diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index bdce1ec0002c..afd1340bcc6b 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -8757,6 +8757,12 @@
     githubId = 40620903;
     name = "figsoda";
   };
+  fin-w = {
+    email = "fin-w@tutanota.com";
+    github = "fin-w";
+    githubId = 41450706;
+    name = "fin-w";
+  };
   fionera = {
     email = "nix@fionera.de";
     github = "fionera";
diff --git a/nixos/modules/services/misc/devpi-server.nix b/nixos/modules/services/misc/devpi-server.nix
index 6d132a38bb71..c56c11ed2884 100644
--- a/nixos/modules/services/misc/devpi-server.nix
+++ b/nixos/modules/services/misc/devpi-server.nix
@@ -1,21 +1,25 @@
 {
-  pkgs,
-  lib,
   config,
+  lib,
+  pkgs,
   ...
 }:
+
 let
+
   cfg = config.services.devpi-server;
-
+  package = cfg.package.override { inherit (cfg) extraPackages; };
   secretsFileName = "devpi-secret-file";
-
   stateDirName = "devpi";
-
   runtimeDir = "/run/${stateDirName}";
   serverDir = "/var/lib/${stateDirName}";
+
 in
+
 {
+
   options.services.devpi-server = {
+
     enable = lib.mkEnableOption "Devpi Server";
 
     package = lib.mkPackageOption pkgs "devpi-server" { };
@@ -57,6 +61,20 @@ in
       description = "The port on which Devpi Server will listen.";
     };
 
+    extraPackages = lib.mkOption {
+      default = (ps: [ ]);
+      defaultText = lib.literalExpression "ps: [ ]";
+      example = lib.literalExpression ''
+        ps: with ps; [ devpi-web devpi-ldap ]
+      '';
+      type =
+        with lib.types;
+        coercedTo (listOf lib.types.package) (v: (_: v)) (functionTo (listOf lib.types.package));
+      description = ''
+        Plugins and extra Python packages to be available to devpi-server.
+      '';
+    };
+
     openFirewall = lib.mkEnableOption "opening the default ports in the firewall for Devpi Server";
   };
 
@@ -80,7 +98,7 @@ in
           # already initialized the package index, exit gracefully
           exit 0
         fi
-        ${cfg.package}/bin/devpi-init --serverdir ${serverDir} ''
+        ${package}/bin/devpi-init --serverdir ${serverDir} ''
       + lib.optionalString cfg.replica "--role=replica --master-url=${cfg.primaryUrl}";
 
       serviceConfig = {
@@ -109,7 +127,7 @@ in
                 [ "--role=master" ]
             );
           in
-          "${cfg.package}/bin/devpi-server ${lib.concatStringsSep " " args}";
+          "${package}/bin/devpi-server ${lib.concatStringsSep " " args}";
         DynamicUser = true;
         StateDirectory = stateDirName;
         RuntimeDirectory = stateDirName;
@@ -125,5 +143,8 @@ in
     };
   };
 
-  meta.maintainers = [ lib.maintainers.cafkafk ];
+  meta.maintainers = with lib.maintainers; [
+    cafkafk
+    confus
+  ];
 }
diff --git a/nixos/tests/web-apps/immich-vectorchord-reindex.nix b/nixos/tests/web-apps/immich-vectorchord-reindex.nix
index 65cd403feca7..65308d11838f 100644
--- a/nixos/tests/web-apps/immich-vectorchord-reindex.nix
+++ b/nixos/tests/web-apps/immich-vectorchord-reindex.nix
@@ -17,24 +17,38 @@
         environment.IMMICH_LOG_LEVEL = "verbose";
       };
 
-      services.postgresql.extensions = lib.mkForce (ps: [
-        ps.pgvector
-        # pin vectorchord to an older version simulate version bump
-        (ps.vectorchord.overrideAttrs (prevAttrs': rec {
-          version = "0.5.2";
-          src = pkgs.fetchFromGitHub {
-            owner = "tensorchord";
-            repo = "vectorchord";
-            tag = version;
-            hash = "sha256-KGwiY5t1ivFiYex3D20y3sdiu3CT9LCDd2fPnRE56jM=";
-          };
+      services.postgresql.extensions = lib.mkForce (
+        ps:
+        let
+          # Pin vectorchord to an older version simulate version bump.
+          # This version must have a different "schema" version than the latest version in nixpkgs.
+          # See version number at https://github.com/tensorchord/VectorChord/blob/1.1.0/crates/vchordrq/src/tuples.rs#L23
+          vectorchord =
+            (ps.vectorchord.override {
+              cargo-pgrx_0_17_0 = pkgs.cargo-pgrx_0_16_0;
+            }).overrideAttrs
+              (
+                finalAttrs: _: {
+                  version = "1.0.0";
+                  src = pkgs.fetchFromGitHub {
+                    owner = "tensorchord";
+                    repo = "vectorchord";
+                    tag = finalAttrs.version;
+                    hash = "sha256-+BOuiinbKPZZaDl9aYsIoZPgvLZ4FA6Rb4/W+lAz4so=";
+                  };
 
-          cargoDeps = pkgs.rustPlatform.fetchCargoVendor {
-            inherit src;
-            hash = "sha256-Vn3c/xuUpQzERJ74I0qbvufTZtW3goefPa5B/nOUO48=";
-          };
-        }))
-      ]);
+                  cargoDeps = pkgs.rustPlatform.fetchCargoVendor {
+                    inherit (finalAttrs) src;
+                    hash = "sha256-kwe2x7OTjpdPonZsvnR1C/89D5W/R5JswYF79YcSFEA=";
+                  };
+                }
+              );
+        in
+        [
+          ps.pgvector
+          vectorchord
+        ]
+      );
 
       specialisation."immich-vectorchord-upgraded".configuration = {
         # needs to be lower than mkForce, otherwise it does not get rid of the previous version
diff --git a/pkgs/applications/editors/neovim/module.nix b/pkgs/applications/editors/neovim/module.nix
index 41b56b81113d..258352c4e41b 100644
--- a/pkgs/applications/editors/neovim/module.nix
+++ b/pkgs/applications/editors/neovim/module.nix
@@ -13,7 +13,7 @@ let
         optional = false;
       };
     in
-    map (x: defaultPlugin // (if (x ? plugin) then x else { plugin = x; })) plugins;
+    map (x: defaultPlugin // (if x ? plugin then x else { plugin = x; })) plugins;
 
   pluginWithConfigType =
     with lib;
@@ -78,17 +78,26 @@ in
 
     userPluginViml = lib.mkOption {
       readOnly = true;
-      type = lib.types.listOf (lib.types.lines);
+      type = lib.types.listOf lib.types.lines;
       description = ''
         The viml config set by the user.
       '';
     };
 
+    pluginPython3Packages = lib.mkOption {
+      readOnly = true;
+      type = lib.types.listOf (lib.types.functionTo (lib.types.listOf lib.types.package));
+      example = lib.literalExpression "[ (ps: [ ps.python-language-server ]) ]";
+      description = ''
+        Packages required by the plugins to work with the python3 provider.
+      '';
+    };
+
   };
 
   config =
     let
-      pluginsNormalized = normalizePlugins config.plugins;
+      pluginsNormalized = config.plugins;
     in
     {
       pluginAdvisedLua =
@@ -111,5 +120,7 @@ in
       userPluginViml = lib.foldl (
         acc: p: if p.config != null then acc ++ [ p.config ] else acc
       ) [ ] pluginsNormalized;
+
+      pluginPython3Packages = map (plugin: plugin.python3Dependencies or (_: [ ])) pluginsNormalized;
     };
 }
diff --git a/pkgs/applications/editors/neovim/utils.nix b/pkgs/applications/editors/neovim/utils.nix
index a358b96a3ba2..df9411ca269d 100644
--- a/pkgs/applications/editors/neovim/utils.nix
+++ b/pkgs/applications/editors/neovim/utils.nix
@@ -99,24 +99,19 @@ let
         inherit plugins;
       };
 
-      pluginsNormalized = normalizePlugins plugins;
+      pluginsNormalized = checked_cfg.plugins;
 
       vimPackage = normalizedPluginsToVimPackage pluginsNormalized;
 
-      getDeps = attrname: map (plugin: plugin.${attrname} or (_: [ ]));
-
-      requiredPlugins = vimUtils.requiredPluginsForPackage vimPackage;
-      pluginPython3Packages = getDeps "python3Dependencies" requiredPlugins;
     in
     {
-      # plugins' python dependencies
-      inherit pluginPython3Packages;
 
       # viml config set by the user along with the plugin
       inherit (checked_cfg)
         userPluginViml
         runtimeDeps
         pluginAdvisedLua
+        pluginPython3Packages
         ;
 
       # A Vim "package", see ':h packages'
diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 56cded54d861..fed532fc1649 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -307,8 +307,8 @@ let
       ${virtiofsd}/bin/virtiofsd --xattr --socket-path virtio-xchg.sock --sandbox none --seccomp none --shared-dir xchg &
 
       # Wait until virtiofsd has created these sockets to avoid race condition.
-      until [[ -e virtio-store.sock ]]; do ${coreutils}/bin/sleep 1; done
-      until [[ -e virtio-xchg.sock ]]; do ${coreutils}/bin/sleep 1; done
+      until [[ -e virtio-store.sock ]]; do ${coreutils}/bin/sleep 0.1; done
+      until [[ -e virtio-xchg.sock ]]; do ${coreutils}/bin/sleep 0.1; done
 
       ${qemuCommand}
       EOF
diff --git a/pkgs/by-name/bu/buf/package.nix b/pkgs/by-name/bu/buf/package.nix
index 59f715a8872f..b0f52a1a437b 100644
--- a/pkgs/by-name/bu/buf/package.nix
+++ b/pkgs/by-name/bu/buf/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "buf";
-  version = "1.64.0";
+  version = "1.66.1";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = "buf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vz7HtNe198Wjy4bjpx327VW11Qme5VWZMyeb56nWy0A=";
+    hash = "sha256-bBQSQ/ZLLSEYVmfpgh5OKapSHdBOFjrjAaMT/0js1Ts=";
   };
 
-  vendorHash = "sha256-jBwIDPDRdXO89uyrw2Ul2uE50zCLxS9qBzoYOQXupUQ=";
+  vendorHash = "sha256-JFuH/NXWhw/Myzk2ct5xzKGuMM4ma0og2YT7ZIq3kKg=";
 
   patches = [
     # Skip a test that requires networking to be available to work.
@@ -45,8 +45,8 @@ buildGoModule (finalAttrs: {
   preCheck = ''
     # Some tests take longer depending on builder load.
     substituteInPlace private/bufpkg/bufcheck/lint_test.go \
-      --replace-fail 'context.WithTimeout(context.Background(), 60*time.Second)' \
-                     'context.WithTimeout(context.Background(), 600*time.Second)'
+      --replace-fail 'context.WithTimeout(t.Context(), 60*time.Second)' \
+                     'context.WithTimeout(t.Context(), 600*time.Second)'
     # For WebAssembly runtime tests
     GOOS=wasip1 GOARCH=wasm go build -o $GOPATH/bin/buf-plugin-suffix.wasm \
       ./private/bufpkg/bufcheck/internal/cmd/buf-plugin-suffix
@@ -88,6 +88,7 @@ buildGoModule (finalAttrs: {
     description = "Create consistent Protobuf APIs that preserve compatibility and comply with design best-practices";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
+      hythera
       jk
       lrewega
     ];
diff --git a/pkgs/by-name/ca/cargo-codspeed/package.nix b/pkgs/by-name/ca/cargo-codspeed/package.nix
index b0a4afe6efaa..47807d9e4735 100644
--- a/pkgs/by-name/ca/cargo-codspeed/package.nix
+++ b/pkgs/by-name/ca/cargo-codspeed/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-codspeed";
-  version = "4.3.0";
+  version = "4.4.0";
 
   src = fetchFromGitHub {
     owner = "CodSpeedHQ";
     repo = "codspeed-rust";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-aOuKz7LEQU9hqJUw0M759A4zk8+9UhiMAnO7OwBc+T0=";
+    hash = "sha256-hvGpJXkdvVgN1I0xYomdlu0V0zjYK+qZB/FZ6FLbq1s=";
   };
 
-  cargoHash = "sha256-K1xm8Kw7TMspFmqvW4qRf4QXddarw3eUDTIuwbg1pGA=";
+  cargoHash = "sha256-oT10BxbLyHUBz9DHDyBNuqWNYK9zHUo8nlH+cr+LaR0=";
 
   nativeBuildInputs = [
     curl
diff --git a/pkgs/by-name/ca/cargo-sort/package.nix b/pkgs/by-name/ca/cargo-sort/package.nix
index a41fb567dac5..9beb3c60f9b6 100644
--- a/pkgs/by-name/ca/cargo-sort/package.nix
+++ b/pkgs/by-name/ca/cargo-sort/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-sort";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "devinr528";
     repo = "cargo-sort";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-jmiCwXRyuK10qb1/7bwhOT/Cq335S9BzKiRc/02wc1E=";
+    sha256 = "sha256-Ad4arLpD8tgNDUGHKBbIKt41oQfjMgzzyWnnw8Cjw0k=";
   };
 
-  cargoHash = "sha256-EzKXrN5TdWFP8zQjop2pIhavJ5a7t+YdK5s5WjwjLNM=";
+  cargoHash = "sha256-BnBo0oEZL5Ilqw/AJzDITkg388LjN+8/AwxRDHQt/9s=";
 
   meta = {
     description = "Tool to check that your Cargo.toml dependencies are sorted alphabetically";
diff --git a/pkgs/by-name/ch/chhoto-url/package.nix b/pkgs/by-name/ch/chhoto-url/package.nix
index 470b834cb90e..2ac30a4d55ff 100644
--- a/pkgs/by-name/ch/chhoto-url/package.nix
+++ b/pkgs/by-name/ch/chhoto-url/package.nix
@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "chhoto-url";
-  version = "6.5.8";
+  version = "6.5.9";
 
   src = fetchFromGitHub {
     owner = "SinTan1729";
     repo = "chhoto-url";
     tag = finalAttrs.version;
-    hash = "sha256-JrGiRYE9YLuUdOhIqtNOsk+yiTLeiaTVQ7A5g3jqk/8=";
+    hash = "sha256-mpFyvzvAL/8vSM3gmS0+vaXEB0TxBdBXQtfcYdFrcEk=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/actix";
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail "./resources/" "${placeholder "out"}/share/chhoto-url/resources/"
   '';
 
-  cargoHash = "sha256-QXSOeiXJadTQaCRRfbn3C3KDyKIV4eOa2IdHHPK5Dzo=";
+  cargoHash = "sha256-bn+u5KPZ8tk7iMSygFdIYQsczUahblsfZNgYrxA+CyI=";
 
   postInstall = ''
     mkdir -p $out/share/chhoto-url
diff --git a/pkgs/by-name/cl/claude-code-bin/package.nix b/pkgs/by-name/cl/claude-code-bin/package.nix
index a00308dc633f..4d16fa39d8fd 100644
--- a/pkgs/by-name/cl/claude-code-bin/package.nix
+++ b/pkgs/by-name/cl/claude-code-bin/package.nix
@@ -50,6 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
     wrapProgram $out/bin/claude \
       --set DISABLE_AUTOUPDATER 1 \
       --set-default FORCE_AUTOUPDATE_PLUGINS 1 \
+      --set DISABLE_INSTALLATION_CHECKS 1 \
       --set USE_BUILTIN_RIPGREP 0 \
       --prefix PATH : ${
         lib.makeBinPath (
diff --git a/pkgs/by-name/cl/clever-tools/package.nix b/pkgs/by-name/cl/clever-tools/package.nix
index 5b51c93116e6..79baa87dfb71 100644
--- a/pkgs/by-name/cl/clever-tools/package.nix
+++ b/pkgs/by-name/cl/clever-tools/package.nix
@@ -11,7 +11,7 @@
 buildNpmPackage rec {
   pname = "clever-tools";
 
-  version = "4.6.1";
+  version = "4.7.0";
 
   nodejs = nodejs_22;
 
@@ -19,10 +19,10 @@ buildNpmPackage rec {
     owner = "CleverCloud";
     repo = "clever-tools";
     rev = version;
-    hash = "sha256-n/iDQdvAaINeIfCbvnL6OGuJ35xS6HsTtFxZ4nKiPWA=";
+    hash = "sha256-W7SE6ZdoFArKmnKiHNDRTuIMvchG/QTFahacUKkzYTI=";
   };
 
-  npmDepsHash = "sha256-muuDE5bd35IlAhq2mOCsp+5U2zf4RuaMxhvkmw8WCHc=";
+  npmDepsHash = "sha256-pZ8MYQ+QAPDk/1XI3lCgc+wstcwDHo+k59jWcc9/hgs=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/co/commitlint/package.nix b/pkgs/by-name/co/commitlint/package.nix
index ab49e0f225f3..42fcf0da325e 100644
--- a/pkgs/by-name/co/commitlint/package.nix
+++ b/pkgs/by-name/co/commitlint/package.nix
@@ -12,18 +12,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "commitlint";
-  version = "20.4.3";
+  version = "20.4.4";
 
   src = fetchFromGitHub {
     owner = "conventional-changelog";
     repo = "commitlint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CciE9m22C1RvB2k0870walO3LwkXFZKVnTYQngq9pII=";
+    hash = "sha256-Nt3uq5FkdpLyjSaQin4avcF4hqUxkd18f+k4I1uxy64=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-zKODU4opWFY1dJ7/vx8q4DQ2NSclShULWv3XrTjpktk=";
+    hash = "sha256-vD+63mWGZAaLut+xMSD7nnAvGSSl7XhSJykUWYDKWQ4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/de/devpi-server/package.nix b/pkgs/by-name/de/devpi-server/package.nix
index b96d19abebf7..f8d0b00ca959 100644
--- a/pkgs/by-name/de/devpi-server/package.nix
+++ b/pkgs/by-name/de/devpi-server/package.nix
@@ -1,4 +1,27 @@
-{ python3Packages }:
+{
+  lib,
+  python3,
+  runCommand,
+  # configurable options
+  extraPackages ? (ps: [ ]),
+}:
 
-with python3Packages;
-toPythonApplication devpi-server
+let
+  pythonEnv = python3.withPackages (ps: [ ps.devpi-server ] ++ extraPackages ps);
+  server = python3.pkgs.devpi-server;
+in
+runCommand "devpi-${server.version}"
+  {
+    inherit (server)
+      pname
+      version
+      meta
+      passthru
+      ;
+  }
+  ''
+    mkdir -p $out/bin
+    for bin in ${lib.getBin server}/bin/*; do
+      ln -s ${pythonEnv}/bin/$(basename "$bin") $out/bin/
+    done
+  ''
diff --git a/pkgs/development/python-modules/devpi-server/default.nix b/pkgs/by-name/de/devpi-server/unwrapped.nix
similarity index 100%
rename from pkgs/development/python-modules/devpi-server/default.nix
rename to pkgs/by-name/de/devpi-server/unwrapped.nix
diff --git a/pkgs/by-name/ev/evil-helix/package.nix b/pkgs/by-name/ev/evil-helix/package.nix
index 1a4f783bc4d4..176480be9723 100644
--- a/pkgs/by-name/ev/evil-helix/package.nix
+++ b/pkgs/by-name/ev/evil-helix/package.nix
@@ -5,44 +5,58 @@
   installShellFiles,
   nix-update-script,
   rustPlatform,
+  runCommand,
+  makeBinaryWrapper,
 }:
 
-rustPlatform.buildRustPackage (finalAttrs: {
-  pname = "evil-helix";
-  version = "20250915";
+rustPlatform.buildRustPackage (
+  finalAttrs:
+  let
+    defaultRuntimeDir = runCommand "evil-helix-default-runtime" { } ''
+      cp -r --no-preserve=mode ${finalAttrs.src}/runtime $out
+      rm -rf $out/grammars $out/queries
+    '';
+  in
+  {
+    pname = "evil-helix";
+    version = "20250915";
 
-  src = fetchFromGitHub {
-    owner = "usagi-flow";
-    repo = "evil-helix";
-    tag = "release-${finalAttrs.version}";
-    hash = "sha256-6kqKTZNS1RZwfxcFoa2uC7fUKcQ+KhT5KXusyCt59YQ=";
-  };
+    src = fetchFromGitHub {
+      owner = "usagi-flow";
+      repo = "evil-helix";
+      tag = "release-${finalAttrs.version}";
+      hash = "sha256-6kqKTZNS1RZwfxcFoa2uC7fUKcQ+KhT5KXusyCt59YQ=";
+    };
 
-  cargoHash = "sha256-Mf0nrgMk1MlZkSyUN6mlM5lmTcrOHn3xBNzmVGtApEU=";
+    cargoHash = "sha256-Mf0nrgMk1MlZkSyUN6mlM5lmTcrOHn3xBNzmVGtApEU=";
 
-  nativeBuildInputs = [ installShellFiles ];
+    nativeBuildInputs = [
+      installShellFiles
+      makeBinaryWrapper
+    ];
 
-  env = {
-    # disable fetching and building of tree-sitter grammars in the helix-term build.rs
-    HELIX_DISABLE_AUTO_GRAMMAR_BUILD = "1";
-    HELIX_DEFAULT_RUNTIME = helix.runtime;
-  };
+    env = {
+      # disable fetching and building of tree-sitter grammars in the helix-term build.rs
+      HELIX_DISABLE_AUTO_GRAMMAR_BUILD = "1";
+      HELIX_DEFAULT_RUNTIME = defaultRuntimeDir;
+    };
 
-  postInstall = ''
-    mkdir -p $out/lib
-    installShellCompletion contrib/completion/hx.{bash,fish,zsh}
-    mkdir -p $out/share/{applications,icons/hicolor/256x256/apps}
-    cp contrib/Helix.desktop $out/share/applications
-    cp contrib/helix.png $out/share/icons/hicolor/256x256/apps
-  '';
+    postInstall = ''
+      installShellCompletion contrib/completion/hx.{bash,fish,zsh}
+      mkdir -p $out/share/{applications,icons/hicolor/256x256/apps}
+      cp contrib/Helix.desktop $out/share/applications
+      cp contrib/helix.png $out/share/icons/hicolor/256x256/apps
+      wrapProgram $out/bin/hx --set HELIX_RUNTIME ${helix.runtime}
+    '';
 
-  passthru.updateScript = nix-update-script { };
+    passthru.updateScript = nix-update-script { };
 
-  meta = {
-    description = "Post-modern modal text editor, with vim keybindings";
-    homepage = "https://github.com/usagi-flow/evil-helix";
-    license = lib.licenses.mpl20;
-    mainProgram = "hx";
-    maintainers = with lib.maintainers; [ thiagokokada ];
-  };
-})
+    meta = {
+      description = "Post-modern modal text editor, with vim keybindings";
+      homepage = "https://github.com/usagi-flow/evil-helix";
+      license = lib.licenses.mpl20;
+      mainProgram = "hx";
+      maintainers = with lib.maintainers; [ thiagokokada ];
+    };
+  }
+)
diff --git a/pkgs/by-name/fo/forgejo-runner/package.nix b/pkgs/by-name/fo/forgejo-runner/package.nix
index b662edf2b944..209eb9becfd3 100644
--- a/pkgs/by-name/fo/forgejo-runner/package.nix
+++ b/pkgs/by-name/fo/forgejo-runner/package.nix
@@ -49,17 +49,17 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "forgejo-runner";
-  version = "12.7.1";
+  version = "12.7.2";
 
   src = fetchFromGitea {
     domain = "code.forgejo.org";
     owner = "forgejo";
     repo = "runner";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-agPlx+bBBqFZnoxxedVvKcAZ7QP09YqaY3TfOunDBOM=";
+    hash = "sha256-ySqvSh2ZdFVCQfKJbz5h2eRYj8BzFEFXoY6peXOzsIE=";
   };
 
-  vendorHash = "sha256-wGCOcrQRxe+1P7deuPwox8yo2GXhI9GgXuMTY81TFKo=";
+  vendorHash = "sha256-lMBRu7RxF4btWBn4NzlnaTAaEC6txx8iQTJxkzQKQh0=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/gi/github-copilot-cli/sources.json b/pkgs/by-name/gi/github-copilot-cli/sources.json
index a38e2ce7d5fd..b9d904295900 100644
--- a/pkgs/by-name/gi/github-copilot-cli/sources.json
+++ b/pkgs/by-name/gi/github-copilot-cli/sources.json
@@ -1,19 +1,19 @@
 {
-  "version": "0.0.421",
+  "version": "1.0.4",
   "x86_64-linux": {
     "name": "copilot-linux-x64",
-    "hash": "sha256-oXnSHTw0aC0SUoU2IT/hpdnDu504UkrRzodWQiDwujc="
+    "hash": "sha256-xZkPmwKuakDB887hcCdBZF3uwQIhrl9ao4E6EOg4JnA="
   },
   "aarch64-linux": {
     "name": "copilot-linux-arm64",
-    "hash": "sha256-ZAf2vV10pLwQAbTaGAWxR/bXPzJX1uAOEaQqKuJGvL4="
+    "hash": "sha256-ssw8hqcPWkNsHTrYgkGZrE8ft5NU6rukOEidY60FOfk="
   },
   "x86_64-darwin": {
     "name": "copilot-darwin-x64",
-    "hash": "sha256-8o2IW/7t0Z6JmSR2Ff1+EvvMDkcxMTw7KkvG/0ED9GM="
+    "hash": "sha256-Ea4+5mb3D+uOMed2kitUg6NVrKgL8kRQAcA4cdY80ME="
   },
   "aarch64-darwin": {
     "name": "copilot-darwin-arm64",
-    "hash": "sha256-Fd9aHynHxGVg79/Pugjch+z/PTAlwNHhbSI9Kwh6Xj4="
+    "hash": "sha256-TYhpNTp14OiQoa6Ep8wpNsMBYUeQN0TWZPkXcZBjWo8="
   }
 }
diff --git a/pkgs/by-name/go/gotmplfmt/package.nix b/pkgs/by-name/go/gotmplfmt/package.nix
index 60d7b95c7286..aa1fb33e4cc5 100644
--- a/pkgs/by-name/go/gotmplfmt/package.nix
+++ b/pkgs/by-name/go/gotmplfmt/package.nix
@@ -7,13 +7,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "gotmplfmt";
-  version = "1.0.22";
+  version = "1.0.25";
 
   src = fetchFromGitHub {
     owner = "miekg";
     repo = "gotmplfmt";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-87TcSEV4tJXf7a9Sml5H7mdVGYd4z7yJRxdkZFYm5DQ=";
+    hash = "sha256-mJkQP2nAVGqvxthrkLU4MmydPE/h+hcHM9c5/SRLj+4=";
   };
 
   vendorHash = "sha256-uPqabZgQGQulf+F3BvMLhv4O0h5jOq12F7K60u5xjtA=";
diff --git a/pkgs/by-name/he/heaptrack/package.nix b/pkgs/by-name/he/heaptrack/package.nix
index e1b45533a019..93a8f5b2dc90 100644
--- a/pkgs/by-name/he/heaptrack/package.nix
+++ b/pkgs/by-name/he/heaptrack/package.nix
@@ -11,6 +11,7 @@
   sparsehash,
   zstd,
   kdePackages,
+  rustc-demangle,
 }:
 
 stdenv.mkDerivation {
@@ -43,6 +44,7 @@ stdenv.mkDerivation {
     libunwind
     sparsehash
     zstd
+    rustc-demangle
   ]
   ++ (with kdePackages; [
     qtbase
@@ -58,6 +60,11 @@ stdenv.mkDerivation {
     elfutils
   ];
 
+  postPatch = ''
+    substituteInPlace src/interpret/demangler.cpp \
+      --replace-fail "librustc_demangle.so" "${rustc-demangle}/lib/librustc_demangle.so"
+  '';
+
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     makeWrapper \
       $out/Applications/KDE/heaptrack_gui.app/Contents/MacOS/heaptrack_gui \
diff --git a/pkgs/by-name/he/helix/mdbook-0.5-support.patch b/pkgs/by-name/he/helix-unwrapped/mdbook-0.5-support.patch
similarity index 100%
rename from pkgs/by-name/he/helix/mdbook-0.5-support.patch
rename to pkgs/by-name/he/helix-unwrapped/mdbook-0.5-support.patch
diff --git a/pkgs/by-name/he/helix-unwrapped/package.nix b/pkgs/by-name/he/helix-unwrapped/package.nix
new file mode 100644
index 000000000000..5b520dc6bbfd
--- /dev/null
+++ b/pkgs/by-name/he/helix-unwrapped/package.nix
@@ -0,0 +1,91 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  runCommand,
+  installShellFiles,
+  mdbook,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (
+  finalAttrs:
+  let
+    defaultRuntimeDir = runCommand "helix-default-runtime" { } ''
+      cp -r --no-preserve=mode ${finalAttrs.src}/runtime $out
+      rm -rf $out/grammars $out/queries
+    '';
+  in
+  {
+    pname = "helix-unwrapped";
+    version = "25.07.1";
+
+    outputs = [
+      "out"
+      "doc"
+    ];
+
+    src = fetchFromGitHub {
+      owner = "helix-editor";
+      repo = "helix";
+      tag = finalAttrs.version;
+      hash = "sha256-RFSzGAcB0mMg/02ykYfTWXzQjLFu2CJ4BkS5HZ/6pBo=";
+    };
+
+    cargoHash = "sha256-Mf0nrgMk1MlZkSyUN6mlM5lmTcrOHn3xBNzmVGtApEU=";
+
+    patches = [
+      # Support mdbook 0.5.x: escape HTML tags in command descriptions
+      ./mdbook-0.5-support.patch
+    ];
+
+    postPatch = ''
+      # mdbook 0.5 uses asset hashing for CSS/JS files
+      # Remove custom theme to use default mdbook theme with correct asset references
+      rm -f book/theme/index.hbs
+    '';
+
+    nativeBuildInputs = [
+      installShellFiles
+      mdbook
+    ];
+
+    env = {
+      # disable fetching and building of tree-sitter grammars in the helix-term build.rs
+      HELIX_DISABLE_AUTO_GRAMMAR_BUILD = "1";
+      HELIX_DEFAULT_RUNTIME = defaultRuntimeDir;
+    };
+
+    postBuild = ''
+      mdbook build book -d ../book-html
+    '';
+
+    postInstall = ''
+      installShellCompletion contrib/completion/hx.{bash,fish,zsh}
+      mkdir -p $out/share/{applications,icons/hicolor/256x256/apps}
+      cp contrib/Helix.desktop $out/share/applications/Helix.desktop
+      cp contrib/helix.png $out/share/icons/hicolor/256x256/apps/helix.png
+      mkdir -p $doc/share/doc
+      cp -r ../book-html $doc/share/doc/$name
+    '';
+
+    nativeInstallCheckInputs = [
+      versionCheckHook
+    ];
+    versionCheckProgram = "${placeholder "out"}/bin/hx";
+    doInstallCheck = true;
+
+    meta = {
+      description = "Post-modern modal text editor";
+      homepage = "https://helix-editor.com";
+      changelog = "https://github.com/helix-editor/helix/blob/${finalAttrs.version}/CHANGELOG.md";
+      license = lib.licenses.mpl20;
+      mainProgram = "hx";
+      maintainers = with lib.maintainers; [
+        aciceri
+        danth
+        yusdacra
+      ];
+    };
+  }
+)
diff --git a/pkgs/by-name/he/helix/package.nix b/pkgs/by-name/he/helix/package.nix
index b66ba8dfa721..60dc5ecf6d66 100644
--- a/pkgs/by-name/he/helix/package.nix
+++ b/pkgs/by-name/he/helix/package.nix
@@ -1,12 +1,9 @@
 {
-  fetchFromGitHub,
   lib,
-  rustPlatform,
-  mdbook,
-  gitMinimal,
-  installShellFiles,
-  versionCheckHook,
+  symlinkJoin,
   runCommand,
+  makeBinaryWrapper,
+  helix-unwrapped,
   removeReferencesTo,
   pkgs,
   tree-sitter,
@@ -22,133 +19,81 @@
     }
   ),
 }:
+let
+  lockedVersionsOverlay =
+    final: prev:
+    lib.mapAttrs (
+      drvName: grammar:
+      let
+        lockedGrammar = lockedGrammars.${lib.removePrefix "tree-sitter-" drvName};
+      in
+      (prev.${drvName}.override {
+        location = lockedGrammar.subpath;
+      }).overrideAttrs
+        {
+          version = lib.sources.shortRev lockedGrammar.nurl.args.rev;
+          src = (pkgs.${lockedGrammar.nurl.fetcher} lockedGrammar.nurl.args);
+        }
+    ) prev;
 
-rustPlatform.buildRustPackage (
-  finalAttrs:
-  let
-    lockedVersionsOverlay =
-      final: prev:
-      lib.mapAttrs (
-        drvName: grammar:
-        let
-          lockedGrammar = lockedGrammars.${lib.removePrefix "tree-sitter-" drvName};
-        in
-        (prev.${drvName}.override {
-          location = lockedGrammar.subpath;
-        }).overrideAttrs
-          {
-            version = lib.sources.shortRev lockedGrammar.nurl.args.rev;
-            src = (pkgs.${lockedGrammar.nurl.fetcher} lockedGrammar.nurl.args);
-          }
-      ) prev;
+  tree-sitter-grammars =
+    lib.filterAttrs (drvName: _: lib.hasAttr (lib.removePrefix "tree-sitter-" drvName) lockedGrammars)
+      (
+        tree-sitter.grammarsScope.overrideScope (
+          lib.composeExtensions lockedVersionsOverlay grammarsOverlay
+        )
+      );
 
-    tree-sitter-grammars =
-      lib.filterAttrs (drvName: _: lib.hasAttr (lib.removePrefix "tree-sitter-" drvName) lockedGrammars)
-        (
-          tree-sitter.grammarsScope.overrideScope (
-            lib.composeExtensions lockedVersionsOverlay grammarsOverlay
-          )
-        );
+  # Dynamic libraries for the grammars always use the `.so` extension, also on Darwin (should use `.dylib`)
+  # See here: https://github.com/helix-editor/helix/pull/14982
+  # Switch to `stdenv.hostPlatform.extensions.sharedLibrary` once the fix above reaches the next release
 
-    # Dynamic libraries for the grammars always use the `.so` extension, also on Darwin (should use `.dylib`)
-    # See here: https://github.com/helix-editor/helix/pull/14982
-    # Switch to `stdenv.hostPlatform.extensions.sharedLibrary` once the fix above reaches the next release
+  grammarsFarm = runCommand "helix-grammars" { } (
+    lib.concatMapAttrsStringSep "\n" (_: grammar: ''
+      install -D ${grammar}/parser $out/${grammar.language}.so
+      ${lib.getExe removeReferencesTo} -t ${grammar} $out/${grammar.language}.so
+    '') (lib.filterAttrs (_: lib.isDerivation) tree-sitter-grammars)
+  );
 
-    grammarsFarm = runCommand "helix-grammars" { } (
-      lib.concatMapAttrsStringSep "\n" (_: grammar: ''
-        install -D ${grammar}/parser $out/${grammar.language}.so
-        ${lib.getExe removeReferencesTo} -t ${grammar} $out/${grammar.language}.so
-      '') (lib.filterAttrs (_: lib.isDerivation) tree-sitter-grammars)
-    );
+  lockedGrammarsCount = lib.length (lib.attrNames lockedGrammars);
 
-    lockedGrammarsCount = lib.length (lib.attrNames lockedGrammars);
+  runtimeDir = runCommand "helix-runtime" { } ''
+    mkdir -p $out
+    ln -s ${grammarsFarm} $out/grammars
+    cp -r --no-preserve=mode ${helix-unwrapped.src}/runtime/queries $out
+    count=$(ls -1 "$out/grammars/" | wc -l)
+    if [ "$count" -ne ${toString lockedGrammarsCount} ]; then
+      echo "Expected ${toString lockedGrammarsCount} grammars, found $count"
+      exit 1
+    fi
+  '';
+in
 
-    runtimeDir = runCommand "helix-runtime" { } ''
-      cp -r --no-preserve=mode ${finalAttrs.src}/runtime $out
-      rm -r $out/grammars
-      ln -s ${grammarsFarm} $out/grammars
-      count=$(ls -1 "$out/grammars/" | wc -l)
-      if [ "$count" -ne ${toString lockedGrammarsCount} ]; then
-        echo "Expected ${toString lockedGrammarsCount} grammars, found $count"
-        exit 1
-      fi
-    '';
-  in
-  {
-    pname = "helix";
-    version = "25.07.1";
-    outputs = [
-      "out"
-      "doc"
-    ];
+symlinkJoin {
+  pname = "helix";
+  inherit (helix-unwrapped) version;
 
-    src = fetchFromGitHub {
-      owner = "helix-editor";
-      repo = "helix";
-      tag = "${finalAttrs.version}";
-      hash = "sha256-RFSzGAcB0mMg/02ykYfTWXzQjLFu2CJ4BkS5HZ/6pBo=";
-    };
+  paths = [ helix-unwrapped ];
+  nativeBuildInputs = [ makeBinaryWrapper ];
 
-    patches = [
-      # Support mdbook 0.5.x: escape HTML tags in command descriptions
-      ./mdbook-0.5-support.patch
-    ];
+  postBuild = ''
+    wrapProgram $out/bin/hx --set HELIX_RUNTIME "${runtimeDir}"
+  '';
 
-    postPatch = ''
-      # mdbook 0.5 uses asset hashing for CSS/JS files
-      # Remove custom theme to use default mdbook theme with correct asset references
-      rm -f book/theme/index.hbs
-    '';
+  passthru = {
+    updateScript = ./update.sh;
+    runtime = runtimeDir;
+    inherit tree-sitter-grammars;
+  };
 
-    cargoHash = "sha256-Mf0nrgMk1MlZkSyUN6mlM5lmTcrOHn3xBNzmVGtApEU=";
-
-    nativeBuildInputs = [
-      gitMinimal
-      installShellFiles
-      mdbook
-    ];
-
-    env = {
-      HELIX_DEFAULT_RUNTIME = runtimeDir;
-      HELIX_DISABLE_AUTO_GRAMMAR_BUILD = "1";
-    };
-
-    postBuild = ''
-      mdbook build book -d ../book-html
-    '';
-
-    postInstall = ''
-      mkdir -p $out/lib $doc/share/doc
-      installShellCompletion contrib/completion/hx.{bash,fish,zsh}
-      mkdir -p $out/share/{applications,icons/hicolor/256x256/apps}
-      cp contrib/Helix.desktop $out/share/applications/Helix.desktop
-      cp contrib/helix.png $out/share/icons/hicolor/256x256/apps/helix.png
-      cp -r ../book-html $doc/share/doc/$name
-    '';
-
-    nativeInstallCheckInputs = [
-      versionCheckHook
-    ];
-    versionCheckProgram = "${placeholder "out"}/bin/hx";
-    doInstallCheck = true;
-
-    passthru = {
-      updateScript = ./update.sh;
-      runtime = runtimeDir;
-      inherit tree-sitter-grammars;
-    };
-
-    meta = {
-      description = "Post-modern modal text editor";
-      homepage = "https://helix-editor.com";
-      changelog = "https://github.com/helix-editor/helix/blob/${finalAttrs.version}/CHANGELOG.md";
-      license = lib.licenses.mpl20;
-      mainProgram = "hx";
-      maintainers = with lib.maintainers; [
-        aciceri
-        danth
-        yusdacra
-      ];
-    };
-  }
-)
+  meta = {
+    inherit (helix-unwrapped.meta)
+      description
+      homepage
+      changelog
+      license
+      mainProgram
+      maintainers
+      ;
+  };
+}
diff --git a/pkgs/by-name/he/helix/update.sh b/pkgs/by-name/he/helix/update.sh
index 096374e02693..c143f5d1fde5 100755
--- a/pkgs/by-name/he/helix/update.sh
+++ b/pkgs/by-name/he/helix/update.sh
@@ -6,10 +6,10 @@ set -euo pipefail
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
 echo "Updating helix source to the latest stable..."
-nix-update helix
+nix-update helix-unwrapped
 
 echo "Fetching updated helixSource..."
-HELIX_SRC=$(nix-instantiate --eval -A "helix.src.outPath" --raw)
+HELIX_SRC=$(nix-instantiate --eval -A "helix-unwrapped.src.outPath" --raw)
 
 echo "Generating grammars.json..."
 "$SCRIPT_DIR/generate_grammars.py" \
diff --git a/pkgs/by-name/hu/hunspell/dictionaries.nix b/pkgs/by-name/hu/hunspell/dictionaries.nix
index 25827082149d..9e88526868b5 100644
--- a/pkgs/by-name/hu/hunspell/dictionaries.nix
+++ b/pkgs/by-name/hu/hunspell/dictionaries.nix
@@ -1251,4 +1251,35 @@ rec {
       maintainers = with lib.maintainers; [ honnip ];
     };
   };
+
+  # According to https://en.wikipedia.org/wiki/List_of_ISO_639_language_codes
+  # we should use `cy` for Cymraeg but it's cy_GB in Hunspell.
+  # WELSH / CYMRAEG
+  cy_GB = cy-gb;
+  cy-gb = mkDict rec {
+    pname = "hunspell-dict-cy-gb";
+    version = "25.03";
+
+    src = fetchFromGitHub {
+      owner = "techiaith";
+      repo = "hunspell-cy";
+      tag = version;
+      hash = "sha256-T1p0LbCUTKN7xfogbI2RqxdONgcMxDpjjFW+dN8IGa4=";
+    };
+
+    shortName = "cy-GB";
+    dictFileName = "cy_GB";
+    readmeFile = "README.md";
+
+    meta = {
+      description = "Hunspell dictionary for Welsh (Cymraeg)";
+      homepage = "https://github.com/techiaith/hunspell-cy";
+      license = with lib.licenses; [
+        lgpl3
+      ];
+      maintainers = with lib.maintainers; [
+        fin-w
+      ];
+    };
+  };
 }
diff --git a/pkgs/by-name/im/immich-public-proxy/package.nix b/pkgs/by-name/im/immich-public-proxy/package.nix
index bbb2d1431ac0..575db111aee8 100644
--- a/pkgs/by-name/im/immich-public-proxy/package.nix
+++ b/pkgs/by-name/im/immich-public-proxy/package.nix
@@ -8,17 +8,17 @@
 }:
 buildNpmPackage rec {
   pname = "immich-public-proxy";
-  version = "1.15.3";
+  version = "1.15.4";
   src = fetchFromGitHub {
     owner = "alangrainger";
     repo = "immich-public-proxy";
     tag = "v${version}";
-    hash = "sha256-ZOI5PtckA/M33iRmSBgTuNOpCgXfU7Oze6HJ4PCppz4=";
+    hash = "sha256-qWFv19XTyFYCiCzQTVm6pGYfKd1ITMjXFyOYaDEJdAU=";
   };
 
   sourceRoot = "${src.name}/app";
 
-  npmDepsHash = "sha256-keRVYgzeiWG5h5fKBhqdl8d+ibR48OGy4jitjemavVA=";
+  npmDepsHash = "sha256-pjM0x/1yAQm+ZolCyUV3M0cUJT0GBifed7NrMaINpyw=";
 
   # patch in absolute nix store paths so the process doesn't need to cwd in $out
   postPatch = ''
diff --git a/pkgs/by-name/ja/jasmin-compiler/package.nix b/pkgs/by-name/ja/jasmin-compiler/package.nix
index f261f62f6b0d..c3955850dee8 100644
--- a/pkgs/by-name/ja/jasmin-compiler/package.nix
+++ b/pkgs/by-name/ja/jasmin-compiler/package.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "jasmin-compiler";
-  version = "2025.06.3";
+  version = "2026.03.0";
 
   src = fetchurl {
     url = "https://github.com/jasmin-lang/jasmin/releases/download/v${finalAttrs.version}/jasmin-compiler-v${finalAttrs.version}.tar.bz2";
-    hash = "sha256-56r9iR61TonUHZ19G72p3bHN3F/fA1nYjCt7QXrko5s=";
+    hash = "sha256-3sYqPNDNQs/pbsZLPNOWHg6KCfuSzrZBdc/7VP3lDkA=";
   };
 
   nativeBuildInputs = with ocamlPackages; [
diff --git a/pkgs/by-name/jo/jotta-cli/package.nix b/pkgs/by-name/jo/jotta-cli/package.nix
index 485630870b89..d7ac78d1c0da 100644
--- a/pkgs/by-name/jo/jotta-cli/package.nix
+++ b/pkgs/by-name/jo/jotta-cli/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "jotta-cli";
-  version = "0.17.158308";
+  version = "0.17.159692";
 
   src = fetchzip {
     url = "https://repo.jotta.us/archives/linux/amd64/jotta-cli-${version}_linux_amd64.tar.gz";
-    hash = "sha256-KSm4SGK/NeBwixEzcu8mh1Ssr2tx1vBHT5QtvtwfMBE=";
+    hash = "sha256-R+eHUZghvhD935vx9/tS0DGcDqtRKqy68JI/OH1X9LU=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/jr/jrl-cmakemodules/package.nix b/pkgs/by-name/jr/jrl-cmakemodules/package.nix
index b3ba427511e6..2f6eea9b5bc8 100644
--- a/pkgs/by-name/jr/jrl-cmakemodules/package.nix
+++ b/pkgs/by-name/jr/jrl-cmakemodules/package.nix
@@ -2,31 +2,21 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   nix-update-script,
   cmake,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "jrl-cmakemodules";
-  version = "1.1.0";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "jrl-umi3218";
     repo = "jrl-cmakemodules";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WQiAAexshQ4zgaBNo/CD91XV+PAeoPZatmehSA14aPM=";
+    hash = "sha256-TUewcxvBGYF3WpqkiWvZzmbyXyaM+UqzHLVsaUJdC0w=";
   };
 
-  patches = [
-    # ref. https://github.com/jrl-umi3218/jrl-cmakemodules/pull/783
-    (fetchpatch {
-      name = "fix-permissions.patch";
-      url = "https://github.com/jrl-umi3218/jrl-cmakemodules/commit/defed70c8a7c5e4bd5b26006bef26e3fb22c3b26.patch";
-      hash = "sha256-muO6DwQhNPCv6DPmnHnEHjsh/FSj0ljgNCb+ZowLRaY=";
-    })
-  ];
-
   nativeBuildInputs = [ cmake ];
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/by-name/ki/kimai/package.nix b/pkgs/by-name/ki/kimai/package.nix
index c0374af64bfb..4e32f35b745b 100644
--- a/pkgs/by-name/ki/kimai/package.nix
+++ b/pkgs/by-name/ki/kimai/package.nix
@@ -7,13 +7,13 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "kimai";
-  version = "2.49.0";
+  version = "2.51.0";
 
   src = fetchFromGitHub {
     owner = "kimai";
     repo = "kimai";
     tag = finalAttrs.version;
-    hash = "sha256-hP67vu/8D7dTOPklyc8g3B//LAvs5YZ0g7fZ5lePM48=";
+    hash = "sha256-3wm8y0Ryl7i3QEBP9hC2pDt8JgkkS6gXQ+Lm0fRE9+E=";
   };
 
   php = php.buildEnv {
@@ -38,7 +38,7 @@ php.buildComposerProject2 (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-fE0nlUaXIHPRKSKErG+xBXmyWOMByq3iU9wJ+KW/5mI=";
+  vendorHash = "sha256-fJozCOlNqhp7LXnQNbMgxYTw0p29DaTxmcR5JtqSYKs=";
 
   composerNoPlugins = false;
   postInstall = ''
diff --git a/pkgs/by-name/li/linkwarden/package.nix b/pkgs/by-name/li/linkwarden/package.nix
index 5088e4bdb769..2e785ca5e1eb 100644
--- a/pkgs/by-name/li/linkwarden/package.nix
+++ b/pkgs/by-name/li/linkwarden/package.nix
@@ -48,12 +48,24 @@ let
     ];
   };
 
-  chromeDir =
-    {
-      x86_64-linux = "chrome-linux64";
-      aarch64-linux = "chrome-linux";
-    }
-    .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+  # Playwright's upstream chromium-headless-shell zips use different directory
+  # names per architecture (chrome-headless-shell-linux64 vs chrome-linux).
+  chrome =
+    let
+      browsers = playwright-driver.selectBrowsers {
+        withChromiumHeadlessShell = true;
+        withChromium = false;
+        withFirefox = false;
+        withWebkit = false;
+        withFfmpeg = false;
+      };
+      chromeDir =
+        {
+          x86_64-linux = "chrome-headless-shell-linux64";
+        }
+        .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+    in
+    "${browsers}/chromium_headless_shell-*/${chromeDir}/chrome-headless-shell";
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "linkwarden";
@@ -181,7 +193,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       --set-default PRISMA_QUERY_ENGINE_LIBRARY "${prisma-engines_6}/lib/libquery_engine.node" \
       --set-default PRISMA_QUERY_ENGINE_BINARY "${prisma-engines_6}/bin/query-engine" \
       --set-default PRISMA_SCHEMA_ENGINE_BINARY "${prisma-engines_6}/bin/schema-engine" \
-      --set-default PLAYWRIGHT_LAUNCH_OPTIONS_EXECUTABLE_PATH ${playwright-driver.browsers-chromium}/chromium-*/${chromeDir}/chrome \
+      --set-default PLAYWRIGHT_LAUNCH_OPTIONS_EXECUTABLE_PATH ${chrome} \
       --set-default LINKWARDEN_CACHE_DIR /var/cache/linkwarden \
       --set-default LINKWARDEN_HOST localhost \
       --set-default LINKWARDEN_PORT 3000 \
diff --git a/pkgs/by-name/ls/lsp-plugins/package.nix b/pkgs/by-name/ls/lsp-plugins/package.nix
index bd5df5a9eab2..c8c6a5244361 100644
--- a/pkgs/by-name/ls/lsp-plugins/package.nix
+++ b/pkgs/by-name/ls/lsp-plugins/package.nix
@@ -39,7 +39,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lsp-plugins";
-  version = "1.2.26";
+  version = "1.2.27";
 
   outputs = [
     "out"
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://github.com/lsp-plugins/lsp-plugins/releases/download/${finalAttrs.version}/lsp-plugins-src-${finalAttrs.version}.tar.gz";
-    hash = "sha256-RIMqmSJkF90u+nSICZCj3nGrAx1mfUXsPQb3lXicCfM=";
+    hash = "sha256-AirMrXIb7ShPrURdzImss7nR8Scxkh2+HtvQzeZy4aM=";
   };
 
   # By default, GStreamer plugins are installed right alongside GStreamer itself
diff --git a/pkgs/by-name/lu/lunar-client/package.nix b/pkgs/by-name/lu/lunar-client/package.nix
index 98e030dcdb48..9eb8b1168f3c 100644
--- a/pkgs/by-name/lu/lunar-client/package.nix
+++ b/pkgs/by-name/lu/lunar-client/package.nix
@@ -7,11 +7,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "lunarclient";
-  version = "3.5.22";
+  version = "3.6.0";
 
   src = fetchurl {
     url = "https://launcherupdates.lunarclientcdn.com/Lunar%20Client-${version}-ow.AppImage";
-    hash = "sha512-HdkkskXwwE6ee9/qeBcoOMaNLXUm6LdObF9HyM0JJC0IE0XZX90bU0c4QCQpF/1ZsS4Y4BW12+sqpEru4ABbsQ==";
+    hash = "sha512-VlTn3aAzFRmhWBE2Pa5WFJo2M8WxQdsQKxJqByxGPD9R3H9Vr4HwJzMdl5BwZJRZCGnVLEpMYMwpA4Z/I9aILw==";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/ma/mastermind/package.nix b/pkgs/by-name/ma/mastermind/package.nix
new file mode 100644
index 000000000000..1604cbb64406
--- /dev/null
+++ b/pkgs/by-name/ma/mastermind/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+
+  # nativeBuildInputs
+  installShellFiles,
+  scdoc,
+
+  # nativeInstallCheckInputs
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "mastermind";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "mahyarmirrashed";
+    repo = "mastermind";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-WWM3OnPJm5BvD2l5KnKrlfKqvMcyrpStcji1joq28hg=";
+  };
+
+  cargoHash = "sha256-N6zjgcaJRwRdmvIXzwFeiW1YCpRV6P2P7uj7D2EK0IQ=";
+
+  nativeBuildInputs = [
+    installShellFiles
+    scdoc
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  postInstall = ''
+    scdoc < doc/mastermind.6.scd > mastermind.6
+    installManPage mastermind.6
+  '';
+
+  meta = {
+    description = "A game of cunning and logic";
+    homepage = "https://github.com/mahyarmirrashed/mastermind";
+    license = lib.licenses.mit;
+    mainProgram = "mastermind";
+    maintainers = with lib.maintainers; [ mahyarmirrashed ];
+  };
+})
diff --git a/pkgs/by-name/op/opencl-cts/package.nix b/pkgs/by-name/op/opencl-cts/package.nix
index e49e10599024..f60f6f2f683e 100644
--- a/pkgs/by-name/op/opencl-cts/package.nix
+++ b/pkgs/by-name/op/opencl-cts/package.nix
@@ -48,6 +48,11 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeFeature "OPENCL_LIBRARIES" "OpenCL")
   ];
 
+  # Upstream installs to bin/$<CONFIG> (e.g. bin/Release/); flatten it.
+  postInstall = ''
+    mv "$out/bin/''${cmakeBuildType:-Release}"/* "$out"/bin/
+  '';
+
   meta = {
     description = "OpenCL Conformance Test Suite";
     homepage = "https://github.com/KhronosGroup/OpenCL-CTS";
diff --git a/pkgs/by-name/pa/pageedit/package.nix b/pkgs/by-name/pa/pageedit/package.nix
index 60ed730926e4..98cb32500eb2 100644
--- a/pkgs/by-name/pa/pageedit/package.nix
+++ b/pkgs/by-name/pa/pageedit/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pageedit";
-  version = "2.7.0";
+  version = "2.7.5";
 
   src = fetchFromGitHub {
     owner = "Sigil-Ebook";
     repo = "pageedit";
     tag = finalAttrs.version;
-    hash = "sha256-oC4OMYTFXIoLCstAalyJb4ppstmSTiE+mdmqhOY6FUU=";
+    hash = "sha256-8qR7oucNeQoRHZSLg1cvJo/eEdFmMV+m7Pjr7rdWVYY=";
   };
 
   nativeBuildInputs = with qt6Packages; [
diff --git a/pkgs/by-name/pa/panache/package.nix b/pkgs/by-name/pa/panache/package.nix
new file mode 100644
index 000000000000..ccb6657c9947
--- /dev/null
+++ b/pkgs/by-name/pa/panache/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  installShellFiles,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "panache";
+  version = "2.18.0";
+
+  src = fetchFromGitHub {
+    owner = "jolars";
+    repo = "panache";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-VI4Ma0wSHeQc5Rofz2sIyUkHmZSBm5woMcHTEM/a9wk=";
+  };
+
+  cargoHash = "sha256-iliilk0uAOwdiYqJwkbdslwxcU6WLgReN2ZDEVki6js=";
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
+  postInstall = ''
+    installShellCompletion --cmd panache \
+      --bash target/completions/panache.bash \
+      --fish target/completions/panache.fish \
+      --zsh target/completions/_panache
+
+    installManPage target/man/*
+  '';
+
+  meta = {
+    description = "Language server, formatter, and linter for Pandoc, Quarto, and R Markdown";
+    homepage = "https://github.com/jolars/panache";
+    changelog = "https://github.com/jolars/panache/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jolars ];
+    mainProgram = "panache";
+  };
+})
diff --git a/pkgs/by-name/pi/pimsync/package.nix b/pkgs/by-name/pi/pimsync/package.nix
index 7f749538711c..06f628871e03 100644
--- a/pkgs/by-name/pi/pimsync/package.nix
+++ b/pkgs/by-name/pi/pimsync/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "pimsync";
-  version = "0.5.6";
+  version = "0.5.7";
 
   src = fetchFromSourcehut {
     owner = "~whynothugo";
     repo = "pimsync";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-I9fbR6xBZwUq5X81wSNaLmx75eMIYbBqNsnFMyt4HQc=";
+    hash = "sha256-6glyZZ79tMaR0VckKNMew1+x7/SU4V93/to6PWaiIHU=";
   };
 
-  cargoHash = "sha256-yY1MDRrvblw5pqnequ7L44XIVV7sFeHEeG6TFkHD9sE=";
+  cargoHash = "sha256-TiywSVcNqnshkmDovQDY03tM6v8AMOfwzI/SLOlEXHw=";
 
   env.PIMSYNC_VERSION = finalAttrs.version;
 
diff --git a/pkgs/by-name/po/postgres-language-server/package.nix b/pkgs/by-name/po/postgres-language-server/package.nix
index f314395e7782..a02d7a82041c 100644
--- a/pkgs/by-name/po/postgres-language-server/package.nix
+++ b/pkgs/by-name/po/postgres-language-server/package.nix
@@ -9,17 +9,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "postgres-language-server";
-  version = "0.21.0";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "supabase-community";
     repo = "postgres-language-server";
     tag = finalAttrs.version;
-    hash = "sha256-E5HRNT4q0RJRJ5PW7uvvrni6jdBZYQCeEWgo0i/fmBQ=";
+    hash = "sha256-B8DzDk++GU/+OLP61pM0ftUl+aGYhs9nmrQ9VkdDYME=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-JRWe0D+H9MhVDva5rY8iRr/icLbVYGMjbwa3KSAori4=";
+  cargoHash = "sha256-XWti9KbiPcPxSKaesZMNnB7HecmXQ2xywORgCe77bWo=";
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook
diff --git a/pkgs/by-name/ru/rusty-path-of-building/package.nix b/pkgs/by-name/ru/rusty-path-of-building/package.nix
index ab077ba4dffe..499a6280a8dd 100644
--- a/pkgs/by-name/ru/rusty-path-of-building/package.nix
+++ b/pkgs/by-name/ru/rusty-path-of-building/package.nix
@@ -17,18 +17,18 @@
   libxcursor,
   libx11,
 }:
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rusty-path-of-building";
-  version = "0.2.11";
+  version = "0.2.13";
 
   src = fetchFromGitHub {
     owner = "meehl";
     repo = "rusty-path-of-building";
-    rev = "v${version}";
-    hash = "sha256-oDhapNQ5yiZFolI7ChDC7SjPkmkeUAutRmQt/AorStA=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-4lxMQfENucDaDZov82iZD5DMgksLuJ/2nXUKYYf/m/w=";
   };
 
-  cargoHash = "sha256-GEHsHxGAzD7UEte1XsoqOXLkFaquNUCMqTO5j+lVguA=";
+  cargoHash = "sha256-PeVVDOWFYoDKkCy+UV5ikFwrHTK93zt2WZ3Oxp0ez1Y=";
 
   nativeBuildInputs = [
     pkg-config
@@ -46,8 +46,8 @@ rustPlatform.buildRustPackage rec {
     # this is weird and vendored and should probably stay that way
     (luajit.pkgs.buildLuaPackage {
       pname = "lzip";
-      inherit version;
-      src = "${src}/lua/libs/lzip";
+      inherit (finalAttrs) version;
+      src = "${finalAttrs.src}/lua/libs/lzip";
 
       nativeBuildInputs = [ pkg-config ];
       buildInputs = [ zlib ];
@@ -119,9 +119,9 @@ rustPlatform.buildRustPackage rec {
   meta = {
     description = "A cross-platform runtime for Path of Building and Path of Building 2.";
     homepage = "https://github.com/meehl/rusty-path-of-building";
-    changelog = "https://github.com/meehl/rusty-path-of-building/blob/${src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/meehl/rusty-path-of-building/blob/${finalAttrs.src.rev}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ k900 ];
     mainProgram = "rusty-path-of-building";
   };
-}
+})
diff --git a/pkgs/by-name/sy/system-manager/package.nix b/pkgs/by-name/sy/system-manager/package.nix
index c8570f7b6f13..be7a6640f84f 100644
--- a/pkgs/by-name/sy/system-manager/package.nix
+++ b/pkgs/by-name/sy/system-manager/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "system-manager";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "numtide";
     repo = "system-manager";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Jjvn9gPmL6otZcaYjzE4cXLQFyzAEEsnpgwP3OoN8Gk=";
+    hash = "sha256-r0/UDbEeYmVqhtxiuJSUfYhjBjtLKHDWhMScpe1RkOA=";
   };
 
-  cargoHash = "sha256-A3A1RRx9U43u6wmzPE+yZwi08m7vcD5ccLC89TgDvOg=";
+  cargoHash = "sha256-oJWEP3wmINuhm7BGGRHPO81j4Zwll0OtyBF5WJ9+oQk=";
 
   buildInputs = [ dbus ];
   nativeBuildInputs = [
@@ -50,7 +50,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     homepage = "http://system-manager.net";
     license = lib.licenses.mit;
     mainProgram = "system-manager";
-    maintainers = with lib.maintainers; [ jfroche ];
+    maintainers = with lib.maintainers; [
+      jfroche
+      picnoir
+    ];
     platforms = lib.platforms.unix;
   };
 })
diff --git a/pkgs/by-name/th/thruster/package.nix b/pkgs/by-name/th/thruster/package.nix
new file mode 100644
index 000000000000..85aeda33fb94
--- /dev/null
+++ b/pkgs/by-name/th/thruster/package.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  buildGo126Module,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildGo126Module (finalAttrs: {
+  pname = "thruster";
+  version = "0.1.19";
+
+  src = fetchFromGitHub {
+    owner = "basecamp";
+    repo = "thruster";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Bavw7w/3AWRqiMVGpsazmVOIGcqkZPAWVBOQRRlnaS0=";
+  };
+
+  vendorHash = "sha256-i5u1quR5V0ceFwRDW0Vym+9/dFUwzp9Wc1JrM0KGgY8=";
+
+  subPackages = [ "cmd/thrust" ];
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Zero-config HTTP/2 proxy for Rails applications";
+    homepage = "https://github.com/basecamp/thruster";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ philocalyst ];
+    mainProgram = "thrust";
+  };
+})
diff --git a/pkgs/by-name/va/vault-bin/package.nix b/pkgs/by-name/va/vault-bin/package.nix
index 4b7af87f6f6d..ecc6e94cd55d 100644
--- a/pkgs/by-name/va/vault-bin/package.nix
+++ b/pkgs/by-name/va/vault-bin/package.nix
@@ -6,7 +6,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vault-bin";
-  version = "1.21.2";
+  version = "1.21.4";
 
   src =
     let
@@ -20,11 +20,11 @@ stdenv.mkDerivation rec {
         aarch64-darwin = "darwin_arm64";
       };
       hash = selectSystem {
-        x86_64-linux = "sha256-nnxORNS+/pII7eB8yOLlZ/XO1bwZavXnlbWW/j367Fs=";
-        aarch64-linux = "sha256-VmJL/wvxDt04SpogYtfg2xRznc4X+uDXAwniv9CITk0=";
-        i686-linux = "sha256-TLSYncDPUWOIkDz8eVNnE66E6YF3b7gmikFDCM6E6AQ=";
-        x86_64-darwin = "sha256-JLIG5GJCWCgHgXJ6BgnMGiDX5C0HqFvmnyVQVMDRd1c=";
-        aarch64-darwin = "sha256-gcKDVW/+jMcv1+J4GtPmSsVYJE53ScJxzFzGURsOxCY=";
+        x86_64-linux = "sha256-XkCzjKa3krWg/6mPyl+EDflqRUZ7HrmVa5mzrc0EN6Y=";
+        aarch64-linux = "sha256-/7Eia9CydYgQY1H1fdYJKq4Q8HDd8ZV5Z/e6x9THOmI=";
+        i686-linux = "sha256-kv+rqGapWJGB3zUB7ccT+aOaWJK/O32NjTr6QBsvRgc=";
+        x86_64-darwin = "sha256-5dGAQVPM3kBB2jvsbM8m9DUhZrzeXiDpROL0+SY3VY4=";
+        aarch64-darwin = "sha256-O2+ZyQV8CPAobutM6bu2UtPaf4TIEu6CnS87ywEupv8=";
       };
     in
     fetchzip {
diff --git a/pkgs/by-name/ve/velocity/deps.json b/pkgs/by-name/ve/velocity/deps.json
index 448dac502adb..c1404c0381b1 100644
--- a/pkgs/by-name/ve/velocity/deps.json
+++ b/pkgs/by-name/ve/velocity/deps.json
@@ -641,102 +641,102 @@
    "jar": "sha256-fx1ZEJLVFCtqqnz1n5TEx01X2+7wOy+CYpSfjza6xuM=",
    "pom": "sha256-JCgbY4MutO8QZOfd/b57eWquGr+IeYrb9NC5ZpurpKQ="
   },
-  "io/netty#netty-buffer/4.2.7.Final": {
-   "jar": "sha256-uBYTyO0iscw57M8qKL0MHUVh+y5eVCBhYX70zh0ii/U=",
-   "pom": "sha256-6mGx9EqNui22yX8iou5DGsVil430rDlUcei28oZtwH4="
+  "io/netty#netty-buffer/4.2.10.Final": {
+   "jar": "sha256-pDDP7c6TwXGlaobR0nyNgp20eT8cWcOBxl6E5bzVvKo=",
+   "pom": "sha256-pP4sEWygUuHtFlKAmn5BaIY6M8l7SXJVtgdIaKPhKeI="
   },
-  "io/netty#netty-codec-base/4.2.7.Final": {
-   "jar": "sha256-Y2BBW3yHFgr83l59SUbDVTm58EPoFmyRp//5XMYGfZ8=",
-   "pom": "sha256-Mu41Sjk4YJqMC/Ay9GxwqzJ9eFVR0mmDdwyakDIJKPo="
+  "io/netty#netty-codec-base/4.2.10.Final": {
+   "jar": "sha256-KkIO5gnBxK11Bgm21+LunyagQxqLvX9Ir7isV28cQLk=",
+   "pom": "sha256-rSHTGclQMWGhk5GzszX1eWsQo9tHuzR9jzptjWElsJM="
   },
-  "io/netty#netty-codec-compression/4.2.7.Final": {
-   "jar": "sha256-7dU600mRgEMBpGVxET2P+01vZ+bYdGdNr7uRVyQnXLM=",
-   "pom": "sha256-uAzpd/6sX//UviPOI03TtvtMNXVrJRL7AdzcAdinSoc="
+  "io/netty#netty-codec-compression/4.2.10.Final": {
+   "jar": "sha256-btcMIda06yN9+rKSFN/AKeHoXpgEdRy5SST6BPNsBM0=",
+   "pom": "sha256-CBUJ10nX3h7RASAPGcBYnkn4H6ZMXUVhAVu54h1TBlQ="
   },
-  "io/netty#netty-codec-haproxy/4.2.7.Final": {
-   "jar": "sha256-bwnVN5FKpGWJE4TIpM8NuXfdkAmgtzqBoFDwpsv6lfc=",
-   "pom": "sha256-Rc/v9/EyJXbOPaHMuoo0i0ANceNu1UVGEm1q1ZcJBPo="
+  "io/netty#netty-codec-haproxy/4.2.10.Final": {
+   "jar": "sha256-r23y95SO9dNbsjULTSRcKM9nTVqX5MAFjGQ7udv69YI=",
+   "pom": "sha256-iHTEnziGfOQSFPReujUKWLvTdr/ObF3avhzvBM7siPE="
   },
-  "io/netty#netty-codec-http/4.2.7.Final": {
-   "jar": "sha256-KYTdOEIKYcTdaPysxR/8Uo60b3P3eVza/bOk1vy3aGI=",
-   "pom": "sha256-hQc6wlleQUiRi1psLnAZMtedm+GNTx212S1qojlj4oA="
+  "io/netty#netty-codec-http/4.2.10.Final": {
+   "jar": "sha256-+vgz0/VXkhJkMoyTP/6wVemIXg0ligITVaqIpiGBtUA=",
+   "pom": "sha256-fvk+RsXebmkkRY69QFJcNHcezwVC4yqJyYDH1TMFsCo="
   },
-  "io/netty#netty-codec-marshalling/4.2.7.Final": {
-   "jar": "sha256-5VCtt1jupDqkneAOdBiwmJMXEdSjHWLmXEGwmUyVsjc=",
-   "pom": "sha256-77XNFeXpIODSbygJ+aiRp5fxOJ9hEX5VFLfmNaOPmjM="
+  "io/netty#netty-codec-marshalling/4.2.10.Final": {
+   "jar": "sha256-hMz05uCVQ0BB9rpHoANgmtQvK69gE2orDHaWxwVs8ao=",
+   "pom": "sha256-yDxKZ4geyk3ODJbwkC59mfPwGR76gA/hAxg66DR+scU="
   },
-  "io/netty#netty-codec-protobuf/4.2.7.Final": {
-   "jar": "sha256-SyUlm2916/x38BSgj2m60BkRbU9cpUj9xB89rYwN4zE=",
-   "pom": "sha256-Ub3X5EMhhkFp9Oqt7RQaaXLBhkh+/fAa59t/3jaQcSU="
+  "io/netty#netty-codec-protobuf/4.2.10.Final": {
+   "jar": "sha256-32OQop/941Qm+lrUnMzEkcWObKIlPjZIJaIE7QPQ+/w=",
+   "pom": "sha256-HknN1DvOW368HPyLAVIhhDskZZcKDYioXlVujWcXwq8="
   },
-  "io/netty#netty-codec/4.2.7.Final": {
-   "jar": "sha256-XzaWWDgXiZmMBCqY8C2nHZw5iEu7T3/VgoL3ZeCcoDE=",
-   "pom": "sha256-5FSK3jVlANmEy7jJP9iEZacPdWHlGbyV6y/O7s4bKjE="
+  "io/netty#netty-codec/4.2.10.Final": {
+   "jar": "sha256-lOv2TeooQ2SfOg91+ATmBWLqdPLtQw4dQep5Reji/wM=",
+   "pom": "sha256-O7awlizPGUJAVposU+jp9kzX2ecBKZyOMDOvv9U9HVw="
   },
-  "io/netty#netty-common/4.2.7.Final": {
-   "jar": "sha256-I0W8DtWEP6V6pJ66Z1KUhcOh1CD88EKTJMgiDHqA6aY=",
-   "pom": "sha256-/jMRoayD8KGH/n2+Be6B6Ef2JvmtkN2wx4WusJ0Y/DM="
+  "io/netty#netty-common/4.2.10.Final": {
+   "jar": "sha256-rX/wmJ12vpKAaRdnVN7sQsag4zBQE98hgUtKxGsazpo=",
+   "pom": "sha256-/mK6WQGACloXBuJGGczUB4jwG1PGKLo8xfGPLlldWMA="
   },
-  "io/netty#netty-handler/4.2.7.Final": {
-   "jar": "sha256-IdBjQJwS287EbTgMiFag97altou18dAF6wZbTWQUbLM=",
-   "pom": "sha256-79QqDJKAKPlJsWREfBtOFt7eccgihRppL1hzEhTr0oM="
+  "io/netty#netty-handler/4.2.10.Final": {
+   "jar": "sha256-dp/sv7yldWxSpELaNVYyGM7U1swXnaKo54Kq5s6KGHs=",
+   "pom": "sha256-bRWw+h3MT8Et+QCMlrfF2+PM45yk9BG5WGmOtFlhWj0="
   },
-  "io/netty#netty-parent/4.2.7.Final": {
-   "pom": "sha256-56FYFCV9GpaNpyU3yRUscw7d9uf9Wj581wJuVclladM="
+  "io/netty#netty-parent/4.2.10.Final": {
+   "pom": "sha256-N+RH6+6IoXVb86s/dPAppClT2kbwx2+K1KwSNoU7JLg="
   },
-  "io/netty#netty-resolver/4.2.7.Final": {
-   "jar": "sha256-fk1WmGfmwIQ3+yGiIOoBwpSw448BFJtoPIlaG82ShDg=",
-   "pom": "sha256-F6vZjvgRyuBYbZ41xMUUZ3GXLrJy+Fek2eDDBe0hs5g="
+  "io/netty#netty-resolver/4.2.10.Final": {
+   "jar": "sha256-FN+teRRmqyzIcxaEHByXavFAvbjG7V+Ecl4SJaHgu+Y=",
+   "pom": "sha256-wZSf6/fO78wNjKxHrQy42JgNmPSzm4xvXmlK/fATEow="
   },
-  "io/netty#netty-transport-classes-epoll/4.2.7.Final": {
-   "jar": "sha256-RJKUjmp2lDmOUZfPFe0uIdZmKnOdAQrmZvonbnIihTw=",
-   "pom": "sha256-RoQ5xbLK4wAXuv2XaqJJfEiA/aYSSyPBrUKQt5CMXA8="
+  "io/netty#netty-transport-classes-epoll/4.2.10.Final": {
+   "jar": "sha256-c8glnWzfUdTqnLA2pTaYEj6IVdqhQYMEIlmIFqGxzzM=",
+   "pom": "sha256-qy9dSI+3OLOebiMp4a1kTKXjN7LIGOU9/lDPksSnE78="
   },
-  "io/netty#netty-transport-classes-io_uring/4.2.7.Final": {
-   "jar": "sha256-/5ZodMYvU+0HKWLxv128Sf3dS9PGC/yafhfONLOax68=",
-   "pom": "sha256-fEFSqfVOcE6KSVjdiggLCaW3d6jqcxjxKNfOM4ayqic="
+  "io/netty#netty-transport-classes-io_uring/4.2.10.Final": {
+   "jar": "sha256-10hGZnBQtb8Fn0y62QxeTfFgh/qCUJPsbtapCtQHS14=",
+   "pom": "sha256-D/Ckq+yf95W4KafXmifPXNdDK3NwBgtyGFCyJNV55/Q="
   },
-  "io/netty#netty-transport-classes-kqueue/4.2.7.Final": {
-   "jar": "sha256-o+sclK4aa+nh0exSw/XFEKdbBLjvHqhrfnez8Sh648w=",
-   "pom": "sha256-mtwTZN1F7chJ933s8SVy3FR4XPbqx5wuhqdyXRGhczM="
+  "io/netty#netty-transport-classes-kqueue/4.2.10.Final": {
+   "jar": "sha256-H0lCcNNC8L77nvzCFfTRxWdV3gIqKtrYTTrWjTldOfc=",
+   "pom": "sha256-nc/b2g79hDRxk/Z3bUhi20MeYUuap3TEvoA/h1F5Wn0="
   },
-  "io/netty#netty-transport-native-epoll/4.2.7.Final": {
-   "jar": "sha256-vc+Af3LZqbf5hklxcQdlLKcVMkVwLomTnM63D4zKsY8=",
-   "pom": "sha256-ygZltZ4tBvqQRF5G/UBaYumOhrFL9TwC0eyCUYE8Vto="
+  "io/netty#netty-transport-native-epoll/4.2.10.Final": {
+   "jar": "sha256-JcqprKeY95eVUSR9xlfX/7tshNR14z6CMZ10oYuLy6c=",
+   "pom": "sha256-DIaVyP2Krd0TW1r4uH6+rw/Vdlxhou5HxcHu2lgdKk0="
   },
-  "io/netty#netty-transport-native-epoll/4.2.7.Final/linux-aarch_64": {
-   "jar": "sha256-LwxzCdffSKiPs3TALPtEbhoeX7WX+wLXc8cKwH2iwmg="
+  "io/netty#netty-transport-native-epoll/4.2.10.Final/linux-aarch_64": {
+   "jar": "sha256-zFwuI31dZheVAK3uqJ7af5f9dyOL6u3dU6DFf+i5ok0="
   },
-  "io/netty#netty-transport-native-epoll/4.2.7.Final/linux-x86_64": {
-   "jar": "sha256-fzlcj9vmmQ92ZECLV9kZBCQBuJMXj8uki+vxphv3hhg="
+  "io/netty#netty-transport-native-epoll/4.2.10.Final/linux-x86_64": {
+   "jar": "sha256-jBMkNF3rhOm257hJEciduDl7wBwS6JRuWA5pMjzDjJY="
   },
-  "io/netty#netty-transport-native-io_uring/4.2.7.Final": {
-   "jar": "sha256-mKjWMVHe0xcscfhVIDrhlpgvAFIZaso7a6l9PoXUJgk=",
-   "pom": "sha256-Q543Rm1v45ZZHsS6JjVcjkRMOB0j9wVMIKL9isXJe0I="
+  "io/netty#netty-transport-native-io_uring/4.2.10.Final": {
+   "jar": "sha256-MP4ivOpnZ7+Kgs/6HZD+23NxanlkHSPh0peUXmNKTEk=",
+   "pom": "sha256-chCMlfycfpXXM5WSCOxeEY+PpPgIcvAmAGBi2nfebfI="
   },
-  "io/netty#netty-transport-native-io_uring/4.2.7.Final/linux-aarch_64": {
-   "jar": "sha256-hPw53BAZ9KbFJEsdealxTLZ/BFu9rk/vJvSYHm9nrb4="
+  "io/netty#netty-transport-native-io_uring/4.2.10.Final/linux-aarch_64": {
+   "jar": "sha256-waL3u+fGvnNPbVpf3vstJeeS5onzV0usmDiEy/pGETw="
   },
-  "io/netty#netty-transport-native-io_uring/4.2.7.Final/linux-x86_64": {
-   "jar": "sha256-wjZQn1W/khZm8CMu/rdWMnm2y0YNnko2xKukDSIXv2I="
+  "io/netty#netty-transport-native-io_uring/4.2.10.Final/linux-x86_64": {
+   "jar": "sha256-8ZNOKmhNk9n39d5jWaTGTCCeNlntGyeZAQBJIlH9Bag="
   },
-  "io/netty#netty-transport-native-kqueue/4.2.7.Final": {
-   "jar": "sha256-8BrzuSyghzja6ep5E3jCiF8wXSEK0W48VxZVueJr0Dw=",
-   "pom": "sha256-/0QzBLr/YGgE922pFg73w/Kh7mZcZe9it74n1vfAMqM="
+  "io/netty#netty-transport-native-kqueue/4.2.10.Final": {
+   "jar": "sha256-zkPEwti840avtNNX2FMiwfv64YsjQFo79J+VBptHPpM=",
+   "pom": "sha256-RreQZTpjfLLjKT1h6pGfbGhtoTiMgLOTg6qRqCVcQaM="
   },
-  "io/netty#netty-transport-native-kqueue/4.2.7.Final/osx-aarch_64": {
-   "jar": "sha256-dkemlVjj1Jo1J4HCroGpfha0QtfGVloGtK4PFSmEidU="
+  "io/netty#netty-transport-native-kqueue/4.2.10.Final/osx-aarch_64": {
+   "jar": "sha256-ejQgkPiom3p9yoRVxBIjxkD+l1gy01eZAZYHu0+Xik0="
   },
-  "io/netty#netty-transport-native-kqueue/4.2.7.Final/osx-x86_64": {
-   "jar": "sha256-opwItolXRqrKeW5ypCm8cF9AJn/rNfdc2Pu81N5t6Z8="
+  "io/netty#netty-transport-native-kqueue/4.2.10.Final/osx-x86_64": {
+   "jar": "sha256-hCikV/WjSJap+04fAYRH17WfqNWnAMXcTd4PHn2ARpQ="
   },
-  "io/netty#netty-transport-native-unix-common/4.2.7.Final": {
-   "jar": "sha256-c2cDs/bRJ+GC9b6Ii24VcysMCNZjTgByU1KmqdGZdLI=",
-   "pom": "sha256-EnhcnEoH0qFDJYYWRWrqw6bgIqoXJBeYA04x+LDtHqk="
+  "io/netty#netty-transport-native-unix-common/4.2.10.Final": {
+   "jar": "sha256-a+oGD1/+lTrKtskiI20oTKjx6MalnYoT6roFP6KAqI8=",
+   "pom": "sha256-0zv1ERXSOm7P/iNPHJlR4d68MSLmfxmb7/Vximxd060="
   },
-  "io/netty#netty-transport/4.2.7.Final": {
-   "jar": "sha256-qtxvsFwU+3iTaMo/hUchVJxy9sDYF5i7zPneG7cWiSs=",
-   "pom": "sha256-zQTiYzq09WBE6aFdUV6ZyBY4iZ2vB9gJdhlzp8DPnqo="
+  "io/netty#netty-transport/4.2.10.Final": {
+   "jar": "sha256-qv+LKVjuoOlNPlUh15XmXqkfr1j6EVLkVYSzY0ioGr0=",
+   "pom": "sha256-SJkN7RPTYd+bJyWscy8NwxC5YOonhIg/dl7vPNU4mkI="
   },
   "it/unimi/dsi#fastutil/8.5.15": {
    "jar": "sha256-z/62ZzvfHm5Dd9aE3y9VrDWc9c9t9hPgXmLe7qUAk2o=",
@@ -994,6 +994,10 @@
    "module": "sha256-4IAoExN1s1fR0oc06aT7QhbahLJAZByz7358fWKCI/w=",
    "pom": "sha256-MjVQgdEJCVw9XTdNWkO09MG3XVSemD71ByPidy5TAqA="
   },
+  "org/bouncycastle#bc-jdk18on-bom/1.83": {
+   "module": "sha256-f9LoflQtKLgyIIewgLg60pWZssGzUAOuDgrmKiAgIe8=",
+   "pom": "sha256-aKi4X0QK23JLJ+ZXJphw4QlcVgJ/+oh6C1J3ZW+2ZqQ="
+  },
   "org/bstats#bstats-base/3.1.0": {
    "jar": "sha256-2g5RgIzYzCi+8wAOcctPoLBeU5Mag6f59NPEAoNvQKA=",
    "module": "sha256-QhHroRz++QjrgoSEtw37ii5EjZ9aaZX/Gu8gEeVquhg=",
diff --git a/pkgs/by-name/ve/velocity/package.nix b/pkgs/by-name/ve/velocity/package.nix
index 86473e45a344..22ad1707fe3c 100644
--- a/pkgs/by-name/ve/velocity/package.nix
+++ b/pkgs/by-name/ve/velocity/package.nix
@@ -34,13 +34,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "velocity";
-  version = "3.5.0-unstable-2026-03-03";
+  version = "3.5.0-unstable-2026-03-08";
 
   src = fetchFromGitHub {
     owner = "PaperMC";
     repo = "Velocity";
-    rev = "e0db25664fc82eabd9fde5aac22a2311a9765975";
-    hash = "sha256-o3BNJyRNu5nJpC/Zagd/D3OsF0KBqZCR9sTTf/AEU3M=";
+    rev = "747cc8984f64d07b2105136a29e4e1095ed889fe";
+    hash = "sha256-Xbfmi6Xic0k1+pJczYXJ3Tt+xBniDO56S64+6DV7VRs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/vi/victoriametrics/package.nix b/pkgs/by-name/vi/victoriametrics/package.nix
index fcd636fa1b9c..198952479e7c 100644
--- a/pkgs/by-name/vi/victoriametrics/package.nix
+++ b/pkgs/by-name/vi/victoriametrics/package.nix
@@ -13,13 +13,13 @@
 
 buildGo126Module (finalAttrs: {
   pname = "VictoriaMetrics";
-  version = "1.136.0";
+  version = "1.137.0";
 
   src = fetchFromGitHub {
     owner = "VictoriaMetrics";
     repo = "VictoriaMetrics";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mYFZ2swaRHYfKeL5r4NTmynQ5sOHcHMPJlChKXQsreA=";
+    hash = "sha256-0ZQA8icb1upxlYIinDLFEKJbRR02Pdcb+HBUWsc1jN0=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/xn/xnldorker/package.nix b/pkgs/by-name/xn/xnldorker/package.nix
index bc10bac29b5c..74960dfb9ffd 100644
--- a/pkgs/by-name/xn/xnldorker/package.nix
+++ b/pkgs/by-name/xn/xnldorker/package.nix
@@ -17,11 +17,6 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     hash = "sha256-g5o2H5FqP+ytu5eqmGUyn0lD9NQcCJ4+xQCmTk0Qxrg=";
   };
 
-  pythonRemoveDeps = [
-    # https://github.com/xnl-h4ck3r/xnldorker/pull/11
-    "asyncio"
-  ];
-
   build-system = with python3.pkgs; [ setuptools ];
 
   nativeBuildInputs = [ writableTmpDirAsHomeHook ];
@@ -45,8 +40,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     description = "Gather results of dorks across a number of search engines";
     homepage = "https://github.com/xnl-h4ck3r/xnldorker";
     changelog = "https://github.com/xnl-h4ck3r/xnldorker/blob/${finalAttrs.src.rev}/CHANGELOG.md";
-    # https://github.com/xnl-h4ck3r/xnldorker/issues/10
-    license = lib.licenses.unfree;
+    license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "xnldorker";
   };
diff --git a/pkgs/by-name/zw/zwave-js-ui/package.nix b/pkgs/by-name/zw/zwave-js-ui/package.nix
index c0981b070798..4360f8d42a96 100644
--- a/pkgs/by-name/zw/zwave-js-ui/package.nix
+++ b/pkgs/by-name/zw/zwave-js-ui/package.nix
@@ -7,15 +7,15 @@
 
 buildNpmPackage rec {
   pname = "zwave-js-ui";
-  version = "11.13.0";
+  version = "11.14.0";
 
   src = fetchFromGitHub {
     owner = "zwave-js";
     repo = "zwave-js-ui";
     tag = "v${version}";
-    hash = "sha256-XRoOOuIkBaHC7oXBA1r2TzgTTYxluE7+YtgnXGsAbkw=";
+    hash = "sha256-D1aZt4rdLdFrnd9kwr0SdodKWZU4fcE+XLnn3GxGjKg=";
   };
-  npmDepsHash = "sha256-OOmJQJf8PTAaUmM7r9KGBaS5sk/uy3OI92jLj7JYhcg=";
+  npmDepsHash = "sha256-khAy5TzaZzKzBlEvW5MiyS07yJxv2xxhZns3GfVs5YU=";
 
   passthru.tests.zwave-js-ui = nixosTests.zwave-js-ui;
 
diff --git a/pkgs/development/libraries/mesa/common.nix b/pkgs/development/libraries/mesa/common.nix
index 84d4e018aefb..e9a837f233a0 100644
--- a/pkgs/development/libraries/mesa/common.nix
+++ b/pkgs/development/libraries/mesa/common.nix
@@ -5,14 +5,14 @@
 # nix build .#legacyPackages.x86_64-darwin.mesa .#legacyPackages.aarch64-darwin.mesa
 rec {
   pname = "mesa";
-  version = "26.0.1";
+  version = "26.0.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "mesa";
     repo = "mesa";
     rev = "mesa-${version}";
-    hash = "sha256-t9IDsEikGvQWxJ7SCIwRGUaoxtlG0s633J1/dmrIr6c=";
+    hash = "sha256-OaE1XM421C0rMep03wM7g4Ttwwn/8z5neLQI8LY9b2U=";
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/asyncsleepiq/default.nix b/pkgs/development/python-modules/asyncsleepiq/default.nix
index 4f225085efe6..633c44a6d62f 100644
--- a/pkgs/development/python-modules/asyncsleepiq/default.nix
+++ b/pkgs/development/python-modules/asyncsleepiq/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "asyncsleepiq";
-  version = "1.7.0";
+  version = "1.7.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7lI60Nc5gLIjs5bEG5bQVw3Vhj9Xq6cghVZVHm8WRGg=";
+    hash = "sha256-gOg1cxd2OsDRg5jtc6MfEMsK9T0Croo8K1jzsvbAbdY=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/beautysh/default.nix b/pkgs/development/python-modules/beautysh/default.nix
index f70b20527825..5059eff357a5 100644
--- a/pkgs/development/python-modules/beautysh/default.nix
+++ b/pkgs/development/python-modules/beautysh/default.nix
@@ -11,16 +11,16 @@
   types-colorama,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "beautysh";
-  version = "6.4.2";
+  version = "6.4.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lovesegfault";
     repo = "beautysh";
-    tag = "v${version}";
-    hash = "sha256-wLqysNhkagZ+sphqMC78cLoKvsMJpJCJr16lgvU37JI=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-P2oF6Sb7CBsZGSOXifxgCtJdY50YUJF3tKihp3v1cK4=";
   };
 
   build-system = [ hatchling ];
@@ -42,9 +42,9 @@ buildPythonPackage rec {
   meta = {
     description = "Tool for beautifying Bash scripts";
     homepage = "https://github.com/lovesegfault/beautysh";
-    changelog = "https://github.com/lovesegfault/beautysh/releases/tag/${src.tag}";
+    changelog = "https://github.com/lovesegfault/beautysh/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "beautysh";
   };
-}
+})
diff --git a/pkgs/development/python-modules/devpi-web/default.nix b/pkgs/development/python-modules/devpi-web/default.nix
new file mode 100644
index 000000000000..258e5e2cb203
--- /dev/null
+++ b/pkgs/development/python-modules/devpi-web/default.nix
@@ -0,0 +1,94 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  gitUpdater,
+
+  # dependencies
+  attrs,
+  beautifulsoup4,
+  defusedxml,
+  devpi-common,
+  devpi-server,
+  docutils,
+  pygments,
+  pyramid,
+  pyramid-chameleon,
+  readme-renderer,
+  setuptools,
+  tomli,
+  whoosh,
+
+  # tests
+  pytestCheckHook,
+  pytest-cov-stub,
+  packaging-legacy,
+  webtest,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "devpi-web";
+  version = "5.0.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "devpi";
+    repo = "devpi";
+    tag = "web-${finalAttrs.version}";
+    hash = "sha256-p52uwkXeCPPsnD9BLfqEa8NK4bAfIdpYIzdNgmwucms=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/web";
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail ', "setuptools_changelog_shortener"' ""
+  '';
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    attrs
+    beautifulsoup4
+    defusedxml
+    devpi-common
+    devpi-server
+    docutils
+    pygments
+    pyramid
+    pyramid-chameleon
+    readme-renderer
+    tomli
+    whoosh
+  ]
+  ++ readme-renderer.optional-dependencies.md;
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-cov-stub
+    packaging-legacy
+    webtest
+  ];
+
+  pythonImportsCheck = [ "devpi_web" ];
+
+  # devpi uses a monorepo for server, common, client and web
+  passthru = {
+    # bulk updater selects wrong tag
+    skipBulkUpdate = true;
+    updateScript = gitUpdater {
+      # devpi uses a monorepo for server, common, client and web
+      rev-prefix = "web-";
+    };
+  };
+
+  meta = {
+    homepage = "https://github.com/devpi/devpi";
+    description = "Web view for devpi-server";
+    changelog = "https://github.com/devpi/devpi/blob/${finalAttrs.src.tag}/common/CHANGELOG";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      confus
+    ];
+  };
+})
diff --git a/pkgs/development/python-modules/django-weasyprint/default.nix b/pkgs/development/python-modules/django-weasyprint/default.nix
index 25722129896d..f496f7948286 100644
--- a/pkgs/development/python-modules/django-weasyprint/default.nix
+++ b/pkgs/development/python-modules/django-weasyprint/default.nix
@@ -33,6 +33,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # Fails with weasyprint >= 68 (tries to open /static/css/print.css in test env)
+    "test_get_pdf_download_and_options"
+  ];
+
   pythonImportsCheck = [ "django_weasyprint" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/gotrue/default.nix b/pkgs/development/python-modules/gotrue/default.nix
deleted file mode 100644
index baa701d1a7ec..000000000000
--- a/pkgs/development/python-modules/gotrue/default.nix
+++ /dev/null
@@ -1,44 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-  poetry-core,
-  httpx,
-  h2,
-  pydantic,
-  pyjwt,
-  pytest-mock,
-}:
-
-buildPythonPackage rec {
-  pname = "gotrue";
-  version = "2.12.4";
-  pyproject = true;
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-NdLljgZkhjIfTf8AM7MKU9BXx/Q2wVKHEi+gy4MwKbE=";
-  };
-
-  build-system = [ poetry-core ];
-
-  dependencies = [
-    httpx
-    h2
-    pydantic
-    pyjwt
-    pytest-mock
-  ];
-
-  pythonImportsCheck = [ "gotrue" ];
-
-  # test aren't in pypi package
-  doCheck = false;
-
-  meta = {
-    homepage = "https://github.com/supabase/auth-py";
-    license = lib.licenses.mit;
-    description = "Python Client Library for Supabase Auth";
-    maintainers = with lib.maintainers; [ siegema ];
-  };
-}
diff --git a/pkgs/development/python-modules/python-socks/default.nix b/pkgs/development/python-modules/python-socks/default.nix
index 8c77598f91cf..1551e5748a7f 100644
--- a/pkgs/development/python-modules/python-socks/default.nix
+++ b/pkgs/development/python-modules/python-socks/default.nix
@@ -10,14 +10,15 @@
   pytest-trio,
   pytestCheckHook,
   setuptools,
+  tiny-proxy,
   trio,
   trustme,
   yarl,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "python-socks";
-  version = "2.8.0";
+  version = "2.8.1";
   pyproject = true;
 
   __darwinAllowLocalNetworking = true;
@@ -25,8 +26,8 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "romis2012";
     repo = "python-socks";
-    tag = "v${version}";
-    hash = "sha256-b19DfvoJo/9NCjgZ+07WdZGnXNS7/f+FgGdU8s1k2io=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Eu4xeBZbZvAGfFArMiUlUQQa4yywKWj+azv+OHiKJfU=";
   };
 
   build-system = [ setuptools ];
@@ -43,14 +44,13 @@ buildPythonPackage rec {
     anyio = [ anyio ];
   };
 
-  doCheck = false; # requires tiny_proxy module
-
   nativeCheckInputs = [
     anyio
     flask
     pytest-asyncio
     pytest-trio
     pytestCheckHook
+    tiny-proxy
     trustme
     yarl
   ];
@@ -58,10 +58,10 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "python_socks" ];
 
   meta = {
-    changelog = "https://github.com/romis2012/python-socks/releases/tag/${src.tag}";
+    changelog = "https://github.com/romis2012/python-socks/releases/tag/${finalAttrs.src.tag}";
     description = "Core proxy client (SOCKS4, SOCKS5, HTTP) functionality for Python";
     homepage = "https://github.com/romis2012/python-socks";
     license = lib.licenses.asl20;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/supafunc/default.nix b/pkgs/development/python-modules/supafunc/default.nix
deleted file mode 100644
index 8dfd5301fb06..000000000000
--- a/pkgs/development/python-modules/supafunc/default.nix
+++ /dev/null
@@ -1,40 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-  httpx,
-  poetry-core,
-  strenum,
-}:
-
-buildPythonPackage rec {
-  pname = "supafunc";
-  version = "0.10.2";
-  pyproject = true;
-
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-ReTVAIVBZ8JhUVxD96NjMg4KkoEYGC/okyre/d7dtUU=";
-  };
-
-  build-system = [ poetry-core ];
-
-  dependencies = [
-    strenum
-    httpx
-  ]
-  ++ httpx.optional-dependencies.http2;
-
-  # Tests are not in PyPI package and source is not tagged
-  doCheck = false;
-
-  pythonImportsCheck = [ "supafunc" ];
-
-  meta = {
-    description = "Library for Supabase Functions";
-    homepage = "https://github.com/supabase/functions-py";
-    changelog = "https://github.com/supabase/functions-py/blob/v${version}/CHANGELOG.md";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ siegema ];
-  };
-}
diff --git a/pkgs/development/python-modules/victron-mqtt/default.nix b/pkgs/development/python-modules/victron-mqtt/default.nix
index fba75b2f93ec..0990d8ddacbb 100644
--- a/pkgs/development/python-modules/victron-mqtt/default.nix
+++ b/pkgs/development/python-modules/victron-mqtt/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "victron-mqtt";
-  version = "2026.2.5.1";
+  version = "2026.3.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tomer-w";
     repo = "victron_mqtt";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-V3kcepEU/1YySQAPZaeCnRnULjcMuBz5LSQZ9JSz4ks=";
+    hash = "sha256-KBmKHDCTBijt1GZGUuNKHLFpBB+Zfj1Vxio0qUS/Dto=";
   };
 
   build-system = [
diff --git a/pkgs/development/rocm-modules/clr/default.nix b/pkgs/development/rocm-modules/clr/default.nix
index 8b76a12d9351..8592f361199b 100644
--- a/pkgs/development/rocm-modules/clr/default.nix
+++ b/pkgs/development/rocm-modules/clr/default.nix
@@ -263,11 +263,15 @@ stdenv.mkDerivation (finalAttrs: {
     };
 
     impureTests = {
+      # bash $(nix-build -A rocmPackages.clr.impureTests.rocm-smi)
       rocm-smi = callPackage ./test-rocm-smi.nix {
         inherit rocm-smi;
         clr = finalAttrs.finalPackage;
       };
-      # TODO(@LunNova): add OpenCL test with opencl-cts
+      # Simple subset of opencl-cts test_basic
+      opencl-cts = callPackage ./test-opencl-cts.nix {
+        clr = finalAttrs.finalPackage;
+      };
       generic-arch = callPackage ./test-isa-compat.nix {
         clr = finalAttrs.finalPackage;
         name = "generic-arch";
diff --git a/pkgs/development/rocm-modules/clr/test-opencl-cts.nix b/pkgs/development/rocm-modules/clr/test-opencl-cts.nix
new file mode 100644
index 000000000000..77929531f900
--- /dev/null
+++ b/pkgs/development/rocm-modules/clr/test-opencl-cts.nix
@@ -0,0 +1,28 @@
+{
+  lib,
+  makeImpureTest,
+  opencl-cts,
+  clr,
+}:
+
+makeImpureTest {
+  name = "opencl-cts";
+  testedPackage = "rocmPackages.clr";
+
+  sandboxPaths = [
+    "/sys"
+    "/dev/dri"
+    "/dev/kfd"
+  ];
+
+  nativeBuildInputs = [ opencl-cts ];
+  OCL_ICD_VENDORS = "${clr.icd}/etc/OpenCL/vendors";
+
+  testScript = ''
+    test_basic arraycopy arrayreadwrite astype barrier vector_swizzle work_item_functions
+  '';
+
+  meta = {
+    teams = [ lib.teams.rocm ];
+  };
+}
diff --git a/pkgs/development/rocq-modules/rocq-elpi/default.nix b/pkgs/development/rocq-modules/rocq-elpi/default.nix
index 51b12e1435f7..d26cb1be419c 100644
--- a/pkgs/development/rocq-modules/rocq-elpi/default.nix
+++ b/pkgs/development/rocq-modules/rocq-elpi/default.nix
@@ -17,6 +17,7 @@ let
       in
       with lib.versions;
       lib.switch rocq-core.rocq-version [
+        (case (range "9.0" "9.2") "3.6.1")
         (case (range "9.0" "9.1") "3.4.5")
         (case (range "9.0" "9.1") "2.0.7")
       ] rocq-core.ocamlPackages.elpi.version;
@@ -36,10 +37,12 @@ let
       in
       with lib.versions;
       lib.switch rocq-core.rocq-version [
+        (case (range "9.0" "9.2") "3.3.0")
         (case (range "9.0" "9.1") "3.2.0")
         (case (range "9.0" "9.1") "2.6.0")
         (case "9.0" "2.5.2")
       ] null;
+    release."3.3.0".sha256 = "sha256-wcsUpw7S+H9CaXuz+W3g22IFWO2cLllJ4xm2qLTG0nM=";
     release."3.2.0".sha256 = "sha256-FyYG/8lEyt1L/paMez8jYAnnUE+sxIp4Da5MztmwJ/c=";
     release."3.1.0".sha256 = "sha256-ytGPGwJv+jmRT6uN0sg6q+xh8ND0PMIZ9ULB0Uwca1w=";
     release."3.0.0".sha256 = "sha256-YMe2is7duGcvAHjM4joUE90EloibjSxqfZThsJhstdU=";
diff --git a/pkgs/development/tools/rust/cargo-pgrx/pinned.nix b/pkgs/development/tools/rust/cargo-pgrx/pinned.nix
index 8e33f655528c..f2954f52b431 100644
--- a/pkgs/development/tools/rust/cargo-pgrx/pinned.nix
+++ b/pkgs/development/tools/rust/cargo-pgrx/pinned.nix
@@ -23,4 +23,9 @@
     hash = "sha256-AjoBr+/sEPdzbD0wLUNVm2syCySkGaFOFQ70TST1U9w=";
     cargoHash = "sha256-95DHq5GLnAqb3bbKwwaeBeKEmkfRh81ZTRaJ7L59DAg=";
   };
+  cargo-pgrx_0_17_0 = {
+    version = "0.17.0";
+    hash = "sha256-Ld7m7ggxlf8FufpeiAE9qcu49X0SgX6XXHS6KIewGyA=";
+    cargoHash = "sha256-hNj39YzJna8iZxnlrLz+uLduxaD+uvggQRM7ng3MN1k=";
+  };
 }
diff --git a/pkgs/development/web/playwright/driver.nix b/pkgs/development/web/playwright/driver.nix
index fba717617061..7750fac295ca 100644
--- a/pkgs/development/web/playwright/driver.nix
+++ b/pkgs/development/web/playwright/driver.nix
@@ -165,6 +165,7 @@ let
 
     passthru = {
       browsersJSON = (lib.importJSON ./browsers.json).browsers;
+      selectBrowsers = browsers;
       browsers = browsers { };
       browsers-chromium = browsers {
         withFirefox = false;
diff --git a/pkgs/os-specific/linux/kernel/linux-rpi.nix b/pkgs/os-specific/linux/kernel/linux-rpi.nix
index 7f93000e8ef4..c7bd79345811 100644
--- a/pkgs/os-specific/linux/kernel/linux-rpi.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rpi.nix
@@ -9,22 +9,23 @@
 
 let
   # NOTE: raspberrypifw & raspberryPiWirelessFirmware should be updated with this
-  modDirVersion = "6.12.47";
-  tag = "stable_20250916";
-  hash = "sha256-HG8Oc04V2t54l0SOn4gKmNJWQUrZfjWusgKcWvx74H0==";
+  modDirVersion = "6.12.62";
+  hash = "sha256-jcSzPoCCnmZU1GDBUWAljIUjZRzbfdh2aQB9/GOc5mQ=";
 in
 lib.overrideDerivation
   (buildLinux (
     args
     // {
-      version = "${modDirVersion}-${tag}";
+      version = "${modDirVersion}-1+rpt1";
       inherit modDirVersion;
       pname = "linux-rpi";
 
       src = fetchFromGitHub {
         owner = "raspberrypi";
         repo = "linux";
-        inherit tag hash;
+        # https://github.com/RPi-Distro/linux-packaging/raw/refs/tags/pios/1%256.12.62-1+rpt1/debian/changelog
+        rev = "a1073743767f9e7fdc7017ababd2a07ea0c97c1c";
+        inherit hash;
       };
 
       defconfig =
diff --git a/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix b/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
index 62b8cb1c7b91..fb67267ce725 100644
--- a/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
+++ b/pkgs/servers/sql/postgresql/ext/vectorchord/package.nix
@@ -1,6 +1,6 @@
 {
   buildPgrxExtension,
-  cargo-pgrx_0_16_0,
+  cargo-pgrx_0_17_0,
   fetchFromGitHub,
   lib,
   nix-update-script,
@@ -9,19 +9,19 @@
 }:
 buildPgrxExtension (finalAttrs: {
   inherit postgresql;
-  cargo-pgrx = cargo-pgrx_0_16_0;
+  cargo-pgrx = cargo-pgrx_0_17_0;
 
   pname = "vectorchord";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "tensorchord";
     repo = "vectorchord";
     tag = finalAttrs.version;
-    hash = "sha256-8Gk5/wIGu5/t8EKeG9Wna7yUWKiuCOC9yjJFo2euF/I=";
+    hash = "sha256-QL9XGSQFOcrpww03Y5F0JuDbpo0v8oidUqucLxggkqE=";
   };
 
-  cargoHash = "sha256-o7NZEH3NCf/T81kL7jDa4HHGWsyTkLXXhq4KQR2/PGM=";
+  cargoHash = "sha256-IXOCzKJArNOcb/2TcJbLz1XdCquUpyF/cLHYU5vmlko=";
 
   # Include upgrade scripts in the final package
   # https://github.com/tensorchord/VectorChord/blob/0.5.0/crates/make/src/main.rs#L366
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 258346a41025..a4763d74d9b6 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -288,7 +288,7 @@ with pkgs;
     name = "update-autotools-gnu-config-scripts-hook";
     substitutions = {
       gnu_config = gnu-config.override {
-        runtimeShell = targetPackages.stdenv.shell;
+        runtimeShell = if stdenv.buildPlatform == stdenv.hostPlatform then stdenv.shell else runtimeShell;
       };
     };
   } ../build-support/setup-hooks/update-autotools-gnu-config-scripts.sh;
@@ -4687,6 +4687,7 @@ with pkgs;
     cargo-pgrx_0_12_6
     cargo-pgrx_0_16_0
     cargo-pgrx_0_16_1
+    cargo-pgrx_0_17_0
     cargo-pgrx
     ;
 
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index e002522ff19a..b602dcd6d6cd 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -221,6 +221,7 @@ mapAliases {
   GitPython = throw "'GitPython' has been renamed to/replaced by 'gitpython'"; # Converted to throw 2025-10-29
   google_api_python_client = throw "'google_api_python_client' has been renamed to/replaced by 'google-api-python-client'"; # Converted to throw 2025-10-29
   googleapis_common_protos = throw "'googleapis_common_protos' has been renamed to/replaced by 'googleapis-common-protos'"; # Converted to throw 2025-10-29
+  gotrue = throw "'gotrue' has been replaced by 'supabase-auth'"; # Added 2026-03-08
   gpapi = throw "'gpapi' has been superseded by google-api-python-client"; # Added 2025-11-09
   gplaycli = throw "'gplaycli' has been removed as it was broken and lacked maintenance"; # Added 2025-11-09
   gpy = throw "'gpy' has been removed as it is based on 'paramz', which was removed"; # added 2025-11-10
@@ -528,6 +529,7 @@ mapAliases {
   sqlalchemy-views = throw "'sqlalchemy-views' has been removed as it was broken and unmaintained upstream"; # Added 2025-11-09
   sqlalchemy_migrate = throw "'sqlalchemy_migrate' has been renamed to/replaced by 'sqlalchemy-migrate'"; # Converted to throw 2025-10-29
   subunit2sql = throw "subunit2sql has been removed because it has been marked as broken since at least November 2024."; # Added 2025-10-04
+  supafunc = throw "'supafunc' has been replaced by 'supabase-functions'"; # Added 2026-03-08
   supervise_api = throw "'supervise_api' has been renamed to/replaced by 'supervise-api'"; # Converted to throw 2025-10-29
   swh-perfecthash = throw "'swh-perfecthash' has been renamed to/replaced by 'swh-shard'"; # added 2025-11-13
   synologydsm-api = throw "'synologydsm-api' has been renamed to/replaced by 'py-synologydsm-api'"; # Converted to throw 2025-10-29
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b2b7897944f0..dbbb7a997cb7 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3878,7 +3878,9 @@ self: super: with self; {
 
   devpi-ldap = callPackage ../development/python-modules/devpi-ldap { };
 
-  devpi-server = callPackage ../development/python-modules/devpi-server { };
+  devpi-server = callPackage ../by-name/de/devpi-server/unwrapped.nix { };
+
+  devpi-web = callPackage ../development/python-modules/devpi-web { };
 
   devtools = callPackage ../development/python-modules/devtools { };
 
@@ -6592,8 +6594,6 @@ self: super: with self; {
 
   gotify = callPackage ../development/python-modules/gotify { };
 
-  gotrue = callPackage ../development/python-modules/gotrue { };
-
   govee-ble = callPackage ../development/python-modules/govee-ble { };
 
   govee-led-wez = callPackage ../development/python-modules/govee-led-wez { };
@@ -18709,8 +18709,6 @@ self: super: with self; {
 
   supabase-functions = callPackage ../development/python-modules/supabase-functions { };
 
-  supafunc = callPackage ../development/python-modules/supafunc { };
-
   super-collections = callPackage ../development/python-modules/super-collections { };
 
   superqt = callPackage ../development/python-modules/superqt { };