diff --git a/lib/default.nix b/lib/default.nix
index d45e6de0c33f2..875a1b9bb3efd 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -287,6 +287,7 @@ let
         init
         crossLists
         unique
+        uniqueStrings
         allUnique
         intersectLists
         subtractLists
diff --git a/lib/lists.nix b/lib/lists.nix
index ec0fe22d2afa2..226e264176a0a 100644
--- a/lib/lists.nix
+++ b/lib/lists.nix
@@ -11,7 +11,7 @@ let
     warn
     pipe
     ;
-  inherit (lib.attrsets) mapAttrs;
+  inherit (lib.attrsets) mapAttrs attrNames;
   inherit (lib) max;
 in
 rec {
@@ -1839,6 +1839,10 @@ rec {
   /**
     Remove duplicate elements from the `list`. O(n^2) complexity.
 
+    :::{.note}
+    If the list only contains strings and order is not important, the complexity can be reduced to O(n log n) by using [`lib.lists.uniqueStrings`](#function-library-lib.lists.uniqueStrings) instead.
+    :::
+
     # Inputs
 
     `list`
@@ -1864,6 +1868,43 @@ rec {
   */
   unique = foldl' (acc: e: if elem e acc then acc else acc ++ [ e ]) [ ];
 
+  /**
+    Removes duplicate strings from the `list`. O(n log n) complexity.
+
+    :::{.note}
+    Order is not preserved.
+
+    All elements of the list must be strings without context.
+
+    This function fails when the list contains a non-string element or a [string with context](https://nix.dev/manual/nix/latest/language/string-context.html).
+    In that case use [`lib.lists.unique`](#function-library-lib.lists.unique) instead.
+    :::
+
+    # Inputs
+
+    `list`
+
+    : List of strings
+
+    # Type
+
+    ```
+    uniqueStrings :: [ String ] -> [ String ]
+    ```
+
+    # Examples
+    :::{.example}
+    ## `lib.lists.uniqueStrings` usage example
+
+    ```nix
+    uniqueStrings [ "foo" "bar" "foo" ]
+    => [ "bar" "foo" ] # order is not preserved
+    ```
+
+    :::
+  */
+  uniqueStrings = list: attrNames (groupBy id list);
+
   /**
     Check if list contains only unique elements. O(n^2) complexity.
 
diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index 22188b4b3bae5..880396a0de72b 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -113,6 +113,7 @@ let
     toIntBase10
     toShellVars
     types
+    uniqueStrings
     updateManyAttrsByPath
     versions
     xor
@@ -1940,6 +1941,69 @@ runTests {
     expected = false;
   };
 
+  testUniqueStrings_empty = {
+    expr = uniqueStrings [ ];
+    expected = [ ];
+  };
+  testUniqueStrings_singles = {
+    expr = uniqueStrings [
+      "all"
+      "unique"
+      "already"
+    ];
+    expected = [
+      "all"
+      "already"
+      "unique"
+    ];
+  };
+  testUniqueStrings_allDuplicates = {
+    expr = uniqueStrings [
+      "dup"
+      "dup"
+      "dup"
+    ];
+    expected = [ "dup" ];
+  };
+  testUniqueStrings_some_duplicates = {
+    expr = uniqueStrings [
+      "foo"
+      "foo"
+      "bar"
+      "bar"
+      "baz"
+    ];
+    expected = [
+      "bar"
+      "baz"
+      "foo"
+    ];
+  };
+  testUniqueStrings_unicode = {
+    expr = uniqueStrings [
+      "café"
+      "@"
+      "#"
+      "@"
+      "#"
+      "$"
+      "😎"
+      "😎"
+      "🙃"
+      ""
+      ""
+    ];
+    expected = [
+      ""
+      "#"
+      "$"
+      "@"
+      "café"
+      "😎"
+      "🙃"
+    ];
+  };
+
   # ATTRSETS
 
   testConcatMapAttrs = {
diff --git a/pkgs/applications/blockchains/bitcoin-knots/default.nix b/pkgs/applications/blockchains/bitcoin-knots/default.nix
index 53f57d737d2e2..49e97d731593e 100644
--- a/pkgs/applications/blockchains/bitcoin-knots/default.nix
+++ b/pkgs/applications/blockchains/bitcoin-knots/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchFromGitHub,
   autoreconfHook,
   pkg-config,
   util-linux,
@@ -21,20 +22,30 @@
   python3,
   withGui,
   withWallet ? true,
+  gnupg,
+  # Signatures from the following GPG public keys checked during verification of the source code.
+  # The list can be found at https://github.com/bitcoinknots/guix.sigs/tree/knots/builder-keys
+  builderKeys ? [
+    "1A3E761F19D2CC7785C5502EA291A2C45D0C504A" # luke-jr.gpg
+    "32FE1E61B1C711186CA378DEFD8981F1BC41ABB9" # oomahq.gpg
+    "CACC7CBB26B3D2EE8FC2F2BC0E37EBAB8574F005" # leo-haf.gpg
+  ],
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = if withGui then "bitcoin-knots" else "bitcoind-knots";
   version = "28.1.knots20250305";
 
   src = fetchurl {
-    url = "https://bitcoinknots.org/files/28.x/${version}/bitcoin-${version}.tar.gz";
+    url = "https://bitcoinknots.org/files/28.x/${finalAttrs.version}/bitcoin-${finalAttrs.version}.tar.gz";
+    # hash retrieved from signed SHA256SUMS
     hash = "sha256-DKO3+43Tn/BTKQVrLrCkeMtzm8SfbaJD8rPlb6lDA8A=";
   };
 
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
+    gnupg
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [ util-linux ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ hexdump ]
@@ -58,11 +69,58 @@ stdenv.mkDerivation rec {
     qttools
   ];
 
+  preUnpack =
+    let
+      majorVersion = lib.versions.major finalAttrs.version;
+
+      publicKeys = fetchFromGitHub {
+        owner = "bitcoinknots";
+        repo = "guix.sigs";
+        rev = "b998306d462f39b6077518521700d7156fec76b8";
+        sha256 = "sha256-q4tumAfTr828AZNOa9ia7Y0PYoe6W47V/7SEApTzl3w=";
+      };
+
+      checksums = fetchurl {
+        url = "https://bitcoinknots.org/files/${majorVersion}.x/${finalAttrs.version}/SHA256SUMS";
+        hash = "sha256-xWJKaZBLm9H6AuMBSC21FLy/5TRUI0AQVIUF/2PvDhs=";
+      };
+
+      signatures = fetchurl {
+        url = "https://bitcoinknots.org/files/${majorVersion}.x/${finalAttrs.version}/SHA256SUMS.asc";
+        hash = "sha256-SywdBEzZqsf2aDeOs7J9n513RTCm+TJA/QYP5+h7Ifo=";
+      };
+
+      verifyBuilderKeys =
+        let
+          script = publicKey: ''
+            echo "Checking if public key ${publicKey} signed the checksum file..."
+            grep "^\[GNUPG:\] VALIDSIG .* ${publicKey}$" verify.log > /dev/null
+            echo "OK"
+          '';
+        in
+        builtins.concatStringsSep "\n" (builtins.map script builderKeys);
+    in
+    ''
+      pushd $(mktemp -d)
+      export GNUPGHOME=$PWD/gnupg
+      mkdir -m 700 -p $GNUPGHOME
+      gpg --no-autostart --batch --import ${publicKeys}/builder-keys/*
+      ln -s ${checksums} ./SHA256SUMS
+      ln -s ${signatures} ./SHA256SUMS.asc
+      ln -s $src ./bitcoin-${finalAttrs.version}.tar.gz
+      gpg --no-autostart --batch --verify --status-fd 1 SHA256SUMS.asc SHA256SUMS > verify.log
+      ${verifyBuilderKeys}
+      grep bitcoin-${finalAttrs.version}.tar.gz SHA256SUMS > SHA256SUMS.filtered
+      echo "Verifying the checksum of bitcoin-${finalAttrs.version}.tar.gz..."
+      sha256sum -c SHA256SUMS.filtered
+      popd
+    '';
+
   configureFlags = [
     "--with-boost-libdir=${boost.out}/lib"
     "--disable-bench"
   ]
-  ++ lib.optionals (!doCheck) [
+  ++ lib.optionals (!finalAttrs.doCheck) [
     "--disable-tests"
     "--disable-gui-tests"
   ]
@@ -90,7 +148,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Derivative of Bitcoin Core with a collection of improvements";
     homepage = "https://bitcoinknots.org/";
-    changelog = "https://github.com/bitcoinknots/bitcoin/blob/v${version}/doc/release-notes.md";
+    changelog = "https://github.com/bitcoinknots/bitcoin/blob/v${finalAttrs.version}/doc/release-notes.md";
     maintainers = with lib.maintainers; [
       prusnak
       mmahut
@@ -98,4 +156,4 @@ stdenv.mkDerivation rec {
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/applications/blockchains/bitcoin/default.nix b/pkgs/applications/blockchains/bitcoin/default.nix
index 809f8665050fb..1c63e4293929b 100644
--- a/pkgs/applications/blockchains/bitcoin/default.nix
+++ b/pkgs/applications/blockchains/bitcoin/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchFromGitHub,
   cmake,
   pkg-config,
   installShellFiles,
@@ -23,6 +24,16 @@
   withGui,
   withWallet ? true,
   enableTracing ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isStatic,
+  gnupg,
+  # Signatures from the following GPG public keys checked during verification of the source code.
+  # The list can be found at https://github.com/bitcoin-core/guix.sigs/tree/main/builder-keys
+  builderKeys ? [
+    "152812300785C96444D3334D17565732E08E5E41" # achow101.gpg
+    "9EDAFF80E080659604F4A76B2EBB056FD847F8A7" # Emzy.gpg
+    "71A3B16735405025D447E8F274810B012346C9A6" # laanwj.gpg
+    "6B002C6EA3F91B1B0DF0C9BC8F617F1200A6D25C" # glozow.gpg
+    "D1DBF2C4B96F2DEBF4C16654410108112E7EA81F" # hebasto.gpg
+  ],
 }:
 
 let
@@ -48,6 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     pkg-config
     installShellFiles
+    gnupg
   ]
   ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
     autoSignDarwinBinariesHook
@@ -70,6 +82,51 @@ stdenv.mkDerivation (finalAttrs: {
     qttools
   ];
 
+  preUnpack =
+    let
+      publicKeys = fetchFromGitHub {
+        owner = "bitcoin-core";
+        repo = "guix.sigs";
+        rev = "a788388207bd244d5ab07b31ecd6c126f213a6c6";
+        sha256 = "sha256-gbenuEWP6pqY9ywPd/yZy6QfWI7jvSObwto27DRXjGI=";
+      };
+
+      checksums = fetchurl {
+        url = "https://bitcoincore.org/bin/bitcoin-core-${finalAttrs.version}/SHA256SUMS";
+        hash = "sha256-lOwVH0UqIhOT0I9rAvswuqy+tZ8ZRhH0kGnn9VCbRv4=";
+      };
+
+      signatures = fetchurl {
+        url = "https://bitcoincore.org/bin/bitcoin-core-${finalAttrs.version}/SHA256SUMS.asc";
+        hash = "sha256-s05cRmZ9aoPdSZTaz6D6qmVwX6OprqxynPn5vZQ7bbw=";
+      };
+
+      verifyBuilderKeys =
+        let
+          script = publicKey: ''
+            echo "Checking if public key ${publicKey} signed the checksum file..."
+            grep "^\[GNUPG:\] VALIDSIG .* ${publicKey}$" verify.log > /dev/null
+            echo "OK"
+          '';
+        in
+        builtins.concatStringsSep "\n" (builtins.map script builderKeys);
+    in
+    ''
+      pushd $(mktemp -d)
+      export GNUPGHOME=$PWD/gnupg
+      mkdir -m 700 -p $GNUPGHOME
+      gpg --no-autostart --batch --import ${publicKeys}/builder-keys/*
+      ln -s ${checksums} ./SHA256SUMS
+      ln -s ${signatures} ./SHA256SUMS.asc
+      ln -s $src ./bitcoin-${finalAttrs.version}.tar.gz
+      gpg --no-autostart --batch --verify --status-fd 1 SHA256SUMS.asc SHA256SUMS > verify.log
+      ${verifyBuilderKeys}
+      grep bitcoin-${finalAttrs.version}.tar.gz SHA256SUMS > SHA256SUMS.filtered
+      echo "Verifying the checksum of bitcoin-${finalAttrs.version}.tar.gz..."
+      sha256sum -c SHA256SUMS.filtered
+      popd
+    '';
+
   postInstall = ''
     cd ..
     installShellCompletion --bash contrib/completions/bash/bitcoin-cli.bash
diff --git a/pkgs/applications/editors/tiled/default.nix b/pkgs/applications/editors/tiled/default.nix
index 773b149a0b6f9..e5e031b2b1f4d 100644
--- a/pkgs/applications/editors/tiled/default.nix
+++ b/pkgs/applications/editors/tiled/default.nix
@@ -28,13 +28,14 @@ in
 
 stdenv.mkDerivation rec {
   pname = "tiled";
-  version = "1.11.90";
+  # nixpkgs-update: no auto update
+  version = "1.11.2";
 
   src = fetchFromGitHub {
     owner = "mapeditor";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-gGsozdFEE5c315DF+EsIY9wGv50wwrOBycejTkVwEHA=";
+    sha256 = "sha256-9oUKn51MQcsStgIJrp9XW5YAIpAUcO0kzfGnYA3gz/E=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix
index ba0190c093d1d..3afecf4ffc905 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix
@@ -12,18 +12,18 @@
   pkgs,
 }:
 let
-  version = "0.0.27-unstable-2025-08-06";
+  version = "0.0.27-unstable-2025-08-14";
   src = fetchFromGitHub {
     owner = "yetone";
     repo = "avante.nvim";
-    rev = "2fc63d4128d2dc2fef0913c7480b4586959ebe4e";
-    hash = "sha256-hHa300Ldszsnp6AuYVJwOFc5FfuRTd3phyM6/qBUIQo=";
+    rev = "be0937a459624ce1170f158f9d8660d0ade47eb4";
+    hash = "sha256-1NzzyWW2Tp91wa+Ujv2cDTv/Cb/HgA6LiDuwxVWdJwU=";
   };
   avante-nvim-lib = rustPlatform.buildRustPackage {
     pname = "avante-nvim-lib";
     inherit version src;
 
-    cargoHash = "sha256-8mBpzndz34RrmhJYezd4hLrJyhVL4S4IHK3plaue1k8=";
+    cargoHash = "sha256-pTWCT2s820mjnfTscFnoSKC37RE7DAPKxP71QuM+JXQ=";
 
     nativeBuildInputs = [
       pkg-config
diff --git a/pkgs/applications/emulators/libretro/cores/flycast.nix b/pkgs/applications/emulators/libretro/cores/flycast.nix
index 2fbae3a49af2b..3899f4f32820e 100644
--- a/pkgs/applications/emulators/libretro/cores/flycast.nix
+++ b/pkgs/applications/emulators/libretro/cores/flycast.nix
@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "flycast";
-  version = "0-unstable-2025-08-01";
+  version = "0-unstable-2025-08-12";
 
   src = fetchFromGitHub {
     owner = "flyinghead";
     repo = "flycast";
-    rev = "40e400ab084175d3bd0f9e10cf8d6ac78c8b9544";
-    hash = "sha256-k/w1tmuGuRD98bR/kmc/9pLFGeobHMhKQapJOv8qVJo=";
+    rev = "33833cfd1ed2d94d907223442fdb8cdafd8d5d80";
+    hash = "sha256-6YXWJi3xbImfBMWILzsnwJGvj2XDoHcrWgLDPwaHfJs=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/ch/chameleon-cli/package.nix b/pkgs/by-name/ch/chameleon-cli/package.nix
new file mode 100644
index 0000000000000..fec07c5141104
--- /dev/null
+++ b/pkgs/by-name/ch/chameleon-cli/package.nix
@@ -0,0 +1,91 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  cmake,
+  makeWrapper,
+  xz,
+  python3,
+}:
+
+let
+  # https://github.com/RfidResearchGroup/ChameleonUltra/blob/main/software/script/requirements.txt
+  pythonPath =
+    with python3.pkgs;
+    makePythonPath [
+      colorama
+      prompt-toolkit
+      pyserial
+    ];
+in
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "chameleon-cli";
+  version = "2.0.0-unstable-2025-08-04";
+
+  src = fetchFromGitHub {
+    owner = "RfidResearchGroup";
+    repo = "ChameleonUltra";
+    rev = "098e0a914b206900f7ea7ae7265486c4349ab644";
+    sparseCheckout = [ "software" ];
+    hash = "sha256-WKxP4jLHkTqBO+nwxhr8DRb3TzDIMlwjA4v+6txQbDo=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/software";
+
+  patches = [
+    # Use execute_tool to simplify running hardnested tool,
+    # also fix when the dir conatains hardnested is read only
+    # https://github.com/RfidResearchGroup/ChameleonUltra/pull/266
+    (fetchpatch {
+      url = "https://github.com/RfidResearchGroup/ChameleonUltra/commit/39270fd09ee61ef0659bf3b79ffa4d2b27f3ba63.patch";
+      hash = "sha256-OlHQ2cL+NFdTsSPFI9geg3dabATRjyKxGp5gGG+eDl8=";
+      stripLen = 1;
+    })
+  ];
+
+  postPatch = ''
+    substituteInPlace src/CMakeLists.txt \
+      --replace-fail "liblzma" "lzma" \
+      --replace-fail "FetchContent_MakeAvailable(xz)" ""
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    makeWrapper
+  ];
+
+  buildInputs = [
+    xz
+  ];
+
+  cmakeFlags = [
+    "-S"
+    "../src"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/libexec
+    cp -r ../script/* $out/libexec
+    rm -r $out/libexec/tests
+    rm $out/libexec/requirements.txt
+    makeWrapper ${lib.getExe python3} $out/bin/chameleon-cli \
+      --add-flags "$out/libexec/chameleon_cli_main.py" \
+      --prefix PYTHONPATH : ${pythonPath}
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "Command line interface for Chameleon Ultra";
+    homepage = "https://github.com/RfidResearchGroup/ChameleonUltra";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "chameleon-cli";
+    maintainers = with lib.maintainers; [ azuwis ];
+  };
+})
diff --git a/pkgs/by-name/ch/chameleon-cli/update.sh b/pkgs/by-name/ch/chameleon-cli/update.sh
new file mode 100755
index 0000000000000..2875b72ffacdb
--- /dev/null
+++ b/pkgs/by-name/ch/chameleon-cli/update.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p coreutils nix-update
+
+# This update script exists, because nix-update is unable to ignore `dev`
+# tags that exist on the upstream repo.
+#
+# Once https://github.com/Mic92/nix-update/issues/322 is resolved it can be
+# removed.
+
+set -exuo pipefail
+
+cd "$(git rev-parse --show-toplevel)"
+
+nix-update --version=branch chameleon-cli
+
+tag=$(git ls-remote --tags --refs --sort='-version:refname' https://github.com/RfidResearchGroup/ChameleonUltra.git 'v*' | head -n 1 | cut --delimiter=/ --field=3-)
+tag="${tag#v}"
+sed -i -e 's|version = "[^-]*-unstable-|version = "'"${tag}"'-unstable-|' pkgs/by-name/ch/chameleon-cli/package.nix
diff --git a/pkgs/by-name/ch/chatbox/package.nix b/pkgs/by-name/ch/chatbox/package.nix
index 87cabe193265d..75d9a8577deae 100644
--- a/pkgs/by-name/ch/chatbox/package.nix
+++ b/pkgs/by-name/ch/chatbox/package.nix
@@ -6,11 +6,11 @@
 }:
 let
   pname = "chatbox";
-  version = "1.15.2";
+  version = "1.15.4";
 
   src = fetchurl {
     url = "https://download.chatboxai.app/releases/Chatbox-${version}-x86_64.AppImage";
-    hash = "sha256-KxL073BIfZfjFndwtkDNXwlt1xny76BMV9CQF3x7ATQ=";
+    hash = "sha256-plKibAg1tv0Togt+Jlwm8qrTp7UbBmuEM20xKLi7bb4=";
   };
 
   appimageContents = appimageTools.extract { inherit pname version src; };
diff --git a/pkgs/by-name/ch/chhoto-url/package.nix b/pkgs/by-name/ch/chhoto-url/package.nix
index 2f73b19d3f686..2a9abd251ea65 100644
--- a/pkgs/by-name/ch/chhoto-url/package.nix
+++ b/pkgs/by-name/ch/chhoto-url/package.nix
@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "chhoto-url";
-  version = "6.2.12";
+  version = "6.2.13";
 
   src = fetchFromGitHub {
     owner = "SinTan1729";
     repo = "chhoto-url";
     tag = finalAttrs.version;
-    hash = "sha256-hV/YWxOPRTojVTFIXwzqImBKyQ1dCDq5+bgCdS7T1p0=";
+    hash = "sha256-onGmDAVhT2lzq2pQ5runGuHgPdh1MjgFLU7DUvN7nt0=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/actix";
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail "./resources/" "${placeholder "out"}/share/chhoto-url/resources/"
   '';
 
-  cargoHash = "sha256-9wXbd56KOQ7suZqtg2cSFf2FGQJADFMHJbwAAxJ2V4g=";
+  cargoHash = "sha256-GbjbVr82Aj/CRdBl9gPGwHiyrc7l2F918DNnlEoPI58=";
 
   postInstall = ''
     mkdir -p $out/share/chhoto-url
diff --git a/pkgs/by-name/cl/clouddrive2/package.nix b/pkgs/by-name/cl/clouddrive2/package.nix
index 8d5649807fc4b..5c8bcfd3fa2be 100644
--- a/pkgs/by-name/cl/clouddrive2/package.nix
+++ b/pkgs/by-name/cl/clouddrive2/package.nix
@@ -11,16 +11,16 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "clouddrive2";
-  version = "0.9.4";
+  version = "0.9.5";
 
   src = fetchurl {
     url = "https://github.com/cloud-fs/cloud-fs.github.io/releases/download/v${finalAttrs.version}/clouddrive-2-${os}-${arch}-${finalAttrs.version}.tgz";
     hash =
       {
-        x86_64-linux = "sha256-i6+YoZfCFaVcF7XO7wPo8AEpU0LrD4bcsIqLNz/V3aM=";
-        aarch64-linux = "sha256-BV+47uJnvH/Gapz7dACnXIM49x7u/MTdbXiFRGq2DVc=";
-        x86_64-darwin = "sha256-Jjsdx203akCmlveGZD1x8fO6V0N5d3AzGAFIAzgOkHs=";
-        aarch64-darwin = "sha256-DuSZoXTQyfC3CIwNGTsGuQNP410rK9qMBei5T7TZN7A=";
+        x86_64-linux = "sha256-Gsq5rvr0SeGxCRwAeeFRZBPOe32EIa7uO6SAIuinezA=";
+        aarch64-linux = "sha256-M+lCUzoiy/sImBZrOjjeP4eqG3F4wbkMQg9Ho3ELGFo=";
+        x86_64-darwin = "sha256-Uyz1wuHICSq5C+n3ZjPinZznhajd6QR36CZgQBm+QRE=";
+        aarch64-darwin = "sha256-ZQxRHTzLUAhnL1rRLR9l8Ix5XzxeTAds7XAmEgZ9Xmo=";
       }
       .${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
   };
diff --git a/pkgs/by-name/cr/crush/package.nix b/pkgs/by-name/cr/crush/package.nix
index d7578f1aaffc1..8ccf5e0f0454b 100644
--- a/pkgs/by-name/cr/crush/package.nix
+++ b/pkgs/by-name/cr/crush/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "crush";
-  version = "0.5.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = "crush";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-u2w19Xmcm3cx/B8QRNGaP2qeg+Cif/L92RNlJav6H3w=";
+    hash = "sha256-QUYNJ2Ifny9Zj9YVQHcH80E2qa4clWVg2T075IEWujM=";
   };
 
-  vendorHash = "sha256-H92TgZoWdYQ863AAb2116zJtmgkKXh2hRoEBRcn5zeA=";
+  vendorHash = "sha256-vdzAVVGr7uTW/A/I8TcYW189E3960SCIqatu7Kb60hg=";
 
   # rename TestMain to prevent it from running, as it panics in the sandbox.
   postPatch = ''
diff --git a/pkgs/by-name/dr/draupnir/hashes.json b/pkgs/by-name/dr/draupnir/hashes.json
index 25bf893bf38c0..a509437a39888 100644
--- a/pkgs/by-name/dr/draupnir/hashes.json
+++ b/pkgs/by-name/dr/draupnir/hashes.json
@@ -1,3 +1,3 @@
 {
-  "yarn_offline_cache_hash": "sha256-xB9SKCM9m2LotwxIzGgT72mLgrDW2spqvR5VoyexIAA="
+  "yarn_offline_cache_hash": "sha256-SoCuCzrKUWWsD/oEh2W3/T1/hhd7ghfpeBojo84sEI8="
 }
diff --git a/pkgs/by-name/dr/draupnir/package.json b/pkgs/by-name/dr/draupnir/package.json
index 5cbbdbf553c85..bbd5e30084f3e 100644
--- a/pkgs/by-name/dr/draupnir/package.json
+++ b/pkgs/by-name/dr/draupnir/package.json
@@ -1,6 +1,6 @@
 {
   "name": "draupnir",
-  "version": "2.6.0",
+  "version": "2.6.1",
   "description": "A moderation tool for Matrix",
   "main": "lib/index.js",
   "repository": "https://github.com/the-draupnir-project/Draupnir.git",
@@ -63,8 +63,8 @@
     "jsdom": "^24.0.0",
     "matrix-appservice-bridge": "^10.3.1",
     "matrix-bot-sdk": "npm:@vector-im/matrix-bot-sdk@^0.7.1-element.6",
-    "matrix-protection-suite": "npm:@gnuxie/matrix-protection-suite@3.10.0",
-    "matrix-protection-suite-for-matrix-bot-sdk": "npm:@gnuxie/matrix-protection-suite-for-matrix-bot-sdk@3.8.0",
+    "matrix-protection-suite": "npm:@gnuxie/matrix-protection-suite@3.11.0",
+    "matrix-protection-suite-for-matrix-bot-sdk": "npm:@gnuxie/matrix-protection-suite-for-matrix-bot-sdk@3.11.0",
     "pg": "^8.8.0",
     "yaml": "^2.3.2"
   },
diff --git a/pkgs/by-name/dr/draupnir/package.nix b/pkgs/by-name/dr/draupnir/package.nix
index ef61dcf66e029..c36d4823a41b3 100644
--- a/pkgs/by-name/dr/draupnir/package.nix
+++ b/pkgs/by-name/dr/draupnir/package.nix
@@ -22,13 +22,13 @@ let
 in
 mkYarnPackage rec {
   pname = "draupnir";
-  version = "2.6.0";
+  version = "2.6.1";
 
   src = fetchFromGitHub {
     owner = "the-draupnir-project";
     repo = "Draupnir";
     tag = "v${version}";
-    hash = "sha256-v6dHexu9x60onBoHbdI+15p6r5m6mi7bRLgZ9jqF19s=";
+    hash = "sha256-KO2jm9yD/LnJSY1dAbPQ2fJZhmrxWJHU+TIaZzK97bg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gi/gitaly/package.nix b/pkgs/by-name/gi/gitaly/package.nix
index 664edf9b73df3..884cb31f11cb4 100644
--- a/pkgs/by-name/gi/gitaly/package.nix
+++ b/pkgs/by-name/gi/gitaly/package.nix
@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "18.2.1";
+  version = "18.2.2";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -21,7 +21,7 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-h4JklXImKwudJT3pb/UhHwQHKd87c5aSH1xYC0lRWKo=";
+      hash = "sha256-+OmduG9neb15m3i57qPfE42HI4w/zgmA5T6bhlwzrT0=";
     };
 
     vendorHash = "sha256-RjDV4NGmmdT9STQBHiYf3UUYwPmuSg6970/W/ekxin0=";
diff --git a/pkgs/by-name/gi/gitlab-container-registry/fix-broken-urlcache-tests.diff b/pkgs/by-name/gi/gitlab-container-registry/fix-broken-urlcache-tests.diff
new file mode 100644
index 0000000000000..2da75604d95f3
--- /dev/null
+++ b/pkgs/by-name/gi/gitlab-container-registry/fix-broken-urlcache-tests.diff
@@ -0,0 +1,22 @@
+diff --git a/registry/storage/driver/middleware/urlcache/urlcache_test.go b/registry/storage/driver/middleware/urlcache/urlcache_test.go
+index 67ef4abc0e..6644c80837 100644
+--- a/registry/storage/driver/middleware/urlcache/urlcache_test.go
++++ b/registry/storage/driver/middleware/urlcache/urlcache_test.go
+@@ -37,7 +37,7 @@
+ 			name:        "missing redis cache",
+ 			options:     make(map[string]any),
+ 			wantErr:     true,
+-			errContains: "urlcache middleware requires `cache` Redis configured",
++			errContains: "`_redisCache` key has not been passed to urlcache middleware",
+ 		},
+ 		{
+ 			name: "default configuration with redis",
+@@ -231,7 +231,7 @@
+ 				"_redisCache": "not a redis cache",
+ 			},
+ 			wantErr:     true,
+-			errContains: "unusable redis cache object",
++			errContains: "redis cache passed to the middleware cannot be used as the type is wrong",
+ 		},
+ 	}
+ 
diff --git a/pkgs/by-name/gi/gitlab-container-registry/package.nix b/pkgs/by-name/gi/gitlab-container-registry/package.nix
index 217966c4b1eb4..cbf8c0f80ede2 100644
--- a/pkgs/by-name/gi/gitlab-container-registry/package.nix
+++ b/pkgs/by-name/gi/gitlab-container-registry/package.nix
@@ -6,7 +6,7 @@
 
 buildGoModule rec {
   pname = "gitlab-container-registry";
-  version = "4.25.0";
+  version = "4.26.0";
   rev = "v${version}-gitlab";
 
   # nixpkgs-update: no auto update
@@ -14,10 +14,16 @@ buildGoModule rec {
     owner = "gitlab-org";
     repo = "container-registry";
     inherit rev;
-    hash = "sha256-7jzKFC29NAHi5iag6aA/5LzH6IyqMa3yAxtzV9OsBnQ=";
+    hash = "sha256-XACKJW5sRXNM4Q24DXEVtjzhVfxoBd+JWHJr1s01ocA=";
   };
 
-  vendorHash = "sha256-z9IlfyJ48FQzhbY38GbZaeQjg3cMDU8tLCXKhazP64A=";
+  patches = [
+    # https://gitlab.com/gitlab-org/container-registry/-/merge_requests/2447
+    # Can be removed with next released when merged
+    ./fix-broken-urlcache-tests.diff
+  ];
+
+  vendorHash = "sha256-J4p3vXLmDFYl/z6crqanlmG1FB4Dq04HLx9IhC3usQ4=";
 
   checkFlags =
     let
diff --git a/pkgs/by-name/gi/gitlab-pages/package.nix b/pkgs/by-name/gi/gitlab-pages/package.nix
index 452d624d23e2d..e5d5874ba7bb9 100644
--- a/pkgs/by-name/gi/gitlab-pages/package.nix
+++ b/pkgs/by-name/gi/gitlab-pages/package.nix
@@ -6,14 +6,14 @@
 
 buildGoModule rec {
   pname = "gitlab-pages";
-  version = "18.2.1";
+  version = "18.2.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${version}";
-    hash = "sha256-z1Pl3xeaoqeF/9qOVcuCpuciu1r6NQ4UhlLe9gy9+nE=";
+    hash = "sha256-PPa9SYyE3G+peP2xSpNw7WDDO7WiWKSRpd5tBODkA0g=";
   };
 
   vendorHash = "sha256-OubXCpvGtGqegQmdb6R1zw/0DfQ4FdbJGt7qYYRnWnA=";
diff --git a/pkgs/by-name/gi/gitlab/data.json b/pkgs/by-name/gi/gitlab/data.json
index c170a0a5d80bd..e14fe7e4fd697 100644
--- a/pkgs/by-name/gi/gitlab/data.json
+++ b/pkgs/by-name/gi/gitlab/data.json
@@ -1,15 +1,15 @@
 {
-  "version": "18.2.1",
-  "repo_hash": "1i0y46w18476gn98fmkixdjiyrwajz2347p57dg2ijch4ivzpmlv",
-  "yarn_hash": "04mqinnbhr6zgab2p1bq6y6b20bf4c4cynkgfc67mzm9xhybr3fk",
+  "version": "18.2.2",
+  "repo_hash": "0fqpfprxmgxaz5g0d5z4gsir1zj9fkhli7iq1ahx413ymsiqrxd0",
+  "yarn_hash": "0c6njrciqcjaswh784yxly4qza6k2ghq1ljbdkcn65cna4f4hwgk",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v18.2.1-ee",
+  "rev": "v18.2.2-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "18.2.1",
-    "GITLAB_PAGES_VERSION": "18.2.1",
+    "GITALY_SERVER_VERSION": "18.2.2",
+    "GITLAB_PAGES_VERSION": "18.2.2",
     "GITLAB_SHELL_VERSION": "14.43.0",
     "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.7.0",
-    "GITLAB_WORKHORSE_VERSION": "18.2.1"
+    "GITLAB_WORKHORSE_VERSION": "18.2.2"
   }
 }
diff --git a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
index 739a24476dec8..2bec55c365707 100644
--- a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
@@ -10,7 +10,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "18.2.1";
+  version = "18.2.2";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
diff --git a/pkgs/by-name/im/imaginer/package.nix b/pkgs/by-name/im/imaginer/package.nix
deleted file mode 100644
index a73faf7fad894..0000000000000
--- a/pkgs/by-name/im/imaginer/package.nix
+++ /dev/null
@@ -1,69 +0,0 @@
-{
-  lib,
-  appstream-glib,
-  blueprint-compiler,
-  desktop-file-utils,
-  fetchFromGitHub,
-  gettext,
-  glib,
-  gobject-introspection,
-  libadwaita,
-  libsoup_3,
-  meson,
-  ninja,
-  pkg-config,
-  python3Packages,
-  wrapGAppsHook4,
-}:
-
-python3Packages.buildPythonApplication rec {
-  pname = "imaginer";
-  version = "0.1.3";
-
-  src = fetchFromGitHub {
-    owner = "ImaginerApp";
-    repo = "Imaginer";
-    rev = "v${version}";
-    hash = "sha256-x1ZnmfaMfxnITiuFDlMPfTU8KZbd1ME9jDevnlsrbJs=";
-  };
-
-  format = "other";
-  dontWrapGApps = true;
-
-  nativeBuildInputs = [
-    appstream-glib
-    blueprint-compiler
-    desktop-file-utils
-    gettext
-    glib
-    gobject-introspection
-    meson
-    ninja
-    pkg-config
-    wrapGAppsHook4
-  ];
-
-  buildInputs = [
-    libadwaita
-    libsoup_3
-  ];
-
-  propagatedBuildInputs = with python3Packages; [
-    openai
-    pillow
-    pygobject3
-    requests
-  ];
-
-  preFixup = ''
-    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
-  '';
-
-  meta = with lib; {
-    homepage = "https://github.com/ImaginerApp/Imaginer";
-    description = "AI image generator for GNOME";
-    mainProgram = "imaginer";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ _0xMRTT ];
-  };
-}
diff --git a/pkgs/by-name/je/jellyfin-tui/package.nix b/pkgs/by-name/je/jellyfin-tui/package.nix
index 0c6b659a011e2..5b7840e4b4a65 100644
--- a/pkgs/by-name/je/jellyfin-tui/package.nix
+++ b/pkgs/by-name/je/jellyfin-tui/package.nix
@@ -43,6 +43,10 @@ rustPlatform.buildRustPackage rec {
   '';
   doInstallCheck = true;
 
+  postInstall = lib.optionalString stdenv.hostPlatform.isLinux ''
+    install -Dm644 src/extra/jellyfin-tui.desktop $out/share/applications/jellyfin-tui.desktop
+  '';
+
   passthru.updateScript = nix-update-script { };
 
   meta = {
diff --git a/pkgs/by-name/re/release-plz/package.nix b/pkgs/by-name/re/release-plz/package.nix
index 84ffbab32ec66..535fdaea13a87 100644
--- a/pkgs/by-name/re/release-plz/package.nix
+++ b/pkgs/by-name/re/release-plz/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "release-plz";
-  version = "0.3.139";
+  version = "0.3.140";
 
   src = fetchFromGitHub {
     owner = "MarcoIeni";
     repo = "release-plz";
     rev = "release-plz-v${version}";
-    hash = "sha256-s2PvMJu0RLO2AOMMonq4xdZlQXHrvKoqh4v9tp72Ud0=";
+    hash = "sha256-pJHyf1aSn4YqzFYW6otuRY+gJ6TBCKFGQuH2Py5uWlE=";
   };
 
-  cargoHash = "sha256-S5YhAcEhTbiM0VCAy3IiObc1uCPbsIi0QqeFxocVqw4=";
+  cargoHash = "sha256-LfadgdrGD9g/PNeFs/XNUk2x0h1i3znzMhIV+w1DjMk=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/si/simplotask/package.nix b/pkgs/by-name/si/simplotask/package.nix
index 66c0d21ebe0dd..d98b732ee1282 100644
--- a/pkgs/by-name/si/simplotask/package.nix
+++ b/pkgs/by-name/si/simplotask/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "simplotask";
-  version = "1.17.2";
+  version = "1.18.0";
 
   src = fetchFromGitHub {
     owner = "umputun";
     repo = "spot";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7EavT4IHEAe3nq6tkhX7qHpDzy7UTdBMZ7x/bquv4Z8=";
+    hash = "sha256-0XAxjh9TWMqMkeSEhdgXX9DflHnT40f7VkHgp1QjQUg=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ta/tageditor/package.nix b/pkgs/by-name/ta/tageditor/package.nix
index f0babd818ed28..de03722f3c4ea 100644
--- a/pkgs/by-name/ta/tageditor/package.nix
+++ b/pkgs/by-name/ta/tageditor/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tageditor";
-  version = "3.9.5";
+  version = "3.9.6";
 
   src = fetchFromGitHub {
     owner = "martchus";
     repo = "tageditor";
     tag = "v${version}";
-    hash = "sha256-Sia6Y/V81WQj4oWjZAAR4o3TngfWq7sWxxiKEuFjQ2M=";
+    hash = "sha256-weGLC8TPSA9XQ/TuLj4DBswmlEbpxPplsxI4sqygHfU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/tf/tfmigrate/package.nix b/pkgs/by-name/tf/tfmigrate/package.nix
index 0b8ba744f031f..54460e85527c4 100644
--- a/pkgs/by-name/tf/tfmigrate/package.nix
+++ b/pkgs/by-name/tf/tfmigrate/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "tfmigrate";
-  version = "0.4.2";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "minamijoyo";
     repo = "tfmigrate";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+5nw+EgFTor8XL4cibxkpJL4fdEQ6UuEj5wyOjpaANA=";
+    hash = "sha256-tuLbcxJj8TsG3I/o3cHO2DtQm9ql3wlhYBtYiMbRW7o=";
   };
 
-  vendorHash = "sha256-mm34U4nLow4lCz/AgfqYZJRb71GpQjR14+tm0hfmdDc=";
+  vendorHash = "sha256-TqZi5NZ+4eSzq98/ZM4Gab7Sud7bz1DNHrp5nGaGHDE=";
 
   checkFlags = [
     "-skip TestExecutorDir" # assumes /usr/bin to be present
diff --git a/pkgs/by-name/ur/urlwatch/package.nix b/pkgs/by-name/ur/urlwatch/package.nix
index 972cd24c1cfde..73429bad880c4 100644
--- a/pkgs/by-name/ur/urlwatch/package.nix
+++ b/pkgs/by-name/ur/urlwatch/package.nix
@@ -12,22 +12,26 @@ python3Packages.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "thp";
     repo = "urlwatch";
-    rev = version;
+    tag = version;
     hash = "sha256-X1UR9JrQuujOIUg87W0YqfXsM3A5nttWjjJMIe3hgk8=";
   };
 
   build-system = with python3Packages; [ setuptools ];
 
   dependencies = with python3Packages; [
+    aioxmpp
+    beautifulsoup4
+    cssbeautifier
     cssselect
     jq
+    jsbeautifier
     keyring
     lxml
     markdown2
     matrix-client
     minidb
-    playwright
     platformdirs
+    playwright
     pushbullet-py
     pycodestyle
     pyyaml
@@ -41,12 +45,13 @@ python3Packages.buildPythonApplication rec {
 
   meta = with lib; {
     description = "Tool for monitoring webpages for updates";
-    mainProgram = "urlwatch";
     homepage = "https://thp.io/2008/urlwatch/";
+    changelog = "https://github.com/thp/urlwatch/blob/${src.tag}/CHANGELOG.md";
     license = licenses.bsd3;
     maintainers = with maintainers; [
       kmein
       tv
     ];
+    mainProgram = "urlwatch";
   };
 }
diff --git a/pkgs/by-name/wa/waytrogen/package.nix b/pkgs/by-name/wa/waytrogen/package.nix
index 27aec72ba5b3c..922b7e0e19e42 100644
--- a/pkgs/by-name/wa/waytrogen/package.nix
+++ b/pkgs/by-name/wa/waytrogen/package.nix
@@ -16,19 +16,19 @@
   desktop-file-utils,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "waytrogen";
   version = "0.7.3";
 
   src = fetchFromGitHub {
     owner = "nikolaizombie1";
     repo = "waytrogen";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-vFzOGadWR5xwhIKrKPHoAHstoeyFw4GrS5aYlpvEF5E=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
+    inherit (finalAttrs) pname version src;
     hash = "sha256-k6n6aWEJ/8Dkbd68CJfJ7kbRTltCuQ4AtZ5dALFD3lU=";
   };
 
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
       in the Rust 🦀 programming language. Supports hyprpaper, swaybg, mpvpaper and swww wallpaper changers.
     '';
     homepage = "https://github.com/nikolaizombie1/waytrogen";
-    changelog = "https://github.com/nikolaizombie1/waytrogen/releases/tag/${version}";
+    changelog = "https://github.com/nikolaizombie1/waytrogen/releases/tag/${finalAttrs.version}";
     license = lib.licenses.unlicense;
     maintainers = with lib.maintainers; [
       genga898
@@ -76,4 +76,4 @@ stdenv.mkDerivation rec {
     mainProgram = "waytrogen";
     platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/zi/zizmor/package.nix b/pkgs/by-name/zi/zizmor/package.nix
index cde6a31644789..0ce9a1fd6dade 100644
--- a/pkgs/by-name/zi/zizmor/package.nix
+++ b/pkgs/by-name/zi/zizmor/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zizmor";
-  version = "1.11.0";
+  version = "1.12.1";
 
   src = fetchFromGitHub {
     owner = "zizmorcore";
     repo = "zizmor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zxEF76zpqwLroC5GjSkwIC3+XdXmErvabIEqhVe0zCA=";
+    hash = "sha256-GnKSbcsVYzbhsrwIUAEArltzQe0IE2tiIr2CqsMQyzk=";
   };
 
-  cargoHash = "sha256-vxDyao9pX/CfS08vFmq3vXtgDIg5NXlEwpzroGW48dA=";
+  cargoHash = "sha256-wLJlaV59sAo97KI6Ekw42aaG6hVkul1wFvcC+71+Zp4=";
 
   nativeBuildInputs = lib.optionals (stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
     installShellFiles
diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index d20085c940143..0478e9bd4c855 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -86,4 +86,4 @@ let
 
   llvmPackages = lib.mapAttrs' (version: args: mkPackage (args // { inherit version; })) versions;
 in
-llvmPackages // { inherit mkPackage; }
+llvmPackages // { inherit mkPackage versions; }
diff --git a/pkgs/development/python-modules/click-shell/default.nix b/pkgs/development/python-modules/click-shell/default.nix
index fa95216a32672..5f4536439d3eb 100644
--- a/pkgs/development/python-modules/click-shell/default.nix
+++ b/pkgs/development/python-modules/click-shell/default.nix
@@ -5,14 +5,15 @@
   click,
   pytestCheckHook,
   pytest-click,
+  setuptools,
+  writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage rec {
   pname = "click-shell";
   version = "2.1";
-  format = "setuptools";
+  pyproject = true;
 
-  # PyPi release is missing tests
   src = fetchFromGitHub {
     owner = "clarkperkins";
     repo = "click-shell";
@@ -20,17 +21,18 @@ buildPythonPackage rec {
     hash = "sha256-4QpQzg0yFuOFymGiTI+A8o6LyX78iTJMqr0ernYbilI=";
   };
 
-  propagatedBuildInputs = [ click ];
+  build-system = [ setuptools ];
+
+  dependencies = [ click ];
 
   nativeCheckInputs = [
     pytest-click
     pytestCheckHook
+    writableTmpDirAsHomeHook
   ];
 
   pythonImportsCheck = [ "click_shell" ];
 
-  preCheck = "export HOME=$(mktemp -d)";
-
   meta = with lib; {
     description = "Extension to click that easily turns your click app into a shell utility";
     longDescription = ''
@@ -40,6 +42,7 @@ buildPythonPackage rec {
       with command completion to any click app.
     '';
     homepage = "https://github.com/clarkperkins/click-shell";
+    changelog = "https://github.com/clarkperkins/click-shell/releases/tag/${src.tag}";
     license = licenses.bsd3;
     maintainers = with maintainers; [ binsky ];
   };
diff --git a/pkgs/development/python-modules/ecpy/default.nix b/pkgs/development/python-modules/ecpy/default.nix
index da36c1c3c8654..4303f4806d445 100644
--- a/pkgs/development/python-modules/ecpy/default.nix
+++ b/pkgs/development/python-modules/ecpy/default.nix
@@ -2,26 +2,21 @@
   lib,
   fetchPypi,
   buildPythonPackage,
-  isPy3k,
-  future,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "ecpy";
   version = "1.2.5";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     pname = "ECPy";
     inherit version;
-    sha256 = "9635cffb9b6ecf7fd7f72aea1665829ac74a1d272006d0057d45a621aae20228";
+    hash = "sha256-ljXP+5tuz3/X9yrqFmWCmsdKHScgBtAFfUWmIariAig=";
   };
 
-  prePatch = ''
-    sed -i "s|reqs.append('future')|pass|" setup.py
-  '';
-
-  propagatedBuildInputs = lib.optional (!isPy3k) future;
+  build-system = [ setuptools ];
 
   # No tests implemented
   doCheck = false;
@@ -31,6 +26,8 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Pure Pyhton Elliptic Curve Library";
     homepage = "https://github.com/ubinity/ECPy";
+    changelog = "https://github.com/cslashm/ECPy/releases/tag/${version}";
     license = licenses.asl20;
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/jsonargparse/default.nix b/pkgs/development/python-modules/jsonargparse/default.nix
index 90588f7b68643..f1c6e76b41a32 100644
--- a/pkgs/development/python-modules/jsonargparse/default.nix
+++ b/pkgs/development/python-modules/jsonargparse/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "jsonargparse";
-  version = "4.40.1";
+  version = "4.40.2";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "omni-us";
     repo = "jsonargparse";
     tag = "v${version}";
-    hash = "sha256-GxltSN1o7vAZQXrejpBp5YMqOQaln8pqKxmGNa0vA/Q=";
+    hash = "sha256-3Zs2F46tGcvIF9UOGI/P079BZLJJyEyP9LDPRfvSk4E=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/netdisco/default.nix b/pkgs/development/python-modules/netdisco/default.nix
index db1d17de07caf..3b90aaed74b44 100644
--- a/pkgs/development/python-modules/netdisco/default.nix
+++ b/pkgs/development/python-modules/netdisco/default.nix
@@ -1,26 +1,26 @@
 {
   lib,
   buildPythonPackage,
-  isPy3k,
   fetchPypi,
+  pytestCheckHook,
   requests,
+  setuptools,
   zeroconf,
-  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "netdisco";
   version = "3.0.0";
-  format = "setuptools";
-
-  disabled = !isPy3k;
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-TbtZBILzd8zEYeAXQnB8y+jx0tGyhXivkdybf+vNy9I=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     requests
     zeroconf
   ];
diff --git a/pkgs/development/python-modules/nox/default.nix b/pkgs/development/python-modules/nox/default.nix
index f419359780c62..159c0feee12b0 100644
--- a/pkgs/development/python-modules/nox/default.nix
+++ b/pkgs/development/python-modules/nox/default.nix
@@ -1,17 +1,26 @@
 {
   lib,
-  argcomplete,
-  attrs,
   buildPythonPackage,
-  colorlog,
-  dependency-groups,
   fetchFromGitHub,
+  pythonOlder,
+
+  # build-system
   hatchling,
+
+  # dependencies
+  attrs,
+  argcomplete,
+  colorlog,
+  dependency-groups,
   jinja2,
   packaging,
-  pytestCheckHook,
-  pythonOlder,
   tomli,
+
+  # tests
+  pytestCheckHook,
+  writableTmpDirAsHomeHook,
+
+  # passthru
   tox,
   uv,
   virtualenv,
@@ -22,7 +31,7 @@ buildPythonPackage rec {
   version = "2025.05.01";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
+  disabled = pythonOlder "3.12";
 
   src = fetchFromGitHub {
     owner = "wntrblm";
@@ -40,8 +49,7 @@ buildPythonPackage rec {
     dependency-groups
     packaging
     virtualenv
-  ]
-  ++ lib.optionals (pythonOlder "3.11") [
+  ] ++ lib.optionals (pythonOlder "3.11") [
     tomli
   ];
 
@@ -53,22 +61,20 @@ buildPythonPackage rec {
     uv = [ uv ];
   };
 
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  preCheck = ''
-    export HOME=$(mktemp -d)
-  '';
+  nativeCheckInputs = [
+    pytestCheckHook
+    writableTmpDirAsHomeHook
+  ];
 
   pythonImportsCheck = [ "nox" ];
 
   disabledTests = [
-    # our conda is not available on 3.11
-    "test__create_venv_options"
     # Assertion errors
     "test_uv"
-    # calls to naked python
-    "test_noxfile_script_mode"
+    # Test requires network access
     "test_noxfile_script_mode_url_req"
+    # Don't test CLi mode
+    "test_noxfile_script_mode"
   ];
 
   disabledTestPaths = [
@@ -76,12 +82,12 @@ buildPythonPackage rec {
     "tests/test_tox_to_nox.py"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Flexible test automation for Python";
     homepage = "https://nox.thea.codes/";
     changelog = "https://github.com/wntrblm/nox/blob/${src.tag}/CHANGELOG.md";
-    license = licenses.asl20;
-    maintainers = with maintainers; [
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
       doronbehar
       fab
     ];
diff --git a/pkgs/development/python-modules/pyftdi/default.nix b/pkgs/development/python-modules/pyftdi/default.nix
index b775d1b21eade..c95c9fea7ffb5 100644
--- a/pkgs/development/python-modules/pyftdi/default.nix
+++ b/pkgs/development/python-modules/pyftdi/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pyftdi";
-  version = "0.56.0";
+  version = "0.57.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "eblot";
     repo = "pyftdi";
     tag = "v${version}";
-    hash = "sha256-/MwgBqwN7xmZepdJzyRhZflbCUpGdWEbEGGKkBnKTFI=";
+    hash = "sha256-RkZXcGvCZXmFrLvj7YqHc6FeZskEqMSQcYgizBSuwIk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyhomematic/default.nix b/pkgs/development/python-modules/pyhomematic/default.nix
index 8b6b6e68627c7..a6cd5f14e724f 100644
--- a/pkgs/development/python-modules/pyhomematic/default.nix
+++ b/pkgs/development/python-modules/pyhomematic/default.nix
@@ -1,32 +1,31 @@
 {
   lib,
   buildPythonPackage,
-  isPy3k,
+  setuptools,
   fetchPypi,
-  python,
+  unittestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "pyhomematic";
   version = "0.1.78";
-  format = "setuptools";
-
-  disabled = !isPy3k;
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
     hash = "sha256-uB9aDa1urIwL2DBdBwPi0sHWPW7SUZ3EaAjuMLSOudc=";
   };
 
-  checkPhase = ''
-    ${python.interpreter} -m unittest
-  '';
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [ unittestCheckHook ];
 
   pythonImportsCheck = [ "pyhomematic" ];
 
   meta = with lib; {
     description = "Python 3 Interface to interact with Homematic devices";
     homepage = "https://github.com/danielperna84/pyhomematic";
+    changelog = "https://github.com/danielperna84/pyhomematic/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ dotlambda ];
   };
diff --git a/pkgs/development/python-modules/pynamecheap/default.nix b/pkgs/development/python-modules/pynamecheap/default.nix
index 658ff62a5d266..4ab6da4a25a91 100644
--- a/pkgs/development/python-modules/pynamecheap/default.nix
+++ b/pkgs/development/python-modules/pynamecheap/default.nix
@@ -3,28 +3,35 @@
   buildPythonPackage,
   fetchFromGitHub,
   requests,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "pynamecheap";
   version = "0.0.3";
-  format = "setuptools";
-
-  propagatedBuildInputs = [ requests ];
-
-  # Tests require access to api.sandbox.namecheap.com
-  doCheck = false;
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Bemmu";
     repo = "PyNamecheap";
-    rev = "v${version}";
-    sha256 = "1g1cd2yc6rpdsc5ax7s93y5nfkf91gcvbgcaqyl9ida6srd9hr97";
+    tag = "v${version}";
+    hash = "sha256-J2WYWtZGtZiox4q9tdkLyU1nix9Jn64K0+1mw7xoLLw=";
   };
 
+  build-system = [ setuptools ];
+
+  dependencies = [ requests ];
+
+  # Tests require access to api.sandbox.namecheap.com
+  doCheck = false;
+
+  pythonImportsCheck = [ "namecheap" ];
+
   meta = with lib; {
     description = "Namecheap API client in Python";
     homepage = "https://github.com/Bemmu/PyNamecheap";
+    changelog = "https://github.com/Bemmu/PyNamecheap/releases/tag/${src.tag}";
     license = licenses.mit;
+    maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/pynanoleaf/default.nix b/pkgs/development/python-modules/pynanoleaf/default.nix
index 892900c118ba5..113818784680f 100644
--- a/pkgs/development/python-modules/pynanoleaf/default.nix
+++ b/pkgs/development/python-modules/pynanoleaf/default.nix
@@ -2,23 +2,23 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  isPy3k,
   requests,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "pynanoleaf";
   version = "0.1.1";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "32a083759c4f99e019e0013670487841f8edf807c7a07742a971fa18707072a7";
+    hash = "sha256-MqCDdZxPmeAZ4AE2cEh4Qfjt+AfHoHdCqXH6GHBwcqc=";
   };
 
-  disabled = !isPy3k;
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [ requests ];
+  dependencies = [ requests ];
 
   # pynanoleaf does not contain tests
   doCheck = false;
@@ -26,8 +26,9 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "pynanoleaf" ];
 
   meta = with lib; {
-    homepage = "https://github.com/Oro/pynanoleaf";
     description = "Python3 wrapper for the Nanoleaf API, capable of controlling both Nanoleaf Aurora and Nanoleaf Canvas";
+    homepage = "https://github.com/Oro/pynanoleaf";
+    changelog = "https://github.com/Oro/pynanoleaf/releases/tag/${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ oro ];
   };
diff --git a/pkgs/development/python-modules/sqlfmt/default.nix b/pkgs/development/python-modules/sqlfmt/default.nix
index 709a4746c8c9d..2f1dff47901a5 100644
--- a/pkgs/development/python-modules/sqlfmt/default.nix
+++ b/pkgs/development/python-modules/sqlfmt/default.nix
@@ -5,15 +5,14 @@
   click,
   fetchFromGitHub,
   gitpython,
-  importlib-metadata,
   jinja2,
   platformdirs,
   poetry-core,
   pytest-asyncio,
   pytestCheckHook,
   pythonOlder,
-  tomli,
   tqdm,
+  writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage rec {
@@ -21,7 +20,7 @@ buildPythonPackage rec {
   version = "0.27.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
+  disabled = pythonOlder "3.12";
 
   src = fetchFromGitHub {
     owner = "tconbeer";
@@ -30,16 +29,12 @@ buildPythonPackage rec {
     hash = "sha256-Yel9SB7KrDqtuZxNx4omz6u4AID8Fk5kFYKBEZD1fuU=";
   };
 
-  pythonRelaxDeps = [ "platformdirs" ];
-
   build-system = [ poetry-core ];
 
   dependencies = [
     click
-    importlib-metadata
     jinja2
     platformdirs
-    tomli
     tqdm
   ];
 
@@ -51,11 +46,11 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytest-asyncio
     pytestCheckHook
+    writableTmpDirAsHomeHook
   ]
   ++ lib.flatten (builtins.attrValues optional-dependencies);
 
   preCheck = ''
-    export HOME=$(mktemp -d)
     export PATH="$PATH:$out/bin";
   '';
 
diff --git a/pkgs/development/python-modules/sunwatcher/default.nix b/pkgs/development/python-modules/sunwatcher/default.nix
index 0fcac2bfb205f..9729093eec663 100644
--- a/pkgs/development/python-modules/sunwatcher/default.nix
+++ b/pkgs/development/python-modules/sunwatcher/default.nix
@@ -4,21 +4,22 @@
   fetchPypi,
   pythonOlder,
   requests,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "sunwatcher";
   version = "0.2.1";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.6";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "0swmvmmbfb914k473yv3fc4zizy2abq2qhd7h6lixli11l5wfjxv";
+    hash = "sha256-u0vHCw0h0h6pgadBLPBSwv/4CXNj+3HIJCEtt2rdlWs=";
   };
 
-  propagatedBuildInputs = [ requests ];
+  build-system = [ setuptools ];
+
+  dependencies = [ requests ];
 
   # Project has no tests
   doCheck = false;
@@ -28,7 +29,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module for the SolarLog HTTP API";
     homepage = "https://bitbucket.org/Lavode/sunwatcher/src/master/";
-    license = with licenses; [ asl20 ];
+    license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/timetagger/default.nix b/pkgs/development/python-modules/timetagger/default.nix
index ae02585f8ba06..af3444f39a1de 100644
--- a/pkgs/development/python-modules/timetagger/default.nix
+++ b/pkgs/development/python-modules/timetagger/default.nix
@@ -12,17 +12,16 @@
   pscript,
   pyjwt,
   pytestCheckHook,
-  pythonOlder,
   requests,
+  setuptools,
   uvicorn,
+  writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage rec {
   pname = "timetagger";
   version = "25.06.1";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.6";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "almarklein";
@@ -31,7 +30,9 @@ buildPythonPackage rec {
     hash = "sha256-fuZj4DoqtgIcRd/u7l0GsWqmuLEgF3BW5gN5wY8FdK0=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     asgineer
     bcrypt
     iptools
@@ -43,22 +44,21 @@ buildPythonPackage rec {
     uvicorn
   ];
 
-  preCheck = ''
-    export HOME=$(mktemp -d)
-  '';
-
   nativeCheckInputs = [
     nodejs
     pytestCheckHook
     requests
+    writableTmpDirAsHomeHook
   ];
 
-  meta = with lib; {
+  pythonImportsCheck = [ "timetagger" ];
+
+  meta = {
     description = "Library to interact with TimeTagger";
-    mainProgram = "timetagger";
     homepage = "https://github.com/almarklein/timetagger";
     changelog = "https://github.com/almarklein/timetagger/releases/tag/${src.tag}";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ matthiasbeyer ];
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ matthiasbeyer ];
+    mainProgram = "timetagger";
   };
 }
diff --git a/pkgs/development/python-modules/vultr/default.nix b/pkgs/development/python-modules/vultr/default.nix
index 4e10e0144243e..79c4f10607224 100644
--- a/pkgs/development/python-modules/vultr/default.nix
+++ b/pkgs/development/python-modules/vultr/default.nix
@@ -3,21 +3,24 @@
   buildPythonPackage,
   fetchFromGitHub,
   requests,
+  setuptools,
 }:
 
 buildPythonPackage rec {
-  version = "1.0.1";
-  format = "setuptools";
   pname = "vultr";
+  version = "1.0.1";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "spry-group";
     repo = "python-vultr";
-    rev = "v${version}";
-    sha256 = "00lc5hdhchvm0472p03019bp9541d8y2773xkjy8vblq9qhys8q7";
+    tag = "v${version}";
+    hash = "sha256-ByPtIU6Yro28nH2cIzxqgZR0VwpggCsOAXVDBhssjAI=";
   };
 
-  propagatedBuildInputs = [ requests ];
+  build-system = [ setuptools ];
+
+  dependencies = [ requests ];
 
   # Tests disabled. They fail because they try to access the network
   doCheck = false;
@@ -27,6 +30,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Vultr.com API Client";
     homepage = "https://github.com/spry-group/python-vultr";
+    changelog = "https://github.com/spry-group/python-vultr/releases/tag/${src.tag}";
     license = licenses.mit;
     maintainers = with maintainers; [ lihop ];
   };
diff --git a/pkgs/servers/http/nginx/mainline.nix b/pkgs/servers/http/nginx/mainline.nix
index e4ece30ec3740..dece0210839e7 100644
--- a/pkgs/servers/http/nginx/mainline.nix
+++ b/pkgs/servers/http/nginx/mainline.nix
@@ -1,6 +1,6 @@
 { callPackage, ... }@args:
 
 callPackage ./generic.nix args {
-  version = "1.27.5";
-  hash = "sha256-6WrOu5wqbbigAMPdGzLsuhuBDwzVhiMtTZIeN2Z03Q4=";
+  version = "1.29.1";
+  hash = "sha256-xYn35+2AHdvZBK+/PeJq4k6wzOJ8dxei6U33+xLWrSc=";
 }
diff --git a/pkgs/servers/spicedb/default.nix b/pkgs/servers/spicedb/default.nix
index 5cbd2033445ee..57584d390e71d 100644
--- a/pkgs/servers/spicedb/default.nix
+++ b/pkgs/servers/spicedb/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "spicedb";
-  version = "1.45.1";
+  version = "1.45.2";
 
   src = fetchFromGitHub {
     owner = "authzed";
     repo = "spicedb";
     rev = "v${version}";
-    hash = "sha256-cKCAA9C0vsCa0BszspvPfrKbdWyaccrMtiO6UWhLIh4=";
+    hash = "sha256-LDAZdcUfrCWtld6V4GDpAbK+BeT/aeVOQ7G++sMoXU4=";
   };
 
-  vendorHash = "sha256-R4lOmHIBgnlvOukMjXdVx5e9Oneo1EizhsrDXiTbwTc=";
+  vendorHash = "sha256-hr+xIfPjlrH9igRsYeqNOPgx/jWhDfu73gA+/NoWWxI=";
 
   ldflags = [
     "-X 'github.com/jzelinskie/cobrautil/v2.Version=${src.rev}'"
diff --git a/pkgs/tools/filesystems/kdiskmark/default.nix b/pkgs/tools/filesystems/kdiskmark/default.nix
index 2f9f09fdc9d37..c401567ed9b41 100644
--- a/pkgs/tools/filesystems/kdiskmark/default.nix
+++ b/pkgs/tools/filesystems/kdiskmark/default.nix
@@ -6,19 +6,19 @@
   qttools,
   fio,
   cmake,
-  polkit-qt,
+  polkit-qt-1,
   extra-cmake-modules,
   fetchFromGitHub,
 }:
 stdenv.mkDerivation rec {
   pname = "kdiskmark";
-  version = "3.1.4";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "jonmagon";
     repo = "kdiskmark";
     rev = version;
-    hash = "sha256-JueY7zw9PIo9ETi7pQLpw8FGRhNXYXeXEvTzZGz9lbw=";
+    hash = "sha256-b42PNUrG10RyGct6dPtdT89oO222tEovkSPoRcROfaQ=";
     fetchSubmodules = true;
   };
 
@@ -31,12 +31,12 @@ stdenv.mkDerivation rec {
   buildInputs = [
     qtbase
     qttools
-    polkit-qt
+    polkit-qt-1
   ];
 
   preConfigure = ''
     substituteInPlace CMakeLists.txt \
-      --replace \$\{POLKITQT-1_POLICY_FILES_INSTALL_DIR\} $out/share/polkit-1/actions
+      --replace-fail \$\{POLKITQT-1_POLICY_FILES_INSTALL_DIR\} $out/share/polkit-1/actions
   '';
 
   qtWrapperArgs = [
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 6ef821fdd2657..f86b74337d906 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1154,6 +1154,7 @@ mapAliases {
   imagemagick7Big = throw "'imagemagick7Big' has been renamed to/replaced by 'imagemagickBig'"; # Converted to throw 2024-10-17
   imagemagick7 = throw "'imagemagick7' has been renamed to/replaced by 'imagemagick'"; # Converted to throw 2024-10-17
   imagemagick7_light = throw "'imagemagick7_light' has been renamed to/replaced by 'imagemagick_light'"; # Converted to throw 2024-10-17
+  imaginer = throw "'imaginer' has been removed due to lack of upstream maintenance"; # Added 2025-08-15
   immersed-vr = lib.warnOnInstantiate "'immersed-vr' has been renamed to 'immersed'" immersed; # Added 2024-08-11
   inconsolata-nerdfont = lib.warnOnInstantiate "inconsolata-nerdfont is redundant. Use nerd-fonts.inconsolata instead." nerd-fonts.inconsolata; # Added 2024-11-10
   incrtcl = tclPackages.incrtcl; # Added 2024-10-02
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b85fbca632bba..f896f92bb55c2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3305,7 +3305,7 @@ with pkgs;
 
   kaffeine = libsForQt5.callPackage ../applications/video/kaffeine { };
 
-  kdiskmark = libsForQt5.callPackage ../tools/filesystems/kdiskmark { };
+  kdiskmark = kdePackages.callPackage ../tools/filesystems/kdiskmark { };
 
   keepkey-agent = with python3Packages; toPythonApplication keepkey-agent;