diff --git a/nixos/modules/security/apparmor/includes.nix b/nixos/modules/security/apparmor/includes.nix
index 4b759e1d94f99..92f5aa8d66b22 100644
--- a/nixos/modules/security/apparmor/includes.nix
+++ b/nixos/modules/security/apparmor/includes.nix
@@ -19,7 +19,7 @@ let
           mode ? "r",
           trail ? "",
         }:
-        lib.optionalString (hasAttr path etc) "${mode} ${config.environment.etc.${path}.source}${trail},";
+        lib.optionalString (hasAttr path etc) "${config.environment.etc.${path}.source}${trail} ${mode},";
     in
     if isAttrs arg then go arg else go { path = arg; };
 in
@@ -93,19 +93,19 @@ in
     ];
     "abstractions/base" = ''
       include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/base"
-      r ${pkgs.stdenv.cc.libc}/share/locale/**,
-      r ${pkgs.stdenv.cc.libc}/share/locale.alias,
-      r ${config.i18n.glibcLocales}/lib/locale/locale-archive,
+      ${pkgs.stdenv.cc.libc}/share/locale/** r,
+      ${pkgs.stdenv.cc.libc}/share/locale.alias r,
+      ${config.i18n.glibcLocales}/lib/locale/locale-archive r,
       ${etcRule "localtime"}
-      r ${pkgs.tzdata}/share/zoneinfo/**,
-      r ${pkgs.stdenv.cc.libc}/share/i18n/**,
+      ${pkgs.tzdata}/share/zoneinfo/** r,
+      ${pkgs.stdenv.cc.libc}/share/i18n/** r,
     '';
     "abstractions/bash" = ''
       include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/bash"
 
       # bash inspects filesystems at startup
       # and /etc/mtab is linked to /proc/mounts
-      r @{PROC}/mounts,
+      @{PROC}/mounts r,
 
       # system-wide bash configuration
     ''
@@ -296,8 +296,8 @@ in
       # looking up users by name or id, groups by name or id, hosts by name
       # or IP, etc. These operations may be performed through files, dns,
       # NIS, NIS+, LDAP, hesiod, wins, etc. Allow them all here.
-      mr ${getLib pkgs.nss}/lib/libnss_*.so*,
-      mr ${getLib pkgs.nss}/lib64/libnss_*.so*,
+      ${getLib pkgs.nss}/lib/libnss_*.so* mr,
+      ${getLib pkgs.nss}/lib64/libnss_*.so* mr,
     ''
     + lib.concatMapStringsSep "\n" etcRule [
       "group"
@@ -463,11 +463,11 @@ in
       include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/ssl_certs"
 
       # For the NixOS module: security.acme
-      r /var/lib/acme/*/cert.pem,
-      r /var/lib/acme/*/chain.pem,
-      r /var/lib/acme/*/fullchain.pem,
+      /var/lib/acme/*/cert.pem r,
+      /var/lib/acme/*/chain.pem r,
+      /var/lib/acme/*/fullchain.pem r,
 
-      r /etc/pki/tls/certs/,
+      /etc/pki/tls/certs/ r,
 
     ''
     + lib.concatMapStringsSep "\n" etcRule [
@@ -510,8 +510,8 @@ in
     ];
     "abstractions/ssl_keys" = ''
       # security.acme NixOS module
-      r /var/lib/acme/*/full.pem,
-      r /var/lib/acme/*/key.pem,
+      /var/lib/acme/*/full.pem r,
+      /var/lib/acme/*/key.pem r,
     '';
     "abstractions/vulkan" = ''
       include "${pkgs.apparmor-profiles}/etc/apparmor.d/abstractions/vulkan"
diff --git a/nixos/modules/services/networking/murmur.nix b/nixos/modules/services/networking/murmur.nix
index c67b4ac473900..9b1cf76860e32 100644
--- a/nixos/modules/services/networking/murmur.nix
+++ b/nixos/modules/services/networking/murmur.nix
@@ -401,40 +401,40 @@ in
     ];
 
     security.apparmor.policies."bin.mumble-server".profile = ''
+      abi <abi/4.0>,
       include <tunables/global>
 
-      ${cfg.package}/bin/{mumble-server,.mumble-server-wrapped} {
+      profile ${cfg.package}/bin/{mumble-server,.mumble-server-wrapped} {
         include <abstractions/base>
         include <abstractions/nameservice>
         include <abstractions/ssl_certs>
         include "${pkgs.apparmorRulesFromClosure { name = "mumble-server"; } cfg.package}"
-        pix ${cfg.package}/bin/.mumble-server-wrapped,
-
-        r ${config.environment.etc."os-release".source},
-        r ${config.environment.etc."lsb-release".source},
-        owner rwk ${cfg.stateDir}/murmur.sqlite,
-        owner rw ${cfg.stateDir}/murmur.sqlite-journal,
-        owner r ${cfg.stateDir}/,
-        r /run/murmur/murmurd.pid,
-        r /run/murmur/murmurd.ini,
-        r ${configFile},
-    ''
-    + lib.optionalString cfg.logToFile ''
-      rw /var/log/murmur/murmurd.log,
-    ''
-    + lib.optionalString (cfg.sslCert != null) ''
-      r ${cfg.sslCert},
-    ''
-    + lib.optionalString (cfg.sslKey != null) ''
-      r ${cfg.sslKey},
-    ''
-    + lib.optionalString (cfg.sslCa != null) ''
-      r ${cfg.sslCa},
-    ''
-    + lib.optionalString (cfg.dbus != null) ''
-      dbus bus=${cfg.dbus}
-    ''
-    + ''
+        ${cfg.package}/bin/.mumble-server-wrapped pix,
+
+        ${config.environment.etc."os-release".source} r,
+        ${config.environment.etc."lsb-release".source} r,
+        owner ${cfg.stateDir}/murmur.sqlite rwk,
+        owner ${cfg.stateDir}/murmur.sqlite-journal rw,
+        owner ${cfg.stateDir}/ r,
+        /run/murmur/murmurd.pid r,
+        /run/murmur/murmurd.ini r,
+        ${configFile} r,
+        ${lib.optionalString cfg.logToFile ''
+          /var/log/murmur/murmurd.log rw,
+        ''}
+        ${lib.optionalString (cfg.sslCert != null) ''
+          ${cfg.sslCert} r,
+        ''}
+        ${lib.optionalString (cfg.sslKey != null) ''
+          ${cfg.sslKey} r,
+        ''}
+        ${lib.optionalString (cfg.sslCa != null) ''
+          ${cfg.sslCa} r,
+        ''}
+        ${lib.optionalString (cfg.dbus != null) ''
+          dbus bus=${cfg.dbus},
+        ''}
+        include if exists <local/bin.mumble-server>
       }
     '';
   };
diff --git a/nixos/modules/services/torrent/transmission.nix b/nixos/modules/services/torrent/transmission.nix
index 3f6ed9eff4d1d..87493ec6ba624 100644
--- a/nixos/modules/services/torrent/transmission.nix
+++ b/nixos/modules/services/torrent/transmission.nix
@@ -585,23 +585,23 @@ in
       include "${cfg.package.apparmor}/bin.transmission-daemon"
     '';
     security.apparmor.includes."local/bin.transmission-daemon" = ''
-      r ${config.systemd.services.transmission.environment.CURL_CA_BUNDLE},
+      ${config.systemd.services.transmission.environment.CURL_CA_BUNDLE} r,
 
-      owner rw ${cfg.home}/${settingsDir}/**,
-      rw ${cfg.settings.download-dir}/**,
+      owner ${cfg.home}/${settingsDir}/** rw,
+      ${cfg.settings.download-dir}/** rw,
       ${optionalString cfg.settings.incomplete-dir-enabled ''
-        rw ${cfg.settings.incomplete-dir}/**,
+        ${cfg.settings.incomplete-dir}/** rw,
       ''}
       ${optionalString cfg.settings.watch-dir-enabled ''
-        r${optionalString cfg.settings.trash-original-torrent-files "w"} ${cfg.settings.watch-dir}/**,
+        ${cfg.settings.watch-dir}/** r${optionalString cfg.settings.trash-original-torrent-files "w"},
       ''}
       profile dirs {
-        rw ${cfg.settings.download-dir}/**,
+        ${cfg.settings.download-dir}/** rw,
         ${optionalString cfg.settings.incomplete-dir-enabled ''
-          rw ${cfg.settings.incomplete-dir}/**,
+          ${cfg.settings.incomplete-dir}/** rw,
         ''}
         ${optionalString cfg.settings.watch-dir-enabled ''
-          r${optionalString cfg.settings.trash-original-torrent-files "w"} ${cfg.settings.watch-dir}/**,
+          ${cfg.settings.watch-dir}/** r${optionalString cfg.settings.trash-original-torrent-files "w"},
         ''}
       }
 
@@ -612,12 +612,12 @@ in
           # any existing profile for script-torrent-done-filename
           # FIXME: to be tested as I'm not sure it works well with NoNewPrivileges=
           # https://gitlab.com/apparmor/apparmor/-/wikis/AppArmorStacking#seccomp-and-no_new_privs
-          px ${cfg.settings.script-torrent-done-filename} -> &@{dirs},
+          ${cfg.settings.script-torrent-done-filename} px -> &@{dirs},
         ''
       }
 
       ${optionalString (cfg.webHome != null) ''
-        r ${cfg.webHome}/**,
+        ${cfg.webHome}/** r,
       ''}
     '';
   };
diff --git a/nixos/modules/services/web-apps/miniflux.nix b/nixos/modules/services/web-apps/miniflux.nix
index 572e4f1700d6d..03447395fef6b 100644
--- a/nixos/modules/services/web-apps/miniflux.nix
+++ b/nixos/modules/services/web-apps/miniflux.nix
@@ -207,15 +207,18 @@ in
     environment.systemPackages = [ cfg.package ];
 
     security.apparmor.policies."bin.miniflux".profile = ''
+      abi <abi/4.0>,
       include <tunables/global>
-      ${cfg.package}/bin/miniflux {
+
+      profile ${cfg.package}/bin/miniflux {
         include <abstractions/base>
         include <abstractions/nameservice>
         include <abstractions/ssl_certs>
         include <abstractions/golang>
         include "${pkgs.apparmorRulesFromClosure { name = "miniflux"; } cfg.package}"
-        r ${cfg.package}/bin/miniflux,
-        rw /run/miniflux/**,
+        ${cfg.package}/bin/miniflux r,
+        /run/miniflux/** rw,
+        include if exists <local/bin.miniflux>
       }
     '';
   };
diff --git a/nixos/tests/systemd-shutdown.nix b/nixos/tests/systemd-shutdown.nix
index f4685605bb612..827cbac300d80 100644
--- a/nixos/tests/systemd-shutdown.nix
+++ b/nixos/tests/systemd-shutdown.nix
@@ -27,7 +27,7 @@ in
     # automatically and that 'systemd-shutdown' runs our script.
     machine.wait_for_unit("multi-user.target")
     # .shutdown() would wait for the machine to power off
-    machine.succeed("systemctl poweroff")
+    machine.execute("systemctl poweroff", check_return=False)
     # Message printed by systemd-shutdown
     machine.wait_for_console_text("Unmounting '/oldroot'")
     machine.wait_for_console_text("${msg}")
diff --git a/pkgs/applications/networking/p2p/transmission/4.nix b/pkgs/applications/networking/p2p/transmission/4.nix
index be91f8d4bf07f..a49cc0c788fac 100644
--- a/pkgs/applications/networking/p2p/transmission/4.nix
+++ b/pkgs/applications/networking/p2p/transmission/4.nix
@@ -175,21 +175,22 @@ stdenv.mkDerivation (finalAttrs: {
   postInstall = ''
     mkdir $apparmor
     cat >$apparmor/bin.transmission-daemon <<EOF
+    abi <abi/4.0>,
     include <tunables/global>
-    $out/bin/transmission-daemon {
+    profile $out/bin/transmission-daemon {
       include <abstractions/base>
       include <abstractions/nameservice>
       include <abstractions/ssl_certs>
       include "${apparmorRules}"
-      r @{PROC}/sys/kernel/random/uuid,
-      r @{PROC}/sys/vm/overcommit_memory,
-      r @{PROC}/@{pid}/environ,
-      r @{PROC}/@{pid}/mounts,
-      rwk /tmp/tr_session_id_*,
+      @{PROC}/sys/kernel/random/uuid r,
+      @{PROC}/sys/vm/overcommit_memory r,
+      @{PROC}/@{pid}/environ r,
+      @{PROC}/@{pid}/mounts r,
+      /tmp/tr_session_id_* rwk,
 
-      r $out/share/transmission/public_html/**,
+      $out/share/transmission/public_html/** r,
 
-      include <local/bin.transmission-daemon>
+      include if exists <local/bin.transmission-daemon>
     }
     EOF
     install -Dm0444 -t $out/share/icons ../qt/icons/transmission.svg
diff --git a/pkgs/build-support/rust/build-rust-crate/test/default.nix b/pkgs/build-support/rust/build-rust-crate/test/default.nix
index 50e045921387b..d5c56858c6a4e 100644
--- a/pkgs/build-support/rust/build-rust-crate/test/default.nix
+++ b/pkgs/build-support/rust/build-rust-crate/test/default.nix
@@ -774,6 +774,7 @@ rec {
           # On Darwin, the debug symbols are in a separate directory.
           "./bin/test_binary1.dSYM/Contents/Info.plist"
           "./bin/test_binary1.dSYM/Contents/Resources/DWARF/test_binary1"
+          "./bin/test_binary1.dSYM/Contents/Resources/Relocations/${stdenv.hostPlatform.rust.platform.arch}/test_binary1.yml"
         ];
       };
 
diff --git a/pkgs/build-support/rust/build-rust-package/default.nix b/pkgs/build-support/rust/build-rust-package/default.nix
index 7efbc8a9ea36d..7ad39a58935c7 100644
--- a/pkgs/build-support/rust/build-rust-package/default.nix
+++ b/pkgs/build-support/rust/build-rust-package/default.nix
@@ -15,6 +15,16 @@
   windows,
 }:
 
+let
+  interpolateString =
+    s:
+    if lib.isList s then
+      lib.concatMapStringsSep " " (s: "${s}") (lib.filter (s: s != null) s)
+    else if s == null then
+      ""
+    else
+      "${s}";
+in
 lib.extendMkDerivation {
   constructDrv = stdenv.mkDerivation;
 
@@ -23,6 +33,7 @@ lib.extendMkDerivation {
     "cargoUpdateHook"
     "cargoLock"
     "useFetchCargoVendor"
+    "RUSTFLAGS"
   ];
 
   extendDrvArgs =
@@ -77,11 +88,19 @@ lib.extendMkDerivation {
     assert lib.warnIf (args ? useFetchCargoVendor)
       "buildRustPackage: `useFetchCargoVendor` is non‐optional and enabled by default as of 25.05, remove it"
       true;
+    {
+      env = {
+        PKG_CONFIG_ALLOW_CROSS = if stdenv.buildPlatform != stdenv.hostPlatform then 1 else 0;
+        RUST_LOG = logLevel;
+        RUSTFLAGS =
+          lib.optionalString (
+            stdenv.hostPlatform.isDarwin && buildType == "debug"
+          ) "-C split-debuginfo=packed "
+          # Workaround the existing RUSTFLAGS specified as a list.
+          + interpolateString (args.RUSTFLAGS or "");
+      }
+      // args.env or { };
 
-    lib.optionalAttrs (stdenv.hostPlatform.isDarwin && buildType == "debug") {
-      RUSTFLAGS = "-C split-debuginfo=packed " + (args.RUSTFLAGS or "");
-    }
-    // {
       cargoDeps =
         if cargoVendorDir != null then
           null
@@ -143,15 +162,6 @@ lib.extendMkDerivation {
 
       patches = cargoPatches ++ patches;
 
-      PKG_CONFIG_ALLOW_CROSS = if stdenv.buildPlatform != stdenv.hostPlatform then 1 else 0;
-
-      postUnpack = ''
-        eval "$cargoDepsHook"
-
-        export RUST_LOG=${logLevel}
-      ''
-      + (args.postUnpack or "");
-
       configurePhase =
         args.configurePhase or ''
           runHook preConfigure
diff --git a/pkgs/build-support/rust/hooks/cargo-setup-hook.sh b/pkgs/build-support/rust/hooks/cargo-setup-hook.sh
index 1c779a6541d8a..4ba6760a1a237 100644
--- a/pkgs/build-support/rust/hooks/cargo-setup-hook.sh
+++ b/pkgs/build-support/rust/hooks/cargo-setup-hook.sh
@@ -1,6 +1,8 @@
 cargoSetupPostUnpackHook() {
     echo "Executing cargoSetupPostUnpackHook"
 
+    eval "${cargoDepsHook-}"
+
     # Some cargo builds include build hooks that modify their own vendor
     # dependencies. This copies the vendor directory into the build tree and makes
     # it writable. If we're using a tarball, the unpackFile hook already handles
diff --git a/pkgs/by-name/at/at-spi2-core/package.nix b/pkgs/by-name/at/at-spi2-core/package.nix
index c9879d33eed53..1ca88332ea10a 100644
--- a/pkgs/by-name/at/at-spi2-core/package.nix
+++ b/pkgs/by-name/at/at-spi2-core/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   meson,
   ninja,
   pkg-config,
@@ -29,7 +28,7 @@
 
 stdenv.mkDerivation rec {
   pname = "at-spi2-core";
-  version = "2.58.0";
+  version = "2.58.1";
 
   outputs = [
     "out"
@@ -39,18 +38,9 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/at-spi2-core/${lib.versions.majorMinor version}/at-spi2-core-${version}.tar.xz";
-    hash = "sha256-390zANong6IZaf+t4oiYF/t8GQak75JJfrpllps9q1o=";
+    hash = "sha256-fzdKajjNcP9LMsnToDEL+oBNlG/tTJ5pp9SfrNy5Xpw=";
   };
 
-  # TODO apply unconditionally on rebuild
-  patches = lib.optionals stdenv.isDarwin [
-    (fetchpatch {
-      name = "timersub.patch";
-      url = "https://github.com/GNOME/at-spi2-core/commit/02108ea1b96db0189b2d4a9eceb843e1f13b7bdf.diff";
-      hash = "sha256-pVBhawfRnJoXmovl9CAmzh+YWJkbvlOVrCs8XanjP00=";
-    })
-  ];
-
   nativeBuildInputs = [
     glib
     meson
diff --git a/pkgs/by-name/bl/bluez-headers/package.nix b/pkgs/by-name/bl/bluez-headers/package.nix
index 2ac0d24640fb5..a3e2e4bf15bad 100644
--- a/pkgs/by-name/bl/bluez-headers/package.nix
+++ b/pkgs/by-name/bl/bluez-headers/package.nix
@@ -10,22 +10,22 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bluez-headers";
-  version = "5.83";
+  version = "5.84";
 
   # This package has the source, because of the emulatorAvailable check in the
   # bluez function args, that causes an infinite recursion with Python on cross
   # builds.
   src = fetchurl {
     url = "mirror://kernel/linux/bluetooth/bluez-${finalAttrs.version}.tar.xz";
-    hash = "sha256-EIUi2QnSIFgTmb/sk9qrYgNVOc7vPdo+eZcHhcY70kw=";
+    hash = "sha256-W6c9Aw97AAh9Z4ALDjIWAa7A+JKCfHLlosg5DYyIaxE=";
   };
 
   dontConfigure = true;
   dontBuild = true;
 
   installPhase = ''
-    mkdir -p $out/include/bluetooth
-    cp -v lib/*.h "$out/include/bluetooth/"
+    mkdir -p $out/include/
+    cp -rv lib/* "$out/include/"
   '';
 
   meta = {
diff --git a/pkgs/by-name/br/brotli/package.nix b/pkgs/by-name/br/brotli/package.nix
index 80030636ab98f..bb6c287c870f7 100644
--- a/pkgs/by-name/br/brotli/package.nix
+++ b/pkgs/by-name/br/brotli/package.nix
@@ -4,12 +4,11 @@
   fetchFromGitHub,
   fetchpatch,
   cmake,
+  python3Packages,
   staticOnly ? stdenv.hostPlatform.isStatic,
   testers,
 }:
 
-# ?TODO: there's also python lib in there
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "brotli";
   version = "1.1.0";
@@ -54,7 +53,10 @@ stdenv.mkDerivation (finalAttrs: {
     cp ../docs/*.3 $out/share/man/man3/
   '';
 
-  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  passthru.tests = {
+    pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    python = python3Packages.brotli;
+  };
 
   meta = with lib; {
     homepage = "https://github.com/google/brotli";
diff --git a/pkgs/by-name/cu/cups/package.nix b/pkgs/by-name/cu/cups/package.nix
index cbb6616f968c7..9af3d80d2e4fb 100644
--- a/pkgs/by-name/cu/cups/package.nix
+++ b/pkgs/by-name/cu/cups/package.nix
@@ -10,8 +10,8 @@
   libtiff,
   pam,
   dbus,
-  enableSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
-  systemd,
+  enableSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
+  systemdLibs,
   acl,
   gmp,
   darwin,
@@ -76,7 +76,7 @@ stdenv.mkDerivation rec {
     dbus
     acl
   ]
-  ++ lib.optional enableSystemd systemd;
+  ++ lib.optional enableSystemd systemdLibs;
 
   propagatedBuildInputs = [ gmp ];
 
diff --git a/pkgs/by-name/cu/curlMinimal/fix-h2-paused-transfers.patch b/pkgs/by-name/cu/curlMinimal/fix-h2-paused-transfers.patch
deleted file mode 100644
index 50e202684b8cb..0000000000000
--- a/pkgs/by-name/cu/curlMinimal/fix-h2-paused-transfers.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 7e91f24c73256af59ac9061c41b73a184c4690aa Mon Sep 17 00:00:00 2001
-From: Stefan Eissing <stefan@eissing.org>
-Date: Mon, 3 Nov 2025 15:07:57 +0100
-Subject: [PATCH] cw-out: fix EAGAIN handling on pause
-
-The interim CURLE_AGAIN result was not always converted to a
-CURLE_OK and then caused write callers to report a failure.
-
-Fixes #19334
-Reported-by: pennae on github
-Closes #19338
----
- lib/cw-out.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/lib/cw-out.c b/lib/cw-out.c
-index 1f4031649267..9c0a36e7e5e2 100644
---- a/lib/cw-out.c
-+++ b/lib/cw-out.c
-@@ -302,6 +302,7 @@ static CURLcode cw_out_buf_flush(struct cw_out_ctx *ctx,
-                               &consumed);
-     if(result && (result != CURLE_AGAIN))
-       return result;
-+    result = CURLE_OK;
- 
-     if(consumed) {
-       if(consumed == curlx_dyn_len(&cwbuf->b)) {
diff --git a/pkgs/by-name/cu/curlMinimal/package.nix b/pkgs/by-name/cu/curlMinimal/package.nix
index 244454016e478..f64a4c9de767f 100644
--- a/pkgs/by-name/cu/curlMinimal/package.nix
+++ b/pkgs/by-name/cu/curlMinimal/package.nix
@@ -86,7 +86,7 @@ assert
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "curl";
-  version = "8.16.0";
+  version = "8.17.0";
 
   src = fetchurl {
     urls = [
@@ -95,17 +95,9 @@ stdenv.mkDerivation (finalAttrs: {
         builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version
       }/curl-${finalAttrs.version}.tar.xz"
     ];
-    hash = "sha256-QMjN28tsxiUcA96kI6Ryps6kA3vmVLpc9d7G6y0i/x0=";
+    hash = "sha256-lV9ucprWs1ZiYOj+9oYg52ujwxrPChhSRBahhaz3eZI=";
   };
 
-  patches = [
-    # Bug introduced in curl@fa915b (8.16.0) https://github.com/curl/curl/issues/19334 Paused
-    # HTTP/2 transfers will return the wrong errors and trash the whole
-    # transfer. Remove this patch once curl is updated to 8.17.0 which will be
-    # released on the 5th November 2025.
-    ./fix-h2-paused-transfers.patch
-  ];
-
   # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion
   # necessary for FreeBSD code path in configure
   postPatch = ''
diff --git a/pkgs/by-name/da/dav1d/package.nix b/pkgs/by-name/da/dav1d/package.nix
index 23d72c245d00c..443ad79790c50 100644
--- a/pkgs/by-name/da/dav1d/package.nix
+++ b/pkgs/by-name/da/dav1d/package.nix
@@ -27,13 +27,13 @@ assert useVulkan -> withExamples;
 
 stdenv.mkDerivation rec {
   pname = "dav1d";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "videolan";
     repo = "dav1d";
     rev = version;
-    hash = "sha256-qcs9QoZ/uWEQ8l1ChZ8nYctZnnWJ0VvCw1q2rEktC9g=";
+    hash = "sha256-rxRO5EWjrOUsCYXd2rDDhfcEZbfSuMfjujRAHTqUYhI=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/dc/dconf/package.nix b/pkgs/by-name/dc/dconf/package.nix
index 916d5551f93cd..70ef73c207612 100644
--- a/pkgs/by-name/dc/dconf/package.nix
+++ b/pkgs/by-name/dc/dconf/package.nix
@@ -25,9 +25,9 @@
   withDocs ? withIntrospection,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "dconf";
-  version = "0.40.0";
+  version = "0.49.0";
 
   outputs = [
     "out"
@@ -37,8 +37,8 @@ stdenv.mkDerivation rec {
   ++ lib.optional withDocs "devdoc";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "0cs5nayg080y8pb9b7qccm1ni8wkicdmqp1jsgc22110r6j24zyg";
+    url = "mirror://gnome/sources/dconf/${lib.versions.majorMinor finalAttrs.version}/dconf-${finalAttrs.version}.tar.xz";
+    sha256 = "FqR+SaWBVtu5ZXjhcIMlKZ5MGe6pvhKNW9Ev0JY9bDY=";
   };
 
   nativeBuildInputs = [
@@ -79,15 +79,13 @@ stdenv.mkDerivation rec {
     !stdenv.hostPlatform.isAarch32 && !stdenv.hostPlatform.isAarch64 && !stdenv.hostPlatform.isDarwin;
 
   postPatch = ''
-    chmod +x meson_post_install.py tests/test-dconf.py
-    patchShebangs meson_post_install.py
-    patchShebangs tests/test-dconf.py
+    chmod +x tests/test-dconf.py tests/shellcheck.sh
+    patchShebangs tests/test-dconf.py tests/shellcheck.sh
   '';
 
   passthru = {
     updateScript = gnome.updateScript {
-      packageName = pname;
-      versionPolicy = "odd-unstable";
+      packageName = "dconf";
     };
     tests = { inherit (nixosTests) dconf; };
   };
@@ -103,4 +101,4 @@ stdenv.mkDerivation rec {
     teams = [ teams.gnome ];
     mainProgram = "dconf";
   };
-}
+})
diff --git a/pkgs/by-name/fl/fluidsynth/package.nix b/pkgs/by-name/fl/fluidsynth/package.nix
index 88e0135024215..60852d919bf6b 100644
--- a/pkgs/by-name/fl/fluidsynth/package.nix
+++ b/pkgs/by-name/fl/fluidsynth/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fluidsynth";
-  version = "2.5.0";
+  version = "2.5.1";
 
   src = fetchFromGitHub {
     owner = "FluidSynth";
     repo = "fluidsynth";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ouPCbXg9vgxSAHsReC7dmF1cstQZ1HaUoWcLChE35Hk=";
+    hash = "sha256-gTkW2X7fcmxJwYf13Yma6cBigz4sbsb99dBSYTDlcyY=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/gi/gi-docgen/package.nix b/pkgs/by-name/gi/gi-docgen/package.nix
index 1ff554f2f4a50..9e04c34259145 100644
--- a/pkgs/by-name/gi/gi-docgen/package.nix
+++ b/pkgs/by-name/gi/gi-docgen/package.nix
@@ -9,13 +9,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gi-docgen";
-  version = "2025.4";
+  version = "2025.5";
 
   format = "other";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gi-docgen/${lib.versions.major version}/gi-docgen-${version}.tar.xz";
-    hash = "sha256-Zshl1Fn+vfteQHiojfBhg2IMPpH3JtHcYI2I7jYFUm4=";
+    hash = "sha256-JXmjP/h7Yi0Q0QLJG30OzlBjQLcONNu2UiFj4WyQrKM=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/by-name/gs/gsettings-desktop-schemas/package.nix b/pkgs/by-name/gs/gsettings-desktop-schemas/package.nix
index cbeece5a07aa9..c4ee1db9fae9a 100644
--- a/pkgs/by-name/gs/gsettings-desktop-schemas/package.nix
+++ b/pkgs/by-name/gs/gsettings-desktop-schemas/package.nix
@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gsettings-desktop-schemas";
-  version = "49.0";
+  version = "49.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    hash = "sha256-kSkFzEU4KIikdwLtEQHGsI69ASKjKmfZQKuBFqlsUg0=";
+    hash = "sha256-d3p/g9XlqAdrm/gJyyQQGxsbqcIwI148PejhOWjtDmM=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/hw/hwdata/package.nix b/pkgs/by-name/hw/hwdata/package.nix
index 28440ad5a0be7..b8b15bd8ca185 100644
--- a/pkgs/by-name/hw/hwdata/package.nix
+++ b/pkgs/by-name/hw/hwdata/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hwdata";
-  version = "0.400";
+  version = "0.401";
 
   src = fetchFromGitHub {
     owner = "vcrhonek";
     repo = "hwdata";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-X3LL3PZjEiGrkntegcSWNW2Wsx/IpdTowSVp/F4ov+E=";
+    hash = "sha256-2NZwylrUfnzA0aE+xlVZ7QCpCzfW9DwGzRVHirt0TRU=";
   };
 
   doCheck = false; # this does build machine-specific checks (e.g. enumerates PCI bus)
diff --git a/pkgs/by-name/in/inetutils/package.nix b/pkgs/by-name/in/inetutils/package.nix
index ee1a08aee9469..ffc901683e0d1 100644
--- a/pkgs/by-name/in/inetutils/package.nix
+++ b/pkgs/by-name/in/inetutils/package.nix
@@ -71,16 +71,18 @@ stdenv.mkDerivation rec {
   postInstall = ''
     mkdir $apparmor
     cat >$apparmor/bin.ping <<EOF
-    $out/bin/ping {
+    abi <abi/4.0>,
+    include <tunables/global>
+    profile $out/bin/ping {
       include <abstractions/base>
       include <abstractions/consoles>
       include <abstractions/nameservice>
       include "${apparmorRulesFromClosure { name = "ping"; } [ stdenv.cc.libc ]}"
-      include <local/bin.ping>
       capability net_raw,
       network inet raw,
       network inet6 raw,
       mr $out/bin/ping,
+      include if exists <local/bin.ping>
     }
     EOF
   '';
diff --git a/pkgs/by-name/is/isocodes/package.nix b/pkgs/by-name/is/isocodes/package.nix
index 68c43ab4be2aa..a8af805b92de5 100644
--- a/pkgs/by-name/is/isocodes/package.nix
+++ b/pkgs/by-name/is/isocodes/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "iso-codes";
-  version = "4.18.0";
+  version = "4.19.0";
 
   src = fetchurl {
     url =
       with finalAttrs;
       "https://salsa.debian.org/iso-codes-team/iso-codes/-/archive/v${version}/${pname}-v${version}.tar.gz";
-    hash = "sha256-UR9nv0tRqnfxfEWtv/UzJCtQ8eNw/kmlcGtjQZAvrIc=";
+    hash = "sha256-SxQ6iR/rfRu2TkT+PvJT7za6EYXR0SnBQlM43G5G4n0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libadwaita/package.nix b/pkgs/by-name/li/libadwaita/package.nix
index dd4ea744d0c18..e29c04dd5b15d 100644
--- a/pkgs/by-name/li/libadwaita/package.nix
+++ b/pkgs/by-name/li/libadwaita/package.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libadwaita";
-  version = "1.8.0";
+  version = "1.8.1";
 
   outputs = [
     "out"
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "GNOME";
     repo = "libadwaita";
     tag = finalAttrs.version;
-    hash = "sha256-neF7nt7x3QhSsWuWGouqniFlDHw1Soco7Dpzhy15gWE=";
+    hash = "sha256-9CcmzwQYZZc6dZAv6x90Od4lrRcYZIejzPgm6S1vz/U=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/by-name/li/libapparmor/apparmorRulesFromClosure.nix b/pkgs/by-name/li/libapparmor/apparmorRulesFromClosure.nix
index a12b8f0459be7..3de57c122ce6c 100644
--- a/pkgs/by-name/li/libapparmor/apparmorRulesFromClosure.nix
+++ b/pkgs/by-name/li/libapparmor/apparmorRulesFromClosure.nix
@@ -9,18 +9,18 @@
   # TODO: factorize here some other common paths
   # that may emerge from use cases.
   baseRules ? [
-    "r $path"
-    "r $path/etc/**"
-    "mr $path/share/**"
+    "$path r"
+    "$path/etc/** r"
+    "$path/share/** mr"
     # Note that not all libraries are prefixed with "lib",
     # eg. glibc-2.30/lib/ld-2.30.so
-    "mr $path/lib/**.so*"
-    "mr $path/lib64/**.so*"
+    "$path/lib/**.so* mr"
+    "$path/lib64/**.so* mr"
     # eg. glibc-2.30/lib/gconv/gconv-modules
-    "r $path/lib/**"
-    "r $path/lib64/**"
+    "$path/lib/** r"
+    "$path/lib64/** r"
     # Internal executables
-    "ixr $path/libexec/**"
+    "$path/libexec/** ixr"
   ],
   name ? "",
 }:
diff --git a/pkgs/by-name/li/libcap/package.nix b/pkgs/by-name/li/libcap/package.nix
index 76e0ee1d0fe6a..8e3efdd4d5206 100644
--- a/pkgs/by-name/li/libcap/package.nix
+++ b/pkgs/by-name/li/libcap/package.nix
@@ -3,6 +3,7 @@
   lib,
   buildPackages,
   fetchurl,
+  fetchpatch,
   runtimeShell,
   pkgsBuildHost,
   usePam ? !isStatic,
@@ -28,11 +29,11 @@ assert usePam -> pam != null;
 
 stdenv.mkDerivation rec {
   pname = "libcap";
-  version = "2.76";
+  version = "2.77";
 
   src = fetchurl {
     url = "mirror://kernel/linux/libs/security/linux-privs/libcap2/${pname}-${version}.tar.xz";
-    hash = "sha256-Yp2kqymQDQ9/zDYicHN0MRmSX9cRyZoWibv1ybQMjm8=";
+    hash = "sha256-iXvBi0Svwmxw54zq09uzHhVKzCS+4IWloJB5qI2/b1I=";
   };
 
   outputs = [
@@ -73,6 +74,13 @@ stdenv.mkDerivation rec {
     "LIBCSTATIC=yes"
   ];
 
+  patches = [
+    (fetchpatch {
+      url = "https://git.kernel.org/pub/scm/libs/libcap/libcap.git/patch/?id=d628b3bfe40338d4efff6b0ae50f250a0eb884c7";
+      hash = "sha256-Eiv/BOJZkduL+hOEJd8K1LQd9wvOeCKchE2GaLcerVc=";
+    })
+  ];
+
   postPatch = ''
     patchShebangs ./progs/mkcapshdoc.sh
 
@@ -86,11 +94,6 @@ stdenv.mkDerivation rec {
       --replace 'lib_prefix=$(exec_prefix)' "lib_prefix=$lib" \
       --replace 'inc_prefix=$(prefix)' "inc_prefix=$dev" \
       --replace 'man_prefix=$(prefix)' "man_prefix=$doc"
-  ''
-  + lib.optionalString withGo ''
-    # disable cross compilation for artifacts which are run as part of the build
-    substituteInPlace go/Makefile \
-      --replace-fail '$(GO) run' 'GOOS= GOARCH= $(GO) run'
   '';
 
   installFlags = [ "RAISE_SETFCAP=no" ];
diff --git a/pkgs/by-name/li/libdeflate/package.nix b/pkgs/by-name/li/libdeflate/package.nix
index 0a14d75ea7dcf..c04a7bc35a8ab 100644
--- a/pkgs/by-name/li/libdeflate/package.nix
+++ b/pkgs/by-name/li/libdeflate/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdeflate";
-  version = "1.24";
+  version = "1.25";
 
   src = fetchFromGitHub {
     owner = "ebiggers";
     repo = "libdeflate";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-IaXXm9VrZ0Pgb3yTh1fPKkifJDvCxvCfTH08Sdho0Ko=";
+    hash = "sha256-2TiV3kmFs9j4aYetoYeWg3+MoZ542/0zaD0hwn9b8ZA=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/by-name/li/libdrm/package.nix b/pkgs/by-name/li/libdrm/package.nix
index 9c38c381502e4..f78ff46011f29 100644
--- a/pkgs/by-name/li/libdrm/package.nix
+++ b/pkgs/by-name/li/libdrm/package.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libdrm";
-  version = "2.4.127";
+  version = "2.4.128";
 
   src = fetchurl {
     url = "https://dri.freedesktop.org/${pname}/${pname}-${version}.tar.xz";
-    hash = "sha256-BRrrPlQqV2IQGP/EQ/sIjdabeO7wzkgItgTOD+rJ9H8=";
+    hash = "sha256-O7NduHAMKgtWnyxnKaU/VJV4aFazEIVMjeV3gqIr3aw=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/li/libressl/default.nix b/pkgs/by-name/li/libressl/default.nix
index 279cbdf60f2eb..2667f2c1bf978 100644
--- a/pkgs/by-name/li/libressl/default.nix
+++ b/pkgs/by-name/li/libressl/default.nix
@@ -117,30 +117,9 @@ let
   };
 in
 {
-  libressl_4_0 = generic {
-    version = "4.0.1";
-    hash = "sha256-IClLh3eMJidIk4Y5Q8hjWJebSZ03tJl31r+Gj3tZfL0=";
-    # Fixes build on loongarch64
-    # https://github.com/libressl/portable/pull/1146
-    patches = [
-      (fetchpatch {
-        name = "0100-ALT-basic-loongarch64-support.patch";
-        url = "https://git.altlinux.org/gears/L/LibreSSL.git?p=LibreSSL.git;a=blob_plain;f=patches/0100-ALT-basic-loongarch64-support.patch;hb=70ddea860b8b62531bd3968bf4d7a5c4b7086776";
-        stripLen = 2;
-        extraPrefix = "";
-        postFetch = ''
-          substituteInPlace "$out" \
-            --replace-fail "a//dev/null" "/dev/null"
-        '';
-        hash = "sha256-dEdtmHHiR7twAqgebXv1Owle/KYCak71NhDCp0PdseU=";
-      })
-      common-cmake-install-full-dirs-patch
-    ];
-  };
-
   libressl_4_1 = generic {
-    version = "4.1.1";
-    hash = "sha256-x/96fWddX1dzCUDlzP8dvi3NW3QFtTl+D3/9ZqXtVnk=";
+    version = "4.1.2";
+    hash = "sha256-+6Ti+ip/UjBt96OJlwoQ6YuX6w7bKZqf252/SZmcYeE=";
     # Fixes build on loongarch64
     # https://github.com/libressl/portable/pull/1184
     postPatch = ''
@@ -158,8 +137,8 @@ in
   };
 
   libressl_4_2 = generic {
-    version = "4.2.0";
-    hash = "sha256-D326RNfLjfjVPyz78ZVSVLwSjgCJWV8aui+s+u6ECLI=";
+    version = "4.2.1";
+    hash = "sha256-bVwvWFg1iOp5H0yGRQBAcdAN+lVKW/eIoAbKHrWr1ws=";
     patches = [
       common-cmake-install-full-dirs-patch
     ];
diff --git a/pkgs/by-name/li/librsvg/package.nix b/pkgs/by-name/li/librsvg/package.nix
index 978cc3cad3b71..4e4b9f0003785 100644
--- a/pkgs/by-name/li/librsvg/package.nix
+++ b/pkgs/by-name/li/librsvg/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch,
   pkg-config,
   meson,
   ninja,
@@ -50,7 +49,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "librsvg";
-  version = "2.61.2";
+  version = "2.61.3";
 
   outputs = [
     "out"
@@ -62,23 +61,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/librsvg/${lib.versions.majorMinor finalAttrs.version}/librsvg-${finalAttrs.version}.tar.xz";
-    hash = "sha256-RkTYNiPdYcxEecKzw3Lh2isoFVLryQA1yNGsUC6x3AA=";
+    hash = "sha256-pW0sgNdErS8nGPhd9Gb+cdJP8fm8Pl71iL3k1+h4FfI=";
   };
 
-  patches = [
-    (fetchpatch {
-      # https://gitlab.gnome.org/GNOME/librsvg/-/merge_requests/1149
-      # libxml 2.15+ requires adjustments to error handling
-      # remove next librsvg release
-      url = "https://gitlab.gnome.org/GNOME/librsvg/-/commit/6663df8e9aec323f0c124e97a7c7447a90c67c4a.patch";
-      hash = "sha256-+iyRvxVMxSCW0IIizXXheBFytwhBtU4cyJNTBebCOSg=";
-    })
-  ];
-
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
     name = "librsvg-deps-${finalAttrs.version}";
-    hash = "sha256-OZspQg9ryDNILUZMiB77vIF0uGCMyVe7blX5BJk102k=";
+    hash = "sha256-5uNkjfZhETuG8Sjw66zapYXOj4dgz9Ziry2kAV+pvZQ=";
     dontConfigure = true;
   };
 
diff --git a/pkgs/by-name/li/liburcu/package.nix b/pkgs/by-name/li/liburcu/package.nix
index 3ba541fd11ca0..e7dae0dec76db 100644
--- a/pkgs/by-name/li/liburcu/package.nix
+++ b/pkgs/by-name/li/liburcu/package.nix
@@ -3,15 +3,16 @@
   stdenv,
   fetchurl,
   perl,
+  gitUpdater,
 }:
 
 stdenv.mkDerivation rec {
-  version = "0.15.3";
+  version = "0.15.5";
   pname = "liburcu";
 
   src = fetchurl {
     url = "https://lttng.org/files/urcu/userspace-rcu-${version}.tar.bz2";
-    hash = "sha256-Jmh+yE4+EUdZRUyISgir6ved7AmwQYld30xF7BUKy20=";
+    hash = "sha256-sveHqKg1EsMlmecc2rzFExRklHuCAUiWvRFBOy14LeE=";
   };
 
   outputs = [
@@ -27,6 +28,11 @@ stdenv.mkDerivation rec {
   preCheck = "patchShebangs tests/unit";
   doCheck = true;
 
+  passthru.updateScript = gitUpdater {
+    url = "https://git.lttng.org/userspace-rcu.git";
+    rev-prefix = "v";
+  };
+
   meta = {
     description = "Userspace RCU (read-copy-update) library";
     homepage = "https://lttng.org/urcu";
diff --git a/pkgs/by-name/lz/lz4/package.nix b/pkgs/by-name/lz/lz4/package.nix
index 23c13065ae40e..bab192f7c4248 100644
--- a/pkgs/by-name/lz/lz4/package.nix
+++ b/pkgs/by-name/lz/lz4/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   valgrind,
   testers,
@@ -18,6 +19,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-/dG1n59SKBaEBg72pAWltAtVmJ2cXxlFFhP+klrkTos=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2025-62813.patch";
+      url = "https://github.com/lz4/lz4/commit/f64efec011c058bd70348576438abac222fe6c82.patch";
+      hash = "sha256-qOvK0A3MGX14WdhThV7m4G6s+ZMP6eA/07A2BY5nesY=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
   ];
diff --git a/pkgs/by-name/md/mdbook/package.nix b/pkgs/by-name/md/mdbook/package.nix
index 3c408a3815e90..6a21c81805752 100644
--- a/pkgs/by-name/md/mdbook/package.nix
+++ b/pkgs/by-name/md/mdbook/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
   nix,
   rustPlatform,
   installShellFiles,
@@ -22,6 +23,14 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-wvTixSVHXglJM+nBMulZNZKF8pZfNd2G8Z+1PlAWmpk=";
 
+  patches = [
+    (fetchpatch2 {
+      name = "fix-rust-1.91-tests.patch";
+      url = "https://github.com/rust-lang/mdBook/commit/841c68d05e763b031524a2b4d679f033cd15e64c.patch?full_index=1";
+      hash = "sha256-KDQhmFX2TWamtdyssFL69MP3vg9LABb+bF8/7vaFsew=";
+    })
+  ];
+
   nativeBuildInputs = [ installShellFiles ];
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
diff --git a/pkgs/by-name/mj/mjpegtools/package.nix b/pkgs/by-name/mj/mjpegtools/package.nix
index ad5ad85e729c6..bfd9320ed0206 100644
--- a/pkgs/by-name/mj/mjpegtools/package.nix
+++ b/pkgs/by-name/mj/mjpegtools/package.nix
@@ -56,6 +56,13 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     sed -i -e '/ARCHFLAGS=/s:=.*:=:' configure
+  ''
+  # Only ppc64le baseline guarantees AltiVec, no configure option to disable it so just make checks never signal success.
+  # AltiVec code also fails without disabling new compiler warnings:
+  # quant_non_intra.c:72:42: error: initialization of '__vector unsigned short *' {aka '__vector(8) short unsigned int *'} from incompatible pointer type 'uint16_t *' {aka 'short unsigned int *'} [-Wincompatible-pointer-types]
+  + lib.optionalString (!(stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isLittleEndian)) ''
+    substituteInPlace configure \
+      --replace-fail 'have_altivec=true' 'have_altivec=false'
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/ml/mlt/package.nix b/pkgs/by-name/ml/mlt/package.nix
index ae965a28077cf..718ef3ef656cd 100644
--- a/pkgs/by-name/ml/mlt/package.nix
+++ b/pkgs/by-name/ml/mlt/package.nix
@@ -6,7 +6,7 @@
   cmake,
   pkg-config,
   which,
-  ffmpeg_7,
+  ffmpeg,
   fftw,
   frei0r,
   libdv,
@@ -25,6 +25,7 @@
   cudaSupport ? config.cudaSupport,
   cudaPackages ? { },
   enableJackrack ? stdenv.hostPlatform.isLinux,
+  gdk-pixbuf,
   glib,
   ladspa-sdk,
   ladspaPlugins,
@@ -40,13 +41,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mlt";
-  version = "7.32.0";
+  version = "7.34.1";
 
   src = fetchFromGitHub {
     owner = "mltframework";
     repo = "mlt";
     tag = "v${version}";
-    hash = "sha256-8T5FXXGs7SxL6nD+R1Q/0Forsdp5Xux4S3VLvgqXzw8=";
+    hash = "sha256-zdfjl4ZrdmX445hYx2CoKj1NuXQslQpTC5m96zPrZes=";
     # The submodule contains glaxnimate code, since MLT uses internally some functions defined in glaxnimate.
     # Since glaxnimate is not available as a library upstream, we cannot remove for now this dependency on
     # submodules until upstream exports glaxnimate as a library: https://gitlab.com/mattbas/glaxnimate/-/issues/545
@@ -71,8 +72,9 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    (opencv4.override { inherit ffmpeg_7; })
-    ffmpeg_7
+    gdk-pixbuf
+    (opencv4.override { inherit ffmpeg; })
+    ffmpeg
     fftw
     frei0r
     libdv
@@ -118,9 +120,18 @@ stdenv.mkDerivation rec {
   ++ lib.optionals enablePython [
     "-DSWIG_PYTHON=ON"
   ]
-  ++ lib.optionals (qt != null) [
-    "-DMOD_QT${lib.versions.major qt.qtbase.version}=ON"
-    "-DMOD_GLAXNIMATE${if lib.versions.major qt.qtbase.version == "5" then "" else "_QT6"}=ON"
+  ++ lib.optionals (qt == null) [
+    "-DMOD_QT6=OFF"
+  ]
+  ++ lib.optionals (qt != null && lib.versions.major qt.qtbase.version == "5") [
+    "-DMOD_QT=ON"
+    "-DMOD_QT6=OFF"
+    "-DMOD_GLAXNIMATE=ON"
+  ]
+  ++ lib.optionals (qt != null && lib.versions.major qt.qtbase.version == "6") [
+    "-DMOD_QT6=ON"
+    "-DMOD_QT=OFF"
+    "-DMOD_GLAXNIMATE_QT6=ON"
   ];
 
   preFixup = ''
@@ -137,7 +148,7 @@ stdenv.mkDerivation rec {
   '';
 
   passthru = {
-    ffmpeg = ffmpeg_7;
+    inherit ffmpeg;
   };
 
   passthru.updateScript = gitUpdater {
diff --git a/pkgs/by-name/mu/munge/package.nix b/pkgs/by-name/mu/munge/package.nix
index ecfd36396afdc..1fbd0e3947d61 100644
--- a/pkgs/by-name/mu/munge/package.nix
+++ b/pkgs/by-name/mu/munge/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "munge";
-  version = "0.5.16";
+  version = "0.5.17";
 
   src = fetchFromGitHub {
     owner = "dun";
     repo = "munge";
     rev = "munge-${finalAttrs.version}";
-    sha256 = "sha256-fv42RMUAP8Os33/iHXr70i5Pt2JWZK71DN5vFI3q7Ak=";
+    sha256 = "sha256-MfxED81P4ipdP4fuxwmpNrAeej3ZH+qiHIt5bSrct1o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ns/nspr/package.nix b/pkgs/by-name/ns/nspr/package.nix
index 7e24a62ccf392..d16052a7603cf 100644
--- a/pkgs/by-name/ns/nspr/package.nix
+++ b/pkgs/by-name/ns/nspr/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "nspr";
-  version = "4.37";
+  version = "4.38.2";
 
   src = fetchurl {
     url = "mirror://mozilla/nspr/releases/v${version}/src/nspr-${version}.tar.gz";
-    hash = "sha256-X5NE7Q4xhVvTj4izPJ2auU9wzlR+8yE+SI0VIPYYQPo=";
+    hash = "sha256-5Akvrqt3vcmzLbERPkIVlI7naOJsRmbbO1pgs18skQU=";
   };
 
   patches = [
diff --git a/pkgs/by-name/sc/scons/no-man-pages.patch b/pkgs/by-name/sc/scons/no-man-pages.patch
deleted file mode 100644
index 4dd459b8261e8..0000000000000
--- a/pkgs/by-name/sc/scons/no-man-pages.patch
+++ /dev/null
@@ -1,14 +0,0 @@
---- a/setup.cfg
-+++ b/setup.cfg
-@@ -67,11 +67,6 @@ console_scripts =
- SCons.Tool.docbook = *.*
- 
- 
--[options.data_files]
--. = scons.1
--    scons-time.1
--    sconsign.1
--
- [sdist]
-     dist_dir=build/dist
- 
diff --git a/pkgs/by-name/sc/scons/package.nix b/pkgs/by-name/sc/scons/package.nix
index 5781d12a24bd9..c1393046acdd1 100644
--- a/pkgs/by-name/sc/scons/package.nix
+++ b/pkgs/by-name/sc/scons/package.nix
@@ -6,26 +6,18 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "scons";
-  version = "4.7.0";
+  version = "4.10.0";
 
   src = fetchFromGitHub {
     owner = "Scons";
     repo = "scons";
-    rev = version;
-    hash = "sha256-7VzGuz9CAUF6MRCEpj5z1FkZD19/Ic+YBukYQocvkr0=";
+    tag = version;
+    hash = "sha256-ZmJETrznHH3zsNBO5o8JCvf+6l7NICOAfIqASYzYBaM=";
   };
 
   pyproject = true;
 
-  patches = [
-    ./env.patch
-    ./no-man-pages.patch
-    # Fix builds on sandboxed Darwin: https://github.com/SCons/scons/pull/4603
-    (fetchpatch {
-      url = "https://github.com/SCons/scons/commit/2d5e3a40a613225b329776ab9dbd9abcd2d24222.patch";
-      hash = "sha256-N1xQOvsPTi7a2maEZJQVu6vJ9AoWMqDOsScXHp9KuXI=";
-    })
-  ];
+  patches = [ ./env.patch ];
 
   build-system = [
     python3Packages.setuptools
diff --git a/pkgs/by-name/sd/sdl2-compat/package.nix b/pkgs/by-name/sd/sdl2-compat/package.nix
index 0aec5ddf963f8..e16eb5927cec0 100644
--- a/pkgs/by-name/sd/sdl2-compat/package.nix
+++ b/pkgs/by-name/sd/sdl2-compat/package.nix
@@ -2,6 +2,7 @@
   cmake,
   lib,
   fetchFromGitHub,
+  fetchpatch2,
   ninja,
   sdl3,
   stdenv,
@@ -71,7 +72,15 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
-  patches = [ ./find-headers.patch ];
+  patches = [
+    ./find-headers.patch
+
+    # https://github.com/libsdl-org/sdl2-compat/pull/545
+    (fetchpatch2 {
+      url = "https://github.com/libsdl-org/sdl2-compat/commit/b799076c72c2492224e81544f58f92b737cccbd3.patch?full_index=1";
+      hash = "sha256-fAc8yBlT+XFHDKcF4MFgBAz2WtXGmhYzNNrjaGSr+do=";
+    })
+  ];
   setupHook = ./setup-hook.sh;
 
   postFixup = ''
diff --git a/pkgs/by-name/so/sord/package.nix b/pkgs/by-name/so/sord/package.nix
index bec23bbd710cd..3575d79cf8b50 100644
--- a/pkgs/by-name/so/sord/package.nix
+++ b/pkgs/by-name/so/sord/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   doxygen,
-  fetchFromGitHub,
+  fetchFromGitLab,
   meson,
   ninja,
   pcre2,
@@ -14,13 +14,14 @@
 
 stdenv.mkDerivation rec {
   pname = "sord";
-  version = "0.16.18";
+  version = "0.16.20";
 
-  src = fetchFromGitHub {
+  src = fetchFromGitLab {
+    domain = "gitlab.com";
     owner = "drobilla";
     repo = "sord";
-    rev = "v${version}";
-    hash = "sha256-cFobmmO2RHJdfCgTyGigzsdLpj7YF6U3r71i267Azks=";
+    tag = "v${version}";
+    hash = "sha256-+f3dxhcxVoub+KeI5c5/J87SVvAawrm5cZgo2qogdRM=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/sq/squashfsTools/package.nix b/pkgs/by-name/sq/squashfsTools/package.nix
index 9f475c41f4466..5039d9079bccd 100644
--- a/pkgs/by-name/sq/squashfsTools/package.nix
+++ b/pkgs/by-name/sq/squashfsTools/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "squashfs";
-  version = "4.7.2";
+  version = "4.7.4";
 
   src = fetchFromGitHub {
     owner = "plougher";
     repo = "squashfs-tools";
     rev = version;
-    hash = "sha256-iQ+pBt+jvqI6zgZRV2MZM3CeFqiXe8Z+SS+rLOB4DLw=";
+    hash = "sha256-xvTSGVwtzJjoAIF6GClASUIB5eIk+uquQNNzHIuwkuY=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/sr/sratom/package.nix b/pkgs/by-name/sr/sratom/package.nix
index bcff1fc39ee97..b55a15c1785a8 100644
--- a/pkgs/by-name/sr/sratom/package.nix
+++ b/pkgs/by-name/sr/sratom/package.nix
@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation rec {
   pname = "sratom";
-  version = "0.6.18";
+  version = "0.6.20";
 
   outputs = [
     "out"
@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://download.drobilla.net/${pname}-${version}.tar.xz";
-    hash = "sha256-TGptngtNbAHMBqiEmRD+zrkuZmyzh3nGFN0kBKmTHpI=";
+    hash = "sha256-OCbpGGyrxDyl41n8w9gjgGAjL1+KIJC+XcmrOQ5bZHc=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/ut/utf8proc/package.nix b/pkgs/by-name/ut/utf8proc/package.nix
index 049a99ef79e78..28577b96d6633 100644
--- a/pkgs/by-name/ut/utf8proc/package.nix
+++ b/pkgs/by-name/ut/utf8proc/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation rec {
   pname = "utf8proc";
-  version = "2.11.0";
+  version = "2.11.1";
 
   src = fetchFromGitHub {
     owner = "JuliaStrings";
     repo = "utf8proc";
     rev = "v${version}";
-    hash = "sha256-iNITnxA1cacOBRU/XV22yzjB0XUOCYsaLLLPYLa+AoA=";
+    hash = "sha256-fFeevzek6Oql+wMmkZXVzKlDh3wZ6AjGCKJFsXBaqzg=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/uv/uv/package.nix b/pkgs/by-name/uv/uv/package.nix
index 11a3d85cf6159..0ab5dfc752597 100644
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@@ -18,16 +18,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uv";
-  version = "0.9.7";
+  version = "0.9.9";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     tag = finalAttrs.version;
-    hash = "sha256-I0Oe6vaH7iQh+Ubp5RIk8Ol6Ni7OPu8HKX0fqLdewyk=";
+    hash = "sha256-i9vdpHA9EfXmw5fhK1tTZG0T2zOlDbjPCGBIizvQzZw=";
   };
 
-  cargoHash = "sha256-K/RP7EA0VAAI8TGx+VwfKPmyT6+x4p3kekuoMZ0/egc=";
+  cargoHash = "sha256-RZkIjHQElqrj+UAz+q6w1CYW3E5/YW9uy2E5KpKvw+w=";
 
   buildInputs = [
     rust-jemalloc-sys
@@ -62,7 +62,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   passthru = {
     tests.uv-python = python3Packages.uv;
 
-    # Updating `uv` needs to be done on staging. Disabling r-ryantm update bot:
+    # Updating `uv` needs to be done on staging until the next staging branch-off.
+    # Disabling r-ryantm update bot:
     # nixpkgs-update: no auto update
     updateScript = nix-update-script { };
   };
diff --git a/pkgs/by-name/wa/waf/package.nix b/pkgs/by-name/wa/waf/package.nix
index 6f4fe6d9cba23..ad1b14998c635 100644
--- a/pkgs/by-name/wa/waf/package.nix
+++ b/pkgs/by-name/wa/waf/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "waf";
-  version = "2.1.6";
+  version = "2.1.7";
 
   src = fetchFromGitLab {
     owner = "ita1024";
     repo = "waf";
     rev = "waf-${finalAttrs.version}";
-    hash = "sha256-srBBRe7OLNM86OVJYYk6A0EYJi+rdJ/xG7f+YBdrclE=";
+    hash = "sha256-qJDnox7+MUtAK8NaaDgEdRVU4YVA8f5Ky9Suv/qLI3g=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/xk/xkeyboard-config/package.nix b/pkgs/by-name/xk/xkeyboard-config/package.nix
index 76f05d89a425a..038e63760f78b 100644
--- a/pkgs/by-name/xk/xkeyboard-config/package.nix
+++ b/pkgs/by-name/xk/xkeyboard-config/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchurl,
-  fetchpatch2,
   pkg-config,
   meson,
   ninja,
@@ -14,23 +13,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "xkeyboard-config";
-  version = "2.45";
+  version = "2.46";
 
   src = fetchurl {
     url = "mirror://xorg/individual/data/xkeyboard-config/xkeyboard-config-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Fp4HWpLZV6V3h8GZ6E41nfKTG3GWwcW0o9V27mI1qHw=";
+    hash = "sha256-EMWCGPtg0I+x97MDBN6zukdhMZWqigioHxlyd1zMNkA=";
   };
 
-  patches = [
-    # Patch that reverts a commit in 2.45 that broke the us-mac keyboard layout.
-    # Remove when 2.46 is released.
-    # https://github.com/NixOS/nixpkgs/issues/426375
-    (fetchpatch2 {
-      url = "https://gitlab.freedesktop.org/xkeyboard-config/xkeyboard-config/-/commit/11dbaeb23d06c0d21efe538c90b44ffc8fc3a071.patch";
-      hash = "sha256-qZkO1GQvbtTFeXqCuA7bjgQX5jq9c+LiKa/ziP1w2sI=";
-    })
-  ];
-
   strictDeps = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ya/yara/package.nix b/pkgs/by-name/ya/yara/package.nix
index 0867a3175cef4..317575a66bfca 100644
--- a/pkgs/by-name/ya/yara/package.nix
+++ b/pkgs/by-name/ya/yara/package.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "yara";
-  version = "4.5.4";
+  version = "4.5.5";
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
     repo = "yara";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vSwjP0wbC65jEOxY9zrHAV1gEhcZ96emqvkuUw20Twc=";
+    hash = "sha256-a+oLxVJgdDrnOra85PPo8ZlFhinawWHuRtVE39S8yJk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/go/1.24.nix b/pkgs/development/compilers/go/1.24.nix
index 17be8a607ec0e..cdd21e4c40040 100644
--- a/pkgs/development/compilers/go/1.24.nix
+++ b/pkgs/development/compilers/go/1.24.nix
@@ -9,45 +9,18 @@
   buildPackages,
   pkgsBuildTarget,
   targetPackages,
-  testers,
-  skopeo,
   buildGo124Module,
+  callPackage,
 }:
 
 let
   goBootstrap = buildPackages.callPackage ./bootstrap122.nix { };
 
-  skopeoTest = skopeo.override { buildGoModule = buildGo124Module; };
-
   # We need a target compiler which is still runnable at build time,
   # to handle the cross-building case where build != host == target
   targetCC = pkgsBuildTarget.targetPackages.stdenv.cc;
 
   isCross = stdenv.buildPlatform != stdenv.targetPlatform;
-
-  # In order for buildmode=pie to work either Go's internal linker must know how
-  # to produce position-independent executables or Go must be using an external linker.
-  #
-  # go-default-pie.patch tries to enable position-independent codegen (PIE) only when the platform
-  # reports support (via BuildModeSupported(..., "pie", ...)).
-  #
-  # That probe is not fully reliable: for example, `pkgsi686Linux.go` can fail during bootstrap
-  # with message 'default PIE binary requires external (cgo) linking, but cgo is not enabled'
-  # despite CGO being enabled. (we set `CGO_ENABLED=1`).
-  #
-  # To avoid such breakage, limit this patch to a small set of explicitly tested platforms
-  # rather than relying on the general BuildModeSupported("pie") check.
-  supportsDefaultPie =
-    let
-      hasPie = {
-        "amd64" = true;
-        "arm64" = true;
-        "ppc64le" = true;
-        "riscv64" = true;
-      };
-    in
-    hasPie.${stdenv.hostPlatform.go.GOARCH} or false
-    && hasPie.${stdenv.targetPlatform.go.GOARCH} or false;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
@@ -89,11 +62,6 @@ stdenv.mkDerivation (finalAttrs: {
     ./remove-tools-1.11.patch
     ./go_no_vendor_checks-1.23.patch
     ./go-env-go_ldso.patch
-  ]
-  ++ lib.optionals supportsDefaultPie [
-    (replaceVars ./go-default-pie.patch {
-      inherit (stdenv.targetPlatform.go) GOARCH;
-    })
   ];
 
   inherit (stdenv.targetPlatform.go) GOOS GOARCH GOARM;
@@ -195,14 +163,10 @@ stdenv.mkDerivation (finalAttrs: {
   disallowedReferences = [ goBootstrap ];
 
   passthru = {
-    inherit goBootstrap skopeoTest;
-    tests = {
-      skopeo = testers.testVersion { package = skopeoTest; };
-      version = testers.testVersion {
-        package = finalAttrs.finalPackage;
-        command = "go version";
-        version = "go${finalAttrs.version}";
-      };
+    inherit goBootstrap;
+    tests = callPackage ./tests.nix {
+      go = finalAttrs.finalPackage;
+      buildGoModule = buildGo124Module;
     };
   };
 
diff --git a/pkgs/development/compilers/go/1.25.nix b/pkgs/development/compilers/go/1.25.nix
index 20f8bc52a5338..e807f81f4ab71 100644
--- a/pkgs/development/compilers/go/1.25.nix
+++ b/pkgs/development/compilers/go/1.25.nix
@@ -10,57 +10,26 @@
   pkgsBuildTarget,
   targetPackages,
   # for testing
-  testers,
-  runCommand,
-  bintools,
-  skopeo,
-  clickhouse-backup,
   buildGo125Module,
+  callPackage,
 }:
 
 let
   goBootstrap = buildPackages.callPackage ./bootstrap122.nix { };
 
-  skopeoTest = skopeo.override { buildGoModule = buildGo125Module; };
-  clickhouse-backupTest = clickhouse-backup.override { buildGoModule = buildGo125Module; };
-
   # We need a target compiler which is still runnable at build time,
   # to handle the cross-building case where build != host == target
   targetCC = pkgsBuildTarget.targetPackages.stdenv.cc;
 
   isCross = stdenv.buildPlatform != stdenv.targetPlatform;
-
-  # go-default-pie.patch tries to enable position-independent codegen (PIE) only when the platform
-  # reports support (via BuildModeSupported(..., "pie", ...)).
-  #
-  # In order for buildmode=pie to work either Go's internal linker must know how
-  # to produce position-independent executables or Go must be using an external linker.
-  #
-  # That probe is not fully reliable: for example, `pkgsi686Linux.go` can fail during bootstrap
-  # with message 'default PIE binary requires external (cgo) linking, but cgo is not enabled'
-  # despite CGO being enabled. (we set `CGO_ENABLED=1`).
-  #
-  # To avoid such breakage, limit this patch to a small set of explicitly tested platforms
-  # rather than relying on the general BuildModeSupported("pie") check.
-  supportsDefaultPie =
-    let
-      hasPie = {
-        "amd64" = true;
-        "arm64" = true;
-        "ppc64le" = true;
-        "riscv64" = true;
-      };
-    in
-    hasPie.${stdenv.hostPlatform.go.GOARCH} or false
-    && hasPie.${stdenv.targetPlatform.go.GOARCH} or false;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.25.3";
+  version = "1.25.4";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-qBpLpZPQAV4QxR4mfeP/B8eskU38oDfZUX0ClRcJd5U=";
+    hash = "sha256-FgBDt/F7bWC1A2lDaRf9qNUDRkC6Oa4kMca5WoicyYw=";
   };
 
   strictDeps = true;
@@ -94,11 +63,6 @@ stdenv.mkDerivation (finalAttrs: {
     ./remove-tools-1.11.patch
     ./go_no_vendor_checks-1.23.patch
     ./go-env-go_ldso.patch
-  ]
-  ++ lib.optionals supportsDefaultPie [
-    (replaceVars ./go-default-pie.patch {
-      inherit (stdenv.targetPlatform.go) GOARCH;
-    })
   ];
 
   inherit (stdenv.targetPlatform.go) GOOS GOARCH GOARM;
@@ -200,31 +164,10 @@ stdenv.mkDerivation (finalAttrs: {
   disallowedReferences = [ goBootstrap ];
 
   passthru = {
-    inherit goBootstrap skopeoTest;
-    tests = {
-      skopeo = testers.testVersion { package = skopeoTest; };
-      version = testers.testVersion {
-        package = finalAttrs.finalPackage;
-        command = "go version";
-        version = "go${finalAttrs.version}";
-      };
-      # Picked clickhouse-backup as a package that sets CGO_ENABLED=0
-      # Running and outputting the right version proves a working ELF interpreter was picked
-      clickhouse-backup = testers.testVersion { package = clickhouse-backupTest; };
-      clickhouse-backup-is-pie = runCommand "has-pie" { meta.broken = stdenv.hostPlatform.isStatic; } ''
-        ${lib.optionalString (!isCross) ''
-          if ${lib.getExe' bintools "readelf"} -p .comment ${lib.getExe clickhouse-backup} | grep -Fq "GCC: (GNU)"; then
-            echo "${lib.getExe clickhouse-backup} has a GCC .comment, but it should have used the internal go linker"
-            exit 1
-          fi
-        ''}
-        if ${lib.getExe' bintools "readelf"} -h ${lib.getExe clickhouse-backup} | grep -q "Type:.*DYN"; then
-          touch $out
-        else
-          echo "ERROR: clickhouse-backup is NOT PIE"
-          exit 1
-        fi
-      '';
+    inherit goBootstrap;
+    tests = callPackage ./tests.nix {
+      go = finalAttrs.finalPackage;
+      buildGoModule = buildGo125Module;
     };
   };
 
diff --git a/pkgs/development/compilers/go/go-default-pie.patch b/pkgs/development/compilers/go/go-default-pie.patch
deleted file mode 100644
index bce8d8dafd3de..0000000000000
--- a/pkgs/development/compilers/go/go-default-pie.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/src/internal/platform/supported.go b/src/internal/platform/supported.go
-index f9706a6988..abac42d550 100644
---- a/src/internal/platform/supported.go
-+++ b/src/internal/platform/supported.go
-@@ -249,7 +253,7 @@ func DefaultPIE(goos, goarch string, isRace bool) bool {
- 	case "darwin":
- 		return true
- 	}
--	return false
-+	return goarch == "@GOARCH@" && BuildModeSupported("gc", "pie", goos, goarch)
- }
- 
- // ExecutableHasDWARF reports whether the linked executable includes DWARF
diff --git a/pkgs/development/compilers/go/tests.nix b/pkgs/development/compilers/go/tests.nix
new file mode 100644
index 0000000000000..3eeaa8b53262c
--- /dev/null
+++ b/pkgs/development/compilers/go/tests.nix
@@ -0,0 +1,61 @@
+{
+  lib,
+  stdenv,
+  go,
+  buildGoModule,
+  # A package that relies on CGO
+  skopeo,
+  testers,
+  runCommand,
+  bintools,
+  # A package with CGO_ENABLED=0
+  athens,
+}:
+let
+  skopeo' = skopeo.override { buildGoModule = buildGoModule; };
+  athens' = athens.override { buildGoModule = buildGoModule; };
+  expectedCgoEnabledType = "DYN";
+  expectedCgoDisabledType = "EXE";
+in
+{
+  skopeo = testers.testVersion { package = skopeo'; };
+  version = testers.testVersion {
+    package = go;
+    command = "go version";
+    version = "go${go.version}";
+  };
+  athens = testers.testVersion { package = athens'; };
+}
+# bin type tests assume ELF file + linux-specific exe types
+// lib.optionalAttrs stdenv.hostPlatform.isLinux {
+  skopeo-bin-type = runCommand "skopeo-bin-type" { meta.broken = stdenv.hostPlatform.isStatic; } ''
+    bin="${lib.getExe' skopeo' ".skopeo-wrapped"}"
+    if ! ${lib.getExe' bintools "readelf"} -p .comment $bin | grep -Fq "GCC: (GNU)"; then
+      echo "${lib.getExe skopeo} should have been externally linked, but no GNU .comment section found"
+      exit 1
+    fi
+    if ${lib.getExe' bintools "readelf"} -h $bin | grep -q "Type:.*${expectedCgoEnabledType}"; then
+      touch $out
+    else
+      echo "ERROR: $bin is NOT ${expectedCgoEnabledType}"
+      exit 1
+    fi
+  '';
+  athens-bin-type = runCommand "athens-bin-type" { meta.broken = stdenv.hostPlatform.isStatic; } ''
+    bin="${lib.getExe athens'}"
+    ${lib.optionalString (stdenv.buildPlatform == stdenv.targetPlatform) ''
+      # For CGO_ENABLED=0 the internal linker should be used, except
+      # for cross where we rely on external linking by default
+      if ${lib.getExe' bintools "readelf"} -p .comment ${lib.getExe athens'} | grep -Fq "GCC: (GNU)"; then
+        echo "${lib.getExe athens'} has a GCC .comment, but it should have used the internal go linker"
+        exit 1
+      fi
+    ''}
+    if ${lib.getExe' bintools "readelf"} -h "$bin" | grep -q "Type:.*${expectedCgoDisabledType}"; then
+      touch $out
+    else
+      echo "ERROR: $bin is NOT ${expectedCgoDisabledType}"
+      exit 1
+    fi
+  '';
+}
diff --git a/pkgs/development/compilers/rust/1_90.nix b/pkgs/development/compilers/rust/1_91.nix
similarity index 51%
rename from pkgs/development/compilers/rust/1_90.nix
rename to pkgs/development/compilers/rust/1_91.nix
index 22124d21362be..a5fee800afa45 100644
--- a/pkgs/development/compilers/rust/1_90.nix
+++ b/pkgs/development/compilers/rust/1_91.nix
@@ -44,8 +44,8 @@ let
 in
 import ./default.nix
   {
-    rustcVersion = "1.90.0";
-    rustcSha256 = "sha256-eZqfnLpO1TUeBxBIvPa1VgdV2QCWSN7zOkB91JYfm34=";
+    rustcVersion = "1.91.1";
+    rustcSha256 = "sha256-ONziBdOfYVcSYfBEQjehzp7+y5cOdg2OxNlXr1tEVyM=";
 
     llvmSharedForBuild = llvmSharedFor pkgsBuildBuild;
     llvmSharedForHost = llvmSharedFor pkgsBuildHost;
@@ -59,30 +59,30 @@ import ./default.nix
     # Note: the version MUST be the same version that we are building. Upstream
     # ensures that each released compiler can compile itself:
     # https://github.com/NixOS/nixpkgs/pull/351028#issuecomment-2438244363
-    bootstrapVersion = "1.90.0";
+    bootstrapVersion = "1.91.1";
 
     # fetch hashes by running `print-hashes.sh ${bootstrapVersion}`
     bootstrapHashes = {
-      i686-unknown-linux-gnu = "8f389b9eb1513785f5589816b60b5a7ca3b24c29bedce7ec0d1c2f8c3ccfb0cc";
-      x86_64-unknown-linux-gnu = "e453bae1c68d02fe2eae065c5452d5731308164cd154154c6ee442d2fa590685";
-      x86_64-unknown-linux-musl = "251c9fe4e3374f2f9f629a7a83238c618e016b1bda1b9de5e8385cb3a6f057fa";
-      arm-unknown-linux-gnueabihf = "61f3987f61bf73562f04dcacfee1a2bad8d16d41f7a3f81ad82dd9b9cbc559ce";
-      armv7-unknown-linux-gnueabihf = "06cfb7f1bd3ce50480eed73ad9ae4f8f665d154fa4c713bc08541197eecd4ae0";
-      aarch64-unknown-linux-gnu = "293f412e3412c3aa3398c78ebbdf898fa08eacad80c85a7332ce1a455504c5fc";
-      aarch64-unknown-linux-musl = "b3ac31ca2e1a720709bf4fb678b2a2f98464c55662c516dfffcbdadd95a420c9";
-      x86_64-apple-darwin = "3d1d24e1d4bedb421ca1a16060c21f4d803eaefba585c0b5b5d0b1e56692ef4b";
-      aarch64-apple-darwin = "a11b52e34f5e80cb25d49f7943ae60e0b069b431727a4c09b2c890ceebee3687";
-      powerpc64-unknown-linux-gnu = "39720c905b8a730cfa725b7e201cd238d15c33112bd4c31b168ca6d1cb898cac";
-      powerpc64le-unknown-linux-gnu = "4061405099dc0aba379fe7b7a616d320272ef9325114dfa8f106c303f9b5695c";
-      powerpc64le-unknown-linux-musl = "0d97ef122126a0de87a8581f48ef85ff0887b733b429ffcec4651699b5444511";
-      riscv64gc-unknown-linux-gnu = "42cc3b3bb008e24a39bd98887c43ef32c2d997f801c86ca47f2119e5e3589fcb";
-      s390x-unknown-linux-gnu = "345c9b902ebee656533d2cfba39c1a020e6a41a4a9609f87430ff8a5d680d649";
-      loongarch64-unknown-linux-gnu = "1c116041a2bc7ab2697218f99ad8cccbe3d6b63fcbf516cb9d985cb00efcdb09";
-      loongarch64-unknown-linux-musl = "0ae18468c7cd3872d1b685cf960426aeb7467629f69eabb497bee6f0fff9cb04";
-      x86_64-unknown-freebsd = "6c7ebf6acbe00873680a190152d47aeebe76e237195b974c593a67227123b2ef";
+      i686-unknown-linux-gnu = "b596ac56c67cf893e58ecf3263e59ac10157e9f50047e8d3d84faf288273ea47";
+      x86_64-unknown-linux-gnu = "1c955c040dd087e4751d15588ddec288b4208bea16f8ec5046c164877e55fff7";
+      x86_64-unknown-linux-musl = "e690ea46a73b11268c0487a4bca440142d69de7c0ca062fcdf2b99ad0e42e8e5";
+      arm-unknown-linux-gnueabihf = "4899619845a875b2e51825943fad66cf42dced0e1f66470222ff0653776bd59e";
+      armv7-unknown-linux-gnueabihf = "c51a61f304c0019c57169b964ec26f7a7ff7dcefaf42b973237f96fb457b25c8";
+      aarch64-unknown-linux-gnu = "50213385f288b8760b2efd54ac066ef9a76475e778cbe3b0fcbd3f898fc00674";
+      aarch64-unknown-linux-musl = "d374258cd00b4069e44266ab58b321208187511606236ebcc791a5a2d86554e1";
+      x86_64-apple-darwin = "05adbd08e6535ed22a9c3d8f11d90df51eb6393488cbbb0c81f2b18d56e4d1ee";
+      aarch64-apple-darwin = "f6727c9ab64a5b2a15623f29a023faf0c6a6aeb1347d102b88d595e5c1d9beae";
+      powerpc64-unknown-linux-gnu = "94d86d13af288c4a06c8ea8b563e3889d55cc6064a06defd3b612eeeda902b93";
+      powerpc64le-unknown-linux-gnu = "355f8043cd506fa718892eeedeebc9d6cc3de1a7757fdb8385c7bdc4cbc853ac";
+      powerpc64le-unknown-linux-musl = "c17d51f54c00a371fbab80519b454a901a4b36b9f5a3a692e8816480d8f87067";
+      riscv64gc-unknown-linux-gnu = "08230d9c59105270b2e06c5e87078a2a478efcacef8a88aedcccca9f317fa492";
+      s390x-unknown-linux-gnu = "fb87330d72636d30f0a9b4b640f994186fc3ad0c0f3c89b2e0f7f31cfd7885f6";
+      loongarch64-unknown-linux-gnu = "be6f676ae2ad80d4242798429915f708e3ecae7c895936c5fee172a4f7f2eec8";
+      loongarch64-unknown-linux-musl = "7b071bc98d1e42dd802cc5b5bb83a9467d02ad6621231363519c869d322dcd5f";
+      x86_64-unknown-freebsd = "9e231fa573b6bb99654a689687aede2014d4c21ac3c8422534c990c859632f50";
     };
 
-    selectRustPackage = pkgs: pkgs.rust_1_90;
+    selectRustPackage = pkgs: pkgs.rust_1_91;
   }
 
   (
diff --git a/pkgs/development/compilers/rust/rustc.nix b/pkgs/development/compilers/rust/rustc.nix
index 9bb69eb243bb6..d2364f7aa533b 100644
--- a/pkgs/development/compilers/rust/rustc.nix
+++ b/pkgs/development/compilers/rust/rustc.nix
@@ -62,12 +62,6 @@ stdenv.mkDerivation (finalAttrs: {
     passthru.isReleaseTarball = true;
   };
 
-  hardeningDisable = optionals stdenv.cc.isClang [
-    # remove once https://github.com/NixOS/nixpkgs/issues/318674 is
-    # addressed properly
-    "zerocallusedregs"
-  ];
-
   __darwinAllowLocalNetworking = true;
 
   # rustc complains about modified source files otherwise
@@ -238,6 +232,11 @@ stdenv.mkDerivation (finalAttrs: {
       # doesn't work) to build a linker.
       "--disable-llvm-bitcode-linker"
     ]
+    ++ optionals (!fastCross && stdenv.targetPlatform.config != "wasm32-unknown-none") [
+      # See https://github.com/rust-lang/rust/issues/132802
+      "--set=target.wasm32-unknown-unknown.optimized-compiler-builtins=false"
+      "--set=target.wasm32v1-none.optimized-compiler-builtins=false"
+    ]
     ++ optionals (stdenv.targetPlatform.isLinux && !(stdenv.targetPlatform.useLLVM or false)) [
       "--enable-profiler" # build libprofiler_builtins
     ]
@@ -281,12 +280,13 @@ stdenv.mkDerivation (finalAttrs: {
       ''
         runHook preBuild
 
-        mkdir -p build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-{std,rustc}/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/
+        mkdir -p build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage{0,1}-{std,rustc}/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/
         ln -s ${rustc.unwrapped}/lib/rustlib/${stdenv.hostPlatform.rust.rustcTargetSpec}/libstd-*.so build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-std/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/libstd.so
         ln -s ${rustc.unwrapped}/lib/rustlib/${stdenv.hostPlatform.rust.rustcTargetSpec}/librustc_driver-*.so build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-rustc/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/librustc.so
         ln -s ${rustc.unwrapped}/bin/rustc build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-rustc/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/rustc-main
+        ln -s ${rustc.unwrapped}/bin/rustc build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage1-rustc/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/rustc-main
         touch build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-std/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/.libstd-stamp
-        touch build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage0-rustc/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/.librustc-stamp
+        touch build/${stdenv.hostPlatform.rust.rustcTargetSpec}/stage{0,1}-rustc/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/.librustc-stamp
         python ./x.py --keep-stage=0 --stage=1 build library
 
         runHook postBuild
diff --git a/pkgs/development/compilers/sbcl/default.nix b/pkgs/development/compilers/sbcl/default.nix
index 29345c0b43940..24bfe176570c5 100644
--- a/pkgs/development/compilers/sbcl/default.nix
+++ b/pkgs/development/compilers/sbcl/default.nix
@@ -30,8 +30,8 @@ let
     "2.4.10".sha256 = "sha256-zus5a2nSkT7uBIQcKva+ylw0LOFGTD/j5FPy3hDF4vg=";
     # By unofficial and very loose convention we keep the latest version of
     # SBCL, and the previous one in case someone quickly needs to roll back.
-    "2.5.7".sha256 = "sha256-xPr+t5VpnVvP+QhQkazHYtz15V+FI1Yl89eu8SyJ0dM=";
     "2.5.9".sha256 = "sha256-0bGQItQ9xJPtyXK25ZyTrmaEyWP90rQTsJZeGM1r0eI=";
+    "2.5.10".sha256 = "sha256-v1+0nypC82s+AD0uTSNDhq3fB9ndjKhjRlaSfMls4SU=";
   };
   # Collection of pre-built SBCL binaries for platforms that need them for
   # bootstrapping. Ideally these are to be avoided.  If ECL (or any other
diff --git a/pkgs/development/interpreters/guile/3.0.nix b/pkgs/development/interpreters/guile/3.0.nix
index d3bf1518868ca..979c1acb56715 100644
--- a/pkgs/development/interpreters/guile/3.0.nix
+++ b/pkgs/development/interpreters/guile/3.0.nix
@@ -126,6 +126,9 @@ builder rec {
   #  https://github.com/NixOS/nixpkgs/pull/160051#issuecomment-1046193028
   ++ lib.optional (stdenv.hostPlatform.isDarwin) "--disable-lto";
 
+  # Fix build with gcc15
+  env.NIX_CFLAGS_COMPILE = toString [ "-std=gnu17" ];
+
   postInstall = ''
     wrapProgram $out/bin/guile-snarf --prefix PATH : "${gawk}/bin"
   ''
diff --git a/pkgs/development/interpreters/spidermonkey/140.nix b/pkgs/development/interpreters/spidermonkey/140.nix
index af269d60324a1..862aa494d2404 100644
--- a/pkgs/development/interpreters/spidermonkey/140.nix
+++ b/pkgs/development/interpreters/spidermonkey/140.nix
@@ -1,4 +1,4 @@
 import ./common.nix {
-  version = "140.4.0";
-  hash = "sha512-z84L3PbUWZx7lrzNn9E5C/s2RduSdqNpowdgzmgZhQqqQlGGnmvTxdhYLqNyi5IHYsXxb3zhLOFRw+dDJ7jIEQ==";
+  version = "140.5.0";
+  hash = "sha512-QSI2oly+oXG9W9U15Fw7pAlXqU4fjdOrdCQeCqHEB1/LjTlLlhlZnWDOPkVj5xLIJfqL7EQXlPIpNWgC9ysoYQ==";
 }
diff --git a/pkgs/development/libraries/gdk-pixbuf/default.nix b/pkgs/development/libraries/gdk-pixbuf/default.nix
index 9ae7a4c31133c..f62230c7649e0 100644
--- a/pkgs/development/libraries/gdk-pixbuf/default.nix
+++ b/pkgs/development/libraries/gdk-pixbuf/default.nix
@@ -28,7 +28,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gdk-pixbuf";
-  version = "2.44.3";
+  version = "2.44.4";
 
   outputs = [
     "out"
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     in
     fetchurl {
       url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-      hash = "sha256-QKktzCN/+UtjqAwVmj9vIs1Z9vtJYfIBx4eZ+iyKwKY=";
+      hash = "sha256-k6Gqw/FCeuc0Vzl1gqLDjQSWOKgBeIzL1fSMpge9vRc=";
     };
 
   patches = [
diff --git a/pkgs/development/libraries/gtk/4.x.nix b/pkgs/development/libraries/gtk/4.x.nix
index 9b5a9daaa063f..9522692b4b564 100644
--- a/pkgs/development/libraries/gtk/4.x.nix
+++ b/pkgs/development/libraries/gtk/4.x.nix
@@ -4,6 +4,7 @@
   buildPackages,
   replaceVars,
   fetchurl,
+  fetchpatch,
   pkg-config,
   docutils,
   gettext,
@@ -69,7 +70,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gtk4";
-  version = "4.20.2";
+  version = "4.20.3";
 
   outputs = [
     "out"
@@ -85,9 +86,15 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk/${lib.versions.majorMinor finalAttrs.version}/gtk-${finalAttrs.version}.tar.xz";
-    hash = "sha256-XoJA7eyvr/K4uvRmO9zqpmjvEKIHvuTX+Q4BDhC93Fw=";
+    hash = "sha256-KHPykDCIpmxxFz6i7YX/riZqZrlyw6SEK7svbxh+wVM=";
   };
 
+  # TODO: make it unconditional on rebuild, drop on version >= 4.20.4
+  patches = lib.optional stdenv.hostPlatform.is32bit (fetchpatch {
+    url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/3b7ed49f26700c65fa9c6f41cf40d4fd5f921756.diff";
+    hash = "sha256-P6cE7fnR5W+H0EWQWJ3hYSu4MwMygPIfS6e0IiXlQv8=";
+  });
+
   depsBuildBuild = [
     pkg-config
   ];
diff --git a/pkgs/development/libraries/libxcrypt/default.nix b/pkgs/development/libraries/libxcrypt/default.nix
index b848ace3879dd..075c25104dc2d 100644
--- a/pkgs/development/libraries/libxcrypt/default.nix
+++ b/pkgs/development/libraries/libxcrypt/default.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libxcrypt";
-  version = "4.4.38";
+  version = "4.5.2";
 
   src = fetchurl {
     url = "https://github.com/besser82/libxcrypt/releases/download/v${finalAttrs.version}/libxcrypt-${finalAttrs.version}.tar.xz";
-    hash = "sha256-gDBLnDBup5kyfwHZp1Sb2ygxd4kYJjHxtU9FEbQgbdY=";
+    hash = "sha256-cVE6McAaQovM1TZ6Mv2V8RXW2sUPtbYMd51ceUKuwHE=";
   };
 
   # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion
@@ -78,9 +78,10 @@ stdenv.mkDerivation (finalAttrs: {
       '';
     };
     enabledCryptSchemeIds = [
-      # https://github.com/besser82/libxcrypt/blob/v4.4.35/lib/hashes.conf
+      # https://github.com/besser82/libxcrypt/blob/v4.5.0/lib/hashes.conf
       "y" # yescrypt
       "gy" # gost_yescrypt
+      "sm3y" # sm3_yescrypt
       "7" # scrypt
       "2b" # bcrypt
       "2y" # bcrypt_y
diff --git a/pkgs/development/libraries/mbedtls/3.nix b/pkgs/development/libraries/mbedtls/3.nix
index 05793b55d0703..f9ddbfd83d821 100644
--- a/pkgs/development/libraries/mbedtls/3.nix
+++ b/pkgs/development/libraries/mbedtls/3.nix
@@ -1,8 +1,8 @@
 { callPackage, fetchurl }:
 
 callPackage ./generic.nix {
-  version = "3.6.4";
-  hash = "sha256-y5YqKtjW4IXyIZkoJvwCGC4scx0qdeV40rynHza4NUE=";
+  version = "3.6.5";
+  hash = "sha256-CAMksh7i4mg5zVTYLB/SZWFVmgQBMhPnislLCD9j7+o=";
 
   patches = [
     # Fixes the build with GCC 14 on aarch64.
diff --git a/pkgs/development/libraries/ncurses/default.nix b/pkgs/development/libraries/ncurses/default.nix
index 16ee5939891d7..39e73047f2bd8 100644
--- a/pkgs/development/libraries/ncurses/default.nix
+++ b/pkgs/development/libraries/ncurses/default.nix
@@ -65,7 +65,8 @@ stdenv.mkDerivation (finalAttrs: {
     "--with-versioned-syms"
   ]
   ++ lib.optional (!finalAttrs.separateDebugInfo) "--without-debug"
-  ++ lib.optional unicodeSupport "--enable-widec"
+  ++ lib.optional (unicodeSupport && abiVersion == "5") "--enable-widec"
+  ++ lib.optional (!unicodeSupport && abiVersion == "6") "--disable-widec"
   ++ lib.optional (!withCxx) "--without-cxx"
   ++ lib.optional (abiVersion == "5") "--with-abi-version=5"
   ++ lib.optional stdenv.hostPlatform.isNetBSD "--enable-rpath"
diff --git a/pkgs/development/libraries/ngtcp2/default.nix b/pkgs/development/libraries/ngtcp2/default.nix
index 49a2f417a0d54..cef563d99f7af 100644
--- a/pkgs/development/libraries/ngtcp2/default.nix
+++ b/pkgs/development/libraries/ngtcp2/default.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ngtcp2";
-  version = "1.15.1";
+  version = "1.17.0";
 
   src = fetchurl {
     url = "https://github.com/ngtcp2/ngtcp2/releases/download/v${finalAttrs.version}/ngtcp2-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-Bbf6cvldAd3fvDVuHL89VPx1h1wvY2CGW5gIsDNM75c=";
+    hash = "sha256-j8hYGdFp5il4pODbNlVILOdJUafqsMdmc3tXoxQY2mE=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index a44697a89dfb0..9451668a58371 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchurl,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   pkg-config,
   unzip,
@@ -58,7 +59,7 @@
   enableVtk ? false,
   vtk,
   enableFfmpeg ? true,
-  ffmpeg_7,
+  ffmpeg,
   enableGStreamer ? true,
   elfutils,
   gst_all_1,
@@ -299,6 +300,16 @@ effectiveStdenv.mkDerivation {
   patches = [
     ./cmake-don-t-use-OpenCVFindOpenEXR.patch
     ./0001-cmake-OpenCVUtils.cmake-invalidate-Nix-store-paths-b.patch
+    (fetchpatch {
+      name = "ffmpeg-8-support.patch";
+      url = "https://github.com/opencv/opencv/commit/90c444abd387ffa70b2e72a34922903a2f0f4f5a.patch";
+      hash = "sha256-iRRparDJoNhrvELH6cAagWcVzpiE2lfivHVxvZyi3ik=";
+    })
+    (fetchpatch {
+      name = "fix-ffmpeg-8-support.patch";
+      url = "https://github.com/opencv/opencv/commit/dbb622b7f59c3f0e5bd3487252ef37cf72dcdcdb.patch";
+      hash = "sha256-MS9WizZQu0Gxw/daDDFmETxcDJYRTyhSq/xK0X5lAZM=";
+    })
   ]
   ++ optionals enableCuda [
     ./cuda_opt_flow.patch
@@ -365,7 +376,7 @@ effectiveStdenv.mkDerivation {
     openjpeg
   ]
   ++ optionals enableFfmpeg [
-    ffmpeg_7
+    ffmpeg
   ]
   ++ optionals (enableGStreamer && effectiveStdenv.hostPlatform.isLinux) [
     elfutils
diff --git a/pkgs/development/libraries/protobuf/33.nix b/pkgs/development/libraries/protobuf/33.nix
index 24ace1256005f..6365e5fac5a59 100644
--- a/pkgs/development/libraries/protobuf/33.nix
+++ b/pkgs/development/libraries/protobuf/33.nix
@@ -2,8 +2,8 @@
 
 callPackage ./generic.nix (
   {
-    version = "33.0";
-    hash = "sha256-VoMMMyPGAyjhXrYw7muHFBRjYshfqgLZZPPOXCfmmPs=";
+    version = "33.1";
+    hash = "sha256-IW6wLkr/NwIZy5N8s+7Fe9CSexXgliW8QSlvmUD+g5Q=";
   }
   // args
 )
diff --git a/pkgs/development/libraries/spandsp/default.nix b/pkgs/development/libraries/spandsp/default.nix
index 87996abdeeb0a..0a06b112e4c2d 100644
--- a/pkgs/development/libraries/spandsp/default.nix
+++ b/pkgs/development/libraries/spandsp/default.nix
@@ -2,8 +2,6 @@
   fetchurl,
   fetchpatch,
   callPackage,
-  lib,
-  stdenv,
 }:
 
 (callPackage ./common.nix { }) rec {
@@ -13,31 +11,14 @@
     sha256 = "0rclrkyspzk575v8fslzjpgp4y2s4x7xk3r55ycvpi4agv33l1fc";
   };
   patches = [
-    # FIXME: clean up rebuild avoidance on staging.
-    (
-      if
-        lib.elem stdenv.hostPlatform.config [
-          "arm64-apple-darwin"
-          "aarch64-unknown-linux-gnu"
-          "x86_64-apple-darwin"
-          "x86_64-unknown-linux-gnu"
-        ]
-      then
-        fetchpatch {
-          url = "https://github.com/freeswitch/spandsp/commit/f7b96b08db148763039cf3459d0e00da9636eb92.patch";
-          includes = [ "spandsp-sim/g1050.c" ];
-          hash = "sha256-TwMhWJXQG/UaWddWgice0klp1uATyHMiE6DcsCebXYQ=";
-        }
-      else
-        fetchpatch {
-          url = "https://github.com/freeswitch/spandsp/commit/f7b96b08db148763039cf3459d0e00da9636eb92.patch";
-          includes = [
-            "spandsp-sim/g1050.c"
-            "spandsp-sim/test_utils.c"
-          ];
-          hash = "sha256-2MmVgyMUK0Zn+mL7IX57Y7brYpgmt4GVlis5/NstuNM=";
-        }
-    )
+    (fetchpatch {
+      url = "https://github.com/freeswitch/spandsp/commit/f7b96b08db148763039cf3459d0e00da9636eb92.patch";
+      includes = [
+        "spandsp-sim/g1050.c"
+        "spandsp-sim/test_utils.c"
+      ];
+      hash = "sha256-2MmVgyMUK0Zn+mL7IX57Y7brYpgmt4GVlis5/NstuNM=";
+    })
     (fetchpatch {
       url = "https://github.com/freeswitch/spandsp/commit/f47bcdc301fbddad44e918939eed1b361882f740.patch";
       hash = "sha256-O+lIC3V92GVFoiHsUQOXkoTN2hJ7v5+LQP7RrAhvwlY=";
diff --git a/pkgs/development/python-modules/brotli/default.nix b/pkgs/development/python-modules/brotli/default.nix
index ea4b5c43a4552..fb78ead78779e 100644
--- a/pkgs/development/python-modules/brotli/default.nix
+++ b/pkgs/development/python-modules/brotli/default.nix
@@ -1,38 +1,50 @@
 {
   lib,
+  brotli,
   buildPythonPackage,
   fetchFromGitHub,
+  pkgconfig,
   pytestCheckHook,
   setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "brotli";
-  version = "1.1.0";
+  version = "1.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "brotli";
     tag = "v${version}";
-    hash = "sha256-U1vAupUthD5W0xvlOKdgm9MAVLqsVyZUaFdeLsDAbDM=";
+    hash = "sha256-ePfllKdY12hOPuO9uHuXFZ3Bdib6BLD4ghiaeurJZ28=";
     # .gitattributes is not correct or GitHub does not parse it correct and the archive is missing the test data
     forceFetchGit = true;
   };
 
-  build-system = [ setuptools ];
+  build-system = [
+    pkgconfig
+    setuptools
+  ];
 
   # only returns information how to really build
   dontConfigure = true;
 
+  env.USE_SYSTEM_BROTLI = 1;
+
+  buildInputs = [
+    brotli
+  ];
+
   nativeCheckInputs = [ pytestCheckHook ];
 
   enabledTestPaths = [ "python/tests" ];
 
-  meta = with lib; {
+  meta = {
+    changelog = "https://github.com/google/brotli/blob/${src.tag}/CHANGELOG.md";
     homepage = "https://github.com/google/brotli";
     description = "Generic-purpose lossless compression algorithm";
-    license = licenses.mit;
+    license = lib.licenses.mit;
     maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/click/default.nix b/pkgs/development/python-modules/click/default.nix
index e028343fbb656..368589cac6ef0 100644
--- a/pkgs/development/python-modules/click/default.nix
+++ b/pkgs/development/python-modules/click/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
   importlib-metadata,
   pytestCheckHook,
 
@@ -26,6 +27,15 @@ buildPythonPackage rec {
     hash = "sha256-3FfLKwpfkiGfY2+H2fQoZwLBqfPlV46xw2Bc4YEsyps=";
   };
 
+  patches = [
+    # https://github.com/pallets/click/pull/2940
+    (fetchpatch {
+      name = "fix-SystemExit-when-using-stdin.patch";
+      url = "https://github.com/pallets/click/commit/93c6966eb3a575c2b600434d1cc9f4b3aee505ac.patch";
+      hash = "sha256-DkVF0JnKbcsdAhgVjWJEDZZ8vr2sf6wba8P3SyRUy6o=";
+    })
+  ];
+
   build-system = [ flit-core ];
 
   nativeCheckInputs = [ pytestCheckHook ];
diff --git a/pkgs/development/python-modules/fonttools/default.nix b/pkgs/development/python-modules/fonttools/default.nix
index 65f72e01e9193..056c4d8df771f 100644
--- a/pkgs/development/python-modules/fonttools/default.nix
+++ b/pkgs/development/python-modules/fonttools/default.nix
@@ -21,7 +21,7 @@
   xattr,
   skia-pathops,
   uharfbuzz,
-  pytest7CheckHook,
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
@@ -29,8 +29,6 @@ buildPythonPackage rec {
   version = "4.60.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
   src = fetchFromGitHub {
     owner = "fonttools";
     repo = "fonttools";
@@ -68,9 +66,7 @@ buildPythonPackage rec {
     extras // { all = lib.concatLists (lib.attrValues extras); };
 
   nativeCheckInputs = [
-    # test suite fails with pytest>=8.0.1
-    # https://github.com/fonttools/fonttools/issues/3458
-    pytest7CheckHook
+    pytestCheckHook
   ]
   ++ lib.concatLists (
     lib.attrVals (
diff --git a/pkgs/development/python-modules/mitmproxy/default.nix b/pkgs/development/python-modules/mitmproxy/default.nix
index f0ce75afc2079..78cc884abc32d 100644
--- a/pkgs/development/python-modules/mitmproxy/default.nix
+++ b/pkgs/development/python-modules/mitmproxy/default.nix
@@ -18,6 +18,7 @@
   ldap3,
   mitmproxy-rs,
   msgpack,
+  nixosTests,
   publicsuffix2,
   pyopenssl,
   pyparsing,
@@ -50,6 +51,7 @@ buildPythonPackage rec {
 
   pythonRelaxDeps = [
     "bcrypt"
+    "brotli"
     "cryptography"
     "flask"
     "h2"
@@ -146,6 +148,10 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "mitmproxy" ];
 
+  passthru.tests = {
+    inherit (nixosTests) mitmproxy;
+  };
+
   meta = with lib; {
     description = "Man-in-the-middle proxy";
     homepage = "https://mitmproxy.org/";
diff --git a/pkgs/development/python-modules/mmengine/default.nix b/pkgs/development/python-modules/mmengine/default.nix
index 0217e140b77ba..5a0a50a8bc200 100644
--- a/pkgs/development/python-modules/mmengine/default.nix
+++ b/pkgs/development/python-modules/mmengine/default.nix
@@ -21,7 +21,6 @@
 
   # tests
   bitsandbytes,
-  coverage,
   dvclive,
   lion-pytorch,
   lmdb,
@@ -89,7 +88,6 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     bitsandbytes
-    coverage
     dvclive
     lion-pytorch
     lmdb
diff --git a/pkgs/development/python-modules/narwhals/default.nix b/pkgs/development/python-modules/narwhals/default.nix
index a33dad2029489..049411653ca09 100644
--- a/pkgs/development/python-modules/narwhals/default.nix
+++ b/pkgs/development/python-modules/narwhals/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   dask,
   duckdb,
@@ -82,6 +83,11 @@ buildPythonPackage rec {
     "test_collect_empty"
   ];
 
+  disabledTestPaths = lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
+    # Segfault in included polars/lazyframe
+    "tests/tpch_q1_test.py"
+  ];
+
   pytestFlags = [
     "-Wignore::DeprecationWarning"
   ];
diff --git a/pkgs/development/python-modules/pikepdf/default.nix b/pkgs/development/python-modules/pikepdf/default.nix
index 8227e6c2e080e..4c636e8e40ea0 100644
--- a/pkgs/development/python-modules/pikepdf/default.nix
+++ b/pkgs/development/python-modules/pikepdf/default.nix
@@ -25,7 +25,7 @@
 
 buildPythonPackage rec {
   pname = "pikepdf";
-  version = "10.0.0";
+  version = "10.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-DiNRjN4tnADaFOxLV9wdvJe9KEOb+h9IOSzaPGtGuk0=";
+    hash = "sha256-ncWgIcQp6/GOrNwIvwJ4nvf+SUfr0N53MXYq9LpfiB4=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/prompt-toolkit/default.nix b/pkgs/development/python-modules/prompt-toolkit/default.nix
index b88ff4b53babb..e1ad037553620 100644
--- a/pkgs/development/python-modules/prompt-toolkit/default.nix
+++ b/pkgs/development/python-modules/prompt-toolkit/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   pytestCheckHook,
   setuptools,
   wcwidth,
@@ -12,10 +12,11 @@ buildPythonPackage rec {
   version = "3.0.52";
   pyproject = true;
 
-  src = fetchPypi {
-    pname = "prompt_toolkit";
-    inherit version;
-    hash = "sha256-KM3hkpKcjnMh3oXeHdvnNvE3UUiwLy4X7dhABCsb6FU=";
+  src = fetchFromGitHub {
+    owner = "prompt-toolkit";
+    repo = "python-prompt-toolkit";
+    tag = version;
+    hash = "sha256-ggCy7xTvOkjy6DgsO/rPNtQiAQ4FjsK4ShrvkIHioNQ=";
   };
 
   postPatch = ''
@@ -47,8 +48,8 @@ buildPythonPackage rec {
       with a nice interactive Python shell (called ptpython) built on top.
     '';
     homepage = "https://github.com/jonathanslenders/python-prompt-toolkit";
-    changelog = "https://github.com/prompt-toolkit/python-prompt-toolkit/blob/${version}/CHANGELOG";
+    changelog = "https://github.com/prompt-toolkit/python-prompt-toolkit/releases/tag/${src.tag}";
     license = licenses.bsd3;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ sarahec ];
   };
 }
diff --git a/pkgs/development/python-modules/protobuf/6.nix b/pkgs/development/python-modules/protobuf/6.nix
index f5ce6a82e7166..bba5b5da6dacb 100644
--- a/pkgs/development/python-modules/protobuf/6.nix
+++ b/pkgs/development/python-modules/protobuf/6.nix
@@ -9,12 +9,12 @@
 
 buildPythonPackage rec {
   pname = "protobuf";
-  version = "6.33.0";
+  version = "6.33.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-FAMD1cjSA3cwxUj4x7k7ILsdwwG+KAw3i4K4iUWJyVQ=";
+    hash = "sha256-l/ZXV+jQmHDeb9lzrt25L4VDVgcjXSCy3+2TQF0AyFs=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pycurl/default.nix b/pkgs/development/python-modules/pycurl/default.nix
index beac9451932a5..224a3f9ebe6f8 100644
--- a/pkgs/development/python-modules/pycurl/default.nix
+++ b/pkgs/development/python-modules/pycurl/default.nix
@@ -34,6 +34,13 @@ buildPythonPackage rec {
       url = "https://github.com/pycurl/pycurl/commit/eb7f52eeef85feb6c117678d52803050bbdd7bc8.patch";
       hash = "sha256-hdwazS7R9duuMd/7S3SNAxVcToo3GhtyWu/1Q6qTMYc=";
     })
+    # curl 8.17+ compatibility
+    # https://github.com/pycurl/pycurl/pull/909
+    (fetchpatch {
+      name = "pycurl-8.17.0-compat.patch";
+      url = "https://github.com/pycurl/pycurl/commit/ea92e3ca230a3ff3d464cb6816102fa157177aca.patch";
+      hash = "sha256-kmlsG0SFfS9FdRNp8pPgudcWK6hSyD9x5oAedZLgBcY=";
+    })
   ];
 
   preConfigure = ''
diff --git a/pkgs/development/python-modules/pygobject/3.nix b/pkgs/development/python-modules/pygobject/3.nix
index 9825af96472eb..c058a77b461a4 100644
--- a/pkgs/development/python-modules/pygobject/3.nix
+++ b/pkgs/development/python-modules/pygobject/3.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "pygobject";
-  version = "3.54.3";
+  version = "3.54.5";
 
   outputs = [
     "out"
@@ -30,8 +30,8 @@ buildPythonPackage rec {
   format = "other";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.gz";
-    hash = "sha256-qNoJE0oPfVZJHPJBIUXjWqdOkddg6PM3CWoc2guSuuc=";
+    url = "mirror://gnome/sources/pygobject/${lib.versions.majorMinor version}/pygobject-${version}.tar.gz";
+    hash = "sha256-tmVvY0j1JFYGzxXqSMOEx/BRVsderSBsGyRsgKIvtYU=";
   };
 
   depsBuildBuild = [ pkg-config ];
@@ -63,8 +63,8 @@ buildPythonPackage rec {
 
   passthru = {
     updateScript = gnome.updateScript {
-      packageName = pname;
-      attrPath = "python3.pkgs.${pname}3";
+      packageName = "pygobject";
+      attrPath = "python3.pkgs.pygobject3";
       versionPolicy = "odd-unstable";
     };
   };
diff --git a/pkgs/development/python-modules/regex/default.nix b/pkgs/development/python-modules/regex/default.nix
index 4ca491e0e0766..7a581c682ceb7 100644
--- a/pkgs/development/python-modules/regex/default.nix
+++ b/pkgs/development/python-modules/regex/default.nix
@@ -1,19 +1,24 @@
 {
-  lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
+  lib,
   python,
   setuptools,
 }:
 
-buildPythonPackage rec {
-  pname = "regex";
+let
   version = "2025.9.18";
+in
+buildPythonPackage {
+  pname = "regex";
+  inherit version;
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-xbojJ0xhxv70R7pqOTMyl9DCR/UwWdugvKQVysUR7cQ=";
+  src = fetchFromGitHub {
+    owner = "mrabarnett";
+    repo = "mrab-regex";
+    tag = version;
+    hash = "sha256-s/jaRbQffd1DmGribk8gwTraKEhWfvFZboWXUduhM8A=";
   };
 
   build-system = [ setuptools ];
@@ -24,13 +29,13 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "regex" ];
 
-  meta = with lib; {
+  meta = {
     description = "Alternative regular expression module, to replace re";
     homepage = "https://github.com/mrabarnett/mrab-regex";
     license = [
-      licenses.asl20
-      licenses.cnri-python
+      lib.licenses.asl20
+      lib.licenses.cnri-python
     ];
-    maintainers = with lib.maintainers; [ dwoffinden ];
+    maintainers = [ lib.maintainers.dwoffinden ];
   };
 }
diff --git a/pkgs/development/python-modules/scipy/default.nix b/pkgs/development/python-modules/scipy/default.nix
index 663389069579d..16ae631686e4f 100644
--- a/pkgs/development/python-modules/scipy/default.nix
+++ b/pkgs/development/python-modules/scipy/default.nix
@@ -50,8 +50,8 @@ let
   #     nix-shell maintainers/scripts/update.nix --argstr package python3.pkgs.scipy
   #
   # The update script uses sed regexes to replace them with the updated hashes.
-  version = "1.16.2";
-  srcHash = "sha256-vWXJyLvOqCC5jwDawWHF6K2GVU2gnvW4a85lF/6tVYg=";
+  version = "1.16.3";
+  srcHash = "sha256-2NVmsJqsUjWSD7oEJhRkRjbKvqwikBJenAhBio/+IuU=";
   datasetsHashes = {
     ascent = "1qjp35ncrniq9rhzb14icwwykqg2208hcssznn3hz27w39615kh3";
     ecg = "1bwbjp43b7znnwha5hv6wiz3g0bhwrpqpi75s12zidxrbwvd62pj";
diff --git a/pkgs/development/python-modules/swh-core/default.nix b/pkgs/development/python-modules/swh-core/default.nix
index 3ce0191925f69..940cf4980cd88 100644
--- a/pkgs/development/python-modules/swh-core/default.nix
+++ b/pkgs/development/python-modules/swh-core/default.nix
@@ -18,6 +18,7 @@
   hypothesis,
   iso8601,
   lzip,
+  moto,
   msgpack,
   postgresql,
   postgresqlTestHook,
@@ -29,7 +30,9 @@
   pytest-postgresql,
   pytz,
   requests-mock,
+  swh-model,
   systemd-python,
+  tqdm,
   types-deprecated,
   types-psycopg2,
   types-pytz,
@@ -41,7 +44,7 @@
 
 buildPythonPackage rec {
   pname = "swh-core";
-  version = "4.5.2";
+  version = "4.6.0";
   pyproject = true;
 
   src = fetchFromGitLab {
@@ -50,7 +53,7 @@ buildPythonPackage rec {
     owner = "devel";
     repo = "swh-core";
     tag = "v${version}";
-    hash = "sha256-yNWij9GclQCysQe9Bukr4cHlZgSQqLAuX1KwGWzAK+0=";
+    hash = "sha256-dI+xfj0DnUbBdYIVycyJQg3B/jnH/eg/Ju8YX2k8Qkc=";
   };
 
   build-system = [
@@ -58,6 +61,11 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
+  pythonRelaxDeps = [
+    # we patched click 8.2.1
+    "click"
+  ];
+
   dependencies = [
     backports-entry-points-selectable
     click
@@ -79,6 +87,7 @@ buildPythonPackage rec {
     hypothesis
     iso8601
     lzip
+    moto
     msgpack
     postgresql
     postgresqlTestHook
@@ -90,7 +99,9 @@ buildPythonPackage rec {
     pytest-postgresql
     pytz
     requests-mock
+    swh-model
     systemd-python
+    tqdm
     types-deprecated
     types-psycopg2
     types-pytz
@@ -111,6 +122,7 @@ buildPythonPackage rec {
   ];
 
   meta = {
+    changelog = "https://gitlab.softwareheritage.org/swh/devel/swh-core/-/tags/${src.tag}";
     description = "Low-level utilities and helpers used by almost all other modules in the stack";
     homepage = "https://gitlab.softwareheritage.org/swh/devel/swh-core";
     license = lib.licenses.gpl3Only;
diff --git a/pkgs/development/python-modules/swh-objstorage/default.nix b/pkgs/development/python-modules/swh-objstorage/default.nix
index ee234b521c956..c8ca0dc87afda 100644
--- a/pkgs/development/python-modules/swh-objstorage/default.nix
+++ b/pkgs/development/python-modules/swh-objstorage/default.nix
@@ -18,7 +18,7 @@
   tenacity,
   swh-core,
   swh-model,
-  swh-perfecthash,
+  swh-shard,
   aiohttp,
   azure-core,
   azure-storage-blob,
@@ -40,7 +40,7 @@
 
 buildPythonPackage rec {
   pname = "swh-objstorage";
-  version = "4.0.0";
+  version = "5.1.0";
   pyproject = true;
 
   src = fetchFromGitLab {
@@ -49,7 +49,7 @@ buildPythonPackage rec {
     owner = "devel";
     repo = "swh-objstorage";
     tag = "v${version}";
-    hash = "sha256-c0ZH2PMT9DVnpTV5PDyX0Yw4iHiJSolEgq/bMXEwXG8=";
+    hash = "sha256-NnNT9Lt/LGDIJpUmfkfPn6JnF3k8Usf2UVa88zHPKlg=";
   };
 
   build-system = [
@@ -71,7 +71,7 @@ buildPythonPackage rec {
     tenacity
     swh-core
     swh-model
-    swh-perfecthash
+    swh-shard
   ];
 
   preCheck = ''
@@ -110,6 +110,7 @@ buildPythonPackage rec {
   ];
 
   meta = {
+    changelog = "https://gitlab.softwareheritage.org/swh/devel/swh-objstorage/-/tags/${src.tag}";
     description = "Content-addressable object storage for the Software Heritage project";
     homepage = "https://gitlab.softwareheritage.org/swh/devel/swh-objstorage";
     license = lib.licenses.gpl3Only;
diff --git a/pkgs/development/python-modules/swh-perfecthash/default.nix b/pkgs/development/python-modules/swh-perfecthash/default.nix
deleted file mode 100644
index ec3e2fa0e9086..0000000000000
--- a/pkgs/development/python-modules/swh-perfecthash/default.nix
+++ /dev/null
@@ -1,62 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitLab,
-  setuptools,
-  setuptools-scm,
-  cffi,
-  pytestCheckHook,
-  pytest-mock,
-  pkgs, # only for cmph
-}:
-
-buildPythonPackage rec {
-  pname = "swh-perfecthash";
-  version = "1.3.2";
-  pyproject = true;
-
-  src = fetchFromGitLab {
-    domain = "gitlab.softwareheritage.org";
-    group = "swh";
-    owner = "devel";
-    repo = "swh-perfecthash";
-    tag = "v${version}";
-    hash = "sha256-cG0h0lfSSooA7Mzrlsi5yIcbkbxQZ7mI5NtiB7D5Crs=";
-  };
-
-  build-system = [
-    setuptools
-    setuptools-scm
-  ];
-
-  dependencies = [
-    cffi
-    pkgs.cmph
-  ];
-
-  # The installed library clashes with the `swh` directory remaining in the source path.
-  # Usually, we get around this by `rm -rf` the python source files to ensure that the installed package is used.
-  # Here, we cannot do that as it would also remove the tests which are also in the `swh` directory.
-  preCheck = ''
-    rm -rf swh/perfecthash/*.py
-  '';
-
-  pythonImportsCheck = [ "swh.perfecthash" ];
-
-  nativeCheckInputs = [
-    pytestCheckHook
-    pytest-mock
-  ];
-
-  disabledTests = [
-    # Flake tests
-    "test_build_speed"
-  ];
-
-  meta = {
-    description = "Perfect hash table for software heritage object storage";
-    homepage = "https://gitlab.softwareheritage.org/swh/devel/swh-perfecthash";
-    license = lib.licenses.gpl3Only;
-    maintainers = [ ];
-  };
-}
diff --git a/pkgs/development/python-modules/swh-scanner/default.nix b/pkgs/development/python-modules/swh-scanner/default.nix
index 03fef49e98784..5dca94bb53d24 100644
--- a/pkgs/development/python-modules/swh-scanner/default.nix
+++ b/pkgs/development/python-modules/swh-scanner/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitLab,
-  fetchpatch,
   setuptools,
   setuptools-scm,
   requests,
@@ -36,15 +35,6 @@ buildPythonPackage rec {
     hash = "sha256-baUUuYFapBD7iuDaDP8CSR9f4glVZcS5qBpZddVf7z8=";
   };
 
-  patches = [
-    # To be removed at the next release
-    # See https://gitlab.softwareheritage.org/swh/devel/swh-scanner/-/merge_requests/160
-    (fetchpatch {
-      url = "https://gitlab.softwareheritage.org/swh/devel/swh-scanner/-/commit/0eb273475826b0074844c7619b767c052562cfe4.patch";
-      hash = "sha256-i3hpaQJmHpIYgix+/npICQGtJ/IKVRXcCTm2O1VsR9M=";
-    })
-  ];
-
   build-system = [
     setuptools
     setuptools-scm
@@ -78,11 +68,14 @@ buildPythonPackage rec {
   disabledTestPaths = [
     # pytestRemoveBytecodePhase fails with: "error (ignored): error: opening directory "/tmp/nix-build-python3.12-swh-scanner-0.8.3.drv-5/build/pytest-of-nixbld/pytest-0/test_randomdir_policy_info_cal0/big-directory/dir/dir/dir/ ......"
     "swh/scanner/tests/test_policy.py"
+    # TypeError: CliRunner.__init__() got an unexpected keyword argument 'mix_stderr'
+    "swh/scanner/tests/test_cli.py"
   ];
 
   meta = {
-    description = "Implementation of the Data model of the Software Heritage project, used to archive source code artifacts";
-    homepage = "https://gitlab.softwareheritage.org/swh/devel/swh-model";
+    changelog = "https://gitlab.softwareheritage.org/swh/devel/swh-scanner/-/tags/${src.tag}";
+    description = "Source code scanner to analyze code bases and compare them with source code artifacts archived by Software Heritage";
+    homepage = "https://gitlab.softwareheritage.org/swh/devel/swh-scanner";
     license = lib.licenses.gpl3Only;
     maintainers = [ ];
   };
diff --git a/pkgs/development/python-modules/swh-scheduler/default.nix b/pkgs/development/python-modules/swh-scheduler/default.nix
index ba2f4e10d1b3a..7bb37313ed3c5 100644
--- a/pkgs/development/python-modules/swh-scheduler/default.nix
+++ b/pkgs/development/python-modules/swh-scheduler/default.nix
@@ -30,7 +30,7 @@
 
 buildPythonPackage rec {
   pname = "swh-scheduler";
-  version = "3.1.0";
+  version = "3.3.0";
   pyproject = true;
 
   src = fetchFromGitLab {
@@ -39,7 +39,7 @@ buildPythonPackage rec {
     owner = "devel";
     repo = "swh-scheduler";
     tag = "v${version}";
-    hash = "sha256-YpMHeZVHK8IPIiuBaPNR0D/yB9lIQ3DK7NEAiBmjWpA=";
+    hash = "sha256-Kv5QH3sj/InKOSjxGtwVxtoAluHx5eIxO5GqcbOs0NY=";
   };
 
   build-system = [
@@ -47,6 +47,11 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
+  pythonRelaxDeps = [
+    # we patched click 8.2.1
+    "click"
+  ];
+
   dependencies = [
     celery
     flask
@@ -80,6 +85,7 @@ buildPythonPackage rec {
   disabledTests = [ "test_setup_log_handler_with_env_configuration" ];
 
   meta = {
+    changelog = "https://gitlab.softwareheritage.org/swh/devel/swh-scheduler/-/tags/${src.tag}";
     description = "Job scheduler for the Software Heritage project";
     homepage = "https://gitlab.softwareheritage.org/swh/devel/swh-scheduler";
     license = lib.licenses.gpl3Only;
diff --git a/pkgs/development/python-modules/swh-shard/default.nix b/pkgs/development/python-modules/swh-shard/default.nix
new file mode 100644
index 0000000000000..a07c344b04a28
--- /dev/null
+++ b/pkgs/development/python-modules/swh-shard/default.nix
@@ -0,0 +1,72 @@
+{
+  buildPythonPackage,
+  click,
+  cmake,
+  cmph,
+  fetchFromGitLab,
+  lib,
+  ninja,
+  pkg-config,
+  pybind11,
+  pytest-mock,
+  pytestCheckHook,
+  scikit-build-core,
+  setuptools-scm,
+}:
+
+buildPythonPackage rec {
+  pname = "swh-shard";
+  version = "2.2.0";
+  pyproject = true;
+
+  src = fetchFromGitLab {
+    domain = "gitlab.softwareheritage.org";
+    group = "swh";
+    owner = "devel";
+    repo = "swh-shard";
+    tag = "v${version}";
+    hash = "sha256-97oZ+Wa8GmyL2V4CnlSvaTbQZJ+mPbg6uVmWd0oxv1Q=";
+  };
+
+  build-system = [
+    cmake
+    ninja
+    pybind11
+    scikit-build-core
+    setuptools-scm
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  dontUseCmakeConfigure = true;
+
+  buildInputs = [
+    cmph
+  ];
+
+  dependencies = [
+    click
+  ];
+
+  pythonImportsCheck = [ "swh.shard" ];
+
+  nativeCheckInputs = [
+    pytest-mock
+    pytestCheckHook
+  ];
+
+  preCheck = ''
+    # import from $out
+    rm src/swh/shard/*.py
+  '';
+
+  meta = {
+    changelog = "https://gitlab.softwareheritage.org/swh/devel/swh-shard/-/tags/v2.2.0";
+    description = "Shard File Format for the Software Heritage Object Storage";
+    homepage = "https://gitlab.softwareheritage.org/swh/devel/swh-shard";
+    license = lib.licenses.gpl3Only;
+    maintainers = [ lib.maintainers.dotlambda ];
+  };
+}
diff --git a/pkgs/development/python-modules/swh-storage/default.nix b/pkgs/development/python-modules/swh-storage/default.nix
index 74e312d076060..dcf09bf27cf46 100644
--- a/pkgs/development/python-modules/swh-storage/default.nix
+++ b/pkgs/development/python-modules/swh-storage/default.nix
@@ -12,6 +12,8 @@
   iso8601,
   mypy-extensions,
   psycopg,
+  psycopg-pool,
+  pyasyncore,
   redis,
   tenacity,
   swh-core,
@@ -30,7 +32,7 @@
 
 buildPythonPackage rec {
   pname = "swh-storage";
-  version = "3.1.0";
+  version = "4.1.0";
   pyproject = true;
 
   src = fetchFromGitLab {
@@ -39,7 +41,7 @@ buildPythonPackage rec {
     owner = "devel";
     repo = "swh-storage";
     tag = "v${version}";
-    hash = "sha256-Bxwc8OccmqadLjHtmhToHBYHGkD7Fw3Cl3go9VLV/Bs=";
+    hash = "sha256-JXeHE/wZ3Wcf1I1eGyCNlCGsreiQH6kCYZoDXV1h0A0=";
   };
 
   build-system = [
@@ -47,6 +49,11 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
+  pythonRelaxDeps = [
+    # we patched click 8.2.1
+    "click"
+  ];
+
   dependencies = [
     backports-entry-points-selectable
     cassandra-driver
@@ -56,13 +63,14 @@ buildPythonPackage rec {
     iso8601
     mypy-extensions
     psycopg
+    psycopg-pool
+    pyasyncore
     redis
     tenacity
     swh-core
     swh-model
     swh-objstorage
-  ]
-  ++ psycopg.optional-dependencies.pool;
+  ];
 
   pythonImportsCheck = [ "swh.storage" ];
 
@@ -88,11 +96,13 @@ buildPythonPackage rec {
     "swh/storage/tests/test_cassandra_migration.py"
     "swh/storage/tests/test_cassandra_ttl.py"
     "swh/storage/tests/test_cli_cassandra.py"
+    "swh/storage/tests/test_cli_object_references_cassandra.py"
     # Failing tests
     "swh/storage/tests/test_cli_object_references.py"
   ];
 
   meta = {
+    changelog = "https://gitlab.softwareheritage.org/swh/devel/swh-storage/-/tags/${src.tag}";
     description = "Abstraction layer over the archive, allowing to access all stored source code artifacts as well as their metadata";
     homepage = "https://gitlab.softwareheritage.org/swh/devel/swh-storage";
     license = lib.licenses.gpl3Only;
diff --git a/pkgs/development/python-modules/swh-web-client/default.nix b/pkgs/development/python-modules/swh-web-client/default.nix
index b7ec8be2d090e..deeba3f3a3b12 100644
--- a/pkgs/development/python-modules/swh-web-client/default.nix
+++ b/pkgs/development/python-modules/swh-web-client/default.nix
@@ -37,6 +37,11 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
+  pythonRelaxDeps = [
+    # we patched click 8.2.1
+    "click"
+  ];
+
   dependencies = [
     click
     dateutils
diff --git a/pkgs/development/python-modules/uv-build/default.nix b/pkgs/development/python-modules/uv-build/default.nix
index 84840a3df9e1f..e9111bd69b133 100644
--- a/pkgs/development/python-modules/uv-build/default.nix
+++ b/pkgs/development/python-modules/uv-build/default.nix
@@ -1,26 +1,34 @@
 {
   lib,
   pkgs,
+  fetchFromGitHub,
   buildPythonPackage,
   rustPlatform,
   callPackage,
 }:
 
-buildPythonPackage {
+buildPythonPackage rec {
   pname = "uv-build";
+  version = "0.9.7";
   pyproject = true;
 
-  inherit (pkgs.uv)
-    version
-    src
-    cargoDeps
-    ;
+  src = fetchFromGitHub {
+    owner = "astral-sh";
+    repo = "uv";
+    tag = version;
+    hash = "sha256-I0Oe6vaH7iQh+Ubp5RIk8Ol6Ni7OPu8HKX0fqLdewyk=";
+  };
 
   nativeBuildInputs = [
     rustPlatform.cargoSetupHook
     rustPlatform.maturinBuildHook
   ];
 
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit pname version src;
+    hash = "sha256-K/RP7EA0VAAI8TGx+VwfKPmyT6+x4p3kekuoMZ0/egc=";
+  };
+
   buildAndTestSubdir = "crates/uv-build";
 
   # $src/.github/workflows/build-binaries.yml#L139
@@ -32,7 +40,11 @@ buildPythonPackage {
   doCheck = false;
 
   # Run the tests of a package built by `uv_build`.
-  passthru.tests.built-by-uv = callPackage ./built-by-uv.nix { inherit (pkgs) uv; };
+  passthru = {
+    tests.built-by-uv = callPackage ./built-by-uv.nix { inherit (pkgs) uv; };
+
+    # updateScript is not needed here, as updating is done on staging
+  };
 
   meta = {
     description = "Minimal build backend for uv";
diff --git a/pkgs/development/tools/electron/CrabbyAvif-Switch-from-no_sanitize-cfi-to-sanitize-cfi-off-2.patch b/pkgs/development/tools/electron/CrabbyAvif-Switch-from-no_sanitize-cfi-to-sanitize-cfi-off-2.patch
new file mode 100644
index 0000000000000..87140cbd11e66
--- /dev/null
+++ b/pkgs/development/tools/electron/CrabbyAvif-Switch-from-no_sanitize-cfi-to-sanitize-cfi-off-2.patch
@@ -0,0 +1,13 @@
+diff --git a/third_party/crabbyavif/src/src/reformat/libyuv.rs b/third_party/crabbyavif/src/src/reformat/libyuv.rs
+index dd12964..4ae9dc0 100644
+--- a/third_party/crabbyavif/src/src/reformat/libyuv.rs
++++ b/third_party/crabbyavif/src/src/reformat/libyuv.rs
+@@ -823,7 +823,7 @@ fn rgb_to_yuv_conversion_function(
+     }
+ }
+ 
+-#[cfg_attr(feature = "disable_cfi", no_sanitize(cfi))]
++#[cfg_attr(feature = "disable_cfi", sanitize(cfi = "off"))]
+ pub(crate) fn rgb_to_yuv(rgb: &rgb::Image, image: &mut image::Image) -> AvifResult<()> {
+     let conversion_function = rgb_to_yuv_conversion_function(rgb, image)?;
+     let plane_u8 = image.plane_ptrs_mut();
diff --git a/pkgs/development/tools/electron/common.nix b/pkgs/development/tools/electron/common.nix
index 1cc57988ff230..2fb4b0dccb199 100644
--- a/pkgs/development/tools/electron/common.nix
+++ b/pkgs/development/tools/electron/common.nix
@@ -106,6 +106,34 @@ in
         url = "https://github.com/chromium/chromium/commit/23d818d3c7fba4658248f17fd7b8993199242aa9.patch";
         hash = "sha256-JVv36PgU/rr34jrhgCyf4Pp8o5j2T8fD1xBVH1avT48=";
       })
+      # Fix build with Rust 1.91.0
+      # https://chromium-review.googlesource.com/c/chromium/src/+/6949745
+      (fetchpatch {
+        name = "Remove-unicode_width-from-rust-dependencies.patch";
+        url = "https://github.com/chromium/chromium/commit/0420449584e2afb7473393f536379efe194ba23c.patch";
+        hash = "sha256-2x1QoKkZEBfJw0hBjaErN/E47WrVfZvDngAXSIDzJs4=";
+      })
+      (fetchpatch {
+        name = "CrabbyAvif-Switch-from-no_sanitize-cfi-to-sanitize-cfi-off-1.patch";
+        url = "https://github.com/webmproject/CrabbyAvif/commit/4c70b98d1ebc8a210f2919be7ccabbcf23061cb5.patch";
+        extraPrefix = "third_party/crabbyavif/src/";
+        stripLen = 1;
+        hash = "sha256-E8/PmL+8+ZSoDO6L0/YOygIsliCDmcaBptXsi2L6ETQ=";
+      })
+      # backport of https://github.com/webmproject/CrabbyAvif/commit/3ba05863e84fd3acb4f4af2b4545221b317a2e55
+      ./CrabbyAvif-Switch-from-no_sanitize-cfi-to-sanitize-cfi-off-2.patch
+      # https://chromium-review.googlesource.com/c/chromium/src/+/6879484
+      (fetchpatch {
+        name = "crabbyavif-BUILD-gn-Temporarily-remove-disable_cfi-feature.patch";
+        url = "https://github.com/chromium/chromium/commit/e46275404d8f8a65ed84b3e583e9b78e4298acc7.patch";
+        hash = "sha256-2Dths53ervzCPKFbAVxeBHxtPHckxYhesJhaYZbxGSA=";
+      })
+      # https://chromium-review.googlesource.com/c/chromium/src/+/6960510
+      (fetchpatch {
+        name = "crabbyavif-BUILD-gn-Enable-disable_cfi-feature.patch";
+        url = "https://github.com/chromium/chromium/commit/9415f40bc6f853547f791e633be638c71368ce56.patch";
+        hash = "sha256-+M4gI77SoQ4dYIe/iGFgIwF1fS/6KQ8s16vj8ht/rik=";
+      })
     ];
 
   npmRoot = "third_party/node";
diff --git a/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch b/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
index 1168d1249858a..e49f506639d53 100644
--- a/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
+++ b/pkgs/os-specific/linux/systemd/0012-path-util.h-add-placeholder-for-DEFAULT_PATH_NORMAL.patch
@@ -6,24 +6,26 @@ Subject: [PATCH] path-util.h: add placeholder for DEFAULT_PATH_NORMAL
 This will be the $PATH used to lookup ExecStart= etc. options, which
 systemd itself uses extensively.
 ---
- src/basic/path-util.h | 6 +++---
- 1 file changed, 3 insertions(+), 3 deletions(-)
+ src/basic/path-util.h | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
 
 diff --git a/src/basic/path-util.h b/src/basic/path-util.h
-index 45518c07e5..94bef2f4b4 100644
+index a3a82574dd..b836dba7f1 100644
 --- a/src/basic/path-util.h
 +++ b/src/basic/path-util.h
-@@ -9,10 +9,10 @@
+@@ -9,11 +9,11 @@
  #define PATH_MERGED_BIN(x) x "bin"
  #define PATH_MERGED_BIN_NULSTR(x) x "bin\0"
  
--#define DEFAULT_PATH_WITH_SBIN PATH_SPLIT_BIN("/usr/local/") ":" PATH_SPLIT_BIN("/usr/")
+-#define DEFAULT_PATH_WITH_FULL_SBIN PATH_SPLIT_BIN("/usr/local/") ":" PATH_SPLIT_BIN("/usr/")
+-#define DEFAULT_PATH_WITH_LOCAL_SBIN PATH_SPLIT_BIN("/usr/local/") ":" PATH_MERGED_BIN("/usr/")
 -#define DEFAULT_PATH_WITHOUT_SBIN PATH_MERGED_BIN("/usr/local/") ":" PATH_MERGED_BIN("/usr/")
-+#define DEFAULT_PATH_WITH_SBIN "@defaultPathNormal@"
-+#define DEFAULT_PATH_WITHOUT_SBIN DEFAULT_PATH_WITH_SBIN
++#define DEFAULT_PATH_WITH_FULL_SBIN "@defaultPathNormal@"
++#define DEFAULT_PATH_WITH_LOCAL_SBIN DEFAULT_PATH_WITH_FULL_SBIN
++#define DEFAULT_PATH_WITHOUT_SBIN DEFAULT_PATH_WITH_FULL_SBIN
  
--#define DEFAULT_PATH_COMPAT PATH_SPLIT_BIN("/usr/local/") ":" PATH_SPLIT_BIN("/usr/") ":" PATH_SPLIT_BIN("/")
-+#define DEFAULT_PATH_COMPAT DEFAULT_PATH_WITH_SBIN
+-#define DEFAULT_PATH_COMPAT DEFAULT_PATH_WITH_FULL_SBIN ":" PATH_SPLIT_BIN("/")
++#define DEFAULT_PATH_COMPAT DEFAULT_PATH_WITH_FULL_SBIN
  
  const char* default_PATH(void);
  
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index a6624aaa803b5..8c5aa4097a4b0 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -203,13 +203,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname;
-  version = "258.1";
+  version = "258.2";
 
   src = fetchFromGitHub {
     owner = "systemd";
     repo = "systemd";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-LA+6/d9W3CxK0G2sXsPHM4BVLf8IzsWW6IxJFby6/JU=";
+    hash = "sha256-1iWeuNefDOIEUSTzxzvt+jfcs6sSMPhxQfdwp0mqUjQ=";
   };
 
   # On major changes, or when otherwise required, you *must* :
@@ -221,16 +221,6 @@ stdenv.mkDerivation (finalAttrs: {
   # Use `find . -name "*.patch" | sort` to get an up-to-date listing of all
   # patches
   patches = [
-    # https://github.com/systemd/systemd/pull/39094
-    (fetchpatch {
-      url = "https://github.com/systemd/systemd/commit/8b4ee3d68d2e70d9a396b74d155eab3b11763311.patch";
-      hash = "sha256-JJDaSHQjd1QZ18CQHq40viB0AF/0MiescmZUcc/6LDg=";
-    })
-    (fetchpatch {
-      url = "https://github.com/systemd/systemd/commit/13b0e7fc6d2623800ba04b104f3b628388c9f5e6.patch";
-      hash = "sha256-X+tY3NjfRJpF6wvd++xEps0DIFTbX/6Zw9oO4Y9FmNI=";
-    })
-
     ./0001-Start-device-units-for-uninitialised-encrypted-devic.patch
     ./0002-Don-t-try-to-unmount-nix-or-nix-store.patch
     ./0003-Fix-NixOS-containers.patch
@@ -445,6 +435,10 @@ stdenv.mkDerivation (finalAttrs: {
     # independent of upstream changes to the default.
     (lib.mesonOption "debug-shell" "/bin/sh")
 
+    # Use the correct path for Bash for user shells (e.g. used in nspawn and
+    # homed), which otherwise defaults to /bin/bash.
+    (lib.mesonOption "default-user-shell" "/run/current-system/sw/bin/bash")
+
     # Attempts to check /usr/sbin and that fails in macOS sandbox because
     # permission is denied. If /usr/sbin is not a symlink, it defaults to true.
     # We set it to false since stdenv moves sbin/* to bin and creates a symlink,
diff --git a/pkgs/shells/bash/5.nix b/pkgs/shells/bash/5.nix
index 017edfe2613ef..015872e3b2f7a 100644
--- a/pkgs/shells/bash/5.nix
+++ b/pkgs/shells/bash/5.nix
@@ -5,7 +5,7 @@
   fetchurl,
   updateAutotoolsGnuConfigScriptsHook,
   bison,
-  util-linux,
+  util-linuxMinimal,
   coreutils,
   libredirect,
   glibcLocales,
@@ -49,7 +49,7 @@ lib.warnIf (withDocs != null)
     # bionic libc is super weird and has issues with fortify outside of its own libc, check this comment:
     # https://github.com/NixOS/nixpkgs/pull/192630#discussion_r978985593
     # or you can check libc/include/sys/cdefs.h in bionic source code
-    ++ lib.optional (stdenv.hostPlatform.libc == "bionic") "fortify";
+    ++ lib.optionals (stdenv.hostPlatform.libc == "bionic") [ "fortify" ];
 
     outputs = [
       "out"
@@ -130,9 +130,9 @@ lib.warnIf (withDocs != null)
       updateAutotoolsGnuConfigScriptsHook
       bison
     ]
-    ++ lib.optional stdenv.hostPlatform.isDarwin stdenv.cc.bintools;
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [ stdenv.cc.bintools ];
 
-    buildInputs = lib.optional interactive readline;
+    buildInputs = lib.optionals interactive [ readline ];
 
     enableParallelBuilding = true;
 
@@ -167,7 +167,7 @@ lib.warnIf (withDocs != null)
         doCheck = true;
 
         nativeCheckInputs = attrs.nativeCheckInputs or [ ] ++ [
-          util-linux
+          util-linuxMinimal
           libredirect.hook
           glibcLocales
           gnused
@@ -255,7 +255,7 @@ lib.warnIf (withDocs != null)
       });
     };
 
-    meta = with lib; {
+    meta = {
       homepage = "https://www.gnu.org/software/bash/";
       description =
         "GNU Bourne-Again Shell, the de facto standard shell on Linux"
@@ -270,8 +270,8 @@ lib.warnIf (withDocs != null)
         interactive use.  In addition, most sh scripts can be run by
         Bash without modification.
       '';
-      license = licenses.gpl3Plus;
-      platforms = platforms.all;
+      license = lib.licenses.gpl3Plus;
+      platforms = lib.platforms.all;
       # https://github.com/NixOS/nixpkgs/issues/333338
       badPlatforms = [ lib.systems.inspect.patterns.isMinGW ];
       maintainers = with lib.maintainers; [ infinisil ];
diff --git a/pkgs/tools/inputmethods/ibus/default.nix b/pkgs/tools/inputmethods/ibus/default.nix
index 3f0701ddaa47b..74df7eefb93d4 100644
--- a/pkgs/tools/inputmethods/ibus/default.nix
+++ b/pkgs/tools/inputmethods/ibus/default.nix
@@ -67,13 +67,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ibus";
-  version = "1.5.32";
+  version = "1.5.33";
 
   src = fetchFromGitHub {
     owner = "ibus";
     repo = "ibus";
     tag = finalAttrs.version;
-    hash = "sha256-Rp2Aw2C2LXMBp8++pnZtPHiPoFDERpkDsKd0E//twuY=";
+    hash = "sha256-cpNZI6KbL9zUJHw1szpWl4lOEAvlBdd+FA6xGh1sYYY=";
   };
 
   patches = [
@@ -88,6 +88,8 @@ stdenv.mkDerivation (finalAttrs: {
       PYTHON = null;
     })
     ./build-without-dbus-launch.patch
+    # https://github.com/NixOS/nixpkgs/issues/230290
+    ./vala-parallelism.patch
   ];
 
   outputs = [
diff --git a/pkgs/tools/inputmethods/ibus/vala-parallelism.patch b/pkgs/tools/inputmethods/ibus/vala-parallelism.patch
new file mode 100644
index 0000000000000..f4c47a76c39cc
--- /dev/null
+++ b/pkgs/tools/inputmethods/ibus/vala-parallelism.patch
@@ -0,0 +1,13 @@
+diff --git a/ui/gtk3/Makefile.am b/ui/gtk3/Makefile.am
+index 3ada6501..2066a8f5 100644
+--- a/ui/gtk3/Makefile.am
++++ b/ui/gtk3/Makefile.am
+@@ -304,6 +304,8 @@ panelbinding.o: $(srcdir)/panelbinding.c
+ 	$(AM_V_CC_no)$(COMPILE) -c -o $@ $<
+ 	$(NULL)
+ 
++.NOTPARALLEL:
++
+ MAINTAINERCLEANFILES += extension.c panelbinding.c
+ 
+ man_seven_DATA = ibus-emoji.7
diff --git a/pkgs/tools/misc/grub/default.nix b/pkgs/tools/misc/grub/default.nix
index 68f3921354a1b..774117d941fd4 100644
--- a/pkgs/tools/misc/grub/default.nix
+++ b/pkgs/tools/misc/grub/default.nix
@@ -510,6 +510,47 @@ stdenv.mkDerivation rec {
       url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c448f511e74cb7c776b314fcb7943f98d3f22b6d";
       hash = "sha256-64gMhCEW0aYHt46crX/qN/3Hj8MgvWLazgQlVXqe8LE=";
     })
+    # https://lists.gnu.org/archive/html/grub-devel/2025-11/msg00155.html
+    (fetchpatch {
+      name = "1_commands_test_fix_error_in_recursion_depth_calculation.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=cc9d621dd06bfa12eac511b37b4ceda5bd2f8246";
+      hash = "sha256-GpLpqTKr2ke/YaxnZIO1Kh9wpde44h2mvwcODcAL/nk=";
+    })
+    (fetchpatch {
+      name = "2_CVE-2025-54771.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=c4fb4cbc941981894a00ba8e75d634a41967a27f";
+      hash = "sha256-yWowlAMVXdfIyC+BiB00IZvTwIybvaPhxAyz0MPjQuY=";
+    })
+    (fetchpatch {
+      name = "3_CVE-2025-54770.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=10e58a14db20e17d1b6a39abe38df01fef98e29d";
+      hash = "sha256-1ROc5n7sApw7aGr+y8gygFqVkifLdgOD3RPaW9b8aQQ=";
+    })
+    (fetchpatch {
+      name = "4_CVE-2025-61662.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=8ed78fd9f0852ab218cc1f991c38e5a229e43807";
+      hash = "sha256-mG+vcZHbF4duY2YoYAzPBQRHfWvp5Fvgtm0XBk7JqqM=";
+    })
+    (fetchpatch {
+      name = "5_CVE-2025-61663_CVE-2025-61664.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=05d3698b8b03eccc49e53491bbd75dba15f40917";
+      hash = "sha256-kgtXhZmAQpassEf8+RzqkghAzLrCcRoRMMnfunF/0J8=";
+    })
+    (fetchpatch {
+      name = "6_tests_lib_functional_test_unregister_commands_on_module_unload.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=9df1e693e70c5a274b6d60dc76efe2694b89c2fc";
+      hash = "sha256-UzyYkpP7vivx2jzxi7BMP9h9OB2yraswrMW4g9UWsbI=";
+    })
+    (fetchpatch {
+      name = "7_CVE-2025-61661.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=549a9cc372fd0b96a4ccdfad0e12140476cc62a3";
+      hash = "sha256-2mlDoVXY7Upwx4QBeAMOHUtoUlyx1MDDmabnrwK1gEY=";
+    })
+    (fetchpatch {
+      name = "8_commands_usbtest_ensure_string_length_is_sufficient_in_usb_string_processing.patch";
+      url = "https://git.savannah.gnu.org/cgit/grub.git/patch/?id=7debdce1e98907e65223a4b4c53a41345ac45e53";
+      hash = "sha256-2ALvrmwxvpjQYjGNrQ0gyGotpk0kgmYlJXMF1xXrnEw=";
+    })
   ];
 
   postPatch =
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 789496df1041e..ce75607dd4ebc 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5216,15 +5216,15 @@ with pkgs;
   wrapRustcWith = { rustc-unwrapped, ... }@args: callPackage ../build-support/rust/rustc-wrapper args;
   wrapRustc = rustc-unwrapped: wrapRustcWith { inherit rustc-unwrapped; };
 
-  rust_1_90 = callPackage ../development/compilers/rust/1_90.nix { };
-  rust = rust_1_90;
+  rust_1_91 = callPackage ../development/compilers/rust/1_91.nix { };
+  rust = rust_1_91;
 
   mrustc = callPackage ../development/compilers/mrustc { };
   mrustc-minicargo = callPackage ../development/compilers/mrustc/minicargo.nix { };
   mrustc-bootstrap = callPackage ../development/compilers/mrustc/bootstrap.nix { };
 
-  rustPackages_1_90 = rust_1_90.packages.stable;
-  rustPackages = rustPackages_1_90;
+  rustPackages_1_91 = rust_1_91.packages.stable;
+  rustPackages = rustPackages_1_91;
 
   inherit (rustPackages)
     cargo
@@ -8157,7 +8157,6 @@ with pkgs;
   zunclient = with python313Packages; toPythonApplication python-zunclient;
 
   inherit (callPackages ../by-name/li/libressl { })
-    libressl_4_0
     libressl_4_1
     libressl_4_2
     ;
@@ -8237,7 +8236,9 @@ with pkgs;
 
   prospector = callPackage ../development/tools/prospector { };
 
-  protobuf = protobuf_33;
+  # this version should align with the static protobuf version linked into python3.pkgs.tensorflow
+  # $ nix-shell -I nixpkgs=$(git rev-parse --show-toplevel) -p python3.pkgs.tensorflow --run "python3 -c 'import google.protobuf; print(google.protobuf.__version__)'"
+  protobuf = protobuf_32;
 
   inherit
     ({
@@ -8896,23 +8897,25 @@ with pkgs;
       "3000"
     ];
   };
-  sbcl_2_5_7 = wrapLisp {
-    pkg = callPackage ../development/compilers/sbcl { version = "2.5.7"; };
+
+  sbcl_2_5_9 = wrapLisp {
+    pkg = callPackage ../development/compilers/sbcl { version = "2.5.9"; };
+
     faslExt = "fasl";
     flags = [
       "--dynamic-space-size"
       "3000"
     ];
   };
-  sbcl_2_5_9 = wrapLisp {
-    pkg = callPackage ../development/compilers/sbcl { version = "2.5.9"; };
+  sbcl_2_5_10 = wrapLisp {
+    pkg = callPackage ../development/compilers/sbcl { version = "2.5.10"; };
     faslExt = "fasl";
     flags = [
       "--dynamic-space-size"
       "3000"
     ];
   };
-  sbcl = sbcl_2_5_9;
+  sbcl = sbcl_2_5_10;
 
   sbclPackages = recurseIntoAttrs sbcl.pkgs;
 
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 61df6b217968e..ada61035c432c 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -450,6 +450,7 @@ mapAliases {
   sqlalchemy_migrate = throw "'sqlalchemy_migrate' has been renamed to/replaced by 'sqlalchemy-migrate'"; # Converted to throw 2025-10-29
   subunit2sql = throw "subunit2sql has been removed because it has been marked as broken since at least November 2024."; # Added 2025-10-04
   supervise_api = throw "'supervise_api' has been renamed to/replaced by 'supervise-api'"; # Converted to throw 2025-10-29
+  swh-perfecthash = throw "'swh-perfecthash' has been renamed to/replaced by 'swh-shard'"; # added 2025-11-13
   synologydsm-api = throw "'synologydsm-api' has been renamed to/replaced by 'py-synologydsm-api'"; # Converted to throw 2025-10-29
   systemd = throw "systemd was removed because it was misnamed; use systemd-python instead"; # added 2025-11-09
   sysv_ipc = throw "'sysv_ipc' has been renamed to/replaced by 'sysv-ipc'"; # Converted to throw 2025-10-29
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index c8c34d8468f3c..cabddf5f36b18 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2209,7 +2209,9 @@ self: super: with self; {
 
   brother-ql = callPackage ../development/python-modules/brother-ql { };
 
-  brotli = callPackage ../development/python-modules/brotli { };
+  brotli = callPackage ../development/python-modules/brotli {
+    inherit (pkgs) brotli;
+  };
 
   brotli-asgi = callPackage ../development/python-modules/brotli-asgi { };
 
@@ -18162,12 +18164,12 @@ self: super: with self; {
 
   swh-objstorage = callPackage ../development/python-modules/swh-objstorage { };
 
-  swh-perfecthash = callPackage ../development/python-modules/swh-perfecthash { };
-
   swh-scanner = callPackage ../development/python-modules/swh-scanner { };
 
   swh-scheduler = callPackage ../development/python-modules/swh-scheduler { };
 
+  swh-shard = callPackage ../development/python-modules/swh-shard { };
+
   swh-storage = callPackage ../development/python-modules/swh-storage { };
 
   swh-web-client = callPackage ../development/python-modules/swh-web-client { };