diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index bd66318b079d..53d655bfbcb8 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -122,6 +122,11 @@
 
 - Reloading or restarting systemd units from the NixOS activation script is deprecated, and will be removed in NixOS 26.11. This deprecation is part of a bigger effort to deprecate activation scripts altogether, which will take place over several releases. There are no in-tree usages of the now-deprecated reload/restart functionality.
 
+- Keycloak has been updated to 26.6.X, bringing a lot new features like federated client authentication, JWT authorization grants, workflows and the ability to do
+  zero-downtime patch releases. Read more about [all the exciting new capabilities in keycloak 26.6 here](https://github.com/keycloak/keycloak/releases/tag/26.6.0)
+  and [consult the migration guide to 26.6](https://www.keycloak.org/docs/latest/upgrading/index.html#migrating-to-26-6-0) to find out wether this is a breaking
+  change for your keycloak instance.
+
 - `elegant-sddm` has been updated to be Qt6 compatible. Themes for SDDM are slightly different so read the [wiki](https://wiki.nixos.org/wiki/SDDM_Themes) for more.
 
 - `forgejo` has been updated to major version 14. For more information, see the [release blog post](https://forgejo.org/2026-01-release-v14-0/) and [full release notes](https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/14.0.0.md)
diff --git a/lib/strings.nix b/lib/strings.nix
index 848e61a65ddf..d6170fdf39e3 100644
--- a/lib/strings.nix
+++ b/lib/strings.nix
@@ -337,7 +337,6 @@ rec {
 
   /**
     Concatenate a list of strings, adding a newline at the end of each one.
-    Defined as `concatMapStrings (s: s + "\n")`.
 
     # Inputs
 
@@ -361,7 +360,7 @@ rec {
 
     :::
   */
-  concatLines = concatMapStrings (s: s + "\n");
+  concatLines = str: concatStringsSep "\n" str + "\n";
 
   /**
     Given string `s`, replace every occurrence of the string `from` with the string `to`.
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index c841ad38cbc9..6706ef656676 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11401,6 +11401,11 @@
     githubId = 39416660;
     name = "Mladen Branković";
   };
+  imcvampire = {
+    github = "imcvampire";
+    githubId = 9426721;
+    name = "Quoc-Anh Nguyen";
+  };
   imgabe = {
     email = "gabrielpmonte@hotmail.com";
     github = "ImGabe";
@@ -14964,6 +14969,12 @@
     githubId = 61395246;
     name = "Lampros Pitsillos";
   };
+  landreussi = {
+    email = "lucasandreussi@gmail.com";
+    github = "landreussi";
+    githubId = 5938518;
+    name = "Lucas Andreussi";
+  };
   langsjo = {
     name = "langsjo";
     github = "langsjo";
diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index 89c18eddcc9f..81ddc364fd24 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -102,6 +102,8 @@
 
 - [Tinyauth](https://tinyauth.app/), a simple authentication middleware for web apps, with OAuth and LDAP support. Available as [services.tinyauth](#opt-services.tinyauth.enable).
 
+- [Strichliste](https://www.strichliste.org), a digital self-service tallysheet used in hackerspaces, clubs and offices. Available as [services.strichliste](#opt-services.strichliste.enable).
+
 - [Dawarich](https://dawarich.app/), a self-hostable location history tracker. Available as [services.dawarich](#opt-services.dawarich.enable).
 
 - [Howdy](https://github.com/boltgolt/howdy), a Windows Hello™ style facial authentication program for Linux.
@@ -313,6 +315,8 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
 
 - [hardware.xpadneo](#opt-hardware.xpadneo.enable) now supports configuring kernel module parameters via a freeform [settings](#opt-hardware.xpadneo.settings) option, with convenience options for [rumble attenuation](#opt-hardware.xpadneo.rumbleAttenuation) and [controller quirks](#opt-hardware.xpadneo.quirks).
 
+- The `services.prometheus.exporters` module interface now accepts an optional `socketOpts` attribute, allowing individual exporter modules to describe an accompanying `systemd.sockets.prometheus-${name}-exporter` unit alongside their service, enabling socket activation support.
+
 - Wine has been updated to the 11.0 branch. Please check the [upstream announcement](https://gitlab.winehq.org/wine/wine/-/releases/wine-11.0) for more details.
 
 - `security.acme` now defaults to a dynamic renewal duration, if
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index f89194a4ef39..f72dcccf3e87 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1779,6 +1779,7 @@
   ./services/web-apps/stash.nix
   ./services/web-apps/stirling-pdf.nix
   ./services/web-apps/strfry.nix
+  ./services/web-apps/strichliste.nix
   ./services/web-apps/suwayomi-server.nix
   ./services/web-apps/szurubooru.nix
   ./services/web-apps/tabbyapi.nix
diff --git a/nixos/modules/services/monitoring/prometheus/exporters.md b/nixos/modules/services/monitoring/prometheus/exporters.md
index f0bff8154291..f12be9b5f874 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters.md
+++ b/nixos/modules/services/monitoring/prometheus/exporters.md
@@ -138,12 +138,23 @@ example:
           DynamicUser = false;
           ExecStart = ''
             ${pkgs.prometheus-postfix-exporter}/bin/postfix_exporter \
-              --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
+              --web.systemd-socket \
               --web.telemetry-path ${cfg.telemetryPath} \
               ${lib.concatStringsSep " \\\n  " cfg.extraFlags}
           '';
         };
       };
+
+      # `socketOpts` is an optional attribute set describing a
+      # `systemd.sockets.prometheus-${name}-exporter` unit that
+      # accompanies the exporter's service. When set, it is merged
+      # with a default definition that includes
+      # `wantedBy = [ "sockets.target" ]`, enabling socket activation
+      # for exporters that support it.
+      # Note that this attribute is optional.
+      socketOpts = {
+        socketConfig.ListenStream = "${cfg.listenAddress}:${toString cfg.port}";
+      };
     }
     ```
   - This should already be enough for the postfix exporter. Additionally one
diff --git a/nixos/modules/services/monitoring/prometheus/exporters.nix b/nixos/modules/services/monitoring/prometheus/exporters.nix
index 18a1e30d31fe..a6317a032235 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters.nix
@@ -36,10 +36,15 @@ let
   #   - extraOpts   (types.attrs): extra configuration options to
   #                                configure the exporter with, which
   #                                are appended to the default options
+  #   - socketOpts  (types.attrs): optional config that is merged with
+  #                                the default definition of the
+  #                                exporter's systemd socket unit. When
+  #                                set, a `prometheus-${name}-exporter.socket`
+  #                                unit is created, enabling socket activation.
   #
-  #  Note that `extraOpts` is optional, but a script for the exporter's
-  #  systemd service must be provided by specifying either
-  #  `serviceOpts.script` or `serviceOpts.serviceConfig.ExecStart`
+  #  Note that `extraOpts` and `socketOpts` are optional, but a script
+  #  for the exporter's systemd service must be provided by specifying
+  #  either `serviceOpts.script` or `serviceOpts.serviceConfig.ExecStart`
 
   exporterOpts =
     (genAttrs
@@ -311,6 +316,7 @@ let
       name,
       conf,
       serviceOpts,
+      socketOpts,
     }:
     let
       enableDynamicUser = serviceOpts.serviceConfig.DynamicUser or true;
@@ -368,6 +374,12 @@ let
         "-m comment --comment ${name}-exporter -j nixos-fw-accept"
       ]);
       networking.firewall.extraInputRules = mkIf (conf.openFirewall && nftables) conf.firewallRules;
+      systemd.sockets."prometheus-${name}-exporter" = mkIf (socketOpts != null) (mkMerge [
+        {
+          wantedBy = [ "sockets.target" ];
+        }
+        socketOpts
+      ]);
       systemd.services."prometheus-${name}-exporter" = mkMerge [
         {
           wantedBy = [ "multi-user.target" ];
@@ -603,6 +615,7 @@ in
       mkExporterConf {
         inherit name;
         inherit (conf) serviceOpts;
+        socketOpts = conf.socketOpts or null;
         conf = cfg.${name};
       }
     ) exporterOpts)
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/node.nix b/nixos/modules/services/monitoring/prometheus/exporters/node.nix
index 2c4a82f0e044..82bb7c804294 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/node.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/node.nix
@@ -39,6 +39,7 @@ in
       '';
     };
   };
+
   serviceOpts = {
     serviceConfig = {
       DynamicUser = false;
@@ -47,7 +48,7 @@ in
         ${pkgs.prometheus-node-exporter}/bin/node_exporter \
           ${concatMapStringsSep " " (x: "--collector." + x) cfg.enabledCollectors} \
           ${concatMapStringsSep " " (x: "--no-collector." + x) cfg.disabledCollectors} \
-          --web.listen-address ${cfg.listenAddress}:${toString cfg.port} ${concatStringsSep " " cfg.extraFlags}
+          --web.systemd-socket ${concatStringsSep " " cfg.extraFlags}
       '';
       RestrictAddressFamilies =
         optionals (collectorIsEnabled "logind" || collectorIsEnabled "systemd") [
@@ -67,4 +68,8 @@ in
       ProtectHome = true;
     };
   };
+
+  socketOpts = {
+    socketConfig.ListenStream = "${cfg.listenAddress}:${toString cfg.port}";
+  };
 }
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/postfix.nix b/nixos/modules/services/monitoring/prometheus/exporters/postfix.nix
index 53a4056b86dd..e0abda068b2f 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/postfix.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/postfix.nix
@@ -85,6 +85,7 @@ in
       };
     };
   };
+
   serviceOpts = {
     after = mkIf cfg.systemd.enable [ cfg.systemd.unit ];
     serviceConfig = {
@@ -95,7 +96,7 @@ in
       SupplementaryGroups = mkIf cfg.systemd.enable [ "systemd-journal" ];
       ExecStart = ''
         ${lib.getExe cfg.package} \
-          --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
+          --web.systemd-socket \
           --web.telemetry-path ${cfg.telemetryPath} \
           --postfix.showq_path ${escapeShellArg cfg.showqPath} \
           ${concatStringsSep " \\\n  " (
@@ -115,4 +116,8 @@ in
       '';
     };
   };
+
+  socketOpts = {
+    socketConfig.ListenStream = "${cfg.listenAddress}:${toString cfg.port}";
+  };
 }
diff --git a/nixos/modules/services/web-apps/strichliste.nix b/nixos/modules/services/web-apps/strichliste.nix
new file mode 100644
index 000000000000..4f7db7cd31da
--- /dev/null
+++ b/nixos/modules/services/web-apps/strichliste.nix
@@ -0,0 +1,521 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    mkEnableOption
+    mkForce
+    mkIf
+    mkMerge
+    mkOption
+    mkPackageOption
+    types
+    ;
+
+  cfg = config.services.strichliste;
+
+  format = pkgs.formats.yaml { };
+  settingsFile = format.generate "strichliste.yaml" {
+    parameters.strichliste = cfg.settings;
+  };
+
+  unitDependencies =
+    lib.optionals (
+      lib.hasInfix "pgpsql" cfg.environment.DATABASE_URL
+      || lib.hasInfix "postgres" cfg.environment.DATABASE_URL
+    ) [ "postgresql.service" ]
+    ++ lib.optionals (lib.hasInfix "mysql" cfg.environment.DATABASE_URL) [ "mysql.service" ];
+in
+{
+  meta.buildDocsInSandbox = false;
+
+  options.services.strichliste = {
+    enable = mkEnableOption "strichliste, a web based tally sheet.";
+
+    packages = {
+      backend = mkPackageOption pkgs "strichliste" { };
+      frontend = mkOption {
+        type = types.package;
+        default = pkgs.strichliste.frontend;
+        description = ''
+          The strichliste-frontend package to use.
+        '';
+      };
+    };
+
+    settings = mkOption {
+      type = types.submodule {
+        freeformType = format.type;
+        options = {
+          common = {
+            idleTimeout = mkOption {
+              type = types.int;
+              default = 30000;
+              description = ''
+                Time until the app returns to the start page.
+              '';
+            };
+          };
+
+          user = {
+            stalePeriod = mkOption {
+              type = types.str;
+              default = "10 day";
+              example = "1 week";
+              description = ''
+                Duration after which users are listed as inactive.
+
+                The format used is documented in <https://www.php.net/manual/en/dateinterval.createfromdatestring.php>.
+
+                ::: {.tip}
+                This helps unclutter the user listing by prioritizing active users.
+                :::
+              '';
+            };
+          };
+
+          i18n = {
+            timezone = mkOption {
+              type = types.str;
+              default = config.time.timeZone;
+              defaultText = lib.literalExpression "config.time.timeZone";
+              example = "Europe/Berlin";
+              description = ''
+                Timezone used throughout the app, e.g. in the transaction log.
+              '';
+            };
+
+            language = mkOption {
+              type = types.str;
+              default = "en";
+              example = "de";
+              description = ''
+                Language used throughout the app.
+              '';
+            };
+
+            currency = {
+              name = mkOption {
+                type = types.str;
+                example = "Euro";
+                description = ''
+                  Name of the currency.
+                '';
+              };
+
+              symbol = mkOption {
+                type = types.str;
+                example = "€";
+                description = ''
+                  Symbol for the currency.
+                '';
+              };
+
+              alpha3 = mkOption {
+                type = types.str;
+                example = "EUR";
+                description = ''
+                  [ISO 4217] alpha code representing the currency.
+
+                  [ISO 4217]: https://en.wikipedia.org/wiki/ISO_4217#List_of_ISO_4217_currency_codes
+                '';
+              };
+            };
+          };
+
+          account = {
+            lower = mkOption {
+              type = types.int;
+              default = -200000;
+              example = 0;
+              description = ''
+                The credit limit for user accounts.
+              '';
+            };
+
+            upper = mkOption {
+              type = types.ints.positive;
+              default = 200000;
+              description = ''
+                The maximum balance on a user account.
+              '';
+            };
+          };
+
+          payment = {
+            boundary = {
+              lower = mkOption {
+                type = types.int;
+                default = -2000;
+                example = 0;
+                description = ''
+                  The lowest amount that can be used for payments.
+                '';
+              };
+
+              upper = mkOption {
+                type = types.ints.positive;
+                default = 15000;
+                description = ''
+                  The highest amount that can be used for payment.
+                '';
+              };
+            };
+
+            deposit = {
+              enabled = mkOption {
+                type = types.bool;
+                default = true;
+                description = ''
+                  Whether to allow money deposits.
+                '';
+              };
+
+              custom = mkOption {
+                type = types.bool;
+                default = true;
+                description = ''
+                  Whether to allow custom amounts for deposits.
+                '';
+              };
+
+              steps = mkOption {
+                type = types.listOf (
+                  types.oneOf [
+                    types.int
+                    types.float
+                  ]
+                );
+                example = [
+                  0.5
+                  1
+                  2
+                  5
+                  10
+                  20
+                ];
+                description = ''
+                  List of selectable deposit amounts.
+
+                  This should match your most common coins and banknotes.
+                '';
+              };
+            };
+
+            dispense = {
+              enabled = mkOption {
+                type = types.bool;
+                default = true;
+                description = ''
+                  Whether to allow spending money.
+                '';
+              };
+
+              custom = mkOption {
+                type = types.bool;
+                default = true;
+                description = ''
+                  Whether to allow custom spending amounts.
+                '';
+              };
+
+              steps = mkOption {
+                type = types.listOf (
+                  types.oneOf [
+                    types.int
+                    types.float
+                  ]
+                );
+                example = [
+                  0.5
+                  1
+                  2
+                  5
+                  10
+                  20
+                ];
+                description = ''
+                  List of selectable spending amounts.
+
+                  This should match your most common products.
+                '';
+              };
+            };
+
+            transaction = {
+              enabled = mkOption {
+                type = types.bool;
+                default = true;
+                description = ''
+                  Whether to allow transactions between user accounts.
+                '';
+              };
+            };
+
+            undo = {
+              enabled = mkOption {
+                type = types.bool;
+                default = true;
+                description = ''
+                  Whether to allow undoing transactions withing the {option}`services.strichliste.settings.payment.undo.timeout` period.
+                '';
+              };
+
+              delete = mkOption {
+                type = types.bool;
+                default = true;
+                description = ''
+                  Whether to allow deleting within the {option}`services.strichliste.settings.payment.undo.timeout` period.
+                '';
+              };
+
+              timeout = mkOption {
+                type = types.str;
+                default = "5 minute";
+                description = ''
+                  The time period after creating a transaction in which undoing/deleting remains possible.
+
+                  The format used is documented in <https://www.php.net/manual/en/dateinterval.createfromdatestring.php>.
+                '';
+              };
+            };
+          };
+        };
+      };
+      description = ''
+        The {file}`strichliste.yaml` configuration as a Nix attribute set.
+
+        See the [configuration reference](https://github.com/strichliste/strichliste-backend/blob/v${cfg.packages.backend.version}/docs/Config.md)
+        for possible options.
+      '';
+    };
+
+    domain = mkOption {
+      type = types.str;
+      example = "strichliste.example.com";
+      description = ''
+        Domain name used to configure the webserver virtual host.
+      '';
+    };
+
+    environment = mkOption {
+      type = types.submodule {
+        freeformType = types.attrs;
+        options = {
+          APP_ENV = mkOption {
+            type = types.str;
+            default = "prod";
+            description = ''
+              The active environment.
+            '';
+          };
+          APP_LOG_DIR = mkOption {
+            type = types.path;
+            default = "/var/log/strichliste";
+            description = ''
+              Directory to write logs.
+            '';
+          };
+          APP_CACHE_DIR = mkOption {
+            type = types.path;
+            default = "/var/cache/strichliste";
+            description = ''
+              Directory used for caching.
+            '';
+          };
+          CORS_ALLOW_ORIGIN = mkOption {
+            type = types.str;
+            default = "^https?://${config.services.strichliste.domain}(:[0-9]+)?$";
+            defaultText = lib.literalExpression "^https?://$${config.services.strichliste.domain}(:[0-9]+)?$";
+            description = ''
+              Regular expression defining the allowed CORS origins.
+            '';
+          };
+          DATABASE_URL = mkOption {
+            type = types.str;
+            default = "sqlite:////var/lib/strichliste/db.sqlite";
+            example = "postgresql://strichliste@localhost/strichliste?host=/run/postgresql";
+            description = ''
+              See <https://www.doctrine-project.org/projects/doctrine-dbal/en/3.9/reference/configuration.html#connecting-using-a-url>
+              for more URL examples.
+            '';
+          };
+        };
+      };
+      default = { };
+      description = ''
+        Environment variables consumed by Symfony.
+
+        See <https://github.com/strichliste/strichliste-backend/blob/v${cfg.packages.backend.version}/.env.dist> for possible options.
+      '';
+    };
+
+    environmentFiles = mkOption {
+      type = types.listOf types.path;
+      default = [ ];
+      example = lib.literalExpression ''
+        [
+          "/run/keys/strichliste.env"
+        ]
+      '';
+      description = ''
+        Environment files to configure Symfony.
+
+        See <https://github.com/strichliste/strichliste-backend/blob/v${cfg.packages.backend.version}/.env.dist> for possible options.
+
+        ::: {.important}
+        You should configure `APP_SECRET` here.
+        :::
+      '';
+    };
+
+    nginx = {
+      enable = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Whether to enable and configure an nginx vhost to serve strichliste.
+        '';
+      };
+
+      virtualHost = mkOption {
+        type = types.submodule (
+          import ../web-servers/nginx/vhost-options.nix {
+            inherit config lib;
+          }
+        );
+        example = lib.literalExpression ''
+          {
+            enableACME = true;
+            forceSSL = true;
+          }
+        '';
+        description = ''
+          Nginx virtual settings to allow direct customization of its settings.
+        '';
+      };
+    };
+  };
+
+  config = mkMerge [
+    (mkIf (cfg.enable && cfg.nginx.enable) {
+      services.phpfpm.pools.strichliste.settings = {
+        "listen.owner" = config.services.nginx.user;
+        "listen.group" = config.services.nginx.group;
+      };
+
+      services.nginx.enable = true;
+      services.nginx.virtualHosts.${cfg.domain} = mkMerge [
+        cfg.nginx.virtualHost
+        {
+          root = mkForce "${cfg.packages.frontend}";
+          locations = {
+            "/" = {
+              tryFiles = toString [
+                "$uri"
+                "$uri/"
+                "index.html"
+              ];
+            };
+
+            "/api/" = {
+              fastcgiParams = {
+                SCRIPT_FILENAME = "${cfg.packages.backend}/share/php/strichliste-backend/public/index.php";
+                SCRIPT_NAME = "/index.php";
+                REQUEST_URI = "$request_uri";
+
+                modHeadersAvailable = "true";
+                front_controller_active = "true";
+              };
+              extraConfig = ''
+                fastcgi_intercept_errors on;
+                fastcgi_pass unix:${config.services.phpfpm.pools.strichliste.socket};
+                fastcgi_request_buffering off;
+              '';
+            };
+          };
+        }
+      ];
+    })
+
+    (mkIf cfg.enable {
+      environment.etc."strichliste.yaml".source = settingsFile;
+
+      systemd.tmpfiles.settings."strichliste" = {
+        ${cfg.environment.APP_CACHE_DIR}.d = {
+          user = "strichliste";
+          group = "strichliste";
+          mode = "0700";
+        };
+        ${cfg.environment.APP_LOG_DIR}.d = {
+          user = "strichliste";
+          group = "strichliste";
+          mode = "0700";
+        };
+      };
+
+      systemd.services.strichliste-migrate = {
+        wantedBy = [ "phpfpm-strichliste.service" ];
+        before = [ "phpfpm-strichliste.service" ];
+        wants = unitDependencies;
+        after = unitDependencies;
+        inherit (cfg) environment;
+        preStart = ''
+          set -ex
+          if [ ! -e "/var/lib/strichliste/.db-init" ]; then
+            ${lib.optionalString (lib.hasInfix "sqlite" cfg.environment.DATABASE_URL) ''
+              ${lib.getExe cfg.packages.backend} doctrine:database:create
+            ''}
+            ${lib.getExe cfg.packages.backend} doctrine:schema:create
+            touch "/var/lib/strichliste/.db-init"
+          fi
+        '';
+        serviceConfig = {
+          Type = "exec";
+          User = "strichliste";
+          Group = "strichliste";
+          EnvironmentFile = cfg.environmentFiles;
+          ExecStart = toString [
+            (lib.getExe cfg.packages.backend)
+            "doctrine:migrations:migrate"
+            "--allow-no-migration"
+            "--no-interaction"
+          ];
+        };
+      };
+
+      systemd.services.phpfpm-strichliste = {
+        inherit (cfg) environment;
+        serviceConfig.EnvironmentFile = cfg.environmentFiles;
+      };
+
+      services.phpfpm.pools.strichliste = {
+        user = "strichliste";
+        group = "strichliste";
+        settings = {
+          # support environment variables
+          "clear_env" = false;
+          "pm" = "dynamic";
+          "pm.max_children" = 8;
+          "pm.start_servers" = 1;
+          "pm.min_spare_servers" = 1;
+          "pm.max_spare_servers" = 4;
+          "pm.max_requests" = 256;
+        };
+        inherit (cfg.packages.backend) phpPackage;
+      };
+
+      users.groups.strichliste = { };
+      users.users.strichliste = {
+        group = "strichliste";
+        home = "/var/lib/strichliste";
+        createHome = true;
+        isSystemUser = true;
+      };
+    })
+  ];
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 929e8362e8f3..f50038332973 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1519,6 +1519,7 @@ in
   step-ca = handleTestOn [ "x86_64-linux" ] ./step-ca.nix { };
   stirling-pdf-desktop = runTest ./stirling-pdf-desktop.nix;
   stratis = handleTest ./stratis { };
+  strichliste = runTest ./web-apps/strichliste.nix;
   strongswan-swanctl = runTest ./strongswan-swanctl.nix;
   stub-ld = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./stub-ld.nix { };
   stunnel = import ./stunnel.nix { inherit runTest; };
diff --git a/nixos/tests/web-apps/strichliste.nix b/nixos/tests/web-apps/strichliste.nix
new file mode 100644
index 000000000000..9d64c113f0c2
--- /dev/null
+++ b/nixos/tests/web-apps/strichliste.nix
@@ -0,0 +1,105 @@
+{
+  pkgs,
+  ...
+}:
+
+{
+  name = "strichliste";
+  meta.maintainers = pkgs.strichliste.meta.maintainers;
+
+  nodes = {
+    server =
+      { config, ... }:
+      {
+        networking.extraHosts = ''
+          127.0.0.1 strichliste.local
+        '';
+
+        environment.systemPackages = with pkgs; [ httpie ];
+
+        time.timeZone = "Europe/Berlin";
+
+        services.strichliste = {
+          enable = true;
+          domain = "strichliste.local";
+          environmentFiles = [
+            (pkgs.writeText "strichliste-secret.env" ''
+              APP_SECRET=changemechangemechangeme
+            '')
+          ];
+          settings = {
+            i18n = {
+              currency = {
+                alpha3 = "EUR";
+                name = "Euro";
+                symbol = "€";
+              };
+            };
+          };
+        };
+      };
+  };
+
+  testScript =
+    {
+      nodes,
+      ...
+    }:
+    # python
+    ''
+      import json
+
+      start_all()
+
+      def get_users():
+        response = machine.succeed("http --check-status http://strichliste.local/api/user")
+        users = json.loads(response)["users"]
+        return users
+
+      def get_user(uid: int):
+        response = machine.succeed(f"http --check-status http://strichliste.local/api/user/{uid}")
+        user = json.loads(response)["user"]
+        return user
+
+      def test():
+        with subtest("Check empty user list"):
+          users = get_users()
+          t.assertEqual(len(users), 0, "Strichliste must not have users.")
+
+        with subtest("Create user"):
+          machine.succeed("http --check-status post http://strichliste.local/api/user name=Alice")
+          users = get_users()
+          t.assertEqual(len(users), 1, "Strichliste must have exactly one user.")
+
+        with subtest("Retrieve user details"):
+          user = get_user(1)
+          t.assertEqual(user["name"], "Alice", "Created user must be named Alice")
+          t.assertEqual(user["balance"], 0, "New users should have a balance of 0")
+
+        with subtest("Deposit money"):
+          machine.succeed("http --check-status post http://strichliste.local/api/user/1/transaction amount=500")
+          user = get_user(1)
+          t.assertEqual(user["balance"], 500, "Balance must be 500 after depositing 500")
+
+        with subtest("Dispense money"):
+          machine.succeed("http --check-status post http://strichliste.local/api/user/1/transaction amount=-1000")
+          user = get_user(1)
+          t.assertEqual(user["balance"], -500, "Balance must be -500 after dispensing 1000")
+
+        with subtest("Undo transaction"):
+          response = machine.succeed("http --check-status post http://strichliste.local/api/user/1/transaction amount=7500")
+          transaction = json.loads(response)["transaction"]
+          machine.succeed(f"http --check-status delete http://strichliste.local/api/user/1/transaction/{transaction['id']}")
+
+      server.wait_for_unit("phpfpm-strichliste.service")
+
+      # frontend
+      server.wait_until_succeeds("http --check-status http://strichliste.local/ | grep -q '<title>Strichliste</title>'")
+
+      # backend
+      server.wait_until_succeeds("http --check-status http://strichliste.local/api/settings")
+
+      # sqlite
+      test()
+    '';
+}
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 5d0bfb46574f..9f48f2b3ffbb 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1330,8 +1330,8 @@ let
         mktplcRef = {
           publisher = "discloud";
           name = "discloud";
-          version = "2.28.4";
-          hash = "sha256-9m3Oi6w1GoVQatiMShmQAlsXDOauW3JBmNi3o78LFys=";
+          version = "2.28.5";
+          hash = "sha256-G5WgFSrmQOOtsDFfmJaJxvgbKfnpQSmMf+xAJeuhvhU=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/discloud.discloud/changelog";
@@ -3090,8 +3090,8 @@ let
         mktplcRef = {
           name = "compare-folders";
           publisher = "moshfeu";
-          version = "0.29.0";
-          hash = "sha256-oX4182qaoHbvZC9MdzzARBlW4MbtE7H0Fg687K5h2XQ=";
+          version = "0.30.0";
+          hash = "sha256-XBMHEk5iRW6n9fjDUbD8c/FFGNRttrnV0tH1qUphXYo=";
         };
 
         meta = {
@@ -5076,8 +5076,8 @@ let
         mktplcRef = {
           publisher = "vscjava";
           name = "vscode-java-debug";
-          version = "0.58.2025022807";
-          hash = "sha256-8bzDbCF03U5P15tkVkieOGuuLetUFXjZNrQKZTcKNFA=";
+          version = "0.59.0";
+          hash = "sha256-5Zc/zXY6mE6k1uV2RMz49f5sqoDA5YnylAPwDJrOOSA=";
         };
         meta = {
           license = lib.licenses.mit;
diff --git a/pkgs/applications/editors/vscode/extensions/github.copilot-chat/default.nix b/pkgs/applications/editors/vscode/extensions/github.copilot-chat/default.nix
index 3f0d86d8ad7d..712f3982a824 100644
--- a/pkgs/applications/editors/vscode/extensions/github.copilot-chat/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/github.copilot-chat/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "github";
     name = "copilot-chat";
-    version = "0.42.3";
-    hash = "sha256-bkVfwPFQSuTMcIEoEa/M91foSZC+0H4ESFXFwDDDhbc=";
+    version = "0.44.1";
+    hash = "sha256-xm3BG6d853ztavvTmADyTbc13xD0x9eZ4TudNpNH7+0=";
   };
 
   meta = {
diff --git a/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix b/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
index ec6824561d98..bd9772d19e74 100644
--- a/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
@@ -12,7 +12,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
   };
 
   meta = {
-    description = "VSCode extension providing an autonomous coding agent right in your IDE, capable of creating/editing files, executing commands, using the browser, and more with your permission every step of the way";
+    description = "Cline - autonomous coding agent VSCode extension, capable of creating/editing files, executing commands, using the browser, and more with your permission every step of the way";
     downloadPage = "https://github.com/cline/cline";
     homepage = "https://github.com/cline/cline";
     license = lib.licenses.asl20;
diff --git a/pkgs/applications/emulators/libretro/cores/flycast.nix b/pkgs/applications/emulators/libretro/cores/flycast.nix
index 14df3e5b0514..30654fbbb865 100644
--- a/pkgs/applications/emulators/libretro/cores/flycast.nix
+++ b/pkgs/applications/emulators/libretro/cores/flycast.nix
@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "flycast";
-  version = "0-unstable-2026-04-07";
+  version = "0-unstable-2026-04-12";
 
   src = fetchFromGitHub {
     owner = "flyinghead";
     repo = "flycast";
-    rev = "ad03e10c16a70b289f29bb10112857961125b4e6";
-    hash = "sha256-XSCI+94PXJXnU6/6lqA+1p05A3p2r8W0XPwbaDPSsaM=";
+    rev = "321bdaf08b4b007a720f196ea072c1813b1b7efe";
+    hash = "sha256-9Ry5+krdhz2RCmZZh2l6DdcKTgMpcgHwOBG4c7fc/og=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/emulators/libretro/cores/vecx.nix b/pkgs/applications/emulators/libretro/cores/vecx.nix
index 16bcf61a76fe..02ac6cb67012 100644
--- a/pkgs/applications/emulators/libretro/cores/vecx.nix
+++ b/pkgs/applications/emulators/libretro/cores/vecx.nix
@@ -7,13 +7,13 @@
 }:
 mkLibretroCore {
   core = "vecx";
-  version = "0-unstable-2026-01-12";
+  version = "0-unstable-2026-04-11";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-vecx";
-    rev = "eacee1f6f029688b043ed802cece29dd3c320e21";
-    hash = "sha256-2OlacvnJWcfTA8l91IBvuoUgd1HAs5ZHCbBGfaTGCyg=";
+    rev = "8f671cc9d737f2890c3ce19e177e2984dcae121f";
+    hash = "sha256-gNHPmoCiqWg7vWapWBPwHPPogiXCvXfkyqsHuudKHDg=";
   };
 
   extraBuildInputs = [
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index 123eacbcdc95..7ffddba320fc 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -828,11 +828,11 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "147.0.7727.55",
+    "version": "147.0.7727.101",
     "deps": {
       "depot_tools": {
-        "rev": "4ce8ba39a3488397a2d1494f167020f21de502f3",
-        "hash": "sha256-WTzjmLFjh1yDDEvYE7Qfx8aBxMLdATx14+Jprwh8ZgQ="
+        "rev": "442cbd6d584d2c992ca9bcc19ecbd2235bea772e",
+        "hash": "sha256-CgEu3y/MNRcCN2EmtcVgmGW/bEPKypeyLaANtiplDJU="
       },
       "gn": {
         "version": "0-unstable-2026-03-05",
@@ -840,16 +840,16 @@
         "hash": "sha256-3AfExm7NL5GJXyC5JCPbGC70D59doRfIZIgpt6MLy9Y="
       },
       "ungoogled-patches": {
-        "rev": "147.0.7727.55-1",
-        "hash": "sha256-7Fs/dfAn+N7zpkUSzACf9SDRhgMJUsnVi8cAExwn21A="
+        "rev": "147.0.7727.101-1",
+        "hash": "sha256-w/9bzbYHZM3Ot26ZcYWB51z7T+I4OBOxflo1dWxghyQ="
       },
       "npmHash": "sha256-ByB1Ea5tduIJZXyydeBWsoS8OPABOgwHe+dNXRssdvc="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "7dc2b8f6f651b42c0a8f3634c9feb5e0b6b25c91",
-        "hash": "sha256-mAauWiP5AlyzoRFOSGA71ljtZ9MtYLKtRlSolCA/spE=",
+        "rev": "56536d2a8034c51b0e68e1a0483ab9f1a0165ae3",
+        "hash": "sha256-94TMvPkcWm+IEVYwTh+m1ys5du75bvJcc1RpkSKpAwc=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -919,8 +919,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "401e94882e22cf2aa7af649b92ab123eaa329321",
-        "hash": "sha256-WD8GaB8LYhICdHZ+meCXSmLylAcISzEaZj06g+z1sfw="
+        "rev": "cbc4f074126e6f1acf72ad620a28cd4a8dd86f2a",
+        "hash": "sha256-MUgLUj2L0vmpAoxt/TJy1clsJfvYkQqe3Xm2+e4Y6tw="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -959,8 +959,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "3ab1df504f1af37a64f8d3949e77b0868e154894",
-        "hash": "sha256-wWoXEvgROx5FLx4nnvaiEW7N9q5VibulffWwCkkEXOs="
+        "rev": "2c681aed02b0add6bcf6724175660c4b35ece843",
+        "hash": "sha256-io3X9zu6tHgqJGXjygUXMa98rXELRNl6Y330U2nRc/M="
       },
       "src/third_party/dawn/third_party/glfw": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1254,8 +1254,8 @@
       },
       "src/third_party/libaom/source/libaom": {
         "url": "https://aomedia.googlesource.com/aom.git",
-        "rev": "9dd1b8af51cfd431cbcdeebc95256c0ec6b249eb",
-        "hash": "sha256-IX9mgT9f8fyAd0e1HzBNDE6tNAK4JC+OVqQLJIsvMY0="
+        "rev": "ab9876a5983227865ee26e91caac87c6b8750e27",
+        "hash": "sha256-V40GL7fKj1qratP0KcrhedEPDIsg0XVb3ha5nroM0ws="
       },
       "src/third_party/crabbyavif/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git",
@@ -1369,8 +1369,8 @@
       },
       "src/third_party/libvpx/source/libvpx": {
         "url": "https://chromium.googlesource.com/webm/libvpx.git",
-        "rev": "9a2d3d1f46afbdfa9b9820a9fd3aacb084e65e2f",
-        "hash": "sha256-9OkXFvBDfh/NFA96IQzaJcXSKSKW6tBN/HJSAwAr3S8="
+        "rev": "aec2a6f1cd6e3d9e8cf5d9682fcb8a442799bd22",
+        "hash": "sha256-PNreh1VisA46I0WZqq8wZRCjbQRiVMxbL5Gl2Bfzo3M="
       },
       "src/third_party/libwebm/source": {
         "url": "https://chromium.googlesource.com/webm/libwebm.git",
@@ -1434,8 +1434,8 @@
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "f99c212599bb85ce2e60936099f829cbcc3d4f5c",
-        "hash": "sha256-jq5qVIRWmC1xTvV/YwaosJMQH3XpS2N6Xn601uUPFkc="
+        "rev": "e5bafd3be58c26673576fd5bb5cbf413b485de5b",
+        "hash": "sha256-umtG2n6kWYD0hT44GpmnwUVztkZ0RtQDV0h0+4CTC9w="
       },
       "src/third_party/perfetto": {
         "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
@@ -1484,8 +1484,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "abbe599fb3c0ef2fa82bfadbb0ddcd321f22faf0",
-        "hash": "sha256-QR0R8gwDh6m4RCCCj0EJ/oQQd/mHdUkOVSO8mg74WkE="
+        "rev": "f8cd2da0256752afb0059bf17e4bf2bec422967e",
+        "hash": "sha256-dtSWBpCaewkKMW3Jc1PNDQh0jSQHIPduaXsIU9rcTa0="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1649,8 +1649,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "0cd69a9ba82925f5eb2c91376c4e7ba0da9dd445",
-        "hash": "sha256-PKaDXkDkdUVBlcXRmlfWjd5tqvLTCywhC7KdP/xp5NM="
+        "rev": "c207e34c08865143dc6774c1c624f3cea07f7420",
+        "hash": "sha256-5rc28tPK9mOJDO3HA3F1ZgsRQmWXhoLZGeKTzxWSISw="
       }
     }
   }
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 204fe21d0274..2c651447d56f 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -652,11 +652,11 @@
     "vendorHash": "sha256-GlkqFg9Bgs+Hi59PYAxqq3YW9ji1qeuX4vz59wQ4pRw="
   },
   "hashicorp_tfe": {
-    "hash": "sha256-TDDnW6786MGOBuptsIBqPe4/PUHQ3pKeLFqLHex3ObI=",
+    "hash": "sha256-/vEbhPKNhKUIlChGYuMNR5Ulbk9gG4171vZ6pvoTdcM=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/tfe",
     "owner": "hashicorp",
     "repo": "terraform-provider-tfe",
-    "rev": "v0.76.1",
+    "rev": "v0.76.2",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-JNTe1RI2aDw86jNzYJqmiBr5BBnr824/DhkJeaMpbKI="
   },
@@ -1247,13 +1247,13 @@
     "vendorHash": "sha256-u3WK/pLsuwySJX6GMNho8ImB+F+XXUPC6h+IQtDrOp8="
   },
   "spotinst_spotinst": {
-    "hash": "sha256-ow/8K8MXUKG0D5U2ILHImPBzRZwAp5oxybCf5wqbclA=",
+    "hash": "sha256-DWMa48u6D9lT6xtcYOQxWyHfMwFvI+iYufKoXgQJmC0=",
     "homepage": "https://registry.terraform.io/providers/spotinst/spotinst",
     "owner": "spotinst",
     "repo": "terraform-provider-spotinst",
-    "rev": "v1.233.1",
+    "rev": "v1.234.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-wcuB0GpsrVajguxa6FQ7jELVdgpZ0chazUKeH0ElVMo="
+    "vendorHash": "sha256-iUu/SG4VprmEuYo6e8az5GARJhJWHyvyyJNSapnpWME="
   },
   "statuscakedev_statuscake": {
     "hash": "sha256-zXBZZA+2uRN2FeGrayq0a4EBk7T+PvlBIwbuxwM7yBc=",
diff --git a/pkgs/applications/science/physics/crystfel/default.nix b/pkgs/applications/science/physics/crystfel/default.nix
index 00c8fc0c4a17..6dbfa8802315 100644
--- a/pkgs/applications/science/physics/crystfel/default.nix
+++ b/pkgs/applications/science/physics/crystfel/default.nix
@@ -86,19 +86,18 @@ let
       src =
         if stdenv.hostPlatform.isDarwin then
           fetchurl {
-            url = "https://www.mrc-lmb.cam.ac.uk/mosflm/mosflm/ver${
+            url = "https://www.mrc-lmb.cam.ac.uk/harry/imosflm/ver${
               builtins.replaceStrings [ "." ] [ "" ] version
-            }/pre-built/mosflm-osx-64-noX11.zip";
-            sha256 = "1da5wimv3kl8bccp49j69vh8gi28cn7axg59lrmb38s68c618h7j";
+            }/downloads/mosflm-${version}-osx-64.zip";
+            hash = "sha256-0sXgA3zSIjhy9+zTiv+K/51yZsIgGorMtKVjdRjW+AM=";
           }
         else
           fetchurl {
-            url = "https://www.mrc-lmb.cam.ac.uk/mosflm/mosflm/ver${
+            url = "https://www.mrc-lmb.cam.ac.uk/harry/imosflm/ver${
               builtins.replaceStrings [ "." ] [ "" ] version
-            }/pre-built/mosflm-linux-64-noX11.zip";
-            hash = "sha256:1f2qins5kaz5v6mkaclncqpirx3mlz177ywm13py9p6s9mk99g32";
+            }/downloads/imosflm-${version}-linux-64.zip";
+            hash = "sha256-2we0K09W31LKgn9SHLGti50EA/zhbX+CWWuQGCSKW18=";
           };
-      mosflmBinary = if stdenv.hostPlatform.isDarwin then "bin/mosflm" else "mosflm-linux-64-noX11";
     in
     stdenv.mkDerivation {
       pname = "mosflm";
@@ -112,13 +111,11 @@ let
         makeWrapper
       ];
 
-      sourceRoot = ".";
-
       # mosflm statically links against its own libccp4, which as the syminfo.lib environment variable problem.
       # Here, we circumvent it by creating a little wrapper script that calls mosflm after setting the SYMINFO variable.
       installPhase = ''
         mkdir -p $out/bin
-        cp ${mosflmBinary} $out/bin/mosflm-raw
+        cp bin/mosflm $out/bin/mosflm-raw
         makeWrapper $out/bin/mosflm-raw $out/bin/mosflm --set SYMINFO ${libccp4}/share/syminfo.lib --add-flags -n
       '';
     };
diff --git a/pkgs/by-name/au/auth0-cli/package.nix b/pkgs/by-name/au/auth0-cli/package.nix
index 2f452465f2d3..88b74634cd03 100644
--- a/pkgs/by-name/au/auth0-cli/package.nix
+++ b/pkgs/by-name/au/auth0-cli/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "auth0-cli";
-  version = "1.28.0";
+  version = "1.29.0";
 
   src = fetchFromGitHub {
     owner = "auth0";
     repo = "auth0-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FqMfnousaJg0u8W3o2lR8REIGFThq3vhsQFN1Je65Q8=";
+    hash = "sha256-RAfDCYDTlinx4mxmpTqOtAMmNG7G9E8XqYYVfkhwCpY=";
   };
 
-  vendorHash = "sha256-PrcGZ1UJb9fsp7ZsAAxH5VzumDwn/mkyoKVvniuPQrg=";
+  vendorHash = "sha256-OICMv7yAkY2OQu++HKfowcuvmISeLk3HzrYygW8EPbI=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/aw/aws-vault/package.nix b/pkgs/by-name/aw/aws-vault/package.nix
index 7c87f96c5354..e4cdcec4065e 100644
--- a/pkgs/by-name/aw/aws-vault/package.nix
+++ b/pkgs/by-name/aw/aws-vault/package.nix
@@ -10,17 +10,17 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "aws-vault";
-  version = "7.9.14";
+  version = "7.9.15";
 
   src = fetchFromGitHub {
     owner = "ByteNess";
     repo = "aws-vault";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-L3WJtS94EYgNqgwM2Gzayx89l2aKHkjaGNwOtfJMk3o=";
+    hash = "sha256-kDzFiuzSyxNyJnj3nechenhvm4bg+fSif+D+/stdTyo=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-axxV3XCxZVY3UM0yzC2ziTO0cbwJiNnDkOKAQADKUKA=";
+  vendorHash = "sha256-92k0E4zCKgWyCAvXWU49dFaYuiTByYNAWxdTYDeTzoE=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/bd/bdf2psf/package.nix b/pkgs/by-name/bd/bdf2psf/package.nix
index 3907ce39c97b..11406dd29f9d 100644
--- a/pkgs/by-name/bd/bdf2psf/package.nix
+++ b/pkgs/by-name/bd/bdf2psf/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bdf2psf";
-  version = "1.246";
+  version = "1.247";
 
   src = fetchurl {
     url = "mirror://debian/pool/main/c/console-setup/bdf2psf_${finalAttrs.version}_all.deb";
-    sha256 = "sha256-mfg5Ml3jnzCgyzWER592nH9F2lD7PToFWlIAsEFQ++o=";
+    sha256 = "sha256-56JC3wJZz80nGXn/YywWZ4wXiR1h+X//Y72qfLyPtyE=";
   };
 
   nativeBuildInputs = [ dpkg ];
diff --git a/pkgs/by-name/be/beads/package.nix b/pkgs/by-name/be/beads/package.nix
index 54c34422b39e..5753dca9de10 100644
--- a/pkgs/by-name/be/beads/package.nix
+++ b/pkgs/by-name/be/beads/package.nix
@@ -2,25 +2,28 @@
   lib,
   stdenv,
   buildGoModule,
+  dolt,
   fetchFromGitHub,
   gitMinimal,
+  icu,
   installShellFiles,
+  makeBinaryWrapper,
   versionCheckHook,
   writableTmpDirAsHomeHook,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "beads";
-  version = "0.42.0";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
-    owner = "steveyegge";
+    owner = "gastownhall";
     repo = "beads";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3t+pm7vuFj3PH1oCJ/AnwbGupqleimNQnP2bRSBHrSg=";
+    hash = "sha256-D2jShGpkOWKx9aRmRvV5bmV8t0/Y2eAE8q0m54QrRN0=";
   };
 
-  vendorHash = "sha256-ovG0EWQFtifHF5leEQTFvTjGvc+yiAjpAaqaV0OklgE=";
+  vendorHash = "sha256-7DJgqJX2HDa9gcGD8fLNHLIXvGAEivYeDYx3snCUyCE=";
 
   subPackages = [ "cmd/bd" ];
 
@@ -29,23 +32,46 @@ buildGoModule (finalAttrs: {
     "-w"
   ];
 
-  nativeBuildInputs = [ installShellFiles ];
+  buildInputs = [
+    icu
+  ];
+
+  nativeBuildInputs = [
+    installShellFiles
+    makeBinaryWrapper
+  ];
 
   nativeCheckInputs = [
     gitMinimal
     writableTmpDirAsHomeHook
   ];
 
-  # Skip security tests on Darwin - they check for /etc/passwd which isn't available in sandbox
-  checkFlags = lib.optionals stdenv.hostPlatform.isDarwin [
-    "-skip=TestCleanupMergeArtifacts_CommandInjectionPrevention"
-  ];
+  # Workaround for: panic: httptest: failed to listen on a port: listen tcp6 [::1]:0: bind: operation not permitted
+  # ref: https://github.com/NixOS/nix/pull/1646
+  __darwinAllowLocalNetworking = true;
+
+  checkFlags =
+    let
+      skippedTests = [
+        # Upstream test bug: version gap 0.55.0->1.0.0 triggers "very old" warning instead of expected "ok"
+        "TestCheckMetadataVersionTracking"
+      ]
+      ++ lib.optionals stdenv.hostPlatform.isDarwin [
+        # Checks for /etc/passwd which isn't available in sandbox
+        "TestCleanupMergeArtifacts_CommandInjectionPrevention"
+      ];
+    in
+    [ "-skip=^(${lib.concatStringsSep "|" skippedTests})$" ];
 
   preCheck = ''
     export PATH="$out/bin:$PATH"
   '';
 
-  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+  postInstall = ''
+    wrapProgram $out/bin/bd \
+      --prefix PATH : ${lib.makeBinPath [ dolt ]}
+  ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd bd \
       --bash <($out/bin/bd completion bash) \
       --fish <($out/bin/bd completion fish) \
@@ -61,9 +87,12 @@ buildGoModule (finalAttrs: {
 
   meta = {
     description = "Lightweight memory system for AI coding agents with graph-based issue tracking";
-    homepage = "https://github.com/steveyegge/beads";
+    homepage = "https://github.com/gastownhall/beads";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ kedry ];
+    maintainers = with lib.maintainers; [
+      kedry
+      imcvampire
+    ];
     mainProgram = "bd";
   };
 })
diff --git a/pkgs/by-name/bu/build2-bootstrap/package.nix b/pkgs/by-name/bu/build2-bootstrap/package.nix
index 8520945927b9..f6002a9b8385 100644
--- a/pkgs/by-name/bu/build2-bootstrap/package.nix
+++ b/pkgs/by-name/bu/build2-bootstrap/package.nix
@@ -4,6 +4,7 @@
   fetchurl,
   buildPackages,
   fixDarwinDylibNames,
+  fetchpatch,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "build2-bootstrap";
@@ -15,6 +16,12 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [
     # Pick up sysdirs from NIX_LDFLAGS
     ./nix-ldflags-sysdirs.patch
+    # Fix build on newer clang/libcpp
+    (fetchpatch {
+      name = "new-libcpp-fix.patch";
+      url = "https://github.com/build2/build2/commit/7cf9cece1d88cd1be283ab309f9a851bd02b43d0.patch";
+      hash = "sha256-PTo1C6Aa1L9fvjiJ08KtGgVqHMw2ZlW5LSKoripL22g=";
+    })
   ];
 
   sourceRoot = "build2-toolchain-${finalAttrs.version}/build2";
diff --git a/pkgs/by-name/ca/cardpeek/package.nix b/pkgs/by-name/ca/cardpeek/package.nix
index 6d10b364f128..895415be4780 100644
--- a/pkgs/by-name/ca/cardpeek/package.nix
+++ b/pkgs/by-name/ca/cardpeek/package.nix
@@ -25,7 +25,14 @@ stdenv.mkDerivation {
     sha256 = "1ighpl7nvcvwnsd6r5h5n9p95kclwrq99hq7bry7s53yr57l6588";
   };
 
-  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+  postPatch = ''
+    # gcc15
+    substituteInPlace lua_nodes.c \
+      --replace-fail "ui_update(1)" "ui_update()"
+    substituteInPlace ui/gtk/gui_cardview.c \
+      --replace-fail "ui_update(0)" "ui_update()"
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
     # replace xcode check and hard-coded PCSC framework path
     substituteInPlace configure.ac \
       --replace-fail 'if test ! -e "/Applications/Xcode.app/"; then' 'if test yes != yes; then' \
diff --git a/pkgs/by-name/cg/cgtcalc/package.nix b/pkgs/by-name/cg/cgtcalc/package.nix
index eae6cbd7e32e..c3720fb38c9e 100644
--- a/pkgs/by-name/cg/cgtcalc/package.nix
+++ b/pkgs/by-name/cg/cgtcalc/package.nix
@@ -45,7 +45,9 @@ stdenv.mkDerivation (finalAttrs: {
   # https://github.com/NixOS/nixpkgs/issues/379859
   doCheck = false;
 
-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
 
   meta = {
     description = "UK capital gains tax calculator written in Swift";
diff --git a/pkgs/by-name/cl/cloud-custodian/package.nix b/pkgs/by-name/cl/cloud-custodian/package.nix
index a03c943f8121..c97c179e5f31 100644
--- a/pkgs/by-name/cl/cloud-custodian/package.nix
+++ b/pkgs/by-name/cl/cloud-custodian/package.nix
@@ -20,6 +20,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     "docutils"
     "importlib-metadata"
     "referencing"
+    "tabulate"
     "urllib3"
   ];
 
diff --git a/pkgs/by-name/co/corrscope/package.nix b/pkgs/by-name/co/corrscope/package.nix
index 6e97bb8c74ee..4dd648b3fecf 100644
--- a/pkgs/by-name/co/corrscope/package.nix
+++ b/pkgs/by-name/co/corrscope/package.nix
@@ -61,6 +61,10 @@ python3Packages.buildPythonApplication (finalAttrs: {
     ]
   );
 
+  pythonRelaxDeps = [
+    "ruamel-yaml"
+  ];
+
   dontWrapQtApps = true;
 
   preFixup = ''
diff --git a/pkgs/by-name/co/costa/package.nix b/pkgs/by-name/co/costa/package.nix
index 9c8800e1baf7..c99a2f1da8bd 100644
--- a/pkgs/by-name/co/costa/package.nix
+++ b/pkgs/by-name/co/costa/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "COSTA";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "eth-cscs";
     repo = "COSTA";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-rkieWcUkAMI/fJjsPL20jI1jII5o5TwBx27nMQqNIXg=";
+    hash = "sha256-G/+AXGOjTbc92+6HLkDzkVJIikri0A+cB7Ft0RRQTzw=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/cs/csharp-ls/package.nix b/pkgs/by-name/cs/csharp-ls/package.nix
index c704f642c749..681092b9628d 100644
--- a/pkgs/by-name/cs/csharp-ls/package.nix
+++ b/pkgs/by-name/cs/csharp-ls/package.nix
@@ -11,9 +11,9 @@ in
 
 buildDotnetGlobalTool (finalAttrs: {
   pname = "csharp-ls";
-  version = "0.23.0";
+  version = "0.24.0";
 
-  nugetHash = "sha256-kaHjd23JFI30dbGvH0up6zFUe0rierF+uD7rpnWqO1M=";
+  nugetHash = "sha256-hpLTqgxwXiycfTaSd3nliS1quNB3VHLpSDBo+V18a9A=";
 
   inherit dotnet-sdk;
   dotnet-runtime = dotnet-sdk;
diff --git a/pkgs/by-name/dn/dnglab/package.nix b/pkgs/by-name/dn/dnglab/package.nix
index eb4d7451c6da..f6c5a10f6a30 100644
--- a/pkgs/by-name/dn/dnglab/package.nix
+++ b/pkgs/by-name/dn/dnglab/package.nix
@@ -5,7 +5,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dnglab";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "dnglab";
@@ -15,10 +15,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     postFetch = ''
       rm -rf "$out"/rawler/data/testdata/cameras/Canon/{"EOS REBEL T7i","EOS Rebel T7i"}
     '';
-    hash = "sha256-KBv7HhsGSPo1fa2QGXZi7zjh5Bu9wEtKwZ9X2TRkg2g=";
+    hash = "sha256-uCOdfCeec//5CnkuDEIgCy9B7SsqiXN8oGkoHhJ4N5Y=";
   };
 
-  cargoHash = "sha256-0Fxhs6Igi5kf/I5wgQ6bM01ka3Favo4AhfIL2DSvLAw=";
+  cargoHash = "sha256-CFtCONFL1qRTg67AxfuEeIqLq/+57xMGbTKKMFPAhuo=";
 
   postInstall = ''
     rm $out/bin/benchmark $out/bin/identify
diff --git a/pkgs/by-name/do/doctl/package.nix b/pkgs/by-name/do/doctl/package.nix
index 4ebcb48e8f4d..1549f863373d 100644
--- a/pkgs/by-name/do/doctl/package.nix
+++ b/pkgs/by-name/do/doctl/package.nix
@@ -9,7 +9,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "doctl";
-  version = "1.154.0";
+  version = "1.155.0";
 
   vendorHash = null;
 
@@ -42,7 +42,7 @@ buildGoModule (finalAttrs: {
     owner = "digitalocean";
     repo = "doctl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+CqkkWpy1bzMBgjml4Tztyz2t/fUFkyYVNh4gXpJjiw=";
+    hash = "sha256-sN/ZC3TAUiQokSZax3oF6LMl/H7lCCgtEjjcpy44aTY=";
   };
 
   meta = {
diff --git a/pkgs/by-name/fa/facter/Gemfile b/pkgs/by-name/fa/facter/Gemfile
index d44fe935cc1a..a60c88df3dfd 100644
--- a/pkgs/by-name/fa/facter/Gemfile
+++ b/pkgs/by-name/fa/facter/Gemfile
@@ -7,3 +7,4 @@ gem "facter"
 gem "base64", "~> 0.2.0"
 gem "benchmark", "~> 0.5.0"
 gem "logger", "~> 1.7.0"
+gem "sys-filesystem", "~> 1.5", ">= 1.5.5"
diff --git a/pkgs/by-name/fa/facter/Gemfile.lock b/pkgs/by-name/fa/facter/Gemfile.lock
index d587af3e4a46..791e3da5f631 100644
--- a/pkgs/by-name/fa/facter/Gemfile.lock
+++ b/pkgs/by-name/fa/facter/Gemfile.lock
@@ -6,18 +6,24 @@ GEM
     facter (4.10.0)
       hocon (~> 1.3)
       thor (>= 1.0.1, < 1.3)
+    ffi (1.17.3)
+    ffi (1.17.3-x86_64-linux-gnu)
     hocon (1.4.0)
     logger (1.7.0)
+    sys-filesystem (1.5.5)
+      ffi (~> 1.1)
     thor (1.2.2)
 
 PLATFORMS
   ruby
+  x86_64-linux
 
 DEPENDENCIES
   base64 (~> 0.2.0)
   benchmark (~> 0.5.0)
   facter
   logger (~> 1.7.0)
+  sys-filesystem (~> 1.5, >= 1.5.5)
 
 BUNDLED WITH
    2.7.2
diff --git a/pkgs/by-name/fa/facter/gemset.nix b/pkgs/by-name/fa/facter/gemset.nix
index c9fb0bf34f9f..417b2e6c7689 100644
--- a/pkgs/by-name/fa/facter/gemset.nix
+++ b/pkgs/by-name/fa/facter/gemset.nix
@@ -33,6 +33,16 @@
     };
     version = "4.10.0";
   };
+  ffi = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0k1xaqw2jk13q3ss7cnyvkp8fzp75dk4kazysrxgfd1rpgvkk7qf";
+      type = "gem";
+    };
+    version = "1.17.3";
+  };
   hocon = {
     groups = [ "default" ];
     platforms = [ ];
@@ -53,6 +63,17 @@
     };
     version = "1.7.0";
   };
+  sys-filesystem = {
+    dependencies = [ "ffi" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0cshw6aqq7ws4sbl0b4g50fgvffykbchjpnzanmg1f9lly85i6bg";
+      type = "gem";
+    };
+    version = "1.5.5";
+  };
   thor = {
     groups = [ "default" ];
     platforms = [ ];
diff --git a/pkgs/by-name/fc/fcitx5-openbangla-keyboard/package.nix b/pkgs/by-name/fc/fcitx5-openbangla-keyboard/package.nix
new file mode 100644
index 000000000000..3d479e7a6518
--- /dev/null
+++ b/pkgs/by-name/fc/fcitx5-openbangla-keyboard/package.nix
@@ -0,0 +1,12 @@
+{
+  openbangla-keyboard,
+  ...
+}@args:
+
+openbangla-keyboard.override (
+  {
+    withFcitx5Support = true;
+    withIbusSupport = false;
+  }
+  // removeAttrs args [ "openbangla-keyboard" ]
+)
diff --git a/pkgs/by-name/fl/flow/package.nix b/pkgs/by-name/fl/flow/package.nix
index f50870b27c9d..d6703986e4d4 100644
--- a/pkgs/by-name/fl/flow/package.nix
+++ b/pkgs/by-name/fl/flow/package.nix
@@ -16,13 +16,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "flow";
-  version = "0.308.0";
+  version = "0.309.0";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "flow";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PWSGay3WVXUtk3NA5ukAY2HMrJV49BXISoMM1UyqzXE=";
+    hash = "sha256-ml1bi5LXk2qzS1Us6ddzctfazoS3XFz2jJQy1of6txc=";
   };
 
   patches = [
diff --git a/pkgs/by-name/fs/fs-watcher-lsp/package.nix b/pkgs/by-name/fs/fs-watcher-lsp/package.nix
new file mode 100644
index 000000000000..fee31476a362
--- /dev/null
+++ b/pkgs/by-name/fs/fs-watcher-lsp/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  fetchCrate,
+  openssl,
+  pkg-config,
+  rustPlatform,
+  nix-update-script,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "fs-watcher-lsp";
+  version = "0.1.0";
+
+  __structuredAttrs = true;
+
+  src = fetchCrate {
+    version = finalAttrs.version;
+    crateName = "fs_watcher_lsp";
+    hash = "sha256-zahbi8RK8aDHcVOzIk5fCIh57+SjMGAVtUvtKhpMvF0=";
+  };
+
+  cargoHash = "sha256-w1i19IV/tjyl+W0NIjjbB0R9UpGrAUuK/yWbOZUKPUA=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+  ];
+
+  buildNoDefaultFeatures = false;
+  doCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Little file system watcher LSP to reload your editor";
+    changelog = "https://codeberg.org/Zentropivity/fs_watcher_lsp/releases/tag/v${finalAttrs.version}";
+    license = with lib.licenses; [
+      mit
+      asl20
+    ];
+    maintainers = with lib.maintainers; [ landreussi ];
+    mainProgram = "fs_watcher_lsp";
+  };
+})
diff --git a/pkgs/by-name/ga/galculator/package.nix b/pkgs/by-name/ga/galculator/package.nix
index e7068f831c8c..b4d121193c28 100644
--- a/pkgs/by-name/ga/galculator/package.nix
+++ b/pkgs/by-name/ga/galculator/package.nix
@@ -2,6 +2,7 @@
   lib,
   autoreconfHook,
   fetchFromGitHub,
+  fetchDebianPatch,
   fetchpatch2,
   flex,
   gtk3,
@@ -30,6 +31,12 @@ stdenv.mkDerivation (finalAttrs: {
       hash = "sha256-qVJHcfJTtl0hK8pzSp6MjhYAh1NbIIWr3rBDodIYBvk=";
     })
     ./gettext-0.25.patch
+    (fetchDebianPatch {
+      inherit (finalAttrs) pname version;
+      patch = "0002-Declare-function-parameters-as-required-by-C23.patch";
+      debianRevision = "2.1";
+      hash = "sha256-kwRYYNOo3Z2SjFQzR6Mo+qBgW3LQfhxdE6mMpLGoE44=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gh/gh/package.nix b/pkgs/by-name/gh/gh/package.nix
index 7174fc1fca70..00c28906fa9f 100644
--- a/pkgs/by-name/gh/gh/package.nix
+++ b/pkgs/by-name/gh/gh/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gh";
-  version = "2.89.0";
+  version = "2.90.0";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SiPcji8CbJd6GwWmsIFWq3874Mr9/VggOATX9yKYjow=";
+    hash = "sha256-yVc4UvC+CsW+pP/BJRjcOGX7h8zO2M8yM0m57Mr89JY=";
   };
 
-  vendorHash = "sha256-Sko+jTkGUTiR66Mv/p5INv/CLID1EK2v9fY0GfIeckg=";
+  vendorHash = "sha256-hz6oMLTibnSLB11vEWsO0O5ZFGKYJaVce6POqINObnI=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/gl/glab/package.nix b/pkgs/by-name/gl/glab/package.nix
index 4f36c3062782..41403e94cb77 100644
--- a/pkgs/by-name/gl/glab/package.nix
+++ b/pkgs/by-name/gl/glab/package.nix
@@ -13,13 +13,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "glab";
-  version = "1.91.0";
+  version = "1.92.1";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AXScsFVN8vEdhjM4m4VK41tje9QABp0OGq+8sPM+4oo=";
+    hash = "sha256-4DUEsh2T5rx/0u79+edMLAjTRUmXxlbA0SVH/EwoeVo=";
     leaveDotGit = true;
     postFetch = ''
       cd "$out"
@@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-idxt6qrs2CPO4SvZEuZNy12mw7dy1dslfuVn1ufrZ5Y=";
+  vendorHash = "sha256-fnVY1WEwzuRjHXQSGLl1c7bQXxzOHFEPlb/DhntYm2U=";
 
   ldflags = [
     "-s"
@@ -85,6 +85,7 @@ buildGoModule (finalAttrs: {
     maintainers = with lib.maintainers; [
       luftmensch-luftmensch
       anthonyroussel
+      turebentzin
     ];
     mainProgram = "glab";
   };
diff --git a/pkgs/by-name/go/gomuks-web/package.nix b/pkgs/by-name/go/gomuks-web/package.nix
index 8a1a4b92db25..a7f9e63aee4f 100644
--- a/pkgs/by-name/go/gomuks-web/package.nix
+++ b/pkgs/by-name/go/gomuks-web/package.nix
@@ -11,17 +11,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "gomuks-web";
-  version = "26.03";
+  version = "26.04";
 
   src = fetchFromGitHub {
     owner = "gomuks";
     repo = "gomuks";
     tag = "v0.${lib.replaceStrings [ "." ] [ "" ] finalAttrs.version}.0";
-    hash = "sha256-lWuZ1UkazG31qfZsRUb4eTc34qazCQlI7k+i9H1cdb4=";
+    hash = "sha256-IysL++H3ncAU1xqNWKy2Z9RKkF1hriVmIDdQu0SkDbQ=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-0h0/pNCd6g3aknDdKmVgojXKHzbtvWK/NVNToVJP0fU=";
+  vendorHash = "sha256-Ev6nmmOzLPjXp8XYj+7MRPElfGAv8fUcXJ5fXP8LCvs=";
 
   nativeBuildInputs = [
     nodejs
@@ -37,7 +37,7 @@ buildGoModule (finalAttrs: {
     npmRoot = "web";
     npmDeps = fetchNpmDeps {
       src = "${finalAttrs.src}/web";
-      hash = "sha256-9kGKUF+t4miz+uXZVifNhLkwYTK8ZAhFfrAfWF8Rxck=";
+      hash = "sha256-NeQzz2+Vdi1OtVN7ZF8I33nFCO7OpccD1AjpPl7tML4=";
     };
   };
 
diff --git a/pkgs/by-name/gr/grafana-alloy/package.nix b/pkgs/by-name/gr/grafana-alloy/package.nix
index 64680f984873..dde2ea8226ba 100644
--- a/pkgs/by-name/gr/grafana-alloy/package.nix
+++ b/pkgs/by-name/gr/grafana-alloy/package.nix
@@ -13,20 +13,25 @@
   lld,
   useLLD ? stdenv.hostPlatform.isArmv7,
 }:
+
+let
+  beylaVersion = "v3.6.0";
+in
+
 buildGoModule (finalAttrs: {
   pname = "grafana-alloy";
-  version = "1.14.2";
+  version = "1.15.1";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "alloy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-77WMsnC2WgVnbw1BsCj9ayS6XPsVTghmtIyl9Dk71uY=";
+    hash = "sha256-dAWBmvrthnsji6WuM2itRdfV4ONKDjsCzUJkUSmb1XI=";
   };
 
   npmDeps = fetchNpmDeps {
     src = "${finalAttrs.src}/internal/web/ui";
-    hash = "sha256-MiHFeyDxLzYF3t9H8OEn/bL10WRbzMcwlENs2FSJ4xo=";
+    hash = "sha256-YUCft67WskKubZu8qEIUoH5NHwSfD5o0tWzyply90Zg=";
   };
 
   frontend = buildNpmPackage {
@@ -49,12 +54,18 @@ buildGoModule (finalAttrs: {
 
   patchPhase = ''
     cp -av ${finalAttrs.frontend}/share internal/web/ui/dist
+
+    goSumBeylaVersion="$(grep beyla go.sum | head -1 | cut -d ' ' -f2)"
+    if [[ "$goSumBeylaVersion" != "${beylaVersion}" ]];then
+      echo "beyla version in go.sum ($goSumBeylaVersion) doesn't match the one set in the expression (${beylaVersion}), needs updating."
+      exit 1
+    fi
   '';
 
   modRoot = "collector";
 
   proxyVendor = true;
-  vendorHash = "sha256-i/BV987/ZYnCRYX8m9iFdtPo0vrWsmpn6UDs0q59sMM=";
+  vendorHash = "sha256-PbaqxDJHXB1MT5KtiEIkl+gP0DolzlC5JRItGC5VCpQ=";
 
   subPackages = [ "." ];
 
@@ -66,6 +77,7 @@ buildGoModule (finalAttrs: {
     "-X github.com/grafana/alloy/internal/build.Revision=v${finalAttrs.version}"
     "-X github.com/grafana/alloy/internal/build.BuildUser=nix@nixpkgs"
     "-X github.com/grafana/alloy/internal/build.BuildDate=1970-01-01T00:00:00Z"
+    "-X github.com/grafana/beyla/pkg/buildinfo=${beylaVersion}"
   ];
 
   tags = [
diff --git a/pkgs/by-name/gr/grpc-gateway/package.nix b/pkgs/by-name/gr/grpc-gateway/package.nix
index d1c518b842fb..381a9f63b4d6 100644
--- a/pkgs/by-name/gr/grpc-gateway/package.nix
+++ b/pkgs/by-name/gr/grpc-gateway/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "grpc-gateway";
-  version = "2.28.0";
+  version = "2.29.0";
 
   src = fetchFromGitHub {
     owner = "grpc-ecosystem";
     repo = "grpc-gateway";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-93omvHb+b+S0w4D+FGEEwYYDjgumJFDAruc1P4elfvA=";
+    sha256 = "sha256-d9OIIGttyMBSNgpS6mbR5JEIm13qGu2gFHJazJAexdw=";
   };
 
-  vendorHash = "sha256-jVP5zfFPfHeAEApKNJzZwuZLA+DjKgkL7m2DFG72UNs=";
+  vendorHash = "sha256-p51yD+v8+rPs+ztlX7r0VQ4XlwUkxu+PxgknKEvH00k=";
 
   ldflags = [
     "-X=main.version=${finalAttrs.version}"
diff --git a/pkgs/by-name/he/hello-wayland/package.nix b/pkgs/by-name/he/hello-wayland/package.nix
index e2091340fd1e..2c66e2e76d8d 100644
--- a/pkgs/by-name/he/hello-wayland/package.nix
+++ b/pkgs/by-name/he/hello-wayland/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation {
   pname = "hello-wayland";
-  version = "0-unstable-2026-03-17";
+  version = "0-unstable-2026-04-14";
 
   src = fetchFromGitHub {
     owner = "emersion";
     repo = "hello-wayland";
-    rev = "9a64c5ce78d004dc50814361b5153cef071f7042";
-    hash = "sha256-YSdBY0IJQB7iyiunVikFHd0S2GlPy7cZBl+aQkpCY1s=";
+    rev = "14231ae0a7f12e0041e81f749ae509d07e88fbe5";
+    hash = "sha256-9ciyfNnjBY3hg+UB7/xS7B30q9m3vvOc1emxi8qJTRE=";
   };
 
   separateDebugInfo = true;
diff --git a/pkgs/by-name/ho/home-manager/package.nix b/pkgs/by-name/ho/home-manager/package.nix
index 32682c11915c..60410234e64c 100644
--- a/pkgs/by-name/ho/home-manager/package.nix
+++ b/pkgs/by-name/ho/home-manager/package.nix
@@ -19,14 +19,14 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "home-manager";
-  version = "0-unstable-2026-04-08";
+  version = "0-unstable-2026-04-14";
 
   src = fetchFromGitHub {
     name = "home-manager-source";
     owner = "nix-community";
     repo = "home-manager";
-    rev = "7ba4ee4228ed36123c7cb75d50524b43514ef992";
-    hash = "sha256-oBYyowo6yfgb95Z78s3uTnAd9KkpJpwzjJbfnpLaM2Y=";
+    rev = "3c7524c68348ef79ce48308e0978611a050089b2";
+    hash = "sha256-No6QGBmIv5ChiwKCcbkxjdEQ/RO2ZS1gD7SFy6EZ7rc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/io/iotas/package.nix b/pkgs/by-name/io/iotas/package.nix
index 1fd10730345e..211846ed0671 100644
--- a/pkgs/by-name/io/iotas/package.nix
+++ b/pkgs/by-name/io/iotas/package.nix
@@ -20,7 +20,7 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "iotas";
-  version = "2026.5";
+  version = "2026.6";
   pyproject = false;
 
   src = fetchFromGitLab {
@@ -28,7 +28,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     owner = "World";
     repo = "iotas";
     tag = finalAttrs.version;
-    hash = "sha256-HTwhlbTc+s7eZVMLA/fYrhwwrmfDkdExARoJghLchls=";
+    hash = "sha256-Zsfp5O6k8VMjF6Hl3lT+u9JingGq3XgCzc8h9PVAhLg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/is/isabelle/package.nix b/pkgs/by-name/is/isabelle/package.nix
index 29273a55098f..0c48de36e306 100644
--- a/pkgs/by-name/is/isabelle/package.nix
+++ b/pkgs/by-name/is/isabelle/package.nix
@@ -330,7 +330,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Generic proof assistant";
-
     longDescription = ''
       Isabelle is a generic proof assistant.  It allows mathematical formulas
       to be expressed in a formal language and provides tools for proving those
@@ -346,6 +345,9 @@ stdenv.mkDerivation (finalAttrs: {
       lib.maintainers.jvanbruegge
       lib.maintainers.sempiternal-aurora
     ];
+    # need to compile the heaps for host on build
+    # which requires us to use the host polyml toolchain
+    broken = !(stdenv.buildPlatform.canExecute stdenv.hostPlatform);
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
diff --git a/pkgs/by-name/ka/kak-tree-sitter-unwrapped/package.nix b/pkgs/by-name/ka/kak-tree-sitter-unwrapped/package.nix
index 182cb151b5f7..bd5090c83370 100644
--- a/pkgs/by-name/ka/kak-tree-sitter-unwrapped/package.nix
+++ b/pkgs/by-name/ka/kak-tree-sitter-unwrapped/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "kak-tree-sitter-unwrapped";
-  version = "3.2.0";
+  version = "3.2.1";
 
   src = fetchFromSourcehut {
     owner = "~hadronized";
     repo = "kak-tree-sitter";
     rev = "kak-tree-sitter-v${finalAttrs.version}";
-    hash = "sha256-8J6bqQkeDfJOyd9WusT+H35J6AMVcCIEr0BCrwGKVXI=";
+    hash = "sha256-w+taJzr9tPLXdpV5RLTedVGR48Qodq/4M5IhlKAM/lU=";
   };
 
-  cargoHash = "sha256-rEF2BaadWuM0OtesiXV3IZ8bRpcpdRekUnvBAWM7Dwc=";
+  cargoHash = "sha256-ztVBBeLU1AByDz3yVDMZ102bDG6JfL/6IoJlcqRmCmU=";
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/by-name/kc/kcl-kafka/package.nix b/pkgs/by-name/kc/kcl-kafka/package.nix
new file mode 100644
index 000000000000..ed2e0ccf2b41
--- /dev/null
+++ b/pkgs/by-name/kc/kcl-kafka/package.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "kcl-kafka";
+  version = "0.17.0";
+
+  src = fetchFromGitHub {
+    owner = "twmb";
+    repo = "kcl";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-P55k9PIUDtYMzgPHCQYQLNgprnC9MDUX6ZfgZhI9fC0=";
+  };
+
+  vendorHash = "sha256-o7iSFI0zRwjlE2MVqKSpPMowR4mD2zW6wez4sqNX4Cw=";
+
+  subPackages = [ "." ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "One stop shop to do anything with Apache Kafka";
+    homepage = "https://github.com/twmb/kcl";
+    changelog = "https://github.com/twmb/kcl/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ chillcicada ];
+    mainProgram = "kcl";
+  };
+})
diff --git a/pkgs/by-name/ke/keycloak/package.nix b/pkgs/by-name/ke/keycloak/package.nix
index b34aa070de43..e818d7a46f85 100644
--- a/pkgs/by-name/ke/keycloak/package.nix
+++ b/pkgs/by-name/ke/keycloak/package.nix
@@ -24,11 +24,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "keycloak";
-  version = "26.5.7";
+  version = "26.6.1";
 
   src = fetchzip {
     url = "https://github.com/keycloak/keycloak/releases/download/${finalAttrs.version}/keycloak-${finalAttrs.version}.zip";
-    hash = "sha256-Brd/tRed8SmY4mzNScLqJDmGLdCFskEGeBbnKOoJ10s=";
+    hash = "sha256-nAINLLwC3H9FNwjcj0xUSy/TwpDA6+LQI1IqMtMxaCM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/l8/l8w8jwt/fix-gcc15.patch b/pkgs/by-name/l8/l8w8jwt/fix-gcc15.patch
new file mode 100644
index 000000000000..d2b7743d785f
--- /dev/null
+++ b/pkgs/by-name/l8/l8w8jwt/fix-gcc15.patch
@@ -0,0 +1,29 @@
+diff --git a/lib/mbedtls/library/ssl_tls13_keys.c b/lib/mbedtls/library/ssl_tls13_keys.c
+index dbc703a6c124961cfe38973ed4a0cae4867ba870..51afb044ccf3892bd0d69ec06b1f0ab0d15c287d 100644
+--- a/lib/mbedtls/library/ssl_tls13_keys.c
++++ b/lib/mbedtls/library/ssl_tls13_keys.c
+@@ -80,7 +80,8 @@ struct mbedtls_ssl_tls13_labels_struct const mbedtls_ssl_tls13_labels =
+  *            the HkdfLabel structure on success.
+  */
+ 
+-static const char tls13_label_prefix[6] = "tls13 ";
++/* We need to tell the compiler that we meant to leave out the null character. */
++static const char tls13_label_prefix[6] __attribute__ ((nonstring)) = "tls13 ";
+ 
+ #define SSL_TLS1_3_KEY_SCHEDULE_HKDF_LABEL_LEN(label_len, context_len) \
+     (2                     /* expansion length           */ \
+diff --git a/lib/mbedtls/library/ssl_tls13_keys.h b/lib/mbedtls/library/ssl_tls13_keys.h
+index 14f6e4876c64b7562eef7de589f92c1fd84b190a..f6d02b522a5e3f4a6f6802ae7655dee07218f8d1 100644
+--- a/lib/mbedtls/library/ssl_tls13_keys.h
++++ b/lib/mbedtls/library/ssl_tls13_keys.h
+@@ -40,8 +40,9 @@
+ 
+ #if defined(MBEDTLS_SSL_PROTO_TLS1_3)
+ 
++/* We need to tell the compiler that we meant to leave out the null character. */
+ #define MBEDTLS_SSL_TLS1_3_LABEL(name, string)       \
+-    const unsigned char name    [sizeof(string) - 1];
++    const unsigned char name    [sizeof(string) - 1] __attribute__ ((nonstring));
+ 
+ union mbedtls_ssl_tls13_labels_union {
+     MBEDTLS_SSL_TLS1_3_LABEL_LIST
diff --git a/pkgs/by-name/l8/l8w8jwt/package.nix b/pkgs/by-name/l8/l8w8jwt/package.nix
index e632841710de..27729aa7ba03 100644
--- a/pkgs/by-name/l8/l8w8jwt/package.nix
+++ b/pkgs/by-name/l8/l8w8jwt/package.nix
@@ -17,6 +17,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-aR3r84AYvCNx3jm9lB1qtbbEh9rU3LTkI+TK9LPQaPk=";
   };
 
+  patches = [
+    # adapted from https://github.com/Mbed-TLS/mbedtls/commit/79b513894a28718604f7cb531380bfea0354844f
+    ./fix-gcc15.patch
+  ];
+
   nativeBuildInputs = [ cmake ];
 
   cmakeFlags = [
diff --git a/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix b/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
index a3c2f5d2a64f..096f566910d1 100644
--- a/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
+++ b/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
@@ -36,7 +36,7 @@ let
 
   pname = "librewolf-bin-unwrapped";
 
-  version = "149.0-1";
+  version = "149.0.2-2";
 in
 
 stdenv.mkDerivation {
@@ -46,8 +46,8 @@ stdenv.mkDerivation {
     url = "https://codeberg.org/api/packages/librewolf/generic/librewolf/${version}/librewolf-${version}-${arch}-package.tar.xz";
     hash =
       {
-        x86_64-linux = "sha256-pW10vDNZMFmNx43yI3dsSO0FNQFS16NVBu2X9NAa+Uo=";
-        aarch64-linux = "sha256-2mOleX25KcNG8+2jSgXI2rTDvZ6jVwgVYOooIOHqqJE=";
+        x86_64-linux = "sha256-BzgSMeAHE3t3P5L/Xj0xjJcfsFk3UIYlrJvQGoahpM0=";
+        aarch64-linux = "sha256-49ODecTb/NeTa8iwB8f4XzGqPfFTJPvEgRJz8gsoGNs=";
       }
       .${stdenv.hostPlatform.system} or throwSystem;
   };
diff --git a/pkgs/by-name/li/lichess-bot/package.nix b/pkgs/by-name/li/lichess-bot/package.nix
index 3e3901b78ae3..89682bb3a99e 100644
--- a/pkgs/by-name/li/lichess-bot/package.nix
+++ b/pkgs/by-name/li/lichess-bot/package.nix
@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication {
   pname = "lichess-bot";
-  version = "2026.4.3.1";
+  version = "2026.4.15.1";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "lichess-bot-devs";
     repo = "lichess-bot";
-    rev = "98c70bbd693e12eafe1eff40996fb61c08c60ddb";
-    hash = "sha256-GpnplQ+MQdA+RrLKaq2JO7TQjJY1jWGxSu/Kbg5bBEo=";
+    rev = "55200ddb52746b87cff3756526c96c8d4f05feb6";
+    hash = "sha256-HaVDUYEnS1ZC26AXr4CmKY4+1nr59w40+eGDgpOEsKA=";
   };
 
   propagatedBuildInputs = with python3Packages; [
diff --git a/pkgs/by-name/li/litestream/package.nix b/pkgs/by-name/li/litestream/package.nix
index fad210501e68..d8b6d13507d7 100644
--- a/pkgs/by-name/li/litestream/package.nix
+++ b/pkgs/by-name/li/litestream/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "litestream";
-  version = "0.5.10";
+  version = "0.5.11";
 
   src = fetchFromGitHub {
     owner = "benbjohnson";
     repo = "litestream";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-xp1Ic7sF3yzpR4FgMOfx/uRp/jv/qzTgSlItOIrl2pI=";
+    hash = "sha256-LGlcc/FoBiZ7YiZUyqdYmAoV9BgUm4h2/n/KQ3NzFa4=";
   };
 
   ldflags = [
@@ -21,7 +21,7 @@ buildGoModule (finalAttrs: {
     "-X main.Version=${finalAttrs.version}"
   ];
 
-  vendorHash = "sha256-e2fsgK/fZNIos5W/Gc3u72uzoT2igs6BgzYtz1PyI10=";
+  vendorHash = "sha256-Zf7BdL0mljGFrRTx4JJxAUXUm6Uh/sVJP/zOJ4ef/CU=";
 
   passthru.tests = { inherit (nixosTests) litestream; };
 
diff --git a/pkgs/by-name/ln/lnav/package.nix b/pkgs/by-name/ln/lnav/package.nix
index b59d8ea3c0ae..53cf366fb6c8 100644
--- a/pkgs/by-name/ln/lnav/package.nix
+++ b/pkgs/by-name/ln/lnav/package.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lnav";
-  version = "0.13.2";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "tstack";
     repo = "lnav";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IYBcYnai7Se3/GNITzhpSV/XYvCUvcpiZDTF4Y58Zt0=";
+    hash = "sha256-BP4QiGO6x2o+9hRvoB4gz1IfQbr/yLVHgT9PWX/k/3c=";
   };
 
   enableParallelBuilding = true;
@@ -68,11 +68,11 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    src = "${finalAttrs.src}/src/third-party/prqlc-c";
-    hash = "sha256-hXjn2CF4FxCfDzikWif9hGWRmlIJI+nxbcV8EBEWxis=";
+    src = "${finalAttrs.src}/src/third-party/lnav-rs-ext";
+    hash = "sha256-Dy+V45X27dy2TN3JRic6nLmmG11I1Pw7m+vYKYJMnQs=";
   };
 
-  cargoRoot = "src/third-party/prqlc-c";
+  cargoRoot = "src/third-party/lnav-rs-ext";
 
   preConfigure = ''
     ./autogen.sh
diff --git a/pkgs/by-name/mi/miro/package.nix b/pkgs/by-name/mi/miro/package.nix
index 4bd122dfa231..215688f9f7de 100644
--- a/pkgs/by-name/mi/miro/package.nix
+++ b/pkgs/by-name/mi/miro/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "miro";
-  version = "0.7.3";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "vincent-uden";
     repo = "miro";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HSI6sAXy+PtZdla2GMuWFwoClUIf3E4rc3NHh7Wz1BE=";
+    hash = "sha256-uHg2RUn0k8POlV5Hod5hwLDLgjAOG6JxWsmdI4Mvx50=";
   };
 
-  cargoHash = "sha256-yYpHB7LwGxBy5r16vzXflqaygJmibEV4XteD0BV0HoA=";
+  cargoHash = "sha256-YoLRw/HVMEKIGmAqyffEyKJ9MTkAJhr2gWWW7TXZ4Io=";
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook
diff --git a/pkgs/by-name/mi/misconfig-mapper/package.nix b/pkgs/by-name/mi/misconfig-mapper/package.nix
index fc3b80d827b4..1e33ebbcfc93 100644
--- a/pkgs/by-name/mi/misconfig-mapper/package.nix
+++ b/pkgs/by-name/mi/misconfig-mapper/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "misconfig-mapper";
-  version = "1.15.2";
+  version = "1.15.4";
 
   src = fetchFromGitHub {
     owner = "intigriti";
     repo = "misconfig-mapper";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pHVa/K9zVLpo/3KKyJfLgYXISRpUE1GbiSQoTrfCxqA=";
+    hash = "sha256-U4zr+5TD8/rjCv1Ldmie52FZulfohfud72Gyivj2Zko=";
   };
 
-  vendorHash = "sha256-K3qHMeB+gYWjallt3JurVMC0aK3g9sXYxCgiGUU3OjM=";
+  vendorHash = "sha256-eQetkCrVlYtiXezFzj35TnYAt6tntzUuJHqRvWEkuC4=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/nc/nchat/fix-darwin.patch b/pkgs/by-name/nc/nchat/fix-darwin.patch
index c7c5ad14c8cc..d5acedafba5d 100644
--- a/pkgs/by-name/nc/nchat/fix-darwin.patch
+++ b/pkgs/by-name/nc/nchat/fix-darwin.patch
@@ -1,34 +1,95 @@
-diff --git i/CMakeLists.txt w/CMakeLists.txt
-index ceff715b..143659fb 100644
---- i/CMakeLists.txt
-+++ w/CMakeLists.txt
-@@ -31,30 +31,6 @@ endif()
+diff --git c/CMakeLists.txt i/CMakeLists.txt
+index bc227885..143382b3 100644
+--- c/CMakeLists.txt
++++ i/CMakeLists.txt
+@@ -30,91 +30,6 @@ endif()
+ # Platform specifics
  if (${CMAKE_SYSTEM_NAME} MATCHES "Darwin")
    add_definitions(-D_XOPEN_SOURCE_EXTENDED)
- 
+-
 -  # ncurses
--  execute_process(COMMAND sh "-c"
--                  "command -v brew &> /dev/null && brew --prefix ncurses 2> /dev/null | tr -d '\n'"
--                  OUTPUT_VARIABLE NCURSES_ROOT_DIR)
--  if (EXISTS "${NCURSES_ROOT_DIR}")
--    message(STATUS "Ncurses cmake prefix '${NCURSES_ROOT_DIR}' (detected).")
+-  if (DEFINED NCURSES_ROOT_DIR AND EXISTS "${NCURSES_ROOT_DIR}")
+-    message(STATUS "Ncurses cmake prefix '${NCURSES_ROOT_DIR}' (user-specified)")
 -  else()
--    set(NCURSES_ROOT_DIR /opt/local)
--    message(STATUS "Ncurses cmake prefix '${NCURSES_ROOT_DIR}' (default).")
+-    execute_process(COMMAND sh "-c"
+-                    "command -v brew &> /dev/null && brew --prefix ncurses 2> /dev/null | tr -d '\n'"
+-                    OUTPUT_VARIABLE NCURSES_ROOT_DIR)
+-    if (EXISTS "${NCURSES_ROOT_DIR}")
+-      message(STATUS "Ncurses cmake prefix '${NCURSES_ROOT_DIR}' (homebrew)")
+-    else()
+-      foreach(FALLBACK_DIR /opt/homebrew/opt/ncurses /usr/local/opt/ncurses)
+-        if (EXISTS "${FALLBACK_DIR}")
+-          set(NCURSES_ROOT_DIR "${FALLBACK_DIR}")
+-          break()
+-        endif()
+-      endforeach()
+-      if (EXISTS "${NCURSES_ROOT_DIR}")
+-        message(STATUS "Ncurses cmake prefix '${NCURSES_ROOT_DIR}' (fallback)")
+-      elseif (EXISTS "/opt/local")
+-        set(NCURSES_ROOT_DIR "/opt/local")
+-        message(STATUS "Ncurses cmake prefix '${NCURSES_ROOT_DIR}' (macports)")
+-      endif()
+-    endif()
+-  endif()
+-  if (EXISTS "${NCURSES_ROOT_DIR}")
+-    list(APPEND CMAKE_PREFIX_PATH ${NCURSES_ROOT_DIR})
 -  endif()
--  list(APPEND CMAKE_PREFIX_PATH ${NCURSES_ROOT_DIR})
 -
 -  # openssl
--  execute_process(COMMAND sh "-c"
--                  "command -v brew &> /dev/null && brew --prefix openssl 2> /dev/null | tr -d '\n'"
--                  OUTPUT_VARIABLE OPENSSL_ROOT_DIR)
--  if (EXISTS "${OPENSSL_ROOT_DIR}")
--    message(STATUS "OpenSSL cmake prefix '${OPENSSL_ROOT_DIR}' (detected).")
+-  if (DEFINED OPENSSL_ROOT_DIR AND EXISTS "${OPENSSL_ROOT_DIR}")
+-    message(STATUS "OpenSSL cmake prefix '${OPENSSL_ROOT_DIR}' (user-specified)")
 -  else()
--    set(OPENSSL_ROOT_DIR /opt/local)
--    message(STATUS "OpenSSL cmake prefix '${OPENSSL_ROOT_DIR}' (default).")
+-    execute_process(COMMAND sh "-c"
+-                    "command -v brew &> /dev/null && brew --prefix openssl 2> /dev/null | tr -d '\n'"
+-                    OUTPUT_VARIABLE OPENSSL_ROOT_DIR)
+-    if (EXISTS "${OPENSSL_ROOT_DIR}")
+-      message(STATUS "OpenSSL cmake prefix '${OPENSSL_ROOT_DIR}' (homebrew)")
+-    else()
+-      foreach(FALLBACK_DIR /opt/homebrew/opt/openssl /usr/local/opt/openssl)
+-        if (EXISTS "${FALLBACK_DIR}")
+-          set(OPENSSL_ROOT_DIR "${FALLBACK_DIR}")
+-          break()
+-        endif()
+-      endforeach()
+-      if (EXISTS "${OPENSSL_ROOT_DIR}")
+-        message(STATUS "OpenSSL cmake prefix '${OPENSSL_ROOT_DIR}' (fallback)")
+-      elseif (EXISTS "/opt/local")
+-        set(OPENSSL_ROOT_DIR "/opt/local")
+-        message(STATUS "OpenSSL cmake prefix '${OPENSSL_ROOT_DIR}' (macports)")
+-      endif()
+-    endif()
+-  endif()
+-  if (EXISTS "${OPENSSL_ROOT_DIR}")
+-    list(APPEND CMAKE_PREFIX_PATH ${OPENSSL_ROOT_DIR})
+-  endif()
+-
+-  # sqlite
+-  if (DEFINED SQLITE_ROOT_DIR AND EXISTS "${SQLITE_ROOT_DIR}")
+-    message(STATUS "SQLite cmake prefix '${SQLITE_ROOT_DIR}' (user-specified)")
+-  else()
+-    execute_process(COMMAND sh "-c"
+-                    "command -v brew &> /dev/null && brew --prefix sqlite 2> /dev/null | tr -d '\n'"
+-                    OUTPUT_VARIABLE SQLITE_ROOT_DIR)
+-    if (EXISTS "${SQLITE_ROOT_DIR}")
+-      message(STATUS "SQLite cmake prefix '${SQLITE_ROOT_DIR}' (homebrew)")
+-    else()
+-      foreach(FALLBACK_DIR /opt/homebrew/opt/sqlite /usr/local/opt/sqlite)
+-        if (EXISTS "${FALLBACK_DIR}")
+-          set(SQLITE_ROOT_DIR "${FALLBACK_DIR}")
+-          break()
+-        endif()
+-      endforeach()
+-      if (EXISTS "${SQLITE_ROOT_DIR}")
+-        message(STATUS "SQLite cmake prefix '${SQLITE_ROOT_DIR}' (fallback)")
+-      elseif (EXISTS "/opt/local")
+-        set(SQLITE_ROOT_DIR "/opt/local")
+-        message(STATUS "SQLite cmake prefix '${SQLITE_ROOT_DIR}' (macports)")
+-      endif()
+-    endif()
+-  endif()
+-  if (EXISTS "${SQLITE_ROOT_DIR}")
+-    list(APPEND CMAKE_PREFIX_PATH ${SQLITE_ROOT_DIR})
 -  endif()
--  list(APPEND CMAKE_PREFIX_PATH ${OPENSSL_ROOT_DIR})
 -
  elseif (${CMAKE_SYSTEM_NAME} MATCHES "Android")
    add_compile_definitions(_XOPEN_SOURCE_EXTENDED)
diff --git a/pkgs/by-name/nc/nchat/go-libs-build.patch b/pkgs/by-name/nc/nchat/go-libs-build.patch
index 7adcef2dcd50..0f0e137e8064 100644
--- a/pkgs/by-name/nc/nchat/go-libs-build.patch
+++ b/pkgs/by-name/nc/nchat/go-libs-build.patch
@@ -1,22 +1,22 @@
-diff --git i/CMakeLists.txt w/CMakeLists.txt
-index a1928ee3..26157e56 100644
---- i/CMakeLists.txt
-+++ w/CMakeLists.txt
-@@ -126,10 +126,6 @@ message(STATUS "Static Go: ${HAS_STATICGOLIB}")
+diff --git c/CMakeLists.txt i/CMakeLists.txt
+index bc227885..d37cafe9 100644
+--- c/CMakeLists.txt
++++ i/CMakeLists.txt
+@@ -182,10 +182,6 @@ message(STATUS "Static Go: ${HAS_STATICGOLIB}")
  
  # Check Golang version for whatsmeow minimum requirement
  set(GO_VERSION_MIN 1.23)
 -execute_process(COMMAND bash "-c" "go version 2> /dev/null | cut -c14- | cut -d' ' -f1 | tr -d '\n'" OUTPUT_VARIABLE GO_VERSION)
 -if((HAS_WHATSAPP OR HAS_SIGNAL) AND (NOT GO_VERSION VERSION_GREATER_EQUAL GO_VERSION_MIN))
--  message(FATAL_ERROR "Go version ${GO_VERSION} (need >= ${GO_VERSION_MIN} to build WhatsApp or Signal).")
+-  message(FATAL_ERROR "Go version ${GO_VERSION} (need >= ${GO_VERSION_MIN} to build WhatsApp or Signal)")
 -endif()
  
  # Check Little/Big Endian for tdlib requirement
  test_big_endian(IS_BIG_ENDIAN)
-diff --git i/lib/tgchat/ext/td/CMakeLists.txt w/lib/tgchat/ext/td/CMakeLists.txt
-index 795f1f4b..7e41549c 100644
---- i/lib/tgchat/ext/td/CMakeLists.txt
-+++ w/lib/tgchat/ext/td/CMakeLists.txt
+diff --git c/lib/tgchat/ext/td/CMakeLists.txt i/lib/tgchat/ext/td/CMakeLists.txt
+index f65c6e45..46b08fdd 100644
+--- c/lib/tgchat/ext/td/CMakeLists.txt
++++ i/lib/tgchat/ext/td/CMakeLists.txt
 @@ -140,7 +140,6 @@ if (CLANG OR GCC)
  endif()
  
@@ -25,10 +25,10 @@ index 795f1f4b..7e41549c 100644
  message(STATUS "Git state: ${TD_GIT_COMMIT_HASH}")
  
  configure_file("${CMAKE_CURRENT_SOURCE_DIR}/td/telegram/GitCommitHash.cpp.in" "${CMAKE_CURRENT_BINARY_DIR}/td/telegram/GitCommitHash.cpp" @ONLY)
-diff --git i/lib/wmchat/CMakeLists.txt w/lib/wmchat/CMakeLists.txt
+diff --git c/lib/wmchat/CMakeLists.txt i/lib/wmchat/CMakeLists.txt
 index 84a42ef9..556df050 100644
---- i/lib/wmchat/CMakeLists.txt
-+++ w/lib/wmchat/CMakeLists.txt
+--- c/lib/wmchat/CMakeLists.txt
++++ i/lib/wmchat/CMakeLists.txt
 @@ -20,8 +20,8 @@ install(TARGETS wmchat DESTINATION ${CMAKE_INSTALL_LIBDIR})
  target_common_config(wmchat)
  
diff --git a/pkgs/by-name/nc/nchat/package.nix b/pkgs/by-name/nc/nchat/package.nix
index 156dcbb63bad..d300e4656007 100644
--- a/pkgs/by-name/nc/nchat/package.nix
+++ b/pkgs/by-name/nc/nchat/package.nix
@@ -17,13 +17,13 @@
 }:
 
 let
-  version = "5.13.17";
+  version = "5.14.44";
 
   src = fetchFromGitHub {
     owner = "d99kris";
     repo = "nchat";
     tag = "v${version}";
-    hash = "sha256-VSya6s3/+vII/M76tHmeJEZh7/gv9L5tYdILuthdO5s=";
+    hash = "sha256-gG0YkahHP/6KjM+5uzdTRxsonn83cxlJDvdn5HE3h0Q=";
   };
 
   libcgowm = buildGoModule {
@@ -31,7 +31,7 @@ let
     inherit version src;
 
     sourceRoot = "${src.name}/lib/wmchat/go";
-    vendorHash = "sha256-lfy7uHH3rLYx6kzIy72ftEiO1CkJkEr7rRXHhuFU/ac=";
+    vendorHash = "sha256-5Id5+DehV2juLJnEHYvcI67/ykFUQehSrfFW+toZRM0=";
 
     buildPhase = ''
       runHook preBuild
diff --git a/pkgs/by-name/no/noctalia-shell/package.nix b/pkgs/by-name/no/noctalia-shell/package.nix
index d8c138bb03d6..7d425e4ad0e5 100644
--- a/pkgs/by-name/no/noctalia-shell/package.nix
+++ b/pkgs/by-name/no/noctalia-shell/package.nix
@@ -68,13 +68,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "noctalia-shell";
-  version = "4.7.5";
+  version = "4.7.6";
 
   src = fetchFromGitHub {
     owner = "noctalia-dev";
     repo = "noctalia-shell";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0xoCuJSRSWcn4mCX382lCxqLbnuOrrqS4dOcdpoUmZg=";
+    hash = "sha256-oGMYWsP0qthxQisirZc/r/vpdGTZrInwkh75AC714AE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/oc/ocelot/package.nix b/pkgs/by-name/oc/ocelot/package.nix
new file mode 100644
index 000000000000..3247bc247292
--- /dev/null
+++ b/pkgs/by-name/oc/ocelot/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  rustPlatform,
+  installShellFiles,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "ocelot";
+  version = "0.5.2";
+
+  src = fetchFromGitHub {
+    owner = "xrelkd";
+    repo = "ocelot";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Z0RKEHeDhHjZtqXWueASMgiqnFRNsPe2rdoC7LZ/Mh8=";
+  };
+
+  cargoHash = "sha256-rJoIElM7fYg+oEV5idUNGys88x6dFeO4Ux8TxJKNqPU=";
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd ocelot \
+      --bash <($out/bin/ocelot completions bash) \
+      --fish <($out/bin/ocelot completions fish) \
+      --zsh  <($out/bin/ocelot completions zsh)
+  '';
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "Process supervisor and init system written in Rust Programming Language";
+    homepage = "https://github.com/xrelkd/ocelot";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ xrelkd ];
+    mainProgram = "ocelot";
+  };
+})
diff --git a/pkgs/by-name/ol/olympus-unwrapped/package.nix b/pkgs/by-name/ol/olympus-unwrapped/package.nix
index 977599560c2b..737914263b88 100644
--- a/pkgs/by-name/ol/olympus-unwrapped/package.nix
+++ b/pkgs/by-name/ol/olympus-unwrapped/package.nix
@@ -22,9 +22,9 @@ let
 
   phome = "$out/lib/olympus";
   # The following variables are to be updated by the update script.
-  version = "26.03.21.03";
-  buildId = "5526"; # IMPORTANT: This line is matched with regex in update.sh.
-  rev = "cd3c4695cf4be1f1aa59211fcc183f603e6c6343";
+  version = "26.04.16.02";
+  buildId = "5566"; # IMPORTANT: This line is matched with regex in update.sh.
+  rev = "047950f997ecf24c3ec5cc01244ffbe2fdc601d9";
 in
 buildDotnetModule {
   pname = "olympus-unwrapped";
@@ -37,7 +37,7 @@ buildDotnetModule {
     owner = "EverestAPI";
     repo = "Olympus";
     fetchSubmodules = true; # Required. See upstream's README.
-    hash = "sha256-pKKVdCkeqTIFH0iqpko5LuDj9qqLubD+cltkwo86bXg=";
+    hash = "sha256-lj2cBwtalTK5wJrIzKcZKirviodUehqIagL9j61iTyM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/openbangla-keyboard/Cargo.lock b/pkgs/by-name/op/openbangla-keyboard/Cargo.lock
similarity index 100%
rename from pkgs/applications/misc/openbangla-keyboard/Cargo.lock
rename to pkgs/by-name/op/openbangla-keyboard/Cargo.lock
diff --git a/pkgs/applications/misc/openbangla-keyboard/default.nix b/pkgs/by-name/op/openbangla-keyboard/package.nix
similarity index 92%
rename from pkgs/applications/misc/openbangla-keyboard/default.nix
rename to pkgs/by-name/op/openbangla-keyboard/package.nix
index 005345179886..167fc76cc8b7 100644
--- a/pkgs/applications/misc/openbangla-keyboard/default.nix
+++ b/pkgs/by-name/op/openbangla-keyboard/package.nix
@@ -7,19 +7,21 @@
   pkg-config,
   rustPlatform,
   rustc,
-  wrapQtAppsHook,
   fcitx5,
   ibus,
-  qtbase,
+  libsForQt5,
   zstd,
   withFcitx5Support ? false,
-  withIbusSupport ? false,
+  withIbusSupport ? true,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "openbangla-keyboard";
   version = "2.0.0-unstable-2025-08-19";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src = fetchFromGitHub {
     owner = "openbangla";
     repo = "openbangla-keyboard";
@@ -34,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
     cargo
     rustc
     rustPlatform.cargoSetupHook
-    wrapQtAppsHook
+    libsForQt5.wrapQtAppsHook
   ];
 
   buildInputs =
@@ -45,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
       ibus
     ]
     ++ [
-      qtbase
+      libsForQt5.qtbase
       zstd
     ];
 
diff --git a/pkgs/by-name/op/openthread-border-router/package.nix b/pkgs/by-name/op/openthread-border-router/package.nix
index d9b1d429492d..b1c8bc935e02 100644
--- a/pkgs/by-name/op/openthread-border-router/package.nix
+++ b/pkgs/by-name/op/openthread-border-router/package.nix
@@ -17,7 +17,7 @@
   buildNpmPackage,
 }:
 let
-  pname = "ot-br-posix";
+  pname = "openthread-border-router";
   version = "0-unstable-2025-06-12";
 
   src = fetchFromGitHub {
@@ -74,9 +74,7 @@ stdenv.mkDerivation {
   ];
 
   postInstall = ''
-    mkdir -p $out/bin
-    cp ../script/otbr-firewall $out/bin/
-    chmod +x $out/bin/otbr-firewall
+    install -Dm555 -t $out/bin ../script/otbr-firewall
   '';
 
   cmakeFlags = [
diff --git a/pkgs/by-name/pa/pangolin-cli/package.nix b/pkgs/by-name/pa/pangolin-cli/package.nix
index a1422a9e0b74..3671e2371131 100644
--- a/pkgs/by-name/pa/pangolin-cli/package.nix
+++ b/pkgs/by-name/pa/pangolin-cli/package.nix
@@ -10,16 +10,20 @@
 
 buildGoModule (finalAttrs: {
   pname = "pangolin-cli";
-  version = "0.3.3";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "fosrl";
     repo = "cli";
     tag = finalAttrs.version;
-    hash = "sha256-VOb/rmfeJ51MaI37v9+wEDuSmPQyOuKqfGKxY7gtl1c=";
+    hash = "sha256-9uQLCSH7LLl8I/LgsgTo6w808iwmH1FF0GYNn5xyVuc=";
   };
 
-  vendorHash = "sha256-hZj/PDNsWGplSrOgzJtL09/oFXHZ4zdS7BiRS+oy5bw=";
+  ldflags = [
+    "-X github.com/fosrl/cli/internal/version.Version=${finalAttrs.version}"
+  ];
+
+  vendorHash = "sha256-eBrglhyqKy6pG9eF0yfJdCOLxeWys4atKAp9Jgtzdj8=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/pr/proton-vpn-cli/package.nix b/pkgs/by-name/pr/proton-vpn-cli/package.nix
index e0d8b57c46fd..f937c1a2f31c 100644
--- a/pkgs/by-name/pr/proton-vpn-cli/package.nix
+++ b/pkgs/by-name/pr/proton-vpn-cli/package.nix
@@ -9,14 +9,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "proton-vpn-cli";
-  version = "0.1.9";
+  version = "1.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "proton-vpn-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rve97cy4VwZmzZXXj3OiqITDNJgKp9XimtBQ0MFZ8Tk=";
+    hash = "sha256-TIS1vhiOaX0ADKD1WRiPv+WYj0LwHmUuqyctygpaBho=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/re/readest/package.nix b/pkgs/by-name/re/readest/package.nix
index f53582d7fbf7..896207b66451 100644
--- a/pkgs/by-name/re/readest/package.nix
+++ b/pkgs/by-name/re/readest/package.nix
@@ -1,4 +1,5 @@
 {
+  stdenv,
   rustPlatform,
   pnpm_10,
   fetchPnpmDeps,
@@ -21,13 +22,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "readest";
-  version = "0.9.100";
+  version = "0.10.6";
 
   src = fetchFromGitHub {
     owner = "readest";
     repo = "readest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GsIOMfNqjcdtVRZ0XwCkxpQoIonivLJVT4GmZyB86M0=";
+    hash = "sha256-48POUgO6torvLJLXpVzDQLF5sZ2Ws+vhiI1x84+exAw=";
     fetchSubmodules = true;
   };
 
@@ -44,11 +45,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-/bzjOdpvuPLBMvX/q1WaO3lFg5/jLz5Ypr5OojssXUI=";
+    hash = "sha256-4CO0ouas6TAZDaL2J8zr9wR28QB/DVN4y1Cqe8m1FEg=";
   };
 
   cargoRoot = "../..";
-  cargoHash = "sha256-qYBHYjwfGkKmGXN8caamZ6/XGtnxe+lmy6dIpdMwS/I=";
+  cargoHash = "sha256-7wmqDGhtBHU9iOvLrsqGifCEuVdymdljlETkW7dThHA=";
 
   buildAndTestSubdir = "src-tauri";
 
@@ -60,6 +61,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     substituteInPlace src/services/constants.ts \
       --replace-fail "autoCheckUpdates: true" "autoCheckUpdates: false" \
       --replace-fail "telemetryEnabled: true" "telemetryEnabled: false"
+
+    mkdir -p src-tauri/plugins/tauri-plugin-turso/dist-js
+    cp -r ${finalAttrs.passthru.tursoPlugin} src-tauri/plugins/tauri-plugin-turso/dist-js
+    jq '.scripts.build = "true"' \
+      src-tauri/plugins/tauri-plugin-turso/package.json | \
+      sponge src-tauri/plugins/tauri-plugin-turso/package.json
   '';
 
   nativeBuildInputs = [
@@ -89,10 +96,50 @@ rustPlatform.buildRustPackage (finalAttrs: {
   preBuild = ''
     # set up pdfjs and simplecc
     pnpm setup-vendors
+
+    # `tauri-plugin-turso` expects frontend files to exist before the build, else it fails with:
+    #
+    # > > tauri-plugin-turso-api@0.1.0 build /build/source/apps/readest-app/src-tauri/plugins/tauri-plugin-turso
+    # > > true
+    # >
+    # >   Error Unable to find your web assets, did you forget to build your web app?
+    #     Your frontendDist is set to "../out" (which is `/build/source/apps/readest-app/out`).
+    pnpm --filter @readest/readest-app build
   '';
 
   passthru.updateScript = nix-update-script { };
 
+  passthru.tursoPluginDeps = fetchPnpmDeps {
+    pname = "tauri-plugin-turso";
+    version = finalAttrs.version;
+    src = "${finalAttrs.src}/apps/readest-app/src-tauri/plugins/tauri-plugin-turso";
+    pnpm = pnpm_10;
+    fetcherVersion = 3;
+    hash = "sha256-Jf/UaEaLUg/v9ZRInBCEfkDY4d6nwyAIegCMKZe0iAQ=";
+  };
+
+  passthru.tursoPlugin = stdenv.mkDerivation {
+    pname = "tauri-plugin-turso";
+    version = finalAttrs.version;
+    src = "${finalAttrs.src}/apps/readest-app/src-tauri/plugins/tauri-plugin-turso";
+
+    nativeBuildInputs = [
+      pnpm_10
+      pnpmConfigHook
+      nodejs
+    ];
+
+    pnpmDeps = finalAttrs.passthru.tursoPluginDeps;
+
+    buildPhase = ''
+      pnpm build
+    '';
+
+    installPhase = ''
+      cp -r dist-js $out
+    '';
+  };
+
   meta = {
     description = "Modern, feature-rich ebook reader";
     homepage = "https://github.com/readest/readest";
diff --git a/pkgs/by-name/re/redumper/package.nix b/pkgs/by-name/re/redumper/package.nix
index 931a38dc9abf..53c7185fd567 100644
--- a/pkgs/by-name/re/redumper/package.nix
+++ b/pkgs/by-name/re/redumper/package.nix
@@ -9,13 +9,13 @@
 # redumper is using C++ modules, this requires latest C++20 compiler and build tools
 llvmPackages.libcxxStdenv.mkDerivation (finalAttrs: {
   pname = "redumper";
-  version = "708";
+  version = "709";
 
   src = fetchFromGitHub {
     owner = "superg";
     repo = "redumper";
     tag = "b${finalAttrs.version}";
-    hash = "sha256-sn5afjJB50ZyFg7kOalHi+O61LRHMWqOIOV+MxnXcRQ=";
+    hash = "sha256-3J+/v8Rhu5yT+MgAxcNBiHLAPAcNWc/YJXxFMgOZnPs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/se/sentry-native/package.nix b/pkgs/by-name/se/sentry-native/package.nix
index 377248dbbdaa..369c685d668f 100644
--- a/pkgs/by-name/se/sentry-native/package.nix
+++ b/pkgs/by-name/se/sentry-native/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sentry-native";
-  version = "0.13.5";
+  version = "0.13.6";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "sentry-native";
     tag = finalAttrs.version;
-    hash = "sha256-EXuSc1xpRwECrOHWLs2hT4VoRmF6x+lDCeu4J0ma5uQ=";
+    hash = "sha256-4ZHA/sUHAhYwduLPbFQ3Ju8Pjdz14oiIcSvpFMrbkgE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/si/sigma-cli/package.nix b/pkgs/by-name/si/sigma-cli/package.nix
index 12dcdb26e283..2020e082cb7d 100644
--- a/pkgs/by-name/si/sigma-cli/package.nix
+++ b/pkgs/by-name/si/sigma-cli/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "sigma-cli";
-  version = "3.0.0";
+  version = "3.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "SigmaHQ";
     repo = "sigma-cli";
     tag = "v${version}";
-    hash = "sha256-eRPOGI/mK1jFAs56MJ+VSuce95gMKEffba3cR9Sl8k0=";
+    hash = "sha256-BBuiLQXGUc3hDF/Dnbs6dNHBMqz43ZtrtnPXTz8r3kQ=";
   };
 
   pythonRelaxDeps = [ "click" ];
diff --git a/pkgs/by-name/sk/skills/package.nix b/pkgs/by-name/sk/skills/package.nix
index 3bccc55f8cb9..a0a6c5205a03 100644
--- a/pkgs/by-name/sk/skills/package.nix
+++ b/pkgs/by-name/sk/skills/package.nix
@@ -11,19 +11,19 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "skills";
-  version = "1.4.6";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "vercel-labs";
     repo = "skills";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-H2ZUOjYbG2I2OBV4J8dil84cAhSh+j9ovJFbT88JVEo=";
+    hash = "sha256-cdundZSbWn8wXByYeXI4lQ3gWtBj3DkPQ37Py0bL3IY=";
   };
 
   pnpmDeps = fetchPnpmDeps {
-    inherit (finalAttrs) pname version src;
     fetcherVersion = 3;
-    hash = "sha256-pwPJ4CRHEtCXpt5b6g/7EbDsUc2KCjOtpiVED0tqoMk=";
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-0CS6BTjTj/TAnMNahTk4Vt/0/2eMxmCGUV9PwI8l4Ao=";
   };
 
   nativeBuildInputs = [
@@ -47,9 +47,12 @@ stdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
+    rm -rf node_modules
+    pnpm install --force --offline --production --ignore-scripts
+
     mkdir -p $out/lib/node_modules/skills/
     mkdir $out/bin
-    cp -r dist bin package.json $out/lib/node_modules/skills
+    cp -r dist bin node_modules package.json $out/lib/node_modules/skills
 
     ln -s $out/lib/node_modules/skills/bin/cli.mjs $out/bin/skills
     chmod +x $out/bin/skills
diff --git a/pkgs/by-name/sl/slurm/package.nix b/pkgs/by-name/sl/slurm/package.nix
index 0994c3675546..84236504a063 100644
--- a/pkgs/by-name/sl/slurm/package.nix
+++ b/pkgs/by-name/sl/slurm/package.nix
@@ -42,7 +42,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "slurm";
-  version = "25-11-4-1";
+  version = "25-11-5-1";
 
   # N.B. We use github release tags instead of https://www.schedmd.com/downloads.php
   # because the latter does not keep older releases.
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     repo = "slurm";
     # The release tags use - instead of .
     rev = "slurm-${builtins.replaceStrings [ "." ] [ "-" ] finalAttrs.version}";
-    hash = "sha256-5axewcMS7+S9R7aQUlQH24M8+AeqO1/qNv+WZMkVDUc=";
+    hash = "sha256-YGENCN4Ge8wftpSNSA9zw2xV0Ltd0wJMROY+fwOREE8=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/st/strichliste/frontend.nix b/pkgs/by-name/st/strichliste/frontend.nix
new file mode 100644
index 000000000000..a30c4fff3766
--- /dev/null
+++ b/pkgs/by-name/st/strichliste/frontend.nix
@@ -0,0 +1,43 @@
+{
+  stdenv,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  nodejs,
+  yarnConfigHook,
+  yarnBuildHook,
+  meta,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "strichliste-frontend";
+  version = "2.0.0";
+
+  src = fetchFromGitHub {
+    owner = "strichliste";
+    repo = "strichliste-web-frontend";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-fi4pz3ylWyC4yvDWsK2Rvv8KDaXeHNVz0jY6PpF07hE=";
+  };
+
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = finalAttrs.src + "/yarn.lock";
+    hash = "sha256-leMwcsyhbxPoHJdA3kZDz97Ti77d1TCe8SrzTQMGrWo=";
+  };
+
+  env.NODE_OPTIONS = "--openssl-legacy-provider";
+
+  nativeBuildInputs = [
+    nodejs
+    yarnConfigHook
+    yarnBuildHook
+  ];
+
+  installPhase = ''
+    mkdir $out
+    cp -R build/* $out/
+  '';
+
+  __structuredAttrs = true;
+
+  inherit meta;
+})
diff --git a/pkgs/by-name/st/strichliste/package.nix b/pkgs/by-name/st/strichliste/package.nix
new file mode 100644
index 000000000000..d26d2dfef174
--- /dev/null
+++ b/pkgs/by-name/st/strichliste/package.nix
@@ -0,0 +1,55 @@
+{
+  callPackage,
+  fetchFromGitHub,
+  lib,
+  pkgs,
+  php ? pkgs.php85,
+  nixosTests,
+}:
+
+php.buildComposerProject2 (finalAttrs: {
+  pname = "strichliste-backend";
+  version = "2.0.1";
+
+  src = fetchFromGitHub {
+    owner = "strichliste";
+    repo = "strichliste-backend";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-yI20cUp19ehtOnWdu+MItwgOlNDnt1VK3giInaTQQ4Y=";
+  };
+
+  vendorHash = "sha256-vYPjUaNIf62GoKXopC4nGqIa+Z3C8Q5dnX9FPvM1Ers=";
+  composerNoDev = true;
+  composerStrictValidation = false;
+
+  postPatch = ''
+    substituteInPlace config/services.yaml \
+      --replace-fail "strichliste.yaml" "/etc/strichliste.yaml"
+  '';
+
+  postInstall = ''
+    mkdir $out/bin
+    ln -s $out/share/php/strichliste-backend/bin/console $out/bin/strichliste-console
+  '';
+
+  __structuredAttrs = true;
+
+  passthru = {
+    frontend = callPackage ./frontend.nix {
+      inherit (finalAttrs) meta;
+    };
+    phpPackage = php;
+    tests = {
+      inherit (nixosTests) strichliste;
+    };
+  };
+
+  meta = {
+    description = "strichliste is a tool to replace a tally sheet.";
+    homepage = "https://www.strichliste.org/";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ hexa ];
+    mainProgram = "strichliste-console";
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/ve/vendir/package.nix b/pkgs/by-name/ve/vendir/package.nix
index 0045297c6573..1e9771badd48 100644
--- a/pkgs/by-name/ve/vendir/package.nix
+++ b/pkgs/by-name/ve/vendir/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "vendir";
-  version = "0.45.2";
+  version = "0.45.3";
 
   src = fetchFromGitHub {
     owner = "vmware-tanzu";
     repo = "carvel-vendir";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-2qcaAuLevtP5pouFuENiKneTJs0/k7ftDaFuKjVVIow=";
+    sha256 = "sha256-pGChtADYje6tGM0qYTwSrGQkUu6P1N8AZiXLJDWoYjA=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/wa/wakatime-cli/package.nix b/pkgs/by-name/wa/wakatime-cli/package.nix
index 3d7810aae7e0..ee5c5280806f 100644
--- a/pkgs/by-name/wa/wakatime-cli/package.nix
+++ b/pkgs/by-name/wa/wakatime-cli/package.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   buildGoModule,
   fetchFromGitHub,
   testers,
@@ -10,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "wakatime-cli";
-  version = "2.2.0";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "wakatime";
     repo = "wakatime-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TOdAcT+IS6XONIfkASRvd7oTSSW5VX8w5q5ASvJlQb8=";
+    hash = "sha256-t0HKRN7qguE+zhyI3fbBtuhpDAPZrbMS9wa8crQkLhc=";
   };
 
   vendorHash = "sha256-HngszNLX2b2EVvh8ovouIEvjBOJL1jA5AhA6Y11ke9Y=";
@@ -27,23 +26,14 @@ buildGoModule (finalAttrs: {
     "-X github.com/wakatime/wakatime-cli/pkg/version.Version=${finalAttrs.version}"
   ];
 
-  # dial tcp 127.0.0.1:51272: connect: operation not permitted
-  # and goroutine 33 [IO wait, 10 minutes] on darwin
-  doCheck = !stdenv.hostPlatform.isDarwin;
+  __darwinAllowLocalNetworking = true;
 
   nativeCheckInputs = [ writableTmpDirAsHomeHook ];
 
   checkFlags =
     let
       skippedTests = [
-        # Tests requiring network
-        "TestFileExperts"
-        "TestSendHeartbeats"
-        "TestSendHeartbeats_ExtraHeartbeats"
-        "TestSendHeartbeats_IsUnsavedEntity"
-        "TestSendHeartbeats_NonExistingExtraHeartbeatsEntity"
-        "TestSendHeartbeats_ExtraHeartbeatsIsUnsavedEntity"
-        "TestFileExperts_Err(Auth|Api|BadRequest)"
+        "TestLoadParams_APIKey_FromVault_Err_Darwin"
       ];
     in
     [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
diff --git a/pkgs/by-name/wh/wheelwizard/package.nix b/pkgs/by-name/wh/wheelwizard/package.nix
index 3da38ae29c54..2e450dc8d850 100644
--- a/pkgs/by-name/wh/wheelwizard/package.nix
+++ b/pkgs/by-name/wh/wheelwizard/package.nix
@@ -14,13 +14,13 @@
 }:
 buildDotnetModule rec {
   pname = "wheelwizard";
-  version = "2.4.3";
+  version = "2.4.4";
 
   src = fetchFromGitHub {
     owner = "TeamWheelWizard";
     repo = "WheelWizard";
     tag = version;
-    hash = "sha256-WJVEofU41ZoOYLgD2TMPy50KQ44SPuLKS2piRmI9wV8=";
+    hash = "sha256-uuEAJPV3P9SRs77nDC9nR3XtnGJreD+H1Xweyx4tU2s=";
   };
   postPatch = ''
     rm .config/dotnet-tools.json
diff --git a/pkgs/by-name/xr/xremap/package.nix b/pkgs/by-name/xr/xremap/package.nix
index fef979ea4001..f94197d0e164 100644
--- a/pkgs/by-name/xr/xremap/package.nix
+++ b/pkgs/by-name/xr/xremap/package.nix
@@ -58,13 +58,13 @@ assert (
 );
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "xremap${variant.suffix or ""}";
-  version = "0.15.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "xremap";
     repo = "xremap";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8IryQGSAxIVQiGGiY3trDvvJ50c19LHP4KvIa3P0zII=";
+    hash = "sha256-PvhpPdgAnCT8HaPEQHdTSympmGqRAK9/t3T5KEHovMM=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -72,7 +72,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   buildNoDefaultFeatures = true;
   buildFeatures = variant.features;
 
-  cargoHash = "sha256-5vDKb6S4G+oNm//WtGsr4kEthozoznzn2N8ajtiMIeY=";
+  cargoHash = "sha256-t32EVL8btJEeqWL5601+6pptT/Mt4KxMeVVlNo/nw5k=";
 
   passthru = lib.mapAttrs (name: lib.const (xremap.override { withVariant = name; })) variants;
 
diff --git a/pkgs/by-name/yg/yggdrasil-ng/package.nix b/pkgs/by-name/yg/yggdrasil-ng/package.nix
new file mode 100644
index 000000000000..7af423a0b2de
--- /dev/null
+++ b/pkgs/by-name/yg/yggdrasil-ng/package.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+rustPlatform.buildRustPackage (oldAttrs: {
+  pname = "yggdrasil-ng";
+  version = "0.1.4";
+
+  src = fetchFromGitHub {
+    owner = "Revertron";
+    repo = "Yggdrasil-ng";
+    tag = "v${oldAttrs.version}";
+    hash = "sha256-AutOV1FXBeiG9CNoVSili3sF+QndZI2L7b72jdPOe5E=";
+  };
+
+  cargoHash = "sha256-9/whbfM5fMZT6COo2HvdCmeCFC93NI1GXhGNAAaTiLM=";
+
+  __structuredAttrs = true;
+
+  meta = {
+    mainProgram = "telemt";
+    description = "Yggdrasil Network rewritten in Rust";
+    homepage = "https://github.com/Revertron/Yggdrasil-ng";
+    license = with lib.licenses; [ mpl20 ];
+    maintainers = with lib.maintainers; [
+      r4v3n6101
+      malik
+    ];
+  };
+})
diff --git a/pkgs/by-name/yu/yubikey-manager/package.nix b/pkgs/by-name/yu/yubikey-manager/package.nix
index 88e7a318aed9..c9047d500930 100644
--- a/pkgs/by-name/yu/yubikey-manager/package.nix
+++ b/pkgs/by-name/yu/yubikey-manager/package.nix
@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "yubikey-manager";
-  version = "5.9.0";
+  version = "5.9.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Yubico";
     repo = "yubikey-manager";
     tag = version;
-    hash = "sha256-8SWuhuFeMRIskJRxeb67gA3gdhSDf/vnrYHra6t71Bc=";
+    hash = "sha256-ldJZWKzXDyBTHkrhiIRI4RFCBEZxVPiHBqzmcCT7PYc=";
   };
 
   postPatch = ''
diff --git a/pkgs/desktops/lomiri/applications/morph-browser/default.nix b/pkgs/desktops/lomiri/applications/morph-browser/default.nix
index 7826a4abb3a1..346d7b05cf01 100644
--- a/pkgs/desktops/lomiri/applications/morph-browser/default.nix
+++ b/pkgs/desktops/lomiri/applications/morph-browser/default.nix
@@ -34,13 +34,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "morph-browser";
-  version = "1.99.3";
+  version = "1.99.4";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/core/morph-browser";
     tag = finalAttrs.version;
-    hash = "sha256-zSpgcOiudt1UIsW5tRGA5AmguJn2q4+XR/G8UCqxePk=";
+    hash = "sha256-gVRaM4pnQlfwRKYVsXk4wO79FgNJ60QBn0X2QZE+8a4=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/science/math/suitesparse/default.nix b/pkgs/development/libraries/science/math/suitesparse/default.nix
index d9ae4221d718..4cb0c4260e6c 100644
--- a/pkgs/development/libraries/science/math/suitesparse/default.nix
+++ b/pkgs/development/libraries/science/math/suitesparse/default.nix
@@ -12,7 +12,7 @@
   config,
   enableCuda ? config.cudaSupport,
   cudaPackages,
-  openmp ? null,
+  llvmPackages,
 }@inputs:
 
 let
@@ -36,14 +36,13 @@ effectiveStdenv.mkDerivation rec {
     sha256 = "sha256-Anen1YtXsSPhk8DpA4JtADIz9m8oXFl9umlkb4iImf8=";
   };
 
-  nativeBuildInputs = [
-  ]
-  ++ lib.optionals effectiveStdenv.hostPlatform.isDarwin [
-    fixDarwinDylibNames
-  ]
-  ++ lib.optionals enableCuda [
-    cudaPackages.cuda_nvcc
-  ];
+  nativeBuildInputs =
+    lib.optionals effectiveStdenv.hostPlatform.isDarwin [
+      fixDarwinDylibNames
+    ]
+    ++ lib.optionals enableCuda [
+      cudaPackages.cuda_nvcc
+    ];
 
   # Use compatible indexing for lapack and blas used
   buildInputs =
@@ -57,7 +56,7 @@ effectiveStdenv.mkDerivation rec {
       mpfr
     ]
     ++ lib.optionals effectiveStdenv.cc.isClang [
-      openmp
+      llvmPackages.openmp
     ]
     ++ lib.optionals enableCuda [
       cudaPackages.cuda_cudart
diff --git a/pkgs/development/lua-modules/overrides.nix b/pkgs/development/lua-modules/overrides.nix
index c3983d8fe62a..c77a212952f8 100644
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -885,6 +885,20 @@ in
   });
 
   neorg = prev.neorg.overrideAttrs {
+
+    doCheck = true;
+    nativeCheckInputs = [
+      final.nlua
+      final.bustedCheckHook
+      writableTmpDirAsHomeHook
+    ];
+
+    nvimSkipModules = [
+      "neorg.modules.core.dirman.tests"
+      "neorg.modules.core.ui.module"
+      "neorg.modules.core.concealer.module"
+    ];
+
     # Relax dependencies
     postConfigure = ''
       substituteInPlace ''${rockspecFilename} \
diff --git a/pkgs/development/python-modules/claude-agent-sdk/default.nix b/pkgs/development/python-modules/claude-agent-sdk/default.nix
index 124311c7abaa..4b2cbf44a304 100644
--- a/pkgs/development/python-modules/claude-agent-sdk/default.nix
+++ b/pkgs/development/python-modules/claude-agent-sdk/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "claude-agent-sdk";
-  version = "0.1.59";
+  version = "0.1.60";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "anthropics";
     repo = "claude-agent-sdk-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fKPY/ORxIvwJ7MI6gkBQv0Ydy5rPRszQ+/1HvIIzOEA=";
+    hash = "sha256-4pDR8YkzF5tt6JlWN5zfNxQah7hz97bqeputPUstqfY=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/dask-gateway-server/default.nix b/pkgs/development/python-modules/dask-gateway-server/default.nix
index 855cb0685cc7..3e6954afa2af 100644
--- a/pkgs/development/python-modules/dask-gateway-server/default.nix
+++ b/pkgs/development/python-modules/dask-gateway-server/default.nix
@@ -7,6 +7,7 @@
   fetchFromGitHub,
   go,
   pykerberos,
+  hatchling,
   skein,
   sqlalchemy,
   traitlets,
@@ -15,7 +16,7 @@
 buildPythonPackage rec {
   pname = "dask-gateway-server";
   version = "2025.4.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dask";
@@ -28,7 +29,9 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [ go ];
 
-  propagatedBuildInputs = [
+  build-system = [ hatchling ];
+
+  dependencies = [
     aiohttp
     colorlog
     cryptography
diff --git a/pkgs/development/python-modules/deep-ep/default.nix b/pkgs/development/python-modules/deep-ep/default.nix
index a26eafdd22e9..38309a06f988 100644
--- a/pkgs/development/python-modules/deep-ep/default.nix
+++ b/pkgs/development/python-modules/deep-ep/default.nix
@@ -64,13 +64,7 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
     {
       TORCH_CUDA_ARCH_LIST = "${lib.concatStringsSep " " cudaCapabilities'}";
 
-      DISABLE_SM90_FEATURES =
-        if disableSm90Features then
-          lib.warn ''
-            python3Packages.deepep: Disabling SM90 features as the provided `cudaCapabilities` list include '${minCudaCapability}'
-          '' "1"
-        else
-          "0";
+      DISABLE_SM90_FEATURES = if disableSm90Features then "1" else "0";
 
       CUDA_HOME = symlinkJoin {
         name = "cuda-redist";
diff --git a/pkgs/development/python-modules/django-modeltranslation/default.nix b/pkgs/development/python-modules/django-modeltranslation/default.nix
index 5c829c48eefb..d55eca8dede7 100644
--- a/pkgs/development/python-modules/django-modeltranslation/default.nix
+++ b/pkgs/development/python-modules/django-modeltranslation/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "django-modeltranslation";
-  version = "0.20.2";
+  version = "0.20.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "deschler";
     repo = "django-modeltranslation";
     tag = "v${version}";
-    hash = "sha256-zjCasSZzIviCBDHyKwQlS0lR5S01AmMjBnWG/iEEJO4=";
+    hash = "sha256-DlghTCh2bcY+jHOYhQWVzMRGNKRIiQkLt4ZHDLVxUUs=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/langsmith/default.nix b/pkgs/development/python-modules/langsmith/default.nix
index 97a2cd4a0092..88ca442fc4ce 100644
--- a/pkgs/development/python-modules/langsmith/default.nix
+++ b/pkgs/development/python-modules/langsmith/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
 
@@ -87,6 +88,10 @@ buildPythonPackage (finalAttrs: {
     "test_as_runnable_batch"
     "test_as_runnable_async"
     "test_as_runnable_async_batch"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # flaky (timing sensitive)
+    "test_refresh_loop_continues_after_500_errors"
   ];
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/polyswarm-api/default.nix b/pkgs/development/python-modules/polyswarm-api/default.nix
index 3d4c6c99a9f3..5e6ae712199c 100644
--- a/pkgs/development/python-modules/polyswarm-api/default.nix
+++ b/pkgs/development/python-modules/polyswarm-api/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "polyswarm-api";
-  version = "3.17.1";
+  version = "3.18.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "polyswarm";
     repo = "polyswarm-api";
     tag = finalAttrs.version;
-    hash = "sha256-nL+DolLBnw/yahNqeCYtepAMFw4yHWXTajz3+KxF9R8=";
+    hash = "sha256-Mrw+/SbDhfVfC651EHcItf2x2/97kj8ePpxfAQYxBXc=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/proton-vpn-api-core/default.nix b/pkgs/development/python-modules/proton-vpn-api-core/default.nix
index ad2a3c8e73cf..67a4266df83d 100644
--- a/pkgs/development/python-modules/proton-vpn-api-core/default.nix
+++ b/pkgs/development/python-modules/proton-vpn-api-core/default.nix
@@ -27,14 +27,14 @@
 
 buildPythonPackage rec {
   pname = "proton-vpn-api-core";
-  version = "4.18.0";
+  version = "4.19.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "python-proton-vpn-api-core";
     rev = "v${version}";
-    hash = "sha256-dyMSyGkeyYXVKAhkmQpq2w4zCFk3fz1qEVECOVl8jEI=";
+    hash = "sha256-PD/UQ+BoDO6firhlBJDRNrtiHgnp+4uIb8j+egXqxPA=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/py-netgear-plus/default.nix b/pkgs/development/python-modules/py-netgear-plus/default.nix
index 275787b249b3..dd59e7ebeb18 100644
--- a/pkgs/development/python-modules/py-netgear-plus/default.nix
+++ b/pkgs/development/python-modules/py-netgear-plus/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "py-netgear-plus";
-  version = "0.4.7";
+  version = "0.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "foxey";
     repo = "py-netgear-plus";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HoHXqAqVPqaw7WkRCi5AJ2dKG8IZX7l7bTp22KZBzdU=";
+    hash = "sha256-8cFaNDgOrsoDkOb6m5dJmd+vzUe11RyTOhd49JOygkA=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/pyvicare/default.nix b/pkgs/development/python-modules/pyvicare/default.nix
index fb831f680f88..76daf778942e 100644
--- a/pkgs/development/python-modules/pyvicare/default.nix
+++ b/pkgs/development/python-modules/pyvicare/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyvicare";
-  version = "2.58.1";
+  version = "2.59.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "openviess";
     repo = "PyViCare";
     tag = finalAttrs.version;
-    hash = "sha256-yCi+Eu3PsxSsvfzoxvTg5FE5wUEtGm4GT1pkzkeNVmI=";
+    hash = "sha256-dy6VFVisQXWB46pdltP2Ww/WyAyQ1igLn8LiSGHPKa8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index da45387f51fb..207ebd047b91 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.78";
+  version = "3.1.79";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = finalAttrs.version;
-    hash = "sha256-hcRbJly7dkCopzTHwwOD77ec8MJh3/2LYuBfh0d55Wc=";
+    hash = "sha256-4RedYjoUdwHfq2232jmoXgS6t115/RR2LfO2IyDOk1U=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/tuya-device-handlers/default.nix b/pkgs/development/python-modules/tuya-device-handlers/default.nix
index da795e3d041a..fef726756115 100644
--- a/pkgs/development/python-modules/tuya-device-handlers/default.nix
+++ b/pkgs/development/python-modules/tuya-device-handlers/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tuya-device-handlers";
-  version = "0.0.16";
+  version = "0.0.17";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = "tuya-device-handlers";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DuMG0nItXwJYl4c3JprA308+qyFzEemt2QS/sJ8kvlU=";
+    hash = "sha256-T3jwUeRVSAiRSzyIOo7M046C+Dul1/1I9kZj0OzIIcs=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/twentemilieu/default.nix b/pkgs/development/python-modules/twentemilieu/default.nix
index 9698aa8c9b02..788f5770badf 100644
--- a/pkgs/development/python-modules/twentemilieu/default.nix
+++ b/pkgs/development/python-modules/twentemilieu/default.nix
@@ -1,32 +1,35 @@
 {
   lib,
   aiohttp,
-  aresponses,
+  aioresponses,
   buildPythonPackage,
   fetchFromGitHub,
   poetry-core,
   pytest-asyncio,
   pytest-cov-stub,
   pytestCheckHook,
+  rich,
+  syrupy,
+  typer,
   yarl,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "twentemilieu";
-  version = "2.2.1";
+  version = "3.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "frenck";
     repo = "python-twentemilieu";
-    tag = "v${version}";
-    hash = "sha256-N6XSf212orMf3vqIjBzu+4fpKX7kFinH180lCWXtjzc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-RSUKluCE66oA0QbPlJ3niIuewvBxPmj18ZCUBNCFr4o=";
   };
 
   postPatch = ''
     # Upstream is creating GitHub releases without version
     substituteInPlace pyproject.toml \
-      --replace '"0.0.0"' '"${version}"'
+      --replace '"0.0.0"' '"${finalAttrs.version}"'
   '';
 
   build-system = [ poetry-core ];
@@ -36,20 +39,29 @@ buildPythonPackage rec {
     yarl
   ];
 
+  optional-dependencies = {
+    cli = [
+      rich
+      typer
+    ];
+  };
+
   nativeCheckInputs = [
-    aresponses
+    aioresponses
     pytest-asyncio
     pytest-cov-stub
     pytestCheckHook
-  ];
+    syrupy
+  ]
+  ++ lib.flatten (builtins.attrValues finalAttrs.passthru.optional-dependencies);
 
   pythonImportsCheck = [ "twentemilieu" ];
 
   meta = {
     description = "Python client for Twente Milieu";
     homepage = "https://github.com/frenck/python-twentemilieu";
-    changelog = "https://github.com/frenck/python-twentemilieu/releases/tag/v${version}";
+    changelog = "https://github.com/frenck/python-twentemilieu/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/waterfurnace/default.nix b/pkgs/development/python-modules/waterfurnace/default.nix
index 8e07a8ecbd30..7a91baa2a20b 100644
--- a/pkgs/development/python-modules/waterfurnace/default.nix
+++ b/pkgs/development/python-modules/waterfurnace/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "waterfurnace";
-  version = "1.6.4";
+  version = "1.6.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "sdague";
     repo = "waterfurnace";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Eh9jmq4VWSDFjU4aFppuJmd1ym8ZAC1/CdSe0iq6ds0=";
+    hash = "sha256-cPYFa3/0IoCiVfJqCtfUbaVrd3cyOMpZbPEuviHLz6c=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/webexpythonsdk/default.nix b/pkgs/development/python-modules/webexpythonsdk/default.nix
index dd3d854a42a2..07c661188159 100644
--- a/pkgs/development/python-modules/webexpythonsdk/default.nix
+++ b/pkgs/development/python-modules/webexpythonsdk/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "webexpythonsdk";
-  version = "2.0.5";
+  version = "2.0.6";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "WebexCommunity";
     repo = "WebexPythonSDK";
     tag = "v${version}";
-    hash = "sha256-iRhl/JCktS+6yJhvMZ6Vv7oOF5ZVrPQiI4Bstsub0bM=";
+    hash = "sha256-2yyGR5gCJVRsEnoPAr8tkMeG19vTfATl/ybuMydnplU=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/whodap/default.nix b/pkgs/development/python-modules/whodap/default.nix
index 51488677a3cb..e74b34a16cd6 100644
--- a/pkgs/development/python-modules/whodap/default.nix
+++ b/pkgs/development/python-modules/whodap/default.nix
@@ -8,18 +8,24 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "whodap";
-  version = "0.1.14";
+  version = "0.1.15";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pogzyb";
     repo = "whodap";
-    tag = "v${version}";
-    hash = "sha256-VSFtHjdG9pJAryGUgwI0NxxaW0JiXEHU7aVvXYxymtc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-PEKFO+mVGtagmH2rny8zorvi9/zadWh+fiJqBc/NA+E=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "setuptools==82.0.1" "setuptools" \
+      --replace-fail "wheel==0.46.3" "wheel"
+  '';
+
   build-system = [ setuptools ];
 
   dependencies = [ httpx ];
@@ -39,8 +45,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python RDAP utility for querying and parsing information about domain names";
     homepage = "https://github.com/pogzyb/whodap";
-    changelog = "https://github.com/pogzyb/whodap/releases/tag/${src.tag}";
+    changelog = "https://github.com/pogzyb/whodap/releases/tag/v${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index aee66f2f36e0..b97d9936bff9 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -34,10 +34,10 @@
 }@pkgs:
 
 let
-  defaultVersion = "2026.01";
+  defaultVersion = "2026.04";
   defaultSrc = fetchurl {
     url = "https://ftp.denx.de/pub/u-boot/u-boot-${defaultVersion}.tar.bz2";
-    hash = "sha256-tg1YZc79vHXajaQVbFbEWOAN51pJuAwaLlipbjCtDVQ=";
+    hash = "sha256-rHwEuLcASSOwCk5dZpnF300hIzusn9ppDYz7wgn/8v0=";
   };
 
   # Dependencies for the tools need to be included as either native or cross,
diff --git a/pkgs/servers/monitoring/grafana/plugins/grafana-exploretraces-app/default.nix b/pkgs/servers/monitoring/grafana/plugins/grafana-exploretraces-app/default.nix
index cc3eafbf20e1..c1346fcb543d 100644
--- a/pkgs/servers/monitoring/grafana/plugins/grafana-exploretraces-app/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/grafana-exploretraces-app/default.nix
@@ -2,8 +2,8 @@
 
 grafanaPlugin {
   pname = "grafana-exploretraces-app";
-  version = "2.0.0";
-  zipHash = "sha256-frwg9f6F/qwdDCyGzxyVvOt/VdAKAeoSc6T20MesRWk=";
+  version = "2.0.1";
+  zipHash = "sha256-tollhGibyN4SCx1WjMiWbQMcdDGHs7yom1/L078JFhE=";
   meta = {
     description = "Opinionated traces app";
     license = lib.licenses.agpl3Only;
diff --git a/pkgs/tools/networking/flannel/default.nix b/pkgs/tools/networking/flannel/default.nix
index 1bc0248ee2b1..ab3a435eb0fe 100644
--- a/pkgs/tools/networking/flannel/default.nix
+++ b/pkgs/tools/networking/flannel/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "flannel";
-  version = "0.28.2";
+  version = "0.28.4";
   rev = "v${version}";
 
-  vendorHash = "sha256-80hrkaY2Kh318EX1Mosm1GP7aXYKvAdPAe+6LR8yuEk=";
+  vendorHash = "sha256-dn5XNwD3OPLrppxCM+B50uetBxLIuvFZUFZfWR/lCoY=";
 
   src = fetchFromGitHub {
     inherit rev;
     owner = "flannel-io";
     repo = "flannel";
-    sha256 = "sha256-/vw5534Ve8P5hiVmSiMD/lbns8zq2h3WCEZXB56ha4E=";
+    sha256 = "sha256-lrT2rbMzE9Kx4s84TdSs6GdeWfbaJA0PeweoLJ5ZvR0=";
   };
 
   ldflags = [ "-X github.com/flannel-io/flannel/pkg/version.Version=${rev}" ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f6937e0566c0..112b010110ce 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2042,10 +2042,6 @@ with pkgs;
     mozc = mozc.override { withIbus = true; };
     mozc-ut = mozc-ut.override { withIbus = true; };
 
-    openbangla-keyboard = libsForQt5.callPackage ../applications/misc/openbangla-keyboard {
-      withIbusSupport = true;
-    };
-
     pinyin = callPackage ../tools/inputmethods/ibus-engines/ibus-pinyin { };
 
     rime = callPackage ../tools/inputmethods/ibus-engines/ibus-rime { };
@@ -2276,10 +2272,6 @@ with pkgs;
 
   fcitx5-m17n = callPackage ../tools/inputmethods/fcitx5/fcitx5-m17n.nix { };
 
-  fcitx5-openbangla-keyboard = libsForQt5.callPackage ../applications/misc/openbangla-keyboard {
-    withFcitx5Support = true;
-  };
-
   fcitx5-gtk = callPackage ../tools/inputmethods/fcitx5/fcitx5-gtk.nix { };
 
   fcitx5-hangul = callPackage ../tools/inputmethods/fcitx5/fcitx5-hangul.nix { };
@@ -11474,10 +11466,7 @@ with pkgs;
     lapack = lapack-ilp64;
   };
 
-  suitesparse_5_3 = callPackage ../development/libraries/science/math/suitesparse {
-    inherit (llvmPackages) openmp;
-  };
-  suitesparse = suitesparse_5_3;
+  suitesparse = callPackage ../development/libraries/science/math/suitesparse { };
 
   trilinos-mpi = trilinos.override { withMPI = true; };
 
diff --git a/pkgs/top-level/release-alternatives.nix b/pkgs/top-level/release-alternatives.nix
index d988265f7735..2b8e9c37daf8 100644
--- a/pkgs/top-level/release-alternatives.nix
+++ b/pkgs/top-level/release-alternatives.nix
@@ -18,7 +18,7 @@ let
     "rspamd"
     "octopus"
     "superlu"
-    "suitesparse_5_3"
+    "suitesparse"
     "scs"
     "scalapack"
     "petsc"
@@ -94,7 +94,7 @@ let
   blas64Users = [
     "rspamd"
     "sundials"
-    "suitesparse_5_3"
+    "suitesparse"
     "petsc"
     "cholmod-extra"
     "arpack"