diff --git a/nixos/modules/programs/captive-browser.nix b/nixos/modules/programs/captive-browser.nix
index 368994e8829f..95c5c37e92be 100644
--- a/nixos/modules/programs/captive-browser.nix
+++ b/nixos/modules/programs/captive-browser.nix
@@ -21,8 +21,6 @@ let
     types
     ;
 
-  requiresSetcapWrapper = config.boot.kernelPackages.kernelOlder "5.7" && cfg.bindInterface;
-
   browserDefault =
     chromium:
     concatStringsSep " " [
@@ -30,11 +28,20 @@ let
       "${chromium}/bin/chromium"
       "--user-data-dir=\${XDG_DATA_HOME:-$HOME/.local/share}/chromium-captive"
       ''--proxy-server="socks5://$PROXY"''
-      ''--host-resolver-rules="MAP * ~NOTFOUND , EXCLUDE localhost"''
+      ''--proxy-bypass-list="<-loopback>"''
       "--no-first-run"
       "--new-window"
       "--incognito"
       "-no-default-browser-check"
+      "--no-crash-upload"
+      "--disable-extensions"
+      "--disable-sync"
+      "--disable-background-networking"
+      "--disable-client-side-phishing-detection"
+      "--disable-component-update"
+      "--disable-translate"
+      "--disable-web-resources"
+      "--safebrowsing-disable-auto-update"
       "http://cache.nixos.org/"
     ];
 
@@ -144,12 +151,5 @@ in
         else
           throw "programs.captive-browser.dhcp-dns must be set"
       );
-
-    security.wrappers.captive-browser = mkIf requiresSetcapWrapper {
-      owner = "root";
-      group = "root";
-      capabilities = "cap_net_raw+p";
-      source = "${captive-browser-configured}/bin/captive-browser";
-    };
   };
 }
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index db3d19f6ba51..c505fc632dfc 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -78,8 +78,8 @@ rec {
   thunderbird = thunderbird-latest;
 
   thunderbird-latest = common {
-    version = "152.0";
-    sha512 = "51b950af634e7c7dfb7c043d69f925ed6d50d4c44341761e7e3ef02d5db28d2c539cd8d9286195e3facf84869f57b12a58760105b5195c449b4e1e4c9b6200d2";
+    version = "152.0.1";
+    sha512 = "f66c87de4dd73c3c45e420a55d76c3cb6ac091a61794ccf58ba59d1a40cf8001dee19a6a7f4c6bef7d36ea94ed4e4f677449d3006b2004abbd3fab42ad1c9228";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-latest";
diff --git a/pkgs/by-name/as/asn1c/package.nix b/pkgs/by-name/as/asn1c/package.nix
index 1072090c2112..9f07efcb9169 100644
--- a/pkgs/by-name/as/asn1c/package.nix
+++ b/pkgs/by-name/as/asn1c/package.nix
@@ -1,39 +1,64 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  autoreconfHook,
+  versionCheckHook,
+  fetchFromGitHub,
   perl,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "asn1c";
-  version = "0.9.28";
+  version = "0.9.29";
 
-  src = fetchurl {
-    url = "https://lionet.info/soft/asn1c-${finalAttrs.version}.tar.gz";
-    hash = "sha256-gAdEC2R+8t2ftz2THDOsEXZOavskN9vmOLtOX8gjhrk=";
+  src = fetchFromGitHub {
+    owner = "vlm";
+    repo = "asn1c";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ms4+tzlVdV0pVGhdBod8sepjHGS4OVxJb3HdrFKv9Cc=";
   };
 
   outputs = [
     "out"
     "doc"
     "man"
+
+    # for the one perl utility
+    "crfc2asn1"
+  ];
+
+  postPatch = ''
+    patchShebangs examples/crfc2asn1.pl
+  '';
+
+  nativeBuildInputs = [
+    autoreconfHook
+    versionCheckHook
   ];
 
   buildInputs = [ perl ];
 
-  preConfigure = ''
-    patchShebangs examples/crfc2asn1.pl
-  '';
+  enableParallelBuilding = true;
 
   postInstall = ''
     cp -r skeletons/standard-modules $out/share/asn1c
   '';
 
-  doCheck = true;
+  # Barely anyone uses this, so make it a split-output
+  # so we don't carry the dependency on perl into bin.
+  postFixup = ''
+    mkdir -p $crfc2asn1/bin
+    mv $out/bin/crfc2asn1.pl $crfc2asn1/bin/crfc2asn1
+  '';
+
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
 
   meta = {
-    homepage = "http://lionet.info/asn1c/compiler.html";
+    mainProgram = "asn1c";
+    homepage = "https://lionet.info/asn1c/compiler.html";
     description = "Open Source ASN.1 Compiler";
     license = lib.licenses.bsd2;
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/ca/captive-browser/package.nix b/pkgs/by-name/ca/captive-browser/package.nix
index 7f6f740261e7..927a560c78ea 100644
--- a/pkgs/by-name/ca/captive-browser/package.nix
+++ b/pkgs/by-name/ca/captive-browser/package.nix
@@ -2,34 +2,25 @@
   lib,
   fetchFromGitHub,
   buildGoModule,
-  fetchpatch,
 }:
 
-buildGoModule {
+buildGoModule (finalAttrs: {
   pname = "captive-browser";
-  version = "0-unstable-2021-08-01";
+  version = "0-unstable-2025-11-05";
 
   src = fetchFromGitHub {
-    owner = "FiloSottile";
+    owner = "pacoorozco";
     repo = "captive-browser";
-    rev = "9c707dc32afc6e4146e19b43a3406329c64b6f3c";
-    sha256 = "sha256-65lPo5tpE0M/VyyvlzlcVSuHX4AhhVuqK0UF4BIAH/Y=";
+    rev = "ca6f74e132ecf298c87936d4c946fd551aefbbf7";
+    sha256 = "sha256-wojx28GFg9whfkNxUbOVDVNHp8M7SLsmRBTP/Jh8nLQ=";
   };
 
-  vendorHash = "sha256-2MFdQ2GIDAdLPuwAiGPO9wU3mm2BDXdyTwoVA1xVlcQ=";
-  deleteVendor = true;
-
-  patches = [
-    # Add go modules support
-    (fetchpatch {
-      url = "https://github.com/FiloSottile/captive-browser/commit/ef50837778ef4eaf38b19887e79c8b6fa830c342.patch";
-      hash = "sha256-w+jDFeO94pMu4ir+G5CzqYlXxYOm9+YfyzbU3sbTyiY=";
-    })
-  ];
+  vendorHash = "sha256-8FMFgCJUTalJ45GR5UnyXqN6s0gVFtiy6zjugbngDYQ=";
 
   ldflags = [
     "-s"
     "-w"
+    "-X main.Version=${finalAttrs.version}"
   ];
 
   meta = {
@@ -38,4 +29,4 @@ buildGoModule {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ ma27 ];
   };
-}
+})
diff --git a/pkgs/by-name/fc/fcitx5-sitelen-pona/package.nix b/pkgs/by-name/fc/fcitx5-sitelen-pona/package.nix
index 71bd5243e679..37eeac3c53c7 100644
--- a/pkgs/by-name/fc/fcitx5-sitelen-pona/package.nix
+++ b/pkgs/by-name/fc/fcitx5-sitelen-pona/package.nix
@@ -5,17 +5,18 @@
   libime,
   fcitx5,
   qt6Packages,
+  nix-update-script,
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "fcitx5-sitelen-pona";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "Toastberries";
     repo = "fcitx5-sitelen-pona";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZLp/p5umewp1seXFPtMevVBXfoNwHXAojYl5jWHHsTU=";
+    hash = "sha256-/pauEuE+hNdWhAz4CnSqySnF0h1toNGngHKOO9ntDnY=";
   };
 
   strictDeps = true;
@@ -54,6 +55,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   __structuredAttrs = true;
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     inherit (fcitx5.meta) platforms;
     description = "IME using Fcitx5 for writing toki pona's sitelen pona glyphs";
diff --git a/pkgs/by-name/gl/glfw3/package.nix b/pkgs/by-name/gl/glfw3/package.nix
index 711406030b70..6ecf627adce1 100644
--- a/pkgs/by-name/gl/glfw3/package.nix
+++ b/pkgs/by-name/gl/glfw3/package.nix
@@ -20,6 +20,9 @@
   libxkbcommon,
   libdecor,
   withMinecraftPatch ? false,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 let
   version = "3.4";
@@ -58,7 +61,11 @@ stdenv.mkDerivation {
     cmake
     pkg-config
   ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ fixDarwinDylibNames ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    fixDarwinDylibNames
+    # TODO: Clean up on `staging`.
+    llvmPackages.lld
+  ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [ wayland-scanner ];
 
   buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
@@ -86,6 +93,9 @@ stdenv.mkDerivation {
   cmakeFlags = [
     # Static linking isn't supported
     (lib.cmakeBool "BUILD_SHARED_LIBS" true)
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    (lib.cmakeFeature "CMAKE_LINKER_TYPE" "LLD")
   ];
 
   env = lib.optionalAttrs (!stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isWindows) {
diff --git a/pkgs/by-name/gr/grok-build/package.nix b/pkgs/by-name/gr/grok-build/package.nix
new file mode 100644
index 000000000000..b18d5fc6f390
--- /dev/null
+++ b/pkgs/by-name/gr/grok-build/package.nix
@@ -0,0 +1,100 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  installShellFiles,
+  autoPatchelfHook,
+  versionCheckHook,
+  runCommand,
+  testers,
+  grok-build,
+}:
+let
+  version = "0.2.82";
+
+  throwSystem = throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}";
+
+  platform = {
+    x86_64-linux = "linux-x86_64";
+    aarch64-linux = "linux-aarch64";
+    x86_64-darwin = "macos-x86_64";
+    aarch64-darwin = "macos-aarch64";
+  };
+
+  sourceData = lib.mapAttrs (
+    system: upstreamPlatform:
+    fetchurl {
+      url = "https://x.ai/cli/grok-${version}-${upstreamPlatform}";
+      hash =
+        {
+          x86_64-linux = "sha256-x0+vJ1FB4WVIgCQY6/EHY5R+uqAPJCe7gPAiq6Y2iP4=";
+          aarch64-linux = "sha256-tHJ8YAeG1ko++xn3OmyLlRsHWzXW+nypUZoIlBFQelg=";
+          x86_64-darwin = "sha256-wCiGbPt50wH/he2VJhdqFD2rUiUznZL0Hj8hUo4+s5Y=";
+          aarch64-darwin = "sha256-HkyKeLBQ2TVj4g9iKkGjT46WuAV1sclYrT8JUxb+YYk=";
+        }
+        .${system};
+    }
+  ) platform;
+in
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "grok-build";
+  inherit version;
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = sourceData.${stdenvNoCC.hostPlatform.system} or throwSystem;
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  nativeBuildInputs = [
+    installShellFiles
+  ]
+  ++ lib.optionals stdenvNoCC.hostPlatform.isElf [ autoPatchelfHook ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 "$src" "$out/bin/grok"
+    ln -s grok "$out/bin/agent"
+
+    ${lib.optionalString (stdenvNoCC.buildPlatform.canExecute stdenvNoCC.hostPlatform) ''
+      installShellCompletion --cmd grok \
+        --bash <("$out/bin/grok" completions bash) \
+        --fish <("$out/bin/grok" completions fish) \
+        --zsh <("$out/bin/grok" completions zsh)
+    ''}
+
+    runHook postInstall
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    # ensure is a symlink
+    test -L "$out/bin/agent"
+
+    # ensure agent points at grok
+    [ "$(readlink -f "$out/bin/agent")" = "$(readlink -f "$out/bin/grok")" ]
+
+    runHook postInstallCheck
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "Command-line coding agent by xAI";
+    homepage = "https://docs.x.ai/build/overview";
+    downloadPage = "https://x.ai/cli/stable";
+    license = lib.licenses.unfreeRedistributable;
+    maintainers = with lib.maintainers; [ crertel ];
+    platforms = lib.attrNames sourceData;
+    mainProgram = "grok";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
diff --git a/pkgs/by-name/gr/grok-build/update.sh b/pkgs/by-name/gr/grok-build/update.sh
new file mode 100755
index 000000000000..371f2853e8ad
--- /dev/null
+++ b/pkgs/by-name/gr/grok-build/update.sh
@@ -0,0 +1,34 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl common-updater-scripts
+
+set -euo pipefail
+
+version="$(curl -fsSL https://x.ai/cli/stable)"
+
+currentVersion=$(
+  nix-instantiate --eval --raw -E "with import ./. {}; grok-build.version or (lib.getVersion grok-build)"
+)
+
+if [[ "$currentVersion" == "$version" ]]; then
+  echo "package is up-to-date: $version"
+  exit 0
+fi
+
+update-source-version grok-build "${version}" || true
+
+for system in "aarch64-darwin macos-aarch64" "aarch64-linux linux-aarch64" "x86_64-darwin macos-x86_64" "x86_64-linux linux-x86_64"; do
+  # shellcheck disable=SC2086
+  set -- ${system}
+
+  arch="${1}"
+  platform="${2}"
+
+  url="https://x.ai/cli/grok-${version}-${platform}"
+  hash=$(
+    nix --extra-experimental-features nix-command hash convert --hash-algo sha256 "$(
+      nix-prefetch-url "${url}"
+    )"
+  )
+
+  update-source-version grok-build "${version}" "${hash}" --system="${arch}" --ignore-same-version
+done
diff --git a/pkgs/by-name/im/immichframe/deps.json b/pkgs/by-name/im/immichframe/deps.json
index abf5e32343d8..e8f2efbd7986 100644
--- a/pkgs/by-name/im/immichframe/deps.json
+++ b/pkgs/by-name/im/immichframe/deps.json
@@ -1,54 +1,19 @@
 [
-  {
-    "pname": "AwesomeAssertions",
-    "version": "9.2.0",
-    "hash": "sha256-s5j46b6KchKwjQgiXvCYUZLk5Xtk4sb1wSh25f8ShFc="
-  },
   {
     "pname": "BloomFilter.NetCore",
     "version": "2.5.3",
     "hash": "sha256-UfH3JZgUh8zj34+E1DLZdKo9Dyqb/Ek8qmg4kx5N818="
   },
-  {
-    "pname": "Castle.Core",
-    "version": "5.1.1",
-    "hash": "sha256-oVkQB+ON7S6Q27OhXrTLaxTL0kWB58HZaFFuiw4iTrE="
-  },
-  {
-    "pname": "coverlet.collector",
-    "version": "6.0.4",
-    "hash": "sha256-ieiUl7G5pVKQ4V6rxhEe0ehep0/u1RBD3EAI63AQTI0="
-  },
   {
     "pname": "Ical.Net",
     "version": "4.3.1",
     "hash": "sha256-jpohvCiUBe61A3O+BJwCqsPW+3jUt4cKeCqZb/0cw0M="
   },
-  {
-    "pname": "Microsoft.ApplicationInsights",
-    "version": "2.23.0",
-    "hash": "sha256-5sf3bg7CZZjHseK+F3foOchEhmVeioePxMZVvS6Rjb0="
-  },
-  {
-    "pname": "Microsoft.AspNetCore.Mvc.Testing",
-    "version": "8.0.20",
-    "hash": "sha256-jSWZfbewG7LqrqVQ4wmwj4K6OPGslm0wt4D5wK2TlFc="
-  },
   {
     "pname": "Microsoft.AspNetCore.SpaProxy",
     "version": "8.0.20",
     "hash": "sha256-kjvVZQBbE6fjKdbZsg+BNCRHh3d5fvxNNFaCF5fxQSI="
   },
-  {
-    "pname": "Microsoft.AspNetCore.TestHost",
-    "version": "8.0.20",
-    "hash": "sha256-M/MTiN0nNQ8eKQn9r8TnIXYWxOYgBHNG/PZtvnInmDw="
-  },
-  {
-    "pname": "Microsoft.CodeCoverage",
-    "version": "17.14.1",
-    "hash": "sha256-f8QytG8GvRoP47rO2KEmnDLxIpyesaq26TFjDdW40Gs="
-  },
   {
     "pname": "Microsoft.Extensions.ApiDescription.Client",
     "version": "8.0.20",
@@ -94,36 +59,6 @@
     "version": "8.0.0",
     "hash": "sha256-GanfInGzzoN2bKeNwON8/Hnamr6l7RTpYLA49CNXD9Q="
   },
-  {
-    "pname": "Microsoft.Extensions.Configuration.Binder",
-    "version": "8.0.2",
-    "hash": "sha256-aGB0VuoC34YadAEqrwoaXLc5qla55pswDV2xLSmR7SE="
-  },
-  {
-    "pname": "Microsoft.Extensions.Configuration.CommandLine",
-    "version": "8.0.0",
-    "hash": "sha256-fmPC/o8S+weTtQJWykpnGHm6AKVU21xYE/CaHYU7zgg="
-  },
-  {
-    "pname": "Microsoft.Extensions.Configuration.EnvironmentVariables",
-    "version": "8.0.0",
-    "hash": "sha256-+bjFZvqCsMf2FRM2olqx/fub+QwfM1kBhjGVOT5HC48="
-  },
-  {
-    "pname": "Microsoft.Extensions.Configuration.FileExtensions",
-    "version": "8.0.1",
-    "hash": "sha256-iRA8L7BX/fe5LHCVOhzBSk30GfshP7V2Qj2nxpEvStA="
-  },
-  {
-    "pname": "Microsoft.Extensions.Configuration.Json",
-    "version": "8.0.1",
-    "hash": "sha256-J8EK/yhsfTpeSUY8F81ZTBV9APHiPUliN7d+n2OX9Ig="
-  },
-  {
-    "pname": "Microsoft.Extensions.Configuration.UserSecrets",
-    "version": "8.0.1",
-    "hash": "sha256-yGvWfwBhyFudcIv96pKWaQ1MIMOiv5LHSCn+9J7Doz0="
-  },
   {
     "pname": "Microsoft.Extensions.DependencyInjection",
     "version": "8.0.1",
@@ -149,11 +84,6 @@
     "version": "9.0.5",
     "hash": "sha256-JSGmzV9CdZaRIBDbnUXCMlrIk2oVnrQSCL79xoNmjeY="
   },
-  {
-    "pname": "Microsoft.Extensions.DependencyModel",
-    "version": "8.0.2",
-    "hash": "sha256-PyuO/MyCR9JtYqpA1l/nXGh+WLKCq34QuAXN9qNza9Q="
-  },
   {
     "pname": "Microsoft.Extensions.Diagnostics",
     "version": "8.0.1",
@@ -164,31 +94,6 @@
     "version": "8.0.1",
     "hash": "sha256-d5DVXhA8qJFY9YbhZjsTqs5w5kDuxF5v+GD/WZR1QL0="
   },
-  {
-    "pname": "Microsoft.Extensions.FileProviders.Abstractions",
-    "version": "8.0.0",
-    "hash": "sha256-uQSXmt47X2HGoVniavjLICbPtD2ReQOYQMgy3l0xuMU="
-  },
-  {
-    "pname": "Microsoft.Extensions.FileProviders.Physical",
-    "version": "8.0.0",
-    "hash": "sha256-29y5ZRQ1ZgzVOxHktYxyiH40kVgm5un2yTGdvuSWnRc="
-  },
-  {
-    "pname": "Microsoft.Extensions.FileSystemGlobbing",
-    "version": "8.0.0",
-    "hash": "sha256-+Oz41JR5jdcJlCJOSpQIL5OMBNi+1Hl2d0JUHfES7sU="
-  },
-  {
-    "pname": "Microsoft.Extensions.Hosting",
-    "version": "8.0.1",
-    "hash": "sha256-FFLo6em0N2vaWg6//vaQhxoOgT9LLH5Y2KWkCeX5xQ4="
-  },
-  {
-    "pname": "Microsoft.Extensions.Hosting.Abstractions",
-    "version": "8.0.1",
-    "hash": "sha256-/bIVL9uvBQhV/KQmjA1ZjR74sMfaAlBb15sVXsGDEVA="
-  },
   {
     "pname": "Microsoft.Extensions.Http",
     "version": "8.0.1",
@@ -214,31 +119,6 @@
     "version": "9.0.5",
     "hash": "sha256-ILcK06TEbVwxUZ3PCpGkjg69H6PGwTXnN512JJ8F9KI="
   },
-  {
-    "pname": "Microsoft.Extensions.Logging.Configuration",
-    "version": "8.0.1",
-    "hash": "sha256-E2JbJG2EXlv2HUWLi17kIkAL6RC9rC2E18C3gAyOuaE="
-  },
-  {
-    "pname": "Microsoft.Extensions.Logging.Console",
-    "version": "8.0.1",
-    "hash": "sha256-2thhF1JbDNj3Bx2fcH7O26uHGNeMd9MYah6N60lIpIU="
-  },
-  {
-    "pname": "Microsoft.Extensions.Logging.Debug",
-    "version": "8.0.1",
-    "hash": "sha256-gKFqBg5lbjy5VBEcAuoQ/SsXAxvrYdBYOu9dV60eJKg="
-  },
-  {
-    "pname": "Microsoft.Extensions.Logging.EventLog",
-    "version": "8.0.1",
-    "hash": "sha256-1UkEOwl3Op2b3jTvpI10hHxIe9FqeVVy+VB1tZp6Lc8="
-  },
-  {
-    "pname": "Microsoft.Extensions.Logging.EventSource",
-    "version": "8.0.1",
-    "hash": "sha256-EINT/PgfB4Dvf+1JBzL1plPT35ezT7kyS8y/XMMgYxA="
-  },
   {
     "pname": "Microsoft.Extensions.Options",
     "version": "6.0.0",
@@ -279,71 +159,11 @@
     "version": "9.0.5",
     "hash": "sha256-3ctJMOwnEsBSNqcrh77IItX2wtOmjM/b8OTXJUZ/P0o="
   },
-  {
-    "pname": "Microsoft.NET.Test.Sdk",
-    "version": "17.14.1",
-    "hash": "sha256-mZUzDFvFp7x1nKrcnRd0hhbNu5g8EQYt8SKnRgdhT/A="
-  },
   {
     "pname": "Microsoft.OpenApi",
     "version": "1.6.23",
     "hash": "sha256-YD2oxM/tlNpK5xUeHF85xdqcpBzHioUSyRjpN2A7KcY="
   },
-  {
-    "pname": "Microsoft.Testing.Extensions.Telemetry",
-    "version": "1.9.0",
-    "hash": "sha256-JT91ThKLEyoRS/8ZJqZwlSTT7ofC2QhNqPFI3pYmMaw="
-  },
-  {
-    "pname": "Microsoft.Testing.Extensions.TrxReport.Abstractions",
-    "version": "1.9.0",
-    "hash": "sha256-oscZOEKw7gM6eRdDrOS3x+CwqIvXWRmfmi0ugCxBRw0="
-  },
-  {
-    "pname": "Microsoft.Testing.Extensions.VSTestBridge",
-    "version": "1.9.0",
-    "hash": "sha256-CadXLWD093sUDaWhnppzD9LvpxSRqqt93ZEOFiIAPyw="
-  },
-  {
-    "pname": "Microsoft.Testing.Platform",
-    "version": "1.9.0",
-    "hash": "sha256-6nzjoYbJOh7v/GB7d+TDuM0l/xglCshFX6KWjg7+cFI="
-  },
-  {
-    "pname": "Microsoft.Testing.Platform.MSBuild",
-    "version": "1.9.0",
-    "hash": "sha256-/bileP4b+9RZp8yjgS6eynXwc2mohyyzf6p/0LZJd8I="
-  },
-  {
-    "pname": "Microsoft.TestPlatform.AdapterUtilities",
-    "version": "17.13.0",
-    "hash": "sha256-Vr+3Tad/h/nk7f/5HMExn3HvCGFCarehFAzJSfCBaOc="
-  },
-  {
-    "pname": "Microsoft.TestPlatform.ObjectModel",
-    "version": "17.13.0",
-    "hash": "sha256-6S0fjfj8vA+h6dJVNwLi6oZhYDO/I/6hBZaq2VTW+Uk="
-  },
-  {
-    "pname": "Microsoft.TestPlatform.ObjectModel",
-    "version": "17.14.1",
-    "hash": "sha256-QMf6O+w0IT+16Mrzo7wn+N20f3L1/mDhs/qjmEo1rYs="
-  },
-  {
-    "pname": "Microsoft.TestPlatform.TestHost",
-    "version": "17.14.1",
-    "hash": "sha256-1cxHWcvHRD7orQ3EEEPPxVGEkTpxom1/zoICC9SInJs="
-  },
-  {
-    "pname": "Moq",
-    "version": "4.20.72",
-    "hash": "sha256-+uAc/6xtzij9YnmZrhZwc+4vUgx6cppZsWQli3CGQ8o="
-  },
-  {
-    "pname": "Newtonsoft.Json",
-    "version": "13.0.3",
-    "hash": "sha256-hy/BieY4qxBWVVsDqqOPaLy1QobiIapkbrESm6v2PHc="
-  },
   {
     "pname": "Newtonsoft.Json",
     "version": "13.0.4",
@@ -356,28 +176,13 @@
   },
   {
     "pname": "NSwag.ApiDescription.Client",
-    "version": "13.20.0",
-    "hash": "sha256-r/BtE46yFdM9MuoaVYNhO7vvdBICDsM8ROXZldxFIeY="
+    "version": "14.6.3",
+    "hash": "sha256-razR+CaeTvCob8IaRkg9MKgfcChqAqjBa8At05V9lxQ="
   },
   {
     "pname": "NSwag.MSBuild",
-    "version": "13.20.0",
-    "hash": "sha256-HarUF6peOsd12saco8+Na4TnOEh+Gl2MJelSfnBVRhQ="
-  },
-  {
-    "pname": "NUnit",
-    "version": "4.4.0",
-    "hash": "sha256-5geF5QOF+X/WkuCEgkPVKH4AdKx4U0olpU07S8+G3nU="
-  },
-  {
-    "pname": "NUnit.Analyzers",
-    "version": "4.10.0",
-    "hash": "sha256-wkThcI2ratJoCnstOIj/jB5muGQbdDPFbRK1r7PHEBU="
-  },
-  {
-    "pname": "NUnit3TestAdapter",
-    "version": "5.2.0",
-    "hash": "sha256-ybTutL4VkX/fq61mS+O3Ruh+adic4fpv+MKgQ0IZvGg="
+    "version": "14.6.3",
+    "hash": "sha256-6hzKfptXAXCCs2nM1UuN4cSBzZxDVoFWvFt5ypOTDxw="
   },
   {
     "pname": "OpenWeatherMap.API",
@@ -404,46 +209,11 @@
     "version": "8.1.4",
     "hash": "sha256-zkVzBxkxGh5WyhFEOiZknez9GBeBKXTH2ySf2/BnSV4="
   },
-  {
-    "pname": "System.Collections.Immutable",
-    "version": "8.0.0",
-    "hash": "sha256-F7OVjKNwpqbUh8lTidbqJWYi476nsq9n+6k0+QVRo3w="
-  },
-  {
-    "pname": "System.Diagnostics.DiagnosticSource",
-    "version": "5.0.0",
-    "hash": "sha256-6mW3N6FvcdNH/pB58pl+pFSCGWgyaP4hfVtC/SMWDV4="
-  },
   {
     "pname": "System.Diagnostics.DiagnosticSource",
     "version": "9.0.5",
     "hash": "sha256-fB8970CWgKWI1UwAaDa9D2yaMUiQ74ULGU7GMsr2u/o="
   },
-  {
-    "pname": "System.Diagnostics.EventLog",
-    "version": "6.0.0",
-    "hash": "sha256-zUXIQtAFKbiUMKCrXzO4mOTD5EUphZzghBYKXprowSM="
-  },
-  {
-    "pname": "System.Diagnostics.EventLog",
-    "version": "8.0.1",
-    "hash": "sha256-zvqd72pwgcGoa1nH3ZT1C0mP9k53vFLJ69r5MCQ1saA="
-  },
-  {
-    "pname": "System.IO.Pipelines",
-    "version": "8.0.0",
-    "hash": "sha256-LdpB1s4vQzsOODaxiKstLks57X9DTD5D6cPx8DE1wwE="
-  },
-  {
-    "pname": "System.Reflection.Metadata",
-    "version": "1.6.0",
-    "hash": "sha256-JJfgaPav7UfEh4yRAQdGhLZF1brr0tUWPl6qmfNWq/E="
-  },
-  {
-    "pname": "System.Reflection.Metadata",
-    "version": "8.0.0",
-    "hash": "sha256-dQGC30JauIDWNWXMrSNOJncVa1umR1sijazYwUDdSIE="
-  },
   {
     "pname": "System.Runtime.CompilerServices.Unsafe",
     "version": "6.0.0",
diff --git a/pkgs/by-name/im/immichframe/package.nix b/pkgs/by-name/im/immichframe/package.nix
index dbc88fa3b41e..85e12a626778 100644
--- a/pkgs/by-name/im/immichframe/package.nix
+++ b/pkgs/by-name/im/immichframe/package.nix
@@ -3,47 +3,29 @@
   buildNpmPackage,
   dotnet-sdk,
   fetchFromGitHub,
-  fetchpatch,
   lib,
   nixosTests,
   writeShellApplication,
+  _experimental-update-script-combinators,
+  nix-update-script,
 }:
 
 let
-  version = "1.0.29.0";
+  version = "1.0.33.0";
   src = fetchFromGitHub {
     owner = "immichFrame";
     repo = "immichFrame";
-    rev = "v${version}";
-    hash = "sha256-YFh+/QWYYtQzBVJUyUuhhKqi9/5waWVX+lw/tov++ws=";
+    tag = "v${version}";
+    hash = "sha256-b8hfzNZJz9XCRO4UfzwK5OsrgqV2F5wnZlRH7h3Eo9Q=";
   };
 
-  publishApi = buildDotnetModule {
+  api = buildDotnetModule {
     pname = "immichframe";
     inherit version src;
     projectFile = "ImmichFrame.WebApi/ImmichFrame.WebApi.csproj";
     nugetDeps = ./deps.json;
     dotnet-runtime = dotnet-sdk.aspnetcore;
 
-    patches = [
-      # This not-yet-released commit has landed upstream. It adds a
-      # `IMMICHFRAME_CONFIG_PATH` environment variable for a "configurable"
-      # config path.
-      (fetchpatch {
-        name = "Configurable config path";
-        url = "https://github.com/immichFrame/ImmichFrame/commit/f6680f23bcf107ce27372dfb37809c0f92ebb2f2.patch";
-        hash = "sha256-dQnspQEKixQgBpCvNxrYL51z5wg5BhdN0uTuaXgKQZU=";
-      })
-      # This patch adds an `ApiKeyFile` option, which makes it possible to
-      # configure ImmichFrame without leaking secrets into your configuration.
-      # See [upstream PR](https://github.com/immichFrame/ImmichFrame/pull/511)
-      (fetchpatch {
-        name = "Add a `ApiKeyFile` option";
-        url = "https://github.com/immichFrame/ImmichFrame/commit/f5bb164170460b1020bfe6bce8e8abb3315e32e3.diff";
-        hash = "sha256-F3BVIxcu8Hm6wbWmzVnfgm6XvqdBw4IiS61CDQiMRVg=";
-      })
-    ];
-
     meta.mainProgram = "ImmichFrame.WebApi";
   };
 
@@ -54,7 +36,7 @@ let
     sourceRoot = "${src.name}/immichFrame.Web";
 
     npmBuildScript = "build";
-    npmDepsHash = "sha256-eOv3DlmHaI6hVCYTBzCtLWKD72/RM/KjCUDVUgb9jcg=";
+    npmDepsHash = "sha256-PjbbBpYYUHH4oucJuk0FCdJa0LzTlkQnjkZ5MLziqTY=";
 
     installPhase = ''
       runHook preInstall
@@ -71,10 +53,20 @@ writeShellApplication {
 
   text = ''
     cd ${frontend}
-    exec ${lib.getExe publishApi} "$@"
+    exec ${lib.getExe api} "$@"
   '';
 
-  passthru.tests = { inherit (nixosTests) immichframe; };
+  passthru = {
+    inherit api frontend;
+    updateScript = _experimental-update-script-combinators.sequence [
+      (nix-update-script { attrPath = "immichframe.api"; })
+      (nix-update-script {
+        attrPath = "immichframe.frontend";
+        extraArgs = [ "--version=skip" ];
+      })
+    ];
+    tests = { inherit (nixosTests) immichframe; };
+  };
 
   meta = {
     description = "Display your photos from Immich as a digital photo frame";
diff --git a/pkgs/by-name/jd/jdt-language-server/package.nix b/pkgs/by-name/jd/jdt-language-server/package.nix
index dbfa2cd31415..12d8628926d6 100644
--- a/pkgs/by-name/jd/jdt-language-server/package.nix
+++ b/pkgs/by-name/jd/jdt-language-server/package.nix
@@ -7,15 +7,15 @@
 }:
 
 let
-  timestamp = "202604151538";
+  timestamp = "202606262232";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "jdt-language-server";
-  version = "1.58.0";
+  version = "1.60.0";
 
   src = fetchurl {
     url = "https://download.eclipse.org/jdtls/milestones/${finalAttrs.version}/jdt-language-server-${finalAttrs.version}-${timestamp}.tar.gz";
-    hash = "sha256-Klu+VeyRtDJTkgUNxCLOrTIgokWbN2a+NeH/9FtKUNk=";
+    hash = "sha256-6UwwPYGY+XeTCANYJzh3H9GMUsVJKHhBC/IisaqB7x0=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/by-name/no/noto-fonts/package.nix b/pkgs/by-name/no/noto-fonts/package.nix
index 5a9f8246a9dd..2d2b9a549990 100644
--- a/pkgs/by-name/no/noto-fonts/package.nix
+++ b/pkgs/by-name/no/noto-fonts/package.nix
@@ -23,13 +23,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "noto-fonts${suffix}";
-  version = "2026.06.01";
+  version = "2026.07.01";
 
   src = fetchFromGitHub {
     owner = "notofonts";
     repo = "notofonts.github.io";
     tag = "noto-monthly-release-${finalAttrs.version}";
-    hash = "sha256-M23KadEl3Wf8GkT3cz63zDaJFOjHbYE+gRX/F5mS1Q8=";
+    hash = "sha256-bKuHct2pG7E6/vJYd/pdcRRHjcv0q8p4dJTKNYWUMtc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pi/pineapple-pictures/package.nix b/pkgs/by-name/pi/pineapple-pictures/package.nix
index 081107098eb5..a793c1f1e3d4 100644
--- a/pkgs/by-name/pi/pineapple-pictures/package.nix
+++ b/pkgs/by-name/pi/pineapple-pictures/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pineapple-pictures";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "BLumia";
     repo = "pineapple-pictures";
     rev = finalAttrs.version;
-    hash = "sha256-4vxD4UN5/MwIzmmQZOj7nmDwbIeGTuj+fLPgCEPLzrw=";
+    hash = "sha256-76DJsJLd7lZqear0FIarmTqL3mlqrrCdwxgXsYmDQNE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/po/podman-desktop/package.nix b/pkgs/by-name/po/podman-desktop/package.nix
index ca5c425cc6bf..d79a76e21065 100644
--- a/pkgs/by-name/po/podman-desktop/package.nix
+++ b/pkgs/by-name/po/podman-desktop/package.nix
@@ -3,7 +3,7 @@
   stdenv,
   fetchFromGitHub,
   makeBinaryWrapper,
-  electron_41,
+  electron_42,
   nodejs-slim_24,
   pnpm_10,
   fetchPnpmDeps,
@@ -22,12 +22,12 @@
 let
   nodejs-slim = nodejs-slim_24;
   pnpm = pnpm_10.override { inherit nodejs-slim; };
-  electron = electron_41;
+  electron = electron_42;
   appName = "Podman Desktop";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "podman-desktop";
-  version = "1.27.2";
+  version = "1.28.2";
 
   passthru.updateScript = _experimental-update-script-combinators.sequence [
     (nix-update-script { })
@@ -67,14 +67,14 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "podman-desktop";
     repo = "podman-desktop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HcT33KjWnoY/pGuolt0BZurxdaWgUTF0tuACE9flfCM=";
+    hash = "sha256-8pp1lxWduKZuxDXmq3GQQ7w10PUC9wR667gO6u9OhSI=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-FD5lXAgA6uJLRLbaiZDbmow6BEiF6DWCzryAzyMGKe8=";
+    hash = "sha256-llkgy+JDJRxTZXxXHxza3RKdACU/Yd9xiGJ5CyptXpY=";
   };
 
   patches = [
diff --git a/pkgs/by-name/qe/qemu/package.nix b/pkgs/by-name/qe/qemu/package.nix
index 5bd6c6e0f8c7..80362ffd6757 100644
--- a/pkgs/by-name/qe/qemu/package.nix
+++ b/pkgs/by-name/qe/qemu/package.nix
@@ -123,6 +123,9 @@
   minimal ? toolsOnly || userOnly,
   gitUpdater,
   qemu-utils, # for tests attribute
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 assert lib.assertMsg (
@@ -180,6 +183,9 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals hexagonSupport [ glib ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     darwin.sigtool
+
+    # TODO: Clean up on `staging`.
+    llvmPackages.lld
   ]
   ++ lib.optionals (!userOnly) [ dtc ];
 
@@ -425,6 +431,10 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s $out/bin/qemu-system-${stdenv.hostPlatform.qemuArch} $out/bin/qemu-kvm
   '';
 
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    NIX_CFLAGS_LINK = "-fuse-ld=lld";
+  };
+
   passthru = {
     qemu-system-i386 = "bin/qemu-system-i386";
     tests = lib.optionalAttrs (!toolsOnly) {
diff --git a/pkgs/by-name/sa/samrewritten/package.nix b/pkgs/by-name/sa/samrewritten/package.nix
index 4129393a225d..f2bb851b72e0 100644
--- a/pkgs/by-name/sa/samrewritten/package.nix
+++ b/pkgs/by-name/sa/samrewritten/package.nix
@@ -15,16 +15,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "samrewritten";
-  version = "1.4.3";
+  version = "1.4.4";
 
   src = fetchFromGitHub {
     owner = "PaulCombal";
     repo = "SamRewritten";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zfjAdInF/Sy9FRALlwGtEvp2K9xCReqpbMvVNPho+Ic=";
+    hash = "sha256-WYwuYNbapD0cIifQALtfgMNqXs5KMvaCsQqUdifJwf8=";
   };
 
-  cargoHash = "sha256-DWt98XoLBShfhfFu1mI7f5Ke/jDIjtllWSpYPS1Sygc=";
+  cargoHash = "sha256-dh4WPk6rU/HsUVJTMrMPsqKXpOmb/0LUAsGTbmdI6Ts=";
 
   # Tests require network access and a running Steam client. Skipping.
   doCheck = false;
diff --git a/pkgs/by-name/wx/wxwidgets_3_1/package.nix b/pkgs/by-name/wx/wxwidgets_3_1/package.nix
index 17b1d60e360f..bea53d1e25e1 100644
--- a/pkgs/by-name/wx/wxwidgets_3_1/package.nix
+++ b/pkgs/by-name/wx/wxwidgets_3_1/package.nix
@@ -23,6 +23,9 @@
   withWebKit ? stdenv.hostPlatform.isDarwin,
   webkitgtk_4_1,
   libpng,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -45,7 +48,11 @@ stdenv.mkDerivation (finalAttrs: {
     ./0002-support-webkitgtk-41.patch
   ];
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+  ]
+  # TODO: Clean up on `staging`.
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
 
   buildInputs = [
     gst_all_1.gst-plugins-base
@@ -89,12 +96,17 @@ stdenv.mkDerivation (finalAttrs: {
     "--enable-webviewwebkit"
   ];
 
-  env = lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
-    SEARCH_LIB = toString [
-      "${libGLU.out}/lib"
-      "${libGL.out}/lib"
-    ];
-  };
+  env =
+    lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
+      SEARCH_LIB = toString [
+        "${libGLU.out}/lib"
+        "${libGL.out}/lib"
+      ];
+    }
+    # TODO: Clean up on `staging`.
+    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+      NIX_CFLAGS_LINK = "-fuse-ld=lld";
+    };
 
   preConfigure = ''
     substituteInPlace configure --replace \
diff --git a/pkgs/by-name/wx/wxwidgets_3_2/package.nix b/pkgs/by-name/wx/wxwidgets_3_2/package.nix
index bc33af7fc265..ca05463f928f 100644
--- a/pkgs/by-name/wx/wxwidgets_3_2/package.nix
+++ b/pkgs/by-name/wx/wxwidgets_3_2/package.nix
@@ -29,6 +29,9 @@
   withMesa ? !stdenv.hostPlatform.isDarwin,
   withWebKit ? true,
   webkitgtk_4_1,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 let
   catch = fetchFromGitHub {
@@ -56,7 +59,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-mYMUW3FnFkKHDQXb/k9UosSiWCPW7OQn+/orwq4Q95k=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+  ]
+  # TODO: Clean up on `staging`.
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
 
   buildInputs = [
     gst_all_1.gst-plugins-base
@@ -114,12 +121,17 @@ stdenv.mkDerivation (finalAttrs: {
     "--enable-webviewwebkit"
   ];
 
-  env = lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
-    SEARCH_LIB = toString [
-      "${libGLU.out}/lib"
-      "${libGL.out}/lib"
-    ];
-  };
+  env =
+    lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
+      SEARCH_LIB = toString [
+        "${libGLU.out}/lib"
+        "${libGL.out}/lib"
+      ];
+    }
+    # TODO: Clean up on `staging`.
+    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+      NIX_CFLAGS_LINK = "-fuse-ld=lld";
+    };
 
   preConfigure = ''
     cp -r ${catch}/* 3rdparty/catch/
diff --git a/pkgs/by-name/wx/wxwidgets_3_3/package.nix b/pkgs/by-name/wx/wxwidgets_3_3/package.nix
index 078dc6706c1d..8afa367df0fe 100644
--- a/pkgs/by-name/wx/wxwidgets_3_3/package.nix
+++ b/pkgs/by-name/wx/wxwidgets_3_3/package.nix
@@ -30,6 +30,9 @@
   withEGL ? true,
   withPrivateFonts ? false,
   webkitgtk_4_1,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -44,7 +47,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-UL1NuByKFGMQ/dhjuWRdnWTgdy4+1cD9pSls3e1mur8=";
   };
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+  ]
+  # TODO: Clean up on `staging`.
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
 
   buildInputs = [
     gst_all_1.gst-plugins-base
@@ -103,12 +110,17 @@ stdenv.mkDerivation (finalAttrs: {
     "--enable-webviewwebkit"
   ];
 
-  env = lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
-    SEARCH_LIB = toString [
-      "${libGLU.out}/lib"
-      "${libGL.out}/lib"
-    ];
-  };
+  env =
+    lib.optionalAttrs (!stdenv.hostPlatform.isDarwin) {
+      SEARCH_LIB = toString [
+        "${libGLU.out}/lib"
+        "${libGL.out}/lib"
+      ];
+    }
+    # TODO: Clean up on `staging`.
+    // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+      NIX_CFLAGS_LINK = "-fuse-ld=lld";
+    };
 
   postInstall = "
     pushd $out/include
diff --git a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
index 7686093f4d75..e3f60553ee63 100644
--- a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
@@ -89,6 +89,9 @@
   # options
   qttranslations ? null,
   fetchpatch,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 let
@@ -197,7 +200,11 @@ stdenv.mkDerivation {
     cmake
     ninja
   ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [ moveBuildTree ];
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    moveBuildTree
+    # TODO: Clean up on `staging`.
+    llvmPackages.lld
+  ];
 
   propagatedNativeBuildInputs = [
     lndir
@@ -312,6 +319,8 @@ stdenv.mkDerivation {
     # When this variable is not set, cmake tries to execute xcodebuild
     # to query the version.
     "-DQT_INTERNAL_XCODE_VERSION=0.1"
+    # TODO: Clean up on `staging`.
+    (lib.cmakeFeature "CMAKE_LINKER_TYPE" "LLD")
   ]
   ++ lib.optionals isCrossBuild [
     "-DQT_HOST_PATH=${pkgsBuildBuild.qt6.qtbase}"
diff --git a/pkgs/development/python-modules/alexapy/default.nix b/pkgs/development/python-modules/alexapy/default.nix
index dde0bffb92cf..b0e6e8d08cf0 100644
--- a/pkgs/development/python-modules/alexapy/default.nix
+++ b/pkgs/development/python-modules/alexapy/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "alexapy";
-  version = "1.29.24";
+  version = "1.29.25";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "keatontaylor";
     repo = "alexapy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-a50J5+xT9kfXTiTY1KuLp9l3qw161KFZ9nwDolkro5U=";
+    hash = "sha256-P/hvgqZVaBJF5dbmHrDjQMC+pwV3EEhKyFIS5KmhgD4=";
   };
 
   pythonRelaxDeps = [ "aiofiles" ];
diff --git a/pkgs/development/python-modules/matplotlib/default.nix b/pkgs/development/python-modules/matplotlib/default.nix
index ab1d363fc6ab..bee69a777e5e 100644
--- a/pkgs/development/python-modules/matplotlib/default.nix
+++ b/pkgs/development/python-modules/matplotlib/default.nix
@@ -62,6 +62,9 @@
 
   # Reverse dependency
   sage,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 let
@@ -104,7 +107,12 @@ buildPythonPackage (finalAttrs: {
         --replace-fail libwayland-client.so.0 ${wayland}/lib/libwayland-client.so.0
     '';
 
-  nativeBuildInputs = [ pkg-config ] ++ lib.optionals enableGtk3 [ gobject-introspection ];
+  nativeBuildInputs = [
+    pkg-config
+  ]
+  ++ lib.optionals enableGtk3 [ gobject-introspection ]
+  # TODO: Clean up on `staging`.
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];
 
   buildInputs = [
     ffmpeg-headless
@@ -160,6 +168,11 @@ buildPythonPackage (finalAttrs: {
     b_lto = false;
   };
 
+  # TODO: Clean up on `staging`.
+  env.${if stdenv.hostPlatform.isDarwin then "CC_LD" else null} = "lld";
+  env.${if stdenv.hostPlatform.isDarwin then "CXX_LD" else null} = "lld";
+  env.${if stdenv.hostPlatform.isDarwin then "OBJC_LD" else null} = "lld";
+
   passthru.tests = {
     inherit sage;
   };
diff --git a/pkgs/development/python-modules/pyobjc-core/default.nix b/pkgs/development/python-modules/pyobjc-core/default.nix
index e07a01289f74..278ad48196d8 100644
--- a/pkgs/development/python-modules/pyobjc-core/default.nix
+++ b/pkgs/development/python-modules/pyobjc-core/default.nix
@@ -4,6 +4,9 @@
   fetchFromGitHub,
   lib,
   setuptools,
+
+  # TODO: Clean up on `staging`.
+  llvmPackages,
 }:
 
 buildPythonPackage rec {
@@ -28,6 +31,9 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     darwin.DarwinTools # sw_vers
+
+    # TODO: Clean up on `staging`.
+    llvmPackages.lld
   ];
 
   env.NIX_CFLAGS_COMPILE = toString [
@@ -36,6 +42,9 @@ buildPythonPackage rec {
     "-Wno-error=unused-command-line-argument"
   ];
 
+  # TODO: Clean up on `staging`.
+  env.NIX_CFLAGS_LINK = "-fuse-ld=lld";
+
   pythonImportsCheck = [ "objc" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/shodan/default.nix b/pkgs/development/python-modules/shodan/default.nix
index f841021fa370..908f9cb25171 100644
--- a/pkgs/development/python-modules/shodan/default.nix
+++ b/pkgs/development/python-modules/shodan/default.nix
@@ -10,17 +10,22 @@
   xlsxwriter,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "shodan";
   version = "1.31.0";
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "shodan";
+    inherit (finalAttrs) version;
     hash = "sha256-xzJ1OG6gI5DhlsNcZgcGoo3U1TfFoh6zh6tiNvrCUfY=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     click-plugins
     colorama
     requests
@@ -38,11 +43,11 @@ buildPythonPackage rec {
     description = "Python library and command-line utility for Shodan";
     mainProgram = "shodan";
     homepage = "https://github.com/achillean/shodan-python";
-    changelog = "https://github.com/achillean/shodan-python/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/achillean/shodan-python/blob/${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       fab
       lihop
     ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/xarray/default.nix b/pkgs/development/python-modules/xarray/default.nix
index b0e9e537cd56..d9f1f5464274 100644
--- a/pkgs/development/python-modules/xarray/default.nix
+++ b/pkgs/development/python-modules/xarray/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
 
   # build-system
   setuptools,
@@ -51,6 +52,22 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-BsgL+Xo9fTMLLdz5AfScnKGuBa76cE85LuUzB4ZNLiY=";
   };
 
+  patches = [
+    # Performance fix
+    (fetchpatch {
+      url = "https://github.com/pydata/xarray/commit/b8bfeca3275045ca82adc3401c38444b1ed12c4a.patch";
+      hash = "sha256-KzN45MqOBPMNEmoG+rb3iwrk/7XFLlTNktQf5uYBWNo=";
+    })
+    # Fix tests with numpy >= 2.5.0
+    (fetchpatch {
+      url = "https://github.com/pydata/xarray/commit/c3a398e856f7fcff1c18bc72bfd1ab9c64d5a2e7.patch";
+      excludes = [
+        "doc/whats-new.rst"
+      ];
+      hash = "sha256-TakZ9RrJHeRksT3oBe7AKyfrjZeZ4oSmbE8axh7EmGg=";
+    })
+  ];
+
   postPatch = ''
     # don't depend on pytest-mypy-plugins
     sed -i "/--mypy-/d" pyproject.toml