diff --git a/doc/style.css b/doc/style.css
index 96b6979474db..c3c58e88637d 100644
--- a/doc/style.css
+++ b/doc/style.css
@@ -34,7 +34,7 @@ body {
   }
 }
 
-.book .list-of-examples {
+.list-of-examples {
   display: none;
 }
 
@@ -392,8 +392,7 @@ div.appendix .toc dt {
   margin-top: 0;
 }
 
-div.book .list-of-examples dt,
-div.appendix .list-of-examples dt {
+.list-of-examples dt {
   margin-top: 0;
 }
 
@@ -450,6 +449,7 @@ div.appendix .variablelist .term {
 }
 
 :root {
+  --sidebar-width: 20rem;
   --background: #fff;
   --main-text-color: #000;
   --link-color: #405d99;
@@ -496,3 +496,68 @@ div.appendix .variablelist .term {
 .chapter {
   content-visibility: auto;
 }
+
+.navheader {
+  position: sticky;
+  top: 0;
+  z-index: 1;
+  background-color: var(--background);
+}
+
+nav.toc-sidebar {
+  height: 100%;
+  overflow-y: none;
+  padding: 0 1rem 2rem;
+  border-bottom: 0.0625rem solid #d8d8d8;
+}
+
+nav.toc-sidebar .toc {
+  margin-bottom: 0;
+}
+
+nav.toc-sidebar .toc dl {
+  margin: 0;
+}
+
+nav.toc-sidebar .toc dd {
+  margin-left: 1em;
+}
+
+@media screen and (min-width: 768px) {
+  body {
+    height: 100vh;
+    min-height: 0;
+    display: grid;
+    grid-template-columns: minmax(0, 1fr);
+    grid-template-rows: auto minmax(0, 1fr);
+  }
+
+  body:has(> nav.toc-sidebar) {
+    grid-template-columns: var(--sidebar-width) minmax(0, 1fr);
+  }
+
+  .navheader {
+    grid-column: 1 / -1;
+    grid-row: 1;
+  }
+
+  nav.toc-sidebar {
+    grid-column: 1;
+    grid-row: 2;
+    max-height: none;
+    overflow-y: auto;
+    border-bottom: none;
+    border-right: 0.0625rem solid #d8d8d8;
+  }
+
+  main.content {
+    grid-column: 1 / -1;
+    grid-row: 2;
+    overflow-y: auto;
+    padding: 0 1rem;
+  }
+
+  body:has(> nav.toc-sidebar) main.content {
+    grid-column: 2;
+  }
+}
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index ae44182003b8..26d7e7fa77b5 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -22355,6 +22355,12 @@
     githubId = 406946;
     name = "Valentin Lorentz";
   };
+  proitheus = {
+    email = "me@mail.proitheus.top";
+    github = "proitheus";
+    githubId = 50539150;
+    name = "proitheus";
+  };
   projectinitiative = {
     name = "ProjectInitiative";
     github = "ProjectInitiative";
diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index b0df63100530..314044b1b2c6 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -58,6 +58,8 @@
 
 - `security.run0.enableSudoAlias` now uses the `run0-sudo-shim` instead of a shell-script to improve compatibility.
 
+- `security.run0.persistentAuth` options have been added to support persistent Authentication of session. Timeout configurable via `security.polkit.settings.Polkitd.ExpirationSeconds`.
+
 - `boot.loader.systemd-boot` gained support for [Automatic Boot Assessment](https://systemd.io/AUTOMATIC_BOOT_ASSESSMENT/) via the new [`boot.loader.systemd-boot.bootCounting`](#opt-boot.loader.systemd-boot.bootCounting.enable) options, allowing automatic detection of and recovery from bad NixOS generations. As part of this change, boot loader entries on the ESP/XBOOTLDR partition are now named `nixos-<content-hash>.conf` instead of `nixos-generation-<n>.conf`; existing entries are migrated automatically on the next `nixos-rebuild boot`/`switch`.
 
 - `security.polkit.settings` added for RFC42 style configuration of the polkitd daemon.
diff --git a/nixos/modules/security/run0.nix b/nixos/modules/security/run0.nix
index 295215aa5a0a..478fae3db67d 100644
--- a/nixos/modules/security/run0.nix
+++ b/nixos/modules/security/run0.nix
@@ -13,6 +13,7 @@ let
     mkOption
     mkPackageOption
     mkAliasOptionModule
+    optionalString
     ;
 
   cfg = config.security.run0;
@@ -21,6 +22,12 @@ in
   options.security.run0 = {
     enable = mkEnableOption "support for run0";
 
+    persistentAuth.enable = mkEnableOption ''
+      persistent authentication for sessions.
+      Timeout configurable via {option}`security.polkit.settings.Polkitd.ExpirationSeconds`
+    '';
+    persistentAuth.enableRemote = mkEnableOption "persistent authentication for remote sessions";
+
     wheelNeedsPassword = mkOption {
       type = lib.types.bool;
       default = true;
@@ -67,13 +74,24 @@ in
 
       security.polkit = {
         enable = true;
-        extraConfig = mkIf (!cfg.wheelNeedsPassword) ''
-          polkit.addRule(function(action, subject) {
-            if (action.id == "org.freedesktop.systemd1.manage-units" && subject.isInGroup("wheel")) {
-              return polkit.Result.YES;
-            }
-          });
-        '';
+        extraConfig = lib.concatLines [
+          (optionalString (!cfg.wheelNeedsPassword) ''
+            polkit.addRule(function(action, subject) {
+              if (action.id == "org.freedesktop.systemd1.manage-units" && subject.isInGroup("wheel")) {
+                return polkit.Result.YES;
+              }
+            });
+          '')
+          (optionalString cfg.persistentAuth.enable ''
+            polkit.addRule(function(action, subject) {
+              if (action.id == "org.freedesktop.systemd1.manage-units" && subject.active ${
+                optionalString (!cfg.persistentAuth.enableRemote) "&& subject.local"
+              }) {
+                return polkit.Result.AUTH_ADMIN_KEEP;
+              }
+            });
+          '')
+        ];
       };
 
       environment.systemPackages = lib.optional cfg.sudo-shim.enable cfg.sudo-shim.package;
diff --git a/nixos/modules/services/matrix/tuwunel.nix b/nixos/modules/services/matrix/tuwunel.nix
index 6296fd6cb6cf..6a17ac5f726d 100644
--- a/nixos/modules/services/matrix/tuwunel.nix
+++ b/nixos/modules/services/matrix/tuwunel.nix
@@ -62,6 +62,19 @@ in
       };
     };
 
+    environmentFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      example = "/run/secrets/matrix-tuwunel.env";
+      description = ''
+        Path to a file containing sensitive environment variables as described in {manpage}`systemd.exec(5).
+
+        Refer to
+        <https://matrix-construct.github.io/tuwunel/configuration.html#environment-variables>
+        for specifying options as environment variables.
+      '';
+    };
+
     settings = lib.mkOption {
       type = lib.types.submodule {
         freeformType = format.type;
@@ -255,6 +268,7 @@ in
         ExecStart = lib.getExe cfg.package;
         Restart = "on-failure";
         RestartSec = 10;
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
       };
     };
   };
diff --git a/nixos/modules/system/boot/uki.nix b/nixos/modules/system/boot/uki.nix
index fa12c63b751a..a33822a9ba37 100644
--- a/nixos/modules/system/boot/uki.nix
+++ b/nixos/modules/system/boot/uki.nix
@@ -81,7 +81,7 @@ in
         Linux = lib.mkOptionDefault "${config.boot.kernelPackages.kernel}/${config.system.boot.loader.kernelFile}";
         Initrd = lib.mkOptionDefault "${config.system.build.initialRamdisk}/${config.system.boot.loader.initrdFile}";
         Cmdline = lib.mkOptionDefault "init=${config.system.build.toplevel}/init ${toString config.boot.kernelParams}";
-        Stub = lib.mkOptionDefault "${pkgs.systemd}/lib/systemd/boot/efi/linux${efiArch}.efi.stub";
+        Stub = lib.mkOptionDefault "${config.systemd.package}/lib/systemd/boot/efi/linux${efiArch}.efi.stub";
         Uname = lib.mkOptionDefault "${config.boot.kernelPackages.kernel.modDirVersion}";
         OSRelease = lib.mkOptionDefault "@${config.system.build.etc}/etc/os-release";
         # This is needed for cross compiling.
diff --git a/nixos/modules/tasks/network-interfaces.nix b/nixos/modules/tasks/network-interfaces.nix
index 4887256b7be1..06b38deff6b6 100644
--- a/nixos/modules/tasks/network-interfaces.nix
+++ b/nixos/modules/tasks/network-interfaces.nix
@@ -1693,8 +1693,7 @@ in
       type = types.bool;
       description = ''
         Whether we should use networkd as the network configuration backend or
-        the legacy script based system. Note that this option is experimental,
-        enable at your own risk.
+        the legacy script based system.
       '';
     };
 
diff --git a/nixos/tests/php/fpm-modular.nix b/nixos/tests/php/fpm-modular.nix
index 360e664963cf..443594673e13 100644
--- a/nixos/tests/php/fpm-modular.nix
+++ b/nixos/tests/php/fpm-modular.nix
@@ -7,7 +7,7 @@
     aanderse
   ];
 
-  nodes.machine =
+  containers.machine =
     { config, pkgs, ... }:
     {
       environment.systemPackages = [ php ];
@@ -56,14 +56,14 @@
       };
     };
   testScript =
-    { ... }:
+    # python
     ''
       machine.wait_for_unit("nginx.service")
       machine.wait_for_unit("php-fpm.service")
 
       # Check so we get an evaluated PHP back
-      response = machine.succeed("curl -fvvv -s http://127.0.0.1:80/")
-      assert "PHP Version ${php.version}" in response, "PHP version not detected"
+      response = machine.wait_until_succeeds("curl -fvvv -s http://127.0.0.1:80/")
+      t.assertIn("PHP Version ${php.version}", response, "PHP version not detected")
 
       # Check so we have database and some other extensions loaded
       for ext in ["json", "opcache", "pdo_mysql", "pdo_pgsql", "pdo_sqlite", "apcu"]:
diff --git a/nixos/tests/php/fpm.nix b/nixos/tests/php/fpm.nix
index 21336ade042b..cb128df26ebe 100644
--- a/nixos/tests/php/fpm.nix
+++ b/nixos/tests/php/fpm.nix
@@ -3,7 +3,7 @@
   name = "php-${php.version}-fpm-nginx-test";
   meta.maintainers = lib.teams.php.members;
 
-  nodes.machine =
+  containers.machine =
     { config, pkgs, ... }:
     {
       environment.systemPackages = [ php ];
@@ -47,14 +47,14 @@
       };
     };
   testScript =
-    { ... }:
+    # python
     ''
       machine.wait_for_unit("nginx.service")
       machine.wait_for_unit("phpfpm-foobar.service")
 
       # Check so we get an evaluated PHP back
-      response = machine.succeed("curl -fvvv -s http://127.0.0.1:80/")
-      assert "PHP Version ${php.version}" in response, "PHP version not detected"
+      response = machine.wait_until_succeeds("curl -fvvv -s http://127.0.0.1:80/")
+      t.assertIn("PHP Version ${php.version}", response, "PHP version not detected")
 
       # Check so we have database and some other extensions loaded
       for ext in ["json", "opcache", "pdo_mysql", "pdo_pgsql", "pdo_sqlite", "apcu"]:
diff --git a/nixos/tests/php/httpd.nix b/nixos/tests/php/httpd.nix
index 9ee157a01096..36381c15509f 100644
--- a/nixos/tests/php/httpd.nix
+++ b/nixos/tests/php/httpd.nix
@@ -7,7 +7,7 @@
   name = "php-${php.version}-httpd-test";
   meta.maintainers = lib.teams.php.members;
 
-  nodes.machine =
+  containers.machine =
     {
       config,
       pkgs,
@@ -32,13 +32,13 @@
       };
     };
   testScript =
-    { ... }:
+    # python
     ''
       machine.wait_for_unit("httpd.service")
 
       # Check so we get an evaluated PHP back
-      response = machine.succeed("curl -fvvv -s http://127.0.0.1:80/")
-      assert "PHP Version ${php.version}" in response, "PHP version not detected"
+      response = machine.wait_until_succeeds("curl -fvvv -s http://127.0.0.1:80/")
+      t.assertIn("PHP Version ${php.version}", response, "PHP version not detected")
 
       # Check so we have database and some other extensions loaded
       for ext in ["json", "opcache", "pdo_mysql", "pdo_pgsql", "pdo_sqlite"]:
diff --git a/nixos/tests/php/pcre.nix b/nixos/tests/php/pcre.nix
index e95ce76c7d7e..fb4c59e310da 100644
--- a/nixos/tests/php/pcre.nix
+++ b/nixos/tests/php/pcre.nix
@@ -11,7 +11,7 @@ in
   name = "php-${php.version}-httpd-pcre-jit-test";
   meta.maintainers = lib.teams.php.members;
 
-  nodes.machine =
+  containers.machine =
     { pkgs, ... }:
     {
       time.timeZone = "UTC";
@@ -50,12 +50,13 @@ in
         pcntl_wait($pid);
       '';
     in
+    # python
     ''
       machine.wait_for_unit("httpd.service")
       # Ensure php evaluation by matching on the var_dump syntax
-      response = machine.succeed("curl -fvvv -s http://127.0.0.1:80/index.php")
+      response = machine.wait_until_succeeds("curl -fvvv -s http://127.0.0.1:80/index.php")
       expected = 'string(${toString (builtins.stringLength testString)}) "${testString}"'
-      assert expected in response, "Does not appear to be able to use subgroups."
-      machine.succeed("${php}/bin/php -f ${pcreJitSeallocForkIssue}")
+      t.assertIn(expected, response, "Does not appear to be able to use subgroups.")
+      machine.succeed("${lib.getExe php} -f ${pcreJitSeallocForkIssue}")
     '';
 }
diff --git a/nixos/tests/systemd-boot.nix b/nixos/tests/systemd-boot.nix
index c2d9131f1974..e001f11ce3a3 100644
--- a/nixos/tests/systemd-boot.nix
+++ b/nixos/tests/systemd-boot.nix
@@ -460,6 +460,9 @@ in
       nodes.machine = common;
 
       testScript =
+        let
+          oldVersion = "222";
+        in
         # python
         ''
           machine.succeed("mount -o remount,rw /boot")
@@ -469,13 +472,13 @@ in
               machine.succeed(
                 """
                 find /boot -iname '*boot*.efi' -print0 | \
-                xargs -0 -I '{}' sed -i 's/#### LoaderInfo: systemd-boot .* ####/#### LoaderInfo: systemd-boot 000.0-1-notnixos ####/' '{}'
+                xargs -0 -I '{}' sed -i 's/#### LoaderInfo: systemd-boot .* ####/#### LoaderInfo: systemd-boot ${oldVersion} ####/' '{}'
                 """
               )
               return machine.succeed("/run/current-system/bin/switch-to-configuration boot 2>&1")
 
           output = switch()
-          assert "updating systemd-boot from 000.0-1-notnixos to " in output, "Couldn't find systemd-boot update message"
+          assert "updating systemd-boot from ${oldVersion} to " in output, "Couldn't find systemd-boot update message"
           assert 'to "/boot/EFI/systemd/systemd-bootx64.efi"' in output, "systemd-boot not copied to to /boot/EFI/systemd/systemd-bootx64.efi"
           assert 'to "/boot/EFI/BOOT/BOOTX64.EFI"' in output, "systemd-boot not copied to to /boot/EFI/BOOT/BOOTX64.EFI"
 
@@ -486,7 +489,7 @@ in
                   "mv /boot/EFI/BOOT/bootx64.efi.new /boot/EFI/BOOT/bootx64.efi",
               )
               output = switch()
-              assert "updating systemd-boot from 000.0-1-notnixos to " in output, "Couldn't find systemd-boot update message"
+              assert "updating systemd-boot from ${oldVersion} to " in output, "Couldn't find systemd-boot update message"
               assert 'to "/boot/EFI/systemd/systemd-bootx64.efi"' in output, "systemd-boot not copied to to /boot/EFI/systemd/systemd-bootx64.efi"
               assert 'to "/boot/EFI/BOOT/BOOTX64.EFI"' in output, "systemd-boot not copied to to /boot/EFI/BOOT/BOOTX64.EFI"
         '';
diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/copilot/package.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/copilot/package.nix
index 07bf31827567..555fba45c2d8 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/copilot/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/copilot/package.nix
@@ -12,13 +12,13 @@
 }:
 melpaBuild (finalAttrs: {
   pname = "copilot";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "copilot-emacs";
     repo = "copilot.el";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-1uHPtz0F0pim7KlotB1+pmls1i7H3hRhZ0DX1h53cPc=";
+    sha256 = "sha256-l4TR3mk72j2VRN8s6DmlT+I5Ii2FgPEG62KKHql40L8=";
   };
 
   files = ''(:defaults "dist")'';
diff --git a/pkgs/applications/editors/vscode/extensions/kilocode.kilo-code/default.nix b/pkgs/applications/editors/vscode/extensions/kilocode.kilo-code/default.nix
index 31fc7cf075b7..e8d4b1b9ce98 100644
--- a/pkgs/applications/editors/vscode/extensions/kilocode.kilo-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/kilocode.kilo-code/default.nix
@@ -12,26 +12,26 @@ vscode-utils.buildVscodeMarketplaceExtension {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-YeF6LyQzVAXgZ5Iqr6YvNcACfiUukUsq7cybeCQdSYc=";
+          hash = "sha256-uPmJyEq7X6uJzE1M5Xywax1mrnTcg6jOb9MlpKZ0WRk=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-SjirNvI83eh3Gt5rGsaiLT6TJMH6LRQAasOFNy9OMCY=";
+          hash = "sha256-oEVt3VbRUPD4tfQs0EU7RX6671fCJiMi38wF+76RzZI=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-FjE3xTp5Mj1584bepVc4nZr3rxCR3CV+jplmA45VF44=";
+          hash = "sha256-b46f0f99rjBivewC9jUbAFiKK+DS1XKv+AynUlKHliw=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-SAf3+0QSFUDq09AZQnw78ps55RM/RwoAeQuVly7vn10=";
+          hash = "sha256-yBJjt53eOazV9FB8qimerwXTX4vCIPC+lyXtau/3FyI=";
         };
       };
     in
     {
       publisher = "kilocode";
       name = "Kilo-Code";
-      version = "7.2.20";
+      version = "7.3.53";
     }
     // sources.${stdenv.hostPlatform.system}
       or (throw "Unsupported system ${stdenv.hostPlatform.system}");
diff --git a/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
index b03efaaac854..d1c2cd86f006 100644
--- a/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
@@ -11,7 +11,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     name = "tinymist";
     publisher = "myriad-dreamin";
     inherit (tinymist) version;
-    hash = "sha256-7kpW5EYOFsnib5i5xVcywgM82I0Ey/2mjC/LAjFy8qM=";
+    hash = "sha256-FLWUeRPoqzHjwBrf0OOejaAVY+KBOpNBb9OJMdfLr04=";
   };
 
   __structuredAttrs = true;
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 017ea2623f71..10c8f7e39e53 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1058,11 +1058,11 @@
     "vendorHash": null
   },
   "oracle_oci": {
-    "hash": "sha256-SFs0BYaYgB4J/HbaYFx1Sh1raVWhRJdW/3KMWdyvX+I=",
+    "hash": "sha256-ByAuY0y7tpzeaHmf1VTpvVUzRFxhuS49g57XqJ4Mnuk=",
     "homepage": "https://registry.terraform.io/providers/oracle/oci",
     "owner": "oracle",
     "repo": "terraform-provider-oci",
-    "rev": "v8.18.0",
+    "rev": "v8.19.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1436,13 +1436,13 @@
     "vendorHash": "sha256-lWBMihP6oX7qPpTuPQQwQS3IDwdyb/rEYqtBsTozb7Q="
   },
   "venafi_venafi": {
-    "hash": "sha256-WOCZRVAYVR9uzsyyAvCQvYReaas6YmZsbRgxxxhDF/k=",
+    "hash": "sha256-oEyrnKMe+cMLSajI2wxkjXfHySM198NviiSqX0hGduk=",
     "homepage": "https://registry.terraform.io/providers/Venafi/venafi",
     "owner": "Venafi",
     "repo": "terraform-provider-venafi",
-    "rev": "v0.23.2",
+    "rev": "v0.24.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-rqDzBez3HvhG+xvEyQ6foq/m0sFyyqrioquY9mcuWOU="
+    "vendorHash": "sha256-UnC3dob6idNgitHo4uGs1BPb3T7UQTR8wAJ2faYVvhE="
   },
   "vinyldns_vinyldns": {
     "hash": "sha256-/M+HFMDeKpIzzdn04TkMxriVeE6vvORRiqonxF38B9Q=",
diff --git a/pkgs/by-name/am/amp-cli/package.nix b/pkgs/by-name/am/amp-cli/package.nix
index 9d550582c9d3..d74fdc80035b 100644
--- a/pkgs/by-name/am/amp-cli/package.nix
+++ b/pkgs/by-name/am/amp-cli/package.nix
@@ -27,7 +27,7 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "amp-cli";
-  version = "0.0.1781370323-g977781";
+  version = "0.0.1782120930-g64087b";
 
   src = finalAttrs.passthru.sources.${stdenvNoCC.hostPlatform.system};
 
@@ -78,10 +78,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         url = "https://static.ampcode.com/cli/${finalAttrs.version}/amp-${platform}.gz";
         hash =
           {
-            x86_64-linux = "sha256-taXa0AE0re6IoUxr/Sa7Os/pt/u0Zm+eCxRbRW019fA=";
-            aarch64-linux = "sha256-gFfgGlFB+HpV+KAitpOtXu2ij7hQYmxzm8gzy+l79us=";
-            x86_64-darwin = "sha256-1L+J9i/y5fg2rySOfAZySnBbqgmxpM7+7h9CoREI14s=";
-            aarch64-darwin = "sha256-1I7roExnTQFjByVDDr6ym3X+70Ba9IVE9vxBHVlJQIY=";
+            x86_64-linux = "sha256-Ye1ch/mmhFelSv77Yy+fbpiBUlXzInACp2Hux+CLQzk=";
+            aarch64-linux = "sha256-cGV6tqiaHDjSCjhlSgAf0wIcOXY0Y78G2IT0ZQ5uuNk=";
+            x86_64-darwin = "sha256-5UmALYPSfUceumD4puKbMY+VwUsmAojHuu3pNXxVOr4=";
+            aarch64-darwin = "sha256-zzpPWKfYHAEXLNvAucVOwm0HE8Ui3Ai31XMs+utlXF4=";
           }
           .${system'};
       }
diff --git a/pkgs/by-name/bl/blocky/package.nix b/pkgs/by-name/bl/blocky/package.nix
index 0c5d680dc1ea..e468ac4bd49b 100644
--- a/pkgs/by-name/bl/blocky/package.nix
+++ b/pkgs/by-name/bl/blocky/package.nix
@@ -7,20 +7,20 @@
 
 buildGoModule (finalAttrs: {
   pname = "blocky";
-  version = "0.31.0";
+  version = "0.32.1";
 
   src = fetchFromGitHub {
     owner = "0xERR0R";
     repo = "blocky";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-qFGJaShWplvZo/uKRjizWWeb/OzLJCoL9YTRsKWTriY=";
+    hash = "sha256-/gkEP7UylJQ079W1n7QaAF8EngWTSF8YbzPN3L+Ru5U=";
   };
 
   # needs network connection and fails at
   # https://github.com/0xERR0R/blocky/blob/development/resolver/upstream_resolver_test.go
   doCheck = false;
 
-  vendorHash = "sha256-EsGaY3U6bHjQTj+rLRtjiQJoNP5WnP7/gZ2NrRX53b0=";
+  vendorHash = "sha256-atsq9nSfuchtyeX9P7dV3wmEj8k9G9aZQSZxieX7mx0";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/br/breaktimer/disable-auto-update.patch b/pkgs/by-name/br/breaktimer/disable-auto-update.patch
new file mode 100644
index 000000000000..2af3ab9a14e3
--- /dev/null
+++ b/pkgs/by-name/br/breaktimer/disable-auto-update.patch
@@ -0,0 +1,89 @@
+diff --git a/app/main/index.ts b/app/main/index.ts
+index 96921cb..f6ce034 100644
+--- a/app/main/index.ts
++++ b/app/main/index.ts
+@@ -1,11 +1,9 @@
+-import { app, shell } from "electron";
++import { app } from "electron";
+ import electronDebug from "electron-debug";
+ import log from "electron-log";
+-import { autoUpdater } from "electron-updater";
+ import { setAutoLauch } from "./lib/auto-launch";
+ import { initBreaks } from "./lib/breaks";
+ import "./lib/ipc";
+-import { showNotification } from "./lib/notifications";
+ import { getAppInitialized } from "./lib/store";
+ import { initTray } from "./lib/tray";
+ import { createSettingsWindow, createSoundsWindow } from "./lib/windows";
+@@ -29,62 +27,6 @@ if (!gotTheLock) {
+   app.exit();
+ }
+ 
+-function getDownloadUrl(): string {
+-  switch (process.platform) {
+-    case "win32":
+-      return "https://github.com/tom-james-watson/breaktimer-app/releases/latest/download/BreakTimer.exe";
+-    case "linux":
+-      return "https://github.com/tom-james-watson/breaktimer-app/releases/latest";
+-    default:
+-      throw new Error("Download URL should not be called for macOS");
+-  }
+-}
+-
+-function shouldAutoInstall(): boolean {
+-  const isMac = process.platform === "darwin";
+-  const isLinux = process.platform === "linux";
+-
+-  return isMac || isLinux;
+-}
+-
+-function checkForUpdates(): void {
+-  log.info("Checking for updates...");
+-  autoUpdater.logger = log;
+-
+-  autoUpdater.on("error", (error) => {
+-    log.error(`Auto updater error: ${error}`);
+-  });
+-
+-  if (shouldAutoInstall()) {
+-    autoUpdater.checkForUpdatesAndNotify().catch((error) => {
+-      log.error(`Unable to run auto updater: ${error}`);
+-    });
+-  } else {
+-    autoUpdater.autoDownload = false;
+-
+-    autoUpdater.on("update-available", (info) => {
+-      log.info("Update available:", info);
+-
+-      const downloadUrl = getDownloadUrl();
+-
+-      showNotification(
+-        "Update Available",
+-        "A new version of BreakTimer is available. Click to download.",
+-        () => {
+-          shell.openExternal(downloadUrl).catch((error) => {
+-            log.error(`Failed to open download URL: ${error}`);
+-          });
+-        },
+-        false,
+-      );
+-    });
+-
+-    autoUpdater.checkForUpdates().catch((error) => {
+-      log.error(`Unable to check for updates: ${error}`);
+-    });
+-  }
+-}
+-
+ if (process.env.NODE_ENV === "production") {
+   const sourceMapSupport = require("source-map-support");
+   sourceMapSupport.install();
+@@ -146,8 +88,4 @@ app.on("ready", async () => {
+   initBreaks();
+   initTray();
+   createSoundsWindow();
+-
+-  if (process.env.NODE_ENV !== "development") {
+-    checkForUpdates();
+-  }
+ });
diff --git a/pkgs/by-name/br/breaktimer/package.nix b/pkgs/by-name/br/breaktimer/package.nix
new file mode 100644
index 000000000000..9fd129c237fc
--- /dev/null
+++ b/pkgs/by-name/br/breaktimer/package.nix
@@ -0,0 +1,140 @@
+{
+  lib,
+  stdenv,
+  buildNpmPackage,
+  copyDesktopItems,
+  electron_40,
+  fetchFromGitHub,
+  jq,
+  makeDesktopItem,
+  makeWrapper,
+  nix-update-script,
+  nodejs_24,
+}:
+
+let
+  electron = electron_40;
+  nodejs = nodejs_24;
+  description = "Cross-platform desktop app for managing periodic breaks";
+in
+buildNpmPackage rec {
+  pname = "breaktimer";
+  version = "2.1.0";
+
+  src = fetchFromGitHub {
+    owner = "tom-james-watson";
+    repo = "breaktimer-app";
+    tag = "v${version}";
+    hash = "sha256-STDb6+brlVk/ZPUbw3cQOpe2r03WlFKEBgVLqJrsrHI=";
+  };
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  # electron-updater's auto-install path tries to download a new release
+  # from GitHub and overwrite the nix-store binary, which is read-only.
+  # Updates come via nix instead.
+  patches = [ ./disable-auto-update.patch ];
+
+  # The package ships a lockfile (package-lock.json) but the default
+  # `npm run build` is run via `concurrently`; we drive the build manually.
+  dontNpmBuild = true;
+
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+
+  npmDepsHash = "sha256-UL8e0UKZKhHHC+JvRpmcdBvFHlCdn3YknceVJ+knMgg=";
+
+  nativeBuildInputs = [
+    jq
+    nodejs
+    makeWrapper
+    copyDesktopItems
+  ];
+
+  preBuild = ''
+    if [[ $(jq --raw-output '.devDependencies.electron' < package.json | grep -E --only-matching '\^[0-9]+' | sed -e 's/\^//') != ${lib.escapeShellArg (lib.versions.major electron.version)} ]]; then
+      echo 'ERROR: electron version mismatch'
+      exit 1
+    fi
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    npm run build
+
+    # electron-builder needs to mutate the copied Electron.app, which is
+    # read-only in the nix store. Copy it to a writable location first.
+    cp -r ${electron.dist} electron-dist
+    chmod -R u+w electron-dist
+
+    # Produce an unpacked Electron app without code-signing / notarisation.
+    npm exec electron-builder -- \
+      --dir \
+      --c.electronDist=electron-dist \
+      --c.electronVersion=${electron.version} \
+      --c.mac.identity=null \
+      --c.mac.notarize=false
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
+    unpacked="release/linux-${lib.optionalString stdenv.hostPlatform.isAarch64 "arm64-"}unpacked"
+
+    mkdir -p "$out/share/lib/breaktimer"
+    cp -r "$unpacked"/{locales,resources{,.pak}} "$out/share/lib/breaktimer"
+
+    makeWrapper '${lib.getExe electron}' "$out/bin/breaktimer" \
+      --add-flags "$out/share/lib/breaktimer/resources/app.asar" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=UseOzonePlatform,WaylandWindowDecorations,WebRTCPipeWireCapturer}}" \
+      --set-default ELECTRON_IS_DEV 0 \
+      --inherit-argv0
+
+    install -Dm644 resources/icon.png \
+      "$out/share/icons/hicolor/512x512/apps/breaktimer.png"
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    mkdir -p "$out/Applications"
+    cp -R release/mac-*/BreakTimer.app "$out/Applications/"
+
+    mkdir -p "$out/bin"
+    makeWrapper \
+      "$out/Applications/BreakTimer.app/Contents/MacOS/BreakTimer" \
+      "$out/bin/breaktimer" \
+      --set-default ELECTRON_IS_DEV 0
+  ''
+  + ''
+    runHook postInstall
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "breaktimer";
+      exec = "breaktimer";
+      icon = "breaktimer";
+      comment = description;
+      desktopName = "BreakTimer";
+      genericName = "Break Reminder";
+      categories = [
+        "Utility"
+        "Office"
+      ];
+    })
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    inherit description;
+    homepage = "https://github.com/tom-james-watson/breaktimer-app";
+    changelog = "https://github.com/tom-james-watson/breaktimer-app/releases/tag/v${version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ proitheus ];
+    mainProgram = "breaktimer";
+    platforms = electron.meta.platforms;
+  };
+}
diff --git a/pkgs/by-name/co/convertx/package.nix b/pkgs/by-name/co/convertx/package.nix
index 153ab012903a..49dd77cf384f 100644
--- a/pkgs/by-name/co/convertx/package.nix
+++ b/pkgs/by-name/co/convertx/package.nix
@@ -1,5 +1,5 @@
 {
-  stdenv,
+  stdenvNoCC,
   lib,
   fetchFromGitHub,
 
@@ -43,11 +43,12 @@ let
     hash = pin.srcHash;
   };
 
-  node_modules = stdenv.mkDerivation (finalAttrs: {
+  node_modules = stdenvNoCC.mkDerivation (finalAttrs: {
     pname = "${pname}-node_modules";
     inherit version src;
 
     dontConfigure = true;
+    dontFixup = true;
 
     nativeBuildInputs = [
       bun
@@ -70,11 +71,11 @@ let
       cp package.json $out/lib
     '';
 
-    outputHash = pin."${stdenv.system}";
+    outputHash = pin."${stdenvNoCC.system}";
     outputHashMode = "recursive";
   });
 in
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   inherit pname version src;
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/co/convertx/pin.json b/pkgs/by-name/co/convertx/pin.json
index 1fc9e21d094a..928e63882b97 100644
--- a/pkgs/by-name/co/convertx/pin.json
+++ b/pkgs/by-name/co/convertx/pin.json
@@ -1,6 +1,6 @@
 {
-  "version": "0.17.0",
-  "srcHash": "sha256-1W7M9BfAh89ntmJW7tNwydwPCkVy5CoddWb2aPPUFds=",
-  "x86_64-linux": "sha256-7B4ZGGew6isFnz7EoaLyJgO6a66V9ZTKsKxXwVSsnfs=",
-  "aarch64-linux": "sha256-IoQP9UBd64qecOwmI8oQREgiYCL2pXGjfVx1Ylvd/WA="
+  "version": "0.18.0",
+  "srcHash": "sha256-S8oUU21VOy+4MiWvnEBOSUBuMysYq9H4tQIcEOvLjKw=",
+  "x86_64-linux": "sha256-rAZROhjbvGg/7aRPlh6yGmPDmbEsYjDHJEVaWXejxts=",
+  "aarch64-linux": "sha256-yJbwexqwe95XIZ51gbjwpg6cRm5ssJl1qrIS+Vrd+vo="
 }
diff --git a/pkgs/by-name/cp/cpcm-x/cmake-config-find-numsa.patch b/pkgs/by-name/cp/cpcm-x/cmake-config-find-numsa.patch
new file mode 100644
index 000000000000..3e54583533ff
--- /dev/null
+++ b/pkgs/by-name/cp/cpcm-x/cmake-config-find-numsa.patch
@@ -0,0 +1,15 @@
+diff --git a/config/config.cmake.in b/config/config.cmake.in
+index e5e4f6b..d41c070 100644
+--- a/config/config.cmake.in
++++ b/config/config.cmake.in
+@@ -23,6 +23,10 @@ if(NOT TARGET "@PROJECT_NAME@::@PROJECT_NAME@")
+ 
+   include(CMakeFindDependencyMacro)
+ 
++  if(NOT TARGET "numsa::numsa")
++    find_dependency("numsa" REQUIRED)
++  endif()
++
+   if(NOT TARGET "mctc-lib::mctc-lib")
+     find_dependency("mctc-lib" REQUIRED)
+   endif()
diff --git a/pkgs/by-name/cp/cpcm-x/package.nix b/pkgs/by-name/cp/cpcm-x/package.nix
new file mode 100644
index 000000000000..99484edfc1d2
--- /dev/null
+++ b/pkgs/by-name/cp/cpcm-x/package.nix
@@ -0,0 +1,107 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+
+  buildType ? "meson",
+
+  gfortran,
+  pkg-config,
+  python3,
+  meson,
+  ninja,
+  cmake,
+
+  # buildInputs
+  blas,
+  lapack,
+  test-drive,
+
+  # propagatedBuildInputs
+  mctc-lib,
+  numsa,
+  toml-f,
+
+  nix-update-script,
+}:
+
+assert (
+  builtins.elem buildType [
+    "meson"
+    "cmake"
+  ]
+);
+stdenv.mkDerivation (finalAttrs: {
+  pname = "cpcm-x";
+  version = "1.1.0";
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "grimme-lab";
+    repo = "CPCM-X";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-FyPUECbcqUHoGq1LASvPF4qSUKQ5N/y1itq8e2wGliE=";
+  };
+
+  patches = [
+    # The installed CMake package config links numsa::numsa transitively but
+    # never re-discovers it, so consumers fail with "target numsa::numsa not
+    # found". Add the missing find_dependency call.
+    ./cmake-config-find-numsa.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace config/install-mod.py \
+      --replace-fail "/usr/bin/env python" "${lib.getExe python3}"
+  '';
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  nativeBuildInputs = [
+    gfortran
+    pkg-config
+    python3
+  ]
+  ++ lib.optionals (buildType == "meson") [
+    meson
+    ninja
+  ]
+  ++ lib.optionals (buildType == "cmake") [
+    cmake
+  ];
+
+  buildInputs = [
+    blas
+    lapack
+    # only needed to build the bundled test suite
+    test-drive
+  ];
+
+  propagatedBuildInputs = [
+    mctc-lib
+    numsa
+    toml-f
+  ];
+
+  doCheck = true;
+
+  preCheck = ''
+    export OMP_NUM_THREADS=2
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Extended conductor-like polarizable continuum solvation model";
+    homepage = "https://github.com/grimme-lab/CPCM-X";
+    changelog = "https://github.com/grimme-lab/CPCM-X/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.lgpl3;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    mainProgram = "cpx";
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/da/dalfox/package.nix b/pkgs/by-name/da/dalfox/package.nix
index a27763c913dc..d3d0492acfb9 100644
--- a/pkgs/by-name/da/dalfox/package.nix
+++ b/pkgs/by-name/da/dalfox/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "dalfox";
-  version = "3.1.0";
+  version = "3.1.1";
 
   src = fetchFromGitHub {
     owner = "hahwul";
     repo = "dalfox";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QV2+eKTMuvt//krGrPrjViIsLiog5i4bzhgq8lgHvR0=";
+    hash = "sha256-V+5/+UYj9Pd727olIOwXij/XUh2NMzGHQDuupTO9DMk=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/df/dftd4/package.nix b/pkgs/by-name/df/dftd4/package.nix
index 0b2c5944035c..c58a7400c404 100644
--- a/pkgs/by-name/df/dftd4/package.nix
+++ b/pkgs/by-name/df/dftd4/package.nix
@@ -27,11 +27,13 @@ assert (
 stdenv.mkDerivation (finalAttrs: {
   pname = "dftd4";
   version = "4.2.0";
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src = fetchFromGitHub {
     owner = "dftd4";
     repo = "dftd4";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-uKjNOIza3/I0oREp88oFESoNqEdumo1AztIjcrVb1O8=";
   };
 
@@ -85,6 +87,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Generally Applicable Atomic-Charge Dependent London Dispersion Correction";
+    changelog = "https://github.com/dftd4/dftd4/releases/tag/${finalAttrs.src.tag}";
     mainProgram = "dftd4";
     license = with lib.licenses; [
       lgpl3Plus
diff --git a/pkgs/by-name/fe/fence/package.nix b/pkgs/by-name/fe/fence/package.nix
index d71b14fe1a0f..fc4007422868 100644
--- a/pkgs/by-name/fe/fence/package.nix
+++ b/pkgs/by-name/fe/fence/package.nix
@@ -14,16 +14,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "fence";
-  version = "0.1.60";
+  version = "0.1.61";
 
   src = fetchFromGitHub {
     owner = "fencesandbox";
     repo = "fence";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4yRfU6fCTGOcA9IeFs9Sk9n1PqXi7E++reVDPlCwS1k=";
+    hash = "sha256-/IVxTPgAzl+mX85M1IyD+21O8j/tIxt2a18TLtQz/zk=";
   };
 
-  vendorHash = "sha256-rZ+ArTdr5GbW+nRzglNgxzsXjuTlTA0uInNWXgAVurM=";
+  vendorHash = "sha256-aMxay3dow6mDKyv396R0j1GOKDmhkX4ebGmhca1B4WE=";
 
   __structuredAttrs = true;
 
diff --git a/pkgs/by-name/ff/ffmpeg-normalize/package.nix b/pkgs/by-name/ff/ffmpeg-normalize/package.nix
index 0965b2e24413..c60497ee3e1a 100644
--- a/pkgs/by-name/ff/ffmpeg-normalize/package.nix
+++ b/pkgs/by-name/ff/ffmpeg-normalize/package.nix
@@ -7,13 +7,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "ffmpeg-normalize";
-  version = "1.37.8";
+  version = "1.38.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = "ffmpeg_normalize";
-    hash = "sha256-9pSVrYTTaxjGCty2pHPtaaSSwCkGDLoNK2wltTwOL3c=";
+    hash = "sha256-qn0E2AxadOvj80rAJ+i8vyGyid8/JD0wPSKMJbM8oX0=";
   };
 
   build-system = with python3Packages; [ uv-build ];
diff --git a/pkgs/by-name/fi/firewalld/package.nix b/pkgs/by-name/fi/firewalld/package.nix
index 6e3e18fcb0d2..613a72ead79a 100644
--- a/pkgs/by-name/fi/firewalld/package.nix
+++ b/pkgs/by-name/fi/firewalld/package.nix
@@ -80,6 +80,7 @@ stdenv.mkDerivation (finalAttrs: {
     docbook_xml_dtd_42
     docbook-xsl-nons
     glib
+    gobject-introspection
     intltool
     libxml2
     libxslt
@@ -94,7 +95,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     glib
-    gobject-introspection
     ipset
     iptables
     kmod
diff --git a/pkgs/by-name/gl/globalping-cli/package.nix b/pkgs/by-name/gl/globalping-cli/package.nix
index 2fc6d470840f..a4224f4e4a3c 100644
--- a/pkgs/by-name/gl/globalping-cli/package.nix
+++ b/pkgs/by-name/gl/globalping-cli/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "globalping-cli";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "jsdelivr";
     repo = "globalping-cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-muWhiKqPdNVhy7c7MSRHACGzOn5pIVRdqSdfdCJw2CA=";
+    hash = "sha256-MaqBaR177gcgoqEpsER1+8oYZmiGeySfL/O9r6CxqCY=";
   };
 
-  vendorHash = "sha256-dJAuN5srL5EvMaRg8rHaTsurjYrdH45p965DeubpB0E=";
+  vendorHash = "sha256-7fhcQptMyq8IuRaqx3Znc9QFLaV0t6HpM4eCtdimupA=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/go/gogcli/package.nix b/pkgs/by-name/go/gogcli/package.nix
index 5d7d9c06b5d6..950513c2261c 100644
--- a/pkgs/by-name/go/gogcli/package.nix
+++ b/pkgs/by-name/go/gogcli/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gogcli";
-  version = "0.11.0";
+  version = "0.29.0";
 
   src = fetchFromGitHub {
     owner = "steipete";
     repo = "gogcli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hJU40ysjRx4p9SWGmbhhpToYCpk3DcMAWCnKqxHRmh0=";
+    hash = "sha256-JunPpEzbNp00uEiJ7AzouXyzFwyNLehLU7mwL3eh4bM=";
   };
 
-  vendorHash = "sha256-WGRlv3UsK3SVBQySD7uZ8+FiRl03p0rzjBm9Se1iITs=";
+  vendorHash = "sha256-JrRIUYpw2lAD0ezi0HTZvS42OS7vP8DAHU3m0u3eCbM=";
 
   subPackages = [ "cmd/gog" ];
 
diff --git a/pkgs/by-name/jj/jj-vine/package.nix b/pkgs/by-name/jj/jj-vine/package.nix
index 6287241df882..17ef577e9285 100644
--- a/pkgs/by-name/jj/jj-vine/package.nix
+++ b/pkgs/by-name/jj/jj-vine/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "jj-vine";
-  version = "0.5.0";
+  version = "0.5.3";
 
   src = fetchFromCodeberg {
     owner = "abrenneke";
     repo = "jj-vine";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uvnSv+4ijVdBoHrOklDRY+JDLsVOTRu+laOcFMjkYaA=";
+    hash = "sha256-dUamfoMtdDNz9xmXeg1O1j5UHW6uF/1WznHSsG+eVjs=";
   };
 
-  cargoHash = "sha256-TsyFWcvr8ksiC1vStWs+mH88lw1/JGRg8IQ7XFnZ5qg=";
+  cargoHash = "sha256-nuj0cugeK5oc+sZmm1f5dvGEjML0qkle5uO66e54VIY=";
 
   nativeCheckInputs = [
     jujutsu
diff --git a/pkgs/by-name/ju/just/package.nix b/pkgs/by-name/ju/just/package.nix
index acab33ada1e8..de3091c0dbd5 100644
--- a/pkgs/by-name/ju/just/package.nix
+++ b/pkgs/by-name/ju/just/package.nix
@@ -17,7 +17,7 @@
   withDocumentation ? stdenv.buildPlatform.canExecute stdenv.hostPlatform,
 }:
 let
-  version = "1.53.0";
+  version = "1.54.0";
 in
 rustPlatform.buildRustPackage {
   inherit version;
@@ -36,10 +36,10 @@ rustPlatform.buildRustPackage {
     owner = "casey";
     repo = "just";
     tag = version;
-    hash = "sha256-+/G5fIPBl9NoDL0i9y67tjccte75yMT84pqsCWropws=";
+    hash = "sha256-sWEelwKEuxJUTh2Ejwr7e29j5EFVCSiQJoLCEH60PxI=";
   };
 
-  cargoHash = "sha256-Rwv10c487qOf6nH/Nj8rcfMLHRm8RaA5OYOh5p27rtM=";
+  cargoHash = "sha256-+eUi0g+ObJhlXhRLmWfRmTlnoxHHVdzTtXdX8LNloIc=";
 
   nativeBuildInputs =
     lib.optionals (installShellCompletions || installManPages) [ installShellFiles ]
diff --git a/pkgs/by-name/kd/kde-rounded-corners/package.nix b/pkgs/by-name/kd/kde-rounded-corners/package.nix
index adde7bfc8e3b..a569c0ca6d9b 100644
--- a/pkgs/by-name/kd/kde-rounded-corners/package.nix
+++ b/pkgs/by-name/kd/kde-rounded-corners/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kde-rounded-corners";
-  version = "0.8.7";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "matinlotfali";
     repo = "KDE-Rounded-Corners";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ivWOMl0cveJHC6eX/QYteVi2GaRJ/2j02YlDj/Uvs1s=";
+    hash = "sha256-JZlrjVjA2OGZhWpkSYvwYpPx4tmqlMvi4cP4zM4hxFc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ko/kopia-ui/package.nix b/pkgs/by-name/ko/kopia-ui/package.nix
index 68f8fe86a3dc..e32b5af7e61b 100644
--- a/pkgs/by-name/ko/kopia-ui/package.nix
+++ b/pkgs/by-name/ko/kopia-ui/package.nix
@@ -10,12 +10,12 @@
   kopia,
 }:
 let
-  version = "0.23.0";
+  version = "0.23.1";
   src = fetchFromGitHub {
     owner = "kopia";
     repo = "kopia";
     tag = "v${version}";
-    hash = "sha256-9xvgm+A8h2pAX3oHtiFSa2xNab5BDkEBEtXQZz3Fd5A=";
+    hash = "sha256-yjeLV7N/U88oVdP4iJYgSM/QJLAMREaB/2jBcbTDWkA=";
   };
 in
 buildNpmPackage {
@@ -24,7 +24,7 @@ buildNpmPackage {
 
   sourceRoot = "${src.name}/app";
 
-  npmDepsHash = "sha256-Ctp41vNZPVbycwIzWiTh+1ej3NpCf1WJCqnJsyoyxlc=";
+  npmDepsHash = "sha256-yj5+qiLfy6CjAOXIzT9OMu860Pefwn+HuJNoBAizb/0=";
   makeCacheWritable = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ku/kubectl-gadget/package.nix b/pkgs/by-name/ku/kubectl-gadget/package.nix
index 20047fda5c07..7508162ad206 100644
--- a/pkgs/by-name/ku/kubectl-gadget/package.nix
+++ b/pkgs/by-name/ku/kubectl-gadget/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubectl-gadget";
-  version = "0.52.0";
+  version = "0.53.2";
 
   src = fetchFromGitHub {
     owner = "inspektor-gadget";
     repo = "inspektor-gadget";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WcIPubDzj3LPf1KUWfmxdlBGnG2x68hax/ZQKwSNifc=";
+    hash = "sha256-Mfj2Slgeo5v5NNg3qj8v0eFg35jishtk5bEt+IxA1xc=";
   };
 
-  vendorHash = "sha256-aEzzXcsM3D+Sp6LBms5+RzWirdC5iFvN2IiwbOXCrEw=";
+  vendorHash = "sha256-u4kEi/H8vdIV6bS/R76H09m7dh1YR8pUD8ZOQ23VhHU=";
 
   env.CGO_ENABLED = 0;
 
diff --git a/pkgs/by-name/ku/kubevirt/package.nix b/pkgs/by-name/ku/kubevirt/package.nix
index ef233f4fb9b5..660fd8893edf 100644
--- a/pkgs/by-name/ku/kubevirt/package.nix
+++ b/pkgs/by-name/ku/kubevirt/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubevirt";
-  version = "1.8.2";
+  version = "1.8.4";
 
   src = fetchFromGitHub {
     owner = "kubevirt";
     repo = "kubevirt";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-YSrMJz0L0Ybw5G6p42YAMMa1D1xc9G8sBLdxjxz3axg=";
+    hash = "sha256-4MQtONb8opLDBLtGr+5oDrOQkkK1q4RlMXDcqyilarM=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/li/linux-firmware/package.nix b/pkgs/by-name/li/linux-firmware/package.nix
index f26f8e593019..6019480aed92 100644
--- a/pkgs/by-name/li/linux-firmware/package.nix
+++ b/pkgs/by-name/li/linux-firmware/package.nix
@@ -23,13 +23,13 @@ let
 in
 stdenvNoCC.mkDerivation rec {
   pname = "linux-firmware";
-  version = "20260519";
+  version = "20260622";
 
   src = fetchFromGitLab {
     owner = "kernel-firmware";
     repo = "linux-firmware";
     tag = version;
-    hash = "sha256-vyrnHNnyNko7m/fZ3fXgLvvasYyJ/pzs5be/Ele+6vY=";
+    hash = "sha256-nSoJhgI4hAxtNmnj5M6ticzuBSt9uNAYcmc1VR/yXxE=";
   };
 
   postUnpack = ''
diff --git a/pkgs/by-name/mu/mujoco/mujoco-system-deps-dont-fetch.patch b/pkgs/by-name/mu/mujoco/mujoco-system-deps-dont-fetch.patch
index 010c78da81c5..b6d360c0949f 100644
--- a/pkgs/by-name/mu/mujoco/mujoco-system-deps-dont-fetch.patch
+++ b/pkgs/by-name/mu/mujoco/mujoco-system-deps-dont-fetch.patch
@@ -84,6 +84,15 @@ index d2404bc1..5c7ddaf6 100644
    TARGETS
    ccd
    EXCLUDE_FROM_ALL
+@@ -256,8 +256,6 @@ set(BUILD_TESTS OFF)
+ set(BUILD_TESTS OFF)
+ fetchpackage(
+   PACKAGE_NAME  miniz
+-  GIT_REPO      https://github.com/richgel999/miniz.git
+-  GIT_TAG       ${MUJOCO_DEP_VERSION_miniz}
+   TARGETS       miniz
+ )
+ if(_BUILD_TESTS_WAS_DEFINED)
 @@ -261,10 +241,6 @@ if(MUJOCO_BUILD_TESTS OR MUJOCO_BUILD_STUDIO OR MUJOCO_USE_FILAMENT)
      absl
      LIBRARY_NAME
diff --git a/pkgs/by-name/mu/mujoco/package.nix b/pkgs/by-name/mu/mujoco/package.nix
index 6b2f93e71eae..b437d8e69259 100644
--- a/pkgs/by-name/mu/mujoco/package.nix
+++ b/pkgs/by-name/mu/mujoco/package.nix
@@ -20,14 +20,14 @@ let
     abseil-cpp = fetchFromGitHub {
       owner = "abseil";
       repo = "abseil-cpp";
-      rev = "255c84dadd029fd8ad25c5efb5933e47beaa00c7";
-      hash = "sha256-TJT2Kzc64zI42FAbbGWP3Sshh1dU/D/AtEpgZrrhebg=";
+      rev = "5650e9cf76d3be4318d5fa3af38ee483ddfd5e4a";
+      hash = "sha256-O9ClnGm4WSTX3g1Q2VYTMhUtGG52XBwxzgHtWW9WSG0=";
     };
     benchmark = fetchFromGitHub {
       owner = "google";
       repo = "benchmark";
-      rev = "5c55f5d4f45a1b09c5d98aa63a671993ebd42c69";
-      hash = "sha256-CChXn58cqam3d6Q61ZJMr5NFq1Ezc5uywA7FSPhk4GI=";
+      rev = "834a61fc65e8b7885fcf177f1230ae4b897118fa";
+      hash = "sha256-V5pVCG5QdFlgBIVKMv4jyTTB22BWfTHD3HolVPDFpgQ=";
     };
     ccd = fetchFromGitHub {
       owner = "danfis";
@@ -38,8 +38,8 @@ let
     eigen3 = fetchFromGitLab {
       owner = "libeigen";
       repo = "eigen";
-      rev = "75bcd155c40cb48e647c87c3f29052360255bc9e";
-      hash = "sha256-ZBm3ac6Kt7gOqNip6PeNNMiOF0fwG+7PJYA47KT0ogI=";
+      rev = "ea13a98decd497a8c5588fb5de71b57bcf10d864";
+      hash = "sha256-v9bNWc9yfK3vG8hYhQ7vkc7DHaoPF6RAKfX9kC0Gw8c=";
     };
     googletest = fetchFromGitHub {
       owner = "google";
@@ -53,11 +53,17 @@ let
       rev = "17d08dd26cac4d63f43af217ebd70318bfb8189c";
       hash = "sha256-vnw52G0lY68471dzH7NXc++bTbLRsITSxGYXOTicA5w=";
     };
+    miniz = fetchFromGitHub {
+      owner = "richgel999";
+      repo = "miniz";
+      rev = "d10b03cc73475af673df40f06e5cefd1d5f940d9";
+      hash = "sha256-hRB/0TVVQjr4VwjozfRnYKUJfeqO+1PNfdvP/rrOCR4=";
+    };
     qhull = fetchFromGitHub {
       owner = "qhull";
       repo = "qhull";
-      rev = "62ccc56af071eaa478bef6ed41fd7a55d3bb2d80";
-      hash = "sha256-kIxHtE0L/axV9WKnQzyFN0mxoIFAI33Z+MP0P/MtQPw=";
+      rev = "d1c2fc0caa5f644f3a0f220290d4a868c68ed4f6";
+      hash = "sha256-enwzl4td3lgYwQ4PXfcONKQrxChnJcvf8ehnJ6vf0yg=";
     };
     tinyobjloader = fetchFromGitHub {
       owner = "tinyobjloader";
@@ -82,7 +88,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mujoco";
-  version = "3.8.1";
+  version = "3.10.0";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -93,7 +99,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "google-deepmind";
     repo = "mujoco";
     tag = finalAttrs.version;
-    hash = "sha256-eoZblIIH+tUNKPdVERGh1dE0KoWwMpP0LA6FgcJCiNU=";
+    hash = "sha256-wNsTTq5z+wKE0rSw2cyY1tJxP5i7LGu05DR7KfZEBtE=";
   };
 
   patches = [
@@ -128,9 +134,14 @@ stdenv.mkDerivation (finalAttrs: {
   # Move things into place so that cmake doesn't try downloading dependencies.
   preConfigure = ''
     mkdir -p build/_deps
-    ln -s ${pin.abseil-cpp} build/_deps/abseil-cpp-src
     ln -s ${pin.benchmark} build/_deps/benchmark-src
   ''
+  # mujoco applies a patch on top of abseil-cpp's sources
+  # https://github.com/google-deepmind/mujoco/blob/3.10.0/cmake/MujocoDependencies.cmake#L299-L300
+  + ''
+    cp -r ${pin.abseil-cpp} build/_deps/abseil-cpp-src
+    chmod -R +w build/_deps/abseil-cpp-src
+  ''
   # cccd is patched by mujoco's cmake and thus needs to be writable
   # https://github.com/google-deepmind/mujoco/blob/3.4.0/cmake/MujocoDependencies.cmake#L232-L235
   + ''
@@ -141,6 +152,7 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s ${pin.eigen3} build/_deps/eigen3-src
     ln -s ${pin.googletest} build/_deps/googletest-src
     ln -s ${pin.lodepng} build/_deps/lodepng-src
+    ln -s ${pin.miniz} build/_deps/miniz-src
   ''
   # qhull is patched by mujoco's cmake and thus needs to be writable
   # https://github.com/google-deepmind/mujoco/blob/3.4.0/cmake/MujocoDependencies.cmake#L132-L135
diff --git a/pkgs/by-name/mu/multica-cli/package.nix b/pkgs/by-name/mu/multica-cli/package.nix
index 0c5dc989be80..59e6c8e5f6a0 100644
--- a/pkgs/by-name/mu/multica-cli/package.nix
+++ b/pkgs/by-name/mu/multica-cli/package.nix
@@ -9,13 +9,13 @@ buildGoModule rec {
   __structuredAttrs = true;
 
   pname = "multica-cli";
-  version = "0.3.21";
+  version = "0.3.27";
 
   src = fetchFromGitHub {
     owner = "multica-ai";
     repo = "multica";
     rev = "v${version}";
-    hash = "sha256-qsQ2ycr+MU1A+U8LIbxnfaYtSHoMnLNO3P9ACJ6ThD4=";
+    hash = "sha256-zHjyITvFG7dTk8mFQ62f8JY9wLbKeOvlo0pjF6hQxcI=";
   };
 
   sourceRoot = "${src.name}/server";
diff --git a/pkgs/by-name/mu/multicharge/package.nix b/pkgs/by-name/mu/multicharge/package.nix
index 4cf03bdfee7d..677b9ec7f29e 100644
--- a/pkgs/by-name/mu/multicharge/package.nix
+++ b/pkgs/by-name/mu/multicharge/package.nix
@@ -26,11 +26,13 @@ assert (
 stdenv.mkDerivation (finalAttrs: {
   pname = "multicharge";
   version = "0.5.0";
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src = fetchFromGitHub {
     owner = "grimme-lab";
     repo = "multicharge";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-hswqC+fvC6tuxDpuUgowyqm72ubVikzpR4EzXtTM5cs=";
   };
 
@@ -48,7 +50,9 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
   ]
-  ++ lib.optional (buildType == "cmake") cmake;
+  ++ lib.optionals (buildType == "cmake") [
+    cmake
+  ];
 
   buildInputs = [
     blas
@@ -85,6 +89,7 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "multicharge";
     license = lib.licenses.asl20;
     homepage = "https://github.com/grimme-lab/multicharge";
+    changelog = "https://github.com/grimme-lab/multicharge/releases/tag/${finalAttrs.src.tag}";
     platforms = lib.platforms.linux;
     maintainers = [ lib.maintainers.sheepforce ];
   };
diff --git a/pkgs/by-name/ne/neovim-unwrapped/package.nix b/pkgs/by-name/ne/neovim-unwrapped/package.nix
index bcc15e19bcc7..aeb2807ce0f7 100644
--- a/pkgs/by-name/ne/neovim-unwrapped/package.nix
+++ b/pkgs/by-name/ne/neovim-unwrapped/package.nix
@@ -11,6 +11,7 @@
   unibilium,
   utf8proc,
   tree-sitter,
+  wasmtime_36,
   fetchurl,
   buildPackages,
   treesitter-parsers ? import ./treesitter-parsers.nix { inherit fetchurl; },
@@ -20,6 +21,7 @@
   versionCheckHook,
   nix-update-script,
   writableTmpDirAsHomeHook,
+  wasmSupport ? false,
 
   # now defaults to false because some tests can be flaky (clipboard etc), see
   # also: https://github.com/neovim/neovim/issues/16233
@@ -30,6 +32,9 @@
 
 let
   lua = if lib.meta.availableOn stdenv.hostPlatform luajit then luajit else lua5_1;
+  treeSitterForNeovim = tree-sitter.override {
+    inherit wasmSupport;
+  };
 in
 
 stdenv.mkDerivation (
@@ -161,10 +166,13 @@ stdenv.mkDerivation (
       # and it's definition at: pkgs/development/lua-modules/overrides.nix
       lua.pkgs.libluv
       neovimLuaEnv
-      tree-sitter
+      treeSitterForNeovim
       unibilium
       utf8proc
     ]
+    ++ lib.optionals wasmSupport [
+      wasmtime_36
+    ]
     ++ lib.optionals (stdenv.hostPlatform.libc != "glibc") [
       # Provide libintl for non-glibc platforms
       gettext
@@ -202,13 +210,20 @@ stdenv.mkDerivation (
         pyEnv # for src/clint.py
       ];
 
-    # nvim --version output retains compilation flags and references to build tools
-    postPatch = lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-      sed -i runtime/CMakeLists.txt \
-        -e "s|\".*/bin/nvim|\${stdenv.hostPlatform.emulator buildPackages} &|g"
-      sed -i src/nvim/po/CMakeLists.txt \
-        -e "s|\$<TARGET_FILE:nvim|\${stdenv.hostPlatform.emulator buildPackages} &|g"
-    '';
+    postPatch =
+      lib.optionalString wasmSupport ''
+        substituteInPlace src/nvim/CMakeLists.txt \
+          --replace-fail \
+            'find_package(Wasmtime 36.0.6 EXACT REQUIRED)' \
+            'find_package(Wasmtime REQUIRED)'
+      ''
+      # nvim --version output retains compilation flags and references to build tools
+      + lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+        sed -i runtime/CMakeLists.txt \
+          -e "s|\".*/bin/nvim|\${stdenv.hostPlatform.emulator buildPackages} &|g"
+        sed -i src/nvim/po/CMakeLists.txt \
+          -e "s|\$<TARGET_FILE:nvim|\${stdenv.hostPlatform.emulator buildPackages} &|g"
+      '';
     # check that the above patching actually works
     disallowedRequisites = [
       stdenv.cc
@@ -229,6 +244,12 @@ stdenv.mkDerivation (
       (lib.cmakeBool "ENABLE_TRANSLATIONS" true)
       (lib.cmakeBool "USE_BUNDLED_BUSTED" false)
     ]
+    ++ lib.optionals wasmSupport [
+      # FindWasmtime has no pkg-config fallback.
+      (lib.cmakeBool "ENABLE_WASMTIME" true)
+      (lib.cmakeFeature "WASMTIME_INCLUDE_DIR" "${lib.getDev wasmtime_36}/include")
+      (lib.cmakeFeature "WASMTIME_LIBRARY" "${lib.getLib wasmtime_36}/lib/libwasmtime${stdenv.hostPlatform.extensions.sharedLibrary}")
+    ]
     ++ (
       if lua.pkgs.isLuaJIT then
         [
diff --git a/pkgs/by-name/ne/newelle/package.nix b/pkgs/by-name/ne/newelle/package.nix
index 027551626794..cb118e03f15f 100644
--- a/pkgs/by-name/ne/newelle/package.nix
+++ b/pkgs/by-name/ne/newelle/package.nix
@@ -20,7 +20,7 @@
 }:
 
 let
-  version = "1.3.7";
+  version = "1.4.5";
 in
 python3Packages.buildPythonApplication {
   pname = "newelle";
@@ -31,7 +31,7 @@ python3Packages.buildPythonApplication {
     owner = "qwersyk";
     repo = "Newelle";
     tag = version;
-    hash = "sha256-Qa1f6lNfKt1hh1gWJ45n9rwjO5lSO2d0tMII27glU/E=";
+    hash = "sha256-GcNAwrk5y6F0BgRy69nRePkX4WoYviWsB+8X/+N5QwE=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py b/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py
index 5b3c30ee1da4..9208148c594b 100644
--- a/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py
+++ b/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py
@@ -307,7 +307,7 @@ class ManualHTMLRenderer(RendererMixin, HTMLRenderer):
 
         toc = TocEntry.of(tokens[0])
         return "\n".join([
-            self._file_header(toc),
+            self._file_header(toc, sidebar=self._build_toc(tokens, 0)),
             ' <div class="book">',
             '  <div class="titlepage">',
             '   <div>',
@@ -316,13 +316,12 @@ class ManualHTMLRenderer(RendererMixin, HTMLRenderer):
             '   </div>',
             "   <hr />",
             '  </div>',
-            self._build_toc(tokens, 0),
             super(HTMLRenderer, self).render(tokens[6:]),
             ' </div>',
             self._file_footer(toc),
         ])
 
-    def _file_header(self, toc: TocEntry) -> str:
+    def _file_header(self, toc: TocEntry, sidebar: str = "") -> str:
         prev_link, up_link, next_link = "", "", ""
         prev_a, next_a, parent_title = "", "", "&nbsp;"
         nav_html = ""
@@ -384,6 +383,8 @@ class ManualHTMLRenderer(RendererMixin, HTMLRenderer):
             ' </head>',
             ' <body>',
             nav_html,
+            f'  <nav class="toc-sidebar">{sidebar}</nav>' if sidebar else "",
+            '  <main class="content">',
         ])
 
     def _file_footer(self, toc: TocEntry) -> str:
@@ -424,6 +425,7 @@ class ManualHTMLRenderer(RendererMixin, HTMLRenderer):
             ])
         return "\n".join([
             nav_html,
+            '  </main>',
             ' </body>',
             '</html>',
         ])
diff --git a/pkgs/by-name/ni/nixpkgs-review/package.nix b/pkgs/by-name/ni/nixpkgs-review/package.nix
index ff037e9b7549..37cbd707d2bc 100644
--- a/pkgs/by-name/ni/nixpkgs-review/package.nix
+++ b/pkgs/by-name/ni/nixpkgs-review/package.nix
@@ -23,7 +23,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "nixpkgs-review";
-  version = "3.8.0";
+  version = "3.9.0";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -32,7 +32,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "Mic92";
     repo = "nixpkgs-review";
     tag = finalAttrs.version;
-    hash = "sha256-Z8pOct9DtuRo4LERqhVpDxX9uoLNQGgqPFUh0Fn3MrI=";
+    hash = "sha256-u0DbEwe28csVWKbu8x9v9/Ah0ZUUgqXtZU2Rr5IJpWI=";
   };
 
   build-system = [
diff --git a/pkgs/by-name/nu/numsa/package.nix b/pkgs/by-name/nu/numsa/package.nix
new file mode 100644
index 000000000000..c823b92a5036
--- /dev/null
+++ b/pkgs/by-name/nu/numsa/package.nix
@@ -0,0 +1,107 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+
+  buildType ? "meson",
+
+  # nativeBuildInputs
+  asciidoctor,
+  gfortran,
+  pkg-config,
+  python3,
+  # meson:
+  meson,
+  ninja,
+  # cmake:
+  cmake,
+
+  # buildInputs
+  mstore,
+  test-drive,
+  blas,
+  lapack,
+
+  # propagatedBuildInputs
+  mctc-lib,
+
+  # passthru
+  nix-update-script,
+}:
+
+assert (
+  builtins.elem buildType [
+    "meson"
+    "cmake"
+  ]
+);
+stdenv.mkDerivation (finalAttrs: {
+  pname = "numsa";
+  version = "0.2.0";
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "grimme-lab";
+    repo = "numsa";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-PAzxeYyg/9P/3YFxKzM4ZFm2xT0AGap6q8/ei8jD/3M=";
+  };
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  patches = [
+    # Use nixpkgs' mstore instead of building it from source
+    ./use-external-mstore.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace config/install-mod.py \
+      --replace-fail "/usr/bin/env python" "${lib.getExe python3}"
+  '';
+
+  nativeBuildInputs = [
+    asciidoctor
+    gfortran
+    pkg-config
+    python3
+  ]
+  ++ lib.optionals (buildType == "meson") [
+    meson
+    ninja
+  ]
+  ++ lib.optionals (buildType == "cmake") [
+    cmake
+  ];
+
+  buildInputs = [
+    blas
+    lapack
+    mstore # only needed to build the bundled test suite
+    test-drive
+  ];
+
+  propagatedBuildInputs = [
+    mctc-lib
+  ];
+
+  doCheck = true;
+
+  preCheck = ''
+    export OMP_NUM_THREADS=2
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Solvent accessible surface area calculation";
+    homepage = "https://github.com/grimme-lab/numsa";
+    changelog = "https://github.com/grimme-lab/numsa/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/nu/numsa/use-external-mstore.patch b/pkgs/by-name/nu/numsa/use-external-mstore.patch
new file mode 100644
index 000000000000..f490884198e1
--- /dev/null
+++ b/pkgs/by-name/nu/numsa/use-external-mstore.patch
@@ -0,0 +1,30 @@
+diff --git a/test/meson.build b/test/meson.build
+index c60e4a4..7da0216 100644
+--- a/test/meson.build
++++ b/test/meson.build
+@@ -14,20 +14,21 @@
+ # You should have received a copy of the GNU Lesser General Public License
+ # along with numsa.  If not, see <https://www.gnu.org/licenses/>.
+ 
+-# Create mstore as subproject for testing
+-mstore_prj = subproject(
++# Find the molecular structure store, preferring an external installation
++# (e.g. via pkg-config) and falling back to building it as a subproject
++mstore_dep = dependency(
+   'mstore',
+   version: '>=0.1',
++  fallback: ['mstore', 'mstore_dep'],
+   required: not meson.is_subproject(),
+   default_options: [
+     'default_library=static',
+   ],
+ )
+ # If we do not find mstore and are a subproject, we just skip testing
+-if not mstore_prj.found()
++if not mstore_dep.found()
+    subdir_done()
+ endif
+-mstore_dep = mstore_prj.get_variable('mstore_dep')
+ 
+ tests = [
+   'surface',
diff --git a/pkgs/by-name/os/osmium/package.nix b/pkgs/by-name/os/osmium/package.nix
index 97114e38aee1..bbd5040f3061 100644
--- a/pkgs/by-name/os/osmium/package.nix
+++ b/pkgs/by-name/os/osmium/package.nix
@@ -29,11 +29,11 @@
 
 stdenv.mkDerivation rec {
   pname = "osmium";
-  version = "0.0.29-alpha";
+  version = "0.0.30-alpha";
 
   src = fetchurl {
     url = "https://updater.osmium.chat/Osmium-${version}-x64.tar.gz";
-    hash = "sha256-UbYnT/9bkMCii4rkAlkUBQcHc6DyAkOa8rQl+9e3NZU=";
+    hash = "sha256-NF7RF8odDQfh4zhk5B4md4OqDgh538exFNsRZzSJwBM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pa/pacman/dont-create-empty-dirs.patch b/pkgs/by-name/pa/pacman/dont-create-empty-dirs.patch
index 59deb947bb5d..7deaf0448ba1 100644
--- a/pkgs/by-name/pa/pacman/dont-create-empty-dirs.patch
+++ b/pkgs/by-name/pa/pacman/dont-create-empty-dirs.patch
@@ -1,8 +1,17 @@
 diff --git a/meson.build b/meson.build
-index c8ee42fd..610401ca 100644
+index 1e8bd8f8..86e68a75 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -414,15 +414,6 @@ install_data(
+@@ -433,8 +433,6 @@ configure_file(
+   configuration : substs,
+   install_dir : join_paths(SYSCONFDIR, 'makepkg.conf.d/'))
+ 
+-install_emptydir(join_paths(SYSCONFDIR, 'makepkg.d/'))
+-
+ configure_file(
+   input : 'etc/pacman.conf.in',
+   output : 'pacman.conf',
+@@ -448,15 +446,6 @@ install_data(
    'proto/proto.install',
    install_dir : join_paths(DATAROOTDIR, 'pacman'))
  
diff --git a/pkgs/by-name/pa/pacman/package.nix b/pkgs/by-name/pa/pacman/package.nix
index d4faa6298245..b761137cbf60 100644
--- a/pkgs/by-name/pa/pacman/package.nix
+++ b/pkgs/by-name/pa/pacman/package.nix
@@ -34,6 +34,9 @@
   gnugrep,
   gnupg,
 
+  # makepkg requires compgen to work
+  bashInteractive,
+
   # Tells pacman where to find ALPM hooks provided by packages.
   # This path is very likely to be used in an Arch-like root.
   sysHookDir ? "/usr/share/libalpm/hooks/",
@@ -41,20 +44,21 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pacman";
-  version = "7.0.0";
+  version = "7.1.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.archlinux.org";
     owner = "pacman";
     repo = "pacman";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-ejOBxN2HjV4dZwFA7zvPz3JUJa0xiJ/jZ+evEQYG1Mc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-bGg2ZrIsEYJYZCLsIh4FZROhpyLSBO0Lar1mSoz66wI=";
   };
 
   strictDeps = true;
 
   nativeBuildInputs = [
     asciidoc
+    bashInteractive
     gettext
     installShellFiles
     libarchive
@@ -101,10 +105,6 @@ stdenv.mkDerivation (finalAttrs: {
         --replace-fail "/bin/true" "${coreutils}/bin/true"
       substituteInPlace scripts/repo-add.sh.in \
         --replace-fail bsdtar "${libarchive}/bin/bsdtar"
-
-      # Fix https://gitlab.archlinux.org/pacman/pacman/-/issues/171
-      substituteInPlace scripts/libmakepkg/source/git.sh.in \
-        --replace-warn "---mirror" "--mirror"
     '';
 
   mesonFlags = [
diff --git a/pkgs/by-name/pa/paru/package.nix b/pkgs/by-name/pa/paru/package.nix
index 4ab3a97d0925..a26dee18b3f5 100644
--- a/pkgs/by-name/pa/paru/package.nix
+++ b/pkgs/by-name/pa/paru/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "paru";
-  version = "2.1.0";
+  version = "2.1.0-unstable-2026-01-09";
 
   src = fetchFromGitHub {
     owner = "Morganamilo";
     repo = "paru";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-i99f2ngYhfVCKpImJ8L7u2T2FgOt7Chp8DHDbrNh1kw=";
+    rev = "9ac3578807a87858651e81a02586ceb947686e7c";
+    hash = "sha256-TJbhxVnP5UhlCmwxKjXq/XaqPGtzHoN5S+lizm3Bmvs=";
   };
 
-  cargoHash = "sha256-USIceRh24WGV0TIrpuyHs4thjaghpxqZmk2uVKBxlm4=";
+  cargoHash = "sha256-Shp/2jQtO3pulT2gmsAcsEVPpv76nbEiGol+kYD7kr8=";
 
   nativeBuildInputs = [
     gettext
diff --git a/pkgs/by-name/pg/pgrok/package.nix b/pkgs/by-name/pg/pgrok/package.nix
index 231fbb265f68..7a8bef55ef44 100644
--- a/pkgs/by-name/pg/pgrok/package.nix
+++ b/pkgs/by-name/pg/pgrok/package.nix
@@ -11,12 +11,12 @@
 
 let
   pname = "pgrok";
-  version = "1.5.0";
+  version = "1.7.0";
   src = fetchFromGitHub {
     owner = "pgrok";
     repo = "pgrok";
     tag = "v${version}";
-    hash = "sha256-arPFccclBie3XOBt0q6UC96fPaPc7NmgQDMsd2H2bhI=";
+    hash = "sha256-uMHeVxAGmAEIOfCK9SEFsL7GZZIUNMYdoV8XeHjXmWc=";
   };
 in
 
@@ -34,6 +34,18 @@ buildGoModule {
     pnpm_9
   ];
 
+  postPatch = ''
+    # Rename directories to avoid binary naming conflicts (both would be named "cli")
+    mv pgrok/cli pgrok/pgrok
+    mv pgrokd/cli pgrokd/pgrokd
+
+    # Update references in Go code and web app package.json to match renamed directory
+    substituteInPlace pgrokd/pgrokd/main.go \
+      --replace-fail "github.com/pgrok/pgrok/pgrokd/cli/internal/web" "github.com/pgrok/pgrok/pgrokd/pgrokd/internal/web"
+    substituteInPlace pgrokd/web/package.json \
+      --replace-fail "../cli/internal/web/dist" "../pgrokd/internal/web/dist"
+  '';
+
   env.pnpmDeps = fetchPnpmDeps {
     inherit
       pname
@@ -42,10 +54,10 @@ buildGoModule {
       ;
     pnpm = pnpm_9;
     fetcherVersion = 3;
-    hash = "sha256-D8UZoN0ZnjB8CXQiHmBZwBEt57XGb5SDLg61xxSqNus=";
+    hash = "sha256-O3bDxnxeRO20FsRNpgXfz4UweYJmeU6zgrrPJ05fgWo=";
   };
 
-  vendorHash = "sha256-ob8s1jYL2+JGaqjCsM10jgirPiEyTY4U3IVVlHVdoGQ=";
+  vendorHash = "sha256-fhyyyXHUJsIWiCZbqtLZZRuIG9hb0LAkSo7lKW0i8Sk";
 
   ldflags = [
     "-s"
@@ -66,10 +78,6 @@ buildGoModule {
     pnpm run build
 
     popd
-
-    # rename packages due to naming conflict
-    mv pgrok/cli/ pgrok/pgrok/
-    mv pgrokd/cli/ pgrokd/pgrokd/
   '';
 
   postInstall = ''
diff --git a/pkgs/by-name/po/polybar/package.nix b/pkgs/by-name/po/polybar/package.nix
index 1890481c389c..50de2ab4b755 100644
--- a/pkgs/by-name/po/polybar/package.nix
+++ b/pkgs/by-name/po/polybar/package.nix
@@ -8,7 +8,6 @@
   libxdmcp,
   libpthread-stubs,
   libxcb,
-  pcre,
   pkg-config,
   python3,
   python3Packages, # sphinx-build
@@ -68,7 +67,6 @@ stdenv.mkDerivation (finalAttrs: {
     libxdmcp
     libpthread-stubs
     libxcb
-    pcre
     python3
     xcbproto
     libxcb-util
diff --git a/pkgs/by-name/pr/prl-tools/package.nix b/pkgs/by-name/pr/prl-tools/package.nix
index 57a2f14dd0e0..ef3fb2075385 100644
--- a/pkgs/by-name/pr/prl-tools/package.nix
+++ b/pkgs/by-name/pr/prl-tools/package.nix
@@ -45,13 +45,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "prl-tools";
-  version = "26.3.3-57507";
+  version = "26.4.0-57513";
 
   # We download the full distribution to extract prl-tools-lin.iso from
   # => ${dmg}/Parallels\ Desktop.app/Contents/Resources/Tools/prl-tools-lin.iso
   src = fetchurl {
     url = "https://download.parallels.com/desktop/v${lib.versions.major finalAttrs.version}/${finalAttrs.version}/ParallelsDesktop-${finalAttrs.version}.dmg";
-    hash = "sha256-QXrzdQ6eY3ikgwMD11/zEkYau/X0mmm2uk6O92r8w1o=";
+    hash = "sha256-Qkul+hZh0J7g8+D+T7RLmfrtK2i90+wlsrfm5tNaYug=";
   };
 
   hardeningDisable = [
diff --git a/pkgs/by-name/re/rerun/package.nix b/pkgs/by-name/re/rerun/package.nix
index 888e2a3cc9db..b3694808af56 100644
--- a/pkgs/by-name/re/rerun/package.nix
+++ b/pkgs/by-name/re/rerun/package.nix
@@ -35,7 +35,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rerun";
-  version = "0.33.0";
+  version = "0.33.1";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -49,7 +49,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "rerun-io";
     repo = "rerun";
     tag = finalAttrs.version;
-    hash = "sha256-1jlZ+8jx1dNsWWrkQSyFAIK/VQNSotcyTknz0WhIaIc=";
+    hash = "sha256-GCIrvNNktW9h2/s90tTxFOmiIRAbWQWOS3Ti03EZ/GM=";
   };
 
   # The path in `build.rs` is wrong for some reason, so we patch it to make the passthru tests work
@@ -58,7 +58,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail '"rerun_sdk/rerun_cli/rerun"' '"rerun_sdk/rerun"'
   '';
 
-  cargoHash = "sha256-3erI/kWTJ5Exl9QpGidsIizi0UWbudzMSzoscoSTmP8=";
+  cargoHash = "sha256-wCJKerOgOUWNn3wBeHEKn92qzGdICX6P52B2FT5wcZE=";
 
   cargoBuildFlags = [
     "--package"
diff --git a/pkgs/by-name/ru/runme/package.nix b/pkgs/by-name/ru/runme/package.nix
index 8c2d06b7a4c1..75c900b5b249 100644
--- a/pkgs/by-name/ru/runme/package.nix
+++ b/pkgs/by-name/ru/runme/package.nix
@@ -13,16 +13,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "runme";
-  version = "3.16.11";
+  version = "3.16.15";
 
   src = fetchFromGitHub {
     owner = "runmedev";
     repo = "runme";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-c01mVr8JW+qghj7q5W3B1NsuH9hQUEq3hVHLT+9VM20=";
+    hash = "sha256-mU8U/aak0FrQEFanVksM/32bsGx5damuf6BxshTk/M0=";
   };
 
-  vendorHash = "sha256-7F33MmGWIY1z2aw2mJ83XhcOrhT+olGwNmvdgGdxyME=";
+  vendorHash = "sha256-q+NVyzTCKgyOW94O/YWbmgvgUVh9xlnBOMLWCp/0jrM=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/ti/tinymist/package.nix b/pkgs/by-name/ti/tinymist/package.nix
index a1aebd60033a..220c0096b9f3 100644
--- a/pkgs/by-name/ti/tinymist/package.nix
+++ b/pkgs/by-name/ti/tinymist/package.nix
@@ -15,7 +15,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tinymist";
   # Please update the corresponding vscode extension when updating
   # this derivation.
-  version = "0.15.0";
+  version = "0.15.2";
 
   __structuredAttrs = true;
 
@@ -23,10 +23,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "Myriad-Dreamin";
     repo = "tinymist";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SfkyyszTmleWHa19jMgHjiOUvBOniVybDr9GBmtMVDw=";
+    hash = "sha256-wNSMjfU3upsqKQQUYx76iFGC+5ghcErlxy65ZJ/LvHk=";
   };
 
-  cargoHash = "sha256-ztJb2Br0Ph2qSeo9MGm9OdU66YPkep+9lBCrL2TimB4=";
+  cargoHash = "sha256-NEvINvHMD9tVG9kyj84AC8DEAbR0ndjkCHpwR4OD6YA=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/to/toml-f/package.nix b/pkgs/by-name/to/toml-f/package.nix
index 96dc25e7d4c2..436c9b5fda1c 100644
--- a/pkgs/by-name/to/toml-f/package.nix
+++ b/pkgs/by-name/to/toml-f/package.nix
@@ -21,11 +21,13 @@ assert (
 stdenv.mkDerivation (finalAttrs: {
   pname = "toml-f";
   version = "0.5.1";
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src = fetchFromGitHub {
     owner = "toml-f";
     repo = "toml-f";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-lReez2rSAJVnLFngjUYgGkm+HUDH8VsCC2m9zYOOr4A=";
   };
 
@@ -42,7 +44,9 @@ stdenv.mkDerivation (finalAttrs: {
     meson
     ninja
   ]
-  ++ lib.optional (buildType == "cmake") cmake;
+  ++ lib.optionals (buildType == "cmake") [
+    cmake
+  ];
 
   buildInputs = [ test-drive ];
 
@@ -65,6 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
       mit
     ];
     homepage = "https://github.com/toml-f/toml-f";
+    changelog = "https://github.com/toml-f/toml-f/releases/tag/${finalAttrs.src.tag}";
     platforms = lib.platforms.linux;
     maintainers = [ lib.maintainers.sheepforce ];
   };
diff --git a/pkgs/by-name/tr/tree-sitter/package.nix b/pkgs/by-name/tr/tree-sitter/package.nix
index 1ae410255fc0..a456828b16b2 100644
--- a/pkgs/by-name/tr/tree-sitter/package.nix
+++ b/pkgs/by-name/tr/tree-sitter/package.nix
@@ -18,8 +18,11 @@
   substitute,
   installShellFiles,
   buildPackages,
+  cmake,
+  wasmtime_36,
   enableShared ? !stdenv.hostPlatform.isStatic,
   enableStatic ? stdenv.hostPlatform.isStatic,
+  wasmSupport ? false,
   webUISupport ? false,
 }:
 
@@ -124,9 +127,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-9FeWnWWPUWmMF15Psmul8GxGv2JceHWc2WZPmOr81gw=";
 
+  cargoBuildFeatures = lib.optionals wasmSupport [ "wasm" ];
+
   buildInputs = [
     installShellFiles
   ]
+  ++ lib.optionals wasmSupport [
+    wasmtime_36
+  ]
   ++ lib.optionals webUISupport [
     openssl
   ];
@@ -134,6 +142,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rustPlatform.bindgenHook
     which
   ]
+  ++ lib.optionals wasmSupport [
+    cmake
+  ]
   ++ lib.optionals webUISupport [
     emscripten
     pkg-config
@@ -164,6 +175,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
       sed -i '/^install:/,/^[^[:space:]]/ { /$(SOEXT/d; }' ./Makefile
     '';
 
+  # The Makefile install can't enable the wasm feature.
+  cmakeFlags = lib.optionals wasmSupport [
+    (lib.cmakeBool "TREE_SITTER_FEATURE_WASM" true)
+    (lib.cmakeFeature "WASMTIME_INCLUDE_DIR" "${lib.getDev wasmtime_36}/include")
+    (lib.cmakeFeature "WASMTIME_LIBRARY" "${lib.getLib wasmtime_36}/lib/libwasmtime${stdenv.hostPlatform.extensions.sharedLibrary}")
+    (lib.cmakeFeature "CMAKE_INSTALL_INCLUDEDIR" "include")
+    (lib.cmakeFeature "CMAKE_INSTALL_LIBDIR" "lib")
+  ];
+
   # Compile web assembly with emscripten. The --debug flag prevents us from
   # minifying the JavaScript; passing it allows us to side-step more Node
   # JS dependencies for installation.
@@ -175,6 +195,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   postInstall = ''
     PREFIX=$out make install
+  ''
+  + lib.optionalString wasmSupport ''
+    cmake --install $cmakeBuildDir
+  ''
+  + ''
     ${lib.optionalString (!enableShared) "rm -f $out/lib/*.so{,.*}"}
     ${lib.optionalString (!enableStatic) "rm -f $out/lib/*.a"}
 
@@ -196,6 +221,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # test result: FAILED. 120 passed; 13 failed; 0 ignored; 0 measured; 0 filtered out
   doCheck = false;
 
+  # CMake builds libtree-sitter with wasm support; cargo still builds the CLI.
+  ${if wasmSupport then "configurePhase" else null} = ''
+    cmakeConfigurePhase
+    cd ..
+  '';
+
+  ${if wasmSupport then "postBuild" else null} = ''
+    cmake --build $cmakeBuildDir
+  '';
+
   passthru = {
     inherit
       grammars
diff --git a/pkgs/by-name/va/vault-bin/package.nix b/pkgs/by-name/va/vault-bin/package.nix
index 5896eaedce6e..5401509c09f7 100644
--- a/pkgs/by-name/va/vault-bin/package.nix
+++ b/pkgs/by-name/va/vault-bin/package.nix
@@ -6,7 +6,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vault-bin";
-  version = "2.0.0";
+  version = "2.0.3";
 
   src =
     let
@@ -20,11 +20,11 @@ stdenv.mkDerivation rec {
         aarch64-darwin = "darwin_arm64";
       };
       hash = selectSystem {
-        x86_64-linux = "sha256-Zp/rbxNa9gDFHclb0Mb2jYfav6jVGfSYvpybEFOaQ+U=";
-        aarch64-linux = "sha256-qenfLCdDrIsJZMzv2CO3VDcI9TwzRfh/KbFvojFwGhQ=";
-        i686-linux = "sha256-hGqJUlK92XO3APCUeJTiLnVHNh6r1MfskEbtYMjDg7I=";
-        x86_64-darwin = "sha256-WJFs/8Lq2VBVMF2wls5EHFfe4ClLJOoxO91+5oGl6Ko=";
-        aarch64-darwin = "sha256-3wfrn05JeYho9+F6lmgT8cZdlogV+7IhJ/kwj09OeOA=";
+        x86_64-linux = "sha256-THVYezhV7TmChy8IKsE8Agx6ks4wFctuk+GevXhwRv8=";
+        aarch64-linux = "sha256-Wmlpw9gzbdCvgCwf3Nh9JPjjmDKS2P0TNYaRvKqO4fg=";
+        i686-linux = "sha256-Fdxq1r1G17kiCl7b9OBrWwkyo+VoKOvrUPf0p4wZlcs=";
+        x86_64-darwin = "sha256-tyQzmycXo4kSvo1X4afFU2aWuXyvyvw0mb81eiH3WjE=";
+        aarch64-darwin = "sha256-+zor3j+7saG6AnuIlkJSAsCkMHYuhm0Abmt6TTu8bZI=";
       };
     in
     fetchzip {
diff --git a/pkgs/by-name/wa/wasmtime/package.nix b/pkgs/by-name/wa/wasmtime/package.nix
index a3cd6a1f0701..034984f5d6de 100644
--- a/pkgs/by-name/wa/wasmtime/package.nix
+++ b/pkgs/by-name/wa/wasmtime/package.nix
@@ -10,23 +10,40 @@
   nix-update-script,
   enableShared ? !stdenv.hostPlatform.isStatic,
   enableStatic ? stdenv.hostPlatform.isStatic,
+  majorVersion ? "45",
 }:
+let
+  sources = {
+    "36" = {
+      version = "36.0.11";
+      hash = "sha256-rrSI2dSOA8/1CL7JhW0eQ7LaeS5EqTVnyn2HTI+/x20=";
+      cargoHash = "sha256-S67/fv7179uDy4PpwycyXSWAknIC/7ZzvzWPOd6MD+8=";
+    };
+    "45" = {
+
+      version = "45.0.2";
+      hash = "sha256-LEQitwz+UDSX4mrjEecmoO/ZPgRnYTZ3DsD1pu8Jybs=";
+      cargoHash = "sha256-uTgEW2w0RSMetd2W1ucGiVMEEvz2A7CQ79SEsE8/+BM=";
+    };
+  };
+  source = sources.${majorVersion};
+in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wasmtime";
-  version = "45.0.2";
+  version = source.version;
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "wasmtime";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LEQitwz+UDSX4mrjEecmoO/ZPgRnYTZ3DsD1pu8Jybs=";
+    hash = source.hash;
     fetchSubmodules = true;
   };
 
   # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
   auditable = false;
 
-  cargoHash = "sha256-uTgEW2w0RSMetd2W1ucGiVMEEvz2A7CQ79SEsE8/+BM=";
+  cargoHash = source.cargoHash;
   cargoBuildFlags = [
     "--package"
     "wasmtime-cli"
diff --git a/pkgs/by-name/wa/wasmtime_36/package.nix b/pkgs/by-name/wa/wasmtime_36/package.nix
new file mode 100644
index 000000000000..282b821a7642
--- /dev/null
+++ b/pkgs/by-name/wa/wasmtime_36/package.nix
@@ -0,0 +1,18 @@
+{
+  nix-update-script,
+  wasmtime,
+}:
+
+# NOTE: LTS Version EOL August 20 2027
+(wasmtime.override { majorVersion = "36"; }).overrideAttrs (old: {
+  __structuredAttrs = true;
+
+  passthru = old.passthru // {
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--version-regex"
+        "^v(36\\.\\d+\\.\\d+)$"
+      ];
+    };
+  };
+})
diff --git a/pkgs/by-name/wa/wastebin/package.nix b/pkgs/by-name/wa/wastebin/package.nix
index 845026e7fd40..f4b5d79b2eaf 100644
--- a/pkgs/by-name/wa/wastebin/package.nix
+++ b/pkgs/by-name/wa/wastebin/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wastebin";
-  version = "3.6.2";
+  version = "3.7.0";
 
   src = fetchFromGitHub {
     owner = "matze";
     repo = "wastebin";
     rev = finalAttrs.version;
-    hash = "sha256-pORShre3lLgI8UE9iZ7gicQbGbZM06IgYnKLLwOYm/s=";
+    hash = "sha256-uWr2xJjWcm0WmOB6eD2pdzUch7HSk9KdHV31FoYHr0E=";
   };
 
-  cargoHash = "sha256-fpEG0J+l/kRq5s6G0rzDsshbKM44fZfVeURFPhFeV7s=";
+  cargoHash = "sha256-m5cO3J4LryO+pS991DkS+4J6dw8ltP9sJR88FVGdsdw=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/xh/xh/package.nix b/pkgs/by-name/xh/xh/package.nix
index 3609712c8298..755452446727 100644
--- a/pkgs/by-name/xh/xh/package.nix
+++ b/pkgs/by-name/xh/xh/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "xh";
-  version = "0.25.3";
+  version = "0.26.1";
 
   src = fetchFromGitHub {
     owner = "ducaale";
     repo = "xh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WRYClBIjw67lVrzvnIMqVHd6toi5yU7nClViqfXahKA=";
+    hash = "sha256-Y8T/r7DaKha0cjWewJPzq4jo6Lab18cDrAj8Ek1D5Bg=";
   };
 
-  cargoHash = "sha256-T2ZaijWXyH8ZJKFTTngGtQsdRWL9re4i3nKHp8srWSI=";
+  cargoHash = "sha256-JjXv4QMmOF0xsRloaKqbdJ8ztHtEg80QRJmnTW1/3Lc=";
 
   buildFeatures = lib.optional withNativeTls "native-tls";
 
diff --git a/pkgs/by-name/xt/xtb/package.nix b/pkgs/by-name/xt/xtb/package.nix
new file mode 100644
index 000000000000..47f1010308fb
--- /dev/null
+++ b/pkgs/by-name/xt/xtb/package.nix
@@ -0,0 +1,112 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+
+  # nativeBuildInputs
+  gfortran,
+  meson,
+  ninja,
+  pkg-config,
+
+  # buildInputs
+  blas,
+  lapack,
+  cpcm-x,
+  dftd4,
+  mctc-lib,
+  multicharge,
+  numsa,
+  simple-dftd3,
+  tblite,
+  test-drive,
+  toml-f,
+
+  # passthru
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xtb";
+  # No tagged release supports the tblite 0.6 / dftd4 4.2 API; the latest tag (6.7.1) targets
+  # tblite 0.3. Track master, which builds against the current grimme-lab stack packaged in nixpkgs
+  version = "6.7.1-unstable-2026-05-16";
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "grimme-lab";
+    repo = "xtb";
+    rev = "2b5cd4829290775e575807daee21560f851ff7e1";
+    hash = "sha256-dnpmbjLG6xKSLXEUdwndsA0ADTEyaTY9fJiOSXI7jD4=";
+  };
+
+  # The `solve`/`solve4` eigensolvers size the DSYGVD workspace from a `LWORK = -1` query.
+  # OpenBLAS leaves `aux(1)` as a denormal/garbage value on that query, so `int(aux(1))` falls
+  # below DSYGVD's documented minimum and the real call aborts with `DSYGVD parameter number 11 had
+  # an illegal value` (it works against reference LAPACK, which fills the query correctly).
+  # This surfaces as failures in the `gfn0` and `peeq` unit tests. Clamp the workspace sizes to the
+  # LAPACK minima so the query result can only ever grow them.
+  postPatch = ''
+    substituteInPlace src/scc_core.f90 \
+      --replace-fail "lwork=int(aux(1))"  "lwork=max(int(aux(1)),1+6*ndim+2*ndim**2)" \
+      --replace-fail "lwork=int(aux4(1))" "lwork=max(int(aux4(1)),1+6*ndim+2*ndim**2)" \
+      --replace-fail "liwork=iwork(1)"    "liwork=max(iwork(1),3+5*ndim)"
+  '';
+
+  nativeBuildInputs = [
+    gfortran
+    meson
+    ninja
+    pkg-config
+  ];
+
+  mesonFlags = [
+    # Require the optional backends rather than letting the `auto` features
+    # silently disable themselves if a dependency is not found.
+    (lib.mesonEnable "tblite" true)
+    (lib.mesonEnable "cpcmx" true)
+  ];
+
+  # Serialize the build: ninja otherwise compiles xtb's program/library objects before the
+  # library's Fortran modules are generated.
+  # `enableParallel` only controls the explicit -j flag and ninja parallelizes regardless, so the
+  # race has to be killed with an explicit -j1.
+  ninjaFlags = [ "-j1" ];
+
+  buildInputs = [
+    blas
+    cpcm-x
+    dftd4
+    lapack
+    mctc-lib
+    multicharge
+    numsa
+    simple-dftd3
+    tblite
+    test-drive
+    toml-f
+  ];
+
+  doCheck = true;
+  preCheck = ''
+    export OMP_NUM_THREADS=2
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
+
+  meta = {
+    description = "Semiempirical Extended Tight-Binding Program Package";
+    homepage = "https://github.com/grimme-lab/xtb";
+    # changelog = "https://github.com/grimme-lab/xtb/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [
+      GaetanLepage
+      sheepforce
+    ];
+    mainProgram = "xtb";
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/za/zashboard/package.nix b/pkgs/by-name/za/zashboard/package.nix
index d9fb336a683b..138104b05ff4 100644
--- a/pkgs/by-name/za/zashboard/package.nix
+++ b/pkgs/by-name/za/zashboard/package.nix
@@ -12,13 +12,13 @@ let
 in
 buildNpmPackage (finalAttrs: {
   pname = "zashboard";
-  version = "3.9.0";
+  version = "3.10.1";
 
   src = fetchFromGitHub {
     owner = "Zephyruso";
     repo = "zashboard";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QUu1HNGjxcT/oNO6XEiUpQ6TfMwLv9MQIsAtff+hYsY=";
+    hash = "sha256-unk/QO2V5BzuY8TL8Z1K/EPPMB6JwW15OQICix8Mukk=";
   };
 
   npmDeps = null;
@@ -26,7 +26,7 @@ buildNpmPackage (finalAttrs: {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-reYRJgLBxz+/J1wwPG4sO953R4xN0L6JInRJauseFc8=";
+    hash = "sha256-7bjsqBQssirsrIbegm5G/J/v3+yzfomq/gxCbxKEb6g=";
   };
 
   nativeBuildInputs = [ pnpm ];
diff --git a/pkgs/development/compilers/openjdk/11/patches/fix-oopdesc-ptr-alignment-ub.patch b/pkgs/development/compilers/openjdk/11/patches/fix-oopdesc-ptr-alignment-ub.patch
new file mode 100644
index 000000000000..9fc32990d1ae
--- /dev/null
+++ b/pkgs/development/compilers/openjdk/11/patches/fix-oopdesc-ptr-alignment-ub.patch
@@ -0,0 +1,2622 @@
+From 55ce9f824ab06507e7253e7de6e57c7baac5ae45 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Stefan=20N=C3=BCrnberger?=
+ <stefan.nuernberger@cyberus-technology.de>
+Date: Thu, 18 Jun 2026 20:21:59 +0200
+Subject: [PATCH] fix undefined behavior in markOop
+
+A smaller version of https://github.com/openjdk/jdk11u-dev/pull/1284
+to fix https://bugs.openjdk.java.net/browse/JDK-8229258
+
+Only fixes x86 and aarch64. Other architectures will not build.
+
+Co-authored-by: Campbell Jones <git@serebit.com>
+Co-authored-by: Reilly Brogan <reilly@reillybrogan.com>
+
+---
+ src/hotspot/cpu/aarch64/aarch64.ad            |   2 +-
+ .../cpu/aarch64/c1_MacroAssembler_aarch64.cpp |   2 +-
+ .../cpu/aarch64/templateTable_aarch64.cpp     |   2 +-
+ src/hotspot/cpu/x86/c1_MacroAssembler_x86.cpp |   2 +-
+ src/hotspot/cpu/x86/macroAssembler_x86.cpp    |   8 +-
+ src/hotspot/cpu/x86/templateTable_x86.cpp     |   2 +-
+ src/hotspot/cpu/zero/cppInterpreter_zero.cpp  |   2 +-
+ src/hotspot/share/classfile/altHashing.cpp    |   2 +-
+ .../gc/cms/concurrentMarkSweepGeneration.cpp  |  32 +--
+ src/hotspot/share/gc/cms/freeChunk.hpp        |   8 +-
+ .../share/gc/cms/parOopClosures.inline.hpp    |   4 +-
+ src/hotspot/share/gc/cms/promotionInfo.cpp    |   2 +-
+ .../share/gc/g1/g1FullGCCompactionPoint.cpp   |   4 +-
+ .../share/gc/g1/g1FullGCMarker.inline.hpp     |   2 +-
+ .../gc/g1/g1FullGCOopClosures.inline.hpp      |   4 +-
+ .../share/gc/g1/g1OopClosures.inline.hpp      |   4 +-
+ .../share/gc/g1/g1ParScanThreadState.cpp      |  12 +-
+ .../gc/g1/g1ParScanThreadState.inline.hpp     |   4 +-
+ .../gc/parallel/psMarkSweepDecorator.cpp      |  10 +-
+ .../gc/parallel/psPromotionManager.inline.hpp |   6 +-
+ src/hotspot/share/gc/serial/markSweep.cpp     |   2 +-
+ .../share/gc/serial/markSweep.inline.hpp      |  10 +-
+ .../share/gc/shared/preservedMarks.inline.hpp |   2 +-
+ src/hotspot/share/gc/shared/space.inline.hpp  |   6 +-
+ .../share/gc/shenandoah/shenandoahAsserts.cpp |   2 +-
+ .../shenandoahForwarding.inline.hpp           |  16 +-
+ .../gc/shenandoah/shenandoahStringDedup.cpp   |   6 +-
+ .../share/interpreter/bytecodeInterpreter.cpp |  18 +-
+ .../jfr/leakprofiler/chains/bfsClosure.cpp    |   4 +-
+ .../jfr/leakprofiler/chains/dfsClosure.cpp    |   2 +-
+ .../jfr/leakprofiler/chains/edgeStore.cpp     |   4 +-
+ .../jfr/leakprofiler/chains/edgeUtils.cpp     |   2 +-
+ .../chains/objectSampleMarker.hpp             |   6 +-
+ .../leakprofiler/checkpoint/eventEmitter.cpp  |   2 +-
+ .../leakprofiler/utilities/saveRestore.cpp    |   8 +-
+ src/hotspot/share/memory/metaspaceShared.cpp  |   2 +-
+ src/hotspot/share/memory/universe.cpp         |   2 +-
+ src/hotspot/share/memory/virtualspace.cpp     |   4 +-
+ src/hotspot/share/oops/klass.cpp              |   2 +-
+ src/hotspot/share/oops/klass.hpp              |   1 +
+ src/hotspot/share/oops/klass.inline.hpp       |   2 +-
+ src/hotspot/share/oops/markOop.hpp            |  62 ++++--
+ src/hotspot/share/oops/markOop.inline.hpp     |   8 +-
+ src/hotspot/share/oops/oop.cpp                |   4 +-
+ src/hotspot/share/oops/oop.hpp                |   1 +
+ src/hotspot/share/oops/oop.inline.hpp         |  65 +++---
+ src/hotspot/share/oops/oopsHierarchy.hpp      |   2 -
+ src/hotspot/share/opto/macro.cpp              |   2 +-
+ src/hotspot/share/prims/jvmtiEnvBase.cpp      |   8 +-
+ src/hotspot/share/prims/jvmtiTagMap.cpp       |  10 +-
+ src/hotspot/share/prims/whitebox.cpp          |   2 +-
+ src/hotspot/share/runtime/basicLock.cpp       |   8 +-
+ src/hotspot/share/runtime/basicLock.hpp       |  10 +-
+ src/hotspot/share/runtime/biasedLocking.cpp   |  84 ++++----
+ src/hotspot/share/runtime/deoptimization.cpp  |   8 +-
+ src/hotspot/share/runtime/objectMonitor.hpp   |   1 +
+ .../share/runtime/objectMonitor.inline.hpp    |  10 +-
+ src/hotspot/share/runtime/sharedRuntime.cpp   |   4 +-
+ src/hotspot/share/runtime/synchronizer.cpp    | 191 +++++++++---------
+ src/hotspot/share/runtime/vframe.cpp          |  22 +-
+ src/hotspot/share/runtime/vmStructs.cpp       |   4 +-
+ 69 files changed, 394 insertions(+), 345 deletions(-)
+
+diff --git a/src/hotspot/cpu/aarch64/aarch64.ad b/src/hotspot/cpu/aarch64/aarch64.ad
+index 27ba4e10d..0e7f17588 100644
+--- a/src/hotspot/cpu/aarch64/aarch64.ad
++++ b/src/hotspot/cpu/aarch64/aarch64.ad
+@@ -3565,7 +3565,7 @@ encode %{
+       // lock. The fast-path monitor unlock code checks for
+       // markOopDesc::monitor_value so use markOopDesc::unused_mark which has the
+       // relevant bit set, and also matches ObjectSynchronizer::slow_enter.
+-      __ mov(tmp, (address)markOopDesc::unused_mark());
++      __ mov(tmp, (address)markOopDesc::unused_mark().value());
+       __ str(tmp, Address(box, BasicLock::displaced_header_offset_in_bytes()));
+     }
+ 
+diff --git a/src/hotspot/cpu/aarch64/c1_MacroAssembler_aarch64.cpp b/src/hotspot/cpu/aarch64/c1_MacroAssembler_aarch64.cpp
+index 218113b78..97791fb63 100644
+--- a/src/hotspot/cpu/aarch64/c1_MacroAssembler_aarch64.cpp
++++ b/src/hotspot/cpu/aarch64/c1_MacroAssembler_aarch64.cpp
+@@ -176,7 +176,7 @@ void C1_MacroAssembler::initialize_header(Register obj, Register klass, Register
+     ldr(t1, Address(klass, Klass::prototype_header_offset()));
+   } else {
+     // This assumes that all prototype bits fit in an int32_t
+-    mov(t1, (int32_t)(intptr_t)markOopDesc::prototype());
++    mov(t1, (int32_t)(intptr_t)markOopDesc::prototype().value());
+   }
+   str(t1, Address(obj, oopDesc::mark_offset_in_bytes()));
+ 
+diff --git a/src/hotspot/cpu/aarch64/templateTable_aarch64.cpp b/src/hotspot/cpu/aarch64/templateTable_aarch64.cpp
+index 6fd216b95..a3c082f49 100644
+--- a/src/hotspot/cpu/aarch64/templateTable_aarch64.cpp
++++ b/src/hotspot/cpu/aarch64/templateTable_aarch64.cpp
+@@ -3611,7 +3611,7 @@ void TemplateTable::_new() {
+     if (UseBiasedLocking) {
+       __ ldr(rscratch1, Address(r4, Klass::prototype_header_offset()));
+     } else {
+-      __ mov(rscratch1, (intptr_t)markOopDesc::prototype());
++      __ mov(rscratch1, (intptr_t)markOopDesc::prototype().value());
+     }
+     __ str(rscratch1, Address(r0, oopDesc::mark_offset_in_bytes()));
+     __ store_klass_gap(r0, zr);  // zero klass gap for compressed oops
+diff --git a/src/hotspot/cpu/x86/c1_MacroAssembler_x86.cpp b/src/hotspot/cpu/x86/c1_MacroAssembler_x86.cpp
+index 25353446f..0e611a18a 100644
+--- a/src/hotspot/cpu/x86/c1_MacroAssembler_x86.cpp
++++ b/src/hotspot/cpu/x86/c1_MacroAssembler_x86.cpp
+@@ -154,7 +154,7 @@ void C1_MacroAssembler::initialize_header(Register obj, Register klass, Register
+     movptr(Address(obj, oopDesc::mark_offset_in_bytes()), t1);
+   } else {
+     // This assumes that all prototype bits fit in an int32_t
+-    movptr(Address(obj, oopDesc::mark_offset_in_bytes ()), (int32_t)(intptr_t)markOopDesc::prototype());
++    movptr(Address(obj, oopDesc::mark_offset_in_bytes ()), (int32_t)(intptr_t)markOopDesc::prototype().value());
+   }
+ #ifdef _LP64
+   if (UseCompressedClassPointers) { // Take care not to kill klass
+diff --git a/src/hotspot/cpu/x86/macroAssembler_x86.cpp b/src/hotspot/cpu/x86/macroAssembler_x86.cpp
+index ccde5ec7f..3e8098320 100644
+--- a/src/hotspot/cpu/x86/macroAssembler_x86.cpp
++++ b/src/hotspot/cpu/x86/macroAssembler_x86.cpp
+@@ -1556,7 +1556,7 @@ void MacroAssembler::rtm_inflated_locking(Register objReg, Register boxReg, Regi
+   int owner_offset = OM_OFFSET_NO_MONITOR_VALUE_TAG(owner);
+ 
+   // Without cast to int32_t a movptr will destroy r10 which is typically obj
+-  movptr(Address(boxReg, 0), (int32_t)intptr_t(markOopDesc::unused_mark()));
++  movptr(Address(boxReg, 0), (int32_t)intptr_t(markOopDesc::unused_mark().value()));
+   movptr(boxReg, tmpReg); // Save ObjectMonitor address
+ 
+   if (RTMRetryCount > 0) {
+@@ -1727,7 +1727,7 @@ void MacroAssembler::fast_lock(Register objReg, Register boxReg, Register tmpReg
+   if (EmitSync & 1) {
+       // set box->dhw = markOopDesc::unused_mark()
+       // Force all sync thru slow-path: slow_enter() and slow_exit()
+-      movptr (Address(boxReg, 0), (int32_t)intptr_t(markOopDesc::unused_mark()));
++      movptr (Address(boxReg, 0), (int32_t)intptr_t(markOopDesc::unused_mark().value()));
+       cmpptr (rsp, (int32_t)NULL_WORD);
+   } else {
+     // Possible cases that we'll encounter in fast_lock
+@@ -1879,7 +1879,7 @@ void MacroAssembler::fast_lock(Register objReg, Register boxReg, Register tmpReg
+        //   Invariant: m->_recursions should already be 0, so we don't need to explicitly set it.
+        // Intentional fall-through into DONE_LABEL ...
+     } else {
+-       movptr(Address(boxReg, 0), intptr_t(markOopDesc::unused_mark()));  // results in ST-before-CAS penalty
++       movptr(Address(boxReg, 0), intptr_t(markOopDesc::unused_mark().value()));  // results in ST-before-CAS penalty
+        movptr(boxReg, tmpReg);
+ 
+        // Using a prefetchw helps avoid later RTS->RTO upgrades and cache probes
+@@ -1926,7 +1926,7 @@ void MacroAssembler::fast_lock(Register objReg, Register boxReg, Register tmpReg
+     cmpxchgptr(r15_thread, Address(scrReg, OM_OFFSET_NO_MONITOR_VALUE_TAG(owner)));
+     // Unconditionally set box->_displaced_header = markOopDesc::unused_mark().
+     // Without cast to int32_t movptr will destroy r10 which is typically obj.
+-    movptr(Address(boxReg, 0), (int32_t)intptr_t(markOopDesc::unused_mark()));
++    movptr(Address(boxReg, 0), (int32_t)intptr_t(markOopDesc::unused_mark().value()));
+     // Intentional fall-through into DONE_LABEL ...
+     // Propagate ICC.ZF from CAS above into DONE_LABEL.
+ #endif // _LP64
+diff --git a/src/hotspot/cpu/x86/templateTable_x86.cpp b/src/hotspot/cpu/x86/templateTable_x86.cpp
+index 311a54f1b..785b675cb 100644
+--- a/src/hotspot/cpu/x86/templateTable_x86.cpp
++++ b/src/hotspot/cpu/x86/templateTable_x86.cpp
+@@ -4103,7 +4103,7 @@ void TemplateTable::_new() {
+       __ movptr(Address(rax, oopDesc::mark_offset_in_bytes ()), rbx);
+     } else {
+       __ movptr(Address(rax, oopDesc::mark_offset_in_bytes ()),
+-                (intptr_t)markOopDesc::prototype()); // header
++                (intptr_t)markOopDesc::prototype().value()); // header
+       __ pop(rcx);   // get saved klass back in the register.
+     }
+ #ifdef _LP64
+diff --git a/src/hotspot/cpu/zero/cppInterpreter_zero.cpp b/src/hotspot/cpu/zero/cppInterpreter_zero.cpp
+index 9331d02ce..04c59d9b6 100644
+--- a/src/hotspot/cpu/zero/cppInterpreter_zero.cpp
++++ b/src/hotspot/cpu/zero/cppInterpreter_zero.cpp
+@@ -274,7 +274,7 @@ int CppInterpreter::native_entry(Method* method, intptr_t UNUSED, TRAPS) {
+   if (method->is_synchronized()) {
+     monitor = (BasicObjectLock*) istate->stack_base();
+     oop lockee = monitor->obj();
+-    markOop disp = lockee->mark()->set_unlocked();
++    markOop disp = lockee->mark().set_unlocked();
+ 
+     monitor->lock()->set_displaced_header(disp);
+     if (lockee->cas_set_mark((markOop)monitor, disp) != disp) {
+diff --git a/src/hotspot/share/classfile/altHashing.cpp b/src/hotspot/share/classfile/altHashing.cpp
+index 253266c16..d7f3e7090 100644
+--- a/src/hotspot/share/classfile/altHashing.cpp
++++ b/src/hotspot/share/classfile/altHashing.cpp
+@@ -55,7 +55,7 @@
+ // objects.  We don't want to call the synchronizer hash code to install
+ // this value because it may safepoint.
+ static intptr_t object_hash(Klass* k) {
+-  intptr_t hc = k->java_mirror()->mark()->hash();
++  intptr_t hc = k->java_mirror()->mark().hash();
+   return hc != markOopDesc::no_hash ? hc : os::random();
+ }
+ 
+diff --git a/src/hotspot/share/gc/cms/concurrentMarkSweepGeneration.cpp b/src/hotspot/share/gc/cms/concurrentMarkSweepGeneration.cpp
+index d4e9253ab..a3d91a6aa 100644
+--- a/src/hotspot/share/gc/cms/concurrentMarkSweepGeneration.cpp
++++ b/src/hotspot/share/gc/cms/concurrentMarkSweepGeneration.cpp
+@@ -7773,7 +7773,7 @@ bool CMSCollector::take_from_overflow_list(size_t num, CMSMarkStack* stack) {
+   const markOop proto = markOopDesc::prototype();
+   NOT_PRODUCT(ssize_t n = 0;)
+   for (oop next; i > 0 && cur != NULL; cur = next, i--) {
+-    next = oop(cur->mark_raw());
++    next = oop(cur->mark_raw().to_pointer());
+     cur->set_mark_raw(proto);   // until proven otherwise
+     assert(oopDesc::is_oop(cur), "Should be an oop");
+     bool res = stack->push(cur);
+@@ -7857,8 +7857,8 @@ bool CMSCollector::par_take_from_overflow_list(size_t num,
+   size_t i = num;
+   oop cur = prefix;
+   // Walk down the first "num" objects, unless we reach the end.
+-  for (; i > 1 && cur->mark_raw() != NULL; cur = oop(cur->mark_raw()), i--);
+-  if (cur->mark_raw() == NULL) {
++  for (; i > 1 && cur->mark_raw().to_pointer() != NULL; cur = oop(cur->mark_raw().to_pointer()), i--);
++  if (cur->mark_raw().to_pointer() == NULL) {
+     // We have "num" or fewer elements in the list, so there
+     // is nothing to return to the global list.
+     // Write back the NULL in lieu of the BUSY we wrote
+@@ -7868,9 +7868,9 @@ bool CMSCollector::par_take_from_overflow_list(size_t num,
+     }
+   } else {
+     // Chop off the suffix and return it to the global list.
+-    assert(cur->mark_raw() != BUSY, "Error");
+-    oop suffix_head = cur->mark_raw(); // suffix will be put back on global list
+-    cur->set_mark_raw(NULL);           // break off suffix
++    assert(cur->mark_raw().to_pointer() != (void*)BUSY, "Error");
++    oop suffix_head = oop(cur->mark_raw().to_pointer()); // suffix will be put back on global list
++    cur->set_mark_raw(markOop::from_pointer(NULL));           // break off suffix
+     // It's possible that the list is still in the empty(busy) state
+     // we left it in a short while ago; in that case we may be
+     // able to place back the suffix without incurring the cost
+@@ -7890,18 +7890,18 @@ bool CMSCollector::par_take_from_overflow_list(size_t num,
+       // Too bad, someone else sneaked in (at least) an element; we'll need
+       // to do a splice. Find tail of suffix so we can prepend suffix to global
+       // list.
+-      for (cur = suffix_head; cur->mark_raw() != NULL; cur = (oop)(cur->mark_raw()));
++      for (cur = suffix_head; cur->mark_raw().to_pointer() != NULL; cur = (oop)(cur->mark_raw().to_pointer()));
+       oop suffix_tail = cur;
+-      assert(suffix_tail != NULL && suffix_tail->mark_raw() == NULL,
++      assert(suffix_tail != NULL && suffix_tail->mark_raw().to_pointer() == NULL,
+              "Tautology");
+       observed_overflow_list = _overflow_list;
+       do {
+         cur_overflow_list = observed_overflow_list;
+         if (cur_overflow_list != BUSY) {
+           // Do the splice ...
+-          suffix_tail->set_mark_raw(markOop(cur_overflow_list));
++          suffix_tail->set_mark_raw(markOop::from_pointer((void*)cur_overflow_list));
+         } else { // cur_overflow_list == BUSY
+-          suffix_tail->set_mark_raw(NULL);
++          suffix_tail->set_mark_raw(markOop::from_pointer(NULL));
+         }
+         // ... and try to place spliced list back on overflow_list ...
+         observed_overflow_list =
+@@ -7917,7 +7917,7 @@ bool CMSCollector::par_take_from_overflow_list(size_t num,
+   oop next;
+   NOT_PRODUCT(ssize_t n = 0;)
+   for (cur = prefix; cur != NULL; cur = next) {
+-    next = oop(cur->mark_raw());
++    next = oop(cur->mark_raw().to_pointer());
+     cur->set_mark_raw(proto);   // until proven otherwise
+     assert(oopDesc::is_oop(cur), "Should be an oop");
+     bool res = work_q->push(cur);
+@@ -7936,7 +7936,7 @@ void CMSCollector::push_on_overflow_list(oop p) {
+   NOT_PRODUCT(_num_par_pushes++;)
+   assert(oopDesc::is_oop(p), "Not an oop");
+   preserve_mark_if_necessary(p);
+-  p->set_mark_raw((markOop)_overflow_list);
++  p->set_mark_raw(markOop::from_pointer(_overflow_list));
+   _overflow_list = p;
+ }
+ 
+@@ -7950,9 +7950,9 @@ void CMSCollector::par_push_on_overflow_list(oop p) {
+   do {
+     cur_overflow_list = observed_overflow_list;
+     if (cur_overflow_list != BUSY) {
+-      p->set_mark_raw(markOop(cur_overflow_list));
++      p->set_mark_raw(markOop::from_pointer((void*)cur_overflow_list));
+     } else {
+-      p->set_mark_raw(NULL);
++      p->set_mark_raw(markOop::from_pointer(NULL));
+     }
+     observed_overflow_list =
+       Atomic::cmpxchg((oopDesc*)p, &_overflow_list, (oopDesc*)cur_overflow_list);
+@@ -7985,14 +7985,14 @@ void CMSCollector::preserve_mark_work(oop p, markOop m) {
+ // Single threaded
+ void CMSCollector::preserve_mark_if_necessary(oop p) {
+   markOop m = p->mark_raw();
+-  if (m->must_be_preserved(p)) {
++  if (m.must_be_preserved(p)) {
+     preserve_mark_work(p, m);
+   }
+ }
+ 
+ void CMSCollector::par_preserve_mark_if_necessary(oop p) {
+   markOop m = p->mark_raw();
+-  if (m->must_be_preserved(p)) {
++  if (m.must_be_preserved(p)) {
+     MutexLockerEx x(ParGCRareEvent_lock, Mutex::_no_safepoint_check_flag);
+     // Even though we read the mark word without holding
+     // the lock, we are assured that it will not change
+diff --git a/src/hotspot/share/gc/cms/freeChunk.hpp b/src/hotspot/share/gc/cms/freeChunk.hpp
+index a48a6dd1f..02bce8602 100644
+--- a/src/hotspot/share/gc/cms/freeChunk.hpp
++++ b/src/hotspot/share/gc/cms/freeChunk.hpp
+@@ -62,8 +62,8 @@ class FreeChunk {
+   FreeChunk* _prev;
+   FreeChunk* _next;
+ 
+-  markOop mark()     const volatile { return (markOop)_size; }
+-  void set_mark(markOop m)          { _size = (size_t)m; }
++  markOop mark()     const volatile { return markOop((uintptr_t)_size); }
++  void set_mark(markOop m)          { _size = (size_t)m.value(); }
+ 
+  public:
+   NOT_PRODUCT(static const size_t header_size();)
+@@ -79,7 +79,7 @@ class FreeChunk {
+   }
+ 
+   bool is_free() const volatile {
+-    LP64_ONLY(if (UseCompressedOops) return mark()->is_cms_free_chunk(); else)
++    LP64_ONLY(if (UseCompressedOops) return mark().is_cms_free_chunk(); else)
+     return (((intptr_t)_prev) & 0x1) == 0x1;
+   }
+   bool cantCoalesce() const {
+@@ -100,7 +100,7 @@ class FreeChunk {
+   debug_only(void* size_addr() const { return (void*)&_size; })
+ 
+   size_t size() const volatile {
+-    LP64_ONLY(if (UseCompressedOops) return mark()->get_size(); else )
++    LP64_ONLY(if (UseCompressedOops) return mark().get_size(); else )
+     return _size;
+   }
+   void set_size(size_t sz) {
+diff --git a/src/hotspot/share/gc/cms/parOopClosures.inline.hpp b/src/hotspot/share/gc/cms/parOopClosures.inline.hpp
+index 609a14868..e73659121 100644
+--- a/src/hotspot/share/gc/cms/parOopClosures.inline.hpp
++++ b/src/hotspot/share/gc/cms/parOopClosures.inline.hpp
+@@ -47,7 +47,7 @@ template <class T> inline void ParScanWeakRefClosure::do_oop_work(T* p) {
+     OrderAccess::loadload();
+     markOop m = obj->mark_raw();
+     oop new_obj;
+-    if (m->is_marked()) { // Contains forwarding pointer.
++    if (m.is_marked()) { // Contains forwarding pointer.
+       new_obj = ParNewGeneration::real_forwardee(obj);
+     } else {
+       size_t obj_sz = obj->size_given_klass(objK);
+@@ -112,7 +112,7 @@ inline void ParScanClosure::do_oop_work(T* p,
+       OrderAccess::loadload();
+       markOop m = obj->mark_raw();
+       oop new_obj;
+-      if (m->is_marked()) { // Contains forwarding pointer.
++      if (m.is_marked()) { // Contains forwarding pointer.
+         new_obj = ParNewGeneration::real_forwardee(obj);
+         RawAccess<IS_NOT_NULL>::oop_store(p, new_obj);
+         log_develop_trace(gc, scavenge)("{%s %s ( " PTR_FORMAT " ) " PTR_FORMAT " -> " PTR_FORMAT " (%d)}",
+diff --git a/src/hotspot/share/gc/cms/promotionInfo.cpp b/src/hotspot/share/gc/cms/promotionInfo.cpp
+index 971368c12..50bb470d5 100644
+--- a/src/hotspot/share/gc/cms/promotionInfo.cpp
++++ b/src/hotspot/share/gc/cms/promotionInfo.cpp
+@@ -95,7 +95,7 @@ void PromotionInfo::track(PromotedObject* trackOop, Klass* klassOfOop) {
+   // make a copy of header as it may need to be spooled
+   markOop mark = oop(trackOop)->mark_raw();
+   trackOop->clear_next();
+-  if (mark->must_be_preserved_for_cms_scavenge(klassOfOop)) {
++  if (mark.must_be_preserved_for_cms_scavenge(klassOfOop)) {
+     // save non-prototypical header, and mark oop
+     saveDisplacedHeader(mark);
+     trackOop->setDisplacedMark();
+diff --git a/src/hotspot/share/gc/g1/g1FullGCCompactionPoint.cpp b/src/hotspot/share/gc/g1/g1FullGCCompactionPoint.cpp
+index 76e9e77d7..8dbf7e8cb 100644
+--- a/src/hotspot/share/gc/g1/g1FullGCCompactionPoint.cpp
++++ b/src/hotspot/share/gc/g1/g1FullGCCompactionPoint.cpp
+@@ -117,10 +117,10 @@ void G1FullGCCompactionPoint::forward(oop object, size_t size) {
+       // Make sure object has the correct mark-word set or that it will be
+       // fixed when restoring the preserved marks.
+       assert(object->mark_raw() == markOopDesc::prototype_for_object(object) || // Correct mark
+-             object->mark_raw()->must_be_preserved(object) || // Will be restored by PreservedMarksSet
++             object->mark_raw().must_be_preserved(object) || // Will be restored by PreservedMarksSet
+              (UseBiasedLocking && object->has_bias_pattern_raw()), // Will be restored by BiasedLocking
+              "should have correct prototype obj: " PTR_FORMAT " mark: " PTR_FORMAT " prototype: " PTR_FORMAT,
+-             p2i(object), p2i(object->mark_raw()), p2i(markOopDesc::prototype_for_object(object)));
++             p2i(object), object->mark_raw().value(), markOopDesc::prototype_for_object(object).value());
+     }
+     assert(object->forwardee() == NULL, "should be forwarded to NULL");
+   }
+diff --git a/src/hotspot/share/gc/g1/g1FullGCMarker.inline.hpp b/src/hotspot/share/gc/g1/g1FullGCMarker.inline.hpp
+index 98a2fe7f1..e0976fd5c 100644
+--- a/src/hotspot/share/gc/g1/g1FullGCMarker.inline.hpp
++++ b/src/hotspot/share/gc/g1/g1FullGCMarker.inline.hpp
+@@ -51,7 +51,7 @@ inline bool G1FullGCMarker::mark_object(oop obj) {
+ 
+   // Marked by us, preserve if needed.
+   markOop mark = obj->mark_raw();
+-  if (mark->must_be_preserved(obj) &&
++  if (mark.must_be_preserved(obj) &&
+       !G1ArchiveAllocator::is_open_archive_object(obj)) {
+     preserved_stack()->push(obj, mark);
+   }
+diff --git a/src/hotspot/share/gc/g1/g1FullGCOopClosures.inline.hpp b/src/hotspot/share/gc/g1/g1FullGCOopClosures.inline.hpp
+index f19a57846..7e0feaf83 100644
+--- a/src/hotspot/share/gc/g1/g1FullGCOopClosures.inline.hpp
++++ b/src/hotspot/share/gc/g1/g1FullGCOopClosures.inline.hpp
+@@ -77,10 +77,10 @@ template <class T> inline void G1AdjustClosure::adjust_pointer(T* p) {
+   if (forwardee == NULL) {
+     // Not forwarded, return current reference.
+     assert(obj->mark_raw() == markOopDesc::prototype_for_object(obj) || // Correct mark
+-           obj->mark_raw()->must_be_preserved(obj) || // Will be restored by PreservedMarksSet
++           obj->mark_raw().must_be_preserved(obj) || // Will be restored by PreservedMarksSet
+            (UseBiasedLocking && obj->has_bias_pattern_raw()), // Will be restored by BiasedLocking
+            "Must have correct prototype or be preserved, obj: " PTR_FORMAT ", mark: " PTR_FORMAT ", prototype: " PTR_FORMAT,
+-           p2i(obj), p2i(obj->mark_raw()), p2i(markOopDesc::prototype_for_object(obj)));
++           p2i(obj), obj->mark_raw().value(), markOopDesc::prototype_for_object(obj).value());
+     return;
+   }
+ 
+diff --git a/src/hotspot/share/gc/g1/g1OopClosures.inline.hpp b/src/hotspot/share/gc/g1/g1OopClosures.inline.hpp
+index c25491323..81f9e1d0e 100644
+--- a/src/hotspot/share/gc/g1/g1OopClosures.inline.hpp
++++ b/src/hotspot/share/gc/g1/g1OopClosures.inline.hpp
+@@ -250,8 +250,8 @@ void G1ParCopyClosure<barrier, do_mark_object>::do_oop_work(T* p) {
+   if (state.is_in_cset()) {
+     oop forwardee;
+     markOop m = obj->mark_raw();
+-    if (m->is_marked()) {
+-      forwardee = (oop) m->decode_pointer();
++    if (m.is_marked()) {
++      forwardee = (oop) m.decode_pointer();
+     } else {
+       forwardee = _par_scan_state->copy_to_survivor_space(state, obj, m);
+     }
+diff --git a/src/hotspot/share/gc/g1/g1ParScanThreadState.cpp b/src/hotspot/share/gc/g1/g1ParScanThreadState.cpp
+index 72a607168..fde1efffc 100644
+--- a/src/hotspot/share/gc/g1/g1ParScanThreadState.cpp
++++ b/src/hotspot/share/gc/g1/g1ParScanThreadState.cpp
+@@ -188,8 +188,8 @@ HeapWord* G1ParScanThreadState::allocate_in_next_plab(InCSetState const state,
+ 
+ InCSetState G1ParScanThreadState::next_state(InCSetState const state, markOop const m, uint& age) {
+   if (state.is_young()) {
+-    age = !m->has_displaced_mark_helper() ? m->age()
+-                                          : m->displaced_mark_helper()->age();
++    age = !m.has_displaced_mark_helper() ? m.age()
++                                          : m.displaced_mark_helper().age();
+     if (age < _tenuring_threshold) {
+       return state;
+     }
+@@ -274,15 +274,15 @@ oop G1ParScanThreadState::copy_to_survivor_space(InCSetState const state,
+       if (age < markOopDesc::max_age) {
+         age++;
+       }
+-      if (old_mark->has_displaced_mark_helper()) {
++      if (old_mark.has_displaced_mark_helper()) {
+         // In this case, we have to install the mark word first,
+         // otherwise obj looks to be forwarded (the old mark word,
+         // which contains the forward pointer, was copied)
+         obj->set_mark_raw(old_mark);
+-        markOop new_mark = old_mark->displaced_mark_helper()->set_age(age);
+-        old_mark->set_displaced_mark_helper(new_mark);
++        markOop new_mark = old_mark.displaced_mark_helper().set_age(age);
++        old_mark.set_displaced_mark_helper(new_mark);
+       } else {
+-        obj->set_mark_raw(old_mark->set_age(age));
++        obj->set_mark_raw(old_mark.set_age(age));
+       }
+       _age_table.add(age, word_sz);
+     } else {
+diff --git a/src/hotspot/share/gc/g1/g1ParScanThreadState.inline.hpp b/src/hotspot/share/gc/g1/g1ParScanThreadState.inline.hpp
+index 10754bafa..78cabd806 100644
+--- a/src/hotspot/share/gc/g1/g1ParScanThreadState.inline.hpp
++++ b/src/hotspot/share/gc/g1/g1ParScanThreadState.inline.hpp
+@@ -42,8 +42,8 @@ template <class T> void G1ParScanThreadState::do_oop_evac(T* p) {
+   const InCSetState in_cset_state = _g1h->in_cset_state(obj);
+   if (in_cset_state.is_in_cset()) {
+     markOop m = obj->mark_raw();
+-    if (m->is_marked()) {
+-      obj = (oop) m->decode_pointer();
++    if (m.is_marked()) {
++      obj = (oop) m.decode_pointer();
+     } else {
+       obj = copy_to_survivor_space(in_cset_state, obj, m);
+     }
+diff --git a/src/hotspot/share/gc/parallel/psMarkSweepDecorator.cpp b/src/hotspot/share/gc/parallel/psMarkSweepDecorator.cpp
+index eed0fa51b..43c336892 100644
+--- a/src/hotspot/share/gc/parallel/psMarkSweepDecorator.cpp
++++ b/src/hotspot/share/gc/parallel/psMarkSweepDecorator.cpp
+@@ -113,8 +113,8 @@ void PSMarkSweepDecorator::precompact() {
+   const intx interval = PrefetchScanIntervalInBytes;
+ 
+   while (q < t) {
+-    assert(oop(q)->mark_raw()->is_marked() || oop(q)->mark_raw()->is_unlocked() ||
+-           oop(q)->mark_raw()->has_bias_pattern(),
++    assert(oop(q)->mark_raw().is_marked() || oop(q)->mark_raw().is_unlocked() ||
++           oop(q)->mark_raw().has_bias_pattern(),
+            "these are the only valid states during a mark sweep");
+     if (oop(q)->is_gc_marked()) {
+       /* prefetch beyond q */
+@@ -259,7 +259,7 @@ bool PSMarkSweepDecorator::insert_deadspace(size_t& allowed_deadspace_words,
+   if (allowed_deadspace_words >= deadlength) {
+     allowed_deadspace_words -= deadlength;
+     CollectedHeap::fill_with_object(q, deadlength);
+-    oop(q)->set_mark_raw(oop(q)->mark_raw()->set_marked());
++    oop(q)->set_mark_raw(oop(q)->mark_raw().set_marked());
+     assert((int) deadlength == oop(q)->size(), "bad filler object size");
+     // Recall that we required "q == compaction_top".
+     return true;
+@@ -350,7 +350,7 @@ void PSMarkSweepDecorator::compact(bool mangle_free_space ) {
+       q = t;
+     } else {
+       // $$$ Funky
+-      q = (HeapWord*) oop(_first_dead)->mark_raw()->decode_pointer();
++      q = (HeapWord*) oop(_first_dead)->mark_raw().decode_pointer();
+     }
+   }
+ 
+@@ -361,7 +361,7 @@ void PSMarkSweepDecorator::compact(bool mangle_free_space ) {
+     if (!oop(q)->is_gc_marked()) {
+       // mark is pointer to next marked oop
+       debug_only(prev_q = q);
+-      q = (HeapWord*) oop(q)->mark_raw()->decode_pointer();
++      q = (HeapWord*) oop(q)->mark_raw().decode_pointer();
+       assert(q > prev_q, "we should be moving forward through memory");
+     } else {
+       // prefetch beyond q
+diff --git a/src/hotspot/share/gc/parallel/psPromotionManager.inline.hpp b/src/hotspot/share/gc/parallel/psPromotionManager.inline.hpp
+index 1ef900783..15c95e3ea 100644
+--- a/src/hotspot/share/gc/parallel/psPromotionManager.inline.hpp
++++ b/src/hotspot/share/gc/parallel/psPromotionManager.inline.hpp
+@@ -119,13 +119,13 @@ inline oop PSPromotionManager::copy_to_survivor_space(oop o) {
+   markOop test_mark = o->mark_raw();
+ 
+   // The same test as "o->is_forwarded()"
+-  if (!test_mark->is_marked()) {
++  if (!test_mark.is_marked()) {
+     bool new_obj_is_tenured = false;
+     size_t new_obj_size = o->size();
+ 
+     // Find the objects age, MT safe.
+-    uint age = (test_mark->has_displaced_mark_helper() /* o->has_displaced_mark() */) ?
+-      test_mark->displaced_mark_helper()->age() : test_mark->age();
++    uint age = (test_mark.has_displaced_mark_helper() /* o->has_displaced_mark() */) ?
++      test_mark.displaced_mark_helper().age() : test_mark.age();
+ 
+     if (!promote_immediately) {
+       // Try allocating obj in to-space (unless too old)
+diff --git a/src/hotspot/share/gc/serial/markSweep.cpp b/src/hotspot/share/gc/serial/markSweep.cpp
+index fcc4f40ec..c799afbe5 100644
+--- a/src/hotspot/share/gc/serial/markSweep.cpp
++++ b/src/hotspot/share/gc/serial/markSweep.cpp
+@@ -131,7 +131,7 @@ template <class T> inline void MarkSweep::follow_root(T* p) {
+   T heap_oop = RawAccess<>::oop_load(p);
+   if (!CompressedOops::is_null(heap_oop)) {
+     oop obj = CompressedOops::decode_not_null(heap_oop);
+-    if (!obj->mark_raw()->is_marked()) {
++    if (!obj->mark_raw().is_marked()) {
+       mark_object(obj);
+       follow_object(obj);
+     }
+diff --git a/src/hotspot/share/gc/serial/markSweep.inline.hpp b/src/hotspot/share/gc/serial/markSweep.inline.hpp
+index 25a5a315f..e021d8b17 100644
+--- a/src/hotspot/share/gc/serial/markSweep.inline.hpp
++++ b/src/hotspot/share/gc/serial/markSweep.inline.hpp
+@@ -39,9 +39,9 @@ inline void MarkSweep::mark_object(oop obj) {
+   // some marks may contain information we need to preserve so we store them away
+   // and overwrite the mark.  We'll restore it at the end of markSweep.
+   markOop mark = obj->mark_raw();
+-  obj->set_mark_raw(markOopDesc::prototype()->set_marked());
++  obj->set_mark_raw(markOopDesc::prototype().set_marked());
+ 
+-  if (mark->must_be_preserved(obj)) {
++  if (mark.must_be_preserved(obj)) {
+     preserve_mark(obj, mark);
+   }
+ }
+@@ -50,7 +50,7 @@ template <class T> inline void MarkSweep::mark_and_push(T* p) {
+   T heap_oop = RawAccess<>::oop_load(p);
+   if (!CompressedOops::is_null(heap_oop)) {
+     oop obj = CompressedOops::decode_not_null(heap_oop);
+-    if (!obj->mark_raw()->is_marked()) {
++    if (!obj->mark_raw().is_marked()) {
+       mark_object(obj);
+       _marking_stack.push(obj);
+     }
+@@ -79,11 +79,11 @@ template <class T> inline void MarkSweep::adjust_pointer(T* p) {
+     oop obj = CompressedOops::decode_not_null(heap_oop);
+     assert(Universe::heap()->is_in(obj), "should be in heap");
+ 
+-    oop new_obj = oop(obj->mark_raw()->decode_pointer());
++    oop new_obj = oop(obj->mark_raw().decode_pointer());
+ 
+     assert(new_obj != NULL ||                         // is forwarding ptr?
+            obj->mark_raw() == markOopDesc::prototype() || // not gc marked?
+-           (UseBiasedLocking && obj->mark_raw()->has_bias_pattern()),
++           (UseBiasedLocking && obj->mark_raw().has_bias_pattern()),
+            // not gc marked?
+            "should be forwarded");
+ 
+diff --git a/src/hotspot/share/gc/shared/preservedMarks.inline.hpp b/src/hotspot/share/gc/shared/preservedMarks.inline.hpp
+index e246a8a5b..42691d63b 100644
+--- a/src/hotspot/share/gc/shared/preservedMarks.inline.hpp
++++ b/src/hotspot/share/gc/shared/preservedMarks.inline.hpp
+@@ -31,7 +31,7 @@
+ #include "utilities/stack.inline.hpp"
+ 
+ inline bool PreservedMarks::should_preserve_mark(oop obj, markOop m) const {
+-  return m->must_be_preserved_for_promotion_failure(obj);
++  return m.must_be_preserved_for_promotion_failure(obj);
+ }
+ 
+ inline void PreservedMarks::push(oop obj, markOop m) {
+diff --git a/src/hotspot/share/gc/shared/space.inline.hpp b/src/hotspot/share/gc/shared/space.inline.hpp
+index ad22b6c42..3732606bc 100644
+--- a/src/hotspot/share/gc/shared/space.inline.hpp
++++ b/src/hotspot/share/gc/shared/space.inline.hpp
+@@ -118,7 +118,7 @@ public:
+       _allowed_deadspace_words -= dead_length;
+       CollectedHeap::fill_with_object(dead_start, dead_length);
+       oop obj = oop(dead_start);
+-      obj->set_mark_raw(obj->mark_raw()->set_marked());
++      obj->set_mark_raw(obj->mark_raw().set_marked());
+ 
+       assert(dead_length == (size_t)obj->size(), "bad filler object size");
+       log_develop_trace(gc, compaction)("Inserting object to dead space: " PTR_FORMAT ", " PTR_FORMAT ", " SIZE_FORMAT "b",
+@@ -165,8 +165,8 @@ inline void CompactibleSpace::scan_and_forward(SpaceType* space, CompactPoint* c
+ 
+   while (cur_obj < scan_limit) {
+     assert(!space->scanned_block_is_obj(cur_obj) ||
+-           oop(cur_obj)->mark_raw()->is_marked() || oop(cur_obj)->mark_raw()->is_unlocked() ||
+-           oop(cur_obj)->mark_raw()->has_bias_pattern(),
++           oop(cur_obj)->mark_raw().is_marked() || oop(cur_obj)->mark_raw().is_unlocked() ||
++           oop(cur_obj)->mark_raw().has_bias_pattern(),
+            "these are the only valid states during a mark sweep");
+     if (space->scanned_block_is_obj(cur_obj) && oop(cur_obj)->is_gc_marked()) {
+       // prefetch beyond cur_obj
+diff --git a/src/hotspot/share/gc/shenandoah/shenandoahAsserts.cpp b/src/hotspot/share/gc/shenandoah/shenandoahAsserts.cpp
+index 1f8b79d5e..d9ecdc8f7 100644
+--- a/src/hotspot/share/gc/shenandoah/shenandoahAsserts.cpp
++++ b/src/hotspot/share/gc/shenandoah/shenandoahAsserts.cpp
+@@ -60,7 +60,7 @@ void ShenandoahAsserts::print_obj(ShenandoahMessageBuffer& msg, oop obj) {
+   r->print_on(&ss);
+ 
+   stringStream mw_ss;
+-  obj->mark()->print_on(&mw_ss);
++  obj->mark().print_on(&mw_ss);
+ 
+   ShenandoahMarkingContext* const ctx = heap->marking_context();
+ 
+diff --git a/src/hotspot/share/gc/shenandoah/shenandoahForwarding.inline.hpp b/src/hotspot/share/gc/shenandoah/shenandoahForwarding.inline.hpp
+index 50d9c5015..4db606bfc 100644
+--- a/src/hotspot/share/gc/shenandoah/shenandoahForwarding.inline.hpp
++++ b/src/hotspot/share/gc/shenandoah/shenandoahForwarding.inline.hpp
+@@ -40,8 +40,8 @@ inline HeapWord* ShenandoahForwarding::get_forwardee_raw_unchecked(oop obj) {
+   // fwdptr. That object is still not forwarded, and we need to return
+   // the object itself.
+   markOop mark = obj->mark_raw();
+-  if (mark->is_marked()) {
+-    HeapWord* fwdptr = (HeapWord*) mark->clear_lock_bits();
++  if (mark.is_marked()) {
++    HeapWord* fwdptr = (HeapWord*) mark.clear_lock_bits().to_pointer();
+     if (fwdptr != NULL) {
+       return fwdptr;
+     }
+@@ -55,8 +55,8 @@ inline oop ShenandoahForwarding::get_forwardee_mutator(oop obj) {
+   assert(Thread::current()->is_Java_thread(), "Must be a mutator thread");
+ 
+   markOop mark = obj->mark_raw();
+-  if (mark->is_marked()) {
+-    HeapWord* fwdptr = (HeapWord*)mark->clear_lock_bits();
++  if (mark.is_marked()) {
++    HeapWord* fwdptr = (HeapWord*)mark.clear_lock_bits().to_pointer();
+     assert(fwdptr != NULL, "Forwarding pointer is never null here");
+     return oop(fwdptr);
+   } else {
+@@ -70,13 +70,13 @@ inline oop ShenandoahForwarding::get_forwardee(oop obj) {
+ }
+ 
+ inline bool ShenandoahForwarding::is_forwarded(oop obj) {
+-  return obj->mark_raw()->is_marked();
++  return obj->mark_raw().is_marked();
+ }
+ 
+ inline oop ShenandoahForwarding::try_update_forwardee(oop obj, oop update) {
+   markOop old_mark = obj->mark_raw();
+-  if (old_mark->is_marked()) {
+-    return (oop) old_mark->clear_lock_bits();
++  if (old_mark.is_marked()) {
++    return (oop) old_mark.clear_lock_bits().to_pointer();
+   }
+ 
+   markOop new_mark = markOopDesc::encode_pointer_as_mark(update);
+@@ -84,7 +84,7 @@ inline oop ShenandoahForwarding::try_update_forwardee(oop obj, oop update) {
+   if (prev_mark == old_mark) {
+     return update;
+   } else {
+-    return (oop) prev_mark->clear_lock_bits();
++    return (oop) prev_mark.clear_lock_bits().to_pointer();
+   }
+ }
+ 
+diff --git a/src/hotspot/share/gc/shenandoah/shenandoahStringDedup.cpp b/src/hotspot/share/gc/shenandoah/shenandoahStringDedup.cpp
+index edcb7724f..b7c4665b9 100644
+--- a/src/hotspot/share/gc/shenandoah/shenandoahStringDedup.cpp
++++ b/src/hotspot/share/gc/shenandoah/shenandoahStringDedup.cpp
+@@ -50,14 +50,14 @@ void ShenandoahStringDedup::enqueue_candidate(oop java_string) {
+     const markOop mark = java_string->mark();
+ 
+     // Having/had displaced header, too risk to deal with them, skip
+-    if (mark == markOopDesc::INFLATING() || mark->has_displaced_mark_helper()) {
++    if (mark == markOopDesc::INFLATING() || mark.has_displaced_mark_helper()) {
+       return;
+     }
+ 
+     // Increase string age and enqueue it when it rearches age threshold
+-    markOop new_mark = mark->incr_age();
++    markOop new_mark = mark.incr_age();
+     if (mark == java_string->cas_set_mark(new_mark, mark)) {
+-      if (mark->age() == StringDeduplicationAgeThreshold) {
++      if (mark.age() == StringDeduplicationAgeThreshold) {
+         StringDedupQueue::push(ShenandoahWorkerSession::worker_id(), java_string);
+       }
+     }
+diff --git a/src/hotspot/share/interpreter/bytecodeInterpreter.cpp b/src/hotspot/share/interpreter/bytecodeInterpreter.cpp
+index cea137469..3ebdc7714 100644
+--- a/src/hotspot/share/interpreter/bytecodeInterpreter.cpp
++++ b/src/hotspot/share/interpreter/bytecodeInterpreter.cpp
+@@ -668,7 +668,7 @@ BytecodeInterpreter::run(interpreterState istate) {
+         markOop mark = rcvr->mark();
+         intptr_t hash = (intptr_t) markOopDesc::no_hash;
+         // Implies UseBiasedLocking.
+-        if (mark->has_bias_pattern()) {
++        if (mark.has_bias_pattern()) {
+           uintptr_t thread_ident;
+           uintptr_t anticipated_bias_locking_value;
+           thread_ident = (uintptr_t)istate->thread();
+@@ -730,7 +730,7 @@ BytecodeInterpreter::run(interpreterState istate) {
+ 
+         // Traditional lightweight locking.
+         if (!success) {
+-          markOop displaced = rcvr->mark()->set_unlocked();
++          markOop displaced = rcvr->mark().set_unlocked();
+           mon->lock()->set_displaced_header(displaced);
+           bool call_vm = UseHeavyMonitors;
+           if (call_vm || rcvr->cas_set_mark((markOop)mon, displaced) != displaced) {
+@@ -854,7 +854,7 @@ BytecodeInterpreter::run(interpreterState istate) {
+       markOop mark = lockee->mark();
+       intptr_t hash = (intptr_t) markOopDesc::no_hash;
+       // implies UseBiasedLocking
+-      if (mark->has_bias_pattern()) {
++      if (mark.has_bias_pattern()) {
+         uintptr_t thread_ident;
+         uintptr_t anticipated_bias_locking_value;
+         thread_ident = (uintptr_t)istate->thread();
+@@ -916,7 +916,7 @@ BytecodeInterpreter::run(interpreterState istate) {
+ 
+       // traditional lightweight locking
+       if (!success) {
+-        markOop displaced = lockee->mark()->set_unlocked();
++        markOop displaced = lockee->mark().set_unlocked();
+         entry->lock()->set_displaced_header(displaced);
+         bool call_vm = UseHeavyMonitors;
+         if (call_vm || lockee->cas_set_mark((markOop)entry, displaced) != displaced) {
+@@ -1794,7 +1794,7 @@ run:
+           markOop mark = lockee->mark();
+           intptr_t hash = (intptr_t) markOopDesc::no_hash;
+           // implies UseBiasedLocking
+-          if (mark->has_bias_pattern()) {
++          if (mark.has_bias_pattern()) {
+             uintptr_t thread_ident;
+             uintptr_t anticipated_bias_locking_value;
+             thread_ident = (uintptr_t)istate->thread();
+@@ -1859,7 +1859,7 @@ run:
+ 
+           // traditional lightweight locking
+           if (!success) {
+-            markOop displaced = lockee->mark()->set_unlocked();
++            markOop displaced = lockee->mark().set_unlocked();
+             entry->lock()->set_displaced_header(displaced);
+             bool call_vm = UseHeavyMonitors;
+             if (call_vm || lockee->cas_set_mark((markOop)entry, displaced) != displaced) {
+@@ -1890,7 +1890,7 @@ run:
+             BasicLock* lock = most_recent->lock();
+             markOop header = lock->displaced_header();
+             most_recent->set_obj(NULL);
+-            if (!lockee->mark()->has_bias_pattern()) {
++            if (!lockee->mark().has_bias_pattern()) {
+               bool call_vm = UseHeavyMonitors;
+               // If it isn't recursive we either must swap old header or call the runtime
+               if (header != NULL || call_vm) {
+@@ -3030,7 +3030,7 @@ run:
+           markOop header = lock->displaced_header();
+           end->set_obj(NULL);
+ 
+-          if (!lockee->mark()->has_bias_pattern()) {
++          if (!lockee->mark().has_bias_pattern()) {
+             // If it isn't recursive we either must swap old header or call the runtime
+             if (header != NULL) {
+               markOop old_header = markOopDesc::encode(lock);
+@@ -3105,7 +3105,7 @@ run:
+             markOop header = lock->displaced_header();
+             base->set_obj(NULL);
+ 
+-            if (!rcvr->mark()->has_bias_pattern()) {
++            if (!rcvr->mark().has_bias_pattern()) {
+               base->set_obj(NULL);
+               // If it isn't recursive we either must swap old header or call the runtime
+               if (header != NULL) {
+diff --git a/src/hotspot/share/jfr/leakprofiler/chains/bfsClosure.cpp b/src/hotspot/share/jfr/leakprofiler/chains/bfsClosure.cpp
+index e436746e8..d14d67962 100644
+--- a/src/hotspot/share/jfr/leakprofiler/chains/bfsClosure.cpp
++++ b/src/hotspot/share/jfr/leakprofiler/chains/bfsClosure.cpp
+@@ -131,7 +131,7 @@ void BFSClosure::closure_impl(const oop* reference, const oop pointee) {
+   if (!_mark_bits->is_marked(pointee)) {
+     _mark_bits->mark_obj(pointee);
+     // is the pointee a sample object?
+-    if (NULL == pointee->mark()) {
++    if (NULL == pointee->mark().to_pointer()) {
+       add_chain(reference, pointee);
+     }
+ 
+@@ -148,7 +148,7 @@ void BFSClosure::closure_impl(const oop* reference, const oop pointee) {
+ 
+ void BFSClosure::add_chain(const oop* reference, const oop pointee) {
+   assert(pointee != NULL, "invariant");
+-  assert(NULL == pointee->mark(), "invariant");
++  assert(NULL == pointee->mark().to_pointer(), "invariant");
+   Edge leak_edge(_current_parent, reference);
+   _edge_store->put_chain(&leak_edge, _current_parent == NULL ? 1 : _current_frontier_level + 2);
+ }
+diff --git a/src/hotspot/share/jfr/leakprofiler/chains/dfsClosure.cpp b/src/hotspot/share/jfr/leakprofiler/chains/dfsClosure.cpp
+index c347901bf..b1a1fca20 100644
+--- a/src/hotspot/share/jfr/leakprofiler/chains/dfsClosure.cpp
++++ b/src/hotspot/share/jfr/leakprofiler/chains/dfsClosure.cpp
+@@ -121,7 +121,7 @@ void DFSClosure::closure_impl(const oop* reference, const oop pointee) {
+   assert(_mark_bits->is_marked(pointee), "invariant");
+ 
+   // is the pointee a sample object?
+-  if (NULL == pointee->mark()) {
++  if (NULL == pointee->mark().to_pointer()) {
+     add_chain();
+   }
+ 
+diff --git a/src/hotspot/share/jfr/leakprofiler/chains/edgeStore.cpp b/src/hotspot/share/jfr/leakprofiler/chains/edgeStore.cpp
+index ad549f486..b9f09fa9a 100644
+--- a/src/hotspot/share/jfr/leakprofiler/chains/edgeStore.cpp
++++ b/src/hotspot/share/jfr/leakprofiler/chains/edgeStore.cpp
+@@ -237,8 +237,8 @@ StoredEdge* EdgeStore::associate_leak_context_with_candidate(const Edge* edge) {
+   StoredEdge* const leak_context_edge = put(edge->reference());
+   oop sample_object = edge->pointee();
+   assert(sample_object != NULL, "invariant");
+-  assert(NULL == sample_object->mark(), "invariant");
+-  sample_object->set_mark(markOop(leak_context_edge));
++  assert(NULL == sample_object->mark().to_pointer(), "invariant");
++  sample_object->set_mark(markOop::from_pointer(leak_context_edge));
+   return leak_context_edge;
+ }
+ 
+diff --git a/src/hotspot/share/jfr/leakprofiler/chains/edgeUtils.cpp b/src/hotspot/share/jfr/leakprofiler/chains/edgeUtils.cpp
+index 699fd4ac4..f4c925004 100644
+--- a/src/hotspot/share/jfr/leakprofiler/chains/edgeUtils.cpp
++++ b/src/hotspot/share/jfr/leakprofiler/chains/edgeUtils.cpp
+@@ -36,7 +36,7 @@
+ #include "runtime/handles.inline.hpp"
+ 
+ bool EdgeUtils::is_leak_edge(const Edge& edge) {
+-  return (const Edge*)edge.pointee()->mark() == &edge;
++  return (const Edge*)edge.pointee()->mark().to_pointer() == &edge;
+ }
+ 
+ static bool is_static_field(const oop ref_owner, const InstanceKlass* ik, int offset) {
+diff --git a/src/hotspot/share/jfr/leakprofiler/chains/objectSampleMarker.hpp b/src/hotspot/share/jfr/leakprofiler/chains/objectSampleMarker.hpp
+index 9a97a373f..2c2616feb 100644
+--- a/src/hotspot/share/jfr/leakprofiler/chains/objectSampleMarker.hpp
++++ b/src/hotspot/share/jfr/leakprofiler/chains/objectSampleMarker.hpp
+@@ -45,7 +45,7 @@ class ObjectSampleMarker : public StackObj {
+                         const markOop mark_oop) : _obj(obj),
+                                                   _mark_oop(mark_oop) {}
+    public:
+-    ObjectSampleMarkOop() : _obj(NULL), _mark_oop(NULL) {}
++    ObjectSampleMarkOop() : _obj(NULL), _mark_oop(markOop::zero()) {}
+   };
+ 
+   GrowableArray<ObjectSampleMarkOop>* _store;
+@@ -72,9 +72,9 @@ class ObjectSampleMarker : public StackObj {
+     // This is an "impossible" state during a safepoint,
+     // hence we will use it to quickly identify sample objects
+     // during the reachability search from gc roots.
+-    assert(NULL == markOopDesc::INFLATING(), "invariant");
++    assert(NULL == markOopDesc::INFLATING().to_pointer(), "invariant");
+     obj->set_mark(markOopDesc::INFLATING());
+-    assert(NULL == obj->mark(), "invariant");
++    assert(NULL == obj->mark().to_pointer(), "invariant");
+   }
+ };
+ 
+diff --git a/src/hotspot/share/jfr/leakprofiler/checkpoint/eventEmitter.cpp b/src/hotspot/share/jfr/leakprofiler/checkpoint/eventEmitter.cpp
+index 02d9c2d9c..438f91763 100644
+--- a/src/hotspot/share/jfr/leakprofiler/checkpoint/eventEmitter.cpp
++++ b/src/hotspot/share/jfr/leakprofiler/checkpoint/eventEmitter.cpp
+@@ -111,7 +111,7 @@ void EventEmitter::write_event(const ObjectSample* sample, EdgeStore* edge_store
+   traceid gc_root_id = 0;
+   const Edge* edge = NULL;
+   if (SafepointSynchronize::is_at_safepoint()) {
+-    edge = (const Edge*)(*object_addr)->mark();
++    edge = (const Edge*)(*object_addr)->mark().to_pointer();
+   }
+   if (edge == NULL) {
+     // In order to dump out a representation of the event
+diff --git a/src/hotspot/share/jfr/leakprofiler/utilities/saveRestore.cpp b/src/hotspot/share/jfr/leakprofiler/utilities/saveRestore.cpp
+index 3cfff5a70..14055853e 100644
+--- a/src/hotspot/share/jfr/leakprofiler/utilities/saveRestore.cpp
++++ b/src/hotspot/share/jfr/leakprofiler/utilities/saveRestore.cpp
+@@ -27,7 +27,7 @@
+ #include "jfr/leakprofiler/utilities/saveRestore.hpp"
+ #include "oops/oop.inline.hpp"
+ 
+-MarkOopContext::MarkOopContext() : _obj(NULL), _mark_oop(NULL) {}
++MarkOopContext::MarkOopContext() : _obj(NULL), _mark_oop(markOop::zero()) {}
+ 
+ MarkOopContext::MarkOopContext(const oop obj) : _obj(obj), _mark_oop(obj->mark()) {
+   assert(_obj->mark() == _mark_oop, "invariant");
+@@ -36,9 +36,9 @@ MarkOopContext::MarkOopContext(const oop obj) : _obj(obj), _mark_oop(obj->mark()
+   // This is an "impossible" state during a safepoint,
+   // hence we will use it to quickly identify objects
+   // during the reachability search from gc roots.
+-  assert(NULL == markOopDesc::INFLATING(), "invariant");
++  assert(markOop::zero() == markOopDesc::INFLATING(), "invariant");
+   _obj->set_mark(markOopDesc::INFLATING());
+-  assert(NULL == obj->mark(), "invariant");
++  assert(markOop::zero() == obj->mark(), "invariant");
+ }
+ 
+ MarkOopContext::~MarkOopContext() {
+@@ -48,7 +48,7 @@ MarkOopContext::~MarkOopContext() {
+   }
+ }
+ 
+-MarkOopContext::MarkOopContext(const MarkOopContext& rhs) : _obj(NULL), _mark_oop(NULL) {
++MarkOopContext::MarkOopContext(const MarkOopContext& rhs) : _obj(NULL), _mark_oop(markOop::zero()) {
+   swap(const_cast<MarkOopContext&>(rhs));
+ }
+ 
+diff --git a/src/hotspot/share/memory/metaspaceShared.cpp b/src/hotspot/share/memory/metaspaceShared.cpp
+index c636ddbe9..b9aa49171 100644
+--- a/src/hotspot/share/memory/metaspaceShared.cpp
++++ b/src/hotspot/share/memory/metaspaceShared.cpp
+@@ -1865,7 +1865,7 @@ void MetaspaceShared::dump_open_archive_heap_objects(
+ }
+ 
+ unsigned MetaspaceShared::obj_hash(oop const& p) {
+-  assert(!p->mark()->has_bias_pattern(),
++  assert(!p->mark().has_bias_pattern(),
+          "this object should never have been locked");  // so identity_hash won't safepoin
+   unsigned hash = (unsigned)p->identity_hash();
+   return hash;
+diff --git a/src/hotspot/share/memory/universe.cpp b/src/hotspot/share/memory/universe.cpp
+index eab9576bc..933b17676 100644
+--- a/src/hotspot/share/memory/universe.cpp
++++ b/src/hotspot/share/memory/universe.cpp
+@@ -1315,7 +1315,7 @@ uintptr_t Universe::verify_mark_mask() {
+ 
+ uintptr_t Universe::verify_mark_bits() {
+   intptr_t mask = verify_mark_mask();
+-  intptr_t bits = (intptr_t)markOopDesc::prototype();
++  intptr_t bits = (intptr_t)markOopDesc::prototype().value();
+   assert((bits & ~mask) == 0, "no stray header bits");
+   return bits;
+ }
+diff --git a/src/hotspot/share/memory/virtualspace.cpp b/src/hotspot/share/memory/virtualspace.cpp
+index d67f624ca..691838c70 100644
+--- a/src/hotspot/share/memory/virtualspace.cpp
++++ b/src/hotspot/share/memory/virtualspace.cpp
+@@ -628,9 +628,9 @@ ReservedHeapSpace::ReservedHeapSpace(size_t size, size_t alignment, bool large,
+     initialize(size, alignment, large, NULL, false);
+   }
+ 
+-  assert(markOopDesc::encode_pointer_as_mark(_base)->decode_pointer() == _base,
++  assert(markOopDesc::encode_pointer_as_mark(_base).decode_pointer() == _base,
+          "area must be distinguishable from marks for mark-sweep");
+-  assert(markOopDesc::encode_pointer_as_mark(&_base[size])->decode_pointer() == &_base[size],
++  assert(markOopDesc::encode_pointer_as_mark(&_base[size]).decode_pointer() == &_base[size],
+          "area must be distinguishable from marks for mark-sweep");
+ 
+   if (base() != NULL) {
+diff --git a/src/hotspot/share/oops/klass.cpp b/src/hotspot/share/oops/klass.cpp
+index 4b97cf7eb..cacfaf82f 100644
+--- a/src/hotspot/share/oops/klass.cpp
++++ b/src/hotspot/share/oops/klass.cpp
+@@ -682,7 +682,7 @@ void Klass::oop_print_on(oop obj, outputStream* st) {
+ 
+   if (WizardMode) {
+      // print header
+-     obj->mark()->print_on(st);
++     obj->mark().print_on(st);
+   }
+ 
+   // print class
+diff --git a/src/hotspot/share/oops/klass.hpp b/src/hotspot/share/oops/klass.hpp
+index 3ade5867a..9094ff0a9 100644
+--- a/src/hotspot/share/oops/klass.hpp
++++ b/src/hotspot/share/oops/klass.hpp
+@@ -28,6 +28,7 @@
+ #include "classfile/classLoaderData.hpp"
+ #include "memory/iterator.hpp"
+ #include "memory/memRegion.hpp"
++#include "oops/markOop.hpp"
+ #include "oops/metadata.hpp"
+ #include "oops/oop.hpp"
+ #include "oops/oopHandle.hpp"
+diff --git a/src/hotspot/share/oops/klass.inline.hpp b/src/hotspot/share/oops/klass.inline.hpp
+index 560998057..89917e4f6 100644
+--- a/src/hotspot/share/oops/klass.inline.hpp
++++ b/src/hotspot/share/oops/klass.inline.hpp
+@@ -30,7 +30,7 @@
+ #include "oops/markOop.hpp"
+ 
+ inline void Klass::set_prototype_header(markOop header) {
+-  assert(!header->has_bias_pattern() || is_instance_klass(), "biased locking currently only supported for Java instances");
++  assert(!header.has_bias_pattern() || is_instance_klass(), "biased locking currently only supported for Java instances");
+   _prototype_header = header;
+ }
+ 
+diff --git a/src/hotspot/share/oops/markOop.hpp b/src/hotspot/share/oops/markOop.hpp
+index 649217c88..036b42372 100644
+--- a/src/hotspot/share/oops/markOop.hpp
++++ b/src/hotspot/share/oops/markOop.hpp
+@@ -101,10 +101,9 @@ class BasicLock;
+ class ObjectMonitor;
+ class JavaThread;
+ 
+-class markOopDesc: public oopDesc {
++class markOop {
+  private:
+-  // Conversion
+-  uintptr_t value() const { return (uintptr_t) this; }
++  uintptr_t _value;
+ 
+  public:
+   // Constants
+@@ -117,6 +116,29 @@ class markOopDesc: public oopDesc {
+          epoch_bits               = 2
+   };
+ 
++  explicit markOop(uintptr_t value) : _value(value) {}
++
++  markOop() { /* uninitialized */}
++
++  // It is critical for performance that this class be trivially
++  // destructable, copyable, and assignable.
++
++  static markOop from_pointer(void* ptr) {
++    return markOop((uintptr_t)ptr);
++  }
++  void* to_pointer() const {
++    return (void*)_value;
++  }
++
++  bool operator==(const markOop& other) const {
++    return _value == other._value;
++  }
++  bool operator!=(const markOop& other) const {
++    return !operator==(other);
++  }
++  // Conversion
++  uintptr_t value() const { return _value; }
++
+   // The biased locking code currently requires that the age bits be
+   // contiguous to the lock bits.
+   enum { lock_shift               = 0,
+@@ -164,6 +186,9 @@ class markOopDesc: public oopDesc {
+ 
+   enum { max_bias_epoch           = epoch_mask };
+ 
++  // Creates a markOop with all bits set to zero.
++  static markOop zero() { return markOop(uintptr_t(0)); }
++
+   // Biased Locking accessors.
+   // These must be checked by all code which calls into the
+   // ObjectSynchronizer and other code. The biasing is not understood
+@@ -224,7 +249,7 @@ class markOopDesc: public oopDesc {
+   // check for and avoid overwriting a 0 value installed by some
+   // other thread.  (They should spin or block instead.  The 0 value
+   // is transient and *should* be short-lived).
+-  static markOop INFLATING() { return (markOop) 0; }    // inflate-in-progress
++  static markOop INFLATING() { return zero(); }    // inflate-in-progress
+ 
+   // Should this header be preserved during GC?
+   inline bool must_be_preserved(oop obj_containing_mark) const;
+@@ -294,17 +319,17 @@ class markOopDesc: public oopDesc {
+   markOop copy_set_hash(intptr_t hash) const {
+     intptr_t tmp = value() & (~hash_mask_in_place);
+     tmp |= ((hash & hash_mask) << hash_shift);
+-    return (markOop)tmp;
++    return markOop(tmp);
+   }
+   // it is only used to be stored into BasicLock as the
+   // indicator that the lock is using heavyweight monitor
+   static markOop unused_mark() {
+-    return (markOop) marked_value;
++    return markOop(marked_value);
+   }
+   // the following two functions create the markOop to be
+   // stored into object header, it encodes monitor info
+   static markOop encode(BasicLock* lock) {
+-    return (markOop) lock;
++    return from_pointer(lock);
+   }
+   static markOop encode(ObjectMonitor* monitor) {
+     intptr_t tmp = (intptr_t) monitor;
+@@ -330,7 +355,7 @@ class markOopDesc: public oopDesc {
+     assert((v & ~age_mask) == 0, "shouldn't overflow age field");
+     return markOop((value() & ~age_mask_in_place) | (((uintptr_t)v & age_mask) << age_shift));
+   }
+-  markOop incr_age()          const { return age() == max_age ? markOop(this) : set_age(age() + 1); }
++  markOop incr_age()          const { return age() == max_age ? markOop(_value) : set_age(age() + 1); }
+ 
+   // hash operations
+   intptr_t hash() const {
+@@ -353,10 +378,10 @@ class markOopDesc: public oopDesc {
+   void print_on(outputStream* st) const;
+ 
+   // Prepare address of oop for placement into mark
+-  inline static markOop encode_pointer_as_mark(void* p) { return markOop(p)->set_marked(); }
++  inline static markOop encode_pointer_as_mark(void* p) { return from_pointer(p).set_marked(); }
+ 
+   // Recover address of oop from encoded form used in mark
+-  inline void* decode_pointer() { if (UseBiasedLocking && has_bias_pattern()) return NULL; return clear_lock_bits(); }
++  inline void* decode_pointer() { if (UseBiasedLocking && has_bias_pattern()) return NULL; return (void*)clear_lock_bits().value(); }
+ 
+   // These markOops indicate cms free chunk blocks and not objects.
+   // In 64 bit, the markOop is set to distinguish them from oops.
+@@ -375,7 +400,7 @@ class markOopDesc: public oopDesc {
+ 
+ #ifdef _LP64
+   static markOop cms_free_prototype() {
+-    return markOop(((intptr_t)prototype() & ~cms_mask_in_place) |
++    return markOop(((intptr_t)prototype().value() & ~cms_mask_in_place) |
+                    ((cms_free_chunk_pattern & cms_mask) << cms_shift));
+   }
+   uintptr_t cms_encoding() const {
+@@ -389,10 +414,23 @@ class markOopDesc: public oopDesc {
+   size_t get_size() const       { return (size_t)(value() >> size_shift); }
+   static markOop set_size_and_free(size_t size) {
+     assert((size & ~size_mask) == 0, "shouldn't overflow size field");
+-    return markOop(((intptr_t)cms_free_prototype() & ~size_mask_in_place) |
++    return markOop(((intptr_t)cms_free_prototype().value() & ~size_mask_in_place) |
+                    (((intptr_t)size & size_mask) << size_shift));
+   }
+ #endif // _LP64
+ };
+ 
++// Add an alias for the Desc type to minimize code churn.
++typedef class markOop markOopDesc;
++
++// Support atomic operations.
++template<>
++struct PrimitiveConversions::Translate<markOop> : public TrueType {
++  typedef markOop Value;
++  typedef uintptr_t Decayed;
++
++  static Decayed decay(const Value& x) { return x.value(); }
++  static Value recover(Decayed x) { return Value(x); }
++};
++
+ #endif // SHARE_VM_OOPS_MARKOOP_HPP
+diff --git a/src/hotspot/share/oops/markOop.inline.hpp b/src/hotspot/share/oops/markOop.inline.hpp
+index 77d2fee0e..f0e042070 100644
+--- a/src/hotspot/share/oops/markOop.inline.hpp
++++ b/src/hotspot/share/oops/markOop.inline.hpp
+@@ -39,7 +39,7 @@ inline bool markOopDesc::must_be_preserved_with_bias(oop obj_containing_mark) co
+     return false;
+   }
+   markOop prototype_header = prototype_for_object(obj_containing_mark);
+-  if (prototype_header->has_bias_pattern()) {
++  if (prototype_header.has_bias_pattern()) {
+     // Individual instance which has its bias revoked; must return
+     // true for correctness
+     return true;
+@@ -68,7 +68,7 @@ inline bool markOopDesc::must_be_preserved_with_bias_for_promotion_failure(oop o
+   // BiasedLocking::preserve_marks() / restore_marks() in the middle
+   // of a scavenge when a promotion failure has first been detected.
+   if (has_bias_pattern() ||
+-      prototype_for_object(obj_containing_mark)->has_bias_pattern()) {
++      prototype_for_object(obj_containing_mark).has_bias_pattern()) {
+     return true;
+   }
+   return (!is_unlocked() || !has_no_hash());
+@@ -89,7 +89,7 @@ inline bool markOopDesc::must_be_preserved_with_bias_for_cms_scavenge(Klass* kla
+   assert(UseBiasedLocking, "unexpected");
+   // CMS scavenges preserve mark words in similar fashion to promotion failures; see above
+   if (has_bias_pattern() ||
+-      klass_of_obj_containing_mark->prototype_header()->has_bias_pattern()) {
++      klass_of_obj_containing_mark->prototype_header().has_bias_pattern()) {
+     return true;
+   }
+   return (!is_unlocked() || !has_no_hash());
+@@ -106,7 +106,7 @@ inline bool markOopDesc::must_be_preserved_for_cms_scavenge(Klass* klass_of_obj_
+ inline markOop markOopDesc::prototype_for_object(oop obj) {
+ #ifdef ASSERT
+   markOop prototype_header = obj->klass()->prototype_header();
+-  assert(prototype_header == prototype() || prototype_header->has_bias_pattern(), "corrupt prototype header");
++  assert(prototype_header == prototype() || prototype_header.has_bias_pattern(), "corrupt prototype header");
+ #endif
+   return obj->klass()->prototype_header();
+ }
+diff --git a/src/hotspot/share/oops/oop.cpp b/src/hotspot/share/oops/oop.cpp
+index 0470cbbde..ab598d767 100644
+--- a/src/hotspot/share/oops/oop.cpp
++++ b/src/hotspot/share/oops/oop.cpp
+@@ -130,7 +130,7 @@ bool oopDesc::is_oop(oop obj, bool ignore_mark_word) {
+   if (ignore_mark_word) {
+     return true;
+   }
+-  if (obj->mark_raw() != NULL) {
++  if (obj->mark_raw().value() != 0) {
+     return true;
+   }
+   return !SafepointSynchronize::is_at_safepoint();
+@@ -145,7 +145,7 @@ bool oopDesc::is_oop_or_null(oop obj, bool ignore_mark_word) {
+ // used only for asserts
+ bool oopDesc::is_unlocked_oop() const {
+   if (!Universe::heap()->is_in_reserved(this)) return false;
+-  return mark()->is_unlocked();
++  return mark().is_unlocked();
+ }
+ #endif // PRODUCT
+ 
+diff --git a/src/hotspot/share/oops/oop.hpp b/src/hotspot/share/oops/oop.hpp
+index 4430530e5..6311ee908 100644
+--- a/src/hotspot/share/oops/oop.hpp
++++ b/src/hotspot/share/oops/oop.hpp
+@@ -28,6 +28,7 @@
+ #include "memory/iterator.hpp"
+ #include "memory/memRegion.hpp"
+ #include "oops/access.hpp"
++#include "oops/markOop.hpp"
+ #include "oops/metadata.hpp"
+ #include "runtime/atomic.hpp"
+ #include "utilities/macros.hpp"
+diff --git a/src/hotspot/share/oops/oop.inline.hpp b/src/hotspot/share/oops/oop.inline.hpp
+index 6c631f545..dfeecb9c5 100644
+--- a/src/hotspot/share/oops/oop.inline.hpp
++++ b/src/hotspot/share/oops/oop.inline.hpp
+@@ -44,23 +44,24 @@
+ // We need a separate file to avoid circular references
+ 
+ markOop  oopDesc::mark()      const {
+-  return HeapAccess<MO_VOLATILE>::load_at(as_oop(), mark_offset_in_bytes());
++  uintptr_t v = HeapAccess<MO_VOLATILE>::load_at(as_oop(), mark_offset_in_bytes());
++  return markOop(v);
+ }
+ 
+ markOop  oopDesc::mark_raw()  const {
+-  return _mark;
++  return Atomic::load(&_mark);;
+ }
+ 
+ markOop* oopDesc::mark_addr_raw() const {
+   return (markOop*) &_mark;
+ }
+ 
+-void oopDesc::set_mark(volatile markOop m) {
+-  HeapAccess<MO_VOLATILE>::store_at(as_oop(), mark_offset_in_bytes(), m);
++void oopDesc::set_mark(markOop m) {
++  HeapAccess<MO_VOLATILE>::store_at(as_oop(), mark_offset_in_bytes(), m.value());
+ }
+ 
+-void oopDesc::set_mark_raw(volatile markOop m) {
+-  _mark = m;
++void oopDesc::set_mark_raw(markOop m) {
++  Atomic::store(m, &_mark);
+ }
+ 
+ void oopDesc::set_mark_raw(HeapWord* mem, markOop m) {
+@@ -68,11 +69,12 @@ void oopDesc::set_mark_raw(HeapWord* mem, markOop m) {
+ }
+ 
+ void oopDesc::release_set_mark(markOop m) {
+-  HeapAccess<MO_RELEASE>::store_at(as_oop(), mark_offset_in_bytes(), m);
++  HeapAccess<MO_RELEASE>::store_at(as_oop(), mark_offset_in_bytes(), m.value());
+ }
+ 
+ markOop oopDesc::cas_set_mark(markOop new_mark, markOop old_mark) {
+-  return HeapAccess<>::atomic_cmpxchg_at(new_mark, as_oop(), mark_offset_in_bytes(), old_mark);
++  uintptr_t v = HeapAccess<>::atomic_cmpxchg_at(new_mark.value(), as_oop(), mark_offset_in_bytes(), old_mark.value());
++  return markOop(v);
+ }
+ 
+ markOop oopDesc::cas_set_mark_raw(markOop new_mark, markOop old_mark, atomic_memory_order order) {
+@@ -318,31 +320,31 @@ inline jdouble oopDesc::double_field(int offset) const              { return Hea
+ inline void    oopDesc::double_field_put(int offset, jdouble value) { HeapAccess<>::store_at(as_oop(), offset, value); }
+ 
+ bool oopDesc::is_locked() const {
+-  return mark()->is_locked();
++  return mark().is_locked();
+ }
+ 
+ bool oopDesc::is_unlocked() const {
+-  return mark()->is_unlocked();
++  return mark().is_unlocked();
+ }
+ 
+ bool oopDesc::has_bias_pattern() const {
+-  return mark()->has_bias_pattern();
++  return mark().has_bias_pattern();
+ }
+ 
+ bool oopDesc::has_bias_pattern_raw() const {
+-  return mark_raw()->has_bias_pattern();
++  return mark_raw().has_bias_pattern();
+ }
+ 
+ // Used only for markSweep, scavenging
+ bool oopDesc::is_gc_marked() const {
+-  return mark_raw()->is_marked();
++  return mark_raw().is_marked();
+ }
+ 
+ // Used by scavengers
+ bool oopDesc::is_forwarded() const {
+   // The extra heap check is needed since the obj might be locked, in which case the
+   // mark would point to a stack location and have the sentinel bit cleared
+-  return mark_raw()->is_marked();
++  return mark_raw().is_marked();
+ }
+ 
+ // Used by scavengers
+@@ -355,7 +357,7 @@ void oopDesc::forward_to(oop p) {
+          !MetaspaceShared::is_archive_object(p),
+          "forwarding archive object");
+   markOop m = markOopDesc::encode_pointer_as_mark(p);
+-  assert(m->decode_pointer() == p, "encoding must be reversable");
++  assert(m.decode_pointer() == p, "encoding must be reversable");
+   set_mark_raw(m);
+ }
+ 
+@@ -366,7 +368,7 @@ bool oopDesc::cas_forward_to(oop p, markOop compare, atomic_memory_order order)
+   assert(Universe::heap()->is_in_reserved(p),
+          "forwarding to something not in heap");
+   markOop m = markOopDesc::encode_pointer_as_mark(p);
+-  assert(m->decode_pointer() == p, "encoding must be reversable");
++  assert(m.decode_pointer() == p, "encoding must be reversable");
+   return cas_set_mark_raw(m, compare, order) == compare;
+ }
+ 
+@@ -375,10 +377,10 @@ oop oopDesc::forward_to_atomic(oop p, atomic_memory_order order) {
+   markOop forwardPtrMark = markOopDesc::encode_pointer_as_mark(p);
+   markOop curMark;
+ 
+-  assert(forwardPtrMark->decode_pointer() == p, "encoding must be reversable");
++  assert(forwardPtrMark.decode_pointer() == p, "encoding must be reversable");
+   assert(sizeof(markOop) == sizeof(intptr_t), "CAS below requires this.");
+ 
+-  while (!oldMark->is_marked()) {
++  while (!oldMark.is_marked()) {
+     curMark = cas_set_mark_raw(forwardPtrMark, oldMark, order);
+     assert(is_forwarded(), "object should have been forwarded");
+     if (curMark == oldMark) {
+@@ -396,33 +398,32 @@ oop oopDesc::forward_to_atomic(oop p, atomic_memory_order order) {
+ // The forwardee is used when copying during scavenge and mark-sweep.
+ // It does need to clear the low two locking- and GC-related bits.
+ oop oopDesc::forwardee() const {
+-  return (oop) mark_raw()->decode_pointer();
++  return (oop) mark_raw().decode_pointer();
+ }
+ 
+ // Note that the forwardee is not the same thing as the displaced_mark.
+ // The forwardee is used when copying during scavenge and mark-sweep.
+ // It does need to clear the low two locking- and GC-related bits.
+ oop oopDesc::forwardee_acquire() const {
+-  markOop m = OrderAccess::load_acquire(&_mark);
+-  return (oop) m->decode_pointer();
++  return (oop) OrderAccess::load_acquire(&_mark).decode_pointer();
+ }
+ 
+ // The following method needs to be MT safe.
+ uint oopDesc::age() const {
+   assert(!is_forwarded(), "Attempt to read age from forwarded mark");
+   if (has_displaced_mark_raw()) {
+-    return displaced_mark_raw()->age();
++    return displaced_mark_raw().age();
+   } else {
+-    return mark_raw()->age();
++    return mark_raw().age();
+   }
+ }
+ 
+ void oopDesc::incr_age() {
+   assert(!is_forwarded(), "Attempt to increment age of forwarded mark");
+   if (has_displaced_mark_raw()) {
+-    set_displaced_mark_raw(displaced_mark_raw()->incr_age());
++    set_displaced_mark_raw(displaced_mark_raw().incr_age());
+   } else {
+-    set_mark_raw(mark_raw()->incr_age());
++    set_mark_raw(mark_raw().incr_age());
+   }
+ }
+ 
+@@ -489,25 +490,25 @@ intptr_t oopDesc::identity_hash() {
+   // Fast case; if the object is unlocked and the hash value is set, no locking is needed
+   // Note: The mark must be read into local variable to avoid concurrent updates.
+   markOop mrk = mark();
+-  if (mrk->is_unlocked() && !mrk->has_no_hash()) {
+-    return mrk->hash();
+-  } else if (mrk->is_marked()) {
+-    return mrk->hash();
++  if (mrk.is_unlocked() && !mrk.has_no_hash()) {
++    return mrk.hash();
++  } else if (mrk.is_marked()) {
++    return mrk.hash();
+   } else {
+     return slow_identity_hash();
+   }
+ }
+ 
+ bool oopDesc::has_displaced_mark_raw() const {
+-  return mark_raw()->has_displaced_mark_helper();
++  return mark_raw().has_displaced_mark_helper();
+ }
+ 
+ markOop oopDesc::displaced_mark_raw() const {
+-  return mark_raw()->displaced_mark_helper();
++  return mark_raw().displaced_mark_helper();
+ }
+ 
+ void oopDesc::set_displaced_mark_raw(markOop m) {
+-  mark_raw()->set_displaced_mark_helper(m);
++  mark_raw().set_displaced_mark_helper(m);
+ }
+ 
+ #endif // SHARE_VM_OOPS_OOP_INLINE_HPP
+diff --git a/src/hotspot/share/oops/oopsHierarchy.hpp b/src/hotspot/share/oops/oopsHierarchy.hpp
+index d419aa156..f5ae4084b 100644
+--- a/src/hotspot/share/oops/oopsHierarchy.hpp
++++ b/src/hotspot/share/oops/oopsHierarchy.hpp
+@@ -40,7 +40,6 @@ typedef juint narrowOop; // Offset instead of address for an oop within a java o
+ typedef juint  narrowKlass;
+ 
+ typedef void* OopOrNarrowOopStar;
+-typedef class   markOopDesc*                markOop;
+ 
+ #ifndef CHECK_UNHANDLED_OOPS
+ 
+@@ -120,7 +119,6 @@ public:
+   operator oopDesc* () const volatile { return obj(); }
+   operator intptr_t* () const         { return (intptr_t*)obj(); }
+   operator PromotedObject* () const   { return (PromotedObject*)obj(); }
+-  operator markOop () const volatile  { return markOop(obj()); }
+   operator address   () const         { return (address)obj(); }
+ 
+   // from javaCalls.cpp
+diff --git a/src/hotspot/share/opto/macro.cpp b/src/hotspot/share/opto/macro.cpp
+index 155c6893e..933adcb3e 100644
+--- a/src/hotspot/share/opto/macro.cpp
++++ b/src/hotspot/share/opto/macro.cpp
+@@ -1773,7 +1773,7 @@ PhaseMacroExpand::initialize_object(AllocateNode* alloc,
+   if (UseBiasedLocking && (length == NULL)) {
+     mark_node = make_load(control, rawmem, klass_node, in_bytes(Klass::prototype_header_offset()), TypeRawPtr::BOTTOM, T_ADDRESS);
+   } else {
+-    mark_node = makecon(TypeRawPtr::make((address)markOopDesc::prototype()));
++    mark_node = makecon(TypeRawPtr::make((address)markOopDesc::prototype().value()));
+   }
+   rawmem = make_store(control, rawmem, object, oopDesc::mark_offset_in_bytes(), mark_node, T_ADDRESS);
+ 
+diff --git a/src/hotspot/share/prims/jvmtiEnvBase.cpp b/src/hotspot/share/prims/jvmtiEnvBase.cpp
+index 093c79042..28ef47815 100644
+--- a/src/hotspot/share/prims/jvmtiEnvBase.cpp
++++ b/src/hotspot/share/prims/jvmtiEnvBase.cpp
+@@ -965,16 +965,16 @@ JvmtiEnvBase::get_object_monitor_usage(JavaThread* calling_thread, jobject objec
+     {
+       markOop mark = hobj()->mark();
+ 
+-      if (!mark->has_monitor()) {
++      if (!mark.has_monitor()) {
+         // this object has a lightweight monitor
+ 
+-        if (mark->has_locker()) {
+-          owner = (address)mark->locker(); // save the address of the Lock word
++        if (mark.has_locker()) {
++          owner = (address)mark.locker(); // save the address of the Lock word
+         }
+         // implied else: no owner
+       } else {
+         // this object has a heavyweight monitor
+-        mon = mark->monitor();
++        mon = mark.monitor();
+ 
+         // The owner field of a heavyweight monitor may be NULL for no
+         // owner, a JavaThread * or it may still be the address of the
+diff --git a/src/hotspot/share/prims/jvmtiTagMap.cpp b/src/hotspot/share/prims/jvmtiTagMap.cpp
+index 1baa32c33..aa8f5230e 100644
+--- a/src/hotspot/share/prims/jvmtiTagMap.cpp
++++ b/src/hotspot/share/prims/jvmtiTagMap.cpp
+@@ -1645,7 +1645,7 @@ class RestoreMarksClosure : public ObjectClosure {
+   void do_object(oop o) {
+     if (o != NULL) {
+       markOop mark = o->mark();
+-      if (mark->is_marked()) {
++      if (mark.is_marked()) {
+         o->init_mark();
+       }
+     }
+@@ -1723,23 +1723,23 @@ void ObjectMarker::done() {
+ // mark an object
+ inline void ObjectMarker::mark(oop o) {
+   assert(Universe::heap()->is_in(o), "sanity check");
+-  assert(!o->mark()->is_marked(), "should only mark an object once");
++  assert(!o->mark().is_marked(), "should only mark an object once");
+ 
+   // object's mark word
+   markOop mark = o->mark();
+ 
+-  if (mark->must_be_preserved(o)) {
++  if (mark.must_be_preserved(o)) {
+     _saved_mark_stack->push(mark);
+     _saved_oop_stack->push(o);
+   }
+ 
+   // mark the object
+-  o->set_mark(markOopDesc::prototype()->set_marked());
++  o->set_mark(markOopDesc::prototype().set_marked());
+ }
+ 
+ // return true if object is marked
+ inline bool ObjectMarker::visited(oop o) {
+-  return o->mark()->is_marked();
++  return o->mark().is_marked();
+ }
+ 
+ // Stack allocated class to help ensure that ObjectMarker is used
+diff --git a/src/hotspot/share/prims/whitebox.cpp b/src/hotspot/share/prims/whitebox.cpp
+index 82a811062..29f67a28e 100644
+--- a/src/hotspot/share/prims/whitebox.cpp
++++ b/src/hotspot/share/prims/whitebox.cpp
+@@ -1689,7 +1689,7 @@ WB_END
+ 
+ WB_ENTRY(jboolean, WB_IsMonitorInflated(JNIEnv* env, jobject wb, jobject obj))
+   oop obj_oop = JNIHandles::resolve(obj);
+-  return (jboolean) obj_oop->mark()->has_monitor();
++  return (jboolean) obj_oop->mark().has_monitor();
+ WB_END
+ 
+ WB_ENTRY(void, WB_ForceSafepoint(JNIEnv* env, jobject wb))
+diff --git a/src/hotspot/share/runtime/basicLock.cpp b/src/hotspot/share/runtime/basicLock.cpp
+index 5d69b30ae..2090e4906 100644
+--- a/src/hotspot/share/runtime/basicLock.cpp
++++ b/src/hotspot/share/runtime/basicLock.cpp
+@@ -29,8 +29,8 @@
+ void BasicLock::print_on(outputStream* st) const {
+   st->print("monitor");
+   markOop moop = displaced_header();
+-  if (moop != NULL)
+-    moop->print_on(st);
++  if (moop.value() != 0)
++    moop.print_on(st);
+ }
+ 
+ void BasicLock::move_to(oop obj, BasicLock* dest) {
+@@ -62,7 +62,7 @@ void BasicLock::move_to(oop obj, BasicLock* dest) {
+   // is small (given the support for inflated fast-path locking in the fast_lock, etc)
+   // we'll leave that optimization for another time.
+ 
+-  if (displaced_header()->is_neutral()) {
++  if (displaced_header().is_neutral()) {
+     ObjectSynchronizer::inflate_helper(obj);
+     // WARNING: We can not put check here, because the inflation
+     // will not update the displaced header. Once BasicLock is inflated,
+@@ -75,6 +75,6 @@ void BasicLock::move_to(oop obj, BasicLock* dest) {
+     // we can find any flavor mark in the displaced mark.
+   }
+ // [RGV] The next line appears to do nothing!
+-  intptr_t dh = (intptr_t) displaced_header();
++  intptr_t dh = (intptr_t) displaced_header().value();
+   dest->set_displaced_header(displaced_header());
+ }
+diff --git a/src/hotspot/share/runtime/basicLock.hpp b/src/hotspot/share/runtime/basicLock.hpp
+index 68fd6c332..388741734 100644
+--- a/src/hotspot/share/runtime/basicLock.hpp
++++ b/src/hotspot/share/runtime/basicLock.hpp
+@@ -26,6 +26,7 @@
+ #define SHARE_VM_RUNTIME_BASICLOCK_HPP
+ 
+ #include "oops/markOop.hpp"
++#include "runtime/atomic.hpp"
+ #include "runtime/handles.hpp"
+ 
+ class BasicLock {
+@@ -34,8 +35,13 @@ class BasicLock {
+  private:
+   volatile markOop _displaced_header;
+  public:
+-  markOop      displaced_header() const               { return _displaced_header; }
+-  void         set_displaced_header(markOop header)   { _displaced_header = header; }
++  markOop displaced_header() const {
++    return Atomic::load(&_displaced_header);
++  }
++
++  void set_displaced_header(markOop header) {
++    Atomic::store(header, &_displaced_header);
++  }
+ 
+   void print_on(outputStream* st) const;
+ 
+diff --git a/src/hotspot/share/runtime/biasedLocking.cpp b/src/hotspot/share/runtime/biasedLocking.cpp
+index a324120d8..2c23a4288 100644
+--- a/src/hotspot/share/runtime/biasedLocking.cpp
++++ b/src/hotspot/share/runtime/biasedLocking.cpp
+@@ -150,27 +150,27 @@ static GrowableArray<MonitorInfo*>* get_or_compute_monitor_info(JavaThread* thre
+   return info;
+ }
+ 
+-// After the call, *biased_locker will be set to obj->mark()->biased_locker() if biased_locker != NULL,
++// After the call, *biased_locker will be set to obj->mark().biased_locker() if biased_locker != NULL,
+ // AND it is a living thread. Otherwise it will not be updated, (i.e. the caller is responsible for initialization).
+ static BiasedLocking::Condition revoke_bias(oop obj, bool allow_rebias, bool is_bulk, JavaThread* requesting_thread, JavaThread** biased_locker) {
+   markOop mark = obj->mark();
+-  if (!mark->has_bias_pattern()) {
++  if (!mark.has_bias_pattern()) {
+     if (log_is_enabled(Info, biasedlocking)) {
+       ResourceMark rm;
+       log_info(biasedlocking)("  (Skipping revocation of object " INTPTR_FORMAT
+                               ", mark " INTPTR_FORMAT ", type %s"
+                               ", requesting thread " INTPTR_FORMAT
+                               " because it's no longer biased)",
+-                              p2i((void *)obj), (intptr_t) mark,
++                              p2i((void *)obj), (intptr_t) mark.value(),
+                               obj->klass()->external_name(),
+                               (intptr_t) requesting_thread);
+     }
+     return BiasedLocking::NOT_BIASED;
+   }
+ 
+-  uint age = mark->age();
+-  markOop   biased_prototype = markOopDesc::biased_locking_prototype()->set_age(age);
+-  markOop unbiased_prototype = markOopDesc::prototype()->set_age(age);
++  uint age = mark.age();
++  markOop   biased_prototype = markOopDesc::biased_locking_prototype().set_age(age);
++  markOop unbiased_prototype = markOopDesc::prototype().set_age(age);
+ 
+   // Log at "info" level if not bulk, else "trace" level
+   if (!is_bulk) {
+@@ -179,9 +179,9 @@ static BiasedLocking::Condition revoke_bias(oop obj, bool allow_rebias, bool is_
+                             INTPTR_FORMAT ", type %s, prototype header " INTPTR_FORMAT
+                             ", allow rebias %d, requesting thread " INTPTR_FORMAT,
+                             p2i((void *)obj),
+-                            (intptr_t) mark,
++                            (intptr_t) mark.value(),
+                             obj->klass()->external_name(),
+-                            (intptr_t) obj->klass()->prototype_header(),
++                            (intptr_t) obj->klass()->prototype_header().value(),
+                             (allow_rebias ? 1 : 0),
+                             (intptr_t) requesting_thread);
+   } else {
+@@ -190,14 +190,14 @@ static BiasedLocking::Condition revoke_bias(oop obj, bool allow_rebias, bool is_
+                              INTPTR_FORMAT " , type %s , prototype header " INTPTR_FORMAT
+                              " , allow rebias %d , requesting thread " INTPTR_FORMAT,
+                              p2i((void *)obj),
+-                             (intptr_t) mark,
++                             (intptr_t) mark.value(),
+                              obj->klass()->external_name(),
+-                             (intptr_t) obj->klass()->prototype_header(),
++                             (intptr_t) obj->klass()->prototype_header().value(),
+                              (allow_rebias ? 1 : 0),
+                              (intptr_t) requesting_thread);
+   }
+ 
+-  JavaThread* biased_thread = mark->biased_locker();
++  JavaThread* biased_thread = mark.biased_locker();
+   if (biased_thread == NULL) {
+     // Object is anonymously biased. We can get here if, for
+     // example, we revoke the bias due to an identity hash code
+@@ -279,7 +279,7 @@ static BiasedLocking::Condition revoke_bias(oop obj, bool allow_rebias, bool is_
+     // Must release storing the lock address for platforms without TSO
+     // ordering (e.g. ppc).
+     obj->release_set_mark(markOopDesc::encode(highest_lock));
+-    assert(!obj->mark()->has_bias_pattern(), "illegal mark state: stack lock used bias bit");
++    assert(!obj->mark().has_bias_pattern(), "illegal mark state: stack lock used bias bit");
+     // Log at "info" level if not bulk, else "trace" level
+     if (!is_bulk) {
+       log_info(biasedlocking)("  Revoked bias of currently-locked object");
+@@ -320,7 +320,7 @@ enum HeuristicsResult {
+ 
+ static HeuristicsResult update_heuristics(oop o, bool allow_rebias) {
+   markOop mark = o->mark();
+-  if (!mark->has_bias_pattern()) {
++  if (!mark.has_bias_pattern()) {
+     return HR_NOT_BIASED;
+   }
+ 
+@@ -381,7 +381,7 @@ static BiasedLocking::Condition bulk_revoke_or_rebias_at_safepoint(oop o,
+                           INTPTR_FORMAT " , mark " INTPTR_FORMAT " , type %s",
+                           (bulk_rebias ? "rebias" : "revoke"),
+                           p2i((void *) o),
+-                          (intptr_t) o->mark(),
++                          (intptr_t) o->mark().value(),
+                           o->klass()->external_name());
+ 
+   jlong cur_time = os::javaTimeMillis();
+@@ -405,10 +405,10 @@ static BiasedLocking::Condition bulk_revoke_or_rebias_at_safepoint(oop o,
+       // try to update the epoch -- assume another VM operation came in
+       // and reset the header to the unbiased state, which will
+       // implicitly cause all existing biases to be revoked
+-      if (klass->prototype_header()->has_bias_pattern()) {
+-        int prev_epoch = klass->prototype_header()->bias_epoch();
+-        klass->set_prototype_header(klass->prototype_header()->incr_bias_epoch());
+-        int cur_epoch = klass->prototype_header()->bias_epoch();
++      if (klass->prototype_header().has_bias_pattern()) {
++        int prev_epoch = klass->prototype_header().bias_epoch();
++        klass->set_prototype_header(klass->prototype_header().incr_bias_epoch());
++        int cur_epoch = klass->prototype_header().bias_epoch();
+ 
+         // Now walk all threads' stacks and adjust epochs of any biased
+         // and locked objects of this data type we encounter
+@@ -418,10 +418,10 @@ static BiasedLocking::Condition bulk_revoke_or_rebias_at_safepoint(oop o,
+             MonitorInfo* mon_info = cached_monitor_info->at(i);
+             oop owner = mon_info->owner();
+             markOop mark = owner->mark();
+-            if ((owner->klass() == k_o) && mark->has_bias_pattern()) {
++            if ((owner->klass() == k_o) && mark.has_bias_pattern()) {
+               // We might have encountered this object already in the case of recursive locking
+-              assert(mark->bias_epoch() == prev_epoch || mark->bias_epoch() == cur_epoch, "error in bias epoch adjustment");
+-              owner->set_mark(mark->set_bias_epoch(cur_epoch));
++              assert(mark.bias_epoch() == prev_epoch || mark.bias_epoch() == cur_epoch, "error in bias epoch adjustment");
++              owner->set_mark(mark.set_bias_epoch(cur_epoch));
+             }
+           }
+         }
+@@ -429,7 +429,7 @@ static BiasedLocking::Condition bulk_revoke_or_rebias_at_safepoint(oop o,
+ 
+       // At this point we're done. All we have to do is potentially
+       // adjust the header of the given object to revoke its bias.
+-      revoke_bias(o, attempt_rebias_of_object && klass->prototype_header()->has_bias_pattern(), true, requesting_thread, NULL);
++      revoke_bias(o, attempt_rebias_of_object && klass->prototype_header().has_bias_pattern(), true, requesting_thread, NULL);
+     } else {
+       if (log_is_enabled(Info, biasedlocking)) {
+         ResourceMark rm;
+@@ -450,7 +450,7 @@ static BiasedLocking::Condition bulk_revoke_or_rebias_at_safepoint(oop o,
+           MonitorInfo* mon_info = cached_monitor_info->at(i);
+           oop owner = mon_info->owner();
+           markOop mark = owner->mark();
+-          if ((owner->klass() == k_o) && mark->has_bias_pattern()) {
++          if ((owner->klass() == k_o) && mark.has_bias_pattern()) {
+             revoke_bias(owner, false, true, requesting_thread, NULL);
+           }
+         }
+@@ -467,17 +467,17 @@ static BiasedLocking::Condition bulk_revoke_or_rebias_at_safepoint(oop o,
+   BiasedLocking::Condition status_code = BiasedLocking::BIAS_REVOKED;
+ 
+   if (attempt_rebias_of_object &&
+-      o->mark()->has_bias_pattern() &&
+-      klass->prototype_header()->has_bias_pattern()) {
+-    markOop new_mark = markOopDesc::encode(requesting_thread, o->mark()->age(),
+-                                           klass->prototype_header()->bias_epoch());
++      o->mark().has_bias_pattern() &&
++      klass->prototype_header().has_bias_pattern()) {
++    markOop new_mark = markOopDesc::encode(requesting_thread, o->mark().age(),
++                                           klass->prototype_header().bias_epoch());
+     o->set_mark(new_mark);
+     status_code = BiasedLocking::BIAS_REVOKED_AND_REBIASED;
+     log_info(biasedlocking)("  Rebiased object toward thread " INTPTR_FORMAT, (intptr_t) requesting_thread);
+   }
+ 
+-  assert(!o->mark()->has_bias_pattern() ||
+-         (attempt_rebias_of_object && (o->mark()->biased_locker() == requesting_thread)),
++  assert(!o->mark().has_bias_pattern() ||
++         (attempt_rebias_of_object && (o->mark().biased_locker() == requesting_thread)),
+          "bug in bulk bias revocation");
+ 
+   return status_code;
+@@ -523,13 +523,13 @@ public:
+     // there is nothing to do and we avoid a safepoint.
+     if (_obj != NULL) {
+       markOop mark = (*_obj)()->mark();
+-      if (mark->has_bias_pattern()) {
++      if (mark.has_bias_pattern()) {
+         return true;
+       }
+     } else {
+       for ( int i = 0 ; i < _objs->length(); i++ ) {
+         markOop mark = (_objs->at(i))()->mark();
+-        if (mark->has_bias_pattern()) {
++        if (mark.has_bias_pattern()) {
+           return true;
+         }
+       }
+@@ -629,7 +629,7 @@ BiasedLocking::Condition BiasedLocking::revoke_and_rebias(Handle obj, bool attem
+   // update the heuristics because doing so may cause unwanted bulk
+   // revocations (which are expensive) to occur.
+   markOop mark = obj->mark();
+-  if (mark->is_biased_anonymously() && !attempt_rebias) {
++  if (mark.is_biased_anonymously() && !attempt_rebias) {
+     // We are probably trying to revoke the bias of this object due to
+     // an identity hash code computation. Try to revoke the bias
+     // without a safepoint. This is possible if we can successfully
+@@ -637,15 +637,15 @@ BiasedLocking::Condition BiasedLocking::revoke_and_rebias(Handle obj, bool attem
+     // the object, meaning that no other thread has raced to acquire
+     // the bias of the object.
+     markOop biased_value       = mark;
+-    markOop unbiased_prototype = markOopDesc::prototype()->set_age(mark->age());
++    markOop unbiased_prototype = markOopDesc::prototype().set_age(mark.age());
+     markOop res_mark = obj->cas_set_mark(unbiased_prototype, mark);
+     if (res_mark == biased_value) {
+       return BIAS_REVOKED;
+     }
+-  } else if (mark->has_bias_pattern()) {
++  } else if (mark.has_bias_pattern()) {
+     Klass* k = obj->klass();
+     markOop prototype_header = k->prototype_header();
+-    if (!prototype_header->has_bias_pattern()) {
++    if (!prototype_header.has_bias_pattern()) {
+       // This object has a stale bias from before the bulk revocation
+       // for this data type occurred. It's pointless to update the
+       // heuristics at this point so simply update the header with a
+@@ -654,9 +654,9 @@ BiasedLocking::Condition BiasedLocking::revoke_and_rebias(Handle obj, bool attem
+       // with it.
+       markOop biased_value       = mark;
+       markOop res_mark = obj->cas_set_mark(prototype_header, mark);
+-      assert(!obj->mark()->has_bias_pattern(), "even if we raced, should still be revoked");
++      assert(!obj->mark().has_bias_pattern(), "even if we raced, should still be revoked");
+       return BIAS_REVOKED;
+-    } else if (prototype_header->bias_epoch() != mark->bias_epoch()) {
++    } else if (prototype_header.bias_epoch() != mark.bias_epoch()) {
+       // The epoch of this biasing has expired indicating that the
+       // object is effectively unbiased. Depending on whether we need
+       // to rebias or revoke the bias of this object we can do it
+@@ -667,14 +667,14 @@ BiasedLocking::Condition BiasedLocking::revoke_and_rebias(Handle obj, bool attem
+       if (attempt_rebias) {
+         assert(THREAD->is_Java_thread(), "");
+         markOop biased_value       = mark;
+-        markOop rebiased_prototype = markOopDesc::encode((JavaThread*) THREAD, mark->age(), prototype_header->bias_epoch());
++        markOop rebiased_prototype = markOopDesc::encode((JavaThread*) THREAD, mark.age(), prototype_header.bias_epoch());
+         markOop res_mark = obj->cas_set_mark(rebiased_prototype, mark);
+         if (res_mark == biased_value) {
+           return BIAS_REVOKED_AND_REBIASED;
+         }
+       } else {
+         markOop biased_value       = mark;
+-        markOop unbiased_prototype = markOopDesc::prototype()->set_age(mark->age());
++        markOop unbiased_prototype = markOopDesc::prototype().set_age(mark.age());
+         markOop res_mark = obj->cas_set_mark(unbiased_prototype, mark);
+         if (res_mark == biased_value) {
+           return BIAS_REVOKED;
+@@ -689,8 +689,8 @@ BiasedLocking::Condition BiasedLocking::revoke_and_rebias(Handle obj, bool attem
+   } else if (heuristics == HR_SINGLE_REVOKE) {
+     Klass *k = obj->klass();
+     markOop prototype_header = k->prototype_header();
+-    if (mark->biased_locker() == THREAD &&
+-        prototype_header->bias_epoch() == mark->bias_epoch()) {
++    if (mark.biased_locker() == THREAD &&
++        prototype_header.bias_epoch() == mark.bias_epoch()) {
+       // A thread is trying to revoke the bias of an object biased
+       // toward it, again likely due to an identity hash code
+       // computation. We can again avoid a safepoint in this case
+@@ -814,7 +814,7 @@ void BiasedLocking::preserve_marks() {
+             oop owner = mon_info->owner();
+             if (owner != NULL) {
+               markOop mark = owner->mark();
+-              if (mark->has_bias_pattern()) {
++              if (mark.has_bias_pattern()) {
+                 _preserved_oop_stack->push(Handle(cur, owner));
+                 _preserved_mark_stack->push(mark);
+               }
+diff --git a/src/hotspot/share/runtime/deoptimization.cpp b/src/hotspot/share/runtime/deoptimization.cpp
+index 7ca0d9154..5f1d44355 100644
+--- a/src/hotspot/share/runtime/deoptimization.cpp
++++ b/src/hotspot/share/runtime/deoptimization.cpp
+@@ -1121,14 +1121,14 @@ void Deoptimization::relock_objects(GrowableArray<MonitorInfo*>* monitors, JavaT
+       if (!mon_info->owner_is_scalar_replaced()) {
+         Handle obj(thread, mon_info->owner());
+         markOop mark = obj->mark();
+-        if (UseBiasedLocking && mark->has_bias_pattern()) {
++        if (UseBiasedLocking && mark.has_bias_pattern()) {
+           // New allocated objects may have the mark set to anonymously biased.
+           // Also the deoptimized method may called methods with synchronization
+           // where the thread-local object is bias locked to the current thread.
+-          assert(mark->is_biased_anonymously() ||
+-                 mark->biased_locker() == thread, "should be locked to current thread");
++          assert(mark.is_biased_anonymously() ||
++                 mark.biased_locker() == thread, "should be locked to current thread");
+           // Reset mark word to unbiased prototype.
+-          markOop unbiased_prototype = markOopDesc::prototype()->set_age(mark->age());
++          markOop unbiased_prototype = markOopDesc::prototype().set_age(mark.age());
+           obj->set_mark(unbiased_prototype);
+         }
+         BasicLock* lock = mon_info->lock();
+diff --git a/src/hotspot/share/runtime/objectMonitor.hpp b/src/hotspot/share/runtime/objectMonitor.hpp
+index d73c8a947..eba6075a2 100644
+--- a/src/hotspot/share/runtime/objectMonitor.hpp
++++ b/src/hotspot/share/runtime/objectMonitor.hpp
+@@ -27,6 +27,7 @@
+ 
+ #include "memory/allocation.hpp"
+ #include "memory/padded.hpp"
++#include "oops/markOop.hpp"
+ #include "runtime/os.hpp"
+ #include "runtime/park.hpp"
+ #include "runtime/perfData.hpp"
+diff --git a/src/hotspot/share/runtime/objectMonitor.inline.hpp b/src/hotspot/share/runtime/objectMonitor.inline.hpp
+index 951d6472e..abb8cc554 100644
+--- a/src/hotspot/share/runtime/objectMonitor.inline.hpp
++++ b/src/hotspot/share/runtime/objectMonitor.inline.hpp
+@@ -25,6 +25,8 @@
+ #ifndef SHARE_VM_RUNTIME_OBJECTMONITOR_INLINE_HPP
+ #define SHARE_VM_RUNTIME_OBJECTMONITOR_INLINE_HPP
+ 
++#include "runtime/atomic.hpp"
++
+ inline intptr_t ObjectMonitor::is_entered(TRAPS) const {
+   if (THREAD == _owner || THREAD->is_lock_owned((address) _owner)) {
+     return 1;
+@@ -33,7 +35,7 @@ inline intptr_t ObjectMonitor::is_entered(TRAPS) const {
+ }
+ 
+ inline markOop ObjectMonitor::header() const {
+-  return _header;
++  return Atomic::load(&_header);
+ }
+ 
+ inline volatile markOop* ObjectMonitor::header_addr() {
+@@ -42,7 +44,7 @@ inline volatile markOop* ObjectMonitor::header_addr() {
+ }
+ 
+ inline void ObjectMonitor::set_header(markOop hdr) {
+-  _header = hdr;
++  Atomic::store(hdr, &_header);
+ }
+ 
+ inline jint ObjectMonitor::count() const {
+@@ -58,14 +60,14 @@ inline void* ObjectMonitor::owner() const {
+ }
+ 
+ inline void ObjectMonitor::clear() {
+-  assert(_header, "Fatal logic error in ObjectMonitor header!");
++  assert(Atomic::load(&_header).value() != 0, "Fatal logic error in ObjectMonitor header!");
+   assert(_count == 0, "Fatal logic error in ObjectMonitor count!");
+   assert(_waiters == 0, "Fatal logic error in ObjectMonitor waiters!");
+   assert(_recursions == 0, "Fatal logic error in ObjectMonitor recursions!");
+   assert(_object != NULL, "Fatal logic error in ObjectMonitor object!");
+   assert(_owner == 0, "Fatal logic error in ObjectMonitor owner!");
+ 
+-  _header = NULL;
++  Atomic::store(markOop::zero(), &_header);
+   _object = NULL;
+ }
+ 
+diff --git a/src/hotspot/share/runtime/sharedRuntime.cpp b/src/hotspot/share/runtime/sharedRuntime.cpp
+index 595ff7495..cee41fcd7 100644
+--- a/src/hotspot/share/runtime/sharedRuntime.cpp
++++ b/src/hotspot/share/runtime/sharedRuntime.cpp
+@@ -3080,10 +3080,10 @@ JRT_LEAF(intptr_t*, SharedRuntime::OSR_migration_begin( JavaThread *thread) )
+     if (kptr2->obj() != NULL) {         // Avoid 'holes' in the monitor array
+       BasicLock *lock = kptr2->lock();
+       // Inflate so the displaced header becomes position-independent
+-      if (lock->displaced_header()->is_unlocked())
++      if (lock->displaced_header().is_unlocked())
+         ObjectSynchronizer::inflate_helper(kptr2->obj());
+       // Now the displaced header is free to move
+-      buf[i++] = (intptr_t)lock->displaced_header();
++      buf[i++] = (intptr_t)lock->displaced_header().value();
+       buf[i++] = cast_from_oop<intptr_t>(kptr2->obj());
+     }
+   }
+diff --git a/src/hotspot/share/runtime/synchronizer.cpp b/src/hotspot/share/runtime/synchronizer.cpp
+index e7b32723e..2da0b02e9 100644
+--- a/src/hotspot/share/runtime/synchronizer.cpp
++++ b/src/hotspot/share/runtime/synchronizer.cpp
+@@ -160,14 +160,14 @@ bool ObjectSynchronizer::quick_notify(oopDesc * obj, Thread * self, bool all) {
+   if (obj == NULL) return false;  // slow-path for invalid obj
+   const markOop mark = obj->mark();
+ 
+-  if (mark->has_locker() && self->is_lock_owned((address)mark->locker())) {
++  if (mark.has_locker() && self->is_lock_owned((address)mark.locker())) {
+     // Degenerate notify
+     // stack-locked by caller so by definition the implied waitset is empty.
+     return true;
+   }
+ 
+-  if (mark->has_monitor()) {
+-    ObjectMonitor * const mon = mark->monitor();
++  if (mark.has_monitor()) {
++    ObjectMonitor * const mon = mark.monitor();
+     assert(mon->object() == obj, "invariant");
+     if (mon->owner() != self) return false;  // slow-path for IMS exception
+ 
+@@ -210,8 +210,8 @@ bool ObjectSynchronizer::quick_enter(oop obj, Thread * Self,
+   if (obj == NULL) return false;       // Need to throw NPE
+   const markOop mark = obj->mark();
+ 
+-  if (mark->has_monitor()) {
+-    ObjectMonitor * const m = mark->monitor();
++  if (mark.has_monitor()) {
++    ObjectMonitor * const m = mark.monitor();
+     assert(m->object() == obj, "invariant");
+     Thread * const owner = (Thread *) m->_owner;
+ 
+@@ -273,7 +273,7 @@ void ObjectSynchronizer::fast_enter(Handle obj, BasicLock* lock,
+       assert(!attempt_rebias, "can not rebias toward VM thread");
+       BiasedLocking::revoke_at_safepoint(obj);
+     }
+-    assert(!obj->mark()->has_bias_pattern(), "biases should be revoked by now");
++    assert(!obj->mark().has_bias_pattern(), "biases should be revoked by now");
+   }
+ 
+   slow_enter(obj, lock, THREAD);
+@@ -283,10 +283,10 @@ void ObjectSynchronizer::fast_exit(oop object, BasicLock* lock, TRAPS) {
+   markOop mark = object->mark();
+   // We cannot check for Biased Locking if we are racing an inflation.
+   assert(mark == markOopDesc::INFLATING() ||
+-         !mark->has_bias_pattern(), "should not see bias pattern here");
++         !mark.has_bias_pattern(), "should not see bias pattern here");
+ 
+   markOop dhw = lock->displaced_header();
+-  if (dhw == NULL) {
++  if (dhw.value() == 0) {
+     // If the displaced header is NULL, then this exit matches up with
+     // a recursive enter. No real work to do here except for diagnostics.
+ #ifndef PRODUCT
+@@ -294,10 +294,10 @@ void ObjectSynchronizer::fast_exit(oop object, BasicLock* lock, TRAPS) {
+       // Only do diagnostics if we are not racing an inflation. Simply
+       // exiting a recursive enter of a Java Monitor that is being
+       // inflated is safe; see the has_monitor() comment below.
+-      assert(!mark->is_neutral(), "invariant");
+-      assert(!mark->has_locker() ||
+-             THREAD->is_lock_owned((address)mark->locker()), "invariant");
+-      if (mark->has_monitor()) {
++      assert(!mark.is_neutral(), "invariant");
++      assert(!mark.has_locker() ||
++             THREAD->is_lock_owned((address)mark.locker()), "invariant");
++      if (mark.has_monitor()) {
+         // The BasicLock's displaced_header is marked as a recursive
+         // enter and we have an inflated Java Monitor (ObjectMonitor).
+         // This is a special case where the Java Monitor was inflated
+@@ -306,7 +306,7 @@ void ObjectSynchronizer::fast_exit(oop object, BasicLock* lock, TRAPS) {
+         // Monitor owner's stack and update the BasicLocks because a
+         // Java Monitor can be asynchronously inflated by a thread that
+         // does not own the Java Monitor.
+-        ObjectMonitor * m = mark->monitor();
++        ObjectMonitor * m = mark.monitor();
+         assert(((oop)(m->object()))->mark() == mark, "invariant");
+         assert(m->is_entered(THREAD), "invariant");
+       }
+@@ -315,10 +315,10 @@ void ObjectSynchronizer::fast_exit(oop object, BasicLock* lock, TRAPS) {
+     return;
+   }
+ 
+-  if (mark == (markOop) lock) {
++  if (mark == markOop::from_pointer(lock)) {
+     // If the object is stack-locked by the current thread, try to
+     // swing the displaced header from the BasicLock back to the mark.
+-    assert(dhw->is_neutral(), "invariant");
++    assert(dhw.is_neutral(), "invariant");
+     if (object->cas_set_mark(dhw, mark) == mark) {
+       TEVENT(fast_exit: release stack-lock);
+       return;
+@@ -338,22 +338,22 @@ void ObjectSynchronizer::fast_exit(oop object, BasicLock* lock, TRAPS) {
+ // failed in the interpreter/compiler code.
+ void ObjectSynchronizer::slow_enter(Handle obj, BasicLock* lock, TRAPS) {
+   markOop mark = obj->mark();
+-  assert(!mark->has_bias_pattern(), "should not see bias pattern here");
++  assert(!mark.has_bias_pattern(), "should not see bias pattern here");
+ 
+-  if (mark->is_neutral()) {
++  if (mark.is_neutral()) {
+     // Anticipate successful CAS -- the ST of the displaced mark must
+     // be visible <= the ST performed by the CAS.
+     lock->set_displaced_header(mark);
+-    if (mark == obj()->cas_set_mark((markOop) lock, mark)) {
++    if (mark == obj()->cas_set_mark(markOop::from_pointer(lock), mark)) {
+       TEVENT(slow_enter: release stacklock);
+       return;
+     }
+     // Fall through to inflate() ...
+-  } else if (mark->has_locker() &&
+-             THREAD->is_lock_owned((address)mark->locker())) {
+-    assert(lock != mark->locker(), "must not re-lock the same lock");
+-    assert(lock != (BasicLock*)obj->mark(), "don't relock with same BasicLock");
+-    lock->set_displaced_header(NULL);
++  } else if (mark.has_locker() &&
++             THREAD->is_lock_owned((address)mark.locker())) {
++    assert(lock != mark.locker(), "must not re-lock the same lock");
++    assert(lock != (BasicLock*)obj->mark().value(), "don't relock with same BasicLock");
++    lock->set_displaced_header(markOop::from_pointer(NULL));
+     return;
+   }
+ 
+@@ -391,7 +391,7 @@ intptr_t ObjectSynchronizer::complete_exit(Handle obj, TRAPS) {
+   TEVENT(complete_exit);
+   if (UseBiasedLocking) {
+     BiasedLocking::revoke_and_rebias(obj, false, THREAD);
+-    assert(!obj->mark()->has_bias_pattern(), "biases should be revoked by now");
++    assert(!obj->mark().has_bias_pattern(), "biases should be revoked by now");
+   }
+ 
+   ObjectMonitor* monitor = ObjectSynchronizer::inflate(THREAD,
+@@ -406,7 +406,7 @@ void ObjectSynchronizer::reenter(Handle obj, intptr_t recursion, TRAPS) {
+   TEVENT(reenter);
+   if (UseBiasedLocking) {
+     BiasedLocking::revoke_and_rebias(obj, false, THREAD);
+-    assert(!obj->mark()->has_bias_pattern(), "biases should be revoked by now");
++    assert(!obj->mark().has_bias_pattern(), "biases should be revoked by now");
+   }
+ 
+   ObjectMonitor* monitor = ObjectSynchronizer::inflate(THREAD,
+@@ -423,7 +423,7 @@ void ObjectSynchronizer::jni_enter(Handle obj, TRAPS) {
+   TEVENT(jni_enter);
+   if (UseBiasedLocking) {
+     BiasedLocking::revoke_and_rebias(obj, false, THREAD);
+-    assert(!obj->mark()->has_bias_pattern(), "biases should be revoked by now");
++    assert(!obj->mark().has_bias_pattern(), "biases should be revoked by now");
+   }
+   THREAD->set_current_pending_monitor_is_from_java(false);
+   ObjectSynchronizer::inflate(THREAD, obj(), inflate_cause_jni_enter)->enter(THREAD);
+@@ -438,7 +438,7 @@ void ObjectSynchronizer::jni_exit(oop obj, Thread* THREAD) {
+     BiasedLocking::revoke_and_rebias(h_obj, false, THREAD);
+     obj = h_obj();
+   }
+-  assert(!obj->mark()->has_bias_pattern(), "biases should be revoked by now");
++  assert(!obj->mark().has_bias_pattern(), "biases should be revoked by now");
+ 
+   ObjectMonitor* monitor = ObjectSynchronizer::inflate(THREAD,
+                                                        obj,
+@@ -479,7 +479,7 @@ ObjectLocker::~ObjectLocker() {
+ int ObjectSynchronizer::wait(Handle obj, jlong millis, TRAPS) {
+   if (UseBiasedLocking) {
+     BiasedLocking::revoke_and_rebias(obj, false, THREAD);
+-    assert(!obj->mark()->has_bias_pattern(), "biases should be revoked by now");
++    assert(!obj->mark().has_bias_pattern(), "biases should be revoked by now");
+   }
+   if (millis < 0) {
+     TEVENT(wait - throw IAX);
+@@ -502,7 +502,7 @@ int ObjectSynchronizer::wait(Handle obj, jlong millis, TRAPS) {
+ void ObjectSynchronizer::waitUninterruptibly(Handle obj, jlong millis, TRAPS) {
+   if (UseBiasedLocking) {
+     BiasedLocking::revoke_and_rebias(obj, false, THREAD);
+-    assert(!obj->mark()->has_bias_pattern(), "biases should be revoked by now");
++    assert(!obj->mark().has_bias_pattern(), "biases should be revoked by now");
+   }
+   if (millis < 0) {
+     TEVENT(wait - throw IAX);
+@@ -516,11 +516,11 @@ void ObjectSynchronizer::waitUninterruptibly(Handle obj, jlong millis, TRAPS) {
+ void ObjectSynchronizer::notify(Handle obj, TRAPS) {
+   if (UseBiasedLocking) {
+     BiasedLocking::revoke_and_rebias(obj, false, THREAD);
+-    assert(!obj->mark()->has_bias_pattern(), "biases should be revoked by now");
++    assert(!obj->mark().has_bias_pattern(), "biases should be revoked by now");
+   }
+ 
+   markOop mark = obj->mark();
+-  if (mark->has_locker() && THREAD->is_lock_owned((address)mark->locker())) {
++  if (mark.has_locker() && THREAD->is_lock_owned((address)mark.locker())) {
+     return;
+   }
+   ObjectSynchronizer::inflate(THREAD,
+@@ -532,11 +532,11 @@ void ObjectSynchronizer::notify(Handle obj, TRAPS) {
+ void ObjectSynchronizer::notifyall(Handle obj, TRAPS) {
+   if (UseBiasedLocking) {
+     BiasedLocking::revoke_and_rebias(obj, false, THREAD);
+-    assert(!obj->mark()->has_bias_pattern(), "biases should be revoked by now");
++    assert(!obj->mark().has_bias_pattern(), "biases should be revoked by now");
+   }
+ 
+   markOop mark = obj->mark();
+-  if (mark->has_locker() && THREAD->is_lock_owned((address)mark->locker())) {
++  if (mark.has_locker() && THREAD->is_lock_owned((address)mark.locker())) {
+     return;
+   }
+   ObjectSynchronizer::inflate(THREAD,
+@@ -583,14 +583,14 @@ static volatile int ForceMonitorScavenge = 0; // Scavenge required and pending
+ 
+ static markOop ReadStableMark(oop obj) {
+   markOop mark = obj->mark();
+-  if (!mark->is_being_inflated()) {
++  if (!mark.is_being_inflated()) {
+     return mark;       // normal fast-path return
+   }
+ 
+   int its = 0;
+   for (;;) {
+     markOop mark = obj->mark();
+-    if (!mark->is_being_inflated()) {
++    if (!mark.is_being_inflated()) {
+       return mark;    // normal fast-path return
+     }
+ 
+@@ -716,7 +716,7 @@ intptr_t ObjectSynchronizer::FastHashCode(Thread * Self, oop obj) {
+     // been checked to make sure they can handle a safepoint. The
+     // added check of the bias pattern is to avoid useless calls to
+     // thread-local storage.
+-    if (obj->mark()->has_bias_pattern()) {
++    if (obj->mark().has_bias_pattern()) {
+       // Handle for oop obj in case of STW safepoint
+       Handle hobj(Self, obj);
+       // Relaxing assertion for bug 6320749.
+@@ -725,7 +725,7 @@ intptr_t ObjectSynchronizer::FastHashCode(Thread * Self, oop obj) {
+              "biases should not be seen by VM thread here");
+       BiasedLocking::revoke_and_rebias(hobj, false, JavaThread::current());
+       obj = hobj();
+-      assert(!obj->mark()->has_bias_pattern(), "biases should be revoked by now");
++      assert(!obj->mark().has_bias_pattern(), "biases should be revoked by now");
+     }
+   }
+ 
+@@ -744,15 +744,15 @@ intptr_t ObjectSynchronizer::FastHashCode(Thread * Self, oop obj) {
+   markOop mark = ReadStableMark(obj);
+ 
+   // object should remain ineligible for biased locking
+-  assert(!mark->has_bias_pattern(), "invariant");
++  assert(!mark.has_bias_pattern(), "invariant");
+ 
+-  if (mark->is_neutral()) {
+-    hash = mark->hash();              // this is a normal header
++  if (mark.is_neutral()) {
++    hash = mark.hash();              // this is a normal header
+     if (hash) {                       // if it has hash, just return it
+       return hash;
+     }
+     hash = get_next_hash(Self, obj);  // allocate a new hash code
+-    temp = mark->copy_set_hash(hash); // merge the hash code into header
++    temp = mark.copy_set_hash(hash); // merge the hash code into header
+     // use (machine word version) atomic operation to install the hash
+     test = obj->cas_set_mark(temp, mark);
+     if (test == mark) {
+@@ -761,19 +761,19 @@ intptr_t ObjectSynchronizer::FastHashCode(Thread * Self, oop obj) {
+     // If atomic operation failed, we must inflate the header
+     // into heavy weight monitor. We could add more code here
+     // for fast path, but it does not worth the complexity.
+-  } else if (mark->has_monitor()) {
+-    monitor = mark->monitor();
++  } else if (mark.has_monitor()) {
++    monitor = mark.monitor();
+     temp = monitor->header();
+-    assert(temp->is_neutral(), "invariant");
+-    hash = temp->hash();
++    assert(temp.is_neutral(), "invariant");
++    hash = temp.hash();
+     if (hash) {
+       return hash;
+     }
+     // Skip to the following code to reduce code size
+-  } else if (Self->is_lock_owned((address)mark->locker())) {
+-    temp = mark->displaced_mark_helper(); // this is a lightweight monitor owned
+-    assert(temp->is_neutral(), "invariant");
+-    hash = temp->hash();              // by current thread, check if the displaced
++  } else if (Self->is_lock_owned((address)mark.locker())) {
++    temp = mark.displaced_mark_helper(); // this is a lightweight monitor owned
++    assert(temp.is_neutral(), "invariant");
++    hash = temp.hash();              // by current thread, check if the displaced
+     if (hash) {                       // header contains hash code
+       return hash;
+     }
+@@ -792,19 +792,20 @@ intptr_t ObjectSynchronizer::FastHashCode(Thread * Self, oop obj) {
+   monitor = ObjectSynchronizer::inflate(Self, obj, inflate_cause_hash_code);
+   // Load displaced header and check it has hash code
+   mark = monitor->header();
+-  assert(mark->is_neutral(), "invariant");
+-  hash = mark->hash();
++  assert(mark.is_neutral(), "invariant");
++  hash = mark.hash();
+   if (hash == 0) {
+     hash = get_next_hash(Self, obj);
+-    temp = mark->copy_set_hash(hash); // merge hash code into header
+-    assert(temp->is_neutral(), "invariant");
+-    test = Atomic::cmpxchg(temp, monitor->header_addr(), mark);
++    temp = mark.copy_set_hash(hash); // merge hash code into header
++    assert(temp.is_neutral(), "invariant");
++    uintptr_t t = Atomic::cmpxchg(temp.value(), (volatile uintptr_t*)monitor->header_addr(), mark.value());
++    test = markOop(t);
+     if (test != mark) {
+       // The only update to the header in the monitor (outside GC)
+       // is install the hash code. If someone add new usage of
+       // displaced header, please update this code
+-      hash = test->hash();
+-      assert(test->is_neutral(), "invariant");
++      hash = test.hash();
++      assert(test.is_neutral(), "invariant");
+       assert(hash != 0, "Trivial unexpected object/monitor header usage.");
+     }
+   }
+@@ -823,7 +824,7 @@ bool ObjectSynchronizer::current_thread_holds_lock(JavaThread* thread,
+                                                    Handle h_obj) {
+   if (UseBiasedLocking) {
+     BiasedLocking::revoke_and_rebias(h_obj, false, thread);
+-    assert(!h_obj->mark()->has_bias_pattern(), "biases should be revoked by now");
++    assert(!h_obj->mark().has_bias_pattern(), "biases should be revoked by now");
+   }
+ 
+   assert(thread == JavaThread::current(), "Can only be called on current thread");
+@@ -832,16 +833,16 @@ bool ObjectSynchronizer::current_thread_holds_lock(JavaThread* thread,
+   markOop mark = ReadStableMark(obj);
+ 
+   // Uncontended case, header points to stack
+-  if (mark->has_locker()) {
+-    return thread->is_lock_owned((address)mark->locker());
++  if (mark.has_locker()) {
++    return thread->is_lock_owned((address)mark.locker());
+   }
+   // Contended case, header points to ObjectMonitor (tagged pointer)
+-  if (mark->has_monitor()) {
+-    ObjectMonitor* monitor = mark->monitor();
++  if (mark.has_monitor()) {
++    ObjectMonitor* monitor = mark.monitor();
+     return monitor->is_entered(thread) != 0;
+   }
+   // Unlocked case, header in place
+-  assert(mark->is_neutral(), "sanity check");
++  assert(mark.is_neutral(), "sanity check");
+   return false;
+ }
+ 
+@@ -859,10 +860,10 @@ ObjectSynchronizer::LockOwnership ObjectSynchronizer::query_lock_ownership
+ 
+   // Possible mark states: neutral, biased, stack-locked, inflated
+ 
+-  if (UseBiasedLocking && h_obj()->mark()->has_bias_pattern()) {
++  if (UseBiasedLocking && h_obj()->mark().has_bias_pattern()) {
+     // CASE: biased
+     BiasedLocking::revoke_and_rebias(h_obj, false, self);
+-    assert(!h_obj->mark()->has_bias_pattern(),
++    assert(!h_obj->mark().has_bias_pattern(),
+            "biases should be revoked by now");
+   }
+ 
+@@ -871,23 +872,23 @@ ObjectSynchronizer::LockOwnership ObjectSynchronizer::query_lock_ownership
+   markOop mark = ReadStableMark(obj);
+ 
+   // CASE: stack-locked.  Mark points to a BasicLock on the owner's stack.
+-  if (mark->has_locker()) {
+-    return self->is_lock_owned((address)mark->locker()) ?
++  if (mark.has_locker()) {
++    return self->is_lock_owned((address)mark.locker()) ?
+       owner_self : owner_other;
+   }
+ 
+   // CASE: inflated. Mark (tagged pointer) points to an objectMonitor.
+   // The Object:ObjectMonitor relationship is stable as long as we're
+   // not at a safepoint.
+-  if (mark->has_monitor()) {
+-    void * owner = mark->monitor()->_owner;
++  if (mark.has_monitor()) {
++    void * owner = mark.monitor()->_owner;
+     if (owner == NULL) return owner_none;
+     return (owner == self ||
+             self->is_lock_owned((address)owner)) ? owner_self : owner_other;
+   }
+ 
+   // CASE: neutral
+-  assert(mark->is_neutral(), "sanity check");
++  assert(mark.is_neutral(), "sanity check");
+   return owner_none;           // it's unlocked
+ }
+ 
+@@ -899,7 +900,7 @@ JavaThread* ObjectSynchronizer::get_lock_owner(ThreadsList * t_list, Handle h_ob
+     } else {
+       BiasedLocking::revoke_and_rebias(h_obj, false, JavaThread::current());
+     }
+-    assert(!h_obj->mark()->has_bias_pattern(), "biases should be revoked by now");
++    assert(!h_obj->mark().has_bias_pattern(), "biases should be revoked by now");
+   }
+ 
+   oop obj = h_obj();
+@@ -908,13 +909,13 @@ JavaThread* ObjectSynchronizer::get_lock_owner(ThreadsList * t_list, Handle h_ob
+   markOop mark = ReadStableMark(obj);
+ 
+   // Uncontended case, header points to stack
+-  if (mark->has_locker()) {
+-    owner = (address) mark->locker();
++  if (mark.has_locker()) {
++    owner = (address) mark.locker();
+   }
+ 
+   // Contended case, header points to ObjectMonitor (tagged pointer)
+-  if (mark->has_monitor()) {
+-    ObjectMonitor* monitor = mark->monitor();
++  if (mark.has_monitor()) {
++    ObjectMonitor* monitor = mark.monitor();
+     assert(monitor != NULL, "monitor should be non-null");
+     owner = (address) monitor->owner();
+   }
+@@ -927,7 +928,7 @@ JavaThread* ObjectSynchronizer::get_lock_owner(ThreadsList * t_list, Handle h_ob
+   // Unlocked case, header in place
+   // Cannot have assertion since this object may have been
+   // locked by another thread when reaching here.
+-  // assert(mark->is_neutral(), "sanity check");
++  // assert(mark.is_neutral(), "sanity check");
+ 
+   return NULL;
+ }
+@@ -1374,10 +1375,10 @@ static void post_monitor_inflate_event(EventJavaMonitorInflate* event,
+ // Fast path code shared by multiple functions
+ ObjectMonitor* ObjectSynchronizer::inflate_helper(oop obj) {
+   markOop mark = obj->mark();
+-  if (mark->has_monitor()) {
+-    assert(ObjectSynchronizer::verify_objmon_isinpool(mark->monitor()), "monitor is invalid");
+-    assert(mark->monitor()->header()->is_neutral(), "monitor must record a good object header");
+-    return mark->monitor();
++  if (mark.has_monitor()) {
++    assert(ObjectSynchronizer::verify_objmon_isinpool(mark.monitor()), "monitor is invalid");
++    assert(mark.monitor()->header().is_neutral(), "monitor must record a good object header");
++    return mark.monitor();
+   }
+   return ObjectSynchronizer::inflate(Thread::current(),
+                                      obj,
+@@ -1397,7 +1398,7 @@ ObjectMonitor* ObjectSynchronizer::inflate(Thread * Self,
+ 
+   for (;;) {
+     const markOop mark = object->mark();
+-    assert(!mark->has_bias_pattern(), "invariant");
++    assert(!mark.has_bias_pattern(), "invariant");
+ 
+     // The mark can be in one of the following states:
+     // *  Inflated     - just return
+@@ -1407,9 +1408,9 @@ ObjectMonitor* ObjectSynchronizer::inflate(Thread * Self,
+     // *  BIASED       - Illegal.  We should never see this
+ 
+     // CASE: inflated
+-    if (mark->has_monitor()) {
+-      ObjectMonitor * inf = mark->monitor();
+-      assert(inf->header()->is_neutral(), "invariant");
++    if (mark.has_monitor()) {
++      ObjectMonitor * inf = mark.monitor();
++      assert(inf->header().is_neutral(), "invariant");
+       assert(inf->object() == object, "invariant");
+       assert(ObjectSynchronizer::verify_objmon_isinpool(inf), "monitor is invalid");
+       return inf;
+@@ -1446,7 +1447,7 @@ ObjectMonitor* ObjectSynchronizer::inflate(Thread * Self,
+     // before or after the CAS(INFLATING) operation.
+     // See the comments in omAlloc().
+ 
+-    if (mark->has_locker()) {
++    if (mark.has_locker()) {
+       ObjectMonitor * m = omAlloc(Self);
+       // Optimistically prepare the objectmonitor - anticipate successful CAS
+       // We do this before the CAS in order to minimize the length of time
+@@ -1484,7 +1485,7 @@ ObjectMonitor* ObjectSynchronizer::inflate(Thread * Self,
+       // drop the lock (restoring the header from the basiclock to the object)
+       // while inflation is in-progress.  This protocol avoids races that might
+       // would otherwise permit hashCode values to change or "flicker" for an object.
+-      // Critically, while object->mark is 0 mark->displaced_mark_helper() is stable.
++      // Critically, while object->mark is 0 mark.displaced_mark_helper() is stable.
+       // 0 serves as a "BUSY" inflate-in-progress indicator.
+ 
+ 
+@@ -1492,18 +1493,18 @@ ObjectMonitor* ObjectSynchronizer::inflate(Thread * Self,
+       // The owner can't die or unwind past the lock while our INFLATING
+       // object is in the mark.  Furthermore the owner can't complete
+       // an unlock on the object, either.
+-      markOop dmw = mark->displaced_mark_helper();
+-      assert(dmw->is_neutral(), "invariant");
++      markOop dmw = mark.displaced_mark_helper();
++      assert(dmw.is_neutral(), "invariant");
+ 
+       // Setup monitor fields to proper values -- prepare the monitor
+       m->set_header(dmw);
+ 
+-      // Optimization: if the mark->locker stack address is associated
++      // Optimization: if the mark.locker stack address is associated
+       // with this thread we could simply set m->_owner = Self.
+       // Note that a thread can inflate an object
+       // that it has stack-locked -- as might happen in wait() -- directly
+       // with CAS.  That is, we can avoid the xchg-NULL .... ST idiom.
+-      m->set_owner(mark->locker());
++      m->set_owner(mark.locker());
+       m->set_object(object);
+       // TODO-FIXME: assert BasicLock->dhw != 0.
+ 
+@@ -1520,7 +1521,7 @@ ObjectMonitor* ObjectSynchronizer::inflate(Thread * Self,
+         if (object->is_instance()) {
+           ResourceMark rm;
+           log_debug(monitorinflation)("Inflating object " INTPTR_FORMAT " , mark " INTPTR_FORMAT " , type %s",
+-                                      p2i(object), p2i(object->mark()),
++                                      p2i(object), object->mark().value(),
+                                       object->klass()->external_name());
+         }
+       }
+@@ -1540,7 +1541,7 @@ ObjectMonitor* ObjectSynchronizer::inflate(Thread * Self,
+     // An inflateTry() method that we could call from fast_enter() and slow_enter()
+     // would be useful.
+ 
+-    assert(mark->is_neutral(), "invariant");
++    assert(mark.is_neutral(), "invariant");
+     ObjectMonitor * m = omAlloc(Self);
+     // prepare m for installation - set monitor to initial state
+     m->Recycle();
+@@ -1571,7 +1572,7 @@ ObjectMonitor* ObjectSynchronizer::inflate(Thread * Self,
+       if (object->is_instance()) {
+         ResourceMark rm;
+         log_debug(monitorinflation)("Inflating object " INTPTR_FORMAT " , mark " INTPTR_FORMAT " , type %s",
+-                                    p2i(object), p2i(object->mark()),
++                                    p2i(object), object->mark().value(),
+                                     object->klass()->external_name());
+       }
+     }
+@@ -1623,8 +1624,8 @@ bool ObjectSynchronizer::deflate_monitor(ObjectMonitor* mid, oop obj,
+   bool deflated;
+   // Normal case ... The monitor is associated with obj.
+   guarantee(obj->mark() == markOopDesc::encode(mid), "invariant");
+-  guarantee(mid == obj->mark()->monitor(), "invariant");
+-  guarantee(mid->header()->is_neutral(), "invariant");
++  guarantee(mid == obj->mark().monitor(), "invariant");
++  guarantee(mid->header().is_neutral(), "invariant");
+ 
+   if (mid->is_busy()) {
+     if (ClearResponsibleAtSTW) mid->_Responsible = NULL;
+@@ -1639,7 +1640,7 @@ bool ObjectSynchronizer::deflate_monitor(ObjectMonitor* mid, oop obj,
+         ResourceMark rm;
+         log_debug(monitorinflation)("Deflating object " INTPTR_FORMAT " , "
+                                     "mark " INTPTR_FORMAT " , type %s",
+-                                    p2i(obj), p2i(obj->mark()),
++                                    p2i(obj), obj->mark().value(),
+                                     obj->klass()->external_name());
+       }
+     }
+diff --git a/src/hotspot/share/runtime/vframe.cpp b/src/hotspot/share/runtime/vframe.cpp
+index cca364217..7dfb2e4a2 100644
+--- a/src/hotspot/share/runtime/vframe.cpp
++++ b/src/hotspot/share/runtime/vframe.cpp
+@@ -222,7 +222,7 @@ void javaVFrame::print_lock_info_on(outputStream* st, int frame_count) {
+       if (monitor->owner() != NULL) {
+         // the monitor is associated with an object, i.e., it is locked
+ 
+-        markOop mark = NULL;
++        markOop mark = markOop::zero();
+         const char *lock_state = "locked"; // assume we have the monitor locked
+         if (!found_first_monitor && frame_count == 0) {
+           // If this is the first frame and we haven't found an owned
+@@ -231,17 +231,17 @@ void javaVFrame::print_lock_info_on(outputStream* st, int frame_count) {
+           // an inflated monitor that is first on the monitor list in
+           // the first frame can block us on a monitor enter.
+           mark = monitor->owner()->mark();
+-          if (mark->has_monitor() &&
++          if (mark.has_monitor() &&
+               ( // we have marked ourself as pending on this monitor
+-                mark->monitor() == thread()->current_pending_monitor() ||
++                mark.monitor() == thread()->current_pending_monitor() ||
+                 // we are not the owner of this monitor
+-                !mark->monitor()->is_entered(thread())
++                !mark.monitor()->is_entered(thread())
+               )) {
+             lock_state = "waiting to lock";
+           } else {
+             // We own the monitor which is not as interesting so
+             // disable the extra printing below.
+-            mark = NULL;
++            mark = markOop::zero();
+           }
+         } else if (frame_count != 0) {
+           // This is not the first frame so we either own this monitor
+@@ -250,23 +250,23 @@ void javaVFrame::print_lock_info_on(outputStream* st, int frame_count) {
+           // numbered frame on the stack, we have to check all the
+           // monitors on the list for this frame.
+           mark = monitor->owner()->mark();
+-          if (mark->has_monitor() &&
++          if (mark.has_monitor() &&
+               ( // we have marked ourself as pending on this monitor
+-                mark->monitor() == thread()->current_pending_monitor() ||
++                mark.monitor() == thread()->current_pending_monitor() ||
+                 // we are not the owner of this monitor
+-                !mark->monitor()->is_entered(thread())
++                !mark.monitor()->is_entered(thread())
+               )) {
+             lock_state = "waiting to re-lock in wait()";
+           } else {
+             // We own the monitor which is not as interesting so
+             // disable the extra printing below.
+-            mark = NULL;
++            mark = markOop::zero();
+           }
+         }
+         print_locked_object_class_name(st, Handle(THREAD, monitor->owner()), lock_state);
+-        if (ObjectMonitor::Knob_Verbose && mark != NULL) {
++        if (ObjectMonitor::Knob_Verbose && mark.to_pointer() != NULL) {
+           st->print("\t- lockbits=");
+-          mark->print_on(st);
++          mark.print_on(st);
+           st->cr();
+         }
+ 
+diff --git a/src/hotspot/share/runtime/vmStructs.cpp b/src/hotspot/share/runtime/vmStructs.cpp
+index adce6da6a..b161a6ec1 100644
+--- a/src/hotspot/share/runtime/vmStructs.cpp
++++ b/src/hotspot/share/runtime/vmStructs.cpp
+@@ -1285,7 +1285,6 @@ typedef PaddedEnd<ObjectMonitor>              PaddedObjectMonitor;
+     declare_type(arrayOopDesc, oopDesc)                                   \
+       declare_type(objArrayOopDesc, arrayOopDesc)                         \
+     declare_type(instanceOopDesc, oopDesc)                                \
+-    declare_type(markOopDesc, oopDesc)                                    \
+                                                                           \
+   /**************************************************/                    \
+   /* MetadataOopDesc hierarchy (NOTE: some missing) */                    \
+@@ -1325,7 +1324,6 @@ typedef PaddedEnd<ObjectMonitor>              PaddedObjectMonitor;
+   /* Oops */                                                              \
+   /********/                                                              \
+                                                                           \
+-  declare_oop_type(markOop)                                               \
+   declare_oop_type(objArrayOop)                                           \
+   declare_oop_type(oop)                                                   \
+   declare_oop_type(narrowOop)                                             \
+@@ -1983,6 +1981,8 @@ typedef PaddedEnd<ObjectMonitor>              PaddedObjectMonitor;
+             declare_type(BitMapView, BitMap)                              \
+                                                                           \
+    declare_integer_type(AccessFlags)  /* FIXME: wrong type (not integer) */\
++   declare_integer_type(markOop)                                          \
++   declare_type(markOopDesc, markOop)                                    \
+   declare_toplevel_type(address)      /* FIXME: should this be an integer type? */\
+    declare_integer_type(BasicType)   /* FIXME: wrong type (not integer) */\
+   JVMTI_ONLY(declare_toplevel_type(BreakpointInfo))                       \
+-- 
+2.54.0
+
diff --git a/pkgs/development/compilers/openjdk/generic.nix b/pkgs/development/compilers/openjdk/generic.nix
index 65bed061789e..7d123cb1fdf9 100644
--- a/pkgs/development/compilers/openjdk/generic.nix
+++ b/pkgs/development/compilers/openjdk/generic.nix
@@ -234,6 +234,9 @@ stdenv.mkDerivation (finalAttrs: {
       else
         ./8/patches/swing-use-gtk-jdk8.patch
     )
+  ]
+  ++ lib.optionals (featureVersion == "11") [
+    ./11/patches/fix-oopdesc-ptr-alignment-ub.patch
   ];
 
   strictDeps = true;
diff --git a/pkgs/development/libraries/science/chemistry/tblite/default.nix b/pkgs/development/libraries/science/chemistry/tblite/default.nix
index 20a89a3647de..1c21aa56c2ec 100644
--- a/pkgs/development/libraries/science/chemistry/tblite/default.nix
+++ b/pkgs/development/libraries/science/chemistry/tblite/default.nix
@@ -27,14 +27,16 @@ assert (
   ]
 );
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "tblite";
   version = "0.6.0";
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src = fetchFromGitHub {
     owner = "tblite";
     repo = "tblite";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-z0g+bf6APqNLB9mDE49FelitQ9ptZXdFQuYeXIT0NIw=";
   };
 
@@ -86,7 +88,9 @@ stdenv.mkDerivation rec {
     "dev"
   ];
 
-  checkInputs = [
+  nativeCheckInputs = [
+    # Runs python test drivers (test/*/tester.py) during checkPhase, so it must be available on the
+    # build host (strictDeps)
     python3
   ];
 
@@ -108,7 +112,8 @@ stdenv.mkDerivation rec {
       lgpl3Plus
     ];
     homepage = "https://github.com/tblite/tblite";
+    changelog = "https://github.com/tblite/tblite/releases/tag/${finalAttrs.src.tag}";
     platforms = lib.platforms.linux;
     maintainers = [ lib.maintainers.sheepforce ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/aeneas/default.nix b/pkgs/development/ocaml-modules/aeneas/default.nix
index 46a5e5827b44..82668012a2e4 100644
--- a/pkgs/development/ocaml-modules/aeneas/default.nix
+++ b/pkgs/development/ocaml-modules/aeneas/default.nix
@@ -8,6 +8,7 @@
   core_unix,
   domainslib,
   ocamlgraph,
+  ppx_deriving_yojson,
   progress,
   visitors,
 
@@ -16,7 +17,7 @@
 
 buildDunePackage (finalAttrs: {
   pname = "aeneas";
-  version = "2026.06.14";
+  version = "2026.06.22";
   __structuredAttrs = true;
 
   minimalOCamlVersion = "5.1";
@@ -25,7 +26,7 @@ buildDunePackage (finalAttrs: {
     owner = "AeneasVerif";
     repo = "aeneas";
     tag = "nightly-${finalAttrs.version}";
-    hash = "sha256-ef68sJtVdKlIr7IiZSehFlG87m1BjW5HSG8PYxbs3Lg=";
+    hash = "sha256-T/wiTajDKCG4lFcHtdQvO0AhEzX9F+vT6ij2VBBnvdU=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/src";
@@ -35,6 +36,7 @@ buildDunePackage (finalAttrs: {
     core_unix
     domainslib
     ocamlgraph
+    ppx_deriving_yojson
     progress
     visitors
   ];
diff --git a/pkgs/development/ocaml-modules/ca-certs-nss/default.nix b/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
index 061763973722..a3c1b8cb2395 100644
--- a/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
+++ b/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
@@ -14,13 +14,13 @@
 
 buildDunePackage (finalAttrs: {
   pname = "ca-certs-nss";
-  version = "3.121";
+  version = "3.125";
 
   minimalOCamlVersion = "4.13";
 
   src = fetchurl {
     url = "https://github.com/mirage/ca-certs-nss/releases/download/v${finalAttrs.version}/ca-certs-nss-${finalAttrs.version}.tbz";
-    hash = "sha256-KLFr7n9DORIkRHXud/xe61DkxKAKPZ1TopGCeK5h45w=";
+    hash = "sha256-mF0XgW/8YiZjDSaAjloI6cIEGJbEuclYitZ6kAmyWWQ=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/charon/default.nix b/pkgs/development/ocaml-modules/charon/default.nix
index a560a938ddaa..93d58a2079d7 100644
--- a/pkgs/development/ocaml-modules/charon/default.nix
+++ b/pkgs/development/ocaml-modules/charon/default.nix
@@ -16,14 +16,14 @@
 
 buildDunePackage (finalAttrs: {
   pname = "charon";
-  version = "2026.06.14";
+  version = "2026.06.22";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "AeneasVerif";
     repo = "charon";
     tag = "nightly-${finalAttrs.version}";
-    hash = "sha256-EZ1Ueco4vK4mUKyOGXXHgToNLMp+1W7095HyU+1zQ2Q=";
+    hash = "sha256-Wz2iVkHZLHwgIycHTNCmST5gizupU3xGTo0scfdq8T0=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/windtrap/default.nix b/pkgs/development/ocaml-modules/windtrap/default.nix
new file mode 100644
index 000000000000..f5e1f82e123c
--- /dev/null
+++ b/pkgs/development/ocaml-modules/windtrap/default.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  fetchurl,
+  buildDunePackage,
+}:
+
+buildDunePackage {
+  pname = "windtrap";
+  version = "0.1.0";
+  minimalOCamlVersion = "5.0";
+
+  src = fetchurl {
+    url = "https://github.com/invariant-hq/windtrap/releases/download/0.1.0/windtrap-0.1.0.tbz";
+    hash = "sha256-IkGylLJO1dVuqLg00pbm+rxdvdkkqJ9RwUsA2mbFCiU=";
+  };
+
+  doCheck = true;
+
+  # this force to skip "collapse_home" tests, because $HOME != getpwuid in the
+  # sandbox
+  preCheck = ''
+    unset HOME
+  '';
+
+  meta = {
+    description = "Unit tests, property-based tests, snapshot tests, and expect tests in a single package with one API.";
+    homepage = "https://ocaml.org/p/windtrap";
+    license = lib.licenses.isc;
+    maintainers = [ lib.maintainers.joblade ];
+  };
+}
diff --git a/pkgs/development/python-modules/badsecrets/default.nix b/pkgs/development/python-modules/badsecrets/default.nix
index d2eed4774527..734a80b35e4d 100644
--- a/pkgs/development/python-modules/badsecrets/default.nix
+++ b/pkgs/development/python-modules/badsecrets/default.nix
@@ -1,49 +1,48 @@
 {
   lib,
+  blasthttp,
   buildPythonPackage,
   colorama,
   django,
   fetchFromGitHub,
   flask-unsign,
-  poetry-core,
-  poetry-dynamic-versioning,
+  hatchling,
   pycryptodome,
   pyjwt,
   requests,
-  viewstate,
+  yara-python,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "badsecrets";
-  version = "0.13.47";
+  version = "1.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "blacklanternsecurity";
     repo = "badsecrets";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-Yvd9AGbVDOfXep8y+XzwYP2EpTvy+rwyz5hRIe7v4oc=";
+    tag = finalAttrs.version;
+    hash = "sha256-fhRQvVb+JUP1DyTMAV7leIAKD/L4kRhGFYtD78cYABI=";
   };
 
   pythonRelaxDeps = [
     "django"
-    "viewstate"
+    "pyjwt"
   ];
 
-  build-system = [
-    poetry-core
-    poetry-dynamic-versioning
-  ];
+  build-system = [ hatchling ];
 
   dependencies = [
+    blasthttp
     colorama
     django
     flask-unsign
     pycryptodome
     pyjwt
     requests
-    viewstate
-  ];
+    yara-python
+  ]
+  ++ pyjwt.optional-dependencies.crypto;
 
   pythonImportsCheck = [ "badsecrets" ];
 
diff --git a/pkgs/development/python-modules/blasthttp/default.nix b/pkgs/development/python-modules/blasthttp/default.nix
new file mode 100644
index 000000000000..48c79b7adbba
--- /dev/null
+++ b/pkgs/development/python-modules/blasthttp/default.nix
@@ -0,0 +1,80 @@
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  cargo,
+  fetchPypi,
+  nix-update-script,
+  openssl,
+  pkg-config,
+  pytest-asyncio,
+  pytestCheckHook,
+  rustc,
+  rustPlatform,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "blasthttp";
+  version = "0.9.0";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-JuoGy+QdBsVPMtD0T4Y/NSoeJcO7dwg3HmpqHxTxCIc=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-1+OFAD9n8JntZSV+PZbYLPRM/XDlFwgrEMFGv/LzTN8=";
+  };
+
+  postPatch = ''
+    # The bundled .cargo/config.toml sets OPENSSL_DIR to a relative path
+    rm .cargo/config.toml
+  '';
+
+  __darwinAllowLocalNetworking = true;
+
+  env = {
+    OPENSSL_NO_VENDOR = "1";
+  };
+
+  build-system = [
+    cargo
+    pkg-config
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+    rustc
+  ];
+
+  buildInputs = [ openssl ];
+
+  nativeCheckInputs = [
+    openssl
+    pytest-asyncio
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "blasthttp" ];
+
+  disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
+    "tests/python/test_ssl_verify.py"
+    "tests/python/test_response_api.py"
+  ];
+
+  disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
+    "test_redirect_onto_proxied_host_reevaluates_no_proxy"
+    "test_redirect_onto_no_proxy_host_reevaluates_to_direct"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Offensive-first HTTP library";
+    homepage = "https://pypi.org/project/blasthttp";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/brax/default.nix b/pkgs/development/python-modules/brax/default.nix
index 849d44c7fab2..dbde33329245 100644
--- a/pkgs/development/python-modules/brax/default.nix
+++ b/pkgs/development/python-modules/brax/default.nix
@@ -54,13 +54,21 @@ buildPythonPackage (finalAttrs: {
     ./dont-use-device_put_replicated-compat.patch
   ];
 
-  # TypeError: clip() got an unexpected keyword argument 'a_min'
-  postPatch = ''
-    substituteInPlace brax/fluid.py \
-      --replace-fail \
-        "box = 6.0 * jp.clip(jp.sum(diag_inertia_v, axis=-1), a_min=1e-12)" \
-        "box = 6.0 * jp.clip(jp.sum(diag_inertia_v, axis=-1), min=1e-12)"
-  '';
+  postPatch =
+    # TypeError: clip() got an unexpected keyword argument 'a_min'
+    ''
+      substituteInPlace brax/fluid.py \
+        --replace-fail \
+          "box = 6.0 * jp.clip(jp.sum(diag_inertia_v, axis=-1), a_min=1e-12)" \
+          "box = 6.0 * jp.clip(jp.sum(diag_inertia_v, axis=-1), min=1e-12)"
+    ''
+    # mujoco >= 3.10 changed mj_fullM's signature from (m, dst, qM) to (m, d, dst).
+    + ''
+      substituteInPlace brax/generalized/mass_test.py \
+        --replace-fail \
+          "mujoco.mj_fullM(model, mj_mass_mx, mj_next.qM)" \
+          "mujoco.mj_fullM(model, mj_next, mj_mass_mx)"
+    '';
 
   build-system = [
     hatchling
diff --git a/pkgs/development/python-modules/devito/default.nix b/pkgs/development/python-modules/devito/default.nix
index 06894f3f1dd5..5c22a8db1300 100644
--- a/pkgs/development/python-modules/devito/default.nix
+++ b/pkgs/development/python-modules/devito/default.nix
@@ -32,14 +32,15 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "devito";
-  version = "4.8.21";
+  version = "4.8.22";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "devitocodes";
     repo = "devito";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nD1bUFv24lnonajUG6m5yhGUAC0pVtSKTX69JwSt69E=";
+    hash = "sha256-7bHMMZKm+n+wSVGUSSoYQjXklxzdTeyCkjMuK0Z8qTI=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/dm-control/default.nix b/pkgs/development/python-modules/dm-control/default.nix
index 44b9ab7d99ba..04f99e7767d1 100644
--- a/pkgs/development/python-modules/dm-control/default.nix
+++ b/pkgs/development/python-modules/dm-control/default.nix
@@ -29,7 +29,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "dm-control";
-  version = "1.0.41";
+  version = "1.0.43";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -37,7 +37,7 @@ buildPythonPackage (finalAttrs: {
     owner = "google-deepmind";
     repo = "dm_control";
     tag = finalAttrs.version;
-    hash = "sha256-AxyxI9sRF822oNLk/zVUnGVRGSQ3BHCBQJ9HtD8aL/M=";
+    hash = "sha256-6c67sOcKsygtjdn3NOjfK0K3IsZIOZHDMXr5qMp+W5A=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/funsor/default.nix b/pkgs/development/python-modules/funsor/default.nix
index 96c7dcd3a62e..04ece9b20542 100644
--- a/pkgs/development/python-modules/funsor/default.nix
+++ b/pkgs/development/python-modules/funsor/default.nix
@@ -14,7 +14,7 @@
   opt-einsum,
   typing-extensions,
 
-  # checks
+  # tests
   pyro-ppl,
   torch,
   pandas,
@@ -25,20 +25,19 @@
   requests,
   scipy,
   torchvision,
-
-  stdenv,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "funsor";
-  version = "0.4.6";
+  version = "0.4.7";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "pyro-ppl";
     repo = "funsor";
-    tag = version;
-    hash = "sha256-Prj1saT0yoPAP8rDE0ipBEpR3QMk4PS12VSJlxc22p8=";
+    tag = finalAttrs.version;
+    hash = "sha256-0STJv1OOliJaHdmYUXdnOnocH3hVXceH/Uw5nILvT+U=";
   };
 
   patches = [
@@ -49,13 +48,6 @@ buildPythonPackage rec {
     })
   ];
 
-  # TypeError: clip() got an unexpected keyword argument 'a_max'
-  postPatch = ''
-    substituteInPlace funsor/jax/ops.py \
-      --replace-fail "a_max=" "max=" \
-      --replace-fail "a_min=" "min="
-  '';
-
   build-system = [ setuptools ];
 
   dependencies = [
@@ -87,24 +79,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "funsor" ];
 
-  disabledTests = [
-    # `test_torch_save` got broken by the update of torch (2.3.1 -> 2.4.0):
-    # FutureWarning: You are using `torch.load` with `weights_only=False`...
-    # TODO: Try to re-enable this test at next release
-    "test_torch_save"
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    # Failures related to JIT
-    # RuntimeError: required keyword attribute 'Subgraph' has the wrong type
-    "test_local_param_ok"
-    "test_plate_ok"
-  ];
-
   meta = {
     description = "Functional tensors for probabilistic programming";
     homepage = "https://funsor.pyro.ai";
-    changelog = "https://github.com/pyro-ppl/funsor/releases/tag/${version}";
+    changelog = "https://github.com/pyro-ppl/funsor/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ GaetanLepage ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index e1bb6d407022..4303c9ae55d5 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202606221";
+  version = "0.1.202606231";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qJJGLgkqvDTqozTCb+1sTLcbWwsVh1JVyOEirNpBGlc=";
+    hash = "sha256-IQWbG1aPrQ8mgzCa8XFMiZDPeMStIy/L9WubtMKpCbI=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/mujoco/default.nix b/pkgs/development/python-modules/mujoco/default.nix
index bd51f0d85688..5215b66c0e62 100644
--- a/pkgs/development/python-modules/mujoco/default.nix
+++ b/pkgs/development/python-modules/mujoco/default.nix
@@ -31,6 +31,7 @@ buildPythonPackage (finalAttrs: {
   inherit (mujoco) version;
 
   pyproject = true;
+  __structuredAttrs = true;
 
   # We do not fetch from the repository because the PyPi tarball is
   # impurely build via
@@ -38,7 +39,7 @@ buildPythonPackage (finalAttrs: {
   # in the project's CI.
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-AZoLNAaJK8mEVOr1XL0n+F0Wd1iteF93xgimHzo0rRc=";
+    hash = "sha256-yejV2H2CIE7VvMyH2EPApT51qvOB3ik47EbQTxrG4k4=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/development/python-modules/opower/default.nix b/pkgs/development/python-modules/opower/default.nix
index 75c632dd0fae..98d9084c692d 100644
--- a/pkgs/development/python-modules/opower/default.nix
+++ b/pkgs/development/python-modules/opower/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "opower";
-  version = "0.18.5";
+  version = "0.18.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tronikos";
     repo = "opower";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-s6nacD6k9OgByt2ZdBrZsHtAhdUto7gngqqQWI3henY=";
+    hash = "sha256-lOmd/eyU0XDPbAjW2ur9lSlq5ECv80/1FZXjLaZ92e4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/osc-lib/default.nix b/pkgs/development/python-modules/osc-lib/default.nix
index d36ea86e78f5..bc8801c50dbe 100644
--- a/pkgs/development/python-modules/osc-lib/default.nix
+++ b/pkgs/development/python-modules/osc-lib/default.nix
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "openstack";
     repo = "osc-lib";
     tag = version;
-    hash = "sha256-HYRm3GdgGUZqi7sqe2wmni2t0t7Ox3qJAukGABKPoyY=";
+    hash = "sha256-XwOJSd3k/74FvSZGveSTjH+KGLlQ2jNbk8GrTzFhbL0=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/pydocket/default.nix b/pkgs/development/python-modules/pydocket/default.nix
index c67c32a80dd4..d2ced9dba1a3 100644
--- a/pkgs/development/python-modules/pydocket/default.nix
+++ b/pkgs/development/python-modules/pydocket/default.nix
@@ -25,7 +25,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydocket";
-  version = "0.21.1";
+  version = "0.22.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -33,7 +33,7 @@ buildPythonPackage (finalAttrs: {
     owner = "chrisguidry";
     repo = "docket";
     tag = finalAttrs.version;
-    hash = "sha256-2YBX/PaR0ebQBkx/Z72TSxlTzY8MWBJu+0mEanLfvnU=";
+    hash = "sha256-WbOXUB6nYeD248K3pE5s1NIf+73dZcuqchQ/Nfw9AbA=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/python-openstackclient/default.nix b/pkgs/development/python-modules/python-openstackclient/default.nix
index b22d3b4ed7df..5a008c978161 100644
--- a/pkgs/development/python-modules/python-openstackclient/default.nix
+++ b/pkgs/development/python-modules/python-openstackclient/default.nix
@@ -82,11 +82,6 @@ buildPythonPackage (finalAttrs: {
     stestrCheckHook
   ];
 
-  disabledTestsRegex = [
-    "openstackclient.tests.unit.common.test_module.TestModuleList*"
-    "openstackclient.tests.unit.common.test_clientmanager.TestClientManager*"
-  ];
-
   pythonImportsCheck = [
     "openstackclient"
     "openstackclient.api"
diff --git a/pkgs/development/python-modules/rerun-notebook/default.nix b/pkgs/development/python-modules/rerun-notebook/default.nix
index dbaa086c8bd1..11b947a01b8a 100644
--- a/pkgs/development/python-modules/rerun-notebook/default.nix
+++ b/pkgs/development/python-modules/rerun-notebook/default.nix
@@ -22,7 +22,7 @@ buildPythonPackage (finalAttrs: {
     inherit (finalAttrs) version;
     format = "wheel";
     python = "py2.py3";
-    hash = "sha256-GDgqFShq40hcptQPie9pwyZFed/9kBmvke5/OwfHl6M=";
+    hash = "sha256-PiZOxfVyqTwK0oSQ57TLpDIzuZUSecSEDmJtfdqqCGo=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/stanza/default.nix b/pkgs/development/python-modules/stanza/default.nix
index 8ba3b9f599c6..2c8cde03e1cf 100644
--- a/pkgs/development/python-modules/stanza/default.nix
+++ b/pkgs/development/python-modules/stanza/default.nix
@@ -6,6 +6,7 @@
   setuptools,
   # dependencies
   emoji,
+  huggingface-hub,
   networkx,
   numpy,
   peft,
@@ -20,20 +21,21 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "stanza";
-  version = "1.12.2";
+  version = "1.13.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "stanfordnlp";
     repo = "stanza";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hUI8sZDwBK8ZRS9asyDiTqpoIGnGbHeH/Q9i/gasut0=";
+    hash = "sha256-+quLNaxaGCUpsg3PH11nEMeKjIoHsKaBqK4FdIHlaMM=";
   };
 
   build-system = [ setuptools ];
 
   dependencies = [
     emoji
+    huggingface-hub
     networkx
     numpy
     peft
diff --git a/pkgs/development/python-modules/symbolic/default.nix b/pkgs/development/python-modules/symbolic/default.nix
index bcc2b224335a..81b779197b5a 100644
--- a/pkgs/development/python-modules/symbolic/default.nix
+++ b/pkgs/development/python-modules/symbolic/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "symbolic";
-  version = "13.2.0";
+  version = "13.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -23,12 +23,12 @@ buildPythonPackage (finalAttrs: {
     tag = finalAttrs.version;
     # the `py` directory is not included in the tarball, so we fetch the source via git instead
     forceFetchGit = true;
-    hash = "sha256-Nks8CClNENRFBbEGgFP3yhi5sWR/iiaLOdTayPD7M9k=";
+    hash = "sha256-w2suCkNxuHGLnf8+RsXwyZWYKGT/41rrckVUWQgT1bg=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-r+9mrGyr78UenC9BFpW1a+VjEAXgcamLOoI8V1N10Cg=";
+    hash = "sha256-6AnNOTdiUvJbmB4TJdEipKoTLXHlJb5WPX51GtJy+II=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 0ffadb14a6ea..21a2f7aa0da9 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.119";
+  version = "3.1.120";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = finalAttrs.version;
-    hash = "sha256-6uPKhXonPxWIwyXYlURSukwDg0WJnUkA4wCcNxWimlY=";
+    hash = "sha256-VJnFj/NeGKT223boJWMZZC/LxHdu+pqNexd+ezuq/js=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/typst/default.nix b/pkgs/development/python-modules/typst/default.nix
index 598de8ecac99..47a48e690ed5 100644
--- a/pkgs/development/python-modules/typst/default.nix
+++ b/pkgs/development/python-modules/typst/default.nix
@@ -12,19 +12,19 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "typst";
-  version = "0.14.9";
+  version = "0.15.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "messense";
     repo = "typst-py";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BiheOVvXPoLGtOzObZte38RkMVkUMOsFURn5DU1cw+o=";
+    hash = "sha256-9wHUikOf/WULPaGkCOXa0aXcSme+xbweC6IDwaJnwRk=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-PM0WntALVI/ks7N/Uk5tjcb0XBr2PSUY+O1nalFg2JQ=";
+    hash = "sha256-TyLKnJUVbodCHQXhpjIr1numNDmeUkvpsKH1o5tWFCM=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/victron-mqtt/default.nix b/pkgs/development/python-modules/victron-mqtt/default.nix
index ae19b7e9db66..f2b9e81a9557 100644
--- a/pkgs/development/python-modules/victron-mqtt/default.nix
+++ b/pkgs/development/python-modules/victron-mqtt/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "victron-mqtt";
-  version = "2026.6.4";
+  version = "2026.6.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tomer-w";
     repo = "victron_mqtt";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lKntAZF9SkSBnlLwcwMB9wZz9PviRbSbweTMzwwzExY=";
+    hash = "sha256-06+vn0HKvml3VRvPnQHz832OQnbvjd8tJEcnE6TIer8=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/xknx/default.nix b/pkgs/development/python-modules/xknx/default.nix
index 8d829187a5c8..40e75ee02244 100644
--- a/pkgs/development/python-modules/xknx/default.nix
+++ b/pkgs/development/python-modules/xknx/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "xknx";
-  version = "3.15.0";
+  version = "3.16.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "XKNX";
     repo = "xknx";
     tag = finalAttrs.version;
-    hash = "sha256-EA6F4Wkji495uVfFyN1M+jZsXFkKbfK7POie3qbuqBY=";
+    hash = "sha256-884iWQynTRBauJR10CzgkveoD9//Dq+mpvywtSnmT+c=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/kde/generated/sources/plasma.json b/pkgs/kde/generated/sources/plasma.json
index 5f74fe6626b9..ec36e1e0c869 100644
--- a/pkgs/kde/generated/sources/plasma.json
+++ b/pkgs/kde/generated/sources/plasma.json
@@ -1,377 +1,377 @@
 {
   "aurorae": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/aurorae-6.7.0.tar.xz",
-    "hash": "sha256-U4Ij6+dSEwXSmHPCePheeRDreBCjHSppaY7edqXA2jw="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/aurorae-6.7.1.tar.xz",
+    "hash": "sha256-q++RuE02QRSkXyi8TLCHzPJCZQ53NzCB8qouJdAPEaQ="
   },
   "bluedevil": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/bluedevil-6.7.0.tar.xz",
-    "hash": "sha256-P9q0pyS6JGoQ8mNwdspTMniP/1w8YZPM806wMeiXPp0="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/bluedevil-6.7.1.tar.xz",
+    "hash": "sha256-HR6ao2cFBVtrHlMiO2B3dXy7okJeYmk8HjEtSU/4rPs="
   },
   "breeze": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/breeze-6.7.0.tar.xz",
-    "hash": "sha256-zzdbuqpF9bobPfA2vwxAt+39eJ6yb25G+d0dMldpy9U="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/breeze-6.7.1.tar.xz",
+    "hash": "sha256-BXoVTUYZ7/aI+OSJ+6EW43Q7dj0y3rERuwCCqRk8n5M="
   },
   "breeze-grub": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/breeze-grub-6.7.0.tar.xz",
-    "hash": "sha256-x+atJoKHKWS9cJucyrD8uTKKz1YpQHwji3XvfYA8+iE="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/breeze-grub-6.7.1.tar.xz",
+    "hash": "sha256-WEFkMVfYE8JBztribmlVNktiTfWLcKNzeVQNqKOhvSk="
   },
   "breeze-gtk": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/breeze-gtk-6.7.0.tar.xz",
-    "hash": "sha256-KFmeF3tBZqezMvg0pyaWz4gs+fap7hknCKJ/R0wQJ8A="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/breeze-gtk-6.7.1.tar.xz",
+    "hash": "sha256-fMJ8F0QXyJvv5HFVI6vDrGqA0xj8Lw4YSULzShe+y24="
   },
   "breeze-plymouth": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/breeze-plymouth-6.7.0.tar.xz",
-    "hash": "sha256-2gNHVU33S38RsXA71s3eF2kXQuMqXMzfyTJaGzJhBqU="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/breeze-plymouth-6.7.1.tar.xz",
+    "hash": "sha256-SBfQKH6/NW8DD9waChoGmrvfy99I1f5KES8wKRm2rcM="
   },
   "discover": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/discover-6.7.0.tar.xz",
-    "hash": "sha256-A9SisXVxdla/7pB/T7lBILhs3MhmPZTnkkrG8nelWyc="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/discover-6.7.1.tar.xz",
+    "hash": "sha256-JXpcSoOhlBYZeNQHzGbOFIG1hIsfp38fn7sn0hFrQfk="
   },
   "drkonqi": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/drkonqi-6.7.0.tar.xz",
-    "hash": "sha256-VeZibrxQCJmKInVcjNJx8jNYcqUM3fZfFY/dXNI319M="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/drkonqi-6.7.1.tar.xz",
+    "hash": "sha256-Ng8NlmwcUTxp7TCw3nFKovX6lTnPqf2J1VWTv4/kkVQ="
   },
   "flatpak-kcm": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/flatpak-kcm-6.7.0.tar.xz",
-    "hash": "sha256-SmSQaW60yGQ4sE6X3BY75QsM17t+rPuyBGkglP9gt2s="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/flatpak-kcm-6.7.1.tar.xz",
+    "hash": "sha256-AruzSZV2MuKyJHc5zSNG2/TQ/3hu2+Sk/tW3zlWLxhg="
   },
   "kactivitymanagerd": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kactivitymanagerd-6.7.0.tar.xz",
-    "hash": "sha256-7QZcLXbIXPjhDdcv+PiechNvxMhVYabJheuX3FGERqE="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kactivitymanagerd-6.7.1.tar.xz",
+    "hash": "sha256-SAvTuiozFbQTCE3J9gxVJS8r+euinz3FebfhUOaAWws="
   },
   "kde-cli-tools": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kde-cli-tools-6.7.0.tar.xz",
-    "hash": "sha256-JyD/fvv5e+9GmwL1RInz2bKguYyHGu25Fazbr5nzGZg="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kde-cli-tools-6.7.1.tar.xz",
+    "hash": "sha256-KH5A1A9uVVs28MQ7ZnEceghmMCSoEGxLAuxM/215FBs="
   },
   "kde-gtk-config": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kde-gtk-config-6.7.0.tar.xz",
-    "hash": "sha256-2W5YIUxmMrSR0yyqSusVrihPg+inXTu5SFl49Cr0q9k="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kde-gtk-config-6.7.1.tar.xz",
+    "hash": "sha256-OLT5jVmIFpTFYmMJczULM853/aYsy85QZ8a7gPRjRtE="
   },
   "kdecoration": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kdecoration-6.7.0.tar.xz",
-    "hash": "sha256-rP5WV9iJvw3VuLUBMrvpxi9ItQdPy6gmWhy4TWwie10="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kdecoration-6.7.1.tar.xz",
+    "hash": "sha256-Ol2PV7q0Uuq9Gq3EUIi5WmaalRYmx+YB9qDvNgMGhL8="
   },
   "kdeplasma-addons": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kdeplasma-addons-6.7.0.tar.xz",
-    "hash": "sha256-i4awt5sK8toJfYHc4JmRPUNXTgjEQop5JYcGkheLQpg="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kdeplasma-addons-6.7.1.tar.xz",
+    "hash": "sha256-nQ5x7xgIUGMIdRtfmydMlty9PTAsPCSVrW1R6zt+pP8="
   },
   "kgamma": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kgamma-6.7.0.tar.xz",
-    "hash": "sha256-6MM9ukfaPqD4kFPpQCmCqx+9tpwlm/CLEEegUEsH3ZI="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kgamma-6.7.1.tar.xz",
+    "hash": "sha256-3msXvkXDuvEUe0OXGNF+AQv3odG/cMUU3deDTOfI/tc="
   },
   "kglobalacceld": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kglobalacceld-6.7.0.tar.xz",
-    "hash": "sha256-/1423Ly4GC8baVBimTqeosxz0mdTay9ZJt4Dn6dzLGU="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kglobalacceld-6.7.1.tar.xz",
+    "hash": "sha256-DycS/x9aTEQ+Lh33A/sHTi112lXx/gOaDuw4pYcI56c="
   },
   "kinfocenter": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kinfocenter-6.7.0.tar.xz",
-    "hash": "sha256-303tKcuH12W31fSxYcKaQlWGOES+5kJH5vDT8Miz5aM="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kinfocenter-6.7.1.tar.xz",
+    "hash": "sha256-lXhBKL3ZZ5w5xmjiv3om1eB9ahP2osmjdhWJ+2x1LP0="
   },
   "kmenuedit": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kmenuedit-6.7.0.tar.xz",
-    "hash": "sha256-8n/tXImJrQCtxxS8fzd638qXQsTM06//lHjVAu6v/6s="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kmenuedit-6.7.1.tar.xz",
+    "hash": "sha256-4nIVMiJyewt19Uq3y8vhFW1DRzwga1pz1n5a6jbfhEk="
   },
   "knighttime": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/knighttime-6.7.0.tar.xz",
-    "hash": "sha256-wvx1Kc7zs6gL5HFShtAn/IkI7w/oBArqEGgxpSZfwRM="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/knighttime-6.7.1.tar.xz",
+    "hash": "sha256-1MYNnr6xO59NDMq/BUWkgtm4mTM6tKhst4sWWs9Z7UM="
   },
   "kpipewire": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kpipewire-6.7.0.tar.xz",
-    "hash": "sha256-2/g5t3nFCMICC9+dZCdiOHy6hQWSkd6rOOigwVIjuts="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kpipewire-6.7.1.tar.xz",
+    "hash": "sha256-j40qF3SPKWQl5sQGgjQKaV3/fNkz7ZdHTU6sK/6UJ8E="
   },
   "krdp": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/krdp-6.7.0.tar.xz",
-    "hash": "sha256-5lylbPL5ZplFENzOzVOJKSLiYa19upkR0vN0BgKTxts="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/krdp-6.7.1.tar.xz",
+    "hash": "sha256-bYe6Be/Sn4SnMKFcdIEJJTV+h12+31vL9pJqVFLrf3k="
   },
   "kscreen": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kscreen-6.7.0.tar.xz",
-    "hash": "sha256-rVekMmpkl5poqlBopxUXAtmwLbByBnDkvj4XiQW+2lY="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kscreen-6.7.1.tar.xz",
+    "hash": "sha256-95xfFg04duXfLxfhBPOjf6Q6QLa5Z9o8687p4nKs9H8="
   },
   "kscreenlocker": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kscreenlocker-6.7.0.tar.xz",
-    "hash": "sha256-wxVLaKiF7VXUzVd/gT9VU+oLMdvdMbMrN0SQVVD+w9E="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kscreenlocker-6.7.1.tar.xz",
+    "hash": "sha256-m6zNFheLULYPmYuBKmHgdAV08T1Zlcohk5xeFgaOPJ4="
   },
   "ksshaskpass": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/ksshaskpass-6.7.0.tar.xz",
-    "hash": "sha256-TY7lYdv64xjil4QR2z1/3wkmY/XUXTafHjqSNNhyzuA="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/ksshaskpass-6.7.1.tar.xz",
+    "hash": "sha256-Y4FB/SY5UAW13R99BFS6n+p9JkupNDeYHzRVNVKi1Aw="
   },
   "ksystemstats": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/ksystemstats-6.7.0.tar.xz",
-    "hash": "sha256-IiTOQeQudYRaqIbhkueDPOY4uGqjHKDk48sx7zbkBms="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/ksystemstats-6.7.1.tar.xz",
+    "hash": "sha256-I7Fqk76ua+2xkl4MItBfKtX5/73ZfA+nUzX+K+Lrsx8="
   },
   "kwallet-pam": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kwallet-pam-6.7.0.tar.xz",
-    "hash": "sha256-cdvV1qtSQ+eMUjzjgtU70Uw1cxrwlJf76Sm8pBtprtk="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kwallet-pam-6.7.1.tar.xz",
+    "hash": "sha256-Lzce3Y5DR9W4rw4qaH9eNTd7/diWxwXJO4Ps4EOenEU="
   },
   "kwayland": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kwayland-6.7.0.tar.xz",
-    "hash": "sha256-hiHRfpEAvmDqNAI1II0ET9ApMdvvdqMtmkd94xyOM/Q="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kwayland-6.7.1.tar.xz",
+    "hash": "sha256-NPLbzil/W/zlv/ujyS8XTZp3SszSjSxnfnhscMnt5L8="
   },
   "kwayland-integration": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kwayland-integration-6.7.0.tar.xz",
-    "hash": "sha256-IRld2c69WlxzhmOybw4dFaspj1ncqvkkNethi540JcM="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kwayland-integration-6.7.1.tar.xz",
+    "hash": "sha256-Cc13B7KLXBnSB/3gdOmkwBLZROK66iPFmVqUAV6hwt4="
   },
   "kwin": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kwin-6.7.0.tar.xz",
-    "hash": "sha256-0gt5gJSp9Y5X3lXso9WLHNy32yk564v3ORjE+rbZrsU="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kwin-6.7.1.tar.xz",
+    "hash": "sha256-NSv7NO+tFDUHGWDvTNOSsRChjhwWjR/cXM5rQzMdCHU="
   },
   "kwin-x11": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kwin-x11-6.7.0.tar.xz",
-    "hash": "sha256-msC4W1kBbfuRWH+MGXD71cbyFdEsmkGazQv30PBJNgY="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kwin-x11-6.7.1.tar.xz",
+    "hash": "sha256-C7QDHIcHM7oDrN6/uxmcqklF0ZFKFnAEXfqNO1O04F8="
   },
   "kwrited": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/kwrited-6.7.0.tar.xz",
-    "hash": "sha256-dUOaklYfbDMoBNHSfa4VvFdVuMmvKNp50WwDLVCQOxA="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/kwrited-6.7.1.tar.xz",
+    "hash": "sha256-QVjROFluLdUtr8h8370JcPUMmOQkB23XKaosbAkjYlE="
   },
   "layer-shell-qt": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/layer-shell-qt-6.7.0.tar.xz",
-    "hash": "sha256-5vSLbr4sPKqjwu9thHBVCQTQMK00lrwQpUCYddstqrA="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/layer-shell-qt-6.7.1.tar.xz",
+    "hash": "sha256-Ayo/VDPxkTKRpZXjPKCKCkx+IuLXzjf19ygkdpbGEYg="
   },
   "libkscreen": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/libkscreen-6.7.0.tar.xz",
-    "hash": "sha256-bvulgFeiY12m8YVbprCOV+Y2yXZCG6Xj9fZn5qV7DOE="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/libkscreen-6.7.1.tar.xz",
+    "hash": "sha256-xrE6dh5u6GXx0KtysSazL782D3ToAqFDFeWix+G35R4="
   },
   "libksysguard": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/libksysguard-6.7.0.tar.xz",
-    "hash": "sha256-40wBQ4OZ/CMJDN5NRyJbzY9giZ0TjsrpnMWZZZU2rOM="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/libksysguard-6.7.1.tar.xz",
+    "hash": "sha256-P7orFd6RPrN2JMROw/O9iHNNCkIqvvb6goT2cmDnE/M="
   },
   "libplasma": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/libplasma-6.7.0.tar.xz",
-    "hash": "sha256-ioXkyessPAC1aDzOOqLJSdBrlWyIeJwbHBELarriAxI="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/libplasma-6.7.1.tar.xz",
+    "hash": "sha256-+sljROkeIvGsrCn5BQ+NzNSXplhzVzPP+Q5HnNob1bM="
   },
   "milou": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/milou-6.7.0.tar.xz",
-    "hash": "sha256-jJSkw875vGJbVByz1MLwqVv6E9MfPBgGM/fvnScB2x4="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/milou-6.7.1.tar.xz",
+    "hash": "sha256-fB+LXOhQ9ZkIAEIvUwEw3RT942QsfJFhAFFv1oNqzp8="
   },
   "ocean-sound-theme": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/ocean-sound-theme-6.7.0.tar.xz",
-    "hash": "sha256-ELK6ypKrcZirzCDVjdrTGRDIxr7uRxH8KkohUFRG8TU="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/ocean-sound-theme-6.7.1.tar.xz",
+    "hash": "sha256-f/G3Nx/GPqqbmEdQlZGAMKlDiq5n0yxm7gy01yNy1iU="
   },
   "oxygen": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/oxygen-6.7.0.tar.xz",
-    "hash": "sha256-ER+2K8PZ86lZ53/TX+VWLKNK14PLzcDBZFh/Vklc/ww="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/oxygen-6.7.1.tar.xz",
+    "hash": "sha256-Yh9N4kv4lh9NUaKhPgid5TqZtmL9LEGs1sWy8v7DHeg="
   },
   "oxygen-sounds": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/oxygen-sounds-6.7.0.tar.xz",
-    "hash": "sha256-YqPdeoilcNacNwpxomHI3QTZLa+QJQyiqdI8KeZ+HIo="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/oxygen-sounds-6.7.1.tar.xz",
+    "hash": "sha256-v/Fr9p+ddlcjfGfg7DLCEYjNyW8AQVfAx/PbuNOciJQ="
   },
   "plasma-activities": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-activities-6.7.0.tar.xz",
-    "hash": "sha256-OP+VeZagnBUjbpOwNboSNICliv90iUtht98QIOxEK1k="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-activities-6.7.1.tar.xz",
+    "hash": "sha256-2eOO+moKuLUMIIwIrKx7/iPJ6PfK/MGAoWRyStaBmAQ="
   },
   "plasma-activities-stats": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-activities-stats-6.7.0.tar.xz",
-    "hash": "sha256-K0qu2cRoW8LAVqDLqE1CfvLx63pPhB1Yd9A0e1sRzBM="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-activities-stats-6.7.1.tar.xz",
+    "hash": "sha256-YvS4CWXw1hblC5XX7s/OSruStCYZD4znbZKblBBsOPU="
   },
   "plasma-bigscreen": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-bigscreen-6.7.0.tar.xz",
-    "hash": "sha256-IS6811bk2oY4UsvKj9qPE+h/6IDSKSy9S+iPJs8k9IY="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-bigscreen-6.7.1.tar.xz",
+    "hash": "sha256-LaM+OvpKt+oZ24J/WTJUpSHf0XVohQmum39CIQQxMLE="
   },
   "plasma-browser-integration": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-browser-integration-6.7.0.tar.xz",
-    "hash": "sha256-zVtIPuKJHea7Bi3q62r+DAop6VHgclEMASwVtJsblUs="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-browser-integration-6.7.1.tar.xz",
+    "hash": "sha256-5/m1qzdFlLFWNNvhKbpGdDG1M3tk7PL/21BPo80fjRM="
   },
   "plasma-desktop": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-desktop-6.7.0.tar.xz",
-    "hash": "sha256-Y1E7VPb2CzzX7DXKLwlivfJWaXKTiOhRWsHTuIme5H8="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-desktop-6.7.1.tar.xz",
+    "hash": "sha256-8EUNwmcG/C1xmrKOMQIUnPv2py6BzTEMk2uFwIq7by8="
   },
   "plasma-dialer": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-dialer-6.7.0.tar.xz",
-    "hash": "sha256-CKULmVTY8yxCgJknsUz7Kg/GaKc1XhdWGbsNL86izUc="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-dialer-6.7.1.tar.xz",
+    "hash": "sha256-1BpinydZ/NviXuLQ21rU1Y3xZXuA791aV8K5NnCq3yg="
   },
   "plasma-disks": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-disks-6.7.0.tar.xz",
-    "hash": "sha256-mYiOJyaPD1q9+9hd42KxjxymxnDps5LnbaMPUafVzc8="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-disks-6.7.1.tar.xz",
+    "hash": "sha256-gMxmv+uvhInLgA09FfDifwEQegzzbKFlkAxhwOv+470="
   },
   "plasma-firewall": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-firewall-6.7.0.tar.xz",
-    "hash": "sha256-eHwVBebooyw/hVu2X0YVY3fuItbcMhpyB5sWB68N8n0="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-firewall-6.7.1.tar.xz",
+    "hash": "sha256-tb2giZ3X4ygv6ibXH0gk5oFcoOHiHSAXlLfxMb9BcYE="
   },
   "plasma-integration": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-integration-6.7.0.tar.xz",
-    "hash": "sha256-U3sFzUurGwcG+zH5gj+GZt9yleZH51YU8Ctr8UWO/x0="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-integration-6.7.1.tar.xz",
+    "hash": "sha256-GqsFgdC/2Taec/mWdIL0WTxZDPBYw0ofC8kREV0MWPw="
   },
   "plasma-keyboard": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-keyboard-6.7.0.tar.xz",
-    "hash": "sha256-gxGV8wjQgRuNeLTIRYFdyhZIuz/sg8nsY30b4ltTq3Q="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-keyboard-6.7.1.tar.xz",
+    "hash": "sha256-rPNqjTYVDGoOzuLusPcMTxImyuP+30fzjgbXZbY4gEc="
   },
   "plasma-login-manager": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-login-manager-6.7.0.tar.xz",
-    "hash": "sha256-A8WFlhQcwSYsKxxXSdm2TW5yJclyjUIcblr7ZJNWbuE="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-login-manager-6.7.1.tar.xz",
+    "hash": "sha256-cZU/NZ8MIsI1HjliCFasSNse/e6bvExB0Wg9j8+EOdY="
   },
   "plasma-mobile": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-mobile-6.7.0.tar.xz",
-    "hash": "sha256-NCaqC2KblFsHbqzhMMSrvG//b2xd0cK/9/8Ney1HfkI="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-mobile-6.7.1.tar.xz",
+    "hash": "sha256-PineHwZCOzNky3VQ3jet92YhSX3xOmq6+JpmR8uPS/4="
   },
   "plasma-nano": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-nano-6.7.0.tar.xz",
-    "hash": "sha256-xOL0nSQVfO62vCWYHi1xYA3SEXJJ6CsMwE+klAEZMYE="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-nano-6.7.1.tar.xz",
+    "hash": "sha256-C3cS0WA1Zci2/WKALspPB5GagqWzJ6vfTpk3vkpuzPQ="
   },
   "plasma-nm": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-nm-6.7.0.tar.xz",
-    "hash": "sha256-spaAzBfEu+UuO5iNW+Q37EtSS1VPoYDq0TvIkQFEz5g="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-nm-6.7.1.tar.xz",
+    "hash": "sha256-xDSWduN13o2YM+/3GCthlwxJHZmLKbtiYupVykW0dNo="
   },
   "plasma-pa": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-pa-6.7.0.tar.xz",
-    "hash": "sha256-utzogREH7ldyBxYnWsX8EhFmibw0zkk8q+cijhtlj1E="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-pa-6.7.1.tar.xz",
+    "hash": "sha256-cOnkdSfzi5FZ+UHciJWoSYKLP24xPjOznhHbQyA/Fwk="
   },
   "plasma-sdk": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-sdk-6.7.0.tar.xz",
-    "hash": "sha256-1G1SKRVGImSuXUl7rBb3U7DQtrW1uZtG/fiCP0xWLtM="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-sdk-6.7.1.tar.xz",
+    "hash": "sha256-RAoThwkoj+iTUCjsKLHebR3wjKCY+s17i4YpkCssZMU="
   },
   "plasma-setup": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-setup-6.7.0.tar.xz",
-    "hash": "sha256-3I+l3XRXBW3hwtAEPw83zTBhAg/s0hmMq/83i9XJVx4="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-setup-6.7.1.tar.xz",
+    "hash": "sha256-D520I44I2sk5ABkSQqcu5FVMsAfaDYs3axfwsOTyy6M="
   },
   "plasma-systemmonitor": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-systemmonitor-6.7.0.tar.xz",
-    "hash": "sha256-9lthyXWIbtxXSZVnAKWkxAWeeRXEl4aFeI/oGKFxS0I="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-systemmonitor-6.7.1.tar.xz",
+    "hash": "sha256-u4duK34ulFDkIHQ40lZCgtKFFNSLnh8WU0CZgh87cvs="
   },
   "plasma-thunderbolt": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-thunderbolt-6.7.0.tar.xz",
-    "hash": "sha256-Pepo91aAHJVHM2ykFVJnLDaTCRwpu/iWjuAf8pKHk6A="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-thunderbolt-6.7.1.tar.xz",
+    "hash": "sha256-Mra0QYXPAj/g909PXjNxGiJTZFftuNLXNcbE7AFP3OQ="
   },
   "plasma-vault": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-vault-6.7.0.tar.xz",
-    "hash": "sha256-i9cLPTeHidOWpm5pOoCd1rIe3EgWYnWTL399AgdPzhw="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-vault-6.7.1.tar.xz",
+    "hash": "sha256-5RfE/MK+NzFtrVfHDBrooQ30Z4FHm1mLoes+I2Z/34I="
   },
   "plasma-welcome": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-welcome-6.7.0.tar.xz",
-    "hash": "sha256-SD8WkxtswsVmaPVCBBjnsvja1XarqgG8dVRsE2HyGQM="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-welcome-6.7.1.tar.xz",
+    "hash": "sha256-/QOm4pkS55WQTJ/7ODX6iB9ZGTUZStcdJFAUMt6WurA="
   },
   "plasma-workspace": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-workspace-6.7.0.tar.xz",
-    "hash": "sha256-mn8qBOikS/JNpNKUu6JwmEoJDvF6CCzR6yXLgYJlHTw="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-workspace-6.7.1.tar.xz",
+    "hash": "sha256-o/Jn78KTkmnCZSNEmteqzK4GsBryBzYklHzOxF17wjw="
   },
   "plasma-workspace-wallpapers": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma-workspace-wallpapers-6.7.0.tar.xz",
-    "hash": "sha256-DpIiDArgt8QmROvtb+FZ+wCXqJLmQMsSQgR8kpkx6go="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma-workspace-wallpapers-6.7.1.tar.xz",
+    "hash": "sha256-s8u3+qZqOE8TfDT5OE7vBRTzMlQhtEmxh7V7XgZdaZo="
   },
   "plasma5support": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plasma5support-6.7.0.tar.xz",
-    "hash": "sha256-5g4eR6Pe6TUYZH1mOTwh4kBvd3np6eQ4LXzqaM67+3s="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plasma5support-6.7.1.tar.xz",
+    "hash": "sha256-BnC/QpkCc/vmBJ0Tbb1g/WU2UJ1SlVw4BImSRLgmOOM="
   },
   "plymouth-kcm": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/plymouth-kcm-6.7.0.tar.xz",
-    "hash": "sha256-KrVY7wsm/U4C+iZ4ZBL28be8UHZAe7nuR6fByffgJUc="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/plymouth-kcm-6.7.1.tar.xz",
+    "hash": "sha256-JL/chn4wxcVMr2Rvrwj4Z48o+znyIZK0G5Mh947eK4Q="
   },
   "polkit-kde-agent-1": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/polkit-kde-agent-1-6.7.0.tar.xz",
-    "hash": "sha256-Dyf/KqNhBBhiDEKAS5w9wi9peeXAOCL5OXnUT77R2r8="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/polkit-kde-agent-1-6.7.1.tar.xz",
+    "hash": "sha256-GvLysrM+GDhOsSDHQi9tKP88eFWzOpiOF3fe5ILWeKc="
   },
   "powerdevil": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/powerdevil-6.7.0.tar.xz",
-    "hash": "sha256-djXv/9UD542SvMAwM9VoHlFXfskrxtpy8qsoKLsKNNs="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/powerdevil-6.7.1.tar.xz",
+    "hash": "sha256-+oJiQSf5Umf2lGdhClfDy6Vi+gZzBSsv9/nbfwU9nlo="
   },
   "print-manager": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/print-manager-6.7.0.tar.xz",
-    "hash": "sha256-v3tqkw7cG4Ped65YV0O9pOGjpYKt5tICovuiYWrcpbM="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/print-manager-6.7.1.tar.xz",
+    "hash": "sha256-Y7vr7t7UX96tDDtw/IFm+zrSHderKpfNzTeo2qO0xCk="
   },
   "qqc2-breeze-style": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/qqc2-breeze-style-6.7.0.tar.xz",
-    "hash": "sha256-gfsPQ/4VwrzRxi50LKuoTWCk65OAwLzsRHtbdyjin7s="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/qqc2-breeze-style-6.7.1.tar.xz",
+    "hash": "sha256-C9N/SlZblK7HwuZ3kjpwVRuVNXj1tQwUvW9Em3SawhI="
   },
   "sddm-kcm": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/sddm-kcm-6.7.0.tar.xz",
-    "hash": "sha256-A7Heo6c4BIoGRjO57bgCcWAE9GMLP2p/Bo/QdNcZ700="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/sddm-kcm-6.7.1.tar.xz",
+    "hash": "sha256-vwpEdfaE59XMOQ4AX+PRvyXbwP+ko0gUtqnhdIWWxx4="
   },
   "spacebar": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/spacebar-6.7.0.tar.xz",
-    "hash": "sha256-XwtcSkDFHaPKxaXWg6uDq/2KNX5FkXYmjs7RWPAxSIU="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/spacebar-6.7.1.tar.xz",
+    "hash": "sha256-A+UTHgSbS8PKMxTAQ38esjscDWZBHtjdNtM+Q+Dl3uo="
   },
   "spectacle": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/spectacle-6.7.0.tar.xz",
-    "hash": "sha256-Sw5J3iGyGP9fEwLQzebgZyC8RSQ5bIUA02zWRMnVDGQ="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/spectacle-6.7.1.tar.xz",
+    "hash": "sha256-gp9kCwn5VJkpqymaUOgt4QldcQ6bjGdFU1zmp56qJG0="
   },
   "systemsettings": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/systemsettings-6.7.0.tar.xz",
-    "hash": "sha256-WfJKRQRrZp0awW+A7ngyPrbxchMKusMcbWXPYfBfp58="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/systemsettings-6.7.1.tar.xz",
+    "hash": "sha256-6ZlBGNFnAL8jO6/Le4LxKfiI9BZJjajKowysjX7oG0I="
   },
   "union": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/union-6.7.0.tar.xz",
-    "hash": "sha256-0JJd9wpnQiRuadl3btE508UuPDzNtoaT66vKLE6M9Fk="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/union-6.7.1.tar.xz",
+    "hash": "sha256-sAJVMeS9e2qF3xSmebS4N8DhGzxZv0yNCqwxp9ipdTM="
   },
   "wacomtablet": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/wacomtablet-6.7.0.tar.xz",
-    "hash": "sha256-4lBGcIom7JKbkTYcPYZAgu3m/toDgrcSntOKl1SiwKw="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/wacomtablet-6.7.1.tar.xz",
+    "hash": "sha256-Fy6qVwNjDX93fYNKBU8fBeMS8LJwNrcIwnT/f194D5A="
   },
   "xdg-desktop-portal-kde": {
-    "version": "6.7.0",
-    "url": "mirror://kde/stable/plasma/6.7.0/xdg-desktop-portal-kde-6.7.0.tar.xz",
-    "hash": "sha256-9a/Ab5SLc7KgED2e5uV3RKmISj8uCBCAd3bsS/cQKto="
+    "version": "6.7.1",
+    "url": "mirror://kde/stable/plasma/6.7.1/xdg-desktop-portal-kde-6.7.1.tar.xz",
+    "hash": "sha256-C5BKsknt9HkaPfXICqQhVVE1eNqMoslQLfqp3sHoSos="
   }
 }
\ No newline at end of file
diff --git a/pkgs/kde/plasma/plasma-login-manager/kwin-path.patch b/pkgs/kde/plasma/plasma-login-manager/kwin-path.patch
index 360884d1e30b..6c214eac534f 100644
--- a/pkgs/kde/plasma/plasma-login-manager/kwin-path.patch
+++ b/pkgs/kde/plasma/plasma-login-manager/kwin-path.patch
@@ -4,6 +4,7 @@
  PartOf=graphical-session.target
  
  [Service]
+ Environment="KWIN_USE_OVERLAYS=0"
 -ExecStart=@CMAKE_INSTALL_FULL_BINDIR@/kwin_wayland --no-lockscreen --no-global-shortcuts --no-kactivities --inputmethod plasma-keyboard --locale1
 +ExecStart=@kwin_wayland@ --no-lockscreen --no-global-shortcuts --no-kactivities --inputmethod plasma-keyboard --locale1
  SuccessExitStatus=15
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 8913bb36c421..c2157ed3316c 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -2261,6 +2261,8 @@ let
 
         webmachine = callPackage ../development/ocaml-modules/webmachine { };
 
+        windtrap = callPackage ../development/ocaml-modules/windtrap { };
+
         wtf8 = callPackage ../development/ocaml-modules/wtf8 { };
 
         ### X ###
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 094ddce8cfab..83f0e6b08cdb 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2144,6 +2144,8 @@ self: super: with self; {
 
   blake3 = callPackage ../development/python-modules/blake3 { };
 
+  blasthttp = callPackage ../development/python-modules/blasthttp { };
+
   ble-serial = callPackage ../development/python-modules/ble-serial { };
 
   bleach = callPackage ../development/python-modules/bleach { };