diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index fb8460644d88..1e5398096cc6 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5731,6 +5731,12 @@
     githubId = 4162215;
     keys = [ { fingerprint = "CE97 9DEE 904C 26AA 3716  78C2 96A4 38F9 EE72 572F"; } ];
   };
+  crop = {
+    email = "crop_tech@proton.me";
+    name = "crop";
+    github = "crop2000";
+    githubId = 176233921;
+  };
   crschnick = {
     email = "crschnick@xpipe.io";
     name = "Christopher Schnick";
diff --git a/nixos/modules/programs/sniffnet.nix b/nixos/modules/programs/sniffnet.nix
index 91d56871dac6..6258bcb67c95 100644
--- a/nixos/modules/programs/sniffnet.nix
+++ b/nixos/modules/programs/sniffnet.nix
@@ -17,6 +17,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.sniffnet ];
+
     security.wrappers.sniffnet = {
       owner = "root";
       group = "root";
diff --git a/nixos/modules/services/web-apps/outline.nix b/nixos/modules/services/web-apps/outline.nix
index e1bfa8ab47d3..6046b2005858 100644
--- a/nixos/modules/services/web-apps/outline.nix
+++ b/nixos/modules/services/web-apps/outline.nix
@@ -836,14 +836,12 @@ in
           ${
             if (cfg.databaseUrl == "local") then
               ''
-                DATABASE_URL=${lib.escapeShellArg localPostgresqlUrl}
-                export DATABASE_URL
-                export PGSSLMODE=disable
+                export DATABASE_URL="''${DATABASE_URL:-${lib.escapeShellArg localPostgresqlUrl}}"
+                export PGSSLMODE="''${PGSSLMODE:-disable}"
               ''
             else
               ''
-                DATABASE_URL=${lib.escapeShellArg cfg.databaseUrl}
-                export DATABASE_URL
+                export DATABASE_URL="''${DATABASE_URL:-${lib.escapeShellArg cfg.databaseUrl}}"
               ''
           }
 
diff --git a/nixos/modules/services/web-apps/pretalx.nix b/nixos/modules/services/web-apps/pretalx.nix
index c67910f03fb6..16fc6f090983 100644
--- a/nixos/modules/services/web-apps/pretalx.nix
+++ b/nixos/modules/services/web-apps/pretalx.nix
@@ -48,6 +48,10 @@ let
         }
       } -- ${lib.getExe' pythonEnv "pretalx-manage"} "$@"
     '';
+    excludeShellChecks = [
+      # Not following: /run/agenix/pretalx-env was not specified as input
+      "SC1091"
+    ];
   };
 in
 
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index dc433b28353a..064caf4daebc 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -16128,6 +16128,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  slimline-nvim = buildVimPlugin {
+    pname = "slimline.nvim";
+    version = "2.10.0";
+    src = fetchFromGitHub {
+      owner = "sschleemilch";
+      repo = "slimline.nvim";
+      tag = "v2.10.0";
+      hash = "sha256-ma+79ysHuTe4KxmFjxO0xMCz/bvhc3mc3sXBNcecjdI=";
+    };
+    meta.homepage = "https://github.com/sschleemilch/slimline.nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   slimv = buildVimPlugin {
     pname = "slimv";
     version = "0.9.13-unstable-2026-05-17";
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 63cf04e188fa..048136405dff 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -4084,6 +4084,20 @@ assertNoAdditions {
     };
   });
 
+  slimline-nvim = super.slimline-nvim.overrideAttrs {
+    nvimSkipModules = [
+      # Component modules read the user-supplied slimline.config at require time.
+      "slimline.components.diagnostics"
+      "slimline.components.filetype_lsp"
+      "slimline.components.mode"
+      "slimline.components.path"
+      "slimline.components.progress"
+      "slimline.components.recording"
+      "slimline.components.searchcount"
+      "slimline.components.selectioncount"
+    ];
+  };
+
   smart-open-nvim = super.smart-open-nvim.overrideAttrs {
     dependencies = with self; [
       plenary-nvim
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 1ca54bd8537c..8e0ef82824a3 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -1150,6 +1150,7 @@ https://github.com/folke/sidekick.nvim/,,
 https://github.com/AndrewRadev/sideways.vim/,,
 https://github.com/skim-rs/skim.vim/,,
 https://github.com/mopp/sky-color-clock.vim/,,
+https://github.com/sschleemilch/slimline.nvim/,,
 https://github.com/kovisoft/slimv/,,
 https://github.com/danielfalk/smart-open.nvim/,,
 https://github.com/mrjones2014/smart-splits.nvim/,,
diff --git a/pkgs/by-name/aa/aardvark-dns/package.nix b/pkgs/by-name/aa/aardvark-dns/package.nix
index 5515f8b50a53..d4ae035f8518 100644
--- a/pkgs/by-name/aa/aardvark-dns/package.nix
+++ b/pkgs/by-name/aa/aardvark-dns/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "aardvark-dns";
-  version = "1.17.1";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "aardvark-dns";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gd04T+GK/+gCWGMnNfFzCcTBPbjU8e5mWjFf7uvob38=";
+    hash = "sha256-w+qHHq/4jdkEzyoxfy1h6Vb+55uWLJhirbBSZHxLxTU=";
   };
 
-  cargoHash = "sha256-19EisvHJZJ1L3f0+pE6wgfChkRoYU8W/iaAppwbjbdQ=";
+  cargoHash = "sha256-rpflZfMYNlrn13Cv3znkS2Jp9peyIJDQrXVnVnVuy9g=";
 
   passthru.tests = { inherit (nixosTests) podman; };
 
diff --git a/pkgs/by-name/bu/buildkit/package.nix b/pkgs/by-name/bu/buildkit/package.nix
index d5eaa20bfdf4..247a267aa1a3 100644
--- a/pkgs/by-name/bu/buildkit/package.nix
+++ b/pkgs/by-name/bu/buildkit/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "buildkit";
-  version = "0.30.0";
+  version = "0.31.0";
 
   src = fetchFromGitHub {
     owner = "moby";
     repo = "buildkit";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-7QyfQew0RuL/EpJlKuY5CXdCiFwIS2Z4i1Fd4yUTx7g=";
+    hash = "sha256-mTYNyz2H980l7/Vcyf9wnEgmi2j6S63C9ZcwOaK/+YY=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ca/cargo-expand/package.nix b/pkgs/by-name/ca/cargo-expand/package.nix
index 07b9e98b45c4..1c4dc8cbbc02 100644
--- a/pkgs/by-name/ca/cargo-expand/package.nix
+++ b/pkgs/by-name/ca/cargo-expand/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-expand";
-  version = "1.0.122";
+  version = "1.0.123";
 
   src = fetchFromGitHub {
     owner = "dtolnay";
     repo = "cargo-expand";
     tag = finalAttrs.version;
-    hash = "sha256-GhlVBpTkh4uCpfQdBl5ACbkXpH5UO5w/an/w9FA4dT4=";
+    hash = "sha256-vd63DpKLZpE+fIdfy4gp9PDSSLICPXZdrjk7hMB9L0A=";
   };
 
-  cargoHash = "sha256-CV+lfWLcyXoXPv8KLutJ819YIaKf3BHOZrj1eP3VMzo=";
+  cargoHash = "sha256-mLpihgQ5PNRE72xWRHgcA8KxujR7Pi4bGnwahOQJ4qo=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
diff --git a/pkgs/by-name/ce/ceph/python-env.nix b/pkgs/by-name/ce/ceph/python-env.nix
index 8d50840196aa..78c5df5a17f2 100644
--- a/pkgs/by-name/ce/ceph/python-env.nix
+++ b/pkgs/by-name/ce/ceph/python-env.nix
@@ -43,6 +43,9 @@ ceph-python.withPackages (
     cryptography
     jsonpatch
 
+    # src/pybind/mgr/dashboard/services/sso.py
+    python3-saml
+
     # src/tools/cephfs/shell/setup.py
     cmd2
     colorama
diff --git a/pkgs/by-name/ga/gauge-unwrapped/package.nix b/pkgs/by-name/ga/gauge-unwrapped/package.nix
index 1991fadd7378..b8b146f266d2 100644
--- a/pkgs/by-name/ga/gauge-unwrapped/package.nix
+++ b/pkgs/by-name/ga/gauge-unwrapped/package.nix
@@ -6,7 +6,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "gauge";
-  version = "1.6.31";
+  version = "1.6.32";
 
   patches = [
     # adds a check which adds an error message when trying to
@@ -18,10 +18,10 @@ buildGoModule (finalAttrs: {
     owner = "getgauge";
     repo = "gauge";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rvhWZgw0lq/YF8Js4UsIqiVOWe5/56bOaCq87+gdmPA=";
+    hash = "sha256-j8nT39mwRvccZQyrhviQxPbM3Cd7F2x4X24OYFq3LYQ=";
   };
 
-  vendorHash = "sha256-FdTauyiGjmNRJNsVG4tS8PesC8J24NqQ4rmW3EgCoQk=";
+  vendorHash = "sha256-OmGKpgsouK5W/DWFi8vNT/0HSX5HqaAzNdN8eEAhNhk=";
 
   excludedPackages = [
     "build"
diff --git a/pkgs/by-name/gp/gpxsee/package.nix b/pkgs/by-name/gp/gpxsee/package.nix
index cf93f011dfb4..b26d4010ac18 100644
--- a/pkgs/by-name/gp/gpxsee/package.nix
+++ b/pkgs/by-name/gp/gpxsee/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gpxsee";
-  version = "16.8";
+  version = "16.9";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "GPXSee";
     tag = finalAttrs.version;
-    hash = "sha256-8G1PN4sN/OawEetbud+va8tTSzY2sb27e3sLNWOwSfk=";
+    hash = "sha256-pb5HsmGIiC2A5IjGYm+M636J7vM8LP9LFGINkSaSSj4=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/ig/igv/package.nix b/pkgs/by-name/ig/igv/package.nix
index b9015f6a1601..073f969113b6 100644
--- a/pkgs/by-name/ig/igv/package.nix
+++ b/pkgs/by-name/ig/igv/package.nix
@@ -10,10 +10,10 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "igv";
-  version = "2.19.7";
+  version = "2.19.8";
   src = fetchzip {
     url = "https://data.broadinstitute.org/igv/projects/downloads/${lib.versions.majorMinor finalAttrs.version}/IGV_${finalAttrs.version}.zip";
-    sha256 = "sha256-IkzaQAM+s1boEKo/3ShtbUhihrhxLQCTz8/0lzAyYJA=";
+    sha256 = "sha256-WVf/y0+Hk3OIz+hlCTJ81Ui/s6vthFLJWLuBJAOGzaQ=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/kr/kr106/package.nix b/pkgs/by-name/kr/kr106/package.nix
new file mode 100644
index 000000000000..06a3167c1b05
--- /dev/null
+++ b/pkgs/by-name/kr/kr106/package.nix
@@ -0,0 +1,92 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  alsa-lib,
+  freetype,
+  fontconfig,
+  libGL,
+  libx11,
+  libxcursor,
+  libxext,
+  libxinerama,
+  libxrandr,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "kr106";
+  version = "2.5.13";
+
+  src = fetchFromGitHub {
+    owner = "kayrockscreenprinting";
+    repo = "ultramaster_kr106";
+    tag = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-R0nvtdhhrT+ucpBSsWjJEUCInd4/0jDammlUsaCgL6M=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    alsa-lib
+    freetype
+    fontconfig
+    libGL
+    libx11
+    libxcursor
+    libxext
+    libxinerama
+    libxrandr
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "KR106_COPY_AFTER_BUILD" false)
+  ];
+
+  # JUCE dlopen's these at runtime, crashes without them
+  env.NIX_LDFLAGS = toString [
+    "-lX11"
+    "-lXext"
+    "-lXcursor"
+    "-lXinerama"
+    "-lXrandr"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib
+    cp -r KR106_artefacts/Release/LV2  $out/lib/lv2
+    cp -r KR106_artefacts/Release/VST3 $out/lib/vst3
+    cp -r KR106_artefacts/Release/CLAP $out/lib/clap
+    install -Dm755 "KR106_artefacts/Release/Standalone/Ultramaster KR-106" $out/bin/kr106
+
+    runHook postInstall
+  '';
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Synthesizer plugin emulating the Roland Juno-6, Juno-60 and Juno-106";
+    homepage = "https://kayrock.org/kr106";
+    downloadPage = "https://github.com/kayrockscreenprinting/ultramaster_kr106";
+    changelog = "https://kayrock.org/kr106/changelog.html";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ crop ];
+    platforms = lib.platforms.linux;
+    mainProgram = "kr106";
+  };
+})
diff --git a/pkgs/by-name/le/leetsolv/package.nix b/pkgs/by-name/le/leetsolv/package.nix
new file mode 100644
index 000000000000..1efc4fb78c8c
--- /dev/null
+++ b/pkgs/by-name/le/leetsolv/package.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "leetsolv";
+  version = "1.2.0";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "eannchen";
+    repo = "leetsolv";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ZZ5TtrVUVWUTrGkp4p5k/aNT/XfCwJPsTjTUMcSz7sc=";
+  };
+
+  vendorHash = null;
+
+  ldflags = [
+    "-s"
+    "-X main.Version=${finalAttrs.version}"
+    "-X main.BuildTime=1970-01-01T00:00:00Z"
+    "-X main.GitCommit=${finalAttrs.src.rev}"
+  ];
+
+  # needed for unit tests, also for version test
+  nativeCheckInputs = [ writableTmpDirAsHomeHook ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckKeepEnvironment = [ "HOME" ];
+  versionCheckProgramArg = "version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Spaced repetition CLI for DSA and LeetCode";
+    homepage = "https://github.com/eannchen/leetsolv";
+    changelog = "https://github.com/eannchen/leetsolv/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+    mainProgram = "leetsolv";
+  };
+})
diff --git a/pkgs/by-name/li/linyaps-box/package.nix b/pkgs/by-name/li/linyaps-box/package.nix
index 00bb109c0759..d4d11afd0e63 100644
--- a/pkgs/by-name/li/linyaps-box/package.nix
+++ b/pkgs/by-name/li/linyaps-box/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "linyaps-box";
-  version = "2.1.2";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "OpenAtom-Linyaps";
     repo = "linyaps-box";
     rev = finalAttrs.version;
-    hash = "sha256-i4wSddstCosDpBEcunoVsV464PTHmuvDDEFrsPQKnxU=";
+    hash = "sha256-s17BI5nftQFrDZQVKBJjQYSOJHDPlkA2VLG4Hd61xSY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/md/mdfried/package.nix b/pkgs/by-name/md/mdfried/package.nix
index 2291edeeeba0..276656a43e77 100644
--- a/pkgs/by-name/md/mdfried/package.nix
+++ b/pkgs/by-name/md/mdfried/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mdfried";
-  version = "0.22.0";
+  version = "0.22.2";
 
   src = fetchFromGitHub {
     owner = "benjajaja";
     repo = "mdfried";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zJSh5g1FkR/nqk2qj22Xo8qIOjwyF346PM4KOUOCBBo=";
+    hash = "sha256-HRtuqnD6erRC1Xx+3NSbaFgqRHzurj1xbOJNGykGIpU=";
   };
 
-  cargoHash = "sha256-2wwaEKknnxX6QuE+6udHL2GTOuPpS1oqRI+b3aP0e1I=";
+  cargoHash = "sha256-jnByeBBL13DavExG2pVN7vNRr+UXGkxRY0a4MkwzRe0=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ne/netavark/package.nix b/pkgs/by-name/ne/netavark/package.nix
index cdccae339838..21ab26755886 100644
--- a/pkgs/by-name/ne/netavark/package.nix
+++ b/pkgs/by-name/ne/netavark/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "netavark";
-  version = "1.17.2";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "netavark";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-FdJNcHYK6Jc1dNqcUr5Ne8dv1dzlHRhcjoldiihrov8=";
+    hash = "sha256-hMtYAG1OnnK1xECp8yiGEtgrWWnVfywLokOw6fzKEjw=";
   };
 
-  cargoHash = "sha256-wp/1lWc3OfNQt74m8DtpuFO/Mf07+M7numq2FMEkeGo=";
+  cargoHash = "sha256-oVIOS0bzvT6FW43TJ/p0PZO/cjskzljhyxqeM0aSCCo=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/os/oshu/package.nix b/pkgs/by-name/os/oshu/package.nix
new file mode 100644
index 000000000000..0cd6b1d99a36
--- /dev/null
+++ b/pkgs/by-name/os/oshu/package.nix
@@ -0,0 +1,67 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  SDL2,
+  SDL2_image,
+  ffmpeg,
+  cairo,
+  pango,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "oshu";
+  version = "2.0.3";
+
+  src = fetchFromGitHub {
+    owner = "fmang";
+    repo = "oshu";
+    tag = finalAttrs.version;
+    hash = "sha256-bVMEhaSaLtlxkPnu3rtue6Ov5m+8ymteBRLnWVv0YEI=";
+  };
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    versionCheckHook
+  ];
+
+  buildInputs = [
+    SDL2
+    SDL2_image
+    ffmpeg
+    cairo
+    pango
+  ];
+
+  cmakeFlag = [
+    "-DCMAKE_BUILD_TYPE=Release"
+    "-DOSHU_DEFAULT_SKIN=minimal"
+  ];
+
+  doCheck = true;
+  checkTarget = "check";
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Lightweight osu! client for Linux and low-end systems";
+    homepage = "https://github.com/fmang/oshu";
+    mainProgram = "oshu";
+    changelog = "https://github.com/fmang/oshu/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ castorNova2 ];
+    sourceProvenance = with lib.sourceTypes; [ fromSource ];
+  };
+})
diff --git a/pkgs/by-name/po/podman-compose/package.nix b/pkgs/by-name/po/podman-compose/package.nix
index d0169a667af0..b3c452607184 100644
--- a/pkgs/by-name/po/podman-compose/package.nix
+++ b/pkgs/by-name/po/podman-compose/package.nix
@@ -5,7 +5,7 @@
 }:
 
 python3Packages.buildPythonApplication (finalAttrs: {
-  version = "1.5.0";
+  version = "1.6.0";
   pname = "podman-compose";
   pyproject = true;
 
@@ -13,7 +13,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     repo = "podman-compose";
     owner = "containers";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AEnq0wsDHaCxefaEX4lB+pCAIKzN0oyaBNm7t7tK/yI=";
+    hash = "sha256-zkXLZfYWpIaQYoUU7GcGnkuTBmhzpJkyojbzFuTR5FI=";
   };
 
   build-system = [
diff --git a/pkgs/by-name/po/podman/package.nix b/pkgs/by-name/po/podman/package.nix
index 9090f58fae0d..0b2ab61c9351 100644
--- a/pkgs/by-name/po/podman/package.nix
+++ b/pkgs/by-name/po/podman/package.nix
@@ -42,13 +42,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "podman";
-  version = "5.8.2";
+  version = "5.8.3";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WUcM594sUerb7/SsAu0PkpOyYuIMjaosr8Bp6d36dYk=";
+    hash = "sha256-MS5eaGTcCAtEvoQUhGlX8UfoOqNOv0VAoeFxfAvB3Zs=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ru/runc/package.nix b/pkgs/by-name/ru/runc/package.nix
index 6776d0da64dc..a70f8cb683b0 100644
--- a/pkgs/by-name/ru/runc/package.nix
+++ b/pkgs/by-name/ru/runc/package.nix
@@ -16,13 +16,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "runc";
-  version = "1.4.2";
+  version = "1.4.3";
 
   src = fetchFromGitHub {
     owner = "opencontainers";
     repo = "runc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bBZEcFr/w8r0pKb0ijONUogCKRMgbMQt3o2NR+zhXrU=";
+    hash = "sha256-I9DruagoSWjrEBB4n+w5rzali5wvD/q3tVQFWPDnLAI=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/sw/switchfin/package.nix b/pkgs/by-name/sw/switchfin/package.nix
index 36bd4b2afe70..544ade8a4af8 100644
--- a/pkgs/by-name/sw/switchfin/package.nix
+++ b/pkgs/by-name/sw/switchfin/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "switchfin";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "dragonflylee";
     repo = "switchfin";
     rev = finalAttrs.version;
-    hash = "sha256-W1qdU9x9GTdLkGNaGE9BopQAO6QIanzPbOvD2wEhfUw=";
+    hash = "sha256-Q/AXCnw3NZh9Y0CciP87vmVsoHggMMKL4SYdmLhC62c=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/tu/tuxedo/package.nix b/pkgs/by-name/tu/tuxedo/package.nix
index aba3f266771b..a98a359fb42e 100644
--- a/pkgs/by-name/tu/tuxedo/package.nix
+++ b/pkgs/by-name/tu/tuxedo/package.nix
@@ -2,46 +2,39 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  writableTmpDirAsHomeHook,
   nix-update-script,
   versionCheckHook,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tuxedo";
-  version = "2026.6.2";
+  version = "2026.6.3";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "webstonehq";
     repo = "tuxedo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0ulyr7AbB6KZbAAvxc/s0NJTPBYS42UCbEXYREJTWMo=";
+    hash = "sha256-1uTa+S1bUyBsWy5FpmXFbggFc7lMbnDKul0h1O4NvMI=";
   };
 
-  cargoHash = "sha256-Sd3O/bw3/FZeas2eWAvSV3HWcDQg8Cla2hagWVYRKsc=";
+  cargoHash = "sha256-PIhtD0/0hxFOn51PwOWCtz82a2dvhS+2jbd8Wvr/JUM=";
 
-  preCheck = ''
-    export HOME="$TMPDIR/home"
-    export XDG_CONFIG_HOME="$TMPDIR/config"
-    export XDG_CACHE_HOME="$TMPDIR/cache"
-    export XDG_STATE_HOME="$TMPDIR/state"
-
-    mkdir -p \
-      "$HOME" \
-      "$XDG_CONFIG_HOME" \
-      "$XDG_CACHE_HOME" \
-      "$XDG_STATE_HOME"
-  '';
-
-  passthru.updateScript = nix-update-script { };
+  nativeCheckInputs = [ writableTmpDirAsHomeHook ];
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
 
+  __darwinAllowLocalNetworking = true;
+
   checkFlags = [
     # Failure
     "--skip=insert_dialog_after_nl_parse"
   ];
+
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "fast, keyboard-driven terminal UI for todo.txt";
     homepage = "https://github.com/webstonehq/tuxedo";
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 094749694b18..2eb7ee0ea3b2 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -98,7 +98,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "1.6.3";
+  version = "1.7.2";
 
   outputs = [
     "out"
@@ -111,7 +111,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9YdmsOtqjQT79R5IwrAtinaJ741xjyW1kZxZiEC0dAc=";
+    hash = "sha256-f4CxfUsOEZQIIf0+v+3nXH4zlM3mPy/eZyzXG1ayiVc=";
   };
 
   postPatch = ''
@@ -134,7 +134,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail 'builder.include(&glib_path_config);' 'builder.include("${lib.getLib glib}/lib/glib-2.0/include");'
   '';
 
-  cargoHash = "sha256-U7vOTZsWtOTP3XCn5iSVvM1HmuvG+bRMMjN1EbB/TkI=";
+  cargoHash = "sha256-QTnDiNFrBl8E6BgFL1HjoJhGfMBUzOoMimkyKdwUcks=";
 
   __structuredAttrs = true;
 
diff --git a/pkgs/development/libraries/mesa/common.nix b/pkgs/development/libraries/mesa/common.nix
index 979a4c44a604..bd4040f6e184 100644
--- a/pkgs/development/libraries/mesa/common.nix
+++ b/pkgs/development/libraries/mesa/common.nix
@@ -5,14 +5,14 @@
 # nix build .#legacyPackages.x86_64-darwin.mesa .#legacyPackages.aarch64-darwin.mesa
 rec {
   pname = "mesa";
-  version = "26.1.2";
+  version = "26.1.3";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "mesa";
     repo = "mesa";
     rev = "mesa-${version}";
-    hash = "sha256-GqIU9BL57n+ihpeXug+K9kOtvHZ+LCUQg1wi/rrYWuc=";
+    hash = "sha256-W2Ud9wmiIuDYMnFj8sK2SGAI1WayMCtdj7/7od/1Ql4=";
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/frida-python/default.nix b/pkgs/development/python-modules/frida-python/default.nix
index 25c2182c32cb..711891bdf92f 100644
--- a/pkgs/development/python-modules/frida-python/default.nix
+++ b/pkgs/development/python-modules/frida-python/default.nix
@@ -49,6 +49,8 @@ buildPythonPackage {
     "frida._frida"
   ];
 
+  passthru.updateScript = ./update.sh;
+
   meta = {
     description = "Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers (Python bindings)";
     homepage = "https://www.frida.re";
@@ -56,7 +58,10 @@ buildPythonPackage {
       lgpl2Plus
       wxWindowsException31
     ];
-    maintainers = with lib.maintainers; [ s1341 ];
+    maintainers = with lib.maintainers; [
+      s1341
+      eyjhb
+    ];
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
diff --git a/pkgs/development/python-modules/frida-python/update.sh b/pkgs/development/python-modules/frida-python/update.sh
new file mode 100755
index 000000000000..2dde81527470
--- /dev/null
+++ b/pkgs/development/python-modules/frida-python/update.sh
@@ -0,0 +1,26 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p curl jq nix
+
+set -euox pipefail
+
+dir="$(dirname "$0")"
+latest=$(curl -s https://pypi.org/pypi/frida/json | jq -r '.info.version')
+
+sed -i "s/version = \".*\"/version = \"$latest\"/" "$dir/default.nix"
+
+for system_platform in \
+  "x86_64-linux|manylinux1_x86_64" \
+  "aarch64-linux|manylinux2014_aarch64" \
+  "x86_64-darwin|macosx_10_13_x86_64" \
+  "aarch64-darwin|macosx_11_0_arm64"
+do
+  system="${system_platform%%|*}"
+  platform="${system_platform##*|}"
+  url=$(curl -s "https://pypi.org/pypi/frida/${latest}/json" | \
+    jq -r ".urls[] | select(.filename | test(\"${platform}\")) | .url")
+  hash=$(nix-prefetch-url --type sha256 "$url" 2>/dev/null | tail -1)
+  sri=$(nix hash to-sri --type sha256 "$hash")
+
+  old_sri=$(grep -A1 "${system} = {" "$dir/default.nix" | grep -o 'sha256-[^"]*')
+  sed -i "s|${old_sri}|${sri}|" "$dir/default.nix"
+done
diff --git a/pkgs/development/python-modules/ggml-python/default.nix b/pkgs/development/python-modules/ggml-python/default.nix
index 671bb7a357a8..dfc5798bc261 100644
--- a/pkgs/development/python-modules/ggml-python/default.nix
+++ b/pkgs/development/python-modules/ggml-python/default.nix
@@ -34,7 +34,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ggml-python";
-  version = "0.0.41";
+  version = "0.0.42";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -44,7 +44,7 @@ buildPythonPackage (finalAttrs: {
     tag = "v${finalAttrs.version}";
     # ggml-python expects an older version of ggml than pkgs.ggml's
     fetchSubmodules = true;
-    hash = "sha256-gtjoB62thkGx4N8gYsb8P8uFTHiGz0FrTLLqLBPA97M=";
+    hash = "sha256-dbYxAropTT8h1BnMg4Ua1hY/IUYWHaZcS0ckj38UoO4=";
   };
 
   build-system = [
diff --git a/pkgs/servers/home-assistant/custom-components/better_thermostat/package.nix b/pkgs/servers/home-assistant/custom-components/better_thermostat/package.nix
index 30cd2e4552a3..f18d33475c4c 100644
--- a/pkgs/servers/home-assistant/custom-components/better_thermostat/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/better_thermostat/package.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
   owner = "KartoffelToby";
   domain = "better_thermostat";
-  version = "1.8.1";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "KartoffelToby";
     repo = "better_thermostat";
     tag = version;
-    hash = "sha256-VSTGYs97ro65rrV80D6b3/XEeGi86FzXwU5nPabS5gE=";
+    hash = "sha256-agGCRIhCVRJWFXdva4lOjeM1Qh7LvYBowGi7LiatnMU=";
   };
 
   passthru.updateScript = gitUpdater {