diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
index c00e4bca3533..f859a5197a7d 100644
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -19,6 +19,8 @@
 - `gentium` package now provides `Gentium-*.ttf` files, and not `GentiumPlus-*.ttf` files like before. The font identifiers `Gentium Plus*` are available in the `gentium-plus` package, and if you want to use the more recently updated package `gentium` [by sil](https://software.sil.org/gentium/), you should update your configuration files to use the `Gentium` font identifier.
 - `space-orbit` package has been removed due to lack of upstream maintenance. Debian upstream stopped tracking it in 2011.
 
+- `gnome-keyring` no longer ships with an SSH agent anymore because it has been deprecated upstream. You should use `gcr_4` instead, which provides the same features. More information on why this was done can be found on [the relevant GCR upstream PR](https://gitlab.gnome.org/GNOME/gcr/-/merge_requests/67).
+
 ## Other Notable Changes {#sec-nixpkgs-release-25.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 609b36959d4e..c210bfc5e997 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -60,3 +60,5 @@
 
 - `amdgpu` kernel driver overdrive mode can now be enabled by setting [hardware.amdgpu.overdrive.enable](#opt-hardware.amdgpu.overdrive.enable) and customized through [hardware.amdgpu.overdrive.ppfeaturemask](#opt-hardware.amdgpu.overdrive.ppfeaturemask).
   This allows for fine-grained control over the GPU's performance and maybe required by overclocking softwares like Corectrl and Lact. These new options replace old options such as {option}`programs.corectrl.gpuOverclock.enable` and {option}`programs.tuxclocker.enableAMD`.
+
+- [](#opt-services.gnome.gnome-keyring.enable) does not ship with an SSH agent anymore, as this is now handled by the `gcr_4` package instead of `gnome-keyring`. A new module has been added to support this, under [](#opt-services.gnome.gcr-ssh-agent.enable) (its default value has been set to [](#opt-services.gnome.gnome-keyring.enable) to ensure a smooth transition). See the [relevant upstream PR](https://gitlab.gnome.org/GNOME/gcr/-/merge_requests/67) for more details.
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 419625349042..fec4eda45b8b 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -548,6 +548,7 @@
   ./services/desktops/geoclue2.nix
   ./services/desktops/gnome/at-spi2-core.nix
   ./services/desktops/gnome/evolution-data-server.nix
+  ./services/desktops/gnome/gcr-ssh-agent.nix
   ./services/desktops/gnome/glib-networking.nix
   ./services/desktops/gnome/gnome-browser-connector.nix
   ./services/desktops/gnome/gnome-initial-setup.nix
diff --git a/nixos/modules/services/desktop-managers/gnome.nix b/nixos/modules/services/desktop-managers/gnome.nix
index aa86bc81f70e..4bf6ce5f2394 100644
--- a/nixos/modules/services/desktop-managers/gnome.nix
+++ b/nixos/modules/services/desktop-managers/gnome.nix
@@ -327,6 +327,7 @@ in
       services.gnome.at-spi2-core.enable = true;
       services.gnome.evolution-data-server.enable = true;
       services.gnome.gnome-keyring.enable = true;
+      services.gnome.gcr-ssh-agent.enable = mkDefault true;
       services.gnome.gnome-online-accounts.enable = mkDefault true;
       services.gnome.localsearch.enable = mkDefault true;
       services.gnome.tinysparql.enable = mkDefault true;
diff --git a/nixos/modules/services/desktops/gnome/gcr-ssh-agent.nix b/nixos/modules/services/desktops/gnome/gcr-ssh-agent.nix
new file mode 100644
index 000000000000..d88f1a618049
--- /dev/null
+++ b/nixos/modules/services/desktops/gnome/gcr-ssh-agent.nix
@@ -0,0 +1,49 @@
+{
+  config,
+  options,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  cfg = config.services.gnome.gcr-ssh-agent;
+  opts = options.services.gnome.gcr-ssh-agent;
+  sshCfg = config.programs.ssh;
+  sshOpts = options.programs.ssh;
+in
+{
+  meta = {
+    maintainers = lib.teams.gnome.members;
+  };
+
+  options = {
+    services.gnome.gcr-ssh-agent = {
+      enable = lib.mkOption {
+        default = config.services.gnome.gnome-keyring.enable;
+        defaultText = lib.literalExpression "config.services.gnome.gnome-keyring.enable";
+        example = true;
+        description = "Whether to enable GCR SSH agent.";
+        type = lib.types.bool;
+      };
+
+      package = lib.mkPackageOption pkgs "GCR" {
+        default = [ "gcr_4" ];
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = lib.singleton {
+      assertion = !sshCfg.startAgent;
+      message = ''
+        `${sshOpts.startAgent}' (defined in ${lib.showFiles sshOpts.startAgent.files}) and `${opts.enable}' (defined in ${lib.showFiles opts.enable.files}) cannot both be enabled at the same time.
+        These options conflict because only one SSH agent can be installed at a time.'';
+    };
+
+    systemd = {
+      packages = [ cfg.package ];
+      user.services.gcr-ssh-agent.wantedBy = [ "default.target" ];
+      user.sockets.gcr-ssh-agent.wantedBy = [ "sockets.target" ];
+    };
+  };
+}
diff --git a/nixos/modules/services/x11/desktop-managers/budgie.nix b/nixos/modules/services/x11/desktop-managers/budgie.nix
index 6ed2f0d20aae..cdd2e9453133 100644
--- a/nixos/modules/services/x11/desktop-managers/budgie.nix
+++ b/nixos/modules/services/x11/desktop-managers/budgie.nix
@@ -253,6 +253,7 @@ in
     services.gnome.evolution-data-server.enable = mkDefault true;
     services.gnome.glib-networking.enable = mkDefault true;
     services.gnome.gnome-keyring.enable = mkDefault true;
+    services.gnome.gcr-ssh-agent.enable = mkDefault true;
     services.gnome.gnome-settings-daemon.enable = mkDefault true;
     services.gvfs.enable = mkDefault true;
 
diff --git a/nixos/modules/services/x11/desktop-managers/cinnamon.nix b/nixos/modules/services/x11/desktop-managers/cinnamon.nix
index 8a94096772b1..60880d826962 100644
--- a/nixos/modules/services/x11/desktop-managers/cinnamon.nix
+++ b/nixos/modules/services/x11/desktop-managers/cinnamon.nix
@@ -116,6 +116,7 @@ in
       services.gnome.evolution-data-server.enable = true;
       services.gnome.glib-networking.enable = true;
       services.gnome.gnome-keyring.enable = true;
+      services.gnome.gcr-ssh-agent.enable = mkDefault true;
       services.gvfs.enable = true;
       services.power-profiles-daemon.enable = mkDefault true;
       services.switcherooControl.enable = mkDefault true; # xapp-gpu-offload-helper
diff --git a/nixos/modules/services/x11/desktop-managers/deepin.nix b/nixos/modules/services/x11/desktop-managers/deepin.nix
index ca9fb229df97..2735ef19aa77 100644
--- a/nixos/modules/services/x11/desktop-managers/deepin.nix
+++ b/nixos/modules/services/x11/desktop-managers/deepin.nix
@@ -63,6 +63,7 @@ in
     services.gvfs.enable = mkDefault true;
     services.gnome.glib-networking.enable = mkDefault true;
     services.gnome.gnome-keyring.enable = mkDefault true;
+    services.gnome.gcr-ssh-agent.enable = mkDefault true;
     services.bamf.enable = mkDefault true;
 
     services.libinput.enable = mkDefault true;
diff --git a/nixos/modules/services/x11/desktop-managers/mate.nix b/nixos/modules/services/x11/desktop-managers/mate.nix
index e5144bc9d102..dd8f10061910 100644
--- a/nixos/modules/services/x11/desktop-managers/mate.nix
+++ b/nixos/modules/services/x11/desktop-managers/mate.nix
@@ -92,6 +92,7 @@ in
       services.gnome.at-spi2-core.enable = true;
       services.gnome.glib-networking.enable = true;
       services.gnome.gnome-keyring.enable = true;
+      services.gnome.gcr-ssh-agent.enable = mkDefault true;
       services.udev.packages = [ pkgs.mate.mate-settings-daemon ];
       services.gvfs.enable = true;
       services.upower.enable = config.powerManagement.enable;
diff --git a/nixos/modules/services/x11/desktop-managers/pantheon.nix b/nixos/modules/services/x11/desktop-managers/pantheon.nix
index c50d9340841e..bb8528bb284a 100644
--- a/nixos/modules/services/x11/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/x11/desktop-managers/pantheon.nix
@@ -152,6 +152,7 @@ in
       services.gnome.evolution-data-server.enable = true;
       services.gnome.glib-networking.enable = true;
       services.gnome.gnome-keyring.enable = true;
+      services.gnome.gcr-ssh-agent.enable = mkDefault true;
       services.gvfs.enable = true;
       services.gnome.rygel.enable = mkDefault true;
       services.udisks2.enable = true;
diff --git a/nixos/tests/prometheus/prometheus-pair.nix b/nixos/tests/prometheus/prometheus-pair.nix
index 6d8d5900480f..48300f926858 100644
--- a/nixos/tests/prometheus/prometheus-pair.nix
+++ b/nixos/tests/prometheus/prometheus-pair.nix
@@ -14,6 +14,9 @@
         services.prometheus = {
           enable = true;
           globalConfig.scrape_interval = "2s";
+          extraFlags = [
+            "--storage.tsdb.min-block-duration=15s"
+          ];
           scrapeConfigs = [
             {
               job_name = "prometheus";
@@ -40,6 +43,9 @@
         services.prometheus = {
           enable = true;
           globalConfig.scrape_interval = "2s";
+          extraFlags = [
+            "--storage.tsdb.min-block-duration=15s"
+          ];
           scrapeConfigs = [
             {
               job_name = "prometheus";
@@ -86,6 +92,38 @@
         + "jq '.data.result[0].value[1]' | grep '\"2\"'"
       )
 
+      machine.wait_until_succeeds(
+        "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=prometheus_tsdb_head_series_created_total\{instance=\"prometheus1:9090\"\}' | "
+        + "jq '.data.result[0].value[1]' | grep -v '\"0\"'"
+      )
+
+    with subtest("Compaction verification"):
+      for machine in prometheus1, prometheus2:
+        machine.wait_until_succeeds("journalctl -o cat -u prometheus.service | grep -E '(log=ERROR|write block)'")
+
+        machine.wait_until_succeeds("journalctl -o cat -u prometheus.service | grep 'Head GC completed'")
+
+        machine.wait_until_succeeds("journalctl -o cat -u prometheus.service | grep 'Creating checkpoint'")
+
+        machine.wait_until_succeeds("journalctl -o cat -u prometheus.service | grep 'WAL checkpoint complete'")
+
+        machine.wait_until_succeeds("journalctl -o cat -u prometheus.service | grep 'compact blocks'")
+
+        machine.wait_until_succeeds("journalctl -o cat -u prometheus.service | grep 'Deleting obsolete block'")
+
+        machine.wait_until_succeeds(
+          "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=prometheus_tsdb_compactions_total\{instance=\"prometheus1:9090\"\}' | "
+          + "jq '.data.result[0].value[1]' | grep -v '\"0\"'"
+        )
+
+        machine.wait_until_succeeds(
+          "curl -sf 'http://127.0.0.1:9090/api/v1/query?query=prometheus_tsdb_compactions_failed_total\{instance=\"prometheus1:9090\"\}' | "
+          + "jq '.data.result[0].value[1]' | grep '\"0\"'"
+        )
+
+    for machine in prometheus1, prometheus2:
+      machine.fail("journalctl -o cat -u prometheus.service | grep 'level=ERROR'")
+
     prometheus1.log(prometheus1.succeed("systemd-analyze security prometheus.service | grep -v '✓'"))
   '';
 }
diff --git a/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix b/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
index b3774f5cbc4f..740d4758a4bc 100644
--- a/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
+++ b/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "genesis-plus-gx";
-  version = "0-unstable-2025-05-23";
+  version = "0-unstable-2025-06-13";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "Genesis-Plus-GX";
-    rev = "d2a3d8a03ac76c01543da22c20d3654de890ee97";
-    hash = "sha256-d8YqkzeMc7Q07YTDUH1bxzscDY/1CGf3V0BIuFdqV+A=";
+    rev = "def3a7c0e413ef35a7d9d4430e5c9c9a5698b4fe";
+    hash = "sha256-MCLPReWzW+NsEVtt4ySplLzGKGAaNXgDtoPYJC2yY3I=";
   };
 
   meta = {
diff --git a/pkgs/applications/graphics/seamly2d/default.nix b/pkgs/applications/graphics/seamly2d/default.nix
index 27f2c3627fda..d125d56fb4d7 100644
--- a/pkgs/applications/graphics/seamly2d/default.nix
+++ b/pkgs/applications/graphics/seamly2d/default.nix
@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "seamly2d";
-  version = "2025.5.5.213";
+  version = "2025.6.9.216";
 
   src = fetchFromGitHub {
     owner = "FashionFreedom";
     repo = "Seamly2D";
     tag = "v${version}";
-    hash = "sha256-jcdk10TcyfPXStM+iRSaOTHczv4K+9JS2h+e/+ArtD0=";
+    hash = "sha256-2fQFCVoSap1kv3mD91UEvol9JvZjXL7f9KR3St+XqaU=";
   };
 
   buildInputs = [
diff --git a/pkgs/applications/networking/browsers/firefox/139-wayland-drag-animation.patch b/pkgs/applications/networking/browsers/firefox/139-wayland-drag-animation.patch
new file mode 100644
index 000000000000..9e0053a1f336
--- /dev/null
+++ b/pkgs/applications/networking/browsers/firefox/139-wayland-drag-animation.patch
@@ -0,0 +1,53 @@
+# HG changeset patch
+# User Dão Gottwald <dao@mozilla.com>
+# Date 1742828426 0
+# Node ID aa8a29bd1fb9668c81475b534b4ceb220dd4fe55
+# Parent  653a7b21210b5b61a36af11b99ccd51e6c85a905
+Bug 1955112 - Finish tab moving animation when a drag session wasn't ended properly. r=dwalker,tabbrowser-reviewers
+
+Differential Revision: https://phabricator.services.mozilla.com/D242631
+
+diff --git a/browser/components/tabbrowser/content/tabs.js b/browser/components/tabbrowser/content/tabs.js
+--- a/browser/components/tabbrowser/content/tabs.js
++++ b/browser/components/tabbrowser/content/tabs.js
+@@ -1012,18 +1012,39 @@
+         newMargin *= -1;
+       }
+       ind.style.transform = this.verticalMode
+         ? "translateY(" + Math.round(newMargin) + "px)"
+         : "translateX(" + Math.round(newMargin) + "px)";
+     }
+ 
+     #setMovingTabMode(movingTab) {
++      if (movingTab == this.#isMovingTab()) {
++        return;
++      }
++
+       this.toggleAttribute("movingtab", movingTab);
+       gNavToolbox.toggleAttribute("movingtab", movingTab);
++
++      if (movingTab) {
++        // This is a bit of an escape hatch in case a tab drag & drop session
++        // wasn't ended properly, leaving behind the movingtab attribute, which
++        // may break the UI (bug 1954163). We don't get mousemove events while
++        // dragging tabs, so at that point it should be safe to assume that we
++        // should not be in drag and drop mode, and clean things up if needed.
++        requestAnimationFrame(() => {
++          this.addEventListener(
++            "mousemove",
++            () => {
++              this.finishAnimateTabMove();
++            },
++            { once: true }
++          );
++        });
++      }
+     }
+ 
+     #isMovingTab() {
+       return this.hasAttribute("movingtab");
+     }
+ 
+     #expandGroupOnDrop(draggedTab) {
+       if (
+
diff --git a/pkgs/applications/networking/browsers/firefox/common.nix b/pkgs/applications/networking/browsers/firefox/common.nix
index 965afea61031..3f21274f81a7 100644
--- a/pkgs/applications/networking/browsers/firefox/common.nix
+++ b/pkgs/applications/networking/browsers/firefox/common.nix
@@ -310,6 +310,11 @@ buildStdenv.mkDerivation {
       ./no-buildconfig-ffx121.patch
     ]
     ++ lib.optionals (lib.versionAtLeast version "136") [ ./no-buildconfig-ffx136.patch ]
+    ++ lib.optionals (lib.versionAtLeast version "139" && lib.versionOlder version "141") [
+      # https://bugzilla.mozilla.org/show_bug.cgi?id=1955112
+      # https://hg-edge.mozilla.org/mozilla-central/rev/aa8a29bd1fb9
+      ./139-wayland-drag-animation.patch
+    ]
     ++ lib.optionals (lib.versionAtLeast version "139") [ ./139-relax-apple-sdk.patch ]
     ++ lib.optionals (lib.versionOlder version "139") [
       # Fix for missing vector header on macOS
diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix
index f2e7b430f825..e994dbd9fe16 100644
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -521,7 +521,7 @@ let
 
           extraPoliciesFiles=(${builtins.toString extraPoliciesFiles})
           for extraPoliciesFile in "''${extraPoliciesFiles[@]}"; do
-            jq -s '.[0] * .[1]' "$POL_PATH" $extraPoliciesFile > .tmp.json
+            jq -s '.[0] * .[1]' $extraPoliciesFile "$POL_PATH" > .tmp.json
             mv .tmp.json "$POL_PATH"
           done
 
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index e280bfd5f918..cad3b4d950eb 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -408,11 +408,11 @@
     "vendorHash": "sha256-duHOqjy8AthXuDX63GO3myJ9TJmV0Ts1a8OsbSOGZWI="
   },
   "doppler": {
-    "hash": "sha256-TPWHqRpvyk1dtSbQySMOecq0AhN2VlSB+2naPIbvMHI=",
+    "hash": "sha256-2sgNPQvk0jylCEiZ0Cja54YbmqHSj+AgLANSLMVAqgw=",
     "homepage": "https://registry.terraform.io/providers/DopplerHQ/doppler",
     "owner": "DopplerHQ",
     "repo": "terraform-provider-doppler",
-    "rev": "v1.17.0",
+    "rev": "v1.18.0",
     "spdx": "Apache-2.0",
     "vendorHash": "sha256-B8mYLd4VdADWoQLWiCM85VQrBfDdlYQ0wkCp9eUBQ4U="
   },
@@ -696,11 +696,11 @@
     "vendorHash": "sha256-ctd9V5EXL0c9b4aJ47nfjhqCMTewL55IkjkQ39ShoUk="
   },
   "kafka": {
-    "hash": "sha256-RZwag424lXwI1GR/kFOcpv+huaYMyG4jcFjkhvA0Nlc=",
+    "hash": "sha256-NiAbUZ+ZMRLXm/WLrfj0ZjbPft4jZhdwLBhFIE4PjeI=",
     "homepage": "https://registry.terraform.io/providers/Mongey/kafka",
     "owner": "Mongey",
     "repo": "terraform-provider-kafka",
-    "rev": "v0.10.2",
+    "rev": "v0.10.3",
     "spdx": "MIT",
     "vendorHash": "sha256-57V/0JIsq+pqbWmg3iZ0s8t8iD2Xtipy08I/+ZJCkNc="
   },
@@ -1111,13 +1111,13 @@
     "vendorHash": "sha256-xo0alLK3fccbKRG5bN1G7orDsP47I3ySAzpZ9O0f2Fg="
   },
   "rootly": {
-    "hash": "sha256-2TVqXQYiCMsMQJtZMWtYiPbeOOsPck5Hpu6cmo9ZaIM=",
+    "hash": "sha256-dnFQVvqvwu2K7Y5NEqwPrGiHKSOKQ4QKW8VSjarbij4=",
     "homepage": "https://registry.terraform.io/providers/rootlyhq/rootly",
     "owner": "rootlyhq",
     "repo": "terraform-provider-rootly",
-    "rev": "v2.27.2",
+    "rev": "v3.0.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-KezwDRmQQj0MnmsVlrX1OhNG6oMgw8fCxX5VFGdUynw="
+    "vendorHash": "sha256-EZbYkyeQdroVJj3a7T7MICU4MSimB+ZqI2Yg9PNUcV0="
   },
   "routeros": {
     "hash": "sha256-ciQsBvpX6gWnDPt9O1SGrVVgNCvAHBPCaLfVlPxrSAY=",
@@ -1318,20 +1318,20 @@
     "vendorHash": "sha256-V0dK5G3zheyyqexBud+9Hg9ExYI/9X1wuYx+lEn6pVg="
   },
   "temporalcloud": {
-    "hash": "sha256-hLY9C0df1h8JCwuXBPxemNurQR57oGXAq2v7NbAyZnU=",
+    "hash": "sha256-nm7YQNoVTy53GpXIu2gQhIblvZMIdCyDcXK9aCL+Xfg=",
     "homepage": "https://registry.terraform.io/providers/temporalio/temporalcloud",
     "owner": "temporalio",
     "repo": "terraform-provider-temporalcloud",
-    "rev": "v0.7.1",
+    "rev": "v0.8.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-HBdvXWZNPPAqPEKodwG0ZeiJOhfJHe9HRCcuozKpwVs="
+    "vendorHash": "sha256-Sqi4MLQTF5n3AZyEkaI03KhFvgy34ROqbd8Rx1N6/oY="
   },
   "tencentcloud": {
-    "hash": "sha256-JMLuH/NDCNiByLh65NQH/goaN7/J7MGfsUNKfHJ3LFQ=",
+    "hash": "sha256-3r3DCZ1bmoBieF0BQ37ai3UxzxWbf5orJ4mvh8aeUhQ=",
     "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
     "owner": "tencentcloudstack",
     "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.81.197",
+    "rev": "v1.81.199",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
diff --git a/pkgs/by-name/ca/cargo-xwin/package.nix b/pkgs/by-name/ca/cargo-xwin/package.nix
index 039525814b43..c6b956a43685 100644
--- a/pkgs/by-name/ca/cargo-xwin/package.nix
+++ b/pkgs/by-name/ca/cargo-xwin/package.nix
@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-xwin";
-  version = "0.18.5";
+  version = "0.18.6";
 
   src = fetchFromGitHub {
     owner = "rust-cross";
     repo = "cargo-xwin";
     rev = "v${version}";
-    hash = "sha256-P4X7k0r29vEjsVHGOD/rFpltUF2PJHETVyazJ6c8UhQ=";
+    hash = "sha256-srPXWJAMc5IOLucGg0QNG23aqMABftQTM3PjcbZc8+A=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Oq3IfaywAZPrh4oom2ejPQRTM2BsgEzfaifaLAQzvbw=";
+  cargoHash = "sha256-1JJSK7Ss4o/Vk1mxQtNfTLOuA5fwfKpcv5MrsJEuXYU=";
 
   meta = with lib; {
     description = "Cross compile Cargo project to Windows MSVC target with ease";
diff --git a/pkgs/by-name/ch/cherry-studio/package.nix b/pkgs/by-name/ch/cherry-studio/package.nix
index b9c9ebe4c548..0e54d0850aa8 100644
--- a/pkgs/by-name/ch/cherry-studio/package.nix
+++ b/pkgs/by-name/ch/cherry-studio/package.nix
@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "cherry-studio";
-  version = "1.3.12";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "CherryHQ";
     repo = "cherry-studio";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BQvoH/F1CCzeGulUg5J1wK/WzHB4Y5j3BWYPAFyTpGs=";
+    hash = "sha256-P7nam15AhwFIy3qisp2cogJeCGe0sgNnF+eFl4ssf0Q=";
   };
 
   postPatch = ''
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   offlineCache = yarn-berry.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes;
-    hash = "sha256-ZVgn/mB7XPozjBT1jKscpr7Izi5vDkNNAQJCpPqB+QE=";
+    hash = "sha256-OFinYvzLEXahaLY5YZM4eamiMUSPJZ1nUCzo8hQdnFw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cl/claude-code/package-lock.json b/pkgs/by-name/cl/claude-code/package-lock.json
index fe46c0b39863..a757e07002aa 100644
--- a/pkgs/by-name/cl/claude-code/package-lock.json
+++ b/pkgs/by-name/cl/claude-code/package-lock.json
@@ -6,13 +6,13 @@
   "packages": {
     "": {
       "dependencies": {
-        "@anthropic-ai/claude-code": "^1.0.17"
+        "@anthropic-ai/claude-code": "^1.0.21"
       }
     },
     "node_modules/@anthropic-ai/claude-code": {
-      "version": "1.0.17",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.17.tgz",
-      "integrity": "sha512-+MX/pKOKXG2HLSh7WJIgiILdumqRgcORUX0iSQmAfn+UEoHSYSuFWZWuWBpixaa8W4tiTCC06uN4pgzinCU6jw==",
+      "version": "1.0.21",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.21.tgz",
+      "integrity": "sha512-Ig+OPSl7e77SJrE2jB8p4qnnyS/+iGItttIxh0oxkZI3qSKu/K3Z7zx8r4YTDCo7XJsoYnV0MNsDBcXWa/YKUg==",
       "hasInstallScript": true,
       "license": "SEE LICENSE IN README.md",
       "bin": {
diff --git a/pkgs/by-name/cl/claude-code/package.nix b/pkgs/by-name/cl/claude-code/package.nix
index dcf7ccb88b46..ae6c5d44bc90 100644
--- a/pkgs/by-name/cl/claude-code/package.nix
+++ b/pkgs/by-name/cl/claude-code/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "claude-code";
-  version = "1.0.17";
+  version = "1.0.21";
 
   nodejs = nodejs_20; # required for sandboxed Nix builds on Darwin
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";
-    hash = "sha256-RxbsAehJ4zIt86ppmMB1MPg/XFrGWuumNdQbT+ytg8A=";
+    hash = "sha256-CtNY7CduAg/QWs58jFnJ/3CMRpRKrJzD49Gqw7kSsao=";
   };
 
-  npmDepsHash = "sha256-tC0OyJ3t4i/CdqKUGIw5Wd9UiLYJECcbDi/suxim0/A=";
+  npmDepsHash = "sha256-Sll/rt4TjxjfD6qFnAu3SQxv8JIKvH0NJGO0zJd9xpk=";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json
diff --git a/pkgs/by-name/cl/clpeak/package.nix b/pkgs/by-name/cl/clpeak/package.nix
index 05630a9bb0f3..1291a1adfe4a 100644
--- a/pkgs/by-name/cl/clpeak/package.nix
+++ b/pkgs/by-name/cl/clpeak/package.nix
@@ -9,14 +9,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "clpeak";
-  version = "1.1.4";
+  version = "1.1.5";
 
   src = fetchFromGitHub {
     owner = "krrishnarraj";
     repo = "clpeak";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-unQLZ5EExL9lU2XuYLJjASeFzDA74+TnU0CQTWyNYiQ=";
+    hash = "sha256-q4L7qoxE0udR6I8gXsc19IAB+wH7YRjgbIGOsdUXzgs=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/cn/cnspec/package.nix b/pkgs/by-name/cn/cnspec/package.nix
index 94a1d36b6a89..c4f4a2b5d0c5 100644
--- a/pkgs/by-name/cn/cnspec/package.nix
+++ b/pkgs/by-name/cn/cnspec/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "cnspec";
-  version = "11.57.2";
+  version = "11.58.0";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     tag = "v${version}";
-    hash = "sha256-cmqOlfoVMHlX5E55Fboo7zBVy+MDZFj3PBS/mvZQw0c=";
+    hash = "sha256-QggKGQOBP7krpAi4PmoVCxUsY+M2VvojBDw6Sj7jAog=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-uehEZCj/U+xmdLt7E/Tsbog5GT78CcgxO8ZOB9QFqis=";
+  vendorHash = "sha256-r5xeh1aKautOoMuJgRWEqvHhPJJlcULuzsREvPbkr6k=";
 
   subPackages = [ "apps/cnspec" ];
 
diff --git a/pkgs/by-name/db/dblab/package.nix b/pkgs/by-name/db/dblab/package.nix
index ab3e084f4a0d..b41a2cfaaaf5 100644
--- a/pkgs/by-name/db/dblab/package.nix
+++ b/pkgs/by-name/db/dblab/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "dblab";
-  version = "0.32.0";
+  version = "0.33.0";
 
   src = fetchFromGitHub {
     owner = "danvergara";
     repo = "dblab";
     rev = "v${version}";
-    hash = "sha256-Hcwuh+NGHp1nb6dS1CDC+M7onlNpJbkb6UAiC4j3ZiU=";
+    hash = "sha256-PFS/9/UdoClktsTnkcILUdjLC9yjvMf60Tgb70lQ5pE=";
   };
 
   vendorHash = "sha256-WxIlGdd3Si3Lyf9FZOCAepDlRo2F3EDRy00EawkZATY=";
diff --git a/pkgs/by-name/do/doctl/package.nix b/pkgs/by-name/do/doctl/package.nix
index 50f0c3a67c5d..eb77dd8c8788 100644
--- a/pkgs/by-name/do/doctl/package.nix
+++ b/pkgs/by-name/do/doctl/package.nix
@@ -9,7 +9,7 @@
 
 buildGoModule rec {
   pname = "doctl";
-  version = "1.128.0";
+  version = "1.130.0";
 
   vendorHash = null;
 
@@ -42,7 +42,7 @@ buildGoModule rec {
     owner = "digitalocean";
     repo = "doctl";
     tag = "v${version}";
-    hash = "sha256-/G+T7tvK1Jg13a6cBA2T58yPPypP1j1/6IvBws3SEOA=";
+    hash = "sha256-jFgcrJVUCs7RwrXczaKpvt/NjFIk0q26/n8SN8olSYE=";
   };
 
   meta = {
diff --git a/pkgs/by-name/fc/fcitx5-pinyin-moegirl/package.nix b/pkgs/by-name/fc/fcitx5-pinyin-moegirl/package.nix
index c8aee9eb36f1..8b014ae1902b 100644
--- a/pkgs/by-name/fc/fcitx5-pinyin-moegirl/package.nix
+++ b/pkgs/by-name/fc/fcitx5-pinyin-moegirl/package.nix
@@ -6,11 +6,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "fcitx5-pinyin-moegirl";
-  version = "20250509";
+  version = "20250610";
 
   src = fetchurl {
     url = "https://github.com/outloudvi/mw2fcitx/releases/download/${finalAttrs.version}/moegirl.dict";
-    hash = "sha256-M0oquFoR44IRY3dvTjpZ48tRTi+OP+GqMfb5sdUcurY=";
+    hash = "sha256-krtBLVcF6qKQ7xIUuJsxYmbBlFXezzGXczg9Th0NPYo=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/fi/firefly-iii/package.nix b/pkgs/by-name/fi/firefly-iii/package.nix
index 770653eaf4ed..21f8a88cd75b 100644
--- a/pkgs/by-name/fi/firefly-iii/package.nix
+++ b/pkgs/by-name/fi/firefly-iii/package.nix
@@ -13,13 +13,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "firefly-iii";
-  version = "6.2.16";
+  version = "6.2.17";
 
   src = fetchFromGitHub {
     owner = "firefly-iii";
     repo = "firefly-iii";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SFl2uGHunF/IjhO5XoDCh1bJ5eIWRosv7HFDMXyknvI=";
+    hash = "sha256-g/mGCc7JxfWrbrh14OXaKgn0rjf4RMNL2NI4GzrphaY=";
   };
 
   buildInputs = [ php84 ];
@@ -38,13 +38,13 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     composerNoScripts = true;
     composerStrictValidation = true;
     strictDeps = true;
-    vendorHash = "sha256-C7lsSon9y286DoAppteZ3fY0qaWVTe66nyFckyrnylk=";
+    vendorHash = "sha256-2GvBlKRTqehD7eVpEGd9zBoiom30DRMqatyHNF4eDiU=";
   };
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
     name = "${finalAttrs.pname}-npm-deps";
-    hash = "sha256-qymMgMXjKll3awXFL/Lo8DloPyqAaxoS2Lw8HBaar9g=";
+    hash = "sha256-uZluWsHpbD2lMG/yNoZxry5X+Hiv3z/H4KqV7pydu/A=";
   };
 
   preInstall = ''
@@ -55,7 +55,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   passthru = {
     phpPackage = php84;
     tests = nixosTests.firefly-iii;
-    updateScript = nix-update-script { };
+    updateScript = nix-update-script { extraArgs = [ "--version-regex='v([0-9]+\.[0-9]+\.[0-9]+)'" ]; };
   };
 
   postInstall = ''
diff --git a/pkgs/by-name/fm/fmi-reference-fmus/package.nix b/pkgs/by-name/fm/fmi-reference-fmus/package.nix
index 5807260ebe1f..223ffb3c9e39 100644
--- a/pkgs/by-name/fm/fmi-reference-fmus/package.nix
+++ b/pkgs/by-name/fm/fmi-reference-fmus/package.nix
@@ -17,12 +17,12 @@ assert lib.asserts.assertMsg (
 # the FMUs.
 stdenv.mkDerivation (finalAttrs: {
   pname = "reference-fmus";
-  version = "0.0.38";
+  version = "0.0.39";
   src = fetchFromGitHub {
     owner = "modelica";
     repo = "reference-fmus";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-FeDKYcm9K670q1FGqy41Tp2Ag8p2JidH4z78zpHOngw=";
+    hash = "sha256-3bjqfEyPhqVrJOHHhniacyUAo82InCd6LLx3tyC8DYg=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/gn/gnome-keyring/package.nix b/pkgs/by-name/gn/gnome-keyring/package.nix
index 2a62bc340bf8..04d0a932b299 100644
--- a/pkgs/by-name/gn/gnome-keyring/package.nix
+++ b/pkgs/by-name/gn/gnome-keyring/package.nix
@@ -16,12 +16,10 @@
   libcap_ng,
   libselinux,
   p11-kit,
-  openssh,
   wrapGAppsNoGuiHook,
   docbook-xsl-nons,
   docbook_xml_dtd_43,
   gnome,
-  writeText,
   useWrappedDaemon ? true,
 }:
 
@@ -55,7 +53,6 @@ stdenv.mkDerivation rec {
     glib
     libgcrypt
     pam
-    openssh
     libcap_ng
     libselinux
     gcr
@@ -71,16 +68,8 @@ stdenv.mkDerivation rec {
     # installation directories
     "-Dpkcs11-config=${placeholder "out"}/etc/pkcs11" # todo: this should probably be /share/p11-kit/modules
     "-Dpkcs11-modules=${placeholder "out"}/lib/pkcs11"
-    # gnome-keyring doesn't build with ssh-agent by default anymore, we need to
-    # switch to using gcr https://github.com/NixOS/nixpkgs/issues/140824
-    "-Dssh-agent=true"
     # TODO: enable socket activation
     "-Dsystemd=disabled"
-    "--cross-file=${writeText "crossfile.ini" ''
-      [binaries]
-      ssh-add = '${lib.getExe' openssh "ssh-add"}'
-      ssh-agent = '${lib.getExe' openssh "ssh-agent"}'
-    ''}"
   ];
 
   # Tends to fail non-deterministically.
diff --git a/pkgs/by-name/gr/graphite-cli/package-lock.json b/pkgs/by-name/gr/graphite-cli/package-lock.json
index 99209616e9bc..b967b6262200 100644
--- a/pkgs/by-name/gr/graphite-cli/package-lock.json
+++ b/pkgs/by-name/gr/graphite-cli/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@withgraphite/graphite-cli",
-  "version": "1.6.2",
+  "version": "1.6.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@withgraphite/graphite-cli",
-      "version": "1.6.2",
+      "version": "1.6.4",
       "hasInstallScript": true,
       "license": "None",
       "dependencies": {
diff --git a/pkgs/by-name/gr/graphite-cli/package.nix b/pkgs/by-name/gr/graphite-cli/package.nix
index f68a6994ebb0..f91780ad5067 100644
--- a/pkgs/by-name/gr/graphite-cli/package.nix
+++ b/pkgs/by-name/gr/graphite-cli/package.nix
@@ -8,14 +8,14 @@
 
 buildNpmPackage rec {
   pname = "graphite-cli";
-  version = "1.6.2";
+  version = "1.6.4";
 
   src = fetchurl {
     url = "https://registry.npmjs.org/@withgraphite/graphite-cli/-/graphite-cli-${version}.tgz";
-    hash = "sha256-k8zZyzLXQkII87QXjoXYlcQPj09PcMCuNy2NFPT2tHY=";
+    hash = "sha256-NxqqYghE9QNbO8VdBH4MsUomeRUvYNRijQMqrlE7/II=";
   };
 
-  npmDepsHash = "sha256-HSiitFpXcIWkE/t0LtuDH9Z4fDgyFWc0/gdIsuvVq9I=";
+  npmDepsHash = "sha256-LDSn5lIEHRyYyicP6b7/CTs5VivzcspeCUQzR+BqrS0=";
 
   postPatch = ''
     ln -s ${./package-lock.json} package-lock.json
diff --git a/pkgs/by-name/ha/harper/package.nix b/pkgs/by-name/ha/harper/package.nix
index 1a7c92eda526..0775cf4535d9 100644
--- a/pkgs/by-name/ha/harper/package.nix
+++ b/pkgs/by-name/ha/harper/package.nix
@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "harper";
-  version = "0.41.0";
+  version = "0.42.0";
 
   src = fetchFromGitHub {
     owner = "Automattic";
     repo = "harper";
     rev = "v${version}";
-    hash = "sha256-o5F9gDeHFq2U9q/kRQVn4otbbQVV4tg6n5Ap7Dwm7oI=";
+    hash = "sha256-qzNH8qGpSNtGQqce3E/mEQoJUP2mQsQ8ntTi9F3ol1I=";
   };
 
   buildAndTestSubdir = "harper-ls";
   useFetchCargoVendor = true;
-  cargoHash = "sha256-KgcsLzFrN+ZDgV6cZmkUv4tUt5ko4+giHq19NjfuF74=";
+  cargoHash = "sha256-PxYRQ6nYHXXgxb8YXkm57wIFXQrF5+cdEHA+CMk22wg=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/he/hexpatch/package.nix b/pkgs/by-name/he/hexpatch/package.nix
index 762b65f05462..578f12ecfd08 100644
--- a/pkgs/by-name/he/hexpatch/package.nix
+++ b/pkgs/by-name/he/hexpatch/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hexpatch";
-  version = "1.11.3";
+  version = "1.12.1";
 
   src = fetchFromGitHub {
     owner = "Etto48";
     repo = "HexPatch";
     tag = "v${version}";
-    hash = "sha256-hGHvu727PbpqIFzfmBscD9kdwuXR0SRFZ3lbgXPxR24=";
+    hash = "sha256-Fkje+wyYJIeCJGUHRMQubCm/OlQAeRPKXFtCnUSzPiQ=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-zRNXGGpREk5xRODbGQ0SlYpU+bLPdXhlchQAc/nTsbs=";
+  cargoHash = "sha256-TTIZEzufOE7m0PtiKKBQjY0fNVabC3oG2b06AyhPxq0=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/la/labwc-menu-generator/package.nix b/pkgs/by-name/la/labwc-menu-generator/package.nix
index 0df66576026f..1c037f507d2a 100644
--- a/pkgs/by-name/la/labwc-menu-generator/package.nix
+++ b/pkgs/by-name/la/labwc-menu-generator/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "labwc-menu-generator";
-  version = "0.2.0-unstable-2025-04-30";
+  version = "0.2.0-unstable-2025-06-03";
 
   src = fetchFromGitHub {
     owner = "labwc";
     repo = "labwc-menu-generator";
-    rev = "2ca1be707aca1a06852e3a0ce70941e50bd7c02e";
-    hash = "sha256-LoRhTeS7wnv/yqUibQ9+3y8q3JvYPCZZJ51rDOe9EtM=";
+    rev = "255ae8937598524c9929e3576149473ff90dab39";
+    hash = "sha256-/cpgdBsRSDZobdXEkqOo68W9buP3J1YkCSHu0ld69R0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libcouchbase/package.nix b/pkgs/by-name/li/libcouchbase/package.nix
index 295bab16ea77..923a629f6d10 100644
--- a/pkgs/by-name/li/libcouchbase/package.nix
+++ b/pkgs/by-name/li/libcouchbase/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libcouchbase";
-  version = "3.3.9";
+  version = "3.3.17";
 
   src = fetchFromGitHub {
     owner = "couchbase";
     repo = "libcouchbase";
     rev = version;
-    sha256 = "sha256-dvXRbAdgb1WmKLijYkx6+js60ZxK1Tl2aTFSF7EpN74=";
+    sha256 = "sha256-YHPfdjt8ME9nkgv6wF9IyEQoT4PpanbAbvcqqWOU+GY=";
   };
 
   cmakeFlags = [ "-DLCB_NO_MOCK=ON" ];
diff --git a/pkgs/by-name/mi/micronaut/package.nix b/pkgs/by-name/mi/micronaut/package.nix
index 3b3bbdb39b27..f435fdea515c 100644
--- a/pkgs/by-name/mi/micronaut/package.nix
+++ b/pkgs/by-name/mi/micronaut/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "micronaut";
-  version = "4.8.2";
+  version = "4.8.3";
 
   src = fetchzip {
     url = "https://github.com/micronaut-projects/micronaut-starter/releases/download/v${version}/micronaut-cli-${version}.zip";
-    sha256 = "sha256-QCXf3999EFLVSUuks8vQWAG/yJnZ74leJ0HWwzH70qU=";
+    sha256 = "sha256-u24Lwvcfv5sHQu/5N7+jOK3EpJ8zJgSs5wZBee2hNrg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/na/namespace-cli/package.nix b/pkgs/by-name/na/namespace-cli/package.nix
index 432d1cabf173..ea16f7253518 100644
--- a/pkgs/by-name/na/namespace-cli/package.nix
+++ b/pkgs/by-name/na/namespace-cli/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "namespace-cli";
-  version = "0.0.416";
+  version = "0.0.421";
 
   src = fetchFromGitHub {
     owner = "namespacelabs";
     repo = "foundation";
     rev = "v${version}";
-    hash = "sha256-Te2BFbzrGU7iw+CqDafOiIByUfHEb8QGBAci+6imIm4=";
+    hash = "sha256-4Gsj4BlPCjSRY/b6UeSaTwTFw9xFTvK1u08cIwPjPaY=";
   };
 
   vendorHash = "sha256-hPZmNH4bhIds+Ps0pQCjYPfvVBaX8e3Bq/onq91Fzq8=";
diff --git a/pkgs/by-name/ne/neonmodem/package.nix b/pkgs/by-name/ne/neonmodem/package.nix
index e38dab6772de..53b817f498df 100644
--- a/pkgs/by-name/ne/neonmodem/package.nix
+++ b/pkgs/by-name/ne/neonmodem/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "neonmodem";
-  version = "1.0.6";
+  version = "1.0.7";
 
   src = fetchFromGitHub {
     owner = "mrusme";
     repo = "neonmodem";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VLR6eicffA0IXVwEZMvgpm1kVmrLYVZOtq7MSy+vIw8=";
+    hash = "sha256-gwhQG8H1OnGQmawPQ3m6VKVooBh8rZaNr6FDl6fgZXc=";
   };
 
-  vendorHash = "sha256-pESNARoUgfg5/cTlTvKF3i7dTMIu0gRG/oV4Ov6h2cY=";
+  vendorHash = "sha256-zqQtuyFrsDB1xRdl4cbaTsCawMrBvcu78zXgU2jUwHI=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/ne/newsflash/package.nix b/pkgs/by-name/ne/newsflash/package.nix
index e534e2e76df9..80bebc9822a4 100644
--- a/pkgs/by-name/ne/newsflash/package.nix
+++ b/pkgs/by-name/ne/newsflash/package.nix
@@ -88,7 +88,10 @@ stdenv.mkDerivation (finalAttrs: {
       gst-plugins-bad
     ]);
 
-  passthru.updateScript = gitUpdater { rev-prefix = "v."; };
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "v.";
+    ignoredVersions = "(alpha|beta|rc)";
+  };
 
   meta = {
     description = "Modern feed reader designed for the GNOME desktop";
diff --git a/pkgs/by-name/op/open-webui/package.nix b/pkgs/by-name/op/open-webui/package.nix
index 4644d2a7453c..cc1022ac6f87 100644
--- a/pkgs/by-name/op/open-webui/package.nix
+++ b/pkgs/by-name/op/open-webui/package.nix
@@ -9,13 +9,13 @@
 }:
 let
   pname = "open-webui";
-  version = "0.6.13";
+  version = "0.6.14";
 
   src = fetchFromGitHub {
     owner = "open-webui";
     repo = "open-webui";
     tag = "v${version}";
-    hash = "sha256-teBGAo9YyFSBVXMElpw2zON5oCa3O8k+pf9pSNSW5gc=";
+    hash = "sha256-tq6npchWuEzgMOoCUvwHGbDjpJPOO1eSCS/88IzhWvQ=";
   };
 
   frontend = buildNpmPackage rec {
@@ -32,7 +32,7 @@ let
       url = "https://github.com/pyodide/pyodide/releases/download/${pyodideVersion}/pyodide-${pyodideVersion}.tar.bz2";
     };
 
-    npmDepsHash = "sha256-/olaKqd0ZBFKyfoyhuPsd1Gl7nC9pro2apiWLjPe07s=";
+    npmDepsHash = "sha256-bt0Q6/ajrMA2yfdWyF+/NeImomRMspLiX3wu+EJ8mTU=";
 
     # Disabling `pyodide:fetch` as it downloads packages during `buildPhase`
     # Until this is solved, running python packages from the browser will not work.
diff --git a/pkgs/by-name/op/openfga-cli/package.nix b/pkgs/by-name/op/openfga-cli/package.nix
index 0c59cfb1d84d..59e6a1a8a8a0 100644
--- a/pkgs/by-name/op/openfga-cli/package.nix
+++ b/pkgs/by-name/op/openfga-cli/package.nix
@@ -7,7 +7,7 @@
 
 let
   pname = "openfga-cli";
-  version = "0.6.6";
+  version = "0.7.0";
 in
 
 buildGoModule {
@@ -17,10 +17,10 @@ buildGoModule {
     owner = "openfga";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-cmeWRtdt3mm5FqOq28pWNPgwQeJs/5amZ5RHT8VzwYQ=";
+    hash = "sha256-hZS9aBHPrcLZd5oitFPAG7z0M5mxWAX2ErE3PL+EdN4=";
   };
 
-  vendorHash = "sha256-vIkG78ep/JcjhlQznn93ImLrZCpKX6GU6FEzbJBPu2Y=";
+  vendorHash = "sha256-qVJBYLJ4YNNA8hkl4J2kEL1MR+MzrHMQnhNvs6EYV98=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/pi/pik/package.nix b/pkgs/by-name/pi/pik/package.nix
index da9709b0b4b7..fff31310e55c 100644
--- a/pkgs/by-name/pi/pik/package.nix
+++ b/pkgs/by-name/pi/pik/package.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "pik";
-  version = "0.23.1";
+  version = "0.24.0";
 
   src = fetchFromGitHub {
     owner = "jacek-kurlit";
     repo = "pik";
     rev = version;
-    hash = "sha256-ol2jILlSmCVLieNzyo4UnzeIn+Xy2Sh03ZyfG2oABcM=";
+    hash = "sha256-LA60IQtR3IYVDdww79XFsTViGeVKi1MzRBB8ibhITK0=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-t9iGHmwB533Jk5sJ6XmOg2OVaD+PgsKaQQ66QjQxdNY=";
+  cargoHash = "sha256-j/BWTCsdAZF3NDj07DY5Mdf6MRGyBe3xpowZZQHSwTU=";
 
   passthru.tests.version = testers.testVersion { package = pik; };
 
diff --git a/pkgs/by-name/pl/plasma-panel-spacer-extended/package.nix b/pkgs/by-name/pl/plasma-panel-spacer-extended/package.nix
index 4de57017c6e1..5c92df60d720 100644
--- a/pkgs/by-name/pl/plasma-panel-spacer-extended/package.nix
+++ b/pkgs/by-name/pl/plasma-panel-spacer-extended/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "plasma-panel-spacer-extended";
-  version = "1.10.1";
+  version = "1.11.1";
 
   src = fetchFromGitHub {
     owner = "luisbocanegra";
     repo = "plasma-panel-spacer-extended";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PEwyydaO2n/tuZ63403mnT2ZRVq4wy5rLUFwX9r8P20=";
+    hash = "sha256-TQx9J10qfjCaolq/mpSjhV13uYxK/wBGIXH1sQFaLRA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/po/pony-corral/package.nix b/pkgs/by-name/po/pony-corral/package.nix
index f56b4d0f5b19..2e39d4c8b6b4 100644
--- a/pkgs/by-name/po/pony-corral/package.nix
+++ b/pkgs/by-name/po/pony-corral/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "corral";
-  version = "0.8.2";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "ponylang";
     repo = "corral";
     rev = finalAttrs.version;
-    hash = "sha256-arcMtCSbXFLBT2ygdj44UKMdGStlgHyiBgt5xZpPRhs=";
+    hash = "sha256-zbOlk92oyy17VyUalYnUZPxAO+8wjRMCqcwLx0lLL1g=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/re/readarr/package.nix b/pkgs/by-name/re/readarr/package.nix
index 30b5a3de57bf..ae9b7581894e 100644
--- a/pkgs/by-name/re/readarr/package.nix
+++ b/pkgs/by-name/re/readarr/package.nix
@@ -24,15 +24,15 @@ let
     ."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   hash =
     {
-      x64-linux_hash = "sha256-sJcnCysBNRL0rY+leTW9oTmHPa1Ook8oC6ateAyP58A=";
-      arm64-linux_hash = "sha256-PQYWApDyl5HFv+lNFi/VQ0suG32QHm0icjsEjHopf/U=";
-      x64-osx_hash = "sha256-NBy3shWURHQdZauTqeZMi7OMfGkBmJjhF/l4oX2xTp4=";
+      x64-linux_hash = "sha256-3Oir/a5TwaCraYierE6pPPZWYObNOD6+V7olw/HmckM=";
+      arm64-linux_hash = "sha256-B/Or5hdqMxqQEmBULG+Z1JqlL9Kdk5M6SBdjhbfMBZA=";
+      x64-osx_hash = "sha256-FYfX50pomjlB/oGVeIHqYvZ00S1SSgBaVB7R8150rvY=";
     }
     ."${arch}-${os}_hash";
 in
 stdenv.mkDerivation rec {
   pname = "readarr";
-  version = "0.4.16.2793";
+  version = "0.4.17.2801";
 
   src = fetchurl {
     url = "https://github.com/Readarr/Readarr/releases/download/v${version}/Readarr.develop.${version}.${os}-core-${arch}.tar.gz";
diff --git a/pkgs/by-name/re/renode-dts2repl/package.nix b/pkgs/by-name/re/renode-dts2repl/package.nix
index 2b0492851ead..b345e3a3d27e 100644
--- a/pkgs/by-name/re/renode-dts2repl/package.nix
+++ b/pkgs/by-name/re/renode-dts2repl/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication {
   pname = "renode-dts2repl";
-  version = "0-unstable-2025-05-28";
+  version = "0-unstable-2025-06-09";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "antmicro";
     repo = "dts2repl";
-    rev = "8413c5a08ed53867493b2a08fd4c730d7b419ee7";
-    hash = "sha256-Dl/JzkUP/mNBxz20C4qH5B3qpXjd4/q/r5n0RO3ga+U=";
+    rev = "f7419099a1678a1de3e20324b67c5e2baff24be6";
+    hash = "sha256-RG/3UZkuivou+jedyfqcORr0y6DY5EUnPwC6IPPC+aU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ru/rush-parallel/package.nix b/pkgs/by-name/ru/rush-parallel/package.nix
index 1eeff70b49bf..945b6a6f1a31 100644
--- a/pkgs/by-name/ru/rush-parallel/package.nix
+++ b/pkgs/by-name/ru/rush-parallel/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "rush-parallel";
-  version = "0.6.1";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "shenwei356";
     repo = "rush";
     rev = "v${version}";
-    hash = "sha256-IV49d4Xu5QqpgqKH4y+yaOHDhhFQ2s4PuyeWHMawZTQ=";
+    hash = "sha256-5xuRA3Jf9SiNc6E/XBP9PCSA7vmioww0G5QkUAzHmEI=";
   };
 
   vendorHash = "sha256-zCloMhjHNkPZHYX1e1nx072IYbWHFWam4Af0l0s8a6M=";
diff --git a/pkgs/by-name/se/sesh/package.nix b/pkgs/by-name/se/sesh/package.nix
index 98409eb9b19a..2e42558ac8b9 100644
--- a/pkgs/by-name/se/sesh/package.nix
+++ b/pkgs/by-name/se/sesh/package.nix
@@ -5,16 +5,16 @@
 }:
 buildGoModule rec {
   pname = "sesh";
-  version = "2.14.0";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "joshmedeski";
     repo = "sesh";
     rev = "v${version}";
-    hash = "sha256-Dla43xI6y7J9M18IloSm1uDeHAhfslU56Z0Q3nVzjIk=";
+    hash = "sha256-D//yt8DVy7DMX38qfmVa5UbGIgjzsGXQoscrhcgPzh4=";
   };
 
-  vendorHash = "sha256-3wNp1meUoUFPa2CEgKjuWcu4I6sxta3FPFvCb9QMQhQ=";
+  vendorHash = "sha256-r6n0xZbOvqDU63d3WrXenvV4x81iRgpOS2h73xSlVBI=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/si/sigil/package.nix b/pkgs/by-name/si/sigil/package.nix
index 46ad4b1b574f..c59b70df0f08 100644
--- a/pkgs/by-name/si/sigil/package.nix
+++ b/pkgs/by-name/si/sigil/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sigil";
-  version = "2.5.1";
+  version = "2.5.2";
 
   src = fetchFromGitHub {
     repo = "Sigil";
     owner = "Sigil-Ebook";
     tag = version;
-    hash = "sha256-1Z+OosEZJEHiUz+62wYuNeAyQXARh14WAtqBVjq1FZw=";
+    hash = "sha256-nMPBkAAah4qbatvtfkCJqdo6BVL0NuxFZEHhSiB4uXY=";
   };
 
   pythonPath = with python3Packages; [ lxml ];
diff --git a/pkgs/by-name/sp/spicetify-cli/package.nix b/pkgs/by-name/sp/spicetify-cli/package.nix
index 44c545ecb7b2..5ac99f455374 100644
--- a/pkgs/by-name/sp/spicetify-cli/package.nix
+++ b/pkgs/by-name/sp/spicetify-cli/package.nix
@@ -8,16 +8,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "spicetify-cli";
-  version = "2.40.10";
+  version = "2.40.11";
 
   src = fetchFromGitHub {
     owner = "spicetify";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-S9vC7gAbwW8YSpXyDryalXHW3aWffGlelyc/oaE5vXg=";
+    hash = "sha256-CVCp9XzbVM0XAtgtBfMLLQTymzMTZfpoL9RrLI9MaDY=";
   };
 
-  vendorHash = "sha256-901njlGcAxr12F9w6yQ+ESsptlwsZsMvKPUmlHxehmA=";
+  vendorHash = "sha256-iD6sKhMnvc0RczoSCWCx/72/zjoC6YQyV+AYyE4w/b0=";
 
   ldflags = [
     "-s -w"
diff --git a/pkgs/by-name/st/steamtinkerlaunch/package.nix b/pkgs/by-name/st/steamtinkerlaunch/package.nix
index 858a9487fac5..de45aa586e88 100644
--- a/pkgs/by-name/st/steamtinkerlaunch/package.nix
+++ b/pkgs/by-name/st/steamtinkerlaunch/package.nix
@@ -20,13 +20,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "steamtinkerlaunch";
-  version = "12.12-unstable-2025-02-21";
+  version = "12.12-unstable-2025-06-02";
 
   src = fetchFromGitHub {
     owner = "sonic2kk";
     repo = "steamtinkerlaunch";
-    rev = "36e917c383a333caa43e187c06c0aed0c30c0421";
-    hash = "sha256-I7Aa7bZ6WB5LfCxyZUbl7fshyr2YWlZTMZDJKCODvhY=";
+    rev = "32bf79010dd2eb981ad5022c5b79fb65d2324d8a";
+    hash = "sha256-iWGbUI56e7uoTtAlykvkDCnS61WsRExfTDIIS85x5pQ=";
   };
 
   passthru.updateScript = unstableGitUpdater {
diff --git a/pkgs/by-name/ta/tauno-monitor/package.nix b/pkgs/by-name/ta/tauno-monitor/package.nix
new file mode 100644
index 000000000000..28be4982bffa
--- /dev/null
+++ b/pkgs/by-name/ta/tauno-monitor/package.nix
@@ -0,0 +1,57 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  meson,
+  ninja,
+  pkg-config,
+  appstream,
+  desktop-file-utils,
+  gobject-introspection,
+  wrapGAppsHook4,
+  libadwaita,
+}:
+python3Packages.buildPythonApplication rec {
+  pname = "tauno-monitor";
+  version = "0.1.27";
+  pyproject = false;
+
+  src = fetchFromGitHub {
+    owner = "taunoe";
+    repo = "tauno-monitor";
+    tag = "v${version}";
+    hash = "sha256-QxapBgKKXuZxMIvZ8Z91cYhjE2/qxe9fC/eEaPpJWFg=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    appstream
+    desktop-file-utils
+    gobject-introspection
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    libadwaita
+  ];
+
+  dependencies = with python3Packages; [
+    pygobject3
+    pyserial
+  ];
+
+  dontWrapGApps = true;
+
+  makeWrapperArgs = [ "\${gappsWrapperArgs[@]}" ];
+
+  meta = {
+    description = "Simple serial port monitor";
+    homepage = "https://github.com/taunoe/tauno-monitor";
+    changelog = "https://github.com/taunoe/tauno-monitor/releases/tag/${src.tag}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ Cameo007 ];
+    mainProgram = "tauno-monitor";
+  };
+}
diff --git a/pkgs/by-name/td/tdl/package.nix b/pkgs/by-name/td/tdl/package.nix
index a2b11b68a982..b173f40f90d5 100644
--- a/pkgs/by-name/td/tdl/package.nix
+++ b/pkgs/by-name/td/tdl/package.nix
@@ -5,16 +5,16 @@
 }:
 buildGoModule rec {
   pname = "tdl";
-  version = "0.18.5";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "iyear";
     repo = "tdl";
     rev = "v${version}";
-    hash = "sha256-PVd9aYo4ALgzovNOfAUQkAaAbWNLeqF+UEPlL9iGhAs=";
+    hash = "sha256-EYS4EK0NmNHnvjMkf5AHrYpZeGw+n2ovFDLanbqpF4Y=";
   };
 
-  vendorHash = "sha256-IJPGkQxUGk7v+8J37vLTbLSGxYOcfgNDywnGzTxbk3w=";
+  vendorHash = "sha256-GpqgH23eK0h2BYxjN5TNUWEOT72smYdUoD1Iy6L2jL4=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/tr/treesheets/package.nix b/pkgs/by-name/tr/treesheets/package.nix
index 9f38024f1abb..f804e96e2e6c 100644
--- a/pkgs/by-name/tr/treesheets/package.nix
+++ b/pkgs/by-name/tr/treesheets/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "treesheets";
-  version = "0-unstable-2025-06-02";
+  version = "0-unstable-2025-06-09";
 
   src = fetchFromGitHub {
     owner = "aardappel";
     repo = "treesheets";
-    rev = "1e6604b6257b41ba518907bfa21c24fa8245c46f";
-    hash = "sha256-zSZ7tMjG5/kSzHifMSA7Wsypv0/x+Oir6jx0I5Fyk2c=";
+    rev = "6a1cd3b0eec3f9048c21cc7bfca52ebeaa1e29d4";
+    hash = "sha256-5zAOnz5+CCJzlUNK9DhIFy44OE4q+ZZq6AGY40IpZQ8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/vi/virtiofsd/package.nix b/pkgs/by-name/vi/virtiofsd/package.nix
index 6bd26991cab7..f8ab7c4e2653 100644
--- a/pkgs/by-name/vi/virtiofsd/package.nix
+++ b/pkgs/by-name/vi/virtiofsd/package.nix
@@ -9,19 +9,19 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "virtiofsd";
-  version = "1.13.1";
+  version = "1.13.2";
 
   src = fetchFromGitLab {
     owner = "virtio-fs";
     repo = "virtiofsd";
     rev = "v${version}";
-    hash = "sha256-QT0GfE0AOrNuL7ppiKNs6IKbCtdkfAnAT3PCGujMIUQ=";
+    hash = "sha256-7ShmdwJaMjaUDSFnzHnsTQ/CmAQ0qpZnX5D7cFYHNmo=";
   };
 
   separateDebugInfo = true;
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Gbnve7YjFvGCvDjlZ7HuvvIIAgJjHulN/Qwyf48lr0Y=";
+  cargoHash = "sha256-Y07SJ54sw4CPCPq/LoueGBfHuZXu9F32yqMR6LBJ09I=";
 
   LIBCAPNG_LIB_PATH = "${lib.getLib libcap_ng}/lib";
   LIBCAPNG_LINK_TYPE = if stdenv.hostPlatform.isStatic then "static" else "dylib";
diff --git a/pkgs/by-name/vu/vuls/package.nix b/pkgs/by-name/vu/vuls/package.nix
index 485530212e51..d007817926f8 100644
--- a/pkgs/by-name/vu/vuls/package.nix
+++ b/pkgs/by-name/vu/vuls/package.nix
@@ -6,17 +6,17 @@
 
 buildGo124Module rec {
   pname = "vuls";
-  version = "0.30.0";
+  version = "0.32.0";
 
   src = fetchFromGitHub {
     owner = "future-architect";
     repo = "vuls";
     tag = "v${version}";
-    hash = "sha256-lDLT5GNFL2LtooHNlpKrewzxVK5W8u+0U47BDvMG8l4=";
+    hash = "sha256-XFaKgCThZ7nE5JY11uq0A4kPMazPUINjo4el8IFRGNI=";
     fetchSubmodules = true;
   };
 
-  vendorHash = "sha256-X9PWg4vB07Bh9w8Lw3cdEaciVvRhvQD0L5n4cFKf880=";
+  vendorHash = "sha256-95j7C0VOJadcv1/SAwEc/2HmeV1vOAh6vdrElRx+M60=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/we/webex/package.nix b/pkgs/by-name/we/webex/package.nix
index e1e23eb9f479..3e0d5e4e3929 100644
--- a/pkgs/by-name/we/webex/package.nix
+++ b/pkgs/by-name/we/webex/package.nix
@@ -169,7 +169,7 @@ stdenv.mkDerivation rec {
     version=$(jq -r '.version' <<< "$manifest")
     hash=$(jq -r '.checksum' <<< "$manifest")
 
-    update-source-version ${pname} "$version" "$hash" "$url" --file=./pkgs/applications/networking/instant-messengers/webex/default.nix
+    update-source-version ${pname} "$version" "$hash" "$url" --file=./pkgs/by-name/we/webex/package.nix
   '';
 
   meta = with lib; {
diff --git a/pkgs/by-name/wl/wl-screenrec/package.nix b/pkgs/by-name/wl/wl-screenrec/package.nix
index f90cd7c5f2ac..a265c6fba2c1 100644
--- a/pkgs/by-name/wl/wl-screenrec/package.nix
+++ b/pkgs/by-name/wl/wl-screenrec/package.nix
@@ -1,30 +1,34 @@
 {
   lib,
+  stdenv,
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
+  installShellFiles,
   libdrm,
   ffmpeg_6,
   wayland,
+  nix-update-script,
 }:
 
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wl-screenrec";
-  version = "0.1.4-unstable-2024-07-28";
+  version = "0.1.7";
 
   src = fetchFromGitHub {
     owner = "russelltg";
     repo = "wl-screenrec";
-    rev = "b817accf1d4f2373cb6f466f760de35e5b8626bd";
-    hash = "sha256-07O2YM9dOHWzriM2+uiBWjEt2hKAuXtRtnKBuzb02Us=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-O3DNiLiZ1Rh5vesJX+cLv6cVcOVVUfWX914034R3ASQ=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-nwABNqJNqgBVwD860lSu9mcEgty/GbSYmPys3xp535Q=";
+  cargoHash = "sha256-shby6XE8xg5gqBoWlQn/Q0E+AmbyC8hFRp+EaBYS3Fs=";
 
   nativeBuildInputs = [
     pkg-config
     rustPlatform.bindgenHook
+    installShellFiles
   ];
 
   buildInputs = [
@@ -35,12 +39,21 @@ rustPlatform.buildRustPackage {
 
   doCheck = false; # tests use host compositor, etc
 
-  meta = with lib; {
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd wl-screenrec \
+      --bash <($out/bin/wl-screenrec --generate-completions bash) \
+      --fish <($out/bin/wl-screenrec --generate-completions fish) \
+      --zsh <($out/bin/wl-screenrec --generate-completions zsh)
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "High performance wlroots screen recording, featuring hardware encoding";
     homepage = "https://github.com/russelltg/wl-screenrec";
-    license = licenses.asl20;
-    platforms = platforms.linux;
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.linux;
     mainProgram = "wl-screenrec";
-    maintainers = with maintainers; [ colemickens ];
+    maintainers = with lib.maintainers; [ colemickens ];
   };
-}
+})
diff --git a/pkgs/by-name/ya/yamlscript/package.nix b/pkgs/by-name/ya/yamlscript/package.nix
index b4b9c1f361d1..189ad46ff1c2 100644
--- a/pkgs/by-name/ya/yamlscript/package.nix
+++ b/pkgs/by-name/ya/yamlscript/package.nix
@@ -6,11 +6,11 @@
 
 buildGraalvmNativeImage (finalAttrs: {
   pname = "yamlscript";
-  version = "0.1.96";
+  version = "0.1.97";
 
   src = fetchurl {
     url = "https://github.com/yaml/yamlscript/releases/download/${finalAttrs.version}/yamlscript.cli-${finalAttrs.version}-standalone.jar";
-    hash = "sha256-nwqZhGOtNEJ0qzOTFdHFWBSyt4hmLhn6nhdCz2jyUbg=";
+    hash = "sha256-xyKn+Eec6Kspoe0kq3N/nQDIOJSJcrb9CE/uUF3+Qcs=";
   };
 
   extraNativeImageBuildArgs = [
diff --git a/pkgs/desktops/pantheon/desktop/elementary-session-settings/default.nix b/pkgs/desktops/pantheon/desktop/elementary-session-settings/default.nix
index ab73700fbb70..b5d0948c9704 100644
--- a/pkgs/desktops/pantheon/desktop/elementary-session-settings/default.nix
+++ b/pkgs/desktops/pantheon/desktop/elementary-session-settings/default.nix
@@ -19,7 +19,6 @@
   meson,
   ninja,
 }:
-
 stdenv.mkDerivation rec {
   pname = "elementary-session-settings";
   version = "8.0.1";
@@ -31,6 +30,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-4B7lUjHEa4LdKrmsFCB3iFIsdVd/rgwmtQUAgAj3rXs=";
   };
 
+  /*
+    This allows `elementary-session-settings` to not use gnome-keyring's ssh capabilities anymore, as they have been
+    moved to gcr upstream, in an effort to modularize gnome-keyring.
+
+    More info can be found here: https://gitlab.gnome.org/GNOME/gnome-keyring/-/merge_requests/60
+  */
+  patches = [ ./no-gnome-keyring-ssh-autostart.patch ];
+
   nativeBuildInputs = [
     desktop-file-utils
     gettext
diff --git a/pkgs/desktops/pantheon/desktop/elementary-session-settings/no-gnome-keyring-ssh-autostart.patch b/pkgs/desktops/pantheon/desktop/elementary-session-settings/no-gnome-keyring-ssh-autostart.patch
new file mode 100644
index 000000000000..97682c5b3778
--- /dev/null
+++ b/pkgs/desktops/pantheon/desktop/elementary-session-settings/no-gnome-keyring-ssh-autostart.patch
@@ -0,0 +1,12 @@
+diff --git a/session/meson.build b/session/meson.build
+index 501e836..3254658 100644
+--- a/session/meson.build
++++ b/session/meson.build
+@@ -79,7 +79,6 @@ if get_option('detect-program-prefixes') == true
+   autostarts = {
+     'gnome-keyring-pkcs11': join_paths(gnome_keyring_prefix, 'etc/xdg/autostart', 'gnome-keyring-pkcs11.desktop'),
+     'gnome-keyring-secrets': join_paths(gnome_keyring_prefix, 'etc/xdg/autostart', 'gnome-keyring-secrets.desktop'),
+-    'gnome-keyring-ssh': join_paths(gnome_keyring_prefix, 'etc/xdg/autostart', 'gnome-keyring-ssh.desktop'),
+     'onboard-autostart': join_paths(onboard_prefix, 'etc/xdg/autostart', 'onboard-autostart.desktop'),
+     'orca-autostart': join_paths(orca_prefix, 'etc/xdg/autostart', 'orca-autostart.desktop'),
+   }
diff --git a/pkgs/development/libraries/gcr/4.nix b/pkgs/development/libraries/gcr/4.nix
index 33e85811a8f8..34a0e67a3e3a 100644
--- a/pkgs/development/libraries/gcr/4.nix
+++ b/pkgs/development/libraries/gcr/4.nix
@@ -1,4 +1,5 @@
 {
+  pkgs,
   stdenv,
   lib,
   fetchurl,
@@ -25,7 +26,9 @@
   shared-mime-info,
   systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd,
 }:
-
+let
+  ini = pkgs.formats.ini { };
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gcr";
   version = "4.4.0.1";
@@ -80,11 +83,20 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   mesonFlags = [
-    # We are still using ssh-agent from gnome-keyring.
-    # https://github.com/NixOS/nixpkgs/issues/140824
-    "-Dssh_agent=false"
     "-Dgpg_path=${lib.getBin gnupg}/bin/gpg"
     (lib.mesonEnable "systemd" systemdSupport)
+    "--cross-file=${
+      ini.generate "cross-file.conf" {
+        binaries =
+          {
+            ssh-add = "'${lib.getExe' openssh "ssh-add"}'";
+            ssh-agent = "'${lib.getExe' openssh "ssh-agent"}'";
+          }
+          // lib.optionalAttrs systemdSupport {
+            systemctl = "'${lib.getExe' systemd "systemctl"}'";
+          };
+      }
+    }"
   ];
 
   doCheck = false; # fails 21 out of 603 tests, needs dbus daemon
diff --git a/pkgs/development/ocaml-modules/janestreet/0.17.nix b/pkgs/development/ocaml-modules/janestreet/0.17.nix
index 4fff1c9ca651..c1be0727a058 100644
--- a/pkgs/development/ocaml-modules/janestreet/0.17.nix
+++ b/pkgs/development/ocaml-modules/janestreet/0.17.nix
@@ -935,6 +935,8 @@ with self;
     meta.description = "A library of intrinsics for OCaml";
     buildInputs = [
       dune-configurator
+    ];
+    propagatedBuildInputs = [
       ocaml_intrinsics_kernel
     ];
     patches = [
diff --git a/pkgs/development/python-modules/aioamazondevices/default.nix b/pkgs/development/python-modules/aioamazondevices/default.nix
index 2fcf9c0eeba6..97d51d48b29c 100644
--- a/pkgs/development/python-modules/aioamazondevices/default.nix
+++ b/pkgs/development/python-modules/aioamazondevices/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "aioamazondevices";
-  version = "3.0.6";
+  version = "3.1.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "chemelli74";
     repo = "aioamazondevices";
     tag = "v${version}";
-    hash = "sha256-+o3LOp0gSjG1/x5IFA0FK5LQUFG9T6JgDLb104vJcM0=";
+    hash = "sha256-oW9QRRTriopWzRJ9ZrDjIgviT/cVk2x6gaHXHmzYXMs=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/brax/default.nix b/pkgs/development/python-modules/brax/default.nix
index 177a906c3ecd..7d67df371c1f 100644
--- a/pkgs/development/python-modules/brax/default.nix
+++ b/pkgs/development/python-modules/brax/default.nix
@@ -9,13 +9,10 @@
 
   # dependencies
   absl-py,
-  dm-env,
   etils,
   flask,
   flask-cors,
   flax,
-  grpcio,
-  gym,
   jax,
   jaxlib,
   jaxopt,
@@ -27,12 +24,13 @@
   optax,
   orbax-checkpoint,
   pillow,
-  pytinyrenderer,
   scipy,
   tensorboardx,
   typing-extensions,
 
   # tests
+  dm-env,
+  gym,
   pytestCheckHook,
   pytest-xdist,
   transforms3d,
@@ -40,14 +38,14 @@
 
 buildPythonPackage rec {
   pname = "brax";
-  version = "0.12.3";
+  version = "0.12.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "brax";
     tag = "v${version}";
-    hash = "sha256-WshTiWK6XpwK2h/aw/YogA5pGo5U7RdZBz6UjD1Ft/4=";
+    hash = "sha256-/eb0WjMzHwD1tjTyZ2fb2dzvGrWnyOLcVLOx4BeKvqk=";
   };
 
   build-system = [
@@ -56,13 +54,10 @@ buildPythonPackage rec {
 
   dependencies = [
     absl-py
-    dm-env
     etils
     flask
     flask-cors
     flax
-    grpcio
-    gym
     jax
     jaxlib
     jaxopt
@@ -74,32 +69,24 @@ buildPythonPackage rec {
     optax
     orbax-checkpoint
     pillow
-    pytinyrenderer
     scipy
     tensorboardx
     typing-extensions
   ];
 
   nativeCheckInputs = [
+    dm-env
+    gym
     pytestCheckHook
     pytest-xdist
     transforms3d
   ];
 
-  disabledTests =
-    [
-      # Broken after mujoco was updated to 3.3.3:
-      # TypeError: Data.init() got an unexpected keyword argument 'contact'
-      # Reported upstream: https://github.com/google/brax/issues/618
-      "test_pendulum"
-      "test_pipeline_ant"
-      "test_pipeline_init_with_ctrl"
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isAarch64 [
-      # Flaky:
-      # AssertionError: Array(-0.00135638, dtype=float32) != 0.0 within 0.001 delta (Array(0.00135638, dtype=float32) difference)
-      "test_pendulum_period2"
-    ];
+  disabledTests = lib.optionals stdenv.hostPlatform.isAarch64 [
+    # Flaky:
+    # AssertionError: Array(-0.00135638, dtype=float32) != 0.0 within 0.001 delta (Array(0.00135638, dtype=float32) difference)
+    "test_pendulum_period2"
+  ];
 
   disabledTestPaths = [
     # ValueError: matmul: Input operand 1 has a mismatch in its core dimension
diff --git a/pkgs/development/python-modules/glyphslib/default.nix b/pkgs/development/python-modules/glyphslib/default.nix
index 88d17c067f6c..449b52c4c35a 100644
--- a/pkgs/development/python-modules/glyphslib/default.nix
+++ b/pkgs/development/python-modules/glyphslib/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "glyphslib";
-  version = "6.10.2";
+  version = "6.10.3";
 
   format = "pyproject";
 
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "googlefonts";
     repo = "glyphsLib";
     tag = "v${version}";
-    hash = "sha256-70qTvGYDbh6P57wbQGaKHmJYxOeY2xNN4cKL0tAJYEI=";
+    hash = "sha256-DLyWuFrAwc/ElGFjLxWY4RihwlQ143AUnWBzzJttZT4=";
   };
 
   nativeBuildInputs = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/gocardless-pro/default.nix b/pkgs/development/python-modules/gocardless-pro/default.nix
index ff29018beaac..41996ccf90fa 100644
--- a/pkgs/development/python-modules/gocardless-pro/default.nix
+++ b/pkgs/development/python-modules/gocardless-pro/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "gocardless-pro";
-  version = "3.0.0";
+  version = "3.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "gocardless";
     repo = "gocardless-pro-python";
     tag = "v${version}";
-    hash = "sha256-Bqqr3j9UJrwqxDdTEQMbWfkznHufnv1gk1Wd0SSF78M=";
+    hash = "sha256-NbUgntDZnre6raLGhC2NIY1DctaYInSk5JvsTRDO/dQ=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-iam-logging/default.nix b/pkgs/development/python-modules/google-cloud-iam-logging/default.nix
index 70125b2cca3e..16d0079d75fc 100644
--- a/pkgs/development/python-modules/google-cloud-iam-logging/default.nix
+++ b/pkgs/development/python-modules/google-cloud-iam-logging/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-iam-logging";
-  version = "1.4.2";
+  version = "1.4.3";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "google_cloud_iam_logging";
     inherit version;
-    hash = "sha256-2tpXDDqP6JN9y8wqku/C3+I9ymns5EfxvfR5eeTDstU=";
+    hash = "sha256-fmS+DTZciJ1BWMk6pxAVe/7Lgt0Xk+uyS5DCRYXAOEA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-translate/default.nix b/pkgs/development/python-modules/google-cloud-translate/default.nix
index 85c10647d378..3e6d297351cd 100644
--- a/pkgs/development/python-modules/google-cloud-translate/default.nix
+++ b/pkgs/development/python-modules/google-cloud-translate/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-translate";
-  version = "3.20.2";
+  version = "3.20.3";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "google_cloud_translate";
     inherit version;
-    hash = "sha256-tUOE7lX0vF2WbO4OELCBT/7hN1wfKvcLkiDTvPWNhfg=";
+    hash = "sha256-bTZUx/h3O/ytddhBkPdbqe6vJp5j4L+3PD8QrVUR5Ps=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/gphoto2/default.nix b/pkgs/development/python-modules/gphoto2/default.nix
index 58e3d19d3701..81a2a6275642 100644
--- a/pkgs/development/python-modules/gphoto2/default.nix
+++ b/pkgs/development/python-modules/gphoto2/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "gphoto2";
-  version = "2.6.0";
+  version = "2.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jim-easterbrook";
     repo = "python-gphoto2";
     tag = "v${version}";
-    hash = "sha256-S/uMP2kRXJDetpXT4+MmCvb35xSxEbzhtKJ0PbHIOIU=";
+    hash = "sha256-842otUAcPvwEfcXGNGhFReKbv6DykLNaEkMiN6j9/CM=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/granian/default.nix b/pkgs/development/python-modules/granian/default.nix
index 65d1e9993873..5e4243d05a05 100644
--- a/pkgs/development/python-modules/granian/default.nix
+++ b/pkgs/development/python-modules/granian/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "granian";
-  version = "2.3.2";
+  version = "2.3.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "emmett-framework";
     repo = "granian";
     tag = "v${version}";
-    hash = "sha256-qJ65ILj7xLqOWmpn1UzNQHUnzFg714gntVSmYHpI65I=";
+    hash = "sha256-pXMoNqcLrj8y2MK6NKQszBlGSrvZJShD/zzOzQbi/Rw=";
   };
 
   # Granian forces a custom allocator for all the things it runs,
@@ -39,7 +39,7 @@ buildPythonPackage rec {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-swfqKp8AsxNAUc7dlce6J4dNQbNGWrCcUDc31AhuMmI=";
+    hash = "sha256-KPIOpvqPYRJeMbokQRQb3UXDfXosdCZscSyzjSBhkEY=";
   };
 
   nativeBuildInputs = with rustPlatform; [
diff --git a/pkgs/development/python-modules/homematicip/default.nix b/pkgs/development/python-modules/homematicip/default.nix
index 3ed8c8983d06..fb1feb4dc972 100644
--- a/pkgs/development/python-modules/homematicip/default.nix
+++ b/pkgs/development/python-modules/homematicip/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "homematicip";
-  version = "2.0.4";
+  version = "2.0.5";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "hahn-th";
     repo = "homematicip-rest-api";
     tag = version;
-    hash = "sha256-AevInggDGEz3FcIwO1tk1lXI4m9g8MF92lc24f3AGgM=";
+    hash = "sha256-WvE5JTpAjRGLP7haIwD5hKOvz3hM7paV2jyds/yCxg8=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/nanoemoji/default.nix b/pkgs/development/python-modules/nanoemoji/default.nix
index d243ae457835..c282157e95c2 100644
--- a/pkgs/development/python-modules/nanoemoji/default.nix
+++ b/pkgs/development/python-modules/nanoemoji/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "nanoemoji";
-  version = "0.15.3";
+  version = "0.15.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googlefonts";
     repo = "nanoemoji";
     tag = "v${version}";
-    hash = "sha256-/YZKmeLgEQog6A1stXkoN+OrcF/LsgltQ/3BeCCtSqQ=";
+    hash = "sha256-QdovfpCICDWzNAotXBypk2pvylGrLC4s45OFLalnBSo=";
   };
 
   patches = [
@@ -92,7 +92,7 @@ buildPythonPackage rec {
   meta = {
     description = "Wee tool to build color fonts";
     homepage = "https://github.com/googlefonts/nanoemoji";
-    changelog = "https://github.com/googlefonts/nanoemoji/releases/tag/v${version}";
+    changelog = "https://github.com/googlefonts/nanoemoji/releases/tag/${src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ _999eagle ];
   };
diff --git a/pkgs/development/python-modules/opower/default.nix b/pkgs/development/python-modules/opower/default.nix
index bbf9fcdab2f0..dd1566c01807 100644
--- a/pkgs/development/python-modules/opower/default.nix
+++ b/pkgs/development/python-modules/opower/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "opower";
-  version = "0.12.3";
+  version = "0.12.4";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "tronikos";
     repo = "opower";
     tag = "v${version}";
-    hash = "sha256-fsZpAipBw6XLeLdum1p5gkpKSOG40TLa6cLFTUSA05Y=";
+    hash = "sha256-wUkPXfiXwKWVIQcPw2dsXJ5VMn1hf1rBFzDINnCVtEM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/orbax-checkpoint/default.nix b/pkgs/development/python-modules/orbax-checkpoint/default.nix
index 2ff52923d893..37a4c014b7b2 100644
--- a/pkgs/development/python-modules/orbax-checkpoint/default.nix
+++ b/pkgs/development/python-modules/orbax-checkpoint/default.nix
@@ -35,14 +35,14 @@
 
 buildPythonPackage rec {
   pname = "orbax-checkpoint";
-  version = "0.11.14";
+  version = "0.11.15";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "orbax";
     tag = "v${version}";
-    hash = "sha256-qZfC3rqfESfXdL/TMXodrJnM1/dQs9adDHM9DS0QlZ4=";
+    hash = "sha256-yy/BsmkBLlS6bd9I8rKKifRG+/T5/0XV00fq07LivPE=";
   };
 
   sourceRoot = "${src.name}/checkpoint";
diff --git a/pkgs/development/python-modules/python-linkplay/default.nix b/pkgs/development/python-modules/python-linkplay/default.nix
index f53de952a903..6a470b8608c9 100644
--- a/pkgs/development/python-modules/python-linkplay/default.nix
+++ b/pkgs/development/python-modules/python-linkplay/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "python-linkplay";
-  version = "0.2.11";
+  version = "0.2.12";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Velleman";
     repo = "python-linkplay";
     tag = "v${version}";
-    hash = "sha256-/AXhbcaP3itLO8xiIOoLtHvc5wNs7o+fHH0nN+OoGNs=";
+    hash = "sha256-oE3ILnaUDWMNcN3ZAIQKmGgUTc/tqXYdZTX1bxuHBso=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/ray/default.nix b/pkgs/development/python-modules/ray/default.nix
index 0e90279f86bc..071d44901775 100644
--- a/pkgs/development/python-modules/ray/default.nix
+++ b/pkgs/development/python-modules/ray/default.nix
@@ -64,7 +64,7 @@
 
 let
   pname = "ray";
-  version = "2.46.0";
+  version = "2.47.0";
 in
 buildPythonPackage rec {
   inherit pname version;
@@ -78,35 +78,35 @@ buildPythonPackage rec {
       platforms = {
         aarch64-darwin = "macosx_11_0_arm64";
         aarch64-linux = "manylinux2014_aarch64";
-        x86_64-darwin = "macosx_10_15_x86_64";
+        x86_64-darwin = "macosx_12_0_x86_64";
         x86_64-linux = "manylinux2014_x86_64";
       };
       # ./pkgs/development/python-modules/ray/prefetch.sh
       # Results are in ./ray-hashes.nix
       hashes = {
         x86_64-linux = {
-          cp310 = "sha256-wShQYIxXyK/ZYTqfdX13ZjxQ1L1Od7ovGBQlBSUgwBo=";
-          cp311 = "sha256-1N3tw/TUjfVkvO57ExyYyfiY/vCldIP0ujNfR/lRpi8=";
-          cp312 = "sha256-XOwe3ak/YY/9IwH4HVOYA38D+psWgl5+TYoArnqaQ4E=";
-          cp313 = "sha256-paKMCjEdLDIh3PcpxAiYpt+CRmu1ryHoG+BFPgmFat8=";
+          cp310 = "sha256-2bwLK5qXR5dBsFoO5AyngXDxoxICnwyz7GOcopdaLBQ=";
+          cp311 = "sha256-mXjmK+MSTNGlSP2MoxTj/7j5Xzj+4r2Y/eOMdTkDnj4=";
+          cp312 = "sha256-jTJr34I2TOkQx+BUFqIQ8IFCEGc6J1+1wA97ZayuVVE=";
+          cp313 = "sha256-NfixG1EV5TCL/9id19yagkpNxdyP8L2Le2BUN/Wo42g=";
         };
         aarch64-linux = {
-          cp310 = "sha256-OWuRKk2/ZJZuL9/Kn6y8r+V7eSykhCrFrhdQf9vf6J8=";
-          cp311 = "sha256-gcjOi3ujPLYH7Hj16yVVRw4wRrsxdzLYKC6BibtYzL0=";
-          cp312 = "sha256-AGy+Go/cN2ZBFKohh3MQDuiROZeF4lbCAuSJWNLawWc=";
-          cp313 = "sha256-gI2uzh8SvYkkucY4Kg+Y2m9caIbPsnHtjYlAeolBPNU=";
+          cp310 = "sha256-gNBbc3pYggQNyUnZqzdOQuH1MHotKvIvWoapEzAsYZw=";
+          cp311 = "sha256-rYHcke+f7mR0mSXeVHtLcRZ1cCkyb9WASYqzR7P/70w=";
+          cp312 = "sha256-QpLtKSVLeTyLGXRwRetE4PotXyElmxe6tj5D4Jl7edA=";
+          cp313 = "sha256-4+jlADusJGgYYzAVX+u7sKZo2lBa+paYCEUUYKVcxI4=";
         };
         x86_64-darwin = {
-          cp310 = "sha256-cZJEuE33lQLl8JSX8lZhjZTXjWb7ryKUIgCKBWjToP8=";
-          cp311 = "sha256-lCulHeb5zX+y7RdhgYGvSM5rlRd0PTI12EbsMileynY=";
-          cp312 = "sha256-0fN+rSkpljcURyb4CcLg/5WN2cDnWTDvYUFW1qCjpX8=";
-          cp313 = "sha256-svwsQ+oKN1IRk8Ye+aJ7b8qNurEWpYpS/UQ0TNc+Hs4=";
+          cp310 = "sha256-CFXvVo2pab2XCLCVKYhPb7HZYlyTSjFMRQ8MXiQqkT4=";
+          cp311 = "sha256-I5ByFBG+nVoKicH02AvcSMOjZgWjjamn9bWkYmE8XSE=";
+          cp312 = "sha256-S6cA3Uth7iWNeQBk0XbU29ibNj89MneLLK3s1A16PHI=";
+          cp313 = "sha256-bCYYiU0/LJg6E9na71kjxLMk6V0zrGH3+iA7vtRO/5U=";
         };
         aarch64-darwin = {
-          cp310 = "sha256-Q3ioaRnmZDI4oQlPcRuH+o3BoYuZjUGQ9pqzPGSiKow=";
-          cp311 = "sha256-r4Tz7QhUu23igZLKngo7+h6zTWnxGK5jSFIhmIlkgMg=";
-          cp312 = "sha256-t6BkrP7ufwZ32ePyXa75xZWTVZ+up2S0Sj4sUzHV2DI=";
-          cp313 = "sha256-QpbdjAF0JWoE7ktUq+ATtoAqRfuF+3z9sTdSMZZdbU0=";
+          cp310 = "sha256-G2ODPZcJl3f2cqh/H0NEaPrTtLTHIRAljNF3nk7uun4=";
+          cp311 = "sha256-pPDYfOr5GMUcXo3U1ZRVk02xjF8YRRYrnJWP5S6sXT4=";
+          cp312 = "sha256-WRm9UuWkaR/mXqZ+3OuCcwg4+sF7woSsLRlu7G9SURg=";
+          cp313 = "sha256-fExn+Jw2AkrnQFXh0zNvdp2gQrGQSoiDQJfZaPe5DuU=";
         };
       };
     in
diff --git a/pkgs/development/python-modules/smolagents/default.nix b/pkgs/development/python-modules/smolagents/default.nix
index 4aa0bfc487c8..2ee92a75222d 100644
--- a/pkgs/development/python-modules/smolagents/default.nix
+++ b/pkgs/development/python-modules/smolagents/default.nix
@@ -1,47 +1,65 @@
 {
   lib,
   stdenv,
-  accelerate,
   buildPythonPackage,
-  boto3,
-  docker,
-  duckduckgo-search,
   fetchFromGitHub,
-  gradio,
+
+  # build-system
+  setuptools,
+
+  # dependencies
   huggingface-hub,
   jinja2,
-  ipython,
-  litellm,
-  markdownify,
-  mcp,
-  mcpadapt,
-  openai,
-  pandas,
   pillow,
-  pytest-datadir,
-  pytestCheckHook,
   python-dotenv,
   requests,
   rich,
-  setuptools,
+
+  # optional-dependencies
+  # audio
   soundfile,
+  # bedrock
+  boto3,
+  # docker
+  docker,
+  websocket-client,
+  # gradio
+  gradio,
+  # litellm
+  litellm,
+  # mcp
+  mcp,
+  mcpadapt,
+  # openai
+  openai,
+  # toolkit
+  duckduckgo-search,
+  markdownify,
+  # torch
+  numpy,
   torch,
   torchvision,
+  # transformers
+  accelerate,
   transformers,
-  websocket-client,
+
+  # tests
+  ipython,
+  pytest-datadir,
+  pytestCheckHook,
   wikipedia-api,
 }:
 
 buildPythonPackage rec {
   pname = "smolagents";
-  version = "1.17.0";
+  version = "1.18.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "smolagents";
     tag = "v${version}";
-    hash = "sha256-BMyLN8eNGBhywpN/EEE8hFf4Wb5EDpZvqBbX0ojRYec=";
+    hash = "sha256-pRpogmVes8ZX19GZff+HmGdykvMnBJ7hGsoYsUGVOSY=";
   };
 
   build-system = [ setuptools ];
@@ -49,19 +67,16 @@ buildPythonPackage rec {
   pythonRelaxDeps = [ "pillow" ];
 
   dependencies = [
-    duckduckgo-search
     huggingface-hub
     jinja2
-    markdownify
-    pandas
     pillow
     python-dotenv
     requests
     rich
   ];
 
-  optional-dependencies = {
-    audio = [ soundfile ];
+  optional-dependencies = lib.fix (self: {
+    audio = [ soundfile ] ++ self.torch;
     bedrock = [ boto3 ];
     docker = [
       docker
@@ -85,14 +100,19 @@ buildPythonPackage rec {
     #   opentelemetry-exporter-otlp
     #   opentelemetry-sdk
     # ];
+    toolkit = [
+      duckduckgo-search
+      markdownify
+    ];
     torch = [
+      numpy
       torch
       torchvision
     ];
     transformers = [
       accelerate
       transformers
-    ];
+    ] ++ self.torch;
     # vision = [
     #   helium
     #   selenium
@@ -101,7 +121,7 @@ buildPythonPackage rec {
     #   torch
     #   vllm
     # ];
-  };
+  });
 
   nativeCheckInputs = [
     ipython
diff --git a/pkgs/development/python-modules/torchmetrics/default.nix b/pkgs/development/python-modules/torchmetrics/default.nix
index 077310e39567..7021d2125fd2 100644
--- a/pkgs/development/python-modules/torchmetrics/default.nix
+++ b/pkgs/development/python-modules/torchmetrics/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "torchmetrics";
-  version = "1.7.2";
+  version = "1.7.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Lightning-AI";
     repo = "torchmetrics";
     tag = "v${version}";
-    hash = "sha256-E/ZmP0eyNdSYb0+wKNsOZM2ViEldUWcwSmSGzZEYXfw=";
+    hash = "sha256-xnGODA5m4UannZKXn9Mq8bKI1WA+yHTOTicJ6AuLB+4=";
   };
 
   dependencies = [
diff --git a/pkgs/development/tools/apko/default.nix b/pkgs/development/tools/apko/default.nix
index 8cd0fc0e2ee2..4b9cb5946964 100644
--- a/pkgs/development/tools/apko/default.nix
+++ b/pkgs/development/tools/apko/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "apko";
-  version = "0.27.6";
+  version = "0.27.9";
 
   src = fetchFromGitHub {
     owner = "chainguard-dev";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-LoTnAfNw+yA5PtKVXDuxolacLxKbDkT0ZEvrw8TpXnw=";
+    hash = "sha256-ET/jzQ8sGQrxn9+3z6gOk57XTj9w9lJnwBK7c2n4s10=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
diff --git a/pkgs/development/tools/esbuild/default.nix b/pkgs/development/tools/esbuild/default.nix
index a8cddae3a432..76ab05ba857c 100644
--- a/pkgs/development/tools/esbuild/default.nix
+++ b/pkgs/development/tools/esbuild/default.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "esbuild";
-  version = "0.25.4";
+  version = "0.25.5";
 
   src = fetchFromGitHub {
     owner = "evanw";
     repo = "esbuild";
     rev = "v${version}";
-    hash = "sha256-fh+w8ZIWfNavZo6kBU8gKS6IwPXP3z+eXLDz3v6gVt4=";
+    hash = "sha256-jemGZkWmN1x2+ZzJ5cLp3MoXO0oDKjtZTmZS9Be/TDw=";
   };
 
   vendorHash = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index ea9a8465a342..0617231f1378 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2025.6.0";
+  version = "2025.6.1";
   components = {
     "3_day_blinds" =
       ps: with ps; [
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 7d17bf742402..3fffe4a6faa1 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -386,7 +386,7 @@ let
   extraBuildInputs = extraPackages python.pkgs;
 
   # Don't forget to run update-component-packages.py after updating
-  hassVersion = "2025.6.0";
+  hassVersion = "2025.6.1";
 
 in
 python.pkgs.buildPythonApplication rec {
@@ -407,13 +407,13 @@ python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     tag = version;
-    hash = "sha256-SSMubMXk6lasj0CwgPVQRzW7yzkN3lWaoJJDf51zIGQ=";
+    hash = "sha256-Pp2IIpVfzYE4BBJEq4Ll2s0vgsqxAApE8TmVd1zAg38=";
   };
 
   # Secondary source is pypi sdist for translations
   sdist = fetchPypi {
     inherit pname version;
-    hash = "sha256-3PiRVBtboqWVU5da8EeOkRWAGumrLENNSMD4cD7/MOU=";
+    hash = "sha256-yc4tEyR3xpo4x9daWEwXFJBhSH3xeOc2ckO+7LWVRlA=";
   };
 
   build-system = with python.pkgs; [
diff --git a/pkgs/servers/home-assistant/frontend.nix b/pkgs/servers/home-assistant/frontend.nix
index d874c8675e71..bb35c97d4b06 100644
--- a/pkgs/servers/home-assistant/frontend.nix
+++ b/pkgs/servers/home-assistant/frontend.nix
@@ -8,7 +8,7 @@ buildPythonPackage rec {
   # the frontend version corresponding to a specific home-assistant version can be found here
   # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
   pname = "home-assistant-frontend";
-  version = "20250531.2";
+  version = "20250531.3";
   format = "wheel";
 
   src = fetchPypi {
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     pname = "home_assistant_frontend";
     dist = "py3";
     python = "py3";
-    hash = "sha256-i77uNNUHwPW+A4RkweqcvOdJofKSWhzoeup5HQFwMzQ=";
+    hash = "sha256-FmG7Ym85KwE76s+srHzcGM2p5hh56X7cZOBZu4Gr4mM=";
   };
 
   # there is nothing to strip in this package
diff --git a/pkgs/servers/monitoring/prometheus/pgbouncer-exporter.nix b/pkgs/servers/monitoring/prometheus/pgbouncer-exporter.nix
index 569e84501099..2b1c4a93a5d8 100644
--- a/pkgs/servers/monitoring/prometheus/pgbouncer-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/pgbouncer-exporter.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "pgbouncer-exporter";
-  version = "0.10.2";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "prometheus-community";
     repo = "pgbouncer_exporter";
     rev = "v${version}";
-    hash = "sha256-8ChYYJIHdzH2vWxqnzS6sz9fDeLe+Y29fzia3/aBkgc=";
+    hash = "sha256-YvkD6X2aSXeOW7O5RqAVM1Fo6KE8OCh0+QzgoW8QAVg=";
   };
 
-  vendorHash = "sha256-PjoS56MdYpDOuSTHHo5lGL9KlWlu3ycA08qim8jrnSU=";
+  vendorHash = "sha256-IBIJWA/arARPV0ErAQdGJXbPAaryCN22mHwKL08M8QA=";
 
   meta = with lib; {
     description = "Prometheus exporter for PgBouncer";
diff --git a/pkgs/servers/monitoring/prometheus/redis-exporter.nix b/pkgs/servers/monitoring/prometheus/redis-exporter.nix
index eec8e8aa1f5c..1f3289574c08 100644
--- a/pkgs/servers/monitoring/prometheus/redis-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/redis-exporter.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "redis_exporter";
-  version = "1.73.0";
+  version = "1.74.0";
 
   src = fetchFromGitHub {
     owner = "oliver006";
     repo = "redis_exporter";
     rev = "v${version}";
-    sha256 = "sha256-yQurt8LCJR/vbnRo1Al6LUPiCSbGNFKmYDi4nFwrlfM=";
+    sha256 = "sha256-TPMbRyz476ylo6OEYYtLQCNL01dLShnJu0ncVgzL5kY=";
   };
 
-  vendorHash = "sha256-gp2TRIv3sotQlKd4dJq1B8U2YoKCQirbQUU7SimG2K8=";
+  vendorHash = "sha256-q/RMdGFwZuFnjE0txb7ShhHlxLpLNF5S6KmmAKKYnaE=";
 
   ldflags = [
     "-X main.BuildVersion=${version}"
diff --git a/pkgs/servers/mpd/default.nix b/pkgs/servers/mpd/default.nix
index 3ec05f243fa9..28b9e2b5cbaa 100644
--- a/pkgs/servers/mpd/default.nix
+++ b/pkgs/servers/mpd/default.nix
@@ -38,6 +38,7 @@
   soxr,
   # Outputs
   alsa-lib,
+  libao,
   libjack2,
   libpulseaudio,
   libshout,
@@ -112,6 +113,7 @@ let
     soxr = [ soxr ];
     # Output plugins
     alsa = [ alsa-lib ];
+    ao = [ libao ];
     jack = [ libjack2 ];
     pipewire = [ pipewire ];
     pulse = [ libpulseaudio ];
@@ -262,7 +264,9 @@ let
         ]
         ++ map (x: "-D${x}=enabled") features_
         ++ map (x: "-D${x}=disabled") (lib.subtractLists features_ knownFeatures)
-        ++ lib.optional (builtins.elem "zeroconf" features_) "-Dzeroconf=avahi"
+        ++ lib.optional (builtins.elem "zeroconf" features_) (
+          "-Dzeroconf=" + (if stdenv.hostPlatform.isDarwin then "bonjour" else "avahi")
+        )
         ++ lib.optional (builtins.elem "systemd" features_) "-Dsystemd_system_unit_dir=etc/systemd/system"
         ++ lib.optional (builtins.elem "qobuz" features_) "-Dnlohmann_json=enabled";