diff --git a/ci/OWNERS b/ci/OWNERS
index cf158b7b9154..dbe5e829bb59 100644
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -377,8 +377,8 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 # VimPlugins
 /pkgs/applications/editors/vim/plugins         @NixOS/neovim
 ## nvim-treesitter
-/pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix @figsoda
-/pkgs/applications/editors/vim/plugins/utils/nvim-treesitter         @figsoda
+/pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix @NixOS/neovim @figsoda
+/pkgs/applications/editors/vim/plugins/utils/nvim-treesitter         @NixOS/neovim @figsoda
 
 # VsCode Extensions
 /pkgs/applications/editors/vscode/extensions
diff --git a/ci/github-script/get-pr-commit-details.js b/ci/github-script/get-pr-commit-details.js
index fcccfeacd75e..b268e7cf6202 100644
--- a/ci/github-script/get-pr-commit-details.js
+++ b/ci/github-script/get-pr-commit-details.js
@@ -2,6 +2,17 @@
 const { promisify } = require('node:util')
 const execFile = promisify(require('node:child_process').execFile)
 
+/**
+ * @typedef {{
+ *  subject: string,
+ *  sha: string,
+ *  author: { name: string, email: string },
+ *  committer: { name: string, email: string}
+ *  changedPaths: string[],
+ *  changedPathSegments: Set<string>,
+ * }} Commit
+ */
+
 /**
  * @param {{
  *  args: string[]
@@ -34,12 +45,7 @@ async function runGit({ args, repoPath, core, quiet }) {
  *  repoPath?: string,
  * }} GetCommitMessagesForPRProps
  *
- * @returns {Promise<{
- *  subject: string,
- *  sha: string,
- *  changedPaths: string[],
- *  changedPathSegments: Set<string>,
- * }[]>}
+ * @returns {Promise<Commit[]>}
  */
 async function getCommitDetailsForPR({ core, pr, repoPath }) {
   await runGit({
@@ -70,17 +76,25 @@ async function getCommitDetailsForPR({ core, pr, repoPath }) {
 
   return Promise.all(
     shas.map(async (sha) => {
-      // Subject first, then a blank line, then filenames.
+      // Subject, author name, author email, committer name, committer email (all tab-seperated)
+      // then a blank line, then filenames.
       const result = (
         await runGit({
-          args: ['log', '--format=%s', '--name-only', '-1', sha],
+          args: [
+            'log',
+            '--format=%s\t%aN\t%aE\t%cN\t%cE',
+            '--name-only',
+            '-1',
+            sha,
+          ],
           repoPath,
           core,
           quiet: true,
         })
       ).stdout.split('\n')
 
-      const subject = result[0]
+      const [subject, authorName, authorEmail, committerName, committerEmail] =
+        result[0].split('\t')
 
       const changedPaths = result.slice(2, -1)
 
@@ -91,6 +105,8 @@ async function getCommitDetailsForPR({ core, pr, repoPath }) {
       return {
         sha,
         subject,
+        author: { name: authorName, email: authorEmail },
+        committer: { name: committerName, email: committerEmail },
         changedPaths,
         changedPathSegments,
       }
diff --git a/ci/github-script/lint-commits.js b/ci/github-script/lint-commits.js
index 1aa18e9477b0..0828db23a2bc 100644
--- a/ci/github-script/lint-commits.js
+++ b/ci/github-script/lint-commits.js
@@ -2,15 +2,17 @@
 const { classify } = require('../supportedBranches.js')
 const { getCommitDetailsForPR } = require('./get-pr-commit-details.js')
 
+/** @typedef {import('./get-pr-commit-details.js').Commit} Commit */
+
 /**
  * @param {{
  *  github: InstanceType<import('@actions/github/lib/utils').GitHub>,
- *  context: import('@actions/github/lib/context').Context,
+ *  context: typeof import('@actions/github').context,
  *  core: import('@actions/core'),
  *  repoPath?: string,
- * }} CheckCommitMessagesProps
+ * }} LintCommitsProps
  */
-async function checkCommitMessages({ github, context, core, repoPath }) {
+async function lintCommits({ github, context, core, repoPath }) {
   // This check should only be run when we have the pull_request context.
   const pull_number = context.payload.pull_request?.number
   if (!pull_number) {
@@ -48,6 +50,17 @@ async function checkCommitMessages({ github, context, core, repoPath }) {
 
   const commits = await getCommitDetailsForPR({ core, pr, repoPath })
 
+  await checkCommitMessages({ commits, core })
+  await checkCommitMetadata({ commits, core })
+}
+
+/**
+ * @param {{
+ *  commits: Commit[],
+ *  core: import('@actions/core'),
+ * }} CheckCommitMessagesProps
+ */
+async function checkCommitMessages({ commits, core }) {
   const failures = new Set()
 
   const conventionalCommitTypes = [
@@ -152,4 +165,59 @@ async function checkCommitMessages({ github, context, core, repoPath }) {
   }
 }
 
-module.exports = checkCommitMessages
+/**
+ * @param {{
+ *  commits: Commit[],
+ *  core: import('@actions/core'),
+ * }} CheckGitFieldsProps
+ */
+async function checkCommitMetadata({ commits, core }) {
+  const failures = new Set()
+
+  /** @type {(s: string) => boolean} */
+  const isEmail = (s) => /^.+@.*$/.test(s)
+
+  for (const commit of commits) {
+    if (!commit.author.name) {
+      core.error(`Commit ${commit.sha} author's name field is missing`)
+      failures.add(commit.sha)
+    }
+
+    if (!commit.author.email || !isEmail(commit.author.email)) {
+      core.error(
+        `Commit ${commit.sha} author's email field is missing or invalid`,
+      )
+      failures.add(commit.sha)
+    }
+
+    if (!commit.committer.name) {
+      core.error(`Commit ${commit.sha} committer's name field is missing`)
+      failures.add(commit.sha)
+    }
+
+    if (!commit.committer.email || !isEmail(commit.committer.email)) {
+      core.error(
+        `Commit ${commit.sha} committer's email field is missing or invalid`,
+      )
+      failures.add(commit.sha)
+    }
+
+    if (!failures.has(commit.sha)) {
+      core.info(
+        `Commit ${commit.sha}'s git fields passed our automated checks!`,
+      )
+    }
+  }
+
+  if (failures.size !== 0) {
+    core.error(
+      'Please add the missing commit fields. ' +
+        'You can use the noreply email address generated for you by GitHub ' +
+        '(https://docs.github.com/en/account-and-profile/reference/email-addresses-reference#your-noreply-email-address) ' +
+        "if you'd like.",
+    )
+    core.setFailed('Committers: merging is discouraged.')
+  }
+}
+
+module.exports = lintCommits
diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index f46c446d75bc..ab63631ace2b 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -310,6 +310,8 @@
   If your SQLite database is corrupted, the migration might fail and require [manual intervention](https://github.com/louislam/uptime-kuma/issues/5281).
   See the [migration guide](https://github.com/louislam/uptime-kuma/wiki/Migration-From-v1-To-v2) for more information.
 
+- `incus-lts` has been updated from v6 to v7
+
 - The `libcxxhardeningextensive` hardening flag has been **disabled** by default. Enabling it by default in 25.11 was unintentional and may have had a negative effect on performance in some cases. `libcxxhardeningfast` remains enabled by default.
 
 - The packages `ibtool`, `actool` and `re-plistbuddy` have been added, providing reimplementations of the corresponding proprietary Apple tools. They are more compatible with the originals than the previously existing `xcbuild` package, and should enable more darwin software to be built from source.
diff --git a/lib/licenses/licenses.nix b/lib/licenses/licenses.nix
index fbc915a6ce5b..8e40dacdbeb3 100644
--- a/lib/licenses/licenses.nix
+++ b/lib/licenses/licenses.nix
@@ -1560,6 +1560,11 @@ lib.mapAttrs mkLicense (
       fullName = "W3C Software Notice and License";
     };
 
+    w3c-19980720 = {
+      spdxId = "W3C-19980720";
+      fullName = "W3C Software Notice and License (1998-07-20)";
+    };
+
     wadalab = {
       fullName = "Wadalab Font License";
       url = "https://fedoraproject.org/wiki/Licensing:Wadalab?rd=Licensing/Wadalab";
diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index fd4ed9777b52..e481b8a8fc28 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -621,6 +621,64 @@ let
             else
               null;
         };
+
+        nim = {
+          # See these locations for a known list of cpu/os idntifeiers:
+          # - https://nim-lang.org/docs/system.html#hostCPU
+          # - https://nim-lang.org/docs/system.html#hostOS
+          cpu =
+            if final.isAarch32 then
+              "arm"
+            else if final.isAarch64 then
+              "arm64"
+            else if final.isAlpha then
+              "alpha"
+            else if final.isAvr then
+              "avr"
+            else if final.isMips && final.is32Bit then
+              "mips"
+            else if final.isMips && final.is64Bit then
+              "mips64"
+            else if final.isMsp430 then
+              "msp430"
+            else if final.isPower && final.is32bit then
+              "powerpc"
+            else if final.isPower && final.is64bit then
+              "powerpc64"
+            else if final.isRiscV && final.is64bit then
+              "riscv64"
+            else if final.isSparc then
+              "sparc"
+            else if final.isx86_32 then
+              "i386"
+            else if final.isx86_64 then
+              "amd64"
+            else
+              null;
+          os =
+            if final.isAndroid then
+              "Android"
+            else if final.isDarwin then
+              "MacOSX"
+            else if final.isFreeBSD then
+              "FreeBSD"
+            else if final.isGenode then
+              "Genode"
+            else if final.isLinux then
+              "Linux"
+            else if final.isNetBSD then
+              "NetBSD"
+            else if final.isNone then
+              "Standalone"
+            else if final.isOpenBSD then
+              "OpenBSD"
+            else if final.isWindows then
+              "Windows"
+            else if final.isiOS then
+              "iOS"
+            else
+              null;
+        };
       };
     in
     assert final.useAndroidPrebuilt -> final.isAndroid;
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 7840750f61c2..bb1f5256e0cb 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -7699,6 +7699,12 @@
     githubId = 22300113;
     name = "Eduardo Espadeiro";
   };
+  eduardofuncao = {
+    email = "eduardofuncao@hotmail.com";
+    github = "eduardofuncao";
+    githubId = 45571086;
+    name = "Eduardo Função";
+  };
   eduarrrd = {
     email = "e.bachmakov@gmail.com";
     github = "eduarrrd";
@@ -9338,6 +9344,12 @@
     githubId = 134872;
     name = "Sergei Lukianov";
   };
+  frostplexx = {
+    email = "daniel.inama02@gmail.com";
+    github = "frostplexx";
+    githubId = 62436912;
+    name = "Daniel Inama";
+  };
   fryuni = {
     name = "Luiz Ferraz";
     email = "luiz@lferraz.com";
@@ -20896,6 +20908,13 @@
     githubId = 686076;
     name = "Vitalii Voloshyn";
   };
+  panakotta00 = {
+    name = "Panakotta00";
+    github = "Panakotta00";
+    githubId = 16022267;
+    email = "panakotta00@gmail.com";
+    keys = [ { fingerprint = "ABF8 D539 0F8C F623 8F49  7338 BA6C E8AC 4B73 53B9"; } ];
+  };
   pancaek = {
     github = "pancaek";
     githubId = 20342389;
@@ -24343,6 +24362,12 @@
     githubId = 30531572;
     name = "Robert James Hernandez";
   };
+  sarowish = {
+    email = "berkeenercan@tutanota.com";
+    github = "sarowish";
+    githubId = 20581722;
+    name = "Berke Enercan";
+  };
   sarunint = {
     email = "nixpkgs@sarunint.com";
     github = "sarunint";
@@ -25342,6 +25367,11 @@
     github = "Simarra";
     githubId = 14372987;
   };
+  Simon-Weij = {
+    name = "Simon";
+    github = "Simon-Weij";
+    githubId = 175155691;
+  };
   simonchatts = {
     email = "code@chatts.net";
     github = "simonchatts";
@@ -25821,6 +25851,12 @@
     githubId = 6277322;
     name = "Wei Tang";
   };
+  sotormd = {
+    email = "sotormd@proton.me";
+    github = "sotormd";
+    githubId = 201147279;
+    name = "sotormd";
+  };
   soupglasses = {
     email = "sofi+git@mailbox.org";
     github = "soupglasses";
diff --git a/nixos/maintainers/scripts/incus/incus-container-image.nix b/nixos/maintainers/scripts/incus/incus-container-image.nix
index 989f583307fe..8007e5cad018 100644
--- a/nixos/maintainers/scripts/incus/incus-container-image.nix
+++ b/nixos/maintainers/scripts/incus/incus-container-image.nix
@@ -32,6 +32,9 @@
       };
     };
 
+  # Disable the cloneConfig module. We have our own Service to generate a configuration.nix.
+  installer.cloneConfig = false;
+
   networking = {
     dhcpcd.enable = false;
     useDHCP = false;
diff --git a/nixos/maintainers/scripts/incus/incus-virtual-machine-image.nix b/nixos/maintainers/scripts/incus/incus-virtual-machine-image.nix
index f06b43dc2675..e7d93a69094e 100644
--- a/nixos/maintainers/scripts/incus/incus-virtual-machine-image.nix
+++ b/nixos/maintainers/scripts/incus/incus-virtual-machine-image.nix
@@ -32,6 +32,9 @@
       };
     };
 
+  # Disable the cloneConfig module. We have our own Service to generate a configuration.nix.
+  installer.cloneConfig = false;
+
   # Network
   networking = {
     dhcpcd.enable = false;
diff --git a/nixos/modules/config/console.nix b/nixos/modules/config/console.nix
index 571f723a823f..74653918f893 100644
--- a/nixos/modules/config/console.nix
+++ b/nixos/modules/config/console.nix
@@ -189,6 +189,9 @@ in
             "/etc/kbd/keymaps" = lib.mkIf (!cfg.earlySetup) {
               source = "${consoleEnv config.boot.initrd.systemd.package.kbd}/share/keymaps";
             };
+            "/etc/kbd/consolefonts" = lib.mkIf (!cfg.earlySetup && cfg.font != null) {
+              source = "${consoleEnv config.boot.initrd.systemd.package.kbd}/share/consolefonts";
+            };
           };
           boot.initrd.systemd.additionalUpstreamUnits = [
             "systemd-vconsole-setup.service"
diff --git a/nixos/modules/programs/shadow.nix b/nixos/modules/programs/shadow.nix
index d6d48af0f877..d179283ac559 100644
--- a/nixos/modules/programs/shadow.nix
+++ b/nixos/modules/programs/shadow.nix
@@ -254,7 +254,7 @@ in
           startSession = true;
           allowNullPassword = true;
           showMotd = true;
-          updateWtmp = true;
+          lastlog.enable = true;
         };
         chpasswd.rootOK = true;
       };
diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix
index 41ba7df94be1..5130987bed1c 100644
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -137,6 +137,7 @@ let
       imports = [
         (lib.mkRenamedOptionModule [ "enableKwallet" ] [ "kwallet" "enable" ])
         (lib.mkRenamedOptionModule [ "u2fAuth" ] [ "u2f" "enable" ])
+        (lib.mkRenamedOptionModule [ "updateWtmp" ] [ "lastlog" "enable" ])
       ];
 
       options = {
@@ -583,10 +584,21 @@ let
           '';
         };
 
-        updateWtmp = lib.mkOption {
-          default = false;
-          type = lib.types.bool;
-          description = "Whether to update {file}`/var/log/wtmp`.";
+        lastlog = {
+          enable = lib.mkOption {
+            default = false;
+            type = lib.types.bool;
+            description = "Whether to update {file}`/var/log/wtmp`.";
+          };
+
+          silent = lib.mkOption {
+            default = true;
+            example = false;
+            type = lib.types.bool;
+            description = ''
+              Whether to suppress the message showing the last login date.
+            '';
+          };
         };
 
         logFailures = lib.mkOption {
@@ -1521,11 +1533,11 @@ let
               }
               {
                 name = "lastlog";
-                enable = cfg.updateWtmp;
+                enable = cfg.lastlog.enable;
                 control = "required";
                 modulePath = "${pkgs.util-linux.lastlog}/lib/security/pam_lastlog2.so";
                 settings = {
-                  silent = true;
+                  inherit (cfg.lastlog) silent;
                 };
               }
               # Work around https://github.com/systemd/systemd/issues/8598
@@ -2549,7 +2561,7 @@ in
     environment.etc = lib.mapAttrs' makePAMService enabledServices;
 
     systemd =
-      lib.mkIf (lib.any (service: service.updateWtmp) (lib.attrValues config.security.pam.services))
+      lib.mkIf (lib.any (service: service.lastlog.enable) (lib.attrValues config.security.pam.services))
         {
           tmpfiles.packages = [ pkgs.util-linux.lastlog ]; # /lib/tmpfiles.d/lastlog2-tmpfiles.conf
           services.lastlog2-import = {
diff --git a/nixos/modules/services/backup/btrbk.nix b/nixos/modules/services/backup/btrbk.nix
index c44fc48836ce..3ee21ecebe7e 100644
--- a/nixos/modules/services/backup/btrbk.nix
+++ b/nixos/modules/services/backup/btrbk.nix
@@ -10,6 +10,7 @@ let
     concatMap
     concatMapStringsSep
     concatStringsSep
+    escapeShellArgs
     filterAttrs
     getAttr
     isAttrs
@@ -275,6 +276,15 @@ in
                 ];
                 description = "What actions can be performed with this SSH key. See ssh_filter_btrbk(1) for details";
               };
+              extraArgs = mkOption {
+                type = listOf str;
+                description = "Additional arguments to pass to ssh_filter_btrbk";
+                default = [ ];
+                example = [
+                  "--log"
+                  "--restrict-path <path>"
+                ];
+              };
             };
           });
         default = [ ];
@@ -335,7 +345,7 @@ in
         in
         ''command="${pkgs.util-linux}/bin/ionice -t -c ${toString ioniceClass} ${
           optionalString (cfg.niceness >= 1) "${pkgs.coreutils}/bin/nice -n ${toString cfg.niceness}"
-        } ${pkgs.btrbk}/share/btrbk/scripts/ssh_filter_btrbk.sh ${sudo_doas_flag} ${options}" ${v.key}''
+        } ${pkgs.btrbk}/share/btrbk/scripts/ssh_filter_btrbk.sh ${sudo_doas_flag} ${options} ${escapeShellArgs v.extraArgs}" ${v.key}''
       ) cfg.sshAccess;
     };
     users.groups.btrbk = { };
diff --git a/nixos/modules/services/databases/lldap.nix b/nixos/modules/services/databases/lldap.nix
index fe956c943281..1c02f996005d 100644
--- a/nixos/modules/services/databases/lldap.nix
+++ b/nixos/modules/services/databases/lldap.nix
@@ -288,6 +288,37 @@ in
         Group = "lldap";
         DynamicUser = true;
         EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+        ];
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        SystemCallArchitectures = "native";
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        MemoryDenyWriteExecute = true;
       };
       inherit (cfg) environment;
     };
diff --git a/nixos/modules/services/misc/iio-niri.nix b/nixos/modules/services/misc/iio-niri.nix
index 2c2810b0ee0f..4efdad1a6bc8 100644
--- a/nixos/modules/services/misc/iio-niri.nix
+++ b/nixos/modules/services/misc/iio-niri.nix
@@ -32,7 +32,7 @@ in
     extraArgs = mkOption {
       type = types.listOf types.str;
       default = [ ];
-      description = "Extra arguments to pass to IIO-Niri.";
+      description = "Extra arguments to pass to `iio-niri listen`.";
     };
   };
 
@@ -49,7 +49,7 @@ in
       after = [ cfg.niriUnit ];
       serviceConfig = {
         Type = "simple";
-        ExecStart = "${getExe cfg.package} ${escapeShellArgs cfg.extraArgs}";
+        ExecStart = "${getExe cfg.package} listen ${escapeShellArgs cfg.extraArgs}";
         Restart = "on-failure";
       };
     };
diff --git a/nixos/modules/services/networking/harmonia.nix b/nixos/modules/services/networking/harmonia.nix
index 5a7902f952e7..2eba1bdccad3 100644
--- a/nixos/modules/services/networking/harmonia.nix
+++ b/nixos/modules/services/networking/harmonia.nix
@@ -50,7 +50,7 @@ in
         signKeyPath = lib.mkOption {
           type = lib.types.nullOr lib.types.path;
           default = null;
-          description = "DEPRECATED: Use `services.harmonia-dev.cache.signKeyPaths` instead. Path to the signing key to use for signing the cache";
+          description = "DEPRECATED: Use `services.harmonia.cache.signKeyPaths` instead. Path to the signing key to use for signing the cache";
         };
 
         signKeyPaths = lib.mkOption {
@@ -109,31 +109,30 @@ in
         else
           [ ];
 
-      nix.settings.extra-allowed-users = [ "harmonia" ];
-      users.users.harmonia = {
-        isSystemUser = true;
-        group = "harmonia";
+      services.harmonia.cache.settings = builtins.mapAttrs (_: v: lib.mkDefault v) {
+        bind = "[::]:5000";
+        workers = 4;
+        max_connection_rate = 256;
+        priority = 50;
       };
-      users.groups.harmonia = { };
 
-      services.harmonia.cache.settings = builtins.mapAttrs (_: v: lib.mkDefault v) (
-        {
-          bind = "[::]:5000";
-          workers = 4;
-          max_connection_rate = 256;
-          priority = 50;
-        }
-        // lib.optionalAttrs daemonCfg.enable {
-          daemon_socket = daemonCfg.socketPath;
-        }
-      );
+      # Socket activation lets the service run with PrivateNetwork; the
+      # inherited fd keeps referring to the host netns.
+      systemd.sockets.harmonia = {
+        description = "harmonia binary cache socket";
+        wantedBy = [ "sockets.target" ];
+        socketConfig.ListenStream =
+          let
+            b = cacheCfg.settings.bind;
+          in
+          if lib.hasPrefix "unix:" b then lib.removePrefix "//" (lib.removePrefix "unix:" b) else b;
+      };
 
       systemd.services.harmonia = {
         description = "harmonia binary cache service";
 
-        requires = if daemonCfg.enable then [ "harmonia-daemon.service" ] else [ "nix-daemon.socket" ];
-        after = [ "network.target" ] ++ lib.optional daemonCfg.enable "harmonia-daemon.service";
-        wantedBy = [ "multi-user.target" ];
+        requires = [ "harmonia.socket" ];
+        after = [ "harmonia.socket" ];
 
         environment = {
           CONFIG_FILE = format.generate "harmonia.toml" cacheCfg.settings;
@@ -150,6 +149,9 @@ in
           ExecStart = lib.getExe cfg.package;
           User = "harmonia";
           Group = "harmonia";
+          DynamicUser = true;
+          Type = "notify";
+          WatchdogSec = 15;
           Restart = "on-failure";
           PrivateUsers = true;
           DeviceAllow = [ "" ];
@@ -174,7 +176,12 @@ in
           ProtectProc = "invisible";
           RestrictNamespaces = true;
           SystemCallArchitectures = "native";
-          PrivateNetwork = false;
+
+          # accept(2) on the inherited fd is exempt from both restrictions.
+          PrivateNetwork = true;
+          RestrictAddressFamilies = [ "AF_UNIX" ];
+          IPAddressDeny = "any";
+
           PrivateTmp = true;
           PrivateDevices = true;
           PrivateMounts = true;
@@ -182,7 +189,6 @@ in
           ProtectSystem = "strict";
           ProtectHome = true;
           LockPersonality = true;
-          RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
           LimitNOFILE = 65536;
         };
       };
diff --git a/nixos/modules/services/security/reaction.nix b/nixos/modules/services/security/reaction.nix
index ba0cc6581dbc..dd0642aa04f3 100644
--- a/nixos/modules/services/security/reaction.nix
+++ b/nixos/modules/services/security/reaction.nix
@@ -240,6 +240,10 @@ in
             ''
           );
 
+      systemd.slices.system-reaction = {
+        description = "Reaction system slice";
+      };
+
       systemd.services.reaction = {
         description = "A daemon that scans program outputs for repeated patterns, and takes action.";
         documentation = [ "https://reaction.ppom.me" ];
@@ -250,6 +254,7 @@ in
         serviceConfig = {
           Type = "simple";
           KillMode = "mixed"; # for plugins
+          Slice = "system-reaction.slice";
           User = if (!cfg.runAsRoot) then "reaction" else "root";
           ExecStart = ''
             ${getExe cfg.package} start -c ${settingsDir}${
diff --git a/nixos/modules/services/x11/display-managers/default.nix b/nixos/modules/services/x11/display-managers/default.nix
index 2695dc71145d..2f9a8dcb210a 100644
--- a/nixos/modules/services/x11/display-managers/default.nix
+++ b/nixos/modules/services/x11/display-managers/default.nix
@@ -48,7 +48,7 @@ let
       IFS=:
       for i in $XDG_CURRENT_DESKTOP; do
         case $i in
-          KDE|GNOME|Pantheon|Hyprland|X-NIXOS-SYSTEMD-AWARE) echo "1"; exit; ;;
+          KDE|GNOME|Pantheon|Hyprland|niri|X-NIXOS-SYSTEMD-AWARE) echo "1"; exit; ;;
           *) ;;
         esac
       done
diff --git a/nixos/modules/virtualisation/incus.nix b/nixos/modules/virtualisation/incus.nix
index a0842be7e93d..83a5a731ccb7 100644
--- a/nixos/modules/virtualisation/incus.nix
+++ b/nixos/modules/virtualisation/incus.nix
@@ -39,8 +39,8 @@ let
       dnsmasq
       e2fsprogs
       findutils
-      getent
       gawk
+      getent
       gnugrep
       gnused
       gnutar
@@ -50,33 +50,29 @@ let
       iptables
       iw
       kmod
+      lego
       libxfs
       lvm2
-      lz4
       lxcfs
+      lz4
       nftables
       qemu-utils
       qemu_kvm
       rsync
+      skopeo
       squashfs-tools-ng
       squashfsTools
       sshfs
       swtpm
       systemd
       thin-provisioning-tools
+      umoci
       util-linux
       virtiofsd
       xdelta
       xz
       zstd
     ]
-    ++ lib.optionals (lib.versionAtLeast cfg.package.version "6.3.0") [
-      skopeo
-      umoci
-    ]
-    ++ lib.optionals (lib.versionAtLeast cfg.package.version "6.11.0") [
-      lego
-    ]
     ++ lib.optionals config.security.apparmor.enable [
       apparmor-bin-utils
 
@@ -97,10 +93,6 @@ let
     ]
     ++ lib.optionals nvidiaEnabled [
       libnvidia-container
-    ]
-    ++ lib.optionals cfg.bucketSupport [
-      minio
-      minio-client
     ];
 
   # https://github.com/lxc/incus/blob/cff35a29ee3d7a2af1f937cbb6cf23776941854b/internal/server/instance/drivers/driver_qemu.go#L123
@@ -213,13 +205,6 @@ in
         description = "The incus client package to use. This package is added to PATH.";
       };
 
-      bucketSupport = lib.mkOption {
-        type = lib.types.bool;
-        description = "Enable bucket support using minio, which is an insecure and unmaintained S3 provider.";
-        default = if lib.versionAtLeast config.system.stateVersion "26.11" then false else null;
-        defaultText = lib.literalExpression ''if lib.versionAtLeast config.system.stateVersion "26.11" then false else null;'';
-      };
-
       softDaemonRestart = lib.mkOption {
         type = lib.types.bool;
         default = true;
@@ -573,4 +558,10 @@ in
 
     virtualisation.lxc.lxcfs.enable = true;
   };
+
+  imports = [
+    (lib.mkRemovedOptionModule [ "virtualisation" "incus" "bucketSupport" ] ''
+      The option was only a temporary workaround to gate the insecure minio dependency until it could be dropped.
+    '')
+  ];
 }
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 83c759e3de0c..9d2917ba4239 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -815,8 +815,12 @@ in
   jool = import ./jool.nix { inherit pkgs runTest; };
   jotta-cli = runTest ./jotta-cli.nix;
   k3s = import ./rancher {
-    inherit pkgs runTest;
+    inherit pkgs;
     inherit (pkgs) lib;
+    runTest = runTestOn [
+      "aarch64-linux"
+      "x86_64-linux"
+    ];
     rancherDistro = "k3s";
   };
   kafka = handleTest ./kafka { };
@@ -1369,7 +1373,7 @@ in
   pulseaudio-tcp = runTest ./pulseaudio-tcp.nix;
   pykms = runTest ./pykms.nix;
   qbittorrent = runTest ./qbittorrent.nix;
-  qboot = handleTestOn [ "x86_64-linux" "i686-linux" ] ./qboot.nix { };
+  qboot = runTestOn [ "x86_64-linux" "i686-linux" ] ./qboot.nix;
   qemu-vm-credentials-fwcfg = runTest {
     imports = [ ./qemu-vm-credentials.nix ];
     _module.args.mechanism = "fw_cfg";
diff --git a/nixos/tests/grafana-to-ntfy.nix b/nixos/tests/grafana-to-ntfy.nix
index d7e942296e3a..f7d3dd487f13 100644
--- a/nixos/tests/grafana-to-ntfy.nix
+++ b/nixos/tests/grafana-to-ntfy.nix
@@ -148,10 +148,10 @@ in
 
     with subtest("Grafana alert arrives at ntfy"):
       machine.succeed(
-        "curl -sf http://127.0.0.1:${toString ports.grafana}/api/alertmanager/grafana/config/api/v1/receivers/test"
+        "curl -sf http://127.0.0.1:${toString ports.grafana}/apis/notifications.alerting.grafana.app/v1beta1/namespaces/default/receivers/-/test"
         " -u admin:admin"
         " -X POST -H 'Content-Type: application/json'"
-        """ -d '{"receivers": [{"name": "grafana-to-ntfy", "grafana_managed_receiver_configs": [{"uid": "cp_webhook", "name": "webhook", "type": "webhook", "disableResolveMessage": false, "settings": {"url": "http://127.0.0.1:${toString ports.grafana-to-ntfy}", "httpMethod": "POST"}}]}]}'"""
+        """ -d '{"alert": {"labels": {"alertname": "test-alert"}, "annotations": {}}, "integration": {"type": "webhook", "settings": {"url": "http://127.0.0.1:${toString ports.grafana-to-ntfy}", "httpMethod": "POST"}}}'"""
       )
       # grep ensures we wait for the Grafana message specifically (see above)
       resp = machine.wait_until_succeeds(
diff --git a/nixos/tests/incus/incus-tests-module.nix b/nixos/tests/incus/incus-tests-module.nix
index 69b0d3c13825..e5318443670b 100644
--- a/nixos/tests/incus/incus-tests-module.nix
+++ b/nixos/tests/incus/incus-tests-module.nix
@@ -142,11 +142,11 @@ in
                       server.succeed("systemctl start incus")
 
                   with subtest("[${image_id}] CPU limits can be managed"):
-                      server.set_instance_config(instance_name, "limits.cpu 1", restart=True)
+                      server.set_instance_config(instance_name, "limits.cpu=1", restart=True)
                       server.wait_instance_exec_success(instance_name, "nproc | grep '^1$'", timeout=90)
 
                   with subtest("[${image_id}] CPU limits can be hotplug changed"):
-                      server.set_instance_config(instance_name, "limits.cpu 2")
+                      server.set_instance_config(instance_name, "limits.cpu=2")
                       server.wait_instance_exec_success(instance_name, "nproc | grep '^2$'", timeout=90)
 
                   with subtest("[${image_id}] exec has a valid path"):
@@ -164,6 +164,7 @@ in
 
                   with subtest("[${image_id}] default configuration.nix is created on first boot"):
                       server.succeed(f"incus exec {instance_name} -- test -f /etc/nixos/configuration.nix")
+                      server.succeed(f"incus exec {instance_name} -- grep -q 'default incus configuration' /etc/nixos/configuration.nix")
 
                   with subtest("[${image_id}] configuration.nix create service does not overwrite existing config"):
                       server.succeed(f"incus exec {instance_name} -- systemctl restart incus-create-nixos-config.service")
@@ -195,7 +196,7 @@ in
 
                     # TODO troubleshoot VM hot memory resizing which was introduced in 6.12
                     with subtest("[${image_id}] memory limits can be hotplug changed"):
-                        server.set_instance_config(instance_name, "limits.memory 512MB")
+                        server.set_instance_config(instance_name, "limits.memory=512MB")
                         # can't use lsmem since it sees the host's memory size
                         server.wait_instance_exec_success(instance_name, "grep 'MemTotal:[[:space:]]*500000 kB' /proc/meminfo", timeout=1)
 
@@ -244,7 +245,7 @@ in
                     # python
                     ''
                       with subtest("[${image_id}] memory limits can be managed"):
-                          server.set_instance_config(instance_name, "limits.memory 384MB", restart=True)
+                          server.set_instance_config(instance_name, "limits.memory=384MB", restart=True)
                           lsmem = json.loads(server.instance_succeed(instance_name, "lsmem --json"))
                           memsize = lsmem["memory"][0]["size"]
                           assert memsize == "384M", f"failed to manage memory limit. {memsize} != 384M"
diff --git a/nixos/tests/incus/incus-tests.nix b/nixos/tests/incus/incus-tests.nix
index 34cfdc63e219..b28eb12b2ef1 100644
--- a/nixos/tests/incus/incus-tests.nix
+++ b/nixos/tests/incus/incus-tests.nix
@@ -51,7 +51,6 @@ in
       incus = {
         enable = true;
         package = cfg.package;
-        bucketSupport = false;
 
         preseed = {
           networks = [
diff --git a/nixos/tests/pam/pam-lastlog.nix b/nixos/tests/pam/pam-lastlog.nix
index cefc8a3d4e45..4d1dab8e7150 100644
--- a/nixos/tests/pam/pam-lastlog.nix
+++ b/nixos/tests/pam/pam-lastlog.nix
@@ -6,10 +6,7 @@
   nodes.machine =
     { ... }:
     {
-      # we abuse run0 for a quick login as root as to not require setting up accounts and passwords
-      security.pam.services.systemd-run0 = {
-        updateWtmp = true; # enable lastlog
-      };
+      imports = [ ../common/user-account.nix ];
     };
 
   testScript = ''
@@ -23,8 +20,13 @@
 
     with subtest("Test lastlog entries are created by logins"):
       machine.wait_for_unit("multi-user.target")
-      machine.succeed("run0 --pty true") # perform full login
-      print(machine.succeed("lastlog2 --active --user root"))
+      machine.wait_until_tty_matches("1", "login: ")
+      machine.send_chars("alice\n")
+      machine.wait_until_tty_matches("1", "Password: ")
+      machine.send_chars("foobar\n")
+      machine.wait_until_succeeds("pgrep -u alice bash")
+      print(machine.succeed("lastlog2 --active --user alice"))
       machine.succeed("stat /var/lib/lastlog/lastlog2.db")
+      machine.send_chars("exit\n")
   '';
 }
diff --git a/nixos/tests/qboot.nix b/nixos/tests/qboot.nix
index 822f74ed2665..c74110afebd5 100644
--- a/nixos/tests/qboot.nix
+++ b/nixos/tests/qboot.nix
@@ -1,17 +1,15 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "qboot";
+{ pkgs, ... }:
+{
+  name = "qboot";
 
-    nodes.machine =
-      { ... }:
-      {
-        virtualisation.bios = pkgs.qboot;
-      };
+  nodes.machine =
+    { ... }:
+    {
+      virtualisation.bios = pkgs.qboot;
+    };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("multi-user.target")
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+  '';
+}
diff --git a/nixos/tests/turn-rs.nix b/nixos/tests/turn-rs.nix
index 4404a50f52d9..a7237c87cd7b 100644
--- a/nixos/tests/turn-rs.nix
+++ b/nixos/tests/turn-rs.nix
@@ -23,23 +23,23 @@
           USER_1_CREDS="foobar"
         '';
         settings = {
-          turn = {
+          server = {
             realm = "localhost";
             interfaces = [
               {
                 transport = "udp";
-                bind = "127.0.0.1:3478";
+                listen = "127.0.0.1:3478";
                 external = "127.0.0.1:3478";
               }
               {
                 transport = "tcp";
-                bind = "127.0.0.1:3478";
+                listen = "127.0.0.1:3478";
                 external = "127.0.0.1:3478";
               }
             ];
           };
 
-          auth.static_credentials.user1 = "$USER_1_CREDS";
+          auth."static-credentials".user1 = "$USER_1_CREDS";
         };
       };
     };
@@ -47,15 +47,20 @@
 
   testScript = # python
     ''
-      import json
-
       start_all()
       server.wait_for_unit('turn-rs.service')
-      server.wait_for_open_port(3000, "127.0.0.1")
+      server.wait_for_open_port(3478, "127.0.0.1")
 
-      info = server.succeed('curl http://localhost:3000/info')
-      jsonInfo = json.loads(info)
-      assert len(jsonInfo['interfaces']) == 2, f'Interfaces doesn\'t contain two entries:\n{json.dumps(jsonInfo, indent=2)}'
+      base = (
+          "${pkgs.coturn}/bin/turnutils_uclient"
+          " -L 127.0.0.1 -e 127.0.0.1 -u user1 -w foobar -X -y -t"
+      )
+      for extra in ["", "-s", "-t", "-t -s"]:
+          out = server.succeed(f"{base} {extra} 127.0.0.1")
+          assert "ERROR" not in out, f"turnutils_uclient errors:\n{out}"
+          assert "Total lost packets 0 (0.000000%)" in out, (
+              f"turnutils_uclient reported packet loss or did not finish:\n{out}"
+          )
 
       config = server.succeed('cat /run/turn-rs/config.toml')
       assert 'foobar' in config, f'Secrets are not properly injected:\n{config}'
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 10c057d3f55f..9bbcc30397d1 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -7758,6 +7758,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  inlay-hints-nvim = buildVimPlugin {
+    pname = "inlay-hints.nvim";
+    version = "0.0.7";
+    src = fetchFromGitHub {
+      owner = "MysticalDevil";
+      repo = "inlay-hints.nvim";
+      tag = "v0.0.7";
+      hash = "sha256-136r1/SjBHcrKZZcFHZK7rFTcJHAReZqIzUrKsZStc4=";
+    };
+    meta.homepage = "https://github.com/MysticalDevil/inlay-hints.nvim";
+    meta.license = getLicenseFromSpdxId "Apache-2.0";
+    meta.hydraPlatforms = [ ];
+  };
+
   instant-nvim = buildVimPlugin {
     pname = "instant.nvim";
     version = "0-unstable-2022-06-25";
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/statix/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/statix/default.nix
index 62dd5e9b9bc0..2090ea8ccfe3 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/statix/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/statix/default.nix
@@ -2,14 +2,15 @@
   vimUtils,
   statix,
 }:
-vimUtils.buildVimPlugin rec {
-  inherit (statix) pname src meta;
-  version = "0.1.0";
-  postPatch = ''
-    # check that version is up to date
-    grep 'pname = "statix-vim"' -A 1 flake.nix \
-      | grep -F 'version = "${version}"'
+vimUtils.buildVimPlugin {
+  inherit (statix)
+    pname
+    src
+    meta
+    version
+    ;
 
+  postPatch = ''
     cd vim-plugin
     substituteInPlace ftplugin/nix.vim --replace-fail statix ${statix}/bin/statix
     substituteInPlace plugin/statix.vim --replace-fail statix ${statix}/bin/statix
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index be8e7bb244c1..cf926280f12d 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -552,6 +552,7 @@ https://github.com/Darazaki/indent-o-matic/,,
 https://github.com/arsham/indent-tools.nvim/,,
 https://github.com/Yggdroot/indentLine/,,
 https://github.com/ciaranm/inkpot/,,
+https://github.com/MysticalDevil/inlay-hints/,,
 https://github.com/jbyuki/instant.nvim/,,
 https://github.com/pta2002/intellitab.nvim/,,
 https://github.com/parsonsmatt/intero-neovim/,,
diff --git a/pkgs/applications/emulators/wine/sources.nix b/pkgs/applications/emulators/wine/sources.nix
index 8fa5364dc670..0f93ed114c8b 100644
--- a/pkgs/applications/emulators/wine/sources.nix
+++ b/pkgs/applications/emulators/wine/sources.nix
@@ -151,9 +151,9 @@ rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the hash for staging as well.
-    version = "11.6";
+    version = "11.7";
     url = "https://dl.winehq.org/wine/source/11.x/wine-${version}.tar.xz";
-    hash = "sha256-1J0WaXVHj2Ceapzb2goHxlo7eV4GH8RU0/EDTIKNGeA=";
+    hash = "sha256-sBqyHHn+3mx71THUadma/Z3N9T6ymviK2sajMutDX58=";
 
     patches = [
       # Also look for root certificates at $NIX_SSL_CERT_FILE
@@ -163,7 +163,7 @@ rec {
     # see https://gitlab.winehq.org/wine/wine-staging
     staging = fetchFromGitLab {
       inherit version;
-      hash = "sha256-vI6GnnAqkyQSff9jrGYCTFR6fSIg2i9FT4mvbOlU1M4=";
+      hash = "sha256-EjAmwSZu/Q/8QfFERnV5iz1n5CsWPneBHflQDaD4LAc=";
       domain = "gitlab.winehq.org";
       owner = "wine";
       repo = "wine-staging";
diff --git a/pkgs/applications/misc/dupeguru/remove-setuptools-sandbox.patch b/pkgs/applications/misc/dupeguru/remove-setuptools-sandbox.patch
deleted file mode 100644
index 983ea4dd7efc..000000000000
--- a/pkgs/applications/misc/dupeguru/remove-setuptools-sandbox.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-diff --git a/build.py b/build.py
-index 06905a11..56d54a17 100644
---- a/build.py
-+++ b/build.py
-@@ -10,7 +10,7 @@ from optparse import OptionParser
- import shutil
- from multiprocessing import Pool
- 
--from setuptools import sandbox
-+import subprocess
- from hscommon import sphinxgen
- from hscommon.build import (
-     add_to_pythonpath,
-@@ -118,7 +118,12 @@ def build_normpo():
- def build_pe_modules():
-     print("Building PE Modules")
-     # Leverage setup.py to build modules
--    sandbox.run_setup("setup.py", ["build_ext", "--inplace"])
-+    result = subprocess.run(
-+        [sys.executable, "setup.py", "build_ext", "--inplace"],
-+        check=True,
-+    )
-+    if result.returncode != 0:
-+        sys.exit("Error building PE modules. Please check the output above.")
- 
- 
- def build_normal():
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index f879a7e052f7..aeacf086a87e 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -600,7 +600,7 @@ let
         hash = "sha256-tJ//HE7o9R8nSQDGhi+MKXdNUwnkCZI++CzpAmFn2YY=";
       })
     ]
-    ++ lib.optionals (chromiumVersionAtLeast "146" && lib.versionOlder llvmVersion "23") [
+    ++ lib.optionals (versionRange "146" "148" && lib.versionOlder llvmVersion "23") [
       # clang++: error: unknown argument: '-fsanitize-ignore-for-ubsan-feature=array-bounds'
       (fetchpatch {
         name = "chromium-146-revert-Update-fsanitizer=array-bounds-config.patch";
@@ -626,6 +626,47 @@ let
     ++ lib.optionals (chromiumVersionAtLeast "147" && lib.versionOlder llvmVersion "23") [
       # clang++: error: unknown argument: '-fno-lifetime-dse'
       ./patches/chromium-147-llvm-22.patch
+    ]
+    ++ lib.optionals (chromiumVersionAtLeast "148" && lib.versionOlder llvmVersion "23") [
+      # clang++: error: unknown argument: '-fsanitize-ignore-for-ubsan-feature=return'
+      (fetchpatch {
+        name = "chromium-148-revert-build-Add--fsanitizer=return-config.patch";
+        # https://chromium-review.googlesource.com/c/chromium/src/+/7629257
+        url = "https://chromium.googlesource.com/chromium/src/+/99ba1f5302f9433efdb4df302cb7b7de56c72e4c^!?format=TEXT";
+        decode = "base64 -d";
+        revert = true;
+        hash = "sha256-/qzzxwTdPMwIdsqD/G02S7kKHCj3QxECL+g1WYEaWmU=";
+      })
+      # ERROR Unresolved dependencies.
+      # //apps:apps(//build/toolchain/linux/unbundle:default)
+      #   needs //build/config/compiler:sanitize_return(//build/toolchain/linux/unbundle:default)
+      (fetchpatch {
+        name = "chromium-148-revert-build-Enable--fsanitizer=return-config.patch";
+        # https://chromium-review.googlesource.com/c/chromium/src/+/7629258
+        url = "https://chromium.googlesource.com/chromium/src/+/9357bfbea03753fe52264c9ec36abe74f48cfef5^!?format=TEXT";
+        decode = "base64 -d";
+        revert = true;
+        hash = "sha256-14fTHNh3vGsf4KgeH8uLX+aK3lrjK0VKd1dfK1g7r0I=";
+      })
+      # [33377/55552] LINK ./mksnapshot
+      # ld.lld: error: undefined symbol: __sanitizer_set_death_callback
+      # https://gitlab.archlinux.org/archlinux/packaging/packages/chromium/-/blob/148.0.7778.96-1/PKGBUILD#L168-174
+      (fetchpatch {
+        name = "archlinux-chromium-146-drop-unknown-clang-flag.patch";
+        url = "https://gitlab.archlinux.org/archlinux/packaging/packages/chromium/-/raw/148.0.7778.96-1/chromium-146-drop-unknown-clang-flag.patch";
+        hash = "sha256-jR0G9z2R8VGl2tkB3u0368RyWM1J6qYXqNWwKkYd5zU=";
+      })
+    ]
+    ++ lib.optionals (chromiumVersionAtLeast "148") [
+      # ninja: error: '../../third_party/rust-toolchain/bin/rustc', needed by 'phony/default_for_rust_host_build_tools_rust_bin_inputs', missing and no known rule to make it
+      (fetchpatch {
+        name = "chromium-148-revert-Reland-build-use-tool-inputs-instead-of-siso-config-for-rust-actions.patch";
+        # https://chromium-review.googlesource.com/c/chromium/src/+/7719879
+        url = "https://chromium.googlesource.com/chromium/src/+/9193ab90af24c23ee983e0a8da9bed45712f0d26^!?format=TEXT";
+        decode = "base64 -d";
+        revert = true;
+        hash = "sha256-7xg8IZ2gO+Wtnv7lWLVE3lLpcmMgvtDtcWwUuMBzkrE=";
+      })
     ];
 
     postPatch =
@@ -751,6 +792,12 @@ let
         sed -i 's/OFFICIAL_BUILD/GOOGLE_CHROME_BUILD/' tools/generate_shim_headers/generate_shim_headers.py
 
       ''
+      # https://chromium-review.googlesource.com/c/chromium/src/+/7677517
+      # ninja: error: '../../third_party/gperf/cipd/bin/gperf', needed by 'gen/third_party/blink/renderer/core/css/parser/at_rule_descriptors.cc', missing and no known rule to make it
+      + lib.optionalString (chromiumVersionAtLeast "148") ''
+        mkdir -p third_party/gperf/cipd/bin
+        ln -s "${pkgsBuildHost.gperf}/bin/gperf" third_party/gperf/cipd/bin/gperf
+      ''
       +
         lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform && stdenv.hostPlatform.isAarch64)
           ''
@@ -903,6 +950,11 @@ let
       # but lit_reactive_element.patch only patches the former.
       + lib.optionalString (chromiumVersionAtLeast "146") ''
         rm -r third_party/node/node_modules/@lit/reactive-element/development
+      ''
+      # Similarly, having @types/estree causes:
+      # error TS2352: Conversion of type 'Node[]' to type 'TSPropertySignature[]' [...]
+      + lib.optionalString (chromiumVersionAtLeast "148") ''
+        rm -r third_party/node/node_modules/@types/estree
       '';
 
     configurePhase = ''
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index c47cf4fbdab4..50cf1f4ec7db 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,6 +1,6 @@
 {
   "chromium": {
-    "version": "147.0.7727.137",
+    "version": "148.0.7778.96",
     "chromedriver": {
       "version": "147.0.7727.138",
       "hash_darwin": "sha256-d2dEPcR2mlfkL6XGhzMsgH/OwAI+yLXdS0dF4luPRfM=",
@@ -8,21 +8,21 @@
     },
     "deps": {
       "depot_tools": {
-        "rev": "d0e1a84d5b0c3c556b0fbdbeb77908d9817e6bbb",
-        "hash": "sha256-mc/W0D9MEtNQPeJ66X9T28IB+pvYqDRXj9UYb9hLlvA="
+        "rev": "41c40cfaec7ee3bf0423c59925d8b23982a601f1",
+        "hash": "sha256-s9uvmYHCJKWnNhztmOPb+OHj/HbGo30PupwT4mHWjnM="
       },
       "gn": {
-        "version": "0-unstable-2026-03-05",
-        "rev": "d8c2f07d653520568da7cace755a87dad241b72d",
-        "hash": "sha256-3AfExm7NL5GJXyC5JCPbGC70D59doRfIZIgpt6MLy9Y="
+        "version": "0-unstable-2026-04-01",
+        "rev": "6e8dcdebbadf4f8aa75e6a4b6e0bdf89dce1513a",
+        "hash": "sha256-BTPD8WM1pVAMkFDlHekMdWFGyf63KdhKkKwsqikqoBQ="
       },
-      "npmHash": "sha256-ByB1Ea5tduIJZXyydeBWsoS8OPABOgwHe+dNXRssdvc="
+      "npmHash": "sha256-JuVcY8iFRDWcPcP4Pg+qm5rnTXkiVfNsqSkXbDWqsE8="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "68ba233a543d25e75c30f1228dd3bafa2da96937",
-        "hash": "sha256-ktIkQRYWcyKnZKEhvxFGssMZ///ctd/Ue3VIYPvQzuM=",
+        "rev": "8625e066febc721e015ea99842da12901eb7ed73",
+        "hash": "sha256-coeBYfNPtiRRPuqoBRaxkTQI/a2pYNLI1slUdU1dZAc=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -32,8 +32,8 @@
       },
       "src/third_party/compiler-rt/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt.git",
-        "rev": "338a5c004c774a8927899b1f1c0c25a82d14510f",
-        "hash": "sha256-2lj4oF8IbJoPOBWwQ4ZfDQjPklxQyNyG5AcHazxEYcs="
+        "rev": "76287b5da8e155135536c8e3a67432d97d74fe3a",
+        "hash": "sha256-q6syHriTR8TCQSqTWbbAkVVK0a/i4wojdEGN7sWGxUY="
       },
       "src/third_party/libc++/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git",
@@ -47,13 +47,13 @@
       },
       "src/third_party/libunwind/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git",
-        "rev": "78884e23fe39cf5cc6987ea188a9b802d65a21c9",
-        "hash": "sha256-G8CtxDHzo8WtJ6qrtghXBoYCWwnDvXcAueEGzLc6C14="
+        "rev": "6ca46ff28e3578c57cbead6f233969eb3dabc176",
+        "hash": "sha256-JW4kqpVTCFDN4WZE2S5gEkX1O7eDycl+adm3KGlUoTU="
       },
       "src/third_party/llvm-libc/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git",
-        "rev": "c42ab4598a74eea2cf3efff9d44b22de155d41af",
-        "hash": "sha256-NJCdrmVyF80aQLtrdVgcWQadhj5w7nKrLShaZDen1GA="
+        "rev": "2a826f2fda3cf8d75b47cbc3bb1d9b244f13a6ab",
+        "hash": "sha256-OWe2lAT5XbADWuxHgg53lZiU0My/ys86FEXvn4zlVx0="
       },
       "src/chrome/test/data/perf/canvas_bench": {
         "url": "https://chromium.googlesource.com/chromium/canvas_bench.git",
@@ -72,18 +72,18 @@
       },
       "src/docs/website": {
         "url": "https://chromium.googlesource.com/website.git",
-        "rev": "d3b3b620e65ebaf511c6c8399b98a081cd644a66",
-        "hash": "sha256-xTGvhQUKOgt007WdvzN4eDpue8nheEMSV+Cl3Tnwviw="
+        "rev": "44319eca109f9678595924a90547c1f6650d8664",
+        "hash": "sha256-Trkan7bzRaLFlTkRfNGh7ssoZ3QpMh+mxQacsSM+d2I="
       },
       "src/media/cdm/api": {
         "url": "https://chromium.googlesource.com/chromium/cdm.git",
-        "rev": "9920660ea0162f88c44a648de177e6f8cb976d07",
-        "hash": "sha256-rC/aV3vsFzXQ8BiOIK+OTXxTsgTLEEqC19KDAot1PTs="
+        "rev": "33c977516b3dfe5b065bc298aa74175e1999ab51",
+        "hash": "sha256-GsaRxLnsz1jrFZ3m5tv65d1dioG23uJnmfa+WD7XcFc="
       },
       "src/net/third_party/quiche/src": {
         "url": "https://quiche.googlesource.com/quiche.git",
-        "rev": "435c98c0d9ab7a2b60592c5297635b4791745191",
-        "hash": "sha256-dhsq9kLRcXPxv0Ih6CQhDvLAGjh3EgSCl28Cxjk2aos="
+        "rev": "21ffbe4c7b717d00d2d768c259b5b330fd754ac3",
+        "hash": "sha256-yKMmfdSBvbB3T042TJbZ1Mw+y0kyfHP0knQVFWAFPTg="
       },
       "src/testing/libfuzzer/fuzzers/wasm_corpus": {
         "url": "https://chromium.googlesource.com/v8/fuzzer_wasm_corpus.git",
@@ -92,8 +92,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "534e0d1c1d0fcb4b57fd6a3fb9284cd14eaa28cd",
-        "hash": "sha256-o3UV8X27G7wpaDiKDzgMZN64+d9JQrvcQXpSybxi/h4="
+        "rev": "cc0e3572e8789f4a184dd9714a04b3d98ae81015",
+        "hash": "sha256-3KVTEBcnQTn99ccdKzylzUvua2jlS4g8/nfIDdLk6ug="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -107,8 +107,8 @@
       },
       "src/third_party/angle/third_party/VK-GL-CTS/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/VK-GL-CTS",
-        "rev": "1cf4ed5bc0620ea514404609b1a2958c4518b86d",
-        "hash": "sha256-IZ5tVrld2+wDOWaYX93j2eLZJJs/EMW1+FtxhOeWi6w="
+        "rev": "f52e89f885064b9109501bca16c813bb29389993",
+        "hash": "sha256-3jx4QVR9nB3WggfrORGJGifmJQhAYVSPusa7RlR16qg="
       },
       "src/third_party/anonymous_tokens/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/anonymous-tokens.git",
@@ -127,48 +127,53 @@
       },
       "src/third_party/dav1d/libdav1d": {
         "url": "https://chromium.googlesource.com/external/github.com/videolan/dav1d.git",
-        "rev": "b546257f770768b2c88258c533da38b91a06f737",
-        "hash": "sha256-E3da/LJ8HNy1osExmupovqnL8JHgVNzPUCG5F8TJKXQ="
+        "rev": "d69235dd804b24c04ed05639cffcc912cd6cfd75",
+        "hash": "sha256-iKq6TYscIBK4ydv+0msNV3tcs82Ljk5ZNr954Qv2lII="
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "049880d58d6636a819168c00f44f8a4ed1e33e51",
-        "hash": "sha256-AHUos4ejvcsHTDdretkDHAeyLugtI6Jg14Hb9MbbPPs="
+        "rev": "19696dd088b8ed5804e2f02a8f83f5afdb3e99e3",
+        "hash": "sha256-ihnVPCk9412UzCmoABWVUhiGaIdIYxiYMkk43KDqpg8="
       },
-      "src/third_party/dawn/third_party/glfw": {
+      "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
-        "rev": "b35641f4a3c62aa86a0b3c983d163bc0fe36026d",
-        "hash": "sha256-E1zXIDiw87badrLOZTvV+Wh9NZHu51nb70ZK9vlAlqE="
+        "rev": "043378876a67b092f5d0d3d9748660121a336dd3",
+        "hash": "sha256-4QSD1/uxWfYZPMjShB0h639eqAfuBRXAVfOm6BbZCBs="
       },
       "src/third_party/dawn/third_party/dxc": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectXShaderCompiler",
-        "rev": "2888a8764a33693f5a351e0c4ec87f430ccb0f7a",
-        "hash": "sha256-xAe7SdcOeNiqNF6pYwMPMnd9/2yTWUlVdH1aCco/PEo="
+        "rev": "eb67a9085c758516d940e1ce3fed0acfb6518209",
+        "hash": "sha256-z+yIuVweIyLdOiZDRfSppjTRoYq8S93+JNUla4Umot8="
       },
       "src/third_party/dawn/third_party/dxheaders": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectX-Headers",
         "rev": "980971e835876dc0cde415e8f9bc646e64667bf7",
         "hash": "sha256-0Miw1Cy/jmOo7bLFBOHuTRDV04cSeyvUEyPkpVsX9DA="
       },
-      "src/third_party/dawn/third_party/khronos/OpenGL-Registry": {
+      "src/third_party/dawn/third_party/directx-headers/src": {
+        "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectX-Headers",
+        "rev": "980971e835876dc0cde415e8f9bc646e64667bf7",
+        "hash": "sha256-0Miw1Cy/jmOo7bLFBOHuTRDV04cSeyvUEyPkpVsX9DA="
+      },
+      "src/third_party/dawn/third_party/OpenGL-Registry/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/OpenGL-Registry",
         "rev": "5bae8738b23d06968e7c3a41308568120943ae77",
         "hash": "sha256-K3PcRIiD3AmnbiSm5TwaLs4Gu9hxaN8Y91WMKK8pOXE="
       },
-      "src/third_party/dawn/third_party/khronos/EGL-Registry": {
+      "src/third_party/dawn/third_party/EGL-Registry/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/EGL-Registry",
         "rev": "7dea2ed79187cd13f76183c4b9100159b9e3e071",
         "hash": "sha256-Z6DwLfgQ1wsJXz0KKJyVieOatnDmx3cs0qJ6IEgSq1A="
       },
       "src/third_party/dawn/third_party/webgpu-cts": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts",
-        "rev": "d213d4b8dba58ca7a0685e30cfaf1d29f4fc5d5b",
-        "hash": "sha256-6YGLG9BMQbF2pjV40su5ddHMqDW8/CEwM3RDEc/t2kM="
+        "rev": "09fdb847d90d0b5bfe57068ce2eb9283cb77fc7f",
+        "hash": "sha256-eTAwnTiAHq8rmbw7u9nAwSuAlS5adStUJKfITlYkcgU="
       },
       "src/third_party/dawn/third_party/webgpu-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webgpu-native/webgpu-headers",
-        "rev": "b2b04dde36a941434c88ccff7a730d7e464d638c",
-        "hash": "sha256-+/qXZNkm26p+becMVcyHNUPyEUCejSV+tyTGFE4ivak="
+        "rev": "7d3186c3dd2c708703524027b46b8703534ab3cc",
+        "hash": "sha256-yE3/mfhqc7YtVNg4f/nrUpuRUGRjOzdwl++vPvd+mvc="
       },
       "src/third_party/highway/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/highway.git",
@@ -182,13 +187,13 @@
       },
       "src/third_party/libpfm4/src": {
         "url": "https://chromium.googlesource.com/external/git.code.sf.net/p/perfmon2/libpfm4.git",
-        "rev": "964baf9d35d5f88d8422f96d8a82c672042e7064",
-        "hash": "sha256-awpZ22rovLZWQkX/qog93vL4u2gJ+F3w5IGFNlZ0heQ="
+        "rev": "977a25bb3dfe45f653a6cee71ffaae9a92fc3095",
+        "hash": "sha256-t4LMG38GksMEM5DktyJ0qLUX1biXErQ57MaMtd7hoeo="
       },
       "src/third_party/boringssl/src": {
         "url": "https://boringssl.googlesource.com/boringssl.git",
-        "rev": "27bc28d7f03fb9e3752980dce01de1a529236532",
-        "hash": "sha256-u+yvIPrdb9fWzJXJeIidUQ1MkKUx6sKLs7vdW68QhYc="
+        "rev": "d8be2b4a71155bf82da092ef543176351eeb59ff",
+        "hash": "sha256-fZc95YrREDbf0YcO6zahIjdX6TcRJANcH9MrkLIIIHw="
       },
       "src/third_party/breakpad/breakpad": {
         "url": "https://chromium.googlesource.com/breakpad/breakpad.git",
@@ -202,13 +207,13 @@
       },
       "src/third_party/catapult": {
         "url": "https://chromium.googlesource.com/catapult.git",
-        "rev": "e0ebf38a01214aba11f31daa1c743782def031d5",
-        "hash": "sha256-njtIcvzo2v9uDuP+AostVAZRTtH2vePsshF4cANHkxo="
+        "rev": "4f1d71f6841d210b3a06ab3ef2e2ed679af0ee56",
+        "hash": "sha256-aHlf8gw3KxbKoyyajP4w586iYybx7HSkcKtLcZIgiDE="
       },
       "src/third_party/catapult/third_party/webpagereplay": {
         "url": "https://chromium.googlesource.com/webpagereplay.git",
-        "rev": "22be07d7809409644d7e292d9495fa8a251d5f29",
-        "hash": "sha256-HR6iEDwmxFaiLi+h3MwsNfBOtBNbrKvmRNgMVog3A0Y="
+        "rev": "be48b5e3387780790ecc7723434b6ea6733bcc33",
+        "hash": "sha256-KcFUlQMltsMm4WlTVMLzZXfrvu67ffkKjmBcruwZye0="
       },
       "src/third_party/ced/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/compact_enc_det.git",
@@ -232,8 +237,8 @@
       },
       "src/third_party/cpuinfo/src": {
         "url": "https://chromium.googlesource.com/external/github.com/pytorch/cpuinfo.git",
-        "rev": "7364b490b5f78d58efe23ea76e74210fd6c3c76f",
-        "hash": "sha256-lB6e5zcw5UiwTOf+a+B35apXP5t1bxI6yOMiEeFwIwY="
+        "rev": "7607ca500436b37ad23fb8d18614bec7796b68a7",
+        "hash": "sha256-LnLtCMMRg+DwB7MijBdt/tmCKD/zN5y2oTgXlYw3hTg="
       },
       "src/third_party/crc32c/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/crc32c.git",
@@ -242,28 +247,28 @@
       },
       "src/third_party/cros_system_api": {
         "url": "https://chromium.googlesource.com/chromiumos/platform2/system_api.git",
-        "rev": "1fb70b2851b292e48b612482a6d4d1b4c343c862",
-        "hash": "sha256-YBN8ogJn5Yup9GYrsE9UW15KPCuXbhD6hdqXWWCPD20="
+        "rev": "c27a09148de373889e5d2bf616c4e85a68050ae2",
+        "hash": "sha256-a/mAa1+if6B1FHe9crO8PDpc3o8M+CeIuXjXT0lwZOY="
       },
       "src/third_party/crossbench": {
         "url": "https://chromium.googlesource.com/crossbench.git",
-        "rev": "19cee54825bc57215266f5b14a5874bfbbb57543",
-        "hash": "sha256-HVwX8E3/7yw7zUqZrptN1iSBWF4ls0FAzPObPagNYtM="
+        "rev": "c179f7919aade97c5cff64d14b9171736e7aaef9",
+        "hash": "sha256-Hxazf58z9imnGO1aj2NRtsQ+BYrfAuIuZscADpr1NVI="
       },
       "src/third_party/crossbench-web-tests": {
         "url": "https://chromium.googlesource.com/chromium/web-tests.git",
-        "rev": "909ad1733b50f28510c840ebad7b878a5ce07715",
-        "hash": "sha256-RYih9sn4rIBnFW/styZaUl5H0A1eEy3//DypZjY6n0M="
+        "rev": "b19e4e52c33fb8a105c3fc99598b0b9b4bc59752",
+        "hash": "sha256-7vCQw91L2c97dnVdrJ53zL8hi0KZffDJJjk7GaG3b/U="
       },
       "src/third_party/depot_tools": {
         "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git",
-        "rev": "4ce8ba39a3488397a2d1494f167020f21de502f3",
-        "hash": "sha256-WTzjmLFjh1yDDEvYE7Qfx8aBxMLdATx14+Jprwh8ZgQ="
+        "rev": "41c40cfaec7ee3bf0423c59925d8b23982a601f1",
+        "hash": "sha256-s9uvmYHCJKWnNhztmOPb+OHj/HbGo30PupwT4mHWjnM="
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "854a02be78c7ffea104cb523636efa991bef5c5b",
-        "hash": "sha256-CzzUueh2QXX+ExGqh5+JpnDoWF8DiFDff7fWmC01xfg="
+        "rev": "6efd6eb1d85fd67fdcc2385c54fa56c524bec3f7",
+        "hash": "sha256-1pr3+RK519m+wtcacJB3PcDTL+qSHlOn1ctxpoLzTf8="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -277,8 +282,8 @@
       },
       "src/third_party/eigen3/src": {
         "url": "https://chromium.googlesource.com/external/gitlab.com/libeigen/eigen.git",
-        "rev": "54458cb39d1081d0cfe6b77ed8e085d457a4c921",
-        "hash": "sha256-WXxSe2AY3hSMXz7lHNeFefOHGGkdXoSQLC6FuOa6Exo="
+        "rev": "a3074053a614df7a3896cb4edbcba40222a5f549",
+        "hash": "sha256-9AHpSqemqdwXoMiP3hH1YuEd3+nrudeVGTpInw+8BU4="
       },
       "src/third_party/farmhash/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/farmhash.git",
@@ -292,13 +297,13 @@
       },
       "src/third_party/federated_compute/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google-parfait/federated-compute.git",
-        "rev": "271aa00f8aec5bc801f542710efe1b2f0b5f0ef9",
-        "hash": "sha256-6ZATBYkyIdGuhG0Ps2vr0DT9nq1LhW2XCWWAkiZh9Hc="
+        "rev": "eb170f645b270c7979edb863fd2cf8edab2b2fd1",
+        "hash": "sha256-Cp0WQBbqWvPdrKCMQhH4Z6zl6YlIPLjafWZEwdkYWlc="
       },
       "src/third_party/ffmpeg": {
         "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git",
-        "rev": "946d97db8d906277085e361892b7efda5152e2f1",
-        "hash": "sha256-UxrmVqfX6TvFy1yxWXIQbd3ABD3jEAtDesgfnbJGg1E="
+        "rev": "b5e18fb9da84e26ceef30d4e4886696bf59337c0",
+        "hash": "sha256-JHAicFKBvtkwmZPRBKYPT6JVqYqF8hyXxU0H7kfgCBs="
       },
       "src/third_party/flac": {
         "url": "https://chromium.googlesource.com/chromium/deps/flac.git",
@@ -327,18 +332,18 @@
       },
       "src/third_party/freetype/src": {
         "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git",
-        "rev": "45556a19aab9502b91d6f30931e0cb5256f683f8",
-        "hash": "sha256-eMt2orPeG81o42O/HU+4B5b/G62TYAVIEeWwOmiML14="
+        "rev": "99b479dc34728936b006679a31e12b8cf432fc55",
+        "hash": "sha256-H5RzBFYWIp/QYKyeBM2wfuX7FvXHPbhCAp7qne5Zvhw="
       },
       "src/third_party/fxdiv/src": {
         "url": "https://chromium.googlesource.com/external/github.com/Maratyszcza/FXdiv.git",
         "rev": "63058eff77e11aa15bf531df5dd34395ec3017c8",
         "hash": "sha256-LjX5kivfHbqCIA5pF9qUvswG1gjOFo3CMpX0VR+Cn38="
       },
-      "src/third_party/harfbuzz-ng/src": {
+      "src/third_party/harfbuzz/src": {
         "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git",
-        "rev": "5d4e96ad8d00fc871ffa17707b2ca08fa850e7d6",
-        "hash": "sha256-9ef1P2JVJc7ZiP7TObFOxJbccCLsEgjhj+Z/ooEAGiI="
+        "rev": "4fc96139259ebc35f40118e0382ac8037d928e5c",
+        "hash": "sha256-/RT2OPWFiVwFqmNS4o+gE0JrcVO1cQDkCkgrSEe7BzE="
       },
       "src/third_party/ink/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ink.git",
@@ -347,13 +352,13 @@
       },
       "src/third_party/ink_stroke_modeler/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ink-stroke-modeler.git",
-        "rev": "3fa5129ed1ae6f8b2ec4e9b60fa5d08cc81e2d78",
-        "hash": "sha256-/TBxFsmLH1h3kfeE90LhR0RWJ3NrCTiLKklcaPbean8="
+        "rev": "da42d439389c90ec7574f0381ec53e7f5be0c2eb",
+        "hash": "sha256-W5HgVe0v9O/EuhpKMHp83PLq4p6cuBul3QUGLYdF6rY="
       },
       "src/third_party/instrumented_libs": {
         "url": "https://chromium.googlesource.com/chromium/third_party/instrumented_libraries.git",
-        "rev": "69015643b3f68dbd438c010439c59adc52cac808",
-        "hash": "sha256-8kokdsnn5jD9KgM/6g0NuITBbKkGXWEM4BMr1nCrfdU="
+        "rev": "e8cb570a9a2ee9128e2214c73417ad2a3c47780b",
+        "hash": "sha256-5cb9qhSEzb941pF5HH0Br+x9wEH7MiGwQttvErb2mZo="
       },
       "src/third_party/emoji-segmenter/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/emoji-segmenter.git",
@@ -387,8 +392,8 @@
       },
       "src/third_party/icu": {
         "url": "https://chromium.googlesource.com/chromium/deps/icu.git",
-        "rev": "ee5f27adc28bd3f15b2c293f726d14d2e336cbd5",
-        "hash": "sha256-UQWSAekvYc1bTEAEQTPdeB406Uqb0mptpnGRZSaLewo="
+        "rev": "ff7995a708a10ab44db101358083c7f74752da9f",
+        "hash": "sha256-yQ55MGzqkVkp/arTlmKqySBvQFtaPaBk9UUAFE0imhE="
       },
       "src/third_party/nlohmann_json/src": {
         "url": "https://chromium.googlesource.com/external/github.com/nlohmann/json.git",
@@ -402,8 +407,8 @@
       },
       "src/third_party/leveldatabase/src": {
         "url": "https://chromium.googlesource.com/external/leveldb.git",
-        "rev": "4ee78d7ea98330f7d7599c42576ca99e3c6ff9c5",
-        "hash": "sha256-ANtMVRZmW6iOjDVn2y15ak2fTagFTTaz1Se6flUHL8w="
+        "rev": "7ee830d02b623e8ffe0b95d59a74db1e58da04c5",
+        "hash": "sha256-a1fcVI9Vsm1qE17Fnx5UxwOy4ZFMMJ0OKwNs/gZHYQI="
       },
       "src/third_party/libFuzzer/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt/lib/fuzzer.git",
@@ -412,8 +417,8 @@
       },
       "src/third_party/fuzztest/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git",
-        "rev": "1f7726d61f7afa9aca1198a9395ede472ed70366",
-        "hash": "sha256-RhJ676e6Kr/muR0ZCfZOAcs3kfoK7CjG2cwOpYG/JCY="
+        "rev": "800c545cf9d6e9c01328a1974f93a7e6564a74fd",
+        "hash": "sha256-Pvz+CWTBcWE0N0yfNGZhXDgUrGeIaCNfEjP1jYmF6G0="
       },
       "src/third_party/domato/src": {
         "url": "https://chromium.googlesource.com/external/github.com/googleprojectzero/domato.git",
@@ -427,13 +432,13 @@
       },
       "src/third_party/libaom/source/libaom": {
         "url": "https://aomedia.googlesource.com/aom.git",
-        "rev": "ab9876a5983227865ee26e91caac87c6b8750e27",
-        "hash": "sha256-V40GL7fKj1qratP0KcrhedEPDIsg0XVb3ha5nroM0ws="
+        "rev": "b63f30b6d30028a3d7d9c5223def8f3ad97dcc4c",
+        "hash": "sha256-LaBEcVcSB8WB9ZNRgPSiGaKdQL5f3wll2sPb9OhN5SE="
       },
       "src/third_party/crabbyavif/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git",
-        "rev": "c05daf3e2e6d83f2a359ab97094ce042944020a9",
-        "hash": "sha256-vVKAgvPdba0Lt3BUStOQsILlhiHNJeIv1jS9691+a80="
+        "rev": "7466a44ac80893803d4a7168b98dc6cd02d1fe2d",
+        "hash": "sha256-x1MRNtGLmwlRNenoQKz2Bgm3J5eHlNiJZtzhT9lttmk="
       },
       "src/third_party/nearby/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/nearby-connections.git",
@@ -487,8 +492,8 @@
       },
       "src/third_party/cros-components/src": {
         "url": "https://chromium.googlesource.com/external/google3/cros_components.git",
-        "rev": "ddb611c60142c72be3719e753a42fb434b6f2458",
-        "hash": "sha256-M/b7PKEu+mFxsEeedJeppkwl8aZnX/932zqWlrCx8Y4="
+        "rev": "fb512780dcc5ba4b5be9e8a3118919002077c760",
+        "hash": "sha256-7wx73HZ6aqXQvLxwX6XnJAPefi/t47gIhvDH3FRT1j4="
       },
       "src/third_party/libdrm/src": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/libdrm.git",
@@ -497,8 +502,8 @@
       },
       "src/third_party/expat/src": {
         "url": "https://chromium.googlesource.com/external/github.com/libexpat/libexpat.git",
-        "rev": "69d6c054c1bd5258c2a13405a7f5628c72c177c2",
-        "hash": "sha256-qe8O7otL6YcDDBx2DS/+c5mWIS8Rf8RQXVtLFMIAeyk="
+        "rev": "f31adfd584b7f6c50bbf4d22eb928538ffc9145a",
+        "hash": "sha256-tLz4RejYQ/kFXhsWTduuGcinfUkqxYKPCpsou+WlvBc="
       },
       "src/third_party/libipp/libipp": {
         "url": "https://chromium.googlesource.com/chromiumos/platform2/libipp.git",
@@ -542,13 +547,13 @@
       },
       "src/third_party/libvpx/source/libvpx": {
         "url": "https://chromium.googlesource.com/webm/libvpx.git",
-        "rev": "aec2a6f1cd6e3d9e8cf5d9682fcb8a442799bd22",
-        "hash": "sha256-PNreh1VisA46I0WZqq8wZRCjbQRiVMxbL5Gl2Bfzo3M="
+        "rev": "47ac1ec7f3de7d7cb3d070844c427c8f1fa9d6fc",
+        "hash": "sha256-RyYnkLYafiS6kQKeOmzohtxFRXudDzgEmQkG+qKHozc="
       },
       "src/third_party/libwebm/source": {
         "url": "https://chromium.googlesource.com/webm/libwebm.git",
-        "rev": "f2a982d748b80586ae53b89a2e6ebbc305848b8c",
-        "hash": "sha256-SxDGt7nPVkSxwRF/lMmcch1h+C2Dyh6GZUXoZjnXWb4="
+        "rev": "b7a1e4767fbb02ad467f45ba378e858e897028da",
+        "hash": "sha256-Lzfs15Us8MDDQYvLRVf6xKg9A76aXPnTukx/A8Mf7rw="
       },
       "src/third_party/libwebp/src": {
         "url": "https://chromium.googlesource.com/webm/libwebp.git",
@@ -577,8 +582,8 @@
       },
       "src/third_party/nasm": {
         "url": "https://chromium.googlesource.com/chromium/deps/nasm.git",
-        "rev": "af5eeeb054bebadfbb79c7bcd100a95e2ad4525f",
-        "hash": "sha256-vH3OUzfLZbaPY4DMAvSW0jKYRJmOa7aE8EfIJtZ1/Xs="
+        "rev": "45252858722aad12e545819b2d0f370eb865431b",
+        "hash": "sha256-0KsHYi76IaVNwk0dBhem2AnUXd9PpeS+jUsY+zPmeJ8="
       },
       "src/third_party/neon_2_sse/src": {
         "url": "https://chromium.googlesource.com/external/github.com/intel/ARM_NEON_2_x86_SSE.git",
@@ -592,8 +597,8 @@
       },
       "src/third_party/openscreen/src": {
         "url": "https://chromium.googlesource.com/openscreen",
-        "rev": "571620ad60afc9f317d77605c65335f5412aada2",
-        "hash": "sha256-ktR3EpmkjueEmEip2oUTcSclVkUlPi/7+qmhElG+Bzs="
+        "rev": "448a19d1f24e0f8ce85ad0c1c6a50cf370ae69d7",
+        "hash": "sha256-hRDFnoqAH4HoWZ3oTWlzNge2nwlxpUC/GEq0MQVzBw8="
       },
       "src/third_party/openscreen/src/buildtools": {
         "url": "https://chromium.googlesource.com/chromium/src/buildtools",
@@ -607,13 +612,13 @@
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "e5bafd3be58c26673576fd5bb5cbf413b485de5b",
-        "hash": "sha256-umtG2n6kWYD0hT44GpmnwUVztkZ0RtQDV0h0+4CTC9w="
+        "rev": "a78c62d93a8f514ea2cd98a70bd1d21226be9d93",
+        "hash": "sha256-qd3Oa/JFzoI5hKDY2/OQAzdr2z9srUj0H6oKz0R516U="
       },
       "src/third_party/perfetto": {
         "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
-        "rev": "728eb5626a3bc701d044dd16d9cd289360ff47c3",
-        "hash": "sha256-LeGGkzSMfVXuioVJmRi/TjMYgG/0YrK7PckBJTejSHU="
+        "rev": "46432bb2a7a60e10fcee516f1692e6846d098a8d",
+        "hash": "sha256-jVih4xWota4SZQi4yEtaIP+4qgD03OsELt2aaulIXik="
       },
       "src/third_party/protobuf-javascript/src": {
         "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript",
@@ -627,8 +632,8 @@
       },
       "src/third_party/pyelftools": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git",
-        "rev": "19b3e610c86fcadb837d252c794cb5e8008826ae",
-        "hash": "sha256-I/7p3IEvfP/gkes4kx18PvWwhAKilQKb67GXoW4zFB4="
+        "rev": "8047437615d66d3267ac0134834b80e70639d572",
+        "hash": "sha256-rEnt08K90/Psfa+SQgTUG3YGrhp4/udXG9VKIwPM7pk="
       },
       "src/third_party/quic_trace/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/quic-trace.git",
@@ -657,8 +662,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "6e0fbe154ccaf018b2dd1f0e42eec285e7d79d00",
-        "hash": "sha256-oqfNOSQB+5sbAnw4tPBXn22rk6Ai5b2aZNLJUyM181k="
+        "rev": "afe8b760ada5128164f9826866b4381a3463df41",
+        "hash": "sha256-HsKHffZWTls362kjokxzdhaxb/xJD1g70VHGk9l6GVM="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -672,13 +677,13 @@
       },
       "src/third_party/sqlite/src": {
         "url": "https://chromium.googlesource.com/chromium/deps/sqlite.git",
-        "rev": "727f7c8991f7b622a8b5c833cff99871a8c2cd8e",
-        "hash": "sha256-L42hkqcsuyMkNUeornIul7AYNgachkYpfNFE8H/VeVc="
+        "rev": "508ab21dc25702ed6690c4dd77da209a6bcd1239",
+        "hash": "sha256-SfvLfBKdPjFvZ7CzUeFMcyoHdCzQgNRQwZyzb6MRtJg="
       },
       "src/third_party/swiftshader": {
         "url": "https://swiftshader.googlesource.com/SwiftShader.git",
-        "rev": "313545f85af72f954820e54f4110cda591a6cf7b",
-        "hash": "sha256-EGgC5nK68Wk0b466K9yvLlGMxBd/CeI+KTgyoE+x6DY="
+        "rev": "89556131bf9d48af3c5c9fbb9a3322e706da89a3",
+        "hash": "sha256-h0utcwCnzwhFufggkBNeA674x2Kqwu4sz3jQ/9eoQv0="
       },
       "src/third_party/text-fragments-polyfill/src": {
         "url": "https://chromium.googlesource.com/external/github.com/GoogleChromeLabs/text-fragments-polyfill.git",
@@ -687,23 +692,23 @@
       },
       "src/third_party/tflite/src": {
         "url": "https://chromium.googlesource.com/external/github.com/tensorflow/tensorflow.git",
-        "rev": "b476481b77f6e939e813ac93df22a4a6e7a3dd57",
-        "hash": "sha256-oKLFjed5sbYjEX5kddkAEdhkVOwFf5ddEUlOS55zLWE="
+        "rev": "de8d7f65b6eb670e4dad0225d0d6f99bebaab559",
+        "hash": "sha256-r2b+/VBffxsh1sRM2xcFiBx9K6GD6FsaQXpfFMBFUag="
       },
       "src/third_party/litert/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google-ai-edge/LiteRT.git",
-        "rev": "82bf3bef8a04a416bcb9d1cca5bdd51a6b3ab4ba",
-        "hash": "sha256-uMBuoGQIgRhmc8KJqLUnf13XK9tveuS0/OzzwKHKNUw="
+        "rev": "588075c77c6895cce6397d41d2890b1aa0a14372",
+        "hash": "sha256-rcEPZNSV0DiDrmoBCtJ07wFzzpmpM93jG4jYaEdNWvI="
       },
       "src/third_party/vulkan-deps": {
         "url": "https://chromium.googlesource.com/vulkan-deps",
-        "rev": "4a9f2cec3d5e7cb4810cf84716f597aff768ffa4",
-        "hash": "sha256-PyBxtzesZR/5jrWt96DxK7QwRoG8qhzWzbiE1fqdqkI="
+        "rev": "0ced1107c62836f439f684a5696c4bd69e09fce3",
+        "hash": "sha256-VOyN618wzyyO2Wh18gCnw+FCr/NbegX3A/54MClyhwc="
       },
       "src/third_party/glslang/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/glslang",
-        "rev": "b11b03839c940685b0201026bd2a4ffef1d5a4b8",
-        "hash": "sha256-FjUqETWBiI91hq5wGomPmCeW7K4k9kn5r74pUP0QFNo="
+        "rev": "715c8500e7cd67f2eba9e60e98852a1ed49d2f15",
+        "hash": "sha256-vSbMdTjlRVvYLi5ZvTVmfe76oAQ4AhqyD+ohvkvIYIs="
       },
       "src/third_party/spirv-cross/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Cross",
@@ -712,38 +717,38 @@
       },
       "src/third_party/spirv-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Headers",
-        "rev": "f88a2d766840fc825af1fc065977953ba1fa4a91",
-        "hash": "sha256-VhcGQ+Tr9sH0ZEIk0oJsXh8MvCo2qpA2W3i8YVCwKaE="
+        "rev": "6dd7ba990830f7c15ac1345ff3b43ef6ffdad216",
+        "hash": "sha256-UKBVs2s05hP+paPq1dZFaUEQQ9Kx9acHxYUyJVx22eY="
       },
       "src/third_party/spirv-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Tools",
-        "rev": "7d8d9e58c384949f1615c069d4c9346bf51b9738",
-        "hash": "sha256-AxS7vHw3RoXZLayWEDKBU7H0M1BZ9RMVdIsD/4rYap8="
+        "rev": "2d14d2e76aa7de72404b17078eda15c20a6a0389",
+        "hash": "sha256-8Xtzq8WOdFEw+uEJqMW39LLHt2m165K9OJsIFZuifoM="
       },
       "src/third_party/vulkan-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Headers",
-        "rev": "74d8a6cb930c68ef617b202c3ff3c59d919e086b",
-        "hash": "sha256-bZKNFiZMVYDxa6RKb1c/GxIR+eEFQAyYNaEptzQW5TE="
+        "rev": "afe9eb980aa928a66d1c9c06f38c55dd59868720",
+        "hash": "sha256-/yolWlC7ruRiJ0gSdCoSlqL9+j2uJAh+o+H0OG37pq4="
       },
       "src/third_party/vulkan-loader/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Loader",
-        "rev": "363f465abadab0a8dcfc5c85d2c691e9b0b788d6",
-        "hash": "sha256-Zk2QyKu19g52vzGpNq5Qm+mlEgqk4jCFn/861eK8+64="
+        "rev": "df84d2be47457a8dfd7eb66f8c2b031683bd1ba5",
+        "hash": "sha256-8ParcURRRU3eS9Oej/vHTwOwvYy3HsVJsKh2wQLKUgM="
       },
       "src/third_party/vulkan-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Tools",
-        "rev": "59f963ce1b1d16cc92137a241a0fe98d637d21f4",
-        "hash": "sha256-Hh0N4N4XN7p7PBKk2uCU5g9TO9vmxJbomC1Gvf5oDZc="
+        "rev": "90bf5bc4fd8bea0d300f6564af256a51a34124b8",
+        "hash": "sha256-tmTD/waVX/duaKXvj0FNUS+ncL1agM73kK7pEfHEsSA="
       },
       "src/third_party/vulkan-utility-libraries/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Utility-Libraries",
-        "rev": "20fb10eb1ec08ccd5cacec32b7df1b0e99e48a0c",
-        "hash": "sha256-4XsQN94JsQXFGwJKp3W2gdTCCxUZrpCKiRVXzxL+Qs0="
+        "rev": "48b1fd1a65e436bae806cb6180c9338846b9de97",
+        "hash": "sha256-B3GXmwJEvnGcER5DJt0FGrwqNi3t8iV6VgX8uOrExlU="
       },
       "src/third_party/vulkan-validation-layers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-ValidationLayers",
-        "rev": "20948525099c0ea030ec5b149c809e48010be4ed",
-        "hash": "sha256-H05Ms2a770ApiCz5ERiIm8g893TJG9gRRuM9Qr4bj60="
+        "rev": "ac146eef210b6f52b842111c5d3419ab32a7293f",
+        "hash": "sha256-GqjVHxtda1a47+9G+nqh4qNMJmQaUdZNMUGQ8kAIIkk="
       },
       "src/third_party/vulkan_memory_allocator": {
         "url": "https://chromium.googlesource.com/external/github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator.git",
@@ -777,23 +782,23 @@
       },
       "src/third_party/webgl/src": {
         "url": "https://chromium.googlesource.com/external/khronosgroup/webgl.git",
-        "rev": "8fc2a0dff53abfc0cf2c140d8420759b2036cc54",
-        "hash": "sha256-cU7kfmxgaem6rPHGW+VwjxfKe7c0u1tCc98MQjsp5l8="
+        "rev": "216b10fafd3f6a900c715a8c758a4c7f9883b030",
+        "hash": "sha256-Aax2hr/9Zq6Avk+TMU1OMBLGshUL6hyRTX6eoOQesqM="
       },
       "src/third_party/webgpu-cts/src": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts.git",
-        "rev": "54441b8d176b12a5e2b01b8db78191ace56d7f34",
-        "hash": "sha256-gGvvKMTUJGm4ZwM7C1xTY1DKskCmlrCpSl3HLgVZqoY="
+        "rev": "09fdb847d90d0b5bfe57068ce2eb9283cb77fc7f",
+        "hash": "sha256-eTAwnTiAHq8rmbw7u9nAwSuAlS5adStUJKfITlYkcgU="
       },
       "src/third_party/webpagereplay": {
         "url": "https://chromium.googlesource.com/webpagereplay.git",
-        "rev": "22be07d7809409644d7e292d9495fa8a251d5f29",
-        "hash": "sha256-HR6iEDwmxFaiLi+h3MwsNfBOtBNbrKvmRNgMVog3A0Y="
+        "rev": "be48b5e3387780790ecc7723434b6ea6733bcc33",
+        "hash": "sha256-KcFUlQMltsMm4WlTVMLzZXfrvu67ffkKjmBcruwZye0="
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "28452dff1bf86fec881a47949d4dedd4a2fe1f09",
-        "hash": "sha256-KBz94jvdVgxWuTuSoeHKNdY7wEJDGqG3xVsSVB3ubRQ="
+        "rev": "9600e77d854090669817d22aa2fc941ee92aaacd",
+        "hash": "sha256-jTJv53qt971Va5q6MaULysYiChBVmsFYxG9fzkcE0ak="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -805,25 +810,20 @@
         "rev": "b65be9e699847c975440108a42f05412cc7fddac",
         "hash": "sha256-PySen9syu0OshtlHAZw666FeSQXdnsV8nlW9RmxgapM="
       },
-      "src/third_party/xdg-utils": {
-        "url": "https://chromium.googlesource.com/chromium/deps/xdg-utils.git",
-        "rev": "cb54d9db2e535ee4ef13cc91b65a1e2741a94a44",
-        "hash": "sha256-WuQ9uDq+QD17Y20ACFGres4nbkeOiTE2y+tY1avAT5U="
-      },
       "src/third_party/xnnpack/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/XNNPACK.git",
-        "rev": "abd8e60edf09db5f5ba8e7fa2f1fcab0ae0807e1",
-        "hash": "sha256-VdrA2UwQ7/kHbnlIXBmga3ZjAqWaxCDQcDAssbLrh/M="
+        "rev": "1812bbe2928a32f26c5e48466712ba6460cf290c",
+        "hash": "sha256-xal21wjgeql3MjQXw6F1ezcRsnhVKod5jv0nYWroJ1o="
       },
       "src/third_party/zstd/src": {
         "url": "https://chromium.googlesource.com/external/github.com/facebook/zstd.git",
-        "rev": "1168da0e567960d50cba1b58c9b0ba047ece4733",
-        "hash": "sha256-T2CwRpL/XT/OsBrRfxC8kNIm43U4qPMBju8Ug13Qebo="
+        "rev": "3ae099b48dfcfe02b1b3ba81ab85457f8a922e9f",
+        "hash": "sha256-futF0sM6z9HAl6AMJwUULBRByN92FTBjRIzYb2vBFGg="
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "c152c31c55cd54fd239772532a86c802d95b4617",
-        "hash": "sha256-7qEPh9l94LqyaA9qW0ZfFmmFyMNTjTJaeunLgDhtFuM="
+        "rev": "ddc9a95905de5268332a8f0216dc2bc67d26e829",
+        "hash": "sha256-x2FGL3J+JaWO1m6jBrcayR7Vlz90fYEAuufm4PULYyM="
       }
     }
   },
diff --git a/pkgs/applications/networking/browsers/chromium/update.mjs b/pkgs/applications/networking/browsers/chromium/update.mjs
index 4c2f3e44c520..9aab0753db78 100755
--- a/pkgs/applications/networking/browsers/chromium/update.mjs
+++ b/pkgs/applications/networking/browsers/chromium/update.mjs
@@ -72,11 +72,7 @@ for (const attr_path of Object.keys(lockfile)) {
       DEPS: {},
     }
 
-    // The DEPS schema was modified in https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/7007552
-    // and https://chromium-review.googlesource.com/c/chromium/src/+/7683270. And while the breaking change itself got
-    // backported to M147 (and M146 fwiw), the necessary depot_tools roll was not.
-    // So for now we simply resort to whatever depot_tools is currently pinned on chromium's main branch.
-    const depot_tools = await fetch_depot_tools(/* chromium_rev */ 'main', lockfile_initial[attr_path].deps.depot_tools)
+    const depot_tools = await fetch_depot_tools(chromium_rev, lockfile_initial[attr_path].deps.depot_tools)
     lockfile[attr_path].deps.depot_tools = {
       rev: depot_tools.rev,
       hash: depot_tools.hash,
diff --git a/pkgs/applications/networking/charles/default.nix b/pkgs/applications/networking/charles/default.nix
index 39d066451db5..f9f70bee1b5a 100644
--- a/pkgs/applications/networking/charles/default.nix
+++ b/pkgs/applications/networking/charles/default.nix
@@ -4,7 +4,7 @@
   makeWrapper,
   makeDesktopItem,
   fetchurl,
-  openjdk17-bootstrap,
+  jdk25,
   jdk11,
   jdk8,
   writeScript,
@@ -114,10 +114,10 @@ in
 {
   charles5 = (
     generic {
-      version = "5.0.3";
-      hash = "sha256-SiZ15ekuAW7AyXBHN5Zel4ZFL/4oNy1td64NQ0GNUhE=";
+      version = "5.1";
+      hash = "sha256-gExmuh1A21QGkfcmcwPPgk51Ag7Ced9kPTHha2ofbKg=";
       platform = "_x86_64";
-      jdk = openjdk17-bootstrap;
+      jdk = jdk25;
 
       updateScript = writeScript "update-charles" ''
         #!/usr/bin/env nix-shell
diff --git a/pkgs/applications/networking/instant-messengers/discord/linux.nix b/pkgs/applications/networking/instant-messengers/discord/linux.nix
index 22a815d4f3f7..cf5ec0193b11 100644
--- a/pkgs/applications/networking/instant-messengers/discord/linux.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/linux.nix
@@ -49,7 +49,6 @@
   libgbm,
   nspr,
   nss,
-  openssl_1_1,
   pango,
   systemdLibs,
   libappindicator-gtk3,
@@ -231,11 +230,10 @@ stdenv.mkDerivation (finalAttrs: {
     nss
   ]
   # The new distro layout ships prebuilt `.node` modules:
-  # discord_dispatch is linked against openssl 1.1, discord_voice against libpulseaudio
-  ++ lib.optionals isDistro [
-    openssl_1_1
-    libpulseaudio
-  ];
+  # discord_dispatch is linked against openssl 1.1, discord_voice against libpulseaudio.
+  # Ignore the missing dependency on insecure openssl_1_1: discord_dispatch is
+  # effectively unused in practice.
+  ++ lib.optionals isDistro [ libpulseaudio ];
 
   strictDeps = true;
 
@@ -243,6 +241,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   inherit libPath;
 
+  autoPatchelfIgnoreMissingDeps = lib.optionals isDistro [
+    "libssl.so.1.1"
+    "libcrypto.so.1.1"
+  ];
+
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/applications/office/beancount/bean-add.nix b/pkgs/applications/office/beancount/bean-add.nix
index 913ac85fcf0f..e3e80e2cbef5 100644
--- a/pkgs/applications/office/beancount/bean-add.nix
+++ b/pkgs/applications/office/beancount/bean-add.nix
@@ -28,10 +28,7 @@ stdenv.mkDerivation {
     homepage = "https://github.com/simon-v/bean-add/";
     description = "Beancount transaction entry assistant";
     mainProgram = "bean-add";
-
-    # The (only) source file states:
-    #   License: "Do what you feel is right, but don't be a jerk" public license.
-
+    license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ matthiasbeyer ];
   };
 }
diff --git a/pkgs/applications/video/kodi/addons/kodi-platform/default.nix b/pkgs/applications/video/kodi/addons/kodi-platform/default.nix
index 0b4682ce94e3..7bf24912818a 100644
--- a/pkgs/applications/video/kodi/addons/kodi-platform/default.nix
+++ b/pkgs/applications/video/kodi/addons/kodi-platform/default.nix
@@ -1,4 +1,5 @@
 {
+  lib,
   stdenv,
   fetchFromGitHub,
   cmake,
@@ -23,4 +24,8 @@ stdenv.mkDerivation rec {
     libcec_platform
     tinyxml
   ];
+
+  meta = {
+    license = lib.licenses.gpl2Plus;
+  };
 }
diff --git a/pkgs/applications/video/kodi/addons/youtube/default.nix b/pkgs/applications/video/kodi/addons/youtube/default.nix
index 0651eb6a9428..83075ef1b028 100644
--- a/pkgs/applications/video/kodi/addons/youtube/default.nix
+++ b/pkgs/applications/video/kodi/addons/youtube/default.nix
@@ -10,13 +10,13 @@
 buildKodiAddon rec {
   pname = "youtube";
   namespace = "plugin.video.youtube";
-  version = "7.4.2";
+  version = "7.4.3";
 
   src = fetchFromGitHub {
     owner = "anxdpanic";
     repo = "plugin.video.youtube";
     rev = "v${version}";
-    hash = "sha256-o+HaYVUvulHzthnP/PUJ0qTe0e901djw3l9sVpUcD08=";
+    hash = "sha256-FUfDUyaYHIeu9thCx19huLFnDO7Yl3RKIbfUH2I+SQI=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index defcd8a39988..02c9f2578f26 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -438,14 +438,14 @@ in
 
   docker_29 =
     let
-      version = "29.4.1";
+      version = "29.4.2";
     in
     callPackage dockerGen {
       inherit version;
       cliRev = "v${version}";
       cliHash = "sha256-jGD+Z3koM0a2Te7cq2HdKFizZj39djvTQUmn815Mn4o=";
       mobyRev = "docker-v${version}";
-      mobyHash = "sha256-R+rCR8DG4IyEdn9ol7PjawixgymjrEVMrTjaZM1wReU=";
+      mobyHash = "sha256-jPmFYGOxvMof32fQeI4iHLG12ElwysYLSTkIrlluEXM=";
       runcRev = "v1.3.5";
       runcHash = "sha256-Swphxbu/OLkUrfRjLMZIVGwYb7AN0xHdyxm0ysAVam0=";
       containerdRev = "v2.2.3";
diff --git a/pkgs/applications/virtualization/qboot/default.nix b/pkgs/applications/virtualization/qboot/default.nix
index 5b1c556ea5e5..53572437af43 100644
--- a/pkgs/applications/virtualization/qboot/default.nix
+++ b/pkgs/applications/virtualization/qboot/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation {
   pname = "qboot";
-  version = "unstable-2020-04-23";
+  version = "unstable-2022-09-19";
 
   src = fetchFromGitHub {
     owner = "bonzini";
     repo = "qboot";
-    rev = "de50b5931c08f5fba7039ddccfb249a5b3b0b18d";
-    sha256 = "1d0h29zz535m0pq18k3aya93q7lqm2858mlcp8mlfkbq54n8c5d8";
+    rev = "8ca302e86d685fa05b16e2b208888243da319941";
+    hash = "sha256-YxVGFiyLdhq7yWaXARh7f0nBZgXfJuYvv1BxfyThupM=";
   };
 
   nativeBuildInputs = [
@@ -33,9 +33,7 @@ stdenv.mkDerivation {
     "pic"
   ];
 
-  passthru.tests = {
-    qboot = nixosTests.qboot;
-  };
+  passthru.tests.qboot = nixosTests.qboot;
 
   meta = {
     description = "Simple x86 firmware for booting Linux";
diff --git a/pkgs/by-name/a4/a4/package.nix b/pkgs/by-name/a4/a4/package.nix
index c18e7d3c4720..44fb6db2832b 100644
--- a/pkgs/by-name/a4/a4/package.nix
+++ b/pkgs/by-name/a4/a4/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "a4";
-  version = "0.2.3";
+  version = "2.0";
 
   src = fetchFromGitHub {
     owner = "rpmohn";
     repo = "a4";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AX5psz9+bLdFFeDR55TIrAWDAkhDygw6289OgIfOJTg=";
+    hash = "sha256-WehME2z/Fm4DOrEUj8+XTOnm2MrplZIeOXSubSN223w=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/ac/acme-client/package.nix b/pkgs/by-name/ac/acme-client/package.nix
index d08602b7d3f3..01903febec36 100644
--- a/pkgs/by-name/ac/acme-client/package.nix
+++ b/pkgs/by-name/ac/acme-client/package.nix
@@ -9,11 +9,11 @@
 
 gccStdenv.mkDerivation (finalAttrs: {
   pname = "acme-client";
-  version = "1.3.3";
+  version = "1.3.7";
 
   src = fetchurl {
-    url = "https://data.wolfsden.cz/sources/acme-client-${finalAttrs.version}.tar.gz";
-    hash = "sha256-HJOk2vlDD7ADrLdf/eLEp+teu9XN0KrghEe6y4FIDoI=";
+    url = "https://files.wolfsden.cz/releases/acme-client/acme-client-${finalAttrs.version}.tar.gz";
+    hash = "sha256-Mq+6epLcgEnlQ0JAPYCxGQu7EM0VS0Y32PYuvEuliAE=";
   };
 
   nativeBuildInputs = [
@@ -29,12 +29,17 @@ gccStdenv.mkDerivation (finalAttrs: {
     "PREFIX=${placeholder "out"}"
   ];
 
+  passthru.updateScript = ./update.sh;
+
   meta = {
     description = "Secure ACME/Let's Encrypt client";
     homepage = "https://git.wolfsden.cz/acme-client-portable";
     platforms = lib.platforms.unix;
     license = lib.licenses.isc;
-    maintainers = with lib.maintainers; [ pmahoney ];
+    maintainers = with lib.maintainers; [
+      pmahoney
+      kybe236
+    ];
     mainProgram = "acme-client";
   };
 })
diff --git a/pkgs/by-name/ac/acme-client/update.sh b/pkgs/by-name/ac/acme-client/update.sh
new file mode 100755
index 000000000000..6b6034bd26cb
--- /dev/null
+++ b/pkgs/by-name/ac/acme-client/update.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnugrep nix-update
+
+set -euo pipefail
+
+VERSION=$(curl https://files.wolfsden.cz/releases/acme-client/ | grep -oP 'acme-client-\K\d+\.\d+\.\d+(?=\.tar\.gz)' | sort -V | tail -n1)
+
+echo ">> acme-client: $VERSION"
+
+nix-update --version "$VERSION" acme-client
diff --git a/pkgs/by-name/ae/aesfix/package.nix b/pkgs/by-name/ae/aesfix/package.nix
index aede73905fe2..5c0a7dd3b315 100644
--- a/pkgs/by-name/ae/aesfix/package.nix
+++ b/pkgs/by-name/ae/aesfix/package.nix
@@ -24,5 +24,6 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "aesfix";
     homepage = "https://citp.princeton.edu/our-work/memory/";
     maintainers = with lib.maintainers; [ fedx-sudo ];
+    license = lib.licenses.bsd3;
   };
 })
diff --git a/pkgs/by-name/ak/akkoma/akkoma-imagemagick.patch b/pkgs/by-name/ak/akkoma/akkoma-imagemagick.patch
deleted file mode 100644
index 11e291f6dbc5..000000000000
--- a/pkgs/by-name/ak/akkoma/akkoma-imagemagick.patch
+++ /dev/null
@@ -1,60 +0,0 @@
-From c48f5d57b6e57f42b668c0c6b8744e4620c77320 Mon Sep 17 00:00:00 2001
-From: Mikael Voss <mvs@nyantec.com>
-Date: Tue, 19 Nov 2024 20:47:27 +0100
-Subject: [PATCH] Use magick command from ImageMagick
-
-With ImageMagick version 7 the convert command has been deprecated in
-favour of magick. Calling convert instead results in the logs being
-spammed with warning messages.
-
-The mogrify Elixir wrapper also runs magick with the mogrify argument
-in current releases.
----
- lib/pleroma/application_requirements.ex | 8 ++++----
- lib/pleroma/helpers/media_helper.ex     | 4 ++--
- 2 files changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/lib/pleroma/application_requirements.ex b/lib/pleroma/application_requirements.ex
-index c3777d8f1..55ee674a2 100644
---- a/lib/pleroma/application_requirements.ex
-+++ b/lib/pleroma/application_requirements.ex
-@@ -166,10 +166,10 @@ defp check_system_commands!(:ok) do
-     filter_commands_statuses = [
-       check_filter(Pleroma.Upload.Filter.Exiftool.StripMetadata, "exiftool"),
-       check_filter(Pleroma.Upload.Filter.Exiftool.ReadDescription, "exiftool"),
--      check_filter(Pleroma.Upload.Filter.Mogrify, "mogrify"),
--      check_filter(Pleroma.Upload.Filter.Mogrifun, "mogrify"),
--      check_filter(Pleroma.Upload.Filter.AnalyzeMetadata, "mogrify"),
--      check_filter(Pleroma.Upload.Filter.AnalyzeMetadata, "convert"),
-+      check_filter(Pleroma.Upload.Filter.Mogrify, "magick"),
-+      check_filter(Pleroma.Upload.Filter.Mogrifun, "magick"),
-+      check_filter(Pleroma.Upload.Filter.AnalyzeMetadata, "magick"),
-+      check_filter(Pleroma.Upload.Filter.AnalyzeMetadata, "magick"),
-       check_filter(Pleroma.Upload.Filter.AnalyzeMetadata, "ffprobe")
-     ]
- 
-diff --git a/lib/pleroma/helpers/media_helper.ex b/lib/pleroma/helpers/media_helper.ex
-index cb95d0e68..17cd9629d 100644
---- a/lib/pleroma/helpers/media_helper.ex
-+++ b/lib/pleroma/helpers/media_helper.ex
-@@ -12,7 +12,7 @@ defmodule Pleroma.Helpers.MediaHelper do
-   require Logger
- 
-   def missing_dependencies do
--    Enum.reduce([imagemagick: "convert", ffmpeg: "ffmpeg"], [], fn {sym, executable}, acc ->
-+    Enum.reduce([imagemagick: "magick", ffmpeg: "ffmpeg"], [], fn {sym, executable}, acc ->
-       if Pleroma.Utils.command_available?(executable) do
-         acc
-       else
-@@ -22,7 +22,7 @@ def missing_dependencies do
-   end
- 
-   def image_resize(url, options) do
--    with executable when is_binary(executable) <- System.find_executable("convert"),
-+    with executable when is_binary(executable) <- System.find_executable("magick"),
-          {:ok, args} <- prepare_image_resize_args(options),
-          {:ok, env} <- HTTP.get(url, [], []),
-          {:ok, fifo_path} <- mkfifo() do
--- 
-2.43.0
-
diff --git a/pkgs/by-name/ak/akkoma/package.nix b/pkgs/by-name/ak/akkoma/package.nix
index c2568cc4c6f3..f5ebc61c42fd 100644
--- a/pkgs/by-name/ak/akkoma/package.nix
+++ b/pkgs/by-name/ak/akkoma/package.nix
@@ -20,14 +20,14 @@ let
 in
 beamPackages.mixRelease rec {
   pname = "akkoma";
-  version = "3.18.1";
+  version = "3.19.0";
 
   src = fetchFromGitea {
     domain = "akkoma.dev";
     owner = "AkkomaGang";
     repo = "akkoma";
     tag = "v${version}";
-    hash = "sha256-4HIIgTNcNAMCpHyT6zBcmxXeFbMrt38Z7PtT9Onvz+U=";
+    hash = "sha256-ASLnsmuWpfQKwpNNLUgI32Gdn/j+jUW5IBLlT8RUmcE=";
 
     # upstream repository archive fetching is broken
     forceFetchGit = true;
@@ -36,20 +36,10 @@ beamPackages.mixRelease rec {
   nativeBuildInputs = [ cmake ];
   buildInputs = [ file ];
 
-  patches = [
-    # See <https://akkoma.dev/AkkomaGang/akkoma/pulls/854>
-    # Akkoma uses the deprecated “convert” command instead of “magick”, which
-    # results in the logs being spammed with warning messages. Upstream is
-    # reluctant to change this, to ensure compatibility with Debian stable,
-    # which does not yet provide ImageMagick 7.
-    # Remove this patch once merged upstream.
-    ./akkoma-imagemagick.patch
-  ];
-
   mixFodDeps = beamPackages.fetchMixDeps {
     pname = "mix-deps-akkoma";
     inherit src version;
-    hash = "sha256-igXEX6I+7G7tNCLjEf0VBOaii0r7jXCdF6x78LMcUv0=";
+    hash = "sha256-O9A7XuQSSczGMcLMc6Fk0eh7PkjQ6sYJKSwdqoEPJJI=";
 
     postInstall = ''
       substituteInPlace "$out/http_signatures/mix.exs" \
diff --git a/pkgs/by-name/al/all-the-package-names/package.nix b/pkgs/by-name/al/all-the-package-names/package.nix
index f721b04fc9a5..6d4e28ef34eb 100644
--- a/pkgs/by-name/al/all-the-package-names/package.nix
+++ b/pkgs/by-name/al/all-the-package-names/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "all-the-package-names";
-  version = "2.0.2429";
+  version = "2.0.2437";
 
   src = fetchFromGitHub {
     owner = "nice-registry";
     repo = "all-the-package-names";
     tag = "v${version}";
-    hash = "sha256-ut3YoTGpHEoSIafkimU31Mt45Q14oiTGWXQQfsxia9s=";
+    hash = "sha256-wPmsxxlgWsh0LvLgvlJbqci8vqfz8Z2/1RC3Sc0krp8=";
   };
 
-  npmDepsHash = "sha256-pxei6HxmUyMajVG+thFp3pOTWqBC6yL/nOvp6c8DXp0=";
+  npmDepsHash = "sha256-UlflkWK2lyQMvuJQ0OkI1cuR8rhZxyDjeHUsdFjWfQk=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/al/allure/package.nix b/pkgs/by-name/al/allure/package.nix
index 1f27bd1a8023..30e3928b2ba3 100644
--- a/pkgs/by-name/al/allure/package.nix
+++ b/pkgs/by-name/al/allure/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "allure";
-  version = "2.39.0";
+  version = "2.40.0";
 
   src = fetchurl {
     url = "https://github.com/allure-framework/allure2/releases/download/${finalAttrs.version}/allure-${finalAttrs.version}.tgz";
-    hash = "sha256-dDg/ZgacwPbsLQ/a0vHXYfExhPbNKJM0sdz8QjdzVmU=";
+    hash = "sha256-RXOO/8dGZ0DULqkTjoD8pQgedWbHCvypRwjZxVhdNCQ=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/an/anki/addons/adjust-sound-volume/default.nix b/pkgs/by-name/an/anki/addons/adjust-sound-volume/default.nix
index b5fc7bb42373..8ad3cb208956 100644
--- a/pkgs/by-name/an/anki/addons/adjust-sound-volume/default.nix
+++ b/pkgs/by-name/an/anki/addons/adjust-sound-volume/default.nix
@@ -2,7 +2,6 @@
   lib,
   anki-utils,
   fetchFromGitHub,
-  nix-update-script,
 }:
 anki-utils.buildAnkiAddon (finalAttrs: {
   pname = "adjust-sound-volume";
@@ -13,7 +12,6 @@ anki-utils.buildAnkiAddon (finalAttrs: {
     tag = "v${finalAttrs.version}";
     hash = "sha256-6reIUz+tHKd4KQpuofLa/tIL5lCloj3yODZ8Cz29jFU=";
   };
-  passthru.updateScript = nix-update-script { };
   meta = {
     description = "Add a new menu item for adjusting the sound volume";
     homepage = "https://github.com/mnogu/adjust-sound-volume";
diff --git a/pkgs/by-name/an/anki/addons/ajt-card-management/default.nix b/pkgs/by-name/an/anki/addons/ajt-card-management/default.nix
index 25a3f9a65c3d..5b585b54ad75 100644
--- a/pkgs/by-name/an/anki/addons/ajt-card-management/default.nix
+++ b/pkgs/by-name/an/anki/addons/ajt-card-management/default.nix
@@ -2,7 +2,6 @@
   lib,
   anki-utils,
   fetchFromGitHub,
-  nix-update-script,
 }:
 
 anki-utils.buildAnkiAddon (finalAttrs: {
@@ -26,7 +25,6 @@ anki-utils.buildAnkiAddon (finalAttrs: {
         };
       });
   sourceRoot = "${finalAttrs.src.name}/card_management";
-  passthru.updateScript = nix-update-script { };
   meta = {
     description = "Reset, Learn, and Grade cards from the card browser";
     longDescription = ''
diff --git a/pkgs/by-name/an/anki/addons/anki-quizlet-importer-extended/default.nix b/pkgs/by-name/an/anki/addons/anki-quizlet-importer-extended/default.nix
index ecbb9bc3bec5..8602a87598aa 100644
--- a/pkgs/by-name/an/anki/addons/anki-quizlet-importer-extended/default.nix
+++ b/pkgs/by-name/an/anki/addons/anki-quizlet-importer-extended/default.nix
@@ -2,7 +2,6 @@
   lib,
   anki-utils,
   fetchFromGitHub,
-  nix-update-script,
 }:
 anki-utils.buildAnkiAddon (finalAttrs: {
   pname = "anki-quizlet-importer-extended";
@@ -13,7 +12,6 @@ anki-utils.buildAnkiAddon (finalAttrs: {
     tag = "v${finalAttrs.version}";
     hash = "sha256-BTddZColXM193x8xFa1axHeiWukjxXvwkXGpHxsLtR0=";
   };
-  passthru.updateScript = nix-update-script { };
   meta = {
     description = "Import Quizlet Decks into Anki";
     homepage = "https://ankiweb.net/shared/info/1362209126";
diff --git a/pkgs/by-name/an/anki/addons/anki-utils.nix b/pkgs/by-name/an/anki/addons/anki-utils.nix
index 958defb8c241..0a53c4de42b7 100644
--- a/pkgs/by-name/an/anki/addons/anki-utils.nix
+++ b/pkgs/by-name/an/anki/addons/anki-utils.nix
@@ -5,6 +5,7 @@
   lndir,
   formats,
   runCommand,
+  nix-update-script,
 }:
 {
   buildAnkiAddon = lib.extendMkDerivation {
@@ -55,6 +56,7 @@
         '';
 
         passthru = {
+          updateScript = nix-update-script { };
           withConfig =
             {
               # JSON add-on config. The available options for an add-on are in its
diff --git a/pkgs/by-name/an/anki/addons/image-occlusion-enhanced/default.nix b/pkgs/by-name/an/anki/addons/image-occlusion-enhanced/default.nix
index 290236b13810..13cceb07b77c 100644
--- a/pkgs/by-name/an/anki/addons/image-occlusion-enhanced/default.nix
+++ b/pkgs/by-name/an/anki/addons/image-occlusion-enhanced/default.nix
@@ -2,7 +2,6 @@
   lib,
   anki-utils,
   fetchFromGitHub,
-  nix-update-script,
 }:
 anki-utils.buildAnkiAddon (finalAttrs: {
   pname = "image-occlusion-enhanced";
@@ -15,7 +14,6 @@ anki-utils.buildAnkiAddon (finalAttrs: {
     hash = "sha256-YR1hicBDb08J+1Qc+SDiJDXLo5FzLqCQGeVe7brbPME=";
   };
   sourceRoot = "${finalAttrs.src.name}/src/image_occlusion_enhanced";
-  passthru.updateScript = nix-update-script { };
   meta = {
     description = ''
       Adds extra features for creating image-based cloze-deletions
diff --git a/pkgs/by-name/an/anki/addons/passfail2/default.nix b/pkgs/by-name/an/anki/addons/passfail2/default.nix
index 73746c1a568a..41c279caef86 100644
--- a/pkgs/by-name/an/anki/addons/passfail2/default.nix
+++ b/pkgs/by-name/an/anki/addons/passfail2/default.nix
@@ -2,7 +2,6 @@
   lib,
   anki-utils,
   fetchFromGitHub,
-  nix-update-script,
 }:
 anki-utils.buildAnkiAddon (finalAttrs: {
   pname = "passfail2";
@@ -21,7 +20,6 @@ anki-utils.buildAnkiAddon (finalAttrs: {
 
     runHook postBuild
   '';
-  passthru.updateScript = nix-update-script { };
   meta = {
     description = ''
       Replaces the default Anki review buttons with only two options:
diff --git a/pkgs/by-name/an/anki/addons/puppy-reinforcement/default.nix b/pkgs/by-name/an/anki/addons/puppy-reinforcement/default.nix
index f4550d60bec8..1d5c179e3889 100644
--- a/pkgs/by-name/an/anki/addons/puppy-reinforcement/default.nix
+++ b/pkgs/by-name/an/anki/addons/puppy-reinforcement/default.nix
@@ -2,7 +2,6 @@
   lib,
   anki-utils,
   fetchFromGitHub,
-  nix-update-script,
 }:
 anki-utils.buildAnkiAddon (finalAttrs: {
   pname = "puppy-reinforcement";
@@ -14,7 +13,6 @@ anki-utils.buildAnkiAddon (finalAttrs: {
     hash = "sha256-y52AjmYrFTcTwd4QAcJzK5R9wwxUSlvnN3C2O/r5cHk=";
   };
   sourceRoot = "${finalAttrs.src.name}/src/puppy_reinforcement";
-  passthru.updateScript = nix-update-script { };
   meta = {
     description = "Encourage learners with pictures of cute puppies";
     longDescription = ''
diff --git a/pkgs/by-name/an/anki/addons/recolor/default.nix b/pkgs/by-name/an/anki/addons/recolor/default.nix
index 249fac0f9f01..26a10c23752e 100644
--- a/pkgs/by-name/an/anki/addons/recolor/default.nix
+++ b/pkgs/by-name/an/anki/addons/recolor/default.nix
@@ -2,7 +2,6 @@
   lib,
   anki-utils,
   fetchFromGitHub,
-  nix-update-script,
 }:
 anki-utils.buildAnkiAddon (finalAttrs: {
   pname = "recolor";
@@ -25,8 +24,6 @@ anki-utils.buildAnkiAddon (finalAttrs: {
     ./only-update-config-version-when-migration-happens.patch
   ];
 
-  passthru.updateScript = nix-update-script { };
-
   meta = {
     description = "ReColor your Anki desktop to whatever aesthetic you like";
     longDescription = ''
diff --git a/pkgs/by-name/at/atlantis/package.nix b/pkgs/by-name/at/atlantis/package.nix
index c81ee93a920a..aa24e1764d77 100644
--- a/pkgs/by-name/at/atlantis/package.nix
+++ b/pkgs/by-name/at/atlantis/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "atlantis";
-  version = "0.42.0";
+  version = "0.43.0";
 
   src = fetchFromGitHub {
     owner = "runatlantis";
     repo = "atlantis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EcFthkizJOcqxpt8VjuFRM0UPHHxSseEcWTpT/qlCxw=";
+    hash = "sha256-btCfoku8LgsZEJ/aza75wg8spacYEeliXVmjMZYkO3M=";
   };
 
   ldflags = [
diff --git a/pkgs/by-name/au/autokey/package.nix b/pkgs/by-name/au/autokey/package.nix
index bfe5ebe550dd..99e85f089f4b 100644
--- a/pkgs/by-name/au/autokey/package.nix
+++ b/pkgs/by-name/au/autokey/package.nix
@@ -4,9 +4,12 @@
   fetchFromGitHub,
   wrapGAppsHook3,
   gobject-introspection,
+  imagemagick,
   gtksourceview3,
   libappindicator-gtk3,
   libnotify,
+  xautomation,
+  xwd,
   zenity,
   wmctrl,
 }:
@@ -19,12 +22,16 @@ python3Packages.buildPythonApplication (finalAttrs: {
   src = fetchFromGitHub {
     owner = "autokey";
     repo = "autokey";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-d1WJLqkdC7QgzuYdnxYhajD3DtCpgceWCAxGrk0KKew=";
   };
 
-  # Tests appear to be broken with import errors within the project structure
-  doCheck = false;
+  postPatch = ''
+    # pyrcc5 embeds resource mtimes; preserve normalized source mtimes for reproducible wheels.
+    substituteInPlace setup.py \
+      --replace-fail "shutil.copy(str(icon), str(target_directory))" \
+        "shutil.copy2(str(icon), str(target_directory))"
+  '';
 
   nativeBuildInputs = [
     wrapGAppsHook3
@@ -41,6 +48,22 @@ python3Packages.buildPythonApplication (finalAttrs: {
     setuptools
   ];
 
+  nativeCheckInputs = with python3Packages; [
+    pyqt5
+    pyhamcrest
+    pytestCheckHook
+    pytest-cov-stub
+  ];
+
+  disabledTestPaths = [
+    # Runs `git describe` during test collection.
+    "tests/test_common.py"
+  ];
+
+  preCheck = ''
+    export HOME=$TMPDIR
+  '';
+
   dependencies = with python3Packages; [
     dbus-python
     pyinotify
@@ -51,7 +74,10 @@ python3Packages.buildPythonApplication (finalAttrs: {
   ];
 
   runtimeDeps = [
+    imagemagick
     zenity
+    xautomation
+    xwd
     wmctrl
   ];
 
@@ -67,10 +93,11 @@ python3Packages.buildPythonApplication (finalAttrs: {
   '';
 
   meta = {
-    homepage = "https://github.com/autokey/autokey";
     description = "Desktop automation utility for Linux and X11";
-    license = with lib.licenses; [ gpl3 ];
-    maintainers = [ ];
+    homepage = "https://github.com/autokey/autokey";
+    changelog = "https://github.com/autokey/autokey/releases/tag/${finalAttrs.src.tag}";
+    license = with lib.licenses; [ gpl3Plus ];
+    maintainers = with lib.maintainers; [ iamanaws ];
     platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/by-name/bl/blockbench/package.nix b/pkgs/by-name/bl/blockbench/package.nix
index cdf69b209b90..0d31dc1f86b4 100644
--- a/pkgs/by-name/bl/blockbench/package.nix
+++ b/pkgs/by-name/bl/blockbench/package.nix
@@ -12,13 +12,13 @@
 
 buildNpmPackage rec {
   pname = "blockbench";
-  version = "5.1.3";
+  version = "5.1.4";
 
   src = fetchFromGitHub {
     owner = "JannisX11";
     repo = "blockbench";
     tag = "v${version}";
-    hash = "sha256-aGGvYIYQ3fw1fk5NUwJsMkq2YSugQD94xfy52LvHOKc=";
+    hash = "sha256-lYsd8KegoO4amtRL5o3JPXW4vu4z3p/dXlOVn3zKgeA=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ca/capslock/package.nix b/pkgs/by-name/ca/capslock/package.nix
index ad6c58028be3..1bb792ae1390 100644
--- a/pkgs/by-name/ca/capslock/package.nix
+++ b/pkgs/by-name/ca/capslock/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "capslock";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "capslock";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Ln2NqyIlFGlPZL4rbmlY+fnJFCVVaKWmwQxhE2h7e2E=";
+    hash = "sha256-IqPzXs8d22tVwYot98i48MLDXZERk0nt1Wh8CnCDeKQ=";
   };
 
-  vendorHash = "sha256-ObQvJwebefu8hIBd+dcs3i3xhRfFax1TIBDPfaTUKOY=";
+  vendorHash = "sha256-k4YQaoLIw1jFl4PJUm0b16ORw/OyhmA/5uKfP0S12GU=";
 
   subPackages = [ "cmd/capslock" ];
 
diff --git a/pkgs/by-name/ca/casacore/casacore-pkgconfig.patch b/pkgs/by-name/ca/casacore/casacore-pkgconfig.patch
new file mode 100644
index 000000000000..58b0e29adf9e
--- /dev/null
+++ b/pkgs/by-name/ca/casacore/casacore-pkgconfig.patch
@@ -0,0 +1,29 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 574150c05..109e96889 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -566,6 +566,14 @@ foreach (module ${_modules})
+ endforeach (module)
+ 
+ # Install pkg-config support file
++set(pc_req_public "")
++if (_usewcs AND WCSLIB_FOUND)
++    list(APPEND pc_req_public "wcslib")
++endif()
++if (_usefits AND CFITSIO_FOUND)
++    list(APPEND pc_req_public "cfitsio")
++endif()
++list(JOIN pc_req_public " " pc_req_public)
+ CONFIGURE_FILE("casacore.pc.in" "casacore.pc" @ONLY)
+ set(CASA_PKGCONFIG_INSTALL_PREFIX "${CMAKE_INSTALL_PREFIX}/lib/pkgconfig")
+ INSTALL(FILES "${CMAKE_CURRENT_BINARY_DIR}/casacore.pc" DESTINATION "${CASA_PKGCONFIG_INSTALL_PREFIX}")
+diff --git a/casacore.pc.in b/casacore.pc.in
+index 6881300df..d0a01b240 100644
+--- a/casacore.pc.in
++++ b/casacore.pc.in
+@@ -9,4 +9,4 @@ Version: @PROJECT_VERSION@
+ Requires: @pc_req_public@
+ Requires.private: @pc_req_private@
+ Libs: -L${libdir} @PRIVATE_LIBS@
+-Cflags: -I${includedir} -I@WCSLIB_INCLUDE_DIR@
++Cflags: -I${includedir}
diff --git a/pkgs/by-name/ca/casacore/package.nix b/pkgs/by-name/ca/casacore/package.nix
index dc1cae89fe07..5a026b41ba10 100644
--- a/pkgs/by-name/ca/casacore/package.nix
+++ b/pkgs/by-name/ca/casacore/package.nix
@@ -14,8 +14,33 @@
   fftwFloat,
   readline,
   gsl,
+  mpi,
+  adios2,
+  hdf5,
+  llvmPackages,
+  mpiSupport ? false,
+  adios2Support ? false,
+  hdf5Support ? false,
 }:
-
+let
+  casacorePackages = {
+    adios2 = adios2.override {
+      inherit mpi mpiSupport;
+    };
+    fftw = fftw.override {
+      inherit mpi;
+      enableMpi = mpiSupport;
+    };
+    fftwFloat = fftwFloat.override {
+      inherit mpi;
+      enableMpi = mpiSupport;
+    };
+    hdf5 = hdf5.override {
+      inherit mpi mpiSupport;
+      cppSupport = !mpiSupport;
+    };
+  };
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "casacore";
   version = "3.8.0";
@@ -27,31 +52,55 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-NOxuHMCuHGk9XuWXMwQTN6kOFDI0QuHMgfNRDdlPw44=";
   };
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     cmake
     gfortran
     flex
     bison
-  ];
+  ]
+  ++ lib.optional mpiSupport mpi;
+
+  propagatedBuildInputs = [
+    wcslib
+    cfitsio
+  ]
+  ++ lib.optional hdf5Support casacorePackages.hdf5
+  ++ lib.optional mpiSupport mpi
+  ++ lib.optional adios2Support casacorePackages.adios2;
 
   buildInputs = [
     blas
     lapack
-    cfitsio
-    wcslib
-    fftw
-    fftwFloat
+    casacorePackages.fftw
+    casacorePackages.fftwFloat
     readline
     gsl
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    llvmPackages.openmp
+  ];
+
+  patches = [
+    # Fix the generated .pc file: set Requires from a variable instead of
+    # leaving it empty, and remove hardcoded absolute cmake build paths from
+    # Cflags (which would embed /nix/store paths from the build environment).
+    ./casacore-pkgconfig.patch
   ];
 
   enableParallelBuilding = true;
 
-  strictDeps = true;
-
   cmakeFlags = [
     (lib.cmakeBool "ENABLE_SHARED" (!stdenv.hostPlatform.isStatic))
-    (lib.cmakeBool "BUILD_PYTHON3" false) # TODO: If/when we package python-casacore, this will change
+    (lib.cmakeBool "BUILD_PYTHON3" false)
+    (lib.cmakeBool "USE_OPENMP" true)
+    (lib.cmakeBool "USE_ADIOS2" adios2Support)
+    (lib.cmakeBool "USE_HDF5" hdf5Support)
+    (lib.cmakeBool "USE_MPI" mpiSupport)
+    (lib.cmakeBool "PORTABLE" true)
+    (lib.cmakeBool "USE_PCH" false)
+    (lib.cmakeBool "BUILD_FFTPACK_DEPRECATED" true) # Needed for casacpp
   ];
 
   meta = {
diff --git a/pkgs/by-name/ca/casacpp/casacpp-pkgconfig.patch b/pkgs/by-name/ca/casacpp/casacpp-pkgconfig.patch
new file mode 100644
index 000000000000..5856af18c55b
--- /dev/null
+++ b/pkgs/by-name/ca/casacpp/casacpp-pkgconfig.patch
@@ -0,0 +1,22 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 4d3cae2326..7954107f8f 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -195,6 +195,7 @@ foreach(_component IN LISTS casacpp_all_components)
+ endforeach()
+ 
+ # Install pkg-config support file
++set(pc_req_public "casacore cfitsio libxml-2.0 gsl protobuf grpc++ fftw3 libsakura")
+ CONFIGURE_FILE("casacpp.pc.in" "casacpp.pc" @ONLY)
+ set(CASACPP_PKGCONFIG_INSTALL_PREFIX "${CMAKE_INSTALL_PREFIX}/lib/pkgconfig")
+ INSTALL(FILES "${CMAKE_CURRENT_BINARY_DIR}/casacpp.pc" DESTINATION "${CASACPP_PKGCONFIG_INSTALL_PREFIX}")
+diff --git a/casacpp.pc.in b/casacpp.pc.in
+index 08a996b2c3..699cfb7319 100644
+--- a/casacpp.pc.in
++++ b/casacpp.pc.in
+@@ -9,4 +9,4 @@ Version: @PROJECT_VERSION@
+ Requires: @pc_req_public@
+ Requires.private: @pc_req_private@
+ Libs: -L${libdir} @PRIVATE_LIBS@
+-Cflags: -DWITHOUT_ACS -DWITHOUT_BOOST -I${includedir}/casacpp -I${includedir}/casacpp/protobuf_generated -I@CASACORE_INCLUDE_DIRS@ -I@CFITSIO_INCLUDE_DIRS@ -I@LibXML_INCLUDE_DIRS@ -I@GSL_INCLUDE_DIRS@
++Cflags: -DWITHOUT_ACS -DWITHOUT_BOOST -I${includedir}/casacpp -I${includedir}/casacpp/protobuf_generated
diff --git a/pkgs/by-name/ca/casacpp/package.nix b/pkgs/by-name/ca/casacpp/package.nix
new file mode 100644
index 000000000000..f495ec40a467
--- /dev/null
+++ b/pkgs/by-name/ca/casacpp/package.nix
@@ -0,0 +1,120 @@
+{
+  lib,
+  stdenv,
+  fetchgit,
+  cmake,
+  common-updater-scripts,
+  curl,
+  gnugrep,
+  writeShellScript,
+  pkg-config,
+  flex,
+  bison,
+  gfortran,
+  casacore,
+  libsakura,
+  grpc,
+  protobuf,
+  gsl,
+  libxml2,
+  libxslt,
+  fftw,
+  fftwFloat,
+  sqlite,
+  openssl,
+  mpi,
+  mpiSupport ? false,
+}:
+let
+  casacppPackages = {
+    fftw = fftw.override {
+      inherit mpi;
+      enableMpi = mpiSupport;
+    };
+    fftwFloat = fftwFloat.override {
+      inherit mpi;
+      enableMpi = mpiSupport;
+    };
+    casacore = casacore.override {
+      inherit mpi mpiSupport;
+    };
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "casacpp";
+  version = "6.7.5.18";
+
+  src = fetchgit {
+    url = "https://open-bitbucket.nrao.edu/scm/casa/casa6.git";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-75oIlaNAyu70KWSjz38LoYAvV7RJgzH/X9uBnGpriF4=";
+    fetchSubmodules = false;
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/casatools/src/code";
+
+  patches = [
+    # Fix the generated .pc file: set Requires from a variable instead of
+    # leaving it empty, and remove hardcoded absolute cmake build paths from
+    # Cflags (which would embed /nix/store paths from the build environment).
+    ./casacpp-pkgconfig.patch
+  ];
+
+  postPatch = ''
+    sed -i '/execute_process(COMMAND/,/OUTPUT_VARIABLE CASACPP_VERSION)/c\set(CASACPP_VERSION "${finalAttrs.version}")' CMakeLists.txt
+    sed -i 's/string(REGEX MATCH.*CASACPP_VERSION)//' CMakeLists.txt
+    substituteInPlace CMakeLists.txt \
+      --replace-fail \
+        'find_package(gRPC QUIET)' \
+        'set(gRPC_FOUND 0)'
+  '';
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    flex
+    bison
+    gfortran
+    grpc # for grpc_cpp_plugin
+  ]
+  ++ lib.optional mpiSupport mpi;
+
+  buildInputs = [
+    libxslt
+    sqlite
+    openssl
+  ];
+
+  propagatedBuildInputs = [
+    casacppPackages.casacore
+    protobuf
+    grpc
+    casacppPackages.fftw
+    casacppPackages.fftwFloat
+    libsakura
+    gsl
+    libxml2
+  ];
+
+  cmakeFlags = lib.optionals stdenv.hostPlatform.isDarwin [
+    (lib.cmakeFeature "CMAKE_CXX_FLAGS" "-ffp-contract=off")
+  ];
+
+  enableParallelBuilding = true;
+
+  passthru.updateScript = writeShellScript "update-casacpp" ''
+    version=$(${lib.getExe curl} -s https://pypi.org/pypi/casatasks/json | ${lib.getExe gnugrep} -oP '"version"\s*:\s*"\K[^"]+' | head -1)
+    ${lib.getExe' common-updater-scripts "update-source-version"} casacpp "$version"
+  '';
+
+  meta = {
+    description = "C++ core libraries for radio interferometry data reduction";
+    homepage = "https://casa.nrao.edu/";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ kiranshila ];
+  };
+})
diff --git a/pkgs/by-name/ca/castxml/package.nix b/pkgs/by-name/ca/castxml/package.nix
index 39ef0f3f3455..491db65d4317 100644
--- a/pkgs/by-name/ca/castxml/package.nix
+++ b/pkgs/by-name/ca/castxml/package.nix
@@ -19,13 +19,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "castxml";
-  version = "0.6.13";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "CastXML";
     repo = "CastXML";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-81I+Uh2HrEenp9iAW+TO+MUyXhXRMVDI+BZuVA4C/pE=";
+    hash = "sha256-nLYh6qb/dc+K1tsCVSm/iBzaJPtKPF1Q66yCpLFM6v4=";
   };
 
   nativeBuildInputs = [ cmake ] ++ lib.optionals (withManual || withHTML) [ sphinx ];
diff --git a/pkgs/by-name/cl/clive/package.nix b/pkgs/by-name/cl/clive/package.nix
index d8aed6b3bd3f..fb03c20f4b1b 100644
--- a/pkgs/by-name/cl/clive/package.nix
+++ b/pkgs/by-name/cl/clive/package.nix
@@ -11,16 +11,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "clive";
-  version = "0.12.16";
+  version = "0.12.17";
 
   src = fetchFromGitHub {
     owner = "koki-develop";
     repo = "clive";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bZzK7RLAStRb9R3V/TK6tZV6yv1C7MGslAhhpWDzdWk=";
+    hash = "sha256-omHxs2hTzjddelPkJWj2sVmK9nI5bCELUS8EmEH7JXM=";
   };
 
-  vendorHash = "sha256-BDspmaATLIfwyqxwJNJ24vpEETUWGVbobHWD2NRaOi4=";
+  vendorHash = "sha256-M3cU2051lOzm9hXuVwC1eFI8Ftpmk32h/98dHUkRfts=";
   subPackages = [ "." ];
   buildInputs = [ ttyd ];
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cl/clouddrive2/package.nix b/pkgs/by-name/cl/clouddrive2/package.nix
index de657e7c4447..50b6fdf2886d 100644
--- a/pkgs/by-name/cl/clouddrive2/package.nix
+++ b/pkgs/by-name/cl/clouddrive2/package.nix
@@ -11,16 +11,16 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "clouddrive2";
-  version = "1.0.5";
+  version = "1.0.6";
 
   src = fetchurl {
     url = "https://github.com/cloud-fs/cloud-fs.github.io/releases/download/v${finalAttrs.version}/clouddrive-2-${os}-${arch}-${finalAttrs.version}.tgz";
     hash =
       {
-        x86_64-linux = "sha256-yeDxxJvBstV+vafqNF22egznqvjUZWX2hZKiJif8jvU=";
-        aarch64-linux = "sha256-Fdi9T0RhdnT2xGixTlNIm1qRLOA9lJUqvZw5G9+SsgQ=";
-        x86_64-darwin = "sha256-FuuhE3Ni5mSkTWt5yyKMsFHhM11xt4sKl7bCxAyXqKE=";
-        aarch64-darwin = "sha256-Y2QoWj/eTWpMfasI+ENM35Rr2P4uufl7spjwe5CWET8=";
+        x86_64-linux = "sha256-MFZIJIcDPnNcgMWqHsnb2fSjfHySvOwq5PNyLcyCeYE=";
+        aarch64-linux = "sha256-Zh1MwZjYTWxGn9qWrDjTPwj+6uQ8m2FkwGlalaarGHg=";
+        x86_64-darwin = "sha256-quwflRL3YYc+gK4I6g7o853tbow/LRwxx0L7IXU3ijM=";
+        aarch64-darwin = "sha256-ebp15M1pWci+tvYtH1lp7syqNrj6ku4558TJSdaLf3I=";
       }
       .${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
   };
diff --git a/pkgs/by-name/cl/cloudflare-cli/package.nix b/pkgs/by-name/cl/cloudflare-cli/package.nix
index eb8643a3399e..89156c67d24e 100644
--- a/pkgs/by-name/cl/cloudflare-cli/package.nix
+++ b/pkgs/by-name/cl/cloudflare-cli/package.nix
@@ -12,18 +12,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cloudflare-cli";
-  version = "5.1.4";
+  version = "5.1.6";
 
   src = fetchFromGitHub {
     owner = "danielpigott";
     repo = "cloudflare-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UGXouKsFA4GCFgjsf5smQ1xsibPFiBqkdsqNDLAy2GM=";
+    hash = "sha256-lNwpXNKrhRAdcDnaapsAyANnsgUtah3/T99iBitgAdY=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-2NgmL04czIj/uj/KzdEDc4PdzUVVRty3MSZ9IwqRMOk=";
+    hash = "sha256-8dQkdCRJ7hJGC3zuUX0hmd5tWCoPSTdRNbtg2vapEXE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/co/coc-clangd/package.nix b/pkgs/by-name/co/coc-clangd/package.nix
index d4283b83f7a4..4c2c45682e91 100644
--- a/pkgs/by-name/co/coc-clangd/package.nix
+++ b/pkgs/by-name/co/coc-clangd/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage {
   pname = "coc-clangd";
-  version = "0-unstable-2026-04-01";
+  version = "0-unstable-2026-05-01";
 
   src = fetchFromGitHub {
     owner = "clangd";
     repo = "coc-clangd";
-    rev = "34d9ed8e7a08f29e398720802401455733e6a481";
-    hash = "sha256-PiPH9kXmVdu9Ul0t28E1jumZILX7IwIr2OBDfCepobs=";
+    rev = "1a9f68c7266621fd8cb5aa5863ec63927232fbfc";
+    hash = "sha256-FhJzJAf5jcdYCpPAKlJUNcVb0U8mkAiS5MoCTQpj/mM=";
   };
 
-  npmDepsHash = "sha256-QVsNztjTuHU0vu53IxjfFqllj1JxHnLwT9B9jaUnWIo=";
+  npmDepsHash = "sha256-jPgvi+Wz39d56d0YQSF99HqZ3rYi97kfGv7r0IY5WbY=";
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
 
diff --git a/pkgs/by-name/co/coredns/package.nix b/pkgs/by-name/co/coredns/package.nix
index 19c6e7592d74..8fa46e05caa9 100644
--- a/pkgs/by-name/co/coredns/package.nix
+++ b/pkgs/by-name/co/coredns/package.nix
@@ -32,60 +32,61 @@ buildGoModule (finalAttrs: {
     "man"
   ];
 
-  # Override the go-modules fetcher derivation to fetch plugins
-  modBuildPhase = ''
-    cp plugin.cfg plugin.cfg.orig
-    ${
-      (lib.concatMapStringsSep "\n" (
-        plugin:
-        let
-          position = plugin.position or "end-of-file";
-          formatPlugin = { name, repo, ... }: "${name}:${repo}";
-        in
-        if position == "end-of-file" then
-          "echo '${formatPlugin plugin}' >> plugin.cfg"
-        else if position == "start-of-file" then
-          "sed -i '1i ${formatPlugin plugin}' plugin.cfg"
-        else if lib.hasAttrByPath [ "before" ] position then
-          ''
-            if ! grep -q '^${position.before}:' plugin.cfg; then
-              echo 'Failed to insert ${plugin.name} before ${position.before} in plugin.cfg: ${position.before} is not in plugin.cfg'
-              exit 1
-            fi
-            sed -i '/^${position.before}:/i ${formatPlugin plugin}' plugin.cfg
-          ''
-        else if lib.hasAttrByPath [ "after" ] position then
-          ''
-            if ! grep -q '^${position.after}:' plugin.cfg; then
-              echo 'Failed to insert ${plugin.name} after ${position.after} in plugin.cfg: ${position.after} is not in plugin.cfg'
-              exit 1
-            fi
-            sed -i '/^${position.after}:/a ${formatPlugin plugin}' plugin.cfg
-          ''
-        else
-          throw ''
-            Unsupported position value in externalPlugin:
-              ${builtins.toJSON plugin}.
-            Valid values for position attr are:
-              - position = "end-of-file" (the default)
-              - position = "start-of-file"
-              - position.before = "{other plugin}"
-              - position.after = "{other plugin}"
-          ''
-      ) externalPlugins)
-    }
-    diff -u plugin.cfg.orig plugin.cfg || true
-    for src in ${toString (attrsToSources externalPlugins)}; do go get $src; done
-    go mod vendor
-    CC= GOOS= GOARCH= go generate
-    go mod vendor
-    go mod tidy
-  '';
+  overrideModAttrs = {
+    # Add plugins before vendoring the modules.
+    preBuild = ''
+      cp plugin.cfg plugin.cfg.orig
+      ${
+        (lib.concatMapStringsSep "\n" (
+          plugin:
+          let
+            position = plugin.position or "end-of-file";
+            formatPlugin = { name, repo, ... }: "${name}:${repo}";
+          in
+          if position == "end-of-file" then
+            "echo '${formatPlugin plugin}' >> plugin.cfg"
+          else if position == "start-of-file" then
+            "sed -i '1i ${formatPlugin plugin}' plugin.cfg"
+          else if lib.hasAttrByPath [ "before" ] position then
+            ''
+              if ! grep -q '^${position.before}:' plugin.cfg; then
+                echo 'Failed to insert ${plugin.name} before ${position.before} in plugin.cfg: ${position.before} is not in plugin.cfg'
+                exit 1
+              fi
+              sed -i '/^${position.before}:/i ${formatPlugin plugin}' plugin.cfg
+            ''
+          else if lib.hasAttrByPath [ "after" ] position then
+            ''
+              if ! grep -q '^${position.after}:' plugin.cfg; then
+                echo 'Failed to insert ${plugin.name} after ${position.after} in plugin.cfg: ${position.after} is not in plugin.cfg'
+                exit 1
+              fi
+              sed -i '/^${position.after}:/a ${formatPlugin plugin}' plugin.cfg
+            ''
+          else
+            throw ''
+              Unsupported position value in externalPlugin:
+                ${builtins.toJSON plugin}.
+              Valid values for position attr are:
+                - position = "end-of-file" (the default)
+                - position = "start-of-file"
+                - position.before = "{other plugin}"
+                - position.after = "{other plugin}"
+            ''
+        ) externalPlugins)
+      }
+      diff -u plugin.cfg.orig plugin.cfg || true
+      for src in ${toString (attrsToSources externalPlugins)}; do go get $src; done
+      GOFLAGS=''${GOFLAGS//-mod=vendor/} CC= GOOS= GOARCH= go generate
+      go mod tidy
+    '';
 
-  modInstallPhase = ''
-    mv -t vendor go.mod go.sum plugin.cfg
-    cp -r --reflink=auto vendor "$out"
-  '';
+    # Move the modified `go.mod`, `go.sum`, and `plugin.cfg` files into the
+    # vendor directory so we can retrieve them later in the `preBuild` hook.
+    postBuild = ''
+      mv -t vendor go.mod go.sum plugin.cfg
+    '';
+  };
 
   preBuild = ''
     chmod -R u+w vendor
diff --git a/pkgs/by-name/cr/crush/package.nix b/pkgs/by-name/cr/crush/package.nix
index 41f60d302c02..08a1470d2162 100644
--- a/pkgs/by-name/cr/crush/package.nix
+++ b/pkgs/by-name/cr/crush/package.nix
@@ -11,16 +11,16 @@
 
 buildGo126Module (finalAttrs: {
   pname = "crush";
-  version = "0.62.1";
+  version = "0.65.3";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = "crush";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kPG7NZEZ/uHhyx9GYbIkTmybfvTPuD+TTlWbRFQ0HzA=";
+    hash = "sha256-X+bCwpyAFUkM1ljj5I6w6gts6b6IWYm1d4veV0mR0gA=";
   };
 
-  vendorHash = "sha256-XlSHxR10ov0uvnqvu99Ax0kq/R/gnkX8fLaG98tTpe4=";
+  vendorHash = "sha256-moVpfFscZLz7mQw+pqaG132k9KTNyRdKOFNNd0RN1oo=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/da/daktari/optional-pyclip.patch b/pkgs/by-name/da/daktari/optional-pyclip.patch
new file mode 100644
index 000000000000..47bbb33d56c4
--- /dev/null
+++ b/pkgs/by-name/da/daktari/optional-pyclip.patch
@@ -0,0 +1,33 @@
+diff --git a/daktari/result_printer.py b/daktari/result_printer.py
+--- a/daktari/result_printer.py
++++ b/daktari/result_printer.py
+@@ -1,7 +1,11 @@
+ import re
+ import textwrap
+-import pyclip
+ from typing import Callable, Dict, Optional
+ 
++try:
++    import pyclip
++except ImportError:
++    pyclip = None
++
+ from colors import green, red, underline, yellow
+ 
+ from daktari.check import CheckResult, CheckStatus
+@@ -58,10 +62,13 @@ def copy_to_clipboard(suggestion: Optional[str]):
+         command_regex = re.compile(r"\<cmd\>(.*?)\<\/cmd\>")
+         results = command_regex.findall(suggestion)
+         if len(results) > 0:
+-            try:
+-                pyclip.copy("\n".join(results))
++            if pyclip is not None:
++                try:
++                    pyclip.copy("\n".join(results))
++                    print("ⓘ  Command copied to clipboard")
++                except pyclip.base.ClipboardSetupException:
+                     print("ⓘ  Clipboard not available")
++            else:
++                print("ⓘ  Clipboard not available")
+             return
+     print("ⓘ  No command available to copy to clipboard")
diff --git a/pkgs/by-name/da/daktari/package.nix b/pkgs/by-name/da/daktari/package.nix
new file mode 100644
index 000000000000..0079222b76d2
--- /dev/null
+++ b/pkgs/by-name/da/daktari/package.nix
@@ -0,0 +1,72 @@
+{
+  lib,
+  stdenv,
+  python3Packages,
+  fetchFromGitHub,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "daktari";
+  version = "0.0.319";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "genio-learn";
+    repo = "daktari";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-NxTDyul1BESr/fBow9hwmTLr6jcl4p5RlIKNzFbaJvc=";
+  };
+
+  patches = [ ./optional-pyclip.patch ];
+
+  pythonRelaxDeps = true;
+
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    # pyclip is broken on macOS in nixpkgs
+    substituteInPlace requirements.txt --replace-fail "pyclip==0.7.0" ""
+  '';
+
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  dependencies =
+    with python3Packages;
+    [
+      ansicolors
+      distro
+      pyfiglet
+      importlib-resources
+      packaging
+      requests
+      responses
+      semver
+      python-hosts
+      pyyaml
+      types-pyyaml
+      requests-unixsocket
+      dpath
+      pyopenssl
+      types-pyopenssl
+      urllib3
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      pyclip
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      pyobjc-core
+      pyobjc-framework-Cocoa
+    ];
+
+  pythonImportsCheck = [ "daktari" ];
+
+  meta = {
+    description = "Tool to assist in setting up and maintaining developer environments";
+    homepage = "https://github.com/genio-learn/daktari";
+    changelog = "https://github.com/genio-learn/daktari/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ tymscar ];
+    mainProgram = "daktari";
+  };
+})
diff --git a/pkgs/by-name/da/darkstat/package.nix b/pkgs/by-name/da/darkstat/package.nix
index b907988a7a81..4b62f528da2f 100644
--- a/pkgs/by-name/da/darkstat/package.nix
+++ b/pkgs/by-name/da/darkstat/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "darkstat";
-  version = "3.0.721";
+  version = "3.0.722";
 
   src = fetchFromGitHub {
     owner = "emikulic";
     repo = "darkstat";
     tag = finalAttrs.version;
-    hash = "sha256-kKj4fCgphoe3lojJfARwpITxQh7E6ehUew9FVEW63uQ=";
+    hash = "sha256-WJjunJx9WjzRky1FL0k25h84Ypv273KXR5qT5YhHmbs=";
   };
 
   patches = [
@@ -54,6 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/emikulic/darkstat/releases/tag/${finalAttrs.version}";
     license = lib.licenses.gpl2Only;
     platforms = with lib.platforms; unix;
+    maintainers = with lib.maintainers; [ tbutter ];
     mainProgram = "darkstat";
   };
 })
diff --git a/pkgs/by-name/da/dashy-ui/package.nix b/pkgs/by-name/da/dashy-ui/package.nix
index 5d9f0714653e..c3bfe85af7cf 100644
--- a/pkgs/by-name/da/dashy-ui/package.nix
+++ b/pkgs/by-name/da/dashy-ui/package.nix
@@ -9,24 +9,24 @@
   fixup-yarn-lock,
   prefetch-yarn-deps,
   nixosTests,
-  nodejs_20,
-  nodejs-slim_20,
+  nodejs_24,
+  nodejs-slim_24,
   remarshal_0_17,
   nix-update-script,
   settings ? { },
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "dashy-ui";
-  version = "3.3.1";
+  version = "4.0.5";
   src = fetchFromGitHub {
     owner = "lissy93";
     repo = "dashy";
     tag = finalAttrs.version;
-    hash = "sha256-EvyRLa+qUFPzmU2k5CVK8WH3D3vmcj9F8fzj3LEjYgg=";
+    hash = "sha256-vcNKnRcSQMU4AuvWTFdTlxVOAA0rlPCKUrDZbd+8/mk=";
   };
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-EMns5J8rM4qOfrACoX6lttOXh/RUtZjaKtd+BpsS6Xs=";
+    hash = "sha256-1FRrhNKm38/AP30F6Rf0cCHflIK9bWoxUCMMiT5c1Fc=";
   };
 
   passthru = {
@@ -56,17 +56,17 @@ stdenv.mkDerivation (finalAttrs: {
     # but they've been overridden for the sake of consistency/in case future updates to dashy/node would cause issues with differing major versions
     (yarnConfigHook.override {
       fixup-yarn-lock = fixup-yarn-lock.override {
-        nodejs-slim = nodejs-slim_20;
+        nodejs-slim = nodejs-slim_24;
       };
       prefetch-yarn-deps = prefetch-yarn-deps.override {
-        nodejs-slim = nodejs-slim_20;
+        nodejs-slim = nodejs-slim_24;
       };
       yarn = yarn.override {
-        nodejs = nodejs_20;
+        nodejs = nodejs_24;
       };
     })
     yarnBuildHook
-    nodejs_20
+    nodejs_24
     # For yaml conversion
     remarshal_0_17
   ];
diff --git a/pkgs/by-name/da/dawarich/0001-build-ffi-gem.diff b/pkgs/by-name/da/dawarich/0001-build-ffi-gem.diff
index 52544314e79e..c05bb7d61c4c 100644
--- a/pkgs/by-name/da/dawarich/0001-build-ffi-gem.diff
+++ b/pkgs/by-name/da/dawarich/0001-build-ffi-gem.diff
@@ -1,8 +1,8 @@
 diff --git a/Gemfile.lock b/Gemfile.lock
-index 9a7c7500..9215d45a 100644
+index d8d04266..75b34a35 100644
 --- a/Gemfile.lock
 +++ b/Gemfile.lock
-@@ -191,12 +191,7 @@ GEM
+@@ -194,12 +194,7 @@ GEM
      faraday-net_http (3.4.2)
        net-http (~> 0.5)
      ffaker (2.25.0)
@@ -15,4 +15,4 @@ index 9a7c7500..9215d45a 100644
 +    ffi (1.17.2)
      fit4ruby (3.13.0)
        bindata (~> 2.4.14)
-     foreman (0.90.0)
+     flipper (1.4.1)
diff --git a/pkgs/by-name/da/dawarich/0002-openssl-hotfix.diff b/pkgs/by-name/da/dawarich/0002-openssl-hotfix.diff
deleted file mode 100644
index a17bea34279e..000000000000
--- a/pkgs/by-name/da/dawarich/0002-openssl-hotfix.diff
+++ /dev/null
@@ -1,32 +0,0 @@
-diff --git a/Gemfile b/Gemfile
-index 36cf0d9c..fc914849 100644
---- a/Gemfile
-+++ b/Gemfile
-@@ -28,6 +28,7 @@ gem 'omniauth-github', '~> 2.0.0'
- gem 'omniauth-google-oauth2'
- gem 'omniauth_openid_connect'
- gem 'omniauth-rails_csrf_protection'
-+gem 'openssl'
- gem 'parallel'
- gem 'pg'
- gem 'prometheus_exporter'
-diff --git a/Gemfile.lock b/Gemfile.lock
-index a32eb801..b2fc45bc 100644
---- a/Gemfile.lock
-+++ b/Gemfile.lock
-@@ -348,6 +348,7 @@ GEM
-       tzinfo
-       validate_url
-       webfinger (~> 2.0)
-+    openssl (3.3.1)
-     optimist (3.2.1)
-     orm_adapter (0.5.0)
-     ostruct (0.6.1)
-@@ -665,6 +666,7 @@ DEPENDENCIES
-   omniauth-google-oauth2
-   omniauth-rails_csrf_protection
-   omniauth_openid_connect
-+  openssl
-   parallel
-   pg
-   prometheus_exporter
diff --git a/pkgs/by-name/da/dawarich/gemset.nix b/pkgs/by-name/da/dawarich/gemset.nix
index 24a5a03a7742..569b6969fe74 100644
--- a/pkgs/by-name/da/dawarich/gemset.nix
+++ b/pkgs/by-name/da/dawarich/gemset.nix
@@ -249,6 +249,21 @@
     };
     version = "1.1.0";
   };
+  apple_id = {
+    dependencies = [
+      "json-jwt"
+      "openid_connect"
+      "rack-oauth2"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0na7v2gb10lwhjrwb1nm6cgnggihzhnznzv3ha9qy3jq7gys41cw";
+      type = "gem";
+    };
+    version = "1.6.4";
+  };
   ast = {
     groups = [
       "default"
@@ -410,10 +425,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "19y406nx17arzsbc515mjmr6k5p59afprspa1k423yd9cp8d61wb";
+      sha256 = "1g9zi8c4i7g8zz0c3hxrw6mblrjvgn7akys60clb9si7c1k1gljk";
       type = "gem";
     };
-    version = "4.0.1";
+    version = "4.1.2";
   };
   bindata = {
     groups = [ "default" ];
@@ -431,10 +446,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "14qb2gy6ypnqri92v9x8szbq7fzw27pc1z5cl367n5f5cpd2rmks";
+      sha256 = "057jsch213i42qgdsz2vg1b190n2xvvbi3hgprc8nmaqim2ly9f1";
       type = "gem";
     };
-    version = "1.20.1";
+    version = "1.23.0";
   };
   brakeman = {
     dependencies = [ "racc" ];
@@ -623,25 +638,15 @@
     };
     version = "0.15.0";
   };
-  css-zero = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1jiihfxvfw0wl42m0jzpq94iqa2ra878dqllkk34w49pv0wsgrkz";
-      type = "gem";
-    };
-    version = "1.1.15";
-  };
   csv = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1kfqg0m6vqs6c67296f10cr07im5mffj90k2b5dsm51liidcsvp9";
+      sha256 = "0gz7r2kazwwwyrwi95hbnhy54kwkfac5swh2gy5p5vw36fn38lbf";
       type = "gem";
     };
-    version = "3.3.4";
+    version = "3.3.5";
   };
   data_migrate = {
     dependencies = [
@@ -867,10 +872,10 @@
     ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1rcpq49pyaiclpjp3c3qjl25r95hqvin2q2dczaynaj7qncxvv18";
+      sha256 = "1ncmbdjf2bwmk0jf5cxywns9zbxyfiy4h4p3pzi7yddyjhv81qrq";
       type = "gem";
     };
-    version = "6.0.1";
+    version = "6.0.4";
   };
   erubi = {
     groups = [
@@ -1013,6 +1018,49 @@
     };
     version = "3.13.0";
   };
+  flipper = {
+    dependencies = [ "concurrent-ruby" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0kbf2r2ayb91d1i0lbpj418pcv33dc24pqs9fl1wg4rhzd035105";
+      type = "gem";
+    };
+    version = "1.4.1";
+  };
+  flipper-active_record = {
+    dependencies = [
+      "activerecord"
+      "flipper"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0dss4hhnw6ypn2yh0cq2yi08cwvkv0kqjxxih7214slps0d4i5si";
+      type = "gem";
+    };
+    version = "1.4.1";
+  };
+  flipper-ui = {
+    dependencies = [
+      "erubi"
+      "flipper"
+      "rack"
+      "rack-protection"
+      "rack-session"
+      "sanitize"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "168agvgc6skln31x3r5ic5c6varc3m5b1gxnpkxq5p9gslvm53mp";
+      type = "gem";
+    };
+    version = "1.4.1";
+  };
   foreman = {
     dependencies = [ "thor" ];
     groups = [ "development" ];
@@ -1065,6 +1113,17 @@
     };
     version = "1.3.0";
   };
+  google-id-token = {
+    dependencies = [ "jwt" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1lb9iqzx0fi2f4x2m9dwimpfvxqz3ck73gx9sh8mb88klbhyp26h";
+      type = "gem";
+    };
+    version = "1.4.2";
+  };
   gpx = {
     dependencies = [
       "csv"
@@ -1075,10 +1134,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1cgm6dzzpslhgxcqcgqnpvargrq9d3v2xhxgan1l1cayc33pn837";
+      sha256 = "06p5wkyj6lcj01szv22g1jcx8qkkpc4cypj9hdmji9n9h5ipd8bq";
       type = "gem";
     };
-    version = "1.2.1";
+    version = "1.2.2";
   };
   groupdate = {
     dependencies = [ "activesupport" ];
@@ -1207,6 +1266,7 @@
   irb = {
     dependencies = [
       "pp"
+      "prism"
       "rdoc"
       "reline"
     ];
@@ -1232,10 +1292,10 @@
     ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "01h8bdksg0cr8bw5dhlhr29ix33rp822jmshy6rdqz4lmk4mdgia";
+      sha256 = "1qs8a9vprg7s8krgq4s0pygr91hclqqyz98ik15p0m1sf2h5956y";
       type = "gem";
     };
-    version = "1.16.0";
+    version = "1.18.0";
   };
   jmespath = {
     groups = [ "default" ];
@@ -1428,10 +1488,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1rk0n13c9nmk8di2x5gqk5r04vf8bkp7ff6z0b44wsmc7fndfpnz";
+      sha256 = "011fdngxzr1p9dq2hxqz7qq1glj2g44xnhaadjqlf48cplywfdnl";
       type = "gem";
     };
-    version = "2.25.0";
+    version = "2.25.1";
   };
   mail = {
     dependencies = [
@@ -1528,10 +1588,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0gdwmn2d4sznjdxyl3kz7hr95mvdgm38fk1vd0s63k3fdyamfvnv";
+      sha256 = "1wfnqyfayx9n9j7x871v2ars4hjhfisi1dl24fa64ylq3mns6ghm";
       type = "gem";
     };
-    version = "6.0.2";
+    version = "6.0.6";
   };
   msgpack = {
     groups = [ "default" ];
@@ -1627,10 +1687,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1a9www524fl1ykspznz54i0phfqya4x45hqaz67in9dvw1lfwpfr";
+      sha256 = "18fwy5yqnvgixq3cn0h63lm8jaxsjjxkmj8rhiv8wpzv9271d43c";
       type = "gem";
     };
-    version = "2.7.4";
+    version = "2.7.5";
   };
   nokogiri = {
     dependencies = [
@@ -1646,10 +1706,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "15anyh2ir3kdji93kw770xxwm5rspn9rzx9b9zh1h9gnclcd4173";
+      sha256 = "1s30b7h7qpyim30m8060xs415mbr3ci7i5hdg09chh1aqfx2qcbq";
       type = "gem";
     };
-    version = "1.19.0";
+    version = "1.19.3";
   };
   oauth2 = {
     dependencies = [
@@ -1796,16 +1856,6 @@
     };
     version = "2.3.1";
   };
-  openssl = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0dzq3k5hmqlav2mwf7bc10mr1mlmlnpin498g7jhbhpdpa324s6n";
-      type = "gem";
-    };
-    version = "3.3.1";
-  };
   optimist = {
     groups = [
       "default"
@@ -1839,20 +1889,6 @@
     };
     version = "0.6.1";
   };
-  pagy = {
-    dependencies = [
-      "json"
-      "yaml"
-    ];
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "08pikkvj916fw75l7ycmzb3gf1w9cp3h1jphls0pnqbphf1v3r4g";
-      type = "gem";
-    };
-    version = "43.2.2";
-  };
   parallel = {
     groups = [
       "default"
@@ -2091,10 +2127,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1pa9zpr51kqnsq549p6apvnr95s9flx6bnwqii24s8jg2b5i0p74";
+      sha256 = "1a3jd9qakasizrf7dkq5mqv51fjf02r2chybai2nskjaa6mz93mz";
       type = "gem";
     };
-    version = "7.1.0";
+    version = "7.2.0";
   };
   pundit = {
     dependencies = [ "activesupport" ];
@@ -2141,10 +2177,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1lyn3rh71rlf50p44xmsbha0pip4c95004j8kc9pm7xpq1s0kgac";
+      sha256 = "1hhjy9gcp52dzij05gmidqac8g28ski5xm67prwmdqmjfcgqxmsy";
       type = "gem";
     };
-    version = "3.2.5";
+    version = "3.2.6";
   };
   rack-attack = {
     dependencies = [ "rack" ];
@@ -2198,15 +2234,16 @@
     groups = [
       "default"
       "development"
+      "staging"
       "test"
     ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1sg4laz2qmllxh1c5sqlj9n1r7scdn08p3m4b0zmhjvyx9yw0v8b";
+      sha256 = "1s7zcxlmg88a6dam4aqbgk9xkpy6dkdfqmmcszkkliy3q3w38m2r";
       type = "gem";
     };
-    version = "2.1.1";
+    version = "2.1.2";
   };
   rack-test = {
     dependencies = [ "rack" ];
@@ -2290,15 +2327,16 @@
     groups = [
       "default"
       "development"
+      "staging"
       "test"
     ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0q55i6mpad20m2x1lg5pkqfpbmmapk0sjsrvr1sqgnj2hb5f5z1m";
+      sha256 = "128y5g3fyi8fds41jasrr4va1jrs7hcamzklk1523k7rxb64bc98";
       type = "gem";
     };
-    version = "1.6.2";
+    version = "1.7.0";
   };
   rails_icons = {
     dependencies = [
@@ -2314,25 +2352,6 @@
     };
     version = "1.4.0";
   };
-  rails_pulse = {
-    dependencies = [
-      "css-zero"
-      "groupdate"
-      "pagy"
-      "rails"
-      "ransack"
-      "request_store"
-      "turbo-rails"
-    ];
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1mla44nhcpr57i4dqir173b3jyzfpvy9prnzyz5nlf0ny3hysk5s";
-      type = "gem";
-    };
-    version = "0.2.4";
-  };
   railties = {
     dependencies = [
       "actionpack"
@@ -2381,25 +2400,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "175iisqb211n0qbfyqd8jz2g01q6xj038zjf4q0nm8k6kz88k7lc";
+      sha256 = "009p524zl0p0kfa65nii8wdmaigkmawv9pbvlcffky7islmmp0nb";
       type = "gem";
     };
-    version = "13.3.1";
-  };
-  ransack = {
-    dependencies = [
-      "activerecord"
-      "activesupport"
-      "i18n"
-    ];
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0gd6nwr0xlvgas21p1qgw90cg27xdi70988dw5q8a20rzhvarska";
-      type = "gem";
-    };
-    version = "4.4.1";
+    version = "13.4.2";
   };
   rdoc = {
     dependencies = [
@@ -2429,10 +2433,10 @@
     ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0qvky4s2fx5xbaz1brxanalqbcky3c7xbqd6dicpih860zgrjj29";
+      sha256 = "14iiyb4yi1chdzrynrk74xbhmikml3ixgdayjma3p700singfl46";
       type = "gem";
     };
-    version = "7.1.0";
+    version = "7.2.0";
   };
   redis = {
     dependencies = [ "redis-client" ];
@@ -2853,6 +2857,20 @@
     };
     version = "3.2.2";
   };
+  sanitize = {
+    dependencies = [
+      "crass"
+      "nokogiri"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "111r4xdcf6ihdnrs6wkfc6nqdzrjq0z69x9sf83r7ri6fffip796";
+      type = "gem";
+    };
+    version = "7.0.0";
+  };
   securerandom = {
     groups = [
       "default"
@@ -2893,24 +2911,25 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1rkp3wpikhwvypabw578rqk5660xkv741jl59dvk34h9b1z9g8g1";
+      sha256 = "1r5031qb02xmwmkrrz8ald4gc35xgcgz2h089873w33l5kcd9ygb";
       type = "gem";
     };
-    version = "6.2.0";
+    version = "6.5.0";
   };
   sentry-ruby = {
     dependencies = [
       "bigdecimal"
       "concurrent-ruby"
+      "logger"
     ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "05xcf7dwqd59nklk29r4dmdjjpy8hb19rccls5mm7l50ldca7f6p";
+      sha256 = "0srsbyw11h4gkr75vv4xcws8b9a9h7ii8wf3kb6syyh1d86swmrw";
       type = "gem";
     };
-    version = "6.2.0";
+    version = "6.5.0";
   };
   shoulda-matchers = {
     dependencies = [ "activesupport" ];
@@ -3433,16 +3452,6 @@
     };
     version = "3.2.0";
   };
-  yaml = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0hhr8z9m9yq2kf7ls0vf8ap1hqma1yd72y2r13b88dffwv8nj3i4";
-      type = "gem";
-    };
-    version = "0.4.0";
-  };
   zeitwerk = {
     groups = [
       "default"
@@ -3453,9 +3462,9 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "12zcvhzfnlghzw03czy2ifdlyfpq0kcbqcmxqakfkbxxavrr1vrb";
+      sha256 = "1pbkiwwla5gldgb3saamn91058nl1sq1344l5k36xsh9ih995nnq";
       type = "gem";
     };
-    version = "2.7.4";
+    version = "2.7.5";
   };
 }
diff --git a/pkgs/by-name/da/dawarich/package.nix b/pkgs/by-name/da/dawarich/package.nix
index 14e673531ebb..acd55e201bc0 100644
--- a/pkgs/by-name/da/dawarich/package.nix
+++ b/pkgs/by-name/da/dawarich/package.nix
@@ -35,10 +35,6 @@ stdenv.mkDerivation (finalAttrs: {
     patches = [
       # bundix and bundlerEnv fail with system-specific gems
       ./0001-build-ffi-gem.diff
-      # openssl 3.6.0 breaks ruby openssl gem
-      # See https://github.com/NixOS/nixpkgs/issues/456753
-      # and https://github.com/ruby/openssl/issues/949#issuecomment-3370358680
-      ./0002-openssl-hotfix.diff
     ];
     postPatch = ''
       substituteInPlace ./Gemfile \
@@ -114,7 +110,7 @@ stdenv.mkDerivation (finalAttrs: {
     # tests are not needed at runtime
     rm -rf spec e2e
     # delete artifacts from patching
-    rm *.orig
+    rm -f *.orig
 
     mkdir -p $out
     mv .{ruby*,app_version} $out/
diff --git a/pkgs/by-name/da/dawarich/sources.json b/pkgs/by-name/da/dawarich/sources.json
index a81affa1db83..cbe5e3e0a91d 100644
--- a/pkgs/by-name/da/dawarich/sources.json
+++ b/pkgs/by-name/da/dawarich/sources.json
@@ -1,5 +1,5 @@
 {
-  "version": "1.6.1",
-  "hash": "sha256-IPa8tfDsE3nNpzQ/Fnul3Fd6J5iQvLZR+3n4CHkVuI0=",
-  "npmHash": "sha256-Y6tEaApfGXAtmy0W85+4qGbrEkUkrKXTssl7wXeVnQY="
+  "version": "1.7.5",
+  "hash": "sha256-MjiU7IiAiCpKGbUexHjGl9yX8oLgX7WtVrN5yP6hXsk=",
+  "npmHash": "sha256-CwpVV5xLw75ReS0IqFvV3oaVk6EBlqYIKRa2KehVwFQ="
 }
diff --git a/pkgs/by-name/do/dockerfile-pin/package.nix b/pkgs/by-name/do/dockerfile-pin/package.nix
new file mode 100644
index 000000000000..6300d8438938
--- /dev/null
+++ b/pkgs/by-name/do/dockerfile-pin/package.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  makeWrapper,
+  docker-credential-helpers,
+  gitMinimal,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "dockerfile-pin";
+  version = "1.3.0";
+
+  src = fetchFromGitHub {
+    owner = "azu";
+    repo = "dockerfile-pin";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-vBBcLQ4ZgiLbUMuDvn8Um24yB9EknuUeU+sxMdg+qoc=";
+  };
+
+  vendorHash = "sha256-CgMFIYoM+nWiZ5NXtTlXHhrjzVYxoVg0YVpQq3LLrjI=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=github.com/azu/dockerfile-pin/cmd.version=${finalAttrs.version}"
+  ];
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  postFixup = ''
+    wrapProgram $out/bin/dockerfile-pin \
+      --prefix PATH : ${lib.makeBinPath [ docker-credential-helpers ]}
+  '';
+
+  nativeCheckInputs = [ gitMinimal ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "version";
+
+  passthru.updateScript = nix-update-script { };
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "Add sha256 digests to Docker images in Dockerfiles, Compose, and GitHub Actions";
+    homepage = "https://github.com/azu/dockerfile-pin";
+    changelog = "https://github.com/azu/dockerfile-pin/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ airrnot ];
+    mainProgram = "dockerfile-pin";
+  };
+})
diff --git a/pkgs/by-name/do/doctl/package.nix b/pkgs/by-name/do/doctl/package.nix
index 1549f863373d..4bff43e3673a 100644
--- a/pkgs/by-name/do/doctl/package.nix
+++ b/pkgs/by-name/do/doctl/package.nix
@@ -9,7 +9,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "doctl";
-  version = "1.155.0";
+  version = "1.157.0";
 
   vendorHash = null;
 
@@ -42,7 +42,7 @@ buildGoModule (finalAttrs: {
     owner = "digitalocean";
     repo = "doctl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sN/ZC3TAUiQokSZax3oF6LMl/H7lCCgtEjjcpy44aTY=";
+    hash = "sha256-pkMJg7lTPR2qQ+E5F7Cd0RA/81x5tDvB7zXyzGn2BcM=";
   };
 
   meta = {
diff --git a/pkgs/applications/misc/dupeguru/default.nix b/pkgs/by-name/du/dupeguru/package.nix
similarity index 72%
rename from pkgs/applications/misc/dupeguru/default.nix
rename to pkgs/by-name/du/dupeguru/package.nix
index 06af2c764027..beafc8424f88 100644
--- a/pkgs/applications/misc/dupeguru/default.nix
+++ b/pkgs/by-name/du/dupeguru/package.nix
@@ -4,42 +4,40 @@
   python3Packages,
   gettext,
   qt5,
+  writableTmpDirAsHomeHook,
   fetchFromGitHub,
 }:
-
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "dupeguru";
-  version = "4.3.1";
+  version = "4.3.1-unstable-2026-01-06";
 
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "arsenetar";
     repo = "dupeguru";
-    rev = version;
-    hash = "sha256-/jkZiCapmCLMp7WfgUmpsR8aNCfb3gBELlMYaC4e7zI=";
+    rev = "16aa6c21ffc2c33d44ff4a47bfa1a623c16ed626";
+    hash = "sha256-0x2ZpjaxpWVhm9vimDA06y1BOvpoU6KZYz5MPAoWAts=";
   };
 
-  patches = [
-    ./remove-setuptools-sandbox.patch
-  ];
-
   nativeBuildInputs = [
     gettext
     python3Packages.pyqt5
     python3Packages.setuptools
+    python3Packages.sphinx
     qt5.wrapQtAppsHook
+    writableTmpDirAsHomeHook
   ];
 
   propagatedBuildInputs = with python3Packages; [
-    hsaudiotag3k
+    distro
     mutagen
     polib
     pyqt5
     pyqt5-sip
     semantic-version
     send2trash
-    sphinx
+    xxhash
   ];
 
   makeFlags = [
@@ -51,13 +49,11 @@ python3Packages.buildPythonApplication rec {
     pytestCheckHook
   ];
 
-  preCheck = ''
-    export HOME="$(mktemp -d)"
-  '';
-
   # Avoid double wrapping Python programs.
   dontWrapQtApps = true;
 
+  installTargets = "install installdocs";
+
   # TODO: A bug in python wrapper
   # see https://github.com/NixOS/nixpkgs/pull/75054#discussion_r357656916
   preFixup = ''
@@ -74,9 +70,10 @@ python3Packages.buildPythonApplication rec {
     broken = stdenv.hostPlatform.isDarwin;
     description = "GUI tool to find duplicate files in a system";
     homepage = "https://github.com/arsenetar/dupeguru";
-    license = lib.licenses.bsd3;
+    changelog = "https://github.com/arsenetar/dupeguru/releases/tag/${builtins.head (lib.strings.splitString "-" finalAttrs.version)}";
+    license = lib.licenses.gpl3;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ novoxd ];
     mainProgram = "dupeguru";
   };
-}
+})
diff --git a/pkgs/by-name/en/envoy/0005-nixpkgs-pin-go-sdk-downloads.patch b/pkgs/by-name/en/envoy/0005-nixpkgs-pin-go-sdk-downloads.patch
new file mode 100644
index 000000000000..ebf12f1ff0e4
--- /dev/null
+++ b/pkgs/by-name/en/envoy/0005-nixpkgs-pin-go-sdk-downloads.patch
@@ -0,0 +1,79 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Daniel Baker <dan@djacu.dev>
+Date: Thu, 30 Apr 2026 08:42:44 -0700
+Subject: [PATCH] nixpkgs: pin Go SDK downloads
+
+Pin Go SDK downloads to avoid fetching the mutable version listing from
+https://go.dev/dl/?mode=json&include=all. Without explicit sdks, each
+go_download_sdk call downloads that listing (which changes with every Go
+release) and caches it in repository_cache, causing the deps hash to
+drift. See: io_bazel_rules_go/go/private/sdk.bzl lines 74-93 (rules_go
+v0.50.0)
+
+Signed-off-by: Daniel Baker <dan@djacu.dev>
+---
+ bazel/dependency_imports.bzl | 19 ++++++++++++++++++-
+ 1 file changed, 18 insertions(+), 1 deletion(-)
+
+diff --git a/bazel/dependency_imports.bzl b/bazel/dependency_imports.bzl
+index 90e49d5ceb0024b57481b816518990f58fc2ad5f..26091a877ea3951bfe69944ab8580857e787bb64 100644
+--- a/bazel/dependency_imports.bzl
++++ b/bazel/dependency_imports.bzl
+@@ -27,6 +27,18 @@ load("@rules_rust//rust:repositories.bzl", "rules_rust_dependencies", "rust_regi
+ # go version for rules_go
+ GO_VERSION = "1.24.6"
+ 
++# Pin Go SDK downloads to avoid fetching the mutable version listing from
++# https://go.dev/dl/?mode=json&include=all. Without explicit sdks, each
++# go_download_sdk call downloads that listing (which changes with every Go
++# release) and caches it in repository_cache, causing the deps hash to drift.
++# See: io_bazel_rules_go/go/private/sdk.bzl lines 74-93 (rules_go v0.50.0)
++_GO_SDKS = {
++    "linux_amd64": ["go" + GO_VERSION + ".linux-amd64.tar.gz", "bbca37cc395c974ffa4893ee35819ad23ebb27426df87af92e93a9ec66ef8712"],
++    "linux_arm64": ["go" + GO_VERSION + ".linux-arm64.tar.gz", "124ea6033a8bf98aa9fbab53e58d134905262d45a022af3a90b73320f3c3afd5"],
++    "darwin_amd64": ["go" + GO_VERSION + ".darwin-amd64.tar.gz", "4a8d7a32052f223e71faab424a69430455b27b3fff5f4e651f9d97c3e51a8746"],
++    "darwin_arm64": ["go" + GO_VERSION + ".darwin-arm64.tar.gz", "4e29202c49573b953be7cc3500e1f8d9e66ddd12faa8cf0939a4951411e09a2a"],
++}
++
+ JQ_VERSION = "1.7"
+ YQ_VERSION = "4.24.4"
+ 
+@@ -46,7 +58,8 @@ def envoy_dependency_imports(
+         register_preinstalled_tools=True,  # use host tools (default)
+     )
+     go_rules_dependencies()
+-    go_register_toolchains(go_version)
++    go_download_sdk(name = "go_sdk", version = go_version, sdks = _GO_SDKS)
++    go_register_toolchains()
+     if go_version != "host":
+         envoy_download_go_sdks(go_version)
+     gazelle_dependencies(go_sdk = "go_sdk")
+@@ -218,24 +231,28 @@ def envoy_download_go_sdks(go_version):
+         goos = "linux",
+         goarch = "amd64",
+         version = go_version,
++        sdks = _GO_SDKS,
+     )
+     go_download_sdk(
+         name = "go_linux_arm64",
+         goos = "linux",
+         goarch = "arm64",
+         version = go_version,
++        sdks = _GO_SDKS,
+     )
+     go_download_sdk(
+         name = "go_darwin_amd64",
+         goos = "darwin",
+         goarch = "amd64",
+         version = go_version,
++        sdks = _GO_SDKS,
+     )
+     go_download_sdk(
+         name = "go_darwin_arm64",
+         goos = "darwin",
+         goarch = "arm64",
+         version = go_version,
++        sdks = _GO_SDKS,
+     )
+ 
+ def crates_repositories():
diff --git a/pkgs/by-name/en/envoy/package.nix b/pkgs/by-name/en/envoy/package.nix
index 58486835903b..a61b122769a4 100644
--- a/pkgs/by-name/en/envoy/package.nix
+++ b/pkgs/by-name/en/envoy/package.nix
@@ -43,14 +43,19 @@ let
     hash = "sha256-dT6ehfmW/huuyitqIlYAlEzUE6WrVA39sDKxatkZGaY=";
   };
 
+  # When GO_VERSION changes upstream, update the four sha256 hex strings in the
+  # _GO_SDKS dict in 0005-nixpkgs-pin-go-sdk-downloads.patch using output from
+  # this command (set the version literal in `select` to match GO_VERSION):
+  #   curl -s 'https://go.dev/dl/?mode=json&include=all' | jq -r '.[] | select(.version == "go1.24.6") | .files[] | select(.kind == "archive" and (.os == "linux" or .os == "darwin") and (.arch == "amd64" or .arch == "arm64")) | "\(.os)_\(.arch): \(.sha256)"'
+
   # these need to be updated for any changes to fetchAttrs
   depsHash' =
     if depsHash != null then
       depsHash
     else
       {
-        x86_64-linux = "sha256-dQpkB4jRfJOB14AO5ynoL3VObI1af7nTI3vbMr5N6/g=";
-        aarch64-linux = "sha256-59sY+bpGsKMDthcj+jw00WhN+vsP5MOTXy0m8HJxebM=";
+        x86_64-linux = "sha256-+oEQV3VfZu+p/f6Sif9pj2AkaA9+u0M8k+czdlcDLXI=";
+        aarch64-linux = "sha256-FcZfRinOd5KO6VnO9cx6ZQxJJ+KCFfB3Nk2k7zMuVU4";
       }
       .${stdenv.system} or (throw "unsupported system ${stdenv.system}");
 
@@ -80,6 +85,9 @@ buildBazelPackage rec {
 
       # bump rules_rust to support newer Rust
       ./0004-nixpkgs-bump-rules_rust-to-0.60.0.patch
+
+      # pin Go SDK downloads so the deps hash doesn't drift on every Go release
+      ./0005-nixpkgs-pin-go-sdk-downloads.patch
     ];
     postPatch = ''
       chmod -R +w .
diff --git a/pkgs/by-name/es/esdm/package.nix b/pkgs/by-name/es/esdm/package.nix
index 2092cf4f8585..57f1b2e2749e 100644
--- a/pkgs/by-name/es/esdm/package.nix
+++ b/pkgs/by-name/es/esdm/package.nix
@@ -18,22 +18,31 @@
   # A brief explanation is given.
 
   # general options
-  selinux ? true, # enable selinux support
-  fips140 ? true, # enable FIPS 140 checksum support
+  selinux ? false, # enable selinux support
+  fips140 ? false, # enable FIPS 140 checksum support
   ais2031 ? true, # set the seeding strategy to be compliant with AIS 20/31
   sp80090c ? true, # set compliance with NIST SP800-90C
   cryptoBackend ? "botan", # set backend for hash and drbg operations
   linuxDevFiles ? true, # enable linux /dev/random and /dev/urandom support
   linuxGetRandom ? true, # enable linux getrandom support
   openSSLRandProvider ? true, # build ESDM provider for OpenSSL 3.x
-  maxThreads ? 1024, # number of RPC handler threads
+  maxThreads ? 64, # number of RPC handler threads
   validationHelpers ? true, # used to analyze entropy output from esdm_es
   numAuxPools ? 128, # use multiple hash pools for e.g. smartcard input
-  serverTermOnSignal ? false, # use select with timeout in server watch loop
+  auxHasFullEntropy ? false, # is already conditioned data inserted into aux pool?
+
+  # DRNG-related options
+  drngReseedThresholdBits ? lib.fromHexString "0xffffffff",
+  drngMaxReseedBits ? lib.fromHexString "0xffffffff",
 
   # entropy sources
   esJitterRng ? true, # enable support for the entropy source: jitter rng (running in user space)
   esJitterRngEntropyRate ? 256, # amount of entropy to account for jitter rng source
+  esJitterRngNtg1 ? false, # configures jitterentropy NTG.1 mode
+  esJitterRngAllCaches ? false, # use all caches in calculating size of memory buffer?
+  esJitterRngMaxMem ? -1, # set static maximum size of memory buffer, -1 disables it
+  esJitterRngHashLoopCount ? -1, # set increased hashloop count, -1 disables it
+  esJitterRngOsr ? 3, # set larger oversampling rate if necessary, (default 3)
   esJitterRngEntropyBlocks ? 128, # number of cached entropy blocks for jitterentropy
   esJitterRngKernel ? false, # enable support for the entropy source: jitter rng (running in kernel space)
   esJitterRngKernelEntropyRate ? 256, # amount of entropy to account for kernel jitter rng source
@@ -41,6 +50,8 @@
   esCPUEntropyRate ? 256, # amount of entropy to account for cpu rng source
   esKernel ? false, # enable support for the entropy source: kernel-based entropy
   esKernelEntropyRate ? 256, # amount of entropy to account for kernel-based source
+  esTPM2 ? true, # enable support for the entropy source: TPM-based entropy
+  esTPM2EntropyRate ? 256, # amount of entropy to account for TPM-based source
   esIRQ ? false, # enable support for the entropy source: interrupt-based entropy
   esIRQEntropyRate ? 256, # amount of entropy to account for interrupt-based source (only set irq XOR sched != 0)
   esSched ? false, # enable support for the entropy source: scheduler-based entropy
@@ -50,20 +61,20 @@
 
   # kernel seeding
   linuxKernelReseedInterval ? 60, # how often to push entropy into Linux kernel, iff seeder service is started
-  linuxKernelReseedEntropyRate ? 256, # how many bits to account on kernel (re-)seeding
+  linuxKernelReseedEntropyRate ? 512, # how many bits to account on kernel (re-)seeding
 }:
 
 assert cryptoBackend == "openssl" || cryptoBackend == "botan";
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "esdm";
-  version = "1.2.1";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner = "smuellerDD";
     repo = "esdm";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-41vc5mB2MiQJu0HXFzSjiudlu1sRj2IP8FcFPQfu5uo=";
+    hash = "sha256-0s9YOqa+sn0rk5YoMWZczO1TB5/wpbFsdkaVWFf4ipI=";
   };
 
   nativeBuildInputs = [
@@ -89,13 +100,18 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonBool "sp80090c" sp80090c)
     (lib.mesonEnable "node" true) # multiple DRNGs
     (lib.mesonEnable "systemd" true) # systemd notify and socket support
-    (lib.mesonOption "threading_max_threads" (toString maxThreads))
+    (lib.mesonOption "threading_max_worker_threads" (toString maxThreads))
     (lib.mesonOption "crypto_backend" cryptoBackend)
     (lib.mesonEnable "linux-devfiles" linuxDevFiles)
     (lib.mesonEnable "linux-getrandom" linuxGetRandom)
     (lib.mesonEnable "es_jent" esJitterRng)
     (lib.mesonOption "es_jent_entropy_rate" (toString esJitterRngEntropyRate))
     (lib.mesonOption "es_jent_entropy_blocks" (toString esJitterRngEntropyBlocks))
+    (lib.mesonEnable "es_jent_ntg1" esJitterRngNtg1)
+    (lib.mesonEnable "es_jent_all_caches" esJitterRngAllCaches)
+    (lib.mesonOption "es_jent_max_mem" (toString esJitterRngMaxMem))
+    (lib.mesonOption "es_jent_hash_loop_count" (toString esJitterRngHashLoopCount))
+    (lib.mesonOption "es_jent_osr" (toString esJitterRngOsr))
     (lib.mesonEnable "es_jent_kernel" esJitterRngKernel)
     (lib.mesonOption "es_jent_kernel_entropy_rate" (toString esJitterRngKernelEntropyRate))
     (lib.mesonEnable "es_cpu" esCPU)
@@ -108,13 +124,17 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonOption "es_sched_entropy_rate" (toString esSchedEntropyRate))
     (lib.mesonEnable "es_hwrand" esHwrand)
     (lib.mesonOption "es_hwrand_entropy_rate" (toString esHwrandEntropyRate))
+    (lib.mesonEnable "es_tpm2" esTPM2)
+    (lib.mesonOption "es_tpm2_entropy_rate" (toString esTPM2EntropyRate))
     (lib.mesonEnable "selinux" selinux)
     (lib.mesonEnable "openssl-rand-provider" openSSLRandProvider)
     (lib.mesonOption "linux-reseed-interval" (toString linuxKernelReseedInterval))
     (lib.mesonOption "linux-reseed-entropy-count" (toString linuxKernelReseedEntropyRate))
     (lib.mesonEnable "validation-helpers" validationHelpers)
     (lib.mesonOption "num-aux-pools" (toString numAuxPools))
-    (lib.mesonBool "esdm-server-term-on-signal" serverTermOnSignal)
+    (lib.mesonEnable "aux-has-full-entropy" auxHasFullEntropy)
+    (lib.mesonOption "drng_reseed_threshold_bits" (toString drngReseedThresholdBits))
+    (lib.mesonOption "drng_max_reseed_bits" (toString drngMaxReseedBits))
   ];
 
   postFixup = lib.optionals fips140 ''
@@ -125,6 +145,8 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = true;
 
   strictDeps = true;
+  __structuredAttrs = true;
+
   mesonBuildType = "release";
 
   meta = {
diff --git a/pkgs/by-name/et/etherpad-lite/package.nix b/pkgs/by-name/et/etherpad-lite/package.nix
index 918957c3dc19..b6736566c593 100644
--- a/pkgs/by-name/et/etherpad-lite/package.nix
+++ b/pkgs/by-name/et/etherpad-lite/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "etherpad-lite";
-  version = "2.6.1";
+  version = "2.7.2";
 
   src = fetchFromGitHub {
     owner = "ether";
     repo = "etherpad-lite";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KzkrJv9eBzzt9PSJGhzC0lxCOfQImSTHcTVlea8HV70=";
+    hash = "sha256-8DCgbfp3ttpMTXS9SNkN1R63LZHaklsNHViRhmWVFuk=";
   };
 
   patches = [
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_9;
     fetcherVersion = 3;
-    hash = "sha256-y5T7yerCK9MtTri3eZ+Iih7/DK9IMDC+d7ej746g47E=";
+    hash = "sha256-2nKpmGxC+KVg0oF0BsswS9L84QxzpRF7NvKyqyQ7WJM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ev/everest-bin/package.nix b/pkgs/by-name/ev/everest-bin/package.nix
index c4f1b231d1f9..8b98f80f3667 100644
--- a/pkgs/by-name/ev/everest-bin/package.nix
+++ b/pkgs/by-name/ev/everest-bin/package.nix
@@ -8,15 +8,15 @@
 
 let
   pname = "everest";
-  version = "6249";
+  version = "6286";
   phome = "$out/lib/Celeste";
 in
 stdenvNoCC.mkDerivation {
   inherit pname version;
   src = fetchzip {
-    url = "https://github.com/EverestAPI/Everest/releases/download/stable-1.6249.0/main.zip";
+    url = "https://github.com/EverestAPI/Everest/releases/download/stable-1.6286.0/main.zip";
     extension = "zip";
-    hash = "sha256-xcWscldogSI7vmljg8uU0zV8gREVe5rLHj0l6X+0z9E=";
+    hash = "sha256-QhC/VZTy7TxIuJZKjqIKWvX/t8d+5EAFhQiS1R9AnQ4=";
   };
   buildInputs = [
     icu
diff --git a/pkgs/by-name/ev/everest/package.nix b/pkgs/by-name/ev/everest/package.nix
index dcf359861840..dda1cae846f7 100644
--- a/pkgs/by-name/ev/everest/package.nix
+++ b/pkgs/by-name/ev/everest/package.nix
@@ -11,8 +11,8 @@
 
 let
   pname = "everest";
-  version = "6249";
-  rev = "201a0dc2e0851f2bc601ed48cc1a64b17952e5ea";
+  version = "6286";
+  rev = "dcc400b1724b4762ca92b50e8d274f66ddeafa0c";
   phome = "$out/lib/Celeste";
 in
 buildDotnetModule {
@@ -25,7 +25,7 @@ buildDotnetModule {
     fetchSubmodules = true;
     # TODO: use leaveDotGit = true and modify external/MonoMod in postFetch to please SourceLink
     # Microsoft.SourceLink.Common.targets(53,5): warning : Source control information is not available - the generated source link is empty.
-    hash = "sha256-ISCL6C1Zj18fMsfBAte9cqAWCA6/4eewKmefYmTm2uA=";
+    hash = "sha256-I2Cy3gGAqD9Irxg44qFH48piJQSn1CpmetyUvJs35cE=";
   };
 
   nativeBuildInputs = [ autoPatchelfHook ];
diff --git a/pkgs/by-name/fa/fairywren/package.nix b/pkgs/by-name/fa/fairywren/package.nix
index bfd0043cffd6..5228890bf1c8 100644
--- a/pkgs/by-name/fa/fairywren/package.nix
+++ b/pkgs/by-name/fa/fairywren/package.nix
@@ -22,13 +22,13 @@ lib.checkListOfEnum "${pname}: colorVariants" colorVariantList colorVariants
   stdenvNoCC.mkDerivation
   {
     inherit pname;
-    version = "0-unstable-2026-04-27";
+    version = "0-unstable-2026-05-06";
 
     src = fetchFromGitLab {
       owner = "aiyahm";
       repo = "FairyWren-Icons";
-      rev = "480e57a9ee90f8de05189f92dc5651fced9bc913";
-      hash = "sha256-1iz7Sv4XjoFcpo7XqB5iRHmki0hPE0kqqkH+ATVTPpY=";
+      rev = "ea33df10bcc0054b1981f859dcbcc36a77de9107";
+      hash = "sha256-Y4siWzKOmHBATSeoJ+Y5FbntsJYLFp8nmMcQq/UQGXw=";
     };
 
     propagatedBuildInputs = [
diff --git a/pkgs/by-name/fi/fish/disable_suid_test.patch b/pkgs/by-name/fi/fish/disable_suid_test.patch
index bfbfe5797985..ab22ee08b6e2 100644
--- a/pkgs/by-name/fi/fish/disable_suid_test.patch
+++ b/pkgs/by-name/fi/fish/disable_suid_test.patch
@@ -1,17 +1,37 @@
-diff --git a/tests/checks/path.fish b/tests/checks/path.fish
-index 62812571a..b0eebcd91 100644
---- a/tests/checks/path.fish
-+++ b/tests/checks/path.fish
-@@ -117,12 +117,6 @@ path filter --type file,dir --perm exec,write bin/fish .
+diff --git i/tests/checks/path.fish w/tests/checks/path.fish
+index 4bf14878e..4024c6d34 100644
+--- i/tests/checks/path.fish
++++ w/tests/checks/path.fish
+@@ -135,32 +135,6 @@ path filter --type file,dir --perm exec,write bin/fish .
  # So it passes.
  # CHECK: .
  
 -mkdir -p sbin
 -touch sbin/setuid-exe sbin/setgid-exe
--chmod u+s,a+x sbin/setuid-exe
--path filter --perm suid sbin/*
+-
+-# Without POSIX permission, there is no way to set the setuid bit, so fake
+-# the output.
+-if set -q noacl
+-    echo sbin/setuid-exe
+-else
+-    chmod u+s,a+x sbin/setuid-exe
+-    path filter --perm suid sbin/*
+-end
 -# CHECK: sbin/setuid-exe
 -
- # On at least FreeBSD on our CI this fails with "permission denied".
- # So we can't test it, and we fake the output instead.
- if chmod g+s,a+x sbin/setgid-exe 2>/dev/null
+-# Without POSIX permission, there is no way to set the setgid bit, so fake
+-# the result.
+-# And on at least FreeBSD on our CI this fails with "permission denied".
+-# So we can't test it, and we fake the output there too.
+-if set -q noacl
+-    echo sbin/setgid-exe
+-else if chmod g+s,a+x sbin/setgid-exe 2>/dev/null
+-    path filter --perm sgid sbin/*
+-else
+-    echo sbin/setgid-exe
+-end
+-# CHECK: sbin/setgid-exe
+-
+ mkdir stuff
+ touch stuff/{read,write,exec,readwrite,readexec,writeexec,all,none}
+ if set -q noacl
diff --git a/pkgs/by-name/fi/fish/package.nix b/pkgs/by-name/fi/fish/package.nix
index 9ecccf3a9402..d6eead7cd42e 100644
--- a/pkgs/by-name/fi/fish/package.nix
+++ b/pkgs/by-name/fi/fish/package.nix
@@ -148,13 +148,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "fish";
-  version = "4.6.0";
+  version = "4.7.0";
 
   src = fetchFromGitHub {
     owner = "fish-shell";
     repo = "fish-shell";
     tag = finalAttrs.version;
-    hash = "sha256-lhixotjhD8+xb8Hw6Mu1uJPtCq0zlQsBAXpHRzT+moI=";
+    hash = "sha256-LzpWSxhUMcJytxUoD7SZyLc/+hiL6CAyL/0FNbvBk1M=";
   };
 
   env = {
@@ -167,7 +167,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src patches;
-    hash = "sha256-zua2O3eGi7dXh4w0IoUGL2RxvGIW0O3WpVg/tT8942Q=";
+    hash = "sha256-WS7FWws1dIuVM9gE1PBnDZpUcRu96fWR80Az4Q+tZpI=";
   };
 
   patches = [
@@ -238,7 +238,8 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace share/functions/grep.fish \
       --replace-fail "command grep" "command ${lib.getExe gnugrep}"
 
-    substituteInPlace share/completions/{sudo.fish,doas.fish} \
+    substituteInPlace share/completions/doas.fish \
+      share/functions/__fish_complete_sudo.fish \
       --replace-fail "/usr/local/sbin /sbin /usr/sbin" ""
   ''
   + lib.optionalString usePython ''
diff --git a/pkgs/by-name/fl/flake-du/package.nix b/pkgs/by-name/fl/flake-du/package.nix
new file mode 100644
index 000000000000..5f722207eea3
--- /dev/null
+++ b/pkgs/by-name/fl/flake-du/package.nix
@@ -0,0 +1,29 @@
+{
+  lib,
+  rustPlatform,
+  fetchgit,
+}:
+let
+  version = "0.1.0";
+in
+rustPlatform.buildRustPackage {
+  pname = "flake-du";
+  inherit version;
+
+  src = fetchgit {
+    url = "https://github.com/kmein/flake-du";
+    rev = "v${version}";
+    sha256 = "sha256-+YfQRi6QE4xNUcIcEc9HWIbnin6GCVp4SYrjvBwksys=";
+  };
+
+  cargoHash = "sha256-DYVT9jM9WcgoVSOnoUIWWR9EmNywR1f4xZOAzkbNkCk=";
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "Tool for managing flake inputs with disk usage insights";
+    license = lib.licenses.mit;
+    homepage = "https://github.com/kmein/flake-du";
+    maintainers = [ lib.maintainers.kmein ];
+  };
+}
diff --git a/pkgs/by-name/fn/fn-cli/package.nix b/pkgs/by-name/fn/fn-cli/package.nix
index a25f12fb5601..be2d5897f184 100644
--- a/pkgs/by-name/fn/fn-cli/package.nix
+++ b/pkgs/by-name/fn/fn-cli/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "fn";
-  version = "0.6.49";
+  version = "0.6.50";
 
   src = fetchFromGitHub {
     owner = "fnproject";
     repo = "cli";
     rev = finalAttrs.version;
-    hash = "sha256-qDLBwxMDVPY2WWCAGw7jFwHX9qAnqOuz9Tgfg1EC1bc=";
+    hash = "sha256-j6UJXBi+q61gQwOhGuI9vIG5i+xkUOTdNRMRYPoc284=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/fo/forgejo-runner/package.nix b/pkgs/by-name/fo/forgejo-runner/package.nix
index 977e022af41a..4f85ec25dc13 100644
--- a/pkgs/by-name/fo/forgejo-runner/package.nix
+++ b/pkgs/by-name/fo/forgejo-runner/package.nix
@@ -52,17 +52,17 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "forgejo-runner";
-  version = "12.9.0";
+  version = "12.10.1";
 
   src = fetchFromGitea {
     domain = "code.forgejo.org";
     owner = "forgejo";
     repo = "runner";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-yhcD+FiRuo+WAvKFtgAI+36/uIci9O1s9RtXT0Q75Uo=";
+    hash = "sha256-OBMduRaGSVPojSAr6DKPbAdUyuw1MSCpipRv+EA5OGw=";
   };
 
-  vendorHash = "sha256-CCUyL6ZxLRQy30TQUj1yOAuR7Ctp06/0jG8Q3De6/oo=";
+  vendorHash = "sha256-V9dEHNp80oS7NfsGIlKgFyHD1PmMm2bCqydVADpphuA=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/fr/framework-tool/package.nix b/pkgs/by-name/fr/framework-tool/package.nix
index f6551c4def18..388febf5c9a5 100644
--- a/pkgs/by-name/fr/framework-tool/package.nix
+++ b/pkgs/by-name/fr/framework-tool/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "framework-tool";
-  version = "0.6.2";
+  version = "0.6.3";
 
   src = fetchFromGitHub {
     owner = "FrameworkComputer";
     repo = "framework-system";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6fitUk939Jy0vBfwnV+ZBxOW4DcFJIY7xGmqfrWj86g=";
+    hash = "sha256-EoaMVbnmidXoCRMbqn5LIZuxXE9xl9Dtb16U9FKmH+4=";
   };
 
-  cargoHash = "sha256-U3agwXUtCbfrcr5NyukCnERbznvCaGla/IfHHUS+TiA=";
+  cargoHash = "sha256-PshbC+LIBm84/86w9lP0OmCVztsT5gB+86rUorCDsQM=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ udev ];
diff --git a/pkgs/by-name/fr/freerouting/package.nix b/pkgs/by-name/fr/freerouting/package.nix
index 328e212d4570..8d6db2acc111 100644
--- a/pkgs/by-name/fr/freerouting/package.nix
+++ b/pkgs/by-name/fr/freerouting/package.nix
@@ -32,13 +32,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "freerouting";
-  version = "2.2.1";
+  version = "2.2.2";
 
   src = fetchFromGitHub {
     owner = "freerouting";
     repo = "freerouting";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bIts0ORxw9GDKRP78k0YnrfUqBliyf8v3gK/WtfNRgw=";
+    hash = "sha256-WhEofQs3TwnhB9fSROPQfWd1PHCDoH790lV54ujlmX4=";
   };
 
   gradleBuildTask = "dist";
diff --git a/pkgs/by-name/ga/gat/package.nix b/pkgs/by-name/ga/gat/package.nix
index 8a5b783ecd8d..2baf051172c4 100644
--- a/pkgs/by-name/ga/gat/package.nix
+++ b/pkgs/by-name/ga/gat/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gat";
-  version = "0.27.1";
+  version = "0.27.2";
 
   src = fetchFromGitHub {
     owner = "koki-develop";
     repo = "gat";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8+IpVMbV+1aXNZoIWVZF/GDsLh2G1rHudkyifguGl0g=";
+    hash = "sha256-3qm9kvAL522QCK7nXIWywdHFfxeuCJ9pukpd2ehIBis=";
   };
 
-  vendorHash = "sha256-UUFfM51toafSxK+x7Q7c9wPDiO22f7YfLc05u3uWLAE=";
+  vendorHash = "sha256-4RswVTjVF9pF7u94BbYIP0ukaKkPrTriSbPHOhhrJuI=";
 
   env.CGO_ENABLED = 0;
 
diff --git a/pkgs/by-name/gi/gitkraken/package.nix b/pkgs/by-name/gi/gitkraken/package.nix
index 33dae3c156f5..41f8c9b178d7 100644
--- a/pkgs/by-name/gi/gitkraken/package.nix
+++ b/pkgs/by-name/gi/gitkraken/package.nix
@@ -56,24 +56,24 @@
 
 let
   pname = "gitkraken";
-  version = "12.0.1";
+  version = "12.1.0";
 
   throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";
 
   srcs = {
     x86_64-linux = fetchzip {
       url = "https://api.gitkraken.dev/releases/production/linux/x64/${version}/gitkraken-amd64.tar.gz";
-      hash = "sha256-Tn4j9zmH8hr5rKaPFgox/LopTvEWghnPGf4JiM8y86k=";
+      hash = "sha256-HLo5cNkA59JBZ43Aea5W4vj2X4UDN0NtaB4VEjDQwvM=";
     };
 
     x86_64-darwin = fetchzip {
       url = "https://api.gitkraken.dev/releases/production/darwin/x64/${version}/GitKraken-v${version}.zip";
-      hash = "sha256-bKbqu94JPI4VOPcphkw/vAN/ihb5wc5qh/qaw7bweG0=";
+      hash = "sha256-SzGcT/2X4OXgtUqKCfE9UkKJsBCrKqj++vTdz2Rqfrc=";
     };
 
     aarch64-darwin = fetchzip {
       url = "https://api.gitkraken.dev/releases/production/darwin/arm64/${version}/GitKraken-v${version}.zip";
-      hash = "sha256-h2RSdK75i1NbchGauDSvaYJyz39Bncgf+RQIfRdDQuE=";
+      hash = "sha256-WYhSqRR0bHB1CKGbwSYHWvaCa/GpZCO6X4q6GMLuFpI=";
     };
   };
 
diff --git a/pkgs/by-name/gi/gitlab-runner/package.nix b/pkgs/by-name/gi/gitlab-runner/package.nix
index dc94606246a4..da2c49252ccf 100644
--- a/pkgs/by-name/gi/gitlab-runner/package.nix
+++ b/pkgs/by-name/gi/gitlab-runner/package.nix
@@ -38,26 +38,30 @@ buildGoModule (finalAttrs: {
     substituteInPlace commands/helpers/file_archiver_test.go \
       --replace-fail "func TestCacheArchiverAddingUntrackedFiles" "func OFF_TestCacheArchiverAddingUntrackedFiles" \
       --replace-fail "func TestCacheArchiverAddingUntrackedUnicodeFiles" "func OFF_TestCacheArchiverAddingUntrackedUnicodeFiles"
-    rm shells/abstract_test.go
 
-    # No writable developer environment
+    # Needs `make development_setup` (git repo at tmp/gitlab-test/)
     rm common/build_settings_test.go
     rm common/build_test.go
     rm executors/custom/custom_test.go
 
-    # No Docker during build
-    rm executors/docker/docker_test.go
-    rm executors/docker/services_test.go
-    rm executors/docker/terminal_test.go
-    rm helpers/docker/auth/auth_test.go
-
-    # No Kubernetes during build
-    rm executors/kubernetes/feature_test.go
+    # Timing-dependent test causes spurious failures on Hydra.
+    # Might be fixed upstream in this MR: https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/6623
+    # Try dropping it on next major version bump
+    rm executors/kubernetes/internal/watchers/pod_test.go
+  ''
+  + lib.optionalString (!stdenv.buildPlatform.isx86_64) ''
+    # Kubernetes tests actually work fine inside the network sandbox (they don't
+    # expect real Kubernetes), but they fail on aarch64-linux because their
+    # mocks expect x86_64
     rm executors/kubernetes/kubernetes_test.go
     rm executors/kubernetes/overwrites_test.go
   ''
   + lib.optionalString stdenv.buildPlatform.isDarwin ''
-    # Invalid bind arguments break Unix socket tests
+    # Darwin's sandbox blocks sendfile(2) during local HTTP PUT uploads
+    substituteInPlace commands/helpers/cache_archiver_test.go \
+      --replace-fail "func TestUploadExistingArchiveIfNeeded" "func OFF_TestUploadExistingArchiveIfNeeded"
+
+    # Invalid bind arguments break Unix socket tests.
     substituteInPlace commands/wrapper_test.go \
       --replace-fail "func TestRunnerWrapperCommand_createListener" "func OFF_TestRunnerWrapperCommand_createListener"
 
@@ -68,6 +72,10 @@ buildGoModule (finalAttrs: {
       --replace-fail "func TestClientInvalidSSL" "func OFF_TestClientInvalidSSL"
   '';
 
+  postPatch = ''
+    patchShebangs --build helpers/docker/auth/testdata/docker-credential-bin.sh
+  '';
+
   excludedPackages = [
     # Nested dependency Go module, used with go.mod replace directive
     #
diff --git a/pkgs/by-name/go/golangci-lint/package.nix b/pkgs/by-name/go/golangci-lint/package.nix
index aa453d09e74e..b1449652acfc 100644
--- a/pkgs/by-name/go/golangci-lint/package.nix
+++ b/pkgs/by-name/go/golangci-lint/package.nix
@@ -14,16 +14,16 @@
 
 buildGo126Module (finalAttrs: {
   pname = "golangci-lint";
-  version = "2.12.1";
+  version = "2.12.2";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golangci-lint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dMXjfMPdqOPJDC7t6+X4GgfmSf/9ThOuUdp4JgVSmmI=";
+    hash = "sha256-qR7fp1x2S+EwEAcplRHTvA3jWwLr/XSiYKSZtAwkrNU=";
   };
 
-  vendorHash = "sha256-qTvBE+c1frDZj3NOy0VKYVbsdxEunun67QrKTye5Rx8=";
+  vendorHash = "sha256-AG5wtLwWLz55bdp1oi3cW+9O3yj1W1P7MV9zxym7Pb4=";
 
   subPackages = [ "cmd/golangci-lint" ];
 
diff --git a/pkgs/by-name/go/google-lighthouse/package.nix b/pkgs/by-name/go/google-lighthouse/package.nix
index ed4917caf5c0..64ea99c1681b 100644
--- a/pkgs/by-name/go/google-lighthouse/package.nix
+++ b/pkgs/by-name/go/google-lighthouse/package.nix
@@ -13,18 +13,18 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "google-lighthouse";
-  version = "13.1.0";
+  version = "13.2.0";
 
   src = fetchFromGitHub {
     owner = "GoogleChrome";
     repo = "lighthouse";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nSXIA1yRwcetv9u/UJ445iDP3i+dX0rhzozxzQvXkf0=";
+    hash = "sha256-D/HQP34/EGJLWgRneiYP8eByUNSjKwQQLD0FScgYAVo=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-naB9TOFiggKNiJcXkHF5VbvsLtNAYQD84/pL//76fuE=";
+    hash = "sha256-DKFPnSj3jujCWb+KitgTZaIJB8XkHJBoncaNvzcuIVU=";
   };
 
   yarnBuildScript = "build-report";
diff --git a/pkgs/by-name/gp/gpac/package.nix b/pkgs/by-name/gp/gpac/package.nix
index 4c771852ffae..8481df4a695d 100644
--- a/pkgs/by-name/gp/gpac/package.nix
+++ b/pkgs/by-name/gp/gpac/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
   gitUpdater,
   unstableGitUpdater,
   cctools,
@@ -39,28 +40,17 @@
 
 let
   stable = rec {
-    version = "2.4.0"; # See below TODO.
+    version = "26.02.0";
     src = fetchFromGitHub {
       owner = "gpac";
       repo = "gpac";
       rev = "v${version}";
-      hash = "sha256-RADDqc5RxNV2EfRTzJP/yz66p0riyn81zvwU3r9xncM=";
+      hash = "sha256-UtL+KG3dsp6dD7cfTK7e17ngt/RHKJL0s5IopTM3VOk=";
     };
     updateScript = gitUpdater {
-      odd-unstable = true;
       rev-prefix = "v";
       ignoredVersions = "^(abi|test)";
     };
-  }
-  // {
-    # ffmpeg 7.0.2 works, but 7.1.1 (which is packaged in nixpkgs) doesn't
-    # because v2.4.0 of this package relies on internal private ffmpeg fields.
-    # TODO: remove this, and switch to simply using ffmpeg-headless,
-    #       when updating stable to 2.6
-    ffmpeg-headless = ffmpeg-headless.override {
-      version = "7.0.2";
-      hash = "sha256-6bcTxMt0rH/Nso3X7zhrFNkkmWYtxsbUqVQKh25R1Fs=";
-    };
   };
   unstable = {
     version = "26.02.0-unstable-2026-04-29";
@@ -74,7 +64,6 @@ let
       tagFormat = "v*";
       tagPrefix = "v";
     };
-    inherit ffmpeg-headless;
   };
   channelToUse = if releaseChannel == "unstable" then unstable else stable;
 in
@@ -89,7 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
     cctools
   ]
   ++ lib.optionals withFfmpeg [
-    channelToUse.ffmpeg-headless
+    ffmpeg-headless
   ];
 
   # ref: https://wiki.gpac.io/Build/build/GPAC-Build-Guide-for-Linux/#gpac-easy-build-recommended-for-most-users
@@ -122,6 +111,14 @@ stdenv.mkDerivation (finalAttrs: {
     curl
   ];
 
+  patches = lib.optionals (releaseChannel == "stable") [
+    (fetchpatch2 {
+      # CVE-2026-7135 fix
+      url = "https://github.com/gpac/gpac/commit/cf6ac48c972eaaee2af270adc3f36615325deb3e.patch?full_index=1";
+      hash = "sha256-JaJiQAQvzdB74ag2/aZTiQa2NqlgqgMYS1tsk/R+wiI=";
+    })
+  ];
+
   enableParallelBuilding = true;
 
   passthru.updateScript = channelToUse.updateScript;
diff --git a/pkgs/by-name/gr/grafana-to-ntfy/package.nix b/pkgs/by-name/gr/grafana-to-ntfy/package.nix
index 498ef0b25a47..1b1c72cf0553 100644
--- a/pkgs/by-name/gr/grafana-to-ntfy/package.nix
+++ b/pkgs/by-name/gr/grafana-to-ntfy/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "grafana-to-ntfy";
-  version = "2026.4.29";
+  version = "2026.5.2";
 
   src = fetchFromGitHub {
     owner = "kittyandrew";
     repo = "grafana-to-ntfy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ac0T8SNCDH9kQTKIfYn9KinnrSCYIBpNByO6NQ8UntA=";
+    hash = "sha256-lbzo/+dQG5u+LfbnhUEL4KDjkod1kCWQ+m2Fsa2VrFo=";
   };
 
-  cargoHash = "sha256-RuWXlofcruR69sg+RO2v1DBgxaPEyu8TeZEiZP7rBV8=";
+  cargoHash = "sha256-vXicD4jUgaioK09oFBn3BgWDR3bzM7m5KStHr4Wqmfk=";
 
   # No unit tests; all testing is NixOS VM-based integration tests
   doCheck = false;
diff --git a/pkgs/by-name/gr/graphia/package.nix b/pkgs/by-name/gr/graphia/package.nix
deleted file mode 100644
index dfe38b62a56e..000000000000
--- a/pkgs/by-name/gr/graphia/package.nix
+++ /dev/null
@@ -1,45 +0,0 @@
-{
-  stdenv,
-  lib,
-  cmake,
-  git,
-  fetchFromGitHub,
-  qt6,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "graphia";
-  version = "5.2";
-
-  src = fetchFromGitHub {
-    owner = "graphia-app";
-    repo = "graphia";
-    rev = finalAttrs.version;
-    sha256 = "sha256-tS5oqpwpqvWGu67s8OuA4uQR3Zb5VzHTY/GnfVQki6k=";
-  };
-
-  nativeBuildInputs = [
-    cmake
-    git # needs to define some hash as a version
-    qt6.wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    qt6.qtbase
-    qt6.qtdeclarative
-    qt6.qtsvg
-    qt6.qtwebengine
-  ];
-
-  meta = {
-    # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/graphia.x86_64-darwin
-    broken =
-      (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) || stdenv.hostPlatform.isDarwin;
-    description = "Visualisation tool for the creation and analysis of graphs";
-    homepage = "https://graphia.app";
-    license = lib.licenses.gpl3Only;
-    mainProgram = "Graphia";
-    maintainers = [ lib.maintainers.bgamari ];
-    platforms = lib.platforms.all;
-  };
-})
diff --git a/pkgs/by-name/gv/gvm-libs/package.nix b/pkgs/by-name/gv/gvm-libs/package.nix
index ac7071c9d71d..6b33013f5935 100644
--- a/pkgs/by-name/gv/gvm-libs/package.nix
+++ b/pkgs/by-name/gv/gvm-libs/package.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gvm-libs";
-  version = "22.41.0";
+  version = "23.0.0";
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "gvm-libs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6GYy+51Nw1zlppsMIYv4cH/yEMhxJ1lsLPgpsC4YRG4=";
+    hash = "sha256-WmHBR7BCkmyTx7l88lEV9aRrPFp1Dj+qh6bs23E6wnA=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/h2/h2/package.nix b/pkgs/by-name/h2/h2/package.nix
index 38144b2abc98..32684fe191d6 100644
--- a/pkgs/by-name/h2/h2/package.nix
+++ b/pkgs/by-name/h2/h2/package.nix
@@ -7,7 +7,7 @@
   nix-update-script,
 }:
 
-maven.buildMavenPackage rec {
+maven.buildMavenPackage (finalAttrs: {
   pname = "h2";
   version = "2.4.240";
 
@@ -19,7 +19,7 @@ maven.buildMavenPackage rec {
   src = fetchFromGitHub {
     owner = "h2database";
     repo = "h2database";
-    tag = "version-${version}";
+    tag = "version-${finalAttrs.version}";
     hash = "sha256-Cy6MoumJBhhcYT6dCHWeOfmhjGRkdNvSONdIiZaf6uU=";
   };
 
@@ -32,10 +32,10 @@ maven.buildMavenPackage rec {
 
   installPhase = ''
     mkdir -p $out/share/java
-    install -Dm644 h2/target/h2-${version}.jar $out/share/java
+    install -Dm644 h2/target/h2-${finalAttrs.version}.jar $out/share/java
 
     makeWrapper ${jre}/bin/java $out/bin/h2 \
-      --add-flags "-cp \"$out/share/java/h2-${version}.jar:\$H2DRIVERS:\$CLASSPATH\" org.h2.tools.Console"
+      --add-flags "-cp \"$out/share/java/h2-${finalAttrs.version}.jar:\$H2DRIVERS:\$CLASSPATH\" org.h2.tools.Console"
 
     mkdir -p $doc/share/doc/h2
     cp -r h2/src/docsrc/* $doc/share/doc/h2
@@ -60,4 +60,4 @@ maven.buildMavenPackage rec {
     ];
     mainProgram = "h2";
   };
-}
+})
diff --git a/pkgs/by-name/h2/h2o/package.nix b/pkgs/by-name/h2/h2o/package.nix
index c09184ce77d8..c4f27de15afc 100644
--- a/pkgs/by-name/h2/h2o/package.nix
+++ b/pkgs/by-name/h2/h2o/package.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "h2o";
-  version = "2.3.0-rolling-2026-04-15";
+  version = "2.3.0-rolling-2026-04-30";
 
   src = fetchFromGitHub {
     owner = "h2o";
     repo = "h2o";
-    rev = "4aa96860e99cc2a2e2777433949bb05aed678ebe";
-    hash = "sha256-0utcajHyLpP+MXwW12pGWd/E58jK5//Erq0dQmzBO5U=";
+    rev = "8cb324bd2d5efb1926d0b8408b1d367687e50cfa";
+    hash = "sha256-4GS2hQzBJXA0C9ClWGppocBdjO4BHDK2Balm0O8Ps/I=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ha/harlequin/package.nix b/pkgs/by-name/ha/harlequin/package.nix
index e344a1a891c4..26246b46aa86 100644
--- a/pkgs/by-name/ha/harlequin/package.nix
+++ b/pkgs/by-name/ha/harlequin/package.nix
@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  python3Packages,
+  python3,
   fetchFromGitHub,
   nix-update-script,
   glibcLocales,
@@ -10,6 +10,23 @@
   withPostgresAdapter ? true,
   withBigQueryAdapter ? true,
 }:
+
+let
+  python = python3.override {
+    packageOverrides = _final: prev: {
+      # throws a runtime error with textual 8.2.5:
+      # KeyError: 'textual-ansi'
+      textual = prev.textual.overridePythonAttrs (old: rec {
+        version = "8.2.4";
+        src = old.src.override {
+          tag = "v${version}";
+          hash = "sha256-827cm9pcj1o1FYeaoWKCJ6dEyXeDop4kYd205cySTfg=";
+        };
+      });
+    };
+  };
+  python3Packages = python.pkgs;
+in
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "harlequin";
   version = "2.5.2";
diff --git a/pkgs/by-name/he/hello/package.nix b/pkgs/by-name/he/hello/package.nix
index 605a4dcf4717..e0b688917e46 100644
--- a/pkgs/by-name/he/hello/package.nix
+++ b/pkgs/by-name/he/hello/package.nix
@@ -14,6 +14,8 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "hello";
   version = "2.12.3";
 
+  __structuredAttrs = true;
+
   src = fetchurl {
     url = "mirror://gnu/hello/hello-${finalAttrs.version}.tar.gz";
     hash = "sha256-DV9gFUOC/uELEUocNOeF2LH0kgc64tOm97FHaHs2aqA=";
diff --git a/pkgs/by-name/hi/highscore-mgba/package.nix b/pkgs/by-name/hi/highscore-mgba/package.nix
index 4e95cb7b5208..72c52a4a2040 100644
--- a/pkgs/by-name/hi/highscore-mgba/package.nix
+++ b/pkgs/by-name/hi/highscore-mgba/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation {
   pname = "highscore-mgba";
-  version = "0-unstable-2026-04-26";
+  version = "0-unstable-2026-05-01";
 
   src = fetchFromGitHub {
     owner = "highscore-emu";
     repo = "mgba";
-    rev = "4a1ca6566fc1c0a67341ddadfc18011aa0a0578f";
-    hash = "sha256-zcRynN01O6zAcOuV/q9u7kL5elFTDJ2tA3wTJR3JBt0=";
+    rev = "eeb3cf0f34af549d9224dd75a1e6cb6361d09aeb";
+    hash = "sha256-yGUAnG8LnZ+hCV+uE1tGX2Zmp5Hriu7LQaWfXZTJqXk=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/hy/hyprwhspr-rs/package.nix b/pkgs/by-name/hy/hyprwhspr-rs/package.nix
index ccd5a633e1fe..260c56c58477 100644
--- a/pkgs/by-name/hy/hyprwhspr-rs/package.nix
+++ b/pkgs/by-name/hy/hyprwhspr-rs/package.nix
@@ -16,16 +16,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "hyprwhspr-rs";
-  version = "0.3.25";
+  version = "0.3.26";
 
   src = fetchFromGitHub {
     owner = "better-slop";
     repo = "hyprwhspr-rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QG+A5tPG+YJ5qQ3dyUAd1oobMGITAK+GQnpE7zXEshc=";
+    hash = "sha256-dR7nLQCYxCSkbHd9K4gr3emmVgjK3h4NP7T8nnToqJI=";
   };
 
-  cargoHash = "sha256-TFx7bVtdNWrjylNHI/DHwechBvOZEZtK/xxdX+RqV/k=";
+  cargoHash = "sha256-olmYjxR1mz5Hx4FOv2k+KFs3p3a29WuMrZ2scKNDX2A=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ii/iio-niri/package.nix b/pkgs/by-name/ii/iio-niri/package.nix
index 73fe38a5fe9f..de670bd7c06f 100644
--- a/pkgs/by-name/ii/iio-niri/package.nix
+++ b/pkgs/by-name/ii/iio-niri/package.nix
@@ -1,31 +1,41 @@
 {
   rustPlatform,
+  stdenv,
   lib,
   fetchFromGitHub,
   dbus,
   pkg-config,
+  installShellFiles,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "iio-niri";
-  version = "1.3.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "Zhaith-Izaliel";
     repo = "iio-niri";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tbCiG/u350U7UbYDV5gWczDQd//RosNHuzB/cP9Dyyo=";
+    hash = "sha256-foE+bPJANKWmPSt3s8BOqEIXGZoFNWRJT731xf5sr1M=";
   };
 
-  cargoHash = "sha256-JnjBnqZXRhxUClvC2hIW898AwwEOS/ELrsrjY2dV3Is=";
+  cargoHash = "sha256-y3Sv3JWg252XbuIqEioNagaQ99Vr9x1OfrFC6Jl4kSY=";
 
   nativeBuildInputs = [
     pkg-config
+    installShellFiles
   ];
 
   buildInputs = [
     dbus
   ];
 
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd iio-niri \
+      --bash <($out/bin/iio-niri completions bash) \
+      --zsh <($out/bin/iio-niri completions zsh) \
+      --fish <($out/bin/iio-niri completions fish)
+  '';
+
   meta = {
     description = "Listen to iio-sensor-proxy and updates Niri output orientation depending on the accelerometer orientation";
     homepage = "https://github.com/Zhaith-Izaliel/iio-niri";
diff --git a/pkgs/by-name/in/incus/0c37b7e3ec65b4d0e166e2127d9f1835320165b8.patch b/pkgs/by-name/in/incus/0c37b7e3ec65b4d0e166e2127d9f1835320165b8.patch
deleted file mode 100644
index d4f9cfccc21a..000000000000
--- a/pkgs/by-name/in/incus/0c37b7e3ec65b4d0e166e2127d9f1835320165b8.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-From 0c37b7e3ec65b4d0e166e2127d9f1835320165b8 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?St=C3=A9phane=20Graber?= <stgraber@stgraber.org>
-Date: Fri, 6 Sep 2024 17:07:11 -0400
-Subject: [PATCH] incusd/instance/qemu: Make O_DIRECT conditional on
- directCache
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
----
- internal/server/instance/drivers/driver_qemu.go | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/internal/server/instance/drivers/driver_qemu.go b/internal/server/instance/drivers/driver_qemu.go
-index 5a94c9db43..9609b73c1b 100644
---- a/internal/server/instance/drivers/driver_qemu.go
-+++ b/internal/server/instance/drivers/driver_qemu.go
-@@ -4276,7 +4276,9 @@ func (d *qemu) addDriveConfig(qemuDev map[string]string, bootIndexes map[string]
- 				permissions = unix.O_RDONLY
- 			}
- 
--			permissions |= unix.O_DIRECT
-+			if directCache {
-+				permissions |= unix.O_DIRECT
-+			}
- 
- 			f, err := os.OpenFile(driveConf.DevPath, permissions, 0)
- 			if err != nil {
diff --git a/pkgs/by-name/in/incus/572afb06f66f83ca95efa1b9386fceeaa1c9e11b.patch b/pkgs/by-name/in/incus/572afb06f66f83ca95efa1b9386fceeaa1c9e11b.patch
deleted file mode 100644
index e918deb8569c..000000000000
--- a/pkgs/by-name/in/incus/572afb06f66f83ca95efa1b9386fceeaa1c9e11b.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From 572afb06f66f83ca95efa1b9386fceeaa1c9e11b Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?St=C3=A9phane=20Graber?= <stgraber@stgraber.org>
-Date: Fri, 6 Sep 2024 15:51:35 -0400
-Subject: [PATCH] incusd/instance/qemu: Set O_DIRECT when passing in FDs
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-This is required in most cases with QEMU 9.1.0.
-
-Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
----
- internal/server/instance/drivers/driver_qemu.go | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/internal/server/instance/drivers/driver_qemu.go b/internal/server/instance/drivers/driver_qemu.go
-index 37da21f42f..e25aab0667 100644
---- a/internal/server/instance/drivers/driver_qemu.go
-+++ b/internal/server/instance/drivers/driver_qemu.go
-@@ -4277,6 +4277,8 @@ func (d *qemu) addDriveConfig(qemuDev map[string]string, bootIndexes map[string]
- 				permissions = unix.O_RDONLY
- 			}
- 
-+			permissions |= unix.O_DIRECT
-+
- 			f, err := os.OpenFile(driveConf.DevPath, permissions, 0)
- 			if err != nil {
- 				return fmt.Errorf("Failed opening file descriptor for disk device %q: %w", driveConf.DevName, err)
diff --git a/pkgs/by-name/in/incus/client.nix b/pkgs/by-name/in/incus/client.nix
index 3e03ff4025b8..beaec29e15c8 100644
--- a/pkgs/by-name/in/incus/client.nix
+++ b/pkgs/by-name/in/incus/client.nix
@@ -9,14 +9,15 @@
   lib,
   buildGoModule,
   installShellFiles,
+  fetchpatch2,
 }:
 let
   pname = "incus${lib.optionalString lts "-lts"}-client";
+  evaluatedPatches = if lib.isFunction patches then patches fetchpatch2 else patches;
 in
 
 buildGoModule {
   inherit
-    patches
     pname
     src
     vendorHash
@@ -29,6 +30,8 @@ buildGoModule {
 
   subPackages = [ "cmd/incus" ];
 
+  patches = evaluatedPatches;
+
   postInstall = ''
     # Needed for builds on systems with auto-allocate-uids to pass.
     # Incus tries to read ~/.config/incus while generating completions
diff --git a/pkgs/by-name/in/incus/generic.nix b/pkgs/by-name/in/incus/generic.nix
index c3844851bc86..d65be430f557 100644
--- a/pkgs/by-name/in/incus/generic.nix
+++ b/pkgs/by-name/in/incus/generic.nix
@@ -14,6 +14,7 @@
   stdenv,
   buildGoModule,
   fetchFromGitHub,
+  fetchpatch2,
   acl,
   buildPackages,
   cowsql,
@@ -51,6 +52,7 @@ let
       sphinxext-opengraph
     ]
   );
+  evaluatedPatches = if lib.isFunction patches then patches fetchpatch2 else patches;
 in
 
 buildGoModule (finalAttrs: {
@@ -75,7 +77,7 @@ buildGoModule (finalAttrs: {
     // (if (rev == null) then { tag = "v${version}"; } else { inherit rev; })
   );
 
-  patches = [ ./docs.patch ] ++ patches;
+  patches = [ ./docs.patch ] ++ evaluatedPatches;
 
   excludedPackages = [
     # statically compile these
@@ -161,25 +163,27 @@ buildGoModule (finalAttrs: {
 
   doInstallCheck = true;
 
-  postInstall = ''
-    installShellCompletion --cmd incus \
-      --bash <($out/bin/incus completion bash) \
-      --fish <($out/bin/incus completion fish) \
-      --zsh <($out/bin/incus completion zsh)
+  postInstall =
+    lib.optionalString (stdenv.hostPlatform.canExecute stdenv.buildPlatform) ''
+      installShellCompletion --cmd incus \
+        --bash <($out/bin/incus completion bash) \
+        --fish <($out/bin/incus completion fish) \
+        --zsh <($out/bin/incus completion zsh)
+    ''
+    + ''
+      mkdir -p $agent_loader/bin $agent_loader/etc/systemd/system $agent_loader/lib/udev/rules.d
+      # the agent_loader output is used by virtualisation.incus.agent
+      cp internal/server/instance/drivers/agent-loader/incus-agent-linux $agent_loader/bin/incus-agent
+      cp internal/server/instance/drivers/agent-loader/incus-agent-setup-linux $agent_loader/bin/incus-agent-setup
+      chmod +x $agent_loader/bin/incus-agent{,-setup}
+      patchShebangs $agent_loader/bin/incus-agent{,-setup}
+      cp internal/server/instance/drivers/agent-loader/systemd/incus-agent.service $agent_loader/etc/systemd/system/
+      cp internal/server/instance/drivers/agent-loader/systemd/incus-agent.rules $agent_loader/lib/udev/rules.d/99-incus-agent.rules
+      substituteInPlace $agent_loader/etc/systemd/system/incus-agent.service --replace-fail 'TARGET/systemd' "$agent_loader/bin"
 
-    mkdir -p $agent_loader/bin $agent_loader/etc/systemd/system $agent_loader/lib/udev/rules.d
-    # the agent_loader output is used by virtualisation.incus.agent
-    cp internal/server/instance/drivers/agent-loader/incus-agent-linux $agent_loader/bin/incus-agent
-    cp internal/server/instance/drivers/agent-loader/incus-agent-setup-linux $agent_loader/bin/incus-agent-setup
-    chmod +x $agent_loader/bin/incus-agent{,-setup}
-    patchShebangs $agent_loader/bin/incus-agent{,-setup}
-    cp internal/server/instance/drivers/agent-loader/systemd/incus-agent.service $agent_loader/etc/systemd/system/
-    cp internal/server/instance/drivers/agent-loader/systemd/incus-agent.rules $agent_loader/lib/udev/rules.d/99-incus-agent.rules
-    substituteInPlace $agent_loader/etc/systemd/system/incus-agent.service --replace-fail 'TARGET/systemd' "$agent_loader/bin"
-
-    mkdir $doc
-    cp -R doc/html $doc/
-  '';
+      mkdir $doc
+      cp -R doc/html $doc/
+    '';
 
   passthru = {
     client = callPackage ./client.nix {
diff --git a/pkgs/by-name/in/incus/lts.nix b/pkgs/by-name/in/incus/lts.nix
index 4b9ece2bc59e..a69ea11df4c5 100644
--- a/pkgs/by-name/in/incus/lts.nix
+++ b/pkgs/by-name/in/incus/lts.nix
@@ -1,16 +1,87 @@
 import ./generic.nix {
-  hash = "sha256-DgPSH5t1Zx2X9T8dbpz54M5nXNcCJbdfcq9AEd8kmYo=";
-  version = "6.0.6-unstable-2026-03-27";
-  vendorHash = "sha256-bVJwg9VaiSgfpKo+e2oMsYgmaKk42dktq0pahcfbjp0=";
-  rev = "d0f2c86fcb4a7d38343807c83ea3541bb4661e1e";
-  patches = [
-    # qemu 9.1 compat, remove when added to LTS
-    ./572afb06f66f83ca95efa1b9386fceeaa1c9e11b.patch
-    ./0c37b7e3ec65b4d0e166e2127d9f1835320165b8.patch
-  ];
+  hash = "sha256-7s2gc+78O8jKypVe1itaUrsLPa2mLjNgUUrR/cv7ITA=";
+  version = "7.0.0";
+  vendorHash = "sha256-6irMB3hpWcxDuMQBxWXnhMLAOwTAl63JX6JJZMQXf5E=";
   lts = true;
+  patches = fetchpatch2: [
+    (fetchpatch2 {
+      name = "doc-devices-disk_Fix-broken-link.patch";
+      url = "https://github.com/lxc/incus/commit/faa636b70c05a5cca0346492a0586d5747e4b117.patch?full_index=1";
+      hash = "sha256-UsfzSeLJq0B9xDmd124ITzFBJzg2w1xXNK6TavQ5iMs=";
+    })
+    (fetchpatch2 {
+      name = "incusd-instance-qemu_Fix-version-detection-for-qemu-kvm.patch";
+      url = "https://github.com/lxc/incus/commit/a5f50d36eaa41580f2233b05936bd29fe1b15100.patch?full_index=1";
+      hash = "sha256-Qwu2oljB7COZB2m3W/9Y5wCCZyxvLj4ZUHcNqtoDGzk=";
+    })
+    (fetchpatch2 {
+      name = "incusd_Re-introduce-core-scheduling-detection.patch";
+      url = "https://github.com/lxc/incus/commit/1e6ce18e8cd92b5b3eb4346e7bd27fd4a7d1fb9b.patch?full_index=1";
+      hash = "sha256-RLy8bcod55g8vtXxChte4oalApw7d/gZg8No6BUZQS0=";
+    })
+    (fetchpatch2 {
+      name = "incusd-instance-lxc_Fix-swap=false-failure.patch";
+      url = "https://github.com/lxc/incus/commit/5f2cdf7545c5398290dc507313de9ee547fe803f.patch?full_index=1";
+      hash = "sha256-Ux6mm8Y4q68fj//hG7k+bXMjqhGDOxGNm64De1pwcYY=";
+    })
+    (fetchpatch2 {
+      name = "incusd-forknet_Persist-DHCPv6-client-DUID-across-restarts.patch";
+      url = "https://github.com/lxc/incus/commit/47377e345930e77d3fbce29d037fc7dbd6823dcf.patch?full_index=1";
+      hash = "sha256-CWaNaDYuBBLahxkqnM0FQZraVkvBSbrx1+8dcB8Vfbg=";
+    })
+    (fetchpatch2 {
+      name = "incusd-forknet_Include-FQDN-in-DHCPv6-INFO-requests.patch";
+      url = "https://github.com/lxc/incus/commit/d7f1c9d75ca33eb2ddb0bf10cec934fd6e352089.patch?full_index=1";
+      hash = "sha256-3zyADLiPUuiGLwdeISj5lUk3tkAayQGaRI+/yBHrvuM=";
+    })
+    (fetchpatch2 {
+      name = "incusd-forknet_Properly-renew-stateful-DHCPv6.patch";
+      url = "https://github.com/lxc/incus/commit/3b127758c17752302b3f4bf907f42e926ab664e4.patch?full_index=1";
+      hash = "sha256-+dcdeZwuyTWH7yfPEDqKOax/lS1Yqvwn9ooqJxKD3jA=";
+    })
+    (fetchpatch2 {
+      name = "incusd-forknet_Add-jitter-to-DHCPv6-renewal.patch";
+      url = "https://github.com/lxc/incus/commit/2b24a260b6177c033047f270286933563f05a999.patch?full_index=1";
+      hash = "sha256-grMspYyqn4Zl1Kn+hFeUfeIevdwszJc0x2YDC2JILKw=";
+    })
+    (fetchpatch2 {
+      name = "incusd-device-nic_bridged_Fix-swapped-IPv4-IPv6-DNS-record.patch";
+      url = "https://github.com/lxc/incus/commit/33ffcf71745e138dd4f3546839115c293e6be083.patch?full_index=1";
+      hash = "sha256-E8Plz9qdoTt3id9I5jbZYMKQt+kUrKmXmtMJ6IXlRJg=";
+    })
+    (fetchpatch2 {
+      name = "doc-authorization_Fix-reference-to-old-manager-relation.patch";
+      url = "https://github.com/lxc/incus/commit/c65ac0f4e6e94859b8565bce41bbf1595f4a8085.patch?full_index=1";
+      hash = "sha256-6wEz3uxWauIibBkH+OdB7+VsFySmugt6wk61qMayzYo=";
+    })
+    (fetchpatch2 {
+      name = "incusd-network-acl_Fix-issue-with-instances-in-different-project-than-ACL.patch";
+      url = "https://github.com/lxc/incus/commit/2a3584b6fccf152be42cf5614e54241bdb13e671.patch?full_index=1";
+      hash = "sha256-CXE5Bowk3ZPup6oVDEJb9ucsJoXhXu/kU7gGCghhtjQ=";
+    })
+    (fetchpatch2 {
+      name = "incusd-projects_Fix-targeting-on-project-delete.patch";
+      url = "https://github.com/lxc/incus/commit/3a104e4dc24897f0d6543136bb1043fcd4a33632.patch?full_index=1";
+      hash = "sha256-kTFkJqbjzdq5jvNxKw8YMPR04WRj4t5IS6ymoGyXDXE=";
+    })
+    (fetchpatch2 {
+      name = "test-network_acl_Add-test-for-ACL-used-by-instance-in-different-project.patch";
+      url = "https://github.com/lxc/incus/commit/41878729f06e9c31df9d4fac20fb8c384608577c.patch?full_index=1";
+      hash = "sha256-YR2Akus4vp3vNvHEmsJUh/3gbEf3R/cFUOVvt9u/wEU=";
+    })
+    (fetchpatch2 {
+      name = "incusd-instance-qemu_Remove-deprecated-QEMU-flag.patch";
+      url = "https://github.com/lxc/incus/commit/c1f18c78fc6bc4850df20574bdcc541e5eefc4ac.patch?full_index=1";
+      hash = "sha256-kbn4Yd/G23FCFA0Ch0+d81HUxCbcoiOzHfZ0MW+VlzE=";
+    })
+    (fetchpatch2 {
+      name = "incusd-cluster_Re-order-evacuations-to-happen-earlier-on-shutdown.patch";
+      url = "https://github.com/lxc/incus/commit/5b29ecc164ef28239d2e2a874a7c871a2e419083.patch?full_index=1";
+      hash = "sha256-jpyJYjiZvRw/aOGsykEx8uotRBF7p1q5O08PVhyQtvk=";
+    })
+  ];
   nixUpdateExtraArgs = [
-    "--version-regex=^v(6\\.0\\.[0-9]+)$"
+    "--version-regex=^v(7\\.0\\.[0-9]+)$"
     "--override-filename=pkgs/by-name/in/incus/lts.nix"
   ];
 }
diff --git a/pkgs/by-name/in/incus/package.nix b/pkgs/by-name/in/incus/package.nix
index 222218914368..a42740e649c0 100644
--- a/pkgs/by-name/in/incus/package.nix
+++ b/pkgs/by-name/in/incus/package.nix
@@ -1,8 +1,84 @@
 import ./generic.nix {
-  hash = "sha256-I+wwpsFGDX0W7pwzROGW1ZDHx+C7uc61ypO45BzOhoE=";
-  version = "6.23.0";
-  vendorHash = "sha256-R4q0FNu33qZrHrZQTqPCfw7FNUv6itl7y2AxdRF19CQ=";
-  patches = [ ];
+  hash = "sha256-7s2gc+78O8jKypVe1itaUrsLPa2mLjNgUUrR/cv7ITA=";
+  version = "7.0.0";
+  vendorHash = "sha256-6irMB3hpWcxDuMQBxWXnhMLAOwTAl63JX6JJZMQXf5E=";
+  patches = fetchpatch2: [
+    (fetchpatch2 {
+      name = "doc-devices-disk_Fix-broken-link.patch";
+      url = "https://github.com/lxc/incus/commit/faa636b70c05a5cca0346492a0586d5747e4b117.patch?full_index=1";
+      hash = "sha256-UsfzSeLJq0B9xDmd124ITzFBJzg2w1xXNK6TavQ5iMs=";
+    })
+    (fetchpatch2 {
+      name = "incusd-instance-qemu_Fix-version-detection-for-qemu-kvm.patch";
+      url = "https://github.com/lxc/incus/commit/a5f50d36eaa41580f2233b05936bd29fe1b15100.patch?full_index=1";
+      hash = "sha256-Qwu2oljB7COZB2m3W/9Y5wCCZyxvLj4ZUHcNqtoDGzk=";
+    })
+    (fetchpatch2 {
+      name = "incusd_Re-introduce-core-scheduling-detection.patch";
+      url = "https://github.com/lxc/incus/commit/1e6ce18e8cd92b5b3eb4346e7bd27fd4a7d1fb9b.patch?full_index=1";
+      hash = "sha256-RLy8bcod55g8vtXxChte4oalApw7d/gZg8No6BUZQS0=";
+    })
+    (fetchpatch2 {
+      name = "incusd-instance-lxc_Fix-swap=false-failure.patch";
+      url = "https://github.com/lxc/incus/commit/5f2cdf7545c5398290dc507313de9ee547fe803f.patch?full_index=1";
+      hash = "sha256-Ux6mm8Y4q68fj//hG7k+bXMjqhGDOxGNm64De1pwcYY=";
+    })
+    (fetchpatch2 {
+      name = "incusd-forknet_Persist-DHCPv6-client-DUID-across-restarts.patch";
+      url = "https://github.com/lxc/incus/commit/47377e345930e77d3fbce29d037fc7dbd6823dcf.patch?full_index=1";
+      hash = "sha256-CWaNaDYuBBLahxkqnM0FQZraVkvBSbrx1+8dcB8Vfbg=";
+    })
+    (fetchpatch2 {
+      name = "incusd-forknet_Include-FQDN-in-DHCPv6-INFO-requests.patch";
+      url = "https://github.com/lxc/incus/commit/d7f1c9d75ca33eb2ddb0bf10cec934fd6e352089.patch?full_index=1";
+      hash = "sha256-3zyADLiPUuiGLwdeISj5lUk3tkAayQGaRI+/yBHrvuM=";
+    })
+    (fetchpatch2 {
+      name = "incusd-forknet_Properly-renew-stateful-DHCPv6.patch";
+      url = "https://github.com/lxc/incus/commit/3b127758c17752302b3f4bf907f42e926ab664e4.patch?full_index=1";
+      hash = "sha256-+dcdeZwuyTWH7yfPEDqKOax/lS1Yqvwn9ooqJxKD3jA=";
+    })
+    (fetchpatch2 {
+      name = "incusd-forknet_Add-jitter-to-DHCPv6-renewal.patch";
+      url = "https://github.com/lxc/incus/commit/2b24a260b6177c033047f270286933563f05a999.patch?full_index=1";
+      hash = "sha256-grMspYyqn4Zl1Kn+hFeUfeIevdwszJc0x2YDC2JILKw=";
+    })
+    (fetchpatch2 {
+      name = "incusd-device-nic_bridged_Fix-swapped-IPv4-IPv6-DNS-record.patch";
+      url = "https://github.com/lxc/incus/commit/33ffcf71745e138dd4f3546839115c293e6be083.patch?full_index=1";
+      hash = "sha256-E8Plz9qdoTt3id9I5jbZYMKQt+kUrKmXmtMJ6IXlRJg=";
+    })
+    (fetchpatch2 {
+      name = "doc-authorization_Fix-reference-to-old-manager-relation.patch";
+      url = "https://github.com/lxc/incus/commit/c65ac0f4e6e94859b8565bce41bbf1595f4a8085.patch?full_index=1";
+      hash = "sha256-6wEz3uxWauIibBkH+OdB7+VsFySmugt6wk61qMayzYo=";
+    })
+    (fetchpatch2 {
+      name = "incusd-network-acl_Fix-issue-with-instances-in-different-project-than-ACL.patch";
+      url = "https://github.com/lxc/incus/commit/2a3584b6fccf152be42cf5614e54241bdb13e671.patch?full_index=1";
+      hash = "sha256-CXE5Bowk3ZPup6oVDEJb9ucsJoXhXu/kU7gGCghhtjQ=";
+    })
+    (fetchpatch2 {
+      name = "incusd-projects_Fix-targeting-on-project-delete.patch";
+      url = "https://github.com/lxc/incus/commit/3a104e4dc24897f0d6543136bb1043fcd4a33632.patch?full_index=1";
+      hash = "sha256-kTFkJqbjzdq5jvNxKw8YMPR04WRj4t5IS6ymoGyXDXE=";
+    })
+    (fetchpatch2 {
+      name = "test-network_acl_Add-test-for-ACL-used-by-instance-in-different-project.patch";
+      url = "https://github.com/lxc/incus/commit/41878729f06e9c31df9d4fac20fb8c384608577c.patch?full_index=1";
+      hash = "sha256-YR2Akus4vp3vNvHEmsJUh/3gbEf3R/cFUOVvt9u/wEU=";
+    })
+    (fetchpatch2 {
+      name = "incusd-instance-qemu_Remove-deprecated-QEMU-flag.patch";
+      url = "https://github.com/lxc/incus/commit/c1f18c78fc6bc4850df20574bdcc541e5eefc4ac.patch?full_index=1";
+      hash = "sha256-kbn4Yd/G23FCFA0Ch0+d81HUxCbcoiOzHfZ0MW+VlzE=";
+    })
+    (fetchpatch2 {
+      name = "incusd-cluster_Re-order-evacuations-to-happen-earlier-on-shutdown.patch";
+      url = "https://github.com/lxc/incus/commit/5b29ecc164ef28239d2e2a874a7c871a2e419083.patch?full_index=1";
+      hash = "sha256-jpyJYjiZvRw/aOGsykEx8uotRBF7p1q5O08PVhyQtvk=";
+    })
+  ];
   nixUpdateExtraArgs = [
     "--override-filename=pkgs/by-name/in/incus/package.nix"
   ];
diff --git a/pkgs/by-name/in/ink/package.nix b/pkgs/by-name/in/ink/package.nix
index 502c5b4b208c..f986dc11295e 100644
--- a/pkgs/by-name/in/ink/package.nix
+++ b/pkgs/by-name/in/ink/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchDebianPatch,
   libinklevel,
 }:
 
@@ -14,6 +15,16 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "1fk0b8vic04a3i3vmq73hbk7mzbi57s8ks6ighn3mvr6m2v8yc9d";
   };
 
+  patches = [
+    (fetchDebianPatch {
+      pname = "ink";
+      version = "0.5.3";
+      debianRevision = "7";
+      patch = "gcc15.patch";
+      hash = "sha256-2Qn8jDAY/ub8MEiG68J7nEnz9GQ/8ScF9nweTkuCibQ=";
+    })
+  ];
+
   buildInputs = [
     libinklevel
   ];
diff --git a/pkgs/by-name/in/instawow/package.nix b/pkgs/by-name/in/instawow/package.nix
index 1d86c27567d3..ad8daa18c329 100644
--- a/pkgs/by-name/in/instawow/package.nix
+++ b/pkgs/by-name/in/instawow/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "instawow";
-  version = "7.0.0";
+  version = "7.0.0.post1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "layday";
     repo = "instawow";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dT1oiPX+id0g28I9I/WJS9G6hyeHHGx5mWvNKXX1Wus=";
+    hash = "sha256-z7O3BHi0OECHSJF6v1ran5ALWe9PU4DxPijuN7yQJ+Q=";
   };
 
   extras = [ ]; # Disable GUI, most dependencies are not packaged.
diff --git a/pkgs/by-name/in/intel-llvm/unwrapped.nix b/pkgs/by-name/in/intel-llvm/unwrapped.nix
index e8f2094489d6..f01144744b3a 100644
--- a/pkgs/by-name/in/intel-llvm/unwrapped.nix
+++ b/pkgs/by-name/in/intel-llvm/unwrapped.nix
@@ -135,6 +135,12 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   cmakeBuildType = "Release";
+  # This is to shave a little bit of size off of the final NAR.
+  # Saves about 0.5GiB
+  # Note that the sum of all outputs needs to stay under 4GiB to be cached by Hydra.
+  # To check:
+  #  nix path-info --json --json-format 2 .#intel-llvm.unwrapped{,.lib,.dev,.python} | jq '[.. | .narSize? // empty] | add'
+  stripDebugFlags = [ "--strip-unneeded" ];
 
   patches = [
     # Fix paths so the output can be split properly
diff --git a/pkgs/by-name/ka/kazumi/git-hashes.json b/pkgs/by-name/ka/kazumi/git-hashes.json
index cf2fa6745ad5..e37ca412e382 100644
--- a/pkgs/by-name/ka/kazumi/git-hashes.json
+++ b/pkgs/by-name/ka/kazumi/git-hashes.json
@@ -1,14 +1,14 @@
 {
   "audio_service_mpris": "sha256-IVv1ioBpiK0VbnOFqnc9NbNn3Z+l9VN2clpCQjckBRo=",
   "desktop_webview_window": "sha256-KWON5aTPlVVrLidmnfpV+syWPYEngChOvkN7miIFjvE=",
-  "media_kit": "sha256-75fNdeaGtpGMOsK+oiLoIdqJe3+5cTO/8ftS0r7AU6I=",
-  "media_kit_libs_android_video": "sha256-75fNdeaGtpGMOsK+oiLoIdqJe3+5cTO/8ftS0r7AU6I=",
-  "media_kit_libs_ios_video": "sha256-75fNdeaGtpGMOsK+oiLoIdqJe3+5cTO/8ftS0r7AU6I=",
-  "media_kit_libs_linux": "sha256-75fNdeaGtpGMOsK+oiLoIdqJe3+5cTO/8ftS0r7AU6I=",
-  "media_kit_libs_macos_video": "sha256-75fNdeaGtpGMOsK+oiLoIdqJe3+5cTO/8ftS0r7AU6I=",
-  "media_kit_libs_ohos": "sha256-75fNdeaGtpGMOsK+oiLoIdqJe3+5cTO/8ftS0r7AU6I=",
-  "media_kit_libs_video": "sha256-75fNdeaGtpGMOsK+oiLoIdqJe3+5cTO/8ftS0r7AU6I=",
-  "media_kit_libs_windows_video": "sha256-75fNdeaGtpGMOsK+oiLoIdqJe3+5cTO/8ftS0r7AU6I=",
-  "media_kit_video": "sha256-75fNdeaGtpGMOsK+oiLoIdqJe3+5cTO/8ftS0r7AU6I=",
+  "media_kit": "sha256-R9fHCJxkPa1kp1yn69LMgyF+QJ7k84AOm8Aa9qcKNIc=",
+  "media_kit_libs_android_video": "sha256-R9fHCJxkPa1kp1yn69LMgyF+QJ7k84AOm8Aa9qcKNIc=",
+  "media_kit_libs_ios_video": "sha256-R9fHCJxkPa1kp1yn69LMgyF+QJ7k84AOm8Aa9qcKNIc=",
+  "media_kit_libs_linux": "sha256-R9fHCJxkPa1kp1yn69LMgyF+QJ7k84AOm8Aa9qcKNIc=",
+  "media_kit_libs_macos_video": "sha256-R9fHCJxkPa1kp1yn69LMgyF+QJ7k84AOm8Aa9qcKNIc=",
+  "media_kit_libs_ohos": "sha256-R9fHCJxkPa1kp1yn69LMgyF+QJ7k84AOm8Aa9qcKNIc=",
+  "media_kit_libs_video": "sha256-R9fHCJxkPa1kp1yn69LMgyF+QJ7k84AOm8Aa9qcKNIc=",
+  "media_kit_libs_windows_video": "sha256-R9fHCJxkPa1kp1yn69LMgyF+QJ7k84AOm8Aa9qcKNIc=",
+  "media_kit_video": "sha256-R9fHCJxkPa1kp1yn69LMgyF+QJ7k84AOm8Aa9qcKNIc=",
   "webview_windows": "sha256-5iNB/h6TzMOTxp98flg7jt2XZn0bFU6wSvYjjUXt3bk="
 }
diff --git a/pkgs/by-name/ka/kazumi/package.nix b/pkgs/by-name/ka/kazumi/package.nix
index 6363529921f6..0c34771bb540 100644
--- a/pkgs/by-name/ka/kazumi/package.nix
+++ b/pkgs/by-name/ka/kazumi/package.nix
@@ -18,13 +18,13 @@
 }:
 
 let
-  version = "2.0.8";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "Predidit";
     repo = "Kazumi";
     tag = version;
-    hash = "sha256-ph9VFRBGwkEjKJGjnPGldLDOwIdHpZtEWydW80hKOFg=";
+    hash = "sha256-cNyeEsH578q+noxOQpJs57x+6FEr6okDbwcaDj6eW1A=";
   };
 in
 flutter338.buildFlutterApplication {
diff --git a/pkgs/by-name/ka/kazumi/pubspec.lock.json b/pkgs/by-name/ka/kazumi/pubspec.lock.json
index 27af44111f65..bce40aab071d 100644
--- a/pkgs/by-name/ka/kazumi/pubspec.lock.json
+++ b/pkgs/by-name/ka/kazumi/pubspec.lock.json
@@ -391,6 +391,16 @@
       "source": "hosted",
       "version": "4.0.9"
     },
+    "cross_file": {
+      "dependency": "transitive",
+      "description": {
+        "name": "cross_file",
+        "sha256": "28bb3ae56f117b5aec029d702a90f57d285cd975c3c5c281eaca38dbc47c5937",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.3.5+2"
+    },
     "crypto": {
       "dependency": "transitive",
       "description": {
@@ -542,6 +552,46 @@
       "source": "hosted",
       "version": "7.0.1"
     },
+    "file_selector_linux": {
+      "dependency": "transitive",
+      "description": {
+        "name": "file_selector_linux",
+        "sha256": "2567f398e06ac72dcf2e98a0c95df2a9edd03c2c2e0cacd4780f20cdf56263a0",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.9.4"
+    },
+    "file_selector_macos": {
+      "dependency": "transitive",
+      "description": {
+        "name": "file_selector_macos",
+        "sha256": "5e0bbe9c312416f1787a68259ea1505b52f258c587f12920422671807c4d618a",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.9.5"
+    },
+    "file_selector_platform_interface": {
+      "dependency": "transitive",
+      "description": {
+        "name": "file_selector_platform_interface",
+        "sha256": "35e0bd61ebcdb91a3505813b055b09b79dfdc7d0aee9c09a7ba59ae4bb13dc85",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.7.0"
+    },
+    "file_selector_windows": {
+      "dependency": "transitive",
+      "description": {
+        "name": "file_selector_windows",
+        "sha256": "62197474ae75893a62df75939c777763d39c2bc5f73ce5b88497208bc269abfd",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.9.3+5"
+    },
     "fixnum": {
       "dependency": "transitive",
       "description": {
@@ -876,6 +926,86 @@
       "source": "hosted",
       "version": "4.8.0"
     },
+    "image_picker": {
+      "dependency": "direct main",
+      "description": {
+        "name": "image_picker",
+        "sha256": "784210112be18ea55f69d7076e2c656a4e24949fa9e76429fe53af0c0f4fa320",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.2.1"
+    },
+    "image_picker_android": {
+      "dependency": "transitive",
+      "description": {
+        "name": "image_picker_android",
+        "sha256": "66810af8e99b2657ee98e5c6f02064f69bb63f7a70e343937f70946c5f8c6622",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.8.13+16"
+    },
+    "image_picker_for_web": {
+      "dependency": "transitive",
+      "description": {
+        "name": "image_picker_for_web",
+        "sha256": "66257a3191ab360d23a55c8241c91a6e329d31e94efa7be9cf7a212e65850214",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.1.1"
+    },
+    "image_picker_ios": {
+      "dependency": "transitive",
+      "description": {
+        "name": "image_picker_ios",
+        "sha256": "b9c4a438a9ff4f60808c9cf0039b93a42bb6c2211ef6ebb647394b2b3fa84588",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.8.13+6"
+    },
+    "image_picker_linux": {
+      "dependency": "transitive",
+      "description": {
+        "name": "image_picker_linux",
+        "sha256": "1f81c5f2046b9ab724f85523e4af65be1d47b038160a8c8deed909762c308ed4",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.2.2"
+    },
+    "image_picker_macos": {
+      "dependency": "transitive",
+      "description": {
+        "name": "image_picker_macos",
+        "sha256": "86f0f15a309de7e1a552c12df9ce5b59fe927e71385329355aec4776c6a8ec91",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.2.2+1"
+    },
+    "image_picker_platform_interface": {
+      "dependency": "transitive",
+      "description": {
+        "name": "image_picker_platform_interface",
+        "sha256": "567e056716333a1647c64bb6bd873cff7622233a5c3f694be28a583d4715690c",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.11.1"
+    },
+    "image_picker_windows": {
+      "dependency": "transitive",
+      "description": {
+        "name": "image_picker_windows",
+        "sha256": "d248c86554a72b5495a31c56f060cf73a41c7ff541689327b1a7dbccc33adfae",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.2.2"
+    },
     "intl": {
       "dependency": "transitive",
       "description": {
@@ -1010,8 +1140,8 @@
       "dependency": "direct main",
       "description": {
         "path": "media_kit",
-        "ref": "f228407de30278da4109bdc090fffedf1986f769",
-        "resolved-ref": "f228407de30278da4109bdc090fffedf1986f769",
+        "ref": "21aacaf9600c4bd00f2a3c57310363bc0cc9597f",
+        "resolved-ref": "21aacaf9600c4bd00f2a3c57310363bc0cc9597f",
         "url": "https://github.com/Predidit/media-kit.git"
       },
       "source": "git",
@@ -1021,8 +1151,8 @@
       "dependency": "direct overridden",
       "description": {
         "path": "libs/android/media_kit_libs_android_video",
-        "ref": "f228407de30278da4109bdc090fffedf1986f769",
-        "resolved-ref": "f228407de30278da4109bdc090fffedf1986f769",
+        "ref": "21aacaf9600c4bd00f2a3c57310363bc0cc9597f",
+        "resolved-ref": "21aacaf9600c4bd00f2a3c57310363bc0cc9597f",
         "url": "https://github.com/Predidit/media-kit.git"
       },
       "source": "git",
@@ -1032,8 +1162,8 @@
       "dependency": "direct overridden",
       "description": {
         "path": "libs/ios/media_kit_libs_ios_video",
-        "ref": "f228407de30278da4109bdc090fffedf1986f769",
-        "resolved-ref": "f228407de30278da4109bdc090fffedf1986f769",
+        "ref": "21aacaf9600c4bd00f2a3c57310363bc0cc9597f",
+        "resolved-ref": "21aacaf9600c4bd00f2a3c57310363bc0cc9597f",
         "url": "https://github.com/Predidit/media-kit.git"
       },
       "source": "git",
@@ -1043,8 +1173,8 @@
       "dependency": "direct overridden",
       "description": {
         "path": "libs/linux/media_kit_libs_linux",
-        "ref": "f228407de30278da4109bdc090fffedf1986f769",
-        "resolved-ref": "f228407de30278da4109bdc090fffedf1986f769",
+        "ref": "21aacaf9600c4bd00f2a3c57310363bc0cc9597f",
+        "resolved-ref": "21aacaf9600c4bd00f2a3c57310363bc0cc9597f",
         "url": "https://github.com/Predidit/media-kit.git"
       },
       "source": "git",
@@ -1054,8 +1184,8 @@
       "dependency": "direct overridden",
       "description": {
         "path": "libs/macos/media_kit_libs_macos_video",
-        "ref": "f228407de30278da4109bdc090fffedf1986f769",
-        "resolved-ref": "f228407de30278da4109bdc090fffedf1986f769",
+        "ref": "21aacaf9600c4bd00f2a3c57310363bc0cc9597f",
+        "resolved-ref": "21aacaf9600c4bd00f2a3c57310363bc0cc9597f",
         "url": "https://github.com/Predidit/media-kit.git"
       },
       "source": "git",
@@ -1065,8 +1195,8 @@
       "dependency": "direct overridden",
       "description": {
         "path": "libs/ohos/media_kit_libs_ohos",
-        "ref": "f228407de30278da4109bdc090fffedf1986f769",
-        "resolved-ref": "f228407de30278da4109bdc090fffedf1986f769",
+        "ref": "21aacaf9600c4bd00f2a3c57310363bc0cc9597f",
+        "resolved-ref": "21aacaf9600c4bd00f2a3c57310363bc0cc9597f",
         "url": "https://github.com/Predidit/media-kit.git"
       },
       "source": "git",
@@ -1076,8 +1206,8 @@
       "dependency": "direct main",
       "description": {
         "path": "libs/universal/media_kit_libs_video",
-        "ref": "f228407de30278da4109bdc090fffedf1986f769",
-        "resolved-ref": "f228407de30278da4109bdc090fffedf1986f769",
+        "ref": "21aacaf9600c4bd00f2a3c57310363bc0cc9597f",
+        "resolved-ref": "21aacaf9600c4bd00f2a3c57310363bc0cc9597f",
         "url": "https://github.com/Predidit/media-kit.git"
       },
       "source": "git",
@@ -1087,8 +1217,8 @@
       "dependency": "direct overridden",
       "description": {
         "path": "libs/windows/media_kit_libs_windows_video",
-        "ref": "f228407de30278da4109bdc090fffedf1986f769",
-        "resolved-ref": "f228407de30278da4109bdc090fffedf1986f769",
+        "ref": "21aacaf9600c4bd00f2a3c57310363bc0cc9597f",
+        "resolved-ref": "21aacaf9600c4bd00f2a3c57310363bc0cc9597f",
         "url": "https://github.com/Predidit/media-kit.git"
       },
       "source": "git",
@@ -1098,8 +1228,8 @@
       "dependency": "direct main",
       "description": {
         "path": "media_kit_video",
-        "ref": "f228407de30278da4109bdc090fffedf1986f769",
-        "resolved-ref": "f228407de30278da4109bdc090fffedf1986f769",
+        "ref": "21aacaf9600c4bd00f2a3c57310363bc0cc9597f",
+        "resolved-ref": "21aacaf9600c4bd00f2a3c57310363bc0cc9597f",
         "url": "https://github.com/Predidit/media-kit.git"
       },
       "source": "git",
@@ -2245,6 +2375,6 @@
   },
   "sdks": {
     "dart": ">=3.10.3 <4.0.0",
-    "flutter": ">=3.41.7"
+    "flutter": ">=3.41.9"
   }
 }
diff --git a/pkgs/by-name/kl/kloak/package.nix b/pkgs/by-name/kl/kloak/package.nix
new file mode 100644
index 000000000000..59b2c18c2e5f
--- /dev/null
+++ b/pkgs/by-name/kl/kloak/package.nix
@@ -0,0 +1,66 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  pkg-config,
+  which,
+  wayland-scanner,
+  ronn,
+  installShellFiles,
+  libevdev,
+  libsodium,
+  libinput,
+  wayland,
+  libxkbcommon,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "kloak";
+  version = "0.7.8-1";
+
+  src = fetchFromGitHub {
+    owner = "Whonix";
+    repo = "kloak";
+    tag = finalAttrs.version;
+    hash = "sha256-V9t7fQ3K5OIWKhvFiX5Hsf0WzAQUWiZojgbjc38Z1Nk=";
+  };
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    which
+    wayland-scanner
+    ronn
+    installShellFiles
+  ];
+
+  buildInputs = [
+    libevdev
+    libsodium
+    libinput
+    wayland
+    libxkbcommon
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D kloak $out/bin/kloak
+
+    ronn --roff man/kloak.8.ronn
+    installManPage man/kloak.8
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Privacy tool for anonymizing keyboard and mouse use";
+    homepage = "https://github.com/Whonix/kloak";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ sotormd ];
+    mainProgram = "kloak";
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/kr/krunkit/package.nix b/pkgs/by-name/kr/krunkit/package.nix
index fa0f6df93c4f..894231cb3ea1 100644
--- a/pkgs/by-name/kr/krunkit/package.nix
+++ b/pkgs/by-name/kr/krunkit/package.nix
@@ -13,18 +13,18 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "krunkit";
-  version = "1.1.1";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "krunkit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2O2v4etlXN61f8Goog+/e/6FTCtt7xSJnkq+w2KGxUM=";
+    hash = "sha256-T3PbSDaMqR/DLaTe1/tyMx/KseU5ENFzz1Gxd5/hRao=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
-    hash = "sha256-ckUunlnyf5BXq/EzFYPF8fI996/NgQaXUuVdOgfj1yk=";
+    hash = "sha256-Yb2jyK4UBJCeVXSKl4UABnlMj+7SKpOIi49tD/itHYo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/la/lagrange/package.nix b/pkgs/by-name/la/lagrange/package.nix
index 05a060d27573..f56ff83240a1 100644
--- a/pkgs/by-name/la/lagrange/package.nix
+++ b/pkgs/by-name/la/lagrange/package.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lagrange";
-  version = "1.20.4";
+  version = "1.20.5";
 
   src = fetchFromGitHub {
     owner = "skyjake";
     repo = "lagrange";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Pm8ITbMlFnJLeUTUOrY4WRG17v/JIi+ZF9Y5LutCz40=";
+    hash = "sha256-U6SrUmTn43IleeVCLkh9NONyWtUe2Oja3e6VmYKOHvQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/la/lastools/package.nix b/pkgs/by-name/la/lastools/package.nix
index e66f3144d4e2..cfd05ce6fda6 100644
--- a/pkgs/by-name/la/lastools/package.nix
+++ b/pkgs/by-name/la/lastools/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lastools";
-  version = "2.0.4";
+  version = "2.0.5";
 
   src = fetchFromGitHub {
     owner = "LAStools";
     repo = "LAStools";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ow7zcvkenJ2j+tj2TxuEtK0dQEwzUtJ9f0wzt5/qimM=";
+    hash = "sha256-eXBrx8gKagxp1J4BOX+f2cH0GkMX0GJ8ebVZw7qqioA=";
   };
 
   patches = [
diff --git a/pkgs/by-name/lf/lfk/package.nix b/pkgs/by-name/lf/lfk/package.nix
index 3e17b48d00b3..044eccb276bd 100644
--- a/pkgs/by-name/lf/lfk/package.nix
+++ b/pkgs/by-name/lf/lfk/package.nix
@@ -6,17 +6,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "lfk";
-  version = "0.9.36";
+  version = "0.10.2";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "janosmiko";
     repo = "lfk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-aIWqZ90Mz6Oc554wLB4691JsX68VG0pD3+AuAOkqNis=";
+    hash = "sha256-6H67d9zVdfsUhnsC4Hg6z3nm0w2//Q8oj1FZBR+a8SY=";
   };
 
-  vendorHash = "sha256-2YhpOg5asUYaMQxorwTt1gkyiA165wjBxDoIUJ74sro=";
+  vendorHash = "sha256-GfJr3jtG+GhV7AHgM0EjPe+bFqdIRkHpjaylu753cGI=";
 
   ldflags = [ "-s" ];
 
diff --git a/pkgs/by-name/li/libamplsolver/package.nix b/pkgs/by-name/li/libamplsolver/package.nix
index 129307101b48..e836cc9a5741 100644
--- a/pkgs/by-name/li/libamplsolver/package.nix
+++ b/pkgs/by-name/li/libamplsolver/package.nix
@@ -2,16 +2,19 @@
   lib,
   stdenv,
   substitute,
-  fetchurl,
+  fetchFromGitHub,
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libamplsolver";
-  version = "20211109";
+  version = "1.0.1";
 
-  src = fetchurl {
-    url = "https://ampl.com/netlib/ampl/solvers.tgz";
-    sha256 = "sha256-LVmScuIvxmZzywPSBl9T9YcUBJP7UFAa3eWs9r4q3JM=";
+  src = fetchFromGitHub {
+    owner = "ampl";
+    repo = "asl";
+    rootDir = "src/solvers";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-D1hB5z6r4n6+u1oWclhIst1mXDvObmOsh1j0uocairQ=";
   };
 
   patches = [
@@ -25,6 +28,10 @@ stdenv.mkDerivation {
     })
   ];
 
+  preConfigure = ''
+    chmod u+x configure configurehere
+  '';
+
   env = {
     # For non-trapping FP architectures like loongarch64 and riscv64
     NIX_CFLAGS_COMPILE = lib.optionalString (
@@ -59,4 +66,4 @@ stdenv.mkDerivation {
     # generates header at compile time
     broken = !stdenv.buildPlatform.canExecute stdenv.hostPlatform;
   };
-}
+})
diff --git a/pkgs/by-name/li/libation/package.nix b/pkgs/by-name/li/libation/package.nix
index c27c87e73a06..3d7035df40dc 100644
--- a/pkgs/by-name/li/libation/package.nix
+++ b/pkgs/by-name/li/libation/package.nix
@@ -16,13 +16,13 @@
 
 buildDotnetModule rec {
   pname = "libation";
-  version = "13.3.5";
+  version = "13.3.6";
 
   src = fetchFromGitHub {
     owner = "rmcrackan";
     repo = "Libation";
     tag = "v${version}";
-    hash = "sha256-2n+1V4O1hyPUGogwCUz7aCo+sdZAUVAXqj1L9IPmUX4=";
+    hash = "sha256-8kJEEi2Ol1zvBtONoJwu4R4ACNbB5dtQyiCXN77vvPs=";
   };
 
   sourceRoot = "${src.name}/Source";
diff --git a/pkgs/by-name/li/libkrun-efi/package.nix b/pkgs/by-name/li/libkrun-efi/package.nix
index 4dd223a7ef52..2ab20562e614 100644
--- a/pkgs/by-name/li/libkrun-efi/package.nix
+++ b/pkgs/by-name/li/libkrun-efi/package.nix
@@ -20,13 +20,13 @@
   withGpu ? true,
 }:
 let
-  version = "1.17.4";
+  version = "1.18.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "libkrun";
     tag = "v${version}";
-    hash = "sha256-Th4vCg3xHb6lbo26IDZES7tLOUAJTebQK2+h3xSYX7U=";
+    hash = "sha256-R7q52ZwiL9JsGofLPhXVTk/eH6bEob3DoZe21PHSBrU=";
   };
 
   virglrenderer = stdenv.mkDerivation (finalAttrs: {
@@ -78,7 +78,7 @@ let
     buildPhase = ''
       runHook preBuild
       cd init
-      $CC -O2 -static -Wall -o init init.c
+      $CC -O2 -static -Wall -o init init.c dhcp.c
       runHook postBuild
     '';
 
@@ -100,7 +100,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src;
-    hash = "sha256-0xpAyNe1jF1OMtc7FXMsejqIv0xKc1ktEvm3rj/mVFU=";
+    hash = "sha256-3IAEWF+XGeKnb61SUpuVHMPiX6q0FgQFN4/eOBCH80c=";
   };
 
   nativeBuildInputs = [
@@ -124,8 +124,16 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optional withGpu "GPU=1";
 
-  preBuild = ''
-    cp ${initBinary}/init init/init
+  env.KRUN_INIT_BINARY_PATH = "${initBinary}/init";
+
+  postPatch = ''
+    substituteInPlace Makefile --replace-fail \
+      '$(LIBRARY_RELEASE_$(OS)): $(SYSROOT_TARGET) $(INIT_BINARY_BSD)' \
+      '$(LIBRARY_RELEASE_$(OS)):'
+  '';
+
+  postInstall = ''
+    ln -s $out/lib/libkrun-efi.dylib $out/lib/libkrun.dylib
   '';
 
   passthru = {
diff --git a/pkgs/by-name/li/libsakura/package.nix b/pkgs/by-name/li/libsakura/package.nix
new file mode 100644
index 000000000000..93183b65c521
--- /dev/null
+++ b/pkgs/by-name/li/libsakura/package.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  eigen,
+  fftw,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libsakura";
+  version = "5.3.2";
+
+  src = fetchFromGitHub {
+    owner = "tnakazato";
+    repo = "sakura";
+    tag = "${finalAttrs.pname}-${finalAttrs.version}";
+    hash = "sha256-QkVZXb9m4iMTeFYUOK1u+9HM0oMu48bwe7AovafanVU=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/${finalAttrs.pname}";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    eigen
+    fftw
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeFeature "SIMD_ARCH" "GENERIC")
+    (lib.cmakeBool "PYTHON_BINDING" false)
+    (lib.cmakeBool "BUILD_DOC" false)
+    (lib.cmakeBool "ENABLE_TEST" false)
+  ];
+
+  meta = {
+    homepage = "https://tnakazato.github.io/sakura/";
+    changelog = "https://github.com/tnakazato/sakura/releases/tag/${finalAttrs.pname}-${finalAttrs.version}";
+    description = "Thread-safe library for signal processing in radio astronomy";
+    maintainers = with lib.maintainers; [ kiranshila ];
+    license = lib.licenses.lgpl3Plus;
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/li/litecli/package.nix b/pkgs/by-name/li/litecli/package.nix
index f865ba5927ee..844ced7b232e 100644
--- a/pkgs/by-name/li/litecli/package.nix
+++ b/pkgs/by-name/li/litecli/package.nix
@@ -13,7 +13,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   src = fetchFromGitHub {
     owner = "dbcli";
     repo = "litecli";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-YSPNtDL5rNgRh5lJBKfL1jjWemlmf3eesBMSLyJVRLY=";
   };
 
@@ -47,13 +47,13 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   meta = {
     description = "Command-line interface for SQLite";
-    mainProgram = "litecli";
     longDescription = ''
       A command-line client for SQLite databases that has auto-completion and syntax highlighting.
     '';
     homepage = "https://litecli.com";
-    changelog = "https://github.com/dbcli/litecli/blob/v${finalAttrs.version}/CHANGELOG.md";
+    changelog = "https://github.com/dbcli/litecli/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ iamanaws ];
+    mainProgram = "litecli";
   };
 })
diff --git a/pkgs/by-name/lu/lufus/package.nix b/pkgs/by-name/lu/lufus/package.nix
new file mode 100644
index 000000000000..de064128430f
--- /dev/null
+++ b/pkgs/by-name/lu/lufus/package.nix
@@ -0,0 +1,74 @@
+{
+  lib,
+  python313Packages,
+  fetchFromGitHub,
+  makeWrapper,
+  makeDesktopItem,
+  copyDesktopItems,
+}:
+python313Packages.buildPythonApplication (finalAttrs: {
+  pname = "lufus";
+  version = "1.0.0b1.1";
+
+  src = fetchFromGitHub {
+    owner = "Hog185";
+    repo = "Lufus";
+    tag = "v${finalAttrs.version}";
+    sha256 = "sha256-3i0CnhGvLTXutz8CQoH5q4PwZ23lAwnUo8H5TRJx+KE=";
+  };
+
+  propagatedBuildInputs = with python313Packages; [
+    psutil
+    pyqt6
+    pyudev
+    requests
+    platformdirs
+  ];
+
+  pyproject = true;
+
+  build-system = with python313Packages; [
+    setuptools
+    wheel
+  ];
+
+  nativeBuildInputs = [
+    makeWrapper
+    copyDesktopItems
+  ];
+
+  __structuredAttrs = true;
+
+  postInstall = ''
+    makeWrapper ${python313Packages.python.interpreter} $out/bin/lufus \
+      --add-flags "-m lufus" \
+      --prefix PYTHONPATH : "$out/${python313Packages.python.sitePackages}:${python313Packages.makePythonPath finalAttrs.propagatedBuildInputs}"
+
+    install -Dm644 src/lufus/gui/assets/lufus.png $out/share/pixmaps/lufus.png
+
+    copyDesktopItems
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "lufus";
+      desktopName = "Lufus";
+      comment = "A rufus clone written in py and designed to work with linux";
+      exec = "lufus";
+      icon = "lufus";
+      categories = [
+        "Utility"
+        "System"
+      ];
+    })
+  ];
+
+  meta = {
+    description = "A rufus clone written in py and designed to work with linux";
+    homepage = "https://github.com/Hog185/Lufus";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ Simon-Weij ];
+    platforms = lib.platforms.linux;
+    mainProgram = "lufus";
+  };
+})
diff --git a/pkgs/by-name/m1/m1n1/package.nix b/pkgs/by-name/m1/m1n1/package.nix
index 0e2d9009da07..ba9320acbde9 100644
--- a/pkgs/by-name/m1/m1n1/package.nix
+++ b/pkgs/by-name/m1/m1n1/package.nix
@@ -151,7 +151,7 @@ stdenv.mkDerivation (finalAttrs: {
       bsd3
       asl20
     ];
-    maintainers = [ ];
-    platforms = lib.platforms.aarch64;
+    maintainers = with lib.maintainers; [ sempiternal-aurora ];
+    platforms = [ "aarch64-linux" ];
   };
 })
diff --git a/pkgs/by-name/ma/magicq/package.nix b/pkgs/by-name/ma/magicq/package.nix
new file mode 100644
index 000000000000..f345f67f38c1
--- /dev/null
+++ b/pkgs/by-name/ma/magicq/package.nix
@@ -0,0 +1,100 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  autoPatchelfHook,
+  copyDesktopItems,
+  makeDesktopItem,
+  dpkg,
+  alsa-lib-with-plugins,
+  ffmpeg_4,
+  libGL,
+  libGLU,
+  libarchive,
+  libgcc,
+  libsForQt5,
+  qt5,
+  libusb-compat-0_1,
+  libusb1,
+  libz,
+  portaudio,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "magicq";
+  version = "1.9.7.3";
+  src_version = builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version;
+
+  src = fetchurl {
+    url = "https://secure.chamsys.co.uk/downloads/v${finalAttrs.src_version}/magicq_ubuntu_v${finalAttrs.src_version}.deb";
+    hash = "sha256-FsVSt9iIhwL/wI2XYmKJrA7800wFQ2qJ/uF3bbMLw0Q=";
+  };
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    copyDesktopItems
+    dpkg
+    qt5.wrapQtAppsHook
+  ];
+  buildInputs = [
+    alsa-lib-with-plugins
+    ffmpeg_4
+    libGL
+    libGLU
+    libarchive
+    libgcc
+    libsForQt5.qt5.qtbase
+    libsForQt5.qt5.qtmultimedia
+    qt5.qtbase
+    libusb-compat-0_1
+    libusb1
+    libz
+    portaudio
+  ];
+
+  installPhase = ''
+    mkdir $out
+    cp -r . $out
+    rm -r $out/opt/magicq/lib
+    rm $out/opt/magicq/plugins/imageformats/libqtiff.so
+    rm $out/opt/magicq/plugins/printsupport/libcupsprintersupport.so
+    rm $out/opt/magicq/plugins/mediaservice/libgstcamerabin.so
+    mv $out/usr/share $out/share
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    mkdir $out/bin
+    makeWrapper $out/opt/magicq/bin/mqqt $out/bin/magicq \
+    --chdir $out/opt/magicq
+    wrapQtApp $out/bin/magicq
+    sed "s|@out@|$out|g" -i $out/share/applications/magicq.desktop
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "magicq";
+      desktopName = "MagicQ by ChamSys Ltd.";
+      genericName = "MagicQ";
+      exec = "@out@/bin/magicq";
+      path = "@out@/opt/magicq/";
+      icon = "magicq";
+      categories = [
+        "AudioVideo"
+        "Qt"
+      ];
+    })
+  ];
+
+  meta = {
+    description = "MagicQ Lighting Console Software";
+    homepage = "https://chamsyslighting.com/product/magicq-software/";
+    license = lib.licenses.unfree;
+    platforms = lib.platforms.linux;
+    mainProgram = "magicq";
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    maintainers = with lib.maintainers; [ panakotta00 ];
+  };
+})
diff --git a/pkgs/by-name/ma/mangohud/package.nix b/pkgs/by-name/ma/mangohud/package.nix
index 36d24d92a496..1cf07b1fc5eb 100644
--- a/pkgs/by-name/ma/mangohud/package.nix
+++ b/pkgs/by-name/ma/mangohud/package.nix
@@ -48,16 +48,16 @@ assert lib.assertMsg (mangoappSupport -> x11Support) "mangoappSupport requires x
 let
   # Derived from subprojects/imgui.wrap
   imgui = rec {
-    version = "1.89.9";
+    version = "1.91.6";
     src = fetchFromGitHub {
       owner = "ocornut";
       repo = "imgui";
       tag = "v${version}";
-      hash = "sha256-0k9jKrJUrG9piHNFQaBBY3zgNIKM23ZA879NY+MNYTU=";
+      hash = "sha256-CLS26CRzzY4vUBgILjSQVvziHMyPGK4fwwcLZcOAzPw=";
     };
     patch = fetchurl {
-      url = "https://wrapdb.mesonbuild.com/v2/imgui_${version}-1/get_patch";
-      hash = "sha256-myEpDFl9dr+NTus/n/oCSxHZ6mxh6R1kjMyQtChD1YQ=";
+      url = "https://wrapdb.mesonbuild.com/v2/imgui_${version}-3/get_patch";
+      hash = "sha256-L3l3EUugfQZVmq+IkKkqTr0lGGWS1ER5VGBaryJEY00=";
     };
   };
 
@@ -78,32 +78,40 @@ let
 
   # Derived from subprojects/vulkan-headers.wrap
   vulkan-headers = rec {
-    version = "1.2.158";
+    version = "1.4.346";
     src = fetchFromGitHub {
       owner = "KhronosGroup";
       repo = "Vulkan-Headers";
       tag = "v${version}";
-      hash = "sha256-5uyk2nMwV1MjXoa3hK/WUeGLwpINJJEvY16kc5DEaks=";
-    };
-    patch = fetchurl {
-      url = "https://wrapdb.mesonbuild.com/v2/vulkan-headers_${version}-2/get_patch";
-      hash = "sha256-hgNYz15z9FjNHoj4w4EW0SOrQh1c4uQSnsOOrt2CDhc=";
+      hash = "sha256-JTBW5CF5hlHWkhCjjRd08hpoAarB5W3FJbHzhQM4YFs=";
     };
   };
+
+  # Derived from subprojects/vulkan-headers.wrap
+  vulkan-utility-libraries = rec {
+    version = "1.4.346";
+    src = fetchFromGitHub {
+      owner = "KhronosGroup";
+      repo = "Vulkan-Utility-Libraries";
+      tag = "v${version}";
+      hash = "sha256-FWZe6NdhLmI/3bm3OIK646vkWkIQ5xmBa4jlSVHSnDs=";
+    };
+  };
+
   libXNVCtrl = linuxPackages.nvidia_x11.settings.libXNVCtrl;
   mangohud32 = pkgsi686Linux.mangohud;
 
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mangohud";
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "flightlessmango";
     repo = "MangoHud";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-BZ3R7D2zOlg69rx4y2FzzjpXuPOv913TOz9kSvRN+Wg=";
+    hash = "sha256-fzfSYyz2NMo61Yd7boRxdtbi/KTNbSos0qmHf2/mikk=";
   };
 
   outputs = [
@@ -119,6 +127,7 @@ stdenv.mkDerivation (finalAttrs: {
       cp -R --no-preserve=mode,ownership ${imgui.src} imgui-${imgui.version}
       cp -R --no-preserve=mode,ownership ${implot.src} implot-${implot.version}
       cp -R --no-preserve=mode,ownership ${vulkan-headers.src} Vulkan-Headers-${vulkan-headers.version}
+      cp -R --no-preserve=mode,ownership ${vulkan-utility-libraries.src} Vulkan-Utility-Libraries-${vulkan-utility-libraries.version}
     )
   '';
 
@@ -163,7 +172,8 @@ stdenv.mkDerivation (finalAttrs: {
       cd subprojects
       unzip ${imgui.patch}
       unzip ${implot.patch}
-      unzip ${vulkan-headers.patch}
+      cp -R --no-preserve=mode,ownership packagefiles/vulkan-headers/* Vulkan-Headers-${vulkan-headers.version}
+      cp -R --no-preserve=mode,ownership packagefiles/vulkan-utility-libraries/* ${vulkan-utility-libraries.src} Vulkan-Utility-Libraries-${vulkan-utility-libraries.version}
     )
   '';
 
diff --git a/pkgs/by-name/ma/markdown-code-runner/package.nix b/pkgs/by-name/ma/markdown-code-runner/package.nix
index 2671cbac13bb..ea602fd676af 100644
--- a/pkgs/by-name/ma/markdown-code-runner/package.nix
+++ b/pkgs/by-name/ma/markdown-code-runner/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "markdown-code-runner";
-  version = "0.4.2";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "drupol";
     repo = "markdown-code-runner";
     tag = finalAttrs.version;
-    hash = "sha256-IMI9hjZDjgzReLIuNOISIkiLlPmnX+DWlrylP108wDc=";
+    hash = "sha256-GcPMkwXwLyHoVljOpfnhmysDYIFXSyvNL5P3f6q/KJw=";
   };
 
-  cargoHash = "sha256-aUbavxCObgZlhlv5DyoC/yAq79UM4tR77jwTsVqN4yU=";
+  cargoHash = "sha256-ul5cl6FDYkW02HGtQmLHkOsSaTIn2lCaTpKjCUzdcjM=";
 
   dontUseCargoParallelTests = true;
 
diff --git a/pkgs/by-name/ma/matrix-authentication-service/package.nix b/pkgs/by-name/ma/matrix-authentication-service/package.nix
index 6a6a22e82b9e..0c5aaf652560 100644
--- a/pkgs/by-name/ma/matrix-authentication-service/package.nix
+++ b/pkgs/by-name/ma/matrix-authentication-service/package.nix
@@ -18,21 +18,21 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "matrix-authentication-service";
-  version = "1.15.0";
+  version = "1.16.0";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "matrix-authentication-service";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-q3MtMRdvuL0olnqvqK8uWeFCT7UpKjZN4zz9ZFlyGd4=";
+    hash = "sha256-pyL2QhvycaGBYgelsHK5Ces195Z1aY2XZyecsPXO/X4=";
   };
 
-  cargoHash = "sha256-FV4ZKR6lq8b5PMj+mZ+/RBWLmoGc6WuAXw00+PGJUi8=";
+  cargoHash = "sha256-gvG6+strULIewJgFdGg3fJ2mjUVjgi9/Q7pDredYuiU=";
 
   npmDeps = fetchNpmDeps {
     name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
     src = "${finalAttrs.src}/${finalAttrs.npmRoot}";
-    hash = "sha256-OA7T8dTWEb8QiiRBx1A/R8H2Bu/xv3RFr8K9IVU3674=";
+    hash = "sha256-FevzqirT/GyT8urQ79AtJi+q1zcwn73AyiJTf/B9cG0=";
   };
 
   npmRoot = "frontend";
diff --git a/pkgs/by-name/mi/microsoft-edge/package.nix b/pkgs/by-name/mi/microsoft-edge/package.nix
index 6068aee262e3..25532cf8274a 100644
--- a/pkgs/by-name/mi/microsoft-edge/package.nix
+++ b/pkgs/by-name/mi/microsoft-edge/package.nix
@@ -170,11 +170,11 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "microsoft-edge";
-  version = "147.0.3912.60";
+  version = "147.0.3912.98";
 
   src = fetchurl {
     url = "https://packages.microsoft.com/repos/edge/pool/main/m/microsoft-edge-stable/microsoft-edge-stable_${finalAttrs.version}-1_amd64.deb";
-    hash = "sha256-fb7BkPuiP3KjLw4h6idyMiaMuesVLseTgblLnz6ZfTU=";
+    hash = "sha256-GD5bXeEWVQHr+u+B3SUjoNCJIp9hwyCW6sYMDbGUBls=";
   };
 
   # With strictDeps on, some shebangs were not being patched correctly
diff --git a/pkgs/by-name/mi/mirrord/manifest.json b/pkgs/by-name/mi/mirrord/manifest.json
index d5f7d69c6140..afb56d1c4d5d 100644
--- a/pkgs/by-name/mi/mirrord/manifest.json
+++ b/pkgs/by-name/mi/mirrord/manifest.json
@@ -1,21 +1,21 @@
 {
-  "version": "3.206.1",
+  "version": "3.209.1",
   "assets": {
     "x86_64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.206.1/mirrord_linux_x86_64",
-      "hash": "sha256-RWhqtP8gVAz2H6OU/ZSiL9kBD0rMs/NfsaNnDzjfriw="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.209.1/mirrord_linux_x86_64",
+      "hash": "sha256-XXSU13UhffwgIIdfPW3vjPOcvtrggs2bKpsMkwUdv8Y="
     },
     "aarch64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.206.1/mirrord_linux_aarch64",
-      "hash": "sha256-3uzh324H6c43Xcx49ynh6S540G3cxBXQL+Jv3SXaY2Q="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.209.1/mirrord_linux_aarch64",
+      "hash": "sha256-RiQsrGAOfRe8kRmNF8imJjP+ZktUpUuMvNGmMI0fboc="
     },
     "aarch64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.206.1/mirrord_mac_universal",
-      "hash": "sha256-jcTlTcCD3hi74e9a87WmiqpnKyLifxWWDu5Pbw9qQOY="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.209.1/mirrord_mac_universal",
+      "hash": "sha256-Lkqk9CgOnMFMUut6JRU5V4IimI1ys/iVX1M5DxOtOMk="
     },
     "x86_64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.206.1/mirrord_mac_universal",
-      "hash": "sha256-jcTlTcCD3hi74e9a87WmiqpnKyLifxWWDu5Pbw9qQOY="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.209.1/mirrord_mac_universal",
+      "hash": "sha256-Lkqk9CgOnMFMUut6JRU5V4IimI1ys/iVX1M5DxOtOMk="
     }
   }
 }
diff --git a/pkgs/by-name/mi/mistral-vibe/package.nix b/pkgs/by-name/mi/mistral-vibe/package.nix
index adbeb158d070..240d729627f1 100644
--- a/pkgs/by-name/mi/mistral-vibe/package.nix
+++ b/pkgs/by-name/mi/mistral-vibe/package.nix
@@ -22,13 +22,22 @@ let
           hash = "sha256-1KVy9s+zjlB4w7E45PMCWRxPus24bgBmmM3k2R9d+Jg=";
         };
       });
+      # 112/2907 tests fail with textual 8.2.5:
+      # textual.app.InvalidThemeError: Theme 'textual-ansi' has not been registered.
+      textual = prev.textual.overridePythonAttrs (old: rec {
+        version = "8.2.4";
+        src = old.src.override {
+          tag = "v${version}";
+          hash = "sha256-827cm9pcj1o1FYeaoWKCJ6dEyXeDop4kYd205cySTfg=";
+        };
+      });
     };
   };
   python3Packages = python.pkgs;
 in
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "mistral-vibe";
-  version = "2.9.3";
+  version = "2.9.4";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -36,7 +45,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "mistralai";
     repo = "mistral-vibe";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3kMilvBmBhP57jPlDLc+S6kDuJjcOjMHEwh8W4hzEVw=";
+    hash = "sha256-TOA1ybK41f3+/I5gCaPlAd3yo9N399l6JumWnATbS00=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/mo/mongosh/package.nix b/pkgs/by-name/mo/mongosh/package.nix
index 03223a13b03b..fea7fd4338a7 100644
--- a/pkgs/by-name/mo/mongosh/package.nix
+++ b/pkgs/by-name/mo/mongosh/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage.override { nodejs = nodejs_22; } (finalAttrs: {
   pname = "mongosh";
-  version = "2.8.2";
+  version = "2.8.3";
 
   src = fetchFromGitHub {
     owner = "mongodb-js";
     repo = "mongosh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GgXFbT0cgoo3wSe5jyE4sU977q4/xTOiEYILN0Kyl+4=";
+    hash = "sha256-CHHGQYJBv1sVo2LT9jxx+c15TU8ecG9R5DVQOA9yG+A=";
   };
 
-  npmDepsHash = "sha256-7o9UGK06wLAWDad6Xqq8o9cvJFSIkI2j8uHQxt77r9c=";
+  npmDepsHash = "sha256-FlVKJqXiDW3FdBrm2lN2vw+xFkvm7J1FgCEI6rFfR4o=";
 
   patches = [
     ./disable-telemetry.patch
diff --git a/pkgs/by-name/mo/moonlight/package.nix b/pkgs/by-name/mo/moonlight/package.nix
index fc5d45400dc7..d5fc3de191b8 100644
--- a/pkgs/by-name/mo/moonlight/package.nix
+++ b/pkgs/by-name/mo/moonlight/package.nix
@@ -14,13 +14,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "moonlight";
-  version = "2026.4.0";
+  version = "2026.5.0";
 
   src = fetchFromGitHub {
     owner = "moonlight-mod";
     repo = "moonlight";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jbIdFHPomN0zD2I6UoClofvSNVdOqpf0nM1s5pbn7ew=";
+    hash = "sha256-RZ7fmgzENSt9bXuhPWW9wBaJ1dss/b23R1VS+tEU7io=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ms/msedgedriver/package.nix b/pkgs/by-name/ms/msedgedriver/package.nix
index dd5608313ef1..6616d4d9c29a 100644
--- a/pkgs/by-name/ms/msedgedriver/package.nix
+++ b/pkgs/by-name/ms/msedgedriver/package.nix
@@ -11,11 +11,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "msedgedriver";
-  version = "147.0.3912.60";
+  version = "147.0.3912.98";
 
   src = fetchzip {
     url = "https://msedgedriver.microsoft.com/${finalAttrs.version}/edgedriver_linux64.zip";
-    hash = "sha256-OvhvTMnY7ckM92wCrM+sfn1e5641rFgi54YZGZZeUh0=";
+    hash = "sha256-w9ekySBlqy0ev3OE/G05UJ6tz8EGC2Pc3fMNpmvmKMU=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/na/nats-server/package.nix b/pkgs/by-name/na/nats-server/package.nix
index 00e3e431a306..33fdbf837a49 100644
--- a/pkgs/by-name/na/nats-server/package.nix
+++ b/pkgs/by-name/na/nats-server/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "nats-server";
-  version = "2.12.8";
+  version = "2.14.0";
 
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = "nats-server";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-iJMF6OyfukTYOwET+wxFpJZ8R0b7/JMEZns5dAkx5DE=";
+    hash = "sha256-S4IbxeiagiAXHidXBXniHKEUGnYaPWoGFNk2DPOkSNo=";
   };
 
-  vendorHash = "sha256-4idiVBtE+e2jf9uS3at+5+C3dnLxjtsLJIBC8zye5Pg=";
+  vendorHash = "sha256-oEYc8cT6OUQ7imbfDskIxnSNhHWpvSpMCxPdS6O2oZA=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/ne/newflasher/package.nix b/pkgs/by-name/ne/newflasher/package.nix
new file mode 100644
index 000000000000..e0d50484180b
--- /dev/null
+++ b/pkgs/by-name/ne/newflasher/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  expat,
+  zlib,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "newflasher";
+  version = "59";
+
+  src = fetchFromGitHub {
+    owner = "munjeni";
+    repo = "newflasher";
+    tag = "${finalAttrs.version}";
+    hash = "sha256-ulcHbSoMXnu0pauYUaZiTVvl5VtEYnYy3ljtZ0oEvGM=";
+  };
+
+  buildInputs = [
+    expat
+    zlib
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 newflasher $out/bin/newflasher
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Flash tool for new Sony flash tool protocol (Xperia XZ Premium and newer)";
+    homepage = "https://github.com/munjeni/newflasher";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ toastal ];
+  };
+})
diff --git a/pkgs/by-name/ni/nim-2_2/package.nix b/pkgs/by-name/ni/nim-2_2/package.nix
index 322d3711f903..350d235887b9 100644
--- a/pkgs/by-name/ni/nim-2_2/package.nix
+++ b/pkgs/by-name/ni/nim-2_2/package.nix
@@ -48,8 +48,8 @@ let
           runHook preBuild
           cat >> config/config.nims << WTF
 
-          switch("os", "${nimUnwrapped.passthru.nimTarget.os}")
-          switch("cpu", "${nimUnwrapped.passthru.nimTarget.cpu}")
+          switch("os", "${stdenv.targetPlatform.nim.os}")
+          switch("cpu", "${stdenv.targetPlatform.nim.cpu}")
           switch("define", "nixbuild")
 
           # Configure the compiler using the $CC set by Nix at build time
@@ -63,8 +63,8 @@ let
 
           mv config/nim.cfg config/nim.cfg.old
           cat > config/nim.cfg << WTF
-          os = "${nimUnwrapped.passthru.nimTarget.os}"
-          cpu =  "${nimUnwrapped.passthru.nimTarget.cpu}"
+          os = "${stdenv.targetPlatform.nim.os}"
+          cpu =  "${stdenv.targetPlatform.nim.cpu}"
           define:"nixbuild"
           WTF
 
diff --git a/pkgs/by-name/ni/nim-unwrapped-2_2/package.nix b/pkgs/by-name/ni/nim-unwrapped-2_2/package.nix
index 69a8926f5f7b..00b39f59eb0a 100644
--- a/pkgs/by-name/ni/nim-unwrapped-2_2/package.nix
+++ b/pkgs/by-name/ni/nim-unwrapped-2_2/package.nix
@@ -11,77 +11,6 @@
   sqlite,
   darwin,
 }:
-
-let
-  parseCpu =
-    platform:
-    with platform;
-    # Derive a Nim CPU identifier
-    if isAarch32 then
-      "arm"
-    else if isAarch64 then
-      "arm64"
-    else if isAlpha then
-      "alpha"
-    else if isAvr then
-      "avr"
-    else if isMips && is32bit then
-      "mips"
-    else if isMips && is64bit then
-      "mips64"
-    else if isMsp430 then
-      "msp430"
-    else if isPower && is32bit then
-      "powerpc"
-    else if isPower && is64bit then
-      "powerpc64"
-    else if isRiscV && is64bit then
-      "riscv64"
-    else if isSparc then
-      "sparc"
-    else if isx86_32 then
-      "i386"
-    else if isx86_64 then
-      "amd64"
-    else
-      throw "no Nim CPU support known for ${config}";
-
-  parseOs =
-    platform:
-    with platform;
-    # Derive a Nim OS identifier
-    if isAndroid then
-      "Android"
-    else if isDarwin then
-      "MacOSX"
-    else if isFreeBSD then
-      "FreeBSD"
-    else if isGenode then
-      "Genode"
-    else if isLinux then
-      "Linux"
-    else if isNetBSD then
-      "NetBSD"
-    else if isNone then
-      "Standalone"
-    else if isOpenBSD then
-      "OpenBSD"
-    else if isWindows then
-      "Windows"
-    else if isiOS then
-      "iOS"
-    else
-      throw "no Nim OS support known for ${config}";
-
-  parsePlatform = p: {
-    cpu = parseCpu p;
-    os = parseOs p;
-  };
-
-  nimHost = parsePlatform stdenv.hostPlatform;
-  nimTarget = parsePlatform stdenv.targetPlatform;
-in
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "nim-unwrapped";
   version = "2.2.4";
@@ -135,8 +64,8 @@ stdenv.mkDerivation (finalAttrs: {
     '';
 
   kochArgs = [
-    "--cpu:${nimHost.cpu}"
-    "--os:${nimHost.os}"
+    "--cpu:${stdenv.hostPlatform.nim.cpu}"
+    "--os:${stdenv.hostPlatform.nim.os}"
     "-d:release"
     "-d:useGnuReadline"
   ]
@@ -168,7 +97,8 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru = {
-    inherit nimHost nimTarget;
+    nimHost = lib.warn "nimHost is deprecated, please use stdenv.hostPlatform.nim.os instead." stdenv.hostPlatform.nim.os;
+    nimTarget = lib.warn "nimTarget is deprecated, please use stdenv.hostPlatform.nim.cpu instead." stdenv.hostPlatform.cpu;
   };
 
   meta = {
diff --git a/pkgs/by-name/no/nomacs/package.nix b/pkgs/by-name/no/nomacs/package.nix
index 8f662b138d75..143522dcb93b 100644
--- a/pkgs/by-name/no/nomacs/package.nix
+++ b/pkgs/by-name/no/nomacs/package.nix
@@ -13,8 +13,8 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "nomacs";
-  version = "3.22.0";
-  hash = "sha256-yheDM92AtojGXCx0UrK5gBvQgyGSxcsKPzl93HpHRt8=";
+  version = "3.22.1";
+  hash = "sha256-20ieFrIkoz4/T4QLK2PNdGPhw9Aj1+a9PimDvTKLqpg=";
 
   src = fetchFromGitHub {
     owner = "nomacs";
diff --git a/pkgs/by-name/nu/nuclei-templates/package.nix b/pkgs/by-name/nu/nuclei-templates/package.nix
index 77fd51e70f9e..14ff0131ee0a 100644
--- a/pkgs/by-name/nu/nuclei-templates/package.nix
+++ b/pkgs/by-name/nu/nuclei-templates/package.nix
@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "nuclei-templates";
-  version = "10.4.2";
+  version = "10.4.3";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "nuclei-templates";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wek6YwS9vhHefvIGfI6a4ErGhFPMTtbiIBIRnZMfnR0=";
+    hash = "sha256-Ke1F+rtLPNxMsSDVdv4MgbIETd2N5eBC5Svv7A2LAHM=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/nv/nvidia-mig-parted/package.nix b/pkgs/by-name/nv/nvidia-mig-parted/package.nix
index c6c27f49aa56..7757ddad5851 100644
--- a/pkgs/by-name/nv/nvidia-mig-parted/package.nix
+++ b/pkgs/by-name/nv/nvidia-mig-parted/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "nvidia-mig-parted";
-  version = "0.14.0";
+  version = "0.14.1";
 
   src = fetchFromGitHub {
     owner = "NVIDIA";
     repo = "mig-parted";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-b+/Rz1Lj+Ef7fIw4g2el8td982SGKXb0iPboP53XGKQ=";
+    hash = "sha256-05WbIEvHN/CAvd5ex4I8FZx0NreIg5QDOgXmAda/mzc=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ol/ollama/package.nix b/pkgs/by-name/ol/ollama/package.nix
index 52ccb92dd010..f8d770154a24 100644
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -141,13 +141,13 @@ let
 in
 goBuild (finalAttrs: {
   pname = "ollama";
-  version = "0.23.0";
+  version = "0.23.1";
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VYaFCSqhIlJPJv1SUiNDgSzLqySK3NTfucdWA7IZaAk=";
+    hash = "sha256-19rx+PNCpvRxhVr1+bgqsQIwpZzgdazlCoppxlDKzvE=";
   };
 
   vendorHash = "sha256-Lc1Ktdqtv2VhJQssk8K1UOimeEjVNvDWePE9WkamCos=";
diff --git a/pkgs/by-name/on/onedrivegui/package.nix b/pkgs/by-name/on/onedrivegui/package.nix
index 5fb289db7f84..38de95965ed4 100644
--- a/pkgs/by-name/on/onedrivegui/package.nix
+++ b/pkgs/by-name/on/onedrivegui/package.nix
@@ -13,7 +13,7 @@
 }:
 
 let
-  version = "1.3.0";
+  version = "1.3.1";
 
   setupPy = writeText "setup.py" ''
     from setuptools import setup
@@ -36,7 +36,7 @@ python3Packages.buildPythonApplication rec {
     owner = "bpozdena";
     repo = "OneDriveGUI";
     tag = "v${version}";
-    hash = "sha256-Y2+5f8/v4SPO6uUnjVTaHrHcGGPEhzm2WExJvmF9M1A=";
+    hash = "sha256-hqo3e9YjfPpR4hLRfqozxEFN0LnEcgigleROOZqY6WY=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index f49f4cea21e8..1c3d1a2b63ac 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -85,7 +85,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     nodejs
     installShellFiles
     makeBinaryWrapper
-    models-dev
     writableTmpDirAsHomeHook
   ];
 
diff --git a/pkgs/by-name/op/opengist/package.nix b/pkgs/by-name/op/opengist/package.nix
index d96f4f34f286..eb27ba77e7c6 100644
--- a/pkgs/by-name/op/opengist/package.nix
+++ b/pkgs/by-name/op/opengist/package.nix
@@ -13,13 +13,13 @@
 buildGoModule (finalAttrs: {
   pname = "opengist";
 
-  version = "1.12.1";
+  version = "1.12.2";
 
   src = fetchFromGitHub {
     owner = "thomiceli";
     repo = "opengist";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vjNrcT4IaCB+QRvvPo0oeLtFgmYXk5DDs5gYvzk4ddo=";
+    hash = "sha256-MZ7aKT4qmWH4NyT32ZUpBmqqLJYCtLpdlSJHh+h7IPI=";
   };
 
   frontend = buildNpmPackage {
@@ -36,10 +36,10 @@ buildGoModule (finalAttrs: {
       cp -R public $out
     '';
 
-    npmDepsHash = "sha256-wjGtA99Cn9FtUbYqhoagDzeuQkc9vKwHsJKI2j+ZgMc=";
+    npmDepsHash = "sha256-KDdXBE5X+fOuXF/hIkyRHscMmBQ/E0PCUednfEm5i8k=";
   };
 
-  vendorHash = "sha256-rRT4SDKtQhLWl1K+DodXO4BBK2SEeJzUph3su306GWU=";
+  vendorHash = "sha256-lhDga5shastI7BfnEnekFnUc2L8Ju6LazeqvD7+CK/o=";
 
   tags = [ "fs_embed" ];
 
diff --git a/pkgs/by-name/ow/owntone/package.nix b/pkgs/by-name/ow/owntone/package.nix
index 49a4df588b4a..4791f08854fd 100644
--- a/pkgs/by-name/ow/owntone/package.nix
+++ b/pkgs/by-name/ow/owntone/package.nix
@@ -37,14 +37,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "29.0";
+  version = "29.2";
   pname = "owntone";
 
   src = fetchFromGitHub {
     owner = "owntone";
     repo = "owntone-server";
     tag = finalAttrs.version;
-    hash = "sha256-Z9u5clC6m5gDAKkvyvrQs9muNK/P0ipHgQUmTHLRumE=";
+    hash = "sha256-cCbCShIgopm3HhNVyvr6Q8fe8LkxwNE/51/0qkS27WE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pa/parted/package.nix b/pkgs/by-name/pa/parted/package.nix
index 97c63b66c930..9521843fd95b 100644
--- a/pkgs/by-name/pa/parted/package.nix
+++ b/pkgs/by-name/pa/parted/package.nix
@@ -38,23 +38,18 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     libuuid
-  ]
-  ++ lib.optional (readline != null) readline
-  ++ lib.optional (gettext != null) gettext
-  ++ lib.optional (lvm2 != null) lvm2;
+    readline
+    gettext
+    lvm2
+  ];
 
   nativeBuildInputs = [
     pkg-config
   ];
-  configureFlags =
-    (if (readline != null) then [ "--with-readline" ] else [ "--without-readline" ])
-    ++ lib.optional (lvm2 == null) "--disable-device-mapper"
-    ++ lib.optional enableStatic "--enable-static";
+  configureFlags = lib.optional enableStatic "--enable-static";
 
   enableParallelBuilding = true;
 
-  # Tests were previously failing due to Hydra running builds as uid 0.
-  # That should hopefully be fixed now.
   doCheck = !stdenv.hostPlatform.isMusl; # translation test
   nativeCheckInputs = [
     check
diff --git a/pkgs/by-name/ph/phrase-cli/package.nix b/pkgs/by-name/ph/phrase-cli/package.nix
index b438ee9e49bb..7632f2dc7e96 100644
--- a/pkgs/by-name/ph/phrase-cli/package.nix
+++ b/pkgs/by-name/ph/phrase-cli/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "phrase-cli";
-  version = "2.61.0";
+  version = "2.62.0";
 
   src = fetchFromGitHub {
     owner = "phrase";
     repo = "phrase-cli";
     rev = finalAttrs.version;
-    sha256 = "sha256-VSkogD90hLgKw/3xXzfs4TktmoLf/RtfaJxEjk/uFsQ=";
+    sha256 = "sha256-p8ixUGMA1S5TcFDocQ+mm35On+ZUUQRO8OZeXfzox20=";
   };
 
-  vendorHash = "sha256-w3XJUE1iM+yi4cMqMTUDhiafV5v42v4zBJzckv3Fd70=";
+  vendorHash = "sha256-O16CdRqj3NevIunBfgIMJOkW1avE2wyeN1kJG6Wehco=";
 
   ldflags = [ "-X=github.com/phrase/phrase-cli/cmd.PHRASE_CLIENT_VERSION=${finalAttrs.version}" ];
 
diff --git a/pkgs/by-name/pi/pi-coding-agent/package.nix b/pkgs/by-name/pi/pi-coding-agent/package.nix
index 396540029231..e61574f72bc7 100644
--- a/pkgs/by-name/pi/pi-coding-agent/package.nix
+++ b/pkgs/by-name/pi/pi-coding-agent/package.nix
@@ -10,16 +10,16 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "pi-coding-agent";
-  version = "0.70.5";
+  version = "0.73.0";
 
   src = fetchFromGitHub {
     owner = "badlogic";
     repo = "pi-mono";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Jn+hvS/DIwbwAff+UovdIVnmrb4o8gsC4IR24MnwF1I=";
+    hash = "sha256-oE4zMH5KEH185Vdp0CE221sa9rJJw35jFLlfhTa3Sg4=";
   };
 
-  npmDepsHash = "sha256-MZgcHJdGFGSNgQ26/24iA12FdmO7S5vWv4crSNFhHi0=";
+  npmDepsHash = "sha256-rBlAzAnP9aif1tZ984AO4HftIJsDgLQ+02J3td4jcRg=";
 
   npmWorkspace = "packages/coding-agent";
 
diff --git a/pkgs/by-name/pi/piglit/package.nix b/pkgs/by-name/pi/piglit/package.nix
index a761cf3c950a..b9b4c0bfdb3d 100644
--- a/pkgs/by-name/pi/piglit/package.nix
+++ b/pkgs/by-name/pi/piglit/package.nix
@@ -29,14 +29,14 @@
 
 stdenv.mkDerivation {
   pname = "piglit";
-  version = "unstable-2025-04-15";
+  version = "unstable-2026-05-04";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "mesa";
     repo = "piglit";
-    rev = "d06f7bac988e67db53cbc05dc0b096b00856ab93";
-    hash = "sha256-bH9NjLEldlZwylq7S0q2vC5IQhUej0xZ6wD+mrWBK5A=";
+    rev = "1bb2910c3fced64396feddd205e356d80e5ff7d9";
+    hash = "sha256-/3OQeZiK7fHfPpSlFtbW7DLEFV3YFBL1cLMndXyxwYs=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/pl/pleroma/package.nix b/pkgs/by-name/pl/pleroma/package.nix
index 4c99d73b22f7..ffe434bf14f9 100644
--- a/pkgs/by-name/pl/pleroma/package.nix
+++ b/pkgs/by-name/pl/pleroma/package.nix
@@ -232,7 +232,6 @@ beamPackages.mixRelease rec {
     maintainers = with lib.maintainers; [
       picnoir
       kloenk
-      yayayayaka
     ];
     platforms = lib.platforms.unix;
   };
diff --git a/pkgs/by-name/po/pomerium/0001-envoy-allow-specification-of-external-binary.patch b/pkgs/by-name/po/pomerium/0001-envoy-allow-specification-of-external-binary.patch
deleted file mode 100644
index 8356cdc583a2..000000000000
--- a/pkgs/by-name/po/pomerium/0001-envoy-allow-specification-of-external-binary.patch
+++ /dev/null
@@ -1,61 +0,0 @@
-From 640d11fae5bcf1fa8c1a54facbe168a256cacc1b Mon Sep 17 00:00:00 2001
-From: Morgan Helton <mhelton@gmail.com>
-Date: Sun, 26 May 2024 12:17:01 -0500
-Subject: [PATCH] envoy: allow specification of external binary
-
----
- pkg/envoy/envoy.go | 17 +++++++++++++----
- 1 file changed, 13 insertions(+), 4 deletions(-)
-
-diff --git a/pkg/envoy/envoy.go b/pkg/envoy/envoy.go
-index 85c725629..4a726a44b 100644
---- a/pkg/envoy/envoy.go
-+++ b/pkg/envoy/envoy.go
-@@ -8,10 +8,10 @@ import (
- 	"errors"
- 	"fmt"
- 	"io"
-+	"io/fs"
- 	"net"
- 	"net/http"
- 	"net/url"
- 	"os"
- 	"os/exec"
--	"path"
- 	"path/filepath"
-@@ -44,6 +44,11 @@ const (
- 	configFileName = "envoy-config.yaml"
- )
-
-+var OverrideEnvoyPath = ""
-+
-+const workingDirectoryName = ".pomerium-envoy"
-+const embeddedEnvoyPermissions fs.FileMode = 0o700
-+
- // A Server is a pomerium proxy implemented via envoy.
- type Server struct {
- 	ServerOptions
-@@ -100,14 +105,17 @@ func NewServer(
- 		log.Ctx(ctx).Debug().Err(err).Msg("couldn't preserve RLIMIT_NOFILE before starting Envoy")
- 	}
-
--	envoyPath, err := Extract()
-+	envoyPath := OverrideEnvoyPath
-+	wd := filepath.Join(os.TempDir(), workingDirectoryName)
-+
-+	err := os.MkdirAll(wd, embeddedEnvoyPermissions)
- 	if err != nil {
--		return nil, fmt.Errorf("extracting envoy: %w", err)
-+		return nil, fmt.Errorf("error creating temporary working directory for envoy: %w", err)
- 	}
-
- 	srv := &Server{
- 		ServerOptions:        options,
--		wd:                   path.Dir(envoyPath),
-+		wd:                   wd,
- 		builder:              builder,
- 		grpcPort:             src.GetConfig().GRPCPort,
- 		httpPort:             src.GetConfig().HTTPPort,
---
-2.49.0
-
diff --git a/pkgs/by-name/po/pomerium/package.nix b/pkgs/by-name/po/pomerium/package.nix
index dc67aa519332..a93e9924255a 100644
--- a/pkgs/by-name/po/pomerium/package.nix
+++ b/pkgs/by-name/po/pomerium/package.nix
@@ -1,9 +1,9 @@
 {
   buildGoModule,
   buildNpmPackage,
+  runCommand,
   fetchFromGitHub,
   lib,
-  envoy,
   nixosTests,
   pomerium-cli,
 }:
@@ -15,9 +15,7 @@ let
     id
     mapAttrsToList
     ;
-in
-buildGoModule rec {
-  pname = "pomerium";
+
   version = "0.32.6";
   src = fetchFromGitHub {
     owner = "pomerium";
@@ -25,13 +23,50 @@ buildGoModule rec {
     rev = "v${version}";
     hash = "sha256-VwmjuXlYsh2dGKf7ux8DyLZec7xMISuQ7SSb9+LwzfU=";
   };
-
   vendorHash = "sha256-b4H7gAMG7DXEbvkZFsoEZrKpuvPW0vkfv1qqBPBaGAM=";
 
+  getEnvoy = buildGoModule {
+    pname = "pomerium-get-envoy";
+    inherit src version vendorHash;
+
+    subPackages = [
+      "pkg/envoy/get-envoy"
+    ];
+
+    # get-envoy's envoy version is pinned via pkg/envoy/envoyversion, which
+    # relies on a specific version of github.com/pomerium/envoy-custom as a Go module,
+    # and then fetches that version's release binaries from GHCR.
+  };
+in
+buildGoModule (finalAttrs: {
+  pname = "pomerium";
+  inherit src version vendorHash;
+
+  envoyBinaries =
+    runCommand "pomerium-envoy-binaries"
+      {
+        nativeBuildInputs = [ getEnvoy ];
+
+        outputHashAlgo = "sha256";
+        outputHashMode = "recursive";
+        outputHash = "sha256-i2DuOx+fSCwTKavf6zvuRd1AKbk4igrzy2AXinDkyrI=";
+
+        meta = {
+          homepage = "https://github.com/pomerium/envoy-custom";
+          sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+        };
+      }
+      ''
+        mkdir $out
+        cd $out
+        get-envoy
+        chmod +x envoy-darwin-amd64 envoy-darwin-arm64 envoy-linux-amd64 envoy-linux-arm64
+      '';
+
   ui = buildNpmPackage {
     pname = "pomerium-ui";
-    inherit version;
-    src = "${src}/ui";
+    inherit (finalAttrs) version;
+    src = "${finalAttrs.src}/ui";
 
     npmDepsHash = "sha256-2fzINp3LBPHPJlzJnUggPWUZHrjuX9TYPD2XvioonSw=";
 
@@ -46,24 +81,16 @@ buildGoModule rec {
     "cmd/pomerium"
   ];
 
-  # patch pomerium to allow use of external envoy
-  patches = [
-    ./0001-envoy-allow-specification-of-external-binary.patch
-  ];
-
   ldflags =
     let
       # Set a variety of useful meta variables for stamping the build with.
       setVars = {
         "github.com/pomerium/pomerium/internal/version" = {
-          Version = "v${version}";
+          Version = "v${finalAttrs.version}";
           BuildMeta = "nixpkgs";
           ProjectName = "pomerium";
           ProjectURL = "github.com/pomerium/pomerium";
         };
-        "github.com/pomerium/pomerium/pkg/envoy" = {
-          OverrideEnvoyPath = "${envoy}/bin/envoy";
-        };
       };
       concatStringsSpace = list: concatStringsSep " " list;
       mapAttrsToFlatList = fn: list: concatMap id (mapAttrsToList fn list);
@@ -79,28 +106,11 @@ buildGoModule rec {
     ];
 
   preBuild = ''
-    # Replace embedded envoy with nothing.
-    # We set OverrideEnvoyPath above, so rawBinary should never get looked at
-    # but we still need to set a checksum/version.
-    rm pkg/envoy/files/files_{darwin,linux}*.go
-    cat <<EOF >pkg/envoy/files/files_external.go
-    package files
-
-    import _ "embed" // embed
-
-    var rawBinary []byte
-
-    //go:embed envoy.sha256
-    var rawChecksum string
-
-    //go:embed envoy.version
-    var rawVersion string
-    EOF
-    sha256sum '${envoy}/bin/envoy' > pkg/envoy/files/envoy.sha256
-    echo '${envoy.version}' > pkg/envoy/files/envoy.version
+    # Insert embedded envoy.
+    cp -r ${finalAttrs.envoyBinaries}/* pkg/envoy/files
 
     # put the built UI files where they will be picked up as part of binary build
-    cp -r ${ui}/* ui/dist
+    cp -r ${finalAttrs.ui}/* ui/dist
   '';
 
   installPhase = ''
@@ -129,4 +139,4 @@ buildGoModule rec {
       "aarch64-linux"
     ];
   };
-}
+})
diff --git a/pkgs/by-name/pr/privatebin/package.nix b/pkgs/by-name/pr/privatebin/package.nix
index 942d2d42e7e3..58086830458d 100644
--- a/pkgs/by-name/pr/privatebin/package.nix
+++ b/pkgs/by-name/pr/privatebin/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "privatebin";
-  version = "2.0.3";
+  version = "2.0.4";
 
   src = fetchFromGitHub {
     owner = "PrivateBin";
     repo = "PrivateBin";
     tag = finalAttrs.version;
-    hash = "sha256-23NzowQCuvJHenWmFGgIXFMP6oZoTLf0AZA7+uDQs5E=";
+    hash = "sha256-OyTEi1D+B33e0Dqr/l/uTBcPTlC7AAqc2atnClYhyGo=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/pu/pulumi-bin/data.nix b/pkgs/by-name/pu/pulumi-bin/data.nix
index fbadd8775f0d..377f4bad6075 100644
--- a/pkgs/by-name/pu/pulumi-bin/data.nix
+++ b/pkgs/by-name/pu/pulumi-bin/data.nix
@@ -1,12 +1,12 @@
 # DO NOT EDIT! This file is generated automatically by update.sh
 { }:
 {
-  version = "3.234.0";
+  version = "3.235.0";
   pulumiPkgs = {
     x86_64-linux = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.234.0-linux-x64.tar.gz";
-        sha256 = "10gzaiz1200fpm1jsha92pc03v8zjkjkiwckdybq7cryrdr7wy35";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.235.0-linux-x64.tar.gz";
+        sha256 = "01z8gy049da2h3iwqn2pcmd04q93smbjypmlka5zfcai4vwd5hv9";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.53.1-linux-amd64.tar.gz";
@@ -21,8 +21,8 @@
         sha256 = "1bk4wswywss8i5isjrrlpnrkdplpp45sqq1yvdc0jwgzay36n8zl";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v8.10.4-linux-amd64.tar.gz";
-        sha256 = "1j80sayzic63ahyv2x9k7kpisi7rvjml7cid1xzzcac8z7s2nhxq";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v8.10.5-linux-amd64.tar.gz";
+        sha256 = "1bdxzgqjvnyf6bi8i0c4zi5qmlb24ck8qhw9chvfigrqqi655221";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v3.41.0-linux-amd64.tar.gz";
@@ -97,8 +97,8 @@
         sha256 = "0yqbn1niyy2a4gq87r4wk75v3p114xf099gxqgyq39c079bdwlns";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v5.10.0-linux-amd64.tar.gz";
-        sha256 = "082qaqpjl0m3ng30nmvmwibn9yfrbh47kpyx9jdzmwg0k3d60sam";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v5.11.0-linux-amd64.tar.gz";
+        sha256 = "12jr7p6c6xzmywcp39ag0ymladxc83v3sp5j38j82m6qx7fg25c2";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mailgun-v3.7.1-linux-amd64.tar.gz";
@@ -163,8 +163,8 @@
     ];
     x86_64-darwin = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.234.0-darwin-x64.tar.gz";
-        sha256 = "1vn74fm1bbgs8h726l0ma3ljsp4lzjim3h7vnnqa8608vqyvjl3y";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.235.0-darwin-x64.tar.gz";
+        sha256 = "0n5z5crkz1h9xpiic1kvs6418pk9f636x41hncka8ll4h73hk986";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.53.1-darwin-amd64.tar.gz";
@@ -179,8 +179,8 @@
         sha256 = "1rhbpxi9g3pb11cj2yinil8iwsl2zb3ndz3h21grf94ss8h4395h";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v8.10.4-darwin-amd64.tar.gz";
-        sha256 = "142ydaywi8xw3k8w2c2py0x88sxf55v9z26yjkjhn2izcr9yv3fg";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v8.10.5-darwin-amd64.tar.gz";
+        sha256 = "0l4i7h58q23rjhgdam205xx9682j4vqy8v8mh73x9hmi93hnj6kc";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v3.41.0-darwin-amd64.tar.gz";
@@ -255,8 +255,8 @@
         sha256 = "0f313ir5kjv8fqyyrp4k12d3nd5cy4jibjym2p5v88drjn3w1g19";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v5.10.0-darwin-amd64.tar.gz";
-        sha256 = "1v17x7mzx2nas9zfbqkz9h49n8j52gw7cz6hci5rzrxxj98fnsh0";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v5.11.0-darwin-amd64.tar.gz";
+        sha256 = "0k8d5gpqbij61ykish5nkpkpky5y5v7m75vn2bv6ddr1kzgp32m7";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mailgun-v3.7.1-darwin-amd64.tar.gz";
@@ -321,8 +321,8 @@
     ];
     aarch64-linux = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.234.0-linux-arm64.tar.gz";
-        sha256 = "1qdwmzy1v3msnhyb97xfnj56vl7mnarc2dmbrvp94lpl79mdah58";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.235.0-linux-arm64.tar.gz";
+        sha256 = "177qpi8c1dagl1sv66h28vsp0rnk92c58hy4hlvlkkssj6i0d3wi";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.53.1-linux-arm64.tar.gz";
@@ -337,8 +337,8 @@
         sha256 = "0dg2brhn72i5wd7nfqs6dhl99fcpfkdr4nd98ll8k12x4g2qjfim";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v8.10.4-linux-arm64.tar.gz";
-        sha256 = "0xfa9p3dhnmlq5vpdwgsb73mcp8ckkw17pkgjmlsb54nfayj687d";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v8.10.5-linux-arm64.tar.gz";
+        sha256 = "1w0asfdg8dih7v77mmva0kywmyc607l7p3jy7251qcqk2in0fhn4";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v3.41.0-linux-arm64.tar.gz";
@@ -413,8 +413,8 @@
         sha256 = "1ax41ricywlhy1nxjl1gybv9xkfw6ifz1xwlzcps7xdw8bcnrcj0";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v5.10.0-linux-arm64.tar.gz";
-        sha256 = "0i43jyxz8g138iky5ik5wmm8zaijx469ck185wiswihcaw6m7wf0";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v5.11.0-linux-arm64.tar.gz";
+        sha256 = "0zglli3pbn895i6dp6pfc8j8lmp3ns2kn5vpscrh5hmcxa00lf9r";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mailgun-v3.7.1-linux-arm64.tar.gz";
@@ -479,8 +479,8 @@
     ];
     aarch64-darwin = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.234.0-darwin-arm64.tar.gz";
-        sha256 = "1v7sbyjyyz69hdwqf0h1sfg2g551ys5aqgc970ns06vc70pkjgq0";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.235.0-darwin-arm64.tar.gz";
+        sha256 = "03wha0231261iwngj2wrvzh72r4dp8l27xhn32b71hwgykgfayg6";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.53.1-darwin-arm64.tar.gz";
@@ -495,8 +495,8 @@
         sha256 = "1crcyyilsj4zsba7mwhqzirikp0ff8x6r3mw4sbm2czi9bba1mv9";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v8.10.4-darwin-arm64.tar.gz";
-        sha256 = "14dwhd8d6683babl6399yqn6dwihxmjs7fa2p40d071ibmpsx307";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v8.10.5-darwin-arm64.tar.gz";
+        sha256 = "1zm352c89rnf78n9xq4pffq1rsd3rddc7v6xi8md41x9vhnpsp6j";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v3.41.0-darwin-arm64.tar.gz";
@@ -571,8 +571,8 @@
         sha256 = "0n8my65zbia3kyhcfrzi7119kggkzldmcljhw3i3zh9839a52p7a";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v5.10.0-darwin-arm64.tar.gz";
-        sha256 = "04m3xcxm19kianxmpf9hdw5ay6mkfg251qln8albfzslhlikx054";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v5.11.0-darwin-arm64.tar.gz";
+        sha256 = "0samqsxs2calvxanf7jljdlk3fimjshwd4w87nzi5amw8grm76l9";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mailgun-v3.7.1-darwin-arm64.tar.gz";
diff --git a/pkgs/by-name/qo/qovery-cli/package.nix b/pkgs/by-name/qo/qovery-cli/package.nix
index 70896bacfbf8..6cc7612e53ef 100644
--- a/pkgs/by-name/qo/qovery-cli/package.nix
+++ b/pkgs/by-name/qo/qovery-cli/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "qovery-cli";
-  version = "1.158.0";
+  version = "1.158.1";
 
   src = fetchFromGitHub {
     owner = "Qovery";
     repo = "qovery-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-b6nvJPLMvqXM+hYJzOG65G15N+ErJnWySQrjJQmsMe8=";
+    hash = "sha256-49xy6lH/diMpE8ZY7vuHevLuVL/hTukBSQjkHpPGbd4=";
   };
 
   vendorHash = "sha256-kENqEnk5RxN8kJ/dnXtG6ypnb8CPcOsHKid1z6uuKAc=";
diff --git a/pkgs/by-name/qu/quakespasm/package.nix b/pkgs/by-name/qu/quakespasm/package.nix
index d76476cce0e1..81251881f2ed 100644
--- a/pkgs/by-name/qu/quakespasm/package.nix
+++ b/pkgs/by-name/qu/quakespasm/package.nix
@@ -128,5 +128,9 @@ stdenv.mkDerivation (finalAttrs: {
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ mikroskeem ];
     mainProgram = "quake";
+    license = lib.licenses.AND [
+      lib.licenses.gpl2Only
+      lib.licenses.cc-by-30
+    ];
   };
 })
diff --git a/pkgs/by-name/qw/qwen-code/package.nix b/pkgs/by-name/qw/qwen-code/package.nix
index 37e3baeaa9f9..535eac203372 100644
--- a/pkgs/by-name/qw/qwen-code/package.nix
+++ b/pkgs/by-name/qw/qwen-code/package.nix
@@ -14,17 +14,17 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "qwen-code";
-  version = "0.14.5";
+  version = "0.15.6";
 
   src = fetchFromGitHub {
     owner = "QwenLM";
     repo = "qwen-code";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2d+PaHaUdCEYjYkAG33DxX3rMbVpL/CcngczFeOvy8M=";
+    hash = "sha256-AMp4a1pInYppJmrUP1eg7Vhcca+amA1CK5izdvYrXOE=";
   };
 
   npmDepsFetcherVersion = 3;
-  npmDepsHash = "sha256-7o3ap0+eyCxga18V4qoG+a6b2EM45MkMLjXdY8J/eGg=";
+  npmDepsHash = "sha256-n7QcJjoW2r77qCW6A3qLmsWEJSHKGv+SalNBRzTcz+E=";
 
   # npm 11 incompatible with fetchNpmDeps
   # https://github.com/NixOS/nixpkgs/issues/474535
diff --git a/pkgs/by-name/re/reaction/package.nix b/pkgs/by-name/re/reaction/package.nix
index b8a693d4349a..34e810b5693a 100644
--- a/pkgs/by-name/re/reaction/package.nix
+++ b/pkgs/by-name/re/reaction/package.nix
@@ -13,22 +13,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "reaction";
-  version = "2.3.0";
+  version = "2.3.1-11";
 
   src = fetchFromGitLab {
     domain = "framagit.org";
     owner = "ppom";
     repo = "reaction";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-OvNJsR9W5MlicqUpr1aOLJ7pI7H7guq1vAlC/hh1Q2o=";
+    rev = "c0868d6fe1d155de183a89729b5f3f0ede7be4a2";
+    hash = "sha256-QlSXZ2Wk1OXzAY2x6YjtW+xNchY+Ghb/6AsJgjfgoFE=";
   };
 
-  patches = [
-    # remove patch in next tagged version
-    ./add-support-for-macos.patch
-  ];
-
-  cargoHash = "sha256-BOFZlVBKf6fjW1L1J8u7Vf+fzNJHlEtQI6YafDjlZ4U=";
+  cargoHash = "sha256-FYd7I93MAAzD6y0VMd9kMU7DAgS6v5CKt2KjrskaKeo=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/re/reaction/plugins/reaction-plugin-nftables.nix b/pkgs/by-name/re/reaction/plugins/reaction-plugin-nftables.nix
new file mode 100644
index 000000000000..5fb7abb92d33
--- /dev/null
+++ b/pkgs/by-name/re/reaction/plugins/reaction-plugin-nftables.nix
@@ -0,0 +1,14 @@
+{
+  nftables,
+  pkg-config,
+  rustPlatform,
+  reaction,
+  ...
+}:
+reaction.mkReactionPlugin "reaction-plugin-nftables" {
+  buildInputs = [ nftables ];
+  nativeBuildInputs = [
+    rustPlatform.bindgenHook
+    pkg-config
+  ];
+}
diff --git a/pkgs/by-name/re/recyclarr/deps.json b/pkgs/by-name/re/recyclarr/deps.json
index 4bbb030e2d69..660bd6c13477 100644
--- a/pkgs/by-name/re/recyclarr/deps.json
+++ b/pkgs/by-name/re/recyclarr/deps.json
@@ -11,13 +11,13 @@
   },
   {
     "pname": "Autofac",
-    "version": "9.0.0",
-    "hash": "sha256-9H9NGKwigUQ0x2pbCM3cgJXJsbZVzY7BvQRfa5sSi5g="
+    "version": "9.1.0",
+    "hash": "sha256-TygJLo8rvWC/KCExg+Hy3eYc0sP+AdhpdlU6fOj11f0="
   },
   {
     "pname": "Autofac.Extensions.DependencyInjection",
-    "version": "10.0.0",
-    "hash": "sha256-ACQwFG8a5LMoqGyHI/YpwVyXZQYqM5+wnk0q2BbGVZ4="
+    "version": "11.0.0",
+    "hash": "sha256-GjvG67HWkyam/GWtdU4Wh3pXY1cJ1i3loPVG9lga7vk="
   },
   {
     "pname": "Autofac.Extras.AggregateService",
@@ -76,13 +76,13 @@
   },
   {
     "pname": "CliWrap",
-    "version": "3.10.0",
-    "hash": "sha256-XMGTr0gkZxSOC72hrCjpIChpN0c0A19X3TqOAdBtgb4="
+    "version": "3.10.1",
+    "hash": "sha256-uH4SXiMkUIPw5RRyKtDTTCSkkr3BhBAPrxnC4O4ES4c="
   },
   {
     "pname": "coverlet.collector",
-    "version": "8.0.0",
-    "hash": "sha256-Gwqyodb0UVbrnV5GlEiTyKYSDqhRHjN9/UZBwkh4vnM="
+    "version": "10.0.0",
+    "hash": "sha256-0cU5wHZfwQFJFXugC19kiRo9XU1jV4ApbDKuRaL72Vc="
   },
   {
     "pname": "Docker.DotNet.Enhanced",
@@ -106,8 +106,8 @@
   },
   {
     "pname": "GitVersion.MsBuild",
-    "version": "6.6.0",
-    "hash": "sha256-LCaB96Y73kAb36XHXZFYeMRtVOpEZ3Q/OWon9hHgr4k="
+    "version": "6.7.0",
+    "hash": "sha256-yUiPTONPgRdES6Bt6VYdGSj9exT6744Za7QeF4v0jW8="
   },
   {
     "pname": "JetBrains.Annotations",
@@ -121,68 +121,73 @@
   },
   {
     "pname": "Microsoft.CodeCoverage",
-    "version": "18.3.0",
-    "hash": "sha256-fqKglbYvEb/77+rmUvLyLZSwROM1P9OW03Ub307WYZ8="
+    "version": "18.4.0",
+    "hash": "sha256-px8qchiuY5rkujAZ1wGEjuuhZdZmsRSp+FCiTmRUA1A="
   },
   {
     "pname": "Microsoft.Extensions.Configuration",
-    "version": "10.0.5",
-    "hash": "sha256-6rOmJD7Jzq5MPLDd1aV+7gCQwIM9j4c+iT1pGea/daI="
+    "version": "10.0.6",
+    "hash": "sha256-CSd5RC5pMsmglpnE6Vm3JabMnbmziqtUGrZE5Rg7uF4="
   },
   {
     "pname": "Microsoft.Extensions.Configuration.Abstractions",
-    "version": "10.0.5",
-    "hash": "sha256-DNK+lL2jeHFYyd43zfgVY32UskEfQ4YsTapztuQbYwo="
+    "version": "10.0.6",
+    "hash": "sha256-jxtne26QF7bASCRmLNwYsKruY3QhsnuzN9Us11WUdSQ="
   },
   {
     "pname": "Microsoft.Extensions.Configuration.Binder",
-    "version": "10.0.5",
-    "hash": "sha256-cVG2NEW1rgLfeq/Gnh/XXqzDx2Tt8ecvgCAB4uFzcQo="
+    "version": "10.0.6",
+    "hash": "sha256-34blBlrQ3FRS7iCS7/gxPZMa9xgDW0p3iEERqwgXFMA="
   },
   {
     "pname": "Microsoft.Extensions.DependencyInjection",
-    "version": "10.0.5",
-    "hash": "sha256-ofDRirUV9XLSz4oksCqErwBJFtAieHACFfyZukHKFng="
+    "version": "10.0.6",
+    "hash": "sha256-K3ODZC+Bwd3Tze5wF7BQvJJGlNObdf2PNA35F41jHTE="
   },
   {
     "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
-    "version": "10.0.5",
-    "hash": "sha256-KrP+hE3gk7pATbJYZsJ1LHiXjzLA+ntHW7G/VGgHk2g="
+    "version": "10.0.4",
+    "hash": "sha256-0QhVYjk9Cxy6NFef9VKftGmscTZnvcD1bhBQoXz3mwA="
   },
   {
     "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
-    "version": "8.0.1",
-    "hash": "sha256-lzTYLpRDAi3wW9uRrkTNJtMmaYdtGJJHdBLbUKu60PM="
+    "version": "10.0.6",
+    "hash": "sha256-lFiZb81kfBJK7J0b0A2UIpydPRT73Xcs57Gzf/+1xXc="
   },
   {
     "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
     "version": "8.0.2",
     "hash": "sha256-UfLfEQAkXxDaVPC7foE/J3FVEXd31Pu6uQIhTic3JgY="
   },
+  {
+    "pname": "Microsoft.Extensions.DependencyModel",
+    "version": "8.0.2",
+    "hash": "sha256-PyuO/MyCR9JtYqpA1l/nXGh+WLKCq34QuAXN9qNza9Q="
+  },
   {
     "pname": "Microsoft.Extensions.Diagnostics",
-    "version": "10.0.5",
-    "hash": "sha256-LlFT3ZzFH9QfymvP9DY4NteJKTdT+mqSGpzUDpsLNhM="
+    "version": "10.0.6",
+    "hash": "sha256-TGJjvsztoajNzOe0KeuOvtb2ZuNDbjq2NfPs15zo3kA="
   },
   {
     "pname": "Microsoft.Extensions.Diagnostics.Abstractions",
-    "version": "10.0.5",
-    "hash": "sha256-pwQltVfaqx0jRpO0d9k/dYtyOpnGixK2MB3aHVVbo0E="
+    "version": "10.0.6",
+    "hash": "sha256-9AbUvHuHhDPjtf6vsci2r6VfSg0BlmkJkMYmIqAQ2QA="
   },
   {
     "pname": "Microsoft.Extensions.Http",
-    "version": "10.0.5",
-    "hash": "sha256-72/sp94yZdM9dX870eibFuUc4Tvyp0tgc4/SanMAqDw="
+    "version": "10.0.6",
+    "hash": "sha256-3REMteQjA7j5LDJ7wDnlWkJlVHHXx0+dgbiVlZQAi/c="
   },
   {
     "pname": "Microsoft.Extensions.Logging",
-    "version": "10.0.5",
-    "hash": "sha256-4gVrKZfo/YHZKgKNsgGZZYqa79XWK9wDUuiVfguUV6U="
+    "version": "10.0.6",
+    "hash": "sha256-tskLj/WXLK35gkuJAWaAhPjMW92N1JKOTzTLupR30pE="
   },
   {
     "pname": "Microsoft.Extensions.Logging.Abstractions",
-    "version": "10.0.5",
-    "hash": "sha256-e3A/l+II+n+D7/OPwjdyQM1IBtKHfHeIdlkJmuRw77w="
+    "version": "10.0.6",
+    "hash": "sha256-4ijpXt4PoTNcmF5dl/rEZkRWBAjukB229lXtBtJhxn4="
   },
   {
     "pname": "Microsoft.Extensions.Logging.Abstractions",
@@ -191,23 +196,23 @@
   },
   {
     "pname": "Microsoft.Extensions.Options",
-    "version": "10.0.5",
-    "hash": "sha256-nw+m6VWXjmaBqZ1aH/l9SR9Oy62N9dmiMKloJ78kxv8="
+    "version": "10.0.6",
+    "hash": "sha256-GJCULaUcN2FxCA9fKOLe5EDEtkKLrEuP2Kw0jRqospA="
   },
   {
     "pname": "Microsoft.Extensions.Options.ConfigurationExtensions",
-    "version": "10.0.5",
-    "hash": "sha256-VQPPvrvYWY/QpmilerCyTNLVejWeBE9mHtGTMOxXUlg="
+    "version": "10.0.6",
+    "hash": "sha256-T0HNAYrIsm1xzfBD1qLqziI5qwSsGXGmXSDdOgpC5s0="
   },
   {
     "pname": "Microsoft.Extensions.Primitives",
-    "version": "10.0.5",
-    "hash": "sha256-uvrur+0dg4zAAQcpLkkhPA77ST0tA3+EpGdDlCckC+E="
+    "version": "10.0.6",
+    "hash": "sha256-/iSFDryQIl8rl+TtrzunT5LcbPsQCeC2V+9CnS1P4Cc="
   },
   {
     "pname": "Microsoft.NET.Test.Sdk",
-    "version": "18.3.0",
-    "hash": "sha256-o2bILLF5i+XUoi8xZYgolU3CxLTdql5R/tEVWVnKFPU="
+    "version": "18.4.0",
+    "hash": "sha256-ak/emX4C4KQVzc0bSNK4bChS+dvb3FvxZbJNrmf/2+w="
   },
   {
     "pname": "Microsoft.NETCore.Platforms",
@@ -216,33 +221,28 @@
   },
   {
     "pname": "Microsoft.Testing.Extensions.Telemetry",
-    "version": "2.0.2",
-    "hash": "sha256-8f23W3125L2ZAExRVwvXSft3a93k+pSb/0CZV0HlFi4="
+    "version": "2.1.0",
+    "hash": "sha256-SawLiz1fB3QbkkyEVloEj8UpQTAIZR7U9FZfqwCkGr0="
   },
   {
     "pname": "Microsoft.Testing.Extensions.TrxReport.Abstractions",
-    "version": "2.0.2",
-    "hash": "sha256-ePhFIkoWZVt79Tkhu62MxYyIheFMBhf1NUbIimZIZ9c="
+    "version": "2.1.0",
+    "hash": "sha256-X54qc4Ey+3hm0e5eCY1R2me8b4zGrWzjesm9fGJWXys="
   },
   {
     "pname": "Microsoft.Testing.Extensions.VSTestBridge",
-    "version": "2.0.2",
-    "hash": "sha256-odn6fZO7yaPs3EaEUr12GraVH5anp0r/BabJpJl8q/c="
+    "version": "2.1.0",
+    "hash": "sha256-2m14uEmuEELn4Ci/CZNpKjhlnzq9vYvhgeiM03DZj7A="
   },
   {
     "pname": "Microsoft.Testing.Platform",
-    "version": "2.0.2",
-    "hash": "sha256-K8B4tQaYslm+njUQ59nyvh4f4UgrbOo6DQgO9Hwt0aY="
+    "version": "2.1.0",
+    "hash": "sha256-CbR0j0Dh65cMccO7L6ppx4b5iiXjqxjjfC9A85HeLuM="
   },
   {
     "pname": "Microsoft.Testing.Platform.MSBuild",
-    "version": "2.0.2",
-    "hash": "sha256-RbL2Ie/sQx07hffiao8ScR+yMyYqI8astlC0/uf3bzM="
-  },
-  {
-    "pname": "Microsoft.TestPlatform.AdapterUtilities",
-    "version": "18.0.1",
-    "hash": "sha256-LE5xsyc75ERflV/EA4A4DV+ja2LAb0KR/DPinAG+AgI="
+    "version": "2.1.0",
+    "hash": "sha256-6T2tBSokr5/oiwqKASk18BieKqkIzDbYX32j1Hl1z1g="
   },
   {
     "pname": "Microsoft.TestPlatform.ObjectModel",
@@ -251,13 +251,13 @@
   },
   {
     "pname": "Microsoft.TestPlatform.ObjectModel",
-    "version": "18.3.0",
-    "hash": "sha256-3Y3OxAQsXl6sunQlSjfq31aLWykHQTj2o/TOVI/uy88="
+    "version": "18.4.0",
+    "hash": "sha256-ERL2goDaM0vUElW25DM/5lI2WplE5E6g9mhTegY0bC8="
   },
   {
     "pname": "Microsoft.TestPlatform.TestHost",
-    "version": "18.3.0",
-    "hash": "sha256-OkR+XvipAHPQbHywTwN8lVcMpyRs2MUJKCxJ5OfKAFk="
+    "version": "18.4.0",
+    "hash": "sha256-S4T/6xHvov8jDcbcuZAOoutMAEudUb3dMP7MyxVa8Fo="
   },
   {
     "pname": "NETStandard.Library",
@@ -291,23 +291,23 @@
   },
   {
     "pname": "NUnit3TestAdapter",
-    "version": "6.1.0",
-    "hash": "sha256-ApKCpMldOi4NIHU+1FedlqvpkLmgIs1hnBSy02tzv5s="
+    "version": "6.2.0",
+    "hash": "sha256-sKQjvF/qlEgfrCKHt1OzT+QZdtPt4RBBZd2f0oD1ldg="
   },
   {
     "pname": "ReferenceTrimmer",
-    "version": "3.4.5",
-    "hash": "sha256-GS6njxeBRH0avSmrFjuEw2tNPWg8Sa/P6BplHsjmFNI="
+    "version": "3.4.7",
+    "hash": "sha256-LgRvN1CYOZGj9Cx5SrOghx3KTJVPZZ22T8EgyKMyDJc="
   },
   {
     "pname": "Refit",
-    "version": "10.0.1",
-    "hash": "sha256-oS6MCd4cvhXlJCKMy6Dlr9gjxx0VUGaXG/reKrxKK7M="
+    "version": "10.1.6",
+    "hash": "sha256-KC0PVsbqx5RHZxItYgJaBeUQBlPLQbTx643BzEhXIc0="
   },
   {
     "pname": "Refit.HttpClientFactory",
-    "version": "10.0.1",
-    "hash": "sha256-xn7mqLxfVpTq8EmDiKvbj/zGWupw/SabxQMmJRKOY9U="
+    "version": "10.1.6",
+    "hash": "sha256-/fkHB7cFXIRVUDnznQVJBgpwLS8KdhtiASF78xp4C8Q="
   },
   {
     "pname": "Refitter.MSBuild",
@@ -351,28 +351,28 @@
   },
   {
     "pname": "Spectre.Console",
-    "version": "0.53.1",
-    "hash": "sha256-uj/DD9y9MFWh5ugfQ1nTpbDP5xj55Sa8KX06B8CluMc="
-  },
-  {
-    "pname": "Spectre.Console",
-    "version": "0.54.0",
-    "hash": "sha256-qlZQkT5KzACqJ1bLgBOylq9qO0L7XCh/RY8L8PnkpcU="
+    "version": "0.55.0",
+    "hash": "sha256-YPW3qtPFW2Hud+y6vmZidrD8a42oDJefPW8MIwdb4rs="
   },
   {
     "pname": "Spectre.Console.Analyzer",
     "version": "1.0.0",
     "hash": "sha256-Om2PRAfm4LoPImty4zpGo/uoqha6ZnuCU6iNcAvKiUE="
   },
+  {
+    "pname": "Spectre.Console.Ansi",
+    "version": "0.55.0",
+    "hash": "sha256-6nV1xQurUlpKCPVkbBcn0YLTaF3vvFFRoCjV+NjYox8="
+  },
   {
     "pname": "Spectre.Console.Cli",
-    "version": "0.53.1",
-    "hash": "sha256-WN79g+F9jRsqXAwVFLYS/lfaQish2yFwL40GB/PpdTo="
+    "version": "0.55.0",
+    "hash": "sha256-VJvGl38caKtrLqc1P8HMG8T2Ny2OgEumZzqk2rUcJNw="
   },
   {
     "pname": "Spectre.Console.Testing",
-    "version": "0.54.0",
-    "hash": "sha256-0ENVkihGqT1bS1ulKQ6Legnko56fSeY6c5C1ZU6OA6k="
+    "version": "0.55.0",
+    "hash": "sha256-Rgro4QZBqQiKHB6LP3H2nII2Tp2Lpp+wNMFoQwQCv+E="
   },
   {
     "pname": "SSH.NET",
@@ -426,8 +426,8 @@
   },
   {
     "pname": "TestableIO.System.IO.Abstractions",
-    "version": "22.1.0",
-    "hash": "sha256-C+zj0Xiv/wMSIqGMFSxQ06QePt7PChP1yl3EfHUAggU="
+    "version": "22.1.1",
+    "hash": "sha256-nBLPa/4R7gHmKltK260ZX6e+aOLlVkw5+2kuhraF2ec="
   },
   {
     "pname": "TestableIO.System.IO.Abstractions.Extensions",
@@ -436,27 +436,27 @@
   },
   {
     "pname": "TestableIO.System.IO.Abstractions.TestingHelpers",
-    "version": "22.1.0",
-    "hash": "sha256-49BRx8rx+4k8tdX+O3KOdi2NJF6uC9fVtnjnhcezK54="
+    "version": "22.1.1",
+    "hash": "sha256-tCAMji9DqF+kbA+ArJn6Lsux2bpvQwBI+d2MvzNVQn4="
   },
   {
     "pname": "TestableIO.System.IO.Abstractions.Wrappers",
-    "version": "22.1.0",
-    "hash": "sha256-lT9YUMBZ2YRP4DSajhzACDJVlR0jm8hdZnGncXbhLxA="
+    "version": "22.1.1",
+    "hash": "sha256-1dLAGZ6XaKlxWsYljNgEsQXG8ET4mubrYxLBNpdee6I="
   },
   {
     "pname": "Testably.Abstractions.FileSystem.Interface",
-    "version": "10.0.0",
-    "hash": "sha256-xEDpDTiT1lBFJHoWfJ9htPlwi5nrL5J/QJVj/9Slu48="
+    "version": "10.1.0",
+    "hash": "sha256-zS5HAJ+iZbjsiiqPE0+M+0PMGxOH1Bsmm3vdNSKoYPU="
   },
   {
     "pname": "Testcontainers",
-    "version": "4.10.0",
-    "hash": "sha256-9FZz37LV8arTeK3C5SLcg0SjCczXdY1nPbfKsxZMQl4="
+    "version": "4.11.0",
+    "hash": "sha256-SbrnISUOL0sQntC/z9/jOutewfLHQVT6vqjl2MfIjmw="
   },
   {
     "pname": "YamlDotNet",
-    "version": "16.3.0",
-    "hash": "sha256-4Gi8wSQ8Rsi/3+LyegJr//A83nxn2fN8LN1wvSSp39Q="
+    "version": "17.0.1",
+    "hash": "sha256-z23qb/L7DcjLgVsvROjyD7gr342u3QKjcPA2mZ0xz2g="
   }
 ]
diff --git a/pkgs/by-name/re/recyclarr/package.nix b/pkgs/by-name/re/recyclarr/package.nix
index 3ed1871acf39..455bdff775ff 100644
--- a/pkgs/by-name/re/recyclarr/package.nix
+++ b/pkgs/by-name/re/recyclarr/package.nix
@@ -9,13 +9,13 @@
 }:
 buildDotnetModule (finalAttrs: {
   pname = "recyclarr";
-  version = "8.5.1";
+  version = "8.6.0";
 
   src = fetchFromGitHub {
     owner = "recyclarr";
     repo = "recyclarr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-q2WEa28TYmmg2KDTIsT7AHQC5o0YwpOw+zmepvhoLaI=";
+    hash = "sha256-Uu6fBKODzKGYA6vSJPw0OV/+bi3y2F/SHfrdd5pdyzs=";
   };
 
   projectFile = "Recyclarr.slnx";
diff --git a/pkgs/by-name/re/redis/package.nix b/pkgs/by-name/re/redis/package.nix
index b4a0ab80ef87..0a8b742b120b 100644
--- a/pkgs/by-name/re/redis/package.nix
+++ b/pkgs/by-name/re/redis/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitHub,
   fetchpatch2,
+  apple-sdk,
   lua,
   jemalloc,
   pkg-config,
@@ -26,13 +27,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "redis";
-  version = "8.2.3";
+  version = "8.6.3";
 
   src = fetchFromGitHub {
     owner = "redis";
     repo = "redis";
     tag = finalAttrs.version;
-    hash = "sha256-PsTAo92Vz+LNxOsbI9VVnx+rHFm67a3bBMeDcLdhXFA=";
+    hash = "sha256-Zg2bghU4uExwI1SWplYIGCeGRhgRxdh3Oy9k1DZPado=";
   };
 
   patches = lib.optional useSystemJemalloc (fetchpatch2 {
@@ -40,6 +41,20 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-A9qp+PWQRuNy/xmv9KLM7/XAyL7Tzkyn0scpVCGngcc=";
   });
 
+  postPatch = ''
+    # Using `yes` seems to be an invalid value and causes the test to fail. See
+    # https://github.com/redis/redis/blob/bd3b38d41070b478c58bc8b72d2af89cbccd1a40/redis.conf#L674-L688
+    substituteInPlace tests/integration/replication.tcl \
+      --replace-fail 'repl-diskless-load yes' ' repl-diskless-load on-empty-db'
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    # The path `/Library/...` isn't available in the build sandbox. The package `apple-sdk`
+    # can provide that functionality for us.
+    substituteInPlace src/modules/Makefile modules/vector-sets/Makefile tests/modules/Makefile \
+      --replace-fail '/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/lib' \
+        '${apple-sdk.sdkroot}/usr/lib'
+  '';
+
   nativeBuildInputs = [
     pkg-config
     which
@@ -82,7 +97,7 @@ stdenv.mkDerivation (finalAttrs: {
     # disable test "Connect multiple replicas at the same time": even
     # upstream find this test too timing-sensitive
     substituteInPlace tests/integration/replication.tcl \
-      --replace-fail 'foreach sdl {disabled swapdb} {' 'foreach sdl {} {'
+      --replace-fail 'foreach sdl {disabled swapdb flushdb} {' 'foreach sdl {} {'
 
     substituteInPlace tests/support/server.tcl \
       --replace-fail 'exec /usr/bin/env' 'exec env'
@@ -105,6 +120,7 @@ stdenv.mkDerivation (finalAttrs: {
       --skipunit integration/aof-multi-part \
       --skipunit integration/failover \
       --skipunit integration/replication-rdbchannel \
+      --skipunit unit/cluster/atomic-slot-migration \
       --skiptest "Check MEMORY USAGE for embedded key strings with jemalloc"
       # ^ breaks due to unexpected and varying address space sizes that jemalloc gets built with
 
@@ -127,7 +143,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.agpl3Only;
     platforms = lib.platforms.all;
     changelog = "https://github.com/redis/redis/releases/tag/${finalAttrs.version}";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ hythera ];
     mainProgram = "redis-cli";
   };
 })
diff --git a/pkgs/by-name/re/reindeer/package.nix b/pkgs/by-name/re/reindeer/package.nix
index 48c181ac0cb8..3e31ee1375d6 100644
--- a/pkgs/by-name/re/reindeer/package.nix
+++ b/pkgs/by-name/re/reindeer/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "reindeer";
-  version = "2026.02.23.00";
+  version = "2026.05.04.00";
 
   src = fetchFromGitHub {
     owner = "facebookincubator";
     repo = "reindeer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-m2IqtOzkrKhFfpwNX1KGW2HZz9DLskGXHum8mc4SVuc=";
+    hash = "sha256-m27zMZbDv/2bXhb16rFxUUokEn0bxyrhpxlOSZvVcfk=";
   };
 
-  cargoHash = "sha256-fWpxIQJOcqzUwHNID+Wc+3QOY9P9hIAYSb9wP8x4pVU=";
+  cargoHash = "sha256-nJU9ClYxRkAfFkOq1V7k34pjdqJntDr3gJekUibq304=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/re/renderdoc/package.nix b/pkgs/by-name/re/renderdoc/package.nix
index 57e670ec9ee9..e69d1581a1a2 100644
--- a/pkgs/by-name/re/renderdoc/package.nix
+++ b/pkgs/by-name/re/renderdoc/package.nix
@@ -33,13 +33,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "renderdoc";
-  version = "1.43";
+  version = "1.44";
 
   src = fetchFromGitHub {
     owner = "baldurk";
     repo = "renderdoc";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-2oojSjBSdq/1plQ093mlBeZzwg7KEJW4oDiRt1f7plM=";
+    hash = "sha256-EInMFJMs+0bNSWmNP/f17pFCV9tJj6Ys3tZY6D69c/E=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/re/reptyr/package.nix b/pkgs/by-name/re/reptyr/package.nix
index b7567f2e7b93..28ab5ab2ea63 100644
--- a/pkgs/by-name/re/reptyr/package.nix
+++ b/pkgs/by-name/re/reptyr/package.nix
@@ -2,12 +2,8 @@
   stdenv,
   lib,
   fetchFromGitHub,
-  python3,
 }:
 
-let
-  python = python3.withPackages (p: [ p.pexpect ]);
-in
 stdenv.mkDerivation (finalAttrs: {
   version = "0.10.0";
   pname = "reptyr";
@@ -24,16 +20,10 @@ stdenv.mkDerivation (finalAttrs: {
     "DESTDIR=$(out)"
   ];
 
-  nativeCheckInputs = [ python ];
-
   # reptyr needs to do ptrace of a non-child process
   # It can be neither used nor tested if the kernel is not told to allow this
   doCheck = false;
 
-  checkFlags = [
-    "PYTHON_CMD=${python.interpreter}"
-  ];
-
   meta = {
     platforms = [
       "i686-linux"
diff --git a/pkgs/by-name/re/resterm/package.nix b/pkgs/by-name/re/resterm/package.nix
index e78d6658a9fd..529daf6ff0b7 100644
--- a/pkgs/by-name/re/resterm/package.nix
+++ b/pkgs/by-name/re/resterm/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "resterm";
-  version = "0.28.2";
+  version = "0.34.1";
 
   src = fetchFromGitHub {
     owner = "unkn0wn-root";
     repo = "resterm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jJGL9oSThbFeO0c89LMFWVEzyrGeIWZDUKYVqOy2hMk=";
+    hash = "sha256-lmUW0K0gUtZCw4yw8GkgiL+sEdnsF4ZNXkdJhwo8zLQ=";
   };
 
   vendorHash = "sha256-AjckKD6NScBa8w9nWMdVExuNadz3vHnK854XXg3nj84=";
diff --git a/pkgs/by-name/ri/ripmime/package.nix b/pkgs/by-name/ri/ripmime/package.nix
index 65cd963349fe..ae4f255d5f7d 100644
--- a/pkgs/by-name/ri/ripmime/package.nix
+++ b/pkgs/by-name/ri/ripmime/package.nix
@@ -30,6 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://pldaniels.com/ripmime/";
     platforms = lib.platforms.all;
     mainProgram = "ripmime";
+    license = lib.licenses.bsd3;
   };
 
   passthru = {
diff --git a/pkgs/by-name/ro/roslyn-ls/deps.json b/pkgs/by-name/ro/roslyn-ls/deps.json
index de0a6fff87ef..5b106ea95e4b 100644
--- a/pkgs/by-name/ro/roslyn-ls/deps.json
+++ b/pkgs/by-name/ro/roslyn-ls/deps.json
@@ -79,9 +79,9 @@
   },
   {
     "pname": "Microsoft.CodeAnalysis.BannedApiAnalyzers",
-    "version": "5.7.0-1.26202.104",
-    "hash": "sha256-p7ybIuiw34dJb1IehSN4v+II42tznBbYYAtVMiKUTbo=",
-    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.bannedapianalyzers/5.7.0-1.26202.104/microsoft.codeanalysis.bannedapianalyzers.5.7.0-1.26202.104.nupkg"
+    "version": "5.7.0-1.26215.121",
+    "hash": "sha256-91me6S6uT9wAM5stwzWc86ilPnVGxuWPg0WeCdhbIRs=",
+    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.bannedapianalyzers/5.7.0-1.26215.121/microsoft.codeanalysis.bannedapianalyzers.5.7.0-1.26215.121.nupkg"
   },
   {
     "pname": "Microsoft.CodeAnalysis.Common",
@@ -103,9 +103,9 @@
   },
   {
     "pname": "Microsoft.CodeAnalysis.PublicApiAnalyzers",
-    "version": "5.7.0-1.26202.104",
-    "hash": "sha256-JUov6s7HgwbliMPxy86J7ok+LfEcFZooVQBiedCSUeo=",
-    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.publicapianalyzers/5.7.0-1.26202.104/microsoft.codeanalysis.publicapianalyzers.5.7.0-1.26202.104.nupkg"
+    "version": "5.7.0-1.26215.121",
+    "hash": "sha256-RwRhXL8XuRypKne2WEH5xm05AePSJcH2LGBF4kwDMH0=",
+    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.publicapianalyzers/5.7.0-1.26215.121/microsoft.codeanalysis.publicapianalyzers.5.7.0-1.26215.121.nupkg"
   },
   {
     "pname": "Microsoft.CSharp",
@@ -121,15 +121,15 @@
   },
   {
     "pname": "Microsoft.DotNet.Arcade.Sdk",
-    "version": "10.0.0-beta.26201.4",
-    "hash": "sha256-A1H87Y8Tvf8+cnKj3a59TFi2utka8e9R1j6p9JbOpzs=",
-    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/1a5f89f6-d8da-4080-b15f-242650c914a8/nuget/v3/flat2/microsoft.dotnet.arcade.sdk/10.0.0-beta.26201.4/microsoft.dotnet.arcade.sdk.10.0.0-beta.26201.4.nupkg"
+    "version": "10.0.0-beta.26208.4",
+    "hash": "sha256-2IyF5OTwwHaOdpvoZK4hI/uXksNozsspxdg8dP8FeWM=",
+    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/1a5f89f6-d8da-4080-b15f-242650c914a8/nuget/v3/flat2/microsoft.dotnet.arcade.sdk/10.0.0-beta.26208.4/microsoft.dotnet.arcade.sdk.10.0.0-beta.26208.4.nupkg"
   },
   {
     "pname": "Microsoft.DotNet.XliffTasks",
-    "version": "10.0.0-beta.26201.4",
-    "hash": "sha256-4UIzFVmuDPIxECOBsAolrCCTb5Mzk5baYHDvGYFh/sc=",
-    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/1a5f89f6-d8da-4080-b15f-242650c914a8/nuget/v3/flat2/microsoft.dotnet.xlifftasks/10.0.0-beta.26201.4/microsoft.dotnet.xlifftasks.10.0.0-beta.26201.4.nupkg"
+    "version": "10.0.0-beta.26208.4",
+    "hash": "sha256-ZGH2bAXTyc0dVJwrPNZrcLEeD0pyKo/9M5p1w/hx0oE=",
+    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/1a5f89f6-d8da-4080-b15f-242650c914a8/nuget/v3/flat2/microsoft.dotnet.xlifftasks/10.0.0-beta.26208.4/microsoft.dotnet.xlifftasks.10.0.0-beta.26208.4.nupkg"
   },
   {
     "pname": "Microsoft.Extensions.Configuration",
@@ -427,15 +427,15 @@
   },
   {
     "pname": "PowerShell",
-    "version": "7.0.0",
-    "hash": "sha256-ioasr71UIhDmeZ2Etw52lQ7QsioEd1pnbpVlEeCyUI4=",
-    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/45bacae2-5efb-47c8-91e5-8ec20c22b4f8/nuget/v3/flat2/powershell/7.0.0/powershell.7.0.0.nupkg"
+    "version": "7.6.0",
+    "hash": "sha256-P6yQHqVi//8oP5zRIH4WQbyCvHvczoubiqpyR3Lk6LA=",
+    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/45bacae2-5efb-47c8-91e5-8ec20c22b4f8/nuget/v3/flat2/powershell/7.6.0/powershell.7.6.0.nupkg"
   },
   {
     "pname": "Roslyn.Diagnostics.Analyzers",
-    "version": "5.7.0-1.26202.104",
-    "hash": "sha256-GO3HaDDOCK+PT4/yoQuj1vXvgGzGmgV2ksBbdP51zW0=",
-    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/roslyn.diagnostics.analyzers/5.7.0-1.26202.104/roslyn.diagnostics.analyzers.5.7.0-1.26202.104.nupkg"
+    "version": "5.7.0-1.26215.121",
+    "hash": "sha256-24oGYM1xHKZHKr0a5d/pAC5d6dIwCsWqq3Ykx6VziWU=",
+    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/roslyn.diagnostics.analyzers/5.7.0-1.26215.121/roslyn.diagnostics.analyzers.5.7.0-1.26215.121.nupkg"
   },
   {
     "pname": "SQLitePCLRaw.bundle_green",
@@ -499,9 +499,9 @@
   },
   {
     "pname": "System.CommandLine",
-    "version": "3.0.0-preview.4.26202.104",
-    "hash": "sha256-Kuh7UZ+fg4mJWismeSS6PNKGFgSYruYOVY7agur6xe8=",
-    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/516521bf-6417-457e-9a9c-0a4bdfde03e7/nuget/v3/flat2/system.commandline/3.0.0-preview.4.26202.104/system.commandline.3.0.0-preview.4.26202.104.nupkg"
+    "version": "3.0.0-preview.4.26215.121",
+    "hash": "sha256-GJjEBeXmrAwXeGfXjJ4GFeFVdKvdAgIMzOhR0svAH2o=",
+    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/516521bf-6417-457e-9a9c-0a4bdfde03e7/nuget/v3/flat2/system.commandline/3.0.0-preview.4.26215.121/system.commandline.3.0.0-preview.4.26215.121.nupkg"
   },
   {
     "pname": "System.ComponentModel.Composition",
diff --git a/pkgs/by-name/ro/roslyn-ls/package.nix b/pkgs/by-name/ro/roslyn-ls/package.nix
index 71fa566c4c49..0d70848f0623 100644
--- a/pkgs/by-name/ro/roslyn-ls/package.nix
+++ b/pkgs/by-name/ro/roslyn-ls/package.nix
@@ -38,18 +38,18 @@ in
 buildDotnetModule (finalAttrs: {
   inherit pname dotnet-sdk dotnet-runtime;
 
-  vsVersion = "2.134.7-prerelease";
+  vsVersion = "2.136.19-prerelease";
   src = fetchFromGitHub {
     owner = "dotnet";
     repo = "roslyn";
     rev = "VSCode-CSharp-${finalAttrs.vsVersion}";
-    hash = "sha256-FzD5KQu5Ij+WBfXib1STBdXZvzvozey1cGghMHFWwvQ=";
+    hash = "sha256-xBxWBh4J8NJWQUDGdVLf/vXz0UTFP8q/2VoN9r55kvc=";
   };
 
   # versioned independently from vscode-csharp
   # "roslyn" in here:
   # https://github.com/dotnet/vscode-csharp/blob/main/package.json
-  version = "5.7.0-1.26203.6";
+  version = "5.7.0-1.26220.12";
   projectFile = "src/LanguageServer/${project}/${project}.csproj";
   useDotnetFromEnv = true;
   nugetDeps = ./deps.json;
diff --git a/pkgs/by-name/rs/rsrpc/package.nix b/pkgs/by-name/rs/rsrpc/package.nix
index f41fcd46f3f7..736b3f51cbf0 100644
--- a/pkgs/by-name/rs/rsrpc/package.nix
+++ b/pkgs/by-name/rs/rsrpc/package.nix
@@ -6,19 +6,18 @@
   pkg-config,
   nix-update-script,
 }:
-
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rsrpc";
-  version = "0.26.0";
+  version = "0.27.1";
 
   src = fetchFromGitHub {
     owner = "SpikeHD";
     repo = "rsRPC";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BH7Ov4WuI34tN3lFRkifTMHuZTHNPA7nZFsAdOKDF/c=";
+    hash = "sha256-QzPFhdnZXiJZ4g+J9kB2v8duM2PgShptNRHliTYW3AU=";
   };
 
-  cargoHash = "sha256-pMxlbOiNxmsnx6v9cTo51iu9zdK/Mzjms+6EGd3tpFs=";
+  cargoHash = "sha256-6Krtsj9hm8NqkFQMQ0MAPrFAjnzcTt4q5C1Fs5mx2SM=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/rt/rtk/package.nix b/pkgs/by-name/rt/rtk/package.nix
index 7cbb7c0a123a..f4b934e22855 100644
--- a/pkgs/by-name/rt/rtk/package.nix
+++ b/pkgs/by-name/rt/rtk/package.nix
@@ -12,19 +12,19 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rtk";
-  version = "0.37.2";
+  version = "0.38.0";
 
   src = fetchFromGitHub {
     owner = "rtk-ai";
     repo = "rtk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rNuu8B5TnKZHrbVSV8HkcTeTdcol26259GGJEPEMPZY=";
+    hash = "sha256-eINYlatbjpsqe46LNZIXvIrZEBf+QC3+2EjY7Ei7VZI=";
   };
 
   strictDeps = true;
   __structuredAttrs = true;
 
-  cargoHash = "sha256-61+PNuVF8H5+9PHc3MBt8V80ieBBi8HzSC9Gc/WUSzM=";
+  cargoHash = "sha256-qTDj7xTBM8dOOE7XLTewtHVwHtxVDcvCLs0ebtT2uSI=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/by-name/rt/rtl_fm_streamer/package.nix b/pkgs/by-name/rt/rtl_fm_streamer/package.nix
index 435744ea7666..777e927c92e5 100644
--- a/pkgs/by-name/rt/rtl_fm_streamer/package.nix
+++ b/pkgs/by-name/rt/rtl_fm_streamer/package.nix
@@ -30,6 +30,10 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail "cmake_minimum_required(VERSION 2.6)" "cmake_minimum_required(VERSION 3.10)"
   '';
 
+  patches = [
+    ./use-stdbool.patch
+  ];
+
   nativeBuildInputs = [
     cmake
     pkg-config
diff --git a/pkgs/by-name/rt/rtl_fm_streamer/use-stdbool.patch b/pkgs/by-name/rt/rtl_fm_streamer/use-stdbool.patch
new file mode 100644
index 000000000000..4e5dd2b70180
--- /dev/null
+++ b/pkgs/by-name/rt/rtl_fm_streamer/use-stdbool.patch
@@ -0,0 +1,18 @@
+Drop the hand-rolled bool enum: `bool`, `true`, and `false` are reserved
+keywords in C23 (the default since GCC 15), so the typedef no longer compiles.
+
+--- a/src/rtl_fm_streamer.c
++++ b/src/rtl_fm_streamer.c
+@@ -100,11 +100,7 @@
+
+ #define DEFAULT_PORT_NUMBER "2346"
+
+-typedef enum
+-{
+-    false = 0,
+-    true
+-}bool;
++#include <stdbool.h>
+
+ struct dongle_state
+ {
diff --git a/pkgs/by-name/ru/rustlens/package.nix b/pkgs/by-name/ru/rustlens/package.nix
new file mode 100644
index 000000000000..a83344c31e30
--- /dev/null
+++ b/pkgs/by-name/ru/rustlens/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  openssl,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "rustlens";
+  version = "0.2.1";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "yashksaini-coder";
+    repo = "Rustlens";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-BYROEUBa9RZXuJbNbKUbWXu9mPYIuAyO6JwPlNmj244=";
+  };
+
+  cargoHash = "sha256-WvUu2M2WFLo5Ve+ER7vpl7q/cpPR4g1vY4z9hRl3On0=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+  ];
+
+  meta = {
+    description = "Rustlens is a terminal-based application for exploring Rust codebases.";
+    homepage = "https://github.com/yashksaini-coder/Rustlens";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ gwg313 ];
+    mainProgram = "rustlens";
+  };
+})
diff --git a/pkgs/by-name/ru/rustnet/package.nix b/pkgs/by-name/ru/rustnet/package.nix
new file mode 100644
index 000000000000..70081d80608e
--- /dev/null
+++ b/pkgs/by-name/ru/rustnet/package.nix
@@ -0,0 +1,70 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+  pkg-config,
+  versionCheckHook,
+  elfutils,
+  zlib,
+  libbpf,
+  libpcap,
+  clangStdenv,
+}:
+let
+  pname = "rustnet";
+  version = "1.3.0";
+in
+rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } {
+  inherit pname version;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "domcyrus";
+    repo = "rustnet";
+    tag = "v${version}";
+    hash = "sha256-E2ItYSnT3WRSgPb5B+HDAlAPPmSLdt8qnE+2TiXHPk8=";
+  };
+
+  cargoHash = "sha256-B1IdFOKYNaLiq6t64mdR3zUUcvojevcV6/nqYGbsbAY=";
+
+  nativeBuildInputs = [
+    pkg-config
+    versionCheckHook
+  ];
+
+  buildInputs = [
+    elfutils
+    libbpf
+    libpcap
+    zlib
+  ];
+
+  # Required for libbpf-sys to build correctly
+  hardeningDisable = [
+    "zerocallusedregs"
+  ];
+
+  # Set environment variables for libbpf-sys
+  env = {
+    LIBBPF_SYS_LIBRARY_PATH = "${libbpf}/lib";
+    LIBBPF_SYS_INCLUDE_PATH = "${libbpf}/include";
+  };
+
+  checkFlags = [
+    "--skip=network::platform::linux::interface_stats::tests::test_get_all_stats"
+    "--skip=network::platform::linux::interface_stats::tests::test_list_interfaces"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "High-performance, cross-platform network monitoring terminal UI tool built with Rust";
+    homepage = "https://github.com/domcyrus/rustnet";
+    changelog = "https://github.com/domcyrus/rustnet/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ dvaerum ];
+    mainProgram = "rustnet";
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/ru/rustus/bump-mobc.patch b/pkgs/by-name/ru/rustus/bump-mobc.patch
new file mode 100644
index 000000000000..d3b1038dfae9
--- /dev/null
+++ b/pkgs/by-name/ru/rustus/bump-mobc.patch
@@ -0,0 +1,57 @@
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -33,7 +33,7 @@
+ sentry-actix = "0.35.0"
+ mime = "0.3.17"
+ mime_guess = "2.0.5"
+-mobc = "0.8.5"
++mobc = "0.9.0"
+ rust-s3 = "~0.35.1"
+ futures = "^0.3.31"
+ lapin = "^2.5.0"
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -2295,12 +2295,12 @@
+ 
+ [[package]]
+ name = "metrics"
+-version = "0.23.0"
++version = "0.24.5"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "884adb57038347dfbaf2d5065887b6cf4312330dc8e94bc30a1a839bd79d3261"
++checksum = "ff56c2e7dce6bd462e3b8919986a617027481b1dcc703175b58cf9dd98a2f071"
+ dependencies = [
+- "ahash",
+  "portable-atomic",
++ "rapidhash",
+ ]
+ 
+ [[package]]
+@@ -2357,9 +2357,9 @@
+ 
+ [[package]]
+ name = "mobc"
+-version = "0.8.5"
++version = "0.9.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "316a7d198b51958a0ab57248bf5f42d8409551203cb3c821d5925819a8d5415f"
++checksum = "4ee4c321f7581ff6d3b02c1fd05dc0b1f17c05f23c8532d1af9413890ab5fab5"
+ dependencies = [
+  "async-trait",
+  "futures-channel",
+@@ -2930,6 +2930,15 @@
+ ]
+ 
+ [[package]]
++name = "rapidhash"
++version = "4.4.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "b5e48930979c155e2f33aa36ab3119b5ee81332beb6482199a8ecd6029b80b59"
++dependencies = [
++ "rustversion",
++]
++
++[[package]]
+ name = "rc2"
+ version = "0.8.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
diff --git a/pkgs/by-name/ru/rustus/package.nix b/pkgs/by-name/ru/rustus/package.nix
index b9af89403dd9..a00c5632cec4 100644
--- a/pkgs/by-name/ru/rustus/package.nix
+++ b/pkgs/by-name/ru/rustus/package.nix
@@ -19,7 +19,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-ALnb6ICg+TZRuHayhozwJ5+imabgjBYX4W42ydhkzv0=";
   };
 
-  cargoHash = "sha256-df92+gp/DtdHwPxJF89zKHjmVWzfrjnD8wAlrPRyyxk=";
+  # Bump mobc 0.8.5 -> 0.9.0 to pull in metrics >= 0.24.2, which fixes a borrow-checker error under newer rustc
+  # (https://github.com/rust-lang/rust/issues/141402).
+  cargoPatches = [ ./bump-mobc.patch ];
+
+  cargoHash = "sha256-FyuUdskTEGiBs7qC7cv1u8d4BCZ2IEOduhAe3m4IDV0=";
 
   env = {
     OPENSSL_NO_VENDOR = 1;
@@ -54,6 +58,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "--skip=notifiers::impls::http_notifier::tests::unknown_url"
     "--skip=notifiers::impls::kafka_notifier::test::simple_success_on_prefix"
     "--skip=notifiers::impls::kafka_notifier::test::simple_success_on_topic"
+
+    # flaky: ETXTBSY race on parallel fork/exec
+    "--skip=notifiers::impls::file_notifier::tests::success"
   ];
 
   meta = {
diff --git a/pkgs/by-name/s7/s7/package.nix b/pkgs/by-name/s7/s7/package.nix
index 7ddb8e312751..7912aaaa83ff 100644
--- a/pkgs/by-name/s7/s7/package.nix
+++ b/pkgs/by-name/s7/s7/package.nix
@@ -26,14 +26,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "s7";
-  version = "11.8-unstable-2026-04-27";
+  version = "11.8-unstable-2026-05-05";
 
   src = fetchFromGitLab {
     domain = "cm-gitlab.stanford.edu";
     owner = "bil";
     repo = "s7";
-    rev = "31e2c56a47f0616a6336acd408aeef4b7894b1ae";
-    hash = "sha256-Qcy7QfdIbwZOQIw+ZxRIQ3W4uk+fAKmiJIBI2aLIIzc=";
+    rev = "aae7fcfbf66e4d1053ed52d70e6134f12440a731";
+    hash = "sha256-6BynynDPjp4vzIrwXWrqzGPPp/zMf8SBIehy05Sxmtw=";
   };
 
   buildInputs =
diff --git a/pkgs/by-name/sa/sabnzbd/package.nix b/pkgs/by-name/sa/sabnzbd/package.nix
index beb1d0e3f71e..8a109186c7b8 100644
--- a/pkgs/by-name/sa/sabnzbd/package.nix
+++ b/pkgs/by-name/sa/sabnzbd/package.nix
@@ -15,8 +15,8 @@
 }:
 
 let
-  sabctoolsVersion = "8.2.6";
-  sabctoolsHash = "sha256-olZSIjfP2E1tkCG8WzEZfrBJuDEp3PZyFFE5LJODEZE=";
+  sabctoolsVersion = "9.4.0";
+  sabctoolsHash = "sha256-JkRRtZnzp83dMKXiuqOXaTm8UOpkkhmjH2ysS8TY0DI=";
 
   pythonEnv = python3.withPackages (
     ps: with ps; [
@@ -73,14 +73,14 @@ let
   ];
 in
 stdenv.mkDerivation rec {
-  version = "4.5.5";
+  version = "5.0.1";
   pname = "sabnzbd";
 
   src = fetchFromGitHub {
     owner = "sabnzbd";
     repo = "sabnzbd";
     rev = version;
-    hash = "sha256-XEWMy+Ph47neyQubehegcOxucClB1Z9t1QDLN7FrxaY=";
+    hash = "sha256-wx3lNGeHsNvd+nLiI9jfIKHcsVstfjEpZry6o3xbWd4=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/sa/sambamba/package.nix b/pkgs/by-name/sa/sambamba/package.nix
index 4645d99b16af..3aa9d9cfc6b0 100644
--- a/pkgs/by-name/sa/sambamba/package.nix
+++ b/pkgs/by-name/sa/sambamba/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   python3,
   which,
   ldc,
@@ -31,6 +32,14 @@ stdenv.mkDerivation (finalAttrs: {
     lz4
   ];
 
+  patches = [
+    # remove on next release; add missing break
+    (fetchpatch {
+      url = "https://github.com/biod/sambamba/commit/5fdcf6f3015cb17b805514397223f7513bc92613.patch";
+      hash = "sha256-9iJmR9rJgGKH1kSFTnUCqZ4IU+Xz923SIloeBiYmIk4=";
+    })
+  ];
+
   buildFlags = [
     "CC=${stdenv.cc.targetPrefix}cc"
   ];
diff --git a/pkgs/by-name/se/sem/package.nix b/pkgs/by-name/se/sem/package.nix
index 52039b84500a..9769c47e7459 100644
--- a/pkgs/by-name/se/sem/package.nix
+++ b/pkgs/by-name/se/sem/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "sem";
-  version = "0.34.0";
+  version = "0.35.0";
 
   src = fetchFromGitHub {
     owner = "semaphoreci";
     repo = "cli";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-FJn1oTtECPZpBi2LsoAxA2kyS3RY1/5oJGOTZiwitsA=";
+    sha256 = "sha256-+rT8Kni7094OjNmGRxPUxXaHopyCNGMCM2ac4lIm9PE=";
   };
 
   vendorHash = "sha256-XEr/vXamJ7GTRpXNdcVQ9PcUVvQ8EW3pmq/tEZMHSDo=";
diff --git a/pkgs/by-name/sh/shpool/package.nix b/pkgs/by-name/sh/shpool/package.nix
index 81ee1d8d4850..7f7f9590d16b 100644
--- a/pkgs/by-name/sh/shpool/package.nix
+++ b/pkgs/by-name/sh/shpool/package.nix
@@ -10,13 +10,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "shpool";
-  version = "0.9.6";
+  version = "0.9.8";
 
   src = fetchFromGitHub {
     owner = "shell-pool";
     repo = "shpool";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Q2sIHOiFP/xj6wO3GNDc53eRwGygAz6nijsUqa3n9v0=";
+    hash = "sha256-iN4ZPayOUhbP3WlQIIyIN73PxH3CFgsQELWt8prtTJo=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail '/usr/bin/shpool' "$out/bin/shpool"
   '';
 
-  cargoHash = "sha256-SkMPP3FwVMmHnsTIYqZjrjdliWk3YbPHsaRe1rx8sIg=";
+  cargoHash = "sha256-bWA0UZLr/z9MWLrp0yxblFTZwSOEIheBhmx71Ftnbcg=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ linux-pam ];
 
diff --git a/pkgs/by-name/sn/snips-sh/package.nix b/pkgs/by-name/sn/snips-sh/package.nix
index 3b0fce9faa17..dc123f4c7a59 100644
--- a/pkgs/by-name/sn/snips-sh/package.nix
+++ b/pkgs/by-name/sn/snips-sh/package.nix
@@ -9,14 +9,14 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "snips-sh";
-  version = "0.9.1";
-  vendorHash = "sha256-41REdYiHEZOEsV8qslQoRBbP9H+sdVSZ+KBkZWkZtHM=";
+  version = "0.10.0";
+  vendorHash = "sha256-HCrikrdQhufG6/bZoKT5aU4Qrlb7Y3RcGWf1iOCrT6Y=";
 
   src = fetchFromGitHub {
     owner = "robherley";
     repo = "snips.sh";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-U3ORTWPLJL+vNQ7nYQa2MgW2uQJzV5oIH/062b1dwqc=";
+    hash = "sha256-DmjS+rhPlUuZZPbNlrhHab9S2mWvKvwrlDsxYPBzvnQ=";
   };
 
   tags = (lib.optional (!withTensorflow) "noguesser");
diff --git a/pkgs/by-name/so/soco-cli/package.nix b/pkgs/by-name/so/soco-cli/package.nix
index 64b24edf3b52..522770cd7007 100644
--- a/pkgs/by-name/so/soco-cli/package.nix
+++ b/pkgs/by-name/so/soco-cli/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "soco-cli";
-  version = "0.4.83";
+  version = "0.4.85";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "avantrec";
     repo = "soco-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sVu6mizqUy9AdwGRciez1wnBPTnUcIRBjkAM+IY3n0E=";
+    hash = "sha256-g/tUK6S9uk4PxE3xscJag8fPYA2PdsCccfP+7Wi1ji0=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];
diff --git a/pkgs/by-name/so/solanum/package.nix b/pkgs/by-name/so/solanum/package.nix
index 99a98f909532..117ef413fc72 100644
--- a/pkgs/by-name/so/solanum/package.nix
+++ b/pkgs/by-name/so/solanum/package.nix
@@ -19,17 +19,20 @@
   sqlite,
   unstableGitUpdater,
   nixosTests,
+
+  # flags
+  withSCTP ? lib.meta.availableOn stdenv.hostPlatform lksctp-tools,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "solanum";
-  version = "0-unstable-2026-04-09";
+  version = "0-unstable-2026-04-29";
 
   src = fetchFromGitHub {
     owner = "solanum-ircd";
     repo = "solanum";
-    rev = "54286cf59235c8688104ee20d4e1d74fe8934317";
-    hash = "sha256-0som1lYheX/GVbqwEXwpIWonYKYqFwpAfcRRojlHlmc=";
+    rev = "eacc3388cd75060a1ece9209c24c85bc20b65ff7";
+    hash = "sha256-kZEjGq6kcm5sjP81at+1qVbIu1Ik3k+vJKb+cisg3IE=";
   };
 
   postPatch = ''
@@ -50,6 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonEnable "mbedtls" false)
     (lib.mesonEnable "openssl" true)
     (lib.mesonEnable "gnutls" false)
+    (lib.mesonEnable "sctp" withSCTP)
   ];
 
   nativeBuildInputs = [
@@ -67,7 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
     sqlite
     vectorscan
   ]
-  ++ lib.optionals stdenv.hostPlatform.isLinux [
+  ++ lib.optionals withSCTP [
     lksctp-tools
   ];
 
@@ -81,6 +85,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = {
+    broken = stdenv.hostPlatform.isDarwin;
     description = "IRCd for unified networks";
     homepage = "https://github.com/solanum-ircd/solanum";
     license = lib.licenses.gpl2Plus;
diff --git a/pkgs/by-name/sp/spicedb-zed/package.nix b/pkgs/by-name/sp/spicedb-zed/package.nix
index 74541fb64c27..14efa4ded236 100644
--- a/pkgs/by-name/sp/spicedb-zed/package.nix
+++ b/pkgs/by-name/sp/spicedb-zed/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "zed";
-  version = "1.0.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "authzed";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kF16ZmIOw80esknKJvHYFWrx4FG/kn+Il5xnC1JmAn4=";
+    hash = "sha256-rlTcC2+faNZKvzouGC9nJBBCsDabxozTE/SFbf8YKQ8=";
   };
 
-  vendorHash = "sha256-e/VrFEKVVAAtClAzFw2XV3cWVmto90qzMKVLpZjKZ8o=";
+  vendorHash = "sha256-/nnPVy+pjcgkgJW8630IycmGF4Qq4I01htEDlsWvZbM=";
 
   ldflags = [ "-X 'github.com/jzelinskie/cobrautil/v2.Version=${finalAttrs.src.tag}'" ];
 
diff --git a/pkgs/by-name/sq/squix/package.nix b/pkgs/by-name/sq/squix/package.nix
new file mode 100644
index 000000000000..89ab281abe86
--- /dev/null
+++ b/pkgs/by-name/sq/squix/package.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  writableTmpDirAsHomeHook,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "squix";
+  version = "0.4.0-beta";
+
+  src = fetchFromGitHub {
+    owner = "eduardofuncao";
+    repo = "squix";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-lJOXzBgVgRdUi+btu/eOlYXDLhS2FLEnJQ/UjGk5jF4=";
+  };
+
+  vendorHash = "sha256-JRmNajvCb57dMo8eggOD1m4N01p2RSK8r49pmBB56Z0=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.Version=${finalAttrs.version}"
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    writableTmpDirAsHomeHook
+    versionCheckHook
+  ];
+  versionCheckKeepEnvironment = [ "HOME" ];
+
+  meta = {
+    description = "SQL command-line client with query management and interactive results";
+    homepage = "https://github.com/eduardofuncao/squix";
+    license = lib.licenses.mit;
+    mainProgram = "squix";
+    maintainers = with lib.maintainers; [ eduardofuncao ];
+  };
+})
diff --git a/pkgs/by-name/sr/srm-cuarzo/package.nix b/pkgs/by-name/sr/srm-cuarzo/package.nix
index b0371a884da9..b4bd5199aff5 100644
--- a/pkgs/by-name/sr/srm-cuarzo/package.nix
+++ b/pkgs/by-name/sr/srm-cuarzo/package.nix
@@ -56,5 +56,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/CuarzoSoftware/SRM";
     maintainers = [ ];
     platforms = lib.platforms.linux;
+    license = lib.licenses.lgpl21Only;
   };
 })
diff --git a/pkgs/by-name/st/starboard/package.nix b/pkgs/by-name/st/starboard/package.nix
index 91e61255afde..55efa152c717 100644
--- a/pkgs/by-name/st/starboard/package.nix
+++ b/pkgs/by-name/st/starboard/package.nix
@@ -9,7 +9,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "starboard";
-  version = "0.15.33";
+  version = "0.15.37";
 
   __darwinAllowLocalNetworking = true; # for tests
 
@@ -17,7 +17,7 @@ buildGoModule (finalAttrs: {
     owner = "aquasecurity";
     repo = "starboard";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wVjwDb7VKjZSPHROTpjpR8rJvgqXJmXKJbJJXHYYxzY=";
+    hash = "sha256-WIgXKw+PWS1A+npYL99t0Du7BJESTvrUckWtCzq1VS4=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
diff --git a/pkgs/by-name/st/statix/package.nix b/pkgs/by-name/st/statix/package.nix
index ed6e9d7963c2..fbacbcc72b92 100644
--- a/pkgs/by-name/st/statix/package.nix
+++ b/pkgs/by-name/st/statix/package.nix
@@ -3,44 +3,35 @@
   rustPlatform,
   fetchFromGitHub,
   withJson ? true,
-  stdenv,
-  versionCheckHook,
   nix-update-script,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "statix";
-  # also update version of the vim plugin in
-  # pkgs/applications/editors/vim/plugins/overrides.nix
-  # the version can be found in flake.nix of the source code
-  version = "0.5.8";
+  version = "0-unstable-2026-05-03";
 
   src = fetchFromGitHub {
-    owner = "oppiliappan";
+    owner = "molybdenumsoftware";
     repo = "statix";
-    tag = "v${finalAttrs.version}";
-    sha256 = "sha256-bMs3XMiGP6sXCqdjna4xoV6CANOIWuISSzCaL5LYY4c=";
+    rev = "91e28aa76179b5769e8eff7ff4b09464d0913f27";
+    hash = "sha256-JDCJ8fgIs5ZdYygQxlR63H/V4VyfmVMR4FleWwAl+AM=";
   };
 
-  cargoHash = "sha256-Pi1q2qNLjQYr3Wla7rqrktNm0StszB2klcfzwAnF3tE=";
+  cargoHash = "sha256-lODAnIGw8MncMT5xicWORSbCChn2HQXENsOStJYHepQ=";
 
   buildFeatures = lib.optional withJson "json";
 
-  # tests are failing on darwin
-  doCheck = !stdenv.hostPlatform.isDarwin;
-
-  doInstallCheck = true;
-  nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgramArg = "--version";
-
-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = nix-update-script {
+    version = "branch";
+  };
 
   meta = {
     description = "Lints and suggestions for the nix programming language";
-    homepage = "https://github.com/oppiliappan/statix";
+    homepage = "https://github.com/molybdenumsoftware/statix";
     license = lib.licenses.mit;
     mainProgram = "statix";
     maintainers = with lib.maintainers; [
+      mightyiam
       nerdypepper
       progrm_jarvis
     ];
diff --git a/pkgs/by-name/st/stremio-linux-shell/package.nix b/pkgs/by-name/st/stremio-linux-shell/package.nix
index 3b82f29fe336..4a3f62c23a55 100644
--- a/pkgs/by-name/st/stremio-linux-shell/package.nix
+++ b/pkgs/by-name/st/stremio-linux-shell/package.nix
@@ -95,6 +95,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   env.CEF_PATH = "${cef}";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   postInstall = ''
     mkdir -p $out/share/applications
     cp data/com.stremio.Stremio.desktop $out/share/applications/com.stremio.Stremio.desktop
@@ -130,10 +133,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
   meta = {
     description = "Modern media center that gives you the freedom to watch everything you want";
     homepage = "https://www.stremio.com/";
-    license = with lib.licenses; [
-      gpl3Only
-      # server.js is unfree
-      unfree
+    license =
+      with lib.licenses;
+      AND [
+        gpl3Only
+        unfree # server.js
+      ];
+    sourceProvenance = with lib.sourceTypes; [
+      fromSource
+      obfuscatedCode # server.js
     ];
     maintainers = with lib.maintainers; [ thunze ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/su/subfinder/package.nix b/pkgs/by-name/su/subfinder/package.nix
index 13491bddf6ef..e5116639e77d 100644
--- a/pkgs/by-name/su/subfinder/package.nix
+++ b/pkgs/by-name/su/subfinder/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "subfinder";
-  version = "2.13.0";
+  version = "2.14.0";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "subfinder";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3QvF+igCpunbUzYN1iq9ZN7Ty/6WOs98HiRuw1KgVTU=";
+    hash = "sha256-VAOrX8oxTAMaVpRxSMtZF8xKlsQ6rx7gxv7vmChDDAM=";
   };
 
-  vendorHash = "sha256-G8CNSCufXaj/rUNqfeScSuOeUDUYJRuFeKd+cGcjOCk=";
+  vendorHash = "sha256-JsJtykNv46EFAjA290rh13k8CrqHEVp3f/vqWhjOIlc=";
 
   patches = [
     # Disable automatic version check
diff --git a/pkgs/by-name/su/supabase-cli/package.nix b/pkgs/by-name/su/supabase-cli/package.nix
index c4cf14284411..fc6d339695e8 100644
--- a/pkgs/by-name/su/supabase-cli/package.nix
+++ b/pkgs/by-name/su/supabase-cli/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "supabase-cli";
-  version = "2.95.4";
+  version = "2.98.1";
 
   src = fetchFromGitHub {
     owner = "supabase";
     repo = "cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-qg2b3fzmsGhVyqGQVA0Iffnna72TgH+2j0CHljG2BWg=";
+    hash = "sha256-BDmd9SXHe5dYvn37XNweFUqKjF4LkiNUeeAyV6nd4ZA=";
   };
 
-  vendorHash = "sha256-SAqxD60UeP0jxigMQfddJlZs7EWkdws2v47smidAisk=";
+  vendorHash = "sha256-5HP9NMd0ByepiJOU3G9fNcz6XYFl71Pm0ZZE9Qg94vo=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/su/surfpool/package.nix b/pkgs/by-name/su/surfpool/package.nix
index 131375083577..56a34be234e4 100644
--- a/pkgs/by-name/su/surfpool/package.nix
+++ b/pkgs/by-name/su/surfpool/package.nix
@@ -19,18 +19,18 @@ in
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "surfpool-cli";
-  version = "1.2.0";
+  version = "1.2.1";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "solana-foundation";
     repo = "surfpool";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PGCzlnu7YxueQ16uae2818I9vXWdMRFRGaFzg2DIIgo=";
+    hash = "sha256-oO6K8OJXj2HQOExhT/6auCjfCOpUrSkHJJncztCjRWU=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-ephKNAJ9PtTz/EN9dGFn6LnIySU0g/GNz8Jg9JDKTSI=";
+  cargoHash = "sha256-MLWXYVVmJXxUY6LRsi8LiVJbVAAvcA3wbT8eiz4pAaE=";
 
   postPatch = ''
     # instead of downloading the surfpool-web-ui at build time, we fetch it beforehand and use it
diff --git a/pkgs/by-name/ta/taco/package.nix b/pkgs/by-name/ta/taco/package.nix
index 4dd472fd36b1..0d46ae7dc96b 100644
--- a/pkgs/by-name/ta/taco/package.nix
+++ b/pkgs/by-name/ta/taco/package.nix
@@ -6,11 +6,10 @@
   python3,
   llvmPackages,
   enablePython ? false,
-  python ? python3,
 }:
 
 let
-  pyEnv = python.withPackages (
+  pyEnv = python3.withPackages (
     p: with p; [
       numpy
       scipy
@@ -21,17 +20,17 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "taco";
-  version = "unstable-2022-08-02";
+  version = "0-unstable-2025-04-14";
 
   src = fetchFromGitHub {
     owner = "tensor-compiler";
     repo = "taco";
-    rev = "2b8ece4c230a5f0f0a74bc6f48e28edfb6c1c95e";
+    rev = "0e79acb56cb5f3d1785179536256e206790b2a9e";
     fetchSubmodules = true;
-    hash = "sha256-PnBocyRLiLALuVS3Gkt/yJeslCMKyK4zdsBI8BFaTSg=";
+    hash = "sha256-mdT6ZLxtJ7fqyjRqdWf6+RltvMy7YDr9AEnJtnaDmTw=";
   };
 
-  src-new-pybind11 = python.pkgs.pybind11.src;
+  src-new-pybind11 = python3.pkgs.pybind11.src;
 
   postPatch = ''
     rm -rf python_bindings/pybind11/*
@@ -45,6 +44,11 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace apps/tensor_times_vector/CMakeLists.txt --replace-fail \
       "cmake_minimum_required(VERSION 2.8.12)" \
       "cmake_minimum_required(VERSION 3.5)"
+
+    # Newer pybind11 typing wrappers require a single concrete lambda return type.
+    substituteInPlace python_bindings/src/pytaco.cpp --replace-fail \
+      'm.def("get_parallel_schedule", [](){' \
+      'm.def("get_parallel_schedule", []() -> py::tuple {'
   '';
 
   # Remove test cases from cmake build as they violate modern C++ expectations
@@ -62,8 +66,8 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional enablePython "-DPYTHON=ON";
 
   postInstall = lib.strings.optionalString enablePython ''
-    mkdir -p $out/${python.sitePackages}
-    cp -r lib/pytaco $out/${python.sitePackages}/.
+    mkdir -p $out/${python3.sitePackages}
+    cp -r lib/pytaco $out/${python3.sitePackages}/.
   '';
 
   # The standard CMake test suite fails a single test of the CLI interface.
diff --git a/pkgs/by-name/ta/talos-pilot/package.nix b/pkgs/by-name/ta/talos-pilot/package.nix
new file mode 100644
index 000000000000..3103674cfde0
--- /dev/null
+++ b/pkgs/by-name/ta/talos-pilot/package.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  protobuf,
+  nix-update-script,
+  testers,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "talos-pilot";
+  version = "0.1.9";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "Handfish";
+    repo = "talos-pilot";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-OZF74efMWQkZgSbOnzyygzt4pRADY1liWVpvnzWns8Y=";
+  };
+
+  cargoHash = "sha256-loCYAgZhNtYs8aBbOJMLkS9i0XglOn6BrodLQROPMPQ=";
+
+  nativeBuildInputs = [
+    protobuf
+  ];
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+    };
+  };
+
+  meta = {
+    description = "Talos TUI for real-time node monitoring, log streaming, etcd health, and diagnostics";
+    homepage = "https://github.com/Handfish/talos-pilot";
+    changelog = "https://github.com/Handfish/talos-pilot/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ frantathefranta ];
+    mainProgram = "talos-pilot";
+  };
+})
diff --git a/pkgs/by-name/te/termusic/package.nix b/pkgs/by-name/te/termusic/package.nix
index 1157d668c9e6..9331153bc2f8 100644
--- a/pkgs/by-name/te/termusic/package.nix
+++ b/pkgs/by-name/te/termusic/package.nix
@@ -18,16 +18,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "termusic";
-  version = "0.12.1";
+  version = "0.13.2";
 
   src = fetchFromGitHub {
     owner = "tramhao";
     repo = "termusic";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-e+D7ykqGX2UprakCZc9Gmaxct+b19DMfTRMkeIANXqg=";
+    hash = "sha256-GAbUvxRWKy5tDjf+G5cKXgwNs9Rm52h7mICyDFlrCoo=";
   };
 
-  cargoHash = "sha256-0JVKY3A3W3vJgDtlZE6gtrXQa2e+4YA6R6mFUYhuQkk=";
+  cargoHash = "sha256-xFQObWhONoRBAdEZblBDQeQtq/KmaCWWnCwv3XEmG2k=";
 
   useNextest = true;
 
diff --git a/pkgs/by-name/te/terramate/package.nix b/pkgs/by-name/te/terramate/package.nix
index 30c04c341d0c..d81b103a9adb 100644
--- a/pkgs/by-name/te/terramate/package.nix
+++ b/pkgs/by-name/te/terramate/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "terramate";
-  version = "0.16.0";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "terramate-io";
     repo = "terramate";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-UY9Nj6MbQd2RLV0ofo5qpcsnabYwOyeEVXxXvC3efTo=";
+    hash = "sha256-Se1A43fDx4/RK70xNvUUZaAdFVWAijo+VLyHqMYgmfw=";
   };
 
-  vendorHash = "sha256-Ca4ZVna80Gb3L+qWmwXTh4qpDuc42PFFlDmuUqlGwqg=";
+  vendorHash = "sha256-U9ASe8P+c6UDHGpazV7LJXcAAkABqXN1AO0WqxlhEGo=";
 
   # required for version info
   nativeBuildInputs = [ git ];
diff --git a/pkgs/by-name/te/texstudio/package.nix b/pkgs/by-name/te/texstudio/package.nix
index c0bf0f592a72..ba6734313c7e 100644
--- a/pkgs/by-name/te/texstudio/package.nix
+++ b/pkgs/by-name/te/texstudio/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "texstudio";
-  version = "4.9.2";
+  version = "4.9.3";
 
   src = fetchFromGitHub {
     owner = "texstudio-org";
     repo = "texstudio";
     rev = finalAttrs.version;
-    hash = "sha256-u4+QUL3bOGo81+8adovqkpCKw3H6Mw6I2V3PfcKhb60=";
+    hash = "sha256-NTabdGaB87otc1zzKQLWXx4/nU5rXeTIw2O9nWXUMi0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ti/tidal/package.nix b/pkgs/by-name/ti/tidal/package.nix
new file mode 100644
index 000000000000..2ada01e637fe
--- /dev/null
+++ b/pkgs/by-name/ti/tidal/package.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  undmg,
+}:
+let
+  updateScript = ./update.sh;
+in
+stdenv.mkDerivation {
+  pname = "tidal";
+  version = "2.41.3";
+
+  src =
+    if stdenv.hostPlatform.isAarch64 then
+      (fetchurl {
+        url = "https://web.archive.org/web/20260314112555/https://download.tidal.com/desktop/TIDAL.arm64.dmg";
+        hash = "sha256-18RjsLHhpUSAyITfwu3efokUbezE1b3GpFiafWHW/qo=";
+      })
+    else
+      (fetchurl {
+        url = "https://web.archive.org/web/20260314112436/https://download.tidal.com/desktop/TIDAL.x64.dmg";
+        hash = "sha256-5nUU8TOSph1v1C0+/KR/F5Y7m5TitbYH/ujsiZ/n6LU=";
+      });
+
+  nativeBuildInputs = [ undmg ];
+
+  sourceRoot = ".";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/Applications
+    cp -r *.app $out/Applications
+
+    runHook postInstall
+  '';
+
+  passthru = { inherit updateScript; };
+
+  meta = {
+    description = "Play music from the Tidal streaming service";
+    homepage = "https://tidal.com/";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.unfree;
+    platforms = [
+      "x86_64-darwin"
+      "aarch64-darwin"
+    ];
+    mainProgram = "tidal";
+    maintainers = with lib.maintainers; [
+      frostplexx
+    ];
+  };
+}
diff --git a/pkgs/by-name/ti/tidal/update.sh b/pkgs/by-name/ti/tidal/update.sh
new file mode 100755
index 000000000000..7810ec9c5faa
--- /dev/null
+++ b/pkgs/by-name/ti/tidal/update.sh
@@ -0,0 +1,70 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p curl jq git gnused gnugrep nix libplist undmg
+set -euo pipefail
+
+# executing this script without arguments will
+# - find the newest stable spotify version avaiable on snapcraft (https://snapcraft.io/spotify)
+# - read the current spotify version from the current nix expression
+# - update the nix expression if the versions differ
+# - try to build the updated version, exit if that fails
+# - give instructions for upstreaming
+
+# Please test the update manually before pushing. There have been errors before
+# and because the service is proprietary and a paid account is necessary to do
+# anything with spotify automatic testing is not possible.
+
+# As an optional argument you can specify the snapcraft channel to update to.
+# Default is `stable` and only stable updates should be pushed to nixpkgs. For
+# testing you may specify `candidate` or `edge`.
+
+nixpkgs="$(git rev-parse --show-toplevel)"
+
+update_macos() {
+  nix_file="$nixpkgs/pkgs/by-name/ti/tidal/package.nix"
+
+  tmp_dir=$(mktemp -d)
+  trap 'rm -rf "$tmp_dir"' EXIT
+
+  pushd $tmp_dir
+
+  x86_64_url="https://download.tidal.com/desktop/TIDAL.x64.dmg"
+  aarch64_url="https://download.tidal.com/desktop/TIDAL.arm64.dmg"
+
+  curl -OL "$aarch64_url"
+  undmg TIDAL.arm64.dmg
+  upstream_version=$(plistutil -i TIDAL.app/Contents/Info.plist -f json -o - | jq -r '.CFBundleShortVersionString')
+
+  popd
+
+  current_nix_version=$(
+    grep 'version\s*=' "$nix_file" |
+      sed -Ene 's/.*"(.*)".*/\1/p'
+  )
+
+  if [[ "$current_nix_version" != "$upstream_version" ]]; then
+    archive_url="https://web.archive.org/save"
+    archived_x86_64_url=$(curl -s -I -L -o /dev/null "$archive_url/$x86_64_url" -w '%{url_effective}')
+    archived_aarch64_url=$(curl -s -I -L -o /dev/null "$archive_url/$aarch64_url" -w '%{url_effective}')
+
+    aarch64_hash=$(nix-prefetch-url "$archived_aarch64_url" --type sha256 | xargs nix hash convert --hash-algo sha256 --to sri)
+    x86_64_hash=$(nix-prefetch-url "$archived_x86_64_url" --type sha256 | xargs nix hash convert --hash-algo sha256 --to sri)
+
+    sed --regexp-extended \
+      -e 's/version\s*=\s*".*"\s*;/version = "'"${upstream_version}"'";/' \
+      -i "$nix_file"
+
+    # Update aarch64 (first fetchurl block) url and hash
+    sed -e '/isAarch64/,/})/{
+      s|url = ".*"|url = "'"${archived_aarch64_url}"'"|
+      s|hash = ".*"|hash = "'"${aarch64_hash}"'"|
+    }' -i "$nix_file"
+
+    # Update x86_64 (second fetchurl block) url and hash
+    sed -e '/else/,/})/{
+      s|url = ".*"|url = "'"${archived_x86_64_url}"'"|
+      s|hash = ".*"|hash = "'"${x86_64_hash}"'"|
+    }' -i "$nix_file"
+  fi
+}
+
+update_macos
diff --git a/pkgs/by-name/ti/tideways-daemon/package.nix b/pkgs/by-name/ti/tideways-daemon/package.nix
index 4b7f964d496c..791579e780d7 100644
--- a/pkgs/by-name/ti/tideways-daemon/package.nix
+++ b/pkgs/by-name/ti/tideways-daemon/package.nix
@@ -10,7 +10,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tideways-daemon";
-  version = "1.16.0";
+  version = "1.17.0";
 
   src =
     finalAttrs.passthru.sources.${stdenvNoCC.hostPlatform.system}
@@ -28,15 +28,15 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     sources = {
       "x86_64-linux" = fetchurl {
         url = "https://tideways.s3.amazonaws.com/daemon/${finalAttrs.version}/tideways-daemon_linux_amd64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-D9pD0SZsMzKLxf23w2sNHewYHXVbMxECQXuZY0yhV2o=";
+        hash = "sha256-ST1wQs2Z9/3fX95YAQqoHZjKsYtxPjR+VlUv3VJmESA=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://tideways.s3.amazonaws.com/daemon/${finalAttrs.version}/tideways-daemon_linux_aarch64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-0GIffwJ+AZsUniiVrkHNEtx2IThpu9zoamDsMeBsJHg=";
+        hash = "sha256-TswqlF8Nmc3zyzPnJNg5yMo2Y2gKJWBo7MdUMZfc7Ms=";
       };
       "aarch64-darwin" = fetchurl {
         url = "https://tideways.s3.amazonaws.com/daemon/${finalAttrs.version}/tideways-daemon_macos_arm64-${finalAttrs.version}.tar.gz";
-        hash = "sha256-MZkIdnQrfFU3i7HQg8MRmIX80PIkGQ1xeZorTP0X/mM=";
+        hash = "sha256-ePEJIJcG3745RVsXm4rvc6ZXVX2Ugv6fCoqezihV30M=";
       };
     };
     updateScript = "${
diff --git a/pkgs/by-name/to/tombi/package.nix b/pkgs/by-name/to/tombi/package.nix
index 3d205e921ce3..ab919e7c9498 100644
--- a/pkgs/by-name/to/tombi/package.nix
+++ b/pkgs/by-name/to/tombi/package.nix
@@ -9,19 +9,19 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tombi";
-  version = "0.9.24";
+  version = "0.10.4";
 
   src = fetchFromGitHub {
     owner = "tombi-toml";
     repo = "tombi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ucyBIq/47CoAZRRX9KmPfS6fTW1fdCLkC/M5mT2pNeA=";
+    hash = "sha256-Hs274ROPzyhVyvcvA7pDZ6+EELj4uUZylz94BoZNe6M=";
   };
 
   # Tests relies on the presence of network
   doCheck = false;
   cargoBuildFlags = [ "--package tombi-cli" ];
-  cargoHash = "sha256-kQB0vRj07lcX/Rzt+KTenD4NoK0BI0yc6D3V/ewT3Bk=";
+  cargoHash = "sha256-i7OeWuGLrDFjBhFjuygIZ35LbzENM39+cCwHJ98ECyQ=";
 
   postPatch = ''
     substituteInPlace Cargo.toml \
diff --git a/pkgs/by-name/to/tor/package.nix b/pkgs/by-name/to/tor/package.nix
index 34cd1257f932..18b20a0cbc3e 100644
--- a/pkgs/by-name/to/tor/package.nix
+++ b/pkgs/by-name/to/tor/package.nix
@@ -46,11 +46,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tor";
-  version = "0.4.9.6";
+  version = "0.4.9.7";
 
   src = fetchurl {
     url = "https://dist.torproject.org/tor-${finalAttrs.version}.tar.gz";
-    hash = "sha256-qJq6lwUumWOmVLQN8tRr4H6Ka24k5UN5F/2BrNkKcBc=";
+    hash = "sha256-WnQPMvaIrInAZjRcOLR7ooawxDlNNRslH/SLalOUYY8=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/tu/turn-rs/package.nix b/pkgs/by-name/tu/turn-rs/package.nix
index 33ef996f32d1..8b3a340e3ac1 100644
--- a/pkgs/by-name/tu/turn-rs/package.nix
+++ b/pkgs/by-name/tu/turn-rs/package.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   # Dependencies
   protobuf,
+  coturn,
   # Tests
   versionCheckHook,
   nix-update-script,
@@ -12,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "turn-rs";
-  version = "4.0.1";
+  version = "4.1.2";
 
   src = fetchFromGitHub {
     owner = "mycrl";
     repo = "turn-rs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CtDlkHHOkU0mwNiyP9PNw/40szBNKeGYvVep9Z/aoDg=";
+    hash = "sha256-YZPKcLePLX+Mdu4J31VNofiX/qCLjcxydc4iVhonhkU=";
   };
 
-  cargoHash = "sha256-x45GDuhxqoB/DZvccdzxBoS/7nnFvHtjkRgfM/LOOE8=";
+  cargoHash = "sha256-vvhj0B/KYdOeddALh38MvAwrg8sIAIlEzTj0yFNEjFk=";
 
   # By default, no features are enabled
   # https://github.com/mycrl/turn-rs?tab=readme-ov-file#features-1
@@ -31,6 +32,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     protobuf
   ];
 
+  # Fix coturn needed
+  nativeCheckInputs = [ coturn ];
+  env.COTURN_UCLIENT_PATH = lib.getExe' coturn "turnutils_uclient";
+
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
diff --git a/pkgs/by-name/ty/typesetter/package.nix b/pkgs/by-name/ty/typesetter/package.nix
index eff51f430621..6b637623a864 100644
--- a/pkgs/by-name/ty/typesetter/package.nix
+++ b/pkgs/by-name/ty/typesetter/package.nix
@@ -30,18 +30,19 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "typesetter";
-  version = "0.12.3";
+  version = "0.12.6";
+  __structuredAttrs = true;
 
   src = fetchFromCodeberg {
     owner = "haydn";
     repo = "typesetter";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-p2MKLcMtguz/oRrNenD+jlIJ62DYyDm0eW7bZ/FhajA=";
+    hash = "sha256-BN/gxJzJ2rjSztVWCid8y9NiHCqMVSQIW4b6VmjJGTo=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-vQQ9xMuzv+5DPXDw2GUXBwbkBf5YOFZwA05NwidRKzQ=";
+    hash = "sha256-6GM3c4Pq/U5dvpR8R/d78nwoWfbUQTwhjlCOhN5UG0s=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/ve/vespa-cli/package.nix b/pkgs/by-name/ve/vespa-cli/package.nix
new file mode 100644
index 000000000000..cea4b89a6b7e
--- /dev/null
+++ b/pkgs/by-name/ve/vespa-cli/package.nix
@@ -0,0 +1,82 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "vespa-cli";
+  version = "8.679.50";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "vespa-engine";
+    repo = "vespa";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-4tABoAA96HoYghIno0qbieYbE4EJZRmFIFDnoOoMIaA=";
+  };
+
+  # case-insensitive conflicts which produce platform `vendorHash` checksumm
+  proxyVendor = true;
+
+  sourceRoot = "${finalAttrs.src.name}/client/go";
+
+  vendorHash = "sha256-qC/8pIhsVbt9uUyLDiAW18tCUWDw3Agvmcx/CIUsCKQ=";
+
+  env.CGO_ENABLED = 0;
+
+  ldflags = [
+    "-s"
+    "-X github.com/vespa-engine/vespa/client/go/internal/build.Version=${finalAttrs.version}"
+  ];
+
+  checkFlags =
+    let
+      skippedTests = [
+        # these tests try to call home
+        "TestAuthShow/auth_show"
+        "TestDeployCloud"
+        "TestDeployCloudFastWait"
+        "TestDeployCloudUnauthorized"
+        "TestDestroy"
+        "TestLogCloud"
+        "TestProdDeploy"
+        "TestProdDeployInvalidZip"
+        "TestProdDeployWarnsOnInstance"
+        "TestProdDeployWithJava"
+        "TestProdDeployWithWait"
+        "TestProdDeployWithoutCertificate"
+        "TestProdDeployWithoutTests"
+        "TestSingleTestWithCloudAndEndpoints"
+        "TestSingleTestWithCloudAndTokenAuth"
+        "TestStatusCloudDeployment"
+        # tries to call home for most recent version but we have our own test
+        "TestVersion"
+        "TestVersionCheckHomebrew"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+  versionCheckProgramArg = "version";
+  versionCheckKeepEnvironment = [ "HOME" ];
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Command-line tool for Vespa.ai";
+    downloadPage = "https://github.com/vespa-engine/vespa/blob/v${finalAttrs.version}/client/go";
+    changelog = "https://github.com/vespa-engine/vespa/releases/tag/v${finalAttrs.version}";
+    homepage = "https://vespa.ai/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+    mainProgram = "vespa";
+  };
+})
diff --git a/pkgs/by-name/vi/vicinae/package.nix b/pkgs/by-name/vi/vicinae/package.nix
index d3c0625f96a9..69948d868bed 100644
--- a/pkgs/by-name/vi/vicinae/package.nix
+++ b/pkgs/by-name/vi/vicinae/package.nix
@@ -21,13 +21,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vicinae";
-  version = "0.20.14";
+  version = "0.20.15";
 
   src = fetchFromGitHub {
     owner = "vicinaehq";
     repo = "vicinae";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HfYLb4RdervjyJSrCdHJqyBov4Huej2wd5G1NBulTdQ=";
+    hash = "sha256-aUM+rSGb6liWdSBVABBwUKZXhsr5iUPq2QfnjkIsEVE=";
   };
 
   apiDeps = fetchNpmDeps {
diff --git a/pkgs/by-name/wa/wails/package.nix b/pkgs/by-name/wa/wails/package.nix
index e5a5be49d192..d44469727606 100644
--- a/pkgs/by-name/wa/wails/package.nix
+++ b/pkgs/by-name/wa/wails/package.nix
@@ -16,18 +16,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "wails";
-  version = "2.11.0";
+  version = "2.12.0";
 
   src = fetchFromGitHub {
     owner = "wailsapp";
     repo = "wails";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-H1Nml2vhCx4IB/CT+kDro5joAw8ewpxoQjDgvqamAr8=";
+    hash = "sha256-XngfbEbXhPRRKbNp/aaVCleISABTs90d5JjmwIq7nsk=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/v2";
 
-  vendorHash = "sha256-RgRrKok06HDg6j5tbOmtX9mOl/t6eXuCwQ2OhOXbHUU=";
+  vendorHash = "sha256-dmSH5I+bOErmtCxQdjkJXp1x2G5bpElL1VK6aZOv69I=";
 
   proxyVendor = true;
 
diff --git a/pkgs/by-name/wi/wireproxy/package.nix b/pkgs/by-name/wi/wireproxy/package.nix
index 241ed73364f7..f2416df91cc9 100644
--- a/pkgs/by-name/wi/wireproxy/package.nix
+++ b/pkgs/by-name/wi/wireproxy/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "wireproxy";
-  version = "1.0.10";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
-    owner = "pufferffish";
+    owner = "windtf";
     repo = "wireproxy";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-F8WatQsXgq3ex2uAy8eoS2DkG7uClNwZ74eG/mJN83o=";
+    hash = "sha256-R1G/VtyQsl7yoDwZw+24qTdeq//qYQTQwzAPvH8f+ls=";
   };
 
   ldflags = [
@@ -23,7 +23,7 @@ buildGoModule (finalAttrs: {
     "-X main.version=v${finalAttrs.version}"
   ];
 
-  vendorHash = "sha256-uCU5WLCKl5T4I1OccVl7WU0GM/t4RyAEmzHkJ22py30=";
+  vendorHash = "sha256-T6RN7f05bNVL7gfhaAR0+lKZWqXvMcgjiyPldCmmvU4=";
 
   passthru.tests.version = testers.testVersion {
     package = wireproxy;
@@ -33,7 +33,7 @@ buildGoModule (finalAttrs: {
 
   meta = {
     description = "Wireguard client that exposes itself as a socks5 proxy";
-    homepage = "https://github.com/pufferffish/wireproxy";
+    homepage = "https://github.com/windtf/wireproxy";
     license = lib.licenses.isc;
     maintainers = with lib.maintainers; [ _3JlOy-PYCCKUi ];
     mainProgram = "wireproxy";
diff --git a/pkgs/by-name/xh/xhtml1/package.nix b/pkgs/by-name/xh/xhtml1/package.nix
index 4d13bd1624dc..020abcab5419 100644
--- a/pkgs/by-name/xh/xhtml1/package.nix
+++ b/pkgs/by-name/xh/xhtml1/package.nix
@@ -33,5 +33,6 @@ stdenv.mkDerivation {
     homepage = "https://www.w3.org/TR/xhtml1/";
     description = "DTDs for XHTML 1.0, the Extensible HyperText Markup Language";
     platforms = lib.platforms.unix;
+    license = lib.licenses.w3c-19980720;
   };
 }
diff --git a/pkgs/by-name/xp/xpar/package.nix b/pkgs/by-name/xp/xpar/package.nix
index ad9b8a5a4e91..9306a857d44c 100644
--- a/pkgs/by-name/xp/xpar/package.nix
+++ b/pkgs/by-name/xp/xpar/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xpar";
-  version = "1.0";
+  version = "1.1";
 
   src = fetchFromGitHub {
     owner = "iczelia";
     repo = "xpar";
     rev = finalAttrs.version;
-    hash = "sha256-FCYZl8tllGvgoIE/u9lpQJANOfB7phyOegXk82EOzzM=";
+    hash = "sha256-uY+MAFJdjf6i2LlPqdEkUdTB+9OmV1MaVAIS8GbGKEI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ya/yara-x/package.nix b/pkgs/by-name/ya/yara-x/package.nix
index a6f171206bca..285c0af098f5 100644
--- a/pkgs/by-name/ya/yara-x/package.nix
+++ b/pkgs/by-name/ya/yara-x/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "yara-x";
-  version = "1.15.0";
+  version = "1.16.0";
 
   src = fetchFromGitHub {
     owner = "VirusTotal";
     repo = "yara-x";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-P0VxfsyjtgLNJcZMh+BHj7ujg/ReB4xycinfCS3NJyU=";
+    hash = "sha256-n/AhEKlQmjbTtPncal6NDn7BcXb4HfnkuJctvDjW2V0=";
   };
 
-  cargoHash = "sha256-FIZihLzpP9EhqQU/L6hKQQsMAhd1SsVzKap3GlghHSk=";
+  cargoHash = "sha256-MbMjrrPN1ctlYoE6R5p8g354OOmu4NplcGwSm3IcHRI=";
 
   env = {
     CARGO_PROFILE_RELEASE_LTO = "fat";
diff --git a/pkgs/by-name/yt/ytsub/package.nix b/pkgs/by-name/yt/ytsub/package.nix
new file mode 100644
index 000000000000..58ea052b356e
--- /dev/null
+++ b/pkgs/by-name/yt/ytsub/package.nix
@@ -0,0 +1,32 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  sqlite,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "ytsub";
+  version = "0.9.0";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "sarowish";
+    repo = "ytsub";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-6qPNSkUAj11Rut/Wx724UsFdRLwZh2Z+ZC7837CeNeQ=";
+  };
+
+  cargoHash = "sha256-RHOG43LTI3K0VzEpGsdSKheL1fjIZ1TyB6FCgoInUm8=";
+
+  buildInputs = [ sqlite ];
+
+  meta = {
+    description = "Subscriptions only TUI Youtube client";
+    homepage = "https://github.com/sarowish/ytsub";
+    changelog = "https://github.com/sarowish/ytsub/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ sarowish ];
+    mainProgram = "ytsub";
+  };
+})
diff --git a/pkgs/by-name/za/zapret2/package.nix b/pkgs/by-name/za/zapret2/package.nix
index 08f96106c855..c7c591cbba1e 100644
--- a/pkgs/by-name/za/zapret2/package.nix
+++ b/pkgs/by-name/za/zapret2/package.nix
@@ -20,7 +20,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zapret2";
-  version = "0.9.5.1";
+  version = "0.9.5.2";
 
   outputs = [
     "out"
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "bol-van";
     repo = "zapret2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uKLHzsi/AYQ8OLj2g8pszSCyD485Sg/s45Ko8gKN5z8=";
+    hash = "sha256-U2Sfm+51QwlBWZGCDwClVeXJrwssoA6tchc/FP+kyF8=";
     leaveDotGit = true;
     postFetch = ''
       cd "$out"
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index ee17f813df39..87529fbae590 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -97,7 +97,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "1.0.0";
+  version = "1.1.5";
 
   outputs = [
     "out"
@@ -110,7 +110,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-D5V0pvL3WCwhcC8dnNKTXRdnFq8LMZZ0/GDjw8xf95g=";
+    hash = "sha256-jY73pkncs351ssZOho7fXcr0bKvQ9UynGEjfKTFFnik=";
   };
 
   postPatch = ''
@@ -139,7 +139,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm -r $out/git/*/candle-book/
   '';
 
-  cargoHash = "sha256-xtw7r7VluCEqXWKnxpVk8BPqr+mJV5rB3Eq/PvsKPBk=";
+  cargoHash = "sha256-uQMjh7JdpjcXYBO8GE6ZI24G13qS43AjM4mgmXEn4V4=";
 
   __structuredAttrs = true;
 
diff --git a/pkgs/by-name/zo/zoom-us/package.nix b/pkgs/by-name/zo/zoom-us/package.nix
index 656b646e8b67..d811819729b7 100644
--- a/pkgs/by-name/zo/zoom-us/package.nix
+++ b/pkgs/by-name/zo/zoom-us/package.nix
@@ -54,25 +54,25 @@ let
   # Zoom versions are released at different times per platform and often with different versions.
   # We write them on three lines like this (rather than using {}) so that the updater script can
   # find where to edit them.
-  versions.aarch64-darwin = "6.7.5.75246";
-  versions.x86_64-darwin = "6.7.5.75246";
+  versions.aarch64-darwin = "7.0.0.77593";
+  versions.x86_64-darwin = "7.0.0.77593";
 
   # This is the fallback version so that evaluation can produce a meaningful result.
-  versions.x86_64-linux = "6.7.5.6891";
+  versions.x86_64-linux = "7.0.0.1666";
 
   srcs = {
     aarch64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.aarch64-darwin}/zoomusInstallerFull.pkg?archType=arm64";
       name = "zoomusInstallerFull.pkg";
-      hash = "sha256-oNeoW7WNq9ES4lJjc+zGrQs/yJ2E7DSsh33hEiU1RSE=";
+      hash = "sha256-YSUaM8YAJHigm4M9W34/bD164M8f/hbhtcmHyUwFN20=";
     };
     x86_64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-darwin}/zoomusInstallerFull.pkg";
-      hash = "sha256-2D8Q0rRluBM0UpXL5QN3a67b0X1iIW67YWZvVqsl4Qg=";
+      hash = "sha256-jIKBCrnvF101WJm8Tcpi2R5jRsqRXH7NQVGkSTnAeMA=";
     };
     x86_64-linux = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-linux}/zoom_x86_64.pkg.tar.xz";
-      hash = "sha256-Qy4o3vbgiAjKUGWMFi8rNqyDAohG7TgwX69jKVWTWeY=";
+      hash = "sha256-aPQ44znQfxcjGnUpON5RRj3+SG+IDaBa/s0khwj/AIo=";
     };
   };
 
@@ -148,7 +148,6 @@ let
       maintainers = with lib.maintainers; [
         philiptaron
         ryan4yin
-        yarny
       ];
       mainProgram = "zoom";
     };
@@ -160,41 +159,37 @@ let
     pkgs:
     [
       pkgs.alsa-lib
-      pkgs.at-spi2-atk
-      pkgs.at-spi2-core
       pkgs.atk
       pkgs.cairo
-      pkgs.coreutils
       pkgs.cups
       pkgs.dbus
       pkgs.expat
       pkgs.fontconfig
       pkgs.freetype
-      pkgs.gdk-pixbuf
       pkgs.glib
-      pkgs.glib.dev
       pkgs.gtk3
+      pkgs.ibus
       pkgs.libGL
       pkgs.libGLU
+      pkgs.libatomic_ops
       pkgs.libdrm
       pkgs.libgbm
       pkgs.libkrb5
+      pkgs.libsm
+      pkgs.libxi
       pkgs.libxkbcommon
+      pkgs.libxslt
+      pkgs.mesa
+      pkgs.mesa-demos
       pkgs.nspr
       pkgs.nss
       pkgs.pango
       pkgs.pciutils
       pkgs.pipewire
-      pkgs.procps
-      pkgs.qt5.qt3d
-      pkgs.qt5.qtgamepad
-      pkgs.qt5.qtlottie
-      pkgs.qt5.qtmultimedia
-      pkgs.qt5.qtremoteobjects
-      pkgs.qt5.qtxmlpatterns
+      pkgs.qt6.qtbase
+      pkgs.qt6.qtdeclarative
       pkgs.stdenv.cc.cc
       pkgs.udev
-      pkgs.util-linux
       pkgs.wayland
       pkgs.libx11
       pkgs.libxcomposite
@@ -212,6 +207,7 @@ let
       pkgs.libxcb-render-util
       pkgs.libxcb-wm
       pkgs.zlib
+      pkgs.zstd
     ]
     ++ lib.optionals pulseaudioSupport [
       pkgs.libpulseaudio
diff --git a/pkgs/desktops/pantheon/apps/switchboard-plugs/sound/default.nix b/pkgs/desktops/pantheon/apps/switchboard-plugs/sound/default.nix
index 8786dfb99f66..46a0428974fb 100644
--- a/pkgs/desktops/pantheon/apps/switchboard-plugs/sound/default.nix
+++ b/pkgs/desktops/pantheon/apps/switchboard-plugs/sound/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "switchboard-plug-sound";
-  version = "8.0.2";
+  version = "8.0.3";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "settings-sound";
     tag = version;
-    hash = "sha256-eemNFGTh/QQJst04t+fzyDkowpAVRQpMS8EFUiLIMok=";
+    hash = "sha256-jiaxb8aQuGrPcIaR28L2i2J3z4eL+OdrbCJ/abuXvuY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/ecl/default.nix b/pkgs/development/compilers/ecl/default.nix
index 12f086072b2a..e1abbcf34c4c 100644
--- a/pkgs/development/compilers/ecl/default.nix
+++ b/pkgs/development/compilers/ecl/default.nix
@@ -24,30 +24,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "ecl";
-  version = "26.3.27";
+  version = "26.5.5";
 
   src = fetchurl {
     url = "https://common-lisp.net/project/ecl/static/files/release/ecl-${version}.tgz";
-    hash = "sha256-QW1XB78R0rPY0z1nkUGaeG5MxZrAzD7FBe5ZtRqfXJo=";
+    hash = "sha256-oBpbzajFtz5Z3aNJT9E+X+xdtqodrXgsPMO7V/FjNDU=";
   };
 
-  patches = [
-    # https://gitlab.com/embeddable-common-lisp/ecl/-/merge_requests/370
-    (fetchpatch {
-      name = "allocate-first_env-dynamically.patch";
-      url = "https://gitlab.com/embeddable-common-lisp/ecl/-/commit/61a14dfc6681f674ae5673856c0749fdf4af6564.patch";
-      hash = "sha256-DOn0mtlW1Bl59LxqEQiE90ZJlXDSbTbxL0s8NNL882o=";
-      includes = [ "src/c/main.d" ];
-    })
-
-    # https://gitlab.com/embeddable-common-lisp/ecl/-/work_items/838
-    (fetchpatch {
-      name = "clang-miscompilation.patch";
-      url = "https://gitlab.com/embeddable-common-lisp/ecl/-/commit/d39cc449f770c52cc4c8b297cf600d7bd53d172a.patch";
-      hash = "sha256-C+zVjAY/+hQ4Te62DQxIQsHu0AqewygmSEQpcmrA5EU=";
-    })
-  ];
-
   nativeBuildInputs = [
     libtool
     autoconf
diff --git a/pkgs/development/compilers/haxe/default.nix b/pkgs/development/compilers/haxe/default.nix
index 953949b949a0..370163a096f4 100644
--- a/pkgs/development/compilers/haxe/default.nix
+++ b/pkgs/development/compilers/haxe/default.nix
@@ -10,12 +10,13 @@
   pcre2,
   neko,
   mbedtls_2,
+  mbedtls,
 }:
 let
   ocamlDependencies =
     version:
     if lib.versionAtLeast version "4.3" then
-      with ocaml-ng.ocamlPackages_4_14;
+      with ocaml-ng.ocamlPackages;
       [
         ocaml
         findlib
@@ -24,7 +25,7 @@ let
         ptmap
         camlp5
         sha
-        luv-0-5-12
+        luv
         extlib
       ]
     else
@@ -41,17 +42,10 @@ let
         extlib-1-7-7
       ];
 
-  defaultPatch = ''
-    substituteInPlace extra/haxelib_src/src/haxelib/client/Main.hx \
-      --replace '"neko"' '"${neko}/bin/neko"'
-  '';
-
   generic =
     {
       hash,
       version,
-      prePatch ? defaultPatch,
-      patches ? [ ],
     }:
     stdenv.mkDerivation {
       pname = "haxe";
@@ -63,7 +57,9 @@ let
         dune
       ]
       ++ (if lib.versionAtLeast version "4.3" then [ pcre2 ] else [ pcre ])
-      ++ lib.optional (lib.versionAtLeast version "4.1") mbedtls_2
+      ++ lib.optional (lib.versionAtLeast version "4.1") (
+        if lib.versionAtLeast version "4.3" then mbedtls else mbedtls_2
+      )
       ++ ocamlDependencies version;
 
       src = fetchFromGitHub {
@@ -74,7 +70,10 @@ let
         inherit hash;
       };
 
-      inherit prePatch patches;
+      prePatch = ''
+        substituteInPlace extra/haxelib_src/src/haxelib/client/Main.hx \
+          --replace-fail '"neko"' '"${neko}/bin/neko"'
+      '';
 
       buildFlags = [
         "all"
@@ -160,8 +159,7 @@ in
     hash = "sha256-QP5/jwexQXai1A5Iiwiyrm+/vkdAc+9NVGt+jEQz2mY=";
   };
   haxe_4_3 = generic {
-    version = "4.3.6";
-    hash = "sha256-m/A0xxB3fw+syPmH1GPKKCcj0a2G/HMRKOu+FKrO5jQ=";
-    patches = [ ./extlib-1.8.0.patch ];
+    version = "4.3.7";
+    hash = "sha256-sQb7MCoH2dZOvNmDQ9P0yFYrSXYOMn4FS/jlyjth39Y=";
   };
 }
diff --git a/pkgs/development/compilers/haxe/extlib-1.8.0.patch b/pkgs/development/compilers/haxe/extlib-1.8.0.patch
deleted file mode 100644
index c95448f830ac..000000000000
--- a/pkgs/development/compilers/haxe/extlib-1.8.0.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-diff --git a/src/context/typecore.ml b/src/context/typecore.ml
-index dc38a5264..0c3ebde9f 100644
---- a/src/context/typecore.ml
-+++ b/src/context/typecore.ml
-@@ -294,7 +294,7 @@ let add_local ctx k n t p =
- 			begin try
- 				let v' = PMap.find n ctx.locals in
- 				(* ignore std lib *)
--				if not (List.exists (ExtLib.String.starts_with p.pfile) ctx.com.std_path) then begin
-+				if not (List.exists (ExtLib.String.starts_with ~prefix:p.pfile) ctx.com.std_path) then begin
- 					warning ctx WVarShadow "This variable shadows a previously declared variable" p;
- 					warning ~depth:1 ctx WVarShadow (compl_msg "Previous variable was here") v'.v_pos
- 				end
-diff --git a/src/optimization/dce.ml b/src/optimization/dce.ml
-index 4e7b1fc98..90d8fc5d6 100644
---- a/src/optimization/dce.ml
-+++ b/src/optimization/dce.ml
-@@ -76,7 +76,7 @@ let overrides_extern_field cf c =
- 	loop c cf
- 
- let is_std_file dce file =
--	List.exists (ExtString.String.starts_with file) dce.std_dirs
-+	List.exists (ExtString.String.starts_with ~prefix:file) dce.std_dirs
- 
- let keep_metas = [Meta.Keep;Meta.Expose]
- 
diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index e75e834bab87..3dcc77a981bc 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -26,7 +26,7 @@ let
     "19.1.7".officialRelease.sha256 = "sha256-cZAB5vZjeTsXt9QHbP5xluWNQnAHByHtHnAhVDV0E6I=";
     "20.1.8".officialRelease.sha256 = "sha256-ysyB/EYxi2qE9fD5x/F2zI4vjn8UDoo1Z9ukiIrjFGw=";
     "21.1.8".officialRelease.sha256 = "sha256-pgd8g9Yfvp7abjCCKSmIn1smAROjqtfZaJkaUkBSKW0=";
-    "22.1.2".officialRelease.sha256 = "sha256-z6YcxgDd3F3JwfU5Y/wMw5MK+ZPISI3KLwHwUaraTuw=";
+    "22.1.5".officialRelease.sha256 = "sha256-eunfMOH+HVpefZJ+CG7hXDoM+pi6iYvHpD3DoSAsjoE=";
     "23.0.0-git".gitRelease = {
       rev = "cd6119c00b461c36139f1f4a0ca1653a6ab2a32b";
       rev-version = "23.0.0-unstable-2026-05-03";
diff --git a/pkgs/development/compilers/mrustc/default.nix b/pkgs/development/compilers/mrustc/default.nix
index c08248d9b5fc..aa400a99de2a 100644
--- a/pkgs/development/compilers/mrustc/default.nix
+++ b/pkgs/development/compilers/mrustc/default.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "0.11.2";
+  version = "0.12.0";
   tag = "v${version}";
   rev = "b6754f574f8846eb842feba4ccbeeecb10bdfacc";
 in
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     owner = "thepowersgang";
     repo = "mrustc";
     rev = tag;
-    hash = "sha256-HW9+2mXri3ismeNeaDoTsCY6lxeH8AELegk+YbIn7Jw=";
+    hash = "sha256-wqHTTnk9c1khLsN6e0v703tUoTlpncMwZPXTKEVZ33s=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/coq-modules/compcert/default.nix b/pkgs/development/coq-modules/compcert/default.nix
index d1c39ed6abd4..feed65d9a66d 100644
--- a/pkgs/development/coq-modules/compcert/default.nix
+++ b/pkgs/development/coq-modules/compcert/default.nix
@@ -4,7 +4,6 @@
   coq,
   flocq,
   MenhirLib,
-  ocamlPackages,
   fetchpatch,
   makeWrapper,
   coq2html,
@@ -71,7 +70,7 @@ let
 
     strictDeps = true;
 
-    nativeBuildInputs = with ocamlPackages; [
+    nativeBuildInputs = with coq.ocamlPackages; [
       makeWrapper
       ocaml
       findlib
@@ -79,7 +78,7 @@ let
       coq
       coq2html
     ];
-    buildInputs = with ocamlPackages; [ menhirLib ];
+    buildInputs = with coq.ocamlPackages; [ menhirLib ];
     propagatedBuildInputs = [
       flocq
       MenhirLib
diff --git a/pkgs/development/coq-modules/graph-theory/default.nix b/pkgs/development/coq-modules/graph-theory/default.nix
index cafa0793461d..31bfcba6394d 100644
--- a/pkgs/development/coq-modules/graph-theory/default.nix
+++ b/pkgs/development/coq-modules/graph-theory/default.nix
@@ -52,10 +52,12 @@ mkCoqDerivation {
     mathcomp.algebra
     mathcomp-finmap
     mathcomp.fingroup
-    mathcomp-algebra-tactics
     fourcolor
     stdlib
-  ];
+  ]
+  ++ lib.optional (
+    mathcomp.version != "dev" && lib.versions.isLe "2.5" mathcomp.version
+  ) mathcomp-algebra-tactics;
 
   meta = {
     description = "Library of formalized graph theory results in Coq";
diff --git a/pkgs/development/coq-modules/jasmin/default.nix b/pkgs/development/coq-modules/jasmin/default.nix
index ac01c30397b6..b8f0bf4d8d08 100644
--- a/pkgs/development/coq-modules/jasmin/default.nix
+++ b/pkgs/development/coq-modules/jasmin/default.nix
@@ -38,9 +38,11 @@
   release."2024.07.2".sha256 = "sha256-aF8SYY5jRxQ6iEr7t6mRN3BEmIDhJ53PGhuZiJGB+i8=";
 
   propagatedBuildInputs = [
-    mathcomp-algebra-tactics
     mathcomp-word
-  ];
+  ]
+  ++ lib.optional (
+    mathcomp.version != "dev" && lib.versions.isLe "2.5" mathcomp.version
+  ) mathcomp-algebra-tactics;
 
   makeFlags = [
     "-C"
diff --git a/pkgs/development/coq-modules/mathcomp-algebra-tactics/default.nix b/pkgs/development/coq-modules/mathcomp-algebra-tactics/default.nix
index cc2f839e0cca..e0f15fcb301e 100644
--- a/pkgs/development/coq-modules/mathcomp-algebra-tactics/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-algebra-tactics/default.nix
@@ -32,13 +32,13 @@ mkCoqDerivation {
     lib.switch
       [ coq.coq-version mathcomp-algebra.version ]
       [
-        (case (range "8.20" "9.1") (isGe "2.4") "1.2.7")
-        (case (range "8.20" "9.1") (isGe "2.4") "1.2.6")
-        (case (range "8.20" "9.1") (isGe "2.4") "1.2.5")
-        (case (range "8.16" "9.0") (isGe "2.0") "1.2.4")
-        (case (range "8.16" "8.18") (isGe "2.0") "1.2.2")
-        (case (range "8.16" "8.19") (isGe "1.15") "1.1.1")
-        (case (range "8.13" "8.16") (isGe "1.12") "1.0.0")
+        (case (range "8.20" "9.1") (range "2.4" "2.5") "1.2.7")
+        (case (range "8.20" "9.1") (range "2.4" "2.4") "1.2.6")
+        (case (range "8.20" "9.1") (range "2.4" "2.4") "1.2.5")
+        (case (range "8.16" "9.0") (range "2.0" "2.3") "1.2.4")
+        (case (range "8.16" "8.18") (range "2.0" "2.2") "1.2.2")
+        (case (range "8.16" "8.19") (range "1.15" "1.19") "1.1.1")
+        (case (range "8.13" "8.16") (range "1.12" "1.17") "1.0.0")
       ]
       null;
 
diff --git a/pkgs/development/coq-modules/mathcomp-infotheo/default.nix b/pkgs/development/coq-modules/mathcomp-infotheo/default.nix
index 3a9684e54349..cd038af428a2 100644
--- a/pkgs/development/coq-modules/mathcomp-infotheo/default.nix
+++ b/pkgs/development/coq-modules/mathcomp-infotheo/default.nix
@@ -1,6 +1,7 @@
 {
   coq,
   mkCoqDerivation,
+  mathcomp,
   mathcomp-analysis,
   mathcomp-analysis-stdlib,
   mathcomp-algebra-tactics,
@@ -71,6 +72,10 @@
   (o: {
     propagatedBuildInputs =
       o.propagatedBuildInputs
-      ++ lib.optional (lib.versions.isGe "0.6.1" o.version || o.version == "dev") mathcomp-algebra-tactics
+      ++ lib.optional (
+        mathcomp.version != "dev"
+        && lib.versions.isLe "2.5" mathcomp.version
+        && (lib.versions.isGe "0.6.1" o.version || o.version == "dev")
+      ) mathcomp-algebra-tactics
       ++ lib.optional (lib.versions.isGe "0.7.2" o.version || o.version == "dev") interval;
   })
diff --git a/pkgs/development/coq-modules/mathcomp/default.nix b/pkgs/development/coq-modules/mathcomp/default.nix
index 943d4b67a418..6cc86368fcfb 100644
--- a/pkgs/development/coq-modules/mathcomp/default.nix
+++ b/pkgs/development/coq-modules/mathcomp/default.nix
@@ -256,7 +256,7 @@ if coq.rocqPackages ? mathcomp && version != "2.3.0" && version != "2.4.0" then
         fetchzip
         hierarchy-builder
         ;
-      inherit (coq.rocqPackages) rocq-core;
+      inherit (coq.rocqPackages) rocq-core micromega-plugin;
     };
   in
   mc
diff --git a/pkgs/development/php-packages/grpc/default.nix b/pkgs/development/php-packages/grpc/default.nix
index c96c6090a097..25b9b57057e4 100644
--- a/pkgs/development/php-packages/grpc/default.nix
+++ b/pkgs/development/php-packages/grpc/default.nix
@@ -27,6 +27,5 @@ buildPecl {
     homepage = "https://github.com/grpc/grpc/tree/master/src/php/ext/grpc";
     license = lib.licenses.asl20;
     teams = [ lib.teams.php ];
-    broken = lib.versionAtLeast php.version "8.5";
   };
 }
diff --git a/pkgs/development/python-modules/afdko/default.nix b/pkgs/development/python-modules/afdko/default.nix
index a2bb7f770f32..c1df13372fc1 100644
--- a/pkgs/development/python-modules/afdko/default.nix
+++ b/pkgs/development/python-modules/afdko/default.nix
@@ -100,13 +100,19 @@ buildPythonPackage (finalAttrs: {
   ++ fonttools.optional-dependencies.unicode
   ++ fonttools.optional-dependencies.woff;
 
+  postInstall = ''
+    # clean up the install directory
+    # 5.0.0 release revamps the build system and hopefully makes this unnecessary
+    rm -r $out/{_skbuild,c,tests}
+  '';
+
   nativeCheckInputs = [ pytestCheckHook ];
 
   preCheck = ''
     export PATH=$PATH:$out/bin
 
     # Remove build artifacts to prevent them from messing with the tests
-    rm -rf _skbuild
+    rm -r _skbuild
   '';
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/aioesphomeapi/default.nix b/pkgs/development/python-modules/aioesphomeapi/default.nix
index 11cc614d17a5..68331992f98a 100644
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@@ -26,16 +26,21 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aioesphomeapi";
-  version = "44.13.3";
+  version = "44.23.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "esphome";
     repo = "aioesphomeapi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PCCz12AAZuhDzqgJGhYpncr2ICN6xWefi/s9icbMSck=";
+    hash = "sha256-mKk4NO44mVTV5Fe8oDhQYcNp8V1OLsPt4xk+kztXwrM=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "setuptools>=82.0.1" setuptools
+  '';
+
   build-system = [
     setuptools
     cython
diff --git a/pkgs/development/python-modules/aiovodafone/default.nix b/pkgs/development/python-modules/aiovodafone/default.nix
index bfa99bbc2a50..cb4b5a5beffc 100644
--- a/pkgs/development/python-modules/aiovodafone/default.nix
+++ b/pkgs/development/python-modules/aiovodafone/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aiovodafone";
-  version = "3.1.3";
+  version = "3.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "chemelli74";
     repo = "aiovodafone";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wgoPL/G9wPshhydHSFpSAFKiiFy/UacVbQ7mdcEuit0=";
+    hash = "sha256-CZz/rRRgZwP7gowYORkt8j99mU0CMgOX+M1JExvFNDI=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/airos/default.nix b/pkgs/development/python-modules/airos/default.nix
index 75d6b2b65c88..530aa8608b31 100644
--- a/pkgs/development/python-modules/airos/default.nix
+++ b/pkgs/development/python-modules/airos/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "airos";
-  version = "0.6.4";
+  version = "0.6.5";
   pyproject = true;
 
   disabled = pythonOlder "3.13";
@@ -23,7 +23,7 @@ buildPythonPackage (finalAttrs: {
     owner = "CoMPaTech";
     repo = "python-airos";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PXi4wZv8BcEdFcFvrlxryrp3JTEjDXydnkEKMud8IJc=";
+    hash = "sha256-B94YeY6R+83xo9+tmUbgJNi6AvBZ7h4C9VxovPVOL9E=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/apache-tvm-ffi/default.nix b/pkgs/development/python-modules/apache-tvm-ffi/default.nix
index bc9c5e9704f1..8344d888b80c 100644
--- a/pkgs/development/python-modules/apache-tvm-ffi/default.nix
+++ b/pkgs/development/python-modules/apache-tvm-ffi/default.nix
@@ -21,15 +21,16 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "apache-tvm-ffi";
-  version = "0.1.10";
+  version = "0.1.11";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "apache";
     repo = "tvm-ffi";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-qVO0SOs8eQh+Rl853XJuYIXY6Kis4HqATxhDBAhtxsI=";
+    hash = "sha256-dqAO6RLLGIRzPk7dNQsQCck+ziyONddhK/t4+S28cn8=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/arxiv/default.nix b/pkgs/development/python-modules/arxiv/default.nix
index e1bba8218a19..e76c832ac707 100644
--- a/pkgs/development/python-modules/arxiv/default.nix
+++ b/pkgs/development/python-modules/arxiv/default.nix
@@ -17,14 +17,14 @@
 }:
 buildPythonPackage rec {
   pname = "arxiv";
-  version = "2.4.1";
+  version = "3.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lukasschwab";
     repo = "arxiv.py";
     tag = version;
-    hash = "sha256-3GQ0HBYwkKlZ5WNgbJI/gHNi800WlnZiAJB6aSVBvjo=";
+    hash = "sha256-o2Vqkr5Tlx7Iv1NEWDSU8X6hvlGUslIl4oHiRQNGdqI=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/bellows/default.nix b/pkgs/development/python-modules/bellows/default.nix
index 3f85644f13bc..05c0359b0b28 100644
--- a/pkgs/development/python-modules/bellows/default.nix
+++ b/pkgs/development/python-modules/bellows/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "bellows";
-  version = "0.49.0";
+  version = "0.49.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "zigpy";
     repo = "bellows";
     tag = version;
-    hash = "sha256-haWej3ZcUPd9Rpqf2PH8r0useylnLDaPiSctrwLz71Q=";
+    hash = "sha256-dt4cwew/jRpmXaZORfjNCivUMynFbRJITOnmP34Aq+I=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/brax/default.nix b/pkgs/development/python-modules/brax/default.nix
index d74a839c505a..49ff253f84d1 100644
--- a/pkgs/development/python-modules/brax/default.nix
+++ b/pkgs/development/python-modules/brax/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  stdenv,
 
   # build-system
   hatchling,
@@ -108,11 +107,12 @@ buildPythonPackage (finalAttrs: {
     "test_convex_convex"
     "test_dumps"
     "test_dumps_invalidstate_raises"
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isAarch64 [
+
     # Flaky:
     # AssertionError: Array(-0.00135638, dtype=float32) != 0.0 within 0.001 delta (Array(0.00135638, dtype=float32) difference)
     "test_pendulum_period2"
+    # AssertionError: Array(837.4592, dtype=float32) not greater than 990.0
+    "testSpeed1"
   ];
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/casaconfig/default.nix b/pkgs/development/python-modules/casaconfig/default.nix
new file mode 100644
index 000000000000..5b0040af4b1a
--- /dev/null
+++ b/pkgs/development/python-modules/casaconfig/default.nix
@@ -0,0 +1,30 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  certifi,
+}:
+buildPythonPackage (finalAttrs: {
+  pname = "casaconfig";
+  version = "1.5.0";
+
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-/O0rzef1Yqn+ezjTWfe1oRIh6FyU1W3Ev9tuXldukys=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ certifi ];
+
+  meta = {
+    description = "Reference data and converters for CASA operation";
+    homepage = "https://casa.nrao.edu/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ kiranshila ];
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/development/python-modules/casatasks/default.nix b/pkgs/development/python-modules/casatasks/default.nix
new file mode 100644
index 000000000000..f778b3340490
--- /dev/null
+++ b/pkgs/development/python-modules/casatasks/default.nix
@@ -0,0 +1,106 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchgit,
+  fetchurl,
+  common-updater-scripts,
+  curl,
+  gnugrep,
+  gnused,
+  writeShellScript,
+  jdk,
+  wheel,
+  casatools,
+  casaconfig,
+  matplotlib,
+  scipy,
+  certifi,
+  pyerfa,
+  setuptools,
+  pipInstallHook,
+}:
+buildPythonPackage (finalAttrs: {
+  pname = "casatasks";
+  version = "6.7.5.18";
+
+  src = fetchgit {
+    url = "https://open-bitbucket.nrao.edu/scm/casa/casa6.git";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-75oIlaNAyu70KWSjz38LoYAvV7RJgzH/X9uBnGpriF4=";
+    fetchSubmodules = false;
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/casatasks";
+
+  format = "other";
+
+  nativeBuildInputs = [
+    jdk
+    wheel
+    setuptools
+    pipInstallHook
+  ];
+
+  propagatedBuildInputs = [
+    casatools
+    casaconfig
+    matplotlib
+    scipy
+    certifi
+    pyerfa
+  ];
+
+  jarName = "xml-casa-assembly-1.88.jar";
+
+  xml_jar = fetchurl {
+    url = "http://casa.nrao.edu/download/devel/xml-casa/java/${finalAttrs.jarName}";
+    hash = "sha256-UJCiXLXAe7Prm1qGXJ9jbuZcgKhPTSrU8qnf4C5Goxs="; # xml-jar
+  };
+
+  postPatch = ''
+    mkdir -p java
+    cp ${finalAttrs.xml_jar} java/${finalAttrs.jarName}
+  '';
+
+  buildPhase = ''
+      runHook preBuild
+      export HOME=$(mktemp -d)
+      mkdir -p $HOME/.casa/data
+      cat > $HOME/.casa/config.py <<EOF
+    measures_auto_update=False
+    data_auto_update=False
+    EOF
+      python setup.py bdist_wheel --version ${finalAttrs.version}
+      runHook postBuild
+  '';
+
+  # Tests require a full CASA data directory and network access
+  doCheck = false;
+
+  passthru.updateScript = writeShellScript "update-casatasks" ''
+    set -euo pipefail
+    version=$(${lib.getExe curl} -s https://pypi.org/pypi/casatasks/json | ${lib.getExe gnugrep} -oP '"version"\s*:\s*"\K[^"]+' | head -1)
+    ${lib.getExe' common-updater-scripts "update-source-version"} python3Packages.casatasks "$version"
+
+    # Extract the jar filename from the xml-casa script at the new tag
+    jar_name=$(${lib.getExe curl} -s \
+      "https://open-bitbucket.nrao.edu/rest/api/1.0/projects/CASA/repos/casa6/raw/casatools/scripts/xml-casa?at=refs/tags/$version" | \
+      ${lib.getExe gnugrep} -oP '(?<=jarfile_name = ").*(?=")')
+    jar_url="http://casa.nrao.edu/download/devel/xml-casa/java/$jar_name"
+    jar_sri=$(nix-prefetch-url --type sha256 "$jar_url" | xargs nix hash convert --hash-algo sha256 --to sri)
+
+    nix_file=pkgs/development/python-modules/casatasks/default.nix
+    ${lib.getExe gnused} -i \
+      -e "s|xml-casa-assembly-[^ \"]*\.jar|$jar_name|" \
+      -e "s|hash = \"sha256-.*\"; # xml-jar|hash = \"$jar_sri\"; # xml-jar|" \
+      "$nix_file"
+  '';
+
+  meta = {
+    description = "High-level Python tasks for radio astronomy data reduction";
+    homepage = "https://casa.nrao.edu/";
+    license = lib.licenses.lgpl2Only;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ kiranshila ];
+  };
+})
diff --git a/pkgs/development/python-modules/casatools/default.nix b/pkgs/development/python-modules/casatools/default.nix
new file mode 100644
index 000000000000..868891e5dc4a
--- /dev/null
+++ b/pkgs/development/python-modules/casatools/default.nix
@@ -0,0 +1,113 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchgit,
+  fetchurl,
+  common-updater-scripts,
+  curl,
+  gnugrep,
+  gnused,
+  writeShellScript,
+  cmake,
+  pkg-config,
+  swig,
+  flex,
+  bison,
+  gfortran,
+  jdk,
+  setuptools,
+  wheel,
+  build,
+  numpy,
+  casaconfig,
+  casacpp,
+  xercesc,
+  grpc,
+  readline,
+}:
+buildPythonPackage (finalAttrs: {
+  pname = "casatools";
+  version = "6.7.5.18";
+
+  src = fetchgit {
+    url = "https://open-bitbucket.nrao.edu/scm/casa/casa6.git";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-75oIlaNAyu70KWSjz38LoYAvV7RJgzH/X9uBnGpriF4=";
+    fetchSubmodules = false;
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/casatools";
+
+  format = "pyproject";
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    swig
+    flex
+    bison
+    gfortran
+    jdk
+    grpc
+    setuptools
+    wheel
+    build
+  ];
+
+  dontConfigure = true;
+
+  buildInputs = [
+    casacpp
+    xercesc
+    readline
+  ];
+
+  propagatedBuildInputs = [
+    numpy
+    casaconfig
+  ];
+
+  jarName = "xml-casa-assembly-1.88.jar";
+
+  xml_jar = fetchurl {
+    url = "http://casa.nrao.edu/download/devel/xml-casa/java/${finalAttrs.jarName}";
+    hash = "sha256-UJCiXLXAe7Prm1qGXJ9jbuZcgKhPTSrU8qnf4C5Goxs="; # xml-jar
+  };
+
+  postPatch = ''
+    mkdir -p scripts/java
+    cp ${finalAttrs.xml_jar} scripts/java/${finalAttrs.jarName}
+    echo "${finalAttrs.version} ${finalAttrs.version}" > version.txt
+    sed -i 's/def compute_version():/def compute_version():\n    return "${finalAttrs.version}"\ndef _compute_version_orig():/' setup.py
+  '';
+
+  # Tests require a full CASA data directory and network access
+  doCheck = false;
+
+  passthru.updateScript = writeShellScript "update-casatools" ''
+    set -euo pipefail
+    version=$(${lib.getExe curl} -s https://pypi.org/pypi/casatools/json | ${lib.getExe gnugrep} -oP '"version"\s*:\s*"\K[^"]+' | head -1)
+    ${lib.getExe' common-updater-scripts "update-source-version"} python3Packages.casatools "$version"
+
+    # Extract the jar filename from the xml-casa script at the new tag
+    jar_name=$(${lib.getExe curl} -s \
+      "https://open-bitbucket.nrao.edu/rest/api/1.0/projects/CASA/repos/casa6/raw/casatools/scripts/xml-casa?at=refs/tags/$version" | \
+      ${lib.getExe gnugrep} -oP '(?<=jarfile_name = ").*(?=")')
+    jar_url="http://casa.nrao.edu/download/devel/xml-casa/java/$jar_name"
+    jar_sri=$(nix-prefetch-url --type sha256 "$jar_url" | xargs nix hash convert --hash-algo sha256 --to sri)
+
+    nix_file=pkgs/development/python-modules/casatools/default.nix
+    ${lib.getExe gnused} -i \
+      -e "s|xml-casa-assembly-[^ \"]*\.jar|$jar_name|" \
+      -e "s|hash = \"sha256-.*\"; # xml-jar|hash = \"$jar_sri\"; # xml-jar|" \
+      "$nix_file"
+  '';
+
+  meta = {
+    description = "Python interface to core radio astronomy data processing routines";
+    homepage = "https://casa.nrao.edu/";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ kiranshila ];
+  };
+})
diff --git a/pkgs/development/python-modules/cuda-pathfinder/default.nix b/pkgs/development/python-modules/cuda-pathfinder/default.nix
index ded37abf88cd..d70070d20644 100644
--- a/pkgs/development/python-modules/cuda-pathfinder/default.nix
+++ b/pkgs/development/python-modules/cuda-pathfinder/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "cuda-pathfinder";
-  version = "1.5.3";
+  version = "1.5.4";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -22,7 +22,7 @@ buildPythonPackage (finalAttrs: {
     owner = "NVIDIA";
     repo = "cuda-python";
     tag = "cuda-pathfinder-v${finalAttrs.version}";
-    hash = "sha256-Tj+0p+nIsOl2pMpKAUpdZ3nIcQ0kHWrPi6Qeu14oMRQ=";
+    hash = "sha256-0hUcc9jZooN7yQ63MJhpNJb1IyfwwTRbp4NjjbK4y1A=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/cuda_pathfinder";
diff --git a/pkgs/development/python-modules/django-tagging/default.nix b/pkgs/development/python-modules/django-tagging/default.nix
index 405e7c806974..e211031ecaeb 100644
--- a/pkgs/development/python-modules/django-tagging/default.nix
+++ b/pkgs/development/python-modules/django-tagging/default.nix
@@ -1,4 +1,5 @@
 {
+  lib,
   buildPythonPackage,
   fetchPypi,
   django,
@@ -22,5 +23,9 @@ buildPythonPackage rec {
   meta = {
     description = "Generic tagging application for Django projects";
     homepage = "https://github.com/Fantomas42/django-tagging";
+    license = lib.licenses.AND [
+      lib.licenses.mit
+      lib.licenses.bsd3
+    ];
   };
 }
diff --git a/pkgs/development/python-modules/ecdsa/default.nix b/pkgs/development/python-modules/ecdsa/default.nix
index 8950bd0d9b71..dd17b454ba69 100644
--- a/pkgs/development/python-modules/ecdsa/default.nix
+++ b/pkgs/development/python-modules/ecdsa/default.nix
@@ -10,16 +10,16 @@
   six,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "ecdsa";
-  version = "0.19.1";
+  version = "0.19.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tlsfuzzer";
     repo = "python-ecdsa";
-    tag = "python-ecdsa-${version}";
-    hash = "sha256-PjOjHQziQ9ohXH82Ocaowj/AtsXHMHDhatFPQNccyC8=";
+    tag = "python-ecdsa-${finalAttrs.version}";
+    hash = "sha256-u+EwAF/EnF33l/gy5y8eoA7aVeI/0cq9DDL9UUwgPFw=";
   };
 
   build-system = [ setuptools ];
@@ -39,7 +39,7 @@ buildPythonPackage rec {
   };
 
   meta = {
-    changelog = "https://github.com/tlsfuzzer/python-ecdsa/blob/${src.tag}/NEWS";
+    changelog = "https://github.com/tlsfuzzer/python-ecdsa/blob/${finalAttrs.src.tag}/NEWS";
     description = "ECDSA cryptographic signature library";
     homepage = "https://github.com/warner/python-ecdsa";
     license = lib.licenses.mit;
@@ -51,4 +51,4 @@ buildPythonPackage rec {
       "CVE-2024-23342"
     ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/equinox/default.nix b/pkgs/development/python-modules/equinox/default.nix
index 2c71c42b3861..62f10ee108c2 100644
--- a/pkgs/development/python-modules/equinox/default.nix
+++ b/pkgs/development/python-modules/equinox/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "equinox";
-  version = "0.13.7";
+  version = "0.13.8";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -29,7 +29,7 @@ buildPythonPackage (finalAttrs: {
     owner = "patrick-kidger";
     repo = "equinox";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vgmU8cqNCyiZYah1SSwzVtLS+YB2T1uooCC17k12+h8=";
+    hash = "sha256-JiIZKWuSkvrF09GdmegUeTyidaM5IRp4uqjJRsn86E4=";
   };
 
   # Relax speed constraints on tests that can fail on busy builders
diff --git a/pkgs/development/python-modules/gardena-bluetooth/default.nix b/pkgs/development/python-modules/gardena-bluetooth/default.nix
index 89e51bcb059b..fc8530c185a9 100644
--- a/pkgs/development/python-modules/gardena-bluetooth/default.nix
+++ b/pkgs/development/python-modules/gardena-bluetooth/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "gardena-bluetooth";
-  version = "2.7.0";
+  version = "2.8.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "elupus";
     repo = "gardena-bluetooth";
     tag = finalAttrs.version;
-    hash = "sha256-VqGcMz9tFXlrekwWQx2Wx1umbf/q3U9XkQKSkze2cCU=";
+    hash = "sha256-yl1I36p21lemKigijqks7cwOxWej+35bDB2D0KO3pa0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/gotailwind/default.nix b/pkgs/development/python-modules/gotailwind/default.nix
index 2b26bb0995a6..be7729054ede 100644
--- a/pkgs/development/python-modules/gotailwind/default.nix
+++ b/pkgs/development/python-modules/gotailwind/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   aiohttp,
-  aresponses,
+  aioresponses,
   awesomeversion,
   backoff,
   buildPythonPackage,
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "gotailwind";
-  version = "0.3.0";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "frenck";
     repo = "python-gotailwind";
     tag = "v${version}";
-    hash = "sha256-kNyqSyJ1ha+BumYX4ruWaN0akEvUEsRxPs7Fj7LDHOw=";
+    hash = "sha256-sDQnweGVDyewvTPkRlmk9f7YMnUdPmvB9VrvegAC2B8=";
   };
 
   postPatch = ''
@@ -53,19 +53,20 @@ buildPythonPackage rec {
   };
 
   nativeCheckInputs = [
-    aresponses
+    aioresponses
     pytest-asyncio
     pytest-cov-stub
     pytestCheckHook
     syrupy
-  ];
+  ]
+  ++ lib.concatAttrValues optional-dependencies;
 
   pythonImportsCheck = [ "gotailwind" ];
 
   meta = {
     description = "Modul to communicate with Tailwind garage door openers";
     homepage = "https://github.com/frenck/python-gotailwind";
-    changelog = "https://github.com/frenck/python-gotailwind/releases/tag/v$version";
+    changelog = "https://github.com/frenck/python-gotailwind/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "tailwind";
diff --git a/pkgs/development/python-modules/hdbscan/default.nix b/pkgs/development/python-modules/hdbscan/default.nix
index a712625fa08f..70c165ddfd95 100644
--- a/pkgs/development/python-modules/hdbscan/default.nix
+++ b/pkgs/development/python-modules/hdbscan/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
 
   cython,
   numpy,
@@ -27,15 +26,6 @@ buildPythonPackage rec {
     hash = "sha256-4uwWoNkrdLB2KzDAksPupdgkIFBgTahzravOtu1WYws=";
   };
 
-  patches = [
-    (fetchpatch {
-      # Replace obsolete use of assert_raises with pytest.raises
-      name = "replace-assert_raises";
-      url = "https://github.com/scikit-learn-contrib/hdbscan/pull/667/commits/04d6a4dcdcd2bb2597419b8aa981d7620765809f.patch";
-      hash = "sha256-z/u5b2rNPKOCe+3/GVE8rMB5ajeU5PrvLVesjEgj9TA=";
-    })
-  ];
-
   pythonRemoveDeps = [ "cython" ];
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/htseq/default.nix b/pkgs/development/python-modules/htseq/default.nix
index da4fdbb92200..807755a4de81 100644
--- a/pkgs/development/python-modules/htseq/default.nix
+++ b/pkgs/development/python-modules/htseq/default.nix
@@ -66,5 +66,6 @@ buildPythonPackage rec {
     homepage = "https://htseq.readthedocs.io/";
     description = "Framework to work with high-throughput sequencing data";
     maintainers = with lib.maintainers; [ unode ];
+    license = lib.licenses.gpl3Plus;
   };
 }
diff --git a/pkgs/development/python-modules/hyper-connections/default.nix b/pkgs/development/python-modules/hyper-connections/default.nix
index 2a10d0d38e9c..b0ec4af38158 100644
--- a/pkgs/development/python-modules/hyper-connections/default.nix
+++ b/pkgs/development/python-modules/hyper-connections/default.nix
@@ -5,19 +5,21 @@
   fetchFromGitHub,
   hatchling,
   pytestCheckHook,
+  stdenv,
   torch,
+  torch-einops-utils,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "hyper-connections";
-  version = "0.4.7";
+  version = "0.4.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lucidrains";
     repo = "hyper-connections";
     tag = finalAttrs.version;
-    hash = "sha256-x1Yx9Fnow9154kFGLmjeCBLYJsbv6oJiC6Rk1XudqJQ=";
+    hash = "sha256-RDwnRtHUWilyqsDmdiV+kRg7BqTS1yghiu9RAM+MNjE=";
   };
 
   build-system = [ hatchling ];
@@ -25,10 +27,17 @@ buildPythonPackage (finalAttrs: {
   dependencies = [
     einops
     torch
+    torch-einops-utils
   ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
+  disabledTests = lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+    # torch's cpuinfo init fails to parse /sys/devices/system/cpu/{possible,present}
+    # in the build sandbox on aarch64-linux, breaking `.half()` calls
+    "test_mhc_dtype_restoration"
+  ];
+
   pythonImportsCheck = [ "hyper_connections" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/intbitset/default.nix b/pkgs/development/python-modules/intbitset/default.nix
index b214a51f168f..92ce856a3243 100644
--- a/pkgs/development/python-modules/intbitset/default.nix
+++ b/pkgs/development/python-modules/intbitset/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "intbitset";
-  version = "4.1.0";
+  version = "4.1.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-cxRf8F5CJ8dlhf+FUGOLagg80TABC3gQRdga9Y97aSA=";
+    hash = "sha256-+C+v4Ly0/noBDZQgmbWoTXIdN8iXU47WMveIliwUEfg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/jupyter-server/default.nix b/pkgs/development/python-modules/jupyter-server/default.nix
index 41f803ad4ab9..9c57c47d9c96 100644
--- a/pkgs/development/python-modules/jupyter-server/default.nix
+++ b/pkgs/development/python-modules/jupyter-server/default.nix
@@ -103,6 +103,8 @@ buildPythonPackage rec {
     "test_subscribe_websocket"
     # test is presumable broken in sandbox
     "test_authorized_requests"
+    # Fails under load on Hydra; kernel stays in 'starting' state due to a zmq socket error
+    "test_cull_connected"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # attempts to use trashcan, build env doesn't allow this
@@ -119,8 +121,6 @@ buildPythonPackage rec {
   ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
     # TypeError: the JSON object must be str, bytes or bytearray, not NoneType
     "test_terminal_create_with_cwd"
-    # Fails under load (which causes failure on Hydra)
-    "test_cull_connected"
   ];
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/jupyter-ydoc/default.nix b/pkgs/development/python-modules/jupyter-ydoc/default.nix
index 0d7d3581edab..98e99eb297c1 100644
--- a/pkgs/development/python-modules/jupyter-ydoc/default.nix
+++ b/pkgs/development/python-modules/jupyter-ydoc/default.nix
@@ -21,6 +21,7 @@ buildPythonPackage (finalAttrs: {
   pname = "jupyter-ydoc";
   version = "3.4.1";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "jupyter-server";
@@ -34,6 +35,9 @@ buildPythonPackage (finalAttrs: {
     hatchling
   ];
 
+  pythonRelaxDeps = [
+    "pycrdt"
+  ];
   dependencies = [
     anyio
     pycrdt
diff --git a/pkgs/development/python-modules/kagglehub/default.nix b/pkgs/development/python-modules/kagglehub/default.nix
index 06202f7cc505..d6a217d5dbea 100644
--- a/pkgs/development/python-modules/kagglehub/default.nix
+++ b/pkgs/development/python-modules/kagglehub/default.nix
@@ -38,14 +38,15 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "kagglehub";
-  version = "1.0.0";
+  version = "1.0.1";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "Kaggle";
     repo = "kagglehub";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TwyOC4ym46zjTyikOQk5qyHoMcaY6jHEzHddXKYJwhc=";
+    hash = "sha256-HyPFGde1v++7Ef5dSLHLA2u2RfnlwM+63RAV+lulTjw=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/llama-cpp-python/default.nix b/pkgs/development/python-modules/llama-cpp-python/default.nix
index 5e9e79e390c8..72a1bdccf7f8 100644
--- a/pkgs/development/python-modules/llama-cpp-python/default.nix
+++ b/pkgs/development/python-modules/llama-cpp-python/default.nix
@@ -4,7 +4,6 @@
   gcc13Stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
 
   # nativeBuildInputs
   cmake,
@@ -41,28 +40,16 @@ let
 in
 buildPythonPackage.override { stdenv = stdenvTarget; } rec {
   pname = "llama-cpp-python";
-  version = "0.3.16";
+  version = "0.3.22";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "abetlen";
     repo = "llama-cpp-python";
     tag = "v${version}";
-    hash = "sha256-EUDtCv86J4bznsTqNsdgj1IYkAu83cf+RydFTUb2NEE=";
+    hash = "sha256-Mdz8aTBo3bwoqtjarXnQuNYjcaU+p4HKdMQfSoYwq60=";
     fetchSubmodules = true;
   };
-  # src = /home/gaetan/llama-cpp-python;
-
-  patches = [
-    # Fix test failure on a machine with no metal devices (e.g. nix-community darwin builder)
-    # https://github.com/ggml-org/llama.cpp/pull/15531
-    (fetchpatch {
-      url = "https://github.com/ggml-org/llama.cpp/pull/15531/commits/63a83ffefe4d478ebadff89300a0a3c5d660f56a.patch";
-      stripLen = 1;
-      extraPrefix = "vendor/llama.cpp/";
-      hash = "sha256-9LGnzviBgYYOOww8lhiLXf7xgd/EtxRXGQMredOO4qM=";
-    })
-  ];
 
   dontUseCmakeConfigure = true;
   cmakeFlags = [
@@ -75,7 +62,6 @@ buildPythonPackage.override { stdenv = stdenvTarget; } rec {
     #
     # cc1: error: unknown value ‘native+nodotprod+noi8mm+nosve’ for ‘-mcpu’
     (lib.cmakeBool "GGML_NATIVE" false)
-    (lib.cmakeFeature "GGML_BUILD_NUMBER" "1")
   ]
   ++ lib.optionals cudaSupport [
     (lib.cmakeBool "GGML_CUDA" true)
diff --git a/pkgs/development/python-modules/lupa/default.nix b/pkgs/development/python-modules/lupa/default.nix
index 64d1ff7f8671..3c82fbc43603 100644
--- a/pkgs/development/python-modules/lupa/default.nix
+++ b/pkgs/development/python-modules/lupa/default.nix
@@ -42,13 +42,27 @@ buildPythonPackage (finalAttrs: {
   postPatch = ''
     (
       set -x
-      rm -rf third-party/lua51;    cp -r ${srcOnly lua5_1}     third-party/lua51
-      rm -rf third-party/lua52;    cp -r ${srcOnly lua5_2}/src third-party/lua52
-      rm -rf third-party/lua53;    cp -r ${srcOnly lua5_3}/src third-party/lua53
-      rm -rf third-party/lua54;    cp -r ${srcOnly lua5_4}/src third-party/lua54
-      rm -rf third-party/lua55;    cp -r ${srcOnly lua5_5}/src third-party/lua55
-      rm -rf third-party/luajit20; cp -r ${srcOnly luajit_2_0} third-party/luajit20
-      rm -rf third-party/luajit21; cp -r ${srcOnly luajit_2_1} third-party/luajit21
+      ${lib.optionalString lua5_1.meta.available ''
+        rm -rf third-party/lua51;    cp -r ${srcOnly lua5_1}     third-party/lua51
+      ''}
+      ${lib.optionalString lua5_2.meta.available ''
+        rm -rf third-party/lua52;    cp -r ${srcOnly lua5_2}/src third-party/lua52
+      ''}
+      ${lib.optionalString lua5_3.meta.available ''
+        rm -rf third-party/lua53;    cp -r ${srcOnly lua5_3}/src third-party/lua53
+      ''}
+      ${lib.optionalString lua5_4.meta.available ''
+        rm -rf third-party/lua54;    cp -r ${srcOnly lua5_4}/src third-party/lua54
+      ''}
+      ${lib.optionalString lua5_5.meta.available ''
+        rm -rf third-party/lua55;    cp -r ${srcOnly lua5_5}/src third-party/lua55
+      ''}
+      ${lib.optionalString luajit_2_0.meta.available ''
+        rm -rf third-party/luajit20; cp -r ${srcOnly luajit_2_0} third-party/luajit20
+      ''}
+      ${lib.optionalString luajit_2_1.meta.available ''
+        rm -rf third-party/luajit21; cp -r ${srcOnly luajit_2_1} third-party/luajit21
+      ''}
       chmod -R +w third-party/*
     )
   '';
diff --git a/pkgs/development/python-modules/magic-wormhole/default.nix b/pkgs/development/python-modules/magic-wormhole/default.nix
index 825eecad6baf..d5aef570ca8b 100644
--- a/pkgs/development/python-modules/magic-wormhole/default.nix
+++ b/pkgs/development/python-modules/magic-wormhole/default.nix
@@ -42,14 +42,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "magic-wormhole";
-  version = "0.23.0";
+  version = "0.24.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "magic-wormhole";
     repo = "magic-wormhole";
     tag = finalAttrs.version;
-    hash = "sha256-knvQwdPfe9uHpSNqaEz4w2LY6LjCPVoUcFG0bhHQl+g=";
+    hash = "sha256-aY8dI5K2qroY+Nbc00R5XK0AjHpdnXFYWABgPqf8gQ8=";
   };
 
   postPatch =
diff --git a/pkgs/development/python-modules/moyopy/default.nix b/pkgs/development/python-modules/moyopy/default.nix
index 552130d5dd58..9cd1d80ad24d 100644
--- a/pkgs/development/python-modules/moyopy/default.nix
+++ b/pkgs/development/python-modules/moyopy/default.nix
@@ -16,14 +16,15 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "moyopy";
-  version = "0.7.9";
+  version = "0.8.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "spglib";
     repo = "moyo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XPXLBEGDGX8MTaM91K0Y7Zjyafq6zscSVELRk3HWIYM=";
+    hash = "sha256-+rSB6y9dEbUSMaWwZYhKAabxBx8jkCiUQesPJbxii8w=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/moyopy";
@@ -46,7 +47,7 @@ buildPythonPackage (finalAttrs: {
       sourceRoot
       cargoRoot
       ;
-    hash = "sha256-DB9hyf1z6tEt7ErswfyFtXCrhEG9z8DSlGqvRRho0xo=";
+    hash = "sha256-Hy//xgkF3UToKq135WT2Gp6fCz0uHzhU8DtGDtgM76o=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/music-assistant-client/default.nix b/pkgs/development/python-modules/music-assistant-client/default.nix
index 9684ce32e156..5aa9a2dfcef5 100644
--- a/pkgs/development/python-modules/music-assistant-client/default.nix
+++ b/pkgs/development/python-modules/music-assistant-client/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "music-assistant-client";
-  version = "1.3.3";
+  version = "1.3.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "music-assistant";
     repo = "client";
     tag = version;
-    hash = "sha256-f5+25MWuovG/g3PscWt0jls/5Y/Qdt2kq9Ai7/9P4aI=";
+    hash = "sha256-1yJTn8gnEFkoWGQHItpdO77ltE1Ai5z9hmJvakxyi24=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/music-assistant-models/default.nix b/pkgs/development/python-modules/music-assistant-models/default.nix
index 74607350c725..7f2b91bb4c1d 100644
--- a/pkgs/development/python-modules/music-assistant-models/default.nix
+++ b/pkgs/development/python-modules/music-assistant-models/default.nix
@@ -23,14 +23,14 @@ buildPythonPackage (finalAttrs: {
   pname = "music-assistant-models";
   # Must be compatible with music-assistant-client package
   # nixpkgs-update: no auto update
-  version = "1.1.89";
+  version = "1.1.115";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "music-assistant";
     repo = "models";
     tag = finalAttrs.version;
-    hash = "sha256-/eNCgAB5G8g1r2fcW27lySEqg+q/1bJvwwyntigGWjo=";
+    hash = "sha256-oEXL0B8JNH4PcltpES375ov7QGs+gtYKlMGr1B7BlKY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/oelint-data/default.nix b/pkgs/development/python-modules/oelint-data/default.nix
index d69acef6d247..5d380282a67d 100644
--- a/pkgs/development/python-modules/oelint-data/default.nix
+++ b/pkgs/development/python-modules/oelint-data/default.nix
@@ -8,14 +8,15 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "oelint-data";
-  version = "1.4.12";
+  version = "1.4.13";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "priv-kweihmann";
     repo = "oelint-data";
     tag = finalAttrs.version;
-    hash = "sha256-Q+h5qSCvybxO+RojDNoS6g1Bt/fLpiWVJHRiMkgPpvY=";
+    hash = "sha256-wOpIgCyPIAWsnULbAQINzFkolns97SW/jMK8yXUOxdY=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/ome-zarr-models/default.nix b/pkgs/development/python-modules/ome-zarr-models/default.nix
index b2845786c753..2446794262ad 100644
--- a/pkgs/development/python-modules/ome-zarr-models/default.nix
+++ b/pkgs/development/python-modules/ome-zarr-models/default.nix
@@ -23,14 +23,15 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ome-zarr-models";
-  version = "1.6";
+  version = "1.7";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "ome-zarr-models";
     repo = "ome-zarr-models-py";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-z2qBQhgijJB8O5smlJ4Y0FMS6UoMZcHVIJn5JuYq/IU=";
+    hash = "sha256-UT/LvbTGo6UueEUwELqnfhERvxtg04Ukrcpo1yTa80c=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/ome-zarr/default.nix b/pkgs/development/python-modules/ome-zarr/default.nix
index 060e4c29be6f..980adf7d6864 100644
--- a/pkgs/development/python-modules/ome-zarr/default.nix
+++ b/pkgs/development/python-modules/ome-zarr/default.nix
@@ -10,6 +10,7 @@
   # dependencies
   aiohttp,
   dask,
+  deprecated,
   fsspec,
   numpy,
   rangehttpserver,
@@ -25,14 +26,15 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ome-zarr";
-  version = "0.13.0";
+  version = "0.16.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "ome";
     repo = "ome-zarr-py";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bRksh6ZKqF6cL6XnWBsQRb4gRVxH/vutKtep6SyFo48=";
+    hash = "sha256-hrk+F1a1yJzaIb7G80sGdqeMb2POIAD2gLOfK57A22A=";
   };
 
   build-system = [
@@ -46,6 +48,7 @@ buildPythonPackage (finalAttrs: {
   dependencies = [
     aiohttp
     dask
+    deprecated
     fsspec
     numpy
     rangehttpserver
diff --git a/pkgs/development/python-modules/plover/5.nix b/pkgs/development/python-modules/plover/5.nix
index 45899b201b7a..460a7e8fb14e 100644
--- a/pkgs/development/python-modules/plover/5.nix
+++ b/pkgs/development/python-modules/plover/5.nix
@@ -79,7 +79,6 @@ buildPythonPackage (finalAttrs: {
     pyserial
     pyside6
     plover-stroke
-    qtbase
     readme-renderer
     requests-cache
     requests-futures
@@ -93,6 +92,10 @@ buildPythonPackage (finalAttrs: {
     wrapQtAppsHook
   ];
 
+  buildInputs = [
+    qtbase
+  ];
+
   nativeCheckInputs = [
     pytestCheckHook
     versionCheckHook
diff --git a/pkgs/development/python-modules/pycrdt-store/default.nix b/pkgs/development/python-modules/pycrdt-store/default.nix
index ae00c9a260d4..374d2efe93f5 100644
--- a/pkgs/development/python-modules/pycrdt-store/default.nix
+++ b/pkgs/development/python-modules/pycrdt-store/default.nix
@@ -16,15 +16,16 @@
   trio,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pycrdt-store";
   version = "0.1.3";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "y-crdt";
     repo = "pycrdt-store";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-KlB3BDhL/dt1IaQvWOfq1hgTKptrobgoBpus/mjZ26M=";
   };
 
@@ -32,6 +33,9 @@ buildPythonPackage rec {
     hatchling
   ];
 
+  pythonRelaxDeps = [
+    "pycrdt"
+  ];
   dependencies = [
     anyio
     pycrdt
@@ -50,8 +54,8 @@ buildPythonPackage rec {
   meta = {
     description = "Persistent storage for pycrdt";
     homepage = "https://github.com/y-crdt/pycrdt-store";
-    changelog = "https://github.com/y-crdt/pycrdt-store/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/y-crdt/pycrdt-store/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ sarahec ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/pycrdt-websocket/default.nix b/pkgs/development/python-modules/pycrdt-websocket/default.nix
index fd6b9d80a1be..01f4e693bb39 100644
--- a/pkgs/development/python-modules/pycrdt-websocket/default.nix
+++ b/pkgs/development/python-modules/pycrdt-websocket/default.nix
@@ -25,20 +25,24 @@
   websockets,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pycrdt-websocket";
   version = "0.16.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "y-crdt";
     repo = "pycrdt-websocket";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-Qux8IxJR1nGbdpGz7RZBKJjYN0qfwfEpd2UDlduOna0=";
   };
 
   build-system = [ hatchling ];
 
+  pythonRelaxDeps = [
+    "pycrdt"
+  ];
   dependencies = [
     anyio
     pycrdt
@@ -79,8 +83,8 @@ buildPythonPackage rec {
   meta = {
     description = "WebSocket Connector for pycrdt";
     homepage = "https://github.com/jupyter-server/pycrdt-websocket";
-    changelog = "https://github.com/jupyter-server/pycrdt-websocket/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/jupyter-server/pycrdt-websocket/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     teams = [ lib.teams.jupyter ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/pycrdt/Cargo.lock b/pkgs/development/python-modules/pycrdt/Cargo.lock
index cf11b8daccfe..a4b5f93bf0cb 100644
--- a/pkgs/development/python-modules/pycrdt/Cargo.lock
+++ b/pkgs/development/python-modules/pycrdt/Cargo.lock
@@ -4,9 +4,9 @@ version = 4
 
 [[package]]
 name = "arc-swap"
-version = "1.9.0"
+version = "1.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a07d1f37ff60921c83bdfc7407723bdefe89b44b98a9b772f225c8f9d67141a6"
+checksum = "6a3a1fd6f75306b68087b831f025c712524bcb19aad54e557b1129cfa0a2b207"
 dependencies = [
  "rustversion",
 ]
@@ -35,9 +35,9 @@ dependencies = [
 
 [[package]]
 name = "bitflags"
-version = "2.11.0"
+version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "843867be96c8daad0d758b57df9392b6d8d271134fce549de6ce169ff98a92af"
+checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
 
 [[package]]
 name = "bumpalo"
@@ -103,23 +103,24 @@ dependencies = [
 
 [[package]]
 name = "fastrand"
-version = "2.3.0"
+version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
+checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
 dependencies = [
  "getrandom",
 ]
 
 [[package]]
 name = "getrandom"
-version = "0.2.17"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
 dependencies = [
  "cfg-if",
  "js-sys",
  "libc",
- "wasi",
+ "r-efi",
+ "wasip2",
  "wasm-bindgen",
 ]
 
@@ -143,19 +144,20 @@ checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "js-sys"
-version = "0.3.91"
+version = "0.3.97"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b49715b7073f385ba4bc528e5747d02e66cb39c6146efb66b781f131f0fb399c"
+checksum = "a1840c94c045fbcf8ba2812c95db44499f7c64910a912551aaaa541decebcacf"
 dependencies = [
+ "cfg-if",
  "once_cell",
  "wasm-bindgen",
 ]
 
 [[package]]
 name = "libc"
-version = "0.2.183"
+version = "0.2.186"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5b646652bf6661599e1da8901b3b9522896f01e736bad5f723fe7a3a27f899d"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
 
 [[package]]
 name = "lock_api"
@@ -220,7 +222,7 @@ dependencies = [
 
 [[package]]
 name = "pycrdt"
-version = "0.12.50"
+version = "0.13.0"
 dependencies = [
  "pyo3",
  "serde_json",
@@ -229,9 +231,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3"
-version = "0.28.2"
+version = "0.28.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf85e27e86080aafd5a22eae58a162e133a589551542b3e5cee4beb27e54f8e1"
+checksum = "91fd8e38a3b50ed1167fb981cd6fd60147e091784c427b8f7183a7ee32c31c12"
 dependencies = [
  "libc",
  "once_cell",
@@ -243,18 +245,18 @@ dependencies = [
 
 [[package]]
 name = "pyo3-build-config"
-version = "0.28.2"
+version = "0.28.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bf94ee265674bf76c09fa430b0e99c26e319c945d96ca0d5a8215f31bf81cf7"
+checksum = "e368e7ddfdeb98c9bca7f8383be1648fd84ab466bf2bc015e94008db6d35611e"
 dependencies = [
  "target-lexicon",
 ]
 
 [[package]]
 name = "pyo3-ffi"
-version = "0.28.2"
+version = "0.28.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "491aa5fc66d8059dd44a75f4580a2962c1862a1c2945359db36f6c2818b748dc"
+checksum = "7f29e10af80b1f7ccaf7f69eace800a03ecd13e883acfacc1e5d0988605f651e"
 dependencies = [
  "libc",
  "pyo3-build-config",
@@ -262,9 +264,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros"
-version = "0.28.2"
+version = "0.28.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f5d671734e9d7a43449f8480f8b38115df67bef8d21f76837fa75ee7aaa5e52e"
+checksum = "df6e520eff47c45997d2fc7dd8214b25dd1310918bbb2642156ef66a67f29813"
 dependencies = [
  "proc-macro2",
  "pyo3-macros-backend",
@@ -274,9 +276,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros-backend"
-version = "0.28.2"
+version = "0.28.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22faaa1ce6c430a1f71658760497291065e6450d7b5dc2bcf254d49f66ee700a"
+checksum = "c4cdc218d835738f81c2338f822078af45b4afdf8b2e33cbb5916f108b813acb"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -294,6 +296,12 @@ dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
 [[package]]
 name = "redox_syscall"
 version = "0.5.18"
@@ -417,16 +425,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
 [[package]]
-name = "wasi"
-version = "0.11.1+wasi-snapshot-preview1"
+name = "wasip2"
+version = "1.0.3+wasi-0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+checksum = "20064672db26d7cdc89c7798c48a0fdfac8213434a1186e5ef29fd560ae223d6"
+dependencies = [
+ "wit-bindgen",
+]
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.114"
+version = "0.2.120"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6532f9a5c1ece3798cb1c2cfdba640b9b3ba884f5db45973a6f442510a87d38e"
+checksum = "df52b6d9b87e0c74c9edfa1eb2d9bf85e5d63515474513aa50fa181b3c4f5db1"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -437,9 +448,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.114"
+version = "0.2.120"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18a2d50fcf105fb33bb15f00e7a77b772945a2ee45dcf454961fd843e74c18e6"
+checksum = "78b1041f495fb322e64aca85f5756b2172e35cd459376e67f2a6c9dffcedb103"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -447,9 +458,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.114"
+version = "0.2.120"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03ce4caeaac547cdf713d280eda22a730824dd11e6b8c3ca9e42247b25c631e3"
+checksum = "9dcd0ff20416988a18ac686d4d4d0f6aae9ebf08a389ff5d29012b05af2a1b41"
 dependencies = [
  "bumpalo",
  "proc-macro2",
@@ -460,9 +471,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.114"
+version = "0.2.120"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75a326b8c223ee17883a4251907455a2431acc2791c98c26279376490c378c16"
+checksum = "49757b3c82ebf16c57d69365a142940b384176c24df52a087fb748e2085359ea"
 dependencies = [
  "unicode-ident",
 ]
@@ -474,10 +485,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
 [[package]]
-name = "yrs"
-version = "0.25.0"
+name = "wit-bindgen"
+version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6893d39bc55d014e4a1d0e71d06c0c41590d5cdeac35c126be44998bc320cff"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
+[[package]]
+name = "yrs"
+version = "0.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89512f2d869f9947e1c58d57ef86c8f4ca1b1e8ccf24d6e1ff8c7cdbd67d54df"
 dependencies = [
  "arc-swap",
  "async-lock",
diff --git a/pkgs/development/python-modules/pycrdt/default.nix b/pkgs/development/python-modules/pycrdt/default.nix
index fb11fa87245a..05733b1f133a 100644
--- a/pkgs/development/python-modules/pycrdt/default.nix
+++ b/pkgs/development/python-modules/pycrdt/default.nix
@@ -20,14 +20,15 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pycrdt";
-  version = "0.12.50";
+  version = "0.13.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "y-crdt";
     repo = "pycrdt";
     tag = finalAttrs.version;
-    hash = "sha256-YtOgUzoqLnRslHrSWSkP+AexdaBR/1e+NH4gKSIKn9I=";
+    hash = "sha256-gfXdH/V2ZwxfxMFoA20cMv0ilgxuCULl4EFl2vqStqI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pydantic-ai-slim/default.nix b/pkgs/development/python-modules/pydantic-ai-slim/default.nix
index 9dfad31b46de..86ba63a3c161 100644
--- a/pkgs/development/python-modules/pydantic-ai-slim/default.nix
+++ b/pkgs/development/python-modules/pydantic-ai-slim/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydantic-ai-slim";
-  version = "1.89.1";
+  version = "1.90.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "pydantic-ai";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AD4tFynt+CO/Tjhndbg8WrQ/qPmaWMPjBsz7xZQOfSo=";
+    hash = "sha256-+yFaSnMfgaTzhvQmFRiYoOnAf60JW45c7QsOrxRIElw=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/pydantic_ai_slim";
diff --git a/pkgs/development/python-modules/pydantic-graph/default.nix b/pkgs/development/python-modules/pydantic-graph/default.nix
index 9cc4ddeccc36..628748fda8eb 100644
--- a/pkgs/development/python-modules/pydantic-graph/default.nix
+++ b/pkgs/development/python-modules/pydantic-graph/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydantic-graph";
-  version = "1.89.1";
+  version = "1.90.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "pydantic-ai";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AD4tFynt+CO/Tjhndbg8WrQ/qPmaWMPjBsz7xZQOfSo=";
+    hash = "sha256-+yFaSnMfgaTzhvQmFRiYoOnAf60JW45c7QsOrxRIElw=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/pydantic_graph";
diff --git a/pkgs/development/python-modules/pydantic-zarr/default.nix b/pkgs/development/python-modules/pydantic-zarr/default.nix
index c9eb6d80f9aa..65e3aa5d76bb 100644
--- a/pkgs/development/python-modules/pydantic-zarr/default.nix
+++ b/pkgs/development/python-modules/pydantic-zarr/default.nix
@@ -21,14 +21,15 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydantic-zarr";
-  version = "0.9.2";
+  version = "0.10.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "zarr-developers";
     repo = "pydantic-zarr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zwC1qds2/KbwdBvoB2Eep0nL+6WLZBNEtxgKmvrRYE4=";
+    hash = "sha256-SzvYiZWnknGdJexYnGEWQaVQpHo1520RaNjuzCA4xtQ=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pyinfra/default.nix b/pkgs/development/python-modules/pyinfra/default.nix
index 4266d6f60096..2e6fc8ede05b 100644
--- a/pkgs/development/python-modules/pyinfra/default.nix
+++ b/pkgs/development/python-modules/pyinfra/default.nix
@@ -1,56 +1,50 @@
 {
   lib,
   buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  hatchling,
+  uv-dynamic-versioning,
+
+  # dependencies
   click,
   distro,
-  fetchFromGitHub,
-  fetchpatch,
-  freezegun,
   gevent,
-  hatchling,
   jinja2,
   packaging,
   paramiko,
   pydantic,
+  python-dateutil,
+  typeguard,
+  types-paramiko,
+
+  # tests
+  freezegun,
   pyinfra-testgen,
   pytest-testinfra,
   pytestCheckHook,
-  python-dateutil,
-  typeguard,
-  uv-dynamic-versioning,
+  versionCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pyinfra";
-  version = "3.6.1";
+  version = "3.8.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "Fizzadar";
     repo = "pyinfra";
-    tag = "v${version}";
-    hash = "sha256-SB/V5pV10pBaYyYTp/Ty3J+/NX9oT3u++ZWELCk1qkc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-0DIG1Msttg7tqLbCZKi07uWTg3KYgH9rVlWPeJs4wwA=";
   };
 
-  patches = [
-    # paramiko v4 compat
-    # https://github.com/pyinfra-dev/pyinfra/pull/1525
-    (fetchpatch {
-      name = "remove-DSSKey.patch";
-      url = "https://github.com/pyinfra-dev/pyinfra/commit/a655bdf425884055145cfd0011c3b444c9a3ada2.patch";
-      hash = "sha256-puHcA4+KigltCL2tUYRMc9OT3kxvTeW77bbFbxgkcTs=";
-    })
-  ];
-
   build-system = [
     hatchling
     uv-dynamic-versioning
   ];
 
-  pythonRelaxDeps = [
-    "paramiko"
-  ];
-
   dependencies = [
     click
     distro
@@ -61,6 +55,7 @@ buildPythonPackage rec {
     pydantic
     python-dateutil
     typeguard
+    types-paramiko
   ];
 
   nativeCheckInputs = [
@@ -68,6 +63,7 @@ buildPythonPackage rec {
     pyinfra-testgen
     pytest-testinfra
     pytestCheckHook
+    versionCheckHook
   ];
 
   pythonImportsCheck = [ "pyinfra" ];
@@ -85,9 +81,9 @@ buildPythonPackage rec {
     '';
     homepage = "https://pyinfra.com";
     downloadPage = "https://pyinfra.com/Fizzadar/pyinfra/releases";
-    changelog = "https://github.com/Fizzadar/pyinfra/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/Fizzadar/pyinfra/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ totoroot ];
     mainProgram = "pyinfra";
   };
-}
+})
diff --git a/pkgs/development/python-modules/pynslookup/default.nix b/pkgs/development/python-modules/pynslookup/default.nix
index 2c80c3eaabb0..411ded3d31be 100644
--- a/pkgs/development/python-modules/pynslookup/default.nix
+++ b/pkgs/development/python-modules/pynslookup/default.nix
@@ -6,16 +6,16 @@
   dnspython,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pynslookup";
-  version = "1.8.1";
+  version = "1.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "wesinator";
     repo = "pynslookup";
-    tag = "v${version}";
-    hash = "sha256-cb8oyI8D8SzBP+tm1jGPPshJYhPegYOH0RwIH03/K/A=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-GdI5Jg/+HjdtbzpLa28z/ZUGPJL9vEbJ+Jd4HP4pQCY=";
   };
 
   build-system = [ setuptools ];
@@ -33,4 +33,4 @@ buildPythonPackage rec {
     license = lib.licenses.mpl20;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/pypugjs/default.nix b/pkgs/development/python-modules/pypugjs/default.nix
index 521048a5b44a..dff64ef34859 100644
--- a/pkgs/development/python-modules/pypugjs/default.nix
+++ b/pkgs/development/python-modules/pypugjs/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "pypugjs";
-  version = "6.0.2";
+  version = "6.0.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kakulukia";
     repo = "pypugjs";
     tag = "v${version}";
-    hash = "sha256-PABd0aa+KMrHGGaOLCqUcsw91bhytHJn06/d/k9RvCg=";
+    hash = "sha256-7w+YTNBxDQ8UZdvX3JfBQc9HQR3zNTGsEp+OR/LWcmU=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/python-bidi/default.nix b/pkgs/development/python-modules/python-bidi/default.nix
index 5e49e1f35671..53551e479b37 100644
--- a/pkgs/development/python-modules/python-bidi/default.nix
+++ b/pkgs/development/python-modules/python-bidi/default.nix
@@ -43,5 +43,9 @@ buildPythonPackage rec {
     mainProgram = "pybidi";
     platforms = lib.platforms.unix;
     maintainers = [ ];
+    license = lib.licenses.AND [
+      lib.licenses.lgpl3Only
+      lib.licenses.gpl3Only
+    ];
   };
 }
diff --git a/pkgs/development/python-modules/reno/default.nix b/pkgs/development/python-modules/reno/default.nix
index e778d3576402..2ee12e77fdb9 100644
--- a/pkgs/development/python-modules/reno/default.nix
+++ b/pkgs/development/python-modules/reno/default.nix
@@ -1,5 +1,5 @@
 {
-  buildPythonApplication,
+  buildPythonPackage,
   dulwich,
   docutils,
   lib,
@@ -15,7 +15,7 @@
   testscenarios,
 }:
 
-buildPythonApplication rec {
+buildPythonPackage (finalAttrs: {
   pname = "reno";
   version = "4.1.0";
   pyproject = true;
@@ -23,11 +23,11 @@ buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "openstack";
     repo = "reno";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-le9JtE0XODlYhTFsrjxFXG/Weshr+FyN4M4S3BMBLUE=";
   };
 
-  env.PBR_VERSION = version;
+  env.PBR_VERSION = finalAttrs.version;
 
   build-system = [
     setuptools
@@ -87,4 +87,4 @@ buildPythonApplication rec {
     license = lib.licenses.asl20;
     teams = [ lib.teams.openstack ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/rns/default.nix b/pkgs/development/python-modules/rns/default.nix
index 8e98127716cd..1bcc2cfafef8 100644
--- a/pkgs/development/python-modules/rns/default.nix
+++ b/pkgs/development/python-modules/rns/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "rns";
-  version = "1.2.0";
+  version = "1.2.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "markqvist";
     repo = "Reticulum";
     tag = finalAttrs.version;
-    hash = "sha256-DsEE+KRR4INC6kR39VCWrhMgEHNPexrQABYea5OSntI=";
+    hash = "sha256-4fb0oyS4LZvvMPKEKAE5lLI7ReCW2V6b5J/pQqMrcNM=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/serialx/default.nix b/pkgs/development/python-modules/serialx/default.nix
index 60a871645709..9bea94f2bc35 100644
--- a/pkgs/development/python-modules/serialx/default.nix
+++ b/pkgs/development/python-modules/serialx/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "serialx";
-  version = "1.6.0";
+  version = "1.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "puddly";
     repo = "serialx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6yTYR66MzcXv9e0l+my5UunD493a7c3bPYwvDKMH3gI=";
+    hash = "sha256-yULTP7aaA/O7cz3NBMpdIybvply3ADQZENxjuexKxo8=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
diff --git a/pkgs/development/python-modules/sqlite-anyio/default.nix b/pkgs/development/python-modules/sqlite-anyio/default.nix
index 38f7460b3931..23ab7190efe2 100644
--- a/pkgs/development/python-modules/sqlite-anyio/default.nix
+++ b/pkgs/development/python-modules/sqlite-anyio/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "sqlite-anyio";
-  version = "0.2.3";
+  version = "0.2.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "davidbrochart";
     repo = "sqlite-anyio";
     tag = "v${version}";
-    hash = "sha256-cZyTpFmYD0l20Cmxl+Hwfh3oVkWvtXD45dMpcSwA2QE=";
+    hash = "sha256-1riZiLBccg7Vqq+a8xT5Lr4vxjkeMbf1wqXnTTgY8iY=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/symfc/default.nix b/pkgs/development/python-modules/symfc/default.nix
index 079abdc09506..431790167b6c 100644
--- a/pkgs/development/python-modules/symfc/default.nix
+++ b/pkgs/development/python-modules/symfc/default.nix
@@ -44,7 +44,7 @@ buildPythonPackage (finalAttrs: {
     pytestCheckHook
   ];
 
-  disabledTests = lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
+  disabledTests = lib.optionals stdenv.hostPlatform.isx86_64 [
     # assert (np.float64(0.5555555555555556) == 1.0 ± 1.0e-06
     "test_fc_basis_set_o3"
   ];
diff --git a/pkgs/development/python-modules/textual/default.nix b/pkgs/development/python-modules/textual/default.nix
index 59dfa4d632dd..d7b48ee4dd7f 100644
--- a/pkgs/development/python-modules/textual/default.nix
+++ b/pkgs/development/python-modules/textual/default.nix
@@ -37,14 +37,14 @@
 
 buildPythonPackage rec {
   pname = "textual";
-  version = "8.2.4";
+  version = "8.2.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Textualize";
     repo = "textual";
     tag = "v${version}";
-    hash = "sha256-827cm9pcj1o1FYeaoWKCJ6dEyXeDop4kYd205cySTfg=";
+    hash = "sha256-bQnyTnoG/3Lcrn9cHwNHUYw6piOg8U9bAoPfZW7SDmQ=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/torch-einops-utils/default.nix b/pkgs/development/python-modules/torch-einops-utils/default.nix
new file mode 100644
index 000000000000..ffb0fd01cb34
--- /dev/null
+++ b/pkgs/development/python-modules/torch-einops-utils/default.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  buildPythonPackage,
+  einops,
+  fetchFromGitHub,
+  hatchling,
+  pytestCheckHook,
+  torch,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "torch-einops-utils";
+  version = "0.0.29";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "lucidrains";
+    repo = "torch-einops-utils";
+    tag = finalAttrs.version;
+    hash = "sha256-ja3HeBvAQRyGL2anqIQa2iiHhOZUhF73do7pvrTyRo0=";
+  };
+
+  build-system = [ hatchling ];
+
+  dependencies = [
+    einops
+    torch
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "torch_einops_utils" ];
+
+  meta = {
+    description = "Utility functions for torch and einops";
+    homepage = "https://github.com/lucidrains/torch-einops-utils";
+    changelog = "https://github.com/lucidrains/torch-einops-utils/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ miniharinn ];
+  };
+})
diff --git a/pkgs/development/python-modules/zha-quirks/default.nix b/pkgs/development/python-modules/zha-quirks/default.nix
index 34825adc5ba9..26ac23392425 100644
--- a/pkgs/development/python-modules/zha-quirks/default.nix
+++ b/pkgs/development/python-modules/zha-quirks/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "zha-quirks";
-  version = "1.1.1";
+  version = "1.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = "zha-device-handlers";
     tag = version;
-    hash = "sha256-GxNxc+cu3wBjz/1VF2+0DJ/PBTLlJKm0ncgzeaw5Fxw=";
+    hash = "sha256-mDcvVwqzSmszaJDahzkRNteiO4C/eU+BqTdBpWj5yGw=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/zha/default.nix b/pkgs/development/python-modules/zha/default.nix
index 89852dcc3765..869c1fa5e121 100644
--- a/pkgs/development/python-modules/zha/default.nix
+++ b/pkgs/development/python-modules/zha/default.nix
@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "zha";
-  version = "1.1.2";
+  version = "1.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     owner = "zigpy";
     repo = "zha";
     tag = version;
-    hash = "sha256-GPl3nXi24ukNHDE81keyu8m1xgS0MSRdo7ULxy6foGQ=";
+    hash = "sha256-oB4vxq/DJjmypmcKS6IeYEh+dTvC0Wt9X79vPbtDJgE=";
   };
 
   postPatch = ''
@@ -93,6 +93,7 @@ buildPythonPackage rec {
     "test_startup_concurrency_limit"
     "test_fan_ikea"
     "test_background"
+    "test_gateway_startup_failure" # Failed first attempt, passed second, flaky
   ];
 
   disabledTestPaths = [ "tests/test_cluster_handlers.py" ];
diff --git a/pkgs/development/python-modules/zigpy-xbee/default.nix b/pkgs/development/python-modules/zigpy-xbee/default.nix
index 58066991b84e..37d64f73dca5 100644
--- a/pkgs/development/python-modules/zigpy-xbee/default.nix
+++ b/pkgs/development/python-modules/zigpy-xbee/default.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   pytest-asyncio,
   pytestCheckHook,
+  pyserial-asyncio-fast,
   setuptools,
   zigpy,
 }:
@@ -35,6 +36,11 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytest-asyncio
     pytestCheckHook
+    pyserial-asyncio-fast
+  ];
+
+  disabledTests = [
+    "test_connect" # Attempts to test ioctl
   ];
 
   meta = {
diff --git a/pkgs/development/python-modules/zigpy-zboss/default.nix b/pkgs/development/python-modules/zigpy-zboss/default.nix
index 0bb39d5ccc2e..a1090a5ddc14 100644
--- a/pkgs/development/python-modules/zigpy-zboss/default.nix
+++ b/pkgs/development/python-modules/zigpy-zboss/default.nix
@@ -68,6 +68,13 @@ buildPythonPackage rec {
     "tests/application/test_startup.py"
     "tests/application/test_zdo_requests.py"
     "tests/application/test_zigpy_callbacks.py"
+    # This hasn't been updated in 2 years, and we're getting new failing tests. Best I can do for now is disable them.
+    # If this recieves an update, please give reenabling these tests a try.
+    "tests/api/test_listeners.py"
+    "tests/api/test_request.py"
+    "tests/api/test_response.py"
+    "tests/api/test_connect.py"
+    "tests/test_uart.py"
   ];
 
   meta = {
diff --git a/pkgs/development/python-modules/zigpy-zigate/default.nix b/pkgs/development/python-modules/zigpy-zigate/default.nix
index 434c63be1741..360bde814a72 100644
--- a/pkgs/development/python-modules/zigpy-zigate/default.nix
+++ b/pkgs/development/python-modules/zigpy-zigate/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "zigpy-zigate";
-  version = "0.13.4";
+  version = "0.14.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "zigpy";
     repo = "zigpy-zigate";
     tag = version;
-    hash = "sha256-pVDqb2/7Pe9zvhNNTVQfl5EphEjOPdJwvCIoTdZm7S0=";
+    hash = "sha256-kimlUwwlecXIBxKkBUJC8JqzMdt6Swf5SuOypOnXZCM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/zigpy-znp/default.nix b/pkgs/development/python-modules/zigpy-znp/default.nix
index 11e2fce0a079..7f5d1475ee01 100644
--- a/pkgs/development/python-modules/zigpy-znp/default.nix
+++ b/pkgs/development/python-modules/zigpy-znp/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "zigpy-znp";
-  version = "0.14.3";
+  version = "1.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "zigpy";
     repo = "zigpy-znp";
     tag = "v${version}";
-    hash = "sha256-XH/nStEGI7jmhwT5JhII4Mc+uO7B9Ur3s5MLvUOFl9c=";
+    hash = "sha256-beIFbmJ6h1wj+e+g+JvXedvBFjnjaTZ60PCYTbiUqic=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/zigpy/default.nix b/pkgs/development/python-modules/zigpy/default.nix
index f6f0f32b18c1..db72b8d1fcd9 100644
--- a/pkgs/development/python-modules/zigpy/default.nix
+++ b/pkgs/development/python-modules/zigpy/default.nix
@@ -13,10 +13,10 @@
   freezegun,
   frozendict,
   jsonschema,
-  pyserial-asyncio-fast,
-  pytest-asyncio_0,
+  pytest-asyncio,
   pytest-timeout,
   pytestCheckHook,
+  serialx,
   setuptools,
   typing-extensions,
   voluptuous,
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "zigpy";
-  version = "1.2.2";
+  version = "1.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "zigpy";
     repo = "zigpy";
     tag = version;
-    hash = "sha256-xCgQJYZJTjt81RC6rLb5hEyauJD3qxMK5TXTxTgXwT4=";
+    hash = "sha256-iBv7FKPeVzHc8xNvRLHDgWAuwHgTf4ByI1fA6Z134v8=";
   };
 
   postPatch = ''
@@ -50,7 +50,7 @@ buildPythonPackage rec {
     cryptography
     frozendict
     jsonschema
-    pyserial-asyncio-fast
+    serialx
     typing-extensions
     voluptuous
   ];
@@ -59,7 +59,7 @@ buildPythonPackage rec {
     aioresponses
     filelock
     freezegun
-    pytest-asyncio_0
+    pytest-asyncio
     pytest-timeout
     pytestCheckHook
   ];
diff --git a/pkgs/development/rocq-modules/mathcomp/default.nix b/pkgs/development/rocq-modules/mathcomp/default.nix
index 32669add7037..05de2bbd843c 100644
--- a/pkgs/development/rocq-modules/mathcomp/default.nix
+++ b/pkgs/development/rocq-modules/mathcomp/default.nix
@@ -21,6 +21,7 @@
   single ? false,
   rocq-core,
   hierarchy-builder,
+  micromega-plugin,
   version ? null,
 }@args:
 
@@ -139,8 +140,22 @@ let
           extraInstallFlags = [ "-f Makefile.coq" ];
         }
       );
-      # patched-derivation1 = derivation.overrideAttrs ...
+      patched-derivation1 = derivation.overrideAttrs (
+        o:
+        lib.optionalAttrs
+          (
+            lib.elem package [
+              "algebra"
+              "single"
+            ]
+            && o.version != null
+            && (o.version == "dev" || lib.versions.isGe "2.6.0" o.version)
+          )
+          {
+            propagatedBuildInputs = o.propagatedBuildInputs ++ [ micromega-plugin ];
+          }
+      );
     in
-    derivation;
+    patched-derivation1;
 in
 mathcomp_ (if single then "single" else "all")
diff --git a/pkgs/development/rocq-modules/micromega-plugin/default.nix b/pkgs/development/rocq-modules/micromega-plugin/default.nix
new file mode 100644
index 000000000000..dd773caebc55
--- /dev/null
+++ b/pkgs/development/rocq-modules/micromega-plugin/default.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  mkRocqDerivation,
+  rocq-core,
+  version ? null,
+}:
+
+mkRocqDerivation {
+  pname = "micromega-plugin";
+  owner = "rocq-community";
+  inherit version;
+  defaultVersion =
+    let
+      case = case: out: { inherit case out; };
+    in
+    with lib.versions;
+    lib.switch rocq-core.rocq-version [
+      (case (range "9.0" "9.2") "1.0.0")
+    ] null;
+
+  release = {
+    "1.0.0".sha256 = "sha256-srDOrGC4h21O9MIHfmOMJ0BKQhamaWyzQT72TwgfDYc=";
+  };
+  releaseRev = v: "v${v}";
+
+  mlPlugin = true;
+  useDune = true;
+
+  nativeBuildInputs = [
+    rocq-core.ocamlPackages.ppx_optcomp
+  ];
+
+  propagatedBuildInputs = [
+    rocq-core.ocamlPackages.findlib
+  ];
+
+  configurePhase = ''
+    patchShebangs etc/with-rocq-wrap.sh
+  '';
+
+  buildPhase = ''
+    etc/with-rocq-wrap.sh dune build -p micromega-plugin @install ''${enableParallelBuilding:+-j $NIX_BUILD_CORES}
+  '';
+
+  installPhase = ''
+    etc/with-rocq-wrap.sh dune install --root . micromega-plugin --prefix=$out --libdir $OCAMLFIND_DESTDIR
+    mkdir $out/lib/coq/
+    mv $OCAMLFIND_DESTDIR/coq $out/lib/coq/${rocq-core.rocq-version}
+  '';
+
+  meta = {
+    description = "Plugin for (semi)decision procedures for arithmetic.";
+    license = lib.licenses.lgpl21;
+  };
+}
diff --git a/pkgs/development/tools/analysis/rizin/cutter.nix b/pkgs/development/tools/analysis/rizin/cutter.nix
index d44b307c51e0..448ff92f6288 100644
--- a/pkgs/development/tools/analysis/rizin/cutter.nix
+++ b/pkgs/development/tools/analysis/rizin/cutter.nix
@@ -1,7 +1,7 @@
 {
   lib,
   fetchFromGitHub,
-  fetchpatch,
+  fetchpatch2,
   stdenv,
   # for passthru.plugins
   pkgs,
@@ -35,6 +35,14 @@ let
       fetchSubmodules = true;
     };
 
+    patches = [
+      (fetchpatch2 {
+        name = "fix-shiboken6-type-index-case.patch";
+        url = "https://github.com/rizinorg/cutter/commit/07fea9c772dc573588dc2e5771f0740ee1883738.patch?full_index=1";
+        hash = "sha256-/C/s+Ui5F7MCxbzbChQ5Tv/oUHUQxXmk9xOnNI80xwQ=";
+      })
+    ];
+
     nativeBuildInputs = [
       cmake
       pkg-config
diff --git a/pkgs/development/tools/mysql-shell/8.nix b/pkgs/development/tools/mysql-shell/8.nix
index 2e909658bbde..e144cc8a0b04 100644
--- a/pkgs/development/tools/mysql-shell/8.nix
+++ b/pkgs/development/tools/mysql-shell/8.nix
@@ -38,8 +38,8 @@ let
     pyyaml
   ];
 
-  mysqlShellVersion = "8.4.8";
-  mysqlServerVersion = "8.4.8";
+  mysqlShellVersion = "8.4.9";
+  mysqlServerVersion = "8.4.9";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mysql-shell";
@@ -48,11 +48,11 @@ stdenv.mkDerivation (finalAttrs: {
   srcs = [
     (fetchurl {
       url = "https://dev.mysql.com/get/Downloads/MySQL-${lib.versions.majorMinor mysqlServerVersion}/mysql-${mysqlServerVersion}.tar.gz";
-      hash = "sha256-vp2Wzfh/J2lSos3ZYPEGuWCohg5GwRXtOcG18uA4eiA=";
+      hash = "sha256-5KqLOeQtH+B48zu9c2lfrCtU28e7E38L2+Y/e+GgLWs=";
     })
     (fetchurl {
       url = "https://dev.mysql.com/get/Downloads/MySQL-Shell/mysql-shell-${finalAttrs.version}-src.tar.gz";
-      hash = "sha256-0mNO/uJVvVHRSDalOIuvQOOsDR6OukfJuov8Uasr0tE=";
+      hash = "sha256-btYUh/akFRCSOXDL1C5xuXLysHS1lm4H74kqY+4zyiQ=";
     })
   ];
 
diff --git a/pkgs/development/tools/mysql-shell/9.nix b/pkgs/development/tools/mysql-shell/9.nix
new file mode 100644
index 000000000000..0ff2adc4f547
--- /dev/null
+++ b/pkgs/development/tools/mysql-shell/9.nix
@@ -0,0 +1,157 @@
+{
+  lib,
+  stdenv,
+  pkg-config,
+  cmake,
+  fetchurl,
+  git,
+  cctools,
+  darwin,
+  makeWrapper,
+  bison,
+  openssl,
+  protobuf,
+  curl,
+  zlib,
+  libssh,
+  zstd,
+  lz4,
+  readline,
+  libtirpc,
+  rpcsvc-proto,
+  libedit,
+  libevent,
+  icu,
+  re2,
+  ncurses,
+  libfido2,
+  python3,
+  cyrus_sasl,
+  openldap,
+  antlr,
+}:
+
+let
+  pythonDeps = with python3.pkgs; [
+    certifi
+    paramiko
+    pyyaml
+  ];
+
+  mysqlShellVersion = "9.7.0";
+  mysqlServerVersion = "9.7.0";
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "mysql-shell";
+  version = mysqlShellVersion;
+
+  srcs = [
+    (fetchurl {
+      url = "https://dev.mysql.com/get/Downloads/MySQL-${lib.versions.majorMinor mysqlServerVersion}/mysql-${mysqlServerVersion}.tar.gz";
+      hash = "sha256-dLV0urxWsOy2MqvTWdITxnlOz0Qq5Ekov8WB+z1iMG0=";
+    })
+    (fetchurl {
+      url = "https://dev.mysql.com/get/Downloads/MySQL-Shell/mysql-shell-${finalAttrs.version}-src.tar.gz";
+      hash = "sha256-s/omxSFTC/n3B8OtYddDqXzCd4GE4b5O8NUKbLdvwRI=";
+    })
+  ];
+
+  sourceRoot = "mysql-shell-${finalAttrs.version}-src";
+
+  postUnpack = ''
+    mv mysql-${mysqlServerVersion} mysql
+  '';
+
+  patches = [
+    # No openssl bundling on macOS. It's not working.
+    # See https://github.com/mysql/mysql-shell/blob/5b84e0be59fc0e027ef3f4920df15f7be97624c1/cmake/ssl.cmake#L53
+    ./no-openssl-bundling.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace ../mysql/cmake/libutils.cmake --replace-fail /usr/bin/libtool libtool
+    substituteInPlace ../mysql/cmake/os/Darwin.cmake --replace-fail /usr/bin/libtool libtool
+
+    substituteInPlace cmake/libutils.cmake --replace-fail /usr/bin/libtool libtool
+  '';
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+    git
+    bison
+    protobuf
+    makeWrapper
+  ]
+  ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ rpcsvc-proto ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    cctools
+    darwin.DarwinTools
+  ];
+
+  buildInputs = [
+    curl
+    libedit
+    libssh
+    lz4
+    openssl
+    protobuf
+    readline
+    zlib
+    zstd
+    libevent
+    icu
+    re2
+    ncurses
+    libfido2
+    cyrus_sasl
+    openldap
+    python3
+    antlr.runtime.cpp
+  ]
+  ++ pythonDeps
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ libtirpc ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.libutil ];
+
+  env = {
+    ${if stdenv.cc.isGNU then "NIX_CFLAGS_COMPILE" else null} = "-Wno-error=maybe-uninitialized";
+  };
+
+  preConfigure = ''
+    # Build MySQL
+    echo "Building mysqlclient mysqlxclient"
+
+    cmake -DWITH_SYSTEM_LIBS=ON -DWITH_FIDO=system -DWITH_ROUTER=ON -DWITH_UNIT_TESTS=OFF \
+      -DFORCE_UNSUPPORTED_COMPILER=1 -S ../mysql -B ../mysql/build
+
+    cmake --build ../mysql/build --parallel ''${NIX_BUILD_CORES:-1} \
+      --target mysqlclient mysqlxclient mysqlbinlog mysql_binlog_event_standalone mysqlrouter_all
+
+    cmakeFlagsArray+=(
+      "-DMYSQL_SOURCE_DIR=''${NIX_BUILD_TOP}/mysql"
+      "-DMYSQL_BUILD_DIR=''${NIX_BUILD_TOP}/mysql/build"
+      "-DMYSQL_CONFIG_EXECUTABLE=''${NIX_BUILD_TOP}/mysql/build/scripts/mysql_config"
+      "-DWITH_ZSTD=system"
+      "-DWITH_LZ4=system"
+      "-DWITH_ZLIB=system"
+      "-DWITH_PROTOBUF=system"
+      "-DHAVE_PYTHON=1"
+    )
+  '';
+
+  postFixup = ''
+    wrapProgram $out/bin/mysqlsh --set PYTHONPATH "${lib.makeSearchPath python3.sitePackages pythonDeps}"
+  '';
+
+  meta = {
+    homepage = "https://dev.mysql.com/doc/mysql-shell/${lib.versions.majorMinor finalAttrs.version}/en/";
+    description = "New command line scriptable shell for MySQL";
+    license = lib.licenses.gpl2;
+    maintainers = with lib.maintainers; [ aaronjheng ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    mainProgram = "mysqlsh";
+  };
+})
diff --git a/pkgs/development/tools/mysql-shell/innovation.nix b/pkgs/development/tools/mysql-shell/innovation.nix
index 8834c6d69ebd..4d8428a23539 100644
--- a/pkgs/development/tools/mysql-shell/innovation.nix
+++ b/pkgs/development/tools/mysql-shell/innovation.nix
@@ -38,8 +38,8 @@ let
     pyyaml
   ];
 
-  mysqlShellVersion = "9.6.0";
-  mysqlServerVersion = "9.6.0";
+  mysqlShellVersion = "9.7.0";
+  mysqlServerVersion = "9.7.0";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mysql-shell-innovation";
@@ -48,11 +48,11 @@ stdenv.mkDerivation (finalAttrs: {
   srcs = [
     (fetchurl {
       url = "https://dev.mysql.com/get/Downloads/MySQL-${lib.versions.majorMinor mysqlServerVersion}/mysql-${mysqlServerVersion}.tar.gz";
-      hash = "sha256-JABh2GnVrhiMmjM4RZKImenZY8y9Z4Zaii5Lb8tnF4w=";
+      hash = "sha256-dLV0urxWsOy2MqvTWdITxnlOz0Qq5Ekov8WB+z1iMG0=";
     })
     (fetchurl {
       url = "https://dev.mysql.com/get/Downloads/MySQL-Shell/mysql-shell-${finalAttrs.version}-src.tar.gz";
-      hash = "sha256-WnCr/poMsxtaS9k7/6QZDkFPOZlf7WAELsqFGpnUwf4=";
+      hash = "sha256-s/omxSFTC/n3B8OtYddDqXzCd4GE4b5O8NUKbLdvwRI=";
     })
   ];
 
diff --git a/pkgs/servers/home-assistant/custom-components/bodymiscale/package.nix b/pkgs/servers/home-assistant/custom-components/bodymiscale/package.nix
index 8048490c4e66..81f1e0b7a974 100644
--- a/pkgs/servers/home-assistant/custom-components/bodymiscale/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/bodymiscale/package.nix
@@ -9,13 +9,13 @@
 buildHomeAssistantComponent rec {
   owner = "dckiller51";
   domain = "bodymiscale";
-  version = "2026.4.3";
+  version = "2026.4.5";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = domain;
     rev = version;
-    hash = "sha256-hkwOgEiBqx0w8gc8ZouH6LWz/psZPT3E3scdKHugsYI=";
+    hash = "sha256-L7HuBQ3NKp2vfJmo29Ju40+MC5DkgtQUi7sXnMbKHoM=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/home-assistant/custom-components/browser-mod/package.nix b/pkgs/servers/home-assistant/custom-components/browser-mod/package.nix
index 7a3175c75024..ab0379ff29a4 100644
--- a/pkgs/servers/home-assistant/custom-components/browser-mod/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/browser-mod/package.nix
@@ -10,13 +10,13 @@
 buildHomeAssistantComponent rec {
   owner = "thomasloven";
   domain = "browser_mod";
-  version = "2.11.0";
+  version = "2.12.0";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "hass-browser_mod";
     tag = "v${version}";
-    hash = "sha256-IenC39xaHxD7Q+r8w4zfn8ZwF+s7i+dliwG4lOPPLHk=";
+    hash = "sha256-z2Q6s3Dg536/PxViUUbR3NMl30y31i0xKFWGMn+vqEg=";
   };
 
   nativeBuildInputs = [
@@ -27,7 +27,7 @@ buildHomeAssistantComponent rec {
 
   npmDeps = fetchNpmDeps {
     inherit src;
-    hash = "sha256-DmN2gWhtfGhqLJpSXW7XAt9stvsH6jJfR4FUQOZqh6M=";
+    hash = "sha256-a17iqEw+aierisbYs+blFY3R0Tsm6zQ4A5i+Q6fExWg=";
   };
 
   npmBuildScript = "build";
diff --git a/pkgs/servers/home-assistant/custom-components/openplantbook/package.nix b/pkgs/servers/home-assistant/custom-components/openplantbook/package.nix
index e33f2d14ffbd..05f04c00b483 100644
--- a/pkgs/servers/home-assistant/custom-components/openplantbook/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/openplantbook/package.nix
@@ -20,10 +20,10 @@ buildHomeAssistantComponent rec {
     hash = "sha256-Ym7bt+0s7eqlL3oDtppIGenoW1XvrSjKkV2flE0TzUo=";
   };
 
-  postPatch = ''
-    substituteInPlace custom_components/openplantbook/manifest.json \
-      --replace-fail "==" ">="
-  '';
+  ignoreVersionRequirement = [
+    "json-timeseries"
+    "openplantbook-sdk"
+  ];
 
   dependencies = [
     json-timeseries
diff --git a/pkgs/servers/home-assistant/custom-components/thewatchman/package.nix b/pkgs/servers/home-assistant/custom-components/thewatchman/package.nix
index 08e1ff7ad81c..80405cf4ba7e 100644
--- a/pkgs/servers/home-assistant/custom-components/thewatchman/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/thewatchman/package.nix
@@ -20,10 +20,9 @@ buildHomeAssistantComponent rec {
     hash = "sha256-5BXIKh8uPKuxsLbxu0fUbuCR2LYOXk1HpOvrqehg0u0=";
   };
 
-  postPatch = ''
-    substituteInPlace custom_components/watchman/manifest.json \
-      --replace-fail "prettytable==3.12.0" "prettytable"
-  '';
+  ignoreVersionRequirement = [
+    "prettytable"
+  ];
 
   dontBuild = true;
 
diff --git a/pkgs/servers/http/apache-httpd/2.4.nix b/pkgs/servers/http/apache-httpd/2.4.nix
index 7fb86808a605..81d4ea6199d5 100644
--- a/pkgs/servers/http/apache-httpd/2.4.nix
+++ b/pkgs/servers/http/apache-httpd/2.4.nix
@@ -33,11 +33,11 @@
 
 stdenv.mkDerivation rec {
   pname = "apache-httpd";
-  version = "2.4.66";
+  version = "2.4.67";
 
   src = fetchurl {
     url = "mirror://apache/httpd/httpd-${version}.tar.bz2";
-    hash = "sha256-lNf/K0Ksu4KOhwuinky61I5VinnGI601luQRbvz+olo=";
+    hash = "sha256-Zs0gZjew1cRG+n2r51/gNSXaj7VYVYdsRiiM2IsTaqQ=";
   };
 
   patches = [
diff --git a/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix b/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix
index 2d3b5d87eb89..1f1b78033cfe 100644
--- a/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix
@@ -2,8 +2,8 @@
 
 grafanaPlugin {
   pname = "grafana-lokiexplore-app";
-  version = "2.0.3";
-  zipHash = "sha256-K57ynUi6kRZIMaZD9rMa7aToue75fHAQBFPJLF1cy3o=";
+  version = "2.0.4";
+  zipHash = "sha256-hne6G+Hmih+SYo4A1Gk7yHRMPA1IoCJoPlclTOpMKJc=";
   meta = {
     description = "Browse Loki logs without the need for writing complex queries";
     license = lib.licenses.agpl3Only;
diff --git a/pkgs/servers/monitoring/grafana/plugins/volkovlabs-form-panel/default.nix b/pkgs/servers/monitoring/grafana/plugins/volkovlabs-form-panel/default.nix
index ffd593d22b7f..3a440ef98d61 100644
--- a/pkgs/servers/monitoring/grafana/plugins/volkovlabs-form-panel/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/volkovlabs-form-panel/default.nix
@@ -2,8 +2,8 @@
 
 grafanaPlugin {
   pname = "volkovlabs-form-panel";
-  version = "6.3.2";
-  zipHash = "sha256-RuwZaAqSwMvWN15jz0+r7DuZyrE52zYD8EBffFTQNEg=";
+  version = "6.3.3";
+  zipHash = "sha256-nhHTNKqnSAGSpsAOB1IjcA4zm013ywJf/ucJzAm9osQ=";
   meta = {
     description = "Plugin that allows inserting and updating application data, as well as modifying configuration directly from your Grafana dashboard";
     license = lib.licenses.asl20;
diff --git a/pkgs/servers/monitoring/sensu-go/default.nix b/pkgs/servers/monitoring/sensu-go/default.nix
index e16ee5826846..8975d692ac0f 100644
--- a/pkgs/servers/monitoring/sensu-go/default.nix
+++ b/pkgs/servers/monitoring/sensu-go/default.nix
@@ -14,19 +14,19 @@ let
     }:
     buildGoModule rec {
       inherit pname;
-      version = "6.14.0";
+      version = "6.14.1";
       shortRev = "591ed6e"; # for internal version info
 
       src = fetchFromGitHub {
         owner = "sensu";
         repo = "sensu-go";
         rev = "v${version}";
-        sha256 = "sha256-/1oQz7mZyhH5U7DoVhRYnLv7AvwFrN1OBx9EEK+sCEw=";
+        sha256 = "sha256-1/yV+NdRfB0dTGWcQUx/vgDNvshn+lYN0gxMQMm/+I0=";
       };
 
       inherit subPackages postInstall;
 
-      vendorHash = "sha256-ylzMqc+zTtuttLl75ILG0OzA/PqfrpvsiKhW6cPx+ls=";
+      vendorHash = "sha256-lww3dO4kdYqql6fZj/wOVmwENFaUSWdgNyXvBwwvasE=";
 
       doCheck = false;
 
diff --git a/pkgs/shells/fish/plugins/exercism-cli-fish-wrapper.nix b/pkgs/shells/fish/plugins/exercism-cli-fish-wrapper.nix
index a19d9556bd42..a8881824d88f 100644
--- a/pkgs/shells/fish/plugins/exercism-cli-fish-wrapper.nix
+++ b/pkgs/shells/fish/plugins/exercism-cli-fish-wrapper.nix
@@ -6,13 +6,13 @@
 }:
 buildFishPlugin {
   pname = "exercism-cli-fish-wrapper";
-  version = "0-unstable-2026-04-06";
+  version = "0-unstable-2026-05-04";
 
   src = fetchFromGitHub {
     owner = "glennj";
     repo = "exercism-cli-fish-wrapper";
-    rev = "948357dbc5ed00054e9ec6aae48084ce56efa76e";
-    hash = "sha256-bbOZmSz6UWSNk0R5TYcuJFNZq0JQlGGRBO8bUabN+zQ=";
+    rev = "dcf821898828b53e36f40943719546d41f8434b4";
+    hash = "sha256-UupN+Pj1eUx5YXDcfU94lnQdvpDsA0D+AQYuX+WGI14=";
   };
 
   passthru.updateScript = unstableGitUpdater { };
diff --git a/pkgs/tools/misc/tdarr/common.nix b/pkgs/tools/misc/tdarr/common.nix
index 6ef7469c2308..499e642b4c95 100644
--- a/pkgs/tools/misc/tdarr/common.nix
+++ b/pkgs/tools/misc/tdarr/common.nix
@@ -24,6 +24,7 @@
   libxfixes,
   tesseract4,
   perl,
+  apprise,
 }:
 {
   pname,
@@ -129,6 +130,7 @@ stdenv.mkDerivation (finalAttrs: {
     libx11
     libxcursor
     libxfixes
+    apprise
   ];
 
   postPatch = ''
@@ -159,6 +161,12 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   postInstall = ''
+    # Remove musl-only prebuilt Node addons on glibc systems.
+    # autoPatchelf scans all ELF files in $out and fails if musl libc is missing.
+    ${lib.optionalString (stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isMusl) ''
+      find $out/share/${pname} -type f -name '*.musl.node' -delete
+    ''}
+
     makeWrapper $out/share/${pname}/${componentName} $out/bin/${pname} ${commonWrapperArgs}
     makeWrapper $out/share/${pname}/${componentTrayName} $out/bin/${pname}-tray ${commonWrapperArgs}
   ''
diff --git a/pkgs/tools/misc/tdarr/node.nix b/pkgs/tools/misc/tdarr/node.nix
index 869ac289ce23..980cc208b0bb 100644
--- a/pkgs/tools/misc/tdarr/node.nix
+++ b/pkgs/tools/misc/tdarr/node.nix
@@ -1,4 +1,4 @@
-{ callPackage }:
+{ callPackage, ccextractor }:
 
 callPackage ./common.nix { } {
   pname = "tdarr-node";
@@ -10,4 +10,6 @@ callPackage ./common.nix { } {
     darwin_x64 = "sha256-icgzoHqZ+P6gXJ8jQTau3O2D6uRvET4MtNoWJI/JnvM=";
     darwin_arm64 = "sha256-Rw478IpDLLe+Ek3Jt5Duaq1sHL1D3pE0HkVqk+v1ECE=";
   };
+
+  includeInPath = [ ccextractor ];
 }
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index b61946a2ca7f..d585c9aa8529 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.130"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.131"
 
 gem "syslog", "~> 0.3.0"
 gem 'mini_portile2', '~> 2.8.0'
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index 1a74f5dd080c..67268ea9ea24 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: e80a8066cd4c7177d821c04c886e3d0d90478bed
-  ref: refs/tags/6.4.130
+  revision: 69fa9eb257ea532c8e0f6ecd545b7e1257d42899
+  ref: refs/tags/6.4.131
   specs:
-    metasploit-framework (6.4.130)
+    metasploit-framework (6.4.131)
       aarch64
       abbrev
       actionpack (~> 7.2.0)
@@ -44,6 +44,7 @@ GIT
       jsobfu
       json
       lru_redux
+      mcp (= 0.13.0)
       metasm
       metasploit-concern
       metasploit-credential (>= 6.0.21)
@@ -174,7 +175,7 @@ GEM
     arel-helpers (2.17.0)
       activerecord (>= 3.1.0)
     aws-eventstream (1.4.0)
-    aws-partitions (1.1242.0)
+    aws-partitions (1.1245.0)
     aws-sdk-core (3.246.0)
       aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.992.0)
@@ -183,13 +184,13 @@ GEM
       bigdecimal
       jmespath (~> 1, >= 1.6.1)
       logger
-    aws-sdk-ec2 (1.613.0)
+    aws-sdk-ec2 (1.614.0)
       aws-sdk-core (~> 3, >= 3.244.0)
       aws-sigv4 (~> 1.5)
     aws-sdk-ec2instanceconnect (1.70.0)
       aws-sdk-core (~> 3, >= 3.244.0)
       aws-sigv4 (~> 1.5)
-    aws-sdk-iam (1.142.0)
+    aws-sdk-iam (1.143.0)
       aws-sdk-core (~> 3, >= 3.244.0)
       aws-sigv4 (~> 1.5)
     aws-sdk-kms (1.124.0)
@@ -210,7 +211,7 @@ GEM
     benchmark (0.5.0)
     bigdecimal (4.1.2)
     bindata (2.4.15)
-    bootsnap (1.24.1)
+    bootsnap (1.24.3)
       msgpack (~> 1.2)
     bson (5.2.0)
     builder (3.3.0)
@@ -290,7 +291,10 @@ GEM
     jmespath (1.6.2)
     jsobfu (0.4.2)
       rkelly-remix
-    json (2.19.4)
+    json (2.19.5)
+    json-schema (6.2.0)
+      addressable (~> 2.8)
+      bigdecimal (>= 3.1, < 5)
     little-plugger (1.1.4)
     logger (1.7.0)
     logging (2.4.0)
@@ -300,6 +304,8 @@ GEM
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
     lru_redux (1.1.0)
+    mcp (0.13.0)
+      json-schema (>= 4.1)
     metasm (1.0.5)
     metasploit-concern (5.0.6)
       activemodel (>= 7.0, < 8.1)
@@ -353,7 +359,7 @@ GEM
     mqtt (0.7.0)
       logger
     msgpack (1.6.1)
-    multi_json (1.20.1)
+    multi_json (1.21.1)
     mustermann (3.1.1)
     mutex_m (0.3.0)
     nessus_rest (0.1.6)
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index 7d5486fb68bd..79373b655e7e 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "metasploit-framework";
-  version = "6.4.130";
+  version = "6.4.131";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     tag = finalAttrs.version;
-    hash = "sha256-t50ZF2TobEVwQFgLp0lHQq2QNpplqIfVbNjWRIyxMXw=";
+    hash = "sha256-7u03A8H5vLQXekVLQ6oQtLwC6SW0JLqk37GUyjgtiZU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index 18e6f0acffe2..5ea6776a5ce2 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -124,10 +124,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0llkqgj1hzdnj1v0qk7v3lj09c0g7hy60pnmm23r5ksc92snm22q";
+      sha256 = "0ipmr7n0affhj0y08a049wyz3n480i92y2s49v6qgsxs86y02dbi";
       type = "gem";
     };
-    version = "1.1242.0";
+    version = "1.1245.0";
   };
   aws-sdk-core = {
     groups = [ "default" ];
@@ -144,10 +144,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "09qbc4sfqgwmis289w24h4w6b40mg86c54s0xw0jm1sbb7mwv648";
+      sha256 = "0qq191bqffds55aw0dpi7iyl9135p12gj52ianrkan4l5l0bmwkb";
       type = "gem";
     };
-    version = "1.613.0";
+    version = "1.614.0";
   };
   aws-sdk-ec2instanceconnect = {
     groups = [ "default" ];
@@ -164,10 +164,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0jx5xrpw40nv5pfv8rvz7y8xhvxm756igcn4nr08agxd6byv7jk1";
+      sha256 = "14lhz5awd4g7nyaqq7vdigsw45r1vz7vbmkfhgp3946pxiib6cv5";
       type = "gem";
     };
-    version = "1.142.0";
+    version = "1.143.0";
   };
   aws-sdk-kms = {
     groups = [ "default" ];
@@ -274,10 +274,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1vrrblvh512xw4awcjfx2h5zdsv4dciwjjf0mhnv59aaq8fymynp";
+      sha256 = "1n6a9m8rb20yzb20w89fkjgggm2lzf1vl6ha5fjhlbvyb4h3vypp";
       type = "gem";
     };
-    version = "1.24.1";
+    version = "1.24.3";
   };
   bson = {
     groups = [ "default" ];
@@ -744,10 +744,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1b1rabz30grash5wh0lcv109w2ggggmmbclwnajqrcdk7wrps2k7";
+      sha256 = "0n9ch455pnvl9vxs2f3j77bpdmxg5g3mn3vyr9wxa0a87raii2i1";
       type = "gem";
     };
-    version = "2.19.4";
+    version = "2.19.5";
+  };
+  json-schema = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0rinh4347nvl9jm0r4mk7gi1zh1iz367w3dxn8d2r8j5v1pg9gz8";
+      type = "gem";
+    };
+    version = "6.2.0";
   };
   little-plugger = {
     groups = [ "default" ];
@@ -799,6 +809,16 @@
     };
     version = "1.1.0";
   };
+  mcp = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1mdigs4shvxkbs7fyhw8fss9fn4wd1lv9921iq27ply8kkn74plf";
+      type = "gem";
+    };
+    version = "0.13.0";
+  };
   metasm = {
     groups = [ "default" ];
     platforms = [ ];
@@ -834,12 +854,12 @@
     platforms = [ ];
     source = {
       fetchSubmodules = false;
-      rev = "e80a8066cd4c7177d821c04c886e3d0d90478bed";
-      sha256 = "0z1in6649mnqdkaqga35k8v91ba28x4sf2sq81q4av78chbik7dp";
+      rev = "69fa9eb257ea532c8e0f6ecd545b7e1257d42899";
+      sha256 = "15c95lwcm55ivyjbl95l4plh5g5l22m46js5g8bv9g7rq41kgvgf";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.4.130";
+    version = "6.4.131";
   };
   metasploit-model = {
     groups = [ "default" ];
@@ -946,10 +966,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0vfaab23d85617ps412ydb8ap4ci1sfzi8ainn8yyifc0pl38f9g";
+      sha256 = "1040lr5y2phn7avdyam6zw6ikprlmk77biw3yhclsfwfh0qnl4p6";
       type = "gem";
     };
-    version = "1.20.1";
+    version = "1.21.1";
   };
   mustermann = {
     groups = [ "default" ];
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index de766a5981cd..b99ec6ad47d5 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -910,6 +910,7 @@ mapAliases {
   gradience = throw "`gradience` has been removed because it was archived upstream."; # Added 2025-09-20
   gradleGen = throw "'gradleGen' has been moved to `gradle-packages.mkGradle`."; # Added 2025-11-02
   grafana_reporter = throw "'grafana_reporter' has been renamed to/replaced by 'grafana-reporter'"; # Converted to throw 2025-10-27
+  graphia = throw "'graphia' has been removed due to being unmaintained and broken"; # Added 2026-05-05
   graphite-kde-theme = throw "'graphite-kde-theme' has been removed, as it is only compatible with Plasma 5, which is EOL"; # Added 2025-08-20
   gringo = throw "'gringo' has been renamed to/replaced by 'clingo'"; # Converted to throw 2025-10-27
   grub2_full = throw "'grub2_full' has been renamed to/replaced by 'grub2'"; # Converted to throw 2025-10-27
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 947fcf6bc63e..e2857a88f812 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -485,9 +485,6 @@ with pkgs;
 
   buildDotnetPackage = callPackage ../build-support/dotnet/build-dotnet-package { };
   fetchNuGet = callPackage ../build-support/dotnet/fetchnuget { };
-  dupeguru = callPackage ../applications/misc/dupeguru {
-    python3Packages = python311Packages;
-  };
 
   fetchbzr = callPackage ../build-support/fetchbzr { };
 
@@ -560,8 +557,18 @@ with pkgs;
           else
             stdenv;
       };
+
+      mysql-shell_9 = callPackage ../development/tools/mysql-shell/9.nix {
+        antlr = antlr4_10;
+        icu = icu77;
+        protobuf = protobuf_25.override {
+          abseil-cpp = abseil-cpp_202407;
+        };
+        stdenv = if stdenv.cc.isGNU then gcc14Stdenv else stdenv;
+      };
     })
     mysql-shell_8
+    mysql-shell_9
     ;
 
   mysql-shell-innovation = callPackage ../development/tools/mysql-shell/innovation.nix {
@@ -570,13 +577,7 @@ with pkgs;
     protobuf = protobuf_25.override {
       abseil-cpp = abseil-cpp_202407;
     };
-    stdenv =
-      if stdenv.cc.isClang then
-        llvmPackages_19.stdenv
-      else if stdenv.cc.isGNU then
-        gcc14Stdenv
-      else
-        stdenv;
+    stdenv = if stdenv.cc.isGNU then gcc14Stdenv else stdenv;
   };
 
   # this is used by most `fetch*` functions
diff --git a/pkgs/top-level/coq-packages.nix b/pkgs/top-level/coq-packages.nix
index 995f14930b8e..b2cd7f2ada19 100644
--- a/pkgs/top-level/coq-packages.nix
+++ b/pkgs/top-level/coq-packages.nix
@@ -88,7 +88,6 @@ let
           lib
           stdenv
           ;
-        ocamlPackages = ocamlPackages_4_14;
       };
       ConCert = callPackage ../development/coq-modules/ConCert { };
       coq-bits = callPackage ../development/coq-modules/coq-bits { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e8558e3a9521..b2b874c0337a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2512,6 +2512,8 @@ self: super: with self; {
 
   casa-formats-io = callPackage ../development/python-modules/casa-formats-io { };
 
+  casaconfig = callPackage ../development/python-modules/casaconfig { };
+
   casadi = toPythonModule (
     pkgs.casadi.override {
       pythonSupport = true;
@@ -2519,6 +2521,10 @@ self: super: with self; {
     }
   );
 
+  casatasks = callPackage ../development/python-modules/casatasks { };
+
+  casatools = callPackage ../development/python-modules/casatools { };
+
   case-converter = callPackage ../development/python-modules/case-converter { };
 
   cashaddress = callPackage ../development/python-modules/cashaddress { };
@@ -19039,7 +19045,6 @@ self: super: with self; {
 
   taco = toPythonModule (
     pkgs.taco.override {
-      inherit (self) python;
       enablePython = true;
     }
   );
@@ -19598,6 +19603,8 @@ self: super: with self; {
 
   torch-c-dlpack-ext = callPackage ../development/python-modules/torch-c-dlpack-ext { };
 
+  torch-einops-utils = callPackage ../development/python-modules/torch-einops-utils { };
+
   torch-geometric = callPackage ../development/python-modules/torch-geometric { };
 
   # Required to test triton
diff --git a/pkgs/top-level/rocq-packages.nix b/pkgs/top-level/rocq-packages.nix
index a6ca3f9b04c9..34af9d8c93a5 100644
--- a/pkgs/top-level/rocq-packages.nix
+++ b/pkgs/top-level/rocq-packages.nix
@@ -57,6 +57,7 @@ let
       mathcomp-finmap = callPackage ../development/rocq-modules/mathcomp-finmap { };
       mathcomp-reals = self.mathcomp-analysis.reals;
       mathcomp-reals-stdlib = self.mathcomp-analysis.reals-stdlib;
+      micromega-plugin = callPackage ../development/rocq-modules/micromega-plugin { };
       parseque = callPackage ../development/rocq-modules/parseque { };
       relation-algebra = callPackage ../development/rocq-modules/relation-algebra { };
       rocq-elpi = callPackage ../development/rocq-modules/rocq-elpi { };