diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index 62e01f3c885c..cca4ab353693 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -46,6 +46,8 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- [OpenThread Border Router](https://openthread.io/), a Thread border router for POSIX-based platforms that bridges Thread mesh networks to IP networks. Available as [services.openthread-border-router](#opt-services.openthread-border-router.enable).
+
 - [Meshtastic](https://meshtastic.org), an open-source, off-grid, decentralised mesh network
   designed to run on affordable, low-power devices. Available as [services.meshtasticd]
   (#opt-services.meshtasticd.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index b23517fcce16..f89194a4ef39 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -729,6 +729,7 @@
   ./services/home-automation/home-assistant.nix
   ./services/home-automation/homebridge.nix
   ./services/home-automation/matter-server.nix
+  ./services/home-automation/openthread-border-router.nix
   ./services/home-automation/wyoming/faster-whisper.nix
   ./services/home-automation/wyoming/openwakeword.nix
   ./services/home-automation/wyoming/piper.nix
diff --git a/nixos/modules/services/home-automation/openthread-border-router.nix b/nixos/modules/services/home-automation/openthread-border-router.nix
new file mode 100644
index 000000000000..93e010c1c6f5
--- /dev/null
+++ b/nixos/modules/services/home-automation/openthread-border-router.nix
@@ -0,0 +1,348 @@
+{
+  lib,
+  config,
+  pkgs,
+  utils,
+  ...
+}:
+
+let
+  cfg = config.services.openthread-border-router;
+  logLevelMappings = {
+    "emerg" = 0;
+    "alert" = 1;
+    "crit" = 2;
+    "err" = 3;
+    "warning" = 4;
+    "notice" = 5;
+    "info" = 6;
+    "debug" = 7;
+  };
+  logLevel = lib.getAttr cfg.logLevel logLevelMappings;
+  # Use correct iptables for otbr-firewall (legacy vs nf-compat)
+  iptables =
+    let
+      inherit (config.networking) firewall;
+    in
+    if firewall.backend == "iptables" then firewall.package else pkgs.iptables;
+in
+{
+  meta.maintainers = with lib.maintainers; [
+    jamiemagee
+    leonm1
+    mrene
+  ];
+
+  options.services.openthread-border-router = {
+    enable = lib.mkEnableOption "the OpenThread Border Router";
+
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Whether to open the firewall for the REST API and web interface ports.";
+    };
+
+    package = lib.mkPackageOption pkgs "openthread-border-router" { };
+
+    backboneInterfaces = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ "eth0" ];
+      description = "The network interfaces on which to advertise the thread ipv6 mesh prefix. Can be specified multiple times.";
+    };
+
+    interfaceName = lib.mkOption {
+      type = lib.types.str;
+      default = "wpan0";
+      description = "The network interface to create for thread packets.";
+    };
+
+    logLevel = lib.mkOption {
+      type = lib.types.enum (lib.attrNames logLevelMappings);
+      default = "err";
+      description = "The level to use when logging messages.";
+    };
+
+    rest = {
+      listenAddress = lib.mkOption {
+        type = lib.types.str;
+        default = "127.0.0.1";
+        description = "The address on which to listen for REST API requests.";
+        example = "::";
+      };
+
+      listenPort = lib.mkOption {
+        type = lib.types.port;
+        default = 8081;
+        description = "The port on which to listen for REST API requests. Warning: the web interface relies on this value being set to 8081.";
+      };
+    };
+
+    web = {
+      enable = lib.mkEnableOption "the web interface";
+      listenAddress = lib.mkOption {
+        type = lib.types.str;
+        default = "127.0.0.1";
+        description = "The address on which the web interface should listen.";
+        example = "::";
+      };
+
+      listenPort = lib.mkOption {
+        type = lib.types.port;
+        default = 8082;
+        description = "The port on which the web interface should listen.";
+      };
+    };
+
+    radio = {
+      device = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
+        default = null;
+        description = ''
+          The device name of the serial port of the radio device.
+          Ignored if {option}`services.openthread-border-router.radio.url` is set.
+        '';
+      };
+
+      baudRate = lib.mkOption {
+        type = lib.types.ints.positive;
+        default = 115200;
+        description = ''
+          The baud rate of the radio device.
+          Ignored if {option}`services.openthread-border-router.radio.url` is set.
+        '';
+      };
+
+      flowControl = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          Enable hardware flow control.
+          Ignored if {option}`services.openthread-border-router.radio.url` is set.
+        '';
+      };
+
+      urlQueryString = lib.mkOption {
+        type = lib.types.str;
+        default = "";
+        description = ''
+          Extra URL query string parameters.
+          Ignored if {option}`services.openthread-border-router.radio.url` is set.
+        '';
+        example = "bus-latency=100&region=ca";
+      };
+
+      url = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        description = "The URL of the radio device to use.";
+        example = "spinel+hdlc+uart:///dev/ttyUSB0?uart-baudrate=460800&uart-flow-control";
+      };
+
+      extraDevices = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = "Extra devices to add to the radio device.";
+        example = [ "trel://eth0" ];
+      };
+    };
+
+    extraArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = "Extra arguments to pass to the otbr-agent daemon.";
+      example = [ "--radio-version" ];
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.radio.device != null || cfg.radio.url != null;
+        message = "services.openthread-border-router requires either radio.device or radio.url to be set.";
+      }
+    ];
+
+    warnings = lib.optional (cfg.web.enable && cfg.rest.listenPort != 8081) ''
+      The openthread-border-router web interface is hardcoded to talk to the REST API on port 8081, but its
+      port has been changed to ${toString cfg.rest.listenPort}. Some features will be broken.
+    '';
+
+    services.openthread-border-router.radio.url = lib.mkIf (cfg.radio.device != null) (
+      lib.mkDefault (
+        "spinel+hdlc+uart://${cfg.radio.device}?"
+        + lib.concatStringsSep "&" (
+          [ "uart-baudrate=${toString cfg.radio.baudRate}" ]
+          ++ lib.optional cfg.radio.flowControl "uart-flow-control"
+          ++ lib.optional (cfg.radio.urlQueryString != "") cfg.radio.urlQueryString
+        )
+      )
+    );
+
+    # ot-ctl can be used to query the router instance
+    environment.systemPackages = [ cfg.package ];
+
+    # Make sure we have ipv6 support, and that forwarding is enabled
+    networking.enableIPv6 = true;
+    networking.firewall.allowedTCPPorts =
+      lib.optional cfg.openFirewall cfg.rest.listenPort
+      ++ lib.optional (cfg.openFirewall && cfg.web.enable) cfg.web.listenPort;
+    boot.kernel.sysctl = {
+      "net.ipv4.conf.all.forwarding" = 1;
+      "net.ipv6.conf.all.forwarding" = 1;
+    }
+    // lib.listToAttrs (
+      lib.concatMap (iface: [
+        {
+          name = "net.ipv6.conf.${iface}.accept_ra";
+          value = 2;
+        }
+        {
+          name = "net.ipv6.conf.${iface}.accept_ra_rt_info_max_plen";
+          value = 64;
+        }
+      ]) cfg.backboneInterfaces
+    );
+
+    # OTBR uses avahi for mDNS service publishing
+    services.avahi = {
+      enable = lib.mkDefault true;
+      publish = {
+        enable = lib.mkDefault true;
+        userServices = lib.mkDefault true;
+      };
+    };
+
+    # The upstream service files (src/agent/otbr-agent.service.in, src/web/otbr-web.service.in) use
+    # EnvironmentFile and CMake-substituted platform scripts that don't translate to NixOS, so the
+    # services are rebuilt here from typed module options instead.
+    systemd.services = {
+      # The agent keeps its local state in /var/lib/thread
+      otbr-agent = {
+        description = "OpenThread Border Router Agent";
+        wantedBy = [ "multi-user.target" ];
+        requires = [ "network-online.target" ];
+        after = [ "network-online.target" ];
+        environment = {
+          THREAD_IF = cfg.interfaceName;
+        };
+        serviceConfig = {
+          ExecStartPre = "${utils.escapeSystemdExecArg (lib.getExe' cfg.package "otbr-firewall")} start";
+          ExecStart = lib.concatStringsSep " " (
+            lib.concatLists [
+              [
+                (lib.getExe' cfg.package "otbr-agent")
+                "--verbose"
+              ]
+              (map (iface: "--backbone-ifname ${utils.escapeSystemdExecArg iface}") cfg.backboneInterfaces)
+              [
+                "--thread-ifname ${utils.escapeSystemdExecArg cfg.interfaceName}"
+                "--debug-level ${toString logLevel}"
+              ]
+              (lib.optional (cfg.rest.listenPort != 0) "--rest-listen-port ${toString cfg.rest.listenPort}")
+              (lib.optional (
+                cfg.rest.listenAddress != ""
+              ) "--rest-listen-address ${utils.escapeSystemdExecArg cfg.rest.listenAddress}")
+              (lib.optional (cfg.radio.url != null) (utils.escapeSystemdExecArg cfg.radio.url))
+              (map utils.escapeSystemdExecArg cfg.radio.extraDevices)
+              (map utils.escapeSystemdExecArg cfg.extraArgs)
+            ]
+          );
+          ExecStopPost = "${utils.escapeSystemdExecArg (lib.getExe' cfg.package "otbr-firewall")} stop";
+          KillMode = "mixed";
+          Restart = "on-failure";
+          RestartSec = 5;
+          RestartPreventExitStatus = "SIGKILL";
+
+          # Hardening options (not present in upstream service definitions)
+          StateDirectory = "thread";
+          ProtectSystem = "strict";
+          ProtectHome = true;
+          PrivateTmp = true;
+          ProtectClock = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectControlGroups = true;
+          ProtectProc = "invisible";
+          ProcSubset = "pid";
+          NoNewPrivileges = true;
+          LockPersonality = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+            "AF_NETLINK"
+            "AF_UNIX"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          UMask = "0077";
+
+          CapabilityBoundingSet = [
+            "CAP_NET_ADMIN"
+            "CAP_NET_RAW"
+          ];
+        };
+        path = [
+          pkgs.ipset
+          iptables
+        ];
+      };
+
+      # Sync with: src/web/otbr-web.service.in
+      otbr-web = lib.mkIf cfg.web.enable {
+        description = "OpenThread Border Router Web Interface";
+        after = [ "otbr-agent.service" ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          ExecStart = lib.concatStringsSep " " (
+            lib.concatLists [
+              [
+                (lib.getExe' cfg.package "otbr-web")
+                "-I"
+                (utils.escapeSystemdExecArg cfg.interfaceName)
+                "-d"
+                (toString logLevel)
+              ]
+              (lib.optional (
+                cfg.web.listenAddress != ""
+              ) "-a ${utils.escapeSystemdExecArg cfg.web.listenAddress}")
+              (lib.optional (cfg.web.listenPort != 0) "-p ${toString cfg.web.listenPort}")
+            ]
+          );
+
+          # Hardening options (not present in upstream service definitions)
+          DynamicUser = true;
+          PrivateUsers = true;
+          ProtectSystem = "strict";
+          ProtectHome = true;
+          PrivateTmp = true;
+          PrivateDevices = true;
+          ProtectClock = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelTunables = true;
+          ProtectKernelModules = true;
+          ProtectControlGroups = true;
+          ProtectProc = "invisible";
+          ProcSubset = "pid";
+          NoNewPrivileges = true;
+          LockPersonality = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+            "AF_UNIX"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          UMask = "0077";
+          CapabilityBoundingSet = "";
+        };
+      };
+    };
+  };
+}
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index 3d29c6123180..3339bfc44a3c 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -31,9 +31,11 @@ let
       ];
       # FIXME: let's hope that upstream will fix this soon and we can drop this hack again.
       # https://bugzilla.mozilla.org/show_bug.cgi?id=2006630
-      extraPostPatch = lib.optionalString (lib.versionAtLeast version "147") ''
-        find . -name .cargo-checksum.json | xargs sed 's/"[^"]*\.gitmodules":"[a-z0-9]*",//g' -i
-      '';
+      extraPostPatch =
+        lib.optionalString (lib.versionAtLeast version "147" && lib.versionOlder version "149")
+          ''
+            find . -name .cargo-checksum.json | xargs sed 's/"[^"]*\.gitmodules":"[a-z0-9]*",//g' -i
+          '';
 
       meta = {
         changelog = "https://www.thunderbird.net/en-US/thunderbird/${version}/releasenotes/";
@@ -53,20 +55,26 @@ let
         license = lib.licenses.mpl20;
       };
     }).override
-      {
-        geolocationSupport = false;
-        webrtcSupport = false;
+      (
+        {
+          geolocationSupport = false;
+          webrtcSupport = false;
 
-        pgoSupport = false; # console.warn: feeds: "downloadFeed: network connection unavailable"
-      };
+          pgoSupport = false; # console.warn: feeds: "downloadFeed: network connection unavailable"
+        }
+        // lib.optionalAttrs (lib.versionAtLeast version "149") {
+          # https://bugzilla.mozilla.org/show_bug.cgi?id=2025767
+          crashreporterSupport = false;
+        }
+      );
 
 in
 rec {
   thunderbird = thunderbird-latest;
 
   thunderbird-latest = common {
-    version = "148.0.1";
-    sha512 = "4f6e721b0858bece740f04744d10d8bb0b0673d2ebfe5624d3797e28e394510a8518dc31fc6a121ba7ed8a5a44953efefe3a74071e9f967c22be17cee45b3faf";
+    version = "149.0.2";
+    sha512 = "b458139d6345bef6d07b8169aee45daae6935c2d0f540c462b1d54113c8beb2c8f17a73ce077225160dee0d2a0891fa567b57a1e5d488704c5fe0aff264f1967";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-latest";
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-backgroundremoval/default.nix b/pkgs/applications/video/obs-studio/plugins/obs-backgroundremoval/default.nix
index 0d8e37e71f70..0860915d4000 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-backgroundremoval/default.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-backgroundremoval/default.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   cmake,
   ninja,
+  pkg-config,
   obs-studio,
   onnxruntime,
   opencv,
@@ -13,19 +14,21 @@
 
 stdenv.mkDerivation rec {
   pname = "obs-backgroundremoval";
-  version = "1.1.13";
+  version = "1.3.7";
 
   src = fetchFromGitHub {
     owner = "occ-ai";
     repo = "obs-backgroundremoval";
-    rev = version;
-    hash = "sha256-QoC9/HkwOXMoFNvcOxQkGCLLAJmsja801LKCNT9O9T0=";
+    tag = version;
+    hash = "sha256-bl0KixfBnBeyidZ4+RJhX4TDy33l9awo0wISMr7XUwk=";
   };
 
   nativeBuildInputs = [
     cmake
     ninja
+    pkg-config
   ];
+
   buildInputs = [
     obs-studio
     onnxruntime
@@ -37,26 +40,19 @@ stdenv.mkDerivation rec {
   dontWrapQtApps = true;
 
   cmakeFlags = [
-    "--preset linux-x86_64"
-    "-DCMAKE_MODULE_PATH:PATH=${src}/cmake"
     "-DUSE_SYSTEM_ONNXRUNTIME=ON"
     "-DUSE_SYSTEM_OPENCV=ON"
-    "-DDISABLE_ONNXRUNTIME_GPU=ON"
+    "-DENABLE_FRONTEND_API=OFF"
+    "-DENABLE_QT=OFF"
   ];
 
-  buildPhase = ''
-    cd ..
-    cmake --build build_x86_64 --parallel
-  '';
-
-  installPhase = ''
-    cmake --install build_x86_64 --prefix "$out"
-  '';
-
   meta = {
     description = "OBS plugin to replace the background in portrait images and video";
-    homepage = "https://github.com/royshil/obs-backgroundremoval";
-    maintainers = with lib.maintainers; [ zahrun ];
+    homepage = "https://github.com/occ-ai/obs-backgroundremoval";
+    maintainers = with lib.maintainers; [
+      randomizedcoder
+      zahrun
+    ];
     license = lib.licenses.mit;
     inherit (obs-studio.meta) platforms;
   };
diff --git a/pkgs/by-name/_2/_2ship2harkinian/darwin-fixes.patch b/pkgs/by-name/_2/_2ship2harkinian/darwin-fixes.patch
new file mode 100644
index 000000000000..e2663fcf3e0f
--- /dev/null
+++ b/pkgs/by-name/_2/_2ship2harkinian/darwin-fixes.patch
@@ -0,0 +1,37 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index e3c1ac7..e7884d1 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -223,17 +223,13 @@ endif()
+ if(CMAKE_SYSTEM_NAME MATCHES "Darwin")
+ add_custom_target(CreateOSXIcons
+    COMMAND mkdir -p ${CMAKE_BINARY_DIR}/macosx/2s2h.iconset
+-   COMMAND sips -z 16 16     mm/macosx/2s2hIcon.png --out ${CMAKE_BINARY_DIR}/macosx/2s2h.iconset/icon_16x16.png
+-   COMMAND sips -z 32 32     mm/macosx/2s2hIcon.png --out ${CMAKE_BINARY_DIR}/macosx/2s2h.iconset/icon_16x16@2x.png
+-   COMMAND sips -z 32 32     mm/macosx/2s2hIcon.png --out ${CMAKE_BINARY_DIR}/macosx/2s2h.iconset/icon_32x32.png
+-   COMMAND sips -z 64 64     mm/macosx/2s2hIcon.png --out ${CMAKE_BINARY_DIR}/macosx/2s2h.iconset/icon_32x32@2x.png
+-   COMMAND sips -z 128 128   mm/macosx/2s2hIcon.png --out ${CMAKE_BINARY_DIR}/macosx/2s2h.iconset/icon_128x128.png
+-   COMMAND sips -z 256 256   mm/macosx/2s2hIcon.png --out ${CMAKE_BINARY_DIR}/macosx/2s2h.iconset/icon_128x128@2x.png
+-   COMMAND sips -z 256 256   mm/macosx/2s2hIcon.png --out ${CMAKE_BINARY_DIR}/macosx/2s2h.iconset/icon_256x256.png
+-   COMMAND sips -z 512 512   mm/macosx/2s2hIcon.png --out ${CMAKE_BINARY_DIR}/macosx/2s2h.iconset/icon_256x256@2x.png
+-   COMMAND sips -z 512 512   mm/macosx/2s2hIcon.png --out ${CMAKE_BINARY_DIR}/macosx/2s2h.iconset/icon_512x512.png
+-   COMMAND cp                mm/macosx/2s2hIcon.png ${CMAKE_BINARY_DIR}/macosx/2s2h.iconset/icon_512x512@2x.png
+-   COMMAND iconutil -c icns -o ${CMAKE_BINARY_DIR}/macosx/2s2h.icns ${CMAKE_BINARY_DIR}/macosx/2s2h.iconset
++   COMMAND convert ${CMAKE_SOURCE_DIR}/mm/macosx/2s2hIcon.png -resize 16x16 ${CMAKE_BINARY_DIR}/macosx/2s2h.iconset/icon_16.png
++   COMMAND convert ${CMAKE_SOURCE_DIR}/mm/macosx/2s2hIcon.png -resize 32x32 ${CMAKE_BINARY_DIR}/macosx/2s2h.iconset/icon_32.png
++   COMMAND convert ${CMAKE_SOURCE_DIR}/mm/macosx/2s2hIcon.png -resize 64x64 ${CMAKE_BINARY_DIR}/macosx/2s2h.iconset/icon_64.png
++   COMMAND convert ${CMAKE_SOURCE_DIR}/mm/macosx/2s2hIcon.png -resize 128x128 ${CMAKE_BINARY_DIR}/macosx/2s2h.iconset/icon_128.png
++   COMMAND convert ${CMAKE_SOURCE_DIR}/mm/macosx/2s2hIcon.png -resize 256x256 ${CMAKE_BINARY_DIR}/macosx/2s2h.iconset/icon_256.png
++   COMMAND convert ${CMAKE_SOURCE_DIR}/mm/macosx/2s2hIcon.png -resize 512x512 ${CMAKE_BINARY_DIR}/macosx/2s2h.iconset/icon_512.png
++   COMMAND png2icns ${CMAKE_BINARY_DIR}/macosx/2s2h.icns ${CMAKE_BINARY_DIR}/macosx/2s2h.iconset/icon_{16,32,64,128,256,512}.png
+    WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
+    COMMENT "Creating OSX icons ..."
+    )
+@@ -250,7 +246,6 @@ install(DIRECTORY "${CMAKE_SOURCE_DIR}/mm/assets/xml/" DESTINATION ./assets/xml)
+ INSTALL(CODE "FILE(RENAME \${CMAKE_INSTALL_PREFIX}/../MacOS/2s2h-macos \${CMAKE_INSTALL_PREFIX}/../MacOS/2s2h)")
+ install(CODE "
+    include(BundleUtilities)
+-  fixup_bundle(\"\${CMAKE_INSTALL_PREFIX}/../MacOS/2s2h\" \"\" \"${dirs}\")
+    ")
+ 
+ endif()
diff --git a/pkgs/by-name/_2/_2ship2harkinian/package.nix b/pkgs/by-name/_2/_2ship2harkinian/package.nix
index ecca7747c8ff..ed77e1b5e6ab 100644
--- a/pkgs/by-name/_2/_2ship2harkinian/package.nix
+++ b/pkgs/by-name/_2/_2ship2harkinian/package.nix
@@ -31,6 +31,10 @@
   opusfile,
   sdl_gamecontrollerdb,
   makeDesktopItem,
+  darwin,
+  glew,
+  libicns,
+  fixDarwinDylibNames,
 }:
 
 let
@@ -103,6 +107,13 @@ let
     hash = "sha256-zhRFEmPYNFLqQCfvdAaG5VBNle9Qm8FepIIIrT9sh88=";
   };
 
+  metalcpp = fetchFromGitHub {
+    owner = "briaguya-ai";
+    repo = "single-header-metal-cpp";
+    tag = "macOS13_iOS16";
+    hash = "sha256-CSYIpmq478bla2xoPL/cGYKIWAeiORxyFFZr0+ixd7I";
+  };
+
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "2ship2harkinian";
@@ -125,37 +136,50 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   patches = [
+    ./darwin-fixes.patch
     # remove fetching stb as we will patch our own
     ./dont-fetch-stb.patch
   ];
 
   nativeBuildInputs = [
     cmake
-    copyDesktopItems
     imagemagick
-    lsb-release
     makeWrapper
     ninja
     pkg-config
     python3
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    copyDesktopItems
+    lsb-release
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    darwin.sigtool
+    fixDarwinDylibNames
+    libicns
   ];
 
   buildInputs = [
     bzip2
-    libGL
     libogg
     (lib.getDev libopus)
     libpng
-    libpulseaudio
     libvorbis
-    libx11
     libzip
     nlohmann_json
     (lib.getDev opusfile)
     SDL2
     spdlog
     tinyxml-2
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    libGL
+    libpulseaudio
+    libx11
     zenity
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    glew
   ];
 
   cmakeFlags = [
@@ -169,8 +193,14 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_THREADPOOL" "${thread_pool}")
     (lib.cmakeFeature "OPUS_INCLUDE_DIR" "${lib.getDev libopus}/include/opus")
     (lib.cmakeFeature "OPUSFILE_INCLUDE_DIR" "${lib.getDev opusfile}/include/opus")
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_METALCPP" "${metalcpp}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_SPDLOG" "${spdlog}")
   ];
 
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-Wno-int-conversion -Wno-implicit-int -Wno-elaborated-enum-base";
+
   strictDeps = true;
   __structuredAttrs = true;
   enableParallelBuilding = true;
@@ -209,24 +239,51 @@ stdenv.mkDerivation (finalAttrs: {
     cp ../OTRExporter/2ship.o2r mm/
   '';
 
-  postInstall = ''
-    mkdir -p $out/bin
-    ln -s $out/2s2h/2s2h.elf $out/bin/2s2h
-    install -Dm644 ../mm/linux/2s2hIcon.png $out/share/icons/hicolor/512x512/apps/2s2h.png
+  postInstall =
+    lib.optionalString stdenv.hostPlatform.isLinux ''
+      mkdir -p $out/bin
+      ln -s $out/2s2h/2s2h.elf $out/bin/2s2h
+      install -Dm644 ../mm/linux/2s2hIcon.png $out/share/icons/hicolor/512x512/apps/2s2h.png
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      # Recreate the macOS bundle (without using cpack)
+      # We mirror the structure of the bundle distributed by the project
 
-    install -Dm644 -t $out/share/licenses/2ship2harkinian ../LICENSE
-    install -Dm644 -t $out/share/licenses/2ship2harkinian/OTRExporter ../OTRExporter/LICENSE
-    install -Dm644 -t $out/share/licenses/2ship2harkinian/ZAPDTR ../ZAPDTR/LICENSE
-    install -Dm644 -t $out/share/licenses/2ship2harkinian/libgfxd ${libgfxd}/LICENSE
-    install -Dm644 -t $out/share/licenses/2ship2harkinian/libultraship ../libultraship/LICENSE
-    install -Dm644 -t $out/share/licenses/2ship2harkinian/thread_pool ${thread_pool}/LICENSE.txt
-  '';
+      mkdir -p $out/Applications/2s2h.app/Contents
+      cp $src/mm/macosx/Info.plist.in $out/Applications/2s2h.app/Contents/Info.plist
+      substituteInPlace $out/Applications/2s2h.app/Contents/Info.plist \
+        --replace-fail "@CMAKE_PROJECT_VERSION@" "${finalAttrs.version}"
 
-  postFixup = ''
+      mv $out/MacOS $out/Applications/2s2h.app/Contents/MacOS
+
+      # "2s2h" contains all resources that are in "Resources" in the official bundle.
+      # We move them to the right place and symlink them back to $out/2s2h,
+      # as that's where the game expects them.
+      mv $out/Resources $out/Applications/2s2h.app/Contents/Resources
+      mv $out/2s2h/* $out/Applications/2s2h.app/Contents/Resources
+      rm -rf $out/2s2h
+      ln -s $out/Applications/2s2h.app/Contents/Resources $out/2s2h
+
+      # Copy icons
+      cp -r ../build/macosx/2s2h.icns $out/Applications/2s2h.app/Contents/Resources/2s2h.icns
+
+      # Codesign (ad-hoc)
+      codesign -f -s - $out/Applications/2s2h.app/Contents/MacOS/2s2h
+    ''
+    + ''
+      install -Dm644 -t $out/share/licenses/2ship2harkinian ../LICENSE
+      install -Dm644 -t $out/share/licenses/2ship2harkinian/OTRExporter ../OTRExporter/LICENSE
+      install -Dm644 -t $out/share/licenses/2ship2harkinian/ZAPDTR ../ZAPDTR/LICENSE
+      install -Dm644 -t $out/share/licenses/2ship2harkinian/libgfxd ${libgfxd}/LICENSE
+      install -Dm644 -t $out/share/licenses/2ship2harkinian/libultraship ../libultraship/LICENSE
+      install -Dm644 -t $out/share/licenses/2ship2harkinian/thread_pool ${thread_pool}/LICENSE.txt
+    '';
+
+  fixupPhase = lib.optionalString stdenv.hostPlatform.isLinux ''
     wrapProgram $out/2s2h/2s2h.elf --prefix PATH ":" ${lib.makeBinPath [ zenity ]}
   '';
 
-  desktopItems = [
+  desktopItems = lib.optionals stdenv.hostPlatform.isLinux [
     (makeDesktopItem {
       name = "2s2h";
       icon = "2s2h";
@@ -242,8 +299,11 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/HarbourMasters/2ship2harkinian";
     description = "PC port of Majora's Mask with modern controls, widescreen, high-resolution, and more";
     mainProgram = "2s2h";
-    platforms = [ "x86_64-linux" ];
-    maintainers = with lib.maintainers; [ qubitnano ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    maintainers = with lib.maintainers; [
+      qubitnano
+      matteopacini
+    ];
     license = with lib.licenses; [
       # OTRExporter, ZAPDTR, libultraship, libgfxd, thread_pool
       mit
diff --git a/pkgs/by-name/af/afsctool/package.nix b/pkgs/by-name/af/afsctool/package.nix
index cb993cf2b1aa..526b11ade2fb 100644
--- a/pkgs/by-name/af/afsctool/package.nix
+++ b/pkgs/by-name/af/afsctool/package.nix
@@ -20,6 +20,10 @@ stdenv.mkDerivation rec {
     hash = "sha256-cZ0P9cygj+5GgkDRpQk7P9z8zh087fpVfrYXMRRVUAI=";
   };
 
+  cmakeFlags = [
+    (lib.cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.5")
+  ];
+
   nativeBuildInputs = [
     pkg-config
     cmake
diff --git a/pkgs/by-name/bu/buildbox/package.nix b/pkgs/by-name/bu/buildbox/package.nix
index 1b3513cb66cf..cd9ef119ae58 100644
--- a/pkgs/by-name/bu/buildbox/package.nix
+++ b/pkgs/by-name/bu/buildbox/package.nix
@@ -11,7 +11,7 @@
   gbenchmark,
   gtest,
   protobuf,
-  glog,
+  abseil-cpp,
   nlohmann_json,
   zlib,
   openssl,
@@ -23,13 +23,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "buildbox";
-  version = "1.3.54";
+  version = "1.4.0";
 
   src = fetchFromGitLab {
     owner = "BuildGrid";
     repo = "buildbox/buildbox";
     tag = finalAttrs.version;
-    hash = "sha256-5IJHXgDeedh0FMxupokB0BRo0ZrchEo/Lba6ifeeFBg=";
+    hash = "sha256-yZux8uXjv9kQPGGL+y0p+1pURauFHhLpCAfjvOVMGmg=";
   };
 
   nativeBuildInputs = [
@@ -40,11 +40,11 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
+    abseil-cpp
     bubblewrap
     curl
     fuse3
     gbenchmark
-    glog
     grpc
     gtest
     libuuid
diff --git a/pkgs/by-name/ca/cargo-nextest/package.nix b/pkgs/by-name/ca/cargo-nextest/package.nix
index 43bfe17ee71c..c18a62d2a07a 100644
--- a/pkgs/by-name/ca/cargo-nextest/package.nix
+++ b/pkgs/by-name/ca/cargo-nextest/package.nix
@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-nextest";
-  version = "0.9.132";
+  version = "0.9.133";
 
   src = fetchFromGitHub {
     owner = "nextest-rs";
     repo = "nextest";
     tag = "cargo-nextest-${finalAttrs.version}";
-    hash = "sha256-UikUhfVfBhP2HZxUFovY5Il9lqzFTITBWMSeRxRXWtk=";
+    hash = "sha256-D8n7wvO9/MCSmvTkT6rht5+Zx9mOA/g8pajAVDVKGg8=";
   };
 
   # FIXME: we don't support dtrace probe generation on macOS until we have a dtrace build: https://github.com/NixOS/nixpkgs/pull/392918
@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ./no-dtrace-macos.patch
   ];
 
-  cargoHash = "sha256-mz6Gykzztf2OV/yifk0X0luSzv6BCVHqUCk0gWsxi2U=";
+  cargoHash = "sha256-oftwiuKIGaxr44RnkMUAu/uSs47Sh5DqqDKZWRXhAN4=";
 
   cargoBuildFlags = [
     "-p"
diff --git a/pkgs/by-name/ev/evil-winrm-py/package.nix b/pkgs/by-name/ev/evil-winrm-py/package.nix
index 93939fc20d3d..6ba82a527fd5 100644
--- a/pkgs/by-name/ev/evil-winrm-py/package.nix
+++ b/pkgs/by-name/ev/evil-winrm-py/package.nix
@@ -10,14 +10,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "evil-winrm-py";
-  version = "1.5.0";
+  version = "1.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "adityatelange";
     repo = "evil-winrm-py";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IACFPPlkgyJh78p6Jy740CQqcySkMTV/8VVPSRJKTPI=";
+    hash = "sha256-arfH7z7QGZPenyHLAubuG1VOJArUxI4wlQgV+iU7CvU=";
   };
 
   pythonRelaxDeps = true;
diff --git a/pkgs/by-name/gd/gdevelop/darwin.nix b/pkgs/by-name/gd/gdevelop/darwin.nix
index b807a4077a50..0cbf9880c9e3 100644
--- a/pkgs/by-name/gd/gdevelop/darwin.nix
+++ b/pkgs/by-name/gd/gdevelop/darwin.nix
@@ -18,7 +18,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://github.com/4ian/GDevelop/releases/download/v${version}/GDevelop-5-${version}-universal-mac.zip";
-    hash = "sha256-F8FSgUhvG6iZK7cz4Mg2zZy4M7eSlCTnDy3H2S/+Xso=";
+    hash = "sha256-vCbvFeSKDujyUwvgYr974OXWU7jKUHOukffBDurS1ik=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/by-name/gd/gdevelop/linux.nix b/pkgs/by-name/gd/gdevelop/linux.nix
index 22c9fd129d0b..f1f9929facc7 100644
--- a/pkgs/by-name/gd/gdevelop/linux.nix
+++ b/pkgs/by-name/gd/gdevelop/linux.nix
@@ -13,7 +13,7 @@ let
     if stdenv.hostPlatform.system == "x86_64-linux" then
       fetchurl {
         url = "https://github.com/4ian/GDevelop/releases/download/v${version}/GDevelop-5-${version}.AppImage";
-        hash = "sha256-wBI3D+FUGmXDaSjBdbLVjIXjzldUz3wx3c3CiTKyuXE=";
+        hash = "sha256-SpX28ailaBpJ/ARyUVzzZ76Mf3GbTLvNpLiGHv17GQg=";
       }
     else
       throw "${pname}-${version} is not supported on ${stdenv.hostPlatform.system}";
diff --git a/pkgs/by-name/gd/gdevelop/package.nix b/pkgs/by-name/gd/gdevelop/package.nix
index 298c218281b9..518952b921a6 100644
--- a/pkgs/by-name/gd/gdevelop/package.nix
+++ b/pkgs/by-name/gd/gdevelop/package.nix
@@ -4,7 +4,7 @@
   callPackage,
 }:
 let
-  version = "5.6.265";
+  version = "5.6.266";
   pname = "gdevelop";
   meta = {
     description = "Graphical Game Development Studio";
diff --git a/pkgs/by-name/go/goshs/package.nix b/pkgs/by-name/go/goshs/package.nix
index f93ab398f5ad..7be75e10a864 100644
--- a/pkgs/by-name/go/goshs/package.nix
+++ b/pkgs/by-name/go/goshs/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "goshs";
-  version = "2.0.0-beta.5";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "patrickhener";
     repo = "goshs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rbmHtVtHG8cdhFpVM5A8XlJbeB3Uh/OyUKqmYMPZeU8=";
+    hash = "sha256-Lh4jUz6dtbAwC9ErQrHe5FtxjHLL2gBRTSqLtj33GTc=";
   };
 
   vendorHash = "sha256-wn+t6xY4zUK6NE5kZSefHYGpMq5whFZ644ij5bDs50I=";
diff --git a/pkgs/by-name/ll/llmfit/package.nix b/pkgs/by-name/ll/llmfit/package.nix
index 635ea0453022..6fbb2aa97281 100644
--- a/pkgs/by-name/ll/llmfit/package.nix
+++ b/pkgs/by-name/ll/llmfit/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "llmfit";
-  version = "0.9.1";
+  version = "0.9.8";
 
   src = fetchFromGitHub {
     owner = "AlexsJones";
     repo = "llmfit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IOAY1aTt2wvwp7lNxaD4Svm1xwDGR03aZ7WvpXStrHc=";
+    hash = "sha256-hD/9Q/VChQZBVYH4c7rMdIoTsM11TgYO+OSDs2W7aKM=";
   };
 
-  cargoHash = "sha256-74uFCzSkX9TxMJjz/37ASQoWfuzNK/iAAc5pPfJl5NI=";
+  cargoHash = "sha256-BrydHdtiMklC8OZ+FzDg88v+i2/plPyX9eTYprtqNnM=";
 
   meta = {
     description = "Find what runs on your hardware";
diff --git a/pkgs/by-name/mf/mfcl8690cdwcupswrapper/package.nix b/pkgs/by-name/mf/mfcl8690cdwcupswrapper/package.nix
index f18bec338f8a..932d22569e0c 100644
--- a/pkgs/by-name/mf/mfcl8690cdwcupswrapper/package.nix
+++ b/pkgs/by-name/mf/mfcl8690cdwcupswrapper/package.nix
@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mfcl8690cdwcupswrapper";
-  version = "1.4.0-0";
+  version = "1.5.0-3";
 
   src = fetchurl {
-    url = "http://download.brother.com/welcome/dlf103250/${pname}-${version}.i386.deb";
-    sha256 = "1bl9r8mmj4vnanwpfjqgq3c9lf2v46wp5k6r2n9iqprf7ldd1kb2";
+    url = "https://download.brother.com/welcome/dlf103250/mfcl8690cdwcupswrapper-${version}.i386.deb";
+    hash = "sha256-CREQRr4nhw1pD+8AfD5p/EHpx3R6vQIO8h6VtnHxXls=";
   };
 
   nativeBuildInputs = [
@@ -56,9 +56,11 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Brother MFC-L8690CDW CUPS wrapper driver";
-    homepage = "http://www.brother.com/";
+    homepage = "https://www.brother.com/";
     license = lib.licenses.unfree;
     platforms = lib.platforms.linux;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      nick-linux
+    ];
   };
 }
diff --git a/pkgs/by-name/mf/mfcl8690cdwlpr/package.nix b/pkgs/by-name/mf/mfcl8690cdwlpr/package.nix
index bcdb8a2ce67b..86fea82dda43 100644
--- a/pkgs/by-name/mf/mfcl8690cdwlpr/package.nix
+++ b/pkgs/by-name/mf/mfcl8690cdwlpr/package.nix
@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mfcl8690cdwlpr";
-  version = "1.3.0-0";
+  version = "1.5.0-3";
 
   src = fetchurl {
-    url = "http://download.brother.com/welcome/dlf103241/${pname}-${version}.i386.deb";
-    sha256 = "0x8zd4b1psmw1znp2ibncs37xm5mljcy9yza2rx8jm8lp0a3l85v";
+    url = "https://download.brother.com/welcome/dlf103241/mfcl8690cdwlpr-${version}.i386.deb";
+    hash = "sha256-CXYo6ISUr0hFiHRVRnXbJ/21dK/2NUrCt2bnzQuHOXI=";
   };
 
   nativeBuildInputs = [
@@ -29,6 +29,7 @@ stdenv.mkDerivation rec {
   ];
 
   dontUnpack = true;
+  dontPatchELF = true;
 
   installPhase = ''
     dpkg-deb -x $src $out
@@ -37,9 +38,9 @@ stdenv.mkDerivation rec {
     filter=$dir/lpd/filter_mfcl8690cdw
 
     substituteInPlace $filter \
-      --replace /usr/bin/perl ${perl}/bin/perl \
-      --replace "BR_PRT_PATH =~" "BR_PRT_PATH = \"$dir/\"; #" \
-      --replace "PRINTER =~" "PRINTER = \"mfcl8690cdw\"; #"
+      --replace-fail /usr/bin/perl ${perl}/bin/perl \
+      --replace-fail "BR_PRT_PATH =~" "BR_PRT_PATH = \"$dir/\"; #" \
+      --replace-fail "PRINTER =~" "PRINTER = \"mfcl8690cdw\"; #"
 
     wrapProgram $filter \
       --prefix PATH : ${
@@ -53,17 +54,22 @@ stdenv.mkDerivation rec {
         ]
       }
 
-    # need to use i686 glibc here, these are 32bit proprietary binaries
-    interpreter=${pkgs.pkgsi686Linux.glibc}/lib/ld-linux.so.2
-    patchelf --set-interpreter "$interpreter" $dir/lpd/brmfcl8690cdwfilter
+    # Adding x86_64 binaries
+    for file in $dir/lpd/x86_64/brmfcl8690cdwfilter $dir/lpd/x86_64/brprintconf_mfcl8690cdw; do
+      patchelf --set-interpreter \
+        ${pkgs.pkgsi686Linux.glibc}/lib/ld-linux.so.2 \
+        $file
+    done
   '';
 
   meta = {
     description = "Brother MFC-L8690CDW LPR printer driver";
-    homepage = "http://www.brother.com/";
+    homepage = "https://www.brother.com/";
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      nick-linux
+    ];
     platforms = [
       "x86_64-linux"
       "i686-linux"
diff --git a/pkgs/by-name/mi/microsoft-edge/package.nix b/pkgs/by-name/mi/microsoft-edge/package.nix
index e20100d1e7d7..6068aee262e3 100644
--- a/pkgs/by-name/mi/microsoft-edge/package.nix
+++ b/pkgs/by-name/mi/microsoft-edge/package.nix
@@ -170,11 +170,11 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "microsoft-edge";
-  version = "146.0.3856.97";
+  version = "147.0.3912.60";
 
   src = fetchurl {
     url = "https://packages.microsoft.com/repos/edge/pool/main/m/microsoft-edge-stable/microsoft-edge-stable_${finalAttrs.version}-1_amd64.deb";
-    hash = "sha256-qsWH4zvEOZQii+KntwjYQgwL/5YgRv9jGPmfr/A4vw8=";
+    hash = "sha256-fb7BkPuiP3KjLw4h6idyMiaMuesVLseTgblLnz6ZfTU=";
   };
 
   # With strictDeps on, some shebangs were not being patched correctly
diff --git a/pkgs/by-name/mo/mold-unwrapped/package.nix b/pkgs/by-name/mo/mold-unwrapped/package.nix
index 9b0d0c678a79..b2e0e1731961 100644
--- a/pkgs/by-name/mo/mold-unwrapped/package.nix
+++ b/pkgs/by-name/mo/mold-unwrapped/package.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mold-unwrapped";
-  version = "2.40.4";
+  version = "2.41.0";
 
   src = fetchFromGitHub {
     owner = "rui314";
     repo = "mold";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BiPeZJvMlLIC0TbsqBD1JSt/RE4xZ5wSRYujPXKb+RY=";
+    hash = "sha256-N+dFJk4KJY8E0UBrAlKXpMSuiseF4KAtpFMUA/nbleQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ms/msedgedriver/package.nix b/pkgs/by-name/ms/msedgedriver/package.nix
index 6ba657438baa..dd5608313ef1 100644
--- a/pkgs/by-name/ms/msedgedriver/package.nix
+++ b/pkgs/by-name/ms/msedgedriver/package.nix
@@ -11,11 +11,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "msedgedriver";
-  version = "146.0.3856.97";
+  version = "147.0.3912.60";
 
   src = fetchzip {
     url = "https://msedgedriver.microsoft.com/${finalAttrs.version}/edgedriver_linux64.zip";
-    hash = "sha256-RqXRR7p+wMkil1jbZPWpOXl3AJV0ggG47NWauUsSy8g=";
+    hash = "sha256-OvhvTMnY7ckM92wCrM+sfn1e5641rFgi54YZGZZeUh0=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/mu/mujoco/package.nix b/pkgs/by-name/mu/mujoco/package.nix
index 61d7930e65ce..172132cc7d66 100644
--- a/pkgs/by-name/mu/mujoco/package.nix
+++ b/pkgs/by-name/mu/mujoco/package.nix
@@ -82,7 +82,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mujoco";
-  version = "3.6.0";
+  version = "3.7.0";
 
   # Bumping version? Make sure to look though the MuJoCo's commit
   # history for bumped dependency pins!
@@ -90,10 +90,12 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "google-deepmind";
     repo = "mujoco";
     tag = finalAttrs.version;
-    hash = "sha256-Gxr8AH9grTjrMTHHOVseLuTC3rNuQEZRWhSvR4HgIc4=";
+    hash = "sha256-Ti5Pdr25fck5IdgumiuLIcrI403XawbTePMJY1Fg6/A=";
   };
 
-  patches = [ ./mujoco-system-deps-dont-fetch.patch ];
+  patches = [
+    ./mujoco-system-deps-dont-fetch.patch
+  ];
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/op/openthread-border-router/firewall-script.patch b/pkgs/by-name/op/openthread-border-router/firewall-script.patch
new file mode 100644
index 000000000000..013e5b18748b
--- /dev/null
+++ b/pkgs/by-name/op/openthread-border-router/firewall-script.patch
@@ -0,0 +1,16 @@
+diff --git a/script/otbr-firewall b/script/otbr-firewall
+--- a/script/otbr-firewall
++++ b/script/otbr-firewall
+@@ -38,12 +38,8 @@
+ # Description:       This service sets up firewall for OTBR.
+ ### END INIT INFO
+ 
+-THREAD_IF="wpan0"
+ OTBR_FORWARD_INGRESS_CHAIN="OTBR_FORWARD_INGRESS"
+ 
+-. /lib/lsb/init-functions
+-. /lib/init/vars.sh
+-
+ set -euxo pipefail
+ 
+ ipset_destroy_if_exist()
diff --git a/pkgs/by-name/op/openthread-border-router/package.nix b/pkgs/by-name/op/openthread-border-router/package.nix
new file mode 100644
index 000000000000..d9b1d429492d
--- /dev/null
+++ b/pkgs/by-name/op/openthread-border-router/package.nix
@@ -0,0 +1,122 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  systemdLibs,
+  avahi,
+  dbus,
+  protobuf,
+  jsoncpp,
+  boost,
+  libnetfilter_queue,
+  libnfnetlink,
+  nodejs,
+  bashNonInteractive,
+  buildNpmPackage,
+}:
+let
+  pname = "ot-br-posix";
+  version = "0-unstable-2025-06-12";
+
+  src = fetchFromGitHub {
+    owner = "openthread";
+    repo = "ot-br-posix";
+    rev = "thread-reference-20250612";
+    hash = "sha256-lPMMLtbPu9NpDcBCZE6XID7u1maCAhkZiSDEyFq7yvg=";
+    fetchSubmodules = true;
+  };
+
+  frontendModules = buildNpmPackage {
+    pname = "${pname}-frontend";
+    inherit version;
+    src = "${src}/src/web/web-service/frontend";
+    npmDepsHash = "sha256-7UVfPICyIbHEClpr3p7eDR46OUzS8mVf6P7phnDpVLk=";
+    dontNpmBuild = true;
+  };
+in
+stdenv.mkDerivation {
+  inherit pname version src;
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  # warning _FORTIFY_SOURCE requires compiling with optimization (-O)
+  env.NIX_CFLAGS_COMPILE = "-O";
+
+  patches = [
+    # Patch the firewall script so we can run it within the systemd start script
+    ./firewall-script.patch
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+    nodejs
+  ];
+
+  # Adding npmConfigHook and manually passing fetchNpmDeps was resulting in ENOTCACHED errors
+  postConfigure = ''
+    ln -sf ${frontendModules}/lib/node_modules/otbr-web/node_modules ./src/web/web-service/frontend/
+  '';
+
+  buildInputs = [
+    avahi # TODO: upstream deprecated OTBR_MDNS=avahi after this release (https://github.com/openthread/ot-br-posix/pull/3240)
+    systemdLibs
+    protobuf
+    jsoncpp
+    boost
+    libnetfilter_queue
+    libnfnetlink
+    dbus
+    (lib.getBin bashNonInteractive)
+  ];
+
+  postInstall = ''
+    mkdir -p $out/bin
+    cp ../script/otbr-firewall $out/bin/
+    chmod +x $out/bin/otbr-firewall
+  '';
+
+  cmakeFlags = [
+    (lib.cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.5")
+
+    (lib.cmakeBool "BUILD_TESTING" false)
+    (lib.cmakeBool "INSTALL_SYSTEMD_UNIT" false)
+    (lib.cmakeBool "Boost_USE_STATIC_LIBS" false)
+    (lib.cmakeBool "OTBR_REST" true)
+
+    (lib.cmakeBool "OTBR_WEB" true)
+    (lib.cmakeBool "OTBR_NAT64" true)
+    (lib.cmakeBool "OTBR_BACKBONE_ROUTER" true)
+    (lib.cmakeBool "OTBR_BORDER_ROUTING" true)
+    (lib.cmakeBool "OTBR_DBUS" true)
+    (lib.cmakeBool "OTBR_TREL" true)
+
+    (lib.cmakeFeature "OTBR_VERSION" version)
+    (lib.cmakeBool "OTBR_DNSSD_DISCOVERY_PROXY" true)
+    (lib.cmakeBool "OTBR_SRP_ADVERTISING_PROXY" true)
+    (lib.cmakeBool "OTBR_DUA_ROUTING" true)
+    (lib.cmakeBool "OTBR_DNS_UPSTREAM_QUERY" true)
+
+    (lib.cmakeBool "OT_CHANNEL_MANAGER" true)
+    (lib.cmakeBool "OT_CHANNEL_MONITOR" true)
+
+    # Required by protobuf
+    (lib.cmakeFeature "CMAKE_CXX_STANDARD" "17")
+  ];
+
+  meta = {
+    description = "Thread border router for POSIX-based platforms";
+    homepage = "https://github.com/openthread/ot-br-posix";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [
+      jamiemagee
+      leonm1
+      mrene
+    ];
+    mainProgram = "ot-ctl";
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/qi/qidi-studio/package.nix b/pkgs/by-name/qi/qidi-studio/package.nix
index 4327638f25f9..e69d73ca2e75 100644
--- a/pkgs/by-name/qi/qidi-studio/package.nix
+++ b/pkgs/by-name/qi/qidi-studio/package.nix
@@ -7,11 +7,11 @@
 }:
 let
   pname = "qidi-studio";
-  version = "2.05.01.52";
+  version = "2.05.01.53";
 
   src = fetchurl {
     url = "https://github.com/QIDITECH/QIDIStudio/releases/download/v${version}/QIDIStudio_v0${version}_Ubuntu24.AppImage";
-    hash = "sha256-bjQsLWuBcA9rWwX8UICgh0SKJ3zQe1oZWcqf7buoe6E=";
+    hash = "sha256-d43u7tUEX8QB3vHQZzMylW4t4/TrFkQJB+Kapsew/CU=";
   };
 
   appimageContents = appimageTools.extract {
diff --git a/pkgs/by-name/ro/rollo-printer/package.nix b/pkgs/by-name/ro/rollo-printer/package.nix
new file mode 100644
index 000000000000..297c4ebe86b5
--- /dev/null
+++ b/pkgs/by-name/ro/rollo-printer/package.nix
@@ -0,0 +1,40 @@
+{
+  cups,
+  fetchurl,
+  lib,
+  pkg-config,
+  stdenv,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "rollo-printer";
+  version = "1.8.4";
+
+  src = fetchurl {
+    url = "https://rollo-main.b-cdn.net/driver-dl/linux/rollo-cups-driver-${finalAttrs.version}.tar.gz";
+    hash = "sha256-v61/5HY25cvhVbHF+dXOOGrDfZZzvvicJEy7MKTAG10=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ cups ];
+
+  # configure unconditionally derives CUPS_DATADIR/CUPS_SERVERBIN from
+  # pkg-config, which points into the cups store path; override at make time
+  # so the filter and PPD are installed into $out instead.
+  makeFlags = [
+    "CUPS_DATADIR=${placeholder "out"}/share/cups"
+    "CUPS_SERVERBIN=${placeholder "out"}/lib/cups"
+  ];
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  meta = {
+    description = "CUPS driver for Rollo label printers";
+    homepage = "https://www.rollo.com/driver-linux/";
+    license = with lib.licenses; gpl3Plus;
+    maintainers = with lib.maintainers; [ shymega ];
+    platforms = cups.meta.platforms;
+    broken = stdenv.hostPlatform.isDarwin;
+  };
+})
diff --git a/pkgs/by-name/ru/rumdl/package.nix b/pkgs/by-name/ru/rumdl/package.nix
index 7912c98e0f32..979ef2b8a274 100644
--- a/pkgs/by-name/ru/rumdl/package.nix
+++ b/pkgs/by-name/ru/rumdl/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rumdl";
-  version = "0.1.67";
+  version = "0.1.72";
 
   src = fetchFromGitHub {
     owner = "rvben";
     repo = "rumdl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+oCgwNGLmntYLbXY1kYQMIQI4IdWOkNS7MBWWIY0I3o=";
+    hash = "sha256-/dMGfXNh/294fA4q/zn2fOAou3HC+BoTOYvQ18oYvI0=";
   };
 
-  cargoHash = "sha256-zIppcngdW7eKXuqA0BD4B7Qpt1EVL22IZHEXyuF6xIY=";
+  cargoHash = "sha256-ZfvH4KS2UXvhkfkY6pReXBPiZ3enRqLu32ScG6VZZfM=";
 
   cargoBuildFlags = [
     "--bin=rumdl"
diff --git a/pkgs/by-name/sn/sniffnet/package.nix b/pkgs/by-name/sn/sniffnet/package.nix
index d6082f9bd407..cc679143edf3 100644
--- a/pkgs/by-name/sn/sniffnet/package.nix
+++ b/pkgs/by-name/sn/sniffnet/package.nix
@@ -29,16 +29,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sniffnet";
-  version = "1.4.2";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "gyulyvgc";
     repo = "sniffnet";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LqEEh+YqFJkseLdFRfCTIK7Q3Xs0M1u+vVcxpNJntCA=";
+    hash = "sha256-ifXccpoyz+NnZDjbRXlVZXfd2TLvOhGVB504hDyIjnE=";
   };
 
-  cargoHash = "sha256-iSQZxZTuSCNIB/725TO9UcvzKyA49DARoYcZh87y1Xs=";
+  cargoHash = "sha256-Tw32dOzFkO/cOlLdTfHeybhmbidgsnfYMIeHhfrrtVc=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/tb/tbls/package.nix b/pkgs/by-name/tb/tbls/package.nix
index 3e651c0a9666..dbf0a023f9d0 100644
--- a/pkgs/by-name/tb/tbls/package.nix
+++ b/pkgs/by-name/tb/tbls/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "tbls";
-  version = "1.94.2";
+  version = "1.94.4";
 
   src = fetchFromGitHub {
     owner = "k1LoW";
     repo = "tbls";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jsMNPtcdrfKO3O2sy+pyFVU4H/HLWVmI3OS43Q6j7AE=";
+    hash = "sha256-IcJVEVyO8cq9UHWq+b+1YuMgkwJRI430UekiLKeKjYo=";
   };
 
-  vendorHash = "sha256-ShhztdAKbEhooIGgxHig7RptDLCSG64G9ajmXr9hmL8=";
+  vendorHash = "sha256-NhssCwXaeBUS+LLU/CTG/+Y5hOih9aOVCMYIXrxbU4M=";
 
   excludedPackages = [ "scripts/jsonschema" ];
 
diff --git a/pkgs/by-name/wa/wayscriber/package.nix b/pkgs/by-name/wa/wayscriber/package.nix
index 49c890f234e2..60e0f17b276e 100644
--- a/pkgs/by-name/wa/wayscriber/package.nix
+++ b/pkgs/by-name/wa/wayscriber/package.nix
@@ -10,20 +10,20 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wayscriber";
-  version = "0.9.13";
+  version = "0.9.16";
 
   src = fetchFromGitHub {
     owner = "devmobasa";
     repo = "wayscriber";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5e+Qqy8SwRz3qOqcgwZtoVQ7j+nYski0Q8yj1PtDn14=";
+    hash = "sha256-gfWvepANARgXXdpTRdAr9zZNfAxwi9icEbvP3AMFsUI=";
   };
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
     pango
     libxkbcommon
   ];
-  cargoHash = "sha256-YRNUZ82U8MTx1GFRT4mLvWcFatrbSsIkHp2NKtw6RbA=";
+  cargoHash = "sha256-SqTWkbuW2Dy/e5oCr7G7m/T5/kLpf+ZPKxXKPDeRX9U=";
   passthru.updateScript = nix-update-script { };
 
   meta = {
diff --git a/pkgs/by-name/xo/xorg-server/package.nix b/pkgs/by-name/xo/xorg-server/package.nix
index 2afcf03a0137..5c63319bb74e 100644
--- a/pkgs/by-name/xo/xorg-server/package.nix
+++ b/pkgs/by-name/xo/xorg-server/package.nix
@@ -57,7 +57,10 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "xorg-server";
-  version = "21.1.21";
+  # `xvfb` inherits `version` and `src` from here, leading to many rebuilds. If
+  # necessary, these can be moved out of lockstep in order to merge updates
+  # quickly.
+  version = "21.1.22";
 
   outputs = [
     "out"
@@ -66,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://xorg/individual/xserver/xorg-server-${finalAttrs.version}.tar.xz";
-    hash = "sha256-wMvlVFs/ZFuuYCS4MNHRFUqVY1BoOk5Ssv/1sPoatRk=";
+    hash = "sha256-GiQsiRfEm6KczB9gIWE9iiuYBd0NJxpmrp0J9LC7BrM=";
   };
 
   patches = lib.optionals stdenv.hostPlatform.isDarwin [
diff --git a/pkgs/by-name/xv/xvfb/package.nix b/pkgs/by-name/xv/xvfb/package.nix
index d5e64c146571..5514f0e1415d 100644
--- a/pkgs/by-name/xv/xvfb/package.nix
+++ b/pkgs/by-name/xv/xvfb/package.nix
@@ -7,6 +7,7 @@
   ninja,
   pkg-config,
   xorg-server,
+  fetchurl,
   dri-pkgconfig-stub,
   libdrm,
   libGL,
@@ -37,7 +38,13 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "xvfb";
 
-  inherit (xorg-server) src version;
+  #FIXME: go back to xorg-server version on nixpkgs staging
+  #inherit (xorg-server) src version;
+  version = "21.1.21";
+  src = fetchurl {
+    url = "mirror://xorg/individual/xserver/xorg-server-${finalAttrs.version}.tar.xz";
+    hash = "sha256-wMvlVFs/ZFuuYCS4MNHRFUqVY1BoOk5Ssv/1sPoatRk=";
+  };
 
   strictDeps = true;
 
diff --git a/pkgs/by-name/zr/zrythm/package.nix b/pkgs/by-name/zr/zrythm/package.nix
index de89862ebedd..3d0a58f5a122 100644
--- a/pkgs/by-name/zr/zrythm/package.nix
+++ b/pkgs/by-name/zr/zrythm/package.nix
@@ -41,7 +41,7 @@
   ninja,
   pcre2,
   pkg-config,
-  plasma5Packages,
+  kdePackages,
   python3,
   rtaudio_6,
   rtmidi,
@@ -200,8 +200,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   preFixup = ''
     gappsWrapperArgs+=(
-      --prefix GSETTINGS_SCHEMA_DIR : "$out/share/gsettings-schemas/${finalAttrs.pname}-${finalAttrs.version}/glib-2.0/schemas/"
-      --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS:${plasma5Packages.breeze-icons}/share"
+      --prefix GSETTINGS_SCHEMA_DIR : "$out/share/gsettings-schemas/zrythm-${finalAttrs.version}/glib-2.0/schemas/"
+      --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS:${kdePackages.breeze-icons}/share"
     )
   '';
 
diff --git a/pkgs/development/coq-modules/jasmin/default.nix b/pkgs/development/coq-modules/jasmin/default.nix
index 12eca9fd9c44..ac01c30397b6 100644
--- a/pkgs/development/coq-modules/jasmin/default.nix
+++ b/pkgs/development/coq-modules/jasmin/default.nix
@@ -16,29 +16,24 @@
   inherit version;
   defaultVersion =
     let
-      case = coq: mc: out: {
-        cases = [
-          coq
-          mc
-        ];
-        inherit out;
-      };
+      case = case: out: { inherit case out; };
     in
     with lib.versions;
-    lib.switch
-      [ coq.coq-version mathcomp.version ]
-      [
-        (case (range "8.20" "9.1") (range "2.2" "2.4") "2025.06.1")
-        (case (range "8.19" "9.1") (range "2.2" "2.4") "2025.02.1")
-        (case (isEq "8.18") (isEq "2.2") "2024.07.2")
-      ]
-      null;
+    lib.switch coq.coq-version [
+      (case (range "8.20" "9.1") "2026.03.1")
+      (case (isEq "8.19") "2025.02.2")
+      (case (isEq "8.18") "2024.07.4")
+    ] null;
   releaseRev = v: "v${v}";
 
+  release."2026.03.1".hash = "sha256-CE+WbcG0lgKvaV/OSMlTp3fG+v82X41z/w7ynsM/LLg=";
+  release."2026.03.0".hash = "sha256-MzdVbZhXlb9JFLsf+23yJNFiGJDBJZGbX6Ox3/U1EzA=";
   release."2025.06.1".sha256 = "sha256-wEL1tN0HUa1Eb7FiQOBA6sAkuonrAMdkqq8gu9/CED0=";
   release."2025.06.0".sha256 = "sha256-XfTg7ofamzMWqmRIU1/MO+S/ieNjvNEhlgIqFrchdAQ=";
+  release."2025.02.2".hash = "sha256-ks0eWqKv7bqgHgMowqTFjKzuT9kMYl2Ozj2s1DaSdEo=";
   release."2025.02.1".sha256 = "sha256-8P2GdplB12Q0e0XdL77w3nQL1/6Xl/gQNhGTB0WX/8I=";
   release."2025.02.0".sha256 = "sha256-Jlf0+VPuYWXdWyKHKHSp7h/HuCCp4VkcrgDAmh7pi5s=";
+  release."2024.07.4".hash = "sha256-eA9xX8jhmt8HJAetBj1lrIOYn5edOjO8iHr8uvm9+lE=";
   release."2024.07.3".sha256 = "sha256-n/X8d7ILuZ07l24Ij8TxbQzAG7E8kldWFcUI65W4r+c=";
   release."2024.07.2".sha256 = "sha256-aF8SYY5jRxQ6iEr7t6mRN3BEmIDhJ53PGhuZiJGB+i8=";
 
diff --git a/pkgs/development/ocaml-modules/ppx_mikmatch/default.nix b/pkgs/development/ocaml-modules/ppx_mikmatch/default.nix
new file mode 100644
index 000000000000..2af11e5a6b9d
--- /dev/null
+++ b/pkgs/development/ocaml-modules/ppx_mikmatch/default.nix
@@ -0,0 +1,40 @@
+{
+  buildDunePackage,
+  fetchurl,
+  lib,
+  menhir,
+  ounit2,
+  ppxlib,
+  re,
+}:
+
+buildDunePackage (finalAttrs: {
+  pname = "ppx_mikmatch";
+  version = "1.3";
+  src = fetchurl {
+    name = "ppx_mikmatch-${finalAttrs.version}.tar.gz";
+    url = "https://codeload.github.com/ahrefs/ppx_mikmatch/tar.gz/refs/tags/${finalAttrs.version}";
+    hash = "sha256-i97gSyutefbJbDZv/yjaeHfV1CU6j3RSaQ1oPjiz8hg=";
+  };
+
+  minimalOCamlVersion = "5.3";
+
+  nativeBuildInputs = [ menhir ];
+  propagatedBuildInputs = [
+    ppxlib
+    re
+  ];
+
+  checkInputs = [ ounit2 ];
+  doCheck = true;
+
+  meta = {
+    description = "Matching Regular Expressions with OCaml Patterns using Mikmatch's syntax";
+    homepage = "https://github.com/ahrefs/ppx_mikmatch";
+    license = lib.licenses.lgpl3Plus;
+    maintainers = [
+      lib.maintainers.vog
+      lib.maintainers.zazedd
+    ];
+  };
+})
diff --git a/pkgs/development/python-modules/dm-control/default.nix b/pkgs/development/python-modules/dm-control/default.nix
index 7429d8fe18cc..e33755a9194e 100644
--- a/pkgs/development/python-modules/dm-control/default.nix
+++ b/pkgs/development/python-modules/dm-control/default.nix
@@ -29,14 +29,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "dm-control";
-  version = "1.0.38";
+  version = "1.0.39";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "google-deepmind";
     repo = "dm_control";
     tag = finalAttrs.version;
-    hash = "sha256-3Bo4XOR3iEf9H0RgMq/62CyKHua9nPU8gpYgze1GMno=";
+    hash = "sha256-N5/zFIJIj0T0TxATeExbcSuAy/kNotY5odSiJuehZ7Y=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/mujoco/default.nix b/pkgs/development/python-modules/mujoco/default.nix
index bf0782c2d9d2..6b147259b12b 100644
--- a/pkgs/development/python-modules/mujoco/default.nix
+++ b/pkgs/development/python-modules/mujoco/default.nix
@@ -38,7 +38,7 @@ buildPythonPackage (finalAttrs: {
   # in the project's CI.
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-FcifQj4zvOCGCtcGF2O3IyNCbWNI17Lkbr3MN7EeCQU=";
+    hash = "sha256-0yXFRIcCqRnbWz0AUP/wr4bUfaFG1ZZ4cishEve1UIQ=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/symbolic/default.nix b/pkgs/development/python-modules/symbolic/default.nix
index b71c901a1f18..fccaf7e3e3d6 100644
--- a/pkgs/development/python-modules/symbolic/default.nix
+++ b/pkgs/development/python-modules/symbolic/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "symbolic";
-  version = "12.17.3";
+  version = "12.18.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -23,12 +23,12 @@ buildPythonPackage rec {
     tag = version;
     # the `py` directory is not included in the tarball, so we fetch the source via git instead
     forceFetchGit = true;
-    hash = "sha256-DNzu33JQuTA60uGD5iG9UkHUO/ljQbpcSUkmVk4vrbU=";
+    hash = "sha256-BPGT+Hb47LN7X6Qx31foqQUMLd8UW5wKVg5xzkQERh8=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-EPCMTeA5Cm86bT/k+cEFngJstmDO6ffVUemW5pOV1Fo=";
+    hash = "sha256-6u6j0AQTyR7lU5kWAHTfa0B0cY0EhTBDG9L7vq62UCw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 37710dc75461..ed935aac2bf7 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1816,6 +1816,8 @@ let
 
         ppx_lun = callPackage ../development/ocaml-modules/lun/ppx.nix { };
 
+        ppx_mikmatch = callPackage ../development/ocaml-modules/ppx_mikmatch { };
+
         ppx_monad = callPackage ../development/ocaml-modules/ppx_monad { };
 
         ppx_repr = callPackage ../development/ocaml-modules/repr/ppx.nix { };