diff --git a/nixos/modules/services/networking/wpa_supplicant.nix b/nixos/modules/services/networking/wpa_supplicant.nix
index 18142b939d90..e64139047577 100644
--- a/nixos/modules/services/networking/wpa_supplicant.nix
+++ b/nixos/modules/services/networking/wpa_supplicant.nix
@@ -128,7 +128,7 @@ let
           ]
           ++ lib.optionals cfg.userControlled [
             # set up client sockets directory
-            "+${pkgs.coreutils}/bin/mkdir /run/wpa_supplicant/client"
+            "+${pkgs.coreutils}/bin/mkdir -p /run/wpa_supplicant/client"
             "+${pkgs.coreutils}/bin/chown wpa_supplicant:wpa_supplicant /run/wpa_supplicant/client"
             "+${pkgs.coreutils}/bin/chmod g=u /run/wpa_supplicant/client"
           ];
diff --git a/nixos/modules/services/security/opensnitch.nix b/nixos/modules/services/security/opensnitch.nix
index bffe17a948d1..0631d0a1863b 100644
--- a/nixos/modules/services/security/opensnitch.nix
+++ b/nixos/modules/services/security/opensnitch.nix
@@ -13,6 +13,7 @@ let
       file = pkgs.writeText "rule" (builtins.toJSON cfg);
     }
   );
+  stateDir = lib.strings.match "/var/lib/([^/]+)/.+" cfg.settings.Rules.Path;
 in
 {
   options = {
@@ -105,10 +106,9 @@ in
                 "iptables"
                 "nftables"
               ];
-              default = if config.networking.nftables.enable then "nftables" else "iptables";
-              defaultText = lib.literalExpression ''if config.networking.nftables.enable then "nftables" else "iptables"'';
+              default = "nftables";
               description = ''
-                Which firewall backend to use.
+                Which firewall backend to use. `nftables` ruleset can be used for `iptables` firewall too, if `iptables` is built with nftables compatibility.
               '';
             };
             Ebpf.ModulesPath = lib.mkOption {
@@ -139,7 +139,10 @@ in
             };
 
             Rules.Path = lib.mkOption {
-              type = lib.types.path;
+              type = lib.types.pathWith {
+                inStore = false;
+                absolute = true;
+              };
               default = "/var/lib/opensnitch/rules";
               description = ''
                 Path to the directory where firewall rules can be found and will
@@ -158,6 +161,12 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = stateDir != null;
+        message = "`config.services.opensnitch.settings.Rules.Path` must be a sub-directory of /var/lib/, currently is ${cfg.settings.Rules.Path}";
+      }
+    ];
 
     security.auditd = lib.mkIf (cfg.settings.ProcMonitorMethod == "audit") {
       enable = true;
@@ -174,8 +183,14 @@ in
             ""
             "${lib.getExe' cfg.package "opensnitchd"} --config-file ${cfg.configFile}"
           ];
+          StateDirectory = builtins.head stateDir; # match produces a list. Null case covered by assertion.
         };
-        preStart = lib.mkIf (cfg.rules != { }) (
+        preStart = ''
+          # assert rules directory exists before service starts
+          # will be in StateDirectory due to assertion
+          mkdir -p ${cfg.settings.Rules.Path}
+        ''
+        + lib.optionalString (cfg.rules != { }) (
           let
             rules = lib.flip lib.mapAttrsToList predefinedRules (
               file: content: {
@@ -205,13 +220,12 @@ in
           ''
         );
       };
-      tmpfiles.rules = [
-        "d ${cfg.settings.Rules.Path} 0750 root root - -"
-        "L+ /etc/opensnitchd/network_aliases.json - - - - ${cfg.package}/etc/opensnitchd/network_aliases.json"
-        "L+ /etc/opensnitchd/system-fw.json - - - - ${cfg.package}/etc/opensnitchd/system-fw.json"
-      ];
     };
 
+    environment.etc."opensnitchd/network_aliases.json".source =
+      "${cfg.package}/etc/opensnitchd/network_aliases.json";
+    environment.etc."opensnitchd/system-fw.json".source =
+      "${cfg.package}/etc/opensnitchd/system-fw.json";
   };
 
   meta.maintainers = with lib.maintainers; [
diff --git a/nixos/modules/services/web-apps/lauti.nix b/nixos/modules/services/web-apps/lauti.nix
index 1da419604b5e..f1d424e7fa05 100644
--- a/nixos/modules/services/web-apps/lauti.nix
+++ b/nixos/modules/services/web-apps/lauti.nix
@@ -72,7 +72,7 @@ in
         ExecStart = lib.getExe pkgs.lauti;
         WorkingDirectory = cfg.dataDir;
         StateDirectory = default;
-        EnvironmentFile = [ cfg.secrets ];
+        EnvironmentFile = cfg.secrets;
 
         # hardening
         AmbientCapabilities = "";
diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index 4fe5ed1e56c0..8d2817c23bf0 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -1307,6 +1307,8 @@ in
       serviceConfig = {
         Type = "oneshot";
         RemainAfterExit = true;
+        User = lib.mkIf (config.nix.daemonUser != "root") config.nix.daemonUser;
+        Group = lib.mkIf (config.nix.daemonGroup != "root") config.nix.daemonGroup;
       };
       script = ''
         if [[ "$(cat /proc/cmdline)" =~ regInfo=([^ ]*) ]]; then
diff --git a/nixos/tests/opensnitch.nix b/nixos/tests/opensnitch.nix
index cde4ae6efc17..f1a152cbf607 100644
--- a/nixos/tests/opensnitch.nix
+++ b/nixos/tests/opensnitch.nix
@@ -1,17 +1,23 @@
 { pkgs, lib, ... }:
 let
+  # opensnitch ebpf seems to handle non-x86 syscalls incorrectly
+  test_ebpf = pkgs.stdenv.hostPlatform.isx86;
+
   monitorMethods = [
-    "ebpf"
     "proc"
     "ftrace"
     "audit"
-  ];
+  ]
+  ++ lib.optional test_ebpf "ebpf";
 in
 {
   name = "opensnitch";
 
   meta = with pkgs.lib.maintainers; {
-    maintainers = [ onny ];
+    maintainers = [
+      onny
+      grimmauld
+    ];
   };
 
   nodes = {
@@ -88,13 +94,13 @@ in
     lib.concatLines (
       map (m: ''
         client_blocked_${m}.wait_for_unit("opensnitchd.service")
-        client_blocked_${m}.fail("curl http://server")
+        client_blocked_${m}.fail("curl --connect-timeout 3 http://server")
 
         client_allowed_${m}.wait_for_unit("opensnitchd.service")
-        client_allowed_${m}.succeed("curl http://server")
+        client_allowed_${m}.succeed("curl --connect-timeout 3 http://server")
       '') monitorMethods
     )
-    + ''
+    + lib.optionalString test_ebpf ''
       # make sure the kernel modules were actually properly loaded
       client_blocked_ebpf.succeed(r"journalctl -u opensnitchd --grep '\[eBPF\] module loaded: /nix/store/.*/etc/opensnitchd/opensnitch\.o'")
       client_blocked_ebpf.succeed(r"journalctl -u opensnitchd --grep '\[eBPF\] module loaded: /nix/store/.*/etc/opensnitchd/opensnitch-procs\.o'")
diff --git a/nixos/tests/wpa_supplicant.nix b/nixos/tests/wpa_supplicant.nix
index 88b727ad4a69..02fdc6bb5b00 100644
--- a/nixos/tests/wpa_supplicant.nix
+++ b/nixos/tests/wpa_supplicant.nix
@@ -283,18 +283,22 @@ in
         enable = lib.mkOverride 0 true;
         userControlled = true;
         allowAuxiliaryImperativeNetworks = true;
-        interfaces = [ "wlan1" ];
+        interfaces = [
+          "wlan0"
+          "wlan1"
+        ];
       };
     };
 
     testScript = ''
       wpa_cli = "sudo -u alice -g wpa_supplicant wpa_cli"
 
-      with subtest("Daemon is running and accepting connections"):
-          machine.wait_for_unit("wpa_supplicant-wlan1.service")
-          status = machine.wait_until_succeeds(f"{wpa_cli} -i wlan1 status")
-          assert "Failed to connect" not in status, \
-                 "Failed to connect to the daemon"
+      with subtest("Daemons are running and accepting connections"):
+          for iface in ["wlan0", "wlan1"]:
+            machine.wait_for_unit(f"wpa_supplicant-{iface}.service")
+            status = machine.wait_until_succeeds(f"{wpa_cli} -i {iface} status")
+            assert "Failed to connect" not in status, \
+                   f"Failed to connect to the daemon for {iface}"
 
       with subtest("Daemon can be configured imperatively"):
           machine.succeed(f"{wpa_cli} -i wlan1 add_network")
diff --git a/pkgs/applications/editors/jetbrains/ides/webstorm.nix b/pkgs/applications/editors/jetbrains/ides/webstorm.nix
index a193754670dd..637302db7639 100644
--- a/pkgs/applications/editors/jetbrains/ides/webstorm.nix
+++ b/pkgs/applications/editors/jetbrains/ides/webstorm.nix
@@ -12,20 +12,20 @@ let
   # update-script-start: urls
   urls = {
     x86_64-linux = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.2.tar.gz";
-      hash = "sha256-xoMOLYSuWqWUh5RLI1Q4OnAgGM6tqRDWd1VoULX17yE=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3.tar.gz";
+      hash = "sha256-lryIoVxoytyDyfgjnobQ3e94wIIohmIKL88fwf2I49w=";
     };
     aarch64-linux = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.2-aarch64.tar.gz";
-      hash = "sha256-Qe9yclQj971jK8V2SL5GAlNpgUfTwP/PS2ILv2LyhuE=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3-aarch64.tar.gz";
+      hash = "sha256-oZQaxpVV0O4WlDE6Ia+KzHIF0SfWQBubBFIopSRMbvE=";
     };
     x86_64-darwin = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.2.dmg";
-      hash = "sha256-DmsOaBjKnhbipSrIfbTqNd9+qcd2i3zkKfVvLK1GXbI=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3.dmg";
+      hash = "sha256-KUcQRWYUD/+4HHWnkGuqoltqL2an0WQkUEfUcttwjCI=";
     };
     aarch64-darwin = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.2-aarch64.dmg";
-      hash = "sha256-2YyCHi7yPXnq5KWkqC+Uodnc4xj+DkTsL1vUNqLNmPg=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3-aarch64.dmg";
+      hash = "sha256-1N1RtN1QLvuJ1QL8jbN5TdbOHAHSN84W9XEK2PEPijI=";
     };
   };
   # update-script-end: urls
@@ -39,8 +39,8 @@ mkJetBrainsProduct {
   product = "WebStorm";
 
   # update-script-start: version
-  version = "2026.1.2";
-  buildNumber = "261.24374.125";
+  version = "2026.1.3";
+  buildNumber = "261.25134.101";
   # update-script-end: version
 
   src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 4b8d9e495fb3..cb398d86be57 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -45,11 +45,11 @@
     "vendorHash": "sha256-5IfYhOEhXRpdL7G3Op9a0Ep14el2gwcVmRMkGB7oWH4="
   },
   "aliyun_alicloud": {
-    "hash": "sha256-YmfHL9uCtbxKE1wdacn9gf4Jo85/ivCkxOtMuBQin0I=",
+    "hash": "sha256-dIMlk/ZKIJjrkAk0EGCz3UTZvjbEltWq879331EEMD0=",
     "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
     "owner": "aliyun",
     "repo": "terraform-provider-alicloud",
-    "rev": "v1.279.0",
+    "rev": "v1.281.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-lBD9ifRpUwg45V7zZG3grHvndG0V42oiX68zgcM7t74="
   },
diff --git a/pkgs/by-name/al/all-the-package-names/package.nix b/pkgs/by-name/al/all-the-package-names/package.nix
index d498ceaa639c..ea0089621d8b 100644
--- a/pkgs/by-name/al/all-the-package-names/package.nix
+++ b/pkgs/by-name/al/all-the-package-names/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "all-the-package-names";
-  version = "2.0.2460";
+  version = "2.0.2469";
 
   src = fetchFromGitHub {
     owner = "nice-registry";
     repo = "all-the-package-names";
     tag = "v${version}";
-    hash = "sha256-Sp2I3rukIzvXibd00TqlvuqlZnRGdQNsCiDSv+e38Xc=";
+    hash = "sha256-niA8ruXOnYXrjJcciwtl1oYTuYze7ii78XxBviTJ4LE=";
   };
 
-  npmDepsHash = "sha256-IHpFhf09+477yvfvoSpzs9WAY8djEXThrM3yUhhNrBQ=";
+  npmDepsHash = "sha256-DXm6gsQltoqo7A2rRwRO6d7XtlHVf1hotAZ1BYvOqSA=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/au/audacious-bare/package.nix b/pkgs/by-name/au/audacious-bare/package.nix
index d2584c1af00e..5d7a2a6d7d77 100644
--- a/pkgs/by-name/au/audacious-bare/package.nix
+++ b/pkgs/by-name/au/audacious-bare/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "audacious";
-  version = "4.6";
+  version = "4.6.1";
 
   src = fetchFromGitHub {
     owner = "audacious-media-player";
     repo = "audacious";
     rev = "${pname}-${version}";
-    hash = "sha256-TKzsAroCbeTI2dJdAWJYI/0ocroc1L8CC8ciepfEVMc=";
+    hash = "sha256-f1ugxM57dYDDq/G+16bXs6++KXnaLwT+mcPY0R371tY=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/au/autobrr/package.nix b/pkgs/by-name/au/autobrr/package.nix
index da4840c2c606..9881bb6ee8bf 100644
--- a/pkgs/by-name/au/autobrr/package.nix
+++ b/pkgs/by-name/au/autobrr/package.nix
@@ -16,12 +16,12 @@
 
 let
   pname = "autobrr";
-  version = "1.79.0";
+  version = "1.80.0";
   src = fetchFromGitHub {
     owner = "autobrr";
     repo = "autobrr";
     tag = "v${version}";
-    hash = "sha256-grwXIDN+dYuWaArB76N3xJEVwYlrzopYZJQ+eXRwOY4=";
+    hash = "sha256-LWnax0/BNPDZeaH+KG1Fi8qrAvHhr1Oo8XNQWkO5pvM=";
   };
 
   autobrr-web = stdenvNoCC.mkDerivation {
diff --git a/pkgs/by-name/ba/basedpyright/package.nix b/pkgs/by-name/ba/basedpyright/package.nix
index 49fdb388ae4f..4196aae7a9ee 100644
--- a/pkgs/by-name/ba/basedpyright/package.nix
+++ b/pkgs/by-name/ba/basedpyright/package.nix
@@ -18,16 +18,16 @@
 
 buildNpmPackage rec {
   pname = "basedpyright";
-  version = "1.39.3";
+  version = "1.39.7";
 
   src = fetchFromGitHub {
     owner = "detachhead";
     repo = "basedpyright";
     tag = "v${version}";
-    hash = "sha256-80RQO0UwDA9ZxIGQ0/8WaEj9QlqrQ4g7m9+WJDZrZbI=";
+    hash = "sha256-E4TR5deuPSf2YinrEzpP79Rq8zZHLJQUKiEsfUdMDOE=";
   };
 
-  npmDepsHash = "sha256-jut63CiYGTNIP27wYCPZnE/Ab90EWJnVkx58Oy3uo9o=";
+  npmDepsHash = "sha256-humpJB+fv3+PITcPCz3uY2jNANb3P7sXy0lFP8Eg58I=";
   npmWorkspace = "packages/pyright";
 
   preBuild = ''
diff --git a/pkgs/by-name/ca/cargo-fuzz/package.nix b/pkgs/by-name/ca/cargo-fuzz/package.nix
index 6cd374aff03a..86dc7bd078a5 100644
--- a/pkgs/by-name/ca/cargo-fuzz/package.nix
+++ b/pkgs/by-name/ca/cargo-fuzz/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-fuzz";
-  version = "0.13.1";
+  version = "0.13.2";
 
   src = fetchFromGitHub {
     owner = "rust-fuzz";
     repo = "cargo-fuzz";
     tag = finalAttrs.version;
-    hash = "sha256-wOzzPhAuCaJfp7uRZ1kPpzMIr03couRaIbbrjL0EyYo=";
+    hash = "sha256-DIvbxyIkmrxcFOpH0iZJGxJB60Bh5sjZX+kYUxpp/iQ=";
   };
 
-  cargoHash = "sha256-7HCdWkjIycVKZty760ZnLBtLOZ3gwPhwseIqxqf8xPQ=";
+  cargoHash = "sha256-7P3bii0Y0hf3z9RCPIH6uClFIw/CTtUSzbTbaZNQkYQ=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/ca/cargo-update/package.nix b/pkgs/by-name/ca/cargo-update/package.nix
index 2ace34600749..c06c8718e1bc 100644
--- a/pkgs/by-name/ca/cargo-update/package.nix
+++ b/pkgs/by-name/ca/cargo-update/package.nix
@@ -16,14 +16,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-update";
-  version = "20.0.0";
+  version = "20.0.1";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-J/FujtsQF8WfHFoHJ3r2M+vv8WVh4cxDFw07JntnW2g=";
+    hash = "sha256-wV1R95TBPLXzCmE9sjztxJdvwvWxedEQPI5TxZEGUqA=";
   };
 
-  cargoHash = "sha256-bH8Mg7QQbbXlF7fxwWEFYmYQD1CmDM+g4GhFPZwLy/M=";
+  cargoHash = "sha256-LsqDwGboCPGrRmpFqy13anszrwE8+VoqRqfm5K3VgM8=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/ch/chromium-xorg-conf/package.nix b/pkgs/by-name/ch/chromium-xorg-conf/package.nix
deleted file mode 100644
index d9608650ed9d..000000000000
--- a/pkgs/by-name/ch/chromium-xorg-conf/package.nix
+++ /dev/null
@@ -1,8 +0,0 @@
-{ fetchFromGitiles }:
-
-fetchFromGitiles {
-  name = "chromium-xorg-conf";
-  url = "https://chromium.googlesource.com/chromiumos/platform/xorg-conf";
-  rev = "26fb9d57e195c7e467616b35b17e2b5d279c1514";
-  sha256 = "0643y3l3hjk4mv4lm3h9z56h990q6k11hcr10lcqppgsii0d3zcf";
-}
diff --git a/pkgs/by-name/co/conan/package.nix b/pkgs/by-name/co/conan/package.nix
index 8d0bcbd356d2..3ca24edfab1e 100644
--- a/pkgs/by-name/co/conan/package.nix
+++ b/pkgs/by-name/co/conan/package.nix
@@ -99,6 +99,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
     "test_xcrun"
     "test_xcrun_in_required_by_tool_requires"
     "test_xcrun_in_tool_requires"
+    # Requires gcc to run
+    "test_qbsprofile_rcflags"
   ];
 
   disabledTestPaths = [
diff --git a/pkgs/by-name/de/decent-sampler/package.nix b/pkgs/by-name/de/decent-sampler/package.nix
index 7ebace9899e1..7026c890da24 100644
--- a/pkgs/by-name/de/decent-sampler/package.nix
+++ b/pkgs/by-name/de/decent-sampler/package.nix
@@ -4,6 +4,7 @@
   fetchzip,
   fetchurl,
   makeDesktopItem,
+  autoPatchelfHook,
   copyDesktopItems,
   buildFHSEnv,
   alsa-lib,
@@ -32,7 +33,15 @@ let
       hash = "sha256-wL9L4I2iw9r3r69TOr37XXEs3iECMuNGX9Ez63P/f8w=";
     };
 
-    nativeBuildInputs = [ copyDesktopItems ];
+    nativeBuildInputs = [
+      autoPatchelfHook
+      copyDesktopItems
+    ];
+
+    buildInputs = [
+      alsa-lib
+      expat
+    ];
 
     desktopItems = [
       (makeDesktopItem {
@@ -67,13 +76,11 @@ buildFHSEnv {
   inherit (decent-sampler) pname version;
 
   targetPkgs = pkgs: [
-    alsa-lib
     alsa-plugins
     decent-sampler
     freetype
     nghttp2
     libx11
-    expat
   ];
 
   runScript = "decent-sampler";
diff --git a/pkgs/by-name/de/deltachat-desktop/package.nix b/pkgs/by-name/de/deltachat-desktop/package.nix
index d65168a448be..dbcc517399ae 100644
--- a/pkgs/by-name/de/deltachat-desktop/package.nix
+++ b/pkgs/by-name/de/deltachat-desktop/package.nix
@@ -22,38 +22,38 @@
 
 let
   deltachat-rpc-server' = deltachat-rpc-server.overrideAttrs rec {
-    version = "2.51.0";
+    version = "2.52.0";
     src = fetchFromGitHub {
       owner = "chatmail";
       repo = "core";
       tag = "v${version}";
-      hash = "sha256-OXazjp3w4NxbcTUNsyeU46erbdj27n1I7dvt+Io/AZ0=";
+      hash = "sha256-AQo27qnHPCK6q/3+Umk6ueqkOIVBA8n4q9S5iEZ7TkM=";
     };
     cargoDeps = rustPlatform.fetchCargoVendor {
       pname = "chatmail-core";
       inherit version src;
-      hash = "sha256-gt//65v9PF2nnX/zkZGU9hm73lfzOTmw36rbkWu9VX0=";
+      hash = "sha256-ni8iaVPHXWhxfiBvtVzGRyPcxkbV0HiqcQCHGmAqk7s=";
     };
   };
   electron = electron_41;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "deltachat-desktop";
-  version = "2.51.0";
+  version = "2.52.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-desktop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ORp8lZcHzswrSCe30cGKpZdyqZCcvqLgu2hwvadMHN0=";
+    hash = "sha256-/FdGI6Dr9lz0+g/xSzHXbMdqWHf4TliHDXXiAQKKkOs=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 4;
-    hash = "sha256-BSDeOkT75usLmXdAY8QNO+9YxxchrJH2gjFpTzErPXo=";
+    hash = "sha256-0VvyZzWAdVGsuYb8CI36KqkqvjgRsTLJov1L44MxUHQ=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/de/deltachat-tauri/package.nix b/pkgs/by-name/de/deltachat-tauri/package.nix
index 5e8f206a9a70..f812683ceae5 100644
--- a/pkgs/by-name/de/deltachat-tauri/package.nix
+++ b/pkgs/by-name/de/deltachat-tauri/package.nix
@@ -35,7 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ;
   __structuredAttrs = true;
 
-  cargoHash = "sha256-JhsoIQZrU4GVcs/TCIug6y/84gODyEWl0Bl2jRNxL5Y=";
+  cargoHash = "sha256-euRUA4LTmAdb9466DAMqKgAPX3N4KNXCh1ED9cL42lA=";
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
     substituteInPlace $cargoDepsCopy/*/libappindicator-sys-*/src/lib.rs \
diff --git a/pkgs/by-name/du/dusklight/package.nix b/pkgs/by-name/du/dusklight/package.nix
index 2b5da6952115..f078fcfce3b2 100644
--- a/pkgs/by-name/du/dusklight/package.nix
+++ b/pkgs/by-name/du/dusklight/package.nix
@@ -26,6 +26,7 @@
   makeWrapper,
   ninja,
   nlohmann_json,
+  nodtool,
   pkg-config,
   python3,
   sdl3,
@@ -40,19 +41,25 @@ let
   auroraSrc = fetchFromGitHub {
     owner = "encounter";
     repo = "aurora";
-    rev = "10006618ee493f248b8597e4dfa1d2871d76a1d9";
-    hash = "sha256-lY2xuVyB7aPJ9+2wwLRB3F5U/BuPSxdSpegdG+qNd9o=";
-  };
-  dawnSrc = fetchzip {
-    url = "https://github.com/encounter/dawn-build/releases/download/v20260423.175430/dawn-linux-x86_64.tar.gz";
-    hash = "sha256-HXfKTLHtMPwupnFnaflCARtXVPuS/0PoCePXidjE5xs=";
-    stripRoot = false;
-  };
-  nodSrc = fetchzip {
-    url = "https://github.com/encounter/nod/releases/download/v2.0.0-alpha.8/libnod-linux-x86_64.tar.gz";
-    hash = "sha256-mUqvLsbsqaZ+HAjMmHYPYO+MgtanGRTw7Gzn5uXR5rE=";
-    stripRoot = false;
+    rev = "cb2c340d6cde6827387f14c31ce19e5f28a40e09";
+    hash = "sha256-fiAe5DChCFeakI3pga/g0tXd27osnhQtMBQchuP2NwQ=";
   };
+  dawnSrc = fetchzip (
+    {
+      x86_64-linux = {
+        url = "https://github.com/encounter/dawn-build/releases/download/v20260523.201736/dawn-linux-x86_64.tar.gz";
+        hash = "sha256-KkdlSeiaw2gbQa+phZOpgbequshxQaFITzFdiuGBZvc=";
+      };
+      aarch64-linux = {
+        url = "https://github.com/encounter/dawn-build/releases/download/v20260523.201736/dawn-linux-aarch64.tar.gz";
+        hash = "sha256-accDTIBzgByQ8Rk2a1dAm85s8hj9SYI7NoHkih0vvAg=";
+      };
+    }
+    .${stdenv.hostPlatform.system}
+    // {
+      stripRoot = false;
+    }
+  );
   imguiSrc = fetchFromGitHub {
     owner = "ocornut";
     repo = "imgui";
@@ -70,13 +77,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "dusklight";
-  version = "1.2.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "TwilitRealm";
     repo = "dusklight";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-a5nCri4XTpnotJY9qRrKTJ8cb9L6cfGKPXmvbbj/1fQ=";
+    hash = "sha256-TarPuCE6bjn4nGtHU54pE2gAo/dIgTyghWn7hjdFFgk=";
   };
 
   strictDeps = true;
@@ -111,6 +118,7 @@ stdenv.mkDerivation (finalAttrs: {
     libxscrnsaver
     libxtst
     nlohmann_json
+    nodtool
     sdl3
     tracy
     vulkan-loader
@@ -138,14 +146,14 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_XXHASH" xxhash.src.outPath)
     (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_FMT" fmt.src.outPath)
     (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_TRACY" tracy.src.outPath)
-    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_NOD_PREBUILT" nodSrc.outPath)
     (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_FREETYPE" freetype.src.outPath)
     (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_ZSTD" zstd.src.outPath)
     (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_SQLITE3" sqliteSrc.outPath)
     (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_IMGUI" imguiSrc.outPath)
     (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_RMLUI" rmluiSrc.outPath)
     (lib.cmakeFeature "AURORA_SDL3_PROVIDER" "system")
-    (lib.cmakeFeature "AURORA_NOD_PROVIDER" "package")
+    (lib.cmakeFeature "AURORA_NOD_PROVIDER" "system")
+    (lib.cmakeFeature "AURORA_NOD_LINKAGE" "static")
     (lib.cmakeBool "CMAKE_CROSSCOMPILING" true)
     (lib.cmakeBool "DUSK_ENABLE_SENTRY_NATIVE" false)
   ];
@@ -159,16 +167,13 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s ../share/dusklight/dusklight   $out/bin/dusklight
 
     install -Dm644 \
-      ../platforms/freedesktop/dusklight.desktop \
-      $out/share/applications/dusklight.desktop
-
-    substituteInPlace $out/share/applications/dusklight.desktop \
-      --replace-fail "Icon=dusklight" "Icon=dev.twilitrealm.dusklight"
+      ../platforms/freedesktop/dev.twilitrealm.dusk.desktop \
+      $out/share/applications/dev.twilitrealm.dusk.desktop
 
     for size in 16x16 32x32 48x48 64x64 128x128 256x256 512x512 1024x1024; do
       install -Dm644 \
-        ../platforms/freedesktop/$size/apps/dusklight.png \
-        $out/share/icons/hicolor/$size/apps/dev.twilitrealm.dusklight.png
+        ../platforms/freedesktop/$size/apps/dev.twilitrealm.dusk.png \
+        $out/share/icons/hicolor/$size/apps/dev.twilitrealm.dusk.png
     done
 
     runHook postInstall
@@ -193,7 +198,7 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/TwilitRealm/dusklight/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.cc0;
     mainProgram = "dusklight";
-    platforms = [ "x86_64-linux" ];
+    platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ liberodark ];
   };
 })
diff --git a/pkgs/by-name/et/ethercat/kernel-module.nix b/pkgs/by-name/et/ethercat/kernel-module.nix
new file mode 100644
index 000000000000..8586e273ae02
--- /dev/null
+++ b/pkgs/by-name/et/ethercat/kernel-module.nix
@@ -0,0 +1,70 @@
+ethercat:
+{
+  lib,
+  stdenv,
+  kernelModuleMakeFlags,
+  kernel,
+}:
+let
+  # Aside from a generic drivers there are special drivers for specific NICs
+  # (for example r8139, r8169, e100, e1000, e1000e) which are only available
+  # for these kernel versions
+  extraSupportedKernel = lib.elem (lib.versions.majorMinor kernel.version) [
+    "5.10"
+    "5.14"
+    "5.15"
+    "6.1"
+    "6.4"
+    "6.12"
+  ];
+in
+stdenv.mkDerivation {
+  pname = "ethercat";
+  version = "${kernel.version}-${ethercat.version}";
+
+  __structuredAttrs = true;
+
+  enableParallelBuilding = true;
+
+  inherit (ethercat) src;
+
+  nativeBuildInputs = kernel.moduleBuildDependencies ++ ethercat.nativeBuildInputs;
+
+  configureFlags = [
+    "--with-linux-dir=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "--enable-userlib=no"
+    "--enable-tool=no"
+    "--enable-kernel=yes"
+    "--enable-ccat=yes"
+  ]
+  ++ lib.optionals extraSupportedKernel [
+    "--enable-e100=yes"
+    "--enable-e1000=yes"
+    "--enable-e1000e=yes"
+    "--enable-r8169=yes"
+    "--enable-igb=yes"
+  ]
+  ++ lib.optionals (extraSupportedKernel && lib.versionAtLeast kernel.version "5.14") [
+    "--enable-igc=yes"
+  ];
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+  ];
+
+  buildFlags = [ "modules" ];
+
+  installTargets = [ "modules_install" ];
+
+  meta = {
+    description = ethercat.meta.description + " - kernel modules";
+
+    inherit (ethercat.meta)
+      homepage
+      changelog
+      license
+      maintainers
+      platforms
+      ;
+  };
+}
diff --git a/pkgs/by-name/et/ethercat/package.nix b/pkgs/by-name/et/ethercat/package.nix
index b0734d3a7745..b87dc7c2224e 100644
--- a/pkgs/by-name/et/ethercat/package.nix
+++ b/pkgs/by-name/et/ethercat/package.nix
@@ -29,14 +29,23 @@ stdenv.mkDerivation (finalAttrs: {
     "--enable-kernel=no"
   ];
 
-  passthru.updateScript = gitUpdater { };
+  passthru = {
+    kernelModule = import ./kernel-module.nix finalAttrs.finalPackage;
+    updateScript = gitUpdater { };
+  };
 
   meta = {
     description = "IgH EtherCAT Master for Linux";
     homepage = "https://etherlab.org/ethercat";
     changelog = "https://gitlab.com/etherlab.org/ethercat/-/blob/${finalAttrs.version}/NEWS";
-    license = lib.licenses.gpl2Plus;
-    maintainers = with lib.maintainers; [ stv0g ];
+    license = with lib.licenses; [
+      gpl2Only
+      lgpl21Only
+    ];
+    maintainers = with lib.maintainers; [
+      ninelore
+      stv0g
+    ];
     platforms = [ "x86_64-linux" ];
   };
 })
diff --git a/pkgs/tools/misc/fltrdr/default.nix b/pkgs/by-name/fl/fltrdr/package.nix
similarity index 84%
rename from pkgs/tools/misc/fltrdr/default.nix
rename to pkgs/by-name/fl/fltrdr/package.nix
index 1f5884f4fed8..7716f364b0fa 100644
--- a/pkgs/tools/misc/fltrdr/default.nix
+++ b/pkgs/by-name/fl/fltrdr/package.nix
@@ -3,19 +3,26 @@
   stdenv,
   fetchFromGitHub,
   cmake,
-  icu,
+  icu63,
   openssl,
 }:
 
-stdenv.mkDerivation rec {
+let
+  icu = icu63;
+in
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "fltrdr";
   version = "0.3.1";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     repo = "fltrdr";
     owner = "octobanana";
-    rev = version;
-    sha256 = "1vpci7vqzcpdd21zgigyz38k77r9fc81dmiwsvfr8w7gad5sg6sj";
+    tag = finalAttrs.version;
+    hash = "sha256-UpunS1PvcJTd1jzWFhBzKZ8z0fj+xfeDaO2yj/eJ7O4=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -48,4 +55,4 @@ stdenv.mkDerivation rec {
     maintainers = [ lib.maintainers.matthiasbeyer ];
     mainProgram = "fltrdr";
   };
-}
+})
diff --git a/pkgs/by-name/fo/forgejo/package.nix b/pkgs/by-name/fo/forgejo/package.nix
index 071a5fea9f2e..ad10007e9e99 100644
--- a/pkgs/by-name/fo/forgejo/package.nix
+++ b/pkgs/by-name/fo/forgejo/package.nix
@@ -1,8 +1,8 @@
 import ./generic.nix {
-  version = "15.0.2";
-  hash = "sha256-ba5jog6eXY4TTmBblhfVa2LSLPGE1/HPfslIb30b3kk=";
-  npmDepsHash = "sha256-70w39jbMWpuAsbzBC9oFHaUMwshtFDeTSEOXDgFNPmE=";
-  vendorHash = "sha256-I6bGvXBP2K3+Xx9E9DS/AyG6Ilqf/s8VjfBnCmLUHsk=";
+  version = "15.0.3";
+  hash = "sha256-tGZ83TEG6iyZd5mfSuSvVkmUJINWLN661YpOk1+dgbM=";
+  npmDepsHash = "sha256-BZSYjEsjUqMYWu3EUP+K35hqSOniv8Y6ek5bEC2vTPg=";
+  vendorHash = "sha256-z3YTjt+SM9yPCsJdfSQbTpy3vRiXaFV2QMz1y6J6k/Q=";
   lts = true;
   nixUpdateExtraArgs = [
     "--override-filename"
diff --git a/pkgs/by-name/gh/ghqr/package.nix b/pkgs/by-name/gh/ghqr/package.nix
index cc7878fec125..6c47091a4ed9 100644
--- a/pkgs/by-name/gh/ghqr/package.nix
+++ b/pkgs/by-name/gh/ghqr/package.nix
@@ -10,14 +10,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "ghqr";
-  version = "0.4.2";
+  version = "0.4.3";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "ghqr";
     tag = "v.${finalAttrs.version}";
-    hash = "sha256-goxKU48fWdCQo0Vng0O3gvRFXsDbuWA/03UH1qUbqrw=";
+    hash = "sha256-KKuxl8odNdMom8l524Mac+sM/5ZdtpakLqazZDQcXJs=";
   };
 
   vendorHash = "sha256-la/yXEZzAIt9l0q0P7+N8yCW0BQie9sLmAhLFK1qyGE=";
diff --git a/pkgs/by-name/gi/git-town/package.nix b/pkgs/by-name/gi/git-town/package.nix
index 78fdab8d4277..6c84a4be9e57 100644
--- a/pkgs/by-name/gi/git-town/package.nix
+++ b/pkgs/by-name/gi/git-town/package.nix
@@ -13,13 +13,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "git-town";
-  version = "23.0.1";
+  version = "23.0.2";
 
   src = fetchFromGitHub {
     owner = "git-town";
     repo = "git-town";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kAAzfb0rg10k9PnUKYEqdSWYWi0JR6jiKDHUv/RSUSs=";
+    hash = "sha256-FwwyX/Ncl8zCR1+/A49VIugESU1YFgDcQYbO8w84Lm0=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/gp/gping/package.nix b/pkgs/by-name/gp/gping/package.nix
index 9b32fcd56de5..920dceed657c 100644
--- a/pkgs/by-name/gp/gping/package.nix
+++ b/pkgs/by-name/gp/gping/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   rustPlatform,
   fetchFromGitHub,
+  fetchpatch,
   installShellFiles,
   iputils,
   versionCheckHook,
@@ -22,6 +23,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-F0QBL7tCCdjnavClqrw8yYxFrY8y4f8h/gcHSpEqBiM=";
 
+  patches = [
+    (fetchpatch {
+      name = "fix-ipv6-addrs-by-using-ping-dash-6.patch";
+      # https://github.com/orf/gping/pull/546
+      url = "https://github.com/orf/gping/commit/7ef8e1ddec847681c5ef3d4a010a0ad3a7aebab0.patch";
+      hash = "sha256-b3Nv+mobPUcgREaNvn7cXra24PgEUe60yE/kOPTQEos=";
+    })
+  ];
+
   nativeBuildInputs = [ installShellFiles ];
 
   nativeCheckInputs = lib.optionals stdenv.hostPlatform.isLinux [ iputils ];
diff --git a/pkgs/by-name/in/inxi/package.nix b/pkgs/by-name/in/inxi/package.nix
index edb89c59524d..165ef9de3787 100644
--- a/pkgs/by-name/in/inxi/package.nix
+++ b/pkgs/by-name/in/inxi/package.nix
@@ -109,7 +109,9 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://codeberg.org/smxi/inxi/src/tag/${finalAttrs.version}/inxi.changelog";
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.unix;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      nick-linux
+    ];
     mainProgram = "inxi";
   };
 })
diff --git a/pkgs/by-name/it/it-tools/package.nix b/pkgs/by-name/it/it-tools/package.nix
index 860c50322e23..c07a1b76ee6e 100644
--- a/pkgs/by-name/it/it-tools/package.nix
+++ b/pkgs/by-name/it/it-tools/package.nix
@@ -3,36 +3,36 @@
   lib,
   fetchFromGitHub,
   nodejs,
-  pnpm_8,
+  pnpm_11,
   fetchPnpmDeps,
   pnpmConfigHook,
 }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "it-tools";
-  version = "2024.10.22-7ca5933";
+  version = "0-unstable-2026-02-12";
 
   src = fetchFromGitHub {
     owner = "CorentinTh";
     repo = "it-tools";
-    rev = "v${version}";
-    hash = "sha256-SQAZv+9tINRH10lewcuv8G2qwfulLOP8sGjX47LxeUk=";
+    rev = "d505845f918e946ec300af7b36efc107e2f66e9e";
+    hash = "sha256-dWVRiLbJ1X4yHT5yRcq+KaHmjjtc24yQg0jQvWTPNwU=";
   };
 
   nativeBuildInputs = [
     nodejs
     pnpmConfigHook
-    pnpm_8
+    pnpm_11
   ];
 
   pnpmDeps = fetchPnpmDeps {
-    inherit
+    inherit (finalAttrs)
       pname
       version
       src
       ;
-    pnpm = pnpm_8;
-    fetcherVersion = 3;
-    hash = "sha256-dsjf2TyLAqPzR8OXJgNcoOdDZj2t+H+tLfRhfPsu1G8=";
+    pnpm = pnpm_11;
+    fetcherVersion = 4;
+    hash = "sha256-ju8YO0IHIGJtCi5TnxvfLUXcTqKWnTBKAGFBhzQJTok=";
   };
 
   buildPhase = ''
@@ -58,4 +58,4 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ akotro ];
   };
-}
+})
diff --git a/pkgs/by-name/iv/ivpn-service/package.nix b/pkgs/by-name/iv/ivpn-service/package.nix
index e62ed995af50..f318607f304c 100644
--- a/pkgs/by-name/iv/ivpn-service/package.nix
+++ b/pkgs/by-name/iv/ivpn-service/package.nix
@@ -13,13 +13,16 @@
   iptables,
   gawk,
   util-linux,
-  nix-update-script,
+  liboqs,
 }:
 buildGoModule (finalAttrs: {
   pname = "ivpn-service";
   version = "3.15.6";
 
-  buildInputs = [ wirelesstools ];
+  buildInputs = [
+    wirelesstools
+    (finalAttrs.passthru.liboqs)
+  ];
   nativeBuildInputs = [ makeWrapper ];
 
   src = fetchFromGitHub {
@@ -62,7 +65,9 @@ buildGoModule (finalAttrs: {
       --replace-fail 'dnscryptproxyBinPath = path.Join(installDir, "dnscrypt-proxy/dnscrypt-proxy")' \
       'dnscryptproxyBinPath = "${dnscrypt-proxy}/bin/dnscrypt-proxy"' \
       --replace-fail 'v2rayBinaryPath = path.Join(installDir, "v2ray/v2ray")' \
-      'v2rayBinaryPath = "${v2ray}/bin/v2ray"'
+      'v2rayBinaryPath = "${v2ray}/bin/v2ray"' \
+      --replace-fail 'kemHelperBinaryPath = path.Join(installDir, "kem/kem-helper")' \
+      'kemHelperBinaryPath = "${placeholder "out"}/bin/kem-helper"'
   '';
 
   ldflags = [
@@ -72,8 +77,17 @@ buildGoModule (finalAttrs: {
     "-X github.com/ivpn/desktop-app/daemon/version._time=1970-01-01"
   ];
 
+  postBuild = ''
+    $CC -O2 -pthread \
+        References/common/kem-helper/main.c \
+        References/common/kem-helper/base64.c \
+        -loqs -Wl,-z,stack-size=5242880 \
+        -o kem-helper
+  '';
+
   postInstall = ''
     mv $out/bin/{daemon,ivpn-service}
+    install -Dm755 kem-helper $out/bin/kem-helper
   '';
 
   postFixup = ''
@@ -94,7 +108,34 @@ buildGoModule (finalAttrs: {
       }
   '';
 
-  passthru.updateScript = nix-update-script { };
+  # IVPN pins this to an older incompatible version, so we vendor it at that
+  # Lives in passthru so end-users can override it
+  passthru.liboqs = liboqs.overrideAttrs (
+    final: prev: {
+      version = "0.10.0";
+      src = fetchFromGitHub {
+        owner = "open-quantum-safe";
+        repo = "liboqs";
+        tag = "${final.version}";
+        hash = "sha256-BFDa5NUr02lFPcT4Hnb2rjGAi+2cXvh1SHLfqX/zLlI=";
+      };
+      # the main derivations patches don't apply onto the older version
+      patches = [ ];
+      # manually do what the main derivations pkg-config patch does (unbreak invalid path)
+      postPatch = ''
+        substituteInPlace src/liboqs.pc.in \
+          --replace-fail 'libdir=''${prefix}/@CMAKE_INSTALL_LIBDIR@' \
+          'libdir=@CMAKE_INSTALL_FULL_LIBDIR@' \
+          --replace-fail 'includedir=''${prefix}/@CMAKE_INSTALL_INCLUDEDIR@' \
+          'includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@'
+      '';
+      # This matches IVPNs build script at $src/daemon/References/common/kem-helper/build.sh
+      cmakeFlags = (prev.cmakeFlags or [ ]) ++ [
+        "-DOQS_USE_OPENSSL=OFF"
+        "-DOQS_MINIMAL_BUILD=KEM_kyber_1024;KEM_classic_mceliece_348864"
+      ];
+    }
+  );
 
   meta = {
     description = "Official IVPN Desktop app service daemon";
diff --git a/pkgs/by-name/la/ladybugdb/package.nix b/pkgs/by-name/la/ladybugdb/package.nix
index 6e859eeb85bf..46aaf1b950dc 100644
--- a/pkgs/by-name/la/ladybugdb/package.nix
+++ b/pkgs/by-name/la/ladybugdb/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ladybugdb";
-  version = "0.17.0";
+  version = "0.17.1";
 
   src = fetchFromGitHub {
     owner = "LadybugDB";
     repo = "ladybug";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-58Wx3QtDS1PSLjuyZ36u3Tq7kiQj+zFxfsMiCJyDUU4=";
+    hash = "sha256-3d0gsSLkO5Np6P4l8AEfEPvzMlkf2wYMCluAtDrwEDc=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/la/lammps/package.nix b/pkgs/by-name/la/lammps/package.nix
index 66715d1eeaf5..40ed6f08f348 100644
--- a/pkgs/by-name/la/lammps/package.nix
+++ b/pkgs/by-name/la/lammps/package.nix
@@ -52,10 +52,13 @@ stdenv.mkDerivation (finalAttrs: {
   version = "22Jul2025_update4";
   pname = "lammps";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src = fetchFromGitHub {
     owner = "lammps";
     repo = "lammps";
-    rev = "stable_${finalAttrs.version}";
+    tag = "stable_${finalAttrs.version}";
     hash = "sha256-QH63nh7J3NjfdfpN7J96Q+9ZGqj8cA0YwEmgTuBbGmg=";
   };
   preConfigure = ''
@@ -67,7 +70,8 @@ stdenv.mkDerivation (finalAttrs: {
     # Although not always needed, it is needed if cmakeFlags include
     # GPU_API=cuda, and it doesn't users that don't enable the GPU package.
     autoAddDriverRunpath
-  ];
+  ]
+  ++ lib.optionals packages.PYTHON [ python3 ];
 
   passthru = {
     inherit packages;
diff --git a/pkgs/by-name/mu/mullvad-vpn/package.nix b/pkgs/by-name/mu/mullvad-vpn/package.nix
index 58dd314a2d96..60e664cdb4b5 100644
--- a/pkgs/by-name/mu/mullvad-vpn/package.nix
+++ b/pkgs/by-name/mu/mullvad-vpn/package.nix
@@ -40,6 +40,7 @@
   makeWrapper,
   coreutils,
   gnugrep,
+  iproute2,
 
   versionCheckHook,
 }:
@@ -119,6 +120,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   runtimeDependencies = [
     (lib.getLib systemd)
+    iproute2
     libGL
     libnotify
     libappindicator
diff --git a/pkgs/by-name/my/mympd/package.nix b/pkgs/by-name/my/mympd/package.nix
index 1b763464df01..2346dc0e24f8 100644
--- a/pkgs/by-name/my/mympd/package.nix
+++ b/pkgs/by-name/my/mympd/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mympd";
-  version = "25.1.0";
+  version = "25.1.1";
 
   src = fetchFromGitHub {
     owner = "jcorporation";
     repo = "myMPD";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-YX9nN4NxD/NrkTlVSxUrQ1ur67Rk2hfM9ZXDjnpoLGk=";
+    sha256 = "sha256-ckGFwnykpmA753bAoCX8ftUEZuxtFlyGTamn4cgK3+A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/n8/n8n/package.nix b/pkgs/by-name/n8/n8n/package.nix
index 8a3b39bf0c54..f7027b35b302 100644
--- a/pkgs/by-name/n8/n8n/package.nix
+++ b/pkgs/by-name/n8/n8n/package.nix
@@ -26,20 +26,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "n8n";
-  version = "2.22.5";
+  version = "2.23.4";
 
   src = fetchFromGitHub {
     owner = "n8n-io";
     repo = "n8n";
     tag = "n8n@${finalAttrs.version}";
-    hash = "sha256-YF6VJLA+y8pcAE3RwTub1XjPVfeh8cR+3TQqb3VvV5U=";
+    hash = "sha256-0LROPZKLKEKHBgV0kWAfataZB2nMzdsmq1WImCA6bgA=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-lAe3GuZRdzEwOXWmpBtF7YfGvA4XJumLf80uDYS6j30=";
+    hash = "sha256-oqnLywIOhAZr7nmeGvq6k0brcGjHRhR3pVvBQK3Fg0k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ni/nickel/package.nix b/pkgs/by-name/ni/nickel/package.nix
index ba654f95e6c8..becfec74d3fd 100644
--- a/pkgs/by-name/ni/nickel/package.nix
+++ b/pkgs/by-name/ni/nickel/package.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nickel";
-  version = "1.16.0";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "nickel-lang";
     repo = "nickel";
     tag = finalAttrs.version;
-    hash = "sha256-G+ik4tMr+WsDpiEFYv80ruBR/SpeEg9agUWqgXrq7UI=";
+    hash = "sha256-D+OI00Ouwm0v65igIYSCGPXKCl6/SZsOyz1wFM1VAF4=";
   };
 
-  cargoHash = "sha256-E3UBkLxd7AC/Pk1Zgy+KvHTPXgATqIr7lZXPB8vlSWs=";
+  cargoHash = "sha256-hIeTHajL+h6xhuje8TmfgkkM9R+tGwYFzlnSwaN3nK8=";
 
   cargoBuildFlags = [
     "--package"
diff --git a/pkgs/by-name/no/nodtool/package.nix b/pkgs/by-name/no/nodtool/package.nix
new file mode 100644
index 000000000000..1d6e554e48c2
--- /dev/null
+++ b/pkgs/by-name/no/nodtool/package.nix
@@ -0,0 +1,97 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  rustPlatform,
+  cmake,
+  git,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "nodtool";
+  version = "2.0.0-alpha.9";
+
+  src = fetchFromGitHub {
+    owner = "encounter";
+    repo = "nod";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-beWw+OgF4zCepv/7NQiwXOA8qMwMb8Z3C6icywT+Jr0=";
+  };
+
+  cargoHash = "sha256-+B7mjiCtuxPQ/zSMy8Lw6r5aGB+PVxhRES6zJhD5NAE=";
+
+  nativeBuildInputs = [
+    cmake
+    git
+  ];
+
+  cargoBuildFlags = [
+    "-p"
+    "nodtool"
+    "-p"
+    "nod-ffi"
+  ];
+
+  cargoTestFlags = [
+    "-p"
+    "nodtool"
+    "-p"
+    "nod-ffi"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    releaseDir="target/${stdenv.hostPlatform.config}/release"
+
+    install -Dm755 $releaseDir/nodtool -t $out/bin/
+    install -Dm755 $releaseDir/libnod${stdenv.hostPlatform.extensions.sharedLibrary} -t $out/lib/
+    install -Dm644 $releaseDir/libnod.a -t $out/lib/
+    install -Dm644 nod-ffi/include/nod.h -t $out/include/
+
+    cat > gen-cmake-config.cmake <<'EOF'
+    include(CMakePackageConfigHelpers)
+    set(CMAKE_INSTALL_LIBDIR lib)
+    set(CMAKE_INSTALL_INCLUDEDIR include)
+    set(CMAKE_INSTALL_BINDIR bin)
+    configure_package_config_file("''${NOD_SOURCE_DIR}/cmake/nodConfig.cmake.in" "''${CMAKE_INSTALL_PREFIX}/lib/cmake/nod/nodConfig.cmake" INSTALL_DESTINATION lib/cmake/nod)
+    write_basic_package_version_file("''${CMAKE_INSTALL_PREFIX}/lib/cmake/nod/nodConfigVersion.cmake" VERSION "''${NOD_VERSION}" COMPATIBILITY AnyNewerVersion)
+    EOF
+
+    cmake \
+      ${lib.cmakeFeature "NOD_SOURCE_DIR" "$PWD"} \
+      ${lib.cmakeFeature "CMAKE_INSTALL_PREFIX" "$out"} \
+      ${lib.cmakeFeature "NOD_VERSION" "2.0.0"} \
+      -P gen-cmake-config.cmake
+
+    runHook postInstall
+  '';
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "GameCube/Wii disc image CLI tool and C library";
+    homepage = "https://github.com/encounter/nod";
+    changelog = "https://github.com/encounter/nod/releases/tag/v${finalAttrs.version}";
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    maintainers = with lib.maintainers; [ liberodark ];
+    platforms = lib.platforms.linux;
+    mainProgram = "nodtool";
+  };
+})
diff --git a/pkgs/by-name/pl/playwright-mcp/package.nix b/pkgs/by-name/pl/playwright-mcp/package.nix
index 2f045c3588bd..8fc87b78605f 100644
--- a/pkgs/by-name/pl/playwright-mcp/package.nix
+++ b/pkgs/by-name/pl/playwright-mcp/package.nix
@@ -2,40 +2,34 @@
   lib,
   buildNpmPackage,
   fetchFromGitHub,
+  makeWrapper,
   playwright-driver,
   playwright-test,
 }:
 buildNpmPackage rec {
   pname = "playwright-mcp";
-  version = "0.0.69";
+  version = "0.0.74";
 
   src = fetchFromGitHub {
     owner = "Microsoft";
     repo = "playwright-mcp";
     tag = "v${version}";
-    hash = "sha256-zX9RsHVInRib69N4LkG3R4TB5qjlBirpu9BBftcr92I=";
+    hash = "sha256-dGYZTBPNszVtxvYWTIF77dDm9elGvcLwbn+yG/lfR68=";
   };
 
-  npmDepsHash = "sha256-hc5AkUTGoXxXlDW9vPpiO23QOgANJp1lX4xoaySHoK4=";
+  npmDepsHash = "sha256-IgoflKLyY4plURB++N4YSzqfG4Y7aGSUvND+WiHYiQo=";
 
-  npmWorkspace = "packages/playwright-mcp";
+  nativeBuildInputs = [ makeWrapper ];
 
   # Codex MCP smoke test (after `codex mcp add playwright-nix --env DISPLAY=:0 -- $out/bin/playwright-mcp --headless --isolated`):
   # timeout 45s codex exec --dangerously-bypass-approvals-and-sandbox --skip-git-repo-check "Use only playwright-nix MCP tools. Navigate to https://example.com and return only the page title."
   postInstall = ''
-    pkg_dir="$out/lib/node_modules/playwright-mcp-internal"
+    pkg_dir="$out/lib/node_modules/@playwright/mcp"
     rm -rf "$pkg_dir/node_modules/playwright"
     rm -rf "$pkg_dir/node_modules/playwright-core"
     ln -s ${playwright-test}/lib/node_modules/playwright "$pkg_dir/node_modules/playwright"
     ln -s ${playwright-test}/lib/node_modules/playwright-core "$pkg_dir/node_modules/playwright-core"
 
-    # Workspace symlinks point to a packages/ tree that npmInstallHook does not
-    # ship; npm hoisted the workspace contents directly into playwright-mcp-internal.
-    rm "$pkg_dir/node_modules/@playwright/mcp"
-    rm "$pkg_dir/node_modules/@playwright/mcp-extension"
-    rm "$pkg_dir/node_modules/playwright-cli"
-    rm "$pkg_dir/node_modules/.bin/playwright-mcp"
-
     wrapProgram $out/bin/playwright-mcp \
       --set PLAYWRIGHT_BROWSERS_PATH ${playwright-driver.browsers} \
       --set-default PLAYWRIGHT_MCP_BROWSER chromium
diff --git a/pkgs/by-name/po/pocket-id/package.nix b/pkgs/by-name/po/pocket-id/package.nix
index 5df33e8d77c7..b1daf150ee17 100644
--- a/pkgs/by-name/po/pocket-id/package.nix
+++ b/pkgs/by-name/po/pocket-id/package.nix
@@ -13,18 +13,18 @@
 }:
 buildGo126Module (finalAttrs: {
   pname = "pocket-id";
-  version = "2.7.0";
+  version = "2.8.0";
 
   src = fetchFromGitHub {
     owner = "pocket-id";
     repo = "pocket-id";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rWU1jldmdtXDcHrFty/Pmll1xFUQnLFF12j833M05rQ=";
+    hash = "sha256-mUBCX2FP/ieDCeqQwtAFmR3dKr8P5bGv8K3+f9ULhZM=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/backend";
 
-  vendorHash = "sha256-nr9L7FVUQYzn+bLtvqKGsYydVCjW/fl53Od9lzRv8gk=";
+  vendorHash = "sha256-QJyy39v4+4+hJO14p6QjgUeHs3t5EXuqCHM/d91jKsM=";
 
   env.CGO_ENABLED = 0;
   ldflags = [
@@ -65,7 +65,7 @@ buildGo126Module (finalAttrs: {
       inherit (finalAttrs) pname version src;
       pnpm = pnpm_10;
       fetcherVersion = 3;
-      hash = "sha256-DVNzFFHMMasKEx+adAhisE32qtirBhJlfMHKrOVl1dM=";
+      hash = "sha256-vohVXJWPQA/29ntx4hY1eTDHuTGx5UuYymQH02Ufd/Y=";
     };
 
     env.BUILD_OUTPUT_PATH = "dist";
diff --git a/pkgs/by-name/po/podofo/package.nix b/pkgs/by-name/po/podofo/package.nix
index bf635ab9b383..b0bcfa976dfc 100644
--- a/pkgs/by-name/po/podofo/package.nix
+++ b/pkgs/by-name/po/podofo/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "podofo";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "podofo";
     repo = "podofo";
     rev = finalAttrs.version;
-    hash = "sha256-gzkIMyGV3nmOrGX2PDLrA9NHbtAwk74vcyrQ+yc5TOw=";
+    hash = "sha256-y+3nOynd0xJRF14XA1oK2smL6irCfaFrJ8rvxJS6b8M=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/po/poezio/package.nix b/pkgs/by-name/po/poezio/package.nix
index 78a64d62ee49..834cd4ea8701 100644
--- a/pkgs/by-name/po/poezio/package.nix
+++ b/pkgs/by-name/po/poezio/package.nix
@@ -8,14 +8,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "poezio";
-  version = "0.16";
+  version = "0.18";
   pyproject = true;
 
   src = fetchFromCodeberg {
     owner = "poezio";
     repo = "poezio";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-bpudgf9oZ+7w7izAuWYKFVO9CIHraHaGvRKLDuSIF7c=";
+    hash = "sha256-/QGxJrWK8Sl+t8SBsU8ZAMU/5pR+daf7Q43jczzENmw=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/by-name/re/resterm/package.nix b/pkgs/by-name/re/resterm/package.nix
index 76e510f4737d..9204f07b18c4 100644
--- a/pkgs/by-name/re/resterm/package.nix
+++ b/pkgs/by-name/re/resterm/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "resterm";
-  version = "0.41.1";
+  version = "0.42.1";
 
   src = fetchFromGitHub {
     owner = "unkn0wn-root";
     repo = "resterm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PSWgbq1aV+9AEhAXL3gZGKh6BzKc5CxufLTp80T0Tno=";
+    hash = "sha256-NyUSV5vsksr9LgwcN6f4f+1ol3304l0SalHzRI9R5mQ=";
   };
 
   vendorHash = "sha256-AjckKD6NScBa8w9nWMdVExuNadz3vHnK854XXg3nj84=";
diff --git a/pkgs/by-name/rs/rs-lxmf/package.nix b/pkgs/by-name/rs/rs-lxmf/package.nix
new file mode 100644
index 000000000000..5de637e44fb5
--- /dev/null
+++ b/pkgs/by-name/rs/rs-lxmf/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  rs-reticulum,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "rs-lxmf";
+  version = "0.9.2";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "ratspeak";
+    repo = "rsLXMF";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-jba/uiQQUO3MdmF2+6AOtdbUXYW43yqplRFUGujN0Oo=";
+  };
+
+  postPatch = ''
+    for crate in rns-crypto rns-wire rns-identity rns-link rns-protocol rns-transport rns-runtime rns-interface; do
+      substituteInPlace Cargo.toml \
+        --replace-fail "../rsReticulum/crates/$crate" "${rs-reticulum.src}/crates/$crate"
+    done
+  '';
+
+  cargoHash = "sha256-ReWw16r9cYIEzilzSsFXYap9ZGhk1mrUVl/bKkQMcVA=";
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Rust implementation of LXMF for Reticulum";
+    homepage = "https://github.com/ratspeak/rsLXMF";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ drupol ];
+    mainProgram = "lxmd-rs";
+  };
+})
diff --git a/pkgs/by-name/sq/sqlx-cli/package.nix b/pkgs/by-name/sq/sqlx-cli/package.nix
index 4278543242fb..d5e08028a73b 100644
--- a/pkgs/by-name/sq/sqlx-cli/package.nix
+++ b/pkgs/by-name/sq/sqlx-cli/package.nix
@@ -2,7 +2,7 @@
   stdenv,
   lib,
   rustPlatform,
-  fetchFromGitHub,
+  fetchCrate,
   installShellFiles,
   pkg-config,
   openssl,
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sqlx-cli";
-  version = "0.8.6";
+  version = "0.9.0";
 
-  src = fetchFromGitHub {
-    owner = "launchbadge";
-    repo = "sqlx";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-Trnyrc17KWhX8QizKyBvXhTM7HHEqtywWgNqvQNMOAY=";
+  # Upstream stopped shipping a Cargo.lock starting with the v0.9.0 release
+  # https://github.com/transact-rs/sqlx/blob/v0.9.0/CHANGELOG.md#cargolock-removed-from-tracking
+  src = fetchCrate {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-XariusjsCgn0Qai0XWtr7EzSzDDTp1cCzjff1kJNO9Y=";
   };
 
-  cargoHash = "sha256-FxvzCe+dRfMUcPWA4lp4L6FJaSpMiXTqEyhzk+Dv1B8=";
+  cargoHash = "sha256-pHaMKuB9v3fjbgeVyLyRtfoQ9BkE6z+TjDfdBaVdbXM=";
 
   buildNoDefaultFeatures = true;
   buildFeatures = [
@@ -32,11 +32,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "sqlite"
     "mysql"
     "completions"
+    "sqlx-toml"
   ];
 
-  doCheck = false;
-  cargoBuildFlags = [ "--package sqlx-cli" ];
-
   nativeBuildInputs = [
     installShellFiles
     pkg-config
@@ -66,7 +64,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   meta = {
     description = "CLI for managing databases, migrations, and enabling offline mode with `sqlx::query!()` and friends";
-    homepage = "https://github.com/launchbadge/sqlx";
+    homepage = "https://github.com/transact-rs/sqlx";
+    changelog = "https://github.com/transact-rs/sqlx/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       greizgh
diff --git a/pkgs/by-name/st/step-cli/package.nix b/pkgs/by-name/st/step-cli/package.nix
index 8bf97e43bb39..07744e43c5e4 100644
--- a/pkgs/by-name/st/step-cli/package.nix
+++ b/pkgs/by-name/st/step-cli/package.nix
@@ -8,7 +8,7 @@
   unixtools,
 }:
 let
-  version = "0.30.2";
+  version = "0.30.4";
 in
 buildGoModule {
   pname = "step-cli";
@@ -18,7 +18,7 @@ buildGoModule {
     owner = "smallstep";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-xhkgPBPMxphlwTQiGPmvC8sQWCoepga3v6LVzHgh5zE=";
+    hash = "sha256-ToM+RzpioI+TlljlptYY0jnKGNdITzJ/xeWf4azhT/4=";
     # this file change depending on git branch status (via .gitattributes)
     # https://github.com/NixOS/nixpkgs/issues/84312
     postFetch = ''
@@ -39,7 +39,7 @@ buildGoModule {
     patchShebangs integration/openssl-jwt.sh
   '';
 
-  vendorHash = "sha256-SnU2jkHZNhn8zS9S/2/MiZRtBV0sVy28n+BJY6RpCag=";
+  vendorHash = "sha256-DTFp9K5iiS50QuD2knN/8miYb2k/7O1d3GyEf79i69Q=";
 
   nativeBuildInputs = [ installShellFiles ];
   nativeCheckInputs = [
diff --git a/pkgs/by-name/vi/victoriametrics/package.nix b/pkgs/by-name/vi/victoriametrics/package.nix
index 3c091d8e69b8..710d39a63429 100644
--- a/pkgs/by-name/vi/victoriametrics/package.nix
+++ b/pkgs/by-name/vi/victoriametrics/package.nix
@@ -14,13 +14,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "VictoriaMetrics";
-  version = "1.144.0";
+  version = "1.145.0";
 
   src = fetchFromGitHub {
     owner = "VictoriaMetrics";
     repo = "VictoriaMetrics";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-K8RCFHVL+E8w0webp6Bg3dma7I32iGXx9gCKnFp4d0g=";
+    hash = "sha256-nKG2ei1Gn1mU5TtD5YLYUHaJrM4fSxm/uUdY4tIGeVE=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/vt/vtsls/package.nix b/pkgs/by-name/vt/vtsls/package.nix
index 7cd84da104b5..7fac88f81b36 100644
--- a/pkgs/by-name/vt/vtsls/package.nix
+++ b/pkgs/by-name/vt/vtsls/package.nix
@@ -5,23 +5,25 @@
   nodejs-slim_22,
   gitMinimal,
   gitSetupHook,
-  pnpm_8,
+  pnpm_11,
   fetchPnpmDeps,
   pnpmConfigHook,
   nix-update-script,
+  vtsls,
+  runCommand,
 }:
 let
-  pnpm' = pnpm_8.override { nodejs-slim = nodejs-slim_22; };
+  pnpm' = pnpm_11.override { nodejs-slim = nodejs-slim_22; };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "vtsls";
-  version = "0.2.9";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "yioneko";
     repo = "vtsls";
     tag = "server-v${finalAttrs.version}";
-    hash = "sha256-vlw84nigvQqRB9OQBxOmrR9CClU9M4dNgF/nrvGN+sk=";
+    hash = "sha256-RuxaT3u9OOUMbDN6A2biIeUC+Z4leELF3OhKXxmCqbM=";
     fetchSubmodules = true;
   };
 
@@ -36,7 +38,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [ nodejs-slim_22 ];
 
-  pnpmWorkspaces = [ "@vtsls/language-server" ];
+  pnpmWorkspaces = [
+    "@vtsls/language-server"
+    "@vtsls/language-service"
+    "@vtsls/vscode-fuzzy"
+  ];
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs)
@@ -46,8 +52,8 @@ stdenv.mkDerivation (finalAttrs: {
       version
       ;
     pnpm = pnpm';
-    fetcherVersion = 3;
-    hash = "sha256-1P2ph8ZX6/KptkLP4wk0dZzuvnYCLOWorM1b9+otKsE=";
+    fetcherVersion = 4;
+    hash = "sha256-jYh79MtcfW/p6twuDM1JDwukSnn2/TJQYvHBlut0QnE=";
   };
 
   # Patches to get submodule sha from file instead of 'git submodule status'
@@ -90,6 +96,25 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     updateScript = nix-update-script { };
+
+    tests.smoke =
+      runCommand "vtsls-smoke-test"
+        {
+        }
+        ''
+          INIT_REQUEST='{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"processId":null,"rootUri":"file:///tmp","workspaceFolders":[{"uri":"file:///tmp","name":"test"}],"capabilities":{}}}'
+          CONTENT_LENGTH=''${#INIT_REQUEST}
+
+          RESPONSE=$(
+            {
+              printf "Content-Length: %d\r\n\r\n%s" "$CONTENT_LENGTH" "$INIT_REQUEST"
+              sleep 1
+            } | timeout 3  ${lib.getExe vtsls} --stdio 2>&1 | head -c 1000
+          ) || true
+
+          echo "$RESPONSE" | grep -q '"capabilities"'
+          touch $out
+        '';
   };
 
   meta = {
diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index 0274a050606b..ac4a5ef58288 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -28,9 +28,9 @@ let
     "21.1.8".officialRelease.sha256 = "sha256-pgd8g9Yfvp7abjCCKSmIn1smAROjqtfZaJkaUkBSKW0=";
     "22.1.7".officialRelease.sha256 = "sha256-AmozlrL8AAlfr+F7OrJqr3ecd/KhBx5Bngj3SopPdyY=";
     "23.0.0-git".gitRelease = {
-      rev = "0ecf562dac85a29f3de1dd598e3ae0ecc34d1240";
-      rev-version = "23.0.0-unstable-2026-05-31";
-      sha256 = "sha256-9F/X7c3i+eyMhutmG5qvaoWaikOTBI20njDwn5TWCOU=";
+      rev = "47ef7495ad781b742a0c4435ca72590d297ba8bf";
+      rev-version = "23.0.0-unstable-2026-06-07";
+      sha256 = "sha256-5x3wvNti/OCmdam0tUmkiiq/ONn23m4mcTh491hWLVA=";
     };
   }
   // llvmVersions;
diff --git a/pkgs/development/python-modules/githubkit/default.nix b/pkgs/development/python-modules/githubkit/default.nix
index 6d205f922b7e..e8b3e5f7fe7e 100644
--- a/pkgs/development/python-modules/githubkit/default.nix
+++ b/pkgs/development/python-modules/githubkit/default.nix
@@ -71,6 +71,7 @@ buildPythonPackage rec {
   ];
 
   meta = {
+    broken = true;
     description = "GitHub SDK for Python";
     homepage = "https://github.com/yanyongyu/githubkit";
     changelog = "https://github.com/yanyongyu/githubkit/releases/tag/${src.tag}";
diff --git a/pkgs/development/python-modules/gradient/default.nix b/pkgs/development/python-modules/gradient/default.nix
index a03dd7d1de8a..47af6704df75 100644
--- a/pkgs/development/python-modules/gradient/default.nix
+++ b/pkgs/development/python-modules/gradient/default.nix
@@ -1,83 +1,56 @@
 {
   lib,
-  attrs,
-  boto3,
   buildPythonPackage,
-  click-completion,
-  click-didyoumean,
-  click-help-colors,
-  colorama,
-  fetchPypi,
-  gradient-statsd,
-  gradient-utils,
-  gql,
-  halo,
-  marshmallow,
-  progressbar2,
-  pyopenssl,
-  pyyaml,
-  requests,
-  requests-toolbelt,
-  terminaltables,
-  websocket-client,
+  fetchFromGitHub,
+  hatchling,
+  hatch-fancy-pypi-readme,
+  httpx,
+  pydantic,
+  typing-extensions,
+  anyio,
+  distro,
+  sniffio,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "gradient";
   version = "3.10.1";
-  format = "setuptools";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-TL9Jbo9UvQhgG9aT3wjLD8DvTY48Os04DdaUfNAwcu4=";
+  src = fetchFromGitHub {
+    owner = "digitalocean";
+    repo = "gradient-python";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-Psre4HdF4/cgQ5CcM3H6PC+6asej4Is4+932Gvym774=";
   };
 
   postPatch = ''
-    substituteInPlace setup.py \
-      --replace 'attrs<=' 'attrs>=' \
-      --replace 'colorama==' 'colorama>=' \
-      --replace 'gql[requests]==3.0.0a6' 'gql' \
-      --replace 'PyYAML==5.*' 'PyYAML' \
-      --replace 'marshmallow<' 'marshmallow>=' \
-      --replace 'websocket-client==0.57.*' 'websocket-client'
+    substituteInPlace pyproject.toml \
+      --replace-fail "hatchling==1.26.3" "hatchling"
   '';
 
-  propagatedBuildInputs = [
-    attrs
-    boto3
-    click-completion
-    click-didyoumean
-    click-help-colors
-    colorama
-    gql
-    gradient-statsd
-    gradient-utils
-    halo
-    marshmallow
-    progressbar2
-    pyopenssl
-    pyyaml
-    requests
-    requests-toolbelt
-    terminaltables
-    websocket-client
+  nativeBuildInputs = [
+    hatchling
+    hatch-fancy-pypi-readme
   ];
 
-  # Tries to use /homeless-shelter to mimic container usage, etc
-  doCheck = false;
+  dependencies = [
+    httpx
+    pydantic
+    typing-extensions
+    anyio
+    distro
+    sniffio
+  ];
 
-  # marshmallow.exceptions.StringNotCollectionError: "only" should be a collection of strings.
-  # Support for marshmallow > 3
-  # pythonImportsCheck = [
-  #   "gradient"
-  # ];
+  pythonImportsCheck = [ "gradient" ];
 
   meta = {
-    description = "Command line interface for Gradient";
+    description = "Python API library for Gradient";
     mainProgram = "gradient";
-    homepage = "https://github.com/Paperspace/gradient-cli";
-    license = lib.licenses.isc;
+    homepage = "https://github.com/digitalocean/gradient-python";
+    license = lib.licenses.asl20;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ thoughtpolice ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/langchain-perplexity/default.nix b/pkgs/development/python-modules/langchain-perplexity/default.nix
index 8704e3615b8f..c5d9ca276e18 100644
--- a/pkgs/development/python-modules/langchain-perplexity/default.nix
+++ b/pkgs/development/python-modules/langchain-perplexity/default.nix
@@ -9,6 +9,7 @@
   # dependencies
   langchain-core,
   openai,
+  perplexityai,
 
   # tests
   langchain-tests,
@@ -23,14 +24,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langchain-perplexity";
-  version = "1.1.0";
+  version = "1.3.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-perplexity==${finalAttrs.version}";
-    hash = "sha256-bm7sIa62CIvsYNDdaN+XZKpRnCv5bg9kPZ1Ym8utFcM=";
+    hash = "sha256-XSfnoJaj2VRXSxHHVnRNBvr4Ko7GAqnFEDM90ohaufo=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/partners/perplexity";
@@ -40,6 +41,7 @@ buildPythonPackage (finalAttrs: {
   dependencies = [
     langchain-core
     openai
+    perplexityai
   ];
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/molecule/plugins.nix b/pkgs/development/python-modules/molecule/plugins.nix
index ec41c0710069..6716c01a6091 100644
--- a/pkgs/development/python-modules/molecule/plugins.nix
+++ b/pkgs/development/python-modules/molecule/plugins.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   setuptools-scm,
   python-vagrant,
   docker,
@@ -9,12 +9,14 @@
 
 buildPythonPackage rec {
   pname = "molecule-plugins";
-  version = "23.5.3";
+  version = "25.8.12";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-orFDfVMtc24/vG23pp7FM+IzSyEV/5JFoLJ3LtlzjSM=";
+  src = fetchFromGitHub {
+    owner = "ansible-community";
+    repo = "molecule-plugins";
+    tag = "v${version}";
+    hash = "sha256-wTvJ+cjZMTOyaqqDZsA1wsKCpu2FEi69IBlSTxNs3/M=";
   };
 
   # reverse the dependency
diff --git a/pkgs/development/python-modules/moyopy/default.nix b/pkgs/development/python-modules/moyopy/default.nix
index 1523fe4f4482..91387d6d924c 100644
--- a/pkgs/development/python-modules/moyopy/default.nix
+++ b/pkgs/development/python-modules/moyopy/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "moyopy";
-  version = "0.10.0";
+  version = "0.11.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -24,7 +24,7 @@ buildPythonPackage (finalAttrs: {
     owner = "spglib";
     repo = "moyo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-C1260FQ/V/puPU41LQHxsvvQ3BAabxRKWBCVEm79gp0=";
+    hash = "sha256-PxKY/dhYKdvl2dfrDfsqg46TJ2EFx6Px27u8OddQjiI=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/moyopy";
@@ -47,7 +47,7 @@ buildPythonPackage (finalAttrs: {
       sourceRoot
       cargoRoot
       ;
-    hash = "sha256-M/AWtXfexXbnFHYd6DxxrRSTuejXdt0DVxU/XtT9iPQ=";
+    hash = "sha256-8GNHuRv3neE0xhfLyxw92DvZRUJFrYm7JCi0Bd2KROs=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/perplexityai/default.nix b/pkgs/development/python-modules/perplexityai/default.nix
new file mode 100644
index 000000000000..6f572887e89d
--- /dev/null
+++ b/pkgs/development/python-modules/perplexityai/default.nix
@@ -0,0 +1,102 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  hatch-fancy-pypi-readme,
+  hatchling,
+
+  # dependencies (incl. optional)
+  anyio,
+  distro,
+  httpx,
+  pydantic,
+  sniffio,
+  typing-extensions,
+  aiohttp,
+  httpx-aiohttp,
+
+  # tests
+  pyright,
+  mypy,
+  respx,
+  pytest,
+  pytest-asyncio,
+  ruff,
+  time-machine,
+  nox,
+  dirty-equals,
+  importlib-metadata,
+  rich,
+  pytest-xdist,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "perplexityai";
+  version = "0.38.0";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "perplexityai";
+    repo = "perplexity-py";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Yp5A3aoKtAjWRPZ1Un2OYwezZohWirNm2JhAWLhd6uQ=";
+  };
+
+  # Can't use relaxPythonDeps as this is a version lock in the build system
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail '"hatchling==1.26.3"' '"hatchling"'
+  '';
+
+  build-system = [
+    hatch-fancy-pypi-readme
+    hatchling
+  ];
+
+  dependencies = [
+    anyio
+    distro
+    httpx
+    pydantic
+    sniffio
+    typing-extensions
+  ];
+
+  optional-dependencies = {
+    aiohttp = [
+      aiohttp
+      httpx-aiohttp
+    ];
+  };
+
+  nativeCheckInputs = [
+    pyright
+    mypy
+    respx
+    pytest
+    pytest-asyncio
+    ruff
+    time-machine
+    nox
+    dirty-equals
+    importlib-metadata
+    rich
+    pytest-xdist
+  ]
+  ++ finalAttrs.passthru.optional-dependencies.aiohttp;
+
+  pythonImportsCheck = [
+    "perplexity"
+  ];
+
+  meta = {
+    description = "API for Perplexity AI";
+    homepage = "https://github.com/perplexityai/perplexity-py";
+    changelog = "https://github.com/perplexityai/perplexity-py/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ sarahec ];
+  };
+})
diff --git a/pkgs/development/python-modules/playwright/default.nix b/pkgs/development/python-modules/playwright/default.nix
index 7a9e257d12a4..1994e7775b12 100644
--- a/pkgs/development/python-modules/playwright/default.nix
+++ b/pkgs/development/python-modules/playwright/default.nix
@@ -31,14 +31,14 @@ in
 buildPythonPackage (finalAttrs: {
   pname = "playwright";
   # run ./pkgs/development/web/playwright/update.sh to update
-  version = "1.59.0";
+  version = "1.60.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "playwright-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CbvVSx/KDaX+CZEJRlDd4GUwWejzjTKNyL4+FhgT6qE=";
+    hash = "sha256-gbPWUmELw77Fw5M236et2TjkkGisMVVOJzmgq61/bg0=";
   };
 
   patches = [
@@ -54,11 +54,11 @@ buildPythonPackage (finalAttrs: {
   ];
 
   postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail ', "auditwheel==6.2.0"' "" \
-      --replace-fail "setuptools-scm==8.3.1" "setuptools-scm" \
-      --replace-fail "setuptools==80.9.0" "setuptools" \
-      --replace-fail "wheel==0.45.1" "wheel"
+    # Use sed with a regex instead of substituteInPlace so we don't have to
+    # bump pinned versions on every upstream release. grep -q precheck makes
+    # the build fail loudly if upstream restructures the requires list.
+    grep -q 'requires = \["setuptools==.*", "setuptools-scm==.*", "wheel==.*", "auditwheel==.*"\]' pyproject.toml
+    sed -i -e 's/requires = \["setuptools==.*", "setuptools-scm==.*", "wheel==.*", "auditwheel==.*"\]/requires = ["setuptools", "setuptools-scm", "wheel"]/' pyproject.toml
 
     # setup.py downloads and extracts the driver.
     # This is done manually in postInstall instead.
diff --git a/pkgs/development/python-modules/slixmpp/default.nix b/pkgs/development/python-modules/slixmpp/default.nix
index f27793fb8349..6bf6b5f3e624 100644
--- a/pkgs/development/python-modules/slixmpp/default.nix
+++ b/pkgs/development/python-modules/slixmpp/default.nix
@@ -20,16 +20,16 @@
   setuptools-scm,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "slixmpp";
-  version = "1.13.2";
+  version = "1.16.0";
   pyproject = true;
 
   src = fetchFromCodeberg {
     owner = "poezio";
     repo = "slixmpp";
-    tag = "slix-${version}";
-    hash = "sha256-hjM1OIFYpHV5SSN32858pyuwOvaAA0tFZWCZI+5n9u4=";
+    tag = "slix-${finalAttrs.version}";
+    hash = "sha256-d0laQWaqZUoviF7NM/egENQ3ArQE12ER0TzfPBcnc7Q=";
   };
 
   patches = [
@@ -71,7 +71,10 @@ buildPythonPackage rec {
     safer-xml-parsing = [ defusedxml ];
   };
 
-  nativeCheckInputs = [ pytestCheckHook ] ++ lib.concatAttrValues optional-dependencies;
+  nativeCheckInputs = [
+    pytestCheckHook
+  ]
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
 
   preCheck = ''
     # don't test against pure python version in the source tree
@@ -90,8 +93,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python library for XMPP";
     homepage = "https://slixmpp.readthedocs.io/";
-    changelog = "https://codeberg.org/poezio/slixmpp/releases/tag/${src.tag}";
+    changelog = "https://codeberg.org/poezio/slixmpp/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/veryprettytable/default.nix b/pkgs/development/python-modules/veryprettytable/default.nix
index 596bb2b30a35..ddfcf2ea545d 100644
--- a/pkgs/development/python-modules/veryprettytable/default.nix
+++ b/pkgs/development/python-modules/veryprettytable/default.nix
@@ -4,26 +4,31 @@
   fetchPypi,
   termcolor,
   colorama,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "veryprettytable";
   version = "0.8.1";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    sha256 = "1k1rifz8x6qcicmx2is9vgxcj0qb2f5pvzrp7zhmvbmci3yack3f";
+    inherit (finalAttrs) pname version;
+    hash = "sha256-bkym/Iisrl3hPzf/fYsTCwPJ+ttJR9Eriwybjr6LOcw=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     termcolor
     colorama
   ];
 
+  pythonImportsCheck = [ "veryprettytable" ];
+
   meta = {
     description = "Simple Python library for easily displaying tabular data in a visually appealing ASCII table format";
     homepage = "https://github.com/smeggingsmegger/VeryPrettyTable";
     license = lib.licenses.free;
   };
-}
+})
diff --git a/pkgs/development/web/playwright/browsers.json b/pkgs/development/web/playwright/browsers.json
index 4ed4747f928b..cd90b574e67b 100644
--- a/pkgs/development/web/playwright/browsers.json
+++ b/pkgs/development/web/playwright/browsers.json
@@ -2,22 +2,22 @@
   "comment": "This file is kept up to date via update.sh",
   "browsers": {
     "chromium": {
-      "revision": "1217",
-      "browserVersion": "147.0.7727.15",
+      "revision": "1223",
+      "browserVersion": "148.0.7778.96",
       "title": "Chrome for Testing"
     },
     "chromium-headless-shell": {
-      "revision": "1217",
-      "browserVersion": "147.0.7727.15",
+      "revision": "1223",
+      "browserVersion": "148.0.7778.96",
       "title": "Chrome Headless Shell"
     },
     "firefox": {
-      "revision": "1511",
-      "browserVersion": "148.0.2",
+      "revision": "1522",
+      "browserVersion": "150.0.2",
       "title": "Firefox"
     },
     "webkit": {
-      "revision": "2272",
+      "revision": "2287",
       "revisionOverrides": {
         "mac14": "2251",
         "mac14-arm64": "2251",
diff --git a/pkgs/development/web/playwright/chromium-headless-shell.nix b/pkgs/development/web/playwright/chromium-headless-shell.nix
index 13ef53743adf..961de4c81b3a 100644
--- a/pkgs/development/web/playwright/chromium-headless-shell.nix
+++ b/pkgs/development/web/playwright/chromium-headless-shell.nix
@@ -36,8 +36,8 @@ let
       inherit (download) url stripRoot;
       hash =
         {
-          x86_64-linux = "sha256-kQCw0nQHHuUIfn8rGVcN7Ip6ZOk5c3Or+GG5RvSica4=";
-          aarch64-linux = "sha256-s2IIjSY5t9AtT05dUS0mp4fPlaixND9+Cg0+0S8Kkx8=";
+          x86_64-linux = "sha256-Nr0/uczFTBTqvRPR0c/wflIqG5relgKfC9XsMOdE9iE=";
+          aarch64-linux = "sha256-veEBmsivFDrG1bArQ780+gMbsoT1Zv4VLcIPpgn4M/I=";
         }
         .${system} or throwSystem;
     };
@@ -72,8 +72,8 @@ let
     inherit (download) url stripRoot;
     hash =
       {
-        x86_64-darwin = "sha256-kzbLpzzMpBurQHyGaz561A0K46GzgWPP2JSQKRV6C+Y=";
-        aarch64-darwin = "sha256-67ekk37uq5ITq9ZvwPTZhhqEgQY17g/3KJ/vnqZz3h0=";
+        x86_64-darwin = "sha256-GEomMUuaIjhBEuWF/HyMohseJtwKOn5MCgh6kIB9ZeE=";
+        aarch64-darwin = "sha256-7laJtPAiy6pYAxCNBxRYk+FmriXemmLW8UYteEdVrd0=";
       }
       .${system} or throwSystem;
   };
diff --git a/pkgs/development/web/playwright/chromium.nix b/pkgs/development/web/playwright/chromium.nix
index d1fb44b11cac..9b39a8322050 100644
--- a/pkgs/development/web/playwright/chromium.nix
+++ b/pkgs/development/web/playwright/chromium.nix
@@ -63,8 +63,8 @@ let
       inherit (download) url stripRoot;
       hash =
         {
-          x86_64-linux = "sha256-GtaJk9Qr1bTbDfpB+noGlLcIDEIS2uzDiV5rb2DZhVQ=";
-          aarch64-linux = "sha256-jsesQ6juzMPQzmn0Ygb8hmpxCeLHJVBL89qto5yuh5s=";
+          x86_64-linux = "sha256-TnplS4C/PPcmyWrMCqWh7c1KrpevHJFKO0gfh46M3tk=";
+          aarch64-linux = "sha256-E7Nmz9fET0kXNf7ooaUBDHtDBWTGq4JDKKUbo/UfA+c=";
         }
         .${system} or throwSystem;
     };
@@ -130,8 +130,8 @@ let
     inherit (download) url stripRoot;
     hash =
       {
-        x86_64-darwin = "sha256-CxnLSe+sZYskO7H5f3cA+BlWCZsFOPpp1gVG5s37r80=";
-        aarch64-darwin = "sha256-n3JLK+hJwzPihC2qSHrSCYPz3jonZNz7GMgXiPBLaS0=";
+        x86_64-darwin = "sha256-W6xH9iX81H+o689LZvJZO7tF79V0Gv7AksUwflPuQ8A=";
+        aarch64-darwin = "sha256-T0rVp4M/ymrJtNVtF0RDmIOT6kC3/tRkzPYrwvFbEQY=";
       }
       .${system} or throwSystem;
   };
diff --git a/pkgs/development/web/playwright/driver.nix b/pkgs/development/web/playwright/driver.nix
index b850961b161d..6649955735ca 100644
--- a/pkgs/development/web/playwright/driver.nix
+++ b/pkgs/development/web/playwright/driver.nix
@@ -19,64 +19,13 @@ let
   throwSystem = throw "Unsupported system: ${system}";
   browsersJSON = (lib.importJSON ./browsers.json).browsers;
 
-  version = "1.59.1";
+  version = "1.60.0";
 
   src = fetchFromGitHub {
     owner = "Microsoft";
     repo = "playwright";
     rev = "v${version}";
-    hash = "sha256-kiH1jDyt5xMWc5C2dytoDC9fi1b5tWXZG8S6KEpuotM=";
-  };
-
-  babel-bundle = buildNpmPackage {
-    pname = "babel-bundle";
-    inherit version src;
-    sourceRoot = "${src.name}/packages/playwright/bundles/babel";
-    npmDepsHash = "sha256-ByCy4go8PM0ksDg+2DcJPyoKG7Z0uIqKM647ZQwYwAE=";
-    dontNpmBuild = true;
-    installPhase = ''
-      cp -r . "$out"
-    '';
-  };
-  expect-bundle = buildNpmPackage {
-    pname = "expect-bundle";
-    inherit version src;
-    sourceRoot = "${src.name}/packages/playwright/bundles/expect";
-    npmDepsHash = "sha256-PbPCsMqRkfU2c/mCsLSagew84XTgeO6H5+isNZQl2ek=";
-    dontNpmBuild = true;
-    installPhase = ''
-      cp -r . "$out"
-    '';
-  };
-  utils-bundle = buildNpmPackage {
-    pname = "utils-bundle";
-    inherit version src;
-    sourceRoot = "${src.name}/packages/playwright/bundles/utils";
-    npmDepsHash = "sha256-BTaF1atpK+kG++ZJBUK4r3A7mbN2vv3xpDmb1NiNngE=";
-    dontNpmBuild = true;
-    installPhase = ''
-      cp -r . "$out"
-    '';
-  };
-  utils-bundle-core = buildNpmPackage {
-    pname = "utils-bundle-core";
-    inherit version src;
-    sourceRoot = "${src.name}/packages/playwright-core/bundles/utils";
-    npmDepsHash = "sha256-O8X80rTT10ht97towSocANnGwH4fH1f3nZMSl8TOc+Y=";
-    dontNpmBuild = true;
-    installPhase = ''
-      cp -r . "$out"
-    '';
-  };
-  zip-bundle = buildNpmPackage {
-    pname = "zip-bundle";
-    inherit version src;
-    sourceRoot = "${src.name}/packages/playwright-core/bundles/zip";
-    npmDepsHash = "sha256-5BHgCelIPh8ljIcdrO4AHafjqfLowDwJcpN+mD13Syw=";
-    dontNpmBuild = true;
-    installPhase = ''
-      cp -r . "$out"
-    '';
+    hash = "sha256-jtQHyphdZsS8hf7uhe9zrx16Uf+kgLLha6dTCsCTT/8=";
   };
 
   playwright = buildNpmPackage {
@@ -84,7 +33,7 @@ let
     inherit version src;
 
     sourceRoot = "${src.name}"; # update.sh depends on sourceRoot presence
-    npmDepsHash = "sha256-H3kKFthmZH4fqFPQA34w7iw2rubpEKLlJ9jaW6mpuyo=";
+    npmDepsHash = "sha256-K1bCDURaq2+kaqGQcOL1tD6tQt/37pyDFWq2njUVNS4=";
 
     nativeBuildInputs = [
       cacert
@@ -95,22 +44,10 @@ let
 
     postPatch = ''
       sed -i '/\/\/ Update test runner./,/^\s*$/{d}' utils/build/build.js
-      sed -i '/^\/\/ Update bundles\./,/^[[:space:]]*}$/d' utils/build/build.js
-      sed -i '/execSync/d' ./utils/generate_third_party_notice.js
       # The dlopen library check uses ldconfig which doesn't work under Nix.
       # These libraries are already provided via rpath by autoPatchelfHook and wrapProgram.
       substituteInPlace packages/playwright-core/src/server/registry/index.ts \
         --replace-fail "['libGLESv2.so.2', 'libx264.so']" "[]"
-      chmod +w packages/playwright/bundles/babel
-      ln -s ${babel-bundle}/node_modules packages/playwright/bundles/babel/node_modules
-      chmod +w packages/playwright/bundles/expect
-      ln -s ${expect-bundle}/node_modules packages/playwright/bundles/expect/node_modules
-      chmod +w packages/playwright/bundles/utils
-      ln -s ${utils-bundle}/node_modules packages/playwright/bundles/utils/node_modules
-      chmod +w packages/playwright-core/bundles/utils
-      ln -s ${utils-bundle-core}/node_modules packages/playwright-core/bundles/utils/node_modules
-      chmod +w packages/playwright-core/bundles/zip
-      ln -s ${zip-bundle}/node_modules packages/playwright-core/bundles/zip/node_modules
     '';
 
     installPhase = ''
diff --git a/pkgs/development/web/playwright/firefox.nix b/pkgs/development/web/playwright/firefox.nix
index 4f2ad3f89e19..96d64ba3d088 100644
--- a/pkgs/development/web/playwright/firefox.nix
+++ b/pkgs/development/web/playwright/firefox.nix
@@ -19,8 +19,8 @@ let
       inherit (download) url stripRoot;
       hash =
         {
-          x86_64-linux = "sha256-kfXBssU8pJbBqEUQkgpUFXaskx95OyQEYXDhe6cteR8=";
-          aarch64-linux = "sha256-OMPpE0VUgZ65cPOZ7f3sfQMaI++lp6B/RBmhH0E7Y9k=";
+          x86_64-linux = "sha256-DXUCNHLzN8rdq/I7JRAHbSPtgK8pJy3sKNEx4xsbd0E=";
+          aarch64-linux = "sha256-Kl7Z9mE+1Vy6VEnnl0DOZY/jtYjhUTwjqfFe9UZu2UA=";
         }
         .${system} or throwSystem;
     };
@@ -42,8 +42,8 @@ let
     inherit (download) url stripRoot;
     hash =
       {
-        x86_64-darwin = "sha256-OfNmamn82tJ8+eY6DC8a3AynmhObZ8E0GTegF8l7km4=";
-        aarch64-darwin = "sha256-WEYhmqGhGvO47i/OICJgXyqj64Wt52juJDEe7nD7HXU=";
+        x86_64-darwin = "sha256-eXS88URYKAbFP6/3pukb2qgrdqVBOR99VGyqKPFZ2Tw=";
+        aarch64-darwin = "sha256-lVNFp20v+zBC3Up9ElhWh8C8ptEUqCHEsfQiuPp3lVM=";
       }
       .${system} or throwSystem;
   };
diff --git a/pkgs/development/web/playwright/webkit.nix b/pkgs/development/web/playwright/webkit.nix
index 71a24bda73bb..55f20bdcd9eb 100644
--- a/pkgs/development/web/playwright/webkit.nix
+++ b/pkgs/development/web/playwright/webkit.nix
@@ -23,6 +23,7 @@
   icu74,
   lcms,
   libavif,
+  libbacktrace,
   libdrm,
   libepoxy,
   libevent,
@@ -120,8 +121,8 @@ let
       inherit (download) url stripRoot;
       hash =
         {
-          x86_64-linux = "sha256-BVIZxnnfhBvI737ojRZ+yUX8mcbQ6WOlNdYJ9t4R5yY=";
-          aarch64-linux = "sha256-t9kqUdyOgDXroKp7LWQsaiaRGZVZN3ZdfYLahl5GW2E=";
+          x86_64-linux = "sha256-hefWMElsTGTkPvSnovwR8P0kunnPLUGDR5Hvoa31SMM=";
+          aarch64-linux = "sha256-4leXyoebeqWPHxO9D2MomnVqza/9IEcJEuiRCf3/eUc=";
         }
         .${system} or throwSystem;
     };
@@ -149,6 +150,7 @@ let
       icu74
       lcms
       libavif
+      libbacktrace
       libdrm
       libepoxy
       libevent
@@ -193,8 +195,8 @@ let
     inherit (download) url stripRoot;
     hash =
       {
-        x86_64-darwin = "sha256-NjuRZrYzraE1FrPAmyMcQFAS2zWZXYe8cBQVbSU6zFw=";
-        aarch64-darwin = "sha256-9g7YHg+TQNmAE07K6jKSSRUJ7IENUQMp2q54Mk2BbaY=";
+        x86_64-darwin = "sha256-D9iZitRG3lPWQ/Zu/HAjx2gEehr/xr0d+j2jo7yjnoQ=";
+        aarch64-darwin = "sha256-383PHqwW+QoXL4qxXEE3ytbQVQ4rg2YDK+B+XvIfBmY=";
       }
       .${system} or throwSystem;
   };
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index f46e25f2c6be..6ff780c690a6 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -796,6 +796,10 @@ let
       DEVTMPFS = yes;
 
       UNICODE = yes; # Casefolding support for filesystems
+    }
+    // lib.optionalAttrs stdenv.hostPlatform.isPower {
+      # Needed to use the installation iso image formatted for tbxi booting (ISO9660 w/ hybrid HFS+ partition).
+      HFSPLUS_FS = yes;
     };
 
     security = {
@@ -1623,6 +1627,12 @@ let
         # > round to working out why.  The workaround is to build it in[…].
         # > (It won't do any harm on non-Mac systems.)
         I2C_POWERMAC = yes;
+      }
+      // lib.optionalAttrs stdenv.hostPlatform.isPower {
+        # Needed for booting PowerMacs from disc
+        # (the only nice way that doesn't involve messing around with internal drives or in Open Firmware)
+        ATA = yes;
+        PATA_MACIO = yes;
       };
 
     accel = {
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 946868d206fc..6102340485fc 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -18,7 +18,7 @@ in
 buildLinux (
   args
   // rec {
-    version = "7.0.10";
+    version = "7.0.11";
     pname = "linux-zen";
     modDirVersion = lib.versions.pad 3 "${version}-${suffix}";
     isZen = true;
@@ -27,7 +27,7 @@ buildLinux (
       owner = "zen-kernel";
       repo = "zen-kernel";
       rev = "v${version}-${suffix}";
-      sha256 = "1xh7bbis9v7yq2s1zwdnmsx54zz9kcmyn1cnrqqlsassk7fzl7nx";
+      sha256 = "03h6f1pa96xdszpxcnd846n5jgwqmc49gf9wbyq1gy8rlzpc59yr";
     };
 
     # This is based on the following source:
diff --git a/pkgs/pkgs-lib/formats.nix b/pkgs/pkgs-lib/formats.nix
index 2f3e5ad9d191..879b233bb670 100644
--- a/pkgs/pkgs-lib/formats.nix
+++ b/pkgs/pkgs-lib/formats.nix
@@ -472,12 +472,14 @@ optionalAttrs allowAliases aliases
           runCommand name
             {
               nativeBuildInputs = [ json2x ];
-              inherit value;
+              value = builtins.toJSON value;
               preferLocalBuild = true;
               __structuredAttrs = true;
             }
             ''
-              json2x toml --unwrap value "$NIX_ATTRS_JSON_FILE" "$out"
+              valuePath="$TMPDIR/value"
+              printf "%s" "$value" > "$valuePath"
+              json2x toml "$valuePath" "$out"
             ''
         ) { };
 
diff --git a/pkgs/pkgs-lib/formats/json2x/src/main.rs b/pkgs/pkgs-lib/formats/json2x/src/main.rs
index 1464fb8972b9..b9025c67f42a 100644
--- a/pkgs/pkgs-lib/formats/json2x/src/main.rs
+++ b/pkgs/pkgs-lib/formats/json2x/src/main.rs
@@ -10,9 +10,6 @@ use argh::{FromArgValue, FromArgs};
 /// Convert a JSON file to another format
 #[derive(FromArgs)]
 struct Args {
-    /// convert only value of this attribute
-    #[argh(option)]
-    unwrap: Option<String>,
     /// format of the output file, possible values: toml
     #[argh(positional)]
     format: Format,
@@ -32,31 +29,16 @@ enum Format {
 fn main() -> anyhow::Result<()> {
     let args: Args = argh::from_env();
 
-    let json_text = read_to_string(&args.input)
+    let input = read_to_string(&args.input)
         .with_context(|| format!("failed to read {}", args.input.display()))?;
-    let parsed_json: serde_json::Value = serde_json::from_str(&json_text)
+    let input: serde_json::Value = serde_json::from_str(&input)
         .with_context(|| format!("failed to parse {}", args.input.display()))?;
-    let output_value = if let Some(unwrap_key) = args.unwrap {
-        parsed_json
-            .as_object()
-            .ok_or_else(|| anyhow::anyhow!("{} does not contain an object", args.input.display()))?
-            .get(&unwrap_key)
-            .ok_or_else(|| {
-                anyhow::anyhow!(
-                    "{} does not containt attribute '{unwrap_key}'",
-                    args.input.display()
-                )
-            })?
-    } else {
-        &parsed_json
-    };
     let mut output = File::create(&args.output)
         .with_context(|| format!("failed to create {}", args.output.display()))?;
 
     match args.format {
         Format::Toml => {
-            let content =
-                toml::to_string(output_value).context("failed to serialize value to toml")?;
+            let content = toml::to_string(&input).context("failed to serialize value to toml")?;
             output
                 .write_all(content.as_bytes())
                 .with_context(|| format!("failed to write to {}", args.output.display()))?;
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index f63cb9db18ca..8017987d67c3 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -481,6 +481,7 @@ mapAliases {
   ChowPhaser = throw "'ChowPhaser' has been renamed to/replaced by 'chow-phaser'"; # Converted to throw 2025-10-27
   CHOWTapeModel = throw "'CHOWTapeModel' has been renamed to/replaced by 'chow-tape-model'"; # Converted to throw 2025-10-27
   chrome-gnome-shell = throw "'chrome-gnome-shell' has been renamed to/replaced by 'gnome-browser-connector'"; # Converted to throw 2025-10-27
+  chromium-xorg-conf = throw "'chromium-xorg-conf' has been removed as it was only used by the 'cmt' NixOS module, which was removed"; # Added 2026-05-25
   ci-edit = throw "'ci-edit' has been removed due to lack of maintenance upstream"; # Added 2025-08-26
   cinnamon-common = cinnamon; # Added 2025-08-06
   ciopfs = throw "'ciopfs' has been removed due to lack of fuse 3 support."; # Added 2026-06-05
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8561ed7f43b6..88ec193a91e8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2153,10 +2153,6 @@ with pkgs;
     binutils = binutils-unwrapped;
   };
 
-  fltrdr = callPackage ../tools/misc/fltrdr {
-    icu = icu63;
-  };
-
   file = callPackage ../tools/misc/file {
     inherit (windows) libgnurx;
   };
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index 8e5a62bfae8a..ddf456a49931 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -332,6 +332,8 @@ in
           inherit kernel;
         };
 
+        ethercat = callPackage pkgs.ethercat.kernelModule { };
+
         evdi = callPackage ../os-specific/linux/evdi { };
 
         fanout = callPackage ../os-specific/linux/fanout { };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b73ce5e99848..f2e303ecf323 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -12579,6 +12579,8 @@ self: super: with self; {
 
   permissionedforms = callPackage ../development/python-modules/permissionedforms { };
 
+  perplexityai = callPackage ../development/python-modules/perplexityai { };
+
   persim = callPackage ../development/python-modules/persim { };
 
   persist-queue = callPackage ../development/python-modules/persist-queue { };