diff --git a/doc/redirects.json b/doc/redirects.json
index 41d1f5a9a3e9..b8c6eb6367db 100644
--- a/doc/redirects.json
+++ b/doc/redirects.json
@@ -926,6 +926,9 @@
   "var-go-buildTestBinaries": [
     "index.html#var-go-buildTestBinaries"
   ],
+  "var-meta-donationPage": [
+    "index.html#var-meta-donationPage"
+  ],
   "var-meta-identifiers-cpe": [
     "index.html#var-meta-identifiers-cpe"
   ],
diff --git a/doc/stdenv/meta.chapter.md b/doc/stdenv/meta.chapter.md
index a88683ed37b7..beac596c2e02 100644
--- a/doc/stdenv/meta.chapter.md
+++ b/doc/stdenv/meta.chapter.md
@@ -61,6 +61,12 @@ Release branch. Used to specify that a package is not going to receive updates t
 
 The package’s homepage. Example: `https://www.gnu.org/software/hello/manual/`
 
+### `donationPage` {#var-meta-donationPage}
+
+The package or project's donation page, if it exists. Example: `https://neovim.io/sponsors/`
+
+Authoritative project URLs are preferred.
+
 ### `downloadPage` {#var-meta-downloadPage}
 
 The page where a link to the current version can be found. Example: `https://ftp.gnu.org/gnu/hello/`
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 23cf0097e5d6..a57e00aa135e 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -710,6 +710,12 @@
     githubId = 25004152;
     name = "Adrian Gunnar Lauterer";
   };
+  adrielvelazquez = {
+    email = "AdrielVelazquez@gmail.com";
+    github = "AdrielVelazquez";
+    githubId = 3443378;
+    name = "Adriel Velazquez";
+  };
   AdrienLemaire = {
     email = "lemaire.adrien@gmail.com";
     github = "AdrienLemaire";
diff --git a/nixos/modules/programs/gamescope.nix b/nixos/modules/programs/gamescope.nix
index 910a75354ea6..d83486e5054f 100644
--- a/nixos/modules/programs/gamescope.nix
+++ b/nixos/modules/programs/gamescope.nix
@@ -26,6 +26,8 @@ in
 
     package = lib.mkPackageOption pkgs "gamescope" { };
 
+    enableWsi = lib.mkEnableOption "gamescope-wsi, the Vulkan WSI layer, alongside gamescope";
+
     capSysNice = lib.mkOption {
       type = lib.types.bool;
       default = false;
@@ -76,6 +78,11 @@ in
     };
 
     environment.systemPackages = lib.mkIf (!cfg.capSysNice) [ gamescope ];
+
+    hardware.graphics = lib.optionalAttrs cfg.enableWsi {
+      extraPackages = with pkgs; [ gamescope-wsi ];
+      extraPackages32 = with pkgs; [ pkgsi686Linux.gamescope-wsi ];
+    };
   };
 
   meta.maintainers = [ ];
diff --git a/nixos/modules/services/networking/fastnetmon-advanced.nix b/nixos/modules/services/networking/fastnetmon-advanced.nix
index 87ed120291f9..5ed87d18c1d8 100644
--- a/nixos/modules/services/networking/fastnetmon-advanced.nix
+++ b/nixos/modules/services/networking/fastnetmon-advanced.nix
@@ -207,6 +207,10 @@ in
           AmbientCapabilities = "cap_net_bind_service";
         };
       };
+
+      services.fastnetmon-advanced.hostgroups = {
+        global = { };
+      };
     })
 
     (lib.mkIf (cfg.enable && cfg.enableAdvancedTrafficPersistence) {
diff --git a/nixos/tests/fastnetmon-advanced.nix b/nixos/tests/fastnetmon-advanced.nix
index e9bce4f8eb9f..957f26017f4c 100644
--- a/nixos/tests/fastnetmon-advanced.nix
+++ b/nixos/tests/fastnetmon-advanced.nix
@@ -62,7 +62,7 @@
       bird.wait_for_unit("bird.service")
 
       fnm.wait_until_succeeds('journalctl -eu fastnetmon.service | grep "BGP daemon restarted correctly"')
-      fnm.wait_until_succeeds("journalctl -eu gobgp.service | grep BGP_FSM_OPENCONFIRM")
+      fnm.wait_until_succeeds('journalctl -eu gobgp.service | grep "Peer Up"')
       bird.wait_until_succeeds("birdc show protocol fnm | grep Estab")
       fnm.wait_until_succeeds('journalctl -eu fastnetmon.service | grep "API server listening"')
       fnm.succeed("fcli set blackhole 172.23.42.123")
diff --git a/nixos/tests/seatd.nix b/nixos/tests/seatd.nix
index 117c1ea4be50..f8a88a1cb9ef 100644
--- a/nixos/tests/seatd.nix
+++ b/nixos/tests/seatd.nix
@@ -50,6 +50,7 @@ in
     };
 
   testScript = ''
+    machine.wait_for_unit("seatd.service")
     machine.wait_for_file("/tmp/foot_started")
     machine.succeed("test $(seatd-client-pid) = $(pgrep dwl)")
   '';
diff --git a/pkgs/applications/networking/instant-messengers/ferdium/default.nix b/pkgs/applications/networking/instant-messengers/ferdium/default.nix
index e552f292ef70..625d389b93e6 100644
--- a/pkgs/applications/networking/instant-messengers/ferdium/default.nix
+++ b/pkgs/applications/networking/instant-messengers/ferdium/default.nix
@@ -4,26 +4,35 @@
   fetchurl,
   libxshmfence,
   stdenv,
+  writeShellScript,
+  nix-update,
+  jq,
+  nix,
+  common-updater-scripts,
 }:
 
 let
+  inherit (stdenv.hostPlatform) system;
+  throwSystem = throw "ferdium: arch ${system} not supported";
+
   arch =
     {
       x86_64-linux = "amd64";
       aarch64-linux = "arm64";
     }
-    ."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+    .${system} or throwSystem;
+
   hash =
     {
-      amd64-linux_hash = "sha256-1jXo8MMk2EEkLo0n4ICmGJteKProLYKkMF//g63frHs=";
-      arm64-linux_hash = "sha256-jYDGVZhL0bswowm1H/4aa35lNJalil6ymV34NQM5Gfc=";
+      x86_64-linux = "sha256-ODQKFjBa2riJY26aPaAfLzuCyLYkB5oYSxIE28nMmwY=";
+      aarch64-linux = "sha256-CYHoTw6JUyU63iTd9tAbfWVnb48WcZgGtjthqnlAD8I=";
     }
-    ."${arch}-linux_hash";
+    .${system} or throwSystem;
 in
 mkFranzDerivation rec {
   pname = "ferdium";
   name = "Ferdium";
-  version = "7.1.1";
+  version = "7.1.2";
   src = fetchurl {
     url = "https://github.com/ferdium/ferdium-app/releases/download/v${version}/Ferdium-linux-${version}-${arch}.deb";
     inherit hash;
@@ -31,9 +40,21 @@ mkFranzDerivation rec {
 
   extraBuildInputs = [ libxshmfence ];
 
-  passthru = {
-    updateScript = ./update.sh;
-  };
+  passthru.updateScript = writeShellScript "update-ferdium" ''
+    ${lib.getExe nix-update} ferdium --no-src --override-filename pkgs/applications/networking/instant-messengers/ferdium/default.nix
+    latestVersion=$(nix eval --raw --file . ferdium.version)
+    if [[ "$latestVersion" == "$UPDATE_NIX_OLD_VERSION" ]]; then
+      exit 0
+    fi
+    for system in x86_64-linux aarch64-linux; do
+      hash=$(${lib.getExe nix} store prefetch-file --json \
+        "$(nix eval --raw --file . ferdium.src.url --argstr system "$system")" \
+        | ${lib.getExe jq} --raw-output .hash)
+      ${lib.getExe' common-updater-scripts "update-source-version"} \
+        ferdium "$latestVersion" "$hash" --system="$system" \
+        --ignore-same-version --ignore-same-hash
+    done
+  '';
 
   meta = {
     description = "All your services in one place built by the community";
diff --git a/pkgs/applications/networking/instant-messengers/ferdium/update.sh b/pkgs/applications/networking/instant-messengers/ferdium/update.sh
deleted file mode 100755
index baae211ee9bd..000000000000
--- a/pkgs/applications/networking/instant-messengers/ferdium/update.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p git bash curl jq nix-update
-
-set -xe
-
-dirname="$(dirname "$0")"
-
-latestTag=$(curl https://api.github.com/repos/ferdium/ferdium-app/releases/latest | jq -r ".tag_name")
-latestVersion="$(expr $latestTag : 'v\(.*\)')"
-
-nix-update --version "$latestVersion" --system aarch64-linux --override-filename "$dirname/default.nix" ferdium
-nix-update --version skip --system x86_64-linux --override-filename "$dirname/default.nix" ferdium
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index 8a78d99b79c8..71d6cb7a2fa6 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -32,11 +32,14 @@ let
       # FIXME: let's hope that upstream will fix this soon and we can drop this hack again.
       # https://bugzilla.mozilla.org/show_bug.cgi?id=2040877
       extraPostPatch =
-        lib.optionalString (lib.versionAtLeast version "151" && lib.versionOlder version "152")
-          ''
-            echo https://hg.mozilla.org/releases/comm-release/rev/becfb8fb2c70f1603882a2787e2170d5d8013949 >> sourcestamp.txt
-            echo https://hg.mozilla.org/releases/mozilla-release/rev/fc12dc911f904307729760a817deb829cbf8feb4 >> sourcestamp.txt
-          '';
+        lib.optionalString (lib.versionAtLeast version "151" && lib.versionOlder version "152") ''
+          echo https://hg.mozilla.org/releases/comm-release/rev/becfb8fb2c70f1603882a2787e2170d5d8013949 >> sourcestamp.txt
+          echo https://hg.mozilla.org/releases/mozilla-release/rev/fc12dc911f904307729760a817deb829cbf8feb4 >> sourcestamp.txt
+        ''
+        # https://bugzilla.mozilla.org/show_bug.cgi?id=2006630
+        + lib.optionalString (lib.versionAtLeast version "140.8" && lib.versionOlder version "151") ''
+          find . -name .cargo-checksum.json | xargs sed 's/"[^"]*\.gitmodules":"[a-z0-9]*",//g' -i
+        '';
 
       meta = {
         changelog = "https://www.thunderbird.net/en-US/thunderbird/${version}/releasenotes/";
@@ -88,8 +91,8 @@ rec {
   thunderbird-140 = common {
     applicationName = "Thunderbird ESR";
 
-    version = "140.7.2esr";
-    sha512 = "513bcaa496f987d0f3906aeb6fe3ea651331470646b0c58479c91bb2c8eb52e389bc8aa646437a03b611ab78bda1df7252545960ffe38086d1fc462e65421819";
+    version = "140.11.1esr";
+    sha512 = "93dfdd26e6f4c7dd2f7dcc2e4994980d017868341c60c93775721467abd9192b815f2de63928e7d10c965fc045ed72ca5b49ed6502a61e50104ee5cd00941d1e";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-140";
diff --git a/pkgs/build-support/build-mozilla-mach/140-bindgen-string-view.patch b/pkgs/build-support/build-mozilla-mach/140-bindgen-string-view.patch
new file mode 100644
index 000000000000..c67dd36f95a4
--- /dev/null
+++ b/pkgs/build-support/build-mozilla-mach/140-bindgen-string-view.patch
@@ -0,0 +1,15 @@
+diff --git a/tools/profiler/rust-api/build.rs b/tools/profiler/rust-api/build.rs
+index 9bb27eb83e5e..3f09f7f01bcb 100644
+--- a/tools/profiler/rust-api/build.rs
++++ b/tools/profiler/rust-api/build.rs
+@@ -88,6 +88,10 @@ fn generate_bindings() {
+         // successfully. Otherwise, it fails to build because MarkerSchema has
+         // some std::strings as its fields.
+         .opaque_type("std::string")
++        .blocklist_type(".*basic_string_view.*")
++        .opaque_type(".*basic_string_view.*")
++        .blocklist_type(".*basic_string___self_view.*")
++        .opaque_type(".*basic_string___self_view.*")
+         // std::vector needs to be converted to an opaque type because, if it's
+         // not an opaque type, bindgen can't find its size properly and
+         // MarkerSchema's total size reduces. That causes a heap buffer overflow.
diff --git a/pkgs/build-support/build-mozilla-mach/default.nix b/pkgs/build-support/build-mozilla-mach/default.nix
index 3363d89fa7b1..4b036b558c45 100644
--- a/pkgs/build-support/build-mozilla-mach/default.nix
+++ b/pkgs/build-support/build-mozilla-mach/default.nix
@@ -332,6 +332,14 @@ buildStdenv.mkDerivation {
       # https://hg-edge.mozilla.org/mozilla-central/rev/aa8a29bd1fb9
       ./139-wayland-drag-animation.patch
     ]
+    ++ lib.optionals (lib.versionAtLeast version "140" && lib.versionOlder version "144") [
+      # Versions before 144 vendor bindgen 0.69. On Darwin, libc++ 21 changed
+      # basic_string::__self_view from a typedef to an attributed using alias;
+      # bindgen then emits it without its template parameter, producing invalid
+      # Rust. Vendored bindgen was updated in:
+      # https://bugzilla.mozilla.org/show_bug.cgi?id=1985509
+      ./140-bindgen-string-view.patch
+    ]
     ++ extraPatches;
 
   postPatch = ''
diff --git a/pkgs/by-name/an/antigravity-cli/package.nix b/pkgs/by-name/an/antigravity-cli/package.nix
index 55bf2c5957d5..d84ecef3db11 100644
--- a/pkgs/by-name/an/antigravity-cli/package.nix
+++ b/pkgs/by-name/an/antigravity-cli/package.nix
@@ -8,27 +8,34 @@
 
 let
   # Version and platform-specific data retrieved from Google's manifests
-  version = "1.0.2";
+  version = "1.0.3";
 
-  sources = {
+  sourceData = {
     "x86_64-linux" = {
-      url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/1.0.2-6109799369277440/linux-x64/cli_linux_x64.tar.gz";
-      hash = "sha256-XAq2oHWaAe2AoAgDBb1/NvABfkodg3xYTDmTY5H9RD0=";
+      url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/1.0.3-6459114696605696/linux-x64/cli_linux_x64.tar.gz";
+      hash = "sha256-UM/b3TuXROHHx0dKMU0KtENNREmY+VAYKmxRWewu/ic=";
     };
     "aarch64-linux" = {
-      url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/1.0.2-6109799369277440/linux-arm/cli_linux_arm64.tar.gz";
-      hash = "sha256-7pj7TMHg+Z7DyWVmXOMqoM9kQkw5FxXTF+P4hGYc2hE=";
+      url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/1.0.3-6459114696605696/linux-arm/cli_linux_arm64.tar.gz";
+      hash = "sha256-Cp44KTj1wP85y6Z6oCOd1ylL2nTg1mDx7aJuv/Q7nBE=";
     };
     "aarch64-darwin" = {
-      url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/1.0.2-6109799369277440/darwin-arm/cli_mac_arm64.tar.gz";
-      hash = "sha256-stu8KZDa5id5wVImTgyedkIKJPdkBTagRCphoYLWUoI=";
+      url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/1.0.3-6459114696605696/darwin-arm/cli_mac_arm64.tar.gz";
+      hash = "sha256-lbf6dCJ7QhDNomfpi10Dhk9VShxAxTC0zsFIFpGlbtA=";
     };
     "x86_64-darwin" = {
-      url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/1.0.2-6109799369277440/darwin-x64/cli_mac_x64.tar.gz";
-      hash = "sha256-KDOEEgFhvpO9bifljSuhRKpb+J6c+q4TWmnrNAAS3A0=";
+      url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/1.0.3-6459114696605696/darwin-x64/cli_mac_x64.tar.gz";
+      hash = "sha256-B1zPkt4h3JN7ZWhin0iTQMCe+NhVvBGKWCLfKnBrZnw=";
     };
   };
 
+  sources = lib.mapAttrs (
+    _system: source:
+    fetchzip {
+      inherit (source) url hash;
+    }
+  ) sourceData;
+
   source =
     sources.${stdenv.hostPlatform.system}
       or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
@@ -37,9 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "antigravity-cli";
   inherit version;
 
-  src = fetchzip {
-    inherit (source) url hash;
-  };
+  src = source;
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -61,15 +66,27 @@ stdenv.mkDerivation (finalAttrs: {
   doInstallCheck = true;
 
   passthru = {
-    updateScript = ./update.py;
+    inherit sources;
+    updateScript = [
+      ./update.sh
+      version
+    ]
+    ++ lib.concatMap (system: [
+      system
+      sourceData.${system}.url
+    ]) (lib.attrNames sourceData);
   };
 
   meta = {
     description = "Google's Go-based terminal user interface (TUI) agent client";
     homepage = "https://antigravity.google";
+    changelog = "https://antigravity.google/changelog";
     license = lib.licenses.unfree;
-    maintainers = with lib.maintainers; [ u3kkasha ];
-    platforms = lib.attrNames sources;
+    maintainers = with lib.maintainers; [
+      adrielvelazquez
+      u3kkasha
+    ];
+    platforms = lib.attrNames sourceData;
     mainProgram = "agy";
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
diff --git a/pkgs/by-name/an/antigravity-cli/update.py b/pkgs/by-name/an/antigravity-cli/update.py
deleted file mode 100755
index 86c69f73da7c..000000000000
--- a/pkgs/by-name/an/antigravity-cli/update.py
+++ /dev/null
@@ -1,131 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i python3 -p python3 nix jq
-
-import re
-import urllib.request
-import json
-import subprocess
-import sys
-import os
-import tempfile
-
-MANIFEST_BASE = (
-    "https://antigravity-cli-auto-updater-974169037036.us-central1.run.app/manifests"
-)
-PLATFORMS = {
-    "x86_64-linux": "linux_amd64",
-    "aarch64-linux": "linux_arm64",
-    "x86_64-darwin": "darwin_amd64",
-    "aarch64-darwin": "darwin_arm64",
-}
-
-
-def fetch_json(url):
-    req = urllib.request.Request(
-        url, headers={"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"}
-    )
-    with urllib.request.urlopen(req) as response:
-        return json.loads(response.read().decode("utf-8"))
-
-
-def get_nix_hash(url):
-    """Downloads, unpacks, and returns the SRI hash of the directory content."""
-    with tempfile.TemporaryDirectory() as tmpdir:
-        archive_path = os.path.join(tmpdir, "archive.tar.gz")
-        unpack_path = os.path.join(tmpdir, "unpack")
-        os.makedirs(unpack_path)
-
-        # Download
-        req = urllib.request.Request(url, headers={"User-Agent": "Mozilla/5.0"})
-        with (
-            urllib.request.urlopen(req) as response,
-            open(archive_path, "wb") as out_file,
-        ):
-            out_file.write(response.read())
-
-        # Unpack
-        subprocess.run(["tar", "-xzf", archive_path, "-C", unpack_path], check=True)
-
-        # Hash
-        result = subprocess.run(
-            ["nix", "hash", "path", "--type", "sha256", unpack_path],
-            capture_output=True,
-            text=True,
-            check=True,
-        )
-        return result.stdout.strip()
-
-
-def main():
-    # Change directory to the script's directory so paths are relative
-    script_dir = os.path.dirname(os.path.abspath(__file__))
-    os.chdir(script_dir)
-
-    print("Checking for updates from Google Antigravity release API...")
-
-    # 1. Fetch the latest version from the linux_amd64 manifest
-    try:
-        manifest = fetch_json(f"{MANIFEST_BASE}/linux_amd64.json")
-    except Exception as e:
-        print(f"Error fetching manifest: {e}", file=sys.stderr)
-        sys.exit(1)
-
-    latest_version = manifest["version"]
-
-    # Read the current package.nix
-    package_file = "package.nix"
-    if not os.path.exists(package_file):
-        print(f"Error: Could not find package.nix in {script_dir}", file=sys.stderr)
-        sys.exit(1)
-
-    with open(package_file, "r") as f:
-        content = f.read()
-
-    # Extract current version
-    version_match = re.search(r'version\s*=\s*"([^"]*)"', content)
-    if not version_match:
-        print(
-            "Error: Could not parse current version from package.nix", file=sys.stderr
-        )
-        sys.exit(1)
-
-    current_version = version_match.group(1)
-
-    if current_version == latest_version:
-        print(f"Already up to date (current version {current_version} is the latest).")
-        sys.exit(0)
-
-    print(f"New version found! Updating: {current_version} -> {latest_version}")
-
-    # 2. Update the version string in content
-    content = re.sub(
-        r'(version\s*=\s*")[^"]*(";)', f"\\g<1>{latest_version}\\g<2>", content
-    )
-
-    # 3. For each platform, fetch url and hash, and update sources
-    for platform, manifest_name in PLATFORMS.items():
-        print(f"Fetching manifest for {platform}...")
-        try:
-            m = fetch_json(f"{MANIFEST_BASE}/{manifest_name}.json")
-        except Exception as e:
-            print(f"Error fetching manifest for {platform}: {e}", file=sys.stderr)
-            sys.exit(1)
-
-        url = m["url"]
-        sri_hash = get_nix_hash(url)
-
-        # Regex to locate and replace URL and hash for this specific platform in package.nix
-        pattern = rf'("{platform}"\s*=\s*\{{[^}}]+url\s*=\s*")[^"]*(";[^}}]+hash\s*=\s*")[^"]*(";)'
-        replacement = f"\\g<1>{url}\\g<2>{sri_hash}\\g<3>"
-
-        content = re.sub(pattern, replacement, content)
-
-    # Write the updated content back
-    with open(package_file, "w") as f:
-        f.write(content)
-
-    print(f"Successfully updated package.nix to version {latest_version}!")
-
-
-if __name__ == "__main__":
-    main()
diff --git a/pkgs/by-name/an/antigravity-cli/update.sh b/pkgs/by-name/an/antigravity-cli/update.sh
new file mode 100755
index 000000000000..3b1801dfd22f
--- /dev/null
+++ b/pkgs/by-name/an/antigravity-cli/update.sh
@@ -0,0 +1,60 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bash common-updater-scripts coreutils curl gnutar nix
+# shellcheck shell=bash
+set -euo pipefail
+
+script_dir="$(cd -- "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+nixpkgs_root="$(realpath "$script_dir/../../../..")"
+package_file="$script_dir/package.nix"
+tmpdir="$(mktemp -d)"
+trap 'rm -rf "$tmpdir"' EXIT
+
+cd -- "$nixpkgs_root"
+
+if (( $# < 3 || ($# - 1) % 2 != 0 )); then
+  echo "Usage: $0 <version> [<system> <url>]..." >&2
+  exit 1
+fi
+
+version="$1"
+shift
+
+export NIXPKGS_ALLOW_UNFREE=1
+
+hash_url() {
+  local system="$1"
+  local url="$2"
+  local archive="$tmpdir/$system.tar.gz"
+  local unpack_dir="$tmpdir/$system-unpack"
+
+  mkdir -p "$unpack_dir"
+  curl -fsSL "$url" -o "$archive" || return
+  tar -xzf "$archive" -C "$unpack_dir" || return
+
+  if [[ ! -x "$unpack_dir/antigravity" ]]; then
+    echo "Expected executable 'antigravity' in $url" >&2
+    exit 1
+  fi
+
+  nix hash path --type sha256 "$unpack_dir"
+}
+
+while (( $# > 0 )); do
+  system="$1"
+  url="$2"
+  shift 2
+
+  if [[ "$url" != *"/antigravity-cli/$version-"* ]]; then
+    echo "URL for $system does not match package version $version: $url" >&2
+    exit 1
+  fi
+
+  echo "Hashing $system from $url"
+  hash="$(hash_url "$system" "$url")"
+  update-source-version antigravity-cli "$version" "$hash" \
+    --file="$package_file" \
+    --ignore-same-hash \
+    --ignore-same-version \
+    --source-key="sources.$system" \
+    --system="$system"
+done
diff --git a/pkgs/by-name/ap/apm-cli/package.nix b/pkgs/by-name/ap/apm-cli/package.nix
new file mode 100644
index 000000000000..d7bb92755741
--- /dev/null
+++ b/pkgs/by-name/ap/apm-cli/package.nix
@@ -0,0 +1,77 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "apm-cli";
+  version = "0.15.0";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "microsoft";
+    repo = "apm";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-xKY1ESX683uFqfiLqAK2ALpO+2NYs6ecqa4S639c1+k=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail '"llm-github-models>=0.1.0",' ""
+  '';
+
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  dependencies = with python3Packages; [
+    click
+    colorama
+    filelock
+    gitpython
+    llm
+    # Not in nixpkgs and the game is not worth the candle for this package.
+    # llm-github-models
+    python-frontmatter
+    pyyaml
+    requests
+    rich
+    rich-click
+    ruamel-yaml
+    toml
+    tomli
+    watchdog
+  ];
+
+  optional-dependencies = with python3Packages; {
+    build = [
+      pyinstaller
+    ];
+    dev = [
+      jsonschema
+      mypy
+      pylint
+      pytest
+      pytest-cov
+      pytest-split
+      pytest-xdist
+      ruff
+    ];
+  };
+
+  pythonImportsCheck = [
+    "apm_cli"
+  ];
+
+  meta = {
+    description = "Agent Package Manager";
+    homepage = "https://github.com/microsoft/apm";
+    changelog = "https://github.com/microsoft/apm/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ drupol ];
+    mainProgram = "apm-cli";
+  };
+})
diff --git a/pkgs/by-name/au/authelia/package.nix b/pkgs/by-name/au/authelia/package.nix
index 3b51064cd4a7..fff57cfd7e5c 100644
--- a/pkgs/by-name/au/authelia/package.nix
+++ b/pkgs/by-name/au/authelia/package.nix
@@ -4,9 +4,9 @@
   nodejs,
   fetchPnpmDeps,
   pnpmConfigHook,
-  pnpm_10,
+  pnpm_11,
   fetchFromGitHub,
-  buildGo125Module,
+  buildGo126Module,
   installShellFiles,
   callPackage,
   nixosTests,
@@ -15,16 +15,16 @@
       nodejs
       fetchPnpmDeps
       pnpmConfigHook
-      pnpm_10
+      pnpm_11
       fetchFromGitHub
       ;
   },
 }:
 
 let
-  pnpm = pnpm_10;
+  pnpm = pnpm_11;
 
-  buildGoModule = buildGo125Module;
+  buildGoModule = buildGo126Module;
 
   inherit (import ./sources.nix { inherit fetchFromGitHub; })
     pname
@@ -66,11 +66,6 @@ buildGoModule (finalAttrs: {
       "-X ${p}.BuildExtra=nixpkgs"
     ];
 
-  # It is required to set this to avoid a change in the
-  # handling of sync map in go 1.24+
-  # Upstream issue: https://github.com/authelia/authelia/issues/8980
-  env.GOEXPERIMENT = "nosynchashtriemap";
-
   # several tests with networking and several that want chromium
   doCheck = false;
 
diff --git a/pkgs/by-name/au/authelia/sources.nix b/pkgs/by-name/au/authelia/sources.nix
index cd9372cc2662..d234fad15cfa 100644
--- a/pkgs/by-name/au/authelia/sources.nix
+++ b/pkgs/by-name/au/authelia/sources.nix
@@ -1,14 +1,14 @@
 { fetchFromGitHub }:
 rec {
   pname = "authelia";
-  version = "4.39.19";
+  version = "4.39.20";
 
   src = fetchFromGitHub {
     owner = "authelia";
     repo = "authelia";
     rev = "v${version}";
-    hash = "sha256-wMOurdgdjykFekn0Pej3meM6WSzq9tJ+kZV9sVDvRwM=";
+    hash = "sha256-JjpfNQsqtmSKXj14fQUJsiTgfkAlSHDfqUC/x+bE+fc=";
   };
-  vendorHash = "sha256-ZDsLRMip2B8PPZu8VxW+91FVvwC2rXzohhAZFifT26g=";
-  pnpmDepsHash = "sha256-HMrC5V+Ak2dF1uPtbh8kgFc8kZI2FPMmZHJciWRYx9w=";
+  vendorHash = "sha256-dZjsYqw/ABEn1y6tZgSjbmqamO4U20Ljj/dQMFruVjU=";
+  pnpmDepsHash = "sha256-syfPg62JrTh496xi39xW/CnIwpJYo+iU5sCPP3bD2Ys=";
 }
diff --git a/pkgs/by-name/au/authelia/web.nix b/pkgs/by-name/au/authelia/web.nix
index 3f5336adfca7..ca8a276e5e31 100644
--- a/pkgs/by-name/au/authelia/web.nix
+++ b/pkgs/by-name/au/authelia/web.nix
@@ -3,12 +3,12 @@
   nodejs,
   fetchPnpmDeps,
   pnpmConfigHook,
-  pnpm_10,
+  pnpm_11,
   fetchFromGitHub,
 }:
 
 let
-  pnpm = pnpm_10;
+  pnpm = pnpm_11;
 
   inherit (import ./sources.nix { inherit fetchFromGitHub; })
     pname
diff --git a/pkgs/by-name/ba/babl/package.nix b/pkgs/by-name/ba/babl/package.nix
index 91c3303bffd8..75fe2176ff4c 100644
--- a/pkgs/by-name/ba/babl/package.nix
+++ b/pkgs/by-name/ba/babl/package.nix
@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "babl";
-  version = "0.1.124";
+  version = "0.1.126";
 
   outputs = [
     "out"
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://download.gimp.org/pub/babl/${lib.versions.majorMinor finalAttrs.version}/babl-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Gw1USrb0CfKxtfZ3ImJy0ejG03Py9FPuhwv8fl3U8bE=";
+    hash = "sha256-PwkPSyph/s98jcYKWAS7x3zv2Nd4ry3tBZ8ONnpSkw4=";
   };
 
   patches = [
@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dprefix-dev=${placeholder "dev"}"
     # On Linux, this would be disabled by default but we have -Dauto_features=enabled.
     # Disable it on other platforms too, since I cannot test it there.
-    "-Drelocatable=disabled"
+    "-Drelocatable-bundle=no"
   ]
   ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
     # Docs are opt-out in native but opt-in in cross builds.
diff --git a/pkgs/by-name/ba/bambu-studio/package.nix b/pkgs/by-name/ba/bambu-studio/package.nix
index de869f8f2f52..de5cdb840016 100644
--- a/pkgs/by-name/ba/bambu-studio/package.nix
+++ b/pkgs/by-name/ba/bambu-studio/package.nix
@@ -1,13 +1,13 @@
 {
   stdenv,
   lib,
-  binutils,
   fetchFromGitHub,
   cmake,
   ninja,
   pkg-config,
   wrapGAppsHook3,
   boost183,
+  cacert,
   cereal,
   cgal_5,
   curl,
@@ -15,7 +15,6 @@
   eigen,
   expat,
   ffmpeg,
-  gcc-unwrapped,
   glew,
   glfw,
   glib,
@@ -26,19 +25,24 @@
   gtk3,
   hicolor-icon-theme,
   libpng,
+  libsecret,
+  makeFontsConf,
   mpfr,
+  nanum,
   nlopt,
   opencascade-occt_7_6,
   openvdb,
   openexr,
   opencv,
-  pcre,
   systemd,
   onetbb,
   webkitgtk_4_1,
   wxwidgets_3_1,
   libx11,
   withSystemd ? stdenv.hostPlatform.isLinux,
+  # 3D viewport blank on NVIDIA proprietary GL; routes through Mesa + zink.
+  # https://github.com/NixOS/nixpkgs/issues/498311
+  withNvidiaGLWorkaround ? false,
 }:
 let
   wxGTK' =
@@ -48,11 +52,17 @@ let
       withWebKit = true;
     }).overrideAttrs
       (old: {
+        buildInputs = old.buildInputs ++ [ libsecret ];
         configureFlags = old.configureFlags ++ [
           # Disable noisy debug dialogs
           "--enable-debug=no"
+          "--enable-secretstore"
         ];
       });
+
+  fontsConf = makeFontsConf { fontDirectories = [ nanum ]; };
+
+  caBundle = "${cacert}/etc/ssl/certs/ca-bundle.crt";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "bambu-studio";
@@ -73,7 +83,6 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    binutils
     boost183
     cereal
     cgal_5
@@ -82,7 +91,6 @@ stdenv.mkDerivation (finalAttrs: {
     eigen
     expat
     ffmpeg
-    gcc-unwrapped
     glew
     glfw
     glib
@@ -95,12 +103,12 @@ stdenv.mkDerivation (finalAttrs: {
     gtk3
     hicolor-icon-theme
     libpng
+    libsecret
     mpfr
     nlopt
     opencascade-occt_7_6
     openexr
     openvdb
-    pcre
     onetbb
     webkitgtk_4_1
     wxGTK'
@@ -156,19 +164,19 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   cmakeFlags = [
-    "-DSLIC3R_STATIC=0"
-    "-DSLIC3R_FHS=1"
-    "-DSLIC3R_GTK=3"
+    (lib.cmakeBool "SLIC3R_STATIC" false)
+    (lib.cmakeBool "SLIC3R_FHS" true)
+    (lib.cmakeFeature "SLIC3R_GTK" "3")
 
     # Skips installing ffmpeg, since we BYO.
-    "-DFLATPAK=1"
+    (lib.cmakeBool "FLATPAK" true)
 
-    # BambuStudio-specific
-    "-DBBL_RELEASE_TO_PUBLIC=1"
-    "-DBBL_INTERNAL_TESTING=0"
-    "-DDEP_WX_GTK3=ON"
-    "-DSLIC3R_BUILD_TESTS=0"
-    "-DCMAKE_CXX_FLAGS=-DBOOST_LOG_DYN_LINK"
+    # Substituted into `#define BBL_x @value@`; must be integer literals.
+    (lib.cmakeFeature "BBL_RELEASE_TO_PUBLIC" "1")
+    (lib.cmakeFeature "BBL_INTERNAL_TESTING" "0")
+    (lib.cmakeBool "DEP_WX_GTK3" true)
+    (lib.cmakeBool "SLIC3R_BUILD_TESTS" false)
+    (lib.cmakeFeature "CMAKE_CXX_FLAGS" "-DBOOST_LOG_DYN_LINK")
   ];
 
   preFixup = ''
@@ -178,6 +186,25 @@ stdenv.mkDerivation (finalAttrs: {
       # Fixes intermittent crash
       # The upstream setup links in glew statically
       --prefix LD_PRELOAD : "${glew.out}/lib/libGLEW.so"
+
+      # plugin libcurl + main HTTPS need explicit CA bundle.
+      # https://github.com/NixOS/nixpkgs/issues/498307
+      --set-default SSL_CERT_FILE ${caBundle}
+      --set-default CURL_CA_BUNDLE ${caBundle}
+
+      # WebKit OAuth callback fails with DMA-BUF compositing.
+      # https://github.com/NixOS/nixpkgs/issues/498307
+      --set WEBKIT_DISABLE_COMPOSITING_MODE 1
+      --set WEBKIT_DISABLE_DMABUF_RENDERER 1
+
+      --set FONTCONFIG_FILE "${fontsConf}"
+
+      ${lib.optionalString withNvidiaGLWorkaround ''
+        --set __GLX_VENDOR_LIBRARY_NAME mesa
+        --set __EGL_VENDOR_LIBRARY_FILENAMES /run/opengl-driver/share/glvnd/egl_vendor.d/50_mesa.json
+        --set MESA_LOADER_DRIVER_OVERRIDE zink
+        --set GALLIUM_DRIVER zink
+      ''}
     )
   '';
 
@@ -192,7 +219,15 @@ stdenv.mkDerivation (finalAttrs: {
     description = "PC Software for BambuLab's 3D printers";
     homepage = "https://github.com/bambulab/BambuStudio";
     changelog = "https://github.com/bambulab/BambuStudio/releases/tag/v${finalAttrs.version}";
-    license = lib.licenses.agpl3Plus;
+    license = with lib.licenses; [
+      agpl3Plus
+      # Bambu Studio downloads and dlopens a proprietary networking library
+      # at first launch whose corresponding source is not provided. SFC ruled
+      # this an ongoing AGPLv3 violation; see:
+      # https://github.com/NixOS/nixpkgs/issues/415821
+      # https://sfconservancy.org/news/2026/may/18/bambu-studio-3d-printer-agpl-violation-response/
+      unfree
+    ];
     maintainers = with lib.maintainers; [
       zhaofengli
       dsluijk
diff --git a/pkgs/by-name/be/beon/package.nix b/pkgs/by-name/be/beon/package.nix
index 068ae8da78a9..e3715c8c89b0 100644
--- a/pkgs/by-name/be/beon/package.nix
+++ b/pkgs/by-name/be/beon/package.nix
@@ -4,12 +4,18 @@
   fetchFromGitHub,
   mkfontdir,
   mkfontscale,
+  installFonts,
 }:
 
 stdenvNoCC.mkDerivation {
   pname = "beon";
   version = "2024-02-26";
 
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
   src = fetchFromGitHub {
     owner = "noirblancrouge";
     repo = "Beon";
@@ -17,22 +23,25 @@ stdenvNoCC.mkDerivation {
     hash = "sha256-jBLVVykHFJamOVF6GSRnQqYixqOrw5K1oV1B3sl4Zoc=";
   };
 
+  dontBuild = true;
+
   nativeBuildInputs = [
     mkfontscale
     mkfontdir
+    installFonts
   ];
 
   installPhase = ''
     runHook preInstall
-
-    install -D -v fonts/ttf/Beon-Regular.ttf $out/share/fonts/truetype/Beon-Regular.ttf
-    cd $out/share/fonts
-    mkfontdir
-    mkfontscale
-
     runHook postInstall
   '';
 
+  preInstall = "rm -r docs/proof";
+  postInstall = ''
+    mkfontdir $out/share/fonts
+    mkfontscale $out/share/fonts
+  '';
+
   meta = {
     description = "Neon stencil typeface";
     homepage = "https://noirblancrouge.com/fonts/beon-display";
diff --git a/pkgs/by-name/bl/blocky/package.nix b/pkgs/by-name/bl/blocky/package.nix
index 72356272cf8e..7d0cb1fae802 100644
--- a/pkgs/by-name/bl/blocky/package.nix
+++ b/pkgs/by-name/bl/blocky/package.nix
@@ -7,20 +7,20 @@
 
 buildGoModule (finalAttrs: {
   pname = "blocky";
-  version = "0.29.0";
+  version = "0.30.0";
 
   src = fetchFromGitHub {
     owner = "0xERR0R";
     repo = "blocky";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-8eFLmgTqK+WqJCPwLJXJqz2XCcP/1JDWfQQfzme9ELw=";
+    hash = "sha256-SZpAPX+MIQA0HRUUmjXi7g+DEJ+jyub4rlyc0RLclew=";
   };
 
   # needs network connection and fails at
   # https://github.com/0xERR0R/blocky/blob/development/resolver/upstream_resolver_test.go
   doCheck = false;
 
-  vendorHash = "sha256-H8AaK1jcdv10218ftMOrjfHd0XfaN9q3I0z4pGFirWA=";
+  vendorHash = "sha256-DahHFf0w0ksQniuVByX45/fLcqpAga23qMjAGnZTjjY=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ca/cantarell-fonts/package.nix b/pkgs/by-name/ca/cantarell-fonts/package.nix
index 0fc209464ea1..b0c3a47edf08 100644
--- a/pkgs/by-name/ca/cantarell-fonts/package.nix
+++ b/pkgs/by-name/ca/cantarell-fonts/package.nix
@@ -33,12 +33,6 @@ stdenv.mkDerivation rec {
     appstream-glib
   ];
 
-  # ad-hoc fix for https://github.com/NixOS/nixpkgs/issues/50855
-  # until we fix gettext's envHook
-  preBuild = ''
-    export GETTEXTDATADIRS="$GETTEXTDATADIRS_FOR_BUILD"
-  '';
-
   outputHashAlgo = "sha256";
   outputHashMode = "recursive";
   outputHash = "sha256-OjHj4h3n+/ozbrLaiH4bGppQ+2LA2RB/sZQVO9EPOEw=";
diff --git a/pkgs/by-name/ca/cargo-nextest/package.nix b/pkgs/by-name/ca/cargo-nextest/package.nix
index a7b8832c6aaf..4d58e9f6bd06 100644
--- a/pkgs/by-name/ca/cargo-nextest/package.nix
+++ b/pkgs/by-name/ca/cargo-nextest/package.nix
@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-nextest";
-  version = "0.9.136";
+  version = "0.9.137";
 
   src = fetchFromGitHub {
     owner = "nextest-rs";
     repo = "nextest";
     tag = "cargo-nextest-${finalAttrs.version}";
-    hash = "sha256-SXpRSmCduZqF9HHvAd3NkgUtokZpxxu3f6IZEnLwA0g=";
+    hash = "sha256-Ad5QXVkPwJk2wMHbCbYVwgua0DfmUwBLmfG9bSt1dbA=";
   };
 
   # FIXME: we don't support dtrace probe generation on macOS until we have a dtrace build: https://github.com/NixOS/nixpkgs/pull/392918
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ./no-dtrace-macos.patch
   ];
 
-  cargoHash = "sha256-RWg1NcqlajN3GTOuMQ3WWWx5pa59YBZO3yKEm58qSu8=";
+  cargoHash = "sha256-7ISzQ9jt/ekrO7Z4B09YbNLZkNDwS13ljl2tpEQdthU=";
 
   cargoBuildFlags = [
     "-p"
diff --git a/pkgs/by-name/cc/ccsymbols/package.nix b/pkgs/by-name/cc/ccsymbols/package.nix
index f9132d165e3e..34c9c106cd0c 100644
--- a/pkgs/by-name/cc/ccsymbols/package.nix
+++ b/pkgs/by-name/cc/ccsymbols/package.nix
@@ -2,31 +2,32 @@
   lib,
   stdenvNoCC,
   fetchurl,
+  installFonts,
   unzip,
 }:
 
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "ccsymbols";
   version = "2020-04-19";
 
   src = fetchurl {
-    url = "https://www.ctrl.blog/file/${version}_cc-symbols.zip";
+    url = "https://www.ctrl.blog/file/${finalAttrs.version}_cc-symbols.zip";
     hash = "sha256-hkARhb8T6VgGAybYkVuPuebjhuk1dwiBJ1bZMwvYpMY=";
   };
 
   sourceRoot = ".";
 
-  nativeBuildInputs = [ unzip ];
+  outputs = [
+    "out"
+    "webfont"
+  ];
 
-  installPhase = ''
-    runHook preInstall
+  nativeBuildInputs = [
+    installFonts
+    unzip
+  ];
 
-    install -Dm644 CCSymbols.* -t $out/share/fonts/ccsymbols
-
-    runHook postInstall
-  '';
-
-  passthru = { inherit pname version; };
+  passthru = { inherit (finalAttrs) pname version; };
 
   meta = {
     description = "Creative Commons symbol font";
@@ -35,4 +36,4 @@ stdenvNoCC.mkDerivation rec {
     license = lib.licenses.publicDomain;
     platforms = lib.platforms.all;
   };
-}
+})
diff --git a/pkgs/by-name/cl/clouddrive2/package.nix b/pkgs/by-name/cl/clouddrive2/package.nix
index 60a4bc653de2..3d96d8ca157b 100644
--- a/pkgs/by-name/cl/clouddrive2/package.nix
+++ b/pkgs/by-name/cl/clouddrive2/package.nix
@@ -11,16 +11,16 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "clouddrive2";
-  version = "1.0.7";
+  version = "1.0.8";
 
   src = fetchurl {
     url = "https://github.com/cloud-fs/cloud-fs.github.io/releases/download/v${finalAttrs.version}/clouddrive-2-${os}-${arch}-${finalAttrs.version}.tgz";
     hash =
       {
-        x86_64-linux = "sha256-wVbCEluFyanoMy1wir87ahRdop7C4lILIn2jB5B29+M=";
-        aarch64-linux = "sha256-HzFg9LXdYO1bGpah5pg/xmv+/7cuVCnNsrin28Yc/OQ=";
-        x86_64-darwin = "sha256-Uqo6hVan4+F3DPxoHjIg53wDV9naT9h6+EiEkCJBb7o=";
-        aarch64-darwin = "sha256-jzCZeGq0fDnsCTGSNG0nOBGIUDBAn/D/TD2Iz5K8O3w=";
+        x86_64-linux = "sha256-LB2G5g5Bj+kFmrY/kgQEGsXmrmrGQbH7pdshr8lfank=";
+        aarch64-linux = "sha256-XYjHiB9JDkfoKS1uzzvJ0o79+YipABedY56JnmCyInE=";
+        x86_64-darwin = "sha256-avzB7gUiVPKuRha+Ls7huNfrPtDKmyFPc6gFfuWOBPw=";
+        aarch64-darwin = "sha256-frldCUG6aGfXDoPzvG8QYMTL4SxTEd2hPLy0+7YWtIE=";
       }
       .${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
   };
diff --git a/pkgs/by-name/di/directx-shader-compiler/package.nix b/pkgs/by-name/di/directx-shader-compiler/package.nix
index 3a1b7114816b..5920ccbf04f3 100644
--- a/pkgs/by-name/di/directx-shader-compiler/package.nix
+++ b/pkgs/by-name/di/directx-shader-compiler/package.nix
@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "directx-shader-compiler";
-  version = "1.10.2605.2";
+  version = "1.10.2605.24";
 
   # Put headers in dev, there are lot of them which aren't necessary for
   # using the compiler binary.
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "microsoft";
     repo = "DirectXShaderCompiler";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-FzfXxfhAyJw7rouWJEyeVdikG5TBM81yC+9iRg5tK3c=";
+    hash = "sha256-vZDP4xnqEdswjvlLTO1jYKtQS1UAA0vGdP2ovB8HMaM=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/en/enca/package.nix b/pkgs/by-name/en/enca/package.nix
index 72ca0eb3f2a1..04bd061c095a 100644
--- a/pkgs/by-name/en/enca/package.nix
+++ b/pkgs/by-name/en/enca/package.nix
@@ -1,18 +1,20 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitHub,
   libiconv,
   recode,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "enca";
-  version = "1.19";
+  version = "1.22";
 
-  src = fetchurl {
-    url = "https://dl.cihar.com/enca/enca-${finalAttrs.version}.tar.xz";
-    sha256 = "1f78jmrggv3jymql8imm5m9yc8nqjw5l99mpwki2245l8357wj1s";
+  src = fetchFromGitHub {
+    owner = "Project-OSS-Revival";
+    repo = "enca";
+    tag = finalAttrs.version;
+    hash = "sha256-TMWAGT3iY/ND8pB4THU4PbBGpb8EfT6z+peT8T6mp4o=";
   };
 
   buildInputs = [
@@ -21,8 +23,9 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   meta = {
+    changelog = "https://github.com/Project-OSS-Revival/enca/blob/${finalAttrs.src.tag}/ChangeLog";
     description = "Detects the encoding of text files and reencodes them";
-
+    homepage = "https://cihar.com/software/enca/";
     longDescription = ''
       Enca detects the encoding of text files, on the basis of knowledge
       of their language. It can also convert them to other encodings,
diff --git a/pkgs/by-name/ex/exploitdb/package.nix b/pkgs/by-name/ex/exploitdb/package.nix
index f587db0dde0e..4ed7894bc131 100644
--- a/pkgs/by-name/ex/exploitdb/package.nix
+++ b/pkgs/by-name/ex/exploitdb/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "exploitdb";
-  version = "2026-05-22";
+  version = "2026-05-27";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = "exploitdb";
     tag = finalAttrs.version;
-    hash = "sha256-DzTgrRjonZgvkLfXpt7oxlmxYD+y3lALTpyAsTv9Y0A=";
+    hash = "sha256-nLn9QpHEF5TCMP0wKBSemQV9VA/viwYzjNlsGSpQf4Q=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/fa/fastnetmon-advanced/package.nix b/pkgs/by-name/fa/fastnetmon-advanced/package.nix
index 2c2061dac530..e19e5820bc3b 100644
--- a/pkgs/by-name/fa/fastnetmon-advanced/package.nix
+++ b/pkgs/by-name/fa/fastnetmon-advanced/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fastnetmon-advanced";
-  version = "2.0.372";
+  version = "2.0.380";
 
   src = fetchurl {
-    url = "https://repo.fastnetmon.com/fastnetmon_ubuntu_jammy/pool/fastnetmon/f/fastnetmon/fastnetmon_${version}_amd64.deb";
-    hash = "sha256-FwYAbTBkk+AciDVxTIimswsB0M3gbzKX+03PD0fLMsY=";
+    url = "https://repo.fastnetmon.com/fastnetmon_ubuntu_noble/pool/fastnetmon/f/fastnetmon/fastnetmon_${version}_amd64.deb";
+    hash = "sha256-4hCrDaFat0kEbyzKg6nHdV+LlqCBYYJEojyvXyPYKD0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ff/ffmpeg-normalize/package.nix b/pkgs/by-name/ff/ffmpeg-normalize/package.nix
index 889b2898ba9a..0965b2e24413 100644
--- a/pkgs/by-name/ff/ffmpeg-normalize/package.nix
+++ b/pkgs/by-name/ff/ffmpeg-normalize/package.nix
@@ -7,13 +7,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "ffmpeg-normalize";
-  version = "1.37.7";
+  version = "1.37.8";
   pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = "ffmpeg_normalize";
-    hash = "sha256-8V9C5auAvrmvq5aeaRjCy9y2/c7wm4/7Yb73dBgvj5s=";
+    hash = "sha256-9pSVrYTTaxjGCty2pHPtaaSSwCkGDLoNK2wltTwOL3c=";
   };
 
   build-system = with python3Packages; [ uv-build ];
diff --git a/pkgs/by-name/fo/forgejo-runner/package.nix b/pkgs/by-name/fo/forgejo-runner/package.nix
index d4ae132e8e78..8803c82a5221 100644
--- a/pkgs/by-name/fo/forgejo-runner/package.nix
+++ b/pkgs/by-name/fo/forgejo-runner/package.nix
@@ -52,17 +52,17 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "forgejo-runner";
-  version = "12.10.1";
+  version = "12.10.2";
 
   src = fetchFromGitea {
     domain = "code.forgejo.org";
     owner = "forgejo";
     repo = "runner";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-OBMduRaGSVPojSAr6DKPbAdUyuw1MSCpipRv+EA5OGw=";
+    hash = "sha256-Uo+x02HgpfOY+KXug7cmnW4d85AlX6wqz+nYGF/JrHk=";
   };
 
-  vendorHash = "sha256-V9dEHNp80oS7NfsGIlKgFyHD1PmMm2bCqydVADpphuA=";
+  vendorHash = "sha256-0gOftkxkBPziU0Tm8lIiD72rXcMMY5M57G9/Bt/mneI=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/gi/github-desktop/package.nix b/pkgs/by-name/gi/github-desktop/package.nix
index afce9672250e..f6c6484edefc 100644
--- a/pkgs/by-name/gi/github-desktop/package.nix
+++ b/pkgs/by-name/gi/github-desktop/package.nix
@@ -35,13 +35,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "github-desktop";
-  version = "3.5.10";
+  version = "3.5.11";
 
   src = fetchFromGitHub {
     owner = "desktop";
     repo = "desktop";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-AG5YiX8Jyi3ebgPSU4he2UamEdxgTjEYjezh2WkZjC8=";
+    hash = "sha256-nW+yq330lQRfo1RtxUtbkQ336WeE8BjC9jYAIibfdXo=";
     fetchSubmodules = true;
     postCheckout = "git -C $out rev-parse HEAD > $out/.gitrev";
   };
diff --git a/pkgs/by-name/gl/glfw3/package.nix b/pkgs/by-name/gl/glfw3/package.nix
index 31eb1b0af49e..711406030b70 100644
--- a/pkgs/by-name/gl/glfw3/package.nix
+++ b/pkgs/by-name/gl/glfw3/package.nix
@@ -34,6 +34,11 @@ stdenv.mkDerivation {
   pname = "glfw${lib.optionalString withMinecraftPatch "-minecraft"}";
   inherit version;
 
+  outputs = [
+    "out"
+    "dev"
+  ];
+
   src = fetchFromGitHub {
     owner = "glfw";
     repo = "GLFW";
diff --git a/pkgs/by-name/go/goshs/package.nix b/pkgs/by-name/go/goshs/package.nix
index 150c41c2f420..a08f48cb856c 100644
--- a/pkgs/by-name/go/goshs/package.nix
+++ b/pkgs/by-name/go/goshs/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "goshs";
-  version = "2.0.8";
+  version = "2.0.9";
 
   src = fetchFromGitHub {
     owner = "patrickhener";
     repo = "goshs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xGV9Sr+IAkGrDv6Qz2mgDS6vL9oBj9l7AuZ13SW91FE=";
+    hash = "sha256-NAq3fBjhiGIP9zA/s6wYaQ0nDju6hZu/g2RPIIEO41g=";
   };
 
-  vendorHash = "sha256-3+MGBaFWmMf2gDiZhYUxHFNmEfD/Xr1lNddlA5FQLUE=";
+  vendorHash = "sha256-nVg+ALvvZYG+9JFiNGaT/EQO8IdZK3EO8UQoAp29KNQ=";
 
   ldflags = [ "-s" ];
 
diff --git a/pkgs/by-name/ht/html2pdf/package.nix b/pkgs/by-name/ht/html2pdf/package.nix
index f92ee0545bbd..3a663c3e4084 100644
--- a/pkgs/by-name/ht/html2pdf/package.nix
+++ b/pkgs/by-name/ht/html2pdf/package.nix
@@ -6,6 +6,7 @@
   makeWrapper,
   chromium,
   withChromium ? (lib.meta.availableOn stdenv.hostPlatform chromium),
+  versionCheckHook,
   nix-update-script,
 }:
 
@@ -41,6 +42,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ''
   );
 
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
   passthru.updateScript = nix-update-script { };
 
   meta = {
diff --git a/pkgs/by-name/jm/jmol/package.nix b/pkgs/by-name/jm/jmol/package.nix
index bbece5ed904e..9242614a4a3c 100644
--- a/pkgs/by-name/jm/jmol/package.nix
+++ b/pkgs/by-name/jm/jmol/package.nix
@@ -31,7 +31,7 @@ let
   };
 in
 stdenv.mkDerivation (finalAttrs: {
-  version = "16.3.49";
+  version = "16.4.1";
   pname = "jmol";
 
   src =
@@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
     in
     fetchurl {
       url = "mirror://sourceforge/jmol/Jmol/Version%20${baseVersion}/Jmol%20${finalAttrs.version}/Jmol-${finalAttrs.version}-binary.tar.gz";
-      hash = "sha256-OOHqRgkgG51o8mxo7lDAEQeCFoBSxdwdX72CUYdmRKw=";
+      hash = "sha256-n7Ql/pK/N6maG2EjrgdRz+HUvn+JwkZpvRQyuElKrHI=";
     };
 
   patchPhase = ''
diff --git a/pkgs/by-name/kn/knope/package.nix b/pkgs/by-name/kn/knope/package.nix
index 8bbfe376e23a..aa64d12df1d8 100644
--- a/pkgs/by-name/kn/knope/package.nix
+++ b/pkgs/by-name/kn/knope/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "knope";
-  version = "0.22.4";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "knope-dev";
     repo = "knope";
     tag = "knope/v${finalAttrs.version}";
-    hash = "sha256-2lZhetmctKSfLXd7jvepm1+Vc0db1teryx6tehEHCJM=";
+    hash = "sha256-Brr/MnJwgyGRjBrY6H2uUnVXFYWdUAHzLolFBgszkp0=";
   };
 
-  cargoHash = "sha256-L7IT7nWinyWiuIwlBmGmHDyKB+o3LJBanHVFRQpWB+c=";
+  cargoHash = "sha256-vjjwoBHgmjzMVDyscfde/fRwm7QWFTuD9EX1+OowUm8=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/li/libnatspec/package.nix b/pkgs/by-name/li/libnatspec/package.nix
index fea1dd1f797b..c94ae97bc476 100644
--- a/pkgs/by-name/li/libnatspec/package.nix
+++ b/pkgs/by-name/li/libnatspec/package.nix
@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitHub,
   autoreconfHook,
   popt,
   libiconv,
@@ -9,11 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libnatspec";
-  version = "0.3.0";
+  version = "0.3.3";
 
-  src = fetchurl {
-    url = "mirror://sourceforge/natspec/libnatspec-${finalAttrs.version}.tar.bz2";
-    sha256 = "0wffxjlc8svilwmrcg3crddpfrpv35mzzjgchf8ygqsvwbrbb3b7";
+  src = fetchFromGitHub {
+    owner = "Etersoft";
+    repo = "libnatspec";
+    rev = "0.3.3-alt1";
+    hash = "sha256-lg3kjrvv7G+nX6xlR7TQKvXqQJFcQTHarSpD0qYLZsw=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];
@@ -27,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
   propagatedBuildInputs = [ libiconv ];
 
   meta = {
-    homepage = "https://natspec.sourceforge.net/";
+    homepage = "https://github.com/Etersoft/libnatspec";
     description = "Library intended to smooth national specificities in using of programs";
     mainProgram = "natspec";
     platforms = lib.platforms.unix;
diff --git a/pkgs/by-name/mi/microsoft-edge/package.nix b/pkgs/by-name/mi/microsoft-edge/package.nix
index 09875f0d22ff..955504805ff7 100644
--- a/pkgs/by-name/mi/microsoft-edge/package.nix
+++ b/pkgs/by-name/mi/microsoft-edge/package.nix
@@ -292,7 +292,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       ulrikstrid
       maeve-oake
       leleuvilela
-      bricklou
       jonhermansen
       iedame
     ];
diff --git a/pkgs/by-name/mi/minio-cpp/package.nix b/pkgs/by-name/mi/minio-cpp/package.nix
index bb35f243f0fe..0751efcba691 100644
--- a/pkgs/by-name/mi/minio-cpp/package.nix
+++ b/pkgs/by-name/mi/minio-cpp/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "minio-cpp";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "minio-cpp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JKC9SYgb5+nQ3M5C6j6QLfltM+U18oaFrep4gOKPlCI=";
+    hash = "sha256-4XQapUPNacgwXOm64efxOJnhqBgeJt2pSoWKBzp7obc=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/mi/mitmproxy2swagger/package.nix b/pkgs/by-name/mi/mitmproxy2swagger/package.nix
index 721efa981d9f..db60db153b05 100644
--- a/pkgs/by-name/mi/mitmproxy2swagger/package.nix
+++ b/pkgs/by-name/mi/mitmproxy2swagger/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "mitmproxy2swagger";
-  version = "0.14.0";
+  version = "0.15.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "alufers";
     repo = "mitmproxy2swagger";
     tag = finalAttrs.version;
-    hash = "sha256-bQ9zjRsMrC/B118iP2hevj2hhSFD7FTnsCe6lUMwYSI=";
+    hash = "sha256-J5vuT0p+mc1XXEl7GnXbT/J4mTjzva66o3cUizBWMko=";
   };
 
   pythonRelaxDeps = [
@@ -21,7 +21,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     "ruamel.yaml"
   ];
 
-  build-system = with python3.pkgs; [ poetry-core ];
+  build-system = with python3.pkgs; [ hatchling ];
 
   dependencies = with python3.pkgs; [
     json-stream
diff --git a/pkgs/by-name/ne/neovim-unwrapped/package.nix b/pkgs/by-name/ne/neovim-unwrapped/package.nix
index 18559067c590..0f0f799d5ccd 100644
--- a/pkgs/by-name/ne/neovim-unwrapped/package.nix
+++ b/pkgs/by-name/ne/neovim-unwrapped/package.nix
@@ -287,6 +287,7 @@ stdenv.mkDerivation (
       '';
       homepage = "https://neovim.io";
       changelog = "https://github.com/neovim/neovim/releases/tag/${finalAttrs.src.tag}";
+      donationPage = "https://neovim.io/sponsors/";
       mainProgram = "nvim";
       # "Contributions committed before b17d96 by authors who did not sign the
       # Contributor License Agreement (CLA) remain under the Vim license.
diff --git a/pkgs/by-name/nv/nvidia-mig-parted/package.nix b/pkgs/by-name/nv/nvidia-mig-parted/package.nix
index 7757ddad5851..bd906a283f6f 100644
--- a/pkgs/by-name/nv/nvidia-mig-parted/package.nix
+++ b/pkgs/by-name/nv/nvidia-mig-parted/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "nvidia-mig-parted";
-  version = "0.14.1";
+  version = "0.14.2";
 
   src = fetchFromGitHub {
     owner = "NVIDIA";
     repo = "mig-parted";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-05WbIEvHN/CAvd5ex4I8FZx0NreIg5QDOgXmAda/mzc=";
+    hash = "sha256-M6XgYh3qrNcSc0WF9uDFk+MOfaTxkoyUK0SJTQAEiVY=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ob/obs-cmd/package.nix b/pkgs/by-name/ob/obs-cmd/package.nix
index 467c7e77728c..9e11f3d97c1d 100644
--- a/pkgs/by-name/ob/obs-cmd/package.nix
+++ b/pkgs/by-name/ob/obs-cmd/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "obs-cmd";
-  version = "0.31.3";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "grigio";
     repo = "obs-cmd";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YJgZ9AhQkr5/AyqJ35czGPi5kdUM9V7o32pmx89r1bc=";
+    hash = "sha256-8lCqUN5FacDARZylR+s74l/mSP3Jy0GT5u03/WrUALM=";
   };
 
-  cargoHash = "sha256-cjoNIAHhk9VCW/MWwBTA2pMOuS47gk+qVkIXNUcEWxs=";
+  cargoHash = "sha256-Fyyr2oMHsIb9/jiqnzb94H5eknoy/WmwU7sL1cOxuPQ=";
 
   meta = {
     description = "Minimal CLI to control OBS Studio via obs-websocket";
diff --git a/pkgs/by-name/pe/penpot-desktop/package.nix b/pkgs/by-name/pe/penpot-desktop/package.nix
index d0ef0a17bc81..664a74686731 100644
--- a/pkgs/by-name/pe/penpot-desktop/package.nix
+++ b/pkgs/by-name/pe/penpot-desktop/package.nix
@@ -2,7 +2,7 @@
   lib,
   buildNpmPackage,
   copyDesktopItems,
-  electron_39,
+  electron_41,
   fetchFromGitHub,
   jq,
   makeDesktopItem,
@@ -15,17 +15,17 @@ let
   description = "Unofficial desktop application for the open-source design tool, Penpot";
   icon = "penpot";
   nodejs = nodejs_24;
-  electron = electron_39;
+  electron = electron_41;
 in
 buildNpmPackage rec {
   pname = "penpot-desktop";
-  version = "0.23.0";
+  version = "0.23.1";
 
   src = fetchFromGitHub {
     owner = "author-more";
     repo = "penpot-desktop";
     tag = "v${version}";
-    hash = "sha256-2thLD8ECfHZMD3Yw/lQgnCqqEGxCE1AXsHGP9JKof+Q=";
+    hash = "sha256-/vRF5eqtjdmd2Qmb+OAgKfLJmh78S0WrLWA94SeOJQA=";
   };
 
   makeCacheWritable = true;
@@ -33,7 +33,7 @@ buildNpmPackage rec {
     "--engine-strict"
     "--legacy-peer-deps"
   ];
-  npmDepsHash = "sha256-uyt9gmmytDwSCnXk9HUBwJoPMcqMt2wLwHHmY2Kx0yk=";
+  npmDepsHash = "sha256-hu2v2Dw2SRs4Egmsi5hb81vgnZDjQahLXyAYm/uaMao=";
   # Do not run the default build script as it leads to errors caused by the electron-builder configuration
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/ph/phoenixd/package.nix b/pkgs/by-name/ph/phoenixd/package.nix
index 44578c1275d3..ae8392392e5c 100644
--- a/pkgs/by-name/ph/phoenixd/package.nix
+++ b/pkgs/by-name/ph/phoenixd/package.nix
@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "phoenixd";
-  version = "0.7.3";
+  version = "0.8.0";
 
   src =
     let
@@ -28,10 +28,10 @@ stdenv.mkDerivation (finalAttrs: {
     fetchurl {
       url = "https://github.com/ACINQ/phoenixd/releases/download/v${finalAttrs.version}/phoenixd-${finalAttrs.version}-${suffix}.zip";
       hash = selectSystem {
-        aarch64-darwin = "sha256-tKTn6w2F6qKsn6ieob+gENL4/kF8CZU346KbjgYIXWU=";
-        x86_64-darwin = "sha256-9F5jngwx/O9Qklpzxlfd5SN94ds80cZzopRrXyPY+pQ=";
-        x86_64-linux = "sha256-MCYElD6mG5PNKcns5ZYsrCoEmS1JPySqFgDhuX2O6os=";
-        aarch64-linux = "sha256-xMiSxY7Q2witH0GR7lI2V6HU8noY8u4zYInhjM3y0wU=";
+        aarch64-darwin = "sha256-eVrwJGjXZNl9e2QGtVVEHjptCMPQgGaxljDEqr7LE7s=";
+        x86_64-darwin = "sha256-vHu+9GwN0jWvjH/bKceZHDPRidVLFLzzMen2Zc+L1ck=";
+        x86_64-linux = "sha256-n/yvAisqpnbHs3XV0sHq0sUpq0+mqXmG+3LXRNmrLpI=";
+        aarch64-linux = "sha256-mfhLpPXFvkO0mz4okdOXALIk8MR2CQQ8mZ6aI+QgNZs=";
       };
     };
 
diff --git a/pkgs/by-name/pi/picoshare/package.nix b/pkgs/by-name/pi/picoshare/package.nix
index b0663e81cf87..4edb8bc9cbfe 100644
--- a/pkgs/by-name/pi/picoshare/package.nix
+++ b/pkgs/by-name/pi/picoshare/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "picoshare";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "mtlynch";
     repo = "picoshare";
     tag = finalAttrs.version;
-    hash = "sha256-8mgrwnY0Y1CggAtc7BrAqC32+Wu82FQNhoK0ijM1RKw=";
+    hash = "sha256-iKLO0m9zPYGQB3aJxyYCs9sHSheihnKn8QWec4D+a4g=";
   };
 
-  vendorHash = "sha256-Wf0qKs/9XKnO2nx2KmTGPdqI0iFih30AGvOi94RPEjw=";
+  vendorHash = "sha256-X2vrEhgEnKKNXRyLCtT+wBbunFHgkcyWZh6DMpQieQ0=";
 
   ldflags = [
     # make sure build time is always set to 0 to make the build reproducible
diff --git a/pkgs/by-name/sa/sandhole/package.nix b/pkgs/by-name/sa/sandhole/package.nix
index 64a10fa4a3a6..4db1fddb74da 100644
--- a/pkgs/by-name/sa/sandhole/package.nix
+++ b/pkgs/by-name/sa/sandhole/package.nix
@@ -10,21 +10,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sandhole";
-  version = "0.9.4";
+  version = "0.9.5";
 
   src = fetchFromGitHub {
     owner = "EpicEric";
     repo = "sandhole";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nACjMd1GGfopXTqkkJP3zOnFGqB4TeuJCoQWZXSnBiA=";
+    hash = "sha256-l+9DcqAxrrjLxs/7KxY6QlfIAlwMVjQztt4lgJJMsyI=";
   };
 
-  cargoHash = "sha256-n3VoLQP6jmYJvo/6GRXaB/u9XfewlOOt/zKD9YbCQzU=";
-
-  # All integration tests require networking.
-  postPatch = ''
-    echo "fn main() {}" > tests/integration/main.rs
-  '';
+  cargoHash = "sha256-euWvpEjSW2JeDysBul5eR4M27LwkRSZDlsp57lMBpAE=";
 
   nativeBuildInputs = [
     cmake
@@ -34,11 +29,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   strictDeps = true;
 
   useNextest = true;
-  checkFlags = [
-    # Some unit tests require networking.
-    "--skip"
-    "login"
-  ];
+  # Skip tests that require networking.
+  cargoTestFlags = [ "--profile=no-network" ];
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
@@ -54,6 +46,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     license = lib.licenses.mit;
     mainProgram = "sandhole";
     maintainers = with lib.maintainers; [ EpicEric ];
-    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    platforms = lib.platforms.all;
   };
 })
diff --git a/pkgs/by-name/sh/shopware-cli/package.nix b/pkgs/by-name/sh/shopware-cli/package.nix
index 535836777b65..f12f01460eb6 100644
--- a/pkgs/by-name/sh/shopware-cli/package.nix
+++ b/pkgs/by-name/sh/shopware-cli/package.nix
@@ -11,12 +11,12 @@
 
 buildGoModule (finalAttrs: {
   pname = "shopware-cli";
-  version = "0.14.8";
+  version = "0.15.2";
   src = fetchFromGitHub {
     repo = "shopware-cli";
     owner = "shopware";
     tag = finalAttrs.version;
-    hash = "sha256-yN6yuGnZv6BsXoERUdA3aBGEmri1hqmPsbIYsX7HE5Q=";
+    hash = "sha256-HWIfumFTBBLMjXa+2AHzXS1UR8Z91C6/x9pHXQcO6WE=";
   };
 
   nativeBuildInputs = [
@@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
     dart-sass
   ];
 
-  vendorHash = "sha256-itrSY18wZnY0j4wq2mJ+2ugM0A2SKORENJ0iwWg+s+U=";
+  vendorHash = "sha256-KQDPTyw24BqjetYSJfMeSrgO9mgHxIBuKgp0/0H76R0=";
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd shopware-cli \
diff --git a/pkgs/by-name/sp/speed-cloudflare-cli/package.nix b/pkgs/by-name/sp/speed-cloudflare-cli/package.nix
index a1c1e27b33df..bd8fedd91dc5 100644
--- a/pkgs/by-name/sp/speed-cloudflare-cli/package.nix
+++ b/pkgs/by-name/sp/speed-cloudflare-cli/package.nix
@@ -1,32 +1,52 @@
 {
   lib,
+  buildNpmPackage,
   fetchFromGitHub,
-  stdenv,
+  applyPatches,
+  fetchpatch,
   nodejs,
 }:
-stdenv.mkDerivation {
+buildNpmPackage {
   pname = "speed-cloudflare-cli";
-  version = "2.0.3-unstable-2024-05-15";
+  version = "2.0.3-unstable-2025-07-31";
 
-  src = fetchFromGitHub {
-    owner = "KNawm";
-    repo = "speed-cloudflare-cli";
-    rev = "dd301195e7def359a39cceeba16b1c0bedac8f5d";
-    sha256 = "sha256-kxLeQUdJbkmApf5Af3Mgd3WvS3GhXXOIvA4gNB55TGM=";
+  src = applyPatches {
+    src = fetchFromGitHub {
+      owner = "KNawm";
+      repo = "speed-cloudflare-cli";
+      rev = "8eb34f4bd4f63493fbd93b1659389b9a1e5e4a36";
+      sha256 = "sha256-kJ//zXBW2IQ5V5dJfAm8iGxf9QILH0uloNYiwG3pTe4=";
+    };
+
+    # Applies the follwing PR:
+    # https://github.com/KNawm/speed-cloudflare-cli/pull/38
+    patches = [
+      # fix: handle non-array response from /locations and format
+      (fetchpatch {
+        url = "https://github.com/KNawm/speed-cloudflare-cli/commit/2682f167a1776de2f0c8085b591b06319a2aac7d.patch";
+        hash = "sha256-pkGNg7NwSP9QrBI2e0q44ZyJ8ckp0Pw/brpDkZkevdk=";
+      })
+      # docs: add logging for API errors as suggested by code review
+      (fetchpatch {
+        url = "https://github.com/KNawm/speed-cloudflare-cli/commit/2cb89f9b9af0f43c75ed2ea8f6c0a8519766b7c8.patch";
+        hash = "sha256-tLkyfXYd1s4FaMOwffyyObXZyIFlkvWvy7YkqBxU1SU=";
+      })
+    ];
   };
 
-  nativeBuildInputs = [ nodejs ];
+  postInstall = ''
+    mkdir -p "$out/bin"
 
-  installPhase = ''
-    mkdir -p $out/bin
-
-    install -Dm755 $src/cli.js $out/bin/speed-cloudflare-cli
-    install -Dm644 $src/chalk.js $out/bin/chalk.js
-    install -Dm644 $src/stats.js $out/bin/stats.js
-
-    patchShebangs $out/bin/speed-cloudflare-cli
+    # Create an executable wrapper
+    makeWrapper ${lib.getExe nodejs} "$out/bin/speed-cloudflare-cli" \
+      --add-flags "$out/lib/node_modules/speed-cloudflare-cli/cli.js"
   '';
 
+  npmDepsHash = "sha256-CoirJgdpF9WEgbaXQbq5QlRO9wstZbNxIW2L1cJ+nXg=";
+
+  dontBuild = true;
+  dontNpmBuild = true;
+
   meta = {
     description = "Measure the speed and consistency of your internet connection using speed.cloudflare.com";
     homepage = "https://github.com/KNawm/speed-cloudflare-cli";
diff --git a/pkgs/by-name/ve/velocity/package.nix b/pkgs/by-name/ve/velocity/package.nix
index 149f6c441f31..d2195b8405a9 100644
--- a/pkgs/by-name/ve/velocity/package.nix
+++ b/pkgs/by-name/ve/velocity/package.nix
@@ -34,13 +34,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "velocity";
-  version = "3.5.0-unstable-2026-05-09";
+  version = "3.5.0-unstable-2026-05-24";
 
   src = fetchFromGitHub {
     owner = "PaperMC";
     repo = "Velocity";
-    rev = "9c0c9b02187c20bb767ce16ac7685580430d9b10";
-    hash = "sha256-SPsI/bAlO3aQOT+84tJJZ0+UjbR4REXzaiFr6952/sI=";
+    rev = "25fbd833cd847a76f1e46ce15b70e077e41b72e2";
+    hash = "sha256-sCAD4Altk6aZyP4eR7+QnkGlo8Rubcd1EzBCbz92ycg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/vl/vlc/package.nix b/pkgs/by-name/vl/vlc/package.nix
index 77fa2e334641..5174bf62351b 100644
--- a/pkgs/by-name/vl/vlc/package.nix
+++ b/pkgs/by-name/vl/vlc/package.nix
@@ -314,6 +314,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Cross-platform media player and streaming server";
     homepage = "https://www.videolan.org/vlc/";
+    donationPage = "https://www.videolan.org/contribute.html#money";
     license = lib.licenses.lgpl21Plus;
     maintainers = [ ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/wa/wapiti/package.nix b/pkgs/by-name/wa/wapiti/package.nix
index d694a4f40495..ad75aa851859 100644
--- a/pkgs/by-name/wa/wapiti/package.nix
+++ b/pkgs/by-name/wa/wapiti/package.nix
@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "wapiti";
-  version = "3.2.10";
+  version = "3.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "wapiti-scanner";
     repo = "wapiti";
     tag = finalAttrs.version;
-    hash = "sha256-/w5t/BcMPewl0Wp6vx9kZamqHArb7+fnfktfEIUDL8Y=";
+    hash = "sha256-hUkEwyIzYhlip6vtwO8EYcUsL5B/ZVnbJKpTR6osVuc=";
   };
 
   pythonRelaxDeps = true;
@@ -87,11 +87,15 @@ python3Packages.buildPythonApplication (finalAttrs: {
     "test_explorer_extract_links"
     "test_explorer_filtering"
     "test_false"
+    "test_fetch_source_files_typo3"
+    "test_fetch_source_files"
     "test_frame"
     "test_headers_detection"
     "test_html_detection"
     "test_implies_detection"
     "test_inclusion_detection"
+    "test_magento_multi_version_detected"
+    "test_magento_version_detected"
     "test_merge_with_and_without_redirection"
     "test_meta_detection"
     "test_multi_detection"
diff --git a/pkgs/by-name/xp/xp-pen-g430-driver/package.nix b/pkgs/by-name/xp/xp-pen-g430-driver/package.nix
deleted file mode 100644
index bb745306080a..000000000000
--- a/pkgs/by-name/xp/xp-pen-g430-driver/package.nix
+++ /dev/null
@@ -1,51 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchzip,
-  autoPatchelfHook,
-  libusb1,
-  libx11,
-  libxtst,
-  qt5,
-  libglvnd,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "xp-pen-g430-driver";
-  version = "1.2.13.1";
-
-  src = fetchzip {
-    url = "https://archive.org/download/linux-pentablet-v-1.2.13.1.tar.gz-20200428/Linux_Pentablet_V1.2.13.1.tar.gz%2820200428%29.zip/Linux_Pentablet_V1.2.13.1.tar.gz";
-    name = "xp-pen-g430-driver-${finalAttrs.version}.tar.gz";
-    hash = "sha256-Wavf4EAzR/NX3GOfdAEdFX08gkD03FVvAkIl37Zmipc=";
-  };
-
-  nativeBuildInputs = [
-    autoPatchelfHook
-    qt5.wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    libusb1
-    libx11
-    libxtst
-    qt5.qtbase
-    libglvnd
-    (lib.getLib stdenv.cc.cc)
-  ];
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp Pentablet_Driver $out/bin/pentablet-driver
-    cp config.xml $out/bin/config.xml
-  '';
-
-  meta = {
-    homepage = "https://www.xp-pen.com/download-46.html";
-    description = "Driver for XP-PEN Pentablet drawing tablets";
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    license = lib.licenses.unfree;
-    platforms = [ "x86_64-linux" ];
-    maintainers = [ ];
-  };
-})
diff --git a/pkgs/desktops/enlightenment/evisum/default.nix b/pkgs/desktops/enlightenment/evisum/default.nix
index bba0c894cac0..9e2bf8f773ef 100644
--- a/pkgs/desktops/enlightenment/evisum/default.nix
+++ b/pkgs/desktops/enlightenment/evisum/default.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evisum";
-  version = "2.0.9";
+  version = "2.0.10";
 
   src = fetchurl {
     url = "https://download.enlightenment.org/rel/apps/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "iTmeXrNqltpALEnJRz4oiNzikGLJzprmeZH7/3RmEkk=";
+    sha256 = "ipp0Yv6uOcEnymkq6A534/pch8Eb2v7E38BgT99XNB4=";
   };
 
   nativeBuildInputs = [
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "System and process monitor written with EFL";
     mainProgram = "evisum";
-    homepage = "https://www.enlightenment.org";
+    homepage = "https://git.enlightenment.org/enlightenment/evisum";
     license = with lib.licenses; [ isc ];
     platforms = lib.platforms.linux;
     teams = [ lib.teams.enlightenment ];
diff --git a/pkgs/development/interpreters/erlang/27.nix b/pkgs/development/interpreters/erlang/27.nix
index 9614575f2620..52b3e41cee8a 100644
--- a/pkgs/development/interpreters/erlang/27.nix
+++ b/pkgs/development/interpreters/erlang/27.nix
@@ -1,6 +1,6 @@
 genericBuilder:
 
 genericBuilder {
-  version = "27.3.4.11";
-  hash = "sha256-yOgsaeUv6GwFX6qPVb28zet6Hli5vg/PZCKW2s2/JEA=";
+  version = "27.3.4.12";
+  hash = "sha256-RnCBGuqEEJ+3kkbiVNLSb8sAh2i9SNyH9ixkqtAbjsk=";
 }
diff --git a/pkgs/development/interpreters/erlang/28.nix b/pkgs/development/interpreters/erlang/28.nix
index 544fdabf13b3..bc2c9546c894 100644
--- a/pkgs/development/interpreters/erlang/28.nix
+++ b/pkgs/development/interpreters/erlang/28.nix
@@ -1,6 +1,6 @@
 genericBuilder:
 
 genericBuilder {
-  version = "28.5";
-  hash = "sha256-A4gIjfWsrfZR89xNWyynTAdJtGj6ZWth3xIQBMLqcpc=";
+  version = "28.5.0.1";
+  hash = "sha256-tZQQCBDpDcrN9QX8Qwz6HqNVATck1+emGVOviEhqsLc=";
 }
diff --git a/pkgs/development/interpreters/erlang/29.nix b/pkgs/development/interpreters/erlang/29.nix
index dc59b0dc29ba..e3c2fbd2a90e 100644
--- a/pkgs/development/interpreters/erlang/29.nix
+++ b/pkgs/development/interpreters/erlang/29.nix
@@ -1,6 +1,6 @@
 genericBuilder:
 
 genericBuilder {
-  version = "29.0";
-  hash = "sha256-AUt/Mlp84cVEypqDsyD5VbywYEGda0eikMDmSnzlKUI=";
+  version = "29.0.1";
+  hash = "sha256-0I82VBCgA8KfdNYkNWyqcH+f0Kc6al11BAErtxfVDZo=";
 }
diff --git a/pkgs/development/libraries/ffmpeg/generic.nix b/pkgs/development/libraries/ffmpeg/generic.nix
index 0b9142ed67a9..b1f682050f21 100644
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -1063,6 +1063,7 @@ stdenv.mkDerivation (
         No matter if they were designed by some standards committee, the community or
         a corporation.
       '';
+      donationPage = "https://ffmpeg.org/donations.html";
       license =
         with lib.licenses;
         [ lgpl21Plus ]
diff --git a/pkgs/development/ocaml-modules/lua-ml/default.nix b/pkgs/development/ocaml-modules/lua-ml/default.nix
index d358a7baf44e..6aeec982619f 100644
--- a/pkgs/development/ocaml-modules/lua-ml/default.nix
+++ b/pkgs/development/ocaml-modules/lua-ml/default.nix
@@ -2,23 +2,24 @@
   lib,
   fetchFromGitHub,
   buildDunePackage,
+  menhir,
 }:
 buildDunePackage (finalAttrs: {
   pname = "lua-ml";
-  version = "0.9.4";
-
-  minimalOCamlVersion = "4.07";
+  version = "0.9.5";
 
   src = fetchFromGitHub {
     owner = "lindig";
     repo = "lua-ml";
     tag = finalAttrs.version;
-    hash = "sha256-kMBTHzmlrRWNpWwG321jYcM61rE1J3YQkygSrfnZ6Wc=";
+    hash = "sha256-+kg/hwcmRoM6sSL2GXOC2GrnJRu52BR5UiNu3nl5Lnk=";
   };
 
+  nativeBuildInputs = [ menhir ];
+
   meta = {
     description = "Embeddable Lua 2.5 interpreter implemented in OCaml";
-    inherit (finalAttrs.src.meta) homepage;
+    homepage = "https://github.com/lindig/lua-ml";
     license = lib.licenses.bsd2;
     maintainers = [ lib.maintainers.vbgl ];
   };
diff --git a/pkgs/development/ocaml-modules/tar/default.nix b/pkgs/development/ocaml-modules/tar/default.nix
index 712579e067f4..f0559a19d126 100644
--- a/pkgs/development/ocaml-modules/tar/default.nix
+++ b/pkgs/development/ocaml-modules/tar/default.nix
@@ -2,22 +2,18 @@
   lib,
   fetchurl,
   buildDunePackage,
-  camlp-streams,
   decompress,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "tar";
-  version = "3.3.0";
+  version = "3.5.0";
   src = fetchurl {
-    url = "https://github.com/mirage/ocaml-tar/releases/download/v${version}/tar-${version}.tbz";
-    hash = "sha256-89aw1nf9QP0euAvMxgu2EyIDWL5Y9mxfqL8CV/Pl65Y=";
+    url = "https://github.com/mirage/ocaml-tar/releases/download/v${finalAttrs.version}/tar-${finalAttrs.version}.tbz";
+    hash = "sha256-haKmHTDu+B5L+B4LQp0hPOtd1urtzWDJeeHLuRFJ+Qw=";
   };
 
-  minimalOCamlVersion = "4.08";
-
   propagatedBuildInputs = [
-    camlp-streams
     decompress
   ];
 
@@ -29,4 +25,4 @@ buildDunePackage rec {
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.ulrikstrid ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/tar/eio.nix b/pkgs/development/ocaml-modules/tar/eio.nix
index dbdf250447a0..afd379b3448f 100644
--- a/pkgs/development/ocaml-modules/tar/eio.nix
+++ b/pkgs/development/ocaml-modules/tar/eio.nix
@@ -2,7 +2,8 @@
   buildDunePackage,
   tar,
   eio,
-  git,
+  alcotest,
+  eio_main,
 }:
 
 buildDunePackage {
@@ -16,8 +17,9 @@ buildDunePackage {
     eio
   ];
 
-  nativeCheckInputs = [
-    git
+  checkInputs = [
+    alcotest
+    eio_main
   ];
 
   meta = tar.meta // {
diff --git a/pkgs/development/ocaml-modules/tar/unix.nix b/pkgs/development/ocaml-modules/tar/unix.nix
index c109b0e7a177..5ab0194fc330 100644
--- a/pkgs/development/ocaml-modules/tar/unix.nix
+++ b/pkgs/development/ocaml-modules/tar/unix.nix
@@ -1,6 +1,8 @@
 {
   buildDunePackage,
   tar,
+  fpath,
+  logs,
   lwt,
   git,
 }:
@@ -11,6 +13,8 @@ buildDunePackage {
 
   propagatedBuildInputs = [
     tar
+    fpath
+    logs
     lwt
   ];
 
diff --git a/pkgs/development/python-modules/azure-mgmt-policyinsights/default.nix b/pkgs/development/python-modules/azure-mgmt-policyinsights/default.nix
index c7906dc5200e..7ffbe2d692ce 100644
--- a/pkgs/development/python-modules/azure-mgmt-policyinsights/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-policyinsights/default.nix
@@ -1,42 +1,44 @@
 {
   lib,
-  buildPythonPackage,
-  fetchPypi,
-  msrest,
-  msrestazure,
   azure-common,
   azure-mgmt-core,
-  azure-mgmt-nspkg,
-  isPy3k,
+  buildPythonPackage,
+  fetchPypi,
+  isodate,
+  setuptools,
+  typing-extensions,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "azure-mgmt-policyinsights";
-  version = "1.0.0";
-  format = "setuptools";
+  version = "1.0.1";
+  pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    extension = "zip";
-    sha256 = "75103fb4541aeae30bb687dee1fedd9ca65530e6b97b2d9ea87f74816905202a";
+    pname = "azure_mgmt_policyinsights";
+    inherit (finalAttrs) version;
+    hash = "sha256-rsmIKwVcRrWUxDjJf1Cj4YczEooRUwRpzgl6fFmaDl0=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     azure-common
     azure-mgmt-core
-    msrest
-    msrestazure
-  ]
-  ++ lib.optionals (!isPy3k) [ azure-mgmt-nspkg ];
+    isodate
+    typing-extensions
+  ];
 
   # has no tests
   doCheck = false;
+
   pythonImportsCheck = [ "azure.mgmt.policyinsights" ];
 
   meta = {
-    description = "This is the Microsoft Azure Policy Insights Client Library";
-    homepage = "https://github.com/Azure/azure-sdk-for-python";
+    description = "Microsoft Azure Policy Insights Client Library";
+    homepage = "https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/policyinsights/azure-mgmt-policyinsights";
+    changelog = "https://github.com/Azure/azure-sdk-for-python/blob/azure-mgmt-policyinsights_${finalAttrs.version}/sdk/policyinsights/azure-mgmt-policyinsights/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ maxwilson ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/blocksat-cli/default.nix b/pkgs/development/python-modules/blocksat-cli/default.nix
index 0131150c4e0a..0dadda917445 100644
--- a/pkgs/development/python-modules/blocksat-cli/default.nix
+++ b/pkgs/development/python-modules/blocksat-cli/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "blocksat-cli";
-  version = "2.5.1";
+  version = "2.5.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Blockstream";
     repo = "satellite";
     tag = "v${version}";
-    hash = "sha256-SH1MZx/ZkhhWhxhREqFCGoob58J2XMZSpe+q7UgiyF4=";
+    hash = "sha256-KwLUE8+/SJ178az/j9WONwwrTsos1vrsP2hpeczNt4Y=";
   };
 
   # Upstream setup.py installs both the CLI and GUI versions.
diff --git a/pkgs/development/python-modules/cynthion/default.nix b/pkgs/development/python-modules/cynthion/default.nix
index 0ed5832bef9c..b61edaeda1db 100644
--- a/pkgs/development/python-modules/cynthion/default.nix
+++ b/pkgs/development/python-modules/cynthion/default.nix
@@ -51,6 +51,8 @@ buildPythonPackage rec {
     setuptools
   ];
 
+  pythonRelaxDeps = [ "pygreat" ];
+
   pythonRemoveDeps = [ "future" ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/diffusers/default.nix b/pkgs/development/python-modules/diffusers/default.nix
index ff7c61692b96..34a5b3ae63a6 100644
--- a/pkgs/development/python-modules/diffusers/default.nix
+++ b/pkgs/development/python-modules/diffusers/default.nix
@@ -45,18 +45,22 @@
 
 buildPythonPackage rec {
   pname = "diffusers";
-  version = "0.36.0";
+  version = "0.38.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "diffusers";
     tag = "v${version}";
-    hash = "sha256-bDGiY1PR3JilEzkynUGE5IwDA+bgVQWW1jpGEfftI3U=";
+    hash = "sha256-FyXQJh4i/m9lAD2Sz45YWc+KIFMA+xQLb3ErudO9voY=";
   };
 
   build-system = [ setuptools ];
 
+  pythonRelaxDeps = [
+    "safetensors"
+  ];
+
   dependencies = [
     filelock
     huggingface-hub
diff --git a/pkgs/development/python-modules/genai-prices/default.nix b/pkgs/development/python-modules/genai-prices/default.nix
index 7c58018d1233..c27015818d1d 100644
--- a/pkgs/development/python-modules/genai-prices/default.nix
+++ b/pkgs/development/python-modules/genai-prices/default.nix
@@ -7,20 +7,20 @@
   uv-build,
 
   # dependencies
-  httpx,
+  httpx2,
   pydantic,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "genai-prices";
-  version = "0.0.61";
+  version = "0.0.62";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "genai-prices";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3w3V6uIeRBTpc2rtkVRVsLlWGzHHksklv3YyCw6/VEI=";
+    hash = "sha256-VUhJwv15cHqIsZc103aoTX1D8kzt+cy/jdHUi++0+/w=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/packages/python";
@@ -30,7 +30,7 @@ buildPythonPackage (finalAttrs: {
   ];
 
   dependencies = [
-    httpx
+    httpx2
     pydantic
   ];
 
diff --git a/pkgs/development/python-modules/http-sf/default.nix b/pkgs/development/python-modules/http-sf/default.nix
index a180257530c1..9248dd4d3ebc 100644
--- a/pkgs/development/python-modules/http-sf/default.nix
+++ b/pkgs/development/python-modules/http-sf/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "http-sf";
-  version = "1.2.1";
+  version = "1.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mnot";
     repo = "http-sf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uA/LosjGuRd8h/xU663peP1eSrz46W79uPohrm75irc=";
+    hash = "sha256-sqLYD/JIRvKl6ciVDfSWNAUhhSHhdw7UFnDyHiV5sZg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/httpcore2/default.nix b/pkgs/development/python-modules/httpcore2/default.nix
new file mode 100644
index 000000000000..f7708b751017
--- /dev/null
+++ b/pkgs/development/python-modules/httpcore2/default.nix
@@ -0,0 +1,95 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  hatchling,
+  hatch-fancy-pypi-readme,
+  uv-dynamic-versioning,
+
+  # dependencies
+  certifi,
+  h11,
+
+  # optional dependencies
+  h2,
+  socksio,
+  trio,
+  anyio,
+
+  # tests
+  pytestCheckHook,
+  pytest-httpbin,
+  pytest-trio,
+
+  # reverse deps
+  httpx2,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "httpcore2";
+  version = "2.2.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "pydantic";
+    repo = "httpx2";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-RdoMDF5XVOkb4JCmytdF0JmBfTUcHuM1N+SD8r+RNiU=";
+  };
+
+  postPatch = ''
+    pushd src/httpcore2
+  '';
+
+  build-system = [
+    hatchling
+    hatch-fancy-pypi-readme
+    uv-dynamic-versioning
+  ];
+
+  dependencies = [
+    certifi
+    h11
+  ];
+
+  optional-dependencies = {
+    asyncio = [ anyio ];
+    http2 = [ h2 ];
+    socks = [ socksio ];
+    trio = [ trio ];
+  };
+
+  pythonImportsCheck = [
+    "httpcore2"
+  ];
+
+  preCheck = ''
+    popd
+  '';
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-httpbin
+    pytest-trio
+  ]
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
+
+  pytestFlags = [ "tests/httpcore2" ];
+
+  passthru.tests = {
+    inherit httpx2;
+  };
+
+  __darwinAllowLocalNetworking = true;
+  __structuredAttrs = true;
+
+  meta = {
+    description = "A next generation HTTP client for Python";
+    homepage = "https://github.com/pydantic/httpx2";
+    changelog = "https://github.com/pydantic/httpx2/blob/${finalAttrs.src.tag}/src/httpcore2/CHANGELOG.md";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ hexa ];
+  };
+})
diff --git a/pkgs/development/python-modules/httpx2/default.nix b/pkgs/development/python-modules/httpx2/default.nix
new file mode 100644
index 000000000000..82f5a2acd0fd
--- /dev/null
+++ b/pkgs/development/python-modules/httpx2/default.nix
@@ -0,0 +1,122 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  isPyPy,
+  pythonOlder,
+
+  # build-system
+  hatchling,
+  hatch-fancy-pypi-readme,
+  uv-dynamic-versioning,
+
+  # dependencies
+  anyio,
+  certifi,
+  httpcore2,
+  idna,
+
+  # optional dependencies
+  brotli,
+  brotlicffi,
+  click,
+  h2,
+  pygments,
+  rich,
+  socksio,
+  zstandard,
+
+  # tests
+  chardet,
+  pytestCheckHook,
+  pytest-httpbin,
+  pytest-trio,
+  trustme,
+  uvicorn,
+
+  # reverse deps
+  httpx2,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "httpx2";
+  version = "2.2.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "pydantic";
+    repo = "httpx2";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-RdoMDF5XVOkb4JCmytdF0JmBfTUcHuM1N+SD8r+RNiU=";
+  };
+
+  postPatch = ''
+    pushd src/httpx2
+  '';
+
+  build-system = [
+    hatchling
+    hatch-fancy-pypi-readme
+    uv-dynamic-versioning
+  ];
+
+  dependencies = [
+    anyio
+    certifi
+    httpcore2
+    idna
+  ];
+
+  optional-dependencies = {
+    brotli = if isPyPy then [ brotlicffi ] else [ brotli ];
+    cli = [
+      click
+      pygments
+      rich
+    ];
+    http2 = [ h2 ];
+    socks = [ socksio ];
+    zstd = lib.optionals (pythonOlder "3.14") [ zstandard ];
+  };
+
+  pythonImportsCheck = [
+    "httpx2"
+  ];
+
+  preCheck = ''
+    popd
+  '';
+
+  nativeCheckInputs = [
+    chardet
+    pytestCheckHook
+    # pytest-httpbin
+    pytest-trio
+    trustme
+    uvicorn
+  ]
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
+
+  pytestFlags = [ "tests/httpx2" ];
+
+  disabledTests = [
+    # network access
+    "test_async_proxy_close"
+    "test_sync_proxy_close"
+  ];
+
+  passthru.tests = {
+    inherit httpx2;
+  };
+
+  __darwinAllowLocalNetworking = true;
+  __structuredAttrs = true;
+
+  meta = {
+    description = "A next generation HTTP client for Python";
+    homepage = "https://github.com/pydantic/httpx2";
+    changelog = "https://github.com/pydantic/httpx2/blob/${finalAttrs.src.tag}/src/httpx2/CHANGELOG.md";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ hexa ];
+  };
+})
diff --git a/pkgs/development/python-modules/iocx/default.nix b/pkgs/development/python-modules/iocx/default.nix
index 1dc942482971..a802796f2ed2 100644
--- a/pkgs/development/python-modules/iocx/default.nix
+++ b/pkgs/development/python-modules/iocx/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iocx";
-  version = "0.7.3";
+  version = "0.7.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "iocx-dev";
     repo = "iocx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cCgpkUSlXQm/F8nvpybwt27cicuDAeoHk5t4dYIAsXY=";
+    hash = "sha256-z/l6i+RKYfEC02OxFHEXvo38VYty2FVt48pP+HBLJco=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/labgrid/default.nix b/pkgs/development/python-modules/labgrid/default.nix
index e886c06e3618..08a45405ea9a 100644
--- a/pkgs/development/python-modules/labgrid/default.nix
+++ b/pkgs/development/python-modules/labgrid/default.nix
@@ -15,6 +15,7 @@
   pexpect,
   psutil,
   pyserial,
+  pytest,
   pytestCheckHook,
   pytest-benchmark,
   pytest-dependency,
@@ -78,6 +79,7 @@ buildPythonPackage rec {
     pyudev
     pyusb
     pyyaml
+    pytest
     requests
     xmodem
   ];
diff --git a/pkgs/development/python-modules/led-ble/default.nix b/pkgs/development/python-modules/led-ble/default.nix
index 056113a0fd87..348a2d86d817 100644
--- a/pkgs/development/python-modules/led-ble/default.nix
+++ b/pkgs/development/python-modules/led-ble/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "led-ble";
-  version = "1.1.8";
+  version = "1.1.11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = "led-ble";
     tag = "v${version}";
-    hash = "sha256-98nAtv2p6WNxg6wwlGviVRzaKGCWGZNqPG4k3jwQpjw=";
+    hash = "sha256-YPOjbmHR6WpmAEpYFl/ajzojgiIYEk+6H5LFjl1yo1c=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/mitogen/default.nix b/pkgs/development/python-modules/mitogen/default.nix
index 1626169e6dc1..ab83fcc49e04 100644
--- a/pkgs/development/python-modules/mitogen/default.nix
+++ b/pkgs/development/python-modules/mitogen/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "mitogen";
-  version = "0.3.47";
+  version = "0.3.48";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mitogen-hq";
     repo = "mitogen";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vCfGig2Sc4NpDl2lEM5FkFAsA/+EFd8Sv643onkMWqQ=";
+    hash = "sha256-RptIeE2XvVOzeYaRGiggesfZGJ+flkcFSDz1l23JxdE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/msgraph-sdk/default.nix b/pkgs/development/python-modules/msgraph-sdk/default.nix
index a4eb8c5a5fb8..a5c5c048ebff 100644
--- a/pkgs/development/python-modules/msgraph-sdk/default.nix
+++ b/pkgs/development/python-modules/msgraph-sdk/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "msgraph-sdk";
-  version = "1.56.0";
+  version = "1.58.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoftgraph";
     repo = "msgraph-sdk-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Y2PX07IzHO3wjVEYUw1o6vb1cr1pa8BJIR9Uliho3lQ=";
+    hash = "sha256-YF5cDivU3VVnIuCCyQsNY1gvCU5aazRJ6Hok97Af3nE=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/python-modules/neo4j/default.nix b/pkgs/development/python-modules/neo4j/default.nix
index 804ba43b9d95..3771214e52a9 100644
--- a/pkgs/development/python-modules/neo4j/default.nix
+++ b/pkgs/development/python-modules/neo4j/default.nix
@@ -11,19 +11,19 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "neo4j";
-  version = "6.1.0";
+  version = "6.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "neo4j";
     repo = "neo4j-python-driver";
     tag = finalAttrs.version;
-    hash = "sha256-1Ef9SMJid0q+tI8hceriNu2vsLAyW4Jxt53ifcmi5VA=";
+    hash = "sha256-M1bBZJOo4GS71Gt4vfRYfLduh/X8XFABgycQNVPsWSs=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail "setuptools ==" "setuptools >=" \
+      --replace-fail "setuptools == 82.0.1" "setuptools" \
       --replace-fail 'dynamic = ["version"]' 'version = "${finalAttrs.version}"'
   '';
 
diff --git a/pkgs/development/python-modules/pulumi/default.nix b/pkgs/development/python-modules/pulumi/default.nix
index 14c3cde976ab..adbed7f545ca 100644
--- a/pkgs/development/python-modules/pulumi/default.nix
+++ b/pkgs/development/python-modules/pulumi/default.nix
@@ -94,7 +94,6 @@ buildPythonPackage {
     homepage = "https://www.pulumi.com";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
-      teto
       tie
     ];
   };
diff --git a/pkgs/development/python-modules/pydantic-ai-slim/default.nix b/pkgs/development/python-modules/pydantic-ai-slim/default.nix
index a5848ca599fc..6e86318529ef 100644
--- a/pkgs/development/python-modules/pydantic-ai-slim/default.nix
+++ b/pkgs/development/python-modules/pydantic-ai-slim/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydantic-ai-slim";
-  version = "1.102.0";
+  version = "1.103.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "pydantic-ai";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5mX4o/LqiLAUmn1WXV6RVf2KwDYJ5pxFPtF2meVFp1o=";
+    hash = "sha256-eWusMERC1yZ/BltZPcYkrBGpbdG0EyWZVwYDqMLD/kY=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/pydantic_ai_slim";
diff --git a/pkgs/development/python-modules/pydantic-graph/default.nix b/pkgs/development/python-modules/pydantic-graph/default.nix
index ae1f19129b20..0ff62acf21b6 100644
--- a/pkgs/development/python-modules/pydantic-graph/default.nix
+++ b/pkgs/development/python-modules/pydantic-graph/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydantic-graph";
-  version = "1.102.0";
+  version = "1.103.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "pydantic-ai";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5mX4o/LqiLAUmn1WXV6RVf2KwDYJ5pxFPtF2meVFp1o=";
+    hash = "sha256-eWusMERC1yZ/BltZPcYkrBGpbdG0EyWZVwYDqMLD/kY=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/pydantic_graph";
diff --git a/pkgs/development/python-modules/pygreat/default.nix b/pkgs/development/python-modules/pygreat/default.nix
index bb3bd2ee8f10..bee64dd72b55 100644
--- a/pkgs/development/python-modules/pygreat/default.nix
+++ b/pkgs/development/python-modules/pygreat/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pygreat";
-  version = "2024.0.5";
+  version = "2026.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "greatscottgadgets";
     repo = "libgreat";
     tag = "v${version}";
-    hash = "sha256-2PFeCG7m8qiK3eBX2838P6ZsLoQxcJBG+/TppUMT6dE=";
+    hash = "sha256-m+s2TAJK7UhKWbuSd5ec1O40WeMXxJyTD9yqPOr0LEM=";
   };
 
   sourceRoot = "${src.name}/host";
@@ -26,8 +26,6 @@ buildPythonPackage rec {
       --replace-fail 'dynamic = ["version"]' 'version = "${version}"'
   '';
 
-  pythonRemoveDeps = [ "backports.functools_lru_cache" ];
-
   build-system = [ setuptools ];
 
   dependencies = [ pyusb ];
diff --git a/pkgs/development/python-modules/pyoverkiz/default.nix b/pkgs/development/python-modules/pyoverkiz/default.nix
index 5de8ce6263ff..6a45385fbc15 100644
--- a/pkgs/development/python-modules/pyoverkiz/default.nix
+++ b/pkgs/development/python-modules/pyoverkiz/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyoverkiz";
-  version = "1.20.3";
+  version = "1.20.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "iMicknl";
     repo = "python-overkiz-api";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pl7SL0lE/+eWTv6jmoilDVtaI2TB42YSpIbrY0fcptk=";
+    hash = "sha256-Zbz4l5bPvFQaek6/Nbn+PzAzLS3l2PyetuxOBVsuLPk=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/safety/default.nix b/pkgs/development/python-modules/safety/default.nix
index 6c01e6d32e1e..7f74c2c828f8 100644
--- a/pkgs/development/python-modules/safety/default.nix
+++ b/pkgs/development/python-modules/safety/default.nix
@@ -3,9 +3,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   hatchling,
-  setuptools,
   click,
-  requests,
   packaging,
   dparse,
   ruamel-yaml,
@@ -18,26 +16,26 @@
   safety-schemas,
   typing-extensions,
   filelock,
-  psutil,
   httpx,
   tenacity,
   tomlkit,
+  truststore,
   git,
   pytestCheckHook,
   tomli,
   writableTmpDirAsHomeHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "safety";
-  version = "3.7.0";
+  version = "3.8.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pyupio";
     repo = "safety";
-    tag = version;
-    hash = "sha256-BPLK/V7YQBCGopfRFAWdra8ve8Ww5KN1+oZKyoEPiFc=";
+    tag = finalAttrs.version;
+    hash = "sha256-/iLxcVku8ogVZyhQI0/U+m1RyECDYWxLix+S83HHrS4=";
   };
 
   patches = [
@@ -47,16 +45,11 @@ buildPythonPackage rec {
   build-system = [ hatchling ];
 
   pythonRelaxDeps = [
-    "filelock"
-    "pydantic"
-    "psutil"
     "safety-schemas"
   ];
 
   dependencies = [
-    setuptools
     click
-    requests
     packaging
     dparse
     ruamel-yaml
@@ -69,10 +62,10 @@ buildPythonPackage rec {
     safety-schemas
     typing-extensions
     filelock
-    psutil
     httpx
     tenacity
     tomlkit
+    truststore
   ];
 
   nativeCheckInputs = [
@@ -82,28 +75,21 @@ buildPythonPackage rec {
     writableTmpDirAsHomeHook
   ];
 
-  disabledTests = [
-    # Disable tests depending on online services
-    "test_announcements_if_is_not_tty"
-    "test_check_live"
-    "test_debug_flag"
-    "test_get_packages_licenses_without_api_key"
-    "test_init_project"
-    "test_validate_with_basic_policy_file"
+  disabledTestPaths = [
+    # Failed to initialize SafetyPlatformClient: [Errno -3] Temporary failure in name resolution
+    "tests/firewall/test_command.py"
+    "tests/test_cli.py"
   ];
 
-  # ImportError: cannot import name 'get_command_for' from partially initialized module 'safety.cli_util' (most likely due to a circular import)
-  disabledTestPaths = [ "tests/alerts/test_utils.py" ];
-
   meta = {
     description = "Checks installed dependencies for known vulnerabilities";
     mainProgram = "safety";
     homepage = "https://github.com/pyupio/safety";
-    changelog = "https://github.com/pyupio/safety/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/pyupio/safety/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       thomasdesr
       dotlambda
     ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/safety/disable-telemetry.patch b/pkgs/development/python-modules/safety/disable-telemetry.patch
index 986962b20071..c42c4789f7cf 100644
--- a/pkgs/development/python-modules/safety/disable-telemetry.patch
+++ b/pkgs/development/python-modules/safety/disable-telemetry.patch
@@ -1,8 +1,8 @@
 diff --git a/safety/cli.py b/safety/cli.py
-index 4d1f0c5..db4d930 100644
+index 14ec46a..3297928 100644
 --- a/safety/cli.py
 +++ b/safety/cli.py
-@@ -228,7 +228,7 @@ def configure_logger(ctx, param, debug):
+@@ -170,7 +170,7 @@ def configure_logger(ctx, param, debug):
  @proxy_options
  @click.option(
      "--disable-optional-telemetry",
@@ -12,41 +12,81 @@ index 4d1f0c5..db4d930 100644
      show_default=True,
      help=CLI_DISABLE_OPTIONAL_TELEMETRY_DATA_HELP,
 diff --git a/safety/safety.py b/safety/safety.py
-index e41f5ae..7d29a50 100644
+index a86c167..ad7fc94 100644
 --- a/safety/safety.py
 +++ b/safety/safety.py
-@@ -143,7 +143,7 @@ def fetch_database_url(
+@@ -228,7 +228,7 @@ def fetch_database_url(
      mirror: str,
      db_name: str,
      cached: int,
 -    telemetry: bool = True,
 +    telemetry: bool = False,
      ecosystem: Ecosystem = Ecosystem.PYTHON,
-     from_cache: bool = True
+     from_cache: bool = True,
+     is_open_mirror: bool = False,
+@@ -368,7 +368,7 @@ def fetch_database(
+     full: bool = False,
+     db: Union[Optional[str], bool] = False,
+     cached: int = 0,
+-    telemetry: bool = True,
++    telemetry: bool = False,
+     ecosystem: Optional[Ecosystem] = None,
+     from_cache: bool = True,
  ) -> Dict[str, Any]:
+@@ -696,7 +696,7 @@ def check(
+     proxy: Optional[Dict[str, Any]] = None,
+     include_ignored: bool = False,
+     is_env_scan: bool = True,
+-    telemetry: bool = True,
++    telemetry: bool = False,
+     params: Optional[Dict[str, Any]] = None,
+     project: Optional[str] = None,
+ ) -> tuple:
+@@ -1686,7 +1686,7 @@ def get_licenses(
+     auth: "Auth",
+     db_mirror: Union[Optional[str], bool] = False,
+     cached: int = 0,
+-    telemetry: bool = True,
++    telemetry: bool = False,
+ ) -> Dict[str, Any]:
+     """
+     Retrieves the licenses from the database.
+@@ -1785,7 +1785,7 @@ def add_local_notifications(
+ 
+ 
+ def get_announcements(
+-    auth: "Auth", telemetry: bool = True, with_telemetry: Any = None
++    auth: "Auth", telemetry: bool = False, with_telemetry: Any = None
+ ) -> List[Dict[str, str]]:
+     """
+     Retrieves announcements from the server.
 diff --git a/safety/scan/finder/handlers.py b/safety/scan/finder/handlers.py
-index 80a3db6..61a10cc 100644
+index 5f8e734..1f55f73 100644
 --- a/safety/scan/finder/handlers.py
 +++ b/safety/scan/finder/handlers.py
-@@ -91,11 +91,11 @@ class PythonFileHandler(FileHandler):
- 
-         # Fetch both the full and partial Safety databases
-         fetch_database(session=session, full=False, db=db, cached=True,
--                       telemetry=True, ecosystem=Ecosystem.PYTHON,
-+                       telemetry=False, ecosystem=Ecosystem.PYTHON,
-                        from_cache=False)
- 
-         fetch_database(session=session, full=True, db=db, cached=True,
--                                telemetry=True, ecosystem=Ecosystem.PYTHON,
-+                                telemetry=False, ecosystem=Ecosystem.PYTHON,
-                                 from_cache=False)
- 
- 
+@@ -102,7 +102,7 @@ class PythonFileHandler(FileHandler):
+             full=False,
+             db=db,
+             cached=True,
+-            telemetry=True,
++            telemetry=False,
+             ecosystem=Ecosystem.PYTHON,
+             from_cache=False,
+         )
+@@ -112,7 +112,7 @@ class PythonFileHandler(FileHandler):
+             full=True,
+             db=db,
+             cached=True,
+-            telemetry=True,
++            telemetry=False,
+             ecosystem=Ecosystem.PYTHON,
+             from_cache=False,
+         )
 diff --git a/safety/util.py b/safety/util.py
-index 2a02236..5feef8d 100644
+index 89ad11d..ba9983d 100644
 --- a/safety/util.py
 +++ b/safety/util.py
-@@ -351,7 +351,7 @@ def filter_announcements(
+@@ -319,7 +319,7 @@ def filter_announcements(
  
  
  def build_telemetry_data(
diff --git a/pkgs/development/python-modules/securesystemslib/default.nix b/pkgs/development/python-modules/securesystemslib/default.nix
index 8d4b76915755..6991bc3b5dfb 100644
--- a/pkgs/development/python-modules/securesystemslib/default.nix
+++ b/pkgs/development/python-modules/securesystemslib/default.nix
@@ -30,19 +30,19 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "securesystemslib";
-  version = "1.3.1";
+  version = "1.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "secure-systems-lab";
     repo = "securesystemslib";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ERFRLNHD3OhbMEGBEnDLkRYGv4f+bYg9MStS5IarcPA=";
+    hash = "sha256-XOE690DKeAMP2KycW+fdYs/KGWqwZCZz/9PiAa6tJbw=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail '"hatchling==1.27.0"' '"hatchling"'
+      --replace-fail '"hatchling==1.29.0"' '"hatchling"'
   '';
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/socid-extractor/default.nix b/pkgs/development/python-modules/socid-extractor/default.nix
index 9a2c740ec7b9..55ff357ffd52 100644
--- a/pkgs/development/python-modules/socid-extractor/default.nix
+++ b/pkgs/development/python-modules/socid-extractor/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "socid-extractor";
-  version = "0.0.28";
+  version = "0.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "soxoj";
     repo = "socid-extractor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eLdJw2teMG/DlG8F8p3nm+L2+iY1zD2QbNHjWAyjtPY=";
+    hash = "sha256-ZYLoHFyRnSHP3Od/cMOx690KFbJoEYK3cICjzbSfLm0=";
   };
 
   pythonRelaxDeps = [ "beautifulsoup4" ];
diff --git a/pkgs/development/python-modules/tensorboard/default.nix b/pkgs/development/python-modules/tensorboard/default.nix
index 106a5753fc98..d96daa9ed04e 100644
--- a/pkgs/development/python-modules/tensorboard/default.nix
+++ b/pkgs/development/python-modules/tensorboard/default.nix
@@ -78,5 +78,6 @@ buildPythonPackage rec {
     license = lib.licenses.asl20;
     mainProgram = "tensorboard";
     maintainers = [ ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
 }
diff --git a/pkgs/development/python-modules/tinygrad/default.nix b/pkgs/development/python-modules/tinygrad/default.nix
index e5d5a5a870f0..910f54ac14c1 100644
--- a/pkgs/development/python-modules/tinygrad/default.nix
+++ b/pkgs/development/python-modules/tinygrad/default.nix
@@ -308,6 +308,15 @@ buildPythonPackage (finalAttrs: {
     gpuCheck = tinygrad.overridePythonAttrs (old: {
       requiredSystemFeatures = [ "cuda" ];
 
+      disabledTests = (old.disabledTests or [ ]) ++ [
+        # Require internet access
+        "TestWhisper"
+        "test_hevc_decode"
+
+        # AssertionError: Not equal to tolerance
+        "test_svd_general"
+      ];
+
       pytestFlags = (old.pytestFlags or [ ]) ++ [
         # When running in parallel, with GPU support, some tests become flaky:
         # RuntimeError: Wait timeout: 30000 ms! (the signal is not set to 153, but 151)
diff --git a/pkgs/development/python-modules/ufo2ft/default.nix b/pkgs/development/python-modules/ufo2ft/default.nix
index 1075c7afc980..4500b59da5e3 100644
--- a/pkgs/development/python-modules/ufo2ft/default.nix
+++ b/pkgs/development/python-modules/ufo2ft/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "ufo2ft";
-  version = "3.7.0";
+  version = "3.7.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googlefonts";
     repo = "ufo2ft";
     tag = "v${version}";
-    hash = "sha256-PHd4l3kbWdJmtZMF9gKbz5DtdaaO3C/Rldw3pdMJJC0=";
+    hash = "sha256-g8nPtIGUiUVV0exddKGBRbLhO/XW+5bBNlYXRDlkIZM=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/wapiti-arsenic/default.nix b/pkgs/development/python-modules/wapiti-arsenic/default.nix
index bf4f4f92bcc8..c978b12a01ed 100644
--- a/pkgs/development/python-modules/wapiti-arsenic/default.nix
+++ b/pkgs/development/python-modules/wapiti-arsenic/default.nix
@@ -11,17 +11,19 @@
   packaging,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "wapiti-arsenic";
   version = "28.5";
   pyproject = true;
 
   src = fetchPypi {
     pname = "wapiti_arsenic";
-    inherit version;
+    inherit (finalAttrs) version;
     hash = "sha256-snIKEdrBOIfPeHkVLv0X5lsBzDbOtDrbOj4m8UNCj60=";
   };
 
+  pythonRelaxDeps = [ "packaging" ];
+
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail "poetry>=2.1.3" "poetry-core" \
@@ -43,8 +45,8 @@ buildPythonPackage rec {
   meta = {
     description = "Asynchronous WebDriver client";
     homepage = "https://github.com/wapiti-scanner/arsenic";
-    changelog = "https://github.com/wapiti-scanner/arsenic/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/wapiti-scanner/arsenic/blob/${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ GaetanLepage ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/webdriver-manager/default.nix b/pkgs/development/python-modules/webdriver-manager/default.nix
index 284c31e74c26..1c02bd404cc0 100644
--- a/pkgs/development/python-modules/webdriver-manager/default.nix
+++ b/pkgs/development/python-modules/webdriver-manager/default.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   packaging,
   pybrowsers,
+  pytest-cov-stub,
   pytestCheckHook,
   python-dotenv,
   requests,
@@ -11,16 +12,16 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "webdriver-manager";
-  version = "4.0.2";
+  version = "4.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "SergeyPirogov";
     repo = "webdriver_manager";
-    tag = "v${version}";
-    hash = "sha256-ZmrQa/2vPwYgSvY3ZUvilg4RizVXpu5hvJJBQVXkK8E=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-MqLM1mSfoirBaJYKkikNuS2XPWPTM2MQNgEwhtp+2ek=";
   };
 
   __darwinAllowLocalNetworking = true;
@@ -35,6 +36,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pybrowsers
+    pytest-cov-stub
     pytestCheckHook
     selenium
   ];
@@ -62,9 +64,9 @@ buildPythonPackage rec {
   meta = {
     description = "Module to manage the binary drivers for different browsers";
     homepage = "https://github.com/SergeyPirogov/webdriver_manager/";
-    changelog = "https://github.com/SergeyPirogov/webdriver_manager/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/SergeyPirogov/webdriver_manager/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
     platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/development/python-modules/wsgidav/default.nix b/pkgs/development/python-modules/wsgidav/default.nix
index ecbfd926e816..0880c9ed4013 100644
--- a/pkgs/development/python-modules/wsgidav/default.nix
+++ b/pkgs/development/python-modules/wsgidav/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  bcrypt,
   buildPythonPackage,
   cheroot,
   defusedxml,
@@ -7,6 +8,7 @@
   jinja2,
   json5,
   lxml,
+  passlib,
   pytestCheckHook,
   python-pam,
   pyyaml,
@@ -15,28 +17,32 @@
   webtest,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "wsgidav";
-  version = "4.3.3";
+  version = "4.3.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mar10";
     repo = "wsgidav";
-    tag = "v${version}";
-    hash = "sha256-vUqNC7ixpta0s7wRC5ROSKMa/MsgEBu5rr0XNu69FRw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-2Pn5kMioMr4COpcIDEhlfolG0/5hpv8zMO0X7l6fSwY=";
   };
 
+  pythonRelaxDeps = [ "bcrypt" ];
+
   __darwinAllowLocalNetworking = true;
 
   build-system = [ setuptools ];
 
   dependencies = [
+    bcrypt
     defusedxml
     jinja2
     json5
     cheroot
     lxml
+    passlib
     pyyaml
   ];
 
@@ -55,9 +61,9 @@ buildPythonPackage rec {
   meta = {
     description = "Generic and extendable WebDAV server based on WSGI";
     homepage = "https://wsgidav.readthedocs.io/";
-    changelog = "https://github.com/mar10/wsgidav/blob/v${version}/CHANGELOG.md";
-    license = with lib.licenses; [ mit ];
+    changelog = "https://github.com/mar10/wsgidav/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "wsgidav";
   };
-}
+})
diff --git a/pkgs/development/rocq-modules/rocq-elpi/default.nix b/pkgs/development/rocq-modules/rocq-elpi/default.nix
index faf9b75462e8..16391b5ee9d2 100644
--- a/pkgs/development/rocq-modules/rocq-elpi/default.nix
+++ b/pkgs/development/rocq-modules/rocq-elpi/default.nix
@@ -17,7 +17,7 @@ let
       in
       with lib.versions;
       lib.switch rocq-core.rocq-version [
-        (case (range "9.0" "9.2") "3.6.2")
+        (case (range "9.0" "9.2") "3.7.1")
         (case (range "9.0" "9.1") "3.4.5")
         (case (range "9.0" "9.1") "2.0.7")
       ] rocq-core.ocamlPackages.elpi.version;
@@ -37,11 +37,12 @@ let
       in
       with lib.versions;
       lib.switch rocq-core.rocq-version [
-        (case (range "9.0" "9.2") "3.3.0")
+        (case (range "9.0" "9.2") "3.4.0")
         (case (range "9.0" "9.1") "3.2.0")
         (case (range "9.0" "9.1") "2.6.0")
         (case "9.0" "2.5.2")
       ] null;
+    release."3.4.0".sha256 = "sha256-8x2Sa/+pUpXEqB+NdyfOyw6Yyzp6Q1k5LnhrjG/qJNM=";
     release."3.3.0".sha256 = "sha256-wcsUpw7S+H9CaXuz+W3g22IFWO2cLllJ4xm2qLTG0nM=";
     release."3.2.0".sha256 = "sha256-FyYG/8lEyt1L/paMez8jYAnnUE+sxIp4Da5MztmwJ/c=";
     release."3.1.0".sha256 = "sha256-ytGPGwJv+jmRT6uN0sg6q+xh8ND0PMIZ9ULB0Uwca1w=";
diff --git a/pkgs/development/tools/ocaml/camlp5/default.nix b/pkgs/development/tools/ocaml/camlp5/default.nix
index 72cdbe9d8e10..4a8cd807a53f 100644
--- a/pkgs/development/tools/ocaml/camlp5/default.nix
+++ b/pkgs/development/tools/ocaml/camlp5/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation (
   in
   {
 
-    version = if lib.versionAtLeast ocaml.version "4.12" && !legacy then "8.05.00" else "7.14";
+    version = if lib.versionAtLeast ocaml.version "4.12" && !legacy then "8.05.01" else "7.14";
 
     pname = "ocaml${ocaml.version}-camlp5";
 
@@ -35,7 +35,7 @@ stdenv.mkDerivation (
           "rel${builtins.replaceStrings [ "." ] [ "" ] finalAttrs.version}";
       hash =
         {
-          "8.05.00" = "sha256-Y7d72gAxtyAQOIvLGua6Pib+FCoeMlbRYa9vzc+9hRo=";
+          "8.05.01" = "sha256-ym1cZIoAIwMnkGiygZf+TZxjhyO6WHYItWRXobdcKm0=";
           "8.03.2" = "sha256-nz+VfGR/6FdBvMzPPpVpviAXXBWNqM3Ora96Yzx964o=";
           "7.14" = "sha256-/ORtS0uc/GN+g3y6N5ftjL4OBSqV6iswLRbfpeNCprU=";
         }
@@ -80,8 +80,7 @@ stdenv.mkDerivation (
     dontStrip = true;
 
     meta = {
-      broken =
-        lib.versionAtLeast ocaml.version "5.04" && !lib.versionAtLeast finalAttrs.version "8.05.00";
+      broken = lib.versionAtLeast ocaml.version "5.4" && !lib.versionAtLeast finalAttrs.version "8.04.00";
       description = "Preprocessor-pretty-printer for OCaml";
       longDescription = ''
         Camlp5 is a preprocessor and pretty-printer for OCaml programs.
diff --git a/pkgs/kde/lib/mk-kde-derivation.nix b/pkgs/kde/lib/mk-kde-derivation.nix
index 8408a31f2633..a43a4548a391 100644
--- a/pkgs/kde/lib/mk-kde-derivation.nix
+++ b/pkgs/kde/lib/mk-kde-derivation.nix
@@ -189,6 +189,7 @@ let
   meta = {
     description = projectInfo.${pname}.description;
     homepage = "https://invent.kde.org/${projectInfo.${pname}.repo_path}";
+    donationPage = "https://kde.org/donate/";
     license = lib.filter (l: l != null) (map (l: licensesBySpdxId.${l}) licenseInfo.${pname});
     teams = [ lib.teams.qt-kde ];
     # Platforms are currently limited to what upstream tests in CI, but can be extended if there's interest.
diff --git a/pkgs/os-specific/linux/xp-pen-drivers/deco-01-v2/default.nix b/pkgs/os-specific/linux/xp-pen-drivers/deco-01-v2/default.nix
deleted file mode 100644
index 05c4bfee3ce4..000000000000
--- a/pkgs/os-specific/linux/xp-pen-drivers/deco-01-v2/default.nix
+++ /dev/null
@@ -1,82 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchzip,
-  libusb1,
-  glibc,
-  libGL,
-  makeWrapper,
-  qtx11extras,
-  wrapQtAppsHook,
-  autoPatchelfHook,
-  libx11,
-  libxtst,
-  libxi,
-  libxrandr,
-  libxinerama,
-}:
-
-let
-  dataDir = "var/lib/xppend1v2";
-in
-stdenv.mkDerivation rec {
-  pname = "xp-pen-deco-01-v2-driver";
-  version = "3.4.9-231023";
-
-  src = fetchzip {
-    url = "https://www.xp-pen.com/download/file/id/1936/pid/440/ext/gz.html#.tar.gz";
-    name = "xp-pen-deco-01-v2-driver-${version}.tar.gz";
-    sha256 = "sha256-A/dv6DpelH0NHjlGj32tKv37S+9q3F8cYByiYlMuqLg=";
-  };
-
-  nativeBuildInputs = [
-    wrapQtAppsHook
-    autoPatchelfHook
-    makeWrapper
-  ];
-
-  dontBuild = true;
-
-  dontWrapQtApps = true; # this is done manually
-
-  buildInputs = [
-    libusb1
-    libx11
-    libxtst
-    libxi
-    libxrandr
-    libxinerama
-    glibc
-    libGL
-    (lib.getLib stdenv.cc.cc)
-    qtx11extras
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/{opt,bin}
-    cp -r App/usr/lib/pentablet/{PenTablet,resource.rcc,conf} $out/opt
-    chmod +x $out/opt/PenTablet
-    cp -r App/lib $out/lib
-    sed -i 's#usr/lib/pentablet#${dataDir}#g' $out/opt/PenTablet
-
-    runHook postInstall
-  '';
-
-  postFixup = ''
-    makeWrapper $out/opt/PenTablet $out/bin/xp-pen-deco-01-v2-driver \
-      "''${qtWrapperArgs[@]}" \
-      --run 'if [ "$EUID" -ne 0 ]; then echo "Please run as root."; exit 1; fi' \
-      --run 'if [ ! -d /${dataDir} ]; then mkdir -p /${dataDir}; cp -r '$out'/opt/conf /${dataDir}; chmod u+w -R /${dataDir}; fi'
-  '';
-
-  meta = {
-    homepage = "https://www.xp-pen.com/product/461.html";
-    description = "Drivers for the XP-PEN Deco 01 v2 drawing tablet";
-    platforms = [ "x86_64-linux" ];
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    maintainers = with lib.maintainers; [ virchau13 ];
-    license = lib.licenses.unfree;
-  };
-}
diff --git a/pkgs/servers/home-assistant/custom-components/smartthinq-sensors/package.nix b/pkgs/servers/home-assistant/custom-components/smartthinq-sensors/package.nix
index d1f17bfde7b1..1d11535ba014 100644
--- a/pkgs/servers/home-assistant/custom-components/smartthinq-sensors/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/smartthinq-sensors/package.nix
@@ -10,13 +10,13 @@
 buildHomeAssistantComponent rec {
   owner = "ollo69";
   domain = "smartthinq_sensors";
-  version = "0.42.2";
+  version = "0.43.0";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "ha-smartthinq-sensors";
     rev = "v${version}";
-    hash = "sha256-y8MGGTcOrr4IZUefBgq7wVG3H5UFAB7L2FkwoVsygb0=";
+    hash = "sha256-QD7p6yldjqgcZTRjztuLsHTBh+PDOQjLq5BGjw5yg8o=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix
index eec1582486f6..685d20120d07 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "material-you-utilities";
-  version = "2.1.11";
+  version = "2.1.12";
 
   src = fetchFromGitHub {
     owner = "Nerwyn";
     repo = "material-you-utilities";
     tag = version;
-    hash = "sha256-nT6UAoa3VBBxanxl6c0ree0RKgG4ozY58fSofVxgZYw=";
+    hash = "sha256-ieeWn2o2lTPe15HqWi6wKe7rqNXl4oIjp09ucIGIxvg=";
   };
 
-  npmDepsHash = "sha256-HdPqj1E8NtB7oeomPtDkbnHHYuSNKG/SvvZ8g2l0Fms=";
+  npmDepsHash = "sha256-ERIQgNWjIayz2Gh74Ha2NUv3TyK5TcLV2YrPexf52Hk=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/servers/samba/4.x-fix-makeflags-parsing.patch b/pkgs/servers/samba/4.x-fix-makeflags-parsing.patch
deleted file mode 100644
index 7c973e5bd26a..000000000000
--- a/pkgs/servers/samba/4.x-fix-makeflags-parsing.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/buildtools/wafsamba/samba_utils.py	2019-04-08 01:13:47.525306574 +0000
-+++ b/buildtools/wafsamba/samba_utils.py	2019-04-08 01:14:34.805245676 +0000
-@@ -495,7 +495,7 @@
-                 Logs.zones = ['runner']
-             if Logs.verbose > 2:
-                 Logs.zones = ['*']
--        elif opt[0].isupper() and opt.find('=') != -1:
-+        elif opt[0] and opt.find('=') != -1:
-             # this allows us to set waf options on the make command line
-             # for example, if you do "make FOO=blah", then we set the
-             # option 'FOO' in Options.options, to blah. If you look in wafsamba/wscript
diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix
index 69df70b61d3e..22f9cbf3aba3 100644
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -81,11 +81,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "samba";
-  version = "4.23.5";
+  version = "4.23.8";
 
   src = fetchurl {
     url = "https://download.samba.org/pub/samba/stable/samba-${finalAttrs.version}.tar.gz";
-    hash = "sha256-WTpD3dDVeQIjffp2iI97Ast/x3RxETacsx4SbbSDa58=";
+    hash = "sha256-l2EphHRW3Ft4wA+P+3ncYFxJ1qrKiyqncv0i27afrgE=";
   };
 
   outputs = [
@@ -97,7 +97,6 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [
     ./4.x-no-persistent-install.patch
     ./4.x-no-persistent-install-dynconfig.patch
-    ./4.x-fix-makeflags-parsing.patch
     ./4.x-fix-systemd-detection.patch
     (fetchpatch {
       # workaround for https://bugzilla.samba.org/show_bug.cgi?id=14164
diff --git a/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix b/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix
index dd6d1df37bd0..5e63f821f438 100644
--- a/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix
+++ b/pkgs/servers/sql/postgresql/ext/plpgsql_check.nix
@@ -8,13 +8,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "plpgsql-check";
-  version = "2.8.11";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     owner = "okbob";
     repo = "plpgsql_check";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qeCC/rmd+qhAlpq7y5UhqDkFVGsDbBUAFWPizciPVaI=";
+    hash = "sha256-Layx2Z7ziH7Cep1G1JCK9VQoMq7+T/crnaT6O3ucLF4=";
   };
 
   passthru.tests.extension = postgresqlTestExtension {
diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index 62b2abdf5b2f..ac5ff3c0a6f1 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -329,6 +329,7 @@ let
         (listOf str)
         str
       ];
+      donationPage = str;
       downloadPage = str;
       changelog = union [
         (listOf str)
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index a95af0af73f8..aadc6a1d69f3 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -2613,6 +2613,8 @@ mapAliases {
   xorgserver = xorg-server; # Added 2026-02-04
   xorgsgmldoctools = xorg-sgml-doctools; # Added 2026-01-19
   xow_dongle-firmware = throw "'xow_dongle-firmware' has been renamed to/replaced by 'xone-dongle-firmware'"; # Added 2025-12-30
+  xp-pen-deco-01-v2-driver = warnAlias "'xp-pen-deco-01-v2-driver' has been replaced by 'xppen_4'. Consider using it with 'programs.xppen' module." xppen_4; # Added 2026-02-02
+  xp-pen-g430-driver = warnAlias "'xp-pen-g430-driver' has been replaced by 'xppen_3'. Consider using it with 'programs.xppen' module." xppen_3; # Added 2026-02-02
   xsw = throw "'xsw' has been removed due to lack of upstream maintenance"; # Added 2025-08-22
   xsynth-dssi = throw "'xsynth-dssi' was removed due to lack of upstream maintenance and relying on gtk2"; # Added 2025-12-02
   xtrap = throw "XTrap was a proposed X11 extension that hasn't been in Xorg since X11R6 in 1994, it is deprecated and archived upstream."; # added 2025-12-13
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 35fa7850baac..af50d8cea080 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11899,8 +11899,6 @@ with pkgs;
 
   openbsd = callPackage ../os-specific/bsd/openbsd { };
 
-  xp-pen-deco-01-v2-driver = libsForQt5.xp-pen-deco-01-v2-driver;
-
   radicle-node-unstable = callPackage ../by-name/ra/radicle-node/unstable.nix { };
 
   olivetin-3k = callPackage ../by-name/ol/olivetin/3k.nix { };
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 9e4950454a7e..c9c9f327a0f7 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -2093,9 +2093,7 @@ let
           inherit (pkgs) git;
         };
 
-        tar-eio = callPackage ../development/ocaml-modules/tar/eio.nix {
-          inherit (pkgs) git;
-        };
+        tar-eio = callPackage ../development/ocaml-modules/tar/eio.nix { };
 
         tcpip = callPackage ../development/ocaml-modules/tcpip { };
 
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index d14e1102c16f..78b55a3f2817 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -17146,12 +17146,12 @@ with self;
     };
   };
 
-  Imager = buildPerlPackage {
+  Imager = buildPerlPackage rec {
     pname = "Imager";
-    version = "1.025";
+    version = "1.031";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/T/TO/TONYC/Imager-1.025.tar.gz";
-      hash = "sha256-TwJ1y7HgEdfz/sYE3GtgwaxvAt78KYs9A31ur3vqcFg=";
+      url = "mirror://cpan/authors/id/T/TO/TONYC/Imager-${version}.tar.gz";
+      hash = "sha256-kL59G9/F7bfxfPgreeamYUxbAuv+Mm67b2afzaeRNAE=";
     };
     buildInputs = [
       pkgs.freetype
@@ -17168,6 +17168,7 @@ with self;
       "${pkgs.libpng.out}/lib"
     ];
     meta = {
+      changelog = "https://metacpan.org/release/TONYC/Imager-${version}/source/Changes";
       description = "Perl extension for Generating 24 bit Images";
       homepage = "http://imager.perl.org";
       license = with lib.licenses; [
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 4ed1ce5b08d2..a18a31464372 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7299,6 +7299,8 @@ self: super: with self; {
 
   httpcore = callPackage ../development/python-modules/httpcore { };
 
+  httpcore2 = callPackage ../development/python-modules/httpcore2 { };
+
   httpie = callPackage ../development/python-modules/httpie { };
 
   httpie-ntlm = callPackage ../development/python-modules/httpie-ntlm { };
@@ -7333,6 +7335,8 @@ self: super: with self; {
 
   httpx-ws = callPackage ../development/python-modules/httpx-ws { };
 
+  httpx2 = callPackage ../development/python-modules/httpx2 { };
+
   huawei-lte-api = callPackage ../development/python-modules/huawei-lte-api { };
 
   hueble = callPackage ../development/python-modules/hueble { };
diff --git a/pkgs/top-level/qt5-packages.nix b/pkgs/top-level/qt5-packages.nix
index 351bae3541fa..2432f157d63c 100644
--- a/pkgs/top-level/qt5-packages.nix
+++ b/pkgs/top-level/qt5-packages.nix
@@ -192,8 +192,6 @@ makeScopeWithSplicing' {
         signond = callPackage ../development/libraries/signond { };
 
         timed = callPackage ../applications/system/timed { };
-
-        xp-pen-deco-01-v2-driver = callPackage ../os-specific/linux/xp-pen-drivers/deco-01-v2 { };
       }
       // lib.optionalAttrs config.allowAliases {
         futuresql = throw "libsForQt5.futuresql has been removed"; # Added 2026-05-01