diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 04a1e3c0b6d3..50888cbe5111 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -12997,12 +12997,6 @@
     githubId = 56224949;
     name = "Mia Kanashi";
   };
-  kanielrkirby = {
-    email = "kanielrkirby@runbox.com";
-    github = "kanielrkirby";
-    githubId = 77940607;
-    name = "Kaniel Kirby";
-  };
   karantan = {
     name = "Gasper Vozel";
     email = "karantan@gmail.com";
@@ -26533,12 +26527,6 @@
     githubId = 123554;
     name = "Thibaut Smith";
   };
-  vidister = {
-    email = "v@vidister.de";
-    github = "vidister";
-    githubId = 11413574;
-    name = "Fiona Weber";
-  };
   vieta = {
     email = "xyzVieta@gmail.com";
     github = "yVieta";
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 07c3bb3ab881..33c7131798c3 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -1256,7 +1256,6 @@ with lib.maintainers;
   wdz = {
     members = [
       n0emis
-      vidister
       johannwagner
       yuka
     ];
diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index bb8e856e104d..1d63a51ce567 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -66,6 +66,8 @@
 
 - [SuiteNumérique Meet](https://github.com/suitenumerique/meet) is an open source alternative to Google Meet and Zoom powered by LiveKit: HD video calls, screen sharing, and chat features. Built with Django and React. Available as [services.lasuite-meet](#opt-services.lasuite-meet.enable).
 
+- [lemurs](https://github.com/coastalwhite/lemurs), a customizable TUI display/login manager. Available at [services.displayManager.lemurs](#opt-services.displayManager.lemurs.enable).
+
 - [paisa](https://github.com/ananthakumaran/paisa), a personal finance tracker and dashboard. Available as [services.paisa](#opt-services.paisa.enable).
 
 ## Backward Incompatibilities {#sec-release-25.11-incompatibilities}
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 97c34af0925b..e2e04222383f 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -597,6 +597,7 @@
   ./services/display-managers/default.nix
   ./services/display-managers/gdm.nix
   ./services/display-managers/greetd.nix
+  ./services/display-managers/lemurs.nix
   ./services/display-managers/ly.nix
   ./services/display-managers/sddm.nix
   ./services/editors/emacs.nix
diff --git a/nixos/modules/services/display-managers/default.nix b/nixos/modules/services/display-managers/default.nix
index 50afbd9f6ffb..d6ab8cbef811 100644
--- a/nixos/modules/services/display-managers/default.nix
+++ b/nixos/modules/services/display-managers/default.nix
@@ -257,7 +257,12 @@ in
         dmConf = config.services.xserver.displayManager;
         noDmUsed =
           !(
-            cfg.gdm.enable || cfg.sddm.enable || dmConf.xpra.enable || dmConf.lightdm.enable || cfg.ly.enable
+            cfg.gdm.enable
+            || cfg.sddm.enable
+            || dmConf.xpra.enable
+            || dmConf.lightdm.enable
+            || cfg.ly.enable
+            || cfg.lemurs.enable
           );
       in
       lib.mkIf noDmUsed (lib.mkDefault false);
diff --git a/nixos/modules/services/display-managers/lemurs.nix b/nixos/modules/services/display-managers/lemurs.nix
new file mode 100644
index 000000000000..d395c946983b
--- /dev/null
+++ b/nixos/modules/services/display-managers/lemurs.nix
@@ -0,0 +1,127 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.displayManager.lemurs;
+  settingsFormat = pkgs.formats.toml { };
+in
+{
+  options.services.displayManager.lemurs = {
+    enable = lib.mkEnableOption "" // {
+      description = ''
+        Whether to enable lemurs, a customizable TUI display/login manager.
+
+        ::: {.note}
+        For Wayland compositors, your user must be in the "seat" group.
+        :::
+      '';
+    };
+
+    package = lib.mkPackageOption pkgs "lemurs" { };
+
+    settings = lib.mkOption {
+      type = settingsFormat.type;
+      default = { };
+      example = lib.literalExpression ''
+        {
+          do_log = true;
+        }
+      '';
+      description = ''
+        Configuration for lemurs, provided as a Nix attribute set and automatically
+        serialized to TOML.
+        See [lemurs configuration documentation](https://github.com/coastalwhite/lemurs/blob/main/extra/config.toml) for available options.
+      '';
+    };
+
+    vt = lib.mkOption {
+      type = lib.types.ints.positive;
+      default = 2;
+      description = ''
+        The virtual console (tty) that lemurs should use.
+      '';
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = !config.services.displayManager.autoLogin.enable;
+        message = ''
+          lemurs doesn't support auto login.
+        '';
+      }
+    ];
+
+    security.pam.services.lemurs = {
+      unixAuth = true;
+      startSession = true;
+      # See https://github.com/coastalwhite/lemurs/issues/166
+      setLoginUid = false;
+      enableGnomeKeyring = lib.mkDefault config.services.gnome.gnome-keyring.enable;
+    };
+
+    environment.systemPackages = [ cfg.package ];
+
+    services = {
+      dbus.packages = [ cfg.package ];
+      # Required for wayland with setLoginUid = false;
+      seatd.enable = true;
+      xserver = {
+        # To enable user switching, allow lemurs to allocate TTYs/displays dynamically.
+        tty = null;
+        display = null;
+      };
+      displayManager = {
+        enable = true;
+        execCmd = "exec ${lib.getExe cfg.package} --config ${settingsFormat.generate "config.toml" cfg.settings}";
+        # set default settings
+        lemurs.settings =
+          let
+            desktops = config.services.displayManager.sessionData.desktops;
+          in
+          {
+            tty = lib.mkDefault cfg.vt;
+            system_shell = lib.mkDefault "${pkgs.bash}/bin/bash";
+            initial_path = lib.mkDefault "/run/current-system/sw/bin";
+            x11 = {
+              xauth_path = lib.mkDefault "${pkgs.xorg.xauth}/bin/xauth";
+              xserver_path = lib.mkDefault "${pkgs.xorg.xorgserver}/bin/X";
+              xsessions_path = lib.mkDefault "${desktops}/share/xsessions";
+              xsetup_path = lib.mkDefault config.services.displayManager.sessionData.wrapper;
+            };
+            wayland.wayland_sessions_path = lib.mkDefault "${desktops}/share/wayland-sessions";
+          };
+      };
+    };
+
+    systemd.services.display-manager = {
+      unitConfig = {
+        Wants = [ "systemd-user-sessions.service" ];
+        After = [
+          "systemd-user-sessions.service"
+          "getty@tty${toString cfg.vt}.service"
+          "plymouth-quit-wait.service"
+        ];
+        Conflicts = [ "getty@tty${toString cfg.vt}.service" ];
+      };
+      serviceConfig = {
+        Type = "idle";
+        # Defaults from lemurs upstream configuration
+        StandardInput = "tty";
+        TTYPath = "/dev/tty${toString cfg.vt}";
+        TTYReset = "yes";
+        TTYVHangup = "yes";
+      };
+      # Don't kill a user session when using nixos-rebuild
+      restartIfChanged = false;
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [
+    nullcube
+    stunkymonkey
+  ];
+}
diff --git a/nixos/modules/services/web-apps/nextcloud-notify_push.nix b/nixos/modules/services/web-apps/nextcloud-notify_push.nix
index 87a516428abc..115e61d853d6 100644
--- a/nixos/modules/services/web-apps/nextcloud-notify_push.nix
+++ b/nixos/modules/services/web-apps/nextcloud-notify_push.nix
@@ -89,6 +89,7 @@ in
         ];
         requires = [
           "nextcloud-setup.service"
+          "phpfpm-nextcloud.service"
         ];
         wantedBy = [ "multi-user.target" ];
         environment = {
@@ -150,6 +151,11 @@ in
           LoadCredential = config.systemd.services.nextcloud-cron.serviceConfig.LoadCredential;
           RestartMode = "direct";
           Restart = "on-failure";
+          RestartSec = "5s";
+        };
+        unitConfig = {
+          StartLimitIntervalSec = 30;
+          StartLimitBurst = 5;
         };
       };
     };
diff --git a/nixos/modules/services/x11/xserver.nix b/nixos/modules/services/x11/xserver.nix
index 206e25355d34..bd41f343eb6f 100644
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@@ -768,6 +768,7 @@ in
             || dmConf.startx.enable
             || config.services.greetd.enable
             || config.services.displayManager.ly.enable
+            || config.services.displayManager.lemurs.enable
           );
       in
       mkIf (default) (mkDefault true);
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index dbfb793af023..07ddbf27b7d8 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -791,6 +791,11 @@ in
   leaps = runTest ./leaps.nix;
   lemmy = runTest ./lemmy.nix;
   libinput = runTest ./libinput.nix;
+  lemurs = runTest ./lemurs/lemurs.nix;
+  lemurs-wayland = runTest ./lemurs/lemurs-wayland.nix;
+  lemurs-wayland-script = runTest ./lemurs/lemurs-wayland-script.nix;
+  lemurs-xorg = runTest ./lemurs/lemurs-xorg.nix;
+  lemurs-xorg-script = runTest ./lemurs/lemurs-xorg-script.nix;
   librenms = runTest ./librenms.nix;
   libresprite = runTest ./libresprite.nix;
   libreswan = runTest ./libreswan.nix;
diff --git a/nixos/tests/lemurs/lemurs-wayland-script.nix b/nixos/tests/lemurs/lemurs-wayland-script.nix
new file mode 100644
index 000000000000..a8c32496885f
--- /dev/null
+++ b/nixos/tests/lemurs/lemurs-wayland-script.nix
@@ -0,0 +1,50 @@
+{ lib, ... }:
+{
+  name = "lemurs-wayland-script";
+  meta = with lib.maintainers; {
+    maintainers = [
+      nullcube
+      stunkymonkey
+    ];
+  };
+
+  nodes.machine =
+    { lib, config, ... }:
+    {
+      imports = [ ../common/user-account.nix ];
+
+      # Required for wayland to work with Lemurs
+      services.seatd.enable = true;
+      users.users.alice.extraGroups = [ "seat" ];
+
+      services.displayManager.lemurs.enable = true;
+
+      programs.sway.enable = true;
+      environment.etc."lemurs/wayland/sway" = {
+        mode = "755";
+        text = ''
+          #! /bin/sh
+          exec ${lib.getExe config.programs.sway.package}
+        '';
+      };
+    };
+
+  testScript = ''
+    machine.start()
+
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_until_succeeds("pgrep -f 'lemurs.*tty1'")
+    machine.screenshot("postboot")
+
+    with subtest("Log in as alice to Sway"):
+      machine.send_chars("\n")
+      machine.send_chars("alice\n")
+      machine.sleep(1)
+      machine.send_chars("foobar\n")
+      machine.sleep(1)
+      machine.wait_until_succeeds("pgrep -u alice sway")
+      machine.sleep(10)
+      machine.succeed("pgrep -u alice sway")
+      machine.screenshot("postlogin")
+  '';
+}
diff --git a/nixos/tests/lemurs/lemurs-wayland.nix b/nixos/tests/lemurs/lemurs-wayland.nix
new file mode 100644
index 000000000000..1fede02cb61e
--- /dev/null
+++ b/nixos/tests/lemurs/lemurs-wayland.nix
@@ -0,0 +1,43 @@
+{ lib, ... }:
+{
+  name = "lemurs-wayland";
+  meta = with lib.maintainers; {
+    maintainers = [
+      nullcube
+      stunkymonkey
+    ];
+  };
+
+  nodes.machine =
+    { ... }:
+    {
+      imports = [ ../common/user-account.nix ];
+
+      # Required for wayland to work with Lemurs
+      services.seatd.enable = true;
+      users.users.alice.extraGroups = [ "seat" ];
+
+      services.displayManager.lemurs.enable = true;
+
+      programs.river.enable = true;
+    };
+
+  testScript = ''
+    machine.start()
+
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_until_succeeds("pgrep -f 'lemurs.*tty1'")
+    machine.screenshot("postboot")
+
+    with subtest("Log in as alice to river"):
+      machine.send_chars("\n")
+      machine.send_chars("alice\n")
+      machine.sleep(1)
+      machine.send_chars("foobar\n")
+      machine.sleep(1)
+      machine.wait_until_succeeds("pgrep -u alice river")
+      machine.sleep(10)
+      machine.succeed("pgrep -u alice river")
+      machine.screenshot("postlogin")
+  '';
+}
diff --git a/nixos/tests/lemurs/lemurs-xorg-script.nix b/nixos/tests/lemurs/lemurs-xorg-script.nix
new file mode 100644
index 000000000000..b64952a564be
--- /dev/null
+++ b/nixos/tests/lemurs/lemurs-xorg-script.nix
@@ -0,0 +1,46 @@
+{ lib, ... }:
+{
+  name = "lemurs-xorg-script";
+  meta = with lib.maintainers; {
+    maintainers = [
+      nullcube
+      stunkymonkey
+    ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      imports = [ ../common/user-account.nix ];
+
+      services.displayManager.lemurs.enable = true;
+
+      services.xserver.enable = true;
+
+      environment.etc."lemurs/wms/icewm" = {
+        mode = "755";
+        text = ''
+          #! /bin/sh
+          exec ${pkgs.icewm}/bin/icewm-session
+        '';
+      };
+    };
+
+  testScript = ''
+    machine.start()
+
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_until_succeeds("pgrep -f 'lemurs.*tty1'")
+    machine.screenshot("postboot")
+
+    with subtest("Log in as alice to icewm"):
+      machine.send_chars("\n")
+      machine.send_chars("alice\n")
+      machine.sleep(1)
+      machine.send_chars("foobar\n")
+      machine.wait_until_succeeds("pgrep -u alice icewm")
+      machine.sleep(10)
+      machine.succeed("pgrep -u alice icewm")
+      machine.screenshot("postlogin")
+  '';
+}
diff --git a/nixos/tests/lemurs/lemurs-xorg.nix b/nixos/tests/lemurs/lemurs-xorg.nix
new file mode 100644
index 000000000000..8fa1ffe3f0c9
--- /dev/null
+++ b/nixos/tests/lemurs/lemurs-xorg.nix
@@ -0,0 +1,40 @@
+{ lib, ... }:
+{
+  name = "lemurs-xorg";
+  meta = with lib.maintainers; {
+    maintainers = [
+      nullcube
+      stunkymonkey
+    ];
+  };
+
+  nodes.machine =
+    { ... }:
+    {
+      imports = [ ../common/user-account.nix ];
+
+      services.displayManager.lemurs.enable = true;
+
+      services.xserver.enable = true;
+
+      services.xserver.windowManager.icewm.enable = true;
+    };
+
+  testScript = ''
+    machine.start()
+
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_until_succeeds("pgrep -f 'lemurs.*tty1'")
+    machine.screenshot("postboot")
+
+    with subtest("Log in as alice to icewm"):
+      machine.send_chars("\n")
+      machine.send_chars("alice\n")
+      machine.sleep(1)
+      machine.send_chars("foobar\n")
+      machine.wait_until_succeeds("pgrep -u alice icewm")
+      machine.sleep(10)
+      machine.succeed("pgrep -u alice icewm")
+      machine.screenshot("postlogin")
+  '';
+}
diff --git a/nixos/tests/lemurs/lemurs.nix b/nixos/tests/lemurs/lemurs.nix
new file mode 100644
index 000000000000..803f74bfc681
--- /dev/null
+++ b/nixos/tests/lemurs/lemurs.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  ...
+}:
+{
+  name = "lemurs";
+  meta = with lib.maintainers; {
+    maintainers = [
+      nullcube
+      stunkymonkey
+    ];
+  };
+
+  nodes.machine = _: {
+    imports = [ ../common/user-account.nix ];
+    services.displayManager.lemurs.enable = true;
+  };
+
+  testScript = ''
+    machine.start()
+
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_until_succeeds("pgrep -f 'lemurs.*tty1'")
+    machine.screenshot("postboot")
+
+    with subtest("Log in as alice on a virtual console"):
+      machine.send_chars("\n")
+      machine.send_chars("alice\n")
+      machine.sleep(1)
+      machine.send_chars("foobar\n")
+      machine.sleep(1)
+      machine.wait_until_succeeds("pgrep -u alice bash")
+      machine.screenshot("postlogin")
+      machine.send_chars("touch done\n")
+      machine.wait_for_file("/home/alice/done")
+  '';
+}
diff --git a/pkgs/applications/emulators/libretro/cores/fbneo.nix b/pkgs/applications/emulators/libretro/cores/fbneo.nix
index 03cb43cb01be..1842612f23c4 100644
--- a/pkgs/applications/emulators/libretro/cores/fbneo.nix
+++ b/pkgs/applications/emulators/libretro/cores/fbneo.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "fbneo";
-  version = "0-unstable-2025-07-09";
+  version = "0-unstable-2025-07-18";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "fbneo";
-    rev = "42160d563e3e40e818dbbb328ff1f65c4a03ad0e";
-    hash = "sha256-dna6JsxYp5ilgPhSX3nDSznFlzET6jqZu5P9IH6PYvk=";
+    rev = "9491dab32de7d70c51a3d9fec6e17d1ea7e52a3f";
+    hash = "sha256-x0gBSSjbM/neIwjA7qmi5gvSGmeyaRNmDs2z9awakXY=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/mame.nix b/pkgs/applications/emulators/libretro/cores/mame.nix
index 8f2b55eb932c..1de6fec86a0a 100644
--- a/pkgs/applications/emulators/libretro/cores/mame.nix
+++ b/pkgs/applications/emulators/libretro/cores/mame.nix
@@ -9,13 +9,13 @@
 }:
 mkLibretroCore {
   core = "mame";
-  version = "0-unstable-2025-07-03";
+  version = "0-unstable-2025-07-12";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame";
-    rev = "fba50741006fa3e27e1897f589d2048a505b8fd6";
-    hash = "sha256-hRaLnxmG3B8IxpiKdiZEEMfKxDOPZg5ew7gwdq08TPQ=";
+    rev = "d6423328d57857c05ef3513999fe4ff4917db197";
+    hash = "sha256-aKPyLszralaS6vIKv2RjJrVOJMIVXDx6W6cRAI6o2EM=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/misc/electrum/default.nix b/pkgs/applications/misc/electrum/default.nix
index 3696b8919178..33233d472357 100644
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@@ -6,21 +6,12 @@
   wrapQtAppsHook,
   python3,
   zbar,
-  secp256k1,
   enableQt ? true,
   callPackage,
   qtwayland,
 }:
 
 let
-  libsecp256k1_name =
-    if stdenv.hostPlatform.isLinux then
-      "libsecp256k1.so.{v}"
-    else if stdenv.hostPlatform.isDarwin then
-      "libsecp256k1.{v}.dylib"
-    else
-      "libsecp256k1${stdenv.hostPlatform.extensions.sharedLibrary}";
-
   libzbar_name =
     if stdenv.hostPlatform.isLinux then
       "libzbar.so.0"
@@ -28,17 +19,15 @@ let
       "libzbar.0.dylib"
     else
       "libzbar${stdenv.hostPlatform.extensions.sharedLibrary}";
-
 in
-
 python3.pkgs.buildPythonApplication rec {
   pname = "electrum";
-  version = "4.5.8";
+  version = "4.6.0";
   format = "setuptools";
 
   src = fetchurl {
     url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz";
-    hash = "sha256-3YWVoTgTLe6Hzuds52Ch1iL8L9ZdO2rH335Tt/tup+g=";
+    hash = "sha256-aQqZXyfqFgc1j2r836eaaayOmSzDijHlYXmF+OBw418=";
   };
 
   build-system = [ protobuf ] ++ lib.optionals enableQt [ wrapQtAppsHook ];
@@ -63,8 +52,9 @@ python3.pkgs.buildPythonApplication rec {
       requests
       certifi
       jsonpatch
+      electrum-aionostr
+      electrum-ecc
       # plugins
-      btchip-python
       ledger-bitcoin
       ckcc-protocol
       keepkey
@@ -74,7 +64,7 @@ python3.pkgs.buildPythonApplication rec {
       pyserial
     ]
     ++ lib.optionals enableQt [
-      pyqt5
+      pyqt6
       qdarkstyle
     ];
 
@@ -85,38 +75,15 @@ python3.pkgs.buildPythonApplication rec {
     ];
 
   postPatch =
-    ''
-      # fix compatibility with recent aiorpcx version
-      # (remove as soon as https://github.com/spesmilo/electrum/commit/171aa5ee5ad4e25b9da10f757d9d398e905b4945 is included in source tarball)
-      substituteInPlace ./contrib/requirements/requirements.txt \
-        --replace-fail "aiorpcx>=0.22.0,<0.24" "aiorpcx>=0.22.0,<0.25"
-      substituteInPlace ./run_electrum \
-        --replace-fail "if not ((0, 22, 0) <= aiorpcx._version < (0, 24)):" "if not ((0, 22, 0) <= aiorpcx._version < (0, 25)):" \
-        --replace-fail "aiorpcX version {aiorpcx._version} does not match required: 0.22.0<=ver<0.24" "aiorpcX version {aiorpcx._version} does not match required: 0.22.0<=ver<0.25"
-      substituteInPlace ./electrum/electrum \
-        --replace-fail "if not ((0, 22, 0) <= aiorpcx._version < (0, 24)):" "if not ((0, 22, 0) <= aiorpcx._version < (0, 25)):" \
-        --replace-fail "aiorpcX version {aiorpcx._version} does not match required: 0.22.0<=ver<0.24" "aiorpcX version {aiorpcx._version} does not match required: 0.22.0<=ver<0.25"
-
-      # make compatible with protobuf4 by easing dependencies ...
-      substituteInPlace ./contrib/requirements/requirements.txt \
-        --replace-fail "protobuf>=3.20,<4" "protobuf>=3.20"
-      # ... and regenerating the paymentrequest_pb2.py file
-      protoc --python_out=. electrum/paymentrequest.proto
-
-      substituteInPlace ./electrum/ecc_fast.py \
-        --replace-fail ${libsecp256k1_name} ${secp256k1}/lib/libsecp256k1${stdenv.hostPlatform.extensions.sharedLibrary}
-    ''
-    + (
-      if enableQt then
-        ''
-          substituteInPlace ./electrum/qrscanner.py \
-            --replace-fail ${libzbar_name} ${zbar.lib}/lib/libzbar${stdenv.hostPlatform.extensions.sharedLibrary}
-        ''
-      else
-        ''
-          sed -i '/qdarkstyle/d' contrib/requirements/requirements.txt
-        ''
-    );
+    if enableQt then
+      ''
+        substituteInPlace ./electrum/qrscanner.py \
+          --replace-fail ${libzbar_name} ${zbar.lib}/lib/libzbar${stdenv.hostPlatform.extensions.sharedLibrary}
+      ''
+    else
+      ''
+        sed -i '/qdarkstyle/d' contrib/requirements/requirements.txt
+      '';
 
   postInstall = lib.optionalString stdenv.hostPlatform.isLinux ''
     substituteInPlace $out/share/applications/electrum.desktop \
@@ -136,6 +103,11 @@ python3.pkgs.buildPythonApplication rec {
 
   enabledTestPaths = [ "tests" ];
 
+  # avoid homeless-shelter error in tests
+  preCheck = ''
+    export HOME="$(mktemp -d)"
+  '';
+
   postCheck = ''
     $out/bin/electrum help >/dev/null
   '';
diff --git a/pkgs/by-name/al/albert/package.nix b/pkgs/by-name/al/albert/package.nix
index 182010569d8a..d9f8559fa634 100644
--- a/pkgs/by-name/al/albert/package.nix
+++ b/pkgs/by-name/al/albert/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "albert";
-  version = "0.30.0";
+  version = "0.30.1";
 
   src = fetchFromGitHub {
     owner = "albertlauncher";
     repo = "albert";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lkicEaQLHloa10A7rySDX7UpOFsDzOSL1xepL5bymd0=";
+    hash = "sha256-EscR31DZzLszs2jPQDDcB7SFtSuWPjSBpjJw8i+PsD0=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/bi/binaryninja-free/package.nix b/pkgs/by-name/bi/binaryninja-free/package.nix
index 08826afa917a..cc39783e4275 100644
--- a/pkgs/by-name/bi/binaryninja-free/package.nix
+++ b/pkgs/by-name/bi/binaryninja-free/package.nix
@@ -18,13 +18,13 @@
   xcbutilwm,
   libxml2,
 }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "binaryninja-free";
-  version = "5.0.7486";
+  version = "5.0.7648";
 
   src = fetchurl {
-    url = "https://web.archive.org/web/20250526111956/https://cdn.binary.ninja/installers/binaryninja_free_linux.zip";
-    hash = "sha256-iZjIgokwnHJaY6OgrnDcto3Un5g42MqTWXKo6OL1Rcs=";
+    url = "https://github.com/Vector35/binaryninja-api/releases/download/v${finalAttrs.version}-stable/binaryninja_free_linux.zip";
+    hash = "sha256-CBRoQaVQ3/wlRA2SE3EOgM9BiU+WlT2nGi3CkBTrT+g=";
   };
 
   icon = fetchurl {
@@ -81,13 +81,15 @@ stdenv.mkDerivation rec {
     mkdir $out/bin
     ln -s $out/binaryninja $out/bin/binaryninja
 
-    install -Dm644 ${icon} $out/share/icons/hicolor/256x256/apps/binaryninja.png
+    install -Dm644 ${finalAttrs.icon} $out/share/icons/hicolor/256x256/apps/binaryninja.png
 
     runHook postInstall
   '';
 
   meta = {
-    changelog = "https://binary.ninja/changelog/#${lib.replaceStrings [ "." ] [ "-" ] version}";
+    changelog = "https://binary.ninja/changelog/#${
+      lib.replaceStrings [ "." ] [ "-" ] finalAttrs.version
+    }";
     description = "Interactive decompiler, disassembler, debugger";
     homepage = "https://binary.ninja/";
     license = {
@@ -99,4 +101,4 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [ scoder12 ];
     platforms = [ "x86_64-linux" ];
   };
-}
+})
diff --git a/pkgs/by-name/gl/glab/package.nix b/pkgs/by-name/gl/glab/package.nix
index dc99f424e6d7..960ca9c5b5fd 100644
--- a/pkgs/by-name/gl/glab/package.nix
+++ b/pkgs/by-name/gl/glab/package.nix
@@ -3,23 +3,32 @@
   buildGoModule,
   fetchFromGitLab,
   installShellFiles,
+  makeBinaryWrapper,
   stdenv,
   nix-update-script,
   writableTmpDirAsHomeHook,
+  versionCheckHook,
+  gitMinimal,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "glab";
-  version = "1.61.0";
+  version = "1.62.0";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pouFnmHCfRFDy+MMbRI82o73jO8hRewHeXgGnJ4hnww=";
+    hash = "sha256-+dXMlNc54i/vEwYV0YRKXrdWejcgfXFW+tFq3tf8TZY=";
+    leaveDotGit = true;
+    postFetch = ''
+      cd "$out"
+      git rev-parse --short HEAD > $out/COMMIT
+      find "$out" -name .git -print0 | xargs -0 rm -rf
+    '';
   };
 
-  vendorHash = "sha256-COp4RebkU36OChbZFeLALUppXqHLRbrm3D64Hb5RmI4=";
+  vendorHash = "sha256-sgph04zjHvvgL0QJm2//h8jyDg/5NY7dq50C0G0hYYM=";
 
   ldflags = [
     "-s"
@@ -27,12 +36,17 @@ buildGoModule (finalAttrs: {
     "-X main.version=${finalAttrs.version}"
   ];
 
-  nativeCheckInputs = [ writableTmpDirAsHomeHook ];
+  preBuild = ''
+    ldflags+=" -X main.commit=$(cat COMMIT)"
+  '';
+
+  nativeBuildInputs = [
+    installShellFiles
+    makeBinaryWrapper
+  ];
 
   subPackages = [ "cmd/glab" ];
 
-  nativeBuildInputs = [ installShellFiles ];
-
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     make manpage
     installManPage share/man/man1/*
@@ -40,8 +54,27 @@ buildGoModule (finalAttrs: {
       --bash <($out/bin/glab completion -s bash) \
       --fish <($out/bin/glab completion -s fish) \
       --zsh <($out/bin/glab completion -s zsh)
+
+    wrapProgram $out/bin/glab \
+      --set-default GLAB_CHECK_UPDATE 0 \
+      --set-default GLAB_SEND_TELEMETRY 0
   '';
 
+  nativeCheckInputs = [ writableTmpDirAsHomeHook ];
+
+  preCheck = ''
+    git init
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    gitMinimal
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+  versionCheckProgramArg = "version";
+  versionCheckKeepEnvironment = [ "HOME" ];
+
   passthru.updateScript = nix-update-script { };
 
   meta = {
diff --git a/pkgs/by-name/hi/high-tide/package.nix b/pkgs/by-name/hi/high-tide/package.nix
index 88c0abe2c1e9..3bd740c7a68a 100644
--- a/pkgs/by-name/hi/high-tide/package.nix
+++ b/pkgs/by-name/hi/high-tide/package.nix
@@ -9,6 +9,7 @@
   blueprint-compiler,
   desktop-file-utils,
   libadwaita,
+  glib-networking,
   gst_all_1,
   libsecret,
   libportal,
@@ -38,6 +39,7 @@ python313Packages.buildPythonApplication rec {
 
   buildInputs =
     [
+      glib-networking
       libadwaita
       libportal
     ]
diff --git a/pkgs/by-name/ip/ipxe/package.nix b/pkgs/by-name/ip/ipxe/package.nix
index ff77ddfe246e..9f120adbb122 100644
--- a/pkgs/by-name/ip/ipxe/package.nix
+++ b/pkgs/by-name/ip/ipxe/package.nix
@@ -48,7 +48,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ipxe";
-  version = "1.21.1-unstable-2025-07-04";
+  version = "1.21.1-unstable-2025-07-16";
 
   nativeBuildInputs = [
     mtools
@@ -65,8 +65,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "ipxe";
     repo = "ipxe";
-    rev = "c21443f0b9a4dee56ab0f47b096540d6443cda9f";
-    hash = "sha256-rCMTtzNZM3KElNYwnpQOINU4CsMhIgla8JQT5Fgx2tQ=";
+    rev = "8a8904aaddcc9497b2c3d110785b52e4d1dca336";
+    hash = "sha256-q8KD4g2Sx+gnGHWi4Wpf2uJ/6YtUyqiRUXhOWLrGnxI=";
   };
 
   # Calling syslinux on a FAT image isn't going to work on Aarch64.
diff --git a/pkgs/by-name/is/issue2md/package.nix b/pkgs/by-name/is/issue2md/package.nix
new file mode 100644
index 000000000000..1333d2d936e8
--- /dev/null
+++ b/pkgs/by-name/is/issue2md/package.nix
@@ -0,0 +1,32 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "issue2md";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "bigwhite";
+    repo = "issue2md";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-QBEHjFu+YWHPeSZSQT1lzTNSIyLQYXEIi+XopdHN710=";
+  };
+
+  vendorHash = null;
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  meta = {
+    description = "CLI tool to convert GitHub issue into Markdown file";
+    homepage = "https://github.com/bigwhite/issue2md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ drupol ];
+    mainProgram = "issue2md";
+  };
+})
diff --git a/pkgs/by-name/la/lazysql/package.nix b/pkgs/by-name/la/lazysql/package.nix
index 4e9ca9675198..346915c4ed1c 100644
--- a/pkgs/by-name/la/lazysql/package.nix
+++ b/pkgs/by-name/la/lazysql/package.nix
@@ -37,7 +37,7 @@ buildGoModule rec {
     description = "Cross-platform TUI database management tool written in Go";
     homepage = "https://github.com/jorgerojas26/lazysql";
     license = licenses.mit;
-    maintainers = with maintainers; [ kanielrkirby ];
+    maintainers = with maintainers; [ ];
     mainProgram = "lazysql";
   };
 }
diff --git a/pkgs/by-name/le/lemurs/package.nix b/pkgs/by-name/le/lemurs/package.nix
index 1f61fc809df0..cfec0fb76cc2 100644
--- a/pkgs/by-name/le/lemurs/package.nix
+++ b/pkgs/by-name/le/lemurs/package.nix
@@ -6,6 +6,7 @@
   rustPlatform,
   systemdMinimal,
   versionCheckHook,
+  nixosTests,
 }:
 rustPlatform.buildRustPackage rec {
   pname = "lemurs";
@@ -30,6 +31,16 @@ rustPlatform.buildRustPackage rec {
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
 
+  passthru.tests = {
+    inherit (nixosTests)
+      lemurs
+      lemurs-wayland
+      lemurs-wayland-script
+      lemurs-xorg
+      lemurs-xorg-script
+      ;
+  };
+
   meta = {
     description = "Customizable TUI display/login manager written in Rust";
     homepage = "https://github.com/coastalwhite/lemurs";
diff --git a/pkgs/by-name/li/libsignal-ffi/package.nix b/pkgs/by-name/li/libsignal-ffi/package.nix
index fb1062aed4d3..9017d7d13b83 100644
--- a/pkgs/by-name/li/libsignal-ffi/package.nix
+++ b/pkgs/by-name/li/libsignal-ffi/package.nix
@@ -21,14 +21,14 @@ rustPlatform.buildRustPackage rec {
   pname = "libsignal-ffi";
   # must match the version used in mautrix-signal
   # see https://github.com/mautrix/signal/issues/401
-  version = "0.74.1";
+  version = "0.76.1";
 
   src = fetchFromGitHub {
     fetchSubmodules = true;
     owner = "signalapp";
     repo = "libsignal";
     tag = "v${version}";
-    hash = "sha256-ZMi+/d051CS7TcWVZnVItNpok0ac+vAvvZL/buNrtL0=";
+    hash = "sha256-411+ANwyqqUX11rxCzFvPhjMWviJ0CcQlkAiqNWs32w=";
   };
 
   nativeBuildInputs = [
@@ -40,7 +40,7 @@ rustPlatform.buildRustPackage rec {
   env.NIX_LDFLAGS = if stdenv.hostPlatform.isDarwin then "-lc++" else "-lstdc++";
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-pRMFWJSRjhZYfX7dmOQXK3BjhJKzPR1Pg+TZzTfPnd4=";
+  cargoHash = "sha256-9W7u0fZgU0J03hT6D4BJPpIKn3dwf9yckJiwwNkyqUA=";
 
   cargoBuildFlags = [
     "-p"
diff --git a/pkgs/by-name/li/lightning-terminal/package.json b/pkgs/by-name/li/lightning-terminal/package.json
deleted file mode 100644
index 3452ada9c1ca..000000000000
--- a/pkgs/by-name/li/lightning-terminal/package.json
+++ /dev/null
@@ -1,139 +0,0 @@
-{
-  "name": "lightning-terminal",
-  "version": "0.0.1",
-  "description": "Lightning Terminal",
-  "repository": "https://github.com/lightninglabs/lightning-terminal",
-  "private": true,
-  "scripts": {
-    "start": "BROWSER=none react-scripts start",
-    "develop": "REACT_APP_USE_SAMPLE_DATA=true yarn start",
-    "build": "react-scripts build",
-    "postbuild": "git restore build/.gitkeep",
-    "test": "react-scripts test --env=jest-environment-jsdom --transformIgnorePatterns \"node_modules/(?!d3)/\"",
-    "test:ci": "cross-env CI=true yarn test --coverage",
-    "eject": "react-scripts eject",
-    "lint": "eslint --ext .ts,.tsx --ignore-path .eslintignore .",
-    "tsc": "tsc --noEmit",
-    "protos": "node ./scripts/build-protos.js",
-    "storybook": "storybook dev -p 9009 -s public",
-    "build-storybook": "storybook build -s public"
-  },
-  "dependencies": {
-    "@emotion/react": "11.4.0",
-    "@emotion/styled": "11.3.0",
-    "@improbable-eng/grpc-web": "0.14.0",
-    "@types/react-collapse": "^5.0.1",
-    "big.js": "6.1.1",
-    "bootstrap": "4.6.1",
-    "buffer": "6.0.3",
-    "copy-to-clipboard": "3.3.1",
-    "d3": "7.8.5",
-    "date-fns": "2.14.0",
-    "debug": "4.3.1",
-    "file-saver": "2.0.2",
-    "http-proxy-middleware": "2.0.7",
-    "i18next": "19.5.1",
-    "i18next-browser-languagedetector": "5.0.0",
-    "lodash": "4.17.21",
-    "lottie-web": "5.7.0",
-    "mobx": "6.3.2",
-    "mobx-react-lite": "3.2.0",
-    "mobx-utils": "6.0.4",
-    "qrcode.react": "^3.1.0",
-    "rc-dialog": "^8.9.0",
-    "rc-select": "11.5.0",
-    "rc-switch": "^4.0.0",
-    "rc-tooltip": "4.2.1",
-    "react": "17.0.2",
-    "react-collapse": "^5.1.1",
-    "react-dom": "17.0.2",
-    "react-i18next": "13.5.0",
-    "react-router-dom": "^6.3.0",
-    "react-toastify": "6.0.6",
-    "react-virtualized": "9.21.2",
-    "reactour": "1.18.0",
-    "semver": "^7.5.2",
-    "styled-components": "5.1.1"
-  },
-  "devDependencies": {
-    "@storybook/addon-actions": "7.5.3",
-    "@storybook/addon-docs": "7.5.3",
-    "@storybook/addon-links": "7.5.3",
-    "@storybook/addons": "7.5.3",
-    "@storybook/preset-create-react-app": "7.5.3",
-    "@storybook/react": "7.5.3",
-    "@storybook/react-webpack5": "7.5.3",
-    "@testing-library/jest-dom": "5.11.5",
-    "@testing-library/react": "11.1.1",
-    "@testing-library/user-event": "12.2.0",
-    "@types/big.js": "6.1.1",
-    "@types/d3": "7.4.3",
-    "@types/debug": "4.1.5",
-    "@types/file-saver": "2.0.1",
-    "@types/google-protobuf": "3.15.10",
-    "@types/history": "4.7.6",
-    "@types/jest": "27.4.1",
-    "@types/lodash": "4.14.157",
-    "@types/node": "14.0.14",
-    "@types/react": "17.0.13",
-    "@types/react-dom": "17.0.8",
-    "@types/react-router-dom": "^5.3.3",
-    "@types/react-virtualized": "9.21.10",
-    "@types/reactour": "1.17.1",
-    "@types/semver": "^7.3.9",
-    "@typescript-eslint/eslint-plugin": "5.17.0",
-    "@typescript-eslint/parser": "5.17.0",
-    "cross-env": "7.0.2",
-    "eslint-config-prettier": "8.5.0",
-    "eslint-plugin-prettier": "4.0.0",
-    "eslint-plugin-react": "7.29.4",
-    "google-protobuf": "3.14.0",
-    "jest-canvas-mock": "2.3.0",
-    "jest-environment-jsdom": "27.5.1",
-    "prettier": "2.1.2",
-    "protoc-gen-js": "3.21.2",
-    "react-scripts": "^5.0.1",
-    "sass": "1.43.4",
-    "storybook": "7.5.3",
-    "ts-protoc-gen": "0.15.0",
-    "typescript": "4.1.6",
-    "webpack": "5.89.0"
-  },
-  "resolutions": {
-    "strip-ansi": "6.0.1",
-    "jackspeak": "2.1.1",
-    "wrap-ansi": "7.0.0"
-  },
-  "eslintConfig": {
-    "extends": "react-app",
-    "ignorePatterns": [
-      "src/types/generated/**/*.js"
-    ]
-  },
-  "jest": {
-    "globalSetup": "./src/setupTestsGlobal.ts",
-    "resetMocks": false,
-    "collectCoverageFrom": [
-      "src/**/*.{js,jsx,ts,tsx}",
-      "!src/**/*.d.ts",
-      "!src/__(stories|mocks)__/**/*.{ts,tsx}",
-      "!src/types/**/*.{js,ts}",
-      "!src/i18n/**/*.{js,ts}",
-      "!src/util/tests/**/*.{ts,tsx}",
-      "!src/setupProxy.js",
-      "!src/index.tsx"
-    ]
-  },
-  "browserslist": {
-    "production": [
-      ">0.2%",
-      "not dead",
-      "not op_mini all"
-    ],
-    "development": [
-      "last 1 chrome version",
-      "last 1 firefox version",
-      "last 1 safari version"
-    ]
-  }
-}
diff --git a/pkgs/by-name/li/lightning-terminal/package.nix b/pkgs/by-name/li/lightning-terminal/package.nix
index 1918a87752c4..f656f0670ead 100644
--- a/pkgs/by-name/li/lightning-terminal/package.nix
+++ b/pkgs/by-name/li/lightning-terminal/package.nix
@@ -1,11 +1,18 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
-  mkYarnPackage,
+  nodejs,
+  yarn,
+  yarnConfigHook,
+  yarnBuildHook,
   fetchYarnDeps,
   go,
   versionCheckHook,
+  testers,
+  curl,
+  lightning-terminal,
 }:
 
 buildGoModule rec {
@@ -30,6 +37,18 @@ buildGoModule rec {
 
   vendorHash = "sha256-Gbx4uz6q9Ef4QNv6DpIoCACjhT66iZ7GPNpd/g9MgKQ=";
 
+  buildInputs = [ lightning-app ];
+  postUnpack = ''
+    echo "Copying app build output into app/build dir to embed into litd."
+    cp -r ${lightning-app}/* source/app/build/
+
+    echo "Asserting that app/build/index.html exists."
+    if [ ! -f source/app/build/index.html ]; then
+      echo "ERROR: app/build/index.html not found!"
+      exit 1
+    fi
+  '';
+
   ldflags = [
     "-s"
     "-w"
@@ -75,24 +94,59 @@ buildGoModule rec {
     versionCheckHook
   ];
 
-  lightning-app = mkYarnPackage {
+  passthru.tests.litd-app = testers.runCommand {
+    name = "test-litd-app";
+    nativeBuildInputs = [
+      curl
+      lightning-terminal
+    ];
+    script = ''
+      litd \
+        --uipassword=12345678 \
+        --insecure-httplisten=127.0.0.1:8080 \
+        --httpslisten= &
+      sleep 2
+      GETindexHTTPCode=$(curl -o /dev/null -w "%{http_code}" -Lvs 127.0.0.1:8080/index.html)
+      if [ "$GETindexHTTPCode" = 200 ]; then
+        touch $out
+      fi
+    '';
+  };
+
+  lightning-app = stdenv.mkDerivation {
     pname = "lightning-app";
     src = "${src}/app";
     version = "0.0.1";
-    packageJSON = ./package.json;
-    yarnLock = "${src}/app/yarn.lock";
-    offlineCache = fetchYarnDeps {
+    yarnOfflineCache = fetchYarnDeps {
       yarnLock = "${src}/app/yarn.lock";
       hash = "sha256-ulOgKQRLG4cRi1N1DajmbZ0L7d08g5cYDA9itXu+Esw=";
     };
+
+    # Remove this command from package.json. It requires Git and it is not
+    # really needed.
+    postPatch = ''
+      substituteInPlace package.json \
+        --replace '"postbuild": "git restore build/.gitkeep",' ' '
+    '';
+
+    nativeBuildInputs = [
+      nodejs
+      yarn
+      yarnConfigHook
+      yarnBuildHook
+    ];
+
+    preBuild = ''
+      # Disable linter. It finds a lot of proposed substitutions and fails.
+      export DISABLE_ESLINT_PLUGIN=true
+      export CI=false
+    '';
+
+    installPhase = ''
+      mkdir -p $out
+      cp -r build/* $out/
+    '';
   };
-  outputs = [
-    "out"
-    "app"
-  ];
-  postFixup = ''
-    ln -s ${lightning-app} "$app"
-  '';
 
   meta = {
     description = "All-in-one Lightning node management tool that includes LND, Loop, Pool, Faraday, and Tapd";
@@ -101,6 +155,5 @@ buildGoModule rec {
     changelog = "https://github.com/lightninglabs/lightning-terminal/releases/tag/v${version}";
     maintainers = with lib.maintainers; [ HannahMR ];
     mainProgram = "litcli";
-    outputsToInstall = [ "out" ];
   };
 }
diff --git a/pkgs/by-name/ly/ly/package.nix b/pkgs/by-name/ly/ly/package.nix
index be47fbe07f1a..5cc31fdcefb6 100644
--- a/pkgs/by-name/ly/ly/package.nix
+++ b/pkgs/by-name/ly/ly/package.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "TUI display manager";
     license = lib.licenses.wtfpl;
     homepage = "https://codeberg.org/AnErrupTion/ly";
-    maintainers = [ lib.maintainers.vidister ];
+    maintainers = [ ];
     platforms = lib.platforms.linux;
     mainProgram = "ly";
   };
diff --git a/pkgs/by-name/ma/mautrix-signal/package.nix b/pkgs/by-name/ma/mautrix-signal/package.nix
index 0e768a5a695d..43f32bfbaf0d 100644
--- a/pkgs/by-name/ma/mautrix-signal/package.nix
+++ b/pkgs/by-name/ma/mautrix-signal/package.nix
@@ -19,13 +19,13 @@ let
 in
 buildGoModule rec {
   pname = "mautrix-signal";
-  version = "0.8.4";
+  version = "0.8.5";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "signal";
     tag = "v${version}";
-    hash = "sha256-8F9wk83F3wB9vXvAFz4IiBmGbDOp/SyqQkYnhHPlYj0=";
+    hash = "sha256-koO1eeMZ8wmty6z2zyJlA7zoM6gYmFlxdF8GB2hOxb8=";
   };
 
   buildInputs =
@@ -41,7 +41,7 @@ buildGoModule rec {
 
   CGO_LDFLAGS = lib.optional withGoolm [ cppStdLib ];
 
-  vendorHash = "sha256-0eh1PaExf87zJ4E/ix1Mjcx2Sms6qNAFc8LD80A5n7M=";
+  vendorHash = "sha256-NmIWxc+6Leaqm1W+g2XdbMv4iU7Z7k8/g88U0iw/+98=";
 
   doCheck = true;
   preCheck =
diff --git a/pkgs/by-name/mc/mcp-grafana/package.nix b/pkgs/by-name/mc/mcp-grafana/package.nix
index 34d43a071955..93b7dbdba473 100644
--- a/pkgs/by-name/mc/mcp-grafana/package.nix
+++ b/pkgs/by-name/mc/mcp-grafana/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "mcp-grafana";
-  version = "0.5.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "mcp-grafana";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oFtih2X3ZXKeo0xP8PBafu9HXgzcLUkLCeHm47qZhNA=";
+    hash = "sha256-Y5uzHLekC756dpMmhPXggLRO5bIawCdzSSoJjrwr4Qo=";
   };
 
-  vendorHash = "sha256-AVU1HE3RlEjkL0xO6j/Mii0B9BtUSdALUvSphCTwjrc=";
+  vendorHash = "sha256-PsfjKkdhgblo3ksjP1tewoJQCQmWuWoSAO5Pfn9iMVM=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/mi/miracle-wm/package.nix b/pkgs/by-name/mi/miracle-wm/package.nix
index 7763154211fa..446642a285e9 100644
--- a/pkgs/by-name/mi/miracle-wm/package.nix
+++ b/pkgs/by-name/mi/miracle-wm/package.nix
@@ -2,7 +2,7 @@
   stdenv,
   lib,
   fetchFromGitHub,
-  gitUpdater,
+  unstableGitUpdater,
   nixosTests,
   boost,
   cmake,
@@ -30,13 +30,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "miracle-wm";
-  version = "0.5.2";
+  version = "0.5.2-unstable-2025-07-06";
 
   src = fetchFromGitHub {
     owner = "miracle-wm-org";
     repo = "miracle-wm";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-nmDFmj3DawgjRB0+vlcvPX+kj6lzAu14HySFc2NsJss=";
+    rev = "859c1e4c97db78872ee799ceb0316c612841ee37";
+    hash = "sha256-1AZLxD/VyBt60ZHXVN/OpKNigN9NdEBJ9svOOVI0JCI=";
   };
 
   postPatch =
@@ -91,7 +91,7 @@ stdenv.mkDerivation (finalAttrs: {
   checkPhase = ''
     runHook preCheck
 
-    ./bin/miracle-wm-tests
+    ./tests/miracle-wm-tests
 
     runHook postCheck
   '';
@@ -109,7 +109,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru = {
-    updateScript = gitUpdater { rev-prefix = "v"; };
+    updateScript = unstableGitUpdater { tagPrefix = "v"; };
     providedSessions = [ "miracle-wm" ];
     tests.vm = nixosTests.miracle-wm;
   };
diff --git a/pkgs/by-name/mo/models-dev/package.nix b/pkgs/by-name/mo/models-dev/package.nix
index 08ee5b69824a..0062f142dec5 100644
--- a/pkgs/by-name/mo/models-dev/package.nix
+++ b/pkgs/by-name/mo/models-dev/package.nix
@@ -17,12 +17,12 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "models-dev";
-  version = "0-unstable-2025-07-14";
+  version = "0-unstable-2025-07-16";
   src = fetchFromGitHub {
     owner = "sst";
     repo = "models.dev";
-    rev = "2b0849aa20d48c28e2bac1fa3762aec867a2e7c7";
-    hash = "sha256-SC2yOy+6xjiGgRuRJY6wCtzWjFJm/DUy+gSlMXXDgAk=";
+    rev = "a0eedfb30fb449322deaff0b349b3a194608789e";
+    hash = "sha256-+0FZmLxWz75wU5NIxjpX+H0oNa3gGgYCjoK8JdP7sOg=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {
diff --git a/pkgs/by-name/op/opencode/fix-models-macro.patch b/pkgs/by-name/op/opencode/fix-models-macro.patch
deleted file mode 100644
index 662ee617de83..000000000000
--- a/pkgs/by-name/op/opencode/fix-models-macro.patch
+++ /dev/null
@@ -1,8 +0,0 @@
---- a/packages/opencode/src/provider/models-macro.ts
-+++ b/packages/opencode/src/provider/models-macro.ts
-@@ -1,4 +1,3 @@
- export async function data() {
--  const json = await fetch("https://models.dev/api.json").then((x) => x.text())
--  return json
-+  return process.env.MODELS_JSON || '{}';
- }
diff --git a/pkgs/by-name/op/opencode/local-models-dev.patch b/pkgs/by-name/op/opencode/local-models-dev.patch
new file mode 100644
index 000000000000..21ecd38fb0c8
--- /dev/null
+++ b/pkgs/by-name/op/opencode/local-models-dev.patch
@@ -0,0 +1,20 @@
+diff --git i/packages/opencode/src/provider/models-macro.ts w/packages/opencode/src/provider/models-macro.ts
+index 91a0348..4f60069 100644
+--- i/packages/opencode/src/provider/models-macro.ts
++++ w/packages/opencode/src/provider/models-macro.ts
+@@ -1,4 +1,15 @@
+ export async function data() {
++  const localApiJsonPath = process.env.MODELS_DEV_API_JSON
++  
++  // Try to read from local file if path is provided
++  if (localApiJsonPath) {
++    const localFile = Bun.file(localApiJsonPath)
++    if (await localFile.exists()) {
++      return await localFile.text()
++    }
++  }
++  
++  // Fallback to fetching from remote URL
+   const json = await fetch("https://models.dev/api.json").then((x) => x.text())
+   return json
+ }
diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index 712e796f75f0..369e524cbbd0 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -4,7 +4,7 @@
   buildGoModule,
   bun,
   fetchFromGitHub,
-  fetchurl,
+  models-dev,
   nix-update-script,
   testers,
   writableTmpDirAsHomeHook,
@@ -106,17 +106,15 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     outputHashMode = "recursive";
   };
 
-  models-dev-data = fetchurl {
-    url = "https://models.dev/api.json";
-    sha256 = "sha256-igxQOC+Hz2FnXIW/S4Px9WhRuBhcIQIHO+7U8jHU1TQ=";
-  };
-
-  nativeBuildInputs = [ bun ];
+  nativeBuildInputs = [
+    bun
+    models-dev
+  ];
 
   patches = [
-    # Patch `packages/opencode/src/provider/models-macro.ts` to load the prefetched `models.dev/api.json`
-    # from the `MODELS_JSON` environment variable instead of fetching it at build time.
-    ./fix-models-macro.patch
+    # Patch `packages/opencode/src/provider/models-macro.ts` to get contents of
+    # `api.json` from the file bundled with `bun build`.
+    ./local-models-dev.patch
   ];
 
   configurePhase = ''
@@ -127,10 +125,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     runHook postConfigure
   '';
 
+  env.MODELS_DEV_API_JSON = "${models-dev}/dist/api.json";
+
   buildPhase = ''
     runHook preBuild
 
-    export MODELS_JSON="$(cat ${finalAttrs.models-dev-data})"
     bun build \
       --define OPENCODE_VERSION="'${finalAttrs.version}'" \
       --compile \
diff --git a/pkgs/by-name/tr/trezor-suite/package.nix b/pkgs/by-name/tr/trezor-suite/package.nix
index 3d4f9ce1d674..a74bcb96223e 100644
--- a/pkgs/by-name/tr/trezor-suite/package.nix
+++ b/pkgs/by-name/tr/trezor-suite/package.nix
@@ -10,7 +10,7 @@
 
 let
   pname = "trezor-suite";
-  version = "25.6.3";
+  version = "25.7.4";
 
   suffix =
     {
@@ -24,8 +24,8 @@ let
     hash =
       {
         # curl -Lfs https://github.com/trezor/trezor-suite/releases/download/v${version}/latest-linux{-arm64,}.yml | grep ^sha512 | sed 's/: /-/'
-        aarch64-linux = "sha512-uOfunT0I/Yt07r0J6/OFYN17N0V41oIJZqieineFVJW0Q+pLQc7Bvme4lfwa1l/gF9ciwwStEJRo3uuWDehFaw==";
-        x86_64-linux = "sha512-OkLee1qCM9jCZiiBOwYwiN0BasGa/OUHqJ4b4qMmr3u69EbchI5rvS3XfZ5GhkCI+9x32CAjUvRxlflAenC8RQ==";
+        aarch64-linux = "sha512-7QkyyeCDEEvNbH5qU+oS7ACLgE3lbXLJfeFeyofnfUdNOg68PJKM7ptQms0G/NN4xM0ME6trzbUucQI8QUfo4Q==";
+        x86_64-linux = "sha512-MOi/lTxPnMajP06lyfNKBuUTFWzHE61kitowfYryXVhomO3ww7eC5mE5pYzHRIbH7TE+kZm5eUL1hGO2JElPRw==";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
diff --git a/pkgs/development/python-modules/aiorpcx/default.nix b/pkgs/development/python-modules/aiorpcx/default.nix
index e17bb9db840d..db3f3f209416 100644
--- a/pkgs/development/python-modules/aiorpcx/default.nix
+++ b/pkgs/development/python-modules/aiorpcx/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "aiorpcx";
-  version = "0.24.0";
+  version = "0.25.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kyuupichan";
     repo = "aiorpcX";
-    tag = "0.24"; # TODO: https://github.com/kyuupichan/aiorpcX/issues/52
-    hash = "sha256-0c4AqKDWAmAFR1t42VE54kgbupe4ljajCR/TB5fZfME=";
+    tag = version;
+    hash = "sha256-mFg9mWrlnfXiQpgZ1rxvUy9TBfwy41XEKmsCf2nvxGo=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/electrum-aionostr/default.nix b/pkgs/development/python-modules/electrum-aionostr/default.nix
new file mode 100644
index 000000000000..8fd18b50d89b
--- /dev/null
+++ b/pkgs/development/python-modules/electrum-aionostr/default.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  aiohttp,
+  aiohttp-socks,
+  aiorpcx,
+  cryptography,
+  electrum-ecc,
+  click,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "electrum-aionostr";
+  version = "0.0.11";
+  pyproject = true;
+  build-system = [ setuptools ];
+
+  src = fetchPypi {
+    pname = "electrum_aionostr";
+    inherit version;
+    hash = "sha256-DusdAeVdS6ssEWJolloLLBFJBlnpaf2GTEUxBFWLz4E=";
+  };
+
+  dependencies = [
+    aiohttp
+    aiohttp-socks
+    aiorpcx
+    cryptography
+    electrum-ecc
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  checkInputs = [ click ];
+
+  pythonImportsCheck = [ "electrum_aionostr" ];
+
+  disabledTests = [
+    # command line interface is broken
+    "test_command_line_interface"
+  ];
+
+  meta = with lib; {
+    description = "Asyncio nostr client";
+    homepage = "https://github.com/spesmilo/electrum-aionostr";
+    license = licenses.bsd3;
+    maintainers = [ ];
+  };
+}
diff --git a/pkgs/development/python-modules/electrum-ecc/default.nix b/pkgs/development/python-modules/electrum-ecc/default.nix
new file mode 100644
index 000000000000..15595435f24e
--- /dev/null
+++ b/pkgs/development/python-modules/electrum-ecc/default.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  pkgs,
+  pytestCheckHook,
+}:
+
+let
+  libsecp256k1_name =
+    if stdenv.hostPlatform.isLinux then
+      "libsecp256k1.so.{v}"
+    else if stdenv.hostPlatform.isDarwin then
+      "libsecp256k1.{v}.dylib"
+    else
+      "libsecp256k1${stdenv.hostPlatform.extensions.sharedLibrary}";
+in
+buildPythonPackage rec {
+  pname = "electrum-ecc";
+  version = "0.0.5";
+  pyproject = true;
+  build-system = [ setuptools ];
+
+  src = fetchPypi {
+    pname = "electrum_ecc";
+    inherit version;
+    hash = "sha256-9zO4WWoPeyXINx0Ir2Hvece4cdW0DwWluV0tBesvt9I=";
+  };
+
+  env = {
+    # Prevent compilation of the C extension as we use the system library instead.
+    ELECTRUM_ECC_DONT_COMPILE = "1";
+  };
+
+  postPatch = ''
+    # remove bundled libsecp256k1
+    rm -rf libsecp256k1/
+    # use the system library instead
+    substituteInPlace ./src/electrum_ecc/ecc_fast.py \
+      --replace-fail ${libsecp256k1_name} ${pkgs.secp256k1}/lib/libsecp256k1${stdenv.hostPlatform.extensions.sharedLibrary}
+  '';
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "electrum_ecc" ];
+
+  meta = with lib; {
+    description = "Pure python ctypes wrapper for libsecp256k1";
+    homepage = "https://github.com/spesmilo/electrum-ecc";
+    license = licenses.mit;
+    maintainers = [ ];
+  };
+}
diff --git a/pkgs/development/python-modules/genie-partner-sdk/default.nix b/pkgs/development/python-modules/genie-partner-sdk/default.nix
index c61bd3a74a9c..e15b481c2928 100644
--- a/pkgs/development/python-modules/genie-partner-sdk/default.nix
+++ b/pkgs/development/python-modules/genie-partner-sdk/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "genie-partner-sdk";
-  version = "1.0.5";
+  version = "1.0.6";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "genie_partner_sdk";
-    hash = "sha256-JxsUaC7WgspUU9ngIc4GOjFr/lHjD2+5YlcLXtJH6LE=";
+    hash = "sha256-4RYNBRB1T60qoZV0+gnxepotPiRJGPS0ZJC28VaVrHg=";
   };
 
   nativeBuildInputs = [ hatchling ];
@@ -29,10 +29,10 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "genie_partner_sdk" ];
 
-  meta = with lib; {
+  meta = {
     description = "An SDK to interact with the AladdinConnect (or OHD) partner API";
     homepage = "https://github.com/Genie-Garage/aladdin-python-sdk";
-    license = licenses.unfree;
-    maintainers = with maintainers; [ jamiemagee ];
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
   };
 }
diff --git a/pkgs/os-specific/linux/kernel/linux-rpi.nix b/pkgs/os-specific/linux/kernel/linux-rpi.nix
index fb229afe8314..db13fbdf2426 100644
--- a/pkgs/os-specific/linux/kernel/linux-rpi.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rpi.nix
@@ -1,10 +1,7 @@
 {
   stdenv,
   lib,
-  buildPackages,
   fetchFromGitHub,
-  fetchpatch,
-  perl,
   buildLinux,
   rpiVersion,
   ...
@@ -12,8 +9,9 @@
 
 let
   # NOTE: raspberrypifw & raspberryPiWirelessFirmware should be updated with this
-  modDirVersion = "6.6.51";
-  tag = "stable_20241008";
+  modDirVersion = "6.12.34";
+  tag = "stable_20250702";
+  hash = "sha256-lK0esjFhLvtBbyddMfa1H7ZcBbcOm2ygor338ZT5VpI=";
 in
 lib.overrideDerivation
   (buildLinux (
@@ -26,8 +24,7 @@ lib.overrideDerivation
       src = fetchFromGitHub {
         owner = "raspberrypi";
         repo = "linux";
-        rev = tag;
-        hash = "sha256-phCxkuO+jUGZkfzSrBq6yErQeO2Td+inIGHxctXbD5U=";
+        inherit tag hash;
       };
 
       defconfig =
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index 76dec620576a..0aa39d4eb0af 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -14,12 +14,12 @@ let
   # kernel config in the xanmod version commit
   variants = {
     lts = {
-      version = "6.12.37";
-      hash = "sha256-VH5w802w6ugpMP5YPUuOJtf9TnrLZmFJUrGCQVH4n+s=";
+      version = "6.12.39";
+      hash = "sha256-yv8CtqqxJiiRjnZJrsqRw/q6B9JnS5nmnYlqTYWN6Kc=";
     };
     main = {
-      version = "6.15.6";
-      hash = "sha256-ArhRHMHvScV1Xa0lgBbM0hYtCAXujSCHA3aKEZnZSwU=";
+      version = "6.15.7";
+      hash = "sha256-YMDjtoGz/PQKmbB2umI+5mODP4A1NqzVusc9kg2zGzA=";
     };
   };
 
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index ae8246731df1..e32bcdeef46e 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -889,7 +889,11 @@ stdenv.mkDerivation (finalAttrs: {
   disallowedReferences =
     lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform)
       # 'or p' is for manually specified buildPackages as they dont have __spliced
-      (builtins.map (p: p.__spliced.buildHost or p) finalAttrs.nativeBuildInputs);
+      (
+        builtins.map (p: p.__spliced.buildHost or p) (
+          builtins.filter (p: p != null) finalAttrs.nativeBuildInputs
+        )
+      );
 
   passthru = {
     # The `interfaceVersion` attribute below points out the incompatibilities
diff --git a/pkgs/servers/mir/common.nix b/pkgs/servers/mir/common.nix
index ccc1150db5b7..a9e66792a87c 100644
--- a/pkgs/servers/mir/common.nix
+++ b/pkgs/servers/mir/common.nix
@@ -26,6 +26,7 @@
   lttng-ust,
   libgbm,
   nettle,
+  pixman,
   udev,
   wayland,
   wayland-scanner,
@@ -105,32 +106,39 @@ stdenv.mkDerivation (finalAttrs: {
     wayland-scanner
   ];
 
-  buildInputs = [
-    boost
-    egl-wayland
-    freetype
-    glib
-    glm
-    libdrm
-    libepoxy
-    libevdev
-    libglvnd
-    libinput
-    libuuid
-    libxcb
-    libxkbcommon
-    libxmlxx
-    yaml-cpp
-    lttng-ust
-    libgbm
-    nettle
-    udev
-    wayland
-    xorg.libX11
-    xorg.libXcursor
-    xorg.xorgproto
-    xwayland
-  ] ++ lib.optionals (lib.strings.versionAtLeast version "2.18.0") [ libapparmor ];
+  buildInputs =
+    [
+      boost
+      egl-wayland
+      freetype
+      glib
+      glm
+      libdrm
+      libepoxy
+      libevdev
+      libglvnd
+      libinput
+      libuuid
+      libxcb
+      libxkbcommon
+      libxmlxx
+      yaml-cpp
+      lttng-ust
+      libgbm
+      nettle
+      udev
+      wayland
+      xorg.libX11
+      xorg.libXcursor
+      xorg.xorgproto
+      xwayland
+    ]
+    ++ lib.optionals (lib.strings.versionAtLeast version "2.18.0") [
+      libapparmor
+    ]
+    ++ lib.optionals (lib.strings.versionAtLeast version "2.21.0") [
+      pixman
+    ];
 
   nativeCheckInputs = [
     dbus
diff --git a/pkgs/servers/mir/default.nix b/pkgs/servers/mir/default.nix
index 70da32a40b53..0012c260114b 100644
--- a/pkgs/servers/mir/default.nix
+++ b/pkgs/servers/mir/default.nix
@@ -5,8 +5,15 @@ let
 in
 {
   mir = common {
-    version = "2.20.2";
-    hash = "sha256-kxXPRIvgvpWqos8l/fJyHvfJBNi0jOZfV5inY3SBavM=";
+    version = "2.21.1";
+    hash = "sha256-FDZ40LiuvMuyWQQGjgOHTm+J3i7yczKMzL3dZ1jsz/E=";
+    patches = [
+      (fetchpatch {
+        name = "0001-Fix-gtest-nodiscard-error.patch";
+        url = "https://github.com/canonical/mir/commit/60dab2b197deb159087e44865e7314ad2865b79d.patch";
+        hash = "sha256-fB49E+Wjm2zJnie9Ws+tP0d6lxcG3V/C/UDfy/4iuFU=";
+      })
+    ];
   };
 
   mir_2_15 = common {
diff --git a/pkgs/servers/sql/postgresql/generic.nix b/pkgs/servers/sql/postgresql/generic.nix
index 127a346dbf14..3f8c4f893f24 100644
--- a/pkgs/servers/sql/postgresql/generic.nix
+++ b/pkgs/servers/sql/postgresql/generic.nix
@@ -102,11 +102,11 @@ let
       numaSupport ?
         lib.versionAtLeast version "18"
         && lib.meta.availableOn stdenv.hostPlatform numactl
-        # NUMA can fail in 18beta1 on some hardware with:
+        # NUMA can fail in 18beta2 on some hardware with:
         # ERROR:  invalid NUMA node id outside of allowed range [0, 0]: 1
         # https://github.com/NixOS/nixpkgs/pull/411958#issuecomment-3031680123
         # https://www.postgresql.org/message-id/flat/E1u1tr8-003BbN-2E%40gemulon.postgresql.org
-        && version != "18beta1",
+        && version != "18beta2",
       numactl,
 
       # PAM
diff --git a/pkgs/tools/admin/meshcentral/default.nix b/pkgs/tools/admin/meshcentral/default.nix
index b11b4a7835cf..33fd196ea964 100644
--- a/pkgs/tools/admin/meshcentral/default.nix
+++ b/pkgs/tools/admin/meshcentral/default.nix
@@ -8,11 +8,11 @@
 }:
 
 yarn2nix-moretea.mkYarnPackage {
-  version = "1.1.46";
+  version = "1.1.47";
 
   src = fetchzip {
-    url = "https://registry.npmjs.org/meshcentral/-/meshcentral-1.1.46.tgz";
-    sha256 = "143ls8455c4vaj0cnai08h7f8mj8llzbjaa54mhcri0aqdh5b5yg";
+    url = "https://registry.npmjs.org/meshcentral/-/meshcentral-1.1.47.tgz";
+    sha256 = "196d2rzmy5caaw42d3az9m4yfwjsgia82g7ic71knamd28q9rab2";
   };
 
   patches = [
@@ -24,7 +24,7 @@ yarn2nix-moretea.mkYarnPackage {
 
   offlineCache = fetchYarnDeps {
     yarnLock = ./yarn.lock;
-    hash = "sha256-VzxNWtbn/ToODqE3jU7n0xpaOZmst55wJ2+dZLonIaA=";
+    hash = "sha256-2pU0XhkiDNjkZiXA2S4RMTY4IyVEnsV/vEDtYnPjOfk=";
   };
 
   # Tarball has CRLF line endings. This makes patching difficult, so let's convert them.
diff --git a/pkgs/tools/admin/meshcentral/package.json b/pkgs/tools/admin/meshcentral/package.json
index aa9b9bdc8ec8..458ec1ed6b35 100644
--- a/pkgs/tools/admin/meshcentral/package.json
+++ b/pkgs/tools/admin/meshcentral/package.json
@@ -1,6 +1,6 @@
 {
   "name": "meshcentral",
-  "version": "1.1.46",
+  "version": "1.1.47",
   "keywords": [
     "Remote Device Management",
     "Remote Device Monitoring",
diff --git a/pkgs/tools/admin/meshcentral/yarn.lock b/pkgs/tools/admin/meshcentral/yarn.lock
index 38c25442581b..c63c14095127 100644
--- a/pkgs/tools/admin/meshcentral/yarn.lock
+++ b/pkgs/tools/admin/meshcentral/yarn.lock
@@ -48,166 +48,166 @@
     "@smithy/util-utf8" "^2.0.0"
     tslib "^2.6.2"
 
-"@aws-sdk/client-cognito-identity@3.840.0":
-  version "3.840.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/client-cognito-identity/-/client-cognito-identity-3.840.0.tgz#2fb8b8ac30c8418c46c42fef447ab13151492cab"
-  integrity sha512-0sn/X63Xqqh5D1FYmdSHiS9SkDzTitoGO++/8IFik4xf/jpn4ZQkIoDPvpxFZcLvebMuUa6jAQs4ap4RusKGkg==
+"@aws-sdk/client-cognito-identity@3.846.0":
+  version "3.846.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/client-cognito-identity/-/client-cognito-identity-3.846.0.tgz#f7bfecb0c731df961058b4f63029f7556cb7eda6"
+  integrity sha512-vlzQVq1TOOYHPppmON/+oNhCxprCPPqxlqAuUddf885JcT6Q9r7FeV7S2yHli/1XC6vBa7sAninNvOjzwDbwYw==
   dependencies:
     "@aws-crypto/sha256-browser" "5.2.0"
     "@aws-crypto/sha256-js" "5.2.0"
-    "@aws-sdk/core" "3.840.0"
-    "@aws-sdk/credential-provider-node" "3.840.0"
+    "@aws-sdk/core" "3.846.0"
+    "@aws-sdk/credential-provider-node" "3.846.0"
     "@aws-sdk/middleware-host-header" "3.840.0"
     "@aws-sdk/middleware-logger" "3.840.0"
     "@aws-sdk/middleware-recursion-detection" "3.840.0"
-    "@aws-sdk/middleware-user-agent" "3.840.0"
+    "@aws-sdk/middleware-user-agent" "3.846.0"
     "@aws-sdk/region-config-resolver" "3.840.0"
     "@aws-sdk/types" "3.840.0"
-    "@aws-sdk/util-endpoints" "3.840.0"
+    "@aws-sdk/util-endpoints" "3.845.0"
     "@aws-sdk/util-user-agent-browser" "3.840.0"
-    "@aws-sdk/util-user-agent-node" "3.840.0"
+    "@aws-sdk/util-user-agent-node" "3.846.0"
     "@smithy/config-resolver" "^4.1.4"
-    "@smithy/core" "^3.6.0"
-    "@smithy/fetch-http-handler" "^5.0.4"
+    "@smithy/core" "^3.7.0"
+    "@smithy/fetch-http-handler" "^5.1.0"
     "@smithy/hash-node" "^4.0.4"
     "@smithy/invalid-dependency" "^4.0.4"
     "@smithy/middleware-content-length" "^4.0.4"
-    "@smithy/middleware-endpoint" "^4.1.13"
-    "@smithy/middleware-retry" "^4.1.14"
+    "@smithy/middleware-endpoint" "^4.1.15"
+    "@smithy/middleware-retry" "^4.1.16"
     "@smithy/middleware-serde" "^4.0.8"
     "@smithy/middleware-stack" "^4.0.4"
     "@smithy/node-config-provider" "^4.1.3"
-    "@smithy/node-http-handler" "^4.0.6"
+    "@smithy/node-http-handler" "^4.1.0"
     "@smithy/protocol-http" "^5.1.2"
-    "@smithy/smithy-client" "^4.4.5"
+    "@smithy/smithy-client" "^4.4.7"
     "@smithy/types" "^4.3.1"
     "@smithy/url-parser" "^4.0.4"
     "@smithy/util-base64" "^4.0.0"
     "@smithy/util-body-length-browser" "^4.0.0"
     "@smithy/util-body-length-node" "^4.0.0"
-    "@smithy/util-defaults-mode-browser" "^4.0.21"
-    "@smithy/util-defaults-mode-node" "^4.0.21"
+    "@smithy/util-defaults-mode-browser" "^4.0.23"
+    "@smithy/util-defaults-mode-node" "^4.0.23"
     "@smithy/util-endpoints" "^3.0.6"
     "@smithy/util-middleware" "^4.0.4"
     "@smithy/util-retry" "^4.0.6"
     "@smithy/util-utf8" "^4.0.0"
     tslib "^2.6.2"
 
-"@aws-sdk/client-sso@3.840.0":
-  version "3.840.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/client-sso/-/client-sso-3.840.0.tgz#74cce04e0192d192e5d9926fcc7f365811e586f0"
-  integrity sha512-3Zp+FWN2hhmKdpS0Ragi5V2ZPsZNScE3jlbgoJjzjI/roHZqO+e3/+XFN4TlM0DsPKYJNp+1TAjmhxN6rOnfYA==
+"@aws-sdk/client-sso@3.846.0":
+  version "3.846.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/client-sso/-/client-sso-3.846.0.tgz#9905ccf216e371c94ca63b1df19dba923d286307"
+  integrity sha512-7MgMl3nlwf2ixad5Xe8pFHtcwFchkx37MEvGuB00tn5jyBp3AQQ4dK3iHtj2HjhXcXD0G67zVPvH4/QNOL7/gw==
   dependencies:
     "@aws-crypto/sha256-browser" "5.2.0"
     "@aws-crypto/sha256-js" "5.2.0"
-    "@aws-sdk/core" "3.840.0"
+    "@aws-sdk/core" "3.846.0"
     "@aws-sdk/middleware-host-header" "3.840.0"
     "@aws-sdk/middleware-logger" "3.840.0"
     "@aws-sdk/middleware-recursion-detection" "3.840.0"
-    "@aws-sdk/middleware-user-agent" "3.840.0"
+    "@aws-sdk/middleware-user-agent" "3.846.0"
     "@aws-sdk/region-config-resolver" "3.840.0"
     "@aws-sdk/types" "3.840.0"
-    "@aws-sdk/util-endpoints" "3.840.0"
+    "@aws-sdk/util-endpoints" "3.845.0"
     "@aws-sdk/util-user-agent-browser" "3.840.0"
-    "@aws-sdk/util-user-agent-node" "3.840.0"
+    "@aws-sdk/util-user-agent-node" "3.846.0"
     "@smithy/config-resolver" "^4.1.4"
-    "@smithy/core" "^3.6.0"
-    "@smithy/fetch-http-handler" "^5.0.4"
+    "@smithy/core" "^3.7.0"
+    "@smithy/fetch-http-handler" "^5.1.0"
     "@smithy/hash-node" "^4.0.4"
     "@smithy/invalid-dependency" "^4.0.4"
     "@smithy/middleware-content-length" "^4.0.4"
-    "@smithy/middleware-endpoint" "^4.1.13"
-    "@smithy/middleware-retry" "^4.1.14"
+    "@smithy/middleware-endpoint" "^4.1.15"
+    "@smithy/middleware-retry" "^4.1.16"
     "@smithy/middleware-serde" "^4.0.8"
     "@smithy/middleware-stack" "^4.0.4"
     "@smithy/node-config-provider" "^4.1.3"
-    "@smithy/node-http-handler" "^4.0.6"
+    "@smithy/node-http-handler" "^4.1.0"
     "@smithy/protocol-http" "^5.1.2"
-    "@smithy/smithy-client" "^4.4.5"
+    "@smithy/smithy-client" "^4.4.7"
     "@smithy/types" "^4.3.1"
     "@smithy/url-parser" "^4.0.4"
     "@smithy/util-base64" "^4.0.0"
     "@smithy/util-body-length-browser" "^4.0.0"
     "@smithy/util-body-length-node" "^4.0.0"
-    "@smithy/util-defaults-mode-browser" "^4.0.21"
-    "@smithy/util-defaults-mode-node" "^4.0.21"
+    "@smithy/util-defaults-mode-browser" "^4.0.23"
+    "@smithy/util-defaults-mode-node" "^4.0.23"
     "@smithy/util-endpoints" "^3.0.6"
     "@smithy/util-middleware" "^4.0.4"
     "@smithy/util-retry" "^4.0.6"
     "@smithy/util-utf8" "^4.0.0"
     tslib "^2.6.2"
 
-"@aws-sdk/core@3.840.0":
-  version "3.840.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/core/-/core-3.840.0.tgz#8eb2c2ba7c258ebbc13d8ea6c45b619b145dc147"
-  integrity sha512-x3Zgb39tF1h2XpU+yA4OAAQlW6LVEfXNlSedSYJ7HGKXqA/E9h3rWQVpYfhXXVVsLdYXdNw5KBUkoAoruoZSZA==
+"@aws-sdk/core@3.846.0":
+  version "3.846.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/core/-/core-3.846.0.tgz#f226d7d4f9b25f31dfda260f7ef1f4de8e4314fa"
+  integrity sha512-7CX0pM906r4WSS68fCTNMTtBCSkTtf3Wggssmx13gD40gcWEZXsU00KzPp1bYheNRyPlAq3rE22xt4wLPXbuxA==
   dependencies:
     "@aws-sdk/types" "3.840.0"
     "@aws-sdk/xml-builder" "3.821.0"
-    "@smithy/core" "^3.6.0"
+    "@smithy/core" "^3.7.0"
     "@smithy/node-config-provider" "^4.1.3"
     "@smithy/property-provider" "^4.0.4"
     "@smithy/protocol-http" "^5.1.2"
     "@smithy/signature-v4" "^5.1.2"
-    "@smithy/smithy-client" "^4.4.5"
+    "@smithy/smithy-client" "^4.4.7"
     "@smithy/types" "^4.3.1"
     "@smithy/util-base64" "^4.0.0"
     "@smithy/util-body-length-browser" "^4.0.0"
     "@smithy/util-middleware" "^4.0.4"
     "@smithy/util-utf8" "^4.0.0"
-    fast-xml-parser "4.4.1"
+    fast-xml-parser "5.2.5"
     tslib "^2.6.2"
 
-"@aws-sdk/credential-provider-cognito-identity@3.840.0":
-  version "3.840.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-cognito-identity/-/credential-provider-cognito-identity-3.840.0.tgz#fb911466aa782f15f76f26f852a87994f6f92856"
-  integrity sha512-p1RaMVd6+6ruYjKsWRCZT/jWhrYfDKbXY+/ScIYTvcaOOf9ArMtVnhFk3egewrC7kPXFGRYhg2GPmxRotNYMng==
+"@aws-sdk/credential-provider-cognito-identity@3.846.0":
+  version "3.846.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-cognito-identity/-/credential-provider-cognito-identity-3.846.0.tgz#61c09e6a3ccf325991f2e335378fd40d6018f44b"
+  integrity sha512-zfcNFUK0QC7czR/n3ATMp3ZWkMrGZzJ1mS/sTezjFg1IupFnogyF+8xKmnmqXiABJd1yE8FduYgw8yx0ZSWiCw==
   dependencies:
-    "@aws-sdk/client-cognito-identity" "3.840.0"
+    "@aws-sdk/client-cognito-identity" "3.846.0"
     "@aws-sdk/types" "3.840.0"
     "@smithy/property-provider" "^4.0.4"
     "@smithy/types" "^4.3.1"
     tslib "^2.6.2"
 
-"@aws-sdk/credential-provider-env@3.840.0":
-  version "3.840.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-env/-/credential-provider-env-3.840.0.tgz#0410a67ed6508ff642df17090d2f4fb61c1e329a"
-  integrity sha512-EzF6VcJK7XvQ/G15AVEfJzN2mNXU8fcVpXo4bRyr1S6t2q5zx6UPH/XjDbn18xyUmOq01t+r8gG+TmHEVo18fA==
+"@aws-sdk/credential-provider-env@3.846.0":
+  version "3.846.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-env/-/credential-provider-env-3.846.0.tgz#b47637b123544971f4d1c7300ea77b70143a7141"
+  integrity sha512-QuCQZET9enja7AWVISY+mpFrEIeHzvkx/JEEbHYzHhUkxcnC2Kq2c0bB7hDihGD0AZd3Xsm653hk1O97qu69zg==
   dependencies:
-    "@aws-sdk/core" "3.840.0"
+    "@aws-sdk/core" "3.846.0"
     "@aws-sdk/types" "3.840.0"
     "@smithy/property-provider" "^4.0.4"
     "@smithy/types" "^4.3.1"
     tslib "^2.6.2"
 
-"@aws-sdk/credential-provider-http@3.840.0":
-  version "3.840.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-http/-/credential-provider-http-3.840.0.tgz#46ee53ff2f22adf4d5cdb83be946ea6554dfc280"
-  integrity sha512-wbnUiPGLVea6mXbUh04fu+VJmGkQvmToPeTYdHE8eRZq3NRDi3t3WltT+jArLBKD/4NppRpMjf2ju4coMCz91g==
+"@aws-sdk/credential-provider-http@3.846.0":
+  version "3.846.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-http/-/credential-provider-http-3.846.0.tgz#fe8b36493070a3444d76082b5129450598563fe0"
+  integrity sha512-Jh1iKUuepdmtreMYozV2ePsPcOF5W9p3U4tWhi3v6nDvz0GsBjzjAROW+BW8XMz9vAD3I9R+8VC3/aq63p5nlw==
   dependencies:
-    "@aws-sdk/core" "3.840.0"
+    "@aws-sdk/core" "3.846.0"
     "@aws-sdk/types" "3.840.0"
-    "@smithy/fetch-http-handler" "^5.0.4"
-    "@smithy/node-http-handler" "^4.0.6"
+    "@smithy/fetch-http-handler" "^5.1.0"
+    "@smithy/node-http-handler" "^4.1.0"
     "@smithy/property-provider" "^4.0.4"
     "@smithy/protocol-http" "^5.1.2"
-    "@smithy/smithy-client" "^4.4.5"
+    "@smithy/smithy-client" "^4.4.7"
     "@smithy/types" "^4.3.1"
-    "@smithy/util-stream" "^4.2.2"
+    "@smithy/util-stream" "^4.2.3"
     tslib "^2.6.2"
 
-"@aws-sdk/credential-provider-ini@3.840.0":
-  version "3.840.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-ini/-/credential-provider-ini-3.840.0.tgz#d4c53a45803caa32a31033ae12cbdf5ab8ba0400"
-  integrity sha512-7F290BsWydShHb+7InXd+IjJc3mlEIm9I0R57F/Pjl1xZB69MdkhVGCnuETWoBt4g53ktJd6NEjzm/iAhFXFmw==
+"@aws-sdk/credential-provider-ini@3.846.0":
+  version "3.846.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-ini/-/credential-provider-ini-3.846.0.tgz#3d4df54131048d745a04ab3b4af95407f49f7514"
+  integrity sha512-GUxaBBKsYx1kOlRbcs77l6BVyG9K70zekJX+5hdwTEgJq7AoHl/XYoWiDxPf6zQ7J4euixPJoyRhpNbJjAXdFw==
   dependencies:
-    "@aws-sdk/core" "3.840.0"
-    "@aws-sdk/credential-provider-env" "3.840.0"
-    "@aws-sdk/credential-provider-http" "3.840.0"
-    "@aws-sdk/credential-provider-process" "3.840.0"
-    "@aws-sdk/credential-provider-sso" "3.840.0"
-    "@aws-sdk/credential-provider-web-identity" "3.840.0"
-    "@aws-sdk/nested-clients" "3.840.0"
+    "@aws-sdk/core" "3.846.0"
+    "@aws-sdk/credential-provider-env" "3.846.0"
+    "@aws-sdk/credential-provider-http" "3.846.0"
+    "@aws-sdk/credential-provider-process" "3.846.0"
+    "@aws-sdk/credential-provider-sso" "3.846.0"
+    "@aws-sdk/credential-provider-web-identity" "3.846.0"
+    "@aws-sdk/nested-clients" "3.846.0"
     "@aws-sdk/types" "3.840.0"
     "@smithy/credential-provider-imds" "^4.0.6"
     "@smithy/property-provider" "^4.0.4"
@@ -215,17 +215,17 @@
     "@smithy/types" "^4.3.1"
     tslib "^2.6.2"
 
-"@aws-sdk/credential-provider-node@3.840.0":
-  version "3.840.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-node/-/credential-provider-node-3.840.0.tgz#9320c35fd0597661b255465f3650b56ddd05a40d"
-  integrity sha512-KufP8JnxA31wxklLm63evUPSFApGcH8X86z3mv9SRbpCm5ycgWIGVCTXpTOdgq6rPZrwT9pftzv2/b4mV/9clg==
+"@aws-sdk/credential-provider-node@3.846.0":
+  version "3.846.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-node/-/credential-provider-node-3.846.0.tgz#576d302e7d5af1abc7e5b95695dd97afa03ad2f8"
+  integrity sha512-du2DsXYRfQ8VIt/gXGThhT8KdUEt2j9W91W87Bl9IA5DINt4nSZv+gzh8LqHBYsTSqoUpKb+qIfP1RjZM/8r0A==
   dependencies:
-    "@aws-sdk/credential-provider-env" "3.840.0"
-    "@aws-sdk/credential-provider-http" "3.840.0"
-    "@aws-sdk/credential-provider-ini" "3.840.0"
-    "@aws-sdk/credential-provider-process" "3.840.0"
-    "@aws-sdk/credential-provider-sso" "3.840.0"
-    "@aws-sdk/credential-provider-web-identity" "3.840.0"
+    "@aws-sdk/credential-provider-env" "3.846.0"
+    "@aws-sdk/credential-provider-http" "3.846.0"
+    "@aws-sdk/credential-provider-ini" "3.846.0"
+    "@aws-sdk/credential-provider-process" "3.846.0"
+    "@aws-sdk/credential-provider-sso" "3.846.0"
+    "@aws-sdk/credential-provider-web-identity" "3.846.0"
     "@aws-sdk/types" "3.840.0"
     "@smithy/credential-provider-imds" "^4.0.6"
     "@smithy/property-provider" "^4.0.4"
@@ -233,63 +233,63 @@
     "@smithy/types" "^4.3.1"
     tslib "^2.6.2"
 
-"@aws-sdk/credential-provider-process@3.840.0":
-  version "3.840.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-process/-/credential-provider-process-3.840.0.tgz#ac775db4d4e89fae7966da9b1fde4308f2ceca7a"
-  integrity sha512-HkDQWHy8tCI4A0Ps2NVtuVYMv9cB4y/IuD/TdOsqeRIAT12h8jDb98BwQPNLAImAOwOWzZJ8Cu0xtSpX7CQhMw==
+"@aws-sdk/credential-provider-process@3.846.0":
+  version "3.846.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-process/-/credential-provider-process-3.846.0.tgz#19d22592594ca554a83148313651d5167c181fc3"
+  integrity sha512-mEpwDYarJSH+CIXnnHN0QOe0MXI+HuPStD6gsv3z/7Q6ESl8KRWon3weFZCDnqpiJMUVavlDR0PPlAFg2MQoPg==
   dependencies:
-    "@aws-sdk/core" "3.840.0"
+    "@aws-sdk/core" "3.846.0"
     "@aws-sdk/types" "3.840.0"
     "@smithy/property-provider" "^4.0.4"
     "@smithy/shared-ini-file-loader" "^4.0.4"
     "@smithy/types" "^4.3.1"
     tslib "^2.6.2"
 
-"@aws-sdk/credential-provider-sso@3.840.0":
-  version "3.840.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-sso/-/credential-provider-sso-3.840.0.tgz#44dc39fc4e8a619a5aed0fa2f1663de3a54a3304"
-  integrity sha512-2qgdtdd6R0Z1y0KL8gzzwFUGmhBHSUx4zy85L2XV1CXhpRNwV71SVWJqLDVV5RVWVf9mg50Pm3AWrUC0xb0pcA==
+"@aws-sdk/credential-provider-sso@3.846.0":
+  version "3.846.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-sso/-/credential-provider-sso-3.846.0.tgz#6c1040a3476e877a769075682c3f7c105f16460b"
+  integrity sha512-Dxz9dpdjfxUsSfW92SAldu9wy8wgEbskn4BNWBFHslQHTmqurmR0ci4P1SMxJJKd498AUEoIAzZOtjGOC38irQ==
   dependencies:
-    "@aws-sdk/client-sso" "3.840.0"
-    "@aws-sdk/core" "3.840.0"
-    "@aws-sdk/token-providers" "3.840.0"
+    "@aws-sdk/client-sso" "3.846.0"
+    "@aws-sdk/core" "3.846.0"
+    "@aws-sdk/token-providers" "3.846.0"
     "@aws-sdk/types" "3.840.0"
     "@smithy/property-provider" "^4.0.4"
     "@smithy/shared-ini-file-loader" "^4.0.4"
     "@smithy/types" "^4.3.1"
     tslib "^2.6.2"
 
-"@aws-sdk/credential-provider-web-identity@3.840.0":
-  version "3.840.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-web-identity/-/credential-provider-web-identity-3.840.0.tgz#5db983a9fb92110fa6e3f61e2a982a96f571c5c4"
-  integrity sha512-dpEeVXG8uNZSmVXReE4WP0lwoioX2gstk4RnUgrdUE3YaPq8A+hJiVAyc3h+cjDeIqfbsQbZm9qFetKC2LF9dQ==
+"@aws-sdk/credential-provider-web-identity@3.846.0":
+  version "3.846.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-provider-web-identity/-/credential-provider-web-identity-3.846.0.tgz#939629e1cf2b778168f350ea79aaf278b357317e"
+  integrity sha512-j6zOd+kynPQJzmVwSKSUTpsLXAf7vKkr7hCPbQyqC8ZqkIuExsRqu2vRQjX2iH/MKhwZ+qEWMxPMhfDoyv7Gag==
   dependencies:
-    "@aws-sdk/core" "3.840.0"
-    "@aws-sdk/nested-clients" "3.840.0"
+    "@aws-sdk/core" "3.846.0"
+    "@aws-sdk/nested-clients" "3.846.0"
     "@aws-sdk/types" "3.840.0"
     "@smithy/property-provider" "^4.0.4"
     "@smithy/types" "^4.3.1"
     tslib "^2.6.2"
 
 "@aws-sdk/credential-providers@^3.186.0":
-  version "3.840.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-providers/-/credential-providers-3.840.0.tgz#68a1febaeb564527b96515ee0e5767405e208550"
-  integrity sha512-+CxYdGd+uM4NZ9VUvFTU1c/H61qhDB4q362k8xKU+bz24g//LDQ5Mpwksv8OUD1en44v4fUwgZ4SthPZMs+eFQ==
+  version "3.846.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/credential-providers/-/credential-providers-3.846.0.tgz#98c348ec6551f7dc832bfc369fe221b2b71e4846"
+  integrity sha512-YpTJcV5PO0V+I1nRGAyNF/kCcOIgPgzihlAyOqicmq3vZ8UHZqUCOfzcS6qbEpPFeAB3domzBgsAJNsQXht4SA==
   dependencies:
-    "@aws-sdk/client-cognito-identity" "3.840.0"
-    "@aws-sdk/core" "3.840.0"
-    "@aws-sdk/credential-provider-cognito-identity" "3.840.0"
-    "@aws-sdk/credential-provider-env" "3.840.0"
-    "@aws-sdk/credential-provider-http" "3.840.0"
-    "@aws-sdk/credential-provider-ini" "3.840.0"
-    "@aws-sdk/credential-provider-node" "3.840.0"
-    "@aws-sdk/credential-provider-process" "3.840.0"
-    "@aws-sdk/credential-provider-sso" "3.840.0"
-    "@aws-sdk/credential-provider-web-identity" "3.840.0"
-    "@aws-sdk/nested-clients" "3.840.0"
+    "@aws-sdk/client-cognito-identity" "3.846.0"
+    "@aws-sdk/core" "3.846.0"
+    "@aws-sdk/credential-provider-cognito-identity" "3.846.0"
+    "@aws-sdk/credential-provider-env" "3.846.0"
+    "@aws-sdk/credential-provider-http" "3.846.0"
+    "@aws-sdk/credential-provider-ini" "3.846.0"
+    "@aws-sdk/credential-provider-node" "3.846.0"
+    "@aws-sdk/credential-provider-process" "3.846.0"
+    "@aws-sdk/credential-provider-sso" "3.846.0"
+    "@aws-sdk/credential-provider-web-identity" "3.846.0"
+    "@aws-sdk/nested-clients" "3.846.0"
     "@aws-sdk/types" "3.840.0"
     "@smithy/config-resolver" "^4.1.4"
-    "@smithy/core" "^3.6.0"
+    "@smithy/core" "^3.7.0"
     "@smithy/credential-provider-imds" "^4.0.6"
     "@smithy/node-config-provider" "^4.1.3"
     "@smithy/property-provider" "^4.0.4"
@@ -325,57 +325,57 @@
     "@smithy/types" "^4.3.1"
     tslib "^2.6.2"
 
-"@aws-sdk/middleware-user-agent@3.840.0":
-  version "3.840.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-user-agent/-/middleware-user-agent-3.840.0.tgz#3702abf6c7cf86e776e695427a4da0bc13bcc994"
-  integrity sha512-hiiMf7BP5ZkAFAvWRcK67Mw/g55ar7OCrvrynC92hunx/xhMkrgSLM0EXIZ1oTn3uql9kH/qqGF0nqsK6K555A==
+"@aws-sdk/middleware-user-agent@3.846.0":
+  version "3.846.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/middleware-user-agent/-/middleware-user-agent-3.846.0.tgz#e038f60b1b12b2c44a41c831925f52347ca27540"
+  integrity sha512-85/oUc2jMXqQWo+HHH7WwrdqqArzhMmTmBCpXZwklBHG+ZMzTS5Wug2B0HhGDVWo9aYRMeikSq4lsrpHFVd2MQ==
   dependencies:
-    "@aws-sdk/core" "3.840.0"
+    "@aws-sdk/core" "3.846.0"
     "@aws-sdk/types" "3.840.0"
-    "@aws-sdk/util-endpoints" "3.840.0"
-    "@smithy/core" "^3.6.0"
+    "@aws-sdk/util-endpoints" "3.845.0"
+    "@smithy/core" "^3.7.0"
     "@smithy/protocol-http" "^5.1.2"
     "@smithy/types" "^4.3.1"
     tslib "^2.6.2"
 
-"@aws-sdk/nested-clients@3.840.0":
-  version "3.840.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/nested-clients/-/nested-clients-3.840.0.tgz#a4d167b358756838341fc7d282ee273c00259c49"
-  integrity sha512-LXYYo9+n4hRqnRSIMXLBb+BLz+cEmjMtTudwK1BF6Bn2RfdDv29KuyeDRrPCS3TwKl7ZKmXUmE9n5UuHAPfBpA==
+"@aws-sdk/nested-clients@3.846.0":
+  version "3.846.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/nested-clients/-/nested-clients-3.846.0.tgz#c0389df04f04e6f4d124a605cc17b2b3f9a82faa"
+  integrity sha512-LCXPVtNQnkTuE8inPCtpfWN2raE/ndFBKf5OIbuHnC/0XYGOUl5q7VsJz471zJuN9FX3WMfopaFwmNc7cQNMpQ==
   dependencies:
     "@aws-crypto/sha256-browser" "5.2.0"
     "@aws-crypto/sha256-js" "5.2.0"
-    "@aws-sdk/core" "3.840.0"
+    "@aws-sdk/core" "3.846.0"
     "@aws-sdk/middleware-host-header" "3.840.0"
     "@aws-sdk/middleware-logger" "3.840.0"
     "@aws-sdk/middleware-recursion-detection" "3.840.0"
-    "@aws-sdk/middleware-user-agent" "3.840.0"
+    "@aws-sdk/middleware-user-agent" "3.846.0"
     "@aws-sdk/region-config-resolver" "3.840.0"
     "@aws-sdk/types" "3.840.0"
-    "@aws-sdk/util-endpoints" "3.840.0"
+    "@aws-sdk/util-endpoints" "3.845.0"
     "@aws-sdk/util-user-agent-browser" "3.840.0"
-    "@aws-sdk/util-user-agent-node" "3.840.0"
+    "@aws-sdk/util-user-agent-node" "3.846.0"
     "@smithy/config-resolver" "^4.1.4"
-    "@smithy/core" "^3.6.0"
-    "@smithy/fetch-http-handler" "^5.0.4"
+    "@smithy/core" "^3.7.0"
+    "@smithy/fetch-http-handler" "^5.1.0"
     "@smithy/hash-node" "^4.0.4"
     "@smithy/invalid-dependency" "^4.0.4"
     "@smithy/middleware-content-length" "^4.0.4"
-    "@smithy/middleware-endpoint" "^4.1.13"
-    "@smithy/middleware-retry" "^4.1.14"
+    "@smithy/middleware-endpoint" "^4.1.15"
+    "@smithy/middleware-retry" "^4.1.16"
     "@smithy/middleware-serde" "^4.0.8"
     "@smithy/middleware-stack" "^4.0.4"
     "@smithy/node-config-provider" "^4.1.3"
-    "@smithy/node-http-handler" "^4.0.6"
+    "@smithy/node-http-handler" "^4.1.0"
     "@smithy/protocol-http" "^5.1.2"
-    "@smithy/smithy-client" "^4.4.5"
+    "@smithy/smithy-client" "^4.4.7"
     "@smithy/types" "^4.3.1"
     "@smithy/url-parser" "^4.0.4"
     "@smithy/util-base64" "^4.0.0"
     "@smithy/util-body-length-browser" "^4.0.0"
     "@smithy/util-body-length-node" "^4.0.0"
-    "@smithy/util-defaults-mode-browser" "^4.0.21"
-    "@smithy/util-defaults-mode-node" "^4.0.21"
+    "@smithy/util-defaults-mode-browser" "^4.0.23"
+    "@smithy/util-defaults-mode-node" "^4.0.23"
     "@smithy/util-endpoints" "^3.0.6"
     "@smithy/util-middleware" "^4.0.4"
     "@smithy/util-retry" "^4.0.6"
@@ -394,13 +394,13 @@
     "@smithy/util-middleware" "^4.0.4"
     tslib "^2.6.2"
 
-"@aws-sdk/token-providers@3.840.0":
-  version "3.840.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/token-providers/-/token-providers-3.840.0.tgz#4545a115bb2a9ed6e0b5631f7b97d10f8a5eb0dc"
-  integrity sha512-6BuTOLTXvmgwjK7ve7aTg9JaWFdM5UoMolLVPMyh3wTv9Ufalh8oklxYHUBIxsKkBGO2WiHXytveuxH6tAgTYg==
+"@aws-sdk/token-providers@3.846.0":
+  version "3.846.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/token-providers/-/token-providers-3.846.0.tgz#36b499314c2ed754aa9372058a2a8c9e9054ad49"
+  integrity sha512-sGNk3xclK7xx+rIJZDJC4FNFqaSSqN0nSr+AdVdQ+/iKQKaUA6hixRbXaQ7I7M5mhqS6fMW1AsqVRywQq2BSMw==
   dependencies:
-    "@aws-sdk/core" "3.840.0"
-    "@aws-sdk/nested-clients" "3.840.0"
+    "@aws-sdk/core" "3.846.0"
+    "@aws-sdk/nested-clients" "3.846.0"
     "@aws-sdk/types" "3.840.0"
     "@smithy/property-provider" "^4.0.4"
     "@smithy/shared-ini-file-loader" "^4.0.4"
@@ -415,13 +415,14 @@
     "@smithy/types" "^4.3.1"
     tslib "^2.6.2"
 
-"@aws-sdk/util-endpoints@3.840.0":
-  version "3.840.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/util-endpoints/-/util-endpoints-3.840.0.tgz#7ba508b23a62ba57cf22084d0a40f74b18a2a2d0"
-  integrity sha512-eqE9ROdg/Kk0rj3poutyRCFauPDXIf/WSvCqFiRDDVi6QOnCv/M0g2XW8/jSvkJlOyaXkNCptapIp6BeeFFGYw==
+"@aws-sdk/util-endpoints@3.845.0":
+  version "3.845.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/util-endpoints/-/util-endpoints-3.845.0.tgz#a4a303502b79a9868da2f6a17f81d24a34f10974"
+  integrity sha512-MBmOf0Pb4q6xs9V7jXT1+qciW2965yvaoZUlUUnxUEoX6zxWROeIu/gttASc4vSjOHr/+64hmFkxjeBUF37FJA==
   dependencies:
     "@aws-sdk/types" "3.840.0"
     "@smithy/types" "^4.3.1"
+    "@smithy/url-parser" "^4.0.4"
     "@smithy/util-endpoints" "^3.0.6"
     tslib "^2.6.2"
 
@@ -442,12 +443,12 @@
     bowser "^2.11.0"
     tslib "^2.6.2"
 
-"@aws-sdk/util-user-agent-node@3.840.0":
-  version "3.840.0"
-  resolved "https://registry.yarnpkg.com/@aws-sdk/util-user-agent-node/-/util-user-agent-node-3.840.0.tgz#bf959b219012688f4bf32f462e4e411666245e4c"
-  integrity sha512-Fy5JUEDQU1tPm2Yw/YqRYYc27W5+QD/J4mYvQvdWjUGZLB5q3eLFMGD35Uc28ZFoGMufPr4OCxK/bRfWROBRHQ==
+"@aws-sdk/util-user-agent-node@3.846.0":
+  version "3.846.0"
+  resolved "https://registry.yarnpkg.com/@aws-sdk/util-user-agent-node/-/util-user-agent-node-3.846.0.tgz#05ab54d561bcbe3888d88b500ef62a7f41acac8c"
+  integrity sha512-MXYXCplw76xe8A9ejVaIru6Carum/2LQbVtNHsIa4h0TlafLdfulywsoMWL1F53Y9XxQSeOKyyqDKLNOgRVimw==
   dependencies:
-    "@aws-sdk/middleware-user-agent" "3.840.0"
+    "@aws-sdk/middleware-user-agent" "3.846.0"
     "@aws-sdk/types" "3.840.0"
     "@smithy/node-config-provider" "^4.1.3"
     "@smithy/types" "^4.3.1"
@@ -662,9 +663,9 @@
     debug "^4.3.1"
 
 "@babel/types@^7.27.1", "@babel/types@^7.27.3", "@babel/types@^7.27.6", "@babel/types@^7.28.0", "@babel/types@^7.4.0":
-  version "7.28.0"
-  resolved "https://registry.yarnpkg.com/@babel/types/-/types-7.28.0.tgz#2fd0159a6dc7353933920c43136335a9b264d950"
-  integrity sha512-jYnje+JyZG5YThjHiF28oT4SIZLnYOcSBb6+SDaFIyzDVSkXQmQQYclJ2R+YxcdmK0AX6x1E5OQNtuh3jHDrUg==
+  version "7.28.1"
+  resolved "https://registry.yarnpkg.com/@babel/types/-/types-7.28.1.tgz#2aaf3c10b31ba03a77ac84f52b3912a0edef4cf9"
+  integrity sha512-x0LvFTekgSX+83TI28Y9wYPUfzrnl2aT5+5QLnO6v7mSJYtEEevuDRN0F0uSHRk1G1IWZC43o00Y0xDDrpBGPQ==
   dependencies:
     "@babel/helper-string-parser" "^7.27.1"
     "@babel/helper-validator-identifier" "^7.27.1"
@@ -854,9 +855,9 @@
   integrity sha512-k2Ty1JcVojjJFwrg/ThKi2ujJ7XNLYaFGNB/bWT9wGR+oSMJHMa5w+CUq6p/pVrKeNNgA7pCqEcjSnHVoqJQFw==
 
 "@google-cloud/firestore@^7.7.0":
-  version "7.11.2"
-  resolved "https://registry.yarnpkg.com/@google-cloud/firestore/-/firestore-7.11.2.tgz#412b453a85dec3b568239f6ae49fd5e118820cc0"
-  integrity sha512-BQCSbjWJndCZ6bj8BSGhi4EM1TDFs9HgZXXsJ7d2kEPo+x64fB3OnQE8ffmn3vWADqeAmYBPaMPF/k6PHETXKA==
+  version "7.11.3"
+  resolved "https://registry.yarnpkg.com/@google-cloud/firestore/-/firestore-7.11.3.tgz#87cc3a58c5c297d6c9ca0e486fbf16b403585721"
+  integrity sha512-qsM3/WHpawF07SRVvEJJVRwhYzM7o9qtuksyuqnrMig6fxIrwWnsezECWsG/D5TyYru51Fv5c/RTqNDQ2yU+4w==
   dependencies:
     "@opentelemetry/api" "^1.3.0"
     fast-deep-equal "^3.1.1"
@@ -1239,10 +1240,10 @@
     "@smithy/util-middleware" "^4.0.4"
     tslib "^2.6.2"
 
-"@smithy/core@^3.6.0":
-  version "3.6.0"
-  resolved "https://registry.yarnpkg.com/@smithy/core/-/core-3.6.0.tgz#be02f2a4a56ba83d37298454a0bddc89cbad510b"
-  integrity sha512-Pgvfb+TQ4wUNLyHzvgCP4aYZMh16y7GcfF59oirRHcgGgkH1e/s9C0nv/v3WP+Quymyr5je71HeFQCwh+44XLg==
+"@smithy/core@^3.7.0":
+  version "3.7.0"
+  resolved "https://registry.yarnpkg.com/@smithy/core/-/core-3.7.0.tgz#b3a98ccc48b1c408dfdb986aaa22d6affffd7795"
+  integrity sha512-7ov8hu/4j0uPZv8b27oeOFtIBtlFmM3ibrPv/Omx1uUdoXvcpJ00U+H/OWWC/keAguLlcqwtyL2/jTlSnApgNQ==
   dependencies:
     "@smithy/middleware-serde" "^4.0.8"
     "@smithy/protocol-http" "^5.1.2"
@@ -1250,7 +1251,7 @@
     "@smithy/util-base64" "^4.0.0"
     "@smithy/util-body-length-browser" "^4.0.0"
     "@smithy/util-middleware" "^4.0.4"
-    "@smithy/util-stream" "^4.2.2"
+    "@smithy/util-stream" "^4.2.3"
     "@smithy/util-utf8" "^4.0.0"
     tslib "^2.6.2"
 
@@ -1265,10 +1266,10 @@
     "@smithy/url-parser" "^4.0.4"
     tslib "^2.6.2"
 
-"@smithy/fetch-http-handler@^5.0.4":
-  version "5.0.4"
-  resolved "https://registry.yarnpkg.com/@smithy/fetch-http-handler/-/fetch-http-handler-5.0.4.tgz#c68601b4676787e049b5d464d5f4b825dbb44013"
-  integrity sha512-AMtBR5pHppYMVD7z7G+OlHHAcgAN7v0kVKEpHuTO4Gb199Gowh0taYi9oDStFeUhetkeP55JLSVlTW1n9rFtUw==
+"@smithy/fetch-http-handler@^5.1.0":
+  version "5.1.0"
+  resolved "https://registry.yarnpkg.com/@smithy/fetch-http-handler/-/fetch-http-handler-5.1.0.tgz#387abd9ec6c8ff0af33b268c0f6ccb289c1b1563"
+  integrity sha512-mADw7MS0bYe2OGKkHYMaqarOXuDwRbO6ArD91XhHcl2ynjGCFF+hvqf0LyQcYxkA1zaWjefSkU7Ne9mqgApSgQ==
   dependencies:
     "@smithy/protocol-http" "^5.1.2"
     "@smithy/querystring-builder" "^4.0.4"
@@ -1317,12 +1318,12 @@
     "@smithy/types" "^4.3.1"
     tslib "^2.6.2"
 
-"@smithy/middleware-endpoint@^4.1.13":
-  version "4.1.13"
-  resolved "https://registry.yarnpkg.com/@smithy/middleware-endpoint/-/middleware-endpoint-4.1.13.tgz#7d5b5f8f61600270bd8c59aabf311c99b9127aba"
-  integrity sha512-xg3EHV/Q5ZdAO5b0UiIMj3RIOCobuS40pBBODguUDVdko6YK6QIzCVRrHTogVuEKglBWqWenRnZ71iZnLL3ZAQ==
+"@smithy/middleware-endpoint@^4.1.15":
+  version "4.1.15"
+  resolved "https://registry.yarnpkg.com/@smithy/middleware-endpoint/-/middleware-endpoint-4.1.15.tgz#31d93e6f33bbe2dbd120bda0833bce35cf960c39"
+  integrity sha512-L2M0oz+r6Wv0KZ90MgClXmWkV7G72519Hd5/+K5i3gQMu4WNQykh7ERr58WT3q60dd9NqHSMc3/bAK0FsFg3Fw==
   dependencies:
-    "@smithy/core" "^3.6.0"
+    "@smithy/core" "^3.7.0"
     "@smithy/middleware-serde" "^4.0.8"
     "@smithy/node-config-provider" "^4.1.3"
     "@smithy/shared-ini-file-loader" "^4.0.4"
@@ -1331,15 +1332,15 @@
     "@smithy/util-middleware" "^4.0.4"
     tslib "^2.6.2"
 
-"@smithy/middleware-retry@^4.1.14":
-  version "4.1.14"
-  resolved "https://registry.yarnpkg.com/@smithy/middleware-retry/-/middleware-retry-4.1.14.tgz#53ce619463a1ce4b95025aaafdf51369ef893196"
-  integrity sha512-eoXaLlDGpKvdmvt+YBfRXE7HmIEtFF+DJCbTPwuLunP0YUnrydl+C4tS+vEM0+nyxXrX3PSUFqC+lP1+EHB1Tw==
+"@smithy/middleware-retry@^4.1.16":
+  version "4.1.16"
+  resolved "https://registry.yarnpkg.com/@smithy/middleware-retry/-/middleware-retry-4.1.16.tgz#0e044d0da18e7019052ac61ec02a2956437376fd"
+  integrity sha512-PpPhMpC6U1fLW0evKnC8gJtmobBYn0oi4RrIKGhN1a86t6XgVEK+Vb9C8dh5PPXb3YDr8lE6aYKh1hd3OikmWw==
   dependencies:
     "@smithy/node-config-provider" "^4.1.3"
     "@smithy/protocol-http" "^5.1.2"
     "@smithy/service-error-classification" "^4.0.6"
-    "@smithy/smithy-client" "^4.4.5"
+    "@smithy/smithy-client" "^4.4.7"
     "@smithy/types" "^4.3.1"
     "@smithy/util-middleware" "^4.0.4"
     "@smithy/util-retry" "^4.0.6"
@@ -1373,10 +1374,10 @@
     "@smithy/types" "^4.3.1"
     tslib "^2.6.2"
 
-"@smithy/node-http-handler@^4.0.6":
-  version "4.0.6"
-  resolved "https://registry.yarnpkg.com/@smithy/node-http-handler/-/node-http-handler-4.0.6.tgz#a022da499ba3af4b6b4c815104fde973c0eccc40"
-  integrity sha512-NqbmSz7AW2rvw4kXhKGrYTiJVDHnMsFnX4i+/FzcZAfbOBauPYs2ekuECkSbtqaxETLLTu9Rl/ex6+I2BKErPA==
+"@smithy/node-http-handler@^4.1.0":
+  version "4.1.0"
+  resolved "https://registry.yarnpkg.com/@smithy/node-http-handler/-/node-http-handler-4.1.0.tgz#6b528cd0da0c35755b34afba207b7db972b0eb92"
+  integrity sha512-vqfSiHz2v8b3TTTrdXi03vNz1KLYYS3bhHCDv36FYDqxT7jvTll1mMnCrkD+gOvgwybuunh/2VmvOMqwBegxEg==
   dependencies:
     "@smithy/abort-controller" "^4.0.4"
     "@smithy/protocol-http" "^5.1.2"
@@ -1446,17 +1447,17 @@
     "@smithy/util-utf8" "^4.0.0"
     tslib "^2.6.2"
 
-"@smithy/smithy-client@^4.4.5":
-  version "4.4.5"
-  resolved "https://registry.yarnpkg.com/@smithy/smithy-client/-/smithy-client-4.4.5.tgz#1c736618f3c4910880cc6862a5826348c1b70d5d"
-  integrity sha512-+lynZjGuUFJaMdDYSTMnP/uPBBXXukVfrJlP+1U/Dp5SFTEI++w6NMga8DjOENxecOF71V9Z2DllaVDYRnGlkg==
+"@smithy/smithy-client@^4.4.7":
+  version "4.4.7"
+  resolved "https://registry.yarnpkg.com/@smithy/smithy-client/-/smithy-client-4.4.7.tgz#68e9f7785179060896ed51d52cd4f4cfc1cbffb5"
+  integrity sha512-x+MxBNOcG7rY9i5QsbdgvvRJngKKvUJrbU5R5bT66PTH3e6htSupJ4Q+kJ3E7t6q854jyl57acjpPi6qG1OY5g==
   dependencies:
-    "@smithy/core" "^3.6.0"
-    "@smithy/middleware-endpoint" "^4.1.13"
+    "@smithy/core" "^3.7.0"
+    "@smithy/middleware-endpoint" "^4.1.15"
     "@smithy/middleware-stack" "^4.0.4"
     "@smithy/protocol-http" "^5.1.2"
     "@smithy/types" "^4.3.1"
-    "@smithy/util-stream" "^4.2.2"
+    "@smithy/util-stream" "^4.2.3"
     tslib "^2.6.2"
 
 "@smithy/types@^4.3.1":
@@ -1521,27 +1522,27 @@
   dependencies:
     tslib "^2.6.2"
 
-"@smithy/util-defaults-mode-browser@^4.0.21":
-  version "4.0.21"
-  resolved "https://registry.yarnpkg.com/@smithy/util-defaults-mode-browser/-/util-defaults-mode-browser-4.0.21.tgz#47895e42d64060d2a7f803a443fd160d0a329d83"
-  integrity sha512-wM0jhTytgXu3wzJoIqpbBAG5U6BwiubZ6QKzSbP7/VbmF1v96xlAbX2Am/mz0Zep0NLvLh84JT0tuZnk3wmYQA==
+"@smithy/util-defaults-mode-browser@^4.0.23":
+  version "4.0.23"
+  resolved "https://registry.yarnpkg.com/@smithy/util-defaults-mode-browser/-/util-defaults-mode-browser-4.0.23.tgz#74887922f87da4f4acbf523b5c0271f11af5997d"
+  integrity sha512-NqRi6VvEIwpJ+KSdqI85+HH46H7uVoNqVTs2QO7p1YKnS7k8VZnunJj8R5KdmmVnTojkaL1OMPyZC8uR5F7fSg==
   dependencies:
     "@smithy/property-provider" "^4.0.4"
-    "@smithy/smithy-client" "^4.4.5"
+    "@smithy/smithy-client" "^4.4.7"
     "@smithy/types" "^4.3.1"
     bowser "^2.11.0"
     tslib "^2.6.2"
 
-"@smithy/util-defaults-mode-node@^4.0.21":
-  version "4.0.21"
-  resolved "https://registry.yarnpkg.com/@smithy/util-defaults-mode-node/-/util-defaults-mode-node-4.0.21.tgz#4682143fbfb0a4c6e08a6151f13af97018e6950e"
-  integrity sha512-/F34zkoU0GzpUgLJydHY8Rxu9lBn8xQC/s/0M0U9lLBkYbA1htaAFjWYJzpzsbXPuri5D1H8gjp2jBum05qBrA==
+"@smithy/util-defaults-mode-node@^4.0.23":
+  version "4.0.23"
+  resolved "https://registry.yarnpkg.com/@smithy/util-defaults-mode-node/-/util-defaults-mode-node-4.0.23.tgz#dd22609289183fe3d722f9a1601b6cc618f9efa7"
+  integrity sha512-NE9NtEVigFa+HHJ5bBeQT7KF3KiltW880CLN9TnWWL55akeou3ziRAHO22QSUPgPZ/nqMfPXi/LGMQ6xQvXPNQ==
   dependencies:
     "@smithy/config-resolver" "^4.1.4"
     "@smithy/credential-provider-imds" "^4.0.6"
     "@smithy/node-config-provider" "^4.1.3"
     "@smithy/property-provider" "^4.0.4"
-    "@smithy/smithy-client" "^4.4.5"
+    "@smithy/smithy-client" "^4.4.7"
     "@smithy/types" "^4.3.1"
     tslib "^2.6.2"
 
@@ -1578,13 +1579,13 @@
     "@smithy/types" "^4.3.1"
     tslib "^2.6.2"
 
-"@smithy/util-stream@^4.2.2":
-  version "4.2.2"
-  resolved "https://registry.yarnpkg.com/@smithy/util-stream/-/util-stream-4.2.2.tgz#beeb1edf690db9b7d7983f46ca4fb66e22253608"
-  integrity sha512-aI+GLi7MJoVxg24/3J1ipwLoYzgkB4kUfogZfnslcYlynj3xsQ0e7vk4TnTro9hhsS5PvX1mwmkRqqHQjwcU7w==
+"@smithy/util-stream@^4.2.3":
+  version "4.2.3"
+  resolved "https://registry.yarnpkg.com/@smithy/util-stream/-/util-stream-4.2.3.tgz#7980fb94dbee96301b0b2610de8ae1700c7daab1"
+  integrity sha512-cQn412DWHHFNKrQfbHY8vSFI3nTROY1aIKji9N0tpp8gUABRilr7wdf8fqBbSlXresobM+tQFNk6I+0LXK/YZg==
   dependencies:
-    "@smithy/fetch-http-handler" "^5.0.4"
-    "@smithy/node-http-handler" "^4.0.6"
+    "@smithy/fetch-http-handler" "^5.1.0"
+    "@smithy/node-http-handler" "^4.1.0"
     "@smithy/types" "^4.3.1"
     "@smithy/util-base64" "^4.0.0"
     "@smithy/util-buffer-from" "^4.0.0"
@@ -1711,9 +1712,9 @@
   integrity sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==
 
 "@types/node@*", "@types/node@>=13.7.0":
-  version "24.0.10"
-  resolved "https://registry.yarnpkg.com/@types/node/-/node-24.0.10.tgz#f65a169779bf0d70203183a1890be7bee8ca2ddb"
-  integrity sha512-ENHwaH+JIRTDIEEbDK6QSQntAYGtbvdDXnMXnZaZ6k13Du1dPMmprkEHIL7ok2Wl2aZevetwTAb5S+7yIF+enA==
+  version "24.0.14"
+  resolved "https://registry.yarnpkg.com/@types/node/-/node-24.0.14.tgz#6e3d4fb6d858c48c69707394e1a0e08ce1ecc1bc"
+  integrity sha512-4zXMWD91vBLGRtHK3YbIoFMia+1nqEz72coM42C5ETjnNCa/heoj7NT1G67iAfOqMmcfhuCZ4uNpyz8EjlAejw==
   dependencies:
     undici-types "~7.8.0"
 
@@ -1723,9 +1724,9 @@
   integrity sha512-fAtCfv4jJg+ExtXhvCkCqUKZ+4ok/JQk01qDKhL5BDDoS3AxKXhV5/MAVUZyQnSEd2GT92fkgZl0pz0Q0AzcIQ==
 
 "@types/node@^22.0.1", "@types/node@^22.5.4":
-  version "22.16.0"
-  resolved "https://registry.yarnpkg.com/@types/node/-/node-22.16.0.tgz#352bc4951fd089df32f2b6412a61d339b67ded8b"
-  integrity sha512-B2egV9wALML1JCpv3VQoQ+yesQKAmNMBIAY7OteVrikcOcAkWm+dGL6qpeCktPjAv6N1JLnhbNiqS35UpFyBsQ==
+  version "22.16.4"
+  resolved "https://registry.yarnpkg.com/@types/node/-/node-22.16.4.tgz#00c763ad4d4e45f62d5a270c040ae1a799c7e38a"
+  integrity sha512-PYRhNtZdm2wH/NT2k/oAJ6/f2VD2N2Dag0lGlx2vWgMSJXGNmlce5MiTQzoWAiIJtso30mjnfQCOKVH+kAQC/g==
   dependencies:
     undici-types "~6.21.0"
 
@@ -2133,9 +2134,9 @@ agent-base@6, agent-base@^6.0.2:
     debug "4"
 
 agent-base@^7.0.2, agent-base@^7.1.2:
-  version "7.1.3"
-  resolved "https://registry.yarnpkg.com/agent-base/-/agent-base-7.1.3.tgz#29435eb821bc4194633a5b89e5bc4703bafc25a1"
-  integrity sha512-jRR5wdylq8CkOe6hei19GGZnxM6rBGwFl3Bg0YItGDimvjGtAvdZk4Pu6Cl4u4Igsws4a1fd1Vq3ezrhn4KmFw==
+  version "7.1.4"
+  resolved "https://registry.yarnpkg.com/agent-base/-/agent-base-7.1.4.tgz#e3cd76d4c548ee895d3c3fd8dc1f6c5b9032e7a8"
+  integrity sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==
 
 agentkeepalive@^4.1.3:
   version "4.6.0"
@@ -2227,9 +2228,9 @@ append-transform@^1.0.0:
     default-require-extensions "^2.0.0"
 
 "aproba@^1.0.3 || ^2.0.0":
-  version "2.0.0"
-  resolved "https://registry.yarnpkg.com/aproba/-/aproba-2.0.0.tgz#52520b8ae5b569215b354efc0caa3fe1e45a8adc"
-  integrity sha512-lYe4Gx7QT+MKGbDsA+Z+he/Wtef0BiwDOlK/XkBrdfsh9J/jPPXbX0tE9x9cl27Tmu5gg3QUbUrQYa/y+KOHPQ==
+  version "2.1.0"
+  resolved "https://registry.yarnpkg.com/aproba/-/aproba-2.1.0.tgz#75500a190313d95c64e871e7e4284c6ac219f0b1"
+  integrity sha512-tLIEcj5GuR2RSTnxNKdkK0dJ/GrC7P38sUkiDmDuHfsHmbagTFAxDVIBltoklXEVIQ/f14IL8IMJ5pn9Hez1Ew==
 
 archiver-utils@^5.0.0, archiver-utils@^5.0.1, archiver-utils@^5.0.2:
   version "5.0.2"
@@ -2494,9 +2495,9 @@ balanced-match@^1.0.0:
   integrity sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==
 
 bare-events@^2.2.0:
-  version "2.5.4"
-  resolved "https://registry.yarnpkg.com/bare-events/-/bare-events-2.5.4.tgz#16143d435e1ed9eafd1ab85f12b89b3357a41745"
-  integrity sha512-+gFfDkR8pj4/TrWCGUGWmJIkBwuxPS5F+a5yWjOHQt2hHvNZd5YLzadjmDUtFmMM4y429bnKLa8bYBMHcYdnQA==
+  version "2.6.0"
+  resolved "https://registry.yarnpkg.com/bare-events/-/bare-events-2.6.0.tgz#11d9506da109e363a2f3af050fbb005ccdb3ee8f"
+  integrity sha512-EKZ5BTXYExaNqi3I3f9RtEsaI/xBSGjE0XZCZilPzFAV/goswFHuPd9jEZlPIZ/iNZJwDSao9qRiScySz7MbQg==
 
 base-64@^0.1.0:
   version "0.1.0"
@@ -2536,9 +2537,9 @@ big-integer@^1.6.48:
   integrity sha512-QxD8cf2eVqJOOz63z6JIN9BzvVs/dlySa5HGSBH5xtR8dPteIRQnBxxKqkNTiT6jbDTF6jAfrd4oMcND9RGbQg==
 
 bignumber.js@^9.0.0, bignumber.js@^9.0.1:
-  version "9.3.0"
-  resolved "https://registry.yarnpkg.com/bignumber.js/-/bignumber.js-9.3.0.tgz#bdba7e2a4c1a2eba08290e8dcad4f36393c92acd"
-  integrity sha512-EM7aMFTXbptt/wZdMlBv2t8IViwQL+h6SLHosp8Yf0dqJMTnY6iL32opnAB6kAdL0SZPuvcAzFr31o0c/R3/RA==
+  version "9.3.1"
+  resolved "https://registry.yarnpkg.com/bignumber.js/-/bignumber.js-9.3.1.tgz#759c5aaddf2ffdc4f154f7b493e1c8770f88c4d7"
+  integrity sha512-Ko0uX15oIUS7wJ3Rb30Fs6SkVbLmPBAKdlm7q9+ak9bbIeFf0MwuBsQV6z7+X768/cHsfg+WlysDWJcmthjsjQ==
 
 binary-extensions@^2.0.0:
   version "2.3.0"
@@ -2825,9 +2826,9 @@ camelcase@^5.0.0:
   integrity sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg==
 
 caniuse-lite@^1.0.30001726:
-  version "1.0.30001726"
-  resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001726.tgz#a15bd87d5a4bf01f6b6f70ae7c97fdfd28b5ae47"
-  integrity sha512-VQAUIUzBiZ/UnlM28fSp2CRF3ivUn1BWEvxMcVTNwpw91Py1pGbPIyIKtd+tzct9C3ouceCVdGAXxZOpZAsgdw==
+  version "1.0.30001727"
+  resolved "https://registry.yarnpkg.com/caniuse-lite/-/caniuse-lite-1.0.30001727.tgz#22e9706422ad37aa50556af8c10e40e2d93a8b85"
+  integrity sha512-pB68nIHmbN6L/4C6MH1DokyR3bYqFwjaSs/sWDHGj4CTcFtQUQMuJftVwWkXq7mNWOybD3KhUv3oWHoGxgP14Q==
 
 caseless@~0.12.0:
   version "0.12.0"
@@ -3141,9 +3142,9 @@ core-js@^2.4.0:
   integrity sha512-Kb2wC0fvsWfQrgk8HU5lW6U/Lcs8+9aaYcy4ZFc6DDlo4nZ7n70dEgE5rtR0oG6ufKDUnrwfWL1mXR5ljDatrQ==
 
 core-js@^3.30.2:
-  version "3.43.0"
-  resolved "https://registry.yarnpkg.com/core-js/-/core-js-3.43.0.tgz#f7258b156523208167df35dea0cfd6b6ecd4ee88"
-  integrity sha512-N6wEbTTZSYOY2rYAn85CuvWWkCK6QweMn7/4Nr3w+gDBeBhk/x4EJeY6FPo4QzDoJZxVTv8U7CMvgWk6pOHHqA==
+  version "3.44.0"
+  resolved "https://registry.yarnpkg.com/core-js/-/core-js-3.44.0.tgz#db4fd4fa07933c1d6898c8b112a1119a9336e959"
+  integrity sha512-aFCtd4l6GvAXwVEh3XbbVqJGHDJt0OZRa+5ePGx3LLwi12WfexqQxcsohb2wgsa/92xtl19Hd66G/L+TaAxDMw==
 
 core-util-is@1.0.2:
   version "1.0.2"
@@ -3339,9 +3340,9 @@ decamelize@^1.2.0:
   integrity sha512-z2S+W9X73hAUUki+N+9Za2lBlun89zigOyGrsax+KUQ6wKW4ZoWpEYBkGhQjwAjjDCkWxhY0VKEhk8wzY7F5cA==
 
 decimal.js@^10.4.3:
-  version "10.5.0"
-  resolved "https://registry.yarnpkg.com/decimal.js/-/decimal.js-10.5.0.tgz#0f371c7cf6c4898ce0afb09836db73cd82010f22"
-  integrity sha512-8vDa8Qxvr/+d94hSh5P3IJwI5t8/c0KsMp+g8bNw9cY2icONa5aPfvKeieW1WlG0WQYwwhJ7mjui2xtiePQSXw==
+  version "10.6.0"
+  resolved "https://registry.yarnpkg.com/decimal.js/-/decimal.js-10.6.0.tgz#e649a43e3ab953a72192ff5983865e509f37ed9a"
+  integrity sha512-YpgQiITW3JXGntzdUmyUR1V812Hn8T1YVXhCu+wO3OpS4eU9l4YdD3qjyiKdV6mvV29zapkMeD390UVEf2lkUg==
 
 decode-uri-component@^0.2.2:
   version "0.2.2"
@@ -3441,9 +3442,9 @@ discord-api-types@^0.37.12, discord-api-types@^0.37.41:
   integrity sha512-7xpNK0EiWjjDFp2nAhHXezE4OUWm7s1zhc/UXXN6hnFFU8dfoPHgV0Hx0RPiCa3ILRpdeh152icc68DGCyXYIw==
 
 discord-api-types@^0.38.1:
-  version "0.38.15"
-  resolved "https://registry.yarnpkg.com/discord-api-types/-/discord-api-types-0.38.15.tgz#5c5e14c7049fa974096cb8172d0ec29dc5f880a6"
-  integrity sha512-RX3skyRH7p6BlHOW62ztdnIc87+wv4TEJEURMir5k5BbRJ10wK1MCqFEO6USHTol3gkiHLE6wWoHhNQ2pqB4AA==
+  version "0.38.16"
+  resolved "https://registry.yarnpkg.com/discord-api-types/-/discord-api-types-0.38.16.tgz#15e034ae99f5bf0bee5a97d411d675e078e38ad8"
+  integrity sha512-Cz42dC5WqJD17Yk0bRy7YLTJmh3NKo4FGpxZuA8MHqT0RPxKSrll5YhlODZ2z5DiEV/gpHMeTSrTFTWpSXjT1Q==
 
 discord.js@14.6.0:
   version "14.6.0"
@@ -3558,9 +3559,9 @@ ee-first@1.1.1:
   integrity sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==
 
 electron-to-chromium@^1.5.173:
-  version "1.5.179"
-  resolved "https://registry.yarnpkg.com/electron-to-chromium/-/electron-to-chromium-1.5.179.tgz#453d53f360014a2604d40ccd41c4ea0a6e31b99a"
-  integrity sha512-UWKi/EbBopgfFsc5k61wFpV7WrnnSlSzW/e2XcBmS6qKYTivZlLtoll5/rdqRTxGglGHkmkW0j0pFNJG10EUIQ==
+  version "1.5.185"
+  resolved "https://registry.yarnpkg.com/electron-to-chromium/-/electron-to-chromium-1.5.185.tgz#b4f9189c4ef652ddf9f1bb37529e2b79f865e912"
+  integrity sha512-dYOZfUk57hSMPePoIQ1fZWl1Fkj+OshhEVuPacNKWzC1efe56OsHY3l/jCfiAgIICOU3VgOIdoq7ahg7r7n6MQ==
 
 emoji-regex@^7.0.1:
   version "7.0.3"
@@ -3934,12 +3935,12 @@ fast-json-stable-stringify@^2.0.0:
   resolved "https://registry.yarnpkg.com/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz#874bf69c6f404c2b5d99c481341399fd55892633"
   integrity sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw==
 
-fast-xml-parser@4.4.1:
-  version "4.4.1"
-  resolved "https://registry.yarnpkg.com/fast-xml-parser/-/fast-xml-parser-4.4.1.tgz#86dbf3f18edf8739326447bcaac31b4ae7f6514f"
-  integrity sha512-xkjOecfnKGkSsOwtZ5Pz7Us/T6mrbPQrq0nh+aCO5V9nk5NLWmasAHumTKjiPJPWANe+kAZ84Jc8ooJkzZ88Sw==
+fast-xml-parser@5.2.5:
+  version "5.2.5"
+  resolved "https://registry.yarnpkg.com/fast-xml-parser/-/fast-xml-parser-5.2.5.tgz#4809fdfb1310494e341098c25cb1341a01a9144a"
+  integrity sha512-pfX9uG9Ki0yekDHx2SiuRIyFdyAr1kMIMitPvb0YBo8SUfKvia7w7FIyd/l6av85pFYRhZscS75MwMnbvY+hcQ==
   dependencies:
-    strnum "^1.0.5"
+    strnum "^2.1.0"
 
 fast-xml-parser@^4.4.1, fast-xml-parser@^4.5.1:
   version "4.5.3"
@@ -6068,9 +6069,9 @@ named-placeholders@^1.1.3:
     lru-cache "^7.14.1"
 
 nan@^2.13.2, nan@^2.19.0, nan@^2.20.0:
-  version "2.22.2"
-  resolved "https://registry.yarnpkg.com/nan/-/nan-2.22.2.tgz#6b504fd029fb8f38c0990e52ad5c26772fdacfbb"
-  integrity sha512-DANghxFkS1plDdRsX0X9pm0Z6SJNN6gBdtXfanwoZ8hooC5gosGFSBGRYHUVPz1asKA/kMRqDRdHrluZ61SpBQ==
+  version "2.23.0"
+  resolved "https://registry.yarnpkg.com/nan/-/nan-2.23.0.tgz#24aa4ddffcc37613a2d2935b97683c1ec96093c6"
+  integrity sha512-1UxuyYGdoQHcGg87Lkqm3FzefucTa0NAiOcuRsDmysep3c1LVCRK2krrUDafMWtjSG04htvAmvg96+SDknOmgQ==
 
 nanoid@^3.3.8:
   version "3.3.11"
@@ -7188,9 +7189,9 @@ readline2@^1.0.1:
     mute-stream "0.0.5"
 
 real-cancellable-promise@^1.1.1:
-  version "1.2.2"
-  resolved "https://registry.yarnpkg.com/real-cancellable-promise/-/real-cancellable-promise-1.2.2.tgz#fef5dc64c99749d9640ab63fe6f32a37fc7b29b2"
-  integrity sha512-Qh1RvIGdekUCv/ZkK9IiAkah2/Q++p66KHe6TSgHnx4QSbr5vCo3qDoszqRO1TSH+6h6HI5aDVBVrQCQBGj44Q==
+  version "1.2.3"
+  resolved "https://registry.yarnpkg.com/real-cancellable-promise/-/real-cancellable-promise-1.2.3.tgz#6df13b7db40cbff9969975d6194c11e2356c4a13"
+  integrity sha512-hBI5Gy/55VEeeMtImMgEirD7eq5UmqJf1J8dFZtbJZA/3rB0pYFZ7PayMGueb6v4UtUtpKpP+05L0VwyE1hI9Q==
 
 reflect.getprototypeof@^1.0.6, reflect.getprototypeof@^1.0.9:
   version "1.0.10"
@@ -7725,9 +7726,9 @@ socks-proxy-agent@^6.0.0:
     socks "^2.6.2"
 
 socks@^2.6.2, socks@^2.7.1:
-  version "2.8.5"
-  resolved "https://registry.yarnpkg.com/socks/-/socks-2.8.5.tgz#bfe18f5ead1efc93f5ec90c79fa8bdccbcee2e64"
-  integrity sha512-iF+tNDQla22geJdTyJB1wM/qrX9DMRwWrciEPwWLPRWAUEM8sQiyxgckLxWT1f7+9VabJS0jTGGr4QgBuvi6Ww==
+  version "2.8.6"
+  resolved "https://registry.yarnpkg.com/socks/-/socks-2.8.6.tgz#e335486a2552f34f932f0c27d8dbb93f2be867aa"
+  integrity sha512-pe4Y2yzru68lXCb38aAqRf5gvN8YdjP1lok5o0J7BOHljkyCGKVz7H3vpVIXKD27rj2giOJ7DwVyk/GWrPHDWA==
   dependencies:
     ip-address "^9.0.5"
     smart-buffer "^4.2.0"
@@ -8075,11 +8076,16 @@ strip-json-comments@~2.0.1:
   resolved "https://registry.yarnpkg.com/strip-json-comments/-/strip-json-comments-2.0.1.tgz#3c531942e908c2697c0ec344858c286c7ca0a60a"
   integrity sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==
 
-strnum@^1.0.5, strnum@^1.1.1:
+strnum@^1.1.1:
   version "1.1.2"
   resolved "https://registry.yarnpkg.com/strnum/-/strnum-1.1.2.tgz#57bca4fbaa6f271081715dbc9ed7cee5493e28e4"
   integrity sha512-vrN+B7DBIoTTZjnPNewwhx6cBA/H+IS7rfW68n7XxC1y7uoiGQBxaKzqucGUgavX15dJgiGztLJ8vxuEzwqBdA==
 
+strnum@^2.1.0:
+  version "2.1.1"
+  resolved "https://registry.yarnpkg.com/strnum/-/strnum-2.1.1.tgz#cf2a6e0cf903728b8b2c4b971b7e36b4e82d46ab"
+  integrity sha512-7ZvoFTiCnGxBtDqJ//Cu6fWtZtc7Y3x+QOirG15wztbdngGSkht27o2pyGWrVy0b4WAy3jbKmnoK6g5VlVNUUw==
+
 strtok3@^7.0.0:
   version "7.1.1"
   resolved "https://registry.yarnpkg.com/strtok3/-/strtok3-7.1.1.tgz#f548fd9dc59d0a76d5567ff8c16be31221f29dfc"
diff --git a/pkgs/tools/graphics/zbar/default.nix b/pkgs/tools/graphics/zbar/default.nix
index c899421687eb..a20738a53ee0 100644
--- a/pkgs/tools/graphics/zbar/default.nix
+++ b/pkgs/tools/graphics/zbar/default.nix
@@ -106,6 +106,11 @@ stdenv.mkDerivation rec {
     argp-standalone
   ];
 
+  # fix iconv linking on macOS
+  preConfigure = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    export LDFLAGS="-liconv"
+  '';
+
   # Note: postConfigure instead of postPatch in order to include some
   # autoconf-generated files. The template files for the autogen'd scripts are
   # not chmod +x, so patchShebangs misses them.
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ecec2e26e877..e41ff0ebc732 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8472,13 +8472,11 @@ with pkgs;
   json2yaml = haskell.lib.compose.justStaticExecutables haskellPackages.json2yaml;
 
   keybinder = callPackage ../development/libraries/keybinder {
-    automake = automake111x;
     lua = lua5_1;
   };
 
   keybinder3 = callPackage ../development/libraries/keybinder3 {
     gtk3 = if stdenv.hostPlatform.isDarwin then gtk3-x11 else gtk3;
-    automake = automake111x;
   };
 
   krb5 = callPackage ../development/libraries/kerberos/krb5.nix {
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 9a82087429b6..4994bc12d4c2 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4549,6 +4549,10 @@ self: super: with self; {
 
   elasticsearchdsl = self.elasticsearch-dsl;
 
+  electrum-aionostr = callPackage ../development/python-modules/electrum-aionostr { };
+
+  electrum-ecc = callPackage ../development/python-modules/electrum-ecc { };
+
   elegy = callPackage ../development/python-modules/elegy { };
 
   elementpath = callPackage ../development/python-modules/elementpath { };
diff --git a/pkgs/top-level/stage.nix b/pkgs/top-level/stage.nix
index 2334242238d5..b37311b8f0e3 100644
--- a/pkgs/top-level/stage.nix
+++ b/pkgs/top-level/stage.nix
@@ -191,15 +191,19 @@ let
 
   aliases = self: super: lib.optionalAttrs config.allowAliases (import ./aliases.nix lib self super);
 
-  variants = import ./variants.nix {
-    inherit
-      lib
-      nixpkgsFun
-      stdenv
-      overlays
-      makeMuslParsedPlatform
-      ;
-  };
+  variants =
+    self: super:
+    lib.optionalAttrs config.allowVariants (
+      import ./variants.nix {
+        inherit
+          lib
+          nixpkgsFun
+          stdenv
+          overlays
+          makeMuslParsedPlatform
+          ;
+      } self super
+    );
 
   # stdenvOverrides is used to avoid having multiple of versions
   # of certain dependencies that were used in bootstrapping the