diff --git a/ci/OWNERS b/ci/OWNERS
index cf158b7b9154..dbe5e829bb59 100644
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -377,8 +377,8 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 # VimPlugins
 /pkgs/applications/editors/vim/plugins         @NixOS/neovim
 ## nvim-treesitter
-/pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix @figsoda
-/pkgs/applications/editors/vim/plugins/utils/nvim-treesitter         @figsoda
+/pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix @NixOS/neovim @figsoda
+/pkgs/applications/editors/vim/plugins/utils/nvim-treesitter         @NixOS/neovim @figsoda
 
 # VsCode Extensions
 /pkgs/applications/editors/vscode/extensions
diff --git a/lib/licenses/licenses.nix b/lib/licenses/licenses.nix
index fbc915a6ce5b..8e40dacdbeb3 100644
--- a/lib/licenses/licenses.nix
+++ b/lib/licenses/licenses.nix
@@ -1560,6 +1560,11 @@ lib.mapAttrs mkLicense (
       fullName = "W3C Software Notice and License";
     };
 
+    w3c-19980720 = {
+      spdxId = "W3C-19980720";
+      fullName = "W3C Software Notice and License (1998-07-20)";
+    };
+
     wadalab = {
       fullName = "Wadalab Font License";
       url = "https://fedoraproject.org/wiki/Licensing:Wadalab?rd=Licensing/Wadalab";
diff --git a/nixos/modules/config/console.nix b/nixos/modules/config/console.nix
index 5a7a4f9f52ec..e57a5e8981a4 100644
--- a/nixos/modules/config/console.nix
+++ b/nixos/modules/config/console.nix
@@ -192,6 +192,9 @@ in
             "/etc/kbd/keymaps" = lib.mkIf (!cfg.earlySetup) {
               source = "${consoleEnv config.boot.initrd.systemd.package.kbd}/share/keymaps";
             };
+            "/etc/kbd/consolefonts" = lib.mkIf (!cfg.earlySetup && cfg.font != null) {
+              source = "${consoleEnv config.boot.initrd.systemd.package.kbd}/share/consolefonts";
+            };
           };
           boot.initrd.systemd.additionalUpstreamUnits = [
             "systemd-vconsole-setup.service"
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index acfa48a7a269..c724fa0b339f 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -816,8 +816,12 @@ in
   jool = import ./jool.nix { inherit pkgs runTest; };
   jotta-cli = runTest ./jotta-cli.nix;
   k3s = import ./rancher {
-    inherit pkgs runTest;
+    inherit pkgs;
     inherit (pkgs) lib;
+    runTest = runTestOn [
+      "aarch64-linux"
+      "x86_64-linux"
+    ];
     rancherDistro = "k3s";
   };
   kafka = handleTest ./kafka { };
diff --git a/pkgs/applications/video/kodi/addons/kodi-platform/default.nix b/pkgs/applications/video/kodi/addons/kodi-platform/default.nix
index 0b4682ce94e3..7bf24912818a 100644
--- a/pkgs/applications/video/kodi/addons/kodi-platform/default.nix
+++ b/pkgs/applications/video/kodi/addons/kodi-platform/default.nix
@@ -1,4 +1,5 @@
 {
+  lib,
   stdenv,
   fetchFromGitHub,
   cmake,
@@ -23,4 +24,8 @@ stdenv.mkDerivation rec {
     libcec_platform
     tinyxml
   ];
+
+  meta = {
+    license = lib.licenses.gpl2Plus;
+  };
 }
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index defcd8a39988..02c9f2578f26 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -438,14 +438,14 @@ in
 
   docker_29 =
     let
-      version = "29.4.1";
+      version = "29.4.2";
     in
     callPackage dockerGen {
       inherit version;
       cliRev = "v${version}";
       cliHash = "sha256-jGD+Z3koM0a2Te7cq2HdKFizZj39djvTQUmn815Mn4o=";
       mobyRev = "docker-v${version}";
-      mobyHash = "sha256-R+rCR8DG4IyEdn9ol7PjawixgymjrEVMrTjaZM1wReU=";
+      mobyHash = "sha256-jPmFYGOxvMof32fQeI4iHLG12ElwysYLSTkIrlluEXM=";
       runcRev = "v1.3.5";
       runcHash = "sha256-Swphxbu/OLkUrfRjLMZIVGwYb7AN0xHdyxm0ysAVam0=";
       containerdRev = "v2.2.3";
diff --git a/pkgs/by-name/ak/akkoma/akkoma-imagemagick.patch b/pkgs/by-name/ak/akkoma/akkoma-imagemagick.patch
deleted file mode 100644
index 11e291f6dbc5..000000000000
--- a/pkgs/by-name/ak/akkoma/akkoma-imagemagick.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From c48f5d57b6e57f42b668c0c6b8744e4620c77320 Mon Sep 17 00:00:00 2001
-From: Mikael Voss <mvs@nyantec.com>
-Date: Tue, 19 Nov 2024 20:47:27 +0100
-Subject: [PATCH] Use magick command from ImageMagick
-
-With ImageMagick version 7 the convert command has been deprecated in
-favour of magick. Calling convert instead results in the logs being
-spammed with warning messages.
-
-The mogrify Elixir wrapper also runs magick with the mogrify argument
-in current releases.
----
- lib/pleroma/application_requirements.ex | 8 ++++----
- lib/pleroma/helpers/media_helper.ex     | 4 ++--
- 2 files changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/lib/pleroma/application_requirements.ex b/lib/pleroma/application_requirements.ex
-index c3777d8f1..55ee674a2 100644
---- a/lib/pleroma/application_requirements.ex
-+++ b/lib/pleroma/application_requirements.ex
-@@ -166,10 +166,10 @@ defp check_system_commands!(:ok) do
-     filter_commands_statuses = [
-       check_filter(Pleroma.Upload.Filter.Exiftool.StripMetadata, "exiftool"),
-       check_filter(Pleroma.Upload.Filter.Exiftool.ReadDescription, "exiftool"),
--      check_filter(Pleroma.Upload.Filter.Mogrify, "mogrify"),
--      check_filter(Pleroma.Upload.Filter.Mogrifun, "mogrify"),
--      check_filter(Pleroma.Upload.Filter.AnalyzeMetadata, "mogrify"),
--      check_filter(Pleroma.Upload.Filter.AnalyzeMetadata, "convert"),
-+      check_filter(Pleroma.Upload.Filter.Mogrify, "magick"),
-+      check_filter(Pleroma.Upload.Filter.Mogrifun, "magick"),
-+      check_filter(Pleroma.Upload.Filter.AnalyzeMetadata, "magick"),
-+      check_filter(Pleroma.Upload.Filter.AnalyzeMetadata, "magick"),
-       check_filter(Pleroma.Upload.Filter.AnalyzeMetadata, "ffprobe")
-     ]
- 
-diff --git a/lib/pleroma/helpers/media_helper.ex b/lib/pleroma/helpers/media_helper.ex
-index cb95d0e68..17cd9629d 100644
---- a/lib/pleroma/helpers/media_helper.ex
-+++ b/lib/pleroma/helpers/media_helper.ex
-@@ -12,7 +12,7 @@ defmodule Pleroma.Helpers.MediaHelper do
-   require Logger
- 
-   def missing_dependencies do
--    Enum.reduce([imagemagick: "convert", ffmpeg: "ffmpeg"], [], fn {sym, executable}, acc ->
-+    Enum.reduce([imagemagick: "magick", ffmpeg: "ffmpeg"], [], fn {sym, executable}, acc ->
-       if Pleroma.Utils.command_available?(executable) do
-         acc
-       else
-@@ -22,7 +22,7 @@ def missing_dependencies do
-   end
- 
-   def image_resize(url, options) do
--    with executable when is_binary(executable) <- System.find_executable("convert"),
-+    with executable when is_binary(executable) <- System.find_executable("magick"),
-          {:ok, args} <- prepare_image_resize_args(options),
-          {:ok, env} <- HTTP.get(url, [], []),
-          {:ok, fifo_path} <- mkfifo() do
--- 
-2.43.0
-
diff --git a/pkgs/by-name/ak/akkoma/package.nix b/pkgs/by-name/ak/akkoma/package.nix
index c2568cc4c6f3..f5ebc61c42fd 100644
--- a/pkgs/by-name/ak/akkoma/package.nix
+++ b/pkgs/by-name/ak/akkoma/package.nix
@@ -20,14 +20,14 @@ let
 in
 beamPackages.mixRelease rec {
   pname = "akkoma";
-  version = "3.18.1";
+  version = "3.19.0";
 
   src = fetchFromGitea {
     domain = "akkoma.dev";
     owner = "AkkomaGang";
     repo = "akkoma";
     tag = "v${version}";
-    hash = "sha256-4HIIgTNcNAMCpHyT6zBcmxXeFbMrt38Z7PtT9Onvz+U=";
+    hash = "sha256-ASLnsmuWpfQKwpNNLUgI32Gdn/j+jUW5IBLlT8RUmcE=";
 
     # upstream repository archive fetching is broken
     forceFetchGit = true;
@@ -36,20 +36,10 @@ beamPackages.mixRelease rec {
   nativeBuildInputs = [ cmake ];
   buildInputs = [ file ];
 
-  patches = [
-    # See <https://akkoma.dev/AkkomaGang/akkoma/pulls/854>
-    # Akkoma uses the deprecated “convert” command instead of “magick”, which
-    # results in the logs being spammed with warning messages. Upstream is
-    # reluctant to change this, to ensure compatibility with Debian stable,
-    # which does not yet provide ImageMagick 7.
-    # Remove this patch once merged upstream.
-    ./akkoma-imagemagick.patch
-  ];
-
   mixFodDeps = beamPackages.fetchMixDeps {
     pname = "mix-deps-akkoma";
     inherit src version;
-    hash = "sha256-igXEX6I+7G7tNCLjEf0VBOaii0r7jXCdF6x78LMcUv0=";
+    hash = "sha256-O9A7XuQSSczGMcLMc6Fk0eh7PkjQ6sYJKSwdqoEPJJI=";
 
     postInstall = ''
       substituteInPlace "$out/http_signatures/mix.exs" \
diff --git a/pkgs/by-name/bl/blockbench/package.nix b/pkgs/by-name/bl/blockbench/package.nix
index cdf69b209b90..0d31dc1f86b4 100644
--- a/pkgs/by-name/bl/blockbench/package.nix
+++ b/pkgs/by-name/bl/blockbench/package.nix
@@ -12,13 +12,13 @@
 
 buildNpmPackage rec {
   pname = "blockbench";
-  version = "5.1.3";
+  version = "5.1.4";
 
   src = fetchFromGitHub {
     owner = "JannisX11";
     repo = "blockbench";
     tag = "v${version}";
-    hash = "sha256-aGGvYIYQ3fw1fk5NUwJsMkq2YSugQD94xfy52LvHOKc=";
+    hash = "sha256-lYsd8KegoO4amtRL5o3JPXW4vu4z3p/dXlOVn3zKgeA=";
   };
 
   patches = [
diff --git a/pkgs/by-name/en/envoy/0005-nixpkgs-pin-go-sdk-downloads.patch b/pkgs/by-name/en/envoy/0005-nixpkgs-pin-go-sdk-downloads.patch
new file mode 100644
index 000000000000..ebf12f1ff0e4
--- /dev/null
+++ b/pkgs/by-name/en/envoy/0005-nixpkgs-pin-go-sdk-downloads.patch
@@ -0,0 +1,79 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Baker <dan@djacu.dev>
+Date: Thu, 30 Apr 2026 08:42:44 -0700
+Subject: [PATCH] nixpkgs: pin Go SDK downloads
+
+Pin Go SDK downloads to avoid fetching the mutable version listing from
+https://go.dev/dl/?mode=json&include=all. Without explicit sdks, each
+go_download_sdk call downloads that listing (which changes with every Go
+release) and caches it in repository_cache, causing the deps hash to
+drift. See: io_bazel_rules_go/go/private/sdk.bzl lines 74-93 (rules_go
+v0.50.0)
+
+Signed-off-by: Daniel Baker <dan@djacu.dev>
+---
+ bazel/dependency_imports.bzl | 19 ++++++++++++++++++-
+ 1 file changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/bazel/dependency_imports.bzl b/bazel/dependency_imports.bzl
+index 90e49d5ceb0024b57481b816518990f58fc2ad5f..26091a877ea3951bfe69944ab8580857e787bb64 100644
+--- a/bazel/dependency_imports.bzl
++++ b/bazel/dependency_imports.bzl
+@@ -27,6 +27,18 @@ load("@rules_rust//rust:repositories.bzl", "rules_rust_dependencies", "rust_regi
+ # go version for rules_go
+ GO_VERSION = "1.24.6"
+ 
++# Pin Go SDK downloads to avoid fetching the mutable version listing from
++# https://go.dev/dl/?mode=json&include=all. Without explicit sdks, each
++# go_download_sdk call downloads that listing (which changes with every Go
++# release) and caches it in repository_cache, causing the deps hash to drift.
++# See: io_bazel_rules_go/go/private/sdk.bzl lines 74-93 (rules_go v0.50.0)
++_GO_SDKS = {
++    "linux_amd64": ["go" + GO_VERSION + ".linux-amd64.tar.gz", "bbca37cc395c974ffa4893ee35819ad23ebb27426df87af92e93a9ec66ef8712"],
++    "linux_arm64": ["go" + GO_VERSION + ".linux-arm64.tar.gz", "124ea6033a8bf98aa9fbab53e58d134905262d45a022af3a90b73320f3c3afd5"],
++    "darwin_amd64": ["go" + GO_VERSION + ".darwin-amd64.tar.gz", "4a8d7a32052f223e71faab424a69430455b27b3fff5f4e651f9d97c3e51a8746"],
++    "darwin_arm64": ["go" + GO_VERSION + ".darwin-arm64.tar.gz", "4e29202c49573b953be7cc3500e1f8d9e66ddd12faa8cf0939a4951411e09a2a"],
++}
++
+ JQ_VERSION = "1.7"
+ YQ_VERSION = "4.24.4"
+ 
+@@ -46,7 +58,8 @@ def envoy_dependency_imports(
+         register_preinstalled_tools=True,  # use host tools (default)
+     )
+     go_rules_dependencies()
+-    go_register_toolchains(go_version)
++    go_download_sdk(name = "go_sdk", version = go_version, sdks = _GO_SDKS)
++    go_register_toolchains()
+     if go_version != "host":
+         envoy_download_go_sdks(go_version)
+     gazelle_dependencies(go_sdk = "go_sdk")
+@@ -218,24 +231,28 @@ def envoy_download_go_sdks(go_version):
+         goos = "linux",
+         goarch = "amd64",
+         version = go_version,
++        sdks = _GO_SDKS,
+     )
+     go_download_sdk(
+         name = "go_linux_arm64",
+         goos = "linux",
+         goarch = "arm64",
+         version = go_version,
++        sdks = _GO_SDKS,
+     )
+     go_download_sdk(
+         name = "go_darwin_amd64",
+         goos = "darwin",
+         goarch = "amd64",
+         version = go_version,
++        sdks = _GO_SDKS,
+     )
+     go_download_sdk(
+         name = "go_darwin_arm64",
+         goos = "darwin",
+         goarch = "arm64",
+         version = go_version,
++        sdks = _GO_SDKS,
+     )
+ 
+ def crates_repositories():
diff --git a/pkgs/by-name/en/envoy/package.nix b/pkgs/by-name/en/envoy/package.nix
index 58486835903b..a61b122769a4 100644
--- a/pkgs/by-name/en/envoy/package.nix
+++ b/pkgs/by-name/en/envoy/package.nix
@@ -43,14 +43,19 @@ let
     hash = "sha256-dT6ehfmW/huuyitqIlYAlEzUE6WrVA39sDKxatkZGaY=";
   };
 
+  # When GO_VERSION changes upstream, update the four sha256 hex strings in the
+  # _GO_SDKS dict in 0005-nixpkgs-pin-go-sdk-downloads.patch using output from
+  # this command (set the version literal in `select` to match GO_VERSION):
+  #   curl -s 'https://go.dev/dl/?mode=json&include=all' | jq -r '.[] | select(.version == "go1.24.6") | .files[] | select(.kind == "archive" and (.os == "linux" or .os == "darwin") and (.arch == "amd64" or .arch == "arm64")) | "\(.os)_\(.arch): \(.sha256)"'
+
   # these need to be updated for any changes to fetchAttrs
   depsHash' =
     if depsHash != null then
       depsHash
     else
       {
-        x86_64-linux = "sha256-dQpkB4jRfJOB14AO5ynoL3VObI1af7nTI3vbMr5N6/g=";
-        aarch64-linux = "sha256-59sY+bpGsKMDthcj+jw00WhN+vsP5MOTXy0m8HJxebM=";
+        x86_64-linux = "sha256-+oEQV3VfZu+p/f6Sif9pj2AkaA9+u0M8k+czdlcDLXI=";
+        aarch64-linux = "sha256-FcZfRinOd5KO6VnO9cx6ZQxJJ+KCFfB3Nk2k7zMuVU4";
       }
       .${stdenv.system} or (throw "unsupported system ${stdenv.system}");
 
@@ -80,6 +85,9 @@ buildBazelPackage rec {
 
       # bump rules_rust to support newer Rust
       ./0004-nixpkgs-bump-rules_rust-to-0.60.0.patch
+
+      # pin Go SDK downloads so the deps hash doesn't drift on every Go release
+      ./0005-nixpkgs-pin-go-sdk-downloads.patch
     ];
     postPatch = ''
       chmod -R +w .
diff --git a/pkgs/by-name/es/esdm/package.nix b/pkgs/by-name/es/esdm/package.nix
index 2092cf4f8585..57f1b2e2749e 100644
--- a/pkgs/by-name/es/esdm/package.nix
+++ b/pkgs/by-name/es/esdm/package.nix
@@ -18,22 +18,31 @@
   # A brief explanation is given.
 
   # general options
-  selinux ? true, # enable selinux support
-  fips140 ? true, # enable FIPS 140 checksum support
+  selinux ? false, # enable selinux support
+  fips140 ? false, # enable FIPS 140 checksum support
   ais2031 ? true, # set the seeding strategy to be compliant with AIS 20/31
   sp80090c ? true, # set compliance with NIST SP800-90C
   cryptoBackend ? "botan", # set backend for hash and drbg operations
   linuxDevFiles ? true, # enable linux /dev/random and /dev/urandom support
   linuxGetRandom ? true, # enable linux getrandom support
   openSSLRandProvider ? true, # build ESDM provider for OpenSSL 3.x
-  maxThreads ? 1024, # number of RPC handler threads
+  maxThreads ? 64, # number of RPC handler threads
   validationHelpers ? true, # used to analyze entropy output from esdm_es
   numAuxPools ? 128, # use multiple hash pools for e.g. smartcard input
-  serverTermOnSignal ? false, # use select with timeout in server watch loop
+  auxHasFullEntropy ? false, # is already conditioned data inserted into aux pool?
+
+  # DRNG-related options
+  drngReseedThresholdBits ? lib.fromHexString "0xffffffff",
+  drngMaxReseedBits ? lib.fromHexString "0xffffffff",
 
   # entropy sources
   esJitterRng ? true, # enable support for the entropy source: jitter rng (running in user space)
   esJitterRngEntropyRate ? 256, # amount of entropy to account for jitter rng source
+  esJitterRngNtg1 ? false, # configures jitterentropy NTG.1 mode
+  esJitterRngAllCaches ? false, # use all caches in calculating size of memory buffer?
+  esJitterRngMaxMem ? -1, # set static maximum size of memory buffer, -1 disables it
+  esJitterRngHashLoopCount ? -1, # set increased hashloop count, -1 disables it
+  esJitterRngOsr ? 3, # set larger oversampling rate if necessary, (default 3)
   esJitterRngEntropyBlocks ? 128, # number of cached entropy blocks for jitterentropy
   esJitterRngKernel ? false, # enable support for the entropy source: jitter rng (running in kernel space)
   esJitterRngKernelEntropyRate ? 256, # amount of entropy to account for kernel jitter rng source
@@ -41,6 +50,8 @@
   esCPUEntropyRate ? 256, # amount of entropy to account for cpu rng source
   esKernel ? false, # enable support for the entropy source: kernel-based entropy
   esKernelEntropyRate ? 256, # amount of entropy to account for kernel-based source
+  esTPM2 ? true, # enable support for the entropy source: TPM-based entropy
+  esTPM2EntropyRate ? 256, # amount of entropy to account for TPM-based source
   esIRQ ? false, # enable support for the entropy source: interrupt-based entropy
   esIRQEntropyRate ? 256, # amount of entropy to account for interrupt-based source (only set irq XOR sched != 0)
   esSched ? false, # enable support for the entropy source: scheduler-based entropy
@@ -50,20 +61,20 @@
 
   # kernel seeding
   linuxKernelReseedInterval ? 60, # how often to push entropy into Linux kernel, iff seeder service is started
-  linuxKernelReseedEntropyRate ? 256, # how many bits to account on kernel (re-)seeding
+  linuxKernelReseedEntropyRate ? 512, # how many bits to account on kernel (re-)seeding
 }:
 
 assert cryptoBackend == "openssl" || cryptoBackend == "botan";
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "esdm";
-  version = "1.2.1";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner = "smuellerDD";
     repo = "esdm";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-41vc5mB2MiQJu0HXFzSjiudlu1sRj2IP8FcFPQfu5uo=";
+    hash = "sha256-0s9YOqa+sn0rk5YoMWZczO1TB5/wpbFsdkaVWFf4ipI=";
   };
 
   nativeBuildInputs = [
@@ -89,13 +100,18 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonBool "sp80090c" sp80090c)
     (lib.mesonEnable "node" true) # multiple DRNGs
     (lib.mesonEnable "systemd" true) # systemd notify and socket support
-    (lib.mesonOption "threading_max_threads" (toString maxThreads))
+    (lib.mesonOption "threading_max_worker_threads" (toString maxThreads))
     (lib.mesonOption "crypto_backend" cryptoBackend)
     (lib.mesonEnable "linux-devfiles" linuxDevFiles)
     (lib.mesonEnable "linux-getrandom" linuxGetRandom)
     (lib.mesonEnable "es_jent" esJitterRng)
     (lib.mesonOption "es_jent_entropy_rate" (toString esJitterRngEntropyRate))
     (lib.mesonOption "es_jent_entropy_blocks" (toString esJitterRngEntropyBlocks))
+    (lib.mesonEnable "es_jent_ntg1" esJitterRngNtg1)
+    (lib.mesonEnable "es_jent_all_caches" esJitterRngAllCaches)
+    (lib.mesonOption "es_jent_max_mem" (toString esJitterRngMaxMem))
+    (lib.mesonOption "es_jent_hash_loop_count" (toString esJitterRngHashLoopCount))
+    (lib.mesonOption "es_jent_osr" (toString esJitterRngOsr))
     (lib.mesonEnable "es_jent_kernel" esJitterRngKernel)
     (lib.mesonOption "es_jent_kernel_entropy_rate" (toString esJitterRngKernelEntropyRate))
     (lib.mesonEnable "es_cpu" esCPU)
@@ -108,13 +124,17 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonOption "es_sched_entropy_rate" (toString esSchedEntropyRate))
     (lib.mesonEnable "es_hwrand" esHwrand)
     (lib.mesonOption "es_hwrand_entropy_rate" (toString esHwrandEntropyRate))
+    (lib.mesonEnable "es_tpm2" esTPM2)
+    (lib.mesonOption "es_tpm2_entropy_rate" (toString esTPM2EntropyRate))
     (lib.mesonEnable "selinux" selinux)
     (lib.mesonEnable "openssl-rand-provider" openSSLRandProvider)
     (lib.mesonOption "linux-reseed-interval" (toString linuxKernelReseedInterval))
     (lib.mesonOption "linux-reseed-entropy-count" (toString linuxKernelReseedEntropyRate))
     (lib.mesonEnable "validation-helpers" validationHelpers)
     (lib.mesonOption "num-aux-pools" (toString numAuxPools))
-    (lib.mesonBool "esdm-server-term-on-signal" serverTermOnSignal)
+    (lib.mesonEnable "aux-has-full-entropy" auxHasFullEntropy)
+    (lib.mesonOption "drng_reseed_threshold_bits" (toString drngReseedThresholdBits))
+    (lib.mesonOption "drng_max_reseed_bits" (toString drngMaxReseedBits))
   ];
 
   postFixup = lib.optionals fips140 ''
@@ -125,6 +145,8 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = true;
 
   strictDeps = true;
+  __structuredAttrs = true;
+
   mesonBuildType = "release";
 
   meta = {
diff --git a/pkgs/by-name/et/etherpad-lite/package.nix b/pkgs/by-name/et/etherpad-lite/package.nix
index 918957c3dc19..b6736566c593 100644
--- a/pkgs/by-name/et/etherpad-lite/package.nix
+++ b/pkgs/by-name/et/etherpad-lite/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "etherpad-lite";
-  version = "2.6.1";
+  version = "2.7.2";
 
   src = fetchFromGitHub {
     owner = "ether";
     repo = "etherpad-lite";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KzkrJv9eBzzt9PSJGhzC0lxCOfQImSTHcTVlea8HV70=";
+    hash = "sha256-8DCgbfp3ttpMTXS9SNkN1R63LZHaklsNHViRhmWVFuk=";
   };
 
   patches = [
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_9;
     fetcherVersion = 3;
-    hash = "sha256-y5T7yerCK9MtTri3eZ+Iih7/DK9IMDC+d7ej746g47E=";
+    hash = "sha256-2nKpmGxC+KVg0oF0BsswS9L84QxzpRF7NvKyqyQ7WJM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fl/flake-du/package.nix b/pkgs/by-name/fl/flake-du/package.nix
new file mode 100644
index 000000000000..5f722207eea3
--- /dev/null
+++ b/pkgs/by-name/fl/flake-du/package.nix
@@ -0,0 +1,29 @@
+{
+  lib,
+  rustPlatform,
+  fetchgit,
+}:
+let
+  version = "0.1.0";
+in
+rustPlatform.buildRustPackage {
+  pname = "flake-du";
+  inherit version;
+
+  src = fetchgit {
+    url = "https://github.com/kmein/flake-du";
+    rev = "v${version}";
+    sha256 = "sha256-+YfQRi6QE4xNUcIcEc9HWIbnin6GCVp4SYrjvBwksys=";
+  };
+
+  cargoHash = "sha256-DYVT9jM9WcgoVSOnoUIWWR9EmNywR1f4xZOAzkbNkCk=";
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "Tool for managing flake inputs with disk usage insights";
+    license = lib.licenses.mit;
+    homepage = "https://github.com/kmein/flake-du";
+    maintainers = [ lib.maintainers.kmein ];
+  };
+}
diff --git a/pkgs/by-name/gi/gitkraken/package.nix b/pkgs/by-name/gi/gitkraken/package.nix
index 33dae3c156f5..41f8c9b178d7 100644
--- a/pkgs/by-name/gi/gitkraken/package.nix
+++ b/pkgs/by-name/gi/gitkraken/package.nix
@@ -56,24 +56,24 @@
 
 let
   pname = "gitkraken";
-  version = "12.0.1";
+  version = "12.1.0";
 
   throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
 
   srcs = {
     x86_64-linux = fetchzip {
       url = "https://api.gitkraken.dev/releases/production/linux/x64/${version}/gitkraken-amd64.tar.gz";
-      hash = "sha256-Tn4j9zmH8hr5rKaPFgox/LopTvEWghnPGf4JiM8y86k=";
+      hash = "sha256-HLo5cNkA59JBZ43Aea5W4vj2X4UDN0NtaB4VEjDQwvM=";
     };
 
     x86_64-darwin = fetchzip {
       url = "https://api.gitkraken.dev/releases/production/darwin/x64/${version}/GitKraken-v${version}.zip";
-      hash = "sha256-bKbqu94JPI4VOPcphkw/vAN/ihb5wc5qh/qaw7bweG0=";
+      hash = "sha256-SzGcT/2X4OXgtUqKCfE9UkKJsBCrKqj++vTdz2Rqfrc=";
     };
 
     aarch64-darwin = fetchzip {
       url = "https://api.gitkraken.dev/releases/production/darwin/arm64/${version}/GitKraken-v${version}.zip";
-      hash = "sha256-h2RSdK75i1NbchGauDSvaYJyz39Bncgf+RQIfRdDQuE=";
+      hash = "sha256-WYhSqRR0bHB1CKGbwSYHWvaCa/GpZCO6X4q6GMLuFpI=";
     };
   };
 
diff --git a/pkgs/by-name/gi/gitlab-runner/package.nix b/pkgs/by-name/gi/gitlab-runner/package.nix
index dc94606246a4..da2c49252ccf 100644
--- a/pkgs/by-name/gi/gitlab-runner/package.nix
+++ b/pkgs/by-name/gi/gitlab-runner/package.nix
@@ -38,26 +38,30 @@ buildGoModule (finalAttrs: {
     substituteInPlace commands/helpers/file_archiver_test.go \
       --replace-fail "func TestCacheArchiverAddingUntrackedFiles" "func OFF_TestCacheArchiverAddingUntrackedFiles" \
       --replace-fail "func TestCacheArchiverAddingUntrackedUnicodeFiles" "func OFF_TestCacheArchiverAddingUntrackedUnicodeFiles"
-    rm shells/abstract_test.go
 
-    # No writable developer environment
+    # Needs `make development_setup` (git repo at tmp/gitlab-test/)
     rm common/build_settings_test.go
     rm common/build_test.go
     rm executors/custom/custom_test.go
 
-    # No Docker during build
-    rm executors/docker/docker_test.go
-    rm executors/docker/services_test.go
-    rm executors/docker/terminal_test.go
-    rm helpers/docker/auth/auth_test.go
-
-    # No Kubernetes during build
-    rm executors/kubernetes/feature_test.go
+    # Timing-dependent test causes spurious failures on Hydra.
+    # Might be fixed upstream in this MR: https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6623
+    # Try dropping it on next major version bump
+    rm executors/kubernetes/internal/watchers/pod_test.go
+  ''
+  + lib.optionalString (!stdenv.buildPlatform.isx86_64) ''
+    # Kubernetes tests actually work fine inside the network sandbox (they don't
+    # expect real Kubernetes), but they fail on aarch64-linux because their
+    # mocks expect x86_64
     rm executors/kubernetes/kubernetes_test.go
     rm executors/kubernetes/overwrites_test.go
   ''
   + lib.optionalString stdenv.buildPlatform.isDarwin ''
-    # Invalid bind arguments break Unix socket tests
+    # Darwin's sandbox blocks sendfile(2) during local HTTP PUT uploads
+    substituteInPlace commands/helpers/cache_archiver_test.go \
+      --replace-fail "func TestUploadExistingArchiveIfNeeded" "func OFF_TestUploadExistingArchiveIfNeeded"
+
+    # Invalid bind arguments break Unix socket tests.
     substituteInPlace commands/wrapper_test.go \
       --replace-fail "func TestRunnerWrapperCommand_createListener" "func OFF_TestRunnerWrapperCommand_createListener"
 
@@ -68,6 +72,10 @@ buildGoModule (finalAttrs: {
       --replace-fail "func TestClientInvalidSSL" "func OFF_TestClientInvalidSSL"
   '';
 
+  postPatch = ''
+    patchShebangs --build helpers/docker/auth/testdata/docker-credential-bin.sh
+  '';
+
   excludedPackages = [
     # Nested dependency Go module, used with go.mod replace directive
     #
diff --git a/pkgs/by-name/go/google-lighthouse/package.nix b/pkgs/by-name/go/google-lighthouse/package.nix
index ed4917caf5c0..64ea99c1681b 100644
--- a/pkgs/by-name/go/google-lighthouse/package.nix
+++ b/pkgs/by-name/go/google-lighthouse/package.nix
@@ -13,18 +13,18 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "google-lighthouse";
-  version = "13.1.0";
+  version = "13.2.0";
 
   src = fetchFromGitHub {
     owner = "GoogleChrome";
     repo = "lighthouse";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nSXIA1yRwcetv9u/UJ445iDP3i+dX0rhzozxzQvXkf0=";
+    hash = "sha256-D/HQP34/EGJLWgRneiYP8eByUNSjKwQQLD0FScgYAVo=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-naB9TOFiggKNiJcXkHF5VbvsLtNAYQD84/pL//76fuE=";
+    hash = "sha256-DKFPnSj3jujCWb+KitgTZaIJB8XkHJBoncaNvzcuIVU=";
   };
 
   yarnBuildScript = "build-report";
diff --git a/pkgs/by-name/in/ink/package.nix b/pkgs/by-name/in/ink/package.nix
index 502c5b4b208c..f986dc11295e 100644
--- a/pkgs/by-name/in/ink/package.nix
+++ b/pkgs/by-name/in/ink/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchDebianPatch,
   libinklevel,
 }:
 
@@ -14,6 +15,16 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "1fk0b8vic04a3i3vmq73hbk7mzbi57s8ks6ighn3mvr6m2v8yc9d";
   };
 
+  patches = [
+    (fetchDebianPatch {
+      pname = "ink";
+      version = "0.5.3";
+      debianRevision = "7";
+      patch = "gcc15.patch";
+      hash = "sha256-2Qn8jDAY/ub8MEiG68J7nEnz9GQ/8ScF9nweTkuCibQ=";
+    })
+  ];
+
   buildInputs = [
     libinklevel
   ];
diff --git a/pkgs/by-name/m1/m1n1/package.nix b/pkgs/by-name/m1/m1n1/package.nix
index 0e2d9009da07..ba9320acbde9 100644
--- a/pkgs/by-name/m1/m1n1/package.nix
+++ b/pkgs/by-name/m1/m1n1/package.nix
@@ -151,7 +151,7 @@ stdenv.mkDerivation (finalAttrs: {
       bsd3
       asl20
     ];
-    maintainers = [ ];
-    platforms = lib.platforms.aarch64;
+    maintainers = with lib.maintainers; [ sempiternal-aurora ];
+    platforms = [ "aarch64-linux" ];
   };
 })
diff --git a/pkgs/by-name/ma/mangohud/package.nix b/pkgs/by-name/ma/mangohud/package.nix
index 36d24d92a496..1cf07b1fc5eb 100644
--- a/pkgs/by-name/ma/mangohud/package.nix
+++ b/pkgs/by-name/ma/mangohud/package.nix
@@ -48,16 +48,16 @@ assert lib.assertMsg (mangoappSupport -> x11Support) "mangoappSupport requires x
 let
   # Derived from subprojects/imgui.wrap
   imgui = rec {
-    version = "1.89.9";
+    version = "1.91.6";
     src = fetchFromGitHub {
       owner = "ocornut";
       repo = "imgui";
       tag = "v${version}";
-      hash = "sha256-0k9jKrJUrG9piHNFQaBBY3zgNIKM23ZA879NY+MNYTU=";
+      hash = "sha256-CLS26CRzzY4vUBgILjSQVvziHMyPGK4fwwcLZcOAzPw=";
     };
     patch = fetchurl {
-      url = "https://wrapdb.mesonbuild.com/v2/imgui_${version}-1/get_patch";
-      hash = "sha256-myEpDFl9dr+NTus/n/oCSxHZ6mxh6R1kjMyQtChD1YQ=";
+      url = "https://wrapdb.mesonbuild.com/v2/imgui_${version}-3/get_patch";
+      hash = "sha256-L3l3EUugfQZVmq+IkKkqTr0lGGWS1ER5VGBaryJEY00=";
     };
   };
 
@@ -78,32 +78,40 @@ let
 
   # Derived from subprojects/vulkan-headers.wrap
   vulkan-headers = rec {
-    version = "1.2.158";
+    version = "1.4.346";
     src = fetchFromGitHub {
       owner = "KhronosGroup";
       repo = "Vulkan-Headers";
       tag = "v${version}";
-      hash = "sha256-5uyk2nMwV1MjXoa3hK/WUeGLwpINJJEvY16kc5DEaks=";
-    };
-    patch = fetchurl {
-      url = "https://wrapdb.mesonbuild.com/v2/vulkan-headers_${version}-2/get_patch";
-      hash = "sha256-hgNYz15z9FjNHoj4w4EW0SOrQh1c4uQSnsOOrt2CDhc=";
+      hash = "sha256-JTBW5CF5hlHWkhCjjRd08hpoAarB5W3FJbHzhQM4YFs=";
     };
   };
+
+  # Derived from subprojects/vulkan-headers.wrap
+  vulkan-utility-libraries = rec {
+    version = "1.4.346";
+    src = fetchFromGitHub {
+      owner = "KhronosGroup";
+      repo = "Vulkan-Utility-Libraries";
+      tag = "v${version}";
+      hash = "sha256-FWZe6NdhLmI/3bm3OIK646vkWkIQ5xmBa4jlSVHSnDs=";
+    };
+  };
+
   libXNVCtrl = linuxPackages.nvidia_x11.settings.libXNVCtrl;
   mangohud32 = pkgsi686Linux.mangohud;
 
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mangohud";
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "flightlessmango";
     repo = "MangoHud";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-BZ3R7D2zOlg69rx4y2FzzjpXuPOv913TOz9kSvRN+Wg=";
+    hash = "sha256-fzfSYyz2NMo61Yd7boRxdtbi/KTNbSos0qmHf2/mikk=";
   };
 
   outputs = [
@@ -119,6 +127,7 @@ stdenv.mkDerivation (finalAttrs: {
       cp -R --no-preserve=mode,ownership ${imgui.src} imgui-${imgui.version}
       cp -R --no-preserve=mode,ownership ${implot.src} implot-${implot.version}
       cp -R --no-preserve=mode,ownership ${vulkan-headers.src} Vulkan-Headers-${vulkan-headers.version}
+      cp -R --no-preserve=mode,ownership ${vulkan-utility-libraries.src} Vulkan-Utility-Libraries-${vulkan-utility-libraries.version}
     )
   '';
 
@@ -163,7 +172,8 @@ stdenv.mkDerivation (finalAttrs: {
       cd subprojects
       unzip ${imgui.patch}
       unzip ${implot.patch}
-      unzip ${vulkan-headers.patch}
+      cp -R --no-preserve=mode,ownership packagefiles/vulkan-headers/* Vulkan-Headers-${vulkan-headers.version}
+      cp -R --no-preserve=mode,ownership packagefiles/vulkan-utility-libraries/* ${vulkan-utility-libraries.src} Vulkan-Utility-Libraries-${vulkan-utility-libraries.version}
     )
   '';
 
diff --git a/pkgs/by-name/ma/matrix-authentication-service/package.nix b/pkgs/by-name/ma/matrix-authentication-service/package.nix
index 6a6a22e82b9e..0c5aaf652560 100644
--- a/pkgs/by-name/ma/matrix-authentication-service/package.nix
+++ b/pkgs/by-name/ma/matrix-authentication-service/package.nix
@@ -18,21 +18,21 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "matrix-authentication-service";
-  version = "1.15.0";
+  version = "1.16.0";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "matrix-authentication-service";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-q3MtMRdvuL0olnqvqK8uWeFCT7UpKjZN4zz9ZFlyGd4=";
+    hash = "sha256-pyL2QhvycaGBYgelsHK5Ces195Z1aY2XZyecsPXO/X4=";
   };
 
-  cargoHash = "sha256-FV4ZKR6lq8b5PMj+mZ+/RBWLmoGc6WuAXw00+PGJUi8=";
+  cargoHash = "sha256-gvG6+strULIewJgFdGg3fJ2mjUVjgi9/Q7pDredYuiU=";
 
   npmDeps = fetchNpmDeps {
     name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
     src = "${finalAttrs.src}/${finalAttrs.npmRoot}";
-    hash = "sha256-OA7T8dTWEb8QiiRBx1A/R8H2Bu/xv3RFr8K9IVU3674=";
+    hash = "sha256-FevzqirT/GyT8urQ79AtJi+q1zcwn73AyiJTf/B9cG0=";
   };
 
   npmRoot = "frontend";
diff --git a/pkgs/by-name/mi/mirrord/manifest.json b/pkgs/by-name/mi/mirrord/manifest.json
index d5f7d69c6140..afb56d1c4d5d 100644
--- a/pkgs/by-name/mi/mirrord/manifest.json
+++ b/pkgs/by-name/mi/mirrord/manifest.json
@@ -1,21 +1,21 @@
 {
-  "version": "3.206.1",
+  "version": "3.209.1",
   "assets": {
     "x86_64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.206.1/mirrord_linux_x86_64",
-      "hash": "sha256-RWhqtP8gVAz2H6OU/ZSiL9kBD0rMs/NfsaNnDzjfriw="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.209.1/mirrord_linux_x86_64",
+      "hash": "sha256-XXSU13UhffwgIIdfPW3vjPOcvtrggs2bKpsMkwUdv8Y="
     },
     "aarch64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.206.1/mirrord_linux_aarch64",
-      "hash": "sha256-3uzh324H6c43Xcx49ynh6S540G3cxBXQL+Jv3SXaY2Q="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.209.1/mirrord_linux_aarch64",
+      "hash": "sha256-RiQsrGAOfRe8kRmNF8imJjP+ZktUpUuMvNGmMI0fboc="
     },
     "aarch64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.206.1/mirrord_mac_universal",
-      "hash": "sha256-jcTlTcCD3hi74e9a87WmiqpnKyLifxWWDu5Pbw9qQOY="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.209.1/mirrord_mac_universal",
+      "hash": "sha256-Lkqk9CgOnMFMUut6JRU5V4IimI1ys/iVX1M5DxOtOMk="
     },
     "x86_64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.206.1/mirrord_mac_universal",
-      "hash": "sha256-jcTlTcCD3hi74e9a87WmiqpnKyLifxWWDu5Pbw9qQOY="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.209.1/mirrord_mac_universal",
+      "hash": "sha256-Lkqk9CgOnMFMUut6JRU5V4IimI1ys/iVX1M5DxOtOMk="
     }
   }
 }
diff --git a/pkgs/by-name/mo/moonlight/package.nix b/pkgs/by-name/mo/moonlight/package.nix
index fc5d45400dc7..d5fc3de191b8 100644
--- a/pkgs/by-name/mo/moonlight/package.nix
+++ b/pkgs/by-name/mo/moonlight/package.nix
@@ -14,13 +14,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "moonlight";
-  version = "2026.4.0";
+  version = "2026.5.0";
 
   src = fetchFromGitHub {
     owner = "moonlight-mod";
     repo = "moonlight";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jbIdFHPomN0zD2I6UoClofvSNVdOqpf0nM1s5pbn7ew=";
+    hash = "sha256-RZ7fmgzENSt9bXuhPWW9wBaJ1dss/b23R1VS+tEU7io=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/na/nats-server/package.nix b/pkgs/by-name/na/nats-server/package.nix
index 00e3e431a306..33fdbf837a49 100644
--- a/pkgs/by-name/na/nats-server/package.nix
+++ b/pkgs/by-name/na/nats-server/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "nats-server";
-  version = "2.12.8";
+  version = "2.14.0";
 
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = "nats-server";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-iJMF6OyfukTYOwET+wxFpJZ8R0b7/JMEZns5dAkx5DE=";
+    hash = "sha256-S4IbxeiagiAXHidXBXniHKEUGnYaPWoGFNk2DPOkSNo=";
   };
 
-  vendorHash = "sha256-4idiVBtE+e2jf9uS3at+5+C3dnLxjtsLJIBC8zye5Pg=";
+  vendorHash = "sha256-oEYc8cT6OUQ7imbfDskIxnSNhHWpvSpMCxPdS6O2oZA=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/nv/nvidia-mig-parted/package.nix b/pkgs/by-name/nv/nvidia-mig-parted/package.nix
index c6c27f49aa56..7757ddad5851 100644
--- a/pkgs/by-name/nv/nvidia-mig-parted/package.nix
+++ b/pkgs/by-name/nv/nvidia-mig-parted/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "nvidia-mig-parted";
-  version = "0.14.0";
+  version = "0.14.1";
 
   src = fetchFromGitHub {
     owner = "NVIDIA";
     repo = "mig-parted";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-b+/Rz1Lj+Ef7fIw4g2el8td982SGKXb0iPboP53XGKQ=";
+    hash = "sha256-05WbIEvHN/CAvd5ex4I8FZx0NreIg5QDOgXmAda/mzc=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ol/ollama/package.nix b/pkgs/by-name/ol/ollama/package.nix
index 52ccb92dd010..f8d770154a24 100644
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -141,13 +141,13 @@ let
 in
 goBuild (finalAttrs: {
   pname = "ollama";
-  version = "0.23.0";
+  version = "0.23.1";
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VYaFCSqhIlJPJv1SUiNDgSzLqySK3NTfucdWA7IZaAk=";
+    hash = "sha256-19rx+PNCpvRxhVr1+bgqsQIwpZzgdazlCoppxlDKzvE=";
   };
 
   vendorHash = "sha256-Lc1Ktdqtv2VhJQssk8K1UOimeEjVNvDWePE9WkamCos=";
diff --git a/pkgs/by-name/pi/pi-coding-agent/package.nix b/pkgs/by-name/pi/pi-coding-agent/package.nix
index 396540029231..e61574f72bc7 100644
--- a/pkgs/by-name/pi/pi-coding-agent/package.nix
+++ b/pkgs/by-name/pi/pi-coding-agent/package.nix
@@ -10,16 +10,16 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "pi-coding-agent";
-  version = "0.70.5";
+  version = "0.73.0";
 
   src = fetchFromGitHub {
     owner = "badlogic";
     repo = "pi-mono";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Jn+hvS/DIwbwAff+UovdIVnmrb4o8gsC4IR24MnwF1I=";
+    hash = "sha256-oE4zMH5KEH185Vdp0CE221sa9rJJw35jFLlfhTa3Sg4=";
   };
 
-  npmDepsHash = "sha256-MZgcHJdGFGSNgQ26/24iA12FdmO7S5vWv4crSNFhHi0=";
+  npmDepsHash = "sha256-rBlAzAnP9aif1tZ984AO4HftIJsDgLQ+02J3td4jcRg=";
 
   npmWorkspace = "packages/coding-agent";
 
diff --git a/pkgs/by-name/pi/piglit/package.nix b/pkgs/by-name/pi/piglit/package.nix
index a761cf3c950a..b9b4c0bfdb3d 100644
--- a/pkgs/by-name/pi/piglit/package.nix
+++ b/pkgs/by-name/pi/piglit/package.nix
@@ -29,14 +29,14 @@
 
 stdenv.mkDerivation {
   pname = "piglit";
-  version = "unstable-2025-04-15";
+  version = "unstable-2026-05-04";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "mesa";
     repo = "piglit";
-    rev = "d06f7bac988e67db53cbc05dc0b096b00856ab93";
-    hash = "sha256-bH9NjLEldlZwylq7S0q2vC5IQhUej0xZ6wD+mrWBK5A=";
+    rev = "1bb2910c3fced64396feddd205e356d80e5ff7d9";
+    hash = "sha256-/3OQeZiK7fHfPpSlFtbW7DLEFV3YFBL1cLMndXyxwYs=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/pl/pleroma/package.nix b/pkgs/by-name/pl/pleroma/package.nix
index 4c99d73b22f7..ffe434bf14f9 100644
--- a/pkgs/by-name/pl/pleroma/package.nix
+++ b/pkgs/by-name/pl/pleroma/package.nix
@@ -232,7 +232,6 @@ beamPackages.mixRelease rec {
     maintainers = with lib.maintainers; [
       picnoir
       kloenk
-      yayayayaka
     ];
     platforms = lib.platforms.unix;
   };
diff --git a/pkgs/by-name/po/pomerium/0001-envoy-allow-specification-of-external-binary.patch b/pkgs/by-name/po/pomerium/0001-envoy-allow-specification-of-external-binary.patch
deleted file mode 100644
index 8356cdc583a2..000000000000
--- a/pkgs/by-name/po/pomerium/0001-envoy-allow-specification-of-external-binary.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From 640d11fae5bcf1fa8c1a54facbe168a256cacc1b Mon Sep 17 00:00:00 2001
-From: Morgan Helton <mhelton@gmail.com>
-Date: Sun, 26 May 2024 12:17:01 -0500
-Subject: [PATCH] envoy: allow specification of external binary
-
----
- pkg/envoy/envoy.go | 17 +++++++++++++----
- 1 file changed, 13 insertions(+), 4 deletions(-)
-
-diff --git a/pkg/envoy/envoy.go b/pkg/envoy/envoy.go
-index 85c725629..4a726a44b 100644
---- a/pkg/envoy/envoy.go
-+++ b/pkg/envoy/envoy.go
-@@ -8,10 +8,10 @@ import (
- 	"errors"
- 	"fmt"
- 	"io"
-+	"io/fs"
- 	"net"
- 	"net/http"
- 	"net/url"
- 	"os"
- 	"os/exec"
--	"path"
- 	"path/filepath"
-@@ -44,6 +44,11 @@ const (
- 	configFileName = "envoy-config.yaml"
- )
-
-+var OverrideEnvoyPath = ""
-+
-+const workingDirectoryName = ".pomerium-envoy"
-+const embeddedEnvoyPermissions fs.FileMode = 0o700
-+
- // A Server is a pomerium proxy implemented via envoy.
- type Server struct {
- 	ServerOptions
-@@ -100,14 +105,17 @@ func NewServer(
- 		log.Ctx(ctx).Debug().Err(err).Msg("couldn't preserve RLIMIT_NOFILE before starting Envoy")
- 	}
-
--	envoyPath, err := Extract()
-+	envoyPath := OverrideEnvoyPath
-+	wd := filepath.Join(os.TempDir(), workingDirectoryName)
-+
-+	err := os.MkdirAll(wd, embeddedEnvoyPermissions)
- 	if err != nil {
--		return nil, fmt.Errorf("extracting envoy: %w", err)
-+		return nil, fmt.Errorf("error creating temporary working directory for envoy: %w", err)
- 	}
-
- 	srv := &Server{
- 		ServerOptions:        options,
--		wd:                   path.Dir(envoyPath),
-+		wd:                   wd,
- 		builder:              builder,
- 		grpcPort:             src.GetConfig().GRPCPort,
- 		httpPort:             src.GetConfig().HTTPPort,
---
-2.49.0
-
diff --git a/pkgs/by-name/po/pomerium/package.nix b/pkgs/by-name/po/pomerium/package.nix
index dc67aa519332..a93e9924255a 100644
--- a/pkgs/by-name/po/pomerium/package.nix
+++ b/pkgs/by-name/po/pomerium/package.nix
@@ -1,9 +1,9 @@
 {
   buildGoModule,
   buildNpmPackage,
+  runCommand,
   fetchFromGitHub,
   lib,
-  envoy,
   nixosTests,
   pomerium-cli,
 }:
@@ -15,9 +15,7 @@ let
     id
     mapAttrsToList
     ;
-in
-buildGoModule rec {
-  pname = "pomerium";
+
   version = "0.32.6";
   src = fetchFromGitHub {
     owner = "pomerium";
@@ -25,13 +23,50 @@ buildGoModule rec {
     rev = "v${version}";
     hash = "sha256-VwmjuXlYsh2dGKf7ux8DyLZec7xMISuQ7SSb9+LwzfU=";
   };
-
   vendorHash = "sha256-b4H7gAMG7DXEbvkZFsoEZrKpuvPW0vkfv1qqBPBaGAM=";
 
+  getEnvoy = buildGoModule {
+    pname = "pomerium-get-envoy";
+    inherit src version vendorHash;
+
+    subPackages = [
+      "pkg/envoy/get-envoy"
+    ];
+
+    # get-envoy's envoy version is pinned via pkg/envoy/envoyversion, which
+    # relies on a specific version of github.com/pomerium/envoy-custom as a Go module,
+    # and then fetches that version's release binaries from GHCR.
+  };
+in
+buildGoModule (finalAttrs: {
+  pname = "pomerium";
+  inherit src version vendorHash;
+
+  envoyBinaries =
+    runCommand "pomerium-envoy-binaries"
+      {
+        nativeBuildInputs = [ getEnvoy ];
+
+        outputHashAlgo = "sha256";
+        outputHashMode = "recursive";
+        outputHash = "sha256-i2DuOx+fSCwTKavf6zvuRd1AKbk4igrzy2AXinDkyrI=";
+
+        meta = {
+          homepage = "https://github.com/pomerium/envoy-custom";
+          sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+        };
+      }
+      ''
+        mkdir $out
+        cd $out
+        get-envoy
+        chmod +x envoy-darwin-amd64 envoy-darwin-arm64 envoy-linux-amd64 envoy-linux-arm64
+      '';
+
   ui = buildNpmPackage {
     pname = "pomerium-ui";
-    inherit version;
-    src = "${src}/ui";
+    inherit (finalAttrs) version;
+    src = "${finalAttrs.src}/ui";
 
     npmDepsHash = "sha256-2fzINp3LBPHPJlzJnUggPWUZHrjuX9TYPD2XvioonSw=";
 
@@ -46,24 +81,16 @@ buildGoModule rec {
     "cmd/pomerium"
   ];
 
-  # patch pomerium to allow use of external envoy
-  patches = [
-    ./0001-envoy-allow-specification-of-external-binary.patch
-  ];
-
   ldflags =
     let
       # Set a variety of useful meta variables for stamping the build with.
       setVars = {
         "github.com/pomerium/pomerium/internal/version" = {
-          Version = "v${version}";
+          Version = "v${finalAttrs.version}";
           BuildMeta = "nixpkgs";
           ProjectName = "pomerium";
           ProjectURL = "github.com/pomerium/pomerium";
         };
-        "github.com/pomerium/pomerium/pkg/envoy" = {
-          OverrideEnvoyPath = "${envoy}/bin/envoy";
-        };
       };
       concatStringsSpace = list: concatStringsSep " " list;
       mapAttrsToFlatList = fn: list: concatMap id (mapAttrsToList fn list);
@@ -79,28 +106,11 @@ buildGoModule rec {
     ];
 
   preBuild = ''
-    # Replace embedded envoy with nothing.
-    # We set OverrideEnvoyPath above, so rawBinary should never get looked at
-    # but we still need to set a checksum/version.
-    rm pkg/envoy/files/files_{darwin,linux}*.go
-    cat <<EOF >pkg/envoy/files/files_external.go
-    package files
-
-    import _ "embed" // embed
-
-    var rawBinary []byte
-
-    //go:embed envoy.sha256
-    var rawChecksum string
-
-    //go:embed envoy.version
-    var rawVersion string
-    EOF
-    sha256sum '${envoy}/bin/envoy' > pkg/envoy/files/envoy.sha256
-    echo '${envoy.version}' > pkg/envoy/files/envoy.version
+    # Insert embedded envoy.
+    cp -r ${finalAttrs.envoyBinaries}/* pkg/envoy/files
 
     # put the built UI files where they will be picked up as part of binary build
-    cp -r ${ui}/* ui/dist
+    cp -r ${finalAttrs.ui}/* ui/dist
   '';
 
   installPhase = ''
@@ -129,4 +139,4 @@ buildGoModule rec {
       "aarch64-linux"
     ];
   };
-}
+})
diff --git a/pkgs/by-name/rt/rtl_fm_streamer/package.nix b/pkgs/by-name/rt/rtl_fm_streamer/package.nix
index 435744ea7666..777e927c92e5 100644
--- a/pkgs/by-name/rt/rtl_fm_streamer/package.nix
+++ b/pkgs/by-name/rt/rtl_fm_streamer/package.nix
@@ -30,6 +30,10 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail "cmake_minimum_required(VERSION 2.6)" "cmake_minimum_required(VERSION 3.10)"
   '';
 
+  patches = [
+    ./use-stdbool.patch
+  ];
+
   nativeBuildInputs = [
     cmake
     pkg-config
diff --git a/pkgs/by-name/rt/rtl_fm_streamer/use-stdbool.patch b/pkgs/by-name/rt/rtl_fm_streamer/use-stdbool.patch
new file mode 100644
index 000000000000..4e5dd2b70180
--- /dev/null
+++ b/pkgs/by-name/rt/rtl_fm_streamer/use-stdbool.patch
@@ -0,0 +1,18 @@
+Drop the hand-rolled bool enum: `bool`, `true`, and `false` are reserved
+keywords in C23 (the default since GCC 15), so the typedef no longer compiles.
+
+--- a/src/rtl_fm_streamer.c
++++ b/src/rtl_fm_streamer.c
+@@ -100,11 +100,7 @@
+
+ #define DEFAULT_PORT_NUMBER "2346"
+
+-typedef enum
+-{
+-    false = 0,
+-    true
+-}bool;
++#include <stdbool.h>
+
+ struct dongle_state
+ {
diff --git a/pkgs/by-name/ru/rustlens/package.nix b/pkgs/by-name/ru/rustlens/package.nix
new file mode 100644
index 000000000000..a83344c31e30
--- /dev/null
+++ b/pkgs/by-name/ru/rustlens/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  openssl,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "rustlens";
+  version = "0.2.1";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "yashksaini-coder";
+    repo = "Rustlens";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-BYROEUBa9RZXuJbNbKUbWXu9mPYIuAyO6JwPlNmj244=";
+  };
+
+  cargoHash = "sha256-WvUu2M2WFLo5Ve+ER7vpl7q/cpPR4g1vY4z9hRl3On0=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+  ];
+
+  meta = {
+    description = "Rustlens is a terminal-based application for exploring Rust codebases.";
+    homepage = "https://github.com/yashksaini-coder/Rustlens";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ gwg313 ];
+    mainProgram = "rustlens";
+  };
+})
diff --git a/pkgs/by-name/ru/rustnet/package.nix b/pkgs/by-name/ru/rustnet/package.nix
new file mode 100644
index 000000000000..70081d80608e
--- /dev/null
+++ b/pkgs/by-name/ru/rustnet/package.nix
@@ -0,0 +1,70 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+  pkg-config,
+  versionCheckHook,
+  elfutils,
+  zlib,
+  libbpf,
+  libpcap,
+  clangStdenv,
+}:
+let
+  pname = "rustnet";
+  version = "1.3.0";
+in
+rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } {
+  inherit pname version;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "domcyrus";
+    repo = "rustnet";
+    tag = "v${version}";
+    hash = "sha256-E2ItYSnT3WRSgPb5B+HDAlAPPmSLdt8qnE+2TiXHPk8=";
+  };
+
+  cargoHash = "sha256-B1IdFOKYNaLiq6t64mdR3zUUcvojevcV6/nqYGbsbAY=";
+
+  nativeBuildInputs = [
+    pkg-config
+    versionCheckHook
+  ];
+
+  buildInputs = [
+    elfutils
+    libbpf
+    libpcap
+    zlib
+  ];
+
+  # Required for libbpf-sys to build correctly
+  hardeningDisable = [
+    "zerocallusedregs"
+  ];
+
+  # Set environment variables for libbpf-sys
+  env = {
+    LIBBPF_SYS_LIBRARY_PATH = "${libbpf}/lib";
+    LIBBPF_SYS_INCLUDE_PATH = "${libbpf}/include";
+  };
+
+  checkFlags = [
+    "--skip=network::platform::linux::interface_stats::tests::test_get_all_stats"
+    "--skip=network::platform::linux::interface_stats::tests::test_list_interfaces"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "High-performance, cross-platform network monitoring terminal UI tool built with Rust";
+    homepage = "https://github.com/domcyrus/rustnet";
+    changelog = "https://github.com/domcyrus/rustnet/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ dvaerum ];
+    mainProgram = "rustnet";
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/sp/spicedb-zed/package.nix b/pkgs/by-name/sp/spicedb-zed/package.nix
index 74541fb64c27..14efa4ded236 100644
--- a/pkgs/by-name/sp/spicedb-zed/package.nix
+++ b/pkgs/by-name/sp/spicedb-zed/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "zed";
-  version = "1.0.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "authzed";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kF16ZmIOw80esknKJvHYFWrx4FG/kn+Il5xnC1JmAn4=";
+    hash = "sha256-rlTcC2+faNZKvzouGC9nJBBCsDabxozTE/SFbf8YKQ8=";
   };
 
-  vendorHash = "sha256-e/VrFEKVVAAtClAzFw2XV3cWVmto90qzMKVLpZjKZ8o=";
+  vendorHash = "sha256-/nnPVy+pjcgkgJW8630IycmGF4Qq4I01htEDlsWvZbM=";
 
   ldflags = [ "-X 'github.com/jzelinskie/cobrautil/v2.Version=${finalAttrs.src.tag}'" ];
 
diff --git a/pkgs/by-name/xh/xhtml1/package.nix b/pkgs/by-name/xh/xhtml1/package.nix
index 4d13bd1624dc..020abcab5419 100644
--- a/pkgs/by-name/xh/xhtml1/package.nix
+++ b/pkgs/by-name/xh/xhtml1/package.nix
@@ -33,5 +33,6 @@ stdenv.mkDerivation {
     homepage = "https://www.w3.org/TR/xhtml1/";
     description = "DTDs for XHTML 1.0, the Extensible HyperText Markup Language";
     platforms = lib.platforms.unix;
+    license = lib.licenses.w3c-19980720;
   };
 }
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index ee17f813df39..23e80e10348a 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -97,7 +97,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "1.0.0";
+  version = "1.0.1";
 
   outputs = [
     "out"
@@ -110,7 +110,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-D5V0pvL3WCwhcC8dnNKTXRdnFq8LMZZ0/GDjw8xf95g=";
+    hash = "sha256-wru2i6Zu3gnqy3zTpS2jfKaVRTVuhI0yaM2vF3bKtD4=";
   };
 
   postPatch = ''
@@ -139,7 +139,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm -r $out/git/*/candle-book/
   '';
 
-  cargoHash = "sha256-xtw7r7VluCEqXWKnxpVk8BPqr+mJV5rB3Eq/PvsKPBk=";
+  cargoHash = "sha256-lBKexuOri/bI0Xc8ludVtLssGjdk+it83u/RtasaJFs=";
 
   __structuredAttrs = true;
 
diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index e75e834bab87..3dcc77a981bc 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -26,7 +26,7 @@ let
     "19.1.7".officialRelease.sha256 = "sha256-cZAB5vZjeTsXt9QHbP5xluWNQnAHByHtHnAhVDV0E6I=";
     "20.1.8".officialRelease.sha256 = "sha256-ysyB/EYxi2qE9fD5x/F2zI4vjn8UDoo1Z9ukiIrjFGw=";
     "21.1.8".officialRelease.sha256 = "sha256-pgd8g9Yfvp7abjCCKSmIn1smAROjqtfZaJkaUkBSKW0=";
-    "22.1.2".officialRelease.sha256 = "sha256-z6YcxgDd3F3JwfU5Y/wMw5MK+ZPISI3KLwHwUaraTuw=";
+    "22.1.5".officialRelease.sha256 = "sha256-eunfMOH+HVpefZJ+CG7hXDoM+pi6iYvHpD3DoSAsjoE=";
     "23.0.0-git".gitRelease = {
       rev = "cd6119c00b461c36139f1f4a0ca1653a6ab2a32b";
       rev-version = "23.0.0-unstable-2026-05-03";
diff --git a/pkgs/development/python-modules/hdbscan/default.nix b/pkgs/development/python-modules/hdbscan/default.nix
index a712625fa08f..70c165ddfd95 100644
--- a/pkgs/development/python-modules/hdbscan/default.nix
+++ b/pkgs/development/python-modules/hdbscan/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
 
   cython,
   numpy,
@@ -27,15 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-4uwWoNkrdLB2KzDAksPupdgkIFBgTahzravOtu1WYws=";
   };
 
-  patches = [
-    (fetchpatch {
-      # Replace obsolete use of assert_raises with pytest.raises
-      name = "replace-assert_raises";
-      url = "https://github.com/scikit-learn-contrib/hdbscan/pull/667/commits/04d6a4dcdcd2bb2597419b8aa981d7620765809f.patch";
-      hash = "sha256-z/u5b2rNPKOCe+3/GVE8rMB5ajeU5PrvLVesjEgj9TA=";
-    })
-  ];
-
   pythonRemoveDeps = [ "cython" ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/magic-wormhole/default.nix b/pkgs/development/python-modules/magic-wormhole/default.nix
index 825eecad6baf..d5aef570ca8b 100644
--- a/pkgs/development/python-modules/magic-wormhole/default.nix
+++ b/pkgs/development/python-modules/magic-wormhole/default.nix
@@ -42,14 +42,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "magic-wormhole";
-  version = "0.23.0";
+  version = "0.24.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "magic-wormhole";
     repo = "magic-wormhole";
     tag = finalAttrs.version;
-    hash = "sha256-knvQwdPfe9uHpSNqaEz4w2LY6LjCPVoUcFG0bhHQl+g=";
+    hash = "sha256-aY8dI5K2qroY+Nbc00R5XK0AjHpdnXFYWABgPqf8gQ8=";
   };
 
   postPatch =
diff --git a/pkgs/servers/monitoring/sensu-go/default.nix b/pkgs/servers/monitoring/sensu-go/default.nix
index e16ee5826846..8975d692ac0f 100644
--- a/pkgs/servers/monitoring/sensu-go/default.nix
+++ b/pkgs/servers/monitoring/sensu-go/default.nix
@@ -14,19 +14,19 @@ let
     }:
     buildGoModule rec {
       inherit pname;
-      version = "6.14.0";
+      version = "6.14.1";
       shortRev = "591ed6e"; # for internal version info
 
       src = fetchFromGitHub {
         owner = "sensu";
         repo = "sensu-go";
         rev = "v${version}";
-        sha256 = "sha256-/1oQz7mZyhH5U7DoVhRYnLv7AvwFrN1OBx9EEK+sCEw=";
+        sha256 = "sha256-1/yV+NdRfB0dTGWcQUx/vgDNvshn+lYN0gxMQMm/+I0=";
       };
 
       inherit subPackages postInstall;
 
-      vendorHash = "sha256-ylzMqc+zTtuttLl75ILG0OzA/PqfrpvsiKhW6cPx+ls=";
+      vendorHash = "sha256-lww3dO4kdYqql6fZj/wOVmwENFaUSWdgNyXvBwwvasE=";
 
       doCheck = false;