diff --git a/maintainers/scripts/luarocks-packages.csv b/maintainers/scripts/luarocks-packages.csv
index a4416d002d23..30e305795d40 100644
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@@ -168,6 +168,7 @@ toml-edit,,,,,5.1,mrcjkb
 tree-sitter-cli,,,,,,
 tree-sitter-http,,,,0.0.33-1,,
 tree-sitter-norg,,,,,5.1,mrcjkb
+tree-sitter-norg-meta,,,,,,
 tree-sitter-orgmode,,,,,5.1,
 utf8,,,,,,
 tree-sitter-teal,,,,,,
diff --git a/pkgs/applications/emulators/libretro/cores/bluemsx.nix b/pkgs/applications/emulators/libretro/cores/bluemsx.nix
index 4dbf4e3a7ad9..ea4671ee5f49 100644
--- a/pkgs/applications/emulators/libretro/cores/bluemsx.nix
+++ b/pkgs/applications/emulators/libretro/cores/bluemsx.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "bluemsx";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-11";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "bluemsx-libretro";
-    rev = "8af516705652d240ef5bc69dea8276d0fdd16323";
-    hash = "sha256-QkJicDAfr+hFAlsqSLlonmGJEf/G9XFQ7oe/X4mvAhw=";
+    rev = "0b23b79f6b8c19f300d2d86958e89fbe2f6d30bc";
+    hash = "sha256-/rILuViKZBKZFZkCjuFuuuOE3AvDiHQqHtWq4Q8XSMA=";
   };
 
   meta = {
diff --git a/pkgs/applications/networking/firehol/iprange.nix b/pkgs/applications/networking/firehol/iprange.nix
index 02ccc9bfb4d4..be730bfed9ca 100644
--- a/pkgs/applications/networking/firehol/iprange.nix
+++ b/pkgs/applications/networking/firehol/iprange.nix
@@ -1,23 +1,38 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  autoreconfHook,
+  fetchFromGitHub,
+  versionCheckHook,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "iprange";
-  version = "1.0.4";
+  version = "2.0.0";
 
-  src = fetchurl {
-    url = "https://github.com/firehol/iprange/releases/download/v${version}/iprange-${version}.tar.xz";
-    sha256 = "0rymw4ydn09dng34q4g5111706fyppzs2gd5br76frgvfj4x2f71";
+  src = fetchFromGitHub {
+    owner = "firehol";
+    repo = "iprange";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-/rNM/5SmqpNX/yM/9EZdRYsXxgbPLp7+SL/RDtKo3+0=";
   };
 
+  nativeBuildInputs = [ autoreconfHook ];
+
+  configureFlags = [ "--disable-man" ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  doInstallCheck = true;
+
+  versionCheckProgramArg = [ "--version" ];
+
   meta = {
     description = "Manage IP ranges";
-    mainProgram = "iprange";
     homepage = "https://github.com/firehol/iprange";
-    license = lib.licenses.gpl2;
+    changelog = "https://github.com/firehol/iprange/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl2Plus;
     maintainers = [ ];
+    mainProgram = "iprange";
   };
-}
+})
diff --git a/pkgs/applications/networking/instant-messengers/discord/linux.nix b/pkgs/applications/networking/instant-messengers/discord/linux.nix
index be18e03f563d..f4616191e3bd 100644
--- a/pkgs/applications/networking/instant-messengers/discord/linux.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/linux.nix
@@ -111,7 +111,6 @@ stdenv.mkDerivation (finalAttrs: {
     ;
 
   nativeBuildInputs = [
-    alsa-lib
     autoPatchelfHook
     cups
     libdrm
@@ -122,14 +121,21 @@ stdenv.mkDerivation (finalAttrs: {
     libxtst
     libxcb
     libxshmfence
-    libgbm
-    nss
     wrapGAppsHook3
     makeShellWrapper
   ];
 
   dontWrapGApps = true;
 
+  buildInputs = [
+    alsa-lib
+    libgbm
+    nspr
+    nss
+  ];
+
+  strictDeps = true;
+
   libPath = lib.makeLibraryPath (
     [
       libcxx
diff --git a/pkgs/by-name/ca/cargo-audit/package.nix b/pkgs/by-name/ca/cargo-audit/package.nix
index fd6fc312778d..d7827e46db66 100644
--- a/pkgs/by-name/ca/cargo-audit/package.nix
+++ b/pkgs/by-name/ca/cargo-audit/package.nix
@@ -9,14 +9,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-audit";
-  version = "0.22.0";
+  version = "0.22.1";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-Ha2yVyu9331NaqiW91NEwCTIeW+3XPiqZzmatN5KOws=";
+    hash = "sha256-/K84iYr3mRNH8lbqHHa7Tsh7M3ykQ2hs6T1k/qrSsnA=";
   };
 
-  cargoHash = "sha256-f8nrW1l7UA8sixwqXBD1jCJi9qyKC5tNl/dWwCt41Lk=";
+  cargoHash = "sha256-Hr3CliJeb9ljHylx8mjkGyf4ybX79Fmt6CaFb6FMRts=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/go/goaccess/package.nix b/pkgs/by-name/go/goaccess/package.nix
index 7cafe38a3ee5..ad32acf68b3c 100644
--- a/pkgs/by-name/go/goaccess/package.nix
+++ b/pkgs/by-name/go/goaccess/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "goaccess";
-  version = "1.9.4";
+  version = "1.10.2";
 
   src = fetchFromGitHub {
     owner = "allinurl";
     repo = "goaccess";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KevxuZuIrMybNlPZgVDLO0zQe4LfAKxfVBbHnyTUC/o=";
+    hash = "sha256-n0+Z3kkjMCjPN0Cb0R1QGSzzXH3S9kjDchy9ay6109s=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
diff --git a/pkgs/by-name/gv/gvm-libs/package.nix b/pkgs/by-name/gv/gvm-libs/package.nix
index a597b66f1310..ac7071c9d71d 100644
--- a/pkgs/by-name/gv/gvm-libs/package.nix
+++ b/pkgs/by-name/gv/gvm-libs/package.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gvm-libs";
-  version = "22.40.0";
+  version = "22.41.0";
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "gvm-libs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oAU4yZeVw1rkOhce2bxulfzXux5e0EBh1hKApF7GOHo=";
+    hash = "sha256-6GYy+51Nw1zlppsMIYv4cH/yEMhxJ1lsLPgpsC4YRG4=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/im/immich/package.nix b/pkgs/by-name/im/immich/package.nix
index 8fa5d6c7691f..e94ad087378e 100644
--- a/pkgs/by-name/im/immich/package.nix
+++ b/pkgs/by-name/im/immich/package.nix
@@ -115,13 +115,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "immich";
-  version = "2.7.4";
+  version = "2.7.5";
 
   src = fetchFromGitHub {
     owner = "immich-app";
     repo = "immich";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cN5MM8lk2UY2gCG4RMryJc4SwbJNYm8IbTcqEmdaNF4=";
+    hash = "sha256-EC1IXM7KObAWfwG5KEao5VDp79d8WGNEI7E89lLOJ44=";
   };
 
   pnpmDeps = fetchPnpmDeps {
diff --git a/pkgs/by-name/nd/ndcurves/package.nix b/pkgs/by-name/nd/ndcurves/package.nix
index 770fea0fa4b9..ddd3895bc4ad 100644
--- a/pkgs/by-name/nd/ndcurves/package.nix
+++ b/pkgs/by-name/nd/ndcurves/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ndcurves";
-  version = "2.1.1";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "loco-3d";
     repo = "ndcurves";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-YnpC2yYEe9VNcHHDyv+glLrue/J/HXbK/VP7DTAE/q0=";
+    hash = "sha256-X9p01hMoAx6fMSEU/nf/eqyFgy23mZrpBFonjoT1DLo=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/op/opus/package.nix b/pkgs/by-name/op/opus/package.nix
new file mode 100644
index 000000000000..fdfe0cf2640a
--- /dev/null
+++ b/pkgs/by-name/op/opus/package.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  stdenv,
+  cmake,
+  fetchFromGitHub,
+  meson,
+  ninja,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "opus";
+  version = "1.5.2";
+
+  src = fetchFromGitHub {
+    owner = "xiph";
+    repo = "opus";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-M1G7ypcfs7nJmXgkyoG96jT/CkgN5BOzy+DGO4LVCvA=";
+  };
+
+  __structuredAttrs = true;
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+    meson
+    ninja
+  ];
+
+  meta = {
+    description = "Modern audio compression for the internet";
+    homepage = "https://github.com/xiph/opus";
+    changelog = "https://github.com/xiph/opus/blob/${finalAttrs.src.rev}/NEWS";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "opus";
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/pd/pdfding/frontend.nix b/pkgs/by-name/pd/pdfding/frontend.nix
index 7e10dda1567c..13df27f63e66 100644
--- a/pkgs/by-name/pd/pdfding/frontend.nix
+++ b/pkgs/by-name/pd/pdfding/frontend.nix
@@ -7,6 +7,8 @@
 
   tailwindcss_4,
   nodejs,
+
+  pdfding,
 }:
 let
   pdfjsVersion = "5.5.207"; # see update script
@@ -26,19 +28,13 @@ let
   };
 in
 stdenv.mkDerivation (finalAttrs: {
-  pname = "pdfding-frontend";
-  version = "1.7.1";
-  src = fetchFromGitHub {
-    owner = "mrmn2";
-    repo = "PdfDing";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-T3Y9eWwBVxGPISZ3EZndAR6mwsq4g67RRCPpoZPuh+0=";
-  };
+  pname = "${pdfding.pname}-frontend";
+  inherit (pdfding) src version;
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
-    name = "pdfding-frontend-${finalAttrs.version}-npm-deps";
-    hash = "sha256-an4KKKx65ehCm1YAlwLWYAW8pQMgB4HdDERqC/hfQi0=";
+    name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
+    hash = "sha256-HOGnzDKg1ca/27u1oQEtOkOl6Cg/7k+aLJEJhbypUhE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pd/pdfding/package.nix b/pkgs/by-name/pd/pdfding/package.nix
index fcc50b33aa0e..494924814094 100644
--- a/pkgs/by-name/pd/pdfding/package.nix
+++ b/pkgs/by-name/pd/pdfding/package.nix
@@ -12,12 +12,12 @@ let
 in
 python.pkgs.buildPythonPackage (finalAttrs: {
   pname = "pdfding";
-  version = "1.7.1";
+  version = "1.7.2";
   src = fetchFromGitHub {
     owner = "mrmn2";
     repo = "PdfDing";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-T3Y9eWwBVxGPISZ3EZndAR6mwsq4g67RRCPpoZPuh+0=";
+    hash = "sha256-a12Rq4fd3XEW6ZTsm8ISklpMu0ZKpeBrZXNh9My3vUQ=";
   };
   pyproject = true;
 
@@ -125,12 +125,12 @@ python.pkgs.buildPythonPackage (finalAttrs: {
   '';
 
   pythonRelaxDeps = [
+    "rapidfuzz"
     "django"
-    "django-allauth"
     "gunicorn"
-    "markdown"
     "nh3"
     "pypdf"
+    "pypdfium2"
     "whitenoise"
   ];
 
diff --git a/pkgs/by-name/se/sendspin-go/package.nix b/pkgs/by-name/se/sendspin-go/package.nix
new file mode 100644
index 000000000000..2f0ef02fbb91
--- /dev/null
+++ b/pkgs/by-name/se/sendspin-go/package.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  alsa-lib,
+  buildGoModule,
+  fetchFromGitHub,
+  ffmpeg,
+  libogg,
+  opus,
+  opusfile,
+  pkg-config,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "sendspin-go";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "Sendspin";
+    repo = "sendspin-go";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-37qTAjEgA6m9aYSt47z2jhnJwvI2Gk86bdPX+5m8hLw=";
+  };
+
+  __structuredAttrs = true;
+
+  vendorHash = "sha256-l1fHIkyZ513wroyB4Lsn76r+WzijG2ahKVid5ujkTyA=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    alsa-lib
+    libogg
+    opus
+    opusfile
+    ffmpeg
+  ];
+
+  env.CGO_LDFLAGS = "-lm";
+
+  ldflags = [ "-s" ];
+
+  preCheck = ''
+    # Tests require network features that are not available in the sandbox
+    substituteInPlace pkg/discovery/mdns_test.go \
+      --replace-fail "TestGetLocalIPs" "Skip_TestGetLocalIPs"
+  '';
+
+  meta = {
+    description = "Sendspin server and client";
+    homepage = "https://github.com/Sendspin/sendspin-go";
+    changelog = "https://github.com/Sendspin/sendspin-go/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "sendspin-go";
+  };
+})
diff --git a/pkgs/by-name/ts/tsid/package.nix b/pkgs/by-name/ts/tsid/package.nix
index d9d38e929fcd..bab941e3b92e 100644
--- a/pkgs/by-name/ts/tsid/package.nix
+++ b/pkgs/by-name/ts/tsid/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tsid";
-  version = "1.9.0";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "stack-of-tasks";
     repo = "tsid";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-enSYneV/Av7lF8ADdLqU1Wj2z8/ePocgecFtOBXS0EY=";
+    hash = "sha256-f/SecQfEmrlelVR5584KIHFwwrp5Cy2aBMKI/rxuPmc=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/by-name/wh/whatweb/package.nix b/pkgs/by-name/wh/whatweb/package.nix
index 2b84a0da7f2a..6b82e6cda43d 100644
--- a/pkgs/by-name/wh/whatweb/package.nix
+++ b/pkgs/by-name/wh/whatweb/package.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   bundlerEnv,
   ruby_3_4,
+  versionCheckHook,
   withMongo ? false,
   withRchardet ? false,
 }:
@@ -52,13 +53,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "whatweb";
-  version = "0.6.2";
+  version = "0.6.4";
 
   src = fetchFromGitHub {
     owner = "urbanadventurer";
     repo = "whatweb";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-EFQ4RHI1+kmlz/Bm+9KXbmY0iEBJnKfdQL5YGDWCfJQ=";
+    sha256 = "sha256-0oU3DAAwJRGUrrzxZUm8TZ1dlsufzTlonkgdVYsh4mQ=";
   };
 
   prePatch = ''
@@ -70,6 +71,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ gems ];
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
   installPhase = ''
     runHook preInstall
 
@@ -77,7 +80,7 @@ stdenv.mkDerivation (finalAttrs: {
     rm $out/bin/whatweb
     cat << EOF >> $out/bin/whatweb
     #!/bin/sh -e
-    export GEM_PATH="${gems}/lib/ruby/gems/3.3.0"
+    export GEM_PATH="${gems}/lib/ruby/gems/3.4.0"
     export RUBYOPT="-W0"
     exec ${ruby_3_4}/bin/ruby "$raw" "\$@"
     EOF
@@ -91,6 +94,8 @@ stdenv.mkDerivation (finalAttrs: {
     withRchardet = withRchardet;
   };
 
+  doInstallCheck = true;
+
   meta = {
     description = "Next generation web scanner";
     longDescription = ''
diff --git a/pkgs/by-name/xw/xwayland/package.nix b/pkgs/by-name/xw/xwayland/package.nix
index 23702f67bc55..4a26bc6945f3 100644
--- a/pkgs/by-name/xw/xwayland/package.nix
+++ b/pkgs/by-name/xw/xwayland/package.nix
@@ -56,11 +56,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xwayland";
-  version = "24.1.9";
+  version = "24.1.10";
 
   src = fetchurl {
     url = "mirror://xorg/individual/xserver/xwayland-${finalAttrs.version}.tar.xz";
-    hash = "sha256-8pevJ6hFCNubgNHLvMacOAHaOOtkxy87W1D1gkWa/dA=";
+    hash = "sha256-RZdivo6gRslDhmh9d6h63WBzhovuFPApE+r+u5RbeqA=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/za/zapper/package.nix b/pkgs/by-name/za/zapper/package.nix
new file mode 100644
index 000000000000..fe22cfa0cae6
--- /dev/null
+++ b/pkgs/by-name/za/zapper/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  glibc,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "zapper";
+  version = "1.1";
+
+  src = fetchFromGitHub {
+    owner = "hackerschoice";
+    repo = "zapper";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-k8tkM3/hRSWwsgLiv9+n06INYpk6tz0hMZtOcOlQfLw=";
+  };
+
+  __structuredAttrs = true;
+
+  strictDeps = true;
+
+  buildInputs = [ glibc.static ];
+
+  buildFlags = [ "zapper" ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 zapper $out/bin/zapper
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Zaps arguments and environment from the process list";
+    homepage = "https://github.com/hackerschoice/zapper";
+    changelog = "https://github.com/hackerschoice/zapper/releases/tag/v${finalAttrs.src.tag}";
+    # https://github.com/hackerschoice/zapper/issues/4
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "zapper";
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index f31caa40438d..d9310de861cd 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -4645,19 +4645,20 @@ final: prev: {
       nui-nvim,
       nvim-nio,
       pathlib-nvim,
-      plenary-nvim,
+      tree-sitter-norg,
+      tree-sitter-norg-meta,
     }:
     buildLuarocksPackage {
       pname = "neorg";
-      version = "9.4.0-1";
+      version = "9.6.4-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/neorg-9.4.0-1.rockspec";
-          sha256 = "0gm91iv0a5lpch6n92cnrcbpn525gxl735cgqwlldbrdfjwxv4y2";
+          url = "mirror://luarocks/neorg-9.6.4-1.rockspec";
+          sha256 = "11k7qwr7430wk3j5kf7isn3d9i4y0drmq6d0dwdx62s4cy9c3pvm";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/nvim-neorg/neorg/archive/d4e6b3665504baa88685c9d2e79446d336dc0594.zip";
-        sha256 = "0gjyn9csw3rngnjxq6hyh7zl20ks6ibqvb5kggmkr9qhi3a8kiaj";
+        url = "https://github.com/nvim-neorg/neorg/archive/1f14d72aad7165eac307a2a2f6be0fb97a04b3c2.zip";
+        sha256 = "0l7hc1w4j00csv8i6dgbdhx0jcf0017b7hhs8gcldvsyka50xkx5";
       };
 
       disabled = luaOlder "5.1";
@@ -4666,7 +4667,8 @@ final: prev: {
         nui-nvim
         nvim-nio
         pathlib-nvim
-        plenary-nvim
+        tree-sitter-norg
+        tree-sitter-norg-meta
       ];
 
       meta = {
@@ -6108,6 +6110,36 @@ final: prev: {
     }
   ) { };
 
+  tree-sitter-norg-meta = callPackage (
+    {
+      buildLuarocksPackage,
+      fetchurl,
+      fetchzip,
+      luarocks-build-treesitter-parser,
+    }:
+    buildLuarocksPackage {
+      pname = "tree-sitter-norg-meta";
+      version = "0.1.0-1";
+      knownRockspec =
+        (fetchurl {
+          url = "mirror://luarocks/tree-sitter-norg-meta-0.1.0-1.rockspec";
+          sha256 = "0vngnyvdad6n36r37sc96asl7h5mph691a0638523mffbg8zdfvr";
+        }).outPath;
+      src = fetchzip {
+        url = "https://github.com/nvim-neorg/tree-sitter-norg-meta/archive/v0.1.0.zip";
+        sha256 = "1vz74wc5yy5fykl9c3b16k6fsvskxp93acsy81p337jzg709v97j";
+      };
+
+      nativeBuildInputs = [ luarocks-build-treesitter-parser ];
+
+      meta = {
+        homepage = "https://github.com/nvim-neorg/tree-sitter-norg-meta";
+        license.fullName = "MIT";
+        description = "Treesitter parser for Norg's `@document.meta` blocks.";
+      };
+    }
+  ) { };
+
   tree-sitter-orgmode = callPackage (
     {
       buildLuarocksPackage,
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index 91083ad0a63d..c3983d8fe62a 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -889,9 +889,7 @@ in
     postConfigure = ''
       substituteInPlace ''${rockspecFilename} \
         --replace-fail "'nvim-nio ~> 1.7'," "'nvim-nio >= 1.7'," \
-        --replace-fail "'plenary.nvim == 0.1.4'," "'plenary.nvim'," \
-        --replace-fail "'nui.nvim == 0.3.0'," "'nui.nvim'," \
-        --replace-fail ", 'nvim-treesitter-legacy-api == 0.9.2'" ""
+        --replace-fail "'nui.nvim == 0.3.0'," "'nui.nvim',"
     '';
   };
 
@@ -1252,6 +1250,13 @@ in
     };
   });
 
+  tree-sitter-norg-meta = prev.tree-sitter-norg-meta.overrideAttrs (old: {
+    nativeBuildInputs = old.nativeBuildInputs or [ ] ++ [
+      writableTmpDirAsHomeHook
+      tree-sitter
+    ];
+  });
+
   tree-sitter-orgmode = prev.tree-sitter-orgmode.overrideAttrs (old: {
     nativeBuildInputs = old.nativeBuildInputs or [ ] ++ [
       writableTmpDirAsHomeHook
diff --git a/pkgs/development/python-modules/bugsnag/default.nix b/pkgs/development/python-modules/bugsnag/default.nix
index 8863c76bc48b..afd81e072b27 100644
--- a/pkgs/development/python-modules/bugsnag/default.nix
+++ b/pkgs/development/python-modules/bugsnag/default.nix
@@ -7,6 +7,7 @@
   setuptools,
   webob,
   pytestCheckHook,
+  pytest-cov-stub,
 }:
 
 buildPythonPackage rec {
@@ -21,11 +22,6 @@ buildPythonPackage rec {
     hash = "sha256-WXBdlgUoWdptv1weJf82qyH8TTqNCC1rYFEa972TqDY=";
   };
 
-  postPatch = ''
-    substituteInPlace tox.ini --replace-fail \
-      "--cov=bugsnag --cov-report html --cov-append --cov-report term" ""
-  '';
-
   build-system = [ setuptools ];
 
   dependencies = [ webob ];
@@ -39,7 +35,10 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "bugsnag" ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-cov-stub
+  ];
 
   disabledTestPaths = [
     # Extra dependencies
diff --git a/pkgs/development/python-modules/dnsight/default.nix b/pkgs/development/python-modules/dnsight/default.nix
index b62625bad763..0da61c71b7d6 100644
--- a/pkgs/development/python-modules/dnsight/default.nix
+++ b/pkgs/development/python-modules/dnsight/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "dnsight";
-  version = "1.0.1";
+  version = "1.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dnsight";
     repo = "dnsight";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WoYLAqNTbMVe+kd/cG1MPRSlYMMYPWP8wm96qr3IdY8=";
+    hash = "sha256-TirYLziPa1xRm7D54Unl5oVjsnsv6Gl0LRVUXzd9o/E=";
   };
 
   pythonRelaxDeps = [ "typer" ];
diff --git a/pkgs/development/python-modules/openevsewifi/default.nix b/pkgs/development/python-modules/openevsewifi/default.nix
index 53934a98d819..48ca148b5563 100644
--- a/pkgs/development/python-modules/openevsewifi/default.nix
+++ b/pkgs/development/python-modules/openevsewifi/default.nix
@@ -6,6 +6,7 @@
   fetchpatch,
   poetry-core,
   pytestCheckHook,
+  pytest-cov-stub,
   requests,
   requests-mock,
 }:
@@ -32,6 +33,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     requests-mock
     pytestCheckHook
+    pytest-cov-stub
   ];
 
   patches = [
@@ -43,11 +45,6 @@ buildPythonPackage rec {
     })
   ];
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace 'pytest-cov = "^2.8.1"' ""
-  '';
-
   pythonImportsCheck = [ "openevsewifi" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/pyairtable/default.nix b/pkgs/development/python-modules/pyairtable/default.nix
index 75a314bb50ed..07c312d832e1 100644
--- a/pkgs/development/python-modules/pyairtable/default.nix
+++ b/pkgs/development/python-modules/pyairtable/default.nix
@@ -11,7 +11,7 @@
   click,
 
   pytest,
-  pytest-cov,
+  pytest-cov-stub,
   mock,
   requests-mock,
   tox,
@@ -42,7 +42,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytest
-    pytest-cov
+    pytest-cov-stub
     mock
     requests-mock
     tox
diff --git a/pkgs/development/python-modules/realtime/default.nix b/pkgs/development/python-modules/realtime/default.nix
index 9b4a95b66703..345d00f17c4b 100644
--- a/pkgs/development/python-modules/realtime/default.nix
+++ b/pkgs/development/python-modules/realtime/default.nix
@@ -1,51 +1,48 @@
 {
+  lib,
+  aiohttp,
   buildPythonPackage,
   fetchFromGitHub,
-  lib,
   poetry-core,
-  aiohttp,
-  websockets,
-  typing-extensions,
   pydantic,
   pytest-asyncio,
   pytest-cov-stub,
-  python-dotenv,
   pytestCheckHook,
-  pythonRelaxDepsHook,
+  python-dotenv,
+  typing-extensions,
+  websockets,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "realtime";
-  version = "2.28.3";
+  version = "3.0.0a1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "supabase";
     repo = "supabase-py";
-    tag = "v${version}";
-    hash = "sha256-Ra7Ig9IMWouMIadx6mg/pe8GlgLCavR6OsPjqgySTCw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Pvu2zyRKS99/KEIWwQXBR7Moegt0KITiaMWi5mi+CL4=";
   };
 
-  sourceRoot = "${src.name}/src/realtime";
+  sourceRoot = "${finalAttrs.src.name}/src/realtime";
+
+  pythonRelaxDeps = [ "websockets" ];
 
   build-system = [ poetry-core ];
 
   dependencies = [
-    websockets
-    typing-extensions
     pydantic
+    typing-extensions
+    websockets
   ];
 
-  nativeBuildInputs = [ pythonRelaxDepsHook ];
-
-  pythonRelaxDeps = [ "websockets" ];
-
   nativeCheckInputs = [
     aiohttp
-    pytestCheckHook
-    pytest-cov-stub
-    python-dotenv
     pytest-asyncio
+    pytest-cov-stub
+    pytestCheckHook
+    python-dotenv
   ];
 
   pythonImportsCheck = [ "realtime" ];
@@ -58,8 +55,8 @@ buildPythonPackage rec {
   meta = {
     description = "Client library for Supabase Functions";
     homepage = "https://github.com/supabase/supabase-py";
-    changelog = "https://github.com/supabase/supabase-py/blob/v${src.tag}/CHANGELOG.md";
-    maintainers = with lib.maintainers; [ siegema ];
+    changelog = "https://github.com/supabase/supabase-py/blob/v${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ siegema ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/returns/default.nix b/pkgs/development/python-modules/returns/default.nix
index e0129305e666..d64ace0f1a24 100644
--- a/pkgs/development/python-modules/returns/default.nix
+++ b/pkgs/development/python-modules/returns/default.nix
@@ -8,6 +8,7 @@
   mypy,
   poetry-core,
   pytest-aio,
+  pytest-cov-stub,
   pytest-mypy,
   pytest-mypy-plugins,
   pytestCheckHook,
@@ -28,11 +29,6 @@ buildPythonPackage rec {
     hash = "sha256-VQzsa/uNTQVND0kc20d25to/6LELEiS3cqvG7a1kDw4=";
   };
 
-  postPatch = ''
-    sed -i setup.cfg \
-      -e '/--cov.*/d'
-  '';
-
   nativeBuildInputs = [ poetry-core ];
 
   propagatedBuildInputs = [ typing-extensions ];
@@ -45,6 +41,7 @@ buildPythonPackage rec {
     mypy
     pytestCheckHook
     pytest-aio
+    pytest-cov-stub
     pytest-mypy
     pytest-mypy-plugins
     setuptools
diff --git a/pkgs/development/python-modules/sense-energy/default.nix b/pkgs/development/python-modules/sense-energy/default.nix
index a15214ba69f7..2f40862c9b11 100644
--- a/pkgs/development/python-modules/sense-energy/default.nix
+++ b/pkgs/development/python-modules/sense-energy/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "sense-energy";
-  version = "0.14.0";
+  version = "0.14.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scottbonline";
     repo = "sense";
     tag = version;
-    hash = "sha256-he/Ti15H2JBngvNCBSwJQWa0LBIBFa+x38TW9g2CQ44=";
+    hash = "sha256-xHI4HuPZFVqBNCC9+bILRVLoZ1LFBW9N0tVT8UzYClw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/static3/default.nix b/pkgs/development/python-modules/static3/default.nix
index a834bc313453..45de611df216 100644
--- a/pkgs/development/python-modules/static3/default.nix
+++ b/pkgs/development/python-modules/static3/default.nix
@@ -8,6 +8,7 @@
 
   # tests
   pytestCheckHook,
+  pytest-cov-stub,
   webtest,
 }:
 
@@ -23,11 +24,6 @@ buildPythonPackage rec {
     hash = "sha256-uFgv+57/UZs4KoOdkFxbvTEDQrJbb0iYJ5JoWWN4yFY=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace ", 'pytest-cov'" ""
-  '';
-
   optional-dependencies = {
     KidMagic = [
       # TODO: kid
@@ -39,6 +35,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
+    pytest-cov-stub
     webtest
   ]
   ++ lib.concatAttrValues optional-dependencies;