diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index fd46bd25461c..3c6075bbec2a 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -26304,6 +26304,12 @@
     github = "snpschaaf";
     githubId = 105843013;
   };
+  sntx = {
+    name = "sntx";
+    email = "sntx@sntx.space";
+    github = "Sntx626";
+    githubId = 48636286;
+  };
   snu = {
     email = "kabelfrickler@gmail.com";
     github = "snue";
diff --git a/nixos/modules/services/video/wivrn.nix b/nixos/modules/services/video/wivrn.nix
index 82f923f13b0f..82e356d419d4 100644
--- a/nixos/modules/services/video/wivrn.nix
+++ b/nixos/modules/services/video/wivrn.nix
@@ -201,6 +201,8 @@ in
           # Exec path isn't absolute, it will be resolved relative to $PATH, so we must
           # not override the value of $PATH.
           enableDefaultPath = false;
+
+          unitConfig.ConditionUser = "!@system";
           serviceConfig = (
             if cfg.highPriority then
               {
diff --git a/nixos/tests/systemd-machinectl.nix b/nixos/tests/systemd-machinectl.nix
index 4b6c8febbb04..8a525a036977 100644
--- a/nixos/tests/systemd-machinectl.nix
+++ b/nixos/tests/systemd-machinectl.nix
@@ -106,6 +106,8 @@ let
       }
     ];
 
+    extraCommands = "mkdir -p usr";
+
     contents = [
       {
         source = containerSystem + "/etc/os-release";
@@ -171,6 +173,7 @@ in
 
       systemd.tmpfiles.rules = [
         "d /var/lib/machines/shared-decl 0755 root root - -"
+        "d /var/lib/machines/shared-decl/usr 0755 root root - -"
       ];
       systemd.nspawn.shared-decl = {
         execConfig = {
@@ -228,7 +231,7 @@ in
     machine.wait_until_succeeds("systemctl -M shared-decl is-active default.target");
     machine.succeed("machinectl stop shared-decl");
 
-    machine.succeed("mkdir -p ${containerRoot}");
+    machine.succeed("mkdir -p ${containerRoot}/usr");
 
     # start container with shared nix store by using same arguments as for systemd-nspawn@.service
     machine.succeed("systemd-run systemd-nspawn --machine=${containerName} --network-veth -U --bind-ro=/nix/store ${containerSystem}/init")
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 9eb3c73eaaed..ec930367a355 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -446,12 +446,12 @@ final: prev: {
 
   SchemaStore-nvim = buildVimPlugin {
     pname = "SchemaStore.nvim";
-    version = "0-unstable-2026-07-06";
+    version = "0-unstable-2026-07-07";
     src = fetchFromGitHub {
       owner = "b0o";
       repo = "SchemaStore.nvim";
-      rev = "4504f8f389c44561e10027e68000cbe000129727";
-      hash = "sha256-GvIyqf5GVCR2wkS5G1+IN4KIkLxaO/nsCXECU41DdW4=";
+      rev = "e954496f8ef22904e8a84f5078f4a110fdc7a0d3";
+      hash = "sha256-b8HOclkr3FoCNUDJ6f0ULsfyiQB38+9PNxl0CibVL60=";
     };
     meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -798,12 +798,12 @@ final: prev: {
 
   agitator-nvim = buildVimPlugin {
     pname = "agitator.nvim";
-    version = "0-unstable-2026-02-26";
+    version = "0-unstable-2026-07-09";
     src = fetchFromGitHub {
       owner = "emmanueltouzery";
       repo = "agitator.nvim";
-      rev = "87949ff3610d502d178e25bdbe906942771922b8";
-      hash = "sha256-oT9xyB6ymkZnjgLwOoQdavntoCtTDB6Ts4dl+nLrwYQ=";
+      rev = "ceaf20e08b0d37ef6e63f38f7fac3f7d700ffede";
+      hash = "sha256-1b+/6fW9StBfxx3KiZxVjoZtPg5z+RK9cJi8HWiUdPo=";
     };
     meta.homepage = "https://github.com/emmanueltouzery/agitator.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -1638,12 +1638,12 @@ final: prev: {
 
   base46 = buildVimPlugin {
     pname = "base46";
-    version = "0-unstable-2026-01-16";
+    version = "0-unstable-2026-07-09";
     src = fetchFromGitHub {
       owner = "nvchad";
       repo = "base46";
-      rev = "884b990dcdbe07520a0892da6ba3e8d202b46337";
-      hash = "sha256-AUdBZbGcPDtixHMFms9Y0EyUdAXOzvcA2AbrRdYQ4ig=";
+      rev = "a972909f1d7ba798b93b56631bc2cd5e96ea40da";
+      hash = "sha256-7WqUWfziecAeGtbKBU6/FESY/pf56bEGKhvnxcm/gNI=";
     };
     meta.homepage = "https://github.com/nvchad/base46/";
     meta.license = unfree;
@@ -3484,12 +3484,12 @@ final: prev: {
 
   coc-nvim = buildVimPlugin {
     pname = "coc.nvim";
-    version = "0.0.82-unstable-2026-07-03";
+    version = "0.0.82-unstable-2026-07-07";
     src = fetchFromGitHub {
       owner = "neoclide";
       repo = "coc.nvim";
-      rev = "caff3ebadf920d3f2323ee6b9ac88a90ba5b02ba";
-      hash = "sha256-zF1y/MOicePWquCRUy6hCgIhIHiO8Z0p2zquZmyaXC8=";
+      rev = "0ff79c0056910e574af2b2aa31aa359065705c4b";
+      hash = "sha256-Pp+qMv4Inc4JsrK59XDS+5CX/F9bEd4Pp4Cb611K+lk=";
     };
     meta.homepage = "https://github.com/neoclide/coc.nvim/";
     meta.license = unfree;
@@ -4185,12 +4185,12 @@ final: prev: {
 
   coq_nvim = buildVimPlugin {
     pname = "coq_nvim";
-    version = "0-unstable-2026-06-29";
+    version = "0-unstable-2026-07-09";
     src = fetchFromGitHub {
       owner = "ms-jpq";
       repo = "coq_nvim";
-      rev = "6b2ba42652d935b4bc70707b9addb37e2d38ef20";
-      hash = "sha256-PKqpmhVez3M5+kuoLzMZS1GjAoQMjvLiAUDmlI0daEA=";
+      rev = "47a2b8157b05433268564672bd2e9667bb287c9d";
+      hash = "sha256-affL0j96Hp+Ffry2KF69dR2hQfLSY2kRYoexvd38r5A=";
     };
     meta.homepage = "https://github.com/ms-jpq/coq_nvim/";
     meta.license = getLicenseFromSpdxId "GPL-3.0-only";
@@ -4619,12 +4619,12 @@ final: prev: {
 
   ddc-ui-native = buildVimPlugin {
     pname = "ddc-ui-native";
-    version = "0-unstable-2026-04-30";
+    version = "0-unstable-2026-07-07";
     src = fetchFromGitHub {
       owner = "Shougo";
       repo = "ddc-ui-native";
-      rev = "4f409fc24e0c1ce2a99a2c055b6a216feef2f076";
-      hash = "sha256-hMsOqJ8Db2W15Z73jQDldwkRBbaI5p8gap8UqgKRNiY=";
+      rev = "7b946489962453c485b894c18dd8e81057dd8098";
+      hash = "sha256-p+jUxvJ7Wza9PtxHMJbwbHV7GZ1iPsfVGNwIYuiM938=";
     };
     meta.homepage = "https://github.com/Shougo/ddc-ui-native/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -4633,12 +4633,12 @@ final: prev: {
 
   ddc-ui-pum = buildVimPlugin {
     pname = "ddc-ui-pum";
-    version = "0-unstable-2025-08-26";
+    version = "0-unstable-2026-07-07";
     src = fetchFromGitHub {
       owner = "Shougo";
       repo = "ddc-ui-pum";
-      rev = "f7f334380e18af42297468b3cf696794bbfa2652";
-      hash = "sha256-kQ1fK65V0NtObqBy/FhcfACUGeI5Pk4t3Kw0BPpxChw=";
+      rev = "0679df221520576d07add3cf4219d478db110801";
+      hash = "sha256-6KRKuovKkYUdtyirZ/UNvtAZzgtVgc+EGVTETq2Hu2U=";
     };
     meta.homepage = "https://github.com/Shougo/ddc-ui-pum/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -5251,12 +5251,12 @@ final: prev: {
 
   diffview-plus-nvim = buildVimPlugin {
     pname = "diffview-plus.nvim";
-    version = "0.35";
+    version = "0.36";
     src = fetchFromGitHub {
       owner = "dlyongemallo";
       repo = "diffview-plus.nvim";
-      tag = "v0.35";
-      hash = "sha256-yoxylfQjTRrN95w+pgkBWLquBdb4knB5Sjplk2rcKVs=";
+      tag = "v0.36";
+      hash = "sha256-RBH06hWEW5fP80Sj48UhVT9KexLtm3xWZtdVH+rGWhY=";
     };
     meta.homepage = "https://github.com/dlyongemallo/diffview-plus.nvim/";
     meta.license = unfree;
@@ -7380,12 +7380,12 @@ final: prev: {
 
   helpview-nvim = buildVimPlugin {
     pname = "helpview.nvim";
-    version = "2.1.2-unstable-2026-05-14";
+    version = "2.2.0";
     src = fetchFromGitHub {
       owner = "OXY2DEV";
       repo = "helpview.nvim";
-      rev = "0057599e169ea6ffd53fef77f279cb13b61e174a";
-      hash = "sha256-F3mdFqzMZhdT0ag+d7Ze9Knv4NW9/YBGVjqRYcQpCCI=";
+      tag = "v2.2.0";
+      hash = "sha256-zWwgfikrE9bagMuFSo6XByprANqIJkx6g2567ZTOEYk=";
       fetchSubmodules = true;
     };
     meta.homepage = "https://github.com/OXY2DEV/helpview.nvim/";
@@ -11034,12 +11034,12 @@ final: prev: {
 
   neoconf-nvim = buildVimPlugin {
     pname = "neoconf.nvim";
-    version = "1.4.0-unstable-2026-07-02";
+    version = "1.4.0-unstable-2026-07-09";
     src = fetchFromGitHub {
       owner = "folke";
       repo = "neoconf.nvim";
-      rev = "6859959fa6322a48121d66aba7d4f3fe628a167d";
-      hash = "sha256-7oYpUrXAzPgUKvmZIgCuSpK3u4sV6SF4d9s38mt5i4g=";
+      rev = "f6c1c4832932d336feb77befa30074cd1a998f3d";
+      hash = "sha256-1IPVcaU+I2MRz+ATZ9nQafzccEHn9UfmaLkfR1YB2e0=";
     };
     meta.homepage = "https://github.com/folke/neoconf.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -11118,12 +11118,12 @@ final: prev: {
 
   neogit = buildVimPlugin {
     pname = "neogit";
-    version = "3.0.0-unstable-2026-07-06";
+    version = "3.0.0-unstable-2026-07-09";
     src = fetchFromGitHub {
       owner = "NeogitOrg";
       repo = "neogit";
-      rev = "6fc2fa890bd2031ed999c074daab0fb4feff20a5";
-      hash = "sha256-fJB5E05OJh01LNZ5wCv6GSymjB0GVia6nYP2ypIY7dM=";
+      rev = "a0847c4bea5a5f92a36e3f3bf7da99d7d685d3ac";
+      hash = "sha256-37iNw57kC+fFk+hEgHKd07+NNDKP2g0YAmLwPYw6NyQ=";
     };
     meta.homepage = "https://github.com/NeogitOrg/neogit/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -12254,12 +12254,12 @@ final: prev: {
 
   nvchad-ui = buildVimPlugin {
     pname = "nvchad-ui";
-    version = "0-unstable-2026-05-10";
+    version = "0-unstable-2026-07-09";
     src = fetchFromGitHub {
       owner = "nvchad";
       repo = "ui";
-      rev = "3e67e9d5325fd47fdbc90ca00a147db2f3525754";
-      hash = "sha256-bl2erzyZCZp9seb4E7o/SFsBUHwocVOmQNv0mbO5yR0=";
+      rev = "5cfd3c8f2c3e6603d52d8f6c0b715743bbb5270d";
+      hash = "sha256-TgBx2alqrazm2JSu4afsZ0tnKWHqpclpBly/0SxYpxs=";
     };
     meta.homepage = "https://github.com/nvchad/ui/";
     meta.license = getLicenseFromSpdxId "GPL-3.0-only";
@@ -13354,12 +13354,12 @@ final: prev: {
 
   nvim-origami = buildVimPlugin {
     pname = "nvim-origami";
-    version = "1.9-unstable-2026-07-03";
+    version = "1.9-unstable-2026-07-06";
     src = fetchFromGitHub {
       owner = "chrisgrieser";
       repo = "nvim-origami";
-      rev = "2ce07161353d8345966a2bee02408d012ca25df0";
-      hash = "sha256-eqzUYYCtIinlT5FD6OHWCmyNKX/SXmaJ/3J26ZDXjuI=";
+      rev = "02312301df125908031b27dc556adb4cd81893d6";
+      hash = "sha256-d9yY/4EMl+5wetAasjhVlee1l7GGxYdqKAA9ajxaHss=";
     };
     meta.homepage = "https://github.com/chrisgrieser/nvim-origami/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -14250,12 +14250,12 @@ final: prev: {
 
   oklch-color-picker-nvim = buildVimPlugin {
     pname = "oklch-color-picker.nvim";
-    version = "5.0.0";
+    version = "5.0.2";
     src = fetchFromGitHub {
       owner = "eero-lehtinen";
       repo = "oklch-color-picker.nvim";
-      tag = "v5.0.0";
-      hash = "sha256-KW30ECF4TT1uv6Mty2SFzg5COqy+2ocKTQ+B3EpCP10=";
+      tag = "v5.0.2";
+      hash = "sha256-cFCA/4xoY/P0h4aL2y6ZVdWiizhz1aRplE6RaQoxeYY=";
     };
     meta.homepage = "https://github.com/eero-lehtinen/oklch-color-picker.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -14530,12 +14530,12 @@ final: prev: {
 
   otter-nvim = buildVimPlugin {
     pname = "otter.nvim";
-    version = "2.14.5";
+    version = "2.14.6";
     src = fetchFromGitHub {
       owner = "jmbuhr";
       repo = "otter.nvim";
-      tag = "v2.14.5";
-      hash = "sha256-kTDFzud+Kx3YAI36QhEi+WjVkB6Owao7PdUBX3mLXKw=";
+      tag = "v2.14.6";
+      hash = "sha256-hfyZ9eG6dMbDzPtQ8wIrx4B3la2VQqnZuXS2eG9gaFU=";
     };
     meta.homepage = "https://github.com/jmbuhr/otter.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -15120,12 +15120,12 @@ final: prev: {
 
   project-nvim = buildVimPlugin {
     pname = "project.nvim";
-    version = "5.1.0-1";
+    version = "5.1.1-1";
     src = fetchFromGitHub {
       owner = "DrKJeff16";
       repo = "project.nvim";
-      tag = "v5.1.0-1";
-      hash = "sha256-V4GAh22phFQLEonJa/quLGP7IKxi+4Wtym1paC4yJfk=";
+      tag = "v5.1.1-1";
+      hash = "sha256-NmkKA9AH1uOgHSQT9S8RIFQrkrhkDvpKIfDqHGfzoFI=";
     };
     meta.homepage = "https://github.com/DrKJeff16/project.nvim/";
     meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -15737,12 +15737,12 @@ final: prev: {
 
   roslyn-nvim = buildVimPlugin {
     pname = "roslyn.nvim";
-    version = "0-unstable-2026-06-16";
+    version = "0-unstable-2026-07-08";
     src = fetchFromGitHub {
       owner = "seblyng";
       repo = "roslyn.nvim";
-      rev = "c4ef25973bcc30a2c8c8766711fbbdb3d02b70a3";
-      hash = "sha256-e0PNOBtjRcsCkbaJn2K2o7Tr1dSte0tOK1jQMWJ2XQ4=";
+      rev = "05ffc134f0b70ce2715c761745f1f78321fcfa9b";
+      hash = "sha256-LLD9Vm3E1Vmp8P5dF1TAzHvRyGxmjpYSOvGksmhtEHc=";
     };
     meta.homepage = "https://github.com/seblyng/roslyn.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -16731,12 +16731,12 @@ final: prev: {
 
   statuscol-nvim = buildVimPlugin {
     pname = "statuscol.nvim";
-    version = "0-unstable-2025-06-02";
+    version = "0-unstable-2026-07-09";
     src = fetchFromGitHub {
       owner = "luukvbaal";
       repo = "statuscol.nvim";
-      rev = "c46172d0911aa5d49ba5f39f4351d1bb7aa289cc";
-      hash = "sha256-nFEQRJ5V+0RskJoAVRPAe2yrkORMTg9Jm13ClTmTSgk=";
+      rev = "887b8a03ea3804628505c9002fd07bd06a3db2e0";
+      hash = "sha256-YZ+vXxTREp2OIxBQGt4pYP8hWcswM9XN5BlOSzd6g0Y=";
     };
     meta.homepage = "https://github.com/luukvbaal/statuscol.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -18236,12 +18236,12 @@ final: prev: {
 
   treewalker-nvim = buildVimPlugin {
     pname = "treewalker.nvim";
-    version = "0-unstable-2026-06-23";
+    version = "0-unstable-2026-07-07";
     src = fetchFromGitHub {
       owner = "aaronik";
       repo = "treewalker.nvim";
-      rev = "cfe3c69396233ddbbd6b581b00868985f78ffd9e";
-      hash = "sha256-8ZkgoFcFym7gXnB/k9yY94wKEkgNSlUNROIsUxTqr1s=";
+      rev = "228f9cd84e7ee45c72e4c9c5c0523e50f13ad520";
+      hash = "sha256-TSwvL0e4JmzjdcphNkft1G/leJ8VCEZ7f8xYNo9/q18=";
     };
     meta.homepage = "https://github.com/aaronik/treewalker.nvim/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -21108,12 +21108,12 @@ final: prev: {
 
   vim-go = buildVimPlugin {
     pname = "vim-go";
-    version = "1.29-unstable-2026-03-28";
+    version = "1.29-unstable-2026-07-08";
     src = fetchFromGitHub {
       owner = "fatih";
       repo = "vim-go";
-      rev = "f4b4ba17035aebcd222df90375c1cbb1dc4d8c5b";
-      hash = "sha256-0mmt7i8GImhVR2kmr8MOQHFybw8QDXVRrYVg/ty30zU=";
+      rev = "551d423ba27915d96721c8709702edd23bc2bb48";
+      hash = "sha256-ps2QQ6xyQpvfCZ+tTUTzBt3kxu7+VtDcvLnH2HS8pRY=";
     };
     meta.homepage = "https://github.com/fatih/vim-go/";
     meta.license = unfree;
@@ -24007,12 +24007,12 @@ final: prev: {
 
   vim-spirv = buildVimPlugin {
     pname = "vim-spirv";
-    version = "0.5.2-unstable-2026-07-03";
+    version = "0.5.2-unstable-2026-07-09";
     src = fetchFromGitHub {
       owner = "kbenzie";
       repo = "vim-spirv";
-      rev = "1e684449e2056206be74714e7a9c4880e1cc97fb";
-      hash = "sha256-rYPX5p06R1HNKSJry9b2FJbmwdd+bqSDIfmrn0dFWg4=";
+      rev = "34b44acbdbfffbfa161569fc255ac56e7f72ec1f";
+      hash = "sha256-yW/B8UqzfXlPpWVBTW5ROBq7UrJCqptM/4xKFdSnKhw=";
     };
     meta.homepage = "https://github.com/kbenzie/vim-spirv/";
     meta.license = getLicenseFromSpdxId "MIT";
@@ -26053,11 +26053,11 @@ final: prev: {
 
   zig-vim = buildVimPlugin {
     pname = "zig.vim";
-    version = "0-unstable-2026-07-02";
+    version = "0-unstable-2026-07-08";
     src = fetchgit {
       url = "https://codeberg.org/ziglang/zig.vim/";
-      rev = "e3becb683d29c6b15c7ecbbaa349431a1a3bd55d";
-      hash = "sha256-DEpTzpSm9ztgCwlJ6oZ2cLdVZ4IMzNUIvbCB7uTxqUs=";
+      rev = "71f3454efc5cf781aba507f709b921993d096731";
+      hash = "sha256-oiZv49qsZIHfB+OtxCYwC+CzpI1cJnEdyhDMZS3DGO8=";
     };
     meta.homepage = "https://codeberg.org/ziglang/zig.vim/";
     meta.license = unfree;
@@ -26066,12 +26066,12 @@ final: prev: {
 
   zk-nvim = buildVimPlugin {
     pname = "zk-nvim";
-    version = "0.4.9";
+    version = "0.4.10";
     src = fetchFromGitHub {
       owner = "zk-org";
       repo = "zk-nvim";
-      tag = "v0.4.9";
-      hash = "sha256-82MgzF6GCaOupMJ2+m6fHJmHUcTq5V/IdTFoIfXqx1I=";
+      tag = "v0.4.10";
+      hash = "sha256-/3M40vkIZ+O0FCk0K6bL8He6WapQ5s74RMxkoxhPM8A=";
     };
     meta.homepage = "https://github.com/zk-org/zk-nvim/";
     meta.license = getLicenseFromSpdxId "GPL-3.0-only";
diff --git a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
index 1bb99910e247..e6d1da26f2ca 100644
--- a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
@@ -21,26 +21,26 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-d9v6prKyua7/Hu/ZeFQDR5J4VvttDcwpTVbM3GxEJRA=";
+          hash = "sha256-OY34TyyPj0Vjc6rLdR7uaVYsgmCXQFTS/1+QLA9pGgk=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-W/oIsBjYv0C2pygo0KbGVDyoOCWYUA3j0Im5Opb9JAQ=";
+          hash = "sha256-A8CrNx6GfFmaFWe1Awck/2B0VuJhNX6HHI5YNSG1qVo=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-BgWV9hTYrAKICO3JV4g7Vuffeuo6e2sGbQHu/4xMSaI=";
+          hash = "sha256-egXg308OJWvMyMqLHiANNEIGCSza/yKPFIqWq1X6JdE=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-c79GFH3aCu7XrM/AodZGQgFCZ56wtJJHt3dGDNfwdQM=";
+          hash = "sha256-BmI7NTlKUVMnTBS8nf2jqYYSA+LT3qP9Yu5gQIv7Mxo=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.205";
+      version = "2.1.206";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 1776484988a6..27bc313a6e45 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -4231,8 +4231,8 @@ let
         mktplcRef = {
           publisher = "shardulm94";
           name = "trailing-spaces";
-          version = "0.4.1";
-          hash = "sha256-pLE1bfLRxjlm/kgU9nmtiPBOnP05giQnWq6bexrrIZY=";
+          version = "0.4.4";
+          hash = "sha256-L2WM021Jyyovy8KElkIspXc0MdHC9APsbPdX5hK4CIM=";
         };
         meta = {
           license = lib.licenses.mit;
diff --git a/pkgs/applications/emulators/libretro/cores/quicknes.nix b/pkgs/applications/emulators/libretro/cores/quicknes.nix
index 78151466a51c..a92cf4c454e5 100644
--- a/pkgs/applications/emulators/libretro/cores/quicknes.nix
+++ b/pkgs/applications/emulators/libretro/cores/quicknes.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "quicknes";
-  version = "0-unstable-2026-05-11";
+  version = "0-unstable-2026-07-06";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "QuickNES_Core";
-    rev = "a0ec494c417f365c578f3dacadb04383e4a99ade";
-    hash = "sha256-q1AS4mASF2gaiGyuM6a/Z57bp0DPRQADlM+snb3iNSg=";
+    rev = "26bb785c9deddb66a17717b21bb4e328f03ade32";
+    hash = "sha256-0W6kYAnRw7uVdjoFL+f4Y8Ut932NbsoEer5TTwf9rBk=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/snes9x2010.nix b/pkgs/applications/emulators/libretro/cores/snes9x2010.nix
index c332930e84f4..f328ea948094 100644
--- a/pkgs/applications/emulators/libretro/cores/snes9x2010.nix
+++ b/pkgs/applications/emulators/libretro/cores/snes9x2010.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore rec {
   core = "snes9x2010";
-  version = "0-unstable-2026-06-29";
+  version = "0-unstable-2026-07-07";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "snes9x2010";
-    rev = "8b34285807d4825a5ab34b67f0c9d0a780a955c8";
-    hash = "sha256-VF9ScwineHNAd7Poj6/U5KEL6uUMhXLmR8nJS9vDSXk=";
+    rev = "8b0d82d9a515b6c75bd46fd80c3e2e19b0780998";
+    hash = "sha256-wbfIbb5Bb78gb1N2L5g/Z3YzqzE3+0tVYVS/vyjtTzQ=";
   };
 
   makeFlags = [ "GIT_VERSION=${builtins.substring 0 7 src.rev}" ];
diff --git a/pkgs/by-name/ae/aeron/package.nix b/pkgs/by-name/ae/aeron/package.nix
index 43d8756ad455..1f949476e33d 100644
--- a/pkgs/by-name/ae/aeron/package.nix
+++ b/pkgs/by-name/ae/aeron/package.nix
@@ -2,676 +2,29 @@
   lib,
   stdenv,
   fetchMavenArtifact,
-  jdk11,
+  jdk17,
   makeWrapper,
 }:
 
 let
   pname = "aeron";
-  version = "1.49.0";
+  version = "1.50.2";
   groupId = "io.aeron";
 
-  aeronAll_1_49_0 = fetchMavenArtifact {
+  aeronAll = fetchMavenArtifact {
     inherit groupId;
+    inherit version;
     artifactId = "aeron-all";
-    version = "1.49.0";
-    hash = "sha256-n3qoLs+iYzrb95skr29DrpQPHsWBZL6IygnayNJ1s6Q=";
+    hash = "sha256-+H43UbfLvDcjYS5VRYea8v5PA3/d8SPYivd/aasv4wQ=";
   };
 
-  aeronSamples_1_49_0 = fetchMavenArtifact {
+  aeronSamples = fetchMavenArtifact {
     inherit groupId;
-    version = "1.49.0";
+    inherit version;
     artifactId = "aeron-samples";
-    hash = "sha256-ePhAUBebeZP5exfBOGpUTTntAeZIdsolPuyhpbv0GVo=";
+    hash = "sha256-mn07b6P8HcNuwRUcbzfXkCpP/7cPChZJVx5VbyT5xrw=";
   };
 
-  aeronAll_1_48_6 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.48.6";
-    hash = "sha256-IWURDka8Qudit1nN/aHi4DHOAxpj++/1iSAbI5QNaBg=";
-  };
-
-  aeronSamples_1_48_6 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.48.6";
-    artifactId = "aeron-samples";
-    hash = "sha256-L5DFzZSfBRSGZOxDkfX1CTYyRNawd8tJLQaLZzYQTew=";
-  };
-
-  aeronAll_1_48_5 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.48.5";
-    hash = "sha256-yPLTh8bYBRwG0y5Tc+Z9TSSoYZSe55RQOb22LbBL804=";
-  };
-
-  aeronSamples_1_48_5 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.48.5";
-    artifactId = "aeron-samples";
-    hash = "sha256-poxiGXdA2SWJQ1oFe8kh2q5T5GOytrxcAhkNv5k64Qo=";
-  };
-
-  aeronAll_1_48_4 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.48.4";
-    hash = "sha256-6a8rgdNPkbYqo8N/7tSS4LxDF1j0s4JvDlYNSUSgrog=";
-  };
-
-  aeronSamples_1_48_4 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.48.4";
-    artifactId = "aeron-samples";
-    hash = "sha256-nB5YqF+jd2C8f++1pH36aZNtuscfP5ZMKx/6W3iiz4I=";
-  };
-
-  aeronAll_1_48_3 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.48.3";
-    hash = "sha256-VEyowi5J7mJWQ+Xj8dO7iL2cHLkeEzcJZkk5yyuDeuU=";
-  };
-
-  aeronSamples_1_48_3 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.48.3";
-    artifactId = "aeron-samples";
-    hash = "sha256-/E7fF8Np8D3/DYHYLeRjLPkP3AQJ5kTYvZRsQmyUBzk=";
-  };
-
-  aeronAll_1_48_2 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.48.2";
-    hash = "sha256-PQFlitiG43NO8zx/JfXiu7R5x/cYU/o5/x9U4/CioEw=";
-  };
-
-  aeronSamples_1_48_2 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.48.2";
-    artifactId = "aeron-samples";
-    hash = "sha256-nQ4kv/nQV0zkDgCL716AtRzEK/FDenHZMFNOhgVkd3s=";
-  };
-
-  aeronAll_1_48_1 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.48.1";
-    hash = "sha256-ZRf4YZLxF1O6GhWpCFS/PJqIHyti3dHCXPoxuuiJEz0=";
-  };
-
-  aeronSamples_1_48_1 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.48.1";
-    artifactId = "aeron-samples";
-    hash = "sha256-wtCOtwtp6hQUm7SfCV5yP4bwxufs8kRgA4V9/LRoAls=";
-  };
-
-  aeronAll_1_48_0 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.48.0";
-    hash = "sha256-eUc9tdR6iOGivovzX00VxLuHvEcXMFKxs2oJqug+ayA=";
-  };
-
-  aeronSamples_1_48_0 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.48.0";
-    artifactId = "aeron-samples";
-    hash = "sha256-31WO354XNsR2sZNPoh9kCNfSTz/ZM44IoRnmsx1iwMU=";
-  };
-
-  aeronAll_1_47_7 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.47.7";
-    hash = "sha256-8j2nKjAjZ3tpGbCPtQ3opGL4y3vVR2kC5Wh8xQvVG8Q=";
-  };
-
-  aeronSamples_1_47_7 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.47.7";
-    artifactId = "aeron-samples";
-    hash = "sha256-zKan26LpNFOAst78qN0S9tmG59oKKowVphCYKfMu1lg=";
-  };
-
-  aeronAll_1_47_5 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.47.5";
-    hash = "sha256-Hi7I/N+L4l05rNjfqPf4fUEFOAzt8FWx5T9UDAdVOLI=";
-  };
-
-  aeronSamples_1_47_5 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.47.5";
-    artifactId = "aeron-samples";
-    hash = "sha256-VFFfZKosTfMx1/C8qgSZNpYGP9oqN2y+rcbyTNH7vYE=";
-  };
-
-  aeronAll_1_47_4 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.47.4";
-    hash = "sha256-PHc3vcRYI1rIJanrNyz7wCFE9znzPZMprPGO+oO8Tgc=";
-  };
-
-  aeronSamples_1_47_4 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.47.4";
-    artifactId = "aeron-samples";
-    hash = "sha256-z/FubK2sIDm8KtlaNwrO1nTlZrw+PC9tjGoiWbe7wBE=";
-  };
-
-  aeronAll_1_47_3 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.47.3";
-    hash = "sha256-K5pVvHY0jltueoEjTv8tr9z/EtTwkhLjgE9Qw+mtN50=";
-  };
-
-  aeronSamples_1_47_3 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.47.3";
-    artifactId = "aeron-samples";
-    hash = "sha256-6HU7ykfDXlrQCdB5hYjZsQV+s0yFybXKqN8QHkEqSrw=";
-  };
-
-  aeronAll_1_47_2 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.47.2";
-    hash = "sha256-qQAp3YcuIoxIJKgxoZ1ahNGRjS+b+Vr6PicN3S4xYUw=";
-  };
-
-  aeronSamples_1_47_2 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.47.2";
-    artifactId = "aeron-samples";
-    hash = "sha256-GVmAxQQZrfixMqylDh/TNXJk4cF0Z1Tg/iTaeohRrdw=";
-  };
-
-  aeronAll_1_47_1 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.47.1";
-    hash = "sha256-QoKJxdkrZ8P7JwCFUGZ1lukG/Q4MgwksAp1R5RdVea0=";
-  };
-
-  aeronSamples_1_47_1 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.47.1";
-    artifactId = "aeron-samples";
-    hash = "sha256-FPkDrp0vyStm62Kf+F160KTXhNu5CdaQaB48uJkNC78=";
-  };
-
-  aeronAll_1_47_0 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.47.0";
-    hash = "sha256-CfWsJBpk637o+CKkvpAMS+muEY/8tCh4SkEML8kYY1k=";
-  };
-
-  aeronSamples_1_47_0 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.47.0";
-    artifactId = "aeron-samples";
-    hash = "sha256-QVlBif/EmzFTB3XPLWXRdZME46Ipky+O300AH+kd9+M=";
-  };
-
-  aeronAll_1_46_9 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.46.9";
-    hash = "sha256-HlIZfQHb3lKE773cE3bWZfAmkUkHD9qhUqHwlPLSvrw=";
-  };
-
-  aeronSamples_1_46_9 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.46.9";
-    artifactId = "aeron-samples";
-    hash = "sha256-o1PcXx8/z+rDHzTP/zSK2LjLM1TRmqSxW/KtCNBzsuc=";
-  };
-
-  aeronAll_1_46_8 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.46.8";
-    hash = "sha256-+Y6kz+rvnzw4Q/K00Y1us3XQAkHpUSoe1nAS9yS6U4I=";
-  };
-
-  aeronSamples_1_46_8 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.46.8";
-    artifactId = "aeron-samples";
-    hash = "sha256-7kT+Ueg9RxrjKmLSfuUMpqbhUkGwGq0P3fpw2J1ruyg=";
-  };
-
-  aeronAll_1_46_7 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.46.7";
-    hash = "sha256-3tLtPFtzmR4xxDmnViopTl1VZvlVw6noEImiimtbnVU=";
-  };
-
-  aeronSamples_1_46_7 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.46.7";
-    artifactId = "aeron-samples";
-    hash = "sha256-XaG8r2a2xXRUqdgK491KOSlptSu7dM3vzEHAh91aBqI=";
-  };
-
-  aeronAll_1_46_6 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.46.6";
-    hash = "sha256-PMcXyzpjBkBC4qnb76D+22qPdgs7mhagZDWvGt9CXwk=";
-  };
-
-  aeronSamples_1_46_6 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.46.6";
-    artifactId = "aeron-samples";
-    hash = "sha256-JBf5531tiRY8w1lSPfic2TnepNln6CJ3PC9S56Fi68Q=";
-  };
-
-  aeronAll_1_46_5 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.46.5";
-    hash = "sha256-ozFVbbNqqYb+giORCtTkNBcn06F0Lfu12Eyd5r/E370=";
-  };
-
-  aeronSamples_1_46_5 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.46.5";
-    artifactId = "aeron-samples";
-    hash = "sha256-0U/Ye9VcCeCtpBdBE7JUaEHe4wsE+yoa+ndLPVJiuBs=";
-  };
-
-  aeronAll_1_46_4 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.46.4";
-    hash = "sha256-9TMGUZ9NUYMXihSFElifeqpJc0Sz7ks9NOcvjUSofaM=";
-  };
-
-  aeronSamples_1_46_4 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.46.4";
-    artifactId = "aeron-samples";
-    hash = "sha256-qo+HRhsdK/LLpAcZz4M4gxlngnokYIaJc1F/KMX8sDQ=";
-  };
-
-  aeronAll_1_46_3 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.46.3";
-    hash = "sha256-lToJIeTM84rAA/oiNqRNdYs5Ropfuw9WJ08Nb0m87MQ=";
-  };
-
-  aeronSamples_1_46_3 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.46.3";
-    artifactId = "aeron-samples";
-    hash = "sha256-MRNGUCOW3w7gctNLsle39Zus89RBS1ukc34o4pzHOnU=";
-  };
-
-  aeronAll_1_46_2 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.46.2";
-    hash = "sha256-2iwmx1X1gbjUabRyCR6Ek6iuDKhtvgEonwBdbF0h3MY=";
-  };
-
-  aeronSamples_1_46_2 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.46.2";
-    artifactId = "aeron-samples";
-    hash = "sha256-jv8tWpuuRnCQSlGGtd9ger562IF/5x0wSEtrlM1s1Ks=";
-  };
-
-  aeronAll_1_46_1 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.46.1";
-    hash = "sha256-KH2mt64ewpdwLOM7q95l0j3ftLOCu3uICcaVUXe/vyY=";
-  };
-
-  aeronSamples_1_46_1 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.46.1";
-    artifactId = "aeron-samples";
-    hash = "sha256-IF9dRX/EUUF8An/baMxb9iEXq/wZlvvgdzKIk2c8+aA=";
-  };
-
-  aeronAll_1_46_0 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.46.0";
-    hash = "sha256-ngFeYSDJxxqxawtGrALZrsjRO9WlPdnhdO9NuZKhPr8=";
-  };
-
-  aeronSamples_1_46_0 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.46.0";
-    artifactId = "aeron-samples";
-    hash = "sha256-arnWZD5znkrnn4usKG2R3gdUXljYKvoibFQ0b466iks=";
-  };
-
-  aeronAll_1_45_2 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.45.2";
-    hash = "sha256-m1FJwC+1ZZlCPTU9KksLq7ozP3X1v7/kZaCb/vFwveQ=";
-  };
-
-  aeronSamples_1_45_2 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.45.2";
-    artifactId = "aeron-samples";
-    hash = "sha256-RB51I7WjV19pT7FCUH9FVrcbt64vjPIjMjRxgLIzEjw=";
-  };
-
-  aeronAll_1_45_1 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.45.1";
-    hash = "sha256-cD50jk95OAcdPKJuc45t1O6WVRgM2j1gMZ5IudbL4U8=";
-  };
-
-  aeronSamples_1_45_1 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.45.1";
-    artifactId = "aeron-samples";
-    hash = "sha256-QSC5Yp35eJjUHByShdQWDP14jW1Y3pL3osLDGLsxsqg=";
-  };
-
-  aeronAll_1_45_0 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.45.0";
-    hash = "sha256-gImfORn61k1fVyqPfr5Uk2Hu5yPfnShCXIUB3qSuFnI=";
-  };
-
-  aeronSamples_1_45_0 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.45.0";
-    artifactId = "aeron-samples";
-    hash = "sha256-7o37/YzQHTBguTlpoIXFa8JNFtyG7zKKnVdijIqAeDY=";
-  };
-
-  aeronAll_1_44_7 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.44.7";
-    hash = "sha256-ZbM17fXbCZQWYjE1QG6MO506sMqth9ukD1an3RbxypA=";
-  };
-
-  aeronSamples_1_44_7 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.44.7";
-    artifactId = "aeron-samples";
-    hash = "sha256-vBtx5bN4JtOhvQwoHAof1Y7uLPiadQCNscw5eiaYDec=";
-  };
-
-  aeronAll_1_44_6 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.44.6";
-    hash = "sha256-FJSPOvjXgcuqQQn8VuXz87sj4qfN7Ayt0CHg6CE2uHA=";
-  };
-
-  aeronSamples_1_44_6 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.44.6";
-    artifactId = "aeron-samples";
-    hash = "sha256-9NKudRW06/Q7xg/tDaVixBy1J0Pv3Y6FGOq0oG/IXO0=";
-  };
-
-  aeronAll_1_44_5 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.44.5";
-    hash = "sha256-s9Jo2sU4obp6OrfLZjJvRlXYpyg3gsVnYH5xNQSjQSQ=";
-  };
-
-  aeronSamples_1_44_5 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.44.5";
-    artifactId = "aeron-samples";
-    hash = "sha256-hvRBaMoEM2KTHDXLruRnrUMi7VQH8QdDr79y1pLk/PA=";
-  };
-
-  aeronAll_1_44_4 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.44.4";
-    hash = "sha256-CfoB7zJ4ZWZXOvy7fZoCg5zCiHI+6CTxLd7UgWslC5I=";
-  };
-
-  aeronSamples_1_44_4 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.44.4";
-    artifactId = "aeron-samples";
-    hash = "sha256-ZGkYlQCV60R1Ua3ecqBkCD3CN2r+/opx1oI1lKsqC7w=";
-  };
-
-  aeronAll_1_44_3 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.44.3";
-    hash = "sha256-uqjLQUE6IEvGMwZqUOocL0NfK+dPIaQAJTAILIK6Kao=";
-  };
-
-  aeronSamples_1_44_3 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.44.3";
-    artifactId = "aeron-samples";
-    hash = "sha256-EfkhMx4iQIDqk3jnVf1oEvb21sN9GyLwJJjok619YW0=";
-  };
-
-  aeronAll_1_44_2 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.44.2";
-    hash = "sha256-C3xr8OeVVpnmE70j+5meawWg+56/FhIBqQm9BTwbOj4=";
-  };
-
-  aeronSamples_1_44_2 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.44.2";
-    artifactId = "aeron-samples";
-    hash = "sha256-laY1xdgaBwwCVdAUrJtrFW2rduguRdcpTaglcWa0jB0=";
-  };
-
-  aeronAll_1_44_1 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.44.1";
-    hash = "sha256-O80bWp7F6mRh3me1znzpfFfFEpvvMVjL4PrAt7+3Fq0=";
-  };
-
-  aeronSamples_1_44_1 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.44.1";
-    artifactId = "aeron-samples";
-    hash = "sha256-ZSuTed45BRzr4JJuGeXghUgEifv/FpnCzTNJWa+nwjo=";
-  };
-
-  aeronAll_1_44_0 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.44.0";
-    hash = "sha256-j7WXJaIQZPKOTLmZg+nGxLUowYAuZYj062pmxS0ycnk=";
-  };
-
-  aeronSamples_1_44_0 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.44.0";
-    artifactId = "aeron-samples";
-    hash = "sha256-DXsYKnFvQT2BRGZyLXIfLBxglZMFRKBG3VDXD0UITLU=";
-  };
-
-  aeronAll_1_43_0 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.43.0";
-    hash = "sha512-ZKjUA1Kp++RLnCNUOi2K/iGc4zIIR4pC4j8qPfO+rcgp7ghZfgsXO8sB+JD307kzeikUXnPFX7ef28DlzI8s8Q==";
-  };
-
-  aeronSamples_1_43_0 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.43.0";
-    artifactId = "aeron-samples";
-    hash = "sha512-a/ti4Kd8WwzOzDGMgdYk0pxsu8vRA4kRD9cm4D3S+r6xc/rL8ECHVoogOMDeabDd1EYSIbx/sKE01BJOW7BVsg==";
-  };
-
-  aeronAll_1_42_1 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.42.1";
-    hash = "sha512-pjX+JopK6onDwElMIroj+ZXrKwdPj5H2uPg08XgNlrK1rAkHo9MUT8weBGbuFVFDLeqOZrHj0bt1wJ9XgYY5aA==";
-  };
-
-  aeronSamples_1_42_1 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.42.1";
-    artifactId = "aeron-samples";
-    hash = "sha512-4JnHn22vJf2lmOg6ev5PD+/YiaL3KgfuyWAK92djX3KBVXO7ERMY2kH79dveVCJG1rbekvE1j1pnjaAIxwJcqg==";
-  };
-
-  aeronAll_1_42_0 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.42.0";
-    hash = "sha256-rcUKHUh2rsBvO8kn2x+wYFRuM9XV21hINwFG7ej6uyw=";
-  };
-
-  aeronSamples_1_42_0 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.42.0";
-    artifactId = "aeron-samples";
-    hash = "sha256-dmLEuEcgUuoEBEM0zW+c+0o6oOpIk+5FCzZgP5j1jXk=";
-  };
-
-  aeronAll_1_41_6 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.41.6";
-    hash = "sha256-YUfQ98lGEeGjl1LB12tP9fON+KycMUJFI7ntqsYa3O8=";
-  };
-
-  aeronSamples_1_41_6 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.41.6";
-    artifactId = "aeron-samples";
-    hash = "sha256-vaO2meykLq5aK6Y0DINcVCq920Qns8GCFu18CavCvis=";
-  };
-
-  aeronAll_1_41_5 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.41.5";
-    hash = "sha256-+yYOBwRsWgAtmDplB9dltU76wTX650KharSkMjWlG6M=";
-  };
-
-  aeronSamples_1_41_5 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.41.5";
-    artifactId = "aeron-samples";
-    hash = "sha256-1RHFDMtaAJHKNdz32Aeo6YplvoMDJerQRi10NUyp/OI=";
-  };
-
-  aeronAll_1_41_4 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.41.4";
-    hash = "sha256-Z06nAaCO1LU6ChNm4YnipuUNgusY7iY6WhV8AeBPRoE=";
-  };
-
-  aeronSamples_1_41_4 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.41.4";
-    artifactId = "aeron-samples";
-    hash = "sha256-9gyKDu7R/Q8HtkCR5D1ohZnVa1jIOv5Z0lgOcRIumCw=";
-  };
-
-  aeronAll_1_41_3 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.41.3";
-    hash = "sha256-aQ+oZ6oqi853fZfwRcGpgRsuEAfP7AJsu5C0pfwxlzU=";
-  };
-
-  aeronSamples_1_41_3 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.41.3";
-    artifactId = "aeron-samples";
-    hash = "sha256-FTiz5IrPoE1zWNjAym4ynjvny0p8uP7QzizK1jCJKgM=";
-  };
-
-  aeronAll_1_41_2 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.41.2";
-    hash = "sha256-0XSoKbFnhEwOlx0+9cJj/Qf6XAUjtskun9BwIq/WxW8=";
-  };
-
-  aeronSamples_1_41_2 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.41.2";
-    artifactId = "aeron-samples";
-    hash = "sha256-7ht2Jklvx3cfk2PopRjUVDQ0Uo+5M5262SI91ItS9Ow=";
-  };
-
-  aeronAll_1_41_1 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.41.1";
-    hash = "sha256-/JufYICrSefm9nGlVcfQHcUkYMnzrZcNDjB8fAfSKGE=";
-  };
-
-  aeronSamples_1_41_1 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.41.1";
-    artifactId = "aeron-samples";
-    hash = "sha256-6/o1t6/ehYYhMqU6pYQ0uScZhsZTuowr0uwJ3TbmtHk=";
-  };
-
-  aeronAll_1_41_0 = fetchMavenArtifact {
-    inherit groupId;
-    artifactId = "aeron-all";
-    version = "1.41.0";
-    hash = "sha256-g2dFf+htF72ByJCcjKuHtLuehLtjjjpqjvWq1rTkmYg=";
-  };
-
-  aeronSamples_1_41_0 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.41.0";
-    artifactId = "aeron-samples";
-    hash = "sha256-nUX9JM0p06m0XyH4ugPXQ0+Fc9ydmhJlaND+VUCZ788=";
-  };
-
-  aeronAll_1_40_0 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.40.0";
-    artifactId = "aeron-all";
-    hash = "sha512-NyhYaQqOWcSBwzwpje6DMAp36CEgGSNXBSdaRrDyP+Fn2Z0nvh5o2czog6GKKtbjH9inYfyyF/21gehfgLF6qA==";
-  };
-
-  aeronSamples_1_40_0 = fetchMavenArtifact {
-    inherit groupId;
-    version = "1.40.0";
-    artifactId = "aeron-samples";
-    hash = "sha512-vyAq4mfLDDyaVk7wcIpPvPcxSt92Ek8mxfuuZwaX+0Wu9oJCpwbnjvS9+bvzcE4qSGxzY6eJIIX6nMdw0LkACg==";
-  };
-
-  aeronAll = aeronAll_1_49_0;
-  aeronSamples = aeronSamples_1_49_0;
-
 in
 stdenv.mkDerivation {
 
@@ -702,7 +55,7 @@ stdenv.mkDerivation {
 
   postFixup = ''
     function wrap {
-      makeWrapper "${jdk11}/bin/java" "$out/bin/$1" \
+      makeWrapper "${jdk17}/bin/java" "$out/bin/$1" \
         --add-flags "--add-opens java.base/sun.nio.ch=ALL-UNNAMED" \
         --add-flags "--class-path ${aeronAll.jar}" \
         --add-flags "$2"
diff --git a/pkgs/by-name/al/alt-tab-macos/0001-replace-count-where-with-filter-.count-for-Swift-5.1.patch b/pkgs/by-name/al/alt-tab-macos/0001-replace-count-where-with-filter-.count-for-Swift-5.1.patch
new file mode 100644
index 000000000000..3d26fdb7a744
--- /dev/null
+++ b/pkgs/by-name/al/alt-tab-macos/0001-replace-count-where-with-filter-.count-for-Swift-5.1.patch
@@ -0,0 +1,39 @@
+From 85a2e0440f8af42ae02cf7fee1119255b2459016 Mon Sep 17 00:00:00 2001
+From: nixpkgs <nix@nixpkgs>
+Date: Fri, 10 Jul 2026 12:21:11 +0300
+Subject: [PATCH 1/4] replace count(where:) with filter{}.count for Swift 5.10
+
+---
+ src/events/TrackpadEvents.swift                | 2 +-
+ src/switcher/main-window/StatusIconsView.swift | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/events/TrackpadEvents.swift b/src/events/TrackpadEvents.swift
+index 2f1909df..5e187064 100644
+--- a/src/events/TrackpadEvents.swift
++++ b/src/events/TrackpadEvents.swift
+@@ -76,7 +76,7 @@ class TrackpadEvents {
+         // on macOS, the finger contact surface is not exposed in NSTouch, so we can't detect big contact == palm, for example
+         // the closest thing we can do to detect resting inputs is remove touches which have .phase == .stationary
+         let activeTouches = touches.filter { !$0.isResting && ($0.phase == .began || $0.phase == .moved) }
+-        let fingersDown = touches.count { $0.phase == .began || $0.phase == .moved || $0.phase == .stationary }
++        let fingersDown = touches.filter { $0.phase == .began || $0.phase == .moved || $0.phase == .stationary }.count
+         let requiredFingers = Preferences.nextWindowGesture.isThreeFinger() ? 3 : 4
+         if SwitcherSession.isActive {
+             handleEventIfAppIsBeingUsed(fingersDown, activeTouches, requiredFingers)
+diff --git a/src/switcher/main-window/StatusIconsView.swift b/src/switcher/main-window/StatusIconsView.swift
+index beeb2a54..2f35bddc 100644
+--- a/src/switcher/main-window/StatusIconsView.swift
++++ b/src/switcher/main-window/StatusIconsView.swift
+@@ -76,7 +76,7 @@ class StatusIconsView: FlippedView {
+         icons[Self.fullscreenIdx].visible = isFullscreen
+         icons[Self.minimizedIdx].visible = isMinimized
+         icons[Self.spaceIdx].visible = showSpace
+-        visibleCount = icons.count(where: { $0.visible })
++        visibleCount = icons.filter { $0.visible }.count
+     }
+ 
+     func setSpaceStar() {
+-- 
+2.55.0
+
diff --git a/pkgs/by-name/al/alt-tab-macos/0002-replace-.extraLarge-with-.large-for-macOS-14-SDK.patch b/pkgs/by-name/al/alt-tab-macos/0002-replace-.extraLarge-with-.large-for-macOS-14-SDK.patch
new file mode 100644
index 000000000000..15e284d6611f
--- /dev/null
+++ b/pkgs/by-name/al/alt-tab-macos/0002-replace-.extraLarge-with-.large-for-macOS-14-SDK.patch
@@ -0,0 +1,39 @@
+From 7313d220616e756c4bb4f2c8cc5cf6b6b2e4789c Mon Sep 17 00:00:00 2001
+From: nixpkgs <nix@nixpkgs>
+Date: Fri, 10 Jul 2026 12:21:11 +0300
+Subject: [PATCH 2/4] replace .extraLarge with .large for macOS 14 SDK
+
+---
+ src/preferences/settings-window/SettingsWindow.swift | 2 +-
+ src/switcher/main-window/TilesView.swift             | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/preferences/settings-window/SettingsWindow.swift b/src/preferences/settings-window/SettingsWindow.swift
+index 866329ea..44f1da76 100644
+--- a/src/preferences/settings-window/SettingsWindow.swift
++++ b/src/preferences/settings-window/SettingsWindow.swift
+@@ -462,7 +462,7 @@ class SettingsWindow: NSWindow {
+         searchField.sendsWholeSearchString = true
+         searchField.bezelStyle = .roundedBezel
+         if #available(macOS 26.0, *) {
+-            searchField.controlSize = .extraLarge
++            searchField.controlSize = .large
+         } else if #available(macOS 13.0, *) {
+             searchField.controlSize = .large
+         }
+diff --git a/src/switcher/main-window/TilesView.swift b/src/switcher/main-window/TilesView.swift
+index d6c7fb69..b6f374c9 100644
+--- a/src/switcher/main-window/TilesView.swift
++++ b/src/switcher/main-window/TilesView.swift
+@@ -142,7 +142,7 @@ class TilesView {
+         searchField.sendsWholeSearchString = true
+         searchField.bezelStyle = .roundedBezel
+         if #available(macOS 26.0, *) {
+-            searchField.controlSize = .extraLarge
++            searchField.controlSize = .large
+         } else if #available(macOS 13.0, *) {
+             searchField.controlSize = .large
+         } else {
+-- 
+2.55.0
+
diff --git a/pkgs/by-name/al/alt-tab-macos/0003-use-runtime-dispatch-for-Liquid-Glass-with-SDK-14.patch b/pkgs/by-name/al/alt-tab-macos/0003-use-runtime-dispatch-for-Liquid-Glass-with-SDK-14.patch
new file mode 100644
index 000000000000..ebd914a0bd0e
--- /dev/null
+++ b/pkgs/by-name/al/alt-tab-macos/0003-use-runtime-dispatch-for-Liquid-Glass-with-SDK-14.patch
@@ -0,0 +1,193 @@
+From 727f4c5aed5960bb429c7df0bbc3a547e05db7dd Mon Sep 17 00:00:00 2001
+From: nixpkgs <nix@nixpkgs>
+Date: Fri, 10 Jul 2026 12:21:12 +0300
+Subject: [PATCH 3/4] use runtime dispatch for Liquid Glass with SDK 14
+
+---
+ src/switcher/Appearance.swift                 |   2 +-
+ .../TilesPanelBackgroundView.swift            | 122 +++++++++++-------
+ 2 files changed, 77 insertions(+), 47 deletions(-)
+
+diff --git a/src/switcher/Appearance.swift b/src/switcher/Appearance.swift
+index dd033fa4..efb70c77 100644
+--- a/src/switcher/Appearance.swift
++++ b/src/switcher/Appearance.swift
+@@ -83,7 +83,7 @@ class Appearance {
+             lightTheme()
+         }
+         // for Liquid Glass, we don't want a shadow around the panel
+-        if #available(macOS 26.0, *), currentStyle == .appIcons && LiquidGlass.canUsePrivateLook {
++        if #available(macOS 26.0, *), currentStyle == .appIcons && LiquidGlassEffectView.canUsePrivateLook {
+             enablePanelShadow = false
+         } else {
+             enablePanelShadow = true
+diff --git a/src/switcher/main-window/TilesPanelBackgroundView.swift b/src/switcher/main-window/TilesPanelBackgroundView.swift
+index cea0819c..99d12b06 100644
+--- a/src/switcher/main-window/TilesPanelBackgroundView.swift
++++ b/src/switcher/main-window/TilesPanelBackgroundView.swift
+@@ -7,12 +7,81 @@ protocol EffectView: NSView {
+ }
+ 
+ @available(macOS 26.0, *)
+-extension NSGlassEffectView: EffectView {
+-    func updateAppearance() {
+-        cornerRadius = Appearance.windowCornerRadius
++class LiquidGlassEffectView: NSView, EffectView {
++    private typealias SetIntType = @convention(c) (AnyObject, Selector, Int) -> Void
++    private typealias SetCGFloatType = @convention(c) (AnyObject, Selector, CGFloat) -> Void
++    private typealias SetObjectType = @convention(c) (AnyObject, Selector, AnyObject) -> Void
++    private static let setVariantSelector = NSSelectorFromString("set_variant:")
++    private static let setStyleSelector = NSSelectorFromString("setStyle:")
++    private static let setCornerRadiusSelector = NSSelectorFromString("setCornerRadius:")
++    private static let setContentViewSelector = NSSelectorFromString("setContentView:")
++    private static let glassClass: AnyClass? = NSClassFromString("NSGlassEffectView")
++
++    static let canUsePrivateLook: Bool = {
++        guard let cls = glassClass else { return false }
++        return class_getInstanceMethod(cls, setVariantSelector) != nil
++    }()
++
++    private var glassView: NSView?
++    private var contentHost: NSView!
++
++    var hostView: NSView { contentHost }
++
++    convenience init(clear: Bool) {
++        self.init(frame: .zero)
++        wantsLayer = true
++        layer!.masksToBounds = true
++
++        let glass: NSView
++        if let cls = Self.glassClass as? NSView.Type {
++            glass = cls.init(frame: .zero)
++        } else {
++            glass = NSView(frame: .zero)
++        }
++        glass.translatesAutoresizingMaskIntoConstraints = false
++        addSubview(glass)
++        NSLayoutConstraint.activate([
++            glass.leadingAnchor.constraint(equalTo: leadingAnchor),
++            glass.trailingAnchor.constraint(equalTo: trailingAnchor),
++            glass.topAnchor.constraint(equalTo: topAnchor),
++            glass.bottomAnchor.constraint(equalTo: bottomAnchor),
++        ])
++        glassView = glass
++
++        // NSGlassEffectView.Style: regular = 0, clear = 1
++        Self.invokeIntSetter(glass, Self.setStyleSelector, clear ? 1 : 0)
++        if clear {
++            Self.invokeIntSetter(glass, Self.setVariantSelector, 3)
++        }
++        contentHost = NSView(frame: .zero)
++        Self.invokeObjectSetter(glass, Self.setContentViewSelector, contentHost)
++        updateAppearance()
++    }
++
++    private static func invokeIntSetter(_ target: AnyObject, _ selector: Selector, _ value: Int) {
++        guard let method = class_getInstanceMethod(object_getClass(target), selector) else { return }
++        let function = unsafeBitCast(method_getImplementation(method), to: SetIntType.self)
++        function(target, selector, value)
+     }
+ 
+-    var hostView: NSView { contentView! }
++    private static func invokeCGFloatSetter(_ target: AnyObject, _ selector: Selector, _ value: CGFloat) {
++        guard let method = class_getInstanceMethod(object_getClass(target), selector) else { return }
++        let function = unsafeBitCast(method_getImplementation(method), to: SetCGFloatType.self)
++        function(target, selector, value)
++    }
++
++    private static func invokeObjectSetter(_ target: AnyObject, _ selector: Selector, _ value: AnyObject) {
++        guard let method = class_getInstanceMethod(object_getClass(target), selector) else { return }
++        let function = unsafeBitCast(method_getImplementation(method), to: SetObjectType.self)
++        function(target, selector, value)
++    }
++
++    func updateAppearance() {
++        let radius = Appearance.windowCornerRadius
++        layer?.cornerRadius = radius
++        guard let glass = glassView else { return }
++        Self.invokeCGFloatSetter(glass, Self.setCornerRadiusSelector, radius)
++    }
+ }
+ 
+ class FrostedGlassEffectView: NSVisualEffectView, EffectView {
+@@ -51,28 +120,6 @@ class FrostedGlassEffectView: NSVisualEffectView, EffectView {
+     }
+ }
+ 
+-/// The App Icons style uses the private `set_variant:` on `NSGlassEffectView` to get the macOS
+-/// Cmd-Tab-like clear glass look. `style = .clear` alone renders nearly fully transparent, so the
+-/// variant is what makes the panel visible. Lives here as a free helper (no NSGlassEffectView subclass).
+-enum LiquidGlass {
+-    private static let setVariantSelector = NSSelectorFromString("set_variant:")
+-    private typealias SetVariantFn = @convention(c) (AnyObject, Selector, Int) -> Void
+-
+-    static let canUsePrivateLook: Bool = {
+-        if #available(macOS 26.0, *) {
+-            return class_getInstanceMethod(object_getClass(NSGlassEffectView()), setVariantSelector) != nil
+-        }
+-        return false
+-    }()
+-
+-    @available(macOS 26.0, *)
+-    static func applyClearVariant(_ view: NSGlassEffectView) {
+-        guard let method = class_getInstanceMethod(object_getClass(view), setVariantSelector) else { return }
+-        let f = unsafeBitCast(method_getImplementation(method), to: SetVariantFn.self)
+-        f(view, setVariantSelector, 3)
+-    }
+-}
+-
+ enum EffectViewKind {
+     case frosted
+     case liquidGlassRegular
+@@ -82,7 +129,7 @@ enum EffectViewKind {
+ func requiredEffectViewKind() -> EffectViewKind {
+     if #available(macOS 26.0, *) {
+         if Preferences.effectiveAppearanceStyle(SwitcherSession.activeShortcutIndex) == .appIcons,
+-           LiquidGlass.canUsePrivateLook {
++           LiquidGlassEffectView.canUsePrivateLook {
+             return .liquidGlassClear
+         }
+         return .liquidGlassRegular
+@@ -90,28 +137,11 @@ func requiredEffectViewKind() -> EffectViewKind {
+     return .frosted
+ }
+ 
+-@available(macOS 26.0, *)
+-private func makeGlassEffectView(clear: Bool) -> NSGlassEffectView {
+-    let glass = NSGlassEffectView()
+-    glass.style = clear ? .clear : .regular
+-    if clear {
+-        LiquidGlass.applyClearVariant(glass)
+-    }
+-    // NSGlassEffectView only renders views embedded in `contentView`; this single host holds the
+-    // scroll view, search field and empty-state label so they all sit inside the glass.
+-    glass.contentView = NSView()
+-    glass.updateAppearance()
+-    // without this, there are weird shadows around the corners (most visible with .regular glass)
+-    glass.wantsLayer = true
+-    glass.layer!.masksToBounds = true
+-    return glass
+-}
+-
+ func makeEffectView(for kind: EffectViewKind) -> EffectView {
+     if #available(macOS 26.0, *) {
+         switch kind {
+             case .liquidGlassClear:
+-                return makeGlassEffectView(clear: true)
++                return LiquidGlassEffectView(clear: true)
+             case .liquidGlassRegular:
+                 if Preferences.effectiveAppearanceStyle(SwitcherSession.activeShortcutIndex) == .appIcons {
+                     Logger.error {
+@@ -119,7 +149,7 @@ func makeEffectView(for kind: EffectViewKind) -> EffectView {
+                         return "Private API set_variant is no longer available. macOS version: \(os.majorVersion).\(os.minorVersion).\(os.patchVersion)"
+                     }
+                 }
+-                return makeGlassEffectView(clear: false)
++                return LiquidGlassEffectView(clear: false)
+             case .frosted:
+                 break
+         }
+-- 
+2.55.0
+
diff --git a/pkgs/by-name/al/alt-tab-macos/0004-hide-settings-for-disabled-services.patch b/pkgs/by-name/al/alt-tab-macos/0004-hide-settings-for-disabled-services.patch
new file mode 100644
index 000000000000..11608646cf18
--- /dev/null
+++ b/pkgs/by-name/al/alt-tab-macos/0004-hide-settings-for-disabled-services.patch
@@ -0,0 +1,43 @@
+From cb68a038f6a0fc79cb60570bbec7bf3c45a5d8d2 Mon Sep 17 00:00:00 2001
+From: nixpkgs <nix@nixpkgs>
+Date: Fri, 10 Jul 2026 13:52:57 +0300
+Subject: [PATCH 4/4] hide settings for disabled services
+
+---
+ .../settings-window/tabs/GeneralTab.swift           | 13 -------------
+ 1 file changed, 13 deletions(-)
+
+diff --git a/src/preferences/settings-window/tabs/GeneralTab.swift b/src/preferences/settings-window/tabs/GeneralTab.swift
+index ab64ea9c..19dbef5e 100644
+--- a/src/preferences/settings-window/tabs/GeneralTab.swift
++++ b/src/preferences/settings-window/tabs/GeneralTab.swift
+@@ -20,12 +20,6 @@ class GeneralTab {
+             ])
+         let language = TableGroupView.Row(leftTitle: NSLocalizedString("Language", comment: ""),
+             rightViews: [LabelAndControl.makeDropdown("language", LanguagePreference.allCases, extraAction: setLanguageCallback)])
+-        updatesPolicyDropdown = LabelAndControl.makeDropdown("updatePolicy", UpdatePolicyPreference.allCases)
+-        let checkForUpdates = NSButton(title: NSLocalizedString("Check for updates now…", comment: ""), target: nil, action: nil)
+-        checkForUpdates.onAction = { control in checkForUpdatesNow(control) }
+-        crashPolicyDropdown = LabelAndControl.makeDropdown("crashPolicy", CrashPolicyPreference.allCases)
+-        let crashPolicy = TableGroupView.Row(leftTitle: NSLocalizedString("Crash reports policy", comment: ""),
+-            rightViews: [crashPolicyDropdown!])
+         for i in 0..<MenubarIconPreference.allCases.count {
+             let image = NSImage.initCopy("menubar-\(i)")
+             image.isTemplate = i < 2
+@@ -45,13 +39,6 @@ class GeneralTab {
+         table.addRow(captureWindowsInBackground)
+         table.addNewTable()
+         table.addRow(language)
+-        table.addNewTable()
+-        table.addRow(leftViews: [TableGroupView.makeText(NSLocalizedString("Updates policy", comment: ""))],
+-            rightViews: [updatesPolicyDropdown!],
+-            secondaryViews: [checkForUpdates],
+-            secondaryViewsAlignment: .right,
+-            secondaryViewsTopGap: 8)
+-        table.addRow(crashPolicy)
+         let exportButton = NSButton(title: NSLocalizedString("Export settings…", comment: ""), target: nil, action: nil)
+         exportButton.onAction = { _ in exportSettings() }
+         let importButton = NSButton(title: NSLocalizedString("Import settings…", comment: ""), target: nil, action: nil)
+-- 
+2.55.0
+
diff --git a/pkgs/by-name/al/alt-tab-macos/package.nix b/pkgs/by-name/al/alt-tab-macos/package.nix
index 5b83fc215045..a5c70709aaac 100644
--- a/pkgs/by-name/al/alt-tab-macos/package.nix
+++ b/pkgs/by-name/al/alt-tab-macos/package.nix
@@ -1,45 +1,411 @@
 {
   lib,
-  stdenvNoCC,
-  fetchurl,
+  swiftPackages,
+  fetchFromGitHub,
+  actool,
+  lld,
+  makeWrapper,
   nix-update-script,
-  unzip,
+  rcodesign,
 }:
 
-stdenvNoCC.mkDerivation (finalAttrs: {
-  pname = "alt-tab-macos";
-  version = "11.4.2";
+let
+  inherit (swiftPackages) stdenv swift;
 
-  src = fetchurl {
-    url = "https://github.com/lwouis/alt-tab-macos/releases/download/v${finalAttrs.version}/AltTab-${finalAttrs.version}.zip";
-    hash = "sha256-eqD9jXebqwXVgAPf7e5ZjY3Vh8ra1EDncOV2hZdpTuM=";
+  toPlist = lib.generators.toPlist { escape = true; };
+  deploymentTarget = "14.0";
+  sdkVersion = "26.0";
+  shortcutRecorderDir = "vendor/ShortcutRecorder/Sources/ShortcutRecorder";
+
+  # Framework descriptors drive both the build (compilation) and the install
+  # (bundle layout, Info.plist, optional resources). Order below is the final
+  # `-l<name>` link order.
+  #
+  # Build shapes (exactly one of):
+  #   stubSrc:         single-file Swift stub (+ optional stubExtraFlags)
+  #   objc = { ... }:  Objective-C framework; see buildObjcFramework for keys
+  #
+  # Install extras (all optional):
+  #   plistOverrides:  extra CFBundle* keys merged into the framework Info.plist
+  #   localizations:   directory to scan for *.lproj dirs to copy into Resources
+  #   xcassets:        .xcassets directory compiled with actool into Assets.car
+  frameworks = [
+    {
+      name = "ShortcutRecorder";
+      objc = {
+        moduleMap = ./stubs/ShortcutRecorder.modulemap;
+        headerGlob = ''"${shortcutRecorderDir}"/include/ShortcutRecorder/*.h'';
+        sourceGlob = ''"${shortcutRecorderDir}"/*.m'';
+        includes = [
+          "${shortcutRecorderDir}/include"
+          "${shortcutRecorderDir}/include/ShortcutRecorder"
+        ];
+        sysFrameworks = [
+          "Carbon"
+          "AppKit"
+          "Foundation"
+          "CoreData"
+        ];
+      };
+      # ShortcutRecorder looks up its own bundle via SRBundle() by identifier
+      plistOverrides = {
+        CFBundleIdentifier = "com.kulakov.ShortcutRecorder";
+        CFBundleVersion = "3.1";
+        CFBundleShortVersionString = "3.1";
+      };
+      localizations = shortcutRecorderDir;
+      xcassets = "${shortcutRecorderDir}/Images.xcassets";
+    }
+    # Updates are managed by Nix, and upstream's AppCenter package depends on
+    # a prebuilt PLCrashReporter xcframework. API-compatible stubs keep both
+    # network-facing services disabled while preserving a source-only build.
+    {
+      name = "Sparkle";
+      stubSrc = ./stubs/SparkleStub.swift;
+    }
+    {
+      name = "AppCenter";
+      stubSrc = ./stubs/AppCenterStub.swift;
+    }
+    {
+      name = "AppCenterCrashes";
+      stubSrc = ./stubs/AppCenterCrashesStub.swift;
+      stubExtraFlags = [
+        "-I"
+        "$buildDir"
+        "-L"
+        "$buildDir"
+        "-lAppCenter"
+      ];
+    }
+  ];
+
+  allFrameworks = lib.catAttrs "name" frameworks;
+  objcFrameworks = lib.filter (fw: fw ? objc) frameworks;
+
+  # apple-sdk_26 cannot be used here because swiftPackages compiles its own modules
+  # against apple-sdk_14; adding it to buildInputs redirects SDKROOT and breaks Swift's
+  # foundational modules
+  commonSwiftFlags = [
+    "-O"
+    "-swift-version"
+    "5"
+    "-disable-bridging-pch"
+    "-Xlinker"
+    "-platform_version"
+    "-Xlinker"
+    "macos"
+    "-Xlinker"
+    deploymentTarget
+    "-Xlinker"
+    sdkVersion
+  ];
+
+  # These are the non-localized files in upstream's PBXResourcesBuildPhase.
+  appResources = [
+    "resources/icons/app/app.icns"
+    "resources/icons/menubar/*.pdf"
+    "resources/illustrations/*.heic"
+    "resources/*.otf"
+    "docs/contributors.md"
+    "docs/acknowledgments.md"
+  ];
+
+  infoPlistSubstitutions = version: {
+    API_DOMAIN = "alt-tab.app/api";
+    APPCENTER_SECRET = "";
+    CURRENT_PROJECT_VERSION = version;
+    DOMAIN = "alt-tab.app";
+    EXECUTABLE_NAME = "AltTab";
+    MACOSX_DEPLOYMENT_TARGET = deploymentTarget;
+    PRODUCT_BUNDLE_IDENTIFIER = "com.lwouis.alt-tab-macos";
+    PRODUCT_NAME = "AltTab";
   };
 
-  sourceRoot = ".";
+  substitutePlistVariables =
+    substitutions:
+    lib.concatStringsSep " \\\n        " (
+      lib.mapAttrsToList (
+        name: value: "--replace-fail ${lib.escapeShellArg "$(${name})"} ${lib.escapeShellArg value}"
+      ) substitutions
+    );
 
-  nativeBuildInputs = [ unzip ];
+  frameworkPlist =
+    name: extra:
+    toPlist (
+      {
+        CFBundleExecutable = name;
+        CFBundleIdentifier = "com.lwouis.alt-tab-macos.${name}";
+        CFBundleInfoDictionaryVersion = "6.0";
+        CFBundleName = name;
+        CFBundlePackageType = "FMWK";
+        CFBundleVersion = "1";
+      }
+      // extra
+    );
+
+  # Shared swiftc invocation for emitting a dylib + swiftmodule for <name>.
+  # `sourcesExpr` is inlined into the swiftc command line: either a single
+  # path (stub), or a bash array expansion like "${foo[@]}" (glob output).
+  swiftFrameworkLink =
+    {
+      name,
+      sourcesExpr,
+      extraFlags ? [ ],
+    }:
+    ''
+      swiftc "''${commonSwiftFlags[@]}" \
+        -emit-module -emit-library \
+        -module-name ${name} -module-link-name ${name} \
+        -emit-module-path "$buildDir/${name}.swiftmodule" \
+        ${lib.concatStringsSep " " extraFlags} \
+        -Xlinker -install_name -Xlinker "@rpath/${name}.framework/${name}" \
+        ${sourcesExpr} -o "$buildDir/lib${name}.dylib"
+    '';
+
+  # Build a single-file Swift stub framework.
+  buildSwiftStubFramework = fw: ''
+    nixLog "Building ${fw.name} (stub)"
+    ${swiftFrameworkLink {
+      inherit (fw) name;
+      sourcesExpr = "${fw.stubSrc}";
+      extraFlags = fw.stubExtraFlags or [ ];
+    }}
+  '';
+
+  # Build an Objective-C dynamic framework: symlink headers + modulemap under
+  # $buildDir/<name>_headers/<name>/, compile each .m to .o, then link a dylib.
+  #   moduleMap:     path to a .modulemap file (copied in place)
+  #   headerGlob:    bash expression expanding to header paths (for ln -s)
+  #   sourceGlob:    bash expression expanding to .m paths (one .o per source)
+  #   arc:           enable -fobjc-arc (default true)
+  #   includes:      extra -I paths passed to clang
+  #   sysFrameworks: macOS system frameworks to link
+  buildObjcFramework =
+    fw:
+    let
+      o = fw.objc;
+      arc = o.arc or true;
+      arcFlag = if arc then "-fobjc-arc" else "-fno-objc-arc";
+      includeFlags = lib.concatMapStringsSep " " (p: ''-I "${p}"'') (o.includes or [ ]);
+      sysFrameworkFlags = lib.concatMapStringsSep " " (f: "-framework ${f}") (o.sysFrameworks or [ ]);
+    in
+    ''
+      (
+        nixLog "Building ${fw.name}"
+        hdrDir="$buildDir/${fw.name}_headers/${fw.name}"
+        mkdir -p "$hdrDir"
+        for h in ${o.headerGlob}; do
+          ln -s "$(realpath "$h")" "$hdrDir/$(basename "$h")"
+        done
+        cp ${o.moduleMap} "$hdrDir/module.modulemap"
+
+        objs=()
+        for f in ${o.sourceGlob}; do
+          obj="$buildDir/${fw.name}_$(basename "$f" .m).o"
+          clang ${arcFlag} -O2 -Wno-deprecated-declarations \
+            -I "$buildDir/${fw.name}_headers" ${includeFlags} \
+            -c "$f" -o "$obj"
+          objs+=("$obj")
+        done
+
+        clang -fuse-ld=lld -dynamiclib ${lib.optionalString arc "-fobjc-arc"} "''${objs[@]}" \
+          ${sysFrameworkFlags} \
+          -install_name "@rpath/${fw.name}.framework/${fw.name}" \
+          -o "$buildDir/lib${fw.name}.dylib"
+      )
+    '';
+
+  # Dispatch to the right builder based on descriptor shape.
+  buildFramework =
+    fw:
+    if fw ? stubSrc then
+      buildSwiftStubFramework fw
+    else if fw ? objc then
+      buildObjcFramework fw
+    else
+      throw "framework ${fw.name} has no build descriptor";
+
+  # Module-map flags for the final AltTab swiftc invocation, so Swift code can
+  # `import <ObjcFrameworkName>`. Flat single line so the surrounding `\`
+  # continuation in the swiftc call stays intact.
+  objcModuleMapFlags = lib.concatMapStringsSep " " (
+    fw:
+    ''-Xcc -fmodule-map-file="$buildDir/${fw.name}_headers/${fw.name}/module.modulemap" -Xcc -I"$buildDir/${fw.name}_headers"''
+  ) objcFrameworks;
+
+  # Compile an xcassets catalog into Assets.car in destDir
+  compileAssetCatalog =
+    { destDir, catalog }:
+    ''
+      actool --compile "${destDir}" \
+        --platform macosx --minimum-deployment-target ${deploymentTarget} \
+        --output-partial-info-plist /dev/null \
+        "${catalog}"
+    '';
+
+  # Assemble one framework bundle: dylib + Info.plist + optional resources.
+  # Runs in the install phase where $app and $buildDir are set.
+  installFramework = fw: ''
+    fwDir="$app/Contents/Frameworks/${fw.name}.framework"
+    mkdir -p "$fwDir/Resources"
+    cp "$buildDir/lib${fw.name}.dylib" "$fwDir/${fw.name}"
+    printf '%s' ${
+      lib.escapeShellArg (frameworkPlist fw.name (fw.plistOverrides or { }))
+    } > "$fwDir/Resources/Info.plist"
+    ${lib.optionalString (fw ? localizations) ''
+      cp -R "${fw.localizations}"/*.lproj "$fwDir/Resources/"
+    ''}
+    ${lib.optionalString (fw ? xcassets) (compileAssetCatalog {
+      destDir = "$fwDir/Resources";
+      catalog = fw.xcassets;
+    })}
+  '';
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "alt-tab-macos";
+  version = "11.4.3";
+
+  src = fetchFromGitHub {
+    owner = "lwouis";
+    repo = "alt-tab-macos";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-izPiRGV8bD67rvOyNWShcpTbUujn6WHnzenPAMAlKoU=";
+  };
+
+  nativeBuildInputs = [
+    swift
+    actool
+    lld
+    makeWrapper
+    rcodesign
+  ];
+
+  patches = [
+    # Swift 5.10 compatibility: count(where:), .extraLarge, Liquid Glass
+    ./0001-replace-count-where-with-filter-.count-for-Swift-5.1.patch
+    ./0002-replace-.extraLarge-with-.large-for-macOS-14-SDK.patch
+    ./0003-use-runtime-dispatch-for-Liquid-Glass-with-SDK-14.patch
+    # Don't offer preferences for services disabled by the source-only stubs.
+    ./0004-hide-settings-for-disabled-services.patch
+  ];
+
+  # Remove trailing comma incompatible with Swift 5.10
+  postPatch = ''
+    substituteInPlace Info.plist \
+      ${substitutePlistVariables (infoPlistSubstitutions finalAttrs.version)}
+
+    substituteInPlace src/secondary-windows/permission-window/PermissionsWindow.swift \
+      --replace-fail \
+        '"x-apple.systempreferences:com.apple.preference.security?Privacy_Accessibility",' \
+        '"x-apple.systempreferences:com.apple.preference.security?Privacy_Accessibility"'
+
+    # Swift 5.10 compat: additional call site using trailing-closure
+    # sugar for count(where:). See 0001-replace-count-where-...patch.
+    substituteInPlace src/util/UsageStats.swift \
+      --replace-fail \
+        'getTimestamps(key).count { $0 >= threshold }' \
+        'getTimestamps(key).filter { $0 >= threshold }.count'
+  '';
+
+  dontConfigure = true;
+
+  buildPhase = ''
+    runHook preBuild
+
+    buildDir="$PWD/build"
+    mkdir -p "$buildDir"
+
+    ${lib.toShellVars { inherit commonSwiftFlags; }}
+
+    ${lib.concatMapStringsSep "\n" buildFramework frameworks}
+
+    nixLog "Compiling AppCenterApplication"
+    clang -fobjc-arc -fmodules -fmodules-cache-path="$buildDir/module-cache" -O2 \
+      -c ${./stubs/AppCenterApplication.m} -o "$buildDir/AppCenterApplication.o"
+
+    nixLog "Compiling ObjCExceptionCatcher"
+    clang -fobjc-arc -fmodules -fmodules-cache-path="$buildDir/module-cache" -O2 \
+      -c src/vendors/ObjCExceptionCatcher.m -o "$buildDir/ObjCExceptionCatcher.o"
+
+    nixLog "Building AltTab"
+    mapfile -d ''' files < <(find src -name '*.swift' \
+      -not -name '*Tests.swift' \
+      -not -path '*/_test-support/*' \
+      -not -path '*/experimentations/*' \
+      -print0)
+
+    swiftc "''${commonSwiftFlags[@]}" \
+      -emit-executable -module-name AltTab \
+      -import-objc-header alt-tab-macos-Bridging-Header.h \
+      -Xcc -Isrc/ui \
+      -Xcc -Isrc/vendors \
+      -I "$buildDir" -L "$buildDir" \
+      ${objcModuleMapFlags} \
+      ${lib.concatMapStringsSep " " (fw: "-l${fw}") allFrameworks} \
+      -F /System/Library/PrivateFrameworks \
+      -framework SkyLight -framework Carbon -framework AppKit -framework Cocoa \
+      -framework ScreenCaptureKit -framework ApplicationServices \
+      -framework CoreGraphics -framework CoreText \
+      -Xlinker -rpath -Xlinker "@executable_path/../Frameworks" \
+      "$buildDir/AppCenterApplication.o" \
+      "$buildDir/ObjCExceptionCatcher.o" \
+      "''${files[@]}" -o "$buildDir/AltTab"
+
+    runHook postBuild
+  '';
 
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/Applications
-    cp -r *.app $out/Applications
+    app="$out/Applications/AltTab.app"
+    mkdir -p "$app/Contents/"{MacOS,Frameworks,Resources}
+
+    cp "$buildDir/AltTab" "$app/Contents/MacOS/AltTab"
+
+    # Install each framework: dylib + Info.plist + optional resources
+    ${lib.concatMapStringsSep "\n" installFramework frameworks}
+
+    cp Info.plist "$app/Contents/Info.plist"
+    printf 'APPL????' > "$app/Contents/PkgInfo"
+
+    # Xcode flattens these PBXGroup resources into Contents/Resources.
+    cp ${lib.concatStringsSep " " appResources} "$app/Contents/Resources/"
+    cp -R resources/l10n/*.lproj "$app/Contents/Resources/"
+
+    makeWrapper "$app/Contents/MacOS/AltTab" "$out/bin/alt-tab"
 
     runHook postInstall
   '';
 
+  # Sign the complete app rather than each Mach-O independently, so its nested
+  # frameworks and resources are sealed as one valid bundle. Match upstream's
+  # hardened-runtime flags and entitlements on the main executable. This must
+  # remain ad-hoc: a stable designated requirement needs a private signing
+  # identity, which cannot be embedded in a public, sandboxed Nix build.
+  postFixup = ''
+    ${lib.getExe rcodesign} sign \
+      --code-signature-flags runtime \
+      --entitlements-xml-file ${finalAttrs.src}/alt_tab_macos.entitlements \
+      "$out/Applications/AltTab.app"
+  '';
+
   passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Windows alt-tab on macOS";
     homepage = "https://alt-tab.app";
-    license = lib.licenses.gpl3Plus;
+    license = with lib.licenses; [
+      gpl3Plus
+      cc-by-40 # ShortcutRecorder
+    ];
+    mainProgram = "alt-tab";
     maintainers = with lib.maintainers; [
       _4evy
       emilytrau
       Br1ght0ne
     ];
     platforms = lib.platforms.darwin;
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    sourceProvenance = with lib.sourceTypes; [ fromSource ];
   };
 })
diff --git a/pkgs/by-name/al/alt-tab-macos/stubs/AppCenterApplication.m b/pkgs/by-name/al/alt-tab-macos/stubs/AppCenterApplication.m
new file mode 100644
index 000000000000..497e8f107ab6
--- /dev/null
+++ b/pkgs/by-name/al/alt-tab-macos/stubs/AppCenterApplication.m
@@ -0,0 +1,7 @@
+#import <Cocoa/Cocoa.h>
+
+@interface AppCenterApplication : NSApplication
+@end
+
+@implementation AppCenterApplication
+@end
diff --git a/pkgs/by-name/al/alt-tab-macos/stubs/AppCenterCrashesStub.swift b/pkgs/by-name/al/alt-tab-macos/stubs/AppCenterCrashesStub.swift
new file mode 100644
index 000000000000..c7f270eb304d
--- /dev/null
+++ b/pkgs/by-name/al/alt-tab-macos/stubs/AppCenterCrashesStub.swift
@@ -0,0 +1,25 @@
+import Foundation
+
+@objc public enum UserConfirmation: UInt {
+    case send = 0
+    case dontSend = 1
+    case always = 2
+}
+
+@objc public class ErrorReport: NSObject {}
+
+@objc public class ErrorAttachmentLog: NSObject {
+    @objc public class func attachment(withText text: String, filename: String) -> ErrorAttachmentLog? {
+        return ErrorAttachmentLog()
+    }
+}
+
+@objc public protocol CrashesDelegate: NSObjectProtocol {
+    @objc optional func attachments(with crashes: Crashes, for errorReport: ErrorReport) -> [ErrorAttachmentLog]?
+}
+
+@objc public class Crashes: NSObject {
+    @objc public static weak var delegate: CrashesDelegate?
+    @objc public static var userConfirmationHandler: (([ErrorReport]) -> Bool)?
+    @objc public static func notify(with confirmation: UserConfirmation) {}
+}
diff --git a/pkgs/by-name/al/alt-tab-macos/stubs/AppCenterStub.swift b/pkgs/by-name/al/alt-tab-macos/stubs/AppCenterStub.swift
new file mode 100644
index 000000000000..19ddf7d259ae
--- /dev/null
+++ b/pkgs/by-name/al/alt-tab-macos/stubs/AppCenterStub.swift
@@ -0,0 +1,6 @@
+import Foundation
+
+@objc public class AppCenter: NSObject {
+    @objc public static var networkRequestsAllowed: Bool = false
+    @objc public static func start(withAppSecret appSecret: String, services: [AnyClass]) {}
+}
diff --git a/pkgs/by-name/al/alt-tab-macos/stubs/ShortcutRecorder.modulemap b/pkgs/by-name/al/alt-tab-macos/stubs/ShortcutRecorder.modulemap
new file mode 100644
index 000000000000..d81d400a5cee
--- /dev/null
+++ b/pkgs/by-name/al/alt-tab-macos/stubs/ShortcutRecorder.modulemap
@@ -0,0 +1,5 @@
+module ShortcutRecorder {
+  umbrella header "ShortcutRecorder.h"
+  export *
+  module * { export * }
+}
diff --git a/pkgs/by-name/al/alt-tab-macos/stubs/SparkleStub.swift b/pkgs/by-name/al/alt-tab-macos/stubs/SparkleStub.swift
new file mode 100644
index 000000000000..2645dd9b3aa9
--- /dev/null
+++ b/pkgs/by-name/al/alt-tab-macos/stubs/SparkleStub.swift
@@ -0,0 +1,59 @@
+import Foundation
+import AppKit
+
+@objc public protocol SPUUpdaterDelegate: NSObjectProtocol {
+    @objc optional func updaterDidNotFindUpdate(_ updater: SPUUpdater)
+}
+
+@objc public class SUAppcastItem: NSObject {
+    @objc public var displayVersionString: String
+
+    @objc public init(displayVersionString: String = "") {
+        self.displayVersionString = displayVersionString
+    }
+}
+
+@objc public class SPUUpdater: NSObject {
+    private weak var delegate: SPUUpdaterDelegate?
+    @objc public var automaticallyDownloadsUpdates: Bool = false
+    @objc public var automaticallyChecksForUpdates: Bool = false
+    @objc public var sessionInProgress: Bool = false
+
+    @objc public init(delegate: SPUUpdaterDelegate? = nil) {
+        self.delegate = delegate
+    }
+
+    @objc public func checkForUpdateInformation() {
+        delegate?.updaterDidNotFindUpdate?(self)
+    }
+}
+
+@objc public class SPUStandardUpdaterController: NSObject {
+    @objc public let updater: SPUUpdater
+
+    @objc public init(startingUpdater: Bool, updaterDelegate: SPUUpdaterDelegate?, userDriverDelegate: Any?) {
+        updater = SPUUpdater(delegate: updaterDelegate)
+    }
+    @objc public func startUpdater() {}
+    @objc public func checkForUpdates(_ sender: Any?) {
+        updater.checkForUpdateInformation()
+        showNixUpdateMessage()
+    }
+}
+
+@objc public class SUUpdater: NSObject {
+    private static let instance = SUUpdater()
+    @objc public class func shared() -> SUUpdater { return instance }
+    @objc public var automaticallyDownloadsUpdates: Bool = false
+    @objc public var automaticallyChecksForUpdates: Bool = false
+    @objc public func checkForUpdates(_ sender: Any?) {
+        showNixUpdateMessage()
+    }
+}
+
+private func showNixUpdateMessage() {
+    let alert = NSAlert()
+    alert.messageText = "Updates are managed by Nix"
+    alert.informativeText = "Update AltTab through the Nix profile or system configuration that installed it."
+    alert.runModal()
+}
diff --git a/pkgs/by-name/at/attyx/package.nix b/pkgs/by-name/at/attyx/package.nix
index 266d7dc542c0..e28b6af86a0b 100644
--- a/pkgs/by-name/at/attyx/package.nix
+++ b/pkgs/by-name/at/attyx/package.nix
@@ -18,13 +18,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "attyx";
-  version = "0.4.14";
+  version = "0.4.15";
 
   src = fetchFromGitHub {
     owner = "semos-labs";
     repo = "attyx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yBl/t8m85B87m42EeGNjJKRVlQcTlx/bOQjpdc/BIEg=";
+    hash = "sha256-WB3qMFmVmv/FkZX60MTKFewk3kEA3yDEoaUFL2LY1bQ=";
   };
 
   deps = callPackage ./build.zig.zon.nix { };
diff --git a/pkgs/by-name/ca/cargo-deny/package.nix b/pkgs/by-name/ca/cargo-deny/package.nix
index 62ef4627cef4..4fef3a52f933 100644
--- a/pkgs/by-name/ca/cargo-deny/package.nix
+++ b/pkgs/by-name/ca/cargo-deny/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-deny";
-  version = "0.19.9";
+  version = "0.20.2";
 
   src = fetchFromGitHub {
     owner = "EmbarkStudios";
     repo = "cargo-deny";
     tag = finalAttrs.version;
-    hash = "sha256-b3p4UxMDUNMKusgGDji3A0myfAfYU+o4DFnhM4mrWao=";
+    hash = "sha256-sYxRQvJVbVmzajGJdAHnuvJDELv0cyDCCU8cRU0U0oQ=";
   };
 
-  cargoHash = "sha256-+FWEA2T8CASg3MmTb7WpN4MO8lwiLZtsVDuWMddkUgA=";
+  cargoHash = "sha256-Zb6vQCnhhhL9Ducn9eh5P8Gfopl0lQPTXWW8Q0Y5xBQ=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/cl/claude-code/manifest.json b/pkgs/by-name/cl/claude-code/manifest.json
index 2c4bbd82c986..3a61d357e015 100644
--- a/pkgs/by-name/cl/claude-code/manifest.json
+++ b/pkgs/by-name/cl/claude-code/manifest.json
@@ -1,47 +1,47 @@
 {
-  "version": "2.1.205",
-  "commit": "4cf2699a14277d4a8edf7e74442381071fc0cfd2",
-  "buildDate": "2026-07-08T17:46:21Z",
+  "version": "2.1.206",
+  "commit": "edc8ebf7f852d3abffad32a5bf8e49e439f92afb",
+  "buildDate": "2026-07-09T01:48:20Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "33e28624c5ae84f2bd7d2d8761e5d2e77997ba965cb11b6448de6b6e2c566f9c",
-      "size": 237437968
+      "checksum": "3197aba4442dbd5b3df42b6f35e6d7bd03b5e48ce18b7a3c5c6f5f8c28e03b7f",
+      "size": 240395024
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "4299a3f48551ef365f2d056f24d87e84b822c4c10b6acc46979446b7b5c60ceb",
-      "size": 246862928
+      "checksum": "b1e1636917a12c7d4e1fa54cd13f7f76ba3779fb988180610b6ca483258c2f46",
+      "size": 248431568
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "c1874c85bcd3a88b70439fd50ff5910b7e6ac5371c14dd49d4ccc2878a592d09",
-      "size": 253803248
+      "checksum": "cb8ccaf4ae6beb558747227a362010c6b32b4f4a5868c3a7e96aa9972fc6ef58",
+      "size": 255376112
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "dd8734c0b6a503fe1d17425184e57b397c30bb0337a33f1470d9985febfe5b09",
-      "size": 257006392
+      "checksum": "d131494be407ff56a62f4e99a96ba60102002d01e3b6b1494db16bef4b7f060f",
+      "size": 258566968
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "a8cd2a626d7d0b5fb3516164a4cf3b4acbbadb053a5b1b2a2462ccbd2ebf6bde",
-      "size": 247051448
+      "checksum": "b1920556c3b077694d52397f4e5221df2419ad9b44af641be0f49647b51f87ad",
+      "size": 248624312
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "20018df16e75f4287c3bfb088e04019452cf262f66ee43041e285113c4e479d8",
-      "size": 251695488
+      "checksum": "b0d780783401de979024c25f14a2cae665873afbcfe718c090b73e13c4cd08a0",
+      "size": 253251968
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "f09120889098672074e7c5166d5474da0c5482f2bec898b3510cacd9c1fefa42",
-      "size": 247162528
+      "checksum": "d5072b25b9a20bffb24625d36129a05ed2be4d2eb7e35625aad6aa35596892c2",
+      "size": 248682144
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "9a86e5acbc584ab7c1b684f1cc1bf5c7bddd6afd4817c0d2c2113d15bfbff0a9",
-      "size": 241629344
+      "checksum": "c17ac3a5a8edf5cfa658e82bd41fcf83170af21538e51cc9d4cbaeefe382aba3",
+      "size": 243149984
     }
   }
 }
diff --git a/pkgs/by-name/cl/cloudflare-dynamic-dns/package.nix b/pkgs/by-name/cl/cloudflare-dynamic-dns/package.nix
index a7f751921b0e..473ce4ae0ed9 100644
--- a/pkgs/by-name/cl/cloudflare-dynamic-dns/package.nix
+++ b/pkgs/by-name/cl/cloudflare-dynamic-dns/package.nix
@@ -7,16 +7,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "cloudflare-dynamic-dns";
-  version = "4.5.0";
+  version = "4.5.1";
 
   src = fetchFromGitHub {
     owner = "zebradil";
     repo = "cloudflare-dynamic-dns";
     tag = finalAttrs.version;
-    hash = "sha256-4QbgtzzPUzDQqPTiKMnA0/MNovDTJD+sm3u3Zorn6f4=";
+    hash = "sha256-EMT4vFm1EJxHFfnjh4ExfWOqaA+s9bJbI71wj//oRv0=";
   };
 
-  vendorHash = "sha256-qcJZp86ZBYrL3bWO94H2yba95oAqyYp57eRcC8U1Xog=";
+  vendorHash = "sha256-1x1Hw343ylhGsbNcj4hwweYnACoVZSdycwBbGUVuu+k=";
 
   subPackages = ".";
 
diff --git a/pkgs/by-name/co/codex/package.nix b/pkgs/by-name/co/codex/package.nix
index bb15ec6f77af..6fa2aff8ea20 100644
--- a/pkgs/by-name/co/codex/package.nix
+++ b/pkgs/by-name/co/codex/package.nix
@@ -26,29 +26,34 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codex";
-  version = "0.142.5";
+  version = "0.144.1";
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = "codex";
     tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-Ua1UVArTvjHcg3bPK1FYyShYiIUH3AOxtoUTvA4UZwU=";
+    hash = "sha256-KHgrqIZyAmLhTZSRYbb7huBO8neOib/B1Vx/oPW2nEU=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/codex-rs";
 
-  cargoHash = "sha256-1gDiCB3Nf/0aIm+EoL3g9C0xbCi3cv6TfH5VytjJpOY=";
+  cargoHash = "sha256-S4dsZXfmKvJItL2XYKyxfhqdCMATEG6oPjrtVRwkuYc=";
 
   __structuredAttrs = true;
 
-  # Match upstream's release build for the codex binary only.
+  # Match upstream's release build for the codex binary, plus its
+  # codex-code-mode-host runtime companion for out-of-process V8 execution.
   cargoBuildFlags = [
     "--package"
     "codex-cli"
+    "--package"
+    "codex-code-mode-host"
   ];
   cargoCheckFlags = [
     "--package"
     "codex-cli"
+    "--package"
+    "codex-code-mode-host"
   ];
 
   postPatch = ''
diff --git a/pkgs/by-name/es/espflash/package.nix b/pkgs/by-name/es/espflash/package.nix
index 3f2830fae857..2c378e9a6670 100644
--- a/pkgs/by-name/es/espflash/package.nix
+++ b/pkgs/by-name/es/espflash/package.nix
@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "espflash";
-  version = "4.4.0";
+  version = "4.5.0";
 
   src = fetchFromGitHub {
     owner = "esp-rs";
     repo = "espflash";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SXXFXwr+oO+BbBQ/BZgCKhbdcaybVr1JY66q+xM2Quc=";
+    hash = "sha256-o+MbUXZZycskltIH2NBGg2TnxOZ4viyc3D16quR2jqQ=";
   };
 
   nativeBuildInputs = [
@@ -30,7 +30,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   buildInputs = [ openssl ];
 
-  cargoHash = "sha256-ZAp9hEzDrzjYSJLKeMCjAoiybOqPdDLqIGOvBTCr5uU=";
+  cargoHash = "sha256-QvJsmjMTx+oVqP3TkbN4A1PLAxmy8jwX/dZZkwdrkf8=";
 
   cargoBuildFlags = [
     "--exclude=xtask"
diff --git a/pkgs/by-name/go/gopls/package.nix b/pkgs/by-name/go/gopls/package.nix
index fc32575b4948..1ce0b995c011 100644
--- a/pkgs/by-name/go/gopls/package.nix
+++ b/pkgs/by-name/go/gopls/package.nix
@@ -11,17 +11,17 @@
 
 buildGoLatestModule (finalAttrs: {
   pname = "gopls";
-  version = "0.22.0";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "golang";
     repo = "tools";
     tag = "gopls/v${finalAttrs.version}";
-    hash = "sha256-JO3FHKBjAGPPuVvrgdc4RZJreiPHbZp+4RwiZubusVg=";
+    hash = "sha256-GTRZ0tS2a7Cx4qRf6PfxhkGVPYRoLYOmE+W/2x9Pttk=";
   };
 
   modRoot = "gopls";
-  vendorHash = "sha256-mZvjoEgVZ5iNTiduLEC3Oy4RCcxEdVlN6a0Us47IdIQ=";
+  vendorHash = "sha256-rvm33C3z3T6moeEQ4C7aG+dT8ROqmpBFehIpwGFZMrU=";
 
   # https://github.com/golang/tools/blob/9ed98faa/gopls/main.go#L27-L30
   ldflags = [ "-X main.version=v${finalAttrs.version}" ];
diff --git a/pkgs/by-name/gq/gqlgen/package.nix b/pkgs/by-name/gq/gqlgen/package.nix
index 2e450544bb68..103f9ea04412 100644
--- a/pkgs/by-name/gq/gqlgen/package.nix
+++ b/pkgs/by-name/gq/gqlgen/package.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "0.17.93";
+  version = "0.17.94";
 in
 buildGoModule {
   pname = "gqlgen";
@@ -16,10 +16,10 @@ buildGoModule {
     owner = "99designs";
     repo = "gqlgen";
     tag = "v${version}";
-    hash = "sha256-F2tbigASufl+Zqq0mKP6S9pFHyia2IADjofI8KAit5s=";
+    hash = "sha256-dtApWhbuajgFlaDzNz2rvAQqz8x7YNnyeXyw/OqM5Qc=";
   };
 
-  vendorHash = "sha256-6tU6aHbEI91u+s3/QoOdxu0zoYD3UefvV+NGgBAuBxE=";
+  vendorHash = "sha256-n49MlAs6gWMxy6u/cH2UR3xd0iwttT3bTcOu2M0UFhc=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/ht/httpx/package.nix b/pkgs/by-name/ht/httpx/package.nix
index 00f445e5d0da..cf614a722144 100644
--- a/pkgs/by-name/ht/httpx/package.nix
+++ b/pkgs/by-name/ht/httpx/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "httpx";
-  version = "1.9.0";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "httpx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WVmxXdQUNrWaVgxx9cirafgsW8+wuNsYyCXYV3mvX9E=";
+    hash = "sha256-j5OvWPwu5dVWTa5a/eY+CpzijYNO6K4mwnnuyXdAoEc=";
   };
 
-  vendorHash = "sha256-ALC8vhK/vzuKpiE1iQ2u0Orx/fUw5eVz32LyMrdrrrk=";
+  vendorHash = "sha256-Lx/m8B5rxuU5TI0BZe19aVBkc+ye2CkpIINydhLgajM=";
 
   subPackages = [ "cmd/httpx" ];
 
diff --git a/pkgs/by-name/im/immich/package.nix b/pkgs/by-name/im/immich/package.nix
index 3b158d44a2b5..8012f5db51a7 100644
--- a/pkgs/by-name/im/immich/package.nix
+++ b/pkgs/by-name/im/immich/package.nix
@@ -197,8 +197,8 @@ stdenv.mkDerivation (finalAttrs: {
     \) -exec rm -r {} +
 
     mkdir -p "$packageOut/build/plugins"
-    ln -s '${finalAttrs.passthru.plugin-core}' "$packageOut/build/plugins/immich-plugin-core"
-    ln -s '${finalAttrs.passthru.web}' "$packageOut/build/www"
+    ln -s '${finalAttrs.plugin-core}' "$packageOut/build/plugins/immich-plugin-core"
+    ln -s '${finalAttrs.web}' "$packageOut/build/www"
     ln -s '${geodata}' "$packageOut/build/geodata"
 
     echo '${builtins.toJSON buildLock}' > "$packageOut/build/build-lock.json"
@@ -222,6 +222,65 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  plugin-core = stdenv.mkDerivation {
+    pname = "immich-plugin-core";
+    inherit (finalAttrs) version src pnpmDeps;
+
+    nativeBuildInputs = [
+      binaryen
+      extism-js
+      nodejs
+      pnpmConfigHook
+      pnpm
+    ];
+
+    buildPhase = ''
+      runHook preBuild
+
+      pnpm --filter @immich/plugin-core... build
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      cd packages/plugin-core
+      mkdir $out
+      cp -r dist manifest.json $out
+
+      runHook postInstall
+    '';
+  };
+
+  web = stdenv.mkDerivation {
+    pname = "immich-web";
+    inherit (finalAttrs) version src pnpmDeps;
+
+    nativeBuildInputs = [
+      nodejs
+      pnpmConfigHook
+      pnpm
+    ];
+
+    buildPhase = ''
+      runHook preBuild
+
+      pnpm --filter immich-web... build
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      cd web
+      cp -r build $out
+
+      runHook postInstall
+    '';
+  };
+
   passthru = {
     tests = {
       inherit (nixosTests) immich immich-vectorchord-reindex;
@@ -231,65 +290,6 @@ stdenv.mkDerivation (finalAttrs: {
       immich = finalAttrs.finalPackage;
     };
 
-    plugin-core = stdenv.mkDerivation {
-      pname = "immich-plugin-core";
-      inherit (finalAttrs) version src pnpmDeps;
-
-      nativeBuildInputs = [
-        binaryen
-        extism-js
-        nodejs
-        pnpmConfigHook
-        pnpm
-      ];
-
-      buildPhase = ''
-        runHook preBuild
-
-        pnpm --filter @immich/plugin-core... build
-
-        runHook postBuild
-      '';
-
-      installPhase = ''
-        runHook preInstall
-
-        cd packages/plugin-core
-        mkdir $out
-        cp -r dist manifest.json $out
-
-        runHook postInstall
-      '';
-    };
-
-    web = stdenv.mkDerivation {
-      pname = "immich-web";
-      inherit (finalAttrs) version src pnpmDeps;
-
-      nativeBuildInputs = [
-        nodejs
-        pnpmConfigHook
-        pnpm
-      ];
-
-      buildPhase = ''
-        runHook preBuild
-
-        pnpm --filter immich-web... build
-
-        runHook postBuild
-      '';
-
-      installPhase = ''
-        runHook preInstall
-
-        cd web
-        cp -r build $out
-
-        runHook postInstall
-      '';
-    };
-
     inherit
       geodata
       pnpm
diff --git a/pkgs/by-name/ko/komorebi/package.nix b/pkgs/by-name/ko/komorebi/package.nix
index 9bc58263357d..8dba64355fe6 100644
--- a/pkgs/by-name/ko/komorebi/package.nix
+++ b/pkgs/by-name/ko/komorebi/package.nix
@@ -8,7 +8,7 @@
   glib,
   gtk3,
   libgee,
-  # webkitgtk_4_0,
+  webkitgtk_4_1,
   clutter-gtk,
   clutter-gst,
   ninja,
@@ -39,16 +39,17 @@ stdenv.mkDerivation (finalAttrs: {
     glib
     gtk3
     libgee
-    # webkitgtk_4_0
+    webkitgtk_4_1
     clutter-gtk
     clutter-gst
   ];
 
+  postPatch = ''
+    substituteInPlace meson.build --replace-fail "webkit2gtk-4.0" "webkit2gtk-4.1"
+  '';
   passthru.tests.version = testers.testVersion { package = finalAttrs.finalPackage; };
 
   meta = {
-    # webkitgtk_4_0 was removed
-    broken = true;
     description = "Beautiful and customizable wallpaper manager for Linux";
     homepage = "https://github.com/Komorebi-Fork/komorebi";
     license = lib.licenses.gpl3Only;
diff --git a/pkgs/by-name/lm/lmstudio/package.nix b/pkgs/by-name/lm/lmstudio/package.nix
index 9c77dd0acc7c..5338cf21baa6 100644
--- a/pkgs/by-name/lm/lmstudio/package.nix
+++ b/pkgs/by-name/lm/lmstudio/package.nix
@@ -7,12 +7,12 @@
 let
   pname = "lmstudio";
 
-  version_aarch64-linux = "0.4.18-1";
-  hash_aarch64-linux = "sha256-dSRgbf2Xo7JxqTP+2VqtNFbHHFINdaucPMCMnwUIYPM=";
-  version_aarch64-darwin = "0.4.18-1";
-  hash_aarch64-darwin = "sha256-H82Pj00m8sC+E56zQIZ0M4wdYCX/3xOfoYxYTILYW9I=";
-  version_x86_64-linux = "0.4.18-1";
-  hash_x86_64-linux = "sha256-KpznZu1tiXhtW9XDvbMCgH9xyGyaO37/F1sWqK1RCUk=";
+  version_aarch64-linux = "0.4.19-2";
+  hash_aarch64-linux = "sha256-okb6RxttmvVZdlg+V1P8UwCOhHgXIl+8fCRGy/JmkB4=";
+  version_aarch64-darwin = "0.4.19-2";
+  hash_aarch64-darwin = "sha256-rWZpkdhEGsPYv7gFA5PVWtI+RU5d5DGiLh91O1W+vj4=";
+  version_x86_64-linux = "0.4.19-2";
+  hash_x86_64-linux = "sha256-kR84VRYbKOYi8Y494/KFrIwzbK6nwSiorIkaIJJDeHI=";
 
   meta = {
     description = "LM Studio is an easy to use desktop app for experimenting with local and open-source Large Language Models (LLMs)";
diff --git a/pkgs/by-name/lu/lux-cli/package.nix b/pkgs/by-name/lu/lux-cli/package.nix
index 5cad34cfa96f..ca1c4ef4c31b 100644
--- a/pkgs/by-name/lu/lux-cli/package.nix
+++ b/pkgs/by-name/lu/lux-cli/package.nix
@@ -74,7 +74,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   '';
 
   postInstall = ''
-    installManPage target/dist/lx.1
+    installManPage target/dist/*.1
     installShellCompletion target/dist/lx.{bash,fish} --zsh target/dist/_lx
   '';
 
diff --git a/pkgs/applications/science/misc/megam/ocaml-3.12.patch b/pkgs/by-name/me/megam/ocaml-3.12.patch
similarity index 100%
rename from pkgs/applications/science/misc/megam/ocaml-3.12.patch
rename to pkgs/by-name/me/megam/ocaml-3.12.patch
diff --git a/pkgs/applications/science/misc/megam/ocaml-includes.patch b/pkgs/by-name/me/megam/ocaml-includes.patch
similarity index 100%
rename from pkgs/applications/science/misc/megam/ocaml-includes.patch
rename to pkgs/by-name/me/megam/ocaml-includes.patch
diff --git a/pkgs/applications/science/misc/megam/default.nix b/pkgs/by-name/me/megam/package.nix
similarity index 77%
rename from pkgs/applications/science/misc/megam/default.nix
rename to pkgs/by-name/me/megam/package.nix
index 614b4935a644..53f1760943a0 100644
--- a/pkgs/applications/science/misc/megam/default.nix
+++ b/pkgs/by-name/me/megam/package.nix
@@ -2,17 +2,21 @@
   lib,
   stdenv,
   fetchurl,
-  ocaml,
+  ocaml-ng,
   ncurses,
 }:
 
+let
+  inherit (ocaml-ng.ocamlPackages_4_14) ocaml;
+in
+
 stdenv.mkDerivation {
   pname = "megam";
   version = "0.92";
 
   src = fetchurl {
     url = "http://hal3.name/megam/megam_src.tgz";
-    sha256 = "dc0e9f59ff8513449fe3bd40b260141f89c88a4edf6ddc8b8a394c758e49724e";
+    hash = "sha256-3A6fWf+FE0Sf471AsmAUH4nIik7fbdyLijlMdY5Jck4=";
   };
 
   patches = [
@@ -23,12 +27,13 @@ stdenv.mkDerivation {
   postPatch = ''
     # Deprecated in ocaml 3.10 https://github.com/ocaml/ocaml/commit/f6190f3d0c49c5220d443ee8d03ca5072d68aa87
     # Deprecated in ocaml 3.08 https://github.com/ocaml/ocaml/commit/0c7aecb88dc696f66f49f3bed54a037361a26b8d
-    substituteInPlace fastdot_c.c --replace copy_double caml_copy_double --replace Bigarray_val Caml_ba_array_val --replace caml_bigarray caml_ba_array
+    substituteInPlace fastdot_c.c --replace-fail copy_double caml_copy_double --replace-fail Bigarray_val Caml_ba_array_val --replace-fail caml_bigarray caml_ba_array
     # They were already deprecated in 3.12 https://v2.ocaml.org/releases/3.12/htmlman/libref/Array.html
-    substituteInPlace abffs.ml main.ml --replace create_matrix make_matrix
-    substituteInPlace intHashtbl.ml --replace Array.create Array.make
+    substituteInPlace abffs.ml main.ml --replace-fail create_matrix make_matrix
+    substituteInPlace intHashtbl.ml --replace-fail Array.create Array.make
   '';
   strictDeps = true;
+  __structuredAttrs = true;
 
   nativeBuildInputs = [ ocaml ];
 
diff --git a/pkgs/by-name/mi/mise/package.nix b/pkgs/by-name/mi/mise/package.nix
index 9714af8af304..500e504b15a3 100644
--- a/pkgs/by-name/mi/mise/package.nix
+++ b/pkgs/by-name/mi/mise/package.nix
@@ -22,16 +22,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mise";
-  version = "2026.7.2";
+  version = "2026.7.4";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "mise";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Jjvg2PBxeW2kKqVA3GoKpMXcEXTMh4g2J+cby6av45s=";
+    hash = "sha256-WNxOHnaT31Wfezwp48g/5P+OYIxG9uoSU3FpX8/J51Q=";
   };
 
-  cargoHash = "sha256-JoXbR4gcca4Zk1KwVwE3qc+TqRTMZyFaTrEd4bzRTJY=";
+  cargoHash = "sha256-gjp4H6OtrdCtboAYqPX7+LrHkL2Dh7LkQ9GiMGwjIFM=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/mo/mochi/package.nix b/pkgs/by-name/mo/mochi/package.nix
index 0f41fbeb5f90..81d56f9eb8ae 100644
--- a/pkgs/by-name/mo/mochi/package.nix
+++ b/pkgs/by-name/mo/mochi/package.nix
@@ -12,14 +12,14 @@
 
 let
   pname = "mochi";
-  version = "1.21.16";
+  version = "1.21.17";
 
   linux = appimageTools.wrapType2 rec {
     inherit pname version meta;
 
     src = fetchurl {
       url = "https://download.mochi.cards/releases/Mochi-${version}.AppImage";
-      hash = "sha256-LWwv/+2/djc2bdqhnJiG5etXg+MFaEZbpttewVBZdeg=";
+      hash = "sha256-QYBh9ZvmJse3ZimvpU+9ky6ml0pCSZ3mVrYtWtMQGA0=";
     };
 
     appimageContents = appimageTools.extractType2 { inherit pname version src; };
@@ -44,9 +44,9 @@ let
       url = "https://download.mochi.cards/releases/Mochi-${version}${lib.optionalString stdenv.hostPlatform.isAarch64 "-arm64"}.dmg";
       hash =
         if stdenv.hostPlatform.isAarch64 then
-          "sha256-dtdQZYGrukT/UgfNdsnGxOYmpuebJCDHXW8cAGN2GZE="
+          "sha256-2NADaVzkibWjxBymeF1McGEQH6xHaqDMBg080kCI0F8="
         else
-          "sha256-FdNFpuIOMgRzniB9Aze3GUpNY27h++StTdwqfF1k07I=";
+          "sha256-XM4vQVQ9QtvqyDu2Wx/8/Z+8H2DetfCufJYrX/1JHFw=";
     };
 
     sourceRoot = ".";
diff --git a/pkgs/by-name/mx/mxnet/package.nix b/pkgs/by-name/mx/mxnet/package.nix
index fbed8ae66b98..ba12c3ad4642 100644
--- a/pkgs/by-name/mx/mxnet/package.nix
+++ b/pkgs/by-name/mx/mxnet/package.nix
@@ -26,6 +26,9 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "mxnet";
   version = "1.9.1";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchurl {
     name = "apache-mxnet-src-${finalAttrs.version}-incubating.tar.gz";
     url = "mirror://apache/incubator/mxnet/${finalAttrs.version}/apache-mxnet-src-${finalAttrs.version}-incubating.tar.gz";
@@ -50,6 +53,9 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     cmake
     perl
+  ]
+  ++ lib.optionals cudaSupport [
+    cudaPackages.cuda_nvcc
   ];
 
   buildInputs = [
@@ -61,7 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional stdenv.cc.isClang llvmPackages.openmp
   ++ lib.optionals cudaSupport [
     # needed for OpenCV cmake module
-    cudaPackages.cudatoolkit
+    cudaPackages.cuda_cudart
   ];
 
   cmakeFlags = [
diff --git a/pkgs/by-name/ne/nerva/package.nix b/pkgs/by-name/ne/nerva/package.nix
index b43ffaea424d..07be8a91c966 100644
--- a/pkgs/by-name/ne/nerva/package.nix
+++ b/pkgs/by-name/ne/nerva/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "nerva";
-  version = "1.40.0";
+  version = "1.40.1";
 
   src = fetchFromGitHub {
     owner = "praetorian-inc";
     repo = "nerva";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7KN8RlQyfKF55AX9xzdNnUiDoTWHlEb9dMoyT38PU4M=";
+    hash = "sha256-JiTTcrdiH/gKt/7/PybUWBN4Qwn+5cmfE9VLwWmsuMk=";
   };
 
   vendorHash = "sha256-Z0MSD+1/1VzrJ+pz5x0JvxrCxtJe59ckaTqHK/+TVN8=";
diff --git a/pkgs/by-name/ne/netgen-vlsi/package.nix b/pkgs/by-name/ne/netgen-vlsi/package.nix
index 81b7afb448b4..bad98953d464 100644
--- a/pkgs/by-name/ne/netgen-vlsi/package.nix
+++ b/pkgs/by-name/ne/netgen-vlsi/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "netgen";
-  version = "1.5.321";
+  version = "1.5.323";
 
   src = fetchFromGitHub {
     owner = "RTimothyEdwards";
     repo = "netgen";
     tag = finalAttrs.version;
-    hash = "sha256-jq7JvChnNSeZf7OrV9EIiOPv5nDqs6r8L9TY6k4vGXc=";
+    hash = "sha256-L8DJdk5lkb/qh5GbZK9eDNq1eZPEQq4ZZsBQPDJcKJ0=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/pa/pangolin-cli/package.nix b/pkgs/by-name/pa/pangolin-cli/package.nix
index 3cee1faf7112..f898daf240f4 100644
--- a/pkgs/by-name/pa/pangolin-cli/package.nix
+++ b/pkgs/by-name/pa/pangolin-cli/package.nix
@@ -10,20 +10,20 @@
 
 buildGoModule (finalAttrs: {
   pname = "pangolin-cli";
-  version = "0.10.1";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "fosrl";
     repo = "cli";
     tag = finalAttrs.version;
-    hash = "sha256-6TRO7tBrWH6EeMFEA6FrpvmlCkUcMtiZ5qr/LQjcLeY=";
+    hash = "sha256-wJS60bG5eQIEsDdqKxfSVKPaW+EmmtiaW9gbH1wwBQ4=";
   };
 
   ldflags = [
     "-X github.com/fosrl/cli/internal/version.Version=${finalAttrs.version}"
   ];
 
-  vendorHash = "sha256-UmzzZDO2lz/HsrUlnV8Wa4GM8lYgoI0ggJlOvxrd79Q=";
+  vendorHash = "sha256-yHU/xfO+I5YncycGkPkpKGUM11YyMrAkS17N/nAmUc0=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/pe/pegtl/package.nix b/pkgs/by-name/pe/pegtl/package.nix
index 28052ee7513b..545dc76681b8 100644
--- a/pkgs/by-name/pe/pegtl/package.nix
+++ b/pkgs/by-name/pe/pegtl/package.nix
@@ -18,6 +18,20 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-nPWSO2wPl/qenUQgvQDQu7Oy1dKa/PnNFSclmkaoM8A=";
   };
 
+  # GCC 16.1.0 has a bug with `__PRETTY_FUNCTION__` that leads to static
+  # assertions in PEGTL failing. Upstream has enabled a workaround for GCC 16
+  # specifically instead, and the bug was fixed for GCC 17+. The upstream patch
+  # does not apply cleanly since the codebase has changed substantially since
+  # v3.2.8, but it's trivial to apply a similar trick on our own.
+  # https://github.com/taocpp/PEGTL/issues/382
+  # https://github.com/taocpp/PEGTL/commit/0176e87da3a02d0ab40ce39f03e0e4108d1bbba5
+  # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91155
+  postPatch = ''
+    substituteInPlace include/tao/pegtl/demangle.hpp --replace-fail \
+      "#elif( __GNUC__ == 9 ) && ( __GNUC_MINOR__ < 3 )" \
+      "#elif ( ( __GNUC__ == 9 ) && ( __GNUC_MINOR__ < 3 ) ) || ( __GNUC__ == 16 )"
+  '';
+
   nativeBuildInputs = [
     cmake
     ninja
diff --git a/pkgs/by-name/re/regexplain/package.nix b/pkgs/by-name/re/regexplain/package.nix
new file mode 100644
index 000000000000..21655846c22d
--- /dev/null
+++ b/pkgs/by-name/re/regexplain/package.nix
@@ -0,0 +1,29 @@
+{
+  fetchFromGitHub,
+  lib,
+  rustPlatform,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "regexplain";
+  version = "1.0.0";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "kapilpokhrel";
+    repo = "regexplain";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-UtwRDFUjpgxgY+geAX4xmTYGgH897tKqxkIShzQEhWA=";
+  };
+  cargoHash = "sha256-6kNiF1ZEl25UuGoTrIph0NhJg422OW/dKtgOSYV7zxo=";
+
+  meta = {
+    description = "A terminal UI for explaining and visualizing regular expressions, kindof like regex101.";
+    homepage = "https://github.com/kapilpokhrel/regexplain";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      sntx
+    ];
+    mainProgram = "regexplain";
+  };
+})
diff --git a/pkgs/by-name/sa/sampo/package.nix b/pkgs/by-name/sa/sampo/package.nix
index 373b87c69baa..0ba83376203e 100644
--- a/pkgs/by-name/sa/sampo/package.nix
+++ b/pkgs/by-name/sa/sampo/package.nix
@@ -9,17 +9,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sampo";
-  version = "0.18.1";
+  version = "0.19.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "bruits";
     repo = "sampo";
     tag = "cargo-sampo-v${finalAttrs.version}";
-    hash = "sha256-F1x/GKTrNHbXFvjdqkLtdt0jXx3+pBBZzYcQEaTj9rQ=";
+    hash = "sha256-WGK2B6SzZNnclD2HeurXLujlScTZaI+jQbOaOrAt8Xw=";
   };
 
-  cargoHash = "sha256-SGCkuL/34eOpI4HpJPW4Z2P95WLHv2R/BEB0EAxbZoA=";
+  cargoHash = "sha256-WY+LYVxEo5FEon3pv/OHiDUZDXSaPot7PIgdOTXpWII=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/sn/snyk/package.nix b/pkgs/by-name/sn/snyk/package.nix
index be783876f93b..780528547fa5 100644
--- a/pkgs/by-name/sn/snyk/package.nix
+++ b/pkgs/by-name/sn/snyk/package.nix
@@ -10,13 +10,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "snyk";
-  version = "1.1305.2";
+  version = "1.1306.0";
 
   src = fetchFromGitHub {
     owner = "snyk";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-c32eVfRJRgABrGErHeWsXiHNd5UlL/MiTwkhJhtSZ3k=";
+    hash = "sha256-SYF5o/yx8A3u81yCwIU3njVSLG2vZskhZhJSAXAEioA=";
 
     # TODO: Remove once https://github.com/snyk/cli/pull/6924 is released.
     postFetch = ''
@@ -26,7 +26,7 @@ buildNpmPackage (finalAttrs: {
 
   npmDepsFetcherVersion = 3;
 
-  npmDepsHash = "sha256-EUK5iD5ElTtdLyewNJjOsY/4/vzfBBctqHY281p9Aow=";
+  npmDepsHash = "sha256-6re7WgeeuiHSJJmr+3wWyHYEq+jcVy9FvkwwVwwdnBg=";
 
   nodejs = nodejs_24;
 
diff --git a/pkgs/by-name/sp/spire/package.nix b/pkgs/by-name/sp/spire/package.nix
index b99163dc7d3a..0342824ba381 100644
--- a/pkgs/by-name/sp/spire/package.nix
+++ b/pkgs/by-name/sp/spire/package.nix
@@ -8,7 +8,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "spire";
-  version = "1.15.1";
+  version = "1.15.2";
 
   outputs = [
     "out"
@@ -21,12 +21,12 @@ buildGoModule (finalAttrs: {
     owner = "spiffe";
     repo = "spire";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-7SmHj/st2r3ks8Bh6gVRlKoay5mHqpovH25qMxG9s40=";
+    sha256 = "sha256-Mmjx4moERdYXbGqaGdtHs/uH3Gsm3E6dA50UST5HfRE=";
   };
 
   # Needed for github.co/google/go-tpm-tools/simulator  which contains non-go files that `go mod vendor` strips
   proxyVendor = true;
-  vendorHash = "sha256-wKVBqjid/PQi5JBB37c3h68Q8kUqbyaiDbLssO7Yo7A=";
+  vendorHash = "sha256-I2k5XiTkFo/Xn7XdzshjgjiBCQ8llhXnTbPWj4e8fzA=";
 
   buildInputs = [ openssl ];
 
diff --git a/pkgs/by-name/ta/tageditor/package.nix b/pkgs/by-name/ta/tageditor/package.nix
index 7e59a5aa2209..89539ec7eea8 100644
--- a/pkgs/by-name/ta/tageditor/package.nix
+++ b/pkgs/by-name/ta/tageditor/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tageditor";
-  version = "3.9.10";
+  version = "3.9.11";
 
   src = fetchFromGitHub {
     owner = "martchus";
     repo = "tageditor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tjJFYVcl6g1vhH40bJOcRCPhge12L6rLQ1lUOBF8DPM=";
+    hash = "sha256-5hOflEaBABu2vjrl0bPFhWHK65+yvoXzQAlb8Ealq+o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/tr/trufflehog/package.nix b/pkgs/by-name/tr/trufflehog/package.nix
index ecfeb8ddae8b..72f1b6263a66 100644
--- a/pkgs/by-name/tr/trufflehog/package.nix
+++ b/pkgs/by-name/tr/trufflehog/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "trufflehog";
-  version = "3.95.8";
+  version = "3.95.9";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-STrdxRwo3Q5dE9TmQRzMPtNPBatEWYffO3+cXsAzykI=";
+    hash = "sha256-CeKZA7d11Kdecjv2aInrK4NQ+C7c/ae8qQmircemTb4=";
   };
 
   vendorHash = "sha256-KVocEbpKYN/PE1Dnx4KO4V8AGEfYoNMKWZsAtXhLXv4=";
diff --git a/pkgs/by-name/uk/ukmm/package.nix b/pkgs/by-name/uk/ukmm/package.nix
index 7a635ab6a2f9..16a6417e556d 100644
--- a/pkgs/by-name/uk/ukmm/package.nix
+++ b/pkgs/by-name/uk/ukmm/package.nix
@@ -16,16 +16,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ukmm";
-  version = "0.17.0-1";
+  version = "0.17.1";
 
   src = fetchFromGitHub {
     owner = "NiceneNerd";
     repo = "ukmm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iNqWNF+X5qFRNpo7OXxCNCP8HR28EukgMAx8a025Ai8=";
+    hash = "sha256-1qhBBa6Mzo8XqvzwiHKnP0W9Oo26nvMiwZTzRAnLtfs=";
   };
 
-  cargoHash = "sha256-3qg5yTzalaKoOXYb1yo0K3AT6itJP1DErEQ2S8EfLNg=";
+  cargoHash = "sha256-I39SPTBH4JUx5z65eD2w2ntWKfjWSxweSco6QE9V5sM=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/we/wezterm/package.nix b/pkgs/by-name/we/wezterm/package.nix
index f064f1593cd5..c90f4cc04a70 100644
--- a/pkgs/by-name/we/wezterm/package.nix
+++ b/pkgs/by-name/we/wezterm/package.nix
@@ -28,14 +28,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wezterm";
-  version = "0-unstable-2026-07-05";
+  version = "0-unstable-2026-07-07";
 
   src = fetchFromGitHub {
     owner = "wezterm";
     repo = "wezterm";
-    rev = "5cc2d1ef0b7f2ac82f965fe6becd8657ccd0067b";
+    rev = "fff02ca501c3b457f99b467a86061d2b150c51f2";
     fetchSubmodules = true;
-    hash = "sha256-HTzKidRDyf2d6ajuKbfbGlpwAjzfRgOzNHipOgkWWD4=";
+    hash = "sha256-q351PUvUy9jbqcAgQfkZqgrEuc4X/Y/H9N8b9+60mjY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/aiointercept/default.nix b/pkgs/development/python-modules/aiointercept/default.nix
index 45389fa4c2b7..1893fccfe4ff 100644
--- a/pkgs/development/python-modules/aiointercept/default.nix
+++ b/pkgs/development/python-modules/aiointercept/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aiointercept";
-  version = "0.1.8";
+  version = "0.1.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Polandia94";
     repo = "aiointercept";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DqrGQkk4mqvXZ8MgswfYXD/++6z8SupjN7rvDmPOGRs=";
+    hash = "sha256-ivWdPw7irgrl0mH+mxChRt6ZITey9w/QB9TIxGu5XeU=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/azure-kusto-data/default.nix b/pkgs/development/python-modules/azure-kusto-data/default.nix
index f511f6357c61..4aece96fb20b 100644
--- a/pkgs/development/python-modules/azure-kusto-data/default.nix
+++ b/pkgs/development/python-modules/azure-kusto-data/default.nix
@@ -1,36 +1,49 @@
 {
   lib,
-  aiohttp,
-  aioresponses,
-  asgiref,
-  azure-core,
-  azure-identity,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
+  uv-build,
+
+  # dependencies
+  azure-core,
+  azure-identity,
   ijson,
   msal,
+  python-dateutil,
+  requests,
+
+  # optional-dependencies
+
+  # tests
+  # aio:
+  aiohttp,
+  asgiref,
+  # pandas:
   pandas,
+
+  # tests
+  aioresponses,
   pytest-asyncio,
   pytest-xdist,
   pytestCheckHook,
-  python-dateutil,
-  requests,
-  uv-build,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "azure-kusto-data";
-  version = "6.0.3";
+  version = "6.0.4";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "azure-kusto-python";
-    tag = "v${version}";
-    hash = "sha256-n69KpWZpAVMjr7d1QRQ/J/SgeTLkadJUhCgD62F6O7w=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-iggsVxLmDbP6+oSPaIiujPLsZAWwm5VLZSl+HYm0DIQ=";
   };
 
-  sourceRoot = "${src.name}/${pname}";
+  sourceRoot = "${finalAttrs.src.name}/azure-kusto-data";
 
   postPatch = ''
     substituteInPlace pyproject.toml \
@@ -42,7 +55,6 @@ buildPythonPackage rec {
   pythonRelaxDeps = [
     "ijson"
   ];
-
   dependencies = [
     azure-core
     azure-identity
@@ -66,22 +78,30 @@ buildPythonPackage rec {
     pytest-xdist
     pytestCheckHook
   ]
-  ++ lib.concatAttrValues optional-dependencies;
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
 
   pythonImportsCheck = [ "azure.kusto.data" ];
 
+  disabledTests = [
+    # AssertionError: Attributes of DataFrame.iloc[:, 1] (column name="rowguid") are different
+    "test_sanity_data_frame"
+  ];
+
   disabledTestPaths = [
     # Tests require network access
     "tests/aio/test_async_token_providers.py"
     "tests/test_token_providers.py"
     "tests/test_e2e_data.py"
+
+    # AssertionError: assert <class 'pandas.Timestamp'> is <class 'pandas.api.typing.NaTType'>
+    "tests/test_helpers.py"
   ];
 
   meta = {
     description = "Kusto Data Client";
     homepage = "https://github.com/Azure/azure-kusto-python/tree/master/azure-kusto-data";
-    changelog = "https://github.com/Azure/azure-kusto-python/releases/tag/${src.tag}";
+    changelog = "https://github.com/Azure/azure-kusto-python/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/drms/default.nix b/pkgs/development/python-modules/drms/default.nix
index f87f932da4eb..21a3d265d703 100644
--- a/pkgs/development/python-modules/drms/default.nix
+++ b/pkgs/development/python-modules/drms/default.nix
@@ -17,16 +17,17 @@
   pytest-doctestplus,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "drms";
-  version = "0.9.0";
+  version = "0.9.1";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "sunpy";
     repo = "drms";
-    tag = "v${version}";
-    hash = "sha256-Hd65bpJCknBeRd27JlcIkzzoZv5nGR7C6oMSGPFiyjA=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-f5t59a24aD8iXa3/zikgBnJeuUnZ4cvvpJuOfc80Xcw=";
   };
 
   build-system = [
@@ -58,8 +59,8 @@ buildPythonPackage rec {
   meta = {
     description = "Access HMI, AIA and MDI data with Python";
     homepage = "https://github.com/sunpy/drms";
-    changelog = "https://github.com/sunpy/drms/blob/v${version}/CHANGELOG.rst";
+    changelog = "https://github.com/sunpy/drms/blob/${finalAttrs.src.tag}/CHANGELOG.rst";
     license = lib.licenses.bsd2;
     maintainers = with lib.maintainers; [ bot-wxt1221 ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/fiona/default.nix b/pkgs/development/python-modules/fiona/default.nix
index 04db9811aa1d..53ff21fdfa53 100644
--- a/pkgs/development/python-modules/fiona/default.nix
+++ b/pkgs/development/python-modules/fiona/default.nix
@@ -25,9 +25,10 @@
   pytestCheckHook,
   pytz,
   snuggs,
+  versionCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "fiona";
   version = "1.10.1";
   pyproject = true;
@@ -35,18 +36,20 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "Toblerity";
     repo = "Fiona";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-5NN6PBh+6HS9OCc9eC2TcBvkcwtI4DV8qXnz4tlaMXc=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail "cython~=3.0.2" cython
-
+  ''
+  +
     # pyparsing deprecated parseString in favor of parse_string
-    substituteInPlace fiona/fio/features.py fiona/_vendor/snuggs.py \
-      --replace-fail parseString parse_string
-  '';
+    ''
+      substituteInPlace fiona/fio/features.py fiona/_vendor/snuggs.py \
+        --replace-fail parseString parse_string
+    '';
 
   build-system = [
     cython
@@ -72,17 +75,21 @@ buildPythonPackage rec {
     s3 = [ boto3 ];
   };
 
+  pythonImportsCheck = [ "fiona" ];
+
   nativeCheckInputs = [
     fsspec
     pytestCheckHook
     pytz
     shapely
     snuggs
+    versionCheckHook
   ]
-  ++ optional-dependencies.s3;
+  ++ finalAttrs.passthru.optional-dependencies.s3;
 
+  # prevent importing local fiona
   preCheck = ''
-    rm -r fiona # prevent importing local fiona
+    rm -r fiona
   '';
 
   disabledTestMarks = [
@@ -91,84 +98,36 @@ buildPythonPackage rec {
     "gdal"
   ];
 
+  pytestFlags = [
+    # UserWarning: The parameter --where is used more than once. Remove its duplicate as parameters should be unique.
+    "-Wignore::UserWarning"
+  ];
+
   disabledTests = [
     # Some tests access network, others test packaging
     "http"
     "https"
     "wheel"
 
+    # AssertionError: assert """"bool": true""" in data
+    "test_write_bool_subtype"
+
+    # AssertionError: assert '"coordinates": [ [ [ -111.74, 42.0 ], [ -111.66, 42.0 ]' in f.read(2000)
+    "test_open_kwargs"
+
+    # fiona.errors.DatasetDeleteError: Driver does not support dataset removal operation
+    "test_remove"
+
     # see: https://github.com/Toblerity/Fiona/issues/1273
     "test_append_memoryfile_drivers"
-
-    # AssertionError CLI exists with non-zero error code
-    # This is a regression introduced by https://github.com/NixOS/nixpkgs/pull/448189
-    "test_bbox_json_yes"
-    "test_bbox_no"
-    "test_bbox_where"
-    "test_bbox_yes"
-    "test_bbox_yes_two_files"
-    "test_bool_seq"
-    "test_bounds_explode_with_obj"
-    "test_calc_seq"
-    "test_collect_ld"
-    "test_collect_no_rs"
-    "test_collect_noparse"
-    "test_collect_noparse_records"
-    "test_collect_noparse_rs"
-    "test_collect_rec_buffered"
-    "test_collect_rs"
-    "test_creation_options"
-    "test_different_crs"
-    "test_distrib"
-    "test_distrib_no_rs"
-    "test_dst_crs_default_to_src_crs"
-    "test_dst_crs_epsg3857"
-    "test_dst_crs_no_src"
-    "test_existing_property"
-    "test_explode"
-    "test_explode_output_rs"
-    "test_explode_pp"
-    "test_explode_with_id"
-    "test_filter"
-    "test_fio_load_layer"
-    "test_fio_load_layer_append"
-    "test_load__auto_detect_format"
-    "test_load__auto_detect_format"
-    "test_load__auto_detect_format"
-    "test_load__auto_detect_format"
-    "test_load__auto_detect_format"
-    "test_map_count"
-    "test_multi_layer"
-    "test_one"
-    "test_precision"
-    "test_reduce_area"
-    "test_reduce_area"
-    "test_reduce_union"
-    "test_reduce_union_zip_properties"
-    "test_seq"
-    "test_seq"
-    "test_seq_no_rs"
-    "test_seq_rs"
-    "test_seq_rs"
-    "test_two"
-    "test_vfs"
-    "test_where_no"
-    "test_where_yes"
-    "test_where_yes_two_files"
-    "test_with_id"
-    "test_with_obj"
   ];
 
-  pythonImportsCheck = [ "fiona" ];
-
-  doInstallCheck = true;
-
   meta = {
-    changelog = "https://github.com/Toblerity/Fiona/blob/${src.rev}/CHANGES.txt";
     description = "OGR's neat, nimble, no-nonsense API for Python";
+    changelog = "https://github.com/Toblerity/Fiona/blob/${finalAttrs.src.tag}/CHANGES.txt";
     mainProgram = "fio";
     homepage = "https://fiona.readthedocs.io/";
     license = lib.licenses.bsd3;
     teams = [ lib.teams.geospatial ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/geopandas/default.nix b/pkgs/development/python-modules/geopandas/default.nix
index 622a87d4e8c0..08701406775a 100644
--- a/pkgs/development/python-modules/geopandas/default.nix
+++ b/pkgs/development/python-modules/geopandas/default.nix
@@ -2,16 +2,15 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
-  pytestCheckHook,
-  setuptools,
-  writableTmpDirAsHomeHook,
 
+  # build-system
+  setuptools,
+
+  # dependencies
   packaging,
   pandas,
   pyogrio,
   pyproj,
-  rtree,
   shapely,
 
   # optional-dependencies
@@ -24,18 +23,24 @@
   pyarrow,
   sqlalchemy,
   xyzservices,
+
+  # tests
+  pytestCheckHook,
+  rtree,
+  writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "geopandas";
-  version = "1.1.3";
+  version = "1.1.4";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "geopandas";
     repo = "geopandas";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-66FbHNewpSEVZ9RwngK7E4bcELa9Z2OQ9xVP9+fgeHQ=";
+    hash = "sha256-7XWPPLuJjc6x+Vb16z0bEjYe1lX710vz5Rwjg/WFHH0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/gradio/client.nix b/pkgs/development/python-modules/gradio/client.nix
index 6a63952ab6f3..ce360b14f476 100644
--- a/pkgs/development/python-modules/gradio/client.nix
+++ b/pkgs/development/python-modules/gradio/client.nix
@@ -120,6 +120,22 @@ buildPythonPackage (finalAttrs: {
   __darwinAllowLocalNetworking = true;
 
   passthru = {
+    # Cyclic dependencies are fun!
+    # overridePythonAttrs is not available in finalAttrs.finalPackage
+    sans-reverse-dependencies = finalAttrs.finalPackage.overrideAttrs (old: {
+      pname = old.pname + "-sans-reverse-dependencies";
+      # we aggressively remove all checkPhase related attrs
+      # to save on rebuilds during bumps
+      doInstallCheck = false;
+      doCheck = false;
+      preCheck = "";
+      enabledTestPaths = [ ];
+      disabledTestMarks = [ ];
+      disabledTests = [ ];
+      pythonImportsCheck = null;
+      dontCheckRuntimeDeps = true;
+    });
+
     inherit (gradio) updateScript;
   };
 
diff --git a/pkgs/development/python-modules/gradio/default.nix b/pkgs/development/python-modules/gradio/default.nix
index 073163aa7a8b..7e11791b068b 100644
--- a/pkgs/development/python-modules/gradio/default.nix
+++ b/pkgs/development/python-modules/gradio/default.nix
@@ -81,7 +81,7 @@ let
 in
 buildPythonPackage (finalAttrs: {
   pname = "gradio";
-  version = "6.19.0";
+  version = "6.20.0"; # please always backport gradio changes
   pyproject = true;
   __structuredAttrs = true;
 
@@ -89,7 +89,7 @@ buildPythonPackage (finalAttrs: {
     owner = "gradio-app";
     repo = "gradio";
     tag = "gradio@${finalAttrs.version}";
-    hash = "sha256-9vO+cuxpXERD/rH8wMuNWBNSH6Mu+yZLQMxLoiUTKtk=";
+    hash = "sha256-q5OoMguG/f0A3c6X+zotafc3kRRuebxMBPUIlrlcNFI=";
   };
 
   patches = [
@@ -102,17 +102,16 @@ buildPythonPackage (finalAttrs: {
   ];
 
   pnpmDeps = fetchPnpmDeps {
-    inherit (finalAttrs)
-      pname
-      version
-      src
-      ;
+    pname = "gradio"; # to avoid a "sans-reverse-dependencies" duplicate
+    inherit (finalAttrs) version src;
     inherit pnpm;
     fetcherVersion = 4;
     hash = "sha256-xCxr/jnp9emeB6THGt4cumvApw6fSZQwG2NGOcvR0yQ=";
   };
 
   env = {
+    # test/test_utils.py
+    # @settings(derandomize=os.getenv("CI") is not None)
     CI = "true";
   };
 
@@ -415,14 +414,14 @@ buildPythonPackage (finalAttrs: {
         # gradio.sans-reverse-dependencies, which would create a build cycle.
         # Break it by giving hf-gradio a checkless gradio-client.
         hf-gradio = hf-gradio.override {
-          gradio-client = gradio-client.overridePythonAttrs {
-            doCheck = false;
-          };
+          gradio-client = gradio-client.sans-reverse-dependencies;
         };
       }).overridePythonAttrs
         (old: {
           pname = old.pname + "-sans-reverse-dependencies";
           pythonRemoveDeps = (old.pythonRemoveDeps or [ ]) ++ [ "gradio-client" ];
+          # we aggressively remove all checkPhase related attrs
+          # to save on rebuilds during bumps
           doInstallCheck = false;
           doCheck = false;
           postPatch = "";
@@ -431,6 +430,7 @@ buildPythonPackage (finalAttrs: {
           disabledTestPaths = [ ];
           disabledTestMarks = [ ];
           pytestFlags = [ ];
+          preBuild = ":"; # skip pnpm build, for speed
           postInstall = ''
             shopt -s globstar
             for f in $out/**/*.py; do
diff --git a/pkgs/development/python-modules/heretic-llm/default.nix b/pkgs/development/python-modules/heretic-llm/default.nix
index fb7a05c08439..df322e60aca3 100644
--- a/pkgs/development/python-modules/heretic-llm/default.nix
+++ b/pkgs/development/python-modules/heretic-llm/default.nix
@@ -1,39 +1,44 @@
 {
   lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  uv-build,
   accelerate,
   bitsandbytes,
-  buildPythonPackage,
   datasets,
-  fetchFromGitHub,
-  # geom-median,
   hf-transfer,
   huggingface-hub,
   imageio,
+  immutabledict,
   kernels,
+  langdetect,
+  lm-eval,
   matplotlib,
   numpy,
   optuna,
-  # pacmap,
   peft,
   psutil,
+  py-cpuinfo,
   pydantic-settings,
   questionary,
   rich,
   scikit-learn,
+  tomli-w,
   transformers,
-  uv-build,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "heretic-llm";
-  version = "1.2.0";
+  version = "1.4.0";
   pyproject = true;
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "p-e-w";
     repo = "heretic";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KmqbOAOII1SP7wpdvGxtzQJt5NmlnF/o99NuZ21vO0s=";
+    hash = "sha256-jIWvHRsRo4wtos+2oNA8n0kz0GPLb03qEFsOQKTuMo8=";
   };
 
   postPatch = ''
@@ -42,7 +47,11 @@ buildPythonPackage (finalAttrs: {
   '';
 
   pythonRelaxDeps = [
+    "datasets"
     "huggingface-hub"
+    "peft"
+    "pydantic-settings"
+    "rich"
     "transformers"
   ];
 
@@ -54,13 +63,18 @@ buildPythonPackage (finalAttrs: {
     datasets
     hf-transfer
     huggingface-hub
+    immutabledict
     kernels
+    langdetect
+    lm-eval
     optuna
     peft
     psutil
+    py-cpuinfo
     pydantic-settings
     questionary
     rich
+    tomli-w
     transformers
   ];
 
diff --git a/pkgs/development/python-modules/hier-config/default.nix b/pkgs/development/python-modules/hier-config/default.nix
index 681c8a86df1e..9bcbc40eadaa 100644
--- a/pkgs/development/python-modules/hier-config/default.nix
+++ b/pkgs/development/python-modules/hier-config/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "hier-config";
-  version = "3.6.0";
+  version = "3.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "netdevops";
     repo = "hier_config";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OMX66ffIPuWkjVEL8fe6E7WCVF+J9+suh5TsQW5e7IY=";
+    hash = "sha256-reOfBIl5+kEEqOT+ZS40FDsNA/xkhLGfcf1LEbIpVlI=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/msticpy/default.nix b/pkgs/development/python-modules/msticpy/default.nix
index 1f1035a660ae..b4908686fadb 100644
--- a/pkgs/development/python-modules/msticpy/default.nix
+++ b/pkgs/development/python-modules/msticpy/default.nix
@@ -1,5 +1,12 @@
 {
   lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
   attrs,
   azure-common,
   azure-core,
@@ -11,12 +18,9 @@
   azure-monitor-query,
   beautifulsoup4,
   bokeh,
-  buildPythonPackage,
-  cache,
   cryptography,
   deprecated,
   dnspython,
-  fetchFromGitHub,
   folium,
   geoip2,
   html5lib,
@@ -26,9 +30,8 @@
   ipywidgets,
   keyring,
   lxml,
-  markdown,
-  msal-extensions,
   msal,
+  msal-extensions,
   msrest,
   msrestazure,
   nest-asyncio,
@@ -40,7 +43,6 @@
   pygments,
   pyjwt,
   pyyaml,
-  setuptools,
   tldextract,
   tqdm,
   typing-extensions,
@@ -49,23 +51,25 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "msticpy";
-  version = "3.0.0";
+  version = "3.0.1";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "msticpy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-aX5Nd0tNuweBp2SqGwe4/Z4LcdJaX3p5LLNQAOdGVGo=";
+    hash = "sha256-utE77oSCAAYKmsyf8ZPep7spUSIoJXBU6NzeLpDIvUs=";
   };
 
+  build-system = [ setuptools ];
+
   pythonRelaxDeps = [
     "azure-kusto-data"
     "bokeh"
+    "nest_asyncio"
+    "pandas"
   ];
-
-  build-system = [ setuptools ];
-
   dependencies = [
     attrs
     azure-common
diff --git a/pkgs/development/python-modules/parfive/default.nix b/pkgs/development/python-modules/parfive/default.nix
index 23c3cde1767d..88d240901ec9 100644
--- a/pkgs/development/python-modules/parfive/default.nix
+++ b/pkgs/development/python-modules/parfive/default.nix
@@ -71,6 +71,17 @@ buildPythonPackage (finalAttrs: {
   # Tests require local network access
   __darwinAllowLocalNetworking = true;
 
+  disabledTestPaths = [
+    # Tests that fail due to network access
+    "parfive/tests/test_downloader.py"
+    "parfive/tests/test_downloader_multipart.py"
+    # assert 1 == 0
+    "parfive/tests/test_main.py::test_run_cli_success"
+    #  aiohttp.client_exceptions.ClientResponseError: 400, message="Data after `Connection: close
+    "parfive/tests/test_utils.py::test_head_or_get"
+    "parfive/tests/test_utils.py::test_head_302"
+  ];
+
   pythonImportsCheck = [ "parfive" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/pylacus/default.nix b/pkgs/development/python-modules/pylacus/default.nix
index 4cedb1b119a2..44789fe049c9 100644
--- a/pkgs/development/python-modules/pylacus/default.nix
+++ b/pkgs/development/python-modules/pylacus/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pylacus";
-  version = "1.24.4";
+  version = "1.25.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ail-project";
     repo = "PyLacus";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qrHYEt837BN24ds63TdHdhfhthYlm9spBKONyTYFePg=";
+    hash = "sha256-MmThqTPM5YvVFv4DBfTCVbbyjFvIaIUmbRci94F8ZQ0=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/pyogrio/default.nix b/pkgs/development/python-modules/pyogrio/default.nix
index fe5268a592a6..b96626ec76e7 100644
--- a/pkgs/development/python-modules/pyogrio/default.nix
+++ b/pkgs/development/python-modules/pyogrio/default.nix
@@ -2,55 +2,74 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pytestCheckHook,
-
-  certifi,
-  cython,
   gdal,
-  numpy,
-  packaging,
+
+  # build-system
+  cython,
   setuptools,
   versioneer,
-  wheel,
+
+  # dependencies
+  certifi,
+  numpy,
+  packaging,
+
+  # tests
+  fiona,
+  pandas,
+  pytest-benchmark,
+  pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pyogrio";
-  version = "0.12.1";
+  version = "0.13.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "geopandas";
     repo = "pyogrio";
-    tag = "v${version}";
-    hash = "sha256-c3bd8gxsHCzLKmy8baiIUbTXzZWms/NlDg7Az6TWrfM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-9WaJMrh3FN4hWpdGNq2TynoLqT91tLQ7iTTl/NWYQTI=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail "versioneer[toml]==0.28" "versioneer[toml]"
+      --replace-fail \
+        "versioneer[toml]==0.28" \
+        "versioneer[toml]"
   '';
 
-  nativeBuildInputs = [
+  build-system = [
     cython
-    gdal # for gdal-config
     setuptools
     versioneer
-    wheel
+  ];
+
+  nativeBuildInputs = [
+    gdal # for gdal-config
   ];
 
   buildInputs = [ gdal ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     certifi
     numpy
     packaging
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  pythonImportsCheck = [ "pyogrio" ];
+
+  nativeCheckInputs = [
+    fiona
+    pandas
+    pytestCheckHook
+    pytest-benchmark
+  ];
 
   preCheck = ''
-    python setup.py build_ext --inplace
+    rm pyogrio/__init__.py
   '';
 
   disabledTestMarks = [
@@ -58,13 +77,26 @@ buildPythonPackage rec {
     "network"
   ];
 
-  pythonImportsCheck = [ "pyogrio" ];
+  disabledTests = [
+    # Circular dependencies with geopandas
+    "test_detect_zip_path"
+    "test_path_absolute"
+    "test_path_relative_dataframe"
+    "test_uri_local_file_dataframe"
+    "test_vsi_handling_read_dataframe"
+    "test_zip_path_dataframe"
+  ];
+
+  disabledTestPaths = [
+    # NameError: name 'shapely' is not defined
+    "pyogrio/tests/test_geopandas_io.py"
+  ];
 
   meta = {
     description = "Vectorized spatial vector file format I/O using GDAL/OGR";
     homepage = "https://pyogrio.readthedocs.io/";
-    changelog = "https://github.com/geopandas/pyogrio/blob/${src.tag}/CHANGES.md";
+    changelog = "https://github.com/geopandas/pyogrio/blob/${finalAttrs.src.tag}/CHANGES.md";
     license = lib.licenses.mit;
     teams = [ lib.teams.geospatial ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/slixmpp/Cargo.lock b/pkgs/development/python-modules/slixmpp/Cargo.lock
index 311c886c443c..c2381de77944 100644
--- a/pkgs/development/python-modules/slixmpp/Cargo.lock
+++ b/pkgs/development/python-modules/slixmpp/Cargo.lock
@@ -2,17 +2,11 @@
 # It is not intended for manual editing.
 version = 4
 
-[[package]]
-name = "autocfg"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
-
 [[package]]
 name = "displaydoc"
-version = "0.2.5"
+version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -27,12 +21,13 @@ checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
 [[package]]
 name = "icu_collections"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c6b649701667bbe825c3b7e6388cb521c23d88644678e83c0c4d0a621a34b43"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
 dependencies = [
  "displaydoc",
  "potential_utf",
+ "utf8_iter",
  "yoke",
  "zerofrom",
  "zerovec",
@@ -40,9 +35,9 @@ dependencies = [
 
 [[package]]
 name = "icu_locale_core"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edba7861004dd3714265b4db54a3c390e880ab658fec5f7db895fae2046b5bb6"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
 dependencies = [
  "displaydoc",
  "litemap",
@@ -53,9 +48,9 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f6c8828b67bf8908d82127b2054ea1b4427ff0230ee9141c54251934ab1b599"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
 dependencies = [
  "icu_collections",
  "icu_normalizer_data",
@@ -67,15 +62,15 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer_data"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7aedcccd01fc5fe81e6b489c15b247b8b0690feb23304303a9e560f37efc560a"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
 
 [[package]]
 name = "icu_properties"
-version = "2.1.2"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "020bfc02fe870ec3a66d93e677ccca0562506e5872c650f893269e08615d74ec"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
 dependencies = [
  "icu_collections",
  "icu_locale_core",
@@ -87,15 +82,15 @@ dependencies = [
 
 [[package]]
 name = "icu_properties_data"
-version = "2.1.2"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "616c294cf8d725c6afcd8f55abc17c56464ef6211f9ed59cccffe534129c77af"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
 
 [[package]]
 name = "icu_provider"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85962cf0ce02e1e0a629cc34e7ca3e373ce20dda4c4d7294bbd0bf1fdb59e614"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
 dependencies = [
  "displaydoc",
  "icu_locale_core",
@@ -119,28 +114,19 @@ dependencies = [
 
 [[package]]
 name = "idna_adapter"
-version = "1.2.1"
+version = "1.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3acae9609540aa318d1bc588455225fb2085b9ed0c4f6bd0d9d5bcd86f1a0344"
+checksum = "cb68373c0d6620ef8105e855e7745e18b0d00d3bdb07fb532e434244cdb9a714"
 dependencies = [
  "icu_normalizer",
  "icu_properties",
 ]
 
-[[package]]
-name = "indoc"
-version = "2.0.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79cf5c93f93228cf8efb3ba362535fb11199ac548a09ce117c9b1adc3030d706"
-dependencies = [
- "rustversion",
-]
-
 [[package]]
 name = "jid"
-version = "0.12.1"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04ec04c561bce2a09e8782a8fa7f4804f794ebc8e8dd4c06967f3aa4403ab4fc"
+checksum = "01200283c7e9307b1afee820eea16008048b6712ef768617e18f36aadb1ed272"
 dependencies = [
  "idna",
  "memchr",
@@ -149,36 +135,27 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.182"
+version = "0.2.186"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6800badb6cb2082ffd7b6a67e6125bb39f18782f793520caee8cb8846be06112"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
 
 [[package]]
 name = "litemap"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6373607a59f0be73a39b6fe456b8192fcc3585f602af20751600e974dd455e77"
+checksum = "92daf443525c4cce67b150400bc2316076100ce0b3686209eb8cf3c31612e6f0"
 
 [[package]]
 name = "memchr"
-version = "2.8.0"
+version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
-
-[[package]]
-name = "memoffset"
-version = "0.9.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
-dependencies = [
- "autocfg",
-]
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
 [[package]]
 name = "once_cell"
-version = "1.21.3"
+version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
 [[package]]
 name = "portable-atomic"
@@ -188,9 +165,9 @@ checksum = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49"
 
 [[package]]
 name = "potential_utf"
-version = "0.1.4"
+version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b73949432f5e2a09657003c25bca5e19a0e9c84f8058ca374f49e0ebe605af77"
+checksum = "0103b1cef7ec0cf76490e969665504990193874ea05c85ff9bab8b911d0a0564"
 dependencies = [
  "zerovec",
 ]
@@ -206,35 +183,32 @@ dependencies = [
 
 [[package]]
 name = "pyo3"
-version = "0.27.2"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ab53c047fcd1a1d2a8820fe84f05d6be69e9526be40cb03b73f86b6b03e6d87d"
+checksum = "cd274650b21d4bfc26a0a47587962c1edb425f69287324355cd040c3ea66071c"
 dependencies = [
- "indoc",
  "libc",
- "memoffset",
  "once_cell",
  "portable-atomic",
  "pyo3-build-config",
  "pyo3-ffi",
  "pyo3-macros",
- "unindent",
 ]
 
 [[package]]
 name = "pyo3-build-config"
-version = "0.27.2"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b455933107de8642b4487ed26d912c2d899dec6114884214a0b3bb3be9261ea6"
+checksum = "c5e2a7d2f0d013342f295c048ad19237add5154a55b1c5a254c0ec93d4109078"
 dependencies = [
  "target-lexicon",
 ]
 
 [[package]]
 name = "pyo3-ffi"
-version = "0.27.2"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c85c9cbfaddf651b1221594209aed57e9e5cff63c4d11d1feead529b872a089"
+checksum = "ca85c467da1bbc8d866eea5deff9cf29ea5f7785054a17da36e65bda9c05845b"
 dependencies = [
  "libc",
  "pyo3-build-config",
@@ -242,9 +216,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros"
-version = "0.27.2"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a5b10c9bf9888125d917fb4d2ca2d25c8df94c7ab5a52e13313a07e050a3b02"
+checksum = "9ac53762fd065daa3194dd09337a38bd793a188100fd1a9304c4ab312d901771"
 dependencies = [
  "proc-macro2",
  "pyo3-macros-backend",
@@ -254,32 +228,25 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros-backend"
-version = "0.27.2"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03b51720d314836e53327f5871d4c0cfb4fb37cc2c4a11cc71907a86342c40f9"
+checksum = "4ca3a1557399783172dc5bf39cfca835157732532cba56b71d2292161e53b362"
 dependencies = [
  "heck",
  "proc-macro2",
- "pyo3-build-config",
  "quote",
  "syn",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.44"
+version = "1.0.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21b2ebcf727b7760c461f091f9f0f539b77b8e87f2fd88131e7f1b433b3cece4"
+checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
 dependencies = [
  "proc-macro2",
 ]
 
-[[package]]
-name = "rustversion"
-version = "1.0.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d"
-
 [[package]]
 name = "slixmpp"
 version = "0.1.0"
@@ -290,9 +257,9 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.15.1"
+version = "1.15.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+checksum = "8ed6a63f02c8539c91a8685a86f4099661ba3da017932f6ebbea6de3f0fa7c90"
 
 [[package]]
 name = "stable_deref_trait"
@@ -313,9 +280,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.117"
+version = "2.0.118"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+checksum = "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -341,9 +308,9 @@ checksum = "adb6935a6f5c20170eeceb1a3835a49e12e19d792f6dd344ccc76a985ca5a6ca"
 
 [[package]]
 name = "tinystr"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42d3e9c45c09de15d06dd8acf5f4e0e399e85927b7f00711024eb7ae10fa4869"
+checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
 dependencies = [
  "displaydoc",
  "zerovec",
@@ -351,9 +318,9 @@ dependencies = [
 
 [[package]]
 name = "tinyvec"
-version = "1.10.0"
+version = "1.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bfa5fdc3bce6191a1dbc8c02d5c8bffcf557bafa17c124c5264a458f1b0613fa"
+checksum = "3e61e67053d25a4e82c844e8424039d9745781b3fc4f32b8d55ed50f5f667ef3"
 dependencies = [
  "tinyvec_macros",
 ]
@@ -391,12 +358,6 @@ version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
 
-[[package]]
-name = "unindent"
-version = "0.2.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7264e107f553ccae879d21fbea1d6724ac785e8c3bfc762137959b5802826ef3"
-
 [[package]]
 name = "utf8_iter"
 version = "1.0.4"
@@ -405,15 +366,15 @@ checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
 [[package]]
 name = "writeable"
-version = "0.6.2"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9edde0db4769d2dc68579893f2306b26c6ecfbe0ef499b013d731b7b9247e0b9"
+checksum = "1ffae5123b2d3fc086436f8834ae3ab053a283cfac8fe0a0b8eaae044768a4c4"
 
 [[package]]
 name = "yoke"
-version = "0.8.1"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72d6e5c6afb84d73944e5cedb052c4680d5657337201555f9f2a16b7406d4954"
+checksum = "709fe23a0424b6a435d82152b1bd3fdfb0833487d5fa90d05d42762a9891fef5"
 dependencies = [
  "stable_deref_trait",
  "yoke-derive",
@@ -422,9 +383,9 @@ dependencies = [
 
 [[package]]
 name = "yoke-derive"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b659052874eb698efe5b9e8cf382204678a0086ebf46982b79d6ca3182927e5d"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -434,18 +395,18 @@ dependencies = [
 
 [[package]]
 name = "zerofrom"
-version = "0.1.6"
+version = "0.1.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50cc42e0333e05660c3587f3bf9d0478688e15d870fab3346451ce7f8c9fbea5"
+checksum = "0ec05a11813ea801ff6d75110ad09cd0824ddba17dfe17128ea0d5f68e6c5272"
 dependencies = [
  "zerofrom-derive",
 ]
 
 [[package]]
 name = "zerofrom-derive"
-version = "0.1.6"
+version = "0.1.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d71e5d6e06ab090c67b5e44993ec16b72dcbaabc526db883a360057678b48502"
+checksum = "11532158c46691caf0f2593ea8358fed6bbf68a0315e80aae9bd41fbade684a1"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -455,9 +416,9 @@ dependencies = [
 
 [[package]]
 name = "zerotrie"
-version = "0.2.3"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a59c17a5562d507e4b54960e8569ebee33bee890c70aa3fe7b97e85a9fd7851"
+checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
 dependencies = [
  "displaydoc",
  "yoke",
@@ -466,9 +427,9 @@ dependencies = [
 
 [[package]]
 name = "zerovec"
-version = "0.11.5"
+version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c28719294829477f525be0186d13efa9a3c602f7ec202ca9e353d310fb9a002"
+checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
 dependencies = [
  "yoke",
  "zerofrom",
@@ -477,9 +438,9 @@ dependencies = [
 
 [[package]]
 name = "zerovec-derive"
-version = "0.11.2"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eadce39539ca5cb3985590102671f2567e659fca9666581ad3411d59207951f3"
+checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
 dependencies = [
  "proc-macro2",
  "quote",
diff --git a/pkgs/development/python-modules/slixmpp/default.nix b/pkgs/development/python-modules/slixmpp/default.nix
index 6bf6b5f3e624..5ccb3d18885a 100644
--- a/pkgs/development/python-modules/slixmpp/default.nix
+++ b/pkgs/development/python-modules/slixmpp/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "slixmpp";
-  version = "1.16.0";
+  version = "1.17.0";
   pyproject = true;
 
   src = fetchFromCodeberg {
     owner = "poezio";
     repo = "slixmpp";
     tag = "slix-${finalAttrs.version}";
-    hash = "sha256-d0laQWaqZUoviF7NM/egENQ3ArQE12ER0TzfPBcnc7Q=";
+    hash = "sha256-1jCKaUwWuIxTQGA0WkQMpB3xWW8XEAfAlyrqoTFIhVY=";
   };
 
   patches = [
@@ -76,11 +76,6 @@ buildPythonPackage (finalAttrs: {
   ]
   ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
 
-  preCheck = ''
-    # don't test against pure python version in the source tree
-    rm -rf slixmpp
-  '';
-
   disabledTestPaths = [
     # Exclude integration tests
     "itests/"
@@ -95,6 +90,9 @@ buildPythonPackage (finalAttrs: {
     homepage = "https://slixmpp.readthedocs.io/";
     changelog = "https://codeberg.org/poezio/slixmpp/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ fab ];
+    maintainers = with lib.maintainers; [
+      fab
+      haansn08
+    ];
   };
 })
diff --git a/pkgs/development/python-modules/sunpy/default.nix b/pkgs/development/python-modules/sunpy/default.nix
index be52a3357bf8..23c9cddd7a95 100644
--- a/pkgs/development/python-modules/sunpy/default.nix
+++ b/pkgs/development/python-modules/sunpy/default.nix
@@ -55,12 +55,13 @@
   pytest-astropy,
   pytest-mock,
   pytestCheckHook,
+  responses,
   writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "sunpy";
-  version = "7.1.2";
+  version = "8.0.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -68,7 +69,7 @@ buildPythonPackage (finalAttrs: {
     owner = "sunpy";
     repo = "sunpy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-saq3vYJMKogXSBxKn/tqlSnE96K10EM27femC+Qx0Gw=";
+    hash = "sha256-VR0FvIkskjL1rvc0xOp+DSS+ocTJAAk4NYkO8+kpqmA=";
   };
 
   build-system = [
@@ -157,6 +158,7 @@ buildPythonPackage (finalAttrs: {
     pytest-astropy
     pytest-mock
     pytestCheckHook
+    responses
     writableTmpDirAsHomeHook
   ]
   ++ finalAttrs.passthru.optional-dependencies.all;
@@ -202,7 +204,9 @@ buildPythonPackage (finalAttrs: {
     "sunpy/net/jsoc/tests/test_jsoc.py"
     "sunpy/physics/differential_rotation.py"
     "sunpy/physics/tests/test_differential_rotation.py"
+    "sunpy/net/soar/tests/test_sunpy_soar.py"
     "sunpy/visualization"
+
     # Requires cdflib
     "sunpy/io/tests/test_cdf.py"
     "sunpy/timeseries"
diff --git a/pkgs/development/python-modules/torchaudio/default.nix b/pkgs/development/python-modules/torchaudio/default.nix
index a4c634349f47..974bf23e7ec1 100644
--- a/pkgs/development/python-modules/torchaudio/default.nix
+++ b/pkgs/development/python-modules/torchaudio/default.nix
@@ -77,8 +77,8 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
     # Fails on aarch64-linux and darwin with:
     #   RuntimeError: `fbgemm` is not available
     # `fbgemm` is indeed an x86_64-linux-only feature
-    TORCHAUDIO_TEST_ALLOW_SKIP_IF_NO_QUANTIZATION =
-      if ((hostPlatform.isLinux && hostPlatform.isAarch64) || hostPlatform.isDarwin) then 1 else 0;
+    # in some x86_64-linux build environments this is also needed
+    TORCHAUDIO_TEST_ALLOW_SKIP_IF_NO_QUANTIZATION = 1;
   };
 
   build-system = [
@@ -128,6 +128,13 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
     # Mismatched elements: 1070 / 32800 (3.3%)
     "test_amplitude_to_DB"
     "test_amplitude_to_DB_power"
+    "test_griffinlim_0_99"
+    "test_MelSpectrogram_00"
+    "test_MelSpectrogram_01"
+    "test_MelSpectrogram_04"
+    "test_MelSpectrogram_05"
+    "test_MelSpectrogram_08"
+    "test_MelSpectrogram_09"
 
     # Very long to run
     "AutogradCPUTest"
@@ -139,24 +146,10 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
     "test_batch_inverse_spectrogram"
     "test_batch_pitch_shift"
     "test_batch_spectrogram"
-    "test_griffinlim_0_99"
 
     # RuntimeError: illegal immediate parameter (range error)
     "test_lfilter_shape_4"
     "test_lfilter_shape_6"
-  ]
-  ++ lib.optionals hostPlatform.isDarwin [
-    # AssertionError: Tensor-likes are not close!
-    "test_griffinlim_0_99"
-  ]
-  ++ lib.optionals (hostPlatform.isDarwin && hostPlatform.isx86_64) [
-    # AssertionError: Tensor-likes are not close!
-    "test_MelSpectrogram_00"
-    "test_MelSpectrogram_01"
-    "test_MelSpectrogram_04"
-    "test_MelSpectrogram_05"
-    "test_MelSpectrogram_08"
-    "test_MelSpectrogram_09"
   ];
 
   passthru.gpuCheck = torchaudio.overridePythonAttrs (old: {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index da82c5e594b8..97935fa90847 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10629,10 +10629,6 @@ with pkgs;
     cudaSupport = true;
   };
 
-  megam = callPackage ../applications/science/misc/megam {
-    inherit (ocaml-ng.ocamlPackages_4_14) ocaml;
-  };
-
   spyder = with python3.pkgs; toPythonApplication spyder;
 
   ### SCIENCE / PHYSICS