diff --git a/doc/languages-frameworks/javascript.section.md b/doc/languages-frameworks/javascript.section.md
index 782962461d8d..ea7e4c6316ce 100644
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@@ -511,9 +511,11 @@ Changes can include workarounds or bug fixes to existing PNPM issues.
 
 ##### Version history {#javascript-pnpm-fetcherVersion-versionHistory}
 
-- 1: Initial version, nothing special. **Deprecated: Scheduled for removal in the 26.11 release.**. New packages must not use this value.
+Version 3 is the recommended value for new packages. Versions 1 and 2 are deprecated and scheduled for removal in the 26.11 release; existing packages must migrate.
+
+- 1: Initial version, nothing special.
 - 2: [Ensure consistent permissions](https://github.com/NixOS/nixpkgs/pull/422975)
-- 3: [Build a reproducible tarball](https://github.com/NixOS/nixpkgs/pull/469950). **Recommended**
+- 3: [Build a reproducible tarball](https://github.com/NixOS/nixpkgs/pull/469950)
 
 ### Yarn {#javascript-yarn}
 
diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index 5426c8768c3b..25b7284a0144 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -334,11 +334,12 @@
 
 - `fetchPnpmDeps` and `pnpmConfigHook` were added as top-level attributes, replacing the now deprecated `pnpm.fetchDeps` and `pnpm.configHook` attributes.
 
-- `fetchPnpmDeps`' `fetcherVersion = 1` is deprecated and scheduled for removal
-  in the 26.11 release. A deprecation warning has been added. Packages still on
-  `fetcherVersion = 1` should migrate to `fetcherVersion = 3` and regenerate
-  their hashes. See the [pnpm `fetcherVersion`
-  section](#javascript-pnpm-fetcherVersion) of the manual for details.
+- `fetchPnpmDeps`' `fetcherVersion = 1` and `fetcherVersion = 2` are deprecated
+  and scheduled for removal in the 26.11 release. A deprecation warning has
+  been added. Packages still on `fetcherVersion = 1` or `fetcherVersion = 2`
+  should migrate to `fetcherVersion = 3` and regenerate their hashes. See the
+  [pnpm `fetcherVersion` section](#javascript-pnpm-fetcherVersion) of the
+  manual for details.
 
 - `buildNpmPackage` now supports `npmDepsFetcherVersion` (and `fetchNpmDeps` now supports `fetcherVersion`). Set to `2` to enable packument caching, which fixes builds for projects using npm workspaces.
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index d634ac529cab..aac03b0c9946 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -16864,6 +16864,13 @@
     githubId = 20665331;
     name = "Mark";
   };
+  Marker06 = {
+    email = "linuxenjoyerfi@proton.me";
+    github = "Marker06";
+    githubId = 148945811;
+    name = "Marcus";
+    matrix = "@marker06:matrix.org";
+  };
   markus1189 = {
     email = "markus1189@gmail.com";
     github = "markus1189";
@@ -19823,6 +19830,12 @@
     name = "nixbitcoindev";
     keys = [ { fingerprint = "577A 3452 7F3E 2A85 E80F  E164 DD11 F9AD 5308 B3BA"; } ];
   };
+  nixosclaw = {
+    email = "github@nixclaw.io";
+    github = "nixosclaw";
+    githubId = 283803283;
+    name = "NixClaw";
+  };
   nixy = {
     email = "nixy@nixy.moe";
     github = "nixy";
@@ -29258,7 +29271,7 @@
     name = "Johannes Mayrhofer";
   };
   vuks = {
-    email = "vuks@allthingslinux.org";
+    email = "vuks@vuks.dev";
     github = "Vuks69";
     githubId = 51289041;
     name = "Vuks";
diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index 58bf43c64ee3..71fc7a046f47 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -158,6 +158,8 @@
 
 - [porxie](https://codeberg.org/Blooym/porxie), a correct and efficient ATProto blob proxy for secure content delivery. Available as [services.porxie](#opt-services.porxie.enable).
 
+- [LogiOps](https://github.com/PixlOne/logiops), a unofficial userspace driver for HID++ Logitech devices. Available as [services.logiops](#opt-services.logiops.enable).
+
 ## Backward Incompatibilities {#sec-release-26.05-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 718fb29d4d8d..7699a60b6ac3 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -688,6 +688,7 @@
   ./services/hardware/lcd.nix
   ./services/hardware/libinput.nix
   ./services/hardware/lirc.nix
+  ./services/hardware/logiops.nix
   ./services/hardware/monado.nix
   ./services/hardware/nvidia-container-toolkit
   ./services/hardware/nvidia-optimus.nix
diff --git a/nixos/modules/services/desktops/crossmacro.nix b/nixos/modules/services/desktops/crossmacro.nix
index d727c1210654..1012f9cc880f 100644
--- a/nixos/modules/services/desktops/crossmacro.nix
+++ b/nixos/modules/services/desktops/crossmacro.nix
@@ -64,9 +64,9 @@ in
       // {
         crossmacro = {
           isSystemUser = true;
-          group = "input";
+          group = "crossmacro";
           extraGroups = [
-            "crossmacro"
+            "input"
             "uinput"
           ];
           description = "CrossMacro Input Daemon User";
@@ -93,12 +93,12 @@ in
       serviceConfig = {
         Type = "notify";
         User = "crossmacro";
-        Group = "input";
+        Group = "crossmacro";
         ExecStart = lib.getExe cfg.daemonPackage;
         Restart = "always";
         RestartSec = 5;
         RuntimeDirectory = "crossmacro";
-        RuntimeDirectoryMode = "0755";
+        RuntimeDirectoryMode = "0750";
         CapabilityBoundingSet = [
           "CAP_SYS_ADMIN"
           "CAP_SETUID"
diff --git a/nixos/modules/services/hardware/keyd.nix b/nixos/modules/services/hardware/keyd.nix
index 53fa97484ec6..0fbdfe2087eb 100644
--- a/nixos/modules/services/hardware/keyd.nix
+++ b/nixos/modules/services/hardware/keyd.nix
@@ -5,62 +5,67 @@
   ...
 }:
 let
+  inherit (lib) types;
+  inherit (lib.attrsets) mapAttrs' mapAttrsToList nameValuePair;
+  inherit (lib.generators) toINI;
+  inherit (lib.modules) mkDefault mkIf mkRemovedOptionModule;
+  inherit (lib.options) literalExpression mkEnableOption mkOption;
+  inherit (lib.strings) concatStringsSep;
+
   cfg = config.services.keyd;
 
-  keyboardOptions =
-    { ... }:
-    {
-      options = {
-        ids = lib.mkOption {
-          type = lib.types.listOf lib.types.str;
-          default = [ "*" ];
-          example = [
-            "*"
-            "-0123:0456"
-          ];
-          description = ''
-            Device identifiers, as shown by {manpage}`keyd(1)`.
-          '';
-        };
+  keyboardOptions = {
+    options = {
+      ids = mkOption {
+        type = with types; listOf str;
+        default = [ "*" ];
+        example = [
+          "*"
+          "-0123:0456"
+        ];
+        description = ''
+          Device identifiers, as shown by {manpage}`keyd(1)`.
+        '';
+      };
 
-        settings = lib.mkOption {
-          type = (pkgs.formats.ini { }).type;
-          default = { };
-          example = {
-            main = {
-              capslock = "overload(control, esc)";
-              rightalt = "layer(rightalt)";
-            };
-
-            rightalt = {
-              j = "down";
-              k = "up";
-              h = "left";
-              l = "right";
-            };
+      settings = mkOption {
+        inherit (pkgs.formats.ini { }) type;
+        default = { };
+        example = {
+          main = {
+            capslock = "overload(control, esc)";
+            rightalt = "layer(rightalt)";
           };
-          description = ''
-            Configuration, except `ids` section, that is written to {file}`/etc/keyd/<keyboard>.conf`.
-            Appropriate names can be used to write non-alpha keys, for example "equal" instead of "=" sign (see <https://github.com/NixOS/nixpkgs/issues/236622>).
-            See <https://github.com/rvaiya/keyd> how to configure.
-          '';
-        };
 
-        extraConfig = lib.mkOption {
-          type = lib.types.lines;
-          default = "";
-          example = ''
-            [control+shift]
-            h = left
-          '';
-          description = ''
-            Extra configuration that is appended to the end of the file.
-            **Do not** write `ids` section here, use a separate option for it.
-            You can use this option to define compound layers that must always be defined after the layer they are comprised.
-          '';
+          rightalt = {
+            j = "down";
+            k = "up";
+            h = "left";
+            l = "right";
+          };
         };
+        description = ''
+          Configuration, except `ids` section, that is written to {file}`/etc/keyd/<keyboard>.conf`.
+          Appropriate names can be used to write non-alpha keys, for example "equal" instead of "=" sign (see <https://github.com/NixOS/nixpkgs/issues/236622>).
+          See <https://github.com/rvaiya/keyd> how to configure.
+        '';
+      };
+
+      extraConfig = mkOption {
+        type = types.lines;
+        default = "";
+        example = ''
+          [control+shift]
+          h = left
+        '';
+        description = ''
+          Extra configuration that is appended to the end of the file.
+          **Do not** write `ids` section here, use a separate option for it.
+          You can use this option to define compound layers that must always be defined after the layer they are comprised.
+        '';
       };
     };
+  };
 in
 {
   imports = [
@@ -73,14 +78,14 @@ in
   ];
 
   options.services.keyd = {
-    enable = lib.mkEnableOption "keyd, a key remapping daemon";
+    enable = mkEnableOption "keyd, a key remapping daemon";
 
     package = lib.mkPackageOption pkgs "keyd" { };
 
-    keyboards = lib.mkOption {
-      type = lib.types.attrsOf (lib.types.submodule keyboardOptions);
+    keyboards = mkOption {
+      type = with types; attrsOf (submodule keyboardOptions);
       default = { };
-      example = lib.literalExpression ''
+      example = literalExpression ''
         {
           default = {
             ids = [ "*" ];
@@ -106,22 +111,22 @@ in
     };
   };
 
-  config = lib.mkIf cfg.enable {
+  config = mkIf cfg.enable {
     # Creates separate files in the `/etc/keyd/` directory for each key in the dictionary
-    environment.etc = lib.mapAttrs' (
+    environment.etc = mapAttrs' (
       name: options:
-      lib.nameValuePair "keyd/${name}.conf" {
+      nameValuePair "keyd/${name}.conf" {
         text = ''
           [ids]
-          ${lib.concatStringsSep "\n" options.ids}
+          ${concatStringsSep "\n" options.ids}
 
-          ${lib.generators.toINI { } options.settings}
+          ${toINI { } options.settings}
           ${options.extraConfig}
         '';
       }
     ) cfg.keyboards;
 
-    hardware.uinput.enable = lib.mkDefault true;
+    hardware.uinput.enable = mkDefault true;
 
     systemd.services.keyd = {
       description = "Keyd remapping daemon";
@@ -129,18 +134,12 @@ in
 
       wantedBy = [ "multi-user.target" ];
 
-      restartTriggers = lib.mapAttrsToList (
-        name: options: config.environment.etc."keyd/${name}.conf".source
+      restartTriggers = mapAttrsToList (
+        name: _options: config.environment.etc."keyd/${name}.conf".source
       ) cfg.keyboards;
 
-      # this is configurable in 2.4.2, later versions seem to remove this option.
-      # post-2.4.2 may need to set makeFlags in the derivation:
-      #
-      #     makeFlags = [ "SOCKET_PATH/run/keyd/keyd.socket" ];
-      environment.KEYD_SOCKET = "/run/keyd/keyd.sock";
-
       serviceConfig = {
-        ExecStart = lib.getExe' cfg.package "keyd";
+        ExecStart = lib.getExe cfg.package;
         Restart = "always";
 
         # TODO investigate why it doesn't work propeprly with DynamicUser
diff --git a/nixos/modules/services/hardware/logiops.nix b/nixos/modules/services/hardware/logiops.nix
new file mode 100644
index 000000000000..807d169ac6fc
--- /dev/null
+++ b/nixos/modules/services/hardware/logiops.nix
@@ -0,0 +1,61 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.logiops;
+  configFormat = pkgs.formats.libconfig { };
+  configFile = configFormat.generate "logid.cfg" cfg.config;
+in
+{
+  options = {
+    services.logiops = {
+      enable = lib.mkEnableOption "LogiOps, a unofficial userspace driver for HID++ Logitech devices";
+
+      package = lib.mkPackageOption pkgs "logiops" { };
+
+      config = lib.mkOption {
+        type = configFormat.type;
+        default = { };
+        example = lib.literalExpression ''
+          devices = [
+          {
+              name = "Wireless Mouse MX Master";
+              dpi = 1000;
+              smartshift =
+              {
+                  on = true;
+                  threshold = 30;
+                  torque = 50;
+              };
+          }
+          ];
+        '';
+        description = ''
+          The standard libconfig-style config for LogiOps.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    services.dbus.packages = [ cfg.package ];
+
+    systemd = {
+      packages = [ cfg.package ];
+      services.logid = {
+        wantedBy = [ "graphical.target" ];
+        serviceConfig.ExecStart = [
+          ""
+          "${lib.getExe cfg.package} -c ${configFile}"
+        ];
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ bokicoder ];
+}
diff --git a/nixos/tests/benchexec.nix b/nixos/tests/benchexec.nix
index 2875588efdf2..d531ceb746fd 100644
--- a/nixos/tests/benchexec.nix
+++ b/nixos/tests/benchexec.nix
@@ -43,7 +43,8 @@ in
             --debug \
             --read-only-dir / \
             --hidden-dir /home \
-            '${test}' \
+            --no-container \
+            -- '${test}' \
       '''')
       benchexec.succeed("grep -s '${echo}' ${wd}/output.log")
       benchexec.succeed("test \"$(grep -Ec '((start|wall|cpu)time|memory)=' ${stdout})\" = 4")
diff --git a/nixos/tests/nginx-etag.nix b/nixos/tests/nginx-etag.nix
index 88aaefd0e476..a6ced2eba537 100644
--- a/nixos/tests/nginx-etag.nix
+++ b/nixos/tests/nginx-etag.nix
@@ -53,14 +53,18 @@
                 }
                 ''
                   import os
+                  import shutil
                   import time
 
                   from selenium.webdriver import Firefox
                   from selenium.webdriver.firefox.options import Options
+                  from selenium.webdriver.firefox.service import Service
+
+                  service = Service(shutil.which("geckodriver"))
 
                   options = Options()
                   options.add_argument('--headless')
-                  driver = Firefox(options=options)
+                  driver = Firefox(options=options, service=service)
 
                   driver.implicitly_wait(20)
                   driver.get('http://server/')
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index c9e5eac612d0..18a76745d9b5 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -365,8 +365,8 @@ let
         mktplcRef = {
           name = "nix-env-selector";
           publisher = "arrterian";
-          version = "1.2.0";
-          hash = "sha256-dvJmBoljMNS7I7c1DicIWW0t4GQvBFF9jAz2Z2v4lXw=";
+          version = "1.3.1";
+          hash = "sha256-dV1FkAOZkWgqlk6j6ppQSUz5N3AoGTPgPkep60gGeP8=";
         };
         meta = {
           license = lib.licenses.mit;
@@ -1007,8 +1007,8 @@ let
         mktplcRef = {
           name = "coder-remote";
           publisher = "coder";
-          version = "1.14.3";
-          hash = "sha256-W4VciZMvVtRcCibJP5UGTlHCrdF/AF167xlLvZs5BB4=";
+          version = "1.14.5";
+          hash = "sha256-08GsGOtgLhq5vLpQ9VDdVk/q5VSW6d7cXXflNQOpB50=";
         };
         meta = {
           description = "Extension for Visual Studio Code to open any Coder workspace in VS Code with a single click";
@@ -1204,8 +1204,8 @@ let
         mktplcRef = {
           name = "dart-code";
           publisher = "dart-code";
-          version = "3.132.0";
-          hash = "sha256-AWzHCg6N//+RmQ1I3Qq4c8Kk+e3gZpeqK9yWB8kfl6w=";
+          version = "3.134.0";
+          hash = "sha256-/tWH2uGfOuyvF8mfga2YdGK1ok2UYQchaOeCC2n+IHk=";
         };
 
         meta.license = lib.licenses.mit;
@@ -1215,8 +1215,8 @@ let
         mktplcRef = {
           name = "flutter";
           publisher = "dart-code";
-          version = "3.132.0";
-          hash = "sha256-2R9SwNaJBKv39JLRy0IFm6/0J8Izj2DlEAat+yigIFk=";
+          version = "3.134.0";
+          hash = "sha256-wWANxBh9Tg3VkfbcrR0NgOIC8cpeZJCNfOevT7E4zKY=";
         };
 
         meta.license = lib.licenses.mit;
@@ -1260,8 +1260,8 @@ let
         mktplcRef = {
           name = "languagetool-linter";
           publisher = "davidlday";
-          version = "0.25.7";
-          hash = "sha256-XLW49YkgDuojNEzqWRztK8mKWKbVU5OeGOjHl0heH/w=";
+          version = "0.25.8";
+          hash = "sha256-ddDxe0ZJgQjDUAKAQyboHEi0ZeVBeGE4Zx2peRbBGFA=";
         };
         meta = {
           description = "LanguageTool integration for VS Code";
@@ -1346,8 +1346,8 @@ let
         mktplcRef = {
           publisher = "discloud";
           name = "discloud";
-          version = "2.29.5";
-          hash = "sha256-oWrGDJHVQ8Gwjrh6vlQPKoFlBx3wxzLbMkH0gDFa5jg=";
+          version = "2.29.6";
+          hash = "sha256-CHpRetKZnGzShIePnbVUdR06/1AAO2I1RX7NiZ7GBNs=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/discloud.discloud/changelog";
@@ -3861,8 +3861,8 @@ let
         mktplcRef = {
           name = "ansible";
           publisher = "redhat";
-          version = "26.4.6";
-          hash = "sha256-ckirgCt6+mdnWkvmLwpH7YwqOxQ+JEeRE0/NJGCi7rU=";
+          version = "26.5.0";
+          hash = "sha256-gKe+LC0OOZi5I1Tei64JtQUR1gpWyTex9MoLGT6jgWU=";
         };
         meta = {
           description = "Ansible language support";
@@ -4357,8 +4357,8 @@ let
         mktplcRef = {
           publisher = "sonarsource";
           name = "sonarlint-vscode";
-          version = "5.2.0";
-          hash = "sha256-Q9wP+PqjWVyqVh0FK8lx+k4bxacyQO7aLtZX98fRl7g=";
+          version = "5.2.1";
+          hash = "sha256-GVuFP0n2Su6YAh/KwtkEFvZK9hAyVDIWfoBjaPQyUFM=";
         };
         meta.license = lib.licenses.lgpl3Only;
       };
@@ -4807,8 +4807,8 @@ let
         mktplcRef = {
           name = "emacs-mcx";
           publisher = "tuttieee";
-          version = "0.110.7";
-          hash = "sha256-9w78/6W/aqJxzoTBqSV7sek2zUf9gKlWFJ/0/XS9124=";
+          version = "0.110.9";
+          hash = "sha256-xHu8GvBoZKMag7BdHddXyjm2IReMujs9cggOn4h32t8=";
         };
         meta = {
           changelog = "https://github.com/whitphx/vscode-emacs-mcx/blob/main/CHANGELOG.md";
diff --git a/pkgs/applications/editors/vscode/extensions/ms-python.mypy-type-checker/default.nix b/pkgs/applications/editors/vscode/extensions/ms-python.mypy-type-checker/default.nix
index 60700645d32e..5daf4054b0ea 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-python.mypy-type-checker/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.mypy-type-checker/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "ms-python";
     name = "mypy-type-checker";
-    version = "2025.2.0";
-    hash = "sha256-VJ/XSC4cbIjgxKLsXxUxwko+HR0U59c8OrhYnKPJu4g=";
+    version = "2026.4.0";
+    hash = "sha256-N0zml16XSBwjGHzCR1L0W9WiSgqD/375VIQGpGfCkFE=";
   };
 
   meta = {
diff --git a/pkgs/applications/misc/cubocore-packages/coreaction/default.nix b/pkgs/applications/misc/cubocore-packages/coreaction/default.nix
index f9143c5d505d..3040ca370e07 100644
--- a/pkgs/applications/misc/cubocore-packages/coreaction/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/coreaction/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "coreaction";
-  version = "5.0.0";
+  version = "5.0.1";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = "coreaction";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-R/pzudaxs85etbI4hh2NwHNtO7EqI+vgJALY/4rIvrs=";
+    hash = "sha256-93/1emCLXP3hHDGdzjF5horWkpG51yM5p68RUs1yoVg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/cubocore-packages/corearchiver/default.nix b/pkgs/applications/misc/cubocore-packages/corearchiver/default.nix
index 4de3a74839bc..d9fa21143f13 100644
--- a/pkgs/applications/misc/cubocore-packages/corearchiver/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corearchiver/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "corearchiver";
-  version = "5.0.0";
+  version = "5.0.1";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = "corearchiver";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+XaBe1fNpAQf3cqXV+A1cZ1tPck3bCpgEDmFeF536q4=";
+    hash = "sha256-r2iXvc9KtRsB5IHvJxs/DxQIf7IiNWoM4h2wDgsXvZE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/cubocore-packages/coregarage/default.nix b/pkgs/applications/misc/cubocore-packages/coregarage/default.nix
index 6772e6a23d4e..74b5bbd5a7cf 100644
--- a/pkgs/applications/misc/cubocore-packages/coregarage/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/coregarage/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "coregarage";
-  version = "5.0.0";
+  version = "5.0.1";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = "coregarage";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-boe7z8KPnMaoWekBFS4g/Ay98rpREeLMAsHOr2olYws=";
+    hash = "sha256-aPBqlt/bL1cx6mLaf/gEFQB+NEvGQJioBJZ4QAxTwzw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/cubocore-packages/corehunt/default.nix b/pkgs/applications/misc/cubocore-packages/corehunt/default.nix
index 978570ceac4c..6b366c3f4650 100644
--- a/pkgs/applications/misc/cubocore-packages/corehunt/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corehunt/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "corehunt";
-  version = "5.0.0";
+  version = "5.0.1";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = "corehunt";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QJJ+e+5UKka1Hbrtyn+agpJ7FLADHupZt41K8Mq8H4c=";
+    hash = "sha256-D3O1RnhXZmIGlk75OxfYvQI+8sytXTho2MvccI5Xyvg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/cubocore-packages/coreimage/default.nix b/pkgs/applications/misc/cubocore-packages/coreimage/default.nix
index 9ebc6457e043..7ecde35724c5 100644
--- a/pkgs/applications/misc/cubocore-packages/coreimage/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/coreimage/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "coreimage";
-  version = "5.0.0";
+  version = "5.0.1";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = "coreimage";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sgOxDKACb9D/TvjjHz09JwBpFoE8eXA4HixcbN+0FoE=";
+    hash = "sha256-1P6dD0aHsv79s1jCghRhhxi5rZ6MmpyIrks9QnqFoaU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/cubocore-packages/coreinfo/default.nix b/pkgs/applications/misc/cubocore-packages/coreinfo/default.nix
index 78328bdc8c63..441069640236 100644
--- a/pkgs/applications/misc/cubocore-packages/coreinfo/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/coreinfo/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "coreinfo";
-  version = "5.0.0";
+  version = "5.0.1";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = "coreinfo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/L69lrkJZh+SJRoNxvogdJ5KRIorwcBzm7WGxrNpexM=";
+    hash = "sha256-Ct/vAxtdFcXIxleaePhWD5L42d88go/3arYKSrw/c2c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/cubocore-packages/corekeyboard/default.nix b/pkgs/applications/misc/cubocore-packages/corekeyboard/default.nix
index 10a0d0c1d3ef..e41603f9aac7 100644
--- a/pkgs/applications/misc/cubocore-packages/corekeyboard/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corekeyboard/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "corekeyboard";
-  version = "5.0.0";
+  version = "5.0.1";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = "corekeyboard";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-n7QbvRPZFMeUl/P4XiGYZDglZCA8Ftf08s5uzPmSyIQ=";
+    hash = "sha256-HAkIhmQzicnOAws8M+Z8J7lCuGUqYkJeQl0H8P0EE3c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/cubocore-packages/corepad/default.nix b/pkgs/applications/misc/cubocore-packages/corepad/default.nix
index 6c77b39025ba..75dfd258add2 100644
--- a/pkgs/applications/misc/cubocore-packages/corepad/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corepad/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "corepad";
-  version = "5.0.0";
+  version = "5.0.1";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = "corepad";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oGF2N0bUuvc/ixmh2nefEJKh0kDipvcL/dwaXNxwo84=";
+    hash = "sha256-TA/gwI7ukuwChBRp2xsDbNbTblkzYgQ5YHwuI53cxc8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/cubocore-packages/corepaint/default.nix b/pkgs/applications/misc/cubocore-packages/corepaint/default.nix
index 86d65d6b3a21..cb096b1dc0e7 100644
--- a/pkgs/applications/misc/cubocore-packages/corepaint/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corepaint/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "corepaint";
-  version = "5.0.0";
+  version = "5.0.1";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = "corepaint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ARFyBtkGYFMKnUD1h93GcQiKV6mFXxJvLEVeSXlaHZI=";
+    hash = "sha256-qk2Fm/IhUU/0y+ErMK/qQKxnD/en14ZKoiIJoJwBnMc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/cubocore-packages/corepdf/default.nix b/pkgs/applications/misc/cubocore-packages/corepdf/default.nix
index c06e01a01729..4474d1531911 100644
--- a/pkgs/applications/misc/cubocore-packages/corepdf/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corepdf/default.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "corepdf";
-  version = "5.0.0";
+  version = "5.0.1";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = "corepdf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fhEuMk15yCA6IUasD9rJPR8sB+h0tz8niOQtXFIe7Uc=";
+    hash = "sha256-6VLjOf/VZpBH8kIvdvObiyu10yiTYk26eKHFKIUMwN8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/cubocore-packages/corepins/default.nix b/pkgs/applications/misc/cubocore-packages/corepins/default.nix
index 1783c0c5d864..e540c3124bfc 100644
--- a/pkgs/applications/misc/cubocore-packages/corepins/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corepins/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "corepins";
-  version = "5.0.0";
+  version = "5.0.1";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = "corepins";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-noMdI2qk3cYc1FfRWd4rwpZBbeHiD557Z1T0ZxIhaTw=";
+    hash = "sha256-+cWhlqIK2Oqx4Zt1sRd7xvGwmbYOZbMMU+k5uNnkogk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/cubocore-packages/corerenamer/default.nix b/pkgs/applications/misc/cubocore-packages/corerenamer/default.nix
index 4d2b91cee669..a90ab69eba82 100644
--- a/pkgs/applications/misc/cubocore-packages/corerenamer/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corerenamer/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "corerenamer";
-  version = "5.0.0";
+  version = "5.0.1";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = "corerenamer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9e8Gm7h0zWVQeb7eFcUmp8uTdSboenLa7baZpKc3HEQ=";
+    hash = "sha256-94luETLmugQZuSI+q84DC9WyH5LtCqpjH6LYtv9R93Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/cubocore-packages/corestats/default.nix b/pkgs/applications/misc/cubocore-packages/corestats/default.nix
index ecdb8642d910..4b68d5a3f4d7 100644
--- a/pkgs/applications/misc/cubocore-packages/corestats/default.nix
+++ b/pkgs/applications/misc/cubocore-packages/corestats/default.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "corestats";
-  version = "5.0.0";
+  version = "5.0.1";
 
   src = fetchFromGitLab {
     owner = "cubocore/coreapps";
     repo = "corestats";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0d03y3AYWxXh9DZrbPWqk34yq7iy5xUn/oMmJBu5GqQ=";
+    hash = "sha256-4wVBC/NeexJIFsDOjqHFC/u3Rapd/22fjH5yMVafWPY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index b01d05397b8e..243d2380275c 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -828,7 +828,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "148.0.7778.96",
+    "version": "148.0.7778.167",
     "deps": {
       "depot_tools": {
         "rev": "41c40cfaec7ee3bf0423c59925d8b23982a601f1",
@@ -840,16 +840,16 @@
         "hash": "sha256-BTPD8WM1pVAMkFDlHekMdWFGyf63KdhKkKwsqikqoBQ="
       },
       "ungoogled-patches": {
-        "rev": "148.0.7778.96-1",
-        "hash": "sha256-yuc51ursl3pNyqSuTT9391AAlytoTzEMeronxjsNM7g="
+        "rev": "148.0.7778.167-1",
+        "hash": "sha256-07mzJHDgWiEQm/8pPDDzT8r+6/bh95yBrZMm2jDqCus="
       },
       "npmHash": "sha256-JuVcY8iFRDWcPcP4Pg+qm5rnTXkiVfNsqSkXbDWqsE8="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "8625e066febc721e015ea99842da12901eb7ed73",
-        "hash": "sha256-coeBYfNPtiRRPuqoBRaxkTQI/a2pYNLI1slUdU1dZAc=",
+        "rev": "65db666ac2cf205fcc36db8bb5b9cd87f94808ac",
+        "hash": "sha256-Vda6y35lHYP3xK9FT5FdsnfTtL0MiY2m/auSq6NyL0U=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -919,8 +919,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "cc0e3572e8789f4a184dd9714a04b3d98ae81015",
-        "hash": "sha256-3KVTEBcnQTn99ccdKzylzUvua2jlS4g8/nfIDdLk6ug="
+        "rev": "6c71c70ec7e838c5f1712974086c8bc33d07de14",
+        "hash": "sha256-35Zu8jSopO47pH1rNLtSq5I8QRsOkMMvTgtmD13Yw/Y="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -1169,8 +1169,8 @@
       },
       "src/third_party/harfbuzz/src": {
         "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git",
-        "rev": "4fc96139259ebc35f40118e0382ac8037d928e5c",
-        "hash": "sha256-/RT2OPWFiVwFqmNS4o+gE0JrcVO1cQDkCkgrSEe7BzE="
+        "rev": "f027b8e9039f73bf803eae684fee2eb2d30e4180",
+        "hash": "sha256-HWb3QbPl+RE2oI/Jwv5BjKwv9UnJ8VcJvk+uGy9cAqM="
       },
       "src/third_party/ink/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ink.git",
@@ -1489,8 +1489,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "afe8b760ada5128164f9826866b4381a3463df41",
-        "hash": "sha256-HsKHffZWTls362kjokxzdhaxb/xJD1g70VHGk9l6GVM="
+        "rev": "a2888b27a98e4ff30085d4d2dba8a1a99baf6dfb",
+        "hash": "sha256-eOjFuMmXr9YtZ0e4yDB8JMjTrNWEg5OlTkAMGuHZIWE="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1624,8 +1624,8 @@
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "9600e77d854090669817d22aa2fc941ee92aaacd",
-        "hash": "sha256-jTJv53qt971Va5q6MaULysYiChBVmsFYxG9fzkcE0ak="
+        "rev": "9a7f650bcd14f241d20f88f4e1ea3b7300de72ac",
+        "hash": "sha256-k5cHE4XURJQrPURmXk4MMNV5k8+ryKfjmsVTzARRro4="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -1649,8 +1649,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "ddc9a95905de5268332a8f0216dc2bc67d26e829",
-        "hash": "sha256-x2FGL3J+JaWO1m6jBrcayR7Vlz90fYEAuufm4PULYyM="
+        "rev": "e38030f4228c8d1405fe105fc5feaa5173559e25",
+        "hash": "sha256-VsJpsCfDGF6rlfYQXccgF+F/pBhY/ybUa9N5HnHJ2lU="
       }
     }
   }
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index f890a7d9f95a..12d02a228b1a 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1499,12 +1499,12 @@
     "vendorHash": "sha256-Z4DfoG4ApXbPNXZs9YvBWQj1bH7moLNI6P+nKDHt/Jc="
   },
   "yandex-cloud_yandex": {
-    "hash": "sha256-EtY2Z/dBtyNvOk8T+iEXduEPiB5IqW/eYA4u7llTYAc=",
+    "hash": "sha256-Jjrwvz1DG2+ypbqlzneHt7Ws6nu68ZqhO+8jXAeDQTE=",
     "homepage": "https://registry.terraform.io/providers/yandex-cloud/yandex",
     "owner": "yandex-cloud",
     "repo": "terraform-provider-yandex",
-    "rev": "v0.201.0",
+    "rev": "v0.202.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Mdyu8GSENgU1+8Lc2iAizZ1tJq2t9Zdh7qRPtwV94XY="
+    "vendorHash": "sha256-QZUm9RDA47b3v84ePqUnSIFAFgMIcuRMJZzBs7JR6ng="
   }
 }
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index 02c9f2578f26..cd27e799168a 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -438,14 +438,14 @@ in
 
   docker_29 =
     let
-      version = "29.4.2";
+      version = "29.4.3";
     in
     callPackage dockerGen {
       inherit version;
       cliRev = "v${version}";
       cliHash = "sha256-jGD+Z3koM0a2Te7cq2HdKFizZj39djvTQUmn815Mn4o=";
       mobyRev = "docker-v${version}";
-      mobyHash = "sha256-jPmFYGOxvMof32fQeI4iHLG12ElwysYLSTkIrlluEXM=";
+      mobyHash = "sha256-YWmxJZwjxh0gwqjHHJDpzZy1K1jS82Twmzb+uWtnejk=";
       runcRev = "v1.3.5";
       runcHash = "sha256-Swphxbu/OLkUrfRjLMZIVGwYb7AN0xHdyxm0ysAVam0=";
       containerdRev = "v2.2.3";
diff --git a/pkgs/build-support/node/fetch-pnpm-deps/default.nix b/pkgs/build-support/node/fetch-pnpm-deps/default.nix
index 79dcddbb4a81..b5635b283dfd 100644
--- a/pkgs/build-support/node/fetch-pnpm-deps/default.nix
+++ b/pkgs/build-support/node/fetch-pnpm-deps/default.nix
@@ -70,8 +70,8 @@ in
       "fetchPnpmDeps `fetcherVersion` is not set to a supported value (${lib.concatStringsSep ", " (map toString supportedFetcherVersions)}), see https://nixos.org/manual/nixpkgs/stable/#javascript-pnpm-fetcherVersion."
     ) true;
 
-    lib.warnIf (fetcherVersion == 1)
-      "fetchPnpmDeps: `fetcherVersion = 1` is deprecated and scheduled for removal in the 26.11 release. Please migrate `${pname}` to `fetcherVersion = 3` and regenerate the hash. See https://nixos.org/manual/nixpkgs/stable/#javascript-pnpm-fetcherVersion."
+    lib.warnIf (fetcherVersion < 3)
+      "fetchPnpmDeps: `fetcherVersion = ${toString fetcherVersion}` is deprecated and scheduled for removal in the 26.11 release. Please migrate `${pname}` to `fetcherVersion = 3` and regenerate the hash. See https://nixos.org/manual/nixpkgs/stable/#javascript-pnpm-fetcherVersion."
 
       stdenvNoCC.mkDerivation
       (
diff --git a/pkgs/by-name/ac/acltoolkit/package.nix b/pkgs/by-name/ac/acltoolkit/package.nix
index 67505709888f..835995193872 100644
--- a/pkgs/by-name/ac/acltoolkit/package.nix
+++ b/pkgs/by-name/ac/acltoolkit/package.nix
@@ -1,19 +1,18 @@
 {
   lib,
-  python3,
+  python3Packages,
   fetchFromGitHub,
 }:
 
-python3.pkgs.buildPythonPackage {
+python3Packages.buildPythonPackage (finalAttrs: {
   pname = "acltoolkit";
-  version = "0-unstable-2023-02-03";
+  version = "0.2.2-unstable-2023-02-03";
   pyproject = true;
 
-  build-system = with python3.pkgs; [ setuptools ];
-
   src = fetchFromGitHub {
     owner = "zblurx";
     repo = "acltoolkit";
+    # https://github.com/zblurx/acltoolkit/issues/6
     rev = "a5219946aa445c0a3b4a406baea67b33f78bca7c";
     hash = "sha256-97cbkGyIkq2Pk1hydMcViXWoh+Ipi3m0YvEYiaV4zcM=";
   };
@@ -23,7 +22,9 @@ python3.pkgs.buildPythonPackage {
     sed -i -e "s/==[0-9.]*//" setup.py
   '';
 
-  dependencies = with python3.pkgs; [
+  build-system = with python3Packages; [ setuptools ];
+
+  dependencies = with python3Packages; [
     asn1crypto
     dnspython
     impacket
@@ -35,15 +36,13 @@ python3.pkgs.buildPythonPackage {
   # Project has no tests
   doCheck = false;
 
-  pythonImportsCheck = [
-    "acltoolkit"
-  ];
+  pythonImportsCheck = [ "acltoolkit" ];
 
   meta = {
     description = "ACL abuse swiss-knife";
-    mainProgram = "acltoolkit";
     homepage = "https://github.com/zblurx/acltoolkit";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "acltoolkit";
   };
-}
+})
diff --git a/pkgs/by-name/ag/age-plugin-fido2-hmac/package.nix b/pkgs/by-name/ag/age-plugin-fido2-hmac/package.nix
index c0511da63160..92bf96e18a4b 100644
--- a/pkgs/by-name/ag/age-plugin-fido2-hmac/package.nix
+++ b/pkgs/by-name/ag/age-plugin-fido2-hmac/package.nix
@@ -24,16 +24,16 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "age-plugin-fido2-hmac";
-  version = "0.4.0";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "olastor";
     repo = "age-plugin-fido2-hmac";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8DO62uISwleJB/NFH7U8xhfT5bcda+d+7U6LXvySsD0=";
+    hash = "sha256-3lhGGw7QI1aij6IU7AeoxwgcVsCNKyrmsKBockb0kRw=";
   };
 
-  vendorHash = "sha256-3r/eTaa4kYRXqq7sUZzzGkgcF8lZbPZguoHb6W6t1T0=";
+  vendorHash = "sha256-kHv5epwaiBE69rcblICofGoVULuLQT1h0sK4jWwtX9w=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/al/algolia-cli/package.nix b/pkgs/by-name/al/algolia-cli/package.nix
index 0b035d211170..00061b1b3f7e 100644
--- a/pkgs/by-name/al/algolia-cli/package.nix
+++ b/pkgs/by-name/al/algolia-cli/package.nix
@@ -6,7 +6,7 @@
   installShellFiles,
 }:
 let
-  version = "1.8.2";
+  version = "1.8.4";
 in
 buildGoModule {
   pname = "algolia-cli";
@@ -16,7 +16,7 @@ buildGoModule {
     owner = "algolia";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-i1x6/Ksiz8t8ho1SmcrypzQjERQ0e0Xxvnd5uIlQRoE=";
+    hash = "sha256-ltr31AnZPTtnfMWaUtsswUnIOXfR76X8pjM9D0uiLJo=";
   };
 
   vendorHash = "sha256-WdNuwUz64IZq3gfvFhXX536/tZ/67Ki0xiqIj7sLSEM=";
diff --git a/pkgs/by-name/an/ansible-doctor/package.nix b/pkgs/by-name/an/ansible-doctor/package.nix
index 8a8c73cb89a1..c1d081652abf 100644
--- a/pkgs/by-name/an/ansible-doctor/package.nix
+++ b/pkgs/by-name/an/ansible-doctor/package.nix
@@ -9,14 +9,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "ansible-doctor";
-  version = "8.3.0";
+  version = "8.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "thegeeklab";
     repo = "ansible-doctor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lwN6pMKysycMOqVRNrK8+dgGfrsRF2B2EW1Kby0l/0I=";
+    hash = "sha256-wv5iSY5p/PZUwgxwknoZgB4f5ERvsvA3hrUbdSAYwxQ=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/ar/arti/package.nix b/pkgs/by-name/ar/arti/package.nix
index 184b5c37e262..71b8f3225149 100644
--- a/pkgs/by-name/ar/arti/package.nix
+++ b/pkgs/by-name/ar/arti/package.nix
@@ -13,7 +13,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "arti";
-  version = "2.2.0";
+  version = "2.3.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.torproject.org";
@@ -21,10 +21,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "core";
     repo = "arti";
     tag = "arti-v${finalAttrs.version}";
-    hash = "sha256-yV+8P6V9QDDmIekJsa3kUt8Qv2Y/Zfeq2aqcQIGNubg=";
+    hash = "sha256-OEGKjYJ3p4g0ZfeK6k8IJJPjgSBMrSlKlxsCw1OwyaI=";
   };
 
-  cargoHash = "sha256-bqJ9beO+AZlz9GZkO5cAk45B4bxyfYq+pLMFWj8pWwg=";
+  # Working around a bug in cargo that appears with cargo-auditable, see
+  # https://github.com/rust-secure-code/cargo-auditable/issues/124.
+  postPatch = ''
+    substituteInPlace crates/arti/Cargo.toml \
+      --replace-fail '"tor-rpcbase"' '"dep:tor-rpcbase"'
+  '';
+
+  cargoHash = "sha256-OJgrIXL185W9rcQd7XZsgiqN4in74Oc2jDT1ZmcCC6E=";
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ];
 
@@ -68,7 +75,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   doInstallCheck = true;
 
   passthru = {
-    inherit (nixosTests) tor;
+    tests = { inherit (nixosTests) tor; };
     updateScript = nix-update-script { extraArgs = [ "--version-regex=^arti-v(.*)$" ]; };
   };
 
diff --git a/pkgs/by-name/as/assh/package.nix b/pkgs/by-name/as/assh/package.nix
index 015ca83f3194..c7e988f70bd5 100644
--- a/pkgs/by-name/as/assh/package.nix
+++ b/pkgs/by-name/as/assh/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "assh";
-  version = "2.17.1";
+  version = "2.17.2";
 
   src = fetchFromGitHub {
     repo = "advanced-ssh-config";
     owner = "moul";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rHe0ynjj/7LXUKoS4iO+PJjh4SVBqh+kChuYzSFocfs=";
+    hash = "sha256-/w4RluA7py6d75S04czNsgHpmR5rmAUZx8OnZfu9oNg=";
   };
 
   vendorHash = "sha256-EA39KqAN9SHPU362j6/j6okvT+eZb2R4unMA0bB+bVg=";
diff --git a/pkgs/by-name/bl/blockstream-electrs/package.nix b/pkgs/by-name/bl/blockstream-electrs/package.nix
index 6a25d4fbed4e..1db509d16d2a 100644
--- a/pkgs/by-name/bl/blockstream-electrs/package.nix
+++ b/pkgs/by-name/bl/blockstream-electrs/package.nix
@@ -3,33 +3,39 @@
   electrum,
   fetchFromGitHub,
   lib,
-  rocksdb_8_3,
+  rocksdb,
+  rust-jemalloc-sys,
   rustPlatform,
   stdenv,
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "blockstream-electrs";
-  version = "0.4.1-unstable-2024-11-25";
+  version = "0.4.1-unstable-2026-04-20";
 
   src = fetchFromGitHub {
     owner = "Blockstream";
     repo = "electrs";
-    rev = "680eacaa8360d5f46eaae9611a3097ba183795c6";
-    hash = "sha256-oDM4arH3aplgcS49t/hy5Rqt36glrVufd3F4tw3j1zo=";
+    rev = "503b740cce2133fd07f451cbe93249a4e092b300";
+    hash = "sha256-jFOEQwFDRVghCDFu0mybSLeTk9zWJSQW9clWFMkCa5A=";
   };
 
-  cargoHash = "sha256-X2C69ui3XiYP1cg9FgfBbJlLLMq1SCw+oAL20B1Fs30=";
+  cargoHash = "sha256-P8slOt07Fu6NNzYLEso3UQtfx7Yj+C4w98lq/Wr8oTk=";
 
   nativeBuildInputs = [
     # Needed for librocksdb-sys
     rustPlatform.bindgenHook
   ];
 
+  buildInputs = [
+    # tikv-jemalloc-sys's vendored jemalloc configure breaks under gcc 15.
+    rust-jemalloc-sys
+  ];
+
   env = {
     # Dynamically link rocksdb
-    ROCKSDB_INCLUDE_DIR = "${rocksdb_8_3}/include";
-    ROCKSDB_LIB_DIR = "${rocksdb_8_3}/lib";
+    ROCKSDB_INCLUDE_DIR = "${rocksdb}/include";
+    ROCKSDB_LIB_DIR = "${rocksdb}/lib";
 
     # External binaries for integration tests are provided via nixpkgs. Skip
     # trying to download them.
@@ -52,6 +58,13 @@ rustPlatform.buildRustPackage rec {
   # Build tests in debug mode to reduce build time
   checkType = "debug";
 
+  # flaky: wait_for_sync roundtrip races the wallet daemon startup
+  checkFlags = [
+    "--skip=test_electrum_balance"
+    "--skip=test_electrum_history"
+    "--skip=test_electrum_payment"
+  ];
+
   # Integration tests require us to pass in some external deps via env.
   preCheck = lib.optionalString doCheck ''
     export BITCOIND_EXE=${bitcoind}/bin/bitcoind
diff --git a/pkgs/by-name/ca/cage/package.nix b/pkgs/by-name/ca/cage/package.nix
index 7326ee2dc221..d787ee6dbb18 100644
--- a/pkgs/by-name/ca/cage/package.nix
+++ b/pkgs/by-name/ca/cage/package.nix
@@ -2,14 +2,13 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   meson,
   ninja,
   pkg-config,
   wayland-scanner,
   scdoc,
   makeWrapper,
-  wlroots_0_19,
+  wlroots_0_20,
   wayland,
   wayland-protocols,
   pixman,
@@ -23,25 +22,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cage";
-  version = "0.2.1";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "cage-kiosk";
     repo = "cage";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-P9MhIl2YIE2hwT5Yr0Cpes5S12evb0aj9oOPLeehkw0=";
+    hash = "sha256-NLoz11bfeZwesmwLmyytuB6/vSwIsnDWKzyAXFe+YZ0=";
   };
 
-  patches = [
-    # backport of https://github.com/cage-kiosk/cage/pull/461
-    # to fix https://github.com/cage-kiosk/cage/issues/456
-    # remove on next release
-    (fetchpatch {
-      url = "https://github.com/cage-kiosk/cage/commit/832e88b0c964a324bb09c7af02ed0650b73dfb9b.patch";
-      hash = "sha256-8dyJL46xXGkw3pF9uskX8H72s0hUO1BhU2UMaoEwz4U=";
-    })
-  ];
-
   depsBuildBuild = [
     pkg-config
   ];
@@ -56,7 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    wlroots_0_19
+    wlroots_0_20
     wayland
     wayland-protocols
     pixman
@@ -66,7 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
     libx11
   ];
 
-  postFixup = lib.optionalString wlroots_0_19.enableXWayland ''
+  postFixup = lib.optionalString wlroots_0_20.enableXWayland ''
     wrapProgram $out/bin/cage --prefix PATH : "${xwayland}/bin"
   '';
 
diff --git a/pkgs/by-name/cd/cdk8s-cli/package.nix b/pkgs/by-name/cd/cdk8s-cli/package.nix
index 69c5e996a14e..58760a0b3536 100644
--- a/pkgs/by-name/cd/cdk8s-cli/package.nix
+++ b/pkgs/by-name/cd/cdk8s-cli/package.nix
@@ -12,18 +12,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cdk8s-cli";
-  version = "2.206.10";
+  version = "2.207.1";
 
   src = fetchFromGitHub {
     owner = "cdk8s-team";
     repo = "cdk8s-cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-fSv5TQ+b7ZG7GBkXzeYytuHUqLZCiWHPVPTyLbzB57k=";
+    hash = "sha256-Sw6BcUWnFS1/BOsLLm1Pi+z6kqEveZbGmY9UAWA6bJc=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-CJ/GKWS4HMINKCo2lNdbVahaGnpNXVV9uNExF6kXeI0=";
+    hash = "sha256-LY4rk9JQkoDW3YXlofuTepcGd1D4zuWnxHeSzlXL+wM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ch/chirpstack-rest-api/package.nix b/pkgs/by-name/ch/chirpstack-rest-api/package.nix
index 5f4157fdea59..7cef8d846206 100644
--- a/pkgs/by-name/ch/chirpstack-rest-api/package.nix
+++ b/pkgs/by-name/ch/chirpstack-rest-api/package.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "chirpstack-rest-api";
-  version = "4.16.1";
+  version = "4.18.0";
 
   src = fetchFromGitHub {
     owner = "chirpstack";
     repo = "chirpstack-rest-api";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-utXayqQGlBYzmf7xW+s1Fh4oRhpBdfnV5g73X2ILKko=";
+    hash = "sha256-d8DoU5iqBtWLu8I0xzM8+ny16iylAbjRku7EC1m0o50=";
   };
 
-  vendorHash = "sha256-JnQaClgU+Yyz07lELoEyLYHLJwcmET5SLci2XQoFGKc=";
+  vendorHash = "sha256-b0m3a0U/XgRFR1lvfOUB1yQFZZ9j558WBiymnysjuGg=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/co/cog/package.nix b/pkgs/by-name/co/cog/package.nix
index b53772303623..c1e921859831 100644
--- a/pkgs/by-name/co/cog/package.nix
+++ b/pkgs/by-name/co/cog/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "cog";
-  version = "0.1.11";
+  version = "0.1.12";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "cog";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ruJxlpem++V7Q39QenvGG7LUuyn3Oqlb3v10H8rdAxA=";
+    hash = "sha256-6W8b3hgBASpizFoQqP0zw3TqdPmhJ6gZFXxaPfnIiS0=";
   };
 
   vendorHash = "sha256-WR/dfwNBduRokPGAljnXNgA2ZKoYRGtZ3+tKBzCuXI4=";
diff --git a/pkgs/by-name/co/coroot/package.nix b/pkgs/by-name/co/coroot/package.nix
index df3f4af94c53..aa3966a12955 100644
--- a/pkgs/by-name/co/coroot/package.nix
+++ b/pkgs/by-name/co/coroot/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "coroot";
-  version = "1.19.7";
+  version = "1.20.2";
 
   src = fetchFromGitHub {
     owner = "coroot";
     repo = "coroot";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-eMN0n+kXN49o7oCjWAa3kPDAEksvGroRLrfFEVdPORE=";
+    hash = "sha256-c+O0nV9b1hSKP+/atJpUihr8ZkMNCwIok4Ldmm+ivmA=";
   };
 
-  vendorHash = "sha256-DCdrE8UYkuUN+rUuxVSGbAnAeLivZ2Xp8xjM+56ZF+A=";
+  vendorHash = "sha256-npMQah59pJqF6wgD2dlEleneIZbP/atDGEpjjb+KCpI=";
   npmDeps = fetchNpmDeps {
     src = "${finalAttrs.src}/front";
     hash = "sha256-5N4dmtKdZgwulqxFHYKhnHOYAg0gnb/rzVVcmzjYFUg=";
diff --git a/pkgs/by-name/co/couchbase-shell/package.nix b/pkgs/by-name/co/couchbase-shell/package.nix
index 77b02de72628..421ec259bca8 100644
--- a/pkgs/by-name/co/couchbase-shell/package.nix
+++ b/pkgs/by-name/co/couchbase-shell/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "couchbase-shell";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "couchbaselabs";
     repo = "couchbase-shell";
     rev = "v${version}";
-    hash = "sha256-sxKf0AdUpV3SgGkXYQSJn5q+l2NrxvWxrFQvzAt1PVo=";
+    hash = "sha256-t4y0VxjRaJ5G/vpqq3/oLE/pIXSDAk+l+9fCcr9n6I4=";
   };
 
-  cargoHash = "sha256-o9bfbmtPROU9XD1R6pLrH4UK5OE92RWu2fpekWcrexY=";
+  cargoHash = "sha256-f2WYczO2kr5BloXGLjjlnmyaKlr9+IH7i8cqGFUEcVA=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/cp/cpm-cmake/package.nix b/pkgs/by-name/cp/cpm-cmake/package.nix
index 135069bc8124..cdb059ce9fe4 100644
--- a/pkgs/by-name/cp/cpm-cmake/package.nix
+++ b/pkgs/by-name/cp/cpm-cmake/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cpm-cmake";
-  version = "0.42.1";
+  version = "0.42.3";
 
   src = fetchFromGitHub {
     owner = "cpm-cmake";
     repo = "cpm.cmake";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-IVlONpApZJOcm6ooC+mguBEgAevzqiynrabSYdq+SDA=";
+    hash = "sha256-zNjcUbgz9ZQMbddTOis7BLeJqHmWqvEYTko4Z5PiHn8=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/cr/crossmacro/package.nix b/pkgs/by-name/cr/crossmacro/package.nix
index 7ce53fca1090..7aebef90e69d 100644
--- a/pkgs/by-name/cr/crossmacro/package.nix
+++ b/pkgs/by-name/cr/crossmacro/package.nix
@@ -3,6 +3,7 @@
   buildDotnetModule,
   dotnetCorePackages,
   fetchFromGitHub,
+  installShellFiles,
   nix-update-script,
   fontconfig,
   freetype,
@@ -14,8 +15,6 @@
   libxcursor,
   libxext,
   libxrandr,
-  libxrender,
-  libxfixes,
   libxtst,
   libglvnd,
   mesa,
@@ -66,8 +65,6 @@ buildDotnetModule rec {
     libxcursor
     libxext
     libxrandr
-    libxrender
-    libxfixes
     libxtst
     glib
     libglvnd
@@ -76,7 +73,11 @@ buildDotnetModule rec {
     libxkbcommon
   ];
 
+  nativeBuildInputs = [ installShellFiles ];
+
   postInstall = ''
+    installManPage docs/man/crossmacro.1
+
     install -Dm644 scripts/assets/CrossMacro.desktop $out/share/applications/crossmacro.desktop
 
     for size in 16 32 48 64 128 256 512; do
@@ -97,7 +98,7 @@ buildDotnetModule rec {
     description = "Cross-platform mouse and keyboard macro recorder and player";
     homepage = "https://github.com/alper-han/CrossMacro";
     changelog = "https://github.com/alper-han/CrossMacro/releases/tag/v${version}";
-    license = lib.licenses.gpl3Plus;
+    license = lib.licenses.gpl3Only;
     platforms = lib.platforms.linux;
     mainProgram = "crossmacro";
     maintainers = with lib.maintainers; [ alper-han ];
diff --git a/pkgs/by-name/da/dasel/package.nix b/pkgs/by-name/da/dasel/package.nix
index 7b4b525cd8dc..06638a5e4090 100644
--- a/pkgs/by-name/da/dasel/package.nix
+++ b/pkgs/by-name/da/dasel/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "dasel";
-  version = "3.8.0";
+  version = "3.8.1";
 
   src = fetchFromGitHub {
     owner = "TomWright";
     repo = "dasel";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-DbVeO59k1LUSVZvcCon6vWBoaCoZRpo5xIdTHfCsB0I=";
+    hash = "sha256-/rQItj+nCr/IriT4Lgbxe+d9XfAyyZM+Q0nM0F3s//M=";
   };
 
-  vendorHash = "sha256-hHxEE0xNSP4wnT5B13BAxUPpdIWs8v7KF1MuISfaYBE=";
+  vendorHash = "sha256-oqGUHPnfCxgUTueB1zEJ8/h0L+2oxoVQHI+oJm3HcPo=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/de/deezer-desktop/package.nix b/pkgs/by-name/de/deezer-desktop/package.nix
index 774b07883efd..ed5f26625d17 100644
--- a/pkgs/by-name/de/deezer-desktop/package.nix
+++ b/pkgs/by-name/de/deezer-desktop/package.nix
@@ -8,15 +8,15 @@
 }:
 
 let
-  version = "7.1.180";
+  version = "7.1.190";
   srcs = {
     x86_64-linux = fetchurl {
       url = "https://github.com/aunetx/deezer-linux/releases/download/v${version}/deezer-desktop-${version}-x64.tar.xz";
-      hash = "sha256-HH8IpdZ8qL0TZ1NWV6+yrcUYB0JRSkmnmjSTei+xVSE=";
+      hash = "sha256-XoZRlFMiN5VVp3vkTwGDMekhW1KzmvuN9oYTXZFn6B4=";
     };
     aarch64-linux = fetchurl {
       url = "https://github.com/aunetx/deezer-linux/releases/download/v${version}/deezer-desktop-${version}-arm64.tar.xz";
-      hash = "sha256-lu3suopnNbLwzDSqSOUS/6QRHz8QCRzuAdG4oXtF+LI=";
+      hash = "sha256-ChPuz8wd3SOxRmxM5bEbz3paBw7pfIVfSY23nasRI4A=";
     };
   };
 
diff --git a/pkgs/by-name/de/devcontainer/package.nix b/pkgs/by-name/de/devcontainer/package.nix
index a7c77efb7c95..d51c01cde29f 100644
--- a/pkgs/by-name/de/devcontainer/package.nix
+++ b/pkgs/by-name/de/devcontainer/package.nix
@@ -16,18 +16,18 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "devcontainer";
-  version = "0.86.0";
+  version = "0.87.0";
 
   src = fetchFromGitHub {
     owner = "devcontainers";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LVvd6BirKwGUWqTG50U7tnXjPwyUVgxVkAoAdCyiQfk=";
+    hash = "sha256-bTJoMQnjmiFzUuaz+dukZ5NP9RznCNvvjmkTTY/Frwc=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-h13YptkTbORwB8XRDGmmcnFSjZO7icwlqRC3U4qlJ2g=";
+    hash = "sha256-AgwXCWogxVDaeiv8dUBvbsLLxLDrkYqb0HPFORd3ieQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/de/devenv/package.nix b/pkgs/by-name/de/devenv/package.nix
index 99d276e666d3..0ad340545046 100644
--- a/pkgs/by-name/de/devenv/package.nix
+++ b/pkgs/by-name/de/devenv/package.nix
@@ -24,7 +24,7 @@
 }:
 
 let
-  version = "2.1.1";
+  version = "2.1.2";
   devenvNixVersion = "2.34";
   devenvNixRev = "42d4b7de21c15f28c568410f4383fa06a8458a40";
 
@@ -49,11 +49,11 @@ rustPlatform.buildRustPackage {
   src = fetchFromGitHub {
     owner = "cachix";
     repo = "devenv";
-    tag = "v2.1.1";
-    hash = "sha256-j+Vh1tQx+JQc6psaykHUX8rFpnHHvJdwHo4bVUswTxg=";
+    tag = "v2.1.2";
+    hash = "sha256-EQnZCy7r4VMO6KDoytxHBa0mFbM1D9g1kaDfs/s0YZA=";
   };
 
-  cargoHash = "sha256-rfZ4HAEDiEcNceZ0Pge7s7eOMBvqJkc4HB5vzRSCOWU=";
+  cargoHash = "sha256-uEwxqnLqCFpyV2NbnfuUyVqKrMeVeQzoGQmElaVeGU8=";
 
   env = {
     RUSTFLAGS = "--cfg tracing_unstable";
diff --git a/pkgs/by-name/di/discordo/package.nix b/pkgs/by-name/di/discordo/package.nix
index 41848f37489d..eae6bbcdb429 100644
--- a/pkgs/by-name/di/discordo/package.nix
+++ b/pkgs/by-name/di/discordo/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "discordo";
-  version = "0-unstable-2026-04-30";
+  version = "0-unstable-2026-05-12";
 
   src = fetchFromGitHub {
     owner = "ayn2op";
     repo = "discordo";
-    rev = "be527a152b209b302d506d9cafbf2870f0145d58";
-    hash = "sha256-v3u46r6BlpP0rkahTkaT0h+hCKDe2VaV029Apqt8Zws=";
+    rev = "af65e21854ccb4cb39cafebfd6afbd5f4858a9f0";
+    hash = "sha256-0Eiil0gaLlgQRcLIa2XbBF95+pGNGzAIiFRJ7X0r/W0=";
   };
 
-  vendorHash = "sha256-URBaO9wjCWIoOtux1xYCX/y/6+hKPS6ZEm9HDznKqHs=";
+  vendorHash = "sha256-g/kGDK0QKZZAGczrXtVskqpsbES+MZGiuqycJ8YO6DA=";
 
   env.CGO_ENABLED = 1;
 
diff --git a/pkgs/by-name/do/dolt/package.nix b/pkgs/by-name/do/dolt/package.nix
index e1115895beec..0601eaa2e9c2 100644
--- a/pkgs/by-name/do/dolt/package.nix
+++ b/pkgs/by-name/do/dolt/package.nix
@@ -7,18 +7,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "dolt";
-  version = "1.86.2";
+  version = "1.86.6";
 
   src = fetchFromGitHub {
     owner = "dolthub";
     repo = "dolt";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CXhdt9uIhdSEW3M21pL2WeT+zKPUxyYrU4fGTgMgun4=";
+    hash = "sha256-OVoREOeVTuRMot6nfpxAfnxRFcTLpZWsIRcg/yk/rMg=";
   };
 
   modRoot = "./go";
   subPackages = [ "cmd/dolt" ];
-  vendorHash = "sha256-JdpPKao8LOGzKzzLtfiYh3rUn1OLLcA7YIrztHwTLmU=";
+  vendorHash = "sha256-8Ls+ANNiE1yBgZuAnDp+FcU4rCiWwSKGo2jTjXVbWFo=";
   proxyVendor = true;
   doCheck = false;
 
diff --git a/pkgs/by-name/dr/drumkv1/package.nix b/pkgs/by-name/dr/drumkv1/package.nix
index a24be4d5968a..5488398cd331 100644
--- a/pkgs/by-name/dr/drumkv1/package.nix
+++ b/pkgs/by-name/dr/drumkv1/package.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "drumkv1";
-  version = "1.4.1";
+  version = "1.4.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/drumkv1/drumkv1-${finalAttrs.version}.tar.gz";
-    hash = "sha256-w9/bdK/qjSeBD5hfHQnGFUGDnUqPgdkM8GQ18Ps+nzM=";
+    hash = "sha256-jTOTOziCrycFyMe6wIfUnw7d6p+gNZfO7Q9BcZOyOME=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/er/errcheck/package.nix b/pkgs/by-name/er/errcheck/package.nix
index a2fb5a816181..9f94ce73dc35 100644
--- a/pkgs/by-name/er/errcheck/package.nix
+++ b/pkgs/by-name/er/errcheck/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "errcheck";
-  version = "1.10.0";
+  version = "1.20.0";
 
   src = fetchFromGitHub {
     owner = "kisielk";
     repo = "errcheck";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-aiZAFNTaXSzVOBhcMGc6Mxj208V7WxCbDYKqItBg3lc=";
+    hash = "sha256-bXt0GuXV4Amg8dE261KC8f6C5sOclOzhFj1D4/kaBYs=";
   };
 
-  vendorHash = "sha256-znkT0S13wCB47InP2QBCZqeWxDdEeIwQPoVWoxiAosQ=";
+  vendorHash = "sha256-mhpKZ47jaX3pp/5TOXADip0iPosIDl5FzpaID98rpHQ=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/ex/extract-xiso/package.nix b/pkgs/by-name/ex/extract-xiso/package.nix
new file mode 100644
index 000000000000..c8b6f4bea091
--- /dev/null
+++ b/pkgs/by-name/ex/extract-xiso/package.nix
@@ -0,0 +1,33 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  cmake,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "extract-xiso";
+  version = "202505152050";
+
+  src = fetchFromGitHub {
+    owner = "XboxDev";
+    repo = "extract-xiso";
+    tag = "build-${finalAttrs.version}";
+    hash = "sha256-KZxnS63MhpmzwxCPFi+op5l/vM6P9GYc+SXmNFmEyc8=";
+  };
+
+  buildInputs = [ cmake ];
+
+  doCheck = true;
+
+  meta = {
+    description = "Command line utility created by in to allow the creation, modification, and extraction of XISOs (Xbox ISOs)";
+    homepage = "https://github.com/XboxDev/extract-xiso";
+    license = lib.licenses.bsdOriginal;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [
+      Marker06
+    ];
+  };
+
+})
diff --git a/pkgs/by-name/fa/faustlive/package.nix b/pkgs/by-name/fa/faustlive/package.nix
index 33c9a3553d02..9dab53630b8f 100644
--- a/pkgs/by-name/fa/faustlive/package.nix
+++ b/pkgs/by-name/fa/faustlive/package.nix
@@ -28,25 +28,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "faustlive";
-  version = "2.5.17";
+  version = "2.5.19";
   src = fetchFromGitHub {
     owner = "grame-cncm";
     repo = "faustlive";
     tag = finalAttrs.version;
-    hash = "sha256-RqtdDkP63l/30sL5PDocvpar5TI4LdKfeeliSNeOHog=";
+    hash = "sha256-IBMgesMkT+0Oh1TjHa+bcSp6YziLNBtNPoUCzbyhMFI=";
     fetchSubmodules = true;
   };
 
-  patches = [
-    # move mutex initialization outside assert call
-    # https://github.com/grame-cncm/faustlive/pull/59
-    (fetchpatch {
-      name = "initalize-mutexes.patch";
-      url = "https://github.com/grame-cncm/faustlive/commit/fdd46b12202def9731b9ed2f6363287af16be892.patch";
-      hash = "sha256-yH95Y4Jbqgs8siE9rtutmu5C2sNZwQMJzCgDYqNBDj4=";
-    })
-  ];
-
   strictDeps = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fr/frescobaldi/package.nix b/pkgs/by-name/fr/frescobaldi/package.nix
index 4f8cbd308c0a..e0c0cbaa91b9 100644
--- a/pkgs/by-name/fr/frescobaldi/package.nix
+++ b/pkgs/by-name/fr/frescobaldi/package.nix
@@ -9,14 +9,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "frescobaldi";
-  version = "4.0.4";
+  version = "4.0.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "wbsoft";
     repo = "frescobaldi";
     tag = "v${version}";
-    hash = "sha256-J0QC+VwNdA24vAW5Fx+cz5IFajkB8GmR4Rae0Q+2zw8=";
+    hash = "sha256-IgvjKj0+8oNbuZ91n4O16kGXBS7rS63HQUNQnJcOis8=";
   };
 
   dependencies = with python3Packages; [
diff --git a/pkgs/by-name/fr/frobby/package.nix b/pkgs/by-name/fr/frobby/package.nix
index 83a5ab0e2d41..6f6d351a70d7 100644
--- a/pkgs/by-name/fr/frobby/package.nix
+++ b/pkgs/by-name/fr/frobby/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-
+  fixDarwinDylibNames,
   gmp,
 }:
 stdenv.mkDerivation (finalAttrs: {
@@ -16,6 +16,10 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-LndLfORnypLqFgNMPEJ8jc2Fa2xWWgYS9rZ7gGFbwwo=";
   };
 
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
+    fixDarwinDylibNames
+  ];
+
   buildInputs = [
     gmp
   ];
diff --git a/pkgs/by-name/gd/gdcm/add-missing-losslylosslessarray-in-TestTransferSyntax.patch b/pkgs/by-name/gd/gdcm/add-missing-losslylosslessarray-in-TestTransferSyntax.patch
deleted file mode 100644
index a3701135c510..000000000000
--- a/pkgs/by-name/gd/gdcm/add-missing-losslylosslessarray-in-TestTransferSyntax.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff --git a/Testing/Source/DataStructureAndEncodingDefinition/Cxx/TestTransferSyntax.cxx b/Testing/Source/DataStructureAndEncodingDefinition/Cxx/TestTransferSyntax.cxx
-index 7ad350d..6f962ce 100644
---- a/Testing/Source/DataStructureAndEncodingDefinition/Cxx/TestTransferSyntax.cxx
-+++ b/Testing/Source/DataStructureAndEncodingDefinition/Cxx/TestTransferSyntax.cxx
-@@ -43,6 +43,9 @@ static const int losslylosslessarray[][3] = {
-     { 1, 0, 1 }, //    MPEG2MainProfileHighLevel
-     { 1, 0, 1 }, //    MPEG4AVCH264HighProfileLevel4_1
-     { 1, 0, 1 }, //    MPEG4AVCH264BDcompatibleHighProfileLevel4_1
-+    { 0, 1, 1 }, //    HTJ2KLossless
-+    { 0, 1, 1 }, //    HTJ2KRPCLLossless
-+    { 1, 0, 1 }, //    HTJ2K
- };
- 
- static int TestTransferSyntaxAll()
diff --git a/pkgs/by-name/gd/gdcm/fix-vtk-deprecated-api.patch b/pkgs/by-name/gd/gdcm/fix-vtk-deprecated-api.patch
deleted file mode 100644
index 211226895054..000000000000
--- a/pkgs/by-name/gd/gdcm/fix-vtk-deprecated-api.patch
+++ /dev/null
@@ -1,184 +0,0 @@
-diff --git a/Utilities/VTK/Applications/gdcm2vtk.cxx b/Utilities/VTK/Applications/gdcm2vtk.cxx
-index 344aec0df..c1cd4b43d 100644
---- a/Utilities/VTK/Applications/gdcm2vtk.cxx
-+++ b/Utilities/VTK/Applications/gdcm2vtk.cxx
-@@ -498,7 +498,7 @@ int main(int argc, char *argv[])
-     {
-     imgreader->SetFileLowerLeft( lowerleft );
-     if( names->GetNumberOfValues() == 1 )
--      imgreader->SetFileName( names->GetValue(0) );
-+      imgreader->SetFileName( names->GetValue(0).c_str() );
-     else
-       imgreader->SetFileNames(names);
-     imgreader->Update();
-diff --git a/Utilities/VTK/Applications/gdcmviewer.cxx b/Utilities/VTK/Applications/gdcmviewer.cxx
-index 3ed4778f8..58236a6a5 100644
---- a/Utilities/VTK/Applications/gdcmviewer.cxx
-+++ b/Utilities/VTK/Applications/gdcmviewer.cxx
-@@ -321,7 +321,7 @@ void ExecuteViewer(TViewer *viewer, vtkStringArray *filenames)
-   vtkGDCMImageReader *reader = vtkGDCMImageReader::New();
-   if( filenames->GetSize() == 1 ) // Backward compatible...
-     {
--    reader->SetFileName( filenames->GetValue(0) );
-+    reader->SetFileName( filenames->GetValue(0).c_str() );
-     }
-   else
-     {
-diff --git a/Utilities/VTK/Testing/Cxx/TestvtkGDCMImageWriter2.cxx b/Utilities/VTK/Testing/Cxx/TestvtkGDCMImageWriter2.cxx
-index fa1d7d895..00d9f3845 100644
---- a/Utilities/VTK/Testing/Cxx/TestvtkGDCMImageWriter2.cxx
-+++ b/Utilities/VTK/Testing/Cxx/TestvtkGDCMImageWriter2.cxx
-@@ -113,7 +113,7 @@ int TestvtkGDCMImageWrite2(const char *filename, bool verbose = false)
-     // Need to check we can still read those files back:
-     for(int file=0; file<filenames->GetNumberOfValues(); ++file)
-       {
--      const char *fname = filenames->GetValue(file);
-+      const char *fname = filenames->GetValue(file).c_str();
-       gdcm::ImageReader r;
-       //r.SetFileName( gdcmfile.c_str() );
-       r.SetFileName( fname );
-diff --git a/Utilities/VTK/Testing/Cxx/TestvtkGDCMThreadedImageReader.cxx b/Utilities/VTK/Testing/Cxx/TestvtkGDCMThreadedImageReader.cxx
-index 8b253ec83..1c83ed417 100644
---- a/Utilities/VTK/Testing/Cxx/TestvtkGDCMThreadedImageReader.cxx
-+++ b/Utilities/VTK/Testing/Cxx/TestvtkGDCMThreadedImageReader.cxx
-@@ -170,7 +170,7 @@ int TestvtkGDCMThreadedImageRead(const char *filename, bool verbose = false)
-     assert( sarray->GetNumberOfValues() == (int)nfiles );
-     reader->SetFileNames( sarray );
-     sarray->Delete();
--    refimage = sarray->GetValue( 0 ); // Ok since sarray is ref count
-+    refimage = sarray->GetValue( 0 ).c_str(); // Ok since sarray is ref count
-     }
-   else
-     {
-diff --git a/Utilities/VTK/Testing/Cxx/TestvtkGDCMThreadedImageReader2.cxx b/Utilities/VTK/Testing/Cxx/TestvtkGDCMThreadedImageReader2.cxx
-index 5151893e8..22dd4fd57 100644
---- a/Utilities/VTK/Testing/Cxx/TestvtkGDCMThreadedImageReader2.cxx
-+++ b/Utilities/VTK/Testing/Cxx/TestvtkGDCMThreadedImageReader2.cxx
-@@ -160,7 +160,7 @@ int TestvtkGDCMThreadedImageRead2(const char *filename, bool verbose = false)
-     assert( sarray->GetNumberOfValues() == (int)nfiles );
-     reader->SetFileNames( sarray );
-     sarray->Delete();
--    refimage = sarray->GetValue( 0 ); // Ok since sarray is ref count
-+    refimage = sarray->GetValue( 0 ).c_str(); // Ok since sarray is ref count
-     }
-   else
-     {
-diff --git a/Utilities/VTK/vtkGDCMImageReader.cxx b/Utilities/VTK/vtkGDCMImageReader.cxx
-index c62034300..463c3879b 100644
---- a/Utilities/VTK/vtkGDCMImageReader.cxx
-+++ b/Utilities/VTK/vtkGDCMImageReader.cxx
-@@ -608,7 +608,7 @@ ComputePixelTypeFromFiles(const char *inputfilename, vtkStringArray *filenames,
-     // FIXME a gdcm::Scanner would be much faster here:
-     for(int i = 0; i < filenames->GetNumberOfValues(); ++i )
-       {
--      const char *filename = filenames->GetValue( i );
-+      const char *filename = filenames->GetValue( i ).c_str();
-       gdcm::ImageReader reader;
-       reader.SetFileName( filename );
-       if( !reader.Read() )
-@@ -703,7 +703,7 @@ int vtkGDCMImageReader::RequestInformationCompat()
-     }
-   else if ( this->FileNames && this->FileNames->GetNumberOfValues() > 0 )
-     {
--    filename = this->FileNames->GetValue( 0 );
-+    filename = this->FileNames->GetValue( 0 ).c_str();
-     }
-   else
-     {
-@@ -1459,7 +1459,7 @@ int vtkGDCMImageReader::RequestDataCompat()
-     for(int j = dext[4]; !this->AbortExecute && j <= dext[5]; ++j)
-       {
-       assert( j >= 0 && j <= this->FileNames->GetNumberOfValues() );
--      const char *filename = this->FileNames->GetValue( j );
-+      const char *filename = this->FileNames->GetValue( j ).c_str();
-       int load = this->LoadSingleFile( filename, pointer, len );
-       if( !load )
-         {
-diff --git a/Utilities/VTK/vtkGDCMImageReader2.cxx b/Utilities/VTK/vtkGDCMImageReader2.cxx
-index 266c1270a..4976f0190 100644
---- a/Utilities/VTK/vtkGDCMImageReader2.cxx
-+++ b/Utilities/VTK/vtkGDCMImageReader2.cxx
-@@ -388,7 +388,7 @@ ComputePixelTypeFromFiles(const char *inputfilename, vtkStringArray *filenames,
-     // FIXME a gdcm::Scanner would be much faster here:
-     for(int i = 0; i < filenames->GetNumberOfValues(); ++i )
-       {
--      const char *filename = filenames->GetValue( i );
-+      const char *filename = filenames->GetValue( i ).c_str();
-       gdcm::ImageReader reader;
-       reader.SetFileName( filename );
-       if( !reader.Read() )
-@@ -480,7 +480,7 @@ int vtkGDCMImageReader2::RequestInformationCompat()
-     }
-   else if ( this->FileNames && this->FileNames->GetNumberOfValues() > 0 )
-     {
--    filename = this->FileNames->GetValue( 0 );
-+    filename = this->FileNames->GetValue( 0 ).c_str();
-     }
-   else
-     {
-@@ -1177,7 +1177,7 @@ int vtkGDCMImageReader2::RequestDataCompat()
-     for(int j = outExt[4]; !this->AbortExecute && j <= outExt[5]; ++j)
-       {
-       assert( j >= 0 && j <= this->FileNames->GetNumberOfValues() );
--      const char *filename = this->FileNames->GetValue( j );
-+      const char *filename = this->FileNames->GetValue( j ).c_str();
-       int load = this->LoadSingleFile( filename, pointer, len );
-       vtkDebugMacro( "LoadSingleFile: " << filename );
-       if( !load )
-diff --git a/Utilities/VTK/vtkGDCMImageWriter.cxx b/Utilities/VTK/vtkGDCMImageWriter.cxx
-index 37e1245a5..e723d15b7 100644
---- a/Utilities/VTK/vtkGDCMImageWriter.cxx
-+++ b/Utilities/VTK/vtkGDCMImageWriter.cxx
-@@ -255,7 +255,7 @@ int vtkGDCMImageWriter::RequestData(
- {
-   if( this->FileNames->GetNumberOfValues() )
-     {
--    const char *filename = this->FileNames->GetValue(0);
-+    const char *filename = this->FileNames->GetValue(0).c_str();
-     return const_cast<char*>(filename);
-     }
-   return this->Superclass::GetFileName();
-@@ -1148,7 +1148,7 @@ int vtkGDCMImageWriter::WriteGDCMData(vtkImageData *data, int timeStep)
-   if( this->FileNames->GetNumberOfValues() )
-     {
-     //int n = this->FileNames->GetNumberOfValues();
--    filename = this->FileNames->GetValue(k);
-+    filename = this->FileNames->GetValue(k).c_str();
-     }
-   else
-     {
-diff --git a/Utilities/VTK/vtkGDCMThreadedImageReader.cxx b/Utilities/VTK/vtkGDCMThreadedImageReader.cxx
-index d50a3fee2..c531b8854 100644
---- a/Utilities/VTK/vtkGDCMThreadedImageReader.cxx
-+++ b/Utilities/VTK/vtkGDCMThreadedImageReader.cxx
-@@ -592,7 +592,7 @@ void vtkGDCMThreadedImageReader::RequestDataCompat()
-     const char **filenames = new const char* [ nfiles ];
-     for(unsigned int i = 0; i < nfiles; ++i)
-       {
--      filenames[i] = this->FileNames->GetValue( i );
-+      filenames[i] = this->FileNames->GetValue( i ).c_str();
-       //std::cerr << filenames[i] << std::endl;
-       }
-     ReadFiles((unsigned int)nfiles, filenames);
-diff --git a/Utilities/VTK/vtkGDCMThreadedImageReader2.cxx b/Utilities/VTK/vtkGDCMThreadedImageReader2.cxx
-index 2e6a2e932..72ce6453c 100644
---- a/Utilities/VTK/vtkGDCMThreadedImageReader2.cxx
-+++ b/Utilities/VTK/vtkGDCMThreadedImageReader2.cxx
-@@ -71,7 +71,7 @@ vtkGDCMThreadedImageReader2::~vtkGDCMThreadedImageReader2()
- //----------------------------------------------------------------------------
- const char *vtkGDCMThreadedImageReader2::GetFileName(int i)
- {
--  return this->FileNames->GetValue( i );
-+  return this->FileNames->GetValue( i ).c_str();
- }
- 
- //----------------------------------------------------------------------------
-@@ -106,7 +106,7 @@ void vtkGDCMThreadedImageReader2Execute(vtkGDCMThreadedImageReader2 *self,
-   for( int i = outExt[4]; i <= outExt[5] && i < maxfiles; ++i )
-     {
-     assert( i < maxfiles );
--    const char *filename = self->GetFileNames()->GetValue( i );
-+    const char *filename = self->GetFileNames()->GetValue( i ).c_str();
-     //ReadOneFile( filename );
-     //outData->GetPointData()->GetScalars()->SetName("GDCMImage");
- 
diff --git a/pkgs/by-name/gd/gdcm/package.nix b/pkgs/by-name/gd/gdcm/package.nix
index e2241dfa9340..731f569d38b4 100644
--- a/pkgs/by-name/gd/gdcm/package.nix
+++ b/pkgs/by-name/gd/gdcm/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch2,
   cmake,
   enableVTK ? true,
   vtk,
@@ -20,22 +19,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = if enablePython then "python-gdcm" else "gdcm";
-  version = "3.2.2";
+  version = "3.2.6";
 
   src = fetchFromGitHub {
     owner = "malaterre";
     repo = "GDCM";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iUJrXcVHdCmL5atm6in4KvgPXbYmAYFxM6TGoZeY9EE=";
+    hash = "sha256-8ZNq89a369mm/hPe0tywo4Tqzt65Xhb0pbEguy8CSsA=";
   };
 
-  patches = [
-    ./add-missing-losslylosslessarray-in-TestTransferSyntax.patch
-    # Fix vtk deprecated api, See https://docs.vtk.org/en/latest/release_details/9.3.html#id13.
-    # Upstream mailing list: https://sourceforge.net/p/gdcm/mailman/message/59197515.
-    ./fix-vtk-deprecated-api.patch
-  ];
-
   cmakeFlags = [
     "-DGDCM_BUILD_APPLICATIONS=ON"
     "-DGDCM_BUILD_SHARED_LIBS=ON"
diff --git a/pkgs/by-name/gi/git-pkgs/package.nix b/pkgs/by-name/gi/git-pkgs/package.nix
index dbc10988424e..f304f36bfb41 100644
--- a/pkgs/by-name/gi/git-pkgs/package.nix
+++ b/pkgs/by-name/gi/git-pkgs/package.nix
@@ -7,16 +7,16 @@
 }:
 buildGoModule rec {
   pname = "git-pkgs";
-  version = "0.15.4";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "git-pkgs";
     repo = "git-pkgs";
     tag = "v${version}";
-    hash = "sha256-/egkYzrRtYy94fRDDEsFFTj+c0yorm8REaqedQSJyEw=";
+    hash = "sha256-5fo4Zvh5ho8WefDv3bV5sVi9j3RwHWP4+ShigqDOUl8=";
   };
 
-  vendorHash = "sha256-eVa2tNLy2Oul1Uqq5Bf1arvjvH9ic24rc6NBDPu1gvk=";
+  vendorHash = "sha256-GPtw+iCUH5/V13WNSvmktchXOz0PGW5ckhCqpiRhHLQ=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/gi/githooks/package.nix b/pkgs/by-name/gi/githooks/package.nix
index 589ea0e014b5..cfc7f23c4f97 100644
--- a/pkgs/by-name/gi/githooks/package.nix
+++ b/pkgs/by-name/gi/githooks/package.nix
@@ -9,17 +9,17 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "githooks";
-  version = "3.0.5";
+  version = "3.0.6";
 
   src = fetchFromGitHub {
     owner = "gabyx";
     repo = "githooks";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-aVrMM7gZF7o6WR2/8SEsfLFsqTSbXpr7UtcSB+eO/oQ=";
+    hash = "sha256-aRv8zSTnpoQfhajagMKT0rpOmNWt0X4jiKv0kS6cQUE=";
   };
 
   modRoot = "./githooks";
-  vendorHash = "sha256-ZcDD4Z/thtyCvXg6GzzKC/FSbh700QEaqXU8FaZaZc4=";
+  vendorHash = "sha256-ULPbM/6DqyVPwq68MnpVesS3w1uxKBbVIZ7i5Kng+1Y=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/gm/gmt/package.nix b/pkgs/by-name/gm/gmt/package.nix
index 092f9b7f7b5b..547b97466567 100644
--- a/pkgs/by-name/gm/gmt/package.nix
+++ b/pkgs/by-name/gm/gmt/package.nix
@@ -7,7 +7,7 @@
   apple-sdk,
   fftwSinglePrec,
   netcdf,
-  pcre,
+  pcre2,
   gdal,
   blas,
   lapack,
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
     curl
     gdal
     netcdf
-    pcre
+    pcre2
     dcw-gmt
     gshhg-gmt
   ]
@@ -64,7 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeFeature "DCW_ROOT" "${dcw-gmt.out}/share/dcw-gmt")
     (lib.cmakeFeature "GDAL_ROOT" "${gdal.out}")
     (lib.cmakeFeature "NETCDF_ROOT" "${netcdf.out}")
-    (lib.cmakeFeature "PCRE_ROOT" "${pcre.out}")
+    (lib.cmakeFeature "PCRE2_ROOT" "${pcre2.out}")
     (lib.cmakeBool "GMT_INSTALL_TRADITIONAL_FOLDERNAMES" false)
     (lib.cmakeBool "GMT_ENABLE_OPENMP" true)
     (lib.cmakeBool "GMT_INSTALL_MODULE_LINKS" false)
diff --git a/pkgs/by-name/hi/hidden-bar/package.nix b/pkgs/by-name/hi/hidden-bar/package.nix
index d31f06643990..9c988082070b 100644
--- a/pkgs/by-name/hi/hidden-bar/package.nix
+++ b/pkgs/by-name/hi/hidden-bar/package.nix
@@ -2,16 +2,16 @@
   lib,
   stdenvNoCC,
   fetchurl,
-  undmg,
+  unzip,
 }:
 
 stdenvNoCC.mkDerivation rec {
   pname = "hidden-bar";
-  version = "1.9";
+  version = "1.10";
 
   src = fetchurl {
-    url = "https://github.com/dwarvesf/hidden/releases/download/v${version}/Hidden.Bar.${version}.dmg";
-    hash = "sha256-P1SwJPXBxAvBiuvjkBRxAom0fhR+cVYfriKmYcqybQI=";
+    url = "https://github.com/dwarvesf/hidden/releases/download/v${version}/Hidden-Bar-v${version}-macos.zip";
+    hash = "sha256-qKX1KZ/fq1K9/7L1cop21MumkHVOmzsS8nvTjy52wLw=";
   };
 
   sourceRoot = ".";
@@ -25,7 +25,7 @@ stdenvNoCC.mkDerivation rec {
     runHook postInstall
   '';
 
-  nativeBuildInputs = [ undmg ];
+  nativeBuildInputs = [ unzip ];
 
   meta = {
     description = "Ultra-light MacOS utility that helps hide menu bar icons";
diff --git a/pkgs/by-name/ho/honeycomb-refinery/package.nix b/pkgs/by-name/ho/honeycomb-refinery/package.nix
index 61a61079036d..20482c4f51bd 100644
--- a/pkgs/by-name/ho/honeycomb-refinery/package.nix
+++ b/pkgs/by-name/ho/honeycomb-refinery/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "honeycomb-refinery";
-  version = "3.2.0";
+  version = "3.2.1";
 
   src = fetchFromGitHub {
     owner = "honeycombio";
     repo = "refinery";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-8UzFoIxi9Vvf5/67rFsED/XTOz1pGeyxyuvLlTO7mVc=";
+    hash = "sha256-2avpxXlphqCNLeuTwskZKML/Dp5igm/qexq44lk8ne8=";
   };
 
   env.NO_REDIS_TEST = true;
@@ -37,7 +37,7 @@ buildGoModule (finalAttrs: {
     "-X main.BuildID=${finalAttrs.version}"
   ];
 
-  vendorHash = "sha256-nzz4SdJnISM6/yCgwelg2w7wlPBInQU1YizT5Ds2z5Y=";
+  vendorHash = "sha256-PBNL6oL3X+zaom2vbPJ0WuH9syZqWw4WXWbUqu/mtH0=";
 
   doCheck = true;
 
diff --git a/pkgs/applications/graphics/imlibsetroot/default.nix b/pkgs/by-name/im/imlibsetroot/package.nix
similarity index 100%
rename from pkgs/applications/graphics/imlibsetroot/default.nix
rename to pkgs/by-name/im/imlibsetroot/package.nix
diff --git a/pkgs/by-name/in/infrastructure-agent/package.nix b/pkgs/by-name/in/infrastructure-agent/package.nix
index 9412baefe3ee..2abcd941c5ff 100644
--- a/pkgs/by-name/in/infrastructure-agent/package.nix
+++ b/pkgs/by-name/in/infrastructure-agent/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "infrastructure-agent";
-  version = "1.74.2";
+  version = "1.74.4";
 
   src = fetchFromGitHub {
     owner = "newrelic";
     repo = "infrastructure-agent";
     rev = finalAttrs.version;
-    hash = "sha256-8viB1wHkoPF1WSEcfay3KHGgakW6coCP4jHtJTGFAAs=";
+    hash = "sha256-T7DXHbI2aK6/nx6bYJEEcr2GRBo9+NnB9yami1SN528=";
   };
 
   vendorHash = "sha256-xkoNVXRm8OkVd2f3cSFE1QIF6EHhh8AQh/YZYt22+MU=";
diff --git a/pkgs/by-name/it/iterm2/update.sh b/pkgs/by-name/it/iterm2/update.sh
index 8a36786c47f4..8533f87ee047 100755
--- a/pkgs/by-name/it/iterm2/update.sh
+++ b/pkgs/by-name/it/iterm2/update.sh
@@ -4,12 +4,12 @@ set -eu -o pipefail
 
 currentVersion=$(nix-instantiate --eval -E "with import ./. {}; iterm2.version or (lib.getVersion iterm2)" | tr -d '"')
 
-downloadUrl=$(
+downloadUrls=$(
   curl -sL "https://iterm2.com/downloads.html" |
   grep -o -E 'href="[^"]*iTerm2[^"]*\.zip"' |
-  sed 's/href="//;s/"//' |
-  head -1
+  sed 's/href="//;s/"//'
 )
+downloadUrl=$(echo "$downloadUrls" | head -1)
 
 if [[ -z "$downloadUrl" ]]; then
   echo >&2 "Failed to extract download url from iTerm2 downloads page"
diff --git a/pkgs/development/libraries/jkqtplotter/default.nix b/pkgs/by-name/jk/jkqtplotter/package.nix
similarity index 100%
rename from pkgs/development/libraries/jkqtplotter/default.nix
rename to pkgs/by-name/jk/jkqtplotter/package.nix
diff --git a/pkgs/by-name/k8/k8sgpt/package.nix b/pkgs/by-name/k8/k8sgpt/package.nix
index 7c6cb3d29cd1..de88e4ab38c4 100644
--- a/pkgs/by-name/k8/k8sgpt/package.nix
+++ b/pkgs/by-name/k8/k8sgpt/package.nix
@@ -8,7 +8,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "k8sgpt";
-  version = "0.4.32";
+  version = "0.4.33";
 
   nativeBuildInputs = [
     installShellFiles
@@ -18,10 +18,10 @@ buildGoModule (finalAttrs: {
     owner = "k8sgpt-ai";
     repo = "k8sgpt";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-qBo5Yi16c9oyZQObaP7Y1AM7MXcgvfz4wE0VJqyVfxE=";
+    hash = "sha256-nr/Cl416ENwrbVGYaAxuOQsYkRWpx/CCM2gIZ2z/I9c=";
   };
 
-  vendorHash = "sha256-rTHy/z2fGT6S4FX4StatxiD2Nbtqbgsqn3N0MA+oscA=";
+  vendorHash = "sha256-7Kvj1BaiR4wrGjzR54f+Qe+PdOrLjD2noaRPaX/Yuos=";
 
   # https://nixos.org/manual/nixpkgs/stable/#var-go-CGO_ENABLED
   env.CGO_ENABLED = 0;
diff --git a/pkgs/by-name/ka/kaniko/package.nix b/pkgs/by-name/ka/kaniko/package.nix
index 0ab36183edca..d69cc0b7437c 100644
--- a/pkgs/by-name/ka/kaniko/package.nix
+++ b/pkgs/by-name/ka/kaniko/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "kaniko";
-  version = "1.25.14";
+  version = "1.25.15";
 
   src = fetchFromGitHub {
     owner = "chainguard-dev";
     repo = "kaniko";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-V6kIEuHYHV3XfuW7Jd/XmPy0XQX449rMH5YxbTtCvZo=";
+    hash = "sha256-0d0QdNmR7FaybJJEq6bb9WshTg6dX3HtO9oESg1e4S4=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ke/kent/package.nix b/pkgs/by-name/ke/kent/package.nix
index 741bc115629e..c1c94e345c30 100644
--- a/pkgs/by-name/ke/kent/package.nix
+++ b/pkgs/by-name/ke/kent/package.nix
@@ -19,13 +19,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "kent";
-  version = "492";
+  version = "497";
 
   src = fetchFromGitHub {
     owner = "ucscGenomeBrowser";
     repo = "kent";
     tag = "v${finalAttrs.version}_base";
-    hash = "sha256-heeEv7zRG3DTQ1dER7f+OjeS+KHVOUq0Z7MAf7Vsw7s=";
+    hash = "sha256-VXm/JwudwNqZhwp7iC/BjQ/grc+9kOFn/t43ceayC4c=";
   };
 
   nativeBuildInputs = [ writableTmpDirAsHomeHook ];
diff --git a/pkgs/by-name/ke/keyd/package.nix b/pkgs/by-name/ke/keyd/package.nix
index 406f3d2fe3c5..7eeb3ad62f87 100644
--- a/pkgs/by-name/ke/keyd/package.nix
+++ b/pkgs/by-name/ke/keyd/package.nix
@@ -2,12 +2,11 @@
   stdenv,
   lib,
   fetchFromGitHub,
-  systemd,
   runtimeShell,
-  python3,
+  python3Packages,
   nixosTests,
+  versionCheckHook,
 }:
-
 let
   version = "2.6.0";
 
@@ -18,28 +17,26 @@ let
     hash = "sha256-l7yjGpicX1ly4UwF7gcOTaaHPRnxVUMwZkH70NDLL5M=";
   };
 
-  pypkgs = python3.pkgs;
-
-  appMap = pypkgs.buildPythonApplication rec {
+  appMap = python3Packages.buildPythonApplication (finalAttrs: {
     pname = "keyd-application-mapper";
     inherit version src;
     pyproject = false;
 
     postPatch = ''
-      substituteInPlace scripts/${pname} \
+      substituteInPlace scripts/${finalAttrs.pname} \
         --replace-fail /bin/sh ${runtimeShell}
     '';
 
-    propagatedBuildInputs = with pypkgs; [ xlib ];
+    propagatedBuildInputs = with python3Packages; [ xlib ];
 
     dontBuild = true;
 
     installPhase = ''
-      install -Dm555 -t $out/bin scripts/${pname}
+      install -Dm555 -t $out/bin scripts/${finalAttrs.pname}
     '';
 
     meta.mainProgram = "keyd-application-mapper";
-  };
+  });
 
 in
 stdenv.mkDerivation {
@@ -56,13 +53,11 @@ stdenv.mkDerivation {
 
   installFlags = [ "DESTDIR=${placeholder "out"}" ];
 
-  buildInputs = [ systemd ];
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
 
   enableParallelBuilding = true;
 
-  # post-2.4.2 may need this to unbreak the test
-  # makeFlags = [ "SOCKET_PATH/run/keyd/keyd.socket" ];
-
   postInstall = ''
     ln -sf ${lib.getExe appMap} $out/bin/${appMap.pname}
     rm -rf $out/etc
@@ -74,6 +69,7 @@ stdenv.mkDerivation {
     description = "Key remapping daemon for Linux";
     homepage = "https://github.com/rvaiya/keyd";
     license = lib.licenses.mit;
+    mainProgram = "keyd";
     maintainers = with lib.maintainers; [ alfarel ];
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/by-name/ki/kicad/versions.nix b/pkgs/by-name/ki/kicad/versions.nix
index 55ecccb5e360..d937edc0a41e 100644
--- a/pkgs/by-name/ki/kicad/versions.nix
+++ b/pkgs/by-name/ki/kicad/versions.nix
@@ -25,14 +25,14 @@
   };
   "kicad-testing" = {
     kicadVersion = {
-      version = "10.0-2026-05-09";
+      version = "10.0-2026-05-12";
       src = {
-        rev = "58a1e6556bf606cbc8da10733db8a9801cdfade3";
-        sha256 = "1myln0iyl3z4s9h8867rr4zjka9xw04gdl29pqgj8ivjpm8gxw95";
+        rev = "5a1300d8f11d154edd892a444d3dd0cc7c60fe5a";
+        sha256 = "0vhp63jd2j9pns3sdfi4i9220gs29nf068z202dnikv4dqn7wz4h";
       };
     };
     libVersion = {
-      version = "10.0-2026-05-09";
+      version = "10.0-2026-05-12";
       libSources = {
         symbols.rev = "f31042c9759771f10754f02e54344dee750692b1";
         symbols.sha256 = "05h8dbygch2kp4s5ikspxngwv999j7jwsiwm4pzwwcrir7dqzdfl";
diff --git a/pkgs/by-name/kn/kn/package.nix b/pkgs/by-name/kn/kn/package.nix
index b1b4ea590546..8e683a1220b5 100644
--- a/pkgs/by-name/kn/kn/package.nix
+++ b/pkgs/by-name/kn/kn/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "kn";
-  version = "1.20.0";
+  version = "1.22.0";
 
   src = fetchFromGitHub {
     owner = "knative";
     repo = "client";
     tag = "knative-v${finalAttrs.version}";
-    hash = "sha256-rElNlb3NfbOZjCMWT2efknWM9B0+BFa5CCNmcA6afPY=";
+    hash = "sha256-G5kadNskSwKBxSuvs58aJUM7+lraevk2GKH/sncslTo=";
   };
 
-  vendorHash = "sha256-rZEkwiCy2kpeKOi4lhLoW1o+cws/p++c9Dz8fKhgNKQ=";
+  vendorHash = "sha256-+IiDWoT9E4SCkmOwPQMTM7AdrXVA6OJa0Fg9Xjq42gI=";
 
   env.GOWORK = "off";
 
diff --git a/pkgs/by-name/ko/kokkos/package.nix b/pkgs/by-name/ko/kokkos/package.nix
index cdf96f2b292c..39fd218893f5 100644
--- a/pkgs/by-name/ko/kokkos/package.nix
+++ b/pkgs/by-name/ko/kokkos/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kokkos";
-  version = "5.1.0";
+  version = "5.1.1";
 
   src = fetchFromGitHub {
     owner = "kokkos";
     repo = "kokkos";
     rev = finalAttrs.version;
-    hash = "sha256-yo+E8U06o7eu2U4AbXkHpo9uwjiIDE6NoP8TgUTkmuU=";
+    hash = "sha256-F/UNDIsEjRvM9RkTPg0wJtRdoTPpNPqyJYbgtvkntNk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ku/kubeone/package.nix b/pkgs/by-name/ku/kubeone/package.nix
index e06f96cbfd92..c031a7dea534 100644
--- a/pkgs/by-name/ku/kubeone/package.nix
+++ b/pkgs/by-name/ku/kubeone/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubeone";
-  version = "1.13.4";
+  version = "1.13.5";
 
   src = fetchFromGitHub {
     owner = "kubermatic";
     repo = "kubeone";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-PEGhLqBLDHLxa23+llB0LdaS/mGINyMzoCyPAsBU+vw=";
+    hash = "sha256-uh724TvrxAGt6NpArot5PL49yyJF+EUeh2JVoMfR+uw=";
   };
 
-  vendorHash = "sha256-qXIlU1ZrJvJ0u8wSoBeESEfOMEGHkVg8kLMp/zlyfno=";
+  vendorHash = "sha256-kJ4ypt0jNWA/BFiuur/pa/qd87csSdRMcV/IplQRA3I=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/la/laszip/package.nix b/pkgs/by-name/la/laszip/package.nix
index 9051a6d15750..18d1351e6063 100644
--- a/pkgs/by-name/la/laszip/package.nix
+++ b/pkgs/by-name/la/laszip/package.nix
@@ -7,14 +7,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "3.4.4";
+  version = "3.5.0";
   pname = "laszip";
 
   src = fetchFromGitHub {
     owner = "LASzip";
     repo = "LASzip";
     tag = finalAttrs.version;
-    hash = "sha256-v/oLU69zqDW1o1HTlay7GDh1Kbmv1rarII2Fz5HWCqg=";
+    hash = "sha256-xZ8IFnqrGt47lN+C6/ibgbIWqpObDf4RHPaGMXw0WZ4=";
   };
 
   hardeningDisable = [ "format" ]; # -Werror=format-security
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://laszip.org";
     changelog = "https://github.com/LASzip/LASzip/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.lgpl2;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ hythera ];
     platforms = lib.platforms.unix;
   };
 })
diff --git a/pkgs/by-name/la/lazysql/package.nix b/pkgs/by-name/la/lazysql/package.nix
index 2fc64bee779c..aa28c2db02d1 100644
--- a/pkgs/by-name/la/lazysql/package.nix
+++ b/pkgs/by-name/la/lazysql/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "lazysql";
-  version = "0.4.9";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "jorgerojas26";
     repo = "lazysql";
     rev = "v${version}";
-    hash = "sha256-KRyR4MZK9/gXj3EaAN/JGtzcou8SR+JJ8ZMWGKBu9mU=";
+    hash = "sha256-fQGojLJdMnzWXetE2AL2i0q16ZRebPsGx9UsWm1CmAs=";
   };
 
   vendorHash = "sha256-FbAt/HsjoxqAKWQqqWN2xuyyTG2Ic4DcyEU4O0rjpQE=";
diff --git a/pkgs/by-name/li/libz/package.nix b/pkgs/by-name/li/libz/package.nix
index 626aa1f0f573..6e351e7bb43e 100644
--- a/pkgs/by-name/li/libz/package.nix
+++ b/pkgs/by-name/li/libz/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitLab,
   gitUpdater,
+  fixDarwinDylibNames,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -16,6 +17,10 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-tr9r0X+iHz3LZFgIxi3JMQUnSlyTRtAIhtjwI+DIhpc=";
   };
 
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
+    fixDarwinDylibNames
+  ];
+
   outputs = [
     "out"
     "dev"
diff --git a/pkgs/by-name/li/lichess-bot/package.nix b/pkgs/by-name/li/lichess-bot/package.nix
index e6d069625ef4..5d87e89f1734 100644
--- a/pkgs/by-name/li/lichess-bot/package.nix
+++ b/pkgs/by-name/li/lichess-bot/package.nix
@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication {
   pname = "lichess-bot";
-  version = "2026.4.20.1";
+  version = "2026.5.12.2";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "lichess-bot-devs";
     repo = "lichess-bot";
-    rev = "98c2147b02af1482feb83174a623942f2c333e30";
-    hash = "sha256-ebHW96J6qAtgsVKtqmCNYP1XelYgIkBbl+GlU7ItZcY=";
+    rev = "c67bbfe57e0d406fd774958bd571f82f0ae5580a";
+    hash = "sha256-oIw6UmKOP6Ut+CtvdPXPF6LrHyQQndEN0YlWvJ/hZ/I=";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index 57dc752361c1..e54476e8784f 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -40,6 +40,7 @@
   shaderc,
   vulkan-headers,
   vulkan-loader,
+  spirv-headers,
   ninja,
 }:
 
@@ -78,7 +79,7 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "llama-cpp";
-  version = "8983";
+  version = "9080";
 
   outputs = [
     "out"
@@ -89,7 +90,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     owner = "ggml-org";
     repo = "llama.cpp";
     tag = "b${finalAttrs.version}";
-    hash = "sha256-v73SfPbzzLBNWyan1dsAnDc2dfSem36zyeGLen5t4KI=";
+    hash = "sha256-IF2Whu9VLxUbL+oLkQeYERfp8s3RdQBUyqsAsruv60M=";
     leaveDotGit = true;
     postFetch = ''
       git -C "$out" rev-parse --short HEAD > $out/COMMIT
@@ -106,6 +107,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     nodejs
     npmHooks.npmConfigHook
     pkg-config
+    spirv-headers
   ]
   ++ optionals cudaSupport [
     cudaPackages.cuda_nvcc
@@ -121,7 +123,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     ++ [ openssl ];
 
   npmRoot = "tools/server/webui";
-  npmDepsHash = "sha256-iYJB0z2YHG8OzEA9EwHUZrDa5obr5m2sbnIH+of28o0=";
+  npmDepsHash = "sha256-cV3noOyKmst9vfxyvkCNhihPgwfVGhmPPT4UMloeWZM=";
   npmDeps = fetchNpmDeps {
     name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
     inherit (finalAttrs) src patches;
diff --git a/pkgs/by-name/lx/lxgw-neoxihei/package.nix b/pkgs/by-name/lx/lxgw-neoxihei/package.nix
index 660fac8013e9..6a76a110fc1b 100644
--- a/pkgs/by-name/lx/lxgw-neoxihei/package.nix
+++ b/pkgs/by-name/lx/lxgw-neoxihei/package.nix
@@ -6,11 +6,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "lxgw-neoxihei";
-  version = "1.300";
+  version = "1.301";
 
   src = fetchurl {
     url = "https://github.com/lxgw/LxgwNeoXiHei/releases/download/v${version}/LXGWNeoXiHei.ttf";
-    hash = "sha256-n5b5sYmn3X/Eo4jwwt4G/6N17iVBPucW0KTlP/M+Xcc=";
+    hash = "sha256-C/M5Dl94L83vB7TzREdx6dBms9aHPQfgdWEyjvtvS00=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/me/meilisearch/package.nix b/pkgs/by-name/me/meilisearch/package.nix
index 8d28343e7266..75b01b1a675f 100644
--- a/pkgs/by-name/me/meilisearch/package.nix
+++ b/pkgs/by-name/me/meilisearch/package.nix
@@ -8,18 +8,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "meilisearch";
-  version = "1.43.0";
+  version = "1.43.1";
 
   src = fetchFromGitHub {
     owner = "meilisearch";
     repo = "meilisearch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-m2c0LI5/SCdBC3rZwXhDpsmIpa013LJjc8AHjGXUYBc=";
+    hash = "sha256-f8iz8qSIj5dJMPstUm0CbYOkPpZ2IIpIYbkVm+4F8V8=";
   };
 
   cargoBuildFlags = [ "--package=meilisearch" ];
 
-  cargoHash = "sha256-ha+mvUfK1yCCUvuW4Lb1PKd6giieE2gaywyVZ3NPgXk=";
+  cargoHash = "sha256-NB25eziZQCzVgtD+uCqJM3wTVrPGnhm58R0S2zfqqAE=";
 
   # Default features include mini dashboard which downloads something from the internet.
   buildNoDefaultFeatures = true;
diff --git a/pkgs/by-name/mi/minizinc-ide/package.nix b/pkgs/by-name/mi/minizinc-ide/package.nix
index 760fab209312..16ebce5c675b 100644
--- a/pkgs/by-name/mi/minizinc-ide/package.nix
+++ b/pkgs/by-name/mi/minizinc-ide/package.nix
@@ -19,13 +19,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "minizinc-ide";
-  version = "2.9.5";
+  version = "2.9.7";
 
   src = fetchFromGitHub {
     owner = "MiniZinc";
     repo = "MiniZincIDE";
     rev = finalAttrs.version;
-    hash = "sha256-VqVcByPBS7UBU/h5NIUltIKA0POAX1dUVgMsn5b9C4w=";
+    hash = "sha256-uOWV+mMIczszFg4BuLADRKoOeTQEYecwMKFwH6v6zl8=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/tools/minizinc/gecode.msc b/pkgs/by-name/mi/minizinc/gecode.msc
similarity index 100%
rename from pkgs/development/tools/minizinc/gecode.msc
rename to pkgs/by-name/mi/minizinc/gecode.msc
diff --git a/pkgs/development/tools/minizinc/default.nix b/pkgs/by-name/mi/minizinc/package.nix
similarity index 100%
rename from pkgs/development/tools/minizinc/default.nix
rename to pkgs/by-name/mi/minizinc/package.nix
diff --git a/pkgs/development/tools/minizinc/simple-test/aust.mzn b/pkgs/by-name/mi/minizinc/simple-test/aust.mzn
similarity index 100%
rename from pkgs/development/tools/minizinc/simple-test/aust.mzn
rename to pkgs/by-name/mi/minizinc/simple-test/aust.mzn
diff --git a/pkgs/development/tools/minizinc/simple-test/default.nix b/pkgs/by-name/mi/minizinc/simple-test/default.nix
similarity index 100%
rename from pkgs/development/tools/minizinc/simple-test/default.nix
rename to pkgs/by-name/mi/minizinc/simple-test/default.nix
diff --git a/pkgs/development/tools/minizinc/simple-test/loan.mzn b/pkgs/by-name/mi/minizinc/simple-test/loan.mzn
similarity index 100%
rename from pkgs/development/tools/minizinc/simple-test/loan.mzn
rename to pkgs/by-name/mi/minizinc/simple-test/loan.mzn
diff --git a/pkgs/development/tools/minizinc/simple-test/loan1.dzn b/pkgs/by-name/mi/minizinc/simple-test/loan1.dzn
similarity index 100%
rename from pkgs/development/tools/minizinc/simple-test/loan1.dzn
rename to pkgs/by-name/mi/minizinc/simple-test/loan1.dzn
diff --git a/pkgs/development/tools/minizinc/simple-test/nqueens.mzn b/pkgs/by-name/mi/minizinc/simple-test/nqueens.mzn
similarity index 100%
rename from pkgs/development/tools/minizinc/simple-test/nqueens.mzn
rename to pkgs/by-name/mi/minizinc/simple-test/nqueens.mzn
diff --git a/pkgs/by-name/mi/mise/package.nix b/pkgs/by-name/mi/mise/package.nix
index 38549a1186a8..2eccaaef3030 100644
--- a/pkgs/by-name/mi/mise/package.nix
+++ b/pkgs/by-name/mi/mise/package.nix
@@ -22,16 +22,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mise";
-  version = "2026.4.20";
+  version = "2026.5.6";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "mise";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6WGYjXx1AuUDbYIAHh0PdSUC+zDXq4mC5LY+r1vLiKc=";
+    hash = "sha256-ac7pK9LYwm//y4TVa1XtlIxJGkloItJxUcGOVCAxzPk=";
   };
 
-  cargoHash = "sha256-8JAxt9m8StOSNbUKZBNwQWoXwX+gXLGdNZYlRSH0SLM=";
+  cargoHash = "sha256-ZvICWDUpemtsbz9rDqxlNWpRRzEfZEdefJsbXwL4A0E=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix b/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
index 5e87b5f24f3b..d48f3b3b436d 100644
--- a/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
+++ b/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
@@ -13,7 +13,7 @@
   nodejs,
   openssl,
   pkg-config,
-  pnpm_9,
+  pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
   replaceVars,
@@ -31,13 +31,13 @@ in
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "modrinth-app-unwrapped";
-  version = "0.13.6";
+  version = "0.13.17";
 
   src = fetchFromGitHub {
     owner = "modrinth";
     repo = "code";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-47uokwYsEg5D0lyHdpqfvKlsuXZK0sm5YIWwNjVGsKQ=";
+    hash = "sha256-Qn4IlqJagLoIcP9p9QdKzu2wdcBDLvfq/2sgVwIjbm4=";
   };
 
   patches = [
@@ -61,20 +61,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ./remove-spotless.patch
   ];
 
-  cargoPatches = [
-    # Cidre 0.11.3 currently fails to build on darwin. Updating it to the latest version
-    # resolves this issue.
-    # Upstream PR is https://github.com/modrinth/code/pull/5862
-    ./update-cidre.patch
-  ];
-
   # Let the app know about our actual version number
   postPatch = ''
     substituteInPlace {apps/app,packages/app-lib}/Cargo.toml apps/app-frontend/package.json \
       --replace-fail '1.0.0-local' '${finalAttrs.version}'
   '';
 
-  cargoHash = "sha256-GwangszzKTEYvflibPgkIyUkHlpfMgenD/mq3my5LIY=";
+  cargoHash = "sha256-iI1AjFApd9fzss3hSVJLofHLZ6SJqUccHJ7PHqtBk+k=";
 
   mitmCache = gradle.fetchDeps {
     inherit (finalAttrs) pname;
@@ -83,9 +76,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
-    pnpm = pnpm_9;
+    pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-Hk32LBD20F2LRgqNs8f1j3VdUxKoTPWs3yJvOghsEbI=";
+    hash = "sha256-oPZt68SosRgzl50VR/xWozcc0weQKiY6T1UcvgMRq1M=";
   };
 
   nativeBuildInputs = [
@@ -96,7 +89,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     nodejs
     pkg-config
     pnpmConfigHook
-    pnpm_9
+    pnpm_10
   ]
   ++ lib.optional stdenv.hostPlatform.isDarwin [
     makeBinaryWrapper
diff --git a/pkgs/by-name/mo/modrinth-app-unwrapped/update-cidre.patch b/pkgs/by-name/mo/modrinth-app-unwrapped/update-cidre.patch
deleted file mode 100644
index ec85dc1a0a52..000000000000
--- a/pkgs/by-name/mo/modrinth-app-unwrapped/update-cidre.patch
+++ /dev/null
@@ -1,41 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
-index ee2157d44..db41b81a3 100644
---- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -1572,18 +1572,19 @@ dependencies = [
- 
- [[package]]
- name = "cidre"
--version = "0.11.3"
-+version = "0.15.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "0cc0eb4d7faf9f94493eaf7e7c0534dee2dfa9642353382039572abb4e0e56e9"
-+checksum = "0c903ff1729987d29e07295d2c5841993db25ff86cca43bee04505878d3ec1a7"
- dependencies = [
-+ "cc",
-  "cidre-macros",
- ]
- 
- [[package]]
- name = "cidre-macros"
--version = "0.3.0"
-+version = "0.5.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "82bc2f84c0baaa09299da3a03864491549685912c1e338a54211e00589dc1e4c"
-+checksum = "6facfeffa8b9792dc014bb4e65e364d13518b74e06783d56249810a3e48cfad7"
- 
- [[package]]
- name = "cityhash-rs"
-diff --git a/Cargo.toml b/Cargo.toml
-index 54865d6d3..a09ad3089 100644
---- a/Cargo.toml
-+++ b/Cargo.toml
-@@ -51,7 +51,7 @@ bytes = "1.10.1"
- censor = "0.3.0"
- chardetng = "0.1.17"
- chrono = "0.4.42"
--cidre = { version = "0.11.3", default-features = false, features = [
-+cidre = { version = "0.15.0", default-features = false, features = [
-   "macos_15_0"
- ] }
- clap = "4.5.48"
diff --git a/pkgs/by-name/mp/mpsolve/package.nix b/pkgs/by-name/mp/mpsolve/package.nix
index 26df426393cc..91ac76c40fa8 100644
--- a/pkgs/by-name/mp/mpsolve/package.nix
+++ b/pkgs/by-name/mp/mpsolve/package.nix
@@ -2,20 +2,30 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   autoreconfHook,
   bison,
+  check,
   flex,
   gitUpdater,
   gmp,
   gtk3,
   pkg-config,
   libsForQt5,
+
+  withGUI ? true,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mpsolve";
   version = "3.2.2";
 
+  outputs = [
+    "out"
+    "dev"
+    "man"
+  ];
+
   src = fetchFromGitHub {
     owner = "robol";
     repo = "MPSolve";
@@ -23,20 +33,47 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-BGXvNxWUbto0yMIpEIxZ9wOYv9w0ev4OgVcniNYIKoU=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "include-cmath-in-c++-before-defining-isnan-macro.patch";
+      url = "https://github.com/robol/MPSolve/commit/260432c9d1002261f60159d0520af7862d4471ed.patch";
+      hash = "sha256-ODWpp966S1SsSN8hf7yuYgJR44GgbLwSxui280WWGmM=";
+    })
+  ];
+
+  strictDeps = true;
+
   nativeBuildInputs = [
     autoreconfHook
     bison
     flex
     pkg-config
+  ]
+  ++ lib.optionals withGUI [
     libsForQt5.wrapQtAppsHook
   ];
 
   buildInputs = [
     gmp
+  ]
+  ++ lib.optionals withGUI [
     gtk3
     libsForQt5.qtbase
   ];
 
+  configureFlags = [
+    (lib.enableFeature withGUI "graphical-debugger")
+    (lib.enableFeature withGUI "ui")
+  ];
+
+  enableParallelBuilding = true;
+
+  doCheck = true;
+
+  checkInputs = [ check ];
+
+  checkTarget = "check";
+
   passthru.updateScript = gitUpdater { };
 
   meta = {
@@ -45,6 +82,5 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ kilianar ];
     mainProgram = "mpsolve";
-    platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/by-name/mt/mtail/package.nix b/pkgs/by-name/mt/mtail/package.nix
index f04976bdfe02..3d1503472b5e 100644
--- a/pkgs/by-name/mt/mtail/package.nix
+++ b/pkgs/by-name/mt/mtail/package.nix
@@ -8,17 +8,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "mtail";
-  version = "3.2.48";
+  version = "3.2.50";
 
   src = fetchFromGitHub {
     owner = "jaqx0r";
     repo = "mtail";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-dZ0fjBpQ1hS1AxuD5A3gSTmimhP6PbiyxGs8XaYdo64=";
+    hash = "sha256-RdDZgmnA9wDN7uEUGle85jLFRmgBNBaRGTu+MthCsfw=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-ZZcVtZBG0Erh/NmYbw0aOVCg2AGZeHMFRfRbwNFTCks=";
+  vendorHash = "sha256-37IbtXK4A8mIWmYR2a9XSgfOAHGpl5BxWGZiJG3okzY=";
 
   nativeBuildInputs = [
     gotools # goyacc
diff --git a/pkgs/by-name/ni/nightdiamond-cursors/package.nix b/pkgs/by-name/ni/nightdiamond-cursors/package.nix
index 708d0077b5be..86b2d888498a 100644
--- a/pkgs/by-name/ni/nightdiamond-cursors/package.nix
+++ b/pkgs/by-name/ni/nightdiamond-cursors/package.nix
@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "nightdiamond-cursors";
-  version = "0-unstable-2025-09-23";
+  version = "0-unstable-2026-05-11";
 
   src = fetchFromGitHub {
     owner = "vimlinuz";
     repo = "NightDiamond-cursors";
-    rev = "3ff3c0486430a4901b4d5cbbee87a370aa2b8ce9";
-    hash = "sha256-huruHo5w7Qrte1+nIiz+P1xPNDGrv5/eByHwaSlZYwQ=";
+    rev = "49650765c3396ccee9ffb796608845d4660d5692";
+    hash = "sha256-Ue6dDvNMq1pGfzudt1O8h0pawfKj4FskTGLnpyEp0CM=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/nw/nwg-hello/package.nix b/pkgs/by-name/nw/nwg-hello/package.nix
index 1efe5ebc1d24..77f62b14f46b 100644
--- a/pkgs/by-name/nw/nwg-hello/package.nix
+++ b/pkgs/by-name/nw/nwg-hello/package.nix
@@ -10,14 +10,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "nwg-hello";
-  version = "0.4.4";
+  version = "0.4.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-hello";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XJVUEuSu24NozFjted4pujo4A83cpF7KmfDSpc8/JzY=";
+    hash = "sha256-8SSNW/we3TPVEqiC6ts3MR/rJrv857L+U/IAfkdK2RU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ob/ob-xf/package.nix b/pkgs/by-name/ob/ob-xf/package.nix
new file mode 100644
index 000000000000..903840edf8f7
--- /dev/null
+++ b/pkgs/by-name/ob/ob-xf/package.nix
@@ -0,0 +1,99 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  gitUpdater,
+  cmake,
+  pkg-config,
+  alsa-lib,
+  freetype,
+  fontconfig,
+  libjack2,
+  libGL,
+  libx11,
+  libxcursor,
+  libxext,
+  libxinerama,
+  libxrandr,
+  writableTmpDirAsHomeHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ob-xf";
+  version = "1.0.3";
+
+  src = fetchFromGitHub {
+    owner = "surge-synthesizer";
+    repo = "OB-Xf";
+    tag = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-MeknY3jiUTcnX29AtdYNci4dAF1uFCZRpwrxEH3YEEM=";
+  };
+
+  postPatch = ''
+    # The build calls git at configure time to determine version info.
+    # Provide a static BUILD_VERSION file so git is not required.
+    cat > BUILD_VERSION <<EOF
+    SST_VERSION_INFO
+    5044e2e3
+    v${finalAttrs.version}
+    main
+    ${finalAttrs.version}
+    EOF
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    writableTmpDirAsHomeHook
+  ];
+
+  buildInputs = [
+    alsa-lib
+    freetype
+    fontconfig
+    libjack2
+    libGL
+    libx11
+    libxcursor
+    libxext
+    libxinerama
+    libxrandr
+  ];
+
+  enableParallelBuilding = true;
+
+  # JUCE dlopen's x11 at runtime, crashes without it
+  env.NIX_LDFLAGS = "-lX11";
+
+  # Fontconfig error: Cannot load default config file: No such file: (null)
+  env.FONTCONFIG_FILE = "${fontconfig.out}/etc/fonts/fonts.conf";
+
+  installPhase = ''
+    runHook preInstall
+
+    # Factory data (patches, themes) — provided by upstream's install() rule
+    cmake --install .
+
+    mkdir -p $out/lib/{vst3,lv2,clap}
+
+    cp -r OB-Xf_artefacts/Release/VST3/OB-Xf.vst3 $out/lib/vst3/
+    cp -r OB-Xf_artefacts/Release/LV2/OB-Xf.lv2 $out/lib/lv2/
+    cp -r OB-Xf_artefacts/Release/CLAP/OB-Xf.clap $out/lib/clap/
+
+    install -Dm755 OB-Xf_artefacts/Release/Standalone/OB-Xf $out/bin/OB-Xf
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = gitUpdater { };
+
+  meta = {
+    description = "Virtual analog synthesizer plug-in inspired by the Oberheim OB-X";
+    homepage = "https://surge-synth-team.org/ob-xf/";
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ magnetophon ];
+    mainProgram = "OB-Xf";
+  };
+})
diff --git a/pkgs/development/libraries/opencolorio/default.nix b/pkgs/by-name/op/opencolorio/package.nix
similarity index 100%
rename from pkgs/development/libraries/opencolorio/default.nix
rename to pkgs/by-name/op/opencolorio/package.nix
diff --git a/pkgs/by-name/op/openhue-cli/package.nix b/pkgs/by-name/op/openhue-cli/package.nix
index 8d0e0829f8ea..4938324559b9 100644
--- a/pkgs/by-name/op/openhue-cli/package.nix
+++ b/pkgs/by-name/op/openhue-cli/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "openhue-cli";
-  version = "0.23";
+  version = "0.24";
 
   src = fetchFromGitHub {
     owner = "openhue";
     repo = "openhue-cli";
     tag = finalAttrs.version;
-    hash = "sha256-YkTlXON31cfA4EAS3RMhplVj7mFF3hx/CyiUrcQOkqc=";
+    hash = "sha256-E1SKaHBWw6I8OycH+XiGvdzjYP9YHnTUCUeRC5J8+bw=";
     leaveDotGit = true;
     postFetch = ''
       cd "$out"
@@ -23,7 +23,7 @@ buildGoModule (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-S2CPDbgHcDYo6T2IIshmZkIatGLNMIdAMNBjowiMkwo=";
+  vendorHash = "sha256-HJ5GdCMVeO3Ve1U9j/GKmwN5VqPmeabQL9MhaSFPsSI=";
 
   env.CGO_ENABLED = 0;
 
diff --git a/pkgs/by-name/pe/peazip/package.nix b/pkgs/by-name/pe/peazip/package.nix
index 764670abb4dd..7a94d230456f 100644
--- a/pkgs/by-name/pe/peazip/package.nix
+++ b/pkgs/by-name/pe/peazip/package.nix
@@ -24,13 +24,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "peazip";
-  version = "11.0.0";
+  version = "11.1.0";
 
   src = fetchFromGitHub {
     owner = "peazip";
     repo = "peazip";
     rev = finalAttrs.version;
-    hash = "sha256-jeAvnSNLS173/diuGfv/PEvj7M4ARRHLoXQ2bkKSMP8=";
+    hash = "sha256-PuY+68+7XxsWylS6skhNF40o+Qt26RwmVxVTLmGXIn0=";
   };
   sourceRoot = "${finalAttrs.src.name}/peazip-sources";
 
diff --git a/pkgs/by-name/pg/pgdog/package.nix b/pkgs/by-name/pg/pgdog/package.nix
index 35b0163fd1f3..9bd130f47c38 100644
--- a/pkgs/by-name/pg/pgdog/package.nix
+++ b/pkgs/by-name/pg/pgdog/package.nix
@@ -14,16 +14,16 @@ let
 in
 rustPlatform.buildRustPackage.override { inherit stdenv; } (finalAttrs: {
   pname = "pgdog";
-  version = "0.1.39";
+  version = "0.1.40";
 
   src = fetchFromGitHub {
     owner = "pgdogdev";
     repo = "pgdog";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-E12+K9AW5yUuklnCN4v2fK6e1+O7zkThkrHMmTxqsJk=";
+    hash = "sha256-zs45vhcoiNwR56QqP7I8mhbTohijY5xc0VGLq4ehYdo=";
   };
 
-  cargoHash = "sha256-Qnjh9u0DGzA44fIjuNGT7UONNCx+2j3z389tvllbQxM=";
+  cargoHash = "sha256-4ctREg7x9Oi8KaIqGj+aZZLqM13wsZM0KrnygPUR8UI=";
 
   # Hardcoded paths for C compiler and linker
   postPatch = ''
diff --git a/pkgs/by-name/pi/pinniped/package.nix b/pkgs/by-name/pi/pinniped/package.nix
index ebc07cfc9fbf..f35c573969c3 100644
--- a/pkgs/by-name/pi/pinniped/package.nix
+++ b/pkgs/by-name/pi/pinniped/package.nix
@@ -8,18 +8,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "pinniped";
-  version = "0.45.0";
+  version = "0.46.0";
 
   src = fetchFromGitHub {
     owner = "vmware-tanzu";
     repo = "pinniped";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-KYhMJjUu+6suT9o4RbGRyBl5ItiYt/5JQPg4fUzqs0M=";
+    sha256 = "sha256-C7N6iPD4caTUXR6gB+9sdfBlWyT1tfE8KwE5WaiUdQM=";
   };
 
   subPackages = "cmd/pinniped";
 
-  vendorHash = "sha256-PAq+Oc8+Iib3/hBGrC0xQl+kBtWtsU7XS0alJePkO7k=";
+  vendorHash = "sha256-B94/SR2OVsxDs9+MaivxPBMQsNWFwAEwuDT7xvWN8vg=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/pk/pkarr/package.nix b/pkgs/by-name/pk/pkarr/package.nix
index 8a34a205be28..fa5c8352b03c 100644
--- a/pkgs/by-name/pk/pkarr/package.nix
+++ b/pkgs/by-name/pk/pkarr/package.nix
@@ -5,16 +5,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "pkarr";
-  version = "5.0.5";
+  version = "6.0.0";
 
   src = fetchFromGitHub {
     owner = "pubky";
     repo = "pkarr";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-R8wUUWBPgXdQM9CwZS1lxyEC0YQaS5HU6dwKiCmQOaM=";
+    hash = "sha256-KVTFBGLcwE+w2WRYkHhq0oOVDXJwVflXIHS9HWGM9AQ=";
   };
 
-  cargoHash = "sha256-pUO+wIWLdSZSRGi/pAVE6+CB5gMG5jBvVXJ7g8WMb40=";
+  cargoHash = "sha256-0x9H1iEmFa7fNL4+guqnpPJieyrOkRFrlrU0M7EOqqI=";
 
   meta = {
     description = "Public Key Addressable Resource Records (sovereign TLDs) ";
diff --git a/pkgs/by-name/pu/pulumi-bin/data.nix b/pkgs/by-name/pu/pulumi-bin/data.nix
index fd3b1b0db84e..8bff766b24aa 100644
--- a/pkgs/by-name/pu/pulumi-bin/data.nix
+++ b/pkgs/by-name/pu/pulumi-bin/data.nix
@@ -1,12 +1,12 @@
 # DO NOT EDIT! This file is generated automatically by update.sh
 { }:
 {
-  version = "3.236.0";
+  version = "3.237.0";
   pulumiPkgs = {
     x86_64-linux = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.236.0-linux-x64.tar.gz";
-        sha256 = "0nk76ra5ypa152gpffn4zp40z4q6aidkr347gc6zpqrqx5wgrnrp";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.237.0-linux-x64.tar.gz";
+        sha256 = "0h78sg60pbjnrwvp6xshg2xkpddwjq9vwb8cgb567v171lafhr3j";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.53.1-linux-amd64.tar.gz";
@@ -17,8 +17,8 @@
         sha256 = "139h210ixh4s46sa90p9ga9nl1bqb1m36hbr1ylcr80nx5hjh42p";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-alicloud-v3.101.0-linux-amd64.tar.gz";
-        sha256 = "1bk4wswywss8i5isjrrlpnrkdplpp45sqq1yvdc0jwgzay36n8zl";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-alicloud-v3.102.0-linux-amd64.tar.gz";
+        sha256 = "0xp8d1lirp3mzi2h8y0s9gsxqrkl13d7vzfsx28amjyawrn1amwl";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v8.10.5-linux-amd64.tar.gz";
@@ -29,8 +29,8 @@
         sha256 = "1m11q8zm5112gh7wcqnb3k4jqv5yzsxzs4g319yxxh3b4jhi6mgv";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v7.28.0-linux-amd64.tar.gz";
-        sha256 = "1rcb1jkggyhvs7fmckwsvacf8ahn8wrz1n5gm2gsp75rg362ms79";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v7.29.0-linux-amd64.tar.gz";
+        sha256 = "0aj63rk78ccknbavjdkkjzdmyxchfcm6mx0hjaiw79v44vmldsya";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v6.9.0-linux-amd64.tar.gz";
@@ -73,8 +73,8 @@
         sha256 = "03w4kfws4zksmri961fs3lsvwg15mpj6nhc0a1zplqpw6rsjgcmr";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v9.22.0-linux-amd64.tar.gz";
-        sha256 = "0jy0r3zlwfljqlg0sr8pc4y79wnnpa0wz55krdazww0znqzmiwv6";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v9.23.0-linux-amd64.tar.gz";
+        sha256 = "0iqg4xn6vc960sl3nkp09ca65r8vzrffk7axbpd80xmivg0nw5pd";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v6.13.1-linux-amd64.tar.gz";
@@ -121,8 +121,8 @@
         sha256 = "12jjgcnjkmyyl09zr3wlc0acp2xnsv1pwz51dhh3v9hfjm4541l9";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v2.14.0-linux-amd64.tar.gz";
-        sha256 = "1ind8360irxnnang0jw6dwm5m6bmn4f162yj7w4l6vi91k5d1s20";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v2.15.0-linux-amd64.tar.gz";
+        sha256 = "1f1srb7s8ig7bdmgi6zyf923ignhrvbjfk9xrx732rcsag534a8a";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.131.0-linux-amd64.tar.gz";
@@ -163,8 +163,8 @@
     ];
     x86_64-darwin = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.236.0-darwin-x64.tar.gz";
-        sha256 = "0j7a6yp2bh3sgbgj6sncaxcxj7xjf2hr18whc92mi50nihd9af0y";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.237.0-darwin-x64.tar.gz";
+        sha256 = "0hzmfw2pqksrkj9lz2xpfxpdndsczd8c4qdx40ws8r4d6nd0rr6f";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.53.1-darwin-amd64.tar.gz";
@@ -175,8 +175,8 @@
         sha256 = "1r1j115bii4hv22z5pwp1yvcbi41j4mdcvwbn04xjridvrpsp63b";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-alicloud-v3.101.0-darwin-amd64.tar.gz";
-        sha256 = "1rhbpxi9g3pb11cj2yinil8iwsl2zb3ndz3h21grf94ss8h4395h";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-alicloud-v3.102.0-darwin-amd64.tar.gz";
+        sha256 = "01nk56ar9fnshgzgdcdkpcb99pd16anvwvsww51azaplqpxj6p6c";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v8.10.5-darwin-amd64.tar.gz";
@@ -187,8 +187,8 @@
         sha256 = "0iq47qi17sxni3nq78pwc081mzi251mv2ffkb0kbijy0rix5miqd";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v7.28.0-darwin-amd64.tar.gz";
-        sha256 = "1xi6k192f71idzari87a9lf37rc87wxbz5c4gqy2n8r2zd5lhybp";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v7.29.0-darwin-amd64.tar.gz";
+        sha256 = "0gr07zznfri1ynqmfs5s803hiz136aijn8v96lmn6wx1v97mk6xj";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v6.9.0-darwin-amd64.tar.gz";
@@ -231,8 +231,8 @@
         sha256 = "1h8s1pc8bdpbhr2v8cfzn59mczpnwdi26x9dplkf95ck6r4s96gh";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v9.22.0-darwin-amd64.tar.gz";
-        sha256 = "1k5qd35w1389zmgr7h5ajnmq612jhq8yawqfali8vgrgppxfbl6w";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v9.23.0-darwin-amd64.tar.gz";
+        sha256 = "1g0ql8xqvbrac47kgb4bpid16affp00zpnrz3c7nifxvrqjl82gd";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v6.13.1-darwin-amd64.tar.gz";
@@ -279,8 +279,8 @@
         sha256 = "0qglyxagy5djccykcyp75b32vaf8mxswfjxk5wqq1p6wlgdb0mm5";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v2.14.0-darwin-amd64.tar.gz";
-        sha256 = "16347ib8lq81v9vmc6953g293zqvqpfg6g6ggw7q5chbjlfkvzhr";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v2.15.0-darwin-amd64.tar.gz";
+        sha256 = "03hx8scbjiwppd1rk22k6hcmj7yihh9ck95jgm2g874gjk60hlmf";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.131.0-darwin-amd64.tar.gz";
@@ -321,8 +321,8 @@
     ];
     aarch64-linux = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.236.0-linux-arm64.tar.gz";
-        sha256 = "1df72nwmnx1lwygk94r5q09mw7cha4z2wjwbdg6mgk5yd0d6padq";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.237.0-linux-arm64.tar.gz";
+        sha256 = "1z401ga9valricxa3i9b19j0gh4rfsps62ha0mbch8hh9wcqddd3";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.53.1-linux-arm64.tar.gz";
@@ -333,8 +333,8 @@
         sha256 = "0v84z83y56lnvrgsmla4qnig8cs57ynilib4ah29wb0dwkxvzamf";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-alicloud-v3.101.0-linux-arm64.tar.gz";
-        sha256 = "0dg2brhn72i5wd7nfqs6dhl99fcpfkdr4nd98ll8k12x4g2qjfim";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-alicloud-v3.102.0-linux-arm64.tar.gz";
+        sha256 = "0604gvz13q7q6n8n1i8x198cscfkjy5ra25n2c9labq5lv75byjr";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v8.10.5-linux-arm64.tar.gz";
@@ -345,8 +345,8 @@
         sha256 = "0p7vknr3j8bfgrh3mlm5nfxnwim0nj8ahc9aqbvsd3ncqlk257vw";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v7.28.0-linux-arm64.tar.gz";
-        sha256 = "0akg4h6i6a81xi9z6brid7g2s6zv2fcm1z7987hbbfnja1z9d1wl";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v7.29.0-linux-arm64.tar.gz";
+        sha256 = "07y0bnml8gzbpsadghbydx9i7if5s6bssd248g4bxil1h47b48v1";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v6.9.0-linux-arm64.tar.gz";
@@ -389,8 +389,8 @@
         sha256 = "1zagad13q8xgpicqz2d0qgrj4qxg9iqvmmw6di8n2nqhy4hczv8f";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v9.22.0-linux-arm64.tar.gz";
-        sha256 = "1gzf8r1zd9ydbxz9ai289j3r35ayzf3lac79ap82cdhh3qag8f6p";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v9.23.0-linux-arm64.tar.gz";
+        sha256 = "0s9rbl1g145gcqbpzfv6vw8d9l6m856bqxxgfd1kf1ks08ipjbm4";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v6.13.1-linux-arm64.tar.gz";
@@ -437,8 +437,8 @@
         sha256 = "035czawc26f09ihcnvcqfjkwrm5zr502yhs3wdqmh4c7kba7f8a6";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v2.14.0-linux-arm64.tar.gz";
-        sha256 = "16jl5fbzb7w93bksfnk32h2hqfdnr6qb9722jfbpzv5ksdw8f7g9";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v2.15.0-linux-arm64.tar.gz";
+        sha256 = "0dylb2z059v6rgir6ivlsmzigj1xn971gz9ddivdxbvyflsvhv89";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.131.0-linux-arm64.tar.gz";
@@ -479,8 +479,8 @@
     ];
     aarch64-darwin = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.236.0-darwin-arm64.tar.gz";
-        sha256 = "0m13ngr74g2b53zkmfqrp530brs54fkw71v4jv53zc6l0mvr5cj5";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.237.0-darwin-arm64.tar.gz";
+        sha256 = "04h5difhiqijwbl5vwvkjfzy6k179nl2iv48rp3k1a8kspvxafw9";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.53.1-darwin-arm64.tar.gz";
@@ -491,8 +491,8 @@
         sha256 = "0zsa46x3fqmbicfm6lg10k9ghj40pjq0v889ksqpws2d4jlhbwp7";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-alicloud-v3.101.0-darwin-arm64.tar.gz";
-        sha256 = "1crcyyilsj4zsba7mwhqzirikp0ff8x6r3mw4sbm2czi9bba1mv9";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-alicloud-v3.102.0-darwin-arm64.tar.gz";
+        sha256 = "1cj48m88bkxwkvb60zydqnb40rcyzv8hm3hllcccr03088mim0xp";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v8.10.5-darwin-arm64.tar.gz";
@@ -503,8 +503,8 @@
         sha256 = "0q71v1skm0k26rapggsam7ds9k3454qdn3wrpmsinjdmvdlbm7m0";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v7.28.0-darwin-arm64.tar.gz";
-        sha256 = "1n9dmfiwr16gnrb90irsm46dnqlkhsiyjgb5vvi6zc7qx5qqsc93";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v7.29.0-darwin-arm64.tar.gz";
+        sha256 = "1wqa9zkrbmxj2nrc8j8z12x947mqb7w8a98yvrrbq5fs0w031g22";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v6.9.0-darwin-arm64.tar.gz";
@@ -547,8 +547,8 @@
         sha256 = "13lgi9zy9cxs6zwc1whw3qhq6hk1kgi72p4yvhdavdc3j4nf241p";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v9.22.0-darwin-arm64.tar.gz";
-        sha256 = "03vd2x27h5givqcjgs6c5qhnb975hd2rw3zzc9m897hgr0vj1p0y";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v9.23.0-darwin-arm64.tar.gz";
+        sha256 = "1k4ah4pjr4gskgz88j46cw6q84d5wwg7fvav3lbvba09f1agk3ip";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v6.13.1-darwin-arm64.tar.gz";
@@ -595,8 +595,8 @@
         sha256 = "1bzw8zl11n9kqn8lz7m42rx3yahagi2r3l153146yi080ndvpsbq";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v2.14.0-darwin-arm64.tar.gz";
-        sha256 = "0bdvm3lgihf4nn8l1r9cla23ww9vxqb2km8z02argsms14ry0dg6";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v2.15.0-darwin-arm64.tar.gz";
+        sha256 = "1h6z3rc4j7a4iq6d1yh7d25jhmn6j55rssfynfpissqgbc275r61";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.131.0-darwin-arm64.tar.gz";
diff --git a/pkgs/by-name/ra/rattler-build/package.nix b/pkgs/by-name/ra/rattler-build/package.nix
index 0aa70e3d15cf..490870953ec2 100644
--- a/pkgs/by-name/ra/rattler-build/package.nix
+++ b/pkgs/by-name/ra/rattler-build/package.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rattler-build";
-  version = "0.64.0";
+  version = "0.64.1";
 
   src = fetchFromGitHub {
     owner = "prefix-dev";
     repo = "rattler-build";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Dv31XdSgGQZ9X8CtyhPVYT2HIMbkghk6BxFbHS8rWHU=";
+    hash = "sha256-crEcS1umg2NT3i+vOjQRgGlQHYujh/BwceuJz5GmRU4=";
   };
 
-  cargoHash = "sha256-YWo91GdNLthvkD62L3ouzpu46JqFjCOOkX2deI7HHt8=";
+  cargoHash = "sha256-eqOZkXlzBXGRdL8CnNjTaH3VzGQqY4f77Onp71g8usQ=";
 
   doCheck = false; # test requires network access
 
diff --git a/pkgs/by-name/ra/ratty/package.nix b/pkgs/by-name/ra/ratty/package.nix
index 04859c8bc71b..b74268075ee8 100644
--- a/pkgs/by-name/ra/ratty/package.nix
+++ b/pkgs/by-name/ra/ratty/package.nix
@@ -14,16 +14,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ratty";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = "ratty";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fDNlyTOhwI1nzNf2/Z9DWtTEdJCZEDogLu13ETbpJAw=";
+    hash = "sha256-Vxqd5peP4dcUyhM3JYzMUohYjlnsgZXRTnerKDC5VPg=";
   };
 
-  cargoHash = "sha256-4oLBONIyC924UGTw0d9RzGvNBolWdLMzzC+mihcD3B0=";
+  cargoHash = "sha256-/9ekk3B96OanoEXxRDd8eN0gx4IK0qfysOd6DkIZg+k=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/rc/rclone-ui/package.nix b/pkgs/by-name/rc/rclone-ui/package.nix
index 76e12d105d69..4447d4db5d54 100644
--- a/pkgs/by-name/rc/rclone-ui/package.nix
+++ b/pkgs/by-name/rc/rclone-ui/package.nix
@@ -20,26 +20,26 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rclone-ui";
-  version = "3.5.3";
+  version = "3.5.4";
 
   src = fetchFromGitHub {
     owner = "rclone-ui";
     repo = "rclone-ui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QswFZJDWPASyqyqzYepS2bzd4K3JulA4UmK/dT9ryVo=";
+    hash = "sha256-VnMNKBtZu5mdsvW7ljl+RNNj44bK+s5QrdGFaYvS2o0=";
   };
 
   npmDeps = fetchNpmDeps {
     name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
     inherit (finalAttrs) src;
     forceGitDeps = true;
-    hash = "sha256-SZhxTgYKfU1I/wzlktgsaMk+em7ly4ekiMvxb0ge+ZM=";
+    hash = "sha256-cBPJgaPHjgn+SByZFZ/SCOZG/YY4OQWUUlX844YHyUU=";
   };
 
   cargoRoot = "src-tauri";
   buildAndTestSubdir = finalAttrs.cargoRoot;
 
-  cargoHash = "sha256-bBkFMixt7Wrchlg/odjDMdHEp7omOofcPqDwacIFyOc=";
+  cargoHash = "sha256-r4orImEIUC+wQgnvkiO8/apXSgQ18LxJFoWgweYGgks=";
 
   # Disable tauri bundle updater, can be removed when #389107 is merged
   patches = [ ./remove_updater.patch ];
diff --git a/pkgs/by-name/re/render-cli/package.nix b/pkgs/by-name/re/render-cli/package.nix
index d6696428f678..683d38ae84b4 100644
--- a/pkgs/by-name/re/render-cli/package.nix
+++ b/pkgs/by-name/re/render-cli/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "render-cli";
-  version = "2.15.1";
+  version = "2.16.0";
 
   src = fetchFromGitHub {
     owner = "render-oss";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-a7yYSslRWa4d8TTAw128PukLBamqkpDr2oUUYBRgpCY=";
+    hash = "sha256-y9XlOMNwqdooj3LcNFIF9gov9KX+WtB8eU0NsjzVuUc=";
   };
 
   vendorHash = "sha256-K2RKcz5wAP0ZA5g5aDgSsEXKEEncFtO9qamgG3fW02Y=";
diff --git a/pkgs/by-name/ri/rio/package.nix b/pkgs/by-name/ri/rio/package.nix
index 8a4105a7753b..2b63dbd3f87c 100644
--- a/pkgs/by-name/ri/rio/package.nix
+++ b/pkgs/by-name/ri/rio/package.nix
@@ -11,6 +11,7 @@
   cmake,
   ncurses,
   scdoc,
+  shaderc,
   pkg-config,
   gcc-unwrapped,
   fontconfig,
@@ -50,16 +51,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rio";
-  version = "0.3.11";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "raphamorim";
     repo = "rio";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mzOgto8ELVrf1RWyL4BoU836HGnMBBeyWwfBFAPgoDE=";
+    hash = "sha256-br3PiI+b2kpNZuzLg9SBRfKS3uo6FKoPUnKUMOq519s=";
   };
 
-  cargoHash = "sha256-wO6PCnV95tKsRzyV1kVxxp7pNTsrR92HtNpZYg3U51w=";
+  cargoHash = "sha256-GzdO+ezGh1xgziW9epKbds0oxf2dYEzospKA648ESN0=";
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook
@@ -71,6 +72,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     cmake
     pkg-config
     autoPatchelfHook
+    shaderc
   ];
 
   runtimeDependencies = rlinkLibs;
diff --git a/pkgs/by-name/sa/samplv1/package.nix b/pkgs/by-name/sa/samplv1/package.nix
index 1ac6710bc8b0..6d0af33b0830 100644
--- a/pkgs/by-name/sa/samplv1/package.nix
+++ b/pkgs/by-name/sa/samplv1/package.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "samplv1";
-  version = "1.4.1";
+  version = "1.4.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/samplv1/samplv1-${finalAttrs.version}.tar.gz";
-    hash = "sha256-siuzbsAkQi909/jBNtz/Lb8gMtxyxh+tiRGuvZ9JUts=";
+    hash = "sha256-DAD8y9BhVyCxi7VPWLXKkcv6kxFQOOmTDB2ntJiG0Lw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/science/misc/sasview/default.nix b/pkgs/by-name/sa/sasview/package.nix
similarity index 100%
rename from pkgs/applications/science/misc/sasview/default.nix
rename to pkgs/by-name/sa/sasview/package.nix
diff --git a/pkgs/by-name/sa/satisfactorymodmanager/package.nix b/pkgs/by-name/sa/satisfactorymodmanager/package.nix
index 8453d212767d..45d4e79f1530 100644
--- a/pkgs/by-name/sa/satisfactorymodmanager/package.nix
+++ b/pkgs/by-name/sa/satisfactorymodmanager/package.nix
@@ -17,13 +17,13 @@ let
 in
 buildGoModule rec {
   pname = "satisfactorymodmanager";
-  version = "3.0.5";
+  version = "3.0.6";
 
   src = fetchFromGitHub {
     owner = "satisfactorymodding";
     repo = "SatisfactoryModManager";
     tag = "v${version}";
-    hash = "sha256-n1eGgvIxbWMugCaB/YX1chPgt97autDDJzomIgntz6M=";
+    hash = "sha256-VgLlMlCPLT8lu2tn+lrkqVCp2eoYhtyNnrWGGqesMd0=";
   };
 
   patches = [
diff --git a/pkgs/by-name/sc/scantpaper/package.nix b/pkgs/by-name/sc/scantpaper/package.nix
index 97b06796cba5..e83ae4f39a16 100644
--- a/pkgs/by-name/sc/scantpaper/package.nix
+++ b/pkgs/by-name/sc/scantpaper/package.nix
@@ -33,13 +33,13 @@ let
 in
 python3.pkgs.buildPythonApplication rec {
   pname = "scantpaper";
-  version = "3.0.6";
+  version = "3.0.7";
 
   src = fetchFromGitHub {
     owner = "carygravel";
     repo = "scantpaper";
     rev = "v${version}";
-    hash = "sha256-MKO5/MIlgjWrL+xUVBe84PgUXUGR0tTxUrJed8LegZc=";
+    hash = "sha256-CKD6hggVIHNPAft+DAsF4S+uZo+u/gbUStz9VaZtDBM=";
   };
 
   pyproject = true;
diff --git a/pkgs/by-name/se/secretspec/package.nix b/pkgs/by-name/se/secretspec/package.nix
index 2faedc781f4d..25e763668471 100644
--- a/pkgs/by-name/se/secretspec/package.nix
+++ b/pkgs/by-name/se/secretspec/package.nix
@@ -9,14 +9,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "secretspec";
-  version = "0.8.2";
+  version = "0.10.1";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-AslpydAYkbpgJwrqxhywfMSyR2ztMdn7Tac4rea2TiM=";
+    hash = "sha256-aFfMgYwRLDSMRAAsh9UpTzKREKgGONycTV71Fyf1fCY=";
   };
 
-  cargoHash = "sha256-wNAw/ve8xydZHrqeamsIweNF+0w5bpG+mQfO77i92gc=";
+  cargoHash = "sha256-I91sGPtCZxfhGYgeQDKZcs1yfSKiqlIcnC5wD3LB0BY=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ dbus ];
diff --git a/pkgs/by-name/se/serpl/package.nix b/pkgs/by-name/se/serpl/package.nix
index 74a774a956e0..e12c27903296 100644
--- a/pkgs/by-name/se/serpl/package.nix
+++ b/pkgs/by-name/se/serpl/package.nix
@@ -11,20 +11,20 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "serpl";
-  version = "0.3.4";
+  version = "0.3.5";
 
   src = fetchFromGitHub {
     owner = "yassinebridi";
     repo = "serpl";
     rev = finalAttrs.version;
-    hash = "sha256-lEvUS1RlZ4CvervzyfODsFqRJAiA6PyLNUVWhSoPMDY=";
+    hash = "sha256-GgyjLgkWKm189yScHf4Kz1YZLgW5e30IA9WPnwyypMA=";
   };
 
   buildFeatures = [ "ast_grep" ];
 
   nativeBuildInputs = [ makeWrapper ];
 
-  cargoHash = "sha256-reeJsSNifPeDzqMKVpS1Pmyn9x1F+Vin/xy81d5rKVs=";
+  cargoHash = "sha256-UyvYh9kXrdUIpV3E5aydSNnWgBl2dPugy660GC15liQ=";
 
   postFixup = ''
     # Serpl needs ripgrep to function properly.
diff --git a/pkgs/by-name/sn/snd/package.nix b/pkgs/by-name/sn/snd/package.nix
index a6ee70daff6d..8335f4cff55a 100644
--- a/pkgs/by-name/sn/snd/package.nix
+++ b/pkgs/by-name/sn/snd/package.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "snd";
-  version = "26.2";
+  version = "26.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/snd/snd-${finalAttrs.version}.tar.gz";
-    hash = "sha256-niNk7SrAt069dzaMsbWxnxd5hNlN9xV2lgc1WgCRmcc=";
+    hash = "sha256-QKXyNUX2UuVWXJRXZCkwmIysZg5tKPAShTnZTGUdp7Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sp/spade/package.nix b/pkgs/by-name/sp/spade/package.nix
index 1cb48b5adaa1..448e439e3038 100644
--- a/pkgs/by-name/sp/spade/package.nix
+++ b/pkgs/by-name/sp/spade/package.nix
@@ -16,18 +16,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "spade";
-  version = "0.17.0";
+  version = "0.18.0";
 
   src = fetchFromGitLab {
     owner = "spade-lang";
     repo = "spade";
     rev = "v${version}";
-    hash = "sha256-jdcwIn/CiibWiYhh4yICa1LWXZCI0r2w3AFDRO0ZbFw=";
+    hash = "sha256-BSbE0hJvCIaxxqCo+QltZuoS2yst6TgUnHXAE4kZD2A=";
     # only needed for vatch, which contains test data
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-JnyICAJ+W9ZwQpJnSVkEb5dSvkrcnx6PZ/IgQMEOsag=";
+  cargoHash = "sha256-+lQiXOof6MnjnVf8CXNYgeyzFMf0myLErbSfnjLVZWU=";
 
   # TODO: somehow respect https://nixos.org/manual/nixpkgs/stable/#var-passthru-updateScript-commit
   passthru.updateScript = _experimental-update-script-combinators.sequence [
diff --git a/pkgs/by-name/sq/sql-formatter/package.nix b/pkgs/by-name/sq/sql-formatter/package.nix
index 60ad64b97be2..366882296017 100644
--- a/pkgs/by-name/sq/sql-formatter/package.nix
+++ b/pkgs/by-name/sq/sql-formatter/package.nix
@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "sql-formatter";
-  version = "15.7.3";
+  version = "15.7.4";
 
   src = fetchFromGitHub {
     owner = "sql-formatter-org";
     repo = "sql-formatter";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-wRzGm8t0z3e/CdvawvAqi/bbc8owpVP07kvVmTrTnsI=";
+    hash = "sha256-cUTijVuBerUlK8xDbq1u6f0P6aSgXjcDaTf/F9jMBAA=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
diff --git a/pkgs/by-name/st/steelix/package.nix b/pkgs/by-name/st/steelix/package.nix
index f1e33be6e4c6..7c34987a1d48 100644
--- a/pkgs/by-name/st/steelix/package.nix
+++ b/pkgs/by-name/st/steelix/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "steelix";
-  version = "0-unstable-2026-05-02";
+  version = "0-unstable-2026-05-09";
 
   src = fetchFromGitHub {
     owner = "mattwparas";
     repo = "helix";
-    rev = "ff73544b3d7d7c264a127a7d78944133015b285a";
-    hash = "sha256-AkotCZTWiQ5KAUDwmHcRuA7G0y8vqJYiLSXEtT+y/po=";
+    rev = "47b4664ac868b334c9cb914d6b6bfa2045249d13";
+    hash = "sha256-+090DLPNNsDoYpAEgH9r5+8n0jQSbL7/5ThUJIT2yGg=";
   };
 
-  cargoHash = "sha256-eECfZ7UZGsbTnbfclBhSTNDj8fbfJNT9oBHjNsXpAG0=";
+  cargoHash = "sha256-6bu8sIM4So3AbnHHYbh8uu+rEB4IjMQjDgh7/AkLQs0=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/libraries/science/math/suitesparse/default.nix b/pkgs/by-name/su/suitesparse/package.nix
similarity index 100%
rename from pkgs/development/libraries/science/math/suitesparse/default.nix
rename to pkgs/by-name/su/suitesparse/package.nix
diff --git a/pkgs/by-name/sw/swayest-workstyle/package.nix b/pkgs/by-name/sw/swayest-workstyle/package.nix
index a4d0908ad5e2..195dfa6f0849 100644
--- a/pkgs/by-name/sw/swayest-workstyle/package.nix
+++ b/pkgs/by-name/sw/swayest-workstyle/package.nix
@@ -6,18 +6,18 @@
 
 let
   pname = "swayest-workstyle";
-  version = "1.3.9";
+  version = "1.4.0";
   src = fetchFromGitHub {
     owner = "Lyr-7D1h";
     repo = "swayest_workstyle";
     rev = version;
-    hash = "sha256-pytRPMGk0qwZcOnLjbYN1ijREVqCI6NZvKoFSGFmmXU=";
+    hash = "sha256-V1vEGz2jZHPdeKL99ILeoWVsuxIMkDHHdzgY8kEe9yM=";
   };
 in
 rustPlatform.buildRustPackage {
   inherit pname version src;
 
-  cargoHash = "sha256-FM30q7Y9s5TxVFoqSarAZ3v6YaybTGpYB53fNRySnUU=";
+  cargoHash = "sha256-cQWmtZFvpgFt49cKXEKUJoZ4d8w4AcwA9ud/W/rmOP8=";
 
   # No tests
   doCheck = false;
diff --git a/pkgs/by-name/sw/swim/package.nix b/pkgs/by-name/sw/swim/package.nix
index 821678b28616..5c5528bc7759 100644
--- a/pkgs/by-name/sw/swim/package.nix
+++ b/pkgs/by-name/sw/swim/package.nix
@@ -10,25 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "swim";
-  version = "0.17.0";
+  version = "0.18.0";
 
   src = fetchFromGitLab {
     owner = "spade-lang";
     repo = "swim";
     rev = "v${version}";
-    hash = "sha256-5GxOW5Np5CS1hO8Bd/CoKuRHMiQ9Q2Xz61NGyXXNF7Q=";
+    hash = "sha256-l0iEzctt3WHW7m3wnr5WdthqBlGSh0SxHCQlM6it0Ds=";
   };
 
-  cargoHash = "sha256-TmPw/vP4/LZrBOv1/vJBv3NIn75NnRQmtS4gdmZRH2w=";
-
-  preConfigure = ''
-    # de-vendor spade git submodule
-    test "$version" = "${spade.version}" || {
-      >&2 echo ERROR: version mismatch between spade and swim!
-      false
-    }
-    ln -s ${spade.src} runt/spade
-  '';
+  cargoHash = "sha256-k3sWg/oG5+ckxa10Jt/AncbyoB8kaOcG3xKPg1fl/ME=";
 
   nativeBuildInputs = [ pkg-config ];
 
@@ -36,11 +27,15 @@ rustPlatform.buildRustPackage rec {
     openssl
   ];
 
-  nativeCheckInputs = [ git ];
+  nativeCheckInputs = [
+    git
+    spade
+  ];
 
   checkFlags = [
-    # tries to clone https://gitlab.com/spade-lang/swim-templates
+    # tries to find git after clearing environ
     "--skip=init::tests::git_init_then_swim_init_works"
+    # tries to clone https://gitlab.com/spade-lang/swim-templates
     "--skip=init::tests::init_board_correctly_sets_project_name"
     "--skip=init::tests::init_board_creates_required_files"
     "--skip=plugin::test::deny_changes_to_plugins::edits_are_denied"
diff --git a/pkgs/by-name/sy/synthv1/package.nix b/pkgs/by-name/sy/synthv1/package.nix
index b8c26a5d5eb9..ff1beba9404b 100644
--- a/pkgs/by-name/sy/synthv1/package.nix
+++ b/pkgs/by-name/sy/synthv1/package.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "synthv1";
-  version = "1.4.1";
+  version = "1.4.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/synthv1/synthv1-${finalAttrs.version}.tar.gz";
-    hash = "sha256-z4jy6Zo7LaYLf3QoAXl0MvZ9rcZWThWwChGDJBY0HYg=";
+    hash = "sha256-eoW1Yl/v1LsdvcQen7/LLDt5Q9Yd4kwX3W+CIjQEfYE=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/sy/syshud/package.nix b/pkgs/by-name/sy/syshud/package.nix
index bde981abaa82..352610b078dc 100644
--- a/pkgs/by-name/sy/syshud/package.nix
+++ b/pkgs/by-name/sy/syshud/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "syshud";
-  version = "0-unstable-2025-12-09";
+  version = "0-unstable-2026-05-11";
 
   src = fetchFromGitHub {
     owner = "System64fumo";
     repo = "syshud";
-    rev = "52b828850c8f761106ed47d03c6c45b1a48d5d94";
-    hash = "sha256-FX5PsZIhIlC9WGuw1dR6BOBtdNj6StDsjQEWOZp+Fik=";
+    rev = "5781eb0feb081a5fe8f1f364c4f29b9b403f89d4";
+    hash = "sha256-fpJmxz4+Gk1x4KWT5Fc/g3ypu6i0LZEqBrMpJ8GIgKs=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ta/tanka/package.nix b/pkgs/by-name/ta/tanka/package.nix
index aa05ebcd9bee..80f503d30b5e 100644
--- a/pkgs/by-name/ta/tanka/package.nix
+++ b/pkgs/by-name/ta/tanka/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "tanka";
-  version = "0.37.0";
+  version = "0.37.1";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "tanka";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-HhDwnpP6xM2i0fCOymDZeUQjrn5l+/UcWKYENIl2n7I=";
+    sha256 = "sha256-7u6/IflJoZTG7N7QIiTGghrC+pby6t1+bUjMB2OJc4A=";
   };
 
-  vendorHash = "sha256-z877U8bnCKED7mOqF8X8VyNzGUULuWCopyHd7aFinxQ=";
+  vendorHash = "sha256-SD6Uj0OExlY6yjZYTarCyDywPZ2Uq3nz/wyd18ZC0/c=";
 
   doCheck = false;
   # Required for versions >= 0.28 as they introduce a gowork.sum file. This is only used for tests so we can safely disable GOWORK
diff --git a/pkgs/by-name/te/terraform-compliance/package.nix b/pkgs/by-name/te/terraform-compliance/package.nix
index 0158cb1e0d8a..4bc462fab77b 100644
--- a/pkgs/by-name/te/terraform-compliance/package.nix
+++ b/pkgs/by-name/te/terraform-compliance/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "terraform-compliance";
-  version = "1.14.1";
+  version = "1.15.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "terraform-compliance";
     repo = "cli";
     tag = finalAttrs.version;
-    hash = "sha256-wWwYM1ZCHiBdbjl5kRI9dFSWp7mpYb/2HlV7lbU/Xeg=";
+    hash = "sha256-saDpAek0QJy0YxGUPw8A5hLa0fmH5uX0FezcfEKkikI=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];
diff --git a/pkgs/by-name/th/thc-hydra/package.nix b/pkgs/by-name/th/thc-hydra/package.nix
index db87bf2d2597..4e8abd6bb1ba 100644
--- a/pkgs/by-name/th/thc-hydra/package.nix
+++ b/pkgs/by-name/th/thc-hydra/package.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "thc-hydra";
-  version = "9.6";
+  version = "9.7";
 
   src = fetchFromGitHub {
     owner = "vanhauser-thc";
     repo = "thc-hydra";
     rev = "v${version}";
-    sha256 = "sha256-DS3Fh4a6OtqZRHubgJewB7qnJXm10sYv85R6o/NePoU=";
+    sha256 = "sha256-6YNHy9k/NJkZYj0TjciPMOXMq/McGQnmj7HWk6KbgI4=";
   };
 
   postPatch =
diff --git a/pkgs/by-name/ti/tinty/package.nix b/pkgs/by-name/ti/tinty/package.nix
index f432dddf25a9..597100daeb2a 100644
--- a/pkgs/by-name/ti/tinty/package.nix
+++ b/pkgs/by-name/ti/tinty/package.nix
@@ -6,7 +6,7 @@
   nix-update-script,
 }:
 let
-  version = "0.29.0";
+  version = "0.32.2";
 in
 rustPlatform.buildRustPackage {
   pname = "tinty";
@@ -16,10 +16,10 @@ rustPlatform.buildRustPackage {
     owner = "tinted-theming";
     repo = "tinty";
     tag = "v${version}";
-    hash = "sha256-p05fRJR0boNKGAZ7+KGPyY3XUmj20QfZteWr80cA/po=";
+    hash = "sha256-+13iS99bwvIZDy96x1fgOtDyvbu59ieY4nUZk91mK4s=";
   };
 
-  cargoHash = "sha256-Mdfz412Y1kb4V6LXOHxrbP3WsnWiZ+irCO5Qi3DRQ4c=";
+  cargoHash = "sha256-gShC4+uzdJVi3KuLc6ImJRvEWvIY4vgKcYT8Aykm0Xc=";
 
   # Pretty much all tests require internet access
   doCheck = false;
@@ -35,7 +35,10 @@ rustPlatform.buildRustPackage {
     changelog = "https://github.com/tinted-theming/tinty/blob/refs/tags/v${version}/CHANGELOG.md";
     license = with lib.licenses; [ mit ];
     platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ pluiedev ];
+    maintainers = with lib.maintainers; [
+      pluiedev
+      cohei
+    ];
     mainProgram = "tinty";
   };
 }
diff --git a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
index 42f674918f5c..87688c78770a 100644
--- a/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/by-name/tr/tree-sitter/grammars/grammar-sources.nix
@@ -2001,9 +2001,9 @@
   };
 
   plank = {
-    version = "0.1.0";
+    version = "0.1.1";
     url = "github:plankevm/plank-monorepo";
-    hash = "sha256-B2UmV5i2ELlmzyrR8iFIOQcSpHeRQl4I6lxakMskolg=";
+    hash = "sha256-4r/hYPlVIKzq1/50mivs6CJjObAS5Iq1inwRe1bFlzE=";
     location = "plank-tree-sitter";
     meta = {
       license = lib.licenses.mit;
@@ -2237,9 +2237,9 @@
   };
 
   regex = {
-    version = "0.25.0";
+    version = "1.0.0";
     url = "github:tree-sitter/tree-sitter-regex";
-    hash = "sha256-bR0K6SR19QuQwDUic+CJ69VQTSGqry5a5IOpPTVJFlo=";
+    hash = "sha256-3D+LOWRUamAdbegVfWD5yFcCjBucthPogOL/zWR78PY=";
     meta = {
       license = lib.licenses.mit;
     };
diff --git a/pkgs/tools/graphics/twilight/default.nix b/pkgs/by-name/tw/twilight/package.nix
similarity index 100%
rename from pkgs/tools/graphics/twilight/default.nix
rename to pkgs/by-name/tw/twilight/package.nix
diff --git a/pkgs/by-name/ty/typescript-language-server/package.nix b/pkgs/by-name/ty/typescript-language-server/package.nix
index 7cb121b5494f..011d23670ec3 100644
--- a/pkgs/by-name/ty/typescript-language-server/package.nix
+++ b/pkgs/by-name/ty/typescript-language-server/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "typescript-language-server";
-  version = "5.1.3";
+  version = "5.2.0";
 
   src = fetchFromGitHub {
     owner = "typescript-language-server";
     repo = "typescript-language-server";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-qKw/AQ6SbodCDJsBJhlHc/w5qFtyhQQv7jFsJiuJtGE=";
+    hash = "sha256-OqAhk8TG/xwF/xZE2kiMmYiYIpxCdjpn+Yx5vWeP4xs=";
   };
 
   patches = [
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-CSjxiuUN+hHmoWwkVe6c5lLFeX3ROB3QlBQ15rVmPhk=";
+    hash = "sha256-7aBQwl5xdJCa3r3ZbntcC3gzOL1GrkTto0x2+Sg1Ikg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/uu/uutils-hostname/package.nix b/pkgs/by-name/uu/uutils-hostname/package.nix
index 8e4d0dc6cef6..f9cbe907dd24 100644
--- a/pkgs/by-name/uu/uutils-hostname/package.nix
+++ b/pkgs/by-name/uu/uutils-hostname/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uutils-hostname";
-  version = "0-unstable-2026-05-04";
+  version = "0-unstable-2026-05-12";
 
   src = fetchFromGitHub {
     owner = "uutils";
     repo = "hostname";
-    rev = "262c5678e98035b6211753eba669c6e5ba56e19a";
-    hash = "sha256-SaJtJhkyKTuafm1EmJUgGX1L1etZHtMQJA3av7e6FsY=";
+    rev = "e249b7e976b31116b90531672e7b3e414d599345";
+    hash = "sha256-SU/Tm8Q/+AKvf+O+tERGBlVMgifwByg6dQpZCcENYXo=";
   };
 
-  cargoHash = "sha256-Ml4yjnUOg3C0r7q5p425MsYdy0Qyz6JywzITUStcQfg=";
+  cargoHash = "sha256-WlXYGvzbdcGb7qWB3L00oJpMZROmKq6zDrtSj6OwtYA=";
 
   cargoBuildFlags = [ "--package uu_hostname" ];
 
diff --git a/pkgs/by-name/uu/uutils-tar/package.nix b/pkgs/by-name/uu/uutils-tar/package.nix
index c26027e18826..363d93ad702f 100644
--- a/pkgs/by-name/uu/uutils-tar/package.nix
+++ b/pkgs/by-name/uu/uutils-tar/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uutils-tar";
-  version = "0-unstable-2026-05-01";
+  version = "0-unstable-2026-05-13";
 
   src = fetchFromGitHub {
     owner = "uutils";
     repo = "tar";
-    rev = "1afcb449283cb1987a69a01c4c784bb3623e3550";
-    hash = "sha256-Xitb3OGRSJQUZ6yiQLH7TE9UvKpClXrQGdLLDnE1/gg=";
+    rev = "840b16bd8fd53a2fe4e8780d710014c2908b9870";
+    hash = "sha256-ZCTg7LEJdG6AzbR22l5MsNo17IO+eWO6dgFINx5xUeA=";
   };
 
-  cargoHash = "sha256-P0KPKriD4cWidWOApHWGIb80rCg5yk5Vub0IAyz5VUs=";
+  cargoHash = "sha256-tv+Rw7fS2llSJBVhfsGSGcovcdU+8ZYNa89K+LYdcFg=";
 
   cargoBuildFlags = [ "--workspace" ];
 
diff --git a/pkgs/by-name/wa/wappalyzergo/package.nix b/pkgs/by-name/wa/wappalyzergo/package.nix
index 771856cfc425..5b7c55ece1c8 100644
--- a/pkgs/by-name/wa/wappalyzergo/package.nix
+++ b/pkgs/by-name/wa/wappalyzergo/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "wappalyzergo";
-  version = "0.2.79";
+  version = "0.2.80";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "wappalyzergo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KPr6TvnwY+fd0xQHbVrjCVQuEx2ukJu+FPeonkyD/Q8=";
+    hash = "sha256-m293HQoZRpKoKPlddQntjLJ4/6hCS7P0V4+A9bAulAU=";
   };
 
-  vendorHash = "sha256-HTh1iNGQXmYe9eNEBhZixr8jyBqWsKhTcUHX4vzItIU=";
+  vendorHash = "sha256-kcg5XaI06UOkOTo803aTJCAt8lUE9QW9jSTbOflTTEo=";
 
   ldflags = [ "-s" ];
 
diff --git a/pkgs/by-name/we/webdav/package.nix b/pkgs/by-name/we/webdav/package.nix
index aa5bbbc8fed7..7ae5a2a0e14b 100644
--- a/pkgs/by-name/we/webdav/package.nix
+++ b/pkgs/by-name/we/webdav/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "webdav";
-  version = "5.11.7";
+  version = "5.11.8";
 
   src = fetchFromGitHub {
     owner = "hacdias";
     repo = "webdav";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xvkkOesOFcgT1OTm0X87eKFdKjEZpMu8Pw+YRTGjJlI=";
+    hash = "sha256-JVywkKgIeUTlmQ+7QTiN6kmQmeKiHuUHaQoPeqGXvkY=";
   };
 
-  vendorHash = "sha256-fSFVqZZXkhFeJPompd6mg+zNV40k5C3pJSjrXiiaPJ8=";
+  vendorHash = "sha256-9RV6koGiycFLnr5Q/Lqcil0xNRd5KKrPXwylCurnYPg=";
 
   __darwinAllowLocalNetworking = true;
 
diff --git a/pkgs/by-name/wi/win2xcur/package.nix b/pkgs/by-name/wi/win2xcur/package.nix
index 1a547d9d3609..d88cb45457c8 100644
--- a/pkgs/by-name/wi/win2xcur/package.nix
+++ b/pkgs/by-name/wi/win2xcur/package.nix
@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonPackage (finalAttrs: {
   pname = "win2xcur";
-  version = "0.2.0";
+  version = "0.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "quantum5";
     repo = "win2xcur";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-uG9yrH1BvdGyFosGBXLNB7lr0w7r89MWhW4gCVS+s1w=";
+    hash = "sha256-zr3zLbjbQAY7McoF89W2Dqgj49mpHDZZBS9zzhqTAm8=";
   };
 
   build-system = with python3Packages; [ setuptools ];
@@ -24,8 +24,11 @@ python3Packages.buildPythonPackage (finalAttrs: {
   ];
 
   pythonImportsCheck = [
+    "win2xcur.main.inspectcur"
     "win2xcur.main.win2xcur"
+    "win2xcur.main.win2xcurtheme"
     "win2xcur.main.x2wincur"
+    "win2xcur.main.x2wincurtheme"
   ];
 
   meta = {
diff --git a/pkgs/by-name/xw/xwayland-run/package.nix b/pkgs/by-name/xw/xwayland-run/package.nix
index aeb5c2048efb..b9f6f75514e2 100644
--- a/pkgs/by-name/xw/xwayland-run/package.nix
+++ b/pkgs/by-name/xw/xwayland-run/package.nix
@@ -31,14 +31,14 @@ let
 in
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "xwayland-run";
-  version = "0.0.5";
+  version = "0.0.6";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "ofourdan";
     repo = "xwayland-run";
     rev = finalAttrs.version;
-    hash = "sha256-TVoMbFQ5OIJkTX3/tuwylW+Bdx/gl1omObj0c3JjICM=";
+    hash = "sha256-zrm8uEy7DduOYPrpHrynZgYwEkZr3pbDsJHdWKOUzY0=";
   };
 
   pyproject = false;
diff --git a/pkgs/by-name/ze/zeroclaw/package.nix b/pkgs/by-name/ze/zeroclaw/package.nix
index 2c7180130586..0baa115dbc19 100644
--- a/pkgs/by-name/ze/zeroclaw/package.nix
+++ b/pkgs/by-name/ze/zeroclaw/package.nix
@@ -14,13 +14,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zeroclaw";
-  version = "0.5.1";
+  version = "0.7.5";
 
   src = fetchFromGitHub {
     owner = "zeroclaw-labs";
     repo = "zeroclaw";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5P+TjAf7i0oUxBCyBtagrmIHPXW2iZ6620PNxVYYjlQ=";
+    hash = "sha256-hVHfsBw3u0CLWAbmizLA9ZrB+3B0qBIrSUuzsyChwW0=";
   };
 
   postPatch =
@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       ln -s ${zeroclaw-web} web/dist
     '';
 
-  cargoHash = "sha256-tpgeRLWyye43fuzw2MRevQx8YKEbyOnIgLzjg8EzwCg=";
+  cargoHash = "sha256-6MGIJsaqRp3k/ysjdu6BE2iM2sehERQR+QoSqiThSpg=";
 
   nativeBuildInputs = [
     pkg-config
@@ -48,12 +48,24 @@ rustPlatform.buildRustPackage (finalAttrs: {
     gitMinimal
   ];
 
+  # wiremock tests require socket binding, which is denied in the darwin sandbox
   checkFlags = [
-    "--skip=memory::lucid::tests::failure_cooldown_avoids_repeated_lucid_calls"
-    "--skip=memory::lucid::tests::recall_handles_lucid_cold_start_delay_within_timeout"
-    "--skip=memory::lucid::tests::recall_merges_lucid_and_local_results"
+    "--skip=tests::exchange_pairing_code_posts_code_and_returns_token"
+    "--skip=tests::fetch_pairing_code_reads_gateway_pair_code_response"
+    "--skip=integration::telegram_attachment_fallback::"
+    "--skip=integration::telegram_finalize_draft::"
   ];
 
+  # The gateway serves the web dashboard from <binary_dir>/web/dist at runtime
+  postInstall =
+    let
+      zeroclaw-web = callPackage ./zeroclaw-web { inherit (finalAttrs) src version; };
+    in
+    ''
+      mkdir -p $out/bin/web
+      ln -s ${zeroclaw-web} $out/bin/web/dist
+    '';
+
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
 
@@ -64,7 +76,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     homepage = "https://github.com/zeroclaw-labs/zeroclaw";
     changelog = "https://github.com/zeroclaw-labs/zeroclaw/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ drupol ];
+    maintainers = with lib.maintainers; [
+      drupol
+      nixosclaw
+    ];
     mainProgram = "zeroclaw";
   };
 })
diff --git a/pkgs/by-name/ze/zeroclaw/zeroclaw-web/add-api-generated-stub.patch b/pkgs/by-name/ze/zeroclaw/zeroclaw-web/add-api-generated-stub.patch
new file mode 100644
index 000000000000..0c5636be177c
--- /dev/null
+++ b/pkgs/by-name/ze/zeroclaw/zeroclaw-web/add-api-generated-stub.patch
@@ -0,0 +1,13 @@
+diff --git a/src/lib/api-generated.ts b/src/lib/api-generated.ts
+new file mode 100644
+index 0000000..f6a1c72
+--- /dev/null
++++ b/src/lib/api-generated.ts
+@@ -0,0 +1,7 @@
++// Stub for Nix build: api-generated.ts is normally produced by
++// `cargo web gen-api` which runs the Rust gateway binary to emit an
++// OpenAPI spec and pipes it through openapi-typescript.  Since we
++// cannot run the gateway during the web build, provide minimal type
++// exports.  These are compile-time only and do not affect the bundle.
++export type paths = Record<string, never>;
++export type components = Record<string, never>;
diff --git a/pkgs/by-name/ze/zeroclaw/zeroclaw-web/default.nix b/pkgs/by-name/ze/zeroclaw/zeroclaw-web/default.nix
index 559460b0974c..0e0feafc9fc8 100644
--- a/pkgs/by-name/ze/zeroclaw/zeroclaw-web/default.nix
+++ b/pkgs/by-name/ze/zeroclaw/zeroclaw-web/default.nix
@@ -10,7 +10,14 @@ buildNpmPackage (finalAttrs: {
 
   sourceRoot = "${finalAttrs.src.name}/web";
 
-  npmDepsHash = "sha256-4+raDJ7+w+RpdeZs2PJL10IWzfoT5B3EpOxsLUnlrRc=";
+  npmDepsHash = "sha256-DVL9kov8y1Eh3BM2Rpw+KbTDL6/AvT/epknM2X/Gf3E=";
+
+  # api-generated.ts is produced by `cargo web gen-api`, which requires the
+  # compiled Rust gateway binary — unavailable during the web build.  The two
+  # re-exported types are compile-time only (erased by Vite), so a minimal stub
+  # is sufficient.  Re-check on every bump: if upstream starts committing
+  # api-generated.ts or removes the import, this patch can be dropped.
+  patches = [ ./add-api-generated-stub.patch ];
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/development/interpreters/erlang/29.nix b/pkgs/development/interpreters/erlang/29.nix
index 51fc071a9ff5..dc59b0dc29ba 100644
--- a/pkgs/development/interpreters/erlang/29.nix
+++ b/pkgs/development/interpreters/erlang/29.nix
@@ -1,6 +1,6 @@
 genericBuilder:
 
 genericBuilder {
-  version = "29.0-rc3";
-  hash = "sha256-lDuxydEG+BKXXvrTE4uaye5cxjJayRw/SCu+fKggpdM=";
+  version = "29.0";
+  hash = "sha256-AUt/Mlp84cVEypqDsyD5VbywYEGda0eikMDmSnzlKUI=";
 }
diff --git a/pkgs/development/python-modules/azure-kusto-ingest/default.nix b/pkgs/development/python-modules/azure-kusto-ingest/default.nix
index 25bccb378d7d..aacc658350ca 100644
--- a/pkgs/development/python-modules/azure-kusto-ingest/default.nix
+++ b/pkgs/development/python-modules/azure-kusto-ingest/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "azure-kusto-ingest";
-  version = "6.0.3";
+  version = "6.0.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "azure-kusto-python";
     tag = "v${version}";
-    hash = "sha256-n69KpWZpAVMjr7d1QRQ/J/SgeTLkadJUhCgD62F6O7w=";
+    hash = "sha256-iggsVxLmDbP6+oSPaIiujPLsZAWwm5VLZSl+HYm0DIQ=";
   };
 
   sourceRoot = "${src.name}/${pname}";
diff --git a/pkgs/development/python-modules/b2sdk/default.nix b/pkgs/development/python-modules/b2sdk/default.nix
index 349d82e07715..a4ce5729d8a7 100644
--- a/pkgs/development/python-modules/b2sdk/default.nix
+++ b/pkgs/development/python-modules/b2sdk/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "b2sdk";
-  version = "2.11.0";
+  version = "2.12.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Backblaze";
     repo = "b2-sdk-python";
     tag = "v${version}";
-    hash = "sha256-gnJHTrOau0zZdYP4mDY+uuni41VfnRxC1uP17b+r9yU=";
+    hash = "sha256-JzJ83+W9k5ys8dj0Q3X4MY+GH4m8/crvKmeQKOttspM=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/beets-alternatives/default.nix b/pkgs/development/python-modules/beets-alternatives/default.nix
index ec30ac64bade..5144eb45c80c 100644
--- a/pkgs/development/python-modules/beets-alternatives/default.nix
+++ b/pkgs/development/python-modules/beets-alternatives/default.nix
@@ -22,25 +22,21 @@
 
 buildPythonPackage rec {
   pname = "beets-alternatives";
-  version = "0.14.0";
+  version = "0.14.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     repo = "beets-alternatives";
     owner = "geigerzaehler";
     tag = "v${version}";
-    hash = "sha256-leZYXf6Oo/jAKbnJbP+rTnuRsh9P1BQXYAbthMNT60A=";
+    hash = "sha256-C4EVJwzLhwQJz/iUKrIKUjhYHIpPrETqyQi0DByZM3Y=";
   };
 
   patches = [
-    # Fixes a failing test, see:
-    # https://github.com/geigerzaehler/beets-alternatives/issues/212
+    # Fixes failing tests; see https://github.com/geigerzaehler/beets-alternatives/pull/221
     (fetchpatch {
-      url = "https://github.com/geigerzaehler/beets-alternatives/commit/8b75974636897aabcf2ca75fb0987f7beb68f50f.patch";
-      hash = "sha256-lIJwuf3UklcJM4m7CO2+aNpPekHXuC5rpPVjK+kb+FQ=";
-      includes = [
-        "test/cli_test.py"
-      ];
+      url = "https://github.com/geigerzaehler/beets-alternatives/commit/84fdb0fa15225cce1e881b07bddcb52715677915.patch";
+      hash = "sha256-rURvP7aNJ+I9bPjk43t8rYujOK1iUS1J4RFMAHfa5AU=";
     })
   ];
 
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 3f66915ec330..6842a9cdfea8 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "boto3-stubs";
-  version = "1.43.6";
+  version = "1.43.7";
   pyproject = true;
 
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit (finalAttrs) version;
-    hash = "sha256-bIsuKXe1+FzayC8eNZDNfn5FLJI0FlTMZMk6Y9oPe+w=";
+    hash = "sha256-fjPMhCzR6fa8zIjtU7HcyT9VIW9pupu6yQ0GLIcLdS8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/chalice/default.nix b/pkgs/development/python-modules/chalice/default.nix
index 9ff94a41d8ef..dab8b5c075fb 100644
--- a/pkgs/development/python-modules/chalice/default.nix
+++ b/pkgs/development/python-modules/chalice/default.nix
@@ -25,7 +25,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "chalice";
-  version = "1.32.0";
+  version = "1.33.0";
   pyproject = true;
 
   disabled = pythonAtLeast "3.14";
@@ -34,7 +34,7 @@ buildPythonPackage (finalAttrs: {
     owner = "aws";
     repo = "chalice";
     tag = finalAttrs.version;
-    hash = "sha256-7qmE78aFfq9XCl2zcx1dAVKZZb96Bu47tSW1Qp2vFl4=";
+    hash = "sha256-c5xzgrxRFRlvgMnf/L8rhG7rYJLtuMvDZHYsPaHkdRs=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/dataproperty/default.nix b/pkgs/development/python-modules/dataproperty/default.nix
index 0b8ba76207b4..05de3a32b54d 100644
--- a/pkgs/development/python-modules/dataproperty/default.nix
+++ b/pkgs/development/python-modules/dataproperty/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "dataproperty";
-  version = "1.1.0";
+  version = "1.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "thombashi";
     repo = "dataproperty";
     tag = "v${version}";
-    hash = "sha256-IEEwdOcC9nKwVumWnjpZlqYKCFGwZebMh7nGdGVjibE=";
+    hash = "sha256-PLXF9g0VIkmsRLl5+KvXcbbwVwaJSYjWB7l8xz1mPZM=";
   };
 
   build-system = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/groq/default.nix b/pkgs/development/python-modules/groq/default.nix
index d38d2e3ad854..1b1e8a24835f 100644
--- a/pkgs/development/python-modules/groq/default.nix
+++ b/pkgs/development/python-modules/groq/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "groq";
-  version = "1.2.0";
+  version = "1.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "groq";
     repo = "groq-python";
     tag = "v${version}";
-    hash = "sha256-PisqKpVM2KAlGgZDcCoFJhoib7WhuM1AkJOGYVimW0U=";
+    hash = "sha256-Y+cF4yKDZ+brXLgPqBmh2RgvU52dB2ujTnZPXsMVShw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/helium/default.nix b/pkgs/development/python-modules/helium/default.nix
index c774aa456018..224b96664346 100644
--- a/pkgs/development/python-modules/helium/default.nix
+++ b/pkgs/development/python-modules/helium/default.nix
@@ -13,25 +13,21 @@
   stdenv,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "helium";
-  version = "7.0.0";
+  version = "7.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mherrmann";
     repo = "helium";
-    tag = "v${version}";
-    hash = "sha256-SGLxP2OOzosLpZn/DgIJN3BnbUeg8cXE1HhKBF4EpyM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-gIezXLVlPOpc5GY0eK7ua6TOiAlWV9/oGZQbimKnzjI=";
   };
 
-  build-system = [
-    setuptools
-  ];
+  build-system = [ setuptools ];
 
-  dependencies = [
-    selenium
-  ];
+  dependencies = [ selenium ];
 
   nativeCheckInputs = [
     firefox
@@ -59,15 +55,13 @@ buildPythonPackage rec {
     "tests/api/test_write.py"
   ];
 
-  pythonImportsCheck = [
-    "helium"
-  ];
+  pythonImportsCheck = [ "helium" ];
 
   meta = {
     description = "Lighter web automation with Python";
     homepage = "https://github.com/mherrmann/helium";
-    changelog = "https://github.com/mherrmann/helium/releases/tag/v${version}";
+    changelog = "https://github.com/mherrmann/helium/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     teams = with lib.teams; [ ngi ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 11c42bf9337f..1b679561f339 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202605121";
+  version = "0.1.202605131";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-u+OecJzqQes3AmBe/AP4szSTgWElXXrN2VGnC+H5cfs=";
+    hash = "sha256-l0mqCMqSvVEG38stMYiJEPz2IPL8CqheQdvo/yN2aBU=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/ics/default.nix b/pkgs/development/python-modules/ics/default.nix
index beb0b7b40b35..4822b92fb575 100644
--- a/pkgs/development/python-modules/ics/default.nix
+++ b/pkgs/development/python-modules/ics/default.nix
@@ -47,6 +47,8 @@ buildPythonPackage rec {
     "test_many_lines"
     # AssertionError: 'Europe/Berlin' not found in "tzfile('Atlantic/Jan_Mayen')"
     "test_timezone_not_dropped"
+    # tatsu PEG parser hits recursion limit on the bundled gehol/BA1.ics fixture
+    "test_gehol"
   ];
 
   pythonImportsCheck = [ "ics" ];
diff --git a/pkgs/development/python-modules/imap-tools/default.nix b/pkgs/development/python-modules/imap-tools/default.nix
index 3e49ffcad2c7..0fee24247912 100644
--- a/pkgs/development/python-modules/imap-tools/default.nix
+++ b/pkgs/development/python-modules/imap-tools/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "imap-tools";
-  version = "1.12.1";
+  version = "1.13.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ikvk";
     repo = "imap_tools";
     tag = "v${version}";
-    hash = "sha256-VNH3aUqIa7hSJr6A7SJUSad1JkKD1D0QZ3WKQuOQoeE=";
+    hash = "sha256-1BcSF40yUbOvOVDsoqS4AXRU2GZ1a3f9p8Xz7crsfwc=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/inventree/default.nix b/pkgs/development/python-modules/inventree/default.nix
index abe0eb3edca0..5c06ef11dc71 100644
--- a/pkgs/development/python-modules/inventree/default.nix
+++ b/pkgs/development/python-modules/inventree/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "inventree";
-  version = "0.21.1";
+  version = "0.23.1";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -26,7 +26,7 @@ buildPythonPackage (finalAttrs: {
     owner = "inventree";
     repo = "inventree-python";
     tag = finalAttrs.version;
-    hash = "sha256-n/iJ2/xFxwRFbZKjcrbWMnx2lp7ITJsyHDLcCtdmEDI=";
+    hash = "sha256-xctn1IDdNRzr+T8uIxu1HvhdVR0damiRkQVWL0EXrkg=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/iocx/default.nix b/pkgs/development/python-modules/iocx/default.nix
index 28e35fe1c63b..fdc39b388253 100644
--- a/pkgs/development/python-modules/iocx/default.nix
+++ b/pkgs/development/python-modules/iocx/default.nix
@@ -40,6 +40,10 @@ buildPythonPackage (finalAttrs: {
   disabledTests = [
     # Test requires go to be available
     "test_cli_with_real_go_binary"
+    # flaky: timing-sensitive scaling assertion
+    "test_filepaths_scaling_behavior"
+    "test_crypto_scaling_behavior"
+    "test_scaling_behavior"
   ];
 
   meta = {
diff --git a/pkgs/development/python-modules/jaxlib/default.nix b/pkgs/development/python-modules/jaxlib/default.nix
index 449665d68b02..9ba7319bb5d7 100644
--- a/pkgs/development/python-modules/jaxlib/default.nix
+++ b/pkgs/development/python-modules/jaxlib/default.nix
@@ -66,7 +66,7 @@ let
 
   meta = {
     description = "Source-built JAX backend. JAX is Autograd and XLA, brought together for high-performance machine learning research";
-    homepage = "https://github.com/google/jax";
+    homepage = "https://github.com/jax-ml/jax";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ ndl ];
 
diff --git a/pkgs/development/python-modules/jellyfin-apiclient-python/default.nix b/pkgs/development/python-modules/jellyfin-apiclient-python/default.nix
index 475a7f342475..60c7742f8d7f 100644
--- a/pkgs/development/python-modules/jellyfin-apiclient-python/default.nix
+++ b/pkgs/development/python-modules/jellyfin-apiclient-python/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "jellyfin-apiclient-python";
-  version = "1.11.0";
+  version = "1.12.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin-apiclient-python";
     tag = "v${version}";
-    hash = "sha256-TFF0pENSXWbmIb7IM1bayDACd0VOCTKc1WzLRvTJYNA=";
+    hash = "sha256-lxwJgYysp/6C/eYviYJu5lfStWulHyl7WxqxMnOE5iw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/language-tool-python/default.nix b/pkgs/development/python-modules/language-tool-python/default.nix
index aff9aeb684a2..d71412aaf6ac 100644
--- a/pkgs/development/python-modules/language-tool-python/default.nix
+++ b/pkgs/development/python-modules/language-tool-python/default.nix
@@ -11,7 +11,7 @@
 }:
 buildPythonPackage rec {
   pname = "language-tool-python";
-  version = "3.3.0";
+  version = "3.3.1";
 
   pyproject = true;
 
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "jxmorris12";
     repo = "language_tool_python";
     tag = version;
-    hash = "sha256-7Hzz7VqQvtz7EisGhmb4GXWynAEQ1CmfPZAiqLNmCPs=";
+    hash = "sha256-Cgzk9Tab9yf/J94SRxLIiTNTyUqZfNXxQYUOnt4w2eI=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/mbstrdecoder/default.nix b/pkgs/development/python-modules/mbstrdecoder/default.nix
index 96db79782565..e4a2959b84c1 100644
--- a/pkgs/development/python-modules/mbstrdecoder/default.nix
+++ b/pkgs/development/python-modules/mbstrdecoder/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "mbstrdecoder";
-  version = "1.1.4";
+  version = "1.1.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "thombashi";
     repo = "mbstrdecoder";
     tag = "v${version}";
-    hash = "sha256-rJ3Q7/xYPO0jBuzhYm2aIhPar2tbJIxHnHR0y0HWtik=";
+    hash = "sha256-RPtxoI4fFiBHBOWOdGueVjPPOAUjDThawS80SIoTQ78=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 9c9fcda393c0..56b32d654d83 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -163,12 +163,12 @@ in
       "sha256-FZuhcgbPBohluThfTy99inR5nyG0r3q/AsxNEvtgJU4=";
 
   mypy-boto3-batch =
-    buildMypyBoto3Package "batch" "1.43.0"
-      "sha256-qkYs/jiXHYUjQMXSYx8XepvxFcrwRXYp2OUJNual8Jw=";
+    buildMypyBoto3Package "batch" "1.43.7"
+      "sha256-4Xj/9Sq0wIs5ldX+WsnUkVKqGmT0xB9fpw8G6Km0hjw=";
 
   mypy-boto3-billingconductor =
-    buildMypyBoto3Package "billingconductor" "1.43.0"
-      "sha256-M1CIE4fho0uGdF6/h87BCiz7Y9q2P2nAHC2NS/d9JOA=";
+    buildMypyBoto3Package "billingconductor" "1.43.7"
+      "sha256-BWFbcDtacQzWwN0fc+OH/iSbsE3Lw0xAjn9V3/Lbxws=";
 
   mypy-boto3-braket =
     buildMypyBoto3Package "braket" "1.43.0"
@@ -335,8 +335,8 @@ in
       "sha256-kPG0jzeHlRm8dNKCrxJY2Jw/N06PL+C/34gB9qhz2BY=";
 
   mypy-boto3-connect =
-    buildMypyBoto3Package "connect" "1.43.0"
-      "sha256-M1VhBDYXAvRDV8U47BAeP0zlr7d6ZClYwEkDUUy35fA=";
+    buildMypyBoto3Package "connect" "1.43.7"
+      "sha256-XvHyT7+6/Uf2YdIeI6sL32TJGQ5Yy/VXjon70HDyGvY=";
 
   mypy-boto3-connect-contact-lens =
     buildMypyBoto3Package "connect-contact-lens" "1.43.0"
@@ -347,8 +347,8 @@ in
       "sha256-diymNW6D5QCBts8lrsxQy1Q18+LeRkhtOThRkd4gWsk=";
 
   mypy-boto3-connectcases =
-    buildMypyBoto3Package "connectcases" "1.43.0"
-      "sha256-4rq7ErTAeExDoq40tL6gjEsQjvGfOhUGuiDBoVOw4vQ=";
+    buildMypyBoto3Package "connectcases" "1.43.7"
+      "sha256-lGdrTkjAWbH6kBppKKLFrMyL/UiUwzpkClbWwTkl32E=";
 
   mypy-boto3-connectparticipant =
     buildMypyBoto3Package "connectparticipant" "1.43.0"
@@ -443,8 +443,8 @@ in
       "sha256-dXNkOcMonYrBh4yzeubd+v3mW42s9XpmpfvgbtgoJgY=";
 
   mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.43.6"
-      "sha256-zYVu5tdGQ2oJjCZ//8x+DZowC/rdpvw7vpQiZixpevU=";
+    buildMypyBoto3Package "ec2" "1.43.7"
+      "sha256-OO7+5yKwPCacPZWT8HmG8SMBSs+xDeWofTrEXCY8vgs=";
 
   mypy-boto3-ec2-instance-connect =
     buildMypyBoto3Package "ec2-instance-connect" "1.43.0"
@@ -511,8 +511,8 @@ in
       "sha256-vJVCkj3pNY8p6UKnr1zdMy8um84ONHYEYG2izkVaNA8=";
 
   mypy-boto3-es =
-    buildMypyBoto3Package "es" "1.43.0"
-      "sha256-I+9aGV6qURFYoHe2rNdk+BfcIvN1lc5Ot2G04F7nGfg=";
+    buildMypyBoto3Package "es" "1.43.7"
+      "sha256-ECDgtsDWKJGlXAI0KrwcVwDO3mqkHMm7wdW6pSVQ0hk=";
 
   mypy-boto3-events =
     buildMypyBoto3Package "events" "1.43.0"
@@ -571,8 +571,8 @@ in
       "sha256-vMz4YKm78XMavlPUNiSVAYmAbyUBrJhUXbFrhxIvUJA=";
 
   mypy-boto3-glue =
-    buildMypyBoto3Package "glue" "1.43.5"
-      "sha256-oUIJxMN+MuPsZoXzU1unTvupMyddoWCu6l/w/zSLx7Y=";
+    buildMypyBoto3Package "glue" "1.43.7"
+      "sha256-PD/CGMq+yciwF8aqvkllDICUaKt1oeHtlP8CteGfYlk=";
   mypy-boto3-grafana =
     buildMypyBoto3Package "grafana" "1.43.0"
       "sha256-ciXs8g462XTc+GTyxuGDDEsoR9DMD+bOdSUFe0OLshM=";
@@ -798,8 +798,8 @@ in
       "sha256-kCI94Z4gBIthwj3Q7OqdIYPPWqavxLTKY3FQDeuPsmI=";
 
   mypy-boto3-lightsail =
-    buildMypyBoto3Package "lightsail" "1.43.0"
-      "sha256-HA4SqeZxi+iSD/WcokROHaCQEUGAQhEG9FghFEdUWhY=";
+    buildMypyBoto3Package "lightsail" "1.43.7"
+      "sha256-1ihwQoZTBK1w8AB+K3qtSZOqDQLTXmXLi47QpmOkCqU=";
 
   mypy-boto3-location =
     buildMypyBoto3Package "location" "1.43.0"
@@ -966,8 +966,8 @@ in
       "sha256-by5t5x+vu84vjqe176tFcz1zhDUIsmUo6dH5f3OyWOw=";
 
   mypy-boto3-opensearch =
-    buildMypyBoto3Package "opensearch" "1.43.4"
-      "sha256-muP+M/cm1H0a0nYrOLmX7OESNFIsYyCyg7Rbj93TDJw=";
+    buildMypyBoto3Package "opensearch" "1.43.7"
+      "sha256-1SO4Vhj8GLEK70etYMCBI/0ePrBZgCdpwTPaEcwl5zM=";
 
   mypy-boto3-opensearchserverless =
     buildMypyBoto3Package "opensearchserverless" "1.43.0"
@@ -1070,8 +1070,8 @@ in
       "sha256-YrrEKl3aGz//5Z5JGapHhWtk6hBXQ4cuRQmLqGYztzg=";
 
   mypy-boto3-quicksight =
-    buildMypyBoto3Package "quicksight" "1.43.2"
-      "sha256-Xx5T3gaf6AlZLHooWhnD5lU6DPGBz/rNyvSzCUFc7vQ=";
+    buildMypyBoto3Package "quicksight" "1.43.7"
+      "sha256-lRhSTB6e+ZikBAKlMumS7ggBeGuneDKiUtzcVHvJDVM=";
 
   mypy-boto3-ram =
     buildMypyBoto3Package "ram" "1.43.0"
@@ -1090,8 +1090,8 @@ in
       "sha256-sgjEU7RqruiFWqUxxiDt/mx0uTJFhJQxkJsXvo5lYbk=";
 
   mypy-boto3-redshift =
-    buildMypyBoto3Package "redshift" "1.43.0"
-      "sha256-oTWIE3DrHvzypf21knCGIBc4iFFPb0cDaDXWxlCOTMA=";
+    buildMypyBoto3Package "redshift" "1.43.7"
+      "sha256-2YZ1Q6A1NWv1TeigA9Rs7a/szHz0QrbCnQX5+XyavcE=";
 
   mypy-boto3-redshift-data =
     buildMypyBoto3Package "redshift-data" "1.43.0"
@@ -1170,8 +1170,8 @@ in
       "sha256-T+JIJpHxD7IzAwq8yxgq6zbVMj/btpbhKnylMyfFvvU=";
 
   mypy-boto3-sagemaker =
-    buildMypyBoto3Package "sagemaker" "1.43.5"
-      "sha256-LQNQUR4kO95oyTH8xZDkZwj3gIaF+rHdR5VbtkXeaT4=";
+    buildMypyBoto3Package "sagemaker" "1.43.7"
+      "sha256-32sFjHHqE0IU9DouhrWPMG3RKpOYZ5Z2af+hD0vJkyg=";
 
   mypy-boto3-sagemaker-a2i-runtime =
     buildMypyBoto3Package "sagemaker-a2i-runtime" "1.43.0"
@@ -1318,8 +1318,8 @@ in
       "sha256-rMrmybKplGKYPFr1cIQaHRs/bwcKFYlFWCQRe7PxXOk=";
 
   mypy-boto3-stepfunctions =
-    buildMypyBoto3Package "stepfunctions" "1.43.0"
-      "sha256-ure1FWQ1DXOg8bmOwCzTqKm5Mci0L+jm/XcPsCe/jYE=";
+    buildMypyBoto3Package "stepfunctions" "1.43.7"
+      "sha256-vu4gaGfa504vH0UFXiynyAA/UCzQxbMd14QSl1jmHk4=";
 
   mypy-boto3-storagegateway =
     buildMypyBoto3Package "storagegateway" "1.43.0"
diff --git a/pkgs/development/python-modules/opensfm/0001-cmake-use-system-pybind11.patch b/pkgs/development/python-modules/opensfm/0001-cmake-use-system-pybind11.patch
new file mode 100644
index 000000000000..4d65c8407862
--- /dev/null
+++ b/pkgs/development/python-modules/opensfm/0001-cmake-use-system-pybind11.patch
@@ -0,0 +1,20 @@
+diff --git a/opensfm/src/CMakeLists.txt b/opensfm/src/CMakeLists.txt
+index 88a7dd8..f755e8e 100644
+--- a/opensfm/src/CMakeLists.txt
++++ b/opensfm/src/CMakeLists.txt
+@@ -58,6 +58,7 @@ if (OPENMP_FOUND)
+   set (CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${OpenMP_CXX_FLAGS}")
+ endif()
+ 
++find_package(pybind11 REQUIRED)
+ find_package(LAPACK)
+ find_package(SuiteSparse)
+ find_package(Eigen3 REQUIRED)
+@@ -109,7 +110,6 @@ if(TARGET opencv_imgcodecs)
+ endif()
+ 
+ ####### Third party libraries #######
+-add_subdirectory(third_party/pybind11)
+ add_subdirectory(third_party/akaze)
+ add_subdirectory(third_party/vlfeat)
+ 
diff --git a/pkgs/development/python-modules/opensfm/0002-cmake-find-system-distributed-gtest.patch b/pkgs/development/python-modules/opensfm/0002-cmake-find-system-distributed-gtest.patch
index 27b87c0b2d09..1d3db15e8f83 100644
--- a/pkgs/development/python-modules/opensfm/0002-cmake-find-system-distributed-gtest.patch
+++ b/pkgs/development/python-modules/opensfm/0002-cmake-find-system-distributed-gtest.patch
@@ -1,57 +1,42 @@
-From 79577371be21df40f1f6d4a4fe3453be6df9e93c Mon Sep 17 00:00:00 2001
-From: Someone Serge <sergei.kozlukov@aalto.fi>
-Date: Fri, 31 Dec 2021 10:03:25 +0200
-Subject: [PATCH 2/4] cmake: find system-distributed gtest
-
----
- opensfm/src/CMakeLists.txt | 19 +++++++------------
- 1 file changed, 7 insertions(+), 12 deletions(-)
-
 diff --git a/opensfm/src/CMakeLists.txt b/opensfm/src/CMakeLists.txt
-index c85aa6fb..640d47a6 100644
+index f755e8e..3dd6cd2 100644
 --- a/opensfm/src/CMakeLists.txt
 +++ b/opensfm/src/CMakeLists.txt
-@@ -52,12 +52,14 @@ if (OPENMP_FOUND)
-   set (CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} ${OpenMP_CXX_FLAGS}")
- endif()
- 
-+find_package(gflags REQUIRED)
-+
- find_package(LAPACK)
- find_package(SuiteSparse)
+@@ -64,6 +64,7 @@ find_package(SuiteSparse)
  find_package(Eigen3 REQUIRED)
  find_package(Ceres)
--find_package(Gflags REQUIRED)
--find_package(Glog REQUIRED)
-+find_package(glog REQUIRED)
+ find_package(Gflags REQUIRED)
 +find_package(GTest REQUIRED)
  
- # Ceres2 exposes Ceres::ceres target.
- # Ceres1 exposes just ceres.
-@@ -100,20 +102,13 @@ option(OPENSFM_BUILD_TESTS "Build OpenSfM unit tests." on)
+ # Try to find glog using its native CMake config first (modern systems)
+ # Fall back to custom FindGlog.cmake for older systems (e.g., Ubuntu 20.04)
+@@ -129,8 +130,6 @@ option(OPENSFM_BUILD_TESTS "Build OpenSfM unit tests." on)
  
  if (OPENSFM_BUILD_TESTS)
    enable_testing()
 -  include_directories(third_party/gtest)
 -  add_definitions(-DCERES_GFLAGS_NAMESPACE=${GFLAGS_NAMESPACE})
--
+ 
+   # Gtest if old now and trigger these
+   set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -Wno-missing-field-initializers")
+@@ -138,18 +137,12 @@ if (OPENSFM_BUILD_TESTS)
+       "${CMAKE_CXX_FLAGS} -Wno-deprecated-copy-with-user-provided-copy"
+   )
+ 
 -  add_library(gtest
 -              third_party/gtest/gmock_gtest_all.cc
 -              third_party/gtest/gmock_main.cc)
 -  target_include_directories(gtest PRIVATE ${GFLAGS_INCLUDE_DIR})
- 
+-  target_link_libraries(gtest PRIVATE glog::glog)
+-
    set(TEST_MAIN test_main)
    add_library(${TEST_MAIN} testing_main.cc)
    target_link_libraries(${TEST_MAIN}
 -                        ${GFLAGS_LIBRARY}
--                        ${GLOG_LIBRARY}
++                        gflags
+                         glog::glog
 -                        gtest)
-+      gflags
-+      glog::glog
-+      GTest::gtest)
++                        GTest::gtest)
  endif()
  
  ####### OpenSfM libraries #######
--- 
-2.33.1
-
diff --git a/pkgs/development/python-modules/opensfm/0003-cmake-use-system-pybind11.patch b/pkgs/development/python-modules/opensfm/0003-cmake-use-system-pybind11.patch
deleted file mode 100644
index 2815886e7e18..000000000000
--- a/pkgs/development/python-modules/opensfm/0003-cmake-use-system-pybind11.patch
+++ /dev/null
@@ -1,161 +0,0 @@
-From 36820fbab1abeeebd99f14e368093e0e3f934ca7 Mon Sep 17 00:00:00 2001
-From: Someone Serge <sergei.kozlukov@aalto.fi>
-Date: Sat, 19 Feb 2022 02:37:54 +0200
-Subject: [PATCH 3/4] cmake: use system pybind11
-
----
- opensfm/src/CMakeLists.txt            | 3 ++-
- opensfm/src/bundle/CMakeLists.txt     | 2 +-
- opensfm/src/dense/CMakeLists.txt      | 2 +-
- opensfm/src/features/CMakeLists.txt   | 1 -
- opensfm/src/foundation/CMakeLists.txt | 1 -
- opensfm/src/geo/CMakeLists.txt        | 1 -
- opensfm/src/geometry/CMakeLists.txt   | 1 -
- opensfm/src/map/CMakeLists.txt        | 3 +--
- opensfm/src/robust/CMakeLists.txt     | 1 -
- opensfm/src/sfm/CMakeLists.txt        | 1 -
- 10 files changed, 5 insertions(+), 11 deletions(-)
-
-diff --git a/opensfm/src/CMakeLists.txt b/opensfm/src/CMakeLists.txt
-index 640d47a6..6e391ffa 100644
---- a/opensfm/src/CMakeLists.txt
-+++ b/opensfm/src/CMakeLists.txt
-@@ -54,6 +54,8 @@ endif()
- 
- find_package(gflags REQUIRED)
- 
-+find_package(pybind11 REQUIRED)
-+
- find_package(LAPACK)
- find_package(SuiteSparse)
- find_package(Eigen3 REQUIRED)
-@@ -82,7 +84,6 @@ else()
- endif()
- 
- ####### Third party libraries #######
--add_subdirectory(third_party/pybind11)
- add_subdirectory(third_party/akaze)
- add_subdirectory(third_party/vlfeat)
- 
-diff --git a/opensfm/src/bundle/CMakeLists.txt b/opensfm/src/bundle/CMakeLists.txt
-index 7cd9cf74..307e963a 100644
---- a/opensfm/src/bundle/CMakeLists.txt
-+++ b/opensfm/src/bundle/CMakeLists.txt
-@@ -52,7 +52,7 @@ target_link_libraries(pybundle PRIVATE
-   bundle
-   geometry
-   foundation
--  pybind11)
-+)
- set_target_properties(pybundle PROPERTIES
-     LIBRARY_OUTPUT_DIRECTORY "${opensfm_SOURCE_DIR}/.."
- )
-diff --git a/opensfm/src/dense/CMakeLists.txt b/opensfm/src/dense/CMakeLists.txt
-index cbebb5ea..2728749d 100644
---- a/opensfm/src/dense/CMakeLists.txt
-+++ b/opensfm/src/dense/CMakeLists.txt
-@@ -23,7 +23,7 @@ endif()
- 
- pybind11_add_module(pydense python/pybind.cc)
- target_include_directories(pydense PRIVATE ${GLOG_INCLUDE_DIR})
--target_link_libraries(pydense PRIVATE dense foundation pybind11)
-+target_link_libraries(pydense PRIVATE dense foundation)
- set_target_properties(pydense PROPERTIES
-     LIBRARY_OUTPUT_DIRECTORY "${opensfm_SOURCE_DIR}/.."
- )
-diff --git a/opensfm/src/features/CMakeLists.txt b/opensfm/src/features/CMakeLists.txt
-index b131d30a..6db5b3f1 100644
---- a/opensfm/src/features/CMakeLists.txt
-+++ b/opensfm/src/features/CMakeLists.txt
-@@ -22,7 +22,6 @@ target_link_libraries(pyfeatures
-   PRIVATE
-     features
-     foundation
--    pybind11
-     akaze
- )
- set_target_properties(pyfeatures PROPERTIES
-diff --git a/opensfm/src/foundation/CMakeLists.txt b/opensfm/src/foundation/CMakeLists.txt
-index 40185227..9e0e45e7 100644
---- a/opensfm/src/foundation/CMakeLists.txt
-+++ b/opensfm/src/foundation/CMakeLists.txt
-@@ -12,7 +12,6 @@ set(FOUNDATION_FILES
- add_library(foundation ${FOUNDATION_FILES})
- target_link_libraries(foundation
-   PUBLIC
--    pybind11
-     ${OpenCV_LIBS}
-     ${OpenMP_libomp_LIBRARY}
-     Eigen3::Eigen
-diff --git a/opensfm/src/geo/CMakeLists.txt b/opensfm/src/geo/CMakeLists.txt
-index a9cbae02..75620d06 100644
---- a/opensfm/src/geo/CMakeLists.txt
-+++ b/opensfm/src/geo/CMakeLists.txt
-@@ -29,7 +29,6 @@ target_link_libraries(pygeo
-   PRIVATE
-     geo
-     foundation
--    pybind11
- )
- set_target_properties(pygeo PROPERTIES
-     LIBRARY_OUTPUT_DIRECTORY "${opensfm_SOURCE_DIR}/.."
-diff --git a/opensfm/src/geometry/CMakeLists.txt b/opensfm/src/geometry/CMakeLists.txt
-index e6dda2c2..51bfd6c5 100644
---- a/opensfm/src/geometry/CMakeLists.txt
-+++ b/opensfm/src/geometry/CMakeLists.txt
-@@ -48,7 +48,6 @@ target_link_libraries(pygeometry
-   PRIVATE
-     geometry
-     foundation
--    pybind11
- )
- set_target_properties(pygeometry PROPERTIES
-     LIBRARY_OUTPUT_DIRECTORY "${opensfm_SOURCE_DIR}/.."
-diff --git a/opensfm/src/map/CMakeLists.txt b/opensfm/src/map/CMakeLists.txt
-index b6f67bcd..f869aa4c 100644
---- a/opensfm/src/map/CMakeLists.txt
-+++ b/opensfm/src/map/CMakeLists.txt
-@@ -20,7 +20,7 @@ set(MAP_FILES
- add_library(map ${MAP_FILES})
- target_link_libraries(map
-   PUBLIC
--    pybind11
-+    pybind11::module
-     Eigen3::Eigen
-   PRIVATE
-     geo
-@@ -39,7 +39,6 @@ target_link_libraries(pymap
-     map
-     geometry
-     bundle
--    pybind11
- )
- 
- if (OPENSFM_BUILD_TESTS)
-diff --git a/opensfm/src/robust/CMakeLists.txt b/opensfm/src/robust/CMakeLists.txt
-index ce70749f..40bdf7a4 100644
---- a/opensfm/src/robust/CMakeLists.txt
-+++ b/opensfm/src/robust/CMakeLists.txt
-@@ -29,7 +29,6 @@ target_link_libraries(pyrobust
-   PRIVATE
-     robust
-     foundation
--    pybind11
- )
- set_target_properties(pyrobust PROPERTIES
-     LIBRARY_OUTPUT_DIRECTORY "${opensfm_SOURCE_DIR}/.."
-diff --git a/opensfm/src/sfm/CMakeLists.txt b/opensfm/src/sfm/CMakeLists.txt
-index 98c28f41..7f56b791 100644
---- a/opensfm/src/sfm/CMakeLists.txt
-+++ b/opensfm/src/sfm/CMakeLists.txt
-@@ -35,7 +35,6 @@ target_include_directories(pysfm PRIVATE ${GLOG_INCLUDE_DIR})
- target_link_libraries(pysfm
-   PRIVATE
-     foundation
--    pybind11
-     sfm
- )
- set_target_properties(pysfm PROPERTIES
--- 
-2.33.1
-
diff --git a/pkgs/development/python-modules/opensfm/fix-scripts.patch b/pkgs/development/python-modules/opensfm/0003-fix-scripts.patch
similarity index 54%
rename from pkgs/development/python-modules/opensfm/fix-scripts.patch
rename to pkgs/development/python-modules/opensfm/0003-fix-scripts.patch
index 634820a32755..1e96bc21fc3e 100644
--- a/pkgs/development/python-modules/opensfm/fix-scripts.patch
+++ b/pkgs/development/python-modules/opensfm/0003-fix-scripts.patch
@@ -1,5 +1,5 @@
 diff --git a/bin/opensfm b/bin/opensfm
-index b5ee4b15..f05c0d1c 100755
+index b5ee4b1..f05c0d1 100755
 --- a/bin/opensfm
 +++ b/bin/opensfm
 @@ -1,12 +1,6 @@
@@ -18,24 +18,11 @@ index b5ee4b15..f05c0d1c 100755
 -"$PYTHON" "$DIR"/opensfm_main.py "$@"
 +exec "$DIR"/opensfm_main.py "$@"
 diff --git a/bin/opensfm_main.py b/bin/opensfm_main.py
-index 31249e12..cc71560c 100755
+index b91abcf..531a492 100755
 --- a/bin/opensfm_main.py
 +++ b/bin/opensfm_main.py
-@@ -1,3 +1,5 @@
+@@ -1,3 +1,4 @@
 +#!/usr/bin/env python
-+
+ # pyre-strict
  import sys
- from os.path import abspath, join, dirname
- 
-diff --git a/setup.py b/setup.py
-index 1120717f..438a16db 100644
---- a/setup.py
-+++ b/setup.py
-@@ -71,6 +71,7 @@ setuptools.setup(
-     scripts=[
-         "bin/opensfm_run_all",
-         "bin/opensfm",
-+        "bin/opensfm_main.py",
-     ],
-     package_data={
-         "opensfm": [
+ from os.path import abspath, dirname, join
diff --git a/pkgs/development/python-modules/opensfm/0004-pybind_utils.h-conflicts-with-nixpkgs-pybind.patch b/pkgs/development/python-modules/opensfm/0004-pybind_utils.h-conflicts-with-nixpkgs-pybind.patch
deleted file mode 100644
index f3cb2db00ecb..000000000000
--- a/pkgs/development/python-modules/opensfm/0004-pybind_utils.h-conflicts-with-nixpkgs-pybind.patch
+++ /dev/null
@@ -1,86 +0,0 @@
-From c35b110a83286e7413d7309eb218eb43b52f7d48 Mon Sep 17 00:00:00 2001
-From: Someone Serge <sergei.kozlukov@aalto.fi>
-Date: Sat, 19 Feb 2022 14:36:12 +0200
-Subject: [PATCH 4/4] pybind_utils.h: conflicts with nixpkgs' pybind
-
----
- opensfm/src/map/pybind_utils.h | 45 +++-------------------------------
- 1 file changed, 3 insertions(+), 42 deletions(-)
-
-diff --git a/opensfm/src/map/pybind_utils.h b/opensfm/src/map/pybind_utils.h
-index 817d1a16..3f98a2ab 100644
---- a/opensfm/src/map/pybind_utils.h
-+++ b/opensfm/src/map/pybind_utils.h
-@@ -52,38 +52,6 @@ struct sfm_iterator_state {
- };
- PYBIND11_NAMESPACE_END_(detail)
- 
--/// Makes an python iterator over the keys (`.first`) of a iterator over pairs
--/// from a first and past-the-end InputIterator.
--template <return_value_policy Policy = return_value_policy::reference_internal,
--          typename Iterator, typename Sentinel,
--          typename KeyType = decltype((*std::declval<Iterator>()).second),
--          typename... Extra>
--iterator make_value_iterator(Iterator first, Sentinel last, Extra &&... extra) {
--  typedef detail::sfm_iterator_state<Iterator, Sentinel, detail::RefIterator,
--                                     Policy>
--      state;
--
--  if (!detail::get_type_info(typeid(state), false)) {
--    class_<state>(handle(), "iterator", pybind11::module_local())
--        .def("__iter__", [](state &s) -> state & { return s; })
--        .def("__next__",
--             [](state &s) -> KeyType {
--               if (!s.first_or_done)
--                 ++s.it;
--               else
--                 s.first_or_done = false;
--               if (s.it == s.end) {
--                 s.first_or_done = true;
--                 throw stop_iteration();
--               }
--               return (*s.it).second;
--             },
--             std::forward<Extra>(extra)..., Policy);
--  }
--
--  return cast(state{first, last, true});
--}
--
- template <return_value_policy Policy = return_value_policy::reference_internal,
-           typename Iterator, typename Sentinel,
-           typename KeyType = decltype(&((*std::declval<Iterator>()).second)),
-@@ -148,12 +116,13 @@ iterator make_ref_iterator(Iterator first, Sentinel last, Extra &&... extra) {
- }
- 
- /// Makes a python iterator from a first and past-the-end C++ InputIterator.
--template <return_value_policy Policy = return_value_policy::reference_internal,
-+template <typename Access,
-+          return_value_policy Policy = return_value_policy::reference_internal,
-           typename Iterator, typename Sentinel,
-           typename ValueType = decltype(std::declval<Iterator>()),
-           typename... Extra>
- iterator make_ptr_iterator(Iterator first, Sentinel last, Extra &&... extra) {
--  typedef detail::iterator_state<Iterator, Sentinel, false, Policy> state;
-+  typedef detail::iterator_state<Access, Policy, Iterator, Sentinel, ValueType, Extra...> state;
- 
-   if (!detail::get_type_info(typeid(state), false)) {
-     class_<state>(handle(), "iterator", pybind11::module_local())
-@@ -176,14 +145,6 @@ iterator make_ptr_iterator(Iterator first, Sentinel last, Extra &&... extra) {
-   return cast(state{first, last, true});
- }
- 
--/// Makes an iterator over the keys (`.first`) of a stl map-like container
--/// supporting `std::begin()`/`std::end()`
--template <return_value_policy Policy = return_value_policy::reference_internal,
--          typename Type, typename... Extra>
--iterator make_value_iterator(Type &value, Extra &&... extra) {
--  return make_value_iterator<Policy>(std::begin(value), std::end(value),
--                                     extra...);
--}
- template <return_value_policy Policy = return_value_policy::reference_internal,
-           typename Type, typename... Extra>
- iterator make_unique_ptr_value_iterator(Type &value, Extra &&... extra) {
--- 
-2.33.1
-
diff --git a/pkgs/development/python-modules/opensfm/0005-fix-numpy-2-test-failures.patch b/pkgs/development/python-modules/opensfm/0005-fix-numpy-2-test-failures.patch
deleted file mode 100644
index 444471d37f4d..000000000000
--- a/pkgs/development/python-modules/opensfm/0005-fix-numpy-2-test-failures.patch
+++ /dev/null
@@ -1,239 +0,0 @@
-diff --git a/opensfm/exif.py b/opensfm/exif.py
---- a/opensfm/exif.py
-+++ b/opensfm/exif.py
-@@ -509,7 +509,7 @@ class EXIF:
-                     )
-                 )
- 
--            if np.all(ypr) is not None:
-+            if np.all(ypr != None):
-                 ypr = np.radians(ypr)
- 
-                 # Convert YPR --> OPK
-diff --git a/opensfm/transformations.py b/opensfm/transformations.py
---- a/opensfm/transformations.py
-+++ b/opensfm/transformations.py
-@@ -232,7 +232,7 @@ def translation_from_matrix(matrix: numpy.ndarray) -> numpy.ndarray:
-     True
- 
-     """
--    return numpy.array(matrix, copy=False)[:3, 3].copy()
-+    return numpy.asarray(matrix)[:3, 3].copy()
- 
- 
- def reflection_matrix(point: numpy.ndarray, normal: numpy.ndarray) -> numpy.ndarray:
-@@ -275,7 +275,7 @@ def reflection_from_matrix(
-     True
- 
-     """
--    M = numpy.array(matrix, dtype=numpy.float64, copy=False)
-+    M = numpy.asarray(matrix, dtype=numpy.float64)
-     # normal: unit eigenvector corresponding to eigenvalue -1
-     w, V = numpy.linalg.eig(M[:3, :3])
-     i = numpy.where(abs(numpy.real(w) + 1.0) < 1e-8)[0]
-@@ -339,7 +339,7 @@ def rotation_matrix(
-     M[:3, :3] = R
-     if point is not None:
-         # rotation not around origin
--        point = numpy.array(point[:3], dtype=numpy.float64, copy=False)
-+        point = numpy.asarray(point[:3], dtype=numpy.float64)
-         M[:3, 3] = point - numpy.dot(R, point)
-     return M
- 
-@@ -359,7 +359,7 @@ def rotation_from_matrix(
-     True
- 
-     """
--    R = numpy.array(matrix, dtype=numpy.float64, copy=False)
-+    R = numpy.asarray(matrix, dtype=numpy.float64)
-     R33 = R[:3, :3]
-     # direction: unit eigenvector of R33 corresponding to eigenvalue of 1
-     w, W = numpy.linalg.eig(R33.T)
-@@ -444,7 +444,7 @@ def scale_from_matrix(
-     True
- 
-     """
--    M = numpy.array(matrix, dtype=numpy.float64, copy=False)
-+    M = numpy.asarray(matrix, dtype=numpy.float64)
-     M33 = M[:3, :3]
-     factor = numpy.trace(M33) - 2.0
-     try:
-@@ -505,11 +505,11 @@ def projection_matrix(
- 
-     """
-     M = numpy.identity(4)
--    point = numpy.array(point[:3], dtype=numpy.float64, copy=False)
-+    point = numpy.asarray(point[:3], dtype=numpy.float64)
-     normal = unit_vector(normal[:3])
-     if perspective is not None:
-         # perspective projection
--        perspective = numpy.array(perspective[:3], dtype=numpy.float64, copy=False)
-+        perspective = numpy.asarray(perspective[:3], dtype=numpy.float64)
-         M[0, 0] = M[1, 1] = M[2, 2] = numpy.dot(perspective - point, normal)
-         M[:3, :3] -= numpy.outer(perspective, normal)
-         if pseudo:
-@@ -522,7 +522,7 @@ def projection_matrix(
-         M[3, 3] = numpy.dot(perspective, normal)
-     elif direction is not None:
-         # parallel projection
--        direction = numpy.array(direction[:3], dtype=numpy.float64, copy=False)
-+        direction = numpy.asarray(direction[:3], dtype=numpy.float64)
-         scale = numpy.dot(direction, normal)
-         M[:3, :3] -= numpy.outer(direction, normal) / scale
-         M[:3, 3] = direction * (numpy.dot(point, normal) / scale)
-@@ -569,7 +569,7 @@ def projection_from_matrix(
-     True
- 
-     """
--    M = numpy.array(matrix, dtype=numpy.float64, copy=False)
-+    M = numpy.asarray(matrix, dtype=numpy.float64)
-     M33 = M[:3, :3]
-     w, V = numpy.linalg.eig(M)
-     i = numpy.where(abs(numpy.real(w) - 1.0) < 1e-8)[0]
-@@ -726,7 +726,7 @@ def shear_from_matrix(
-     True
- 
-     """
--    M = numpy.array(matrix, dtype=numpy.float64, copy=False)
-+    M = numpy.asarray(matrix, dtype=numpy.float64)
-     M33 = M[:3, :3]
-     # normal: cross independent eigenvectors corresponding to the eigenvalue 1
-     w, V = numpy.linalg.eig(M33)
-@@ -790,7 +790,7 @@ def decompose_matrix(
-     True
- 
-     """
--    M = numpy.array(matrix, dtype=numpy.float64, copy=True).T
-+    M = numpy.asarray(matrix, dtype=numpy.float64, copy=True).T
-     if abs(M[3, 3]) < _EPS:
-         raise ValueError("M[3, 3] is zero")
-     M /= M[3, 3]
-@@ -982,8 +982,8 @@ def affine_matrix_from_points(
-     More examples in superimposition_matrix()
- 
-     """
--    v0 = numpy.array(v0, dtype=numpy.float64, copy=True)
--    v1 = numpy.array(v1, dtype=numpy.float64, copy=True)
-+    v0 = numpy.asarray(v0, dtype=numpy.float64, copy=True)
-+    v1 = numpy.asarray(v1, dtype=numpy.float64, copy=True)
- 
-     ndims = v0.shape[0]
-     if ndims < 2 or v0.shape[1] < ndims or v0.shape != v1.shape:
-@@ -1099,8 +1099,8 @@ def superimposition_matrix(
-     True
- 
-     """
--    v0 = numpy.array(v0, dtype=numpy.float64, copy=False)[:3]
--    v1 = numpy.array(v1, dtype=numpy.float64, copy=False)[:3]
-+    v0 = numpy.asarray(v0, dtype=numpy.float64)[:3]
-+    v1 = numpy.asarray(v1, dtype=numpy.float64)[:3]
-     return affine_matrix_from_points(v0, v1, shear=False, scale=scale, usesvd=usesvd)
- 
- 
-@@ -1198,7 +1198,7 @@ def euler_from_matrix(
-     j = _NEXT_AXIS[i + parity]
-     k = _NEXT_AXIS[i - parity + 1]
- 
--    M = numpy.array(matrix, dtype=numpy.float64, copy=False)[:3, :3]
-+    M = numpy.asarray(matrix, dtype=numpy.float64)[:3, :3]
-     if repetition:
-         sy = math.sqrt(M[i, j] * M[i, j] + M[i, k] * M[i, k])
-         if sy > _EPS:
-@@ -1329,7 +1329,7 @@ def quaternion_matrix(quaternion: numpy.ndarray) -> numpy.ndarray:
-     True
- 
-     """
--    q = numpy.array(quaternion, dtype=numpy.float64, copy=True)
-+    q = numpy.asarray(quaternion, dtype=numpy.float64, copy=True)
-     n = numpy.dot(q, q)
-     if n < _EPS:
-         return numpy.identity(4)
-@@ -1379,7 +1379,7 @@ def quaternion_from_matrix(
-     True
- 
-     """
--    M = numpy.array(matrix, dtype=numpy.float64, copy=False)[:4, :4]
-+    M = numpy.asarray(matrix, dtype=numpy.float64)[:4, :4]
-     if isprecise:
-         q = numpy.empty((4,))
-         t = numpy.trace(M)
-@@ -1460,7 +1460,7 @@ def quaternion_conjugate(quaternion: numpy.ndarray) -> numpy.ndarray:
-     True
- 
-     """
--    q = numpy.array(quaternion, dtype=numpy.float64, copy=True)
-+    q = numpy.asarray(quaternion, dtype=numpy.float64, copy=True)
-     numpy.negative(q[1:], q[1:])
-     return q
- 
-@@ -1474,7 +1474,7 @@ def quaternion_inverse(quaternion: numpy.ndarray) -> numpy.ndarray:
-     True
- 
-     """
--    q = numpy.array(quaternion, dtype=numpy.float64, copy=True)
-+    q = numpy.asarray(quaternion, dtype=numpy.float64, copy=True)
-     numpy.negative(q[1:], q[1:])
-     return q / numpy.dot(q, q)
- 
-@@ -1496,7 +1496,7 @@ def quaternion_imag(quaternion: numpy.ndarray) -> numpy.ndarray:
-     array([ 0.,  1.,  2.])
- 
-     """
--    return numpy.array(quaternion[1:4], dtype=numpy.float64, copy=True)
-+    return numpy.asarray(quaternion[1:4], dtype=numpy.float64, copy=True)
- 
- 
- def quaternion_slerp(
-@@ -1654,7 +1654,7 @@ def vector_norm(
-     1.0
- 
-     """
--    data = numpy.array(data, dtype=numpy.float64, copy=True)
-+    data = numpy.asarray(data, dtype=numpy.float64, copy=True)
-     if out is None:
-         if data.ndim == 1:
-             return math.sqrt(numpy.dot(data, data))
-@@ -1697,13 +1697,13 @@ def unit_vector(
- 
-     """
-     if out is None:
--        data = numpy.array(data, dtype=numpy.float64, copy=True)
-+        data = numpy.asarray(data, dtype=numpy.float64, copy=True)
-         if data.ndim == 1:
-             data /= math.sqrt(numpy.dot(data, data))
-             return data
-     else:
-         if out is not data:
--            out[:] = numpy.array(data, copy=False)
-+            out[:] = numpy.asarray(data)
-         data = out
-     length = numpy.atleast_1d(numpy.sum(data * data, axis))
-     numpy.sqrt(length, length)
-@@ -1777,8 +1777,8 @@ def angle_between_vectors(
-     True
- 
-     """
--    v0 = numpy.array(v0, dtype=numpy.float64, copy=False)
--    v1 = numpy.array(v1, dtype=numpy.float64, copy=False)
-+    v0 = numpy.asarray(v0, dtype=numpy.float64)
-+    v1 = numpy.asarray(v1, dtype=numpy.float64)
-     dot = numpy.sum(v0 * v1, axis=axis)
-     dot /= vector_norm(v0, axis=axis) * vector_norm(v1, axis=axis)
-     dot = numpy.clip(dot, -1.0, 1.0)
-@@ -1826,9 +1826,9 @@ def is_same_transform(matrix0: numpy.ndarray, matrix1: numpy.ndarray) -> numpy.n
-     False
- 
-     """
--    matrix0 = numpy.array(matrix0, dtype=numpy.float64, copy=True)
-+    matrix0 = numpy.asarray(matrix0, dtype=numpy.float64, copy=True)
-     matrix0 /= matrix0[3, 3]
--    matrix1 = numpy.array(matrix1, dtype=numpy.float64, copy=True)
-+    matrix1 = numpy.asarray(matrix1, dtype=numpy.float64, copy=True)
-     matrix1 /= matrix1[3, 3]
-     return numpy.allclose(matrix0, matrix1)
- 
-@@ -1874,3 +1874,4 @@ if __name__ == "__main__":
- 
-     numpy.set_printoptions(suppress=True, precision=5)
-     doctest.testmod()
-+
diff --git a/pkgs/development/python-modules/opensfm/default.nix b/pkgs/development/python-modules/opensfm/default.nix
index 59bf764902dd..2a7a13e7924c 100644
--- a/pkgs/development/python-modules/opensfm/default.nix
+++ b/pkgs/development/python-modules/opensfm/default.nix
@@ -3,8 +3,10 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+  runCommand,
+  srcOnly,
+  bashNonInteractive,
   cmake,
-  opencv4,
   ceres-solver,
   suitesparse,
   metis,
@@ -14,6 +16,9 @@
   pybind11,
   numpy,
   pyyaml,
+  flask,
+  fpdf2,
+  opencv-python,
   lapack,
   gtest,
   gflags,
@@ -22,46 +27,42 @@
   networkx,
   pillow,
   exifread,
-  gpxpy,
   pyproj,
   python-dateutil,
   joblib,
-  repoze-lru,
   xmltodict,
-  distutils,
   cloudpickle,
   scipy,
   sphinx,
   matplotlib,
-  fpdf,
+  scikit-build-core,
+  ninja,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "opensfm";
-  version = "unstable-2023-12-09";
+  version = "0.5.1-unstable-2026-05-04";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mapillary";
     repo = "OpenSfM";
-    rev = "7f170d0dc352340295ff480378e3ac37d0179f8e";
-    sha256 = "sha256-l/HTVenC+L+GpMNnDgnSGZ7+Qd2j8b8cuTs3SmORqrg=";
+    rev = "1dc5b95b5c8c4cadd653bdc9f6eb97c0ac1602ba";
+    sha256 = "sha256-K3+H8QSzTxIGAtYDGqOuJFTVaqk+B/R/MDMepJ/bRxY=";
   };
 
   patches = [
+    ./0001-cmake-use-system-pybind11.patch
     ./0002-cmake-find-system-distributed-gtest.patch
-    ./0003-cmake-use-system-pybind11.patch
-    ./0004-pybind_utils.h-conflicts-with-nixpkgs-pybind.patch
-    ./0005-fix-numpy-2-test-failures.patch # not upstreamed due to cla, but you're free upstream it -@pbsds
-    ./fix-scripts.patch
+    ./0003-fix-scripts.patch
   ];
 
   postPatch = ''
-    substituteInPlace opensfm/src/CMakeLists.txt \
-      --replace-fail "cmake_minimum_required(VERSION 3.0)" "cmake_minimum_required(VERSION 3.10)"
-
-    rm opensfm/src/cmake/FindGlog.cmake
+    # devendor
+    rm opensfm/src/cmake/FindGlog.cmake # (ubuntu 20.04 fallback)
     rm opensfm/src/cmake/FindGflags.cmake
+    rm -rf  opensfm/src/third_party/gtest
+    rm -rf  opensfm/src/third_party/pybind11
 
     # HAHOG is the default descriptor.
     # We'll test both HAHOG and SIFT because this is
@@ -72,15 +73,20 @@ buildPythonPackage rec {
     # make opensfm correctly import glog headers
     export CXXFLAGS=-DGLOG_USE_GLOG_EXPORT
 
-    sed -i -e 's/^.*BuildDoc.*$//' setup.py
+    # we use the pyproject.toml
+    rm setup.py
   '';
 
-  build-system = [ setuptools ];
+  dontUseCmakeConfigure = true;
+
+  build-system = [
+    setuptools
+    scikit-build-core
+    ninja
+  ];
 
   nativeBuildInputs = [
     cmake
-    pkg-config
-    sphinx
   ];
 
   buildInputs = [
@@ -93,41 +99,45 @@ buildPythonPackage rec {
     gtest
     glog
     pybind11
+    bashNonInteractive # for patchShebangs
   ];
 
   dependencies = [
     numpy
     scipy
     pyyaml
-    opencv4.cxxdev
+    flask
+    fpdf2
+    opencv-python
     networkx
     pillow
     matplotlib
-    fpdf
     exifread
-    gpxpy
     pyproj
     python-dateutil
     joblib
-    repoze-lru
     xmltodict
     cloudpickle
   ];
 
   nativeCheckInputs = [
     pytestCheckHook
-    distutils
   ];
 
-  dontUseCmakeBuildDir = true;
-  cmakeFlags = [
-    "-Bcmake_build"
-    "-Sopensfm/src"
-  ];
+  # pyproject.toml has yet to enable the [project.scripts]
+  postInstall = ''
+    if [[ -d $out/bin ]]; then
+      echo >&2 "ERROR: $out/bin found, re-check our assumptions"
+      false
+    fi
+    install -Dt $out/bin -m +rwx bin/opensfm
+    install -Dt $out/bin -m +rwx bin/opensfm_run_all
+    install -Dt $out/bin -m +rwx bin/opensfm_main.py
+  '';
 
   disabledTests = [
-    "test_run_all" # Matplotlib issues. Broken integration is less useless than a broken build
-    "test_match_candidates_from_metadata_bow" # flaky
+    # flaky
+    "test_match_candidates_from_metadata_bow"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     "test_reconstruction_incremental"
@@ -136,6 +146,27 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "opensfm" ];
 
+  # https://opensfm.org/docs/using.html#quickstart
+  passthru.tests = lib.genAttrs' [ "berlin" "lund" ] (
+    name:
+    lib.nameValuePair "integration-test-${name}" (
+      runCommand "opensfm-integration-test-${name}"
+        {
+          nativeBuildInputs = [ finalAttrs.finalPackage ];
+        }
+        ''
+          set -euo pipefail
+          opensfm --help
+          cp -r ${srcOnly finalAttrs.finalPackage}/data/${name} data
+          chmod -R +w data/
+          bash -x $(command -v opensfm_run_all) data/
+          if [[ -s data/camera_models.json && -s data/undistorted/reconstruction.json ]]; then
+            touch $out
+          fi
+        ''
+    )
+  );
+
   meta = {
     broken = stdenv.hostPlatform.isDarwin;
     maintainers = [
@@ -143,8 +174,8 @@ buildPythonPackage rec {
       lib.maintainers.SomeoneSerge
     ];
     license = lib.licenses.bsd2;
-    changelog = "https://github.com/mapillary/OpenSfM/blob/${src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/mapillary/OpenSfM/blob/${finalAttrs.src.rev}/CHANGELOG.md";
     description = "Open source Structure-from-Motion pipeline from Mapillary";
     homepage = "https://opensfm.org/";
   };
-}
+})
diff --git a/pkgs/development/python-modules/postgrest/default.nix b/pkgs/development/python-modules/postgrest/default.nix
index 8d73316e36dc..94a735648f14 100644
--- a/pkgs/development/python-modules/postgrest/default.nix
+++ b/pkgs/development/python-modules/postgrest/default.nix
@@ -14,19 +14,19 @@
   unasync,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "postgrest";
-  version = "2.28.3";
+  version = "2.29.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "supabase";
     repo = "supabase-py";
-    tag = "v${version}";
-    hash = "sha256-Ra7Ig9IMWouMIadx6mg/pe8GlgLCavR6OsPjqgySTCw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-LaSlAYFvx/HHdfmc9J+KScVQ9JFGS98Yfihzn8F7t3g=";
   };
 
-  sourceRoot = "${src.name}/src/postgrest";
+  sourceRoot = "${finalAttrs.src.name}/src/postgrest";
 
   build-system = [ uv-build ];
 
@@ -61,8 +61,8 @@ buildPythonPackage rec {
   meta = {
     description = "Client library for Supabase Functions";
     homepage = "https://github.com/supabase/supabase-py";
-    changelog = "https://github.com/supabase/supabase-py/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/supabase/supabase-py/blob/v${finalAttrs.src.tag}/CHANGELOG.md";
     maintainers = with lib.maintainers; [ macbucheron ];
     license = lib.licenses.mit;
   };
-}
+})
diff --git a/pkgs/development/python-modules/pydantic-ai-slim/default.nix b/pkgs/development/python-modules/pydantic-ai-slim/default.nix
index e216f972d654..52fad873c884 100644
--- a/pkgs/development/python-modules/pydantic-ai-slim/default.nix
+++ b/pkgs/development/python-modules/pydantic-ai-slim/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydantic-ai-slim";
-  version = "1.95.0";
+  version = "1.95.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "pydantic-ai";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-K4Cgssa7RFOTXnCiGwx0sFu7EypTX4GpIQAnom2JVZw=";
+    hash = "sha256-JE5ufIfwEVtJ9OOdPnuQPiOOvmo63l6D7IsNIats39c=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/pydantic_ai_slim";
diff --git a/pkgs/development/python-modules/pydantic-graph/default.nix b/pkgs/development/python-modules/pydantic-graph/default.nix
index 206dac229f87..ecd8a93b915e 100644
--- a/pkgs/development/python-modules/pydantic-graph/default.nix
+++ b/pkgs/development/python-modules/pydantic-graph/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydantic-graph";
-  version = "1.95.0";
+  version = "1.95.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "pydantic-ai";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-K4Cgssa7RFOTXnCiGwx0sFu7EypTX4GpIQAnom2JVZw=";
+    hash = "sha256-JE5ufIfwEVtJ9OOdPnuQPiOOvmo63l6D7IsNIats39c=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/pydantic_graph";
diff --git a/pkgs/development/python-modules/pydo/default.nix b/pkgs/development/python-modules/pydo/default.nix
index 7d4b103af0d8..8502813aa7ca 100644
--- a/pkgs/development/python-modules/pydo/default.nix
+++ b/pkgs/development/python-modules/pydo/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydo";
-  version = "0.33.0";
+  version = "0.34.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "digitalocean";
     repo = "pydo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-U6owPB+zTCT/5uoG3+BZcnmJqWammnih+jpo4DKUMcw=";
+    hash = "sha256-ykGrZN5Q4qcFLSHdOoiR4zOW1iTk8/laxcItcX7pJug=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/pynetbox/default.nix b/pkgs/development/python-modules/pynetbox/default.nix
index 9f234c0873f4..888a8ce22d85 100644
--- a/pkgs/development/python-modules/pynetbox/default.nix
+++ b/pkgs/development/python-modules/pynetbox/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pynetbox";
-  version = "7.6.1";
+  version = "7.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "netbox-community";
     repo = "pynetbox";
     tag = "v${version}";
-    hash = "sha256-PAWcLJvDrS70Y9pLGtdTbwiEjhOb6yiOPCT34RfnyjU=";
+    hash = "sha256-h/kEMPr3l9ZhWNv4i4R58AQ7z4WdVbBM5Mq3X6Hnp88=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pysmb/default.nix b/pkgs/development/python-modules/pysmb/default.nix
index d7296578d33e..1d074a81b6fd 100644
--- a/pkgs/development/python-modules/pysmb/default.nix
+++ b/pkgs/development/python-modules/pysmb/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "pysmb";
-  version = "1.2.13";
+  version = "1.2.14";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "miketeo";
     repo = "pysmb";
     tag = "pysmb-${version}";
-    hash = "sha256-CLjpUkDCtAZyneM+KFTE1G1Q3NIRRw2sIytIv30ZUgI=";
+    hash = "sha256-TwQ9gkhZ9nMyr30qJ9QVX3PPUtSPcxxBzKZr7Z7d9l8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/qbittorrent-api/default.nix b/pkgs/development/python-modules/qbittorrent-api/default.nix
index 9aa5c93dce71..84f35bc44e8f 100644
--- a/pkgs/development/python-modules/qbittorrent-api/default.nix
+++ b/pkgs/development/python-modules/qbittorrent-api/default.nix
@@ -15,13 +15,13 @@
 
 buildPythonPackage rec {
   pname = "qbittorrent-api";
-  version = "2025.11.1";
+  version = "2026.5.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "qbittorrent_api";
     inherit version;
-    hash = "sha256-XLKkafi8lfYW4DvQJZ2LS+YKXD3w1JkQxEMJsPWXJMQ=";
+    hash = "sha256-pCwSD+q5vqh/WSxg4i20LBRQv8JHUEtBzoNzC9x6C1s=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/qcodes-contrib-drivers/default.nix b/pkgs/development/python-modules/qcodes-contrib-drivers/default.nix
index fbe48ea2cd47..a277296bc61e 100644
--- a/pkgs/development/python-modules/qcodes-contrib-drivers/default.nix
+++ b/pkgs/development/python-modules/qcodes-contrib-drivers/default.nix
@@ -25,14 +25,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "qcodes-contrib-drivers";
-  version = "0.24.1";
+  version = "0.25.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "QCoDeS";
     repo = "Qcodes_contrib_drivers";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-s3Q3UV2vvNBDrcYrcl9mh+3LRvnHGDxO7vUZd/OwJM8=";
+    hash = "sha256-4ZVNd1cHqM3tuGcOxlBN8WX9i9u3XFlJ0zr06n7zpmI=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/qiskit/default.nix b/pkgs/development/python-modules/qiskit/default.nix
index 1ab91eaa020c..384efdcfd8d9 100644
--- a/pkgs/development/python-modules/qiskit/default.nix
+++ b/pkgs/development/python-modules/qiskit/default.nix
@@ -29,14 +29,14 @@
 
 buildPythonPackage rec {
   pname = "qiskit";
-  version = "2.3.1";
+  version = "2.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Qiskit";
     repo = "qiskit";
     tag = version;
-    hash = "sha256-7/7MjwA3XJ65Ylw0WljS8PQSwGJ6g8towTqn17qKBxw=";
+    hash = "sha256-Y5JgapafP3lxR7PMNB7+yDoM6vFvSoMZMrpOE2jeemU=";
   };
 
   nativeBuildInputs = [
@@ -54,7 +54,7 @@ buildPythonPackage rec {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src pname version;
-    hash = "sha256-/h5eCaZzGlXeoBp8+VvCrXF1RySjAKRP/QZjuB23ivU=";
+    hash = "sha256-skyZSoYO9XiwQGkgSxRCB3N0+XgDMM5IM9o6KfSG35k=";
   };
 
   dependencies = [
diff --git a/pkgs/development/python-modules/realtime/default.nix b/pkgs/development/python-modules/realtime/default.nix
index 34ac3f9bafb5..88f95f1a4f2b 100644
--- a/pkgs/development/python-modules/realtime/default.nix
+++ b/pkgs/development/python-modules/realtime/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "realtime";
-  version = "3.0.0a1";
+  version = "2.29.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "supabase";
     repo = "supabase-py";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Pvu2zyRKS99/KEIWwQXBR7Moegt0KITiaMWi5mi+CL4=";
+    hash = "sha256-LaSlAYFvx/HHdfmc9J+KScVQ9JFGS98Yfihzn8F7t3g=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/src/realtime";
@@ -57,6 +57,9 @@ buildPythonPackage (finalAttrs: {
     homepage = "https://github.com/supabase/supabase-py";
     changelog = "https://github.com/supabase/supabase-py/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ siegema ];
+    maintainers = with lib.maintainers; [
+      siegema
+      macbucheron
+    ];
   };
 })
diff --git a/pkgs/development/python-modules/storage3/default.nix b/pkgs/development/python-modules/storage3/default.nix
index 97d6ba899034..e901fe0a5379 100644
--- a/pkgs/development/python-modules/storage3/default.nix
+++ b/pkgs/development/python-modules/storage3/default.nix
@@ -14,19 +14,19 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "storage3";
-  version = "2.28.3";
+  version = "2.29.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "supabase";
     repo = "supabase-py";
-    tag = "v${version}";
-    hash = "sha256-Ra7Ig9IMWouMIadx6mg/pe8GlgLCavR6OsPjqgySTCw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-LaSlAYFvx/HHdfmc9J+KScVQ9JFGS98Yfihzn8F7t3g=";
   };
 
-  sourceRoot = "${src.name}/src/storage";
+  sourceRoot = "${finalAttrs.src.name}/src/storage";
 
   build-system = [ uv-build ];
 
@@ -61,8 +61,11 @@ buildPythonPackage rec {
   meta = {
     description = "Client library for Supabase Functions";
     homepage = "https://github.com/supabase/supabase-py";
-    changelog = "https://github.com/supabase/supabase-py/blob/${src.tag}/CHANGELOG.md";
-    maintainers = with lib.maintainers; [ siegema ];
+    changelog = "https://github.com/supabase/supabase-py/blob/v${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      siegema
+      macbucheron
+    ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/supabase-auth/default.nix b/pkgs/development/python-modules/supabase-auth/default.nix
index 9d09abc88313..bc576b2b9a49 100644
--- a/pkgs/development/python-modules/supabase-auth/default.nix
+++ b/pkgs/development/python-modules/supabase-auth/default.nix
@@ -12,19 +12,19 @@
   pytest-mock,
   pytest-asyncio,
 }:
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "supabase-auth";
-  version = "2.28.3";
+  version = "2.29.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "supabase";
     repo = "supabase-py";
-    tag = "v${version}";
-    hash = "sha256-Ra7Ig9IMWouMIadx6mg/pe8GlgLCavR6OsPjqgySTCw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-LaSlAYFvx/HHdfmc9J+KScVQ9JFGS98Yfihzn8F7t3g=";
   };
 
-  sourceRoot = "${src.name}/src/auth";
+  sourceRoot = "${finalAttrs.src.name}/src/auth";
 
   build-system = [ uv-build ];
 
@@ -59,8 +59,8 @@ buildPythonPackage rec {
   meta = {
     description = "Client library for Supabase Auth";
     homepage = "https://github.com/supabase/supabase-py/";
-    changelog = "https://github.com/supabase/supabase-py/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/supabase/supabase-py/blob/v${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ macbucheron ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/supabase-functions/default.nix b/pkgs/development/python-modules/supabase-functions/default.nix
index 5b64f658a45a..36738f53e2c2 100644
--- a/pkgs/development/python-modules/supabase-functions/default.nix
+++ b/pkgs/development/python-modules/supabase-functions/default.nix
@@ -11,19 +11,19 @@
   yarl,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "supabase-functions";
-  version = "2.28.3";
+  version = "2.29.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "supabase";
     repo = "supabase-py";
-    tag = "v${version}";
-    hash = "sha256-Ra7Ig9IMWouMIadx6mg/pe8GlgLCavR6OsPjqgySTCw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-LaSlAYFvx/HHdfmc9J+KScVQ9JFGS98Yfihzn8F7t3g=";
   };
 
-  sourceRoot = "${src.name}/src/functions";
+  sourceRoot = "${finalAttrs.src.name}/src/functions";
 
   build-system = [ uv-build ];
 
@@ -53,8 +53,8 @@ buildPythonPackage rec {
   meta = {
     description = "Client library for Supabase Functions";
     homepage = "https://github.com/supabase/supabase-py";
-    changelog = "https://github.com/supabase/supabase-py/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/supabase/supabase-py/blob/v${finalAttrs.src.tag}/CHANGELOG.md";
     maintainers = with lib.maintainers; [ macbucheron ];
     license = lib.licenses.mit;
   };
-}
+})
diff --git a/pkgs/development/python-modules/supabase/default.nix b/pkgs/development/python-modules/supabase/default.nix
index 22ba8f3fa260..6e7048fc8178 100644
--- a/pkgs/development/python-modules/supabase/default.nix
+++ b/pkgs/development/python-modules/supabase/default.nix
@@ -16,19 +16,19 @@
   pytest-cov-stub,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "supabase";
-  version = "2.28.3";
+  version = "2.29.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "supabase";
     repo = "supabase-py";
-    tag = "v${version}";
-    hash = "sha256-Ra7Ig9IMWouMIadx6mg/pe8GlgLCavR6OsPjqgySTCw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-LaSlAYFvx/HHdfmc9J+KScVQ9JFGS98Yfihzn8F7t3g=";
   };
 
-  sourceRoot = "${src.name}/src/supabase";
+  sourceRoot = "${finalAttrs.src.name}/src/supabase";
 
   build-system = [ uv-build ];
 
@@ -61,7 +61,11 @@ buildPythonPackage rec {
   meta = {
     homepage = "https://github.com/supabase/supabase-py";
     license = lib.licenses.mit;
-    description = "Supabas client for Python";
-    maintainers = with lib.maintainers; [ siegema ];
+    changelog = "https://github.com/supabase/supabase-py/blob/v${finalAttrs.src.tag}/CHANGELOG.md";
+    description = "Supabase client for Python";
+    maintainers = with lib.maintainers; [
+      siegema
+      macbucheron
+    ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 41b3cfbd43c7..5f1ebbd5116e 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.93";
+  version = "3.1.95";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = finalAttrs.version;
-    hash = "sha256-Yo0noD/CrwIdvOM7BaS8QCj3KAMaGPzLyp8xz+TNWsQ=";
+    hash = "sha256-CjQGcAAdUAbo0FK8rCbv261nUisdr6DBhNPOSuhsfX0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/transformer-engine/cuda-libs-paths.patch b/pkgs/development/python-modules/transformer-engine/cuda-libs-paths.patch
index 49ddd0553f49..5a7db7136213 100644
--- a/pkgs/development/python-modules/transformer-engine/cuda-libs-paths.patch
+++ b/pkgs/development/python-modules/transformer-engine/cuda-libs-paths.patch
@@ -1,8 +1,8 @@
 diff --git a/transformer_engine/common/__init__.py b/transformer_engine/common/__init__.py
-index 40933f17..f2eb337c 100644
+index 40933f17..e59f43bb 100644
 --- a/transformer_engine/common/__init__.py
 +++ b/transformer_engine/common/__init__.py
-@@ -239,119 +239,7 @@ def _get_sys_extension() -> str:
+@@ -239,64 +239,7 @@ def _get_sys_extension() -> str:
  def _nvidia_cudart_include_dir() -> str:
      """Returns the include directory for cuda_runtime.h if exists in python environment."""
  
@@ -64,66 +64,11 @@ index 40933f17..f2eb337c 100644
 -        raise RuntimeError(f"{lib_name} shared object not found.")
 -
 -    return path_found, ctypes_handles
--
--
--@functools.lru_cache(maxsize=None)
--def _load_cuda_library_from_system(lib_name: str):
--    """
--    Attempts to load shared object file installed via system/cuda-toolkit.
--
--    `lib_name`: Name of library to load without extension or `lib` prefix.
--    """
--
--    # Where to look for the shared lib in decreasing order of preference.
--    paths = (
--        os.environ.get(f"{lib_name.upper()}_HOME"),
--        os.environ.get(f"{lib_name.upper()}_PATH"),
--        os.environ.get("CUDA_HOME"),
--        os.environ.get("CUDA_PATH"),
--        "/usr/local/cuda",
--    )
--
--    for path in paths:
--        if path is None:
--            continue
--        libs = glob.glob(f"{path}/**/lib{lib_name}{_get_sys_extension()}*", recursive=True)
--        libs = [lib for lib in libs if "stub" not in lib]
--        libs.sort(reverse=True, key=os.path.basename)
--        if libs:
--            return True, ctypes.CDLL(libs[0], mode=ctypes.RTLD_GLOBAL)
--
--    # Search in LD_LIBRARY_PATH.
--    try:
--        _lib_handle = ctypes.CDLL(f"lib{lib_name}{_get_sys_extension()}", mode=ctypes.RTLD_GLOBAL)
--        return True, _lib_handle
--    except OSError:
--        return False, None
--
--
--@functools.lru_cache(maxsize=None)
--def _load_cuda_library(lib_name: str):
--    """
--    Load given shared library.
--    Prioritize loading from system/toolkit
--    before checking python packages.
--    """
--
--    # Attempt to locate library in system.
--    found, handle = _load_cuda_library_from_system(lib_name)
--    if found:
--        return True, handle
--
--    # Attempt to locate library in Python dist-packages.
--    found, handle = _load_cuda_library_from_python(lib_name)
--    if found:
--        return False, handle
--
--    raise RuntimeError(f"{lib_name} shared object not found.")
 +    return "@cudart_include_dir@"
  
  
  @functools.lru_cache(maxsize=None)
-@@ -366,18 +254,9 @@ if "NVTE_PROJECT_BUILDING" not in os.environ or bool(int(os.getenv("NVTE_RELEASE
+@@ -366,18 +309,9 @@ if "NVTE_PROJECT_BUILDING" not in os.environ or bool(int(os.getenv("NVTE_RELEASE
      # `_load_cuda_library` is used for packages that must be loaded
      # during runtime. Both system and pypi packages are searched
      # and an error is thrown if not found.
diff --git a/pkgs/development/python-modules/transformer-engine/default.nix b/pkgs/development/python-modules/transformer-engine/default.nix
index 0e9fb9c59588..6cb337762753 100644
--- a/pkgs/development/python-modules/transformer-engine/default.nix
+++ b/pkgs/development/python-modules/transformer-engine/default.nix
@@ -4,7 +4,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   replaceVars,
-  fetchpatch,
   python,
   cudaPackages,
 
@@ -34,6 +33,9 @@
   onnx,
   onnxscript,
 
+  # passthru
+  transformer-engine,
+
   cudaSupport ? config.cudaSupport,
   cudaCapabilities ?
     if withPytorch then torch.cudaCapabilities else cudaPackages.flags.cudaCapabilities,
@@ -41,6 +43,7 @@
   withPytorch ? true,
   withJax ? true,
   withNvshmem ? false,
+  withCusolvermp ? false,
 }:
 
 let
@@ -77,7 +80,7 @@ let
 in
 buildPythonPackage.override { stdenv = backendStdenv; } (finalAttrs: {
   pname = "transformer-engine";
-  version = "2.14";
+  version = "2.15";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -87,42 +90,18 @@ buildPythonPackage.override { stdenv = backendStdenv; } (finalAttrs: {
     tag = "v${finalAttrs.version}";
     # Their CMakeLists.txt does not easily let us inject dependencies
     fetchSubmodules = true;
-    hash = "sha256-yxcUn75blB5ssEqGXZFDUrBv2/WM8yzumJCt5olV5Po=";
+    hash = "sha256-0a6etDttNoTL1pe2OZb1CcS0/AtozeAG8NFz2Hkppn8=";
   };
 
-  patches =
-    optionals cudaSupport [
-      (replaceVars ./cuda-libs-paths.patch {
-        libcudnn_so = "${getLib cudaPackages.cudnn}/lib/libcudnn.so";
-        libnvrtc_so = "${getLib cudaPackages.cuda_nvrtc}/lib/libnvrtc.so";
-        libcurand_so = "${getLib cudaPackages.libcurand}/lib/libcurand.so";
+  patches = optionals cudaSupport [
+    (replaceVars ./cuda-libs-paths.patch {
+      libcudnn_so = "${getLib cudaPackages.cudnn}/lib/libcudnn.so";
+      libnvrtc_so = "${getLib cudaPackages.cuda_nvrtc}/lib/libnvrtc.so";
+      libcurand_so = "${getLib cudaPackages.libcurand}/lib/libcurand.so";
 
-        cudart_include_dir = "${getInclude cudaPackages.cuda_cudart}/include";
-      })
-
-      # https://github.com/NVIDIA/TransformerEngine/pull/2832
-      (fetchpatch {
-        name = "fix-cuda-arch-cmake-logic";
-        url = "https://github.com/NVIDIA/TransformerEngine/commit/fca261ecd09c318d22e7eeebda79632eed8cb9e4.patch";
-        hash = "sha256-nph01cIfmjN7RUFZif5ORoz29CEHWwetiHMEZVnnOyY=";
-      })
-    ]
-    ++ optionals withNvshmem [
-      # https://github.com/NVIDIA/TransformerEngine/pull/2815
-      (fetchpatch {
-        name = "fix-nvshmem-build";
-        url = "https://github.com/NVIDIA/TransformerEngine/commit/e83c09742166dfef3f871cfa1407605feafb3afe.patch";
-        hash = "sha256-5pf0Dg1XL7oAQjR1JZcdgbeaGj9qw9G5+i9Ac0iff64=";
-      })
-    ]
-    ++ optionals (withMpi && withJax) [
-      # https://github.com/NVIDIA/TransformerEngine/pull/2835
-      (fetchpatch {
-        name = "fix-jax-extension-build-with-mpi";
-        url = "https://github.com/NVIDIA/TransformerEngine/commit/2dd31bb849e83cce51c7d169db883862063d3a95.patch";
-        hash = "sha256-QSRMetseYPGGZCgGkS9rIj9nJdazCD4hv2IgPc+ClSM=";
-      })
-    ];
+      cudart_include_dir = "${getInclude cudaPackages.cuda_cudart}/include";
+    })
+  ];
 
   postPatch =
     # Patch build-system requirements:
@@ -171,6 +150,9 @@ buildPythonPackage.override { stdenv = backendStdenv; } (finalAttrs: {
 
     NVTE_ENABLE_NVSHMEM = if withNvshmem then 1 else 0;
     NVSHMEM_HOME = optionalString withNvshmem cudaPackages.libnvshmem.outPath;
+
+    NVTE_WITH_CUSOLVERMP = if withCusolvermp then 1 else 0;
+    CUSOLVERMP_HOME = optionalString withCusolvermp (getLib cudaPackages.libcusolvermp).outPath;
   };
 
   build-system = [
@@ -216,6 +198,9 @@ buildPythonPackage.override { stdenv = backendStdenv; } (finalAttrs: {
   ]
   ++ optionals withMpi [
     mpi # mpi.h
+  ]
+  ++ optionals withCusolvermp [
+    cudaPackages.libcusolvermp
   ];
 
   runtimeDependencies = optionals withNvshmem [
@@ -245,24 +230,38 @@ buildPythonPackage.override { stdenv = backendStdenv; } (finalAttrs: {
     torch
   ];
 
-  # When built with nvshmem support `dlopen`ing libtransformer_engine.so `dlopen`s
-  # libnvidia-ml.so.1 which is provided by the GPU driver at run time:
-  # OSError: libnvidia-ml.so.1: cannot open shared object file: No such file or directory
-  pythonImportsCheck = optionals (!withNvshmem) (
-    [
-      "transformer_engine"
-    ]
-    ++ optionals withJax [
-      "transformer_engine_jax"
-    ]
-    ++ optionals withPytorch [
-      "transformer_engine_torch"
-    ]
-  );
+  dontUsePythonImportsCheck =
+    # When built with cusolvermp support `dlopen`ing libtransformer_engine.so `dlopen`s
+    # libcuda.so.1 which is provided by the GPU driver at run time:
+    # OSError: libcuda.so.1: cannot open shared object file: No such file or directory
+    withCusolvermp
+
+    # When built with nvshmem support `dlopen`ing libtransformer_engine.so `dlopen`s
+    # libnvidia-ml.so.1 which is provided by the GPU driver at run time:
+    # OSError: libnvidia-ml.so.1: cannot open shared object file: No such file or directory
+    || withNvshmem;
+
+  pythonImportsCheck = [
+    "transformer_engine"
+  ]
+  ++ optionals withJax [
+    "transformer_engine_jax"
+  ]
+  ++ optionals withPytorch [
+    "transformer_engine_torch"
+  ];
 
   # Almost all tests require GPU access
   doCheck = false;
 
+  passthru.tests = {
+    withMpi = transformer-engine.override { withMpi = true; };
+    withPytorch = transformer-engine.override { withPytorch = true; };
+    withJax = transformer-engine.override { withJax = true; };
+    withNvshmem = transformer-engine.override { withNvshmem = true; };
+    withCusolvermp = transformer-engine.override { withCusolvermp = true; };
+  };
+
   meta = {
     description = "Library for accelerating Transformer models on NVIDIA GPUs";
     homepage = "https://github.com/NVIDIA/TransformerEngine";
diff --git a/pkgs/development/python-modules/types-aiobotocore/default.nix b/pkgs/development/python-modules/types-aiobotocore/default.nix
index d87354bbb00f..c5bfcf200576 100644
--- a/pkgs/development/python-modules/types-aiobotocore/default.nix
+++ b/pkgs/development/python-modules/types-aiobotocore/default.nix
@@ -371,13 +371,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "types-aiobotocore";
-  version = "3.6.0";
+  version = "3.7.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "types_aiobotocore";
     inherit (finalAttrs) version;
-    hash = "sha256-6ZAFbOnRkJSp2bNgCMoLKk1plI/1j1CGjdFZqB9q1pw=";
+    hash = "sha256-/jXeUsEuX9uJymCzmJdm5/6Cfj0ulfz0WD6RWBlFIFw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/typeshed-client/default.nix b/pkgs/development/python-modules/typeshed-client/default.nix
index e230969c53d7..3dfe797b072f 100644
--- a/pkgs/development/python-modules/typeshed-client/default.nix
+++ b/pkgs/development/python-modules/typeshed-client/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "typeshed-client";
-  version = "2.8.2";
+  version = "2.11.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "JelleZijlstra";
     repo = "typeshed_client";
     tag = "v${version}";
-    hash = "sha256-+muWm2/Psp8V1n7mEloc+ltuwHG/uRvDUgSFRNzz5EQ=";
+    hash = "sha256-hSyhGn+xEUjZVrYUYaxZ/3CwNXy4EJ2TG73S9o3o0gw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/uarray/default.nix b/pkgs/development/python-modules/uarray/default.nix
index 168e85e2a231..acf010a08e74 100644
--- a/pkgs/development/python-modules/uarray/default.nix
+++ b/pkgs/development/python-modules/uarray/default.nix
@@ -9,7 +9,6 @@
   ninja,
   matchpy,
   numpy,
-  astunparse,
   typing-extensions,
   nix-update-script,
   pytestCheckHook,
@@ -39,7 +38,6 @@ buildPythonPackage rec {
   dontUseCmakeConfigure = true;
 
   dependencies = [
-    astunparse
     matchpy
     numpy
     typing-extensions
diff --git a/pkgs/development/python-modules/yangson/default.nix b/pkgs/development/python-modules/yangson/default.nix
index d019fd254b68..b510802a345d 100644
--- a/pkgs/development/python-modules/yangson/default.nix
+++ b/pkgs/development/python-modules/yangson/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "yangson";
-  version = "1.7.5";
+  version = "1.7.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "CZ-NIC";
     repo = "yangson";
     tag = version;
-    hash = "sha256-hod18DLfITuPB1n/FkxvQozguP9tCIDNLlV2V5MtmBU=";
+    hash = "sha256-goheMKny+ZH2twD1g3CvzocaiSIK50VPZZTAP+YCWx0=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/web/nodejs/v22.nix b/pkgs/development/web/nodejs/v22.nix
index 3c73fdd91bbf..a7ce03fb23b3 100644
--- a/pkgs/development/web/nodejs/v22.nix
+++ b/pkgs/development/web/nodejs/v22.nix
@@ -23,8 +23,8 @@ let
       [ ];
 in
 buildNodejs {
-  version = "22.22.2";
-  sha256 = "b6bedd3a8cacd5df7df015a5088264b12c74a277ba60684cb9642ae8eb743132";
+  version = "22.22.3";
+  sha256 = "f3e6a578db1ab335a4a72785c1e87ad18a2cf6d2fc25747a1d741fb34af0bd0f";
   patches =
     (
       if (stdenv.hostPlatform.emulatorAvailable buildPackages) then
@@ -57,13 +57,6 @@ buildNodejs {
       ./use-correct-env-in-tests.patch
       ./bin-sh-node-run-v22.patch
       ./use-nix-codesign.patch
-
-      # TODO: remove this when included in a next release
-      (fetchpatch2 {
-        url = "https://github.com/nodejs/node/commit/a5e534c21af49ae1b34854846b6913daa7df0808.patch?full_index=1";
-        hash = "sha256-4cr94fsJrq5iCAHOf60wJQQkP/K2YWYY5W7GHs8Sbxg=";
-        includes = [ "test/*" ];
-      })
     ]
     ++ lib.optionals (!stdenv.hostPlatform.isStatic) [
       # Fix builds with shared llhttp
diff --git a/pkgs/servers/sql/postgresql/ext/pg_graphql.nix b/pkgs/servers/sql/postgresql/ext/pg_graphql.nix
index 3e7de8c7952e..485e8ccb9947 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_graphql.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_graphql.nix
@@ -11,16 +11,16 @@ buildPgrxExtension (finalAttrs: {
   cargo-pgrx = cargo-pgrx_0_16_1;
 
   pname = "pg_graphql";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "supabase";
     repo = "pg_graphql";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OnFYxhRBlEeCyRlgGu3N1rkKdsJoVyWnQF+kEqgAWhs=";
+    hash = "sha256-DOmxdLuYlRoQRprN4tni6JyXZ3nWaEqVQU0DNSYRYTc=";
   };
 
-  cargoHash = "sha256-EN1ndJwV0lQ7F0J2cTiiX+9MTgQnKJ+BWaq1lA8EPR4=";
+  cargoHash = "sha256-pgwx8Axctd37J79nUTbCGp6g2PGiHdgt99pMqGGLmyA=";
 
   # pgrx tests try to install the extension into postgresql nix store
   doCheck = false;
diff --git a/pkgs/servers/sql/postgresql/libpq.nix b/pkgs/servers/sql/postgresql/libpq.nix
index 393341f0c919..2170f5cb2782 100644
--- a/pkgs/servers/sql/postgresql/libpq.nix
+++ b/pkgs/servers/sql/postgresql/libpq.nix
@@ -163,7 +163,13 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   # PostgreSQL always builds both shared and static libs, so we delete those we don't want.
-  postInstall = if stdenv.hostPlatform.isStatic then "touch $out/empty" else "rm -rfv $dev/lib/*.a";
+  # Honour the `dontDisableStatic` convention (see `generic.nix`) so consumers can keep
+  # the static archives in `$dev/lib` alongside the shared libraries in `$out/lib`.
+  postInstall =
+    if stdenv.hostPlatform.isStatic then
+      "touch $out/empty"
+    else
+      lib.optionalString (!(finalAttrs.dontDisableStatic or false)) "rm -rfv $dev/lib/*.a";
 
   doCheck = false;
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d6a4bee6f4d2..a80deda17844 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2575,8 +2575,6 @@ with pkgs;
 
   jl = haskellPackages.jl;
 
-  jkqtplotter = callPackage ../development/libraries/jkqtplotter { };
-
   jpylyzer = with python3Packages; toPythonApplication jpylyzer;
 
   jsbeautifier = with python3Packages; toPythonApplication jsbeautifier;
@@ -3249,8 +3247,6 @@ with pkgs;
 
   safety-cli = with python3.pkgs; toPythonApplication safety;
 
-  sasview = callPackage ../applications/science/misc/sasview { };
-
   segger-jlink-headless = callPackage ../by-name/se/segger-jlink/package.nix { headless = true; };
 
   semgrep = python3.pkgs.toPythonApplication python3.pkgs.semgrep;
@@ -3390,8 +3386,6 @@ with pkgs;
 
   ttfautohint-nox = ttfautohint.override { enableGUI = false; };
 
-  twilight = callPackage ../tools/graphics/twilight { };
-
   twitch-chat-downloader =
     python3Packages.callPackage ../applications/misc/twitch-chat-downloader
       { };
@@ -4848,11 +4842,11 @@ with pkgs;
 
   beam27Packages = recurseIntoAttrs beam.packages.erlang_27.beamPackages;
   beam28Packages = recurseIntoAttrs beam.packages.erlang_28.beamPackages;
-  beam29Packages = dontRecurseIntoAttrs beam.packages.erlang_29.beamPackages;
+  beam29Packages = recurseIntoAttrs beam.packages.erlang_29.beamPackages;
 
   beamMinimal27Packages = recurseIntoAttrs beam_minimal.packages.erlang_27.beamPackages;
   beamMinimal28Packages = recurseIntoAttrs beam_minimal.packages.erlang_28.beamPackages;
-  beamMinimal29Packages = dontRecurseIntoAttrs beam_minimal.packages.erlang_29.beamPackages;
+  beamMinimal29Packages = recurseIntoAttrs beam_minimal.packages.erlang_29.beamPackages;
 
   gnudatalanguage = callPackage ../development/interpreters/gnudatalanguage {
     inherit (llvmPackages) openmp;
@@ -5692,8 +5686,6 @@ with pkgs;
       })
     );
 
-  minizinc = callPackage ../development/tools/minizinc { };
-
   mkdocs = with python3Packages; toPythonApplication mkdocs;
 
   mold = wrapBintoolsWith {
@@ -6450,8 +6442,6 @@ with pkgs;
     x11Support = false;
   };
 
-  imlibsetroot = callPackage ../applications/graphics/imlibsetroot { };
-
   indilib = callPackage ../development/libraries/science/astronomy/indilib { };
   indi-3rdparty = recurseIntoAttrs (
     callPackages ../development/libraries/science/astronomy/indilib/indi-3rdparty.nix { }
@@ -6963,8 +6953,6 @@ with pkgs;
   openexr = callPackage ../development/libraries/openexr/3.nix { };
   openexr_2 = callPackage ../development/libraries/openexr/2.nix { };
 
-  opencolorio = callPackage ../development/libraries/opencolorio { };
-
   openstackclient = with python313Packages; toPythonApplication python-openstackclient;
   openstackclient-full = openstackclient.overridePythonAttrs (oldAttrs: {
     dependencies = oldAttrs.dependencies ++ oldAttrs.optional-dependencies.cli-plugins;
@@ -11256,8 +11244,6 @@ with pkgs;
     lapack = lapack-ilp64;
   };
 
-  suitesparse = callPackage ../development/libraries/science/math/suitesparse { };
-
   trilinos-mpi = trilinos.override { withMPI = true; };
 
   wolfram-engine = libsForQt5.callPackage ../applications/science/math/wolfram-engine { };