
@@ -18,7 +18,7 @@ buildDunePackage rec {
     owner = "zoggy";
     repo = "ocaml-iri";
     rev = version;
-    hash = "sha256-6Q7qPezmdcO6JSevWl55XAxFuIROZNDrMkYw8VRR7qg=";
+    hash = "sha256-fh5+0CWplDdGXCotZL2UzjOGil2LR4NppttaquO/ndE=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/irmin/ppx.nix b/pkgs/development/ocaml-modules/irmin/ppx.nix
index 14ff89f39627..49c6033695be 100644
--- a/pkgs/development/ocaml-modules/irmin/ppx.nix
+++ b/pkgs/development/ocaml-modules/irmin/ppx.nix
@@ -9,11 +9,11 @@
 
 buildDunePackage rec {
   pname = "ppx_irmin";
-  version = "3.10.0";
+  version = "3.11.0";
 
   src = fetchurl {
     url = "https://github.com/mirage/irmin/releases/download/${version}/irmin-${version}.tbz";
-    hash = "sha256-kqneegoqNcL+ugw1qAax8N8kwcDRUWTuvz+RkpbSZxU=";
+    hash = "sha256-CZlvvMLEPhF6m9jpAoxjXoHMyyZNXgLUJauLBrus29s=";
   };
 
   minimalOCamlVersion = "4.10";
diff --git a/pkgs/development/ocaml-modules/metrics/default.nix b/pkgs/development/ocaml-modules/metrics/default.nix
index b1c921ac548c..421f7b6e911a 100644
--- a/pkgs/development/ocaml-modules/metrics/default.nix
+++ b/pkgs/development/ocaml-modules/metrics/default.nix
@@ -8,13 +8,13 @@
 
 buildDunePackage rec {
   pname = "metrics";
-  version = "0.4.1";
+  version = "0.5.0";
 
   minimalOCamlVersion = "4.04";
 
   src = fetchurl {
     url = "https://github.com/mirage/metrics/releases/download/v${version}/metrics-${version}.tbz";
-    sha256 = "sha256-d+DCD7XB0GED27DsC8YEW+48YcAK0EI8l4Uqx/PGFE0=";
+    sha256 = "sha256-3zVjgJCdBkYbzQl+9gY8qfPFE2X0dqeXwDZktTwFcV0=";
   };
 
   propagatedBuildInputs = [ fmt ];
diff --git a/pkgs/development/ocaml-modules/ocamlformat-mlx/lib.nix b/pkgs/development/ocaml-modules/ocamlformat-mlx/lib.nix
index 253275346089..f4a4c308466a 100644
--- a/pkgs/development/ocaml-modules/ocamlformat-mlx/lib.nix
+++ b/pkgs/development/ocaml-modules/ocamlformat-mlx/lib.nix
@@ -24,14 +24,14 @@
 }:
 buildDunePackage rec {
   pname = "ocamlformat-mlx-lib";
-  version = "0.27.0.0";
+  version = "0.27.0.1";
   minimalOcamlVersion = "4.08";
 
   src = fetchFromGitHub {
     owner = "ocaml-mlx";
     repo = "ocamlformat-mlx";
     tag = version;
-    hash = "sha256-psuiZy/+HjlJ+b/EYlNVb0aXqUu6/364L71qVoH9xSs=";
+    hash = "sha256-807ku1C5CxAGlMP1tDW0APE32VV/TPOgsZqi6FcFQm0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/postgresql/default.nix b/pkgs/development/ocaml-modules/postgresql/default.nix
index 49c8a06f04dc..8c71a2321e3d 100644
--- a/pkgs/development/ocaml-modules/postgresql/default.nix
+++ b/pkgs/development/ocaml-modules/postgresql/default.nix
@@ -9,13 +9,13 @@
 
 buildDunePackage rec {
   pname = "postgresql";
-  version = "5.1.3";
+  version = "5.2.0";
 
   minimalOCamlVersion = "4.12";
 
   src = fetchurl {
     url = "https://github.com/mmottl/postgresql-ocaml/releases/download/${version}/postgresql-${version}.tbz";
-    hash = "sha256-RipVP8mj+tYwO8LrVASvVc36ZAJYjMI4x6Uj5J50Eww=";
+    hash = "sha256-uU/K7hvQljGnUzClPRdod32tpVAGd/sGqh3NqIygJ4A=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/development/python-modules/curtsies/default.nix b/pkgs/development/python-modules/curtsies/default.nix
index b979610a7411..f036a3505ced 100644
--- a/pkgs/development/python-modules/curtsies/default.nix
+++ b/pkgs/development/python-modules/curtsies/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "curtsies";
-  version = "0.4.2";
+  version = "0.4.3";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-br4zIVvXyShRpQYEnHIMykz1wZLBZlwdepigTEcCdg4=";
+    hash = "sha256-ECoP+/lSEk8b4iL9aYnaTsfM4E5J9hMAnl9UrTdhiCU=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/dissect-esedb/default.nix b/pkgs/development/python-modules/dissect-esedb/default.nix
index 6f1de7253e33..6ae482dc619b 100644
--- a/pkgs/development/python-modules/dissect-esedb/default.nix
+++ b/pkgs/development/python-modules/dissect-esedb/default.nix
@@ -24,12 +24,12 @@ buildPythonPackage rec {
     hash = "sha256-jLv62/3U89sbmcHAA2YYwVPLlLj85nMn4PRE565ppw4=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     setuptools
     setuptools-scm
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     dissect-cstruct
     dissect-util
   ];
@@ -42,7 +42,7 @@ buildPythonPackage rec {
     description = "Dissect module implementing a parser for Microsofts Extensible Storage Engine Database (ESEDB)";
     homepage = "https://github.com/fox-it/dissect.esedb";
     changelog = "https://github.com/fox-it/dissect.esedb/releases/tag/${src.tag}";
-    license = licenses.agpl3Only;
+    license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/e3-testsuite/default.nix b/pkgs/development/python-modules/e3-testsuite/default.nix
index 4f2aa875f945..47f70c62039e 100644
--- a/pkgs/development/python-modules/e3-testsuite/default.nix
+++ b/pkgs/development/python-modules/e3-testsuite/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "e3-testsuite";
-  version = "26.0";
+  version = "27.2";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "AdaCore";
     repo = "e3-testsuite";
     tag = "v${version}";
-    hash = "sha256-V20tX0zi2DRHO42udUcW/CDMyBxh1uSTgac0zZGubsI=";
+    hash = "sha256-qG8SHwogBle3demgFJCqcfCh5ktLvOqh2XSwxPCANFk=";
   };
 
   build-system = [ setuptools ];
@@ -29,7 +29,7 @@ buildPythonPackage rec {
 
   meta = with lib; {
     description = "Generic testsuite framework in Python";
-    changelog = "https://github.com/AdaCore/e3-testsuite/releases/tag/v${version}";
+    changelog = "https://github.com/AdaCore/e3-testsuite/releases/tag/${src.tag}";
     homepage = "https://github.com/AdaCore/e3-testsuite/";
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ heijligen ];
diff --git a/pkgs/development/python-modules/libipld/default.nix b/pkgs/development/python-modules/libipld/default.nix
index aa3e40381c24..21fafc0c727b 100644
--- a/pkgs/development/python-modules/libipld/default.nix
+++ b/pkgs/development/python-modules/libipld/default.nix
@@ -18,19 +18,19 @@
 
 buildPythonPackage rec {
   pname = "libipld";
-  version = "3.0.1";
+  version = "3.1.1";
   format = "pyproject";
   disabled = pythonOlder "3.8";
 
   # use pypi, GitHub does not include Cargo.lock
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-KXB1LecOX9ysRkaQDN76oNygjbm11ZxAtUltmeO/+mQ=";
+    hash = "sha256-S5qdoOpdhI6foSxwACdhmh437MHaOdvRQkwOkGLynkQ=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src;
-    hash = "sha256-V/UGTO+VEBtv5gwKR/fZmmhbeYILsIVc7Mq/Rl6E4Dw=";
+    hash = "sha256-LMd1M2gCK0i3TJPnUIY/2pskt9Rm/yki4uDX5uQGi8Q=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/orange-widget-base/default.nix b/pkgs/development/python-modules/orange-widget-base/default.nix
index fe80dff8d07a..65b270293cf5 100644
--- a/pkgs/development/python-modules/orange-widget-base/default.nix
+++ b/pkgs/development/python-modules/orange-widget-base/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "orange-widget-base";
-  version = "4.25.1";
+  version = "4.26.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "biolab";
     repo = "orange-widget-base";
     tag = version;
-    hash = "sha256-ENP3Xyubsx7Q2w4cTQCsZuvC0cbm3KwaoDGbF0fk3dg=";
+    hash = "sha256-XoQlZaY6pAflL0vWzSALDABOPybqV28xB/AS8L0DcBc=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pypcap/default.nix b/pkgs/development/python-modules/pypcap/default.nix
deleted file mode 100644
index 05db59c38ca6..000000000000
--- a/pkgs/development/python-modules/pypcap/default.nix
+++ /dev/null
@@ -1,47 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  dpkt,
-  fetchFromGitHub,
-  libpcap,
-  pytestCheckHook,
-}:
-
-buildPythonPackage {
-  pname = "pypcap";
-  version = "1.3.0";
-  format = "setuptools";
-
-  src = fetchFromGitHub {
-    owner = "pynetwork";
-    repo = "pypcap";
-    # No release was tagged and PyPI doesn't contain tests.
-    rev = "968859f0ffb5b7c990506dffe82457b7de23a026";
-    hash = "sha256-NfyEC3qEBm6TjebcDIsoz8tJWaJ625ZFPfx7AMyynWE=";
-  };
-
-  postPatch = ''
-    # Add the path to libpcap in the nix-store
-    substituteInPlace setup.py --replace "('/usr', sys.prefix)" "'${libpcap}'"
-    # Remove coverage from test run
-    sed -i "/--cov/d" setup.cfg
-  '';
-
-  buildInputs = [ libpcap ];
-
-  nativeCheckInputs = [
-    dpkt
-    pytestCheckHook
-  ];
-
-  enabledTestPaths = [ "tests" ];
-
-  pythonImportsCheck = [ "pcap" ];
-
-  meta = with lib; {
-    homepage = "https://github.com/pynetwork/pypcap";
-    description = "Simplified object-oriented Python wrapper for libpcap";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ oxzi ];
-  };
-}
diff --git a/pkgs/development/python-modules/pyside6-fluent-widgets/default.nix b/pkgs/development/python-modules/pyside6-fluent-widgets/default.nix
index ee2f1171be38..4f4215bf76cf 100644
--- a/pkgs/development/python-modules/pyside6-fluent-widgets/default.nix
+++ b/pkgs/development/python-modules/pyside6-fluent-widgets/default.nix
@@ -10,13 +10,13 @@
 
 buildPythonPackage rec {
   pname = "pyside6-fluent-widgets";
-  version = "1.8.1";
+  version = "1.8.2";
   pyproject = true;
 
   src = fetchPypi {
     pname = "pyside6_fluent_widgets";
     inherit version;
-    hash = "sha256-PMpbGUFN7bb9jKBF+596x4WLqoHjjNN2gX0c4G+lCHo=";
+    hash = "sha256-FspFnfu4f3PS2ARTOqaH7NCKMpg9r4YTj5LYsHyduBI=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/quaternion/default.nix b/pkgs/development/python-modules/quaternion/default.nix
index eca00ec9788a..a30869f45a7f 100644
--- a/pkgs/development/python-modules/quaternion/default.nix
+++ b/pkgs/development/python-modules/quaternion/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "quaternion";
-  version = "2024.0.8";
+  version = "2024.0.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "moble";
     repo = "quaternion";
     tag = "v${version}";
-    hash = "sha256-Le9i7oFPcBuZw/oNwCxz3svzKg9zREk4peIJadTiJ/M=";
+    hash = "sha256-i2GgcHbSN/JnJti8Nz8nFTKgbpntsxiG2KOPzJwNQa8=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/sudachidict/default.nix b/pkgs/development/python-modules/sudachidict/default.nix
index 5eb97fc597c2..2af6a0787108 100644
--- a/pkgs/development/python-modules/sudachidict/default.nix
+++ b/pkgs/development/python-modules/sudachidict/default.nix
@@ -15,7 +15,7 @@ buildPythonPackage rec {
     owner = "WorksApplications";
     repo = "SudachiDict";
     tag = "v${version}";
-    hash = "sha256-QORgO8FG0iSNuO1r2Myzjz6EYblNxbJSKxNHbF+h15c=";
+    hash = "sha256-nunc0obZ+4GvzP1+GgyOommBpK6sCAOXxwq04PWKf8c=";
   };
 
   sourceRoot = "${src.name}/python";
diff --git a/pkgs/development/tools/infisical/default.nix b/pkgs/development/tools/infisical/default.nix
index 7ff1bf3200e6..917ac90cc8fa 100644
--- a/pkgs/development/tools/infisical/default.nix
+++ b/pkgs/development/tools/infisical/default.nix
@@ -21,7 +21,7 @@ let
   buildHashes = builtins.fromJSON (builtins.readFile ./hashes.json);
 
   # the version of infisical
-  version = "0.41.7";
+  version = "0.41.85";
 
   # the platform-specific, statically linked binary
   src =
diff --git a/pkgs/development/tools/infisical/hashes.json b/pkgs/development/tools/infisical/hashes.json
index cca4a588e106..911192af9409 100644
--- a/pkgs/development/tools/infisical/hashes.json
+++ b/pkgs/development/tools/infisical/hashes.json
@@ -1,6 +1,6 @@
 { "_comment": "@generated by pkgs/development/tools/infisical/update.sh"
-, "x86_64-linux": "sha256-S/HP4IRwwMiJAkS8ciP+dlUEvfu6/lEk/35nfjKGAO8="
-, "x86_64-darwin": "sha256-RXjch0leSexJUvLlPc6gOda27EABX0sx2YzcH23nd3k="
-, "aarch64-linux": "sha256-mQLcGicdDdNx19zSIijQY9W6bdvjgR9NOCWdV88HGuk="
-, "aarch64-darwin": "sha256-pdhKkE3c+h6tSX9J3CxTfPNOp9+PKfy53KWvVV/HU8k="
+, "x86_64-linux": "sha256-w+N4OV0LX6bjFsD/A11fPser3InZWO7Vv9IfKbgiFsU="
+, "x86_64-darwin": "sha256-y3nEUAMQqA912wWmuANhWa6R+OHhtDtR0RzJC5Kw0Qk="
+, "aarch64-linux": "sha256-eOO5AK/qMYiuTTBqSLFgm+ojU3PQ72wgOlAj05v3MYU="
+, "aarch64-darwin": "sha256-CRpXY3+2IUVegMNPGJtzmfv46DhMQI0Ce5ofBSg2dX8="
 }
diff --git a/pkgs/games/openttd/jgrpp.nix b/pkgs/games/openttd/jgrpp.nix
index cb2cb115a23f..dde457a38c51 100644
--- a/pkgs/games/openttd/jgrpp.nix
+++ b/pkgs/games/openttd/jgrpp.nix
@@ -7,13 +7,13 @@
 
 openttd.overrideAttrs (oldAttrs: rec {
   pname = "openttd-jgrpp";
-  version = "0.65.3";
+  version = "0.65.4";
 
   src = fetchFromGitHub {
     owner = "JGRennison";
     repo = "OpenTTD-patches";
     rev = "jgrpp-${version}";
-    hash = "sha256-lmDkYrk7qjUSTtCQQCN/pbuLDt3+2RI1K8A1H1GJRjw=";
+    hash = "sha256-A0bcfbihbGbOCmCI3NXHUWL4w2l46dGDWKy6tVIsuc8=";
   };
   patches = [ ];
 
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 9aa6f46d5121..f52858dba1ff 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,31 +1,31 @@
 {
     "testing": {
-        "version": "6.16-rc2",
-        "hash": "sha256:1hzkpp5161ss40d8j9nzvzyw6vljslx0pk5fin0klj884l5i8igh"
+        "version": "6.16-rc3",
+        "hash": "sha256:04inkd3aqpikjarxy3lxzw2v2f45mnfzlq82r8mdsm23lkn68glr"
     },
     "6.1": {
-        "version": "6.1.141",
-        "hash": "sha256:05n1561cbzaw9vcxp86bqzvhqz5wv7dajpy7cq34bw7myvx4ag5w"
+        "version": "6.1.142",
+        "hash": "sha256:1am31xw70sbxzdnvj70fx9l946nadcbrc7qk2yxxssy96nhnxlnw"
     },
     "5.15": {
-        "version": "5.15.185",
-        "hash": "sha256:1p0kjc09qqv361phscny1gqj38di9dpab9gxywljkwqhi5wyn0rx"
+        "version": "5.15.186",
+        "hash": "sha256:0anbf7v0m26da0c6d0z925im4x2kf8kswpbv056543amxvbzsklw"
     },
     "5.10": {
-        "version": "5.10.238",
-        "hash": "sha256:1dkblixa0as9h11m081dqq8vlz4dcjbzdz7phkz07p621na55j07"
+        "version": "5.10.239",
+        "hash": "sha256:1nzhl1y6avfl77fyqwjwy3qc6679gp92k0d3aarscrdydcml5yid"
     },
     "5.4": {
-        "version": "5.4.294",
-        "hash": "sha256:16bv0x4c9ssr66vrd6jnv2dw5na1y7hxfn4d67g0zaksh6xd0yf8"
+        "version": "5.4.295",
+        "hash": "sha256:1adn0pbk8y1zp1yrz83ch6h4wypm2qvbnx4xig3sls2nfgvmi0f4"
     },
     "6.6": {
-        "version": "6.6.94",
-        "hash": "sha256:0mncdsqbqrxii0hirnymi1kmg50jn9v0p26flimlf2xj4vm82fbi"
+        "version": "6.6.95",
+        "hash": "sha256:11gaczm68mqm72f3mfg656nkiqd9y66kf943hvwghln9lblhlr0q"
     },
     "6.12": {
-        "version": "6.12.34",
-        "hash": "sha256:0kf2f3r96npzs01kdq3q2ag7zg8l3avfyqwv5qbs9v373wwgxwx7"
+        "version": "6.12.35",
+        "hash": "sha256:0j577lqmzbzx45gxvxirx627pv6cbhq9slzb50rqqmyy3nqf1x05"
     },
     "6.13": {
         "version": "6.13.12",
@@ -36,7 +36,7 @@
         "hash": "sha256:06rvydmc2yfspidnsay5hin3i8p4fxy3bvzwnry7gjf9dl5cs71z"
     },
     "6.15": {
-        "version": "6.15.3",
-        "hash": "sha256:1c35ima9zklzi0hhmw2xmii6agj3kkycm845fg6xjf2lja4hrd8j"
+        "version": "6.15.4",
+        "hash": "sha256:05psir6p8x5a89d9kxkxlv5iifln67yf803xj5rqvx82nqkxdbqf"
     }
 }
diff --git a/pkgs/os-specific/linux/new-lg4ff/default.nix b/pkgs/os-specific/linux/new-lg4ff/default.nix
index f33e54b335da..4de25e6b7294 100644
--- a/pkgs/os-specific/linux/new-lg4ff/default.nix
+++ b/pkgs/os-specific/linux/new-lg4ff/default.nix
@@ -5,15 +5,15 @@
   fetchFromGitHub,
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation rec {
   pname = "new-lg4ff";
-  version = "0-unstable-2024-11-25";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "berarma";
     repo = "new-lg4ff";
-    rev = "6100a34c182536c607af80e119d54a66c6fb2a23";
-    sha256 = "sha256-90PnQDGwp94ELvWx6p8QiZucYmTbH3N0GiZbj3fo25g=";
+    tag = "v${version}";
+    sha256 = "sha256-nh5J89S3z0odzh2fDsAVVY1X6lr4ZUwoyu3UVOYQiq8=";
   };
 
   preBuild = ''
@@ -25,17 +25,23 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = kernel.moduleBuildDependencies;
 
-  makeFlags = [
-    "KVERSION=${kernel.modDirVersion}"
-    "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
-  ];
+  preConfigure = ''
+    makeFlagsArray+=(
+      KVERSION="${kernel.modDirVersion}"
+      KDIR="${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+      KCFLAGS="-DCONFIG_LOGIWHEELS_FF -DCONFIG_LEDS_CLASS"
+    )
+  '';
 
-  meta = with lib; {
+  meta = {
     description = "Experimental Logitech force feedback module for Linux";
     homepage = "https://github.com/berarma/new-lg4ff";
-    license = licenses.gpl2Only;
-    maintainers = with maintainers; [ matthiasbenaets ];
-    platforms = platforms.linux;
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [
+      amadejkastelic
+      matthiasbenaets
+    ];
+    platforms = lib.platforms.linux;
     broken = stdenv.hostPlatform.isAarch64;
   };
 }
diff --git a/pkgs/os-specific/linux/r8125/default.nix b/pkgs/os-specific/linux/r8125/default.nix
index 4c1bb97e719d..d0041d0d04a5 100644
--- a/pkgs/os-specific/linux/r8125/default.nix
+++ b/pkgs/os-specific/linux/r8125/default.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "r8125";
-  version = "9.015.00";
+  version = "9.016.00";
 
   src = fetchFromGitLab {
     domain = "salsa.debian.org";
     owner = "debian";
     repo = "r8125";
     tag = "upstream/${finalAttrs.version}";
-    hash = "sha256-RA7rvvF2Ngeu+hSACBbKfAJgLbPqhaXG14DH2NmztTE=";
+    hash = "sha256-dWsJNU25LxlXw9W+RVcC3zpHgsuUb+59OVidHqIYrYw=";
   };
 
   hardeningDisable = [ "pic" ];
diff --git a/pkgs/os-specific/linux/xone/default.nix b/pkgs/os-specific/linux/xone/default.nix
index 0a53277ff9bf..c16a2f413144 100644
--- a/pkgs/os-specific/linux/xone/default.nix
+++ b/pkgs/os-specific/linux/xone/default.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "xone";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "dlundqvist";
     repo = "xone";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qMZlQgAe5vB5zfuhyK7EBxIwfhnC5MvnF/qr3BGnDms=";
+    hash = "sha256-sX+oN7H0Okl+3yYwbIFoHU8q2pOcMHQcRqQkmnMXSps=";
   };
 
   setSourceRoot = ''
diff --git a/pkgs/servers/home-assistant/custom-components/solis-sensor/package.nix b/pkgs/servers/home-assistant/custom-components/solis-sensor/package.nix
index 121691f5f577..1aae56b79754 100644
--- a/pkgs/servers/home-assistant/custom-components/solis-sensor/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/solis-sensor/package.nix
@@ -9,13 +9,13 @@
 buildHomeAssistantComponent rec {
   owner = "hultenvp";
   domain = "solis";
-  version = "3.11.0";
+  version = "3.12.0";
 
   src = fetchFromGitHub {
     owner = "hultenvp";
     repo = "solis-sensor";
     rev = "v${version}";
-    hash = "sha256-PZoqS/klq58opqXofgYy7HsCQu/g4Nj60U09JSXTtMY=";
+    hash = "sha256-JjEfak1dH+Gox6XKZw1g75q2zogdw01D2QKcUur9Dg8=";
   };
 
   dependencies = [ aiofiles ];
diff --git a/pkgs/servers/icingaweb2/ipl.nix b/pkgs/servers/icingaweb2/ipl.nix
index d3c83a01cc26..8b665af62739 100644
--- a/pkgs/servers/icingaweb2/ipl.nix
+++ b/pkgs/servers/icingaweb2/ipl.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "icingaweb2-ipl";
-  version = "0.16.0";
+  version = "0.16.1";
 
   src = fetchFromGitHub {
     owner = "Icinga";
     repo = "icinga-php-library";
     rev = "v${version}";
-    hash = "sha256-1hq7jPe8WiCPAfz7j273BCBWsX1xLVp85vhTEV+2D/E=";
+    hash = "sha256-NDzSX/+3DSxWCoDVkfu9XzhGiw81o07GHrUtef7zyMQ=";
   };
 
   installPhase = ''
diff --git a/pkgs/servers/icingaweb2/thirdparty.nix b/pkgs/servers/icingaweb2/thirdparty.nix
index 38224744b047..e18e8b7860e3 100644
--- a/pkgs/servers/icingaweb2/thirdparty.nix
+++ b/pkgs/servers/icingaweb2/thirdparty.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "icingaweb2-thirdparty";
-  version = "0.12.1";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "Icinga";
     repo = "icinga-php-thirdparty";
     rev = "v${version}";
-    sha256 = "sha256-T67DcsHVf3yDQveNtSPqLoOOPuT4ThkUSCJ9aCSVaIc=";
+    sha256 = "sha256-MaUXhlMxNmaTDMRw5LPcQIU/0Sht05MOhJM+GqFD8Pc=";
   };
 
   installPhase = ''
diff --git a/pkgs/servers/lidarr/default.nix b/pkgs/servers/lidarr/default.nix
index ca165ca1ea06..0a21e62a45dd 100644
--- a/pkgs/servers/lidarr/default.nix
+++ b/pkgs/servers/lidarr/default.nix
@@ -27,16 +27,16 @@ let
     ."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   hash =
     {
-      x64-linux_hash = "sha256-QHCHB7ep23nd8YAF3klzvAd9ZNkCTI9P2pELQwmsrDw=";
-      arm64-linux_hash = "sha256-UBXDuVTRb7EWVjWbeNUn1TLb5W7hkvvbpxZuLhohgaA=";
-      x64-osx_hash = "sha256-W58yF2XMeLHjP3hNCM+EomTqfgXeYtyjHTaffeA05xY=";
-      arm64-osx_hash = "sha256-N9/h3Yc37/81c66KskhTk714EZkSUEAHJzGnpHeK2JQ=";
+      x64-linux_hash = "sha256-ttbQj6GYuKedDEdF8vUZcmc0AluZS6pPC5GCQTUu7OM=";
+      arm64-linux_hash = "sha256-9Zv0YCR7CvgcDFGYXuc55BhFmIH1iled9WDeEvwAMoI=";
+      x64-osx_hash = "sha256-v3R43J1KNEzKwIFIu6dkH6xyhr+MZAjcO72vn0ijgCY=";
+      arm64-osx_hash = "sha256-XAfSawOcfp5iVvmta/maYcj+UU2usRunLM6LjvKKVcg=";
     }
     ."${arch}-${os}_hash";
 in
 stdenv.mkDerivation rec {
   pname = "lidarr";
-  version = "2.11.2.4629";
+  version = "2.12.4.4658";
 
   src = fetchurl {
     url = "https://github.com/lidarr/Lidarr/releases/download/v${version}/Lidarr.master.${version}.${os}-core-${arch}.tar.gz";
diff --git a/pkgs/servers/monitoring/icinga2/default.nix b/pkgs/servers/monitoring/icinga2/default.nix
index 4122049490e5..dab521e6f81a 100644
--- a/pkgs/servers/monitoring/icinga2/default.nix
+++ b/pkgs/servers/monitoring/icinga2/default.nix
@@ -30,13 +30,13 @@
 
 stdenv.mkDerivation rec {
   pname = "icinga2${nameSuffix}";
-  version = "2.14.6";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "icinga";
     repo = "icinga2";
     rev = "v${version}";
-    hash = "sha256-/6w4AOfPQXjwrAUrioN4Macg8r/8Ap92nO8CGmz6VRk=";
+    hash = "sha256-IuK6kD2OBAm7bKtPcMnplwNSGyGUcX3UWiwm8Vry1is=";
   };
 
   patches = [
diff --git a/pkgs/servers/plex/raw.nix b/pkgs/servers/plex/raw.nix
index 63bdf06ecfb0..3521a36597ef 100644
--- a/pkgs/servers/plex/raw.nix
+++ b/pkgs/servers/plex/raw.nix
@@ -14,7 +14,7 @@
 # server, and the FHS userenv and corresponding NixOS module should
 # automatically pick up the changes.
 stdenv.mkDerivation rec {
-  version = "1.41.7.9823-59f304c16";
+  version = "1.41.8.9834-071366d65";
   pname = "plexmediaserver";
 
   # Fetch the source
@@ -22,12 +22,12 @@ stdenv.mkDerivation rec {
     if stdenv.hostPlatform.system == "aarch64-linux" then
       fetchurl {
         url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_arm64.deb";
-        sha256 = "1gnrb3kc9l7rvbs1yb1640f4csvwdp0kpabhgbq7ql55yk1rcfg8";
+        sha256 = "0y62k1bqp5ydx2yyyicp24535dkg8a7jhd7vcsj3vx58kis4f2fd";
       }
     else
       fetchurl {
         url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_amd64.deb";
-        sha256 = "1r73w7bgpv5nabi8w5fh8np8ghny308s574izmr1damcczz5d0z2";
+        sha256 = "0bh1lzsd2z8jmkpbq6s9xy08595jmiqcq2vqvbd6cfa9zkbbl6by";
       };
 
   outputs = [
diff --git a/pkgs/shells/fish/plugins/exercism-cli-fish-wrapper.nix b/pkgs/shells/fish/plugins/exercism-cli-fish-wrapper.nix
index de8e68b55288..a4698a070e4c 100644
--- a/pkgs/shells/fish/plugins/exercism-cli-fish-wrapper.nix
+++ b/pkgs/shells/fish/plugins/exercism-cli-fish-wrapper.nix
@@ -6,13 +6,13 @@
 }:
 buildFishPlugin {
   pname = "exercism-cli-fish-wrapper";
-  version = "0-unstable-2025-06-12";
+  version = "0-unstable-2025-06-23";
 
   src = fetchFromGitHub {
     owner = "glennj";
     repo = "exercism-cli-fish-wrapper";
-    rev = "fc00e992b73adc63596e1406a8554313d642204f";
-    hash = "sha256-w2aGakB/Kel0TMaZ44/WC6syhetohJzn5kgwgW7Kdqs=";
+    rev = "eaaa6f482a635a12b844794f173a692e69d89688";
+    hash = "sha256-9TKCiGlYhNCnAJ52BWOeuEPY2Cu/Z+CsBYM1IJ8/On0=";
   };
 
   passthru.updateScript = unstableGitUpdater { };
diff --git a/pkgs/tools/admin/ibmcloud-cli/default.nix b/pkgs/tools/admin/ibmcloud-cli/default.nix
index 5173891e73b8..4cb22081bdb9 100644
--- a/pkgs/tools/admin/ibmcloud-cli/default.nix
+++ b/pkgs/tools/admin/ibmcloud-cli/default.nix
@@ -30,19 +30,19 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ibmcloud-cli";
-  version = "2.34.1";
+  version = "2.34.2";
 
   src = fetchurl {
     url = "https://download.clis.cloud.ibm.com/ibm-cloud-cli/${finalAttrs.version}/binaries/IBM_Cloud_CLI_${finalAttrs.version}_${platform}.tgz";
     hash =
       {
-        "x86_64-darwin" = "sha256-+1Uf+OGZ5Mqo8OJN+ByxGO5OKm9XAxpbhBrNxyJmovs=";
-        "aarch64-darwin" = "sha256-ByQ3eO2R8612aUaQyeXaJ4W8hiKk4YmDoQ3DdJn5n2o=";
-        "x86_64-linux" = "sha256-gCnRyuUlHpr0b6hTwQBZ7V8WAjWG60+mly3uqfjlzrU=";
-        "aarch64-linux" = "sha256-+Q87wqLKycSOusySpNfwVKhrrPOXL0teXEbN3QUC2ek=";
-        "i686-linux" = "sha256-+8v/3qw2HYDxyEw8q+xshgF6Uo3lJRA5WloXagPPje4=";
-        "powerpc64le-linux" = "sha256-3K4cgDOUZANMkCTU8AN9u/1F0ZsAjNBzEndRnz5Lxco=";
-        "s390x-linux" = "sha256-54XEodccwQOR8/50m5qfQqcwIVCZAyQHuwYsn4Uq0Ms=";
+        "x86_64-darwin" = "sha256-StOJEaQyPAObCz6DPO5i0Kj6s5RoHzyEWMh2C0sov3U=";
+        "aarch64-darwin" = "sha256-sur1M0PoRibj551iExCSyXYXlEGwjDqA2n7BP8JtCIU=";
+        "x86_64-linux" = "sha256-UoP9kPe+00jdwCQYbZB2z1OorZ8cvlQLjY0wWx/RukI=";
+        "aarch64-linux" = "sha256-FIYqbubVyuzn1yQ7jejG82ZHvPZD7NmTWUV1TD1LbuE=";
+        "i686-linux" = "sha256-JC8UIvMpENbucZ8aVeOr2PsqKa9xg2UXh7zLTPVQ1yg=";
+        "powerpc64le-linux" = "sha256-q8VqZkfCf6+K1aGheYgxQB06i8ua1AMojPp8U3flcmo=";
+        "s390x-linux" = "sha256-4wYEJZ/+65+1j3JdctY2ZIC5cNKLl8Kc3c9Azlh7HaM=";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
diff --git a/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix b/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
index f6c00c245a44..c874580f840f 100644
--- a/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
+++ b/pkgs/tools/inputmethods/ibus-engines/ibus-typing-booster/default.nix
@@ -25,13 +25,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "ibus-typing-booster";
-  version = "2.27.64";
+  version = "2.27.65";
 
   src = fetchFromGitHub {
     owner = "mike-fabian";
     repo = "ibus-typing-booster";
     rev = version;
-    hash = "sha256-ZeAmIZNayXpy1jplMzT1PR0E4gCtn9vVLb1CtRXBNWY=";
+    hash = "sha256-panhKPoSs/rObr1kgAyznZCveiYKVJv1O0hI7dgdKKI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/bitwarden-directory-connector/default.nix b/pkgs/tools/security/bitwarden-directory-connector/default.nix
index 1bc3bbb5ccc3..d1407bc94940 100644
--- a/pkgs/tools/security/bitwarden-directory-connector/default.nix
+++ b/pkgs/tools/security/bitwarden-directory-connector/default.nix
@@ -19,14 +19,14 @@ let
     }:
     buildNpmPackage rec {
       pname = name;
-      version = "2025.5.0";
+      version = "2025.6.0";
       nodejs = nodejs_22;
 
       src = fetchFromGitHub {
         owner = "bitwarden";
         repo = "directory-connector";
         rev = "v${version}";
-        hash = "sha256-78AWsZd6j/GYyKDwr95d2x5tPh6jBbA34zs0CjtLIyg=";
+        hash = "sha256-qlD16U/S3SzaA7sMR+JZSYHy9g7c5cjedAmkFWRoxN0=";
       };
 
       postPatch = ''
@@ -38,7 +38,7 @@ let
           --replace-fail "AppImage" "dir"
       '';
 
-      npmDepsHash = "sha256-9sQWy+w3MdAWGTIzGD3yJypTLYh4aUzazBNf5GcW3Sc=";
+      npmDepsHash = "sha256-EIF7I4stB6+h3l2hLJqLHR8qzmRP20v161YwXVMJh44=";
 
       env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 0083ce7d6dcc..52611eb4f2a8 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -526,6 +526,7 @@ mapAliases ({
   pwndbg = throw "'pwndbg' has been removed due to dependency version incompatibilities that are infeasible to maintain in nixpkgs. Use the downstream flake that pwndbg provides instead: https://github.com/pwndbg/pwndbg"; # Added 2025-02-09
   pxml = throw "pxml was removed, because it was disabled on all python version since 3.8 and last updated in 2020."; # added 2024-05-13
   py3to2 = throw "py3to2 is unmaintained and source is no longer available"; # added 2024-10-23
+  pypcap = throw "pypcap has been removed because it is broken and unmaintained upstream."; # added 2025-06-18
   pytricia = throw "pytricia has been removed, since it is unmaintained"; # added 2025-05-25
   py-radix = throw "py-radix has been removed, since it abandoned"; # added 2023-07-07
   py_stringmatching = py-stringmatching; # added 2023-11-12
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 4289f2170ab2..ac7c08198dba 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -13316,10 +13316,6 @@ self: super: with self; {
 
   pypca = callPackage ../development/python-modules/pypca { };
 
-  pypcap = callPackage ../development/python-modules/pypcap {
-    inherit (pkgs) libpcap; # Avoid confusion with python package of the same name
-  };
-
   pypck = callPackage ../development/python-modules/pypck { };
 
   pypdf = callPackage ../development/python-modules/pypdf { };