diff --git a/pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix b/pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix
index b2f9fe77969c..5e5081b0090f 100644
--- a/pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix
+++ b/pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "pcsx-rearmed";
-  version = "0-unstable-2026-03-16";
+  version = "0-unstable-2026-03-21";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "pcsx_rearmed";
-    rev = "4dfc616b9389f9997d1f2afcb9e61023b87c12c7";
-    hash = "sha256-UVgCeA4+I+7vA0DHgfDUt8Vbg37xnu/lfoRcZmnQ21w=";
+    rev = "80bc0e4784e8e8ce98c02f6802484577f28be3cc";
+    hash = "sha256-GIqbWH48snEbiiZKVk2z7H8QXZZwvkAHJxGBHwAJJts=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/applications/emulators/libretro/cores/puae2021.nix b/pkgs/applications/emulators/libretro/cores/puae2021.nix
new file mode 100644
index 000000000000..29e6673f5dd5
--- /dev/null
+++ b/pkgs/applications/emulators/libretro/cores/puae2021.nix
@@ -0,0 +1,28 @@
+{
+  lib,
+  fetchFromGitHub,
+  mkLibretroCore,
+}:
+mkLibretroCore {
+  core = "puae2021";
+  version = "0-unstable-2025-11-02";
+
+  src = fetchFromGitHub {
+    owner = "libretro";
+    repo = "libretro-uae";
+    rev = "58527ce9e8cc5f19faae9e6010d2f06fc70b10de";
+    hash = "sha256-wHzjpTh/zuV5KXaMsv7A/7xqYfzLgIUusjwg8LOUzMY=";
+  };
+
+  makefile = "Makefile";
+
+  meta = {
+    description = "Amiga emulator based on WinUAE (Version 2021)";
+    homepage = "https://github.com/libretro/libretro-uae";
+    license = lib.licenses.gpl2Only;
+    platforms = [
+      "aarch64-linux"
+      "x86_64-linux"
+    ];
+  };
+}
diff --git a/pkgs/applications/emulators/libretro/cores/snes9x.nix b/pkgs/applications/emulators/libretro/cores/snes9x.nix
index 807ffcec7742..df246b4718c0 100644
--- a/pkgs/applications/emulators/libretro/cores/snes9x.nix
+++ b/pkgs/applications/emulators/libretro/cores/snes9x.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "snes9x";
-  version = "0-unstable-2026-02-10";
+  version = "0-unstable-2026-03-21";
 
   src = fetchFromGitHub {
     owner = "snes9xgit";
     repo = "snes9x";
-    rev = "5110899f86b0facb67ebd84200e3d43e4f7f4e01";
-    hash = "sha256-DniWaYte0N7xZq8w294CVxMWYeQO3wK91ECJp+LOv3k=";
+    rev = "871a88065ca2d4e218b95626b646742a40cf88ae";
+    hash = "sha256-2XyU+KKKNBrJ7brCeqc00+QK2moOPXaWCUJ5Wc/US9A=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/stella.nix b/pkgs/applications/emulators/libretro/cores/stella.nix
index bc0bab396b0d..c8b913447af7 100644
--- a/pkgs/applications/emulators/libretro/cores/stella.nix
+++ b/pkgs/applications/emulators/libretro/cores/stella.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "stella";
-  version = "0-unstable-2026-03-02";
+  version = "0-unstable-2026-03-25";
 
   src = fetchFromGitHub {
     owner = "stella-emu";
     repo = "stella";
-    rev = "b89c2fecb2a00449c484f47ff8437bce2db1b5b9";
-    hash = "sha256-/cWHUlr9msupT6acfUub1Jr7LCPlasFD7ZCrS9kvCnI=";
+    rev = "65631824500f8764ee3da726f5f24cb06d243b60";
+    hash = "sha256-Qrr19OF6YGfvOAIBS0Irhfl4VYVFfA20ZNGIJoKboNE=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/default.nix b/pkgs/applications/emulators/libretro/default.nix
index 46faa0f29e9b..e4925f538cc7 100644
--- a/pkgs/applications/emulators/libretro/default.nix
+++ b/pkgs/applications/emulators/libretro/default.nix
@@ -149,6 +149,8 @@ lib.makeScope newScope (self: {
 
   puae = self.callPackage ./cores/puae.nix { };
 
+  puae2021 = self.callPackage ./cores/puae2021.nix { };
+
   quicknes = self.callPackage ./cores/quicknes.nix { };
 
   same_cdi = self.callPackage ./cores/same_cdi.nix { }; # the name is not a typo
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index bcaee719c623..571d835b518e 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1157,13 +1157,13 @@
     "vendorHash": "sha256-SY13J+aguuOicQnNBgutjIGh0njrLubpNl0c0b4kNwo="
   },
   "sap-cloud-infrastructure_sci": {
-    "hash": "sha256-m3degJZruqRkA/lSnNQrLfJIlpl5k8qCpbyIcsyV5/U=",
+    "hash": "sha256-eQA4mY+Rx5PLbTgGqfefYFc5gZKIvt1w2eag8ipE0PI=",
     "homepage": "https://registry.terraform.io/providers/sap-cloud-infrastructure/sci",
     "owner": "SAP-cloud-infrastructure",
     "repo": "terraform-provider-sci",
-    "rev": "v2.2.1",
+    "rev": "v2.3.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-WDyULPLN+uZ5OaE/j3FgurHbXKRU93S3nbXk8mW5dc4="
+    "vendorHash": "sha256-InCRL4k6v0avmnNja+b6Ozg5+injxa8EmrRHIWrq4Ag="
   },
   "sap_btp": {
     "hash": "sha256-5b8XFH7aPnjuf/yaMBecjM964e36KBclZZC+/kyhZDk=",
@@ -1301,11 +1301,11 @@
     "vendorHash": "sha256-Hzq97ElAjs7Y4tmJ2x7+g4j74MEdEvI2bD8pkvi5ZXg="
   },
   "temporalio_temporalcloud": {
-    "hash": "sha256-ZoDn6s4YlgoMrrAeUVmKx0rASEDoZVbcV4eFjZxaFQA=",
+    "hash": "sha256-8jui3CeYBu2xWHO5SgLvVKBfh2icUCQrKAFoRwdrev8=",
     "homepage": "https://registry.terraform.io/providers/temporalio/temporalcloud",
     "owner": "temporalio",
     "repo": "terraform-provider-temporalcloud",
-    "rev": "v1.2.1",
+    "rev": "v1.3.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-omxEb+ntQuHDfS2Rmt0rj0BF0Q2T8DLhobLua2uU/0o="
   },
diff --git a/pkgs/applications/networking/instant-messengers/discord/sources.json b/pkgs/applications/networking/instant-messengers/discord/sources.json
index c58be4ad600c..2e03ff5d0ed4 100644
--- a/pkgs/applications/networking/instant-messengers/discord/sources.json
+++ b/pkgs/applications/networking/instant-messengers/discord/sources.json
@@ -1,8 +1,8 @@
 {
   "linux-canary": {
-    "hash": "sha256-0/A5x/5F60fGN/V6n+OZh6dqsi7D2zuSNABflXK0zF4=",
-    "url": "https://canary.dl2.discordapp.net/apps/linux/0.0.902/discord-canary-0.0.902.tar.gz",
-    "version": "0.0.902"
+    "hash": "sha256-wTAmrtGcJpI/DIrLQu/++WuVzMr9EcJs+AIFkAilFvk=",
+    "url": "https://canary.dl2.discordapp.net/apps/linux/0.0.927/discord-canary-0.0.927.tar.gz",
+    "version": "0.0.927"
   },
   "linux-development": {
     "hash": "sha256-Xe5PjHDWXU+eIAcBID34gjuADmAl1JAQLmXUAi/p4tg=",
@@ -10,33 +10,33 @@
     "version": "0.0.99"
   },
   "linux-ptb": {
-    "hash": "sha256-Oywm/ckDY3Mhoy3rbW5PdBSQVsPG4vzR/zHXBFfda4c=",
-    "url": "https://ptb.dl2.discordapp.net/apps/linux/0.0.182/discord-ptb-0.0.182.tar.gz",
-    "version": "0.0.182"
+    "hash": "sha256-vnzEamdX8pCzFtYLoWHvxcznHD1FCcgKnwQOx8BkWu0=",
+    "url": "https://ptb.dl2.discordapp.net/apps/linux/0.0.183/discord-ptb-0.0.183.tar.gz",
+    "version": "0.0.183"
   },
   "linux-stable": {
-    "hash": "sha256-90XmXUbkzwiMXh1UGpeO8xqkXb589+dwUlt7iHGEwQU=",
-    "url": "https://stable.dl2.discordapp.net/apps/linux/0.0.128/discord-0.0.128.tar.gz",
-    "version": "0.0.128"
+    "hash": "sha256-FMIM/CWPk3Kcqp8iIg+gxiCpjD2DNk7dSBqnCBvzn5w=",
+    "url": "https://stable.dl2.discordapp.net/apps/linux/0.0.130/discord-0.0.130.tar.gz",
+    "version": "0.0.130"
   },
   "osx-canary": {
-    "hash": "sha256-cK3Yo7NT7MIUJYzaatO9qxNeAFwEDikPsv4CQPUZKZQ=",
-    "url": "https://canary.dl2.discordapp.net/apps/osx/0.0.1007/DiscordCanary.dmg",
-    "version": "0.0.1007"
+    "hash": "sha256-9bknJCpZv07BaF5v0g7t+YrGR3+HsYCHl4gjduQsABo=",
+    "url": "https://canary.dl2.discordapp.net/apps/osx/0.0.1040/DiscordCanary.dmg",
+    "version": "0.0.1040"
   },
   "osx-development": {
-    "hash": "sha256-UWZYRgykAiYPXPQ63cRIRiPdvG3a8lml84zgNABd0/E=",
-    "url": "https://development.dl2.discordapp.net/apps/osx/0.0.116/DiscordDevelopment.dmg",
-    "version": "0.0.116"
+    "hash": "sha256-gQL2ibCxqHsSbMu5Cor+RbioNdbuupJo8JoP4PWmJyA=",
+    "url": "https://development.dl2.discordapp.net/apps/osx/0.0.119/DiscordDevelopment.dmg",
+    "version": "0.0.119"
   },
   "osx-ptb": {
-    "hash": "sha256-jnzl9VXIH0AlTtt8BKfVlIRVxAPUBq6iyxECjpE/c+E=",
-    "url": "https://ptb.dl2.discordapp.net/apps/osx/0.0.214/DiscordPTB.dmg",
-    "version": "0.0.214"
+    "hash": "sha256-SV6ZdD0CCnNNkSWyIDqCmg9dpdQr4JLbrD3+k8943PQ=",
+    "url": "https://ptb.dl2.discordapp.net/apps/osx/0.0.226/DiscordPTB.dmg",
+    "version": "0.0.226"
   },
   "osx-stable": {
-    "hash": "sha256-zMIBZtvmncIAR3IEYblss7oP7miyRpmCkqao/NSA67k=",
-    "url": "https://stable.dl2.discordapp.net/apps/osx/0.0.380/Discord.dmg",
-    "version": "0.0.380"
+    "hash": "sha256-vBadXUHrYhvkqzkCvGnKf25A19TKcFs5D0tzC54E0Hk=",
+    "url": "https://stable.dl2.discordapp.net/apps/osx/0.0.382/Discord.dmg",
+    "version": "0.0.382"
   }
 }
diff --git a/pkgs/by-name/al/aldente/package.nix b/pkgs/by-name/al/aldente/package.nix
index 27cd0341e2c0..548ce892bcca 100644
--- a/pkgs/by-name/al/aldente/package.nix
+++ b/pkgs/by-name/al/aldente/package.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "aldente";
-  version = "1.36.2";
+  version = "1.37";
 
   src = fetchurl {
     url = "https://github.com/AppHouseKitchen/AlDente-Battery_Care_and_Monitoring/releases/download/${finalAttrs.version}/AlDente.dmg";
-    hash = "sha256-VeNEONO7wachGgCFDybH4tGaz58xlTG10S/rvm/S/Tc=";
+    hash = "sha256-nkwJl4xMhbdodBRtwyG2IcmDlTJnErOvEycjcdAMP2o=";
   };
 
   dontBuild = true;
diff --git a/pkgs/by-name/an/andcli/package.nix b/pkgs/by-name/an/andcli/package.nix
index 5ff60790ce76..2753d00b83f4 100644
--- a/pkgs/by-name/an/andcli/package.nix
+++ b/pkgs/by-name/an/andcli/package.nix
@@ -8,7 +8,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "andcli";
-  version = "2.6.0";
+  version = "2.6.1";
 
   subPackages = [ "cmd/andcli" ];
 
@@ -16,7 +16,7 @@ buildGoModule (finalAttrs: {
     owner = "tjblackheart";
     repo = "andcli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iJSeUMELbyuL8h/8dfWVA5jDW3XpXG6y1mCkWRF1Kpo=";
+    hash = "sha256-iNquGZfnXIo/UcTcRYdw+reV5TEPymHsX3kZdT66IPw=";
   };
 
   vendorHash = "sha256-ZfU8Sf9M2dz9aIhwiK58zGIrcpmaw8wMAdcpxxvkUsQ=";
diff --git a/pkgs/by-name/bi/biome/package.nix b/pkgs/by-name/bi/biome/package.nix
index 1190635b4ed7..19f4a9df36eb 100644
--- a/pkgs/by-name/bi/biome/package.nix
+++ b/pkgs/by-name/bi/biome/package.nix
@@ -11,16 +11,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "biome";
-  version = "2.4.7";
+  version = "2.4.9";
 
   src = fetchFromGitHub {
     owner = "biomejs";
     repo = "biome";
     rev = "@biomejs/biome@${finalAttrs.version}";
-    hash = "sha256-Ca1a8Q6YJpGUMZ3cbQkIndmeE10V7myB/3EQ4r3fa1o=";
+    hash = "sha256-Fv+jqgwI4UZNwsy5oC+ekXmnJpIqIXWY+ttRbIu+lQg=";
   };
 
-  cargoHash = "sha256-z2JtrZkvlvfQGhhY3T3PIiXUq53bSb7Z8rgvGZPzPag=";
+  cargoHash = "sha256-vU7yFXNx3r0aCDdMVra1omo+HgK5OwCohgbjyP3Q5VI=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/ca/cargo-llvm-cov/Cargo.lock b/pkgs/by-name/ca/cargo-llvm-cov/Cargo.lock
index b1fa2d18e392..4f2c0388d604 100644
--- a/pkgs/by-name/ca/cargo-llvm-cov/Cargo.lock
+++ b/pkgs/by-name/ca/cargo-llvm-cov/Cargo.lock
@@ -13,9 +13,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.101"
+version = "1.0.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f0e0fee31ef5ed1ba1316088939cea399010ed7731dba877ed44aeb407a75ea"
+checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
 
 [[package]]
 name = "autocfg"
@@ -25,9 +25,9 @@ checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
 
 [[package]]
 name = "bitflags"
-version = "2.10.0"
+version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"
+checksum = "843867be96c8daad0d758b57df9392b6d8d271134fce549de6ce169ff98a92af"
 
 [[package]]
 name = "bstr"
@@ -42,9 +42,9 @@ dependencies = [
 
 [[package]]
 name = "build-context"
-version = "0.1.3"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86610cb1e9d45d65a31b574f9d69de003a76b6bb0b7d882396a5153fc547c935"
+checksum = "ebb068a5ba5b65a7cdba869497ca2a352e88e6093c4909ddf4d12d9d3151ee9c"
 
 [[package]]
 name = "camino"
@@ -54,9 +54,9 @@ checksum = "e629a66d692cb9ff1a1c664e41771b3dcaf961985a9774c0eb0bd1b51cf60a48"
 
 [[package]]
 name = "cargo-config2"
-version = "0.1.39"
+version = "0.1.43"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3795d3a48839a46854805f56c8fe9c558f10804bcf57df53925ca843d87c788f"
+checksum = "1f7dacdd4a7586d602c2543e0217304bebc6502bde82154209cd8f09f24a7718"
 dependencies = [
  "serde",
  "serde_derive",
@@ -66,7 +66,7 @@ dependencies = [
 
 [[package]]
 name = "cargo-llvm-cov"
-version = "0.8.3"
+version = "0.8.5"
 dependencies = [
  "anyhow",
  "build-context",
@@ -140,9 +140,9 @@ dependencies = [
 
 [[package]]
 name = "fs-err"
-version = "3.2.2"
+version = "3.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf68cef89750956493a66a10f512b9e58d9db21f2a573c079c0bdf1207a54a7"
+checksum = "73fde052dbfc920003cfd2c8e2c6e6d4cc7c1091538c3a24226cec0665ab08c0"
 dependencies = [
  "autocfg",
 ]
@@ -155,15 +155,15 @@ checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
 
 [[package]]
 name = "itoa"
-version = "1.0.17"
+version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92ecc6618181def0457392ccd0ee51198e065e016d1d527a7ac1b6dc7c1f09d2"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "lcov2cobertura"
-version = "1.0.6"
+version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aaa0cf456e88a45378a5737f228c0800175d94be6856908dc4718b3a91c7c9f8"
+checksum = "bf5d75e3487295500b5426ad473805696126915b3e647ecdd5b9597a17766c6a"
 dependencies = [
  "anyhow",
  "quick-xml",
@@ -173,38 +173,39 @@ dependencies = [
 
 [[package]]
 name = "lexopt"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fa0e2a1fcbe2f6be6c42e342259976206b383122fc152e872795338b5a3f3a7"
+checksum = "803ec87c9cfb29b9d2633f20cba1f488db3fd53f2158b1024cbefb47ba05d413"
 
 [[package]]
 name = "libc"
-version = "0.2.180"
+version = "0.2.183"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bcc35a38544a891a5f7c865aca548a982ccb3b8650a5b06d0fd33a10283c56fc"
+checksum = "b5b646652bf6661599e1da8901b3b9522896f01e736bad5f723fe7a3a27f899d"
 
 [[package]]
 name = "libredox"
-version = "0.1.12"
+version = "0.1.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d0b95e02c851351f877147b7deea7b1afb1df71b63aa5f8270716e0c5720616"
+checksum = "1744e39d1d6a9948f4f388969627434e31128196de472883b39f148769bfe30a"
 dependencies = [
  "bitflags",
  "libc",
+ "plain",
  "redox_syscall",
 ]
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.11.0"
+version = "0.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df1d3c3b53da64cf5760482273a98e575c651a67eec7f77df96b5b642de8f039"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
 
 [[package]]
 name = "memchr"
-version = "2.7.6"
+version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f52b00d39961fc5b2736ea853c9cc86238e165017a493d1d5c8eac6bdc4cc273"
+checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
 
 [[package]]
 name = "normpath"
@@ -217,9 +218,9 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.21.3"
+version = "1.21.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42f5e15c9953c5e4ccceeb2e7382a716482c34515315f7b03532b8b4e8393d2d"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
 
 [[package]]
 name = "opener"
@@ -242,6 +243,12 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "plain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
+
 [[package]]
 name = "proc-macro2"
 version = "1.0.106"
@@ -253,27 +260,27 @@ dependencies = [
 
 [[package]]
 name = "quick-xml"
-version = "0.37.5"
+version = "0.39.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "331e97a1af0bf59823e6eadffe373d7b27f485be8748f71471c662c1f269b7fb"
+checksum = "958f21e8e7ceb5a1aa7fa87fab28e7c75976e0bfe7e23ff069e0a260f894067d"
 dependencies = [
  "memchr",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.44"
+version = "1.0.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21b2ebcf727b7760c461f091f9f0f539b77b8e87f2fd88131e7f1b433b3cece4"
+checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
 dependencies = [
  "proc-macro2",
 ]
 
 [[package]]
 name = "redox_syscall"
-version = "0.7.0"
+version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49f3fe0889e69e2ae9e41f4d6c4c0181701d00e4697b356fb1f74173a5e0ee27"
+checksum = "6ce70a74e890531977d37e532c34d45e9055d2409ed08ddba14529471ed0be16"
 dependencies = [
  "bitflags",
 ]
@@ -303,9 +310,9 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.9"
+version = "0.8.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a96887878f22d7bad8a3b6dc5b7440e0ada9a245242924394987b21cf2210a4c"
+checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
 
 [[package]]
 name = "rustc-demangle"
@@ -315,9 +322,9 @@ checksum = "b50b8869d9fc858ce7266cce0194bd74df58b9d0e3f6df3a9fc8eb470d95c09d"
 
 [[package]]
 name = "rustix"
-version = "1.1.3"
+version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "146c9e247ccc180c1f61615433868c99f3de3ae256a30a43b49f67c2d9171f34"
+checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
 dependencies = [
  "bitflags",
  "errno",
@@ -422,9 +429,9 @@ checksum = "45bb67a18fa91266cc7807181f62f9178a6873bfad7dc788c42e6430db40184f"
 
 [[package]]
 name = "syn"
-version = "2.0.114"
+version = "2.0.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4d107df263a3013ef9b1879b0df87d706ff80f65a86ea879bd9c31f9b307c2a"
+checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -433,9 +440,9 @@ dependencies = [
 
 [[package]]
 name = "tar"
-version = "0.4.44"
+version = "0.4.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d863878d212c87a19c1a610eb53bb01fe12951c0501cf5a0d65f724914a667a"
+checksum = "22692a6476a21fa75fdfc11d452fda482af402c008cdbaf3476414e122040973"
 dependencies = [
  "filetime",
  "libc",
@@ -444,9 +451,9 @@ dependencies = [
 
 [[package]]
 name = "tempfile"
-version = "3.24.0"
+version = "3.27.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "655da9c7eb6305c55742045d5a8d2037996d61d8de95806335c7c86ce0f82e9c"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
  "once_cell",
@@ -473,9 +480,9 @@ dependencies = [
 
 [[package]]
 name = "toml"
-version = "0.9.11+spec-1.1.0"
+version = "1.0.7+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3afc9a848309fe1aaffaed6e1546a7a14de1f935dc9d89d32afd9a44bab7c46"
+checksum = "dd28d57d8a6f6e458bc0b8784f8fdcc4b99a437936056fa122cb234f18656a96"
 dependencies = [
  "serde_core",
  "serde_spanned",
@@ -486,27 +493,27 @@ dependencies = [
 
 [[package]]
 name = "toml_datetime"
-version = "0.7.5+spec-1.1.0"
+version = "1.0.1+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92e1cfed4a3038bc5a127e35a2d360f145e1f4b971b551a2ba5fd7aedf7e1347"
+checksum = "9b320e741db58cac564e26c607d3cc1fdc4a88fd36c879568c07856ed83ff3e9"
 dependencies = [
  "serde_core",
 ]
 
 [[package]]
 name = "toml_parser"
-version = "1.0.6+spec-1.1.0"
+version = "1.0.10+spec-1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a3198b4b0a8e11f09dd03e133c0280504d0801269e9afa46362ffde1cbeebf44"
+checksum = "7df25b4befd31c4816df190124375d5a20c6b6921e2cad937316de3fccd63420"
 dependencies = [
  "winnow",
 ]
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.22"
+version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9312f7c4f6ff9069b165498234ce8be658059c6728633667c526e27dc2cf1df5"
+checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
 [[package]]
 name = "walkdir"
@@ -618,9 +625,9 @@ checksum = "d6bbff5f0aada427a1e5a6da5f1f98158182f26556f345ac9e04d36d0ebed650"
 
 [[package]]
 name = "winnow"
-version = "0.7.14"
+version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a5364e9d77fcdeeaa6062ced926ee3381faa2ee02d3eb83a5c27a8825540829"
+checksum = "a90e88e4667264a994d34e6d1ab2d26d398dcdca8b7f52bec8668957517fc7d8"
 
 [[package]]
 name = "xattr"
@@ -634,6 +641,6 @@ dependencies = [
 
 [[package]]
 name = "zmij"
-version = "1.0.19"
+version = "1.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3ff05f8caa9038894637571ae6b9e29466c1f4f829d26c9b28f869a29cbe3445"
+checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"
diff --git a/pkgs/by-name/ca/cargo-llvm-cov/package.nix b/pkgs/by-name/ca/cargo-llvm-cov/package.nix
index 18b8a9b3a699..853476334d0d 100644
--- a/pkgs/by-name/ca/cargo-llvm-cov/package.nix
+++ b/pkgs/by-name/ca/cargo-llvm-cov/package.nix
@@ -25,7 +25,7 @@
 
 let
   pname = "cargo-llvm-cov";
-  version = "0.8.3";
+  version = "0.8.5";
 
   owner = "taiki-e";
   homepage = "https://github.com/${owner}/${pname}";
@@ -42,7 +42,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     inherit owner;
     repo = "cargo-llvm-cov";
     rev = "v${version}";
-    sha256 = "sha256-XMv0li/zBNE3FJpcIpja6SqNp4f5GPOET5rfPWLIzRw=";
+    sha256 = "sha256-acd2qauvcVPxDjMuFXkaUxDL4kXoDSCVKDG7ki2pK/Y=";
   };
 
   # Upstream doesn't include the lockfile so we need to add it back
diff --git a/pkgs/by-name/ca/cargo-msrv/package.nix b/pkgs/by-name/ca/cargo-msrv/package.nix
index eedd18f5ea4a..cbf8b8d4481f 100644
--- a/pkgs/by-name/ca/cargo-msrv/package.nix
+++ b/pkgs/by-name/ca/cargo-msrv/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-msrv";
-  version = "0.19.2";
+  version = "0.19.3";
 
   src = fetchFromGitHub {
     owner = "foresterre";
     repo = "cargo-msrv";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-GsreJpQ+WsiKIRbQx4gXyH24JnoMUgJSVLFvljWxJq8=";
+    sha256 = "sha256-qt1Mlj4/DSh8V/SkgorLJFRdLwbtXyOvrISU1vmXzyg=";
   };
 
-  cargoHash = "sha256-+7O+9wS72QCHNYcXJUFyc4I9PFH5B8OvisVKf5bBDdY=";
+  cargoHash = "sha256-cqTSLpmS/9BgtuVXlqBrxpFCPPs+wFhqOalOVhPD5r8=";
 
   passthru.updateScript = nix-update-script {
     extraArgs = [ "--version-regex=^v([0-9.]+)$" ];
@@ -53,6 +53,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     maintainers = with lib.maintainers; [
       otavio
       matthiasbeyer
+      chrjabs
     ];
   };
 })
diff --git a/pkgs/by-name/cb/cbmbasic/package.nix b/pkgs/by-name/cb/cbmbasic/package.nix
index 38fd85923edc..f6019dae8d97 100644
--- a/pkgs/by-name/cb/cbmbasic/package.nix
+++ b/pkgs/by-name/cb/cbmbasic/package.nix
@@ -16,6 +16,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-aA/ivRap+aDd2wi6KWXam9eP/21lOn6OWTeZ4i/S9Bs=";
   };
 
+  postPatch = ''
+    substituteInPlace cbmbasic.c \
+      --replace-fail "typedef unsigned char bool;" ""
+  '';
+
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/by-name/ce/certinfo/package.nix b/pkgs/by-name/ce/certinfo/package.nix
index da33d8c3784b..2a7c06bb7c87 100644
--- a/pkgs/by-name/ce/certinfo/package.nix
+++ b/pkgs/by-name/ce/certinfo/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "certinfo";
-  version = "1.0.39";
+  version = "1.0.40";
 
   src = fetchFromGitHub {
     owner = "pete911";
     repo = "certinfo";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-U3uVQiALtI7aWkIPQyHxSzMTD6AjAMoOEjkbPO07SdA=";
+    sha256 = "sha256-2Feb2+7UJ+39waO9rFyT3ZDlEdS5s3uLuxUiDh4iuJE=";
   };
 
   # clipboard functionality not working on Darwin
diff --git a/pkgs/by-name/cf/cfclient/package.nix b/pkgs/by-name/cf/cfclient/package.nix
index d6c37709442c..1c96940a044f 100644
--- a/pkgs/by-name/cf/cfclient/package.nix
+++ b/pkgs/by-name/cf/cfclient/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "cfclient";
-  version = "2025.2";
+  version = "2025.12.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bitcraze";
     repo = "crazyflie-clients-python";
     tag = finalAttrs.version;
-    hash = "sha256-LCGTMLIfGH59KFwQACyuEQTh/zkGgzXd3e6MkFTgKhA=";
+    hash = "sha256-+3RZRShELL2iXxz95eRhK5UPp5NZ1yJO4NDlZ7cDTjI=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/cl/clean/package.nix b/pkgs/by-name/cl/clean/package.nix
index c75a7296b6ae..6a51494bfb81 100644
--- a/pkgs/by-name/cl/clean/package.nix
+++ b/pkgs/by-name/cl/clean/package.nix
@@ -40,6 +40,8 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail /usr/bin/gcc ${gcc}/bin/gcc
   '';
 
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
+
   buildFlags = [ "-C src/" ];
 
   # do not strip libraries and executables since all symbols since they are
diff --git a/pkgs/by-name/cr/crun/package.nix b/pkgs/by-name/cr/crun/package.nix
index 65e73259621c..fa878d0e9395 100644
--- a/pkgs/by-name/cr/crun/package.nix
+++ b/pkgs/by-name/cr/crun/package.nix
@@ -41,13 +41,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "crun";
-  version = "1.26";
+  version = "1.27";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "crun";
     tag = finalAttrs.version;
-    hash = "sha256-h9X9UNPXNLSN+b9ka1kXMfApxkU4j5zU3yyyBQyYmwE=";
+    hash = "sha256-AhNKSwKZdm/8rZsDIGwNdNcVUXFvEGQecGw3pZYjmZw=";
     fetchSubmodules = true;
     leaveDotGit = true;
     postFetch = ''
diff --git a/pkgs/by-name/ge/gefyra/package.nix b/pkgs/by-name/ge/gefyra/package.nix
index b37cdd11b502..febfc6194dfe 100644
--- a/pkgs/by-name/ge/gefyra/package.nix
+++ b/pkgs/by-name/ge/gefyra/package.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gefyra";
-  version = "2.3.3";
+  version = "2.4.0";
 
   src = fetchzip {
     url = "https://github.com/gefyrahq/gefyra/releases/download/${finalAttrs.version}/gefyra-${finalAttrs.version}-linux-amd64.zip";
-    hash = "sha256-YHU39Ti1PezdHrB9EIwUpF85YiWEmkZsCQU7pEWY+G4=";
+    hash = "sha256-PBwAVdTa1DL7KwAFhei1AcTdPyrcaCsyo6zif+UwJPk=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/gh/ghgrab/package.nix b/pkgs/by-name/gh/ghgrab/package.nix
new file mode 100644
index 000000000000..1d360bd32066
--- /dev/null
+++ b/pkgs/by-name/gh/ghgrab/package.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  stdenv,
+}:
+
+# note: upstream has a flake
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "ghgrab";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "abhixdd";
+    repo = "ghgrab";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-09+DI1/jKfcbPNB1rUyXtu642TuU7z9UBbQllg9uoQM=";
+  };
+
+  cargoHash = "sha256-9o5AQxe/G5Yc6T/Ogtvq1N32t2eM8jAKt6CIvNBzX70=";
+
+  # fails on darwin
+  # https://github.com/abhixdd/ghgrab/issues/31
+  checkFlags = lib.optionals stdenv.hostPlatform.isDarwin [
+    "--skip=agent_tree_invalid_url_returns_json_error"
+  ];
+
+  meta = {
+    changelog = "https://github.com/abhixdd/ghgrab/releases/tag/v${finalAttrs.version}";
+    description = "Simple, pretty terminal tool that lets you search and download files from GitHub without leaving your CLI";
+    homepage = "https://github.com/abhixdd/ghgrab";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ phanirithvij ];
+    mainProgram = "ghgrab";
+  };
+})
diff --git a/pkgs/by-name/gl/global-platform-pro/package.nix b/pkgs/by-name/gl/global-platform-pro/package.nix
index a89e1057c104..67d99f61406f 100644
--- a/pkgs/by-name/gl/global-platform-pro/package.nix
+++ b/pkgs/by-name/gl/global-platform-pro/package.nix
@@ -9,6 +9,7 @@
   pcsclite,
   proot,
   zlib,
+  versionCheckHook,
 }:
 
 let
@@ -31,8 +32,8 @@ maven.buildMavenPackage rec {
   src = fetchFromGitHub {
     owner = "martinpaljak";
     repo = "GlobalPlatformPro";
-    rev = "v${version}";
-    sha256 = "sha256-H4rq68ECfdUvgTbG4Ho1EgAgD+1qTZu5DYfg+SjrDkw=";
+    tag = "v${version}";
+    hash = "sha256-H4rq68ECfdUvgTbG4Ho1EgAgD+1qTZu5DYfg+SjrDkw=";
   };
 
   mvnJdk = jdk11;
@@ -69,6 +70,9 @@ maven.buildMavenPackage rec {
       --prefix LD_LIBRARY_PATH : "${lib.getLib pcsclite}/lib"
   '';
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
   meta = {
     description = "Command-line utility for managing applets and keys on Java Cards";
     longDescription = ''
diff --git a/pkgs/by-name/gr/gromit-mpx/package.nix b/pkgs/by-name/gr/gromit-mpx/package.nix
index ea65d36cb5f2..12d66df4ae31 100644
--- a/pkgs/by-name/gr/gromit-mpx/package.nix
+++ b/pkgs/by-name/gr/gromit-mpx/package.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gromit-mpx";
-  version = "1.8.0";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "bk138";
     repo = "gromit-mpx";
     tag = finalAttrs.version;
-    hash = "sha256-dqZbkbjcfNO/rlUn5pCDdPU5rYyG1qSR38WROFwPlN0=";
+    hash = "sha256-DgPhQtLmrhcRInaY4s23izWte86DczprjnWhfiiYsSE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/lz/lziprecover/package.nix b/pkgs/by-name/lz/lziprecover/package.nix
index af7c2a948b35..ddf5e78235fb 100644
--- a/pkgs/by-name/lz/lziprecover/package.nix
+++ b/pkgs/by-name/lz/lziprecover/package.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lziprecover";
-  version = "1.25";
+  version = "1.26";
 
   src = fetchurl {
     url = "mirror://savannah/lzip/lziprecover/lziprecover-${finalAttrs.version}.tar.gz";
-    sha256 = "4f392f9c780ae266ee3d0db166b0f1b4d3ae07076e401dc2b199dc3a0fff8b45";
+    sha256 = "sha256-4jQAWnVtVkn0FoYRbT5UhzbUp35aXsN7lDymZQeHgB0=";
     # This hash taken from the mailing list announcement.
   };
 
diff --git a/pkgs/by-name/ma/mapserver/package.nix b/pkgs/by-name/ma/mapserver/package.nix
index 44fb40058e43..1a0ae8adeafe 100644
--- a/pkgs/by-name/ma/mapserver/package.nix
+++ b/pkgs/by-name/ma/mapserver/package.nix
@@ -30,13 +30,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mapserver";
-  version = "8.6.0";
+  version = "8.6.1";
 
   src = fetchFromGitHub {
     owner = "MapServer";
     repo = "MapServer";
     rev = "rel-${lib.replaceStrings [ "." ] [ "-" ] finalAttrs.version}";
-    hash = "sha256-KfCYYbBAsOKWkpaPIiN+xxu1IXoMkk0NWSdndk8FpTg=";
+    hash = "sha256-hzYgFJHQOV5c4eR7wUCWWvc6iLfQacEUH6PSc5VwfgA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mk/mkosi/0001-Use-wrapped-binaries-instead-of-Python-interpreter.patch b/pkgs/by-name/mk/mkosi/0001-Use-wrapped-binaries-instead-of-Python-interpreter.patch
index 90f0223665d5..a7db324cb59f 100644
--- a/pkgs/by-name/mk/mkosi/0001-Use-wrapped-binaries-instead-of-Python-interpreter.patch
+++ b/pkgs/by-name/mk/mkosi/0001-Use-wrapped-binaries-instead-of-Python-interpreter.patch
@@ -7,13 +7,13 @@ Rather than calling ukify and mkosi with sys.executable, which doesn't use the P
 
 Signed-off-by: Moritz Sanft <58110325+msanft@users.noreply.github.com>
 ---
- mkosi/__init__.py   | 17 +++++++----------
+ mkosi/__init__.py   | 21 +++++++++++----------
  mkosi/bootloader.py |  3 +--
- mkosi/run.py        |  6 +++---
- 3 files changed, 11 insertions(+), 15 deletions(-)
+ mkosi/run.py        | 10 +++++++---
+ 3 files changed, 19 insertions(+), 15 deletions(-)
 
 diff --git a/mkosi/__init__.py b/mkosi/__init__.py
-index f4766ae71244a21caa5bcbf5b5376f617c706b33..8f85f923b41feaa7716ae409cc2e983a73579ea8 100644
+index f4766ae71244a21caa5bcbf5b5376f617c706b33..e022c2e2e3ea267a78c69c219890572652e3f350 100644
 --- a/mkosi/__init__.py
 +++ b/mkosi/__init__.py
 @@ -613,7 +613,7 @@ def finalize_host_scripts(
@@ -25,16 +25,20 @@ index f4766ae71244a21caa5bcbf5b5376f617c706b33..8f85f923b41feaa7716ae409cc2e983a
      return finalize_scripts(context.config, scripts | dict(helpers))
  
  
-@@ -755,7 +755,7 @@ def script_maybe_chroot_sandbox(
+@@ -755,7 +755,11 @@ def script_maybe_chroot_sandbox(
  
      helpers = {
          "mkosi-chroot": [
 -            finalize_interpreter(bool(context.config.tools_tree)), "-SI", "/sandbox.py",
-+            @MKOSI_SANDBOX@,
++            *(
++                ["@MKOSI_SANDBOX@"]
++                if not bool(context.config.tools_tree)
++                else [finalize_interpreter(bool(context.config.tools_tree)), "-SI", "/sandbox.py"]
++            ),
              "--bind", "/buildroot", "/",
              "--bind", "/var/tmp", "/var/tmp",
              *apivfs_options(root=Path("/")),
-@@ -1587,7 +1587,7 @@ def run_ukify(
+@@ -1587,7 +1591,7 @@ def run_ukify(
      sign: bool = True,
      json_out: bool = False,
  ) -> dict[str, Any]:
@@ -43,7 +47,7 @@ index f4766ae71244a21caa5bcbf5b5376f617c706b33..8f85f923b41feaa7716ae409cc2e983a
      if not ukify:
          die("Could not find ukify")
  
-@@ -1599,7 +1599,6 @@ def run_ukify(
+@@ -1599,7 +1603,6 @@ def run_ukify(
      (context.workspace / "cmdline").write_text(f"{' '.join(cmdline)}\x00")
  
      cmd = [
@@ -51,7 +55,7 @@ index f4766ae71244a21caa5bcbf5b5376f617c706b33..8f85f923b41feaa7716ae409cc2e983a
          ukify,
          "build",
          *arguments,
-@@ -1694,7 +1693,7 @@ def build_uki(
+@@ -1694,7 +1697,7 @@ def build_uki(
      profiles: Sequence[Path],
      output: Path,
  ) -> dict[str, Any]:
@@ -60,7 +64,7 @@ index f4766ae71244a21caa5bcbf5b5376f617c706b33..8f85f923b41feaa7716ae409cc2e983a
          die("Could not find ukify")
  
      json_out = False
-@@ -1755,7 +1754,6 @@ def build_uki(
+@@ -1755,7 +1758,6 @@ def build_uki(
  
          if (
              systemd_tool_version(
@@ -68,7 +72,7 @@ index f4766ae71244a21caa5bcbf5b5376f617c706b33..8f85f923b41feaa7716ae409cc2e983a
                  ukify,
                  sandbox=context.sandbox,
              )
-@@ -1815,7 +1813,6 @@ def build_uki(
+@@ -1815,7 +1817,6 @@ def build_uki(
          # new .ucode section support?
          if (
              systemd_tool_version(
@@ -76,7 +80,7 @@ index f4766ae71244a21caa5bcbf5b5376f617c706b33..8f85f923b41feaa7716ae409cc2e983a
                  ukify,
                  sandbox=context.sandbox,
              )
-@@ -1883,7 +1880,7 @@ def want_uki(context: Context) -> bool:
+@@ -1883,7 +1884,7 @@ def want_uki(context: Context) -> bool:
          or (
              context.config.unified_kernel_images == UnifiedKernelImage.auto
              and systemd_stub_binary(context).exists()
@@ -85,7 +89,7 @@ index f4766ae71244a21caa5bcbf5b5376f617c706b33..8f85f923b41feaa7716ae409cc2e983a
          )
      )
  
-@@ -2799,9 +2796,9 @@ def check_ukify(
+@@ -2799,9 +2800,9 @@ def check_ukify(
      reason: str,
      hint: Optional[str] = None,
  ) -> None:
@@ -112,19 +116,23 @@ index 7d434bb4776980c6fa58ae8f7795f3ffc319baeb..8960a6d17d153b06b029f9072a464a12
  
  def extract_pe_section(context: Context, binary: Path, section: str, output: Path) -> Path:
 diff --git a/mkosi/run.py b/mkosi/run.py
-index 159b75c1af1b5d84e409426e566e098571086c8e..7ade34fc6a9d53e010f5f45cce53a9c92407f49d 100644
+index 159b75c1af1b5d84e409426e566e098571086c8e..68572039cbeddcb1c32ffc1e2ba34c91dede52b0 100644
 --- a/mkosi/run.py
 +++ b/mkosi/run.py
-@@ -238,7 +238,7 @@ def spawn(
+@@ -238,7 +238,11 @@ def spawn(
              module = stack.enter_context(resource_path(sys.modules[__package__ or __name__]))
              prefix = [
                  *(["strace", "--detach-on=execve", "--string-limit=256"] if ARG_DEBUG_SANDBOX.get() else []),
 -                sys.executable, "-SI", os.fspath(module / "sandbox.py"),
-+                @MKOSI_SANDBOX@,
++                *(
++                    ["@MKOSI_SANDBOX@"]
++                    if os.path.exists("@MKOSI_SANDBOX@")
++                    else [sys.executable, "-SI", os.fspath(module / "sandbox.py")]
++                ),
                  *sbx,
              ]  # fmt: skip
  
-@@ -321,7 +321,7 @@ def finalize_path(
+@@ -321,7 +325,7 @@ def finalize_path(
          # Make sure that /usr/bin and /usr/sbin are always in $PATH.
          path += [s for s in ("/usr/bin", "/usr/sbin") if s not in path]
      else:
@@ -133,7 +141,7 @@ index 159b75c1af1b5d84e409426e566e098571086c8e..7ade34fc6a9d53e010f5f45cce53a9c9
  
      if prefix_usr:
          path = [os.fspath(root / s.lstrip("/")) if s in ("/usr/bin", "/usr/sbin") else s for s in path]
-@@ -690,7 +690,7 @@ def chroot_options() -> list[PathString]:
+@@ -690,7 +694,7 @@ def chroot_options() -> list[PathString]:
          "--unshare-ipc",
          "--setenv", "container", "mkosi",
          "--setenv", "HOME", "/",
diff --git a/pkgs/by-name/mk/mkosi/package.nix b/pkgs/by-name/mk/mkosi/package.nix
index 37efb6e3c62b..11772d2d1914 100644
--- a/pkgs/by-name/mk/mkosi/package.nix
+++ b/pkgs/by-name/mk/mkosi/package.nix
@@ -94,7 +94,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   postPatch = ''
     # As we need the $out reference, we can't use `replaceVars` here.
     substituteInPlace mkosi/{run,__init__}.py \
-      --replace-fail '@MKOSI_SANDBOX@' "\"$out/bin/mkosi-sandbox\""
+      --replace-fail '@MKOSI_SANDBOX@' "$out/bin/mkosi-sandbox"
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ni/ni/package.nix b/pkgs/by-name/ni/ni/package.nix
index 1269ef2a8152..b523718f290b 100644
--- a/pkgs/by-name/ni/ni/package.nix
+++ b/pkgs/by-name/ni/ni/package.nix
@@ -12,19 +12,19 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "ni";
-  version = "29.0.0";
+  version = "30.0.0";
 
   src = fetchFromGitHub {
     owner = "antfu-collective";
     repo = "ni";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PRYsKIpjb3Mu+U1Vc4eHx07LHZt7DycEkb/AFsi/OgA=";
+    hash = "sha256-CCegG/ClJV4SsuCztUbUy6fw0nFod8FLpIXvftPA9cg=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 2;
-    hash = "sha256-zYKsg9tMaiclazKkiE8EIKRJFwePEwChsvFOs9bp1jE=";
+    hash = "sha256-BoQO6oTctvRAzHUw6dsOSV5w7uLzrnD1+KmP9irG0Z4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ni/nixtamal/package.nix b/pkgs/by-name/ni/nixtamal/package.nix
index 047bf43687a4..03bfb4a770ce 100644
--- a/pkgs/by-name/ni/nixtamal/package.nix
+++ b/pkgs/by-name/ni/nixtamal/package.nix
@@ -18,7 +18,7 @@
 
 ocamlPackages.buildDunePackage (finalAttrs: {
   pname = "nixtamal";
-  version = "1.1.4";
+  version = "1.1.5";
   release_year = 2026;
 
   minimalOCamlVersion = "5.3";
@@ -27,7 +27,7 @@ ocamlPackages.buildDunePackage (finalAttrs: {
     url = "https://darcs.toastal.in.th/nixtamal/stable/";
     mirrors = [ "https://smeder.ee/~toastal/nixtamal.darcs" ];
     rev = finalAttrs.version;
-    hash = "sha256-iLjVuNS0pgoWoXp/Yr6ovEazXqhe5bflqtuzFupxmw0=";
+    hash = "sha256-viMbqPq/XyvRt7AsVk/wT1hbWlZGXqiOfp4SccqyOI8=";
   };
 
   nativeBuildInputs = [
@@ -80,17 +80,32 @@ ocamlPackages.buildDunePackage (finalAttrs: {
 
   outputs = [
     "bin"
+    "data"
+    "doc"
     "lib"
+    "man"
     "out"
   ];
 
   installPhase = ''
     runHook preInstall
-    dune install --prefix="$bin" --libdir="$lib/lib/ocaml/${ocamlPackages.ocaml.version}/site-lib" nixtamal
-    for dep in ${ocamlPackages.ocaml} ${ocamlPackages.camomile}
+
+    dune install \
+       -j "$NIX_BUILD_CORES" \
+       --cache="disabled" \
+       --prefix="$out" \
+       --bindir="$bin/bin" \
+       --datadir="$data/share" \
+       --docdir="$doc/share/doc" \
+       --mandir="$man/share/man" \
+       --libdir="$lib/lib/ocaml/${ocamlPackages.ocaml.version}/site-lib" \
+       nixtamal
+
+    for dep in "${ocamlPackages.ocaml}" "${ocamlPackages.camomile}"
     do
-        remove-references-to -t $dep $bin/bin/nixtamal
+        remove-references-to -t "$dep" "$bin/bin/nixtamal"
     done
+
     wrapProgram "$bin/bin/nixtamal" --prefix PATH : ${
       lib.makeBinPath [
         coreutils
@@ -100,6 +115,7 @@ ocamlPackages.buildDunePackage (finalAttrs: {
         nix-prefetch-pijul
       ]
     }
+
     runHook postInstall
   '';
 
@@ -112,6 +128,12 @@ ocamlPackages.buildDunePackage (finalAttrs: {
     license = with lib.licenses; [ gpl3Plus ];
     platforms = lib.platforms.unix;
     mainProgram = "nixtamal";
+    outputsToInstall = [
+      "bin"
+      "data"
+      "doc"
+      "man"
+    ];
     homepage = "https://nixtamal.toast.al";
     changelog = "https://nixtamal.toast.al/changelog/";
     description = "Fulfilling input pinning for Nix";
@@ -119,7 +141,8 @@ ocamlPackages.buildDunePackage (finalAttrs: {
       Nixtamal’s keys features
 
       • Automate the manual work of input pinning, allowing to lock & refresh inputs
-      • Declaritive KDL manifest file over imperative CLI flags
+      • Declarative KDL manifest file over imperative CLI flags
+      • diff/grep-friendly lockfile
       • Host, forge, VCS-agnostic
       • Choose eval time fetchers (builtins) or build time fetchers (Nixpkgs, default) — which opens up fetching Darcs, Pijul, & Fossil
       • Supports mirrors
diff --git a/pkgs/by-name/or/ory/package.nix b/pkgs/by-name/or/ory/package.nix
index be07e3ec9d48..9e080c70361c 100644
--- a/pkgs/by-name/or/ory/package.nix
+++ b/pkgs/by-name/or/ory/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "ory";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "ory";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WqVcVqdgzlI6OvgLA4OViBsU0DGaTnv5F+Ew58UzQlM=";
+    hash = "sha256-NO4F9QE0wMsHDDcmJWx+1QVg/RI7ZsqkLJDbgigZIjs=";
   };
 
   nativeBuildInputs = [
@@ -34,7 +34,7 @@ buildGoModule (finalAttrs: {
     "sqlite"
   ];
 
-  vendorHash = "sha256-W7yi6CSioLnLmOsK7hdB3C96fV7METOe+wzKKMWpphw=";
+  vendorHash = "sha256-YoEM/dhBWLzpx2J0/uQrUhfMdRRH++9/MzycHTnHlRQ=";
   postInstall = ''
     mv $out/bin/cli $out/bin/ory
   ''
diff --git a/pkgs/by-name/pa/parca/package.nix b/pkgs/by-name/pa/parca/package.nix
index f1a08ce9241f..3babc527626c 100644
--- a/pkgs/by-name/pa/parca/package.nix
+++ b/pkgs/by-name/pa/parca/package.nix
@@ -10,13 +10,13 @@
   stdenv,
 }:
 let
-  version = "0.26.0";
+  version = "0.27.1";
 
   parca-src = fetchFromGitHub {
     owner = "parca-dev";
     repo = "parca";
     tag = "v${version}";
-    hash = "sha256-/btYLSTP8AAZX8RHJO0hwbK4aN4gX+LU838oDSf2eRo=";
+    hash = "sha256-pI2SV2BiBqqga4RADEE5Z0FffdGb3fxhRRNj4S9Hxzc=";
   };
 
   ui = stdenv.mkDerivation (finalAttrs: {
@@ -28,7 +28,7 @@ let
       inherit (finalAttrs) pname src version;
       pnpm = pnpm_9;
       fetcherVersion = 3;
-      hash = "sha256-RGIwJELFVUvDnci/uobnwhMBlCM4eEt2SHtuiZwF4BI=";
+      hash = "sha256-3eICZpJJacvcD9MGQ9AmoMMnlcNt/LCxIIM+H+oJdR8=";
     };
 
     nativeBuildInputs = [
@@ -61,7 +61,7 @@ buildGoModule rec {
   pname = "parca";
   src = parca-src;
 
-  vendorHash = "sha256-Ud0OsoY1z+MrKA4RaAhHbOYeLD75EJupLxZCycDAFnA=";
+  vendorHash = "sha256-dAFGcavDaN1vW4SdjZ78IRWCnfqaRipLOQHc+V6MuDw=";
 
   ldflags = [
     "-X=main.version=${version}"
diff --git a/pkgs/by-name/po/polarity/package.nix b/pkgs/by-name/po/polarity/package.nix
index 36386fd15804..4363fb5fff28 100644
--- a/pkgs/by-name/po/polarity/package.nix
+++ b/pkgs/by-name/po/polarity/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "polarity";
-  version = "latest-unstable-2026-03-16";
+  version = "latest-unstable-2026-03-23";
 
   src = fetchFromGitHub {
     owner = "polarity-lang";
     repo = "polarity";
-    rev = "02610d9df01cd3297fc68d0df6b63a9eaa37585e";
-    hash = "sha256-37/dcuaN1QoCvjzrHin1PFzzFvpH5prQHonsX9WLq0o=";
+    rev = "134d730457e0e874308d0f0abab4600eb89bf084";
+    hash = "sha256-EzPNv9GmHqIcSkADEVDBLzlWD/kubQIWBfYeCWowAhw=";
   };
 
-  cargoHash = "sha256-FrCOsgbb0xQH3cKnWqa2n17uDpppnSd0PyVrrCPXCYw=";
+  cargoHash = "sha256-eat5XK8GZlbdPdkcrvOF99ln0a2SHZexAnqH55i8Vec=";
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
 
diff --git a/pkgs/by-name/py/pyfa/package.nix b/pkgs/by-name/py/pyfa/package.nix
index fea373fc00e6..8fc79b3881e9 100644
--- a/pkgs/by-name/py/pyfa/package.nix
+++ b/pkgs/by-name/py/pyfa/package.nix
@@ -11,7 +11,7 @@
   copyDesktopItems,
 }:
 let
-  version = "2.65.4";
+  version = "2.66.1";
 in
 python3Packages.buildPythonApplication rec {
   inherit version;
@@ -22,7 +22,7 @@ python3Packages.buildPythonApplication rec {
     owner = "pyfa-org";
     repo = "Pyfa";
     tag = "v${version}";
-    hash = "sha256-dBJmtKZD2MvQjLhz2Jcn/ldAEbo0wllXDItQu5pyrW8=";
+    hash = "sha256-lSX+ZCPUjXE5t8OmKcA9yD+g6Xiizj1Qi6+SstZbq2g=";
   };
 
   desktopItems = [
diff --git a/pkgs/by-name/ra/radicle-node/unstable.nix b/pkgs/by-name/ra/radicle-node/unstable.nix
index ea393a208551..0404e5a77202 100644
--- a/pkgs/by-name/ra/radicle-node/unstable.nix
+++ b/pkgs/by-name/ra/radicle-node/unstable.nix
@@ -1,8 +1,8 @@
 { radicle-node }:
 
 radicle-node.override {
-  version = "1.8.0-rc.2";
-  srcHash = "sha256-J+1URp8mzxdKwlNpgYtaEQBDSyDVYqsAMnxwogZWVWM=";
+  version = "1.8.0-rc.3";
+  srcHash = "sha256-W94Vwf7ozwkENLueKF9Lvkns7HRX7PbMtvMHMCujV/s=";
   cargoHash = "sha256-9+mlNQwV2bUyAXkPN7aflGuN/Xd32uT+JEjl48ZDeXY=";
   updateScript = ./update-unstable.sh;
 }
diff --git a/pkgs/by-name/re/redpanda-client/package.nix b/pkgs/by-name/re/redpanda-client/package.nix
index cde2a6dc5ded..14e2c7e764df 100644
--- a/pkgs/by-name/re/redpanda-client/package.nix
+++ b/pkgs/by-name/re/redpanda-client/package.nix
@@ -7,12 +7,12 @@
   stdenv,
 }:
 let
-  version = "25.3.10";
+  version = "25.3.11";
   src = fetchFromGitHub {
     owner = "redpanda-data";
     repo = "redpanda";
     rev = "v${version}";
-    sha256 = "sha256-cfT+hh5h/tR6bSJBhE01GcJaQLJa3KFsJLn24bVrr48=";
+    sha256 = "sha256-Nl+lz5tF9/N5B0jgM4tS3psrg7qDIGZh77HgggFoXHQ=";
   };
 in
 buildGoModule rec {
diff --git a/pkgs/by-name/sp/spotatui/package.nix b/pkgs/by-name/sp/spotatui/package.nix
index 3db3fcf443cf..66aa257025cb 100644
--- a/pkgs/by-name/sp/spotatui/package.nix
+++ b/pkgs/by-name/sp/spotatui/package.nix
@@ -12,16 +12,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "spotatui";
-  version = "0.37.3";
+  version = "0.38.0";
 
   src = fetchFromGitHub {
     owner = "LargeModGames";
     repo = "spotatui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FRmKkrxMyLmSb1rq7+lFxJ1TqvV5CuI7ZX2PQChWESI=";
+    hash = "sha256-6XsKlM4KLwRZk+uJY60a0rKHIEv1ieZPZoBZpRG1sQ0=";
   };
 
-  cargoHash = "sha256-3yxf0othDv5tp85PpLjJBglATbDGgzsMKyOqWjJLuMg=";
+  cargoHash = "sha256-5aj35NGRFb1DiEPU1RGKkvz/wMOIjO1HzkX45GEFbPs=";
 
   nativeBuildInputs = [ pkg-config ] ++ lib.optional withPipewireVisualizer rustPlatform.bindgenHook;
 
diff --git a/pkgs/by-name/up/updatecli/package.nix b/pkgs/by-name/up/updatecli/package.nix
index cccfbb3b1a0a..8f574346f95a 100644
--- a/pkgs/by-name/up/updatecli/package.nix
+++ b/pkgs/by-name/up/updatecli/package.nix
@@ -12,16 +12,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "updatecli";
-  version = "0.113.0";
+  version = "0.115.0";
 
   src = fetchFromGitHub {
     owner = "updatecli";
     repo = "updatecli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-sol0adhlIoB+/lTGbIk8R2Rv8rw1GlzBcuXISzLYceE=";
+    hash = "sha256-TUFOtMABC8Ut9EHhEveyLK9UTDxRS5Yz6znj4lhHfCU=";
   };
 
-  vendorHash = "sha256-CbtpjJDlqNYOZ/xkIJ3Ct0LLoK3NWOH2Ke3OIsbZMa4=";
+  vendorHash = "sha256-z1nACmowcOerHWSI2SDRlombb8coYsrDTYaHY9eFPMQ=";
 
   # tests require network access
   doCheck = false;
diff --git a/pkgs/by-name/ve/veilid/package.nix b/pkgs/by-name/ve/veilid/package.nix
index c20a2464a085..32907a2a5026 100644
--- a/pkgs/by-name/ve/veilid/package.nix
+++ b/pkgs/by-name/ve/veilid/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "veilid";
-  version = "0.5.2";
+  version = "0.5.3";
 
   src = fetchFromGitLab {
     owner = "veilid";
     repo = "veilid";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-BND2Io3V5GtSqh9cTJ9SJ4jgfv6TZQGpYebO4f2YdMA=";
+    hash = "sha256-qPV5kVp/1ZTLzo8i3DkGLxuoOaMJxZJUEzYGNReJyHY=";
   };
 
-  cargoHash = "sha256-glbrjue0d2bG1P3U5+nqfxvz2qlDd16bpvyQYpGuiyI=";
+  cargoHash = "sha256-LjysGZihXoE82224nXNrRWIMe6/POXDqjMO29zg+MMI=";
 
   nativeBuildInputs = [
     capnproto
diff --git a/pkgs/by-name/yq/yq-go/package.nix b/pkgs/by-name/yq/yq-go/package.nix
index d5384dcabb48..468788f036e4 100644
--- a/pkgs/by-name/yq/yq-go/package.nix
+++ b/pkgs/by-name/yq/yq-go/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "yq-go";
-  version = "4.52.4";
+  version = "4.52.5";
 
   src = fetchFromGitHub {
     owner = "mikefarah";
     repo = "yq";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vbvqjcov0ceFeQ81tIaXHbAFjrJ2dCkRfkw/MA0qCr4=";
+    hash = "sha256-ZOgAPnONzRBTjNeOgQK4fXwUrypHH51XI/JWbE/momE=";
   };
 
-  vendorHash = "sha256-WQDuMVBlmomxdaMQ/nVNki8o++dPdwDSj6jQqbsQNQw=";
+  vendorHash = "sha256-QTcDE5qs46ryWhZlKHIC2G1jbEO12XGJa6QvEJC5oL8=";
 
   nativeBuildInputs = lib.optionals (stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
     installShellFiles
diff --git a/pkgs/by-name/zi/zizmor/package.nix b/pkgs/by-name/zi/zizmor/package.nix
index e1cad4928953..8da3f33a4f07 100644
--- a/pkgs/by-name/zi/zizmor/package.nix
+++ b/pkgs/by-name/zi/zizmor/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zizmor";
-  version = "1.22.0";
+  version = "1.23.1";
 
   src = fetchFromGitHub {
     owner = "zizmorcore";
     repo = "zizmor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HRwtjke7kDq+mrTLwyWU0aEGxdgdbimcg42J1baDXhs=";
+    hash = "sha256-fNpIcOVPw0beoN10JM92ITOxCupUZj8xV+P4VXIilRo=";
   };
 
-  cargoHash = "sha256-UuSBd+RppydP0+cG1iNarikbhBtoZZbIUxiwgq3EZaU=";
+  cargoHash = "sha256-K0lL46Mbx3Bqbhxqz21s0xsz7W9GKeG3Qw72fek0c/M=";
 
   buildInputs = [
     rust-jemalloc-sys
@@ -30,6 +30,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
     installShellFiles
   ];
 
+  checkFlags = [
+    # need network
+    "--skip=audit::known_vulnerable_actions::tests::test_first_patched_version_priority"
+    "--skip=audit::known_vulnerable_actions::tests::test_fix_symbolic_ref"
+    "--skip=audit::known_vulnerable_actions::tests::test_fix_upgrade_action_with_subpath"
+    "--skip=audit::known_vulnerable_actions::tests::test_fix_upgrade_actions_checkout"
+    "--skip=audit::known_vulnerable_actions::tests::test_fix_upgrade_actions_setup_node"
+    "--skip=audit::known_vulnerable_actions::tests::test_fix_upgrade_multiple_vulnerable_actions"
+    "--skip=audit::known_vulnerable_actions::tests::test_fix_upgrade_third_party_action"
+  ];
+
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd zizmor \
       --bash <("$out/bin/zizmor" --completions bash) \
diff --git a/pkgs/development/compilers/dart/source/default.nix b/pkgs/development/compilers/dart/source/default.nix
index 8afe8b6a2962..e8b7a1856aee 100644
--- a/pkgs/development/compilers/dart/source/default.nix
+++ b/pkgs/development/compilers/dart/source/default.nix
@@ -28,7 +28,7 @@
 }:
 
 let
-  version = "3.11.0";
+  version = "3.11.2";
 
   tools = callPackage ../../flutter/engine/tools.nix { inherit (stdenv) hostPlatform buildPlatform; };
 
@@ -80,7 +80,7 @@ let
 
         outputHashAlgo = "sha256";
         outputHashMode = "recursive";
-        outputHash = "sha256-7y6kNpjWpc8+4Rhv+GuMnV5xHCQ5om2/3woZOJ8wYSc=";
+        outputHash = "sha256-jo+sf3VqQOHiQ2u/aPb2EBWK6frBbqmgbUaBqXwgOkY=";
       }
       ''
         mkdir source
diff --git a/pkgs/development/coq-modules/verified-extraction/default.nix b/pkgs/development/coq-modules/verified-extraction/default.nix
new file mode 100644
index 000000000000..c8ce1f8bf02f
--- /dev/null
+++ b/pkgs/development/coq-modules/verified-extraction/default.nix
@@ -0,0 +1,66 @@
+{
+  lib,
+  mkCoqDerivation,
+  coq,
+  dune,
+  ceres-bs,
+  equations,
+  metarocq-erasure-plugin,
+  version ? null,
+}:
+
+mkCoqDerivation {
+  pname = "verified-extraction";
+  owner = "MetaRocq";
+  repo = "rocq-verified-extraction";
+  opam-name = "rocq-verified-extraction";
+
+  inherit version;
+  defaultVersion =
+    let
+      case = coq: mr: out: {
+        cases = [
+          coq
+          mr
+        ];
+        inherit out;
+      };
+    in
+    lib.switch
+      [
+        coq.coq-version
+        metarocq-erasure-plugin.version
+      ]
+      [
+        (case "9.1" "1.5.1-9.1" "1.0.0-9.1")
+      ]
+      null;
+  release = {
+    "1.0.0-9.1".hash = "sha256-0eKpchQtnPI12rcsb9+qN1pdNX9KY8VryZP0oqHuYeU=";
+  };
+  releaseRev = v: "v${v}";
+
+  mlPlugin = true;
+
+  buildInputs = [ dune ];
+  propagatedBuildInputs = [
+    coq.ocamlPackages.findlib
+    coq.ocamlPackages.malfunction
+    equations
+    metarocq-erasure-plugin
+    ceres-bs
+  ];
+
+  prePatch = ''
+    patchShebangs plugin/plugin/clean_extraction.sh
+  '';
+
+  meta = with lib; {
+    homepage = "https://metarocq.github.io/";
+    description = "Verified Extraction from Rocq to OCaml. Including a bootstrapped extraction plugin";
+    maintainers = with maintainers; [
+      mattam82
+      _4ever2
+    ];
+  };
+}
diff --git a/pkgs/development/ocaml-modules/gstreamer/default.nix b/pkgs/development/ocaml-modules/gstreamer/default.nix
index 3f23c9febad4..14bf90552b7f 100644
--- a/pkgs/development/ocaml-modules/gstreamer/default.nix
+++ b/pkgs/development/ocaml-modules/gstreamer/default.nix
@@ -27,7 +27,7 @@ buildDunePackage rec {
     gst_all_1.gst-plugins-base
   ];
 
-  CFLAGS_COMPILE = [
+  env.CFLAGS_COMPILE = toString [
     "-I${glib.dev}/include/glib-2.0"
     "-I${glib.out}/lib/glib-2.0/include"
     "-I${gst_all_1.gst-plugins-base.dev}/include/gstreamer-1.0"
diff --git a/pkgs/development/python-modules/databricks-sdk/default.nix b/pkgs/development/python-modules/databricks-sdk/default.nix
index b97e4c574a8e..d65cd09759bc 100644
--- a/pkgs/development/python-modules/databricks-sdk/default.nix
+++ b/pkgs/development/python-modules/databricks-sdk/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "databricks-sdk";
-  version = "0.100.0";
+  version = "0.102.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "databricks";
     repo = "databricks-sdk-py";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NB+YgUrMsteZ1hNJKWSpeM4yW196HgkP9/00ATM/2m8=";
+    hash = "sha256-WHy+JTdjgq7D+Iy7OTx5V8zLBpY4SNztL3UkPM9gIns=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/meraki/default.nix b/pkgs/development/python-modules/meraki/default.nix
index 53c4e96a37aa..b2f2b45da6fa 100644
--- a/pkgs/development/python-modules/meraki/default.nix
+++ b/pkgs/development/python-modules/meraki/default.nix
@@ -22,6 +22,11 @@ buildPythonPackage rec {
     hash = "sha256-B9eda7ccpCRGuBB2XfRI/Fz+MVBUIjFZzHYWfckQT2g=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "setuptools>=78.1.1,<79.0.0" "setuptools"
+  '';
+
   pythonRelaxDeps = [
     "pytest"
     "setuptools"
diff --git a/pkgs/development/python-modules/mplcursors/default.nix b/pkgs/development/python-modules/mplcursors/default.nix
index 1fc443d9f9fc..8dd17cf92f34 100644
--- a/pkgs/development/python-modules/mplcursors/default.nix
+++ b/pkgs/development/python-modules/mplcursors/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "mplcursors";
-  version = "0.7";
+  version = "0.7.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "anntzer";
     repo = "mplcursors";
     rev = "v${version}";
-    hash = "sha256-bHBMi9xtawV50xPyR1vsGg+1KmTWjeErP9yh2tZxTIg=";
+    hash = "sha256-ZHX//AUVSF91cHxyiL4klglJ2Ef3iSE6oOancL+gQbA=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/numpy-typing-compat/default.nix b/pkgs/development/python-modules/numpy-typing-compat/default.nix
index 57270f3b9463..b684b6fa1684 100644
--- a/pkgs/development/python-modules/numpy-typing-compat/default.nix
+++ b/pkgs/development/python-modules/numpy-typing-compat/default.nix
@@ -17,6 +17,10 @@ buildPythonPackage rec {
     hash = "sha256-WYgtI6r/BUolNtqAVkASzc4zSHZXvk15xZJbuHBfyrw=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml --replace-fail "uv_build>=0.9,<0.10" "uv_build>=0.9,<=0.10"
+  '';
+
   build-system = [
     uv-build
   ];
diff --git a/pkgs/development/python-modules/pysequoia/default.nix b/pkgs/development/python-modules/pysequoia/default.nix
index a5eda7ad0688..0a42c761d278 100644
--- a/pkgs/development/python-modules/pysequoia/default.nix
+++ b/pkgs/development/python-modules/pysequoia/default.nix
@@ -8,17 +8,17 @@
 
 buildPythonPackage rec {
   pname = "pysequoia";
-  version = "0.1.31";
+  version = "0.1.32";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1qvMoytvivcVkiBFB6wzt4ejxAbxCAOg+ENRtT8LtdE=";
+    hash = "sha256-uqWJKz5o2/RJL81LW+sQve7YCAyl6PV3JWBqgktldT8=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-kr7Gqj4qQ6x/AOXaMoY4kBqP0q3iXLfpzyLQQDb0b8k=";
+    hash = "sha256-5TGxD3XOmi5NbTkhtxzZXExHFmveKewdlkDHSt+ZTVI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/qtile/default.nix b/pkgs/development/python-modules/qtile/default.nix
index 7c5454fea78d..1ca2185d1dae 100644
--- a/pkgs/development/python-modules/qtile/default.nix
+++ b/pkgs/development/python-modules/qtile/default.nix
@@ -2,37 +2,70 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
+  setuptools,
+  setuptools-scm,
+
+  # nativeBuildInputs
+  pkg-config,
+  wayland-scanner,
+
+  # dependencies
   cairocffi,
   dbus-fast,
-  aiohttp,
-  cairo,
-  cffi,
-  glib,
   iwlib,
   libcst,
-  libdrm,
-  libinput,
-  libxkbcommon,
   mpd2,
-  pango,
-  pixman,
-  pkg-config,
   psutil,
   pulsectl-asyncio,
   pygobject3,
   pytz,
   pyxdg,
-  setuptools,
-  setuptools-scm,
-  wayland,
-  wayland-protocols,
-  wayland-scanner,
-  wlroots,
-  libxcb-cursor,
-  libxcb-wm,
   xcffib,
-  nixosTests,
   extraPackages ? [ ],
+
+  # buildInputs
+  cairo,
+  libinput,
+  libxcb-wm,
+  libxkbcommon,
+  wayland,
+  wlroots,
+  # environment & pypaBuildFlags
+  libdrm,
+  pixman,
+  glib,
+  pango,
+  libxcb-cursor,
+
+  # propagatedBuildInputs
+  aiohttp,
+  cffi,
+  wayland-protocols,
+
+  # checkInputs
+  gtk3,
+  librsvg,
+
+  # nativeCheckInputs
+  pytestCheckHook,
+  pytest-asyncio,
+  pytest-httpbin,
+  pytest-xdist,
+  writableTmpDirAsHomeHook,
+  anyio,
+  fontconfig,
+  gdk-pixbuf,
+  gobject-introspection,
+  isort,
+  wxsvg,
+  xorg-server,
+  xterm,
+  xvfb,
+
+  # passthru.tests
+  nixosTests,
 }:
 
 buildPythonPackage (finalAttrs: {
@@ -50,10 +83,16 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-5XHzlS/Knw/VmVtnM7wToJ/F12GAa2lwdWuXBJHXnZM=";
   };
 
+  patches = [
+    # https://github.com/qtile/qtile/pull/5889
+    ./fix-test-net.patch
+  ];
+
   build-system = [
     setuptools
     setuptools-scm
   ];
+
   nativeBuildInputs = [
     pkg-config
     wayland-scanner
@@ -76,7 +115,9 @@ buildPythonPackage (finalAttrs: {
   ];
 
   dependencies = extraPackages ++ [
+    aiohttp
     (cairocffi.override { withXcffib = true; })
+    cffi
     dbus-fast
     iwlib
     libcst
@@ -92,20 +133,71 @@ buildPythonPackage (finalAttrs: {
   buildInputs = [
     cairo
     libinput
+    libxcb-wm
     libxkbcommon
     wayland
     wlroots
-    libxcb-wm
   ];
 
   propagatedBuildInputs = [
     wayland-protocols
-    cffi
-    xcffib
-    aiohttp
   ];
 
-  doCheck = false;
+  pythonImportsCheck = [ "libqtile" ];
+
+  checkInputs = [
+    gtk3
+    librsvg
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-asyncio
+    pytest-httpbin
+    pytest-xdist
+    writableTmpDirAsHomeHook
+    anyio
+    fontconfig
+    gdk-pixbuf
+    gobject-introspection
+    isort
+    wxsvg
+    xorg-server
+    xterm
+    xvfb
+  ];
+
+  preCheck = ''
+    export PATH=$PATH:$out/bin
+  '';
+
+  disabledTests = [
+    # ModuleNotFoundError: No module named 'libqtile'
+    # known issue upstream: https://github.com/qtile/qtile/issues/5883
+    "test_identify_output"
+
+    # caused by dbus-fast trying to read '/var/lib/dbus/machine-id'
+    "test_defaults"
+    "test_device_actions"
+    "test_adapter_actions"
+    "test_statusnotifier_defaults"
+    "test_custom_symbols"
+    "test_statusnotifier_defaults_vertical_bar"
+    "test_default_show_battery"
+    "test_statusnotifier_icon_size"
+    "test_missing_adapter"
+    "test_statusnotifier_left_click"
+    "test_default_text"
+    "test_statusnotifier_left_click_vertical_bar"
+    "test_default_device"
+
+    # PermissionError: [Errno 13] Permission denied: '/var'
+    "test_thermal_zone_getting_value"
+
+    # Probably won't work in the Nix sandbox due to `xcffib.ConnectionException`
+    "test_urgent_hook_fire"
+  ];
+
   passthru = {
     tests.qtile = nixosTests.qtile;
     providedSessions = [ "qtile" ];
diff --git a/pkgs/development/python-modules/qtile/fix-test-net.patch b/pkgs/development/python-modules/qtile/fix-test-net.patch
new file mode 100644
index 000000000000..6230f22c665d
--- /dev/null
+++ b/pkgs/development/python-modules/qtile/fix-test-net.patch
@@ -0,0 +1,63 @@
+From 71c70072524ee2fb2f4683861236894e51c50d6e Mon Sep 17 00:00:00 2001
+From: elParaguayo <elparaguayocode@gmail.com>
+Date: Tue, 24 Mar 2026 20:38:18 +0000
+Subject: [PATCH] Fix test_net.py
+
+The test uses a fake psutil module to get net statistics. However,
+values are increased between tests and so will fail if tests are run in
+a different order. We fix this by resetting stats between tests.
+---
+ test/widgets/test_net.py | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+diff --git a/test/widgets/test_net.py b/test/widgets/test_net.py
+index dcb0966c50..ea6a849a3a 100644
+--- a/test/widgets/test_net.py
++++ b/test/widgets/test_net.py
+@@ -34,6 +34,8 @@ def __init__(self, up, down):
+ @pytest.fixture
+ def patch_net(fake_qtile, monkeypatch, fake_window):
+     def build_widget(**kwargs):
++        MockPsutil.up = 0
++        MockPsutil.down = 0
+         monkeypatch.setitem(sys.modules, "psutil", MockPsutil("psutil"))
+         from libqtile.widget import net
+
+@@ -62,15 +64,15 @@ def test_net_defaults(patch_net):
+ def test_net_single_interface(patch_net):
+     """Display single named interface"""
+     net2 = patch_net(interface="wlp58s0")
+-    assert net2.poll() == "wlp58s0: U 40.0kB 160.0kB D 1.2MB 4.8MB T 1.24MB 4.96MB"
++    assert net2.poll() == "wlp58s0: U 40.0kB 80.0kB D 1.2MB 2.4MB T 1.24MB 2.48MB"
+
+
+ def test_net_list_interface(patch_net):
+     """Display multiple named interfaces"""
+     net2 = patch_net(interface=["wlp58s0", "lo"])
+     assert net2.poll() == (
+-        "wlp58s0: U 40.0kB 240.0kB D 1.2MB 7.2MB T 1.24MB 7.44MB lo: U 40.0kB "
+-        "240.0kB D 1.2MB 7.2MB T 1.24MB 7.44MB"
++        "wlp58s0: U 40.0kB 80.0kB D 1.2MB 2.4MB T 1.24MB 2.48MB "
++        "lo: U 40.0kB 80.0kB D 1.2MB 2.4MB T 1.24MB 2.48MB"
+     )
+
+
+@@ -83,7 +85,7 @@ def test_net_invalid_interface(patch_net):
+ def test_net_use_bits(patch_net):
+     """Display all interfaces in bits rather than bytes"""
+     net4 = patch_net(use_bits=True)
+-    assert net4.poll() == "all: U 320.0kb 2.56Mb D 9.6Mb 76.8Mb T 9.92Mb 79.36Mb"
++    assert net4.poll() == "all: U 320.0kb 640.0kb D 9.6Mb 19.2Mb T 9.92Mb 19.84Mb"
+
+
+ def test_net_convert_zero_b(patch_net):
+@@ -95,7 +97,7 @@ def test_net_convert_zero_b(patch_net):
+ def test_net_use_prefix(patch_net):
+     """Tests `prefix` configurable option"""
+     net6 = patch_net(prefix="M")
+-    assert net6.poll() == "all: U 0.04MB 440.0kB D 1.2MB 13.2MB T 1.24MB 13.64MB"
++    assert net6.poll() == "all: U 0.04MB 80.0kB D 1.2MB 2.4MB T 1.24MB 2.48MB"
+
+
+ def test_net_missing_interface(patch_net):
+
diff --git a/pkgs/os-specific/linux/kernel/update-zen.py b/pkgs/os-specific/linux/kernel/update-zen.py
index 9b852b164b99..cf33df902057 100755
--- a/pkgs/os-specific/linux/kernel/update-zen.py
+++ b/pkgs/os-specific/linux/kernel/update-zen.py
@@ -64,24 +64,24 @@ def update_file(relpath, version, suffix, sha256):
         for line in f:
             result = line
             result = re.sub(
-                fr'^  version = ".+";',
-                f'  version = "{version}";',
+                r'^(\s*)version = ".+";',
+                fr'\1version = "{version}";',
                 result)
             result = re.sub(
-                fr'^  suffix = ".+";',
-                f'  suffix = "{suffix}";',
+                r'^(\s*)suffix = ".+";',
+                fr'\1suffix = "{suffix}";',
                 result)
             result = re.sub(
-                fr'^    sha256 = ".+";',
-                f'    sha256 = "{sha256}";',
+                r'^(\s*)sha256 = ".+";',
+                fr'\1sha256 = "{sha256}";',
                 result)
             print(result, end='')
 
 
 def read_file(relpath):
     file_path = os.path.join(DIR, relpath)
-    re_version = re.compile(fr'^\s*version = "(.+)";')
-    re_suffix = re.compile(fr'^\s*suffix = "(.+)";')
+    re_version = re.compile(r'^\s*version = "(.+)";')
+    re_suffix = re.compile(r'^\s*suffix = "(.+)";')
     version = None
     suffix = None
     with fileinput.FileInput(file_path, mode='r') as f:
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index a403b0be58b0..79d2f3a5c700 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -12,13 +12,13 @@ let
   # override options if they need using lib.mkForce (that has 50 priority)
   mkKernelOverride = lib.mkOverride 90;
 
-  suffix = "zen1"; # zen
+  suffix = "zen1";
 in
 
 buildLinux (
   args
   // rec {
-    version = "6.18.13";
+    version = "6.19.9";
     pname = "linux-zen";
     modDirVersion = lib.versions.pad 3 "${version}-${suffix}";
     isZen = true;
@@ -27,7 +27,7 @@ buildLinux (
       owner = "zen-kernel";
       repo = "zen-kernel";
       rev = "v${version}-${suffix}";
-      sha256 = "0x6s3pa7c6zlvr3w2fv6i15v54cy1pschvgk7b4vrzx1bcrjdxf7";
+      sha256 = "09wlnd8ndm4r75ywk2sanmkc0v788rz9faa61hcfschw5pq5yzx6";
     };
 
     # This is based on the following source:
@@ -46,6 +46,7 @@ buildLinux (
       # Preempt (low-latency)
       PREEMPT = mkKernelOverride yes;
       PREEMPT_VOLUNTARY = mkKernelOverride no;
+      PREEMPT_LAZY = mkKernelOverride no;
 
       # Preemptible tree-based hierarchical RCU
       TREE_RCU = yes;
diff --git a/pkgs/tools/package-management/lix/common-lix.nix b/pkgs/tools/package-management/lix/common-lix.nix
index 9e116c09050e..68fa730097d7 100644
--- a/pkgs/tools/package-management/lix/common-lix.nix
+++ b/pkgs/tools/package-management/lix/common-lix.nix
@@ -367,7 +367,12 @@ stdenv.mkDerivation (finalAttrs: {
     lib.optionals
       (stdenv.hostPlatform.isLinux && finalAttrs.doInstallCheck && lib.versionAtLeast version "2.95")
       [
-        (lib.mesonOption "build-test-env" "${pkgsStatic.busybox}/bin")
+        (lib.mesonOption "build-test-env" (
+          lib.makeBinPath [
+            pkgsStatic.busybox
+            pkgsStatic.acl
+          ]
+        ))
         (lib.mesonOption "build-test-shell" "${pkgsStatic.bash}/bin")
       ]
   ++ lib.optionals (lib.versionAtLeast version "2.95") [
diff --git a/pkgs/tools/package-management/lix/default.nix b/pkgs/tools/package-management/lix/default.nix
index 2640659d43d0..e307fcf7e7be 100644
--- a/pkgs/tools/package-management/lix/default.nix
+++ b/pkgs/tools/package-management/lix/default.nix
@@ -238,14 +238,14 @@ lib.makeExtensible (
       attrName = "lix_2_94";
 
       lix-args = rec {
-        version = "2.94.0";
+        version = "2.94.1";
 
         src = fetchFromGitea {
           domain = "git.lix.systems";
           owner = "lix-project";
           repo = "lix";
           rev = version;
-          hash = "sha256-X6X3NhgLnpkgWUbLs0nLjusNx/el3L1EkVm6OHqY2z8=";
+          hash = "sha256-+VJmizrdZPygtffgS/yfMb4PkZUUK5JmyGGzn0GPsKc=";
         };
 
         cargoDeps = rustPlatform.fetchCargoVendor {
@@ -258,6 +258,28 @@ lib.makeExtensible (
       };
     };
 
+    lix_2_95 = self.makeLixScope {
+      attrName = "lix_2_95";
+
+      lix-args = rec {
+        version = "2.95.1";
+
+        src = fetchFromGitea {
+          domain = "git.lix.systems";
+          owner = "lix-project";
+          repo = "lix";
+          rev = version;
+          hash = "sha256-eZEynXdDcrjDMjGVfDhFJJrU5ENal7wlx7bn/wkggTg=";
+        };
+
+        cargoDeps = rustPlatform.fetchCargoVendor {
+          name = "lix-${version}";
+          inherit src;
+          hash = "sha256-a5XtutX+NS4wOqxeqbscWZMs99teKick5+cQfbCRGxQ=";
+        };
+      };
+    };
+
     git = self.makeLixScope {
       attrName = "git";
 
@@ -280,7 +302,7 @@ lib.makeExtensible (
       };
     };
 
-    latest = self.lix_2_94;
+    latest = self.lix_2_95;
 
     stable = self.lix_2_94;
 
diff --git a/pkgs/top-level/coq-packages.nix b/pkgs/top-level/coq-packages.nix
index b0204719a753..eff8239c40b2 100644
--- a/pkgs/top-level/coq-packages.nix
+++ b/pkgs/top-level/coq-packages.nix
@@ -241,6 +241,7 @@ let
       );
       Velisarios = callPackage ../development/coq-modules/Velisarios { };
       Verdi = callPackage ../development/coq-modules/Verdi { };
+      verified-extraction = callPackage ../development/coq-modules/verified-extraction { };
       Vpl = callPackage ../development/coq-modules/Vpl { };
       VplTactic = callPackage ../development/coq-modules/VplTactic { };
       vscoq-language-server = callPackage ../development/coq-modules/vscoq-language-server { };