diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index ef9a34b768db..ba6d2b7ed416 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -19557,6 +19557,11 @@
     githubId = 10180857;
     name = "Anmol Sethi";
   };
+  nhshah15 = {
+    github = "nhshah15";
+    githubId = 31825306;
+    name = "Neil Shah";
+  };
   ni5arga = {
     email = "hello@ni5arga.com";
     github = "ni5arga";
@@ -30498,6 +30503,12 @@
     githubId = 7040031;
     name = "Yannik Sander";
   };
+  ysnt-yes = {
+    name = "Yes";
+    github = "ysnt-yes";
+    githubId = 85800291;
+    email = "yes@ysnt.live";
+  };
   yuannan = {
     email = "brandon@emergence.ltd";
     github = "yuannan";
diff --git a/nixos/tests/rancher/multi-node.nix b/nixos/tests/rancher/multi-node.nix
index d44884e5002e..6e5584f0cd7a 100644
--- a/nixos/tests/rancher/multi-node.nix
+++ b/nixos/tests/rancher/multi-node.nix
@@ -222,6 +222,11 @@ in
       # Also wait for our service account to show up; it takes a sec
       server.wait_until_succeeds("kubectl get serviceaccount default")
 
+      # Wait for all nodes to be ready
+      server.succeed("kubectl wait --timeout=-1s --for=condition=Ready node/server")
+      server.succeed("kubectl wait --timeout=-1s --for=condition=Ready node/server2")
+      server.succeed("kubectl wait --timeout=-1s --for=condition=Ready node/agent")
+
       # Now create a pod on each node via a daemonset and verify they can talk to each other.
       server.succeed("kubectl apply -f ${networkTestDaemonset}")
       server.wait_until_succeeds("kubectl rollout status daemonset test")
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/codesnap-nvim/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/codesnap-nvim/default.nix
index 4d2f7094ba13..6a6d0ba5b56c 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/codesnap-nvim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/codesnap-nvim/default.nix
@@ -10,12 +10,12 @@
   nix-update-script,
 }:
 let
-  version = "2.0.1";
+  version = "2.0.3";
   src = fetchFromGitHub {
     owner = "mistricky";
     repo = "codesnap.nvim";
     tag = "v${version}";
-    hash = "sha256-pYBB647UX3okpfUlZ3MhrlEwILXv/V0r42j7xp4aDO0=";
+    hash = "sha256-mpH+sewIXgl4vYLDToMYx3IX19HFPDjBWmMRdYGVsIw=";
   };
   codesnap-lib = rustPlatform.buildRustPackage {
     pname = "codesnap-lib";
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 7b79bb6e7003..5edddf51e0ac 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -661,13 +661,13 @@
     "vendorHash": "sha256-CwTlb0QTq0lpZK90IL6mBLoarFYFLsjiLYauGEaR1Rk="
   },
   "hashicorp_tfe": {
-    "hash": "sha256-/vEbhPKNhKUIlChGYuMNR5Ulbk9gG4171vZ6pvoTdcM=",
+    "hash": "sha256-GRrtwrShJj+d2h6CpxjP+QmRKQLTWoNt5889ek9rfyE=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/tfe",
     "owner": "hashicorp",
     "repo": "terraform-provider-tfe",
-    "rev": "v0.76.2",
+    "rev": "v0.77.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-JNTe1RI2aDw86jNzYJqmiBr5BBnr824/DhkJeaMpbKI="
+    "vendorHash": "sha256-DutNev1ABazfV6QOWMFsFc0QSkffARhaJ7RXTWG2Jyo="
   },
   "hashicorp_time": {
     "hash": "sha256-5+iPq2It3oFHPBHWshfIuNo1xkOPcuSYyljt6j+j7lg=",
@@ -1256,13 +1256,13 @@
     "vendorHash": "sha256-L+J3vsxxmF3TjQaDL5Uo9IentkDJfGpjfzBYTQzzGvY="
   },
   "spotinst_spotinst": {
-    "hash": "sha256-0Wc+QgEeizydsvtyBdnxgLhpYuBZLMB3JGjmTDXzJY0=",
+    "hash": "sha256-b+Bk3W3/xNF863+kflRVZ0gyk5YyziVS4Ok+H5A3VEg=",
     "homepage": "https://registry.terraform.io/providers/spotinst/spotinst",
     "owner": "spotinst",
     "repo": "terraform-provider-spotinst",
-    "rev": "v1.235.0",
+    "rev": "v1.236.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-odyKlnrYufT5pQsYuGN0hKQeQx7LzTLVNTwde97wyPc="
+    "vendorHash": "sha256-Gb07NAvZowWIUokmjLq2IOvg4El2hGwJ6J2J9hBj+eg="
   },
   "statuscakedev_statuscake": {
     "hash": "sha256-zXBZZA+2uRN2FeGrayq0a4EBk7T+PvlBIwbuxwM7yBc=",
diff --git a/pkgs/applications/science/molecular-dynamics/gromacs/default.nix b/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
index e4d07d925053..fe76b4457b0f 100644
--- a/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
+++ b/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch2,
   cmake,
   hwloc,
   fftw,
@@ -69,7 +70,17 @@ stdenv.mkDerivation rec {
     inherit (source) hash;
   };
 
-  patches = [ (if enablePlumed then ./pkgconfig-2024.patch else ./pkgconfig-2025.patch) ];
+  patches = [
+    # Fix pkg-config paths for the version-specific gromacs variant.
+    (if enablePlumed then ./pkgconfig-2024.patch else ./pkgconfig-2025.patch)
+  ]
+  ++ lib.optional enablePlumed (
+    # Backport gcc 15 cstdint include fix.
+    fetchpatch2 {
+      url = "https://gitlab.com/gromacs/gromacs/-/commit/e0180bc37f3111d7dcaffca3854c088ed910c3b4.diff";
+      hash = "sha256-TvTzfb/RETAzFpYfFFr6/L5GV1Pile16gVJhNigwAB4=";
+    }
+  );
 
   postPatch = lib.optionalString enablePlumed ''
     plumed patch -p -e gromacs-${source.version}
diff --git a/pkgs/by-name/ac/accountsservice/package.nix b/pkgs/by-name/ac/accountsservice/package.nix
index 36f274498fea..285a393feb7c 100644
--- a/pkgs/by-name/ac/accountsservice/package.nix
+++ b/pkgs/by-name/ac/accountsservice/package.nix
@@ -8,7 +8,7 @@
   shadow,
   gobject-introspection,
   polkit,
-  systemd,
+  systemdLibs,
   coreutils,
   meson,
   mesonEmulatorHook,
@@ -74,7 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
     gettext
     glib
     polkit
-    systemd
+    systemdLibs
     libxcrypt
   ];
 
diff --git a/pkgs/by-name/an/ananicy-rules-cachyos/package.nix b/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
index a1206daf52c4..92d2a2c78f0d 100644
--- a/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
+++ b/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "ananicy-rules-cachyos";
-  version = "0-unstable-2026-05-12";
+  version = "0-unstable-2026-05-19";
 
   src = fetchFromGitHub {
     owner = "CachyOS";
     repo = "ananicy-rules";
-    rev = "96d10aba6ead2862c4cc34bd6c9f1fabfeb4bee6";
-    hash = "sha256-YCt0XL+t7kMPQjWaLZrQGXDu5LjPqHye4T0t906tOXA=";
+    rev = "74b314e1c54115623fcb0eea868d1e08a10f84fe";
+    hash = "sha256-UGSv3ilCRfFmUpY3Gn/sEGs8nrA8zd+g/qihuNkIWLI=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/ar/arnis/package.nix b/pkgs/by-name/ar/arnis/package.nix
index 7641b3342691..71ce5b416a5e 100644
--- a/pkgs/by-name/ar/arnis/package.nix
+++ b/pkgs/by-name/ar/arnis/package.nix
@@ -12,16 +12,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "arnis";
-  version = "2.7.0";
+  version = "2.8.0";
 
   src = fetchFromGitHub {
     owner = "louis-e";
     repo = "arnis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7Fh/jhKVNeAlJn2PATEMkPROhsyUYTtUp+Dv0FXoIfs=";
+    hash = "sha256-hNVECK6+I3ML/knsBdvEx2Uz1w4jXHynanlQfgrM9oM=";
   };
 
-  cargoHash = "sha256-ZKr+BBcn6vKq3JuLkHqaVHM6Ug7BfUUTEmnePs7RKyc=";
+  cargoHash = "sha256-Kff+76lZ6hsSbssYhrupmE2xAt1gwia8sMZR15ReqgU=";
 
   nativeBuildInputs = [
     cargo-tauri.hook
diff --git a/pkgs/by-name/aw/awsebcli/package.nix b/pkgs/by-name/aw/awsebcli/package.nix
index 67fba53a1467..856a8ee7ac0b 100644
--- a/pkgs/by-name/aw/awsebcli/package.nix
+++ b/pkgs/by-name/aw/awsebcli/package.nix
@@ -27,7 +27,7 @@ in
 
 python.pkgs.buildPythonApplication (finalAttrs: {
   pname = "awsebcli";
-  version = "3.27.1";
+  version = "3.27.2";
   pyproject = true;
   doInstallCheck = true;
 
@@ -35,7 +35,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
     owner = "aws";
     repo = "aws-elastic-beanstalk-cli";
     tag = finalAttrs.version;
-    hash = "sha256-5SmV+V+B3GYDnuOH8abh+NzGTZpMId41ZrJ7Fr6cXZo=";
+    hash = "sha256-hTRgNqccwbXxpS4F+JD2h19N/U671NjCBEMiDp6Jbio=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/be/beszel/package.nix b/pkgs/by-name/be/beszel/package.nix
index 0fc4f4a10241..d9246f259450 100644
--- a/pkgs/by-name/be/beszel/package.nix
+++ b/pkgs/by-name/be/beszel/package.nix
@@ -1,7 +1,9 @@
 {
+  stdenv,
   buildGo126Module,
   lib,
   fetchFromGitHub,
+  fetchpatch,
   nix-update-script,
   buildNpmPackage,
   nixosTests,
@@ -53,7 +55,14 @@ buildGo126Module (finalAttrs: {
 
   vendorHash = "sha256-TVpZbK9V9/GqpVFcjF7QGD5XJJHzRgjVXZOImHQTR1k=";
 
-  tags = [ "testing" ];
+  patches = [
+    # https://github.com/NixOS/nixpkgs/pull/513197
+    (fetchpatch {
+      name = "fix-updater-after-system-manager-shutdown.patch";
+      url = "https://github.com/henrygd/beszel/commit/c538d1de1cf3f4664a2d98086341884a217846e7.patch";
+      hash = "sha256-voIT9b14pgfhnbJrqgoIbQtwZPU1JF0fblybjG9mzvM=";
+    })
+  ];
 
   preBuild = ''
     mkdir -p internal/site/dist
@@ -66,15 +75,33 @@ buildGo126Module (finalAttrs: {
         "TestCollectorStartHelpers/nvtop_collector"
         "TestApiRoutesAuthentication/GET_/update_-_shouldn't_exist_without_CHECK_UPDATES_env_var"
         "TestConfigSyncWithTokens"
+        # This subtest assumes enough host CPUs for an 8s CPU delta over 1s to stay below 100%.
+        "TestServiceUpdateCPUPercent/subsequent_call_calculates_CPU_percentage"
+      ]
+      ++ lib.optionals stdenv.hostPlatform.isDarwin [
+        "TestCollectorStartHelpers/nvidia-smi_collector"
+        "TestCollectorStartHelpers/rocm-smi_collector"
+        "TestCollectorStartHelpers/tegrastats_collector"
+        "TestNewGPUManagerPriorityNvtopFallback"
+        "TestNewGPUManagerPriorityMixedCollectors"
+        "TestNewGPUManagerPriorityNvmlFallbackToNvidiaSmi"
+        "TestNewGPUManagerConfiguredCollectorsMustStart"
+        "TestNewGPUManagerConfiguredNvmlBypassesCapabilityGate"
+        "TestNewGPUManagerJetsonIgnoresCollectorConfig"
       ];
     in
-    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+    [
+      "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$"
+      "-tags=testing"
+    ];
 
   postInstall = ''
     mv $out/bin/agent $out/bin/beszel-agent
     mv $out/bin/hub $out/bin/beszel-hub
   '';
 
+  __darwinAllowLocalNetworking = true;
+
   passthru = {
     updateScript = nix-update-script {
       extraArgs = [
diff --git a/pkgs/by-name/bo/bootdev-cli/package.nix b/pkgs/by-name/bo/bootdev-cli/package.nix
index c37839c316f4..bb4b00aaf762 100644
--- a/pkgs/by-name/bo/bootdev-cli/package.nix
+++ b/pkgs/by-name/bo/bootdev-cli/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "bootdev-cli";
-  version = "1.29.3";
+  version = "1.29.4";
 
   src = fetchFromGitHub {
     owner = "bootdotdev";
     repo = "bootdev";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6fdzSwCtJG8SFqInVsOc5EO4g9esMU/z9MYtou1ylFI=";
+    hash = "sha256-BU43XyK+5/YTI+61UGZSUPHmeWUIlal7sW6vgR5KCPg=";
   };
 
   vendorHash = "sha256-ZDioEU5uPCkd+kC83cLlpgzyOsnpj2S7N+lQgsQb8uY=";
diff --git a/pkgs/by-name/bu/buildkite-agent/package.nix b/pkgs/by-name/bu/buildkite-agent/package.nix
index 76f06d121c17..51d29d7f6d60 100644
--- a/pkgs/by-name/bu/buildkite-agent/package.nix
+++ b/pkgs/by-name/bu/buildkite-agent/package.nix
@@ -14,16 +14,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "buildkite-agent";
-  version = "3.126.0";
+  version = "3.127.0";
 
   src = fetchFromGitHub {
     owner = "buildkite";
     repo = "agent";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JkXWd8I66iQVx/L+qHH0MGcJ/1AtPRZ7bL7+/pqCky0=";
+    hash = "sha256-pFB36R3WESjljn1oeDvq+G6X26sFn6rbHR2Q0iLDzAc=";
   };
 
-  vendorHash = "sha256-p8Xfm+jql2tFihiETlCjZBsx6o5S8DwpHkkjKk6yCV8=";
+  vendorHash = "sha256-lS12eJhIIc0Vi8k4W+NmQFxXBbHSkO+gzcFA6yoYc3U=";
 
   postPatch = ''
     substituteInPlace clicommand/agent_start.go --replace /bin/bash ${bash}/bin/bash
diff --git a/pkgs/by-name/co/cockpit/package.nix b/pkgs/by-name/co/cockpit/package.nix
index 55d6fed592a4..de274ca95dc2 100644
--- a/pkgs/by-name/co/cockpit/package.nix
+++ b/pkgs/by-name/co/cockpit/package.nix
@@ -53,13 +53,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cockpit";
-  version = "361";
+  version = "362";
 
   src = fetchFromGitHub {
     owner = "cockpit-project";
     repo = "cockpit";
     tag = finalAttrs.version;
-    hash = "sha256-/OaFNUUz6W1du9b7esEz1VHtx7MEphbXhyybyWwPc2Y=";
+    hash = "sha256-Aos7jQ9T8q/ZYZZGXZrSQzTWXXIrAcu3OorJ/Utkq28=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/de/depthcharge-tools/package.nix b/pkgs/by-name/de/depthcharge-tools/package.nix
new file mode 100644
index 000000000000..48c7b1e3c9c2
--- /dev/null
+++ b/pkgs/by-name/de/depthcharge-tools/package.nix
@@ -0,0 +1,68 @@
+{
+  bzip2,
+  dtc,
+  fetchFromGitLab,
+  gzip,
+  lib,
+  lz4,
+  lzop,
+  makeWrapper,
+  nix-update-script,
+  python3Packages,
+  ubootTools,
+  vboot-utils,
+  xz,
+  zstd,
+}:
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "depthcharge-tools";
+  version = "0.6.4";
+  src = fetchFromGitLab {
+    domain = "gitlab.postmarketos.org";
+    owner = "postmarketOS";
+    repo = "depthcharge-tools";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-McnBtc0UpatKO4XBnMOHf2L8xxcrsRM/5DCbmAmfA1o=";
+  };
+
+  pyproject = true;
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  dependencies = with python3Packages; [
+    importlib-resources
+    importlib-metadata
+    packaging
+  ];
+
+  makeWrapperArgs = [
+    "--suffix"
+    "PATH"
+    ":"
+    "${lib.makeBinPath [
+      bzip2
+      dtc
+      gzip
+      lz4
+      lzop
+      ubootTools
+      vboot-utils
+      xz
+      zstd
+    ]}"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "Tools to manage the Chrome OS bootloader";
+    homepage = "https://gitlab.postmarketos.org/postmarketOS/depthcharge-tools";
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.ninelore ];
+    mainProgram = "depthchargectl";
+  };
+})
diff --git a/pkgs/by-name/de/devin-cli/package.nix b/pkgs/by-name/de/devin-cli/package.nix
new file mode 100644
index 000000000000..22fd3f640376
--- /dev/null
+++ b/pkgs/by-name/de/devin-cli/package.nix
@@ -0,0 +1,93 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  installShellFiles,
+  versionCheckHook,
+}:
+
+let
+  version = "2026.5.6-8";
+
+  throwSystem = throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}";
+
+  srcs = {
+    x86_64-linux = fetchurl {
+      url = "https://static.devin.ai/cli/${version}/devin-${version}-x86_64-unknown-linux.tar.gz";
+      hash = "sha256-kBHRIUiMwbFIGRCkNIOSST6fwEULs8yJu3cwHq2eyac=";
+    };
+
+    aarch64-linux = fetchurl {
+      url = "https://static.devin.ai/cli/${version}/devin-${version}-aarch64-unknown-linux.tar.gz";
+      hash = "sha256-3Kg90ec9Fdne/+OhfFV24JCoDWzwilrej3vRM52XRqI=";
+    };
+
+    aarch64-darwin = fetchurl {
+      url = "https://static.devin.ai/cli/${version}/devin-${version}-aarch64-apple-darwin.tar.gz";
+      hash = "sha256-nUb8yotP9cUrWeDw5kb+ZLZ5Ug2l7QTO6eQnYNaD9o4=";
+    };
+
+    x86_64-darwin = fetchurl {
+      url = "https://static.devin.ai/cli/${version}/devin-${version}-x86_64-apple-darwin.tar.gz";
+      hash = "sha256-CN03ZsVb1gyvFqAcVnjpT4VHB/mxnAQ2PhG8PwRZSrw=";
+    };
+  };
+
+  src = srcs.${stdenvNoCC.hostPlatform.system} or throwSystem;
+in
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "devin-cli";
+  inherit version;
+
+  outputs = [
+    "out"
+    "man"
+    "doc"
+  ];
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  inherit src;
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  dontConfigure = true;
+  dontStrip = true;
+  dontBuild = true;
+
+  doCheck = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    installBin ./bin/devin
+    installManPage ./share/man/man1/*.1
+
+    mkdir -p $out/share/doc
+
+    mv ./share/devin/docs/* $out/share/doc
+
+    runHook postInstall
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "Cognition's Devin Agent CLI";
+    homepage = "https://devin.ai/";
+    license = lib.licenses.unfree;
+    sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
+    maintainers = with lib.maintainers; [
+      ethancedwards8
+      nhshah15
+    ];
+    mainProgram = "devin";
+  };
+})
diff --git a/pkgs/by-name/de/devin-cli/update.sh b/pkgs/by-name/de/devin-cli/update.sh
new file mode 100755
index 000000000000..58a20b17911b
--- /dev/null
+++ b/pkgs/by-name/de/devin-cli/update.sh
@@ -0,0 +1,23 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bash nix-update common-updater-scripts nix jq
+
+set -euo pipefail
+
+currentVersion=$(nix-instantiate --eval -E "with import ./. {}; devin-cli.version or (lib.getVersion devin-cli)" | tr -d '"')
+latestVersion=$(curl https://static.devin.ai/cli/current/manifest.json | jq '.version' | tr -d '"')
+
+if [[ "$currentVersion" == "$latestVersion" ]]; then
+    echo "package is up-to-date: $currentVersion"
+    exit 0
+fi
+
+update-source-version devin-cli $latestVersion || true
+
+for system in \
+    x86_64-linux \
+    aarch64-linux \
+    x86_64-darwin \
+    aarch64-darwin; do
+    hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 $(nix-prefetch-url $(nix-instantiate --eval -E "with import ./. {}; devin-cli.src.url" --system "$system" | tr -d '"')))
+    update-source-version devin-cli $latestVersion $hash --system=$system --ignore-same-version
+done
diff --git a/pkgs/by-name/di/dinit/package.nix b/pkgs/by-name/di/dinit/package.nix
index 58645ab0607e..afa123963737 100644
--- a/pkgs/by-name/di/dinit/package.nix
+++ b/pkgs/by-name/di/dinit/package.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dinit";
-  version = "0.21.0";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "davmac314";
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
     postFetch = ''
       [ -f "$out/BUILD" ] && rm "$out/BUILD"
     '';
-    hash = "sha256-PkriMQrvmBCZsReATcHBkHu9AJQDSvjctPAifseuJGI=";
+    hash = "sha256-Axa993X17NdsNb+HwfzVzGGVTPVmdolNRxh3GfrpmBY=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/fa/fastdds/package.nix b/pkgs/by-name/fa/fastdds/package.nix
index e7dd650186de..d441c4cc9a12 100644
--- a/pkgs/by-name/fa/fastdds/package.nix
+++ b/pkgs/by-name/fa/fastdds/package.nix
@@ -15,14 +15,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fastdds";
-  version = "3.6.0";
+  version = "3.6.1";
 
   src = fetchFromGitHub {
     owner = "eProsima";
     repo = "Fast-DDS";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-r9ub7/ULkwVFM6Brz+rV+4yGxaGQAmpMW4xf6+jSAIQ=";
+    hash = "sha256-C9MKfQJ+8XsiSIYaB43j6xmoIyRH7h7sgEyzj1gml/8=";
   };
 
   nativeBuildInputs = [
@@ -58,6 +58,9 @@ stdenv.mkDerivation (finalAttrs: {
       protocol, which provides publisher-subscriber communications over unreliable transports
       such as UDP, as defined and maintained by the Object Management Group (OMG) consortium.
     '';
+    maintainers = with lib.maintainers; [
+      panicgh
+    ];
     platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/by-name/fn/fnm/package.nix b/pkgs/by-name/fn/fnm/package.nix
index 7eadcede4f41..0a2d8e73211b 100644
--- a/pkgs/by-name/fn/fnm/package.nix
+++ b/pkgs/by-name/fn/fnm/package.nix
@@ -8,18 +8,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "fnm";
-  version = "1.38.1";
+  version = "1.39.0";
 
   src = fetchFromGitHub {
     owner = "Schniz";
     repo = "fnm";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-WW+jWaClDn78Fw/xj6WvnEUlBI99HA5hQFUpwsYKmbI=";
+    sha256 = "sha256-sCPrHy1+hdv6schBxOP1+Y1hpag4/hdKPhG/PZhqKQA=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
 
-  cargoHash = "sha256-mxYTV3kNetIHB8XcvFdqp7t78E9EzMdMgD4ENIAYyec=";
+  cargoHash = "sha256-AVSphRupcncOmlIh4GXcPab2ePhS1jgaQLBKv2sRwuo=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/gi/git-wt/package.nix b/pkgs/by-name/gi/git-wt/package.nix
index 24d545dfd094..61aafed622ff 100644
--- a/pkgs/by-name/gi/git-wt/package.nix
+++ b/pkgs/by-name/gi/git-wt/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "git-wt";
-  version = "0.26.2";
+  version = "0.28.0";
 
   src = fetchFromGitHub {
     owner = "k1LoW";
     repo = "git-wt";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zAQxo9rgNq9L+NOMx4xS+h0oBGukZqfRg0Y3OYdelA0=";
+    hash = "sha256-JXPJlPAsbXXXN86ZB7PQNv31QZMiAn5DaYfHlnGWknc=";
   };
 
-  vendorHash = "sha256-stE3S6+ogv0bei6+eiyrR/fHMu+jizSEuL1NGakPszU=";
+  vendorHash = "sha256-KYE9v+aSWprovDXXhWWmftLQCrH7QtjUYjnGK5m9s9Y=";
 
   nativeCheckInputs = [ git ];
 
diff --git a/pkgs/by-name/gu/gurk-rs/package.nix b/pkgs/by-name/gu/gurk-rs/package.nix
index 4449ee7fcfef..7b5aa0889746 100644
--- a/pkgs/by-name/gu/gurk-rs/package.nix
+++ b/pkgs/by-name/gu/gurk-rs/package.nix
@@ -14,20 +14,20 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gurk-rs";
-  version = "0.9.1";
+  version = "0.9.3";
 
   src = fetchFromGitHub {
     owner = "boxdot";
     repo = "gurk-rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qgAQsQKAOPJrDgqwY6cwP0EruByhsQnQAQsmGZ1C5P4=";
+    hash = "sha256-tIR2HJAqpWewsQeD5kYriPCsGJci++LYDbmazqoQ/L0=";
   };
 
   postPatch = ''
     rm .cargo/config.toml
   '';
 
-  cargoHash = "sha256-O5R93pVG8mCrmuhebJ6Csn5CqdlFIIo00GEIT1QARbs=";
+  cargoHash = "sha256-gmuQxqDsO4mqLYsv9ahVAfxRu7IJAG47jFNRksC/kfI=";
 
   nativeBuildInputs = [
     protobuf
diff --git a/pkgs/by-name/ip/ipp-usb/package.nix b/pkgs/by-name/ip/ipp-usb/package.nix
index 19c0be1364f4..ceb73e3fe488 100644
--- a/pkgs/by-name/ip/ipp-usb/package.nix
+++ b/pkgs/by-name/ip/ipp-usb/package.nix
@@ -23,7 +23,8 @@ buildGoModule (finalAttrs: {
     rm ipp-usb.8
     substituteInPlace Makefile \
       --replace-fail "install: all" "install: man" \
-      --replace-fail "/usr/" "/"
+      --replace-fail "/usr/" "/" \
+      --replace-fail "install -s" "install" # Nix already strips binaries in $out/sbin, this also fixes cross
     substituteInPlace systemd-udev/ipp-usb.service --replace-fail "/sbin" "$out/bin"
     for i in paths.go ipp-usb.8.md; do
       substituteInPlace $i --replace-fail "/usr" "$out"
diff --git a/pkgs/by-name/jo/john/package.nix b/pkgs/by-name/jo/john/package.nix
index c3270044195f..3ce8d1cc4e7c 100644
--- a/pkgs/by-name/jo/john/package.nix
+++ b/pkgs/by-name/jo/john/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  unstableGitUpdater,
   openssl,
   nss,
   nspr,
@@ -25,13 +26,13 @@
 
 stdenv.mkDerivation {
   pname = "john";
-  version = "rolling-2604";
+  version = "1.9.0-Jumbo-1-unstable-2026-04-13";
 
   src = fetchFromGitHub {
     owner = "openwall";
     repo = "john";
     rev = "f514ece8ec4ae5e38ad75aaa322eac86d73dcd76";
-    hash = "sha256-Fzt9KnMFBTdPpQMSlXe/zG9LMylAZnC6uzU4yJ6HSUk=";
+    hash = "sha256-zO1/KUJe3LvYCGlwVpNg5uDwPRD0ql/7anErb7tywC0=";
   };
 
   patches = lib.optionals withOpenCL [
@@ -40,9 +41,6 @@ stdenv.mkDerivation {
     })
   ];
 
-  # Fix build with gcc 15
-  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
-
   postPatch = ''
     sed -ri -e '
       s!^(#define\s+CFG_[A-Z]+_NAME\s+).*/!\1"'"$out"'/etc/john/!
@@ -109,9 +107,7 @@ stdenv.mkDerivation {
     ]);
   # TODO: Get dependencies for radius2john.pl and lion2john-alt.pl
 
-  # gcc -DAC_BUILT -Wall vncpcap2john.o memdbg.o -g    -lpcap -fopenmp -o ../run/vncpcap2john
-  # gcc: error: memdbg.o: No such file or directory
-  enableParallelBuilding = false;
+  enableParallelBuilding = true;
 
   postInstall = ''
     mkdir -p "$out/bin" "$out/etc/john" "$out/share/john" "$out/share/doc/john" "$out/share/john/rules" "$out/share/john/opencl" "$out/${perlPackages.perl.libPrefix}"
@@ -133,6 +129,10 @@ stdenv.mkDerivation {
     done
   '';
 
+  passthru.updateScript = unstableGitUpdater {
+    tagFormat = "[0-9].*";
+  };
+
   meta = {
     description = "John the Ripper password cracker";
     license = [
diff --git a/pkgs/by-name/jo/jolt-tui/package.nix b/pkgs/by-name/jo/jolt-tui/package.nix
new file mode 100644
index 000000000000..3202e8d4ba1e
--- /dev/null
+++ b/pkgs/by-name/jo/jolt-tui/package.nix
@@ -0,0 +1,40 @@
+{
+  fetchFromGitHub,
+  lib,
+  pkg-config,
+  rustPlatform,
+  versionCheckHook,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "jolt-tui";
+  version = "1.2.0";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "jordond";
+    repo = "jolt";
+    tag = finalAttrs.version;
+    hash = "sha256-A8X06Y7Ujl2rN4+op6ixbWaL4Tx9Toj6+jSgRhRcDRM=";
+  };
+
+  cargoHash = "sha256-5SKyKTQXqcRsmvyHfq4i7RcGiL+3lENcEXU1FgTGsek=";
+
+  cargoBuildFlags = [ "--package=jolt-tui" ];
+
+  nativeBuildInputs = [ pkg-config ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  meta = {
+    description = "Terminal-based battery and energy monitor";
+    homepage = "https://getjolt.sh";
+    changelog = "https://github.com/jordond/jolt/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.mit;
+    mainProgram = "jolt";
+    maintainers = with lib.maintainers; [ EpicEric ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
+})
diff --git a/pkgs/by-name/ma/mautrix-whatsapp/package.nix b/pkgs/by-name/ma/mautrix-whatsapp/package.nix
index 75fac601f4e5..3863bf8b3541 100644
--- a/pkgs/by-name/ma/mautrix-whatsapp/package.nix
+++ b/pkgs/by-name/ma/mautrix-whatsapp/package.nix
@@ -14,20 +14,20 @@
 
 buildGoModule rec {
   pname = "mautrix-whatsapp";
-  version = "26.04";
-  tag = "v0.2604.0";
+  version = "26.05";
+  tag = "v0.2605.0";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "whatsapp";
     inherit tag;
-    hash = "sha256-y5oApQXQBy+ksU/03RxixBlmv+qNaKyJvgFQVfurIBs=";
+    hash = "sha256-WlVfGQoP9e/wl98hUJei8O2JMcOKijoEY8XuU/z69Qk=";
   };
 
   buildInputs = lib.optional (!withGoolm) olm;
   tags = lib.optional withGoolm "goolm";
 
-  vendorHash = "sha256-idjQryuyPCrCoaebJ7itAwUrGRpg9rWkOVK/GY/CBkg=";
+  vendorHash = "sha256-Hi/dZHJHoTTCnxLXgbkcYzuzis4fl5kxb5wMd9fKTY8=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/mu/musescore/package.nix b/pkgs/by-name/mu/musescore/package.nix
index 225878b43fea..367fc7cedc99 100644
--- a/pkgs/by-name/mu/musescore/package.nix
+++ b/pkgs/by-name/mu/musescore/package.nix
@@ -1,17 +1,19 @@
 {
-  stdenv,
   lib,
+  stdenv,
   fetchFromGitHub,
-  fetchpatch,
+
+  # nativeBuildInputs
   cmake,
   wrapGAppsHook3,
   pkg-config,
   ninja,
+
+  # buildInputs
   alsa-lib,
   alsa-plugins,
   freetype,
   libjack2,
-  lame,
   libogg,
   libpulseaudio,
   libsndfile,
@@ -21,40 +23,46 @@
   flac,
   libopusenc,
   libopus,
-  tinyxml-2,
+  mnxdom,
   kdePackages,
+
+  # passthru tests
   nixosTests,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "musescore";
-  version = "4.6.5";
+  version = "4.7.0";
 
   src = fetchFromGitHub {
     owner = "musescore";
     repo = "MuseScore";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lfgf09gLeoiXc0xsJvvKAnSJUjy/L2Fdis/9SNjb1KM=";
+    hash = "sha256-AEYZWkcjqB2pW+oBow2oMX1HQn4kRaTBBxhyxIbG0a4=";
   };
 
   cmakeFlags = [
-    "-DMUSE_APP_BUILD_MODE=release"
+    (lib.cmakeFeature "MUSE_APP_BUILD_MODE" "release")
     # Disable the build and usage of the `/bin/crashpad_handler` utility - it's
     # not useful on NixOS, see:
     # https://github.com/musescore/MuseScore/issues/15571
-    "-DMUSE_MODULE_DIAGNOSTICS_CRASHPAD_CLIENT=OFF"
-    # Use our versions of system libraries
-    "-DMUE_COMPILE_USE_SYSTEM_FREETYPE=ON"
-    "-DMUE_COMPILE_USE_SYSTEM_HARFBUZZ=ON"
-    "-DMUE_COMPILE_USE_SYSTEM_TINYXML=ON"
-    # Implies also -DMUE_COMPILE_USE_SYSTEM_OPUS=ON
-    "-DMUE_COMPILE_USE_SYSTEM_OPUSENC=ON"
-    "-DMUE_COMPILE_USE_SYSTEM_FLAC=ON"
-    # Don't bundle qt qml files, relevant really only for darwin, but we set
-    # this for all platforms anyway.
-    "-DMUE_COMPILE_INSTALL_QTQML_FILES=OFF"
+    (lib.cmakeBool "MUSE_MODULE_DIAGNOSTICS_CRASHPAD_CLIENT" false)
     # Don't build unit tests unless we are going to run them.
     (lib.cmakeBool "MUSE_ENABLE_UNIT_TESTS" finalAttrs.finalPackage.doCheck)
+  ]
+  # Use our versions of system libraries, see:
+  # https://github.com/musescore/MuseScore/issues/11572
+  ++ map (l: lib.cmakeBool "MUE_COMPILE_USE_SYSTEM_${l}" true) [
+    "FREETYPE"
+    "HARFBUZZ"
+    "MNXDOM"
+    # Implies also OPUS
+    "OPUSENC"
+    "FLAC"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # https://github.com/musescore/MuseScore/issues/33467
+    (lib.cmakeBool "MUE_BUILD_MACOS_INTEGRATION" false)
   ];
 
   qtWrapperArgs = [
@@ -94,7 +102,6 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     libjack2
     freetype
-    lame
     libogg
     libpulseaudio
     libsndfile
@@ -104,7 +111,7 @@ stdenv.mkDerivation (finalAttrs: {
     flac
     libopusenc
     libopus
-    tinyxml-2
+    mnxdom
     kdePackages.qtbase
     kdePackages.qtdeclarative
     kdePackages.qt5compat
diff --git a/pkgs/by-name/na/nats-server/package.nix b/pkgs/by-name/na/nats-server/package.nix
index 33fdbf837a49..f2ac5a94bf0c 100644
--- a/pkgs/by-name/na/nats-server/package.nix
+++ b/pkgs/by-name/na/nats-server/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "nats-server";
-  version = "2.14.0";
+  version = "2.14.1";
 
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = "nats-server";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-S4IbxeiagiAXHidXBXniHKEUGnYaPWoGFNk2DPOkSNo=";
+    hash = "sha256-SvgOts4bI60vKVDw5IZzn3PIoXVXk3sysqDf3doJ164=";
   };
 
-  vendorHash = "sha256-oEYc8cT6OUQ7imbfDskIxnSNhHWpvSpMCxPdS6O2oZA=";
+  vendorHash = "sha256-/tmb8bd89+BWmbt6mJyRiFPvFSRMoU6eXr4WnWS0oog=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/op/openbao/package.nix b/pkgs/by-name/op/openbao/package.nix
index 224c4117a7ea..747948b388ad 100644
--- a/pkgs/by-name/op/openbao/package.nix
+++ b/pkgs/by-name/op/openbao/package.nix
@@ -14,16 +14,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "openbao";
-  version = "2.5.3";
+  version = "2.5.4";
 
   src = fetchFromGitHub {
     owner = "openbao";
     repo = "openbao";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VpW27vWKtqabJiNxuyx3PGDThHF6MOlxxfzD1UksX6I=";
+    hash = "sha256-Gf/2/3XLzCnmU8hJfctUra6mamBsH/4QEiC89FolKQ4=";
   };
 
-  vendorHash = "sha256-imP8GJjm8udJ1RXfGhVJX7YZ9J47p/vdKjKjMfMgTXA=";
+  vendorHash = "sha256-TPBKqIa9ZkxqXbMXSY4tuVne4ed19tzZp7+LvH0to9M=";
 
   proxyVendor = true;
 
diff --git a/pkgs/by-name/op/openbox/package.nix b/pkgs/by-name/op/openbox/package.nix
index eb82b79eaa8f..b97a3d11a314 100644
--- a/pkgs/by-name/op/openbox/package.nix
+++ b/pkgs/by-name/op/openbox/package.nix
@@ -93,6 +93,9 @@ stdenv.mkDerivation (finalAttrs: {
     wrapProgram "$out/bin/openbox-gnome-session" --prefix XDG_DATA_DIRS : "$out/share"
     wrapProgram "$out/bin/openbox-kde-session" --prefix XDG_DATA_DIRS : "$out/share"
     wrapPythonProgramsIn "$out/libexec" "$out ''${pythonPath[*]}"
+
+    substituteInPlace "$out/libexec/openbox-autostart" \
+      --replace-fail "$out/etc/xdg/openbox/autostart" "/etc/xdg/openbox/autostart"
   '';
 
   doInstallCheck = true;
diff --git a/pkgs/by-name/ox/oxidized/Gemfile.lock b/pkgs/by-name/ox/oxidized/Gemfile.lock
index 43fc4cf335aa..341165ab0474 100644
--- a/pkgs/by-name/ox/oxidized/Gemfile.lock
+++ b/pkgs/by-name/ox/oxidized/Gemfile.lock
@@ -3,24 +3,23 @@ GEM
   specs:
     asetus (0.4.0)
     base64 (0.3.0)
-    bcrypt_pbkdf (1.1.1)
+    bcrypt_pbkdf (1.1.2)
     charlock_holmes (0.7.9)
-    concurrent-ruby (1.3.5)
-    date (3.4.1)
+    concurrent-ruby (1.3.6)
+    date (3.5.1)
     ed25519 (1.4.0)
     emk-sinatra-url-for (0.2.1)
       sinatra (>= 0.9.1.1)
-    haml (6.3.0)
+    haml (6.4.0)
       temple (>= 0.8.2)
       thor
       tilt
-    htmlentities (4.3.4)
-    json (2.13.2)
+    htmlentities (4.4.2)
+    json (2.19.5)
     logger (1.7.0)
-    multi_json (1.17.0)
-    mustermann (3.0.4)
-      ruby2_keywords (~> 0.0.1)
-    net-ftp (0.3.8)
+    multi_json (1.21.1)
+    mustermann (3.1.1)
+    net-ftp (0.3.9)
       net-protocol
       time
     net-http-digest_auth (1.4.1)
@@ -28,9 +27,9 @@ GEM
       timeout
     net-scp (4.1.0)
       net-ssh (>= 2.6.5, < 8.0.0)
-    net-ssh (7.3.0)
+    net-ssh (7.3.2)
     net-telnet (0.2.0)
-    nio4r (2.7.4)
+    nio4r (2.7.5)
     oxidized (0.36.0)
       asetus (~> 0.4)
       bcrypt_pbkdf (~> 1.0)
@@ -58,47 +57,46 @@ GEM
       puma (>= 6.6, < 8)
       sinatra (~> 4.1)
       sinatra-contrib (~> 4.1)
-    psych (5.2.6)
+    psych (5.3.1)
       date
       stringio
-    puma (6.6.1)
+    puma (7.2.0)
       nio4r (~> 2.0)
-    rack (3.2.0)
-    rack-protection (4.1.1)
+    rack (3.2.6)
+    rack-protection (4.2.1)
       base64 (>= 0.1.0)
       logger (>= 1.6.0)
       rack (>= 3.0.0, < 4)
-    rack-session (2.1.1)
+    rack-session (2.1.2)
       base64 (>= 0.1.0)
       rack (>= 3.0.0)
-    ruby2_keywords (0.0.5)
     rugged (1.9.0)
-    semantic_logger (4.17.0)
+    semantic_logger (4.18.0)
       concurrent-ruby (~> 1.0)
-    sinatra (4.1.1)
+    sinatra (4.2.1)
       logger (>= 1.6.0)
       mustermann (~> 3.0)
       rack (>= 3.0.0, < 4)
-      rack-protection (= 4.1.1)
+      rack-protection (= 4.2.1)
       rack-session (>= 2.0.0, < 3)
       tilt (~> 2.0)
-    sinatra-contrib (4.1.1)
+    sinatra-contrib (4.2.1)
       multi_json (>= 0.0.2)
       mustermann (~> 3.0)
-      rack-protection (= 4.1.1)
-      sinatra (= 4.1.1)
+      rack-protection (= 4.2.1)
+      sinatra (= 4.2.1)
       tilt (~> 2.0)
     slop (4.10.1)
-    stringio (3.1.7)
-    syslog (0.3.0)
+    stringio (3.2.0)
+    syslog (0.4.0)
       logger
     syslog_protocol (0.9.2)
     temple (0.10.4)
-    thor (1.4.0)
-    tilt (2.6.1)
-    time (0.4.1)
+    thor (1.5.0)
+    tilt (2.7.0)
+    time (0.4.2)
       date
-    timeout (0.4.3)
+    timeout (0.6.1)
 
 PLATFORMS
   ruby
@@ -111,4 +109,4 @@ DEPENDENCIES
   psych (~> 5.0)
 
 BUNDLED WITH
-   2.6.6
+   2.7.2
diff --git a/pkgs/by-name/ox/oxidized/gemset.nix b/pkgs/by-name/ox/oxidized/gemset.nix
index 57c52043065f..7b6c788c2278 100644
--- a/pkgs/by-name/ox/oxidized/gemset.nix
+++ b/pkgs/by-name/ox/oxidized/gemset.nix
@@ -24,10 +24,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "04rb3rp9bdxn1y3qiflfpj7ccwb8ghrfbydh5vfz1l9px3fpg41g";
+      sha256 = "1xjcp484qc4j4z42b087npgj50sd6yixchznp4z9p1k6rqilqhf2";
       type = "gem";
     };
-    version = "1.1.1";
+    version = "1.1.2";
   };
   charlock_holmes = {
     groups = [ "default" ];
@@ -44,20 +44,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1ipbrgvf0pp6zxdk5ascp6i29aybz2bx9wdrlchjmpx6mhvkwfw1";
+      sha256 = "1aymcakhzl83k77g2f2krz07bg1cbafbcd2ghvwr4lky3rz86mkb";
       type = "gem";
     };
-    version = "1.3.5";
+    version = "1.3.6";
   };
   date = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0kz6mc4b9m49iaans6cbx031j9y7ldghpi5fzsdh0n3ixwa8w9mz";
+      sha256 = "1h0db8r2v5llxdbzkzyllkfniqw9gm092qn7cbaib73v9lw0c3bm";
       type = "gem";
     };
-    version = "3.4.1";
+    version = "3.5.1";
   };
   ed25519 = {
     groups = [ "default" ];
@@ -90,30 +90,30 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "15yxph91zswbnfy7szpdcfbdfqqn595ff290hm4f6fcnhryvhvlf";
+      sha256 = "0sngjyk3gmgsvrf1m3p7qhpyh1yh390zzs18wcxrmb2jpr90dqmj";
       type = "gem";
     };
-    version = "6.3.0";
+    version = "6.4.0";
   };
   htmlentities = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1nkklqsn8ir8wizzlakncfv42i32wc0w9hxp00hvdlgjr7376nhj";
+      sha256 = "1hy5jvzd4wagk0k0yq7bjm6fa7ba7vjggzjfpri95jifkzvbvbxv";
       type = "gem";
     };
-    version = "4.3.4";
+    version = "4.4.2";
   };
   json = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0s5vklcy2fgdxa9c6da34jbfrqq7xs6mryjglqqb5iilshcg3q82";
+      sha256 = "0n9ch455pnvl9vxs2f3j77bpdmxg5g3mn3vyr9wxa0a87raii2i1";
       type = "gem";
     };
-    version = "2.13.2";
+    version = "2.19.5";
   };
   logger = {
     groups = [ "default" ];
@@ -130,21 +130,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "06sabsvnw0x1aqdcswc6bqrqz6705548bfd8z22jxgxfjrn1yn3n";
+      sha256 = "1040lr5y2phn7avdyam6zw6ikprlmk77biw3yhclsfwfh0qnl4p6";
       type = "gem";
     };
-    version = "1.17.0";
+    version = "1.21.1";
   };
   mustermann = {
-    dependencies = [ "ruby2_keywords" ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "08ma2fmxlm6i7lih4mc3har2fzsbj1pl4hhva65kljf6nfvdryl5";
+      sha256 = "163i29mdcr1h0nximk3d51a1fgp7vz3sfasn8p1rjm2d4g3p0qac";
       type = "gem";
     };
-    version = "3.0.4";
+    version = "3.1.1";
   };
   net-ftp = {
     dependencies = [
@@ -155,10 +154,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0kw7g0j35fla8438s90m72b3xr0mqnpgm910qcwrgnvyg903xmi8";
+      sha256 = "0r9vn7q6c66y4iw048qdbqviv7bankdkcziz12fzfa7lyz61fy1h";
       type = "gem";
     };
-    version = "0.3.8";
+    version = "0.3.9";
   };
   net-http-digest_auth = {
     groups = [ "default" ];
@@ -197,10 +196,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1w1ypxa3n6mskkwb00b489314km19l61p5h3bar6zr8cng27c80p";
+      sha256 = "1m1d6rs40rjvdb6df34fi3za1c2ajdiydv4jzpjj03iq7hhrw0k5";
       type = "gem";
     };
-    version = "7.3.0";
+    version = "7.3.2";
   };
   net-telnet = {
     groups = [ "default" ];
@@ -217,10 +216,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1a9www524fl1ykspznz54i0phfqya4x45hqaz67in9dvw1lfwpfr";
+      sha256 = "18fwy5yqnvgixq3cn0h63lm8jaxsjjxkmj8rhiv8wpzv9271d43c";
       type = "gem";
     };
-    version = "2.7.4";
+    version = "2.7.5";
   };
   oxidized = {
     dependencies = [
@@ -291,10 +290,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0vii1xc7x81hicdbp7dlllhmbw5w3jy20shj696n0vfbbnm2hhw1";
+      sha256 = "0x0r3gc66abv8i4dw0x0370b5hrshjfp6kpp7wbp178cy775fypb";
       type = "gem";
     };
-    version = "5.2.6";
+    version = "5.3.1";
   };
   puma = {
     dependencies = [ "nio4r" ];
@@ -302,20 +301,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "07pajhv7pqz82kcjc6017y4d0hwz5kp746cydpx1npd79r56xddr";
+      sha256 = "1a3jd9qakasizrf7dkq5mqv51fjf02r2chybai2nskjaa6mz93mz";
       type = "gem";
     };
-    version = "6.6.1";
+    version = "7.2.0";
   };
   rack = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "04inzfa1psgl8mywgzaks31am1zh00lyc0mf3zb5jv399m8j3kbr";
+      sha256 = "1hhjy9gcp52dzij05gmidqac8g28ski5xm67prwmdqmjfcgqxmsy";
       type = "gem";
     };
-    version = "3.2.0";
+    version = "3.2.6";
   };
   rack-protection = {
     dependencies = [
@@ -327,10 +326,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0sniswjyi0yn949l776h7f67rvx5w9f04wh69z5g19vlsnjm98ji";
+      sha256 = "1b4bamcbpk29i7jvly3i7ayfj69yc1g03gm4s7jgamccvx12hvng";
       type = "gem";
     };
-    version = "4.1.1";
+    version = "4.2.1";
   };
   rack-session = {
     dependencies = [
@@ -341,20 +340,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1sg4laz2qmllxh1c5sqlj9n1r7scdn08p3m4b0zmhjvyx9yw0v8b";
+      sha256 = "1s7zcxlmg88a6dam4aqbgk9xkpy6dkdfqmmcszkkliy3q3w38m2r";
       type = "gem";
     };
-    version = "2.1.1";
-  };
-  ruby2_keywords = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1vz322p8n39hz3b4a9gkmz9y7a5jaz41zrm2ywf31dvkqm03glgz";
-      type = "gem";
-    };
-    version = "0.0.5";
+    version = "2.1.2";
   };
   rugged = {
     groups = [ "default" ];
@@ -372,10 +361,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1s9hs743a8wkqxwpfddsgwlf8ikc9y6n882gpli2xgkab7c60jy5";
+      sha256 = "12xdvql7ipy4vdwg7v15npyy4vv2ckaq0giqrql4d11xns0483mh";
       type = "gem";
     };
-    version = "4.17.0";
+    version = "4.18.0";
   };
   sinatra = {
     dependencies = [
@@ -390,10 +379,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "002dkzdc1xqhvz5sdnj4vb0apczhs07mnpgq4kkd5dd1ka2pp6af";
+      sha256 = "103h6wjpcqp3i034hi44za2v365yz7qk9s5df8lmasq43nqvkbmp";
       type = "gem";
     };
-    version = "4.1.1";
+    version = "4.2.1";
   };
   sinatra-contrib = {
     dependencies = [
@@ -407,10 +396,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1giziwf8mgki581jf40zzw3dhjkkmdg3yxbrahj9krd5h24vb90y";
+      sha256 = "0jkbsaika8pr9bc90ag3wqrhbgiy7h5a93k11j8sls6j8k4r3l0h";
       type = "gem";
     };
-    version = "4.1.1";
+    version = "4.2.1";
   };
   slop = {
     groups = [ "default" ];
@@ -427,10 +416,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1yh78pg6lm28c3k0pfd2ipskii1fsraq46m6zjs5yc9a4k5vfy2v";
+      sha256 = "1q92y9627yisykyscv0bdsrrgyaajc2qr56dwlzx7ysgigjv4z63";
       type = "gem";
     };
-    version = "3.1.7";
+    version = "3.2.0";
   };
   syslog = {
     dependencies = [ "logger" ];
@@ -438,10 +427,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "023lbh48fcn72gwyh1x52ycs1wx1bnhdajmv0qvkidmdsmxnxzjd";
+      sha256 = "0wklh86rhpiff34ja0hda5pwdfywybjvb50hqhz90wpyhblqmhy4";
       type = "gem";
     };
-    version = "0.3.0";
+    version = "0.4.0";
   };
   syslog_protocol = {
     groups = [ "default" ];
@@ -468,20 +457,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0gcarlmpfbmqnjvwfz44gdjhcmm634di7plcx2zdgwdhrhifhqw7";
+      sha256 = "0wsy88vg2mazl039392hqrcwvs5nb9kq8jhhrrclir2px1gybag3";
       type = "gem";
     };
-    version = "1.4.0";
+    version = "1.5.0";
   };
   tilt = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0w27v04d7rnxjr3f65w1m7xyvr6ch6szjj2v5wv1wz6z5ax9pa9m";
+      sha256 = "1cvaikq1dcbfl008i16c1pi1gmdax7vfkvmhch64jdkakyk9nnqd";
       type = "gem";
     };
-    version = "2.6.1";
+    version = "2.7.0";
   };
   time = {
     dependencies = [ "date" ];
@@ -489,19 +478,19 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0qgarmdyqypzsaanf4w9vqrd9axrcrjqilxwrfmxp954102kcpq3";
+      sha256 = "1arxpii25xgb3fkgqp5acyc0x6179j3qzld78lflgsdxqfcf897k";
       type = "gem";
     };
-    version = "0.4.1";
+    version = "0.4.2";
   };
   timeout = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "03p31w5ghqfsbz5mcjzvwgkw3h9lbvbknqvrdliy8pxmn9wz02cm";
+      sha256 = "1jxcji88mh6xsqz0mfzwnxczpg7cyniph7wpavnavfz7lxl77xbq";
       type = "gem";
     };
-    version = "0.4.3";
+    version = "0.6.1";
   };
 }
diff --git a/pkgs/by-name/pa/paretosecurity/package.nix b/pkgs/by-name/pa/paretosecurity/package.nix
index b0a71805a2cd..3a6a96561c62 100644
--- a/pkgs/by-name/pa/paretosecurity/package.nix
+++ b/pkgs/by-name/pa/paretosecurity/package.nix
@@ -17,16 +17,16 @@ buildGoModule (finalAttrs: {
     webkitgtk_4_1
   ];
   pname = "paretosecurity";
-  version = "0.3.16";
+  version = "0.3.18";
 
   src = fetchFromGitHub {
     owner = "ParetoSecurity";
     repo = "agent";
     rev = finalAttrs.version;
-    hash = "sha256-93+8r7GOdaQ5HnPEvJ0L2DDStHT6HvH1tuDsCSoDU0E=";
+    hash = "sha256-BJeTnApZya8+wdmKScadHqh49/cTs2+6owh/J1+62Ac=";
   };
 
-  vendorHash = "sha256-jAcUf4VjtKB/Q2wHOVnCgcmPp5XNMqV8Ei9kpWoGO4Q=";
+  vendorHash = "sha256-tQkiAVrV1Tjv1VlBJWtfP9vBiiK845EBqM7QvJVsVB8=";
   proxyVendor = true;
 
   # Skip building the Windows installer
diff --git a/pkgs/by-name/pr/prow/package.nix b/pkgs/by-name/pr/prow/package.nix
index 219853b211b4..7330818c90d3 100644
--- a/pkgs/by-name/pr/prow/package.nix
+++ b/pkgs/by-name/pr/prow/package.nix
@@ -8,18 +8,18 @@
 
 buildGoModule rec {
   pname = "prow";
-  version = "0-unstable-2026-03-04";
-  rev = "f92e22b4dc861f76dc2b686855274fb91ed55537";
+  version = "0-unstable-2026-05-19";
+  rev = "32fe11af9437baf705c1a232e7a2ffbc78b042ac";
 
   src = fetchFromGitHub {
     inherit rev;
 
     owner = "kubernetes-sigs";
     repo = "prow";
-    hash = "sha256-zZgb6gQdj+5vLDRkveKzWrGiwQ2tdMfr3kJSvbTBLyw=";
+    hash = "sha256-X414GUPK81i6cO/YVatn8P7TVxtRuIYCMJ2i/MFLY8g=";
   };
 
-  vendorHash = "sha256-Pv9LznRh7Nzm74gMKT2Q/VLIMIIc93en0qX6YA6TwK4=";
+  vendorHash = "sha256-xFGvUkA1KTjHQ3kBw8PaDGG0gxSIhO1awM2PFFDgrMo=";
 
   # doCheck = false;
 
diff --git a/pkgs/by-name/pu/pulldown-cmark/package.nix b/pkgs/by-name/pu/pulldown-cmark/package.nix
index a1b07d550964..a9f32bfc446b 100644
--- a/pkgs/by-name/pu/pulldown-cmark/package.nix
+++ b/pkgs/by-name/pu/pulldown-cmark/package.nix
@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "pulldown-cmark";
-  version = "0.13.3";
+  version = "0.13.4";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-TeNF8Fgfo9m/TEAXBogzioSEVkY5lKOBm33HELk+WZE=";
+    hash = "sha256-XMKUFbPsYhYIxMxEvUJT38Jr03lzy9afRqe6tIj9lls=";
   };
 
-  cargoHash = "sha256-i0mQvxtDKrU3hXe5LGMygELBVnMhtRytSPDA9u+49mI=";
+  cargoHash = "sha256-JgGvRSUE6UXf0pSl6x6SC7gGgTEoq2E3t0tPrueuIEE=";
 
   meta = {
     description = "Pull parser for CommonMark written in Rust";
diff --git a/pkgs/by-name/pv/pvetui/package.nix b/pkgs/by-name/pv/pvetui/package.nix
new file mode 100644
index 000000000000..44f67fd7290a
--- /dev/null
+++ b/pkgs/by-name/pv/pvetui/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "pvetui";
+  version = "1.3.2";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "devnullvoid";
+    repo = "pvetui";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-PgxhfDFP0DBrihtkIWFYEOTbXUvp/WuB47iNPHJGr1Q=";
+  };
+
+  vendorHash = "sha256-gGhEW9owJYjI+59X/yJ+tta9AQh9hoBdOBaO5Rojdy8=";
+
+  subPackages = [ "cmd/pvetui" ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/devnullvoid/pvetui/internal/version.version=${finalAttrs.version}"
+    "-X github.com/devnullvoid/pvetui/internal/version.commit=${finalAttrs.src.tag}"
+    "-X github.com/devnullvoid/pvetui/internal/version.buildDate=1970-01-01T00:00:00Z"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Terminal UI for Proxmox Virtual Environment";
+    homepage = "https://pvetui.org/";
+    changelog = "https://github.com/devnullvoid/pvetui/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ miniharinn ];
+    mainProgram = "pvetui";
+  };
+})
diff --git a/pkgs/by-name/rt/rtg-tools/package.nix b/pkgs/by-name/rt/rtg-tools/package.nix
index 226cdc1d4bd7..8cf9eee5e190 100644
--- a/pkgs/by-name/rt/rtg-tools/package.nix
+++ b/pkgs/by-name/rt/rtg-tools/package.nix
@@ -52,9 +52,10 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail awk ${lib.getExe gawk} \
       --replace-fail "hostname -s" "${lib.getExe hostname} -s" \
       --replace-fail dirname ${lib.getExe' coreutils "dirname"} \
-      --replace-fail readlink ${lib.getExe' coreutils "readlink"}
+      --replace-fail readlink ${lib.getExe' coreutils "readlink"} \
+      --replace-fail cat ${lib.getExe' coreutils "cat"}
 
-    sed -i '/USER_JAVA_OPTS=$RTG_JAVA_OPTS/a mkdir -p $HOME/.config/rtg-tools'  installer/rtg
+    sed -i '/# Now write the selection to local config/i mkdir -p $HOME/.config/rtg-tools' installer/rtg
   '';
 
   checkPhase = ''
diff --git a/pkgs/by-name/ru/rustical/package.nix b/pkgs/by-name/ru/rustical/package.nix
index 8f5c48fb564e..07f244b5b22e 100644
--- a/pkgs/by-name/ru/rustical/package.nix
+++ b/pkgs/by-name/ru/rustical/package.nix
@@ -4,27 +4,31 @@
   fetchFromGitHub,
   pkg-config,
   openssl,
+  cacert,
   nixosTests,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rustical";
-  version = "0.12.13";
+  version = "0.12.15";
 
   src = fetchFromGitHub {
     owner = "lennart-k";
     repo = "rustical";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-A6b4iWPVu/HrBtzNMS7rTann75EOwbegjhNQ0amOEXg=";
+    hash = "sha256-ll7CFxYpzseYstBLe60VhYgvCYtobWeZ9/trBPTCSMg=";
   };
 
-  cargoHash = "sha256-Pbx3o8+/egm5xzPlRH2lF+ja7Sibv+F1NtCpYXiO1hU=";
+  cargoHash = "sha256-eqY5xzlPOlGSqqegTWTHeLR+YJb9l52Ku2yGVfflQkk=";
 
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ openssl ];
 
-  env.OPENSSL_NO_VENDOR = true;
+  env = {
+    OPENSSL_NO_VENDOR = true;
+    SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
+  };
 
   passthru.tests = {
     inherit (nixosTests) rustical;
diff --git a/pkgs/by-name/tf/tf/package.nix b/pkgs/by-name/tf/tf/package.nix
index d028675ecd6d..66892f09258b 100644
--- a/pkgs/by-name/tf/tf/package.nix
+++ b/pkgs/by-name/tf/tf/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "tf";
-  version = "2.12.0";
+  version = "2.12.1";
 
   src = fetchFromGitHub {
     owner = "dex4er";
     repo = "tf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-a/IWfiBZkRLgJWiEGzyWOpyZfI1EQkIsYaiNuRwH6hE=";
+    hash = "sha256-VnALird0iuve9TmnN+LhVkRaJtbopI/pEqAtIs6cw+k=";
   };
 
-  vendorHash = "sha256-h1ApWUK62l4O9Xr6TyXM++uzYqWkxlzvgZOwkWMYke0=";
+  vendorHash = "sha256-aJVVMVoxmECmUUJphEMz5PYWx6FiSprn7NfO8asVXMc=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/tr/truenas-incus-ctl/package.nix b/pkgs/by-name/tr/truenas-incus-ctl/package.nix
new file mode 100644
index 000000000000..e50f350d908f
--- /dev/null
+++ b/pkgs/by-name/tr/truenas-incus-ctl/package.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "truenas-incus-ctl";
+  version = "0.7.7";
+
+  src = fetchFromGitHub {
+    owner = "truenas";
+    repo = "truenas_incus_ctl";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-F9bTh++yt6heYmkjYSOGXsIyS4s5yIIBS4F44JmIhwc=";
+  };
+
+  vendorHash = "sha256-4mm28T6nWTe3UvwGJ1S7s09ZSRZjm6TGcTD13vazUa4=";
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "A CLI tool for managing Incus volumes on TrueNAS";
+    homepage = "https://github.com/truenas/truenas_incus_ctl";
+    changelog = "https://github.com/truenas/truenas_incus_ctl/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ ysnt-yes ];
+    mainProgram = "truenas_incus_ctl";
+  };
+})
diff --git a/pkgs/by-name/wr/wrangler/package.nix b/pkgs/by-name/wr/wrangler/package.nix
index 5107acca95ff..484794806ed1 100644
--- a/pkgs/by-name/wr/wrangler/package.nix
+++ b/pkgs/by-name/wr/wrangler/package.nix
@@ -19,13 +19,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "wrangler";
-  version = "4.90.0";
+  version = "4.93.0";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "workers-sdk";
     rev = "wrangler@${finalAttrs.version}";
-    hash = "sha256-M2m8dRhTjAYof3S7lVaFYP61p38LvXFSTxantCsUHtE=";
+    hash = "sha256-o/kD67hkj+/pr1grCmTsrWUggcusRWoHegbL4hIEdAw=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-Bo9V3MJaDnKR7TZO4u0mDy9223n7/En8aAdYOgHyYxE=";
+    hash = "sha256-bc/L3bQl2BlcoqpTGBrFbGNl8IeRPoV65EVykAa8euA=";
   };
   # pnpm packageManager version in workers-sdk root package.json may not match nixpkgs
   postPatch = ''
diff --git a/pkgs/by-name/ya/yazi/plugins/bypass/default.nix b/pkgs/by-name/ya/yazi/plugins/bypass/default.nix
index 785193f71016..642d5f7b479a 100644
--- a/pkgs/by-name/ya/yazi/plugins/bypass/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/bypass/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "bypass.yazi";
-  version = "0-unstable-2025-06-01";
+  version = "0-unstable-2026-05-17";
 
   src = fetchFromGitHub {
     owner = "Rolv-Apneseth";
     repo = "bypass.yazi";
-    rev = "c1e5fcf6eeed0bfceb57b9738da6db9d0fb8af56";
-    hash = "sha256-ZndDtTMkEwuIMXG4SGe4B95Nw4fChfFhxJHj+IY30Kc=";
+    rev = "4a0c70ec9122d884deb659ff620af0098314c136";
+    hash = "sha256-kho114UcjV90BDghZxUn2gZXtjY0tsE+C9ttlQZli6U=";
   };
 
   meta = {
diff --git a/pkgs/by-name/ya/yazi/plugins/clipboard/default.nix b/pkgs/by-name/ya/yazi/plugins/clipboard/default.nix
index 7c707e014e94..8b67653f1ed8 100644
--- a/pkgs/by-name/ya/yazi/plugins/clipboard/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/clipboard/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "clipboard.yazi";
-  version = "0-unstable-2026-05-10";
+  version = "0-unstable-2026-05-20";
 
   src = fetchFromGitHub {
     owner = "XYenon";
     repo = "clipboard.yazi";
-    rev = "68b506d9a9c2c5dde01a078a589520f551d05fe5";
-    hash = "sha256-jNBwkcFb9i5Z6BSMfkTOyrK7HZohAT/yB3cxcCOG54w=";
+    rev = "a125df07ba69c893df0e22592e55c1130ce16fe4";
+    hash = "sha256-Q+8MGfeP7reX3nDl5V/HFxRYIayPKEQT5w0b+n73b5k=";
   };
 
   meta = {
diff --git a/pkgs/by-name/ya/yazi/plugins/full-border/default.nix b/pkgs/by-name/ya/yazi/plugins/full-border/default.nix
index 4311dd9a6007..4676bd70ddae 100644
--- a/pkgs/by-name/ya/yazi/plugins/full-border/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/full-border/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "full-border.yazi";
-  version = "0-unstable-2026-04-22";
+  version = "0-unstable-2026-05-13";
 
   src = fetchFromGitHub {
     owner = "yazi-rs";
     repo = "plugins";
-    rev = "034efd687f689f1981ab0e5a7dd46c1e1b4a08c9";
-    hash = "sha256-JIb26wE0WBf9Ul0wYW1/XpQICVTsNLgWgkXvtC457zo=";
+    rev = "5d5c4803dd12bab4e4f19d606f8db0c871e6bec5";
+    hash = "sha256-cZlnrlgv8+SFeNgIW69q//i/apcpvAv41q5W8bJwVaI=";
   };
 
   meta = {
diff --git a/pkgs/by-name/ya/yazi/plugins/git/default.nix b/pkgs/by-name/ya/yazi/plugins/git/default.nix
index 49c011ffe106..afc64890533c 100644
--- a/pkgs/by-name/ya/yazi/plugins/git/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/git/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "git.yazi";
-  version = "0-unstable-2026-02-27";
+  version = "0-unstable-2026-05-09";
 
   src = fetchFromGitHub {
     owner = "yazi-rs";
     repo = "plugins";
-    rev = "0897e20d41b79a5ec8e80e645b041bb950547a0b";
-    hash = "sha256-tHOHWFH9E7aGrmHb8bUD1sLGU0OIdTjQ2p4SbJVfh/s=";
+    rev = "1db18bb5a1c962f95873654a7af1202abb98da60";
+    hash = "sha256-kcZGQB8Dfon8OipuAcNnCeRgTp/S0mQokADkuvEG4Lc=";
   };
 
   meta = {
diff --git a/pkgs/by-name/ya/yazi/plugins/mediainfo/default.nix b/pkgs/by-name/ya/yazi/plugins/mediainfo/default.nix
index ef59d489e107..eb2beac639a9 100644
--- a/pkgs/by-name/ya/yazi/plugins/mediainfo/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/mediainfo/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "mediainfo.yazi";
-  version = "0-unstable-2026-04-10";
+  version = "0-unstable-2026-05-19";
 
   src = fetchFromGitHub {
     owner = "boydaihungst";
     repo = "mediainfo.yazi";
-    rev = "49f5ab722d617a64b3bea87944e3e4e17ba3a46b";
-    hash = "sha256-PcGrFG06XiJYgBWq+c7fYsx1kjkCvIYRaBiWaJT+xkw=";
+    rev = "4f80288c7286efb7ea3ffb6193027f2f1a027473";
+    hash = "sha256-xxOM5cdAEGgUrcFViKWFgwwQdCYpsbvE+Ji0Gerk7UA=";
   };
 
   meta = {
diff --git a/pkgs/by-name/ya/yazi/plugins/mount/default.nix b/pkgs/by-name/ya/yazi/plugins/mount/default.nix
index 6f542ca83c1f..6b60a34af51f 100644
--- a/pkgs/by-name/ya/yazi/plugins/mount/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/mount/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "mount.yazi";
-  version = "0-unstable-2026-04-09";
+  version = "0-unstable-2026-05-09";
 
   src = fetchFromGitHub {
     owner = "yazi-rs";
     repo = "plugins";
-    rev = "7749958b00d461d3c0fba4aa651940d778d1fc3f";
-    hash = "sha256-DZNhqIuGZIEEEH1TrCtAjZKa+7CWZeS1wO9aA9C0Eec=";
+    rev = "16e8ed382db5fc5ea9d179a2803d86859803fae0";
+    hash = "sha256-ALSuXdAGGcscQmGL2d6cDv6MzNiuzl52f9i1b3t+b1I=";
   };
 
   meta = {
diff --git a/pkgs/by-name/ya/yazi/plugins/split-tabs/default.nix b/pkgs/by-name/ya/yazi/plugins/split-tabs/default.nix
index b6dec940a6bf..7e51a4963da6 100644
--- a/pkgs/by-name/ya/yazi/plugins/split-tabs/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/split-tabs/default.nix
@@ -6,13 +6,13 @@
 
 mkYaziPlugin {
   pname = "split-tabs.yazi";
-  version = "0-unstable-2026-05-13";
+  version = "0-unstable-2026-05-17";
 
   src = fetchFromGitHub {
     owner = "terrakok";
     repo = "split-tabs.yazi";
-    rev = "6da6089a0943bf5b9ee18942a890c294d4f227bc";
-    hash = "sha256-vIJNXmkIp5mjWuS/madKI/m9N8D4d6HaIyzeantrkig=";
+    rev = "da25bc0c02f669ef5d939bb03597f4ae557834ec";
+    hash = "sha256-Xb8XKEEZgNL5dZ8EAy9ELDcYGWGq2go+bwdlpydifi8=";
   };
 
   meta = {
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index c1c1f4a25480..6b8e53d4cdb0 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -97,7 +97,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "1.2.6";
+  version = "1.3.5";
 
   outputs = [
     "out"
@@ -110,7 +110,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sxjzbmYEZtup8kpKy3+Wdep5GIqa5YNRZFqzoeqrWAM=";
+    hash = "sha256-ToOIxcbK7cSfl1IJKFR8gg+Ps4zoLHlLqHII3cVXpbg=";
   };
 
   postPatch = ''
@@ -139,7 +139,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm -r $out/git/*/candle-book/
   '';
 
-  cargoHash = "sha256-tJg3uIV/UtAP/S958/1wN/kwLm5P6KZePhF3gWmh1xw=";
+  cargoHash = "sha256-TFYrJnnovUg6whhqYc/CRvYA8nATfVeKBR0EvAIczAg=";
 
   __structuredAttrs = true;
 
diff --git a/pkgs/by-name/ze/zeekstd/package.nix b/pkgs/by-name/ze/zeekstd/package.nix
index 7101af998ae3..0fd40b3c58e3 100644
--- a/pkgs/by-name/ze/zeekstd/package.nix
+++ b/pkgs/by-name/ze/zeekstd/package.nix
@@ -5,6 +5,7 @@
   nix-update,
   rustPlatform,
   writeShellScript,
+  versionCheckHook,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zeekstd";
@@ -18,6 +19,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   };
 
   cargoHash = "sha256-PpfNNRh+K61jfWtBYtWSx3cWXZ2v7tS52Ny1T1XSYVw=";
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
 
   passthru.updateScript = writeShellScript "update-zeekstd" ''
     latestVersion=$(curl ''${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} --fail --silent https://api.github.com/repos/rorosen/zeekstd/releases/latest | ${lib.getExe jq} --raw-output .tag_name | sed -E 's/^v([0-9.]+)-cli$/\1/')
diff --git a/pkgs/development/python-modules/bittensor-drand/default.nix b/pkgs/development/python-modules/bittensor-drand/default.nix
new file mode 100644
index 000000000000..c875e79df9dd
--- /dev/null
+++ b/pkgs/development/python-modules/bittensor-drand/default.nix
@@ -0,0 +1,63 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  rustPlatform,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "bittensor-drand";
+  version = "1.3.0";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "latent-to";
+    repo = "bittensor-drand";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-0GizpmKGWbDjWCIAF1kPdz2sjn8B/e0qSIHmDqlDzZc=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-JasDf3qXzB6ddp1NjC+xtozsggwyk2nQbRw/Lbt02Kg=";
+  };
+
+  nativeBuildInputs = with rustPlatform; [
+    cargoSetupHook
+    maturinBuildHook
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  # remove source package so tests import the installed Rust extension, not the stub __init__.py
+  preCheck = ''
+    rm -rf bittensor_drand
+  '';
+
+  # All tests in test_commit_reveal.py and most in test_all_functions.py call
+  # the live drand network beacon, which is unavailable in the build sandbox.
+  disabledTests = [
+    "test_get_latest_round"
+    "test_encrypt_and_decrypt"
+    "test_encrypt_at_round_and_decrypt"
+    "test_get_signature_for_round"
+    "test_decrypt_with_signature"
+    "test_batch_decryption_optimization"
+    "test_get_encrypted_commitment"
+    "test_get_encrypted_commit"
+    "test_get_encrypted_commits"
+  ];
+
+  pythonImportsCheck = [ "bittensor_drand" ];
+
+  meta = {
+    description = "Bittensor drand integration for commit-reveal";
+    homepage = "https://github.com/latent-to/bittensor-drand";
+    changelog = "https://github.com/latent-to/bittensor-drand/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ kilyanni ];
+  };
+})
diff --git a/pkgs/development/python-modules/bt-decode/default.nix b/pkgs/development/python-modules/bt-decode/default.nix
new file mode 100644
index 000000000000..94a4714a1bc0
--- /dev/null
+++ b/pkgs/development/python-modules/bt-decode/default.nix
@@ -0,0 +1,57 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  rustPlatform,
+  toml,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "bt-decode";
+  version = "0.8.0";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "latent-to";
+    repo = "bt-decode";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-jpCnYKoTVq2NCxE1vZhJzSagXtx43efDSdA5jWsZ95k=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-qj4S1104HaFs6JePwgBjAI/4z7aH71Wq9CDvnSxlXmM=";
+  };
+
+  nativeBuildInputs = with rustPlatform; [
+    cargoSetupHook
+    maturinBuildHook
+  ];
+
+  dependencies = [ toml ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  # these tests compare against bittensor, which is not in nixpkgs
+  disabledTestPaths = [
+    "tests/test_decode_delegate_info.py"
+    "tests/test_decode_neurons.py"
+    "tests/test_decode_stake_info.py"
+    "tests/test_decode_subnet_hyp.py"
+    "tests/test_decode_subnet_info.py"
+  ];
+
+  pythonImportsCheck = [ "bt_decode" ];
+
+  meta = {
+    description = "Fast SCALE decoding of Bittensor data structures";
+    longDescription = "A python wrapper around the rust scale-codec crate for fast scale-decoding of Bittensor data structures.";
+    homepage = "https://github.com/latent-to/bt-decode";
+    changelog = "https://github.com/latent-to/bt-decode/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ kilyanni ];
+  };
+})
diff --git a/pkgs/development/python-modules/csv2md/default.nix b/pkgs/development/python-modules/csv2md/default.nix
index 15c0ad1029c1..04bb04320569 100644
--- a/pkgs/development/python-modules/csv2md/default.nix
+++ b/pkgs/development/python-modules/csv2md/default.nix
@@ -2,28 +2,31 @@
   lib,
   fetchFromGitHub,
   buildPythonPackage,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "csv2md";
   version = "1.6.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lzakharov";
     repo = "csv2md";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-51MCeM/zfjYMhB8Ryt1RMevEwszAzgYrJsyViEIOYVY=";
   };
 
+  build-system = [ setuptools ];
+
   pythonImportsCheck = [ "csv2md" ];
 
   meta = {
     description = "Command line tool for converting CSV files into Markdown tables";
     homepage = "https://github.com/lzakharov/csv2md";
-    changelog = "https://github.com/lzakharov/csv2md/releases/tag/v${version}";
+    changelog = "https://github.com/lzakharov/csv2md/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ t4ccer ];
     mainProgram = "csv2md";
   };
-}
+})
diff --git a/pkgs/development/python-modules/cyscale/default.nix b/pkgs/development/python-modules/cyscale/default.nix
new file mode 100644
index 000000000000..ac55c72ae78e
--- /dev/null
+++ b/pkgs/development/python-modules/cyscale/default.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  more-itertools,
+  base58,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "cyscale";
+  version = "0.3.2";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "latent-to";
+    repo = "cyscale";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-L75xuo4LWfTMs1XYV8zSPtmxqgjWin9wcALDUjz5L1k=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    more-itertools
+    base58
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  # test_valid_type_registry_presets walks ../scalecodec/type_registry relative
+  # to the test file, which no longer exists after removing the source package dir
+  disabledTests = [ "test_valid_type_registry_presets" ];
+
+  # remove source package so tests import the installed Cython extensions, not the .pyx sources
+  preCheck = ''
+    rm -rf scalecodec
+  '';
+
+  pythonImportsCheck = [ "scalecodec" ];
+
+  meta = {
+    description = "Cython-accelerated SCALE codec library for Substrate-based blockchains (Polkadot, Kusama, Bittensor, etc.)";
+    longDescription = "A drop-in replacement for py-scale-codec — same scalecodec module name, same public API, compiled with Cython for improved throughput.";
+    homepage = "https://github.com/latent-to/cyscale";
+    changelog = "https://github.com/latent-to/cyscale/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ kilyanni ];
+  };
+})
diff --git a/pkgs/development/python-modules/django-modelcluster/default.nix b/pkgs/development/python-modules/django-modelcluster/default.nix
index a254022b68dc..42162882aee1 100644
--- a/pkgs/development/python-modules/django-modelcluster/default.nix
+++ b/pkgs/development/python-modules/django-modelcluster/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "django-modelcluster";
-  version = "6.4.1";
+  version = "6.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "wagtail";
     repo = "django-modelcluster";
     tag = "v${version}";
-    hash = "sha256-LVCYjbKN53740hr5Tl0JRbx17g35fnauZHIKQNkb5Kc=";
+    hash = "sha256-jIEiwWuC+sudUHsHuG975nxrlC2yKZN/QjdvMKEeL6s=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/python-statemachine/default.nix b/pkgs/development/python-modules/python-statemachine/default.nix
new file mode 100644
index 000000000000..83e62d0be083
--- /dev/null
+++ b/pkgs/development/python-modules/python-statemachine/default.nix
@@ -0,0 +1,79 @@
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  fetchPypi,
+  hatchling,
+  pytestCheckHook,
+  pytest-asyncio,
+  pytest-benchmark,
+  pytest-mock,
+  pytest-timeout,
+  pytest-django,
+  pydot,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "python-statemachine";
+  version = "3.0.0";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    pname = "python_statemachine";
+    inherit (finalAttrs) version;
+    hash = "sha256-kVI/nq1zwdb+zJddXG4L/jY/v1N8XwvzCbzQ+U+UQbI=";
+  };
+
+  build-system = [ hatchling ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-asyncio
+    pytest-benchmark
+    pytest-mock
+    pytest-timeout
+    pytest-django
+    pydot
+  ];
+
+  pytestFlags = [ "--benchmark-disable" ];
+
+  disabledTestPaths = [
+    # quite slow
+    "tests/test_weighted_transitions.py"
+    "tests/scxml/"
+  ];
+
+  disabledTests = [
+    # broken upstream
+    "statemachine.contrib.diagram.quickchart_write_svg"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # async state transitions appear broken on darwin
+    # TODO: investigate on an actual macOS machine
+    "test_timeout_fires_done_invoke"
+    "test_timeout_fires_before_slow_invoke"
+    "test_custom_event_fires"
+
+    # flaky
+    "test_group_returns_ordered_results"
+    "test_group_error_cancels_remaining"
+    "test_group_with_file_io"
+    "test_group_cancel_on_exit"
+    "test_group_single_callable"
+    "test_each_sm_instance_gets_own_group"
+  ];
+
+  pythonImportsCheck = [ "statemachine" ];
+
+  meta = {
+    description = "Expressive statecharts and FSMs for modern Python";
+
+    homepage = "https://github.com/fgmacedo/python-statemachine";
+    changelog = "https://github.com/fgmacedo/python-statemachine/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ kilyanni ];
+  };
+})
diff --git a/pkgs/development/python-modules/reflex/default.nix b/pkgs/development/python-modules/reflex/default.nix
index 3b9cd46d0736..ab9304395e9b 100644
--- a/pkgs/development/python-modules/reflex/default.nix
+++ b/pkgs/development/python-modules/reflex/default.nix
@@ -72,7 +72,7 @@ let
     buildPythonPackage {
       inherit pname version src;
       pyproject = true;
-      sourceRoot = "${src.name}/packages/${pname}";
+      sourceRoot = workspace.sourceRoot or "${src.name}/packages/${pname}";
 
       build-system = [
         hatchling
@@ -98,14 +98,14 @@ in
 
 buildPythonPackage (finalAttrs: {
   pname = "reflex";
-  version = "0.9.1";
+  version = "0.9.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "reflex-dev";
     repo = "reflex";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YYy/K4AXeh9wS4Vodg3NOqwolPYHTgpP5/yWkutMsxo=";
+    hash = "sha256-HY8FaOUU2kp/39OqO+7Xpepiu/6obxTMir11jGtRAkE=";
   };
 
   build-system = [
@@ -199,12 +199,16 @@ buildPythonPackage (finalAttrs: {
     "tests/benchmarks/"
     "tests/integration/"
 
+    # unable to import agent_files (should be in docs/app/agent_files/)
+    "docs/app/tests/test_agent_files.py"
+
     # circular imports (reflex-docgen)
     "tests/units/docgen/test_class_and_component.py"
     "tests/units/docgen/test_markdown.py"
+    "docs/app/tests/test_doc_links.py"
     "docs/app/tests/test_docgen_double_eval.py"
 
-    # circular imports (reflex_site_shared)
+    # circular imports (reflex-site-shared)
     "docs/app/tests/test_routes.py"
   ];
 
@@ -257,7 +261,8 @@ buildPythonPackage (finalAttrs: {
         hatch-reflex-pyi.dependencies = [
           hatchling
         ];
-        integrations-docs.dependencies = [
+        reflex-integrations-docs.sourceRoot = "${finalAttrs.src.name}/packages/integrations-docs";
+        reflex-integrations-docs.dependencies = [
         ];
         reflex-base.dependencies = [
           packaging
@@ -394,6 +399,7 @@ buildPythonPackage (finalAttrs: {
           subPkgs.reflex-components-recharts
           subPkgs.reflex-components-sonner
           subPkgs.reflex-hosting-cli
+          subPkgs.reflex-integrations-docs
           ruff
           ruff-format
         ];
diff --git a/pkgs/development/python-modules/reflex/mk_workspaces.sh b/pkgs/development/python-modules/reflex/mk_workspaces.sh
index f162c1fcc56d..35ce78ff2246 100755
--- a/pkgs/development/python-modules/reflex/mk_workspaces.sh
+++ b/pkgs/development/python-modules/reflex/mk_workspaces.sh
@@ -1,27 +1,36 @@
 #!/usr/bin/env nix-shell
-#!nix-shell --pure -i bash -p nix jq yq
+#! nix-shell --pure -i bash -p nix jq yq
 set -euo pipefail
 
 src=$(nix-build . -A python3Packages.reflex.src --no-out-link)
 # echo >&2 "src=$src"; exit 0 # DEBUG
 
-declare -a workspace_paths=( "$src"/packages/* )
-# printf >&2 "%s\n" "${workspace_paths[@]}"; exit 0 # DEBUG
+declare -A workspaces=()
+for workspace_path in "$src"/packages/*; do
+  workspace_name=$(tomlq <"$workspace_path/pyproject.toml" '.project.name' -r)
+  workspaces["$workspace_path"]="$workspace_name"
+done
+# printf >&2 "%s\n" "${!workspaces[@]}" ; exit # DEBUG
+# printf >&2 "%s\n" "${workspaces[@]}" ; exit # DEBUG
 
-declare -a workspaces=( "${workspace_paths[@]##*/}" )
-# printf >&2 "%s\n" "${workspaces[@]}"; exit 0 # DEBUG
+workspace_names_json=$( printf '"%s"\n' "${workspaces[@]}" | jq -s '.' -c )
+# jq >&2 . <<<"$workspace_names_json"; exit # DEBUG
 
-workspaces_json=$( printf '"%s"\n' "${workspaces[@]}" | jq -s '.' -c )
+for workspace_path in $( printf '%q\n' "${!workspaces[@]}" | sort ); do
+  workspace_name="${workspaces["$workspace_path"]}"
 
-for workspace in "${workspaces[@]}"; do
-  echo "$workspace.dependencies = ["
-  tomlq <"$src/packages/$workspace/pyproject.toml" \
-    --argjson "workspaces" "$workspaces_json" \
+  if [[ "$workspace_path" != "$src"/packages/"$workspace_name" ]]; then
+    echo "$workspace_name"'.sourceRoot = "${finalAttrs.src.name}/'"${workspace_path#"$src/"}"'";'
+  fi
+
+  echo "$workspace_name.dependencies = ["
+  tomlq <"$workspace_path/pyproject.toml" \
+    --argjson "workspace_names" "$workspace_names_json" \
     '.project.dependencies + (.tool.hatch.build.hooks."reflex-pyi".dependencies // [])
       | map( split("[ !><=]"; null)[0] ) # remove ">= 1.2.3"
       | map( gsub("_"; "-") )            # normalize attrpath/pname
       | unique[]
-      | if (. as $dep | $workspaces|index($dep) != null) then
+      | if (. as $dep | $workspace_names|index($dep) != null) then
           "  subPkgs.\(.)"
         elif . == "reflex" then
           "  finalAttrs.finalPackage # reflex"
diff --git a/pkgs/development/python-modules/scalecodec/default.nix b/pkgs/development/python-modules/scalecodec/default.nix
new file mode 100644
index 000000000000..3b7f4cfd15ac
--- /dev/null
+++ b/pkgs/development/python-modules/scalecodec/default.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  more-itertools,
+  base58,
+  requests,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "scalecodec";
+  version = "1.2.12";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "JAMdotTech";
+    repo = "py-scale-codec";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-e6SDVivkVZjL84kcvkPs+5S2iD79+p+dGjhUWuS50Fc=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    more-itertools
+    base58
+    requests
+  ];
+
+  # setup.py reads version from TRAVIS_TAG env var
+  env.TRAVIS_TAG = finalAttrs.src.tag;
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "scalecodec" ];
+
+  meta = {
+    description = "Python SCALE Codec Library";
+    longDescription = ''
+      Substrate uses a lightweight and efficient encoding and decoding program to optimize how data is sent and received over the network.
+      The program used to serialize and deserialize data is called the SCALE codec, with SCALE being an acronym for Simple Concatenated Aggregate Little-Endian.
+    '';
+    homepage = "https://github.com/JAMdotTech/py-scale-codec";
+    changelog = "https://github.com/JAMdotTech/py-scale-codec/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ kilyanni ];
+  };
+})
diff --git a/pkgs/development/python-modules/sympy/default.nix b/pkgs/development/python-modules/sympy/default.nix
index ef1e4183e307..575698e7a81c 100644
--- a/pkgs/development/python-modules/sympy/default.nix
+++ b/pkgs/development/python-modules/sympy/default.nix
@@ -1,30 +1,48 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
-  glibcLocales,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
   mpmath,
 
+  # tests
+  glibcLocales,
+
   # Reverse dependency
   sage,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "sympy";
   version = "1.14.0";
-  format = "setuptools";
+  pyproject = true;
+  __structuredAttrs = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-09P+jfHloLQvDnvfUFQWl9vn0jdG6JSZDAMOKwXnJRc=";
+  src = fetchFromGitHub {
+    owner = "sympy";
+    repo = "sympy";
+    tag = "sympy-${finalAttrs.version}";
+    hash = "sha256-aSMQ/H5agjsa+Lp7o15/irLSTLtmF/VEqMCBGbXbvmM=";
   };
 
-  nativeCheckInputs = [ glibcLocales ];
+  build-system = [
+    setuptools
+  ];
 
-  propagatedBuildInputs = [ mpmath ];
+  pythonRelaxDeps = [
+    "mpmath"
+  ];
+  dependencies = [
+    mpmath
+  ];
 
   # tests take ~1h
   doCheck = false;
+  nativeCheckInputs = [ glibcLocales ];
   pythonImportsCheck = [ "sympy" ];
 
   passthru.tests = {
@@ -35,8 +53,12 @@ buildPythonPackage rec {
     description = "Python library for symbolic mathematics";
     mainProgram = "isympy";
     homepage = "https://www.sympy.org/";
+    downloadPage = "https://github.com/sympy/sympy";
+    changelog = "https://github.com/sympy/sympy/wiki/Release-Notes-for-${finalAttrs.version}";
     license = lib.licenses.bsd3;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      GaetanLepage
+    ];
     teams = [ lib.teams.sage ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/wagtail-localize/default.nix b/pkgs/development/python-modules/wagtail-localize/default.nix
index 2b22e924a455..aedbc54f4bc1 100644
--- a/pkgs/development/python-modules/wagtail-localize/default.nix
+++ b/pkgs/development/python-modules/wagtail-localize/default.nix
@@ -25,14 +25,14 @@
 
 buildPythonPackage rec {
   pname = "wagtail-localize";
-  version = "1.13";
+  version = "1.13.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     repo = "wagtail-localize";
     owner = "wagtail";
     tag = "v${version}";
-    hash = "sha256-JhLfrK4CBdTR85JuAjf9vGByQVgCIYT3IrM6AYxxNTE=";
+    hash = "sha256-iJwX/N8/aaAjinU1htVasp88fuuZCOomVPgJ1Ymxre4=";
   };
 
   build-system = [ flit-core ];
@@ -56,12 +56,12 @@ buildPythonPackage rec {
     google-cloud-translate
   ];
 
+  # See https://github.com/wagtail/wagtail-localize/issues/922
+  patches = [ ./failing-test.patch ];
+
   checkPhase = ''
     runHook preCheck
 
-    # test_translate_html fails with later Beautifulsoup releases
-    rm wagtail_localize/machine_translators/tests/test_dummy_translator.py
-
     ${python.interpreter} testmanage.py test
 
     runHook postCheck
diff --git a/pkgs/development/python-modules/wagtail-localize/failing-test.patch b/pkgs/development/python-modules/wagtail-localize/failing-test.patch
new file mode 100644
index 000000000000..2d50ef7218d0
--- /dev/null
+++ b/pkgs/development/python-modules/wagtail-localize/failing-test.patch
@@ -0,0 +1,19 @@
+diff --git a/wagtail_localize/tests/test_edit_translation.py b/wagtail_localize/tests/test_edit_translation.py
+index 4bbe5a1..033b6bf 100644
+--- a/wagtail_localize/tests/test_edit_translation.py
++++ b/wagtail_localize/tests/test_edit_translation.py
+@@ -1,5 +1,6 @@
+ import json
+ import tempfile
++import unittest
+ import uuid
+ 
+ from unittest.mock import patch
+@@ -1718,6 +1719,7 @@ def test_cant_edit_snippet_translation_without_perms(self):
+             "Sorry, you do not have permission to access this area.\n\n\n\n\n",
+         )
+ 
++    @unittest.skip
+     def test_edit_nested_snippet_translation(self):
+         for permission in Permission.objects.filter(
+             content_type=ContentType.objects.get_for_model(Header)
diff --git a/pkgs/development/python-modules/wagtail/default.nix b/pkgs/development/python-modules/wagtail/default.nix
index 4fdbdcc0c803..60704abf0bdb 100644
--- a/pkgs/development/python-modules/wagtail/default.nix
+++ b/pkgs/development/python-modules/wagtail/default.nix
@@ -37,14 +37,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "wagtail";
-  version = "7.3";
+  version = "7.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "wagtail";
     repo = "wagtail";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-o/4jn32ffR3BPVNwtFKJ6PowXYi7SpjBqghdeZIl5tM=";
+    hash = "sha256-+Ar8lg340rafaRNgcohEBuloU/dJC+ODTzAMmrPS/PU=";
   };
 
   nativeBuildInputs = [
@@ -54,7 +54,7 @@ buildPythonPackage (finalAttrs: {
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-Uc16K1RZUCnr4qRe2u4yB44F+zYFBxMpEQCz5992RMA=";
+    hash = "sha256-Z2VOMqsNIBybJpfYxAq2dkmS2vwd8Yuhu7MCFyqNxdI=";
   };
 
   preBuild = ''
diff --git a/pkgs/kde/misc/oxygen-icons/default.nix b/pkgs/kde/misc/oxygen-icons/default.nix
index 02e1e278edbb..dcf24a74ef20 100644
--- a/pkgs/kde/misc/oxygen-icons/default.nix
+++ b/pkgs/kde/misc/oxygen-icons/default.nix
@@ -5,11 +5,11 @@
 }:
 mkKdeDerivation rec {
   pname = "oxygen-icons";
-  version = "6.1.0";
+  version = "6.2.0";
 
   src = fetchurl {
     url = "mirror://kde/stable/oxygen-icons/oxygen-icons-${version}.tar.xz";
-    hash = "sha256-FsqXEHnFBnxFB8q/G2GdyH3Wsyb9XC3Z9dQ4EPIXTWg=";
+    hash = "sha256-Yf0u9W56+7urA0BSAXJkrQDQdMe+BvCFXUyAWly6z90=";
   };
 
   dontStrip = true;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ce82af5e3179..4e65749da218 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2120,6 +2120,8 @@ self: super: with self; {
 
   bitstruct = callPackage ../development/python-modules/bitstruct { };
 
+  bittensor-drand = callPackage ../development/python-modules/bittensor-drand { };
+
   bitvavo-aio = callPackage ../development/python-modules/bitvavo-aio { };
 
   bitvector-for-humans = callPackage ../development/python-modules/bitvector-for-humans { };
@@ -2353,6 +2355,8 @@ self: super: with self; {
 
   bsuite = callPackage ../development/python-modules/bsuite { };
 
+  bt-decode = callPackage ../development/python-modules/bt-decode { };
+
   bt-proximity = callPackage ../development/python-modules/bt-proximity { };
 
   btchip-python = callPackage ../development/python-modules/btchip-python { };
@@ -3516,6 +3520,8 @@ self: super: with self; {
 
   cyrtranslit = callPackage ../development/python-modules/cyrtranslit { };
 
+  cyscale = callPackage ../development/python-modules/cyscale { };
+
   cysignals = callPackage ../development/python-modules/cysignals { };
 
   cython = callPackage ../development/python-modules/cython { };
@@ -16152,6 +16158,8 @@ self: super: with self; {
 
   python-sql = callPackage ../development/python-modules/python-sql { };
 
+  python-statemachine = callPackage ../development/python-modules/python-statemachine { };
+
   python-status = callPackage ../development/python-modules/python-status { };
 
   python-stdnum = callPackage ../development/python-modules/python-stdnum { };
@@ -17491,6 +17499,8 @@ self: super: with self; {
 
   scalar-fastapi = callPackage ../development/python-modules/scalar-fastapi { };
 
+  scalecodec = callPackage ../development/python-modules/scalecodec { };
+
   scalene = callPackage ../development/python-modules/scalene { };
 
   scales = callPackage ../development/python-modules/scales { };