diff --git a/nixos/doc/manual/configuration/profiles/installation-device.section.md b/nixos/doc/manual/configuration/profiles/installation-device.section.md
index ae9f8fa7757f..7d8082e27557 100644
--- a/nixos/doc/manual/configuration/profiles/installation-device.section.md
+++ b/nixos/doc/manual/configuration/profiles/installation-device.section.md
@@ -14,8 +14,8 @@ NixOS manual is shown automatically on TTY 8, udisks is disabled.
 Autologin is enabled as `nixos` user, while passwordless
 login as both `root` and `nixos` is possible.
 Passwordless `sudo` is enabled too.
-[wpa_supplicant](#opt-networking.wireless.enable) is
-enabled, but configured to not autostart.
+[NetworkManager](#opt-networking.networkmanager.enable) is
+enabled and can be configured interactively with `nmtui`.
 
 It is explained how to login, start the ssh server, and if available,
 how to start the display manager.
diff --git a/nixos/doc/manual/installation/installing.chapter.md b/nixos/doc/manual/installation/installing.chapter.md
index 8ee417a108fd..4ae8bf494848 100644
--- a/nixos/doc/manual/installation/installing.chapter.md
+++ b/nixos/doc/manual/installation/installing.chapter.md
@@ -154,54 +154,13 @@ The boot process should have brought up networking (check `ip
 a`). Networking is necessary for the installer, since it will
 download lots of stuff (such as source tarballs or Nixpkgs channel
 binaries). It's best if you have a DHCP server on your network.
-Otherwise configure networking manually using `ifconfig`.
+Otherwise configure networking manually using `ip`.
 
-On the graphical installer, you can configure the network, wifi
-included, through NetworkManager. Using the `nmtui` program, you can do
-so even in a non-graphical session. If you prefer to configure the
-network manually, disable NetworkManager with
+You can configure the network, Wi-Fi included, through NetworkManager.
+Using the `nmtui` program, you can do so even in a non-graphical session.
+ If you prefer to configure the network manually, disable NetworkManager with
 `systemctl stop NetworkManager`.
 
-On the minimal installer, NetworkManager is not available, so
-configuration must be performed manually. To configure the wifi, first
-start wpa_supplicant with `sudo systemctl start wpa_supplicant`, then
-run `wpa_cli`. For most home networks, you need to type in the following
-commands:
-
-```plain
-> add_network
-0
-> set_network 0 ssid "myhomenetwork"
-OK
-> set_network 0 psk "mypassword"
-OK
-> enable_network 0
-OK
-```
-
-For enterprise networks, for example *eduroam*, instead do:
-
-```plain
-> add_network
-0
-> set_network 0 ssid "eduroam"
-OK
-> set_network 0 identity "myname@example.com"
-OK
-> set_network 0 password "mypassword"
-OK
-> enable_network 0
-OK
-```
-
-When successfully connected, you should see a line such as this one
-
-```plain
-<3>CTRL-EVENT-CONNECTED - Connection to 32:85:ab:ef:24:5c completed [id=0 id_str=]
-```
-
-you can now leave `wpa_cli` by typing `quit`.
-
 If you would like to continue the installation from a different machine
 you can use activated SSH daemon. You need to copy your ssh key to
 either `/home/nixos/.ssh/authorized_keys` or
diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 983537f73ede..5b510db17528 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -10,6 +10,8 @@
 
 - The default PostgreSQL version for new NixOS installations (i.e. with `system.stateVersion >= 25.11`) is v17.
 
+- The NetworkManager module does not ship with a default set of VPN plugins anymore. All required VPN plugins must now be explicitly configured in [`networking.networkmanager.plugins`](#opt-networking.networkmanager.plugins).
+
 ## New Modules {#sec-release-25.11-new-modules}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix b/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix
index f73617694961..37998c334e5f 100644
--- a/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix
+++ b/nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix
@@ -20,10 +20,6 @@
 
   services.xserver.enable = true;
 
-  # Provide networkmanager for easy wireless configuration.
-  networking.networkmanager.enable = true;
-  networking.wireless.enable = lib.mkImageMediaOverride false;
-
   # KDE complains if power management is disabled (to be precise, if
   # there is no power management backend such as upower).
   powerManagement.enable = true;
diff --git a/nixos/modules/installer/netboot/netboot-minimal.nix b/nixos/modules/installer/netboot/netboot-minimal.nix
index dc881a336997..59f5fb757c3b 100644
--- a/nixos/modules/installer/netboot/netboot-minimal.nix
+++ b/nixos/modules/installer/netboot/netboot-minimal.nix
@@ -11,5 +11,5 @@
   documentation.man.enable = lib.mkOverride 500 true;
   hardware.enableRedistributableFirmware = lib.mkOverride 70 false;
   system.extraDependencies = lib.mkOverride 70 [ ];
-  networking.wireless.enable = lib.mkOverride 500 false;
+  networking.networkmanager.enable = lib.mkOverride 500 false;
 }
diff --git a/nixos/modules/profiles/installation-device.nix b/nixos/modules/profiles/installation-device.nix
index 3a29f7ab8c90..375cfc7087d7 100644
--- a/nixos/modules/profiles/installation-device.nix
+++ b/nixos/modules/profiles/installation-device.nix
@@ -69,9 +69,7 @@ with lib;
         with `passwd` (prefix with `sudo` for "root"), or add your public key to
         /home/nixos/.ssh/authorized_keys or /root/.ssh/authorized_keys.
 
-        If you need a wireless connection, type
-        `sudo systemctl start wpa_supplicant` and configure a
-        network using `wpa_cli`. See the NixOS manual for details.
+        To set up a wireless connection, run `nmtui`.
       ''
       + optionalString config.services.xserver.enable ''
 
@@ -89,10 +87,8 @@ with lib;
       settings.PermitRootLogin = mkDefault "yes";
     };
 
-    # Enable wpa_supplicant, but don't start it by default.
-    networking.wireless.enable = mkDefault true;
-    networking.wireless.userControlled.enable = true;
-    systemd.services.wpa_supplicant.wantedBy = mkOverride 50 [ ];
+    # Provide networkmanager for easy network configuration.
+    networking.networkmanager.enable = true;
 
     # Tell the Nix evaluator to garbage collect more aggressively.
     # This is desirable in memory-constrained environments that don't
diff --git a/nixos/modules/services/networking/networkmanager.nix b/nixos/modules/services/networking/networkmanager.nix
index 803cc741ce15..f851f2428723 100644
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@@ -127,15 +127,20 @@ let
     '';
   };
 
+  concatPluginAttrs = attr: lib.concatMap (plugin: plugin.${attr} or [ ]) cfg.plugins;
+  pluginRuntimeDeps = concatPluginAttrs "networkManagerRuntimeDeps";
+  pluginDbusDeps = concatPluginAttrs "networkManagerDbusDeps";
+  pluginTmpfilesRules = concatPluginAttrs "networkManagerTmpfilesRules";
+
   packages =
     [
       cfg.package
     ]
     ++ cfg.plugins
+    ++ pluginRuntimeDeps
     ++ lib.optionals (!delegateWireless && !enableIwd) [
       pkgs.wpa_supplicant
     ];
-
 in
 {
 
@@ -220,30 +225,37 @@ in
         type =
           let
             networkManagerPluginPackage = types.package // {
-              description = "NetworkManager plug-in";
+              description = "NetworkManager plugin package";
               check =
                 p:
                 lib.assertMsg
                   (types.package.check p && p ? networkManagerPlugin && lib.isString p.networkManagerPlugin)
                   ''
-                    Package ‘${p.name}’, is not a NetworkManager plug-in.
+                    Package ‘${p.name}’, is not a NetworkManager plugin.
                     Those need to have a ‘networkManagerPlugin’ attribute.
                   '';
             };
           in
           types.listOf networkManagerPluginPackage;
         default = [ ];
-        description = ''
-          List of NetworkManager plug-ins to enable.
-          Some plug-ins are enabled by the NetworkManager module by default.
+        example = literalExpression ''
+          [
+            networkmanager-fortisslvpn
+            networkmanager-iodine
+            networkmanager-l2tp
+            networkmanager-openconnect
+            networkmanager-openvpn
+            networkmanager-sstp
+            networkmanager-strongswan
+            networkmanager-vpnc
+          ]
         '';
-      };
-
-      enableDefaultPlugins = mkOption {
-        type = types.bool;
-        default = true;
         description = ''
-          Enable a set of recommended plugins.
+          List of plugin packages to install.
+
+          See <https://search.nixos.org/packages?query=networkmanager-> for available plugin packages.
+          and <https://networkmanager.dev/docs/vpn/> for an overview over builtin and external plugins
+          and their support status.
         '';
       };
 
@@ -390,19 +402,6 @@ in
         '';
       };
 
-      enableStrongSwan = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Enable the StrongSwan plugin.
-
-          If you enable this option the
-          `networkmanager_strongswan` plugin will be added to
-          the {option}`networking.networkmanager.plugins` option
-          so you don't need to do that yourself.
-        '';
-      };
-
       ensureProfiles = {
         profiles =
           with lib.types;
@@ -523,6 +522,16 @@ in
       [ "networking" "networkmanager" "fccUnlockScripts" ]
       [ "networking" "modemmanager" "fccUnlockScripts" ]
     )
+    (mkRemovedOptionModule [
+      "networking"
+      "networkmanager"
+      "enableStrongSwan"
+    ] "Pass `pkgs.networkmanager-strongswan` into `networking.networkmanager.plugins` instead.")
+    (mkRemovedOptionModule [
+      "networking"
+      "networkmanager"
+      "enableDefaultPlugins"
+    ] "Configure the required plugins explicitly in `networking.networkmanager.plugins`.")
   ];
 
   ###### implementation
@@ -597,13 +606,10 @@ in
 
     systemd.tmpfiles.rules = [
       "d /etc/NetworkManager/system-connections 0700 root root -"
-      "d /etc/ipsec.d 0700 root root -"
-      "d /var/lib/NetworkManager-fortisslvpn 0700 root root -"
-
       "d /var/lib/misc 0755 root root -" # for dnsmasq.leases
       # ppp isn't able to mkdir that directory at runtime
       "d /run/pppd/lock 0700 root root -"
-    ];
+    ] ++ pluginTmpfilesRules;
 
     systemd.services.NetworkManager = {
       wantedBy = [ "multi-user.target" ];
@@ -642,6 +648,7 @@ in
       wantedBy = [ "multi-user.target" ];
       before = [ "network-online.target" ];
       after = [ "NetworkManager.service" ];
+      path = pluginRuntimeDeps;
       script =
         let
           path = id: "/run/NetworkManager/system-connections/${id}.nmconnection";
@@ -668,22 +675,6 @@ in
         useDHCP = false;
       })
 
-      (mkIf cfg.enableDefaultPlugins {
-        networkmanager.plugins = with pkgs; [
-          networkmanager-fortisslvpn
-          networkmanager-iodine
-          networkmanager-l2tp
-          networkmanager-openconnect
-          networkmanager-openvpn
-          networkmanager-vpnc
-          networkmanager-sstp
-        ];
-      })
-
-      (mkIf cfg.enableStrongSwan {
-        networkmanager.plugins = [ pkgs.networkmanager_strongswan ];
-      })
-
       (mkIf enableIwd {
         wireless.iwd.enable = true;
       })
@@ -710,11 +701,10 @@ in
     security.polkit.enable = true;
     security.polkit.extraConfig = polkitConf;
 
-    services.dbus.packages =
-      packages
-      ++ optional cfg.enableStrongSwan pkgs.strongswanNM
-      ++ optional (cfg.dns == "dnsmasq") pkgs.dnsmasq;
+    services.dbus.packages = packages ++ pluginDbusDeps ++ optional (cfg.dns == "dnsmasq") pkgs.dnsmasq;
 
     services.udev.packages = packages;
+
+    systemd.services.NetworkManager.path = pluginRuntimeDeps;
   };
 }
diff --git a/nixos/tests/seafile.nix b/nixos/tests/seafile.nix
index 85ff857535fe..c82c5cac3de8 100644
--- a/nixos/tests/seafile.nix
+++ b/nixos/tests/seafile.nix
@@ -14,7 +14,6 @@ in
   meta = with pkgs.lib.maintainers; {
     maintainers = [
       kampfschlaefer
-      schmittlauch
     ];
   };
 
diff --git a/pkgs/applications/kde/default.nix b/pkgs/applications/kde/default.nix
index 6daf57588163..eb0dcdadd900 100644
--- a/pkgs/applications/kde/default.nix
+++ b/pkgs/applications/kde/default.nix
@@ -218,7 +218,6 @@ let
       ktimer = callPackage ./ktimer.nix { };
       ktnef = callPackage ./ktnef.nix { };
       ktorrent = callPackage ./ktorrent.nix { };
-      ktouch = callPackage ./ktouch.nix { };
       kturtle = callPackage ./kturtle.nix { };
       kwalletmanager = callPackage ./kwalletmanager.nix { };
       kwave = callPackage ./kwave.nix { };
@@ -280,6 +279,7 @@ let
     }
     // lib.optionalAttrs config.allowAliases {
       k3b = throw "libsForQt5.k3b has been dropped in favor of kdePackages.k3b";
+      ktouch = throw "ktouch has been dropped due keyboard layout issues";
     };
 
 in
diff --git a/pkgs/applications/kde/ktouch.nix b/pkgs/applications/kde/ktouch.nix
deleted file mode 100644
index 6256fd174bf5..000000000000
--- a/pkgs/applications/kde/ktouch.nix
+++ /dev/null
@@ -1,69 +0,0 @@
-{
-  mkDerivation,
-  lib,
-  extra-cmake-modules,
-  kdoctools,
-  kconfig,
-  kconfigwidgets,
-  kcoreaddons,
-  kdeclarative,
-  ki18n,
-  kitemviews,
-  kcmutils,
-  kio,
-  knewstuff,
-  ktexteditor,
-  kwidgetsaddons,
-  kwindowsystem,
-  kxmlgui,
-  qtscript,
-  qtdeclarative,
-  kqtquickcharts,
-  qtx11extras,
-  qtgraphicaleffects,
-  qtxmlpatterns,
-  qtquickcontrols2,
-  xorg,
-}:
-
-mkDerivation {
-  pname = "ktouch";
-  meta = {
-    homepage = "https://apps.kde.org/ktouch/";
-    license = lib.licenses.gpl2;
-    maintainers = [ lib.maintainers.schmittlauch ];
-    description = "Touch typing tutor from the KDE software collection";
-    mainProgram = "ktouch";
-  };
-  nativeBuildInputs = [
-    extra-cmake-modules
-    kdoctools
-    qtdeclarative
-  ];
-  buildInputs = [
-    kconfig
-    kconfigwidgets
-    kcoreaddons
-    kdeclarative
-    ki18n
-    kitemviews
-    kcmutils
-    kio
-    knewstuff
-    ktexteditor
-    kwidgetsaddons
-    kwindowsystem
-    kxmlgui
-    qtscript
-    qtdeclarative
-    kqtquickcharts
-    qtx11extras
-    qtgraphicaleffects
-    qtxmlpatterns
-    qtquickcontrols2
-    xorg.libxkbfile
-    xorg.libxcb
-  ];
-
-  enableParallelBuilding = true;
-}
diff --git a/pkgs/applications/misc/googleearth-pro/default.nix b/pkgs/applications/misc/googleearth-pro/default.nix
index 2b835255412d..078fb5c79689 100644
--- a/pkgs/applications/misc/googleearth-pro/default.nix
+++ b/pkgs/applications/misc/googleearth-pro/default.nix
@@ -37,6 +37,14 @@ let
       "amd64"
     else
       throw "Unsupported system ${stdenv.hostPlatform.system} ";
+
+  libxml2' = libxml2.overrideAttrs rec {
+    version = "2.13.8";
+    src = fetchurl {
+      url = "mirror://gnome/sources/libxml2/${lib.versions.majorMinor version}/libxml2-${version}.tar.xz";
+      hash = "sha256-J3KUyzMRmrcbK8gfL0Rem8lDW4k60VuyzSsOhZoO6Eo=";
+    };
+  };
 in
 mkDerivation rec {
   pname = "googleearth-pro";
@@ -70,7 +78,7 @@ mkDerivation rec {
     libXrender
     libproxy
     libxcb
-    libxml2
+    libxml2'
     sqlite
     zlib
     alsa-lib
@@ -81,9 +89,13 @@ mkDerivation rec {
   dontBuild = true;
 
   unpackPhase = ''
+    runHook preUnpack
+
     # deb file contains a setuid binary, so 'dpkg -x' doesn't work here
     mkdir deb
     dpkg --fsys-tarfile $src | tar --extract -C deb
+
+    runHook postUnpack
   '';
 
   installPhase = ''
diff --git a/pkgs/applications/radio/svxlink/default.nix b/pkgs/applications/radio/svxlink/default.nix
index 7eb097556736..e3db5ce7eb2f 100644
--- a/pkgs/applications/radio/svxlink/default.nix
+++ b/pkgs/applications/radio/svxlink/default.nix
@@ -40,13 +40,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "svxlink";
-  version = "25.05";
+  version = "25.05.1";
 
   src = fetchFromGitHub {
     owner = "sm0svx";
     repo = "svxlink";
     tag = version;
-    hash = "sha256-xFtfHkLnStG730o5tGATLLZvcqYYpR+7ATUdib7B2rw=";
+    hash = "sha256-OyAR/6heGX6J53p6x+ZPXY6nzSv22umMTg0ISlWcjp8=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/by-name/bi/bitsnpicas/package.nix b/pkgs/by-name/bi/bitsnpicas/package.nix
new file mode 100644
index 000000000000..bd168a684389
--- /dev/null
+++ b/pkgs/by-name/bi/bitsnpicas/package.nix
@@ -0,0 +1,105 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  jdk,
+  jre,
+  zip,
+  makeWrapper,
+  desktop-file-utils,
+  spleen,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "bitsnpicas";
+  version = "2.1";
+
+  src = fetchFromGitHub {
+    owner = "kreativekorp";
+    repo = "bitsnpicas";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-hw7UuzesqpmnTjgpfikAIYyY70ni7BxjaUtHAPEdkXI=";
+  };
+
+  nativeBuildInputs =
+    [
+      jdk
+      zip
+      makeWrapper
+    ]
+    ++ lib.optionals stdenvNoCC.hostPlatform.isLinux [
+      desktop-file-utils
+    ];
+
+  sourceRoot = "${finalAttrs.src.name}/main/java/BitsNPicas";
+
+  installPhase =
+    ''
+      runHook preInstall
+
+      install -Dm444 BitsNPicas.jar "$out/share/java/bitsnpicas.jar"
+      install -Dm444 MapEdit.jar "$out/share/java/mapedit.jar"
+      install -Dm444 KeyEdit.jar "$out/share/java/keyedit.jar"
+
+      makeWrapper "${jre}/bin/java" "$out/bin/bitsnpicas" \
+        --add-flags "-jar $out/share/java/bitsnpicas.jar"
+      makeWrapper "${jre}/bin/java" "$out/bin/mapedit" \
+        --add-flags "-jar $out/share/java/mapedit.jar"
+      makeWrapper "${jre}/bin/java" "$out/bin/keyedit" \
+        --add-flags "-jar $out/share/java/keyedit.jar"
+
+      install -Dm444 dep/bitsnpicas.png "$out/share/icons/hicolor/128x128/apps/bitsnpicas.png"
+      install -Dm444 dep/kbnp-icon.png "$out/share/icons/hicolor/512x512/apps/bitsnpicas.png"
+      install -Dm444 dep/mapedit-icon.png "$out/share/icons/hicolor/512x512/apps/mapedit.png"
+      install -Dm444 dep/keyedit-icon.png "$out/share/icons/hicolor/256x256/apps/keyedit.png"
+    ''
+    + lib.optionalString stdenvNoCC.hostPlatform.isLinux ''
+      mkdir -p "$out/share/applications/"
+      cp dep/*.desktop "$out/share/applications/"
+    ''
+    + ''
+      runHook postInstall
+    '';
+
+  postFixup = lib.optionalString stdenvNoCC.hostPlatform.isLinux ''
+    desktop-file-edit "$out/share/applications/bitsnpicas.desktop" \
+      --set-key='Exec' --set-value='bitsnpicas edit %F' \
+      --set-key='Icon' --set-value='bitsnpicas' \
+      --set-key='StartupWMClass' --set-value='com-kreative-bitsnpicas-main-Main'
+    desktop-file-edit "$out/share/applications/mapedit.desktop" \
+      --set-key='Exec' --set-value='mapedit %F' \
+      --set-key='Icon' --set-value='mapedit' \
+      --set-key='StartupWMClass' --set-value='com-kreative-mapedit-Main'
+    desktop-file-edit "$out/share/applications/keyedit.desktop" \
+      --set-key='Exec' --set-value='keyedit %F' \
+      --set-key='Icon' --set-value='keyedit' \
+      --set-key='StartupWMClass' --set-value='com-kreative-keyedit-Main'
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    "$out/bin/bitsnpicas" convertbitmap -f psf "${spleen}/share/fonts/misc/spleen-8x16.bdf"
+    [[ -f Spleen.psf ]]
+
+    runHook postInstallCheck
+  '';
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Bitmap and emoji font creation and conversion tools";
+    homepage = "https://github.com/kreativekorp/bitsnpicas";
+    # Written in https://github.com/kreativekorp/bitsnpicas/blob/v2.1/main/java/BitsNPicas/LICENSE
+    license = lib.licenses.mpl11;
+    mainProgram = "bitsnpicas";
+    maintainers = with lib.maintainers; [
+      kachick
+    ];
+    platforms = lib.lists.unique (jdk.meta.platforms ++ lib.platforms.windows);
+  };
+})
diff --git a/pkgs/by-name/bu/burpsuite/package.nix b/pkgs/by-name/bu/burpsuite/package.nix
index fe76eff92b0b..c1045518f025 100644
--- a/pkgs/by-name/bu/burpsuite/package.nix
+++ b/pkgs/by-name/bu/burpsuite/package.nix
@@ -9,20 +9,20 @@
 }:
 
 let
-  version = "2025.6.1";
+  version = "2025.6.2";
 
   product =
     if proEdition then
       {
         productName = "pro";
         productDesktop = "Burp Suite Professional Edition";
-        hash = "sha256-At3+tScMbNrZI2qF+kwt41khou8aP5Qn33v6IT7n9HI=";
+        hash = "sha256-+MUbED8pDAPReH2KEYn/l6LlforeHPlVitI0VhPDUDw=";
       }
     else
       {
         productName = "community";
         productDesktop = "Burp Suite Community Edition";
-        hash = "sha256-1reZGan6hmXTg7RUjaian6Q5VAsR5iuye4kGWkpREM4=";
+        hash = "sha256-Jelsti5BSp4uwCRqwfaKWW15/tbINNNZwJO3lbAdVmY=";
       };
 
   src = fetchurl {
diff --git a/pkgs/by-name/cl/claude-code/package-lock.json b/pkgs/by-name/cl/claude-code/package-lock.json
index d3d947537b45..2f21cd67fdd5 100644
--- a/pkgs/by-name/cl/claude-code/package-lock.json
+++ b/pkgs/by-name/cl/claude-code/package-lock.json
@@ -6,13 +6,13 @@
   "packages": {
     "": {
       "dependencies": {
-        "@anthropic-ai/claude-code": "^1.0.38"
+        "@anthropic-ai/claude-code": "^1.0.41"
       }
     },
     "node_modules/@anthropic-ai/claude-code": {
-      "version": "1.0.38",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.38.tgz",
-      "integrity": "sha512-hPZbJCt7O8T872wbCXGiwF210DzMBo/k3EVKB6EZQB10b73ZQIEflAWGTC2ZvBcMp79qAR4F6c82V0+Cc6o0sg==",
+      "version": "1.0.41",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.41.tgz",
+      "integrity": "sha512-6E5SCb1I/pC4WCEFGwmyo4M4bL9vBuk7qkC78v9ZFX9PAxmKX94SEj422igdLeucBYX99ZqKSMYfsJEqTeIo2Q==",
       "hasInstallScript": true,
       "license": "SEE LICENSE IN README.md",
       "bin": {
diff --git a/pkgs/by-name/cl/claude-code/package.nix b/pkgs/by-name/cl/claude-code/package.nix
index 9e8a2cc162f4..3960d6286ae2 100644
--- a/pkgs/by-name/cl/claude-code/package.nix
+++ b/pkgs/by-name/cl/claude-code/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "claude-code";
-  version = "1.0.38";
+  version = "1.0.41";
 
   nodejs = nodejs_20; # required for sandboxed Nix builds on Darwin
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";
-    hash = "sha256-flG9VlnQfMfGFBbs6RdQKSbceD/Tke19Euo8znR5OG0=";
+    hash = "sha256-x8Bxh0iKqf8AsMQ+7zutSh53DbCRzM9s6s6BQkdbyXc=";
   };
 
-  npmDepsHash = "sha256-IOk/dPi43WqFb1mWC/48JMK5a8PeSHE2uKz+4qA3AYA=";
+  npmDepsHash = "sha256-LiCN8swT4ba+F1aMjHQqCsZUqcAW0qc4AiYL90Burk8=";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json
diff --git a/pkgs/by-name/co/code-cursor/package.nix b/pkgs/by-name/co/code-cursor/package.nix
index 2f228d1ed763..725e38a37160 100644
--- a/pkgs/by-name/co/code-cursor/package.nix
+++ b/pkgs/by-name/co/code-cursor/package.nix
@@ -16,20 +16,20 @@ let
 
   sources = {
     x86_64-linux = fetchurl {
-      url = "https://downloads.cursor.com/production/979ba33804ac150108481c14e0b5cb970bda3266/linux/x64/Cursor-1.1.3-x86_64.AppImage";
-      hash = "sha256-mOwWNbKKykMaLFxfjaoGGrxfyhLX++fqJ0TXQtKVD8c=";
+      url = "https://downloads.cursor.com/production/031e7e0ff1e2eda9c1a0f5df67d44053b059c5df/linux/x64/Cursor-1.2.1-x86_64.AppImage";
+      hash = "sha256-2rOs5+85crKO/N9dCQLFfUXTfP9JVVR1s/g0bK2E78s=";
     };
     aarch64-linux = fetchurl {
-      url = "https://downloads.cursor.com/production/979ba33804ac150108481c14e0b5cb970bda3266/linux/arm64/Cursor-1.1.3-aarch64.AppImage";
-      hash = "sha256-1uWfTOrBcCX6QWTwB9C45RsjLqu2C89DQkqKFTHsKxg=";
+      url = "https://downloads.cursor.com/production/031e7e0ff1e2eda9c1a0f5df67d44053b059c5df/linux/arm64/Cursor-1.2.1-aarch64.AppImage";
+      hash = "sha256-Otg+NyW1DmrqIb0xqZCfJ4ys61/DBOQNgaAR8PMOCfg=";
     };
     x86_64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/production/979ba33804ac150108481c14e0b5cb970bda3266/darwin/x64/Cursor-darwin-x64.dmg";
-      hash = "sha256-q5/bmv+QDAkuMOUcaCspJrkaxrz9dBRJKf1eFhk9M04=";
+      url = "https://downloads.cursor.com/production/031e7e0ff1e2eda9c1a0f5df67d44053b059c5df/darwin/x64/Cursor-darwin-x64.dmg";
+      hash = "sha256-Rh1erFG7UtGwO1NaM5+tq17mI5WdIX750pIzeO9AK+Q=";
     };
     aarch64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/production/979ba33804ac150108481c14e0b5cb970bda3266/darwin/arm64/Cursor-darwin-arm64.dmg";
-      hash = "sha256-vgcPwbRXFRtxIAUqbozFD9b21/XUAAojMv9/UnEYvb8=";
+      url = "https://downloads.cursor.com/production/031e7e0ff1e2eda9c1a0f5df67d44053b059c5df/darwin/arm64/Cursor-darwin-arm64.dmg";
+      hash = "sha256-k/j3hJnHIdtfK9+T0aq2gFkRM+JulDt4FpU7n4HGEYM=";
     };
   };
 
@@ -39,7 +39,7 @@ in
   inherit useVSCodeRipgrep;
   commandLineArgs = finalCommandLineArgs;
 
-  version = "1.1.3";
+  version = "1.2.1";
   pname = "cursor";
 
   # You can find the current VSCode version in the About dialog:
diff --git a/pkgs/by-name/ex/exegol/package.nix b/pkgs/by-name/ex/exegol/package.nix
index c6fceb771a10..fd0b774384bd 100644
--- a/pkgs/by-name/ex/exegol/package.nix
+++ b/pkgs/by-name/ex/exegol/package.nix
@@ -18,6 +18,7 @@ python3Packages.buildPythonApplication rec {
 
   pythonRelaxDeps = [
     "rich"
+    "argcomplete"
   ];
 
   dependencies =
diff --git a/pkgs/by-name/ez/eza/package.nix b/pkgs/by-name/ez/eza/package.nix
index f614766d74c0..e987a04e9952 100644
--- a/pkgs/by-name/ez/eza/package.nix
+++ b/pkgs/by-name/ez/eza/package.nix
@@ -15,17 +15,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "eza";
-  version = "0.21.6";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "eza-community";
     repo = "eza";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9Q66xaQzRwpc/fRvAQsbzBDpXhm0goCNiW/sUjGmUEM=";
+    hash = "sha256-/mk8UMWiw+YrEcZK+C/2AkHXekvxTwWGBsJG7lWbz38=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Asb6V0R49ZprabXQOi95zBpqc855CLwXUstKVq7+rXs=";
+  cargoHash = "sha256-6I7Enwp95u2d3xtnBykVCBE1tBm1OeAyQtxvGCDJPdc=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/fi/files-cli/package.nix b/pkgs/by-name/fi/files-cli/package.nix
index 9d5ce40c9805..b097e8181964 100644
--- a/pkgs/by-name/fi/files-cli/package.nix
+++ b/pkgs/by-name/fi/files-cli/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "files-cli";
-  version = "2.15.32";
+  version = "2.15.38";
 
   src = fetchFromGitHub {
     repo = "files-cli";
     owner = "files-com";
     rev = "v${version}";
-    hash = "sha256-etUcjmRZJvwEUHX87sPBoYsh9oVFm4fxdrJR6VJBvrE=";
+    hash = "sha256-bf87pCosw41yqnPeQ38t++jedRYKEn22wwuTSrmPvCo=";
   };
 
-  vendorHash = "sha256-8mEl9/ljAKkTHgcEgf+SjeVjFv/fxVlYnhOxKzEIxgM=";
+  vendorHash = "sha256-p5Fcs7xVsDBfJQLNbEqsJY2jwgoKrBRCi6Qadwr1azY=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/go/gost/package.nix b/pkgs/by-name/go/gost/package.nix
index d517621fd4ae..8fba34d55f27 100644
--- a/pkgs/by-name/go/gost/package.nix
+++ b/pkgs/by-name/go/gost/package.nix
@@ -4,20 +4,27 @@
   fetchFromGitHub,
   buildGoModule,
   versionCheckHook,
+  nix-update-script,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "gost";
-  version = "3.0.0";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "go-gost";
     repo = "gost";
-    tag = "v${version}";
-    hash = "sha256-ep3ZjD+eVKl3PuooDuYeur8xDAcyy6ww2I7f3cYG03o=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-4ZfGxhXespaZNspvbwZ/Yz2ncqtY3wxJPQsqVILayao=";
   };
 
-  vendorHash = "sha256-lzyr6Q8yXsuer6dRUlwHEeBewjwGxDslueuvIiZUW70=";
+  vendorHash = "sha256-lWuLvYF9Sl+k8VnsujvRmj7xb9zst+g//Gkg7VwtWkg=";
+
+  # Based on ldflags in upstream's .goreleaser.yaml
+  ldflags = [
+    "-s"
+    "-X main.version=v${finalAttrs.version}"
+  ];
 
   __darwinAllowLocalNetworking = true;
 
@@ -30,6 +37,8 @@ buildGoModule rec {
 
   versionCheckProgramArg = "-V";
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Simple tunnel written in golang";
     homepage = "https://github.com/go-gost/gost";
@@ -37,7 +46,8 @@ buildGoModule rec {
     maintainers = with lib.maintainers; [
       pmy
       ramblurr
+      moraxyc
     ];
     mainProgram = "gost";
   };
-}
+})
diff --git a/pkgs/by-name/gr/graphite-cli/package-lock.json b/pkgs/by-name/gr/graphite-cli/package-lock.json
index 375f1b011380..13639b0c62c3 100644
--- a/pkgs/by-name/gr/graphite-cli/package-lock.json
+++ b/pkgs/by-name/gr/graphite-cli/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@withgraphite/graphite-cli",
-  "version": "1.6.5",
+  "version": "1.6.6",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@withgraphite/graphite-cli",
-      "version": "1.6.5",
+      "version": "1.6.6",
       "hasInstallScript": true,
       "license": "None",
       "dependencies": {
diff --git a/pkgs/by-name/gr/graphite-cli/package.nix b/pkgs/by-name/gr/graphite-cli/package.nix
index ca661d8f1743..41191fd9a2aa 100644
--- a/pkgs/by-name/gr/graphite-cli/package.nix
+++ b/pkgs/by-name/gr/graphite-cli/package.nix
@@ -8,14 +8,14 @@
 
 buildNpmPackage rec {
   pname = "graphite-cli";
-  version = "1.6.5";
+  version = "1.6.6";
 
   src = fetchurl {
     url = "https://registry.npmjs.org/@withgraphite/graphite-cli/-/graphite-cli-${version}.tgz";
-    hash = "sha256-Z1lJUKe1fET4Xj2bmxCbH2abH/hX6BEtWFD+HC2w2iw=";
+    hash = "sha256-WTgZjXMqxhN3XM6tmH4OMa0VgCPlY3KRX+hlqVMVVpk=";
   };
 
-  npmDepsHash = "sha256-lN7mg2gNFXuQ39hbjG7kVvDhPF6mWg3E6dszywbKHZo=";
+  npmDepsHash = "sha256-B9hd7IZ7bmOV9ZSiORWoFbhp+2Gj6WwUWZPGEvb9j5s=";
 
   postPatch = ''
     ln -s ${./package-lock.json} package-lock.json
diff --git a/pkgs/by-name/ic/ical2orgpy/package.nix b/pkgs/by-name/ic/ical2orgpy/package.nix
index 0ca92ac24413..ac16557769bf 100644
--- a/pkgs/by-name/ic/ical2orgpy/package.nix
+++ b/pkgs/by-name/ic/ical2orgpy/package.nix
@@ -1,43 +1,49 @@
 {
   lib,
-  python3,
+  python3Packages,
   fetchFromGitHub,
+  versionCheckHook,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "ical2orgpy";
   version = "0.5";
-
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ical2org-py";
     repo = "ical2org.py";
-    rev = version;
+    tag = version;
     hash = "sha256-vBi1WYXMuDFS/PnwFQ/fqN5+gIvtylXidfZklyd6LcI=";
   };
 
-  propagatedBuildInputs = with python3.pkgs; [
+  build-system = [ python3Packages.setuptools ];
+
+  dependencies = with python3Packages; [
     click
-    future
     icalendar
     pytz
     tzlocal
     recurring-ical-events
   ];
 
-  nativeCheckInputs = with python3.pkgs; [
+  pythonRemoveDeps = [ "future" ];
+
+  nativeCheckInputs = with python3Packages; [
     freezegun
     pytestCheckHook
     pyyaml
+    versionCheckHook
   ];
 
-  meta = with lib; {
-    changelog = "https://github.com/ical2org-py/ical2org.py/blob/${src.rev}/CHANGELOG.rst";
+  pythonImportsCheck = [ "ical2orgpy" ];
+
+  meta = {
+    changelog = "https://github.com/ical2org-py/ical2org.py/blob/${src.tag}/CHANGELOG.rst";
     description = "Converting ICAL file into org-mode format";
     homepage = "https://github.com/ical2org-py/ical2org.py";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ StillerHarpo ];
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ StillerHarpo ];
     mainProgram = "ical2orgpy";
   };
 
diff --git a/pkgs/by-name/js/jsonkdl/package.nix b/pkgs/by-name/js/jsonkdl/package.nix
new file mode 100644
index 000000000000..a6ce90879962
--- /dev/null
+++ b/pkgs/by-name/js/jsonkdl/package.nix
@@ -0,0 +1,29 @@
+{
+  lib,
+  rustPlatform,
+  fetchCrate,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "jsonkdl";
+  version = "1.0.0";
+
+  src = fetchCrate {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-4k6gwThkS9OfdM412Mi/Scv+4wIKIXuCA5lVuJ7IRiY=";
+  };
+
+  cargoHash = "sha256-9dHS41ZyI9vna0w8N6/PXsmObKPHUi25JPFLsEaxG/A=";
+
+  meta = {
+    description = "JSON to KDL converter";
+    homepage = "https://github.com/joshprk/jsonkdl";
+    changelog = "https://github.com/joshprk/jsonkdl/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      joshprk
+      kiara
+    ];
+    mainProgram = "jsonkdl";
+  };
+})
diff --git a/pkgs/by-name/ly/LycheeSlicer/package.nix b/pkgs/by-name/ly/LycheeSlicer/package.nix
index 91012f6450a2..a4af6c2f53d0 100644
--- a/pkgs/by-name/ly/LycheeSlicer/package.nix
+++ b/pkgs/by-name/ly/LycheeSlicer/package.nix
@@ -39,7 +39,7 @@ appimageTools.wrapType2 {
     install -Dm444 -t $out/share/applications ${desktopItem}/share/applications/*
   '';
 
-  buildInputs = [
+  extraLibraries = [
     xorg.libxshmfence
   ];
 
diff --git a/pkgs/by-name/ne/nero-umu/package.nix b/pkgs/by-name/ne/nero-umu/package.nix
index 639d09366e95..629bc0f58f1a 100644
--- a/pkgs/by-name/ne/nero-umu/package.nix
+++ b/pkgs/by-name/ne/nero-umu/package.nix
@@ -18,13 +18,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "nero-umu";
-  version = "1.1.2";
+  version = "1.1.3";
 
   src = fetchFromGitHub {
     owner = "SeongGino";
     repo = "Nero-umu";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7Wmha/WsSmbEgD2Dw2izSRzw8ldIrWcRIdUMp2okHWY=";
+    hash = "sha256-w9sMBMtaop0lCwqvNf235cf0+ON91tMoqU1guyX6oVU=";
   };
 
   #Replace quazip git submodule with pre-packaged quazip
diff --git a/pkgs/by-name/ne/networkmanager-fortisslvpn/package.nix b/pkgs/by-name/ne/networkmanager-fortisslvpn/package.nix
index ec651b3b0a56..aafa2861b401 100644
--- a/pkgs/by-name/ne/networkmanager-fortisslvpn/package.nix
+++ b/pkgs/by-name/ne/networkmanager-fortisslvpn/package.nix
@@ -82,6 +82,9 @@ stdenv.mkDerivation rec {
       versionPolicy = "odd-unstable";
     };
     networkManagerPlugin = "VPN/nm-fortisslvpn-service.name";
+    networkManagerTmpfilesRules = [
+      "d /var/lib/NetworkManager-fortisslvpn 0700 root root -"
+    ];
   };
 
   meta = with lib; {
diff --git a/pkgs/by-name/ne/networkmanager-openconnect/package.nix b/pkgs/by-name/ne/networkmanager-openconnect/package.nix
index 098be3d6fe68..090fe868482b 100644
--- a/pkgs/by-name/ne/networkmanager-openconnect/package.nix
+++ b/pkgs/by-name/ne/networkmanager-openconnect/package.nix
@@ -73,6 +73,7 @@ stdenv.mkDerivation rec {
       versionPolicy = "odd-unstable";
     };
     networkManagerPlugin = "VPN/nm-openconnect-service.name";
+    networkManagerRuntimeDeps = [ openconnect ];
   };
 
   meta = with lib; {
diff --git a/pkgs/by-name/ne/networkmanager_strongswan/package.nix b/pkgs/by-name/ne/networkmanager-strongswan/package.nix
similarity index 90%
rename from pkgs/by-name/ne/networkmanager_strongswan/package.nix
rename to pkgs/by-name/ne/networkmanager-strongswan/package.nix
index 1f19a10087c1..5d0b6ae110e8 100644
--- a/pkgs/by-name/ne/networkmanager_strongswan/package.nix
+++ b/pkgs/by-name/ne/networkmanager-strongswan/package.nix
@@ -49,6 +49,10 @@ stdenv.mkDerivation rec {
 
   passthru = {
     networkManagerPlugin = "VPN/nm-strongswan-service.name";
+    networkManagerDbusDeps = [ strongswanNM ];
+    networkManagerTmpfilesRules = [
+      "d /etc/ipsec.d 0700 root root -"
+    ];
   };
 
   meta = with lib; {
diff --git a/pkgs/by-name/no/noseyparker/package.nix b/pkgs/by-name/no/noseyparker/package.nix
index 69b5249e3975..e830e452b015 100644
--- a/pkgs/by-name/no/noseyparker/package.nix
+++ b/pkgs/by-name/no/noseyparker/package.nix
@@ -1,13 +1,15 @@
 {
   lib,
+  stdenv,
   rustPlatform,
   fetchFromGitHub,
   boost,
   cmake,
-  git,
   vectorscan,
   openssl,
   pkg-config,
+  installShellFiles,
+  versionCheckHook,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -24,10 +26,6 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-hVBHIm/12WU6g45QMxxuGk41B0kwThk7A84fOxArvno=";
 
-  nativeCheckInputs = [
-    git
-  ];
-
   checkFlags = [
     # These tests expect access to network to clone and use GitHub API
     "--skip=github::github_repos_list_multiple_user_dedupe_jsonl_format"
@@ -38,11 +36,20 @@ rustPlatform.buildRustPackage rec {
     "--skip=github::github_repos_list_user_jsonl_format"
     "--skip=github::github_repos_list_user_repo_filter"
     "--skip=scan::appmaker::scan_workflow_from_git_url"
+
+    # This caused a flaky result. See https://github.com/NixOS/nixpkgs/pull/422012#issuecomment-3031728181
+    "--skip=scan::git_url::git_binary_missing"
+
+    # Also skips all tests which depend on external git command to prevent unstable tests similar to git_binary_missing
+    # See https://github.com/NixOS/nixpkgs/pull/422012#discussion_r2182551619
+    "--skip=scan::git_url::https_nonexistent"
+    "--skip=scan::basic::scan_git_emptyrepo"
   ];
 
   nativeBuildInputs = [
     cmake
     pkg-config
+    installShellFiles
   ];
   buildInputs = [
     boost
@@ -52,6 +59,24 @@ rustPlatform.buildRustPackage rec {
 
   OPENSSL_NO_VENDOR = 1;
 
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    mkdir -p manpages
+    "$out/bin/noseyparker-cli" generate manpages
+    installManPage manpages/*
+
+    installShellCompletion --cmd noseyparker-cli \
+      --bash <("$out/bin/noseyparker-cli" generate shell-completions --shell bash) \
+      --zsh <("$out/bin/noseyparker-cli" generate shell-completions --shell zsh) \
+      --fish <("$out/bin/noseyparker-cli" generate shell-completions --shell fish)
+  '';
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+  versionCheckProgram = "${placeholder "out"}/bin/noseyparker-cli";
+  versionCheckProgramArg = "--version";
+
   meta = {
     description = "Find secrets and sensitive information in textual data";
     mainProgram = "noseyparker";
diff --git a/pkgs/by-name/pa/pam_rssh/package.nix b/pkgs/by-name/pa/pam_rssh/package.nix
index cc95d3acc04a..c128b3efd140 100644
--- a/pkgs/by-name/pa/pam_rssh/package.nix
+++ b/pkgs/by-name/pa/pam_rssh/package.nix
@@ -7,17 +7,18 @@
   openssl,
   pam,
   openssh,
+  nix-update-script,
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "pam_rssh";
-  version = "1.2.0-rc2";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "z4yx";
     repo = "pam_rssh";
     rev = "v${version}";
-    hash = "sha256-sXTSICVYSmwr12kRWuhVcag8kY6VAFdCqbe6LtYs4hU=";
+    hash = "sha256-VxbaxqyIAwmjjbgfTajqwPQC3bp7g/JNVNx9yy/3tus=";
     fetchSubmodules = true;
   };
 
@@ -66,11 +67,16 @@ rustPlatform.buildRustPackage rec {
     ssh-add $HOME/.ssh/id_rsa
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     description = "PAM module for authenticating via ssh-agent, written in Rust";
     homepage = "https://github.com/z4yx/pam_rssh";
     license = licenses.mit;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ kranzes ];
+    maintainers = with maintainers; [
+      kranzes
+      xyenon
+    ];
   };
 }
diff --git a/pkgs/by-name/pc/pcsx2/package.nix b/pkgs/by-name/pc/pcsx2/package.nix
index fd7992bb18b5..bf68de038ec5 100644
--- a/pkgs/by-name/pc/pcsx2/package.nix
+++ b/pkgs/by-name/pc/pcsx2/package.nix
@@ -7,6 +7,7 @@
   curl,
   extra-cmake-modules,
   ffmpeg,
+  gtk3,
   libXrandr,
   libaio,
   libbacktrace,
@@ -23,6 +24,7 @@
   vulkan-headers,
   vulkan-loader,
   wayland,
+  wrapGAppsHook3,
   zip,
   zstd,
   plutovg,
@@ -76,6 +78,7 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
     extra-cmake-modules
     pkg-config
     strip-nondeterminism
+    wrapGAppsHook3
     wrapQtAppsHook
     zip
   ];
@@ -83,6 +86,7 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     curl
     ffmpeg
+    gtk3
     libaio
     libbacktrace
     libpcap
@@ -124,6 +128,12 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
     in
     [ "--prefix LD_LIBRARY_PATH : ${libs}" ];
 
+  dontWrapGApps = true;
+
+  preFixup = ''
+    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
   # https://github.com/PCSX2/pcsx2/pull/10200
   # Can't avoid the double wrapping, the binary wrapper from qtWrapperArgs doesn't support --run
   postFixup = ''
@@ -155,6 +165,7 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
     ];
     mainProgram = "pcsx2-qt";
     maintainers = with lib.maintainers; [
+      _0david0mp
       hrdinka
       govanify
       matteopacini
diff --git a/pkgs/by-name/pm/pmbootstrap/package.nix b/pkgs/by-name/pm/pmbootstrap/package.nix
index 609ff67fed80..e05c89017f4a 100644
--- a/pkgs/by-name/pm/pmbootstrap/package.nix
+++ b/pkgs/by-name/pm/pmbootstrap/package.nix
@@ -15,14 +15,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pmbootstrap";
-  version = "3.5.0";
+  version = "3.5.2";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "postmarketOS";
     repo = "pmbootstrap";
     tag = version;
-    hash = "sha256-wdJl7DrSm1Jht0KEqZ9+qjqlkE+Y6oBdzEHTCgIGJ84=";
+    hash = "sha256-fkzDVMO0huAuJDJIt0dyNGnRD6Go7XZ/YRv/JMtlbss=";
     domain = "gitlab.postmarketos.org";
   };
 
diff --git a/pkgs/by-name/po/pong3d/package.nix b/pkgs/by-name/po/pong3d/package.nix
index d94b42d23303..944ba4f0e253 100644
--- a/pkgs/by-name/po/pong3d/package.nix
+++ b/pkgs/by-name/po/pong3d/package.nix
@@ -34,12 +34,15 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ libX11 ];
 
-  makeFlags = [ "PREFIX=$(out)" ];
+  makeFlags = [
+    "PREFIX=$(out)"
+    "CC=${stdenv.cc.targetPrefix}cc" # fix darwin and cross-compiled builds
+  ];
 
   meta = {
     homepage = "http://www.newbreedsoftware.com/3dpong/";
     description = "One or two player 3d sports game based on Pong from Atari";
     license = lib.licenses.gpl2Plus;
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
   };
 })
diff --git a/pkgs/by-name/ru/rundeck-cli/package.nix b/pkgs/by-name/ru/rundeck-cli/package.nix
index acb20b73626e..7de143781188 100644
--- a/pkgs/by-name/ru/rundeck-cli/package.nix
+++ b/pkgs/by-name/ru/rundeck-cli/package.nix
@@ -2,13 +2,17 @@
   lib,
   stdenv,
   fetchurl,
-  makeWrapper,
-  jdk11,
-  unzip,
+  makeBinaryWrapper,
+  jre11_minimal,
+  jdk11_headless,
   versionCheckHook,
   nix-update-script,
 }:
-
+let
+  jre11_minimal_headless = jre11_minimal.override {
+    jdk = jdk11_headless;
+  };
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "rundeck-cli";
   version = "2.0.9";
@@ -18,8 +22,8 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-c6QAgwyRCtoOlS7DEmjyK3BwHV122bilL6H+Hzrv2dQ=";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ jdk11 ];
+  nativeBuildInputs = [ makeBinaryWrapper ];
+  buildInputs = [ jre11_minimal_headless ];
 
   dontUnpack = true;
 
@@ -30,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
     cp $src $out/share/rundeck-cli/rundeck-cli.jar
 
     mkdir -p $out/bin
-    makeWrapper ${lib.getExe jdk11} $out/bin/rd \
+    makeWrapper ${lib.getExe jre11_minimal_headless} $out/bin/rd \
       --add-flags "-jar $out/share/rundeck-cli/rundeck-cli.jar"
 
     runHook postInstall
diff --git a/pkgs/by-name/se/seafile-server/package.nix b/pkgs/by-name/se/seafile-server/package.nix
index 35f2ca2378d0..f6a0b61af28b 100644
--- a/pkgs/by-name/se/seafile-server/package.nix
+++ b/pkgs/by-name/se/seafile-server/package.nix
@@ -94,7 +94,6 @@ stdenv.mkDerivation {
     license = licenses.agpl3Plus;
     platforms = platforms.linux;
     maintainers = with maintainers; [
-      schmittlauch
       melvyn2
     ];
     mainProgram = "seaf-server";
diff --git a/pkgs/by-name/se/seahub/package.nix b/pkgs/by-name/se/seahub/package.nix
index 3889dfe80f52..b3c8baf90114 100644
--- a/pkgs/by-name/se/seahub/package.nix
+++ b/pkgs/by-name/se/seahub/package.nix
@@ -80,7 +80,6 @@ python3.pkgs.buildPythonApplication rec {
     homepage = "https://github.com/haiwen/seahub";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
-      schmittlauch
       melvyn2
     ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/st/star/package.nix b/pkgs/by-name/st/star/package.nix
index 43a4989962e2..9d3cb06e5a2c 100644
--- a/pkgs/by-name/st/star/package.nix
+++ b/pkgs/by-name/st/star/package.nix
@@ -4,6 +4,10 @@
   fetchFromGitHub,
   xxd,
   zlib,
+  llvmPackages,
+  star,
+  testers,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation rec {
@@ -20,31 +24,48 @@ stdenv.mkDerivation rec {
   sourceRoot = "${src.name}/source";
 
   postPatch = ''
-    substituteInPlace Makefile --replace "/bin/rm" "rm"
+    substituteInPlace Makefile --replace-fail "-std=c++11" "-std=c++14"
   '';
 
   nativeBuildInputs = [ xxd ];
 
-  buildInputs = [ zlib ];
+  buildInputs = [ zlib ] ++ lib.optionals stdenv.isDarwin [ llvmPackages.openmp ];
+
+  enableParallelBuilding = true;
+
+  makeFlags = lib.optionals stdenv.hostPlatform.isAarch64 [ "CXXFLAGS_SIMD=" ];
+
+  preBuild = lib.optionalString stdenv.isDarwin ''
+    export CXXFLAGS="$CXXFLAGS -DSHM_NORESERVE=0"
+  '';
 
   buildFlags = [
     "STAR"
     "STARlong"
   ];
 
-  enableParallelBuilding = true;
-
   installPhase = ''
     runHook preInstall
     install -D STAR STARlong -t $out/bin
     runHook postInstall
   '';
 
+  passthru.tests.version = testers.testVersion {
+    package = star;
+    command = "STAR --version";
+  };
+
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     description = "Spliced Transcripts Alignment to a Reference";
+    longDescription = ''
+      STAR (Spliced Transcripts Alignment to a Reference) is a fast RNA-seq
+      read mapper, with support for splice-junction and fusion read detection.
+    '';
     homepage = "https://github.com/alexdobin/STAR";
     license = licenses.gpl3Plus;
-    platforms = [ "x86_64-linux" ];
+    platforms = platforms.unix;
     maintainers = [ maintainers.arcadio ];
   };
 }
diff --git a/pkgs/by-name/te/teetertorture/package.nix b/pkgs/by-name/te/teetertorture/package.nix
index ca697191d19a..b5d8051142a2 100644
--- a/pkgs/by-name/te/teetertorture/package.nix
+++ b/pkgs/by-name/te/teetertorture/package.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     homepage = "http://www.newbreedsoftware.com/teetertorture/";
     description = "Simple shooting game with your cannon is sitting atop a teeter totter";
     license = lib.licenses.gpl2Plus;
-    platforms = lib.platforms.linux;
+    inherit (SDL.meta) platforms;
     mainProgram = "teetertorture";
   };
 }
diff --git a/pkgs/by-name/ve/vectoroids/package.nix b/pkgs/by-name/ve/vectoroids/package.nix
index 9d3bc9f943ff..df54dcff0c71 100644
--- a/pkgs/by-name/ve/vectoroids/package.nix
+++ b/pkgs/by-name/ve/vectoroids/package.nix
@@ -32,6 +32,6 @@ stdenv.mkDerivation rec {
     description = "Clone of the classic arcade game Asteroids by Atari";
     mainProgram = "vectoroids";
     license = lib.licenses.gpl2Plus;
-    platforms = lib.platforms.linux;
+    inherit (SDL.meta) platforms;
   };
 }
diff --git a/pkgs/by-name/wt/wttrbar/package.nix b/pkgs/by-name/wt/wttrbar/package.nix
index 6d334268964a..d450549caec7 100644
--- a/pkgs/by-name/wt/wttrbar/package.nix
+++ b/pkgs/by-name/wt/wttrbar/package.nix
@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wttrbar";
-  version = "0.12.0";
+  version = "0.12.1";
 
   src = fetchFromGitHub {
     owner = "bjesus";
     repo = "wttrbar";
     rev = version;
-    hash = "sha256-+M0s6v9ULf+D2pPOE8KlHoyV+jBMbPsAXpYxGjms5DY=";
+    hash = "sha256-+EyjZZpDktkYbxy3YXAtuW3A0bEFKFa+UuRvIzUEISM=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-sv9hSTmq5J6s0PPBMJgaMUWBaRk0/NJV41nNDIj6MoY=";
+  cargoHash = "sha256-AXyt5z1d26si7qLZgd7dWrHOOJBvK75B29/LJj7bpAo=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/xs/xscreensaver/package.nix b/pkgs/by-name/xs/xscreensaver/package.nix
index 37e373319725..e02f96562936 100644
--- a/pkgs/by-name/xs/xscreensaver/package.nix
+++ b/pkgs/by-name/xs/xscreensaver/package.nix
@@ -35,11 +35,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xscreensaver";
-  version = "6.10.1";
+  version = "6.11";
 
   src = fetchurl {
     url = "https://www.jwz.org/xscreensaver/xscreensaver-${finalAttrs.version}.tar.gz";
-    hash = "sha256-/+WZ+c93r6Ru+427e1YejaDDFW3qZLY14Lfiwg9Ls+0=";
+    hash = "sha256-lIi3ouZVkSh7lEMB8x+WjXcX/5vGswmJ46vtZiyH4eg=";
   };
 
   outputs = [
diff --git a/pkgs/development/compilers/openjdk/jre.nix b/pkgs/development/compilers/openjdk/jre.nix
index 2370774cef29..9e9498f4d6dc 100644
--- a/pkgs/development/compilers/openjdk/jre.nix
+++ b/pkgs/development/compilers/openjdk/jre.nix
@@ -7,38 +7,43 @@
   modules ? [ "java.base" ],
 }:
 
-let
-  jre = stdenv.mkDerivation {
-    pname = "${jdk.pname}-minimal-jre";
-    version = jdk.version;
+stdenv.mkDerivation (finalAttrs: {
+  pname = "${jdk.pname}-minimal-jre";
+  version = jdk.version;
 
-    nativeBuildInputs = [ jdkOnBuild ];
-    buildInputs = [ jdk ];
-    strictDeps = true;
+  nativeBuildInputs = [ jdkOnBuild ];
+  buildInputs = [ jdk ];
+  strictDeps = true;
 
-    dontUnpack = true;
+  dontUnpack = true;
 
-    # Strip more heavily than the default '-S', since if you're
-    # using this derivation you probably care about this.
-    stripDebugFlags = [ "--strip-unneeded" ];
+  # Strip more heavily than the default '-S', since if you're
+  # using this derivation you probably care about this.
+  stripDebugFlags = [ "--strip-unneeded" ];
 
-    buildPhase = ''
-      runHook preBuild
+  buildPhase = ''
+    runHook preBuild
 
-      jlink --module-path ${jdk}/lib/openjdk/jmods --add-modules ${lib.concatStringsSep "," modules} --output $out
+    jlink --module-path ${jdk}/lib/openjdk/jmods --add-modules ${lib.concatStringsSep "," modules} --output $out
 
-      runHook postBuild
-    '';
+    runHook postBuild
+  '';
 
-    dontInstall = true;
+  dontInstall = true;
 
-    passthru = {
-      home = "${jre}";
-      tests = {
-        jre_minimal-hello = callPackage ./tests/test_jre_minimal.nix { };
-        jre_minimal-hello-logging = callPackage ./tests/test_jre_minimal_with_logging.nix { };
-      };
+  passthru = {
+    home = "${finalAttrs.finalPackage}";
+    tests = {
+      jre_minimal-hello = callPackage ./tests/test_jre_minimal.nix { };
+      jre_minimal-hello-logging = callPackage ./tests/test_jre_minimal_with_logging.nix { };
     };
   };
-in
-jre
+
+  meta = jdk.meta // {
+    description = "Minimal JRE for OpenJDK ${jdk.version}";
+    longDescription = ''
+      This is a minimal JRE built from OpenJDK, containing only the specified modules.
+      It is suitable for running Java applications that do not require the full JDK.
+    '';
+  };
+})
diff --git a/pkgs/development/coq-modules/VST/default.nix b/pkgs/development/coq-modules/VST/default.nix
index a7d8b805f067..17aaf9d55636 100644
--- a/pkgs/development/coq-modules/VST/default.nix
+++ b/pkgs/development/coq-modules/VST/default.nix
@@ -34,32 +34,17 @@ mkCoqDerivation {
   repo = "VST";
   inherit version;
   defaultVersion =
+    let
+      case = case: out: { inherit case out; };
+    in
     with lib.versions;
     lib.switch coq.coq-version [
-      {
-        case = range "8.19" "8.20";
-        out = "2.15";
-      }
-      {
-        case = range "8.15" "8.19";
-        out = "2.14";
-      }
-      {
-        case = range "8.15" "8.17";
-        out = "2.13";
-      }
-      {
-        case = range "8.14" "8.16";
-        out = "2.10";
-      }
-      {
-        case = range "8.13" "8.15";
-        out = "2.9";
-      }
-      {
-        case = range "8.12" "8.13";
-        out = "2.8";
-      }
+      (case (range "8.19" "8.20") "2.15")
+      (case (range "8.15" "8.19") "2.14")
+      (case (range "8.15" "8.17") "2.13")
+      (case (range "8.14" "8.16") "2.10")
+      (case (range "8.13" "8.15") "2.9")
+      (case (range "8.12" "8.13") "2.8")
     ] null;
   release."2.15".sha256 = "sha256-51k2W4efMaEO4nZ0rdkRT9rA8ZJLpot1YpFmd6RIAXw=";
   release."2.14".sha256 = "sha256-NHc1ZQ2VmXZy4lK2+mtyeNz1Qr9Nhj2QLxkPhhQB7Iw=";
@@ -73,19 +58,28 @@ mkCoqDerivation {
   buildInputs = [ ITree ];
   propagatedBuildInputs = [ compcert ];
 
-  preConfigure = ''
-    patchShebangs util
-    substituteInPlace Makefile \
-      --replace 'COQVERSION= ' 'COQVERSION= 8.20.1 or-else 8.19.2 or-else 8.17.1 or-else 8.16.1 or-else 8.16.0 or-else 8.15.2 or-else 8.15.1 or-else '\
-      --replace 'FLOYD_FILES=' 'FLOYD_FILES= ${toString extra_floyd_files}'
-  '';
+  preConfigure =
+    ''
+      patchShebangs util
+    ''
+    +
+      lib.optionalString
+        (coq.coq-version != null && coq.coq-version != "dev" && lib.versions.isLe "8.20" coq.coq-version)
+        ''
+          substituteInPlace Makefile \
+            --replace-fail 'COQVERSION= ' 'COQVERSION= 8.20.1 or-else 8.19.2 or-else 8.17.1 or-else 8.16.1 or-else 8.16.0 or-else 8.15.2 or-else 8.15.1 or-else '\
+            --replace-fail 'FLOYD_FILES=' 'FLOYD_FILES= ${toString extra_floyd_files}'
+        '';
 
-  makeFlags = [
-    "BITSIZE=64"
-    "COMPCERT=inst_dir"
-    "COMPCERT_INST_DIR=${compcert.lib}/lib/coq/${coq.coq-version}/user-contrib/compcert"
-    "INSTALLDIR=$(out)/lib/coq/${coq.coq-version}/user-contrib/VST"
-  ];
+  makeFlags =
+    [
+      "BITSIZE=64"
+      "COMPCERT=inst_dir"
+      "COMPCERT_INST_DIR=${compcert.lib}/lib/coq/${coq.coq-version}/user-contrib/compcert"
+      "INSTALLDIR=$(out)/lib/coq/${coq.coq-version}/user-contrib/VST"
+    ]
+    ++ lib.optional (coq.coq-version == "dev") "IGNORECOQVERSION=true"
+    ++ lib.optional (coq.coq-version == "dev") "IGNORECOMPCERTVERSION=true";
 
   postInstall = ''
     for d in msl veric floyd sepcomp progs64
diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index b24fa3eeacd6..e64851bb6d83 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -82,7 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
     [
       findXMLCatalogs
     ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    ++ lib.optionals (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isMinGW) [
       libiconv
     ]
     ++ lib.optionals icuSupport [
diff --git a/pkgs/development/php-packages/phan/default.nix b/pkgs/development/php-packages/phan/default.nix
index fac0b0cb1ab9..9f2eca7bd16d 100644
--- a/pkgs/development/php-packages/phan/default.nix
+++ b/pkgs/development/php-packages/phan/default.nix
@@ -7,13 +7,13 @@
 (php.withExtensions ({ enabled, all }: enabled ++ (with all; [ ast ]))).buildComposerProject
   (finalAttrs: {
     pname = "phan";
-    version = "5.4.6";
+    version = "5.5.0";
 
     src = fetchFromGitHub {
       owner = "phan";
       repo = "phan";
       rev = finalAttrs.version;
-      hash = "sha256-627Vc8jFrC2wifvGoZ18w72mp43myk4/adyJR28sFEw=";
+      hash = "sha256-jWlxBCfkN5nTd3nEwRLobDuxnJirk53ChSw59rj4gq0=";
     };
 
     vendorHash = "sha256-Ake5/7IyoweC2ONDuWt9jJSbG0JbnU9lmCRu2p6uUQM=";
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index c40f8810e855..f830354586a5 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -359,7 +359,7 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.38.46";
+  version = "1.39.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -367,7 +367,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit version;
-    hash = "sha256-UmeJ/B9Kb4nzckJNyaQQkpb2vRivqxq/XSgalPXPt3A=";
+    hash = "sha256-sfG67xZYvVdaKcqFzAh327Ot6zdv+oy/JCuHZxmuD5U=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/botocore-stubs/default.nix b/pkgs/development/python-modules/botocore-stubs/default.nix
index fc1920df72ba..4fbae283d8cb 100644
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.38.30";
+  version = "1.38.46";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-KR1785oxbACopVtyVUibAsDOoaNDSC53hOjR4jW66ZU=";
+    hash = "sha256-oE5pdmq4uuM4kRwYl0kviNBc1InNdfBubrTxNfnajHs=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/django-formtools/default.nix b/pkgs/development/python-modules/django-formtools/default.nix
index 5f74ef1802cb..6428cec5ae2f 100644
--- a/pkgs/development/python-modules/django-formtools/default.nix
+++ b/pkgs/development/python-modules/django-formtools/default.nix
@@ -40,7 +40,6 @@ buildPythonPackage rec {
     changelog = "https://github.com/jazzband/django-formtools/blob/master/docs/changelog.rst";
     license = licenses.bsd3;
     maintainers = with maintainers; [
-      schmittlauch
     ];
   };
 }
diff --git a/pkgs/development/python-modules/django-simple-captcha/default.nix b/pkgs/development/python-modules/django-simple-captcha/default.nix
index 210f1005bb58..a357a92ad576 100644
--- a/pkgs/development/python-modules/django-simple-captcha/default.nix
+++ b/pkgs/development/python-modules/django-simple-captcha/default.nix
@@ -60,7 +60,6 @@ buildPythonPackage rec {
     license = licenses.mit;
     maintainers = with maintainers; [
       mrmebelman
-      schmittlauch
     ];
   };
 }
diff --git a/pkgs/development/python-modules/django-statici18n/default.nix b/pkgs/development/python-modules/django-statici18n/default.nix
index d7b2e85fe2a3..9db592a84c7e 100644
--- a/pkgs/development/python-modules/django-statici18n/default.nix
+++ b/pkgs/development/python-modules/django-statici18n/default.nix
@@ -48,7 +48,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/zyegfryed/django-statici18n";
     license = licenses.bsd3;
     maintainers = with maintainers; [
-      schmittlauch
     ];
   };
 }
diff --git a/pkgs/development/python-modules/dowhen/default.nix b/pkgs/development/python-modules/dowhen/default.nix
new file mode 100644
index 000000000000..ad5ef9d6d278
--- /dev/null
+++ b/pkgs/development/python-modules/dowhen/default.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  pytestCheckHook,
+  nix-update-script,
+}:
+
+buildPythonPackage rec {
+  pname = "dowhen";
+  version = "0.1.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "gaogaotiantian";
+    repo = "dowhen";
+    tag = version;
+    hash = "sha256-7eoNe9SvE39J4mwIOxvbU1oh/L7tr/QM1uuBDqWtQu0=";
+  };
+
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "dowhen" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Intuitive and low-overhead instrumentation tool for Python";
+    homepage = "https://github.com/gaogaotiantian/dowhen";
+    changelog = "https://github.com/gaogaotiantian/dowhen/releases/tag/${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ moraxyc ];
+  };
+}
diff --git a/pkgs/development/python-modules/signxml/default.nix b/pkgs/development/python-modules/signxml/default.nix
index e95ce8284894..823f8247e34d 100644
--- a/pkgs/development/python-modules/signxml/default.nix
+++ b/pkgs/development/python-modules/signxml/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "signxml";
-  version = "4.0.5";
+  version = "4.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "XML-Security";
     repo = "signxml";
     tag = "v${version}";
-    hash = "sha256-dO7erKXyX/3qwWVC1laABOb+0yAkCy51rrnG1opL6pY=";
+    hash = "sha256-yNxqU5sg2xANCKLkaWYn1sr1SWQLPVfu9Jg3VF6Qf28=";
   };
 
   build-system = [
@@ -47,7 +47,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python XML Signature and XAdES library";
     homepage = "https://github.com/XML-Security/signxml";
-    changelog = "https://github.com/XML-Security/signxml/blob/${src.rev}/Changes.rst";
+    changelog = "https://github.com/XML-Security/signxml/blob/${src.tag}/Changes.rst";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index a8c92ff704c8..45959be9bb00 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1410";
+  version = "3.0.1411";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = version;
-    hash = "sha256-egpsFSYD5S+a3BcJ/4MElyJYyB5ziNY2CxvzbWGL7PM=";
+    hash = "sha256-YFqv7BIl7sOpGaRyMUTqiiT6w0kb7G0Xe5c3R/jPgUA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/wavinsentio/default.nix b/pkgs/development/python-modules/wavinsentio/default.nix
index b7b1f1cd645f..add20789e5b9 100644
--- a/pkgs/development/python-modules/wavinsentio/default.nix
+++ b/pkgs/development/python-modules/wavinsentio/default.nix
@@ -2,25 +2,25 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  pythonOlder,
   requests,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "wavinsentio";
-  version = "0.4.1";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.8";
+  version = "0.5.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Oko3Ivj95vajNWjQTQK18i5B/DIBngjw2HLlzYqLv2Y=";
+    hash = "sha256-YSofEjDehuNlenkAsQzLkX67Um4pkMSeZmVZgNA06vw=";
   };
 
-  propagatedBuildInputs = [ requests ];
+  build-system = [ setuptools ];
 
-  # Project has no tests
+  dependencies = [ requests ];
+
+  # Module has no tests
   doCheck = false;
 
   pythonImportsCheck = [ "wavinsentio" ];
@@ -28,7 +28,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python module to interact with the Wavin Sentio underfloor heating system";
     homepage = "https://github.com/djerik/wavinsentio";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/servers/home-assistant/custom-components/oref_alert/package.nix b/pkgs/servers/home-assistant/custom-components/oref_alert/package.nix
index 5fffab60d234..37cb64d622e3 100644
--- a/pkgs/servers/home-assistant/custom-components/oref_alert/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/oref_alert/package.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   aiofiles,
   shapely,
+  paho-mqtt,
   pytestCheckHook,
   pytest-homeassistant-custom-component,
   pytest-freezer,
@@ -12,25 +13,23 @@
 buildHomeAssistantComponent rec {
   owner = "amitfin";
   domain = "oref_alert";
-  version = "2.22.1";
+  version = "3.1.3";
 
   src = fetchFromGitHub {
     owner = "amitfin";
     repo = "oref_alert";
     tag = "v${version}";
-    hash = "sha256-OO3My8U8SCmhaJQI7y0kxVKj/stvfp3pdqhFdTCcIWs=";
+    hash = "sha256-Mr9zNq5KMuzwRAGoxi0P7ruYpKHoxy/DQWWjCisn7tA=";
   };
 
-  postPatch = ''
-    substituteInPlace custom_components/oref_alert/manifest.json \
-      --replace-fail shapely==2.0.7 shapely
-  '';
-
   dependencies = [
     aiofiles
     shapely
+    paho-mqtt
   ];
 
+  ignoreVersionRequirement = [ "shapely" ];
+
   nativeCheckInputs = [
     pytestCheckHook
     pytest-homeassistant-custom-component
diff --git a/pkgs/tools/networking/networkmanager/default.nix b/pkgs/tools/networking/networkmanager/default.nix
index 9513c66be3ad..2feabeefa54a 100644
--- a/pkgs/tools/networking/networkmanager/default.nix
+++ b/pkgs/tools/networking/networkmanager/default.nix
@@ -40,7 +40,6 @@
   docbook_xml_dtd_412,
   docbook_xml_dtd_42,
   docbook_xml_dtd_43,
-  openconnect,
   curl,
   meson,
   mesonEmulatorHook,
@@ -130,7 +129,6 @@ stdenv.mkDerivation (finalAttrs: {
     (replaceVars ./fix-paths.patch {
       inherit
         iputils
-        openconnect
         ethtool
         gnused
         ;
diff --git a/pkgs/tools/networking/networkmanager/fix-paths.patch b/pkgs/tools/networking/networkmanager/fix-paths.patch
index 47887de9283f..3cacf8152c2f 100644
--- a/pkgs/tools/networking/networkmanager/fix-paths.patch
+++ b/pkgs/tools/networking/networkmanager/fix-paths.patch
@@ -11,10 +11,10 @@ index 148acade5c..6395fbfbe5 100644
  
  LABEL="nm_drivers_end"
 diff --git a/src/core/devices/nm-device.c b/src/core/devices/nm-device.c
-index f3441508ab..7cde8d7d39 100644
+index e310a9c680..ed8d838e43 100644
 --- a/src/core/devices/nm-device.c
 +++ b/src/core/devices/nm-device.c
-@@ -14839,14 +14839,14 @@ nm_device_start_ip_check(NMDevice *self)
+@@ -15239,14 +15239,14 @@ nm_device_start_ip_check(NMDevice *self)
              gw = nm_l3_config_data_get_best_default_route(l3cd, AF_INET);
              if (gw) {
                  nm_inet4_ntop(NMP_OBJECT_CAST_IP4_ROUTE(gw)->gateway, buf);
@@ -32,7 +32,7 @@ index f3441508ab..7cde8d7d39 100644
              }
          }
 diff --git a/src/libnmc-base/nm-vpn-helpers.c b/src/libnmc-base/nm-vpn-helpers.c
-index cbe76f5f1c..8515f94994 100644
+index cbe76f5f1c..6ec684f9fe 100644
 --- a/src/libnmc-base/nm-vpn-helpers.c
 +++ b/src/libnmc-base/nm-vpn-helpers.c
 @@ -284,15 +284,6 @@ nm_vpn_openconnect_authenticate_helper(NMSettingVpn *s_vpn, GPtrArray *secrets,
@@ -51,7 +51,7 @@ index cbe76f5f1c..8515f94994 100644
      const char *oc_argv[(12 + 2 * G_N_ELEMENTS(oc_property_args))];
      const char *gw;
      int         port;
-@@ -311,15 +302,7 @@ nm_vpn_openconnect_authenticate_helper(NMSettingVpn *s_vpn, GPtrArray *secrets,
+@@ -311,13 +302,8 @@ nm_vpn_openconnect_authenticate_helper(NMSettingVpn *s_vpn, GPtrArray *secrets,
  
      port = extract_url_port(gw);
  
@@ -62,9 +62,8 @@ index cbe76f5f1c..8515f94994 100644
 -                                         NULL,
 -                                         NULL,
 -                                         error);
--    if (!path)
--        return FALSE;
-+    path = "@openconnect@/bin/openconnect";
++    path = g_find_program_in_path("openconnect");
++
+     if (!path)
+         return FALSE;
  
-     oc_argv[oc_argc++] = path;
-     oc_argv[oc_argc++] = "--authenticate";
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 6cae261e2342..0a6acc725d97 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1381,6 +1381,7 @@ mapAliases {
     or for all fonts
       fonts.packages = [ ... ] ++ builtins.filter lib.attrsets.isDerivation (builtins.attrValues pkgs.nerd-fonts)
   ''; # Added 2024-11-09
+  networkmanager_strongswan = networkmanager-strongswan; # added 2025-06-29
   newlibCross = newlib; # Added 2024-09-06
   newlib-nanoCross = newlib-nano; # Added 2024-09-06
   nix-direnv-flakes = nix-direnv;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 970167f0b016..8e392aaab28b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5668,6 +5668,10 @@ with pkgs;
   jre = jdk;
   jre_headless = jdk_headless;
 
+  jre11_minimal = callPackage ../development/compilers/openjdk/jre.nix {
+    jdk = jdk11;
+    jdkOnBuild = buildPackages.jdk11;
+  };
   jre17_minimal = callPackage ../development/compilers/openjdk/jre.nix {
     jdk = jdk17;
     jdkOnBuild = buildPackages.jdk17;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 324afdf61bbe..4fb18ba9c235 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4234,6 +4234,8 @@ self: super: with self; {
 
   doubleratchet = callPackage ../development/python-modules/doubleratchet { };
 
+  dowhen = callPackage ../development/python-modules/dowhen { };
+
   downloader-cli = callPackage ../development/python-modules/downloader-cli { };
 
   doxmlparser = callPackage ../development/tools/documentation/doxygen/doxmlparser.nix { };