diff --git a/doc/release-notes/rl-2505.section.md b/doc/release-notes/rl-2505.section.md
index fc40e5eefe4e..3c6bbef5f9f0 100644
--- a/doc/release-notes/rl-2505.section.md
+++ b/doc/release-notes/rl-2505.section.md
@@ -58,6 +58,12 @@
 - [testers.shellcheck](https://nixos.org/manual/nixpkgs/unstable/#tester-shellcheck) now warns when `name` is not provided.
   The `name` argument will become mandatory in a future release.
 
+- `grafana-agent` and `services.grafana-agent` have been removed in favor of
+  Grafana Alloy (`grafana-alloy` and `services.alloy`), as they depend on an EOL compiler version
+  and will become EOL during the 25.05 lifecycle.
+  Grafana recommends migrating to `grafana-alloy` (`services.alloy`).
+  See https://grafana.com/docs/alloy/latest/set-up/migrate/ for details.
+
 - `xdragon` package has been renamed to `dragon-drop`.
   `xdragon` is an alias to `dragon-drop` and the package still provides `bin/xdragon`.
   `bin/dragon` is no longer supplied.
@@ -68,9 +74,12 @@
 
 - `postgresql`'s `pythonSupport` argument has been changed. It is now enabled by default, but to use PL/Python the extension needs to be added explicitly with `postgresql.withPackages`. If you were using `postgresql.override { pythonSupport = true; }` before, change it to `postgresql.withPackages (ps: [ ps.plpython3 ])`. The same applies to `perlSupport`/`plperl` and `tclSupport`/`pltcl` respectively.
 
-- The `rustPlatform.fetchCargoTarball` function is deprecated, because it relied on `cargo vendor` not changing its output format to keep fixed-output derivation hashes the same, which is a Nix invariant, and Cargo 1.84.0 changed `cargo vendor`'s output format.
-  It should generally be replaced with `rustPlatform.fetchCargoVendor`, but `rustPlatform.importCargoLock` may also be appropriate in some circumstances.
-  `rustPlatform.buildRustPackage` users must set `useFetchCargoVendor` to `true` and regenerate the `cargoHash`.
+- Rust packages will need to regenerate their `cargoHash`.
+  Cargo 1.84.0 changed the format of `cargo vendor` output, which invalidated all existing `rustPlatform.fetchCargoTarball` hashes.
+  To preserve Nix’s invariants, it has been replaced with `rustPlatform.fetchCargoVendor`, an independent implementation prioritizing format stability.
+  `rustPlatform.buildRustPackage` now uses `rustPlatform.fetchCargoVendor` by default; a hash mismatch error is expected in third‐party Rust packages when updating to Nixpkgs 25.05.
+  Packages wishing to maintain compatibility with Nixpkgs 24.11 must set `useFetchCargoVendor` to `true` explicitly.
+  `rustPlatform.importCargoLock` may also be appropriate in some circumstances.
 
 - NetBox was updated to `>= 4.2.0`. Have a look at the breaking changes
   of the [4.1 release](https://github.com/netbox-community/netbox/releases/tag/v4.1.0)
@@ -83,6 +92,8 @@
 
 - `i3status-rust`-package no longer enables `notmuch` by default. It can be enabled via `withNotmuch`.
 
+- `ocis-bin` has been renamed to `ocis_5-bin`. Future versions will have the major version suffix.
+
 - All support for 32‐bit Darwin systems has been dropped.
 
 - Default ICU version updated from 74 to 76
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index a2664ff44e5f..e7464e9e5a75 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -10799,6 +10799,13 @@
     github = "james-atkins";
     githubId = 9221409;
   };
+  jamesward = {
+    email = "james@jamesward.com";
+    name = "James Ward";
+    github = "jamesward";
+    githubId = 65043;
+    keys = [ { fingerprint = "82F9 4BBD F95C 247B BD21  396B 9A0B 94DE C0FF A7EE"; } ];
+  };
   jamiemagee = {
     email = "jamie.magee@gmail.com";
     github = "JamieMagee";
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 6a3be1eb100f..0a23a0d0d653 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -949,7 +949,6 @@
   ./services/monitoring/glances.nix
   ./services/monitoring/glpi-agent.nix
   ./services/monitoring/goss.nix
-  ./services/monitoring/grafana-agent.nix
   ./services/monitoring/grafana-image-renderer.nix
   ./services/monitoring/grafana-reporter.nix
   ./services/monitoring/grafana-to-ntfy.nix
diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix
index 4f1565dc6298..49872bc7a96b 100644
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -143,6 +143,13 @@ in
     ] "The fourStoreEndpoint module has been removed")
     (mkRemovedOptionModule [ "services" "fprot" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "frab" ] "The frab module has been removed")
+    (mkRemovedOptionModule
+      [
+        "services"
+        "grafana-agent"
+      ]
+      "The grafana-agent module has been removed. Consider migrating to `grafana-alloy` (`services.alloy.enable`). See <https://grafana.com/docs/alloy/latest/set-up/migrate/>"
+    )
     (mkRemovedOptionModule [ "services" "homeassistant-satellite" ]
       "The `services.homeassistant-satellite` module has been replaced by `services.wyoming-satellite`."
     )
diff --git a/nixos/modules/services/desktop-managers/cosmic.nix b/nixos/modules/services/desktop-managers/cosmic.nix
index a6aa7cc3e826..576cbe1438ec 100644
--- a/nixos/modules/services/desktop-managers/cosmic.nix
+++ b/nixos/modules/services/desktop-managers/cosmic.nix
@@ -7,7 +7,6 @@
   config,
   lib,
   pkgs,
-  utils,
   ...
 }:
 
@@ -97,14 +96,11 @@ in
     systemd = {
       packages = [ pkgs.cosmic-session ];
       user.targets = {
+        # TODO: remove when upstream has XDG autostart support
         cosmic-session = {
           wants = [ "xdg-desktop-autostart.target" ];
           before = [ "xdg-desktop-autostart.target" ];
         };
-        tray = {
-          description = "Cosmic Tray Target";
-          requires = [ "graphical-session-pre.target" ];
-        };
       };
     };
 
@@ -125,7 +121,7 @@ in
     services.displayManager.sessionPackages = [ pkgs.cosmic-session ];
     services.libinput.enable = true;
     services.upower.enable = true;
-    # Setup PAM authentication for the `cosmic-greeter` user
+    # Required for screen locker
     security.pam.services.cosmic-greeter = { };
 
     # Good to have defaults
diff --git a/nixos/modules/services/display-managers/cosmic-greeter.nix b/nixos/modules/services/display-managers/cosmic-greeter.nix
index 64cd8667b365..aa4243cfa700 100644
--- a/nixos/modules/services/display-managers/cosmic-greeter.nix
+++ b/nixos/modules/services/display-managers/cosmic-greeter.nix
@@ -59,7 +59,7 @@ in
       createHome = true;
       group = "cosmic-greeter";
     };
-    # Setup PAM authentication for the `cosmic-greeter` user
+    # Required for authentication
     security.pam.services.cosmic-greeter = { };
 
     hardware.graphics.enable = true;
diff --git a/nixos/modules/services/monitoring/grafana-agent.nix b/nixos/modules/services/monitoring/grafana-agent.nix
deleted file mode 100644
index f00514d61936..000000000000
--- a/nixos/modules/services/monitoring/grafana-agent.nix
+++ /dev/null
@@ -1,180 +0,0 @@
-{
-  lib,
-  pkgs,
-  config,
-  generators,
-  ...
-}:
-let
-  cfg = config.services.grafana-agent;
-  settingsFormat = pkgs.formats.yaml { };
-  configFile = settingsFormat.generate "grafana-agent.yaml" cfg.settings;
-in
-{
-  meta = {
-    maintainers = with lib.maintainers; [
-      flokli
-      zimbatm
-    ];
-  };
-
-  options.services.grafana-agent = {
-    enable = lib.mkEnableOption "grafana-agent";
-
-    package = lib.mkPackageOption pkgs "grafana-agent" { };
-
-    credentials = lib.mkOption {
-      description = ''
-        Credentials to load at service startup. Keys that are UPPER_SNAKE will be loaded as env vars. Values are absolute paths to the credentials.
-      '';
-      type = lib.types.attrsOf lib.types.str;
-      default = { };
-
-      example = {
-        logs_remote_write_password = "/run/keys/grafana_agent_logs_remote_write_password";
-        LOGS_REMOTE_WRITE_URL = "/run/keys/grafana_agent_logs_remote_write_url";
-        LOGS_REMOTE_WRITE_USERNAME = "/run/keys/grafana_agent_logs_remote_write_username";
-        metrics_remote_write_password = "/run/keys/grafana_agent_metrics_remote_write_password";
-        METRICS_REMOTE_WRITE_URL = "/run/keys/grafana_agent_metrics_remote_write_url";
-        METRICS_REMOTE_WRITE_USERNAME = "/run/keys/grafana_agent_metrics_remote_write_username";
-      };
-    };
-
-    extraFlags = lib.mkOption {
-      type = with lib.types; listOf str;
-      default = [ ];
-      example = [
-        "-enable-features=integrations-next"
-        "-disable-reporting"
-      ];
-      description = ''
-        Extra command-line flags passed to {command}`grafana-agent`.
-
-        See <https://grafana.com/docs/agent/latest/static/configuration/flags/>
-      '';
-    };
-
-    settings = lib.mkOption {
-      description = ''
-        Configuration for {command}`grafana-agent`.
-
-        See <https://grafana.com/docs/agent/latest/configuration/>
-      '';
-
-      type = lib.types.submodule {
-        freeformType = settingsFormat.type;
-      };
-
-      default = { };
-      defaultText = lib.literalExpression ''
-        {
-          metrics = {
-            wal_directory = "\''${STATE_DIRECTORY}";
-            global.scrape_interval = "5s";
-          };
-          integrations = {
-            agent.enabled = true;
-            agent.scrape_integration = true;
-            node_exporter.enabled = true;
-          };
-        }
-      '';
-      example = {
-        metrics.global.remote_write = [
-          {
-            url = "\${METRICS_REMOTE_WRITE_URL}";
-            basic_auth.username = "\${METRICS_REMOTE_WRITE_USERNAME}";
-            basic_auth.password_file = "\${CREDENTIALS_DIRECTORY}/metrics_remote_write_password";
-          }
-        ];
-        logs.configs = [
-          {
-            name = "default";
-            scrape_configs = [
-              {
-                job_name = "journal";
-                journal = {
-                  max_age = "12h";
-                  labels.job = "systemd-journal";
-                };
-                relabel_configs = [
-                  {
-                    source_labels = [ "__journal__systemd_unit" ];
-                    target_label = "systemd_unit";
-                  }
-                  {
-                    source_labels = [ "__journal__hostname" ];
-                    target_label = "nodename";
-                  }
-                  {
-                    source_labels = [ "__journal_syslog_identifier" ];
-                    target_label = "syslog_identifier";
-                  }
-                ];
-              }
-            ];
-            positions.filename = "\${STATE_DIRECTORY}/loki_positions.yaml";
-            clients = [
-              {
-                url = "\${LOGS_REMOTE_WRITE_URL}";
-                basic_auth.username = "\${LOGS_REMOTE_WRITE_USERNAME}";
-                basic_auth.password_file = "\${CREDENTIALS_DIRECTORY}/logs_remote_write_password";
-              }
-            ];
-          }
-        ];
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    services.grafana-agent.settings = {
-      # keep this in sync with config.services.grafana-agent.settings.defaultText.
-      metrics = {
-        wal_directory = lib.mkDefault "\${STATE_DIRECTORY}";
-        global.scrape_interval = lib.mkDefault "5s";
-      };
-      integrations = {
-        agent.enabled = lib.mkDefault true;
-        agent.scrape_integration = lib.mkDefault true;
-        node_exporter.enabled = lib.mkDefault true;
-      };
-    };
-
-    systemd.services.grafana-agent = {
-      wantedBy = [ "multi-user.target" ];
-      script = ''
-        set -euo pipefail
-        shopt -u nullglob
-
-        # Load all credentials into env if they are in UPPER_SNAKE form.
-        if [[ -n "''${CREDENTIALS_DIRECTORY:-}" ]]; then
-          for file in "$CREDENTIALS_DIRECTORY"/*; do
-            key=$(basename "$file")
-            if [[ $key =~ ^[A-Z0-9_]+$ ]]; then
-              echo "Environ $key"
-              export "$key=$(< "$file")"
-            fi
-          done
-        fi
-
-        # We can't use Environment=HOSTNAME=%H, as it doesn't include the domain part.
-        export HOSTNAME=$(< /proc/sys/kernel/hostname)
-
-        exec ${lib.getExe cfg.package} -config.expand-env -config.file ${configFile} ${lib.escapeShellArgs cfg.extraFlags}
-      '';
-      serviceConfig = {
-        Restart = "always";
-        DynamicUser = true;
-        RestartSec = 2;
-        SupplementaryGroups = [
-          # allow to read the systemd journal for loki log forwarding
-          "systemd-journal"
-        ];
-        StateDirectory = "grafana-agent";
-        LoadCredential = lib.mapAttrsToList (key: value: "${key}:${value}") cfg.credentials;
-        Type = "simple";
-      };
-    };
-  };
-}
diff --git a/nixos/modules/services/web-apps/ocis.md b/nixos/modules/services/web-apps/ocis.md
index 9156e927ed2d..9a21ca25f14a 100644
--- a/nixos/modules/services/web-apps/ocis.md
+++ b/nixos/modules/services/web-apps/ocis.md
@@ -37,7 +37,7 @@ However to make this configuration work you will need generate a configuration.
 You can do this with:
 
 ```console
-$ nix-shell -p ocis-bin
+$ nix-shell -p ocis_5-bin
 $ mkdir scratch/
 $ cd scratch/
 $ ocis init --config-path . --admin-password "changeme"
diff --git a/nixos/modules/services/web-apps/ocis.nix b/nixos/modules/services/web-apps/ocis.nix
index 0266eb6ad29c..bc17dabade7f 100644
--- a/nixos/modules/services/web-apps/ocis.nix
+++ b/nixos/modules/services/web-apps/ocis.nix
@@ -16,7 +16,11 @@ in
     services.ocis = {
       enable = lib.mkEnableOption "ownCloud Infinite Scale";
 
-      package = lib.mkPackageOption pkgs "ocis-bin" { };
+      package = lib.mkOption {
+        type = types.package;
+        description = "Which package to use for the ownCloud Infinite Scale instance.";
+        relatedPackages = [ "ocis_5-bin" ];
+      };
 
       configDir = lib.mkOption {
         type = types.nullOr types.path;
@@ -137,6 +141,8 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    services.ocis.package = lib.mkDefault pkgs.ocis_5-bin;
+
     users.users.${defaultUser} = lib.mkIf (cfg.user == defaultUser) {
       group = cfg.group;
       home = cfg.stateDir;
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index f7e23d511819..fbe35b84859a 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -369,13 +369,13 @@ in
   dnscrypt-proxy2 = handleTestOn [ "x86_64-linux" ] ./dnscrypt-proxy2.nix { };
   dnsdist = import ./dnsdist.nix { inherit pkgs runTest; };
   doas = runTest ./doas.nix;
-  docker = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./docker.nix { };
-  docker-rootless = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./docker-rootless.nix { };
-  docker-registry = handleTest ./docker-registry.nix { };
+  docker = runTestOn [ "aarch64-linux" "x86_64-linux" ] ./docker.nix;
+  docker-rootless = runTestOn [ "aarch64-linux" "x86_64-linux" ] ./docker-rootless.nix;
+  docker-registry = runTest ./docker-registry.nix;
   docker-tools = handleTestOn [ "x86_64-linux" ] ./docker-tools.nix { };
   docker-tools-nix-shell = runTest ./docker-tools-nix-shell.nix;
-  docker-tools-cross = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./docker-tools-cross.nix { };
-  docker-tools-overlay = handleTestOn [ "x86_64-linux" ] ./docker-tools-overlay.nix { };
+  docker-tools-cross = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./docker-tools-cross.nix;
+  docker-tools-overlay = runTestOn [ "x86_64-linux" ] ./docker-tools-overlay.nix;
   docling-serve = runTest ./docling-serve.nix;
   documize = handleTest ./documize.nix { };
   documentation = pkgs.callPackage ../modules/misc/documentation/test.nix { inherit nixosLib; };
@@ -546,12 +546,11 @@ in
   gotify-server = handleTest ./gotify-server.nix { };
   gotosocial = runTest ./web-apps/gotosocial.nix;
   grafana = handleTest ./grafana { };
-  grafana-agent = handleTest ./grafana-agent.nix { };
   graphite = handleTest ./graphite.nix { };
   grav = runTest ./web-apps/grav.nix;
   graylog = handleTest ./graylog.nix { };
   greetd-no-shadow = handleTest ./greetd-no-shadow.nix { };
-  grocy = handleTest ./grocy.nix { };
+  grocy = runTest ./grocy.nix;
   grow-partition = runTest ./grow-partition.nix;
   grub = handleTest ./grub.nix { };
   guacamole-server = handleTest ./guacamole-server.nix { };
@@ -612,7 +611,7 @@ in
   hostname = handleTest ./hostname.nix { };
   hound = handleTest ./hound.nix { };
   hub = handleTest ./git/hub.nix { };
-  hydra = handleTest ./hydra { };
+  hydra = runTest ./hydra;
   i3wm = handleTest ./i3wm.nix { };
   icingaweb2 = runTest ./icingaweb2.nix;
   ifm = handleTest ./ifm.nix { };
diff --git a/nixos/tests/docker-registry.nix b/nixos/tests/docker-registry.nix
index aeb95a564c0e..73658b67fb13 100644
--- a/nixos/tests/docker-registry.nix
+++ b/nixos/tests/docker-registry.nix
@@ -1,74 +1,71 @@
 # This test runs docker-registry and check if it works
+{ pkgs, ... }:
+{
+  name = "docker-registry";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      globin
+      ironpinguin
+      cafkafk
+    ];
+  };
 
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "docker-registry";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        globin
-        ironpinguin
-        cafkafk
-      ];
-    };
+  nodes = {
+    registry =
+      { ... }:
+      {
+        services.dockerRegistry.enable = true;
+        services.dockerRegistry.enableDelete = true;
+        services.dockerRegistry.port = 8080;
+        services.dockerRegistry.listenAddress = "0.0.0.0";
+        services.dockerRegistry.enableGarbageCollect = true;
+        services.dockerRegistry.openFirewall = true;
+      };
 
-    nodes = {
-      registry =
-        { ... }:
-        {
-          services.dockerRegistry.enable = true;
-          services.dockerRegistry.enableDelete = true;
-          services.dockerRegistry.port = 8080;
-          services.dockerRegistry.listenAddress = "0.0.0.0";
-          services.dockerRegistry.enableGarbageCollect = true;
-          services.dockerRegistry.openFirewall = true;
-        };
+    client1 =
+      { ... }:
+      {
+        virtualisation.docker.enable = true;
+        virtualisation.docker.extraOptions = "--insecure-registry registry:8080";
+      };
 
-      client1 =
-        { ... }:
-        {
-          virtualisation.docker.enable = true;
-          virtualisation.docker.extraOptions = "--insecure-registry registry:8080";
-        };
+    client2 =
+      { ... }:
+      {
+        virtualisation.docker.enable = true;
+        virtualisation.docker.extraOptions = "--insecure-registry registry:8080";
+      };
+  };
 
-      client2 =
-        { ... }:
-        {
-          virtualisation.docker.enable = true;
-          virtualisation.docker.extraOptions = "--insecure-registry registry:8080";
-        };
-    };
+  testScript = ''
+    client1.start()
+    client1.wait_for_unit("docker.service")
+    client1.succeed("tar cv --files-from /dev/null | docker import - scratch")
+    client1.succeed("docker tag scratch registry:8080/scratch")
 
-    testScript = ''
-      client1.start()
-      client1.wait_for_unit("docker.service")
-      client1.succeed("tar cv --files-from /dev/null | docker import - scratch")
-      client1.succeed("docker tag scratch registry:8080/scratch")
+    registry.start()
+    registry.wait_for_unit("docker-registry.service")
+    registry.wait_for_open_port(8080)
+    client1.succeed("docker push registry:8080/scratch")
 
-      registry.start()
-      registry.wait_for_unit("docker-registry.service")
-      registry.wait_for_open_port(8080)
-      client1.succeed("docker push registry:8080/scratch")
+    client2.start()
+    client2.wait_for_unit("docker.service")
+    client2.succeed("docker pull registry:8080/scratch")
+    client2.succeed("docker images | grep scratch")
 
-      client2.start()
-      client2.wait_for_unit("docker.service")
-      client2.succeed("docker pull registry:8080/scratch")
-      client2.succeed("docker images | grep scratch")
+    client2.succeed(
+        "curl -fsS -X DELETE registry:8080/v2/scratch/manifests/$(curl -fsS -I -H\"Accept: application/vnd.docker.distribution.manifest.v2+json\" registry:8080/v2/scratch/manifests/latest | grep Docker-Content-Digest | sed -e 's/Docker-Content-Digest: //' | tr -d '\\r')"
+    )
 
-      client2.succeed(
-          "curl -fsS -X DELETE registry:8080/v2/scratch/manifests/$(curl -fsS -I -H\"Accept: application/vnd.docker.distribution.manifest.v2+json\" registry:8080/v2/scratch/manifests/latest | grep Docker-Content-Digest | sed -e 's/Docker-Content-Digest: //' | tr -d '\\r')"
-      )
+    registry.systemctl("start docker-registry-garbage-collect.service")
+    registry.wait_until_fails("systemctl status docker-registry-garbage-collect.service")
+    registry.wait_for_unit("docker-registry.service")
 
-      registry.systemctl("start docker-registry-garbage-collect.service")
-      registry.wait_until_fails("systemctl status docker-registry-garbage-collect.service")
-      registry.wait_for_unit("docker-registry.service")
+    registry.fail("ls -l /var/lib/docker-registry/docker/registry/v2/blobs/sha256/*/*/data")
 
-      registry.fail("ls -l /var/lib/docker-registry/docker/registry/v2/blobs/sha256/*/*/data")
-
-      client1.succeed("docker push registry:8080/scratch")
-      registry.succeed(
-          "ls -l /var/lib/docker-registry/docker/registry/v2/blobs/sha256/*/*/data"
-      )
-    '';
-  }
-)
+    client1.succeed("docker push registry:8080/scratch")
+    registry.succeed(
+        "ls -l /var/lib/docker-registry/docker/registry/v2/blobs/sha256/*/*/data"
+    )
+  '';
+}
diff --git a/nixos/tests/docker-rootless.nix b/nixos/tests/docker-rootless.nix
index 2a97ccb35f91..a2e6a52ca13c 100644
--- a/nixos/tests/docker-rootless.nix
+++ b/nixos/tests/docker-rootless.nix
@@ -1,51 +1,48 @@
 # This test runs docker and checks if simple container starts
+{ lib, pkgs, ... }:
+{
+  name = "docker-rootless";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ abbradar ];
+  };
 
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "docker-rootless";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ abbradar ];
-    };
+  nodes = {
+    machine =
+      { pkgs, ... }:
+      {
+        virtualisation.docker.rootless.enable = true;
 
-    nodes = {
-      machine =
-        { pkgs, ... }:
-        {
-          virtualisation.docker.rootless.enable = true;
-
-          users.users.alice = {
-            uid = 1000;
-            isNormalUser = true;
-          };
+        users.users.alice = {
+          uid = 1000;
+          isNormalUser = true;
         };
-    };
+      };
+  };
 
-    testScript =
-      { nodes, ... }:
-      let
-        user = nodes.machine.config.users.users.alice;
-        sudo = lib.concatStringsSep " " [
-          "XDG_RUNTIME_DIR=/run/user/${toString user.uid}"
-          "DOCKER_HOST=unix:///run/user/${toString user.uid}/docker.sock"
-          "sudo"
-          "--preserve-env=XDG_RUNTIME_DIR,DOCKER_HOST"
-          "-u"
-          "alice"
-        ];
-      in
-      ''
-        machine.wait_for_unit("multi-user.target")
+  testScript =
+    { nodes, ... }:
+    let
+      user = nodes.machine.config.users.users.alice;
+      sudo = lib.concatStringsSep " " [
+        "XDG_RUNTIME_DIR=/run/user/${toString user.uid}"
+        "DOCKER_HOST=unix:///run/user/${toString user.uid}/docker.sock"
+        "sudo"
+        "--preserve-env=XDG_RUNTIME_DIR,DOCKER_HOST"
+        "-u"
+        "alice"
+      ];
+    in
+    ''
+      machine.wait_for_unit("multi-user.target")
 
-        machine.succeed("loginctl enable-linger alice")
-        machine.wait_until_succeeds("${sudo} systemctl --user is-active docker.service")
+      machine.succeed("loginctl enable-linger alice")
+      machine.wait_until_succeeds("${sudo} systemctl --user is-active docker.service")
 
-        machine.succeed("tar cv --files-from /dev/null | ${sudo} docker import - scratchimg")
-        machine.succeed(
-            "${sudo} docker run -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
-        )
-        machine.succeed("${sudo} docker ps | grep sleeping")
-        machine.succeed("${sudo} docker stop sleeping")
-      '';
-  }
-)
+      machine.succeed("tar cv --files-from /dev/null | ${sudo} docker import - scratchimg")
+      machine.succeed(
+          "${sudo} docker run -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
+      )
+      machine.succeed("${sudo} docker ps | grep sleeping")
+      machine.succeed("${sudo} docker stop sleeping")
+    '';
+}
diff --git a/nixos/tests/docker-tools-cross.nix b/nixos/tests/docker-tools-cross.nix
index e2508be134f0..afd78223e857 100644
--- a/nixos/tests/docker-tools-cross.nix
+++ b/nixos/tests/docker-tools-cross.nix
@@ -2,83 +2,81 @@
 # tests that _include_ running the result are separate. That way, most people
 # can run the majority of the test suite without the extra setup.
 
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
+{ pkgs, ... }:
+let
 
-    remoteSystem =
-      if pkgs.stdenv.hostPlatform.system == "aarch64-linux" then "x86_64-linux" else "aarch64-linux";
+  remoteSystem =
+    if pkgs.stdenv.hostPlatform.system == "aarch64-linux" then "x86_64-linux" else "aarch64-linux";
 
-    remoteCrossPkgs =
-      import ../.. # nixpkgs
-        {
-          # NOTE: This is the machine that runs the build -  local from the
-          #       'perspective' of the build script.
-          localSystem = remoteSystem;
+  remoteCrossPkgs =
+    import ../.. # nixpkgs
+      {
+        # NOTE: This is the machine that runs the build -  local from the
+        #       'perspective' of the build script.
+        localSystem = remoteSystem;
 
-          # NOTE: Since this file can't control where the test will be _run_ we don't
-          #       cross-compile _to_ a different system but _from_ a different system
-          crossSystem = pkgs.stdenv.hostPlatform.system;
-        };
-
-    hello1 = remoteCrossPkgs.dockerTools.buildImage {
-      name = "hello1";
-      tag = "latest";
-      copyToRoot = remoteCrossPkgs.buildEnv {
-        name = "image-root";
-        pathsToLink = [ "/bin" ];
-        paths = [ remoteCrossPkgs.hello ];
+        # NOTE: Since this file can't control where the test will be _run_ we don't
+        #       cross-compile _to_ a different system but _from_ a different system
+        crossSystem = pkgs.stdenv.hostPlatform.system;
       };
-    };
 
-    hello2 = remoteCrossPkgs.dockerTools.buildLayeredImage {
-      name = "hello2";
-      tag = "latest";
-      contents = remoteCrossPkgs.hello;
+  hello1 = remoteCrossPkgs.dockerTools.buildImage {
+    name = "hello1";
+    tag = "latest";
+    copyToRoot = remoteCrossPkgs.buildEnv {
+      name = "image-root";
+      pathsToLink = [ "/bin" ];
+      paths = [ remoteCrossPkgs.hello ];
     };
+  };
 
-  in
-  {
-    name = "docker-tools";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ roberth ];
-    };
+  hello2 = remoteCrossPkgs.dockerTools.buildLayeredImage {
+    name = "hello2";
+    tag = "latest";
+    contents = remoteCrossPkgs.hello;
+  };
 
-    nodes = {
-      docker =
-        { ... }:
-        {
-          virtualisation = {
-            diskSize = 2048;
-            docker.enable = true;
-          };
+in
+{
+  name = "docker-tools";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ roberth ];
+  };
+
+  nodes = {
+    docker =
+      { ... }:
+      {
+        virtualisation = {
+          diskSize = 2048;
+          docker.enable = true;
         };
-    };
+      };
+  };
 
-    testScript = ''
-      docker.wait_for_unit("sockets.target")
+  testScript = ''
+    docker.wait_for_unit("sockets.target")
 
-      with subtest("Ensure cross compiled buildImage image can run."):
-          docker.succeed(
-              "docker load --input='${hello1}'"
-          )
-          assert "Hello, world!" in docker.succeed(
-              "docker run --rm ${hello1.imageName} hello",
-          )
-          docker.succeed(
-              "docker rmi ${hello1.imageName}",
-          )
+    with subtest("Ensure cross compiled buildImage image can run."):
+        docker.succeed(
+            "docker load --input='${hello1}'"
+        )
+        assert "Hello, world!" in docker.succeed(
+            "docker run --rm ${hello1.imageName} hello",
+        )
+        docker.succeed(
+            "docker rmi ${hello1.imageName}",
+        )
 
-      with subtest("Ensure cross compiled buildLayeredImage image can run."):
-          docker.succeed(
-              "docker load --input='${hello2}'"
-          )
-          assert "Hello, world!" in docker.succeed(
-              "docker run --rm ${hello2.imageName} hello",
-          )
-          docker.succeed(
-              "docker rmi ${hello2.imageName}",
-          )
-    '';
-  }
-)
+    with subtest("Ensure cross compiled buildLayeredImage image can run."):
+        docker.succeed(
+            "docker load --input='${hello2}'"
+        )
+        assert "Hello, world!" in docker.succeed(
+            "docker run --rm ${hello2.imageName} hello",
+        )
+        docker.succeed(
+            "docker rmi ${hello2.imageName}",
+        )
+  '';
+}
diff --git a/nixos/tests/docker-tools-overlay.nix b/nixos/tests/docker-tools-overlay.nix
index a1de0272703f..98a72f78e3e1 100644
--- a/nixos/tests/docker-tools-overlay.nix
+++ b/nixos/tests/docker-tools-overlay.nix
@@ -1,38 +1,35 @@
 # this test creates a simple GNU image with docker tools and sees if it executes
+{ pkgs, ... }:
+{
+  name = "docker-tools-overlay";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      lnl7
+      roberth
+    ];
+  };
 
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "docker-tools-overlay";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        lnl7
-        roberth
-      ];
-    };
+  nodes = {
+    docker =
+      { ... }:
+      {
+        virtualisation.docker.enable = true;
+        virtualisation.docker.storageDriver = "overlay2";
+      };
+  };
 
-    nodes = {
-      docker =
-        { ... }:
-        {
-          virtualisation.docker.enable = true;
-          virtualisation.docker.storageDriver = "overlay2";
-        };
-    };
+  testScript = ''
+    docker.wait_for_unit("sockets.target")
 
-    testScript = ''
-      docker.wait_for_unit("sockets.target")
+    docker.succeed(
+        "docker load --input='${pkgs.dockerTools.examples.bash}'",
+        "docker run --rm ${pkgs.dockerTools.examples.bash.imageName} bash --version",
+    )
 
-      docker.succeed(
-          "docker load --input='${pkgs.dockerTools.examples.bash}'",
-          "docker run --rm ${pkgs.dockerTools.examples.bash.imageName} bash --version",
-      )
-
-      # Check if the nix store has correct user permissions depending on what
-      # storage driver is used, incorrectly built images can show up as readonly.
-      # drw-------  3 0 0   3 Apr 14 11:36 /nix
-      # drw------- 99 0 0 100 Apr 14 11:36 /nix/store
-      docker.succeed("docker run --rm -u 1000:1000 ${pkgs.dockerTools.examples.bash.imageName} bash --version")
-    '';
-  }
-)
+    # Check if the nix store has correct user permissions depending on what
+    # storage driver is used, incorrectly built images can show up as readonly.
+    # drw-------  3 0 0   3 Apr 14 11:36 /nix
+    # drw------- 99 0 0 100 Apr 14 11:36 /nix/store
+    docker.succeed("docker run --rm -u 1000:1000 ${pkgs.dockerTools.examples.bash.imageName} bash --version")
+  '';
+}
diff --git a/nixos/tests/docker.nix b/nixos/tests/docker.nix
index b7c4b2690573..eb92d6e21b91 100644
--- a/nixos/tests/docker.nix
+++ b/nixos/tests/docker.nix
@@ -1,59 +1,56 @@
 # This test runs docker and checks if simple container starts
+{ pkgs, ... }:
+{
+  name = "docker";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      nequissimus
+      offline
+    ];
+  };
 
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "docker";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        nequissimus
-        offline
-      ];
-    };
+  nodes = {
+    docker =
+      { pkgs, ... }:
+      {
+        virtualisation.docker.enable = true;
+        virtualisation.docker.autoPrune.enable = true;
+        virtualisation.docker.package = pkgs.docker;
 
-    nodes = {
-      docker =
-        { pkgs, ... }:
-        {
-          virtualisation.docker.enable = true;
-          virtualisation.docker.autoPrune.enable = true;
-          virtualisation.docker.package = pkgs.docker;
+        users.users = {
+          noprivs = {
+            isNormalUser = true;
+            description = "Can't access the docker daemon";
+            password = "foobar";
+          };
 
-          users.users = {
-            noprivs = {
-              isNormalUser = true;
-              description = "Can't access the docker daemon";
-              password = "foobar";
-            };
-
-            hasprivs = {
-              isNormalUser = true;
-              description = "Can access the docker daemon";
-              password = "foobar";
-              extraGroups = [ "docker" ];
-            };
+          hasprivs = {
+            isNormalUser = true;
+            description = "Can access the docker daemon";
+            password = "foobar";
+            extraGroups = [ "docker" ];
           };
         };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
+  testScript = ''
+    start_all()
 
-      docker.wait_for_unit("sockets.target")
-      docker.succeed("tar cv --files-from /dev/null | docker import - scratchimg")
-      docker.succeed(
-          "docker run -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
-      )
-      docker.succeed("docker ps | grep sleeping")
-      docker.succeed("sudo -u hasprivs docker ps")
-      docker.fail("sudo -u noprivs docker ps")
-      docker.succeed("docker stop sleeping")
+    docker.wait_for_unit("sockets.target")
+    docker.succeed("tar cv --files-from /dev/null | docker import - scratchimg")
+    docker.succeed(
+        "docker run -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg /bin/sleep 10"
+    )
+    docker.succeed("docker ps | grep sleeping")
+    docker.succeed("sudo -u hasprivs docker ps")
+    docker.fail("sudo -u noprivs docker ps")
+    docker.succeed("docker stop sleeping")
 
-      # Must match version 4 times to ensure client and server git commits and versions are correct
-      docker.succeed('[ $(docker version | grep ${pkgs.docker.version} | wc -l) = "4" ]')
-      docker.succeed("systemctl restart systemd-sysctl")
-      docker.succeed("grep 1 /proc/sys/net/ipv4/conf/all/forwarding")
-      docker.succeed("grep 1 /proc/sys/net/ipv4/conf/default/forwarding")
-    '';
-  }
-)
+    # Must match version 4 times to ensure client and server git commits and versions are correct
+    docker.succeed('[ $(docker version | grep ${pkgs.docker.version} | wc -l) = "4" ]')
+    docker.succeed("systemctl restart systemd-sysctl")
+    docker.succeed("grep 1 /proc/sys/net/ipv4/conf/all/forwarding")
+    docker.succeed("grep 1 /proc/sys/net/ipv4/conf/default/forwarding")
+  '';
+}
diff --git a/nixos/tests/grafana-agent.nix b/nixos/tests/grafana-agent.nix
deleted file mode 100644
index 05e3764583f3..000000000000
--- a/nixos/tests/grafana-agent.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-
-  let
-    nodes = {
-      machine = {
-        services.grafana-agent = {
-          enable = true;
-        };
-      };
-    };
-  in
-  {
-    name = "grafana-agent";
-
-    meta = with lib.maintainers; {
-      maintainers = [ zimbatm ];
-    };
-
-    inherit nodes;
-
-    testScript = ''
-      start_all()
-
-      with subtest("Grafana-agent is running"):
-          machine.wait_for_unit("grafana-agent.service")
-          machine.wait_for_open_port(12345)
-          machine.succeed(
-              "curl -sSfN http://127.0.0.1:12345/-/healthy"
-          )
-          machine.shutdown()
-    '';
-  }
-)
diff --git a/nixos/tests/grocy.nix b/nixos/tests/grocy.nix
index 3031ed15c743..cd675b16de0e 100644
--- a/nixos/tests/grocy.nix
+++ b/nixos/tests/grocy.nix
@@ -1,81 +1,79 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "grocy";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ ma27 ];
+{ pkgs, ... }:
+{
+  name = "grocy";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ma27 ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.grocy = {
+        enable = true;
+        hostName = "localhost";
+        nginx.enableSSL = false;
+      };
+      environment.systemPackages = [ pkgs.jq ];
     };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.grocy = {
-          enable = true;
-          hostName = "localhost";
-          nginx.enableSSL = false;
-        };
-        environment.systemPackages = [ pkgs.jq ];
-      };
+  testScript = ''
+    from base64 import b64encode
+    from urllib.parse import quote
 
-    testScript = ''
-      from base64 import b64encode
-      from urllib.parse import quote
+    machine.start()
+    machine.wait_for_open_port(80)
+    machine.wait_for_unit("multi-user.target")
 
-      machine.start()
-      machine.wait_for_open_port(80)
-      machine.wait_for_unit("multi-user.target")
+    # This establishes _something_
+    machine.succeed("curl -sSf http://localhost")
+    # The second request creates the database, unsure why both are required
+    machine.succeed("curl -sSf http://localhost/")
 
-      # This establishes _something_
-      machine.succeed("curl -sSf http://localhost")
-      # The second request creates the database, unsure why both are required
-      machine.succeed("curl -sSf http://localhost/")
+    machine.succeed(
+        "curl -c cookies -sSf -X POST http://localhost/login -d 'username=admin&password=admin'"
+    )
 
-      machine.succeed(
-          "curl -c cookies -sSf -X POST http://localhost/login -d 'username=admin&password=admin'"
-      )
+    cookie = machine.succeed(
+        "grep -v '^#' cookies | awk '{ print $7 }' | sed -e '/^$/d' | perl -pe 'chomp'"
+    )
 
-      cookie = machine.succeed(
-          "grep -v '^#' cookies | awk '{ print $7 }' | sed -e '/^$/d' | perl -pe 'chomp'"
-      )
+    machine.succeed(
+        f"curl -sSf -X POST http://localhost/api/objects/tasks -b 'grocy_session={cookie}' "
+        + '-d \'{"assigned_to_user_id":1,"name":"Test Task","due_date":"1970-01-01"}\'''
+        + " --header 'Content-Type: application/json'"
+    )
 
-      machine.succeed(
-          f"curl -sSf -X POST http://localhost/api/objects/tasks -b 'grocy_session={cookie}' "
-          + '-d \'{"assigned_to_user_id":1,"name":"Test Task","due_date":"1970-01-01"}\'''
-          + " --header 'Content-Type: application/json'"
-      )
+    task_name = machine.succeed(
+        f"curl -sSf http://localhost/api/tasks -b 'grocy_session={cookie}' --header 'Accept: application/json' | jq '.[].name' | xargs echo | perl -pe 'chomp'"
+    )
 
-      task_name = machine.succeed(
-          f"curl -sSf http://localhost/api/tasks -b 'grocy_session={cookie}' --header 'Accept: application/json' | jq '.[].name' | xargs echo | perl -pe 'chomp'"
-      )
+    assert task_name == "Test Task"
 
-      assert task_name == "Test Task"
+    machine.succeed("curl -sSI http://localhost/api/tasks 2>&1 | grep '401 Unauthorized'")
 
-      machine.succeed("curl -sSI http://localhost/api/tasks 2>&1 | grep '401 Unauthorized'")
+    file_name = "test.txt"
+    file_name_base64 = b64encode(file_name.encode('ascii')).decode('ascii')
+    file_name_base64_urlencode = quote(file_name_base64)
 
-      file_name = "test.txt"
-      file_name_base64 = b64encode(file_name.encode('ascii')).decode('ascii')
-      file_name_base64_urlencode = quote(file_name_base64)
+    machine.succeed(
+        f"echo Sample equipment manual > /tmp/{file_name}"
+    )
 
-      machine.succeed(
-          f"echo Sample equipment manual > /tmp/{file_name}"
-      )
+    machine.succeed(
+        f"curl -sSf -X 'PUT' -b 'grocy_session={cookie}' "
+        + f" 'http://localhost/api/files/equipmentmanuals/{file_name_base64_urlencode}' "
+        + "  --header 'Accept: */*' "
+        + "  --header 'Content-Type: application/octet-stream' "
+        + f" --data-binary '@/tmp/{file_name}' "
+    )
 
-      machine.succeed(
-          f"curl -sSf -X 'PUT' -b 'grocy_session={cookie}' "
-          + f" 'http://localhost/api/files/equipmentmanuals/{file_name_base64_urlencode}' "
-          + "  --header 'Accept: */*' "
-          + "  --header 'Content-Type: application/octet-stream' "
-          + f" --data-binary '@/tmp/{file_name}' "
-      )
+    machine.succeed(
+        f"curl -sSf -X 'GET' -b 'grocy_session={cookie}' "
+        + f" 'http://localhost/api/files/equipmentmanuals/{file_name_base64_urlencode}' "
+        + "  --header 'Accept: application/octet-stream' "
+        + f" | cmp /tmp/{file_name}"
+    )
 
-      machine.succeed(
-          f"curl -sSf -X 'GET' -b 'grocy_session={cookie}' "
-          + f" 'http://localhost/api/files/equipmentmanuals/{file_name_base64_urlencode}' "
-          + "  --header 'Accept: application/octet-stream' "
-          + f" | cmp /tmp/{file_name}"
-      )
-
-      machine.shutdown()
-    '';
-  }
-)
+    machine.shutdown()
+  '';
+}
diff --git a/nixos/tests/hydra/common.nix b/nixos/tests/hydra/common.nix
index 0e58e49b1bcd..c4d618ca3bca 100644
--- a/nixos/tests/hydra/common.nix
+++ b/nixos/tests/hydra/common.nix
@@ -1,4 +1,3 @@
-{ system, ... }:
 {
   baseConfig =
     { pkgs, ... }:
@@ -6,7 +5,7 @@
       trivialJob = pkgs.writeTextDir "trivial.nix" ''
         { trivial = builtins.derivation {
             name = "trivial";
-            system = "${system}";
+            system = "${pkgs.stdenv.hostPlatform.system}";
             builder = "/bin/sh";
             allowSubstitutes = false;
             preferLocalBuild = true;
diff --git a/nixos/tests/hydra/default.nix b/nixos/tests/hydra/default.nix
index 4016f8819539..6fbce3b4f826 100644
--- a/nixos/tests/hydra/default.nix
+++ b/nixos/tests/hydra/default.nix
@@ -1,65 +1,44 @@
-{
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../../.. { inherit system config; },
-}:
-
-with import ../../lib/testing-python.nix { inherit system pkgs; };
-with pkgs.lib;
-
+{ pkgs, ... }:
 let
-
-  inherit (import ./common.nix { inherit system; }) baseConfig;
-
-  hydraPkgs = {
-    inherit (pkgs) hydra;
+  inherit (import ./common.nix) baseConfig;
+in
+{
+  name = "hydra";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ lewo ];
   };
 
-  makeHydraTest =
-    with pkgs.lib;
-    name: package:
-    makeTest {
-      name = "hydra-${name}";
-      meta = with pkgs.lib.maintainers; {
-        maintainers = [ lewo ];
-      };
-
-      nodes.machine =
-        { pkgs, lib, ... }:
-        {
-          imports = [ baseConfig ];
-          services.hydra = { inherit package; };
-        };
-
-      testScript = ''
-        # let the system boot up
-        machine.wait_for_unit("multi-user.target")
-        # test whether the database is running
-        machine.wait_for_unit("postgresql.service")
-        # test whether the actual hydra daemons are running
-        machine.wait_for_unit("hydra-init.service")
-        machine.require_unit_state("hydra-queue-runner.service")
-        machine.require_unit_state("hydra-evaluator.service")
-        machine.require_unit_state("hydra-notify.service")
-
-        machine.succeed("hydra-create-user admin --role admin --password admin")
-
-        # create a project with a trivial job
-        machine.wait_for_open_port(3000)
-
-        # make sure the build as been successfully built
-        machine.succeed("create-trivial-project.sh")
-
-        machine.wait_until_succeeds(
-            'curl -L -s http://localhost:3000/build/1 -H "Accept: application/json" |  jq .buildstatus | xargs test 0 -eq'
-        )
-
-        machine.wait_until_succeeds(
-            'journalctl -eu hydra-notify.service -o cat | grep -q "sending mail notification to hydra@localhost"'
-        )
-      '';
+  nodes.machine =
+    { pkgs, lib, ... }:
+    {
+      imports = [ baseConfig ];
     };
 
-in
+  testScript = ''
+    # let the system boot up
+    machine.wait_for_unit("multi-user.target")
+    # test whether the database is running
+    machine.wait_for_unit("postgresql.service")
+    # test whether the actual hydra daemons are running
+    machine.wait_for_unit("hydra-init.service")
+    machine.require_unit_state("hydra-queue-runner.service")
+    machine.require_unit_state("hydra-evaluator.service")
+    machine.require_unit_state("hydra-notify.service")
 
-mapAttrs makeHydraTest hydraPkgs
+    machine.succeed("hydra-create-user admin --role admin --password admin")
+
+    # create a project with a trivial job
+    machine.wait_for_open_port(3000)
+
+    # make sure the build as been successfully built
+    machine.succeed("create-trivial-project.sh")
+
+    machine.wait_until_succeeds(
+        'curl -L -s http://localhost:3000/build/1 -H "Accept: application/json" |  jq .buildstatus | xargs test 0 -eq'
+    )
+
+    machine.wait_until_succeeds(
+        'journalctl -eu hydra-notify.service -o cat | grep -q "sending mail notification to hydra@localhost"'
+    )
+  '';
+}
diff --git a/nixos/tests/ocis.nix b/nixos/tests/ocis.nix
index 35461e246749..a529b4385663 100644
--- a/nixos/tests/ocis.nix
+++ b/nixos/tests/ocis.nix
@@ -205,7 +205,7 @@ import ./make-test-python.nix (
       machine.sleep(5)
 
       with subtest("ocis bin works"):
-          machine.succeed("${lib.getExe pkgs.ocis-bin} version")
+          machine.succeed("${lib.getExe pkgs.ocis_5-bin} version")
 
       with subtest("use the web interface to log in with a demo user"):
           machine.succeed("PYTHONUNBUFFERED=1 systemd-cat -t test-runner test-runner ${demoUser} ${demoPassword}")
diff --git a/pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix b/pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix
index ebbfff043084..78964d9849df 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix
@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "vscode-pylance";
     publisher = "MS-python";
-    version = "2025.3.2";
-    hash = "sha256-Lv4HiFsYszThuGp6YyTWUqgi2o0+aiMGnsiBxu3vQWk=";
+    version = "2025.4.1";
+    hash = "sha256-XZ00HOH+7onP1li6nBwjBIRc1Zy5SNvrT1JhnzJTr1E=";
   };
 
   buildInputs = [ pyright ];
diff --git a/pkgs/applications/misc/1password-gui/sources.json b/pkgs/applications/misc/1password-gui/sources.json
index 18c27f4d62fe..f0dca4321f30 100644
--- a/pkgs/applications/misc/1password-gui/sources.json
+++ b/pkgs/applications/misc/1password-gui/sources.json
@@ -1,38 +1,38 @@
 {
   "stable": {
     "x86_64-linux": {
-      "url": "https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.10.68.x64.tar.gz",
-      "hash": "sha256-6MekdtKnjvrP0dai6VfBEFJ+oKf2WvPp+sU/kVIzCTw="
+      "url": "https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.10.70.x64.tar.gz",
+      "hash": "sha256-QGKeKX7qxu7heJ6T0I8aayI1P2M3KOmU9faS929BCjI="
     },
     "aarch64-linux": {
-      "url": "https://downloads.1password.com/linux/tar/stable/aarch64/1password-8.10.68.arm64.tar.gz",
-      "hash": "sha256-2SpfkLu/4K1t2ILwOBMVAXeW7rbEzsjofn8naM1Szfc="
+      "url": "https://downloads.1password.com/linux/tar/stable/aarch64/1password-8.10.70.arm64.tar.gz",
+      "hash": "sha256-Uz8YKlIa6zibRv3ObnVVlyEk3sZP5wX+0E/nX02m6SA="
     },
     "x86_64-darwin": {
-      "url": "https://downloads.1password.com/mac/1Password-8.10.68-x86_64.zip",
-      "hash": "sha256-t/glPvEGJH+IcYyrnW0fMSEeLB8mKqGqmZ8wnVFCJpo="
+      "url": "https://downloads.1password.com/mac/1Password-8.10.70-x86_64.zip",
+      "hash": "sha256-s6+LUSHZwCH5PgREt2bkCCR3JeGBj9llQ6rGrOhEPlQ="
     },
     "aarch64-darwin": {
-      "url": "https://downloads.1password.com/mac/1Password-8.10.68-aarch64.zip",
-      "hash": "sha256-bhmuy8gUVCv+hYSIpYXgm8a0f1+JtyKb4g5cUIJCb28="
+      "url": "https://downloads.1password.com/mac/1Password-8.10.70-aarch64.zip",
+      "hash": "sha256-f9b8L4S6CToMukeqrW3EKXAov0rqEMsIpZEGrvDQmg8="
     }
   },
   "beta": {
     "x86_64-linux": {
-      "url": "https://downloads.1password.com/linux/tar/beta/x86_64/1password-8.10.68-12.BETA.x64.tar.gz",
-      "hash": "sha256-/0Y1qnCI/gXGKTHk9EIaUVbHTwRkOvwOOiMif6sRkqw="
+      "url": "https://downloads.1password.com/linux/tar/beta/x86_64/1password-8.10.70-24.BETA.x64.tar.gz",
+      "hash": "sha256-XNub6kGh2QH2WQKh0Hj6IBVQENfe5YIaOtRV+pkuioc="
     },
     "aarch64-linux": {
-      "url": "https://downloads.1password.com/linux/tar/beta/aarch64/1password-8.10.68-12.BETA.arm64.tar.gz",
-      "hash": "sha256-4J6a10r5n8ffqC5Y2pjO/GJLXY5AQDkQWmFNLYeK/Xw="
+      "url": "https://downloads.1password.com/linux/tar/beta/aarch64/1password-8.10.70-24.BETA.arm64.tar.gz",
+      "hash": "sha256-wqpSPCGFiDioIzhUyVCEBfRval13mu0dMSs4oIt+RIU="
     },
     "x86_64-darwin": {
-      "url": "https://downloads.1password.com/mac/1Password-8.10.68-12.BETA-x86_64.zip",
-      "hash": "sha256-XvflRqqUI59ekuSiQXyACzS94VIrl8wJjemi0xAznZU="
+      "url": "https://downloads.1password.com/mac/1Password-8.10.70-24.BETA-x86_64.zip",
+      "hash": "sha256-jzjXVh9iTua0/0N3lP4xIPVd1hDlsWssbTtDvvzoTZk="
     },
     "aarch64-darwin": {
-      "url": "https://downloads.1password.com/mac/1Password-8.10.68-12.BETA-aarch64.zip",
-      "hash": "sha256-UErp3pcSXz/C5s3JraLoBN89tL8ghgJ3XLpg7KtU8Sc="
+      "url": "https://downloads.1password.com/mac/1Password-8.10.70-24.BETA-aarch64.zip",
+      "hash": "sha256-qb1j9VMhI+tf643HCOz+5dhTuFAgd1ICv8lvRC+um+I="
     }
   }
 }
diff --git a/pkgs/applications/misc/1password-gui/versions.json b/pkgs/applications/misc/1password-gui/versions.json
index 95dfd6b9078d..3314aea3f031 100644
--- a/pkgs/applications/misc/1password-gui/versions.json
+++ b/pkgs/applications/misc/1password-gui/versions.json
@@ -1,6 +1,6 @@
 {
-  "stable-linux": "8.10.68",
-  "stable-darwin": "8.10.68",
-  "beta-linux":"8.10.68-12.BETA",
-  "beta-darwin": "8.10.68-12.BETA"
+  "stable-linux": "8.10.70",
+  "stable-darwin": "8.10.70",
+  "beta-linux":"8.10.70-24.BETA",
+  "beta-darwin": "8.10.70-24.BETA"
 }
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
index db07fa616186..850fa78f80ba 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
@@ -10,13 +10,13 @@
 buildMozillaMach rec {
   pname = "firefox-devedition";
   binaryName = pname;
-  version = "137.0b8";
+  version = "137.0b10";
   applicationName = "Firefox Developer Edition";
   requireSigning = false;
   branding = "browser/branding/aurora";
   src = fetchurl {
     url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "d978dbbe5215fe0787ca571d9676c9572917e88f347ea46e4656d8e0a849e11d3e8c7c918e159a0eaea41bf480897e91fd26776e1dd28c5bfbb37934c44511a1";
+    sha512 = "ece2e76830b7f3fa0ea3b077948a874315c225da03f9043a5e63900f251aa7f568278aeae5c9b5be89bf07c2d783fbdfd1f2acf37e6dd7db3d82cb7e925e33d6";
   };
 
   meta = {
diff --git a/pkgs/applications/networking/browsers/librewolf/src.json b/pkgs/applications/networking/browsers/librewolf/src.json
index 7c0bf123fb9c..510aab612186 100644
--- a/pkgs/applications/networking/browsers/librewolf/src.json
+++ b/pkgs/applications/networking/browsers/librewolf/src.json
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "137.0-1",
+  "packageVersion": "136.0.4-1",
   "source": {
-    "rev": "137.0-1",
-    "hash": "sha256-xynkPKn4JDLVdDEYjmBvEKIHoW83Xackpx/+rnXci5g="
+    "rev": "136.0.4-1",
+    "hash": "sha256-ymW9vj4CariMaswrMQRKYEvTofFRjc50gF9EmTuhsRA="
   },
   "firefox": {
-    "version": "137.0",
-    "hash": "sha512-gaLAzBT/wuSeSTeebCq1bPtuE7ZmZqZPOr/0SkO7Ln3BcnTTJdHCCvBi1Av/gGPXiNSy+TGnpkbbiwcgTKa0gQ=="
+    "version": "136.0.4",
+    "hash": "sha512-wiUqpi0BXO1lNMsqwHH2gImZe0ZpAIPMHv9LrTBq5shlQ3Ge0tNfb5c790Rn1qBKukYNMJwG3qQl52xyDjROKA=="
   }
 }
diff --git a/pkgs/applications/networking/cluster/roxctl/default.nix b/pkgs/applications/networking/cluster/roxctl/default.nix
index a8f28e59eeec..e10ba0c7e28f 100644
--- a/pkgs/applications/networking/cluster/roxctl/default.nix
+++ b/pkgs/applications/networking/cluster/roxctl/default.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "roxctl";
-  version = "4.7.0";
+  version = "4.7.1";
 
   src = fetchFromGitHub {
     owner = "stackrox";
     repo = "stackrox";
     rev = version;
-    sha256 = "sha256-hi9K1FIMxDJKEyabPNWTwLkZJTm+iAuMfoH3cywVTkI=";
+    sha256 = "sha256-AQaMWpI7kFFotEQa536dqKxuP/mHuzNm75RPqUWw1VY=";
   };
 
-  vendorHash = "sha256-T3A0Sm2eKIO3UcyReFRfpKUgLM15AhSgcGpJbYgmnHA=";
+  vendorHash = "sha256-v2aLKU6FBkJqenWzftKmngeXvQBPR03RPR0WcmOiYD0=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/applications/virtualization/cri-o/default.nix b/pkgs/applications/virtualization/cri-o/default.nix
index 14ba3cc51988..fc57f0cf270d 100644
--- a/pkgs/applications/virtualization/cri-o/default.nix
+++ b/pkgs/applications/virtualization/cri-o/default.nix
@@ -17,13 +17,13 @@
 
 buildGoModule rec {
   pname = "cri-o";
-  version = "1.32.2";
+  version = "1.32.3";
 
   src = fetchFromGitHub {
     owner = "cri-o";
     repo = "cri-o";
     rev = "v${version}";
-    hash = "sha256-oB3X59+v4VosY5Db0BUfKt/WTMCWhhJX+mWwp/6ifVI=";
+    hash = "sha256-EIJT/LwxRZUYvbH0EFYSeZpGgFOywI6jpfmFO3g8cps=";
   };
   vendorHash = null;
 
diff --git a/pkgs/build-support/node/build-npm-package/default.nix b/pkgs/build-support/node/build-npm-package/default.nix
index 685ea9a85038..69181aee399c 100644
--- a/pkgs/build-support/node/build-npm-package/default.nix
+++ b/pkgs/build-support/node/build-npm-package/default.nix
@@ -63,7 +63,6 @@ lib.extendMkDerivation {
           patches
           postPatch
           patchFlags
-          nativeBuildInputs
           ;
         name = "${name}-npm-deps";
         hash = npmDepsHash;
diff --git a/pkgs/build-support/rust/build-rust-package/default.nix b/pkgs/build-support/rust/build-rust-package/default.nix
index 665546481217..2d215a4eb010 100644
--- a/pkgs/build-support/rust/build-rust-package/default.nix
+++ b/pkgs/build-support/rust/build-rust-package/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   importCargoLock,
-  fetchCargoTarball,
   fetchCargoVendor,
   stdenv,
   cargoBuildHook,
@@ -50,7 +49,7 @@ lib.extendMkDerivation {
       cargoDepsHook ? "",
       buildType ? "release",
       meta ? { },
-      useFetchCargoVendor ? false,
+      useFetchCargoVendor ? true,
       cargoDeps ? null,
       cargoLock ? null,
       cargoVendorDir ? null,
@@ -72,6 +71,9 @@ lib.extendMkDerivation {
       ...
     }@args:
 
+    assert lib.assertMsg useFetchCargoVendor
+      "buildRustPackage: `useFetchCargoVendor` is non‐optional and enabled by default as of 25.05";
+
     lib.optionalAttrs (stdenv.hostPlatform.isDarwin && buildType == "debug") {
       RUSTFLAGS = "-C split-debuginfo=packed " + (args.RUSTFLAGS or "");
     }
@@ -85,7 +87,7 @@ lib.extendMkDerivation {
           importCargoLock cargoLock
         else if args.cargoHash or null == null then
           throw "cargoHash, cargoVendorDir, cargoDeps, or cargoLock must be set"
-        else if useFetchCargoVendor then
+        else
           fetchCargoVendor (
             {
               inherit
@@ -102,25 +104,6 @@ lib.extendMkDerivation {
               hash = args.cargoHash;
             }
             // depsExtraArgs
-          )
-        else
-          fetchCargoTarball (
-            {
-              inherit
-                src
-                srcs
-                sourceRoot
-                cargoRoot
-                preUnpack
-                unpackPhase
-                postUnpack
-                cargoUpdateHook
-                ;
-              hash = args.cargoHash;
-              name = cargoDepsName;
-              patches = cargoPatches;
-            }
-            // depsExtraArgs
           );
       inherit buildAndTestSubdir;
 
diff --git a/pkgs/build-support/rust/fetch-cargo-tarball/cargo-vendor-normalise.py b/pkgs/build-support/rust/fetch-cargo-tarball/cargo-vendor-normalise.py
deleted file mode 100755
index 90933b089c92..000000000000
--- a/pkgs/build-support/rust/fetch-cargo-tarball/cargo-vendor-normalise.py
+++ /dev/null
@@ -1,43 +0,0 @@
-#!/usr/bin/env python
-
-import sys
-
-import toml
-
-
-def quote(s: str) -> str:
-    escaped = s.replace('"', r"\"").replace("\n", r"\n").replace("\\", "\\\\")
-    return '"{}"'.format(escaped)
-
-
-def main() -> None:
-    data = toml.load(sys.stdin)
-
-    # There is no dependency to vendor in this project.
-    if not list(data.keys()) == ["source"]:
-        return
-
-    # this value is non deterministic
-    data["source"]["vendored-sources"]["directory"] = "@vendor@"
-
-    lines = []
-    inner = data["source"]
-    for source, attrs in sorted(inner.items()):
-        lines.append("[source.{}]".format(quote(source)))
-        if source == "vendored-sources":
-            lines.append('"directory" = "@vendor@"\n')
-        else:
-            for key, value in sorted(attrs.items()):
-                attr = "{} = {}".format(quote(key), quote(value))
-                lines.append(attr)
-        lines.append("")
-
-    result = "\n".join(lines)
-    real = toml.loads(result)
-    assert real == data, "output = {} while input = {}".format(real, data)
-
-    print(result)
-
-
-if __name__ == "__main__":
-    main()
diff --git a/pkgs/build-support/rust/fetch-cargo-tarball/default.nix b/pkgs/build-support/rust/fetch-cargo-tarball/default.nix
deleted file mode 100644
index c477262968af..000000000000
--- a/pkgs/build-support/rust/fetch-cargo-tarball/default.nix
+++ /dev/null
@@ -1,170 +0,0 @@
-{
-  lib,
-  stdenv,
-  cacert,
-  git,
-  cargo,
-  python3,
-}:
-let
-  cargo-vendor-normalise = stdenv.mkDerivation {
-    name = "cargo-vendor-normalise";
-    src = ./cargo-vendor-normalise.py;
-    nativeBuildInputs = [ python3.pkgs.wrapPython ];
-    dontUnpack = true;
-    installPhase = "install -D $src $out/bin/cargo-vendor-normalise";
-    pythonPath = [ python3.pkgs.toml ];
-    postFixup = "wrapPythonPrograms";
-    doInstallCheck = true;
-    installCheckPhase = ''
-      # check that ../fetchcargo-default-config.toml is a fix point
-      reference=${../fetchcargo-default-config.toml}
-      < $reference $out/bin/cargo-vendor-normalise > test;
-      cmp test $reference
-    '';
-    preferLocalBuild = true;
-  };
-in
-{
-  pname ? null,
-  version ? null,
-  name ? if args ? pname && args ? version then "${pname}-${version}" else "cargo-deps",
-  src ? null,
-  srcs ? [ ],
-  patches ? [ ],
-  sourceRoot ? "",
-  cargoUpdateHook ? "",
-  nativeBuildInputs ? [ ],
-  ...
-}@args:
-
-assert lib.assertMsg (
-  (args ? pname || args ? version) -> !(args ? name)
-) "Either specify `pname` with `version`, or specify `name` only, not a mix of both.";
-assert lib.assertMsg (
-  args ? pname == args ? version
-) "If `pname` is specified, `version` must be also, and vice versa.";
-let
-  # args to remove from the final call to stdenv.mkDerivation, as we've already handled them
-  removedArgs = [
-    "name"
-    "pname"
-    "version"
-    "sha256"
-    "cargoUpdateHook"
-    "nativeBuildInputs"
-  ];
-
-  hash_ =
-    if args ? hash then
-      {
-        outputHashAlgo = if args.hash == "" then "sha256" else null;
-        outputHash = args.hash;
-      }
-    else if args ? sha256 then
-      {
-        outputHashAlgo = "sha256";
-        outputHash = args.sha256;
-      }
-    else
-      throw "fetchCargoTarball requires a hash for ${name}";
-in
-lib.warn
-  ''
-    rustPlatform.fetchCargoTarball is deprecated in favor of rustPlatform.fetchCargoVendor.
-    If you are using buildRustPackage, try setting useFetchCargoVendor = true and regenerating cargoHash.
-    See the 25.05 release notes for more information.
-  ''
-  (
-    stdenv.mkDerivation (
-      {
-        name = "${name}-vendor.tar.gz";
-        nativeBuildInputs = [
-          cacert
-          git
-          cargo-vendor-normalise
-          cargo
-        ] ++ nativeBuildInputs;
-
-        dontConfigure = true;
-        buildPhase = ''
-          runHook preBuild
-
-          # Ensure deterministic Cargo vendor builds
-          export SOURCE_DATE_EPOCH=1
-
-          if [ -n "''${cargoRoot-}" ]; then
-            cd "$cargoRoot"
-          fi
-
-          if [[ ! -f Cargo.lock ]]; then
-              echo
-              echo "ERROR: The Cargo.lock file doesn't exist"
-              echo
-              echo "Cargo.lock is needed to make sure that cargoHash/cargoSha256 doesn't change"
-              echo "when the registry is updated."
-              echo
-
-              exit 1
-          fi
-
-          # Keep the original around for copyLockfile
-          cp Cargo.lock Cargo.lock.orig
-
-          export CARGO_HOME=$(mktemp -d cargo-home.XXX)
-          CARGO_CONFIG=$(mktemp cargo-config.XXXX)
-
-          if [[ -n "$NIX_CRATES_INDEX" ]]; then
-          cat >$CARGO_HOME/config.toml <<EOF
-          [source.crates-io]
-          replace-with = 'mirror'
-          [source.mirror]
-          registry = "$NIX_CRATES_INDEX"
-          EOF
-          fi
-
-          ${cargoUpdateHook}
-
-          # Override the `http.cainfo` option usually specified in `.cargo/config`.
-          export CARGO_HTTP_CAINFO=${cacert}/etc/ssl/certs/ca-bundle.crt
-
-          if grep '^source = "git' Cargo.lock; then
-              echo
-              echo "ERROR: The Cargo.lock contains git dependencies"
-              echo
-              echo "This is not supported in the default fixed-output derivation fetcher."
-              echo "Set \`useFetchCargoVendor = true\` / use fetchCargoVendor"
-              echo "or use cargoLock.lockFile / importCargoLock instead."
-              echo
-
-              exit 1
-          fi
-
-          cargo vendor $name --respect-source-config | cargo-vendor-normalise > $CARGO_CONFIG
-
-          # Create an empty vendor directory when there is no dependency to vendor
-          mkdir -p $name
-          # Add the Cargo.lock to allow hash invalidation
-          cp Cargo.lock.orig $name/Cargo.lock
-
-          # Packages with git dependencies generate non-default cargo configs, so
-          # always install it rather than trying to write a standard default template.
-          install -D $CARGO_CONFIG $name/.cargo/config
-
-          runHook postBuild
-        '';
-
-        # Build a reproducible tar, per instructions at https://reproducible-builds.org/docs/archives/
-        installPhase = ''
-          tar --owner=0 --group=0 --numeric-owner --format=gnu \
-              --sort=name --mtime="@$SOURCE_DATE_EPOCH" \
-              -czf $out $name
-        '';
-
-        inherit (hash_) outputHashAlgo outputHash;
-
-        impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [ "NIX_CRATES_INDEX" ];
-      }
-      // (removeAttrs args removedArgs)
-    )
-  )
diff --git a/pkgs/by-name/ai/aiken/package.nix b/pkgs/by-name/ai/aiken/package.nix
index d3c48e9592ec..a05dead8c537 100644
--- a/pkgs/by-name/ai/aiken/package.nix
+++ b/pkgs/by-name/ai/aiken/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "aiken";
-  version = "1.1.14";
+  version = "1.1.15";
 
   src = fetchFromGitHub {
     owner = "aiken-lang";
     repo = "aiken";
     rev = "v${version}";
-    hash = "sha256-aydujI8yPfUEEonasOT0uFCpLKOXSh/c9iw12kACLuw=";
+    hash = "sha256-zbtsSEWgzhMeRMLb/ocsbz28lYXbSgucnPLVB9z7iwo=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-D7N9liDcthV4YLH+XzG4E1PAcLg9PQlTeGBmUcGOYes=";
+  cargoHash = "sha256-k4gjgeQTZQw0OU1bHJPWskeZ974pTJGaKaIpM5+lZeU=";
 
   buildInputs =
     [ openssl ]
diff --git a/pkgs/by-name/am/amazon-q-cli/package.nix b/pkgs/by-name/am/amazon-q-cli/package.nix
new file mode 100644
index 000000000000..0d7082f3f787
--- /dev/null
+++ b/pkgs/by-name/am/amazon-q-cli/package.nix
@@ -0,0 +1,73 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  protobuf_26,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "amazon-q-cli";
+  version = "1.7.2";
+
+  src = fetchFromGitHub {
+    owner = "aws";
+    repo = "amazon-q-developer-cli";
+    tag = "v${version}";
+    hash = "sha256-uKsj7QBKomkO1xP5VgOGI5W8CHIgPQx4QsS2voghrVc=";
+  };
+
+  useFetchCargoVendor = true;
+
+  cargoHash = "sha256-G99vb+7eomxDy9xFJjKA+KpCH2NUzitAKHZE5b62Db8=";
+
+  cargoBuildFlags = [
+    "-p"
+    "q_cli"
+  ];
+  cargoTestFlags = [
+    "-p"
+    "q_cli"
+  ];
+
+  # skip integration tests that have external dependencies
+  checkFlags = [
+    "--skip=cli::chat::tests::test_flow"
+    "--skip=cli::init::tests::test_prompts"
+    "--skip=debug_get_index"
+    "--skip=debug_list_intellij_variants"
+    "--skip=debug_refresh_auth_token"
+    "--skip=local_state_all"
+    "--skip=local_state_get"
+    "--skip=settings_all"
+    "--skip=settings_get"
+    "--skip=user_whoami"
+    "--skip=init_lint_bash_post_bash_profile"
+    "--skip=init_lint_bash_post_bashrc"
+    "--skip=init_lint_bash_pre_bash_profile"
+    "--skip=init_lint_bash_pre_bashrc"
+    "--skip=init_lint_fish_pre_00_fig_pre"
+    "--skip=init_lint_zsh_post_zprofile"
+    "--skip=init_lint_zsh_post_zshrc"
+    "--skip=init_lint_zsh_pre_zprofile"
+    "--skip=init_lint_zsh_pre_zshrc"
+  ];
+
+  nativeBuildInputs = [
+    protobuf_26
+  ];
+
+  postInstall = ''
+    mv $out/bin/q_cli $out/bin/amazon-q
+  '';
+
+  meta = {
+    description = "Amazon Q Developer AI coding agent CLI";
+    homepage = "https://github.com/aws/amazon-q-developer-cli";
+    license = with lib.licenses; [
+      mit
+      asl20
+    ];
+    maintainers = [ lib.maintainers.jamesward ];
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/an/android-studio-tools/package.nix b/pkgs/by-name/an/android-studio-tools/package.nix
index 699f7405eb34..0cd30e449e93 100644
--- a/pkgs/by-name/an/android-studio-tools/package.nix
+++ b/pkgs/by-name/an/android-studio-tools/package.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "android-studio-tools";
-  version = "11076708";
+  version = "13114758";
 
   src = fetchzip {
     # The only difference between the Linux and Mac versions is a single comment at the top of all the scripts
     # Therefore, we will use the Linux version and just patch the comment
-    url = "https://dl.google.com/android/repository/commandlinetools-linux-11076708_latest.zip";
-    hash = "sha256-NjxJzHRT2/zZ9YzzjqaMVxpOELkDneQgc1/y1GUnZow=";
+    url = "https://dl.google.com/android/repository/commandlinetools-linux-13114758_latest.zip";
+    hash = "sha256-dt8nwjL8wyRfBZOedCPYXh7zyeMUeH0gOPpTcpxCegU=";
   };
 
   postPatch =
diff --git a/pkgs/by-name/an/anytype-heart/package.nix b/pkgs/by-name/an/anytype-heart/package.nix
index 894390f86e33..6b2f2472a473 100644
--- a/pkgs/by-name/an/anytype-heart/package.nix
+++ b/pkgs/by-name/an/anytype-heart/package.nix
@@ -82,7 +82,10 @@ buildGoModule {
     description = "Shared library for Anytype clients";
     homepage = "https://anytype.io/";
     license = lib.licenses.unfreeRedistributable;
-    maintainers = with lib.maintainers; [ autrimpo ];
+    maintainers = with lib.maintainers; [
+      autrimpo
+      adda
+    ];
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
diff --git a/pkgs/by-name/an/anytype/package.nix b/pkgs/by-name/an/anytype/package.nix
index ddfdd44db8b6..21cf65f6c3d0 100644
--- a/pkgs/by-name/an/anytype/package.nix
+++ b/pkgs/by-name/an/anytype/package.nix
@@ -138,6 +138,7 @@ buildNpmPackage {
     maintainers = with lib.maintainers; [
       running-grass
       autrimpo
+      adda
     ];
     platforms = [
       "x86_64-linux"
diff --git a/pkgs/by-name/ap/apache-orc/package.nix b/pkgs/by-name/ap/apache-orc/package.nix
new file mode 100644
index 000000000000..b64b6683c2b1
--- /dev/null
+++ b/pkgs/by-name/ap/apache-orc/package.nix
@@ -0,0 +1,81 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchurl,
+  fetchpatch,
+  cmake,
+  gtest,
+  lz4,
+  protobuf,
+  snappy,
+  zlib,
+  zstd,
+}:
+
+let
+  orc-format = fetchurl {
+    name = "orc-format-1.0.0.tar.gz";
+    url = "https://www.apache.org/dyn/closer.lua/orc/orc-format-1.0.0/orc-format-1.0.0.tar.gz?action=download";
+    hash = "sha256-c5+uX/lLH4ErQTB3KANhBFv5LlEO8Es0phDiOpRdjNU=";
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "apache-orc";
+  version = "2.1.1";
+
+  src = fetchFromGitHub {
+    owner = "apache";
+    repo = "orc";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Ib02mIUQaLEVwIBv5xdKDyX+FeI8vhh9+5hM7miKwHo=";
+  };
+
+  patches = [
+    # Patch that adds 2 missing imports in source files
+    # To be removed this PR land: https://github.com/apache/orc/pull/2175
+    (fetchpatch {
+      url = "https://github.com/apache/orc/commit/fb20db2440226da6b92d38ce260e5b850d2f0092.patch";
+      hash = "sha256-rHGECXJoBPgZ62yZciYdSMq4pGnVt75lxkHyO46IiyQ=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    gtest
+    lz4
+    protobuf
+    snappy
+    zlib
+    zstd
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeFeature "CMAKE_BUILD_TYPE" "Release")
+    (lib.cmakeBool "BUILD_JAVA" false)
+    (lib.cmakeBool "STOP_BUILD_ON_WARNING" true)
+    (lib.cmakeBool "INSTALL_VENDORED_LIBS" false)
+  ];
+
+  env = {
+    GTEST_HOME = gtest.dev;
+    LZ4_ROOT = lz4;
+    ORC_FORMAT_URL = orc-format;
+    PROTOBUF_HOME = protobuf;
+    SNAPPY_ROOT = snappy.dev;
+    ZLIB_ROOT = zlib.dev;
+    ZSTD_ROOT = zstd.dev;
+  };
+
+  meta = {
+    changelog = "https://github.com/apache/orc/releases/tag/v${finalAttrs.version}";
+    description = "The smallest, fastest columnar storage for Hadoop workloads";
+    homepage = "https://github.com/apache/orc/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ drupol ];
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/ar/arc-browser/package.nix b/pkgs/by-name/ar/arc-browser/package.nix
index 5e0e99379f5c..af4c56d640ae 100644
--- a/pkgs/by-name/ar/arc-browser/package.nix
+++ b/pkgs/by-name/ar/arc-browser/package.nix
@@ -10,11 +10,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "arc-browser";
-  version = "1.83.0-59042";
+  version = "1.87.1-60573";
 
   src = fetchurl {
     url = "https://releases.arc.net/release/Arc-${finalAttrs.version}.dmg";
-    hash = "sha256-GJuWBbzp9XuzxCu/dr/28mkrAclwTAAHB9n87Daw0HE=";
+    hash = "sha256-UiB5MQl7hRl6nPu4xiwOdhC40bHYIcpPNtWg98HqCJc=";
   };
 
   nativeBuildInputs = [ undmg ];
diff --git a/pkgs/by-name/bo/boost-sml/package.nix b/pkgs/by-name/bo/boost-sml/package.nix
index 1817a64b5371..901be3c83fb8 100644
--- a/pkgs/by-name/bo/boost-sml/package.nix
+++ b/pkgs/by-name/bo/boost-sml/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "boost-sml";
-  version = "1.1.11";
+  version = "1.1.12";
 
   src = fetchFromGitHub {
     owner = "boost-ext";
     repo = "sml";
     rev = "v${version}";
-    hash = "sha256-/eR/B8rE+mh5zDPjx1kS9nVJf1rCeHP04QDavh6z6fM=";
+    hash = "sha256-IvZwkhZe9pcyJhZdn4VkWMRUN6Ow8qs3zB6JtWb5pKk=";
   };
 
   buildInputs = [ boost ];
diff --git a/pkgs/by-name/ca/cargo-duplicates/package.nix b/pkgs/by-name/ca/cargo-duplicates/package.nix
index 768867254ef3..8ab9656c8c22 100644
--- a/pkgs/by-name/ca/cargo-duplicates/package.nix
+++ b/pkgs/by-name/ca/cargo-duplicates/package.nix
@@ -13,17 +13,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-duplicates";
-  version = "0.7.0";
+  version = "0.8.4";
 
   src = fetchFromGitHub {
     owner = "Keruspe";
     repo = "cargo-duplicates";
     rev = "v${version}";
-    hash = "sha256-VGxBmzMtev+lXGhV9pMefpgX6nPlzMaPbXq5LMdIvrE=";
+    hash = "sha256-JzS1+BHSCEcZM5MokbQsck/AGJ7EeSwbzjNz0uLQsgE=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-F6ZQrK4pKpljIQEei3cvxPPnOSBu9cyoaUzz/aS+yQU=";
+  cargoHash = "sha256-58H6wFToCgW+J7QYXb6W6BiCFUVIG8MmxgZtWnPNkrI=";
 
   nativeBuildInputs = [
     curl
diff --git a/pkgs/by-name/cl/cloudfoundry-cli/package.nix b/pkgs/by-name/cl/cloudfoundry-cli/package.nix
index 39ee1e660ebc..90db90e6abed 100644
--- a/pkgs/by-name/cl/cloudfoundry-cli/package.nix
+++ b/pkgs/by-name/cl/cloudfoundry-cli/package.nix
@@ -8,15 +8,15 @@
 
 buildGoModule rec {
   pname = "cloudfoundry-cli";
-  version = "8.11.0";
+  version = "8.12.0";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-1OJWkhXw/VYerQgaYFgX6mPIAtD3GKDhI+/a8TJS5Yg=";
+    sha256 = "sha256-W9hshsq02AiDVNFYMoIWCei04b7pPTmIP2+fMyLgcDY=";
   };
-  vendorHash = "sha256-c0RThHxnT/OU+sFZlACKoFYmFM1P3XItvF0XiGKBVZ8=";
+  vendorHash = "sha256-6pAcDdCCp64o6VuSSLyLtnLPD5OxSt4o3eUpRhJzXTI=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/co/code-cursor/package.nix b/pkgs/by-name/co/code-cursor/package.nix
index 5432e321fc8e..2af676d2d474 100644
--- a/pkgs/by-name/co/code-cursor/package.nix
+++ b/pkgs/by-name/co/code-cursor/package.nix
@@ -159,7 +159,7 @@ stdenvNoCC.mkDerivation {
       rsync -a -q ${appimageContents}/usr/share $out/ --exclude "*.so"
 
       # Fix the desktop file to point to the correct location
-      substituteInPlace $out/share/applications/cursor.desktop --replace-fail "/usr/share/cursor/cursor" "$out/share/cursor/cursor"
+      substituteInPlace $out/share/applications/cursor.desktop --replace-fail "/usr/share/cursor/cursor" "$out/bin/cursor"
 
       wrapProgram $out/bin/cursor \
         --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}} --no-update"
@@ -196,13 +196,7 @@ stdenvNoCC.mkDerivation {
       sarahec
       aspauldingcode
     ];
-    platforms = [
-      "x86_64-linux"
-      "x86_64-darwin"
-      "aarch64-darwin"
-    ];
-    # Temporary: Cursor doesn't supply a 0.47.8 build for aarch64-linux
-    badPlatforms = [ "aarch64-linux" ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
     mainProgram = "cursor";
   };
 }
diff --git a/pkgs/by-name/cr/criu/package.nix b/pkgs/by-name/cr/criu/package.nix
index ea0478428dcc..728a1ad28939 100644
--- a/pkgs/by-name/cr/criu/package.nix
+++ b/pkgs/by-name/cr/criu/package.nix
@@ -11,6 +11,7 @@
   libpaper,
   libnl,
   libcap,
+  libuuid,
   libnet,
   pkg-config,
   iproute2,
@@ -28,13 +29,13 @@
 
 stdenv.mkDerivation rec {
   pname = "criu";
-  version = "4.0";
+  version = "4.1";
 
   src = fetchFromGitHub {
     owner = "checkpoint-restore";
     repo = "criu";
     rev = "v${version}";
-    hash = "sha256-D16s6pGWHWRLvub7foG3Vbzw2hoU4p1VeHt7ymL5hlw=";
+    hash = "sha256-Z4prbaPYRdN/fPdBwDz7D3/gKybh2ulA3UM1LZGeAK0=";
   };
 
   enableParallelBuilding = true;
@@ -47,6 +48,7 @@ stdenv.mkDerivation rec {
     asciidoc
     xmlto
     libpaper
+    libuuid
     docbook_xsl
     which
     makeWrapper
diff --git a/pkgs/by-name/di/displaycal/package.nix b/pkgs/by-name/di/displaycal/package.nix
index f476067fa427..260990326c3b 100644
--- a/pkgs/by-name/di/displaycal/package.nix
+++ b/pkgs/by-name/di/displaycal/package.nix
@@ -11,13 +11,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "displaycal";
-  version = "3.9.14";
+  version = "3.9.15";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "DisplayCAL";
     inherit version;
-    hash = "sha256-2I5fiWgS9n7IY/ZayWBvEaP0uNIAXfvkyqQe2vLFPJw=";
+    hash = "sha256-VX3xQQn8FKcrqyx1RpGste2QmATgTh6cCowAmtnpbeM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/dr/dri-pkgconfig-stub/package.nix b/pkgs/by-name/dr/dri-pkgconfig-stub/package.nix
index 9b5b5265882a..74afbaba49ec 100644
--- a/pkgs/by-name/dr/dri-pkgconfig-stub/package.nix
+++ b/pkgs/by-name/dr/dri-pkgconfig-stub/package.nix
@@ -6,11 +6,13 @@
 writeTextFile {
   name = "dri-pkgconfig-stub";
 
+  # Version intentionally hardcoded to avoid rebuilds on Mesa updates.
+  # If anything ever requires a newer version, this can simply be bumped manually.
   text = ''
     dridriverdir=${mesa.driverLink}/lib/dri
 
     Name: dri
-    Version: ${mesa.version}
+    Version: 25.0
     Description: Nixpkgs graphics driver path stub
   '';
 
diff --git a/pkgs/by-name/et/etterna/package.nix b/pkgs/by-name/et/etterna/package.nix
index 7221ced0f88d..dff72cd5b51a 100644
--- a/pkgs/by-name/et/etterna/package.nix
+++ b/pkgs/by-name/et/etterna/package.nix
@@ -18,13 +18,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "etterna";
-  version = "0.74.3";
+  version = "0.74.4";
 
   src = fetchFromGitHub {
     owner = "etternagame";
     repo = "etterna";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zzCk6axISswfTAk7rRha5HFzIHQ0AjpAZyAWzH+Cn1s=";
+    hash = "sha256-ZCQt99Qcov/7jGfrSmX9WftaP2U2B1d1APK1mxrUDBs=";
   };
 
   patches = [ ./fix-download-manager.patch ];
diff --git a/pkgs/by-name/gd/gdevelop/package.nix b/pkgs/by-name/gd/gdevelop/package.nix
index 08b4444c0ba6..2fae7140e3ba 100644
--- a/pkgs/by-name/gd/gdevelop/package.nix
+++ b/pkgs/by-name/gd/gdevelop/package.nix
@@ -5,14 +5,14 @@
   appimageTools,
 }:
 let
-  version = "5.5.226";
+  version = "5.5.228";
   pname = "gdevelop";
 
   src =
     if stdenv.hostPlatform.system == "x86_64-linux" then
       fetchurl {
         url = "https://github.com/4ian/GDevelop/releases/download/v${version}/GDevelop-5-${version}.AppImage";
-        sha256 = "sha256-58P/9QZOpk327gPM/gDLSchmuXpOR5kBf7U8xksFWUQ=";
+        sha256 = "sha256-f6WCyCcMg+QhpFy9Xu4ac7pZ0aLwEe1GVJfsiVOLW0g=";
       }
     else
       throw "${pname}-${version} is not supported on ${stdenv.hostPlatform.system}";
diff --git a/pkgs/by-name/gf/gfold/package.nix b/pkgs/by-name/gf/gfold/package.nix
index 47387cbef479..9bd3a11726e9 100644
--- a/pkgs/by-name/gf/gfold/package.nix
+++ b/pkgs/by-name/gf/gfold/package.nix
@@ -8,7 +8,7 @@
 
 let
   pname = "gfold";
-  version = "2025.2.1";
+  version = "2025.4.0";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -17,11 +17,11 @@ rustPlatform.buildRustPackage {
     owner = "nickgerace";
     repo = pname;
     rev = version;
-    hash = "sha256-WgSFLAhPJe7U4ovanqqxYArmPHmN+JRcVHjXYATV+wQ=";
+    hash = "sha256-7PnqhS80Ozh5ZQNQ8iYgCiFT0JDLzhA09NV1HgrCOww=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-zU6ixAlac5TKTVm4vc1qVDYtHVoNDildJpi+RrBwV9Y=";
+  cargoHash = "sha256-nGHJ96jFqG1pe3WUILPzm52HxrZYde2Z1p8N4DTaxlw=";
 
   passthru.tests.version = testers.testVersion {
     package = gfold;
diff --git a/pkgs/by-name/gp/gpt-cli/package.nix b/pkgs/by-name/gp/gpt-cli/package.nix
index 05612d02cba4..a72d1a21172c 100644
--- a/pkgs/by-name/gp/gpt-cli/package.nix
+++ b/pkgs/by-name/gp/gpt-cli/package.nix
@@ -6,14 +6,14 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "gpt-cli";
-  version = "0.4.0";
+  version = "0.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kharvd";
     repo = "gpt-cli";
     tag = "v${version}";
-    hash = "sha256-VUDkY0r1/2kSJ0afEIsuWg6JSZpKPVuRgUcmoucWBps=";
+    hash = "sha256-G8iepcjZFMTwsMhtGYmVOK9NkHXLqLet5SJWDAx1usg=";
   };
 
   build-system = with python3Packages; [
@@ -52,7 +52,7 @@ python3Packages.buildPythonApplication rec {
   meta = {
     description = "Command-line interface for ChatGPT, Claude and Bard";
     homepage = "https://github.com/kharvd/gpt-cli";
-    changelog = "https://github.com/kharvd/gpt-cli/releases/tag/v${version}";
+    changelog = "https://github.com/kharvd/gpt-cli/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ _404wolf ];
     mainProgram = "gpt";
diff --git a/pkgs/by-name/gr/grafana-agent/package.nix b/pkgs/by-name/gr/grafana-agent/package.nix
deleted file mode 100644
index ee5b17b77cd3..000000000000
--- a/pkgs/by-name/gr/grafana-agent/package.nix
+++ /dev/null
@@ -1,136 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  fetchFromGitHub,
-  fetchYarnDeps,
-  fixup-yarn-lock,
-  grafana-agent,
-  nix-update-script,
-  nixosTests,
-  nodejs,
-  stdenv,
-  systemd,
-  testers,
-  yarn,
-}:
-
-buildGoModule rec {
-  pname = "grafana-agent";
-  version = "0.44.2";
-
-  src = fetchFromGitHub {
-    owner = "grafana";
-    repo = "agent";
-    tag = "v${version}";
-    hash = "sha256-dAfiTJ0DlChriYOl/bPCEHj/UpbZ2a8BZBCQ82H+O9I=";
-  };
-
-  vendorHash = "sha256-6nXUeRpaezzfRykqMCtwP0FQZchRdxLmtupVAMNAjmY=";
-  proxyVendor = true; # darwin/linux hash mismatch
-
-  frontendYarnOfflineCache = fetchYarnDeps {
-    yarnLock = src + "/internal/web/ui/yarn.lock";
-    hash = "sha256-uqKOGSEnR9CU4vlahldrLxDb3z7Yt1DebyRB91NQMRc=";
-  };
-
-  ldflags =
-    let
-      prefix = "github.com/grafana/agent/internal/build";
-    in
-    [
-      "-s"
-      "-w"
-      # https://github.com/grafana/agent/blob/v0.44.2/Makefile#L132-L137
-      "-X ${prefix}.Version=${version}"
-      "-X ${prefix}.Branch=v${version}"
-      "-X ${prefix}.Revision=v${version}"
-      "-X ${prefix}.BuildUser=nix"
-      "-X ${prefix}.BuildDate=1980-01-01T00:00:00Z"
-    ];
-
-  nativeBuildInputs = [
-    fixup-yarn-lock
-    nodejs
-    yarn
-  ];
-
-  tags = [
-    "builtinassets"
-    "nonetwork"
-    "nodocker"
-    "promtail_journal_enabled"
-  ];
-
-  subPackages = [
-    "cmd/grafana-agent"
-    "cmd/grafana-agentctl"
-    "internal/web/ui"
-  ];
-
-  preBuild = ''
-    export HOME="$TMPDIR"
-
-    pushd internal/web/ui
-    fixup-yarn-lock yarn.lock
-    yarn config --offline set yarn-offline-mirror $frontendYarnOfflineCache
-    yarn install --offline --frozen-lockfile --ignore-platform --ignore-scripts --no-progress --non-interactive
-    patchShebangs node_modules
-    yarn --offline run build
-    popd
-  '';
-
-  # do not pass preBuild to go-modules.drv, as it would otherwise fail to build.
-  # but even if it would work, it simply isn't needed in that scope.
-  overrideModAttrs = (
-    _: {
-      preBuild = null;
-    }
-  );
-
-  # uses go-systemd, which uses libsystemd headers
-  # https://github.com/coreos/go-systemd/issues/351
-  env.NIX_CFLAGS_COMPILE = toString (
-    lib.optionals stdenv.hostPlatform.isLinux [ "-I${lib.getDev systemd}/include" ]
-  );
-
-  # go-systemd uses libsystemd under the hood, which does dlopen(libsystemd) at
-  # runtime.
-  # Add to RUNPATH so it can be found.
-  postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
-    patchelf \
-      --set-rpath "${
-        lib.makeLibraryPath [ (lib.getLib systemd) ]
-      }:$(patchelf --print-rpath $out/bin/grafana-agent)" \
-      $out/bin/grafana-agent
-  '';
-
-  passthru = {
-    tests = {
-      inherit (nixosTests) grafana-agent;
-      version = testers.testVersion {
-        inherit version;
-        command = "${lib.getExe grafana-agent} --version";
-        package = grafana-agent;
-      };
-    };
-    updateScript = nix-update-script { };
-    # alias for nix-update to be able to find and update this attribute
-    offlineCache = frontendYarnOfflineCache;
-  };
-
-  meta = {
-    description = "Lightweight subset of Prometheus and more, optimized for Grafana Cloud";
-    license = lib.licenses.asl20;
-    homepage = "https://grafana.com/products/cloud";
-    changelog = "https://github.com/grafana/agent/blob/${src.rev}/CHANGELOG.md";
-    maintainers = with lib.maintainers; [
-      flokli
-      emilylange
-    ];
-    mainProgram = "grafana-agent";
-    # Breaks with Go 1.23: https://github.com/grafana/agent/issues/6972
-    # Binary panics at runtime with:
-    # 'panic: pattern "GET /debug/pprof/" (registered at net/http/pprof/pprof.go:100) conflicts with pattern "/debug/pprof/delta_heap"'
-    broken = true;
-  };
-}
diff --git a/pkgs/by-name/gr/grimblast/package.nix b/pkgs/by-name/gr/grimblast/package.nix
index dca93be00694..4b90a5a62143 100644
--- a/pkgs/by-name/gr/grimblast/package.nix
+++ b/pkgs/by-name/gr/grimblast/package.nix
@@ -18,13 +18,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "grimblast";
-  version = "0.1-unstable-2025-03-17";
+  version = "0.1-unstable-2025-03-31";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "contrib";
-    rev = "bd81329944be53b0ffb99e05864804b95f1d7c65";
-    hash = "sha256-I8JVdQRu8eWvY5W8XWYZkdd5pojDHkxeqQV7mMIsbhs=";
+    rev = "bc2ad24e0b2e66c3e164994c4897cd94a933fd10";
+    hash = "sha256-YItzk1pj8Kz+b7VlC9zN1pSZ6CuX35asYy3HuMQ3lBQ=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/ha/halo/package.nix b/pkgs/by-name/ha/halo/package.nix
index 76b003e7697c..a3058e5acc35 100644
--- a/pkgs/by-name/ha/halo/package.nix
+++ b/pkgs/by-name/ha/halo/package.nix
@@ -8,10 +8,10 @@
 }:
 stdenv.mkDerivation rec {
   pname = "halo";
-  version = "2.20.17";
+  version = "2.20.18";
   src = fetchurl {
     url = "https://github.com/halo-dev/halo/releases/download/v${version}/halo-${version}.jar";
-    hash = "sha256-DBXtSA06MzhVySHZstRgML/CU8SSry9vVIbg30/Jo9g=";
+    hash = "sha256-N3hbiK/pmZ30wJA8VJI9ft6o7VKQEM2+evakk0EObx4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/hy/hydra/package.nix b/pkgs/by-name/hy/hydra/package.nix
index 08692a0184d3..7e2c45fd4c40 100644
--- a/pkgs/by-name/hy/hydra/package.nix
+++ b/pkgs/by-name/hy/hydra/package.nix
@@ -265,7 +265,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     inherit nix perlDeps;
-    tests.basic = nixosTests.hydra.hydra;
+    tests = { inherit (nixosTests) hydra; };
     updateScript = unstableGitUpdater { };
   };
 
diff --git a/pkgs/by-name/im/immich/sources.json b/pkgs/by-name/im/immich/sources.json
index 51337c7fcf45..c93d6b0b35d5 100644
--- a/pkgs/by-name/im/immich/sources.json
+++ b/pkgs/by-name/im/immich/sources.json
@@ -1,22 +1,22 @@
 {
-  "version": "1.131.2",
-  "hash": "sha256-E7D6tTA2XJLfKg1qTGG/v5vJsHh2dY5ihhiA0xcf0sA=",
+  "version": "1.131.3",
+  "hash": "sha256-ZSi9DfyGzkEOiCVEdLu16xzjbmwuMIodD9zMwW72Ppo=",
   "components": {
     "cli": {
-      "npmDepsHash": "sha256-bubJQlsumazercr5W4oUwjEjLrC/odU8r4kcT0BZhcw=",
-      "version": "2.2.60"
+      "npmDepsHash": "sha256-FNIrVdEvibIWq7yeHU76PNoolwJPPuCtcL3X6OeZ67U=",
+      "version": "2.2.61"
     },
     "server": {
-      "npmDepsHash": "sha256-nYicKhgbsDyLiWfUGelJ6ZbH1oGeWIPCG/UBmTv5H7A=",
-      "version": "1.131.2"
+      "npmDepsHash": "sha256-3557g6XH/FLXwZQ27IxgM55bzKrF+TLUBLI26PNjKec=",
+      "version": "1.131.3"
     },
     "web": {
-      "npmDepsHash": "sha256-3Dc7U6kq9hUDNfK41hCpUu/al8WJ7p4oaLwyGqu2m2I=",
-      "version": "1.131.2"
+      "npmDepsHash": "sha256-DIsWAfkEhIYnomC1AFpl2vLFxREhe0ofWs6ntFk9qXA=",
+      "version": "1.131.3"
     },
     "open-api/typescript-sdk": {
-      "npmDepsHash": "sha256-fsFWhRnwzTwMTrC5WPR2yJ2t8plWb98GO2P5Sm/NwaQ=",
-      "version": "1.131.2"
+      "npmDepsHash": "sha256-q0cg1yCZVM6DmvGYrI5fyGcA1fOyDhYZYvBsIPV05A8=",
+      "version": "1.131.3"
     },
     "geonames": {
       "timestamp": "20250331194635",
diff --git a/pkgs/by-name/ji/jitsi-meet-electron/package.nix b/pkgs/by-name/ji/jitsi-meet-electron/package.nix
index 55edb988668d..0be61315c429 100644
--- a/pkgs/by-name/ji/jitsi-meet-electron/package.nix
+++ b/pkgs/by-name/ji/jitsi-meet-electron/package.nix
@@ -25,13 +25,13 @@ let
 in
 buildNpmPackage rec {
   pname = "jitsi-meet-electron";
-  version = "2025.1.0";
+  version = "2025.2.0";
 
   src = fetchFromGitHub {
     owner = "jitsi";
     repo = "jitsi-meet-electron";
     rev = "v${version}";
-    hash = "sha256-o65UPPyGgmFe8+HANmnyVgPITk8gY7uvIzx7QZUluBU=";
+    hash = "sha256-Pk62BpfXblRph3ktxy8eF9umRmPRZbZGjRWduy+3z+s=";
   };
 
   nativeBuildInputs =
@@ -58,7 +58,7 @@ buildNpmPackage rec {
       OpenGL
     ];
 
-  npmDepsHash = "sha256-16yWCI408tkkzvrx2fBPSNSUa9dRej9LrnNpqobwfl8=";
+  npmDepsHash = "sha256-TckV91RJo06OKb8nIvxBCxu28qyHtA/ACDshOlaCQxA=";
 
   makeCacheWritable = true;
 
diff --git a/pkgs/by-name/jn/jnv/package.nix b/pkgs/by-name/jn/jnv/package.nix
index 3bb0a3a5f2c7..e42b7fb671f9 100644
--- a/pkgs/by-name/jn/jnv/package.nix
+++ b/pkgs/by-name/jn/jnv/package.nix
@@ -7,17 +7,17 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "jnv";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "ynqa";
     repo = "jnv";
     rev = "v${version}";
-    hash = "sha256-ouWtMos4g9uIFEFeukgq8VgcxlSCzJnSYFNdNmOD5C8=";
+    hash = "sha256-HKZ+hF5Y7vTA4EODSAd9xYJHaipv5YukTl470ejPLtM=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-83xZy8LAe1IE58WAsM6loIxV7pO9n9pgMpjCHrWkHwc=";
+  cargoHash = "sha256-VLVoURqmUhhekNZ0a75bwjvSiLfaQ79IlltbmWVyBrI=";
 
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin (
     with darwin.apple_sdk.frameworks;
diff --git a/pkgs/by-name/ki/kitex/package.nix b/pkgs/by-name/ki/kitex/package.nix
index 80b927143ca7..cc60333b66b2 100644
--- a/pkgs/by-name/ki/kitex/package.nix
+++ b/pkgs/by-name/ki/kitex/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "kitex";
-  version = "0.12.3";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "cloudwego";
     repo = "kitex";
     rev = "v${version}";
-    hash = "sha256-YJq/aE8M/yRed2ZH7zf6i5wRl9KKXxAncD0lNAmJXUM=";
+    hash = "sha256-1dgQgc9XljawyH+MIDPNqcwHMH0yW2BMY8TZnc+P13I=";
   };
 
-  vendorHash = "sha256-yIPcH1arDSYfCqSbBTvbnp4UORx11bbuT//fy89bzF0=";
+  vendorHash = "sha256-31OgNcAL2NJq5b96UmQnVecdusY4AtUP/O2MVCmPk+8=";
 
   subPackages = [ "tool/cmd/kitex" ];
 
diff --git a/pkgs/by-name/le/lean4/package.nix b/pkgs/by-name/le/lean4/package.nix
index 34c035759cc5..a49ae08068ea 100644
--- a/pkgs/by-name/le/lean4/package.nix
+++ b/pkgs/by-name/le/lean4/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lean4";
-  version = "4.17.0";
+  version = "4.18.0";
 
   src = fetchFromGitHub {
     owner = "leanprover";
     repo = "lean4";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6oteAbCKhel0pRyFGqSDG03oDPQU5Y9dsPcujSG6sjo=";
+    hash = "sha256-1hVcRO9RbVUgoKTUTFXBqJZwt50/aw/P9dxUdI7RpCc=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/li/libdigidocpp/package.nix b/pkgs/by-name/li/libdigidocpp/package.nix
index 2a1c015910a4..9788e8c092f8 100644
--- a/pkgs/by-name/li/libdigidocpp/package.nix
+++ b/pkgs/by-name/li/libdigidocpp/package.nix
@@ -9,9 +9,7 @@
   pcsclite,
   opensc,
   openssl,
-  xercesc,
   pkg-config,
-  xsd,
   zlib,
   xmlsec,
   xxd,
@@ -38,8 +36,6 @@ stdenv.mkDerivation rec {
     pcsclite
     opensc
     openssl
-    xercesc
-    xsd
     zlib
     xmlsec
   ];
diff --git a/pkgs/by-name/mo/monocle/package.nix b/pkgs/by-name/mo/monocle/package.nix
new file mode 100644
index 000000000000..dda720c31345
--- /dev/null
+++ b/pkgs/by-name/mo/monocle/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "monocle";
+  version = "0.8.0";
+
+  src = fetchFromGitHub {
+    owner = "bgpkit";
+    repo = "monocle";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-vpGCYU/vW4cQFuAWxa+ZkuKLB4NSs5tPW2iWVE8iPAk=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-1wouA1REbPHm/v4ZB76gfgDPweNV3nztf6XxKdu42GQ=";
+
+  # require internet access
+  checkFlags = [
+    "--skip=datasets::as2org::tests::test_crawling"
+    "--skip=datasets::ip::tests::test_fetch_ip_info"
+    "--skip=datasets::rpki::validator::tests::test_bgp"
+    "--skip=datasets::rpki::validator::tests::test_list_asn"
+    "--skip=datasets::rpki::validator::tests::test_list_prefix"
+    "--skip=datasets::rpki::validator::tests::test_validation"
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "See through all BGP data with a monocle";
+    homepage = "https://github.com/bgpkit/monocle";
+    changelog = "https://github.com/bgpkit/monocle/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ stepbrobd ];
+    mainProgram = "monocle";
+  };
+})
diff --git a/pkgs/by-name/ne/nezha-theme-admin/package-lock.json b/pkgs/by-name/ne/nezha-theme-admin/package-lock.json
index 174d710981e4..31048724c393 100644
--- a/pkgs/by-name/ne/nezha-theme-admin/package-lock.json
+++ b/pkgs/by-name/ne/nezha-theme-admin/package-lock.json
@@ -155,13 +155,13 @@
             }
         },
         "node_modules/@babel/generator": {
-            "version": "7.26.10",
-            "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.26.10.tgz",
-            "integrity": "sha512-rRHT8siFIXQrAYOYqZQVsAr8vJ+cBNqcVAY6m5V8/4QqzaPl+zDBe6cLEPRDuNOUf3ww8RfJVlOyQMoSI+5Ang==",
+            "version": "7.27.0",
+            "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.27.0.tgz",
+            "integrity": "sha512-VybsKvpiN1gU1sdMZIp7FcqphVVKEwcuj02x73uvcHE0PTihx1nlBcowYWhDwjpoAXRv43+gDzyggGnn1XZhVw==",
             "license": "MIT",
             "dependencies": {
-                "@babel/parser": "^7.26.10",
-                "@babel/types": "^7.26.10",
+                "@babel/parser": "^7.27.0",
+                "@babel/types": "^7.27.0",
                 "@jridgewell/gen-mapping": "^0.3.5",
                 "@jridgewell/trace-mapping": "^0.3.25",
                 "jsesc": "^3.0.2"
@@ -171,13 +171,13 @@
             }
         },
         "node_modules/@babel/helper-compilation-targets": {
-            "version": "7.26.5",
-            "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.26.5.tgz",
-            "integrity": "sha512-IXuyn5EkouFJscIDuFF5EsiSolseme1s0CZB+QxVugqJLYmKdxI1VfIBOst0SUu4rnk2Z7kqTwmoO1lp3HIfnA==",
+            "version": "7.27.0",
+            "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.27.0.tgz",
+            "integrity": "sha512-LVk7fbXml0H2xH34dFzKQ7TDZ2G4/rVTOrq9V+icbbadjbVxxeFeDsNHv2SrZeWoA+6ZiTyWYWtScEIW07EAcA==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@babel/compat-data": "^7.26.5",
+                "@babel/compat-data": "^7.26.8",
                 "@babel/helper-validator-option": "^7.25.9",
                 "browserslist": "^4.24.0",
                 "lru-cache": "^5.1.1",
@@ -258,26 +258,26 @@
             }
         },
         "node_modules/@babel/helpers": {
-            "version": "7.26.10",
-            "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.26.10.tgz",
-            "integrity": "sha512-UPYc3SauzZ3JGgj87GgZ89JVdC5dj0AoetR5Bw6wj4niittNyFh6+eOGonYvJ1ao6B8lEa3Q3klS7ADZ53bc5g==",
+            "version": "7.27.0",
+            "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.27.0.tgz",
+            "integrity": "sha512-U5eyP/CTFPuNE3qk+WZMxFkp/4zUzdceQlfzf7DdGdhp+Fezd7HD+i8Y24ZuTMKX3wQBld449jijbGq6OdGNQg==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@babel/template": "^7.26.9",
-                "@babel/types": "^7.26.10"
+                "@babel/template": "^7.27.0",
+                "@babel/types": "^7.27.0"
             },
             "engines": {
                 "node": ">=6.9.0"
             }
         },
         "node_modules/@babel/parser": {
-            "version": "7.26.10",
-            "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.26.10.tgz",
-            "integrity": "sha512-6aQR2zGE/QFi8JpDLjUZEPYOs7+mhKXm86VaKFiLP35JQwQb6bwUE+XbvkH0EptsYhbNBSUGaUBLKqxH1xSgsA==",
+            "version": "7.27.0",
+            "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.27.0.tgz",
+            "integrity": "sha512-iaepho73/2Pz7w2eMS0Q5f83+0RKI7i4xmiYeBmDzfRVbQtTOG7Ts0S4HzJVsTMGI9keU8rNfuZr8DKfSt7Yyg==",
             "license": "MIT",
             "dependencies": {
-                "@babel/types": "^7.26.10"
+                "@babel/types": "^7.27.0"
             },
             "bin": {
                 "parser": "bin/babel-parser.js"
@@ -319,9 +319,9 @@
             }
         },
         "node_modules/@babel/runtime": {
-            "version": "7.26.10",
-            "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.26.10.tgz",
-            "integrity": "sha512-2WJMeRQPHKSPemqk/awGrAiuFfzBmOIPXKizAsVhWH9YJqLZ0H+HS4c8loHGgW6utJ3E/ejXQUsiGaQy2NZ9Fw==",
+            "version": "7.27.0",
+            "resolved": "https://registry.npmjs.org/@babel/runtime/-/runtime-7.27.0.tgz",
+            "integrity": "sha512-VtPOkrdPHZsKc/clNqyi9WUA8TINkZ4cGk63UUE3u4pmB2k+ZMQRDuIOagv8UVd6j7k0T3+RRIb7beKTebNbcw==",
             "license": "MIT",
             "dependencies": {
                 "regenerator-runtime": "^0.14.0"
@@ -331,30 +331,30 @@
             }
         },
         "node_modules/@babel/template": {
-            "version": "7.26.9",
-            "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.26.9.tgz",
-            "integrity": "sha512-qyRplbeIpNZhmzOysF/wFMuP9sctmh2cFzRAZOn1YapxBsE1i9bJIY586R/WBLfLcmcBlM8ROBiQURnnNy+zfA==",
+            "version": "7.27.0",
+            "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.27.0.tgz",
+            "integrity": "sha512-2ncevenBqXI6qRMukPlXwHKHchC7RyMuu4xv5JBXRfOGVcTy1mXCD12qrp7Jsoxll1EV3+9sE4GugBVRjT2jFA==",
             "license": "MIT",
             "dependencies": {
                 "@babel/code-frame": "^7.26.2",
-                "@babel/parser": "^7.26.9",
-                "@babel/types": "^7.26.9"
+                "@babel/parser": "^7.27.0",
+                "@babel/types": "^7.27.0"
             },
             "engines": {
                 "node": ">=6.9.0"
             }
         },
         "node_modules/@babel/traverse": {
-            "version": "7.26.10",
-            "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.26.10.tgz",
-            "integrity": "sha512-k8NuDrxr0WrPH5Aupqb2LCVURP/S0vBEn5mK6iH+GIYob66U5EtoZvcdudR2jQ4cmTwhEwW1DLB+Yyas9zjF6A==",
+            "version": "7.27.0",
+            "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.27.0.tgz",
+            "integrity": "sha512-19lYZFzYVQkkHkl4Cy4WrAVcqBkgvV2YM2TU3xG6DIwO7O3ecbDPfW3yM3bjAGcqcQHi+CCtjMR3dIEHxsd6bA==",
             "license": "MIT",
             "dependencies": {
                 "@babel/code-frame": "^7.26.2",
-                "@babel/generator": "^7.26.10",
-                "@babel/parser": "^7.26.10",
-                "@babel/template": "^7.26.9",
-                "@babel/types": "^7.26.10",
+                "@babel/generator": "^7.27.0",
+                "@babel/parser": "^7.27.0",
+                "@babel/template": "^7.27.0",
+                "@babel/types": "^7.27.0",
                 "debug": "^4.3.1",
                 "globals": "^11.1.0"
             },
@@ -372,9 +372,9 @@
             }
         },
         "node_modules/@babel/types": {
-            "version": "7.26.10",
-            "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.26.10.tgz",
-            "integrity": "sha512-emqcG3vHrpxUKTrxcblR36dcrcoRDvKmnL/dCL6ZsHaShW80qxCAcNhzQZrpeM765VzEos+xOi4s+r4IXzTwdQ==",
+            "version": "7.27.0",
+            "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.27.0.tgz",
+            "integrity": "sha512-H45s8fVLYjbhFH62dIJ3WtmJ6RSPt/3DRO0ZcT2SUiYiQyz3BLVb9ADEnLl91m74aQPS3AzzeajZHYOalWe3bg==",
             "license": "MIT",
             "dependencies": {
                 "@babel/helper-string-parser": "^7.25.9",
@@ -385,9 +385,9 @@
             }
         },
         "node_modules/@esbuild/aix-ppc64": {
-            "version": "0.25.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.1.tgz",
-            "integrity": "sha512-kfYGy8IdzTGy+z0vFGvExZtxkFlA4zAxgKEahG9KE1ScBjpQnFsNOX8KTU5ojNru5ed5CVoJYXFtoxaq5nFbjQ==",
+            "version": "0.25.2",
+            "resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.2.tgz",
+            "integrity": "sha512-wCIboOL2yXZym2cgm6mlA742s9QeJ8DjGVaL39dLN4rRwrOgOyYSnOaFPhKZGLb2ngj4EyfAFjsNJwPXZvseag==",
             "cpu": [
                 "ppc64"
             ],
@@ -402,9 +402,9 @@
             }
         },
         "node_modules/@esbuild/android-arm": {
-            "version": "0.25.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.1.tgz",
-            "integrity": "sha512-dp+MshLYux6j/JjdqVLnMglQlFu+MuVeNrmT5nk6q07wNhCdSnB7QZj+7G8VMUGh1q+vj2Bq8kRsuyA00I/k+Q==",
+            "version": "0.25.2",
+            "resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.2.tgz",
+            "integrity": "sha512-NQhH7jFstVY5x8CKbcfa166GoV0EFkaPkCKBQkdPJFvo5u+nGXLEH/ooniLb3QI8Fk58YAx7nsPLozUWfCBOJA==",
             "cpu": [
                 "arm"
             ],
@@ -419,9 +419,9 @@
             }
         },
         "node_modules/@esbuild/android-arm64": {
-            "version": "0.25.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.1.tgz",
-            "integrity": "sha512-50tM0zCJW5kGqgG7fQ7IHvQOcAn9TKiVRuQ/lN0xR+T2lzEFvAi1ZcS8DiksFcEpf1t/GYOeOfCAgDHFpkiSmA==",
+            "version": "0.25.2",
+            "resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.2.tgz",
+            "integrity": "sha512-5ZAX5xOmTligeBaeNEPnPaeEuah53Id2tX4c2CVP3JaROTH+j4fnfHCkr1PjXMd78hMst+TlkfKcW/DlTq0i4w==",
             "cpu": [
                 "arm64"
             ],
@@ -436,9 +436,9 @@
             }
         },
         "node_modules/@esbuild/android-x64": {
-            "version": "0.25.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.1.tgz",
-            "integrity": "sha512-GCj6WfUtNldqUzYkN/ITtlhwQqGWu9S45vUXs7EIYf+7rCiiqH9bCloatO9VhxsL0Pji+PF4Lz2XXCES+Q8hDw==",
+            "version": "0.25.2",
+            "resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.2.tgz",
+            "integrity": "sha512-Ffcx+nnma8Sge4jzddPHCZVRvIfQ0kMsUsCMcJRHkGJ1cDmhe4SsrYIjLUKn1xpHZybmOqCWwB0zQvsjdEHtkg==",
             "cpu": [
                 "x64"
             ],
@@ -453,9 +453,9 @@
             }
         },
         "node_modules/@esbuild/darwin-arm64": {
-            "version": "0.25.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.1.tgz",
-            "integrity": "sha512-5hEZKPf+nQjYoSr/elb62U19/l1mZDdqidGfmFutVUjjUZrOazAtwK+Kr+3y0C/oeJfLlxo9fXb1w7L+P7E4FQ==",
+            "version": "0.25.2",
+            "resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.2.tgz",
+            "integrity": "sha512-MpM6LUVTXAzOvN4KbjzU/q5smzryuoNjlriAIx+06RpecwCkL9JpenNzpKd2YMzLJFOdPqBpuub6eVRP5IgiSA==",
             "cpu": [
                 "arm64"
             ],
@@ -470,9 +470,9 @@
             }
         },
         "node_modules/@esbuild/darwin-x64": {
-            "version": "0.25.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.1.tgz",
-            "integrity": "sha512-hxVnwL2Dqs3fM1IWq8Iezh0cX7ZGdVhbTfnOy5uURtao5OIVCEyj9xIzemDi7sRvKsuSdtCAhMKarxqtlyVyfA==",
+            "version": "0.25.2",
+            "resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.2.tgz",
+            "integrity": "sha512-5eRPrTX7wFyuWe8FqEFPG2cU0+butQQVNcT4sVipqjLYQjjh8a8+vUTfgBKM88ObB85ahsnTwF7PSIt6PG+QkA==",
             "cpu": [
                 "x64"
             ],
@@ -487,9 +487,9 @@
             }
         },
         "node_modules/@esbuild/freebsd-arm64": {
-            "version": "0.25.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.1.tgz",
-            "integrity": "sha512-1MrCZs0fZa2g8E+FUo2ipw6jw5qqQiH+tERoS5fAfKnRx6NXH31tXBKI3VpmLijLH6yriMZsxJtaXUyFt/8Y4A==",
+            "version": "0.25.2",
+            "resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.2.tgz",
+            "integrity": "sha512-mLwm4vXKiQ2UTSX4+ImyiPdiHjiZhIaE9QvC7sw0tZ6HoNMjYAqQpGyui5VRIi5sGd+uWq940gdCbY3VLvsO1w==",
             "cpu": [
                 "arm64"
             ],
@@ -504,9 +504,9 @@
             }
         },
         "node_modules/@esbuild/freebsd-x64": {
-            "version": "0.25.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.1.tgz",
-            "integrity": "sha512-0IZWLiTyz7nm0xuIs0q1Y3QWJC52R8aSXxe40VUxm6BB1RNmkODtW6LHvWRrGiICulcX7ZvyH6h5fqdLu4gkww==",
+            "version": "0.25.2",
+            "resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.2.tgz",
+            "integrity": "sha512-6qyyn6TjayJSwGpm8J9QYYGQcRgc90nmfdUb0O7pp1s4lTY+9D0H9O02v5JqGApUyiHOtkz6+1hZNvNtEhbwRQ==",
             "cpu": [
                 "x64"
             ],
@@ -521,9 +521,9 @@
             }
         },
         "node_modules/@esbuild/linux-arm": {
-            "version": "0.25.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.1.tgz",
-            "integrity": "sha512-NdKOhS4u7JhDKw9G3cY6sWqFcnLITn6SqivVArbzIaf3cemShqfLGHYMx8Xlm/lBit3/5d7kXvriTUGa5YViuQ==",
+            "version": "0.25.2",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.2.tgz",
+            "integrity": "sha512-UHBRgJcmjJv5oeQF8EpTRZs/1knq6loLxTsjc3nxO9eXAPDLcWW55flrMVc97qFPbmZP31ta1AZVUKQzKTzb0g==",
             "cpu": [
                 "arm"
             ],
@@ -538,9 +538,9 @@
             }
         },
         "node_modules/@esbuild/linux-arm64": {
-            "version": "0.25.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.1.tgz",
-            "integrity": "sha512-jaN3dHi0/DDPelk0nLcXRm1q7DNJpjXy7yWaWvbfkPvI+7XNSc/lDOnCLN7gzsyzgu6qSAmgSvP9oXAhP973uQ==",
+            "version": "0.25.2",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.2.tgz",
+            "integrity": "sha512-gq/sjLsOyMT19I8obBISvhoYiZIAaGF8JpeXu1u8yPv8BE5HlWYobmlsfijFIZ9hIVGYkbdFhEqC0NvM4kNO0g==",
             "cpu": [
                 "arm64"
             ],
@@ -555,9 +555,9 @@
             }
         },
         "node_modules/@esbuild/linux-ia32": {
-            "version": "0.25.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.1.tgz",
-            "integrity": "sha512-OJykPaF4v8JidKNGz8c/q1lBO44sQNUQtq1KktJXdBLn1hPod5rE/Hko5ugKKZd+D2+o1a9MFGUEIUwO2YfgkQ==",
+            "version": "0.25.2",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.2.tgz",
+            "integrity": "sha512-bBYCv9obgW2cBP+2ZWfjYTU+f5cxRoGGQ5SeDbYdFCAZpYWrfjjfYwvUpP8MlKbP0nwZ5gyOU/0aUzZ5HWPuvQ==",
             "cpu": [
                 "ia32"
             ],
@@ -572,9 +572,9 @@
             }
         },
         "node_modules/@esbuild/linux-loong64": {
-            "version": "0.25.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.1.tgz",
-            "integrity": "sha512-nGfornQj4dzcq5Vp835oM/o21UMlXzn79KobKlcs3Wz9smwiifknLy4xDCLUU0BWp7b/houtdrgUz7nOGnfIYg==",
+            "version": "0.25.2",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.2.tgz",
+            "integrity": "sha512-SHNGiKtvnU2dBlM5D8CXRFdd+6etgZ9dXfaPCeJtz+37PIUlixvlIhI23L5khKXs3DIzAn9V8v+qb1TRKrgT5w==",
             "cpu": [
                 "loong64"
             ],
@@ -589,9 +589,9 @@
             }
         },
         "node_modules/@esbuild/linux-mips64el": {
-            "version": "0.25.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.1.tgz",
-            "integrity": "sha512-1osBbPEFYwIE5IVB/0g2X6i1qInZa1aIoj1TdL4AaAb55xIIgbg8Doq6a5BzYWgr+tEcDzYH67XVnTmUzL+nXg==",
+            "version": "0.25.2",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.2.tgz",
+            "integrity": "sha512-hDDRlzE6rPeoj+5fsADqdUZl1OzqDYow4TB4Y/3PlKBD0ph1e6uPHzIQcv2Z65u2K0kpeByIyAjCmjn1hJgG0Q==",
             "cpu": [
                 "mips64el"
             ],
@@ -606,9 +606,9 @@
             }
         },
         "node_modules/@esbuild/linux-ppc64": {
-            "version": "0.25.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.1.tgz",
-            "integrity": "sha512-/6VBJOwUf3TdTvJZ82qF3tbLuWsscd7/1w+D9LH0W/SqUgM5/JJD0lrJ1fVIfZsqB6RFmLCe0Xz3fmZc3WtyVg==",
+            "version": "0.25.2",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.2.tgz",
+            "integrity": "sha512-tsHu2RRSWzipmUi9UBDEzc0nLc4HtpZEI5Ba+Omms5456x5WaNuiG3u7xh5AO6sipnJ9r4cRWQB2tUjPyIkc6g==",
             "cpu": [
                 "ppc64"
             ],
@@ -623,9 +623,9 @@
             }
         },
         "node_modules/@esbuild/linux-riscv64": {
-            "version": "0.25.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.1.tgz",
-            "integrity": "sha512-nSut/Mx5gnilhcq2yIMLMe3Wl4FK5wx/o0QuuCLMtmJn+WeWYoEGDN1ipcN72g1WHsnIbxGXd4i/MF0gTcuAjQ==",
+            "version": "0.25.2",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.2.tgz",
+            "integrity": "sha512-k4LtpgV7NJQOml/10uPU0s4SAXGnowi5qBSjaLWMojNCUICNu7TshqHLAEbkBdAszL5TabfvQ48kK84hyFzjnw==",
             "cpu": [
                 "riscv64"
             ],
@@ -640,9 +640,9 @@
             }
         },
         "node_modules/@esbuild/linux-s390x": {
-            "version": "0.25.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.1.tgz",
-            "integrity": "sha512-cEECeLlJNfT8kZHqLarDBQso9a27o2Zd2AQ8USAEoGtejOrCYHNtKP8XQhMDJMtthdF4GBmjR2au3x1udADQQQ==",
+            "version": "0.25.2",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.2.tgz",
+            "integrity": "sha512-GRa4IshOdvKY7M/rDpRR3gkiTNp34M0eLTaC1a08gNrh4u488aPhuZOCpkF6+2wl3zAN7L7XIpOFBhnaE3/Q8Q==",
             "cpu": [
                 "s390x"
             ],
@@ -657,9 +657,9 @@
             }
         },
         "node_modules/@esbuild/linux-x64": {
-            "version": "0.25.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.1.tgz",
-            "integrity": "sha512-xbfUhu/gnvSEg+EGovRc+kjBAkrvtk38RlerAzQxvMzlB4fXpCFCeUAYzJvrnhFtdeyVCDANSjJvOvGYoeKzFA==",
+            "version": "0.25.2",
+            "resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.2.tgz",
+            "integrity": "sha512-QInHERlqpTTZ4FRB0fROQWXcYRD64lAoiegezDunLpalZMjcUcld3YzZmVJ2H/Cp0wJRZ8Xtjtj0cEHhYc/uUg==",
             "cpu": [
                 "x64"
             ],
@@ -674,9 +674,9 @@
             }
         },
         "node_modules/@esbuild/netbsd-arm64": {
-            "version": "0.25.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.1.tgz",
-            "integrity": "sha512-O96poM2XGhLtpTh+s4+nP7YCCAfb4tJNRVZHfIE7dgmax+yMP2WgMd2OecBuaATHKTHsLWHQeuaxMRnCsH8+5g==",
+            "version": "0.25.2",
+            "resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.2.tgz",
+            "integrity": "sha512-talAIBoY5M8vHc6EeI2WW9d/CkiO9MQJ0IOWX8hrLhxGbro/vBXJvaQXefW2cP0z0nQVTdQ/eNyGFV1GSKrxfw==",
             "cpu": [
                 "arm64"
             ],
@@ -691,9 +691,9 @@
             }
         },
         "node_modules/@esbuild/netbsd-x64": {
-            "version": "0.25.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.1.tgz",
-            "integrity": "sha512-X53z6uXip6KFXBQ+Krbx25XHV/NCbzryM6ehOAeAil7X7oa4XIq+394PWGnwaSQ2WRA0KI6PUO6hTO5zeF5ijA==",
+            "version": "0.25.2",
+            "resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.2.tgz",
+            "integrity": "sha512-voZT9Z+tpOxrvfKFyfDYPc4DO4rk06qamv1a/fkuzHpiVBMOhpjK+vBmWM8J1eiB3OLSMFYNaOaBNLXGChf5tg==",
             "cpu": [
                 "x64"
             ],
@@ -708,9 +708,9 @@
             }
         },
         "node_modules/@esbuild/openbsd-arm64": {
-            "version": "0.25.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.1.tgz",
-            "integrity": "sha512-Na9T3szbXezdzM/Kfs3GcRQNjHzM6GzFBeU1/6IV/npKP5ORtp9zbQjvkDJ47s6BCgaAZnnnu/cY1x342+MvZg==",
+            "version": "0.25.2",
+            "resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.2.tgz",
+            "integrity": "sha512-dcXYOC6NXOqcykeDlwId9kB6OkPUxOEqU+rkrYVqJbK2hagWOMrsTGsMr8+rW02M+d5Op5NNlgMmjzecaRf7Tg==",
             "cpu": [
                 "arm64"
             ],
@@ -725,9 +725,9 @@
             }
         },
         "node_modules/@esbuild/openbsd-x64": {
-            "version": "0.25.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.1.tgz",
-            "integrity": "sha512-T3H78X2h1tszfRSf+txbt5aOp/e7TAz3ptVKu9Oyir3IAOFPGV6O9c2naym5TOriy1l0nNf6a4X5UXRZSGX/dw==",
+            "version": "0.25.2",
+            "resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.2.tgz",
+            "integrity": "sha512-t/TkWwahkH0Tsgoq1Ju7QfgGhArkGLkF1uYz8nQS/PPFlXbP5YgRpqQR3ARRiC2iXoLTWFxc6DJMSK10dVXluw==",
             "cpu": [
                 "x64"
             ],
@@ -742,9 +742,9 @@
             }
         },
         "node_modules/@esbuild/sunos-x64": {
-            "version": "0.25.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.1.tgz",
-            "integrity": "sha512-2H3RUvcmULO7dIE5EWJH8eubZAI4xw54H1ilJnRNZdeo8dTADEZ21w6J22XBkXqGJbe0+wnNJtw3UXRoLJnFEg==",
+            "version": "0.25.2",
+            "resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.2.tgz",
+            "integrity": "sha512-cfZH1co2+imVdWCjd+D1gf9NjkchVhhdpgb1q5y6Hcv9TP6Zi9ZG/beI3ig8TvwT9lH9dlxLq5MQBBgwuj4xvA==",
             "cpu": [
                 "x64"
             ],
@@ -759,9 +759,9 @@
             }
         },
         "node_modules/@esbuild/win32-arm64": {
-            "version": "0.25.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.1.tgz",
-            "integrity": "sha512-GE7XvrdOzrb+yVKB9KsRMq+7a2U/K5Cf/8grVFRAGJmfADr/e/ODQ134RK2/eeHqYV5eQRFxb1hY7Nr15fv1NQ==",
+            "version": "0.25.2",
+            "resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.2.tgz",
+            "integrity": "sha512-7Loyjh+D/Nx/sOTzV8vfbB3GJuHdOQyrOryFdZvPHLf42Tk9ivBU5Aedi7iyX+x6rbn2Mh68T4qq1SDqJBQO5Q==",
             "cpu": [
                 "arm64"
             ],
@@ -776,9 +776,9 @@
             }
         },
         "node_modules/@esbuild/win32-ia32": {
-            "version": "0.25.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.1.tgz",
-            "integrity": "sha512-uOxSJCIcavSiT6UnBhBzE8wy3n0hOkJsBOzy7HDAuTDE++1DJMRRVCPGisULScHL+a/ZwdXPpXD3IyFKjA7K8A==",
+            "version": "0.25.2",
+            "resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.2.tgz",
+            "integrity": "sha512-WRJgsz9un0nqZJ4MfhabxaD9Ft8KioqU3JMinOTvobbX6MOSUigSBlogP8QB3uxpJDsFS6yN+3FDBdqE5lg9kg==",
             "cpu": [
                 "ia32"
             ],
@@ -793,9 +793,9 @@
             }
         },
         "node_modules/@esbuild/win32-x64": {
-            "version": "0.25.1",
-            "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.1.tgz",
-            "integrity": "sha512-Y1EQdcfwMSeQN/ujR5VayLOJ1BHaK+ssyk0AEzPjC+t1lITgsnccPqFjb6V+LsTp/9Iov4ysfjxLaGJ9RPtkVg==",
+            "version": "0.25.2",
+            "resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.2.tgz",
+            "integrity": "sha512-kM3HKb16VIXZyIeVrM1ygYmZBKybX8N4p754bw390wGO3Tf2j4L2/WYL+4suWujpgf6GBYs3jv7TyUivdd05JA==",
             "cpu": [
                 "x64"
             ],
@@ -867,9 +867,9 @@
             }
         },
         "node_modules/@eslint/config-helpers": {
-            "version": "0.2.0",
-            "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.2.0.tgz",
-            "integrity": "sha512-yJLLmLexii32mGrhW29qvU3QBVTu0GUmEf/J4XsBtVhp4JkIUFN/BjWqTF63yRvGApIDpZm5fa97LtYtINmfeQ==",
+            "version": "0.2.1",
+            "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.2.1.tgz",
+            "integrity": "sha512-RI17tsD2frtDu/3dmI7QRrD4bedNKPM08ziRYaC5AhkGrzIAJelm9kJU1TznK+apx6V+cqRz8tfpEeG3oIyjxw==",
             "dev": true,
             "license": "Apache-2.0",
             "engines": {
@@ -947,19 +947,32 @@
             }
         },
         "node_modules/@eslint/plugin-kit": {
-            "version": "0.2.7",
-            "resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.2.7.tgz",
-            "integrity": "sha512-JubJ5B2pJ4k4yGxaNLdbjrnk9d/iDz6/q8wOilpIowd6PJPgaxCuHBnBszq7Ce2TyMrywm5r4PnKm6V3iiZF+g==",
+            "version": "0.2.8",
+            "resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.2.8.tgz",
+            "integrity": "sha512-ZAoA40rNMPwSm+AeHpCq8STiNAwzWLJuP8Xv4CHIc9wv/PSuExjMrmjfYNj682vW0OOiZ1HKxzvjQr9XZIisQA==",
             "dev": true,
             "license": "Apache-2.0",
             "dependencies": {
-                "@eslint/core": "^0.12.0",
+                "@eslint/core": "^0.13.0",
                 "levn": "^0.4.1"
             },
             "engines": {
                 "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
             }
         },
+        "node_modules/@eslint/plugin-kit/node_modules/@eslint/core": {
+            "version": "0.13.0",
+            "resolved": "https://registry.npmjs.org/@eslint/core/-/core-0.13.0.tgz",
+            "integrity": "sha512-yfkgDw1KR66rkT5A8ci4irzDysN7FRpq3ttJolR88OqQikAWqwA8j5VZyas+vjyBNFIJ7MfybJ9plMILI2UrCw==",
+            "dev": true,
+            "license": "Apache-2.0",
+            "dependencies": {
+                "@types/json-schema": "^7.0.15"
+            },
+            "engines": {
+                "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+            }
+        },
         "node_modules/@exodus/schemasafe": {
             "version": "1.3.0",
             "resolved": "https://registry.npmjs.org/@exodus/schemasafe/-/schemasafe-1.3.0.tgz",
@@ -2092,9 +2105,9 @@
             "license": "MIT"
         },
         "node_modules/@rollup/rollup-android-arm-eabi": {
-            "version": "4.36.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.36.0.tgz",
-            "integrity": "sha512-jgrXjjcEwN6XpZXL0HUeOVGfjXhPyxAbbhD0BlXUB+abTOpbPiN5Wb3kOT7yb+uEtATNYF5x5gIfwutmuBA26w==",
+            "version": "4.39.0",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.39.0.tgz",
+            "integrity": "sha512-lGVys55Qb00Wvh8DMAocp5kIcaNzEFTmGhfFd88LfaogYTRKrdxgtlO5H6S49v2Nd8R2C6wLOal0qv6/kCkOwA==",
             "cpu": [
                 "arm"
             ],
@@ -2106,9 +2119,9 @@
             ]
         },
         "node_modules/@rollup/rollup-android-arm64": {
-            "version": "4.36.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.36.0.tgz",
-            "integrity": "sha512-NyfuLvdPdNUfUNeYKUwPwKsE5SXa2J6bCt2LdB/N+AxShnkpiczi3tcLJrm5mA+eqpy0HmaIY9F6XCa32N5yzg==",
+            "version": "4.39.0",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.39.0.tgz",
+            "integrity": "sha512-It9+M1zE31KWfqh/0cJLrrsCPiF72PoJjIChLX+rEcujVRCb4NLQ5QzFkzIZW8Kn8FTbvGQBY5TkKBau3S8cCQ==",
             "cpu": [
                 "arm64"
             ],
@@ -2120,9 +2133,9 @@
             ]
         },
         "node_modules/@rollup/rollup-darwin-arm64": {
-            "version": "4.36.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.36.0.tgz",
-            "integrity": "sha512-JQ1Jk5G4bGrD4pWJQzWsD8I1n1mgPXq33+/vP4sk8j/z/C2siRuxZtaUA7yMTf71TCZTZl/4e1bfzwUmFb3+rw==",
+            "version": "4.39.0",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.39.0.tgz",
+            "integrity": "sha512-lXQnhpFDOKDXiGxsU9/l8UEGGM65comrQuZ+lDcGUx+9YQ9dKpF3rSEGepyeR5AHZ0b5RgiligsBhWZfSSQh8Q==",
             "cpu": [
                 "arm64"
             ],
@@ -2134,9 +2147,9 @@
             ]
         },
         "node_modules/@rollup/rollup-darwin-x64": {
-            "version": "4.36.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.36.0.tgz",
-            "integrity": "sha512-6c6wMZa1lrtiRsbDziCmjE53YbTkxMYhhnWnSW8R/yqsM7a6mSJ3uAVT0t8Y/DGt7gxUWYuFM4bwWk9XCJrFKA==",
+            "version": "4.39.0",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.39.0.tgz",
+            "integrity": "sha512-mKXpNZLvtEbgu6WCkNij7CGycdw9cJi2k9v0noMb++Vab12GZjFgUXD69ilAbBh034Zwn95c2PNSz9xM7KYEAQ==",
             "cpu": [
                 "x64"
             ],
@@ -2148,9 +2161,9 @@
             ]
         },
         "node_modules/@rollup/rollup-freebsd-arm64": {
-            "version": "4.36.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.36.0.tgz",
-            "integrity": "sha512-KXVsijKeJXOl8QzXTsA+sHVDsFOmMCdBRgFmBb+mfEb/7geR7+C8ypAml4fquUt14ZyVXaw2o1FWhqAfOvA4sg==",
+            "version": "4.39.0",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.39.0.tgz",
+            "integrity": "sha512-jivRRlh2Lod/KvDZx2zUR+I4iBfHcu2V/BA2vasUtdtTN2Uk3jfcZczLa81ESHZHPHy4ih3T/W5rPFZ/hX7RtQ==",
             "cpu": [
                 "arm64"
             ],
@@ -2162,9 +2175,9 @@
             ]
         },
         "node_modules/@rollup/rollup-freebsd-x64": {
-            "version": "4.36.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.36.0.tgz",
-            "integrity": "sha512-dVeWq1ebbvByI+ndz4IJcD4a09RJgRYmLccwlQ8bPd4olz3Y213uf1iwvc7ZaxNn2ab7bjc08PrtBgMu6nb4pQ==",
+            "version": "4.39.0",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.39.0.tgz",
+            "integrity": "sha512-8RXIWvYIRK9nO+bhVz8DwLBepcptw633gv/QT4015CpJ0Ht8punmoHU/DuEd3iw9Hr8UwUV+t+VNNuZIWYeY7Q==",
             "cpu": [
                 "x64"
             ],
@@ -2176,9 +2189,9 @@
             ]
         },
         "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
-            "version": "4.36.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.36.0.tgz",
-            "integrity": "sha512-bvXVU42mOVcF4le6XSjscdXjqx8okv4n5vmwgzcmtvFdifQ5U4dXFYaCB87namDRKlUL9ybVtLQ9ztnawaSzvg==",
+            "version": "4.39.0",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.39.0.tgz",
+            "integrity": "sha512-mz5POx5Zu58f2xAG5RaRRhp3IZDK7zXGk5sdEDj4o96HeaXhlUwmLFzNlc4hCQi5sGdR12VDgEUqVSHer0lI9g==",
             "cpu": [
                 "arm"
             ],
@@ -2190,9 +2203,9 @@
             ]
         },
         "node_modules/@rollup/rollup-linux-arm-musleabihf": {
-            "version": "4.36.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.36.0.tgz",
-            "integrity": "sha512-JFIQrDJYrxOnyDQGYkqnNBtjDwTgbasdbUiQvcU8JmGDfValfH1lNpng+4FWlhaVIR4KPkeddYjsVVbmJYvDcg==",
+            "version": "4.39.0",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.39.0.tgz",
+            "integrity": "sha512-+YDwhM6gUAyakl0CD+bMFpdmwIoRDzZYaTWV3SDRBGkMU/VpIBYXXEvkEcTagw/7VVkL2vA29zU4UVy1mP0/Yw==",
             "cpu": [
                 "arm"
             ],
@@ -2204,9 +2217,9 @@
             ]
         },
         "node_modules/@rollup/rollup-linux-arm64-gnu": {
-            "version": "4.36.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.36.0.tgz",
-            "integrity": "sha512-KqjYVh3oM1bj//5X7k79PSCZ6CvaVzb7Qs7VMWS+SlWB5M8p3FqufLP9VNp4CazJ0CsPDLwVD9r3vX7Ci4J56A==",
+            "version": "4.39.0",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.39.0.tgz",
+            "integrity": "sha512-EKf7iF7aK36eEChvlgxGnk7pdJfzfQbNvGV/+l98iiMwU23MwvmV0Ty3pJ0p5WQfm3JRHOytSIqD9LB7Bq7xdQ==",
             "cpu": [
                 "arm64"
             ],
@@ -2218,9 +2231,9 @@
             ]
         },
         "node_modules/@rollup/rollup-linux-arm64-musl": {
-            "version": "4.36.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.36.0.tgz",
-            "integrity": "sha512-QiGnhScND+mAAtfHqeT+cB1S9yFnNQ/EwCg5yE3MzoaZZnIV0RV9O5alJAoJKX/sBONVKeZdMfO8QSaWEygMhw==",
+            "version": "4.39.0",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.39.0.tgz",
+            "integrity": "sha512-vYanR6MtqC7Z2SNr8gzVnzUul09Wi1kZqJaek3KcIlI/wq5Xtq4ZPIZ0Mr/st/sv/NnaPwy/D4yXg5x0B3aUUA==",
             "cpu": [
                 "arm64"
             ],
@@ -2232,9 +2245,9 @@
             ]
         },
         "node_modules/@rollup/rollup-linux-loongarch64-gnu": {
-            "version": "4.36.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loongarch64-gnu/-/rollup-linux-loongarch64-gnu-4.36.0.tgz",
-            "integrity": "sha512-1ZPyEDWF8phd4FQtTzMh8FQwqzvIjLsl6/84gzUxnMNFBtExBtpL51H67mV9xipuxl1AEAerRBgBwFNpkw8+Lg==",
+            "version": "4.39.0",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-loongarch64-gnu/-/rollup-linux-loongarch64-gnu-4.39.0.tgz",
+            "integrity": "sha512-NMRUT40+h0FBa5fb+cpxtZoGAggRem16ocVKIv5gDB5uLDgBIwrIsXlGqYbLwW8YyO3WVTk1FkFDjMETYlDqiw==",
             "cpu": [
                 "loong64"
             ],
@@ -2246,9 +2259,9 @@
             ]
         },
         "node_modules/@rollup/rollup-linux-powerpc64le-gnu": {
-            "version": "4.36.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-powerpc64le-gnu/-/rollup-linux-powerpc64le-gnu-4.36.0.tgz",
-            "integrity": "sha512-VMPMEIUpPFKpPI9GZMhJrtu8rxnp6mJR3ZzQPykq4xc2GmdHj3Q4cA+7avMyegXy4n1v+Qynr9fR88BmyO74tg==",
+            "version": "4.39.0",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-powerpc64le-gnu/-/rollup-linux-powerpc64le-gnu-4.39.0.tgz",
+            "integrity": "sha512-0pCNnmxgduJ3YRt+D+kJ6Ai/r+TaePu9ZLENl+ZDV/CdVczXl95CbIiwwswu4L+K7uOIGf6tMo2vm8uadRaICQ==",
             "cpu": [
                 "ppc64"
             ],
@@ -2260,9 +2273,23 @@
             ]
         },
         "node_modules/@rollup/rollup-linux-riscv64-gnu": {
-            "version": "4.36.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.36.0.tgz",
-            "integrity": "sha512-ttE6ayb/kHwNRJGYLpuAvB7SMtOeQnVXEIpMtAvx3kepFQeowVED0n1K9nAdraHUPJ5hydEMxBpIR7o4nrm8uA==",
+            "version": "4.39.0",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.39.0.tgz",
+            "integrity": "sha512-t7j5Zhr7S4bBtksT73bO6c3Qa2AV/HqiGlj9+KB3gNF5upcVkx+HLgxTm8DK4OkzsOYqbdqbLKwvGMhylJCPhQ==",
+            "cpu": [
+                "riscv64"
+            ],
+            "dev": true,
+            "license": "MIT",
+            "optional": true,
+            "os": [
+                "linux"
+            ]
+        },
+        "node_modules/@rollup/rollup-linux-riscv64-musl": {
+            "version": "4.39.0",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.39.0.tgz",
+            "integrity": "sha512-m6cwI86IvQ7M93MQ2RF5SP8tUjD39Y7rjb1qjHgYh28uAPVU8+k/xYWvxRO3/tBN2pZkSMa5RjnPuUIbrwVxeA==",
             "cpu": [
                 "riscv64"
             ],
@@ -2274,9 +2301,9 @@
             ]
         },
         "node_modules/@rollup/rollup-linux-s390x-gnu": {
-            "version": "4.36.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.36.0.tgz",
-            "integrity": "sha512-4a5gf2jpS0AIe7uBjxDeUMNcFmaRTbNv7NxI5xOCs4lhzsVyGR/0qBXduPnoWf6dGC365saTiwag8hP1imTgag==",
+            "version": "4.39.0",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.39.0.tgz",
+            "integrity": "sha512-iRDJd2ebMunnk2rsSBYlsptCyuINvxUfGwOUldjv5M4tpa93K8tFMeYGpNk2+Nxl+OBJnBzy2/JCscGeO507kA==",
             "cpu": [
                 "s390x"
             ],
@@ -2288,9 +2315,9 @@
             ]
         },
         "node_modules/@rollup/rollup-linux-x64-gnu": {
-            "version": "4.36.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.36.0.tgz",
-            "integrity": "sha512-5KtoW8UWmwFKQ96aQL3LlRXX16IMwyzMq/jSSVIIyAANiE1doaQsx/KRyhAvpHlPjPiSU/AYX/8m+lQ9VToxFQ==",
+            "version": "4.39.0",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.39.0.tgz",
+            "integrity": "sha512-t9jqYw27R6Lx0XKfEFe5vUeEJ5pF3SGIM6gTfONSMb7DuG6z6wfj2yjcoZxHg129veTqU7+wOhY6GX8wmf90dA==",
             "cpu": [
                 "x64"
             ],
@@ -2302,9 +2329,9 @@
             ]
         },
         "node_modules/@rollup/rollup-linux-x64-musl": {
-            "version": "4.36.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.36.0.tgz",
-            "integrity": "sha512-sycrYZPrv2ag4OCvaN5js+f01eoZ2U+RmT5as8vhxiFz+kxwlHrsxOwKPSA8WyS+Wc6Epid9QeI/IkQ9NkgYyQ==",
+            "version": "4.39.0",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.39.0.tgz",
+            "integrity": "sha512-ThFdkrFDP55AIsIZDKSBWEt/JcWlCzydbZHinZ0F/r1h83qbGeenCt/G/wG2O0reuENDD2tawfAj2s8VK7Bugg==",
             "cpu": [
                 "x64"
             ],
@@ -2316,9 +2343,9 @@
             ]
         },
         "node_modules/@rollup/rollup-win32-arm64-msvc": {
-            "version": "4.36.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.36.0.tgz",
-            "integrity": "sha512-qbqt4N7tokFwwSVlWDsjfoHgviS3n/vZ8LK0h1uLG9TYIRuUTJC88E1xb3LM2iqZ/WTqNQjYrtmtGmrmmawB6A==",
+            "version": "4.39.0",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.39.0.tgz",
+            "integrity": "sha512-jDrLm6yUtbOg2TYB3sBF3acUnAwsIksEYjLeHL+TJv9jg+TmTwdyjnDex27jqEMakNKf3RwwPahDIt7QXCSqRQ==",
             "cpu": [
                 "arm64"
             ],
@@ -2330,9 +2357,9 @@
             ]
         },
         "node_modules/@rollup/rollup-win32-ia32-msvc": {
-            "version": "4.36.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.36.0.tgz",
-            "integrity": "sha512-t+RY0JuRamIocMuQcfwYSOkmdX9dtkr1PbhKW42AMvaDQa+jOdpUYysroTF/nuPpAaQMWp7ye+ndlmmthieJrQ==",
+            "version": "4.39.0",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.39.0.tgz",
+            "integrity": "sha512-6w9uMuza+LbLCVoNKL5FSLE7yvYkq9laSd09bwS0tMjkwXrmib/4KmoJcrKhLWHvw19mwU+33ndC69T7weNNjQ==",
             "cpu": [
                 "ia32"
             ],
@@ -2344,9 +2371,9 @@
             ]
         },
         "node_modules/@rollup/rollup-win32-x64-msvc": {
-            "version": "4.36.0",
-            "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.36.0.tgz",
-            "integrity": "sha512-aRXd7tRZkWLqGbChgcMMDEHjOKudo1kChb1Jt1IfR8cY/KIpgNviLeJy5FUb9IpSuQj8dU2fAYNMPW/hLKOSTw==",
+            "version": "4.39.0",
+            "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.39.0.tgz",
+            "integrity": "sha512-yAkUOkIKZlK5dl7u6dg897doBgLXmUHhIINM2c+sND3DZwnrdQkkSiDh7N75Ll4mM4dxSkYfXqU9fW3lLkMFug==",
             "cpu": [
                 "x64"
             ],
@@ -2460,9 +2487,9 @@
             }
         },
         "node_modules/@types/babel__traverse": {
-            "version": "7.20.6",
-            "resolved": "https://registry.npmjs.org/@types/babel__traverse/-/babel__traverse-7.20.6.tgz",
-            "integrity": "sha512-r1bzfrm0tomOI8g1SzvCaQHo6Lcv6zu0EA+W2kHrt8dyrHQxGzBBL4kdkzIS+jBMV+EYcMAEAqXqYaLJq5rOZg==",
+            "version": "7.20.7",
+            "resolved": "https://registry.npmjs.org/@types/babel__traverse/-/babel__traverse-7.20.7.tgz",
+            "integrity": "sha512-dkO5fhS7+/oos4ciWxyEyjWe48zmG6wbCheo/G2ZnHx4fs3EU6YC6UM8rk56gAjNJ9P3MTH2jo5jb92/K6wbng==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
@@ -2476,9 +2503,9 @@
             "license": "MIT"
         },
         "node_modules/@types/estree": {
-            "version": "1.0.6",
-            "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.6.tgz",
-            "integrity": "sha512-AYnb1nQyY49te+VRAVgmzfcgjYS91mY5P0TKUDCLEM+gNnA+3T6rWITXRLYCpahpqSQbN5cE+gHpnPyXjHWxcw==",
+            "version": "1.0.7",
+            "resolved": "https://registry.npmjs.org/@types/estree/-/estree-1.0.7.tgz",
+            "integrity": "sha512-w28IoSUCJpidD/TGviZwwMJckNESJZXFu7NBZ5YJ4mEUnNraUn9Pm8HSZm/jDF1pDWYKspWE7oVphigUPRakIQ==",
             "dev": true,
             "license": "MIT"
         },
@@ -2490,19 +2517,19 @@
             "license": "MIT"
         },
         "node_modules/@types/luxon": {
-            "version": "3.4.2",
-            "resolved": "https://registry.npmjs.org/@types/luxon/-/luxon-3.4.2.tgz",
-            "integrity": "sha512-TifLZlFudklWlMBfhubvgqTXRzLDI5pCbGa4P8a3wPyUQSW+1xQ5eDsreP9DWHX3tjq1ke96uYG/nwundroWcA==",
+            "version": "3.6.0",
+            "resolved": "https://registry.npmjs.org/@types/luxon/-/luxon-3.6.0.tgz",
+            "integrity": "sha512-RtEj20xRyG7cRp142MkQpV3GRF8Wo2MtDkKLz65MQs7rM1Lh8bz+HtfPXCCJEYpnDFu6VwAq/Iv2Ikyp9Jw/hw==",
             "license": "MIT"
         },
         "node_modules/@types/node": {
-            "version": "22.13.11",
-            "resolved": "https://registry.npmjs.org/@types/node/-/node-22.13.11.tgz",
-            "integrity": "sha512-iEUCUJoU0i3VnrCmgoWCXttklWcvoCIx4jzcP22fioIVSdTmjgoEvmAO/QPw6TcS9k5FrNgn4w7q5lGOd1CT5g==",
+            "version": "22.14.0",
+            "resolved": "https://registry.npmjs.org/@types/node/-/node-22.14.0.tgz",
+            "integrity": "sha512-Kmpl+z84ILoG+3T/zQFyAJsU6EPTmOCj8/2+83fSN6djd6I4o7uOuGIH6vq3PrjY5BGitSbFuMN18j3iknubbA==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "undici-types": "~6.20.0"
+                "undici-types": "~6.21.0"
             }
         },
         "node_modules/@types/prop-types": {
@@ -2513,9 +2540,9 @@
             "license": "MIT"
         },
         "node_modules/@types/react": {
-            "version": "18.3.19",
-            "resolved": "https://registry.npmjs.org/@types/react/-/react-18.3.19.tgz",
-            "integrity": "sha512-fcdJqaHOMDbiAwJnXv6XCzX0jDW77yI3tJqYh1Byn8EL5/S628WRx9b/y3DnNe55zTukUQKrfYxiZls2dHcUMw==",
+            "version": "18.3.20",
+            "resolved": "https://registry.npmjs.org/@types/react/-/react-18.3.20.tgz",
+            "integrity": "sha512-IPaCZN7PShZK/3t6Q87pfTkRm6oLTd4vztyoj+cbHUF1g3FfVb2tFIL79uCRKEfv16AhqDMBywP2VW3KIZUvcg==",
             "devOptional": true,
             "license": "MIT",
             "dependencies": {
@@ -2524,9 +2551,9 @@
             }
         },
         "node_modules/@types/react-dom": {
-            "version": "18.3.5",
-            "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-18.3.5.tgz",
-            "integrity": "sha512-P4t6saawp+b/dFrUr2cvkVsfvPguwsxtH6dNIYRllMsefqFzkZk5UIjzyDOv5g1dXIPdG4Sp1yCR4Z6RCUsG/Q==",
+            "version": "18.3.6",
+            "resolved": "https://registry.npmjs.org/@types/react-dom/-/react-dom-18.3.6.tgz",
+            "integrity": "sha512-nf22//wEbKXusP6E9pfOCDwFdHAX4u172eaJI4YkDRQEZiorm6KfYnSC2SWLDMVWUOWPERmJnN0ujeAfTBLvrw==",
             "devOptional": true,
             "license": "MIT",
             "peerDependencies": {
@@ -2541,17 +2568,17 @@
             "license": "MIT"
         },
         "node_modules/@typescript-eslint/eslint-plugin": {
-            "version": "8.27.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.27.0.tgz",
-            "integrity": "sha512-4henw4zkePi5p252c8ncBLzLce52SEUz2Ebj8faDnuUXz2UuHEONYcJ+G0oaCF+bYCWVZtrGzq3FD7YXetmnSA==",
+            "version": "8.29.0",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.29.0.tgz",
+            "integrity": "sha512-PAIpk/U7NIS6H7TEtN45SPGLQaHNgB7wSjsQV/8+KYokAb2T/gloOA/Bee2yd4/yKVhPKe5LlaUGhAZk5zmSaQ==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
                 "@eslint-community/regexpp": "^4.10.0",
-                "@typescript-eslint/scope-manager": "8.27.0",
-                "@typescript-eslint/type-utils": "8.27.0",
-                "@typescript-eslint/utils": "8.27.0",
-                "@typescript-eslint/visitor-keys": "8.27.0",
+                "@typescript-eslint/scope-manager": "8.29.0",
+                "@typescript-eslint/type-utils": "8.29.0",
+                "@typescript-eslint/utils": "8.29.0",
+                "@typescript-eslint/visitor-keys": "8.29.0",
                 "graphemer": "^1.4.0",
                 "ignore": "^5.3.1",
                 "natural-compare": "^1.4.0",
@@ -2571,16 +2598,16 @@
             }
         },
         "node_modules/@typescript-eslint/parser": {
-            "version": "8.27.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.27.0.tgz",
-            "integrity": "sha512-XGwIabPallYipmcOk45DpsBSgLC64A0yvdAkrwEzwZ2viqGqRUJ8eEYoPz0CWnutgAFbNMPdsGGvzjSmcWVlEA==",
+            "version": "8.29.0",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.29.0.tgz",
+            "integrity": "sha512-8C0+jlNJOwQso2GapCVWWfW/rzaq7Lbme+vGUFKE31djwNncIpgXD7Cd4weEsDdkoZDjH0lwwr3QDQFuyrMg9g==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@typescript-eslint/scope-manager": "8.27.0",
-                "@typescript-eslint/types": "8.27.0",
-                "@typescript-eslint/typescript-estree": "8.27.0",
-                "@typescript-eslint/visitor-keys": "8.27.0",
+                "@typescript-eslint/scope-manager": "8.29.0",
+                "@typescript-eslint/types": "8.29.0",
+                "@typescript-eslint/typescript-estree": "8.29.0",
+                "@typescript-eslint/visitor-keys": "8.29.0",
                 "debug": "^4.3.4"
             },
             "engines": {
@@ -2596,14 +2623,14 @@
             }
         },
         "node_modules/@typescript-eslint/scope-manager": {
-            "version": "8.27.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.27.0.tgz",
-            "integrity": "sha512-8oI9GwPMQmBryaaxG1tOZdxXVeMDte6NyJA4i7/TWa4fBwgnAXYlIQP+uYOeqAaLJ2JRxlG9CAyL+C+YE9Xknw==",
+            "version": "8.29.0",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.29.0.tgz",
+            "integrity": "sha512-aO1PVsq7Gm+tcghabUpzEnVSFMCU4/nYIgC2GOatJcllvWfnhrgW0ZEbnTxm36QsikmCN1K/6ZgM7fok2I7xNw==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@typescript-eslint/types": "8.27.0",
-                "@typescript-eslint/visitor-keys": "8.27.0"
+                "@typescript-eslint/types": "8.29.0",
+                "@typescript-eslint/visitor-keys": "8.29.0"
             },
             "engines": {
                 "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -2614,14 +2641,14 @@
             }
         },
         "node_modules/@typescript-eslint/type-utils": {
-            "version": "8.27.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.27.0.tgz",
-            "integrity": "sha512-wVArTVcz1oJOIEJxui/nRhV0TXzD/zMSOYi/ggCfNq78EIszddXcJb7r4RCp/oBrjt8n9A0BSxRMKxHftpDxDA==",
+            "version": "8.29.0",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.29.0.tgz",
+            "integrity": "sha512-ahaWQ42JAOx+NKEf5++WC/ua17q5l+j1GFrbbpVKzFL/tKVc0aYY8rVSYUpUvt2hUP1YBr7mwXzx+E/DfUWI9Q==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@typescript-eslint/typescript-estree": "8.27.0",
-                "@typescript-eslint/utils": "8.27.0",
+                "@typescript-eslint/typescript-estree": "8.29.0",
+                "@typescript-eslint/utils": "8.29.0",
                 "debug": "^4.3.4",
                 "ts-api-utils": "^2.0.1"
             },
@@ -2638,9 +2665,9 @@
             }
         },
         "node_modules/@typescript-eslint/types": {
-            "version": "8.27.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.27.0.tgz",
-            "integrity": "sha512-/6cp9yL72yUHAYq9g6DsAU+vVfvQmd1a8KyA81uvfDE21O2DwQ/qxlM4AR8TSdAu+kJLBDrEHKC5/W2/nxsY0A==",
+            "version": "8.29.0",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.29.0.tgz",
+            "integrity": "sha512-wcJL/+cOXV+RE3gjCyl/V2G877+2faqvlgtso/ZRbTCnZazh0gXhe+7gbAnfubzN2bNsBtZjDvlh7ero8uIbzg==",
             "dev": true,
             "license": "MIT",
             "engines": {
@@ -2652,14 +2679,14 @@
             }
         },
         "node_modules/@typescript-eslint/typescript-estree": {
-            "version": "8.27.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.27.0.tgz",
-            "integrity": "sha512-BnKq8cqPVoMw71O38a1tEb6iebEgGA80icSxW7g+kndx0o6ot6696HjG7NdgfuAVmVEtwXUr3L8R9ZuVjoQL6A==",
+            "version": "8.29.0",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.29.0.tgz",
+            "integrity": "sha512-yOfen3jE9ISZR/hHpU/bmNvTtBW1NjRbkSFdZOksL1N+ybPEE7UVGMwqvS6CP022Rp00Sb0tdiIkhSCe6NI8ow==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@typescript-eslint/types": "8.27.0",
-                "@typescript-eslint/visitor-keys": "8.27.0",
+                "@typescript-eslint/types": "8.29.0",
+                "@typescript-eslint/visitor-keys": "8.29.0",
                 "debug": "^4.3.4",
                 "fast-glob": "^3.3.2",
                 "is-glob": "^4.0.3",
@@ -2718,16 +2745,16 @@
             }
         },
         "node_modules/@typescript-eslint/utils": {
-            "version": "8.27.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.27.0.tgz",
-            "integrity": "sha512-njkodcwH1yvmo31YWgRHNb/x1Xhhq4/m81PhtvmRngD8iHPehxffz1SNCO+kwaePhATC+kOa/ggmvPoPza5i0Q==",
+            "version": "8.29.0",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.29.0.tgz",
+            "integrity": "sha512-gX/A0Mz9Bskm8avSWFcK0gP7cZpbY4AIo6B0hWYFCaIsz750oaiWR4Jr2CI+PQhfW1CpcQr9OlfPS+kMFegjXA==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
                 "@eslint-community/eslint-utils": "^4.4.0",
-                "@typescript-eslint/scope-manager": "8.27.0",
-                "@typescript-eslint/types": "8.27.0",
-                "@typescript-eslint/typescript-estree": "8.27.0"
+                "@typescript-eslint/scope-manager": "8.29.0",
+                "@typescript-eslint/types": "8.29.0",
+                "@typescript-eslint/typescript-estree": "8.29.0"
             },
             "engines": {
                 "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -2742,13 +2769,13 @@
             }
         },
         "node_modules/@typescript-eslint/visitor-keys": {
-            "version": "8.27.0",
-            "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.27.0.tgz",
-            "integrity": "sha512-WsXQwMkILJvffP6z4U3FYJPlbf/j07HIxmDjZpbNvBJkMfvwXj5ACRkkHwBDvLBbDbtX5TdU64/rcvKJ/vuInQ==",
+            "version": "8.29.0",
+            "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.29.0.tgz",
+            "integrity": "sha512-Sne/pVz8ryR03NFK21VpN88dZ2FdQXOlq3VIklbrTYEt8yXtRFr9tvUhqvCeKjqYk5FSim37sHbooT6vzBTZcg==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@typescript-eslint/types": "8.27.0",
+                "@typescript-eslint/types": "8.29.0",
                 "eslint-visitor-keys": "^4.2.0"
             },
             "engines": {
@@ -3053,9 +3080,9 @@
             }
         },
         "node_modules/caniuse-lite": {
-            "version": "1.0.30001706",
-            "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001706.tgz",
-            "integrity": "sha512-3ZczoTApMAZwPKYWmwVbQMFpXBDds3/0VciVoUwPUbldlYyVLmRVuRs/PcUZtHpbLRpzzDvrvnFuREsGt6lUug==",
+            "version": "1.0.30001707",
+            "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001707.tgz",
+            "integrity": "sha512-3qtRjw/HQSMlDWf+X79N206fepf4SOOU6SQLMaq/0KkZLmSjPxAkBOQQ+FxbHKfHmYLZFfdWsO3KA90ceHPSnw==",
             "dev": true,
             "funding": [
                 {
@@ -3438,9 +3465,9 @@
             "license": "MIT"
         },
         "node_modules/electron-to-chromium": {
-            "version": "1.5.123",
-            "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.123.tgz",
-            "integrity": "sha512-refir3NlutEZqlKaBLK0tzlVLe5P2wDKS7UQt/3SpibizgsRAPOsqQC3ffw1nlv3ze5gjRQZYHoPymgVZkplFA==",
+            "version": "1.5.129",
+            "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.129.tgz",
+            "integrity": "sha512-JlXUemX4s0+9f8mLqib/bHH8gOHf5elKS6KeWG3sk3xozb/JTq/RLXIv8OKUWiK4Ah00Wm88EFj5PYkFr4RUPA==",
             "dev": true,
             "license": "ISC"
         },
@@ -3478,9 +3505,9 @@
             "license": "MIT"
         },
         "node_modules/esbuild": {
-            "version": "0.25.1",
-            "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.1.tgz",
-            "integrity": "sha512-BGO5LtrGC7vxnqucAe/rmvKdJllfGaYWdyABvyMoXQlfYMb2bbRuReWR5tEGE//4LcNJj9XrkovTqNYRFZHAMQ==",
+            "version": "0.25.2",
+            "resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.25.2.tgz",
+            "integrity": "sha512-16854zccKPnC+toMywC+uKNeYSv+/eXkevRAfwRD/G9Cleq66m8XFIrigkbvauLLlCfDL45Q2cWegSg53gGBnQ==",
             "dev": true,
             "hasInstallScript": true,
             "license": "MIT",
@@ -3491,31 +3518,31 @@
                 "node": ">=18"
             },
             "optionalDependencies": {
-                "@esbuild/aix-ppc64": "0.25.1",
-                "@esbuild/android-arm": "0.25.1",
-                "@esbuild/android-arm64": "0.25.1",
-                "@esbuild/android-x64": "0.25.1",
-                "@esbuild/darwin-arm64": "0.25.1",
-                "@esbuild/darwin-x64": "0.25.1",
-                "@esbuild/freebsd-arm64": "0.25.1",
-                "@esbuild/freebsd-x64": "0.25.1",
-                "@esbuild/linux-arm": "0.25.1",
-                "@esbuild/linux-arm64": "0.25.1",
-                "@esbuild/linux-ia32": "0.25.1",
-                "@esbuild/linux-loong64": "0.25.1",
-                "@esbuild/linux-mips64el": "0.25.1",
-                "@esbuild/linux-ppc64": "0.25.1",
-                "@esbuild/linux-riscv64": "0.25.1",
-                "@esbuild/linux-s390x": "0.25.1",
-                "@esbuild/linux-x64": "0.25.1",
-                "@esbuild/netbsd-arm64": "0.25.1",
-                "@esbuild/netbsd-x64": "0.25.1",
-                "@esbuild/openbsd-arm64": "0.25.1",
-                "@esbuild/openbsd-x64": "0.25.1",
-                "@esbuild/sunos-x64": "0.25.1",
-                "@esbuild/win32-arm64": "0.25.1",
-                "@esbuild/win32-ia32": "0.25.1",
-                "@esbuild/win32-x64": "0.25.1"
+                "@esbuild/aix-ppc64": "0.25.2",
+                "@esbuild/android-arm": "0.25.2",
+                "@esbuild/android-arm64": "0.25.2",
+                "@esbuild/android-x64": "0.25.2",
+                "@esbuild/darwin-arm64": "0.25.2",
+                "@esbuild/darwin-x64": "0.25.2",
+                "@esbuild/freebsd-arm64": "0.25.2",
+                "@esbuild/freebsd-x64": "0.25.2",
+                "@esbuild/linux-arm": "0.25.2",
+                "@esbuild/linux-arm64": "0.25.2",
+                "@esbuild/linux-ia32": "0.25.2",
+                "@esbuild/linux-loong64": "0.25.2",
+                "@esbuild/linux-mips64el": "0.25.2",
+                "@esbuild/linux-ppc64": "0.25.2",
+                "@esbuild/linux-riscv64": "0.25.2",
+                "@esbuild/linux-s390x": "0.25.2",
+                "@esbuild/linux-x64": "0.25.2",
+                "@esbuild/netbsd-arm64": "0.25.2",
+                "@esbuild/netbsd-x64": "0.25.2",
+                "@esbuild/openbsd-arm64": "0.25.2",
+                "@esbuild/openbsd-x64": "0.25.2",
+                "@esbuild/sunos-x64": "0.25.2",
+                "@esbuild/win32-arm64": "0.25.2",
+                "@esbuild/win32-ia32": "0.25.2",
+                "@esbuild/win32-x64": "0.25.2"
             }
         },
         "node_modules/escalade": {
@@ -4463,9 +4490,9 @@
             }
         },
         "node_modules/luxon": {
-            "version": "3.5.0",
-            "resolved": "https://registry.npmjs.org/luxon/-/luxon-3.5.0.tgz",
-            "integrity": "sha512-rh+Zjr6DNfUYR3bPwJEnuwDdqMbxZW7LOQfUN4B54+Cl+0o5zaU9RJ6bcidfDtC1cWCZXQ+nvX8bf6bAji37QQ==",
+            "version": "3.6.1",
+            "resolved": "https://registry.npmjs.org/luxon/-/luxon-3.6.1.tgz",
+            "integrity": "sha512-tJLxrKJhO2ukZ5z0gyjY1zPh3Rh88Ej9P7jNrZiHMUXHae1yvI2imgOZtL1TO8TW6biMMKfTtAOoEJANgtWBMQ==",
             "license": "MIT",
             "engines": {
                 "node": ">=12"
@@ -4938,9 +4965,9 @@
             }
         },
         "node_modules/pirates": {
-            "version": "4.0.6",
-            "resolved": "https://registry.npmjs.org/pirates/-/pirates-4.0.6.tgz",
-            "integrity": "sha512-saLsH7WeYYPiD25LDuLRRY/i+6HaPYr6G1OUlN39otzkSTxKnubR9RTxS3/Kk50s1g2JTgFwWQDQyplC5/SHZg==",
+            "version": "4.0.7",
+            "resolved": "https://registry.npmjs.org/pirates/-/pirates-4.0.7.tgz",
+            "integrity": "sha512-TfySrs/5nm8fQJDcBDuUng3VOUKsd7S+zqvbOTiGXHfxX4wK31ard+hoNuvkicM/2YFzlpDgABOevKSsB4G/FA==",
             "license": "MIT",
             "engines": {
                 "node": ">= 6"
@@ -5223,30 +5250,30 @@
             "license": "MIT"
         },
         "node_modules/react": {
-            "version": "19.0.0",
-            "resolved": "https://registry.npmjs.org/react/-/react-19.0.0.tgz",
-            "integrity": "sha512-V8AVnmPIICiWpGfm6GLzCR/W5FXLchHop40W4nXBmdlEceh16rCN8O8LNWm5bh5XUX91fh7KpA+W0TgMKmgTpQ==",
+            "version": "19.1.0",
+            "resolved": "https://registry.npmjs.org/react/-/react-19.1.0.tgz",
+            "integrity": "sha512-FS+XFBNvn3GTAWq26joslQgWNoFu08F4kl0J4CgdNKADkdSGXQyTCnKteIAJy96Br6YbpEU1LSzV5dYtjMkMDg==",
             "license": "MIT",
             "engines": {
                 "node": ">=0.10.0"
             }
         },
         "node_modules/react-dom": {
-            "version": "19.0.0",
-            "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.0.0.tgz",
-            "integrity": "sha512-4GV5sHFG0e/0AD4X+ySy6UJd3jVl1iNsNHdpad0qhABJ11twS3TTBnseqsKurKcsNqCEFeGL3uLpVChpIO3QfQ==",
+            "version": "19.1.0",
+            "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-19.1.0.tgz",
+            "integrity": "sha512-Xs1hdnE+DyKgeHJeJznQmYMIBG3TKIHJJT95Q58nHLSrElKlGQqDTR2HQ9fx5CN/Gk6Vh/kupBTDLU11/nDk/g==",
             "license": "MIT",
             "dependencies": {
-                "scheduler": "^0.25.0"
+                "scheduler": "^0.26.0"
             },
             "peerDependencies": {
-                "react": "^19.0.0"
+                "react": "^19.1.0"
             }
         },
         "node_modules/react-hook-form": {
-            "version": "7.54.2",
-            "resolved": "https://registry.npmjs.org/react-hook-form/-/react-hook-form-7.54.2.tgz",
-            "integrity": "sha512-eHpAUgUjWbZocoQYUHposymRb4ZP6d0uwUnooL2uOybA9/3tPUvoAKqEWK1WaSiTxxOfTpffNZP7QwlnM3/gEg==",
+            "version": "7.55.0",
+            "resolved": "https://registry.npmjs.org/react-hook-form/-/react-hook-form-7.55.0.tgz",
+            "integrity": "sha512-XRnjsH3GVMQz1moZTW53MxfoWN7aDpUg/GpVNc4A3eXRVNdGXfbzJ4vM4aLQ8g6XCUh1nIbx70aaNCl7kxnjog==",
             "license": "MIT",
             "engines": {
                 "node": ">=18.0.0"
@@ -5339,9 +5366,9 @@
             }
         },
         "node_modules/react-router": {
-            "version": "7.4.0",
-            "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.4.0.tgz",
-            "integrity": "sha512-Y2g5ObjkvX3VFeVt+0CIPuYd9PpgqCslG7ASSIdN73LwA1nNWzcMLaoMRJfP3prZFI92svxFwbn7XkLJ+UPQ6A==",
+            "version": "7.4.1",
+            "resolved": "https://registry.npmjs.org/react-router/-/react-router-7.4.1.tgz",
+            "integrity": "sha512-Vmizn9ZNzxfh3cumddqv3kLOKvc7AskUT0dC1prTabhiEi0U4A33LmkDOJ79tXaeSqCqMBXBU/ySX88W85+EUg==",
             "license": "MIT",
             "dependencies": {
                 "@types/cookie": "^0.6.0",
@@ -5363,12 +5390,12 @@
             }
         },
         "node_modules/react-router-dom": {
-            "version": "7.4.0",
-            "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.4.0.tgz",
-            "integrity": "sha512-VlksBPf3n2bijPvnA7nkTsXxMAKOj+bWp4R9c3i+bnwlSOFAGOkJkKhzy/OsRkWaBMICqcAl1JDzh9ZSOze9CA==",
+            "version": "7.4.1",
+            "resolved": "https://registry.npmjs.org/react-router-dom/-/react-router-dom-7.4.1.tgz",
+            "integrity": "sha512-L3/4tig0Lvs6m6THK0HRV4eHUdpx0dlJasgCxXKnavwhh4tKYgpuZk75HRYNoRKDyDWi9QgzGXsQ1oQSBlWpAA==",
             "license": "MIT",
             "dependencies": {
-                "react-router": "7.4.0"
+                "react-router": "7.4.1"
             },
             "engines": {
                 "node": ">=20.0.0"
@@ -5401,9 +5428,9 @@
             }
         },
         "node_modules/react-virtuoso": {
-            "version": "4.12.5",
-            "resolved": "https://registry.npmjs.org/react-virtuoso/-/react-virtuoso-4.12.5.tgz",
-            "integrity": "sha512-YeCbRRsC9CLf0buD0Rct7WsDbzf+yBU1wGbo05/XjbcN2nJuhgh040m3y3+6HVogTZxEqVm45ac9Fpae4/MxRQ==",
+            "version": "4.12.6",
+            "resolved": "https://registry.npmjs.org/react-virtuoso/-/react-virtuoso-4.12.6.tgz",
+            "integrity": "sha512-bfvS6aCL1ehXmq39KRiz/vxznGUbtA27I5I24TYCe1DhMf84O3aVNCIwrSjYQjkJGJGzY46ihdN8WkYlemuhMQ==",
             "license": "MIT",
             "peerDependencies": {
                 "react": ">=16 || >=17 || >= 18 || >= 19",
@@ -5498,13 +5525,13 @@
             }
         },
         "node_modules/rollup": {
-            "version": "4.36.0",
-            "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.36.0.tgz",
-            "integrity": "sha512-zwATAXNQxUcd40zgtQG0ZafcRK4g004WtEl7kbuhTWPvf07PsfohXl39jVUvPF7jvNAIkKPQ2XrsDlWuxBd++Q==",
+            "version": "4.39.0",
+            "resolved": "https://registry.npmjs.org/rollup/-/rollup-4.39.0.tgz",
+            "integrity": "sha512-thI8kNc02yNvnmJp8dr3fNWJ9tCONDhp6TV35X6HkKGGs9E6q7YWCHbe5vKiTa7TAiNcFEmXKj3X/pG2b3ci0g==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@types/estree": "1.0.6"
+                "@types/estree": "1.0.7"
             },
             "bin": {
                 "rollup": "dist/bin/rollup"
@@ -5514,25 +5541,26 @@
                 "npm": ">=8.0.0"
             },
             "optionalDependencies": {
-                "@rollup/rollup-android-arm-eabi": "4.36.0",
-                "@rollup/rollup-android-arm64": "4.36.0",
-                "@rollup/rollup-darwin-arm64": "4.36.0",
-                "@rollup/rollup-darwin-x64": "4.36.0",
-                "@rollup/rollup-freebsd-arm64": "4.36.0",
-                "@rollup/rollup-freebsd-x64": "4.36.0",
-                "@rollup/rollup-linux-arm-gnueabihf": "4.36.0",
-                "@rollup/rollup-linux-arm-musleabihf": "4.36.0",
-                "@rollup/rollup-linux-arm64-gnu": "4.36.0",
-                "@rollup/rollup-linux-arm64-musl": "4.36.0",
-                "@rollup/rollup-linux-loongarch64-gnu": "4.36.0",
-                "@rollup/rollup-linux-powerpc64le-gnu": "4.36.0",
-                "@rollup/rollup-linux-riscv64-gnu": "4.36.0",
-                "@rollup/rollup-linux-s390x-gnu": "4.36.0",
-                "@rollup/rollup-linux-x64-gnu": "4.36.0",
-                "@rollup/rollup-linux-x64-musl": "4.36.0",
-                "@rollup/rollup-win32-arm64-msvc": "4.36.0",
-                "@rollup/rollup-win32-ia32-msvc": "4.36.0",
-                "@rollup/rollup-win32-x64-msvc": "4.36.0",
+                "@rollup/rollup-android-arm-eabi": "4.39.0",
+                "@rollup/rollup-android-arm64": "4.39.0",
+                "@rollup/rollup-darwin-arm64": "4.39.0",
+                "@rollup/rollup-darwin-x64": "4.39.0",
+                "@rollup/rollup-freebsd-arm64": "4.39.0",
+                "@rollup/rollup-freebsd-x64": "4.39.0",
+                "@rollup/rollup-linux-arm-gnueabihf": "4.39.0",
+                "@rollup/rollup-linux-arm-musleabihf": "4.39.0",
+                "@rollup/rollup-linux-arm64-gnu": "4.39.0",
+                "@rollup/rollup-linux-arm64-musl": "4.39.0",
+                "@rollup/rollup-linux-loongarch64-gnu": "4.39.0",
+                "@rollup/rollup-linux-powerpc64le-gnu": "4.39.0",
+                "@rollup/rollup-linux-riscv64-gnu": "4.39.0",
+                "@rollup/rollup-linux-riscv64-musl": "4.39.0",
+                "@rollup/rollup-linux-s390x-gnu": "4.39.0",
+                "@rollup/rollup-linux-x64-gnu": "4.39.0",
+                "@rollup/rollup-linux-x64-musl": "4.39.0",
+                "@rollup/rollup-win32-arm64-msvc": "4.39.0",
+                "@rollup/rollup-win32-ia32-msvc": "4.39.0",
+                "@rollup/rollup-win32-x64-msvc": "4.39.0",
                 "fsevents": "~2.3.2"
             }
         },
@@ -5560,9 +5588,9 @@
             }
         },
         "node_modules/scheduler": {
-            "version": "0.25.0",
-            "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.25.0.tgz",
-            "integrity": "sha512-xFVuu11jh+xcO7JOAGJNOXld8/TcEHK/4CituBUeUb5hqxJLj9YuemAEuvm9gQ/+pgXYfbQuqAkiYu+u7YEsNA==",
+            "version": "0.26.0",
+            "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.26.0.tgz",
+            "integrity": "sha512-NlHwttCI/l5gCPR3D1nNXtWABUmBwvZpEQiD4IXSbIDq8BzLIK/7Ir5gTFSGZDUu37K5cMNp0hFtzO38sC7gWA==",
             "license": "MIT"
         },
         "node_modules/semver": {
@@ -5857,9 +5885,9 @@
             "license": "ISC"
         },
         "node_modules/swagger-typescript-api": {
-            "version": "13.0.24",
-            "resolved": "https://registry.npmjs.org/swagger-typescript-api/-/swagger-typescript-api-13.0.24.tgz",
-            "integrity": "sha512-gr0bz8RNgRswiY8hEJghPVC5Sv1D2dbePiYsfZavlg5vCUS/xXCdNNW6iKLx8yRYV7qo+tyRT31DEEzZPB3eEA==",
+            "version": "13.0.28",
+            "resolved": "https://registry.npmjs.org/swagger-typescript-api/-/swagger-typescript-api-13.0.28.tgz",
+            "integrity": "sha512-8IwPD6nCFDTtzSl8rS7xlAx0NGMpBUlFfccJwgMV7t8d/nKw1yQWPVdC7h94XDsDPrLFvICd5xAJJm2TK2Pcpw==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
@@ -6129,15 +6157,15 @@
             }
         },
         "node_modules/typescript-eslint": {
-            "version": "8.27.0",
-            "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.27.0.tgz",
-            "integrity": "sha512-ZZ/8+Y0rRUMuW1gJaPtLWe4ryHbsPLzzibk5Sq+IFa2aOH1Vo0gPr1fbA6pOnzBke7zC2Da4w8AyCgxKXo3lqA==",
+            "version": "8.29.0",
+            "resolved": "https://registry.npmjs.org/typescript-eslint/-/typescript-eslint-8.29.0.tgz",
+            "integrity": "sha512-ep9rVd9B4kQsZ7ZnWCVxUE/xDLUUUsRzE0poAeNu+4CkFErLfuvPt/qtm2EpnSyfvsR0S6QzDFSrPCFBwf64fg==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "@typescript-eslint/eslint-plugin": "8.27.0",
-                "@typescript-eslint/parser": "8.27.0",
-                "@typescript-eslint/utils": "8.27.0"
+                "@typescript-eslint/eslint-plugin": "8.29.0",
+                "@typescript-eslint/parser": "8.29.0",
+                "@typescript-eslint/utils": "8.29.0"
             },
             "engines": {
                 "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -6152,9 +6180,9 @@
             }
         },
         "node_modules/undici-types": {
-            "version": "6.20.0",
-            "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.20.0.tgz",
-            "integrity": "sha512-Ny6QZ2Nju20vw1SRHe3d9jVu6gJ+4e3+MMpqu7pqE5HT6WsTSlce++GQmK5UXS8mzV8DSYHrQH+Xrf2jVcuKNg==",
+            "version": "6.21.0",
+            "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz",
+            "integrity": "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==",
             "dev": true,
             "license": "MIT"
         },
@@ -6243,9 +6271,9 @@
             }
         },
         "node_modules/use-sync-external-store": {
-            "version": "1.4.0",
-            "resolved": "https://registry.npmjs.org/use-sync-external-store/-/use-sync-external-store-1.4.0.tgz",
-            "integrity": "sha512-9WXSPC5fMv61vaupRkCKCxsPxBocVnwakBEkMIHHpkTTg6icbJtg6jzgtLDm4bl3cSHAca52rYWih0k4K3PfHw==",
+            "version": "1.5.0",
+            "resolved": "https://registry.npmjs.org/use-sync-external-store/-/use-sync-external-store-1.5.0.tgz",
+            "integrity": "sha512-Rb46I4cGGVBmjamjphe8L/UnvJD+uPPtTkNvX5mZgqdbavhI4EbgIWJiIHXJ8bc/i9EQGPRh4DwEURJ552Do0A==",
             "license": "MIT",
             "peerDependencies": {
                 "react": "^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0"
@@ -6271,9 +6299,9 @@
             }
         },
         "node_modules/vite": {
-            "version": "6.2.2",
-            "resolved": "https://registry.npmjs.org/vite/-/vite-6.2.2.tgz",
-            "integrity": "sha512-yW7PeMM+LkDzc7CgJuRLMW2Jz0FxMOsVJ8Lv3gpgW9WLcb9cTW+121UEr1hvmfR7w3SegR5ItvYyzVz1vxNJgQ==",
+            "version": "6.2.4",
+            "resolved": "https://registry.npmjs.org/vite/-/vite-6.2.4.tgz",
+            "integrity": "sha512-veHMSew8CcRzhL5o8ONjy8gkfmFJAd5Ac16oxBUjlwgX3Gq2Wqr+qNC3TjPIpy7TPV/KporLga5GT9HqdrCizw==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
@@ -6500,9 +6528,9 @@
             "license": "ISC"
         },
         "node_modules/yaml": {
-            "version": "2.7.0",
-            "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.7.0.tgz",
-            "integrity": "sha512-+hSoy/QHluxmC9kCIJyL/uyFmLmc+e5CFR5Wa+bpIhIj85LVb9ZH2nVnqrHoSvKogwODv0ClqZkmiSSaIH5LTA==",
+            "version": "2.7.1",
+            "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.7.1.tgz",
+            "integrity": "sha512-10ULxpnOCQXxJvBgxsn9ptjq6uviG/htZKk9veJGhlqn3w/DxQ631zFF+nlQXLwmImeS5amR2dl2U8sg6U9jsQ==",
             "license": "ISC",
             "bin": {
                 "yaml": "bin.mjs"
diff --git a/pkgs/by-name/ne/nezha-theme-admin/package.nix b/pkgs/by-name/ne/nezha-theme-admin/package.nix
index a305dfc8980b..759235b00d46 100644
--- a/pkgs/by-name/ne/nezha-theme-admin/package.nix
+++ b/pkgs/by-name/ne/nezha-theme-admin/package.nix
@@ -7,13 +7,13 @@
 
 buildNpmPackage rec {
   pname = "nezha-theme-admin";
-  version = "1.10.0";
+  version = "1.10.4";
 
   src = fetchFromGitHub {
     owner = "nezhahq";
     repo = "admin-frontend";
     tag = "v${version}";
-    hash = "sha256-WA7NkXIJEtXRp+Nky5PjCl6afmnpj8p7TNrOuTNyQ/E=";
+    hash = "sha256-TT/WCeHYi/Q5zpB8DCdJdAv8sJsm4J7q596qOqbCH4E=";
   };
 
   # TODO: Switch to the bun build function once available in nixpkgs
@@ -21,7 +21,7 @@ buildNpmPackage rec {
     cp ${./package-lock.json} package-lock.json
   '';
 
-  npmDepsHash = "sha256-6lt2Z4RvVHaQ9MZs0D4BT7Rmwf9G79pdnp6l0ItFXeY=";
+  npmDepsHash = "sha256-vkToSpCqsXrbjMxmnlyBGeiWTQaQC04XBnCRtn9lEQU=";
 
   npmPackFlags = [ "--ignore-scripts" ];
 
diff --git a/pkgs/by-name/oc/ocis-bin/update.py b/pkgs/by-name/oc/ocis-bin/update.py
deleted file mode 100755
index e66b39f96f38..000000000000
--- a/pkgs/by-name/oc/ocis-bin/update.py
+++ /dev/null
@@ -1,215 +0,0 @@
-#!/usr/bin/env nix-shell
-##!nix-shell -I nixpkgs=./. -i python3 -p common-updater-scripts gnused nix coreutils python312
-"""
-Updater script for the ocis-bin package.
-
-This script fetches an HTML table from a specified URL and parses it to determine the release type
-(either "Rolling" or "Production") of a given software version. It uses the built-in urllib.request
-for fetching the HTML content and the built-in html.parser for parsing the HTML. By relying only on
-standard library modules, we avoid dependencies on third-party libraries, which simplifies deployment
-and improves portability.
-"""
-import urllib.request
-import os
-import subprocess
-import json
-import sys
-from datetime import datetime
-from html.parser import HTMLParser
-
-TRACKING_CHANNEL = "Production"  # Either Rolling or Production
-
-GITHUB_TOKEN = os.getenv("GITHUB_TOKEN", None)
-
-
-class TableParser(HTMLParser):
-    def __init__(self, version):
-        super().__init__()
-        self.version = version
-        self.in_td = False
-        self.current_row = []
-        self.release_type = None
-        self.in_target_row = False
-
-    def handle_starttag(self, tag, attrs):
-        if tag == "td":
-            self.in_td = True
-
-        if tag == "a":
-            href = dict(attrs).get("href", "")
-            if self.version in href:
-                self.in_target_row = True
-
-    def handle_endtag(self, tag):
-        if tag == "td":
-            self.in_td = False
-
-        if tag == "tr" and self.in_target_row:
-            self.release_type = self.current_row[1]
-            self.in_target_row = False
-
-        if tag == "tr":
-            self.current_row = []
-
-    def handle_data(self, data):
-        if self.in_td:
-            self.current_row.append(data.strip())
-
-
-def get_release_type(content, version):
-    parser = TableParser(version)
-    parser.feed(content)
-    return parser.release_type
-
-
-def get_latest_version():
-    url = "https://api.github.com/repos/owncloud/ocis/releases?per_page=1"
-    req = urllib.request.Request(url)
-
-    if GITHUB_TOKEN:
-        req.add_header("Authorization", f"Bearer {GITHUB_TOKEN}")
-
-    with urllib.request.urlopen(req) as response:
-        if response.status != 200:
-            raise Exception(f"HTTP request failed with status {response.status}")
-
-        data = response.read()
-        releases = json.loads(data)
-        latest_version = releases[0]["tag_name"].lstrip("v")
-
-    return latest_version
-
-
-def get_all_versions():
-    url = "https://api.github.com/repos/owncloud/ocis/releases"
-    req = urllib.request.Request(url)
-
-    if GITHUB_TOKEN:
-        req.add_header("Authorization", f"Bearer {GITHUB_TOKEN}")
-
-    with urllib.request.urlopen(req) as response:
-        if response.status != 200:
-            raise Exception(f"HTTP request failed with status {response.status}")
-
-        data = response.read()
-        releases = json.loads(data)
-
-        versions = []
-        for release in releases:
-            version = release["tag_name"].lstrip("v")
-            published_date = datetime.strptime(
-                release["published_at"], "%Y-%m-%dT%H:%M:%SZ"
-            )
-            versions.append({"version": version, "published_date": published_date})
-
-    return versions
-
-
-def get_current_version():
-    result = subprocess.run(
-        [
-            "nix-instantiate",
-            "--eval",
-            "-E",
-            "with import ./. {}; ocis-bin.version or (lib.getVersion ocis-bin)",
-        ],
-        capture_output=True,
-        text=True,
-    )
-    result.check_returncode()
-    return result.stdout.strip().strip('"')
-
-
-def get_hash(os_name, arch, version):
-    url = f"https://github.com/owncloud/ocis/releases/download/v{version}/ocis-{version}-{os_name}-{arch}"
-    result = subprocess.run(
-        ["nix-prefetch-url", "--type", "sha256", url], capture_output=True, text=True
-    )
-    result.check_returncode()
-    pkg_hash = result.stdout.strip()
-    result = subprocess.run(
-        ["nix", "hash", "to-sri", f"sha256:{pkg_hash}"], capture_output=True, text=True
-    )
-    result.check_returncode()
-    return result.stdout.strip()
-
-
-def update_source_version(pkg_name, version, hash_value, system):
-    subprocess.run(
-        [
-            "update-source-version",
-            pkg_name,
-            version,
-            hash_value,
-            f"--system={system}",
-            "--ignore-same-version",
-        ],
-        check=True,
-    )
-
-
-def main():
-    all_versions = get_all_versions()
-    latest_version = all_versions[0]
-    nix_current_version = get_current_version()
-
-    current_version = None
-    for version in all_versions:
-        if nix_current_version == version["version"]:
-            current_version = version
-            break
-
-    if not current_version:
-        print(
-            f"error: cannot find github release for current nix version of ocis-bin {nix_current_version}"
-        )
-        sys.exit(1)
-
-    if current_version == latest_version:
-        print(f"ocis-bin is up-to-date: {current_version}")
-        return
-
-    roadmap_url = "https://owncloud.dev/ocis/release_roadmap/"
-    response = urllib.request.urlopen(roadmap_url)
-    content = response.read().decode("utf-8")
-    latest_version_channel = get_release_type(content, latest_version["version"])
-    current_version_channel = get_release_type(content, current_version["version"])
-
-    target_version = None
-    if latest_version_channel == TRACKING_CHANNEL:
-        target_version = latest_version
-    elif latest_version_channel != TRACKING_CHANNEL:
-        for version in all_versions:
-            channel = get_release_type(content, version["version"])
-            if (
-                channel == TRACKING_CHANNEL
-                and version["published_date"] > current_version["published_date"]
-            ):
-                target_version = version
-                print(
-                    f"ocis-bin found newer version {version['version']} in channel {TRACKING_CHANNEL}"
-                )
-                break
-
-    if not target_version:
-        print(
-            f"ocis-bin could not find newer version in {TRACKING_CHANNEL} than the current {current_version['version']}"
-        )
-        return
-
-    systems = [
-        ("darwin", "arm64", "aarch64-darwin"),
-        ("darwin", "amd64", "x86_64-darwin"),
-        ("linux", "arm64", "aarch64-linux"),
-        ("linux", "arm", "armv7l-linux"),
-        ("linux", "amd64", "x86_64-linux"),
-        ("linux", "386", "i686-linux"),
-    ]
-
-    for os_name, arch, system in systems:
-        hash_value = get_hash(os_name, arch, target_version["version"])
-        update_source_version("ocis-bin", target_version["version"], hash_value, system)
-
-
-if __name__ == "__main__":
-    main()
diff --git a/pkgs/by-name/oc/ocis-bin/package.nix b/pkgs/by-name/oc/ocis_5-bin/package.nix
similarity index 77%
rename from pkgs/by-name/oc/ocis-bin/package.nix
rename to pkgs/by-name/oc/ocis_5-bin/package.nix
index e853e40b35bc..4e2c420f7ad3 100644
--- a/pkgs/by-name/oc/ocis-bin/package.nix
+++ b/pkgs/by-name/oc/ocis_5-bin/package.nix
@@ -27,18 +27,18 @@ let
 
   hash =
     {
-      hash_386-linux = "sha256-4yEgg0Ve8tjNn2weH9d91tfRaU1TE569VvZLxzuzXsw=";
-      hash_amd64-linux = "sha256-YAIhtHv/cO4yFpkWoRNMf6t4+ifMtGPTcYu84ZMvfD4=";
-      hash_arm64-linux = "sha256-OdtT9NOhh0Fkk+8CDic0NWWbGflk3FcuKB60OycJU5E=";
-      hash_arm-linux = "sha256-foMsZ8Nq+Q5lqt2XZCDvQ+/sFM8/1/rPfogzsyrQHqs=";
-      hash_amd64-darwin = "sha256-6jaX9iqyqztykeXZX3YqwRV/silFiyfeB9gJyreAfF8=";
-      hash_arm64-darwin = "sha256-KJqMJct7YWocE4eVjMF36adqTIf7WcutZlG3QEoMhCI=";
+      hash_386-linux = "sha256-2RtkxtVk7YN7CfsIBpMP85g84MNTzrnEgk10eFdfyyw=";
+      hash_amd64-linux = "sha256-tmUfDKLO35qCs1hauJQKhJhcnMhqOpcqDFtAggMFhLE=";
+      hash_arm64-linux = "sha256-ggRDW1cnTHMQKvOvCDH3eptH3O3PgYaondlzOGHTjio=";
+      hash_arm-linux = "sha256-uMLRow1NeHufSI5B4k5qSIfH3lTxg+WxzLxgdedAz40=";
+      hash_amd64-darwin = "sha256-LZ6n/f2MdbFaPnBCoJqZZ7HQiLG3Z6ZoatgFsxaFvMc=";
+      hash_arm64-darwin = "sha256-k5X2ZInFS/HlToOZPX23TRJqlx/XM1ZG++Xr4BHn8SY=";
     }
     ."hash_${arch}-${os}";
 in
 stdenv.mkDerivation (finalAttrs: {
-  pname = "ocis-bin";
-  version = "5.0.5";
+  pname = "ocis_5-bin";
+  version = "5.0.9";
 
   src = fetchurl {
     url = "https://github.com/owncloud/ocis/releases/download/v${finalAttrs.version}/ocis-${finalAttrs.version}-${os}-${arch}";
diff --git a/pkgs/by-name/oc/ocis_5-bin/update.py b/pkgs/by-name/oc/ocis_5-bin/update.py
new file mode 100755
index 000000000000..c2f717cb41d5
--- /dev/null
+++ b/pkgs/by-name/oc/ocis_5-bin/update.py
@@ -0,0 +1,271 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -I nixpkgs=./. -i python3 -p common-updater-scripts gnused nix coreutils python312
+"""
+Updater script for the ocis_5-bin package.
+
+This script fetches an HTML table from a specified URL and parses it to determine the release type
+(either "Rolling" or "Production") of a given software version. It uses the built-in urllib.request
+for fetching the HTML content and the built-in html.parser for parsing the HTML. By relying only on
+standard library modules, we avoid dependencies on third-party libraries, which simplifies deployment
+and improves portability.
+"""
+import urllib.request
+import os
+import subprocess
+import json
+import sys
+from datetime import datetime
+from html.parser import HTMLParser
+
+TRACKING_CHANNEL = "Production"  # Either Rolling or Production
+
+GITHUB_TOKEN = os.getenv("GITHUB_TOKEN", None)
+
+MAJOR_VERSION = 5
+PKG_NAME = f"ocis_{MAJOR_VERSION}-5"
+
+class TableParser(HTMLParser):
+    def __init__(self, version):
+        super().__init__()
+        self.version = version
+        self.in_td = False
+        self.current_row = []
+        self.release_type = None
+        self.in_target_row = False
+
+    def handle_starttag(self, tag, attrs):
+        if tag == "td":
+            self.in_td = True
+
+        if tag == "a":
+            href = dict(attrs).get("href", "")
+            if self.version in href:
+                self.in_target_row = True
+
+    def handle_endtag(self, tag):
+        if tag == "td":
+            self.in_td = False
+
+        if tag == "tr" and self.in_target_row:
+            self.release_type = self.current_row[1]
+            self.in_target_row = False
+
+        if tag == "tr":
+            self.current_row = []
+
+    def handle_data(self, data):
+        if self.in_td:
+            self.current_row.append(data.strip())
+
+
+def get_release_type(content, version):
+    parser = TableParser(version)
+    parser.feed(content)
+    return parser.release_type
+
+
+def get_all_versions():
+    """Get versions from GitHub releases with pagination (up to 10 pages)."""
+    versions = []
+    page = 1
+    max_pages = 10
+    per_page = 30
+
+    while page <= max_pages:
+        url = f"https://api.github.com/repos/owncloud/ocis/releases?page={page}&per_page={per_page}"
+        req = urllib.request.Request(url)
+
+        if GITHUB_TOKEN:
+            req.add_header("Authorization", f"Bearer {GITHUB_TOKEN}")
+
+        req.add_header("Accept", "application/vnd.github.v3+json")
+        req.add_header("User-Agent", "ocis-bin-updater-script")
+
+        with urllib.request.urlopen(req) as response:
+            if response.status != 200:
+                raise Exception(f"HTTP request failed with status {response.status}")
+
+            data = response.read()
+            releases = json.loads(data)
+
+            if not releases:
+                break
+
+            for release in releases:
+                version = release["tag_name"].lstrip("v")
+                published_date = datetime.strptime(
+                    release["published_at"], "%Y-%m-%dT%H:%M:%SZ"
+                )
+                versions.append({"version": version, "published_date": published_date})
+
+            page += 1
+
+            if len(releases) < per_page:
+                break
+
+    if not versions:
+        raise Exception("No releases found in GitHub API response")
+
+    return versions
+
+
+def get_current_version():
+    result = subprocess.run(
+        [
+            "nix-instantiate",
+            "--eval",
+            "-E",
+            f"with import ./. {{}}; {PKG_NAME}.version or (lib.getVersion {PKG_NAME})",
+        ],
+        capture_output=True,
+        text=True,
+    )
+    result.check_returncode()
+    return result.stdout.strip().strip('"')
+
+
+def get_hash(os_name, arch, version):
+    url = f"https://github.com/owncloud/ocis/releases/download/v{version}/ocis-{version}-{os_name}-{arch}"
+    result = subprocess.run(
+        ["nix-prefetch-url", "--type", "sha256", url], capture_output=True, text=True
+    )
+    result.check_returncode()
+    pkg_hash = result.stdout.strip()
+    result = subprocess.run(
+        ["nix", "hash", "to-sri", f"sha256:{pkg_hash}"], capture_output=True, text=True
+    )
+    result.check_returncode()
+    return result.stdout.strip()
+
+
+def update_source_version(pkg_name, version, hash_value, system):
+    subprocess.run(
+        [
+            "update-source-version",
+            pkg_name,
+            version,
+            hash_value,
+            f"--system={system}",
+            "--ignore-same-version",
+        ],
+        check=True,
+    )
+
+
+def main():
+    print("Fetching all versions from GitHub API (with pagination)...")
+    all_versions = get_all_versions()
+    print(f"Found {len(all_versions)} versions across multiple pages")
+
+    if not all_versions:
+        print("Error: No versions fetched from GitHub API")
+        sys.exit(1)
+
+    # We depend on the fact that versions are sorted reverse chronologically
+    for version in all_versions:
+        if version["version"].startswith(str(MAJOR_VERSION)):
+            latest_version = version
+            break
+    print(f"Latest version from GitHub: {latest_version['version']}")
+
+    nix_current_version = get_current_version()
+    print(f"Current nix version: {nix_current_version}")
+
+    current_version = None
+    for version in all_versions:
+        if nix_current_version == version["version"]:
+            current_version = version
+            break
+
+    if not current_version:
+        available_versions = [v["version"] for v in all_versions]
+        print(
+            f"Error: Cannot find GitHub release for current nix version {nix_current_version}"
+        )
+        print(
+            f"Available versions (searched {len(available_versions)} across multiple pages): {', '.join(available_versions[:10])}..."
+        )
+        sys.exit(1)
+
+    print(f"Found current version {current_version['version']} in GitHub releases")
+
+    if current_version == latest_version:
+        print(f"{PKG_NAME} is already up-to-date: {current_version['version']}")
+        return
+
+    print("Fetching release roadmap information...")
+    roadmap_url = "https://owncloud.dev/ocis/release_roadmap/"
+    try:
+        response = urllib.request.urlopen(roadmap_url)
+        content = response.read().decode("utf-8")
+
+        latest_version_channel = get_release_type(content, latest_version["version"])
+        current_version_channel = get_release_type(content, current_version["version"])
+
+        print(
+            f"Latest version {latest_version['version']} is in channel: {latest_version_channel}"
+        )
+        print(
+            f"Current version {current_version['version']} is in channel: {current_version_channel}"
+        )
+    except Exception as e:
+        print(f"Warning: Failed to fetch release roadmap information: {e}")
+        print("Proceeding with update using latest version")
+        latest_version_channel = TRACKING_CHANNEL
+        current_version_channel = TRACKING_CHANNEL
+
+    target_version = None
+    if latest_version_channel == TRACKING_CHANNEL:
+        target_version = latest_version
+        print(
+            f"Using latest version {latest_version['version']} as it is in the {TRACKING_CHANNEL} channel"
+        )
+    elif latest_version_channel != TRACKING_CHANNEL:
+        print(f"Looking for a newer version in the {TRACKING_CHANNEL} channel...")
+        for version in all_versions:
+            try:
+                channel = get_release_type(content, version["version"])
+                if (
+                    channel == TRACKING_CHANNEL
+                    and version["published_date"] > current_version["published_date"]
+                ):
+                    target_version = version
+                    print(
+                        f"{PKG_NAME} found newer version {version['version']} in channel {TRACKING_CHANNEL}"
+                    )
+                    break
+            except Exception as e:
+                print(
+                    f"Warning: Failed to determine channel for version {version['version']}: {e}"
+                )
+
+    if not target_version:
+        print(
+            f"{PKG_NAME} could not find newer version in {TRACKING_CHANNEL} than the current {current_version['version']}"
+        )
+        return
+
+    print(
+        f"Updating {PKG_NAME} from {current_version['version']} to {target_version['version']}"
+    )
+
+    systems = [
+        ("darwin", "arm64", "aarch64-darwin"),
+        ("darwin", "amd64", "x86_64-darwin"),
+        ("linux", "arm64", "aarch64-linux"),
+        ("linux", "arm", "armv7l-linux"),
+        ("linux", "amd64", "x86_64-linux"),
+        ("linux", "386", "i686-linux"),
+    ]
+
+    for os_name, arch, system in systems:
+        print(f"Calculating hash for {os_name}-{arch}...")
+        hash_value = get_hash(os_name, arch, target_version["version"])
+        print(f"Updating package for {system}...")
+        update_source_version(PKG_NAME, target_version["version"], hash_value, system)
+
+    print(f"Successfully updated {PKG_NAME} to version {target_version['version']}")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/pkgs/by-name/pi/pinocchio/package.nix b/pkgs/by-name/pi/pinocchio/package.nix
index 86349e6fe450..0b97a1148897 100644
--- a/pkgs/by-name/pi/pinocchio/package.nix
+++ b/pkgs/by-name/pi/pinocchio/package.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pinocchio";
-  version = "3.4.0";
+  version = "3.5.0";
 
   src = fetchFromGitHub {
     owner = "stack-of-tasks";
     repo = "pinocchio";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-myhMisXzYd2WGIBQ7SIQmQkjUmxRfVuxTPPGvBzkt8I=";
+    hash = "sha256-oSxeFt84IB3KR12knm2vBAHYyevVNjCjnp9mS3e0Zls=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/pl/play/package.nix b/pkgs/by-name/pl/play/package.nix
index 05fc04534c45..75a34f67a533 100644
--- a/pkgs/by-name/pl/play/package.nix
+++ b/pkgs/by-name/pl/play/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "play";
-  version = "0.3.5";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "paololazzari";
     repo = "play";
     tag = "v${version}";
-    hash = "sha256-31naTjYwCytytKXg9tQo2qx0hVoBwBwL7nVeoAV+/go=";
+    hash = "sha256-0ew8iYpNzSsE4fhAIB7NZYDIJitmpS5npJ74Hp6l0E0=";
   };
 
   vendorHash = "sha256-9eP0rhsgpTttYrBG/BNk/ICtaM+zKNBz2H2cHuTSt30=";
diff --git a/pkgs/by-name/pl/plemoljp-nf/package.nix b/pkgs/by-name/pl/plemoljp-nf/package.nix
index 5976d2aee318..f000bb37055b 100644
--- a/pkgs/by-name/pl/plemoljp-nf/package.nix
+++ b/pkgs/by-name/pl/plemoljp-nf/package.nix
@@ -6,11 +6,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "plemoljp-nf";
-  version = "2.0.3";
+  version = "2.0.4";
 
   src = fetchzip {
     url = "https://github.com/yuru7/PlemolJP/releases/download/v${version}/PlemolJP_NF_v${version}.zip";
-    hash = "sha256-FPWA85z0IjVk1Pa/pwsj510sKAZa8i8vgEvrKRu9GGI=";
+    hash = "sha256-6CMeo6YtWbEH/6xDD1yERhlMiCcOafAsQzcHeWQxuo4=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/ra/railway/package.nix b/pkgs/by-name/ra/railway/package.nix
index ebc208a9d4fa..1fd672670492 100644
--- a/pkgs/by-name/ra/railway/package.nix
+++ b/pkgs/by-name/ra/railway/package.nix
@@ -12,17 +12,17 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "railway";
-  version = "3.23.0";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-WxL5mETs7PVGhJcg1wVobYo/ETYFg3/1Fs/wJCJgKXg=";
+    hash = "sha256-o3AWcUKeOBiNsDSDV0XFzQ0rWpj7el4qX6iQKnqMPgg=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-cMi3raSQgCSu6ZbiTgU2ABCy+NWJjY5IcWPJMMcmqyI=";
+  cargoHash = "sha256-F+1ELwvtjnaQlvkfdKk7hnuEEde4NL/sUjPBExU+zds=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/re/readest/package.nix b/pkgs/by-name/re/readest/package.nix
index 591776c30a37..839bd03f2fcd 100644
--- a/pkgs/by-name/re/readest/package.nix
+++ b/pkgs/by-name/re/readest/package.nix
@@ -19,13 +19,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "readest";
-  version = "0.9.28";
+  version = "0.9.29";
 
   src = fetchFromGitHub {
     owner = "readest";
     repo = "readest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jIAvpppOB50KA+4jmx8QN/4e1Dkn6V9Oo3lHUWb5cyI=";
+    hash = "sha256-2L5Wyl3xWjiJCjwUq9mcKe/hnDeHjNnhHgFPISNqfk0=";
     fetchSubmodules = true;
   };
 
@@ -45,7 +45,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   useFetchCargoVendor = true;
 
-  cargoHash = "sha256-guUe2liie2x87VXNo8UeJhVLgvfPViKJKQol1XWA3fw=";
+  cargoHash = "sha256-bRIZcR8UNE78k5cbOt6GQM+PlFVHR2qV7eB82Y+abZw=";
 
   cargoRoot = "../..";
 
diff --git a/pkgs/by-name/sr/srgn/package.nix b/pkgs/by-name/sr/srgn/package.nix
index 3202fdc692e8..ca6f936051ca 100644
--- a/pkgs/by-name/sr/srgn/package.nix
+++ b/pkgs/by-name/sr/srgn/package.nix
@@ -6,17 +6,17 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "srgn";
-  version = "0.13.5";
+  version = "0.13.6";
 
   src = fetchFromGitHub {
     owner = "alexpovel";
     repo = "srgn";
     rev = "srgn-v${version}";
-    hash = "sha256-S6Wc79LY6WKtjDw/Ob3v4ETRI8Zxjrx9BDNKn79M1j4=";
+    hash = "sha256-q6LFNymfCkKhmQXsJvKOya9WPchURI1SBdk64bpmsts=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-4BravWJRtZxC34JjbH26HY7mDdDFPryQZC4e4jOZ1fQ=";
+  cargoHash = "sha256-qS1I4+pL3K4HIXNFID/ajldxIJJJXhpi0hxivHWk9Vg=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/sw/swh/package.nix b/pkgs/by-name/sw/swh/package.nix
index 96561b1c703b..95828a6665d4 100644
--- a/pkgs/by-name/sw/swh/package.nix
+++ b/pkgs/by-name/sw/swh/package.nix
@@ -3,6 +3,7 @@
   writeShellApplication,
   withSwhPythonPackages ? [
     python3Packages.swh-auth
+    python3Packages.swh-export
     python3Packages.swh-model
     python3Packages.swh-objstorage
     python3Packages.swh-scanner
diff --git a/pkgs/by-name/ta/tantivy-go/package.nix b/pkgs/by-name/ta/tantivy-go/package.nix
index 95153c1bb8f0..53cbb9e75085 100644
--- a/pkgs/by-name/ta/tantivy-go/package.nix
+++ b/pkgs/by-name/ta/tantivy-go/package.nix
@@ -29,6 +29,9 @@ rustPlatform.buildRustPackage rec {
     description = "Tantivy go bindings";
     homepage = "https://github.com/anyproto/tantivy-go";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ autrimpo ];
+    maintainers = with lib.maintainers; [
+      autrimpo
+      adda
+    ];
   };
 }
diff --git a/pkgs/by-name/te/templ/package.nix b/pkgs/by-name/te/templ/package.nix
index 061563b73c6c..ca3d1bd37a0e 100644
--- a/pkgs/by-name/te/templ/package.nix
+++ b/pkgs/by-name/te/templ/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "templ";
-  version = "0.3.850";
+  version = "0.3.857";
 
   src = fetchFromGitHub {
     owner = "a-h";
     repo = "templ";
     rev = "v${version}";
-    hash = "sha256-kH7nVXL6pINqOBPK5E5j9scw38lvnhyiQqMOe0MwUy8=";
+    hash = "sha256-c3x7v5PeMJFADRfImMyEasvlC9WSjqHQxNDg1sgPBfQ=";
   };
 
   vendorHash = "sha256-JVOsjBn1LV8p6HHelfAO1Qcqi/tPg1S3xBffo+0aplE=";
diff --git a/pkgs/by-name/ug/ugs/package.nix b/pkgs/by-name/ug/ugs/package.nix
index 576f5d414909..a60b73996c00 100644
--- a/pkgs/by-name/ug/ugs/package.nix
+++ b/pkgs/by-name/ug/ugs/package.nix
@@ -19,11 +19,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "ugs";
-  version = "2.1.12";
+  version = "2.1.13";
 
   src = fetchzip {
     url = "https://github.com/winder/Universal-G-Code-Sender/releases/download/v${version}/UniversalGcodeSender.zip";
-    hash = "sha256-HJMJ9bPo7YGQOrI5eM0MRPDoPawyWcr0YY2CBBkijpA=";
+    hash = "sha256-LgbZds747/ll9kwIlDR62c9GcnxTcz1TNbAAVXwg3wY=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/va/vals/package.nix b/pkgs/by-name/va/vals/package.nix
index 806ed73c53ca..04f0fe27fb39 100644
--- a/pkgs/by-name/va/vals/package.nix
+++ b/pkgs/by-name/va/vals/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "vals";
-  version = "0.39.4";
+  version = "0.40.1";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "helmfile";
     repo = pname;
-    sha256 = "sha256-UHiVAT7EE+rH+fcTDtTrTTVYktsePUojfAQgPWRNui0=";
+    sha256 = "sha256-1mN8JbFgzHjzuuSoagDo9f4zFrrZc2iNk8AoSrBsyBs=";
   };
 
-  vendorHash = "sha256-5Wg5cRr470GikN1cuot4HkErK0VPHYPfQiC4d/frSsc=";
+  vendorHash = "sha256-LI0NEjkE22ljSWd3qbZX7fTdwEriQJBSuKyX3hv1yFk=";
 
   proxyVendor = true;
 
diff --git a/pkgs/by-name/wa/wasm-language-tools/package.nix b/pkgs/by-name/wa/wasm-language-tools/package.nix
index 1aa2d6015d5b..3767fa61114c 100644
--- a/pkgs/by-name/wa/wasm-language-tools/package.nix
+++ b/pkgs/by-name/wa/wasm-language-tools/package.nix
@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wasm-language-tools";
-  version = "0.3.2";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "g-plane";
     repo = "wasm-language-tools";
     tag = "v${version}";
-    hash = "sha256-f1Mq+1gZZelN12rFTLJHOvdzDAbqufzT9+I6pkJdJMU=";
+    hash = "sha256-LkBeMZ4WEc8sZ6Gx31jdfdkEkjNfE3LFsz4B3hngT8U=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-P3sxAFZjAlgPrGrw3W+7ufflUz3/Xe7lTXygnSX5Q+4=";
+  cargoHash = "sha256-PwyWqaJCfSh7l0OCalNfHIe9dA1BMOI8F7m4szOgVrs=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgram = "${placeholder "out"}/bin/wat_server";
diff --git a/pkgs/by-name/ye/yew-fmt/package.nix b/pkgs/by-name/ye/yew-fmt/package.nix
index 2956e91d9ab1..52763818adc1 100644
--- a/pkgs/by-name/ye/yew-fmt/package.nix
+++ b/pkgs/by-name/ye/yew-fmt/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "yew-fmt";
-  version = "0.6";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "its-the-shrimp";
     repo = "yew-fmt";
     tag = "v${version}";
-    hash = "sha256-KhZezkR9VhdfGkNe1hSF90pe9K4VGDlBltasb7xnmRI=";
+    hash = "sha256-kUelvhWUj9+nEHNWolhTJa8emdBInKV9cK2dF/H7dNQ=";
   };
 
-  cargoHash = "sha256-Y6OicST0GbUL4RpvdvtBLFlLwryQMKlaut5x9+cNiM8=";
+  cargoHash = "sha256-oIliRYc6HU8KFmlTTIlV+nmeRUx1gJhy93QjPnGxiK8=";
   nativeCheckInputs = [ rustfmt ];
   passthru.updateScript = nix-update-script { };
   useFetchCargoVendor = true;
diff --git a/pkgs/by-name/zi/zipline/package.nix b/pkgs/by-name/zi/zipline/package.nix
index 6addeed71305..80adb00ab4d7 100644
--- a/pkgs/by-name/zi/zipline/package.nix
+++ b/pkgs/by-name/zi/zipline/package.nix
@@ -28,18 +28,18 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zipline";
-  version = "4.0.1";
+  version = "4.0.2";
 
   src = fetchFromGitHub {
     owner = "diced";
     repo = "zipline";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HKd6OXnr9Xcxdaas0Pfvnq3nozFbOTcQsUxiIqDmvXI=";
+    hash = "sha256-waUc2DzD7oQ/ZuPKvUwu3Yj6uxrZauR4phcQwh7YfKw=";
   };
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-4dVhCv06ze7kmHhwejiMTleojzl//S0yabW7tPyeuT8=";
+    hash = "sha256-Q1PHXoiqUorAGcpIvM5iBvPINLRv+dAo0awhG4gvsrI=";
   };
 
   buildInputs = [ vips ];
diff --git a/pkgs/development/compilers/rust/make-rust-platform.nix b/pkgs/development/compilers/rust/make-rust-platform.nix
index e7d0da9cbb5b..03564bc068f7 100644
--- a/pkgs/development/compilers/rust/make-rust-platform.nix
+++ b/pkgs/development/compilers/rust/make-rust-platform.nix
@@ -26,11 +26,6 @@
       inherit (self) callPackage;
     in
     {
-      fetchCargoTarball = buildPackages.callPackage ../../../build-support/rust/fetch-cargo-tarball {
-        git = buildPackages.gitMinimal;
-        inherit cargo;
-      };
-
       fetchCargoVendor = buildPackages.callPackage ../../../build-support/rust/fetch-cargo-vendor.nix {
         inherit cargo;
       };
@@ -81,4 +76,7 @@
     rustc = lib.warn "rustPlatform.rust.rustc is deprecated. Use rustc instead." rustc;
     cargo = lib.warn "rustPlatform.rust.cargo is deprecated. Use cargo instead." cargo;
   };
+
+  # Added in 25.05.
+  fetchCargoTarball = throw "`rustPlatform.fetchCargoTarball` has been removed in 25.05, use `rustPlatform.fetchCargoVendor` instead";
 }
diff --git a/pkgs/development/interpreters/erlang/generic-builder.nix b/pkgs/development/interpreters/erlang/generic-builder.nix
index 01ab649261e5..7c33178708dd 100644
--- a/pkgs/development/interpreters/erlang/generic-builder.nix
+++ b/pkgs/development/interpreters/erlang/generic-builder.nix
@@ -21,7 +21,8 @@
   parallelBuild ? false,
   systemd,
   wxSupport ? true,
-  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd, # systemd support in epmd
+  # systemd support for epmd
+  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd,
   # updateScript deps
   writeScript,
   common-updater-scripts,
@@ -50,6 +51,7 @@
   odbcSupport ? false,
   odbcPackages ? [ unixODBC ],
   opensslPackage ? openssl,
+  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd,
   wxPackages ? [
     libGL
     libGLU
diff --git a/pkgs/development/libraries/kddockwidgets/default.nix b/pkgs/development/libraries/kddockwidgets/default.nix
index 23a401804dbb..d9aa3433644d 100644
--- a/pkgs/development/libraries/kddockwidgets/default.nix
+++ b/pkgs/development/libraries/kddockwidgets/default.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "KDDockWidgets";
-  version = "2.2.1";
+  version = "2.2.3";
 
   src = fetchFromGitHub {
     owner = "KDAB";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-DxRySKhQ15OpstjCO6FJ9edV7z8/rECN2+o5T63vFzQ=";
+    sha256 = "sha256-VDLHED/QKxccZ18WEPV7GPdr3v7VaizDa5sZq7ei5+g=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/libraries/mesa/common.nix b/pkgs/development/libraries/mesa/common.nix
index eed15cbcbc93..496f74440aad 100644
--- a/pkgs/development/libraries/mesa/common.nix
+++ b/pkgs/development/libraries/mesa/common.nix
@@ -5,14 +5,14 @@
 # nix build .#legacyPackages.x86_64-darwin.mesa .#legacyPackages.aarch64-darwin.mesa
 rec {
   pname = "mesa";
-  version = "25.0.2";
+  version = "25.0.3";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "mesa";
     repo = "mesa";
     rev = "mesa-${version}";
-    hash = "sha256-NW2Xntdpt4Iec3z0E8j+omNRH/46IMYNuyD2MIFMs2M=";
+    hash = "sha256-OM/T6pkq4vgEYZ7TlLRVsyMknLxQC9L+iOPF20ToZi8=";
   };
 
   meta = {
diff --git a/pkgs/development/libraries/xsd/default.nix b/pkgs/development/libraries/xsd/default.nix
deleted file mode 100644
index 14600a773bf8..000000000000
--- a/pkgs/development/libraries/xsd/default.nix
+++ /dev/null
@@ -1,45 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  xercesc,
-}:
-
-let
-in
-stdenv.mkDerivation rec {
-  pname = "xsd";
-  version = "4.0.0";
-
-  src = fetchurl {
-    url = "https://codesynthesis.com/download/xsd/4.0/xsd-4.0.0+dep.tar.bz2";
-    sha256 = "05wqhmd5cd4pdky8i8qysnh96d2h16ly8r73whmbxkajiyf2m9gc";
-  };
-
-  patches = [ ./xsdcxx.patch ];
-
-  postPatch = ''
-    patchShebangs .
-  '';
-
-  enableParallelBuilding = true;
-
-  buildFlags = [
-    "LDFLAGS=-L${xercesc}/lib"
-    "CPPFLAGS=-I${xercesc}/include"
-  ];
-  installFlags = buildFlags ++ [
-    "install_prefix=${placeholder "out"}"
-  ];
-
-  buildInputs = [ xercesc ];
-
-  meta = {
-    homepage = "http://www.codesynthesis.com/products/xsd";
-    description = "Open-source, cross-platform W3C XML Schema to C++ data binding compiler";
-    mainProgram = "xsd";
-    license = lib.licenses.gpl2;
-    platforms = lib.platforms.linux;
-    maintainers = [ lib.maintainers.jagajaga ];
-  };
-}
diff --git a/pkgs/development/libraries/xsd/xsdcxx.patch b/pkgs/development/libraries/xsd/xsdcxx.patch
deleted file mode 100644
index 88a893c6e602..000000000000
--- a/pkgs/development/libraries/xsd/xsdcxx.patch
+++ /dev/null
@@ -1,126 +0,0 @@
---- xsd-4.0.0+dep/xsd/doc/xsd.1~	2014-09-14 12:25:36.862267587 +0000
-+++ xsd-4.0.0+dep/xsd/doc/xsd.1	2014-09-14 12:28:25.728229892 +0000
-@@ -1,16 +1,16 @@
- .\" Process this file with
--.\" groff -man -Tascii xsd.1
-+.\" groff -man -Tascii xsdcxx.1
- .\"
- .TH XSD 1 "July 2014" "XSD 4.0.0"
- .SH NAME
--xsd \- W3C XML Schema to C++ Compiler
-+xsdcxx \- W3C XML Schema to C++ Compiler
- .\"
- .\"
- .\"
- .\"--------------------------------------------------------------------
- .SH SYNOPSIS
- .\"--------------------------------------------------------------------
--.B xsd
-+.B xsdcxx
- .I command
- .B [
- .I options
-@@ -20,19 +20,19 @@
- .I file
- .B ...]
- .in
--.B xsd help
-+.B xsdcxx help
- .B [
- .I command
- .B ]
- .in
--.B xsd version
-+.B xsdcxx version
- .\"
- .\"
- .\"
- .\"--------------------------------------------------------------------
- .SH DESCRIPTION
- .\"--------------------------------------------------------------------
--.B xsd
-+.B xsdcxx
- generates vocabulary-specific, statically-typed C++ mapping from W3C XML
- Schema definitions. Particular mapping to produce is selected by a
- .IR command .
-@@ -96,7 +96,7 @@
- .PP
- .RS
- .RS 3
--.B xsd help
-+.B xsdcxx help
- .I command
- .RE
- .PP
-@@ -206,7 +206,7 @@
- \fIfilename\fP \fInamespace\fP
- 
- For example, if you have file \fBhello\.xsd\fP with namespace
--\fBhttp://example\.com/hello\fP and you run \fBxsd\fP on this file, then the
-+\fBhttp://example\.com/hello\fP and you run \fBxsdcxx\fP on this file, then the
- string in question will be:
- 
- \fBhello\.xsd\. http://example\.com/hello\fP
-@@ -1632,7 +1632,7 @@
- .\"
- .SH DIAGNOSTICS
- If the input file is not a valid W3C XML Schema definition,
--.B xsd
-+.B xsdcxx
- will issue diagnostic messages to
- .B STDERR
- and exit with non-zero exit code.
---- xsd-4.0.0+dep/xsd/doc/xsd.xhtml~	2014-09-14 12:28:37.731513138 +0000
-+++ xsd-4.0.0+dep/xsd/doc/xsd.xhtml	2014-09-14 12:30:11.277789610 +0000
-@@ -50,19 +50,19 @@
- 
-   <h1>NAME</h1>
- 
--  <p>xsd - W3C XML Schema to C++ Compiler</p>
-+  <p>xsdcxx - W3C XML Schema to C++ Compiler</p>
- 
-   <h1>SYNOPSIS</h1>
- 
-   <dl id="synopsis">
--    <dt><code><b>xsd</b> <i>command</i> [<i>options</i>] <i>file</i> [<i>file</i> ...]</code></dt>
--    <dt><code><b>xsd help</b> [<i>command</i>]</code></dt>
--    <dt><code><b>xsd version</b></code></dt>
-+    <dt><code><b>xsdcxx</b> <i>command</i> [<i>options</i>] <i>file</i> [<i>file</i> ...]</code></dt>
-+    <dt><code><b>xsdcxx help</b> [<i>command</i>]</code></dt>
-+    <dt><code><b>xsdcxx version</b></code></dt>
-   </dl>
- 
-   <h1>DESCRIPTION</h1>
- 
--  <p><code><b>xsd</b></code> generates vocabulary-specific, statically-typed
-+  <p><code><b>xsdcxx</b></code> generates vocabulary-specific, statically-typed
-   C++ mapping from W3C XML Schema definitions. Particular mapping to
-   produce is selected by a <code><i>command</i></code>. Each mapping has
-   a number of mapping-specific <code><i>options</i></code> that should
-@@ -104,7 +104,7 @@
- 
-     <dt><code><b>help</b></code></dt>
-     <dd>Print usage information and exit. Use
--      <p><code><b>xsd help</b> <i>command</i></code></p>
-+      <p><code><b>xsdcxx help</b> <i>command</i></code></p>
-       for command-specific help.
-     </dd>
- 
-@@ -219,7 +219,7 @@
- 
-   <p>For example, if you have file <code><b>hello.xsd</b></code> with
-   namespace <code><b>http://example.com/hello</b></code> and you run
--  <code><b>xsd</b></code> on this file, then the string in question will
-+  <code><b>xsdcxx</b></code> on this file, then the string in question will
-   be:</p>
- 
-   <p><code><b>hello.xsd. http://example.com/hello</b></code></p>
-@@ -1530,7 +1530,7 @@
-   <h1>DIAGNOSTICS</h1>
- 
-   <p>If the input file is not a valid W3C XML Schema definition,
--    <code><b>xsd</b></code> will issue diagnostic messages to STDERR
-+    <code><b>xsdcxx</b></code> will issue diagnostic messages to STDERR
-     and exit with non-zero exit code.</p>
- 
-   <h1>BUGS</h1>
diff --git a/pkgs/development/python-modules/accelerate/default.nix b/pkgs/development/python-modules/accelerate/default.nix
index 6a160567925c..8bcebc59ca35 100644
--- a/pkgs/development/python-modules/accelerate/default.nix
+++ b/pkgs/development/python-modules/accelerate/default.nix
@@ -3,6 +3,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
   pythonAtLeast,
 
   # buildInputs
@@ -43,6 +44,14 @@ buildPythonPackage rec {
     hash = "sha256-J4eDm/PcyKK3256l6CAWUj4AWTB6neTKgxbBmul0BPE=";
   };
 
+  patches = [
+    # Fix tests on darwin: https://github.com/huggingface/accelerate/pull/3464
+    (fetchpatch {
+      url = "https://github.com/huggingface/accelerate/commit/8b31a2fe2c6d0246fff9885fb1f8456fb560abc7.patch";
+      hash = "sha256-Ek9Ou4Y/H1jt3qanf2g3HowBoTsN/bn4yV9O3ogcXMo=";
+    })
+  ];
+
   buildInputs = [ llvmPackages.openmp ];
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/anyqt/default.nix b/pkgs/development/python-modules/anyqt/default.nix
index f1e88064955d..7e6742b432ca 100644
--- a/pkgs/development/python-modules/anyqt/default.nix
+++ b/pkgs/development/python-modules/anyqt/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "anyqt";
-  version = "0.2.0";
+  version = "0.2.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "ales-erjavec";
     repo = "anyqt";
     rev = version;
-    hash = "sha256-dL2EUAMzWKq/oN3rXiEC6emDJddmg4KclT5ONKA0jfk=";
+    hash = "sha256-iDUgu+x9rnpxpHzO7Rf2rJFXsheivrK7HI3FUbomkTU=";
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/banks/default.nix b/pkgs/development/python-modules/banks/default.nix
index 41953bc05bc4..b42d754e912f 100644
--- a/pkgs/development/python-modules/banks/default.nix
+++ b/pkgs/development/python-modules/banks/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "banks";
-  version = "2.1.0";
+  version = "2.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "masci";
     repo = "banks";
     tag = "v${version}";
-    hash = "sha256-RaUDmJfSn8lSBNY/iOPCynRYW2KINgf4K/0O+0niIqk=";
+    hash = "sha256-bDOPWq941UGcRXlUO8CVewjmEDFHJH7OZaRTo1Iqbjw=";
   };
 
   SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
diff --git a/pkgs/development/python-modules/colbert-ai/default.nix b/pkgs/development/python-modules/colbert-ai/default.nix
index 8d949efde7e2..5b4ebfdeb2c4 100644
--- a/pkgs/development/python-modules/colbert-ai/default.nix
+++ b/pkgs/development/python-modules/colbert-ai/default.nix
@@ -74,10 +74,5 @@ buildPythonPackage rec {
     maintainers = with lib.maintainers; [
       bachp
     ];
-    badPlatforms = [
-      # `import torch.distributed.tensor` fails on darwin:
-      # ModuleNotFoundError: No module named 'torch._C._distributed_c10d'; 'torch._C' is not a packag
-      lib.systems.inspect.patterns.isDarwin
-    ];
   };
 }
diff --git a/pkgs/development/python-modules/collidoscope/default.nix b/pkgs/development/python-modules/collidoscope/default.nix
index 2ad63e83c081..b8c334bb6736 100644
--- a/pkgs/development/python-modules/collidoscope/default.nix
+++ b/pkgs/development/python-modules/collidoscope/default.nix
@@ -1,7 +1,8 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
+  setuptools,
   babelfont,
   kurbopy,
   fonttools,
@@ -9,19 +10,26 @@
   tqdm,
   uharfbuzz,
   unittestCheckHook,
+  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "collidoscope";
   version = "0.6.5";
-  format = "setuptools";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-D7MzJ8FZjA/NSXCqCJQ9a02FPPi3t4W0q65wRIDcfSA=";
+  src = fetchFromGitHub {
+    owner = "googlefonts";
+    repo = "collidoscope";
+    tag = "v${version}";
+    hash = "sha256-1tKbv+i2gbUFJa94xSEj5BrEpZ0+ULgglkYvGMP4NXw=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
     babelfont
     kurbopy
     fonttools
@@ -37,10 +45,12 @@ buildPythonPackage rec {
     "-v"
   ];
 
-  meta = with lib; {
+  __darwinAllowLocalNetworking = true;
+
+  meta = {
     description = "Python library to detect glyph collisions in fonts";
     homepage = "https://github.com/googlefonts/collidoscope";
-    license = licenses.mit;
-    maintainers = with maintainers; [ danc86 ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ danc86 ];
   };
 }
diff --git a/pkgs/development/python-modules/compressed-tensors/default.nix b/pkgs/development/python-modules/compressed-tensors/default.nix
index 3dd16d37e9f7..e62a07a2ad0b 100644
--- a/pkgs/development/python-modules/compressed-tensors/default.nix
+++ b/pkgs/development/python-modules/compressed-tensors/default.nix
@@ -43,21 +43,15 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  disabledTests =
-    [
-      # these try to download models from HF Hub
-      "test_get_observer_token_count"
-      "test_kv_cache_quantization"
-      "test_target_prioritization"
-      "test_load_compressed_sharded"
-      "test_save_compressed_model"
-      "test_apply_tinyllama_dynamic_activations"
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      # No module named 'torch._C._distributed_c10d'; 'torch._C' is not a package
-      "test_composability"
-      "test_missing_and_unexpected_keys_on_compression"
-    ];
+  disabledTests = [
+    # these try to download models from HF Hub
+    "test_get_observer_token_count"
+    "test_kv_cache_quantization"
+    "test_target_prioritization"
+    "test_load_compressed_sharded"
+    "test_save_compressed_model"
+    "test_apply_tinyllama_dynamic_activations"
+  ];
 
   disabledTestPaths = [
     # these try to download models from HF Hub
diff --git a/pkgs/development/python-modules/django/5.nix b/pkgs/development/python-modules/django/5.nix
index c79c8a7f8c34..29513cee0ea7 100644
--- a/pkgs/development/python-modules/django/5.nix
+++ b/pkgs/development/python-modules/django/5.nix
@@ -44,7 +44,7 @@
 
 buildPythonPackage rec {
   pname = "django";
-  version = "5.1.7";
+  version = "5.1.8";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -53,7 +53,7 @@ buildPythonPackage rec {
     owner = "django";
     repo = "django";
     rev = "refs/tags/${version}";
-    hash = "sha256-BxhHqWpTZLcx46RofnXzZ5nj4xDPcj7hNng9ppUN5Hw=";
+    hash = "sha256-TZjqB9khEHnkkxYvAC/RzAvOIwdemh0uT4UVdosMq6M=";
   };
 
   patches =
@@ -72,12 +72,6 @@ buildPythonPackage rec {
         url = "https://github.com/django/django/commit/12f4f95405c7857cbf2f4bf4d0261154aac31676.patch";
         hash = "sha256-+K20/V8sh036Ox9U7CSPgfxue7f28Sdhr3MsB7erVOk=";
       })
-
-      # fix regression which breaks django-import-export
-      # https://github.com/django-import-export/django-import-export/pull/2045
-      # https://github.com/django/django/pull/19233
-      # manual backport because commit doesn't apply on stable cleanly
-      ./Restored-single_object-rgument-to-LogEntry-objects-log_actions.diff
     ]
     ++ lib.optionals withGdal [
       (replaceVars ./django_5_set_geos_gdal_lib.patch {
diff --git a/pkgs/development/python-modules/django/Restored-single_object-rgument-to-LogEntry-objects-log_actions.diff b/pkgs/development/python-modules/django/Restored-single_object-rgument-to-LogEntry-objects-log_actions.diff
deleted file mode 100644
index 6831797f1fda..000000000000
--- a/pkgs/development/python-modules/django/Restored-single_object-rgument-to-LogEntry-objects-log_actions.diff
+++ /dev/null
@@ -1,15 +0,0 @@
-diff --git a/django/contrib/admin/models.py b/django/contrib/admin/models.py
-index 345b8cf341..2ed78d775b 100644
---- a/django/contrib/admin/models.py
-+++ b/django/contrib/admin/models.py
-@@ -51,7 +51,9 @@ def log_action(
-             change_message=change_message,
-         )
- 
--    def log_actions(self, user_id, queryset, action_flag, change_message=""):
-+    def log_actions(
-+        self, user_id, queryset, action_flag, change_message="", *, single_object=False
-+    ):
-         # RemovedInDjango60Warning.
-         if type(self).log_action != LogEntryManager.log_action:
-             warnings.warn(
diff --git a/pkgs/development/python-modules/dllogger/default.nix b/pkgs/development/python-modules/dllogger/default.nix
index 00a2b6b82a2c..b1a4bbfc4fe4 100644
--- a/pkgs/development/python-modules/dllogger/default.nix
+++ b/pkgs/development/python-modules/dllogger/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "dllogger";
-  version = "1.0.0";
+  version = "1.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.5";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "NVIDIA";
     repo = "dllogger";
     tag = "v${version}";
-    hash = "sha256-Hpr4yeRl+Dyaz6lRyH/5P6UQT184JEHPqgVlf4qHvOg=";
+    hash = "sha256-kT6FhAl4JZlFPdzKYopAJBurYVMaU5umn/qZADfPjkE=";
   };
 
   nativeBuildInputs = [
@@ -41,7 +41,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Logging tool for deep learning";
     homepage = "https://github.com/NVIDIA/dllogger";
-    changelog = "https://github.com/NVIDIA/dllogger/releases/tag/v${version}";
+    changelog = "https://github.com/NVIDIA/dllogger/releases/tag/${src.tag}";
     license = licenses.asl20;
     maintainers = with maintainers; [ natsukium ];
   };
diff --git a/pkgs/development/python-modules/docling-ibm-models/default.nix b/pkgs/development/python-modules/docling-ibm-models/default.nix
index 93bd42c78167..362e5c59ae8a 100644
--- a/pkgs/development/python-modules/docling-ibm-models/default.nix
+++ b/pkgs/development/python-modules/docling-ibm-models/default.nix
@@ -83,12 +83,6 @@ buildPythonPackage rec {
     "test_tf_predictor"
   ];
 
-  disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
-    # No module named 'torch._C._distributed_c10d'; 'torch._C' is not a package
-    "tests/test_code_formula_predictor.py"
-    "tests/test_layout_predictor.py"
-  ];
-
   meta = {
     changelog = "https://github.com/DS4SD/docling-ibm-models/blob/${src.tag}/CHANGELOG.md";
     description = "Docling IBM models";
diff --git a/pkgs/development/python-modules/docling/default.nix b/pkgs/development/python-modules/docling/default.nix
index 7e60149238a0..fddcf855bbbf 100644
--- a/pkgs/development/python-modules/docling/default.nix
+++ b/pkgs/development/python-modules/docling/default.nix
@@ -164,26 +164,6 @@ buildPythonPackage rec {
     "test_e2e_valid_csv_conversions"
   ];
 
-  disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
-    # No module named 'torch._C._distributed_c10d'; 'torch._C' is not a package
-    "tests/test_backend_csv.py"
-    "tests/test_backend_html.py"
-    "tests/test_backend_jats.py"
-    "tests/test_backend_msexcel.py"
-    "tests/test_backend_msword.py"
-    "tests/test_backend_pptx.py"
-    "tests/test_cli.py"
-    "tests/test_code_formula.py"
-    "tests/test_document_picture_classifier.py"
-    "tests/test_e2e_conversion.py"
-    "tests/test_e2e_ocr_conversion.py"
-    "tests/test_input_doc.py"
-    "tests/test_interfaces.py"
-    "tests/test_invalid_input.py"
-    "tests/test_legacy_format_transform.py"
-    "tests/test_options.py"
-  ];
-
   meta = {
     description = "Get your documents ready for gen AI";
     homepage = "https://github.com/DS4SD/docling";
diff --git a/pkgs/development/python-modules/duo-client/default.nix b/pkgs/development/python-modules/duo-client/default.nix
index bc095ea4039b..f07516f642ba 100644
--- a/pkgs/development/python-modules/duo-client/default.nix
+++ b/pkgs/development/python-modules/duo-client/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "duo-client";
-  version = "5.4.0";
+  version = "5.5.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "duosecurity";
     repo = "duo_client_python";
     tag = version;
-    hash = "sha256-CZfB40TMTNhs2sGPVobcs3poSsYJ03qDjVoADlvLi88=";
+    hash = "sha256-5ZPs2099G9oBbDpComNDP3c4B0NjWirBMZY4orO9YfA=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/fairseq/default.nix b/pkgs/development/python-modules/fairseq/default.nix
index d68c8c2ebbc3..aa2932bbf91f 100644
--- a/pkgs/development/python-modules/fairseq/default.nix
+++ b/pkgs/development/python-modules/fairseq/default.nix
@@ -120,5 +120,6 @@ buildPythonPackage rec {
     platforms = platforms.linux;
     hydraPlatforms = [ ];
     maintainers = with maintainers; [ happysalada ];
+    broken = true; # requires numpy1 which is incompatible with sacrebleu depending on numpy2
   };
 }
diff --git a/pkgs/development/python-modules/finetuning-scheduler/default.nix b/pkgs/development/python-modules/finetuning-scheduler/default.nix
index ce1d1f858a30..3f98b37ed0b2 100644
--- a/pkgs/development/python-modules/finetuning-scheduler/default.nix
+++ b/pkgs/development/python-modules/finetuning-scheduler/default.nix
@@ -3,6 +3,7 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
 
   # build-system
   setuptools,
@@ -29,6 +30,13 @@ buildPythonPackage rec {
     hash = "sha256-+jt+if9aAbEd2XDMC7RpZmJpm4VUEZMt5xoLOP/esMg=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/speediedan/finetuning-scheduler/commit/78e6e225f353d1ba95db05d7fc6ff541859ed6a2.patch";
+      hash = "sha256-7mbtsaHrnHph8lvuwhBGqxPQimbZcbGeyBYXzApFPn4=";
+    })
+  ];
+
   build-system = [ setuptools ];
 
   pythonRelaxDeps = [
@@ -71,9 +79,5 @@ buildPythonPackage rec {
     changelog = "https://github.com/speediedan/finetuning-scheduler/blob/v${version}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ bcdarwin ];
-    badPlatforms = [
-      # "No module named 'torch._C._distributed_c10d'; 'torch._C' is not a package" at import time:
-      lib.systems.inspect.patterns.isDarwin
-    ];
   };
 }
diff --git a/pkgs/development/python-modules/flowmc/default.nix b/pkgs/development/python-modules/flowmc/default.nix
index 1d76461f239f..078106da6140 100644
--- a/pkgs/development/python-modules/flowmc/default.nix
+++ b/pkgs/development/python-modules/flowmc/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "flowmc";
-  version = "0.4.0";
+  version = "0.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kazewong";
     repo = "flowMC";
     tag = "flowMC-${version}";
-    hash = "sha256-ambi2BMFjWAggeJ3PdlRpdKVmZeePe5LbvuKzCgNV/k=";
+    hash = "sha256-ehmKXR01tT3H564ndjSwUoUuu2KmQCC6RwkB2nsk42E=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/gradio/default.nix b/pkgs/development/python-modules/gradio/default.nix
index 05c02ca38d2e..0184f539e946 100644
--- a/pkgs/development/python-modules/gradio/default.nix
+++ b/pkgs/development/python-modules/gradio/default.nix
@@ -301,21 +301,16 @@ buildPythonPackage rec {
       "test_updates_stored_up_to_capacity"
       "test_varying_output_forms_with_generators"
     ];
-  disabledTestPaths =
-    [
-      # 100% touches network
-      "test/test_networking.py"
-      "client/python/test/test_client.py"
-      # makes pytest freeze 50% of the time
-      "test/test_interfaces.py"
+  disabledTestPaths = [
+    # 100% touches network
+    "test/test_networking.py"
+    "client/python/test/test_client.py"
+    # makes pytest freeze 50% of the time
+    "test/test_interfaces.py"
 
-      # Local network tests dependant on port availability (port 7860-7959)
-      "test/test_routes.py"
-    ]
-    ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
-      # No module named 'torch._C._distributed_c10d'; 'torch._C' is not a package
-      "test/test_pipelines.py"
-    ];
+    # Local network tests dependant on port availability (port 7860-7959)
+    "test/test_routes.py"
+  ];
   pytestFlagsArray = [
     "-x" # abort on first failure
     "-m 'not flaky'"
diff --git a/pkgs/development/python-modules/heudiconv/default.nix b/pkgs/development/python-modules/heudiconv/default.nix
index b44c00fb041a..574361a93c78 100644
--- a/pkgs/development/python-modules/heudiconv/default.nix
+++ b/pkgs/development/python-modules/heudiconv/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "heudiconv";
-  version = "1.3.2";
+  version = "1.3.3";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-z7HaouhNuFX16RSY4gsF8gQJIJfmSiBVUANwMM113ds=";
+    hash = "sha256-SnYysTsQUagXH8CCPgNoca2ls47XUguE/pJD2wc1tro=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/hist/default.nix b/pkgs/development/python-modules/hist/default.nix
index 521762308c4b..6e4da9897e76 100644
--- a/pkgs/development/python-modules/hist/default.nix
+++ b/pkgs/development/python-modules/hist/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "hist";
-  version = "2.8.0";
+  version = "2.8.1";
   format = "pyproject";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Cj5gLdHSchvX8iKfRWcJ3eMj9vdJUvE7pOWYbDJ193s=";
+    hash = "sha256-fafJAOLvbUJXk9oamtrEJOvAE6jqvymyQwH3CJghjZ0=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/ignite/default.nix b/pkgs/development/python-modules/ignite/default.nix
index a34e5c5d6c24..6da0f8e7123b 100644
--- a/pkgs/development/python-modules/ignite/default.nix
+++ b/pkgs/development/python-modules/ignite/default.nix
@@ -96,7 +96,5 @@ buildPythonPackage rec {
     changelog = "https://github.com/pytorch/ignite/releases/tag/v${version}";
     license = lib.licenses.bsd3;
     maintainers = [ lib.maintainers.bcdarwin ];
-    # ModuleNotFoundError: No module named 'torch._C._distributed_c10d'; 'torch._C' is not a package
-    broken = stdenv.hostPlatform.isDarwin;
   };
 }
diff --git a/pkgs/development/python-modules/inscriptis/default.nix b/pkgs/development/python-modules/inscriptis/default.nix
index cbf5de1d7a14..034cd9c196e0 100644
--- a/pkgs/development/python-modules/inscriptis/default.nix
+++ b/pkgs/development/python-modules/inscriptis/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "inscriptis";
-  version = "2.5.3";
+  version = "2.6.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "weblyzard";
     repo = "inscriptis";
     tag = version;
-    hash = "sha256-s19ldUjJm0dnr0aFiKk0G7sXqnxQPgWo9kJYv96WLjM=";
+    hash = "sha256-+qLHdQ4i/PYSUCZLYV3BguXjacjs7aB3MP0rJegv+dI=";
   };
 
   build-system = [ poetry-core ];
@@ -44,7 +44,7 @@ buildPythonPackage rec {
     description = "HTML to text converter";
     mainProgram = "inscript.py";
     homepage = "https://github.com/weblyzard/inscriptis";
-    changelog = "https://github.com/weblyzard/inscriptis/releases/tag/${version}";
+    changelog = "https://github.com/weblyzard/inscriptis/releases/tag/${src.tag}";
     license = licenses.asl20;
     maintainers = [ ];
   };
diff --git a/pkgs/development/python-modules/lacuscore/default.nix b/pkgs/development/python-modules/lacuscore/default.nix
index 8ef451cf0f69..0facc5227ec0 100644
--- a/pkgs/development/python-modules/lacuscore/default.nix
+++ b/pkgs/development/python-modules/lacuscore/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "lacuscore";
-  version = "1.13.7";
+  version = "1.13.8";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "ail-project";
     repo = "LacusCore";
     tag = "v${version}";
-    hash = "sha256-80qgV35B863B16L+kdQ+6p6laZo2v5dChyczO5VXvNY=";
+    hash = "sha256-N49q1+m6BzRCoYnTslZQqbXLvpOXf23Lsg0NMhGMCoE=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/lexilang/default.nix b/pkgs/development/python-modules/lexilang/default.nix
index 227fdb0e55b5..6f287b236cd7 100644
--- a/pkgs/development/python-modules/lexilang/default.nix
+++ b/pkgs/development/python-modules/lexilang/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "lexilang";
-  version = "1.0.5";
+  version = "1.0.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "LibreTranslate";
     repo = "LexiLang";
     tag = "v${version}";
-    hash = "sha256-Yn6zthr6irkDsRx25NG9gOQc07xRpItwCc6+WqAhd/c=";
+    hash = "sha256-+AtdmkYKJgQwFOK0B2jkrNfSWGaydv6tCVjNnb2DJng=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/llama-index-llms-ollama/default.nix b/pkgs/development/python-modules/llama-index-llms-ollama/default.nix
index 935c5fbae35f..3409c2ce7da4 100644
--- a/pkgs/development/python-modules/llama-index-llms-ollama/default.nix
+++ b/pkgs/development/python-modules/llama-index-llms-ollama/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "llama-index-llms-ollama";
-  version = "0.5.3";
+  version = "0.5.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "llama_index_llms_ollama";
     inherit version;
-    hash = "sha256-FxbGOJoFDcgVLIWTZU+uyRdqrbzNExRce7D2aJz+wOs=";
+    hash = "sha256-5efnpOZUeMdikG0I9ZRkfYFI/9wyrpCNVrc8DfjqBPI=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/model-checker/default.nix b/pkgs/development/python-modules/model-checker/default.nix
index cb918a23394f..369868bee089 100644
--- a/pkgs/development/python-modules/model-checker/default.nix
+++ b/pkgs/development/python-modules/model-checker/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "model-checker";
-  version = "0.8.8";
+  version = "0.8.13";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "model_checker";
     inherit version;
-    hash = "sha256-jxj397xLP0VMlqPfFLHQ2Uh5Bo3n9EUh/BeZdWZEVaQ=";
+    hash = "sha256-bWaqddc2XhyP/CaLQxJpj/nXXp/4oW7/t6ogmiSNtI4=";
   };
 
   # z3 does not provide a dist-info, so python-runtime-deps-check will fail
diff --git a/pkgs/development/python-modules/ormsgpack/default.nix b/pkgs/development/python-modules/ormsgpack/default.nix
new file mode 100644
index 000000000000..5b94c78db911
--- /dev/null
+++ b/pkgs/development/python-modules/ormsgpack/default.nix
@@ -0,0 +1,76 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  cargo,
+  rustPlatform,
+  rustc,
+  pyinstaller,
+
+  # dependencies
+  msgpack,
+
+  # testing
+  pydantic,
+  pytestCheckHook,
+  python-dateutil,
+  pytz,
+}:
+
+buildPythonPackage rec {
+  pname = "ormsgpack";
+  version = "1.9.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "aviramha";
+    repo = "ormsgpack";
+    tag = version;
+    hash = "sha256-lFKHXTYtYEjtu+nXemQnB0yjkFD69gr0n7XfJ1Hy3J0=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit src;
+    hash = "sha256-jOEryJcE5+b0Y588fbDSyPcz5h4zYz2+40+lIfRDV1M=";
+  };
+
+  build-system = [
+    cargo
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+    rustc
+  ];
+
+  # requires nightly features (feature(portable_simd))
+  env.RUSTC_BOOTSTRAP = true;
+
+  dependencies = [
+    msgpack
+  ];
+
+  nativeBuildInputs = [
+    pyinstaller
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pydantic
+    python-dateutil
+    pytz
+  ];
+
+  pythonImportsCheck = [
+    "ormsgpack"
+  ];
+
+  meta = {
+    description = "Fast msgpack serialization library for Python derived from orjson";
+    homepage = "https://github.com/aviramha/ormsgpack";
+    changelog = "https://github.com/aviramha/ormsgpack/releases/tag/${version}";
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    maintainers = with lib.maintainers; [ sarahec ];
+  };
+}
diff --git a/pkgs/development/python-modules/peft/default.nix b/pkgs/development/python-modules/peft/default.nix
index 831970cdb825..c0acbfd1ac70 100644
--- a/pkgs/development/python-modules/peft/default.nix
+++ b/pkgs/development/python-modules/peft/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  stdenv,
 
   # build-system
   setuptools,
@@ -69,6 +70,11 @@ buildPythonPackage rec {
 
   pytestFlagsArray = [ "tests" ];
 
+  # These tests fail when MPS devices are detected
+  disabledTests = lib.optional stdenv.isDarwin [
+    "gpu"
+  ];
+
   disabledTestPaths = [
     # ValueError: Can't find 'adapter_config.json'
     "tests/test_config.py"
@@ -104,9 +110,5 @@ buildPythonPackage rec {
     changelog = "https://github.com/huggingface/peft/releases/tag/v${version}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ bcdarwin ];
-    badPlatforms = [
-      # No module named 'torch._C._distributed_c10d'; 'torch._C' is not a package
-      lib.systems.inspect.patterns.isDarwin
-    ];
   };
 }
diff --git a/pkgs/development/python-modules/playwrightcapture/default.nix b/pkgs/development/python-modules/playwrightcapture/default.nix
index 21d14e710718..44bc8f204ac2 100644
--- a/pkgs/development/python-modules/playwrightcapture/default.nix
+++ b/pkgs/development/python-modules/playwrightcapture/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "playwrightcapture";
-  version = "1.28.3";
+  version = "1.28.4";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "Lookyloo";
     repo = "PlaywrightCapture";
     tag = "v${version}";
-    hash = "sha256-uf1uCXuCgp9Ly7sYdcGiwyjI7QbEqLvQEtJt2DE/06k=";
+    hash = "sha256-w3ZQqur/fj36n64Li/qNnhJ8b7Lu3cna2eNj4hxhZ/8=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/pyctr/default.nix b/pkgs/development/python-modules/pyctr/default.nix
index 1267085c86e8..a3280adc4726 100644
--- a/pkgs/development/python-modules/pyctr/default.nix
+++ b/pkgs/development/python-modules/pyctr/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pyctr";
-  version = "0.7.5";
+  version = "0.7.6";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-fiDJWcypFabnUoS313f56ypDuDrLASHrkk0Em8bymmw=";
+    hash = "sha256-8Vgesn/uLe9rq2JqdUy0qL9FOmglJ7vxr5gRsGNGhAI=";
   };
 
   propagatedBuildInputs = [ pycryptodomex ];
diff --git a/pkgs/development/python-modules/pykoplenti/default.nix b/pkgs/development/python-modules/pykoplenti/default.nix
index dfea12e0d346..27c0e68a97a8 100644
--- a/pkgs/development/python-modules/pykoplenti/default.nix
+++ b/pkgs/development/python-modules/pykoplenti/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "pykoplenti";
-  version = "1.3.0";
+  version = "1.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "stegm";
     repo = "pykoplenti";
     tag = "v${version}";
-    hash = "sha256-6edlcjQvV+6q3/ytn9KR/IovduVREEQt8foE2lfsBko=";
+    hash = "sha256-vsqbjNj5x7X0VGbTq+CdZ9rPXVDypBkgaCI6MImloLo=";
   };
 
   pythonRelaxDeps = [ "pydantic" ];
diff --git a/pkgs/development/python-modules/pyorc/default.nix b/pkgs/development/python-modules/pyorc/default.nix
new file mode 100644
index 000000000000..bd2935ef7853
--- /dev/null
+++ b/pkgs/development/python-modules/pyorc/default.nix
@@ -0,0 +1,73 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pybind11,
+  setuptools,
+  pytestCheckHook,
+  tzdata,
+  python,
+  pkgs,
+}:
+
+buildPythonPackage rec {
+  pname = "pyorc";
+  version = "0.10.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "noirello";
+    repo = "pyorc";
+    tag = "v${version}";
+    hash = "sha256-2w3Qh6g+Yg+D10kTow9YR6B6FhQ+z2DvgDy5GtYxH4g=";
+  };
+
+  build-system = [
+    pybind11
+    setuptools
+  ];
+
+  env = {
+    PYORC_SKIP_ORC_BUILD = "true";
+  };
+
+  buildInputs = [
+    pkgs.lz4
+    pkgs.protobuf
+    pkgs.snappy
+    pkgs.zlib
+    pkgs.zstd
+    pkgs.apache-orc
+  ];
+
+  preCheck = ''
+    # provide timezone data, works only on linux
+    export TZDIR=${tzdata}/${python.sitePackages}/tzdata/zoneinfo
+
+    substituteInPlace "tests/compare/test_writer_cmp.py" \
+      --replace-fail "deps/bin/orc-contents" "orc-contents"
+
+    substituteInPlace "tests/compare/test_reader_cmp.py" \
+      --replace-fail "deps/bin/orc-metadata" "orc-metadata"
+
+    mkdir -p deps
+    ln -s "${pkgs.apache-orc.src}/examples" "deps/"
+  '';
+
+  pythonImportsCheck = [
+    "pyorc"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pkgs.apache-orc
+  ];
+
+  meta = {
+    changelog = "https://github.com/noirello/pyorc/blob/${version}/CHANGELOG.rst";
+    description = "Python module for Apache ORC file format";
+    homepage = "https://github.com/noirello/pyorc";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ drupol ];
+  };
+}
diff --git a/pkgs/development/python-modules/pytest-kafka/default.nix b/pkgs/development/python-modules/pytest-kafka/default.nix
new file mode 100644
index 000000000000..ee4c323e8cef
--- /dev/null
+++ b/pkgs/development/python-modules/pytest-kafka/default.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitLab,
+  setuptools,
+  kafka-python-ng,
+  port-for,
+  pytest,
+}:
+
+buildPythonPackage rec {
+  pname = "pytest-kafka";
+  version = "0.8.1";
+  pyproject = true;
+
+  src = fetchFromGitLab {
+    owner = "karolinepauls";
+    repo = "pytest-kafka";
+    tag = "v${version}";
+    hash = "sha256-OR8SpNswbPOVtAcFuZgrZJR5K6wPb1TS5leybKWr3zY=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    kafka-python-ng
+    port-for
+    pytest
+  ];
+
+  pythonImportsCheck = [ "pytest_kafka" ];
+
+  # Tests depends on a kafka server running
+  doCheck = false;
+
+  meta = {
+    description = "Pytest fixture factories for Zookeeper, Kafka server and Kafka consumer";
+    homepage = "https://gitlab.com/karolinepauls/pytest-kafka";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ drupol ];
+  };
+}
diff --git a/pkgs/development/python-modules/pytorch-pfn-extras/default.nix b/pkgs/development/python-modules/pytorch-pfn-extras/default.nix
index 29c448e963ba..fab0a1a49e72 100644
--- a/pkgs/development/python-modules/pytorch-pfn-extras/default.nix
+++ b/pkgs/development/python-modules/pytorch-pfn-extras/default.nix
@@ -66,7 +66,7 @@ buildPythonPackage rec {
       "test_register"
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      # torch.distributed is not available on darwin
+      # torch.distributed was not available on darwin at one point; revisit
       "test_create_distributed_evaluator"
       "test_distributed_evaluation"
       "test_distributed_evaluator_progress_bar"
@@ -96,7 +96,7 @@ buildPythonPackage rec {
       "tests/pytorch_pfn_extras_tests/dynamo_tests/test_compile.py"
     ]
     ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
-      # torch.distributed is not available on darwin
+      # torch.distributed was not available on darwin at one point; revisit
       "tests/pytorch_pfn_extras_tests/distributed_tests/test_distributed_validation_sampler.py"
       "tests/pytorch_pfn_extras_tests/nn_tests/parallel_tests/test_distributed.py"
       "tests/pytorch_pfn_extras_tests/profiler_tests/test_record.py"
@@ -116,5 +116,9 @@ buildPythonPackage rec {
     changelog = "https://github.com/pfnet/pytorch-pfn-extras/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ samuela ];
+    badPlatforms = [
+      # test_profile_report is broken on darwin
+      lib.systems.inspect.patterns.isDarwin
+    ];
   };
 }
diff --git a/pkgs/development/python-modules/scim2-models/default.nix b/pkgs/development/python-modules/scim2-models/default.nix
index 54a8575817d0..5e625418d8af 100644
--- a/pkgs/development/python-modules/scim2-models/default.nix
+++ b/pkgs/development/python-modules/scim2-models/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "scim2-models";
-  version = "0.3.1";
+  version = "0.3.2";
 
   pyproject = true;
 
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "scim2_models";
-    hash = "sha256-oV6OGgsIHEvekc39TqS2egQ1tUz8BL2dTADNWNwdrxE=";
+    hash = "sha256-CHXvg7okGvUKJ2tND/EduUPPpUAwIc97BM/nGAeDiYE=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/scim2-server/default.nix b/pkgs/development/python-modules/scim2-server/default.nix
index 8ad17410d070..fa844171be8b 100644
--- a/pkgs/development/python-modules/scim2-server/default.nix
+++ b/pkgs/development/python-modules/scim2-server/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "scim2-server";
-  version = "0.1.4";
+  version = "0.1.5";
 
   pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = "scim2_server";
-    hash = "sha256-5BPkRVon70BWVL2Pvh9kISVnyP2FXR2s3FOWCpcBiZQ=";
+    hash = "sha256-VCJVLnYg3+Kz7/DXWnZXkFqXVszsd2hm3cLY22J4NRw=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/scim2-tester/default.nix b/pkgs/development/python-modules/scim2-tester/default.nix
index 29a4853f8a5f..93de7bf9f384 100644
--- a/pkgs/development/python-modules/scim2-tester/default.nix
+++ b/pkgs/development/python-modules/scim2-tester/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "scim2-tester";
-  version = "0.1.13";
+  version = "0.1.14";
 
   pyproject = true;
 
@@ -23,7 +23,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "scim2_tester";
-    hash = "sha256-Jpfxyok46fRCW3aAOFb0BTEI++Ou5lob/0RsoXgzkxk=";
+    hash = "sha256-QoqD0dgEuL0VJ6vc6K76G7ipl7rKjlzJuTwFCnfS/64=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/sentence-transformers/default.nix b/pkgs/development/python-modules/sentence-transformers/default.nix
index 2ba0e892ac86..aa0f6a2a3a6d 100644
--- a/pkgs/development/python-modules/sentence-transformers/default.nix
+++ b/pkgs/development/python-modules/sentence-transformers/default.nix
@@ -113,9 +113,5 @@ buildPythonPackage rec {
     changelog = "https://github.com/UKPLab/sentence-transformers/releases/tag/v${version}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ dit7ya ];
-    badPlatforms = [
-      # No module named 'torch._C._distributed_c10d'; 'torch._C' is not a package
-      lib.systems.inspect.patterns.isDarwin
-    ];
   };
 }
diff --git a/pkgs/development/python-modules/smolagents/default.nix b/pkgs/development/python-modules/smolagents/default.nix
index b26a14f557c4..2835fff213cc 100644
--- a/pkgs/development/python-modules/smolagents/default.nix
+++ b/pkgs/development/python-modules/smolagents/default.nix
@@ -28,18 +28,19 @@
   torchvision,
   transformers,
   websocket-client,
+  wikipedia-api,
 }:
 
 buildPythonPackage rec {
   pname = "smolagents";
-  version = "1.12.0";
+  version = "1.13.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "smolagents";
     tag = "v${version}";
-    hash = "sha256-OgivL7L6IOqIEDHO3JUrxluMZoq768DD3hhUpIh1fac=";
+    hash = "sha256-LZW2MsBowr2ttl3V5J3AlIxZijo++DwT02gBVaXXBXs=";
   };
 
   build-system = [ setuptools ];
@@ -102,6 +103,7 @@ buildPythonPackage rec {
     ipython
     pytest-datadir
     pytestCheckHook
+    wikipedia-api
   ] ++ lib.flatten (builtins.attrValues optional-dependencies);
 
   pythonImportsCheck = [ "smolagents" ];
@@ -122,6 +124,7 @@ buildPythonPackage rec {
       "test_transformers_message_vl_no_tool"
       "test_transformers_toolcalling_agent"
       "test_visit_webpage"
+      "test_wikipedia_search"
     ]
     ++ lib.optionals stdenv.isDarwin [
       # Missing dependencies
@@ -136,12 +139,6 @@ buildPythonPackage rec {
       "test_new_instance"
     ];
 
-  disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
-    # No module named 'torch._C._distributed_c10d'; 'torch._C' is not a package
-    "tests/test_final_answer.py"
-    "tests/test_types.py"
-  ];
-
   __darwinAllowLocalNetworking = true;
 
   meta = {
diff --git a/pkgs/development/python-modules/swh-export/default.nix b/pkgs/development/python-modules/swh-export/default.nix
new file mode 100644
index 000000000000..6429bd8b475e
--- /dev/null
+++ b/pkgs/development/python-modules/swh-export/default.nix
@@ -0,0 +1,90 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitLab,
+  setuptools,
+  setuptools-scm,
+  boto3,
+  click,
+  tqdm,
+  pyorc,
+  plyvel,
+  python,
+  types-requests,
+  swh-core,
+  swh-journal,
+  swh-model,
+  swh-storage,
+  pytestCheckHook,
+  pytest-kafka,
+  pytest-mock,
+  tzdata,
+  pkgs,
+}:
+
+buildPythonPackage rec {
+  pname = "swh-export";
+  version = "1.8.0";
+  pyproject = true;
+
+  src = fetchFromGitLab {
+    domain = "gitlab.softwareheritage.org";
+    group = "swh";
+    owner = "devel";
+    repo = "swh-export";
+    tag = "v${version}";
+    hash = "sha256-n97MMYn7EmTrv411YSxUD1+zfbFB8KOSns44N3NqqV8=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [
+    boto3
+    click
+    tqdm
+    pyorc
+    plyvel
+    types-requests
+    swh-core
+    swh-journal
+    swh-model
+    swh-storage
+  ];
+
+  preCheck = ''
+    # provide timezone data, works only on linux
+    export TZDIR=${tzdata}/${python.sitePackages}/tzdata/zoneinfo
+  '';
+
+  pythonImportsCheck = [ "swh.export" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-kafka
+    pytest-mock
+    pkgs.zstd
+    pkgs.pv
+  ];
+
+  disabledTests = [
+    # I don't know how to fix the following error
+    # E       fixture 'kafka_server' not found
+    "test_parallel_journal_processor"
+    "test_parallel_journal_processor_origin"
+    "test_parallel_journal_processor_origin_visit_status"
+    "test_parallel_journal_processor_offsets"
+    "test_parallel_journal_processor_masked"
+    "test_parallel_journal_processor_masked_origin"
+    "test_parallel_journal_processor_masked_origin_visit_statuses"
+  ];
+
+  meta = {
+    description = "Software Heritage dataset tools";
+    homepage = "https://gitlab.softwareheritage.org/swh/devel/swh-export";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ drupol ];
+  };
+}
diff --git a/pkgs/development/python-modules/swh-objstorage/default.nix b/pkgs/development/python-modules/swh-objstorage/default.nix
index 478bc7e07bdf..6672a3054cdb 100644
--- a/pkgs/development/python-modules/swh-objstorage/default.nix
+++ b/pkgs/development/python-modules/swh-objstorage/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitLab,
   setuptools,
@@ -102,6 +103,11 @@ buildPythonPackage rec {
     util-linux
   ] ++ psycopg.optional-dependencies.pool;
 
+  disabledTests = lib.optionals (stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isLinux) [
+    # FAILED swh/objstorage/tests/test_objstorage_winery.py::test_winery_leaky_bucket_tick - assert 1 == 0
+    "test_winery_leaky_bucket_tick"
+  ];
+
   meta = {
     description = "Content-addressable object storage for the Software Heritage project";
     homepage = "https://gitlab.softwareheritage.org/swh/devel/swh-objstorage";
diff --git a/pkgs/development/python-modules/tensordict/default.nix b/pkgs/development/python-modules/tensordict/default.nix
index 29c92e118b36..19bfaa01a116 100644
--- a/pkgs/development/python-modules/tensordict/default.nix
+++ b/pkgs/development/python-modules/tensordict/default.nix
@@ -66,15 +66,10 @@ buildPythonPackage rec {
     "test_map_iter_interrupt_early"
   ];
 
-  disabledTestPaths =
-    [
-      # torch._dynamo.exc.Unsupported: Graph break due to unsupported builtin None.ReferenceType.__new__.
-      "test/test_compile.py"
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      # ModuleNotFoundError: No module named 'torch._C._distributed_c10d'; 'torch._C' is not a package
-      "test/test_distributed.py"
-    ];
+  disabledTestPaths = [
+    # torch._dynamo.exc.Unsupported: Graph break due to unsupported builtin None.ReferenceType.__new__.
+    "test/test_compile.py"
+  ];
 
   meta = {
     description = "Pytorch dedicated tensor container";
diff --git a/pkgs/development/python-modules/tensorflow-metadata/default.nix b/pkgs/development/python-modules/tensorflow-metadata/default.nix
index 19c5eefa5d0a..3d1c3fa3ad23 100644
--- a/pkgs/development/python-modules/tensorflow-metadata/default.nix
+++ b/pkgs/development/python-modules/tensorflow-metadata/default.nix
@@ -1,23 +1,27 @@
 {
-  absl-py,
+  lib,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  absl-py,
   googleapis-common-protos,
   protobuf,
-  setuptools,
-  lib,
 }:
 
 buildPythonPackage rec {
   pname = "tensorflow-metadata";
-  version = "1.16.1";
+  version = "1.17.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tensorflow";
     repo = "metadata";
     tag = "v${version}";
-    hash = "sha256-MP5P4kFACT1guZVU3f9YrnKeQaUK0Tnu7edKRy4yvlM=";
+    hash = "sha256-DD37l5Sqsn6m9mrRagKi/pi3GKjhO1HzEkEfmnhItqI=";
   };
 
   patches = [ ./build.patch ];
@@ -43,10 +47,10 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "tensorflow_metadata" ];
 
-  meta = with lib; {
+  meta = {
     description = "Standard representations for metadata that are useful when training machine learning models with TensorFlow";
     homepage = "https://github.com/tensorflow/metadata";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ ndl ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ ndl ];
   };
 }
diff --git a/pkgs/development/python-modules/torch/clang19-template-warning.patch b/pkgs/development/python-modules/torch/clang19-template-warning.patch
new file mode 100644
index 000000000000..deec511d011b
--- /dev/null
+++ b/pkgs/development/python-modules/torch/clang19-template-warning.patch
@@ -0,0 +1,31 @@
+Submodule third_party/libnop contains modified content
+diff --git a/third_party/tensorpipe/third_party/libnop/include/nop/types/variant.h b/third_party/tensorpipe/third_party/libnop/include/nop/types/variant.h
+index cffbde1..b6ebfab 100644
+--- a/third_party/tensorpipe/third_party/libnop/include/nop/types/variant.h
++++ b/third_party/tensorpipe/third_party/libnop/include/nop/types/variant.h
+@@ -238,7 +238,7 @@ class Variant {
+   // resulting type.
+   template <typename... Args>
+   void Construct(Args&&... args) {
+-    index_ = value_.template Construct(std::forward<Args>(args)...);
++    index_ = value_.template Construct<>(std::forward<Args>(args)...);
+   }
+   void Construct(EmptyVariant) {}
+ 
+@@ -255,14 +255,14 @@ class Variant {
+   // multiple element types.
+   template <typename T, typename U>
+   void Assign(TypeTag<T>, U&& value) {
+-    if (!value_.template Assign(TypeTag<T>{}, index_, std::forward<U>(value))) {
++    if (!value_.template Assign<>(TypeTag<T>{}, index_, std::forward<U>(value))) {
+       Destruct();
+       Construct(TypeTag<T>{}, std::forward<U>(value));
+     }
+   }
+   template <typename T>
+   void Assign(T&& value) {
+-    if (!value_.template Assign(index_, std::forward<T>(value))) {
++    if (!value_.template Assign<>(index_, std::forward<T>(value))) {
+       Destruct();
+       Construct(std::forward<T>(value));
+     }
diff --git a/pkgs/development/python-modules/torch/default.nix b/pkgs/development/python-modules/torch/default.nix
index 61d05aa3d3f2..72c086d557f3 100644
--- a/pkgs/development/python-modules/torch/default.nix
+++ b/pkgs/development/python-modules/torch/default.nix
@@ -271,7 +271,8 @@ buildPythonPackage rec {
   };
 
   patches =
-    lib.optionals cudaSupport [ ./fix-cmake-cuda-toolkit.patch ]
+    [ ./clang19-template-warning.patch ]
+    ++ lib.optionals cudaSupport [ ./fix-cmake-cuda-toolkit.patch ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       # Propagate CUPTI to Kineto by overriding the search path with environment variables.
       # https://github.com/pytorch/pytorch/pull/108847
@@ -395,6 +396,10 @@ buildPythonPackage rec {
   # Explicitly enable MPS for Darwin
   USE_MPS = setBool stdenv.hostPlatform.isDarwin;
 
+  # building torch.distributed on Darwin is disabled by default
+  # https://pytorch.org/docs/stable/distributed.html#torch.distributed.is_available
+  USE_DISTRIBUTED = setBool true;
+
   cmakeFlags =
     [
       (lib.cmakeFeature "PYTHON_SIX_SOURCE_DIR" "${six.src}")
@@ -604,8 +609,15 @@ buildPythonPackage rec {
       find "$out/${python.sitePackages}/torch/include" "$out/${python.sitePackages}/torch/lib" -type f -exec remove-references-to -t ${stdenv.cc} '{}' +
 
       mkdir $dev
+
+      # CppExtension requires that include files are packaged with the main
+      # python library output; which is why they are copied here.
       cp -r $out/${python.sitePackages}/torch/include $dev/include
-      cp -r $out/${python.sitePackages}/torch/share $dev/share
+
+      # Cmake files under /share are different and can be safely moved. This
+      # avoids unnecessary closure blow-up due to apple sdk references when
+      # USE_DISTRIBUTED is enabled.
+      mv $out/${python.sitePackages}/torch/share $dev/share
 
       # Fix up library paths for split outputs
       substituteInPlace \
diff --git a/pkgs/development/python-modules/torchsnapshot/default.nix b/pkgs/development/python-modules/torchsnapshot/default.nix
index 37c882c9fd75..90e4c3f2dbbf 100644
--- a/pkgs/development/python-modules/torchsnapshot/default.nix
+++ b/pkgs/development/python-modules/torchsnapshot/default.nix
@@ -68,7 +68,7 @@ buildPythonPackage rec {
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ GaetanLepage ];
     badPlatforms = [
-      # ModuleNotFoundError: No module named 'torch._C._distributed_c10d'; 'torch._C' is not a package
+      # test suite gets stuck and eventually times out with: "torch.distributed.DistNetworkError: The client socket has timed out after"
       lib.systems.inspect.patterns.isDarwin
     ];
   };
diff --git a/pkgs/development/python-modules/typed-ast/default.nix b/pkgs/development/python-modules/typed-ast/default.nix
index 9cf774443302..da5da6112d83 100644
--- a/pkgs/development/python-modules/typed-ast/default.nix
+++ b/pkgs/development/python-modules/typed-ast/default.nix
@@ -1,36 +1,35 @@
 {
   lib,
   buildPythonPackage,
+  pythonAtLeast,
   fetchFromGitHub,
+  setuptools,
   pytest,
-  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "typed-ast";
-  version = "1.5.4";
-  format = "setuptools";
+  version = "1.5.5";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  # error: unknown type name ‘PyFutureFeatures’
+  disabled = pythonAtLeast "3.13";
 
   src = fetchFromGitHub {
     owner = "python";
     repo = "typed_ast";
-    rev = version;
-    hash = "sha256-GRmKw7SRrrIIb61VeB8GLhSKCmLUd54AA+GAf43vor8=";
+    tag = version;
+    hash = "sha256-A/FA6ngu8/bbpKW9coJ7unm9GQezGuDhgBWjOhAxm2o=";
   };
 
+  build-system = [
+    setuptools
+  ];
+
   nativeCheckInputs = [ pytest ];
 
-  checkPhase = ''
-    runHook preCheck
-
-    # We can't use pytestCheckHook because that invokes pytest with python -m pytest
-    # which adds the current directory to sys.path at the beginning.
-    # _That_ version of the typed_ast module doesn't have the C extensions we need.
-    pytest
-
-    runHook postCheck
+  preCheck = ''
+    rm -rf typed_ast
   '';
 
   pythonImportsCheck = [
@@ -40,10 +39,10 @@ buildPythonPackage rec {
     "typed_ast.conversions"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Python AST modules with type comment support";
     homepage = "https://github.com/python/typed_ast";
-    license = licenses.asl20;
+    license = lib.licenses.asl20;
     maintainers = [ ];
   };
 }
diff --git a/pkgs/development/python-modules/types-decorator/default.nix b/pkgs/development/python-modules/types-decorator/default.nix
index 6f3cdd6c4a13..e732c6ad25d1 100644
--- a/pkgs/development/python-modules/types-decorator/default.nix
+++ b/pkgs/development/python-modules/types-decorator/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage rec {
   pname = "types-decorator";
-  version = "5.2.0.20250224";
+  version = "5.2.0.20250324";
   pyproject = true;
 
   src = fetchPypi {
     pname = "types_decorator";
     inherit version;
-    hash = "sha256-1oqi9Vz1BFEN19AbSeaN0yw6IA0LwMu4RZXboaEZVP8=";
+    hash = "sha256-j71ysNrcVhduSOUYfedE52/kW8yRolh0uqdWYkEhVdM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/wikipedia-api/default.nix b/pkgs/development/python-modules/wikipedia-api/default.nix
index e169f9864670..71a26aafc855 100644
--- a/pkgs/development/python-modules/wikipedia-api/default.nix
+++ b/pkgs/development/python-modules/wikipedia-api/default.nix
@@ -2,14 +2,15 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  requests,
   pytestCheckHook,
+  requests,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "wikipedia-api";
   version = "0.8.1";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "martin-majlis";
@@ -18,7 +19,9 @@ buildPythonPackage rec {
     hash = "sha256-5wi1HVkD36RnmIAKSKRYTc30HtYMiFrRoYzZRWENd/M=";
   };
 
-  propagatedBuildInputs = [ requests ];
+  build-system = [ setuptools ];
+
+  dependencies = [ requests ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
diff --git a/pkgs/development/python-modules/xml2rfc/default.nix b/pkgs/development/python-modules/xml2rfc/default.nix
index 572ebdaad5df..206ee75049d7 100644
--- a/pkgs/development/python-modules/xml2rfc/default.nix
+++ b/pkgs/development/python-modules/xml2rfc/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage rec {
   pname = "xml2rfc";
-  version = "3.28.0";
+  version = "3.28.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "ietf-tools";
     repo = "xml2rfc";
     tag = "v${version}";
-    hash = "sha256-pWJ2nzRMnukcsuhzwsp1uZ3kFakfqrPn8/qooxGeM74=";
+    hash = "sha256-3wyW1LHHsaJrgynMYgdQ01UhGQ7eyLbOv6I+A0adX1E=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/apko/default.nix b/pkgs/development/tools/apko/default.nix
index bbc2fe5989e4..0189f549d306 100644
--- a/pkgs/development/tools/apko/default.nix
+++ b/pkgs/development/tools/apko/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "apko";
-  version = "0.25.5";
+  version = "0.25.6";
 
   src = fetchFromGitHub {
     owner = "chainguard-dev";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-t5ktcl52KOinqqFNNQISqAUBZ08qfR3VBXFTF9k3bsQ=";
+    hash = "sha256-BtEk5XncGPxs8Voy6p2zovwCipdlUdQ48IOW1Gah9fY=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
diff --git a/pkgs/development/tools/parsing/antlr/4.nix b/pkgs/development/tools/parsing/antlr/4.nix
index b84405e6c93a..f020ab3c149c 100644
--- a/pkgs/development/tools/parsing/antlr/4.nix
+++ b/pkgs/development/tools/parsing/antlr/4.nix
@@ -33,7 +33,7 @@ let
       source = fetchFromGitHub {
         owner = "antlr";
         repo = "antlr4";
-        rev = version;
+        tag = version;
         sha256 = sourceSha256;
       };
 
@@ -73,7 +73,7 @@ let
           jarLocation = antlr.src;
         };
 
-        meta = with lib; {
+        meta = {
           description = "Powerful parser generator";
           longDescription = ''
             ANTLR (ANother Tool for Language Recognition) is a powerful parser
@@ -83,9 +83,9 @@ let
             walk parse trees.
           '';
           homepage = "https://www.antlr.org/";
-          sourceProvenance = with sourceTypes; [ binaryBytecode ];
-          license = licenses.bsd3;
-          platforms = platforms.unix;
+          sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+          license = lib.licenses.bsd3;
+          platforms = lib.platforms.unix;
         };
       };
 
@@ -114,11 +114,11 @@ let
 
           cmakeFlags = extraCppCmakeFlags;
 
-          meta = with lib; {
+          meta = {
             description = "C++ target for ANTLR 4";
             homepage = "https://www.antlr.org/";
-            license = licenses.bsd3;
-            platforms = platforms.unix;
+            license = lib.licenses.bsd3;
+            platforms = lib.platforms.unix;
           };
         };
       };
@@ -133,11 +133,11 @@ in
       jarSha256 = "sha256-6uLfoRmmQydERnKv9j6ew1ogGA3FuAkLemq4USXfTXY=";
       extraCppCmakeFlags = [
         # Generate CMake config files, which are not installed by default.
-        "-DANTLR4_INSTALL=ON"
+        (lib.cmakeBool "ANTLR4_INSTALL" true)
 
         # Disable tests, since they require downloading googletest, which is
         # not available in a sandboxed build.
-        "-DANTLR_BUILD_CPP_TESTS=OFF"
+        (lib.cmakeBool "ANTLR_BUILD_CPP_TESTS" false)
       ];
       extraPatches = [
         ./include-dir-issue-379757.patch
@@ -151,11 +151,11 @@ in
       jarSha256 = "sha256-iPGKK/rA3eEAntpcfc41ilKHf673ho9WIjpbzBUynkM=";
       extraCppCmakeFlags = [
         # Generate CMake config files, which are not installed by default.
-        "-DANTLR4_INSTALL=ON"
+        (lib.cmakeBool "ANTLR4_INSTALL" true)
 
         # Disable tests, since they require downloading googletest, which is
         # not available in a sandboxed build.
-        "-DANTLR_BUILD_CPP_TESTS=OFF"
+        (lib.cmakeBool "ANTLR_BUILD_CPP_TESTS" false)
       ];
     }).antlr;
 
@@ -166,11 +166,11 @@ in
       jarSha256 = "sha256-YpdeGStK8mIrcrXwExVT7jy86X923CpBYy3MVeJUc+E=";
       extraCppCmakeFlags = [
         # Generate CMake config files, which are not installed by default.
-        "-DANTLR4_INSTALL=ON"
+        (lib.cmakeBool "ANTLR4_INSTALL" true)
 
         # Disable tests, since they require downloading googletest, which is
         # not available in a sandboxed build.
-        "-DANTLR_BUILD_CPP_TESTS=OFF"
+        (lib.cmakeBool "ANTLR_BUILD_CPP_TESTS" false)
       ];
     }).antlr;
 
@@ -181,8 +181,8 @@ in
       jarSha256 = "sha256-QZSdQfINMdW4J3GHc13XVRCN9Ss422yGUQjTOCBA+Rg=";
       extraCppBuildInputs = lib.optional stdenv.hostPlatform.isLinux libuuid;
       extraCppCmakeFlags = [
-        "-DANTLR4_INSTALL=ON"
-        "-DANTLR_BUILD_CPP_TESTS=OFF"
+        (lib.cmakeBool "ANTLR4_INSTALL" true)
+        (lib.cmakeBool "ANTLR_BUILD_CPP_TESTS" false)
       ];
     }).antlr;
 
@@ -193,7 +193,7 @@ in
       jarSha256 = "0dnz2x54kigc58bxnynjhmr5iq49f938vj6p50gdir1xdna41kdg";
       extraCppBuildInputs = [ utf8cpp ] ++ lib.optional stdenv.hostPlatform.isLinux libuuid;
       extraCppCmakeFlags = [
-        "-DCMAKE_CXX_FLAGS='-I${lib.getDev utf8cpp}/include/utf8cpp'"
+        (lib.cmakeFeature "CMAKE_CXX_FLAGS" "-I${lib.getDev utf8cpp}/include/utf8cpp")
       ];
       extraPatches = [
         ./utf8cpp.patch
@@ -206,6 +206,8 @@ in
       sourceSha256 = "1qal3add26qxskm85nk7r758arladn5rcyjinmhlhznmpbbv9j8m";
       jarSha256 = "0nms976cnqyr1ndng3haxkmknpdq6xli4cpf4x4al0yr21l9v93k";
       extraCppBuildInputs = lib.optional stdenv.hostPlatform.isLinux libuuid;
-      extraCppCmakeFlags = [ "-DANTLR4_INSTALL=ON" ];
+      extraCppCmakeFlags = [
+        (lib.cmakeBool "ANTLR4_INSTALL" true)
+      ];
     }).antlr;
 }
diff --git a/pkgs/servers/spicedb/default.nix b/pkgs/servers/spicedb/default.nix
index 448f3cea1ae9..731b6c43b759 100644
--- a/pkgs/servers/spicedb/default.nix
+++ b/pkgs/servers/spicedb/default.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "spicedb";
-  version = "1.41.0";
+  version = "1.42.0";
 
   src = fetchFromGitHub {
     owner = "authzed";
     repo = "spicedb";
     rev = "v${version}";
-    hash = "sha256-baCHn9GqCwFVZ4cr1pnVUsq5+u26ETEyMLdf39cJ0Yg=";
+    hash = "sha256-7E9wbPi82F9mqqEsnK96a376QRu9NnpdZRAFB0pe1Lc=";
   };
 
-  vendorHash = "sha256-ln4OL1ZLS+UwmmSSofTrvuvBpj5fSN5YQkATkc5sCyM=";
+  vendorHash = "sha256-mjzVMtTLJiimzQcXntd2JTIDQS7ndRqosxCVorzcn54=";
 
   ldflags = [
     "-X 'github.com/jzelinskie/cobrautil/v2.Version=${src.rev}'"
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 8fab66bb2aea..a489871452c4 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -2,9 +2,7 @@
   lib,
   config,
   stdenv,
-  aws-sdk-cpp,
-  boehmgc,
-  callPackage,
+  nixDependencies,
   generateSplicesForMkScope,
   fetchFromGitHub,
   fetchpatch2,
@@ -20,99 +18,22 @@
   confDir ? "/etc",
 }:
 let
-  boehmgc-nix_2_3 = boehmgc.override { enableLargeConfig = true; };
-
-  boehmgc-nix = boehmgc-nix_2_3.overrideAttrs (drv: {
-    patches = (drv.patches or [ ]) ++ [
-      # Part of the GC solution in https://github.com/NixOS/nix/pull/4944
-      ./patches/boehmgc-coroutine-sp-fallback.patch
-    ];
-  });
-
-  # old nix fails to build with newer aws-sdk-cpp and the patch doesn't apply
-  aws-sdk-cpp-old-nix =
-    (aws-sdk-cpp.override {
-      apis = [
-        "s3"
-        "transfer"
-      ];
-      customMemoryManagement = false;
-    }).overrideAttrs
-      (args: rec {
-        # intentionally overriding postPatch
-        version = "1.9.294";
-
-        src = fetchFromGitHub {
-          owner = "aws";
-          repo = "aws-sdk-cpp";
-          rev = version;
-          hash = "sha256-Z1eRKW+8nVD53GkNyYlZjCcT74MqFqqRMeMc33eIQ9g=";
-        };
-        postPatch =
-          ''
-            # Avoid blanket -Werror to evade build failures on less
-            # tested compilers.
-            substituteInPlace cmake/compiler_settings.cmake \
-              --replace '"-Werror"' ' '
-
-            # Missing includes for GCC11
-            sed '5i#include <thread>' -i \
-              aws-cpp-sdk-cloudfront-integration-tests/CloudfrontOperationTest.cpp \
-              aws-cpp-sdk-cognitoidentity-integration-tests/IdentityPoolOperationTest.cpp \
-              aws-cpp-sdk-dynamodb-integration-tests/TableOperationTest.cpp \
-              aws-cpp-sdk-elasticfilesystem-integration-tests/ElasticFileSystemTest.cpp \
-              aws-cpp-sdk-lambda-integration-tests/FunctionTest.cpp \
-              aws-cpp-sdk-mediastore-data-integration-tests/MediaStoreDataTest.cpp \
-              aws-cpp-sdk-queues/source/sqs/SQSQueue.cpp \
-              aws-cpp-sdk-redshift-integration-tests/RedshiftClientTest.cpp \
-              aws-cpp-sdk-s3-crt-integration-tests/BucketAndObjectOperationTest.cpp \
-              aws-cpp-sdk-s3-integration-tests/BucketAndObjectOperationTest.cpp \
-              aws-cpp-sdk-s3control-integration-tests/S3ControlTest.cpp \
-              aws-cpp-sdk-sqs-integration-tests/QueueOperationTest.cpp \
-              aws-cpp-sdk-transfer-tests/TransferTests.cpp
-            # Flaky on Hydra
-            rm aws-cpp-sdk-core-tests/aws/auth/AWSCredentialsProviderTest.cpp
-            # Includes aws-c-auth private headers, so only works with submodule build
-            rm aws-cpp-sdk-core-tests/aws/auth/AWSAuthSignerTest.cpp
-            # TestRandomURLMultiThreaded fails
-            rm aws-cpp-sdk-core-tests/http/HttpClientTest.cpp
-          ''
-          + lib.optionalString aws-sdk-cpp.stdenv.hostPlatform.isi686 ''
-            # EPSILON is exceeded
-            rm aws-cpp-sdk-core-tests/aws/client/AdaptiveRetryStrategyTest.cpp
-          '';
-
-        patches = (args.patches or [ ]) ++ [ ./patches/aws-sdk-cpp-TransferManager-ContentEncoding.patch ];
-
-        # only a stripped down version is build which takes a lot less resources to build
-        requiredSystemFeatures = [ ];
-      });
-
-  aws-sdk-cpp-nix =
-    (aws-sdk-cpp.override {
-      apis = [
-        "s3"
-        "transfer"
-      ];
-      customMemoryManagement = false;
-    }).overrideAttrs
-      {
-        # only a stripped down version is build which takes a lot less resources to build
-        requiredSystemFeatures = [ ];
-      };
 
+  # Called for Nix < 2.26
   common =
     args:
-    callPackage (import ./common.nix ({ inherit lib fetchFromGitHub; } // args)) {
+    nixDependencies.callPackage (import ./common.nix ({ inherit lib fetchFromGitHub; } // args)) {
       inherit
         Security
         storeDir
         stateDir
         confDir
         ;
-      boehmgc = boehmgc-nix;
       aws-sdk-cpp =
-        if lib.versionAtLeast args.version "2.12pre" then aws-sdk-cpp-nix else aws-sdk-cpp-old-nix;
+        if lib.versionAtLeast args.version "2.12pre" then
+          nixDependencies.aws-sdk-cpp
+        else
+          nixDependencies.aws-sdk-cpp-old;
     };
 
   # https://github.com/NixOS/nix/pull/7585
@@ -219,18 +140,15 @@ lib.makeExtensible (
   (
     {
       nix_2_3 =
-        (
-          (common {
-            version = "2.3.18";
-            hash = "sha256-jBz2Ub65eFYG+aWgSI3AJYvLSghio77fWQiIW1svA9U=";
-            patches = [
-              patch-monitorfdhup
-            ];
-            self_attribute_name = "nix_2_3";
-            maintainers = with lib.maintainers; [ flokli ];
-          }).override
-          { boehmgc = boehmgc-nix_2_3; }
-        ).overrideAttrs
+        (common {
+          version = "2.3.18";
+          hash = "sha256-jBz2Ub65eFYG+aWgSI3AJYvLSghio77fWQiIW1svA9U=";
+          patches = [
+            patch-monitorfdhup
+          ];
+          self_attribute_name = "nix_2_3";
+          maintainers = with lib.maintainers; [ flokli ];
+        }).overrideAttrs
           {
             # https://github.com/NixOS/nix/issues/10222
             # spurious test/add.sh failures
@@ -249,17 +167,36 @@ lib.makeExtensible (
         self_attribute_name = "nix_2_25";
       };
 
-      nixComponents_2_26 = (
-        callPackage ./vendor/2_26/componentized.nix {
-          inherit (self.nix_2_24.meta) maintainers;
-          otherSplices = generateSplicesForNixComponents "nixComponents_2_26";
-        }
-      );
+      nixComponents_2_26 = nixDependencies.callPackage ./modular/packages.nix {
+        version = "2.26.3";
+        inherit (self.nix_2_24.meta) maintainers;
+        otherSplices = generateSplicesForNixComponents "nixComponents_2_26";
+        src = fetchFromGitHub {
+          owner = "NixOS";
+          repo = "nix";
+          rev = "42fc03dd1f12df2d9152303f3fb8bf22b746462c";
+          hash = "sha256-5ZV8YqU8mfFmoAMiUEuBqNwk0T3vUR//x1D12BiYCeY=";
+        };
+      };
 
       # Note, this might eventually become an alias, as packages should
       # depend on the components they need in `nixComponents_2_26`.
       nix_2_26 = addTests "nix_2_26" self.nixComponents_2_26.nix-everything;
 
+      nixComponents_2_27 = nixDependencies.callPackage ./modular/packages.nix {
+        version = "2.27.1";
+        inherit (self.nix_2_24.meta) maintainers;
+        otherSplices = generateSplicesForNixComponents "nixComponents_2_26";
+        src = fetchFromGitHub {
+          owner = "NixOS";
+          repo = "nix";
+          rev = "9cb662df7442a1e2c4600fb8ecb2ad613ebc5a95";
+          hash = "sha256-rBPulEBpn4IiqkPsetuh7BRzT2iGCzZYnogTAsbrvhU=";
+        };
+      };
+
+      nix_2_27 = addTests "nix_2_27" self.nixComponents_2_27.nix-everything;
+
       latest = self.nix_2_26;
 
       # The minimum Nix version supported by Nixpkgs
diff --git a/pkgs/tools/package-management/nix/dependencies-scope.nix b/pkgs/tools/package-management/nix/dependencies-scope.nix
new file mode 100644
index 000000000000..cb562dad3505
--- /dev/null
+++ b/pkgs/tools/package-management/nix/dependencies-scope.nix
@@ -0,0 +1,22 @@
+{
+  lib,
+  generateSplicesForMkScope,
+  newScope,
+  splicePackages,
+  callPackage,
+}:
+
+let
+  otherSplices = generateSplicesForMkScope [ "nixDependencies" ];
+in
+lib.makeScopeWithSplicing'
+  {
+    inherit splicePackages;
+    inherit newScope; # layered directly on pkgs, unlike nixComponents above
+  }
+  {
+    # Technically this should point to the nixDependencies set only, but
+    # this is ok as long as the scopes don't intersect.
+    inherit otherSplices;
+    f = (callPackage ./dependencies.nix { }).scopeFunction;
+  }
diff --git a/pkgs/tools/package-management/nix/dependencies.nix b/pkgs/tools/package-management/nix/dependencies.nix
new file mode 100644
index 000000000000..a1a964836959
--- /dev/null
+++ b/pkgs/tools/package-management/nix/dependencies.nix
@@ -0,0 +1,102 @@
+regular@{
+  lib,
+  boehmgc,
+  aws-sdk-cpp,
+  fetchFromGitHub,
+  pkgs,
+  stdenv,
+}:
+
+let
+  stdenv =
+    if regular.stdenv.isDarwin && regular.stdenv.isx86_64 then darwinStdenv else regular.stdenv;
+
+  # Fix the following error with the default x86_64-darwin SDK:
+  #
+  #     error: aligned allocation function of type 'void *(std::size_t, std::align_val_t)' is only available on macOS 10.13 or newer
+  #
+  # Despite the use of the 10.13 deployment target here, the aligned
+  # allocation function Clang uses with this setting actually works
+  # all the way back to 10.6.
+  darwinStdenv = regular.pkgs.overrideSDK regular.stdenv { darwinMinVersion = "10.13"; };
+in
+
+{
+  scopeFunction = scope: {
+    inherit stdenv;
+
+    boehmgc = regular.boehmgc.override { enableLargeConfig = true; };
+
+    # old nix fails to build with newer aws-sdk-cpp and the patch doesn't apply
+    aws-sdk-cpp-old =
+      (regular.aws-sdk-cpp.override {
+        apis = [
+          "s3"
+          "transfer"
+        ];
+        customMemoryManagement = false;
+      }).overrideAttrs
+        (args: rec {
+          # intentionally overriding postPatch
+          version = "1.9.294";
+
+          src = fetchFromGitHub {
+            owner = "aws";
+            repo = "aws-sdk-cpp";
+            rev = version;
+            hash = "sha256-Z1eRKW+8nVD53GkNyYlZjCcT74MqFqqRMeMc33eIQ9g=";
+          };
+          postPatch =
+            ''
+              # Avoid blanket -Werror to evade build failures on less
+              # tested compilers.
+              substituteInPlace cmake/compiler_settings.cmake \
+                --replace '"-Werror"' ' '
+
+              # Missing includes for GCC11
+              sed '5i#include <thread>' -i \
+                aws-cpp-sdk-cloudfront-integration-tests/CloudfrontOperationTest.cpp \
+                aws-cpp-sdk-cognitoidentity-integration-tests/IdentityPoolOperationTest.cpp \
+                aws-cpp-sdk-dynamodb-integration-tests/TableOperationTest.cpp \
+                aws-cpp-sdk-elasticfilesystem-integration-tests/ElasticFileSystemTest.cpp \
+                aws-cpp-sdk-lambda-integration-tests/FunctionTest.cpp \
+                aws-cpp-sdk-mediastore-data-integration-tests/MediaStoreDataTest.cpp \
+                aws-cpp-sdk-queues/source/sqs/SQSQueue.cpp \
+                aws-cpp-sdk-redshift-integration-tests/RedshiftClientTest.cpp \
+                aws-cpp-sdk-s3-crt-integration-tests/BucketAndObjectOperationTest.cpp \
+                aws-cpp-sdk-s3-integration-tests/BucketAndObjectOperationTest.cpp \
+                aws-cpp-sdk-s3control-integration-tests/S3ControlTest.cpp \
+                aws-cpp-sdk-sqs-integration-tests/QueueOperationTest.cpp \
+                aws-cpp-sdk-transfer-tests/TransferTests.cpp
+              # Flaky on Hydra
+              rm aws-cpp-sdk-core-tests/aws/auth/AWSCredentialsProviderTest.cpp
+              # Includes aws-c-auth private headers, so only works with submodule build
+              rm aws-cpp-sdk-core-tests/aws/auth/AWSAuthSignerTest.cpp
+              # TestRandomURLMultiThreaded fails
+              rm aws-cpp-sdk-core-tests/http/HttpClientTest.cpp
+            ''
+            + lib.optionalString aws-sdk-cpp.stdenv.hostPlatform.isi686 ''
+              # EPSILON is exceeded
+              rm aws-cpp-sdk-core-tests/aws/client/AdaptiveRetryStrategyTest.cpp
+            '';
+
+          patches = (args.patches or [ ]) ++ [ ./patches/aws-sdk-cpp-TransferManager-ContentEncoding.patch ];
+
+          # only a stripped down version is build which takes a lot less resources to build
+          requiredSystemFeatures = [ ];
+        });
+
+    aws-sdk-cpp =
+      (regular.aws-sdk-cpp.override {
+        apis = [
+          "s3"
+          "transfer"
+        ];
+        customMemoryManagement = false;
+      }).overrideAttrs
+        {
+          # only a stripped down version is build which takes a lot less resources to build
+          requiredSystemFeatures = [ ];
+        };
+  };
+}
diff --git a/pkgs/tools/package-management/nix/modular/README.md b/pkgs/tools/package-management/nix/modular/README.md
new file mode 100644
index 000000000000..247bfc8badc5
--- /dev/null
+++ b/pkgs/tools/package-management/nix/modular/README.md
@@ -0,0 +1,6 @@
+# `nix/modular`
+
+This directory follows a directory structure similar to that in the upstream repo,
+to make comparisons easier.
+
+The files are maintained separately from the upstream repo, so differences are expected.
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/doc/manual/package.nix b/pkgs/tools/package-management/nix/modular/doc/manual/package.nix
similarity index 100%
rename from pkgs/tools/package-management/nix/vendor/2_26/doc/manual/package.nix
rename to pkgs/tools/package-management/nix/modular/doc/manual/package.nix
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/componentized.nix b/pkgs/tools/package-management/nix/modular/packages.nix
similarity index 50%
rename from pkgs/tools/package-management/nix/vendor/2_26/componentized.nix
rename to pkgs/tools/package-management/nix/modular/packages.nix
index 21b16a98f241..d051dc6d716d 100644
--- a/pkgs/tools/package-management/nix/vendor/2_26/componentized.nix
+++ b/pkgs/tools/package-management/nix/modular/packages.nix
@@ -1,17 +1,15 @@
 {
   lib,
-  fetchFromGitHub,
   splicePackages,
-  generateSplicesForMkScope,
-  newScope,
+  nixDependencies,
   pkgs,
-  stdenv,
   maintainers,
   otherSplices,
+  version,
+  src,
 }:
 let
   officialRelease = true;
-  src = fetchFromGitHub (builtins.fromJSON (builtins.readFile ./source.json));
 
   # A new scope, so that we can use `callPackage` to inject our own interdependencies
   # without "polluting" the top level "`pkgs`" attrset.
@@ -32,26 +30,10 @@ let
             officialRelease
             pkgs
             src
+            version
             ;
         };
       };
 
-  # The dependencies are in their own scope, so that they don't have to be
-  # in Nixpkgs top level `pkgs` or `nixComponents`.
-  nixDependencies =
-    lib.makeScopeWithSplicing'
-      {
-        inherit splicePackages;
-        inherit newScope; # layered directly on pkgs, unlike nixComponents above
-      }
-      {
-        # Technically this should point to the nixDependencies set only, but
-        # this is ok as long as the scopes don't intersect.
-        inherit otherSplices;
-        f = import ./dependencies.nix {
-          inherit pkgs;
-          inherit stdenv;
-        };
-      };
 in
 nixComponents.overrideSource src
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/packaging/components.nix b/pkgs/tools/package-management/nix/modular/packaging/components.nix
similarity index 99%
rename from pkgs/tools/package-management/nix/vendor/2_26/packaging/components.nix
rename to pkgs/tools/package-management/nix/modular/packaging/components.nix
index 77cf9c9a5065..db53ff87555d 100644
--- a/pkgs/tools/package-management/nix/vendor/2_26/packaging/components.nix
+++ b/pkgs/tools/package-management/nix/modular/packaging/components.nix
@@ -4,6 +4,7 @@
   src,
   officialRelease,
   maintainers,
+  version,
 }:
 
 scope:
@@ -27,7 +28,7 @@ let
     pkg-config
     ;
 
-  baseVersion = lib.fileContents ../.version;
+  baseVersion = version;
 
   versionSuffix = lib.optionalString (!officialRelease) "pre";
 
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/packaging/everything.nix b/pkgs/tools/package-management/nix/modular/packaging/everything.nix
similarity index 100%
rename from pkgs/tools/package-management/nix/vendor/2_26/packaging/everything.nix
rename to pkgs/tools/package-management/nix/modular/packaging/everything.nix
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/src/external-api-docs/package.nix b/pkgs/tools/package-management/nix/modular/src/external-api-docs/package.nix
similarity index 100%
rename from pkgs/tools/package-management/nix/vendor/2_26/src/external-api-docs/package.nix
rename to pkgs/tools/package-management/nix/modular/src/external-api-docs/package.nix
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/src/internal-api-docs/package.nix b/pkgs/tools/package-management/nix/modular/src/internal-api-docs/package.nix
similarity index 100%
rename from pkgs/tools/package-management/nix/vendor/2_26/src/internal-api-docs/package.nix
rename to pkgs/tools/package-management/nix/modular/src/internal-api-docs/package.nix
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/src/libcmd/package.nix b/pkgs/tools/package-management/nix/modular/src/libcmd/package.nix
similarity index 100%
rename from pkgs/tools/package-management/nix/vendor/2_26/src/libcmd/package.nix
rename to pkgs/tools/package-management/nix/modular/src/libcmd/package.nix
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/src/libexpr-c/package.nix b/pkgs/tools/package-management/nix/modular/src/libexpr-c/package.nix
similarity index 100%
rename from pkgs/tools/package-management/nix/vendor/2_26/src/libexpr-c/package.nix
rename to pkgs/tools/package-management/nix/modular/src/libexpr-c/package.nix
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/src/libexpr-test-support/package.nix b/pkgs/tools/package-management/nix/modular/src/libexpr-test-support/package.nix
similarity index 100%
rename from pkgs/tools/package-management/nix/vendor/2_26/src/libexpr-test-support/package.nix
rename to pkgs/tools/package-management/nix/modular/src/libexpr-test-support/package.nix
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/src/libexpr-tests/package.nix b/pkgs/tools/package-management/nix/modular/src/libexpr-tests/package.nix
similarity index 100%
rename from pkgs/tools/package-management/nix/vendor/2_26/src/libexpr-tests/package.nix
rename to pkgs/tools/package-management/nix/modular/src/libexpr-tests/package.nix
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/src/libexpr/package.nix b/pkgs/tools/package-management/nix/modular/src/libexpr/package.nix
similarity index 100%
rename from pkgs/tools/package-management/nix/vendor/2_26/src/libexpr/package.nix
rename to pkgs/tools/package-management/nix/modular/src/libexpr/package.nix
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/src/libfetchers-tests/package.nix b/pkgs/tools/package-management/nix/modular/src/libfetchers-tests/package.nix
similarity index 87%
rename from pkgs/tools/package-management/nix/vendor/2_26/src/libfetchers-tests/package.nix
rename to pkgs/tools/package-management/nix/modular/src/libfetchers-tests/package.nix
index 1e379fc5ade2..f6659130152e 100644
--- a/pkgs/tools/package-management/nix/vendor/2_26/src/libfetchers-tests/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libfetchers-tests/package.nix
@@ -7,6 +7,7 @@
   nix-fetchers,
   nix-store-test-support,
 
+  libgit2,
   rapidcheck,
   gtest,
   runCommand,
@@ -37,12 +38,16 @@ mkMesonExecutable (finalAttrs: {
     (fileset.fileFilter (file: file.hasExt "hh") ./.)
   ];
 
-  buildInputs = [
-    nix-fetchers
-    nix-store-test-support
-    rapidcheck
-    gtest
-  ];
+  buildInputs =
+    [
+      nix-fetchers
+      nix-store-test-support
+      rapidcheck
+      gtest
+    ]
+    ++ lib.optionals (lib.versionAtLeast version "2.27") [
+      libgit2
+    ];
 
   mesonFlags = [
   ];
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/src/libfetchers/package.nix b/pkgs/tools/package-management/nix/modular/src/libfetchers/package.nix
similarity index 100%
rename from pkgs/tools/package-management/nix/vendor/2_26/src/libfetchers/package.nix
rename to pkgs/tools/package-management/nix/modular/src/libfetchers/package.nix
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/src/libflake-c/package.nix b/pkgs/tools/package-management/nix/modular/src/libflake-c/package.nix
similarity index 100%
rename from pkgs/tools/package-management/nix/vendor/2_26/src/libflake-c/package.nix
rename to pkgs/tools/package-management/nix/modular/src/libflake-c/package.nix
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/src/libflake-tests/package.nix b/pkgs/tools/package-management/nix/modular/src/libflake-tests/package.nix
similarity index 100%
rename from pkgs/tools/package-management/nix/vendor/2_26/src/libflake-tests/package.nix
rename to pkgs/tools/package-management/nix/modular/src/libflake-tests/package.nix
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/src/libflake/package.nix b/pkgs/tools/package-management/nix/modular/src/libflake/package.nix
similarity index 100%
rename from pkgs/tools/package-management/nix/vendor/2_26/src/libflake/package.nix
rename to pkgs/tools/package-management/nix/modular/src/libflake/package.nix
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/src/libmain-c/package.nix b/pkgs/tools/package-management/nix/modular/src/libmain-c/package.nix
similarity index 100%
rename from pkgs/tools/package-management/nix/vendor/2_26/src/libmain-c/package.nix
rename to pkgs/tools/package-management/nix/modular/src/libmain-c/package.nix
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/src/libmain/package.nix b/pkgs/tools/package-management/nix/modular/src/libmain/package.nix
similarity index 100%
rename from pkgs/tools/package-management/nix/vendor/2_26/src/libmain/package.nix
rename to pkgs/tools/package-management/nix/modular/src/libmain/package.nix
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/src/libstore-c/package.nix b/pkgs/tools/package-management/nix/modular/src/libstore-c/package.nix
similarity index 100%
rename from pkgs/tools/package-management/nix/vendor/2_26/src/libstore-c/package.nix
rename to pkgs/tools/package-management/nix/modular/src/libstore-c/package.nix
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/src/libstore-test-support/package.nix b/pkgs/tools/package-management/nix/modular/src/libstore-test-support/package.nix
similarity index 100%
rename from pkgs/tools/package-management/nix/vendor/2_26/src/libstore-test-support/package.nix
rename to pkgs/tools/package-management/nix/modular/src/libstore-test-support/package.nix
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/src/libstore-tests/package.nix b/pkgs/tools/package-management/nix/modular/src/libstore-tests/package.nix
similarity index 100%
rename from pkgs/tools/package-management/nix/vendor/2_26/src/libstore-tests/package.nix
rename to pkgs/tools/package-management/nix/modular/src/libstore-tests/package.nix
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/src/libstore/package.nix b/pkgs/tools/package-management/nix/modular/src/libstore/package.nix
similarity index 96%
rename from pkgs/tools/package-management/nix/vendor/2_26/src/libstore/package.nix
rename to pkgs/tools/package-management/nix/modular/src/libstore/package.nix
index 31867d331b92..bba96e07f312 100644
--- a/pkgs/tools/package-management/nix/vendor/2_26/src/libstore/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libstore/package.nix
@@ -78,7 +78,7 @@ mkMesonLibrary (finalAttrs: {
       (lib.mesonOption "sandbox-shell" "${busybox-sandbox-shell}/bin/busybox")
     ];
 
-  env = {
+  env = lib.optionalAttrs (!lib.versionAtLeast version "2.27") {
     # Needed for Meson to find Boost.
     # https://github.com/NixOS/nixpkgs/issues/86131.
     BOOST_INCLUDEDIR = "${lib.getDev boost}/include";
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/src/libutil-c/package.nix b/pkgs/tools/package-management/nix/modular/src/libutil-c/package.nix
similarity index 100%
rename from pkgs/tools/package-management/nix/vendor/2_26/src/libutil-c/package.nix
rename to pkgs/tools/package-management/nix/modular/src/libutil-c/package.nix
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/src/libutil-test-support/package.nix b/pkgs/tools/package-management/nix/modular/src/libutil-test-support/package.nix
similarity index 100%
rename from pkgs/tools/package-management/nix/vendor/2_26/src/libutil-test-support/package.nix
rename to pkgs/tools/package-management/nix/modular/src/libutil-test-support/package.nix
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/src/libutil-tests/package.nix b/pkgs/tools/package-management/nix/modular/src/libutil-tests/package.nix
similarity index 100%
rename from pkgs/tools/package-management/nix/vendor/2_26/src/libutil-tests/package.nix
rename to pkgs/tools/package-management/nix/modular/src/libutil-tests/package.nix
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/src/libutil/package.nix b/pkgs/tools/package-management/nix/modular/src/libutil/package.nix
similarity index 78%
rename from pkgs/tools/package-management/nix/vendor/2_26/src/libutil/package.nix
rename to pkgs/tools/package-management/nix/modular/src/libutil/package.nix
index 47dcb54a26f8..e389fd59439c 100644
--- a/pkgs/tools/package-management/nix/vendor/2_26/src/libutil/package.nix
+++ b/pkgs/tools/package-management/nix/modular/src/libutil/package.nix
@@ -6,6 +6,7 @@
   boost,
   brotli,
   libarchive,
+  libblake3,
   libcpuid,
   libsodium,
   nlohmann_json,
@@ -40,11 +41,18 @@ mkMesonLibrary (finalAttrs: {
     (fileset.fileFilter (file: file.hasExt "hh") ./.)
   ];
 
-  buildInputs = [
-    brotli
-    libsodium
-    openssl
-  ] ++ lib.optional stdenv.hostPlatform.isx86_64 libcpuid;
+  buildInputs =
+    [
+      brotli
+    ]
+    ++ lib.optional (lib.versionAtLeast version "2.27") [
+      libblake3
+    ]
+    ++ [
+      libsodium
+      openssl
+    ]
+    ++ lib.optional stdenv.hostPlatform.isx86_64 libcpuid;
 
   propagatedBuildInputs = [
     boost
@@ -56,7 +64,7 @@ mkMesonLibrary (finalAttrs: {
     (lib.mesonEnable "cpuid" stdenv.hostPlatform.isx86_64)
   ];
 
-  env = {
+  env = lib.optionalAttrs (!lib.versionAtLeast version "2.27") {
     # Needed for Meson to find Boost.
     # https://github.com/NixOS/nixpkgs/issues/86131.
     BOOST_INCLUDEDIR = "${lib.getDev boost}/include";
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/src/nix/package.nix b/pkgs/tools/package-management/nix/modular/src/nix/package.nix
similarity index 100%
rename from pkgs/tools/package-management/nix/vendor/2_26/src/nix/package.nix
rename to pkgs/tools/package-management/nix/modular/src/nix/package.nix
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/src/perl/package.nix b/pkgs/tools/package-management/nix/modular/src/perl/package.nix
similarity index 100%
rename from pkgs/tools/package-management/nix/vendor/2_26/src/perl/package.nix
rename to pkgs/tools/package-management/nix/modular/src/perl/package.nix
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/tests/functional/package.nix b/pkgs/tools/package-management/nix/modular/tests/functional/package.nix
similarity index 100%
rename from pkgs/tools/package-management/nix/vendor/2_26/tests/functional/package.nix
rename to pkgs/tools/package-management/nix/modular/tests/functional/package.nix
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/.version b/pkgs/tools/package-management/nix/vendor/2_26/.version
deleted file mode 100644
index 90f3e72b6118..000000000000
--- a/pkgs/tools/package-management/nix/vendor/2_26/.version
+++ /dev/null
@@ -1 +0,0 @@
-2.26.3
\ No newline at end of file
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/dependencies.nix b/pkgs/tools/package-management/nix/vendor/2_26/dependencies.nix
deleted file mode 100644
index 0e874d990188..000000000000
--- a/pkgs/tools/package-management/nix/vendor/2_26/dependencies.nix
+++ /dev/null
@@ -1,46 +0,0 @@
-# These overrides are applied to the dependencies of the Nix components.
-
-{
-  # The raw Nixpkgs, not affected by this scope
-  pkgs,
-
-  stdenv,
-}:
-
-let
-  prevStdenv = stdenv;
-in
-
-let
-  stdenv = if prevStdenv.isDarwin && prevStdenv.isx86_64 then darwinStdenv else prevStdenv;
-
-  # Fix the following error with the default x86_64-darwin SDK:
-  #
-  #     error: aligned allocation function of type 'void *(std::size_t, std::align_val_t)' is only available on macOS 10.13 or newer
-  #
-  # Despite the use of the 10.13 deployment target here, the aligned
-  # allocation function Clang uses with this setting actually works
-  # all the way back to 10.6.
-  darwinStdenv = pkgs.overrideSDK prevStdenv { darwinMinVersion = "10.13"; };
-in
-scope: {
-  inherit stdenv;
-
-  aws-sdk-cpp =
-    (pkgs.aws-sdk-cpp.override {
-      apis = [
-        "s3"
-        "transfer"
-      ];
-      customMemoryManagement = false;
-    }).overrideAttrs
-      {
-        # only a stripped down version is built, which takes a lot less resources
-        # to build, so we don't need a "big-parallel" machine.
-        requiredSystemFeatures = [ ];
-      };
-
-  boehmgc = pkgs.boehmgc.override {
-    enableLargeConfig = true;
-  };
-}
diff --git a/pkgs/tools/package-management/nix/vendor/2_26/source.json b/pkgs/tools/package-management/nix/vendor/2_26/source.json
deleted file mode 100644
index e8070d9b0dd1..000000000000
--- a/pkgs/tools/package-management/nix/vendor/2_26/source.json
+++ /dev/null
@@ -1,6 +0,0 @@
-{
-    "owner": "NixOS",
-    "repo": "nix",
-    "rev": "42fc03dd1f12df2d9152303f3fb8bf22b746462c",
-    "hash": "sha256-5ZV8YqU8mfFmoAMiUEuBqNwk0T3vUR//x1D12BiYCeY="
-}
diff --git a/pkgs/tools/security/ggshield/default.nix b/pkgs/tools/security/ggshield/default.nix
index 964bf2551b88..c579d45c0414 100644
--- a/pkgs/tools/security/ggshield/default.nix
+++ b/pkgs/tools/security/ggshield/default.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "ggshield";
-  version = "1.38.0";
+  version = "1.38.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "GitGuardian";
     repo = "ggshield";
     tag = "v${version}";
-    hash = "sha256-bdAC7ILCSUhY71TP9ZUl0c2YpSAYfEQP5V8EOCg4z9I=";
+    hash = "sha256-VioahNz9mlai+pavSTvuyE8dm1gyrjFgBLlSPE1IKRw=";
   };
 
   pythonRelaxDeps = true;
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 7808fc468fef..ae0a409a1b39 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -324,6 +324,7 @@ mapAliases {
   bashInteractive_5 = throw "'bashInteractive_5' has been renamed to/replaced by 'bashInteractive'"; # Converted to throw 2024-10-17
   bash_5 = throw "'bash_5' has been renamed to/replaced by 'bash'"; # Converted to throw 2024-10-17
   BeatSaberModManager = beatsabermodmanager; # Added 2024-06-12
+  beam_nox = throw "beam_nox has been removed in favor of beam_minimal or beamMinimalPackages"; # Added 2025-04-01
   beatsabermodmanager = throw "'beatsabermodmanager' has been removed due to lack of upstream maintainenance. Consider using 'bs-manager' instead"; # Added 2025-03-18
   betterbird = throw "betterbird has been removed as there were insufficient maintainer resources to keep up with security updates"; # Added 2024-10-25
   betterbird-unwrapped = throw "betterbird has been removed as there were insufficient maintainer resources to keep up with security updates"; # Added 2024-10-25
@@ -564,6 +565,7 @@ mapAliases {
 
   erlang_24 = throw "erlang_24 has been removed as it is unmaintained upstream";
   erlang_27-rc3 = throw "erlang_27-rc3 has been removed in favor of erlang_27"; # added 2024-05-20
+  erlang_nox = throw "erlang_nox has been removed in favor of beam_minimal.packages.erlang or beamMinimalPackages.erlang"; # added 2025-04-01
   erlangR24 = throw "erlangR24 has been removed in favor of erlang_24"; # added 2024-05-24
   erlangR24_odbc = throw "erlangR24_odbc has been removed in favor of erlang_24_odbc"; # added 2024-05-24
   erlangR24_javac = throw "erlangR24_javac has been removed in favor of erlang_24_javac"; # added 2024-05-24
@@ -747,6 +749,7 @@ mapAliases {
   gobby5 = throw "'gobby5' has been renamed to/replaced by 'gobby'"; # Converted to throw 2024-10-17
   gradle_6 = throw "Gradle 6 has been removed, as it is end-of-life (https://endoflife.date/gradle) and has many vulnerabilities that are not resolved until Gradle 7."; # Added 2024-10-30
   gradle_6-unwrapped = throw "Gradle 6 has been removed, as it is end-of-life (https://endoflife.date/gradle) and has many vulnerabilities that are not resolved until Gradle 7."; # Added 2024-10-30
+  grafana-agent = throw "'grafana-agent' has been removed, as it only works with an EOL compiler and will become EOL during the 25.05 release. Consider migrating to 'grafana-alloy' instead"; # Added 2025-04-02
 
   #godot
 
@@ -1252,6 +1255,7 @@ mapAliases {
   o = orbiton; # Added 2023-04-09
   oathToolkit = oath-toolkit; # Added 2022-04-04
   oauth2_proxy = throw "'oauth2_proxy' has been renamed to/replaced by 'oauth2-proxy'"; # Converted to throw 2024-10-17
+  ocis-bin = throw "ocis-bin has been renamed to ocis_5-bin'. Future major.minor versions will be made available as separate packages"; # Added 2025-03-30
   oil = lib.warnOnInstantiate "Oil has been replaced with the faster native C++ version and renamed to 'oils-for-unix'. See also https://github.com/oils-for-unix/oils/wiki/Oils-Deployments" oils-for-unix; # Added 2024-10-22
   onevpl-intel-gpu = lib.warnOnInstantiate "onevpl-intel-gpu has been renamed to vpl-gpu-rt" vpl-gpu-rt; # Added 2024-06-04
   openai-whisper-cpp = whisper-cpp; # Added 2024-12-13
@@ -1858,6 +1862,7 @@ mapAliases {
   xonsh-unwrapped = python3Packages.xonsh; # Added 2024-06-18
   xplayer = throw "xplayer has been removed as the upstream project was archived"; # Added 2024-12-27
   xprite-editor = throw "'xprite-editor' has been removed due to lack of maintenance upstream. Consider using 'pablodraw' or 'aseprite' instead"; # Added 2024-09-14
+  xsd = throw "'xsd' has been removed."; # Added 2025-04-02
   xsv = throw "'xsv' has been removed due to lack of upstream maintenance. Please see 'xan' for a maintained alternative";
   xtrlock-pam = throw "xtrlock-pam has been removed because it is unmaintained for 10 years and doesn't support Python 3.10 or newer"; # Added 2025-01-25
   xulrunner = firefox-unwrapped; # Added 2023-11-03
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8a01bd17c488..3ed7a2e8b6d5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1045,7 +1045,7 @@ with pkgs;
   };
 
   akkoma = callPackage ../by-name/ak/akkoma/package.nix {
-    beamPackages = beam_nox.packages.erlang_26.extend (
+    beamPackages = beam_minimal.packages.erlang_26.extend (
       self: super: {
         elixir = self.elixir_1_16;
         rebar3 = self.rebar3WithPlugins {
@@ -7373,14 +7373,9 @@ with pkgs;
   };
 
   beam = callPackage ./beam-packages.nix { };
-  beam_nox = callPackage ./beam-packages.nix {
-    beam = beam_nox;
-    wxSupport = false;
-  };
   beam_minimal = callPackage ./beam-packages.nix {
     beam = beam_minimal;
     wxSupport = false;
-    systemdSupport = false;
   };
 
   inherit (beam.interpreters)
@@ -7398,8 +7393,6 @@ with pkgs;
     elixir-ls
     ;
 
-  erlang_nox = beam_nox.interpreters.erlang;
-
   inherit (beam.packages.erlang)
     erlang-ls
     ex_doc
@@ -7416,17 +7409,17 @@ with pkgs;
   beamPackages = dontRecurseIntoAttrs beam27Packages;
   beamMinimalPackages = dontRecurseIntoAttrs beamMinimal27Packages;
 
-  beam25Packages = recurseIntoAttrs beam.packages.erlang_25;
-  beam26Packages = recurseIntoAttrs beam.packages.erlang_26;
-  beam27Packages = recurseIntoAttrs beam.packages.erlang_27;
+  beam25Packages = recurseIntoAttrs beam.packages.erlang_25.beamPackages;
+  beam26Packages = recurseIntoAttrs beam.packages.erlang_26.beamPackages;
+  beam27Packages = recurseIntoAttrs beam.packages.erlang_27.beamPackages;
   # 28 is pre-release
-  beam28Packages = dontRecurseIntoAttrs beam.packages.erlang_28;
+  beam28Packages = dontRecurseIntoAttrs beam.packages.erlang_28.beamPackages;
 
-  beamMinimal25Packages = recurseIntoAttrs beam_minimal.packages.erlang_25;
-  beamMinimal26Packages = recurseIntoAttrs beam_minimal.packages.erlang_26;
-  beamMinimal27Packages = recurseIntoAttrs beam_minimal.packages.erlang_27;
+  beamMinimal25Packages = recurseIntoAttrs beam_minimal.packages.erlang_25.beamPackages;
+  beamMinimal26Packages = recurseIntoAttrs beam_minimal.packages.erlang_26.beamPackages;
+  beamMinimal27Packages = recurseIntoAttrs beam_minimal.packages.erlang_27.beamPackages;
   # 28 is pre-release
-  beamMinimal28Packages = dontRecurseIntoAttrs beam_minimal.packages.erlang_28;
+  beamMinimal28Packages = dontRecurseIntoAttrs beam_minimal.packages.erlang_28.beamPackages;
 
   erlang_language_platform = callPackage ../by-name/er/erlang-language-platform/package.nix { };
 
@@ -16938,10 +16931,6 @@ with pkgs;
   };
   libfakeXinerama = callPackage ../tools/X11/xpra/libfakeXinerama.nix { };
 
-  xsd = callPackage ../development/libraries/xsd {
-    stdenv = gcc9Stdenv;
-  };
-
   xmp = callPackage ../applications/audio/xmp {
     inherit (darwin.apple_sdk.frameworks) AudioUnit CoreAudio;
   };
@@ -18892,6 +18881,10 @@ with pkgs;
 
   muse = libsForQt5.callPackage ../applications/audio/muse { };
 
+  nixDependencies = recurseIntoAttrs (
+    callPackage ../tools/package-management/nix/dependencies-scope.nix { }
+  );
+
   nixVersions = recurseIntoAttrs (
     callPackage ../tools/package-management/nix {
       storeDir = config.nix.storeDir or "/nix/store";
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a3cbd2ad6a13..d8fdc3348ff7 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -10418,6 +10418,8 @@ self: super: with self; {
 
   ormar = callPackage ../development/python-modules/ormar { };
 
+  ormsgpack = callPackage ../development/python-modules/ormsgpack { };
+
   ortools = (toPythonModule (pkgs.or-tools.override { inherit (self) python; })).python;
 
   orvibo = callPackage ../development/python-modules/orvibo { };
@@ -12772,6 +12774,8 @@ self: super: with self; {
 
   pyoppleio = callPackage ../development/python-modules/pyoppleio { };
 
+  pyorc = callPackage ../development/python-modules/pyorc { };
+
   pyorthanc = callPackage ../development/python-modules/pyorthanc { };
 
   pyosf = callPackage ../development/python-modules/pyosf { };
@@ -13541,6 +13545,8 @@ self: super: with self; {
 
   pytest-jupyter = callPackage ../development/python-modules/pytest-jupyter { };
 
+  pytest-kafka = callPackage ../development/python-modules/pytest-kafka { };
+
   pytest-lazy-fixture = callPackage ../development/python-modules/pytest-lazy-fixture { };
 
   pytest-lazy-fixtures = callPackage ../development/python-modules/pytest-lazy-fixtures { };
@@ -16669,6 +16675,8 @@ self: super: with self; {
 
   swh-core = callPackage ../development/python-modules/swh-core { };
 
+  swh-export = callPackage ../development/python-modules/swh-export { };
+
   swh-journal = callPackage ../development/python-modules/swh-journal { };
 
   swh-model = callPackage ../development/python-modules/swh-model { };