diff --git a/ci/eval/default.nix b/ci/eval/default.nix
index 547fcf1f26be..8feaf5cf77aa 100644
--- a/ci/eval/default.nix
+++ b/ci/eval/default.nix
@@ -100,6 +100,7 @@ let
         myChunk=$2
         system=$3
         outputDir=$4
+        preEvalFile=$5
 
         # Default is 5, higher values effectively disable the warning.
         # This randomly breaks Eval.
@@ -121,12 +122,12 @@ let
           --show-trace \
           --arg chunkSize "$chunkSize" \
           --arg myChunk "$myChunk" \
-          --arg preEvalFile "${preEvalFile}" \
+          --arg preEvalFile "$preEvalFile" \
           --arg systems "[ \"$system\" ]" \
           --arg includeBroken ${lib.boolToString includeBroken} \
           --argstr extraNixpkgsConfigJson ${lib.escapeShellArg (builtins.toJSON extraNixpkgsConfig)} \
           -I ${nixpkgs} \
-          -I ${preEvalFile} \
+          -I "$preEvalFile" \
           > "$outputDir/result/$myChunk" \
           2> "$outputDir/stderr/$myChunk"
         exitCode=$?
@@ -164,12 +165,6 @@ let
         echo "System: $evalSystem"
         cores=$NIX_BUILD_CORES
         echo "Cores: $cores"
-        attrCount=$(jq '.paths | length' "${preEvalFile}")
-        echo "Attribute count: $attrCount"
-        echo "Chunk size: $chunkSize"
-        # Same as `attrCount / chunkSize` but rounded up
-        chunkCount=$(( (attrCount - 1) / chunkSize + 1 ))
-        echo "Chunk count: $chunkCount"
 
         mkdir -p $out/${evalSystem}
 
@@ -190,29 +185,61 @@ let
           done
         ) &
 
-        seq_end=$(( chunkCount - 1 ))
+        chunkedEval() {
+          local chunkOutputDir=$1
+          local preEvalFile=$2
 
-        ${lib.optionalString quickTest ''
-          seq_end=0
-        ''}
+          local attrCount=$(jq '.paths | length' "$preEvalFile")
+          echo "Attribute count: $attrCount"
+          echo "Chunk size: $chunkSize"
+          # Same as `attrCount / chunkSize` but rounded up
+          local chunkCount=$(( (attrCount - 1) / chunkSize + 1 ))
+          echo "Chunk count: $chunkCount"
 
-        chunkOutputDir=$(mktemp -d)
-        mkdir "$chunkOutputDir"/{result,stats,timestats,stderr}
+          local seq_end=$(( chunkCount - 1 ))
+          ${lib.optionalString quickTest ''
+            seq_end=0
+          ''}
 
-        seq -w 0 "$seq_end" |
-          command time -f "%e" -o "$out/${evalSystem}/total-time" \
-          xargs -I{} -P"$cores" \
-          ${singleChunk} "$chunkSize" {} "$evalSystem" "$chunkOutputDir"
+          mkdir -p "$chunkOutputDir"/{result,stats,timestats,stderr}
 
-        cp -r "$chunkOutputDir"/stats $out/${evalSystem}/stats-by-chunk
+          seq -w 0 "$seq_end" |
+            xargs -I{} -P"$cores" \
+            ${singleChunk} "$chunkSize" {} "$evalSystem" "$chunkOutputDir" "$preEvalFile"
 
-        if (( chunkSize * chunkCount != attrCount )); then
-          # A final incomplete chunk would mess up the stats, don't include it
-          rm "$chunkOutputDir"/stats/"$seq_end"
-        fi
+          if (( chunkSize * chunkCount != attrCount )); then
+            # A final incomplete chunk would mess up the stats, don't include it
+            rm "$chunkOutputDir"/stats/"$seq_end"
+          fi
+        }
 
-        cat "$chunkOutputDir"/result/* | jq -s 'add | map_values(.outputs)' > $out/${evalSystem}/paths.json
-        cat "$chunkOutputDir"/result/* | jq -s 'add | map_values(.meta)' > $out/${evalSystem}/meta.json
+        chunkOutputDirs=$(mktemp -d)
+
+        # Preparation for the second eval
+        disallowedAttributesPreEvalFile=$(mktemp)
+        jq '{
+          paths: (.attrPathsDisallowedForInternalUse | map(.attrPath)),
+          attrPathsDisallowedForInternalUse: []
+        }' ${preEvalFile} > "$disallowedAttributesPreEvalFile"
+
+        startEpoch=$(date +%s)
+
+        # The first eval evaluates only attributes that are not disallowed for internal Nixpkgs use, ensuring that they don't depend on disallowed attributes
+        # Because the first eval doesn't evaluate the disallowed attributes themselves, but we still want to check that they don't fail evaluation, we evaluate them separately in a second eval
+        # The reason we need two evals is because we want disallowed attributes to be able to depend on other disallowed attributes, which inherently needs a separate Nixpkgs instantiation
+        # And while we could interleave that instantiation into a single eval, that would ~double memory usage for all chunks, while doing it separately doesn't
+        echo "Evaluating the internally allowed attributes"
+        chunkedEval "$chunkOutputDirs"/allowed ${preEvalFile}
+        echo "Evaluating the internally disallowed attributes"
+        chunkedEval "$chunkOutputDirs"/disallowed "$disallowedAttributesPreEvalFile"
+
+        echo $(( $(date +%s) - startEpoch )) > "$out/${evalSystem}/total-time"
+
+        # We only use the stats from the allowed attrs eval, because the disallowed attrs are generally not even a full chunk
+        cp -r "$chunkOutputDirs"/allowed/stats $out/${evalSystem}/stats-by-chunk
+
+        cat "$chunkOutputDirs"/*/result/* | jq -s 'add | map_values(.outputs)' > $out/${evalSystem}/paths.json
+        cat "$chunkOutputDirs"/*/result/* | jq -s 'add | map_values(.meta)' > $out/${evalSystem}/meta.json
       '';
 
   diff = callPackage ./diff.nix { };
diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 957037b95f4f..809f397407a7 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -204,25 +204,9 @@ following are specific to `buildPythonPackage`:
 * `setupPyGlobalFlags ? []`: List of flags passed to `setup.py` command.
 * `setupPyBuildFlags ? []`: List of flags passed to `setup.py build_ext` command.
 
-##### Using fixed-point arguments {#buildpythonpackage-fixed-point-arguments}
+##### Writing override-compatible packages {#buildpythonpackage-fixed-point-arguments}
 
-Both `buildPythonPackage` and `buildPythonApplication` support [fixed-point arguments](#chap-build-helpers-finalAttrs), similar to `stdenv.mkDerivation`.
-This allows you to reference the final attributes of the derivation.
-
-Instead of using `rec`:
-
-```nix
-buildPythonPackage rec {
-  pname = "pyspread";
-  version = "2.4";
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-...";
-  };
-}
-```
-
-You can use the `finalAttrs` pattern:
+Use `finalAttrs` to make a package easy to update and override:
 
 ```nix
 buildPythonPackage (finalAttrs: {
@@ -236,7 +220,9 @@ buildPythonPackage (finalAttrs: {
 })
 ```
 
-See the [general documentation on fixed-point arguments](#chap-build-helpers-finalAttrs) for more details on the benefits of this pattern.
+When a downstream callsite *overrides* `version` the override becomes visible as `finalAttrs.version`.
+
+Both `buildPythonPackage` and `buildPythonApplication` support [fixed-point arguments](#chap-build-helpers-finalAttrs), similar to `stdenv.mkDerivation`.
 
 ::: {.note}
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 6cb590d3a614..14f2417297a4 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -25297,6 +25297,13 @@
     githubId = 35622998;
     name = "Suwon Park";
   };
+  sepointon = {
+    email = "sampointon@gmail.com";
+    github = "sepointon";
+    githubId = 209542026;
+    matrix = "sampointon:matrix.org";
+    name = "Sam Pointon";
+  };
   seppeljordan = {
     email = "sebastian.jordan.mail@googlemail.com";
     github = "seppeljordan";
diff --git a/nixos/modules/services/misc/paperless.nix b/nixos/modules/services/misc/paperless.nix
index 9df4e99ff9a5..f7ca6c2717bc 100644
--- a/nixos/modules/services/misc/paperless.nix
+++ b/nixos/modules/services/misc/paperless.nix
@@ -621,7 +621,7 @@ in
             PrivateNetwork = false;
           };
           environment = env // {
-            PYTHONPATH = "${cfg.package.python.pkgs.makePythonPath cfg.package.propagatedBuildInputs}:${cfg.package}/lib/paperless-ngx/src";
+            PYTHONPATH = "${cfg.package.python.pkgs.makePythonPath cfg.package.passthru.dependencies}:${cfg.package}/lib/paperless-ngx/src";
           };
           # Allow the web interface to access the private /tmp directory of the server.
           # This is required to support uploading files via the web interface.
diff --git a/nixos/modules/services/networking/tinc.nix b/nixos/modules/services/networking/tinc.nix
index e082214b5eca..22398f2ff5b0 100644
--- a/nixos/modules/services/networking/tinc.nix
+++ b/nixos/modules/services/networking/tinc.nix
@@ -421,10 +421,7 @@ in
               ExecStart = "${data.package}/bin/tincd -D -U tinc-${network} -n ${network} ${optionalString (data.chroot) "-R"} --pidfile /run/tinc.${network}.pid -d ${toString data.debugLevel}";
             };
             preStart = ''
-              mkdir -p /etc/tinc/${network}/hosts
-              chown tinc-${network} /etc/tinc/${network}/hosts
-              mkdir -p /etc/tinc/${network}/invitations
-              chown tinc-${network} /etc/tinc/${network}/invitations
+              install -d -o tinc-${network} /etc/tinc/${network} /etc/tinc/${network}/hosts /etc/tinc/${network}/invitations
 
               # Determine how we should generate our keys
               if type tinc >/dev/null 2>&1; then
diff --git a/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix b/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix
index b17bc1d76708..51f89e1e87c3 100644
--- a/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/vadimcn.vscode-lldb/default.nix
@@ -16,7 +16,7 @@ assert lib.versionAtLeast python3.version "3.5";
 let
   publisher = "vadimcn";
   pname = "vscode-lldb";
-  version = "1.12.1";
+  version = "1.12.2";
 
   vscodeExtUniqueId = "${publisher}.${pname}";
   vscodeExtPublisher = publisher;
@@ -26,7 +26,7 @@ let
     owner = "vadimcn";
     repo = "codelldb";
     rev = "v${version}";
-    hash = "sha256-B8iCy4NXG7IzJVncbYm5VoAMfhMfxGF+HW7M5sVn5b0=";
+    hash = "sha256-7//+y02rfDloeNADpoM8tist7fPstBZ2Eqt4dM5dCaE=";
   };
 
   lldb = llvmPackages_19.lldb;
@@ -181,7 +181,7 @@ stdenv.mkDerivation {
     description = "Native debugger extension for VSCode based on LLDB";
     homepage = "https://github.com/vadimcn/vscode-lldb";
     license = [ lib.licenses.mit ];
-    maintainers = [ lib.maintainers.r4v3n6101 ];
+    maintainers = [ ];
     platforms = lib.platforms.all;
   };
 }
diff --git a/pkgs/by-name/aa/aaa/package.nix b/pkgs/by-name/aa/aaa/package.nix
index b9c5e18dc0d7..64bf894ee5a4 100644
--- a/pkgs/by-name/aa/aaa/package.nix
+++ b/pkgs/by-name/aa/aaa/package.nix
@@ -6,19 +6,19 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "aaa";
-  version = "1.1.1";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "asciimoth";
     repo = "aaa";
-    tag = "v${finalAttrs.version}";
-    sha256 = "sha256-gIOlPjZOcmVLi9oOn4gBv6F+3Eq6t5b/3fKzoFqxclw=";
+    tag = "${finalAttrs.version}";
+    sha256 = "sha256-z8PXkX6Bh3oD8tRf+tsLJHbx5wIz2mBYhJSEL88hBDc=";
   };
 
-  cargoHash = "sha256-CHX+Ugy4ND36cpxNEFpnqid6ALHMPXmfXi+D4aktPRk=";
+  cargoHash = "sha256-dt3nbVS8i075O8m9x+FsDi3VeihVKVIV0wnPqyYUaIk=";
 
   meta = {
-    description = "Terminal viewer for 3a format";
+    description = "Swiss Army knife for animated ascii art";
     homepage = "https://github.com/asciimoth/aaa";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ asciimoth ];
diff --git a/pkgs/by-name/al/allure/package.nix b/pkgs/by-name/al/allure/package.nix
index 0c85aa04c277..3f265620777a 100644
--- a/pkgs/by-name/al/allure/package.nix
+++ b/pkgs/by-name/al/allure/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "allure";
-  version = "2.43.0";
+  version = "2.44.0";
 
   src = fetchurl {
     url = "https://github.com/allure-framework/allure2/releases/download/${finalAttrs.version}/allure-${finalAttrs.version}.tgz";
-    hash = "sha256-Hrp4vTrtdPNSRpMVCdQKBg9v8He6VyhHiThGiPMQdsg=";
+    hash = "sha256-cCGpCCjADNbsmSAnzOSOipS9h/rUPQwtysR5XK3BeNc=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/au/audiness/package.nix b/pkgs/by-name/au/audiness/package.nix
index ad2e62c31d3d..80fd8022434d 100644
--- a/pkgs/by-name/au/audiness/package.nix
+++ b/pkgs/by-name/au/audiness/package.nix
@@ -17,6 +17,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   };
 
   pythonRelaxDeps = [
+    "pytenable"
     "typer"
     "validators"
   ];
diff --git a/pkgs/by-name/bi/bitcomet/package.nix b/pkgs/by-name/bi/bitcomet/package.nix
index 515c995451b9..bbcd2a03bc74 100644
--- a/pkgs/by-name/bi/bitcomet/package.nix
+++ b/pkgs/by-name/bi/bitcomet/package.nix
@@ -13,7 +13,7 @@
 
 let
   pname = "bitcomet";
-  version = "2.19.2";
+  version = "2.21.2";
 
   meta = {
     homepage = "https://www.bitcomet.com";
@@ -45,8 +45,8 @@ let
       fetchurl {
         url = "https://download.bitcomet.com/linux/${arch}/BitComet-${version}-${arch}.deb";
         hash = selectSystem {
-          x86_64-linux = "sha256-26hpKNCetqV0whfzNo950EAmK+LKC1RsN5f/9HU9zKs=";
-          aarch64-linux = "sha256-VrrjQ4dcj0XL2xmNspo2mJ+3BVy9vKyVw6QaHkha0LY=";
+          x86_64-linux = "sha256-qHPr4G921W1Pl7n0Wv98yLRbsAkJBrOcyg9kHHjtBGc=";
+          aarch64-linux = "sha256-VC/dvAGmhqlmZT5XB41x/fTGvMZjYCuz/tSp9MYFUHo=";
         };
       };
 
diff --git a/pkgs/by-name/cf/cfripper/package.nix b/pkgs/by-name/cf/cfripper/package.nix
index b5e915bb043f..93e0ce49fcf0 100644
--- a/pkgs/by-name/cf/cfripper/package.nix
+++ b/pkgs/by-name/cf/cfripper/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "cfripper";
-  version = "1.20.1";
+  version = "1.21.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Skyscanner";
     repo = "cfripper";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HE9n28q1HX1HRSiXyEuUrAJGp4d5i1e0lROcsqpsobA=";
+    hash = "sha256-psuUG8Kk+pl9Qv9vpH7yCn2X6leciftgFN1Ft+zEgtg=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/ch/checkstyle/package.nix b/pkgs/by-name/ch/checkstyle/package.nix
index 5eb0d22fef51..acdc60aef140 100644
--- a/pkgs/by-name/ch/checkstyle/package.nix
+++ b/pkgs/by-name/ch/checkstyle/package.nix
@@ -8,17 +8,17 @@
 }:
 
 maven.buildMavenPackage (finalAttrs: {
-  version = "13.6.0";
+  version = "13.7.0";
   pname = "checkstyle";
 
   src = fetchFromGitHub {
     owner = "checkstyle";
     repo = "checkstyle";
     tag = "checkstyle-${finalAttrs.version}";
-    hash = "sha256-5E3GTE4fPmJYoSm2lK4tW1Dcu+SuyQKL396JLg3J22E=";
+    hash = "sha256-BrgjkqkVnLYMlouyopUoCTby2z4YWZl4UK7m3Ktm5bE=";
   };
 
-  mvnHash = "sha256-r0adD/80UguRCIznE6hGdhRifm29GxMhQRSmd2/nabc=";
+  mvnHash = "sha256-IKO61ugVjF03zA6pCwYKmwMVx/Ogy8hrt70ArOUm0NA=";
 
   nativeBuildInputs = [
     maven
diff --git a/pkgs/by-name/cn/cnspec/package.nix b/pkgs/by-name/cn/cnspec/package.nix
index fed41ef87222..9574fd82a314 100644
--- a/pkgs/by-name/cn/cnspec/package.nix
+++ b/pkgs/by-name/cn/cnspec/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "cnspec";
-  version = "13.25.0";
+  version = "13.27.0";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6DyF9gOXZfN5wUpUtTO/Pj8wOcHbTRbZbTCYF3t9clE=";
+    hash = "sha256-t/ugT15QxiwMJybX2mIwgx0wGQETLFJWplxNEosTq4A=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-q9ur5wbiJGZ8K0dI3xjpB4RsnEkoQetZu6Kj7IB7kEc=";
+  vendorHash = "sha256-M2f2HApngE8GJRXy53u7bif1puNTE6BV6oxmnvSSS6Y=";
 
   subPackages = [ "apps/cnspec" ];
 
diff --git a/pkgs/by-name/ct/ctranslate2/package.nix b/pkgs/by-name/ct/ctranslate2/package.nix
index 35e175647aaf..812a6d88286f 100644
--- a/pkgs/by-name/ct/ctranslate2/package.nix
+++ b/pkgs/by-name/ct/ctranslate2/package.nix
@@ -51,13 +51,6 @@ stdenv'.mkDerivation (finalAttrs: {
         'CMAKE_MINIMUM_REQUIRED(VERSION 3.10 FATAL_ERROR)'
 
     sed -e '1i #include <cstdint>' -i third_party/cxxopts/include/cxxopts.hpp
-
-    # Prevent setting the default nvcc arch flags, which can be
-    # ones that don't work with the current CUDA version
-    substituteInPlace CMakeLists.txt \
-      --replace-fail \
-        'list(APPEND CUDA_NVCC_FLAGS ''${ARCH_FLAGS})' \
-        ""
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/di/diffoscope/fix-tests-with-zipdetails-4.006.patch b/pkgs/by-name/di/diffoscope/fix-tests-with-zipdetails-4.006.patch
deleted file mode 100644
index 04593b366e76..000000000000
--- a/pkgs/by-name/di/diffoscope/fix-tests-with-zipdetails-4.006.patch
+++ /dev/null
@@ -1,97 +0,0 @@
-From fade8d04bfdbf473f3930feba7183957372e7fa7 Mon Sep 17 00:00:00 2001
-From: Michael Daniels <mdaniels5757@gmail.com>
-Date: Sun, 28 Jun 2026 16:20:43 -0400
-Subject: [PATCH] fix tests with zipdetails 4.006
-
----
- tests/comparators/test_zip.py            |  3 ++-
- tests/data/zip2_zipdetails_expected_diff |  2 +-
- tests/data/zip_zipdetails_expected_diff  | 10 +++++-----
- 3 files changed, 8 insertions(+), 7 deletions(-)
-
-diff --git a/tests/comparators/test_zip.py b/tests/comparators/test_zip.py
-index 75ec38be..ecff1930 100644
---- a/tests/comparators/test_zip.py
-+++ b/tests/comparators/test_zip.py
-@@ -81,7 +81,7 @@ def differences2(zip1, zip3):
- 
- 
- @skip_unless_tools_exist("zipinfo", "zipdetails")
--@skip_unless_tool_is_at_least("zipdetails", zipdetails_version, "4.004")
-+@skip_unless_tool_is_at_least("zipdetails", zipdetails_version, "4.006")
- @skip_unless_tool_is_at_least("perl", io_compress_zip_version, "2.212")
- def test_metadata(differences):
-     assert_diff(differences[0], "zip_zipinfo_expected_diff")
-@@ -96,6 +96,7 @@ def test_compressed_files(differences):
- 
- 
- @skip_unless_tools_exist("zipinfo", "bsdtar", "zipdetails")
-+@skip_unless_tool_is_at_least("zipdetails", zipdetails_version, "4.006")
- @skip_unless_tool_is_at_least("perl", io_compress_zip_version, "2.212")
- def test_extra_fields(differences2):
-     assert_diff(differences2[0], "zip_bsdtar_expected_diff")
-diff --git a/tests/data/zip2_zipdetails_expected_diff b/tests/data/zip2_zipdetails_expected_diff
-index 291dca88..281cf6c5 100644
---- a/tests/data/zip2_zipdetails_expected_diff
-+++ b/tests/data/zip2_zipdetails_expected_diff
-@@ -5,7 +5,7 @@
-  #
-  0064 Extra ID #1           5455 (21589) 'Extended Timestamp [UT]'
-  0066   Length              0009 (9)
-- 0068   Flags               03 (3) 'Modification Access'
-+ 0068   Flags               03 (3) 'Modification & Access'
- -0069   Modification Time   558AB455 (1435153493) 'Wed Jun 24 13:44:53 2015'
- -006D   Access Time         558AB45F (1435153503) 'Wed Jun 24 13:45:03 2015'
- +0069   Modification Time   41414141 (1094795585) 'Fri Sep 10 05:53:05 2004'
-diff --git a/tests/data/zip_zipdetails_expected_diff b/tests/data/zip_zipdetails_expected_diff
-index 978c2583..50df2696 100644
---- a/tests/data/zip_zipdetails_expected_diff
-+++ b/tests/data/zip_zipdetails_expected_diff
-@@ -23,7 +23,7 @@
-  #
-  0064 Extra ID #1           5455 (21589) 'Extended Timestamp [UT]'
-  0066   Length              0009 (9)
-- 0068   Flags               03 (3) 'Modification Access'
-+ 0068   Flags               03 (3) 'Modification & Access'
- -0069   Modification Time   558AB455 (1435153493) 'Wed Jun 24 13:44:53 2015'
- +0069   Modification Time   558AB474 (1435153524) 'Wed Jun 24 13:45:24 2015'
-  006D   Access Time         558AB45F (1435153503) 'Wed Jun 24 13:45:03 2015'
-@@ -85,7 +85,7 @@
-  #
- -01BF Extra ID #1           5455 (21589) 'Extended Timestamp [UT]'
- -01C1   Length              0005 (5)
---01C3   Flags               03 (3) 'Modification Access'
-+-01C3   Flags               03 (3) 'Modification & Access'
- -01C4   Modification Time   558AB455 (1435153493) 'Wed Jun 24 13:44:53 2015'
- -01C8 Extra ID #2           7875 (30837) 'Unix Extra type 3 [ux]'
- -01CA   Length              000B (11)
-@@ -96,7 +96,7 @@
- -01D3   GID                 000003E8 (1000)
- +024E Extra ID #1           5455 (21589) 'Extended Timestamp [UT]'
- +0250   Length              0005 (5)
--+0252   Flags               03 (3) 'Modification Access'
-++0252   Flags               03 (3) 'Modification & Access'
- +0253   Modification Time   558AB455 (1435153493) 'Wed Jun 24 13:44:53 2015'
- +0257 Extra ID #2           7875 (30837) 'Unix Extra type 3 [ux]'
- +0259   Length              000B (11)
-@@ -163,7 +163,7 @@
-  #
- -020D Extra ID #1           5455 (21589) 'Extended Timestamp [UT]'
- -020F   Length              0005 (5)
---0211   Flags               03 (3) 'Modification Access'
-+-0211   Flags               03 (3) 'Modification & Access'
- -0212   Modification Time   558AB455 (1435153493) 'Wed Jun 24 13:44:53 2015'
- -0216 Extra ID #2           7875 (30837) 'Unix Extra type 3 [ux]'
- -0218   Length              000B (11)
-@@ -174,7 +174,7 @@
- -0221   GID                 000003E8 (1000)
- +029C Extra ID #1           5455 (21589) 'Extended Timestamp [UT]'
- +029E   Length              0005 (5)
--+02A0   Flags               03 (3) 'Modification Access'
-++02A0   Flags               03 (3) 'Modification & Access'
- +02A1   Modification Time   558AB474 (1435153524) 'Wed Jun 24 13:45:24 2015'
- +02A5 Extra ID #2           7875 (30837) 'Unix Extra type 3 [ux]'
- +02A7   Length              000B (11)
--- 
-2.54.0
-
diff --git a/pkgs/by-name/di/diffoscope/package.nix b/pkgs/by-name/di/diffoscope/package.nix
index dc5169673518..5898aba19644 100644
--- a/pkgs/by-name/di/diffoscope/package.nix
+++ b/pkgs/by-name/di/diffoscope/package.nix
@@ -109,12 +109,12 @@ in
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
 python.pkgs.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "322";
+  version = "323";
   pyproject = true;
 
   src = fetchurl {
     url = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    hash = "sha256-dina2JdbLL/jfo4eMuUo62KggST95w0b7oonY86zjgk=";
+    hash = "sha256-TFSeCS7D2D496rUrosYAWP4kHsu6x386c8AJ5c4aKYs=";
   };
 
   outputs = [
@@ -124,10 +124,6 @@ python.pkgs.buildPythonApplication rec {
 
   patches = [
     ./ignore_links.patch
-    # Remove flags output from an OCaml test's diff, as it's Debian-specific
-    ./remove-flags-from-ocaml-diff.patch
-    # https://salsa.debian.org/reproducible-builds/diffoscope/-/merge_requests/166
-    ./fix-tests-with-zipdetails-4.006.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/by-name/di/diffoscope/remove-flags-from-ocaml-diff.patch b/pkgs/by-name/di/diffoscope/remove-flags-from-ocaml-diff.patch
deleted file mode 100644
index 61138d263c6e..000000000000
--- a/pkgs/by-name/di/diffoscope/remove-flags-from-ocaml-diff.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-From 18cf9ab675691c7173a9b7fafd6d521c3ea75862 Mon Sep 17 00:00:00 2001
-From: Michael Daniels <mdaniels5757@gmail.com>
-Date: Sat, 20 Jun 2026 11:42:29 -0400
-Subject: [PATCH] tests/data/ocaml_expected_diff: remove flags from diff
-
-This output comes from a Debian-specific OCaml patch, see
-https://salsa.debian.org/ocaml-team/ocaml/-/blob/archive/debian/5.4.1-1/debian/patches/Print-.cmi-flags-in-objinfo.patch
----
- tests/data/ocaml_expected_diff | 3 +--
- 1 file changed, 1 insertion(+), 2 deletions(-)
-
-diff --git a/tests/data/ocaml_expected_diff b/tests/data/ocaml_expected_diff
-index 79631882..a48de841 100644
---- a/tests/data/ocaml_expected_diff
-+++ b/tests/data/ocaml_expected_diff
-@@ -1,7 +1,6 @@
--@@ -1,6 +1,6 @@
-+@@ -1,5 +1,5 @@
- -Unit name: Test1
- +Unit name: Test2
-- Flags: [ Alerts _ ]
-  Interfaces imported:
- -	351c2dc2fb4a56dac258b47c26262db6	Test1
- +	ac02205dc900024a67ede9f394c59d72	Test2
--- 
-2.54.0
-
diff --git a/pkgs/by-name/fa/faraday-agent-dispatcher/package.nix b/pkgs/by-name/fa/faraday-agent-dispatcher/package.nix
index b371db2fd199..7229bcf79d0a 100644
--- a/pkgs/by-name/fa/faraday-agent-dispatcher/package.nix
+++ b/pkgs/by-name/fa/faraday-agent-dispatcher/package.nix
@@ -2,6 +2,7 @@
   lib,
   fetchFromGitHub,
   python3,
+  writableTmpDirAsHomeHook,
 }:
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
@@ -21,6 +22,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
       --replace-fail '"pytest-runner",' ""  '';
 
   pythonRelaxDeps = [
+    "pytenable"
     "python-socketio"
   ];
 
@@ -28,13 +30,9 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     "python-owasp-zap-v2.4"
   ];
 
-  build-system = with python3.pkgs; [
-    setuptools-scm
-  ];
+  build-system = with python3.pkgs; [ setuptools-scm ];
 
-  nativeBuildInputs = [
-    python3.pkgs.python-owasp-zap-v2-4
-  ];
+  nativeBuildInputs = with python3.pkgs; [ python-owasp-zap-v2-4 ];
 
   dependencies = with python3.pkgs; [
     aiohttp
@@ -57,12 +55,9 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   nativeCheckInputs = with python3.pkgs; [
     pytest-asyncio
     pytestCheckHook
+    writableTmpDirAsHomeHook
   ];
 
-  preCheck = ''
-    export HOME=$(mktemp -d);
-  '';
-
   disabledTests = [
     "test_execute_agent"
     "SSL"
@@ -74,14 +69,12 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     "tests/unittests/test_import_official_executors.py"
   ];
 
-  pythonImportsCheck = [
-    "faraday_agent_dispatcher"
-  ];
+  pythonImportsCheck = [ "faraday_agent_dispatcher" ];
 
   meta = {
     description = "Tool to send result from tools to the Faraday Platform";
     homepage = "https://github.com/infobyte/faraday_agent_dispatcher";
-    changelog = "https://github.com/infobyte/faraday_agent_dispatcher/releases/tag/${finalAttrs.version}";
+    changelog = "https://github.com/infobyte/faraday_agent_dispatcher/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "faraday-dispatcher";
diff --git a/pkgs/by-name/fe/fetchtastic/package.nix b/pkgs/by-name/fe/fetchtastic/package.nix
index bbc80f11b9cc..6d17d5b252f3 100644
--- a/pkgs/by-name/fe/fetchtastic/package.nix
+++ b/pkgs/by-name/fe/fetchtastic/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "fetchtastic";
-  version = "0.10.10";
+  version = "0.10.11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jeremiah-k";
     repo = "fetchtastic";
     tag = finalAttrs.version;
-    hash = "sha256-ImXBH1mvJE+Ae7fUqR/Z381TKGt6hq0BRHhdtOz3YO4=";
+    hash = "sha256-/kp9bfJJLffZp+9dEY7G+RQmE43XXwNozkDYjeAjPkc=";
   };
 
   pythonRelaxDeps = [ "platformdirs" ];
diff --git a/pkgs/by-name/fl/flyctl/package.nix b/pkgs/by-name/fl/flyctl/package.nix
index c4251bf2aecb..5890e1c2af06 100644
--- a/pkgs/by-name/fl/flyctl/package.nix
+++ b/pkgs/by-name/fl/flyctl/package.nix
@@ -12,7 +12,7 @@
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.4.60";
+  version = "0.4.63";
 
   src = fetchFromGitHub {
     owner = "superfly";
@@ -22,11 +22,11 @@ buildGoModule rec {
       cd "$out"
       git rev-parse HEAD > COMMIT
     '';
-    hash = "sha256-ToKKn3Scj++VLv0SCMNQHkbffs2aADto0tLv80aFqzc=";
+    hash = "sha256-dGqL6lKx67VzlfHvaCpOTpHtFao99zLIYXiORPHP5e8=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-XBpLOhC3fY18o0tQZXgyKrQRgd84U5SRo6Rrgkuq4f8=";
+  vendorHash = "sha256-X6cEAaUIHTJoNwoBlGFZUA4M8/AnRY3oTiWW7/03PXY=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/fr/freelens-bin/package.nix b/pkgs/by-name/fr/freelens-bin/package.nix
index 19f61da6d001..adc3239312c1 100644
--- a/pkgs/by-name/fr/freelens-bin/package.nix
+++ b/pkgs/by-name/fr/freelens-bin/package.nix
@@ -16,24 +16,24 @@
 let
 
   pname = "freelens-bin";
-  version = "1.10.1";
+  version = "1.10.2";
 
   sources = {
     x86_64-linux = {
       url = "https://github.com/freelensapp/freelens/releases/download/v${version}/Freelens-${version}-linux-amd64.AppImage";
-      hash = "sha256-Hbu28vbgaSEjJTAVSfHJ3cZGd2PRU0ex7dNv0wo1SrI=";
+      hash = "sha256-l+6QnlDnNs2t4auJRS0MLy592OfQDd0tDNqiVH5xJ3g=";
     };
     aarch64-linux = {
       url = "https://github.com/freelensapp/freelens/releases/download/v${version}/Freelens-${version}-linux-arm64.AppImage";
-      hash = "sha256-JrApeOjMXNNi/wCq6vY6rYpPGgMWti0H+2i7QNEXaTc=";
+      hash = "sha256-Pw6RPa6T9jN7XAfOqj6lDFzTqhwOT1DgK35cANyBAOE=";
     };
     x86_64-darwin = {
       url = "https://github.com/freelensapp/freelens/releases/download/v${version}/Freelens-${version}-macos-amd64.dmg";
-      hash = "sha256-BIBEaQFny/DvzrvsC38UPiIqBFaxUO/DOVQTIe2gL+Q=";
+      hash = "sha256-6qn/3Zly7nvj9XxihUdmkguLWw0a7Y321Xv7EnJzjkc=";
     };
     aarch64-darwin = {
       url = "https://github.com/freelensapp/freelens/releases/download/v${version}/Freelens-${version}-macos-arm64.dmg";
-      hash = "sha256-5duswriuDmL92tXqLckBhH2RMPFDqFRG/WW9oYMClGY=";
+      hash = "sha256-ARIvUMkkdUK5O6xdplXJ/JkPdezO/16HvO2P21W6y8I=";
     };
   };
 
diff --git a/pkgs/by-name/ga/gamemac/package.nix b/pkgs/by-name/ga/gamemac/package.nix
new file mode 100644
index 000000000000..4e0bd43b621a
--- /dev/null
+++ b/pkgs/by-name/ga/gamemac/package.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  undmg,
+  makeWrapper,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "gamemac";
+  version = "0.8.328";
+
+  src = fetchurl {
+    name = "GameHub_en_${finalAttrs.version}.dmg";
+    url = "https://gamehub-cdn.masnet.cn/uploads/upgrade/20260618/b616a96780c249a789d95f7b897333cb.dmg";
+    hash = "sha256-uo/kr9PAFREfbkXX9hpJJNT6OZDv3jnOuZgc2fwtSyM=";
+  };
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    undmg
+    makeWrapper
+  ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/Applications" "$out/bin"
+    mv GameHub.app "$out/Applications/"
+    makeWrapper "$out/Applications/GameHub.app/Contents/MacOS/GameHub" "$out/bin/GameHub"
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "Play mobile games natively on macOS";
+    homepage = "https://www.gamemac.com/en/";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ damidoug ];
+    mainProgram = "GameHub";
+    platforms = lib.platforms.darwin;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
diff --git a/pkgs/by-name/ga/gamemac/update.sh b/pkgs/by-name/ga/gamemac/update.sh
new file mode 100755
index 000000000000..e12550fcc7d6
--- /dev/null
+++ b/pkgs/by-name/ga/gamemac/update.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bash curl gnused nix
+
+set -euo pipefail
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+ROLLING_URL="https://api-international-gamehub.xiaoji.com/game/download/mac/en"
+UA="Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
+
+# Resolve rolling URL to stable CDN URL (strip query string)
+DIRECT_URL=$(curl -fsSL -A "$UA" -w "%{url_effective}" -o /dev/null "$ROLLING_URL")
+CDN_URL="${DIRECT_URL%%\?*}"
+
+# Extract version from CDN filename (e.g. .../GameHub_en_0.8.328.dmg)
+VERSION=$(basename "$CDN_URL" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
+
+CURRENT=$(grep 'version = ' package.nix | head -1 | grep -oE '"[0-9.]+"' | tr -d '"')
+if [ "$VERSION" = "$CURRENT" ]; then
+  echo "Already at $VERSION"
+  exit 0
+fi
+
+HASH=$(nix-prefetch-url --name "GameHub_en_${VERSION}.dmg" --type sha256 "$CDN_URL")
+SRI=$(nix-hash --to-sri --type sha256 "$HASH")
+
+sed -i \
+  -e "s|version = \"[^\"]*\"|version = \"$VERSION\"|" \
+  -e "s|https://gamehub-cdn\.masnet\.cn/uploads/upgrade/[^\"]*|$CDN_URL|" \
+  -e "s|hash = \"sha256-[^\"]*\"|hash = \"$SRI\"|" \
+  package.nix
+
+echo "Updated $CURRENT -> $VERSION"
diff --git a/pkgs/by-name/gi/github-mcp-server/package.nix b/pkgs/by-name/gi/github-mcp-server/package.nix
index 3cab6eaa7ee1..8789264aba3d 100644
--- a/pkgs/by-name/gi/github-mcp-server/package.nix
+++ b/pkgs/by-name/gi/github-mcp-server/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "github-mcp-server";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "github";
     repo = "github-mcp-server";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5INN7B/F1KcyZwZ3xeOBiCnfAdK1PXVnMZf3t8JIk6I=";
+    hash = "sha256-O8ooNaFmWXMhsn7UQITgo48VkdYbVTCC4WkHoU9abyo=";
   };
 
   vendorHash = "sha256-J1hC4hdEKLENXLJrsyV41TaJ9+2CuPz5KoIMm2mXvTE=";
diff --git a/pkgs/by-name/gl/glitchtip/frontend.nix b/pkgs/by-name/gl/glitchtip/frontend.nix
index e57cd1aef060..86c37d73d166 100644
--- a/pkgs/by-name/gl/glitchtip/frontend.nix
+++ b/pkgs/by-name/gl/glitchtip/frontend.nix
@@ -10,13 +10,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "glitchtip-frontend";
-  version = "6.1.8";
+  version = "6.2.0";
 
   src = fetchFromGitLab {
     owner = "glitchtip";
     repo = "glitchtip-frontend";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-y8NPj1xjGnGS9yBFaRjFRxLdTGrAq08T9N7cZN5IeSc=";
+    hash = "sha256-iKY1w9lmfuyvDblH/TlnUwAnda17qWGxmx1qtmQRENg=";
   };
 
   nodejs = nodejs_22;
@@ -25,7 +25,7 @@ buildNpmPackage (finalAttrs: {
     name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
     inherit (finalAttrs) src;
     npmDepsFetcherVersion = 3;
-    hash = "sha256-AIzPJpNvGV/U71UFAUwOqx8kb31s7LXhMha4bXV+oCU=";
+    hash = "sha256-V9aRKoJ6+BN/q7NS21eZBopzkWje8sOGGL1AgO4cUM0=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/gl/glitchtip/glitchtip-rust.nix b/pkgs/by-name/gl/glitchtip/glitchtip-rust.nix
new file mode 100644
index 000000000000..455d00a4614a
--- /dev/null
+++ b/pkgs/by-name/gl/glitchtip/glitchtip-rust.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitLab,
+  rustPlatform,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "glitchtip-rust";
+  version = "0.3.0";
+  pyproject = true;
+
+  src = fetchFromGitLab {
+    owner = "glitchtip";
+    repo = "glitchtip-rust";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-0FG+seIWqfyOG3JR0WF4ICnxMAPx9FO0JyFSB43CttU=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-14j7h4TgQhTE5oihnvjAxtGZhPajuTRD4Cga8xzN9Lg=";
+  };
+
+  nativeBuildInputs = [
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+  ];
+
+  pythonImportsCheck = [ "gt_rust" ];
+
+  meta = {
+    description = "Rust components of GlitchTip Backend";
+    homepage = "https://glitchtip.com";
+    changelog = "https://gitlab.com/glitchtip/glitchtip-rust/-/tags/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      defelo
+      felbinger
+    ];
+  };
+})
diff --git a/pkgs/by-name/gl/glitchtip/package.nix b/pkgs/by-name/gl/glitchtip/package.nix
index 60e7ef7aae3a..a623377e0b95 100644
--- a/pkgs/by-name/gl/glitchtip/package.nix
+++ b/pkgs/by-name/gl/glitchtip/package.nix
@@ -13,6 +13,7 @@ let
     self = python;
     packageOverrides = final: prev: {
       django = final.django_6;
+      glitchtip-rust = final.callPackage ./glitchtip-rust.nix { };
     };
   };
 
@@ -24,7 +25,6 @@ let
       arro3-core
       arro3-io
       boto3
-      brotli
       cxxfilt
       django
       django-allauth
@@ -46,8 +46,10 @@ let
       duckdb
       google-cloud-logging
       granian
+      glitchtip-rust
       mcp
       minidump
+      opentelemetry-proto
       orjson
       psycopg
       pydantic
@@ -77,14 +79,14 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glitchtip";
-  version = "6.1.8";
+  version = "6.2.0";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "glitchtip";
     repo = "glitchtip-backend";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4RAZYGoS1tUbcPVv8L0sFWqFfBX05yXKZHFZDbEn0C0=";
+    hash = "sha256-E1YwJwfL5+Q68xRfnoi2Sg+vAZxGQa0IKfOSVuLVnK0=";
   };
 
   postPatch = ''
@@ -128,6 +130,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     inherit frontend python;
+    inherit (python.pkgs) glitchtip-rust;
     tests = { inherit (nixosTests) glitchtip; };
     updateScript = ./update.sh;
   };
diff --git a/pkgs/by-name/gl/glitchtip/update.sh b/pkgs/by-name/gl/glitchtip/update.sh
index e0a5cf370e59..33816b26d0b3 100755
--- a/pkgs/by-name/gl/glitchtip/update.sh
+++ b/pkgs/by-name/gl/glitchtip/update.sh
@@ -7,3 +7,4 @@ version=$(curl ${GITLAB_TOKEN:+-H "Private-Token: $GITLAB_TOKEN"} -sL https://gi
 
 nix-update --version="$version" glitchtip
 nix-update --version="$version" glitchtip.frontend
+nix-update glitchtip.glitchtip-rust
diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix
index a0b030218353..e639b0005187 100644
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -179,11 +179,11 @@ let
 
   linux = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "149.0.7827.200";
+    version = "150.0.7871.46";
 
     src = fetchurl {
       url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-HDCPrhH44nKTr6Fzm9SqAV/Vdmtyx1znIZXsPkGmEqg=";
+      hash = "sha256-abQBOftzoCGnSfMvzeCFP7F4G286izyvFzrY9nR/qnw=";
     };
 
     # With strictDeps on, some shebangs were not being patched correctly
diff --git a/pkgs/by-name/go/google-cloud-sql-proxy/package.nix b/pkgs/by-name/go/google-cloud-sql-proxy/package.nix
index 6b89b0bad4cf..30e2d43c064e 100644
--- a/pkgs/by-name/go/google-cloud-sql-proxy/package.nix
+++ b/pkgs/by-name/go/google-cloud-sql-proxy/package.nix
@@ -7,18 +7,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "google-cloud-sql-proxy";
-  version = "2.22.1";
+  version = "2.23.0";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = "cloud-sql-proxy";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-vTTYQ1D42X1L03EE9c5Xz/SCRE3wWROT/daY+f0vLPI=";
+    hash = "sha256-hCnwNSOu9aSdWC5Gtr0nytmQQnkMS6i84pICBrN2VVg=";
   };
 
   subPackages = [ "." ];
 
-  vendorHash = "sha256-lOT9GpZk6Bv5P8kiyMR4j+aHOO0be4pW4WvVux8hpnQ=";
+  vendorHash = "sha256-bM8BEdq5EY5RtsCNkRNTsc9dGgAEZkGHcUOip2LwKik=";
 
   checkFlags = [
     "-short"
diff --git a/pkgs/by-name/gr/greenmask/package.nix b/pkgs/by-name/gr/greenmask/package.nix
index 8a9a72457091..1b0f2f0799a9 100644
--- a/pkgs/by-name/gr/greenmask/package.nix
+++ b/pkgs/by-name/gr/greenmask/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "greenmask";
-  version = "0.2.21";
+  version = "0.2.22";
 
   src = fetchFromGitHub {
     owner = "GreenmaskIO";
     repo = "greenmask";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QlNw2kCh5Rd8kwuA/BiNHXaw0p5qCfn4hzo9dgN45lU=";
+    hash = "sha256-bmKy3naQiLG4z3+VNkUck3UNVh2Oi8faXRz20qjwL9g=";
   };
 
-  vendorHash = "sha256-zVbSppCgLil0qS4WYhkzQZxbBx6L/0gbexY//I+GzwQ=";
+  vendorHash = "sha256-PsGeh7PzZFFhzQClW56GfvsGp8T7dccyErdnOv3urhs=";
 
   subPackages = [ "cmd/greenmask/" ];
 
diff --git a/pkgs/by-name/it/itgmania/themes/digital-dance.nix b/pkgs/by-name/it/itgmania/themes/digital-dance.nix
index 7a502dc9f249..f7ecc099fc25 100644
--- a/pkgs/by-name/it/itgmania/themes/digital-dance.nix
+++ b/pkgs/by-name/it/itgmania/themes/digital-dance.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "digital-dance";
-  version = "1.1.3-unstable-2026-06-22";
+  version = "1.1.4-unstable-2026-06-30";
 
   src = fetchFromCodeberg {
     owner = "JNero";
     repo = "Digital-Dance-ITGMania";
-    rev = "14d3d31a4f79f1557e3515de41a7907130d7b163";
-    hash = "sha256-e/lOhwI+Q4sMn0EL5sPMhCaxoN6eOLVLBs7bMOPJUxY=";
+    rev = "90087bfd1182d1240f22e48fb348df52f784e799";
+    hash = "sha256-iZ3N1+epG8EF8H9KViI3fgtHeayxmWaumxkOOK9qK0c=";
   };
 
   postInstall = ''
diff --git a/pkgs/by-name/it/itgmania/themes/itg3encore.nix b/pkgs/by-name/it/itgmania/themes/itg3encore.nix
index ae675009a8f9..76c915a9be1f 100644
--- a/pkgs/by-name/it/itgmania/themes/itg3encore.nix
+++ b/pkgs/by-name/it/itgmania/themes/itg3encore.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "itg3encore";
-  version = "0-unstable-2026-06-22";
+  version = "0-unstable-2026-06-28";
 
   src = fetchFromGitHub {
     owner = "DarkBahamut162";
     repo = "itg3encore";
-    rev = "c669a04ce6487a32263a2f617efa26bfd5eaf764";
-    hash = "sha256-CbqIzHcHmxICoi23z032Ti8AZyB5Ur/SPsolr1VjBhY=";
+    rev = "408a726f31287bfe98144fa62f64abac5a4fbb92";
+    hash = "sha256-6MGbwkU8dppAs/mg6hA2jmDjrHU7sgITouUjKh92ozE=";
   };
 
   postInstall = ''
diff --git a/pkgs/by-name/it/itgmania/unwrapped.nix b/pkgs/by-name/it/itgmania/unwrapped.nix
index f0d65de916e3..6eced844d6a9 100644
--- a/pkgs/by-name/it/itgmania/unwrapped.nix
+++ b/pkgs/by-name/it/itgmania/unwrapped.nix
@@ -23,14 +23,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "itgmania";
-  version = "1.2.1";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "itgmania";
     repo = "itgmania";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-bTABfTflWasuXvX+YPciUIICAFVROk/SgeClgrTUjkQ=";
+    hash = "sha256-dwalGEQFNhjuKwUBBskCHDYzmyjuf0r9TYM2ex8wzio=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/jf/jfrog-cli/package.nix b/pkgs/by-name/jf/jfrog-cli/package.nix
index 4c75f009fb03..e83bd5b6d3df 100644
--- a/pkgs/by-name/jf/jfrog-cli/package.nix
+++ b/pkgs/by-name/jf/jfrog-cli/package.nix
@@ -9,17 +9,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "jfrog-cli";
-  version = "2.109.0";
+  version = "2.112.0";
 
   src = fetchFromGitHub {
     owner = "jfrog";
     repo = "jfrog-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jzQNwNdqNMcwDf3RgEdS4ACUPDL3ujlkGD5kFuHRd8Q=";
+    hash = "sha256-jqzjkUbCwR+EMA4Zrb4rZHDsQWD4YimPVhHA2GcLNF8=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-lI24KDC31yQaUYe9uV7ZiQLzwROSaFh7M1J0B7k0iWI=";
+  vendorHash = "sha256-Bw2g9bfuG+IgItrRh85G9lyFZP8oXNXxkZTcvSy0WWA=";
 
   checkFlags = "-skip=^(TestReleaseBundle|TestVisibilitySendUsage_RtCurl_E2E)";
 
diff --git a/pkgs/by-name/ko/kopuz/package.nix b/pkgs/by-name/ko/kopuz/package.nix
index 4ec960fb4865..28fa8650215e 100644
--- a/pkgs/by-name/ko/kopuz/package.nix
+++ b/pkgs/by-name/ko/kopuz/package.nix
@@ -4,6 +4,7 @@
   rustPlatform,
   pkg-config,
   cmake,
+  git,
   openssl,
   tailwindcss_4,
   dioxus-cli,
@@ -20,28 +21,30 @@
   xdotool,
   wayland,
   dbus,
+  libayatana-appindicator,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   __structuredAttrs = true;
 
   pname = "kopuz";
-  version = "0.6.0";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "Kopuz-org";
     repo = "kopuz";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+HT76hfgTEkEVV1wn2r97PshoRJ08r4fTrExmQDuymg=";
+    hash = "sha256-d6wSefvx2KT1EyhLq2pn9MSDtW+AvDj7WVz27MJeTmg=";
   };
 
-  cargoHash = "sha256-lTGrwN2CGbmOgrjjbqrizNWPQoxWrEbDkcjhjMergoE=";
+  cargoHash = "sha256-fr65eE8wFWtW/PT5ZACGMcNCo/QNo9xf39LVBQMGLVk=";
 
   nativeBuildInputs = [
     pkg-config
     cmake
     tailwindcss_4
     dioxus-cli
+    git
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     wrapGAppsHook3
@@ -60,12 +63,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
     xdotool
     wayland
     dbus
+    libayatana-appindicator
   ];
 
   buildPhase = ''
     runHook preBuild
 
-    tailwindcss -i tailwind.css -o kopuz/assets/tailwind.css --minify
+    tailwindcss -i tailwind.css -o crates/kopuz/assets/tailwind.css --minify
 
     ${lib.optionalString stdenv.hostPlatform.isDarwin ''
             mkdir -p "$TMPDIR/fake-bin"
@@ -95,11 +99,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
           install -Dm644 data/com.temidaradev.kopuz.desktop \
             $out/share/applications/com.temidaradev.kopuz.desktop
           substituteInPlace $out/share/applications/com.temidaradev.kopuz.desktop \
+            --replace-fail "Exec=kopuz" "Exec=$out/bin/kopuz"
 
           install -Dm644 data/com.temidaradev.kopuz.metainfo.xml \
             $out/share/metainfo/com.temidaradev.kopuz.metainfo.xml
 
-          install -Dm644 kopuz/assets/logo.png \
+          install -Dm644 crates/kopuz/assets/logo.png \
             $out/share/icons/hicolor/256x256/apps/com.temidaradev.kopuz.png
         ''
       else
@@ -119,6 +124,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     gappsWrapperArgs+=(
       --chdir $out/bin
       --prefix PATH : ${lib.makeBinPath [ yt-dlp ]}
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libayatana-appindicator ]}
     )
   '';
 
diff --git a/pkgs/by-name/kt/ktailctl/package.nix b/pkgs/by-name/kt/ktailctl/package.nix
index 739c374a00b4..d6e25dd9a379 100644
--- a/pkgs/by-name/kt/ktailctl/package.nix
+++ b/pkgs/by-name/kt/ktailctl/package.nix
@@ -11,13 +11,13 @@
 }:
 
 let
-  version = "0.22.0";
+  version = "0.22.1";
 
   src = fetchFromGitHub {
     owner = "f-koehler";
     repo = "KTailctl";
-    rev = "v${version}";
-    hash = "sha256-20hR/N3m1BsbMGiaWVV/SH/OHgfk7ZC1+WWhYqQpIls=";
+    tag = "v${version}";
+    hash = "sha256-BRkjVZaoxiMW8JltIkYDiCCE2kNGLDpRJd0iclQMcGY=";
   };
 
   goDeps =
@@ -74,6 +74,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "GUI to monitor and manage Tailscale on your Linux desktop";
+    changelog = "https://github.com/f-koehler/KTailctl/releases/tag/${src.tag}";
     homepage = "https://github.com/f-koehler/KTailctl";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ k900 ];
diff --git a/pkgs/by-name/li/libdict/package.nix b/pkgs/by-name/li/libdict/package.nix
index b5013a3df553..7558978c2f4b 100644
--- a/pkgs/by-name/li/libdict/package.nix
+++ b/pkgs/by-name/li/libdict/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdict";
-  version = "1.0.5";
+  version = "1.0.6";
 
   src = fetchFromGitHub {
     owner = "rtbrick";
     repo = "libdict";
     rev = finalAttrs.version;
-    hash = "sha256-604escyV5MVuYggs1awIrorCrdXSUj3IhjwXV2QdDMU=";
+    hash = "sha256-JO8gIZwSZ1vOigiM2IoGRYW2m2zoAa1af/eMBP3ZRjY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mu/music-assistant-desktop/package.nix b/pkgs/by-name/mu/music-assistant-desktop/package.nix
index 54179caddd17..24342160219b 100644
--- a/pkgs/by-name/mu/music-assistant-desktop/package.nix
+++ b/pkgs/by-name/mu/music-assistant-desktop/package.nix
@@ -30,13 +30,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "music-assistant-desktop";
-  version = "0.4.2";
+  version = "0.4.4";
 
   src = fetchFromGitHub {
     owner = "music-assistant";
     repo = "desktop-app";
     tag = finalAttrs.version;
-    hash = "sha256-AzKUv0lEpxM4lVEmgDV89RCD78YKcGNj1FTBs8spdyI=";
+    hash = "sha256-t63DUejUyNnOD7gIPow/xsCo2TcmDaK3C5R+TkoBZo8=";
   };
 
   patches = [
@@ -46,7 +46,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoRoot = "src-tauri";
   buildAndTestSubdir = finalAttrs.cargoRoot;
 
-  cargoHash = "sha256-PevHpvDIlah0jQw/mZkDxQ5xY3t6KicGLlDYbtPco5A=";
+  cargoHash = "sha256-Z7iyPEEPvUhVLma4n20faoz47CK+PHAIB6epNDF5sUo=";
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
diff --git a/pkgs/by-name/ne/nerva/package.nix b/pkgs/by-name/ne/nerva/package.nix
index 4b1d57c903a5..eb5599180716 100644
--- a/pkgs/by-name/ne/nerva/package.nix
+++ b/pkgs/by-name/ne/nerva/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "nerva";
-  version = "1.30.0";
+  version = "1.36.0";
 
   src = fetchFromGitHub {
     owner = "praetorian-inc";
     repo = "nerva";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kiVZFByiNCyubtzDryVwi6x/Xo1StEtlnOTlD9MfwP0=";
+    hash = "sha256-akGiZ5KolHOzZddgAYA3zWcFG0VSqHe6cFiB6AvRyhg=";
   };
 
   vendorHash = "sha256-Z0MSD+1/1VzrJ+pz5x0JvxrCxtJe59ckaTqHK/+TVN8=";
diff --git a/pkgs/by-name/pa/paperless-ngx/frontend.nix b/pkgs/by-name/pa/paperless-ngx/frontend.nix
new file mode 100644
index 000000000000..20f2843c7793
--- /dev/null
+++ b/pkgs/by-name/pa/paperless-ngx/frontend.nix
@@ -0,0 +1,88 @@
+{
+  stdenv,
+  lib,
+  fetchPnpmDeps,
+  pnpmConfigHook,
+  pnpm_10,
+  nodejs,
+  node-gyp,
+  pkg-config,
+  python3,
+  pango,
+  giflib,
+  xcbuild,
+  src,
+  version,
+  meta,
+}:
+let
+  pnpm = pnpm_10;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "paperless-ngx-frontend";
+  inherit version;
+
+  src = src + "/src-ui";
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit pnpm;
+    inherit (finalAttrs) pname version src;
+    fetcherVersion = 3;
+    hash = "sha256-HO+IDNB3NXWgvV0cvZ5zx46JuXv6Tgroz+YfVump5MA=";
+  };
+
+  nativeBuildInputs = [
+    node-gyp
+    nodejs
+    pkg-config
+    pnpmConfigHook
+    pnpm
+    python3
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    xcbuild
+  ];
+
+  buildInputs = [
+    pango
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    giflib
+  ];
+
+  CYPRESS_INSTALL_BINARY = "0";
+  NG_CLI_ANALYTICS = "false";
+
+  buildPhase = ''
+    runHook preBuild
+
+    pushd node_modules/canvas
+    node-gyp rebuild
+    popd
+
+    # cat forcefully disables angular cli's spinner which doesn't work with nix' tty which is 0x0
+    pnpm run build --configuration production | cat
+
+    runHook postBuild
+  '';
+
+  doCheck = true;
+  checkPhase = ''
+    runHook preCheck
+
+    pnpm run test | cat
+
+    runHook postCheck
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib/paperless-ui
+    mv ../src/documents/static/frontend $out/lib/paperless-ui/
+
+    runHook postInstall
+  '';
+
+  inherit meta;
+})
diff --git a/pkgs/by-name/pa/paperless-ngx/package.nix b/pkgs/by-name/pa/paperless-ngx/package.nix
index 084331ade53a..641da02e2848 100644
--- a/pkgs/by-name/pa/paperless-ngx/package.nix
+++ b/pkgs/by-name/pa/paperless-ngx/package.nix
@@ -3,12 +3,10 @@
   stdenv,
   fetchFromGitHub,
   fetchPypi,
-  node-gyp,
-  nodejs,
+  callPackage,
   nixosTests,
   gettext,
   python3,
-  giflib,
   ghostscript_headless,
   imagemagickBig,
   jbig2enc,
@@ -16,50 +14,40 @@
   pngquant,
   qpdf,
   tesseract5,
-  fetchPnpmDeps,
-  pnpmConfigHook,
-  pnpm_10,
   poppler-utils,
   liberation_ttf,
-  xcbuild,
-  pango,
-  pkg-config,
   symlinkJoin,
   nltk-data,
   lndir,
+  nix-update-script,
+  extraPythonPackageOverrides ? (_final: _prev: { }),
 }:
 let
-  pnpm = pnpm_10;
+  defaultPythonPackageOverrides = final: prev: {
+    django = prev.django_5;
 
-  version = "2.20.15";
+    fido2 = prev.fido2.overridePythonAttrs {
+      version = "1.2.0";
 
-  src = fetchFromGitHub {
-    owner = "paperless-ngx";
-    repo = "paperless-ngx";
-    tag = "v${version}";
-    hash = "sha256-Czh4Knel0IIHsTc3kEnp1153Kv+3721GRCbTYTkeCDg=";
+      src = fetchPypi {
+        pname = "fido2";
+        version = "1.2.0";
+        hash = "sha256-45+VkgEi1kKD/aXlWB2VogbnBPpChGv6RmL4aqDTMzs=";
+      };
+
+      pytestFlags = [ ];
+    };
+
+    # tesseract5 may be overwritten in the paperless module and we need to propagate that to make the closure reduction effective
+    ocrmypdf = prev.ocrmypdf_16.override { tesseract = tesseract5; };
   };
 
   python = python3.override {
     self = python;
-    packageOverrides = final: prev: {
-      django = prev.django_5;
-
-      fido2 = prev.fido2.overridePythonAttrs {
-        version = "1.2.0";
-
-        src = fetchPypi {
-          pname = "fido2";
-          version = "1.2.0";
-          hash = "sha256-45+VkgEi1kKD/aXlWB2VogbnBPpChGv6RmL4aqDTMzs=";
-        };
-
-        pytestFlags = [ ];
-      };
-
-      # tesseract5 may be overwritten in the paperless module and we need to propagate that to make the closure reduction effective
-      ocrmypdf = prev.ocrmypdf_16.override { tesseract = tesseract5; };
-    };
+    packageOverrides = lib.composeManyExtensions [
+      defaultPythonPackageOverrides
+      extraPythonPackageOverrides
+    ];
   };
 
   path = lib.makeBinPath [
@@ -73,73 +61,6 @@ let
     poppler-utils
   ];
 
-  frontend = stdenv.mkDerivation (finalAttrs: {
-    pname = "paperless-ngx-frontend";
-    inherit version;
-
-    src = src + "/src-ui";
-
-    pnpmDeps = fetchPnpmDeps {
-      inherit pnpm;
-      inherit (finalAttrs) pname version src;
-      fetcherVersion = 3;
-      hash = "sha256-HO+IDNB3NXWgvV0cvZ5zx46JuXv6Tgroz+YfVump5MA=";
-    };
-
-    nativeBuildInputs = [
-      node-gyp
-      nodejs
-      pkg-config
-      pnpmConfigHook
-      pnpm
-      python3
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      xcbuild
-    ];
-
-    buildInputs = [
-      pango
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      giflib
-    ];
-
-    CYPRESS_INSTALL_BINARY = "0";
-    NG_CLI_ANALYTICS = "false";
-
-    buildPhase = ''
-      runHook preBuild
-
-      pushd node_modules/canvas
-      node-gyp rebuild
-      popd
-
-      # cat forcefully disables angular cli's spinner which doesn't work with nix' tty which is 0x0
-      pnpm run build --configuration production | cat
-
-      runHook postBuild
-    '';
-
-    doCheck = true;
-    checkPhase = ''
-      runHook preCheck
-
-      pnpm run test | cat
-
-      runHook postCheck
-    '';
-
-    installPhase = ''
-      runHook preInstall
-
-      mkdir -p $out/lib/paperless-ui
-      mv ../src/documents/static/frontend $out/lib/paperless-ui/
-
-      runHook postInstall
-    '';
-  });
-
   nltkDataDir = symlinkJoin {
     name = "paperless_ngx_nltk_data";
     paths = with nltk-data; [
@@ -149,11 +70,18 @@ let
     ];
   };
 in
-python.pkgs.buildPythonApplication rec {
+python.pkgs.buildPythonApplication (finalAttrs: {
   pname = "paperless-ngx";
   pyproject = true;
 
-  inherit version src;
+  version = "2.20.15";
+
+  src = fetchFromGitHub {
+    owner = "paperless-ngx";
+    repo = "paperless-ngx";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Czh4Knel0IIHsTc3kEnp1153Kv+3721GRCbTYTkeCDg=";
+  };
 
   postPatch = ''
     # pytest-xdist with to many threads makes the tests flaky
@@ -266,14 +194,14 @@ python.pkgs.buildPythonApplication rec {
 
   installPhase =
     let
-      pythonPath = python.pkgs.makePythonPath dependencies;
+      pythonPath = python.pkgs.makePythonPath finalAttrs.passthru.dependencies;
     in
     ''
       runHook preInstall
 
       mkdir -p $out/lib/paperless-ngx/static/frontend
       cp -r {src,static,LICENSE} $out/lib/paperless-ngx
-      lndir -silent ${frontend}/lib/paperless-ui/frontend $out/lib/paperless-ngx/static/frontend
+      lndir -silent ${finalAttrs.passthru.frontend}/lib/paperless-ui/frontend $out/lib/paperless-ngx/static/frontend
       chmod +x $out/lib/paperless-ngx/src/manage.py
       makeWrapper $out/lib/paperless-ngx/src/manage.py $out/bin/paperless-ngx \
         --prefix PYTHONPATH : "${pythonPath}" \
@@ -319,7 +247,7 @@ python.pkgs.buildPythonApplication rec {
     export PATH="${path}:$PATH"
     export HOME=$(mktemp -d)
     export XDG_DATA_DIRS="${liberation_ttf}/share:$XDG_DATA_DIRS"
-    export PAPERLESS_NLTK_DIR=${passthru.nltkDataDir}
+    export PAPERLESS_NLTK_DIR=${finalAttrs.passthru.nltkDataDir}
     # Limit threads per worker based on NIX_BUILD_CORES, capped at 256
     # ocrmypdf has an internal limit of 256 jobs and will fail with more:
     # https://github.com/ocrmypdf/OCRmyPDF/blob/66308c281306302fac3470f587814c3b212d0c40/src/ocrmypdf/cli.py#L234
@@ -351,20 +279,29 @@ python.pkgs.buildPythonApplication rec {
   doCheck = !stdenv.hostPlatform.isDarwin;
 
   passthru = {
+    frontend = callPackage ./frontend.nix {
+      inherit (finalAttrs) src version;
+      meta = removeAttrs finalAttrs.meta [ "mainProgram" ];
+    };
     inherit
-      frontend
       nltkDataDir
       path
       python
       tesseract5
       ;
     tests = { inherit (nixosTests) paperless; };
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--subpackage"
+        "frontend"
+      ];
+    };
   };
 
   meta = {
     description = "Tool to scan, index, and archive all of your physical documents";
     homepage = "https://docs.paperless-ngx.com/";
-    changelog = "https://github.com/paperless-ngx/paperless-ngx/releases/tag/${src.tag}";
+    changelog = "https://github.com/paperless-ngx/paperless-ngx/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl3Only;
     platforms = lib.platforms.unix;
     mainProgram = "paperless-ngx";
@@ -374,4 +311,4 @@ python.pkgs.buildPythonApplication rec {
       erikarvstedt
     ];
   };
-}
+})
diff --git a/pkgs/by-name/pr/pretix/package.nix b/pkgs/by-name/pr/pretix/package.nix
index 4ca8a8995841..22f3855b68e9 100644
--- a/pkgs/by-name/pr/pretix/package.nix
+++ b/pkgs/by-name/pr/pretix/package.nix
@@ -54,14 +54,14 @@ let
 in
 pythonPackages.buildPythonApplication (finalAttrs: {
   pname = "pretix";
-  version = "2026.5.3";
+  version = "2026.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pretix";
     repo = "pretix";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-R77jPwcRgu5+NBR9H0tD14QfbUtoHme6z9maYzDVmPg=";
+    hash = "sha256-yKJGJziMpOB8ttz0n4USay03wJTId77bYT7id4OgoIE=";
   };
 
   patches = [
@@ -87,7 +87,7 @@ pythonPackages.buildPythonApplication (finalAttrs: {
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-Gkcz/QJCNuvhIdZnP/mPx5GD0EOJzxoP1dGI43pyOro=";
+    hash = "sha256-DJCvNcgDIY71Q9qg4Ng7SAM9i9wHhHOdJonpt5t/Xx8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pr/pretix/plugins/fontpack-free/package.nix b/pkgs/by-name/pr/pretix/plugins/fontpack-free/package.nix
new file mode 100644
index 000000000000..2c4b91cc706f
--- /dev/null
+++ b/pkgs/by-name/pr/pretix/plugins/fontpack-free/package.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pretix-plugin-build,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pretix-fontpack-free";
+  version = "1.11.1";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "pretix";
+    repo = "pretix-fontpack-free";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-eeU8awLf/PSsLuAOobZhXVyQ3KM7jOEIz1ZLt4eDxzQ=";
+  };
+
+  build-system = [
+    pretix-plugin-build
+    setuptools
+  ];
+
+  pythonImportsCheck = [
+    "pretix_fontpackfree"
+  ];
+
+  meta = {
+    description = "Set of free fonts for pretix";
+    homepage = "https://github.com/pretix/pretix-fontpack-free";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ hexa ];
+  };
+})
diff --git a/pkgs/by-name/qo/qovery-cli/package.nix b/pkgs/by-name/qo/qovery-cli/package.nix
index 60c9f5d0b35a..47a33f715938 100644
--- a/pkgs/by-name/qo/qovery-cli/package.nix
+++ b/pkgs/by-name/qo/qovery-cli/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "qovery-cli";
-  version = "1.166.0";
+  version = "1.166.2";
 
   src = fetchFromGitHub {
     owner = "Qovery";
     repo = "qovery-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-orNVII6Y82YVtgEKpQnEpNXVWsg6P3sHluW1FGU20DA=";
+    hash = "sha256-GjfgdW5A2afQ46GfT3wjj+foxQEXsmI83NBaxU19uig=";
   };
 
   vendorHash = "sha256-fZqzHJa5VFC1z5ZaHCXNyIKbwLjb3pSEb9FHs4YhWZg=";
diff --git a/pkgs/by-name/rd/rdfind/package.nix b/pkgs/by-name/rd/rdfind/package.nix
index 107fc932af99..a88ebc058953 100644
--- a/pkgs/by-name/rd/rdfind/package.nix
+++ b/pkgs/by-name/rd/rdfind/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  autoreconfHook,
   nettle,
 }:
 
@@ -14,6 +15,11 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-eMRjFS4dnk/Rv+uDuckt9ef8TF+Tx9Qm+x9++ivk3yk=";
   };
 
+  # the built-in configure script was generated by autoconf 2.72 and
+  # passes -std=gnu++11 when using gcc 16 instead of the intended c++20.
+  # autoconf 2.73 fixes this, so we autoreconf to avoid this issue.
+  nativeBuildInputs = [ autoreconfHook ];
+
   buildInputs = [ nettle ];
 
   meta = {
diff --git a/pkgs/by-name/rd/rdup/package.nix b/pkgs/by-name/rd/rdup/package.nix
index 1649ad98882a..078aac483789 100644
--- a/pkgs/by-name/rd/rdup/package.nix
+++ b/pkgs/by-name/rd/rdup/package.nix
@@ -5,29 +5,38 @@
   pkg-config,
   autoreconfHook,
   glib,
-  pcre,
+  pcre2,
+  coreutils,
 }:
 
 stdenv.mkDerivation {
   pname = "rdup";
-  version = "1.1.15";
+  version = "1.1.16-unstable-2024-03-05";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+  enableParallelBuilding = true;
 
   src = fetchFromGitHub {
     owner = "miekg";
     repo = "rdup";
-    rev = "d66e4320cd0bbcc83253baddafe87f9e0e83caa6";
-    sha256 = "0bzyv6qmnivxnv9nw7lnfn46k0m1dlxcjj53zcva6v8y8084l1iw";
+    rev = "fa1c753a107c12b3797204c41779ce2c8d5da45a";
+    hash = "sha256-k+386SrXE0IULP02/aOa5E/F/HWhnD/ttGzFStric5M=";
   };
 
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
+    glib
   ];
+
   buildInputs = [
     glib
-    pcre
+    pcre2
   ];
 
+  installFlags = [ "INSTALL=${coreutils}/bin/install" ];
+
   meta = {
     description = "Only backup program that doesn't make backups";
     homepage = "https://github.com/miekg/rdup";
diff --git a/pkgs/by-name/sa/sage/patches/lower-sleep2-test-threshold.patch b/pkgs/by-name/sa/sage/patches/lower-sleep2-test-threshold.patch
new file mode 100644
index 000000000000..1ac7f5571baf
--- /dev/null
+++ b/pkgs/by-name/sa/sage/patches/lower-sleep2-test-threshold.patch
@@ -0,0 +1,32 @@
+diff --git a/src/sage/doctest/test.py b/src/sage/doctest/test.py
+index 812f8167c12..a4822642f0c 100644
+--- a/src/sage/doctest/test.py
++++ b/src/sage/doctest/test.py
+@@ -49,11 +49,11 @@ Check that :issue:`2235` has been fixed::
+ 
+ Check slow doctest warnings are correctly raised::
+ 
+-    sage: subprocess.call(["python3", "-m", "sage.doctest", "--warn-long",     # long time
++    sage: subprocess.call(["python3", "-m", "sage.doctest", "--warn-long", "0.2",     # long time
+     ....:       "--random-seed=0", "--optional=sage", "sleep2.rst"], **kwds)
+     Running doctests...
+     Doctesting 1 file.
+-    ... --warn-long --random-seed=0 sleep2.rst
++    ... --warn-long 0.2 --random-seed=0 sleep2.rst
+     **********************************************************************
+     File "sleep2.rst", line 4, in sage.doctest.tests.sleep2
+     Warning: slow doctest:
+@@ -66,11 +66,11 @@ Check slow doctest warnings are correctly raised::
+     ----------------------------------------------------------------------
+     ...
+     0
+-    sage: subprocess.call(["python3", "-m", "sage.doctest", "--format=github", "--warn-long",     # long time
++    sage: subprocess.call(["python3", "-m", "sage.doctest", "--format=github", "--warn-long", "0.2",    # long time
+     ....:       "--random-seed=0", "--optional=sage", "sleep2.rst"], **kwds)
+     Running doctests...
+     Doctesting 1 file.
+-    ... --warn-long --random-seed=0 sleep2.rst
++    ... --warn-long 0.2 --random-seed=0 sleep2.rst
+     **********************************************************************
+     ::warning title=Warning: slow doctest:,file=sleep2.rst,line=4::slow doctest:: Test ran for ...s cpu, ...s wall%0ACheck ran for ...s cpu, ...s wall%0A
+         while walltime(t) < 2: pass
diff --git a/pkgs/by-name/sa/sage/sage-src.nix b/pkgs/by-name/sa/sage/sage-src.nix
index eae82d4c9d6e..7362bf8f3897 100644
--- a/pkgs/by-name/sa/sage/sage-src.nix
+++ b/pkgs/by-name/sa/sage/sage-src.nix
@@ -78,6 +78,9 @@ stdenv.mkDerivation rec {
     # a more conservative version of https://github.com/sagemath/sage/pull/37951
     ./patches/gap-element-crash.patch
 
+    # https://github.com/sagemath/sage/issues/42473
+    ./patches/lower-sleep2-test-threshold.patch
+
     # https://github.com/sagemath/sage/pull/42009, landed in 10.10.beta0
     (fetchpatch2 {
       name = "gap-root-paths.patch";
diff --git a/pkgs/by-name/sc/scss-lint/Gemfile.lock b/pkgs/by-name/sc/scss-lint/Gemfile.lock
index 8f6ebd379216..7b9e58ae45e4 100644
--- a/pkgs/by-name/sc/scss-lint/Gemfile.lock
+++ b/pkgs/by-name/sc/scss-lint/Gemfile.lock
@@ -1,7 +1,7 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    ffi (1.17.2)
+    ffi (1.17.4)
     rb-fsevent (0.11.2)
     rb-inotify (0.11.1)
       ffi (~> 1.0)
@@ -20,4 +20,4 @@ DEPENDENCIES
   scss_lint
 
 BUNDLED WITH
-   2.7.1
+   2.7.2
diff --git a/pkgs/by-name/sc/scss-lint/gemset.nix b/pkgs/by-name/sc/scss-lint/gemset.nix
index 7300ead8b4b2..4a8ff7693705 100644
--- a/pkgs/by-name/sc/scss-lint/gemset.nix
+++ b/pkgs/by-name/sc/scss-lint/gemset.nix
@@ -4,10 +4,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "19kdyjg3kv7x0ad4xsd4swy5izsbb1vl1rpb6qqcqisr5s23awi9";
+      sha256 = "1kqasqvy8d7r09ri4n6bkdwbk63j7afd9ilsw34nzlgh0qp69ldw";
       type = "gem";
     };
-    version = "1.17.2";
+    version = "1.17.4";
   };
   rb-fsevent = {
     groups = [ "default" ];
diff --git a/pkgs/by-name/sp/spotube/package.nix b/pkgs/by-name/sp/spotube/package.nix
index 1e7ad8ec566b..2cf5e96731a7 100644
--- a/pkgs/by-name/sp/spotube/package.nix
+++ b/pkgs/by-name/sp/spotube/package.nix
@@ -22,7 +22,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spotube";
-  version = "5.1.1";
+  version = "5.1.2";
 
   src = finalAttrs.passthru.sources.${stdenv.hostPlatform.system};
 
@@ -87,19 +87,19 @@ stdenv.mkDerivation (finalAttrs: {
     {
       "aarch64-linux" = fetchArtifact {
         suffix = "linux-aarch64.deb";
-        hash = "sha256-Wn+eE8nkHXRBZYVw+sm+Nxf75nK/JJ8bnVK7YZ0O47A=";
+        hash = "sha256-cb9qPNJ1wB3zURvBCLEJIr+L4BGYwtgjAezSRm4QQDE=";
       };
       "x86_64-linux" = fetchArtifact {
         suffix = "linux-x86_64.deb";
-        hash = "sha256-jzi1HPJErDhZwt1Eu1lzG29QaAw3vL+PVRNDVBxn7ZQ=";
+        hash = "sha256-FEb5mPmGOAMw4nnFJ0kC+ymg4zBdUXWjvIO0sGOS6M0=";
       };
       "x86_64-darwin" = fetchArtifact {
         suffix = "macos-universal.dmg";
-        hash = "sha256-kUQdLWawtIVhzeO5NfUa435JOf7/SCVBhSKfQh3J96I=";
+        hash = "sha256-J2J9/UQZAECvGmumqGzcRFA5kpakOmFpQKlK5oesCRM=";
       };
       "aarch64-darwin" = fetchArtifact {
         suffix = "macos-universal.dmg";
-        hash = "sha256-kUQdLWawtIVhzeO5NfUa435JOf7/SCVBhSKfQh3J96I=";
+        hash = "sha256-J2J9/UQZAECvGmumqGzcRFA5kpakOmFpQKlK5oesCRM=";
       };
     };
 
diff --git a/pkgs/by-name/st/steam-lancache-prefill/deps.json b/pkgs/by-name/st/steam-lancache-prefill/deps.json
index 03ae8464bfbc..072c50f1a7da 100644
--- a/pkgs/by-name/st/steam-lancache-prefill/deps.json
+++ b/pkgs/by-name/st/steam-lancache-prefill/deps.json
@@ -136,8 +136,8 @@
   },
   {
     "pname": "Spectre.Console",
-    "version": "0.49.2-preview.0.67",
-    "hash": "sha256-e1BrfX8ME8Ob7ZVKx8VYExKNvLzHHxNJ1R+Yv2lVE3A="
+    "version": "0.51.1",
+    "hash": "sha256-FQAK07dEwEsNYVI1T3S488LHv8AXJ+ZeA9N2hPpWBoo="
   },
   {
     "pname": "Spectre.Console.Analyzer",
diff --git a/pkgs/by-name/st/steam-lancache-prefill/package.nix b/pkgs/by-name/st/steam-lancache-prefill/package.nix
index 9c4cc31e6018..db96a6b71858 100644
--- a/pkgs/by-name/st/steam-lancache-prefill/package.nix
+++ b/pkgs/by-name/st/steam-lancache-prefill/package.nix
@@ -10,13 +10,13 @@
 
 buildDotnetModule (finalAttrs: {
   pname = "steam-lancache-prefill";
-  version = "3.4.2";
+  version = "3.5.1";
 
   src = fetchFromGitHub {
     owner = "tpill90";
     repo = "steam-lancache-prefill";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FD7rC73VF+jhdCrSPKEillRXAi7jbY+h+oHi0Bpng3k=";
+    hash = "sha256-BDJB4kubcA9Uu84CubZ0uyKYwYWQYq+pBJa0t0q481Y=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/to/tofu-ls/package.nix b/pkgs/by-name/to/tofu-ls/package.nix
index 00c2ba918d7a..e881984bea59 100644
--- a/pkgs/by-name/to/tofu-ls/package.nix
+++ b/pkgs/by-name/to/tofu-ls/package.nix
@@ -8,7 +8,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "tofu-ls";
-  version = "0.5.0";
+  version = "0.5.1";
 
   __structuredAttrs = true;
 
@@ -16,10 +16,10 @@ buildGoModule (finalAttrs: {
     owner = "opentofu";
     repo = "tofu-ls";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-v6oqCRsiTAOGqhVZD6Zwhq0/bSl55PhH9+aEYxjlQcA=";
+    hash = "sha256-lmTvFtgXV8u4GNR3Bof+bfLMoq+luFdT1YeQq7ooLg8=";
   };
 
-  vendorHash = "sha256-vugyEaOD7diOiymo9nDEfIez++mPYWq1qVj3a9wCqoc=";
+  vendorHash = "sha256-+yG4Tz29NJ3m2is0ERMqW8vC/HJv4uudyDg9KSA/z/o=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/va/vault/package.nix b/pkgs/by-name/va/vault/package.nix
index 034215dbe73b..ec92e58ba9d9 100644
--- a/pkgs/by-name/va/vault/package.nix
+++ b/pkgs/by-name/va/vault/package.nix
@@ -12,16 +12,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "vault";
-  version = "1.21.4";
+  version = "2.0.3";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "vault";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-1yBvcGKzLZYFWlZJL1iJgDFkiT4g2f84iZCjWi2CwDg=";
+    hash = "sha256-s6Muogxe+jvre1qZYRiSGTDgMf0+BVsSOwyxF6+Aa2o=";
   };
 
-  vendorHash = "sha256-LxWqJroDfGqqCrTej+jkpxEO/+ipXuqSPB2R3bg2v10=";
+  vendorHash = "sha256-utF/CgWNtJNin5NIq7ZGjNc7YbjAuN5nm/G57uQal94=";
 
   proxyVendor = true;
 
diff --git a/pkgs/by-name/wa/wasilibc/0000-relax-version-bounds.patch b/pkgs/by-name/wa/wasilibc/0000-relax-version-bounds.patch
new file mode 100644
index 000000000000..3a11547a763e
--- /dev/null
+++ b/pkgs/by-name/wa/wasilibc/0000-relax-version-bounds.patch
@@ -0,0 +1,39 @@
+Commit ID: bf0251709e0440ff00036298d94177a72382979d
+Change ID: nukukykqkzqunwukokzxwlxrpxptuwzm
+Author   : Sam Pointon <sampointon@gmail.com> (2026-06-17 09:26:00)
+Committer: Sam Pointon <sampointon@gmail.com> (2026-06-17 09:27:26)
+
+    Relax strict version bounds on tools
+
+    Nixpkgs has more recent versions of these, and they work fine.
+
+diff --git a/cmake/bindings.cmake b/cmake/bindings.cmake
+index a629ecd006..14fdb8aed3 100644
+--- a/cmake/bindings.cmake
++++ b/cmake/bindings.cmake
+@@ -15,10 +15,6 @@
+     OUTPUT_VARIABLE WIT_BINDGEN_VERSION
+     OUTPUT_STRIP_TRAILING_WHITESPACE)
+ 
+-  if (NOT (WIT_BINDGEN_VERSION MATCHES "0\\.53\\.1"))
+-    message(WARNING "wit-bindgen version 0.53.1 is required, found: ${WIT_BINDGEN_VERSION}")
+-    set(WIT_BINDGEN_EXECUTABLE "")
+-  endif()
+ endif()
+ 
+ if (NOT WIT_BINDGEN_EXECUTABLE)
+diff --git a/cmake/wasi-wits.cmake b/cmake/wasi-wits.cmake
+index e21ab0258d..d72ed9bcc2 100644
+--- a/cmake/wasi-wits.cmake
++++ b/cmake/wasi-wits.cmake
+@@ -12,10 +12,6 @@
+     OUTPUT_VARIABLE WKG_VERSION
+     OUTPUT_STRIP_TRAILING_WHITESPACE)
+ 
+-  if (NOT (WKG_VERSION MATCHES "0\\.13\\.0"))
+-    message(WARNING "wkg version 0.13.0 is required, found: ${WKG_VERSION}")
+-    set(WKG_EXECUTABLE "")
+-  endif()
+ endif()
+ 
+ if (NOT WKG_EXECUTABLE)
diff --git a/pkgs/by-name/wa/wasilibc/package.nix b/pkgs/by-name/wa/wasilibc/package.nix
index 1745a80f2916..a9dcd85aed88 100644
--- a/pkgs/by-name/wa/wasilibc/package.nix
+++ b/pkgs/by-name/wa/wasilibc/package.nix
@@ -1,72 +1,78 @@
 {
   stdenvNoLibc,
+  cmake,
   fetchFromGitHub,
   lib,
+  lld,
+  llvmPackages,
+  ninja,
+  wasm-tools,
+  wit-bindgen,
+  wkg,
   firefox-unwrapped,
   firefox-esr-unwrapped,
-  enablePosixThreads ? false,
 }:
 
 stdenvNoLibc.mkDerivation (finalAttrs: {
   pname = "wasilibc";
-  version = "27";
+  version = "32";
+
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "WebAssembly";
     repo = "wasi-libc";
     tag = "wasi-sdk-${finalAttrs.version}";
-    hash = "sha256-RIjph1XdYc1aGywKks5JApcLajbNFEuWm+Wy/GMHddg=";
+    hash = "sha256-iP/SFYvO8zQMwwbY4VvIboO+Kx195L9brpMq8cbsA7c=";
     fetchSubmodules = true;
   };
 
-  # These flags break pkgsCross.wasi32.llvmPackages.libcxx
-  hardeningDisable = [
-    "libcxxhardeningfast"
-    "libcxxhardeningextensive"
+  patches = [
+    ./0000-relax-version-bounds.patch
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    lld
+    ninja
+    wasm-tools
+    wit-bindgen
+    wkg
   ];
 
   outputs = [
     "out"
     "dev"
-    "share"
   ];
 
-  # clang-13: error: argument unused during compilation: '-rtlib=compiler-rt' [-Werror,-Wunused-command-line-argument]
-  postPatch = ''
-    substituteInPlace Makefile \
-      --replace "-Werror" ""
-    patchShebangs scripts/
-  '';
-
-  preBuild = ''
-    export SYSROOT_LIB=${placeholder "out"}/lib
-    export SYSROOT_INC=${placeholder "dev"}/include
-    export SYSROOT_SHARE=${placeholder "share"}/share
-    mkdir -p "$SYSROOT_LIB" "$SYSROOT_INC" "$SYSROOT_SHARE"
-    makeFlagsArray+=(
-      "SYSROOT_LIB:=$SYSROOT_LIB"
-      "SYSROOT_INC:=$SYSROOT_INC"
-      "SYSROOT_SHARE:=$SYSROOT_SHARE"
-      "TARGET_TRIPLE:=${stdenvNoLibc.system}"
-      ${lib.strings.optionalString enablePosixThreads "THREAD_MODEL:=posix"}
-    )
-  '';
+  cmakeFlags = [
+    (lib.cmakeFeature "BUILTINS_LIB" "${llvmPackages.compiler-rt}/lib/${stdenvNoLibc.targetPlatform.parsed.kernel.name}/libclang_rt.builtins-wasm32.a")
+    #https://stackoverflow.com/questions/53633705/cmake-the-c-compiler-is-not-able-to-compile-a-simple-test-program
+    (lib.cmakeFeature "CMAKE_TRY_COMPILE_TARGET_TYPE" "STATIC_LIBRARY")
+    (lib.cmakeFeature "TARGET_TRIPLE" stdenvNoLibc.system)
+    # clang already knows to use wasm-component-ld to link
+    (lib.cmakeFeature "USE_WASM_COMPONENT_LD" "OFF")
+  ];
 
   enableParallelBuilding = true;
 
-  # We just build right into the install paths, per the `preBuild`.
-  dontInstall = true;
+  preFixup =
+    lib.optionalString (stdenvNoLibc.system != stdenvNoLibc.targetPlatform.rust.rustcTargetSpec)
+      ''
+        ln -s $out/lib/${stdenvNoLibc.system} $out/lib/${stdenvNoLibc.targetPlatform.rust.rustcTargetSpec}
+      '';
 
-  preFixup = ''
-    ln -s $share/share/undefined-symbols.txt $out/lib/wasi.imports
-    ln -s $out/lib $out/lib/${stdenvNoLibc.system}
-  ''
-  + lib.optionalString (stdenvNoLibc.system != stdenvNoLibc.targetPlatform.rust.rustcTargetSpec) ''
-    ln -s $out/lib $out/lib/${stdenvNoLibc.targetPlatform.rust.rustcTargetSpec}
-  '';
+  # TODO: run wasilibc tests. Nixpkgs never runs the check phase during cross compiles
+  # (sensibly), but this package is always cross compiled due to its nature, and the tests
+  # expect to be run in a cross-compilation environment. There are instructions on how to run
+  # them but I don't understand enough about Nixpkgs' CMake set-up to work out how to apply them.
 
-  passthru.tests = {
-    inherit firefox-unwrapped firefox-esr-unwrapped;
+  passthru = {
+    incdir = "/include/${stdenvNoLibc.system}";
+    libdir = "/lib/${stdenvNoLibc.system}";
+    tests = {
+      inherit firefox-unwrapped firefox-esr-unwrapped;
+    };
   };
 
   meta = {
diff --git a/pkgs/by-name/wa/wasm-component-ld/package.nix b/pkgs/by-name/wa/wasm-component-ld/package.nix
new file mode 100644
index 000000000000..ccc96dd71141
--- /dev/null
+++ b/pkgs/by-name/wa/wasm-component-ld/package.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "wasm-component-ld";
+  version = "0.5.25";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "bytecodealliance";
+    repo = "wasm-component-ld";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-EQqNm3GRuMafbrOyzsdZ5e1pX4LH40wCyKVgSgm8A48=";
+  };
+
+  cargoHash = "sha256-1e54TLWGjfNORwr6uLIe/XhdDDOkbalw/6/0UGuBiPk=";
+
+  # Tests require a rustc that can target wasm32-wasip1, including std. This is awkward for
+  # Nixpkgs to provide at the same time as providing a rustc that's targetting the actual target.
+  # TODO: work around by patching the test suite to invoke pkgsBuildTarget.rustc rather than just looking in PATH for any old rustc
+  doCheck = false;
+
+  meta = {
+    description = "Command line linker for creating WebAssembly components";
+    homepage = "https://github.com/bytecodealliance/wasm-component-ld";
+    license = with lib.licenses; [
+      asl20
+      llvm-exception
+      mit
+    ];
+    maintainers = with lib.maintainers; [
+      sepointon
+    ];
+    mainProgram = "wasm-component-ld";
+  };
+})
diff --git a/pkgs/by-name/we/webwormhole/package.nix b/pkgs/by-name/we/webwormhole/package.nix
index 45b53957b34f..45e0fe8f204b 100644
--- a/pkgs/by-name/we/webwormhole/package.nix
+++ b/pkgs/by-name/we/webwormhole/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule {
   pname = "webwormhole";
-  version = "0-unstable-2023-11-15";
+  version = "0-unstable-2025-12-22";
 
   src = fetchFromGitHub {
     owner = "saljam";
     repo = "webwormhole";
-    rev = "6ceee76274ee881e828bd48c5cc15c758b9ad77c";
-    hash = "sha256-C9r6wFhP5BkIClgTQol7LyMUHXOzyrX9Pn91VqBaqFQ=";
+    rev = "abf852af0458ba79772d9c26ef01434165f217d8";
+    hash = "sha256-hP5MtIoGod3FS4TipNkgoyo43HWnywPintqpjmvrTc8=";
   };
 
-  vendorHash = "sha256-+7ctAm2wnjmfMd6CHXlcAUwiUMS7cH4koDAvlEUAXEg=";
+  vendorHash = "sha256-ULlaicl4o/YyHSS64Q2hsl5l5Mm3C6cBG8zaxrEijOU=";
 
   meta = {
     description = "Send files using peer authenticated WebRTC";
diff --git a/pkgs/by-name/wp/wp-scanner/package.nix b/pkgs/by-name/wp/wp-scanner/package.nix
new file mode 100644
index 000000000000..ea61d89e93ad
--- /dev/null
+++ b/pkgs/by-name/wp/wp-scanner/package.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+  python3,
+}:
+
+python3.pkgs.buildPythonApplication (finalAttrs: {
+  pname = "wp-scanner";
+  version = "2.0.1-unstable-2026-03-17";
+  pyproject = false;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "Triotion";
+    repo = "WP-Scanner";
+    rev = "1f75728384ca5422f69cf5f1d0a284c36b0ed45a";
+    hash = "sha256-gIfOxoiVdRKa2GGDy9GMi7+6u2Lh/yVdin/hY9lh4bs=";
+  };
+
+  dependencies = with python3.pkgs; [
+    beautifulsoup4
+    colorama
+    lxml
+    packaging
+    python-dateutil
+    requests
+    tqdm
+    urllib3
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -vD wp_scanner.py $out/bin/wp-scanner
+    install -vd $out/${python3.sitePackages}/
+    cp -R data modules $out/${python3.sitePackages}
+
+    runHook postInstall
+  '';
+
+  # Project has no tests
+  doCheck = false;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Wordpress Security Scanner and Auto Exploiter";
+    homepage = "https://github.com/Triotion/WP-Scanner";
+    # https://github.com/Triotion/WP-Scanner/issues/2
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "wp-scanner";
+  };
+})
diff --git a/pkgs/by-name/ys/yscan/package.nix b/pkgs/by-name/ys/yscan/package.nix
new file mode 100644
index 000000000000..287154072164
--- /dev/null
+++ b/pkgs/by-name/ys/yscan/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  fetchpatch2,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "yscan";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "yetidevworks";
+    repo = "yscan";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-dIRtqn6vismwgQUwfK5KzApBDBlAmOt+mfdBY8sr47g=";
+  };
+
+  __structuredAttrs = true;
+
+  cargoPatches = [
+    # https://github.com/yetidevworks/yscan/pull/2
+    (fetchpatch2 {
+      name = "cargo-lock.patch";
+      url = "https://github.com/yetidevworks/yscan/commit/54c0d9f008e0a9205ff639db8223c0a89fe72f34.patch?full_index=1";
+      hash = "sha256-n1JthKGLAS+Rx4BiLNwtRNZ4NHpS0Azv6uThjQgWqJg=";
+    })
+  ];
+
+  cargoHash = "sha256-nQV0vtx2hwKxysSHNB6j9d6JSuFlFFqtZr2hPciyo40=";
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  doInstallCheck = true;
+
+  meta = {
+    description = "TUI IP and Port Scanner";
+    homepage = "https://github.com/yetidevworks/yscan";
+    changelog = "https://github.com/yetidevworks/yscan/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "yscan";
+  };
+})
diff --git a/pkgs/by-name/ze/zennotes-desktop/package.nix b/pkgs/by-name/ze/zennotes-desktop/package.nix
index 1a43598fbd3a..4264cd2d426c 100644
--- a/pkgs/by-name/ze/zennotes-desktop/package.nix
+++ b/pkgs/by-name/ze/zennotes-desktop/package.nix
@@ -13,14 +13,14 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "zennotes-desktop";
-  version = "2.3.0";
-  npmDepsHash = "sha256-7IpGnxVjaJvfSZyKjOylGMhFqa1bx8Ry5O1yqYfNnCE=";
+  version = "2.8.0";
+  npmDepsHash = "sha256-4YEBo/8HIMcvlj36ACv5r9iN995/QX2mc6vwTZh4AV8=";
 
   src = fetchFromGitHub {
     owner = "ZenNotes";
     repo = "zennotes";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+tLPVnnMbtMa5blSwHav9ZMlnkUsrdG62mMGxhbmy6g=";
+    hash = "sha256-cVFiL1SNMmLZQyce83hNbE7NLuTPIQqNhDaeiUkK+mo=";
   };
 
   npmWorkspace = "apps/desktop";
@@ -86,7 +86,10 @@ buildNpmPackage (finalAttrs: {
     homepage = "https://zennotes.org/";
     changelog = "https://github.com/ZenNotes/zennotes/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ justkrysteq ];
+    maintainers = with lib.maintainers; [
+      justkrysteq
+      Br1ght0ne
+    ];
     mainProgram = "zennotes-desktop";
     platforms = lib.platforms.darwin ++ lib.platforms.linux;
   };
diff --git a/pkgs/development/python-modules/alibabacloud-ecs20140526/default.nix b/pkgs/development/python-modules/alibabacloud-ecs20140526/default.nix
index cb33051d3649..92ac4d69c58a 100644
--- a/pkgs/development/python-modules/alibabacloud-ecs20140526/default.nix
+++ b/pkgs/development/python-modules/alibabacloud-ecs20140526/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "alibabacloud-ecs20140526";
-  version = "7.8.7";
+  version = "7.9.0";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -17,7 +17,7 @@ buildPythonPackage (finalAttrs: {
   src = fetchPypi {
     pname = "alibabacloud_ecs20140526";
     inherit (finalAttrs) version;
-    hash = "sha256-78QeY9Qpcwf71EelPt0wP+KUg3foUUSynhCcn+ofbGc=";
+    hash = "sha256-m1eaDj6VLGwJwfF3Dg6nN+YISHQuY+ij7uJ1KMFKvDU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index a3b4e459a23d..6360263fefa4 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "boto3-stubs";
-  version = "1.43.38";
+  version = "1.43.39";
   pyproject = true;
 
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit (finalAttrs) version;
-    hash = "sha256-VXAQCPqRDWCqKlk6owfRIchakaiSyyQYK8+OxB8pqfU=";
+    hash = "sha256-PzXmBl1uo+oNEuh1PFJ3BDqQiPRjL7vzF8DE9eBx5mM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/cvxpy/default.nix b/pkgs/development/python-modules/cvxpy/default.nix
index 9fad43a2f257..90ff31cb0d2c 100644
--- a/pkgs/development/python-modules/cvxpy/default.nix
+++ b/pkgs/development/python-modules/cvxpy/default.nix
@@ -28,7 +28,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "cvxpy";
-  version = "1.9.1";
+  version = "1.9.2";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -36,7 +36,7 @@ buildPythonPackage (finalAttrs: {
     owner = "cvxpy";
     repo = "cvxpy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xQ2WD0S4GiFLYqQlOE+3V23bIs7AqJY6Xn9m4sjc10I=";
+    hash = "sha256-nYfS9HXWTKcvVrq+wm5cgvB7keMAQPmKEe8bI0jngFg=";
   };
 
   postPatch =
diff --git a/pkgs/development/python-modules/deebot-client/default.nix b/pkgs/development/python-modules/deebot-client/default.nix
index 6357af360a4f..2d0a0e2670e5 100644
--- a/pkgs/development/python-modules/deebot-client/default.nix
+++ b/pkgs/development/python-modules/deebot-client/default.nix
@@ -22,21 +22,21 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "deebot-client";
-  version = "18.3.0";
+  version = "18.4.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.13";
+  disabled = pythonOlder "3.14";
 
   src = fetchFromGitHub {
     owner = "DeebotUniverse";
     repo = "client.py";
     tag = finalAttrs.version;
-    hash = "sha256-dQh98CIEbxpRga2BbB8X1KtGZ18jvVv4DhyJ1LFNNuw=";
+    hash = "sha256-SFOwIK1rjvbLw5W0d6vzXVUDlUOlBYOu/GMvlwwFDs0=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-MNMLOF3j+bGEhDeRln5wLOG6gY+ssSQqrb8vdmyJdtA=";
+    hash = "sha256-mvHHwfeP7k8bvOMFcNTn7wZlumMJ8wx7H+p8SNreIuE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/django-vtasks/default.nix b/pkgs/development/python-modules/django-vtasks/default.nix
index d890b5894ef3..f582ae5992e9 100644
--- a/pkgs/development/python-modules/django-vtasks/default.nix
+++ b/pkgs/development/python-modules/django-vtasks/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "django-vtasks";
-  version = "2.1.1";
+  version = "2.1.2";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "glitchtip";
     repo = "django-vtasks";
     tag = "v${version}";
-    hash = "sha256-f9x6atPMYgQQ/jpCJdDj33l+mhyei+6IWi4bqqVWxU8=";
+    hash = "sha256-L2desiA5ZSdW6KcWuJ4UmtqDVuvAFeRplLgJex7inVM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/env-canada/default.nix b/pkgs/development/python-modules/env-canada/default.nix
index d7bdcb34d671..f87f56c944ee 100644
--- a/pkgs/development/python-modules/env-canada/default.nix
+++ b/pkgs/development/python-modules/env-canada/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "env-canada";
-  version = "0.15.0";
+  version = "0.16.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "michaeldavie";
     repo = "env_canada";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iiNsbXvZPLCJ0BzPYCs6UEZIm1S0tEqi3ClY7vX6le4=";
+    hash = "sha256-99kf2A8nkxWZmhgD/x3YipYpxAJej5RjBTGomS/U8EQ=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/faraday-agent-parameters-types/default.nix b/pkgs/development/python-modules/faraday-agent-parameters-types/default.nix
index acfc96d9db60..6f2a1f3d3678 100644
--- a/pkgs/development/python-modules/faraday-agent-parameters-types/default.nix
+++ b/pkgs/development/python-modules/faraday-agent-parameters-types/default.nix
@@ -3,31 +3,13 @@
   buildPythonPackage,
   fetchFromGitHub,
   flit-core,
+  marshmallow,
   packaging,
   pytestCheckHook,
   setuptools,
   validators,
 }:
-let
-  marshmallow' = buildPythonPackage {
-    pname = "marshmallow";
-    version = "3.26.2";
-    pyproject = true;
 
-    src = fetchFromGitHub {
-      owner = "marshmallow-code";
-      repo = "marshmallow";
-      tag = "3.26.2";
-      hash = "sha256-ioe+aZHOW8r3wF3UknbTjAP0dEggd/NL9PTkPVQ46zM=";
-    };
-
-    build-system = [ flit-core ];
-
-    doCheck = false;
-
-    pythonImportsCheck = [ "marshmallow" ];
-  };
-in
 buildPythonPackage (finalAttrs: {
   pname = "faraday-agent-parameters-types";
   version = "1.9.1";
@@ -40,7 +22,10 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-Oe/9/zKOoCLK3JHMacOhk2+d91MrhzkBTW3POoFm71M=";
   };
 
-  pythonRelaxDeps = [ "validators" ];
+  pythonRelaxDeps = [
+    "marshmallow"
+    "validators"
+  ];
 
   postPatch = ''
     substituteInPlace setup.py \
@@ -50,7 +35,7 @@ buildPythonPackage (finalAttrs: {
   build-system = [ setuptools ];
 
   dependencies = [
-    marshmallow'
+    marshmallow
     packaging
     validators
   ];
@@ -65,12 +50,16 @@ buildPythonPackage (finalAttrs: {
   disabledTests = [
     # assert 'Version requested not valid' in "Invalid version: 'hola'"
     "test_incorrect_version_requested"
+    # Tests are outdated
+    "test_deserialize"
+    "test_invalid_data"
+    "test_serialize"
   ];
 
   meta = {
     description = "Collection of Faraday agent parameters types";
     homepage = "https://github.com/infobyte/faraday_agent_parameters_types";
-    changelog = "https://github.com/infobyte/faraday_agent_parameters_types/blob/${finalAttrs.version}/CHANGELOG.md";
+    changelog = "https://github.com/infobyte/faraday_agent_parameters_types/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/granian/default.nix b/pkgs/development/python-modules/granian/default.nix
index aceaea74a293..b015bead770d 100644
--- a/pkgs/development/python-modules/granian/default.nix
+++ b/pkgs/development/python-modules/granian/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "granian";
-  version = "2.7.5";
+  version = "2.7.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "emmett-framework";
     repo = "granian";
     tag = "v${version}";
-    hash = "sha256-6NOag3PHI4BOi5JuulRqhKeyDWuMxxu0bfb8ViQxDWY=";
+    hash = "sha256-89Kl/MrotK0fv0oAayUuZXyLLG9PPM1km57ER+dM1jw=";
   };
 
   # Granian forces a custom allocator for all the things it runs,
@@ -40,7 +40,7 @@ buildPythonPackage rec {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-R4thKT3lMo/CFv+CokGSDzynTKOMCLRjVEy7Ojip4qA=";
+    hash = "sha256-mnqtzZ2+xuxUezhsgw+gr6MmWbi4Z4j0bHndys6vHFw=";
   };
 
   nativeBuildInputs = with rustPlatform; [
diff --git a/pkgs/development/python-modules/granian/no-alloc.patch b/pkgs/development/python-modules/granian/no-alloc.patch
index d6b01f9475b1..bd885bab87ed 100644
--- a/pkgs/development/python-modules/granian/no-alloc.patch
+++ b/pkgs/development/python-modules/granian/no-alloc.patch
@@ -1,5 +1,5 @@
 diff --git a/Cargo.toml b/Cargo.toml
-index e1b6a3d..8fe77cf 100644
+index a33fb2c..8426d66 100644
 --- a/Cargo.toml
 +++ b/Cargo.toml
 @@ -46,3 +46,2 @@ itertools = "0.14"
@@ -7,8 +7,8 @@ index e1b6a3d..8fe77cf 100644
 -mimalloc = { version = "0.1.49", default-features = false, features = ["local_dynamic_tls"], optional = true }
  mime_guess = "=2.0"
 @@ -58,3 +57,2 @@ socket2 = { version = "=0.6", features = ["all"] }
- sysinfo = "=0.38"
--tikv-jemallocator = { version = "0.6.0", default-features = false, features = ["disable_initial_exec_tls"], optional = true }
+ sysinfo = "=0.39"
+-tikv-jemallocator = { version = "=0.7", default-features = false, features = ["disable_initial_exec_tls"], optional = true }
  tls-listener = { version = "=0.11", git = "https://github.com/gi0baro/tls-listener.git", branch = "0.11.x", features = ["rustls-ring", "rustls-tls12"] }
 @@ -68,6 +66,2 @@ pyo3-build-config = "=0.27"
  
diff --git a/pkgs/development/python-modules/iocx/default.nix b/pkgs/development/python-modules/iocx/default.nix
index 15f6d1537c75..c66f5013ab83 100644
--- a/pkgs/development/python-modules/iocx/default.nix
+++ b/pkgs/development/python-modules/iocx/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iocx";
-  version = "0.7.4.1";
+  version = "0.7.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "iocx-dev";
     repo = "iocx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bSfmAAsVgtyCapcc9k4ky+nAFZV6GUf/EX1Ht8TOEg4=";
+    hash = "sha256-j7GApoKh0LBTWMLnapqzRncDFLu+89wLeNmSHxflcks=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/mediapy/default.nix b/pkgs/development/python-modules/mediapy/default.nix
index de5dc2ed90eb..1081b0cc331e 100644
--- a/pkgs/development/python-modules/mediapy/default.nix
+++ b/pkgs/development/python-modules/mediapy/default.nix
@@ -1,40 +1,62 @@
 {
   lib,
+  bash,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   flit-core,
   ipython,
   matplotlib,
   numpy,
   pillow,
+  absl-py,
+  ffmpeg-headless,
+  pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "mediapy";
-  version = "1.2.5";
+  version = "1.2.7";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-LHpMUXBLJmQnNxkKbl++qCYLAn/enZnGRKZwJVquhg8=";
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = "mediapy";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-+p88Zc7YuN0P4i1AzTQfQqCFo6Uc6hpDKgoDpdJxMaI=";
   };
 
-  nativeBuildInputs = [ flit-core ];
+  postPatch = ''
+    substituteInPlace mediapy_test.py \
+      --replace-fail "/bin/bash" "${lib.getExe bash}"
+  '';
 
-  propagatedBuildInputs = [
+  build-system = [ flit-core ];
+
+  dependencies = [
     ipython
     matplotlib
     numpy
     pillow
   ];
 
+  nativeCheckInputs = [
+    absl-py
+    ffmpeg-headless
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # AssertionError: np.float64(148.75258355982479) not less than 51.2
+    "test_video_read_write_10bit"
+  ];
+
   pythonImportsCheck = [ "mediapy" ];
 
   meta = {
     description = "Read/write/show images and videos in an IPython notebook";
     homepage = "https://github.com/google/mediapy";
-    changelog = "https://github.com/google/mediapy/releases/tag/v${version}";
+    changelog = "https://github.com/google/mediapy/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ mcwitt ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index d39b1d63dd10..a2761d3eb7ad 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -211,8 +211,8 @@ in
       "sha256-m7y4NwYn4tNtJ2V8wlXSkOMdhTrNFZUWXc8g1yqLFGA=";
 
   mypy-boto3-cloud9 =
-    buildMypyBoto3Package "cloud9" "1.43.0"
-      "sha256-76N3xUFKaU+cepHviRw2SWdjptNmVZkg6giAF7B1b5s=";
+    buildMypyBoto3Package "cloud9" "1.43.39"
+      "sha256-n+O246n0LbH1Tc8QK93YRO2Cxj9pz8nfAetvq1lidj8=";
 
   mypy-boto3-cloudcontrol =
     buildMypyBoto3Package "cloudcontrol" "1.43.0"
@@ -335,8 +335,8 @@ in
       "sha256-6FyB/VCGsMYDBFUu0VzWpge94lASfg6CVewhkmpxycQ=";
 
   mypy-boto3-connect =
-    buildMypyBoto3Package "connect" "1.43.38"
-      "sha256-EpBR0OFb96qnM0+ToMfr9KyB7oTy7FkNAZqqIbEKG9w=";
+    buildMypyBoto3Package "connect" "1.43.39"
+      "sha256-yu5th3IYwC4kGT/DnRy9A3MXR/XxxtpeQomeRQoD7ck=";
 
   mypy-boto3-connect-contact-lens =
     buildMypyBoto3Package "connect-contact-lens" "1.43.0"
@@ -443,8 +443,8 @@ in
       "sha256-dXNkOcMonYrBh4yzeubd+v3mW42s9XpmpfvgbtgoJgY=";
 
   mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.43.38"
-      "sha256-nPuU8WL2p1bFewTf+X+V5joyTJ3wWRnaYYgIoAjt0Vw=";
+    buildMypyBoto3Package "ec2" "1.43.39"
+      "sha256-iatW0Ijl1hGkkP3tOwC49kvmO3r3BdYfvRclRw+pmbA=";
 
   mypy-boto3-ec2-instance-connect =
     buildMypyBoto3Package "ec2-instance-connect" "1.43.0"
@@ -858,8 +858,8 @@ in
       "sha256-ZlvcxMsMtkPwzyBpxGWffcD2g73aNIU6WG7jYn66ZjU=";
 
   mypy-boto3-mediaconvert =
-    buildMypyBoto3Package "mediaconvert" "1.43.24"
-      "sha256-VaGwdqgERTszcGip4FytIsm6r9mADouitpOWVmBFBko=";
+    buildMypyBoto3Package "mediaconvert" "1.43.39"
+      "sha256-3s5d1ZZ+XoVjYP3uZ2zuaAjH76fbj0j0a5v2H3Ji8vA=";
 
   mypy-boto3-medialive =
     buildMypyBoto3Package "medialive" "1.43.27"
@@ -898,8 +898,8 @@ in
       "sha256-13fAVct/Icy2iWt9z+fFyHLbp+7X6kZjLCtiiqC8Emc=";
 
   mypy-boto3-meteringmarketplace =
-    buildMypyBoto3Package "meteringmarketplace" "1.43.0"
-      "sha256-+gJkfsKfgRQbXovoZwas++rwAFxKlkGUdjqVGgE9jvA=";
+    buildMypyBoto3Package "meteringmarketplace" "1.43.39"
+      "sha256-HIHcM0wk4B50OYDf9Dsb81hsfrXYnZ7WyQ9R6BBvjNk=";
 
   mypy-boto3-mgh =
     buildMypyBoto3Package "mgh" "1.43.0"
@@ -966,8 +966,8 @@ in
       "sha256-1wQApBLsMnKRZ3lJZdd2W0+2Zz50QFdzYAhrOvEzByM=";
 
   mypy-boto3-opensearch =
-    buildMypyBoto3Package "opensearch" "1.43.34"
-      "sha256-MCgsSuTTm5JpFVTCWYOqi4usXhqThxyda6Q8dd4FiLA=";
+    buildMypyBoto3Package "opensearch" "1.43.39"
+      "sha256-ML0Y1a5twHRFUmR0MppMRopU2RG9n6y0HpQj4jUb/Dk=";
 
   mypy-boto3-opensearchserverless =
     buildMypyBoto3Package "opensearchserverless" "1.43.17"
@@ -1070,8 +1070,8 @@ in
       "sha256-YrrEKl3aGz//5Z5JGapHhWtk6hBXQ4cuRQmLqGYztzg=";
 
   mypy-boto3-quicksight =
-    buildMypyBoto3Package "quicksight" "1.43.35"
-      "sha256-47+AzLZ3ovvK0wLQ4xFoFkMocEjP1Kv44z+X1Ad4aYs=";
+    buildMypyBoto3Package "quicksight" "1.43.39"
+      "sha256-xjqIi2ZTAZusw3FDL2AQx871Yg0VM++K32w+ht74F34=";
 
   mypy-boto3-ram =
     buildMypyBoto3Package "ram" "1.43.0"
diff --git a/pkgs/development/python-modules/ngff-zarr/default.nix b/pkgs/development/python-modules/ngff-zarr/default.nix
index dd1d3284aa05..0eee8e95bc0c 100644
--- a/pkgs/development/python-modules/ngff-zarr/default.nix
+++ b/pkgs/development/python-modules/ngff-zarr/default.nix
@@ -31,14 +31,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ngff-zarr";
-  version = "0.36.0";
+  version = "0.37.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fideus-labs";
     repo = "ngff-zarr";
     tag = "py-v${finalAttrs.version}";
-    hash = "sha256-TsPyW815ITcBtAvRyQgEqgHhp9MqtRlkmKLFNVdnKR8=";
+    hash = "sha256-v747oBJMKORiEgy3fVzzgl35+9uRbyGvtor+Ga4UkNI=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/py/";
@@ -130,6 +130,9 @@ buildPythonPackage (finalAttrs: {
     "test_3d_zyx"
     "test_smaller_dask_graph"
     "test_tensorstore_compression"
+    # Test requires network access
+    "test_cli_orientation_preset_end_to_end"
+    "test_cli_itk_input_writes_orientation_automatically"
   ];
 
   meta = {
diff --git a/pkgs/development/python-modules/ocrmypdf/default.nix b/pkgs/development/python-modules/ocrmypdf/default.nix
index 33cebeede2e8..265ede72e8aa 100644
--- a/pkgs/development/python-modules/ocrmypdf/default.nix
+++ b/pkgs/development/python-modules/ocrmypdf/default.nix
@@ -32,7 +32,7 @@
 
 buildPythonPackage rec {
   pname = "ocrmypdf";
-  version = "17.7.1";
+  version = "17.8.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -45,7 +45,7 @@ buildPythonPackage rec {
     postFetch = ''
       rm "$out/.git_archival.txt"
     '';
-    hash = "sha256-LHNaWpnx11EGKvmudicMFCQJzTQMB2+Rz5JgHJN7lFk=";
+    hash = "sha256-E6SheIepSXQPxTCf6/vWeGpUs0x7VO+h86JhtSxK6e0=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/openinference-instrumentation/default.nix b/pkgs/development/python-modules/openinference-instrumentation/default.nix
index 6c2e2fbf3a3b..d86bfeefe993 100644
--- a/pkgs/development/python-modules/openinference-instrumentation/default.nix
+++ b/pkgs/development/python-modules/openinference-instrumentation/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "openinference-instrumentation";
-  version = "0.1.53";
+  version = "0.1.54";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -27,7 +27,7 @@ buildPythonPackage (finalAttrs: {
     owner = "Arize-ai";
     repo = "openinference";
     tag = "python-openinference-instrumentation-v${finalAttrs.version}";
-    hash = "sha256-1FzAiO3Vxt2o9YCzwPfHOn4hwvOLDt9Luv3zQTJ6J2Q=";
+    hash = "sha256-6GWZmgb9ZcT/yx7MvGUQlht5fljQGCKMHMpJWZQKpPI=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/python/${finalAttrs.pname}";
diff --git a/pkgs/development/python-modules/pillow/default.nix b/pkgs/development/python-modules/pillow/default.nix
index e2c0b2eb75ad..e19a87b695eb 100644
--- a/pkgs/development/python-modules/pillow/default.nix
+++ b/pkgs/development/python-modules/pillow/default.nix
@@ -42,14 +42,14 @@
 
 buildPythonPackage rec {
   pname = "pillow";
-  version = "12.2.0";
+  version = "12.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python-pillow";
     repo = "pillow";
     tag = version;
-    hash = "sha256-7w6FbZLTAoUMvLtSPvafk3wSRv8TrkAAfgZ/dfu3HpA=";
+    hash = "sha256-kmUlgR+f75Y8DAKKPdEbchLLgg0m95oyVP53WTQni88=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pycfmodel/default.nix b/pkgs/development/python-modules/pycfmodel/default.nix
index 750256d81f59..4bd9057b9d9b 100644
--- a/pkgs/development/python-modules/pycfmodel/default.nix
+++ b/pkgs/development/python-modules/pycfmodel/default.nix
@@ -6,23 +6,27 @@
   pydantic,
   pytestCheckHook,
   setuptools,
+  setuptools-scm,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pycfmodel";
-  version = "1.2.0";
+  version = "2.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Skyscanner";
     repo = "pycfmodel";
-    tag = "v${version}";
-    hash = "sha256-ta6kS+MiSa2DZx18EQr7hvWYrK55j48hSBACtcklCpI=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-fI6CeBJc1ry0vbXCxq7sfGiNDIrb3TiyimNacoOg8Lw=";
   };
 
   pythonRelaxDeps = [ "pydantic" ];
 
-  build-system = [ setuptools ];
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
 
   dependencies = [ pydantic ];
 
@@ -43,13 +47,18 @@ buildPythonPackage rec {
     "test_raise_error_if_invalid_fields_in_resource"
   ];
 
+  disabledTestPaths = [
+    # Test requires network access
+    "tests/test_resource_generator.py"
+  ];
+
   pythonImportsCheck = [ "pycfmodel" ];
 
   meta = {
     description = "Model for Cloud Formation scripts";
     homepage = "https://github.com/Skyscanner/pycfmodel";
-    changelog = "https://github.com/Skyscanner/pycfmodel/releases/tag/${src.tag}";
+    changelog = "https://github.com/Skyscanner/pycfmodel/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/pyhomee/default.nix b/pkgs/development/python-modules/pyhomee/default.nix
index e2f91641c678..89393645b849 100644
--- a/pkgs/development/python-modules/pyhomee/default.nix
+++ b/pkgs/development/python-modules/pyhomee/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "pyhomee";
-  version = "1.4.0";
+  version = "1.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Taraman17";
     repo = "pyHomee";
     tag = "v${version}";
-    hash = "sha256-kFsg1abnH9aL5dwSNwQ1WHPdZ6EApc48j8si92kR8ts=";
+    hash = "sha256-SH31V/9Z1fw63K7SLQeBQcpQ0DnDVOrngggBNsG5Kk4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pytenable/default.nix b/pkgs/development/python-modules/pytenable/default.nix
index 8b2f87c33dc4..4bf9d75941ab 100644
--- a/pkgs/development/python-modules/pytenable/default.nix
+++ b/pkgs/development/python-modules/pytenable/default.nix
@@ -1,74 +1,42 @@
 {
   lib,
   buildPythonPackage,
-  fetchFromGitHub,
-
-  # build-system
-  setuptools,
-
-  # dependencies
   cryptography,
   defusedxml,
+  fetchFromGitHub,
   gql,
   graphql-core,
-  pydantic,
+  marshmallow,
   pydantic-extra-types,
-  python-box,
-  python-dateutil,
-  requests,
-  requests-toolbelt,
-  restfly,
-  semver,
-  typing-extensions,
-
-  # marshmallow build system
-  flit-core,
-
-  # tests
+  pydantic,
   pytest-cov-stub,
   pytest-datafiles,
   pytest-vcr,
   pytestCheckHook,
+  python-box,
+  python-dateutil,
   requests-pkcs12,
+  requests-toolbelt,
+  requests,
   responses,
+  restfly,
+  semver,
+  setuptools,
+  typing-extensions,
 }:
-let
-  marshmallow' = buildPythonPackage {
-    pname = "marshmallow";
-    version = "3.26.2";
-    pyproject = true;
 
-    src = fetchFromGitHub {
-      owner = "marshmallow-code";
-      repo = "marshmallow";
-      tag = "3.26.2";
-      hash = "sha256-ioe+aZHOW8r3wF3UknbTjAP0dEggd/NL9PTkPVQ46zM=";
-    };
-
-    build-system = [ flit-core ];
-
-    doCheck = false;
-
-    pythonImportsCheck = [ "marshmallow" ];
-  };
-in
 buildPythonPackage (finalAttrs: {
   pname = "pytenable";
-  version = "1.9.1";
+  version = "26.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tenable";
     repo = "pyTenable";
     tag = finalAttrs.version;
-    hash = "sha256-WAKZe1m6EaNE+y2B/1/k8qZsEftLfAVPVEvIkh2N/4g=";
+    hash = "sha256-o11Lq11btpIwzgZlPMcChHexNOZSFEFOsnaIv1n66uY=";
   };
 
-  pythonRelaxDeps = [
-    "cryptography"
-    "defusedxml"
-  ];
-
   build-system = [ setuptools ];
 
   dependencies = [
@@ -76,7 +44,7 @@ buildPythonPackage (finalAttrs: {
     defusedxml
     gql
     graphql-core
-    marshmallow'
+    marshmallow
     pydantic
     pydantic-extra-types
     python-box
@@ -115,6 +83,7 @@ buildPythonPackage (finalAttrs: {
     # Test requires network access
     "test_assets_list_vcr"
     "test_events_list_vcr"
+    "test_session_ssl_error"
     # https://github.com/tenable/pyTenable/issues/953
     "test_construct_query_str"
     "test_construct_query_stored_file"
diff --git a/pkgs/development/python-modules/selenium-wire-roadtx/default.nix b/pkgs/development/python-modules/selenium-wire-roadtx/default.nix
index f3b333bd7bb7..c1f67db1995a 100644
--- a/pkgs/development/python-modules/selenium-wire-roadtx/default.nix
+++ b/pkgs/development/python-modules/selenium-wire-roadtx/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "selenium-wire-roadtx";
-  version = "0-unstable-2026-05-20";
+  version = "5.2.4-unstable-2026-05-20";
   pyproject = true;
 
   __structuredAttrs = true;
diff --git a/pkgs/development/python-modules/slack-bolt/default.nix b/pkgs/development/python-modules/slack-bolt/default.nix
index 93e5b09cd7e4..4588046e0c26 100644
--- a/pkgs/development/python-modules/slack-bolt/default.nix
+++ b/pkgs/development/python-modules/slack-bolt/default.nix
@@ -41,14 +41,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "slack-bolt";
-  version = "1.28.0";
+  version = "1.29.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "slackapi";
     repo = "bolt-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1AJO7+7YG/NFh6Rmqwkm6yua2LWdYQ9Rv1oadfHAlhE=";
+    hash = "sha256-3U15V++q/x73LuEgw9uWaIGWulJmPkmkpUxxK1EXuzU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/slack-sdk/default.nix b/pkgs/development/python-modules/slack-sdk/default.nix
index b6eeaa14fc7e..a434650c1ed3 100644
--- a/pkgs/development/python-modules/slack-sdk/default.nix
+++ b/pkgs/development/python-modules/slack-sdk/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "slack-sdk";
-  version = "3.42.0";
+  version = "3.43.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "slackapi";
     repo = "python-slack-sdk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-d0XuzBhn2Ex57xjeAF1q5RcwoWVsFWnlsWUufB3Um4g=";
+    hash = "sha256-slgf9U/Rm0pSV84CZR/8gGhvEi1zowjzE7YG9FsqwKk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/torchdata/default.nix b/pkgs/development/python-modules/torchdata/default.nix
index 07c376e92679..ae6516a3d887 100644
--- a/pkgs/development/python-modules/torchdata/default.nix
+++ b/pkgs/development/python-modules/torchdata/default.nix
@@ -16,6 +16,7 @@
 
   # tests
   datasets,
+  expecttest,
   parameterized,
   pytest-xdist,
   pytestCheckHook,
@@ -26,6 +27,7 @@ buildPythonPackage (finalAttrs: {
   pname = "torchdata";
   version = "0.11.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "meta-pytorch";
@@ -51,6 +53,7 @@ buildPythonPackage (finalAttrs: {
 
   nativeCheckInputs = [
     datasets
+    expecttest
     parameterized
     pytest-xdist
     pytestCheckHook
diff --git a/pkgs/development/python-modules/torchsnapshot/default.nix b/pkgs/development/python-modules/torchsnapshot/default.nix
index 017494ba6ff5..abef8ccc4f34 100644
--- a/pkgs/development/python-modules/torchsnapshot/default.nix
+++ b/pkgs/development/python-modules/torchsnapshot/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
 
@@ -11,6 +12,7 @@
   aiohttp,
   importlib-metadata,
   nest-asyncio,
+  numpy,
   psutil,
   pyyaml,
   torch,
@@ -21,15 +23,16 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "torchsnapshot";
   version = "0.1.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "pytorch";
     repo = "torchsnapshot";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-F8OaxLH8BL6MPNLFv1hBuVmeEdnEQ5w2Qny6by1wP6k=";
   };
 
@@ -52,6 +55,7 @@ buildPythonPackage rec {
     aiohttp
     importlib-metadata
     nest-asyncio
+    numpy
     psutil
     pyyaml
     torch
@@ -69,12 +73,17 @@ buildPythonPackage rec {
     # torch.distributed.elastic.multiprocessing.errors.ChildFailedError:
     # AssertionError: "Socket Timeout" does not match "wait timeout after 5000ms
     "test_linear_barrier_timeout"
+  ]
+  ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+    # aarch64-linux fails cpuinfo test, because /sys/devices/system/cpu/ does not exist in the sandbox:
+    # RuntimeError: Failed to initialize cpuinfo!
+    "test_tensor_copy"
   ];
 
   meta = {
     description = "Performant, memory-efficient checkpointing library for PyTorch applications, designed with large, complex distributed workloads in mind";
     homepage = "https://github.com/pytorch/torchsnapshot/";
-    changelog = "https://github.com/pytorch/torchsnapshot/releases/tag/${version}";
+    changelog = "https://github.com/pytorch/torchsnapshot/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ GaetanLepage ];
     badPlatforms = [
@@ -82,4 +91,4 @@ buildPythonPackage rec {
       lib.systems.inspect.patterns.isDarwin
     ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/torchtune/default.nix b/pkgs/development/python-modules/torchtune/default.nix
index 04e344e4195a..b6ec79556151 100644
--- a/pkgs/development/python-modules/torchtune/default.nix
+++ b/pkgs/development/python-modules/torchtune/default.nix
@@ -28,29 +28,82 @@
 
   # tests
   comet-ml,
+  expecttest,
   mlflow,
   pytest-integration,
   pytest-mock,
   pytestCheckHook,
+  tensorboard,
   writableTmpDirAsHomeHook,
+
+  # passthru
+  nix-update-script,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "torchtune";
-  version = "0.6.2-unstable-2026-02-19";
+  version = "0.6.1-unstable-2026-04-23";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "meta-pytorch";
     repo = "torchtune";
-    rev = "6f2aa7254458145f99d7004cbd6ebc8e53a06404";
-    hash = "sha256-ryR5iO3IwkoLdMLSFGhHCLl0P8yD+GQdZFEE6M/EYh0=";
+    rev = "bd2a0fc7c31430972728494fa01aaeeb0ebf1ba1";
+    hash = "sha256-6jE8+ZCm46qyoSOCkBjxsXNvtVEOUP6v3NEmMh+ocl8=";
   };
 
+  postPatch = ''
+    substituteInPlace \
+      tests/torchtune/modules/low_precision/test_nf4_dispatch_registration.py \
+      torchtune/modules/low_precision/_register_nf4_dispatch_ops.py \
+      torchtune/modules/low_precision/nf4_linear.py \
+      torchtune/modules/peft/dora.py \
+      torchtune/modules/peft/lora.py \
+      --replace-fail \
+        "from torchao.quantization import to_nf4" \
+        "from torchao.dtypes import to_nf4" \
+
+    substituteInPlace \
+      tests/torchtune/models/llama2/test_lora_llama2.py \
+      tests/torchtune/models/phi3/test_lora_phi3.py \
+      tests/torchtune/modules/low_precision/test_nf4_linear.py \
+      tests/torchtune/training/test_distributed.py \
+      torchtune/modules/common_utils.py \
+      torchtune/training/_activation_offloading.py \
+      --replace-fail \
+        "from torchao.quantization import NF4Tensor" \
+        "from torchao.dtypes.nf4tensor import NF4Tensor"
+
+    substituteInPlace \
+      tests/torchtune/modules/peft/test_dora.py \
+      tests/torchtune/modules/peft/test_lora.py \
+      torchtune/training/_distributed.py \
+      --replace-fail \
+        "from torchao.quantization import NF4Tensor, to_nf4" \
+        "from torchao.dtypes.nf4tensor import NF4Tensor, to_nf4"
+
+    substituteInPlace \
+      torchtune/modules/low_precision/nf4_linear.py \
+      torchtune/modules/peft/dora.py \
+      torchtune/modules/peft/lora.py \
+      --replace-fail \
+        "from torchao.quantization.quantize_.workflows.nf4.nf4_tensor import linear_nf4" \
+        "from torchao.dtypes.nf4tensor import linear_nf4"
+
+    substituteInPlace torchtune/modules/low_precision/_register_nf4_dispatch_ops.py \
+      --replace-fail \
+        "from torchao.quantization.quantize_.workflows.nf4.nf4_tensor import implements as nf4_tensor_impl" \
+        "from torchao.dtypes.nf4tensor import implements as nf4_tensor_impl"
+  '';
+
   build-system = [
     setuptools
   ];
 
+  pythonRelaxDeps = [
+    "pyarrow"
+  ];
   dependencies = [
     blobfile
     datasets
@@ -77,10 +130,12 @@ buildPythonPackage (finalAttrs: {
 
   nativeCheckInputs = [
     comet-ml
+    expecttest
     mlflow
     pytest-integration
     pytest-mock
     pytestCheckHook
+    tensorboard
     writableTmpDirAsHomeHook
   ];
 
@@ -157,6 +212,10 @@ buildPythonPackage (finalAttrs: {
     "tests/torchtune/utils"
   ];
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
+
   meta = {
     description = "PyTorch native post-training library";
     homepage = "https://github.com/meta-pytorch/torchtune";
diff --git a/pkgs/development/python-modules/yaswfp/default.nix b/pkgs/development/python-modules/yaswfp/default.nix
index f0c7998a453f..6ed211dd9a0b 100644
--- a/pkgs/development/python-modules/yaswfp/default.nix
+++ b/pkgs/development/python-modules/yaswfp/default.nix
@@ -6,9 +6,9 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage {
+buildPythonPackage (finalAttrs: {
   pname = "yaswfp";
-  version = "unstable-20210331";
+  version = "0.9.3-unstable-20210331";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -28,9 +28,9 @@ buildPythonPackage {
 
   meta = {
     description = "Python SWF Parser";
-    mainProgram = "swfparser";
     homepage = "https://github.com/facundobatista/yaswfp";
-    license = with lib.licenses; [ gpl3Only ];
+    license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "swfparser";
   };
-}
+})
diff --git a/pkgs/kde/plasma/plasma-bigscreen/default.nix b/pkgs/kde/plasma/plasma-bigscreen/default.nix
index 311a6e33a498..f6134e521251 100644
--- a/pkgs/kde/plasma/plasma-bigscreen/default.nix
+++ b/pkgs/kde/plasma/plasma-bigscreen/default.nix
@@ -1,9 +1,11 @@
 {
+  lib,
   mkKdeDerivation,
   plasma-workspace,
   pkg-config,
   qtwebengine,
   libcec,
+  libcec_platform,
   sdl3,
 }:
 
@@ -19,7 +21,7 @@ mkKdeDerivation {
   '';
 
   extraCmakeFlags = [
-    "-DQT_FIND_PRIVATE_MODULES=ON"
+    (lib.cmakeBool "QT_FIND_PRIVATE_MODULES" true)
   ];
 
   extraNativeBuildInputs = [
@@ -30,6 +32,7 @@ mkKdeDerivation {
     qtwebengine
 
     libcec
+    libcec_platform
     sdl3
   ];
 
diff --git a/pkgs/servers/http/angie/default.nix b/pkgs/servers/http/angie/default.nix
index ee4dd5c50979..fc468d763bdf 100644
--- a/pkgs/servers/http/angie/default.nix
+++ b/pkgs/servers/http/angie/default.nix
@@ -9,11 +9,11 @@
 
 callPackage ../nginx/generic.nix args rec {
   pname = "angie";
-  version = "1.11.5";
+  version = "1.11.8";
 
   src = fetchurl {
     url = "https://download.angie.software/files/angie-${version}.tar.gz";
-    hash = "sha256-tfKXxt8qdLnQCRp83XR//9LQ4dC+Q2MtphwcdTnbIEM=";
+    hash = "sha256-hJiXx495w7BNA1d440mTqSGI5r0sDDuozjrV6xUF69M=";
   };
 
   configureFlags = lib.optionals withAcme [
diff --git a/pkgs/tools/networking/iroh/default.nix b/pkgs/tools/networking/iroh/default.nix
index d0dc19d8b749..90d79532ef82 100644
--- a/pkgs/tools/networking/iroh/default.nix
+++ b/pkgs/tools/networking/iroh/default.nix
@@ -12,16 +12,16 @@ let
     }:
     rustPlatform.buildRustPackage rec {
       pname = name;
-      version = "1.0.0";
+      version = "1.0.1";
 
       src = fetchFromGitHub {
         owner = "n0-computer";
         repo = "iroh";
         rev = "v${version}";
-        hash = "sha256-L5y2/u5Sxh0tnl1NJS5dcRVLHDExHMiF12p0gRY2fzM=";
+        hash = "sha256-Tk9QXg+5Pu+xmfmo1FZRlshG3VLr3jTycybjKvnP9DU=";
       };
 
-      cargoHash = "sha256-R6b1BfKlgFCcPSif0qMHCj/gZ6v2beawbF4P3knkROw=";
+      cargoHash = "sha256-iLN2PJkWNyFPSNkAD/kgtmPb5c2HmMrhN+rUNoAnIFY=";
 
       buildFeatures = cargoFeatures;
       cargoBuildFlags = [
diff --git a/pkgs/top-level/default.nix b/pkgs/top-level/default.nix
index ee40599ba3f1..c00efe313abd 100644
--- a/pkgs/top-level/default.nix
+++ b/pkgs/top-level/default.nix
@@ -220,27 +220,37 @@ let
 
   fixedPoint = boot stages;
 
+  removeInternallyDisallowedAttrPaths =
+    let
+      # Same as `lib.removeAttrs`, but can remove nested attributes (and order of arguments is fixed)
+      # TODO: Consider moving to lib.attrpaths.removeAttrPaths
+      removeAttrPaths =
+        attrPathsToRemove: set:
+        let
+          split = lib.partition (
+            attrPath:
+            assert attrPath != [ ];
+            lib.length attrPath == 1
+          ) attrPathsToRemove;
+          nestedApplied =
+            set
+            // lib.mapAttrs (name: attrPaths: removeAttrPaths (lib.map lib.tail attrPaths) set.${name}) (
+              lib.groupBy (attrPath: lib.head attrPath) split.wrong
+            );
+        in
+        lib.removeAttrs nestedApplied (lib.map lib.head split.right);
+    in
+    removeAttrPaths (map (x: x.attrPath) config.attrPathsDisallowedForInternalUse);
+
   pkgs =
     # Generally only set by CI, don't want to cause a performance hit for users
     if config.attrPathsDisallowedForInternalUse == [ ] then
       fixedPoint
     else
       # See ./stage.nix, which replaced config.attrPathsDisallowedForInternalUse with aborts.
-      # We replace these attribute paths with their original derivations again,
-      # because CI would just error out from the aborting attributes themselves.
-      # Internally all packages still see the aborting attributes if used as dependencies,
-      # because we do this here after the fixed-point is calculated.
-      # Note that we don't want to remove the attributes entirely like what aliases.nix does,
-      # because unlike aliases, CI still needs to check the packages to evaluate at all,
-      # which it wouldn't if they're removed entirely.
-      lib.updateManyAttrsByPath
-        (map (attrs: {
-          path = attrs.attrPath;
-          update =
-            _:
-            lib.getAttrFromPath attrs.attrPath fixedPoint.__internalBeforeInternallyDisallowedAttrPathsOverlay;
-        }) config.attrPathsDisallowedForInternalUse)
-        (removeAttrs fixedPoint [ "__internalBeforeInternallyDisallowedAttrPathsOverlay" ]);
+      # To prevent these attributes from causing CI failures we remove them entirely.
+      # These attrs are still evaluated but in a different way, see ci/eval/default.nix
+      removeInternallyDisallowedAttrPaths fixedPoint;
 
 in
 checked pkgs
diff --git a/pkgs/top-level/stage.nix b/pkgs/top-level/stage.nix
index b3249b168490..0668737c9ee4 100644
--- a/pkgs/top-level/stage.nix
+++ b/pkgs/top-level/stage.nix
@@ -311,20 +311,16 @@ let
   };
 
   # Replaces the attributes in config.attrPathsDisallowedForInternalUse with aborts.
+  # Not warnings because those wouldn't give a backtrace, which is important for debugging
   # Not throws because those would be ignored by nix-env, which is what CI uses to evaluate everything
-  # See also ./default.nix, where these attributes are added back again so they're still checked by CI
+  # See also ./default.nix, which removes these attributes entirely from the end result
   internallyDisallowedAttrPathsOverlay =
     final: prev:
     # Generally only set by CI, don't want to cause a performance hit for users
     if config.attrPathsDisallowedForInternalUse == [ ] then
       { }
     else
-      {
-        # So that ./default.nix can add them back again outside the fixed point
-        # Don't use this in packages!
-        __internalBeforeInternallyDisallowedAttrPathsOverlay = prev;
-      }
-      // lib.updateManyAttrsByPath (map (
+      lib.updateManyAttrsByPath (map (
         { attrPath, reason }:
         {
           path = attrPath;