diff --git a/nixos/modules/programs/starship.nix b/nixos/modules/programs/starship.nix
index 849c91b12ed3..b23471d2529f 100644
--- a/nixos/modules/programs/starship.nix
+++ b/nixos/modules/programs/starship.nix
@@ -116,7 +116,7 @@ in
         # config file.  starship appears to use a hardcoded config location
         # rather than one inside an XDG folder:
         # https://github.com/starship/starship/blob/686bda1706e5b409129e6694639477a0f8a3f01b/src/configure.rs#L651
-        if [[ ! -f "$${STARSHIP_CONFIG:-$HOME/.config/starship.toml}" ]]; then
+        if [[ ! -f "''${STARSHIP_CONFIG:-$HOME/.config/starship.toml}" ]]; then
           export STARSHIP_CONFIG=${settingsFile}
         fi
         eval "$(${cfg.package}/bin/starship init bash --print-full-init)"
@@ -154,7 +154,7 @@ in
         # config file.  starship appears to use a hardcoded config location
         # rather than one inside an XDG folder:
         # https://github.com/starship/starship/blob/686bda1706e5b409129e6694639477a0f8a3f01b/src/configure.rs#L651
-        if [[ ! -f "$${STARSHIP_CONFIG:-$HOME/.config/starship.toml}" ]]; then
+        if [[ ! -f "''${STARSHIP_CONFIG:-$HOME/.config/starship.toml}" ]]; then
           export STARSHIP_CONFIG=${settingsFile}
         fi
         eval "$(${cfg.package}/bin/starship init zsh)"
diff --git a/nixos/modules/services/audio/navidrome.nix b/nixos/modules/services/audio/navidrome.nix
index 8920c2d429ff..a57fa2e159c6 100644
--- a/nixos/modules/services/audio/navidrome.nix
+++ b/nixos/modules/services/audio/navidrome.nix
@@ -90,12 +90,9 @@ in
 
             Plugins = {
               Enabled = mkOption {
-                default = (builtins.length cfg.plugins) != 0;
-                defaultText = literalExpression "builtins.length \"\${config.services.navidrome.plugins != 0}\"";
+                default = true;
                 description = ''
                   Enable plugin support in navidrome.
-
-                  This is automatically enabled if {option}`services.navidrome.plugins` is used.
                 '';
               };
               Folder = mkOption {
diff --git a/nixos/modules/services/web-apps/nextcloud.md b/nixos/modules/services/web-apps/nextcloud.md
index 0becc863590b..69d7053d1adc 100644
--- a/nixos/modules/services/web-apps/nextcloud.md
+++ b/nixos/modules/services/web-apps/nextcloud.md
@@ -68,6 +68,11 @@ It requires elevated permissions to become the `nextcloud` user. Given the way t
 escalation is implemented, parameters passed via the environment to Nextcloud are
 currently ignored, except for `OC_PASS` and `NC_PASS`.
 
+::: {.warning}
+When Polkit is enabled, the command being executed by `nextcloud-occ` might be logged
+into the system's journal. Be careful to not leak secrets that way!
+:::
+
 Custom service units that need to run `nextcloud-occ` either need elevated privileges
 or the systemd configuration from `nextcloud-setup.service` (recommended):
 
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index cd27e799168a..d6f81168f4f7 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -418,24 +418,6 @@ in
       tiniHash = "sha256-jCBNfoJAjmcTJBx08kHs+FmbaU82CbQcf0IVjd56Nuw=";
     };
 
-  docker_28 =
-    let
-      version = "28.5.2";
-    in
-    callPackage dockerGen {
-      inherit version;
-      cliRev = "v${version}";
-      cliHash = "sha256-11wbqvenTJooAzqOEp0UivPxhvWwSl1thCAzDMx0i/o=";
-      mobyRev = "v${version}";
-      mobyHash = "sha256-T5zz1lSLVdMR646CfhWAiVU4/VPAY1CRU+jIdjEWycs=";
-      runcRev = "v1.3.3";
-      runcHash = "sha256-Ci/2otySB7FaFoutmzWeVaTU+tO/lnluQfneFSQM1RE=";
-      containerdRev = "v1.7.28";
-      containerdHash = "sha256-vz7RFJkFkMk2gp7bIMx1kbkDFUMS9s0iH0VoyD9A21s=";
-      tiniRev = "369448a167e8b3da4ca5bca0b3307500c3371828";
-      tiniHash = "sha256-jCBNfoJAjmcTJBx08kHs+FmbaU82CbQcf0IVjd56Nuw=";
-    };
-
   docker_29 =
     let
       version = "29.4.3";
diff --git a/pkgs/by-name/_1/_1password-gui/sources.json b/pkgs/by-name/_1/_1password-gui/sources.json
index a7f258fa0f52..9cdb264b1767 100644
--- a/pkgs/by-name/_1/_1password-gui/sources.json
+++ b/pkgs/by-name/_1/_1password-gui/sources.json
@@ -5,11 +5,11 @@
       "sources": {
         "x86_64": {
           "url": "https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.12.21.x64.tar.gz",
-          "hash": "sha256-+TNkHD+CEODImJqxsvYO008UYqOAyrFpfXiaI5zYuDs="
+          "hash": "sha256-JwiMi2iozP6jWSIUtgXla86aSAhuUob7snqtUbeXPpI="
         },
         "aarch64": {
           "url": "https://downloads.1password.com/linux/tar/stable/aarch64/1password-8.12.21.arm64.tar.gz",
-          "hash": "sha256-zY2hwSANgpGLGh/qOXUbY2JlZnNpXByysAgZvnuS+Qc="
+          "hash": "sha256-WPFUqKKfdadzF7BtR9gUm0SlYq4ZN36eICfGsPxirH0="
         }
       }
     },
@@ -18,39 +18,39 @@
       "sources": {
         "x86_64": {
           "url": "https://downloads.1password.com/mac/1Password-8.12.21-x86_64.zip",
-          "hash": "sha256-3CX1Qv2lYTy23XXRaAblOE+mp5YoX4qtV0SXV4hP8xI="
+          "hash": "sha256-tAWgIe7mcaGANCn8Kr0h6+zmvqufDJMjzAI3FrAGNk0="
         },
         "aarch64": {
           "url": "https://downloads.1password.com/mac/1Password-8.12.21-aarch64.zip",
-          "hash": "sha256-dwE97R0ZXn5kH9GGlyE+Zizb2T5GasgpGW+5zUFog8U="
+          "hash": "sha256-1c6YbzFYNyHKzY13OZ7z1Ad5hzgTIMs3aT0nluK9l0w="
         }
       }
     }
   },
   "beta": {
     "linux": {
-      "version": "8.12.12-43.BETA",
+      "version": "8.12.22-15.BETA",
       "sources": {
         "x86_64": {
-          "url": "https://downloads.1password.com/linux/tar/beta/x86_64/1password-8.12.12-43.BETA.x64.tar.gz",
-          "hash": "sha256-dMnYMw+egxZZXR03EBhOyL3mdRjp0nyuxL78eVKklHs="
+          "url": "https://downloads.1password.com/linux/tar/beta/x86_64/1password-8.12.22-15.BETA.x64.tar.gz",
+          "hash": "sha256-rqbbfsCgo5+3PecaVo0YKCXS9afgzSbXz1DxcVWfkf8="
         },
         "aarch64": {
-          "url": "https://downloads.1password.com/linux/tar/beta/aarch64/1password-8.12.12-43.BETA.arm64.tar.gz",
-          "hash": "sha256-nge4jT8M8X2LR18vHfZTRnIEcfxVgnbcHvvAJcveZxI="
+          "url": "https://downloads.1password.com/linux/tar/beta/aarch64/1password-8.12.22-15.BETA.arm64.tar.gz",
+          "hash": "sha256-e3IzRG/Ptj3MSszd1DRRMOXorlhVPon+oVinRy+4q+I="
         }
       }
     },
     "darwin": {
-      "version": "8.11.22-25.BETA",
+      "version": "8.12.22-15.BETA",
       "sources": {
         "x86_64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.11.22-25.BETA-x86_64.zip",
-          "hash": "sha256-ZUFlsExUccqIXagggwTFj99Efd1i5Lo07P/XgTZuHBs="
+          "url": "https://downloads.1password.com/mac/1Password-8.12.22-15.BETA-x86_64.zip",
+          "hash": "sha256-AVKhJcRwkxp4N0s2dalY/lcFvcEzuJ0dJzVKwmEpT1M="
         },
         "aarch64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.11.22-25.BETA-aarch64.zip",
-          "hash": "sha256-ALY5Kj/Wt/p3OTCv085q+TWFS5rLXp6MctCBUSG0ZSI="
+          "url": "https://downloads.1password.com/mac/1Password-8.12.22-15.BETA-aarch64.zip",
+          "hash": "sha256-ZQAZUFHlNfgvBe/JKVnpjpstQsivXemXMDFiHuxM3eo="
         }
       }
     }
diff --git a/pkgs/by-name/ai/aider-chat/package.nix b/pkgs/by-name/ai/aider-chat/package.nix
index a769e9f1b9fb..f81abd03ec89 100644
--- a/pkgs/by-name/ai/aider-chat/package.nix
+++ b/pkgs/by-name/ai/aider-chat/package.nix
@@ -112,6 +112,7 @@ let
       requests
       rich
       rpds-py
+      rsa
       scipy
       shtab
       smmap
diff --git a/pkgs/by-name/ca/camilladsp/package.nix b/pkgs/by-name/ca/camilladsp/package.nix
index ad7fda83b157..5e07ce723b70 100644
--- a/pkgs/by-name/ca/camilladsp/package.nix
+++ b/pkgs/by-name/ca/camilladsp/package.nix
@@ -50,8 +50,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     homepage = "https://github.com/HEnquist/camilladsp";
     changelog = "https://github.com/HEnquist/camilladsp/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.gpl3Only;
-    platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ paepcke ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    maintainers = with lib.maintainers; [
+      paepcke
+      stepbrobd
+    ];
     mainProgram = "camilladsp";
   };
 })
diff --git a/pkgs/by-name/ca/cargo-hakari/package.nix b/pkgs/by-name/ca/cargo-hakari/package.nix
index 553956486ee8..334be5cc2394 100644
--- a/pkgs/by-name/ca/cargo-hakari/package.nix
+++ b/pkgs/by-name/ca/cargo-hakari/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-hakari";
-  version = "0.9.37";
+  version = "0.9.38";
 
   src = fetchFromGitHub {
     owner = "guppy-rs";
     repo = "guppy";
     tag = "cargo-hakari-${finalAttrs.version}";
-    hash = "sha256-Rf/1IhcvSp9Q8dLo/kuG0O9uIUH15Aw567ggaABANJw=";
+    hash = "sha256-joTDNEIlNDtRBFV6QL2yqM3VWbZ05nF235U3F8lekeE=";
   };
 
-  cargoHash = "sha256-vL+1oJO9qTg/SX0mvt3hvKo1t3FhQJmUSLoK6LZuqZc=";
+  cargoHash = "sha256-JmRq6Hoss99tOymMQvrBZevrf56+nSS70AZb2XeqZSc=";
 
   cargoBuildFlags = [
     "-p"
diff --git a/pkgs/by-name/co/copilot-language-server/package.nix b/pkgs/by-name/co/copilot-language-server/package.nix
index 0ddcc5196f2e..4548130f3bce 100644
--- a/pkgs/by-name/co/copilot-language-server/package.nix
+++ b/pkgs/by-name/co/copilot-language-server/package.nix
@@ -10,11 +10,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "copilot-language-server";
-  version = "1.487.0";
+  version = "1.495.0";
 
   src = fetchzip {
     url = "https://github.com/github/copilot-language-server-release/releases/download/${finalAttrs.version}/copilot-language-server-js-${finalAttrs.version}.zip";
-    hash = "sha256-v7bYNfpN7xFg4Zc0kb3RpwSBqUew3wG7JdX6BM7nzxI=";
+    hash = "sha256-6ld4pAyC0zS0T1kLNKtEywFrVMTUOdN3edbtjVhjlpY=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/dc/dcp/package.nix b/pkgs/by-name/dc/dcp/package.nix
index 6617a7867766..e6cbf069396a 100644
--- a/pkgs/by-name/dc/dcp/package.nix
+++ b/pkgs/by-name/dc/dcp/package.nix
@@ -15,16 +15,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "dcp";
-  version = "0.23.4";
+  version = "0.24.3";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "dcp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4hGFoFmVltr2oS1Bq7bB0V1TYnh2QEleFG29A0VfZYM=";
+    hash = "sha256-SHMthGpQ3zKJXmltIjSEI0vq1fysdUCs1rIiaBHi0JI=";
   };
 
-  vendorHash = "sha256-f5NcEgkBzOdYqBdVGYoL8EYew6LXmZwpNiIQeoett/k=";
+  vendorHash = "sha256-hcuVUUr3kr3iBmSEhHy365LIWGGLFTYnBRa5jnt7kPw=";
 
   # This is required so we:
   # - Delete an inconsistent vendor directory from upstream
diff --git a/pkgs/by-name/ev/evcc/package.nix b/pkgs/by-name/ev/evcc/package.nix
index ad778e31128d..4fc9a3ab7853 100644
--- a/pkgs/by-name/ev/evcc/package.nix
+++ b/pkgs/by-name/ev/evcc/package.nix
@@ -17,33 +17,21 @@
 }:
 
 let
-  version = "0.306.3";
+  version = "0.307.0";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = "evcc";
     tag = version;
-    hash = "sha256-6j4GTAgC5xvLkaNaOQQBkjINI4Wg57IHVVUoDY/rfBo=";
+    hash = "sha256-G6+8cJF+So9kePDpNlFGuvsTU5+KXg9dlgaMnElWwL8=";
   };
 
-  vendorHash = "sha256-JBhx1K8E2BynsgjXBno+0OUpWF15Eyo9yBzofruBEck=";
+  vendorHash = "sha256-ie5wCRgGj8DeotYD/GrDP9qTnonTJsMqj1fBqHNR84M=";
 
   commonMeta = {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ hexa ];
   };
-
-  decorate = buildGo126Module {
-    pname = "evcc-decorate";
-    inherit version src vendorHash;
-
-    subPackages = "cmd/decorate";
-
-    meta = commonMeta // {
-      description = "EVCC decorate helper";
-      homepage = "https://github.com/evcc-io/evcc/tree/master/cmd/decorate";
-    };
-  };
 in
 
 buildGo126Module rec {
@@ -52,7 +40,7 @@ buildGo126Module rec {
 
   npmDeps = fetchNpmDeps {
     inherit src;
-    hash = "sha256-PL16KEA5XaJjE5SvziMxdjlG2j7fQutfOoSvruxGJHQ=";
+    hash = "sha256-CtZoPtpENUfaVvs2zozBWsMYD8ZJFAXig7sYcNNLwzY=";
   };
 
   nativeBuildInputs = [
@@ -62,7 +50,6 @@ buildGo126Module rec {
 
   overrideModAttrs = _: {
     nativeBuildInputs = [
-      decorate
       enumer
       go_1_26
       gokrazy
@@ -106,7 +93,6 @@ buildGo126Module rec {
     [ "-skip=^${lib.concatStringsSep "$|^" skippedTests}$" ];
 
   passthru = {
-    inherit decorate;
     tests = {
       inherit (nixosTests) evcc;
     };
diff --git a/pkgs/by-name/he/hello/package.nix b/pkgs/by-name/he/hello/package.nix
index e0b688917e46..3a9966200bf7 100644
--- a/pkgs/by-name/he/hello/package.nix
+++ b/pkgs/by-name/he/hello/package.nix
@@ -7,6 +7,7 @@
   testers,
   versionCheckHook,
   hello,
+  gettext,
   gnulib,
 }:
 
@@ -30,6 +31,10 @@ stdenv.mkDerivation (finalAttrs: {
     NIX_LDFLAGS = "-liconv";
   };
 
+  buildInputs = lib.optionals stdenv.hostPlatform.isFreeBSD [
+    gettext
+  ];
+
   doCheck = true;
 
   doInstallCheck = true;
diff --git a/pkgs/by-name/ht/httptoolkit-server/package.nix b/pkgs/by-name/ht/httptoolkit-server/package.nix
index b1960919d465..9aa19b960d09 100644
--- a/pkgs/by-name/ht/httptoolkit-server/package.nix
+++ b/pkgs/by-name/ht/httptoolkit-server/package.nix
@@ -1,30 +1,33 @@
 {
   lib,
-  nodejs_22,
+
   buildNpmPackage,
   fetchFromGitHub,
   writeShellScriptBin,
-  nss,
+
   cmake,
+  nodejs_24,
+  nss,
   pkg-config,
-  openssl,
+
   libdatachannel,
+  openssl,
   plog,
 }:
 
 let
-  nodejs = nodejs_22;
+  nodejs = nodejs_24;
   buildNpmPackage' = buildNpmPackage.override { inherit nodejs; };
 
   # update together with httptoolkit
   # nixpkgs-update: no auto update
-  version = "1.24.2";
+  version = "1.26.1";
 
   src = fetchFromGitHub {
     owner = "httptoolkit";
     repo = "httptoolkit-server";
     tag = "v${version}";
-    hash = "sha256-tcUQe4YIUpQ9I5nq66K7LO84mLFo8YAdHY/c2HROSpk=";
+    hash = "sha256-pCEz5bgpzEjGeBoOp3fb/WBW+loCzjvCckJTEwK0o7U=";
   };
 
   overridesNodeModules = buildNpmPackage' {
@@ -32,7 +35,7 @@ let
     inherit version src;
     sourceRoot = "${src.name}/overrides/js";
 
-    npmDepsHash = "sha256-8cNGJdT8ndXa72ETttU2PjA8nfn+MTWesVVlA8GA1qQ=";
+    npmDepsHash = "sha256-B/W6kD6x10bfsuehRb9oObi+Gf3Hovm0jMNLcbuigeo=";
 
     dontBuild = true;
 
@@ -65,8 +68,8 @@ let
     ];
 
     buildInputs = [
-      openssl
       libdatachannel
+      openssl
       plog
     ];
 
@@ -79,14 +82,14 @@ let
       # don't use static libs and don't use FetchContent
       # don't try to link plog (it's headers-only)
       substituteInPlace CMakeLists.txt \
-          --replace-fail 'OPENSSL_USE_STATIC_LIBS TRUE' 'OPENSSL_USE_STATIC_LIBS FALSE' \
-          --replace-fail 'if(NOT libdatachannel)' 'if(false)' \
-          --replace-fail 'datachannel-static' 'datachannel' \
-          --replace-fail 'plog::plog' ""
+        --replace-fail 'OPENSSL_USE_STATIC_LIBS TRUE' 'OPENSSL_USE_STATIC_LIBS FALSE' \
+        --replace-fail 'if(NOT libdatachannel)' 'if(false)' \
+        --replace-fail 'datachannel-static' 'datachannel' \
+        --replace-fail 'plog::plog' ""
 
       # don't fetch node headers
       substituteInPlace node_modules/cmake-js/lib/dist.js \
-          --replace-fail '!this.downloaded' 'false'
+        --replace-fail '!this.downloaded' 'false'
     '';
 
     installPhase = ''
@@ -102,7 +105,7 @@ buildNpmPackage' {
 
   patches = [ ./only-build-for-one-platform.patch ];
 
-  npmDepsHash = "sha256-vhTe7EccEX57h7LDtNaaLaNR8xHSOlbnLtGrs7qT7pY=";
+  npmDepsHash = "sha256-OO1QI2KNbZo/2Bl6xC6oORVfDtBqjr2tuQmk6s70znM=";
 
   npmFlags = [ "--ignore-scripts" ];
 
@@ -117,8 +120,8 @@ buildNpmPackage' {
   postConfigure = ''
     # make sure `oclif-dev' doesn't fetch `node` binary to bundle with the app
     substituteInPlace node_modules/@oclif/dev-cli/lib/tarballs/node.js --replace-fail \
-        'async function fetchNodeBinary({ nodeVersion, output, platform, arch, tmp }) {' \
-        'async function fetchNodeBinary({ nodeVersion, output, platform, arch, tmp }) { return;'
+      'async function fetchNodeBinary({ nodeVersion, output, platform, arch, tmp }) {' \
+      'async function fetchNodeBinary({ nodeVersion, output, platform, arch, tmp }) { return;'
 
     # manually place our prebuilt `node-datachannel` binary into its place, since we used '--ignore-scripts'
     ln -s ${nodeDatachannel}/build node_modules/node-datachannel/build
@@ -152,12 +155,12 @@ buildNpmPackage' {
 
     # disable updating functionality
     substituteInPlace $out/share/httptoolkit-server/node_modules/@oclif/plugin-update/lib/commands/update.js \
-        --replace-fail "await this.skipUpdate()" "'cannot update nix based package'"
+      --replace-fail "await this.skipUpdate()" "'cannot update nix based package'"
 
     # the app determines if it's in production by checking if HTTPTOOLKIT_SERVER_BINPATH is set to anything
     makeWrapper $out/share/httptoolkit-server/bin/run $out/bin/httptoolkit-server \
-        --set HTTPTOOLKIT_SERVER_BINPATH dummy \
-        --prefix PATH : ${lib.makeBinPath [ nss.tools ]}
+      --set HTTPTOOLKIT_SERVER_BINPATH dummy \
+      --prefix PATH : ${lib.makeBinPath [ nss.tools ]}
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/ht/httptoolkit/fix-paths.patch b/pkgs/by-name/ht/httptoolkit/fix-paths.patch
new file mode 100644
index 000000000000..7daa244be10e
--- /dev/null
+++ b/pkgs/by-name/ht/httptoolkit/fix-paths.patch
@@ -0,0 +1,60 @@
+diff --git a/httptoolkit-ctl b/httptoolkit-ctl
+index 0878247..d299b71 100644
+--- a/httptoolkit-ctl
++++ b/httptoolkit-ctl
+@@ -1,10 +1,5 @@
+ #!/bin/sh
+ SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+-APP_DIR="$(dirname "$SCRIPT_DIR")"
+ export HTK_DESKTOP_RESOURCES="$SCRIPT_DIR"
+-if [ "$(uname)" = "Darwin" ]; then
+-    export HTK_DESKTOP_EXE="$APP_DIR/MacOS/HTTP Toolkit"
+-else
+-    export HTK_DESKTOP_EXE="$APP_DIR/httptoolkit"
+-fi
++export HTK_DESKTOP_EXE="@out@/bin/httptoolkit"
+ exec "$SCRIPT_DIR/httptoolkit-server/bin/httptoolkit-server" ctl "$@"
+diff --git a/httptoolkit-mcp b/httptoolkit-mcp
+index c27b25a..c7b3f07 100644
+--- a/httptoolkit-mcp
++++ b/httptoolkit-mcp
+@@ -1,10 +1,5 @@
+ #!/bin/sh
+ SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+-APP_DIR="$(dirname "$SCRIPT_DIR")"
+ export HTK_DESKTOP_RESOURCES="$SCRIPT_DIR"
+-if [ "$(uname)" = "Darwin" ]; then
+-    export HTK_DESKTOP_EXE="$APP_DIR/MacOS/HTTP Toolkit"
+-else
+-    export HTK_DESKTOP_EXE="$APP_DIR/httptoolkit"
+-fi
++export HTK_DESKTOP_EXE="@out@/bin/httptoolkit"
+ exec "$SCRIPT_DIR/httptoolkit-server/bin/httptoolkit-server" mcp "$@"
+diff --git a/package.json b/package.json
+index e6a9ef4..f8d7ec1 100644
+--- a/package.json
++++ b/package.json
+@@ -58,8 +58,8 @@
+     ],
+     "extraResources": [
+       "httptoolkit-server/**/*",
+-      "httptoolkit-ctl{,.*}",
+-      "httptoolkit-mcp{,.*}"
++      "httptoolkit-ctl",
++      "httptoolkit-mcp"
+     ],
+     "artifactName": "HttpToolkit-${version}-${arch}.${ext}",
+     "mac": {
+diff --git a/src/index.ts b/src/index.ts
+index 8a63c58..0511575 100644
+--- a/src/index.ts
++++ b/src/index.ts
+@@ -392,7 +392,7 @@ if (!amMainInstance) {
+             ...process.env,
+ 
+             HTK_SERVER_TOKEN: AUTH_TOKEN,
+-            HTK_DESKTOP_EXE: app.getPath('exe'),
++            HTK_DESKTOP_EXE: '@out@/bin/httptoolkit',
+             HTK_DESKTOP_RESOURCES: RESOURCES_PATH,
+             NODE_SKIP_PLATFORM_CHECK: '1',
+             OPENSSL_CONF: undefined, // Not relevant to us, and if set this can crash Node.js
diff --git a/pkgs/by-name/ht/httptoolkit/package.nix b/pkgs/by-name/ht/httptoolkit/package.nix
index 0c759847c9cb..8194b6a66a7d 100644
--- a/pkgs/by-name/ht/httptoolkit/package.nix
+++ b/pkgs/by-name/ht/httptoolkit/package.nix
@@ -1,89 +1,97 @@
 {
   lib,
   stdenv,
+
   buildNpmPackage,
   fetchFromGitHub,
-  makeWrapper,
   makeDesktopItem,
+
   copyDesktopItems,
-  electron_39,
+  makeWrapper,
+  xcbuild,
+
+  electron_41,
   httptoolkit-server,
 }:
 
 let
-  electron = electron_39;
+  electron = electron_41;
 in
 buildNpmPackage rec {
   pname = "httptoolkit";
 
   # update together with httptoolkit-server
   # nixpkgs-update: no auto update
-  version = "1.24.4";
+  version = "1.26.0";
 
   src = fetchFromGitHub {
     owner = "httptoolkit";
     repo = "httptoolkit-desktop";
     tag = "v${version}";
-    hash = "sha256-b1u+DFhxU/ED4GgMHFaF51zNfC+0vIg6ujyA8jIy8AQ=";
+    hash = "sha256-WEl0DGYdq1qa5zNEVO6L8TW6lgNTI0NdL0YXeR3Z0BI=";
   };
 
-  npmDepsHash = "sha256-FX8sClJL66zvWEaaw0lmoat7cM396RA8Rq9NgRVh0Vw=";
+  patches = [
+    ./fix-paths.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace httptoolkit-{mcp,ctl} src/index.ts \
+      --replace-fail "@out@" "$out"
+  '';
+
+  npmDepsHash = "sha256-fGVxHhJU/1ZsRyX3AnP6jM/jkY0PZHKDA1tb2z06lLs=";
 
   makeCacheWritable = true;
 
-  env = {
-    ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
-    # disable code signing on Darwin
-    CSC_IDENTITY_AUTO_DISCOVERY = "false";
-  };
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
   nativeBuildInputs = [
     makeWrapper
   ]
-  ++ lib.optionals stdenv.hostPlatform.isLinux [ copyDesktopItems ];
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ copyDesktopItems ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ xcbuild ];
 
   npmBuildScript = "build:src";
 
   postBuild = ''
-    substituteInPlace package.json --replace-fail \
-        '"forceCodeSigning": true' \
-        '"forceCodeSigning": false'
-
     cp -rL ${electron.dist} electron-dist
     chmod -R u+w electron-dist
 
     npm exec electron-builder -- \
-        --dir \
-        -c.electronDist=electron-dist \
-        -c.electronVersion=${electron.version}
+      --dir \
+      -c.electronDist=electron-dist \
+      -c.electronVersion=${electron.version} \
+      -c.mac.forceCodeSigning=false \
+      -c.mac.identity=null
+    # ^ this disables codesigning on Darwin
   '';
 
   installPhase = ''
     runHook preInstall
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
+    mkdir -p $out/share/httptoolkit
+    cp -r dist/*-unpacked/{locales,resources{,.pak}} $out/share/httptoolkit
 
-    ${lib.optionalString stdenv.hostPlatform.isLinux ''
-      mkdir -p $out/share/httptoolkit
-      cp -r dist/*-unpacked/{locales,resources{,.pak}} $out/share/httptoolkit
+    ln -s ${httptoolkit-server} $out/share/httptoolkit/resources/httptoolkit-server
 
-      ln -s ${httptoolkit-server} $out/share/httptoolkit/resources/httptoolkit-server
+    install -Dm644 src/icons/icon.svg $out/share/icons/hicolor/scalable/apps/httptoolkit.svg
 
-      install -Dm644 src/icons/icon.svg $out/share/icons/hicolor/scalable/apps/httptoolkit.svg
+    makeWrapper ${lib.getExe electron} $out/bin/httptoolkit \
+      --add-flags $out/share/httptoolkit/resources/app.asar \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
+      --inherit-argv0
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    mkdir -p $out/Applications
+    cp -r dist/mac*/"HTTP Toolkit.app" $out/Applications
 
-      makeWrapper ${lib.getExe electron} $out/bin/httptoolkit \
-          --add-flags $out/share/httptoolkit/resources/app.asar \
-          --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
-          --inherit-argv0
-    ''}
-
-    ${lib.optionalString stdenv.hostPlatform.isDarwin ''
-      mkdir -p $out/Applications
-      cp -r dist/mac*/"HTTP Toolkit.app" $out/Applications
-
-      ln -s ${httptoolkit-server} "$out/Applications/HTTP Toolkit.app/Contents/Resources/httptoolkit-server"
-
-      makeWrapper "$out/Applications/HTTP Toolkit.app/Contents/MacOS/HTTP Toolkit" $out/bin/httptoolkit
-    ''}
+    ln -s ${httptoolkit-server} "$out/Applications/HTTP Toolkit.app/Contents/Resources/httptoolkit-server"
 
+    makeWrapper "$out/Applications/HTTP Toolkit.app/Contents/MacOS/HTTP Toolkit" $out/bin/httptoolkit
+  ''
+  + ''
     runHook postInstall
   '';
 
diff --git a/pkgs/by-name/ig/igraph/package.nix b/pkgs/by-name/ig/igraph/package.nix
index 046952aee7c0..9c9dfffaaa7d 100644
--- a/pkgs/by-name/ig/igraph/package.nix
+++ b/pkgs/by-name/ig/igraph/package.nix
@@ -7,12 +7,13 @@
   blas,
   cmake,
   flex,
-  fop,
   glpk,
   gmp,
   lapack,
   libxml2,
   libxslt,
+  docbook_xml_dtd_43,
+  docbook_xsl,
   llvmPackages,
   pkg-config,
   plfit,
@@ -48,9 +49,10 @@ stdenv.mkDerivation (finalAttrs: {
     bison
     cmake
     flex
-    fop
     libxml2
     libxslt
+    docbook_xml_dtd_43
+    docbook_xsl
     pkg-config
     python3
     sourceHighlight
@@ -85,6 +87,11 @@ stdenv.mkDerivation (finalAttrs: {
     "-DBUILD_SHARED_LIBS=ON"
   ];
 
+  buildFlags = [
+    "all"
+    "html"
+  ];
+
   doCheck = true;
 
   postInstall = ''
diff --git a/pkgs/by-name/ko/koodo-reader/bump-abi-compat.patch b/pkgs/by-name/ko/koodo-reader/bump-abi-compat.patch
index c9e2ba143fd4..f1e33b59aafb 100644
--- a/pkgs/by-name/ko/koodo-reader/bump-abi-compat.patch
+++ b/pkgs/by-name/ko/koodo-reader/bump-abi-compat.patch
@@ -1,30 +1,30 @@
 diff --git a/package.json b/package.json
-index 3a001b5..c6ba849 100644
+index 4441e8b..269a8ed 100644
 --- a/package.json
 +++ b/package.json
 @@ -14,6 +14,8 @@
    "repository": "https://github.com/koodo-reader/koodo-reader",
    "private": false,
    "resolutions": {
-+    "nan": "2.24.0",
-+    "node-abi": "3.85.0",
-     "//": "See https://github.com/facebook/create-react-app/issues/11773",
-     "react-error-overlay": "6.0.9"
++    "nan": "2.27.0",
++    "node-abi": "3.92.0",
+     "@types/react": "^18.3.1",
+     "node-gyp": "^10.0.0"
    },
 @@ -22,7 +24,7 @@
      "adm-zip": "^0.5.2",
      "axios": "^0.19.2",
      "basic-ftp": "^5.0.5",
 -    "better-sqlite3": "^11.6.0",
-+    "better-sqlite3": "^12.4.5",
++    "better-sqlite3": "^12.10.0",
      "buffer": "^6.0.3",
      "chardet": "^2.0.0",
-     "copy-text-to-clipboard": "^2.2.0",
+     "color-thief-browser": "^2.0.2",
 diff --git a/yarn.lock b/yarn.lock
-index 83cf080..0dda6d2 100644
+index 6ced710..42e4e4f 100644
 --- a/yarn.lock
 +++ b/yarn.lock
-@@ -5358,10 +5358,10 @@ bcrypt-pbkdf@^1.0.0, bcrypt-pbkdf@^1.0.2:
+@@ -5407,10 +5407,10 @@ bcrypt-pbkdf@^1.0.0, bcrypt-pbkdf@^1.0.2:
    dependencies:
      tweetnacl "^0.14.3"
  
@@ -32,14 +32,14 @@ index 83cf080..0dda6d2 100644
 -  version "11.6.0"
 -  resolved "https://registry.yarnpkg.com/better-sqlite3/-/better-sqlite3-11.6.0.tgz#e50736956e6fe1c30dc94f1bc94a9c15d63b7b6b"
 -  integrity sha512-2J6k/eVxcFYY2SsTxsXrj6XylzHWPxveCn4fKPKZFv/Vqn/Cd7lOuX4d7rGQXT5zL+97MkNL3nSbCrIoe3LkgA==
-+better-sqlite3@^12.4.5:
-+  version "12.5.0"
-+  resolved "https://registry.yarnpkg.com/better-sqlite3/-/better-sqlite3-12.5.0.tgz#c570873d9635b5d56baa52f7e72634c2c589f35f"
-+  integrity sha512-WwCZ/5Diz7rsF29o27o0Gcc1Du+l7Zsv7SYtVPG0X3G/uUI1LqdxrQI7c9Hs2FWpqXXERjW9hp6g3/tH7DlVKg==
++better-sqlite3@^12.10.0:
++  version "12.10.0"
++  resolved "https://registry.yarnpkg.com/better-sqlite3/-/better-sqlite3-12.10.0.tgz#bde622d14a18008583a53bc53501ae98f1a12221"
++  integrity sha512-CyzaZRQKyHkB2ZInfTTl2nvT33EbDpjkLEbE8/Zck3Ll6O0qqvuGdrJ45HgtH+HykRg88ITY3AdreBGN70aBSQ==
    dependencies:
      bindings "^1.5.0"
      prebuild-install "^7.1.1"
-@@ -10853,10 +10853,10 @@ mz@^2.7.0:
+@@ -11041,10 +11041,10 @@ mz@^2.7.0:
      object-assign "^4.0.1"
      thenify-all "^1.0.0"
  
@@ -47,18 +47,25 @@ index 83cf080..0dda6d2 100644
 -  version "2.22.0"
 -  resolved "https://registry.yarnpkg.com/nan/-/nan-2.22.0.tgz#31bc433fc33213c97bad36404bb68063de604de3"
 -  integrity sha512-nbajikzWTMwsW+eSsNm3QwlOs7het9gGJU5dDZzRTQGk03vyBOauxgI4VakDzE0PtsGTmXPsXTbbjVhRwR5mpw==
-+nan@2.24.0, nan@^2.19.0, nan@^2.20.0:
-+  version "2.24.0"
-+  resolved "https://registry.yarnpkg.com/nan/-/nan-2.24.0.tgz#a8919b36e692aa5b260831910e4f81419fc0a283"
-+  integrity sha512-Vpf9qnVW1RaDkoNKFUvfxqAbtI8ncb8OJlqZ9wwpXzWPEsvsB1nvdUi6oYrHIkQ1Y/tMDnr1h4nczS0VB9Xykg==
++nan@2.27.0, nan@^2.19.0, nan@^2.20.0:
++  version "2.27.0"
++  resolved "https://registry.yarnpkg.com/nan/-/nan-2.27.0.tgz#804e389f4c0e39b729a17eca85c80ebc4355c4c4"
++  integrity sha512-hC+0LidcL3XE4rp1C4H54KujgXKzbfyTngZTwBByQxsOxCEKZT0MPQ4hOKUH2jU1OYstqdDH4onyHPDzcV0XdQ==
  
  nanoid@^3.3.6:
    version "3.3.6"
-@@ -10906,17 +10906,10 @@ no-case@^3.0.4:
+@@ -11094,24 +11094,10 @@ no-case@^3.0.4:
      lower-case "^2.0.2"
      tslib "^2.0.3"
  
--node-abi@^3.0.0, node-abi@^3.3.0:
+-node-abi@^3.0.0:
+-  version "3.85.0"
+-  resolved "https://registry.yarnpkg.com/node-abi/-/node-abi-3.85.0.tgz#b115d575e52b2495ef08372b058e13d202875a7d"
+-  integrity sha512-zsFhmbkAzwhTft6nd3VxcG0cvJsT70rL+BIGHWVq5fi6MwGrHwzqKaxXE+Hl2GmnGItnDKPPkO5/LQqjVkIdFg==
+-  dependencies:
+-    semver "^7.3.5"
+-
+-node-abi@^3.3.0:
 -  version "3.71.0"
 -  resolved "https://registry.yarnpkg.com/node-abi/-/node-abi-3.71.0.tgz#52d84bbcd8575efb71468fbaa1f9a49b2c242038"
 -  integrity sha512-SZ40vRiy/+wRTf21hxkkEjPJZpARzUMVcJoQse2EF8qkUWbbO2z7vd5oA/H6bVH6SZQ5STGcu0KRDS7biNRfxw==
@@ -69,10 +76,10 @@ index 83cf080..0dda6d2 100644
 -  version "3.74.0"
 -  resolved "https://registry.yarnpkg.com/node-abi/-/node-abi-3.74.0.tgz#5bfb4424264eaeb91432d2adb9da23c63a301ed0"
 -  integrity sha512-c5XK0MjkGBrQPGYG24GBADZud0NCbznxNx0ZkS+ebUTrmV1qTDxPxSL8zEAPURXSbLRWVexxmP4986BziahL5w==
-+node-abi@3.85.0, node-abi@^3.0.0, node-abi@^3.3.0, node-abi@^3.45.0:
-+  version "3.85.0"
-+  resolved "https://registry.yarnpkg.com/node-abi/-/node-abi-3.85.0.tgz#b115d575e52b2495ef08372b058e13d202875a7d"
-+  integrity sha512-zsFhmbkAzwhTft6nd3VxcG0cvJsT70rL+BIGHWVq5fi6MwGrHwzqKaxXE+Hl2GmnGItnDKPPkO5/LQqjVkIdFg==
++node-abi@3.92.0, node-abi@^3.0.0, node-abi@^3.3.0, node-abi@^3.45.0:
++  version "3.92.0"
++  resolved "https://registry.yarnpkg.com/node-abi/-/node-abi-3.92.0.tgz#18e2214677499b8dda81ffcd095afc763d5a9802"
++  integrity sha512-KdHvFWZjEKDf0cakgFjebl371GPsISX2oZHcuyKqM7DtogIsHrqKeLTo8wBHxaXRAQlY2PsPlZmfo+9ZCxEREQ==
    dependencies:
      semver "^7.3.5"
  
diff --git a/pkgs/by-name/ko/koodo-reader/package.nix b/pkgs/by-name/ko/koodo-reader/package.nix
index 30ec2833b282..29d3aecc989a 100644
--- a/pkgs/by-name/ko/koodo-reader/package.nix
+++ b/pkgs/by-name/ko/koodo-reader/package.nix
@@ -14,23 +14,24 @@
   wrapGAppsHook3,
   xcbuild,
 
-  electron_39,
+  electron_41,
 
   nix-update-script,
 }:
 
 let
-  electron = electron_39; # don't use latest electron to avoid going over the supported abi numbers
+  # don't use latest electron to avoid going over the supported abi numbers
+  electron = electron_41;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "koodo-reader";
-  version = "2.2.4";
+  version = "2.3.4";
 
   src = fetchFromGitHub {
     owner = "koodo-reader";
     repo = "koodo-reader";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KUcI+0+ICMdwAF30CLM3QdS+X8UnYiHhcYkvEQ6WgS8=";
+    hash = "sha256-GWhofLT5p8Li0aErJlUQ6E5xSkK4CnnM7UwGDJQBq9I=";
   };
 
   patches = [
@@ -39,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   yarnOfflineCache = fetchYarnDeps {
     inherit (finalAttrs) src patches;
-    hash = "sha256-XyFcY0XeNdNzLuqfv9Z2/41875Nl5OrAT/QVyI/+OQc=";
+    hash = "sha256-HRWp/lXXPSw2OdvBaEX0W3hnxL9NvIjIk62Dj+rKm1g=";
   };
 
   nativeBuildInputs = [
@@ -70,8 +71,6 @@ stdenv.mkDerivation (finalAttrs: {
     npm rebuild --verbose cpu-features
 
     export npm_config_nodedir=${electron.headers}
-    npm run postinstall
-
     # Explicitly set identity to null to avoid signing on darwin
     yarn --offline run electron-builder --dir \
       -c.mac.identity=null \
@@ -125,7 +124,6 @@ stdenv.mkDerivation (finalAttrs: {
         "image/vnd.djvu"
         "application/x-mobipocket-ebook"
         "application/vnd.amazon.ebook"
-        "application/vnd.amazon.ebook"
         "application/x-cbz"
         "application/x-cbr"
         "application/x-cbt"
diff --git a/pkgs/by-name/li/libcss/fix-calloc-transposed-args-computed.patch b/pkgs/by-name/li/libcss/fix-calloc-transposed-args-computed.patch
new file mode 100644
index 000000000000..1bec9eeffaf4
--- /dev/null
+++ b/pkgs/by-name/li/libcss/fix-calloc-transposed-args-computed.patch
@@ -0,0 +1,11 @@
+--- a/src/select/computed.c
++++ b/src/select/computed.c
+@@ -73,7 +73,7 @@
+ 	if (result == NULL)
+ 		return CSS_BADPARM;
+ 
+-	s = calloc(sizeof(css_computed_style), 1);
++	s = calloc(1, sizeof(css_computed_style));
+ 	if (s == NULL)
+ 		return CSS_NOMEM;
+ 
diff --git a/pkgs/by-name/li/libcss/fix-calloc-transposed-args-select.patch b/pkgs/by-name/li/libcss/fix-calloc-transposed-args-select.patch
new file mode 100644
index 000000000000..8a23e7e813bc
--- /dev/null
+++ b/pkgs/by-name/li/libcss/fix-calloc-transposed-args-select.patch
@@ -0,0 +1,29 @@
+--- a/src/select/select.c
++++ b/src/select/select.c
+@@ -138,7 +138,7 @@
+ {
+ 	struct css_node_data *nd;
+ 
+-	nd = calloc(sizeof(struct css_node_data), 1);
++	nd = calloc(1, sizeof(struct css_node_data));
+ 	if (nd == NULL) {
+ 		return CSS_NOMEM;
+ 	}
+@@ -234,7 +234,7 @@
+ 	if (result == NULL)
+ 		return CSS_BADPARM;
+ 
+-	c = calloc(sizeof(css_select_ctx), 1);
++	c = calloc(1, sizeof(css_select_ctx));
+ 	if (c == NULL)
+ 		return CSS_NOMEM;
+ 
+@@ -613,7 +613,7 @@
+ 	*node_bloom = NULL;
+ 
+ 	/* Create the node's bloom */
+-	bloom = calloc(sizeof(css_bloom), CSS_BLOOM_SIZE);
++	bloom = calloc(CSS_BLOOM_SIZE, sizeof(css_bloom));
+ 	if (bloom == NULL) {
+ 		return CSS_NOMEM;
+ 	}
diff --git a/pkgs/by-name/li/libcss/package.nix b/pkgs/by-name/li/libcss/package.nix
index 54c0ce25bb31..9e749639bcfb 100644
--- a/pkgs/by-name/li/libcss/package.nix
+++ b/pkgs/by-name/li/libcss/package.nix
@@ -22,18 +22,10 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [
     # select: computed: Squash -Wcalloc-transposed-args (gcc-14)
     # remove on next release
-    (fetchpatch {
-      name = "fix-calloc-transposed-args-computed.patch";
-      url = "https://source.netsurf-browser.org/libcss.git/patch/?id=0541e18b442d2f46abc0f0b09e0db950e1b657e5";
-      hash = "sha256-6nrT1S1E+jU6UDr3BZo9GH8jcSiIwTNLnmI1rthhhws=";
-    })
+    ./fix-calloc-transposed-args-computed.patch
     # select: select: Squash -Wcalloc-transposed-args (gcc-14)
     # remove on next release
-    (fetchpatch {
-      name = "fix-calloc-transposed-args-select.patch";
-      url = "https://source.netsurf-browser.org/libcss.git/patch/?id=8619d09102d6cc34d63fe87195c548852fc93bf4";
-      hash = "sha256-Clkhw/n/+NQR/T8Gi+2Lc1Neq5dWsNKM8RqieYuTnzQ=";
-    })
+    ./fix-calloc-transposed-args-select.patch
   ];
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/by-name/li/libdom/fix-calloc-transposed-args.patch b/pkgs/by-name/li/libdom/fix-calloc-transposed-args.patch
new file mode 100644
index 000000000000..17523accefb8
--- /dev/null
+++ b/pkgs/by-name/li/libdom/fix-calloc-transposed-args.patch
@@ -0,0 +1,40 @@
+--- a/bindings/xml/expat_xmlparser.c
++++ b/bindings/xml/expat_xmlparser.c
+@@ -484,7 +484,7 @@
+ 
+ 	UNUSED(int_enc);
+ 
+-	parser = calloc(sizeof(*parser), 1);
++	parser = calloc(1, sizeof(*parser));
+ 	if (parser == NULL) {
+ 		msg(DOM_MSG_CRITICAL, mctx, "No memory for parser");
+ 		return NULL;
+--- a/src/core/node.c
++++ b/src/core/node.c
+@@ -2379,7 +2379,7 @@
+ 	if (t == NULL) {
+ 		/* Create the event target list */
+ 		size = 64;
+-		t = calloc(sizeof(*t), size);
++		t = calloc(size, sizeof(*t));
+ 		if (t == NULL) {
+ 			return DOM_NO_MEM_ERR;
+ 		}
+--- a/src/html/html_document.c
++++ b/src/html/html_document.c
+@@ -134,13 +134,12 @@
+ 	doc->cookie = NULL;
+ 	doc->body = NULL;
+ 
+-	doc->memoised = calloc(sizeof(dom_string *), hds_COUNT);
++	doc->memoised = calloc(hds_COUNT, sizeof(dom_string *));
+ 	if (doc->memoised == NULL) {
+ 		error = DOM_NO_MEM_ERR;
+ 		goto out;
+ 	}
+-	doc->elements = calloc(sizeof(dom_string *),
+-			DOM_HTML_ELEMENT_TYPE__COUNT);
++	doc->elements = calloc(DOM_HTML_ELEMENT_TYPE__COUNT, sizeof(dom_string *));
+ 	if (doc->elements == NULL) {
+ 		error = DOM_NO_MEM_ERR;
+ 		goto out;
diff --git a/pkgs/by-name/li/libdom/package.nix b/pkgs/by-name/li/libdom/package.nix
index 7022a9c21add..98a96ff6d179 100644
--- a/pkgs/by-name/li/libdom/package.nix
+++ b/pkgs/by-name/li/libdom/package.nix
@@ -23,11 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [
     # fixes libdom build on gcc 14 due to calloc-transposed-args warning
     # remove on next release
-    (fetchpatch {
-      name = "fix-calloc-transposed-args.patch";
-      url = "https://source.netsurf-browser.org/libdom.git/patch/?id=2687282d56dfef19e26e9639a5c0cd81de957e22";
-      hash = "sha256-1uAdLM9foplCVu8IQlMMlXh6OWHs5eUgsKp+0ZqM9yM=";
-    })
+    ./fix-calloc-transposed-args.patch
   ];
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/by-name/li/libdwarf/package.nix b/pkgs/by-name/li/libdwarf/package.nix
index afc0c6c5c013..c94bc7d2ee8a 100644
--- a/pkgs/by-name/li/libdwarf/package.nix
+++ b/pkgs/by-name/li/libdwarf/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdwarf";
-  version = "2.2.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "davea42";
     repo = "libdwarf-code";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PJhhrNsYZNDKzLYJzF+eSJfEH1ehF/aeJrNjiEdFEas=";
+    hash = "sha256-azVCzQt9oA40YACa9PkdNt0D8vWRNHXXGoSFOYNJxgA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libsignal-ffi/package.nix b/pkgs/by-name/li/libsignal-ffi/package.nix
index 72db421bee7e..0cb074ba6fc0 100644
--- a/pkgs/by-name/li/libsignal-ffi/package.nix
+++ b/pkgs/by-name/li/libsignal-ffi/package.nix
@@ -13,14 +13,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pname = "libsignal-ffi";
   # must match the version used in mautrix-signal
   # see https://github.com/mautrix/signal/issues/401
-  version = "0.92.1";
+  version = "0.93.2";
 
   src = fetchFromGitHub {
     fetchSubmodules = true;
     owner = "signalapp";
     repo = "libsignal";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gAXLt0e2k5PA6PgFRQa22oGuNLM7TGkOKQnYtFhn8I8=";
+    hash = "sha256-U32vd5TzgA1LwlFgLUJU30gUeQoYnKI7kYnhy+d8eQk=";
   };
 
   postPatch =
@@ -46,7 +46,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     NIX_LDFLAGS = if stdenv.hostPlatform.isDarwin then "-lc++" else "-lstdc++";
   };
 
-  cargoHash = "sha256-TqYxkkzlbgrc7jkAubz3TsXhcU8Do5IFaLRqSPiZVR0=";
+  cargoHash = "sha256-5thq1MXL792u87fv6M5E1oi8gq6S8dnTsy3k26T7pgM=";
 
   cargoBuildFlags = [
     "-p"
diff --git a/pkgs/by-name/li/libsvgtiny/fix-calloc-transposed-args.patch b/pkgs/by-name/li/libsvgtiny/fix-calloc-transposed-args.patch
new file mode 100644
index 000000000000..64339b8ec790
--- /dev/null
+++ b/pkgs/by-name/li/libsvgtiny/fix-calloc-transposed-args.patch
@@ -0,0 +1,11 @@
+--- a/src/svgtiny.c
++++ b/src/svgtiny.c
+@@ -586,7 +586,7 @@
+ {
+ 	struct svgtiny_diagram *diagram;
+ 
+-	diagram = calloc(sizeof(*diagram), 1);
++	diagram = calloc(1, sizeof(*diagram));
+ 	if (!diagram)
+ 		return 0;
+ 
diff --git a/pkgs/by-name/li/libsvgtiny/package.nix b/pkgs/by-name/li/libsvgtiny/package.nix
index 04e84d0300a7..7bfd5f548eaf 100644
--- a/pkgs/by-name/li/libsvgtiny/package.nix
+++ b/pkgs/by-name/li/libsvgtiny/package.nix
@@ -24,11 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [
     # fixes libdom build on gcc 14 due to calloc-transposed-args warning
     # remove on next release
-    (fetchpatch {
-      name = "fix-calloc-transposed-args.patch";
-      url = "https://source.netsurf-browser.org/libsvgtiny.git/patch/?id=9d14633496ae504557c95d124b97a71147635f04";
-      hash = "sha256-IRWWjyFXd+lWci/bKR9uPDKbP3ttK6zNB6Cy5bv4huc=";
-    })
+    ./fix-calloc-transposed-args.patch
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/lu/lunar-client/package.nix b/pkgs/by-name/lu/lunar-client/package.nix
index eb5a631853a6..5f1e1757f80b 100644
--- a/pkgs/by-name/lu/lunar-client/package.nix
+++ b/pkgs/by-name/lu/lunar-client/package.nix
@@ -7,11 +7,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "lunarclient";
-  version = "3.6.10";
+  version = "3.6.11";
 
   src = fetchurl {
     url = "https://launcherupdates.lunarclientcdn.com/Lunar%20Client-${version}-ow.AppImage";
-    hash = "sha512-qdr6CcCtZa++KLzfmpA8ChdHXO3N+syn06pTXH7EQY0uI10ZI0w4os+hZ6SNoh0+YOcMY90gv4k4zpI9jWKPVg==";
+    hash = "sha512-WHjeAA+vS/gC8ZI2jUWpiJasvT+AgEWB14/ZnJGIOJPi4PUxtBNseM6HR8Aql8a8JGzobyZS9ISqYtFJEiYQ+A==";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/ma/mautrix-signal/package.nix b/pkgs/by-name/ma/mautrix-signal/package.nix
index 2c70b6cc1dee..c0c7e9978038 100644
--- a/pkgs/by-name/ma/mautrix-signal/package.nix
+++ b/pkgs/by-name/ma/mautrix-signal/package.nix
@@ -20,14 +20,14 @@ let
 in
 buildGoModule rec {
   pname = "mautrix-signal";
-  version = "26.04";
-  tag = "v0.2604.0";
+  version = "26.05";
+  tag = "v0.2605.0";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "signal";
     inherit tag;
-    hash = "sha256-DKJ8BiBu3lhBqeqjCsNNSwF+iSFd8QnJ4wDS7EGU/UM=";
+    hash = "sha256-IGDVfauU+zRbwEN6FdI9t5TjnKAm22NsuxiUiDPhK2Q=";
   };
 
   buildInputs =
@@ -46,7 +46,7 @@ buildGoModule rec {
     CGO_LDFLAGS = toString [ cppStdLib ];
   };
 
-  vendorHash = "sha256-rTDEB8OS0RbXNlKHrdtBPkti2PzjbuxaoAKa3uri5CM=";
+  vendorHash = "sha256-Njl4kwhx+vlqQI8CeA8gfanEKClvMefoM3Sy3UUYllc=";
 
   ldflags = [
     "-X"
diff --git a/pkgs/by-name/mu/mup/package.nix b/pkgs/by-name/mu/mup/package.nix
index 280e8d9ec1ed..b8a1ec2e0d88 100644
--- a/pkgs/by-name/mu/mup/package.nix
+++ b/pkgs/by-name/mu/mup/package.nix
@@ -60,6 +60,10 @@ stdenv.mkDerivation {
       --replace-fail /usr/share/doc $out/share/doc
   '';
 
+  env = {
+    NIX_CFLAGS_COMPILE = "-std=gnu17";
+  };
+
   enableParallelBuilding = false; # Undeclared dependencies + https://stackoverflow.com/a/19822767/1687334 for prolog.ps.
 
   meta = {
diff --git a/pkgs/by-name/nd/ndg/package.nix b/pkgs/by-name/nd/ndg/package.nix
new file mode 100644
index 000000000000..ef5c17e03fc1
--- /dev/null
+++ b/pkgs/by-name/nd/ndg/package.nix
@@ -0,0 +1,65 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  installShellFiles,
+  stdenv,
+  nix-update-script,
+  buildPackages,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "ndg";
+  version = "2.8.0";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "feel-co";
+    repo = "ndg";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-YIKEyzh0NFQlD0O92LQQNMoVCDwV8yw1Xz0Iu+4ZC5U=";
+  };
+
+  cargoHash = "sha256-r4lNSZuGFtNTOkIyd7skdEmA61lfbetI03tIUD+MO+Y=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  cargoBuildFlags = [
+    "-p"
+    "ndg"
+    "-p"
+    "xtask"
+  ];
+
+  checkFlags = [
+    "--skip"
+    "test_js_commonjs_syntax"
+  ];
+
+  postInstall =
+    lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) (
+      let
+        emulator = stdenv.hostPlatform.emulator buildPackages;
+      in
+      ''
+        ${emulator} $out/bin/xtask dist
+
+        installManPage dist/man/*
+        installShellCompletion --cmd ${finalAttrs.meta.mainProgram} dist/completions/*.{bash,fish,zsh}
+      ''
+    )
+    + ''
+      rm $out/bin/xtask
+    '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Not A Docs Generator";
+    homepage = "https://github.com/feel-co/ndg";
+    changelog = "https://github.com/feel-co/ndg/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.mpl20;
+    maintainers = [ lib.teams.feel-co ];
+    mainProgram = "ndg";
+  };
+})
diff --git a/pkgs/by-name/ny/nylon/package.nix b/pkgs/by-name/ny/nylon/package.nix
index e733c231fc40..3e953c083e74 100644
--- a/pkgs/by-name/ny/nylon/package.nix
+++ b/pkgs/by-name/ny/nylon/package.nix
@@ -29,6 +29,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ libevent ];
 
+  # K&R-style function pointer declarations break under gcc 15's C23 default.
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
+
   meta = {
     homepage = "http://monkey.org/~marius/nylon";
     description = "Proxy server, supporting SOCKS 4 and 5, as well as a mirror mode";
diff --git a/pkgs/by-name/os/os-agent/package.nix b/pkgs/by-name/os/os-agent/package.nix
index 435893c45e4c..a776018160ba 100644
--- a/pkgs/by-name/os/os-agent/package.nix
+++ b/pkgs/by-name/os/os-agent/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "os-agent";
-  version = "1.8.1";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "home-assistant";
     repo = "os-agent";
     tag = finalAttrs.version;
-    hash = "sha256-x0bVY476Gm5D1drRmyszdshrO0Vi/baDsG3ulysu0Kg=";
+    hash = "sha256-Bc/EXVjq0tTxCslKB9zszu10htq/xPgJ5zaiCZ9CHAw=";
   };
 
-  vendorHash = "sha256-9boWe/mvJ/C/I8B7b4hJgz2dEDgpKCNTE/8pVAsNTxg=";
+  vendorHash = "sha256-PXl/1CW6hQhGFWZDiRo4DNvnaN3CfEIz/fx0a+UVEpo=";
 
   ldFlags = [
     "-X main.version="
diff --git a/pkgs/by-name/pe/perfect_dark/package.nix b/pkgs/by-name/pe/perfect_dark/package.nix
index 950582344246..870db13c0fda 100644
--- a/pkgs/by-name/pe/perfect_dark/package.nix
+++ b/pkgs/by-name/pe/perfect_dark/package.nix
@@ -22,13 +22,13 @@ assert lib.assertOneOf "romID" romID roms;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "perfect_dark";
-  version = "0-unstable-2026-05-02";
+  version = "0-unstable-2026-05-21";
 
   src = fetchFromGitHub {
     owner = "fgsfdsfgs";
     repo = "perfect_dark";
-    rev = "45139a9293dc221de5795733137c76f5ee134261";
-    hash = "sha256-WTRh/Eij+8n2lQTCCNL3FSTXHUVslEfiupFl8FMPXuo=";
+    rev = "132e59d3ec1a17bbba5d5b1c991e9e1007cc271e";
+    hash = "sha256-9nC9DPzrovhIvq+EcgSSGtlBjBrWWP8T8D4ZHw8ANRQ=";
 
     postFetch = ''
       pushd $out
diff --git a/pkgs/by-name/pl/plezy/git-hashes.json b/pkgs/by-name/pl/plezy/git-hashes.json
index 1054b3331dcc..295d1be3f70e 100644
--- a/pkgs/by-name/pl/plezy/git-hashes.json
+++ b/pkgs/by-name/pl/plezy/git-hashes.json
@@ -3,7 +3,7 @@
   "auto_updater_macos": "sha256-787cMkeT2BlfwVcy4y46XkWioNqLKJgQ/CCxQvERa+A=",
   "auto_updater_platform_interface": "sha256-787cMkeT2BlfwVcy4y46XkWioNqLKJgQ/CCxQvERa+A=",
   "auto_updater_windows": "sha256-787cMkeT2BlfwVcy4y46XkWioNqLKJgQ/CCxQvERa+A=",
-  "background_downloader": "sha256-U41AQVdXceT5ZBgvBR90h3JAAU2BLpguglcVBTrTww4=",
+  "background_downloader": "sha256-hW3fD7X1l6dPITPchE9lzpFwsIZ597JsgsBeAyQPjI0=",
   "material_symbols_icons": "sha256-XRB6AZ4Q33sQKVZFA8lgdXCW/bx55h/RpmuItmFYVJM=",
   "os_media_controls": "sha256-0Bghn1s28+xlcfSLyVA7B60atJkkdqcFKseSubPtzkQ=",
   "wakelock_plus": "sha256-89xs0sLNuoCqApFqwEY+SEk2DUqjHf8JsSd7dfxX3P0="
diff --git a/pkgs/by-name/pl/plezy/package.nix b/pkgs/by-name/pl/plezy/package.nix
index 7bd849f6fde2..d83783782b67 100644
--- a/pkgs/by-name/pl/plezy/package.nix
+++ b/pkgs/by-name/pl/plezy/package.nix
@@ -25,13 +25,13 @@
 
 let
   pname = "plezy";
-  version = "2.0.0";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "edde746";
     repo = "plezy";
     tag = version;
-    hash = "sha256-Pi5M74CI6J31Pzaf7wnUFFTpbOSwOTWdKUoYuXt8+Zs=";
+    hash = "sha256-l09xiSTyV8MNE9ZI69nM+DTpumQ0ZOaRjhLlq4rXX0w=";
   };
 
   simdutf = fetchurl {
@@ -139,7 +139,7 @@ let
 
     src = fetchurl {
       url = "https://github.com/edde746/plezy/releases/download/${version}/plezy-macos.dmg";
-      hash = "sha256-zkctxQIgpU9dGhv8SdVy2S4eFUQ7GgeaWzwSEvFrWWc=";
+      hash = "sha256-khmDHKsW8zs7ehIj86EgqortRKKDUoOfPsX7VpvnfNY=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/pl/plezy/pubspec.lock.json b/pkgs/by-name/pl/plezy/pubspec.lock.json
index fc3071b89a7a..6aeb83514798 100644
--- a/pkgs/by-name/pl/plezy/pubspec.lock.json
+++ b/pkgs/by-name/pl/plezy/pubspec.lock.json
@@ -108,8 +108,8 @@
       "dependency": "direct main",
       "description": {
         "path": ".",
-        "ref": "1f42690",
-        "resolved-ref": "1f426908b0d9e1083de35b3dd353c3434ad32ef2",
+        "ref": "4c965996210e408465e3c8b66e63ab4a659a62f9",
+        "resolved-ref": "4c965996210e408465e3c8b66e63ab4a659a62f9",
         "url": "https://github.com/edde746/background_downloader"
       },
       "source": "git",
@@ -629,6 +629,16 @@
       "source": "hosted",
       "version": "2.1.3"
     },
+    "globbing": {
+      "dependency": "transitive",
+      "description": {
+        "name": "globbing",
+        "sha256": "4f89cfaf6fa74c9c1740a96259da06bd45411ede56744e28017cc534a12b6e2d",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.0.0"
+    },
     "graphs": {
       "dependency": "transitive",
       "description": {
@@ -709,6 +719,16 @@
       "source": "hosted",
       "version": "0.1.0"
     },
+    "injector": {
+      "dependency": "transitive",
+      "description": {
+        "name": "injector",
+        "sha256": "ed389bed5b48a699d5b9561c985023d0d5cc88dd5ff2237aadcce5a5ab433e4e",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.0.0"
+    },
     "intl": {
       "dependency": "direct main",
       "description": {
@@ -1101,6 +1121,16 @@
       "source": "hosted",
       "version": "5.0.5"
     },
+    "properties": {
+      "dependency": "transitive",
+      "description": {
+        "name": "properties",
+        "sha256": "333f427dd4ed07bdbe8c75b9ff864a1e70b5d7a8426a2e8bdd457b65ae5ac598",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.1.1"
+    },
     "provider": {
       "dependency": "direct main",
       "description": {
@@ -1261,6 +1291,16 @@
       "source": "hosted",
       "version": "9.16.0"
     },
+    "sentry_dart_plugin": {
+      "dependency": "direct dev",
+      "description": {
+        "name": "sentry_dart_plugin",
+        "sha256": "2c5f263f8d5aea3cf387a7e03f77e355d35c71bd9a429474d633fbc085b86ceb",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.3.0"
+    },
     "sentry_flutter": {
       "dependency": "direct main",
       "description": {
@@ -1507,6 +1547,26 @@
       "source": "hosted",
       "version": "1.4.1"
     },
+    "string_similarity": {
+      "dependency": "direct main",
+      "description": {
+        "name": "string_similarity",
+        "sha256": "3ee1fc76e0c800aeb3dce197e28ed8541b622224d09b10c34a022803066a7c50",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.2.0"
+    },
+    "system_info2": {
+      "dependency": "transitive",
+      "description": {
+        "name": "system_info2",
+        "sha256": "b937736ecfa63c45b10dde1ceb6bb30e5c0c340e14c441df024150679d65ac43",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "4.1.0"
+    },
     "term_glyph": {
       "dependency": "transitive",
       "description": {
@@ -1799,7 +1859,7 @@
       "version": "1.1.0"
     },
     "xml": {
-      "dependency": "transitive",
+      "dependency": "direct main",
       "description": {
         "name": "xml",
         "sha256": "971043b3a0d3da28727e40ed3e0b5d18b742fa5a68665cca88e74b7876d5e025",
diff --git a/pkgs/by-name/pl/plezy/replace-sentry-fork.patch b/pkgs/by-name/pl/plezy/replace-sentry-fork.patch
index 7ea9482ccebf..36931c997186 100644
--- a/pkgs/by-name/pl/plezy/replace-sentry-fork.patch
+++ b/pkgs/by-name/pl/plezy/replace-sentry-fork.patch
@@ -3,7 +3,7 @@
 @@ -56,11 +56,7 @@
      git:
        url: https://github.com/edde746/background_downloader
-       ref: 1f42690
+       ref: 4c965996210e408465e3c8b66e63ab4a659a62f9
 -  sentry_flutter:
 -    git:
 -      url: https://github.com/edde746/sentry-dart
diff --git a/pkgs/by-name/pl/plezy/update.sh b/pkgs/by-name/pl/plezy/update.sh
index c7734d7b5353..4b9cb35c7572 100755
--- a/pkgs/by-name/pl/plezy/update.sh
+++ b/pkgs/by-name/pl/plezy/update.sh
@@ -35,7 +35,7 @@ patch -d "$workdir" -p1 < "$ROOT/replace-sentry-fork.patch"
 
 export PUB_CACHE="$workdir/.pub-cache"
 flutter --no-version-check config --no-analytics >/dev/null
-flutter --no-version-check pub --directory "$workdir" get
+(cd "$workdir" && flutter --no-version-check pub get)
 
 yq eval --output-format=json --prettyPrint "$workdir/pubspec.lock" > "$ROOT/pubspec.lock.json"
 
diff --git a/pkgs/by-name/po/poutine/package.nix b/pkgs/by-name/po/poutine/package.nix
index 001d068edc6d..c313188deb53 100644
--- a/pkgs/by-name/po/poutine/package.nix
+++ b/pkgs/by-name/po/poutine/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "poutine";
-  version = "1.1.4";
+  version = "1.1.5";
 
   src = fetchFromGitHub {
     owner = "boostsecurityio";
     repo = "poutine";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8lA9LK5KUblwh9wUDdsbtKQHOINlo6AZi8zkmmhnvwI=";
+    hash = "sha256-9Gyxwcm45301zmMJWYPwzMPdJwBNsDLXKkmuJHBWZt8=";
   };
 
   vendorHash = "sha256-Ktsk01YqBHVZDOu+Xp1p3sVDwqozl35iLYbVavpiWq0=";
diff --git a/pkgs/by-name/pr/prometheus-redis-exporter/package.nix b/pkgs/by-name/pr/prometheus-redis-exporter/package.nix
index c29d0cdc82c3..00f6faa48878 100644
--- a/pkgs/by-name/pr/prometheus-redis-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-redis-exporter/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "redis_exporter";
-  version = "1.83.0";
+  version = "1.84.0";
 
   src = fetchFromGitHub {
     owner = "oliver006";
     repo = "redis_exporter";
     rev = "v${version}";
-    sha256 = "sha256-3KT5GsUxHG2t7C7aATo8MpAP5az663dBH5vHesDuBpQ=";
+    sha256 = "sha256-0GxPPtZh7qJO1jQ5Q+ED8cJK0kbn/Q7DuXLihWd67gg=";
   };
 
-  vendorHash = "sha256-hISPhsMn2NFmbD7Dg6ervAg5/YfcjLcUneimf9AOxb4=";
+  vendorHash = "sha256-O2koMGh9/1UWtV5arH3S/7b6q33P4Yv+xgPthTtZsLg=";
 
   ldflags = [
     "-X main.BuildVersion=${version}"
diff --git a/pkgs/by-name/sp/spotiflac/package.nix b/pkgs/by-name/sp/spotiflac/package.nix
index 19d5de9a7c6b..ccaca6e06fcc 100644
--- a/pkgs/by-name/sp/spotiflac/package.nix
+++ b/pkgs/by-name/sp/spotiflac/package.nix
@@ -18,14 +18,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "spotiflac";
-  version = "7.1.6";
+  version = "7.1.7";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "afkarxyz";
     repo = "SpotiFLAC";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iQBJS2IsOzamC1plkd9BGbSajY9UpomaXMJRJgQ36t4=";
+    hash = "sha256-2bCKsgrJH8jfggluNdNqX+LdG8NLcsuhrJwkaRTXAOs=";
   };
 
   nativeBuildInputs = [
@@ -86,7 +86,7 @@ buildGoModule (finalAttrs: {
     runHook postInstall;
   '';
 
-  vendorHash = "sha256-ZUmQPOMkeF8YUow6gr4yyRnPJIbCnAltM50H5yo3MGs=";
+  vendorHash = "sha256-0H3U+i7SbbO7WkF9O8U8JoRxtroyEofzi2XrrWi6HWY=";
 
   desktopItems = [
     (makeDesktopItem {
diff --git a/pkgs/by-name/sp/spotify/darwin.nix b/pkgs/by-name/sp/spotify/darwin.nix
index 91906e1f72d6..e2c12556559e 100644
--- a/pkgs/by-name/sp/spotify/darwin.nix
+++ b/pkgs/by-name/sp/spotify/darwin.nix
@@ -11,7 +11,7 @@
 stdenv.mkDerivation {
   inherit pname;
 
-  version = "1.2.88.483";
+  version = "1.2.89.539";
 
   src =
     # WARNING: This Wayback Machine URL redirects to the closest timestamp.
@@ -20,13 +20,13 @@ stdenv.mkDerivation {
     # https://web.archive.org/web/*/https://download.scdn.co/Spotify.dmg
     if stdenv.hostPlatform.isAarch64 then
       (fetchurl {
-        url = "https://web.archive.org/web/20260501151114/https://download.scdn.co/SpotifyARM64.dmg";
-        hash = "sha256-rBoJ5PKge4pr90FqYwsG+6JqyKvc3sKyPXM7OXXEmz8=";
+        url = "https://web.archive.org/web/20260510001507/https://download.scdn.co/SpotifyARM64.dmg";
+        hash = "sha256-m7Wbcl1ewIa92n/eCTgF62EN63KJyWPRW2ZF71/8btk=";
       })
     else
       (fetchurl {
-        url = "https://web.archive.org/web/20260501151019/https://download.scdn.co/Spotify.dmg";
-        hash = "sha256-o/qDYnVhkrca2TBDoqxsKWq0QfDQyHdhU4llbmIGUBQ=";
+        url = "https://web.archive.org/web/20260510001458/https://download.scdn.co/Spotify.dmg";
+        hash = "sha256-BjZ0WT00QvLQvLBWnHzE/POf82cUxZUW4BIJsk2hAaw=";
       });
 
   nativeBuildInputs = [ undmg ];
diff --git a/pkgs/by-name/sp/spotify/linux.nix b/pkgs/by-name/sp/spotify/linux.nix
index 8fe795e4681c..fbb4336d19ea 100644
--- a/pkgs/by-name/sp/spotify/linux.nix
+++ b/pkgs/by-name/sp/spotify/linux.nix
@@ -123,7 +123,7 @@ stdenv.mkDerivation (finalAttrs: {
   # If an update breaks things, one of those might have valuable info:
   # https://aur.archlinux.org/packages/spotify/
   # https://community.spotify.com/t5/Desktop-Linux
-  version = "1.2.84.475.ga1a748ff";
+  version = "1.2.86.502.g8cd7fb22";
 
   # To get the latest stable revision:
   # curl -H 'X-Ubuntu-Series: 16' 'https://api.snapcraft.io/api/v1/snaps/details/spotify?channel=stable' | jq '.download_url,.version,.last_updated'
@@ -131,7 +131,7 @@ stdenv.mkDerivation (finalAttrs: {
   # curl -H 'Snap-Device-Series: 16' 'https://api.snapcraft.io/v2/snaps/info/spotify' | jq '.'
   # More examples of api usage:
   # https://github.com/canonical-websites/snapcraft.io/blob/master/webapp/publisher/snaps/views.py
-  rev = "93";
+  rev = "94";
 
   # fetch from snapcraft instead of the debian repository most repos fetch from.
   # That is a bit more cumbersome. But the debian repository only keeps the last
@@ -144,7 +144,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchurl {
     name = "spotify-${finalAttrs.version}-${finalAttrs.rev}.snap";
     url = "https://api.snapcraft.io/api/v1/snaps/download/pOBIoZ2LrCB3rDohMxoYGnbN14EHOgD7_${finalAttrs.rev}.snap";
-    hash = "sha512-X9IslXh1MHExJpBu45mXnIowdhmvkBko+fupk23WhKNoUPSR37jbj5Ee4V2ZYKxCtgyDgX8Px1YKynu3KEVUFg==";
+    hash = "sha512-wp+DHLFJM1yWhp2WNCnvUrLJUhdWqB7OvkIuljLNmmlDm0T+0Vt+/zYyx/pGCVqhv5zzMl6e+32hPD/elHMADA==";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sw/swagger-typescript-api/package.nix b/pkgs/by-name/sw/swagger-typescript-api/package.nix
index 609e16f551d5..78329eb30fd1 100644
--- a/pkgs/by-name/sw/swagger-typescript-api/package.nix
+++ b/pkgs/by-name/sw/swagger-typescript-api/package.nix
@@ -9,10 +9,11 @@
 }:
 let
   pname = "swagger-typescript-api";
-  version = "13.9.1";
+  version = "13.9.3";
 
   node-modules-hash = {
-    "x86_64-linux" = "sha256-QxnqTaV5oN5WoYvLzTckWrYAZVAUxTSLYHVTmmqhmgM=";
+    "x86_64-linux" = "sha256-0jTq1Ds8CNDGOaXZlBgtl5IspoLTGzfXwOhR9MwhoYQ=";
+    "aarch64-linux" = "sha256-7hR5cS8fFN1Eb82eKF+B24FdznfQn5roRqGe9dHk5H4=";
   };
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -22,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "acacode";
     repo = "swagger-typescript-api";
     rev = "v${version}";
-    hash = "sha256-PnQ2aTj8oVUqoqM9voupfBqPu7MZSVflUtuGrXznifo=";
+    hash = "sha256-Xy67aqkZAB54dz9yabJHvOLilb2C/oe8ZCprnqfBBj4=";
   };
 
   node_modules = stdenv.mkDerivation {
@@ -40,15 +41,15 @@ stdenv.mkDerivation (finalAttrs: {
     ];
 
     dontConfigure = true;
-    # Prevent patchShebangs from rewriting node_modules/.bin shebangs to store
-    # paths, which would make this fixed-output derivation's output hash unstable.
-    dontPatchShebangs = true;
+    # Skip fixup, would embed store paths or modify binaries,
+    # making this fixed-output derivation's output hash unstable.
+    dontFixup = true;
 
     buildPhase = ''
       runHook preBuild
 
       export BUN_INSTALL_CACHE_DIR=$(mktemp -d)
-      bun install --no-progress --frozen-lockfile --no-cache
+      bun install --no-progress --frozen-lockfile
 
       runHook postBuild
     '';
@@ -64,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     outputHash =
       node-modules-hash.${stdenv.hostPlatform.system}
-        or (throw "${finalAttrs.pname}: Platform ${stdenv.hostPlatform.system} is not packaged yet. Supported platforms: x86_64-linux.");
+        or (throw "${finalAttrs.pname}: Platform ${stdenv.hostPlatform.system} is not packaged yet. Supported platforms: x86_64-linux, aarch64-linux.");
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
   };
diff --git a/pkgs/by-name/ve/veloren/package.nix b/pkgs/by-name/ve/veloren/package.nix
index b58ab75a7281..43b515447dd7 100644
--- a/pkgs/by-name/ve/veloren/package.nix
+++ b/pkgs/by-name/ve/veloren/package.nix
@@ -3,10 +3,12 @@
   rustPlatform,
   fetchFromGitLab,
   pkg-config,
+  stdenv,
+
+  # Linux-only
   vulkan-loader,
   alsa-lib,
   udev,
-  shaderc,
   libxcb,
   libxkbcommon,
   autoPatchelfHook,
@@ -15,7 +17,12 @@
   libxcursor,
   libxrandr,
   wayland,
-  stdenv,
+
+  # Both platforms
+  shaderc,
+
+  # macOS-only
+  desktopToDarwinBundle,
 }:
 
 let
@@ -25,7 +32,6 @@ let
   timestamp = "1769191511";
   rev = "1d12f35edd6cdbfc1fb921c167cdd7beeeffe248";
 in
-
 rustPlatform.buildRustPackage {
   pname = "veloren";
   inherit version;
@@ -45,29 +51,38 @@ rustPlatform.buildRustPackage {
 
   postPatch = ''
     # Force vek to build in unstable mode
-    cat <<'EOF' | tee "$cargoDepsCopy"/*/vek-*/build.rs
+    tee "$cargoDepsCopy"/*/vek-*/build.rs > /dev/null <<'EOF'
     fn main() {
       println!("cargo:rustc-check-cfg=cfg(nightly)");
       println!("cargo:rustc-cfg=nightly");
     }
     EOF
+
     # Fix assets path
     substituteAllInPlace common/assets/src/lib.rs
+
     # Do not use mold, it produces broken binaries
     substituteInPlace .cargo/config.toml --replace-fail mold gold
   '';
 
   nativeBuildInputs = [
-    autoPatchelfHook
     pkg-config
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    autoPatchelfHook
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    desktopToDarwinBundle
   ];
 
   buildInputs = [
+    shaderc
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
     alsa-lib
     udev
     libxcb
     libxkbcommon
-    shaderc
     stdenv.cc.cc # libgcc_s.so.1
   ];
 
@@ -92,7 +107,7 @@ rustPlatform.buildRustPackage {
   # Some tests require internet access
   doCheck = false;
 
-  appendRunpaths = [
+  appendRunpaths = lib.optionals stdenv.hostPlatform.isLinux [
     (lib.makeLibraryPath (
       [
         libx11
@@ -113,6 +128,7 @@ rustPlatform.buildRustPackage {
     install -Dm644 assets/voxygen/net.veloren.veloren.desktop -t "$out/share/applications"
     install -Dm644 assets/voxygen/net.veloren.veloren.png -t "$out/share/icons/hicolor/256x256/apps"
     install -Dm644 assets/voxygen/net.veloren.veloren.metainfo.xml -t "$out/share/metainfo"
+
     # Assets directory
     mkdir -p "$out/share/veloren"; cp -ar assets "$out/share/veloren/"
   '';
@@ -122,9 +138,10 @@ rustPlatform.buildRustPackage {
     homepage = "https://www.veloren.net";
     license = lib.licenses.gpl3Only;
     mainProgram = "veloren-voxygen";
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [
       rnhmjoj
+      philocalyst
       tomodachi94
     ];
   };
diff --git a/pkgs/by-name/vi/victoriatraces/package.nix b/pkgs/by-name/vi/victoriatraces/package.nix
index 39e71803483f..f87fe117c196 100644
--- a/pkgs/by-name/vi/victoriatraces/package.nix
+++ b/pkgs/by-name/vi/victoriatraces/package.nix
@@ -13,13 +13,13 @@
 
 buildGo126Module (finalAttrs: {
   pname = "VictoriaTraces";
-  version = "0.8.2";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "VictoriaMetrics";
     repo = "VictoriaTraces";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WUndQWyWzffrJ5T4/VDUzRJYvLIOVFFyGIGw366ANa4=";
+    hash = "sha256-IbiQ83iWGIGVZsb3Qszjnr89/LGh7tU6jKyDMTeOZEQ=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/vi/visual-paradigm-ce/package.nix b/pkgs/by-name/vi/visual-paradigm-ce/package.nix
index 04e0d38884b6..8d372fe2b07a 100644
--- a/pkgs/by-name/vi/visual-paradigm-ce/package.nix
+++ b/pkgs/by-name/vi/visual-paradigm-ce/package.nix
@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "visual-paradigm-ce";
-  version = "18.0.20260303";
+  version = "18.0.20260511";
 
   src =
     let
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://eu10-dl.visual-paradigm.com/visual-paradigm/vpce${majorMinor}/${suffix}/Visual_Paradigm_CE_${
         builtins.replaceStrings [ "." ] [ "_" ] majorMinor
       }_${suffix}_Linux64_InstallFree.tar.gz";
-      hash = "sha256-n6cijv9ndliqcvcbIOnMB/mwIjkOzWe1AcJZB+HdHBg=";
+      hash = "sha256-K3eJhS+hz0AlVB0a17Chf/PNa5bFXjVIaFHt9thlabo=";
     };
 
   passthru.updateScript = writeScript "update-visual-paradigm-ce" ''
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     set -eu -o pipefail
 
-    version = "$(curl -Ls -o /dev/null -w %{url_effective} https://www.visual-paradigm.com/downloads/vpce/checksum.html | sed -E 's#.*/vpce([0-9]+\.[0-9]+)/([0-9]+)/.*#\1.\2#')"
+    version="$(curl -Ls -o /dev/null -w %{url_effective} https://www.visual-paradigm.com/downloads/vpce/checksum.html | sed -E 's#.*/vpce([0-9]+\.[0-9]+)/([0-9]+)/.*#\1.\2#')"
 
     update-source-version visual-paradigm-ce "$version"
   '';
diff --git a/pkgs/by-name/wr/wrtag/package.nix b/pkgs/by-name/wr/wrtag/package.nix
index f1774cd7ee3b..c9ab4202a56a 100644
--- a/pkgs/by-name/wr/wrtag/package.nix
+++ b/pkgs/by-name/wr/wrtag/package.nix
@@ -8,16 +8,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "wrtag";
-  version = "0.20.0";
+  version = "0.31.0";
 
   src = fetchFromGitHub {
     owner = "sentriz";
     repo = "wrtag";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LSYrkXDbl0W7V+wDixIKGlOlSE/t10m/7cdgUYUNcr0=";
+    hash = "sha256-KTACpt1cfxsnwkSqQRng//+VH3FsSpSVGaQqnvduLDc=";
   };
 
-  vendorHash = "sha256-u2HM1J535SgB7RrDfVjKFa7QpcK06gqr5+DZaNTxcmA=";
+  vendorHash = "sha256-hL8T9mC5re1v17grFXdVF6TidI9P41HKq0hQyG0Yl8c=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/development/libraries/libinput/default.nix b/pkgs/development/libraries/libinput/default.nix
index 613b5bf8870a..5a878bdc7d5d 100644
--- a/pkgs/development/libraries/libinput/default.nix
+++ b/pkgs/development/libraries/libinput/default.nix
@@ -7,7 +7,6 @@
   meson,
   ninja,
   libevdev,
-  lua5_4,
   mtdev,
   udev,
   wacomSupport ? stdenv.hostPlatform.isLinux,
@@ -20,6 +19,8 @@
   cairo,
   glib,
   gtk3,
+  luaSupport ? true,
+  lua5_4,
   testsSupport ? false,
   check,
   valgrind,
@@ -32,8 +33,6 @@
 }:
 
 let
-  mkFlag = optSet: flag: "-D${flag}=${lib.boolToString optSet}";
-
   sphinx-build =
     let
       env = python3.withPackages (
@@ -84,7 +83,6 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     libevdev
-    lua5_4
     mtdev
     (python3.withPackages (
       pp: with pp; [
@@ -101,6 +99,9 @@ stdenv.mkDerivation rec {
   ++ lib.optionals wacomSupport [
     libwacom
   ]
+  ++ lib.optionals luaSupport [
+    lua5_4
+  ]
   ++ lib.optionals eventGUISupport [
     # GUI event viewer
     cairo
@@ -119,10 +120,11 @@ stdenv.mkDerivation rec {
   ];
 
   mesonFlags = [
-    (mkFlag documentationSupport "documentation")
-    (mkFlag eventGUISupport "debug-gui")
-    (mkFlag testsSupport "tests")
-    (mkFlag wacomSupport "libwacom")
+    (lib.mesonBool "documentation" documentationSupport)
+    (lib.mesonBool "debug-gui" eventGUISupport)
+    (lib.mesonBool "tests" testsSupport)
+    (lib.mesonBool "libwacom" wacomSupport)
+    (lib.mesonEnable "lua-plugins" luaSupport)
     "--sysconfdir=/etc"
     "--libexecdir=${placeholder "bin"}/libexec"
   ]
diff --git a/pkgs/development/php-packages/mongodb/default.nix b/pkgs/development/php-packages/mongodb/default.nix
index 0c735d864390..ea889b5c3e94 100644
--- a/pkgs/development/php-packages/mongodb/default.nix
+++ b/pkgs/development/php-packages/mongodb/default.nix
@@ -15,13 +15,13 @@
 
 buildPecl rec {
   pname = "mongodb";
-  version = "2.3.1";
+  version = "2.3.3";
 
   src = fetchFromGitHub {
     owner = "mongodb";
     repo = "mongo-php-driver";
     rev = version;
-    hash = "sha256-R6mFykE9QrM2i5NA+xuRFYzAf/PCCwfdnAWRcsEovfc=";
+    hash = "sha256-w8KKQDnVORm3OFV94H+rEzVP7+XtHN7ZdKoFpp6Idww=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/python-modules/bthome-ble/default.nix b/pkgs/development/python-modules/bthome-ble/default.nix
index 313d450c085e..9ec742b2c354 100644
--- a/pkgs/development/python-modules/bthome-ble/default.nix
+++ b/pkgs/development/python-modules/bthome-ble/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "bthome-ble";
-  version = "3.22.1";
+  version = "3.23.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Bluetooth-Devices";
     repo = "bthome-ble";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-aUhfcWjElFIIb9xMGuKt4cowSJ6VPXO3xfft7C0stRs=";
+    hash = "sha256-t8AOz1riqwXAoovN/DXBzfQ/btCZqzgC72U9OBdSPHU=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/fpsample/default.nix b/pkgs/development/python-modules/fpsample/default.nix
new file mode 100644
index 000000000000..0c8baa3a2e82
--- /dev/null
+++ b/pkgs/development/python-modules/fpsample/default.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  cmake,
+  ninja,
+  pybind11,
+  scikit-build-core,
+  numpy,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "fpsample";
+  version = "1.0.2";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-XiX5fANBLSQ3Z/ueR/e21sc2x84enVGRiJTj/TJ3SfI=";
+  };
+
+  dontUseCmakeConfigure = true;
+
+  build-system = [
+    cmake
+    ninja
+    pybind11
+    scikit-build-core
+  ];
+
+  dependencies = [ numpy ];
+
+  pythonImportsCheck = [ "fpsample" ];
+
+  meta = {
+    description = "Efficient CPU farthest-point sampling for point clouds";
+    homepage = "https://github.com/leonardodalinky/fpsample";
+    changelog = "https://github.com/leonardodalinky/fpsample/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ BatteredBunny ];
+  };
+})
diff --git a/pkgs/development/python-modules/homematicip/default.nix b/pkgs/development/python-modules/homematicip/default.nix
index 2b6f70562c32..20158a79f640 100644
--- a/pkgs/development/python-modules/homematicip/default.nix
+++ b/pkgs/development/python-modules/homematicip/default.nix
@@ -7,7 +7,6 @@
   pytest-aiohttp,
   pytest-mock,
   pytestCheckHook,
-  pythonOlder,
   requests,
   setuptools-scm,
   setuptools,
@@ -16,16 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "homematicip";
-  version = "2.11.0";
+  version = "2.12.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.12";
-
   src = fetchFromGitHub {
     owner = "hahn-th";
     repo = "homematicip-rest-api";
     tag = finalAttrs.version;
-    hash = "sha256-j2n6mWf2sib067Yhk+8Wc+r6bayfh+WjCTxRz9TCALo=";
+    hash = "sha256-bxoEHk4624Wk4rhSDzRaweWp+wgYo4O0cfpLTNAcdCk=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/lightning/default.nix b/pkgs/development/python-modules/lightning/default.nix
index 7d2bf3cd046a..14b8b762530c 100644
--- a/pkgs/development/python-modules/lightning/default.nix
+++ b/pkgs/development/python-modules/lightning/default.nix
@@ -12,6 +12,7 @@
 buildPythonPackage {
   pname = "lightning";
   pyproject = true;
+  __structuredAttrs = true;
 
   inherit (pytorch-lightning)
     version
diff --git a/pkgs/development/python-modules/pydantic-ai-slim/default.nix b/pkgs/development/python-modules/pydantic-ai-slim/default.nix
index 345e89080267..49d5daa40abf 100644
--- a/pkgs/development/python-modules/pydantic-ai-slim/default.nix
+++ b/pkgs/development/python-modules/pydantic-ai-slim/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydantic-ai-slim";
-  version = "1.97.0";
+  version = "1.101.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "pydantic-ai";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-L18K1g77PeHlc7BdWalrMPOaBmdRErIXogiLcW57lq8=";
+    hash = "sha256-Giir7Q6Jfo2Pm7//kn/AvyDTb+r4nLzVux2GxNrSfdw=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/pydantic_ai_slim";
diff --git a/pkgs/development/python-modules/pydantic-graph/default.nix b/pkgs/development/python-modules/pydantic-graph/default.nix
index f9b84b83e230..9b68c457ca53 100644
--- a/pkgs/development/python-modules/pydantic-graph/default.nix
+++ b/pkgs/development/python-modules/pydantic-graph/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydantic-graph";
-  version = "1.97.0";
+  version = "1.101.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "pydantic-ai";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-L18K1g77PeHlc7BdWalrMPOaBmdRErIXogiLcW57lq8=";
+    hash = "sha256-Giir7Q6Jfo2Pm7//kn/AvyDTb+r4nLzVux2GxNrSfdw=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/pydantic_graph";
diff --git a/pkgs/development/python-modules/pysigma-backend-opensearch/default.nix b/pkgs/development/python-modules/pysigma-backend-opensearch/default.nix
index 0f397a08156b..2052755db6c0 100644
--- a/pkgs/development/python-modules/pysigma-backend-opensearch/default.nix
+++ b/pkgs/development/python-modules/pysigma-backend-opensearch/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pysigma-backend-opensearch";
-  version = "2.0.2";
+  version = "2.0.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "SigmaHQ";
     repo = "pySigma-backend-opensearch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CCIQQeR/WXFV8A1elLxc4o32oox5wsOupI1XVjwFrUs=";
+    hash = "sha256-GKy2gQIeon3kewLXlNdE8ZCwiqQfaukz2BF6a4dOwJU=";
   };
 
   pythonRelaxDeps = [ "pysigma" ];
diff --git a/pkgs/development/python-modules/python-homewizard-energy/default.nix b/pkgs/development/python-modules/python-homewizard-energy/default.nix
index 7cdc2ddb6964..f766625b7f7c 100644
--- a/pkgs/development/python-modules/python-homewizard-energy/default.nix
+++ b/pkgs/development/python-modules/python-homewizard-energy/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "python-homewizard-energy";
-  version = "10.0.1";
+  version = "10.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "DCSBL";
     repo = "python-homewizard-energy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/bz/KM6kCLciHRcPifd5F1P6Agzzb2ULxEzWP9xbfwo=";
+    hash = "sha256-8JgoikNo1ZWeQLQT/9Zn0X0qDcj+wszGht2SWMCRtto=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pytorch-lightning/default.nix b/pkgs/development/python-modules/pytorch-lightning/default.nix
index c0c7ed6f83d9..25f044198c16 100644
--- a/pkgs/development/python-modules/pytorch-lightning/default.nix
+++ b/pkgs/development/python-modules/pytorch-lightning/default.nix
@@ -26,12 +26,13 @@ buildPythonPackage (finalAttrs: {
   pname = "pytorch-lightning";
   version = "2.6.4";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "Lightning-AI";
     repo = "pytorch-lightning";
     tag = finalAttrs.version;
-    hash = "sha256-zOSV2X3yZy0uh1lJ2yNl/hHBvfIDcIrATHtiRwThsQA=";
+    hash = "sha256-Qysnr76OCO9eZzhQW5EoGT2hUAYGw/qY+j6dF8XCXC4=";
   };
 
   env.PACKAGE_NAME = "pytorch";
diff --git a/pkgs/development/python-modules/pyvlx/default.nix b/pkgs/development/python-modules/pyvlx/default.nix
index 5d06a71b3519..1836be024dab 100644
--- a/pkgs/development/python-modules/pyvlx/default.nix
+++ b/pkgs/development/python-modules/pyvlx/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyvlx";
-  version = "0.2.33";
+  version = "0.2.34";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Julius2342";
     repo = "pyvlx";
     tag = finalAttrs.version;
-    hash = "sha256-CdBpXga/OxkNILUPDe8bna0wbwNk7GLzYgZJeScJ948=";
+    hash = "sha256-QROewaUCvZ4wTCdi/TB5FTr58lytaViac9oOUGRp5Tw=";
   };
 
   build-system = [
diff --git a/pkgs/servers/home-assistant/custom-components/elegoo_printer/package.nix b/pkgs/servers/home-assistant/custom-components/elegoo_printer/package.nix
index 8fe569af652e..b22b77df6c7e 100644
--- a/pkgs/servers/home-assistant/custom-components/elegoo_printer/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/elegoo_printer/package.nix
@@ -19,13 +19,13 @@
 buildHomeAssistantComponent rec {
   owner = "danielcherubini";
   domain = "elegoo_printer";
-  version = "2.8.0";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     owner = "danielcherubini";
     repo = "elegoo-homeassistant";
     tag = "v${version}";
-    hash = "sha256-JyAgBPaj7BQNn+qhBRZPDw0HypRxpBKGvAuKfQk/bn4=";
+    hash = "sha256-lKRi90H48w9jndljoSyaHY4cVh4/qEkGGOkEs5GVk1o=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/zigbee2mqtt-networkmap/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/zigbee2mqtt-networkmap/package.nix
index 36e0f5e8fbf1..55b6764c24dd 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/zigbee2mqtt-networkmap/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/zigbee2mqtt-networkmap/package.nix
@@ -11,18 +11,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zigbee2mqtt-networkmap";
-  version = "0.10.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "azuwis";
     repo = "zigbee2mqtt-networkmap";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-S4iUTjI+pFfa8hg1/lJSI1tl2nEIh+LO2WTYhWWLh/s=";
+    hash = "sha256-b1B8M2EP+lt7H3M+8tlgVCRWX43jeOr6a2XJT+cRI18=";
   };
 
   offlineCache = fetchYarnDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-yo+K3vUJH6WwyNj/UuvbhhmhdqzJ3XUzX+cKUueutjE=";
+    hash = "sha256-juql9gJX3NPOR0AVXejHC0XmRWwdtemMUCDS3iKM+wA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/typesetting/tex/texlive/bin.nix b/pkgs/tools/typesetting/tex/texlive/bin.nix
index c843cdb554ff..e115c7d436a2 100644
--- a/pkgs/tools/typesetting/tex/texlive/bin.nix
+++ b/pkgs/tools/typesetting/tex/texlive/bin.nix
@@ -7,6 +7,8 @@
   unzip,
   buildPackages,
   texlive,
+  gnum4,
+  jdk_headless,
   zlib,
   libiconv,
   libpng,
@@ -791,6 +793,60 @@ rec {
     enableParallelBuilding = true;
   };
 
+  # tex4ht.jar
+  # we build this as a TeX package, but under texlive.bin to avoid exposing it in texlivePackages
+  tex4htJar = stdenv.mkDerivation {
+    pname = "tex4ht-jar";
+    inherit (texlive.pkgs.tex4ht) meta version;
+
+    outputs = [ "tex" ];
+
+    src = texlive.pkgs.tex4ht.texsource + "/source/generic/tex4ht";
+
+    nativeBuildInputs = [
+      gnum4
+      jdk_headless
+      (texlive.schemes.texliveBasic.withPackages (ps: [
+        # override tex4ht-jar with an empty package to avoid a self dependency
+        { pname = "tex4ht-jar"; }
+        ps.protex
+        ps.tex4ht
+      ]))
+    ];
+
+    preHook = ''
+      export out="$tex"
+    '';
+
+    # the current Makefile is broken, so we build the artifact by hand
+    # we also use latex instead of htlatex as the latter is orders of magnitude slower
+    buildPhase = ''
+      make tex4ht-dir.tex
+
+      mkdir -p work.dir/src/tex4ht
+      for f in *-xtpipes.tex ; do
+        latex -output-directory=work.dir/src/tex4ht "\\RequirePackage{tex4ht}\\input $f"
+      done
+
+      mkdir -p work.dir/src/xtpipes
+      latex -output-directory=work.dir/src/xtpipes "\\RequirePackage{tex4ht}\\input xtpipes.tex"
+
+      mkdir -p work.dir/src/xtpipes/util
+      mv work.dir/src/xtpipes/xtpipes.java.java work.dir/src/xtpipes.java
+      mv work.dir/src/xtpipes/ScriptsManager*.java work.dir/src/xtpipes/util
+
+      mkdir -p xtpipes.dir/xtpipes/lib
+      cp work.dir/src/xtpipes/xtpipes*.{4xt,dtd} xtpipes.dir/xtpipes/lib
+
+      javac -d xtpipes.dir work.dir/src/{*,*/*,*/*/*}.java
+      jar cf tex4ht.dir/texmf/tex4ht/bin/tex4ht.jar -C xtpipes.dir .
+    '';
+
+    installPhase = ''
+      install -D -t "$tex"/tex4ht/bin tex4ht.dir/texmf/tex4ht/bin/tex4ht.jar
+    '';
+  };
+
 } # un-indented
 
 //
diff --git a/pkgs/tools/typesetting/tex/texlive/build-texlive-package.nix b/pkgs/tools/typesetting/tex/texlive/build-texlive-package.nix
index 67a52edd4590..841fc76479d8 100644
--- a/pkgs/tools/typesetting/tex/texlive/build-texlive-package.nix
+++ b/pkgs/tools/typesetting/tex/texlive/build-texlive-package.nix
@@ -54,6 +54,7 @@
   hasRunfiles ? (sha512 ? run),
   hasTlpkg ? false,
   hasCatalogue ? true,
+  hasJar ? false,
   catalogue ? pname,
   extraNativeBuildInputs ? [ ],
   ...
@@ -86,6 +87,9 @@ let
   }
   // lib.optionalAttrs (mainProgram != null) {
     inherit mainProgram;
+  }
+  // lib.optionalAttrs hasJar {
+    sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
   };
 
   # if binfiles contains exactly one entry, use it as mainProgram, but allow overrides via args.mainProgram
diff --git a/pkgs/tools/typesetting/tex/texlive/default.nix b/pkgs/tools/typesetting/tex/texlive/default.nix
index d2acf9ca03e0..a5d81fbbaa7c 100644
--- a/pkgs/tools/typesetting/tex/texlive/default.nix
+++ b/pkgs/tools/typesetting/tex/texlive/default.nix
@@ -47,6 +47,8 @@
   luajit,
   texinfo,
   # for bin.nix
+  gnum4,
+  jdk_headless,
   perlPackages,
   python3Packages,
   pkg-config,
@@ -225,7 +227,7 @@ let
         inherit mirrors pname;
         fixedHashes = fixedHashes."${pname}-${toString revision}${extraRevision}" or { };
       }
-      // lib.optionalAttrs (args ? deps) { deps = map (n: tl.${n}) (args.deps or [ ]); }
+      // lib.optionalAttrs (args ? deps) { deps = map (n: tl.${n} or bin.${n}) (args.deps or [ ]); }
     )
   ) overriddenTlpdb;
 
diff --git a/pkgs/tools/typesetting/tex/texlive/fixed-hashes.nix b/pkgs/tools/typesetting/tex/texlive/fixed-hashes.nix
index 389642652d96..e51554358faa 100644
--- a/pkgs/tools/typesetting/tex/texlive/fixed-hashes.nix
+++ b/pkgs/tools/typesetting/tex/texlive/fixed-hashes.nix
@@ -17603,7 +17603,7 @@
     doc = "0np84cifjrc9ls39gvnf0pfmyr2azbmkjng68wf22mpbbax0vblj";
   };
   tex4ht-77991 = {
-    run = "1brpxgcxrn8x45rnxd2mi9fjjlifafrd5d9naghxd12h36i5xz50";
+    run = "1g06wmrnj8psqyby6nq53m0wavs0pcl8wllyhms6jyc1vnya9in7";
     doc = "04z1bsgy3lisx7ifskxzna5jcbjkbwwjlqfwbfppnmjp5rwphxdv";
     source = "1fvgpz4r686f86hf8mjj31724dcr1l9s02nirfn01fjlxq9fkpkm";
   };
diff --git a/pkgs/tools/typesetting/tex/texlive/tl2nix.sed b/pkgs/tools/typesetting/tex/texlive/tl2nix.sed
index 086acd8bdd87..9eef947402db 100644
--- a/pkgs/tools/typesetting/tex/texlive/tl2nix.sed
+++ b/pkgs/tools/typesetting/tex/texlive/tl2nix.sed
@@ -167,18 +167,22 @@ $a}
       # flag existence of tlpkg files in hold space
       x ; s/$/\n  hasTlpkg = true;/ ; x
     }
+    / [^ ]*\.jar /{
+      # flag existence of java bytecode in hold space
+      x ; s/$/\n  hasJar = true;/ ; x
+    }
 
     # extract script extensions
-    / texmf-dist\/scripts\/.*\.(jar|lua|py|rb|sno|tcl|texlua|tlu) /{
+    / texmf-dist\/scripts\/[^ ]*\.(jar|lua|py|rb|sno|tcl|texlua|tlu) /{
       i\  scriptExts = [
-        / texmf-dist\/scripts\/.*\.jar /i\    "jar"
-        / texmf-dist\/scripts\/.*\.lua /i\    "lua"
-        / texmf-dist\/scripts\/.*\.py /i\    "py"
-        / texmf-dist\/scripts\/.*\.rb /i\    "rb"
-        / texmf-dist\/scripts\/.*\.sno /i\    "sno"
-        / texmf-dist\/scripts\/.*\.tcl /i\    "tcl"
-        / texmf-dist\/scripts\/.*\.texlua /i\    "texlua"
-        / texmf-dist\/scripts\/.*\.tlu /i\    "tlu"
+        / texmf-dist\/scripts\/[^ ]*\.jar /i\    "jar"
+        / texmf-dist\/scripts\/[^ ]*\.lua /i\    "lua"
+        / texmf-dist\/scripts\/[^ ]*\.py /i\    "py"
+        / texmf-dist\/scripts\/[^ ]*\.rb /i\    "rb"
+        / texmf-dist\/scripts\/[^ ]*\.sno /i\    "sno"
+        / texmf-dist\/scripts\/[^ ]*\.tcl /i\    "tcl"
+        / texmf-dist\/scripts\/[^ ]*\.texlua /i\    "texlua"
+        / texmf-dist\/scripts\/[^ ]*\.tlu /i\    "tlu"
       i\  ];
     }
 
diff --git a/pkgs/tools/typesetting/tex/texlive/tlpdb-overrides.nix b/pkgs/tools/typesetting/tex/texlive/tlpdb-overrides.nix
index 44cbfa33fa2c..2eb1eec2366f 100644
--- a/pkgs/tools/typesetting/tex/texlive/tlpdb-overrides.nix
+++ b/pkgs/tools/typesetting/tex/texlive/tlpdb-overrides.nix
@@ -555,6 +555,13 @@ lib.recursiveUpdate orig rec {
 
   #### misc
 
+  # replace tex4ht.jar with our rebuilt version
+  tex4ht.deps = (orig.tex4ht.deps or [ ]) ++ [ "tex4htJar" ];
+  tex4ht.postUnpack = ''
+    [[ ! -d "$out"/tex4ht/bin ]] || rm -fr "$out"/tex4ht/bin
+  '';
+  tex4ht.hasJar = false;
+
   # Use top-level git-latexdiff's version and src. NOTE that this derivation is
   # still different from top-level's `git-latexdiff`, due to __structuredAttrs
   # enabled unconditionally. Still though this derivation produces a funcitonal
diff --git a/pkgs/tools/typesetting/tex/texlive/tlpdb.nix b/pkgs/tools/typesetting/tex/texlive/tlpdb.nix
index 9dd50dc26da5..1b078df39bad 100644
--- a/pkgs/tools/typesetting/tex/texlive/tlpdb.nix
+++ b/pkgs/tools/typesetting/tex/texlive/tlpdb.nix
@@ -703,6 +703,7 @@
     license = [ "bsd3" ];
     version = "0.5.1";
     sha512.run = "e43861305fb612100621b74079c43f554b85d2af958778ea47e2cdf01996d9e08f0ae2cbd576e14ef0dd90d5919571db537cea058200dd6b45e9165fcba8c9a1";
+    hasJar = true;
   };
   albatross.binfiles = [
     "albatross"
@@ -1600,6 +1601,7 @@
     license = [ "bsd3" ];
     version = "7.2.0";
     sha512.run = "340c6b8ff750e684955d07e167cfb77f4b60131166a38e6fcfa0d3498e9281ca51e954a492fdcafaf01ce103441d87cc0330b849d000a0a788812cee8d6bc365";
+    hasJar = true;
   };
   arara.binfiles = [
     "arara"
@@ -4155,6 +4157,7 @@
     license = [ "gpl3Plus" ];
     version = "4.7";
     sha512.run = "09c58acec980741552e643eff132be3f9b93408b5094c5ce40f7850ccb47cc6b4f1fdbd79ae7212b4df70bae68115328d118bd632eb8c55a1afac000c4bb9792";
+    hasJar = true;
   };
   bib2gls.binfiles = [
     "bib2gls"
@@ -23530,9 +23533,6 @@
     shortdesc = "Engraving Gregorian Chant scores";
     sha512.doc = "acfa4975c8936132f6cfb0f1af75c35fddfc030e74f01bcf88cededf66d67b6840477847d332db66c4a1645c4ac2b152070496786b4f2232a8d2392c31e8754a";
     sha512.source = "2bd9d16ac9b11b8ecdcaf0864f007ce10be9ae29662edbca81611fa0d3b7697fe12eea871a1e016880172dd629ae08774e9a6722aea564519ebb4919bd7d3238";
-    scriptExts = [
-      "lua"
-    ];
     license = [ "gpl3Only" ];
     version = "6.1.0";
     sha512.run = "0d15d49278efb0b4dcc6ff714bd7e5c97407a567c0a7f6f189d328839b727e4d3f6f6f8769c5f9ece3227a14d38b52875a2139484f5ddd3f8962f611e96c7d5a";
@@ -28610,6 +28610,7 @@
     license = [ "gpl3Plus" ];
     version = "20191225.0";
     sha512.run = "da33a0bdc989fcb6f4521d23e5d44bae70d608ed8ac10f05d6962a252e99bbd80380afa2cbe9e02b9c652b044dfff79218f951144da6ce55f8a53033c11ff346";
+    hasJar = true;
   };
   ketcindy.binfiles = [
     "ketcindy"
@@ -29983,6 +29984,7 @@
     license = [ "gpl3Only" ];
     version = "1.1.3";
     sha512.run = "2824e5ac81f37b52b45686927add1c73d9e8a6b3972f144178c312cb6c11b0d40d356ce06153d620d64ca735ccac7f97adcec8e59fe31527d1cc1e53e1551fef";
+    hasJar = true;
   };
   latex2nemeth.binfiles = [
     "latex2nemeth"
@@ -38445,6 +38447,7 @@
       "gpl1Only"
     ];
     sha512.run = "71a2c105a7d593ca432a50a68fbcd16d876c8a28ce25be99326f323bcdba997b000158514328542378384f55a0ceadd9d34b71840980346b0b5c1c63843f7c1b";
+    hasJar = true;
   };
   pax.binfiles = [
     "pdfannotextractor"
@@ -48449,12 +48452,9 @@
     shortdesc = "Convert (La)TeX to HTML/XML";
     sha512.doc = "3a932fda55762263ae1ae1ab3695dbcef2a7e6d4995028bfcc0a9ca15de04998aefbad56110b7853489fe038eddeb1f2057a65ea28d2b78caea30ae1b69a7e1a";
     sha512.source = "a2a6022a828a7b55a78ca72514e681951731e4ab451b54e0683e0daad6f07d243b52b056e376a6a0fa3b91652396598e819a8a8d14fdfcef65f5a8cd93e30a0f";
-    scriptExts = [
-      "jar"
-      "lua"
-    ];
     license = [ "lppl13c" ];
     sha512.run = "760a199f6fde826739c94eee51bbb6424df4b4b8bc67e2f225884d7d42985d2a64560bca9623e5d71724caff484cd9a68854de80d8a6632efb5b81e645200d57";
+    hasJar = true;
   };
   tex4ht.binfiles = [
     "ht"
@@ -48764,7 +48764,6 @@
     hasManpages = true;
     scriptExts = [
       "lua"
-      "tcl"
     ];
     hasCatalogue = false;
     sha512.run = "7b3365e054384d1acd91eb50d34c43dbd7d7ea7bcc98eee91ccc62c6ede11b32c1bdebfa34593eda672b13918059e895e3aa969948d988b578a1482e2712efbb";
@@ -48945,6 +48944,7 @@
     license = [ "lppl13c" ];
     version = "1.7";
     sha512.run = "fbd239be879748a38a7fe3544081b2e5ef230176e7f3a6513f1d2a11fb9d537a8c882d6af36f4226776faf84a23fea6c040246f1c7403fa018d2c6da801b5654";
+    hasJar = true;
   };
   texosquery.binfiles = [
     "texosquery"
@@ -48962,6 +48962,7 @@
     license = [ "bsd3" ];
     version = "1.0.6";
     sha512.run = "c70f7e8e637a72c18b74e2c5e1832c911a32e7ac4f9b2fa538fb11b85c9c026c62373e0af52b6114180cbaed2d2c6222923ff400a0beff2db1adc16b499a64cd";
+    hasJar = true;
   };
   texplate.binfiles = [
     "texplate"
@@ -50552,6 +50553,7 @@
     license = [ "gpl3Plus" ];
     version = "1.2";
     sha512.run = "50817d4c68d4e302cf0f4075ff9321bde2fd26336923efd2fb39bf097090b617a2a67ce75d1a14d562939514acb17b2a356bc388f72049dbe52a868ff3d63ffd";
+    hasJar = true;
   };
   tlcockpit.binfiles = [
     "tlcockpit"
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 79f3d954d168..f70c3719a68b 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -623,6 +623,7 @@ mapAliases {
   docker-sync = throw "'docker-sync' has been removed because it was broken and unmaintained"; # Added 2025-08-26
   docker_26 = throw "'docker_26' has been removed because it has been unmaintained since February 2025. Use docker_28 or newer instead."; # Added 2025-06-21
   docker_27 = throw "'docker_27' has been removed because it has been unmaintained since May 2025. Use docker_28 or newer instead."; # Added 2025-06-15
+  docker_28 = throw "'docker_28' has been removed because it has been unmaintained since November 2025. Use docker_29 or newer instead."; # Added 2026-05-18
   dockerfile-language-server-nodejs = warnAlias "'dockerfile-language-server-nodejs' has been renamed to 'dockerfile-language-server'" dockerfile-language-server; # Added 2025-09-12
   doctave = throw "'doctave' has been removed as it has been unmaintained upstream since April 2022"; # Added 2026-02-07
   docui = throw "'docui' has removed as it was deprecated and archived upstream. Consider using lazydocker instead"; # Added 2026-01-16
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e0abafb9ea0f..6f190f299de3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9046,7 +9046,6 @@ with pkgs;
 
   inherit (callPackage ../applications/virtualization/docker { })
     docker_25
-    docker_28
     docker_29
     ;
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 73ea6e0ad256..bc55a388cec7 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5964,6 +5964,8 @@ self: super: with self; {
 
   fpdf2 = callPackage ../development/python-modules/fpdf2 { };
 
+  fpsample = callPackage ../development/python-modules/fpsample { };
+
   fpylll = callPackage ../development/python-modules/fpylll { };
 
   fpyutils = callPackage ../development/python-modules/fpyutils { };