diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 938339bf8f4b..72b45f03d786 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -9683,6 +9683,14 @@
     github = "Gigahawk";
     githubId = 10356230;
   };
+  gigamonster256 = {
+    email = "n0603919@outlook.com";
+    github = "gigamonster256";
+    githubId = 19415285;
+    matrix = "@gigamonster256:matrix.org";
+    name = "Caleb Norton";
+    keys = [ { fingerprint = "483A 112B 3567 C4F0 DF89  74E1 D776 F570 2D7E 83AB"; } ];
+  };
   giggio = {
     email = "giggio@giggio.net";
     github = "giggio";
diff --git a/nixos/modules/services/networking/bind.nix b/nixos/modules/services/networking/bind.nix
index 5d1ce87344d2..28b4a1b306bb 100644
--- a/nixos/modules/services/networking/bind.nix
+++ b/nixos/modules/services/networking/bind.nix
@@ -76,25 +76,26 @@ let
     text = ''
       key "rndc-key" {
         algorithm ${bindRndcMacType};
-        secret "0123456789abcdefghijklmnopqrstuvw=";
+        secret "Ini0XSebb9LrYz7zprobBLZ2iwBEK5S9vh9zj/DozR8=";
       };
     '';
   };
 
+  testFakeDir = "/tmp/test-fake-directory-for-named-checkconf";
+
   confFile = pkgs.writeTextFile {
     name = "named.conf";
     checkPhase = ''
-      runHook preCheck
-      echo "Checking named configuration file...";
-      ${lib.getExe' bindPkg "named-checkconf"} -z $target -t ${cfg.directory}
-      runHook postCheck
+      ${lib.optionalString cfg.checkConfig ''
+        echo "Checking named configuration file...";
+        mkdir -p ${testFakeDir}
+        ${lib.getExe' bindPkg "named-checkconf"} -z $target
+      ''}
+
+      substituteInPlace $target \
+        --replace-fail ${testRndcKey} ${bindRndcKeyFile} \
+        --replace-fail ${testFakeDir} ${cfg.directory}
     '';
-    derivationArgs = {
-      doCheck = true;
-      postCheck = ''
-        substituteInPlace $target --replace-fail ${testRndcKey} ${bindRndcKeyFile}
-      '';
-    };
 
     # The include path in the first line will be replaced in the postCheck hook.
     text = ''
@@ -117,7 +118,7 @@ let
         blackhole { badnetworks; };
         forward ${cfg.forward};
         forwarders { ${lib.concatMapStrings (entry: " ${entry}; ") cfg.forwarders} };
-        directory "${cfg.directory}";
+        directory "${testFakeDir}";
         pid-file "/run/named/named.pid";
         ${cfg.extraOptions}
       };
@@ -323,6 +324,16 @@ in
         '';
       };
 
+      checkConfig = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Check configuration.
+
+          The configuration will not be checked if you override the config file
+          with `configFile`.
+        '';
+      };
     };
 
   };
diff --git a/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
index ca841c82a043..a10313fad7e1 100644
--- a/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
@@ -10,8 +10,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "tinymist";
     publisher = "myriad-dreamin";
-    version = "0.14.10";
-    hash = "sha256-ez7VRSVjPVDqXpscwB+PGSEXw34YHmAV14atnSYO0vg=";
+    version = "0.14.12";
+    hash = "sha256-BDRp9idiE0P9GvnXugxkPyOJ7Sv4cVs6z7Ep9Pw9rgs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index a59320d4cd97..da8f4b9fb4c3 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -27,13 +27,13 @@
     "vendorHash": null
   },
   "aiven_aiven": {
-    "hash": "sha256-2kv5cBEogQXmWcN/fzg0Rxf/SuqLpeOr8O2NoOg57+c=",
+    "hash": "sha256-/Vrz9KuImtTDhuOMM6Ql8N2KTDQKZyzU5bgWPlN7HdI=",
     "homepage": "https://registry.terraform.io/providers/aiven/aiven",
     "owner": "aiven",
     "repo": "terraform-provider-aiven",
-    "rev": "v4.52.0",
+    "rev": "v4.53.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-mUBHjGpDE7aFiyUovi7/doOrrZelmNJC+QYF5+2dxt0="
+    "vendorHash": "sha256-aKD+3Y80B3BUmsBsbeAiSpCx7Qh3U/LlTtB2fk/tlTI="
   },
   "akamai_akamai": {
     "hash": "sha256-vC7hVV/p28y7cv9PONEfRVj5uKgumtbq4HpbOYq9vBQ=",
@@ -580,11 +580,11 @@
     "vendorHash": "sha256-v/XHGUEpAIpGHErv7GPqfosVLL3xaqBwZHbJKS8fkn4="
   },
   "hashicorp_google-beta": {
-    "hash": "sha256-rBThPPPO8TJbJYXJBQX8pF7Wy4V8fNzrpAgcu1B+7mE=",
+    "hash": "sha256-WOeYK5uti8NYhR3j8BgxwnlybEGOJryIPPTEgM23Fp0=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "repo": "terraform-provider-google-beta",
-    "rev": "v7.23.0",
+    "rev": "v7.24.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-YZQMUGScsYjBkhAQ4DXYlBpAw805iKgX/iXDMTpRr6c="
   },
diff --git a/pkgs/by-name/cf/cfripper/package.nix b/pkgs/by-name/cf/cfripper/package.nix
index 0b37a517de43..b5e915bb043f 100644
--- a/pkgs/by-name/cf/cfripper/package.nix
+++ b/pkgs/by-name/cf/cfripper/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "cfripper";
-  version = "1.20.0";
+  version = "1.20.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Skyscanner";
     repo = "cfripper";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uJy1n+bZgmKZpyu1MmbHgKeEOl5onUuQI3ZAlLgY+v4=";
+    hash = "sha256-HE9n28q1HX1HRSiXyEuUrAJGp4d5i1e0lROcsqpsobA=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/co/codex/package.nix b/pkgs/by-name/co/codex/package.nix
index 153b3d5a4a06..3cbb31d2466f 100644
--- a/pkgs/by-name/co/codex/package.nix
+++ b/pkgs/by-name/co/codex/package.nix
@@ -20,30 +20,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codex";
-  version = "0.115.0";
+  version = "0.116.0";
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = "codex";
     tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-8l5OZQS6L1uhVpqZZGx2O3Xt6qTaTAYDR5XWOydTVuQ=";
+    hash = "sha256-PTsKphg3gPlBUs5oMM34RhJJ4jxvD6hand5aVjXcuZ4=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/codex-rs";
 
-  # TODO: Drop workaround once PR #486983 reaches master.
-  depsExtraArgs = {
-    nativeBuildInputs = [ cargo ];
-    postBuild = ''
-      # delete all Cargo.toml files for which `cargo metadata` fails
-      shopt -s globstar
-      for manifest_path in "$out"/**/Cargo.toml; do
-        cargo metadata --format-version 1 --no-deps --manifest-path "$manifest_path" >/dev/null || rm -v "$manifest_path"
-      done
-    '';
-  };
-
-  cargoHash = "sha256-7lp6QslpGPXtDXVvlg/+m6LrLV/Ygd1FcjtlMviE3oM=";
+  cargoHash = "sha256-X5Yh8+3UrCZfzIplb4OzFfcfoklMu3FikU9vZ6CJbfc=";
 
   nativeBuildInputs = [
     clang
diff --git a/pkgs/by-name/cr/cryptomator/package.nix b/pkgs/by-name/cr/cryptomator/package.nix
index e374518ca5cc..223b1e83adb1 100644
--- a/pkgs/by-name/cr/cryptomator/package.nix
+++ b/pkgs/by-name/cr/cryptomator/package.nix
@@ -35,12 +35,11 @@ maven.buildMavenPackage rec {
   mvnParameters = "-Dmaven.test.skip=true -Plinux";
   mvnHash = "sha256-IVOcDFW5YKgUHJKX3ZXYVnOevwmOwN5yEU8jfPtCY1I=";
   mvnFetchExtraArgs.env = {
-    inherit SOURCE_DATE_EPOCH;
+    inherit (env) SOURCE_DATE_EPOCH;
   };
 
   # fix for "date 1980-01-01T00:00:00Z is not within the valid range 1980-01-01T00:00:02Z to 2099-12-31T23:59:59Z"
-  # this should be in env, but looks like buildMavenPackage doesn't support that
-  SOURCE_DATE_EPOCH = 315532802; # 1980-01-01T00:00:02Z
+  env.SOURCE_DATE_EPOCH = 315532802; # 1980-01-01T00:00:02Z
 
   preBuild = ''
     VERSION=${version}
diff --git a/pkgs/by-name/de/deterministic-zip/package.nix b/pkgs/by-name/de/deterministic-zip/package.nix
index d8e8f5d43054..b529cc49014a 100644
--- a/pkgs/by-name/de/deterministic-zip/package.nix
+++ b/pkgs/by-name/de/deterministic-zip/package.nix
@@ -30,7 +30,7 @@ buildGoModule (finalAttrs: {
     description = "Simple (almost drop-in) replacement for zip that produces deterministic files";
     mainProgram = "deterministic-zip";
     homepage = "https://github.com/timo-reymann/deterministic-zip";
-    license = lib.licenses.unfreeRedistributable;
+    license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ rhysmdnz ];
   };
 })
diff --git a/pkgs/by-name/du/ducker/package.nix b/pkgs/by-name/du/ducker/package.nix
index 34f49d396074..82e2fbff573c 100644
--- a/pkgs/by-name/du/ducker/package.nix
+++ b/pkgs/by-name/du/ducker/package.nix
@@ -5,16 +5,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ducker";
-  version = "0.6.4";
+  version = "0.6.5";
 
   src = fetchFromGitHub {
     owner = "robertpsoane";
     repo = "ducker";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-3o6uA3g1v4PiRYl6J4sOAllgwkEou7kS9E8us4DIZb0=";
+    sha256 = "sha256-ly5+2GySq2yiEDXG+IXfAB70Wzp58B+Py0GCuvwKXxw=";
   };
 
-  cargoHash = "sha256-GUbRNXphkbm0oSjC8wKJgIhigtB4dbUwNuMSvCJUyaA=";
+  cargoHash = "sha256-Sgn7dxmt/kn40jqMcRUIxdLfJRDWrHEAUb3TXUuGqSk=";
 
   meta = {
     description = "Terminal app for managing docker containers, inspired by K9s";
diff --git a/pkgs/by-name/fl/flashrom/0001-sb600spi.c-Drop-Promontory-support.patch b/pkgs/by-name/fl/flashrom/0001-sb600spi.c-Drop-Promontory-support.patch
deleted file mode 100644
index 2fa422f8c1a1..000000000000
--- a/pkgs/by-name/fl/flashrom/0001-sb600spi.c-Drop-Promontory-support.patch
+++ /dev/null
@@ -1,103 +0,0 @@
-From 38b2cb092e866dede6b6ffddd135ff54a9bda69e Mon Sep 17 00:00:00 2001
-From: Angel Pons <th3fanbus@gmail.com>
-Date: Wed, 2 Nov 2022 22:45:52 +0100
-Subject: [PATCH] sb600spi.c: Drop "Promontory" support
-
-The "Promontory" code is riddled with issues, some of them can result in
-soft bricks. Moreover, Promontory doesn't have a SPI controller.
-
-Drop support for "Promontory" in flashrom for now: it's holding back the
-entire project and it's unlikely that it'll be fixed in a timely manner.
-
-Change-Id: I1457946dce68321b496d9ffa40a0c5ab46455f72
-Signed-off-by: Angel Pons <th3fanbus@gmail.com>
-Reviewed-on: https://review.coreboot.org/c/flashrom/+/68824
-Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
-Reviewed-by: Felix Singer <felixsinger@posteo.net>
-Reviewed-by: Swift Geek (Sebastian Grzywna) <swiftgeek@gmail.com>
-Reviewed-by: Edward O'Callaghan <quasisec@chromium.org>
-(cherry picked from commit 664c58f32af45b2acf7520c05bb40ef2c2f0891e)
----
- sb600spi.c | 31 ++-----------------------------
- 1 file changed, 2 insertions(+), 29 deletions(-)
-
-diff --git a/sb600spi.c b/sb600spi.c
-index cec7e0a5..e84bb8d6 100644
---- a/sb600spi.c
-+++ b/sb600spi.c
-@@ -48,7 +48,6 @@ enum amd_chipset {
- 	CHIPSET_HUDSON234,
- 	CHIPSET_BOLTON,
- 	CHIPSET_YANGTZE,
--	CHIPSET_PROMONTORY,
- };
- 
- #define FIFO_SIZE_OLD		8
-@@ -135,7 +134,8 @@ static enum amd_chipset determine_generation(struct pci_dev *dev)
- 		 */
- 		} else if (rev == 0x4b || rev == 0x51 || rev == 0x59 || rev == 0x61 || rev == 0x71) {
- 			msg_pdbg("Promontory (rev 0x%02x) detected.\n", rev);
--			return CHIPSET_PROMONTORY;
-+			msg_perr("AMD \"Promontory\" chipsets are currently not supported (https://ticket.coreboot.org/issues/370)");
-+			return CHIPSET_AMD_UNKNOWN;
- 		} else {
- 			msg_pwarn("FCH device found but SMBus revision 0x%02x does not match known values.\n"
- 				  "Please report this to flashrom@flashrom.org and include this log and\n"
-@@ -572,18 +572,6 @@ static int handle_imc(const struct programmer_cfg *cfg, struct pci_dev *dev, enu
- 	return amd_imc_shutdown(dev);
- }
- 
--static int promontory_read_memmapped(struct flashctx *flash, uint8_t *buf,
--		unsigned int start, unsigned int len)
--{
--	struct sb600spi_data * data = (struct sb600spi_data *)flash->mst->spi.data;
--	if (!data->flash) {
--		map_flash(flash);
--		data->flash = flash; /* keep a copy of flashctx for unmap() on tear-down. */
--	}
--	mmio_readn((void *)(flash->virtual_memory + start), buf, len);
--	return 0;
--}
--
- static int sb600spi_shutdown(void *data)
- {
- 	struct sb600spi_data *sb600_data = data;
-@@ -617,17 +605,6 @@ static const struct spi_master spi_master_yangtze = {
- 	.shutdown	= sb600spi_shutdown,
- };
- 
--static const struct spi_master spi_master_promontory = {
--	.max_data_read	= MAX_DATA_READ_UNLIMITED,
--	.max_data_write	= FIFO_SIZE_YANGTZE - 3,
--	.command	= spi100_spi_send_command,
--	.map_flash_region	= physmap,
--	.unmap_flash_region	= physunmap,
--	.read		= promontory_read_memmapped,
--	.write_256	= default_spi_write_256,
--	.shutdown	= sb600spi_shutdown,
--};
--
- int sb600_probe_spi(const struct programmer_cfg *cfg, struct pci_dev *dev)
- {
- 	struct pci_dev *smbus_dev;
-@@ -731,8 +708,6 @@ int sb600_probe_spi(const struct programmer_cfg *cfg, struct pci_dev *dev)
- 	case CHIPSET_SB89XX:
- 	case CHIPSET_HUDSON234:
- 	case CHIPSET_YANGTZE:
--	case CHIPSET_PROMONTORY:
--		msg_pdbg(", SpiBusy=%"PRIi32"", (tmp >> 31) & 0x1);
- 	default: break;
- 	}
- 	msg_pdbg("\n");
-@@ -808,8 +783,6 @@ int sb600_probe_spi(const struct programmer_cfg *cfg, struct pci_dev *dev)
- 		register_spi_master(&spi_master_sb600, data);
- 	else if (amd_gen == CHIPSET_YANGTZE)
- 		register_spi_master(&spi_master_yangtze, data);
--	else
--		register_spi_master(&spi_master_promontory, data);
- 
- 	return 0;
- }
--- 
-2.45.2
-
diff --git a/pkgs/by-name/fl/flashrom/package.nix b/pkgs/by-name/fl/flashrom/package.nix
index 4eb29859cebc..381f26cb98fb 100644
--- a/pkgs/by-name/fl/flashrom/package.nix
+++ b/pkgs/by-name/fl/flashrom/package.nix
@@ -14,27 +14,20 @@
   pkg-config,
   sphinx,
   jlinkSupport ? false,
+  git,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "flashrom";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchurl {
     url = "https://download.flashrom.org/releases/flashrom-v${finalAttrs.version}.tar.xz";
-    hash = "sha256-i52zmH35tfyB5wGJ0BeQXdX2vh4UEDR/Imh6ttTJRCM=";
+    hash = "sha256-Qyis6YM/fv58M0vdc0gs3oKGgZgmzAAUnoP7qWvzq08=";
   };
 
-  patches = [
-    # Release notes for 1.4.0 state that Promontory chipsets are unsupported, and that attempting to read flash on those systems may crash the system.
-    # The patch that removes this (broken) support only made it into the 1.3.0 release, seemingly by mistake, and the relevant code has been essentially untouched since.
-    # We cherry-pick the upstream patch from 1.3.0, though amended to reference the relevant bug in the error message, rather than requesting the user email upstream.
-    # https://ticket.coreboot.org/issues/370
-    # https://review.coreboot.org/c/flashrom/+/68824
-    ./0001-sb600spi.c-Drop-Promontory-support.patch
-  ];
-
   nativeBuildInputs = [
+    git
     meson
     ninja
     pkg-config
diff --git a/pkgs/by-name/fo/forgejo-mcp/package.nix b/pkgs/by-name/fo/forgejo-mcp/package.nix
index d3a35ad0407f..37a719978fff 100644
--- a/pkgs/by-name/fo/forgejo-mcp/package.nix
+++ b/pkgs/by-name/fo/forgejo-mcp/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "forgejo-mcp";
-  version = "2.14.0";
+  version = "2.16.0";
 
   src = fetchFromCodeberg {
     owner = "goern";
     repo = "forgejo-mcp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jjwzc9bnuOG5j9frOGmJYv7oOnXRpns8pknonDezHGQ=";
+    hash = "sha256-LiLzkpbNqY8YKhsDt1Y6SrI28YEAy2KWQiw206Q4MbQ=";
   };
 
-  vendorHash = "sha256-j5o/FZBowQvcatw14Fvs/8CTM5ZtQR6kwlroctaeKuM=";
+  vendorHash = "sha256-tQyZqtmJnbVIG8lpWeZjflv92OdOdmzJXAmq4xrI5Pw=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/gi/git-credential-keepassxc/package.nix b/pkgs/by-name/gi/git-credential-keepassxc/package.nix
index a66f393465f4..a33a78b6fa42 100644
--- a/pkgs/by-name/gi/git-credential-keepassxc/package.nix
+++ b/pkgs/by-name/gi/git-credential-keepassxc/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "git-credential-keepassxc";
-  version = "0.14.1";
+  version = "0.14.2";
 
   src = fetchFromGitHub {
     owner = "Frederick888";
     repo = "git-credential-keepassxc";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-qxNzWuuIoK9BJLVcWtrER+MyA5cyd03xAwGljh8DZC4=";
+    hash = "sha256-tA90IM2zLDX9LkIZ6BEW9L+Se3f/cq80f+IwLfq1cjI=";
   };
 
-  cargoHash = "sha256-jjexSzxRhnNPW+urG7KpZBWfGcy06Cg4lXlQogF3L/A=";
+  cargoHash = "sha256-5aXVvQdiQ+3c3VsGX/nrvclgNlXUO3bs0/De8LEXDek=";
 
   buildFeatures =
     [ ]
diff --git a/pkgs/by-name/ho/homebridge/package.nix b/pkgs/by-name/ho/homebridge/package.nix
index b73996a2bdb6..da43e6534191 100644
--- a/pkgs/by-name/ho/homebridge/package.nix
+++ b/pkgs/by-name/ho/homebridge/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "homebridge";
-  version = "1.11.2";
+  version = "1.11.3";
 
   src = fetchFromGitHub {
     owner = "homebridge";
     repo = "homebridge";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6w2SDnP7P89j3/oLR77D0ubOzDb93krrRJQsDrhPTR4=";
+    hash = "sha256-Hr4pwWsISj4zde5DNOVSciZr1xJmL7M0wG2GU62ZDk4=";
   };
 
-  npmDepsHash = "sha256-m6ZLwDyWEwll7PYRHREThj+SvkfCNgODrpo8DTk6j8w=";
+  npmDepsHash = "sha256-LPCaqJGMeX8PaGwxfLnxQ5hdNycaE9nUMIU3LM6PHkg=";
 
   # Homebridge's clean phase attempts to install rimraf directly, which fails in nix builds
   # rimraf is already in the declared dependencies, so we just don't need to do it.
diff --git a/pkgs/by-name/ki/kittysay/package.nix b/pkgs/by-name/ki/kittysay/package.nix
index 5548c8200619..e1d50ae5a6b3 100644
--- a/pkgs/by-name/ki/kittysay/package.nix
+++ b/pkgs/by-name/ki/kittysay/package.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
 }:
 let
-  version = "0.8.0";
+  version = "1.1.1";
 in
 rustPlatform.buildRustPackage {
   pname = "kittysay";
@@ -14,10 +14,12 @@ rustPlatform.buildRustPackage {
     owner = "uncenter";
     repo = "kittysay";
     rev = "v${version}";
-    hash = "sha256-ZYHrDBJ8cTqJAh2KUGSCsS1bY/emHRodPxZX2vxAhDs=";
+    hash = "sha256-+WrIMte1RXi8nZNvrH/e/2JMx39LkKi8pkq/TUfmzFo=";
   };
 
-  cargoHash = "sha256-LIAXlOArm5V7Kbm82GDRs3XvMTgKjuOL2C+fQfEDwb4=";
+  cargoHash = "sha256-7bAPKZAiX/p5xvIbGBBf8O1rksnizIJfMkUwhkpouAA=";
+
+  doCheck = false;
 
   meta = {
     description = "Cowsay, but with a cute kitty :3";
diff --git a/pkgs/by-name/la/labwc-tweaks/package.nix b/pkgs/by-name/la/labwc-tweaks/package.nix
index e84c7d90b9a0..fa7e18588bac 100644
--- a/pkgs/by-name/la/labwc-tweaks/package.nix
+++ b/pkgs/by-name/la/labwc-tweaks/package.nix
@@ -10,15 +10,15 @@
   unstableGitUpdater,
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "labwc-tweaks";
-  version = "0-unstable-2024-04-27";
+  version = "0.1.0";
 
   src = fetchFromGitHub {
     owner = "labwc";
     repo = "labwc-tweaks";
-    rev = "9007079640e0f38c1d69ac94899229354a5c67b2";
-    hash = "sha256-klKPHAhJ6fedFojXPfesjs1dG5NJhBZkzynhka5vD8M=";
+    tag = finalAttrs.version;
+    hash = "sha256-himbdQ3cu+9NnbO5mYOKh30WIp55lSIkwvHAC89IzC8=";
   };
 
   nativeBuildInputs = [
@@ -37,7 +37,7 @@ stdenv.mkDerivation {
   strictDeps = true;
 
   postPatch = ''
-    substituteInPlace tweaks-qt/gen-layout-list --replace-fail /usr/share/X11/xkb ${xkeyboard_config}/share/X11/xkb
+    substituteInPlace bin/gen-layout-list --replace-fail /usr/share/X11/xkb ${xkeyboard_config}/share/X11/xkb
   '';
 
   passthru.updateScript = unstableGitUpdater { };
@@ -52,4 +52,4 @@ stdenv.mkDerivation {
       romildo
     ];
   };
-}
+})
diff --git a/pkgs/by-name/li/liquibase/package.nix b/pkgs/by-name/li/liquibase/package.nix
index 480f9e53494c..f5693eb176b7 100644
--- a/pkgs/by-name/li/liquibase/package.nix
+++ b/pkgs/by-name/li/liquibase/package.nix
@@ -26,11 +26,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "liquibase";
-  version = "5.0.1";
+  version = "5.0.2";
 
   src = fetchurl {
     url = "https://github.com/liquibase/liquibase/releases/download/v${finalAttrs.version}/liquibase-${finalAttrs.version}.tar.gz";
-    hash = "sha256-OuEczc1MCA5CHl/QQ729Yk1W/PybKU1dnYmMuLB05Ek=";
+    hash = "sha256-EDVr6p3FeGilf8OviK1HH1An1nrR9fyIqcIiFAHLriM=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/ma/maven/build-maven-package.nix b/pkgs/by-name/ma/maven/build-maven-package.nix
index 0738126f66ed..65b8bd2f7fc6 100644
--- a/pkgs/by-name/ma/maven/build-maven-package.nix
+++ b/pkgs/by-name/ma/maven/build-maven-package.nix
@@ -52,7 +52,9 @@ let
       ]
       ++ args.nativeBuildInputs or [ ];
 
-      env.JAVA_HOME = mvnJdk;
+      env = mvnFetchExtraArgs.env or { } // {
+        JAVA_HOME = mvnJdk;
+      };
 
       impureEnvVars = lib.fetchers.proxyImpureEnvVars;
 
@@ -119,7 +121,7 @@ let
       outputHashMode = "recursive";
       outputHash = mvnHash;
     }
-    // mvnFetchExtraArgs
+    // (removeAttrs mvnFetchExtraArgs [ "env" ])
   );
 in
 stdenv.mkDerivation (
@@ -131,7 +133,9 @@ stdenv.mkDerivation (
       maven
     ];
 
-    env.JAVA_HOME = mvnJdk;
+    env = args.env or { } // {
+      JAVA_HOME = mvnJdk;
+    };
 
     buildPhase = ''
       runHook preBuild
diff --git a/pkgs/by-name/mi/miller/package.nix b/pkgs/by-name/mi/miller/package.nix
index 1ff496d18ad2..256ed560c8e2 100644
--- a/pkgs/by-name/mi/miller/package.nix
+++ b/pkgs/by-name/mi/miller/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "miller";
-  version = "6.16.0";
+  version = "6.17.0";
 
   src = fetchFromGitHub {
     owner = "johnkerl";
     repo = "miller";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-WQn0vynf+eNbPHuPI2J5CA9R3ptAShPMErJQ/W3UybQ=";
+    sha256 = "sha256-a147/0w+e+y4zCDs9/NGmtVK8rp//5I+QAsDBzj/sRg=";
   };
 
   outputs = [
@@ -20,7 +20,7 @@ buildGoModule (finalAttrs: {
     "man"
   ];
 
-  vendorHash = "sha256-pBl0WfgXgMlUFzIDL7vgTkh9OXoetyRSf769UcVW+uQ=";
+  vendorHash = "sha256-6BStDF95QXk55m2QujCqxoE0nciP7blyN/fFCHaTy6I=";
 
   postInstall = ''
     mkdir -p $man/share/man/man1
diff --git a/pkgs/by-name/mp/mprocs/package.nix b/pkgs/by-name/mp/mprocs/package.nix
index a61d447d706d..f6b04bf56f53 100644
--- a/pkgs/by-name/mp/mprocs/package.nix
+++ b/pkgs/by-name/mp/mprocs/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mprocs";
-  version = "0.8.3";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "pvolok";
     repo = "mprocs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8p8hPATAyc7ms2iXktrSEAmi6/ax85F5xwF6e7H4XRE=";
+    hash = "sha256-UZFFeaesT71UQHPjiG2w5O2Ulyt86OVuFw7i3A7b91I=";
   };
 
-  cargoHash = "sha256-wQNUHiOaq5fgZbwUEEco5MjX8xH2NoQnKCtM1cHchUQ=";
+  cargoHash = "sha256-htgl0zh73oHXbc9E90xtb5jM8zhXvSJCE9DBhd1SH2E=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/no/noctalia-qs/package.nix b/pkgs/by-name/no/noctalia-qs/package.nix
index 265eae434676..1546b1cd3411 100644
--- a/pkgs/by-name/no/noctalia-qs/package.nix
+++ b/pkgs/by-name/no/noctalia-qs/package.nix
@@ -26,13 +26,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "noctalia-qs";
-  version = "0.0.9";
+  version = "0.0.10";
 
   src = fetchFromGitHub {
     owner = "noctalia-dev";
     repo = "noctalia-qs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oRqz+5AbNKfUWWwN5c83CsSOsUWVGITh0HZg+wX5Q/8=";
+    hash = "sha256-tscUYNjBfi52Uwu40epdAhoFztsmroKBEBvr22oCnv4=";
   };
 
   patches = [
diff --git a/pkgs/by-name/nu/nu-lint/package.nix b/pkgs/by-name/nu/nu-lint/package.nix
new file mode 100644
index 000000000000..f2f49e61be9f
--- /dev/null
+++ b/pkgs/by-name/nu/nu-lint/package.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  fetchFromGitea,
+  rustPlatform,
+  nix-update-script,
+  versionCheckHook,
+  stdenvNoCC,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "nu-lint";
+  version = "0.1.1";
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "wvhulle";
+    repo = "nu-lint";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-RU+Jy0AMesQpvndjF29IlJb2gpV76lm0Fz0Fk/i6RYU=";
+  };
+
+  cargoHash = "sha256-NbjeOtvvJhk/27Jg/jthdSZ09n/j37J2Y+yAIiVUia4=";
+
+  nativeBuildInputs = lib.optionals stdenvNoCC.hostPlatform.isDarwin [
+    # Avoids "couldn't find any valid shared libraries matching: ['libclang.dylib']" error on darwin in sandbox mode.
+    rustPlatform.bindgenHook
+  ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  # NOTE: Disabled for version 0.1.1 outputs "0.1.0" when run `nu-lint --version` is run
+  doInstallCheck = false;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Linter for the Nu shell scripting language";
+    homepage = "https://codeberg.org/wvhulle/nu-lint";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ kpbaks ];
+    platforms = lib.platforms.all;
+    mainProgram = "nu-lint";
+  };
+})
diff --git a/pkgs/by-name/ol/ollama/package.nix b/pkgs/by-name/ol/ollama/package.nix
index 025815fd7d37..2eaba9c0c4f0 100644
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -137,13 +137,13 @@ let
 in
 goBuild (finalAttrs: {
   pname = "ollama";
-  version = "0.18.0";
+  version = "0.18.2";
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nnVuWjx3ZmAjHRPmsh+ut4UzzZxq6b7kXf0jq2ZsbXU=";
+    hash = "sha256-BDCYczTZO6LKwD8+LY625pZwvJVMYUE0VwVG5pVYfGk=";
   };
 
   vendorHash = "sha256-Lc1Ktdqtv2VhJQssk8K1UOimeEjVNvDWePE9WkamCos=";
diff --git a/pkgs/by-name/ph/phoenixd/package.nix b/pkgs/by-name/ph/phoenixd/package.nix
index a02e5cce49cd..44578c1275d3 100644
--- a/pkgs/by-name/ph/phoenixd/package.nix
+++ b/pkgs/by-name/ph/phoenixd/package.nix
@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "phoenixd";
-  version = "0.7.2";
+  version = "0.7.3";
 
   src =
     let
@@ -28,10 +28,10 @@ stdenv.mkDerivation (finalAttrs: {
     fetchurl {
       url = "https://github.com/ACINQ/phoenixd/releases/download/v${finalAttrs.version}/phoenixd-${finalAttrs.version}-${suffix}.zip";
       hash = selectSystem {
-        aarch64-darwin = "sha256-OOoEgZLa+wZ8CXDH64TxvLBZ2r5WLyq6HERIyeEerf0=";
-        x86_64-darwin = "sha256-HPpgqmoiw3TCT4Q/+GJRv1AgHI0wtHThSPTSVAsPQcE=";
-        x86_64-linux = "sha256-T0Xhc4tzZRIDx16sbrOXeCZjRlTdeITghhfLHrU6nBY=";
-        aarch64-linux = "sha256-w7zaqDd4zYM0gva6l8d6tJ+/jpJuWERQ2aHaKOBKJAM=";
+        aarch64-darwin = "sha256-tKTn6w2F6qKsn6ieob+gENL4/kF8CZU346KbjgYIXWU=";
+        x86_64-darwin = "sha256-9F5jngwx/O9Qklpzxlfd5SN94ds80cZzopRrXyPY+pQ=";
+        x86_64-linux = "sha256-MCYElD6mG5PNKcns5ZYsrCoEmS1JPySqFgDhuX2O6os=";
+        aarch64-linux = "sha256-xMiSxY7Q2witH0GR7lI2V6HU8noY8u4zYInhjM3y0wU=";
       };
     };
 
diff --git a/pkgs/by-name/pl/pluto/package.nix b/pkgs/by-name/pl/pluto/package.nix
index 7e415e3f5689..4adba57309c3 100644
--- a/pkgs/by-name/pl/pluto/package.nix
+++ b/pkgs/by-name/pl/pluto/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "pluto";
-  version = "5.22.7";
+  version = "5.23.5";
 
   src = fetchFromGitHub {
     owner = "FairwindsOps";
     repo = "pluto";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-lB8xMkKCnQYMtwvYXbCwSsh30nbpQ/2Pl8dHA1R3bQg=";
+    hash = "sha256-jV5osPpAQk161IBQZkL5J+zZH0ewWeSW8D/8Zlj+6JE=";
   };
 
-  vendorHash = "sha256-PVax9C1tSlB8AVhJbRx4l5kvOrPfWd4O8jQ2lXoamls=";
+  vendorHash = "sha256-gk4AhSbFdbC3bTy/bFL1Evm8b6RlgoMybWdacRlluN8=";
 
   ldflags = [
     "-w"
diff --git a/pkgs/by-name/pr/protontricks/package.nix b/pkgs/by-name/pr/protontricks/package.nix
index bed9a641aaab..b2b5cbbb3ddb 100644
--- a/pkgs/by-name/pr/protontricks/package.nix
+++ b/pkgs/by-name/pr/protontricks/package.nix
@@ -14,14 +14,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "protontricks";
-  version = "1.13.1";
+  version = "1.14.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Matoking";
     repo = "protontricks";
     tag = finalAttrs.version;
-    hash = "sha256-YJUNp+8n1LPlD7lCAy6AMNxToloPBn8ZaRfREiwS9ls=";
+    hash = "sha256-36Yst8j5xhXulNp/YGO3pDnvxpyT4ZuEjwSvJIESUSw=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ps/pscale/package.nix b/pkgs/by-name/ps/pscale/package.nix
index 35852fabb712..bbd399180cec 100644
--- a/pkgs/by-name/ps/pscale/package.nix
+++ b/pkgs/by-name/ps/pscale/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "pscale";
-  version = "0.271.0";
+  version = "0.276.0";
 
   src = fetchFromGitHub {
     owner = "planetscale";
     repo = "cli";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-VSHeHruqGD2cgF5XYlyeGYhcSBlGIC+lgO6Qqrhtb0Q=";
+    sha256 = "sha256-J7v281WpKD4WQahfgLtGjKCg1l44scobPnPXpC5SpOs=";
   };
 
-  vendorHash = "sha256-DbxciJXGcjQJZUmCbK8mFAtmKzRkWcMCWgU0SBrKTH0=";
+  vendorHash = "sha256-eQtafI1LHm8kRVFHJhjihdy2/KHKGAsyOwzsIzWVspc=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/py/pyrefly/package.nix b/pkgs/by-name/py/pyrefly/package.nix
index 184f7088b82e..f99cfdb26e1e 100644
--- a/pkgs/by-name/py/pyrefly/package.nix
+++ b/pkgs/by-name/py/pyrefly/package.nix
@@ -10,17 +10,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "pyrefly";
-  version = "0.55.0";
+  version = "0.57.1";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "pyrefly";
     tag = finalAttrs.version;
-    hash = "sha256-Pdfi+ZCAnBCCFNI/5NLNexacn1kFDHjnjgkhfw/m1j0=";
+    hash = "sha256-BOByPz2Ue0AjABvaqii0NJZJotyrOJhRjBpfwBCgdzs=";
   };
 
   buildAndTestSubdir = "pyrefly";
-  cargoHash = "sha256-HXJsTE0a8X4c+CvC9e0xp4PVUBrFOpB5R/K/UG5MeDs=";
+  cargoHash = "sha256-XGiK5tVkgOmwMuBLppQ/QNR2HuVxr4vGLO66WUm8jNs=";
 
   buildInputs = [ rust-jemalloc-sys ];
 
diff --git a/pkgs/by-name/qd/qdelay/package.nix b/pkgs/by-name/qd/qdelay/package.nix
index 4453316263c7..c01d32a4b43c 100644
--- a/pkgs/by-name/qd/qdelay/package.nix
+++ b/pkgs/by-name/qd/qdelay/package.nix
@@ -23,14 +23,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qdelay";
-  version = "1.1.1";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "tiagolr";
     repo = "qdelay";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-RKTfKKsPSnraLS6SFKWB/wRPSFqeRpl/DYVKF4BKAYU=";
+    hash = "sha256-CjJJYr4dQkc7N+KbTAdaX7u8vnRi+mjBx8iqrN/Pi+4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ru/rumno/package.nix b/pkgs/by-name/ru/rumno/package.nix
index 561627b2bdb8..8a69ddced2df 100644
--- a/pkgs/by-name/ru/rumno/package.nix
+++ b/pkgs/by-name/ru/rumno/package.nix
@@ -11,21 +11,22 @@
   atk,
   pango,
   harfbuzz,
+  gtk-layer-shell,
   nix-update-script,
 }:
 
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rumno";
-  version = "0-unstable-2025-08-13";
+  version = "0.1.3";
 
   src = fetchFromGitLab {
     owner = "ivanmalison";
     repo = "rumno";
-    rev = "a70bf6f05976b07ae5fdced2ab80d2b9e684fb92";
-    hash = "sha256-reJIYlTR6fI42EcYGwb5BmEPVtls+s1+mFd7/34oXBw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-vR6+dNq0sdVtzdBL6GTzqAhl0fE6ulF6UCqIH1fSte4=";
   };
 
-  cargoHash = "sha256-z9nGePcVc+RPSMPb7CAPOfUMoVlP1MKo57aVFkd1DmE=";
+  cargoHash = "sha256-1FyDMdOO7m6y2oX/+VH5LxBwimz7fXM59eOeiffBnOI=";
 
   nativeBuildInputs = [
     pkg-config
@@ -40,6 +41,7 @@ rustPlatform.buildRustPackage {
     atk
     pango
     harfbuzz
+    gtk-layer-shell
   ];
 
   passthru.updateScript = nix-update-script { };
@@ -52,4 +54,4 @@ rustPlatform.buildRustPackage {
     mainProgram = "rumno";
     platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/ru/rustls-ffi/package.nix b/pkgs/by-name/ru/rustls-ffi/package.nix
index dd918af7ca30..71f69ebf2ec5 100644
--- a/pkgs/by-name/ru/rustls-ffi/package.nix
+++ b/pkgs/by-name/ru/rustls-ffi/package.nix
@@ -15,18 +15,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rustls-ffi";
-  version = "0.15.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "rustls";
     repo = "rustls-ffi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-m92kWH+J8wuGmI0msrp2aginY1K51iqgi3+u4ncmfts=";
+    hash = "sha256-mqC5uKkFIVVZW+7Z+8PF2lhx/6TVsKX4DW6oQuMMtDw=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-gqc6en59QQpD14hOgRuGEPWLvrkyGn9tPR9vQmRAxIg=";
+    hash = "sha256-ugU2tfG9VUvOhMeOQ4A+MBQIEw+bYb2dZllXrztQtrg=";
   };
 
   propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
@@ -62,6 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
     curl = curl.override {
       opensslSupport = false;
       rustlsSupport = true;
+      http3Support = false; # rustls-ffi doesn't yet support QUIC
       rustls-ffi = finalAttrs.finalPackage;
     };
     pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
@@ -76,6 +77,9 @@ stdenv.mkDerivation (finalAttrs: {
       asl20
       isc
     ];
-    maintainers = [ lib.maintainers.lesuisse ];
+    maintainers = [
+      lib.maintainers.lesuisse
+      lib.maintainers.cpu
+    ];
   };
 })
diff --git a/pkgs/by-name/sc/scilla/package.nix b/pkgs/by-name/sc/scilla/package.nix
index 6492f667281c..7fb3155ede79 100644
--- a/pkgs/by-name/sc/scilla/package.nix
+++ b/pkgs/by-name/sc/scilla/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "scilla";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchFromGitHub {
     owner = "edoardottt";
     repo = "scilla";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0aqcFtyi3cNiBelSTf8bwgxhErIDdXOI9c6FKT/Omlw=";
+    hash = "sha256-zeEsxmj1APc/vsKRTrdkVLJoILr6Gx9i0VSQ+dTLlGM=";
   };
 
-  vendorHash = "sha256-0DDBvoJiHXka90gvcyxnldJJWvb8dfBFwRjHJO4pFGA=";
+  vendorHash = "sha256-nI79Gx6Vs7wyqK9pCSbsFGmKBsqcmCNk2LpQ5fi79h4=";
 
   ldflags = [
     "-w"
diff --git a/pkgs/by-name/sc/scraper/package.nix b/pkgs/by-name/sc/scraper/package.nix
index 1e804244ecbf..c9d77ae81f19 100644
--- a/pkgs/by-name/sc/scraper/package.nix
+++ b/pkgs/by-name/sc/scraper/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "scraper";
-  version = "0.25.0";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "rust-scraper";
     repo = "scraper";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SGYusb+8MKz4vXjZZlM+bpmrshmts+FZLjR44DyHYqg=";
+    hash = "sha256-gdxE9vkN9y5KCmPF0IzSodgxKyWTzYHuLrIMFu4To1E=";
   };
 
-  cargoHash = "sha256-vbJMOVur2QE0rFo1OJkSsuNzTOzn22ty5Py3gozDEzs=";
+  cargoHash = "sha256-xpg5/ZZEUVNLHGJsbpb/m9TRUJS6wb2HOIoPt407+q0=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/se/search-vulns/package.nix b/pkgs/by-name/se/search-vulns/package.nix
index 774db2c8a271..d41fb867b0c2 100644
--- a/pkgs/by-name/se/search-vulns/package.nix
+++ b/pkgs/by-name/se/search-vulns/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "search-vulns";
-  version = "1.0.6";
+  version = "1.0.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ra1nb0rn";
     repo = "search_vulns";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0aqAjDJy+ShybYawUFyqKzz3yDut5n3t47lCEksykEU=";
+    hash = "sha256-VxNaG9ljx/z2KNlRJaNFxc42wNMRFRtRqAQR4PhAjSE=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/sp/spacectl/package.nix b/pkgs/by-name/sp/spacectl/package.nix
index 57ac3c873173..2d0f7ec56d78 100644
--- a/pkgs/by-name/sp/spacectl/package.nix
+++ b/pkgs/by-name/sp/spacectl/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "spacectl";
-  version = "1.19.0";
+  version = "1.20.1";
 
   src = fetchFromGitHub {
     owner = "spacelift-io";
     repo = "spacectl";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-wRtS09cXtthjxt3Uo0niEAb1Xx2A9gXQZDnKKjEjpZc=";
+    hash = "sha256-/eetv0AS5fdeYRoOEWhKL31Nud18w3rdx33ce/70SYs=";
   };
 
-  vendorHash = "sha256-TSsb/xoetPUyQwpwJBhTK+FtjTnAXR6WBi9GqmNFsWo=";
+  vendorHash = "sha256-d3GO1P2miqDLlnonjGl+OSy+AQbQIIBfEw4Nkroqnrc=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ti/tinymist/package.nix b/pkgs/by-name/ti/tinymist/package.nix
index 253152da0bfb..68d3650ab145 100644
--- a/pkgs/by-name/ti/tinymist/package.nix
+++ b/pkgs/by-name/ti/tinymist/package.nix
@@ -15,16 +15,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tinymist";
   # Please update the corresponding vscode extension when updating
   # this derivation.
-  version = "0.14.10";
+  version = "0.14.12";
 
   src = fetchFromGitHub {
     owner = "Myriad-Dreamin";
     repo = "tinymist";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TDzna8ohzeZO9/baO8RbRrchVuqNFfirxTteXLDLH4g=";
+    hash = "sha256-mhg6gLGOuM97W7Jcx8hr53cry/q2/A3x5JuyOMtqvEU=";
   };
 
-  cargoHash = "sha256-gO0tnHeARixYnkiy6PrD+dzVGEdrEW7kPsmo0Y4YYnY=";
+  cargoHash = "sha256-lLJvJzm6e/JmO2OTLVDjAvTbGezv81jD7fc8FbUqKKM=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/ts/tscli/package.nix b/pkgs/by-name/ts/tscli/package.nix
index e0a93e1cbce3..83e8634babe2 100644
--- a/pkgs/by-name/ts/tscli/package.nix
+++ b/pkgs/by-name/ts/tscli/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "tscli";
-  version = "0.0.15";
+  version = "0.1.0";
 
   src = fetchFromGitHub {
     owner = "jaxxstorm";
     repo = "tscli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RsWpZYRb/6ZpOio5te7qokGJeTlSmu/MH+BVoQVbkNw=";
+    hash = "sha256-/MHFPFm9+DFh6pmIXbm3wXUCbjyJUDaESpDbvqbyTx8=";
   };
 
-  vendorHash = "sha256-RELJJN2ldcUkbyskitg1y6vakdQ6mRkmT7Y25TS2sz8=";
+  vendorHash = "sha256-meG/BYuMDBtENIty8I2koTrqGmRtW5BzlEvNOkf5qlE=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/vi/vikunja-desktop/package.nix b/pkgs/by-name/vi/vikunja-desktop/package.nix
index 658e44a14d11..7bc7ddba29ac 100644
--- a/pkgs/by-name/vi/vikunja-desktop/package.nix
+++ b/pkgs/by-name/vi/vikunja-desktop/package.nix
@@ -15,12 +15,12 @@
 
 let
   executableName = "vikunja-desktop";
-  version = "2.1.0";
+  version = "2.2.0";
   src = fetchFromGitHub {
     owner = "go-vikunja";
     repo = "vikunja";
     rev = "v${version}";
-    hash = "sha256-R9PNhH5s3W9c1qHYmV9H5CkBvUtUFU+yzF+eEU2ybdo=";
+    hash = "sha256-QmFuPKbhPX+pgUPmeUglmg2OvqBRpeeA9Xz0l1tscfM=";
   };
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     pnpm = pnpm_10_29_2;
     fetcherVersion = 1;
-    hash = "sha256-yiVlEr1gi2g3m+hkYfDv6qd/wRlwwknM6lAaIeR58Ok=";
+    hash = "sha256-4+r+1Yi3BS7LHFIY4VOGMhG2RW/KcTy67oqkfXiMW7k=";
   };
 
   env = {
diff --git a/pkgs/by-name/vi/vikunja/package.nix b/pkgs/by-name/vi/vikunja/package.nix
index d66f71f8c894..d8eb22590011 100644
--- a/pkgs/by-name/vi/vikunja/package.nix
+++ b/pkgs/by-name/vi/vikunja/package.nix
@@ -14,12 +14,12 @@
 }:
 
 let
-  version = "2.1.0";
+  version = "2.2.0";
   src = fetchFromGitHub {
     owner = "go-vikunja";
     repo = "vikunja";
     rev = "v${version}";
-    hash = "sha256-R9PNhH5s3W9c1qHYmV9H5CkBvUtUFU+yzF+eEU2ybdo=";
+    hash = "sha256-QmFuPKbhPX+pgUPmeUglmg2OvqBRpeeA9Xz0l1tscfM=";
   };
 
   frontend = stdenv.mkDerivation (finalAttrs: {
@@ -37,7 +37,7 @@ let
         ;
       pnpm = pnpm_10_29_2;
       fetcherVersion = 1;
-      hash = "sha256-oY8DXJFFwLBjUno3EithLhmnA8hTksq4xgMSSOGtwuo=";
+      hash = "sha256-j84UVbLIqPz56Djy0vafhAOn9ZFM+kuTcBhfYZBYEDI=";
     };
 
     nativeBuildInputs = [
@@ -97,7 +97,7 @@ buildGoModule {
       mage
     ];
 
-  vendorHash = "sha256-VLy5yybeueVEjb9SijYPQnXoTz7lxBksHTzBxt+TdG4=";
+  vendorHash = "sha256-yRSrsVbIEav+ye7wTehIzEh5/YqfOZpIqx2xFCpTfDo=";
 
   inherit frontend;
 
diff --git a/pkgs/by-name/wi/wiki-go/package.nix b/pkgs/by-name/wi/wiki-go/package.nix
index 756c21dcb0ab..4278ed0d2b8b 100644
--- a/pkgs/by-name/wi/wiki-go/package.nix
+++ b/pkgs/by-name/wi/wiki-go/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "wiki-go";
-  version = "1.8.5";
+  version = "1.8.7";
 
   src = fetchFromGitHub {
     owner = "leomoon-studios";
     repo = "wiki-go";
     tag = "v${version}";
-    hash = "sha256-6GgX2wEaQvW5ccayavbQ4FV3yQKUdcsbUfmLrO4Jxng=";
+    hash = "sha256-5Swnr/V/lfXxF1tGhmq2mo+ZDmob9nLOS5pAYY58G/E=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/wo/worktrunk/package.nix b/pkgs/by-name/wo/worktrunk/package.nix
index 1a8256b9225e..8e637729861f 100644
--- a/pkgs/by-name/wo/worktrunk/package.nix
+++ b/pkgs/by-name/wo/worktrunk/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "worktrunk";
-  version = "0.30.0";
+  version = "0.30.1";
 
   src = fetchFromGitHub {
     owner = "max-sixty";
     repo = "worktrunk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-563tEowYm8mKxA+OnjjcsCCheHLjqNEL/vRsi/g26/Q=";
+    hash = "sha256-D/S2KBa3fmgUO8x1HubOIti/oXGEXDkto03+PFrtH/Q=";
   };
 
-  cargoHash = "sha256-wmFdKutNzo+2ddvadVdIFBmHGrbb+oJ/Nzmw2H6D1VY=";
+  cargoHash = "sha256-UDpYUgrhw/raDnVVW3rT35/Iae5eVcnCWMX59of1htg=";
 
   cargoBuildFlags = [ "--package=worktrunk" ];
 
@@ -74,6 +74,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ];
     platforms = lib.platforms.unix;
     mainProgram = "wt";
-    maintainers = with lib.maintainers; [ siriobalmelli ];
+    maintainers = with lib.maintainers; [
+      siriobalmelli
+      DuskyElf
+    ];
   };
 })
diff --git a/pkgs/by-name/ya/yaralyzer/package.nix b/pkgs/by-name/ya/yaralyzer/package.nix
index c639e50791ec..89aecdff8c00 100644
--- a/pkgs/by-name/ya/yaralyzer/package.nix
+++ b/pkgs/by-name/ya/yaralyzer/package.nix
@@ -27,6 +27,8 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     yara-python
   ];
 
+  pythonRelaxDeps = [ "rich" ];
+
   pythonImportsCheck = [ "yaralyzer" ];
 
   passthru = {
diff --git a/pkgs/development/interpreters/python/cpython/3.14/hacl-static-ldeps-for-static-modules.patch b/pkgs/development/interpreters/python/cpython/3.14/hacl-static-ldeps-for-static-modules.patch
new file mode 100644
index 000000000000..8501ab38a940
--- /dev/null
+++ b/pkgs/development/interpreters/python/cpython/3.14/hacl-static-ldeps-for-static-modules.patch
@@ -0,0 +1,50 @@
+From ee1b8479cff97ca7e5ed4d51d6aa24ccb47deb8b Mon Sep 17 00:00:00 2001
+From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
+Date: Sat, 21 Mar 2026 18:34:50 -0400
+Subject: [PATCH] gh-146264: Use static HACL deps for static module builds
+
+---
+ .../next/Build/2026-03-21-18-51-31.gh-issue-146264.Q9Ej4m.rst  | 3 +++
+ configure                                                      | 2 +-
+ configure.ac                                                   | 2 +-
+ 3 files changed, 5 insertions(+), 2 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Build/2026-03-21-18-51-31.gh-issue-146264.Q9Ej4m.rst
+
+diff --git a/Misc/NEWS.d/next/Build/2026-03-21-18-51-31.gh-issue-146264.Q9Ej4m.rst b/Misc/NEWS.d/next/Build/2026-03-21-18-51-31.gh-issue-146264.Q9Ej4m.rst
+new file mode 100644
+index 00000000000..1fdafe56043
+--- /dev/null
++++ b/Misc/NEWS.d/next/Build/2026-03-21-18-51-31.gh-issue-146264.Q9Ej4m.rst
+@@ -0,0 +1,3 @@
++Fix static module builds on non-WASI targets by linking HACL dependencies as
++static libraries when ``MODULE_BUILDTYPE=static``, preventing duplicate
++``_Py_LibHacl_*`` symbol errors at link time.
+diff --git a/configure b/configure
+index 23f24d51c79..db5c861f601 100755
+--- a/configure
++++ b/configure
+@@ -33009,7 +33009,7 @@ fi
+ 
+ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for HACL* library linking type" >&5
+ printf %s "checking for HACL* library linking type... " >&6; }
+-if test "$ac_sys_system" = "WASI"; then
++if test "$ac_sys_system" = "WASI" || test "$MODULE_BUILDTYPE" = "static"; then
+   LIBHACL_LDEPS_LIBTYPE=STATIC
+   { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: static" >&5
+ printf "%s\n" "static" >&6; }
+diff --git a/configure.ac b/configure.ac
+index 635fce3f2e6..59166d63e63 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -8171,7 +8171,7 @@ AC_SUBST([LIBHACL_BLAKE2_SIMD256_OBJS])
+ # HACL*-based cryptographic primitives
+ 
+ AC_MSG_CHECKING([for HACL* library linking type])
+-if test "$ac_sys_system" = "WASI"; then
++if test "$ac_sys_system" = "WASI" || test "$MODULE_BUILDTYPE" = "static"; then
+   LIBHACL_LDEPS_LIBTYPE=STATIC
+   AC_MSG_RESULT([static])
+ else
+-- 
+2.53.0
+
diff --git a/pkgs/development/interpreters/python/cpython/default.nix b/pkgs/development/interpreters/python/cpython/default.nix
index e674de90810f..62a699d02483 100644
--- a/pkgs/development/interpreters/python/cpython/default.nix
+++ b/pkgs/development/interpreters/python/cpython/default.nix
@@ -427,6 +427,11 @@ stdenv.mkDerivation (finalAttrs: {
     # backport fix for https://github.com/python/cpython/issues/95855
     ./platform-triplet-detection.patch
   ]
+  ++ optionals (static && pythonAtLeast "3.14") [
+    # https://github.com/python/cpython/issues/146264
+    # https://github.com/python/cpython/pull/146265
+    ./3.14/hacl-static-ldeps-for-static-modules.patch
+  ]
   ++ optionals (version == "3.13.10" || version == "3.14.1") [
     # https://github.com/python/cpython/issues/142218
     ./${lib.versions.majorMinor version}/gh-142218.patch
diff --git a/pkgs/development/python-modules/alexapy/default.nix b/pkgs/development/python-modules/alexapy/default.nix
index 658b6408cded..ce05225398b8 100644
--- a/pkgs/development/python-modules/alexapy/default.nix
+++ b/pkgs/development/python-modules/alexapy/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "alexapy";
-  version = "1.29.19";
+  version = "1.29.20";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "keatontaylor";
     repo = "alexapy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1PFHIVtFaaYRyOgzqxMCbvbSECK+9T7EuRlQ9CWuv5Y=";
+    hash = "sha256-CHr1R2zqDlIrN3CN8d0iahi3Ytp0JlVsHY+My5t8WoA=";
   };
 
   pythonRelaxDeps = [ "aiofiles" ];
diff --git a/pkgs/development/python-modules/arviz-base/default.nix b/pkgs/development/python-modules/arviz-base/default.nix
index 5ff4601940eb..2b673f93e9cb 100644
--- a/pkgs/development/python-modules/arviz-base/default.nix
+++ b/pkgs/development/python-modules/arviz-base/default.nix
@@ -12,25 +12,8 @@
   xarray,
 
   # optional-dependencies
-  black,
-  build,
-  isort,
-  mypy,
-  pre-commit,
-  cloudpickle,
   h5netcdf,
-  jupyter-sphinx,
-  myst-nb,
-  myst-parser,
-  numpydoc,
-  sphinx,
-  sphinx-book-theme,
-  sphinx-copybutton,
-  sphinx-design,
   netcdf4,
-  pytest,
-  pytest-cov,
-  scipy,
   zarr,
 
   # tests
@@ -61,41 +44,12 @@ buildPythonPackage (finalAttrs: {
   ];
 
   optional-dependencies = {
-    check = [
-      black
-      build
-      # docstub
-      isort
-      mypy
-      pre-commit
-    ];
-    ci = [
-      cloudpickle
-      pre-commit
-    ];
-    doc = [
-      h5netcdf
-      jupyter-sphinx
-      myst-nb
-      myst-parser
-      numpydoc
-      sphinx
-      sphinx-book-theme
-      sphinx-copybutton
-      sphinx-design
-    ];
     h5netcdf = [
       h5netcdf
     ];
     netcdf4 = [
       netcdf4
     ];
-    test = [
-      pytest
-      pytest-cov
-      scipy
-      xarray
-    ];
     zarr = [
       zarr
     ];
diff --git a/pkgs/development/python-modules/asyncstdlib/default.nix b/pkgs/development/python-modules/asyncstdlib/default.nix
index c295a4e1592c..80229f92cf5f 100644
--- a/pkgs/development/python-modules/asyncstdlib/default.nix
+++ b/pkgs/development/python-modules/asyncstdlib/default.nix
@@ -4,23 +4,19 @@
   fetchFromGitHub,
   flit-core,
   pytestCheckHook,
-  pythonAtLeast,
   typing-extensions,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "asyncstdlib";
-  version = "3.13.3";
+  version = "3.14.0";
   pyproject = true;
 
-  # https://github.com/maxfischer2781/asyncstdlib/issues/189
-  disabled = pythonAtLeast "3.14";
-
   src = fetchFromGitHub {
     owner = "maxfischer2781";
     repo = "asyncstdlib";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3mM97zB/pEw8/kPO6jUL7dz6Q7kVatfsURy+5zSq9Bs=";
+    hash = "sha256-zp6F+Otb1d8kqdLO99shBA7ny7Zjq027T2dtTGHTcqI=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/python-modules/busylight-core/default.nix b/pkgs/development/python-modules/busylight-core/default.nix
index 8f312fd3b540..f6c0add36894 100644
--- a/pkgs/development/python-modules/busylight-core/default.nix
+++ b/pkgs/development/python-modules/busylight-core/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "busylight-core";
-  version = "0.15.3";
+  version = "2.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "JnyJny";
     repo = "busylight-core";
     tag = "v${version}";
-    hash = "sha256-4T6FARygtHzY1diLbOcl812pyw5qloV4bNVe1Oj2pHY=";
+    hash = "sha256-BJJkuArs7zRvnxVykcMzc/K+MC9r/NYy3wUfAUxrnNE=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/crewai/default.nix b/pkgs/development/python-modules/crewai/default.nix
index 589d044cc415..52031bac1414 100644
--- a/pkgs/development/python-modules/crewai/default.nix
+++ b/pkgs/development/python-modules/crewai/default.nix
@@ -54,14 +54,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "crewai";
-  version = "1.10.0";
+  version = "1.11.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "crewAIInc";
     repo = "crewAI";
     tag = finalAttrs.version;
-    hash = "sha256-oHDGn77rmjKKH4t+5xSy+r6m/GaI+q6RDwrTpWfIrxs=";
+    hash = "sha256-i2UBgni0XRRBijidLVvSDUljnXwgGy52L8bc5WJkV64=";
   };
 
   postPatch = ''
@@ -201,7 +201,10 @@ buildPythonPackage (finalAttrs: {
     "test_agent_execute_task_with_context"
     "test_agent_execute_task_with_custom_llm"
     "test_agent_execute_task_with_ollama"
+    "test_agent_execute_task_with_planning"
+    "test_agent_execute_task_with_planning_refine"
     "test_agent_execute_task_with_tool"
+    "test_agent_execute_task_without_planning"
     "test_agent_execution"
     "test_agent_execution_with_specific_tools"
     "test_agent_execution_with_tools"
@@ -209,6 +212,12 @@ buildPythonPackage (finalAttrs: {
     "test_agent_from_repository_override_attributes"
     "test_agent_from_repository_with_invalid_tools"
     "test_agent_function_calling_llm"
+    "test_agent_kickoff_multi_step_task_with_planning"
+    "test_agent_kickoff_with_planning"
+    "test_agent_kickoff_with_planning_disabled"
+    "test_agent_kickoff_with_planning_stores_plan_in_state"
+    "test_agent_kickoff_without_planning"
+    "test_agent_kickoff_without_planning_skips_plan_generation"
     "test_agent_knowledege_with_crewai_knowledge"
     "test_agent_moved_on_after_max_iterations"
     "test_agent_powered_by_new_o_model_family_that_allows_skipping_tool"
@@ -231,16 +240,25 @@ buildPythonPackage (finalAttrs: {
     "test_disabling_cache_for_agent"
     "test_do_not_allow_crewai_trigger_context_for_first_task_hierarchical"
     "test_ensure_first_task_allow_crewai_trigger_context_is_false_does_not_inject"
+    "test_executor_state_contains_plan_after_planning"
     "test_first_task_auto_inject_trigger"
     "test_first_time_user_trace_collection_user_accepts"
     "test_first_time_user_trace_collection_with_timeout"
     "test_first_time_user_trace_consolidation_logic"
     "test_get_knowledge_search_query"
     "test_handle_context_length_exceeds_limit_cli_no"
+    "test_kickoff_no_response_format_returns_raw_text"
+    "test_kickoff_response_format_with_planning_and_tools"
+    "test_kickoff_response_format_without_planning"
     "test_llm_call"
     "test_llm_call_with_all_attributes"
     "test_llm_call_with_ollama_llama3"
     "test_logging_tool_usage"
+    "test_planning_creates_minimal_steps_for_multi_step_task"
+    "test_planning_disabled_skips_planning"
+    "test_planning_handles_sequential_dependency_task"
+    "test_reasoning_effort_high_runs_full_observation_pipeline"
+    "test_reasoning_effort_low_skips_decide_and_replan"
     "test_task_allow_crewai_trigger_context"
     "test_task_allow_crewai_trigger_context_no_payload"
     "test_task_without_allow_crewai_trigger_context"
@@ -268,6 +286,8 @@ buildPythonPackage (finalAttrs: {
     "test_docling_source"
     "test_multiple_docling_sources"
     "test_excel_knowledge_source"
+    # azure-ai-inference
+    "test_azure_research_workflow_generates_steps"
 
     # Test telemetry
     "test_telemetry_fails_due_connect_timeout"
@@ -324,24 +344,27 @@ buildPythonPackage (finalAttrs: {
     "test_create_crew"
 
     # Tests LLM - require API keys
-    "test_llm_callback_replacement"
+    "test_anthropic_research_workflow_generates_steps"
     "test_gemini_models"
-    "test_llm_call_with_message_list"
-    "test_gpt_4_1"
-    "test_o3_mini_reasoning_effort_low"
-    "test_handle_streaming_tool_calls"
-    "test_llm_call_with_string_input"
-    "test_llm_call_with_tool_and_string_input"
-    "test_llm_call_with_string_input_and_callbacks"
-    "test_llm_call_when_stop_is_unsupported"
-    "test_handle_streaming_tool_calls_with_error"
-    "test_o3_mini_reasoning_effort_medium"
-    "test_llm_call_with_tool_and_message_list"
+    "test_gemini_research_workflow_generates_steps"
     "test_gemma3"
-    "test_llm_call_when_stop_is_unsupported_when_additional_drop_params_is_provided"
-    "test_o3_mini_reasoning_effort_high"
+    "test_gpt_4_1"
+    "test_handle_streaming_tool_calls"
     "test_handle_streaming_tool_calls_no_available_functions"
     "test_handle_streaming_tool_calls_no_tools"
+    "test_handle_streaming_tool_calls_with_error"
+    "test_llm_call_when_stop_is_unsupported"
+    "test_llm_call_when_stop_is_unsupported_when_additional_drop_params_is_provided"
+    "test_llm_call_with_message_list"
+    "test_llm_call_with_string_input"
+    "test_llm_call_with_string_input_and_callbacks"
+    "test_llm_call_with_tool_and_message_list"
+    "test_llm_call_with_tool_and_string_input"
+    "test_llm_callback_replacement"
+    "test_o3_mini_reasoning_effort_high"
+    "test_o3_mini_reasoning_effort_low"
+    "test_o3_mini_reasoning_effort_medium"
+    "test_openai_research_workflow_generates_steps"
 
     # Test main - require git
     "test_publish_when_not_in_sync"
diff --git a/pkgs/development/python-modules/etelemetry/default.nix b/pkgs/development/python-modules/etelemetry/default.nix
index 533f1508a45a..a6fa4ebc6c22 100644
--- a/pkgs/development/python-modules/etelemetry/default.nix
+++ b/pkgs/development/python-modules/etelemetry/default.nix
@@ -21,9 +21,15 @@ buildPythonPackage rec {
     hash = "sha256-UaE5JQhv2AtzXKY7YD2/g6Kj1igKhmnY3zlf1P9B/iQ=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  postPatch = ''
+    substituteInPlace setup.py --replace-fail "versioneer.get_version()" "'${version}'"
+  '';
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
     ci-info
     ci-py
     requests
diff --git a/pkgs/development/python-modules/homepluscontrol/default.nix b/pkgs/development/python-modules/homepluscontrol/default.nix
deleted file mode 100644
index ee2b437d502b..000000000000
--- a/pkgs/development/python-modules/homepluscontrol/default.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{
-  lib,
-  aiohttp,
-  aioresponses,
-  buildPythonPackage,
-  fetchFromGitHub,
-  pyjwt,
-  pytestCheckHook,
-  yarl,
-}:
-
-buildPythonPackage rec {
-  pname = "homepluscontrol";
-  version = "0.1";
-  format = "setuptools";
-
-  src = fetchFromGitHub {
-    owner = "chemaaa";
-    repo = "homepluscontrol";
-    rev = version;
-    hash = "sha256-COOGqfYiR4tueQHXuCvVxShrYS0XNltcW4mclbFWcfA=";
-  };
-
-  propagatedBuildInputs = [
-    aiohttp
-    pyjwt
-    yarl
-  ];
-
-  nativeCheckInputs = [
-    aioresponses
-    pytestCheckHook
-  ];
-
-  pythonImportsCheck = [ "homepluscontrol" ];
-
-  meta = {
-    description = "Python API to interact with the Legrand Eliot Home and Control";
-    homepage = "https://github.com/chemaaa/homepluscontrol";
-    license = with lib.licenses; [ gpl3Only ];
-    maintainers = with lib.maintainers; [ fab ];
-  };
-}
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 7f506dfc763c..0a9a628f4657 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202603201";
+  version = "0.1.202603211";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fKyOrDBwHMPMibzS7R75kslvuVolyYnIh8e1+7VP2eA=";
+    hash = "sha256-WY4UC7mLp4zuUiYBmN/6rrcWywo0/A0udjiSFc/19IY=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/mitmproxy-linux/default.nix b/pkgs/development/python-modules/mitmproxy-linux/default.nix
index 342ef131b55b..085f9cdbf645 100644
--- a/pkgs/development/python-modules/mitmproxy-linux/default.nix
+++ b/pkgs/development/python-modules/mitmproxy-linux/default.nix
@@ -12,7 +12,7 @@ buildPythonPackage {
   pyproject = true;
 
   postPatch = ''
-    substituteInPlace ../mitmproxy-rs-*-vendor/aya-build-*/src/lib.rs \
+    substituteInPlace ../mitmproxy-rs-*-vendor/*/aya-build-*/src/lib.rs \
       --replace-fail '"+nightly",' "" \
       --replace-fail '"-Z",' "" \
       --replace-fail '"build-std=core",' ""
diff --git a/pkgs/development/python-modules/nipype/default.nix b/pkgs/development/python-modules/nipype/default.nix
index 0552ca8896e6..21659531a6f3 100644
--- a/pkgs/development/python-modules/nipype/default.nix
+++ b/pkgs/development/python-modules/nipype/default.nix
@@ -3,95 +3,120 @@
   stdenv,
   buildPythonPackage,
   fetchPypi,
+
+  # build-system
+  hatchling,
+  hatch-vcs,
+
   # python dependencies
+  acres,
   click,
   python-dateutil,
   etelemetry,
   filelock,
   looseversion,
-  mock,
+  lxml,
   networkx,
   nibabel,
   numpy,
   packaging,
   prov,
-  psutil,
   puremagic,
   pybids,
   pydot,
-  pytest,
+  pytestCheckHook,
   pytest-xdist,
-  pytest-forked,
+  pytest-cov-stub,
   rdflib,
   scipy,
   simplejson,
   traits,
+
+  # optional-dependencies
+  datalad,
+  duecredit,
+  pandas,
+  paramiko,
+  psutil,
+  sphinx,
   xvfbwrapper,
+
   # other dependencies
   which,
   bash,
   glibcLocales,
-  # causes Python packaging conflict with any package requiring rdflib,
-  # so use the unpatched rdflib by default (disables Nipype provenance tracking);
-  # see https://github.com/nipy/nipype/issues/2888:
-  useNeurdflib ? false,
 }:
 
 buildPythonPackage rec {
   pname = "nipype";
-  version = "1.10.0";
-  format = "setuptools";
+  version = "1.11.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-GeXWzvpwmXGY94vGZe9NPTy1MyW1uYpy5Rrvra9rPg4=";
+    hash = "sha256-ZwfsTDz44Zg673+O6nlifue3q0qklkmZFVDhKcFlt6c=";
   };
 
   postPatch = ''
     substituteInPlace nipype/interfaces/base/tests/test_core.py \
       --replace-fail "/usr/bin/env bash" "${bash}/bin/bash"
+    substituteInPlace nipype/pipeline/engine/tests/test_nodes.py \
+      --replace-fail "/bin/bash" "${bash}/bin/bash"
   '';
 
-  pythonRelaxDeps = [ "traits" ];
+  build-system = [
+    hatchling
+    hatch-vcs
+  ];
 
   dependencies = [
+    acres
     click
-    python-dateutil
     etelemetry
     filelock
     looseversion
+    lxml
     networkx
     nibabel
     numpy
     packaging
     prov
-    psutil
     puremagic
     pydot
+    python-dateutil
     rdflib
     scipy
     simplejson
     traits
-    xvfbwrapper
   ];
 
+  passthru.optional-dependencies = {
+    data = [ datalad ];
+    duecredit = [ duecredit ];
+    profiler = [ psutil ];
+    pybids = [ pybids ];
+    ssh = [ paramiko ];
+    xvfbwrapper = [ xvfbwrapper ];
+  };
+
   nativeCheckInputs = [
-    pybids
     glibcLocales
-    mock
-    pytest
-    pytest-forked
+    pandas
+    pytestCheckHook
+    pytest-cov-stub
     pytest-xdist
+    sphinx
     which
   ];
 
   # checks on darwin inspect memory which doesn't work in build environment
   doCheck = !stdenv.hostPlatform.isDarwin;
-  # ignore tests which incorrect fail to detect xvfb
-  checkPhase = ''
-    pytest nipype/tests -k 'not display and not test_no_et_multiproc'
-  '';
-  pythonImportsCheck = [ "nipype" ];
+
+  pythonImportsCheck = [
+    "nipype"
+    "nipype.algorithms"
+    "nipype.interfaces"
+  ];
 
   meta = {
     homepage = "https://nipy.org/nipype";
diff --git a/pkgs/development/python-modules/pygls/default.nix b/pkgs/development/python-modules/pygls/default.nix
index 400c7c5e7f89..76608ac9ee88 100644
--- a/pkgs/development/python-modules/pygls/default.nix
+++ b/pkgs/development/python-modules/pygls/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "pygls";
-  version = "2.0.1";
+  version = "2.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "openlawlibrary";
     repo = "pygls";
     tag = "v${version}";
-    hash = "sha256-RznpnGBOZZeNP1pqL9jSNd0W2sJmW0CAo8DKP6t9APw=";
+    hash = "sha256-VXLPtZDbTs59DRvrB9xv1EJshV02K+7983BHR7QKTaE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pysmarlaapi/default.nix b/pkgs/development/python-modules/pysmarlaapi/default.nix
index 72ba440eebe1..d5745c1bb9b7 100644
--- a/pkgs/development/python-modules/pysmarlaapi/default.nix
+++ b/pkgs/development/python-modules/pysmarlaapi/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pysmarlaapi";
-  version = "1.0.1";
+  version = "1.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Explicatis-GmbH";
     repo = "pysmarlaapi";
     tag = version;
-    hash = "sha256-mDcBIRs2tJ5BWNQY/G4qN/nBrnKqz9PsW+teNYut9Pc=";
+    hash = "sha256-teRdxYe9thM22tZ09FHxOxxzy4gcfJBAylgpk34ISTk=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/python-modules/scapy/default.nix b/pkgs/development/python-modules/scapy/default.nix
index 18bcd842b60e..942f5f584fe7 100644
--- a/pkgs/development/python-modules/scapy/default.nix
+++ b/pkgs/development/python-modules/scapy/default.nix
@@ -34,11 +34,12 @@ buildPythonPackage rec {
     hash = "sha256-Pp7pPfaWyzJGf+soENfOPynN8logc5FM848hyVCcdKk=";
   };
 
-  patches = [ ./find-library.patch ];
+  patches = lib.optional (!stdenv.hostPlatform.isStatic) ./find-library.patch;
 
   postPatch = ''
     printf "${version}" > scapy/VERSION
-
+  ''
+  + lib.optionalString (!stdenv.hostPlatform.isStatic) ''
     libpcap_file="${lib.getLib libpcap}/lib/libpcap${stdenv.hostPlatform.extensions.sharedLibrary}"
     if ! [ -e "$libpcap_file" ]; then
         echo "error: $libpcap_file not found" >&2
diff --git a/pkgs/development/python-modules/uploadserver/default.nix b/pkgs/development/python-modules/uploadserver/default.nix
new file mode 100644
index 000000000000..6b769cfc9cc8
--- /dev/null
+++ b/pkgs/development/python-modules/uploadserver/default.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  setuptools,
+  urllib3,
+  requests,
+  curl,
+}:
+buildPythonPackage (finalAttrs: {
+  pname = "uploadserver";
+  version = "6.0.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "Densaugeo";
+    repo = "uploadserver";
+    tag = finalAttrs.version;
+    hash = "sha256-3obQZF9dY9rRVpeU4362o3ZC95hQtXFhxSNryxPAoLM=";
+  };
+
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    urllib3
+    requests
+    curl
+  ];
+
+  env.VERBOSE = 0;
+  env.PROTOCOL = "HTTP";
+  enabledTestPaths = [ "test.py" ];
+
+  pythonImportsCheck = [ "uploadserver" ];
+
+  meta = {
+    description = "Python's http.server extended to include a file upload page";
+    homepage = "https://github.com/Densaugeo/uploadserver";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.gigamonster256 ];
+    mainProgram = "uploadserver";
+  };
+})
diff --git a/pkgs/servers/web-apps/wordpress/default.nix b/pkgs/servers/web-apps/wordpress/default.nix
index 86f26b4f6de7..7c75e9b90816 100644
--- a/pkgs/servers/web-apps/wordpress/default.nix
+++ b/pkgs/servers/web-apps/wordpress/default.nix
@@ -2,15 +2,15 @@
 builtins.mapAttrs (_: callPackage ./generic.nix) rec {
   wordpress = wordpress_6_9;
   wordpress_6_7 = {
-    version = "6.7.3";
-    hash = "sha256-zWLpZ/NKla1u4CHh2Bu0P7UmFWvnuTUheRq6Bq5NZjU=";
+    version = "6.7.5";
+    hash = "sha256-IS9B6kwjWLYLybmWG2Ym5+JAgFExMqhcEQsJJF2puXg=";
   };
   wordpress_6_8 = {
-    version = "6.8.3";
-    hash = "sha256-kto0yZYOZNElhlLB73PFF/fkasbf0t/HVDbThVr0aww=";
+    version = "6.8.5";
+    hash = "sha256-N/WVUQxI0W3t4L+lr6KcuK8S2/Dj00WyXElMFfjIHYE=";
   };
   wordpress_6_9 = {
-    version = "6.9.1";
-    hash = "sha256-hchDaZiHDkKjmudViwltGdKUoM0q23yH7nZNuXOwGVM=";
+    version = "6.9.4";
+    hash = "sha256-22EK2fVJ4Ku1rz49XGcpxY2HRDllTN8K/qQlsuqJXzU=";
   };
 }
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index d9d1dd335ef6..9d6d8c94d790 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -243,6 +243,7 @@ mapAliases {
   hijri-converter = hijridate; # added 2025-08-07
   holistic-trace-analysis = throw "'holistic-trace-analysis' was removed because there is no such package on PyPI"; # added 2026-02-28
   homeassistant-bring-api = throw "'homeassistant-bring-api' has been renamed to/replaced by 'bring-api'"; # Converted to throw 2025-10-29
+  homepluscontrol = throw "'homepluscontrol' has been removed as it was unmaintained upstream"; # Added 2026-03-22
   HTSeq = throw "'HTSeq' has been renamed to/replaced by 'htseq'"; # Converted to throw 2025-10-29
   IMAPClient = throw "'IMAPClient' has been renamed to/replaced by 'imapclient'"; # Converted to throw 2025-10-29
   inlinestyler = throw "inlinestyler has been removed because it is no longer maintained"; # added 2025-08-09
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index fcf19791ac15..7441c4aa8e3f 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7108,8 +7108,6 @@ self: super: with self; {
 
   homematicip = callPackage ../development/python-modules/homematicip { };
 
-  homepluscontrol = callPackage ../development/python-modules/homepluscontrol { };
-
   homf = callPackage ../development/python-modules/homf { };
 
   hoomd-blue = callPackage ../development/python-modules/hoomd-blue { };
@@ -20517,6 +20515,8 @@ self: super: with self; {
 
   uplink-protobuf = callPackage ../development/python-modules/uplink-protobuf { };
 
+  uploadserver = callPackage ../development/python-modules/uploadserver { };
+
   upnpy = callPackage ../development/python-modules/upnpy { };
 
   uproot = callPackage ../development/python-modules/uproot { };