diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index f552cd7fa549..7771b7c6da66 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -24,6 +24,9 @@
 - `databricks-cli` has been updated from `0.290.2` to `1.x.x`, the first major release. OAuth tokens for interactive logins (`auth_type = databricks-cli`) are now stored in the OS-native secure store by default (Secret Service on Linux) instead of `~/.databricks/token-cache.json`; cached tokens from older versions are not migrated, so run `databricks auth login` once per profile after upgrading. To keep the previous file-backed storage, set `DATABRICKS_AUTH_STORAGE=plaintext` or add `auth_storage = plaintext` under `[__settings__]` in `~/.databrickscfg`. Additionally, the `vector_search_endpoints` DABs resource renamed `min_qps` to `target_qps` (and the `vector-search-endpoints` command renamed `--min-qps` to `--target-qps`). See the [upstream changelog](https://github.com/databricks/cli/blob/main/CHANGELOG.md) for details.
 
 - `hurl` has been updated to `8.x.x` which has some breaking changes. See [upstream changelog](https://github.com/Orange-OpenSource/hurl/releases/tag/8.0.0) for details.
+
+- `xsecurelock` no longer supports authentication via htaccess files (`~/.xsecurelock.pw`) or via the `pamtester` program by default. Only the recommended PAM module is supported unless rebuilt with `withHtaccess` or `withPamtester`.
+
 - `python3Packages.django-health-check` has been updated to major version 4. See its [migration guide](https://codingjoe.dev/django-health-check/migrate-to-v4/) and [changelog](https://github.com/codingjoe/django-health-check/releases/tag/4.0.0) for breaking changes.
 
 - `libgdata` has been removed, as it was archived upstream and relied on the insecure libsoup 2.4.
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 2e92e5a4baf3..9d9968c5491b 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -18693,6 +18693,12 @@
     githubId = 2072185;
     name = "Marc Scholten";
   };
+  Mr-Stoneman = {
+    email = "mrstoneman@sten.rocks";
+    github = "Mr-Stoneman";
+    githubId = 72991726;
+    name = "Mr-Stoneman";
+  };
   mrbenjadmin = {
     email = "mrbenjadmin@gmail.com";
     github = "mrbenjadmin";
@@ -28302,6 +28308,12 @@
     githubId = 1486805;
     name = "Toon Nolten";
   };
+  tophcodes = {
+    email = "toki@toph.so";
+    github = "tophcodes";
+    githubId = 3678770;
+    name = "Christopher Mühl";
+  };
   tornax = {
     email = "tornax@pm.me";
     github = "TornaxO7";
diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index 4ab5e4826e6f..0da2ba935bcc 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -80,6 +80,8 @@
 
 - [ImmichFrame](https://immichframe.dev/), display your photos from Immich as a digital photo frame. Available as [services.immichframe](#opt-services.immichframe.enable).
 
+- [adw-bluetooth](https://github.com/ezratweaver/adw-bluetooth), a GNOME-inspired LibAdwaita Bluetooth applet. Available as [services.adw-bluetooth](#opt-services.adw-bluetooth.enable).
+
 - [PdfDing](https://www.pdfding.com/), manage, view and edit your PDFs seamlessly on all your devices wherever you are. Available as [services.pdfding](#opt-services.pdfding.enable).
 
 - [mangowc](https://github.com/DreamMaoMao/mangowc), a lightweight and feature-rich Wayland compositor based on dwl. Available as [programs.mangowc](#opt-programs.mangowc.enable).
diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index 9f24254da7fa..0d5d9e9e8a42 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -16,6 +16,8 @@
 
 - [Nezha](https://github.com/nezhahq/nezha), a self-hosted, lightweight server and website monitoring and O&M tool. Available as [services.nezha](#opt-services.nezha.enable).
 
+- [mail-tlsa-check-exporter](https://github.com/ietf-tools/mail-tlsa-check-exporter), validates SMTP / IMAP server certificates against a TLSA record as a Prometheus exporter. Available as [services.prometheus.exporters.mail-tlsa-check](#opt-services.prometheus.exporters.mail-tlsa-check.enable).
+
 - [CastSponsorSkip](https://github.com/gabe565/CastSponsorSkip/), skips YouTube sponsorships (and sometimes ads) on all local Google Cast devices.
 
 - [Stump](https://www.stumpapp.dev/), a free and open source comics, manga and digital book server with OPDS support. Available as [services.stump](#opt-services.stump.enable).
@@ -40,6 +42,8 @@
 
 - `security.polkit.enablePkexecWrapper` has been introduced, making the `pkexec` setuid wrapper opt-in.
 
+- When Avahi's mDNS resolver is enabled (`services.avahi.nssmdns4` or `services.avahi.nssmdns6`), only the minimal mDNS resolver is enabled by default to avoid adding a 5 second delay to every failed reverse hostname lookup (e.g., delaying ping by 5 seconds). The "full" mDNS resolver now remains disabled unless `services.avahi.nssmdnsFull` is also enabled. Users who have customized [`/etc/mdns.allow`](https://github.com/avahi/nss-mdns/tree/master#etcmdnsallow) to allow mDNS domains not ending `.local` must enable `services.avahi.nssmdnsFull` to continue to resolve such domains.
+
 - `systemd.user.extraConfig` has been removed in favor of the structured [](#opt-systemd.user.settings.Manager) option. Use `systemd.user.settings.Manager` to set any `systemd-user.conf(5)` option directly. For example, replace `systemd.user.extraConfig = "DefaultTimeoutStartSec=60";` with `systemd.user.settings.Manager.DefaultTimeoutStartSec = 60;`.
 
 - `services.timesyncd.extraConfig` has been removed in favor of the structured [](#opt-services.timesyncd.settings.Time) option. Use `services.timesyncd.settings.Time` to set any `timesyncd.conf(5)` option directly. For example, replace `services.timesyncd.extraConfig = "PollIntervalMaxSec=180";` with `services.timesyncd.settings.Time.PollIntervalMaxSec = 180;`.
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 507eeb3a9ff0..0f420ffecbd3 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -559,6 +559,7 @@
   ./services/databases/victoriametrics.nix
   ./services/databases/victoriatraces.nix
   ./services/desktops/accountsservice.nix
+  ./services/desktops/adw-bluetooth.nix
   ./services/desktops/ayatana-indicators.nix
   ./services/desktops/bamf.nix
   ./services/desktops/blueman.nix
diff --git a/nixos/modules/security/default.nix b/nixos/modules/security/default.nix
index 5170383d6f5e..c1a4f7cf34a1 100644
--- a/nixos/modules/security/default.nix
+++ b/nixos/modules/security/default.nix
@@ -1,4 +1,8 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 let
   cfg = config.security;
 in
@@ -16,10 +20,16 @@ in
   config = lib.mkMerge [
     {
       # We set the default LSM's here due to them not being present if set when enabling AppArmor.
-      security.lsm = [
-        "landlock"
-        "yama"
-        "bpf"
+      security.lsm = lib.mkMerge [
+        [
+          "landlock"
+          "yama"
+        ]
+        # Load BPF last unconditionally. See: https://github.com/NixOS/nixpkgs/pull/533428.
+        # Apparmor (and potentially other modules) will load incorrectly if they are not before BPF.
+        # It is believed that there was a regression between kernel 6.12 and 6.18 which caused the
+        # passthrough stub or LSM stacking of the BPF module to interact with other modules incorrectly.
+        (lib.mkAfter [ "bpf" ])
       ];
     }
     (lib.mkIf (lib.lists.length cfg.lsm > 0) {
diff --git a/nixos/modules/services/audio/gonic.nix b/nixos/modules/services/audio/gonic.nix
index da259d6957d9..d1b150b6501f 100644
--- a/nixos/modules/services/audio/gonic.nix
+++ b/nixos/modules/services/audio/gonic.nix
@@ -93,6 +93,7 @@ in
         ];
         RestrictNamespaces = true;
         PrivateDevices = true;
+        PrivateTmp = true;
         PrivateUsers = true;
         ProtectClock = true;
         ProtectControlGroups = true;
diff --git a/nixos/modules/services/desktops/adw-bluetooth.nix b/nixos/modules/services/desktops/adw-bluetooth.nix
new file mode 100644
index 000000000000..43c6cfe4e436
--- /dev/null
+++ b/nixos/modules/services/desktops/adw-bluetooth.nix
@@ -0,0 +1,34 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.adw-bluetooth;
+in
+{
+  meta.maintainers = with lib.maintainers; [ ezratweaver ];
+
+  options.services.adw-bluetooth = {
+    enable = lib.mkEnableOption "Adwaita Bluetooth daemon";
+    package = lib.mkPackageOption pkgs "adw-bluetooth" { };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+    services.dbus.packages = [ cfg.package ];
+
+    systemd.user.services.adw-bluetooth-daemon = {
+      description = "AdwBluetooth Daemon";
+      wantedBy = [ "default.target" ];
+      after = [ "bluetooth.target" ];
+      serviceConfig = {
+        Type = "dbus";
+        BusName = "com.ezratweaver.AdwBluetoothDaemon";
+        ExecStart = "${cfg.package}/libexec/adw-bluetooth-daemon";
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/monitoring/prometheus/exporters.nix b/nixos/modules/services/monitoring/prometheus/exporters.nix
index 96ab896356f6..b1d7f62b582e 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@@ -86,6 +86,7 @@ let
         "lnd"
         "mail"
         "mailman3"
+        "mail-tlsa-check"
         "mikrotik"
         "modemmanager"
         "mongodb"
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/mail-tlsa-check.nix b/nixos/modules/services/monitoring/prometheus/exporters/mail-tlsa-check.nix
new file mode 100644
index 000000000000..aa66a45daee2
--- /dev/null
+++ b/nixos/modules/services/monitoring/prometheus/exporters/mail-tlsa-check.nix
@@ -0,0 +1,164 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.prometheus.exporters.mail-tlsa-check;
+
+  inherit (lib)
+    boolToString
+    collect
+    concatStringsSep
+    getExe
+    isBool
+    isList
+    isString
+    listToAttrs
+    mapAttrsRecursive
+    mkForce
+    mkOption
+    mkPackageOption
+    optionalAttrs
+    pipe
+    toUpper
+    types
+    ;
+
+  environment = pipe cfg.settings [
+    (mapAttrsRecursive (
+      path: value:
+      optionalAttrs (value != null) {
+        name = toUpper "MTCE_${concatStringsSep "_" path}";
+        value =
+          if isList value then
+            concatStringsSep "," value
+          else if isBool value then
+            boolToString value
+          else
+            toString value;
+      }
+    ))
+    (collect (x: isString x.name or false && isString x.value or false))
+    listToAttrs
+  ];
+in
+{
+  port = 19309;
+  extraOpts = {
+    package = mkPackageOption pkgs "mail-tlsa-check-exporter" { };
+    settings = mkOption {
+      description = "Settings for the mail-tlsa-check-exporter";
+      type = types.submodule {
+        freeformType = types.attrs;
+
+        options = {
+          tlsa.record = mkOption {
+            description = "The TLSA record to monitor";
+            type = types.str;
+            example = "_25._tcp.smtp.example.org";
+          };
+          check.timeout = mkOption {
+            description = "Timeout for validation checks to complete before giving up, in milliseconds (e.g. 15000 for 15 seconds)";
+            type = types.ints.positive;
+            default = 15000;
+            example = 10000;
+          };
+          ipv4.enabled = mkOption {
+            description = "Whether to enable monitoring over IPv4";
+            type = types.bool;
+            default = true;
+            example = false;
+          };
+          ipv6.enabled = mkOption {
+            description = "Whether to enable monitoring over IPv6";
+            type = types.bool;
+            default = true;
+            example = false;
+          };
+          server.port = mkOption {
+            description = ''
+              The port that the exporter listens on.
+
+              ::: {.note}
+              This is a read-only option that is read from {option}`services.prometheus.exporters.mail-tlsa-check.port`.
+              :::
+            '';
+            type = types.port;
+            default = cfg.port;
+            defaultText = lib.literalExpression "config.services.prometheus.exporters.mail-tlsa-check.port";
+            readOnly = true;
+          };
+          smtp = {
+            hostname = mkOption {
+              description = "The SMTP hostname to monitor";
+              type = types.nullOr types.str;
+              default = null;
+              example = "smtp.example.org";
+            };
+            port = mkOption {
+              description = ''
+                The SMTP port to monitor
+
+                ::: {.note}
+                The exporter currently only supports explicit TLS (StartTLS), see <https://github.com/ietf-tools/mail-tlsa-check-exporter/issues/6>
+                :::
+              '';
+              type = types.port;
+              default = 587;
+              example = 465;
+            };
+            client = mkOption {
+              description = "The host to send in the SMTP EHLO command (name/domain/IP address)";
+              type = types.str;
+              default = "tlsa-smtp-synthetics-probe";
+              example = "tlsa-exporter";
+            };
+          };
+          imap = {
+            hostname = mkOption {
+              description = "The IMAP hostname to monitor";
+              type = types.nullOr types.str;
+              default = null;
+              example = "imap.example.org";
+            };
+            port = mkOption {
+              description = ''
+                The IMAP port to monitor
+
+                ::: {.note}
+                The exporter currently only supports explicit TLS (StartTLS), see <https://github.com/ietf-tools/mail-tlsa-check-exporter/issues/6>
+                :::
+              '';
+              type = types.port;
+              default = 143;
+            };
+          };
+        };
+      };
+    };
+  };
+
+  assertions = [
+    {
+      assertion = cfg.settings.ipv4.enabled || cfg.ipv6.enabled;
+      message = "Both IPv4 and IPv6 are disabled, this is not possible as it won't monitor anything";
+    }
+    {
+      assertion = cfg.settings.smtp.hostname != null || cfg.settings.imap.hostname != null;
+      message = "Both SMTP and IMAP are disabled, this is not possible as it won't monitor anything";
+    }
+  ];
+
+  serviceOpts = {
+    inherit environment;
+
+    serviceConfig = {
+      ExecStart = getExe cfg.package;
+      MemoryDenyWriteExecute = mkForce false; # because v8 won't start otherwise
+      Restart = "always"; # because apparently, this service crashes and is intended to do so, see the upstream systemd unit
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/avahi-daemon.nix b/nixos/modules/services/networking/avahi-daemon.nix
index 6ff86daf6a9e..2e61b39835a2 100644
--- a/nixos/modules/services/networking/avahi-daemon.nix
+++ b/nixos/modules/services/networking/avahi-daemon.nix
@@ -262,6 +262,28 @@ in
       '';
     };
 
+    nssmdnsFull = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Whether to enable the full mDNS NSS (Name Service Switch) plug-in.
+
+        By default, only the minimal module is enabled. The minimal module
+        will only resolve `.local` domains and only perform reverse hostname
+        lookups for `169.254.0.0/16`. The full module will use mDNS to resolve any
+        domain allowed by [`/etc/mdns.allow`][1] and will perform reverse hostname
+        lookups for any IP address.
+
+        [1]: https://github.com/avahi/nss-mdns/tree/master#etcmdnsallow
+
+        ::: {.note}
+        Enabling this option will introduce a 5 second delay to failed reverse
+        hostname lookups. For example, this will often add a 5 second delay to
+        ping.
+        :::
+      '';
+    };
+
     cacheEntriesMax = lib.mkOption {
       type = lib.types.nullOr lib.types.int;
       default = null;
@@ -287,6 +309,15 @@ in
       (lib.mkIf cfg.wideArea "Enabling `services.avahi.wideArea` exposes this system to `CVE-2024-52615`.")
     ];
 
+    assertions = [
+      {
+        assertion = cfg.nssmdnsFull -> (cfg.nssmdns4 || cfg.nssmdns6);
+        message = ''
+          `services.avahi.nssmdnsFull` requires one or both of `services.avahi.nssmdns4` and/or `services.avahi.nssmdns6` to be enabled.
+        '';
+      }
+    ];
+
     users.users.avahi = {
       description = "avahi-daemon privilege separation user";
       home = "/var/empty";
@@ -312,7 +343,7 @@ in
       lib.optionals (cfg.nssmdns4 || cfg.nssmdns6) (
         lib.mkMerge [
           (lib.mkBefore [ "${mdns}_minimal [NOTFOUND=return]" ]) # before resolve
-          (lib.mkAfter [ "${mdns}" ]) # after dns
+          (lib.mkAfter (lib.optional cfg.nssmdnsFull "${mdns}")) # after dns
         ]
       );
 
diff --git a/nixos/modules/services/web-apps/mediawiki.nix b/nixos/modules/services/web-apps/mediawiki.nix
index af1dbcd223a7..b5a3e69209a6 100644
--- a/nixos/modules/services/web-apps/mediawiki.nix
+++ b/nixos/modules/services/web-apps/mediawiki.nix
@@ -616,7 +616,7 @@ in
       ++ lib.optional (cfg.database.type != "sqlite" && cfg.database.path != null) ''
         The services.mediawiki.database.path option will be ignored because services.mediawiki.database.type is not "sqlite".
       ''
-      ++ lib.optional (cfg.database.type == "mysql" && cfg.database.tablePrefix != null) ''
+      ++ lib.optional (cfg.database.type != "mysql" && cfg.database.tablePrefix != null) ''
         The services.mediawiki.database.tablePrefix option has no effect when the services.mediawiki.database.type is not "mysql".
       '';
 
diff --git a/nixos/modules/virtualisation/incus.nix b/nixos/modules/virtualisation/incus.nix
index 83a5a731ccb7..466e359c3147 100644
--- a/nixos/modules/virtualisation/incus.nix
+++ b/nixos/modules/virtualisation/incus.nix
@@ -363,21 +363,27 @@ in
           include ${cfg.lxcPackage}/etc/apparmor.d/lxc-containers
         '';
         "incusd".profile = ''
-          # This profile allows everything and only exists to give the
-          # application a name instead of having the label "unconfined"
+          # incusd is deliberatly left unconfined, with NO named profile attached to the binary.
+          # Incus checks its own confinement at startup by reading /proc/self/attr/current
+          # (https://github.com/lxc/incus/blob/92b0cbbc5728ed45578fdeeec634606af8826404/internal/server/sys/apparmor.go).
+          # Anything other than "unconfined" makes Incus believe that the host process is
+          # itself confined, which sends every container down the "reuse my own profile" branch in
+          # https://github.com/lxc/incus/blob/92b0cbbc5728ed45578fdeeec634606af8826404/internal/server/instance/drivers/driver_lxc.go
+          # instead of generating a "proper" per-container profile. Furthermore,
+          # that branch only strips " (enforce)" suffix before handing the string to lxc.apparmor.profile
+          # (https://github.com/lxc/incus/blob/92b0cbbc5728ed45578fdeeec634606af8826404/internal/server/instance/drivers/driver_lxc.go#L96),
+          # so the named profile with flags=(unconfined) produces a literal string
+          # "incusd (unconfined)", which the kernel rejects at change_profile() time
+          # with "label not found", failing every `incus start` when AppArmor is enabled.
+          # This was not caught before as AppArmor was stifled by bpf.
+
+          # We keep this policy to pull in the per-container /
+          # per-archive profiles incusd generates at runtime so
+          # apparmor_parser loads them.
 
           abi <abi/4.0>,
           include <tunables/global>
 
-          profile incusd ${lib.getExe' config.virtualisation.incus.package "incusd"} flags=(unconfined) {
-            userns,
-
-            include "/var/lib/incus/security/apparmor/cache"
-
-            # Site-specific additions and overrides. See local/README for details.
-            include if exists <local/incusd>
-          }
-
           include "/var/lib/incus/security/apparmor/profiles"
         '';
       };
diff --git a/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix b/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
index ad5a4b148996..e88e8d21768b 100644
--- a/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
+++ b/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "genesis-plus-gx";
-  version = "0-unstable-2026-06-12";
+  version = "0-unstable-2026-06-19";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "Genesis-Plus-GX";
-    rev = "d046ec708d443ec7d9d38f757fa8e01099dd5c5a";
-    hash = "sha256-Q3eqYnoGAUcQOSt33lcQHHDqc7aLGcxaf+gcRUC4FGs=";
+    rev = "f33876ca3e4f021f4b273aeabed42b551243b71c";
+    hash = "sha256-cmA4aBzR33Df3SNyB3e/reQnQmF0alT6RIeXK+ew+us=";
   };
 
   meta = {
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index 41c0339db9cc..21f19b0f1323 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -77,8 +77,8 @@ rec {
   thunderbird = thunderbird-latest;
 
   thunderbird-latest = common {
-    version = "151.0.1";
-    sha512 = "a09c1e18faa8d7fdccf39e905542c21e817230e68c7cc6050beec048d0fec0f8eb92e51278d2ccd8d8cfa842762662235517e20238b555a4ad48ee5648dc3589";
+    version = "152.0";
+    sha512 = "51b950af634e7c7dfb7c043d69f925ed6d50d4c44341761e7e3ef02d5db28d2c539cd8d9286195e3facf84869f57b12a58760105b5195c449b4e1e4c9b6200d2";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-latest";
diff --git a/pkgs/applications/virtualization/docker/compose.nix b/pkgs/applications/virtualization/docker/compose.nix
index 96820c023507..f1cc52d211f5 100644
--- a/pkgs/applications/virtualization/docker/compose.nix
+++ b/pkgs/applications/virtualization/docker/compose.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule rec {
   pname = "docker-compose";
-  version = "5.1.4";
+  version = "5.2.0";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "compose";
     tag = "v${version}";
-    hash = "sha256-sdRxssZ6bRGRB/WPp2BiDTVHQ5LBmNGwXQYBdSpylQg=";
+    hash = "sha256-sKfsPn8CV62TXY0LoquQYEUgSBVDRiKW0Z3/py1RFng=";
   };
 
-  vendorHash = "sha256-hgNboIZx5QOGjPadey4f2TKpPw+b2sja6mcwoMjINuY=";
+  vendorHash = "sha256-1cYmWaj6gvmM6207dj8E7kVKIOJlS4js9EwNXhnv13A=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 
diff --git a/pkgs/by-name/ad/adw-bluetooth/package.nix b/pkgs/by-name/ad/adw-bluetooth/package.nix
index fde7d2367c9a..f0b700ee9c9b 100644
--- a/pkgs/by-name/ad/adw-bluetooth/package.nix
+++ b/pkgs/by-name/ad/adw-bluetooth/package.nix
@@ -2,6 +2,7 @@
   stdenv,
   lib,
   fetchFromGitHub,
+  buildGoModule,
   meson,
   ninja,
   pkg-config,
@@ -13,17 +14,27 @@
   libadwaita,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
-  pname = "adw-bluetooth";
-  version = "1.0.0";
+let
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "ezratweaver";
     repo = "adw-bluetooth";
-    tag = finalAttrs.version;
-    hash = "sha256-/KJpB9i6tFDnB3C0tPtJtt8tTDfNftIkHmP1JSVSZNY=";
+    tag = version;
+    hash = "sha256-h3cHtecwBsx3j33qXVn/zaq4FZext71P7flzunCHqHg=";
   };
 
+  daemon = buildGoModule {
+    pname = "adw-bluetooth-daemon";
+    inherit version;
+    src = src + "/daemon";
+    vendorHash = "sha256-7tiSwNhq6e4LEh4lUkfh2i4tEdWWL6TxQpYYwYKsfog=";
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "adw-bluetooth";
+  inherit version src;
+
   nativeBuildInputs = [
     meson
     ninja
@@ -39,6 +50,13 @@ stdenv.mkDerivation (finalAttrs: {
     libadwaita
   ];
 
+  mesonFlags = [ "-Dbuild_daemon=false" ];
+
+  postInstall = ''
+    mkdir -p $out/libexec
+    ln -s ${daemon}/bin/daemon $out/libexec/adw-bluetooth-daemon
+  '';
+
   meta = {
     description = "GNOME Inspired LibAdwaita Bluetooth Applet";
     homepage = "https://github.com/ezratweaver/adw-bluetooth";
diff --git a/pkgs/by-name/al/alac/package.nix b/pkgs/by-name/al/alac/package.nix
index e46b5443477c..bb2d20b84405 100644
--- a/pkgs/by-name/al/alac/package.nix
+++ b/pkgs/by-name/al/alac/package.nix
@@ -8,7 +8,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "alac";
-  version = "0.0.7-unstable-2024-10-16";
+  version = "0.0.7-unstable-2026-04-10";
 
   outputs = [
     "out"
@@ -18,8 +18,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "mikebrady";
     repo = "alac";
-    rev = "1832544d27d01335d823d639b176d1cae25ecfd4";
-    hash = "sha256-xRWDeqyJ/BEaSWVlDXgaKIKJuBwM8kJDIATVTVaMn2k=";
+    rev = "5d8c5db0dfcadd5872f28e665cf4f4303447352a";
+    hash = "sha256-Wb6I5YHGvBVjVgOutICbRKH96odR3ZgmNS6HQedVahk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/al/althttpd/package.nix b/pkgs/by-name/al/althttpd/package.nix
index d9302fb2669a..001d2cdea7e2 100644
--- a/pkgs/by-name/al/althttpd/package.nix
+++ b/pkgs/by-name/al/althttpd/package.nix
@@ -8,12 +8,12 @@
 
 stdenv.mkDerivation {
   pname = "althttpd";
-  version = "0-unstable-2026-03-20";
+  version = "0-unstable-2026-06-03";
 
   src = fetchfossil {
     url = "https://sqlite.org/althttpd/";
-    rev = "a8fac0faaab1f43f";
-    hash = "sha256-Z4kZgCvqY7Kroc6A98s5UH4N8CEUzF+xmdXDRw2Lxtw=";
+    rev = "641e31f18cff7215";
+    hash = "sha256-AMOb1GHI99Plxdry89ynoLNpvFVpUzkdwffKLhJBKYw=";
   };
 
   buildInputs = [ openssl ];
diff --git a/pkgs/by-name/an/ananicy-rules-cachyos/package.nix b/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
index 9f082fd2af32..8cfac9b66729 100644
--- a/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
+++ b/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "ananicy-rules-cachyos";
-  version = "0-unstable-2026-06-15";
+  version = "0-unstable-2026-06-24";
 
   src = fetchFromGitHub {
     owner = "CachyOS";
     repo = "ananicy-rules";
-    rev = "70bc1a2c935518461e4e8d53d7c454489e26565d";
-    hash = "sha256-KJnZRXyl/iagknbFGh06dEtedMzJKZ+uDiXuP2OpMZE=";
+    rev = "c273ac846fade148468bce83d0221ed80d238c57";
+    hash = "sha256-upHgVyGnR6BIgXRzA3FCoryBukqx/CFp/39jKsc7BFo=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/at/attic-client/package.nix b/pkgs/by-name/at/attic-client/package.nix
index 72096bd19636..51fa7cbe75da 100644
--- a/pkgs/by-name/at/attic-client/package.nix
+++ b/pkgs/by-name/at/attic-client/package.nix
@@ -16,7 +16,7 @@ let
   # Only the attic-client crate builds against the Nix C++ libs
   # This derivation is also used to build the server
   needNixInclude = lib.elem "attic-client" crates;
-  nix = nixVersions.nix_2_28;
+  nix = nixVersions.nix_2_34;
 in
 
 rustPlatform.buildRustPackage {
diff --git a/pkgs/by-name/ba/barman/package.nix b/pkgs/by-name/ba/barman/package.nix
index 0390432c052e..df7e38409bd7 100644
--- a/pkgs/by-name/ba/barman/package.nix
+++ b/pkgs/by-name/ba/barman/package.nix
@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "barman";
-  version = "3.19.0";
+  version = "3.19.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "EnterpriseDB";
     repo = "barman";
     tag = "release/${finalAttrs.version}";
-    hash = "sha256-qjde8NdI+/2BH4L3LoxoYqdVwsaBXw1IcxYBx6sYqG8=";
+    hash = "sha256-7K7ibg2/hr5wBzGR8cW5FZNtPPFEBA7xPwmOl2c1fOU=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ca/cargo-tarpaulin/package.nix b/pkgs/by-name/ca/cargo-tarpaulin/package.nix
index 3945643395b6..388845f21469 100644
--- a/pkgs/by-name/ca/cargo-tarpaulin/package.nix
+++ b/pkgs/by-name/ca/cargo-tarpaulin/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-tarpaulin";
-  version = "0.35.4";
+  version = "0.35.5";
 
   src = fetchFromGitHub {
     owner = "xd009642";
     repo = "tarpaulin";
     tag = finalAttrs.version;
-    hash = "sha256-fm9q3VTZh5QKXXw4+t4xngz5gyiZqKpUHShpz0nf2Is=";
+    hash = "sha256-m822/s9HBKIxAfzgQEBOZeHcHU57MPGOumqlTc55Ro8=";
   };
 
-  cargoHash = "sha256-4og97E5zdRIO7swsfgh87MdWh4E4onMIcrCb1/KCJEc=";
+  cargoHash = "sha256-Qo06iUy/1ElEe/gkH23JZLw7AKPkBPw6aLXnvx9Hv4g=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ca/cargo-zigbuild/package.nix b/pkgs/by-name/ca/cargo-zigbuild/package.nix
index 115ef44c1b23..e8327d1ba95f 100644
--- a/pkgs/by-name/ca/cargo-zigbuild/package.nix
+++ b/pkgs/by-name/ca/cargo-zigbuild/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-zigbuild";
-  version = "0.22.3";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "rust-cross";
     repo = "cargo-zigbuild";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-f9jmt3UXniXVeX2NyuRx30DrpRtczLO7ZioNi4TI3Zk=";
+    hash = "sha256-Y73aPGsrSAZVxNJ1r1lS9uXmfpAwthq6NW4urKS8ab0=";
   };
 
-  cargoHash = "sha256-7ZQpAePAIqSNiKM8bTAhyx4QyDQda1J8TSnZX0W2tfY=";
+  cargoHash = "sha256-dt2s18B9RVwEBlun5cegoqfW1KYXFqjdScdc/Q2aDlI=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/co/concord-tui/package.nix b/pkgs/by-name/co/concord-tui/package.nix
new file mode 100644
index 000000000000..b6b1e5b95d29
--- /dev/null
+++ b/pkgs/by-name/co/concord-tui/package.nix
@@ -0,0 +1,46 @@
+{
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  alsa-lib,
+  cmake,
+  opus,
+  lib,
+  stdenv,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "concord-tui";
+  version = "2.2.2";
+
+  src = fetchFromGitHub {
+    owner = "chojs23";
+    repo = "concord";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-oKaP5ff19RYg73LsilD1Hxaz7nSr8QK/08jM1TylbWU=";
+  };
+
+  cargoHash = "sha256-jJkAXzmZAUHLIO2uVeR3KNTBYAnp31m49mk66/lKHHY=";
+
+  buildInputs = [
+    opus
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    alsa-lib
+  ];
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+  ];
+
+  __darwinAllowLocalNetworking = true;
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "Feature-rich TUI client for Discord, written in Rust";
+    homepage = "https://github.com/chojs23/concord";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ Simon-Weij ];
+    mainProgram = "concord";
+  };
+})
diff --git a/pkgs/by-name/cp/cp2k/package.nix b/pkgs/by-name/cp/cp2k/package.nix
index a89ef4cccf51..42775a325526 100644
--- a/pkgs/by-name/cp/cp2k/package.nix
+++ b/pkgs/by-name/cp/cp2k/package.nix
@@ -133,6 +133,9 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "cp2k";
   version = "2026.1-unstable-2026-06-16";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "cp2k";
     repo = "cp2k";
@@ -157,8 +160,11 @@ stdenv.mkDerivation (finalAttrs: {
     makeWrapper
     pkg-config
     gfortran
+    mpi
   ]
-  ++ lib.optional (gpuBackend == "cuda") cudaPackages.cuda_nvcc;
+  ++ lib.optionals (gpuBackend == "cuda") [
+    cudaPackages.cuda_nvcc
+  ];
 
   buildInputs = [
     fftw
@@ -191,6 +197,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional enableElpa elpa
   ++ lib.optionals (gpuBackend == "cuda") [
     cudaPackages.cuda_cudart
+    cudaPackages.libcufft
     cudaPackages.libcublas
     cudaPackages.cuda_nvrtc
   ]
diff --git a/pkgs/by-name/ct/ctx7/package.nix b/pkgs/by-name/ct/ctx7/package.nix
index aaa477fc26d0..67cca59a1728 100644
--- a/pkgs/by-name/ct/ctx7/package.nix
+++ b/pkgs/by-name/ct/ctx7/package.nix
@@ -16,7 +16,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ctx7";
-  version = "0.5.2";
+  version = "0.5.3";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "upstash";
     repo = "context7";
     tag = "${finalAttrs.pname}@${finalAttrs.version}";
-    hash = "sha256-CAOFt/oKjeFOIesJCTQsAq0miXssEJKNMLcd6Eb9HZs=";
+    hash = "sha256-J3FS0HPpkuriuxEyY1dluwdMovdvgWUTFgBxVUlf+GA=";
   };
 
   nativeBuildInputs = [
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-C+4QgpSJa5sDZr/0ltxHeaPX7IJTgG957dK/iA5sFXs=";
+    hash = "sha256-S+TCwe4FJHjSLTUL/cPh+eRtWx/z7REUyfMNT0BgK7k=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/fi/firewalld/package.nix b/pkgs/by-name/fi/firewalld/package.nix
index 613a72ead79a..646eae599f4e 100644
--- a/pkgs/by-name/fi/firewalld/package.nix
+++ b/pkgs/by-name/fi/firewalld/package.nix
@@ -43,7 +43,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "firewalld";
-  version = "2.4.2";
+  version = "2.4.3";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "firewalld";
     repo = "firewalld";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RUDDUvpGfWEKI+VtC4SBMLKsAHkStV1qAYpHLQbN5HM=";
+    hash = "sha256-S7E0szAZ2MEttL4PdBkoOcDGFVCVrwsTKr9xe+DPPgM=";
   };
 
   patches = [
diff --git a/pkgs/by-name/gi/gitaly/package.nix b/pkgs/by-name/gi/gitaly/package.nix
index 7143fd093f77..ceb96f569302 100644
--- a/pkgs/by-name/gi/gitaly/package.nix
+++ b/pkgs/by-name/gi/gitaly/package.nix
@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "18.11.5";
+  version = "18.11.6";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -21,7 +21,7 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-i2DgcNoGPR/B6qya+jYFU5noOSabSlwu9P7p5KwR6jI=";
+      hash = "sha256-fsr8ttV2q2iedTA5yn4iHry92Mgu775K1GW3JBz5N1U=";
     };
 
     vendorHash = "sha256-/RJnCcmUoqGy08MSGEVM/taV1qZK65kiZw19n6S3ZQ0=";
diff --git a/pkgs/by-name/gi/gitlab-pages/package.nix b/pkgs/by-name/gi/gitlab-pages/package.nix
index 096573d2c5f5..0c6ae216ff5c 100644
--- a/pkgs/by-name/gi/gitlab-pages/package.nix
+++ b/pkgs/by-name/gi/gitlab-pages/package.nix
@@ -6,14 +6,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "gitlab-pages";
-  version = "18.11.5";
+  version = "18.11.6";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-jSTXLbzYCiCpqrbs9kAmW6um2X5hA1OFiA6fSZrQ2RI=";
+    hash = "sha256-D/AlIXbcgvPyP2TX/lXVYlnG2HXKZlxOhqRTfTXsaew=";
   };
 
   vendorHash = "sha256-PUW4cgAiM1GTtvja894OZ4pe0SWChf5JsL4/fkns2kI=";
diff --git a/pkgs/by-name/gi/gitlab/data.json b/pkgs/by-name/gi/gitlab/data.json
index 3ce73f50325d..2f8606e66e98 100644
--- a/pkgs/by-name/gi/gitlab/data.json
+++ b/pkgs/by-name/gi/gitlab/data.json
@@ -1,17 +1,17 @@
 {
-  "version": "18.11.5",
-  "repo_hash": "sha256-/RIUqxfRjq3+TOvapYMfl0uVqQLp1adpE6bR303rH6g=",
+  "version": "18.11.6",
+  "repo_hash": "sha256-bdnBX6M4BtuA03CP/N0teKnuey3V9qHseBoxTIGXE5Q=",
   "yarn_hash": "sha256-og09R28lwYvDk4pe7z1dRMaanYiTsUSx+SUKoWc53do=",
   "frontend_islands_yarn_hash": "sha256-EvGQin+5DqqIgM36jlVkVI49WcJzVvceYnkSS9ybfcY=",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v18.11.5-ee",
+  "rev": "v18.11.6-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "18.11.5",
-    "GITLAB_KAS_VERSION": "18.11.5",
-    "GITLAB_PAGES_VERSION": "18.11.5",
+    "GITALY_SERVER_VERSION": "18.11.6",
+    "GITLAB_KAS_VERSION": "18.11.6",
+    "GITLAB_PAGES_VERSION": "18.11.6",
     "GITLAB_SHELL_VERSION": "14.50.0",
     "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.14.7",
-    "GITLAB_WORKHORSE_VERSION": "18.11.5"
+    "GITLAB_WORKHORSE_VERSION": "18.11.6"
   }
 }
diff --git a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
index 5fcf95d2f083..1e60673586d2 100644
--- a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
@@ -10,7 +10,7 @@ in
 buildGoModule (finalAttrs: {
   pname = "gitlab-workhorse";
 
-  version = "18.11.5";
+  version = "18.11.6";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
index 9e054ba008c9..ef81560ad325 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
@@ -537,7 +537,7 @@ GEM
       thor (>= 0.19, < 2)
     descendants_tracker (0.0.4)
       thread_safe (~> 0.3, >= 0.3.1)
-    devfile (0.5.0)
+    devfile (0.5.2)
     device_detector (1.1.3)
     devise (4.9.4)
       bcrypt (~> 3.0)
@@ -2678,7 +2678,7 @@ CHECKSUMS
   declarative_policy (2.1.0) sha256=f9ab705da726174bde97785c319311a4abf6143c07862f882bd8bc1b69361eea
   derailed_benchmarks (2.2.1) sha256=654280664fded41c9cd8fc27fc0fcfaf096023afab90eb4ac1185ba70c5d4439
   descendants_tracker (0.0.4) sha256=e9c41dd4cfbb85829a9301ea7e7c48c2a03b26f09319db230e6479ccdc780897
-  devfile (0.5.0) sha256=6a7e3be19e3e6b4b698b64ec4d6fd85b6653ce810c65cee611907d47ebb4cccf
+  devfile (0.5.2) sha256=2398cc38726f7bce03088eb74e4157f7839b353e36a488565e3fcc7739cd613d
   device_detector (1.1.3) sha256=c5fe3fe42cab2e8aa01f193b2074b8bb1510373ce47127206f28c7dea75a9c79
   devise (4.9.4) sha256=920042fe5e704c548aa4eb65ebdd65980b83ffae67feb32c697206bfd975a7f8
   devise-pbkdf2-encryptable (0.0.0)
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix b/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
index 4ed69ec68a77..4391115257d4 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
@@ -1621,10 +1621,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1kycnkmlfzch27kcwr8ch7756rjvv1plvv34idllnsrykvhknzka";
+      sha256 = "0gb1rlwpgk1zbrb8i91n7qsrp0zpax0lxdwf101wwyvgf8wcr613";
       type = "gem";
     };
-    version = "0.5.0";
+    version = "0.5.2";
   };
   device_detector = {
     groups = [ "default" ];
diff --git a/pkgs/by-name/gl/glycin-loaders/package.nix b/pkgs/by-name/gl/glycin-loaders/package.nix
index f9b97462d915..bb6e645bb5f1 100644
--- a/pkgs/by-name/gl/glycin-loaders/package.nix
+++ b/pkgs/by-name/gl/glycin-loaders/package.nix
@@ -20,8 +20,20 @@
   shared-mime-info,
   rustc,
   rustPlatform,
+
+  # List of loaders to build.
+  # https://gitlab.gnome.org/GNOME/glycin/-/blob/2.1.1/meson_options.txt?ref_type=tags#L26-43
+  enabledLoaders ? [
+    "heif"
+    "image-rs"
+    "jxl"
+    "svg"
+  ],
 }:
 
+# Doesn't produce any output if no loaders are enabled
+assert enabledLoaders != [ ];
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "glycin-loaders";
 
@@ -59,12 +71,15 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   mesonFlags = [
-    "-Dglycin-loaders=true"
-    "-Dglycin-thumbnailer=false"
-    "-Dlibglycin=false"
-    "-Dlibglycin-gtk4=false"
-    "-Dvapi=false"
+    (lib.mesonBool "glycin-loaders" true)
+    (lib.mesonBool "glycin-thumbnailer" false)
+    (lib.mesonBool "libglycin" false)
+    (lib.mesonBool "libglycin-gtk4" false)
+    (lib.mesonBool "vapi" false)
     (lib.mesonBool "tests" finalAttrs.finalPackage.doCheck)
+    (lib.mesonOption "loaders" (
+      lib.concatMapStringsSep "," (loader: "glycin-${loader}") enabledLoaders
+    ))
   ];
 
   strictDeps = true;
@@ -88,9 +103,16 @@ stdenv.mkDerivation (finalAttrs: {
     export XDG_CACHE_HOME=$(mktemp -d)
   '';
 
+  # Thumbnailer files are provided by glycin-thumbnailer
+  postInstall = ''
+    rm -r $out/share/thumbnailers
+  '';
+
   env.CARGO_BUILD_TARGET = stdenv.hostPlatform.rust.rustcTargetSpec;
 
   passthru = {
+    inherit enabledLoaders;
+
     tests = {
       withTests = finalAttrs.finalPackage.overrideAttrs {
         doCheck = true;
@@ -102,10 +124,12 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Glycin loaders for several formats";
     homepage = "https://gitlab.gnome.org/GNOME/glycin";
     teams = [ lib.teams.gnome ];
-    license = with lib.licenses; [
-      mpl20 # or
-      lgpl21Plus
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        mpl20
+        lgpl21Plus
+      ];
     platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/by-name/gl/glycin-thumbnailer/package.nix b/pkgs/by-name/gl/glycin-thumbnailer/package.nix
new file mode 100644
index 000000000000..f90b4dd1e43e
--- /dev/null
+++ b/pkgs/by-name/gl/glycin-thumbnailer/package.nix
@@ -0,0 +1,100 @@
+{
+  lib,
+  stdenv,
+  callPackage,
+  cargo,
+  fontconfig,
+  glib,
+  glycin-loaders,
+  glycin-thumbnailer,
+  libglycin,
+  libseccomp,
+  meson,
+  ninja,
+  pkg-config,
+  rustc,
+  rustPlatform,
+  wrapGAppsNoGuiHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "glycin-thumbnailer";
+
+  inherit (libglycin) version src cargoDeps;
+
+  nativeBuildInputs = [
+    cargo
+    libglycin.patchVendorHook
+    meson
+    ninja
+    pkg-config
+    rustc
+    rustPlatform.cargoSetupHook
+    wrapGAppsNoGuiHook
+  ];
+
+  buildInputs = [
+    fontconfig
+    glib
+    glycin-loaders
+    libglycin
+    libglycin.setupHook
+    libseccomp
+  ];
+
+  mesonFlags = [
+    (lib.mesonBool "glycin-loaders" false)
+    (lib.mesonBool "glycin-thumbnailer" true)
+    (lib.mesonBool "libglycin" false)
+    (lib.mesonBool "libglycin-gtk4" false)
+  ];
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  # Thumbnailer files are in `glycin-loaders`, but we provide them in this package
+  postInstall = ''
+    mkdir -p $out/share/thumbnailers
+    (
+      shopt -s failglob
+
+      for loader in ${lib.concatStringsSep " " glycin-loaders.passthru.enabledLoaders}; do
+        substitute \
+          "../glycin-loaders/glycin-$loader/glycin-$loader.thumbnailer.in" \
+          "$out/share/thumbnailers/glycin-$loader.thumbnailer" \
+          --subst-var-by "BINDIR" "$out/bin"
+      done
+    )
+  '';
+
+  passthru.tests = {
+    all-loaders = glycin-thumbnailer.override {
+      glycin-loaders = glycin-loaders.override {
+        enabledLoaders = [
+          "heif"
+          "image-rs"
+          "jxl"
+          "raw"
+          "svg"
+        ];
+      };
+    };
+    thumbnailer = callPackage ./tests.nix { };
+  };
+
+  meta = {
+    description = "Glycin thumbnailers for several formats";
+    homepage = "https://gitlab.gnome.org/GNOME/glycin";
+    changelog = "https://gitlab.gnome.org/GNOME/glycin/-/tags/${finalAttrs.version}";
+    license =
+      with lib.licenses;
+      OR [
+        mpl20
+        lgpl21Plus
+      ];
+    maintainers = with lib.maintainers; [ thunze ];
+    teams = [ lib.teams.gnome ];
+    platforms = lib.platforms.linux;
+    mainProgram = "glycin-thumbnailer";
+  };
+})
diff --git a/pkgs/by-name/gl/glycin-thumbnailer/tests.nix b/pkgs/by-name/gl/glycin-thumbnailer/tests.nix
new file mode 100644
index 000000000000..da7f2a845de1
--- /dev/null
+++ b/pkgs/by-name/gl/glycin-thumbnailer/tests.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  glycin-thumbnailer,
+  shared-mime-info,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "glycin-thumbnailer-test";
+  inherit (glycin-thumbnailer) version;
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "sophie-h";
+    repo = "test-images";
+    rev = "f7a06d9131a5686c1b58c56f42f9fda9ea5e620d";
+    hash = "sha256-qoteYmliUha3lY21PRM0FaeYu9aD5MsygBTsTYog9SE=";
+  };
+
+  # Fix incorrectly detected MIME types
+  preBuild = ''
+    export XDG_DATA_DIRS=${shared-mime-info}/share:$XDG_DATA_DIRS
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    cd images/
+    mkdir -p $out
+
+    for image in color/* icon/*; do
+      for size in 128 256 512 1024; do
+        input="file://$(realpath "$image")"
+        output="$out/$(basename "$image")-$size.png"
+
+        ${lib.getExe glycin-thumbnailer} -i "$input" -o "$output" -s $size
+        file -E "$output"
+      done
+    done
+
+    runHook postBuild
+  '';
+})
diff --git a/pkgs/by-name/li/libglycin-gtk4/package.nix b/pkgs/by-name/li/libglycin-gtk4/package.nix
index f5b46f1d68b3..b5181f595b22 100644
--- a/pkgs/by-name/li/libglycin-gtk4/package.nix
+++ b/pkgs/by-name/li/libglycin-gtk4/package.nix
@@ -96,10 +96,12 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "C-Bindings to convert glycin frames to GDK Textures";
     homepage = "https://gitlab.gnome.org/GNOME/glycin";
-    license = with lib.licenses; [
-      mpl20 # or
-      lgpl21Plus
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        mpl20
+        lgpl21Plus
+      ];
     teams = [ lib.teams.gnome ];
     platforms = lib.platforms.linux;
     pkgConfigModules = [
diff --git a/pkgs/by-name/li/libglycin/package.nix b/pkgs/by-name/li/libglycin/package.nix
index 9ee9bb5df921..3a42bc136d27 100644
--- a/pkgs/by-name/li/libglycin/package.nix
+++ b/pkgs/by-name/li/libglycin/package.nix
@@ -15,6 +15,7 @@
   glib,
   gobject-introspection,
   glycin-loaders,
+  glycin-thumbnailer,
   libglycin-gtk4,
   fontconfig,
   libseccomp,
@@ -153,6 +154,7 @@ stdenv.mkDerivation (finalAttrs: {
     tests = {
       inherit
         glycin-loaders
+        glycin-thumbnailer
         libglycin-gtk4
         ;
     };
@@ -162,10 +164,12 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Sandboxed and extendable image loading library";
     homepage = "https://gitlab.gnome.org/GNOME/glycin";
     changelog = "https://gitlab.gnome.org/GNOME/glycin/-/tags/${finalAttrs.version}";
-    license = with lib.licenses; [
-      mpl20 # or
-      lgpl21Plus
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        mpl20
+        lgpl21Plus
+      ];
     maintainers = [ ];
     teams = [ lib.teams.gnome ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/li/libpg_query/package.nix b/pkgs/by-name/li/libpg_query/package.nix
index 3f78829abccd..7e801d8839b7 100644
--- a/pkgs/by-name/li/libpg_query/package.nix
+++ b/pkgs/by-name/li/libpg_query/package.nix
@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libpg_query";
-  version = "17-6.1.0";
+  version = "18.0.0";
 
   src = fetchFromGitHub {
     owner = "pganalyze";
     repo = "libpg_query";
     tag = finalAttrs.version;
-    hash = "sha256-UXba2WYyIO7RcFcNZeLL+Q9CwlloMZ5oFfHfL7+j4dU=";
+    hash = "sha256-Fs9SFs8ramKYdkv1gEOMJd9SnLmKDcbf+zYKv1hHBfc=";
   };
 
   nativeBuildInputs = [ which ];
diff --git a/pkgs/by-name/li/librewolf-unwrapped/librewolf.nix b/pkgs/by-name/li/librewolf-unwrapped/librewolf.nix
index 8db148066c60..1e3bf61a2e63 100644
--- a/pkgs/by-name/li/librewolf-unwrapped/librewolf.nix
+++ b/pkgs/by-name/li/librewolf-unwrapped/librewolf.nix
@@ -37,8 +37,6 @@ rec {
     cp ${source}/assets/search-config.json services/settings/dumps/main/search-config.json
     sed -i '/MOZ_SERVICES_HEALTHREPORT/ s/True/False/' browser/moz.configure
 
-    sed -i '/# This must remain last./i gkrust_features += ["glean_disable_upload"]\'$'\n' toolkit/library/rust/gkrust-features.mozbuild
-
     cp ${source}/patches/pref-pane/category-librewolf.svg browser/themes/shared/preferences
     cp ${source}/patches/pref-pane/librewolf.css browser/themes/shared/preferences
     cp ${source}/patches/pref-pane/librewolf.inc.xhtml browser/components/preferences
diff --git a/pkgs/by-name/li/librewolf-unwrapped/src.json b/pkgs/by-name/li/librewolf-unwrapped/src.json
index d032717d2235..7995f6b699ea 100644
--- a/pkgs/by-name/li/librewolf-unwrapped/src.json
+++ b/pkgs/by-name/li/librewolf-unwrapped/src.json
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "152.0.1-2",
+  "packageVersion": "152.0.2-1",
   "source": {
-    "rev": "152.0.1-2",
-    "hash": "sha256-qr0eO+ucXguTb2QDhbsI9jjlx9fzfZVAI++87UfXcXE="
+    "rev": "152.0.2-1",
+    "hash": "sha256-CgH0HOtNbdoHMZ/MJL/zPK0Gn+e+qqtZjqPDSq63gX8="
   },
   "firefox": {
-    "version": "152.0.1",
-    "hash": "sha512-myWVFI7ZdwQOorIefW7OcPDlP6yblrMRWxE76nbq1sBCL26UsVQCg7Qw/tXo6aIndxpjV78W9W1TCn+ufcdVOg=="
+    "version": "152.0.2",
+    "hash": "sha512-5OVM///P1XUerFgXp7dLDvCqQ/wA7yk5fMnfmqUlcrInK5bmA3OnDXEr5NyEkXDY1cG0SfPql4tKso3uGQVrAw=="
   }
 }
diff --git a/pkgs/by-name/ls/lsplug/package.nix b/pkgs/by-name/ls/lsplug/package.nix
new file mode 100644
index 000000000000..23ac2a7f9adc
--- /dev/null
+++ b/pkgs/by-name/ls/lsplug/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  python3Packages,
+  fetchFromSourcehut,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "lsplug";
+  version = "7";
+  pyproject = true;
+
+  src = fetchFromSourcehut {
+    owner = "~martijnbraam";
+    repo = "lsplug";
+    tag = finalAttrs.version;
+    hash = "sha256-eY9XNEdJfQREKroxsuPlv3CKqNX/XiMEnN8TdGYGa+g=";
+  };
+
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  pythonImportsCheck = [
+    "lsplug"
+  ];
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "Replacement for lsusb that shows more useful info and less useless info";
+    homepage = "https://git.sr.ht/~martijnbraam/lsplug";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      Luflosi
+    ];
+    mainProgram = "lsplug";
+  };
+})
diff --git a/pkgs/by-name/ma/mail-tlsa-check-exporter/package.nix b/pkgs/by-name/ma/mail-tlsa-check-exporter/package.nix
new file mode 100644
index 000000000000..05aebe64bae1
--- /dev/null
+++ b/pkgs/by-name/ma/mail-tlsa-check-exporter/package.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  nix-update-script,
+  makeWrapper,
+  nodejs,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "mail-tlsa-check-exporter";
+  version = "0-unstable-2025-06-12";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "ietf-tools";
+    repo = "mail-tlsa-check-exporter";
+    rev = "9843bf85971fbe130e8cd32e6fcf0dfcee92e929";
+    hash = "sha256-5c3epExz3tv6gRiIfpDyV1pkfcRVWjtNpl93LWsYKdk=";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/libexec
+    cp $src/index.mjs $out/libexec
+
+    makeWrapper ${lib.getExe nodejs} $out/bin/mail-tlsa-check-exporter \
+      --append-flag $out/libexec/index.mjs
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch=main" ];
+  };
+
+  meta = {
+    description = "Validate SMTP / IMAP server certificates against a TLSA record as a Prometheus exporter";
+    homepage = "https://github.com/ietf-tools/mail-tlsa-check-exporter";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ bartoostveen ];
+    mainProgram = "mail-tlsa-check-exporter";
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/ma/mailspring/darwin.nix b/pkgs/by-name/ma/mailspring/darwin.nix
deleted file mode 100644
index 77750ef76453..000000000000
--- a/pkgs/by-name/ma/mailspring/darwin.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{
-  stdenv,
-  fetchurl,
-  pname,
-  version,
-  meta,
-  unzip,
-  makeWrapper,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  inherit pname version meta;
-
-  src = fetchurl {
-    url = "https://github.com/Foundry376/Mailspring/releases/download/${finalAttrs.version}/Mailspring-AppleSilicon.zip";
-    hash = "sha256-U8yh7Qsxu1AmqMVV2p9MmvNHH922yBEqWA8OsQleoCQ=";
-  };
-  dontUnpack = true;
-
-  nativeBuildInputs = [
-    unzip
-    makeWrapper
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/Applications $out/bin
-    unzip $src -d $out/Applications
-    makeWrapper $out/Applications/Mailspring.app/Contents/MacOS/Mailspring $out/bin/mailspring
-
-    runHook postInstall
-  '';
-})
diff --git a/pkgs/by-name/ma/mailspring/libetpan.nix b/pkgs/by-name/ma/mailspring/libetpan.nix
new file mode 100644
index 000000000000..93341ca2145b
--- /dev/null
+++ b/pkgs/by-name/ma/mailspring/libetpan.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  stdenv,
+
+  src,
+  version,
+
+  autoreconfHook,
+  pkg-config,
+
+  cyrus_sasl,
+  openssl,
+  zlib,
+}:
+stdenv.mkDerivation {
+  pname = "mailspring-libetpan";
+  inherit src version;
+
+  sourceRoot = "${src.name}/mailsync/Vendor/libetpan";
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
+
+  buildInputs = [
+    cyrus_sasl
+    openssl
+    zlib
+  ];
+
+  configureFlags = [
+    "--with-sasl=${cyrus_sasl.dev}"
+    "--with-openssl=${openssl.dev}"
+  ];
+
+  # Prevent GCC 14 from treating pointer type mismatches as fatal build errors
+  env.CFLAGS = toString [
+    "-std=gnu17"
+    "-Wno-error=incompatible-pointer-types"
+  ];
+
+  meta = {
+    description = "Modified fork of the libetpan mail framework";
+    homepage = "https://github.com/Foundry376/Mailspring-Sync";
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
+}
diff --git a/pkgs/by-name/ma/mailspring/linux.nix b/pkgs/by-name/ma/mailspring/linux.nix
deleted file mode 100644
index 54e04eb2e601..000000000000
--- a/pkgs/by-name/ma/mailspring/linux.nix
+++ /dev/null
@@ -1,101 +0,0 @@
-{
-  stdenv,
-  lib,
-  pname,
-  version,
-  meta,
-  fetchurl,
-  autoPatchelfHook,
-  alsa-lib,
-  coreutils,
-  curl,
-  db,
-  dpkg,
-  glib,
-  gtk3,
-  wrapGAppsHook3,
-  libkrb5,
-  libsecret,
-  nss,
-  openssl,
-  udev,
-  libxtst,
-  libxscrnsaver,
-  libxdamage,
-  libxshmfence,
-  libxkbfile,
-  libgbm,
-  libdrm,
-  libappindicator,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  inherit pname version meta;
-
-  src = fetchurl {
-    url = "https://github.com/Foundry376/Mailspring/releases/download/${finalAttrs.version}/mailspring-${finalAttrs.version}-amd64.deb";
-    hash = "sha256-pyEWypqujSYYmbpUgcUMJoew4nIjE/dQWTVdYTxhmN4=";
-  };
-
-  nativeBuildInputs = [
-    autoPatchelfHook
-    dpkg
-    wrapGAppsHook3
-  ];
-
-  buildInputs = [
-    alsa-lib
-    db
-    glib
-    gtk3
-    libkrb5
-    libsecret
-    nss
-    libxkbfile
-    libxdamage
-    libxscrnsaver
-    libxtst
-    libxshmfence
-    libgbm
-    libdrm
-    openssl
-    curl
-  ];
-
-  runtimeDependencies = [
-    coreutils
-    openssl
-    (lib.getLib udev)
-    libappindicator
-    libsecret
-  ];
-
-  unpackPhase = ''
-    runHook preUnpack
-
-    dpkg -x $src .
-
-    runHook postUnpack
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/{bin,lib}
-    cp -ar ./usr/share $out
-
-    substituteInPlace $out/share/mailspring/resources/app.asar.unpacked/mailsync \
-      --replace-fail dirname ${coreutils}/bin/dirname
-
-    ln -s $out/share/mailspring/mailspring $out/bin/mailspring
-    ln -s ${lib.getLib openssl}/lib/libcrypto.so $out/lib/libcrypto.so.1.0.0
-
-    runHook postInstall
-  '';
-
-  postFixup = # sh
-    ''
-      substituteInPlace $out/share/applications/Mailspring.desktop \
-        --replace-fail Exec=mailspring Exec=$out/bin/mailspring
-    '';
-})
diff --git a/pkgs/by-name/ma/mailspring/mailcore2.nix b/pkgs/by-name/ma/mailspring/mailcore2.nix
new file mode 100644
index 000000000000..aa5c4e4f5ba9
--- /dev/null
+++ b/pkgs/by-name/ma/mailspring/mailcore2.nix
@@ -0,0 +1,106 @@
+{
+  lib,
+  stdenv,
+
+  src,
+  version,
+
+  cmake,
+  pkg-config,
+
+  glib,
+  icu,
+  mailspring-libetpan,
+  pcre2,
+  openssl,
+  cyrus_sasl,
+  html-tidy,
+  libuuid,
+  libctemplate,
+  libsysprof-capture,
+  libxml2,
+  zlib,
+}:
+stdenv.mkDerivation {
+  pname = "mailspring-mailcore2";
+  inherit src version;
+
+  sourceRoot = "${src.name}/mailsync/Vendor/mailcore2";
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    cyrus_sasl
+    glib
+    html-tidy
+    icu
+    libctemplate
+    libsysprof-capture
+    libuuid
+    libxml2
+    mailspring-libetpan
+    openssl
+    pcre2
+    zlib
+  ];
+
+  # Prevent GCC 14 pointer errors
+  env = {
+    CXXFLAGS = toString [
+      "-std=gnu++17"
+      "-Wno-error=incompatible-pointer-types"
+    ];
+
+    CFLAGS = toString [
+      "-Wno-error=incompatible-pointer-types"
+    ];
+  };
+
+  # Only build the core library, mimicking ./build.sh
+  buildFlags = [ "MailCore" ];
+
+  postPatch = ''
+    # Fix hardcoded impure paths
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "/usr/include/libxml2" "${lib.getDev libxml2}/include/libxml2" \
+      --replace-fail "/usr/include/tidy" "${lib.getDev html-tidy}/include/tidy"
+
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    # Tell CMake to build with Objective C if the file is C, otherwise Objective C++ if the file is C++.
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "project (mailcore2)" "project (mailcore2 C CXX OBJC OBJCXX)
+    add_compile_options(\"$<$<COMPILE_LANGUAGE:C>:-xobjective-c>\" \"$<$<COMPILE_LANGUAGE:CXX>:-xobjective-c++>\")"
+
+    # Fix old tidy header reference
+    substituteInPlace src/core/basetypes/MCHTMLCleaner.cpp \
+      --replace-fail "buffio.h" "tidybuffio.h"
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib $out/include
+
+    cp src/libMailCore.* $out/lib/
+
+    cp -r src/include/MailCore $out/include/
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Modified fork of the mailcore2 asynchronous C++ framework";
+    homepage = "https://github.com/Foundry376/Mailspring-Sync";
+    license = lib.licenses.gpl3Plus;
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "x86_64-darwin"
+      "aarch64-darwin"
+    ];
+  };
+}
diff --git a/pkgs/by-name/ma/mailspring/mailsync.nix b/pkgs/by-name/ma/mailspring/mailsync.nix
new file mode 100644
index 000000000000..cd112e3b4740
--- /dev/null
+++ b/pkgs/by-name/ma/mailspring/mailsync.nix
@@ -0,0 +1,138 @@
+{
+  lib,
+  stdenv,
+  callPackage,
+
+  src,
+  version,
+
+  autoPatchelfHook,
+  cmake,
+  pkg-config,
+
+  c-ares,
+  curl,
+  cyrus_sasl,
+  glib,
+  html-tidy,
+  icu,
+  libctemplate,
+  libiconv,
+  libsysprof-capture,
+  libuuid,
+  libxml2,
+  pcre2,
+  sqlite,
+  xz,
+  zlib,
+}:
+let
+  # libetpan and mailcore2 have both been modified from their upstream sources, so we must provide the vendored derivations
+  # See: https://github.com/Foundry376/Mailspring/blob/master/mailsync/Vendor/README.md
+  mailspring-libetpan = callPackage ./libetpan.nix { inherit src version; };
+  mailspring-mailcore2 = callPackage ./mailcore2.nix { inherit src version mailspring-libetpan; };
+in
+stdenv.mkDerivation {
+  pname = "mailspring-sync";
+  inherit src version;
+
+  sourceRoot = "${src.name}/mailsync";
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ]
+  ++ lib.optionals stdenv.isLinux [
+    autoPatchelfHook
+  ];
+
+  buildInputs = [
+    c-ares
+    curl
+    cyrus_sasl
+    glib
+    html-tidy
+    icu
+    libctemplate
+    libsysprof-capture
+    libuuid
+    libxml2
+    mailspring-libetpan
+    mailspring-mailcore2
+    pcre2
+    sqlite
+    xz
+    zlib
+  ]
+  ++ lib.optionals stdenv.isDarwin [
+    libiconv
+  ];
+
+  runtimeDependencies = [
+    html-tidy
+  ];
+
+  env =
+    let
+      FLAGS = toString [
+        "-Wno-error=deprecated-declarations"
+        "-Wno-error=incompatible-pointer-types"
+      ];
+    in
+    {
+      CFLAGS = FLAGS;
+      CXXFLAGS = FLAGS;
+    };
+
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'IF(''${CMAKE_SYSTEM_NAME} MATCHES "Linux")' 'if(TRUE)'
+
+    # Replace hardcoded host paths and vendored dependencies
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "/usr/include/libxml2" "${lib.getDev libxml2}/include/libxml2" \
+      --replace-fail "find_library(RESOLV_LIB NAMES libresolv.a libresolv)" "set(RESOLV_LIB \"resolv\")" \
+      --replace-fail "target_link_libraries(mailsync libetpan.a)" "target_link_libraries(mailsync ${mailspring-libetpan}/lib/libetpan${stdenv.hostPlatform.extensions.sharedLibrary})" \
+      --replace-fail "target_link_libraries(mailsync libMailCore.a)" "target_link_libraries(mailsync ${mailspring-mailcore2}/lib/libMailCore.a)"
+
+    # Replace hardcoded references to archives with library references
+    # Transforms 'NAMES libfoo.a libfoo' into 'NAMES foo'
+    sed -i -E 's/NAMES lib([a-zA-Z0-9]+)\.a lib\1/NAMES \1/g' CMakeLists.txt
+  ''
+  + lib.optionalString stdenv.isDarwin ''
+    # UUID_LIB is provided by system frameworks
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "find_library(UUID_LIB NAMES uuid)" "set(UUID_LIB \"\")"
+
+    # Remove GCC related linker flags
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'set(CMAKE_EXE_LINKER_FLAGS "-static-libgcc -static-libstdc++")' ""
+
+    # Inject system frameworks and dependencies
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'target_link_libraries(mailsync pthread sasl2 ssl crypto curl dl)' \
+      'target_link_libraries(mailsync pthread sasl2 ssl crypto curl dl tidy iconv "-framework Foundation" "-framework CoreFoundation" "-framework Security" "-framework CoreServices" "-framework SystemConfiguration")'
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+
+    cp mailsync $out/bin
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Email synchronization engine for Mailspring";
+    homepage = "https://github.com/Foundry376/Mailspring-Sync";
+    license = lib.licenses.gpl3Plus;
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "x86_64-darwin"
+      "aarch64-darwin"
+    ];
+  };
+}
diff --git a/pkgs/by-name/ma/mailspring/package.nix b/pkgs/by-name/ma/mailspring/package.nix
index 37011710992f..d1e320d9d25b 100644
--- a/pkgs/by-name/ma/mailspring/package.nix
+++ b/pkgs/by-name/ma/mailspring/package.nix
@@ -1,31 +1,156 @@
 {
   lib,
-  stdenv,
+  buildNpmPackage,
   callPackage,
+  fetchFromGitHub,
+
+  makeBinaryWrapper,
+  pkg-config,
+  wrapGAppsHook3,
+  zip,
+
+  electron_41,
+  html-tidy,
+
+  # Command line arguments which are always set e.g "--password-store=kwallet6"
+  commandLineArgs ? "",
 }:
 let
+  version = "1.22.0";
+
+  src = fetchFromGitHub {
+    owner = "Foundry376";
+    repo = "Mailspring";
+    tag = version;
+    hash = "sha256-32d0WIWqCsZlvuT+RDa3EYxkwTxWzQyLIfASiDfZnL8=";
+    fetchSubmodules = true;
+  };
+
+  electron = electron_41;
+
+  mailspring-sync = callPackage ./mailsync.nix { inherit src version; };
+
+  mailspring-app = buildNpmPackage {
+    pname = "mailspring-app";
+    inherit version src;
+    sourceRoot = "${src.name}/app";
+    npmDepsHash = "sha256-b8CscOVVIbjkdf977LVVzFkWxOwn8XOemYpud5yK6vU=";
+    dontNpmBuild = true;
+    env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+
+    npmFlags = [ "--ignore-scripts" ];
+
+    makeCacheWritable = true;
+    installPhase = ''
+      cp -r . "$out"
+    '';
+
+    meta = {
+      description = "Node dependencies for the Mailspring electron frontend";
+      license = lib.licenses.gpl3Plus;
+      platforms = [
+        "x86_64-linux"
+        "aarch64-linux"
+        "x86_64-darwin"
+        "aarch64-darwin"
+      ];
+    };
+  };
+in
+buildNpmPackage (finalAttrs: {
   pname = "mailspring";
-  version = "1.21.1";
+  inherit version src;
+
+  npmDepsHash = "sha256-3uidHfxgGONdtwAnoVytIbRqRjwtz3Yu8tNQ0qT8mJQ=";
+
+  nativeBuildInputs = [
+    makeBinaryWrapper
+    pkg-config
+    wrapGAppsHook3
+    zip
+  ];
+
+  npmFlags = [ "--ignore-scripts" ];
+
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+
+  # Remove the postinstall script to stop it from downloading a recompiled mailspring-sync binary
+  postPatch = ''
+    echo "" > scripts/postinstall.js
+  '';
+
+  preConfigure = ''
+    chmod +w app
+    cp -r ${mailspring-app}/node_modules app/node_modules
+    chmod -R u+w app/node_modules
+
+    cp ${mailspring-sync}/bin/mailsync app/mailsync
+
+    # Remove nix sandbox violating steps from the build script
+    substituteInPlace app/build/build.js \
+      --replace-fail "runWriteCommitHashIntoPackage," "" \
+      --replace-fail "runUpdateSandboxHelperPermissions," "" \
+      --replace-fail "runCopySymlinkedPackages," "" \
+      --replace-fail "process.argv.includes('--skip-installers')" "true"
+
+    # Use npm env vars to make node-gyp compile against the electron ABI
+    export npm_config_target="${electron.version}"
+    export npm_config_nodedir="${electron.headers}"
+
+    # Create the electron archive to be used by electron-packager
+    cp -r ${electron.dist} electron-dist
+    chmod -R u+w electron-dist
+
+    pushd electron-dist
+    zip -0Xqr ../electron.zip .
+    popd
+
+    rm -r electron-dist
+
+    # force @electron/packager to use our electron instead of downloading it
+    substituteInPlace \
+      node_modules/@electron/packager/dist/packager.js \
+      --replace-fail "await this.getElectronZipPath(downloadOpts)" "'$(pwd)/electron.zip'"
+
+    pushd app
+    npm rebuild
+    popd
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/mailspring $out/bin
+
+    ASAR_PATH=$(find app/dist -name "app.asar" -print -quit)
+    cp -R "$(dirname "$ASAR_PATH")" $out/share/mailspring/resources
+
+    makeWrapper ${lib.getExe electron} "$out/bin/mailspring" \
+      --add-flags "$out/share/mailspring/resources/app.asar" \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ html-tidy ]}" \
+      --set-default ELECTRON_FORCE_IS_PACKAGED 1 \
+      --add-flags ${lib.escapeShellArg commandLineArgs}
+
+    runHook postInstall
+  '';
 
   meta = {
     description = "Beautiful, fast and maintained fork of Nylas Mail by one of the original authors";
-    downloadPage = "https://github.com/Foundry376/Mailspring";
+    downloadPage = "https://github.com/Foundry376/Mailspring/releases";
+    changelog = "https://github.com/Foundry376/Mailspring/releases/tag/${finalAttrs.version}";
     homepage = "https://getmailspring.com";
     license = lib.licenses.gpl3Plus;
     longDescription = ''
       Mailspring is an open-source mail client forked from Nylas Mail and built with Electron.
-      Mailspring's sync engine runs locally, but its source is not open.
+      Mailspring's sync engine is open source and written in C++ and C. It runs locally on your computer.
     '';
     mainProgram = "mailspring";
     maintainers = with lib.maintainers; [ wrench-exile-legacy ];
     platforms = [
       "x86_64-linux"
+      "aarch64-linux"
+      "x86_64-darwin"
       "aarch64-darwin"
     ];
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
-
-  linux = callPackage ./linux.nix { inherit pname version meta; };
-  darwin = callPackage ./darwin.nix { inherit pname version meta; };
-in
-if stdenv.hostPlatform.isDarwin then darwin else linux
+})
diff --git a/pkgs/by-name/ma/makemkv/package.nix b/pkgs/by-name/ma/makemkv/package.nix
index 71993f3e84f4..4fa2687716d7 100644
--- a/pkgs/by-name/ma/makemkv/package.nix
+++ b/pkgs/by-name/ma/makemkv/package.nix
@@ -27,19 +27,19 @@ stdenv.mkDerivation (
         "http://www.makemkv.com/download/makemkv-bin-${version}.tar.gz"
         "http://www.makemkv.com/download/old/makemkv-bin-${version}.tar.gz"
       ];
-      hash = "sha256-we5yCukbJ2p8ib6GEUbFuTRjGDHo1sj0U0BkNXJOkr0=";
+      hash = "sha256-zuVt4LqlUxq+0WvYYnQtMI13K0q02uFu6GW/dPBKFgg=";
     };
     srcs.oss = fetchurl {
       urls = [
         "http://www.makemkv.com/download/makemkv-oss-${version}.tar.gz"
         "http://www.makemkv.com/download/old/makemkv-oss-${version}.tar.gz"
       ];
-      hash = "sha256-vIuwhK46q81QPVu5PvwnPgRuT9RmPTmpg2zgwEf+6CM=";
+      hash = "sha256-hZAGNkjULsKpWLdFc9cCLw9MM05OT+fdU7cMbnSLpFM=";
     };
   in
   {
     pname = "makemkv";
-    version = "1.18.3";
+    version = "1.18.4";
 
     srcs = lib.attrValues finalAttrs.passthru.srcs;
     sourceRoot = "makemkv-oss-${version}";
diff --git a/pkgs/by-name/mo/mos/package.nix b/pkgs/by-name/mo/mos/package.nix
index deaae5b146e1..2ed11eaf8ba9 100644
--- a/pkgs/by-name/mo/mos/package.nix
+++ b/pkgs/by-name/mo/mos/package.nix
@@ -3,15 +3,14 @@
   stdenvNoCC,
   fetchurl,
   unzip,
-  nix-update-script,
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "mos";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchurl {
-    url = "https://github.com/Caldis/Mos/releases/download/${finalAttrs.version}/Mos.Versions.${finalAttrs.version}-20260505.1.zip";
-    hash = "sha256-SswAG7V+7LbAbPcHwS4Kr+0TFg6XWhYTEK7lVC3lYCQ=";
+    url = "https://github.com/Caldis/Mos/releases/download/${finalAttrs.version}/Mos.Versions.${finalAttrs.version}-20260531.1.zip";
+    hash = "sha256-LqaelvCS5E2tqTpVvaHN2rMynFJ7vV8G4A37eOlTlgo=";
   };
   sourceRoot = ".";
 
diff --git a/pkgs/by-name/ne/nerdlog/package.nix b/pkgs/by-name/ne/nerdlog/package.nix
new file mode 100644
index 000000000000..90c3af05adfd
--- /dev/null
+++ b/pkgs/by-name/ne/nerdlog/package.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  libx11,
+  nix-update-script,
+  versionCheckHook,
+}:
+buildGoModule (finalAttrs: {
+  pname = "nerdlog";
+  version = "1.10.0";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "dimonomid";
+    repo = "nerdlog";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-XlzWNeyd+Ar4ArFcN1wkQ0aod6ckAiIb12odK7cf4+s=";
+  };
+
+  vendorHash = "sha256-hvv0dsE1yz85VLaBOE7RWbux8L8kVTihcA1HyyHRYAM=";
+
+  buildInputs = [ libx11 ];
+
+  subPackages = [ "cmd/nerdlog" ];
+
+  ldflags = [
+    "-X github.com/dimonomid/nerdlog/version.version=${finalAttrs.version}"
+    "-X github.com/dimonomid/nerdlog/version.builtBy=nix"
+  ];
+
+  # e2e tests require SSH connections to test hosts
+  checkFlags = [
+    "-skip"
+    "^TestE2E"
+  ];
+
+  doInstallCheck = true;
+  nativeBuildInputs = [ versionCheckHook ];
+
+  # `nerdlog --version` will fail if $HOME is not defined
+  versionCheckKeepEnvironment = [ "HOME" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    changelog = "https://github.com/dimonomid/nerdlog/releases/tag/${finalAttrs.src.tag}";
+    description = "Fast, remote-first, multi-host TUI log viewer with timeline histogram";
+    longDescription = ''
+      Nerdlog is a fast, remote-first, multi-host TUI log viewer with timeline histogram
+      and no central server. Loosely inspired by Graylog/Kibana, but without the bloat.
+      Pretty much no setup needed, either.
+    '';
+    homepage = "https://github.com/dimonomid/nerdlog";
+    license = lib.licenses.bsd2;
+    mainProgram = "nerdlog";
+    maintainers = with lib.maintainers; [ tophcodes ];
+  };
+})
diff --git a/pkgs/by-name/ne/netbird-dashboard/package.nix b/pkgs/by-name/ne/netbird-dashboard/package.nix
index 4e2109b3553f..5d94f97b6df7 100644
--- a/pkgs/by-name/ne/netbird-dashboard/package.nix
+++ b/pkgs/by-name/ne/netbird-dashboard/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "netbird-dashboard";
-  version = "2.39.0";
+  version = "2.80.0";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = "dashboard";
     rev = "v${version}";
-    hash = "sha256-9sSK9RBbe+u/sNt/5nsYJgS8QdBNdHMFUTrSggZiLos=";
+    hash = "sha256-Z0yE6w7CIBE/JD/JS4ehz+lT2lKoK8U9mjifMaO/joM=";
   };
 
-  npmDepsHash = "sha256-Ze+1r5Uh+wdm3MuVr93oS2itodx9Zdv+JYO6Uji1saw=";
+  npmDepsHash = "sha256-weTRhkPGoNF34iHOITCBhZj9LWwWmemMOng51aAv+BU=";
   npmFlags = [ "--legacy-peer-deps" ];
 
   installPhase = ''
diff --git a/pkgs/by-name/nr/nrpl/package.nix b/pkgs/by-name/nr/nrpl/package.nix
deleted file mode 100644
index c623f3a9da47..000000000000
--- a/pkgs/by-name/nr/nrpl/package.nix
+++ /dev/null
@@ -1,54 +0,0 @@
-{
-  lib,
-  buildNimPackage,
-  fetchFromGitHub,
-  fetchpatch,
-  makeWrapper,
-  nim,
-  pcre,
-  tinycc,
-}:
-
-buildNimPackage {
-  pname = "nrpl";
-  version = "20150522";
-
-  src = fetchFromGitHub {
-    owner = "wheineman";
-    repo = "nrpl";
-    rev = "6d6c189ab7d1c905cc29dc678d66e9e132026f69";
-    hash = "sha256-YpP1LJKX3cTPficoBUBGnUETwQX5rDCyIMxylSFNnrI=";
-  };
-
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ pcre ];
-
-  patches = [
-    (fetchpatch {
-      url = "https://patch-diff.githubusercontent.com/raw/wheineman/nrpl/pull/12.patch";
-      name = "update_for_new_nim.patch";
-      hash = "sha256-4fFj1RAxvQC9ysRBFlbEfMRPCzi+Rcu6lYEOC208zv0=";
-    })
-  ];
-
-  env.NIX_LDFLAGS = "-lpcre";
-
-  postFixup = ''
-    wrapProgram $out/bin/nrpl \
-      --prefix PATH : ${
-        lib.makeBinPath [
-          nim
-          tinycc
-        ]
-      }
-  '';
-
-  meta = {
-    description = "REPL for the Nim programming language";
-    mainProgram = "nrpl";
-    homepage = "https://github.com/wheineman/nrpl";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ peterhoeg ];
-    platforms = with lib.platforms; linux ++ darwin;
-  };
-}
diff --git a/pkgs/by-name/pa/palemoon-bin/package.nix b/pkgs/by-name/pa/palemoon-bin/package.nix
index fbb903774a53..7de709e66c33 100644
--- a/pkgs/by-name/pa/palemoon-bin/package.nix
+++ b/pkgs/by-name/pa/palemoon-bin/package.nix
@@ -22,7 +22,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "palemoon-bin";
-  version = "34.3.0.1";
+  version = "34.3.1";
 
   src = finalAttrs.passthru.sources."gtk${if withGTK3 then "3" else "2"}";
 
@@ -171,11 +171,11 @@ stdenv.mkDerivation (finalAttrs: {
       {
         gtk3 = fetchzip {
           urls = urlRegionVariants "gtk3";
-          hash = "sha256-U9OwgiQMVOayt5Krlina2s33wS55HuLN255tkVyQxoY=";
+          hash = "sha256-PFsdDuer6mbxFrcT0rSADcOxunoJIo3Y6O4NG4R8ygY=";
         };
         gtk2 = fetchzip {
           urls = urlRegionVariants "gtk2";
-          hash = "sha256-Yzr2ovHKFFNIem1PXTaajlxVKXB5frZQ/kfOL+jsmtE=";
+          hash = "sha256-C48vM0LI6rPSS0wFVnPRlppT4I5EFnWzBFg/Rxw++Bw=";
         };
       };
 
diff --git a/pkgs/by-name/pg/pg_activity/package.nix b/pkgs/by-name/pg/pg_activity/package.nix
index ac69363fb152..5ae027cd2668 100644
--- a/pkgs/by-name/pg/pg_activity/package.nix
+++ b/pkgs/by-name/pg/pg_activity/package.nix
@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "pg_activity";
-  version = "3.6.1";
+  version = "3.6.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dalibo";
     repo = "pg_activity";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-TzY+3RE06TxIrhl75wol9CvZDIz25GfgOx11vkREw2c=";
+    sha256 = "sha256-W5R521eyJjblCE5NG546ItMZo0CeBAhFLxMHUrbRGms=";
   };
 
   build-system = with python3Packages; [ setuptools ];
diff --git a/pkgs/by-name/pg/pgcenter/package.nix b/pkgs/by-name/pg/pgcenter/package.nix
index 16d718c020c1..0b39185b3276 100644
--- a/pkgs/by-name/pg/pgcenter/package.nix
+++ b/pkgs/by-name/pg/pgcenter/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "pgcenter";
-  version = "0.9.2";
+  version = "0.10.1";
 
   src = fetchFromGitHub {
     owner = "lesovsky";
     repo = "pgcenter";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-xaY01T12/5Peww9scRgfc5yHj7QA8BEwOK5l6OedziY=";
+    sha256 = "sha256-HSSHRMkzb0WkRAPEtG654ngnJw9rjkBq/v2Su4bUO8Y=";
   };
 
-  vendorHash = "sha256-9hYiyZ34atmSL7JvuXyiGU7HR4E6qN7bGZlyU+hP+FU=";
+  vendorHash = "sha256-nHPS/iLHQwM39UYpajQRAbZcK7PxTPU0mO2HapDRFDU=";
 
   subPackages = [ "cmd" ];
 
diff --git a/pkgs/by-name/pg/pgpool/package.nix b/pkgs/by-name/pg/pgpool/package.nix
index a6b4b6ea5d11..3f1a7d064bcf 100644
--- a/pkgs/by-name/pg/pgpool/package.nix
+++ b/pkgs/by-name/pg/pgpool/package.nix
@@ -19,7 +19,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pgpool";
-  version = "4.7.1";
+  version = "4.7.2";
 
   outputs = [
     "out"
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "pgpool";
     repo = "pgpool2";
     tag = "V${lib.replaceString "." "_" finalAttrs.version}";
-    hash = "sha256-npH4rhRToPVfKk7XyGGzdRSZMQ+APM8MBKHmd0rzlDw=";
+    hash = "sha256-gURWz9NeiHLL5DbUP7WnByHzCrLaI/8HWTRU9xO22EY=";
   };
 
   patches = [
diff --git a/pkgs/by-name/pg/pgroll/package.nix b/pkgs/by-name/pg/pgroll/package.nix
index 1166bef016b3..dd928e4e54e3 100644
--- a/pkgs/by-name/pg/pgroll/package.nix
+++ b/pkgs/by-name/pg/pgroll/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "pgroll";
-  version = "0.16.1";
+  version = "0.16.2";
 
   src = fetchFromGitHub {
     owner = "xataio";
     repo = "pgroll";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5mo6USnCzYRNx8i0pjxjfas/iZWFnRh3hY6hf17JAT4=";
+    hash = "sha256-pvc+hKWUY8OPKMU4QNwuTlw8ewhiDrFcS1q/hcOzqSk=";
   };
 
   proxyVendor = true;
diff --git a/pkgs/by-name/se/setools/package.nix b/pkgs/by-name/se/setools/package.nix
index 2d73f3bc566f..0f9b2b74b346 100644
--- a/pkgs/by-name/se/setools/package.nix
+++ b/pkgs/by-name/se/setools/package.nix
@@ -10,14 +10,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "setools";
-  version = "4.6.0";
+  version = "4.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "SELinuxProject";
     repo = "setools";
     tag = finalAttrs.version;
-    hash = "sha256-UZisEbHx3zO92gmRQSYsI8TmY9MjCP7AWNAESYklAkk=";
+    hash = "sha256-Xe+/ZEtSRfBPFcRnyR4igoTJVYBg4jH3Ov76CFVY8+k=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/si/sirius/package.nix b/pkgs/by-name/si/sirius/package.nix
index 3d38dd8b071b..f0784fadc7ab 100644
--- a/pkgs/by-name/si/sirius/package.nix
+++ b/pkgs/by-name/si/sirius/package.nix
@@ -55,6 +55,9 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "SIRIUS";
   version = "7.10.0";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "electronic-structure";
     repo = "SIRIUS";
@@ -70,9 +73,11 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     cmake
     gfortran
+    mpi
     pkg-config
   ]
-  ++ lib.optional (gpuBackend == "cuda") cudaPackages.cuda_nvcc;
+  ++ lib.optionals (gpuBackend == "cuda") [ cudaPackages.cuda_nvcc ]
+  ++ lib.optionals enablePython [ pythonPackages.python ];
 
   buildInputs = [
     blas
@@ -100,7 +105,9 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals (gpuBackend == "cuda") [
     cudaPackages.cuda_cudart
     cudaPackages.cuda_profiler_api
-    cudaPackages.cudatoolkit
+    cudaPackages.cuda_nvtx
+    cudaPackages.libcufft
+    cudaPackages.libcusolver
     cudaPackages.libcublas
   ]
   ++ lib.optionals (gpuBackend == "rocm") [
@@ -150,7 +157,6 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals (gpuBackend == "cuda") [
     "-DSIRIUS_USE_CUDA=ON"
-    "-DCUDA_TOOLKIT_ROOT_DIR=${cudaPackages.cudatoolkit}"
     (lib.cmakeFeature "CMAKE_CUDA_ARCHITECTURES" cudaPackages.flags.cmakeCudaArchitecturesString)
   ]
   ++ lib.optionals (gpuBackend == "rocm") [
diff --git a/pkgs/by-name/sp/sparkle/package.nix b/pkgs/by-name/sp/sparkle/package.nix
index bd10387d4e03..873c7b9b229c 100644
--- a/pkgs/by-name/sp/sparkle/package.nix
+++ b/pkgs/by-name/sp/sparkle/package.nix
@@ -3,7 +3,7 @@
   stdenvNoCC,
   buildGoModule,
   fetchFromGitHub,
-  pnpm_10_29_2,
+  pnpm,
   fetchPnpmDeps,
   pnpmConfigHook,
   nodejs,
@@ -22,8 +22,6 @@
 }:
 
 let
-  pnpm = pnpm_10_29_2;
-
   sparkle-service = buildGoModule {
     pname = "sparkle-service";
     version = "0-unstable-2025-10-24";
@@ -43,20 +41,20 @@ in
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "sparkle";
-  version = "1.26.4";
+  version = "1.26.5";
 
   src = fetchFromGitHub {
     owner = "xishang0128";
     repo = "sparkle";
     tag = finalAttrs.version;
-    hash = "sha256-+3MHCy1N1/kOVFYDNvNiP/jkL0HHi2RwfeIqe2Z40O8=";
+    hash = "sha256-b4SidOlMDSi+DdbuF3LmOMlQTSBxd2CAf9oshYGXWrQ=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-Us4qsCJdRZKYJQAgcqeStX7MfEqBWr4rKXBqU2K+KZI=";
+    hash = "sha256-UrMzBinZsTfZigkPMOySJ/Yjskh6Csna1M6XpBpq0vI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/st/step-agent/package.nix b/pkgs/by-name/st/step-agent/package.nix
new file mode 100644
index 000000000000..bf9570b18b97
--- /dev/null
+++ b/pkgs/by-name/st/step-agent/package.nix
@@ -0,0 +1,72 @@
+{
+  lib,
+  fetchurl,
+  installShellFiles,
+  stdenvNoCC,
+  stdenv,
+  autoPatchelfHook,
+  makeWrapper,
+  p11-kit,
+  polkit,
+  tpm2-openssl,
+  tpm2-tss,
+  nix-update-script,
+}:
+let
+  version = "0.67.3";
+
+  srcs = {
+    x86_64-linux = fetchurl {
+      url = "https://github.com/smallstep/step-agent-plugin/releases/download/v${version}/step-agent_${version}_linux_amd64.tar.gz";
+      sha256 = "sha256-sTZ6dNjyRwCWHWROUKCpq1rb8n9lT0cGOUOUpui9NJM=";
+    };
+
+    aarch64-linux = fetchurl {
+      url = "https://github.com/smallstep/step-agent-plugin/releases/download/v${version}/step-agent_${version}_linux_arm64.tar.gz";
+      sha256 = "sha256-0Vefuc+Xnx8x6Gu+WuS4zTHDIMepY593uFi3JKD+hrk=";
+    };
+  };
+in
+stdenvNoCC.mkDerivation {
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  inherit version;
+  pname = "step-agent";
+
+  src =
+    srcs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [
+    installShellFiles
+    makeWrapper
+    autoPatchelfHook
+  ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp -vr ./step-agent $out/bin/step-agent
+    wrapProgram $out/bin/step-agent --prefix PATH : ${
+      lib.makeBinPath [
+        tpm2-tss
+        tpm2-openssl
+        polkit
+        p11-kit
+      ]
+    }
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "step-agent is an automated certificate management agent plugin for step-cli";
+    homepage = "https://github.com/smallstep/step-agent-plugin/";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ Srylax ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    platforms = lib.platforms.linux;
+    mainProgram = "step-agent";
+  };
+}
diff --git a/pkgs/by-name/tm/tmc-cli/package.nix b/pkgs/by-name/tm/tmc-cli/package.nix
index 84913922d3d4..83959df50b34 100644
--- a/pkgs/by-name/tm/tmc-cli/package.nix
+++ b/pkgs/by-name/tm/tmc-cli/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tmc-cli";
-  version = "1.1.2";
+  version = "1.1.3";
 
   src = fetchFromGitHub {
     owner = "rage";
     repo = "tmc-cli-rust";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-C7X+XTOqquqf/W29+A4wUUl6aDZYLlc5XokkIOrCbp0=";
+    hash = "sha256-P6jlj9HWZ09vAw7EVT8po49eWGkGv/ppvKwnq06t2A0=";
   };
 
-  cargoHash = "sha256-2KoHKTN1Jvyvk9ravi0a9D+RIFYa1KmHLJQzKT2iP9A=";
+  cargoHash = "sha256-YUIEKr1nQij4f/4kOeJq6AgqeQq+U3bOBTJaJM2Bs2Y=";
 
   nativeCheckInputs = [
     writableTmpDirAsHomeHook
diff --git a/pkgs/by-name/ub/ubuntu-sans-mono/package.nix b/pkgs/by-name/ub/ubuntu-sans-mono/package.nix
index 59ddf9255242..d35a14500cff 100644
--- a/pkgs/by-name/ub/ubuntu-sans-mono/package.nix
+++ b/pkgs/by-name/ub/ubuntu-sans-mono/package.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "ubuntu-sans-mono";
-  version = "1.006";
+  version = "1.100";
 
   src = fetchFromGitHub {
     owner = "canonical";
     repo = "Ubuntu-Sans-Mono-fonts";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-EFZZnMZTQHo2Tr9/rtb7C5gAlQ/0uYT+MQ1gKkqQ5hE=";
+    hash = "sha256-3vHf1e1bHaFCPTYMDldoUPYQvMAW6//MiNiqlCjd7HQ=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/vl/vlc/package.nix b/pkgs/by-name/vl/vlc/package.nix
index 0f1a3937cabe..070f6c31eaac 100644
--- a/pkgs/by-name/vl/vlc/package.nix
+++ b/pkgs/by-name/vl/vlc/package.nix
@@ -5,7 +5,6 @@
   avahi,
   bison,
   cairo,
-  curl,
   dbus,
   faad2,
   fetchFromGitLab,
@@ -26,6 +25,7 @@
   libxinerama,
   libxpm,
   libarchive,
+  libaacs,
   libass,
   libbluray-full,
   libcaca,
@@ -82,10 +82,8 @@
   wayland-protocols,
   wayland-scanner,
   wrapGAppsHook3,
-  writeShellScript,
   libxcb-keysyms,
   zlib,
-
   chromecastSupport ? true,
   jackSupport ? false,
   onlyLibVLC ? false,
@@ -152,6 +150,7 @@ stdenv.mkDerivation (finalAttrs: {
     libGL
     libsm
     libarchive
+    libaacs
     libass
     libbluray-full
     libcaca
@@ -246,7 +245,7 @@ stdenv.mkDerivation (finalAttrs: {
   postPatch = ''
     echo "$version" > src/revision.txt
     substituteInPlace modules/text_renderer/freetype/platform_fonts.h \
-      --replace \
+      --replace-fail \
         /usr/share/fonts/truetype/freefont \
         ${freefont_ttf}/share/fonts/truetype
   ''
@@ -255,7 +254,7 @@ stdenv.mkDerivation (finalAttrs: {
   # https://www.lua.org/wshop13/Jericke.pdf#page=39
   + lib.optionalString (!stdenv.hostPlatform.canExecute stdenv.buildPlatform) ''
     substituteInPlace share/Makefile.am \
-      --replace $'.luac \\\n' $'.lua \\\n'
+      --replace-fail $'.luac \\\n' $'.lua \\\n'
   '';
 
   enableParallelBuilding = true;
@@ -299,6 +298,7 @@ stdenv.mkDerivation (finalAttrs: {
   # depends on a qt5.qttranslations that doesn't build, even though it
   # should be the same as pkgsBuildBuild.qt5.qttranslations.
   postFixup = ''
+    patchelf --add-rpath ${libaacs}/lib "$out/lib/vlc/plugins/access/liblibbluray_plugin.so"
     patchelf --add-rpath ${libv4l}/lib "$out/lib/vlc/plugins/access/libv4l2_plugin.so"
     find $out/lib/vlc/plugins -exec touch -d @1 '{}' ';'
     ${
diff --git a/pkgs/by-name/xs/xsecurelock/package.nix b/pkgs/by-name/xs/xsecurelock/package.nix
index beb5a7f835c8..f326e305b42b 100644
--- a/pkgs/by-name/xs/xsecurelock/package.nix
+++ b/pkgs/by-name/xs/xsecurelock/package.nix
@@ -12,16 +12,18 @@
   libxext,
   libxscrnsaver,
   pam,
-  apacheHttpd,
-  pamtester,
   coreutils,
   makeWrapper,
 
   # boolean flags
   withXscreensaver ? true,
-  xscreensaver ? null,
+  xscreensaver,
   withDocs ? false,
-  pandoc ? null,
+  pandoc,
+  withHtaccess ? false,
+  apacheHttpd,
+  withPamtester ? false,
+  pamtester,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -40,9 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     makeWrapper
   ]
-  ++ lib.optionals withDocs [
-    pandoc
-  ];
+  ++ lib.optional withDocs pandoc;
 
   buildInputs = [
     libx11
@@ -53,9 +53,9 @@ stdenv.mkDerivation (finalAttrs: {
     libxext
     libxscrnsaver
     pam
-    apacheHttpd
-    pamtester
-  ];
+  ]
+  ++ lib.optional withHtaccess apacheHttpd
+  ++ lib.optional withPamtester pamtester;
 
   configureFlags = [
     "--with-pam-service-name=login"
diff --git a/pkgs/by-name/ya/yara-x/package.nix b/pkgs/by-name/ya/yara-x/package.nix
index 0cb89701dd05..22807879f612 100644
--- a/pkgs/by-name/ya/yara-x/package.nix
+++ b/pkgs/by-name/ya/yara-x/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "yara-x";
-  version = "1.18.0";
+  version = "1.19.0";
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
     repo = "yara-x";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4cHCBSmBhjuk8otOB+ykiviaHVDmrguIVCLCRMcq7L4=";
+    hash = "sha256-CokjFTQoFT9k/2/MuQSbfzHonW4V0F8hskhqDvpCesM=";
   };
 
-  cargoHash = "sha256-MMERL3DcOlTEa2S6BMboFi8MfKC8ah2wZtOQRbO6ADg=";
+  cargoHash = "sha256-wMh8F++16tQ0IUhacBPb4rDcydmDKZKzQf8EK/qDJXo=";
 
   env = {
     CARGO_PROFILE_RELEASE_LTO = "fat";
diff --git a/pkgs/by-name/za/zapp/package.nix b/pkgs/by-name/za/zapp/package.nix
new file mode 100644
index 000000000000..434e70381090
--- /dev/null
+++ b/pkgs/by-name/za/zapp/package.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  udev,
+  stdenv,
+  pkg-config,
+  rustPlatform,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "zapp";
+  version = "1.0.1";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "zsa";
+    repo = "zapp";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-KhWL+SsN1z9qpxwHpaqRo3qAk7xAOHVkRAOa02Q2Myc=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    udev
+  ];
+
+  cargoHash = "sha256-gDyNwHrMdNQdKdr9RGfwFAU8IaUlGrlJxV0WClQ25JM=";
+  passthru.updateScript = nix-update-script { };
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  meta = {
+    description = "Flash ZSA keyboards from your terminal";
+    homepage = "https://github.com/zsa/zapp";
+    license = with lib.licenses; [
+      mit
+      commons-clause
+    ];
+    maintainers = with lib.maintainers; [ Mr-Stoneman ];
+    mainProgram = "zapp";
+  };
+})
diff --git a/pkgs/development/python-modules/captum/default.nix b/pkgs/development/python-modules/captum/default.nix
index 32889473641c..455eac5c5fc1 100644
--- a/pkgs/development/python-modules/captum/default.nix
+++ b/pkgs/development/python-modules/captum/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   buildPythonPackage,
   pytestCheckHook,
   setuptools,
@@ -53,6 +52,10 @@ buildPythonPackage rec {
     scikit-learn
   ];
 
+  preCheck = ''
+    export OMP_NUM_THREADS=1
+  '';
+
   disabledTestPaths =
     lib.optionals stdenv.hostPlatform.isDarwin [
       # These tests may fail if multiple builds run them at the same time due
diff --git a/pkgs/development/python-modules/claude-agent-sdk/default.nix b/pkgs/development/python-modules/claude-agent-sdk/default.nix
index f977c605e5a0..b9aed7f1f68f 100644
--- a/pkgs/development/python-modules/claude-agent-sdk/default.nix
+++ b/pkgs/development/python-modules/claude-agent-sdk/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "claude-agent-sdk";
-  version = "0.2.108";
+  version = "0.2.110";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "anthropics";
     repo = "claude-agent-sdk-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RL4YtNUoW6YFg/5eM8ZAlUNNDBuZLu01qNShN7Ddlxc=";
+    hash = "sha256-tz26ueGAMFM7sD95FoAzhKHvNo7NV9fYZoKfJy/t8Lw=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/fusepy/default.nix b/pkgs/development/python-modules/fusepy/default.nix
index 492418fdd3aa..51691711da24 100644
--- a/pkgs/development/python-modules/fusepy/default.nix
+++ b/pkgs/development/python-modules/fusepy/default.nix
@@ -31,7 +31,7 @@ buildPythonPackage (finalAttrs: {
   # No tests included
   doCheck = false;
 
-  pythonImportsCheck = [ "fuse" ];
+  pythonImportsCheck = lib.optionals (!stdenv.hostPlatform.isDarwin) [ "fuse" ];
 
   meta = {
     description = "Simple ctypes bindings for FUSE";
diff --git a/pkgs/development/python-modules/gguf/default.nix b/pkgs/development/python-modules/gguf/default.nix
index 27f44ca63e40..9b216bc0cf79 100644
--- a/pkgs/development/python-modules/gguf/default.nix
+++ b/pkgs/development/python-modules/gguf/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "gguf";
-  version = "9538";
+  version = "9775";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ggml-org";
     repo = "llama.cpp";
     tag = "b${finalAttrs.version}";
-    hash = "sha256-7cE5l+fnVsw72UyqAqKP2UmKg2seMCcqsZSKhHBSKLM=";
+    hash = "sha256-y//hC8lpHjyFA3UK6hmcwkzb99xCZyZRMRILo+Y7Ap4=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/gguf-py";
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 4e06b6135f5a..ae91f0c8d8f4 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202606241";
+  version = "0.1.202606251";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7B6OPBlYW8k9uSuZ86dmY9ROdgKDcsFLjVqesIDb9r8=";
+    hash = "sha256-13k3Z5D181y0Ildl1ZcThA1Z3f69YHux6XN2PlM2MVk=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/linearmodels/default.nix b/pkgs/development/python-modules/linearmodels/default.nix
index 9a5ae03ffe5f..d67690e48774 100644
--- a/pkgs/development/python-modules/linearmodels/default.nix
+++ b/pkgs/development/python-modules/linearmodels/default.nix
@@ -67,6 +67,8 @@ buildPythonPackage (finalAttrs: {
 
   preCheck = ''
     rm linearmodels/__init__.py
+
+    export OMP_NUM_THREADS=1
   '';
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/mace-torch/default.nix b/pkgs/development/python-modules/mace-torch/default.nix
index 3c8b486f643b..4ed39d479782 100644
--- a/pkgs/development/python-modules/mace-torch/default.nix
+++ b/pkgs/development/python-modules/mace-torch/default.nix
@@ -82,6 +82,10 @@ buildPythonPackage (finalAttrs: {
     writableTmpDirAsHomeHook
   ];
 
+  preCheck = ''
+    export OMP_NUM_THREADS=1
+  '';
+
   disabledTests = [
     # _pickle.PickleError: ScriptFunction cannot be pickled
     "test_run_eval_fail_with_wrong_model"
diff --git a/pkgs/development/python-modules/nomadnet/default.nix b/pkgs/development/python-modules/nomadnet/default.nix
index fead49b3abc9..22abc385601c 100644
--- a/pkgs/development/python-modules/nomadnet/default.nix
+++ b/pkgs/development/python-modules/nomadnet/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchFromGitHub,
+  fetchPypi,
   lxmf,
   msgpack,
   qrcode,
@@ -12,15 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "nomadnet";
-  version = "1.2.0";
+  version = "1.2.6";
   pyproject = true;
+
   __structuredAttrs = true;
 
-  src = fetchFromGitHub {
-    owner = "markqvist";
-    repo = "NomadNet";
-    tag = finalAttrs.version;
-    hash = "sha256-BaRZfqQ9oNpWQc5uQ0PvVduauW3+gTnDljYeBXlmJ9w=";
+  src = fetchPypi {
+    inherit (finalAttrs) version pname;
+    hash = "sha256-XNRs4avq22JslxkSlqgTOj0bKuiVwam3i9bzoMAUjAU=";
   };
 
   build-system = [ setuptools ];
@@ -41,7 +40,6 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Off-grid, resilient mesh communication";
     homepage = "https://github.com/markqvist/NomadNet";
-    changelog = "https://github.com/markqvist/NomadNet/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [
       drupol
diff --git a/pkgs/development/python-modules/pgvector/default.nix b/pkgs/development/python-modules/pgvector/default.nix
index 66351f445a6e..ea10cac552ce 100644
--- a/pkgs/development/python-modules/pgvector/default.nix
+++ b/pkgs/development/python-modules/pgvector/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
 
@@ -60,6 +61,8 @@ buildPythonPackage rec {
     sqlmodel
   ];
 
+  doCheck = lib.meta.availableOn stdenv.buildPlatform postgresqlTestHook;
+
   env = {
     PGDATABASE = "pgvector_python_test";
     postgresqlEnableTCP = 1;
diff --git a/pkgs/development/python-modules/rq/default.nix b/pkgs/development/python-modules/rq/default.nix
index a53e08d86223..0efb763e3694 100644
--- a/pkgs/development/python-modules/rq/default.nix
+++ b/pkgs/development/python-modules/rq/default.nix
@@ -76,6 +76,10 @@ buildPythonPackage (finalAttrs: {
       # PermissionError: [Errno 13] Permission denied: '/tmp/rq-tests.txt'
       "test_deleted_jobs_arent_executed"
       "test_suspend_worker_execution"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      # no delay between reaping worker and checking; racy
+      "test_reap_workers"
     ];
 
   pythonImportsCheck = [ "rq" ];
diff --git a/pkgs/development/python-modules/scikit-bio/default.nix b/pkgs/development/python-modules/scikit-bio/default.nix
index 1190d875005a..c909d8d66d08 100644
--- a/pkgs/development/python-modules/scikit-bio/default.nix
+++ b/pkgs/development/python-modules/scikit-bio/default.nix
@@ -62,6 +62,10 @@ buildPythonPackage (finalAttrs: {
     pytestCheckHook
   ];
 
+  preCheck = ''
+    export OMP_NUM_THREADS=1
+  '';
+
   # only the $out dir contains the built cython extensions, so we run the tests inside there
   enabledTestPaths = [ "${placeholder "out"}/${python.sitePackages}/skbio" ];
 
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 21a2f7aa0da9..198621e34494 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.120";
+  version = "3.1.122";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = finalAttrs.version;
-    hash = "sha256-VJnFj/NeGKT223boJWMZZC/LxHdu+pqNexd+ezuq/js=";
+    hash = "sha256-7d8WdODzOG+zkz+Y9f2OpdL2z5i12QZFOzOpGrVGUXY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/tinygrad/default.nix b/pkgs/development/python-modules/tinygrad/default.nix
index f1b3c33ba2ed..43aac9173f64 100644
--- a/pkgs/development/python-modules/tinygrad/default.nix
+++ b/pkgs/development/python-modules/tinygrad/default.nix
@@ -195,6 +195,8 @@ buildPythonPackage (finalAttrs: {
     # Flaky:
     #   AssertionError: 2.1376906810000946 not less than 2.0
     "test_recursive_pad"
+    # AssertionError: 23476983700 not greater than 60457564575 (performance test)
+    "test_flops"
 
     # Require internet access
     "testCopySHMtoDefault"
@@ -244,6 +246,10 @@ buildPythonPackage (finalAttrs: {
     "test_transcribe_long"
     "test_transcribe_long_no_batch"
     "test_vgg7"
+    # Downloads external model each time.
+    # Skipped when building on Hydra (no network access),
+    # but interferes with local builds
+    "test_xlm_roberta_large"
   ]
   ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
     # Fail with AssertionError
diff --git a/pkgs/development/python-modules/torch-geometric/default.nix b/pkgs/development/python-modules/torch-geometric/default.nix
index 06863712e7c5..839f5c8e02e5 100644
--- a/pkgs/development/python-modules/torch-geometric/default.nix
+++ b/pkgs/development/python-modules/torch-geometric/default.nix
@@ -185,6 +185,10 @@ buildPythonPackage (finalAttrs: {
     writableTmpDirAsHomeHook
   ];
 
+  preCheck = ''
+    export OMP_NUM_THREADS=1
+  '';
+
   pytestFlags = [
     # DeprecationWarning: Failing to pass a value to the 'type_params' parameter of
     # 'typing._eval_type' is deprecated, as it leads to incorrect behaviour when calling
diff --git a/pkgs/development/python-modules/x-transformers/default.nix b/pkgs/development/python-modules/x-transformers/default.nix
index 16d3dff4fd61..1496775f5eec 100644
--- a/pkgs/development/python-modules/x-transformers/default.nix
+++ b/pkgs/development/python-modules/x-transformers/default.nix
@@ -42,6 +42,10 @@ buildPythonPackage (finalAttrs: {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
+  preCheck = ''
+    export OMP_NUM_THREADS=1
+  '';
+
   # RuntimeError: torch.compile is not supported on Python 3.14+
   disabledTests = lib.optionals (pythonAtLeast "3.14") [ "test_up" ];
 
diff --git a/pkgs/development/rocq-modules/hierarchy-builder/default.nix b/pkgs/development/rocq-modules/hierarchy-builder/default.nix
index 84f8c41c91ca..25e0621aab3e 100644
--- a/pkgs/development/rocq-modules/hierarchy-builder/default.nix
+++ b/pkgs/development/rocq-modules/hierarchy-builder/default.nix
@@ -17,10 +17,12 @@ let
       in
       with lib.versions;
       lib.switch rocq-core.rocq-version [
+        (case (range "9.0" "9.2") "1.10.3")
         (case (range "9.0" "9.1") "1.10.2")
         (case (range "9.0" "9.1") "1.10.0")
         (case (range "9.0" "9.1") "1.9.1")
       ] null;
+    release."1.10.3".hash = "sha256-y13KxzLulIu39Ci3aMc1cZG4tw3LL2ab7U9snI6jrXc=";
     release."1.10.2".sha256 = "sha256-Uzni9qrYQP45Tr+JkHs0BuRARwmWSMwA/iHhIzkolxc=";
     release."1.10.0".sha256 = "sha256-c52nS8I0tia7Q8lZTFJyHVPVabW9xv55m7w6B7y3+e8=";
     release."1.9.1".sha256 = "sha256-AiS0ezMyfIYlXnuNsVLz1GlKQZzJX+ilkrKkbo0GrF0=";
diff --git a/pkgs/development/web/nodejs/v26.nix b/pkgs/development/web/nodejs/v26.nix
index 500d00eaaef0..3be4bfbc98f9 100644
--- a/pkgs/development/web/nodejs/v26.nix
+++ b/pkgs/development/web/nodejs/v26.nix
@@ -23,13 +23,16 @@ let
       [ ];
 in
 buildNodejs {
-  version = "26.3.1";
-  sha256 = "979b9b8308a8d2d4a27c662ed50448c85f970c0fd4f5ce8b98e8da78c441f2bc";
+  version = "26.4.0";
+  sha256 = "9eceb3621024069d91035b5471d2ebe86aa04d22dbeba72a782eaf36ff9183ac";
   patches =
     (
       if (stdenv.hostPlatform.emulatorAvailable buildPackages) then
         [
-          ./configure-emulator.patch
+          (fetchpatch2 {
+            url = "https://github.com/nodejs/node/commit/b087e922bde7bfd0cb4b7340bb473ddbbb84ee85.patch?full_index=1";
+            hash = "sha256-338rkBx2OAKyaelFj6jePU+shl+KTAl29a8KBItbDqc=";
+          })
         ]
       else
         [
diff --git a/pkgs/kde/plasma/plasma-workspace-wallpapers/default.nix b/pkgs/kde/plasma/plasma-workspace-wallpapers/default.nix
index 5d661c1c94fd..3a9553c7315e 100644
--- a/pkgs/kde/plasma/plasma-workspace-wallpapers/default.nix
+++ b/pkgs/kde/plasma/plasma-workspace-wallpapers/default.nix
@@ -1,9 +1,11 @@
 {
+  lib,
   mkKdeDerivation,
   extra-cmake-modules,
 }:
 mkKdeDerivation {
   pname = "plasma-workspace-wallpapers";
-
   extraBuildInputs = [ extra-cmake-modules ];
+
+  meta.platforms = lib.platforms.all;
 }
diff --git a/pkgs/servers/sql/postgresql/ext/timescaledb.nix b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
index 69917cfbd15d..82ca5939ad81 100644
--- a/pkgs/servers/sql/postgresql/ext/timescaledb.nix
+++ b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
@@ -13,13 +13,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "timescaledb${lib.optionalString (!enableUnfree) "-apache"}";
-  version = "2.27.2";
+  version = "2.28.0";
 
   src = fetchFromGitHub {
     owner = "timescale";
     repo = "timescaledb";
     tag = finalAttrs.version;
-    hash = "sha256-/z8qr+56svxnUrnmh0uetPPttXdc1B8aDKZ5mtZpTt4=";
+    hash = "sha256-/m1B74kvYzYElFFP8AgEjhqWNRkNy0/hponuSY09tgs=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -101,6 +101,12 @@ postgresqlBuildExtension (finalAttrs: {
     maintainers = with lib.maintainers; [ kirillrdy ];
     platforms = postgresql.meta.platforms;
     license = with lib.licenses; if enableUnfree then tsl else asl20;
-    broken = lib.versionOlder postgresql.version "15";
+    broken =
+      lib.versionOlder postgresql.version "15"
+      ||
+        # Check after next package update.
+        lib.warnIf (finalAttrs.version != "2.28.0") "Is postgresql19Packages.timescaledb still broken?" (
+          lib.versionAtLeast postgresql.version "19"
+        );
   };
 })
diff --git a/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix b/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
index c895d8ebe34e..1dd1d6283a81 100644
--- a/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
+++ b/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
@@ -15,8 +15,8 @@ buildPgrxExtension (finalAttrs: {
   version = "1.1.1";
 
   src = fetchFromGitHub {
-    owner = "tensorchord";
-    repo = "vectorchord";
+    owner = "supervc-stack";
+    repo = "VectorChord";
     tag = finalAttrs.version;
     hash = "sha256-QL9XGSQFOcrpww03Y5F0JuDbpo0v8oidUqucLxggkqE=";
   };
@@ -24,7 +24,7 @@ buildPgrxExtension (finalAttrs: {
   cargoHash = "sha256-IXOCzKJArNOcb/2TcJbLz1XdCquUpyF/cLHYU5vmlko=";
 
   # Include upgrade scripts in the final package
-  # https://github.com/tensorchord/VectorChord/blob/0.5.0/crates/make/src/main.rs#L366
+  # https://github.com/supervc-stack/VectorChord/blob/0.5.0/crates/make/src/main.rs#L366
   postInstall = ''
     cp sql/upgrade/* $out/share/postgresql/extension/
   '';
@@ -89,9 +89,15 @@ buildPgrxExtension (finalAttrs: {
   };
 
   meta = {
-    changelog = "https://github.com/tensorchord/VectorChord/releases/tag/${finalAttrs.version}";
+    # PostgreSQL 19 is not yet supported
+    # See https://github.com/supervc-stack/VectorChord/issues/464
+    # Check after next package update.
+    broken = lib.warnIf (
+      finalAttrs.version != "1.1.1"
+    ) "Is postgresql19Packages.vectorchord still broken?" (lib.versionAtLeast postgresql.version "19");
+    changelog = "https://github.com/supervc-stack/VectorChord/releases/tag/${finalAttrs.version}";
     description = "Scalable, fast, and disk-friendly vector search in Postgres, the successor of pgvecto.rs";
-    homepage = "https://github.com/tensorchord/VectorChord";
+    homepage = "https://github.com/supervc-stack/VectorChord";
     license = lib.licenses.OR [
       lib.licenses.agpl3Only
       lib.licenses.elastic20
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 794ed977e90f..58d2779f7c64 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1658,6 +1658,7 @@ mapAliases {
   notify-sharp = throw "'notify-sharp' has been removed as it was unmaintained and depends on deprecated dbus-sharp versions"; # Added 2025-08-25
   noto-fonts-emoji = throw "'noto-fonts-emoji' has been renamed to/replaced by 'noto-fonts-color-emoji'"; # Converted to throw 2025-10-27
   noto-fonts-extra = throw "'noto-fonts-extra' has been renamed to/replaced by 'noto-fonts'"; # Converted to throw 2025-10-27
+  nrpl = throw "'nrpl' has been removed as it depends on pcre, which is deprecated"; # Added 2026-06-25
   NSPlist = throw "'NSPlist' has been renamed to/replaced by 'nsplist'"; # Converted to throw 2025-10-27
   nuget-to-nix = throw "nuget-to-nix has been removed as it was deprecated in favor of nuget-to-json. Please use nuget-to-json instead"; # Added 2025-08-28
   nushellFull = throw "'nushellFull' has been renamed to/replaced by 'nushell'"; # Converted to throw 2025-10-27