diff --git a/ci/OWNERS b/ci/OWNERS
index 463c546e695b..7dbf1fa8c203 100644
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -223,10 +223,10 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 /pkgs/development/r-modules         @jbedo
 
 # Rust
-/pkgs/development/compilers/rust @alyssais @Mic92 @winterqt
-/pkgs/build-support/rust @winterqt
+/pkgs/development/compilers/rust @NixOS/rust @alyssais
+/pkgs/build-support/rust @NixOS/rust
 /pkgs/build-support/rust/fetch-cargo-vendor* @TomaSajt
-/doc/languages-frameworks/rust.section.md @winterqt
+/doc/languages-frameworks/rust.section.md @NixOS/rust
 
 # Tcl
 /pkgs/development/interpreters/tcl  @fgaz
diff --git a/doc/languages-frameworks/javascript.section.md b/doc/languages-frameworks/javascript.section.md
index 7bf9ad661b55..e2ef01141eb9 100644
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@@ -408,6 +408,8 @@ In case you are patching `package.json` or `pnpm-lock.yaml`, make sure to pass `
 }
 ```
 
+If needed, `dontPnpmConfigure = true;` can be used to fully disable `pnpmConfigHook` without manually removing it from inputs.
+
 #### Dealing with `sourceRoot` {#javascript-pnpm-sourceRoot}
 
 If the pnpm project is in a subdirectory, you can just define `sourceRoot` or `setSourceRoot` for `fetchPnpmDeps`.
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 13178c26a549..5e77665d379f 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3946,6 +3946,13 @@
     githubId = 140968250;
     keys = [ { fingerprint = "8321 ED3A 8DB9 99A5 1F3B  F80F F268 2914 EA42 DE26"; } ];
   };
+  Br1ght0ne = {
+    name = "Oleksii Filonenko";
+    email = "nixpkgs@brightone.cloud";
+    matrix = "@br1ght0ne:matrix.org";
+    github = "Br1ght0ne";
+    githubId = 12615679;
+  };
   br337 = {
     email = "brian.porumb@proton.me";
     github = "br337";
diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index aaf1554cf398..f54a03330c7b 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -18,6 +18,8 @@
 
 - [CastSponsorSkip](https://github.com/gabe565/CastSponsorSkip/), skips YouTube sponsorships (and sometimes ads) on all local Google Cast devices.
 
+- [Stump](https://www.stumpapp.dev/), a free and open source comics, manga and digital book server with OPDS support. Available as [services.stump](#opt-services.stump.enable).
+
 - [FlapAlerted](https://github.com/Kioubit/FlapAlerted), detects BGP flapping events and provides statistics based on BGP update messages. Available as [services.flap-alerted](#opt-services.flap-alerted.enable).
 
 - [Unpackerr](https://unpackerr.zip), extracts downloads for Radarr, Sonarr, Lidarr, Readarr, and/or a Watch folder. Available as [services.unpackerr](#opt-services.unpackerr.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 0fd01c232583..9e3d2f772b48 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1798,6 +1798,7 @@
   ./services/web-apps/stirling-pdf.nix
   ./services/web-apps/strfry.nix
   ./services/web-apps/strichliste.nix
+  ./services/web-apps/stump.nix
   ./services/web-apps/suwayomi-server.nix
   ./services/web-apps/szurubooru.nix
   ./services/web-apps/tabbyapi.nix
diff --git a/nixos/modules/services/networking/netbird.nix b/nixos/modules/services/networking/netbird.nix
index d7514f2360d3..c96be69162cf 100644
--- a/nixos/modules/services/networking/netbird.nix
+++ b/nixos/modules/services/networking/netbird.nix
@@ -340,7 +340,8 @@ in
                         substitute ${cfg.ui.package}/share/applications/netbird.desktop \
                             "$out/share/applications/${mkBin "netbird"}.desktop" \
                           --replace-fail 'Name=Netbird' "Name=NetBird @ ${client.service.name}" \
-                          --replace-fail 'Icon=netbird' "Icon=${cfg.ui.package}/share/pixmaps/netbird.png"
+                          --replace-fail 'Icon=netbird' "Icon=${cfg.ui.package}/share/icons/hicolor/256x256/apps/netbird.png" \
+                          --replace-fail 'Exec=netbird-ui' "Exec=${mkBin "netbird-ui"}"
                       '')
                     ];
                   };
diff --git a/nixos/modules/services/security/pocket-id.nix b/nixos/modules/services/security/pocket-id.nix
index 9396185c2469..547b3df6db54 100644
--- a/nixos/modules/services/security/pocket-id.nix
+++ b/nixos/modules/services/security/pocket-id.nix
@@ -70,10 +70,13 @@ in
         ENCRYPTION_KEY = "/run/secrets/pocket-id/encryption-key";
       };
       description = ''
-        Environment variables which are loaded from the contents of the specified file paths.
+        Credentials which are loaded from the contents of the specified file paths.
+
         This can be used to securely store tokens and secrets outside of the world-readable Nix store.
 
-        See [PocketID environment variables](https://pocket-id.org/docs/configuration/environment-variables).
+        See [PocketID environment variables](https://pocket-id.org/docs/configuration/environment-variables) (all with the `_FILE` suffix).
+
+        Accepts an attrset mapping from the variable name *without its `_FILE` suffix* to the path on disk.
 
         Alternatively you can use `services.pocket-id.environmentFile` to define all the variables in a single file.
       '';
diff --git a/nixos/modules/services/web-apps/stump.nix b/nixos/modules/services/web-apps/stump.nix
new file mode 100644
index 000000000000..8dbf1dfcb7da
--- /dev/null
+++ b/nixos/modules/services/web-apps/stump.nix
@@ -0,0 +1,172 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.stump;
+
+  inherit (lib)
+    types
+    mkIf
+    mkOption
+    mkEnableOption
+    ;
+
+  secret = types.nullOr (
+    types.str
+    // {
+      # We don't want users to be able to pass a path literal here but
+      # it should look like a path.
+      check = it: lib.isString it && lib.types.path.check it;
+    }
+  );
+in
+{
+  options.services.stump = {
+    enable = mkEnableOption "Stump";
+    package = lib.mkPackageOption pkgs "stump" { };
+
+    configLocation = mkOption {
+      type = types.path;
+      default = "/var/lib/stump";
+      description = "Directory used to store the database and configuration files. If it is not the default, the directory has to be created manually such that the stump user is able to read and write to it.";
+    };
+
+    environment = mkOption {
+      type = types.attrsOf types.str;
+      default = { };
+      example = {
+        STUMP_VERBOSITY = "2";
+      };
+      description = ''
+        Extra configuration environment variables. Refer to the [documentation](https://www.stumpapp.dev/docs/guides/configuration/server-config) for options.
+      '';
+    };
+
+    environmentFile = mkOption {
+      type = secret;
+      example = "/run/secrets/stump";
+      default = null;
+      description = ''
+        Path of a file with extra environment variables to be loaded from disk.
+        This file is not added to the nix store, so it can be used to pass secrets to stump.
+        Refer to the [documentation](https://www.stumpapp.dev/docs/guides/configuration/server-config) for options.
+      '';
+    };
+
+    secretFiles = mkOption {
+      type = types.attrsOf secret;
+      example = {
+        STUMP_OIDC_CLIENT_SECRET = "/run/secrets/stump_client_secret";
+      };
+      default = { };
+      description = ''
+        Attribute set containing paths to files to add to the environment of stump.
+        The files are not added to the nix store, so they can be used to pass secrets to stump.
+        Refer to the [documentation](https://www.stumpapp.dev/docs/guides/configuration/server-config) for options.
+      '';
+    };
+
+    ip = mkOption {
+      type = types.str;
+      default = "127.0.0.1";
+      description = "The IP address that Stump will listen on.";
+    };
+    port = mkOption {
+      type = types.port;
+      default = 10001;
+      description = "The port that Stump will listen on.";
+    };
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Whether to open the Stump port in the firewall";
+    };
+    user = mkOption {
+      type = types.str;
+      default = "stump";
+      description = "The user Stump should run as.";
+    };
+    group = mkOption {
+      type = types.str;
+      default = "stump";
+      description = "The group stump should run as.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
+
+    services.stump.environment = {
+      STUMP_IP = cfg.ip;
+      STUMP_PORT = toString cfg.port;
+      STUMP_CONFIG_DIR = cfg.configLocation;
+    };
+
+    systemd.services.stump = {
+      description = "Stump (A free and open source comics, manga and digital book server with OPDS support)";
+      requires = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+      wantedBy = [ "multi-user.target" ];
+      environment = cfg.environment;
+      serviceConfig = {
+        Type = "simple";
+        Restart = "on-failure";
+        RestartSec = 3;
+
+        ExecStart =
+          if cfg.secretFiles == { } then
+            "${lib.getExe cfg.package}"
+          else
+            pkgs.writeShellScript "stump-env" ''
+              ${lib.strings.concatStringsSep "\n" (
+                lib.attrsets.mapAttrsToList (key: path: "export ${key}=$(< \"${path}\")") cfg.secretFiles
+              )}
+              ${lib.getExe cfg.package}
+            '';
+        EnvironmentFile = cfg.environmentFile;
+        StateDirectory = "stump";
+        User = cfg.user;
+        Group = cfg.group;
+
+        # Hardening
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = true;
+        PrivateUsers = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+          "AF_NETLINK" # is used to determine local ip
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+      };
+    };
+
+    users.users = mkIf (cfg.user == "stump") {
+      stump = {
+        name = "stump";
+        group = cfg.group;
+        isSystemUser = true;
+      };
+    };
+    users.groups = mkIf (cfg.group == "stump") { stump = { }; };
+
+    meta.maintainers = with lib.maintainers; [ jvanbruegge ];
+  };
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 24b3d1216af7..af6436521f7b 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -421,25 +421,25 @@ in
   corerad = runTest ./corerad.nix;
   corteza = runTest ./corteza.nix;
   cosmic = runTest {
-    imports = [ ./cosmic.nix ];
+    imports = [ ./cosmic ];
     _module.args.testName = "cosmic";
     _module.args.enableAutologin = false;
     _module.args.enableXWayland = true;
   };
   cosmic-autologin = runTest {
-    imports = [ ./cosmic.nix ];
+    imports = [ ./cosmic ];
     _module.args.testName = "cosmic-autologin";
     _module.args.enableAutologin = true;
     _module.args.enableXWayland = true;
   };
   cosmic-autologin-noxwayland = runTest {
-    imports = [ ./cosmic.nix ];
+    imports = [ ./cosmic ];
     _module.args.testName = "cosmic-autologin-noxwayland";
     _module.args.enableAutologin = true;
     _module.args.enableXWayland = false;
   };
   cosmic-noxwayland = runTest {
-    imports = [ ./cosmic.nix ];
+    imports = [ ./cosmic ];
     _module.args.testName = "cosmic-noxwayland";
     _module.args.enableAutologin = false;
     _module.args.enableXWayland = false;
@@ -1579,6 +1579,7 @@ in
   strichliste = runTest ./web-apps/strichliste.nix;
   strongswan-swanctl = runTest ./strongswan-swanctl.nix;
   stub-ld = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./stub-ld.nix { };
+  stump = runTest ./web-apps/stump.nix;
   stunnel = import ./stunnel.nix { inherit runTest; };
   sudo = runTest ./sudo.nix;
   sudo-rs = runTest ./sudo-rs.nix;
diff --git a/nixos/tests/cosmic.nix b/nixos/tests/cosmic.nix
deleted file mode 100644
index f7fde6ca0e0f..000000000000
--- a/nixos/tests/cosmic.nix
+++ /dev/null
@@ -1,147 +0,0 @@
-{
-  config,
-  lib,
-  testName,
-  enableAutologin,
-  enableXWayland,
-  ...
-}:
-
-{
-  name = testName;
-
-  meta.maintainers = lib.teams.cosmic.members;
-
-  nodes.machine = {
-    imports = [ ./common/user-account.nix ];
-
-    services = {
-      # For `cosmic-store` to be added to `environment.systemPackages`
-      # and for it to work correctly because Flatpak is a runtime
-      # dependency of `cosmic-store`.
-      flatpak.enable = true;
-
-      displayManager.cosmic-greeter.enable = true;
-      desktopManager.cosmic = {
-        enable = true;
-        xwayland.enable = enableXWayland;
-      };
-    };
-
-    services.displayManager.autoLogin = lib.mkIf enableAutologin {
-      enable = true;
-      user = "alice";
-    };
-
-    environment.systemPackages = with config.node.pkgs; [
-      # These two packages are used to check if a window was opened
-      # under the COSMIC session or not. Kinda important.
-      # TODO: Move the check from the test module to
-      # `nixos/lib/test-driver/src/test_driver/machine.py` so more
-      # Wayland-only testing can be done using the existing testing
-      # infrastructure.
-      jq
-      lswt
-    ];
-
-    # So far, all COSMIC tests launch a few GUI applications. In doing
-    # so, the default allocated memory to the guest of 1024M quickly
-    # poses a very high risk of an OOM-shutdown which is worse than an
-    # OOM-kill. Because now, the test failed, but not for a genuine
-    # reason, but an OOM-shutdown. That's an inconclusive failure
-    # which might possibly mask an actual failure. Not enabling
-    # systemd-oomd because we need said applications running for a
-    # few seconds. So instead, bump the allocated memory to the guest
-    # from 1024M to 4x; 4096M.
-    virtualisation.memorySize = 4096;
-  };
-
-  testScript =
-    { nodes, ... }:
-    let
-      cfg = nodes.machine;
-      user = cfg.users.users.alice;
-      DISPLAY = lib.strings.optionalString enableXWayland (
-        if enableAutologin then "DISPLAY=:0" else "DISPLAY=:1"
-      );
-      emptyPDF = config.node.pkgs.stdenvNoCC.mkDerivation {
-        name = "empty-pdf";
-        dontUnpack = true;
-        nativeBuildInputs = [ config.node.pkgs.imagemagick ];
-        buildPhase = ''
-          magick xc:none -page Letter empty.pdf
-        '';
-        installPhase = ''
-          mkdir $out
-          mv empty.pdf $out/empty.pdf
-        '';
-      };
-    in
-    ''
-      #testName: ${testName}
-    ''
-    + (
-      if enableAutologin then
-        ''
-          with subtest("cosmic-greeter initialisation"):
-              machine.wait_for_unit("graphical.target", timeout=120)
-        ''
-      else
-        ''
-          from time import sleep
-
-          machine.wait_for_unit("graphical.target", timeout=120)
-          machine.wait_until_succeeds("pgrep --uid ${toString cfg.users.users.cosmic-greeter.name} --full cosmic-greeter", timeout=30)
-          # Sleep for 10 seconds for ensuring that `greetd` loads the
-          # password prompt for the login screen properly.
-          sleep(10)
-
-          with subtest("cosmic-session login"):
-              machine.send_chars("${user.password}\n", delay=0.2)
-        ''
-    )
-    + ''
-          # _One_ of the final processes to start as part of the
-          # `cosmic-session` target is the Workspaces applet. So, wait
-          # for it to start. The process existing means that COSMIC
-          # now handles any opened windows from now on.
-          machine.wait_until_succeeds("pgrep --uid ${toString user.uid} --full 'cosmic-panel-button com.system76.CosmicWorkspaces'", timeout=30)
-
-      # The best way to test for Wayland and XWayland is to launch
-      # the GUI applications and see the results yourself.
-      with subtest("Launch applications"):
-          # key: binary_name
-          # value: "app-id" as reported by `lswt`
-          gui_apps_to_launch = {}
-
-          # We want to ensure that the first-party applications
-          # start/launch properly.
-          gui_apps_to_launch['cosmic-edit'] = 'com.system76.CosmicEdit'
-          gui_apps_to_launch['cosmic-files'] = 'com.system76.CosmicFiles'
-          gui_apps_to_launch['cosmic-player'] = 'com.system76.CosmicPlayer'
-          gui_apps_to_launch['cosmic-reader'] = 'com.system76.CosmicReader'
-          gui_apps_to_launch['cosmic-settings'] = 'com.system76.CosmicSettings'
-          gui_apps_to_launch['cosmic-store'] = 'com.system76.CosmicStore'
-          gui_apps_to_launch['cosmic-term'] = 'com.system76.CosmicTerm'
-
-          for gui_app, app_id in gui_apps_to_launch.items():
-              # Don't fail the test if binary is absent
-              if machine.execute(f"su - ${user.name} -c 'command -v {gui_app}'", timeout=5)[0] == 0:
-                  match gui_app:
-                      case 'cosmic-reader':
-                          opt_arg = '${emptyPDF}/empty.pdf'
-                      case _:
-                          opt_arg = ""
-
-                  machine.succeed(f"su - ${user.name} -c 'WAYLAND_DISPLAY=wayland-1 XDG_RUNTIME_DIR=/run/user/${toString user.uid} ${DISPLAY} {gui_app} {opt_arg} >&2 &'", timeout=5)
-                  # Nix builds the following non-commented expression to the following:
-                  #                              `su - alice -c 'WAYLAND_DISPLAY=wayland-1 XDG_RUNTIME_DIR=/run/user/1000 lswt --json | jq ".toplevels" | grep "^    \\"app-id\\": \\"{app_id}\\"$"' `
-                  machine.wait_until_succeeds(f''''su - ${user.name} -c 'WAYLAND_DISPLAY=wayland-1 XDG_RUNTIME_DIR=/run/user/${toString user.uid} lswt --json | jq ".toplevels" | grep "^    \\"app-id\\": \\"{app_id}\\"$"' '''', timeout=60)
-                  machine.succeed(f"pkill {gui_app}", timeout=5)
-
-      machine.succeed("echo 'test completed succeessfully' > /${testName}", timeout=5)
-      machine.copy_from_machine('/${testName}')
-
-      machine.shutdown()
-    '';
-}
diff --git a/nixos/tests/cosmic/default.nix b/nixos/tests/cosmic/default.nix
new file mode 100644
index 000000000000..3b6dce9f55a4
--- /dev/null
+++ b/nixos/tests/cosmic/default.nix
@@ -0,0 +1,168 @@
+{
+  config,
+  lib,
+  testName,
+  enableAutologin,
+  enableXWayland,
+  ...
+}:
+
+let
+  user = config.nodes.machine.users.users.alice;
+  logFilePath = "/home/${user.name}/${testName}";
+  # Use `writeShellScriptBin` instead of `writeShellScript` so that the
+  # process name in the journald log appears as 'cosmicTest[$pid]'
+  cosmicTest = config.node.pkgs.writeShellScriptBin "cosmicTest" ''
+    exec ${lib.getExe config.node.pkgs.python3Minimal} ${./test-script.py} \
+        --log-file-path ${logFilePath} \
+        --cosmic-reader-pdf ${config.node.pkgs.empty-pdf} \
+        --polkit-agent-helper-path ${config.node.pkgs.polkit.out}/lib/polkit-1/polkit-agent-helper-1 \
+        --root-user-password ${user.password}
+  '';
+  cosmicTestDesktop = config.node.pkgs.makeDesktopItem {
+    name = "cosmicTest";
+    desktopName = "COSMIC NixOS VM test (${testName})";
+    exec = "cosmicTest";
+  };
+  cosmicTestAutostartItem = config.node.pkgs.makeAutostartItem {
+    name = "cosmicTest";
+    package = cosmicTestDesktop;
+  };
+in
+
+{
+  name = testName;
+
+  meta.maintainers = lib.teams.cosmic.members;
+
+  nodes.machine = {
+    imports = [ ../common/user-account.nix ];
+
+    services = {
+      # For `cosmic-store` to be added to `environment.systemPackages`
+      # and for it to work correctly because Flatpak is a runtime
+      # dependency of `cosmic-store`.
+      flatpak.enable = true;
+
+      displayManager.cosmic-greeter.enable = true;
+      desktopManager.cosmic = {
+        enable = true;
+        xwayland.enable = enableXWayland;
+      };
+    };
+
+    services.displayManager.autoLogin = lib.mkIf enableAutologin {
+      enable = true;
+      user = user.name;
+    };
+
+    users.users = {
+      alice.extraGroups = [
+        "uinput" # for ydotoold
+      ];
+
+      root.password = user.password;
+      root.hashedPasswordFile = lib.mkForce null;
+    };
+
+    hardware.uinput.enable = true;
+
+    environment.systemPackages = with config.node.pkgs; [
+      ydotool
+      cosmicTest
+      cosmicTestAutostartItem
+
+      # These two packages are used to check if a window was opened
+      # under the COSMIC session or not. Kinda important.
+      # TODO: Move the check from the test module to
+      # `nixos/lib/test-driver/src/test_driver/machine.py` so more
+      # Wayland-only testing can be done using the existing testing
+      # infrastructure.
+      jq
+      lswt
+    ];
+
+    # So far, all COSMIC tests launch a few GUI applications. In doing
+    # so, the default allocated memory to the guest of 1024M quickly
+    # poses a very high risk of an OOM-shutdown which is worse than an
+    # OOM-kill. Because now, the test failed, but not for a genuine
+    # reason, but an OOM-shutdown. That's an inconclusive failure
+    # which might possibly mask an actual failure. Not enabling
+    # systemd-oomd because we need said applications running for a
+    # few seconds. So instead, bump the allocated memory to the guest
+    # from 1024M to 4x; 4096M.
+    virtualisation.memorySize = 4096;
+  };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      #testName: ${testName}
+      import sys
+    ''
+    + (
+      if enableAutologin then
+        ''
+          with subtest("cosmic-greeter initialisation"):
+              machine.wait_for_unit("graphical.target", timeout=120)
+        ''
+      else
+        ''
+          from time import sleep
+
+          machine.wait_for_unit("graphical.target", timeout=120)
+          machine.wait_until_succeeds("pgrep --uid ${config.nodes.machine.users.users.cosmic-greeter.name} --full cosmic-greeter", timeout=30)
+          # Sleep for 10 seconds for ensuring that `greetd` loads the
+          # password prompt for the login screen properly.
+          sleep(10)
+
+          with subtest("cosmic-session login"):
+              machine.send_chars("${user.password}\n", delay=0.2)
+        ''
+    )
+    + ''
+      with subtest("xdg autostart support in cosmic"):
+          # When checking the status of our `cosmicTest` package with:
+          # `machine.wait_for_unit("app-cosmicTest@autostart.service", user="${user.name}")`
+          # We are immediately greeted with the error:
+          # ```
+          # subtest: xdg autostart support in cosmic
+          # machine: waiting for unit app-cosmicTest@autostart.service with user alice
+          # machine # [   26.497516] cosmic-comp[1352]: [EGL] 0x3008 (BAD_DISPLAY) eglCreateSync: _eglCreateSync
+          # machine # [   26.511706] su[1416]: Successful su for alice by root
+          # machine # [   26.528190] su[1416]: pam_unix(su:session): session opened for user alice(uid=1000) by (uid=0)
+          # machine # Failed to connect to user scope bus via local transport: No such file or directory
+          # machine # [   26.599563] su[1416]: pam_unix(su:session): session closed for user alice
+          # !!! Test "xdg autostart support in cosmic" failed with error: "retrieving systemctl property "ActiveState" for unit "app-cosmicTest@autostart.service" under user "alice" failed with exit code 1"
+          # ```
+          # Meaning, our session is extremely new and the D-Bus user
+          # session socket does not yet exist. Instead, lets poll for
+          # the log file that the test is guaranteed to write to, as
+          # soon as it starts.
+          machine.wait_for_file("${logFilePath}.log", timeout=120)
+
+      exit_code = 0
+      try:
+          machine.wait_for_file("${logFilePath}.done", timeout=700)
+      except Exception:
+          exit_code = 1
+
+      # The log file is created in the very beginning of the test
+      # script's execution. If we are here, it means that the
+      # `wait_for_unit`'s "guard" on the test script's autostart unit
+      # plus the 630 second combined timeout of other two
+      # `wait_for_file`s, make it extremely likely for the log file to
+      # be present.
+      machine.copy_from_machine("${logFilePath}.log")
+
+      machine.shutdown()
+
+      with open(f"{machine.out_dir}/${testName}.log") as test_log_file:
+          contents = test_log_file.read()
+          print(contents)
+          if any("Z [ERROR] [L:" in line for line in contents.splitlines()):
+              exit_code = 1
+
+      sys.exit(exit_code)
+    '';
+}
diff --git a/nixos/tests/cosmic/test-script.py b/nixos/tests/cosmic/test-script.py
new file mode 100644
index 000000000000..07377fa95fac
--- /dev/null
+++ b/nixos/tests/cosmic/test-script.py
@@ -0,0 +1,315 @@
+#!/usr/bin/env python3
+import argparse
+import logging
+import os
+import pathlib
+import subprocess
+import time
+
+
+def parse_cli_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        "--log-file-path",
+        required=True,
+        type=str,
+        help="The path to the log file (without the '.log' suffix/extension)",
+    )
+    parser.add_argument(
+        "--cosmic-reader-pdf",
+        required=True,
+        type=str,
+        help="The PDF that the `cosmic-reader` should open for testing",
+    )
+    parser.add_argument(
+        "--polkit-agent-helper-path",
+        required=True,
+        type=str,
+        help="The path to the polkit agent helper (`${pkgs.polkit.out}/lib/polkit-1/polkit-agent-helper-1`)",
+    )
+    parser.add_argument(
+        "--root-user-password", required=True, type=str, help="The root user's password"
+    )
+    args = parser.parse_args()
+    return args
+
+
+def start_ydotool_daemon() -> tuple[str, subprocess.Popen]:
+    """
+    The ydotool requires a daemon to be running.
+    """
+    xdg_runtime_dir = os.getenv("XDG_RUNTIME_DIR") or f"/run/user/{os.getuid()}"
+    ydotool_daemon_socket_path = f"{xdg_runtime_dir}/.ydotool_socket"
+    ydotool_daemon_process = subprocess.Popen(
+        [
+            "ydotoold",
+            "--socket-path",
+            ydotool_daemon_socket_path,
+            "--mouse-off",
+        ],
+        stdout=subprocess.DEVNULL,
+        stderr=subprocess.DEVNULL,
+    )
+    return ydotool_daemon_socket_path, ydotool_daemon_process
+
+
+def wait_for_cosmic_de_readiness() -> None:
+    """
+    Wait for the COSMIC DE to be ready, before running the tests. This
+    is done by waiting on the supposedly last component of the COSMIC
+    DE to be "ready." That component is the notification watcher, of
+    the `cosmic-applet` derivation.
+    """
+    logging.info("=" * 80)
+    logging.info("Waiting for COSMIC DE to complete initialization")
+
+    notification_watcher_wait_deadline = time.monotonic() + 360
+    notification_watcher_exists = False
+    while time.monotonic() < notification_watcher_wait_deadline:
+        busctl_process = subprocess.run(
+            ["busctl", "--user", "status", "com.system76.CosmicStatusNotifierWatcher"],
+            check=False,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+        )
+        if busctl_process.returncode == 0:
+            notification_watcher_exists = True
+            break
+        else:
+            time.sleep(1)
+    logging_msg = "The COSMIC DE is "
+    if notification_watcher_exists:
+        logging.info(f"{logging_msg} ready")
+    else:
+        logging.error(f"{logging_msg} not ready")
+    return
+
+
+def perform_polkit_authentication_test(
+    cli_args: argparse.Namespace,
+    ydotool_daemon_socket_path: str,
+    ydotool_daemon_process: subprocess.Popen,
+) -> None:
+    """
+    1. Run `pkexec` as a background process that produces a specific
+       output to stdout upon successful completion.
+    2. Wait unil it has been confimred that `cosmic-osd` has created
+       a pop-up requesting the root user's password.
+    3. Use ydotool to type the root user's password in the pop-up
+       prompt.
+    4. Ensure that the the `pkexec` background process' stdout matches
+       the output that we expect.
+
+    Any breakage in this flow is considered a failure of the polkit
+    authenticaion test.
+    """
+    logging.info("=" * 80)
+    logging.info("Performing polkit authentication test")
+
+    polkit_test_passed = False
+    polkit_test_command = [
+        "pkexec",
+        "--disable-internal-agent",
+        "bash",
+        "-c",
+        "echo -n 'polkit test was successful'",
+    ]
+    logging.info(f"Running: {polkit_test_command}")
+    polkit_test_process = subprocess.Popen(
+        polkit_test_command,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        text=True,
+    )
+
+    polkit_popup_deadline = time.monotonic() + 60
+    pop_up_msg = "the pop-up for polkit password authentication"
+    encountered_polkit_authentication_popup = False
+    while time.monotonic() < polkit_popup_deadline:
+        polkit_popup_check_process = subprocess.run(
+            [
+                "pgrep",
+                "-afx",
+                f"{cli_args.polkit_agent_helper_path} --socket-activated",
+            ],
+            check=False,
+        )
+        if polkit_popup_check_process.returncode == 0:
+            encountered_polkit_authentication_popup = True
+            logging.info(f"Noticed {pop_up_msg}")
+            if ydotool_daemon_process.poll() is None:
+                # The polkit-agent-helper process exists, but that
+                # doesn't necessarily mean that the pop-up is
+                # **rendered** and ready to accept the password. So we
+                # sleep for a few seconds.
+                time.sleep(20)
+                ydotool_process = subprocess.run(
+                    [
+                        "ydotool",
+                        "type",
+                        "--key-delay=500",
+                        f"{cli_args.root_user_password}\n",
+                    ],
+                    env={
+                        **os.environ.copy(),
+                        "YDOTOOL_SOCKET": ydotool_daemon_socket_path,
+                    },
+                    check=False,
+                )
+                ydotool_msg = (
+                    "the root user's password in the pop-up for polkit authentication"
+                )
+                if ydotool_process.returncode == 0:
+                    logging.info(f"ydotool typed {ydotool_msg}")
+                else:
+                    logging.error(f"ydotool did not type {ydotool_msg}")
+            else:
+                logging.error(
+                    "The ydotool daemon exited for some reason before it could be used"
+                )
+            break
+        time.sleep(1)
+    if not encountered_polkit_authentication_popup:
+        logging.error(f"Did not notice {pop_up_msg}")
+
+    polkit_test_process_stdout = ""
+    polkit_test_process_stderr = ""
+    try:
+        polkit_test_process_stdout, polkit_test_process_stderr = (
+            polkit_test_process.communicate(timeout=45)
+        )
+    except subprocess.TimeoutExpired:
+        polkit_test_process.kill()
+        polkit_test_process_stdout, polkit_test_process_stderr = (
+            polkit_test_process.communicate()
+        )
+
+    logging.info(f"polkit stdout: '{polkit_test_process_stdout}'")
+    logging.info(f"polkit stderr: '{polkit_test_process_stderr}'")
+
+    if polkit_test_process_stdout:
+        logging.info(f"pkexec command stdout: {polkit_test_process_stdout}")
+        polkit_test_passed = "polkit test was successful" in polkit_test_process_stdout
+    else:
+        logging.warning("Could not capture stdout from the polkit test command")
+
+    if polkit_test_passed:
+        logging.info("The polkit authentication test passed")
+    else:
+        logging.error("The polkit authentication test failed")
+    return
+
+
+def perform_gui_application_test(cli_args: argparse.Namespace) -> None:
+    """
+    1. Start one GUI application as a background process.
+    2. Wait unil it has been confimred that the GUI application is
+       running.
+    3. Kill the background process of the GUI application.
+
+    Any breakage in this flow is considered a failure of the test for
+    the GUI application.
+    """
+    logging.info("=" * 80)
+    logging.info("Performing test to launch GUI applications")
+
+    gui_apps_to_test = {
+        "com.system76.CosmicEdit": [
+            "cosmic-edit",
+        ],
+        "com.system76.CosmicFiles": [
+            "cosmic-files",
+        ],
+        "com.system76.CosmicPlayer": [
+            "cosmic-player",
+        ],
+        "com.system76.CosmicReader": [
+            "cosmic-reader",
+            cli_args.cosmic_reader_pdf,
+        ],
+        "com.system76.CosmicSettings": [
+            "cosmic-settings",
+        ],
+        "com.system76.CosmicStore": [
+            "cosmic-store",
+        ],
+        "com.system76.CosmicTerm": [
+            "cosmic-term",
+        ],
+    }
+
+    for gui_app_id, gui_app_command in gui_apps_to_test.items():
+        logging.info(f"Running: {gui_app_command}")
+        gui_app_bg_process = subprocess.Popen(
+            gui_app_command,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+        )
+        gui_app_bg_process_deadline = time.monotonic() + 30
+        gui_app_is_running = False
+
+        while time.monotonic() < gui_app_bg_process_deadline and not gui_app_is_running:
+            lswt_process = subprocess.run(
+                [
+                    "lswt",
+                    "--custom",
+                    "a",
+                ],
+                check=False,
+                text=True,
+                stdout=subprocess.PIPE,
+                stderr=subprocess.DEVNULL,
+            )
+            lswt_process_stdout = lswt_process.stdout.strip()
+            if lswt_process_stdout:
+                if gui_app_id in lswt_process_stdout.splitlines():
+                    gui_app_is_running = True
+            time.sleep(1)
+        pkill_process = subprocess.run(
+            ["pkill", gui_app_command[0]],
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            check=False,
+        )
+
+        log_message = (
+            f"The GUI application test for '{gui_app_command[0]}' ({gui_app_id})"
+        )
+        if gui_app_is_running:
+            logging.info(f"{log_message} passed")
+        else:
+            logging.error(f"{log_message} failed")
+    return
+
+
+def main() -> None:
+    cli_args = parse_cli_args()
+    logging.basicConfig(
+        level=logging.INFO,
+        format=f"%(asctime)sZ [%(levelname)s] [L:%(lineno)d] %(message)s",
+        datefmt="%H:%M:%S",
+        handlers=[
+            logging.StreamHandler(),
+            logging.FileHandler(f"{cli_args.log_file_path}.log", mode="w"),
+        ],
+    )
+    logging.Formatter.converter = time.gmtime
+    logging.info(f"Logging to '{cli_args.log_file_path}.log'")
+
+    ydotool_daemon_socket_path, ydotool_daemon_process = start_ydotool_daemon()
+
+    # Wait for the DE to be ready
+    wait_for_cosmic_de_readiness()
+
+    # tests go here
+    perform_polkit_authentication_test(
+        cli_args, ydotool_daemon_socket_path, ydotool_daemon_process
+    )
+    perform_gui_application_test(cli_args)
+
+    pathlib.Path(f"{cli_args.log_file_path}.done").touch()
+    return
+
+
+if __name__ == "__main__":
+    main()
diff --git a/nixos/tests/web-apps/stump.nix b/nixos/tests/web-apps/stump.nix
new file mode 100644
index 000000000000..ce67647404f0
--- /dev/null
+++ b/nixos/tests/web-apps/stump.nix
@@ -0,0 +1,26 @@
+{ ... }:
+{
+  name = "stump-nixos";
+
+  nodes.machine =
+    { ... }:
+    {
+      services.stump.enable = true;
+    };
+
+  testScript = ''
+    import json
+
+    machine.wait_for_unit("stump.service")
+
+    machine.wait_for_open_port(10001)
+    machine.succeed("curl --fail -s http://localhost:10001/")
+
+    machine.succeed("curl --fail -s --data '{\"username\":\"admin\",\"password\":\"admin\"}' -H 'Content-Type: application/json' -X POST http://localhost:10001/api/v2/auth/register")
+
+    response = machine.succeed("curl --fail -s -X GET http://localhost:10001/api/v2/claim")
+    is_claimed = json.loads(response)['isClaimed']
+
+    assert is_claimed
+  '';
+}
diff --git a/pkgs/README.md b/pkgs/README.md
index c123f2ee6463..b1eb9dc76a65 100644
--- a/pkgs/README.md
+++ b/pkgs/README.md
@@ -906,10 +906,14 @@ stdenv.mkDerivation {
 ## Automatic package updates
 [automatic-package-updates]: #automatic-package-updates
 
-Nixpkgs periodically tries to update all packages that have a `passthru.updateScript` attribute.
+The [community bot `r-ryantm`](https://nix-community.org/update-bot/), periodically tries to update all packages in Nixpkgs.
+`r-ryantm` runs the program [`nixpkgs-update`](https://nix-community.github.io/nixpkgs-update/) to find new versions of packages.
+In most cases, `nixpkgs-update` will be capable of finding new versions and perform the update with out any special instructions.
+Putting a `passthru.updateScript` attribute sets an explicit update procedure for `nixpkgs-update`, but this is not required for most cases.
+To learn more about the default update procedures, read their [FAQ for Nixpkgs maintainers](https://nix-community.github.io/nixpkgs-update/nixpkgs-maintainer-faq/).
 
 > [!Note]
-> A common pattern is to use the [`nix-update-script`](../pkgs/by-name/ni/nix-update/nix-update-script.nix) attribute provided in Nixpkgs, which runs [`nix-update`](https://github.com/Mic92/nix-update):
+> A common pattern is to use the [`nix-update-script`](../pkgs/by-name/ni/nix-update/nix-update-script.nix) function provided in Nixpkgs, which makes automatic updates use [`nix-update`](https://github.com/Mic92/nix-update):
 >
 > ```nix
 > { stdenv, nix-update-script }:
@@ -919,9 +923,10 @@ Nixpkgs periodically tries to update all packages that have a `passthru.updateSc
 > }
 > ```
 >
-> For simple packages, this is often enough, and will ensure that the package is updated automatically by [`nixpkgs-update`](https://github.com/nix-community/nixpkgs-update) when a new version is released.
-> The [update bot](https://nix-community.org/update-bot) runs periodically to attempt to automatically update packages, and will run `passthru.updateScript` if set.
-> While not strictly necessary if the project is listed on [Repology](https://repology.org), using `nix-update-script` allows the package to update via many more sources (e.g. GitHub releases).
+> `nix-update` is a little bit more flexible than `nixpkgs-update` in performing updates, so it can be useful for cases such as:
+>
+>  - A `nix-update` CLI flag like `--version branch` or `--version-regex` are needed to make the update work.
+>  - You don't want to rely upon new versions to be listed in [Repology](https://repology.org/), and `nix-update` finds new versions easily (e.g GitLab projects).
 
 The `passthru.updateScript` attribute can contain one of the following:
 
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/mirth/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/mirth/default.nix
new file mode 100644
index 000000000000..3409d9f27312
--- /dev/null
+++ b/pkgs/applications/editors/vim/plugins/non-generated/mirth/default.nix
@@ -0,0 +1,15 @@
+{ vimUtils, mirth }:
+
+vimUtils.buildVimPlugin {
+  pname = "mirth";
+  inherit (mirth) version;
+  src = mirth.vim;
+  meta = {
+    inherit (mirth.meta)
+      homepage
+      license
+      platforms
+      ;
+    description = "Syntax highlighting & filetype detection for the Mirth programming language";
+  };
+}
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 2dfbaa519e4b..9bdd234b9924 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2184,8 +2184,8 @@ let
         mktplcRef = {
           publisher = "haskell";
           name = "haskell";
-          version = "2.8.0";
-          hash = "sha256-Tp4Ahfp3Ma9aJtghD+mgsCBTMOP1GI1vGE5xzvHO+d4=";
+          version = "2.8.1";
+          hash = "sha256-mAlEy5a83BRhUhA22AKheP6PPpfbrdGT6HsTKbFwJYs=";
         };
         meta = {
           license = lib.licenses.mit;
diff --git a/pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh b/pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh
index 38f6eb97b56b..4a44775ab7b8 100644
--- a/pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh
+++ b/pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh
@@ -118,4 +118,6 @@ pnpmConfigHook() {
     echo "Finished pnpmConfigHook"
 }
 
-postConfigureHooks+=(pnpmConfigHook)
+if [ -z "${dontPnpmConfigure-}" ]; then
+  postConfigureHooks+=(pnpmConfigHook)
+fi
diff --git a/pkgs/by-name/ac/acli/sources.json b/pkgs/by-name/ac/acli/sources.json
index 0a8aa45e4ab9..ebc68bc98fb4 100644
--- a/pkgs/by-name/ac/acli/sources.json
+++ b/pkgs/by-name/ac/acli/sources.json
@@ -1,21 +1,21 @@
 {
-  "version": "1.3.19-stable",
+  "version": "1.3.20-stable",
   "sources": {
     "aarch64-darwin": {
-      "url": "https://acli.atlassian.com/darwin/1.3.19-stable/acli_1.3.19-stable_darwin_arm64.tar.gz",
-      "sha256": "c5f1b1f6db63972d126a2f8ac9aca9a199739c7b51ac9e352e8ae3ed2b27131c"
+      "url": "https://acli.atlassian.com/darwin/1.3.20-stable/acli_1.3.20-stable_darwin_arm64.tar.gz",
+      "sha256": "5fca5f021b8202f77f60ecc0ded293fb4af67afdb462ed20dce990cfedc49517"
     },
     "aarch64-linux": {
-      "url": "https://acli.atlassian.com/linux/1.3.19-stable/acli_1.3.19-stable_linux_arm64.tar.gz",
-      "sha256": "72972e74fa9036c5b40175570234a2e79559776c06a3aa29f632a39c7d3674da"
+      "url": "https://acli.atlassian.com/linux/1.3.20-stable/acli_1.3.20-stable_linux_arm64.tar.gz",
+      "sha256": "2209f6ab1f7fb4c16247e30115d0ff7c1511161aeae4d166e0e79ec81125a4b1"
     },
     "x86_64-darwin": {
-      "url": "https://acli.atlassian.com/darwin/1.3.19-stable/acli_1.3.19-stable_darwin_amd64.tar.gz",
-      "sha256": "394096ecd5a6082cbbbc8b2f3e1f1fbe694cdb340e25a4014eeb78461b869beb"
+      "url": "https://acli.atlassian.com/darwin/1.3.20-stable/acli_1.3.20-stable_darwin_amd64.tar.gz",
+      "sha256": "4b9c4faa0d635b6e9194b101d4826b26cd6a15c46313f6a5f9436e20e8a48b78"
     },
     "x86_64-linux": {
-      "url": "https://acli.atlassian.com/linux/1.3.19-stable/acli_1.3.19-stable_linux_amd64.tar.gz",
-      "sha256": "f29fa8b7f01710053c2f4e07723501ebfe448672b669d32d83e961686d383a6d"
+      "url": "https://acli.atlassian.com/linux/1.3.20-stable/acli_1.3.20-stable_linux_amd64.tar.gz",
+      "sha256": "4e0190233a58276001a3cdff23e4be5e30844f98c639c49cfdeb581b9eb147aa"
     }
   }
 }
diff --git a/pkgs/by-name/al/alt-tab-macos/package.nix b/pkgs/by-name/al/alt-tab-macos/package.nix
index a289da289757..5a0725b65e46 100644
--- a/pkgs/by-name/al/alt-tab-macos/package.nix
+++ b/pkgs/by-name/al/alt-tab-macos/package.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "alt-tab-macos";
-  version = "11.1.0";
+  version = "11.3.1";
 
   src = fetchurl {
     url = "https://github.com/lwouis/alt-tab-macos/releases/download/v${finalAttrs.version}/AltTab-${finalAttrs.version}.zip";
-    hash = "sha256-wVg0HjPC4MYOVNDtFdzcG5P8amrjE3tNNccUAPRGZNY=";
+    hash = "sha256-X59sFQWuT9y3/YGfG/lFoXmoeV/BjHPniDZey5Phb4w=";
   };
 
   sourceRoot = ".";
@@ -32,11 +32,12 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Windows alt-tab on macOS";
-    homepage = "https://alt-tab-macos.netlify.app";
+    homepage = "https://alt-tab.app";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [
       FlameFlag
       emilytrau
+      Br1ght0ne
     ];
     platforms = lib.platforms.darwin;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
diff --git a/pkgs/by-name/an/anki-bin/package.nix b/pkgs/by-name/an/anki-bin/package.nix
index 8850e149e682..d3f7622c0820 100644
--- a/pkgs/by-name/an/anki-bin/package.nix
+++ b/pkgs/by-name/an/anki-bin/package.nix
@@ -15,22 +15,26 @@
 let
   pname = "anki-bin";
   # Update hashes for both Linux and Darwin!
-  version = "25.02.5";
+  version = "26.05";
 
   sources = {
-    linux = fetchurl {
-      url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-linux-qt6.tar.zst";
-      hash = "sha256-wYFqT1g+rtoqOR7+Bb5mIJLZ5JdT2M1kcHqJUCuNElA=";
+    linux-aarch64 = fetchurl {
+      url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-linux-aarch64.tar.zst";
+      hash = "sha256-z/w7+TKLW+xi/iJMXGOp50Yjwnv7FD5O0lNsu31dfqo=";
+    };
+    linux-x86_64 = fetchurl {
+      url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-linux-x86_64.tar.zst";
+      hash = "sha256-YiPXBVY/catAzgcqXZajkZxUbV3eHkxJ3CeXXnAGcnQ=";
     };
 
     # For some reason anki distributes completely separate dmg-files for the aarch64 version and the x86_64 version
     darwin-x86_64 = fetchurl {
-      url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-mac-intel-qt6.dmg";
-      hash = "sha256-PDlu+oFKWHraPdTuGDCUkO0bhPtkNVibo11B1QkCICw=";
+      url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-mac-intel.dmg";
+      hash = "sha256-L/TXKh0cmTop7/ROA9YC4dyBz9iAFRhpXuNRbR3wwYk=";
     };
     darwin-aarch64 = fetchurl {
-      url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-mac-apple-qt6.dmg";
-      hash = "sha256-RqcGHXN29GDGGuFbrQCBmj3cctzoRQZ8svR5hMYPhxs=";
+      url = "https://github.com/ankitects/anki/releases/download/${version}/anki-${version}-mac-apple.dmg";
+      hash = "sha256-c5NZf0uWNB7XQDYBDtgrtCU+A5Cuck0rJ1xFG8hY0Sc=";
     };
   };
 
@@ -38,7 +42,7 @@ let
     inherit pname version;
 
     nativeBuildInputs = [ zstd ];
-    src = sources.linux;
+    src = if stdenv.hostPlatform.isAarch64 then sources.linux-aarch64 else sources.linux-x86_64;
 
     installPhase = ''
       runHook preInstall
@@ -64,6 +68,7 @@ let
       ;
     platforms = [
       "x86_64-linux"
+      "aarch64-linux"
       "x86_64-darwin"
       "aarch64-darwin"
     ];
diff --git a/pkgs/by-name/ar/arcdps-log-manager/package.nix b/pkgs/by-name/ar/arcdps-log-manager/package.nix
index 1ccbe05a2b3c..25243b0352c0 100644
--- a/pkgs/by-name/ar/arcdps-log-manager/package.nix
+++ b/pkgs/by-name/ar/arcdps-log-manager/package.nix
@@ -13,13 +13,13 @@
 }:
 buildDotnetModule (finalAttrs: {
   pname = "arcdps-log-manager";
-  version = "1.15.1";
+  version = "1.16";
 
   src = fetchFromGitHub {
     owner = "gw2scratch";
     repo = "evtc";
     tag = "manager-v${finalAttrs.version}";
-    hash = "sha256-JevVLlWcPu0/inLjzsxyNCcwOTp1jwNMp/rZH9h1wO0=";
+    hash = "sha256-AiIWYb3hwkE20NdmAHlSt55QJ/d3NnQt3ZeX1COUG7k=";
   };
 
   nugetDeps = ./deps.json;
diff --git a/pkgs/by-name/aw/aws-cdk-cli/missing-hashes.json b/pkgs/by-name/aw/aws-cdk-cli/missing-hashes.json
new file mode 100644
index 000000000000..07816f807684
--- /dev/null
+++ b/pkgs/by-name/aw/aws-cdk-cli/missing-hashes.json
@@ -0,0 +1,57 @@
+{
+  "@esbuild/aix-ppc64@npm:0.28.1": "9b01eaa9c57542436436de762466b9a348b4596aa53dffa6e7034e4180691e1948d33fe34ec302239ab04c280e5166248880f24531011ff419fbec6986a265f3",
+  "@esbuild/android-arm64@npm:0.28.1": "7c977c8d4cea5126df4b298d5c31c3df8d14aa05d7477aa11c4147ec7baff17d25542234eea0134f279191b59cb1af18fee49c6916afda554484464129e4f9c3",
+  "@esbuild/android-arm@npm:0.28.1": "44baed9765216202f71b6aae8d9ddb930efa671d34f63f4220d980662b3df4da7972e965c0a0f12922147aa8428083686f6cb23cd9a4f140eaf922ae0b59c2a0",
+  "@esbuild/android-x64@npm:0.28.1": "1b8183640bef23f41a91598d898a04a6a8e3ca31d0100207c7e75928ee885878c04e3bcf31f27ed9c655d6d8a7c08e35e3afef035aee649488cb2d68e51abf1e",
+  "@esbuild/darwin-arm64@npm:0.28.1": "8ed80a99836df196c2b7996448eabb2d503ec8c71d0a8be59af4eed457b858fa5fd9292528b1967f0e106d2a045387e375207a2cc262cd45f89596681e94e7fd",
+  "@esbuild/darwin-x64@npm:0.28.1": "952b23f33c24aea13f5a78fd41731e06e8c7fa732e10995327fa1289115da6b4123899ca0cdb0cf0a56add29efcb9f7891ad6fda0bfb94541347275537a71e77",
+  "@esbuild/freebsd-arm64@npm:0.28.1": "cc2c4f1f13230607807c3f128680d789e85d4b93309501c4f8d84ed0674f4a2a3e60e279e3b997ee9f797047c1c5b906b25e4fe37de62d19634e4470bcb16f32",
+  "@esbuild/freebsd-x64@npm:0.28.1": "5b99b980599567ee931520a019beaeea4c7ae2874d0bfab79ee4bd6373a869251d2175946478c527490ce155d10a5bcc795e8c986dceb4a36fb6e813513fc54c",
+  "@esbuild/linux-arm64@npm:0.28.1": "9348c6bfc2d878e6213cffe482d4455d817b9e56b3c581a9f68b94aac720cddea5733d963dec57ca273039f3a7ca1714f1ac8e39e2e0f85f1af42f5d05e3ed00",
+  "@esbuild/linux-arm@npm:0.28.1": "654d7af59b4be40f585455e42ecb389657c6f11b1f2be2d5ab04caeac0514574d8b2a28b9f0f9805d92e266a44a5627c5acc8151b0d0379f75ac1490fecc013d",
+  "@esbuild/linux-ia32@npm:0.28.1": "cce27fbd8d74f34bb5507a5db8c0119aa377c7a070fd0be3881a8efddcdb8adeebe24dc97d55784d74a8bf4a60fb55b48899f41b5e931acaa3eb9f90ecc94a01",
+  "@esbuild/linux-loong64@npm:0.28.1": "47c3215d378f5da750300694b273b83db26d3e9ed36553696a1769da6d467e7557e289b46d211c93ab7a2978348b7415b66c7fec31658622f5bd356332b9d5b0",
+  "@esbuild/linux-mips64el@npm:0.28.1": "166d8888e731bdeba0c657382d429c0a979af2136100ee2491ec47b2e2ec55f6924fe2045880b48a6cdaeb3dcc44fc495f3f4b9a5aa3bb8c418d1f53f86b2ba1",
+  "@esbuild/linux-ppc64@npm:0.28.1": "a8eecb9e43a26dcb70a9805e685dec9f0caff0a8bac691b06a6db7c14ba0a69980ef0c01cb3fc1377ad63e2c4945f396fbbeaf008588bb232e9c0c37dcdb557b",
+  "@esbuild/linux-riscv64@npm:0.28.1": "cfde883f336e1811fee019a1df402000c7a8e6dc5a2b3577679fd0d9711d1a774c1faa194cc8954b18ca11f3a380ef32905ea90c241803831b61017d8a667c3b",
+  "@esbuild/linux-s390x@npm:0.28.1": "ea121d2fb6c8f6161312e0239258b584c431b4d23f320ace7cbc18da77034aac5ed383658d2a48fdfa32e38be07126a14aa26802b8e04d0e958e82646fb87f41",
+  "@esbuild/linux-x64@npm:0.28.1": "9b5458cf012247e31c6bf465e37553f2fc5aef3fccc6593bb30fee0c547958f9f00fbedd44e5bc076cf68d6791a4af2ce8714260fe341cb16843a78643773e3d",
+  "@esbuild/netbsd-arm64@npm:0.28.1": "86b5cf33fbad27ea5e7345601e711a26717bdf5ad119efa0b1bb9ad6a75f7cb2658c57ffb80f19491e3c7105f4698e76358ee2b6d57f48c9a230de9f588589c7",
+  "@esbuild/netbsd-x64@npm:0.28.1": "ff24c209715f7f122c711d3c51af099de27659837d3f7bd4cbea9a8868fa99a10b7af785058d18a1e32b2132989d1d1d82b8768df77ff25ab6cf19d58be3697d",
+  "@esbuild/openbsd-arm64@npm:0.28.1": "fe6590621116132baa0a2b9c2dc95c6342f146170ec1ffb343c29936580c369a69061676bef4e654ee27bad6491f531af3ba985aed7133eb16b758fffae6a445",
+  "@esbuild/openbsd-x64@npm:0.28.1": "2600c51c394945654f99b096fccba95e1d34fa3ecf4e78f40a7aee4573bf21dd955c274e0586768e9ebef3bff145ffe30231f1cb281ef5e679f7aa78dcc86687",
+  "@esbuild/openharmony-arm64@npm:0.28.1": "be9e1d1e4af478778ce847e28809fba0b754340a699e37ec03bc1a3cd4e84e4fde30ffea62099757877229b024d50331efd6270580492aa6be38eb2353ef5646",
+  "@esbuild/sunos-x64@npm:0.28.1": "349b9c7d879496456b2eb28f7bb3decc12a906007bb7fb24cb2b269f6b3e5138af109045b216bd0396762e63b802f0233408cc3dce802be5fcf242d4835b6bc8",
+  "@esbuild/win32-arm64@npm:0.28.1": "551ada5396e1f10e3d3592dd60a148a7257af1ab2317bba09e9ed18a6d7ee7e5961c68eb1fbaee4e8c1961b504807493e1b8f5c700dd1fb990f0cb36b240ad57",
+  "@esbuild/win32-ia32@npm:0.28.1": "2676ace6b4d63721da34873974152e869aed9fc8bd9fdff4b8df14a3a3e68b78a9b4566e643b90b948b4e85773cbf288a33a59d13979caaadd43b5adad68312c",
+  "@esbuild/win32-x64@npm:0.28.1": "8d658b74ed9b7494b3799093551d4c928a7916865ed42d00a135156cbd08612b53072e9e424f0687c10a93a444d30d6b0294b6a1d5fdba78078d706646ba558f",
+  "@nx/nx-darwin-arm64@npm:22.7.5": "4f8435566c4b7ea0de0c8953f994849b91ad85867f6cdfce67fc0bb7404a760131dad7bdb7c789f82980d349c1a6df255be03807da260cbc5396284395865f28",
+  "@nx/nx-darwin-x64@npm:22.7.5": "3d63123766ce58602f08c5c2e9e896d9bbba402c53f3918a0ea5eebab25cd2f48fb992ac654ea648088564b1347f920509f7a20ad25c538d227a11292024ce64",
+  "@nx/nx-freebsd-x64@npm:22.7.5": "6fa6ba0ab68e6fd9742c5bdc8cacbd67d3be6334b967c9dfa3a3fa5e64b689fa1d7b50f807420227ad470c53ad5cf8343240d35ed89ca8d3e62a921a4857e8b9",
+  "@nx/nx-linux-arm-gnueabihf@npm:22.7.5": "7fd2f207688a8353012f8363cc28868e927840c2378dba466a67dff50eabbf24362e6654e183c1308479d435e8326444ae4ab803e3f5bdf84061915124183f4f",
+  "@nx/nx-linux-arm64-gnu@npm:22.7.5": "03c8fa25e5833fe4746995624b15e72258b7050ee70a6d80ed4c2b0f5e8b740774264d1decf70eea61387028886b2360953675d554f2ee8b4ae784adf738ed7b",
+  "@nx/nx-linux-arm64-musl@npm:22.7.5": "ea449f0b82c027b6eae5f2a060d26624bee91b487b601ccb5ab250ff33140f4bd60cf004e8f5f1e495b9bd391c17bda4758635ddb80f1af29b234eb067517b2c",
+  "@nx/nx-linux-x64-gnu@npm:22.7.5": "96aad2912ef8a607147cb5831ddbfc6f08b3c657c44879c738055fde274259e2dfc7e507485c52c194e79445ca2410cf618e31e2d2af00f7563f04055beea3c7",
+  "@nx/nx-linux-x64-musl@npm:22.7.5": "1f61915a2e93a6b930b81b8205407e2c961f7878a5131f136027b86bd35a579fe65b52a47088c4818c6e6426b3aa79ece8ce30119a3e44dd4d5a681efd7cde4a",
+  "@nx/nx-win32-arm64-msvc@npm:22.7.5": "3f4668ce48fd341f487b99c72e7678ebdfa0964591a58947752bf050a4bb21bf27ee920ac4554433e0efd73beca923a17a6dfc90e35c8b5ee1f92fd4a7f2caa0",
+  "@nx/nx-win32-x64-msvc@npm:22.7.5": "c44700bd537a0f2571d75285302d332c0fa31a648a822937cd81362c7b4fcb8c8ecabb98559c0b7bcdb537acd051b4f3926bcd9e369095260fc6aa8d079e3c04",
+  "@unrs/resolver-binding-android-arm-eabi@npm:1.11.1": "04dd38b694c1680bfec192b499e188700398a414886a08a8a7c72815db56ac147df03d88c73ff6fff7ac3e0a01dc41978054b3622b49463e0d684c5168557fcc",
+  "@unrs/resolver-binding-android-arm64@npm:1.11.1": "763626adc34dd2b4af677b5ced6493e7b2b1935351a5c9137f1c9561d11faf97b94015e6876e57e85c33ff563564314c92c0882a4780a57f2225cbbd779a695d",
+  "@unrs/resolver-binding-darwin-arm64@npm:1.11.1": "03b477fdfec55dbabe488fe0962417bddaa38b028d2670053469f1d24163907b097aac15b565f6974449bee398a38d5e3e1525f2b515ce57e243149021b7aa2f",
+  "@unrs/resolver-binding-darwin-x64@npm:1.11.1": "3aeff9aaf4ef6d786c517d9017b5c41b0af180cdbaf705d08e6e5b5ba9d5410d28ef6754c5f8a865f0bb5efd460dc1c4156b5e2201032c0a604a6c734ddbc848",
+  "@unrs/resolver-binding-freebsd-x64@npm:1.11.1": "b9f7a3e03db9edfc3480db056dd25229f901f21840ee768b69f349b66676a995a404e60617b3bcbd984f57f2199eb352dd6fad0f4420c3084ceef5e3293cdad5",
+  "@unrs/resolver-binding-linux-arm-gnueabihf@npm:1.11.1": "4d03b8bcef5a90586a846d6d332f39cee211f3d330b6e10036969894b6ecfb70b047265e985d572def93b84f38621dec30e4b4bb42699dd784adbae3ca5e7bea",
+  "@unrs/resolver-binding-linux-arm-musleabihf@npm:1.11.1": "9f3a3c2e5e6418a5a78294fa042824f5c270e993c1a99e82dd6b0ee0d2869929bb62dd154a0acc1e4ef16273e8073e0e257901208c062e6bdd49d586d07bb419",
+  "@unrs/resolver-binding-linux-arm64-gnu@npm:1.11.1": "05228d6fd669f404f0e3164ccf2430a52cc7b3bbd211367527b5d726b1220a1816bab70159bed55694d9b7543553f6002379e7e186c605d7055c5156977da022",
+  "@unrs/resolver-binding-linux-arm64-musl@npm:1.11.1": "8115802143396d4992bb2f6f0acb6e8bc141a57864c5fd84cbc70577c25784cb08dd163b753b1fc0decc02582cf4cb1e30d04faaf763048babbbe706bdfa26ea",
+  "@unrs/resolver-binding-linux-ppc64-gnu@npm:1.11.1": "50f9f54b2eafb1ea023671cc3070692b2b15f6e49105b08b3f588033e65e8de4183f76e080b798de710f9c41df1bf5515c01868866a21cbd35db179b4ac9f23b",
+  "@unrs/resolver-binding-linux-riscv64-gnu@npm:1.11.1": "8f8222f938cc2025ed3971e0e303f4ff5aa5df74474b835442830ebe942d050ba3f8bbb67095da64099e6fc69bb5bb73ca63db54e059c95e51aa8909880fb207",
+  "@unrs/resolver-binding-linux-riscv64-musl@npm:1.11.1": "5c8987f7dcaf38ef27ec67dcf118141502d5ac75d28429da6d1b7037f3e5a5351f32f55094472fde11784e65d01f1da4dafd7c0fdca28423fbc8de2c2c51d16c",
+  "@unrs/resolver-binding-linux-s390x-gnu@npm:1.11.1": "17aed6472880a82e5a05147a55efb6f0d968f5dcb584845addf89acec3824534ee741d4b162686124d17daf9131373c469c57843996a5ee2db4f1b1b55e1d11e",
+  "@unrs/resolver-binding-linux-x64-gnu@npm:1.11.1": "9495c08fc42f2d4a33e33c64adbcbf51588cd7ea07478eacb2e9143d955a760122440f4a3ac48b086cc2563ca2b2464d72ed0336fcc20c0a89ddc356f956eda8",
+  "@unrs/resolver-binding-linux-x64-musl@npm:1.11.1": "c84fadfee66eeebd16eb7cce7c4b5a1ec90260c724d0064111e9f43a1341ebfede61627cb68fd3a9735e4c10b25606fb472a4d13143cc569867b80d85c4a9824",
+  "@unrs/resolver-binding-wasm32-wasi@npm:1.11.1": "655a3990ed9b238e8f0c4858f87ca84bd3d81db300f7730c885162333055170e11207af7789ff38f619e261178718f6977729e42ce7978cc9e6ac7b6d93822d5",
+  "@unrs/resolver-binding-win32-arm64-msvc@npm:1.11.1": "983f800ff8b5181247a7d460ab5c9704cd425d0182e93290f69fb969d93efe17be6a27c22b97546d36e9a9d9aeda96d5f753bc938b3d9a00f32c10fc228ce5a9",
+  "@unrs/resolver-binding-win32-ia32-msvc@npm:1.11.1": "383d639e3b08fc9e4ba18127ef55610172d2d1d6adb83e1466fff2b223552384cdc6217051f749829e0c90a757ea5631e8c4ad2cfeb59bdee2bb033fbd526854",
+  "@unrs/resolver-binding-win32-x64-msvc@npm:1.11.1": "c862561f6495c0dbffb94d421e5727b25c1b61d98e22383bff23e6719a6c0125bb0b7df3be7220f5480bf54f5a605ea572f10fff1cce14fda24d42e396559940"
+}
diff --git a/pkgs/by-name/aw/aws-cdk-cli/package.nix b/pkgs/by-name/aw/aws-cdk-cli/package.nix
index 7124ccac6707..3c6c407e32f8 100644
--- a/pkgs/by-name/aw/aws-cdk-cli/package.nix
+++ b/pkgs/by-name/aw/aws-cdk-cli/package.nix
@@ -2,40 +2,42 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchYarnDeps,
   nodejs,
-  yarnBuildHook,
-  yarnConfigHook,
-  yarnInstallHook,
+  yarn-berry_4,
   diffutils,
   zip,
   jq,
+  python3,
   unzip,
   testers,
   nix-update-script,
 }:
 
+let
+  yarn-berry = yarn-berry_4;
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-cdk-cli";
-  version = "2.1116.0";
+  version = "2.1127.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-cdk-cli";
     tag = "cdk@v${finalAttrs.version}";
-    hash = "sha256-mRr5G42RrO87AdJOTLaM+EPprTFCI7eVxzUhafrGOxA=";
+    hash = "sha256-d55JNmWi4oTNorunkDwpdfcxHE9UC2fufKDahKgoLvk=";
   };
 
-  yarnOfflineCache = fetchYarnDeps {
-    yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-cjJBaq65sNWOFMFB1HAgGScxJlBZKnwkGipDd4aXhDE=";
+  missingHashes = ./missing-hashes.json;
+  offlineCache = yarn-berry.fetchYarnBerryDeps {
+    inherit (finalAttrs) src missingHashes;
+    hash = "sha256-eGj2Gx46lyypNz5e0U1AD1dVwOgJK4hkwXp03lR+6sc=";
   };
 
   nativeBuildInputs = [
-    yarnConfigHook
-    yarnBuildHook
-    yarnInstallHook
+    yarn-berry
+    yarn-berry.yarnBerryConfigHook
     nodejs
+    python3
     zip
     jq
     # tests
@@ -49,6 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     NX_VERBOSE_LOGGING = "true";
     # Needed to properly embed version info
     CODEBUILD_RESOLVED_SOURCE_VERSION = finalAttrs.version;
+    YARN_LOCKFILE_VERSION_OVERRIDE = "8";
   };
 
   # Regular "build" is very heavy and does things we don't need.
@@ -62,6 +65,13 @@ stdenv.mkDerivation (finalAttrs: {
     in
     ''
       echo '${cliVersionJson}' > packages/@aws-cdk/cloud-assembly-schema/cli-version.json
+      cat >> .yarnrc.yml <<'EOF'
+      approvedGitRepositories:
+        - "**"
+      enableScripts: true
+      enableNetwork: false
+      enableHardenedMode: false
+      EOF
     '';
 
   preBuild = ''
@@ -76,10 +86,27 @@ stdenv.mkDerivation (finalAttrs: {
     popd
   '';
 
+  buildPhase = ''
+    runHook preBuild
+
+    yarn "$yarnBuildScript"
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/node_modules/aws-cdk-cli
+    cp -r . $out/lib/node_modules/aws-cdk-cli
+
+    runHook postInstall
+  '';
+
   postInstall = ''
     # Manually bundle non-bundled dependencies
-    cp -r packages/@aws-cdk/cloud-assembly-schema/node_modules/jsonschema $out/lib/node_modules/aws-cdk-cli/node_modules/jsonschema
-    cp -r packages/aws-cdk/node_modules/decamelize $out/lib/node_modules/aws-cdk-cli/node_modules/decamelize
+    cp -r node_modules/jsonschema $out/lib/node_modules/aws-cdk-cli/node_modules/jsonschema
+    cp -r node_modules/decamelize $out/lib/node_modules/aws-cdk-cli/node_modules/decamelize
 
     patchShebangs "$out/lib/node_modules/aws-cdk-cli/node_modules/aws-cdk/bin"
     ln -s "$out/lib/node_modules/aws-cdk-cli/node_modules/aws-cdk/bin" "$out/bin"
diff --git a/pkgs/by-name/cd/cdemu-daemon/package.nix b/pkgs/by-name/cd/cdemu-daemon/package.nix
index f25748b01c85..95eb42f7e75c 100644
--- a/pkgs/by-name/cd/cdemu-daemon/package.nix
+++ b/pkgs/by-name/cd/cdemu-daemon/package.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cdemu-daemon";
-  version = "3.3.0";
+  version = "3.3.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/cdemu/cdemu-daemon-${finalAttrs.version}.tar.xz";
-    hash = "sha256-AYHjiOAQdu685gc6p0j2QNtCmTYTWix1kzWQZYvGPWU=";
+    hash = "sha256-rkhxivVGQ2lsCUQEXJupDenj74E3shQXExhTWysf+qo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ch/changie/package.nix b/pkgs/by-name/ch/changie/package.nix
index 75fafed8c07f..308f71a99d20 100644
--- a/pkgs/by-name/ch/changie/package.nix
+++ b/pkgs/by-name/ch/changie/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "changie";
-  version = "1.24.1";
+  version = "1.24.2";
 
   src = fetchFromGitHub {
     owner = "miniscruff";
     repo = "changie";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-mstq+iOqPc8rU1lLmS0ZvguxjS0GC8DrS+G4rQVThdg=";
+    hash = "sha256-J71lJq46gSQcAA+agswh0bZ1B97YoFIV2mM0e8A1Dw8=";
   };
 
   vendorHash = "sha256-VoiGg0K89S98j2q68U0oYENgAYjynl3EeFC47l3Hq9Q=";
diff --git a/pkgs/by-name/cu/cursor-cli/package.nix b/pkgs/by-name/cu/cursor-cli/package.nix
index f3f8e0d037a8..4bf958f44b12 100644
--- a/pkgs/by-name/cu/cursor-cli/package.nix
+++ b/pkgs/by-name/cu/cursor-cli/package.nix
@@ -10,26 +10,26 @@ let
   inherit (stdenv) hostPlatform;
   sources = {
     x86_64-linux = fetchurl {
-      url = "https://downloads.cursor.com/lab/2026.06.12-19-59-36-f6aba9a/linux/x64/agent-cli-package.tar.gz";
-      hash = "sha256-bn8gLdiHW1adZ0VkvmN28Pb7X35F/dlztZuE8zzJoeQ=";
+      url = "https://downloads.cursor.com/lab/2026.06.19-20-24-33-653a7fb/linux/x64/agent-cli-package.tar.gz";
+      hash = "sha256-3xHrn1JaG2Leok/CiWtZezERrYqVcpZggXSD/zuWyy4=";
     };
     aarch64-linux = fetchurl {
-      url = "https://downloads.cursor.com/lab/2026.06.12-19-59-36-f6aba9a/linux/arm64/agent-cli-package.tar.gz";
-      hash = "sha256-otjrJCOKW+be5QmK+OJkYqJMbTZolVzSVfCsqNs1Otw=";
+      url = "https://downloads.cursor.com/lab/2026.06.19-20-24-33-653a7fb/linux/arm64/agent-cli-package.tar.gz";
+      hash = "sha256-6iiinIexiEKqXDXOHzKut1d0Mtg89A8zel0zeXna4Qc=";
     };
     x86_64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/lab/2026.06.12-19-59-36-f6aba9a/darwin/x64/agent-cli-package.tar.gz";
-      hash = "sha256-kTyFA999IZRH3wnlL3kpBD/ch0d+HlkGC2GqrneJ37k=";
+      url = "https://downloads.cursor.com/lab/2026.06.19-20-24-33-653a7fb/darwin/x64/agent-cli-package.tar.gz";
+      hash = "sha256-HgxyZ1TPLnyJJJuvi8VrQhm33/rzD9kCwxy4Mp0D9C0=";
     };
     aarch64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/lab/2026.06.12-19-59-36-f6aba9a/darwin/arm64/agent-cli-package.tar.gz";
-      hash = "sha256-fgM9Wuw693QhgmgLGbAzyR42ifUSUCaERTMZjPC1o+w=";
+      url = "https://downloads.cursor.com/lab/2026.06.19-20-24-33-653a7fb/darwin/arm64/agent-cli-package.tar.gz";
+      hash = "sha256-Qa22+f5+x5+4sHesqp24d9GlKqPp6xBJG7BFxz6LUVU=";
     };
   };
 in
 stdenv.mkDerivation {
   pname = "cursor-cli";
-  version = "2026.06.12-19-59-36-f6aba9a";
+  version = "2026.06.19-20-24-33-653a7fb";
 
   src = sources.${hostPlatform.system};
 
diff --git a/pkgs/by-name/em/empty-pdf/package.nix b/pkgs/by-name/em/empty-pdf/package.nix
new file mode 100644
index 000000000000..55b13e079355
--- /dev/null
+++ b/pkgs/by-name/em/empty-pdf/package.nix
@@ -0,0 +1,41 @@
+{
+  stdenvNoCC,
+  imagemagick,
+  lib,
+}:
+
+stdenvNoCC.mkDerivation {
+  name = "empty-pdf";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  dontUnpack = true;
+
+  nativeBuildInputs = [ imagemagick ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    magick xc:none -page Letter empty.pdf
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mv empty.pdf $out
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Empty PDF file intended for testing";
+    maintainers = with lib.maintainers; [
+      pandapip1
+      thefossguy
+    ];
+    platforms = imagemagick.meta.platforms;
+  };
+}
diff --git a/pkgs/by-name/fl/flent/package.nix b/pkgs/by-name/fl/flent/package.nix
index 3c75ba139927..523f72e2659b 100644
--- a/pkgs/by-name/fl/flent/package.nix
+++ b/pkgs/by-name/fl/flent/package.nix
@@ -2,18 +2,21 @@
   lib,
   python3Packages,
   fetchPypi,
+  qt6,
+  irtt,
+  iputils,
+  netperf,
   procps,
-  qt5,
   nix-update-script,
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "flent";
-  version = "2.2.0";
+  version = "2.3.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-BPwh3oWIY1YEI+ecgi9AUiX4Ka/Y5dYikwmfvvNB+eg=";
+    hash = "sha256-qy+BvMpBDBtBqEEM9yEko/Gb2pusxF/LqiutSKlS2eE=";
   };
 
   build-system = with python3Packages; [
@@ -21,11 +24,23 @@ python3Packages.buildPythonApplication (finalAttrs: {
     sphinx
   ];
 
-  nativeBuildInputs = [ qt5.wrapQtAppsHook ];
+  nativeBuildInputs = [ qt6.wrapQtAppsHook ];
+  buildInputs = [ qt6.qtbase ];
+  makeWrapperArgs = [
+    "--prefix"
+    "PATH"
+    ":"
+    (lib.makeBinPath [
+      iputils
+      irtt
+      netperf
+      procps
+    ])
+  ];
 
   dependencies = with python3Packages; [
     matplotlib
-    pyqt5
+    pyqt6
     qtpy
   ];
 
@@ -36,17 +51,10 @@ python3Packages.buildPythonApplication (finalAttrs: {
     sed -i 's|self.skip|pass; #&|' unittests/test_gui.py
 
     # Dummy qt setup for gui tests
-    export QT_PLUGIN_PATH="${qt5.qtbase.bin}/${qt5.qtbase.qtPluginPrefix}"
+    export QT_PLUGIN_PATH="${qt6.qtbase}/${qt6.qtbase.qtPluginPrefix}"
     export QT_QPA_PLATFORM=offscreen
   '';
 
-  preFixup = ''
-    makeWrapperArgs+=(
-      "''${qtWrapperArgs[@]}"
-      --prefix PATH : ${lib.makeBinPath [ procps ]}
-    )
-  '';
-
   passthru.updateScript = nix-update-script { };
   meta = {
     description = "FLExible Network Tester";
diff --git a/pkgs/by-name/fo/forgejo-mcp/package.nix b/pkgs/by-name/fo/forgejo-mcp/package.nix
index 98ed33f8eca5..cf5cdef3bbc1 100644
--- a/pkgs/by-name/fo/forgejo-mcp/package.nix
+++ b/pkgs/by-name/fo/forgejo-mcp/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "forgejo-mcp";
-  version = "2.29.0";
+  version = "2.30.0";
 
   src = fetchFromCodeberg {
     owner = "goern";
     repo = "forgejo-mcp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZG8TKcckdyrdVHiNhYK1SvKFZHetg5otEw1ytkCD+Zc=";
+    hash = "sha256-DV8lL6Q/0gD8mFn3q5UusHv8ahNtmk9t9vtbhpvpxBs=";
   };
 
   vendorHash = "sha256-QDJRbF4mZzBv1vxvo1ZQJaUJayRHj1jMgjaRfAmLMik=";
diff --git a/pkgs/by-name/gi/git-mit/package.nix b/pkgs/by-name/gi/git-mit/package.nix
index 9f028c9f6a1c..adb4c7f12c76 100644
--- a/pkgs/by-name/gi/git-mit/package.nix
+++ b/pkgs/by-name/gi/git-mit/package.nix
@@ -9,7 +9,7 @@
 }:
 
 let
-  version = "6.1.0";
+  version = "6.4.3";
 in
 rustPlatform.buildRustPackage {
   pname = "git-mit";
@@ -19,10 +19,10 @@ rustPlatform.buildRustPackage {
     owner = "PurpleBooth";
     repo = "git-mit";
     tag = "v${version}";
-    hash = "sha256-2ApBtZPfpV5mrvD/6NS+qsA8/WLFZL6OGWnANJBMchI=";
+    hash = "sha256-Id7S0qE1020pPMoyCl8jkHWrbdOb6FZHLNsqRvwjpf8=";
   };
 
-  cargoHash = "sha256-ahT2jMFwU1+xQykqedmhOWjr+6mxpaUpjAMCeBwUTY0=";
+  cargoHash = "sha256-edKtumK9HGIXHy/ZdxZ1+lxYi+cS5G129E+WK9/JE10=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/im/image-analyzer/package.nix b/pkgs/by-name/im/image-analyzer/package.nix
index 364286765d26..f35aae5c0e82 100644
--- a/pkgs/by-name/im/image-analyzer/package.nix
+++ b/pkgs/by-name/im/image-analyzer/package.nix
@@ -16,11 +16,11 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "image-analyzer";
-  version = "3.3.0";
+  version = "3.3.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/cdemu/image-analyzer-${finalAttrs.version}.tar.xz";
-    hash = "sha256-N2aufwYEBVx7z2Vo7Qi4DP2MsDXXr5LrQdeNYOtNGnU=";
+    hash = "sha256-vsfDmtjrvAC49ynnJ7QguBfSVnt/sBpCy/Eau2l1/jQ=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/jc/jchempaint/package.nix b/pkgs/by-name/jc/jchempaint/package.nix
index 179f52abcb5b..f3cc48097538 100644
--- a/pkgs/by-name/jc/jchempaint/package.nix
+++ b/pkgs/by-name/jc/jchempaint/package.nix
@@ -13,16 +13,16 @@
 
 maven.buildMavenPackage {
   pname = "jchempaint";
-  version = "3.4-SNAPSHOT-2025-10-15"; # "3.4-SNAPSHOT" is the version given in the pom.xml
+  version = "3.4-SNAPSHOT-2026-04-24"; # "3.4-SNAPSHOT" is the version given in the pom.xml
 
   src = fetchFromGitHub {
     owner = "JChemPaint";
     repo = "jchempaint";
-    rev = "de023b6ddc1a13f5af48fa2acc8a2633c36a30fa";
-    hash = "sha256-1wcJ1qP8yZg1qe4YkpCRGidHUXc1/1eUabR3NoM6kjc=";
+    rev = "f128d0d15be1bac4d324463f269cf130d2211253";
+    hash = "sha256-pcHX6PdnD/jkLxAMSV/Ts8VVrK9xy2NWiMVVJ7jTrQc=";
   };
 
-  mvnHash = "sha256-AGDyXyEEDMjPHMlbcxninkciZ7V/ALMUS/OkgBnni18=";
+  mvnHash = "sha256-VpYSTN5u9IhCakak48HhbwnT3FhMpPKlwRZztiNGEIw=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/by-name/ki/kiro-cli/package.nix b/pkgs/by-name/ki/kiro-cli/package.nix
index 1f5dece53dc9..d93e292b1d6b 100644
--- a/pkgs/by-name/ki/kiro-cli/package.nix
+++ b/pkgs/by-name/ki/kiro-cli/package.nix
@@ -14,23 +14,23 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "kiro-cli";
-  version = "2.7.0";
+  version = "2.8.1";
 
   src =
     let
       darwinDmg = fetchurl {
         url = "https://desktop-release.q.us-east-1.amazonaws.com/${finalAttrs.version}/Kiro%20CLI.dmg";
-        hash = "sha256-UkwrchLjdbQ3aWHYG+DcMkbtQyKCEbG6wdNfOpu42TY=";
+        hash = "sha256-nN3GHnAdjgIplKgbPgtis4M1lRhyH5s8ilHMjKAuRJU=";
       };
     in
     {
       x86_64-linux = fetchurl {
         url = "https://desktop-release.q.us-east-1.amazonaws.com/${finalAttrs.version}/kirocli-x86_64-linux.tar.gz";
-        hash = "sha256-jDpQgcIJfLS+IxPqMsOg9Ydeol2UptXl8ugeIdVe0rg=";
+        hash = "sha256-6HAczZP8cCChkZ4rN3I+15vwABHm1LvSu+CKgIbNqRM=";
       };
       aarch64-linux = fetchurl {
         url = "https://desktop-release.q.us-east-1.amazonaws.com/${finalAttrs.version}/kirocli-aarch64-linux.tar.gz";
-        hash = "sha256-YYoPWHvmjanHBuZuI+0P8lytURCOwChH7BaSZnQmIJE=";
+        hash = "sha256-dnTr+VGe30hB/LRo7whzRTt1m6cOwsorf7CebN/eock=";
       };
       x86_64-darwin = darwinDmg;
       aarch64-darwin = darwinDmg;
diff --git a/pkgs/by-name/le/lenovo-legion/package.nix b/pkgs/by-name/le/lenovo-legion/package.nix
index e712e5e11f47..ca02b32de8ee 100644
--- a/pkgs/by-name/le/lenovo-legion/package.nix
+++ b/pkgs/by-name/le/lenovo-legion/package.nix
@@ -9,14 +9,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "lenovo-legion-app";
-  version = "0.0.20-unstable-2025-07-11";
+  version = "0.0.20-unstable-2026-05-12";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "johnfanv2";
     repo = "LenovoLegionLinux";
-    rev = "f559df04cc0705b2b181dfd0404110a4d1d6e2a9";
-    hash = "sha256-WXGDlykH6aBUVotmDcGZ8Y/zC8iBAv57u3hXRnfTaSo=";
+    rev = "7c19579d13ce686cf1e237699b9a78e80d03c977";
+    hash = "sha256-gTlUrbNKCUQ+g70StlqspDn90wKW2scssKPZqaegzTY=";
   };
 
   sourceRoot = "${src.name}/python/legion_linux";
@@ -38,10 +38,6 @@ python3.pkgs.buildPythonApplication rec {
 
   postPatch = ''
     # only fixup application (legion-linux-gui), service (legiond) currently not installed so do not fixup
-    # version
-    substituteInPlace ./setup.cfg \
-      --replace-fail "_VERSION" "${builtins.head (lib.splitString "-" version)}"
-
     # /etc
     substituteInPlace ./legion_linux/legion.py \
       --replace-fail "/etc/legion_linux" "$out/share/legion_linux"
diff --git a/pkgs/by-name/le/leviculum/package.nix b/pkgs/by-name/le/leviculum/package.nix
index 7b380d466ef2..77b04ab2e892 100644
--- a/pkgs/by-name/le/leviculum/package.nix
+++ b/pkgs/by-name/le/leviculum/package.nix
@@ -4,15 +4,13 @@
   fetchFromGitea,
   pkg-config,
   udev,
-  gitMinimal,
-  writableTmpDirAsHomeHook,
   versionCheckHook,
   nix-update-script,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "leviculum";
-  version = "0.6.0";
+  version = "0.7.0";
   __structuredAttrs = true;
 
   src = fetchFromGitea {
@@ -21,10 +19,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     repo = "leviculum";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = false;
-    hash = "sha256-pNCTWIGVr0tHrqpisJbAEAyQUW1/mKexu6K+LZ9PWZ4=";
+    hash = "sha256-/ylHrCLs9QSTiox3/JHJtZBYLlysLsezG8iz6C1DtCI=";
   };
 
-  cargoHash = "sha256-pGORaIcRRkJKKcyFnt8Fu9wmhWREwH6Cs8KvlEas/NQ=";
+  cargoHash = "sha256-DfwN4DTWcezcDRkl27cZXQdfXIhxlAj6+2nmYXhxius=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/li/libretro-shaders-slang/package.nix b/pkgs/by-name/li/libretro-shaders-slang/package.nix
index 3baaf9e86f5d..7536aa81085b 100644
--- a/pkgs/by-name/li/libretro-shaders-slang/package.nix
+++ b/pkgs/by-name/li/libretro-shaders-slang/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "libretro-shaders-slang";
-  version = "0-unstable-2026-06-10";
+  version = "0-unstable-2026-06-19";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "slang-shaders";
-    rev = "140d1bcc67a7287670ad6a02fc77e11c10ef5e07";
-    hash = "sha256-EejHojtJDnhgYk5PM8RTiCdV5TCeqcszodHQvs6vVIU=";
+    rev = "8ec4c82cf61a6ce3faae1e6111457d0d31920b60";
+    hash = "sha256-nPmDmuaa64I0QMHoUTr1nD6g3STyx0+cW3tY/q26M4A=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/li/litmusctl/package.nix b/pkgs/by-name/li/litmusctl/package.nix
index 63179580d54f..b752a5686ce2 100644
--- a/pkgs/by-name/li/litmusctl/package.nix
+++ b/pkgs/by-name/li/litmusctl/package.nix
@@ -9,7 +9,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "litmusctl";
-  version = "1.25.0";
+  version = "1.26.0";
 
   nativeBuildInputs = [
     installShellFiles
@@ -23,7 +23,7 @@ buildGoModule (finalAttrs: {
     owner = "litmuschaos";
     repo = "litmusctl";
     rev = "${finalAttrs.version}";
-    hash = "sha256-vHvTp6qOFblGbGatQ2YUJQIsJQgFzB/bbnTpMMzE4NY=";
+    hash = "sha256-Zo21QH6uO1uKcLbuirLiIXS4qOI40zbamt1G9sL0IWg=";
   };
 
   vendorHash = "sha256-Lkvc8dBr/nvKczx83/KXKLe5FskGpI/17GIrl2y/E1I=";
diff --git a/pkgs/by-name/ma/mailpit/source.nix b/pkgs/by-name/ma/mailpit/source.nix
index d08c094b3283..163ac2f273cb 100644
--- a/pkgs/by-name/ma/mailpit/source.nix
+++ b/pkgs/by-name/ma/mailpit/source.nix
@@ -1,6 +1,6 @@
 {
-  version = "1.30.1";
-  hash = "sha256-Z/0Lh+2VLB3w4AHNf+imWRgHmarO1MMUmNqrcAVSQ2k=";
-  npmDepsHash = "sha256-eccYGPIbk98+BtNtBAq4G1z/ymj6HHwacuH6ZktuN0U=";
-  vendorHash = "sha256-FgwMdvND7DMrYWp9kB2IB+Gjyo1gm1LtLTeC9SfPw9U=";
+  version = "1.30.2";
+  hash = "sha256-37nJRJL1mxvUdD7L9/yO/Lzyjvn09Tu9xHTEt4pxu2s=";
+  npmDepsHash = "sha256-AApRrIIYC4NtKIFyGQ3lnKIOk7LZNDK8wvUUbSczTrA=";
+  vendorHash = "sha256-em0317Q1u5sl8gws4/qqM8e9H5F4vfBiM7tLCyufgEk=";
 }
diff --git a/pkgs/by-name/mc/mcp-grafana/package.nix b/pkgs/by-name/mc/mcp-grafana/package.nix
index 1cbef5c243a8..71b4cfbbdc3f 100644
--- a/pkgs/by-name/mc/mcp-grafana/package.nix
+++ b/pkgs/by-name/mc/mcp-grafana/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "mcp-grafana";
-  version = "0.15.2";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "mcp-grafana";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qjK8v3nUTGcBWdEF1hMKDRQtPKcYbZRU5+O8D89eZHI=";
+    hash = "sha256-/K7m+VexScHppGuxKsGpz18WmJ3Xphmk2/nCHphwL1o=";
   };
 
   vendorHash = "sha256-E7Uh5nG6elUhEa+4RCtgGrle0Py6TjRc+OOvjtik1D8=";
diff --git a/pkgs/by-name/mi/mirth/package.nix b/pkgs/by-name/mi/mirth/package.nix
new file mode 100644
index 000000000000..ada6e8fada17
--- /dev/null
+++ b/pkgs/by-name/mi/mirth/package.nix
@@ -0,0 +1,116 @@
+{
+  lib,
+  fetchFromSourcehut,
+  buildPackages,
+  stdenv,
+  makeBinaryWrapper,
+}:
+
+stdenv.mkDerivation {
+  name = "mirth";
+  version = "0-unstable-2026-05-28";
+
+  src = fetchFromSourcehut {
+    owner = "~typeswitch";
+    repo = "mirth";
+    rev = "b180112a547cb803e3bf5720a0bb08f8bffa9742";
+    hash = "sha256-6nd1DrN3sGobmOh+E/8hYUFW2tBSFLdaEPXrViKDVSc=";
+  };
+
+  postPatch =
+    # Bug report: https://todo.sr.ht/~typeswitch/mirth/16
+    lib.optionalString (with stdenv.buildPlatform; isAarch64 && isLinux) ''
+      substituteInPlace bin/mirth0.c \
+        --replace-fail "WRAP_I63(24LL);" "WRAP_I63(16LL);"
+      substituteInPlace lib/std/world.mth \
+        --replace-fail "Linux -> 24u," "Linux -> running-arch Arch.ARM64 = if(16u, 24u),"
+    ''
+    # Replace hard-coded GCC with stdenv’s C compiler.
+    # NOTE: newer GCC requires optimization level ≥1 to use fortity. -O1 is
+    # fast enough as a default for the compiler stages.
+    + ''
+      substituteInPlace Makefile \
+        --replace-fail "-O0" "-O1" \
+        --replace-fail "CC=gcc \$(C99FLAGS)" "CC=${buildPackages.stdenv.cc.targetPrefix}cc \$(C99FLAGS)"
+    ''
+    # Override the final binary, mirth3, with the target’s C compiler & -O2
+    # optimization for distribution.
+    + ''
+      echo "bin/mirth3: CC := ${stdenv.cc.targetPrefix}cc \$(C99FLAGS) -O2" >>Makefile
+    '';
+
+  outputs = [
+    "out"
+    "lib"
+    "bin"
+    "doc"
+    "examples"
+    "vim"
+  ];
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+
+  nativeBuildInputs = [ makeBinaryWrapper ];
+
+  buildFlags = [
+    "bin/mirth2"
+    "bin/mirth3"
+  ];
+
+  # st_mode substitution intentionally diverges from the pre-generated mirth0.c
+  doCheck = with stdenv.buildPlatform; !(isAarch64 && isLinux);
+
+  installPhase = ''
+    runHook preInstall
+
+    install -d "$lib/lib/mirth" "$doc/share/doc/mirth/tutorial" \
+      "$examples/share/mirth/examples" "$vim"
+
+    cp -Tr lib "$lib/lib/mirth"
+    cp -Tr examples "$examples/share/mirth/examples"
+    cp -Tr tutorial "$doc/share/doc/mirth/tutorial"
+    cp -Tr tools/mirth-vim  "$vim"
+
+    bin/mirth2 src/main.mth --docs "$doc/share/doc/mirth" -c
+    install -Dm644 LICENSE README.md -t "$doc/share/doc/mirth"
+
+    # stages 0–2 aren’t needed anymore
+    install -Dm755 bin/mirth3 "$bin/bin/mirth"
+
+    runHook postInstall
+  '';
+
+  # The raw binary @ $bin needs wrapping to get the stdlib @ $lib. By wrapping
+  # it here, it will be more flexible towards allowing users to wrap the Mirth
+  # binary with their own stdlib & other packages.
+  postFixup = ''
+    makeBinaryWrapper "$bin/bin/mirth" "$out/bin/mirth" \
+      --add-flags "-P $lib/lib/mirth"
+  '';
+
+  meta = {
+    description = "Concatenative functional programming language with strong static linear types";
+    longDescription = ''
+      Mirth is inspired by Forth, Joy, Haskell, Lisp, and monoidal category theory.
+      Mirth compiles to C99.
+    '';
+    homepage = "https://git.sr.ht/~typeswitch/mirth";
+    license = lib.licenses.bsd0;
+    mainProgram = "mirth";
+    # https://git.sr.ht/~typeswitch/mirth/tree/main/item/src/mirth.h#L4-22
+    platforms = [
+      "aarch64-darwin"
+      "aarch64-linux"
+      "aarch64-windows"
+      "i686-linux"
+      "i686-windows"
+      "x86_64-darwin"
+      "x86_64-linux"
+      "x86_64-windows"
+    ];
+    maintainers = with lib.maintainers; [ toastal ];
+  };
+}
diff --git a/pkgs/by-name/ni/nixpkgs-vet/package.nix b/pkgs/by-name/ni/nixpkgs-vet/package.nix
index 2901878e9a94..69a65f20052d 100644
--- a/pkgs/by-name/ni/nixpkgs-vet/package.nix
+++ b/pkgs/by-name/ni/nixpkgs-vet/package.nix
@@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nixpkgs-vet";
-  version = "0.3.2";
+  version = "0.3.3";
 
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "nixpkgs-vet";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GJhN77zLtV2fUEL5wxjcybtDqUa6ODg39d3UxuOrapo=";
+    hash = "sha256-vOKZ5Da6PMI39WlOS7CXDME3oCvJw64dQDEfaCsDL0A=";
   };
 
-  cargoHash = "sha256-zTh18jec0trJP4q3rYheHZz01lbkhpDaotuPbvgzMpo=";
+  cargoHash = "sha256-9XQvmYO4bw57NoKsXTY281fMQE0vjV3pvoRlrUaRX3o=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/ra/raycast-beta/package.nix b/pkgs/by-name/ra/raycast-beta/package.nix
index acd40a54dc50..862481b3f98d 100644
--- a/pkgs/by-name/ra/raycast-beta/package.nix
+++ b/pkgs/by-name/ra/raycast-beta/package.nix
@@ -11,7 +11,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "raycast-beta";
-  version = "0.60.0.0";
+  version = "0.65.1.0";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -20,8 +20,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     {
       aarch64-darwin = fetchurl {
         name = "Raycast_Beta.dmg";
-        url = "https://x-r2.raycast-releases.com/Raycast_Beta_${finalAttrs.version}_2fc04147cc_arm64.dmg";
-        hash = "sha256-PQX5l5UzlphKySIR5QRcJvJLe9NxQrTOPLy3itV0QHU=";
+        url = "https://x-r2.raycast-releases.com/Raycast_Beta_0.65.1.0_66eacbc22e_arm64.dmg";
+        hash = "sha256-K9OuqlUR0E3hIVonSuBYAWFAvQCZQG35fsv5OWO8gKM=";
       };
     }
     .${stdenvNoCC.system} or (throw "raycast-beta: ${stdenvNoCC.system} is unsupported.");
@@ -68,10 +68,14 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Control your tools with a few keystrokes - beta release";
-    homepage = "https://raycast.app/";
+    homepage = "https://raycast.app/new";
+    changelog = "https://www.raycast.com/changelog/macos-beta";
     license = lib.licenses.unfree;
     mainProgram = "raycast-beta";
-    maintainers = with lib.maintainers; [ FlameFlag ];
+    maintainers = with lib.maintainers; [
+      FlameFlag
+      Br1ght0ne
+    ];
     platforms = [ "aarch64-darwin" ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
diff --git a/pkgs/by-name/re/readest/package.nix b/pkgs/by-name/re/readest/package.nix
index a0b70812e9c5..81f1b00c7297 100644
--- a/pkgs/by-name/re/readest/package.nix
+++ b/pkgs/by-name/re/readest/package.nix
@@ -23,13 +23,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "readest";
-  version = "0.11.4";
+  version = "0.11.12";
 
   src = fetchFromGitHub {
     owner = "readest";
     repo = "readest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tudx4LLRZXjA5wgfnA7+pBgBIUv1ZOYl2DZbsx7sWr0=";
+    hash = "sha256-3nUmizE5g2ICWd/1rpsq35w8VzKEg8OMuIceNULR6SM=";
     fetchSubmodules = true;
   };
 
@@ -46,11 +46,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_11;
     fetcherVersion = 3;
-    hash = "sha256-K6KQfXKBopTFJ4LKbFYSe0wVtwWkkhj40nMzYosBeGw=";
+    hash = "sha256-dxcQmbJHWwkPOR9JYMSL8x3Fb4Z65lhVVF5DUDHPOtk=";
   };
 
   cargoRoot = "../..";
-  cargoHash = "sha256-HQ7nQvxpfGTudOTGVaXRPqaxFrAOA2HnIcgFpmJsgDI=";
+  cargoHash = "sha256-t7pP3VP80/ex4iKwa0/ogEppeE6zPjEvZp53VwPg/Iw=";
 
   buildAndTestSubdir = "src-tauri";
 
diff --git a/pkgs/by-name/ro/rosa/package.nix b/pkgs/by-name/ro/rosa/package.nix
index 33b7316540a3..377851a1bf19 100644
--- a/pkgs/by-name/ro/rosa/package.nix
+++ b/pkgs/by-name/ro/rosa/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "rosa";
-  version = "1.2.63";
+  version = "1.2.64";
 
   src = fetchFromGitHub {
     owner = "openshift";
     repo = "rosa";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-8+4Ip9PGSIIfZ1zfkihrahh/65fBBAYWhVqdpeP0eB0=";
+    hash = "sha256-lvulPx9Vyo84Lt1yo/7LKsWEh0ABkRxhusXyO/aUVrU=";
   };
   vendorHash = null;
 
diff --git a/pkgs/by-name/ru/rust-rpxy/package.nix b/pkgs/by-name/ru/rust-rpxy/package.nix
index 9f241b19209c..78b9ce583b12 100644
--- a/pkgs/by-name/ru/rust-rpxy/package.nix
+++ b/pkgs/by-name/ru/rust-rpxy/package.nix
@@ -5,17 +5,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rust-rpxy";
-  version = "0.13.0";
+  version = "0.13.2";
 
   src = fetchFromGitHub {
     owner = "junkurihara";
     repo = "rust-rpxy";
     tag = finalAttrs.version;
-    hash = "sha256-YGXvRnpDKUi1qGJasTUrfa95AWsHAT+V/La1WOZIUkI=";
+    hash = "sha256-fdpr6HWMuMT0nXj7V5JQbiLVOGoWaTsX1OI+yCEErDA=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-CiauwBhv9Phdlpe7V9KwmgUvMSSFBLYPrlDl1lRT5/c=";
+  cargoHash = "sha256-WsK7eQffO+Ehx6H2Jj99XWON1Wc3Ud5Yaq1Nyz/oeSY=";
 
   meta = {
     description = "Http reverse proxy serving multiple domain names and terminating TLS for http/1.1, 2 and 3, written in Rust";
diff --git a/pkgs/by-name/se/seconlay/package.nix b/pkgs/by-name/se/seconlay/package.nix
index 772e9ece00e1..3394ddee73cf 100644
--- a/pkgs/by-name/se/seconlay/package.nix
+++ b/pkgs/by-name/se/seconlay/package.nix
@@ -12,17 +12,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "seconlay";
-  version = "0-unstable-2026-06-09";
+  version = "0-unstable-2026-06-18";
 
   src = fetchFromGitLab {
     group = "alasca.cloud";
     owner = "scl";
     repo = "scl-management";
-    rev = "1b410ebd9775faa116629a7bec01463ce9038a56";
-    hash = "sha256-Qq7bX1C+QTcYXfn8DGJwZZT0N1YfbywUe9jwqdReNLU=";
+    rev = "bd2d56e3537824537390cb0ba5e9efd4db1410c2";
+    hash = "sha256-f/eySU2lq1DwFPZ1CD8P7EeVO8b26Fz6d3PH3OrTm/0=";
   };
 
-  cargoHash = "sha256-pb9xqdgWrf8Lc10jSkkDb/1n0e15fMQ3AcKNPw6/vi8=";
+  cargoHash = "sha256-aX5HL/zDdrQ+V4vCYZrqlO2vNWuvF4GW2P30jtbv1tE=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/sh/shelfmark/package.nix b/pkgs/by-name/sh/shelfmark/package.nix
index de0496fab960..1a6f3af13afa 100644
--- a/pkgs/by-name/sh/shelfmark/package.nix
+++ b/pkgs/by-name/sh/shelfmark/package.nix
@@ -37,13 +37,13 @@ let
     apprise
   ];
 
-  version = "1.3.0";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner = "calibrain";
     repo = "shelfmark";
     tag = "v${version}";
-    hash = "sha256-rkGz7I3Gb/c4ndoB+YqStEhp0iv3IrB/gwq5gTWm5+c=";
+    hash = "sha256-3Z+e7d8kSckbIfobm8peOlg19IkW7AidJ3wOjz4dEOc=";
   };
 
   frontend = buildNpmPackage (finalAttrs: {
@@ -52,7 +52,7 @@ let
 
     sourceRoot = "${finalAttrs.src.name}/src/frontend";
 
-    npmDepsHash = "sha256-RkhjPdogxnZgaL+DysWO7Iy7EFAifskAxhALWX4n5qI=";
+    npmDepsHash = "sha256-fdocgRnduehA3LKHrVrxGmLEYgZDRTo20HSCh80RJIg=";
 
     installPhase = ''
       runHook preInstall
diff --git a/pkgs/by-name/sp/spotatui/package.nix b/pkgs/by-name/sp/spotatui/package.nix
index 1cb050cda77e..f4877a86c2d3 100644
--- a/pkgs/by-name/sp/spotatui/package.nix
+++ b/pkgs/by-name/sp/spotatui/package.nix
@@ -12,16 +12,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "spotatui";
-  version = "0.38.6";
+  version = "0.39.1";
 
   src = fetchFromGitHub {
     owner = "LargeModGames";
     repo = "spotatui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2H/HvyGc2xxP1S0eiP2eSiBOjkzKdqyOOD+8mLVLvE0=";
+    hash = "sha256-fuOSJSN5bKKmEVZZnzckNOxGK1+gDC9pU0vO7MHowis=";
   };
 
-  cargoHash = "sha256-3Ht4LjwFmmf07XizPrH66V2yPkOzrY4dVvvA4GRAcTs=";
+  cargoHash = "sha256-fe86HbNckgFruPl8KIW2akW6qFOpR98iCde9kRXthpM=";
 
   nativeBuildInputs = [ pkg-config ] ++ lib.optional withPipewireVisualizer rustPlatform.bindgenHook;
 
diff --git a/pkgs/by-name/st/steam-devices-udev-rules/package.nix b/pkgs/by-name/st/steam-devices-udev-rules/package.nix
index b84491ff06d7..1528acb4cd4c 100644
--- a/pkgs/by-name/st/steam-devices-udev-rules/package.nix
+++ b/pkgs/by-name/st/steam-devices-udev-rules/package.nix
@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "steam-devices-udev-rules";
-  version = "1.0.0.61-unstable-2026-04-16";
+  version = "1.0.0.61-unstable-2026-06-11";
 
   src = fetchFromGitHub {
     owner = "ValveSoftware";
     repo = "steam-devices";
-    rev = "39e7bd00f7a322e5165fd8f416b31d23daf6d385";
-    hash = "sha256-QjFyzSwqwzPz06Wcj7in91tlhaxgw0DydLgsjC+i6Lo=";
+    rev = "bbf6cf03104aed5f73ac2798bdb09dc63ea3adf8";
+    hash = "sha256-22blCo0NpPE39BevFsj/Xtz2K59eyPW1xjhJMXAoR/k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/st/stump/package.nix b/pkgs/by-name/st/stump/package.nix
new file mode 100644
index 000000000000..7045bcb575d4
--- /dev/null
+++ b/pkgs/by-name/st/stump/package.nix
@@ -0,0 +1,116 @@
+{
+  lib,
+  stdenv,
+  nixosTests,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  yarnConfigHook,
+  rustPlatform,
+  nodejs,
+  pdfium-binaries,
+  openssl,
+  dbus,
+  glib,
+  gtk3,
+  webkitgtk_4_1,
+  cacert,
+  pkg-config,
+  makeWrapper,
+}:
+let
+  version = "0.1.5";
+
+  src = fetchFromGitHub {
+    owner = "stumpapp";
+    repo = "stump";
+    tag = "v${version}";
+    hash = "sha256-kstMk4HJopLHW22ynVZF0itWUixwiDkbsMUpYMvw1Ag=";
+  };
+
+  frontend = stdenv.mkDerivation (finalAttrs: {
+    pname = "stump-frontend";
+    inherit src version;
+
+    yarnOfflineCache = fetchYarnDeps {
+      yarnLock = finalAttrs.src + "/yarn.lock";
+      hash = "sha256-Zh0GmxzDZ9YkUVK9i4cT4NKm83Rgcdi1qGmvA8RdDUM=";
+    };
+
+    nativeBuildInputs = [
+      yarnConfigHook
+      nodejs
+    ];
+
+    buildPhase = ''
+      runHook preBuild
+
+      pushd apps/web
+      node ./node_modules/.bin/vite build
+      popd
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      mv ./apps/web/dist $out
+    '';
+  });
+in
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "stump";
+  inherit src version;
+
+  __structuredAttrs = true;
+
+  cargoHash = "sha256-ZFIoxlArbhD+kZfX8K1iWmIaFSPfk9DeO9mL9PUZCnI=";
+
+  cargoBuildFlags = [
+    "--package"
+    "stump_server"
+    "--bin"
+    "stump_server"
+  ];
+
+  env.GIT_REV = "v${version}";
+
+  nativeBuildInputs = [
+    pkg-config
+    makeWrapper
+  ];
+
+  nativeCheckInputs = [
+    cacert
+  ];
+
+  buildInputs = [
+    openssl
+    dbus
+    glib
+    gtk3
+    webkitgtk_4_1
+  ];
+
+  preCheck = ''
+    export HOME=$TMP
+  '';
+
+  postInstall = ''
+    wrapProgram $out/bin/stump_server \
+      --set-default STUMP_CONFIG_DIR /var/lib/stump/config \
+      --set-default STUMP_CLIENT_DIR ${frontend} \
+      --set-default STUMP_PORT 10001 \
+      --set-default STUMP_PROFILE release \
+      --set-default PDFIUM_PATH ${pdfium-binaries}/lib/libpdfium.so \
+      --set-default API_VERSION v1
+  '';
+
+  passthru.tests = nixosTests.stump;
+
+  meta = {
+    homepage = "https://stumpapp.dev/";
+    description = "A free and open source comics, manga and digital book server with OPDS support";
+    license = lib.licenses.mit;
+    platforms = [ "x86_64-linux" ];
+    mainProgram = "stump_server";
+  };
+})
diff --git a/pkgs/by-name/ta/tailscale-gui/package.nix b/pkgs/by-name/ta/tailscale-gui/package.nix
index 214d6a6d3137..2bdeb434acbc 100644
--- a/pkgs/by-name/ta/tailscale-gui/package.nix
+++ b/pkgs/by-name/ta/tailscale-gui/package.nix
@@ -5,15 +5,20 @@
   xar,
   cpio,
   pbzx,
+  writeShellApplication,
+  cacert,
+  curl,
+  jq,
+  common-updater-scripts,
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tailscale-gui";
-  version = "1.92.3";
+  version = "1.98.5";
 
   src = fetchurl {
     url = "https://pkgs.tailscale.com/stable/Tailscale-${finalAttrs.version}-macos.pkg";
-    hash = "sha256-K5tJHyFhqnxV4KHzr7YOHRoH33vk+dq+EVWyUo88nuI=";
+    hash = "sha256-r7e8aKNWaX1psI0a3sohTUv8xmUv8oebH/ndjeHLoVA=";
   };
 
   dontUnpack = true;
@@ -39,13 +44,30 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  passthru.updateScript = lib.getExe (writeShellApplication {
+    name = "tailscale-gui-update-script";
+    runtimeInputs = [
+      cacert
+      curl
+      jq
+      common-updater-scripts
+    ];
+    text = ''
+      version=$(curl --silent "https://pkgs.tailscale.com/stable/?mode=json&os=darwin" | jq -r '.MacZipsVersion')
+      update-source-version tailscale-gui "$version"
+    '';
+  });
+
   meta = {
     description = "Tailscale GUI client for macOS";
     homepage = "https://tailscale.com";
     changelog = "https://tailscale.com/changelog#client";
     license = lib.licenses.unfree;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    maintainers = with lib.maintainers; [ anish ];
+    maintainers = with lib.maintainers; [
+      anish
+      Br1ght0ne
+    ];
     platforms = lib.platforms.darwin;
   };
 })
diff --git a/pkgs/by-name/te/teams-for-linux/package.nix b/pkgs/by-name/te/teams-for-linux/package.nix
index 6533308cff6b..f090d766af06 100644
--- a/pkgs/by-name/te/teams-for-linux/package.nix
+++ b/pkgs/by-name/te/teams-for-linux/package.nix
@@ -6,6 +6,7 @@
   alsa-utils,
   copyDesktopItems,
   electron_41,
+  libicns,
   makeDesktopItem,
   makeWrapper,
   nix-update-script,
@@ -18,22 +19,23 @@ let
 in
 buildNpmPackage rec {
   pname = "teams-for-linux";
-  version = "2.11.1";
+  version = "2.12.0";
 
   src = fetchFromGitHub {
     owner = "IsmaelMartinez";
     repo = "teams-for-linux";
     tag = "v${version}";
-    hash = "sha256-XEu0x9g2mEsmY+vZtazTOzW6KNMRbrxlPck/kPNehmo=";
+    hash = "sha256-n9Ibno6NqiZ9W5KpPPZKD5/MTO8CKYdf/fXDf0cGsi4=";
   };
 
-  npmDepsHash = "sha256-urLRj7668NX7CaDWAVxAoOg+c1TmMyvf23Je+RmFwHE=";
+  npmDepsHash = "sha256-euf/6RtAO84ZtbdhglBd6gRCcg2m6a+fhthNvFzMlho=";
 
   nativeBuildInputs = [
     makeWrapper
     versionCheckHook
   ]
-  ++ lib.optionals (stdenv.hostPlatform.isLinux) [ copyDesktopItems ];
+  ++ lib.optionals (stdenv.hostPlatform.isLinux) [ copyDesktopItems ]
+  ++ lib.optionals (stdenv.hostPlatform.isDarwin) [ libicns ];
 
   doInstallCheck = stdenv.hostPlatform.isLinux;
 
@@ -48,13 +50,29 @@ buildNpmPackage rec {
     cp -r ${electron.dist}/. "$electron_dist"
     chmod -R u+w "$electron_dist"
 
-    npm exec electron-builder -- \
-        --dir \
-        -c.npmRebuild=true \
-        -c.asarUnpack="**/*.node" \
-        -c.electronDist="$electron_dist" \
-        -c.electronVersion=${electron.version} \
-        -c.mac.identity=null
+    electron_builder_args=(
+      --dir
+      -c.npmRebuild=true
+      -c.asarUnpack="**/*.node"
+      -c.electronDist="$electron_dist"
+      -c.electronVersion=${electron.version}
+      -c.mac.identity=null
+    )
+
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    png2icns build/icon.icns \
+      build/icons/16x16.png \
+      build/icons/32x32.png \
+      build/icons/128x128.png \
+      build/icons/256x256.png \
+      build/icons/512x512.png \
+      build/icons/1024x1024.png
+    electron_builder_args+=(-c.mac.icon=build/icon.icns)
+  ''
+  + ''
+
+    npm exec electron-builder -- "''${electron_builder_args[@]}"
 
     runHook postBuild
   '';
diff --git a/pkgs/by-name/th/thaw/package.nix b/pkgs/by-name/th/thaw/package.nix
new file mode 100644
index 000000000000..75b88e6409fd
--- /dev/null
+++ b/pkgs/by-name/th/thaw/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  stdenvNoCC,
+  unzip,
+  fetchurl,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "thaw";
+  version = "1.2.0";
+
+  src = fetchurl {
+    url = "https://github.com/stonerl/Thaw/releases/download/${finalAttrs.version}/Thaw_${finalAttrs.version}.zip";
+    hash = "sha256-1n9NMe+foFeEmphUC4EM+kLgvGYBnTYFq9CORcaaoG8=";
+  };
+
+  __structuredAttrs = true;
+  strictDeps = true;
+  sourceRoot = ".";
+
+  nativeBuildInputs = [ unzip ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p "$out/Applications"
+    cp -r Thaw.app "$out/Applications"
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Menu bar manager for macOS 26";
+    homepage = "https://github.com/stonerl/Thaw";
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ Br1ght0ne ];
+    platforms = lib.platforms.darwin;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
diff --git a/pkgs/by-name/xv/xviewer/package.nix b/pkgs/by-name/xv/xviewer/package.nix
index 9347aed1b81c..1d1309d7792b 100644
--- a/pkgs/by-name/xv/xviewer/package.nix
+++ b/pkgs/by-name/xv/xviewer/package.nix
@@ -2,6 +2,7 @@
   stdenv,
   lib,
   fetchFromGitHub,
+  fetchpatch,
   docbook_xsl,
   exempi,
   gdk-pixbuf,
@@ -25,6 +26,11 @@
   yelp-tools,
   xapp,
   xapp-symbolic-icons,
+  gnome,
+  libavif,
+  libheif,
+  libjxl,
+  webp-pixbuf-loader,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -38,6 +44,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-ayd91gVLuSUVlCxaPSBbx7hg4tthVTaBEnl5V9YYbQw=";
   };
 
+  patches = [
+    # build: Add support for GIRepository-2.0.
+    (fetchpatch {
+      url = "https://github.com/linuxmint/xviewer/commit/74d7d4ba2584c658ae6fb87208543671664943cc.patch";
+      hash = "sha256-lL4MTvC2RvdVZ4O5RaYyK+1sHnLGPYzGNbZ99aN22U8=";
+    })
+  ];
+
   nativeBuildInputs = [
     docbook_xsl
     gobject-introspection
@@ -66,16 +80,19 @@ stdenv.mkDerivation (finalAttrs: {
     xapp
   ];
 
-  postPatch = ''
-    # Switch to girepository-2.0
-    substituteInPlace src/main.c \
-      --replace-fail "#include <girepository.h>" "#include <girepository/girepository.h>" \
-      --replace-fail "g_irepository_get_option_group" "gi_repository_get_option_group"
-
-    substituteInPlace src/xviewer-plugin-engine.c \
-      --replace-fail "#include <girepository.h>" "#include <girepository/girepository.h>" \
-      --replace-fail "g_irepository_get_default" "gi_repository_dup_default" \
-      --replace-fail "g_irepository_require" "gi_repository_require"
+  postInstall = ''
+    # In postInstall to run before gappsWrapperArgsHook.
+    export GDK_PIXBUF_MODULE_FILE="${
+      gnome._gdkPixbufCacheBuilder_DO_NOT_USE {
+        extraLoaders = [
+          libavif
+          libheif.lib
+          libjxl
+          librsvg
+          webp-pixbuf-loader
+        ];
+      }
+    }"
   '';
 
   preFixup = ''
diff --git a/pkgs/by-name/ya/yarn-berry/fetcher/yarn-berry-fetcher.nix b/pkgs/by-name/ya/yarn-berry/fetcher/yarn-berry-fetcher.nix
index dc24e4e18552..4edc9469e777 100644
--- a/pkgs/by-name/ya/yarn-berry/fetcher/yarn-berry-fetcher.nix
+++ b/pkgs/by-name/ya/yarn-berry/fetcher/yarn-berry-fetcher.nix
@@ -44,7 +44,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     license = lib.licenses.mit;
     mainProgram = "yarn-berry-fetcher";
     maintainers = with lib.maintainers; [
-      yuka
       flokli
     ];
   };
diff --git a/pkgs/development/python-modules/altcha/default.nix b/pkgs/development/python-modules/altcha/default.nix
index bb8b45651ccb..757668cdefc0 100644
--- a/pkgs/development/python-modules/altcha/default.nix
+++ b/pkgs/development/python-modules/altcha/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "altcha";
-  version = "2.0.0";
+  version = "2.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "altcha-org";
     repo = "altcha-lib-py";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-k5vy6lalC3idiquXbDCwF+mObzja/QC3PRBGQJMZ6fA=";
+    hash = "sha256-7KepW5PAl2prWdylBqBM/GDvsLGW+6le/itUiMBvFFU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/bgutil-ytdlp-pot-provider/default.nix b/pkgs/development/python-modules/bgutil-ytdlp-pot-provider/default.nix
index a483b927ef28..9dc0ebb58fe6 100644
--- a/pkgs/development/python-modules/bgutil-ytdlp-pot-provider/default.nix
+++ b/pkgs/development/python-modules/bgutil-ytdlp-pot-provider/default.nix
@@ -1,8 +1,16 @@
 {
   lib,
   buildPythonPackage,
+  cairo,
   fetchFromGitHub,
+  fetchNpmDeps,
+  giflib,
   hatchling,
+  nodejs,
+  npmHooks,
+  pango,
+  pixman,
+  pkg-config,
   yt-dlp,
 }:
 
@@ -18,7 +26,27 @@ buildPythonPackage rec {
     hash = "sha256-dhpataQ1HSCRPnm4k3K/NMaQPQdNrx8C4q855l7kbbQ=";
   };
 
-  sourceRoot = "${src.name}/plugin";
+  npmDeps = fetchNpmDeps {
+    name = "${pname}-${version}-npm-deps";
+    src = src + "/server";
+    npmDepsFetcherVersion = 2;
+    hash = "sha256-Qwwi6W+Oeu6ZeLmZP5vEfAKOJyivbULR5mlk7tcVIE8=";
+  };
+
+  npmRoot = "server";
+
+  nativeBuildInputs = [
+    nodejs
+    npmHooks.npmConfigHook
+    pkg-config
+  ];
+
+  buildInputs = [
+    cairo
+    giflib
+    pango
+    pixman
+  ];
 
   build-system = [ hatchling ];
 
@@ -26,10 +54,29 @@ buildPythonPackage rec {
 
   doCheck = false; # no tests
 
+  preBuild = ''
+    cd server
+    npx tsc
+    npm prune --omit=dev
+    cd ../plugin
+  '';
+
+  postInstall = ''
+    cd ..
+
+    mkdir -p $out/share/bgutil-ytdlp-pot-provider/
+    cp -r server/{build,node_modules} $out/share/bgutil-ytdlp-pot-provider/
+    makeWrapper ${lib.getExe nodejs} $out/bin/bgutil-ytdlp-pot-provider \
+      --add-flags $out/share/bgutil-ytdlp-pot-provider/build/main.js
+
+    cd plugin
+  '';
+
   meta = {
     description = "Proof-of-origin token provider plugin for yt-dlp";
     homepage = "https://github.com/Brainicism/bgutil-ytdlp-pot-provider";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ hexa ];
+    mainProgram = "bgutil-ytdlp-pot-provider";
   };
 }
diff --git a/pkgs/development/python-modules/os-client-config/default.nix b/pkgs/development/python-modules/os-client-config/default.nix
index 6b95f5bb3462..9e64f72bd64f 100644
--- a/pkgs/development/python-modules/os-client-config/default.nix
+++ b/pkgs/development/python-modules/os-client-config/default.nix
@@ -10,7 +10,7 @@
   python-glanceclient,
   setuptools,
   stestr,
-  subunit,
+  python-subunit,
   testscenarios,
   testtools,
 }:
@@ -40,7 +40,7 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     fixtures
     jsonschema
-    subunit
+    python-subunit
     oslotest
     stestr
     testscenarios
diff --git a/pkgs/development/python-modules/oslotest/default.nix b/pkgs/development/python-modules/oslotest/default.nix
index 66c6b5741d45..292ff2c8a383 100644
--- a/pkgs/development/python-modules/oslotest/default.nix
+++ b/pkgs/development/python-modules/oslotest/default.nix
@@ -5,7 +5,7 @@
   fixtures,
   pbr,
   six,
-  subunit,
+  python-subunit,
   callPackage,
 }:
 
@@ -24,7 +24,7 @@ buildPythonPackage rec {
   propagatedBuildInputs = [
     fixtures
     six
-    subunit
+    python-subunit
   ];
 
   # check in passthru.tests.pytest to escape infinite recursion with other oslo components
diff --git a/pkgs/development/python-modules/pyanglianwater/default.nix b/pkgs/development/python-modules/pyanglianwater/default.nix
index c0707646394f..abc7172cb4cd 100644
--- a/pkgs/development/python-modules/pyanglianwater/default.nix
+++ b/pkgs/development/python-modules/pyanglianwater/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pyanglianwater";
-  version = "3.2.1";
+  version = "3.2.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pantherale0";
     repo = "pyanglianwater";
     tag = version;
-    hash = "sha256-BAP3daKCIu0ANb1eUgElZ+stUt4Z5ffKia4snFXoeTA=";
+    hash = "sha256-u1s/XsNN6AuTzj0jLE7us1Mmoe8r+VuCl0khS5BRxkQ=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/python-octaviaclient/tests.nix b/pkgs/development/python-modules/python-octaviaclient/tests.nix
index 34a5d74de468..10499d53e417 100644
--- a/pkgs/development/python-modules/python-octaviaclient/tests.nix
+++ b/pkgs/development/python-modules/python-octaviaclient/tests.nix
@@ -7,7 +7,7 @@
   doc8,
   docutils,
   pygments,
-  subunit,
+  python-subunit,
   oslotest,
   stestr,
   testscenarios,
@@ -29,7 +29,7 @@ buildPythonPackage {
     doc8
     docutils
     pygments
-    subunit
+    python-subunit
     oslotest
     stestr
     testscenarios
diff --git a/pkgs/development/python-modules/subunit/default.nix b/pkgs/development/python-modules/python-subunit/default.nix
similarity index 97%
rename from pkgs/development/python-modules/subunit/default.nix
rename to pkgs/development/python-modules/python-subunit/default.nix
index 810b053d2b00..feb1644030f3 100644
--- a/pkgs/development/python-modules/subunit/default.nix
+++ b/pkgs/development/python-modules/python-subunit/default.nix
@@ -18,8 +18,8 @@
 }:
 
 buildPythonPackage {
+  pname = "python-subunit";
   inherit (subunit)
-    pname
     version
     src
     meta
diff --git a/pkgs/development/python-modules/stestr/default.nix b/pkgs/development/python-modules/stestr/default.nix
index 7af5331c3a99..14f79e2ada20 100644
--- a/pkgs/development/python-modules/stestr/default.nix
+++ b/pkgs/development/python-modules/stestr/default.nix
@@ -5,7 +5,7 @@
   cliff,
   fixtures,
   flit-core,
-  subunit,
+  python-subunit,
   testtools,
   tomlkit,
   voluptuous,
@@ -29,7 +29,7 @@ buildPythonPackage rec {
   dependencies = [
     cliff
     fixtures
-    subunit
+    python-subunit
     testtools
     tomlkit
     voluptuous
diff --git a/pkgs/development/python-modules/tempest/default.nix b/pkgs/development/python-modules/tempest/default.nix
index c3e40bd9f4e8..918cabbb3a12 100644
--- a/pkgs/development/python-modules/tempest/default.nix
+++ b/pkgs/development/python-modules/tempest/default.nix
@@ -24,7 +24,7 @@
   setuptools,
   stestr,
   stevedore,
-  subunit,
+  python-subunit,
   testscenarios,
   testtools,
   urllib3,
@@ -67,7 +67,7 @@ buildPythonPackage rec {
     pyyaml
     stestr
     stevedore
-    subunit
+    python-subunit
     testscenarios
     testtools
     urllib3
diff --git a/pkgs/development/python-modules/testrepository/default.nix b/pkgs/development/python-modules/testrepository/default.nix
index edaaeed18d9d..19af11c17108 100644
--- a/pkgs/development/python-modules/testrepository/default.nix
+++ b/pkgs/development/python-modules/testrepository/default.nix
@@ -5,7 +5,7 @@
   testtools,
   testresources,
   pbr,
-  subunit,
+  python-subunit,
   fixtures,
   python,
 }:
@@ -24,7 +24,7 @@ buildPythonPackage rec {
   buildInputs = [ pbr ];
   propagatedBuildInputs = [
     fixtures
-    subunit
+    python-subunit
     testtools
   ];
 
diff --git a/pkgs/development/python-modules/webrtcvad/default.nix b/pkgs/development/python-modules/webrtcvad/default.nix
index 2bc09f2e0c57..b18d159fcdd4 100644
--- a/pkgs/development/python-modules/webrtcvad/default.nix
+++ b/pkgs/development/python-modules/webrtcvad/default.nix
@@ -2,25 +2,32 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "webrtcvad";
   version = "2.0.10";
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "f1bed2fb25b63fb7b1a55d64090c993c9c9167b28485ae0bcdd81cf6ede96aea";
+    inherit (finalAttrs) pname version;
+    hash = "sha256-8b7S+yW2P7expV1kCQyZPJyRZ7KEha4Lzdgc9u3pauo=";
   };
 
+  build-system = [ setuptools ];
+
   # required WAV files for testing are not included in the tarball
   doCheck = false;
 
+  pythonImportsCheck = [ "webrtcvad" ];
+
   meta = {
     description = "Interface to the Google WebRTC Voice Activity Detector (VAD)";
     homepage = "https://github.com/wiseman/py-webrtcvad";
     license = with lib.licenses; [ mit ];
     maintainers = with lib.maintainers; [ prusnak ];
   };
-}
+})
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e1f46c269394..ba4690c748a2 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3963,79 +3963,53 @@ with pkgs;
       llvmPackagesSet = recurseIntoAttrs (callPackages ../development/compilers/llvm { });
 
       llvmPackages_18 = llvmPackagesSet."18";
-      clang_18 = llvmPackages_18.clang;
-      lld_18 = llvmPackages_18.lld;
-      lldb_18 = llvmPackages_18.lldb;
-      llvm_18 = llvmPackages_18.llvm;
-
       llvmPackages_19 = llvmPackagesSet."19";
-      clang_19 = llvmPackages_19.clang;
-      lld_19 = llvmPackages_19.lld;
-      lldb_19 = llvmPackages_19.lldb;
-      llvm_19 = llvmPackages_19.llvm;
-      bolt_19 = llvmPackages_19.bolt;
-
       llvmPackages_20 = llvmPackagesSet."20";
-      clang_20 = llvmPackages_20.clang;
-      lld_20 = llvmPackages_20.lld;
-      lldb_20 = llvmPackages_20.lldb;
-      llvm_20 = llvmPackages_20.llvm;
-      bolt_20 = llvmPackages_20.bolt;
-      flang_20 = llvmPackages_20.flang;
-
       llvmPackages_21 = llvmPackagesSet."21";
-      clang_21 = llvmPackages_21.clang;
-      lld_21 = llvmPackages_21.lld;
-      lldb_21 = llvmPackages_21.lldb;
-      llvm_21 = llvmPackages_21.llvm;
-      bolt_21 = llvmPackages_21.bolt;
-      flang_21 = llvmPackages_21.flang;
-
       llvmPackages_22 = llvmPackagesSet."22";
-      clang_22 = llvmPackages_22.clang;
-      lld_22 = llvmPackages_22.lld;
-      lldb_22 = llvmPackages_22.lldb;
-      llvm_22 = llvmPackages_22.llvm;
-      bolt_22 = llvmPackages_22.bolt;
-      flang_22 = llvmPackages_22.flang;
 
       mkLLVMPackages = llvmPackagesSet.mkPackage;
     })
     llvmPackages_18
-    clang_18
-    lld_18
-    lldb_18
-    llvm_18
     llvmPackages_19
-    clang_19
-    lld_19
-    lldb_19
-    llvm_19
-    bolt_19
     llvmPackages_20
-    clang_20
-    lld_20
-    lldb_20
-    llvm_20
-    bolt_20
-    flang_20
     llvmPackages_21
-    clang_21
-    lld_21
-    lldb_21
-    llvm_21
-    bolt_21
-    flang_21
     llvmPackages_22
-    clang_22
-    lld_22
-    lldb_22
-    llvm_22
-    bolt_22
-    flang_22
     mkLLVMPackages
     ;
 
+  clang_18 = llvmPackages_18.clang;
+  lld_18 = llvmPackages_18.lld;
+  lldb_18 = llvmPackages_18.lldb;
+  llvm_18 = llvmPackages_18.llvm;
+
+  clang_19 = llvmPackages_19.clang;
+  lld_19 = llvmPackages_19.lld;
+  lldb_19 = llvmPackages_19.lldb;
+  llvm_19 = llvmPackages_19.llvm;
+  bolt_19 = llvmPackages_19.bolt;
+
+  clang_20 = llvmPackages_20.clang;
+  lld_20 = llvmPackages_20.lld;
+  lldb_20 = llvmPackages_20.lldb;
+  llvm_20 = llvmPackages_20.llvm;
+  bolt_20 = llvmPackages_20.bolt;
+  flang_20 = llvmPackages_20.flang;
+
+  clang_21 = llvmPackages_21.clang;
+  lld_21 = llvmPackages_21.lld;
+  lldb_21 = llvmPackages_21.lldb;
+  llvm_21 = llvmPackages_21.llvm;
+  bolt_21 = llvmPackages_21.bolt;
+  flang_21 = llvmPackages_21.flang;
+
+  clang_22 = llvmPackages_22.clang;
+  lld_22 = llvmPackages_22.lld;
+  lldb_22 = llvmPackages_22.lldb;
+  llvm_22 = llvmPackages_22.llvm;
+  bolt_22 = llvmPackages_22.bolt;
+  flang_22 = llvmPackages_22.flang;
+
   mitschemeX11 = mitscheme.override {
     enableX11 = true;
   };
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 0af2eaaef4bc..57cd431dd2c8 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -601,6 +601,7 @@ mapAliases {
   sqlalchemy_migrate = throw "'sqlalchemy_migrate' has been renamed to/replaced by 'sqlalchemy-migrate'"; # Converted to throw 2025-10-29
   steamship = throw "'steamship' has been removed because it is broken and unmaintained upstream"; # Added 2026-05-06
   subunit2sql = throw "subunit2sql has been removed because it has been marked as broken since at least November 2024."; # Added 2025-10-04
+  subunit = python-subunit; # added 2026-06-21
   supafunc = throw "'supafunc' has been replaced by 'supabase-functions'"; # Added 2026-03-08
   supervise_api = throw "'supervise_api' has been renamed to/replaced by 'supervise-api'"; # Converted to throw 2025-10-29
   swh-perfecthash = throw "'swh-perfecthash' has been renamed to/replaced by 'swh-shard'"; # added 2025-11-13
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 6c08a84cbf5c..ebc2a4e5fcdc 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -16341,6 +16341,10 @@ self: super: with self; {
 
   python-string-utils = callPackage ../development/python-modules/python-string-utils { };
 
+  python-subunit = callPackage ../development/python-modules/python-subunit {
+    inherit (pkgs) subunit cppunit check;
+  };
+
   python-swiftclient = callPackage ../development/python-modules/python-swiftclient { };
 
   python-tado = callPackage ../development/python-modules/python-tado { };
@@ -19204,10 +19208,6 @@ self: super: with self; {
 
   subprocess4 = callPackage ../development/python-modules/subprocess4 { };
 
-  subunit = callPackage ../development/python-modules/subunit {
-    inherit (pkgs) subunit cppunit check;
-  };
-
   subzerod = callPackage ../development/python-modules/subzerod { };
 
   succulent = callPackage ../development/python-modules/succulent { };