diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 71ba2b99d6c6..bf83fdd32167 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -52,7 +52,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@7be5dee1421f63d07e71ce6e0a9f8a4b07c2a487 # v31
+      - uses: cachix/install-nix-action@a809471b5c7c913aa67bec8f459a11a0decc3fce # v31
         with:
           # Sandbox is disabled on MacOS by default.
           extra_nix_config: sandbox = true
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 408ba7369e62..15db37f6c99e 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -96,7 +96,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@7be5dee1421f63d07e71ce6e0a9f8a4b07c2a487 # v31
+      - uses: cachix/install-nix-action@a809471b5c7c913aa67bec8f459a11a0decc3fce # v31
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         with:
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index eaf1ac35bb6e..5ef33f4dc34b 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -47,7 +47,7 @@ jobs:
             ci/pinned.json
 
       - name: Install Nix
-        uses: cachix/install-nix-action@7be5dee1421f63d07e71ce6e0a9f8a4b07c2a487 # v31
+        uses: cachix/install-nix-action@a809471b5c7c913aa67bec8f459a11a0decc3fce # v31
 
       - name: Load supported versions
         id: versions
@@ -92,7 +92,7 @@ jobs:
           target-as-trusted-at: ${{ inputs.targetSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@7be5dee1421f63d07e71ce6e0a9f8a4b07c2a487 # v31
+        uses: cachix/install-nix-action@a809471b5c7c913aa67bec8f459a11a0decc3fce # v31
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         with:
@@ -190,7 +190,7 @@ jobs:
           merge-multiple: true
 
       - name: Install Nix
-        uses: cachix/install-nix-action@7be5dee1421f63d07e71ce6e0a9f8a4b07c2a487 # v31
+        uses: cachix/install-nix-action@a809471b5c7c913aa67bec8f459a11a0decc3fce # v31
 
       - name: Combine all output paths and eval stats
         run: |
@@ -350,7 +350,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@7be5dee1421f63d07e71ce6e0a9f8a4b07c2a487 # v31
+        uses: cachix/install-nix-action@a809471b5c7c913aa67bec8f459a11a0decc3fce # v31
 
       - name: Run misc eval tasks in parallel
         run: |
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index f3d4a8360f1b..39a99acf3f32 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -32,7 +32,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@7be5dee1421f63d07e71ce6e0a9f8a4b07c2a487 # v31
+      - uses: cachix/install-nix-action@a809471b5c7c913aa67bec8f459a11a0decc3fce # v31
 
       # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
       # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -66,7 +66,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@7be5dee1421f63d07e71ce6e0a9f8a4b07c2a487 # v31
+      - uses: cachix/install-nix-action@a809471b5c7c913aa67bec8f459a11a0decc3fce # v31
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         with:
@@ -94,7 +94,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@7be5dee1421f63d07e71ce6e0a9f8a4b07c2a487 # v31
+      - uses: cachix/install-nix-action@a809471b5c7c913aa67bec8f459a11a0decc3fce # v31
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         with:
diff --git a/.github/workflows/reviewers.yml b/.github/workflows/reviewers.yml
index 3d5d08f8d7cf..c6f94acbec36 100644
--- a/.github/workflows/reviewers.yml
+++ b/.github/workflows/reviewers.yml
@@ -33,7 +33,7 @@ jobs:
           sparse-checkout: ci
 
       - name: Install Nix
-        uses: cachix/install-nix-action@7be5dee1421f63d07e71ce6e0a9f8a4b07c2a487 # v31
+        uses: cachix/install-nix-action@a809471b5c7c913aa67bec8f459a11a0decc3fce # v31
 
       - name: Build the requestReviews derivation
         run: nix-build trusted/ci -A requestReviews
diff --git a/ci/pinned.json b/ci/pinned.json
index 14a454c2e258..7f922fff0fe0 100644
--- a/ci/pinned.json
+++ b/ci/pinned.json
@@ -9,9 +9,9 @@
       },
       "branch": "nixpkgs-unstable",
       "submodules": false,
-      "revision": "641d909c4a7538f1539da9240dedb1755c907e40",
-      "url": "https://github.com/NixOS/nixpkgs/archive/641d909c4a7538f1539da9240dedb1755c907e40.tar.gz",
-      "hash": "10hpb1aw884k3zzcy1mhf47dqvfagiyx7kr6hg0p5xcwg04mkx8x"
+      "revision": "a1f79a1770d05af18111fbbe2a3ab2c42c0f6cd0",
+      "url": "https://github.com/NixOS/nixpkgs/archive/a1f79a1770d05af18111fbbe2a3ab2c42c0f6cd0.tar.gz",
+      "hash": "06lqp08pfgnsn8kb4kdpjmmjyhj4bgniv7yf9bjczg4kn25l1dz6"
     },
     "treefmt-nix": {
       "type": "Git",
@@ -22,9 +22,9 @@
       },
       "branch": "main",
       "submodules": false,
-      "revision": "7d81f6fb2e19bf84f1c65135d1060d829fae2408",
-      "url": "https://github.com/numtide/treefmt-nix/archive/7d81f6fb2e19bf84f1c65135d1060d829fae2408.tar.gz",
-      "hash": "1cg20q8ja8k2nb7mzy95hgmd8whxapc3fbyndh1ip5dr6d1grxfs"
+      "revision": "128222dc911b8e2e18939537bed1762b7f3a04aa",
+      "url": "https://github.com/numtide/treefmt-nix/archive/128222dc911b8e2e18939537bed1762b7f3a04aa.tar.gz",
+      "hash": "1p81chik0sb8aligng579m4h0klnndxv76z0p4gyhr4g3s9cydpw"
     }
   },
   "version": 5
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 4adac94f9526..09ca05897dba 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1361,7 +1361,7 @@
     name = "Amaan Qureshi";
   };
   amadaluzia = {
-    email = "amad@atl.tools";
+    email = "amadaluzia@disroot.org";
     github = "amadaluzia";
     githubId = 188314694;
     name = "Artur Manuel";
@@ -8330,6 +8330,12 @@
     keys = [ { fingerprint = "7391 BF2D A2C3 B2C9 BE25  ACA9 C7A7 4616 F302 5DF4"; } ];
     matrix = "@felipeqq2:pub.solar";
   };
+  felissedano = {
+    name = "Felis Sedano";
+    email = "contact@felissedano.com";
+    github = "felissedano";
+    githubId = 109383955;
+  };
   felixalbrigtsen = {
     email = "felix@albrigtsen.it";
     github = "felixalbrigtsen";
@@ -15289,6 +15295,12 @@
     githubId = 208297;
     name = "Luz";
   };
+  lwb-2021 = {
+    email = "lwb-2021@qq.com";
+    github = "lwb-2021";
+    githubId = 91705377;
+    name = "lwb-2021";
+  };
   lx = {
     email = "alex@adnab.me";
     github = "Alexis211";
@@ -18697,7 +18709,7 @@
     github = "Notarin";
     githubId = 25104390;
     keys = [ { fingerprint = "4E15 9433 48D9 7BA7 E8B8  B0FF C38F D346 AE36 36FB"; } ];
-    matrix = "@notarin:matrix.org";
+    matrix = "@notarin:matrix.squishcat.net";
   };
   NotAShelf = {
     name = "NotAShelf";
@@ -24009,6 +24021,12 @@
     githubId = 617130;
     keys = [ { fingerprint = "C4F7 46C7 B560 38D8 210F  0288 5877 DEE9 7428 557F"; } ];
   };
+  skohtv = {
+    name = "Skoh";
+    email = "contact@skoh.dev";
+    github = "skohtv";
+    githubId = 101289702;
+  };
   skovati = {
     github = "skovati";
     githubId = 49844593;
diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index adc084518d04..004ad3614dd5 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -72,6 +72,8 @@
 
 - [Draupnir](https://github.com/the-draupnir-project/draupnir), a Matrix moderation bot. Available as [services.draupnir](#opt-services.draupnir.enable).
 
+- [Pangolin](https://github.com/fosrl/pangolin), a tunneled reverse proxy server with access control. Available as [services.pangolin](#opt-services.pangolin.enable).
+
 - [postfix-tlspol](https://github.com/Zuplu/postfix-tlspol), MTA-STS and DANE resolver and TLS policy server for Postfix. Available as [services.postfix-tlspol](#opt-services.postfix-tlspol.enable).
 
 - [crowdsec](https://www.crowdsec.net/), a free, open-source and collaborative IPS. Available as [services.crowdsec](#opt-services.crowdsec.enable).
diff --git a/nixos/modules/misc/ids.nix b/nixos/modules/misc/ids.nix
index f96d90941323..949531d9a83c 100644
--- a/nixos/modules/misc/ids.nix
+++ b/nixos/modules/misc/ids.nix
@@ -31,7 +31,7 @@ in
       description = ''
         The user IDs used in NixOS.
       '';
-      type = types.attrsOf types.int;
+      type = types.attrsOf types.ints.u32;
     };
 
     ids.gids = lib.mkOption {
@@ -39,7 +39,7 @@ in
       description = ''
         The group IDs used in NixOS.
       '';
-      type = types.attrsOf types.int;
+      type = types.attrsOf types.ints.u32;
     };
 
   };
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 7f1eb380cd40..62a90d843020 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -568,6 +568,7 @@
   ./services/desktops/gnome/sushi.nix
   ./services/desktops/gnome/tinysparql.nix
   ./services/desktops/gvfs.nix
+  ./services/desktops/linyaps.nix
   ./services/desktops/malcontent.nix
   ./services/desktops/neard.nix
   ./services/desktops/pipewire/pipewire.nix
@@ -1292,6 +1293,7 @@
   ./services/networking/openvpn.nix
   ./services/networking/ostinato.nix
   ./services/networking/owamp.nix
+  ./services/networking/pangolin.nix
   ./services/networking/pdns-recursor.nix
   ./services/networking/pdnsd.nix
   ./services/networking/peroxide.nix
diff --git a/nixos/modules/profiles/nix-builder-vm.nix b/nixos/modules/profiles/nix-builder-vm.nix
index 287ae83f498e..67a134cb95fa 100644
--- a/nixos/modules/profiles/nix-builder-vm.nix
+++ b/nixos/modules/profiles/nix-builder-vm.nix
@@ -85,7 +85,7 @@ in
     };
     hostPort = mkOption {
       default = 31022;
-      type = types.int;
+      type = types.port;
       example = 22;
       description = ''
         The localhost host port to forward TCP to the guest port.
diff --git a/nixos/modules/programs/fish.nix b/nixos/modules/programs/fish.nix
index 799c5194d575..903752bc9a54 100644
--- a/nixos/modules/programs/fish.nix
+++ b/nixos/modules/programs/fish.nix
@@ -12,7 +12,7 @@ let
   cfg = config.programs.fish;
 
   fishAbbrs = lib.concatStringsSep "\n" (
-    lib.mapAttrsToList (k: v: "abbr -ag ${k} ${lib.escapeShellArg v}") cfg.shellAbbrs
+    lib.mapAttrsToList (k: v: "abbr -a ${k} -- ${lib.escapeShellArg v}") cfg.shellAbbrs
   );
 
   fishAliases = lib.concatStringsSep "\n" (
diff --git a/nixos/modules/programs/kubeswitch.nix b/nixos/modules/programs/kubeswitch.nix
index 4a86f68a0d0b..0042ffb83e87 100644
--- a/nixos/modules/programs/kubeswitch.nix
+++ b/nixos/modules/programs/kubeswitch.nix
@@ -18,12 +18,7 @@ in
         description = "The name of the command to use";
       };
 
-      package = lib.mkOption {
-        type = lib.types.package;
-        default = pkgs.kubeswitch;
-        defaultText = lib.literalExpression "pkgs.kubeswitch";
-        description = "The package to install for kubeswitch";
-      };
+      package = lib.mkPackageOption pkgs "kubeswitch" { };
     };
   };
 
diff --git a/nixos/modules/programs/shadow.nix b/nixos/modules/programs/shadow.nix
index e8eb756f8f59..049d5d0c78a7 100644
--- a/nixos/modules/programs/shadow.nix
+++ b/nixos/modules/programs/shadow.nix
@@ -77,49 +77,49 @@ in
             SYS_UID_MIN = lib.mkOption {
               description = "Range of user IDs used for the creation of system users by useradd or newusers.";
               default = 400;
-              type = lib.types.int;
+              type = lib.types.ints.u32;
             };
 
             SYS_UID_MAX = lib.mkOption {
               description = "Range of user IDs used for the creation of system users by useradd or newusers.";
               default = 999;
-              type = lib.types.int;
+              type = lib.types.ints.u32;
             };
 
             UID_MIN = lib.mkOption {
               description = "Range of user IDs used for the creation of regular users by useradd or newusers.";
               default = 1000;
-              type = lib.types.int;
+              type = lib.types.ints.u32;
             };
 
             UID_MAX = lib.mkOption {
               description = "Range of user IDs used for the creation of regular users by useradd or newusers.";
               default = 29999;
-              type = lib.types.int;
+              type = lib.types.ints.u32;
             };
 
             SYS_GID_MIN = lib.mkOption {
               description = "Range of group IDs used for the creation of system groups by useradd, groupadd, or newusers";
               default = 400;
-              type = lib.types.int;
+              type = lib.types.ints.u32;
             };
 
             SYS_GID_MAX = lib.mkOption {
               description = "Range of group IDs used for the creation of system groups by useradd, groupadd, or newusers";
               default = 999;
-              type = lib.types.int;
+              type = lib.types.ints.u32;
             };
 
             GID_MIN = lib.mkOption {
               description = "Range of group IDs used for the creation of regular groups by useradd, groupadd, or newusers.";
               default = 1000;
-              type = lib.types.int;
+              type = lib.types.ints.u32;
             };
 
             GID_MAX = lib.mkOption {
               description = "Range of group IDs used for the creation of regular groups by useradd, groupadd, or newusers.";
               default = 29999;
-              type = lib.types.int;
+              type = lib.types.ints.u32;
             };
 
             TTYGROUP = lib.mkOption {
diff --git a/nixos/modules/security/tpm2.nix b/nixos/modules/security/tpm2.nix
index bb947cb32a56..dba46dbd1cf4 100644
--- a/nixos/modules/security/tpm2.nix
+++ b/nixos/modules/security/tpm2.nix
@@ -58,12 +58,7 @@ in
         Trusted Platform 2 userspace resource manager daemon
       '';
 
-      package = lib.mkOption {
-        description = "tpm2-abrmd package to use";
-        type = lib.types.package;
-        default = pkgs.tpm2-abrmd;
-        defaultText = lib.literalExpression "pkgs.tpm2-abrmd";
-      };
+      package = lib.mkPackageOption pkgs "tpm2-abrmd" { };
     };
 
     pkcs11 = {
diff --git a/nixos/modules/services/admin/pgadmin.nix b/nixos/modules/services/admin/pgadmin.nix
index 8341b9939239..0fbc6a19a814 100644
--- a/nixos/modules/services/admin/pgadmin.nix
+++ b/nixos/modules/services/admin/pgadmin.nix
@@ -228,6 +228,33 @@ in
           "initial_password:${cfg.initialPasswordFile}"
         ]
         ++ lib.optional cfg.emailServer.enable "email_password:${cfg.emailServer.passwordFile}";
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "full";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        UMask = 27;
       };
     };
 
diff --git a/nixos/modules/services/continuous-integration/buildbot/master.nix b/nixos/modules/services/continuous-integration/buildbot/master.nix
index 64555228c9c3..410829ee4cb6 100644
--- a/nixos/modules/services/continuous-integration/buildbot/master.nix
+++ b/nixos/modules/services/continuous-integration/buildbot/master.nix
@@ -182,7 +182,7 @@ in
 
       pbPort = lib.mkOption {
         default = 9989;
-        type = lib.types.either lib.types.str lib.types.int;
+        type = lib.types.either lib.types.str lib.types.port;
         example = "'tcp:9990:interface=127.0.0.1'";
         description = ''
           The buildmaster will listen on a TCP port of your choosing
diff --git a/nixos/modules/services/continuous-integration/buildkite-agents.nix b/nixos/modules/services/continuous-integration/buildkite-agents.nix
index abef4dff3ea3..f4c868ed6a2f 100644
--- a/nixos/modules/services/continuous-integration/buildkite-agents.nix
+++ b/nixos/modules/services/continuous-integration/buildkite-agents.nix
@@ -38,12 +38,7 @@ let
           description = "Whether to enable this buildkite agent";
         };
 
-        package = lib.mkOption {
-          default = pkgs.buildkite-agent;
-          defaultText = lib.literalExpression "pkgs.buildkite-agent";
-          description = "Which buildkite-agent derivation to use";
-          type = lib.types.package;
-        };
+        package = lib.mkPackageOption pkgs "buildkite-agent" { };
 
         dataDir = lib.mkOption {
           default = "/var/lib/buildkite-agent-${name}";
diff --git a/nixos/modules/services/continuous-integration/gocd-server/default.nix b/nixos/modules/services/continuous-integration/gocd-server/default.nix
index 0c3091f85b49..de4403b30208 100644
--- a/nixos/modules/services/continuous-integration/gocd-server/default.nix
+++ b/nixos/modules/services/continuous-integration/gocd-server/default.nix
@@ -64,7 +64,7 @@ in
 
       sslPort = mkOption {
         default = 8154;
-        type = types.int;
+        type = types.port;
         description = ''
           Specifies port number on which the Go.CD server HTTPS interface listens.
         '';
diff --git a/nixos/modules/services/continuous-integration/jenkins/default.nix b/nixos/modules/services/continuous-integration/jenkins/default.nix
index bcd96443a861..2dae8b61296c 100644
--- a/nixos/modules/services/continuous-integration/jenkins/default.nix
+++ b/nixos/modules/services/continuous-integration/jenkins/default.nix
@@ -254,6 +254,33 @@ in
         StateDirectory = lib.mkIf (lib.hasPrefix "/var/lib/jenkins" cfg.home) "jenkins";
         # For (possible) socket use
         RuntimeDirectory = "jenkins";
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        # MemoryDenyWriteExecute = false;   Breaks execution;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "full";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        UMask = 27;
       };
     };
   };
diff --git a/nixos/modules/services/databases/cassandra.nix b/nixos/modules/services/databases/cassandra.nix
index 814f0e99a8a7..27b7a5b94db2 100644
--- a/nixos/modules/services/databases/cassandra.nix
+++ b/nixos/modules/services/databases/cassandra.nix
@@ -415,7 +415,7 @@ in
     };
 
     jmxPort = mkOption {
-      type = types.int;
+      type = types.port;
       default = 7199;
       description = ''
         Specifies the default port over which Cassandra will be available for
diff --git a/nixos/modules/services/databases/chromadb.nix b/nixos/modules/services/databases/chromadb.nix
index 0e0188f6dd3e..03ea0221eab6 100644
--- a/nixos/modules/services/databases/chromadb.nix
+++ b/nixos/modules/services/databases/chromadb.nix
@@ -9,10 +9,10 @@ let
   cfg = config.services.chromadb;
   inherit (lib)
     mkEnableOption
+    mkPackageOption
     mkOption
     mkIf
     types
-    literalExpression
     ;
 in
 {
@@ -29,13 +29,7 @@ in
     services.chromadb = {
       enable = mkEnableOption "ChromaDB, an open-source AI application database.";
 
-      package = mkOption {
-        type = types.package;
-        example = literalExpression "pkgs.python3Packages.chromadb";
-        default = pkgs.python3Packages.chromadb;
-        defaultText = "pkgs.python3Packages.chromadb";
-        description = "ChromaDB package to use.";
-      };
+      package = mkPackageOption pkgs [ "python3Packages" "chromadb" ] { };
 
       host = mkOption {
         type = types.str;
diff --git a/nixos/modules/services/databases/ferretdb.nix b/nixos/modules/services/databases/ferretdb.nix
index dc756403e477..dc106bbf3b73 100644
--- a/nixos/modules/services/databases/ferretdb.nix
+++ b/nixos/modules/services/databases/ferretdb.nix
@@ -18,13 +18,7 @@ in
     services.ferretdb = {
       enable = lib.mkEnableOption "FerretDB, an Open Source MongoDB alternative";
 
-      package = lib.mkOption {
-        type = lib.types.package;
-        example = lib.literalExpression "pkgs.ferretdb";
-        default = pkgs.ferretdb;
-        defaultText = "pkgs.ferretdb";
-        description = "FerretDB package to use.";
-      };
+      package = lib.mkPackageOption pkgs "ferretdb" { };
 
       settings = lib.mkOption {
         type = lib.types.submodule {
diff --git a/nixos/modules/services/databases/foundationdb.nix b/nixos/modules/services/databases/foundationdb.nix
index 5cce94ac6d5e..c05bfc47bb77 100644
--- a/nixos/modules/services/databases/foundationdb.nix
+++ b/nixos/modules/services/databases/foundationdb.nix
@@ -94,7 +94,7 @@ in
     };
 
     listenPortStart = lib.mkOption {
-      type = lib.types.int;
+      type = lib.types.port;
       default = 4500;
       description = ''
         Starting port number for database listening sockets. Every FDB process binds to a
diff --git a/nixos/modules/services/desktops/linyaps.nix b/nixos/modules/services/desktops/linyaps.nix
new file mode 100644
index 000000000000..993a29167e89
--- /dev/null
+++ b/nixos/modules/services/desktops/linyaps.nix
@@ -0,0 +1,60 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.linyaps;
+in
+
+{
+  meta = {
+    maintainers = pkgs.linyaps.meta.maintainers;
+  };
+
+  ###### interface
+  options = {
+    services.linyaps = {
+      enable = lib.mkEnableOption "linyaps, a cross-distribution package manager with sandboxed apps and shared runtime";
+
+      package = lib.mkPackageOption pkgs "linyaps" { };
+
+      boxPackage = lib.mkPackageOption pkgs "linyaps-box" { };
+    };
+  };
+
+  ###### implementation
+  config = lib.mkIf cfg.enable {
+
+    environment = {
+      profiles = [ "/var/lib/linglong/entries" ];
+      systemPackages = [
+        cfg.package
+        cfg.boxPackage
+      ];
+    };
+
+    security.polkit.enable = true;
+
+    fonts.fontDir.enable = true;
+
+    services.dbus.packages = [ cfg.package ];
+
+    systemd = {
+      packages = [ cfg.package ];
+      tmpfiles.packages = [ cfg.package ];
+    };
+
+    # Create system user and group for linyaps/linglong
+    users = {
+      groups.deepin-linglong = { };
+      users.deepin-linglong = {
+        group = "deepin-linglong";
+        isSystemUser = true;
+        description = "Linyaps/Linglong system helper";
+      };
+    };
+  };
+}
diff --git a/nixos/modules/services/development/distccd.nix b/nixos/modules/services/development/distccd.nix
index 46d09911e2b7..29ea8767b283 100644
--- a/nixos/modules/services/development/distccd.nix
+++ b/nixos/modules/services/development/distccd.nix
@@ -65,7 +65,7 @@ in
       };
 
       nice = lib.mkOption {
-        type = lib.types.nullOr lib.types.int;
+        type = lib.types.nullOr (lib.types.ints.between (-20) 19);
         default = null;
         description = ''
           Niceness of the compilation tasks.
diff --git a/nixos/modules/services/development/lorri.nix b/nixos/modules/services/development/lorri.nix
index 899e4f3de191..efeb997d28bc 100644
--- a/nixos/modules/services/development/lorri.nix
+++ b/nixos/modules/services/development/lorri.nix
@@ -21,14 +21,7 @@ in
           issued by the `lorri` command.
         '';
       };
-      package = lib.mkOption {
-        default = pkgs.lorri;
-        type = lib.types.package;
-        description = ''
-          The lorri package to use.
-        '';
-        defaultText = lib.literalExpression "pkgs.lorri";
-      };
+      package = lib.mkPackageOption pkgs "lorri" { };
     };
   };
 
diff --git a/nixos/modules/services/display-managers/sddm.nix b/nixos/modules/services/display-managers/sddm.nix
index b9df863d12f9..d5ba80d009b7 100644
--- a/nixos/modules/services/display-managers/sddm.nix
+++ b/nixos/modules/services/display-managers/sddm.nix
@@ -12,9 +12,11 @@ let
   xEnv = config.systemd.services.display-manager.environment;
 
   sddm = cfg.package.override (old: {
-    withWayland = cfg.wayland.enable;
-    withLayerShellQt = cfg.wayland.compositor == "kwin";
-    extraPackages = old.extraPackages or [ ] ++ cfg.extraPackages;
+    extraPackages =
+      old.extraPackages or [ ]
+      ++ lib.optionals cfg.wayland.enable [ pkgs.qt6.qtwayland ]
+      ++ lib.optionals (cfg.wayland.compositor == "kwin") [ pkgs.kdePackages.layer-shell-qt ]
+      ++ cfg.extraPackages;
   });
 
   iniFmt = pkgs.formats.ini { };
@@ -228,7 +230,7 @@ in
         '';
       };
 
-      package = mkPackageOption pkgs [ "libsForQt5" "sddm" ] { };
+      package = mkPackageOption pkgs [ "kdePackages" "sddm" ] { };
 
       enableHidpi = mkOption {
         type = types.bool;
diff --git a/nixos/modules/services/hardware/argonone.nix b/nixos/modules/services/hardware/argonone.nix
index bdbe27a199c8..6c88d46fa67d 100644
--- a/nixos/modules/services/hardware/argonone.nix
+++ b/nixos/modules/services/hardware/argonone.nix
@@ -11,14 +11,7 @@ in
 {
   options.services.hardware.argonone = {
     enable = lib.mkEnableOption "the driver for Argon One Raspberry Pi case fan and power button";
-    package = lib.mkOption {
-      type = lib.types.package;
-      default = pkgs.argononed;
-      defaultText = lib.literalExpression "pkgs.argononed";
-      description = ''
-        The package implementing the Argon One driver
-      '';
-    };
+    package = lib.mkPackageOption pkgs "argononed" { };
   };
 
   config = lib.mkIf cfg.enable {
diff --git a/nixos/modules/services/hardware/sane.nix b/nixos/modules/services/hardware/sane.nix
index 337bed562727..0b89cf2bc98a 100644
--- a/nixos/modules/services/hardware/sane.nix
+++ b/nixos/modules/services/hardware/sane.nix
@@ -67,12 +67,7 @@ in
       '';
     };
 
-    hardware.sane.backends-package = lib.mkOption {
-      type = lib.types.package;
-      default = pkgs.sane-backends;
-      defaultText = lib.literalExpression "pkgs.sane-backends";
-      description = "Backends driver package to use.";
-    };
+    hardware.sane.backends-package = lib.mkPackageOption pkgs "sane-backends" { };
 
     hardware.sane.snapshot = lib.mkOption {
       type = lib.types.bool;
diff --git a/nixos/modules/services/logging/journalwatch.nix b/nixos/modules/services/logging/journalwatch.nix
index 19ec7f76af8c..7ec2144230ed 100644
--- a/nixos/modules/services/logging/journalwatch.nix
+++ b/nixos/modules/services/logging/journalwatch.nix
@@ -72,7 +72,7 @@ in
       package = lib.mkPackageOption pkgs "journalwatch" { };
 
       priority = lib.mkOption {
-        type = lib.types.int;
+        type = lib.types.ints.between 0 7;
         default = 6;
         description = ''
           Lowest priority of message to be considered.
diff --git a/nixos/modules/services/matrix/mautrix-discord.nix b/nixos/modules/services/matrix/mautrix-discord.nix
index 0c37139b24c7..f14e7d90196d 100644
--- a/nixos/modules/services/matrix/mautrix-discord.nix
+++ b/nixos/modules/services/matrix/mautrix-discord.nix
@@ -19,14 +19,7 @@ in
     services.mautrix-discord = {
       enable = lib.mkEnableOption "Mautrix-Discord, a Matrix-Discord puppeting/relay-bot bridge";
 
-      package = lib.mkOption {
-        type = lib.types.package;
-        default = pkgs.mautrix-discord;
-        defaultText = lib.literalExpression "pkgs.mautrix-discord";
-        description = ''
-          The mautrix-discord package to use.
-        '';
-      };
+      package = lib.mkPackageOption pkgs "mautrix-discord" { };
 
       settings = lib.mkOption {
         type = lib.types.submodule {
diff --git a/nixos/modules/services/misc/cpuminer-cryptonight.nix b/nixos/modules/services/misc/cpuminer-cryptonight.nix
index adaee2bbb215..a06077497e22 100644
--- a/nixos/modules/services/misc/cpuminer-cryptonight.nix
+++ b/nixos/modules/services/misc/cpuminer-cryptonight.nix
@@ -43,7 +43,7 @@ in
         description = "Password for mining server";
       };
       threads = lib.mkOption {
-        type = lib.types.int;
+        type = lib.types.ints.unsigned;
         default = 0;
         description = "Number of miner threads, defaults to available processors";
       };
diff --git a/nixos/modules/services/misc/etebase-server.nix b/nixos/modules/services/misc/etebase-server.nix
index f303d763d1df..ecd620cff6cc 100644
--- a/nixos/modules/services/misc/etebase-server.nix
+++ b/nixos/modules/services/misc/etebase-server.nix
@@ -51,12 +51,7 @@ in
         '';
       };
 
-      package = lib.mkOption {
-        type = lib.types.package;
-        default = pkgs.etebase-server;
-        defaultText = lib.literalExpression "pkgs.python3.pkgs.etebase-server";
-        description = "etebase-server package to use.";
-      };
+      package = lib.mkPackageOption pkgs "etebase-server" { };
 
       dataDir = lib.mkOption {
         type = lib.types.str;
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index a604bc88b3bf..240561f20278 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -638,7 +638,7 @@ in
           description = "External address used to access registry from the internet";
         };
         externalPort = mkOption {
-          type = types.int;
+          type = types.port;
           description = "External port used to access registry from the internet";
         };
       };
diff --git a/nixos/modules/services/misc/gotenberg.nix b/nixos/modules/services/misc/gotenberg.nix
index e9a6388b970b..542aa342e5d6 100644
--- a/nixos/modules/services/misc/gotenberg.nix
+++ b/nixos/modules/services/misc/gotenberg.nix
@@ -107,7 +107,7 @@ in
         package = mkPackageOption pkgs "chromium" { };
 
         maxQueueSize = mkOption {
-          type = types.int;
+          type = types.ints.unsigned;
           default = 0;
           description = "Maximum queue size for chromium-based conversions. Setting to 0 disables the limit.";
         };
@@ -143,7 +143,7 @@ in
           description = "Deny accepting URLs from these domains in the `downloadFrom` API field. Accepts a regular expression.";
         };
         maxRetries = mkOption {
-          type = types.int;
+          type = types.ints.unsigned;
           default = 4;
           description = "The maximum amount of times to retry downloading a file specified with `downloadFrom`.";
         };
@@ -158,13 +158,13 @@ in
         package = mkPackageOption pkgs "libreoffice" { };
 
         restartAfter = mkOption {
-          type = types.int;
+          type = types.ints.unsigned;
           default = 10;
           description = "Restart LibreOffice after this many conversions. Setting to 0 disables this feature.";
         };
 
         maxQueueSize = mkOption {
-          type = types.int;
+          type = types.ints.unsigned;
           default = 0;
           description = "Maximum queue size for LibreOffice-based conversions. Setting to 0 disables the limit.";
         };
diff --git a/nixos/modules/services/misc/homepage-dashboard.nix b/nixos/modules/services/misc/homepage-dashboard.nix
index 827c0f1b1590..c344d1b4a44c 100644
--- a/nixos/modules/services/misc/homepage-dashboard.nix
+++ b/nixos/modules/services/misc/homepage-dashboard.nix
@@ -23,7 +23,7 @@ in
       };
 
       listenPort = lib.mkOption {
-        type = lib.types.int;
+        type = lib.types.port;
         default = 8082;
         description = "Port for Homepage to bind to.";
       };
diff --git a/nixos/modules/services/misc/invidious-router.nix b/nixos/modules/services/misc/invidious-router.nix
index 5d4fc1528890..9a1ce086e031 100644
--- a/nixos/modules/services/misc/invidious-router.nix
+++ b/nixos/modules/services/misc/invidious-router.nix
@@ -70,14 +70,7 @@ in
         for configuration options.
       '';
     };
-    package = lib.mkOption {
-      type = lib.types.package;
-      default = pkgs.invidious-router;
-      defaultText = lib.literalExpression "pkgs.invidious-router";
-      description = ''
-        The invidious-router package to use.
-      '';
-    };
+    package = lib.mkPackageOption pkgs "invidious-router" { };
     nginx = {
       enable = lib.mkEnableOption ''
         Automatic nginx proxy configuration
diff --git a/nixos/modules/services/misc/portunus.nix b/nixos/modules/services/misc/portunus.nix
index 022efc5b9839..0b0718289c8a 100644
--- a/nixos/modules/services/misc/portunus.nix
+++ b/nixos/modules/services/misc/portunus.nix
@@ -117,12 +117,7 @@ in
     };
 
     ldap = {
-      package = lib.mkOption {
-        type = lib.types.package;
-        default = pkgs.openldap;
-        defaultText = lib.literalExpression "pkgs.openldap";
-        description = "The OpenLDAP package to use.";
-      };
+      package = lib.mkPackageOption pkgs "openldap" { };
 
       searchUserName = lib.mkOption {
         type = lib.types.str;
diff --git a/nixos/modules/services/misc/rshim.nix b/nixos/modules/services/misc/rshim.nix
index 49296f0e2f05..37bcb40e16e7 100644
--- a/nixos/modules/services/misc/rshim.nix
+++ b/nixos/modules/services/misc/rshim.nix
@@ -61,7 +61,7 @@ in
     };
 
     log-level = lib.mkOption {
-      type = lib.types.int;
+      type = lib.types.ints.between 0 4;
       description = ''
         Specify the log level (0:none, 1:error, 2:warning, 3:notice, 4:debug).
       '';
diff --git a/nixos/modules/services/misc/taskserver/default.nix b/nixos/modules/services/misc/taskserver/default.nix
index c21b4384ba43..8a860ba44142 100644
--- a/nixos/modules/services/misc/taskserver/default.nix
+++ b/nixos/modules/services/misc/taskserver/default.nix
@@ -329,7 +329,7 @@ in
       };
 
       listenPort = lib.mkOption {
-        type = lib.types.int;
+        type = lib.types.port;
         default = 53589;
         description = ''
           Port number of the Taskserver.
diff --git a/nixos/modules/services/monitoring/nezha-agent.nix b/nixos/modules/services/monitoring/nezha-agent.nix
index 87ecbfdde710..e9161defe80b 100644
--- a/nixos/modules/services/monitoring/nezha-agent.nix
+++ b/nixos/modules/services/monitoring/nezha-agent.nix
@@ -98,12 +98,7 @@ in
               '';
             };
             report_delay = lib.mkOption {
-              type = lib.types.enum [
-                1
-                2
-                3
-                4
-              ];
+              type = lib.types.ints.between 1 4;
               default = 3;
               description = ''
                 The interval between system status reportings.
diff --git a/nixos/modules/services/monitoring/prometheus/exporters/fritzbox.nix b/nixos/modules/services/monitoring/prometheus/exporters/fritzbox.nix
index 7c91e7995803..0d8853951357 100644
--- a/nixos/modules/services/monitoring/prometheus/exporters/fritzbox.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/fritzbox.nix
@@ -22,7 +22,7 @@ in
     };
 
     gatewayPort = mkOption {
-      type = types.int;
+      type = types.port;
       default = 49000;
       description = ''
         The port of the FRITZ!Box UPnP service.
diff --git a/nixos/modules/services/monitoring/statsd.nix b/nixos/modules/services/monitoring/statsd.nix
index 5eb0517d4fc5..48bb0f0e93f3 100644
--- a/nixos/modules/services/monitoring/statsd.nix
+++ b/nixos/modules/services/monitoring/statsd.nix
@@ -110,7 +110,7 @@ in
     graphitePort = lib.mkOption {
       description = "Port of Graphite server (i.e. carbon-cache).";
       default = null;
-      type = lib.types.nullOr lib.types.int;
+      type = lib.types.nullOr lib.types.port;
     };
 
     extraConfig = lib.mkOption {
diff --git a/nixos/modules/services/network-filesystems/nfsd.nix b/nixos/modules/services/network-filesystems/nfsd.nix
index 8729945fc3fd..9d3c3f9e4188 100644
--- a/nixos/modules/services/network-filesystems/nfsd.nix
+++ b/nixos/modules/services/network-filesystems/nfsd.nix
@@ -81,7 +81,7 @@ in
         };
 
         mountdPort = lib.mkOption {
-          type = lib.types.nullOr lib.types.int;
+          type = lib.types.nullOr lib.types.port;
           default = null;
           example = 4002;
           description = ''
@@ -90,7 +90,7 @@ in
         };
 
         lockdPort = lib.mkOption {
-          type = lib.types.nullOr lib.types.int;
+          type = lib.types.nullOr lib.types.port;
           default = null;
           example = 4001;
           description = ''
@@ -101,7 +101,7 @@ in
         };
 
         statdPort = lib.mkOption {
-          type = lib.types.nullOr lib.types.int;
+          type = lib.types.nullOr lib.types.port;
           default = null;
           example = 4000;
           description = ''
diff --git a/nixos/modules/services/network-filesystems/tahoe.nix b/nixos/modules/services/network-filesystems/tahoe.nix
index 1176fb3131fc..3297e65dac2b 100644
--- a/nixos/modules/services/network-filesystems/tahoe.nix
+++ b/nixos/modules/services/network-filesystems/tahoe.nix
@@ -140,7 +140,7 @@ in
             sftpd.enable = lib.mkEnableOption "SFTP service";
             sftpd.port = lib.mkOption {
               default = null;
-              type = lib.types.nullOr lib.types.int;
+              type = lib.types.nullOr lib.types.port;
               description = ''
                 The port on which the SFTP server will listen.
 
diff --git a/nixos/modules/services/networking/3proxy.nix b/nixos/modules/services/networking/3proxy.nix
index aa76e57417fb..dca17e8194ef 100644
--- a/nixos/modules/services/networking/3proxy.nix
+++ b/nixos/modules/services/networking/3proxy.nix
@@ -83,7 +83,7 @@ in
               '';
             };
             bindPort = lib.mkOption {
-              type = lib.types.nullOr lib.types.int;
+              type = lib.types.nullOr lib.types.port;
               default = null;
               example = 3128;
               description = ''
@@ -192,7 +192,7 @@ in
                       '';
                     };
                     targetPorts = lib.mkOption {
-                      type = lib.types.listOf lib.types.int;
+                      type = lib.types.listOf lib.types.port;
                       default = [ ];
                       example = [
                         80
diff --git a/nixos/modules/services/networking/autossh.nix b/nixos/modules/services/networking/autossh.nix
index d40c7b5cb415..2e6fbcec9431 100644
--- a/nixos/modules/services/networking/autossh.nix
+++ b/nixos/modules/services/networking/autossh.nix
@@ -33,7 +33,7 @@ in
                 description = "Name of the user the AutoSSH session should run as";
               };
               monitoringPort = lib.mkOption {
-                type = lib.types.int;
+                type = lib.types.port;
                 default = 0;
                 example = 20000;
                 description = ''
diff --git a/nixos/modules/services/networking/ax25/axlisten.nix b/nixos/modules/services/networking/ax25/axlisten.nix
index ad887885c142..f36eca678eec 100644
--- a/nixos/modules/services/networking/ax25/axlisten.nix
+++ b/nixos/modules/services/networking/ax25/axlisten.nix
@@ -17,7 +17,7 @@ let
   inherit (lib.options)
     mkEnableOption
     mkOption
-    literalExpression
+    mkPackageOption
     ;
 
   cfg = config.services.ax25.axlisten;
@@ -29,12 +29,7 @@ in
 
       enable = mkEnableOption "AX.25 axlisten daemon";
 
-      package = mkOption {
-        type = types.package;
-        default = pkgs.ax25-apps;
-        defaultText = literalExpression "pkgs.ax25-apps";
-        description = "The ax25-apps package to use.";
-      };
+      package = mkPackageOption pkgs "ax25-apps" { };
 
       config = mkOption {
         type = types.str;
diff --git a/nixos/modules/services/networking/coturn.nix b/nixos/modules/services/networking/coturn.nix
index 8d60deda0085..1786aa530f02 100644
--- a/nixos/modules/services/networking/coturn.nix
+++ b/nixos/modules/services/networking/coturn.nix
@@ -50,7 +50,7 @@ in
     services.coturn = {
       enable = lib.mkEnableOption "coturn TURN server";
       listening-port = lib.mkOption {
-        type = lib.types.int;
+        type = lib.types.port;
         default = 3478;
         description = ''
           TURN listener port for UDP and TCP.
@@ -59,7 +59,7 @@ in
         '';
       };
       tls-listening-port = lib.mkOption {
-        type = lib.types.int;
+        type = lib.types.port;
         default = 5349;
         description = ''
           TURN listener port for TLS.
@@ -74,7 +74,7 @@ in
         '';
       };
       alt-listening-port = lib.mkOption {
-        type = lib.types.int;
+        type = lib.types.port;
         default = cfg.listening-port + 1;
         defaultText = lib.literalExpression "listening-port + 1";
         description = ''
@@ -89,7 +89,7 @@ in
         '';
       };
       alt-tls-listening-port = lib.mkOption {
-        type = lib.types.int;
+        type = lib.types.port;
         default = cfg.tls-listening-port + 1;
         defaultText = lib.literalExpression "tls-listening-port + 1";
         description = ''
@@ -130,14 +130,14 @@ in
         '';
       };
       min-port = lib.mkOption {
-        type = lib.types.int;
+        type = lib.types.port;
         default = 49152;
         description = ''
           Lower bound of UDP relay endpoints
         '';
       };
       max-port = lib.mkOption {
-        type = lib.types.int;
+        type = lib.types.port;
         default = 65535;
         description = ''
           Upper bound of UDP relay endpoints
@@ -263,7 +263,7 @@ in
         '';
       };
       cli-port = lib.mkOption {
-        type = lib.types.int;
+        type = lib.types.port;
         default = 5766;
         description = ''
           CLI server port.
diff --git a/nixos/modules/services/networking/deconz.nix b/nixos/modules/services/networking/deconz.nix
index c26565efcac2..fdec8923a710 100644
--- a/nixos/modules/services/networking/deconz.nix
+++ b/nixos/modules/services/networking/deconz.nix
@@ -21,12 +21,7 @@ in
 
     enable = lib.mkEnableOption "deCONZ, a Zigbee gateway for use with ConBee/RaspBee hardware (https://phoscon.de/)";
 
-    package = lib.mkOption {
-      type = lib.types.package;
-      default = pkgs.deconz;
-      defaultText = lib.literalExpression "pkgs.deconz";
-      description = "Which deCONZ package to use.";
-    };
+    package = lib.mkPackageOption pkgs "deconz" { };
 
     device = lib.mkOption {
       type = lib.types.nullOr lib.types.str;
diff --git a/nixos/modules/services/networking/firefox-syncserver.nix b/nixos/modules/services/networking/firefox-syncserver.nix
index b13ce25a06c0..56f204c50c7c 100644
--- a/nixos/modules/services/networking/firefox-syncserver.nix
+++ b/nixos/modules/services/networking/firefox-syncserver.nix
@@ -101,14 +101,7 @@ in
         {option}`${opt.singleNode.enable}` does this automatically when enabled
       '';
 
-      package = lib.mkOption {
-        type = lib.types.package;
-        default = pkgs.syncstorage-rs;
-        defaultText = lib.literalExpression "pkgs.syncstorage-rs";
-        description = ''
-          Package to use.
-        '';
-      };
+      package = lib.mkPackageOption pkgs "syncstorage-rs" { };
 
       database.name = lib.mkOption {
         # the mysql module does not allow `-quoting without resorting to shell
diff --git a/nixos/modules/services/networking/freenet.nix b/nixos/modules/services/networking/freenet.nix
index a0c67796377b..c95eb5d271af 100644
--- a/nixos/modules/services/networking/freenet.nix
+++ b/nixos/modules/services/networking/freenet.nix
@@ -15,7 +15,7 @@ in
       enable = lib.mkEnableOption "Freenet daemon";
 
       nice = lib.mkOption {
-        type = lib.types.int;
+        type = lib.types.ints.between (-20) 19;
         default = 10;
         description = "Set the nice level for the Freenet daemon";
       };
diff --git a/nixos/modules/services/networking/hostapd.nix b/nixos/modules/services/networking/hostapd.nix
index 5fa3cadb9a7e..a9c686763ca9 100644
--- a/nixos/modules/services/networking/hostapd.nix
+++ b/nixos/modules/services/networking/hostapd.nix
@@ -274,7 +274,7 @@ in
               channel = mkOption {
                 default = 0;
                 example = 11;
-                type = types.int;
+                type = types.ints.positive;
                 description = ''
                   The channel to operate on. Use 0 to enable ACS (Automatic Channel Selection).
                   Beware that not every device supports ACS in which case {command}`hostapd`
@@ -571,7 +571,7 @@ in
                     options = {
                       logLevel = mkOption {
                         default = 2;
-                        type = types.int;
+                        type = types.ints.between 0 4;
                         description = ''
                           Levels (minimum value for logged events):
                           0 = verbose debugging
@@ -957,7 +957,7 @@ in
                                 vlanid = mkOption {
                                   default = null;
                                   example = 1;
-                                  type = types.nullOr types.int;
+                                  type = types.nullOr types.ints.unsigned;
                                   description = "If this attribute is given, all clients using this entry will get tagged with the given VLAN ID.";
                                 };
 
diff --git a/nixos/modules/services/networking/i2pd.nix b/nixos/modules/services/networking/i2pd.nix
index 1f9c9dcac4a0..15e86c4c342e 100644
--- a/nixos/modules/services/networking/i2pd.nix
+++ b/nixos/modules/services/networking/i2pd.nix
@@ -667,7 +667,7 @@ in
           description = "Upstream outproxy bind address.";
         };
         outproxyPort = mkOption {
-          type = types.int;
+          type = types.port;
           default = 4444;
           description = "Upstream outproxy bind port.";
         };
@@ -686,7 +686,7 @@ in
             {
               options = {
                 destinationPort = mkOption {
-                  type = with types; nullOr int;
+                  type = with types; nullOr port;
                   default = null;
                   description = "Connect to particular port at destination.";
                 };
@@ -711,7 +711,7 @@ in
             {
               options = {
                 inPort = mkOption {
-                  type = types.int;
+                  type = types.port;
                   default = 0;
                   description = "Service port. Default to the tunnel's listen port.";
                 };
diff --git a/nixos/modules/services/networking/icecream/daemon.nix b/nixos/modules/services/networking/icecream/daemon.nix
index 789ff377bbaf..baf63539254f 100644
--- a/nixos/modules/services/networking/icecream/daemon.nix
+++ b/nixos/modules/services/networking/icecream/daemon.nix
@@ -79,7 +79,7 @@ in
       };
 
       nice = mkOption {
-        type = types.int;
+        type = types.ints.between (-20) 19;
         default = 5;
         description = ''
           The level of niceness to use.
diff --git a/nixos/modules/services/networking/livekit-ingress.nix b/nixos/modules/services/networking/livekit-ingress.nix
index 260698a4b2b4..7aaf6d1397af 100644
--- a/nixos/modules/services/networking/livekit-ingress.nix
+++ b/nixos/modules/services/networking/livekit-ingress.nix
@@ -71,13 +71,13 @@ in
 
           rtc_config = {
             port_range_start = lib.mkOption {
-              type = lib.types.int;
+              type = lib.types.port;
               default = 50000;
               description = "Start of UDP port range for WebRTC";
             };
 
             port_range_end = lib.mkOption {
-              type = lib.types.int;
+              type = lib.types.port;
               default = 51000;
               description = "End of UDP port range for WebRTC";
             };
diff --git a/nixos/modules/services/networking/livekit.nix b/nixos/modules/services/networking/livekit.nix
index 1c93fd6fc069..ec7cc212c82a 100644
--- a/nixos/modules/services/networking/livekit.nix
+++ b/nixos/modules/services/networking/livekit.nix
@@ -85,13 +85,13 @@ in
 
           rtc = {
             port_range_start = lib.mkOption {
-              type = lib.types.int;
+              type = lib.types.port;
               default = 50000;
               description = "Start of UDP port range for WebRTC";
             };
 
             port_range_end = lib.mkOption {
-              type = lib.types.int;
+              type = lib.types.port;
               default = 51000;
               description = "End of UDP port range for WebRTC";
             };
diff --git a/nixos/modules/services/networking/murmur.nix b/nixos/modules/services/networking/murmur.nix
index 6b8bd96a4f1b..692868c8a790 100644
--- a/nixos/modules/services/networking/murmur.nix
+++ b/nixos/modules/services/networking/murmur.nix
@@ -41,9 +41,9 @@ let
     ${lib.optionalString (cfg.registerHostname != "") "registerHostname=${cfg.registerHostname}"}
 
     certrequired=${lib.boolToString cfg.clientCertRequired}
-    ${lib.optionalString (cfg.sslCert != "") "sslCert=${cfg.sslCert}"}
-    ${lib.optionalString (cfg.sslKey != "") "sslKey=${cfg.sslKey}"}
-    ${lib.optionalString (cfg.sslCa != "") "sslCA=${cfg.sslCa}"}
+    ${lib.optionalString (cfg.sslCert != null) "sslCert=${cfg.sslCert}"}
+    ${lib.optionalString (cfg.sslKey != null) "sslKey=${cfg.sslKey}"}
+    ${lib.optionalString (cfg.sslCa != null) "sslCA=${cfg.sslCa}"}
 
     ${lib.optionalString (cfg.dbus != null) "dbus=${cfg.dbus}"}
 
@@ -56,7 +56,7 @@ in
     (lib.mkRemovedOptionModule [
       "services"
       "murmur"
-      "logfile"
+      "logFile"
     ] "This option has been superseded by services.murmur.logToFile")
   ];
 
@@ -238,20 +238,20 @@ in
       clientCertRequired = lib.mkEnableOption "requiring clients to authenticate via certificates";
 
       sslCert = lib.mkOption {
-        type = lib.types.str;
-        default = "";
+        type = lib.types.nullOr lib.types.path;
+        default = null;
         description = "Path to your SSL certificate.";
       };
 
       sslKey = lib.mkOption {
-        type = lib.types.str;
-        default = "";
+        type = lib.types.nullOr lib.types.path;
+        default = null;
         description = "Path to your SSL key.";
       };
 
       sslCa = lib.mkOption {
-        type = lib.types.str;
-        default = "";
+        type = lib.types.nullOr lib.types.path;
+        default = null;
         description = "Path to your SSL CA certificate.";
       };
 
@@ -355,7 +355,10 @@ in
         ProtectKernelLogs = true;
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
-        ProtectSystem = "full";
+        ProtectSystem = "strict";
+        ReadWritePaths = [
+          cfg.stateDir
+        ];
         RestrictAddressFamilies = [
           "AF_INET"
           "AF_INET6"
@@ -415,13 +418,13 @@ in
     + lib.optionalString cfg.logToFile ''
       rw /var/log/murmur/murmurd.log,
     ''
-    + lib.optionalString (cfg.sslCert != "") ''
+    + lib.optionalString (cfg.sslCert != null) ''
       r ${cfg.sslCert},
     ''
-    + lib.optionalString (cfg.sslKey != "") ''
+    + lib.optionalString (cfg.sslKey != null) ''
       r ${cfg.sslKey},
     ''
-    + lib.optionalString (cfg.sslCa != "") ''
+    + lib.optionalString (cfg.sslCa != null) ''
       r ${cfg.sslCa},
     ''
     + lib.optionalString (cfg.dbus != null) ''
diff --git a/nixos/modules/services/networking/mycelium.nix b/nixos/modules/services/networking/mycelium.nix
index 7ffbf13be400..1574db67fd8a 100644
--- a/nixos/modules/services/networking/mycelium.nix
+++ b/nixos/modules/services/networking/mycelium.nix
@@ -39,12 +39,7 @@ in
       default = false;
       description = "Open the firewall for mycelium";
     };
-    package = lib.mkOption {
-      type = lib.types.package;
-      default = pkgs.mycelium;
-      defaultText = lib.literalExpression ''"''${pkgs.mycelium}"'';
-      description = "The mycelium package to use";
-    };
+    package = lib.mkPackageOption pkgs "mycelium" { };
     addHostedPublicNodes = lib.mkOption {
       type = lib.types.bool;
       default = true;
diff --git a/nixos/modules/services/networking/newt.nix b/nixos/modules/services/networking/newt.nix
index 07a58d868cab..bc2d1cc001a9 100644
--- a/nixos/modules/services/networking/newt.nix
+++ b/nixos/modules/services/networking/newt.nix
@@ -6,39 +6,49 @@
 }:
 let
   cfg = config.services.newt;
+  type =
+    with lib.types;
+    attrsOf (
+      nullOr (oneOf [
+        bool
+        int
+        float
+        str
+        path
+        (listOf type)
+      ])
+    )
+    // {
+      description = "value coercible to CLI argument";
+    };
 in
 {
+  imports = [
+    (lib.mkRenamedOptionModule [ "services" "newt" "id" ] [ "services" "newt" "settings" "id" ])
+    (lib.mkRenamedOptionModule
+      [ "services" "newt" "logLevel" ]
+      [ "services" "newt" "settings" "log-level" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "newt" "endpoint" ]
+      [ "services" "newt" "settings" "endpoint" ]
+    )
+  ];
+
   options = {
     services.newt = {
       enable = lib.mkEnableOption "Newt, user space tunnel client for Pangolin";
-      # needs to be changed when newt-go changes to fosrl-newt
-      package = lib.mkPackageOption pkgs "newt-go" { };
+      package = lib.mkPackageOption pkgs "fosrl-newt" { };
+      settings = lib.mkOption {
+        inherit type;
+        default = { };
+        example = {
+          endpoint = "pangolin.example.com";
+          id = "8yfsghj438a20ol";
+        };
+        description = "Settings for Newt module, see [Newt CLI docs](https://github.com/fosrl/newt?tab=readme-ov-file#cli-args) for more information.";
+      };
 
-      id = lib.mkOption {
-        type = with lib.types; nullOr str;
-        default = null;
-        description = ''
-          The Newt Id that will be used to communicate to Pangolin. This is generated on site creation in the dashboard.
-        '';
-      };
-      endpoint = lib.mkOption {
-        type = with lib.types; nullOr str;
-        default = null;
-        description = ''
-          The endpoint where both Gerbil and Pangolin reside in order to connect to the websocket. The url of your Pangolin dashboard.
-        '';
-      };
-      logLevel = lib.mkOption {
-        type = lib.types.enum [
-          "DEBUG"
-          "INFO"
-          "WARN"
-          "ERROR"
-          "FATAL"
-        ];
-        default = "INFO";
-        description = "The log level to use.";
-      };
       # provide path to file to keep secrets out of the nix store
       environmentFile = lib.mkOption {
         type = with lib.types; nullOr path;
@@ -72,17 +82,8 @@ in
         HOME = "/var/lib/private/newt";
       };
       # the flag values will all be overwritten if also defined in the env file
-      script = "
-        exec ${lib.getExe pkgs.newt-go} \\\n
-        ${lib.optionalString (
-                !isNull cfg.id
-              ) "--id ${cfg.id} \\\n"}
-        ${lib.optionalString (
-                !isNull cfg.endpoint
-              ) "--endpoint ${cfg.endpoint} \\\n"}
-        --log-level ${cfg.logLevel}
-      ";
       serviceConfig = {
+        ExecStart = "${lib.getExe cfg.package} ${lib.cli.toGNUCommandLineShell { } cfg.settings}";
         DynamicUser = true;
         StateDirectory = "newt";
         StateDirectoryMode = "0700";
diff --git a/nixos/modules/services/networking/ntopng.nix b/nixos/modules/services/networking/ntopng.nix
index a4b718864d37..b97a70db66ce 100644
--- a/nixos/modules/services/networking/ntopng.nix
+++ b/nixos/modules/services/networking/ntopng.nix
@@ -80,7 +80,7 @@ in
 
       httpPort = mkOption {
         default = 3000;
-        type = types.int;
+        type = types.port;
         description = ''
           Sets the HTTP port of the embedded web server.
         '';
diff --git a/nixos/modules/services/networking/onedrive.nix b/nixos/modules/services/networking/onedrive.nix
index dae3ed31b30b..f7d1f0d0de5c 100644
--- a/nixos/modules/services/networking/onedrive.nix
+++ b/nixos/modules/services/networking/onedrive.nix
@@ -31,14 +31,7 @@ in
   options.services.onedrive = {
     enable = lib.mkEnableOption "OneDrive service";
 
-    package = lib.mkOption {
-      type = lib.types.package;
-      default = pkgs.onedrive;
-      defaultText = lib.literalExpression "pkgs.onedrive";
-      description = ''
-        OneDrive package to use.
-      '';
-    };
+    package = lib.mkPackageOption pkgs "onedrive" { };
   };
   ### Implementation
 
diff --git a/nixos/modules/services/networking/pangolin.nix b/nixos/modules/services/networking/pangolin.nix
new file mode 100644
index 000000000000..d612f6953904
--- /dev/null
+++ b/nixos/modules/services/networking/pangolin.nix
@@ -0,0 +1,555 @@
+{
+  utils,
+  config,
+  options,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.pangolin;
+  format = pkgs.formats.yaml { };
+  finalSettings = lib.attrsets.recursiveUpdate pangolinConf cfg.settings;
+  cfgFile = format.generate "config.yml" finalSettings;
+  # override the type to allow for optionality
+  nullOrOpt = t: lib.types.nullOr t // { _optional = true; };
+
+  gerbil-wg0-fix-script = pkgs.writeShellApplication {
+    name = "gerbil-wg0-fix-script";
+    runtimeInputs = with pkgs; [
+      coreutils
+      iproute2
+    ];
+    # will not work if the interface is renamed
+    # https://github.com/fosrl/newt/issues/37#issuecomment-3193385911
+    text = ''
+      if [ ! -f /var/lib/pangolin/config/wg0 ]; then
+          until ip l d wg0
+          do
+            sleep 2
+          done
+          touch /var/lib/pangolin/config/wg0
+          systemctl restart gerbil --no-block
+      fi
+    '';
+  };
+
+  pangolinConf = {
+    app.dashboard_url = "https://${cfg.dashboardDomain}";
+    domains.domain1 = {
+      base_domain = cfg.baseDomain;
+      prefer_wildcard_cert = false;
+    };
+    server = {
+      external_port = 3000;
+      internal_port = 3001;
+      next_port = 3002;
+      integration_port = 3004;
+      # needs to be set, otherwise this fails silently
+      # see https://github.com/fosrl/newt/issues/37
+      internal_hostname = "localhost";
+    };
+    gerbil.base_endpoint = cfg.dashboardDomain;
+    flags.enable_integration_api = false;
+  };
+in
+{
+  options.services = {
+    pangolin = {
+      enable = lib.mkEnableOption "Pangolin reverse proxy server";
+      package = lib.mkPackageOption pkgs "fosrl-pangolin" { };
+
+      settings = lib.mkOption {
+        inherit (format) type;
+        default = { };
+        description = ''
+          Additional attributes to be merged with the configuration options and written to Pangolin's `config.yml` file.
+        '';
+        example = {
+          app = {
+            save_logs = true;
+          };
+          server = {
+            external_port = 3007;
+            internal_port = 3008;
+          };
+          domains.domain1 = {
+            prefer_wildcard_cert = true;
+          };
+        };
+      };
+
+      openFirewall = lib.mkEnableOption "opening TCP ports 80 and 443, and UDP port 51820 in the firewall for the Pangolin service(s)";
+
+      baseDomain = lib.mkOption {
+        type = with lib.types; nullOr str;
+        default = null;
+        description = ''
+          Your base fully qualified domain name (without any subdomains).
+        '';
+        example = "example.com";
+      };
+
+      dashboardDomain = lib.mkOption {
+        type = lib.types.str;
+        default = if (isNull cfg.baseDomain) then "" else "pangolin.${cfg.baseDomain}";
+        defaultText = "pangolin.\${config.services.pangolin.baseDomain}";
+        description = ''
+          The domain where the application will be hosted. This is used for many things, including generating links. You can run Pangolin on a subdomain or root domain. Do not prefix with `http` or `https`.
+        '';
+        example = "auth.example.com";
+      };
+
+      letsEncryptEmail = lib.mkOption {
+        type = with lib.types; nullOr str;
+        default = config.security.acme.defaults.email;
+        defaultText = lib.literalExpression "config.security.acme.defaults.email";
+        description = ''
+          An email address for SSL certificate registration with Let's Encrypt. This should be an email you have access to.
+        '';
+      };
+
+      # this assumes that all domains are hosted by the same provider
+      dnsProvider = lib.mkOption {
+        type = nullOrOpt lib.types.str;
+        default = null;
+        description = ''
+          The DNS provider Traefik will request wildcard certificates from. See the [Traefik Documentation](https://doc.traefik.io/traefik/https/acme/#providers) for more information.
+        '';
+      };
+
+      # provide path to file to keep secrets out of the nix store
+      environmentFile = lib.mkOption {
+        type = with lib.types; nullOr path;
+        default = null;
+        description = ''
+          Path to a file containing sensitive environment variables for Pangolin. See the [Pangolin Documentation](https://docs.fossorial.io/Pangolin/Configuration/config) for more information.
+          These will overwrite anything defined in the config.
+          The file should contain environment-variable assignments like:
+          ```
+          SERVER_SECRET=1234567890abc
+          ```
+        '';
+        example = "/etc/nixos/secrets/pangolin.env";
+      };
+
+      dataDir = lib.mkOption {
+        type = lib.types.str;
+        default = "/var/lib/pangolin";
+        example = "/srv/pangolin";
+        description = "Path to variable state data directory for Pangolin.";
+      };
+    };
+    gerbil = {
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 3003;
+        description = ''
+          Specifies the port to listen on for Gerbil.
+        '';
+      };
+
+      environmentFile = lib.mkOption {
+        type = nullOrOpt lib.types.path;
+        default = null;
+        description = ''
+          Path to a file containing sensitive environment variables for Gerbil. See the [Gerbil Documentation](https://docs.fossorial.io/Pangolin/Configuration/config) for more information.
+          These will overwrite anything defined in the config.
+        '';
+        example = "/etc/nixos/secrets/gerbil.env";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    assertions =
+      (lib.mapAttrsToList (name: value: {
+        # check if the value is optional by looking at the type
+        assertion = (value == null) -> options.services.pangolin."${name}".type._optional or false;
+        message = "services.pangolin.${name} must be provided when Pangolin is enabled.";
+      }) cfg)
+      ++ [
+        {
+          # wildcards implies (dnsProvider and traefikEnvironmentFile)
+          assertion =
+            (finalSettings.traefik.prefer_wildcard_cert or finalSettings.domains.domain1.prefer_wildcard_cert)
+            -> (cfg.dnsProvider != "" && config.services.traefik.environmentFiles != [ ]);
+          message = "services.pangolin.dnsProvider and services.traefik.environmentFile must be provided when prefer_wildcard_cert is true.";
+        }
+      ];
+
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = [
+        80
+        443
+      ];
+      allowedUDPPorts = [ 51820 ];
+    };
+
+    users = {
+      users = {
+        pangolin = {
+          description = "Pangolin service user";
+          group = "fossorial";
+          isSystemUser = true;
+          packages = [ cfg.package ];
+        };
+        gerbil = {
+          description = "Gerbil service user";
+          group = "fossorial";
+          isSystemUser = true;
+        };
+      };
+      groups.fossorial = {
+        members = [
+          "pangolin"
+          "gerbil"
+          "traefik"
+        ];
+      };
+    };
+    # order is as follows
+    # "pangolin.service"
+    # "gerbil.service"
+    # "traefik.service"
+    ### TODO:
+    # make tunnels declarative by calling API
+    ###
+    systemd = {
+      tmpfiles.settings."10-fossorial-paths" = {
+        "${cfg.dataDir}".d = {
+          user = "pangolin";
+          group = "fossorial";
+          mode = "0770";
+        };
+        "${cfg.dataDir}/config".d = {
+          user = "pangolin";
+          group = "fossorial";
+          mode = "0770";
+        };
+        "${cfg.dataDir}/config/letsencrypt".d = {
+          user = "traefik";
+          group = "fossorial";
+          mode = "0700";
+        };
+      };
+      services = {
+        pangolin = {
+          description = "Pangolin reverse proxy tunneling service";
+          wantedBy = [ "multi-user.target" ];
+          requires = [ "network.target" ];
+          after = [ "network.target" ];
+
+          preStart = ''
+            mkdir -p ${cfg.dataDir}/config
+            cp -f ${cfgFile} ${cfg.dataDir}/config/config.yml
+          '';
+
+          serviceConfig = {
+            User = "pangolin";
+            Group = "fossorial";
+            WorkingDirectory = cfg.dataDir;
+            Restart = "always";
+            EnvironmentFile = cfg.environmentFile;
+            # hardening
+            ProtectSystem = "full";
+            ProtectHome = true;
+            PrivateTmp = "disconnected";
+            PrivateDevices = true;
+            PrivateMounts = true;
+            ProtectKernelTunables = true;
+            ProtectKernelModules = true;
+            ProtectKernelLogs = true;
+            ProtectControlGroups = true;
+            LockPersonality = true;
+            RestrictRealtime = true;
+            ProtectClock = true;
+            ProtectProc = "noaccess";
+            ProtectHostname = true;
+            NoNewPrivileges = true;
+            RestrictSUIDSGID = true;
+            RestrictAddressFamilies = [
+              "AF_INET"
+              "AF_INET6"
+              "AF_NETLINK"
+              "AF_UNIX"
+            ];
+            SocketBindDeny = [
+              "ipv4:tcp"
+              "ipv4:udp"
+              "ipv6:udp"
+            ];
+            CapabilityBoundingSet = [
+              "~CAP_BLOCK_SUSPEND"
+              "~CAP_BPF"
+              "~CAP_CHOWN"
+              "~CAP_MKNOD"
+              "~CAP_NET_RAW"
+              "~CAP_PERFMON"
+              "~CAP_SYS_BOOT"
+              "~CAP_SYS_CHROOT"
+              "~CAP_SYS_MODULE"
+              "~CAP_SYS_NICE"
+              "~CAP_SYS_PACCT"
+              "~CAP_SYS_PTRACE"
+              "~CAP_SYS_TIME"
+              "~CAP_SYSLOG"
+              "~CAP_WAKE_ALARM"
+            ];
+            SystemCallFilter = [
+              "~@chown:EPERM"
+              "~@clock:EPERM"
+              "~@cpu-emulation:EPERM"
+              "~@debug:EPERM"
+              "~@keyring:EPERM"
+              "~@memlock:EPERM"
+              "~@module:EPERM"
+              "~@mount:EPERM"
+              "~@obsolete:EPERM"
+              "~@pkey:EPERM"
+              "~@privileged:EPERM"
+              "~@raw-io:EPERM"
+              "~@reboot:EPERM"
+              "~@resources:EPERM"
+              "~@sandbox:EPERM"
+              "~@setuid:EPERM"
+              "~@swap:EPERM"
+              "~@timer:EPERM"
+            ];
+            ExecStart = lib.getExe cfg.package;
+          };
+        };
+        gerbil = {
+          description = "Gerbil Service";
+          wantedBy = [ "multi-user.target" ];
+          after = [ "pangolin.service" ];
+          requires = [ "pangolin.service" ];
+          before = [ "traefik.service" ];
+          requiredBy = [ "traefik.service" ];
+          # restarting gerbil restarts traefik
+          upholds = [ "traefik.service" ];
+
+          # provide default to use correct port without envfile
+          environment = {
+            LISTEN = "localhost:" + toString config.services.gerbil.port;
+          };
+
+          serviceConfig = {
+            User = "gerbil";
+            Group = "fossorial";
+            WorkingDirectory = cfg.dataDir;
+            Restart = "always";
+            EnvironmentFile = cfg.environmentFile;
+            ReadWritePaths = "${cfg.dataDir}/config";
+            # hardening
+            AmbientCapabilities = [
+              "CAP_NET_ADMIN"
+              "CAP_SYS_MODULE"
+            ];
+            CapabilityBoundingSet = [
+              "CAP_NET_ADMIN"
+              "CAP_SYS_MODULE"
+              "~CAP_BLOCK_SUSPEND"
+              "~CAP_BPF"
+              "~CAP_CHOWN"
+              "~CAP_MKNOD"
+              "~CAP_PERFMON"
+              "~CAP_SYS_BOOT"
+              "~CAP_SYS_CHROOT"
+              "~CAP_SYS_NICE"
+              "~CAP_SYS_PACCT"
+              "~CAP_SYS_PTRACE"
+              "~CAP_SYS_TIME"
+              "~CAP_SYS_TTY_CONFIG"
+              "~CAP_SYSLOG"
+              "~CAP_WAKE_ALARM"
+            ];
+            ProtectSystem = "full";
+            ProtectHome = true;
+            PrivateTmp = "disconnected";
+            PrivateDevices = true;
+            PrivateMounts = true;
+            ProtectKernelTunables = true;
+            ProtectKernelModules = true;
+            ProtectKernelLogs = true;
+            ProtectControlGroups = true;
+            LockPersonality = true;
+            RestrictRealtime = true;
+            ProtectClock = true;
+            ProtectProc = "noaccess";
+            ProtectHostname = true;
+            NoNewPrivileges = true;
+            RestrictSUIDSGID = true;
+            MemoryDenyWriteExecute = true;
+            RestrictAddressFamilies = [
+              "AF_INET"
+              "AF_INET6"
+              "AF_NETLINK"
+              "AF_UNIX"
+            ];
+            SystemCallFilter = [
+              "~@aio:EPERM"
+              "~@chown:EPERM"
+              "~@clock:EPERM"
+              "~@cpu-emulation:EPERM"
+              "~@debug:EPERM"
+              "~@keyring:EPERM"
+              "~@memlock:EPERM"
+              "~@mount:EPERM"
+              "~@obsolete:EPERM"
+              "~@pkey:EPERM"
+              "~@privileged:EPERM"
+              "~@raw-io:EPERM"
+              "~@reboot:EPERM"
+              "~@resources:EPERM"
+              "~@sandbox:EPERM"
+              "~@setuid:EPERM"
+              "~@swap:EPERM"
+              "~@sync:EPERM"
+              "~@timer:EPERM"
+            ];
+            ExecStart = utils.escapeSystemdExecArgs [
+              (lib.getExe pkgs.fosrl-gerbil)
+              "--reachableAt=http://localhost:${toString config.services.gerbil.port}"
+              "--generateAndSaveKeyTo=${toString cfg.dataDir}/config/key"
+              "--remoteConfig=http://localhost:${toString finalSettings.server.internal_port}/api/v1/gerbil/get-config"
+            ];
+            # will not work if the interface is renamed
+            # https://github.com/fosrl/newt/issues/37#issuecomment-3193385911
+            ExecStartPost = lib.getExe gerbil-wg0-fix-script;
+          };
+        };
+        traefik = {
+          wantedBy = [ "multi-user.target" ];
+          after = [ "gerbil.service" ];
+          requires = [ "gerbil.service" ];
+          partOf = [ "gerbil.service" ];
+        };
+      };
+    };
+
+    services.traefik = {
+      enable = true;
+      group = "fossorial";
+      dataDir = "${cfg.dataDir}/config/traefik";
+      staticConfigOptions = {
+        providers.http = {
+          endpoint = "http://localhost:${toString finalSettings.server.internal_port}/api/v1/traefik-config";
+          pollInterval = "5s";
+        };
+        # TODO to change this once #437073 is merged.
+        experimental.plugins.badger = {
+          moduleName = "github.com/fosrl/badger";
+          version = "v1.2.0";
+        };
+        certificatesResolvers.letsencrypt.acme =
+          (
+            if finalSettings.domains.domain1.prefer_wildcard_cert then
+              {
+                # see https://doc.traefik.io/traefik/https/acme/#providers
+                dnsChallenge.provider = cfg.dnsProvider;
+              }
+            else
+              {
+                httpChallenge.entryPoint = "web";
+              }
+          )
+          //
+          # common
+          {
+            email = cfg.letsEncryptEmail;
+            storage = "${cfg.dataDir}/config/letsencrypt/acme.json";
+            caServer = "https://acme-v02.api.letsencrypt.org/directory";
+          };
+        entryPoints = {
+          web.address = ":80";
+          websecure = {
+            address = ":443";
+            transport.respondingTimeouts.readTimeout = "30m";
+            http.tls.certResolver = "letsencrypt";
+          };
+        };
+      };
+      dynamicConfigOptions = {
+        http = {
+          middlewares.redirect-to-https.redirectScheme.scheme = "https";
+          routers = {
+            # HTTP to HTTPS redirect router
+            main-app-router-redirect = {
+              rule = "Host(`${cfg.dashboardDomain}`)";
+              service = "next-service";
+              entryPoints = [ "web" ];
+              middlewares = [ "redirect-to-https" ];
+            };
+            # Next.js router (handles everything except API and WebSocket paths)
+            next-router = {
+              rule = "Host(`${cfg.dashboardDomain}`) && !PathPrefix(`/api/v1`)";
+              service = "next-service";
+              entryPoints = [ "websecure" ];
+              tls =
+                lib.optionalAttrs (finalSettings.domains.domain1.prefer_wildcard_cert) {
+                  domains = [
+                    { main = cfg.baseDomain; }
+                    { sans = "*.${cfg.baseDomain}"; }
+                  ];
+                }
+                //
+                # common
+                {
+                  certResolver = "letsencrypt";
+                };
+            };
+            # API router (handles /api/v1 paths)
+            api-router = {
+              rule = "Host(`${cfg.dashboardDomain}`) && PathPrefix(`/api/v1`)";
+              service = "api-service";
+              entryPoints = [ "websecure" ];
+              tls.certResolver = "letsencrypt";
+            };
+            # WebSocket router
+            ws-router = {
+              rule = "Host(`${cfg.dashboardDomain}`)";
+              service = "api-service";
+              entryPoints = [ "websecure" ];
+              tls.certResolver = "letsencrypt";
+            };
+            # Integration API router
+            int-api-router-redirect = lib.mkIf (finalSettings.flags.enable_integration_api) {
+              rule = "Host(`api.${cfg.baseDomain}`)";
+              service = "int-api-service";
+              entryPoints = [ "web" ];
+              middlewares = [ "redirect-to-https" ];
+            };
+            int-api-router = lib.mkIf (finalSettings.flags.enable_integration_api) {
+              rule = "Host(`api.${cfg.baseDomain}`)";
+              service = "int-api-service";
+              entryPoints = [ "websecure" ];
+              tls.certResolver = "letsencrypt";
+            };
+          };
+          # could be map
+          services = {
+            # Next.js server
+            next-service.loadBalancer.servers = [
+              { url = "http://localhost:${toString finalSettings.server.next_port}"; }
+            ];
+            # API/WebSocket server
+            api-service.loadBalancer.servers = [
+              { url = "http://localhost:${toString finalSettings.server.external_port}"; }
+            ];
+            # Integration API server
+            int-api-service.loadBalancer.servers = lib.mkIf (finalSettings.flags.enable_integration_api) [
+              { url = "http://localhost:${toString finalSettings.server.integration_port}"; }
+            ];
+          };
+        };
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [
+    jackr
+    sigmasquadron
+  ];
+}
diff --git a/nixos/modules/services/networking/prosody.nix b/nixos/modules/services/networking/prosody.nix
index ce55056710e2..12879870fe39 100644
--- a/nixos/modules/services/networking/prosody.nix
+++ b/nixos/modules/services/networking/prosody.nix
@@ -708,7 +708,7 @@ in
 
       # HTTP server-related options
       httpPorts = mkOption {
-        type = types.listOf types.int;
+        type = types.listOf types.port;
         description = "Listening HTTP ports list for this service.";
         default = [ 5280 ];
       };
@@ -723,7 +723,7 @@ in
       };
 
       httpsPorts = mkOption {
-        type = types.listOf types.int;
+        type = types.listOf types.port;
         description = "Listening HTTPS ports list for this service.";
         default = [ 5281 ];
       };
diff --git a/nixos/modules/services/networking/radvd.nix b/nixos/modules/services/networking/radvd.nix
index 17bc051fca20..19a0b293095d 100644
--- a/nixos/modules/services/networking/radvd.nix
+++ b/nixos/modules/services/networking/radvd.nix
@@ -39,7 +39,7 @@ in
     package = mkPackageOption pkgs "radvd" { };
 
     debugLevel = mkOption {
-      type = types.int;
+      type = types.ints.between 0 5;
       default = 0;
       example = 5;
       description = ''
diff --git a/nixos/modules/services/networking/resilio.nix b/nixos/modules/services/networking/resilio.nix
index 25ad4b13daf2..2b72d7cbffc0 100644
--- a/nixos/modules/services/networking/resilio.nix
+++ b/nixos/modules/services/networking/resilio.nix
@@ -113,7 +113,7 @@ in
       };
 
       listeningPort = mkOption {
-        type = types.int;
+        type = types.port;
         default = 0;
         example = 44444;
         description = ''
@@ -139,7 +139,7 @@ in
       };
 
       downloadLimit = mkOption {
-        type = types.int;
+        type = types.ints.unsigned;
         default = 0;
         example = 1024;
         description = ''
@@ -148,7 +148,7 @@ in
       };
 
       uploadLimit = mkOption {
-        type = types.int;
+        type = types.ints.unsigned;
         default = 0;
         example = 1024;
         description = ''
@@ -166,7 +166,7 @@ in
       };
 
       httpListenPort = mkOption {
-        type = types.int;
+        type = types.port;
         default = 9000;
         description = ''
           HTTP port to bind on.
diff --git a/nixos/modules/services/networking/shorewall.nix b/nixos/modules/services/networking/shorewall.nix
index 3d59b7d09c73..184c5fd7caf2 100644
--- a/nixos/modules/services/networking/shorewall.nix
+++ b/nixos/modules/services/networking/shorewall.nix
@@ -24,12 +24,7 @@ in
           :::
         '';
       };
-      package = lib.mkOption {
-        type = types.package;
-        default = pkgs.shorewall;
-        defaultText = lib.literalExpression "pkgs.shorewall";
-        description = "The shorewall package to use.";
-      };
+      package = lib.mkPackageOption pkgs "shorewall" { };
       configs = lib.mkOption {
         type = types.attrsOf types.lines;
         default = { };
diff --git a/nixos/modules/services/networking/shorewall6.nix b/nixos/modules/services/networking/shorewall6.nix
index fe40f7e430e3..74314706c459 100644
--- a/nixos/modules/services/networking/shorewall6.nix
+++ b/nixos/modules/services/networking/shorewall6.nix
@@ -24,12 +24,7 @@ in
           :::
         '';
       };
-      package = lib.mkOption {
-        type = types.package;
-        default = pkgs.shorewall;
-        defaultText = lib.literalExpression "pkgs.shorewall";
-        description = "The shorewall package to use.";
-      };
+      package = lib.mkPackageOption pkgs "shorewall" { };
       configs = lib.mkOption {
         type = types.attrsOf types.lines;
         default = { };
diff --git a/nixos/modules/services/networking/sitespeed-io.nix b/nixos/modules/services/networking/sitespeed-io.nix
index 338328dd94f0..c00a10d40d71 100644
--- a/nixos/modules/services/networking/sitespeed-io.nix
+++ b/nixos/modules/services/networking/sitespeed-io.nix
@@ -18,12 +18,7 @@ in
       description = "User account under which sitespeed-io runs.";
     };
 
-    package = lib.mkOption {
-      type = lib.types.package;
-      default = pkgs.sitespeed-io;
-      defaultText = "pkgs.sitespeed-io";
-      description = "Sitespeed.io package to use.";
-    };
+    package = lib.mkPackageOption pkgs "sitespeed-io" { };
 
     dataDir = lib.mkOption {
       default = "/var/lib/sitespeed-io";
diff --git a/nixos/modules/services/networking/squid.nix b/nixos/modules/services/networking/squid.nix
index 7a6a5cea15fc..bc072c249c56 100644
--- a/nixos/modules/services/networking/squid.nix
+++ b/nixos/modules/services/networking/squid.nix
@@ -145,7 +145,7 @@ in
       };
 
       proxyPort = mkOption {
-        type = types.int;
+        type = types.port;
         default = 3128;
         description = "TCP port on which squid will listen.";
       };
diff --git a/nixos/modules/services/networking/syncplay.nix b/nixos/modules/services/networking/syncplay.nix
index f2e387282e14..72b6fc3a1bc3 100644
--- a/nixos/modules/services/networking/syncplay.nix
+++ b/nixos/modules/services/networking/syncplay.nix
@@ -290,14 +290,7 @@ in
         '';
       };
 
-      package = mkOption {
-        type = types.package;
-        default = pkgs.syncplay-nogui;
-        defaultText = literalExpression "pkgs.syncplay-nogui";
-        description = ''
-          Package to use for syncplay.
-        '';
-      };
+      package = mkPackageOption pkgs "syncplay-nogui" { };
     };
   };
 
diff --git a/nixos/modules/services/networking/syncthing.nix b/nixos/modules/services/networking/syncthing.nix
index 19c8ce15dfec..aa4d08a7f74a 100644
--- a/nixos/modules/services/networking/syncthing.nix
+++ b/nixos/modules/services/networking/syncthing.nix
@@ -336,7 +336,7 @@ in
                     };
 
                     localAnnouncePort = mkOption {
-                      type = types.nullOr types.int;
+                      type = types.nullOr types.port;
                       default = null;
                       description = ''
                         The port on which to listen and send IPv4 broadcast announcements to.
diff --git a/nixos/modules/services/networking/websockify.nix b/nixos/modules/services/networking/websockify.nix
index c9219fc17d51..5e17e9bc7818 100644
--- a/nixos/modules/services/networking/websockify.nix
+++ b/nixos/modules/services/networking/websockify.nix
@@ -36,7 +36,7 @@ in
       portMap = mkOption {
         description = "Ports to map by default.";
         default = { };
-        type = types.attrsOf types.int;
+        type = types.attrsOf types.port;
       };
     };
   };
diff --git a/nixos/modules/services/networking/x2goserver.nix b/nixos/modules/services/networking/x2goserver.nix
index 8ea2c50e2bd2..52bf7b25ea5f 100644
--- a/nixos/modules/services/networking/x2goserver.nix
+++ b/nixos/modules/services/networking/x2goserver.nix
@@ -37,14 +37,7 @@ in
       '';
     };
 
-    package = mkOption {
-      type = types.package;
-      default = pkgs.x2goserver;
-      defaultText = literalExpression "pkgs.x2goserver";
-      description = ''
-        The x2goserver package to use.
-      '';
-    };
+    package = mkPackageOption pkgs "x2goserver" { };
 
     superenicer = {
       enable = mkEnableOption "superenicer" // {
diff --git a/nixos/modules/services/networking/zenohd.nix b/nixos/modules/services/networking/zenohd.nix
index 70eceab48792..8e86635154d3 100644
--- a/nixos/modules/services/networking/zenohd.nix
+++ b/nixos/modules/services/networking/zenohd.nix
@@ -10,6 +10,7 @@ let
     types
     mkDefault
     mkOption
+    mkPackageOption
     ;
 
   json = pkgs.formats.json { };
@@ -22,12 +23,7 @@ in
     services.zenohd = {
       enable = lib.mkEnableOption "Zenoh daemon.";
 
-      package = mkOption {
-        description = "The zenoh package to use.";
-        type = types.package;
-        default = pkgs.zenoh;
-        defaultText = "pkgs.zenoh";
-      };
+      package = mkPackageOption pkgs "zenoh" { };
 
       settings = mkOption {
         description = ''
diff --git a/nixos/modules/services/networking/zerobin.nix b/nixos/modules/services/networking/zerobin.nix
index 49bcc9e830d3..96cf4cc7148d 100644
--- a/nixos/modules/services/networking/zerobin.nix
+++ b/nixos/modules/services/networking/zerobin.nix
@@ -44,7 +44,7 @@ in
       };
 
       listenPort = mkOption {
-        type = types.int;
+        type = types.port;
         default = 8000;
         example = 1357;
         description = ''
diff --git a/nixos/modules/services/search/elasticsearch.nix b/nixos/modules/services/search/elasticsearch.nix
index c7f21236e0fd..7813f154ecd6 100644
--- a/nixos/modules/services/search/elasticsearch.nix
+++ b/nixos/modules/services/search/elasticsearch.nix
@@ -72,7 +72,7 @@ in
     tcp_port = mkOption {
       description = "Elasticsearch port for the node to node communication.";
       default = 9300;
-      type = types.int;
+      type = types.port;
     };
 
     cluster_name = mkOption {
diff --git a/nixos/modules/services/security/cfssl.nix b/nixos/modules/services/security/cfssl.nix
index 514442dbe437..329002417a25 100644
--- a/nixos/modules/services/security/cfssl.nix
+++ b/nixos/modules/services/security/cfssl.nix
@@ -154,14 +154,7 @@ in
 
     logLevel = lib.mkOption {
       default = 1;
-      type = lib.types.enum [
-        0
-        1
-        2
-        3
-        4
-        5
-      ];
+      type = lib.types.ints.between 0 5;
       description = "Log level (0 = DEBUG, 5 = FATAL).";
     };
 
diff --git a/nixos/modules/services/security/kanidm.nix b/nixos/modules/services/security/kanidm.nix
index adab048c5bf1..12599379ff01 100644
--- a/nixos/modules/services/security/kanidm.nix
+++ b/nixos/modules/services/security/kanidm.nix
@@ -996,6 +996,9 @@ in
           "-/etc/resolv.conf"
           "-/etc/nsswitch.conf"
           "-/etc/hosts"
+          "-/etc/passwd"
+          "-/etc/group"
+          "-/etc/shadow"
           "-/etc/localtime"
           "-/etc/kanidm"
           "-/etc/static/kanidm"
diff --git a/nixos/modules/services/security/opensnitch.nix b/nixos/modules/services/security/opensnitch.nix
index 26c015a8107e..12643b20bd6a 100644
--- a/nixos/modules/services/security/opensnitch.nix
+++ b/nixos/modules/services/security/opensnitch.nix
@@ -108,13 +108,7 @@ in
             };
 
             LogLevel = lib.mkOption {
-              type = lib.types.enum [
-                0
-                1
-                2
-                3
-                4
-              ];
+              type = lib.types.ints.between 0 4;
               description = ''
                 Default log level from 0 to 4 (debug, info, important, warning,
                 error).
diff --git a/nixos/modules/services/security/shibboleth-sp.nix b/nixos/modules/services/security/shibboleth-sp.nix
index e9f92dcc0928..74dd333b1ae7 100644
--- a/nixos/modules/services/security/shibboleth-sp.nix
+++ b/nixos/modules/services/security/shibboleth-sp.nix
@@ -30,13 +30,13 @@ in
       };
 
       fastcgi.shibAuthorizerPort = lib.mkOption {
-        type = lib.types.int;
+        type = lib.types.port;
         default = 9100;
         description = "Port for shibauthorizer FastCGI process to bind to";
       };
 
       fastcgi.shibResponderPort = lib.mkOption {
-        type = lib.types.int;
+        type = lib.types.port;
         default = 9101;
         description = "Port for shibauthorizer FastCGI process to bind to";
       };
diff --git a/nixos/modules/services/security/step-ca.nix b/nixos/modules/services/security/step-ca.nix
index 3465d93f2fd0..d7ed2acf7664 100644
--- a/nixos/modules/services/security/step-ca.nix
+++ b/nixos/modules/services/security/step-ca.nix
@@ -15,12 +15,7 @@ in
     services.step-ca = {
       enable = lib.mkEnableOption "the smallstep certificate authority server";
       openFirewall = lib.mkEnableOption "opening the certificate authority server port";
-      package = lib.mkOption {
-        type = lib.types.package;
-        default = pkgs.step-ca;
-        defaultText = lib.literalExpression "pkgs.step-ca";
-        description = "Which step-ca package to use.";
-      };
+      package = lib.mkPackageOption pkgs "step-ca" { };
       address = lib.mkOption {
         type = lib.types.str;
         example = "127.0.0.1";
diff --git a/nixos/modules/services/security/tang.nix b/nixos/modules/services/security/tang.nix
index 6bf03d107def..5efb05fd324b 100644
--- a/nixos/modules/services/security/tang.nix
+++ b/nixos/modules/services/security/tang.nix
@@ -11,12 +11,7 @@ in
   options.services.tang = {
     enable = lib.mkEnableOption "tang";
 
-    package = lib.mkOption {
-      type = lib.types.package;
-      default = pkgs.tang;
-      defaultText = lib.literalExpression "pkgs.tang";
-      description = "The tang package to use.";
-    };
+    package = lib.mkPackageOption pkgs "tang" { };
 
     listenStream = lib.mkOption {
       type = with lib.types; listOf str;
diff --git a/nixos/modules/services/security/vaultwarden/default.nix b/nixos/modules/services/security/vaultwarden/default.nix
index b564cd283d4e..e15f8a2eeeb1 100644
--- a/nixos/modules/services/security/vaultwarden/default.nix
+++ b/nixos/modules/services/security/vaultwarden/default.nix
@@ -197,12 +197,7 @@ in
 
     package = lib.mkPackageOption pkgs "vaultwarden" { };
 
-    webVaultPackage = lib.mkOption {
-      type = lib.types.package;
-      default = pkgs.vaultwarden.webvault;
-      defaultText = lib.literalExpression "pkgs.vaultwarden.webvault";
-      description = "Web vault package to use.";
-    };
+    webVaultPackage = lib.mkPackageOption pkgs [ "vaultwarden" "webvault" ] { };
   };
 
   config = lib.mkIf cfg.enable {
diff --git a/nixos/modules/services/system/cachix-watch-store.nix b/nixos/modules/services/system/cachix-watch-store.nix
index 0df74b927afa..b30a57cd4926 100644
--- a/nixos/modules/services/system/cachix-watch-store.nix
+++ b/nixos/modules/services/system/cachix-watch-store.nix
@@ -36,13 +36,13 @@ in
     };
 
     compressionLevel = lib.mkOption {
-      type = lib.types.nullOr lib.types.int;
+      type = lib.types.nullOr (lib.types.ints.between 0 16);
       description = "The compression level for ZSTD compression (between 0 and 16)";
       default = null;
     };
 
     jobs = lib.mkOption {
-      type = lib.types.nullOr lib.types.int;
+      type = lib.types.nullOr lib.types.ints.positive;
       description = "Number of threads used for pushing store paths";
       default = null;
     };
diff --git a/nixos/modules/services/web-apps/anuko-time-tracker.nix b/nixos/modules/services/web-apps/anuko-time-tracker.nix
index 52cbfd5ae4f0..4d00d418a1dc 100644
--- a/nixos/modules/services/web-apps/anuko-time-tracker.nix
+++ b/nixos/modules/services/web-apps/anuko-time-tracker.nix
@@ -225,7 +225,7 @@ in
         };
 
         smtpPort = lib.mkOption {
-          type = lib.types.int;
+          type = lib.types.port;
           description = "MTA port.";
           default = 25;
         };
diff --git a/nixos/modules/services/web-apps/baikal.nix b/nixos/modules/services/web-apps/baikal.nix
index 91a007e6e541..d1be94aa6204 100644
--- a/nixos/modules/services/web-apps/baikal.nix
+++ b/nixos/modules/services/web-apps/baikal.nix
@@ -44,23 +44,8 @@ in
           Name of the nginx virtualhost to use and setup. If null, do not setup any virtualhost.
         '';
       };
-      phpPackage = lib.mkOption {
-        type = lib.types.package;
-        default = pkgs.php;
-        defaultText = "pkgs.php";
-        description = ''
-          php package to use for php fpm daemon.
-        '';
-      };
-      package = lib.mkOption {
-        type = lib.types.package;
-        default = pkgs.baikal;
-        defaultText = "pkgs.baikal";
-        description = ''
-          Baikal package to use.
-        '';
-      };
-
+      phpPackage = lib.mkPackageOption pkgs "php" { };
+      package = lib.mkPackageOption pkgs "baikal" { };
     };
   };
   config = lib.mkIf cfg.enable {
diff --git a/nixos/modules/services/web-apps/castopod.nix b/nixos/modules/services/web-apps/castopod.nix
index 1c428cead548..1567ad1d2dc9 100644
--- a/nixos/modules/services/web-apps/castopod.nix
+++ b/nixos/modules/services/web-apps/castopod.nix
@@ -32,12 +32,7 @@ in
   options.services = {
     castopod = {
       enable = lib.mkEnableOption "Castopod, a hosting platform for podcasters";
-      package = lib.mkOption {
-        type = lib.types.package;
-        default = pkgs.castopod;
-        defaultText = lib.literalMD "pkgs.castopod";
-        description = "Which Castopod package to use.";
-      };
+      package = lib.mkPackageOption pkgs "castopod" { };
       dataDir = lib.mkOption {
         type = lib.types.path;
         default = "/var/lib/castopod";
diff --git a/nixos/modules/services/web-apps/cryptpad.nix b/nixos/modules/services/web-apps/cryptpad.nix
index 0ec6df1419bb..4a38d9589678 100644
--- a/nixos/modules/services/web-apps/cryptpad.nix
+++ b/nixos/modules/services/web-apps/cryptpad.nix
@@ -75,12 +75,12 @@ in
             description = "Address on which the Node.js server should listen";
           };
           httpPort = mkOption {
-            type = types.int;
+            type = types.port;
             default = 3000;
             description = "Port on which the Node.js server should listen";
           };
           websocketPort = mkOption {
-            type = types.int;
+            type = types.port;
             default = 3003;
             description = "Port for the websocket that needs to be separate";
           };
diff --git a/nixos/modules/services/web-apps/invoiceplane.nix b/nixos/modules/services/web-apps/invoiceplane.nix
index 1a01f0c17ceb..f4bbcb0f5f09 100644
--- a/nixos/modules/services/web-apps/invoiceplane.nix
+++ b/nixos/modules/services/web-apps/invoiceplane.nix
@@ -95,6 +95,9 @@ let
         ${concatMapStringsSep "\n" (
           template: "cp -r ${template}/. $out/application/views/invoice_templates/pdf/"
         ) cfg.invoiceTemplates}
+        ${concatMapStringsSep "\n" (
+          template: "cp -r ${template}/. $out/application/views/quote_templates/pdf/"
+        ) cfg.quoteTemplates}
       '';
     };
 
@@ -189,6 +192,38 @@ let
           '';
         };
 
+        quoteTemplates = mkOption {
+          type = types.listOf types.path;
+          default = [ ];
+          description = ''
+            List of path(s) to respective template(s) which are copied from the 'quote_templates/pdf' directory.
+
+            ::: {.note}
+            These templates need to be packaged before use, see example.
+            :::
+          '';
+          example = literalExpression ''
+            let
+              # Let's package an example template
+              template-vtdirektmarketing = pkgs.stdenv.mkDerivation {
+                name = "vtdirektmarketing";
+                # Download the template from a public repository
+                src = pkgs.fetchgit {
+                  url = "https://git.project-insanity.org/onny/invoiceplane-vtdirektmarketing.git";
+                  sha256 = "1hh0q7wzsh8v8x03i82p6qrgbxr4v5fb05xylyrpp975l8axyg2z";
+                };
+                sourceRoot = ".";
+                # Installing simply means copying template php file to the output directory
+                installPhase = ""
+                  mkdir -p $out
+                  cp invoiceplane-vtdirektmarketing/vtdirektmarketing.php $out/
+                "";
+              };
+            # And then pass this package to the template list like this:
+            in [ template-vtdirektmarketing ]
+          '';
+        };
+
         poolConfig = mkOption {
           type =
             with types;
diff --git a/nixos/modules/services/web-apps/kasmweb/default.nix b/nixos/modules/services/web-apps/kasmweb/default.nix
index a5a5edd6deac..a32116562686 100644
--- a/nixos/modules/services/web-apps/kasmweb/default.nix
+++ b/nixos/modules/services/web-apps/kasmweb/default.nix
@@ -102,7 +102,7 @@ in
     };
 
     listenPort = lib.mkOption {
-      type = lib.types.int;
+      type = lib.types.port;
       default = 443;
       description = ''
         The port on which kasmweb should listen.
diff --git a/nixos/modules/services/web-apps/mastodon.nix b/nixos/modules/services/web-apps/mastodon.nix
index 6cd51efbf60a..8a197c947a6e 100644
--- a/nixos/modules/services/web-apps/mastodon.nix
+++ b/nixos/modules/services/web-apps/mastodon.nix
@@ -706,12 +706,7 @@ in
         };
       };
 
-      package = lib.mkOption {
-        type = lib.types.package;
-        default = pkgs.mastodon;
-        defaultText = lib.literalExpression "pkgs.mastodon";
-        description = "Mastodon package to use.";
-      };
+      package = lib.mkPackageOption pkgs "mastodon" { };
 
       extraConfig = lib.mkOption {
         type = lib.types.attrs;
diff --git a/nixos/modules/services/web-apps/nextcloud-notify_push.nix b/nixos/modules/services/web-apps/nextcloud-notify_push.nix
index 50dc65cf3b2d..ce4986b2cfa2 100644
--- a/nixos/modules/services/web-apps/nextcloud-notify_push.nix
+++ b/nixos/modules/services/web-apps/nextcloud-notify_push.nix
@@ -14,12 +14,7 @@ in
   options.services.nextcloud.notify_push = {
     enable = lib.mkEnableOption "Notify push";
 
-    package = lib.mkOption {
-      type = lib.types.package;
-      default = pkgs.nextcloud-notify_push;
-      defaultText = lib.literalMD "pkgs.nextcloud-notify_push";
-      description = "Which package to use for notify_push";
-    };
+    package = lib.mkPackageOption pkgs "nextcloud-notify_push" { };
 
     socketPath = lib.mkOption {
       type = lib.types.str;
diff --git a/nixos/modules/services/web-apps/nexus.nix b/nixos/modules/services/web-apps/nexus.nix
index b3ad13f4102b..1a97c88900f9 100644
--- a/nixos/modules/services/web-apps/nexus.nix
+++ b/nixos/modules/services/web-apps/nexus.nix
@@ -46,7 +46,7 @@ in
       };
 
       listenPort = mkOption {
-        type = types.int;
+        type = types.port;
         default = 8081;
         description = "Port to listen on.";
       };
diff --git a/nixos/modules/services/web-apps/nifi.nix b/nixos/modules/services/web-apps/nifi.nix
index a59e5066cf48..f4c175a68aa2 100644
--- a/nixos/modules/services/web-apps/nifi.nix
+++ b/nixos/modules/services/web-apps/nifi.nix
@@ -37,12 +37,7 @@ in
     services.nifi = {
       enable = lib.mkEnableOption "Apache NiFi";
 
-      package = lib.mkOption {
-        type = lib.types.package;
-        default = pkgs.nifi;
-        defaultText = lib.literalExpression "pkgs.nifi";
-        description = "Apache NiFi package to use.";
-      };
+      package = lib.mkPackageOption pkgs "nifi" { };
 
       user = lib.mkOption {
         type = lib.types.str;
@@ -74,7 +69,7 @@ in
       };
 
       listenPort = lib.mkOption {
-        type = lib.types.int;
+        type = lib.types.port;
         default = if cfg.enableHTTPS then 8443 else 8080;
         defaultText = lib.literalExpression ''
           if config.${opt.enableHTTPS}
@@ -96,7 +91,7 @@ in
       };
 
       proxyPort = lib.mkOption {
-        type = lib.types.nullOr lib.types.int;
+        type = lib.types.nullOr lib.types.port;
         default = if cfg.enableHTTPS then 8443 else null;
         defaultText = lib.literalExpression ''
           if config.${opt.enableHTTPS}
diff --git a/nixos/modules/services/web-apps/peertube.nix b/nixos/modules/services/web-apps/peertube.nix
index 795d0947ea9e..c4213319e052 100644
--- a/nixos/modules/services/web-apps/peertube.nix
+++ b/nixos/modules/services/web-apps/peertube.nix
@@ -338,12 +338,7 @@ in
       };
     };
 
-    package = lib.mkOption {
-      type = lib.types.package;
-      default = pkgs.peertube;
-      defaultText = lib.literalExpression "pkgs.peertube";
-      description = "PeerTube package to use.";
-    };
+    package = lib.mkPackageOption pkgs "peertube" { };
   };
 
   config = lib.mkIf cfg.enable {
diff --git a/nixos/modules/services/web-apps/pgpkeyserver-lite.nix b/nixos/modules/services/web-apps/pgpkeyserver-lite.nix
index ff533bb669c9..6e7fbf7e1353 100644
--- a/nixos/modules/services/web-apps/pgpkeyserver-lite.nix
+++ b/nixos/modules/services/web-apps/pgpkeyserver-lite.nix
@@ -47,7 +47,7 @@ in
       hkpPort = mkOption {
         default = sksCfg.hkpPort;
         defaultText = literalExpression "config.${sksOpt.hkpPort}";
-        type = types.int;
+        type = types.port;
         description = ''
           Which port the sks-keyserver is listening on.
         '';
diff --git a/nixos/modules/services/web-apps/plantuml-server.nix b/nixos/modules/services/web-apps/plantuml-server.nix
index 43d08ff77d82..39d5ffc92496 100644
--- a/nixos/modules/services/web-apps/plantuml-server.nix
+++ b/nixos/modules/services/web-apps/plantuml-server.nix
@@ -75,7 +75,7 @@ in
       };
 
       listenPort = mkOption {
-        type = types.int;
+        type = types.port;
         default = 8080;
         description = "Port to listen on.";
       };
diff --git a/nixos/modules/services/web-apps/silverbullet.nix b/nixos/modules/services/web-apps/silverbullet.nix
index e1b795a30749..789fafb68f7f 100644
--- a/nixos/modules/services/web-apps/silverbullet.nix
+++ b/nixos/modules/services/web-apps/silverbullet.nix
@@ -24,7 +24,7 @@ in
       };
 
       listenPort = lib.mkOption {
-        type = lib.types.int;
+        type = lib.types.port;
         default = 3000;
         description = "Port to listen on.";
       };
diff --git a/nixos/modules/services/web-apps/writefreely.nix b/nixos/modules/services/web-apps/writefreely.nix
index ce3ea822d0ed..b2969ed1bcfa 100644
--- a/nixos/modules/services/web-apps/writefreely.nix
+++ b/nixos/modules/services/web-apps/writefreely.nix
@@ -152,12 +152,7 @@ in
   options.services.writefreely = {
     enable = lib.mkEnableOption "Writefreely, build a digital writing community";
 
-    package = lib.mkOption {
-      type = lib.types.package;
-      default = pkgs.writefreely;
-      defaultText = lib.literalExpression "pkgs.writefreely";
-      description = "Writefreely package to use.";
-    };
+    package = lib.mkPackageOption pkgs "writefreely" { };
 
     stateDir = mkOption {
       type = types.path;
diff --git a/nixos/modules/services/web-apps/youtrack.nix b/nixos/modules/services/web-apps/youtrack.nix
index 1c9347ce8747..ca5fa2a8867e 100644
--- a/nixos/modules/services/web-apps/youtrack.nix
+++ b/nixos/modules/services/web-apps/youtrack.nix
@@ -51,14 +51,7 @@ in
       type = lib.types.str;
     };
 
-    package = lib.mkOption {
-      description = ''
-        Package to use.
-      '';
-      type = lib.types.package;
-      default = pkgs.youtrack;
-      defaultText = lib.literalExpression "pkgs.youtrack";
-    };
+    package = lib.mkPackageOption pkgs "youtrack" { };
 
     statePath = lib.mkOption {
       description = ''
diff --git a/nixos/modules/services/web-servers/apache-httpd/default.nix b/nixos/modules/services/web-servers/apache-httpd/default.nix
index 07d4ad7fccfa..28d64a2e2bee 100644
--- a/nixos/modules/services/web-servers/apache-httpd/default.nix
+++ b/nixos/modules/services/web-servers/apache-httpd/default.nix
@@ -704,14 +704,14 @@ in
       };
 
       maxClients = mkOption {
-        type = types.int;
+        type = types.ints.positive;
         default = 150;
         example = 8;
         description = "Maximum number of httpd processes (prefork)";
       };
 
       maxRequestsPerChild = mkOption {
-        type = types.int;
+        type = types.ints.unsigned;
         default = 0;
         example = 500;
         description = ''
diff --git a/nixos/modules/services/web-servers/keter/default.nix b/nixos/modules/services/web-servers/keter/default.nix
index 4a1b08bfd933..5dec058f661a 100644
--- a/nixos/modules/services/web-servers/keter/default.nix
+++ b/nixos/modules/services/web-servers/keter/default.nix
@@ -31,12 +31,7 @@ in
       description = "Mutable state folder for keter";
     };
 
-    package = lib.mkOption {
-      type = lib.types.package;
-      default = pkgs.haskellPackages.keter;
-      defaultText = lib.literalExpression "pkgs.haskellPackages.keter";
-      description = "The keter package to be used";
-    };
+    package = lib.mkPackageOption pkgs [ "haskellPackages" "keter" ] { };
 
     globalKeterConfig = lib.mkOption {
       type = lib.types.submodule {
diff --git a/nixos/modules/services/web-servers/stargazer.nix b/nixos/modules/services/web-servers/stargazer.nix
index c29f0107cd0e..4af08aeba0c1 100644
--- a/nixos/modules/services/web-servers/stargazer.nix
+++ b/nixos/modules/services/web-servers/stargazer.nix
@@ -74,7 +74,7 @@ in
     };
 
     requestTimeout = lib.mkOption {
-      type = lib.types.int;
+      type = lib.types.ints.unsigned;
       default = 5;
       description = ''
         Number of seconds to wait for the client to send a complete
@@ -83,7 +83,7 @@ in
     };
 
     responseTimeout = lib.mkOption {
-      type = lib.types.int;
+      type = lib.types.ints.unsigned;
       default = 0;
       description = ''
         Number of seconds to wait for the client to send a complete
diff --git a/nixos/modules/services/x11/display-managers/lightdm-greeters/enso-os.nix b/nixos/modules/services/x11/display-managers/lightdm-greeters/enso-os.nix
index 85de2ce62849..977042a074bd 100644
--- a/nixos/modules/services/x11/display-managers/lightdm-greeters/enso-os.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm-greeters/enso-os.nix
@@ -38,15 +38,7 @@ in
       };
 
       theme = {
-        package = mkOption {
-          type = types.package;
-          default = pkgs.gnome-themes-extra;
-          defaultText = literalExpression "pkgs.gnome-themes-extra";
-          description = ''
-            The package path that contains the theme given in the name option.
-          '';
-        };
-
+        package = mkPackageOption pkgs "gnome-themes-extra" { };
         name = mkOption {
           type = types.str;
           default = "Adwaita";
@@ -57,15 +49,7 @@ in
       };
 
       iconTheme = {
-        package = mkOption {
-          type = types.package;
-          default = pkgs.papirus-icon-theme;
-          defaultText = literalExpression "pkgs.papirus-icon-theme";
-          description = ''
-            The package path that contains the icon theme given in the name option.
-          '';
-        };
-
+        package = mkPackageOption pkgs "papirus-icon-theme" { };
         name = mkOption {
           type = types.str;
           default = "ePapirus";
@@ -76,15 +60,7 @@ in
       };
 
       cursorTheme = {
-        package = mkOption {
-          type = types.package;
-          default = pkgs.capitaine-cursors;
-          defaultText = literalExpression "pkgs.capitaine-cursors";
-          description = ''
-            The package path that contains the cursor theme given in the name option.
-          '';
-        };
-
+        package = mkPackageOption pkgs "capitaine-cursors" { };
         name = mkOption {
           type = types.str;
           default = "capitane-cursors";
diff --git a/nixos/modules/services/x11/display-managers/lightdm-greeters/gtk.nix b/nixos/modules/services/x11/display-managers/lightdm-greeters/gtk.nix
index 468ab09c66a5..93726529ca47 100644
--- a/nixos/modules/services/x11/display-managers/lightdm-greeters/gtk.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm-greeters/gtk.nix
@@ -49,14 +49,7 @@ in
 
       theme = {
 
-        package = mkOption {
-          type = types.package;
-          default = pkgs.gnome-themes-extra;
-          defaultText = literalExpression "pkgs.gnome-themes-extra";
-          description = ''
-            The package path that contains the theme given in the name option.
-          '';
-        };
+        package = mkPackageOption pkgs "gnome-themes-extra" { };
 
         name = mkOption {
           type = types.str;
@@ -70,14 +63,7 @@ in
 
       iconTheme = {
 
-        package = mkOption {
-          type = types.package;
-          default = pkgs.adwaita-icon-theme;
-          defaultText = literalExpression "pkgs.adwaita-icon-theme";
-          description = ''
-            The package path that contains the icon theme given in the name option.
-          '';
-        };
+        package = mkPackageOption pkgs "adwaita-icon-theme" { };
 
         name = mkOption {
           type = types.str;
@@ -91,14 +77,7 @@ in
 
       cursorTheme = {
 
-        package = mkOption {
-          type = types.package;
-          default = pkgs.adwaita-icon-theme;
-          defaultText = literalExpression "pkgs.adwaita-icon-theme";
-          description = ''
-            The package path that contains the cursor theme given in the name option.
-          '';
-        };
+        package = mkPackageOption pkgs "adwaita-icon-theme" { };
 
         name = mkOption {
           type = types.str;
diff --git a/nixos/modules/services/x11/display-managers/lightdm-greeters/slick.nix b/nixos/modules/services/x11/display-managers/lightdm-greeters/slick.nix
index e2d83ce5dcb4..edb9c2a8e740 100644
--- a/nixos/modules/services/x11/display-managers/lightdm-greeters/slick.nix
+++ b/nixos/modules/services/x11/display-managers/lightdm-greeters/slick.nix
@@ -36,14 +36,7 @@ in
       enable = mkEnableOption "lightdm-slick-greeter as the lightdm greeter";
 
       theme = {
-        package = mkOption {
-          type = types.package;
-          default = pkgs.gnome-themes-extra;
-          defaultText = literalExpression "pkgs.gnome-themes-extra";
-          description = ''
-            The package path that contains the theme given in the name option.
-          '';
-        };
+        package = mkPackageOption pkgs "gnome-themes-extra" { };
 
         name = mkOption {
           type = types.str;
@@ -55,14 +48,7 @@ in
       };
 
       iconTheme = {
-        package = mkOption {
-          type = types.package;
-          default = pkgs.adwaita-icon-theme;
-          defaultText = literalExpression "pkgs.adwaita-icon-theme";
-          description = ''
-            The package path that contains the icon theme given in the name option.
-          '';
-        };
+        package = mkPackageOption pkgs "adwaita-icon-theme" { };
 
         name = mkOption {
           type = types.str;
@@ -74,14 +60,7 @@ in
       };
 
       font = {
-        package = mkOption {
-          type = types.package;
-          default = pkgs.ubuntu-classic;
-          defaultText = literalExpression "pkgs.ubuntu-classic";
-          description = ''
-            The package path that contains the font given in the name option.
-          '';
-        };
+        package = mkPackageOption pkgs "ubuntu-classic" { };
 
         name = mkOption {
           type = types.str;
@@ -93,14 +72,7 @@ in
       };
 
       cursorTheme = {
-        package = mkOption {
-          type = types.package;
-          default = pkgs.adwaita-icon-theme;
-          defaultText = literalExpression "pkgs.adwaita-icon-theme";
-          description = ''
-            The package path that contains the cursor theme given in the name option.
-          '';
-        };
+        package = mkPackageOption pkgs "adwaita-icon-theme" { };
 
         name = mkOption {
           type = types.str;
diff --git a/nixos/modules/services/x11/redshift.nix b/nixos/modules/services/x11/redshift.nix
index 661053c20016..0ebde5bf642b 100644
--- a/nixos/modules/services/x11/redshift.nix
+++ b/nixos/modules/services/x11/redshift.nix
@@ -51,7 +51,7 @@ in
 
     temperature = {
       day = mkOption {
-        type = types.int;
+        type = types.ints.between 1000 25000;
         default = 5500;
         description = ''
           Colour temperature to use during the day, between
@@ -59,7 +59,7 @@ in
         '';
       };
       night = mkOption {
-        type = types.int;
+        type = types.ints.between 1000 25000;
         default = 3700;
         description = ''
           Colour temperature to use at night, between
diff --git a/nixos/modules/services/x11/window-managers/nimdow.nix b/nixos/modules/services/x11/window-managers/nimdow.nix
index bde5bd950a02..68497046efcc 100644
--- a/nixos/modules/services/x11/window-managers/nimdow.nix
+++ b/nixos/modules/services/x11/window-managers/nimdow.nix
@@ -13,12 +13,7 @@ in
 {
   options = {
     services.xserver.windowManager.nimdow.enable = mkEnableOption "nimdow";
-    services.xserver.windowManager.nimdow.package = mkOption {
-      type = types.package;
-      default = pkgs.nimdow;
-      defaultText = "pkgs.nimdow";
-      description = "nimdow package to use";
-    };
+    services.xserver.windowManager.nimdow.package = mkPackageOption pkgs "nimdow" { };
   };
 
   config = mkIf cfg.enable {
diff --git a/nixos/modules/services/x11/xscreensaver.nix b/nixos/modules/services/x11/xscreensaver.nix
index 3d9312e3e6b8..b9523ef2ae53 100644
--- a/nixos/modules/services/x11/xscreensaver.nix
+++ b/nixos/modules/services/x11/xscreensaver.nix
@@ -12,12 +12,7 @@ in
   options.services.xscreensaver = {
     enable = lib.mkEnableOption "xscreensaver user service";
 
-    package = lib.mkOption {
-      type = lib.types.package;
-      default = pkgs.xscreensaver;
-      defaultText = lib.literalExpression "pkgs.xscreensaver";
-      description = "Which xscreensaver package to use.";
-    };
+    package = lib.mkPackageOption pkgs "xscreensaver" { };
   };
 
   config = lib.mkIf cfg.enable {
diff --git a/nixos/modules/system/boot/clevis.nix b/nixos/modules/system/boot/clevis.nix
index 881a6452d9c9..afd14f492f4d 100644
--- a/nixos/modules/system/boot/clevis.nix
+++ b/nixos/modules/system/boot/clevis.nix
@@ -22,12 +22,7 @@ in
   options = {
     boot.initrd.clevis.enable = lib.mkEnableOption "Clevis in initrd";
 
-    boot.initrd.clevis.package = lib.mkOption {
-      type = lib.types.package;
-      default = pkgs.clevis;
-      defaultText = "pkgs.clevis";
-      description = "Clevis package";
-    };
+    boot.initrd.clevis.package = lib.mkPackageOption pkgs "clevis" { };
 
     boot.initrd.clevis.devices = lib.mkOption {
       description = "Encrypted devices that need to be unlocked at boot using Clevis";
diff --git a/nixos/modules/virtualisation/nixos-containers.nix b/nixos/modules/virtualisation/nixos-containers.nix
index 44619513f577..d95ab944acd8 100644
--- a/nixos/modules/virtualisation/nixos-containers.nix
+++ b/nixos/modules/virtualisation/nixos-containers.nix
@@ -416,11 +416,11 @@ let
               description = "The protocol specifier for port forwarding between host and container";
             };
             hostPort = mkOption {
-              type = types.int;
+              type = types.port;
               description = "Source port of the external interface on host";
             };
             containerPort = mkOption {
-              type = types.nullOr types.int;
+              type = types.nullOr types.port;
               default = null;
               description = "Target port of container";
             };
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 0415a43bcdfa..693a8efff969 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1142,6 +1142,7 @@ in
   pam-u2f = runTest ./pam/pam-u2f.nix;
   pam-ussh = runTest ./pam/pam-ussh.nix;
   pam-zfs-key = runTest ./pam/zfs-key.nix;
+  pangolin = runTest ./pangolin.nix;
   pantalaimon = runTest ./matrix/pantalaimon.nix;
   pantheon = runTest ./pantheon.nix;
   paperless = runTest ./paperless.nix;
diff --git a/nixos/tests/pangolin.nix b/nixos/tests/pangolin.nix
new file mode 100644
index 000000000000..696f3626cd4e
--- /dev/null
+++ b/nixos/tests/pangolin.nix
@@ -0,0 +1,138 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+let
+  # cant use .test, since that gets caught by traefik
+  domain = "nixos.eu";
+  secret = "1234567890";
+
+  dnsServerIP = nodes: nodes.dnsserver.networking.primaryIPAddress;
+
+in
+{
+  name = "pangolin";
+  meta.maintainers = with lib.maintainers; [
+    jackr
+    sigmasquadron
+  ];
+
+  # The full test is not yet implemented, but once upstream supports a way to
+  # configure Pangolin non-interactively, the full test will look like the following:
+  # - 'acme': ACME server to replace the real servers at Let's Encrypt.
+  # - 'dnsserver': The pebble challenge test server so we can use a private DNS
+  #                for everything here.
+  # - 'VPS': The Pangolin instance, running Gerbil, Traefik, and Badger as well.
+  # - 'privateHost': The private server running an HTTP server on its local
+  #                  network that will be tunnelled via Newt to the VPS.
+  # - 'client': An outside node that will test if the service hosted in
+  #             'privateHost' is publicly accessible.
+  # TODO: In the future, we should also have a machine to test the
+  #       functionality of Olm, as well as a split Pangolin/Gerbil
+  #       configuration once that is implemented into the module.
+  nodes = {
+    acme =
+      { nodes, ... }:
+      {
+        imports = [ ./common/acme/server ];
+        networking.nameservers = lib.mkForce [ (dnsServerIP nodes) ];
+      };
+
+    dnsserver =
+      { nodes, ... }:
+      {
+        networking = {
+          firewall.allowedTCPPorts = [
+            8055
+            53
+          ];
+          firewall.allowedUDPPorts = [ 53 ];
+
+          # nixos/lib/testing/network.nix will provide name resolution via /etc/hosts
+          # for all nodes based on their host names and domain
+          hostName = "dnsserver";
+          domain = "eu";
+        };
+        systemd.services.pebble-challtestsrv = {
+          description = "Pebble ACME challenge test server";
+          wantedBy = [ "network.target" ];
+          serviceConfig = {
+            ExecStart = "${lib.getExe' pkgs.pebble "pebble-challtestsrv"} -dns01 ':53' -defaultIPv6 '' -defaultIPv4 '${nodes.VPS.networking.primaryIPAddress}'";
+            # Required to bind on privileged ports.
+            AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+          };
+        };
+      };
+
+    VPS =
+      { nodes, ... }:
+      {
+        imports = [ ./common/acme/client ];
+        networking = {
+          inherit domain;
+          hosts.${nodes.VPS.networking.primaryIPAddress} = [
+            domain
+            "pangolin.${domain}"
+          ];
+          nameservers = lib.mkForce [ (dnsServerIP nodes) ];
+        };
+
+        environment = {
+          etc = {
+            "nixos/secrets/pangolin.env".text = ''
+              SERVER_SECRET=${secret}
+            '';
+          };
+        };
+
+        services = {
+          pangolin = {
+            enable = true;
+            baseDomain = domain;
+            letsEncryptEmail = "pangolin@${domain}";
+            openFirewall = true;
+            environmentFile = "/etc/nixos/secrets/pangolin.env";
+            settings = {
+              flags.enable_integration_api = true;
+            };
+          };
+          # set up local ca server, so we can get our certs signed without going on the internet
+          traefik.staticConfigOptions.certificatesResolvers.letsencrypt.acme.caServer =
+            lib.mkForce "https://${nodes.acme.test-support.acme.caDomain}/dir";
+        };
+      };
+
+  };
+  testScript = ''
+    ${(import ./acme/utils.nix).pythonUtils}
+
+    with subtest("start ACME and DNS server"):
+      acme.start()
+      wait_for_running(acme)
+      acme.wait_for_open_port(443)
+      dnsserver.start()
+      dnsserver.wait_for_open_port(53)
+
+    VPS.start()
+
+    with subtest("start Pangolin"):
+      VPS.wait_for_unit("pangolin.service")
+      VPS.wait_for_open_port(3000)
+      VPS.wait_for_open_port(3001)
+      VPS.wait_for_open_port(3002)
+      VPS.wait_for_open_port(3003)
+
+    with subtest("start Gerbil"):
+      VPS.wait_for_unit("gerbil.service")
+
+    with subtest("start Traefik"):
+      VPS.wait_for_unit("traefik.service")
+      VPS.wait_for_open_port(80)
+      VPS.wait_for_open_port(443)
+
+    with subtest("check traefik certs}"):
+      download_ca_certs(VPS, "acme.test")
+
+  '';
+}
diff --git a/nixos/tests/systemd-journal.nix b/nixos/tests/systemd-journal.nix
index 2c7309f163f8..e2867de95f64 100644
--- a/nixos/tests/systemd-journal.nix
+++ b/nixos/tests/systemd-journal.nix
@@ -40,7 +40,7 @@
       # logs should end up in the auditd audit log
       auditd.succeed("grep 'unit=systemd-journald' /var/log/audit/audit.log")
       # logs should not end up in kmesg
-      machine.fail("journalctl _TRANSPORT=kernel --grep 'unit=systemd-journald'")
+      auditd.fail("journalctl _TRANSPORT=kernel --grep 'unit=systemd-journald'")
 
 
     with subtest("journald audit"):
diff --git a/pkgs/README.md b/pkgs/README.md
index c5adb39ba146..409ab906f556 100644
--- a/pkgs/README.md
+++ b/pkgs/README.md
@@ -38,7 +38,9 @@ Before adding a new package, please consider the following questions:
 * How realistic is it that it will be used by other people?
   It's good that nixpkgs caters to various niches, but if it's a niche of 5 people it's probably too small.
   A good estimate is checking upstream issues and pull requests, or other software repositories.
-  Library packages should have at least one dependent.
+    * Library packages should have at least one dependent.
+      If possible, that dependent should be packaged in the same PR the library is added in, as a sanity check.
+      If it is not possible to package the dependent, a minimal test program should be added to `passthru.tests`.
 * Is the software actively maintained upstream?
   Especially packages that are security-critical, rely on fast-moving dependencies, or affect data integrity should see regular maintenance.
 * Are you willing to maintain the package?
diff --git a/pkgs/applications/audio/clementine/default.nix b/pkgs/applications/audio/clementine/default.nix
index 3bd0540e2895..392b95f9dc74 100644
--- a/pkgs/applications/audio/clementine/default.nix
+++ b/pkgs/applications/audio/clementine/default.nix
@@ -32,7 +32,7 @@
   config,
   wrapQtAppsHook,
   gst_plugins,
-  util-linux,
+  util-linuxMinimal,
   libunwind,
   libselinux,
   elfutils,
@@ -62,7 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     pkg-config
     wrapQtAppsHook
-    util-linux
+    util-linuxMinimal
     libunwind
     libselinux
     elfutils
@@ -96,14 +96,14 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   # gst_plugins needed for setup-hooks
   ++ gst_plugins
-  ++ lib.optionals (withIpod) [
+  ++ lib.optionals withIpod [
     libgpod
     libplist
     usbmuxd
   ]
-  ++ lib.optionals (withMTP) [ libmtp ]
-  ++ lib.optionals (withCD) [ libcdio ]
-  ++ lib.optionals (withCloud) [ sparsehash ];
+  ++ lib.optionals withMTP [ libmtp ]
+  ++ lib.optionals withCD [ libcdio ]
+  ++ lib.optionals withCloud [ sparsehash ];
 
   postPatch = ''
     sed -i src/CMakeLists.txt \
@@ -119,9 +119,9 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   cmakeFlags = [
-    "-DFORCE_GIT_REVISION=1.3.1"
-    "-DUSE_SYSTEM_PROJECTM=ON"
-    "-DSPOTIFY_BLOB=OFF"
+    (lib.cmakeFeature "FORCE_GIT_REVISION" "1.3.1")
+    (lib.cmakeBool "USE_SYSTEM_PROJECTM" true)
+    (lib.cmakeBool "SPOTIFY_BLOB" false)
   ];
 
   dontWrapQtApps = true;
@@ -136,6 +136,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Multiplatform music player";
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.linux;
+    mainProgram = "clementine";
     maintainers = with lib.maintainers; [ ttuegel ];
   };
 })
diff --git a/pkgs/applications/display-managers/sddm/default.nix b/pkgs/applications/display-managers/sddm/default.nix
index 7ee30e5a77ac..f4f5e95c8ba6 100644
--- a/pkgs/applications/display-managers/sddm/default.nix
+++ b/pkgs/applications/display-managers/sddm/default.nix
@@ -2,23 +2,15 @@
   lib,
   callPackage,
   runCommand,
-  layer-shell-qt ? null,
-  qtwayland,
   wrapQtAppsHook,
   unwrapped ? callPackage ./unwrapped.nix { },
-  withWayland ? false,
-  withLayerShellQt ? false,
   extraPackages ? [ ],
 }:
 runCommand "sddm-wrapped"
   {
     inherit (unwrapped) version outputs;
 
-    buildInputs =
-      unwrapped.buildInputs
-      ++ extraPackages
-      ++ lib.optional withWayland qtwayland
-      ++ lib.optional (withWayland && withLayerShellQt) layer-shell-qt;
+    buildInputs = unwrapped.buildInputs ++ extraPackages;
     nativeBuildInputs = [ wrapQtAppsHook ];
 
     strictDeps = true;
diff --git a/pkgs/applications/editors/vscode/extensions/ms-dotnettools.csdevkit/default.nix b/pkgs/applications/editors/vscode/extensions/ms-dotnettools.csdevkit/default.nix
index 78ad89046f74..0b8b3e68b430 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-dotnettools.csdevkit/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-dotnettools.csdevkit/default.nix
@@ -16,19 +16,19 @@ let
     {
       x86_64-linux = {
         arch = "linux-x64";
-        hash = "sha256-1NGZTdAw2VS7txYuyKrpsm0bvLYYpsFZfkLCT5j2MIk=";
+        hash = "sha256-4yljDypIsx2bFKgCe0nL7Ljnzq6+efMRMBlpl1T6mU0=";
       };
       aarch64-linux = {
         arch = "linux-arm64";
-        hash = "sha256-7d5tSZOGkmtfaL/IFk7ksFRAOlv58/Jw/N+nhlyJEHE=";
+        hash = "sha256-heiercuubJUhzOiRNPRvcBQfvbOtM6albpWvOkHlgsI=";
       };
       x86_64-darwin = {
         arch = "darwin-x64";
-        hash = "sha256-1qinxbsBU5Ot/ce5OcIH9ybhhHoRSHv98Mwr/Piwmis=";
+        hash = "sha256-U3VA9GjyP00bhZid3mdODLfmFW5WmtXmikPByDjELXA=";
       };
       aarch64-darwin = {
         arch = "darwin-arm64";
-        hash = "sha256-1LMV1e9xCoXa0UhyUkNFJJ0Nr0xJasPbfYAr6h7l6EE=";
+        hash = "sha256-uCOQnQ8x5OGPl/139jAZ12PdbWczS2KOQHLFxjEQnL4=";
       };
     }
     .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}")
@@ -38,7 +38,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "csdevkit";
     publisher = "ms-dotnettools";
-    version = "1.41.11";
+    version = "1.50.51";
     inherit (extInfo) hash arch;
   };
   sourceRoot = "extension"; # This has more than one folder.
diff --git a/pkgs/applications/editors/vscode/extensions/ms-dotnettools.csharp/default.nix b/pkgs/applications/editors/vscode/extensions/ms-dotnettools.csharp/default.nix
index 9f53c83a95d2..1cb3c0a2b3bb 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-dotnettools.csharp/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-dotnettools.csharp/default.nix
@@ -18,19 +18,19 @@ let
     {
       x86_64-linux = {
         arch = "linux-x64";
-        hash = "sha256-FPhB2oWx5x/qr2k4sAg8w2Wx+LvW/Syfc/u8nnTCQFU=";
+        hash = "sha256-0SMd7cEMSxH6fuvQl5RKc1jFvonBIgYpUMnmMnDiRmU=";
       };
       aarch64-linux = {
         arch = "linux-arm64";
-        hash = "sha256-qVZ9Go+/mVIoUr8Qt/kJv8gvOWd7NLu1wk7YZ2v6Lw8=";
+        hash = "sha256-Y6KpB6WreP4ZWovUL4cOZxxorp2Ekzq9jISY0Yo4c1Q=";
       };
       x86_64-darwin = {
         arch = "darwin-x64";
-        hash = "sha256-7G9t84clyi4T3k7FxoPIfaIs4VabBTvGilTptd3AHOw=";
+        hash = "sha256-uXL/AN3dA45po1EuZHCSCLSFyzfVGs7yPX+0refwy10=";
       };
       aarch64-darwin = {
         arch = "darwin-arm64";
-        hash = "sha256-fmWlcLVUUY6Ekx5mtsBYFrYFdXpSUg8PctDBUovETV4=";
+        hash = "sha256-Tj0uEwLFMNN+T5XG+8y67ssUig+QeUS4uFe0HZp2ua8=";
       };
     }
     .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}")
@@ -52,7 +52,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "csharp";
     publisher = "ms-dotnettools";
-    version = "2.89.19";
+    version = "2.90.60";
     inherit (extInfo) hash arch;
   };
 
diff --git a/pkgs/applications/networking/cluster/kops/default.nix b/pkgs/applications/networking/cluster/kops/default.nix
index 0c70cd6c41a2..418392b89040 100644
--- a/pkgs/applications/networking/cluster/kops/default.nix
+++ b/pkgs/applications/networking/cluster/kops/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -45,7 +46,7 @@ let
 
       doCheck = false;
 
-      postInstall = ''
+      postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
         installShellCompletion --cmd kops \
           --bash <($GOPATH/bin/kops completion bash) \
           --fish <($GOPATH/bin/kops completion fish) \
diff --git a/pkgs/applications/networking/cluster/kuma/default.nix b/pkgs/applications/networking/cluster/kuma/default.nix
index a5b34f598306..b43c63ecef0d 100644
--- a/pkgs/applications/networking/cluster/kuma/default.nix
+++ b/pkgs/applications/networking/cluster/kuma/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   fetchFromGitHub,
   buildGoModule,
   coredns,
@@ -40,12 +41,14 @@ buildGoModule rec {
   subPackages = map (p: "app/" + p) components;
 
   postInstall =
-    lib.concatMapStringsSep "\n" (p: ''
-      installShellCompletion --cmd ${p} \
-        --bash <($out/bin/${p} completion bash) \
-        --fish <($out/bin/${p} completion fish) \
-        --zsh <($out/bin/${p} completion zsh)
-    '') components
+    lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) (
+      lib.concatMapStringsSep "\n" (p: ''
+        installShellCompletion --cmd ${p} \
+          --bash <($out/bin/${p} completion bash) \
+          --fish <($out/bin/${p} completion fish) \
+          --zsh <($out/bin/${p} completion zsh)
+      '') components
+    )
     + lib.optionalString isFull ''
       ln -sLf ${coredns}/bin/coredns $out/bin
     '';
diff --git a/pkgs/applications/networking/cluster/linkerd/generic.nix b/pkgs/applications/networking/cluster/linkerd/generic.nix
index bb604d74aed9..ef5835bcd6db 100644
--- a/pkgs/applications/networking/cluster/linkerd/generic.nix
+++ b/pkgs/applications/networking/cluster/linkerd/generic.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   fetchFromGitHub,
   buildGoModule,
   installShellFiles,
@@ -51,6 +52,8 @@ buildGoModule rec {
 
   postInstall = ''
     mv $out/bin/cli $out/bin/linkerd
+  ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd linkerd \
       --bash <($out/bin/linkerd completion bash) \
       --zsh <($out/bin/linkerd completion zsh) \
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 13fa0e6ed32f..c23eed203708 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -99,11 +99,11 @@
     "vendorHash": "sha256-YIn8akPW+DCVF0eYZxsmJxmrJuYhK4QLG/uhmmrXd4c="
   },
   "auth0": {
-    "hash": "sha256-RnQq6dIaFfcix8uAmC2VJ5CLpaPXZjFYVbyPDEzqFFo=",
+    "hash": "sha256-Wv8B28h6idsni7peoKiQ7+5Uo5njw7zeNSRNq3ati8c=",
     "homepage": "https://registry.terraform.io/providers/auth0/auth0",
     "owner": "auth0",
     "repo": "terraform-provider-auth0",
-    "rev": "v1.29.0",
+    "rev": "v1.30.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-tS+LKp4n1SjCmdrJ0kbxrcUYR53NCsODD9Yiq8B8hok="
   },
@@ -1021,11 +1021,11 @@
     "vendorHash": null
   },
   "ovh": {
-    "hash": "sha256-qMKjJP7iuW5qE+H/uP2TDl1zxowobutf9TrtJqQKzws=",
+    "hash": "sha256-G6pLpThqKuCDx4QdTYvJYpba56ZWaxPML/3H1oslw34=",
     "homepage": "https://registry.terraform.io/providers/ovh/ovh",
     "owner": "ovh",
     "repo": "terraform-provider-ovh",
-    "rev": "v2.7.0",
+    "rev": "v2.8.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
diff --git a/pkgs/applications/networking/instant-messengers/psi-plus/default.nix b/pkgs/applications/networking/instant-messengers/psi-plus/default.nix
index 252c42aabd7f..1d9c0bd444c5 100644
--- a/pkgs/applications/networking/instant-messengers/psi-plus/default.nix
+++ b/pkgs/applications/networking/instant-messengers/psi-plus/default.nix
@@ -46,12 +46,12 @@ assert enablePsiMedia -> enablePlugins;
 mkDerivation rec {
   pname = "psi-plus";
 
-  version = "1.5.2081";
+  version = "1.5.2115";
   src = fetchFromGitHub {
     owner = "psi-plus";
     repo = "psi-plus-snapshots";
     rev = version;
-    sha256 = "sha256-C5EFC6HpUEFb5P3yGAwlhpj7MhS16P6fkKD5GjC3J9I=";
+    sha256 = "sha256-4is3ksl6IsYP1L0WhTT/56QUtR+EC1X6Lftre2BO6pM=";
   };
 
   cmakeFlags = [
diff --git a/pkgs/applications/video/mpv/default.nix b/pkgs/applications/video/mpv/default.nix
index 6eeb4c40a1ad..b11bccf732b1 100644
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@@ -39,7 +39,7 @@
   libvdpau,
   libxkbcommon,
   lua,
-  makeWrapper,
+  makeBinaryWrapper,
   libgbm,
   meson,
   mujs,
@@ -159,7 +159,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     buildPackages.darwin.sigtool
     swift
-    makeWrapper
+    makeBinaryWrapper
   ]
   ++ lib.optionals waylandSupport [ wayland-scanner ];
 
diff --git a/pkgs/applications/video/mpv/wrapper.nix b/pkgs/applications/video/mpv/wrapper.nix
index 874aedb7c076..bbfdab038454 100644
--- a/pkgs/applications/video/mpv/wrapper.nix
+++ b/pkgs/applications/video/mpv/wrapper.nix
@@ -3,7 +3,7 @@
   stdenv,
   buildEnv,
   lib,
-  makeWrapper,
+  makeBinaryWrapper,
   mpvScripts,
   symlinkJoin,
   writeTextDir,
@@ -102,7 +102,7 @@ let
       # TODO: don't link all mpv outputs and convert package to mpv-unwrapped?
       paths = [ mpv.all ];
 
-      nativeBuildInputs = [ makeWrapper ];
+      nativeBuildInputs = [ makeBinaryWrapper ];
 
       passthru.unwrapped = mpv;
 
diff --git a/pkgs/applications/video/plex-mpv-shim/default.nix b/pkgs/applications/video/plex-mpv-shim/default.nix
index fc5d1b0ffbac..71d3750bc574 100644
--- a/pkgs/applications/video/plex-mpv-shim/default.nix
+++ b/pkgs/applications/video/plex-mpv-shim/default.nix
@@ -16,24 +16,16 @@
 
 buildPythonApplication rec {
   pname = "plex-mpv-shim";
-  version = "1.11.0";
+  version = "1.11.0-unstable-2025-03-17";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "iwalton3";
     repo = pname;
-    tag = "v${version}";
-    sha256 = "sha256-hUGKOJEDZMK5uhHoevFt1ay6QQEcoN4F8cPxln5uMRo=";
+    rev = "fb1f1f3325285e33f9ce3425e9361f5f99277d9a"; # Fetch from this commit to include fixes for python library issues. Should be reverted to release 1.12.0
+    hash = "sha256-tk+bIS93Y726sbrRXEyS7+4ku+g40Z7Aj0++wItjW2s=";
   };
 
-  patches = [
-    # pull in upstream commit to fix python-mpv dependency name -- remove when version > 1.11.0
-    (fetchpatch {
-      url = "https://github.com/iwalton3/plex-mpv-shim/commit/d8643123a8ec79216e02850b08f63b06e4e0a2ea.diff";
-      hash = "sha256-nc+vwYnAtMjVzL2fIQeTAqhf3HBseL+2pFEtv8zNUXo=";
-    })
-  ];
-
   nativeBuildInputs = [
     wrapGAppsHook3
     gobject-introspection
diff --git a/pkgs/by-name/_1/_1password-cli/package.nix b/pkgs/by-name/_1/_1password-cli/package.nix
index 819fa08e298b..0825eae7904f 100644
--- a/pkgs/by-name/_1/_1password-cli/package.nix
+++ b/pkgs/by-name/_1/_1password-cli/package.nix
@@ -67,7 +67,7 @@ stdenv.mkDerivation {
     runHook postInstall
   '';
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     HOME=$TMPDIR
     installShellCompletion --cmd ${mainProgram} \
       --bash <($out/bin/${mainProgram} completion bash) \
diff --git a/pkgs/by-name/_1/_1password-gui/sources.json b/pkgs/by-name/_1/_1password-gui/sources.json
index 4de3bc476077..7ed36c3def36 100644
--- a/pkgs/by-name/_1/_1password-gui/sources.json
+++ b/pkgs/by-name/_1/_1password-gui/sources.json
@@ -1,28 +1,28 @@
 {
   "stable": {
     "linux": {
-      "version": "8.11.8",
+      "version": "8.11.10",
       "sources": {
         "x86_64": {
-          "url": "https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.11.8.x64.tar.gz",
-          "hash": "sha256-gidi2lnKFxcSxi6lekWODp9TJNGofWFp72Bp30KoRfY="
+          "url": "https://downloads.1password.com/linux/tar/stable/x86_64/1password-8.11.10.x64.tar.gz",
+          "hash": "sha256-AKqr1jMTFXPYYYJu8wD9P+xXwxobSbpjXwmBQhWYVhg="
         },
         "aarch64": {
-          "url": "https://downloads.1password.com/linux/tar/stable/aarch64/1password-8.11.8.arm64.tar.gz",
-          "hash": "sha256-pZqhWd2K+5+B3eK52OZNSPh3Jx4MKBy+hAnC5tihzhM="
+          "url": "https://downloads.1password.com/linux/tar/stable/aarch64/1password-8.11.10.arm64.tar.gz",
+          "hash": "sha256-Xz66LYXgX64P9TTmI8D8Wtrz7qKTBrZx+rP26yJqcTw="
         }
       }
     },
     "darwin": {
-      "version": "8.11.8",
+      "version": "8.11.10",
       "sources": {
         "x86_64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.11.8-x86_64.zip",
-          "hash": "sha256-MYyWof17KLVRtnPqSICnny24f8YoXJWeGwErWFrb6C4="
+          "url": "https://downloads.1password.com/mac/1Password-8.11.10-x86_64.zip",
+          "hash": "sha256-sQK+qHdGvpIi+h2az8PYq6kROmiaGKBbNGFGXJSe1eg="
         },
         "aarch64": {
-          "url": "https://downloads.1password.com/mac/1Password-8.11.8-aarch64.zip",
-          "hash": "sha256-wii983COooBCXyiV2a2MC7SKnFJLp1JashsOzT3+ZRA="
+          "url": "https://downloads.1password.com/mac/1Password-8.11.10-aarch64.zip",
+          "hash": "sha256-Hb+DEGM7ymDuf71uKTy8L/9bUWZ2+QD+w7h2tNvp0Pk="
         }
       }
     }
diff --git a/pkgs/by-name/ab/abbreviate/package.nix b/pkgs/by-name/ab/abbreviate/package.nix
index b4343637ad54..779f6bb0cde9 100644
--- a/pkgs/by-name/ab/abbreviate/package.nix
+++ b/pkgs/by-name/ab/abbreviate/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -27,7 +28,7 @@ buildGoModule rec {
     "-w"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd abbreviate \
       --bash <($out/bin/abbreviate completion bash) \
       --fish <($out/bin/abbreviate completion fish) \
diff --git a/pkgs/by-name/al/algolia-cli/package.nix b/pkgs/by-name/al/algolia-cli/package.nix
index 0b4ed1ee5dc7..bda349ec4b8c 100644
--- a/pkgs/by-name/al/algolia-cli/package.nix
+++ b/pkgs/by-name/al/algolia-cli/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -30,7 +31,7 @@ buildGoModule {
     "-X github.com/algolia/cli/pkg/version.Version=${version}"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd algolia \
       --bash <($out/bin/algolia completion bash) \
       --fish <($out/bin/algolia completion fish) \
diff --git a/pkgs/by-name/an/angrr/package.nix b/pkgs/by-name/an/angrr/package.nix
index 6a2f32ca4df3..5cc2aa6540b9 100644
--- a/pkgs/by-name/an/angrr/package.nix
+++ b/pkgs/by-name/an/angrr/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   rustPlatform,
   fetchFromGitHub,
   installShellFiles,
@@ -22,7 +23,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoHash = "sha256-lo9JpsHkvyrEqFnIiGlU2o4rREeQeqWpe9WMwisvw+4=";
 
   nativeBuildInputs = [ installShellFiles ];
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd angrr \
       --bash <($out/bin/angrr completion bash) \
       --fish <($out/bin/angrr completion fish) \
diff --git a/pkgs/by-name/ap/apko/package.nix b/pkgs/by-name/ap/apko/package.nix
index 0d4aadc526ff..e0a28364887b 100644
--- a/pkgs/by-name/ap/apko/package.nix
+++ b/pkgs/by-name/ap/apko/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "apko";
-  version = "0.30.11";
+  version = "0.30.12";
 
   src = fetchFromGitHub {
     owner = "chainguard-dev";
     repo = "apko";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KYxu1Wj7cJB0krcbdwCjbqokA/H9WtVYQ18ov0BkYQ4=";
+    hash = "sha256-+Ttriv/CG2dMttig0YjVB6BkxuCDjuLZsH92ENNom2c=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
diff --git a/pkgs/by-name/ap/app2unit/package.nix b/pkgs/by-name/ap/app2unit/package.nix
index 0689a92a89e0..c37973851c16 100644
--- a/pkgs/by-name/ap/app2unit/package.nix
+++ b/pkgs/by-name/ap/app2unit/package.nix
@@ -4,18 +4,21 @@
   dash,
   scdoc,
   fetchFromGitHub,
+  nix-update-script,
 }:
 stdenvNoCC.mkDerivation rec {
   pname = "app2unit";
-  version = "1.0.3";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "Vladimir-csp";
     repo = "app2unit";
     tag = "v${version}";
-    sha256 = "sha256-7eEVjgs+8k+/NLteSBKgn4gPaPLHC+3Uzlmz6XB0930=";
+    sha256 = "sha256-M2sitlrQNSLthSaDH+R8gUcZ8i+o1ktf2SB/vvjyJEI=";
   };
 
+  passthru.updateScript = nix-update-script { };
+
   nativeBuildInputs = [ scdoc ];
 
   buildPhase = ''
diff --git a/pkgs/by-name/ar/arkade/package.nix b/pkgs/by-name/ar/arkade/package.nix
index dfa497d83e32..046ccb348d45 100644
--- a/pkgs/by-name/ar/arkade/package.nix
+++ b/pkgs/by-name/ar/arkade/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -42,7 +43,7 @@ buildGoModule rec {
     "-X github.com/alexellis/arkade/pkg.Version=${version}"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd arkade \
       --bash <($out/bin/arkade completion bash) \
       --zsh <($out/bin/arkade completion zsh) \
diff --git a/pkgs/by-name/as/asciinema_3/package.nix b/pkgs/by-name/as/asciinema_3/package.nix
index f72c6dc4c4d0..140d97fbda02 100644
--- a/pkgs/by-name/as/asciinema_3/package.nix
+++ b/pkgs/by-name/as/asciinema_3/package.nix
@@ -10,17 +10,17 @@
 let
   self = rustPlatform.buildRustPackage {
     pname = "asciinema";
-    version = "3.0.0-rc.5";
+    version = "3.0.0";
 
     src = fetchFromGitHub {
       name = "asciinema-source-${self.version}";
       owner = "asciinema";
       repo = "asciinema";
       rev = "v${self.version}";
-      hash = "sha256-CxssC3ftnXgxdvRO7CrVgBSVkh7DPjXRNRet4fB2BKc=";
+      hash = "sha256-P92EZyg8f/mm66SmXAyPX9f4eMgOP6lyn3Uqhqh+D0I=";
     };
 
-    cargoHash = "sha256-OsynIQeGjXHD1E9iDH4P7Jksr1APtGZkchzZB0DawIw=";
+    cargoHash = "sha256-2DQqtCcvSO43+RcMN2/BGqvf+cp/WvzUY4dxVpNcbGU=";
 
     env.ASCIINEMA_GEN_DIR = "gendir";
 
@@ -35,13 +35,6 @@ let
         --zsh gendir/completion/_asciinema
     '';
 
-    checkFlags = [
-      # ---- pty::tests::exec_quick stdout ----
-      # thread 'pty::tests::exec_quick' panicked at src/pty.rs:494:10:
-      # called `Result::unwrap()` on an `Err` value: EBADF: Bad file number
-      "--skip=pty::tests::exec_quick"
-    ];
-
     strictDeps = true;
 
     passthru = {
diff --git a/pkgs/by-name/as/astartectl/package.nix b/pkgs/by-name/as/astartectl/package.nix
index f5c5be3aad9c..7c96404b0098 100644
--- a/pkgs/by-name/as/astartectl/package.nix
+++ b/pkgs/by-name/as/astartectl/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -19,7 +20,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd astartectl \
       --bash <($out/bin/astartectl completion bash) \
       --fish <($out/bin/astartectl completion fish) \
diff --git a/pkgs/by-name/at/atac/package.nix b/pkgs/by-name/at/atac/package.nix
index 1bc2f5bd79f8..789ef0d73019 100644
--- a/pkgs/by-name/at/atac/package.nix
+++ b/pkgs/by-name/at/atac/package.nix
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "atac";
-  version = "0.21.0";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "Julien-cpsn";
     repo = "ATAC";
     rev = "v${version}";
-    hash = "sha256-NTdz7NtjvVQolSiqyCdR0P4dD0+ZQBKMEXTzwHPZgxU=";
+    hash = "sha256-zMCz0WRqIS2htf9TMfq6BlupU8dj5PrziEMxisjkOEc=";
   };
 
-  cargoHash = "sha256-iLExF4lwXQ1BVBxEK+iD5HDkbjk38AbLaIirS04C4iw=";
+  cargoHash = "sha256-U+8JElXGNsiPUM9bLmqXYudRmg+K+VJLAgKLGqiVddc=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/at/atlas/package.nix b/pkgs/by-name/at/atlas/package.nix
index 585ecefbd613..667772b77b84 100644
--- a/pkgs/by-name/at/atlas/package.nix
+++ b/pkgs/by-name/at/atlas/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -32,7 +33,7 @@ buildGoModule (finalAttrs: {
 
   subPackages = [ "." ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd atlas \
       --bash <($out/bin/atlas completion bash) \
       --fish <($out/bin/atlas completion fish) \
diff --git a/pkgs/by-name/au/autobase/package.nix b/pkgs/by-name/au/autobase/package.nix
index 4674794ef5bc..8ebad595c3e3 100644
--- a/pkgs/by-name/au/autobase/package.nix
+++ b/pkgs/by-name/au/autobase/package.nix
@@ -7,13 +7,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "autobase";
-  version = "7.19.1";
+  version = "7.19.2";
 
   src = fetchFromGitHub {
     owner = "holepunchto";
     repo = "autobase";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bkb8Q6eI1ck6FD/JuWRnepJy14KsaYM+wB6nkc25fdI=";
+    hash = "sha256-IsqpVx7GFcbIouIAoLHiHLivE6RCzehW1TTmYC6SDgw=";
   };
 
   npmDepsHash = "sha256-H9Xy1VD7WQvi0+86v6CMcmc0L3mB6KuSCtgQSF4AlkY=";
diff --git a/pkgs/by-name/au/autorestic/package.nix b/pkgs/by-name/au/autorestic/package.nix
index 632cd25d7577..d8f22c918350 100644
--- a/pkgs/by-name/au/autorestic/package.nix
+++ b/pkgs/by-name/au/autorestic/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   fetchFromGitHub,
   installShellFiles,
   buildGoModule,
@@ -20,7 +21,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd autorestic \
          --bash <($out/bin/autorestic completion bash) \
          --fish <($out/bin/autorestic completion fish) \
diff --git a/pkgs/by-name/aw/aws-signing-helper/package.nix b/pkgs/by-name/aw/aws-signing-helper/package.nix
index 66de8f8da88c..4517b6a42ea6 100644
--- a/pkgs/by-name/aw/aws-signing-helper/package.nix
+++ b/pkgs/by-name/aw/aws-signing-helper/package.nix
@@ -6,15 +6,15 @@
 }:
 buildGoModule rec {
   pname = "aws-signing-helper";
-  version = "1.6.0";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "rolesanywhere-credential-helper";
     rev = "v${version}";
-    hash = "sha256-QOuumJSKrqkhSXvprefSkRFiC9LrjzD5g560VJKHCWc=";
+    hash = "sha256-FmMs8oU1x85ESTD4Ap6f+OC6AW7W3sULPv1bScDrbL4=";
   };
-  vendorHash = "sha256-jKX0hmtMDPEnsey4RN7FgvQg1ZdQx/6c44OZuexuknQ=";
+  vendorHash = "sha256-znca4Zcy8brsPeSMpFSyojjKrborx/tx1wLBadWGYmQ=";
 
   checkPhase = ''
     runHook preCheck
diff --git a/pkgs/by-name/ba/badrobot/package.nix b/pkgs/by-name/ba/badrobot/package.nix
index 33525d78c396..1c1171da2155 100644
--- a/pkgs/by-name/ba/badrobot/package.nix
+++ b/pkgs/by-name/ba/badrobot/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -25,7 +26,7 @@ buildGoModule rec {
     "-X github.com/controlplaneio/badrobot/cmd.version=v${version}"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd badrobot \
       --bash <($out/bin/badrobot completion bash) \
       --fish <($out/bin/badrobot completion fish) \
diff --git a/pkgs/by-name/ba/balena-cli/package.nix b/pkgs/by-name/ba/balena-cli/package.nix
index c3dc1325236c..c52b4e43c96b 100644
--- a/pkgs/by-name/ba/balena-cli/package.nix
+++ b/pkgs/by-name/ba/balena-cli/package.nix
@@ -22,16 +22,16 @@ let
 in
 buildNpmPackage' rec {
   pname = "balena-cli";
-  version = "22.4.1";
+  version = "22.4.6";
 
   src = fetchFromGitHub {
     owner = "balena-io";
     repo = "balena-cli";
     rev = "v${version}";
-    hash = "sha256-eUkH2rzYiNkMAB3NrDzd20nmeP12uJxTcFISE+6Ty7o=";
+    hash = "sha256-/EV4xixcJBNDWqvNp9uv4ZjlPcm6j/d7u4qYlALtixQ=";
   };
 
-  npmDepsHash = "sha256-WEYhtsCOdupU7nYF7scy4QP3/PVcchJX9CRRWjSkBJQ=";
+  npmDepsHash = "sha256-ZunJp1wY8iFhEvGKPJDPcnKO/eGGVT2NduK1kjjZ2k0=";
 
   postPatch = ''
     ln -s npm-shrinkwrap.json package-lock.json
diff --git a/pkgs/by-name/ba/bashunit/package.nix b/pkgs/by-name/ba/bashunit/package.nix
index 5832d6f23961..f1b72c3921f3 100644
--- a/pkgs/by-name/ba/bashunit/package.nix
+++ b/pkgs/by-name/ba/bashunit/package.nix
@@ -12,13 +12,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "bashunit";
-  version = "0.23.0";
+  version = "0.24.0";
 
   src = fetchFromGitHub {
     owner = "TypedDevs";
     repo = "bashunit";
     tag = finalAttrs.version;
-    hash = "sha256-sYg5zrB887rliBLdiZ6ZFcK2OVJjpRMO2fT498aOYF0=";
+    hash = "sha256-TIt1EG/KQCslwZH9seF5SUgH242ZkUkWf8HWqNBIrD0=";
     forceFetchGit = true; # needed to include the tests directory for the check phase
   };
 
diff --git a/pkgs/by-name/bi/bilibili/sources.nix b/pkgs/by-name/bi/bilibili/sources.nix
index f3d9c76e1a27..b01b5e081cc0 100644
--- a/pkgs/by-name/bi/bilibili/sources.nix
+++ b/pkgs/by-name/bi/bilibili/sources.nix
@@ -1,6 +1,6 @@
 # Generated by ./update.sh - do not update manually!
 {
-  version = "1.17.1-6";
-  arm64-hash = "sha256-Vp5BqePWV7yu3+e29t0r4VQL322u4g0owR3GUEmHasA=";
-  x86_64-hash = "sha256-/ga1KOArFq0Nv/CqfyA3BabGuXiJkHeV3mZn9J5qKXI=";
+  version = "1.17.2-1";
+  arm64-hash = "sha256-7IJId1YMV6kM9Bi9VrKXE5KLOWnyje+m2FGuQcDlMMI=";
+  x86_64-hash = "sha256-cXCSzyRkMSZLGQIkoBFMy26r8mt9dm3AcEQVHGtpsUo=";
 }
diff --git a/pkgs/by-name/bl/bleep/package.nix b/pkgs/by-name/bl/bleep/package.nix
index a792dedd05cb..e5710dfbcdc6 100644
--- a/pkgs/by-name/bl/bleep/package.nix
+++ b/pkgs/by-name/bl/bleep/package.nix
@@ -53,7 +53,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     lib.optionalString stdenvNoCC.hostPlatform.isLinux ''
       autoPatchelf $out
     ''
-    + ''
+    + lib.optionalString (stdenvNoCC.buildPlatform.canExecute stdenvNoCC.hostPlatform) ''
       export PATH=$PATH:$out/bin
       installShellCompletion --cmd bleep \
         --bash <(bleep install-tab-completions-bash --stdout) \
diff --git a/pkgs/by-name/bo/bom/package.nix b/pkgs/by-name/bo/bom/package.nix
index f33c24910a44..760be97f557a 100644
--- a/pkgs/by-name/bo/bom/package.nix
+++ b/pkgs/by-name/bo/bom/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -43,7 +44,7 @@ buildGoModule rec {
     ldflags+=" -X sigs.k8s.io/release-utils/version.buildDate=$(cat SOURCE_DATE_EPOCH)"
   '';
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd bom \
       --bash <($out/bin/bom completion bash) \
       --fish <($out/bin/bom completion fish) \
diff --git a/pkgs/by-name/bo/borgmatic/package.nix b/pkgs/by-name/bo/borgmatic/package.nix
index d2e1b43adce7..48dc20d37d26 100644
--- a/pkgs/by-name/bo/borgmatic/package.nix
+++ b/pkgs/by-name/bo/borgmatic/package.nix
@@ -56,21 +56,22 @@ python3Packages.buildPythonApplication rec {
     apprise = [ python3Packages.apprise ];
   };
 
-  postInstall = ''
-    installShellCompletion --cmd borgmatic \
-      --bash <($out/bin/borgmatic --bash-completion)
-  ''
-  + lib.optionalString enableSystemd ''
-    mkdir -p $out/lib/systemd/system
-    cp sample/systemd/borgmatic.timer $out/lib/systemd/system/
-    # there is another "sleep", so choose the one with the space after it
-    # due to https://github.com/borgmatic-collective/borgmatic/commit/2e9f70d49647d47fb4ca05f428c592b0e4319544
-    substitute sample/systemd/borgmatic.service \
-               $out/lib/systemd/system/borgmatic.service \
-               --replace /root/.local/bin/borgmatic $out/bin/borgmatic \
-               --replace systemd-inhibit ${systemd}/bin/systemd-inhibit \
-               --replace "sleep " "${coreutils}/bin/sleep "
-  '';
+  postInstall =
+    lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+      installShellCompletion --cmd borgmatic \
+        --bash <($out/bin/borgmatic --bash-completion)
+    ''
+    + lib.optionalString enableSystemd ''
+      mkdir -p $out/lib/systemd/system
+      cp sample/systemd/borgmatic.timer $out/lib/systemd/system/
+      # there is another "sleep", so choose the one with the space after it
+      # due to https://github.com/borgmatic-collective/borgmatic/commit/2e9f70d49647d47fb4ca05f428c592b0e4319544
+      substitute sample/systemd/borgmatic.service \
+                 $out/lib/systemd/system/borgmatic.service \
+                 --replace /root/.local/bin/borgmatic $out/bin/borgmatic \
+                 --replace systemd-inhibit ${systemd}/bin/systemd-inhibit \
+                 --replace "sleep " "${coreutils}/bin/sleep "
+    '';
 
   passthru.tests = {
     version = testers.testVersion { package = borgmatic; };
diff --git a/pkgs/by-name/br/brush-splat/package.nix b/pkgs/by-name/br/brush-splat/package.nix
new file mode 100644
index 000000000000..452c72360efe
--- /dev/null
+++ b/pkgs/by-name/br/brush-splat/package.nix
@@ -0,0 +1,78 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  bzip2,
+  libxkbcommon,
+  sqlite,
+  vulkan-loader,
+  zstd,
+  stdenv,
+  wayland,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "brush-splat";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "ArthurBrussee";
+    repo = "brush";
+    tag = finalAttrs.version;
+    hash = "sha256-IvsHYCM/M2hHozzKwovgXpcW1b7MSEGneU62y1k8U9U=";
+  };
+
+  cargoHash = "sha256-7cJj5L8ggkBP9SDaYMtY9xIAHVAhi8cTD/0pncUaHbI=";
+
+  # Force linking to libEGL, which is always dlopen()ed, and to
+  # libwayland-client & libxkbcommon, which is dlopen()ed based on the
+  # winit backend.
+  NIX_LDFLAGS = [
+    "--no-as-needed"
+    "-lvulkan"
+    "-lwayland-client"
+    "-lxkbcommon"
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    bzip2
+    libxkbcommon
+    sqlite
+    vulkan-loader
+    zstd
+  ]
+  ++ lib.optionals stdenv.isLinux [
+    wayland
+  ];
+
+  env = {
+    ZSTD_SYS_USE_PKG_CONFIG = true;
+  };
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "3D Reconstruction for all";
+    homepage = "https://github.com/ArthurBrussee/brush";
+    changelog = "https://github.com/ArthurBrussee/brush/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ matthewcroughan ];
+    mainProgram = "brush_app";
+  };
+})
diff --git a/pkgs/by-name/bu/buildpack/package.nix b/pkgs/by-name/bu/buildpack/package.nix
index 247474f4202e..55b677cc84bf 100644
--- a/pkgs/by-name/bu/buildpack/package.nix
+++ b/pkgs/by-name/bu/buildpack/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -31,7 +32,7 @@ buildGoModule {
     "-X github.com/buildpacks/pack.Version=${version}"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd pack \
       --zsh $(PACK_HOME=$PWD $out/bin/pack completion --shell zsh) \
       --bash $(PACK_HOME=$PWD $out/bin/pack completion --shell bash) \
diff --git a/pkgs/by-name/ca/cargo-semver-checks/package.nix b/pkgs/by-name/ca/cargo-semver-checks/package.nix
index e19b9afe50a6..da4f2d0b8cd7 100644
--- a/pkgs/by-name/ca/cargo-semver-checks/package.nix
+++ b/pkgs/by-name/ca/cargo-semver-checks/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-semver-checks";
-  version = "0.43.0";
+  version = "0.44.0";
 
   src = fetchFromGitHub {
     owner = "obi1kenobi";
     repo = "cargo-semver-checks";
     tag = "v${version}";
-    hash = "sha256-SfmixBe7M0wnKEIBCpae2ypqgsTb5/AC0GwI42uMGlE=";
+    hash = "sha256-QU8vLdq129gcGi8/VfjflY6zkIXXam/Ri2zjbO3sPNg=";
   };
 
-  cargoHash = "sha256-OD3N1rtgXQhWNfFjnLLrkBvC9Ra9EBNv6GqtX0ai4Gs=";
+  cargoHash = "sha256-0oPAIhhBcCwZT8sD2PWJ5ZDuMMFvmwxhyOXJWA9+jZg=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/ca/cargo-udeps/package.nix b/pkgs/by-name/ca/cargo-udeps/package.nix
index 23715b5b3467..0e872eb99b12 100644
--- a/pkgs/by-name/ca/cargo-udeps/package.nix
+++ b/pkgs/by-name/ca/cargo-udeps/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-udeps";
-  version = "0.1.57";
+  version = "0.1.59";
 
   src = fetchFromGitHub {
     owner = "est31";
     repo = "cargo-udeps";
     rev = "v${version}";
-    sha256 = "sha256-08IUMw/fCVrmsSL4a86dAbeG+DsS2d7jiVBNKfebVqk=";
+    sha256 = "sha256-oA/oWXTaQPY7bCBUP52b+PACZXV+32G3/STh+sec6AI=";
   };
 
-  cargoHash = "sha256-cHQIW3TDxurrkT9FfGCBVG4PRgTg5+XkLXgnDL1rfG0=";
+  cargoHash = "sha256-X+Y2ialZnwusy3XVnXiTcGmSYsKsFOmEOL4Gc5SgXWU=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/ca/catppuccin-catwalk/package.nix b/pkgs/by-name/ca/catppuccin-catwalk/package.nix
index ab5ebcf62d6a..e63b60710762 100644
--- a/pkgs/by-name/ca/catppuccin-catwalk/package.nix
+++ b/pkgs/by-name/ca/catppuccin-catwalk/package.nix
@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage {
   ];
   buildInputs = [ libwebp ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd catwalk \
       --bash <("$out/bin/catwalk" completion bash) \
       --zsh <("$out/bin/catwalk" completion zsh) \
diff --git a/pkgs/by-name/cd/cdncheck/package.nix b/pkgs/by-name/cd/cdncheck/package.nix
index 1a115db2ebbf..c3e46fb0e8b6 100644
--- a/pkgs/by-name/cd/cdncheck/package.nix
+++ b/pkgs/by-name/cd/cdncheck/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "cdncheck";
-  version = "1.1.35";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "cdncheck";
     tag = "v${version}";
-    hash = "sha256-/ZVR4cGqUIjtiESNYFdedlYuQvLpgs1M/yyBveTF6b4=";
+    hash = "sha256-2+o2CIR8zcoOxdg8Cp+E1U3mjrxQhLUGuMTep0bXnMo=";
   };
 
-  vendorHash = "sha256-/1REkZ5+sz/H4T4lXhloz7fu5cLv1GoaD3dlttN+Qd4=";
+  vendorHash = "sha256-21giZLgfNgDouU+T/8N28BEbJP2u44A3glZOwDBaiHY=";
 
   subPackages = [ "cmd/cdncheck/" ];
 
diff --git a/pkgs/by-name/ce/centrifugo/package.nix b/pkgs/by-name/ce/centrifugo/package.nix
index 290cd0b2295d..e1ec149139c5 100644
--- a/pkgs/by-name/ce/centrifugo/package.nix
+++ b/pkgs/by-name/ce/centrifugo/package.nix
@@ -16,16 +16,16 @@ let
 in
 buildGoModule rec {
   pname = "centrifugo";
-  version = "6.3.0";
+  version = "6.3.1";
 
   src = fetchFromGitHub {
     owner = "centrifugal";
     repo = "centrifugo";
     rev = "v${version}";
-    hash = "sha256-BXZaiIR4+nF17aoiT35IW+GBIQSOplAMd8Kp1dLnT74=";
+    hash = "sha256-1LP33LXGb+W23Mej/kOOl4wIuP/ZKj5ICOabH0WjKWk=";
   };
 
-  vendorHash = "sha256-WK9p648fqNEpk9TmuDwSukKodGEOKd7DgulktRjZfLk=";
+  vendorHash = "sha256-cSiRXIm9Iz0FmialBfcs04e5OUZn/ap9q/MEmGzWz+M=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ch/chain-bench/package.nix b/pkgs/by-name/ch/chain-bench/package.nix
index e46c05ba6767..4f8d7cb056ef 100644
--- a/pkgs/by-name/ch/chain-bench/package.nix
+++ b/pkgs/by-name/ch/chain-bench/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -25,7 +26,7 @@ buildGoModule rec {
     "-X main.version=v${version}"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd chain-bench \
       --bash <($out/bin/chain-bench completion bash) \
       --fish <($out/bin/chain-bench completion fish) \
diff --git a/pkgs/by-name/ch/changelogger/package.nix b/pkgs/by-name/ch/changelogger/package.nix
index 593f0a39bb80..74f1680b478d 100644
--- a/pkgs/by-name/ch/changelogger/package.nix
+++ b/pkgs/by-name/ch/changelogger/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -27,7 +28,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd changelogger \
       --bash <($out/bin/changelogger completion bash) \
       --fish <($out/bin/changelogger completion fish) \
diff --git a/pkgs/by-name/ch/changie/package.nix b/pkgs/by-name/ch/changie/package.nix
index 66afca7ebe98..4a53390b5fd3 100644
--- a/pkgs/by-name/ch/changie/package.nix
+++ b/pkgs/by-name/ch/changie/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -28,7 +29,7 @@ buildGoModule rec {
     "-X=main.version=${version}"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd changie \
       --bash <($out/bin/changie completion bash) \
       --fish <($out/bin/changie completion fish) \
diff --git a/pkgs/by-name/ch/charge-lnd/package.nix b/pkgs/by-name/ch/charge-lnd/package.nix
index bf32c78a05fd..b64162f87fdd 100644
--- a/pkgs/by-name/ch/charge-lnd/package.nix
+++ b/pkgs/by-name/ch/charge-lnd/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "charge-lnd";
-  version = "0.3.0";
+  version = "0.3.1";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "accumulator";
     repo = "charge-lnd";
     tag = "v${version}";
-    hash = "sha256-a/zIEA2oF1+BoZXk4YDWx69eVFSnANUE/F+ARI/VsXU=";
+    hash = "sha256-rACpIHVVq4q3iOEJgJbslCzEcP3qYrc3rZQ85YJfzoQ=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/ci/ciel/package.nix b/pkgs/by-name/ci/ciel/package.nix
index afa7f52af388..06a3f970cb45 100644
--- a/pkgs/by-name/ci/ciel/package.nix
+++ b/pkgs/by-name/ci/ciel/package.nix
@@ -16,16 +16,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ciel";
-  version = "3.9.7";
+  version = "3.9.8";
 
   src = fetchFromGitHub {
     owner = "AOSC-Dev";
     repo = "ciel-rs";
     tag = "v${version}";
-    hash = "sha256-GLgCepIZf08m4xywU0Erh5QWCSAcvGoE7/AOrBwCEWQ=";
+    hash = "sha256-swYIy+e+N4MVmNXSttLUWKmG2xj9TA9sWwCrIdo+gIA=";
   };
 
-  cargoHash = "sha256-SWI7K/fi3DkbvEZ1nS5GfVkjvdwjd2oZbJFaELge34A=";
+  cargoHash = "sha256-RBtERA9CkTdW++ikHkV1X11hg49IrvVFIdTi1qQp+ok=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ci/cilium-cli/package.nix b/pkgs/by-name/ci/cilium-cli/package.nix
index 069ec2d6529c..59f2c448423b 100644
--- a/pkgs/by-name/ci/cilium-cli/package.nix
+++ b/pkgs/by-name/ci/cilium-cli/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   cilium-cli,
   fetchFromGitHub,
@@ -34,7 +35,7 @@ buildGoModule rec {
   # 2022/06/25 10:36:22 Unable to start gops: mkdir /homeless-shelter: permission denied
   HOME = "$TMPDIR";
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd cilium \
       --bash <($out/bin/cilium completion bash) \
       --fish <($out/bin/cilium completion fish) \
diff --git a/pkgs/by-name/ci/cirrus-cli/package.nix b/pkgs/by-name/ci/cirrus-cli/package.nix
index ca5fb79c5958..89a22ef3f672 100644
--- a/pkgs/by-name/ci/cirrus-cli/package.nix
+++ b/pkgs/by-name/ci/cirrus-cli/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   fetchFromGitHub,
   buildGoModule,
   installShellFiles,
@@ -24,7 +25,7 @@ buildGoModule rec {
   ];
 
   nativeBuildInputs = [ installShellFiles ];
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd cirrus \
       --bash <($out/bin/cirrus completion bash) \
       --zsh <($out/bin/cirrus completion zsh) \
diff --git a/pkgs/by-name/ci/civo/package.nix b/pkgs/by-name/ci/civo/package.nix
index 46234501c520..7578339877a7 100644
--- a/pkgs/by-name/ci/civo/package.nix
+++ b/pkgs/by-name/ci/civo/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -36,6 +37,8 @@ buildGoModule rec {
 
   postInstall = ''
     mv $out/bin/cli $out/bin/civo
+  ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd civo \
       --bash <($out/bin/civo completion bash) \
       --fish <($out/bin/civo completion fish) \
diff --git a/pkgs/by-name/cl/cliam/package.nix b/pkgs/by-name/cl/cliam/package.nix
index fea95ffc1b9c..83e34e1f4764 100644
--- a/pkgs/by-name/cl/cliam/package.nix
+++ b/pkgs/by-name/cl/cliam/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -33,7 +34,7 @@ buildGoModule rec {
     mv $GOPATH/bin/{cli,cliam}
   '';
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd cliam \
       --bash <($out/bin/cliam completion bash) \
       --fish <($out/bin/cliam completion fish) \
diff --git a/pkgs/by-name/cl/clive/package.nix b/pkgs/by-name/cl/clive/package.nix
index a722a1e5f8c2..b91308d2e0f0 100644
--- a/pkgs/by-name/cl/clive/package.nix
+++ b/pkgs/by-name/cl/clive/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   ttyd,
   buildGoModule,
   fetchFromGitHub,
@@ -33,6 +34,8 @@ buildGoModule rec {
 
   postInstall = ''
     wrapProgram $out/bin/clive --prefix PATH : ${ttyd}/bin
+  ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd clive \
       --bash <($out/bin/clive completion bash) \
       --fish <($out/bin/clive completion fish) \
diff --git a/pkgs/by-name/cl/clusterctl/package.nix b/pkgs/by-name/cl/clusterctl/package.nix
index 513a07706f9d..76561c3d0818 100644
--- a/pkgs/by-name/cl/clusterctl/package.nix
+++ b/pkgs/by-name/cl/clusterctl/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -34,7 +35,7 @@ buildGoModule rec {
       "-X ${t}.gitVersion=v${version}"
     ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     # errors attempting to write config to read-only $HOME
     export HOME=$TMPDIR
 
diff --git a/pkgs/by-name/cn/cnpypp/package.nix b/pkgs/by-name/cn/cnpypp/package.nix
new file mode 100644
index 000000000000..3cae99476f8f
--- /dev/null
+++ b/pkgs/by-name/cn/cnpypp/package.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  boost,
+  libzip,
+  range-v3,
+}:
+
+stdenv.mkDerivation {
+  pname = "cnpypp";
+  version = "0-unstable-2025-06-22";
+
+  src = fetchFromGitHub {
+    owner = "mreininghaus";
+    repo = "cnpypp";
+    rev = "c6cd4e2078e4f39e862720b66fb211c45577c510";
+    hash = "sha256-aV57931nis0W2cwCNeMjQDip9Au7K76VpC/BqACnT5M=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+  buildInputs = [
+    boost
+    libzip
+    range-v3
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeFeature "CNPYPP_SPAN_IMPL" "BOOST")
+  ];
+
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+
+  checkPhase = ''
+    runHook preCheck
+
+    ./example1
+    ./example2
+    ./example_c
+    ./range_example
+    ./range_zip_example
+    ./npz_speedtest
+
+    runHook postCheck
+  '';
+
+  meta = {
+    description = "C++17 library that allows to read and write NumPy data files";
+    homepage = "https://github.com/mreininghaus/cnpypp";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jherland ];
+    platforms = lib.platforms.all;
+  };
+}
diff --git a/pkgs/by-name/co/cobra-cli/package.nix b/pkgs/by-name/co/cobra-cli/package.nix
index 3f5cea8df239..60eac76c129d 100644
--- a/pkgs/by-name/co/cobra-cli/package.nix
+++ b/pkgs/by-name/co/cobra-cli/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   makeWrapper,
@@ -39,7 +40,7 @@ buildGoModule rec {
       --prefix PATH : ${go}/bin
   '';
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd cobra-cli \
       --bash <($out/bin/cobra-cli completion bash) \
       --fish <($out/bin/cobra-cli completion fish) \
diff --git a/pkgs/by-name/co/confluent-cli/package.nix b/pkgs/by-name/co/confluent-cli/package.nix
index 2e618642e67b..80cfa2b85278 100644
--- a/pkgs/by-name/co/confluent-cli/package.nix
+++ b/pkgs/by-name/co/confluent-cli/package.nix
@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "confluent-cli";
-  version = "4.37.0";
+  version = "4.38.0";
 
   # To get the latest version:
   # curl -L https://cnfl.io/cli | sh -s -- -l | grep -v latest | sort -V | tail -n1
@@ -26,10 +26,10 @@ stdenv.mkDerivation (finalAttrs: {
     fetchurl {
       url = "https://s3-us-west-2.amazonaws.com/confluent.cloud/confluent-cli/archives/${finalAttrs.version}/confluent_${finalAttrs.version}_${system}.tar.gz";
       hash = selectSystem {
-        x86_64-linux = "sha256-UG9vLUoZEK4WSZIXa8VKZ4D7L7WxU9mkyp5WTqFQuog=";
-        aarch64-linux = "sha256-1dz4C/QiCRq1Ncu+dOCUcXqVXed4u7Eyrmxqaj11PIY=";
-        x86_64-darwin = "sha256-XdurFD65BypAryPkBfrvbG5dvIcIodltSd8W68H4KRw=";
-        aarch64-darwin = "sha256-PMcPR7Q5GahEYEiCEqS0Y71To7Tyy46HvvX8VS0VVS8=";
+        x86_64-linux = "sha256-NetkaNbUCbNyajtwLUVW5KpFhkyngYoWxJJxDK42QCQ=";
+        aarch64-linux = "sha256-xzMpG7BknzOdFoUZnnlCjsCxuFCkJMzGi+yH4+0QvtQ=";
+        x86_64-darwin = "sha256-UP5+tnLuYore8t/qi2d3iLf47OMxwF51mfJzgfLnK7s=";
+        aarch64-darwin = "sha256-IV0zEL4ApRZug0C0A0jQm9Vp78z/kk8MwcaXNOE3Agk=";
       };
     };
 
diff --git a/pkgs/by-name/co/container-structure-test/package.nix b/pkgs/by-name/co/container-structure-test/package.nix
index c640369c381d..d932b48b9464 100644
--- a/pkgs/by-name/co/container-structure-test/package.nix
+++ b/pkgs/by-name/co/container-structure-test/package.nix
@@ -8,13 +8,13 @@
   container-structure-test,
 }:
 buildGoModule rec {
-  version = "1.19.3";
+  version = "1.20.0";
   pname = "container-structure-test";
   src = fetchFromGitHub {
     owner = "GoogleContainerTools";
     repo = "container-structure-test";
     rev = "v${version}";
-    sha256 = "sha256-KLLACXUn6dtVCI+gCMHU9hoAJBOAVyhfwxtzsopWS4U=";
+    sha256 = "sha256-7/RTWpj/W+W4mhQL2HX/6KuMbDFsjh9GGRCGZZ9sNHQ=";
   };
   vendorHash = "sha256-pBq76HJ+nluOMOs9nqBKp1mr1LuX2NERXo48g8ezE9k=";
 
diff --git a/pkgs/by-name/co/copilot-cli/package.nix b/pkgs/by-name/co/copilot-cli/package.nix
index f7f8bcbe45ad..1214b6634e3e 100644
--- a/pkgs/by-name/co/copilot-cli/package.nix
+++ b/pkgs/by-name/co/copilot-cli/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -32,7 +33,7 @@ buildGoModule rec {
 
   subPackages = [ "./cmd/copilot" ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd copilot \
       --bash <($out/bin/copilot completion bash) \
       --fish <($out/bin/copilot completion fish) \
diff --git a/pkgs/by-name/co/cosmic-reader/package.nix b/pkgs/by-name/co/cosmic-reader/package.nix
index 9197bdea2b00..07f21969120e 100644
--- a/pkgs/by-name/co/cosmic-reader/package.nix
+++ b/pkgs/by-name/co/cosmic-reader/package.nix
@@ -19,13 +19,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-reader";
-  version = "0-unstable-2025-08-29";
+  version = "0-unstable-2025-09-21";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-reader";
-    rev = "b877809273243f0630b250fd60f12fff48e0bd22";
-    hash = "sha256-kJApZgQkHDP6lD9E2vPLyVGQ0o/xibm83N9CfIJAd0A=";
+    rev = "a5b1b5c0583deacafde19de4ee936cdd126b25df";
+    hash = "sha256-yXY1t67ws2PvK7IubNHT0jp+xnfDAdyK5H7LCMGcMQI=";
   };
 
   cargoHash = "sha256-4ofAtZN3FpYwNahinldALbdEJA5lDwa+CUsVIISnSTc=";
diff --git a/pkgs/by-name/cr/croc/package.nix b/pkgs/by-name/cr/croc/package.nix
index e723164ee215..b2cfb2090241 100644
--- a/pkgs/by-name/cr/croc/package.nix
+++ b/pkgs/by-name/cr/croc/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "croc";
-  version = "10.2.4";
+  version = "10.2.5";
 
   src = fetchFromGitHub {
     owner = "schollz";
     repo = "croc";
     rev = "v${version}";
-    hash = "sha256-iC2Yki8RN+csvNvIQP65bAIN1Q0KR5DUIiZqEVZqG+o=";
+    hash = "sha256-6zeJfRZFpfHsNSD1dICPoOt9HQBaw2eKSX4LH7fLyEk=";
   };
 
-  vendorHash = "sha256-bFn2C5py2STLz8YBlnyK2XDBlgoBnXujeBizN9cDTI0=";
+  vendorHash = "sha256-zMN4SxgnHwLBZ8Lqk6wj/Ne3Hx41VVhf/01DgHT8/Tk=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/ct/ctlptl/package.nix b/pkgs/by-name/ct/ctlptl/package.nix
index b921b2d3dba8..eeec4f03e5ee 100644
--- a/pkgs/by-name/ct/ctlptl/package.nix
+++ b/pkgs/by-name/ct/ctlptl/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -28,7 +29,7 @@ buildGoModule rec {
     "-X main.version=${version}"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd ctlptl \
       --bash <($out/bin/ctlptl completion bash) \
       --fish <($out/bin/ctlptl completion fish) \
diff --git a/pkgs/by-name/cy/cyme/package.nix b/pkgs/by-name/cy/cyme/package.nix
index fff91444ba08..09f133e94272 100644
--- a/pkgs/by-name/cy/cyme/package.nix
+++ b/pkgs/by-name/cy/cyme/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cyme";
-  version = "2.2.4";
+  version = "2.2.5";
 
   src = fetchFromGitHub {
     owner = "tuna-f1sh";
     repo = "cyme";
     rev = "v${version}";
-    hash = "sha256-zwte2YzjEMW1wVti02tOa2IZMd2Z8amYUB9RHevx5bg=";
+    hash = "sha256-1a+8e9sVij9o1G/XlSf7tTECZOHTwqO9rORcYsVjp6Y=";
   };
 
-  cargoHash = "sha256-wOOcIkEgyR5Af78uMuCksalVH8VPFXptg232It/ilXE=";
+  cargoHash = "sha256-HMPjsaHrd3UdazPiAyrHs9Emh0XdjQ/qkaZm6kxOyq4=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/da/datree/package.nix b/pkgs/by-name/da/datree/package.nix
index a30726b53ca5..5133fdba84ab 100644
--- a/pkgs/by-name/da/datree/package.nix
+++ b/pkgs/by-name/da/datree/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -30,7 +31,7 @@ buildGoModule rec {
 
   tags = [ "main" ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion \
       --cmd datree \
       --bash <($out/bin/datree completion bash) \
diff --git a/pkgs/by-name/de/deck/package.nix b/pkgs/by-name/de/deck/package.nix
index bfcb23b67c28..c73785ac20e2 100644
--- a/pkgs/by-name/de/deck/package.nix
+++ b/pkgs/by-name/de/deck/package.nix
@@ -1,5 +1,6 @@
 {
   buildGoModule,
+  stdenv,
   lib,
   installShellFiles,
   fetchFromGitHub,
@@ -29,7 +30,7 @@ buildGoModule rec {
   proxyVendor = true; # darwin/linux hash mismatch
   vendorHash = "sha256-G2mRj1IQi8hxVfqpc5JeSyAb3ADlcmCNNZPJGwefx1k=";
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd deck \
       --bash <($out/bin/deck completion bash) \
       --fish <($out/bin/deck completion fish) \
diff --git a/pkgs/by-name/de/deskflow/package.nix b/pkgs/by-name/de/deskflow/package.nix
index eb2bfce350b5..b85a44536aa4 100644
--- a/pkgs/by-name/de/deskflow/package.nix
+++ b/pkgs/by-name/de/deskflow/package.nix
@@ -34,13 +34,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "deskflow";
-  version = "1.23.0";
+  version = "1.24.0";
 
   src = fetchFromGitHub {
     owner = "deskflow";
     repo = "deskflow";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-REc6TY0eZJgLcDDo3R4evdYuXdgQ8oKNEvhy1zcdTQc=";
+    hash = "sha256-eXQXHi8TMMwyIkZ7gQ9GHIzSOM2rtzV+w1R7hxS+WSA=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/de/dethrace/package.nix b/pkgs/by-name/de/dethrace/package.nix
index 97f6ea6bc89b..6c402cc03261 100644
--- a/pkgs/by-name/de/dethrace/package.nix
+++ b/pkgs/by-name/de/dethrace/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dethrace";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "dethrace-labs";
     repo = "dethrace";
     tag = "v${version}";
-    hash = "sha256-Bt2wwF5cquXZwFpFyJ0TDmbFdTHbboQ93W/DvP9bsMo=";
+    hash = "sha256-+C3NyRLmvXrkZuhLGwIIHFWjXLMpt3srLZCVrxRUlkA=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/dn/dnscontrol/package.nix b/pkgs/by-name/dn/dnscontrol/package.nix
index 233d07edff16..ea9982abaa2a 100644
--- a/pkgs/by-name/dn/dnscontrol/package.nix
+++ b/pkgs/by-name/dn/dnscontrol/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGo125Module,
   fetchFromGitHub,
   installShellFiles,
@@ -30,7 +31,7 @@ buildGo125Module rec {
     "-X=github.com/StackExchange/dnscontrol/v4/pkg/version.version=${version}"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd dnscontrol \
       --bash <($out/bin/dnscontrol shell-completion bash) \
       --zsh <($out/bin/dnscontrol shell-completion zsh)
diff --git a/pkgs/by-name/do/doxygen-awesome-css/package.nix b/pkgs/by-name/do/doxygen-awesome-css/package.nix
index 05412686981a..00132ec7fafd 100644
--- a/pkgs/by-name/do/doxygen-awesome-css/package.nix
+++ b/pkgs/by-name/do/doxygen-awesome-css/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "doxygen-awesome-css";
-  version = "2.3.4";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "jothepro";
     repo = "doxygen-awesome-css";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-g4Smy7BJ//4wQigAnx5fJQe5QxoLc6Aopm8O7S2lVkY=";
+    hash = "sha256-nUp9uYW3p5laen+pRjwRnDvUA+PsGWtniTZ4ZE5Lg0w=";
   };
 
   makeFlags = [ "PREFIX=$(out)" ];
diff --git a/pkgs/by-name/dr/driftctl/package.nix b/pkgs/by-name/dr/driftctl/package.nix
index 715ffa1c8adf..a1f7a6fb6f82 100644
--- a/pkgs/by-name/dr/driftctl/package.nix
+++ b/pkgs/by-name/dr/driftctl/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -28,7 +29,7 @@ buildGoModule rec {
     "-X github.com/snyk/driftctl/build.enableUsageReporting=false"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd driftctl \
       --bash <($out/bin/driftctl completion bash) \
       --fish <($out/bin/driftctl completion fish) \
diff --git a/pkgs/by-name/dy/dyff/package.nix b/pkgs/by-name/dy/dyff/package.nix
index 46527a240db9..66d2524271f6 100644
--- a/pkgs/by-name/dy/dyff/package.nix
+++ b/pkgs/by-name/dy/dyff/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -38,7 +39,7 @@ buildGoModule rec {
     "-X=github.com/homeport/dyff/internal/cmd.version=${version}"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd dyff \
       --bash <($out/bin/dyff completion bash) \
       --fish <($out/bin/dyff completion fish) \
diff --git a/pkgs/by-name/ec/ecspresso/package.nix b/pkgs/by-name/ec/ecspresso/package.nix
index c2f9ba6aff44..9c4ba0d8f086 100644
--- a/pkgs/by-name/ec/ecspresso/package.nix
+++ b/pkgs/by-name/ec/ecspresso/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "ecspresso";
-  version = "2.6.0";
+  version = "2.6.1";
 
   src = fetchFromGitHub {
     owner = "kayac";
     repo = "ecspresso";
     tag = "v${version}";
-    hash = "sha256-t7XToo/OFrczwF24k51Ae1gFI3/C2HIP5mAJVN8BzLk=";
+    hash = "sha256-kZKfhGOxtuZM6oytt/36AW8R2XVoKuLZdaj7NvoRWGA=";
   };
 
   subPackages = [
diff --git a/pkgs/by-name/ek/eksctl/package.nix b/pkgs/by-name/ek/eksctl/package.nix
index 2b28bfdde651..6e2ce4dea702 100644
--- a/pkgs/by-name/ek/eksctl/package.nix
+++ b/pkgs/by-name/ek/eksctl/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -36,7 +37,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd eksctl \
       --bash <($out/bin/eksctl completion bash) \
       --fish <($out/bin/eksctl completion fish) \
diff --git a/pkgs/by-name/en/enc/package.nix b/pkgs/by-name/en/enc/package.nix
index 124ab7d13688..768a2c6a40dc 100644
--- a/pkgs/by-name/en/enc/package.nix
+++ b/pkgs/by-name/en/enc/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   git,
@@ -31,7 +32,7 @@ buildGoModule rec {
 
   nativeCheckInputs = [ git ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd enc \
       --bash <($out/bin/enc completion bash) \
       --fish <($out/bin/enc completion fish) \
diff --git a/pkgs/by-name/en/ent-go/package.nix b/pkgs/by-name/en/ent-go/package.nix
index 611fc0df5e5d..9c7e60978b49 100644
--- a/pkgs/by-name/en/ent-go/package.nix
+++ b/pkgs/by-name/en/ent-go/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -36,7 +37,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd ent \
       --bash <($out/bin/ent completion bash) \
       --fish <($out/bin/ent completion fish) \
diff --git a/pkgs/by-name/et/etherape/package.nix b/pkgs/by-name/et/etherape/package.nix
index a2b044238daa..ee77b6f1e1fb 100644
--- a/pkgs/by-name/et/etherape/package.nix
+++ b/pkgs/by-name/et/etherape/package.nix
@@ -6,7 +6,6 @@
   libtool,
   gtk3,
   libpcap,
-  goocanvas2,
   popt,
   itstool,
   libxml2,
@@ -14,12 +13,14 @@
 
 stdenv.mkDerivation rec {
   pname = "etherape";
-  version = "0.9.20";
+  version = "0.9.21";
   src = fetchurl {
     url = "mirror://sourceforge/etherape/etherape-${version}.tar.gz";
-    sha256 = "sha256-9UsQtWOXB1yYofGS4rMIF+ISWBsJKd0DBOFfqOr1n5Y=";
+    sha256 = "sha256-SckN87uIDTxg36xERMqPxdaLqPNrgg7V+Hc4HJoHF1w=";
   };
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     itstool
     pkg-config
@@ -29,7 +30,6 @@ stdenv.mkDerivation rec {
     libtool
     gtk3
     libpcap
-    goocanvas2
     popt
   ];
 
diff --git a/pkgs/by-name/et/etlegacy-unwrapped/package.nix b/pkgs/by-name/et/etlegacy-unwrapped/package.nix
index b9e18dee9b2c..bbe6bf7e13fb 100644
--- a/pkgs/by-name/et/etlegacy-unwrapped/package.nix
+++ b/pkgs/by-name/et/etlegacy-unwrapped/package.nix
@@ -46,8 +46,9 @@ stdenv.mkDerivation {
     hash = "sha256-hZwLYaYV0j3YwFi8KRr4DZV73L2yIwFJ3XqCyq6L7hE=";
   };
 
+  strictDeps = true;
+
   nativeBuildInputs = [
-    cjson
     cmake
     fakeGit
     git
@@ -56,6 +57,7 @@ stdenv.mkDerivation {
   ];
 
   buildInputs = [
+    cjson
     curl
     freetype
     glew
@@ -72,36 +74,32 @@ stdenv.mkDerivation {
     zlib
   ];
 
-  preBuild = ''
-    # Required for build time to not be in 1980
-    export SOURCE_DATE_EPOCH=$(date +%s)
-    # This indicates the build was by a CI pipeline and prevents the resource
-    # files from being flagged as 'dirty' due to potentially being custom built.
-    export CI="true"
-  '';
-
   cmakeFlags = [
-    "-DCROSS_COMPILE32=0"
-    "-DCMAKE_BUILD_TYPE=Release"
-    "-DBUILD_SERVER=1"
-    "-DBUILD_CLIENT=1"
-    "-DBUNDLED_ZLIB=0"
-    "-DBUNDLED_CJSON=0"
-    "-DBUNDLED_JPEG=0"
-    "-DBUNDLED_LIBS=0"
-    "-DBUNDLED_FREETYPE=0"
-    "-DBUNDLED_OGG_VORBIS=0"
-    "-DBUNDLED_OPENAL=0"
-    "-DBUNDLED_PNG=0"
-    "-DBUNDLED_THEORA=0"
-    "-DBUNDLED_MINIZIP=0"
-    "-DINSTALL_EXTRA=0"
-    "-DINSTALL_OMNIBOT=0"
-    "-DINSTALL_GEOIP=0"
-    "-DINSTALL_WOLFADMIN=0"
-    "-DFEATURE_AUTOUPDATE=0"
-    "-DINSTALL_DEFAULT_BASEDIR=${placeholder "out"}/lib/etlegacy"
-    "-DINSTALL_DEFAULT_BINDIR=${placeholder "out"}/bin"
+    (lib.cmakeBool "CROSS_COMPILE32" false)
+    (lib.cmakeFeature "CMAKE_BUILD_TYPE" "Release")
+    (lib.cmakeBool "BUILD_SERVER" true)
+    (lib.cmakeBool "BUILD_CLIENT" true)
+    (lib.cmakeBool "BUNDLED_ZLIB" false)
+    (lib.cmakeBool "BUNDLED_CJSON" false)
+    (lib.cmakeBool "BUNDLED_JPEG" false)
+    (lib.cmakeBool "BUNDLED_LIBS" false)
+    (lib.cmakeBool "BUNDLED_LIBS_DEFAULT" false)
+    (lib.cmakeBool "BUNDLED_FREETYPE" false)
+    (lib.cmakeBool "BUNDLED_OGG_VORBIS" false)
+    (lib.cmakeBool "BUNDLED_OPENAL" false)
+    (lib.cmakeBool "BUNDLED_PNG" false)
+    (lib.cmakeBool "BUNDLED_THEORA" false)
+    (lib.cmakeBool "BUNDLED_MINIZIP" false)
+    (lib.cmakeBool "CLIENT_GLVND" true)
+    (lib.cmakeBool "ENABLE_SSE" true)
+    (lib.cmakeBool "INSTALL_EXTRA" false)
+    (lib.cmakeBool "INSTALL_OMNIBOT" false)
+    (lib.cmakeBool "INSTALL_GEOIP" false)
+    (lib.cmakeBool "INSTALL_WOLFADMIN" false)
+    (lib.cmakeBool "FEATURE_AUTOUPDATE" false)
+    (lib.cmakeBool "FEATURE_RENDERER2" false)
+    (lib.cmakeFeature "INSTALL_DEFAULT_BASEDIR" "${placeholder "out"}/lib/etlegacy")
+    (lib.cmakeFeature "INSTALL_DEFAULT_BINDIR" "${placeholder "out"}/bin")
   ];
 
   hardeningDisable = [ "fortify" ];
diff --git a/pkgs/by-name/ex/expenses/package.nix b/pkgs/by-name/ex/expenses/package.nix
index a2a71735ed03..7ba110adf3a3 100644
--- a/pkgs/by-name/ex/expenses/package.nix
+++ b/pkgs/by-name/ex/expenses/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   sqlite,
@@ -32,7 +33,7 @@ buildGoModule rec {
     "-X github.com/manojkarthick/expenses/cmd.Version=${version}"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd expenses \
       --bash <($out/bin/expenses completion bash) \
       --zsh <($out/bin/expenses completion zsh) \
diff --git a/pkgs/by-name/fa/fastly/package.nix b/pkgs/by-name/fa/fastly/package.nix
index a2c8b81be704..626c68263697 100644
--- a/pkgs/by-name/fa/fastly/package.nix
+++ b/pkgs/by-name/fa/fastly/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   fetchurl,
   fetchFromGitHub,
   installShellFiles,
@@ -11,13 +12,13 @@
 
 buildGoModule rec {
   pname = "fastly";
-  version = "11.5.0";
+  version = "12.0.0";
 
   src = fetchFromGitHub {
     owner = "fastly";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-o2/gwXODAS4eex6q91hxbNx2RHNt5z8eaT3ZXS7D634=";
+    hash = "sha256-Cq4pTp9K6vsQrdWz9kMdX1K1KR26e/qPL55xqiZ5kYM=";
     # The git commit is part of the `fastly version` original output;
     # leave that output the same in nixpkgs. Use the `.git` directory
     # to retrieve the commit SHA, and remove the directory afterwards,
@@ -34,7 +35,7 @@ buildGoModule rec {
     "cmd/fastly"
   ];
 
-  vendorHash = "sha256-qoRlUCAnJHt9B1w9R4dBtkvqKhk3hum6OjzraPKAzk0=";
+  vendorHash = "sha256-vjTqT/Gv8FU0HNvYqXIE9OCNRsJ8GbUNXIxXDdhDclc=";
 
   nativeBuildInputs = [
     installShellFiles
@@ -68,7 +69,7 @@ buildGoModule rec {
       --set FASTLY_VICEROY_USE_PATH 1
   '';
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     export HOME="$(mktemp -d)"
     installShellCompletion --cmd fastly \
       --bash <($out/bin/fastly --completion-script-bash) \
diff --git a/pkgs/by-name/fe/fetchit/package.nix b/pkgs/by-name/fe/fetchit/package.nix
index 9e77a9154615..04842d497869 100644
--- a/pkgs/by-name/fe/fetchit/package.nix
+++ b/pkgs/by-name/fe/fetchit/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -58,7 +59,7 @@ buildGoModule rec {
   # There are no tests for cmd/fetchit.
   doCheck = false;
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     for i in bash fish zsh; do
       installShellCompletion --cmd fetchit \
         --$i <($out/bin/fetchit completion $i)
diff --git a/pkgs/by-name/fi/fioctl/package.nix b/pkgs/by-name/fi/fioctl/package.nix
index 26d5ba7b9f89..f5198558a813 100644
--- a/pkgs/by-name/fi/fioctl/package.nix
+++ b/pkgs/by-name/fi/fioctl/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -28,7 +29,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd fioctl \
       --bash <($out/bin/fioctl completion bash) \
       --fish <($out/bin/fioctl completion fish) \
diff --git a/pkgs/by-name/fl/flyctl/package.nix b/pkgs/by-name/fl/flyctl/package.nix
index 3e4f3e2488a3..109016e70fb4 100644
--- a/pkgs/by-name/fl/flyctl/package.nix
+++ b/pkgs/by-name/fl/flyctl/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   testers,
@@ -53,7 +54,7 @@ buildGoModule rec {
     runHook postCheck
   '';
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd flyctl \
       --bash <($out/bin/flyctl completion bash) \
       --fish <($out/bin/flyctl completion fish) \
diff --git a/pkgs/by-name/fo/fosrl-pangolin/package.nix b/pkgs/by-name/fo/fosrl-pangolin/package.nix
index bdc67f2c436b..897e0f1d1419 100644
--- a/pkgs/by-name/fo/fosrl-pangolin/package.nix
+++ b/pkgs/by-name/fo/fosrl-pangolin/package.nix
@@ -8,6 +8,7 @@
   inter,
   databaseType ? "sqlite",
   environmentVariables ? { },
+  nixosTests,
 }:
 
 assert lib.assertOneOf "databaseType" databaseType [
@@ -151,7 +152,10 @@ buildNpmPackage (finalAttrs: {
         }
       ];
 
-  passthru = { inherit databaseType; };
+  passthru = {
+    inherit databaseType;
+    tests = { inherit (nixosTests) pangolin; };
+  };
 
   meta = {
     description = "Tunneled reverse proxy server with identity and access control";
diff --git a/pkgs/by-name/fu/func/package.nix b/pkgs/by-name/fu/func/package.nix
index 4388fe81487a..a2a5b15cd8ef 100644
--- a/pkgs/by-name/fu/func/package.nix
+++ b/pkgs/by-name/fu/func/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -31,7 +32,7 @@ buildGoModule (finalAttrs: {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd func \
       --bash <($out/bin/func completion bash) \
       --zsh <($out/bin/func completion zsh)
diff --git a/pkgs/by-name/fx/fx/package.nix b/pkgs/by-name/fx/fx/package.nix
index 1cbe08409dd0..b36b7d208437 100644
--- a/pkgs/by-name/fx/fx/package.nix
+++ b/pkgs/by-name/fx/fx/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -22,7 +23,7 @@ buildGoModule (finalAttrs: {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd fx \
       --bash <($out/bin/fx --comp bash) \
       --fish <($out/bin/fx --comp fish) \
diff --git a/pkgs/by-name/ga/gambit-chess/package.nix b/pkgs/by-name/ga/gambit-chess/package.nix
index 8a3485276625..c39fe64d522e 100644
--- a/pkgs/by-name/ga/gambit-chess/package.nix
+++ b/pkgs/by-name/ga/gambit-chess/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -31,7 +32,7 @@ buildGoModule rec {
     "-X=main.CommitSHA=${src.rev}"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd gambit \
       --bash <($out/bin/gambit completion bash) \
       --fish <($out/bin/gambit completion fish) \
diff --git a/pkgs/by-name/ga/gatekeeper/package.nix b/pkgs/by-name/ga/gatekeeper/package.nix
index f38ba23da0f5..718408fbaeac 100644
--- a/pkgs/by-name/ga/gatekeeper/package.nix
+++ b/pkgs/by-name/ga/gatekeeper/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -28,7 +29,7 @@ buildGoModule rec {
 
   subPackages = [ "cmd/gator" ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd gator \
       --bash <($out/bin/gator completion bash) \
       --fish <($out/bin/gator completion fish) \
diff --git a/pkgs/by-name/ge/geph/package.nix b/pkgs/by-name/ge/geph/package.nix
index 73051d72f445..5c5b98411091 100644
--- a/pkgs/by-name/ge/geph/package.nix
+++ b/pkgs/by-name/ge/geph/package.nix
@@ -38,6 +38,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
   postPatch = ''
     substituteInPlace binaries/geph5-client/src/vpn/*.sh \
       --replace-fail 'PATH=' 'PATH=${binPath}:'
+
+    # This setting is dumped from https://github.com/geph-official/gephgui-wry/blob/a85a632448e548f69f9d1eea3d06a4bdc8be3d57/src/daemon.rs#L230
+    cat ${./settings_default.yaml} | base32 -w 0  | tr 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567' '0123456789ABCDEFGHJKMNPQRSTVWXYZ' | sed 's/=//g' > binaries/geph5-client-gui/src/settings_default.yaml.base32
   '';
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ge/geph/settings_default.yaml b/pkgs/by-name/ge/geph/settings_default.yaml
new file mode 100644
index 000000000000..3121ebccdeb8
--- /dev/null
+++ b/pkgs/by-name/ge/geph/settings_default.yaml
@@ -0,0 +1,23 @@
+exit_constraint: auto
+
+broker:
+  race:
+    - fronted:
+        front: https://www.cdn77.com/
+        host: 1826209743.rsc.cdn77.org
+    - fronted:
+        front: https://www.vuejs.org/
+        host: svitania-naidallszei-2.netlify.app
+        override_dns:
+          - 75.2.60.5:443
+    - fronted:
+        front: https://www.vuejs.org/
+        host: svitania-naidallszei-3.netlify.app
+        override_dns:
+          - 75.2.60.5:443
+    - aws_lambda:
+        function_name: geph-lambda-bouncer
+        region: us-east-1
+        obfs_key: 855MJGAMB58MCPJBB97NADJ36D64WM2T:C4TN2M1H68VNMRVCCH57GDV2C5VN6V3RB8QMWP235D0P4RT2ACV7GVTRCHX3EC37
+
+spoof_dns: true
diff --git a/pkgs/by-name/gh/ghorg/package.nix b/pkgs/by-name/gh/ghorg/package.nix
index f95b30c67a95..f6a58f50db6b 100644
--- a/pkgs/by-name/gh/ghorg/package.nix
+++ b/pkgs/by-name/gh/ghorg/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -28,7 +29,7 @@ buildGoModule rec {
   ];
 
   nativeBuildInputs = [ installShellFiles ];
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd ghorg \
       --bash <($out/bin/ghorg completion bash) \
       --fish <($out/bin/ghorg completion fish) \
diff --git a/pkgs/by-name/gh/ghq/package.nix b/pkgs/by-name/gh/ghq/package.nix
index 705cbfab18a5..92079c5c0fed 100644
--- a/pkgs/by-name/gh/ghq/package.nix
+++ b/pkgs/by-name/gh/ghq/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -29,7 +30,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion \
       --bash $src/misc/bash/_ghq \
       --fish $src/misc/fish/ghq.fish \
diff --git a/pkgs/by-name/gi/git-cliff/package.nix b/pkgs/by-name/gi/git-cliff/package.nix
index 6fd5c403079d..36d11de597c9 100644
--- a/pkgs/by-name/gi/git-cliff/package.nix
+++ b/pkgs/by-name/gi/git-cliff/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "git-cliff";
-  version = "2.10.0";
+  version = "2.10.1";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = "git-cliff";
     rev = "v${version}";
-    hash = "sha256-Kv17U2/1mM+c1356oo2730AihgYUDGULOoZVlqW5tZY=";
+    hash = "sha256-AFNOnFX/U0HkVypzrt1LELMiXshgVJ6q52ga74V9J9w=";
   };
 
-  cargoHash = "sha256-nsE4yDXVA7h82LekaKMPLEG0cRfR4UmxoCzF/wecMcQ=";
+  cargoHash = "sha256-6B65R/6VVUm7OZs/8UmJTEQ0htWBas1kxQj0qQ0QW+4=";
 
   # attempts to run the program on .git in src which is not deterministic
   doCheck = false;
diff --git a/pkgs/by-name/gl/glasskube/package.nix b/pkgs/by-name/gl/glasskube/package.nix
index a474c5c6909b..4b93c58d64b2 100644
--- a/pkgs/by-name/gl/glasskube/package.nix
+++ b/pkgs/by-name/gl/glasskube/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   buildNpmPackage,
   fetchFromGitHub,
@@ -67,7 +68,7 @@ buildGoModule rec {
     cp -r ${web-bundle}/bundle internal/web/root/static/bundle
   '';
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     # Completions
     installShellCompletion --cmd glasskube \
       --bash <($out/bin/glasskube completion bash) \
diff --git a/pkgs/by-name/gl/globus-cli/package.nix b/pkgs/by-name/gl/globus-cli/package.nix
index 445ebddb1bde..fc51eea9b030 100644
--- a/pkgs/by-name/gl/globus-cli/package.nix
+++ b/pkgs/by-name/gl/globus-cli/package.nix
@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "globus-cli";
-  version = "3.36.0";
+  version = "3.37.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "globus";
     repo = "globus-cli";
     tag = version;
-    hash = "sha256-Phu7nXMICSBFUX8wfzwA4ORBJIkhTDCMCqTyZvcG93c=";
+    hash = "sha256-CG57RmWVI1p/8zjDhrH1ZK1KwNrwxbz0FkwOKLBbFcc=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/gl/glooctl/package.nix b/pkgs/by-name/gl/glooctl/package.nix
index a6d12e9dba5e..75e96a7a475c 100644
--- a/pkgs/by-name/gl/glooctl/package.nix
+++ b/pkgs/by-name/gl/glooctl/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -35,6 +36,8 @@ buildGoModule rec {
 
   postInstall = ''
     mv $out/bin/cmd $out/bin/glooctl
+  ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd glooctl \
       --bash <($out/bin/glooctl completion bash) \
       --zsh <($out/bin/glooctl completion zsh)
diff --git a/pkgs/by-name/gm/gmailctl/package.nix b/pkgs/by-name/gm/gmailctl/package.nix
index 900157a20cce..d31ccb008fcb 100644
--- a/pkgs/by-name/gm/gmailctl/package.nix
+++ b/pkgs/by-name/gm/gmailctl/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -22,7 +23,7 @@ buildGoModule rec {
     installShellFiles
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd gmailctl \
       --bash <($out/bin/gmailctl completion bash) \
       --fish <($out/bin/gmailctl completion fish) \
diff --git a/pkgs/by-name/gn/gnunet/package.nix b/pkgs/by-name/gn/gnunet/package.nix
index a7f7dbf90f5c..106963786606 100644
--- a/pkgs/by-name/gn/gnunet/package.nix
+++ b/pkgs/by-name/gn/gnunet/package.nix
@@ -39,11 +39,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnunet";
-  version = "0.24.3";
+  version = "0.25.0";
 
   src = fetchurl {
     url = "mirror://gnu/gnunet/gnunet-${finalAttrs.version}.tar.gz";
-    hash = "sha256-WwaJew6ESJu7Q4J47HPkNiRCsuBaY+QAI+wdDMzGxXY=";
+    hash = "sha256-LepmLuhgWUaFKvAtKAbKZP2t7cxxju72uG4LJoIsNv8=";
   };
 
   enableParallelBuilding = true;
@@ -94,6 +94,12 @@ stdenv.mkDerivation (finalAttrs: {
     # builds.
     find . \( -iname \*test\*.c -or -name \*.conf \) | \
       xargs sed -i -e "s|/tmp|$TMPDIR|g"
+
+    # fix error: conflicting types for `GNUNET_TESTING_cmd_{exec,finish}`
+    for name in exec finish; do
+      substituteInPlace src/lib/testing/testing_api_cmd_$name.c \
+        --replace-fail 'const struct GNUNET_TESTING_Command' 'struct GNUNET_TESTING_Command'
+    done
   '';
 
   # unfortunately, there's still a few failures with impure tests
diff --git a/pkgs/by-name/go/go-containerregistry/package.nix b/pkgs/by-name/go/go-containerregistry/package.nix
index 7dea9263824e..d651beeadcec 100644
--- a/pkgs/by-name/go/go-containerregistry/package.nix
+++ b/pkgs/by-name/go/go-containerregistry/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -52,7 +53,7 @@ buildGoModule rec {
         ln -s ''$${bin}/bin/${bin} $out/bin/
       '') bins
     )
-    + ''
+    + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
       for cmd in crane gcrane; do
         installShellCompletion --cmd "$cmd" \
           --bash <($GOPATH/bin/$cmd completion bash) \
diff --git a/pkgs/by-name/go/go-licenses/package.nix b/pkgs/by-name/go/go-licenses/package.nix
index 2115c76f3a8a..8701111df6c3 100644
--- a/pkgs/by-name/go/go-licenses/package.nix
+++ b/pkgs/by-name/go/go-licenses/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   go,
@@ -36,7 +37,7 @@ buildGoModule rec {
 
   allowGoReference = true;
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd go-licenses \
       --bash <("$out/bin/go-licenses" completion bash) \
       --fish <("$out/bin/go-licenses" completion fish) \
diff --git a/pkgs/by-name/go/gonic/package.nix b/pkgs/by-name/go/gonic/package.nix
index 77dbca2a6e36..14016c04011b 100644
--- a/pkgs/by-name/go/gonic/package.nix
+++ b/pkgs/by-name/go/gonic/package.nix
@@ -20,12 +20,12 @@
 
 buildGoModule rec {
   pname = "gonic";
-  version = "0.17.0";
+  version = "0.18.0";
   src = fetchFromGitHub {
     owner = "sentriz";
     repo = "gonic";
     rev = "v${version}";
-    sha256 = "sha256-/oQKlM8mJuFuIEAXwGuJtdS4mEZXvGPmOUD992Z08ww=";
+    sha256 = "sha256-qWUADZntJg8722Kxt3z1cwIOTcjxS0PYC0RHzselkdI=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -33,7 +33,7 @@ buildGoModule rec {
     taglib
     zlib
   ];
-  vendorHash = "sha256-EPl8qy8d7fs0GJ0b29nBqpg4JYF84Kd4my74ySlCwVA=";
+  vendorHash = "sha256-HY+57SJsz/kPxSadjFl4LQ1Jlu3A5I+rpih67cMMGHA=";
 
   # TODO(Profpatsch): write a test for transcoding support,
   # since it is prone to break
diff --git a/pkgs/by-name/go/gopass-jsonapi/package.nix b/pkgs/by-name/go/gopass-jsonapi/package.nix
index bc9456542310..91a8baccd8a1 100644
--- a/pkgs/by-name/go/gopass-jsonapi/package.nix
+++ b/pkgs/by-name/go/gopass-jsonapi/package.nix
@@ -13,7 +13,7 @@
 
 let
 
-  # https://github.com/gopasspw/gopass-jsonapi/blob/v1.15.16/internal/jsonapi/manifest/manifest_path_linux.go
+  # https://github.com/gopasspw/gopass-jsonapi/blob/v1.15.18/internal/jsonapi/manifest/manifest_path_linux.go
   manifestPaths = {
     firefox = "$out/lib/mozilla/native-messaging-hosts/com.justwatch.gopass.json";
     chrome = "$out/etc/opt/chrome/native-messaging-hosts/com.justwatch.gopass.json";
@@ -27,16 +27,16 @@ let
 in
 buildGoModule rec {
   pname = "gopass-jsonapi";
-  version = "1.15.16";
+  version = "1.15.18";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
     repo = "gopass-jsonapi";
     rev = "v${version}";
-    hash = "sha256-Nl69SSqs18zG7eYhBafXFGBVNQglSeffg7Z0Y8zuLmc=";
+    hash = "sha256-TN6GC+T2S3xdUGtQFbsSnFtdb+DsERLjLMCPCb8Q+2c=";
   };
 
-  vendorHash = "sha256-zncWJSA6cUthwcFZQXtJmwJZujaXt0Rubcga8D0+ZQc=";
+  vendorHash = "sha256-PJOGnx0zSxK95bWbweF/VoSfyXkkmru8XYToSh48YOw=";
 
   subPackages = [ "." ];
 
@@ -72,7 +72,7 @@ buildGoModule rec {
       # `gopass-jsonapi configure` will ask for them. (`--libpath` and `--global`
       # are overriden by `--manifest-path`. `--libpath` is only used to
       # compute Firefox's global manifest path. See
-      # https://github.com/gopasspw/gopass-jsonapi/blob/v1.15.16/setup_others.go#L33-L46)
+      # https://github.com/gopasspw/gopass-jsonapi/blob/v1.15.18/setup_others.go#L33-L46)
       #
       # `gopass-jsonapi configure` ask for confirmation before writing any files,
       # `echo y` gives it.
diff --git a/pkgs/by-name/go/gosec/package.nix b/pkgs/by-name/go/gosec/package.nix
index 084c01f05b14..d1626c708f33 100644
--- a/pkgs/by-name/go/gosec/package.nix
+++ b/pkgs/by-name/go/gosec/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "gosec";
-  version = "2.22.8";
+  version = "2.22.9";
 
   src = fetchFromGitHub {
     owner = "securego";
     repo = "gosec";
     rev = "v${version}";
-    hash = "sha256-Ar8j5oJshouHss062m/YhAWSFDGzTKcZHGxQtKff9Bg=";
+    hash = "sha256-cI6cOD0fySVFex2gd1VTSgLGFz1CGunby2SvowKNXZQ=";
   };
 
-  vendorHash = "sha256-zj1v98LDyaMFmjFtUV2L02j4FSBrODZFVhzYAj4rB1Q=";
+  vendorHash = "sha256-Q/Wws0fefVgp05aQnIlq+Br0RdoEvas0bp2XqT7w19s=";
 
   subPackages = [
     "cmd/gosec"
diff --git a/pkgs/by-name/go/goshs/package.nix b/pkgs/by-name/go/goshs/package.nix
index 4d50f1e1e3b0..83e1dfec2484 100644
--- a/pkgs/by-name/go/goshs/package.nix
+++ b/pkgs/by-name/go/goshs/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "goshs";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "patrickhener";
     repo = "goshs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Me57EOUrpz37fsLYQpmPYjrhIokanS6HmICSjHmqeyU=";
+    hash = "sha256-MgWYbM48VbbmiY5mlDWnyU20/SPziHfZQXwNRZ435Mg=";
   };
 
-  vendorHash = "sha256-bDfeQQMMMUGLNvmFKEUgGhFkvY3emQp9lNVPbz2QiNk=";
+  vendorHash = "sha256-eu4ytWargmwSfCVfXPykCX0VD7XO7m/T8Her10XpM3s=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/go/gosmee/package.nix b/pkgs/by-name/go/gosmee/package.nix
index f84542002a00..7036518feaee 100644
--- a/pkgs/by-name/go/gosmee/package.nix
+++ b/pkgs/by-name/go/gosmee/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -23,7 +24,7 @@ buildGoModule rec {
     printf ${version} > gosmee/templates/version
   '';
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd gosmee \
       --bash <($out/bin/gosmee completion bash) \
       --fish <($out/bin/gosmee completion fish) \
diff --git a/pkgs/by-name/go/gossip/package.nix b/pkgs/by-name/go/gossip/package.nix
index be2ad199f1f4..4821daaab8e8 100644
--- a/pkgs/by-name/go/gossip/package.nix
+++ b/pkgs/by-name/go/gossip/package.nix
@@ -9,6 +9,7 @@
   libGL,
   libxkbcommon,
   makeDesktopItem,
+  copyDesktopItems,
   openssl,
   pkg-config,
   rustPlatform,
@@ -50,6 +51,7 @@ rustPlatform.buildRustPackage rec {
     git
     pkg-config
     rustPlatform.bindgenHook
+    copyDesktopItems
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     wayland-scanner
@@ -110,6 +112,7 @@ rustPlatform.buildRustPackage rec {
         "InstantMessaging"
       ];
       startupWMClass = "gossip";
+      mimeTypes = [ "x-scheme-handler/nostr" ];
     })
   ];
 
diff --git a/pkgs/by-name/go/gotify-server/package.nix b/pkgs/by-name/go/gotify-server/package.nix
index 7d972e514783..51bcf2b369a6 100644
--- a/pkgs/by-name/go/gotify-server/package.nix
+++ b/pkgs/by-name/go/gotify-server/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gotify-server";
-  version = "2.6.3";
+  version = "2.7.2";
 
   src = fetchFromGitHub {
     owner = "gotify";
     repo = "server";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9vIReA29dWf3QwUYEW8JhzF9o74JZqG4zGobgI+gIWE=";
+    hash = "sha256-0kMjHq+GuxTqdiaQq1Px+aWgwDbJVva4MZFIfAGvaKk=";
   };
 
-  vendorHash = "sha256-rs6EfnJT6Jgif2TR5u5Tp5/Ozn+4uhSapksyKFnQiCo=";
+  vendorHash = "sha256-cXt8SZNDhYxfQq/B0zhZLmQs8vAFHXh3qTz/1dtB3mU=";
 
   # No test
   doCheck = false;
diff --git a/pkgs/by-name/go/gotify-server/ui.nix b/pkgs/by-name/go/gotify-server/ui.nix
index 432aeedafd60..9a7e02ec360c 100644
--- a/pkgs/by-name/go/gotify-server/ui.nix
+++ b/pkgs/by-name/go/gotify-server/ui.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-ejHzo6NHCMlNiYePWvfMY9Blb58pj3UQ5PFI0V84flI=";
+    hash = "sha256-0OIxoT7iS7i3E1fD6E/6+WVYZcu2r+Qa7KBX56+CzIk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/go/goverview/package.nix b/pkgs/by-name/go/goverview/package.nix
index a7571f4680c1..45c67696567b 100644
--- a/pkgs/by-name/go/goverview/package.nix
+++ b/pkgs/by-name/go/goverview/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -25,7 +26,7 @@ buildGoModule rec {
   nativeBuildInputs = [
     installShellFiles
   ];
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd goverview \
       --bash <($out/bin/goverview completion bash) \
       --fish <($out/bin/goverview completion fish) \
diff --git a/pkgs/by-name/gr/grafana-alloy/package.nix b/pkgs/by-name/gr/grafana-alloy/package.nix
index a1383984f474..dba589bc04c9 100644
--- a/pkgs/by-name/gr/grafana-alloy/package.nix
+++ b/pkgs/by-name/gr/grafana-alloy/package.nix
@@ -112,7 +112,7 @@ buildGoModule rec {
       $out/bin/alloy
   '';
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd alloy \
       --bash <($out/bin/alloy completion bash) \
       --fish <($out/bin/alloy completion fish) \
diff --git a/pkgs/by-name/gr/graphite-cli/package.nix b/pkgs/by-name/gr/graphite-cli/package.nix
index 634425053fdf..5100d7d69180 100644
--- a/pkgs/by-name/gr/graphite-cli/package.nix
+++ b/pkgs/by-name/gr/graphite-cli/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildNpmPackage,
   fetchurl,
   git,
@@ -28,7 +29,7 @@ buildNpmPackage rec {
 
   dontNpmBuild = true;
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd gt \
       --bash <($out/bin/gt completion) \
       --fish <(GT_PAGER= $out/bin/gt fish) \
diff --git a/pkgs/by-name/gr/grype/package.nix b/pkgs/by-name/gr/grype/package.nix
index b0ed5db81424..5cbf85382a4a 100644
--- a/pkgs/by-name/gr/grype/package.nix
+++ b/pkgs/by-name/gr/grype/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   git,
@@ -111,7 +112,7 @@ buildGoModule (finalAttrs: {
     rm grype/db/v5/namespace/cpe/namespace_test.go
   '';
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd grype \
       --bash <($out/bin/grype completion bash) \
       --fish <($out/bin/grype completion fish) \
diff --git a/pkgs/by-name/gt/gtrash/package.nix b/pkgs/by-name/gt/gtrash/package.nix
index 9934836d3c94..2c5a5d2b888e 100644
--- a/pkgs/by-name/gt/gtrash/package.nix
+++ b/pkgs/by-name/gt/gtrash/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -33,7 +34,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd gtrash \
       --bash <($out/bin/gtrash completion bash) \
       --fish <($out/bin/gtrash completion fish) \
diff --git a/pkgs/by-name/he/helm-ls/package.nix b/pkgs/by-name/he/helm-ls/package.nix
index 2025b4c41448..53735b45dd32 100644
--- a/pkgs/by-name/he/helm-ls/package.nix
+++ b/pkgs/by-name/he/helm-ls/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -28,7 +29,7 @@ buildGoModule rec {
     "-X main.Version=${version}"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     mv $out/bin/helm-ls $out/bin/helm_ls
     installShellCompletion --cmd helm_ls \
       --bash <($out/bin/helm_ls completion bash) \
diff --git a/pkgs/by-name/he/helmfile/package.nix b/pkgs/by-name/he/helmfile/package.nix
index c4cadadab1bf..b5dcdbcd5d0c 100644
--- a/pkgs/by-name/he/helmfile/package.nix
+++ b/pkgs/by-name/he/helmfile/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGo125Module,
   fetchFromGitHub,
   installShellFiles,
@@ -39,7 +40,7 @@ buildGo125Module rec {
       wrapProgram $out/bin/helmfile \
         --set HELM_PLUGINS "${pluginsDir}"
     ''
-    + ''
+    + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
       installShellCompletion --cmd helmfile \
         --bash <($out/bin/helmfile completion bash) \
         --fish <($out/bin/helmfile completion fish) \
diff --git a/pkgs/by-name/hl/hl-log-viewer/package.nix b/pkgs/by-name/hl/hl-log-viewer/package.nix
index 8b6c2d1b066d..aefbaea2efde 100644
--- a/pkgs/by-name/hl/hl-log-viewer/package.nix
+++ b/pkgs/by-name/hl/hl-log-viewer/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   rustPlatform,
   installShellFiles,
   fetchFromGitHub,
@@ -21,7 +22,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd hl \
       --bash <($out/bin/hl --shell-completions bash) \
       --fish <($out/bin/hl --shell-completions fish) \
diff --git a/pkgs/by-name/ho/hostctl/package.nix b/pkgs/by-name/ho/hostctl/package.nix
index d3825ec0319b..d1dbe67e4cd0 100644
--- a/pkgs/by-name/ho/hostctl/package.nix
+++ b/pkgs/by-name/ho/hostctl/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -28,7 +29,7 @@ buildGoModule rec {
     "-X github.com/guumaster/hostctl/cmd/hostctl/actions.version=${version}"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd hostctl \
       --bash <($out/bin/hostctl completion bash) \
       --zsh <($out/bin/hostctl completion zsh)
diff --git a/pkgs/by-name/ht/htmlhint/package.nix b/pkgs/by-name/ht/htmlhint/package.nix
index 77a4c8f9eb7d..b1a46eca36fa 100644
--- a/pkgs/by-name/ht/htmlhint/package.nix
+++ b/pkgs/by-name/ht/htmlhint/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "htmlhint";
-  version = "1.7.0";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "htmlhint";
     repo = "HTMLHint";
     rev = "v${version}";
-    hash = "sha256-aFydnJiRqGzBKZGX/AvRlxjf3sw+fBwKdGmydFjD/xk=";
+    hash = "sha256-jhn3FWzqwqczB7siHRxpYNLPoC9YhZtkcVyvWdIq93k=";
   };
 
-  npmDepsHash = "sha256-h37yWpXWh9+cMlI36zucq2ZbYsQUaGuRQGJySKIeda0=";
+  npmDepsHash = "sha256-acf6pyv3TsOA3Ulm/OMYZ2R7sMGEcsOXA9hbPXLbX3I=";
 
   meta = {
     changelog = "https://github.com/htmlhint/HTMLHint/blob/${src.rev}/CHANGELOG.md";
diff --git a/pkgs/by-name/hu/humioctl/package.nix b/pkgs/by-name/hu/humioctl/package.nix
index 34fc374f4f54..115c0fb424ee 100644
--- a/pkgs/by-name/hu/humioctl/package.nix
+++ b/pkgs/by-name/hu/humioctl/package.nix
@@ -3,6 +3,7 @@
   fetchFromGitHub,
   installShellFiles,
   lib,
+  stdenv,
 }:
 
 buildGoModule rec {
@@ -26,7 +27,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd humioctl \
       --bash <($out/bin/humioctl completion bash) \
       --zsh <($out/bin/humioctl completion zsh)
diff --git a/pkgs/by-name/hy/hyprkeys/package.nix b/pkgs/by-name/hy/hyprkeys/package.nix
index 672f98e764c7..d0cb0b634a02 100644
--- a/pkgs/by-name/hy/hyprkeys/package.nix
+++ b/pkgs/by-name/hy/hyprkeys/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -28,7 +29,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-JFvC9V0xS8SZSdLsOtpyTrFzXjYAOaPQaJHdcnJzK3s=";
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd hyprkeys \
       --bash <($out/bin/hyprkeys completion bash) \
       --fish <($out/bin/hyprkeys completion fish) \
diff --git a/pkgs/by-name/hy/hyprland-workspaces-tui/package.nix b/pkgs/by-name/hy/hyprland-workspaces-tui/package.nix
index 0134745427e0..4028f68eab83 100644
--- a/pkgs/by-name/hy/hyprland-workspaces-tui/package.nix
+++ b/pkgs/by-name/hy/hyprland-workspaces-tui/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   rustPlatform,
   fetchFromGitHub,
   makeWrapper,
@@ -27,7 +28,7 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = [ hyprland-workspaces ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd hyprland-workspaces-tui \
       --bash <($out/bin/hyprland-workspaces-tui --completions bash) \
       --zsh <($out/bin/hyprland-workspaces-tui --completions zsh) \
diff --git a/pkgs/by-name/in/infracost/package.nix b/pkgs/by-name/in/infracost/package.nix
index 1ecac7d6c471..12d3817f5b13 100644
--- a/pkgs/by-name/in/infracost/package.nix
+++ b/pkgs/by-name/in/infracost/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -43,7 +44,7 @@ buildGoModule rec {
     "-short"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     export INFRACOST_SKIP_UPDATE_CHECK=true
     installShellCompletion --cmd infracost \
       --bash <($out/bin/infracost completion --shell bash) \
diff --git a/pkgs/by-name/ip/ipam/package.nix b/pkgs/by-name/ip/ipam/package.nix
index fea8e5c867da..942a938ff9a9 100644
--- a/pkgs/by-name/ip/ipam/package.nix
+++ b/pkgs/by-name/ip/ipam/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitea,
   installShellFiles,
@@ -28,7 +29,7 @@ buildGoModule rec {
     "-w"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd ipam \
       --bash <($out/bin/ipam completion bash) \
       --fish <($out/bin/ipam completion fish) \
diff --git a/pkgs/by-name/is/istat-menus/package.nix b/pkgs/by-name/is/istat-menus/package.nix
index 4d6a33ee7195..735c129521f1 100644
--- a/pkgs/by-name/is/istat-menus/package.nix
+++ b/pkgs/by-name/is/istat-menus/package.nix
@@ -10,11 +10,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "istat-menus";
-  version = "7.10.2";
+  version = "7.10.4";
 
   src = fetchurl {
     url = "https://cdn.istatmenus.app/files/istatmenus${lib.versions.major finalAttrs.version}/versions/iStatMenus${finalAttrs.version}.zip";
-    hash = "sha256-NDjIsCAxTcCo6APaWyuYmil8b0gzJEmSxFxqm2IQ5dU=";
+    hash = "sha256-9fw0J492ywzuKXGR47WAjL6IROCRByCn7KsbQecUU+w=";
   };
 
   sourceRoot = ".";
@@ -48,7 +48,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     description = "Set of nine separate and highly configurable menu items that let you know exactly what's going on inside your Mac";
     homepage = "https://bjango.com/mac/istatmenus/";
     license = lib.licenses.unfree;
-    maintainers = with lib.maintainers; [ FlameFlag ];
+    maintainers = with lib.maintainers; [
+      FlameFlag
+      iedame
+    ];
     platforms = lib.platforms.darwin;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
diff --git a/pkgs/by-name/it/itsycal/package.nix b/pkgs/by-name/it/itsycal/package.nix
index 97a2303ad262..5c212cf10109 100644
--- a/pkgs/by-name/it/itsycal/package.nix
+++ b/pkgs/by-name/it/itsycal/package.nix
@@ -6,11 +6,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "itsycal";
-  version = "0.15.5";
+  version = "0.15.6";
 
   src = fetchzip {
     url = "https://itsycal.s3.amazonaws.com/Itsycal-${finalAttrs.version}.zip";
-    hash = "sha256-kRO9zcyi8Di0NNuT158htKXt4wo7nVys+AV+1EgS1ZI=";
+    hash = "sha256-e1h81Lsi9mC/3HfUbCk9JkLztGZSVRG6NeQb9voPDk0=";
   };
 
   installPhase = ''
@@ -27,7 +27,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     description = "Tiny menu bar calendar";
     homepage = "https://www.mowglii.com/itsycal/";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ FlameFlag ];
+    maintainers = with lib.maintainers; [
+      FlameFlag
+      iedame
+    ];
     platforms = lib.platforms.darwin;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
diff --git a/pkgs/by-name/iw/iw4x-launcher/package.nix b/pkgs/by-name/iw/iw4x-launcher/package.nix
index 126b0f3788c4..5d3aee515f8e 100644
--- a/pkgs/by-name/iw/iw4x-launcher/package.nix
+++ b/pkgs/by-name/iw/iw4x-launcher/package.nix
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   meta = {
     description = "Official launcher for the IW4x mod";
     longDescription = "IW4x allows you to relive Call of Duty: Modern Warfare 2 (2009) in a secure environment with expanded modding capabilites";
-    homepage = "https://iw4x.dev";
+    homepage = "https://iw4x.io";
     downloadPage = "https://github.com/iw4x/launcher";
     changelog = "https://github.com/iw4x/launcher/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl3Only;
diff --git a/pkgs/by-name/je/jellyfin-ffmpeg/package.nix b/pkgs/by-name/je/jellyfin-ffmpeg/package.nix
index 2b57715cb68a..1c40b4fca43d 100644
--- a/pkgs/by-name/je/jellyfin-ffmpeg/package.nix
+++ b/pkgs/by-name/je/jellyfin-ffmpeg/package.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "7.1.1-7";
+  version = "7.1.2-1";
 in
 
 (ffmpeg_7-full.override {
@@ -14,7 +14,7 @@ in
     owner = "jellyfin";
     repo = "jellyfin-ffmpeg";
     rev = "v${version}";
-    hash = "sha256-QzmMhLwlFO9TOCLQaTpoCgNwPpertRA3h1+JMzOEULE=";
+    hash = "sha256-1nisdEtH5J5cDqUeDev0baCHopmoQ1SEojFdYdYeY0Q=";
   };
 }).overrideAttrs
   (old: {
diff --git a/pkgs/by-name/je/jenkins/package.nix b/pkgs/by-name/je/jenkins/package.nix
index d4731991b1c3..1f26162ba92a 100644
--- a/pkgs/by-name/je/jenkins/package.nix
+++ b/pkgs/by-name/je/jenkins/package.nix
@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "jenkins";
-  version = "2.516.2";
+  version = "2.516.3";
 
   src = fetchurl {
     url = "https://get.jenkins.io/war-stable/${finalAttrs.version}/jenkins.war";
-    hash = "sha256-7WucCZXXgGLgVcekKgVbZRh8TSbqNvubSdjy3Ya8b8g=";
+    hash = "sha256-gbOrzA8kzqSOdO/+FS9p3F8NiA7cDCc3xhRGs8WZLAA=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/je/jetuml/package.nix b/pkgs/by-name/je/jetuml/package.nix
new file mode 100644
index 000000000000..e67cba6d2496
--- /dev/null
+++ b/pkgs/by-name/je/jetuml/package.nix
@@ -0,0 +1,76 @@
+{
+  stdenvNoCC,
+  lib,
+  makeDesktopItem,
+  copyDesktopItems,
+  fetchurl,
+  jdk,
+  makeBinaryWrapper,
+  imagemagick,
+}:
+
+let
+  jdkWithFX = jdk.override { enableJavaFX = true; };
+in
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "jetuml";
+  version = "3.9";
+
+  src = fetchurl {
+    url = "https://github.com/prmr/JetUML/releases/download/v${finalAttrs.version}/JetUML-${finalAttrs.version}.jar";
+    hash = "sha256-wACGbHeRQ5rXcuI1J3eTfQraWp8eWtkIAPo7BNGcFUU=";
+  };
+
+  dontUnpack = true;
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    makeBinaryWrapper
+    copyDesktopItems
+    imagemagick
+  ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "jetuml";
+      desktopName = "JetUML";
+      genericName = "UML Tool";
+      categories = [
+        "Application"
+        "Development"
+        "ProjectManagement"
+      ];
+      icon = "jet";
+      exec = "jetuml";
+      comment = finalAttrs.meta.description;
+    })
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    ${jdkWithFX}/lib/openjdk/bin/jar xf $src jet.png
+    magick jet.png -resize 128x128 jet128.png
+    magick jet.png -resize 48x48 jet48.png
+    install -Dm444 jet48.png $out/share/icons/hicolor/48x48/jet.png
+    install -Dm444 jet128.png $out/share/icons/hicolor/128x128/jet.png
+
+    install -Dm444 $src $out/share/java/JetUML-${finalAttrs.version}.jar
+
+    makeWrapper ${jdkWithFX}/lib/openjdk/bin/java $out/bin/jetuml \
+      --add-flags "-jar $out/share/java/JetUML-${finalAttrs.version}.jar"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "https://www.jetuml.org/";
+    description = "Desktop application for fast UML diagramming";
+    mainProgram = "jetuml";
+    sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.all;
+    maintainers = [ lib.maintainers.felissedano ];
+  };
+})
diff --git a/pkgs/by-name/k3/k3d/package.nix b/pkgs/by-name/k3/k3d/package.nix
index ca6cc1a20c28..e9b042cc0935 100644
--- a/pkgs/by-name/k3/k3d/package.nix
+++ b/pkgs/by-name/k3/k3d/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -52,7 +53,7 @@ buildGoModule rec {
       --replace-fail "TestGetK3sVersion" "SkipGetK3sVersion"
   '';
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd k3d \
       --bash <($out/bin/k3d completion bash) \
       --fish <($out/bin/k3d completion fish) \
diff --git a/pkgs/by-name/k8/k8s-manifest-sigstore/package.nix b/pkgs/by-name/k8/k8s-manifest-sigstore/package.nix
index 7977fe094bde..833c41d993a2 100644
--- a/pkgs/by-name/k8/k8s-manifest-sigstore/package.nix
+++ b/pkgs/by-name/k8/k8s-manifest-sigstore/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -39,7 +40,7 @@ buildGoModule rec {
       "-X ${prefix}.GitVersion=v${version}"
     ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd kubectl-sigstore \
       --bash <($out/bin/kubectl-sigstore completion bash) \
       --fish <($out/bin/kubectl-sigstore completion fish) \
diff --git a/pkgs/by-name/ka/kardolus-chatgpt-cli/package.nix b/pkgs/by-name/ka/kardolus-chatgpt-cli/package.nix
index ea06e465e278..c4a73de144b2 100644
--- a/pkgs/by-name/ka/kardolus-chatgpt-cli/package.nix
+++ b/pkgs/by-name/ka/kardolus-chatgpt-cli/package.nix
@@ -9,18 +9,18 @@ buildGoModule (finalAttrs: {
   # "chatgpt-cli" is taken by another package with the same upsteam name.
   # To keep "pname" and "package attribute name" identical, the owners name (kardolus) gets prefixed as identifier.
   pname = "kardolus-chatgpt-cli";
-  version = "1.8.9";
+  version = "1.8.10";
 
   src = fetchFromGitHub {
     owner = "kardolus";
     repo = "chatgpt-cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-XC8Uzrm8OjyEvdYArFt6rJJYrXKJeG3QgaOqgUyFNmw=";
+    hash = "sha256-XZ9f+PAY0i7DfzZCxtZFw1jit7o/tjqAEc8uJpqiOAc=";
   };
 
   vendorHash = null;
   # The tests of kardolus/chatgpt-cli require an OpenAI API Key to be present in the environment,
-  # (e.g. https://github.com/kardolus/chatgpt-cli/blob/v1.8.9/test/contract/contract_test.go#L35)
+  # (e.g. https://github.com/kardolus/chatgpt-cli/blob/v1.8.10/test/contract/contract_test.go#L35)
   # which will not be the case in the pipeline.
   # Therefore, tests must be skipped.
   doCheck = false;
diff --git a/pkgs/by-name/ka/karmor/package.nix b/pkgs/by-name/ka/karmor/package.nix
index 68b4b82c57c4..35b72678adea 100644
--- a/pkgs/by-name/ka/karmor/package.nix
+++ b/pkgs/by-name/ka/karmor/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -34,6 +35,8 @@ buildGoModule rec {
 
   postInstall = ''
     mv $out/bin/{kubearmor-client,karmor}
+  ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd karmor \
       --bash <($out/bin/karmor completion bash) \
       --fish <($out/bin/karmor completion fish) \
diff --git a/pkgs/by-name/kd/kdigger/package.nix b/pkgs/by-name/kd/kdigger/package.nix
index 7a8d821d98f4..5a93c4448f14 100644
--- a/pkgs/by-name/kd/kdigger/package.nix
+++ b/pkgs/by-name/kd/kdigger/package.nix
@@ -42,7 +42,7 @@ buildGoModule rec {
     ldflags+=" -X github.com/quarkslab/kdigger/commands.GITCOMMIT=$(cat COMMIT)"
   '';
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd kdigger \
       --bash <($out/bin/kdigger completion bash) \
       --fish <($out/bin/kdigger completion fish) \
diff --git a/pkgs/by-name/ki/kind/package.nix b/pkgs/by-name/ki/kind/package.nix
index 233937b0cbc9..8f48ba17ae96 100644
--- a/pkgs/by-name/ki/kind/package.nix
+++ b/pkgs/by-name/ki/kind/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -37,7 +38,7 @@ buildGoModule rec {
     "-w"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd kind \
       --bash <($out/bin/kind completion bash) \
       --fish <($out/bin/kind completion fish) \
diff --git a/pkgs/by-name/kn/kn/package.nix b/pkgs/by-name/kn/kn/package.nix
index d8e61dc0536b..90501eb6e177 100644
--- a/pkgs/by-name/kn/kn/package.nix
+++ b/pkgs/by-name/kn/kn/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   getent,
@@ -27,7 +28,7 @@ buildGoModule (finalAttrs: {
 
   ldflags = [ "-X knative.dev/client/pkg/commands/version.Version=v${finalAttrs.version}" ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd kn \
       --bash <($out/bin/kn completion bash) \
       --zsh <($out/bin/kn completion zsh)
diff --git a/pkgs/by-name/ko/ko/package.nix b/pkgs/by-name/ko/ko/package.nix
index 10a03be43251..a435e95b1f43 100644
--- a/pkgs/by-name/ko/ko/package.nix
+++ b/pkgs/by-name/ko/ko/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   gitMinimal,
@@ -55,7 +56,7 @@ buildGoModule rec {
     unset GOOS GOARCH GOARM
   '';
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd ko \
       --bash <($out/bin/ko completion bash) \
       --fish <($out/bin/ko completion fish) \
diff --git a/pkgs/by-name/ko/komac/package.nix b/pkgs/by-name/ko/komac/package.nix
index b0b05e774b4e..cfa0d188cb84 100644
--- a/pkgs/by-name/ko/komac/package.nix
+++ b/pkgs/by-name/ko/komac/package.nix
@@ -16,16 +16,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "komac";
-  version = "2.12.1";
+  version = "2.13.0";
 
   src = fetchFromGitHub {
     owner = "russellbanks";
     repo = "Komac";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-F6Vb6X1JbB7I1oOkrtLBVUdi2nqPIhiQIlqUEfPIgsc=";
+    hash = "sha256-wOojfEEzf/NGiyL3Q8ql7t7/gM/hVfgeQmc5cvugKR4=";
   };
 
-  cargoHash = "sha256-FMxt98wbes1PWqeOE95epK4uwOEgLU3zvCu1cyDPxGA=";
+  cargoHash = "sha256-Bn2Nq/aH2Ta/3VaNQwLClv9gaz2qjo0Ko+d1XQtVdFY=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ko/konstraint/package.nix b/pkgs/by-name/ko/konstraint/package.nix
index f15931719278..77536038df39 100644
--- a/pkgs/by-name/ko/konstraint/package.nix
+++ b/pkgs/by-name/ko/konstraint/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -28,7 +29,7 @@ buildGoModule rec {
     "-X github.com/plexsystems/konstraint/internal/commands.version=${version}"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd konstraint \
       --bash <($out/bin/konstraint completion bash) \
       --fish <($out/bin/konstraint completion fish) \
diff --git a/pkgs/by-name/ku/kube-linter/package.nix b/pkgs/by-name/ku/kube-linter/package.nix
index f57dbc4cc1e1..6a9de33b4c81 100644
--- a/pkgs/by-name/ku/kube-linter/package.nix
+++ b/pkgs/by-name/ku/kube-linter/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -32,7 +33,7 @@ buildGoModule rec {
 
   checkFlags = [ "-skip=TestCreateContextsWithIgnorePaths" ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd kube-linter \
       --bash <($out/bin/kube-linter completion bash) \
       --fish <($out/bin/kube-linter completion fish) \
diff --git a/pkgs/by-name/ku/kubecfg/package.nix b/pkgs/by-name/ku/kubecfg/package.nix
index 1eb5cac7ac93..66d19f7fe720 100644
--- a/pkgs/by-name/ku/kubecfg/package.nix
+++ b/pkgs/by-name/ku/kubecfg/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -26,7 +27,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd kubecfg \
       --bash <($out/bin/kubecfg completion --shell=bash) \
       --zsh  <($out/bin/kubecfg completion --shell=zsh)
diff --git a/pkgs/by-name/ku/kubeone/package.nix b/pkgs/by-name/ku/kubeone/package.nix
index 964a2a707ed9..b64b3bc12c29 100644
--- a/pkgs/by-name/ku/kubeone/package.nix
+++ b/pkgs/by-name/ku/kubeone/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -31,7 +32,7 @@ buildGoModule rec {
     installShellFiles
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd kubeone \
       --bash <($out/bin/kubeone completion bash) \
       --zsh <($out/bin/kubeone completion zsh)
diff --git a/pkgs/by-name/ku/kubernetes-polaris/package.nix b/pkgs/by-name/ku/kubernetes-polaris/package.nix
index ff0a588bdeb5..d6cb4f3a5554 100644
--- a/pkgs/by-name/ku/kubernetes-polaris/package.nix
+++ b/pkgs/by-name/ku/kubernetes-polaris/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -27,7 +28,7 @@ buildGoModule rec {
     "-X main.Commit=${version}"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd polaris \
       --bash <($out/bin/polaris completion bash) \
       --fish <($out/bin/polaris completion fish) \
diff --git a/pkgs/by-name/ku/kubescape/package.nix b/pkgs/by-name/ku/kubescape/package.nix
index b7f98f12e2c7..8f5a2faf34b0 100644
--- a/pkgs/by-name/ku/kubescape/package.nix
+++ b/pkgs/by-name/ku/kubescape/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   git,
@@ -57,7 +58,7 @@ buildGoModule rec {
       --replace-fail "TestSetContextMetadata" "SkipSetContextMetadata"
   '';
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd kubescape \
       --bash <($out/bin/kubescape completion bash) \
       --fish <($out/bin/kubescape completion fish) \
diff --git a/pkgs/by-name/ku/kubesec/package.nix b/pkgs/by-name/ku/kubesec/package.nix
index 05add02663f5..a39b1f86f7d7 100644
--- a/pkgs/by-name/ku/kubesec/package.nix
+++ b/pkgs/by-name/ku/kubesec/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -29,7 +30,7 @@ buildGoModule rec {
   # Tests wants to download the kubernetes schema for use with kubeval
   doCheck = false;
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd kubesec \
       --bash <($out/bin/kubesec completion bash) \
       --fish <($out/bin/kubesec completion fish) \
diff --git a/pkgs/by-name/ku/kubevirt/package.nix b/pkgs/by-name/ku/kubevirt/package.nix
index dbe8ef7709d4..e19bdacc7ce5 100644
--- a/pkgs/by-name/ku/kubevirt/package.nix
+++ b/pkgs/by-name/ku/kubevirt/package.nix
@@ -3,6 +3,7 @@
   fetchFromGitHub,
   installShellFiles,
   lib,
+  stdenv,
   testers,
   kubevirt,
 }:
@@ -32,7 +33,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd virtctl \
       --bash <($out/bin/virtctl completion bash) \
       --fish <($out/bin/virtctl completion fish) \
diff --git a/pkgs/by-name/ky/kyverno/package.nix b/pkgs/by-name/ky/kyverno/package.nix
index 9a15c64af61f..7dc282d4edad 100644
--- a/pkgs/by-name/ky/kyverno/package.nix
+++ b/pkgs/by-name/ky/kyverno/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -35,6 +36,8 @@ buildGoModule rec {
     # we have no integration between krew and kubectl
     # so better rename binary to kyverno and use as a standalone
     mv $out/bin/kubectl-kyverno $out/bin/kyverno
+  ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd kyverno \
       --bash <($out/bin/kyverno completion bash) \
       --zsh <($out/bin/kyverno completion zsh) \
diff --git a/pkgs/by-name/la/lapce/package.nix b/pkgs/by-name/la/lapce/package.nix
index 6ad86e3f36be..44880910a362 100644
--- a/pkgs/by-name/la/lapce/package.nix
+++ b/pkgs/by-name/la/lapce/package.nix
@@ -103,7 +103,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/lapce/lapce";
     changelog = "https://github.com/lapce/lapce/releases/tag/v${version}";
     license = with lib.licenses; [ asl20 ];
-    maintainers = with lib.maintainers; [ elliot ];
     mainProgram = "lapce";
   };
 }
diff --git a/pkgs/by-name/le/leetgo/package.nix b/pkgs/by-name/le/leetgo/package.nix
index 079444b6398c..78144fbead0a 100644
--- a/pkgs/by-name/le/leetgo/package.nix
+++ b/pkgs/by-name/le/leetgo/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -28,7 +29,7 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd leetgo \
       --bash <($out/bin/leetgo completion bash) \
       --fish <($out/bin/leetgo completion fish) \
diff --git a/pkgs/by-name/le/lefthook/package.nix b/pkgs/by-name/le/lefthook/package.nix
index bf7e841cf246..bff671b8cb7d 100644
--- a/pkgs/by-name/le/lefthook/package.nix
+++ b/pkgs/by-name/le/lefthook/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -30,7 +31,7 @@ buildGoModule {
 
   doCheck = false;
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd lefthook \
       --bash <($out/bin/lefthook completion bash) \
       --fish <($out/bin/lefthook completion fish) \
diff --git a/pkgs/by-name/li/libgbinder/package.nix b/pkgs/by-name/li/libgbinder/package.nix
index e7c1458e8fc4..1091edbee99c 100644
--- a/pkgs/by-name/li/libgbinder/package.nix
+++ b/pkgs/by-name/li/libgbinder/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "libgbinder";
-  version = "1.1.42";
+  version = "1.1.43";
 
   src = fetchFromGitHub {
     owner = "mer-hybris";
     repo = "libgbinder";
     rev = version;
-    sha256 = "sha256-f5yfAmCpjI4T0XKBiGPQ3JWLuYg+SlrQwYeY/HIrycY=";
+    sha256 = "sha256-a4lQzWOVdlXQeoJzvNaELiVXLvXsx4reigKrhsrcafM=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/li/libgen-cli/package.nix b/pkgs/by-name/li/libgen-cli/package.nix
index 7b7963093a5f..14c76402e3ae 100644
--- a/pkgs/by-name/li/libgen-cli/package.nix
+++ b/pkgs/by-name/li/libgen-cli/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -29,7 +30,7 @@ buildGoModule rec {
     "-w"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd libgen-cli \
       --bash <($out/bin/libgen-cli completion bash) \
       --fish <($out/bin/libgen-cli completion fish) \
diff --git a/pkgs/by-name/li/libgnunetchat/package.nix b/pkgs/by-name/li/libgnunetchat/package.nix
index f5803786bb60..01b94d9b6719 100644
--- a/pkgs/by-name/li/libgnunetchat/package.nix
+++ b/pkgs/by-name/li/libgnunetchat/package.nix
@@ -16,12 +16,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   name = "libgnunetchat";
-  version = "0.5.3";
+  version = "0.6.0";
 
   src = fetchgit {
     url = "https://git.gnunet.org/libgnunetchat.git";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DhXPYa8ya9cEbwa4btQTrpjfoTGhzBInWXXH4gmDAQw=";
+    hash = "sha256-pRO8i7tHynCqm97RLMBOiWKCl2CAYBE6RXfyIljIiQ0=";
   };
 
   strictDeps = true;
@@ -51,6 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkgConfigModules = [ "gnunetchat" ];
     description = "Library for secure, decentralized chat using GNUnet network services";
     homepage = "https://git.gnunet.org/libgnunetchat.git";
+    changelog = "https://git.gnunet.org/libgnunetchat.git/plain/ChangeLog?h=v${finalAttrs.version}";
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.all;
     teams = with lib.teams; [ ngi ];
diff --git a/pkgs/by-name/li/lightway/package.nix b/pkgs/by-name/li/lightway/package.nix
index 051d056855e6..0bf4c6a92840 100644
--- a/pkgs/by-name/li/lightway/package.nix
+++ b/pkgs/by-name/li/lightway/package.nix
@@ -10,17 +10,16 @@
 
 rustPlatform.buildRustPackage {
   pname = "lightway";
-  version = "0-unstable-2025-09-04";
+  version = "0-unstable-2025-09-19";
 
   src = fetchFromGitHub {
     owner = "expressvpn";
     repo = "lightway";
-    rev = "4eb836158607c83d47226703de5a043519586782";
-    hash = "sha256-sNhTdJTxNxHMVswyzizgBfGbmJhYmMZY/5nVD7ScLjM=";
+    rev = "dac72eb8af0994de020d71d24114717ecfb9804d";
+    hash = "sha256-oHxHJ4D/Xg/zAFiI0bMX3Dc05HXIjk+ZHuGY03cwY+c=";
   };
 
-  cargoHash = "sha256-3/6yEyGntyxxCqrMy2M9dtV2pWiD4M0Rtnb52I4n9nU=";
-  cargoDepsName = "lightway";
+  cargoHash = "sha256-RFlac10XFJXT3Giayy31kZ3Nn1Q+YsPt/zCdkSV0Atk=";
 
   cargoBuildFlags = lib.cli.toGNUCommandLine { } {
     package = [
@@ -33,9 +32,10 @@ rustPlatform.buildRustPackage {
     ];
   };
 
-  # Some tests rely on debug_assert! and fail in release.
-  # https://github.com/expressvpn/lightway/issues/274
-  checkType = "debug";
+  # Enable ARM crypto extensions, overrides the default stdenv.hostPlatform.gcc.arch.
+  env.NIX_CFLAGS_COMPILE =
+    with stdenv.hostPlatform;
+    lib.optionalString (isAarch && isLinux) "-march=${gcc.arch}+crypto";
 
   # For wolfSSL.
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/lint-staged/package.nix b/pkgs/by-name/li/lint-staged/package.nix
index f5f734100a7f..a14401cebd34 100644
--- a/pkgs/by-name/li/lint-staged/package.nix
+++ b/pkgs/by-name/li/lint-staged/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "lint-staged";
-  version = "16.1.6";
+  version = "16.2.0";
 
   src = fetchFromGitHub {
     owner = "okonet";
     repo = "lint-staged";
     rev = "v${version}";
-    hash = "sha256-P8VFFeYVuMjAQD9whLmuHvD/tOVT2m7QKCm5X/5me0Q=";
+    hash = "sha256-liStGx9Tjcwv1csgPepzT0bDSew8AlpywT+YT38B/Fk=";
   };
 
-  npmDepsHash = "sha256-TdmQ3Eg86LC3pcGy779c8IcyMWcS7RU0fqkzG3OaABY=";
+  npmDepsHash = "sha256-5ZVyYzSw5lJZdTVHyR9C4mZa+Nx9yoTmpPRkMsf/b5w=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/li/linyaps-box/package.nix b/pkgs/by-name/li/linyaps-box/package.nix
new file mode 100644
index 000000000000..b46024969459
--- /dev/null
+++ b/pkgs/by-name/li/linyaps-box/package.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  cli11,
+  gtest,
+  libcap,
+  libseccomp,
+  nlohmann_json,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "linyaps-box";
+  version = "2.1.0";
+
+  src = fetchFromGitHub {
+    owner = "OpenAtom-Linyaps";
+    repo = "linyaps-box";
+    rev = finalAttrs.version;
+    hash = "sha256-Pdhb7dwAabDfhxmEifZblxEi9F4OUIDPx1X07f2AwPE=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    cli11
+    gtest
+    libcap
+    libseccomp
+    nlohmann_json
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "linyaps-box_ENABLE_SECCOMP" true)
+  ];
+
+  meta = {
+    description = "Simple OCI runtime mainly used by linyaps";
+    homepage = "https://github.com/OpenAtom-Linyaps/linyaps-box";
+    license = lib.licenses.lgpl3Plus;
+    platforms = lib.platforms.linux;
+    mainProgram = "ll-box";
+    maintainers = with lib.maintainers; [ wineee ];
+  };
+})
diff --git a/pkgs/by-name/li/linyaps/fix-host-path.patch b/pkgs/by-name/li/linyaps/fix-host-path.patch
new file mode 100644
index 000000000000..3e9227c2465d
--- /dev/null
+++ b/pkgs/by-name/li/linyaps/fix-host-path.patch
@@ -0,0 +1,91 @@
+diff --git a/libs/oci-cfg-generators/src/linglong/oci-cfg-generators/container_cfg_builder.cpp b/libs/oci-cfg-generators/src/linglong/oci-cfg-generators/container_cfg_builder.cpp
+index 787e70cb..a71df46a 100644
+--- a/libs/oci-cfg-generators/src/linglong/oci-cfg-generators/container_cfg_builder.cpp
++++ b/libs/oci-cfg-generators/src/linglong/oci-cfg-generators/container_cfg_builder.cpp
+@@ -19,6 +19,8 @@
+ #include <iomanip>
+ #include <iostream>
+ #include <vector>
++#include <unordered_map>
++#include <unordered_set>
+ 
+ #include <sys/stat.h>
+ #include <sys/types.h>
+@@ -432,19 +434,67 @@ ContainerCfgBuilder &ContainerCfgBuilder::bindHostRoot() noexcept
+ 
+ ContainerCfgBuilder &ContainerCfgBuilder::bindHostStatics() noexcept
+ {
+-    std::vector<std::filesystem::path> statics{
+-        "/etc/machine-id",
+-        // FIXME: support for host /etc/ssl, ref https://github.com/p11-glue/p11-kit
+-        "/usr/lib/locale",
+-        "/usr/share/fonts",
+-        "/usr/share/icons",
+-        "/usr/share/themes",
+-        "/var/cache/fontconfig",
++    std::unordered_map<std::filesystem::path, std::string> statics{
++        { "/etc/machine-id", "" },
++        { "/usr/lib/locale", "" },
++        { "/var/cache/fontconfig", "" },
++
++        { "/run/current-system/sw/share/X11/fonts", "/usr/share/fonts" },
++        { "/run/current-system/sw/share/icons", "/usr/share/icons" },
++        { "/run/current-system/sw/share/themes", "/usr/share/themes" },
+     };
+ 
+     hostStaticsMount = std::vector<Mount>{};
+-    for (const auto &loc : statics) {
+-        bindIfExist(*hostStaticsMount, loc);
++    auto nixStorePaths = std::unordered_set<std::string>{};
++    for (const auto &[source, destination] : statics) {
++        if (!std::filesystem::exists(source)) {
++            std::cerr << "[bindHostStatics] Skipping non-existent path: " << source << std::endl;
++            continue;
++        }
++
++        bindIfExist(*hostStaticsMount, source, destination);
++
++        std::string sourcePathPrefix = "/run/current-system/sw/share/";
++        std::string nixStorePrefix = "/nix/store/";
++
++        if (source.string().rfind(sourcePathPrefix, 0) != 0)
++            continue;
++
++        std::error_code ec;
++        for (const std::filesystem::directory_entry &dir_entry :
++             std::filesystem::recursive_directory_iterator(source, std::filesystem::directory_options::skip_permission_denied, ec)) 
++        {
++            if (ec) {
++                std::cerr << "[bindHostStatics] Failed to iterate directory: " << source << ", error: " << ec.message() << std::endl;
++                break;
++            }
++
++            if (!dir_entry.is_symlink(ec) || ec) {
++                if (ec)
++                    std::cerr << "[bindHostStatics] Failed to check symlink: " << dir_entry.path() << ", error: " << ec.message() << std::endl;
++                continue;
++            }
++
++            std::filesystem::path targetPath = std::filesystem::canonical(dir_entry.path(), ec);
++            if (ec) {
++                std::cerr << "[bindHostStatics] Failed to resolve symlink: " << dir_entry.path() << ", error: " << ec.message() << std::endl;
++                continue;
++            }
++
++            std::string target = targetPath.string();
++            if (target.rfind(nixStorePrefix, 0) != 0)
++                continue;
++
++            auto endPos = target.find('/', nixStorePrefix.length());
++            if (endPos != std::string::npos)
++                nixStorePaths.insert(target.substr(0, endPos));
++            else
++                nixStorePaths.insert(target);
++        }
++    }
++
++    for (const std::string &path : nixStorePaths) {
++        bindIfExist(*hostStaticsMount, path);
+     }
+ 
+     return *this;
diff --git a/pkgs/by-name/li/linyaps/package.nix b/pkgs/by-name/li/linyaps/package.nix
new file mode 100644
index 000000000000..8b074a698319
--- /dev/null
+++ b/pkgs/by-name/li/linyaps/package.nix
@@ -0,0 +1,144 @@
+{
+  fetchFromGitHub,
+  fetchpatch,
+  lib,
+  stdenv,
+  cmake,
+  copyDesktopItems,
+  pkg-config,
+  qt6Packages,
+  linyaps-box,
+  cli11,
+  curl,
+  gpgme,
+  gtest,
+  libarchive,
+  libelf,
+  libsodium,
+  libsysprof-capture,
+  nlohmann_json,
+  openssl,
+  ostree,
+  systemdLibs,
+  tl-expected,
+  uncrustify,
+  xz,
+  yaml-cpp,
+  replaceVars,
+  bash,
+  binutils,
+  coreutils,
+  desktop-file-utils,
+  erofs-utils,
+  fuse3,
+  fuse-overlayfs,
+  gnutar,
+  glib,
+  shared-mime-info,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "linyaps";
+  version = "1.9.12";
+
+  src = fetchFromGitHub {
+    owner = "OpenAtom-Linyaps";
+    repo = finalAttrs.pname;
+    tag = finalAttrs.version;
+    hash = "sha256-BNP/CenPXMuEixEleil9zB08qLn/SZ9Ur/Im4MQy5nE=";
+  };
+
+  patches = [
+    ./fix-host-path.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace apps/ll-init/CMakeLists.txt \
+      --replace-fail "target_link_options(\''${LL_INIT_TARGET} PRIVATE -static -static-libgcc" \
+                     "target_link_options(\''${LL_INIT_TARGET} PRIVATE -static -static-libgcc -L${stdenv.cc.libc.static}/lib"
+
+    substituteInPlace misc/share/applications/linyaps.desktop \
+      --replace-fail "/usr/bin/ll-cli" "$out/bin/ll-cli"
+
+    # Don't use hardcoded paths in the application's desktop file, as it would become invalid when the old linyaps gets removed.
+    substituteInPlace libs/linglong/src/linglong/repo/ostree_repo.cpp \
+      --replace-fail 'LINGLONG_CLIENT_PATH' 'LINGLONG_CLIENT_NAME'
+  '';
+
+  buildInputs = [
+    cli11
+    curl
+    gpgme
+    gtest
+    libarchive
+    libelf
+    libsodium
+    libsysprof-capture
+    nlohmann_json
+    openssl
+    ostree
+    qt6Packages.qtbase
+    systemdLibs
+    tl-expected
+    uncrustify
+    xz
+    yaml-cpp
+  ];
+
+  nativeBuildInputs = [
+    cmake
+    copyDesktopItems
+    pkg-config
+    qt6Packages.wrapQtAppsNoGuiHook
+  ];
+
+  postInstall = ''
+    # move to the right location for systemd.packages option
+    # https://github.com/NixOS/nixpkgs/blob/85dbfc7aaf52ecb755f87e577ddbe6dbbdbc1054/nixos/modules/system/boot/systemd.nix#L605
+    mv $out/lib/systemd/system-environment-generators $out/lib/systemd/system-generators
+  '';
+
+  # Disable automatic Qt wrapping to handle it manually
+  dontWrapQtApps = true;
+
+  # Add runtime dependencies to PATH for all wrapped binaries
+  qtWrapperArgs = [
+    "--prefix PATH : ${
+      lib.makeBinPath [
+        bash
+        binutils
+        coreutils
+        desktop-file-utils
+        erofs-utils
+        fuse3
+        fuse-overlayfs
+        glib
+        gnutar
+        shared-mime-info
+        linyaps-box
+      ]
+    }"
+  ];
+
+  # Note: ll-init must be statically linked and should not be wrapped
+  postFixup = ''
+    # Wrap all executables except ll-init
+    find "$out" -type f -executable \
+      \( -path "$out/bin/*" -o -path "$out/libexec/*" \) \
+      ! -name "ll-init" \
+      -print0 | while IFS= read -r -d "" f; do
+      wrapQtApp "$f"
+    done
+  '';
+
+  meta = {
+    description = "Cross-distribution package manager with sandboxed apps and shared runtime";
+    homepage = "https://linyaps.org.cn";
+    downloadPage = "https://github.com/OpenAtom-Linyaps/linyaps";
+    changelog = "https://github.com/OpenAtom-Linyaps/linyaps/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.lgpl3Plus;
+    platforms = lib.platforms.linux;
+    mainProgram = "ll-cli";
+    maintainers = with lib.maintainers; [ wineee ];
+  };
+})
diff --git a/pkgs/by-name/li/litmusctl/package.nix b/pkgs/by-name/li/litmusctl/package.nix
index f35e4dde3579..34ffa1757d9f 100644
--- a/pkgs/by-name/li/litmusctl/package.nix
+++ b/pkgs/by-name/li/litmusctl/package.nix
@@ -4,6 +4,7 @@
   installShellFiles,
   kubectl,
   lib,
+  stdenv,
 }:
 
 buildGoModule rec {
@@ -27,7 +28,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-7FYOQ89aUFPX+5NCPYKg+YGCXstQ6j9DK4V2mCgklu0=";
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd litmusctl \
       --bash <($out/bin/litmusctl completion bash) \
       --fish <($out/bin/litmusctl completion fish) \
diff --git a/pkgs/by-name/ll/lla/package.nix b/pkgs/by-name/ll/lla/package.nix
index 7543c7704f36..5176cb4f8354 100644
--- a/pkgs/by-name/ll/lla/package.nix
+++ b/pkgs/by-name/ll/lla/package.nix
@@ -8,7 +8,7 @@
   nix-update-script,
 }:
 let
-  version = "0.4.0";
+  version = "0.4.2";
 in
 rustPlatform.buildRustPackage {
   pname = "lla";
@@ -18,7 +18,7 @@ rustPlatform.buildRustPackage {
     owner = "chaqchase";
     repo = "lla";
     tag = "v${version}";
-    hash = "sha256-ArkmjnMRTwnIMy2UNM+GsdZJIvWa4RRZ3n//Gm3k9s4=";
+    hash = "sha256-7/VfEcqvYGC1Pw9wJh5FF3c7BXgcg9LVDvcr4zCrros=";
   };
 
   nativeBuildInputs = [
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage {
     installShellFiles
   ];
 
-  cargoHash = "sha256-vw5cckGZjN6B7X7Pm/mZzWnSjRVYkgl58txv6Asqoug=";
+  cargoHash = "sha256-LYRNXNhPgpNZWP5XKqfgM6t9Ts2k/e09iXWMcuEp9LA=";
 
   cargoBuildFlags = [ "--workspace" ];
 
diff --git a/pkgs/by-name/ma/mackerel-agent/package.nix b/pkgs/by-name/ma/mackerel-agent/package.nix
index fb38a764e41a..111b2b956b0c 100644
--- a/pkgs/by-name/ma/mackerel-agent/package.nix
+++ b/pkgs/by-name/ma/mackerel-agent/package.nix
@@ -10,20 +10,20 @@
 
 buildGoModule rec {
   pname = "mackerel-agent";
-  version = "0.85.0";
+  version = "0.85.1";
 
   src = fetchFromGitHub {
     owner = "mackerelio";
     repo = "mackerel-agent";
     rev = "v${version}";
-    sha256 = "sha256-wTL+zxa0uaRT8cP2P+iYW6qC8RS5g8wSpvsa01iSUXA=";
+    sha256 = "sha256-ngBBpvDk5HsMNoZy45mlEBn3dgG8j1b98tShdR6QmQQ=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
   nativeCheckInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [ net-tools ];
   buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [ iproute2 ];
 
-  vendorHash = "sha256-Q3HsfLA6xqzwXVfRc0bOb15kW2tdwj14DvJEZoRy0/4=";
+  vendorHash = "sha256-Ubk/ms/3FwH1ZqZ5uTy0MubXhrKBoeaC85Y1KKH5cIw=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/ma/madonctl/package.nix b/pkgs/by-name/ma/madonctl/package.nix
index adc4acc4c3c5..d95fa7e6a624 100644
--- a/pkgs/by-name/ma/madonctl/package.nix
+++ b/pkgs/by-name/ma/madonctl/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -27,7 +28,7 @@ buildGoModule rec {
     "-w"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd madonctl \
       --bash <($out/bin/madonctl completion bash) \
       --zsh <($out/bin/madonctl completion zsh)
diff --git a/pkgs/by-name/me/melange/package.nix b/pkgs/by-name/me/melange/package.nix
index c97962bfed1b..777665570211 100644
--- a/pkgs/by-name/me/melange/package.nix
+++ b/pkgs/by-name/me/melange/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -45,7 +46,7 @@ buildGoModule rec {
     ldflags+=" -X sigs.k8s.io/release-utils/version.buildDate=$(cat SOURCE_DATE_EPOCH)"
   '';
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd melange \
       --bash <($out/bin/melange completion bash) \
       --fish <($out/bin/melange completion fish) \
diff --git a/pkgs/by-name/me/metal-cli/package.nix b/pkgs/by-name/me/metal-cli/package.nix
index 0d9ce2cc7a72..968abd246781 100644
--- a/pkgs/by-name/me/metal-cli/package.nix
+++ b/pkgs/by-name/me/metal-cli/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -29,7 +30,7 @@ buildGoModule (finalAttrs: {
     installShellFiles
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd metal \
       --bash <($out/bin/metal completion bash) \
       --fish <($out/bin/metal completion fish) \
diff --git a/pkgs/by-name/mi/millipixels/package.nix b/pkgs/by-name/mi/millipixels/package.nix
index 2022d8e50bcc..96fb56df4d1a 100644
--- a/pkgs/by-name/mi/millipixels/package.nix
+++ b/pkgs/by-name/mi/millipixels/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitLab,
   fetchpatch,
+  gitUpdater,
   glib,
   meson,
   ninja,
@@ -25,14 +26,14 @@
 
 stdenv.mkDerivation rec {
   pname = "millipixels";
-  version = "0.22.0";
+  version = "0.23.0";
 
   src = fetchFromGitLab {
     owner = "Librem5";
     repo = "millipixels";
     rev = "v${version}";
     domain = "source.puri.sm";
-    hash = "sha256-pRREQRYyD9+dpRvcfsNiNthFy08Yeup9xDn+x+RWDrE=";
+    hash = "sha256-Sj14t6LeZWNONcgrwJxN4J1/85m1SLgmmcRnHQUULHI=";
   };
   patches = [
     # fix for https://source.puri.sm/Librem5/millipixels/-/issues/87, can be removed with the next release (if there ever will be one)
@@ -74,6 +75,10 @@ stdenv.mkDerivation rec {
       }
   '';
 
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "v";
+  };
+
   meta = with lib; {
     description = "Camera application for the Librem 5";
     homepage = "https://source.puri.sm/Librem5/millipixels";
diff --git a/pkgs/by-name/mi/mim-solvers/package.nix b/pkgs/by-name/mi/mim-solvers/package.nix
index 9df420c765d9..46d62d1a8677 100644
--- a/pkgs/by-name/mi/mim-solvers/package.nix
+++ b/pkgs/by-name/mi/mim-solvers/package.nix
@@ -9,17 +9,18 @@
   python3Packages,
   pythonSupport ? false,
   stdenv,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mim-solvers";
-  version = "0.1.0";
+  version = "0.1.1";
 
   src = fetchFromGitHub {
     owner = "machines-in-motion";
     repo = "mim_solvers";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-jUL/kyXKODpcCURG7e7/qNarvwm4+EnzZRL2Wix5Jbs=";
+    hash = "sha256-1Mqu9Hfy65HUIOVG/gJBpSMlOwDWVcH+LrR8CaWz0BE=";
   };
 
   # eigenpy is not used without python support
@@ -61,6 +62,8 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = true;
   pythonImportsCheck = [ "mim_solvers" ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Numerical solvers used in the Machines in Motion Laboratory";
     homepage = "https://github.com/machines-in-motion/mim_solvers";
diff --git a/pkgs/by-name/mk/mktxp/package.nix b/pkgs/by-name/mk/mktxp/package.nix
index 5e30eb9c51aa..9a6dd83f98a6 100644
--- a/pkgs/by-name/mk/mktxp/package.nix
+++ b/pkgs/by-name/mk/mktxp/package.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
 }:
 let
-  version = "1.2.12";
+  version = "1.2.14";
 in
 python3Packages.buildPythonApplication {
   pname = "mktxp";
@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication {
     owner = "akpw";
     repo = "mktxp";
     tag = "v${version}";
-    hash = "sha256-2aSRnfhOROFJWzqvltYaN2FLXrRjICV56SOOHf4wKtg=";
+    hash = "sha256-4+0aw/r71FcVrxASco3AkYzi7zbFeiEkJB7acGdb1FQ=";
   };
 
   nativeBuildInputs = with python3Packages; [
diff --git a/pkgs/by-name/my/myks/package.nix b/pkgs/by-name/my/myks/package.nix
index 90785c4a01bb..28a8a91d702b 100644
--- a/pkgs/by-name/my/myks/package.nix
+++ b/pkgs/by-name/my/myks/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "myks";
-  version = "4.11.3";
+  version = "4.11.4";
 
   src = fetchFromGitHub {
     owner = "mykso";
     repo = "myks";
     tag = "v${version}";
-    hash = "sha256-NIcKYlirX110QHB5r8m3g2dZbWyImiFoFQZW0ig5shE=";
+    hash = "sha256-1tJPYLo14LPwd7mtNTvr6YMGz0s+K6aN9Hung/N9lrM=";
   };
 
-  vendorHash = "sha256-Tiz9SmEKet2vp8toJrUaby1Jhsh+023bi1NC+WzOrX0=";
+  vendorHash = "sha256-k/EeQdThF8pgeY9RI012kjlEZkVVcnanL6L8UBrQTUI=";
 
   subPackages = ".";
 
diff --git a/pkgs/by-name/na/nats-server/package.nix b/pkgs/by-name/na/nats-server/package.nix
index 7942ca0f184a..524c40644aa0 100644
--- a/pkgs/by-name/na/nats-server/package.nix
+++ b/pkgs/by-name/na/nats-server/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "nats-server";
-  version = "2.11.9";
+  version = "2.12.0";
 
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = "nats-server";
     rev = "v${version}";
-    hash = "sha256-F35qklJRa9IUikVNhh8c34KF3l41yfPXl0aig1iQq1g=";
+    hash = "sha256-Ln4e58jIrZZRbgf1+b28sNT1hyNSZepH5oo71OWVFII=";
   };
 
-  vendorHash = "sha256-ti2Y4ev8INMNudfwmPhmKGCManRj2cFTw6Fh7kkvDQc=";
+  vendorHash = "sha256-533w30v681ZYOEL+gCkF7XOXsUmW1DV2+Eukgd/OcxE=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/ne/networkmanager-fortisslvpn/package.nix b/pkgs/by-name/ne/networkmanager-fortisslvpn/package.nix
index dbc2551ad2fe..c03e224044a2 100644
--- a/pkgs/by-name/ne/networkmanager-fortisslvpn/package.nix
+++ b/pkgs/by-name/ne/networkmanager-fortisslvpn/package.nix
@@ -35,6 +35,7 @@ stdenv.mkDerivation rec {
       inherit openfortivpn;
     })
     ./support-ppp-2.5.0.patch
+    ./pppd-accept-remote.patch
   ];
 
   strictDeps = true;
diff --git a/pkgs/by-name/ne/networkmanager-fortisslvpn/pppd-accept-remote.patch b/pkgs/by-name/ne/networkmanager-fortisslvpn/pppd-accept-remote.patch
new file mode 100644
index 000000000000..29eb016e2930
--- /dev/null
+++ b/pkgs/by-name/ne/networkmanager-fortisslvpn/pppd-accept-remote.patch
@@ -0,0 +1,32 @@
+From cea75ece3eaecb17922feda81a4ee81718536d1a Mon Sep 17 00:00:00 2001
+From: Mikhail Novosyolov <m.novosyolov@rosalinux.ru>
+Date: Fri, 14 Mar 2025 07:14:43 +0300
+Subject: [PATCH] Fix routing with pppd 2.5
+
+Tested on ROSA 13 with pppd-2.5.2 and openfortivpn-1.23.1.
+Without this change, routes are not set up correctly and connection does not work properly.
+
+Solution is from https://aur.archlinux.org/packages/networkmanager-fortisslvpn (see PKGBLUILD and comments).
+---
+ src/nm-fortisslvpn-service.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/src/nm-fortisslvpn-service.c b/src/nm-fortisslvpn-service.c
+index 8796ace..8f69333 100644
+--- a/src/nm-fortisslvpn-service.c
++++ b/src/nm-fortisslvpn-service.c
+@@ -225,7 +225,11 @@ run_openfortivpn (NMFortisslvpnPlugin *plugin, NMSettingVpn *s_vpn, GError **err
+ 	g_ptr_array_add (argv, (gpointer) g_strdup ("-c"));
+ 	g_ptr_array_add (argv, (gpointer) g_strdup (priv->config_file));
+ 
++#if WITH_PPP_VERSION >= PPP_VERSION(2,5,0)
++	g_ptr_array_add (argv, (gpointer) g_strdup ("--pppd-accept-remote"));
++#else
+ 	g_ptr_array_add (argv, (gpointer) g_strdup ("--no-routes"));
++#endif
+ 	g_ptr_array_add (argv, (gpointer) g_strdup ("--no-dns"));
+ 	ip4_config = nm_connection_get_setting_ip4_config (priv->connection);
+ 	if (!nm_setting_ip_config_get_ignore_auto_dns (ip4_config)) {
+-- 
+GitLab
+
diff --git a/pkgs/by-name/ne/nextcloud-client/package.nix b/pkgs/by-name/ne/nextcloud-client/package.nix
index b565c29ff149..44dcf47ce335 100644
--- a/pkgs/by-name/ne/nextcloud-client/package.nix
+++ b/pkgs/by-name/ne/nextcloud-client/package.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation rec {
   pname = "nextcloud-client";
-  version = "3.17.1";
+  version = "3.17.2";
 
   outputs = [
     "out"
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     owner = "nextcloud-releases";
     repo = "desktop";
     tag = "v${version}";
-    hash = "sha256-HXi3DDjOFLY9G+aK+QrkmLvLwL6s9lAT+8jVpG87eNM=";
+    hash = "sha256-jBlQh5tHP+2LyFCnP0m/ud3nU40i5cWtUwSeM5auQX8=";
   };
 
   patches = [
diff --git a/pkgs/by-name/nh/nhost-cli/package.nix b/pkgs/by-name/nh/nhost-cli/package.nix
index 0a5045fcb14b..dcdc9cd65158 100644
--- a/pkgs/by-name/nh/nhost-cli/package.nix
+++ b/pkgs/by-name/nh/nhost-cli/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "nhost-cli";
-  version = "1.31.1";
+  version = "1.31.2";
 
   src = fetchFromGitHub {
     owner = "nhost";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-UfcQh8jdnNKn5AMerh+J83yuTY/cX20/8UA0NoPBJ14=";
+    hash = "sha256-RzLnhnnEDUIlRq89/CmhH7+o4Mt6GiXbGXDObSIk4tY=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ni/nimbo/package.nix b/pkgs/by-name/ni/nimbo/package.nix
index b7bca401305c..f8209f815fe0 100644
--- a/pkgs/by-name/ni/nimbo/package.nix
+++ b/pkgs/by-name/ni/nimbo/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   python3,
   fetchFromGitHub,
   installShellFiles,
@@ -51,7 +52,7 @@ python3.pkgs.buildPythonApplication rec {
     (lib.makeBinPath [ awscli ])
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd nimbo \
       --zsh <(_NIMBO_COMPLETE=source_zsh $out/bin/nimbo) \
       --bash <(_NIMBO_COMPLETE=source_bash $out/bin/nimbo) \
diff --git a/pkgs/by-name/ni/nix-update/package.nix b/pkgs/by-name/ni/nix-update/package.nix
index 3c5600532d96..3d67a9329e63 100644
--- a/pkgs/by-name/ni/nix-update/package.nix
+++ b/pkgs/by-name/ni/nix-update/package.nix
@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "nix-update";
-  version = "1.13.0";
+  version = "1.13.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = "nix-update";
     tag = version;
-    hash = "sha256-+d4NexgDkpuiesuA6vOv2COD3bgWddIL1SjFxuDF1dA=";
+    hash = "sha256-b/Ymvz4Un67j7UulzBJtmKrwcchpEE/si/QOn/m8m80=";
   };
 
   build-system = [ python3Packages.setuptools ];
diff --git a/pkgs/by-name/ni/nixci/package.nix b/pkgs/by-name/ni/nixci/package.nix
index 7920028ffb9b..7dc93c622c88 100644
--- a/pkgs/by-name/ni/nixci/package.nix
+++ b/pkgs/by-name/ni/nixci/package.nix
@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage rec {
     openssl
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd nixci \
       --bash <($out/bin/nixci completion bash) \
       --fish <($out/bin/nixci completion fish) \
diff --git a/pkgs/by-name/no/notation/package.nix b/pkgs/by-name/no/notation/package.nix
index 48ec6c69596c..a91c39e25334 100644
--- a/pkgs/by-name/no/notation/package.nix
+++ b/pkgs/by-name/no/notation/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -33,7 +34,7 @@ buildGoModule (finalAttrs: {
     "-X github.com/notaryproject/notation/internal/version.BuildMetadata="
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd notation \
       --bash <($out/bin/notation completion bash) \
       --fish <($out/bin/notation completion fish) \
diff --git a/pkgs/by-name/no/novops/package.nix b/pkgs/by-name/no/novops/package.nix
index c65871799a01..e917f0cbd4b4 100644
--- a/pkgs/by-name/no/novops/package.nix
+++ b/pkgs/by-name/no/novops/package.nix
@@ -40,7 +40,7 @@ rustPlatform.buildRustPackage rec {
     "--lib"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd novops \
       --bash <($out/bin/novops completion bash) \
       --fish <($out/bin/novops completion fish) \
diff --git a/pkgs/by-name/nv/nvs/package.nix b/pkgs/by-name/nv/nvs/package.nix
index 6c180ea5b0e4..72b63d069382 100644
--- a/pkgs/by-name/nv/nvs/package.nix
+++ b/pkgs/by-name/nv/nvs/package.nix
@@ -1,4 +1,5 @@
 {
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -29,7 +30,7 @@ buildGoModule (finalAttrs: {
     installShellFiles
     writableTmpDirAsHomeHook
   ];
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd nvs \
       --bash <($out/bin/nvs completion bash) \
       --fish <($out/bin/nvs completion fish) \
diff --git a/pkgs/by-name/oc/ocm/package.nix b/pkgs/by-name/oc/ocm/package.nix
index b73ac4ffeb7f..1d903fe0c5d5 100644
--- a/pkgs/by-name/oc/ocm/package.nix
+++ b/pkgs/by-name/oc/ocm/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -38,7 +39,7 @@ buildGoModule rec {
     "-skip=^TestCLI$"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd ocm \
       --bash <($out/bin/ocm completion bash) \
       --fish <($out/bin/ocm completion fish) \
diff --git a/pkgs/by-name/ok/okteto/package.nix b/pkgs/by-name/ok/okteto/package.nix
index 611752b98fa7..7590f87bfe14 100644
--- a/pkgs/by-name/ok/okteto/package.nix
+++ b/pkgs/by-name/ok/okteto/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -65,7 +66,7 @@ buildGoModule (finalAttrs: {
     in
     [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd okteto \
       --bash <($out/bin/okteto completion bash) \
       --fish <($out/bin/okteto completion fish) \
diff --git a/pkgs/by-name/ol/olympus/package.nix b/pkgs/by-name/ol/olympus/package.nix
index 26943f05636a..e99638848be2 100644
--- a/pkgs/by-name/ol/olympus/package.nix
+++ b/pkgs/by-name/ol/olympus/package.nix
@@ -18,6 +18,7 @@
   loennWrapper ? null,
   miniinstallerWrapper ? null,
   skipHandlerCheck ? false, # whether to skip olympus xdg-mime check, true will override it
+  finderHints ? [ ],
 }:
 let
 
@@ -49,6 +50,12 @@ let
     else
       (wrapper-to-env miniinstallerWrapper);
 
+  finderHints' =
+    if lib.isList finderHints then
+      lib.concatMapStringsSep ":" (hint: "${hint}") finderHints
+    else
+      "${finderHints}";
+
 in
 symlinkJoin {
 
@@ -66,6 +73,7 @@ symlinkJoin {
       --set-default OLYMPUS_CELESTE_WRAPPER "${wrapper-to-env celesteWrapper}" \
       --set-default OLYMPUS_LOENN_WRAPPER "${wrapper-to-env loennWrapper}"  \
       --set-default OLYMPUS_MINIINSTALLER_WRAPPER "${miniinstaller-wrapper}" \
-      --set-default OLYMPUS_SKIP_SCHEME_HANDLER_CHECK "${if skipHandlerCheck then "1" else "0"}"
+      --set-default OLYMPUS_SKIP_SCHEME_HANDLER_CHECK "${if skipHandlerCheck then "1" else "0"}" \
+      --suffix OLYMPUS_FINDER_HINTS : "${finderHints'}"
   '';
 }
diff --git a/pkgs/by-name/om/omnictl/package.nix b/pkgs/by-name/om/omnictl/package.nix
index 50b205d414dc..f4f85728b646 100644
--- a/pkgs/by-name/om/omnictl/package.nix
+++ b/pkgs/by-name/om/omnictl/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -7,16 +8,16 @@
 
 buildGoModule rec {
   pname = "omnictl";
-  version = "1.0.1";
+  version = "1.1.4";
 
   src = fetchFromGitHub {
     owner = "siderolabs";
     repo = "omni";
     rev = "v${version}";
-    hash = "sha256-T7sX3mIZl361tyG0q/diMakRFAMi7wtiJLfv5VeVHSg=";
+    hash = "sha256-wPatXY9hl1YEzEQyvn+As2MBssCXFJCfNbYlwwdgGR0=";
   };
 
-  vendorHash = "sha256-MdWEMUAAUH4cEyKnANLax05h6ZuhBIXEvOnJ1qOxvWE=";
+  vendorHash = "sha256-9BzR5ZjSoaPYxMhweNaOalFsvX5BM4EVX8HAR17Xzoc=";
 
   ldflags = [
     "-s"
@@ -29,7 +30,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd omnictl \
       --bash <($out/bin/omnictl completion bash) \
       --fish <($out/bin/omnictl completion fish) \
diff --git a/pkgs/by-name/op/open-policy-agent/package.nix b/pkgs/by-name/op/open-policy-agent/package.nix
index 6b72eced3727..f9b75016e61f 100644
--- a/pkgs/by-name/op/open-policy-agent/package.nix
+++ b/pkgs/by-name/op/open-policy-agent/package.nix
@@ -91,7 +91,7 @@ buildGoModule (finalAttrs: {
       rm v1/server/server_bench_test.go
     '';
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd opa \
       --bash <($out/bin/opa completion bash) \
       --fish <($out/bin/opa completion fish) \
diff --git a/pkgs/by-name/op/open-webui/package.nix b/pkgs/by-name/op/open-webui/package.nix
index 170949f1ee6c..903aeba2c55b 100644
--- a/pkgs/by-name/op/open-webui/package.nix
+++ b/pkgs/by-name/op/open-webui/package.nix
@@ -9,13 +9,13 @@
 }:
 let
   pname = "open-webui";
-  version = "0.6.28";
+  version = "0.6.30";
 
   src = fetchFromGitHub {
     owner = "open-webui";
     repo = "open-webui";
     tag = "v${version}";
-    hash = "sha256-677M1IxWhdJ3AO8DPlW4eUYnOo/mCNu+11IPdaey9ks=";
+    hash = "sha256-0gQlzqHFVcayN1/Z5Ou1Gv1+VQMMwk7QrvVXV92EFp0=";
   };
 
   frontend = buildNpmPackage rec {
@@ -32,7 +32,7 @@ let
       url = "https://github.com/pyodide/pyodide/releases/download/${pyodideVersion}/pyodide-${pyodideVersion}.tar.bz2";
     };
 
-    npmDepsHash = "sha256-vsgdf7+h16VBF+bTxzdNeHNzsYV65KWNZ6Ga3N7fB5A=";
+    npmDepsHash = "sha256-AYChUMU8vLNaJPfIbX1SThx01uV3V6QpN6OjYrerg5U=";
 
     # See https://github.com/open-webui/open-webui/issues/15880
     npmFlags = [
@@ -107,12 +107,10 @@ python3Packages.buildPythonApplication rec {
       black
       boto3
       chromadb
-      colbert-ai
       cryptography
       ddgs
       docx2txt
       einops
-      elasticsearch
       extract-msg
       fake-useragent
       fastapi
@@ -159,15 +157,12 @@ python3Packages.buildPythonApplication rec {
       peewee-migrate
       pgvector
       pillow
-      pinecone-client
-      playwright
       psutil
       pyarrow
       pycrdt
       pydub
       pyjwt
       pymdown-extensions
-      pymilvus
       pymysql
       pypandoc
       pypdf
@@ -178,7 +173,6 @@ python3Packages.buildPythonApplication rec {
       python-socketio
       pytube
       pyxlsb
-      qdrant-client
       rank-bm25
       rapidocr-onnxruntime
       redis
@@ -206,9 +200,16 @@ python3Packages.buildPythonApplication rec {
     ];
 
     all = [
+      colbert-ai
+      elasticsearch
       moto
       gcp-storage-emulator
+      playwright
+      oracledb
+      pinecone-client
+      pymilvus
       pymongo
+      qdrant-client
     ]
     ++ moto.optional-dependencies.s3
     ++ postgres;
diff --git a/pkgs/by-name/op/openapi-python-client/package.nix b/pkgs/by-name/op/openapi-python-client/package.nix
index 7059d96824dd..4a2c89679066 100644
--- a/pkgs/by-name/op/openapi-python-client/package.nix
+++ b/pkgs/by-name/op/openapi-python-client/package.nix
@@ -52,7 +52,7 @@ python3Packages.buildPythonApplication rec {
   # just a simple wrapper to locate the binary. We'll remove the upper bound
   pythonRelaxDeps = [ "ruff" ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     # see: https://github.com/fastapi/typer/blob/5889cf82f4ed925f92e6b0750bf1b1ed9ee672f3/typer/completion.py#L54
     # otherwise shellingham throws exception on darwin
     export _TYPER_COMPLETE_TEST_DISABLE_SHELL_DETECTION=1
diff --git a/pkgs/by-name/op/opencloud/package.nix b/pkgs/by-name/op/opencloud/package.nix
index 135cdb17a45b..95ed0bf4adb9 100644
--- a/pkgs/by-name/op/opencloud/package.nix
+++ b/pkgs/by-name/op/opencloud/package.nix
@@ -28,13 +28,13 @@ let
 in
 buildGoModule rec {
   pname = "opencloud";
-  version = "3.4.0";
+  version = "3.5.0";
 
   src = fetchFromGitHub {
     owner = "opencloud-eu";
     repo = "opencloud";
     tag = "v${version}";
-    hash = "sha256-uoGgsz0BUUVuSEZrTX8b294FbVqL2YPFg7JoyRpH8Do=";
+    hash = "sha256-NPBz9pevjDUqDrEg/S6Vtk+jAA9f2H95ehO8EgcB1eY=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/op/opencloud/web.nix b/pkgs/by-name/op/opencloud/web.nix
index ab788789ac6a..dd47943591d9 100644
--- a/pkgs/by-name/op/opencloud/web.nix
+++ b/pkgs/by-name/op/opencloud/web.nix
@@ -9,19 +9,19 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencloud-web";
-  version = "3.3.0";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "opencloud-eu";
     repo = "web";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QBIAy3S8pss6NhN7V+AovWMoYZmu0cHbi6E7lUugYzU=";
+    hash = "sha256-IMFbDPVn32offVIHHxQvHjauQLGYnFf/s1mAo6OF7Mk=";
   };
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 1;
-    hash = "sha256-KYSjgDrl/IC+xi/GN+DqB0H6q0HWT7sjzGk/YvfTmHA=";
+    hash = "sha256-CHImAISDPhjfhB+Qj3fuo6jaOyi+wBVwuLm8ODzRU4M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/op/opengrok/package.nix b/pkgs/by-name/op/opengrok/package.nix
index 730efd65593f..f25fb15d8ecb 100644
--- a/pkgs/by-name/op/opengrok/package.nix
+++ b/pkgs/by-name/op/opengrok/package.nix
@@ -8,12 +8,12 @@
 
 stdenv.mkDerivation rec {
   pname = "opengrok";
-  version = "1.14.2";
+  version = "1.14.3";
 
   # binary distribution
   src = fetchurl {
     url = "https://github.com/oracle/opengrok/releases/download/${version}/${pname}-${version}.tar.gz";
-    hash = "sha256-zn+w/k5Q5/73sOdmWivZKpjoXUjZDXhrCDU9gSYu8Nk=";
+    hash = "sha256-+7jLmvsEFxL4HcxuXQjgvMg/YiUtsrrnvjN0CY4pTJw=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/op/opensearch-cli/package.nix b/pkgs/by-name/op/opensearch-cli/package.nix
index 082905811338..827c5bb224b2 100644
--- a/pkgs/by-name/op/opensearch-cli/package.nix
+++ b/pkgs/by-name/op/opensearch-cli/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -19,7 +20,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     export HOME="$(mktemp -d)"
     installShellCompletion --cmd opensearch-cli \
       --bash <($out/bin/opensearch-cli completion bash) \
diff --git a/pkgs/by-name/op/optinix/package.nix b/pkgs/by-name/op/optinix/package.nix
index 21a69da48689..ea20a86f16af 100644
--- a/pkgs/by-name/op/optinix/package.nix
+++ b/pkgs/by-name/op/optinix/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   fetchFromGitLab,
   buildGoModule,
   installShellFiles,
@@ -20,7 +21,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd optinix \
       --bash <($out/bin/optinix completion bash) \
       --fish <($out/bin/optinix completion fish) \
diff --git a/pkgs/by-name/or/oras/package.nix b/pkgs/by-name/or/oras/package.nix
index b36d833f79b5..24fd4f11554b 100644
--- a/pkgs/by-name/or/oras/package.nix
+++ b/pkgs/by-name/or/oras/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -31,7 +32,7 @@ buildGoModule (finalAttrs: {
     "-X oras.land/oras/internal/version.GitTreeState=clean"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd oras \
       --bash <($out/bin/oras completion bash) \
       --fish <($out/bin/oras completion fish) \
diff --git a/pkgs/by-name/or/orchard/package.nix b/pkgs/by-name/or/orchard/package.nix
index 3b2ffa8e5725..21cce3878f2f 100644
--- a/pkgs/by-name/or/orchard/package.nix
+++ b/pkgs/by-name/or/orchard/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   fetchFromGitHub,
   buildGoModule,
   installShellFiles,
@@ -41,7 +42,7 @@ buildGoModule rec {
 
   subPackages = [ "cmd/orchard" ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     export HOME="$(mktemp -d)"
     installShellCompletion --cmd orchard \
       --bash <($out/bin/orchard completion bash) \
diff --git a/pkgs/by-name/or/ory/package.nix b/pkgs/by-name/or/ory/package.nix
index ff604a8f1ba9..45c7eddd418c 100644
--- a/pkgs/by-name/or/ory/package.nix
+++ b/pkgs/by-name/or/ory/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -32,6 +33,8 @@ buildGoModule rec {
 
   postInstall = ''
     mv $out/bin/cli $out/bin/ory
+  ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd ory \
       --bash <($out/bin/ory completion bash) \
       --fish <($out/bin/ory completion fish) \
diff --git a/pkgs/by-name/os/oscar64/package.nix b/pkgs/by-name/os/oscar64/package.nix
new file mode 100644
index 000000000000..6dba5f6bfd39
--- /dev/null
+++ b/pkgs/by-name/os/oscar64/package.nix
@@ -0,0 +1,61 @@
+{
+  lib,
+  stdenv,
+  nix-update-script,
+  fetchFromGitHub,
+  fetchpatch,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "oscar64";
+  version = "1.32.263";
+
+  src = fetchFromGitHub {
+    owner = "drmortalwombat";
+    repo = "oscar64";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-g8HUJcoI7fBmypPO79QYiOdhIYh1/sctSaEC8RLaM+s=";
+  };
+
+  # FIXME: can be removed whenever the version is bumped.
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/drmortalwombat/oscar64/commit/3b0f954144e36903fd396c099714722f9fa2430a.patch";
+      hash = "sha256-6S7Gx9pZSNBHxX9uyS0zApe263dUo5DGviEczpP1FpQ=";
+    })
+    (fetchpatch {
+      url = "https://github.com/drmortalwombat/oscar64/commit/744f496f0f71fae098063a1f3ed71722d31f7b1a.patch";
+      hash = "sha256-84UBgVuKN7HMdkQfWUXMCfQSNqAe2QQ2yiifEN1JuOU=";
+    })
+  ];
+
+  postPatch = ''
+    substituteInPlace ./oscar64.1 \
+      --replace-fail "/usr/local/bin/oscar64" "$out/bin/oscar64" \
+      --replace-fail "/usr/local/share/oscar64/" "$out/include/oscar64"
+  '';
+
+  enableParallelBuilding = true;
+
+  makeFlags = [
+    "-C ./make"
+    "prefix=$(out)"
+  ];
+
+  buildTarget = "compiler";
+
+  doCheck = true;
+  checkTarget = "check";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Optimizing small memory C compiler, assembler, and runtime for C64";
+    homepage = "https://github.com/drmortalwombat/oscar64";
+    license = lib.licenses.gpl3Only;
+    maintainers = [ lib.maintainers.nekowinston ];
+    mainProgram = "oscar64";
+    platforms = lib.platforms.unix;
+    # FIXME: enable aarch64-linux for the next version.
+    broken = stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isLinux;
+  };
+})
diff --git a/pkgs/by-name/ow/owi/package.nix b/pkgs/by-name/ow/owi/package.nix
index 0f392f07c814..1c1a10370ab8 100644
--- a/pkgs/by-name/ow/owi/package.nix
+++ b/pkgs/by-name/ow/owi/package.nix
@@ -15,14 +15,14 @@ let
 in
 ocamlPackages.buildDunePackage rec {
   pname = "owi";
-  version = "0.2-unstable-2025-08-22";
+  version = "0.2-unstable-2025-09-17";
 
   src = fetchFromGitHub {
     owner = "ocamlpro";
     repo = "owi";
-    rev = "daad8163dec12abc8fe7f3384adc37e51f0994e9";
+    rev = "a0b11f9463a7f9dc8dd84f15405dd197b8fdc9ba";
     fetchSubmodules = true;
-    hash = "sha256-C28YoUbovSEk9/RW0iYWNVB7/ETlDnY+vPTfQZPOerE=";
+    hash = "sha256-PQgXfFsaB9EwzHhxpvfCbnvppy0YHtcb6WB2kF5jz8Q=";
   };
 
   nativeBuildInputs = with ocamlPackages; [
diff --git a/pkgs/by-name/pa/packwiz/package.nix b/pkgs/by-name/pa/packwiz/package.nix
index 3bfc70e66caf..21aaff58a189 100644
--- a/pkgs/by-name/pa/packwiz/package.nix
+++ b/pkgs/by-name/pa/packwiz/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -24,7 +25,7 @@ buildGoModule {
     installShellFiles
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd packwiz \
       --bash <($out/bin/packwiz completion bash) \
       --fish <($out/bin/packwiz completion fish) \
diff --git a/pkgs/by-name/pe/penpot-desktop/package.nix b/pkgs/by-name/pe/penpot-desktop/package.nix
index ea24c174e939..3c691db155ea 100644
--- a/pkgs/by-name/pe/penpot-desktop/package.nix
+++ b/pkgs/by-name/pe/penpot-desktop/package.nix
@@ -2,30 +2,29 @@
   lib,
   buildNpmPackage,
   copyDesktopItems,
-  electron_35,
+  electron,
   fetchFromGitHub,
   jq,
   makeDesktopItem,
   makeWrapper,
-  nodejs_22,
+  nodejs_24,
   stdenv,
 }:
 
 let
   description = "Unofficial desktop application for the open-source design tool, Penpot";
   icon = "penpot";
-  nodejs = nodejs_22;
-  electron = electron_35;
+  nodejs = nodejs_24;
 in
 buildNpmPackage rec {
   pname = "penpot-desktop";
-  version = "0.13.1";
+  version = "0.18.1";
 
   src = fetchFromGitHub {
     owner = "author-more";
     repo = "penpot-desktop";
     tag = "v${version}";
-    hash = "sha256-ztvwabsy7PiT8m0+DDehvwV8oclJCb1BymEpkjTPtZ8=";
+    hash = "sha256-MxkdGifPaakhX/tLHiD7Y6xCe3cZ7ELiAhD7GSmdtvk=";
   };
 
   makeCacheWritable = true;
@@ -33,7 +32,7 @@ buildNpmPackage rec {
     "--engine-strict"
     "--legacy-peer-deps"
   ];
-  npmDepsHash = "sha256-aRdqq0tMuNXkSy/NYdwir+LfwAr466dLi2b4vO/yjdg=";
+  npmDepsHash = "sha256-zOoED2WKfiDgfWQDgRrr7Gf09GbSFK+8rOsNr8VQpgY=";
   # Do not run the default build script as it leads to errors caused by the electron-builder configuration
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/pg/pg_top/package.nix b/pkgs/by-name/pg/pg_top/package.nix
index 4252a38283d5..f9125c384d70 100644
--- a/pkgs/by-name/pg/pg_top/package.nix
+++ b/pkgs/by-name/pg/pg_top/package.nix
@@ -1,5 +1,6 @@
 {
   cmake,
+  docutils,
   fetchurl,
   lib,
   libbsd,
@@ -10,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pg_top";
-  version = "4.1.1";
+  version = "4.1.3";
 
   src = fetchurl {
     url = "https://pg_top.gitlab.io/source/pg_top-${version}.tar.xz";
-    sha256 = "sha256-85LObBS9aAt7Ck5yiK0g2CAKxiYtnWp5XnTAUB5ui/k=";
+    sha256 = "sha256-4El3GmfP5UDJOsDxyU5z/s3JKw0jlMb8EB/hvtywwVs=";
   };
 
   buildInputs = [
@@ -23,7 +24,10 @@ stdenv.mkDerivation rec {
     ncurses
   ];
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [
+    cmake
+    docutils
+  ];
 
   meta = with lib; {
     description = "'top' like tool for PostgreSQL";
diff --git a/pkgs/by-name/pi/pinecone/package.nix b/pkgs/by-name/pi/pinecone/package.nix
index ad8933af0b9a..3fb208264da5 100644
--- a/pkgs/by-name/pi/pinecone/package.nix
+++ b/pkgs/by-name/pi/pinecone/package.nix
@@ -1,18 +1,18 @@
 {
   lib,
-  buildGoModule,
+  buildGo124Module,
   fetchFromGitHub,
 }:
 
-buildGoModule {
+buildGo124Module {
   pname = "pinecone";
-  version = "0.11.0-unstable-2023-08-10";
+  version = "0.11.0-unstable-2025-03-04";
 
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "pinecone";
-    rev = "ea4c33717fd74ef7d6f49490625a0fa10e3f5bbc";
-    hash = "sha256-q4EFWXSkQJ2n+xAWuBxdP7nrtv3eFql9LoavWo10dfs=";
+    rev = "b35aec69f59eb9bb8bd5a8c6be30fc276d3cce96";
+    hash = "sha256-0jqvWdFjN4Kzhkv4Oe1obsKGW0i/MGEMX3ZhcxpsdxA=";
   };
 
   vendorHash = "sha256-+P10K7G0UwkbCGEi6sYTQSqO7LzIf/xmaHIr7v110Ao=";
diff --git a/pkgs/by-name/pi/pinniped/package.nix b/pkgs/by-name/pi/pinniped/package.nix
index cc0d6d05026e..94d73eefe70a 100644
--- a/pkgs/by-name/pi/pinniped/package.nix
+++ b/pkgs/by-name/pi/pinniped/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   fetchFromGitHub,
   buildGoModule,
   installShellFiles,
@@ -27,7 +28,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd pinniped \
       --bash <($out/bin/pinniped completion bash) \
       --fish <($out/bin/pinniped completion fish) \
diff --git a/pkgs/by-name/pi/pipenv/package.nix b/pkgs/by-name/pi/pipenv/package.nix
index f03f07b3ffa1..d0a3d14a90bd 100644
--- a/pkgs/by-name/pi/pipenv/package.nix
+++ b/pkgs/by-name/pi/pipenv/package.nix
@@ -100,7 +100,7 @@ buildPythonApplication rec {
     '';
   };
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd pipenv \
       --bash <(_PIPENV_COMPLETE=bash_source $out/bin/pipenv) \
       --zsh <(_PIPENV_COMPLETE=zsh_source $out/bin/pipenv) \
diff --git a/pkgs/by-name/po/poetry/package.nix b/pkgs/by-name/po/poetry/package.nix
index e5ce69dbc168..2422753a8ab4 100644
--- a/pkgs/by-name/po/poetry/package.nix
+++ b/pkgs/by-name/po/poetry/package.nix
@@ -11,18 +11,6 @@ let
     {
       poetry = self.callPackage ./unwrapped.nix { };
 
-      # Poetry 2.1.4 officially requires virtualenv >=20.26.6, <20.33.0
-      # otherwise will be incompatible with python312
-      # see: https://github.com/python-poetry/poetry/issues/10490
-      virtualenv = super.virtualenv.overridePythonAttrs (old: rec {
-        version = "20.30.0";
-        src = fetchPypi {
-          inherit (old) pname;
-          inherit version;
-          hash = "sha256-gAhjFivKpUUKbk1yEElzDn8trgdyDgkCsOQEC9b5rag=";
-        };
-      });
-
       # The versions of Poetry and poetry-core need to match exactly,
       # and poetry-core in nixpkgs requires a staging cycle to be updated,
       # so apply an override here.
@@ -30,22 +18,12 @@ let
       # We keep the override around even when the versions match, as
       # it's likely to become relevant again after the next Poetry update.
       poetry-core = super.poetry-core.overridePythonAttrs (old: rec {
-        version = "2.1.3";
+        version = "2.2.0";
         src = fetchFromGitHub {
           owner = "python-poetry";
           repo = "poetry-core";
           tag = version;
-          hash = "sha256-CgaWlqjvBTN7GuerzmO5IiEdXxYH6pmTDj9IsNJlCBE=";
-        };
-      });
-
-      findpython = super.findpython.overridePythonAttrs (old: rec {
-        version = "0.6.3";
-
-        src = fetchPypi {
-          inherit (old) pname;
-          inherit version;
-          hash = "sha256-WGPqVVVtiq3Gk0gaFKxPNiSVJxnvwcVZGrsLSp6WXJQ=";
+          hash = "sha256-WLPG8BiM+927qSC+ly5H2IAE2Htm8+wLEjK2AFnMJ58=";
         };
       });
     }
diff --git a/pkgs/by-name/po/poetry/plugins/poetry-plugin-export.nix b/pkgs/by-name/po/poetry/plugins/poetry-plugin-export.nix
index a33d7048627d..2e7ed72134c2 100644
--- a/pkgs/by-name/po/poetry/plugins/poetry-plugin-export.nix
+++ b/pkgs/by-name/po/poetry/plugins/poetry-plugin-export.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
   poetry,
   poetry-core,
   pytest-mock,
@@ -12,28 +11,16 @@
 
 buildPythonPackage rec {
   pname = "poetry-plugin-export";
-  version = "1.9.0";
-  format = "pyproject";
+  version = "1.9.0-unstable-2025-09-14";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python-poetry";
     repo = "poetry-plugin-export";
-    tag = version;
-    hash = "sha256-AP3/njzbLEi2s4pOUSLLLzqNprvxwLe9LSY7qh08EWc=";
+    rev = "70a2f386a52687adee7353b51e59dd45aa319ee7";
+    hash = "sha256-KsvkM4hjG+jrdPVauXYdc6E87Gp7srMg/mJHpWRjaEs=";
   };
 
-  patches = [
-    # Remove after next release of poetry-plugin-export
-    (fetchpatch {
-      url = "https://github.com/python-poetry/poetry-plugin-export/commit/16637f194e86708913ec6e09064c713eb0715bb6.patch";
-      includes = [
-        "tests/test_exporter.py"
-        "tests/markers.py"
-      ];
-      hash = "sha256-ncz9kqp18+yeRXlhmLEcWfO1bDavjohhmVw6DwTy1hA=";
-    })
-  ];
-
   build-system = [
     poetry-core
   ];
@@ -48,10 +35,10 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  meta = with lib; {
+  meta = {
     changelog = "https://github.com/python-poetry/poetry-plugin-export/blob/${src.rev}/CHANGELOG.md";
     description = "Poetry plugin to export the dependencies to various formats";
-    license = licenses.mit;
+    license = lib.licenses.mit;
     homepage = "https://github.com/python-poetry/poetry-plugin-export";
     maintainers = [ ];
   };
diff --git a/pkgs/by-name/po/poetry/plugins/poetry-plugin-up.nix b/pkgs/by-name/po/poetry/plugins/poetry-plugin-up.nix
index c6c5acf0fec5..58bf3b5b575f 100644
--- a/pkgs/by-name/po/poetry/plugins/poetry-plugin-up.nix
+++ b/pkgs/by-name/po/poetry/plugins/poetry-plugin-up.nix
@@ -6,6 +6,7 @@
   pytestCheckHook,
   pytest-mock,
   poetry,
+  writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage rec {
@@ -31,11 +32,14 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytestCheckHook
     pytest-mock
+    writableTmpDirAsHomeHook
   ];
 
-  preCheck = ''
-    export HOME=$TMPDIR
-  '';
+  disabledTests = [
+    # https://github.com/MousaZeidBaker/poetry-plugin-up/issues/78
+    "test_command_preserve_wildcard_project"
+    "test_command_with_latest_project"
+  ];
 
   meta = {
     description = "Poetry plugin to simplify package updates";
diff --git a/pkgs/by-name/po/poetry/unwrapped.nix b/pkgs/by-name/po/poetry/unwrapped.nix
index 9a1486765cce..c6de126c84a1 100644
--- a/pkgs/by-name/po/poetry/unwrapped.nix
+++ b/pkgs/by-name/po/poetry/unwrapped.nix
@@ -37,7 +37,7 @@
 
 buildPythonPackage rec {
   pname = "poetry";
-  version = "2.1.4";
+  version = "2.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -46,7 +46,7 @@ buildPythonPackage rec {
     owner = "python-poetry";
     repo = "poetry";
     tag = version;
-    hash = "sha256-6QYg+QRZ60hgcAvKiUqC3gW7P0oK0vaFps9NYIPhBb8=";
+    hash = "sha256-CI3+0P+eIFpdnyxy1zhaEMWAsX/R0qqdAvVEQ5fqnhk=";
   };
 
   build-system = [
@@ -97,7 +97,7 @@ buildPythonPackage rec {
   ++ pbs-installer.optional-dependencies.download
   ++ pbs-installer.optional-dependencies.install;
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd poetry \
       --bash <($out/bin/poetry completions bash) \
       --fish <($out/bin/poetry completions fish) \
diff --git a/pkgs/by-name/po/polarity/package.nix b/pkgs/by-name/po/polarity/package.nix
index 83d33d1593e7..b58b658595cf 100644
--- a/pkgs/by-name/po/polarity/package.nix
+++ b/pkgs/by-name/po/polarity/package.nix
@@ -7,13 +7,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "polarity";
-  version = "latest-unstable-2025-08-24";
+  version = "latest-unstable-2025-09-17";
 
   src = fetchFromGitHub {
     owner = "polarity-lang";
     repo = "polarity";
-    rev = "5e208207cfee3fbefd16dd6c0ef5e9f086597374";
-    hash = "sha256-8/edtUEoDtIwqBtUi5OdyQ+aHSnbXS4R1ltZYLQIehM=";
+    rev = "20a0394d99752947f78e152854efd19852616968";
+    hash = "sha256-Gu9PwRqMjFzubFkyRRbxcfG6mmID8HIJclkW7sDDWYo=";
   };
 
   cargoHash = "sha256-EB6DlhD+0oneAGhLHi3bWnnFUIfNdKeW52umWHZEP7c=";
diff --git a/pkgs/by-name/po/polenum/package.nix b/pkgs/by-name/po/polenum/package.nix
index a4443f02e2de..2e7cec24462a 100644
--- a/pkgs/by-name/po/polenum/package.nix
+++ b/pkgs/by-name/po/polenum/package.nix
@@ -4,16 +4,16 @@
   python3,
 }:
 
-python3.pkgs.buildPythonApplication {
+python3.pkgs.buildPythonApplication rec {
   pname = "polenum";
-  version = "1.6.1-unstable-2024-07-30";
+  version = "1.7";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "Wh1t3Fox";
     repo = "polenum";
-    rev = "6f95ce0f9936d8c20820e199a4bb1ea68d2f061f";
-    hash = "sha256-aCX7dByfkUSFHjhRAjrFhbbeIgYNGixnB5pHE/lftng=";
+    tag = version;
+    hash = "sha256-/xjGwolpbkh/ig0N9gpSTQMIJ/2ayThRBzx3tF1kfjM=";
   };
 
   propagatedBuildInputs = with python3.pkgs; [
diff --git a/pkgs/by-name/po/pop/package.nix b/pkgs/by-name/po/pop/package.nix
index 4452a75aab08..b8be704a790d 100644
--- a/pkgs/by-name/po/pop/package.nix
+++ b/pkgs/by-name/po/pop/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   installShellFiles,
   fetchFromGitHub,
@@ -30,7 +31,7 @@ buildGoModule rec {
     "-X=main.Version=${version}"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     $out/bin/pop man > pop.1
     installManPage pop.1
     installShellCompletion --cmd pop \
diff --git a/pkgs/by-name/po/popeye/package.nix b/pkgs/by-name/po/popeye/package.nix
index 31fff97a6478..c1ab4467e016 100644
--- a/pkgs/by-name/po/popeye/package.nix
+++ b/pkgs/by-name/po/popeye/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -27,7 +28,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd popeye \
       --bash <($out/bin/popeye completion bash) \
       --fish <($out/bin/popeye completion fish) \
diff --git a/pkgs/by-name/po/portablemc/package.nix b/pkgs/by-name/po/portablemc/package.nix
index d99a3ea4d318..6f94c7abc528 100644
--- a/pkgs/by-name/po/portablemc/package.nix
+++ b/pkgs/by-name/po/portablemc/package.nix
@@ -72,7 +72,7 @@ python3Packages.buildPythonApplication rec {
 
   # Note: Tests use networking, so we don't run them
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd portablemc \
         --bash <($out/bin/portablemc show completion bash) \
         --zsh <($out/bin/portablemc show completion zsh)
diff --git a/pkgs/by-name/po/portfolio/package.nix b/pkgs/by-name/po/portfolio/package.nix
index e38faabda977..410fa276bb5d 100644
--- a/pkgs/by-name/po/portfolio/package.nix
+++ b/pkgs/by-name/po/portfolio/package.nix
@@ -34,11 +34,11 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "PortfolioPerformance";
-  version = "0.79.1";
+  version = "0.80.0";
 
   src = fetchurl {
     url = "https://github.com/buchen/portfolio/releases/download/${finalAttrs.version}/PortfolioPerformance-${finalAttrs.version}-linux.gtk.x86_64.tar.gz";
-    hash = "sha256-oJjYnJvgNpYpbJ5QSV4dwaB7FEaIqCbkAmzsYpjyfbc=";
+    hash = "sha256-2Qpyc4SXjQQtvDxYxrZrFt91BptlzFNC7Psl9MxII6I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pr/prometheus/package.nix b/pkgs/by-name/pr/prometheus/package.nix
index 6dc90385659e..8af5940becd8 100644
--- a/pkgs/by-name/pr/prometheus/package.nix
+++ b/pkgs/by-name/pr/prometheus/package.nix
@@ -33,7 +33,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "prometheus";
-  version = "3.5.0";
+  version = "3.6.0";
 
   outputs = [
     "out"
@@ -45,14 +45,14 @@ buildGoModule (finalAttrs: {
     owner = "prometheus";
     repo = "prometheus";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QBmtJ+qBIwQzfJ7tx0P9/3kl6UaZou7qp8jrI+Qrcck=";
+    hash = "sha256-GowtA1iTx6lpRW+RBLYFc8s5H8ECPEmcbdVJvGHl5Cw=";
   };
 
-  vendorHash = "sha256-Svm+rH/cmS9mjiQHVucwKHy6ilw3mgySjRdC3ivw0YE=";
+  vendorHash = "sha256-xGMBd/MhwjCbrQrP5d5aSd99F8GN6wB3jaHpOh0M7OA=";
 
   webUiStatic = fetchurl {
     url = "https://github.com/prometheus/prometheus/releases/download/v${finalAttrs.version}/prometheus-web-ui-${finalAttrs.version}.tar.gz";
-    hash = "sha256-j+wOQ8m2joXZ3/C6bO8pxroM/hntVLP/QhoWVmdLir4=";
+    hash = "sha256-lw097NTDJUWm2RY0RUg/5djNdbj+W9hRdIaF2cQz4Bo=";
   };
 
   excludedPackages = [
diff --git a/pkgs/by-name/pr/proton-ge-bin/package.nix b/pkgs/by-name/pr/proton-ge-bin/package.nix
index 0e73a2a7d840..cf14b1d3bd9a 100644
--- a/pkgs/by-name/pr/proton-ge-bin/package.nix
+++ b/pkgs/by-name/pr/proton-ge-bin/package.nix
@@ -9,11 +9,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "proton-ge-bin";
-  version = "GE-Proton10-15";
+  version = "GE-Proton10-16";
 
   src = fetchzip {
     url = "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/${finalAttrs.version}/${finalAttrs.version}.tar.gz";
-    hash = "sha256-VS9oFut8Wz2sbMwtX5tZkeusLDcZP3FOLUsQRabaZ0c=";
+    hash = "sha256-pwnYnO6JPoZS8w2kge98WQcTfclrx7U2vwxGc6uj9k4=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/pu/pulsarctl/package.nix b/pkgs/by-name/pu/pulsarctl/package.nix
index 9ef30b624b1d..224c3ecbed67 100644
--- a/pkgs/by-name/pu/pulsarctl/package.nix
+++ b/pkgs/by-name/pu/pulsarctl/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -50,7 +51,7 @@ buildGoModule rec {
 
   doCheck = false;
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd pulsarctl \
       --bash <($out/bin/pulsarctl completion bash) \
       --fish <($out/bin/pulsarctl completion fish) \
diff --git a/pkgs/by-name/pv/pv-migrate/package.nix b/pkgs/by-name/pv/pv-migrate/package.nix
index 744d48af917e..f6935f15ff23 100644
--- a/pkgs/by-name/pv/pv-migrate/package.nix
+++ b/pkgs/by-name/pv/pv-migrate/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -32,7 +33,7 @@ buildGoModule rec {
     installShellFiles
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd pv-migrate \
       --bash <($out/bin/pv-migrate completion bash) \
       --fish <($out/bin/pv-migrate completion fish) \
diff --git a/pkgs/by-name/py/pytr/package.nix b/pkgs/by-name/py/pytr/package.nix
index 1cec6203cb6a..667997735be3 100644
--- a/pkgs/by-name/py/pytr/package.nix
+++ b/pkgs/by-name/py/pytr/package.nix
@@ -2,6 +2,7 @@
   fetchFromGitHub,
   installShellFiles,
   lib,
+  stdenv,
   python3Packages,
   versionCheckHook,
 }:
@@ -38,7 +39,7 @@ python3Packages.buildPythonApplication rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd pytr \
       --bash <($out/bin/pytr completion bash) \
       --zsh <($out/bin/pytr completion zsh)
diff --git a/pkgs/by-name/qc/qc/package.nix b/pkgs/by-name/qc/qc/package.nix
index 31121dc707bb..e492f6cd8ada 100644
--- a/pkgs/by-name/qc/qc/package.nix
+++ b/pkgs/by-name/qc/qc/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -33,7 +34,7 @@ buildGoModule rec {
     installShellFiles
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     export HOME=$(mktemp -d)
     installShellCompletion --cmd qc \
       --bash <($out/bin/qc completion bash) \
diff --git a/pkgs/by-name/qo/qovery-cli/package.nix b/pkgs/by-name/qo/qovery-cli/package.nix
index 522c671f073f..5e8ae9bec2ef 100644
--- a/pkgs/by-name/qo/qovery-cli/package.nix
+++ b/pkgs/by-name/qo/qovery-cli/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -22,7 +23,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd ${pname} \
       --bash <($out/bin/${pname} completion bash) \
       --fish <($out/bin/${pname} completion fish) \
diff --git a/pkgs/by-name/qo/qownnotes/package.nix b/pkgs/by-name/qo/qownnotes/package.nix
index f94fbe48d78d..fbe21e92e3a8 100644
--- a/pkgs/by-name/qo/qownnotes/package.nix
+++ b/pkgs/by-name/qo/qownnotes/package.nix
@@ -18,11 +18,11 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "25.9.1";
+  version = "25.9.3";
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${finalAttrs.version}/qownnotes-${finalAttrs.version}.tar.xz";
-    hash = "sha256-YTlQroUtcu6p64ZVIhRhyXRY9X+ujTEgdCLz78HGU1g=";
+    hash = "sha256-B5xKZaayYNClf02O8KHXfqrDX7obS61dPAW999xn9Eo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/qq/qq/sources.nix b/pkgs/by-name/qq/qq/sources.nix
index 91b907f615c0..1865b9633364 100644
--- a/pkgs/by-name/qq/qq/sources.nix
+++ b/pkgs/by-name/qq/qq/sources.nix
@@ -1,12 +1,12 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2025-08-20
+# Last updated: 2025-09-22
 { fetchurl }:
 let
   any-darwin = {
-    version = "6.9.79-2025-08-20";
+    version = "6.9.80-2025-09-04";
     src = fetchurl {
-      url = "https://dldir1v6.qq.com/qqfile/qq/QQNT/Mac/QQ_6.9.79_250820_01.dmg";
-      hash = "sha256-m8COj+kn9ify4D4FUpNXL31uO4j4DKqCQhZnoo5umTE=";
+      url = "https://dldir1v6.qq.com/qqfile/qq/QQNT/Mac/QQ_6.9.80_250904_01.dmg";
+      hash = "sha256-VUjgWQIxabjXkXJhxQiQJlYDkbLDNLaVQeRaZ4WGOIs=";
     };
   };
 in
@@ -14,17 +14,17 @@ in
   aarch64-darwin = any-darwin;
   x86_64-darwin = any-darwin;
   aarch64-linux = {
-    version = "3.2.19-2025-08-20";
+    version = "3.2.19-2025-09-04";
     src = fetchurl {
-      url = "https://dldir1v6.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.19_250820_arm64_01.deb";
-      hash = "sha256-rHgN0T9lcoAucwR3B2U8so/dAUfB92dQYc0TncTHPaM=";
+      url = "https://dldir1v6.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.19_250904_arm64_01.deb";
+      hash = "sha256-OqBRxDfTz9w4cFeDSKeysPlqxaJtrp96PZieXnsjGhA=";
     };
   };
   x86_64-linux = {
-    version = "3.2.19-2025-08-20";
+    version = "3.2.19-2025-09-04";
     src = fetchurl {
-      url = "https://dldir1v6.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.19_250820_amd64_01.deb";
-      hash = "sha256-4Y0GSWwFkqYX5ezE2Jk/tZIwsBHg88ZxJghzB+kXTds=";
+      url = "https://dldir1v6.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.19_250904_amd64_01.deb";
+      hash = "sha256-5M3kykJCmFZZ0VTG/K+nYRt7SIUzvc3O6yPW8ebx45A=";
     };
   };
 }
diff --git a/pkgs/by-name/qw/qwen-code/package.nix b/pkgs/by-name/qw/qwen-code/package.nix
index da994ed2b3e7..0aaf2b6654bc 100644
--- a/pkgs/by-name/qw/qwen-code/package.nix
+++ b/pkgs/by-name/qw/qwen-code/package.nix
@@ -4,17 +4,18 @@
   fetchFromGitHub,
   nix-update-script,
   jq,
+  ripgrep,
 }:
 
 buildNpmPackage (finalAttrs: {
   pname = "qwen-code";
-  version = "0.0.11";
+  version = "0.0.12";
 
   src = fetchFromGitHub {
     owner = "QwenLM";
     repo = "qwen-code";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5qKSWbc0NPpgvt36T/gRSgm1+o2Pbdw3tgfcGba6YSs=";
+    hash = "sha256-qsa4bAk0QUUZCtoEREBd+8s0AwwVr1os5TO7Luo/UrY=";
   };
 
   patches = [
@@ -23,13 +24,21 @@ buildNpmPackage (finalAttrs: {
     ./add-missing-resolved-integrity-fields.patch
   ];
 
-  npmDepsHash = "sha256-XvJO3ylm/ER5neSubci2w9OCTmqobmmXLbKmdQAqArY=";
+  npmDepsHash = "sha256-uLKxUD0e9YSEQz4dxsGXYojcYS6noqsWhtmsc20He0k=";
 
   nativeBuildInputs = [
     jq
   ];
 
+  buildInputs = [ ripgrep ];
+
   postPatch = ''
+    # Remove @lvce-editor/ripgrep dependency (no network on buildPhase
+    substituteInPlace package.json --replace-fail '"@lvce-editor/ripgrep": "^1.6.0",' ""
+    substituteInPlace packages/core/package.json --replace-fail '"@lvce-editor/ripgrep": "^1.6.0",' ""
+    substituteInPlace packages/core/src/tools/ripGrep.ts \
+      --replace-fail "import { rgPath } from '@lvce-editor/ripgrep';" "const rgPath = 'rg';"
+
     # patches below remove node-pty dependency which causes build fail on Darwin
     # should be conditional on platform but since package-lock.json is patched it changes its hash
     # though seems like this dependency is not really required by the package
diff --git a/pkgs/by-name/ra/radioboat/package.nix b/pkgs/by-name/ra/radioboat/package.nix
index f874642fe91f..3f220a662434 100644
--- a/pkgs/by-name/ra/radioboat/package.nix
+++ b/pkgs/by-name/ra/radioboat/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   fetchFromGitHub,
   buildGoModule,
   mpv,
@@ -38,7 +39,7 @@ buildGoModule rec {
     wrapProgram $out/bin/radioboat --prefix PATH ":" "${lib.makeBinPath [ mpv ]}";
   '';
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd radioboat \
       --bash <($out/bin/radioboat completion bash) \
       --fish <($out/bin/radioboat completion fish) \
diff --git a/pkgs/by-name/ra/railway/package.nix b/pkgs/by-name/ra/railway/package.nix
index 1d1f453ba5c8..9aade72c2cc8 100644
--- a/pkgs/by-name/ra/railway/package.nix
+++ b/pkgs/by-name/ra/railway/package.nix
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "railway";
-  version = "4.7.3";
+  version = "4.8.0";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-1I9YpM89m5NsUYzsFkknMcMJDsOnZEeqXRLhdaCuVNI=";
+    hash = "sha256-zZiEhXVIffYALiXiKwLlPpr8XchGii/i6VmDnoZTeq0=";
   };
 
-  cargoHash = "sha256-2FuK72cyOCEeIjzIoU4cGjHsPvG/yo1sT5TiFK8vNfw=";
+  cargoHash = "sha256-Khk4D7xSfm4q3EWR9UHSzrf+m6NHo74wrPYYAh6tG4g=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/re/readability-cli/package.nix b/pkgs/by-name/re/readability-cli/package.nix
index b2aabfb96622..f2ad25c2bd37 100644
--- a/pkgs/by-name/re/readability-cli/package.nix
+++ b/pkgs/by-name/re/readability-cli/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildNpmPackage,
   fetchFromGitLab,
   installShellFiles,
@@ -35,6 +36,8 @@ buildNpmPackage (finalAttrs: {
 
   postInstall = ''
     installManPage readability-cli.1
+  ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd readable \
       --bash <(SHELL=bash $out/bin/readable --completion) \
       --zsh <(SHELL=zsh $out/bin/readable --completion)
diff --git a/pkgs/by-name/re/repro-get/package.nix b/pkgs/by-name/re/repro-get/package.nix
index e3f94b5374ee..1c6f49ac083a 100644
--- a/pkgs/by-name/re/repro-get/package.nix
+++ b/pkgs/by-name/re/repro-get/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -35,7 +36,7 @@ buildGoModule rec {
     "-X github.com/reproducible-containers/${pname}/pkg/version.Version=v${version}"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd repro-get \
       --bash <($out/bin/repro-get completion bash) \
       --fish <($out/bin/repro-get completion fish) \
diff --git a/pkgs/by-name/re/restic/package.nix b/pkgs/by-name/re/restic/package.nix
index 795389d734b2..47d67bfbd56c 100644
--- a/pkgs/by-name/re/restic/package.nix
+++ b/pkgs/by-name/re/restic/package.nix
@@ -12,13 +12,13 @@
 
 buildGoModule rec {
   pname = "restic";
-  version = "0.18.0";
+  version = "0.18.1";
 
   src = fetchFromGitHub {
     owner = "restic";
     repo = "restic";
     rev = "v${version}";
-    hash = "sha256-odyKcpNAhk1dlVBhjrtmgKjWTOCMtooYOJ5p0J9OUFY=";
+    hash = "sha256-lLinqZUOsZCPPybvVDB1f8o9Hl5qKYi0eHwJAaydsD8=";
   };
 
   patches = [
@@ -26,7 +26,7 @@ buildGoModule rec {
     ./0001-Skip-testing-restore-with-permission-failure.patch
   ];
 
-  vendorHash = "sha256-cxOwVf1qZXJbDZC/7cGnKPNpwJnAk3OunKVZpwtI8pI=";
+  vendorHash = "sha256-4GVhG1sjFiuKyDUAgmSmFww5bDKIoCjejkkoSqkvU4E=";
 
   subPackages = [ "cmd/restic" ];
 
diff --git a/pkgs/by-name/re/rewaita/package.nix b/pkgs/by-name/re/rewaita/package.nix
index 8709a6ea7dad..f3089ef6b39d 100644
--- a/pkgs/by-name/re/rewaita/package.nix
+++ b/pkgs/by-name/re/rewaita/package.nix
@@ -12,10 +12,11 @@
   appstream-glib,
   blueprint-compiler,
   libadwaita,
+  libportal,
   nix-update-script,
 }:
 let
-  version = "1.0.1";
+  version = "1.0.5";
 in
 python3Packages.buildPythonApplication {
   pname = "rewaita";
@@ -26,16 +27,12 @@ python3Packages.buildPythonApplication {
     owner = "SwordPuffin";
     repo = "Rewaita";
     tag = "v${version}";
-    hash = "sha256-adSXq+DFw3IQxNuUkP1FcKlIh9h4Zb0tJKswYs3S92E=";
+    hash = "sha256-Q4HUly78liI0OfmD9llR+00qUKE+mioeNE0TIypCB9k=";
   };
 
-  # Prevent the app from copying the RO flag of files from /nix/store
   postPatch = ''
-    substituteInPlace src/interface_to_shell_theme.py \
-      --replace-fail 'shutil.copy2' 'shutil.copyfile'
-
     substituteInPlace src/window.py \
-      --replace-fail 'shutil.copy' 'shutil.copyfile'
+      --replace-fail 'shutil.copy(' 'shutil.copyfile('
   '';
 
   strictDeps = true;
@@ -59,6 +56,7 @@ python3Packages.buildPythonApplication {
   buildInputs = [
     libadwaita
     gtk4
+    libportal
   ];
 
   dontWrapGApps = true;
@@ -73,6 +71,9 @@ python3Packages.buildPythonApplication {
     license = lib.licenses.gpl3Plus;
     mainProgram = "rewaita";
     platforms = lib.platforms.linux;
-    maintainers = [ lib.maintainers.awwpotato ];
+    maintainers = with lib.maintainers; [
+      awwpotato
+      getchoo
+    ];
   };
 }
diff --git a/pkgs/by-name/ri/rio/package.nix b/pkgs/by-name/ri/rio/package.nix
index 5f5382dbd48d..113d35a18347 100644
--- a/pkgs/by-name/ri/rio/package.nix
+++ b/pkgs/by-name/ri/rio/package.nix
@@ -129,7 +129,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   meta = {
     description = "Hardware-accelerated GPU terminal emulator powered by WebGPU";
-    homepage = "https://raphamorim.io/rio";
+    homepage = "https://rioterm.com/";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       tornax
diff --git a/pkgs/by-name/ro/roadrunner/package.nix b/pkgs/by-name/ro/roadrunner/package.nix
index bd1319624997..52f0886d0ede 100644
--- a/pkgs/by-name/ro/roadrunner/package.nix
+++ b/pkgs/by-name/ro/roadrunner/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -28,7 +29,7 @@ buildGoModule rec {
     "-X=github.com/roadrunner-server/roadrunner/v2023/internal/meta.buildTime=1970-01-01T00:00:00Z"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd rr \
       --bash <($out/bin/rr completion bash) \
       --zsh <($out/bin/rr completion zsh) \
diff --git a/pkgs/by-name/ro/rosa/package.nix b/pkgs/by-name/ro/rosa/package.nix
index 756c7cdfa1c5..183d070419f1 100644
--- a/pkgs/by-name/ro/rosa/package.nix
+++ b/pkgs/by-name/ro/rosa/package.nix
@@ -43,7 +43,7 @@ buildGoModule rec {
     [ "-skip=^${lib.concatStringsSep "$|^" skippedTests}$" ];
 
   nativeBuildInputs = [ installShellFiles ];
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd rosa \
       --bash <($out/bin/rosa completion bash) \
       --fish <($out/bin/rosa completion fish) \
diff --git a/pkgs/by-name/ro/roxctl/package.nix b/pkgs/by-name/ro/roxctl/package.nix
index 255a2763d242..26c590510223 100644
--- a/pkgs/by-name/ro/roxctl/package.nix
+++ b/pkgs/by-name/ro/roxctl/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -30,7 +31,7 @@ buildGoModule rec {
     "-X github.com/stackrox/rox/pkg/version/internal.MainVersion=${version}"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd roxctl \
       --bash <($out/bin/roxctl completion bash) \
       --fish <($out/bin/roxctl completion fish) \
diff --git a/pkgs/by-name/ru/rure/Cargo.lock b/pkgs/by-name/ru/rure/Cargo.lock
index 33b7e44c2fa7..112698c1c39c 100644
--- a/pkgs/by-name/ru/rure/Cargo.lock
+++ b/pkgs/by-name/ru/rure/Cargo.lock
@@ -13,21 +13,21 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.172"
+version = "0.2.175"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d750af042f7ef4f724306de029d18836c26c1765a54a6a3f094cbd23a7267ffa"
+checksum = "6a82ae493e598baaea5209805c49bbf2ea7de956d50d7da0da1164f9c6d28543"
 
 [[package]]
 name = "memchr"
-version = "2.7.4"
+version = "2.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
+checksum = "32a282da65faaf38286cf3be983213fcf1d2e2a58700e808f83f4ea9a4804bc0"
 
 [[package]]
 name = "regex"
-version = "1.11.1"
+version = "1.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
+checksum = "23d7fd106d8c02486a8d64e778353d1cffe08ce79ac2e82f540c86d0facf6912"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -37,9 +37,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.9"
+version = "0.4.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
+checksum = "6b9458fa0bfeeac22b5ca447c63aaf45f28439a709ccd244698632f9aa6394d6"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -48,13 +48,13 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.5"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
+checksum = "caf4aa5b0f434c91fe5c7f1ecb6a5ece2130b02ad2a590589dda5146df959001"
 
 [[package]]
 name = "rure"
-version = "0.2.2"
+version = "0.2.3"
 dependencies = [
  "libc",
  "regex",
diff --git a/pkgs/by-name/ru/rure/pin.json b/pkgs/by-name/ru/rure/pin.json
index 528371275bfc..5078676c08ca 100644
--- a/pkgs/by-name/ru/rure/pin.json
+++ b/pkgs/by-name/ru/rure/pin.json
@@ -1,5 +1,5 @@
 {
   "pname": "rure",
-  "version": "0.2.2",
-  "hash": "sha256:0n2c9b8arfgcq1l7gr8dfcmdvdbggvfd0msy6sbx3bln74wwbr06"
+  "version": "0.2.3",
+  "hash": "sha256:0d8r0fv93ganqi9iyrgljbkvrvys33n0zrkaf11zsb23b2hwcsxa"
 }
diff --git a/pkgs/by-name/ru/rutabaga_gfx/package.nix b/pkgs/by-name/ru/rutabaga_gfx/package.nix
index 91a1a0116dfd..742b38ec4f68 100644
--- a/pkgs/by-name/ru/rutabaga_gfx/package.nix
+++ b/pkgs/by-name/ru/rutabaga_gfx/package.nix
@@ -26,6 +26,8 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-/zeWWL4Mdb/kIJ0J3nky5dastsZUOXm9YTXUjKCDJcY=";
   };
 
+  separateDebugInfo = true;
+
   nativeBuildInputs = [
     cargo
     meson
diff --git a/pkgs/by-name/sc/scorecard/package.nix b/pkgs/by-name/sc/scorecard/package.nix
index 18bbdac33a2b..67ee3577ce32 100644
--- a/pkgs/by-name/sc/scorecard/package.nix
+++ b/pkgs/by-name/sc/scorecard/package.nix
@@ -73,7 +73,7 @@ buildGoModule rec {
     "-skip TestCollectDockerfilePinning/Non-pinned_dockerfile|TestMixedPinning"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd scorecard \
       --bash <($out/bin/scorecard completion bash) \
       --fish <($out/bin/scorecard completion fish) \
diff --git a/pkgs/by-name/se/semantic-release/package.nix b/pkgs/by-name/se/semantic-release/package.nix
index 80571b984e54..f3be478f2021 100644
--- a/pkgs/by-name/se/semantic-release/package.nix
+++ b/pkgs/by-name/se/semantic-release/package.nix
@@ -9,16 +9,16 @@
 
 buildNpmPackage rec {
   pname = "semantic-release";
-  version = "24.2.8";
+  version = "24.2.9";
 
   src = fetchFromGitHub {
     owner = "semantic-release";
     repo = "semantic-release";
     rev = "v${version}";
-    hash = "sha256-blPpIVL1bg8u7vnZo+XRvVPOv8UAmwtt7Rl1h3XC1L8=";
+    hash = "sha256-6dR1wUkoUTRtyQliJFUYLC4eNW2ppIOqeUsL7rLCZiA=";
   };
 
-  npmDepsHash = "sha256-XvZpyDEUMDj4TvjDsDhWiyJHiy+14mWgTghXeFP+vBM=";
+  npmDepsHash = "sha256-Frhb7bsY0z160EAKOWB5VCsrBMcrjKPE5OYtgX1Cmhs=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/sf/sfml/package.nix b/pkgs/by-name/sf/sfml/package.nix
index f91240cb85b1..214289478f3e 100644
--- a/pkgs/by-name/sf/sfml/package.nix
+++ b/pkgs/by-name/sf/sfml/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch2,
 
   # nativeBuildInputs
   cmake,
@@ -26,22 +25,16 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sfml";
-  version = "3.0.1";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "SFML";
     repo = "SFML";
     tag = finalAttrs.version;
-    hash = "sha256-yTNoDHcBRzk270QHjSFVpjFKm2+uVvmVLg6XlAppwYk=";
+    hash = "sha256-YqlrY0iIsxcjlLb+buMU0zpXo7/eKSKxOsITWf7BX6s=";
   };
 
   patches = [
-    (fetchpatch2 {
-      name = "Fix-pkg-config-when-SFML_PKGCONFIG_INSTALL_DIR-is-unset.patch";
-      url = "https://github.com/SFML/SFML/commit/a87763becbc4672b38f1021418ed94caa0f6540a.patch?full_index=1";
-      hash = "sha256-tJmXTdhwtWq6XfUPBzw47yTrc6EzwmSiVj9n6jQwHig=";
-    })
-
     # Not upstreamble in the near future, see https://github.com/SFML/SFML/pull/3555
     ./unvendor-miniaudio.patch
   ];
diff --git a/pkgs/by-name/sh/shaperglot-cli/package.nix b/pkgs/by-name/sh/shaperglot-cli/package.nix
index a7061dfef4a3..0755e1852ec1 100644
--- a/pkgs/by-name/sh/shaperglot-cli/package.nix
+++ b/pkgs/by-name/sh/shaperglot-cli/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "shaperglot-cli";
-  version = "1.1.0";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "googlefonts";
     repo = "shaperglot";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XFzsUzHa4KsyDWlOKlWHBNimn1hzdrtCPe+lFrs0EDc=";
+    hash = "sha256-YbAitVNBSPvYg2wsBmvNS/NA6M7ZDY7w/lYgDNs3i4Y=";
   };
 
-  cargoHash = "sha256-Md48ovCG8pEPbTz6R0nks6rZxO3UEdZ/SYRVgffCIKU=";
+  cargoHash = "sha256-miGaE2SntBi4tHrK2bz4A77gnUX0zIBvnvDDZIVeveo=";
 
   cargoBuildFlags = [
     "--package=shaperglot-cli"
diff --git a/pkgs/by-name/sh/shiori/package.nix b/pkgs/by-name/sh/shiori/package.nix
index a7feee99616c..705062ff7f3f 100644
--- a/pkgs/by-name/sh/shiori/package.nix
+++ b/pkgs/by-name/sh/shiori/package.nix
@@ -28,7 +28,7 @@ buildGoModule rec {
   ];
 
   nativeBuildInputs = [ installShellFiles ];
-  postInstall = lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd shiori \
       --bash <($out/bin/shiori completion bash) \
       --fish <($out/bin/shiori completion fish) \
diff --git a/pkgs/by-name/sh/shopware-cli/package.nix b/pkgs/by-name/sh/shopware-cli/package.nix
index 0efbe10caeda..d2473cac7fb1 100644
--- a/pkgs/by-name/sh/shopware-cli/package.nix
+++ b/pkgs/by-name/sh/shopware-cli/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -29,7 +30,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-Ckn6+DzHPX+UG5YxYqvkdaio/elRQssbDSR+zAfxzdE=";
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd shopware-cli \
       --bash <($out/bin/shopware-cli completion bash) \
       --zsh <($out/bin/shopware-cli completion zsh) \
diff --git a/pkgs/by-name/sn/snac2/package.nix b/pkgs/by-name/sn/snac2/package.nix
index a8f7f20c8683..071223850fa7 100644
--- a/pkgs/by-name/sn/snac2/package.nix
+++ b/pkgs/by-name/sn/snac2/package.nix
@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "snac2";
-  version = "2.82";
+  version = "2.83";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "grunfink";
     repo = "snac2";
     tag = finalAttrs.version;
-    hash = "sha256-iYBxx1QqjK1fsrADIiyAzftpNoH33vKRbjkeppHL39k=";
+    hash = "sha256-5BpJKDXA3PO/ZCfFYMngWaAGns2+ANWCpLgiEi4CAXY=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/sp/spicedb-zed/package.nix b/pkgs/by-name/sp/spicedb-zed/package.nix
index cc3774c8f858..cadd00eb9710 100644
--- a/pkgs/by-name/sp/spicedb-zed/package.nix
+++ b/pkgs/by-name/sp/spicedb-zed/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -26,7 +27,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd zed \
       --bash <($out/bin/zed completion bash) \
       --fish <($out/bin/zed completion fish) \
diff --git a/pkgs/by-name/sp/spicedb/package.nix b/pkgs/by-name/sp/spicedb/package.nix
index 501fb8e22c54..9db7a3e2e5df 100644
--- a/pkgs/by-name/sp/spicedb/package.nix
+++ b/pkgs/by-name/sp/spicedb/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -26,7 +27,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd spicedb \
       --bash <($out/bin/spicedb completion bash) \
       --fish <($out/bin/spicedb completion fish) \
diff --git a/pkgs/by-name/sp/spral/package.nix b/pkgs/by-name/sp/spral/package.nix
index e549eda0e881..e8f7a940e61c 100644
--- a/pkgs/by-name/sp/spral/package.nix
+++ b/pkgs/by-name/sp/spral/package.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spral";
-  version = "2025.05.20";
+  version = "2025.09.18";
 
   src = fetchFromGitHub {
     owner = "ralna";
     repo = "spral";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9QEcAOFB3CtGNqr8LoDaj2vP3KMONlUVooeXECtGsxc=";
+    hash = "sha256-ftyA6zP+VX0fb7e9YKjPCAWYblNyjX/eVeni1tRQIxY=";
   };
 
   # Ignore a failing test on darwin
diff --git a/pkgs/by-name/sq/sq/package.nix b/pkgs/by-name/sq/sq/package.nix
index 29f32422002f..fcbb65d9590a 100644
--- a/pkgs/by-name/sq/sq/package.nix
+++ b/pkgs/by-name/sq/sq/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -33,7 +34,7 @@ buildGoModule rec {
     "-X=github.com/neilotoole/sq/cli/buildinfo.Version=v${version}"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd sq \
       --bash <($out/bin/sq completion bash) \
       --fish <($out/bin/sq completion fish) \
diff --git a/pkgs/by-name/sr/srgn/package.nix b/pkgs/by-name/sr/srgn/package.nix
index 706f74f17cff..84f1ead7f2af 100644
--- a/pkgs/by-name/sr/srgn/package.nix
+++ b/pkgs/by-name/sr/srgn/package.nix
@@ -3,6 +3,7 @@
   fetchFromGitHub,
   installShellFiles,
   lib,
+  stdenv,
 }:
 rustPlatform.buildRustPackage rec {
   pname = "srgn";
@@ -19,7 +20,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     for shell in bash zsh fish; do
       installShellCompletion --cmd srgn "--$shell" <("$out/bin/srgn" --completions "$shell")
     done
diff --git a/pkgs/by-name/st/starboard/package.nix b/pkgs/by-name/st/starboard/package.nix
index eb82de1c1d52..15aeadd2e86b 100644
--- a/pkgs/by-name/st/starboard/package.nix
+++ b/pkgs/by-name/st/starboard/package.nix
@@ -63,7 +63,7 @@ buildGoModule (finalAttrs: {
     }
   '';
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd starboard \
       --bash <($out/bin/starboard completion bash) \
       --fish <($out/bin/starboard completion fish) \
diff --git a/pkgs/by-name/st/stripe-cli/package.nix b/pkgs/by-name/st/stripe-cli/package.nix
index e4d50aab978c..c9733e739d09 100644
--- a/pkgs/by-name/st/stripe-cli/package.nix
+++ b/pkgs/by-name/st/stripe-cli/package.nix
@@ -54,7 +54,7 @@ buildGoModule rec {
         rm pkg/plugins/plugin_test.go
       '';
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd stripe \
       --bash <($out/bin/stripe completion --write-to-stdout --shell bash) \
       --zsh <($out/bin/stripe completion --write-to-stdout --shell zsh)
diff --git a/pkgs/by-name/st/sttr/package.nix b/pkgs/by-name/st/sttr/package.nix
index 2bef2f2e42cd..edd6bd3c2a24 100644
--- a/pkgs/by-name/st/sttr/package.nix
+++ b/pkgs/by-name/st/sttr/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -26,7 +27,7 @@ buildGoModule rec {
     "-X=main.version=${version}"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd sttr \
       --bash <($out/bin/sttr completion bash) \
       --fish <($out/bin/sttr completion fish) \
diff --git a/pkgs/by-name/su/subtitlr/package.nix b/pkgs/by-name/su/subtitlr/package.nix
index 4d06c340010e..225d8c313924 100644
--- a/pkgs/by-name/su/subtitlr/package.nix
+++ b/pkgs/by-name/su/subtitlr/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -27,7 +28,7 @@ buildGoModule rec {
     installShellFiles
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd Subtitlr \
       --bash <($out/bin/Subtitlr completion bash) \
       --fish <($out/bin/Subtitlr completion fish) \
diff --git a/pkgs/by-name/sw/switch-to-configuration-ng/src/build.rs b/pkgs/by-name/sw/switch-to-configuration-ng/src/build.rs
index 41fed3086e69..bc07ec47a661 100644
--- a/pkgs/by-name/sw/switch-to-configuration-ng/src/build.rs
+++ b/pkgs/by-name/sw/switch-to-configuration-ng/src/build.rs
@@ -18,6 +18,10 @@ fn main() {
 
     let out_path = std::path::PathBuf::from(std::env::var("OUT_DIR").unwrap());
 
+    let fdo_dbus_code = code_for_dbus_xml("org.freedesktop.DBus.xml");
+    let mut file = std::fs::File::create(out_path.join("fdo_dbus.rs")).unwrap();
+    file.write_all(fdo_dbus_code.as_bytes()).unwrap();
+
     let systemd_manager_code =
         code_for_dbus_xml(systemd_dbus_interface_dir.join("org.freedesktop.systemd1.Manager.xml"));
     let mut file = std::fs::File::create(out_path.join("systemd_manager.rs")).unwrap();
diff --git a/pkgs/by-name/sw/switch-to-configuration-ng/src/org.freedesktop.DBus.xml b/pkgs/by-name/sw/switch-to-configuration-ng/src/org.freedesktop.DBus.xml
new file mode 100644
index 000000000000..6ab33de9dc40
--- /dev/null
+++ b/pkgs/by-name/sw/switch-to-configuration-ng/src/org.freedesktop.DBus.xml
@@ -0,0 +1,12 @@
+<!DOCTYPE node PUBLIC "-//freedesktop//DTD D-BUS Object Introspection 1.0//EN"
+"https://www.freedesktop.org/standards/dbus/1.0/introspect.dtd">
+<node>
+  <!-- From https://dbus.freedesktop.org/doc/dbus-specification.html#message-bus-messages. -->
+  <interface name="org.freedesktop.DBus">
+    <signal name="NameOwnerChanged">
+      <arg type="s" direction="out" name="name"/>
+      <arg type="s" direction="out" name="old_owner"/>
+      <arg type="s" direction="out" name="new_owner"/>
+    </signal>
+  </interface>
+</node>
diff --git a/pkgs/by-name/sw/switch-to-configuration-ng/src/src/main.rs b/pkgs/by-name/sw/switch-to-configuration-ng/src/src/main.rs
index f4d339ccf60e..4e84e8d1ae09 100644
--- a/pkgs/by-name/sw/switch-to-configuration-ng/src/src/main.rs
+++ b/pkgs/by-name/sw/switch-to-configuration-ng/src/src/main.rs
@@ -17,6 +17,8 @@ use std::{
 use anyhow::{anyhow, bail, Context, Result};
 use dbus::{
     blocking::{stdintf::org_freedesktop_dbus::Properties, LocalConnection, Proxy},
+    channel::Sender,
+    strings::{BusName, Interface, Member},
     Message,
 };
 use glob::glob;
@@ -32,6 +34,15 @@ use nix::{
 use regex::Regex;
 use syslog::Facility;
 
+mod fdo_dbus {
+    #![allow(non_upper_case_globals)]
+    #![allow(non_camel_case_types)]
+    #![allow(non_snake_case)]
+    #![allow(unused)]
+    #![allow(clippy::all)]
+    include!(concat!(env!("OUT_DIR"), "/fdo_dbus.rs"));
+}
+
 mod systemd_manager {
     #![allow(non_upper_case_globals)]
     #![allow(non_camel_case_types)]
@@ -50,7 +61,9 @@ mod logind_manager {
     include!(concat!(env!("OUT_DIR"), "/logind_manager.rs"));
 }
 
-use crate::systemd_manager::OrgFreedesktopSystemd1Manager;
+use crate::{
+    fdo_dbus::OrgFreedesktopDBusNameOwnerChanged, systemd_manager::OrgFreedesktopSystemd1Manager,
+};
 use crate::{
     logind_manager::OrgFreedesktopLogin1Manager,
     systemd_manager::{
@@ -894,20 +907,27 @@ impl std::fmt::Display for Job {
     }
 }
 
-fn new_dbus_proxies(
-    conn: &LocalConnection,
-) -> (Proxy<'_, &LocalConnection>, Proxy<'_, &LocalConnection>) {
-    (
-        conn.with_proxy(
-            "org.freedesktop.systemd1",
-            "/org/freedesktop/systemd1",
-            Duration::from_millis(10000),
-        ),
-        conn.with_proxy(
-            "org.freedesktop.login1",
-            "/org/freedesktop/login1",
-            Duration::from_millis(10000),
-        ),
+fn fdo_dbus_proxy(conn: &LocalConnection) -> Proxy<'_, &LocalConnection> {
+    conn.with_proxy(
+        "org.freedesktop.DBus",
+        "/org/freedesktop/DBus",
+        Duration::from_millis(500),
+    )
+}
+
+fn systemd1_proxy(conn: &LocalConnection) -> Proxy<'_, &LocalConnection> {
+    conn.with_proxy(
+        "org.freedesktop.systemd1",
+        "/org/freedesktop/systemd1",
+        Duration::from_millis(10000),
+    )
+}
+
+fn login1_proxy(conn: &LocalConnection) -> Proxy<'_, &LocalConnection> {
+    conn.with_proxy(
+        "org.freedesktop.login1",
+        "/org/freedesktop/login1",
+        Duration::from_millis(10000),
     )
 }
 
@@ -931,6 +951,54 @@ fn remove_file_if_exists(p: impl AsRef<Path>) -> std::io::Result<()> {
     }
 }
 
+fn reexecute_systemd_manager(
+    dbus_conn: &LocalConnection,
+    fdo_dbus: &Proxy<'_, &LocalConnection>,
+) -> anyhow::Result<()> {
+    let reexecute_done = Rc::new(RefCell::new(false));
+    let _reexecute_done = reexecute_done.clone();
+    let owner_changed_token = fdo_dbus
+        .match_signal(
+            move |signal: OrgFreedesktopDBusNameOwnerChanged, _: &LocalConnection, _: &Message| {
+                if signal.name.as_str() == "org.freedesktop.systemd1" {
+                    *_reexecute_done.borrow_mut() = true;
+                }
+
+                true
+            },
+        )
+        .context("Failed to add signal match for DBus name owner changes")?;
+
+    let bus_name = BusName::from("org.freedesktop.systemd1");
+    let object_path = dbus::Path::from("/org/freedesktop/systemd1");
+    let interface = Interface::new("org.freedesktop.systemd1.Manager")
+        .expect("the org.freedesktop.systemd1.Manager interface name should be valid");
+    let method_name = Member::new("Reexecute").expect("the Reexecute method name should be valid");
+
+    // Systemd does not reply to the Reexecute method.
+    let _serial = dbus_conn
+        .send(Message::method_call(
+            &bus_name,
+            &object_path,
+            &interface,
+            &method_name,
+        ))
+        .map_err(|_err| anyhow!("Failed to send org.freedesktop.systemd1.Manager.Reexecute"))?;
+
+    log::debug!("waiting for systemd to finish reexecuting");
+    while !*reexecute_done.borrow() {
+        _ = dbus_conn
+            .process(Duration::from_secs(500))
+            .context("Failed to process dbus messages")?;
+    }
+
+    dbus_conn
+        .remove_match(owner_changed_token)
+        .context("Failed to remove jobs token")?;
+
+    Ok(())
+}
+
 /// Performs switch-to-configuration functionality for a single non-root user
 fn do_user_switch(parent_exe: String) -> anyhow::Result<()> {
     if Path::new(&parent_exe)
@@ -946,7 +1014,10 @@ fn do_user_switch(parent_exe: String) -> anyhow::Result<()> {
     }
 
     let dbus_conn = LocalConnection::new_session().context("Failed to open dbus connection")?;
-    let (systemd, _) = new_dbus_proxies(&dbus_conn);
+    let fdo_dbus = fdo_dbus_proxy(&dbus_conn);
+    let systemd = systemd1_proxy(&dbus_conn);
+
+    reexecute_systemd_manager(&dbus_conn, &fdo_dbus)?;
 
     let nixos_activation_done = Rc::new(RefCell::new(false));
     let _nixos_activation_done = nixos_activation_done.clone();
@@ -964,10 +1035,6 @@ fn do_user_switch(parent_exe: String) -> anyhow::Result<()> {
         )
         .context("Failed to add signal match for systemd removed jobs")?;
 
-    // The systemd user session seems to not send a Reloaded signal, so we don't have anything to
-    // wait on here.
-    _ = systemd.reexecute();
-
     systemd
         .restart_unit("nixos-activation.service", "replace")
         .context("Failed to restart nixos-activation.service")?;
@@ -1140,7 +1207,9 @@ won't take effect until you reboot the system.
     let mut units_to_reload = map_from_list_file(RELOAD_LIST_FILE);
 
     let dbus_conn = LocalConnection::new_system().context("Failed to open dbus connection")?;
-    let (systemd, logind) = new_dbus_proxies(&dbus_conn);
+    let fdo_dbus = fdo_dbus_proxy(&dbus_conn);
+    let systemd = systemd1_proxy(&dbus_conn);
+    let logind = login1_proxy(&dbus_conn);
 
     let submitted_jobs = Rc::new(RefCell::new(HashMap::new()));
     let finished_jobs = Rc::new(RefCell::new(HashMap::new()));
@@ -1664,7 +1733,7 @@ won't take effect until you reboot the system.
     // just in case the new one has trouble communicating with the running pid 1.
     if restart_systemd {
         eprintln!("restarting systemd...");
-        _ = systemd.reexecute(); // we don't get a dbus reply here
+        reexecute_systemd_manager(&dbus_conn, &fdo_dbus)?;
 
         log::debug!("waiting for systemd restart to finish");
         while !*systemd_reload_status.borrow() {
diff --git a/pkgs/by-name/sy/syft/package.nix b/pkgs/by-name/sy/syft/package.nix
index 32298b025271..32cfb2219905 100644
--- a/pkgs/by-name/sy/syft/package.nix
+++ b/pkgs/by-name/sy/syft/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -56,7 +57,7 @@ buildGoModule rec {
   # tests require a running docker instance
   doCheck = false;
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd syft \
       --bash <($out/bin/syft completion bash) \
       --fish <($out/bin/syft completion fish) \
diff --git a/pkgs/by-name/ta/talosctl/package.nix b/pkgs/by-name/ta/talosctl/package.nix
index c176479b7302..e13e9fb5f564 100644
--- a/pkgs/by-name/ta/talosctl/package.nix
+++ b/pkgs/by-name/ta/talosctl/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -30,7 +31,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd talosctl \
       --bash <($out/bin/talosctl completion bash) \
       --fish <($out/bin/talosctl completion fish) \
diff --git a/pkgs/by-name/te/temporal-cli/package.nix b/pkgs/by-name/te/temporal-cli/package.nix
index ea43d1df4d01..4160e8915212 100644
--- a/pkgs/by-name/te/temporal-cli/package.nix
+++ b/pkgs/by-name/te/temporal-cli/package.nix
@@ -47,7 +47,7 @@ buildGoModule (finalAttrs: {
     export HOME="$(mktemp -d)"
   '';
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd temporal \
       --bash <($out/bin/temporal completion bash) \
       --fish <($out/bin/temporal completion fish) \
diff --git a/pkgs/by-name/te/terraform-backend-git/package.nix b/pkgs/by-name/te/terraform-backend-git/package.nix
index 0df99f3ddce7..fb15682656bc 100644
--- a/pkgs/by-name/te/terraform-backend-git/package.nix
+++ b/pkgs/by-name/te/terraform-backend-git/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -28,7 +29,7 @@ buildGoModule rec {
     "-X=github.com/plumber-cd/terraform-backend-git/cmd.Version=${version}"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd terraform-backend-git \
       --bash <($out/bin/terraform-backend-git completion bash) \
       --fish <($out/bin/terraform-backend-git completion fish) \
diff --git a/pkgs/by-name/te/terraform-docs/package.nix b/pkgs/by-name/te/terraform-docs/package.nix
index fbee13db8c5c..6877d5786fe4 100644
--- a/pkgs/by-name/te/terraform-docs/package.nix
+++ b/pkgs/by-name/te/terraform-docs/package.nix
@@ -1,23 +1,35 @@
 {
   stdenv,
   lib,
-  buildGoModule,
+  # Build fails with Go 1.25, with the following error:
+  # 'vendor/golang.org/x/tools/internal/tokeninternal/tokeninternal.go:64:9: invalid array length -delta * delta (constant -256 of type int64)'
+  # Wait for upstream to update their vendored dependencies before unpinning.
+  buildGo124Module,
   fetchFromGitHub,
   installShellFiles,
+  testers,
 }:
-buildGoModule rec {
+
+buildGo124Module (finalAttrs: {
   pname = "terraform-docs";
   version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "terraform-docs";
     repo = "terraform-docs";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-DiKoYAe7vcNy35ormKHYZcZrGK/MEb6VmcHWPgrbmUg=";
   };
 
   vendorHash = "sha256-ynyYpX41LJxGhf5kF2AULj+VKROjsvTjVPBnqG+JGSg=";
 
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  env.CGO_ENABLED = 0;
+
   excludedPackages = [ "scripts" ];
 
   nativeBuildInputs = [ installShellFiles ];
@@ -29,11 +41,19 @@ buildGoModule rec {
     installShellCompletion terraform-docs.{bash,fish,zsh}
   '';
 
+  passthru.tests.version = testers.testVersion {
+    package = finalAttrs.finalPackage;
+    version = "v${finalAttrs.version}";
+  };
+
   meta = with lib; {
     description = "Utility to generate documentation from Terraform modules in various output formats";
     mainProgram = "terraform-docs";
     homepage = "https://github.com/terraform-docs/terraform-docs/";
     license = licenses.mit;
-    maintainers = with maintainers; [ zimbatm ];
+    maintainers = with maintainers; [
+      zimbatm
+      anthonyroussel
+    ];
   };
-}
+})
diff --git a/pkgs/by-name/th/threatest/package.nix b/pkgs/by-name/th/threatest/package.nix
index badb6e0e2171..c221ffed03ee 100644
--- a/pkgs/by-name/th/threatest/package.nix
+++ b/pkgs/by-name/th/threatest/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -23,7 +24,7 @@ buildGoModule rec {
     installShellFiles
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd threatest \
       --bash <($out/bin/threatest completion bash) \
       --fish <($out/bin/threatest completion fish) \
diff --git a/pkgs/by-name/ti/timoni/package.nix b/pkgs/by-name/ti/timoni/package.nix
index 5d56c991b8c7..b5940eb3a44b 100644
--- a/pkgs/by-name/ti/timoni/package.nix
+++ b/pkgs/by-name/ti/timoni/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -31,7 +32,7 @@ buildGoModule (finalAttrs: {
     "-X main.VERSION=${finalAttrs.version}"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd timoni \
     --bash <($out/bin/timoni completion bash) \
     --fish <($out/bin/timoni completion fish) \
diff --git a/pkgs/by-name/to/tombi/package.nix b/pkgs/by-name/to/tombi/package.nix
index a3fdbb20a86f..1c98e19275f3 100644
--- a/pkgs/by-name/to/tombi/package.nix
+++ b/pkgs/by-name/to/tombi/package.nix
@@ -7,19 +7,19 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tombi";
-  version = "0.6.0";
+  version = "0.6.10";
 
   src = fetchFromGitHub {
     owner = "tombi-toml";
     repo = "tombi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-y12ZFjSUZWLuDItDxVYkVlvGHVDsDLavJ/5OLZVV1TA=";
+    hash = "sha256-d3wB5aLv0xTh2n3ESBN6hKjR2qlbOXJs4/4DYyJGn7c=";
   };
 
   # Tests relies on the presence of network
   doCheck = false;
   cargoBuildFlags = [ "--package tombi-cli" ];
-  cargoHash = "sha256-4Xab/7oT/pPHnUcWAOiAgTbEnR0u0t7uobUB7TCbc8k=";
+  cargoHash = "sha256-7fjvYvftnM6pHr40/uB0kkxuQ2CMPPd8asRgukHUY9k=";
 
   postPatch = ''
     substituteInPlace Cargo.toml \
diff --git a/pkgs/by-name/to/touchosc/package.nix b/pkgs/by-name/to/touchosc/package.nix
index b47d0dba904e..8344a56a4449 100644
--- a/pkgs/by-name/to/touchosc/package.nix
+++ b/pkgs/by-name/to/touchosc/package.nix
@@ -46,7 +46,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "touchosc";
-  version = "1.4.4.236";
+  version = "1.4.5.238";
 
   suffix =
     {
@@ -60,9 +60,9 @@ stdenv.mkDerivation rec {
     url = "https://hexler.net/pub/${pname}/${pname}-${version}-${suffix}.deb";
     hash =
       {
-        aarch64-linux = "sha256-bMC3FbamzpYqMSe4D20eulJOW4M7CVJrlFWpqv2iBJU=";
-        armv7l-linux = "sha256-tADriDthvPNx8u3/HvIthBzEbvRW/RDT5ZcnADfR2xA=";
-        x86_64-linux = "sha256-eCU0EpeL9C0eqklpczWzsw6cghJ8pLlChsHKuHqgLLA=";
+        aarch64-linux = "sha256-ITuIQfBw5LIN3sc11G78Pd5Ca4KDqxPhc9ArpGKBNzo=";
+        armv7l-linux = "sha256-DF7jTVp5Xieop6Q/EVznQmDlFFA5qaizXAoNwCXs/Hc=";
+        x86_64-linux = "sha256-6KpdwGXbyYwT0VhwPS9yP0c6HXUjKkGGmvZDiwQvlBw=";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
diff --git a/pkgs/by-name/tp/tpnote/package.nix b/pkgs/by-name/tp/tpnote/package.nix
index d81707fe938b..5dc592333593 100644
--- a/pkgs/by-name/tp/tpnote/package.nix
+++ b/pkgs/by-name/tp/tpnote/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tpnote";
-  version = "1.25.14";
+  version = "1.25.15";
 
   src = fetchFromGitHub {
     owner = "getreu";
     repo = "tp-note";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CgC4aLg1GdqDXzuWfV4i5C4//I3GJ2RJa0y3oFOM0II=";
+    hash = "sha256-vmHRpY2KvG6vxVQ6OVi/u6wpD8oqQFXn2IJOT0Nh/V0=";
   };
 
-  cargoHash = "sha256-LF17FrWiqfFaVFbOjm9GiW9AsZmleZL++i8YDyrVZVM=";
+  cargoHash = "sha256-dltBOA6pxy2gLemVoX8l0Z+xkiJvhGWSmediWWnN1bc=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/tr/trash-cli/package.nix b/pkgs/by-name/tr/trash-cli/package.nix
index b645d5a3ec78..f8420c82a270 100644
--- a/pkgs/by-name/tr/trash-cli/package.nix
+++ b/pkgs/by-name/tr/trash-cli/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   fetchFromGitHub,
   installShellFiles,
   nix-update-script,
@@ -65,7 +66,7 @@ python3Packages.buildPythonApplication rec {
 
   pythonImportsCheck = [ "trashcli" ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     for bin in trash-empty trash-list trash-restore trash-put trash; do
       installShellCompletion --cmd "$bin" \
         --bash <("$out/bin/$bin" --print-completion bash) \
diff --git a/pkgs/by-name/tr/tray-tui/package.nix b/pkgs/by-name/tr/tray-tui/package.nix
index e6755b43a5f3..620de265d995 100644
--- a/pkgs/by-name/tr/tray-tui/package.nix
+++ b/pkgs/by-name/tr/tray-tui/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   rustPlatform,
   fetchFromGitHub,
   installShellFiles,
@@ -22,7 +23,7 @@ rustPlatform.buildRustPackage rec {
     installShellFiles
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd tray-tui \
       --bash <($out/bin/tray-tui --completions bash) \
       --zsh <($out/bin/tray-tui --completions zsh) \
diff --git a/pkgs/by-name/ty/tyson/package.nix b/pkgs/by-name/ty/tyson/package.nix
index ace33ac47201..ddd04518a6b0 100644
--- a/pkgs/by-name/ty/tyson/package.nix
+++ b/pkgs/by-name/ty/tyson/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -27,7 +28,7 @@ buildGoModule rec {
     "-w"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd tyson \
       --bash <($out/bin/tyson completion bash) \
       --fish <($out/bin/tyson completion fish) \
diff --git a/pkgs/by-name/un/unison-ucm/package.nix b/pkgs/by-name/un/unison-ucm/package.nix
index c9602d1f46f0..d7c653248e85 100644
--- a/pkgs/by-name/un/unison-ucm/package.nix
+++ b/pkgs/by-name/un/unison-ucm/package.nix
@@ -14,21 +14,25 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "unison-code-manager";
-  version = "0.5.47";
+  version = "0.5.48";
 
   src =
     {
       aarch64-darwin = fetchurl {
         url = "https://github.com/unisonweb/unison/releases/download/release/${finalAttrs.version}/ucm-macos-arm64.tar.gz";
-        hash = "sha256-Ocqwh+kH4tLMTMthbezDB0o00TTF/d6n8CzQxR919hA=";
+        hash = "sha256-HtgVPgxwOYvsv6Z+qG0GMnRyqzm/AlLDdIrypjzCBHo=";
       };
       x86_64-darwin = fetchurl {
         url = "https://github.com/unisonweb/unison/releases/download/release/${finalAttrs.version}/ucm-macos-x64.tar.gz";
-        hash = "sha256-Fkouq/jv0Ddv1EjREtiGjMAEqdNoxwv4nqqp/nwf+zg=";
+        hash = "sha256-xtn8ozF2UdoSSYYCoYPh4AgbrYm+3vtmIRSXD8OWams=";
+      };
+      aarch64-linux = fetchurl {
+        url = "https://github.com/unisonweb/unison/releases/download/release/${finalAttrs.version}/ucm-linux-arm64.tar.gz";
+        hash = "sha256-xiEEkzdCS/HSEPLzuuDLh4iITsF2fuR51ACYQoQnzKQ=";
       };
       x86_64-linux = fetchurl {
         url = "https://github.com/unisonweb/unison/releases/download/release/${finalAttrs.version}/ucm-linux-x64.tar.gz";
-        hash = "sha256-RizYZaNdaXCkfiFXblB34btqmu6xo3owKkSuOrgopIo=";
+        hash = "sha256-CMiheW4z27awGIpAk/DQN+JAAU7ZvIyFAEAI+ZaQhpY=";
       };
     }
     .${stdenv.hostPlatform.system} or (throw "Unsupported platform ${stdenv.hostPlatform.system}");
@@ -82,6 +86,7 @@ stdenv.mkDerivation (finalAttrs: {
       "x86_64-darwin"
       "x86_64-linux"
       "aarch64-darwin"
+      "aarch64-linux"
     ];
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
   };
diff --git a/pkgs/by-name/up/updatecli/package.nix b/pkgs/by-name/up/updatecli/package.nix
index 5cc247e4f912..cb707b135540 100644
--- a/pkgs/by-name/up/updatecli/package.nix
+++ b/pkgs/by-name/up/updatecli/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   go,
   buildGoModule,
   fetchFromGitHub,
@@ -45,7 +46,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd updatecli \
       --bash <($out/bin/updatecli completion bash) \
       --fish <($out/bin/updatecli completion fish) \
diff --git a/pkgs/by-name/up/uplosi/package.nix b/pkgs/by-name/up/uplosi/package.nix
index 11f3d8d52e3c..daa4743654e2 100644
--- a/pkgs/by-name/up/uplosi/package.nix
+++ b/pkgs/by-name/up/uplosi/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   fetchFromGitHub,
   buildGoModule,
   installShellFiles,
@@ -27,7 +28,7 @@ buildGoModule (finalAttrs: {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd uplosi \
       --bash <($out/bin/uplosi completion bash) \
       --fish <($out/bin/uplosi completion fish) \
diff --git a/pkgs/by-name/us/usage/package.nix b/pkgs/by-name/us/usage/package.nix
index bede4026432a..75216b5b574c 100644
--- a/pkgs/by-name/us/usage/package.nix
+++ b/pkgs/by-name/us/usage/package.nix
@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd usage \
       --bash <($out/bin/usage --completions bash) \
       --fish <($out/bin/usage --completions fish) \
diff --git a/pkgs/by-name/ve/vexctl/package.nix b/pkgs/by-name/ve/vexctl/package.nix
index 60593041106b..e841f72bd0e9 100644
--- a/pkgs/by-name/ve/vexctl/package.nix
+++ b/pkgs/by-name/ve/vexctl/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -44,7 +45,7 @@ buildGoModule rec {
     ldflags+=" -X sigs.k8s.io/release-utils/version.buildDate=$(cat SOURCE_DATE_EPOCH)"
   '';
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd vexctl \
       --bash <($out/bin/vexctl completion bash) \
       --fish <($out/bin/vexctl completion fish) \
diff --git a/pkgs/by-name/vh/vhs/package.nix b/pkgs/by-name/vh/vhs/package.nix
index 5e8497453ed8..ecf7267f1091 100644
--- a/pkgs/by-name/vh/vhs/package.nix
+++ b/pkgs/by-name/vh/vhs/package.nix
@@ -44,6 +44,8 @@ buildGoModule rec {
         ]
       )
     }
+  ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     $out/bin/vhs man > vhs.1
     installManPage vhs.1
     installShellCompletion --cmd vhs \
diff --git a/pkgs/by-name/vi/vivify/package.nix b/pkgs/by-name/vi/vivify/package.nix
new file mode 100644
index 000000000000..e943e0e15d36
--- /dev/null
+++ b/pkgs/by-name/vi/vivify/package.nix
@@ -0,0 +1,85 @@
+{
+  lib,
+  stdenv,
+  fetchYarnDeps,
+  fetchFromGitHub,
+  yarnConfigHook,
+  npmHooks,
+  nodejs,
+  zip,
+  file,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "vivify";
+  version = "0.8.2";
+
+  src = fetchFromGitHub {
+    owner = "jannis-baum";
+    repo = "Vivify";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-2lxf21T9y4GMFlk0+qbaJJ/twRffYEBoBXZXe/NRDQk=";
+  };
+
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = "${finalAttrs.src}/yarn.lock";
+    hash = "sha256-mOgfwetiLMTDquw3f3+U1iEhBbvf0OC5lkNJHdrRSK0=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    yarn install
+
+    substituteInPlace node_modules/.bin/tsc \
+      --replace-fail '/usr/bin/env node' '${lib.getExe nodejs}'
+
+    substituteInPlace node_modules/.bin/webpack \
+      --replace-fail '/usr/bin/env node' '${lib.getExe nodejs}'
+
+    substituteInPlace node_modules/.bin/postject \
+      --replace-fail '/usr/bin/env node' '${lib.getExe nodejs}'
+
+    make linux
+
+    mkdir -p $out/bin
+    install -Dm755 ./build/linux/viv $out/bin/viv
+    install -Dm755 ./build/linux/vivify-server $out/bin/vivify-server
+
+    wrapProgram $out/bin/viv \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          nodejs
+          file
+        ]
+      }
+  '';
+
+  nativeBuildInputs = [
+    yarnConfigHook
+    npmHooks.npmInstallHook
+    zip
+
+    nodejs
+    file
+  ];
+
+  # Stripping 'unneeded symbols' causes vivify-server executable to break
+  # (segmentation fault)
+  dontStrip = true;
+
+  meta = {
+    description = "Live Markdown viewer";
+    longDescription = ''
+      Vivify brings your files to life in the browser!
+      Vivify is primarily made to render Markdown and Jupyter Notebooks, but will also
+      serve as a directory browser and let you view code files with syntax highlighting.
+    '';
+    homepage = "https://github.com/jannis-baum/Vivify";
+    changelog = "https://github.com/jannis-baum/Vivify/releases/tag/v${finalAttrs.src.tag}";
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ skohtv ];
+    platforms = lib.platforms.linux;
+    mainProgram = "viv";
+  };
+})
diff --git a/pkgs/by-name/vi/vixl/add_missing_meson_support.patch b/pkgs/by-name/vi/vixl/add_missing_meson_support.patch
new file mode 100644
index 000000000000..26f7acd92a00
--- /dev/null
+++ b/pkgs/by-name/vi/vixl/add_missing_meson_support.patch
@@ -0,0 +1,445 @@
+From 7c6adc3fbb3624261b9c4d4e0702018697486e3b Mon Sep 17 00:00:00 2001
+From: Andrea Pappacoda <andrea@pappacoda.it>
+Date: Wed, 7 Aug 2024 00:11:15 +0200
+Subject: [PATCH] build: add Meson support
+
+I was trying to package Vixl, but the SCons build system does not
+provide an install target, so I would've had to add it. It seemed too
+difficult, so I directly created a quite basic Meson build script.
+
+It provides most features of the SCons script, except for tests and
+benchmarks, while adding a rich install target, with library soname
+versioning and a pkg-config file.
+
+Meson is a simple yet powerful build system, and you're interested in
+using it as your main build system I could add tests and benchmarks :)
+
+Origin: upstream, https://github.com/Linaro/vixl/pull/7
+Last-Update: 2025-03-22
+---
+ AUTHORS                        |   1 +
+ doc/aarch32/meson.build        |  12 +++
+ doc/aarch64/meson.build        |  21 +++++
+ doc/aarch64/topics/meson.build |  21 +++++
+ doc/meson.build                |  21 +++++
+ meson.build                    | 158 +++++++++++++++++++++++++++++++++
+ meson_options.txt              |  40 +++++++++
+ src/aarch32/meson.build        |  30 +++++++
+ src/aarch64/meson.build        |  47 ++++++++++
+ 9 files changed, 351 insertions(+)
+ create mode 100644 doc/aarch32/meson.build
+ create mode 100644 doc/aarch64/meson.build
+ create mode 100644 doc/aarch64/topics/meson.build
+ create mode 100644 doc/meson.build
+ create mode 100644 meson.build
+ create mode 100644 meson_options.txt
+ create mode 100644 src/aarch32/meson.build
+ create mode 100644 src/aarch64/meson.build
+
+diff --git a/AUTHORS b/AUTHORS
+index 257ec9d3..13809d26 100644
+--- a/AUTHORS
++++ b/AUTHORS
+@@ -6,3 +6,4 @@
+ ARM Ltd. <*@arm.com>
+ Google Inc. <*@google.com>
+ Linaro <*@linaro.org>
++Andrea Pappacoda <andrea@pappacoda.it>
+diff --git a/doc/aarch32/meson.build b/doc/aarch32/meson.build
+new file mode 100644
+index 00000000..e07fc46d
+--- /dev/null
++++ b/doc/aarch32/meson.build
+@@ -0,0 +1,12 @@
++# SPDX-FileCopyrightText: 2021 VIXL authors
++# SPDX-License-Identifier: BSD-3-Clause
++
++custom_target(
++  'doc_aarch32',
++  command: [markdown, '@INPUT@'],
++  input: 'getting-started-aarch32.md',
++  output: '@BASENAME@.html',
++  capture: true,
++  install: true,
++  install_dir: doc_dir/'aarch32'
++)
+diff --git a/doc/aarch64/meson.build b/doc/aarch64/meson.build
+new file mode 100644
+index 00000000..d25f8bfa
+--- /dev/null
++++ b/doc/aarch64/meson.build
+@@ -0,0 +1,21 @@
++# SPDX-FileCopyrightText: 2021 VIXL authors
++# SPDX-License-Identifier: BSD-3-Clause
++
++doc_aarch64_files = [
++  'getting-started-aarch64',
++  'supported-instructions-aarch64'
++]
++
++foreach file : doc_aarch64_files
++  custom_target(
++    'doc_aarch64_' + file,
++    command: [markdown, '@INPUT@'],
++    input: file + '.md',
++    output: file + '.html',
++    capture: true,
++    install: true,
++    install_dir: doc_dir/'aarch64'
++  )
++endforeach
++
++subdir('topics')
+diff --git a/doc/aarch64/topics/meson.build b/doc/aarch64/topics/meson.build
+new file mode 100644
+index 00000000..c6e8542b
+--- /dev/null
++++ b/doc/aarch64/topics/meson.build
+@@ -0,0 +1,21 @@
++# SPDX-FileCopyrightText: 2021 VIXL authors
++# SPDX-License-Identifier: BSD-3-Clause
++
++doc_aarch64_topics_files = [
++  'extending-the-disassembler',
++  'index',
++  'state-trace',
++  'ycm'
++]
++
++foreach file : doc_aarch64_topics_files
++  custom_target(
++    'doc_aarch64_topics_' + file,
++    command: [markdown, '@INPUT@'],
++    input: file + '.md',
++    output: file + '.html',
++    capture: true,
++    install: true,
++    install_dir: doc_dir/'aarch64'/'topics'
++  )
++endforeach
+diff --git a/doc/meson.build b/doc/meson.build
+new file mode 100644
+index 00000000..cbfe193d
+--- /dev/null
++++ b/doc/meson.build
+@@ -0,0 +1,21 @@
++# SPDX-FileCopyrightText: 2021 VIXL authors
++# SPDX-License-Identifier: BSD-3-Clause
++
++doc_dir = get_option('datadir')/'doc'/meson.project_name()
++
++custom_target(
++  'doc',
++  command: [markdown, '@INPUT@'],
++  input: '..'/'README.md',
++  output: '@BASENAME@.html',
++  capture: true,
++  install: true,
++  install_dir: doc_dir
++)
++
++if build_a32 or build_t32
++  subdir('aarch32')
++endif
++if build_a64
++  subdir('aarch64')
++endif
+diff --git a/meson.build b/meson.build
+new file mode 100644
+index 00000000..e0f8f79a
+--- /dev/null
++++ b/meson.build
+@@ -0,0 +1,158 @@
++# SPDX-FileCopyrightText: 2021 VIXL authors
++# SPDX-License-Identifier: BSD-3-Clause
++
++project(
++  'vixl',
++  'cpp',
++  default_options: [
++    'cpp_std=c++17',
++    'buildtype=release',
++    'warning_level=3',
++    'werror=true',
++    'd_ndebug=if-release',
++    'b_lto=true'
++  ],
++  license: 'BSD-3-Clause',
++  meson_version: '>=0.50.0',
++  version: '8.0.0',
++)
++
++deps = []
++extra_args = []
++
++if get_option('debug')
++  extra_args += '-DVIXL_DEBUG'
++endif
++
++hosts_32bit = ['arc', 'arm', 'c2000', 'csky', 'mips', 'ppc', 'riscv32', 'rx', 'sparc', 'wasm32', 'x86']
++can_target_aarch64 = not (host_machine.cpu_family() in hosts_32bit)
++
++build_a32 = false
++build_t32 = false
++build_a64 = false
++
++targets = get_option('target')
++if 'auto' in targets or 'all' in targets
++  if can_target_aarch64 or 'all' in targets
++    extra_args += [
++      '-DVIXL_INCLUDE_TARGET_A32',
++      '-DVIXL_INCLUDE_TARGET_T32',
++      '-DVIXL_INCLUDE_TARGET_A64'
++    ]
++    build_a32 = true
++    build_t32 = true
++    build_a64 = true
++  else
++    extra_args += [
++      '-DVIXL_INCLUDE_TARGET_A32',
++      '-DVIXL_INCLUDE_TARGET_T32'
++    ]
++    build_a32 = true
++    build_t32 = true
++  endif
++else
++  if 'a32' in targets or 'aarch32' in targets
++    extra_args += [
++      '-DVIXL_INCLUDE_TARGET_A32'
++    ]
++    build_a32 = true
++  endif
++  if 't32' in targets or 'aarch32' in targets
++    extra_args += [
++      '-DVIXL_INCLUDE_TARGET_T32'
++    ]
++    build_t32 = true
++  endif
++  if 'a64' in targets or 'aarch64' in targets
++    extra_args += [
++      '-DVIXL_INCLUDE_TARGET_A64'
++    ]
++    build_a64 = true
++  endif
++endif
++
++target_sources = []
++if build_a32 or build_t32
++  subdir('src'/'aarch32')
++endif
++if build_a64
++  subdir('src'/'aarch64')
++endif
++
++if get_option('simulator') == 'auto'
++  if not (host_machine.cpu_family() == 'aarch64') and can_target_aarch64
++    extra_args += '-DVIXL_INCLUDE_SIMULATOR_AARCH64'
++    deps += dependency('threads')
++  endif
++elif get_option('simulator') == 'aarch64'
++  if can_target_aarch64 and build_a64
++    extra_args += '-DVIXL_INCLUDE_SIMULATOR_AARCH64'
++    deps += dependency('threads')
++  else
++    error('Building an AArch64 simulator implies that VIXL targets AArch64. Set `target` to include `aarch64` or `a64`.')
++  endif
++endif
++
++allocator = get_option('code_buffer_allocator')
++if (allocator == 'auto' and host_machine.system() == 'linux') or allocator == 'mmap'
++  extra_args += '-DVIXL_CODE_BUFFER_MMAP'
++else
++  extra_args += '-DVIXL_CODE_BUFFER_MALLOC'
++endif
++
++if get_option('implicit_checks')
++  extra_args += '-DVIXL_ENABLE_IMPLICIT_CHECKS'
++endif
++
++markdown = find_program('markdown', required: get_option('doc'))
++if markdown.found()
++  subdir('doc')
++endif
++
++libvixl = library(
++  'vixl',
++  'src'/'code-buffer-vixl.cc',
++  'src'/'compiler-intrinsics-vixl.cc',
++  'src'/'cpu-features.cc',
++  'src'/'utils-vixl.cc',
++  cpp_args: extra_args,
++  include_directories: 'src',
++  dependencies: deps,
++  install: true,
++  sources: target_sources,
++  version: meson.project_version()
++)
++
++vixl_dep = declare_dependency(
++  compile_args: extra_args,
++  include_directories: 'src',
++  link_with: libvixl
++)
++
++if meson.version().version_compare('>=0.54.0')
++  meson.override_dependency('vixl', vixl_dep)
++endif
++
++install_headers(
++  'src'/'assembler-base-vixl.h',
++  'src'/'code-buffer-vixl.h',
++  'src'/'code-generation-scopes-vixl.h',
++  'src'/'compiler-intrinsics-vixl.h',
++  'src'/'cpu-features.h',
++  'src'/'globals-vixl.h',
++  'src'/'invalset-vixl.h',
++  'src'/'macro-assembler-interface.h',
++  'src'/'platform-vixl.h',
++  'src'/'pool-manager-impl.h',
++  'src'/'pool-manager.h',
++  'src'/'utils-vixl.h',
++  subdir: 'vixl'
++)
++
++import('pkgconfig').generate(
++  libvixl,
++  description: 'ARMv8 Runtime Code Generation Library',
++  extra_cflags: extra_args,
++  subdirs: 'vixl',
++  url: 'https://github.com/Linaro/vixl'
++)
+diff --git a/meson_options.txt b/meson_options.txt
+new file mode 100644
+index 00000000..b7b5428d
+--- /dev/null
++++ b/meson_options.txt
+@@ -0,0 +1,40 @@
++# SPDX-FileCopyrightText: 2021 VIXL authors
++# SPDX-License-Identifier: BSD-3-Clause
++
++option(
++  'target',
++  type: 'array',
++  choices: ['auto', 'all', 'aarch32', 'a32', 't32', 'aarch64', 'a64'],
++  value: ['auto'],
++  description: 'Target ISA/Architecture'
++)
++
++option(
++  'simulator',
++  type: 'combo',
++  choices: ['auto', 'aarch64', 'none'],
++  value: 'auto',
++  description: 'Simulators to include'
++)
++
++option(
++  'code_buffer_allocator',
++  type: 'combo',
++  choices: ['auto', 'malloc', 'mmap'],
++  value: 'auto',
++  description: 'Configure the allocation mechanism in the CodeBuffer'
++)
++
++option(
++  'implicit_checks',
++  type: 'boolean',
++  value: false,
++  description: 'Allow signals raised from simulated invalid (e.g: out of bounds) memory reads to be handled by the host.'
++)
++
++option(
++  'doc',
++  type: 'feature',
++  value: 'auto',
++  description: 'Convert documentation to HTML (requires the `markdown` program)'
++)
+diff --git a/src/aarch32/meson.build b/src/aarch32/meson.build
+new file mode 100644
+index 00000000..0b22336f
+--- /dev/null
++++ b/src/aarch32/meson.build
+@@ -0,0 +1,30 @@
++# SPDX-FileCopyrightText: 2021 VIXL authors
++# SPDX-License-Identifier: BSD-3-Clause
++
++# Need to wrap the filenames in files() otherwise this array would be treated
++# as a simple array of strings, and when used in the master meson.build they
++# would refer to nonexistent paths. Wrapping in files() ensures that the
++# filenames will be always relative to this directory, even if referenced in
++# a different one. As a general rule, when I need to refer to a file from a
++# different build directory I should wrap it in files().
++
++target_sources += files(
++  'assembler-aarch32.cc',
++  'constants-aarch32.cc',
++  'disasm-aarch32.cc',
++  'instructions-aarch32.cc',
++  'location-aarch32.cc',
++  'macro-assembler-aarch32.cc',
++  'operands-aarch32.cc'
++)
++
++install_headers(
++  'assembler-aarch32.h',
++  'constants-aarch32.h',
++  'disasm-aarch32.h',
++  'instructions-aarch32.h',
++  'location-aarch32.h',
++  'macro-assembler-aarch32.h',
++  'operands-aarch32.h',
++  subdir: 'vixl'/'aarch32'
++)
+diff --git a/src/aarch64/meson.build b/src/aarch64/meson.build
+new file mode 100644
+index 00000000..2898c8f6
+--- /dev/null
++++ b/src/aarch64/meson.build
+@@ -0,0 +1,47 @@
++# SPDX-FileCopyrightText: 2021 VIXL authors
++# SPDX-License-Identifier: BSD-3-Clause
++
++# Need to wrap the filenames in files() otherwise this array would be treated
++# as a simple array of strings, and when used in the master meson.build they
++# would refer to nonexistent paths. Wrapping in files() ensures that the
++# filenames will be always relative to this directory, even if referenced in
++# a different one. As a general rule, when I need to refer to a file from a
++# different build directory I should wrap it in files().
++
++target_sources += files(
++  'assembler-aarch64.cc',
++  'assembler-sve-aarch64.cc',
++  'cpu-aarch64.cc',
++  'cpu-features-auditor-aarch64.cc',
++  'debugger-aarch64.cc',
++  'decoder-aarch64.cc',
++  'disasm-aarch64.cc',
++  'instructions-aarch64.cc',
++  'logic-aarch64.cc',
++  'macro-assembler-aarch64.cc',
++  'macro-assembler-sve-aarch64.cc',
++  'operands-aarch64.cc',
++  'pointer-auth-aarch64.cc',
++  'registers-aarch64.cc',
++  'simulator-aarch64.cc'
++)
++
++install_headers(
++  'abi-aarch64.h',
++  'assembler-aarch64.h',
++  'constants-aarch64.h',
++  'cpu-aarch64.h',
++  'cpu-features-auditor-aarch64.h',
++  'debugger-aarch64.h',
++  'decoder-aarch64.h',
++  'decoder-constants-aarch64.h',
++  'decoder-visitor-map-aarch64.h',
++  'disasm-aarch64.h',
++  'instructions-aarch64.h',
++  'macro-assembler-aarch64.h',
++  'operands-aarch64.h',
++  'registers-aarch64.h',
++  'simulator-aarch64.h',
++  'simulator-constants-aarch64.h',
++  subdir: 'vixl'/'aarch64'
++)
diff --git a/pkgs/by-name/vi/vixl/package.nix b/pkgs/by-name/vi/vixl/package.nix
new file mode 100644
index 000000000000..e91479f9c45e
--- /dev/null
+++ b/pkgs/by-name/vi/vixl/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  fetchpatch,
+  multimarkdown,
+  ninja,
+  pkg-config,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "vixl";
+  version = "8.0.0";
+
+  src = fetchFromGitHub {
+    owner = "Linaro";
+    repo = "vixl";
+    tag = finalAttrs.version;
+    hash = "sha256-VW4Zoh4L8AXoL2kgthAtHkrTnoKpSa9MsBTEGROUrj4=";
+  };
+
+  # Add missing meson build support
+  # See: https://github.com/Linaro/vixl/pull/7
+  patches = [ ./add_missing_meson_support.patch ];
+
+  nativeBuildInputs = [
+    meson
+    multimarkdown
+    ninja
+    pkg-config
+  ];
+
+  strictDeps = true;
+
+  meta = {
+    description = "AArch32 and AArch64 runtime code generation library";
+    homepage = "https://github.com/Linaro/vixl";
+    license = lib.licenses.bsd3;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ onny ];
+  };
+})
diff --git a/pkgs/by-name/wa/wal-g/package.nix b/pkgs/by-name/wa/wal-g/package.nix
index ab32ee07909c..4ec7c1bb571d 100644
--- a/pkgs/by-name/wa/wal-g/package.nix
+++ b/pkgs/by-name/wa/wal-g/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   brotli,
@@ -43,6 +44,8 @@ buildGoModule rec {
 
   postInstall = ''
     mv $out/bin/pg $out/bin/wal-g
+  ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd wal-g \
       --bash <($out/bin/wal-g completion bash) \
       --zsh <($out/bin/wal-g completion zsh)
diff --git a/pkgs/by-name/wa/wander/package.nix b/pkgs/by-name/wa/wander/package.nix
index 2fe965315ce3..7c24a72b82a2 100644
--- a/pkgs/by-name/wa/wander/package.nix
+++ b/pkgs/by-name/wa/wander/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -25,7 +26,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd wander \
       --fish <($out/bin/wander completion fish) \
       --bash <($out/bin/wander completion bash) \
diff --git a/pkgs/by-name/we/weblate/package.nix b/pkgs/by-name/we/weblate/package.nix
index 82870d55f22f..a84ece94bd64 100644
--- a/pkgs/by-name/we/weblate/package.nix
+++ b/pkgs/by-name/we/weblate/package.nix
@@ -27,7 +27,7 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "weblate";
-  version = "5.13.1";
+  version = "5.13.3";
 
   pyproject = true;
 
@@ -40,7 +40,7 @@ python.pkgs.buildPythonApplication rec {
     owner = "WeblateOrg";
     repo = "weblate";
     tag = "weblate-${version}";
-    hash = "sha256-so+bpjuWgyLiSfTCL8+WqGNZYaqnENKXWqiojD47WwU=";
+    hash = "sha256-PM5h9RqCMdt0FODE7MoCWv9I+RMFTgjDmSrid59cHOA=";
   };
 
   build-system = with python.pkgs; [ setuptools ];
diff --git a/pkgs/by-name/we/websocketpp/package.nix b/pkgs/by-name/we/websocketpp/package.nix
index 6b933480b0ba..aa3abf8d9388 100644
--- a/pkgs/by-name/we/websocketpp/package.nix
+++ b/pkgs/by-name/we/websocketpp/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
 }:
 
@@ -16,6 +17,13 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-9fIwouthv2GcmBe/UPvV7Xn9P2o0Kmn2hCI4jCh0hPM=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/zaphoyd/websocketpp/commit/deb0a334471362608958ce59a6b0bcd3e5b73c24.patch?full_index=1";
+      hash = "sha256-bFCHwtRuCFz9vr4trmmBLziPSlEx6SNjsTcBv9zV8go=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ];
 
   meta = with lib; {
diff --git a/pkgs/by-name/we/werf/package.nix b/pkgs/by-name/we/werf/package.nix
index ed07c3da5480..731d339129f6 100644
--- a/pkgs/by-name/we/werf/package.nix
+++ b/pkgs/by-name/we/werf/package.nix
@@ -83,7 +83,7 @@ buildGoModule (finalAttrs: {
 
   versionCheckProgramArg = "version";
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     for shell in bash fish zsh; do
       installShellCompletion \
         --cmd werf \
diff --git a/pkgs/by-name/wi/witness/package.nix b/pkgs/by-name/wi/witness/package.nix
index 51bb59b5cc35..214aec9cf025 100644
--- a/pkgs/by-name/wi/witness/package.nix
+++ b/pkgs/by-name/wi/witness/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -39,7 +40,7 @@ buildGoModule rec {
     unset subPackages
   '';
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd witness \
       --bash <($out/bin/witness completion bash) \
       --fish <($out/bin/witness completion fish) \
diff --git a/pkgs/by-name/xk/xk6/package.nix b/pkgs/by-name/xk/xk6/package.nix
index 82ffbfb45c63..b3d58e1a2378 100644
--- a/pkgs/by-name/xk/xk6/package.nix
+++ b/pkgs/by-name/xk/xk6/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "xk6";
-  version = "1.1.3";
+  version = "1.1.5";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "xk6";
     tag = "v${version}";
-    hash = "sha256-+sKZjC6H8ddRvCGFmUKp3H1BrLfoawWy3YCDY7bbnc0=";
+    hash = "sha256-+hWZWWrFkenzmaXAgzuZ9eWB4DmhQZNAQV+FYQdEg2U=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ya/yanic/package.nix b/pkgs/by-name/ya/yanic/package.nix
index 24cfcb6ffdd6..355b3dd56fe4 100644
--- a/pkgs/by-name/ya/yanic/package.nix
+++ b/pkgs/by-name/ya/yanic/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -26,7 +27,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd yanic \
       --bash <($out/bin/yanic completion bash) \
       --fish <($out/bin/yanic completion fish) \
diff --git a/pkgs/by-name/yd/ydotool/package.nix b/pkgs/by-name/yd/ydotool/package.nix
index ee0ac25bdd1a..bcbe83b73bca 100644
--- a/pkgs/by-name/yd/ydotool/package.nix
+++ b/pkgs/by-name/yd/ydotool/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
   cmake,
   scdoc,
   util-linux,
@@ -20,6 +21,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-MtanR+cxz6FsbNBngqLE+ITKPZFHmWGsD1mBDk0OVng=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      url = "https://github.com/ReimuNotMoe/ydotool/commit/58fde33d9a8b393fd59348f71e80c56177b62706.patch?full_index=1";
+      hash = "sha256-Ga9DPCzpJwtYVHWwKKl3kzn2BPEZBZ7uzbEY/eFXGs4=";
+      includes = [ "CMakeLists.txt" ];
+    })
+  ];
+
   postPatch = ''
     substituteInPlace Daemon/ydotoold.c \
       --replace "/usr/bin/xinput" "${xorg.xinput}/bin/xinput"
diff --git a/pkgs/by-name/yt/ytt/package.nix b/pkgs/by-name/yt/ytt/package.nix
index 44c1f26ddb6f..0db26802c0ca 100644
--- a/pkgs/by-name/yt/ytt/package.nix
+++ b/pkgs/by-name/yt/ytt/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -27,7 +28,7 @@ buildGoModule rec {
     "-X carvel.dev/ytt/pkg/version.Version=${version}"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd ytt \
       --bash <($out/bin/ytt completion bash) \
       --fish <($out/bin/ytt completion fish) \
diff --git a/pkgs/by-name/zi/zitadel-tools/package.nix b/pkgs/by-name/zi/zitadel-tools/package.nix
index bf8f21fccd32..6dea57b5cd60 100644
--- a/pkgs/by-name/zi/zitadel-tools/package.nix
+++ b/pkgs/by-name/zi/zitadel-tools/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -26,7 +27,7 @@ buildGoModule rec {
     "-X main.version=${version}"
   ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     local INSTALL="$out/bin/zitadel-tools"
     installShellCompletion --cmd zitadel-tools \
       --bash <($out/bin/zitadel-tools completion bash) \
diff --git a/pkgs/by-name/zs/zs/package.nix b/pkgs/by-name/zs/zs/package.nix
index 84e49f4e4db3..35985ef4ea9e 100644
--- a/pkgs/by-name/zs/zs/package.nix
+++ b/pkgs/by-name/zs/zs/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   fetchFromGitea,
   buildGoModule,
   installShellFiles,
@@ -28,7 +29,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd zs \
       --bash <($out/bin/zs completion bash) \
       --fish <($out/bin/zs completion fish) \
diff --git a/pkgs/data/icons/beauty-line-icon-theme/default.nix b/pkgs/data/icons/beauty-line-icon-theme/default.nix
index d1bea8dfd6bd..af4c09e9adff 100644
--- a/pkgs/data/icons/beauty-line-icon-theme/default.nix
+++ b/pkgs/data/icons/beauty-line-icon-theme/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   stdenvNoCC,
-  fetchFromGitHub,
+  fetchFromGitLab,
   breeze-icons,
   gtk3,
   gnome-icon-theme,
@@ -13,20 +13,15 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "BeautyLine";
-  version = "0.0.4";
+  version = "2.4";
 
-  src = fetchFromGitHub {
-    owner = "gvolpe";
-    repo = pname;
-    rev = version;
-    sparseCheckout = [
-      "BeautyLine-V3"
-    ];
-    hash = "sha256-IkkypAj250+OXbf19TampCnqYsSbJVIjeYlxJoyhpzk=";
+  src = fetchFromGitLab {
+    owner = "garuda-linux";
+    repo = "themes-and-settings/artwork/beautyline";
+    rev = "0df6f5df71c19496f9a873f8a52fbb5e84e95b12";
+    hash = "sha256-SsYW4H1qam7kQJ3E4/vHJJOv2E4Pdk3itGncWa6YTqw=";
   };
 
-  sourceRoot = "${src.name}/BeautyLine-V3";
-
   nativeBuildInputs = [
     jdupes
     gtk3
@@ -63,6 +58,6 @@ stdenvNoCC.mkDerivation rec {
     homepage = "https://www.gnome-look.org/p/1425426/";
     platforms = platforms.linux;
     license = [ licenses.publicDomain ];
-    maintainers = with maintainers; [ gvolpe ];
+    maintainers = with maintainers; [ lwb-2021 ];
   };
 }
diff --git a/pkgs/development/compilers/flutter/versions/3_35/data.json b/pkgs/development/compilers/flutter/versions/3_35/data.json
index fd02a6dbb4a9..915626fd790a 100644
--- a/pkgs/development/compilers/flutter/versions/3_35/data.json
+++ b/pkgs/development/compilers/flutter/versions/3_35/data.json
@@ -1,17 +1,17 @@
 {
-  "version": "3.35.3",
-  "engineVersion": "ddf47dd3ff96dbde6d9c614db0d7f019d7c7a2b7",
+  "version": "3.35.4",
+  "engineVersion": "c29809135135e262a912cf583b2c90deb9ded610",
   "engineSwiftShaderHash": "sha256-ATVcuxqPHqHOWYyO7DoX9LdgUiO3INUi7m9Mc6ccc1M=",
   "engineSwiftShaderRev": "d040a5bab638bf7c226235c95787ba6288bb6416",
   "channel": "stable",
   "engineHashes": {
     "aarch64-linux": {
-      "aarch64-linux": "sha256-f5RFYSG6LLz1Yt6EE7ETpcLDxlQ0Bm6b5FiLh39lbpY=",
-      "x86_64-linux": "sha256-f5RFYSG6LLz1Yt6EE7ETpcLDxlQ0Bm6b5FiLh39lbpY="
+      "aarch64-linux": "sha256-lUqqu4OgveDOmVJw1BMnSYFCDooReGuj7Gh9ZCalcmE=",
+      "x86_64-linux": "sha256-lUqqu4OgveDOmVJw1BMnSYFCDooReGuj7Gh9ZCalcmE="
     },
     "x86_64-linux": {
-      "aarch64-linux": "sha256-vwEIm64Dwwhmo6L2fKKDNWa/uIyVfL/eCLJK7eob6lQ=",
-      "x86_64-linux": "sha256-vwEIm64Dwwhmo6L2fKKDNWa/uIyVfL/eCLJK7eob6lQ="
+      "aarch64-linux": "sha256-Kw2I9ztyYOVl1V2ewLOIlxvvlX4+P3Hp5yZK82eLIbo=",
+      "x86_64-linux": "sha256-Kw2I9ztyYOVl1V2ewLOIlxvvlX4+P3Hp5yZK82eLIbo="
     }
   },
   "dartVersion": "3.9.2",
@@ -21,53 +21,53 @@
     "x86_64-darwin": "sha256-mjWHCF5voWLKlqBKYhl2OKg2aDx0pyIQ1TlF6k4MQz0=",
     "aarch64-darwin": "sha256-1rAfqatlOdphdi6dZSfUfKywAbdwRn6ijo60isjV3Lw="
   },
-  "flutterHash": "sha256-OXyciVucxYnb+d8IO1Sb0/47hlygnSoA+N8YtJw7ES8=",
+  "flutterHash": "sha256-8mX5KZGti5TR1AhB6ACAhGziZOgmnaaNF4RFyD1a3O4=",
   "artifactHashes": {
     "android": {
-      "aarch64-darwin": "sha256-j07VOm7nabzb9nA0L3I/Ojc0murKgIrX+n4t8CaOWUU=",
-      "aarch64-linux": "sha256-p0DktS367Iof8Wpy4ODojQBIeVyKClWnh0WjjUUbl+E=",
-      "x86_64-darwin": "sha256-j07VOm7nabzb9nA0L3I/Ojc0murKgIrX+n4t8CaOWUU=",
-      "x86_64-linux": "sha256-p0DktS367Iof8Wpy4ODojQBIeVyKClWnh0WjjUUbl+E="
+      "aarch64-darwin": "sha256-59z28tm0Pr6Jwln/MlTJmCNoZrxRuqEOW5Ua1M6bryI=",
+      "aarch64-linux": "sha256-odC1O8RbcqLndwsRFtguPguH6oda3mDAabBAuFQKCLY=",
+      "x86_64-darwin": "sha256-59z28tm0Pr6Jwln/MlTJmCNoZrxRuqEOW5Ua1M6bryI=",
+      "x86_64-linux": "sha256-odC1O8RbcqLndwsRFtguPguH6oda3mDAabBAuFQKCLY="
     },
     "fuchsia": {
-      "aarch64-darwin": "sha256-JOlDUchplstR0Wu8RlK16RQBS4AAsEEQyU5TWG9nJ1Y=",
-      "aarch64-linux": "sha256-JOlDUchplstR0Wu8RlK16RQBS4AAsEEQyU5TWG9nJ1Y=",
-      "x86_64-darwin": "sha256-JOlDUchplstR0Wu8RlK16RQBS4AAsEEQyU5TWG9nJ1Y=",
-      "x86_64-linux": "sha256-JOlDUchplstR0Wu8RlK16RQBS4AAsEEQyU5TWG9nJ1Y="
+      "aarch64-darwin": "sha256-xoET0OFPSF/OWiNHJSYoEgNwaopRTMMAdHZkBN6n/5k=",
+      "aarch64-linux": "sha256-xoET0OFPSF/OWiNHJSYoEgNwaopRTMMAdHZkBN6n/5k=",
+      "x86_64-darwin": "sha256-xoET0OFPSF/OWiNHJSYoEgNwaopRTMMAdHZkBN6n/5k=",
+      "x86_64-linux": "sha256-xoET0OFPSF/OWiNHJSYoEgNwaopRTMMAdHZkBN6n/5k="
     },
     "ios": {
-      "aarch64-darwin": "sha256-oz0/S33dcaKWAuWfXQfrDKQENrCxysKwQ50mloIqXK8=",
-      "aarch64-linux": "sha256-oz0/S33dcaKWAuWfXQfrDKQENrCxysKwQ50mloIqXK8=",
-      "x86_64-darwin": "sha256-oz0/S33dcaKWAuWfXQfrDKQENrCxysKwQ50mloIqXK8=",
-      "x86_64-linux": "sha256-oz0/S33dcaKWAuWfXQfrDKQENrCxysKwQ50mloIqXK8="
+      "aarch64-darwin": "sha256-IUWziLP2FtBo041VkxVQCDVRYztybPTcNFfhMvHlReQ=",
+      "aarch64-linux": "sha256-IUWziLP2FtBo041VkxVQCDVRYztybPTcNFfhMvHlReQ=",
+      "x86_64-darwin": "sha256-IUWziLP2FtBo041VkxVQCDVRYztybPTcNFfhMvHlReQ=",
+      "x86_64-linux": "sha256-IUWziLP2FtBo041VkxVQCDVRYztybPTcNFfhMvHlReQ="
     },
     "linux": {
-      "aarch64-darwin": "sha256-IjaOmgSzh5bt2IPgrFKBCptToAFS68Lb/6JUib3efXE=",
-      "aarch64-linux": "sha256-IjaOmgSzh5bt2IPgrFKBCptToAFS68Lb/6JUib3efXE=",
-      "x86_64-darwin": "sha256-TSkUrQPG6B9vUevlhB7fQfslSGTIY+epzwRM8l72hYc=",
-      "x86_64-linux": "sha256-TSkUrQPG6B9vUevlhB7fQfslSGTIY+epzwRM8l72hYc="
+      "aarch64-darwin": "sha256-Y8j7Mr8tbgbl89/bxnNnqTb4plTijv24CYtWlKxAxqs=",
+      "aarch64-linux": "sha256-Y8j7Mr8tbgbl89/bxnNnqTb4plTijv24CYtWlKxAxqs=",
+      "x86_64-darwin": "sha256-FZ8y8zTUSxhbGiFLyhgFRrwWAE77jSINuY6ypbL8Gjg=",
+      "x86_64-linux": "sha256-FZ8y8zTUSxhbGiFLyhgFRrwWAE77jSINuY6ypbL8Gjg="
     },
     "macos": {
-      "aarch64-darwin": "sha256-iTc6Q462wbCRzFvS7lKJZvlQMYb7eqJGfChmfgGQvls=",
-      "aarch64-linux": "sha256-iTc6Q462wbCRzFvS7lKJZvlQMYb7eqJGfChmfgGQvls=",
-      "x86_64-darwin": "sha256-iTc6Q462wbCRzFvS7lKJZvlQMYb7eqJGfChmfgGQvls=",
-      "x86_64-linux": "sha256-iTc6Q462wbCRzFvS7lKJZvlQMYb7eqJGfChmfgGQvls="
+      "aarch64-darwin": "sha256-fHf8/MunFZ24Q3CEF032nljlZH2I8w7KlKfLVqKCpJc=",
+      "aarch64-linux": "sha256-fHf8/MunFZ24Q3CEF032nljlZH2I8w7KlKfLVqKCpJc=",
+      "x86_64-darwin": "sha256-fHf8/MunFZ24Q3CEF032nljlZH2I8w7KlKfLVqKCpJc=",
+      "x86_64-linux": "sha256-fHf8/MunFZ24Q3CEF032nljlZH2I8w7KlKfLVqKCpJc="
     },
     "universal": {
-      "aarch64-darwin": "sha256-QB6x399cf7FI5xJS25D3xQsprYMvqdOqs3R2GQwzB0I=",
-      "aarch64-linux": "sha256-ywTLTRvqZgLqSXSTS/axyGGWsUvMd76KQmz5p/cZhSY=",
-      "x86_64-darwin": "sha256-mCmTvirTGovEAaYKgYYkK8WJ9ntZMLshDLNrViPxf8U=",
-      "x86_64-linux": "sha256-hfngQ8yKVEgRDnE1JfBGUPf11u3IKNgag3Yx1/AWfSQ="
+      "aarch64-darwin": "sha256-naywuR7a5kNzp32cg/n7x+rNP/nEPDzMILeaAkW1rZ0=",
+      "aarch64-linux": "sha256-++veEABUJp9nCvawRC+PzgG7I/Qg/WTEDjB0BLixnhY=",
+      "x86_64-darwin": "sha256-Ctt79i77YOqIzLzs1BNh50zbCEcLHPNm/nH+cICp1S8=",
+      "x86_64-linux": "sha256-ZFHB4gT3O/U+eKHSAynvbG1Kov1mshhcibmJlG1MsRs="
     },
     "web": {
-      "aarch64-darwin": "sha256-+OMF6Bc8tsdhDyBIokt/oTsGJLisaC/iv0Yt7xhChmk=",
-      "aarch64-linux": "sha256-+OMF6Bc8tsdhDyBIokt/oTsGJLisaC/iv0Yt7xhChmk=",
-      "x86_64-darwin": "sha256-+OMF6Bc8tsdhDyBIokt/oTsGJLisaC/iv0Yt7xhChmk=",
-      "x86_64-linux": "sha256-+OMF6Bc8tsdhDyBIokt/oTsGJLisaC/iv0Yt7xhChmk="
+      "aarch64-darwin": "sha256-SkH+u5yQwY2JxLLW/4hG0tSr8l0diL4QMvi8kS064WY=",
+      "aarch64-linux": "sha256-SkH+u5yQwY2JxLLW/4hG0tSr8l0diL4QMvi8kS064WY=",
+      "x86_64-darwin": "sha256-SkH+u5yQwY2JxLLW/4hG0tSr8l0diL4QMvi8kS064WY=",
+      "x86_64-linux": "sha256-SkH+u5yQwY2JxLLW/4hG0tSr8l0diL4QMvi8kS064WY="
     },
     "windows": {
-      "x86_64-darwin": "sha256-SkBxiYhGp1EMQ8MH92QrDlbgrvsJLHuBs1NVaOxSAfc=",
-      "x86_64-linux": "sha256-SkBxiYhGp1EMQ8MH92QrDlbgrvsJLHuBs1NVaOxSAfc="
+      "x86_64-darwin": "sha256-yYn8BChjhZgqUyrENcpAZRpBf1w0LmzCjXnx9z4aw4Q=",
+      "x86_64-linux": "sha256-yYn8BChjhZgqUyrENcpAZRpBf1w0LmzCjXnx9z4aw4Q="
     }
   },
   "pubspecLock": {
diff --git a/pkgs/development/compilers/julia/default.nix b/pkgs/development/compilers/julia/default.nix
index 7c42fb497b5c..6f8b92d7a34b 100644
--- a/pkgs/development/compilers/julia/default.nix
+++ b/pkgs/development/compilers/julia/default.nix
@@ -31,12 +31,12 @@ in
   );
   julia_110-bin = wrapJulia (
     callPackage (import ./generic-bin.nix {
-      version = "1.10.9";
+      version = "1.10.10";
       sha256 = {
-        x86_64-linux = "5a2d2c5224594b683c97e7304cb72407fbcf0be4a0187789cba1a2f73f0cbf09";
-        aarch64-linux = "be222882e3674f960f43b6842f7bbb52a369977e40d5dcd26498793e1cd2dfb6";
-        x86_64-darwin = "f80c93c30a18d8a5dc7f37d0cc94757fd3857651268e4a9e2d42d3b1ea3372f1";
-        aarch64-darwin = "e62e00b22408159cba3d669f2d9e8b60c1d23b5c2d1c22ec25f4957d15ca98ef";
+        x86_64-linux = "6a78a03a71c7ab792e8673dc5cedb918e037f081ceb58b50971dfb7c64c5bf81";
+        aarch64-linux = "a4b157ed68da10471ea86acc05a0ab61c1a6931ee592a9b236be227d72da50ff";
+        x86_64-darwin = "942b0d4accc9704861c7781558829b1d521df21226ad97bd01e1e43b1518d3e6";
+        aarch64-darwin = "52d3f82c50d9402e42298b52edc3d36e0f73e59f81fc8609d22fa094fbad18be";
       };
     }) { }
   );
@@ -62,8 +62,8 @@ in
   );
   julia_110 = wrapJulia (
     callPackage (import ./generic.nix {
-      version = "1.10.9";
-      hash = "sha256-u9by+X76fcXs+w159KTSvw43JeYwJ9Wvn0VyoEfniTM=";
+      version = "1.10.10";
+      hash = "sha256-/NTIGLlcNu4sI1rICa+PS/Jn+YnWi37zFBcbfMnv3Ys=";
       patches = [
         ./patches/1.10/0002-skip-failing-and-flaky-tests.patch
         # Revert https://github.com/JuliaLang/julia/pull/55354
diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index df9157a07bce..a508347ba23b 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -27,9 +27,9 @@ let
     "20.1.8".officialRelease.sha256 = "sha256-ysyB/EYxi2qE9fD5x/F2zI4vjn8UDoo1Z9ukiIrjFGw=";
     "21.1.1".officialRelease.sha256 = "sha256-IB9Z3bIMwfgw2W2Vxo89CmtCM9DfOyV2Ei64nqgHrgc=";
     "22.0.0-git".gitRelease = {
-      rev = "c3fb2e1cee954338acb83955b157e0a2e82a4849";
-      rev-version = "22.0.0-unstable-2025-09-16";
-      sha256 = "sha256-jTRI71x395XnfT06cyYLp8x0Z79ttJmmmasa3LiK790=";
+      rev = "e396dab01f3da49df16c710d105a409973df5a03";
+      rev-version = "22.0.0-unstable-2025-09-21";
+      sha256 = "sha256-pYu/IVFvptxbtMo5GQePPKFlFnD/7FA13uzSuJWq3dc=";
     };
   }
   // llvmVersions;
diff --git a/pkgs/development/compilers/reason/default.nix b/pkgs/development/compilers/reason/default.nix
index f6e3b181fcd8..44802e0833e5 100644
--- a/pkgs/development/compilers/reason/default.nix
+++ b/pkgs/development/compilers/reason/default.nix
@@ -10,7 +10,7 @@
   merlin-extend,
   ppxlib,
   cppo,
-  ppx_derivers,
+  cmdliner,
   dune-build-info,
 }:
 
@@ -18,8 +18,8 @@ let
   param =
     if lib.versionAtLeast ppxlib.version "0.36" then
       {
-        version = "3.16.0";
-        hash = "sha256-R7DkOn00jiqFBlirS+xaT7u5/U/z7IocGBZRFVjFNk4=";
+        version = "3.17.0";
+        hash = "sha256-gsiBnOn9IVt+fixlAeY456kE6+E6taHY6sJnnYz4pes=";
       }
     else
       {
@@ -50,7 +50,8 @@ buildDunePackage rec {
     fix
     menhirSdk
     merlin-extend
-  ];
+  ]
+  ++ lib.optional (lib.versionAtLeast version "3.17") cmdliner;
 
   propagatedBuildInputs = [
     ppxlib
diff --git a/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml b/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
index f0c49c4681f6..6e6ea2343d64 100644
--- a/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
+++ b/pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml
@@ -730,7 +730,6 @@ unsupported-platforms:
   kmonad:                                       [ platforms.darwin ]
   Kulitta:                                      [ platforms.darwin ] # depends on Euterpea
   LambdaHack:                                   [ platforms.darwin ]
-  large-hashable:                               [ aarch64-linux ] # https://github.com/factisresearch/large-hashable/issues/17
   libmodbus:                                    [ platforms.darwin ]
   libsystemd-journal:                           [ platforms.darwin ]
   libtelnet:                                    [ platforms.darwin ]
diff --git a/pkgs/development/haskell-modules/hackage-packages.nix b/pkgs/development/haskell-modules/hackage-packages.nix
index ea66cea14080..48d422015484 100644
--- a/pkgs/development/haskell-modules/hackage-packages.nix
+++ b/pkgs/development/haskell-modules/hackage-packages.nix
@@ -409275,7 +409275,6 @@ self: {
       benchmarkToolDepends = [ cpphs ];
       description = "Efficiently hash (large) Haskell values";
       license = lib.licenses.bsd3;
-      badPlatforms = [ "aarch64-linux" ];
       maintainers = [ lib.maintainers.sternenseemann ];
     }
   ) { };
diff --git a/pkgs/development/haskell-modules/make-package-set.nix b/pkgs/development/haskell-modules/make-package-set.nix
index bdc71b928a2c..0d936b21f41d 100644
--- a/pkgs/development/haskell-modules/make-package-set.nix
+++ b/pkgs/development/haskell-modules/make-package-set.nix
@@ -107,29 +107,35 @@ let
       # is that nix has no way to "passthrough" args while preserving the reflection
       # info that callPackage uses to determine the arguments).
       drv = if lib.isFunction fn then fn else import fn;
-      auto = builtins.intersectAttrs (lib.functionArgs drv) scope;
+      drvFunctionArgs = lib.functionArgs drv;
+      auto = builtins.intersectAttrs drvFunctionArgs scope;
 
       # Converts a returned function to a functor attribute set if necessary
       ensureAttrs = v: if builtins.isFunction v then { __functor = _: v; } else v;
 
       # this wraps the `drv` function to add `scope` and `overrideScope` to the result.
-      drvScope =
-        allArgs:
-        ensureAttrs (drv allArgs)
-        // {
-          inherit scope;
-          overrideScope =
-            f:
-            let
-              newScope = mkScope (fix' (extends f scope.__unfix__));
-            in
-            # note that we have to be careful here: `allArgs` includes the auto-arguments that
-            # weren't manually specified. If we would just pass `allArgs` to the recursive call here,
-            # then we wouldn't look up any packages in the scope in the next interation, because it
-            # appears as if all arguments were already manually passed, so the scope change would do
-            # nothing.
-            callPackageWithScope newScope drv manualArgs;
-        };
+      # it's a functor, so that we can pass through `functionArgs`
+      drvScope = {
+        __functor =
+          _: allArgs:
+          ensureAttrs (drv allArgs)
+          // {
+            inherit scope;
+            overrideScope =
+              f:
+              let
+                newScope = mkScope (fix' (extends f scope.__unfix__));
+              in
+              # note that we have to be careful here: `allArgs` includes the auto-arguments that
+              # weren't manually specified. If we would just pass `allArgs` to the recursive call here,
+              # then we wouldn't look up any packages in the scope in the next interation, because it
+              # appears as if all arguments were already manually passed, so the scope change would do
+              # nothing.
+              callPackageWithScope newScope drv manualArgs;
+          };
+        # `drvScope` accepts the same arguments as `drv`
+        __functionArgs = drvFunctionArgs;
+      };
     in
     lib.makeOverridable drvScope (auto // manualArgs);
 
diff --git a/pkgs/development/libraries/geos/3.9.nix b/pkgs/development/libraries/geos/3.9.nix
deleted file mode 100644
index 70cfa917993b..000000000000
--- a/pkgs/development/libraries/geos/3.9.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  cmake,
-  testers,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "geos";
-  version = "3.9.5";
-
-  src = fetchurl {
-    url = "https://download.osgeo.org/geos/geos-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-xsmu36iGT7RLp4kRQIRCOCv9BpDPLUCRrjgFyGN4kDY=";
-  };
-
-  nativeBuildInputs = [ cmake ];
-
-  enableParallelBuilding = true;
-
-  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-
-  meta = with lib; {
-    description = "C++ port of the Java Topology Suite (JTS)";
-    mainProgram = "geos-config";
-    homepage = "https://trac.osgeo.org/geos";
-    license = licenses.lgpl21Only;
-    pkgConfigModules = [ "geos" ];
-    maintainers = with lib.maintainers; [
-      willcohen
-    ];
-  };
-})
diff --git a/pkgs/development/ocaml-modules/bdd/default.nix b/pkgs/development/ocaml-modules/bdd/default.nix
index cc9306bb4552..b622de57ce99 100644
--- a/pkgs/development/ocaml-modules/bdd/default.nix
+++ b/pkgs/development/ocaml-modules/bdd/default.nix
@@ -5,33 +5,31 @@
   stdlib-shims,
 }:
 
-buildDunePackage {
+buildDunePackage rec {
   pname = "bdd";
-  version = "unstable-2022-07-14";
-
-  duneVersion = "3";
+  version = "0.5";
 
   src = fetchFromGitHub {
     owner = "backtracking";
     repo = "ocaml-bdd";
-    rev = "6d1b1d3c24e5784b87e599a00230ce652acb2dcc";
-    hash = "sha256-3mJZlAFQsI7AgrNQOe6N94CDfX5gXYqQBooV0jcoYEA=";
+    tag = version;
+    hash = "sha256-bhgKpo7gGkjbI75pzckfQulZnTstj6G5QcErLgIGneU=";
   };
 
   # Fix build with OCaml 4.02
   postPatch = ''
     substituteInPlace lib/bdd.ml \
-      --replace "Buffer.truncate Format.stdbuf 0;" "Buffer.clear Format.stdbuf;"
+      --replace-fail "Buffer.truncate Format.stdbuf 0;" "Buffer.clear Format.stdbuf;"
   '';
 
   propagatedBuildInputs = [
     stdlib-shims
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Quick implementation of a Binary Decision Diagrams (BDD) library for OCaml";
     homepage = "https://github.com/backtracking/ocaml-bdd";
-    license = licenses.lgpl21Plus;
-    maintainers = with maintainers; [ wegank ];
+    license = lib.licenses.lgpl21Only;
+    maintainers = with lib.maintainers; [ wegank ];
   };
 }
diff --git a/pkgs/development/ocaml-modules/fix/default.nix b/pkgs/development/ocaml-modules/fix/default.nix
index 1075e42aacc1..c2424072e74a 100644
--- a/pkgs/development/ocaml-modules/fix/default.nix
+++ b/pkgs/development/ocaml-modules/fix/default.nix
@@ -6,18 +6,17 @@
 
 buildDunePackage rec {
   pname = "fix";
-  version = "20250428";
+  version = "20250919";
 
   src = fetchFromGitLab {
     domain = "gitlab.inria.fr";
     owner = "fpottier";
     repo = "fix";
-    rev = version;
-    sha256 = "sha256-ZfIKx0BMhnmrqmfyqRi9ElZN1xdkupsDmfRg1GD3l/Q=";
+    tag = version;
+    hash = "sha256-CVxOLlSKKX1kb1bi6IbSo7SH5GsVynI4de0c5NUmq+s=";
   };
 
   minimalOCamlVersion = "4.03";
-  useDune2 = true;
 
   meta = with lib; {
     homepage = "https://gitlab.inria.fr/fpottier/fix/";
diff --git a/pkgs/development/ocaml-modules/odoc-parser/default.nix b/pkgs/development/ocaml-modules/odoc-parser/default.nix
index 302308e0c821..1e23649ac3b2 100644
--- a/pkgs/development/ocaml-modules/odoc-parser/default.nix
+++ b/pkgs/development/ocaml-modules/odoc-parser/default.nix
@@ -6,12 +6,15 @@
   astring,
   result,
   camlp-streams,
-  version ? "2.4.4",
+  version ? if lib.versionAtLeast ocaml.version "4.08" then "3.1.0" else "2.4.4",
 }:
 
 let
   param =
     {
+      "3.1.0" = {
+        sha256 = "sha256-NVs8//STSQPLrti1HONeMz6GCZMtIwKUIAqfLUL/qRQ=";
+      };
       "2.4.4" = {
         sha256 = "sha256-fiU6VbXI9hD54LSJQOza8hwBVTFDr5O0DJmMMEmeUfM=";
       };
@@ -41,8 +44,6 @@ lib.throwIf (param ? max_version && lib.versionAtLeast ocaml.version param.max_v
     pname = "odoc-parser";
     inherit version;
 
-    minimalOCamlVersion = "4.02";
-
     src = fetchurl {
       url =
         if lib.versionAtLeast version "2.4" then
@@ -54,8 +55,8 @@ lib.throwIf (param ? max_version && lib.versionAtLeast ocaml.version param.max_v
 
     propagatedBuildInputs = [
       astring
-      result
     ]
+    ++ lib.optional (!lib.versionAtLeast version "3.1.0") result
     ++ lib.optional (lib.versionAtLeast version "1.0.1") camlp-streams;
 
     meta = {
diff --git a/pkgs/development/ocaml-modules/odoc/default.nix b/pkgs/development/ocaml-modules/odoc/default.nix
index d49547dafab4..ab2f8557e0d6 100644
--- a/pkgs/development/ocaml-modules/odoc/default.nix
+++ b/pkgs/development/ocaml-modules/odoc/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   buildDunePackage,
-  ocaml,
   ocaml-crunch,
   astring,
   cmdliner,
@@ -19,7 +18,7 @@
   fmt,
 }:
 
-buildDunePackage rec {
+buildDunePackage {
   pname = "odoc";
   inherit (odoc-parser) version src;
 
@@ -31,7 +30,6 @@ buildDunePackage rec {
     astring
     cmdliner
     fpath
-    result
     tyxml
     odoc-parser
     fmt
@@ -48,7 +46,7 @@ buildDunePackage rec {
     jq
     ppx_expect
   ];
-  doCheck = lib.versionAtLeast ocaml.version "4.08" && lib.versionOlder yojson.version "2.0";
+  doCheck = true;
 
   preCheck = ''
     # some run.t files check the content of patchShebangs-ed scripts, so patch
@@ -63,6 +61,6 @@ buildDunePackage rec {
     license = lib.licenses.isc;
     maintainers = [ lib.maintainers.vbgl ];
     homepage = "https://github.com/ocaml/odoc";
-    changelog = "https://github.com/ocaml/odoc/blob/${version}/CHANGES.md";
+    changelog = "https://github.com/ocaml/odoc/blob/${odoc-parser.version}/CHANGES.md";
   };
 }
diff --git a/pkgs/development/python-modules/asyncserial/default.nix b/pkgs/development/python-modules/asyncserial/default.nix
index 2eab95bd4dfb..562ce983e270 100644
--- a/pkgs/development/python-modules/asyncserial/default.nix
+++ b/pkgs/development/python-modules/asyncserial/default.nix
@@ -2,29 +2,32 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  setuptools,
   pyserial,
 }:
 
-buildPythonPackage {
+buildPythonPackage rec {
   pname = "asyncserial";
-  version = "unstable-2022-06-10";
-  format = "setuptools";
+  version = "1.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "m-labs";
     repo = "asyncserial";
-    rev = "446559fec892a556876b17d17f182ae9647d5952";
-    hash = "sha256-WExmgh55sTH2w7wV3i96J1F1FN7L5rX3L/Ayvt2Kw/g=";
+    tag = version;
+    hash = "sha256-ZHzgJnbsDVxVcp09LXq9JZp46+dorgdP8bAiTB59K28=";
   };
 
-  propagatedBuildInputs = [ pyserial ];
+  build-system = [ setuptools ];
+
+  dependencies = [ pyserial ];
 
   pythonImportsCheck = [ "asyncserial" ];
 
-  meta = with lib; {
+  meta = {
     description = "asyncio support for pyserial";
     homepage = "https://github.com/m-labs/asyncserial";
-    license = licenses.bsd2;
-    maintainers = with maintainers; [ doronbehar ];
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ doronbehar ];
   };
 }
diff --git a/pkgs/development/python-modules/biocframe/default.nix b/pkgs/development/python-modules/biocframe/default.nix
new file mode 100644
index 000000000000..bb6f77f0d68c
--- /dev/null
+++ b/pkgs/development/python-modules/biocframe/default.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  pytest-cov-stub,
+  setuptools,
+  setuptools-scm,
+  biocutils,
+  numpy,
+  polars,
+  pandas,
+}:
+
+buildPythonPackage rec {
+  pname = "biocframe";
+  version = "0.6.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "BiocPy";
+    repo = "BiocFrame";
+    tag = "${version}";
+    hash = "sha256-HeXQEVDGrr/oEGqLcKgq2RLDA58sbYtc2O6oEdFxrIw=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [
+    biocutils
+    numpy
+  ];
+
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+    pandas
+    polars
+  ];
+
+  pythonImportsCheck = [ "biocframe" ];
+
+  meta = {
+    description = "Bioconductor-like data frames";
+    homepage = "https://github.com/BiocPy/BiocFrame";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ b-rodrigues ];
+  };
+}
diff --git a/pkgs/development/python-modules/bitlist/default.nix b/pkgs/development/python-modules/bitlist/default.nix
index 0744302e4af5..c4c715c4a959 100644
--- a/pkgs/development/python-modules/bitlist/default.nix
+++ b/pkgs/development/python-modules/bitlist/default.nix
@@ -2,38 +2,31 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  setuptools,
-  wheel,
   parts,
-  pytestCheckHook,
   pytest-cov-stub,
-  pythonOlder,
+  pytestCheckHook,
+  setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "bitlist";
-  version = "1.2.0";
+  version = "2.0.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-+/rBno+OH7yEiN4K9VC6BCEPuOv8nNp0hU+fWegjqPw=";
+    hash = "sha256-mbXSvIUYsnZy/pmZLFXa1bqrwK+JZ2eySuDRCVAs1zk=";
   };
 
-  build-system = [
-    setuptools
-    wheel
-  ];
-
   pythonRelaxDeps = [ "parts" ];
 
+  build-system = [ setuptools ];
+
   dependencies = [ parts ];
 
   nativeCheckInputs = [
-    pytestCheckHook
     pytest-cov-stub
+    pytestCheckHook
   ];
 
   pythonImportsCheck = [ "bitlist" ];
@@ -41,7 +34,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python library for working with little-endian list representation of bit strings";
     homepage = "https://github.com/lapets/bitlist";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/datafusion/default.nix b/pkgs/development/python-modules/datafusion/default.nix
index c9c796b66eb5..9695272f7a6a 100644
--- a/pkgs/development/python-modules/datafusion/default.nix
+++ b/pkgs/development/python-modules/datafusion/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "datafusion";
-  version = "48.0.0";
+  version = "49.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -32,12 +32,12 @@ buildPythonPackage rec {
     tag = version;
     # Fetch arrow-testing and parquet-testing (tests assets)
     fetchSubmodules = true;
-    hash = "sha256-9IOkb31f4nFo9mWTr+z5ZG8xSXIZSgW3vCBgLaGxpfI=";
+    hash = "sha256-U3LRZQMjL8sNa5yQmwfhw9NRGC0299TRODylzZkvFh4=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname src version;
-    hash = "sha256-P9NFvhHAGgYIi36CHEPZPr8hmMNp5zrCcmE7NHx51k4=";
+    hash = "sha256-lCbqy6kZK+LSLvr+Odxt167ACnDap2enH/J4ILcPtOc=";
   };
 
   nativeBuildInputs = with rustPlatform; [
diff --git a/pkgs/development/python-modules/datamodel-code-generator/default.nix b/pkgs/development/python-modules/datamodel-code-generator/default.nix
index 114c02db162a..1338520fdb30 100644
--- a/pkgs/development/python-modules/datamodel-code-generator/default.nix
+++ b/pkgs/development/python-modules/datamodel-code-generator/default.nix
@@ -1,4 +1,5 @@
 {
+  lib,
   argcomplete,
   black,
   buildPythonPackage,
@@ -6,33 +7,34 @@
   freezegun,
   genson,
   graphql-core,
+  hatch-vcs,
+  hatchling,
   httpx,
   inflect,
   isort,
   jinja2,
-  lib,
   openapi-spec-validator,
   packaging,
-  poetry-core,
-  poetry-dynamic-versioning,
   prance,
+  ruff,
+  pydantic,
+  pytest-benchmark,
   pytest-mock,
   pytestCheckHook,
-  pydantic,
   pyyaml,
   toml,
 }:
 
 buildPythonPackage rec {
   pname = "datamodel-code-generator";
-  version = "0.32.0";
+  version = "0.33.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "koxudaxi";
     repo = "datamodel-code-generator";
     tag = version;
-    hash = "sha256-sFMNs8wHRTxK1TU4IWfbKf/qUCb11bh2Td1/FngFavo=";
+    hash = "sha256-SyRF4Rn9LdcMTEH0xphDNIfEABknwvUoN2BYlNJFbrA=";
   };
 
   pythonRelaxDeps = [
@@ -41,32 +43,40 @@ buildPythonPackage rec {
   ];
 
   build-system = [
-    poetry-core
-    poetry-dynamic-versioning
+    hatchling
+    hatch-vcs
   ];
 
   dependencies = [
     argcomplete
     black
     genson
-    graphql-core
-    httpx
     inflect
     isort
     jinja2
-    openapi-spec-validator
     packaging
     pydantic
     pyyaml
     toml
   ];
 
+  optional-dependencies = {
+    graphql = [ graphql-core ];
+    http = [ httpx ];
+    ruff = [ ruff ];
+    validation = [
+      openapi-spec-validator
+      prance
+    ];
+  };
+
   nativeCheckInputs = [
     freezegun
-    prance
+    pytest-benchmark
     pytest-mock
     pytestCheckHook
-  ];
+  ]
+  ++ lib.flatten (builtins.attrValues optional-dependencies);
 
   pythonImportsCheck = [ "datamodel_code_generator" ];
 
@@ -78,6 +88,7 @@ buildPythonPackage rec {
   meta = {
     description = "Pydantic model and dataclasses.dataclass generator for easy conversion of JSON, OpenAPI, JSON Schema, and YAML data sources";
     homepage = "https://github.com/koxudaxi/datamodel-code-generator";
+    changelog = "https://github.com/koxudaxi/datamodel-code-generator/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ tochiaha ];
     mainProgram = "datamodel-code-generator";
diff --git a/pkgs/development/python-modules/debugpy/default.nix b/pkgs/development/python-modules/debugpy/default.nix
index b337381be485..d7606c49001b 100644
--- a/pkgs/development/python-modules/debugpy/default.nix
+++ b/pkgs/development/python-modules/debugpy/default.nix
@@ -2,12 +2,12 @@
   lib,
   stdenv,
   buildPythonPackage,
-  pythonOlder,
   pythonAtLeast,
   fetchFromGitHub,
   replaceVars,
   gdb,
   lldb,
+  setuptools,
   pytestCheckHook,
   pytest-xdist,
   pytest-timeout,
@@ -26,9 +26,7 @@
 buildPythonPackage rec {
   pname = "debugpy";
   version = "1.8.17";
-  format = "setuptools";
-
-  disabled = pythonOlder "3.8";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
@@ -91,6 +89,8 @@ buildPythonPackage rec {
         }
       )'';
 
+  build-system = [ setuptools ];
+
   # Disable tests for unmaintained versions of python
   doCheck = pythonAtLeast "3.11";
 
@@ -136,17 +136,23 @@ buildPythonPackage rec {
     "test_systemexit"
   ];
 
+  disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
+    # ConnectionResetError: [Errno 54] Connection reset by peer
+    "tests/debugpy/test_breakpoints.py::test_error_in_condition[program-attach_connect(cli)-]"
+    "tests/debugpy/test_breakpoints.py::test_error_in_condition[program-attach_connect(cli)-NameError]"
+  ];
+
   # Fixes hanging tests on Darwin
   __darwinAllowLocalNetworking = true;
 
   pythonImportsCheck = [ "debugpy" ];
 
-  meta = with lib; {
+  meta = {
     description = "Implementation of the Debug Adapter Protocol for Python";
     homepage = "https://github.com/microsoft/debugpy";
     changelog = "https://github.com/microsoft/debugpy/releases/tag/${src.tag}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ kira-bruneau ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ kira-bruneau ];
     platforms = [
       "x86_64-linux"
       "i686-linux"
diff --git a/pkgs/development/python-modules/dipy/default.nix b/pkgs/development/python-modules/dipy/default.nix
index ef15c110c193..141a7ae3f6a7 100644
--- a/pkgs/development/python-modules/dipy/default.nix
+++ b/pkgs/development/python-modules/dipy/default.nix
@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "dipy";
-  version = "1.9.0";
+  version = "1.11.0";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -25,14 +25,9 @@ buildPythonPackage rec {
     owner = "dipy";
     repo = "dipy";
     tag = version;
-    hash = "sha256-6cpxuk2PL43kjQ+6UGiUHUXC7pC9OlW9kZvGOdEXyzw=";
+    hash = "sha256-vqjd5gd9B630pv6H4MvXnlPwlEhm1o7MbwYD0J7D24o=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail "numpy==" "numpy>="
-  '';
-
   build-system = [
     cython
     meson-python
@@ -74,11 +69,11 @@ buildPythonPackage rec {
     "dipy.nn"
   ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://dipy.org/";
     description = "Diffusion imaging toolkit for Python";
     changelog = "https://github.com/dipy/dipy/blob/${version}/Changelog";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ bcdarwin ];
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ bcdarwin ];
   };
 }
diff --git a/pkgs/development/python-modules/disposable-email-domains/default.nix b/pkgs/development/python-modules/disposable-email-domains/default.nix
index 4ab72c035406..05130f538900 100644
--- a/pkgs/development/python-modules/disposable-email-domains/default.nix
+++ b/pkgs/development/python-modules/disposable-email-domains/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "disposable-email-domains";
-  version = "0.0.135";
+  version = "0.0.137";
   pyproject = true;
 
   # No tags on GitHub
   src = fetchPypi {
     pname = "disposable_email_domains";
     inherit version;
-    hash = "sha256-1drASN1TnqU2U1pTwjctynkKsOYJ6df7GM1GZfEVQS4=";
+    hash = "sha256-XX8WqoDKf+ub2EzIiLalFYvJRvIZhD5zXdJ1Q4X/PW0=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/django-pghistory/default.nix b/pkgs/development/python-modules/django-pghistory/default.nix
index 67cfa982d2eb..daac8859f440 100644
--- a/pkgs/development/python-modules/django-pghistory/default.nix
+++ b/pkgs/development/python-modules/django-pghistory/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "django-pghistory";
-  version = "3.8.1";
+  version = "3.8.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Opus10";
     repo = "django-pghistory";
     tag = version;
-    hash = "sha256-z1dpd2JC/IOLE/v0taJiEK8dlZedBS63KeYhv5MG6tk=";
+    hash = "sha256-zQqa4rBhjt2+kaCT4PvGXyTJ63JR3YM50GBQkqnWUKE=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/django-reversion/default.nix b/pkgs/development/python-modules/django-reversion/default.nix
index 2c0328883703..aa698ea02652 100644
--- a/pkgs/development/python-modules/django-reversion/default.nix
+++ b/pkgs/development/python-modules/django-reversion/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "django-reversion";
-  version = "5.1.0";
+  version = "6.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "django_reversion";
     inherit version;
-    hash = "sha256-MwmCHltvzu3M5raXXxqcf6tq58fQ4SdqkONFlG+g3Lg=";
+    hash = "sha256-yrD9kGQLLOs316iXgjynKiG5YK0dajuctONR+rvSfZw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/docling-core/default.nix b/pkgs/development/python-modules/docling-core/default.nix
index 452600a2bc06..31a38588fc9c 100644
--- a/pkgs/development/python-modules/docling-core/default.nix
+++ b/pkgs/development/python-modules/docling-core/default.nix
@@ -29,14 +29,14 @@
 
 buildPythonPackage rec {
   pname = "docling-core";
-  version = "2.45.0";
+  version = "2.48.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "docling-project";
     repo = "docling-core";
     tag = "v${version}";
-    hash = "sha256-9gTGC5jATmiYNrYXWb3KCBvaa/7H5ienUSQ+wBefwdQ=";
+    hash = "sha256-hXVEjToV6YMIJ1XYPhkZjYMbZPf10KmtYDuwBA0N/Hw=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/equinox/default.nix b/pkgs/development/python-modules/equinox/default.nix
index 01cf6219a370..bd32fa99bbb2 100644
--- a/pkgs/development/python-modules/equinox/default.nix
+++ b/pkgs/development/python-modules/equinox/default.nix
@@ -37,7 +37,8 @@ buildPythonPackage rec {
     substituteInPlace tests/test_while_loop.py \
       --replace-fail "speed < 0.1" "speed < 0.5" \
       --replace-fail "speed < 0.5" "speed < 1" \
-      --replace-fail "speed < 1" "speed < 20"
+      --replace-fail "speed < 1" "speed < 20" \
+      --replace-fail "speed < 2" "speed < 20"
   '';
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/fastexcel/default.nix b/pkgs/development/python-modules/fastexcel/default.nix
index a67d04082635..b4db317f45ae 100644
--- a/pkgs/development/python-modules/fastexcel/default.nix
+++ b/pkgs/development/python-modules/fastexcel/default.nix
@@ -20,19 +20,19 @@
 
 buildPythonPackage rec {
   pname = "fastexcel";
-  version = "0.15.1";
+  version = "0.16.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ToucanToco";
     repo = "fastexcel";
     tag = "v${version}";
-    hash = "sha256-kGGtTgy8k6TeP4iwonIwiQKiYMFAXw9v5Q5dpdcYP7A=";
+    hash = "sha256-6pEE3l3qJ3Nir4oDFXdsGiX/2d1w3bqH0nrIOjBt9PM=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-SdraNHOicCjIKFaTSRn4dEzfW8w243y/w9ym9JduMQo=";
+    hash = "sha256-ULRK7GjMEs0mN/H491XANDT7eipOdPfJyGFtPBM3SC8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/fe25519/default.nix b/pkgs/development/python-modules/fe25519/default.nix
index a19efc6be1c6..f6a399024203 100644
--- a/pkgs/development/python-modules/fe25519/default.nix
+++ b/pkgs/development/python-modules/fe25519/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "fe25519";
-  version = "1.5.0";
+  version = "2.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-la+17tPHjceMTe7Wk8DGVaSptk8XJa+l7GTeqLIFDvs=";
+    hash = "sha256-Kf5OCTG3IL2dYGvzFngoS+OMZPqq/O//8Gf0a2McgPc=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/formulaic/default.nix b/pkgs/development/python-modules/formulaic/default.nix
index 44870bba4566..97d387abec91 100644
--- a/pkgs/development/python-modules/formulaic/default.nix
+++ b/pkgs/development/python-modules/formulaic/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "formulaic";
-  version = "1.2.0";
+  version = "1.2.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "matthewwardrop";
     repo = "formulaic";
     tag = "v${version}";
-    hash = "sha256-+MyMxtX3DCmluf+8dvo0uulc1AeKE6les1xiRGVWjPU=";
+    hash = "sha256-mZt+cwk/AaUmmeCj7aLu1QEBqlPUVUqQbYdgETMj/vY=";
   };
 
   env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
diff --git a/pkgs/development/python-modules/fountains/default.nix b/pkgs/development/python-modules/fountains/default.nix
index 8a5e4e923dfe..8d789b9b7c4c 100644
--- a/pkgs/development/python-modules/fountains/default.nix
+++ b/pkgs/development/python-modules/fountains/default.nix
@@ -3,29 +3,22 @@
   buildPythonPackage,
   fetchPypi,
   setuptools,
-  wheel,
   bitlist,
-  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "fountains";
-  version = "2.2.0";
-  format = "pyproject";
-
-  disabled = pythonOlder "3.7";
+  version = "3.0.0";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-MhOQ4pemxmjfp7Uy5hLA8i8BBI5QbvD4EjEcKMM/u3I=";
+    hash = "sha256-kRu+jCKRfkH0URNuYvTF3TF1WslyfeE2EHE1VLCMyys=";
   };
 
-  nativeBuildInputs = [
-    setuptools
-    wheel
-  ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [ bitlist ];
+  dependencies = [ bitlist ];
 
   # Module has no test
   doCheck = false;
@@ -35,7 +28,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python library for generating and embedding data for unit testing";
     homepage = "https://github.com/reity/fountains";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/ge25519/default.nix b/pkgs/development/python-modules/ge25519/default.nix
index d8bf085d7142..695dbe7235dd 100644
--- a/pkgs/development/python-modules/ge25519/default.nix
+++ b/pkgs/development/python-modules/ge25519/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "ge25519";
-  version = "1.5.1";
+  version = "2.0.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-VKDPiSdufWwrNcZSRTByFU4YGoJrm48TDm1nt4VyclA=";
+    hash = "sha256-eqduw1nMHMiMIvhzXA1Zg2foqQscQwFLhgm9aJYvmuo=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/githubkit/default.nix b/pkgs/development/python-modules/githubkit/default.nix
index b24fdbe1e639..6c27b80197c9 100644
--- a/pkgs/development/python-modules/githubkit/default.nix
+++ b/pkgs/development/python-modules/githubkit/default.nix
@@ -5,33 +5,30 @@
   fetchFromGitHub,
   hishel,
   httpx,
-  poetry-core,
   pydantic,
   pyjwt,
   pytest-cov-stub,
   pytest-xdist,
   pytestCheckHook,
-  pythonOlder,
   typing-extensions,
+  uv-build,
 }:
 
 buildPythonPackage rec {
   pname = "githubkit";
-  version = "0.13.0";
+  version = "0.13.2";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
   src = fetchFromGitHub {
     owner = "yanyongyu";
     repo = "githubkit";
     tag = "v${version}";
-    hash = "sha256-BhTGik8JZ9QxE8zmfgToU7rVkY8T5iykJx4Bg4evyzY=";
+    hash = "sha256-MxMzc6JMeQCJJ6rWQYofThJB1mUHTOj4ztD9zye84O4=";
   };
 
   pythonRelaxDeps = [ "hishel" ];
 
-  build-system = [ poetry-core ];
+  build-system = [ uv-build ];
 
   dependencies = [
     hishel
diff --git a/pkgs/development/python-modules/google-cloud-spanner/default.nix b/pkgs/development/python-modules/google-cloud-spanner/default.nix
index 3cc0c1430697..19263faa4656 100644
--- a/pkgs/development/python-modules/google-cloud-spanner/default.nix
+++ b/pkgs/development/python-modules/google-cloud-spanner/default.nix
@@ -33,14 +33,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-spanner";
-  version = "3.57.0";
+  version = "3.58.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "python-spanner";
     tag = "v${version}";
-    hash = "sha256-XZfG3xk2DYcqzOkVKVRT+O81R+hL4CCfl+/E2WLThYA=";
+    hash = "sha256-bIagQjQv+oatIo8mkA8t5wP9igMnorkiudgyWkVnJcg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-genai/default.nix b/pkgs/development/python-modules/google-genai/default.nix
index 3029730391cb..39a9ee131d4a 100644
--- a/pkgs/development/python-modules/google-genai/default.nix
+++ b/pkgs/development/python-modules/google-genai/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "google-genai";
-  version = "1.35.0";
+  version = "1.38.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "python-genai";
     tag = "v${version}";
-    hash = "sha256-KJtnaL2XhTeAXmdIU2O7JkkN3LvOGA/aT3M3Wx9RapM=";
+    hash = "sha256-gJaLEpNKHl6n1MvQDIUW7ynsHYH2eEPGsYso5jSysNg=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/hanzidentifier/default.nix b/pkgs/development/python-modules/hanzidentifier/default.nix
index 2b425f81a485..be32acc7562e 100644
--- a/pkgs/development/python-modules/hanzidentifier/default.nix
+++ b/pkgs/development/python-modules/hanzidentifier/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "hanzidentifier";
-  version = "1.2.0";
+  version = "1.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tsroten";
     repo = "hanzidentifier";
     tag = "v${version}";
-    hash = "sha256-TVS21zy5UR+tGgVRB6eUguy2PGgruxbc+QR0DYUWl4w=";
+    hash = "sha256-SXIMk5Pr2jqoWOjKfVVhe6fHdbh3j+5Lnlru7St8bgA=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/inflate64/default.nix b/pkgs/development/python-modules/inflate64/default.nix
index 35da809726c4..e844b2367110 100644
--- a/pkgs/development/python-modules/inflate64/default.nix
+++ b/pkgs/development/python-modules/inflate64/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitea,
+  nix-update-script,
   setuptools,
   setuptools-scm,
   pytestCheckHook,
@@ -9,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "inflate64";
-  version = "1.0.1";
+  version = "1.0.2";
   pyproject = true;
 
   src = fetchFromGitea {
@@ -17,7 +18,7 @@ buildPythonPackage rec {
     owner = "miurahr";
     repo = "inflate64";
     tag = "v${version}";
-    hash = "sha256-deFx8NMbGLP51CdNvmZ25LQ5FLPBb1PB3QhGhIfTMfc=";
+    hash = "sha256-qYTkL37IzvrhYYwj6i6X8WRSQxprNKgBnQEYRnztzjA=";
   };
 
   build-system = [
@@ -33,6 +34,8 @@ buildPythonPackage rec {
     "inflate64"
   ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Compress and decompress with Enhanced Deflate compression algorithm";
     homepage = "https://codeberg.org/miurahr/inflate64";
diff --git a/pkgs/development/python-modules/jianpu-ly/default.nix b/pkgs/development/python-modules/jianpu-ly/default.nix
index 53efb8deb78c..c3b3ec5b1451 100644
--- a/pkgs/development/python-modules/jianpu-ly/default.nix
+++ b/pkgs/development/python-modules/jianpu-ly/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "jianpu-ly";
-  version = "1.862";
+  version = "1.863";
   pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = "jianpu_ly";
-    hash = "sha256-lrJVepMtdeHti+zmHiTP578aVedWj9N+s74xif1U9UM=";
+    hash = "sha256-feSg7kWWBFHqqvyx4O05KtWa9p4JvKwrtyMqbNXwAd0=";
   };
 
   dependencies = [ lilypond ];
diff --git a/pkgs/development/python-modules/keyring/default.nix b/pkgs/development/python-modules/keyring/default.nix
index ff52b0cfd36f..0583cbb5160f 100644
--- a/pkgs/development/python-modules/keyring/default.nix
+++ b/pkgs/development/python-modules/keyring/default.nix
@@ -48,7 +48,7 @@ buildPythonPackage rec {
   ]
   ++ lib.optionals (pythonOlder "3.12") [ importlib-metadata ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd keyring \
       --bash <($out/bin/keyring --print-completion bash) \
       --zsh <($out/bin/keyring --print-completion zsh)
diff --git a/pkgs/development/python-modules/knowit/default.nix b/pkgs/development/python-modules/knowit/default.nix
new file mode 100644
index 000000000000..c4c49ebddf0f
--- /dev/null
+++ b/pkgs/development/python-modules/knowit/default.nix
@@ -0,0 +1,87 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  fetchzip,
+
+  # build-system
+  poetry-core,
+
+  # dependencies
+  babelfish,
+  enzyme,
+  pymediainfo,
+  pyyaml,
+  trakit,
+  pint,
+
+  # nativeCheckInputs
+  pytestCheckHook,
+  ffmpeg,
+  mediainfo,
+  mkvtoolnix,
+  requests,
+}:
+
+buildPythonPackage rec {
+  pname = "knowit";
+  version = "0.5.11";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "ratoaq2";
+    repo = "knowit";
+    tag = version;
+    hash = "sha256-JqzCLdXEWZyvqXpeTJRW0zhY+wVcHLuBYrJbuSqfgkg=";
+  };
+
+  matroska_test_zip = fetchzip {
+    url = "http://downloads.sourceforge.net/project/matroska/test_files/matroska_test_w1_1.zip";
+    hash = "sha256-X8gIfDj2iP043kjO3yqxuIgn8mZMX7XaqzhQ7CTLUhc=";
+    stripRoot = false;
+  };
+
+  postPatch = ''
+    mkdir -p tests/data/videos
+    cp ${matroska_test_zip}/*.mkv tests/data/videos/
+  '';
+
+  build-system = [
+    poetry-core
+  ];
+
+  dependencies = [
+    babelfish
+    enzyme
+    pymediainfo
+    pyyaml
+    trakit
+  ];
+
+  optional-dependencies = {
+    pint = [
+      pint
+    ];
+  };
+
+  pythonImportsCheck = [
+    "knowit"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    ffmpeg
+    mediainfo
+    mkvtoolnix
+    requests
+  ];
+
+  meta = {
+    changelog = "https://github.com/ratoaq2/knowit/releases/tag/${src.tag}";
+    description = "Extract metadata from media files";
+    homepage = "https://github.com/ratoaq2/knowit";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ iynaix ];
+    mainProgram = "knowit";
+  };
+}
diff --git a/pkgs/development/python-modules/langchain-chroma/default.nix b/pkgs/development/python-modules/langchain-chroma/default.nix
index 2365b18fcd19..e412b4e02738 100644
--- a/pkgs/development/python-modules/langchain-chroma/default.nix
+++ b/pkgs/development/python-modules/langchain-chroma/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "langchain-chroma";
-  version = "0.2.5";
+  version = "0.2.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-chroma==${version}";
-    hash = "sha256-iOPhtDVsB2f6Jwr47aK3kaWAJEChNeVz7rS7slCUt04=";
+    hash = "sha256-HxoxxOgiDC/rf4hCA6uQBPmK11/fqddc5d4nMpIFxEw=";
   };
 
   sourceRoot = "${src.name}/libs/partners/chroma";
diff --git a/pkgs/development/python-modules/linearmodels/default.nix b/pkgs/development/python-modules/linearmodels/default.nix
new file mode 100644
index 000000000000..c8f3b819959d
--- /dev/null
+++ b/pkgs/development/python-modules/linearmodels/default.nix
@@ -0,0 +1,59 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  cython,
+  formulaic,
+  mypy-extensions,
+  numpy,
+  pandas,
+  pyhdfe,
+  pytestCheckHook,
+  scipy,
+  setuptools,
+  setuptools-scm,
+  statsmodels,
+}:
+
+buildPythonPackage rec {
+  pname = "linearmodels";
+  version = "6.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "bashtage";
+    repo = "linearmodels";
+    tag = "v${version}";
+    hash = "sha256-oWVBsFSKnv/8AHYP5sxO6+u5+hsOw/uQlOetse5ue88=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+    cython
+  ];
+
+  env.SETUPTOOLS_SCM_PRETEND_VERSION = version;
+
+  dependencies = [
+    formulaic
+    mypy-extensions
+    numpy
+    pandas
+    pyhdfe
+    scipy
+    statsmodels
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "linearmodels" ];
+
+  meta = {
+    description = "Models for panel data, system regression, instrumental variables and asset pricing";
+    homepage = "https://bashtage.github.io/linearmodels/";
+    changelog = "https://github.com/bashtage/linearmodels/releases/tag/v${version}";
+    license = lib.licenses.ncsa;
+    maintainers = with lib.maintainers; [ jherland ];
+  };
+}
diff --git a/pkgs/development/python-modules/llama-index-instrumentation/default.nix b/pkgs/development/python-modules/llama-index-instrumentation/default.nix
index 40774b99d19f..acc9cdebf04f 100644
--- a/pkgs/development/python-modules/llama-index-instrumentation/default.nix
+++ b/pkgs/development/python-modules/llama-index-instrumentation/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "llama-index-instrumentation";
-  version = "0.4.0";
+  version = "0.4.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "llama_index_instrumentation";
     inherit version;
-    hash = "sha256-847MHwK2wferhCY7qmRn+sn4ZTjA7iVUKFPeRieKvqc=";
+    hash = "sha256-p50N0rq6NPBf9DVNY6mbISMiY1uK+mzJbtAKfhHr/cM=";
   };
 
   pythonRelaxDeps = [ "pydantic" ];
diff --git a/pkgs/development/python-modules/manifestoo-core/default.nix b/pkgs/development/python-modules/manifestoo-core/default.nix
index bd13239399d3..7bc73b5ae002 100644
--- a/pkgs/development/python-modules/manifestoo-core/default.nix
+++ b/pkgs/development/python-modules/manifestoo-core/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "manifestoo-core";
-  version = "1.11";
+  version = "1.12";
   format = "pyproject";
 
   src = fetchPypi {
     inherit version;
     pname = "manifestoo_core";
-    hash = "sha256-f242Zf6L/vvAAOHpqcJVBVKFD17ATpDU3Er/eoNqIfg=";
+    hash = "sha256-cBWTXCIWBu9+mVnyj4jvGZuX8Hh6dePBRqB7BDf0gRQ=";
   };
 
   nativeBuildInputs = [ hatch-vcs ];
diff --git a/pkgs/development/python-modules/mcdreforged/default.nix b/pkgs/development/python-modules/mcdreforged/default.nix
index 462574bd83e6..796301df1627 100644
--- a/pkgs/development/python-modules/mcdreforged/default.nix
+++ b/pkgs/development/python-modules/mcdreforged/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "mcdreforged";
-  version = "2.15.2";
+  version = "2.15.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "MCDReforged";
     repo = "MCDReforged";
     tag = "v${version}";
-    hash = "sha256-BhiscpbuiP2UWkSfUl5lyZ+eeE3LiH80xXjHs7K3x88=";
+    hash = "sha256-q88jAsgoIFzsOVKeA4fk69wGbnq3HcYJ2YzeZQHmYo4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/meross-iot/default.nix b/pkgs/development/python-modules/meross-iot/default.nix
index d474b8a2b04a..823a87c580c8 100644
--- a/pkgs/development/python-modules/meross-iot/default.nix
+++ b/pkgs/development/python-modules/meross-iot/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "meross-iot";
-  version = "0.4.9.1";
+  version = "0.4.9.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "albertogeniola";
     repo = "MerossIot";
     tag = version;
-    hash = "sha256-c9nUFCjbuqJaGk5Rqo+Nmr+IYQrWsVqb36mLmYTc47s=";
+    hash = "sha256-l0mw/V965JqX/pgcs9ek9dMLzUCGnam0E5Cu8W/HfEU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/nats-py/default.nix b/pkgs/development/python-modules/nats-py/default.nix
index 73746749cfcb..4eb1555f61b2 100644
--- a/pkgs/development/python-modules/nats-py/default.nix
+++ b/pkgs/development/python-modules/nats-py/default.nix
@@ -56,6 +56,9 @@ buildPythonPackage rec {
     "test_subscribe_iterate_next_msg"
     "test_ordered_consumer_larger_streams"
     "test_object_file_basics"
+    # Should be safe to remove on next version upgrade (from 2.11.0)
+    # https://github.com/nats-io/nats.py/pull/728
+    "test_object_list"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     "test_subscribe_iterate_next_msg"
diff --git a/pkgs/development/python-modules/pandera/default.nix b/pkgs/development/python-modules/pandera/default.nix
index ce68f97a5f7d..c42958c57fa9 100644
--- a/pkgs/development/python-modules/pandera/default.nix
+++ b/pkgs/development/python-modules/pandera/default.nix
@@ -20,6 +20,7 @@
   # optional-dependencies
   black,
   dask,
+  duckdb,
   fastapi,
   geopandas,
   hypothesis,
@@ -31,25 +32,25 @@
   shapely,
 
   # tests
-  duckdb,
   joblib,
-  pyarrow,
   pyarrow-hotfix,
-  pytestCheckHook,
+  pyarrow,
   pytest-asyncio,
+  pytestCheckHook,
   pythonAtLeast,
+  rich,
 }:
 
 buildPythonPackage rec {
   pname = "pandera";
-  version = "0.25.0";
+  version = "0.26.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "unionai-oss";
     repo = "pandera";
     tag = "v${version}";
-    hash = "sha256-0YeLeGpunjHRWFvSvz0r2BokM4/eJKXuBajgcGquca4=";
+    hash = "sha256-kjKsujDxX2+X6omP9qDWc2JI8bxQlOSVOcEnfACoL2I=";
   };
 
   build-system = [
@@ -113,11 +114,12 @@ buildPythonPackage rec {
     extras // { all = lib.concatLists (lib.attrValues extras); };
 
   nativeCheckInputs = [
-    pytestCheckHook
-    pytest-asyncio
     joblib
     pyarrow
     pyarrow-hotfix
+    pytest-asyncio
+    pytestCheckHook
+    rich
   ]
   ++ optional-dependencies.all;
 
@@ -133,17 +135,22 @@ buildPythonPackage rec {
     "tests/dask/test_dask_accessor.py::test_dataframe_series_add_schema"
   ];
 
-  disabledTests =
-    lib.optionals stdenv.hostPlatform.isDarwin [
-      # OOM error on ofborg:
-      "test_engine_geometry_coerce_crs"
-      # pandera.errors.SchemaError: Error while coercing 'geometry' to type geometry
-      "test_schema_dtype_crs_with_coerce"
-    ]
-    ++ lib.optionals (pythonAtLeast "3.13") [
-      # AssertionError: assert DataType(Sparse[float64, nan]) == DataType(Sparse[float64, nan])
-      "test_legacy_default_pandas_extension_dtype"
-    ];
+  disabledTests = [
+    # TypeError: __class__ assignment: 'GeoDataFrame' object...
+    "test_schema_model"
+    "test_schema_from_dataframe"
+    "test_schema_no_geometry"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # OOM error on ofborg:
+    "test_engine_geometry_coerce_crs"
+    # pandera.errors.SchemaError: Error while coercing 'geometry' to type geometry
+    "test_schema_dtype_crs_with_coerce"
+  ]
+  ++ lib.optionals (pythonAtLeast "3.13") [
+    # AssertionError: assert DataType(Sparse[float64, nan]) == DataType(Sparse[float64, nan])
+    "test_legacy_default_pandas_extension_dtype"
+  ];
 
   pythonImportsCheck = [
     "pandera"
diff --git a/pkgs/development/python-modules/piqp/default.nix b/pkgs/development/python-modules/piqp/default.nix
index 63c7bd058b37..efdb378f7130 100644
--- a/pkgs/development/python-modules/piqp/default.nix
+++ b/pkgs/development/python-modules/piqp/default.nix
@@ -1,86 +1,71 @@
 {
   lib,
-  fetchFromGitHub,
   buildPythonPackage,
-  pytestCheckHook,
-  stdenv,
-  pythonOlder,
-  setuptools,
+  fetchFromGitHub,
+  replaceVars,
+  cpu_features,
+
+  # build-system
   cmake,
   ninja,
-  wheel,
-  matio,
+  pybind11,
+  scikit-build-core,
+
+  # buildInputs
   eigen,
   gtest,
-  cpu_features,
-  pybind11,
-  python,
+  matio,
+
+  # tests
   numpy,
   scipy,
+  pytestCheckHook,
 }:
 buildPythonPackage rec {
   pname = "piqp";
-  version = "0.6.0";
+  version = "0.6.2";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchFromGitHub {
     owner = "PREDICT-EPFL";
     repo = "piqp";
     tag = "v${version}";
-    hash = "sha256-hVUeDV2GrBAOIgaWhg+RV+8CFRIm8Kv6/wCs5bXs2aY=";
+    hash = "sha256-W9t7d+wV5WcphL54e6tpnKxiWFay9UrFmIRKsGk2yMM=";
   };
 
-  postPatch =
-    let
-      # E.g. 3.11.2 -> "311"
-      pythonVersionMajorMinor =
-        with lib.versions;
-        "${major python.pythonVersion}${minor python.pythonVersion}";
-
-      # E.g. "linux-aarch64"
-      platform =
-        with stdenv.hostPlatform;
-        (lib.optionalString (!isDarwin) "${parsed.kernel.name}-${parsed.cpu.name}")
-        + (lib.optionalString isDarwin "macosx-${darwinMinVersion}-${darwinArch}");
-    in
-    ''
-      build="build/temp.${platform}-cpython-${pythonVersionMajorMinor}/${pname}.${pname}"
-      mkdir -p $build/_deps
-      ln -s ${cpu_features.src} $build/_deps/cpu_features-src
-    '';
-
-  patches = [ ./use-nix-packages.patch ];
+  patches = [
+    (replaceVars ./use-nix-packages.patch {
+      cpu_features_src = cpu_features.src;
+    })
+  ];
 
   build-system = [
-    setuptools
     cmake
     ninja
-    wheel
+    pybind11
+    scikit-build-core
   ];
+  dontUseCmakeConfigure = true;
 
   buildInputs = [
-    matio
     eigen
     gtest
-    pybind11
+    matio
   ];
 
-  dontUseCmakeConfigure = true;
-
   pythonImportsCheck = [ "piqp" ];
 
   nativeCheckInputs = [
-    pytestCheckHook
     numpy
+    pytestCheckHook
     scipy
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Proximal Interior Point Quadratic Programming solver";
     homepage = "https://github.com/PREDICT-EPFL/piqp";
-    license = licenses.bsd2;
-    maintainers = with maintainers; [ renesat ];
+    changelog = "https://github.com/PREDICT-EPFL/piqp/releases/tag/v${version}";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ renesat ];
   };
 }
diff --git a/pkgs/development/python-modules/piqp/use-nix-packages.patch b/pkgs/development/python-modules/piqp/use-nix-packages.patch
index 27a61b165e54..ac4a5d87df50 100644
--- a/pkgs/development/python-modules/piqp/use-nix-packages.patch
+++ b/pkgs/development/python-modules/piqp/use-nix-packages.patch
@@ -1,21 +1,21 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index ea1da5e..0a6f096 100644
+index 8e0eb68..0131d4e 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -100,7 +100,7 @@ if (BUILD_PYTHON_INTERFACE OR BUILD_MATLAB_INTERFACE)
+@@ -109,7 +109,7 @@ if (BUILD_PYTHON_INTERFACE OR BUILD_MATLAB_INTERFACE)
      include(FetchContent)
      FetchContent_Declare(
          cpu_features
--        URL https://github.com/google/cpu_features/archive/refs/tags/v0.9.0.zip
-+	DOWNLOAD_COMMAND true
+-        URL https://github.com/google/cpu_features/archive/refs/tags/v0.10.1.zip
++        URL @cpu_features_src@
      )
      set(BUILD_SHARED_LIBS_COPY ${BUILD_SHARED_LIBS})
      set(BUILD_SHARED_LIBS OFF)
 diff --git a/interfaces/c/tests/CMakeLists.txt b/interfaces/c/tests/CMakeLists.txt
-index 010f038..c8f9ec4 100644
+index 5919593..bf504c5 100644
 --- a/interfaces/c/tests/CMakeLists.txt
 +++ b/interfaces/c/tests/CMakeLists.txt
-@@ -13,18 +13,8 @@ if (CMAKE_VERSION VERSION_GREATER_EQUAL "3.24.0")
+@@ -17,18 +17,8 @@ if (CMAKE_VERSION VERSION_GREATER_EQUAL "3.30.0")
  endif()
  
  # Google Test
@@ -37,19 +37,16 @@ index 010f038..c8f9ec4 100644
  enable_testing()
  
 diff --git a/interfaces/python/CMakeLists.txt b/interfaces/python/CMakeLists.txt
-index f7415dc..885aeff 100644
+index b2e3cef..3d9cf65 100644
 --- a/interfaces/python/CMakeLists.txt
 +++ b/interfaces/python/CMakeLists.txt
-@@ -14,19 +14,7 @@ if (CMAKE_VERSION VERSION_GREATER_EQUAL "3.24.0")
+@@ -13,16 +13,7 @@ if (CMAKE_VERSION VERSION_GREATER_EQUAL "3.24.0")
+     cmake_policy(SET CMP0135 OLD)
  endif()
  
- # Find pybind11
--include(FetchContent)
--FetchContent_Declare(
--    pybind11
--    URL https://github.com/pybind/pybind11/archive/refs/tags/v2.12.0.zip
--)
--FetchContent_MakeAvailable(pybind11)
+-# Find pybind11
+-set(PYBIND11_FINDPYTHON ON)
+-find_package(pybind11 CONFIG REQUIRED)
 -
 -# detect arm64 cross compilation on macOS
 -if(DEFINED ENV{_PYTHON_HOST_PLATFORM})
@@ -62,7 +59,7 @@ index f7415dc..885aeff 100644
  # add instruction set detection on x86/amd64
  pybind11_add_module(instruction_set src/instruction_set.cpp)
 diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
-index d11bd37..2275a62 100644
+index fded71a..cb568a7 100644
 --- a/tests/CMakeLists.txt
 +++ b/tests/CMakeLists.txt
 @@ -14,18 +14,8 @@ if (CMAKE_VERSION VERSION_GREATER_EQUAL "3.24.0")
diff --git a/pkgs/development/python-modules/pyfronius/default.nix b/pkgs/development/python-modules/pyfronius/default.nix
index 86b97e404984..217edb838f02 100644
--- a/pkgs/development/python-modules/pyfronius/default.nix
+++ b/pkgs/development/python-modules/pyfronius/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pyfronius";
-  version = "0.8.0";
+  version = "0.8.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nielstron";
     repo = "pyfronius";
     tag = version;
-    hash = "sha256-Ns4OpBvj40aQkCBTnKHMTSpyNu5zgfXDtmz1aW3bmEU=";
+    hash = "sha256-Q1GMt9K9+wohFogXwGyAhyfSxSsmo+80Kca7F7VhksA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyhdfe/default.nix b/pkgs/development/python-modules/pyhdfe/default.nix
new file mode 100644
index 000000000000..6b887dceb83b
--- /dev/null
+++ b/pkgs/development/python-modules/pyhdfe/default.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  numpy,
+  pytestCheckHook,
+  scipy,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "pyhdfe";
+  version = "0.2.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jeffgortmaker";
+    repo = "pyhdfe";
+    tag = "v${version}";
+    hash = "sha256-UXVQHf4Nmq/zQZtPaLba4TShhpgPUBwPM+zCEa8qaKs=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    numpy
+    scipy
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "pyhdfe" ];
+
+  meta = {
+    description = "Python 3 implementation of algorithms for absorbing high dimensional fixed effects";
+    homepage = "https://github.com/jeffgortmaker/pyhdfe";
+    changelog = "https://github.com/jeffgortmaker/pyhdfe/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jherland ];
+  };
+}
diff --git a/pkgs/development/python-modules/pynitrokey/default.nix b/pkgs/development/python-modules/pynitrokey/default.nix
index 06ec6c673405..1ce0824e3d39 100644
--- a/pkgs/development/python-modules/pynitrokey/default.nix
+++ b/pkgs/development/python-modules/pynitrokey/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchPypi,
   installShellFiles,
@@ -72,7 +73,7 @@ buildPythonPackage {
 
   pythonImportsCheck = [ "pynitrokey" ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd ${mainProgram} \
       --bash <(_NITROPY_COMPLETE=bash_source $out/bin/${mainProgram}) \
       --zsh <(_NITROPY_COMPLETE=zsh_source $out/bin/${mainProgram}) \
diff --git a/pkgs/development/python-modules/pypiserver/default.nix b/pkgs/development/python-modules/pypiserver/default.nix
index ef39dbe21f80..121801f3b9ac 100644
--- a/pkgs/development/python-modules/pypiserver/default.nix
+++ b/pkgs/development/python-modules/pypiserver/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "pypiserver";
-  version = "2.3.2";
+  version = "2.4.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "pypiserver";
     repo = "pypiserver";
     tag = "v${version}";
-    hash = "sha256-ODwDYAEAqel31+kR/BE1yBfgOZOtPz3iaCLg/d6jbb4=";
+    hash = "sha256-tbBSZdkZJGcas3PZ3dj7CqAYNH2Mt0a4aXl6t7E+wNY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyreadstat/default.nix b/pkgs/development/python-modules/pyreadstat/default.nix
index 64db1c5206a4..926581a1bd48 100644
--- a/pkgs/development/python-modules/pyreadstat/default.nix
+++ b/pkgs/development/python-modules/pyreadstat/default.nix
@@ -1,13 +1,11 @@
 {
   lib,
-  stdenv,
   buildPythonPackage,
   cython,
   fetchFromGitHub,
-  libiconv,
+  narwhals,
   pandas,
   python,
-  pythonOlder,
   readstat,
   setuptools,
   zlib,
@@ -15,16 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pyreadstat";
-  version = "1.3.0";
+  version = "1.3.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchFromGitHub {
     owner = "Roche";
     repo = "pyreadstat";
     tag = "v${version}";
-    hash = "sha256-ZcdCUX8mNBipOV5k+y7WdgxCZLfsZZlClyeuL8sQ6BI=";
+    hash = "sha256-EiQKsz4+PdUNXAniw8ftZbF5B+BegUx40zumE3Z7Xmo=";
   };
 
   build-system = [
@@ -32,9 +28,10 @@ buildPythonPackage rec {
     setuptools
   ];
 
-  buildInputs = [ zlib ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ libiconv ];
+  buildInputs = [ zlib ];
 
   dependencies = [
+    narwhals
     readstat
     pandas
   ];
diff --git a/pkgs/development/python-modules/python-docs-theme/default.nix b/pkgs/development/python-modules/python-docs-theme/default.nix
index b8c92da93302..81e9744b25e6 100644
--- a/pkgs/development/python-modules/python-docs-theme/default.nix
+++ b/pkgs/development/python-modules/python-docs-theme/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "python-docs-theme";
-  version = "2025.9.1";
+  version = "2025.9.2";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "python";
     repo = "python-docs-theme";
     tag = version;
-    hash = "sha256-rO2L5M2TYU8+fJLDbu+EMqAy3vD7yNwd5b1fMZ8LNwg=";
+    hash = "sha256-G9QhrNqwSonyCQXxBv1GkUx39GyOQs+0gciJDQwWvVQ=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/python-modules/python-pkcs11/default.nix b/pkgs/development/python-modules/python-pkcs11/default.nix
index baa6e6b45e63..b67fab579aa6 100644
--- a/pkgs/development/python-modules/python-pkcs11/default.nix
+++ b/pkgs/development/python-modules/python-pkcs11/default.nix
@@ -2,7 +2,6 @@
   lib,
   asn1crypto,
   buildPythonPackage,
-  cached-property,
   cython,
   fetchFromGitHub,
   setuptools-scm,
@@ -10,23 +9,22 @@
 
 buildPythonPackage rec {
   pname = "python-pkcs11";
-  version = "0.8.1";
+  version = "0.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "danni";
     repo = "python-pkcs11";
     tag = "v${version}";
-    sha256 = "sha256-iCfcVVzAwwg69Ym1uVimSzYZBQmC+Yppl5YXDaLIcqc=";
+    sha256 = "sha256-8KLc/jNpYAsuRaiRVD9m5rQWW6u1EG1yf9fwwXRk4Qc=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     cython
     setuptools-scm
   ];
 
-  propagatedBuildInputs = [
-    cached-property
+  dependencies = [
     asn1crypto
   ];
 
@@ -35,10 +33,11 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "pkcs11" ];
 
-  meta = with lib; {
+  meta = {
+    changelog = "https://github.com/pyauth/python-pkcs11/releases/tag/${src.tag}";
     description = "PKCS#11/Cryptoki support for Python";
     homepage = "https://github.com/danni/python-pkcs11";
-    license = with licenses; [ mit ];
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
   };
 }
diff --git a/pkgs/development/python-modules/scikit-survival/default.nix b/pkgs/development/python-modules/scikit-survival/default.nix
index 54714e1e66b2..9075dafe84aa 100644
--- a/pkgs/development/python-modules/scikit-survival/default.nix
+++ b/pkgs/development/python-modules/scikit-survival/default.nix
@@ -1,40 +1,57 @@
 {
-  stdenv,
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  cython,
-  ecos,
   eigen,
+
+  # build-system
+  cython,
+  numpy,
+  packaging,
+  scikit-learn,
+  setuptools,
+  setuptools-scm,
+
+  # dependencies
+  ecos,
   joblib,
   numexpr,
-  numpy,
   osqp,
   pandas,
-  setuptools-scm,
-  scikit-learn,
   scipy,
+
+  # tests
   pytestCheckHook,
 }:
 
 buildPythonPackage rec {
   pname = "scikit-survival";
-  version = "0.24.1";
+  version = "0.25.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "sebp";
     repo = "scikit-survival";
     tag = "v${version}";
-    hash = "sha256-El5q2eE6wJKg/8rcFZPZQl7MVxw1jMsggjiCJHj7il8=";
+    hash = "sha256-OvdmZ2vDptYB2tq7OtokIQzjKzhQBWwnXZLW0m6FqlI=";
   };
 
-  nativeBuildInputs = [
+  postPatch = ''
+    ln -s ${lib.getInclude eigen}/include/eigen3/Eigen \
+      sksurv/linear_model/src/eigen
+  '';
+
+  build-system = [
     cython
+    numpy
+    packaging
+    scikit-learn
+    setuptools
     setuptools-scm
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     ecos
     joblib
     numexpr
@@ -49,22 +66,14 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
-  postPatch = ''
-    ln -s ${lib.getInclude eigen}/include/eigen3/Eigen \
-      sksurv/linear_model/src/eigen
-  '';
-
   # Hack needed to make pytest + cython work
   # https://github.com/NixOS/nixpkgs/pull/82410#issuecomment-827186298
   preCheck = ''
-    export HOME=$(mktemp -d)
-    cp -r $TMP/$sourceRoot/tests $HOME
-    pushd $HOME
+    rm -rf sksurv
   '';
-  postCheck = "popd";
 
-  # very long tests, unnecessary for a leaf package
   disabledTests = [
+    # very long tests, unnecessary for a leaf package
     "test_coxph"
     "test_datasets"
     "test_ensemble_selection"
@@ -73,16 +82,17 @@ buildPythonPackage rec {
     "test_survival_svm"
     "test_tree"
   ]
-  ++
-    lib.optional (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64)
-      # floating point mismatch on aarch64
-      # 27079905.88052468 to far from 27079905.880496684
-      "test_coxnet";
+  ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
+    # floating point mismatch on aarch64
+    # 27079905.88052468 to far from 27079905.880496684
+    "test_coxnet"
+  ];
 
-  meta = with lib; {
+  meta = {
     description = "Survival analysis built on top of scikit-learn";
     homepage = "https://github.com/sebp/scikit-survival";
-    license = licenses.gpl3Only;
-    maintainers = with maintainers; [ GuillaumeDesforges ];
+    changelog = "https://github.com/sebp/scikit-survival/releases/tag/v${version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ GuillaumeDesforges ];
   };
 }
diff --git a/pkgs/development/python-modules/sentence-transformers/default.nix b/pkgs/development/python-modules/sentence-transformers/default.nix
index 0d1bb64536a9..456a2f3f2c81 100644
--- a/pkgs/development/python-modules/sentence-transformers/default.nix
+++ b/pkgs/development/python-modules/sentence-transformers/default.nix
@@ -27,14 +27,14 @@
 
 buildPythonPackage rec {
   pname = "sentence-transformers";
-  version = "5.1.0";
+  version = "5.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "UKPLab";
     repo = "sentence-transformers";
     tag = "v${version}";
-    hash = "sha256-snowpTdHelcFjo1+hvqpoVt5ROB0f91yt0GsIvA5cso=";
+    hash = "sha256-n0ZP01BU/s9iJ+RP7rNlBjD11jNDj8A8Q/seekh56nA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/smpp-pdu/default.nix b/pkgs/development/python-modules/smpp-pdu/default.nix
index a515b5371627..1da871ed0da5 100644
--- a/pkgs/development/python-modules/smpp-pdu/default.nix
+++ b/pkgs/development/python-modules/smpp-pdu/default.nix
@@ -2,13 +2,14 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  nix-update-script,
   pytestCheckHook,
   setuptools,
 }:
 
 buildPythonPackage {
   pname = "smpp-pdu";
-  version = "unstable-2022-09-02";
+  version = "0.3-unstable-2022-09-01";
   format = "pyproject";
 
   # Upstream was once mozes/smpp.pdu, but it's dead and Python 2 only.
@@ -25,6 +26,10 @@ buildPythonPackage {
 
   pythonImportsCheck = [ "smpp.pdu" ];
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
+
   meta = with lib; {
     description = "Library for parsing Protocol Data Units (PDUs) in SMPP protocol";
     homepage = "https://github.com/hologram-io/smpp.pdu";
diff --git a/pkgs/development/python-modules/solarlog-cli/default.nix b/pkgs/development/python-modules/solarlog-cli/default.nix
index 25aa10f1d4db..2e3fbb24a62c 100644
--- a/pkgs/development/python-modules/solarlog-cli/default.nix
+++ b/pkgs/development/python-modules/solarlog-cli/default.nix
@@ -5,6 +5,7 @@
   fetchFromGitHub,
   hatchling,
   aiohttp,
+  bcrypt,
   mashumaro,
   aioresponses,
   pytest-aio,
@@ -14,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "solarlog-cli";
-  version = "0.5.0";
+  version = "0.6.0";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -23,13 +24,14 @@ buildPythonPackage rec {
     owner = "dontinelli";
     repo = "solarlog_cli";
     tag = "v${version}";
-    hash = "sha256-MMn03i4Uu0auEzUiQHWCNfJyp32P+68pd4fDMy2GqnA=";
+    hash = "sha256-oxeZkf5RpTgAd/PO8itElvQyBOQg1k4W//4M8Q0xbJg=";
   };
 
   build-system = [ hatchling ];
 
   dependencies = [
     aiohttp
+    bcrypt
     mashumaro
   ];
 
diff --git a/pkgs/development/python-modules/sqlite-migrate/default.nix b/pkgs/development/python-modules/sqlite-migrate/default.nix
index 8c1d58d9dc01..8d2d9855425f 100644
--- a/pkgs/development/python-modules/sqlite-migrate/default.nix
+++ b/pkgs/development/python-modules/sqlite-migrate/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "sqlite-migrate";
-  version = "0.1a2";
+  version = "0.1b0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-wztAqe3TW0SQ4JX1XPWeA4KNJci5c3fNih97cmlPwRE=";
+    hash = "sha256-jVArPKS5xF5WASvTXAPSMjXwgjyXbUzpQMu0DjMIfe0=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/subliminal/default.nix b/pkgs/development/python-modules/subliminal/default.nix
index 43fa45173a13..d78808a666d3 100644
--- a/pkgs/development/python-modules/subliminal/default.nix
+++ b/pkgs/development/python-modules/subliminal/default.nix
@@ -4,23 +4,33 @@
   fetchFromGitHub,
   pythonOlder,
 
+  # build-system
+  hatchling,
+  hatch-vcs,
+
+  # dependencies
   babelfish,
   beautifulsoup4,
   chardet,
   click,
   click-option-group,
+  defusedxml,
   dogpile-cache,
   enzyme,
   guessit,
+  knowit,
   srt,
   pysubs2,
   rarfile,
   requests,
   platformdirs,
-  setuptools,
   stevedore,
   tomli,
+  tomlkit,
 
+  # nativeCheckInputs
+  colorama,
+  pypandoc,
   pytestCheckHook,
   pytest-cov-stub,
   pytest-xdist,
@@ -43,7 +53,10 @@ buildPythonPackage rec {
     hash = "sha256-eAXzD6diep28wCZjWLOZpOX1bnakEldhs2LX5CPu5OI=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [
+    hatchling
+    hatch-vcs
+  ];
 
   propagatedBuildInputs = [
     babelfish
@@ -51,9 +64,11 @@ buildPythonPackage rec {
     chardet
     click
     click-option-group
+    defusedxml
     dogpile-cache
     enzyme
     guessit
+    knowit
     srt
     pysubs2
     rarfile
@@ -61,9 +76,12 @@ buildPythonPackage rec {
     platformdirs
     stevedore
     tomli
+    tomlkit
   ];
 
   nativeCheckInputs = [
+    colorama
+    pypandoc
     pytestCheckHook
     pytest-cov-stub
     pytest-xdist
@@ -76,6 +94,10 @@ buildPythonPackage rec {
 
   disabledTests = [
     # Tests require network access
+    "integration"
+    "test_cli_cache"
+    "test_cli_download"
+    "test_is_supported_archive"
     "test_refine"
     "test_scan"
     "test_hash"
diff --git a/pkgs/development/python-modules/telethon/default.nix b/pkgs/development/python-modules/telethon/default.nix
index b48ef2157e4f..fb350cf4a0b5 100644
--- a/pkgs/development/python-modules/telethon/default.nix
+++ b/pkgs/development/python-modules/telethon/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "telethon";
-  version = "1.40.0";
+  version = "1.41.1";
   pyproject = true;
 
   disabled = pythonOlder "3.5";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "LonamiWebs";
     repo = "Telethon";
     tag = "v${version}";
-    hash = "sha256-y8nMh2dAy5ixATYGjH04FtfpvhO2HU5HRTXBr7Z+Dds=";
+    hash = "sha256-V38enxg1ZW1zd87xRLr0GHv+t1NK7fwDFxXDqPvCf2U=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/temporalio/default.nix b/pkgs/development/python-modules/temporalio/default.nix
index 43fb5b9cbdbe..de0d91404c7f 100644
--- a/pkgs/development/python-modules/temporalio/default.nix
+++ b/pkgs/development/python-modules/temporalio/default.nix
@@ -22,7 +22,7 @@
 
 buildPythonPackage rec {
   pname = "temporalio";
-  version = "1.17.0";
+  version = "1.18.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     owner = "temporalio";
     repo = "sdk-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-uxjZ3aINVP4g5UTzhGW7H/7dyaZlAqBuXH9uVS1zax0=";
+    hash = "sha256-uFcy348o4e7DZ+12Lc52wfANFHYCyMfLL/clhRsdkcI=";
     fetchSubmodules = true;
   };
 
@@ -42,7 +42,7 @@ buildPythonPackage rec {
       src
       cargoRoot
       ;
-    hash = "sha256-yE5mShJ++Zx+5AwsotGn20b7dC6BEbTiIy1xST9du+U=";
+    hash = "sha256-2/AH8ffSRXBrzF2G9n8MdJfbOrSnSVPRfB1fDm8wFU0=";
   };
 
   cargoRoot = "temporalio/bridge";
diff --git a/pkgs/development/python-modules/tlsh/cmake-4-compat.patch b/pkgs/development/python-modules/tlsh/cmake-4-compat.patch
new file mode 100644
index 000000000000..85aeac4ea6cb
--- /dev/null
+++ b/pkgs/development/python-modules/tlsh/cmake-4-compat.patch
@@ -0,0 +1,22 @@
+From e08aafe1363fa9ed98ee16026ed2b81d2c2c1977 Mon Sep 17 00:00:00 2001
+From: Thomas Bracht Laumann Jespersen <t@laumann.xyz>
+Date: Tue, 24 Jun 2025 12:37:33 +0200
+Subject: [PATCH] Increase cmake_minimum_required version for CMake 4 compat
+
+---
+ CMakeLists.txt | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index d360291..e1cfa8c 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -51,7 +51,7 @@
+ # OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ # OF THE POSSIBILITY OF SUCH DAMAGE.
+ 
+-cmake_minimum_required(VERSION 2.6)
++cmake_minimum_required(VERSION 3.10)
+ 
+ project(TLSH)
+ 
diff --git a/pkgs/development/python-modules/tlsh/default.nix b/pkgs/development/python-modules/tlsh/default.nix
index 92ba131d7a05..241669026257 100644
--- a/pkgs/development/python-modules/tlsh/default.nix
+++ b/pkgs/development/python-modules/tlsh/default.nix
@@ -18,6 +18,11 @@ buildPythonPackage rec {
     hash = "sha256-Ht4LkcNmxPEvzFHXeS/XhPt/xo+0sE4RBcLCn9N/zwE=";
   };
 
+  patches = [
+    # https://github.com/trendmicro/tlsh/pull/152
+    ./cmake-4-compat.patch
+  ];
+
   nativeBuildInputs = [ cmake ];
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/trimesh/default.nix b/pkgs/development/python-modules/trimesh/default.nix
index fdb3597e7cd8..0019d714b2d9 100644
--- a/pkgs/development/python-modules/trimesh/default.nix
+++ b/pkgs/development/python-modules/trimesh/default.nix
@@ -29,7 +29,7 @@
 
 buildPythonPackage rec {
   pname = "trimesh";
-  version = "4.8.1";
+  version = "4.8.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "mikedh";
     repo = "trimesh";
     tag = version;
-    hash = "sha256-nU79v0n6Dx5YV4nWBtLYXU1oickdcS43Me5fd5QNb88=";
+    hash = "sha256-9D3cuQ6parDq2pWSJmGlMzUyxUOs6Nn9T4l8Fpz50nw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/types-aiobotocore-packages/default.nix b/pkgs/development/python-modules/types-aiobotocore-packages/default.nix
index 2c0ec2af86a3..85354006f3ed 100644
--- a/pkgs/development/python-modules/types-aiobotocore-packages/default.nix
+++ b/pkgs/development/python-modules/types-aiobotocore-packages/default.nix
@@ -61,620 +61,620 @@ let
 in
 {
   types-aiobotocore-accessanalyzer =
-    buildTypesAiobotocorePackage "accessanalyzer" "2.23.2"
-      "sha256-lRW+1h47u78SeFlV6g85VUeTWcrD+35tyvfDLW9PBoo=";
+    buildTypesAiobotocorePackage "accessanalyzer" "2.24.2"
+      "sha256-Uc7aAJOW/G7uhDh6meNXyAlCxsOpuMY2LZpzF8sx1sw=";
 
   types-aiobotocore-account =
-    buildTypesAiobotocorePackage "account" "2.23.2"
-      "sha256-dD41Uwz5+RvQ7eUm+FqMXrZn8M7zP5FSMuSh77E3NGE=";
+    buildTypesAiobotocorePackage "account" "2.24.2"
+      "sha256-wfkv2Kq4w0Cr/4UbGRLYAPxH02exFtKSIQZDD0367C8=";
 
   types-aiobotocore-acm =
-    buildTypesAiobotocorePackage "acm" "2.23.2"
-      "sha256-/RCJBWx6BNQRAAQ9NU0C4W7kImYXL+nvlMLziZ0XKKc=";
+    buildTypesAiobotocorePackage "acm" "2.24.2"
+      "sha256-kr/ykcIeGrNL7X0zNCYpEBK8flZJ7/w53zY41N5Wl7M=";
 
   types-aiobotocore-acm-pca =
-    buildTypesAiobotocorePackage "acm-pca" "2.23.2"
-      "sha256-9GbwI5+x58e/3Ib3dP60Ynerp1s5HX84+xQGU1qIlVQ=";
+    buildTypesAiobotocorePackage "acm-pca" "2.24.2"
+      "sha256-8HRbVA8OdOdADGSiM/qcwqRqVFNtkHLw2O3UxjRdoXU=";
 
   types-aiobotocore-alexaforbusiness =
     buildTypesAiobotocorePackage "alexaforbusiness" "2.13.0"
       "sha256-+w/InoQR2aZ5prieGhgEEp7auBiSSghG5zIIHY5Kyao=";
 
   types-aiobotocore-amp =
-    buildTypesAiobotocorePackage "amp" "2.23.2"
-      "sha256-sI9rqtX3f5VhaZ1sErcDIIi0AignzNXB6RWjC18Ujd0=";
+    buildTypesAiobotocorePackage "amp" "2.24.2"
+      "sha256-NcXjStoCfslJvzmWxxDXlPAYxrO/GMEbzsmKQi7uaOw=";
 
   types-aiobotocore-amplify =
-    buildTypesAiobotocorePackage "amplify" "2.23.2"
-      "sha256-D7C4ccCxUJ1HAxTtPiaMNpaaT8uvfGwrlvSXwsRIk7c=";
+    buildTypesAiobotocorePackage "amplify" "2.24.2"
+      "sha256-jlSLx4AwRpAhU6a/YTHf8/i8W+w7QEAIUKXAXgIiy6Y=";
 
   types-aiobotocore-amplifybackend =
-    buildTypesAiobotocorePackage "amplifybackend" "2.23.2"
-      "sha256-CCN9H7aK3FuLVYvy0X1c7nA06fkLYneJE/YEBdsPKis=";
+    buildTypesAiobotocorePackage "amplifybackend" "2.24.2"
+      "sha256-VGj6eivlyqpOMF6+Vj9BxNrr+cTcrtz1I3Ta3QzlU8k=";
 
   types-aiobotocore-amplifyuibuilder =
-    buildTypesAiobotocorePackage "amplifyuibuilder" "2.23.2"
-      "sha256-uYV6EQE37w4+8OFFKCbpBwNbGfItl31ylVN7/YjsMgU=";
+    buildTypesAiobotocorePackage "amplifyuibuilder" "2.24.2"
+      "sha256-zJ8kxnGUDO7WQFnqJ3JiolgpsXB0g2eTLWRgvB+MmrI=";
 
   types-aiobotocore-apigateway =
-    buildTypesAiobotocorePackage "apigateway" "2.23.2"
-      "sha256-bv+Q9hxNW3tcxAKXbPK5m3KHl7Ismgc8J548ZPVlccs=";
+    buildTypesAiobotocorePackage "apigateway" "2.24.2"
+      "sha256-tcedCy72LR/rZnw8LWfLYs+Kh4GGuOj9PfVikmREgj0=";
 
   types-aiobotocore-apigatewaymanagementapi =
-    buildTypesAiobotocorePackage "apigatewaymanagementapi" "2.23.2"
-      "sha256-iXT2cKSE4mxIVv64kdsCWVANeatMQHqBE/mEUkct/QI=";
+    buildTypesAiobotocorePackage "apigatewaymanagementapi" "2.24.2"
+      "sha256-wvgMQvNAH12xf7HSTCEmz4NCPqZ7zjuF/FCCnUM5HBc=";
 
   types-aiobotocore-apigatewayv2 =
-    buildTypesAiobotocorePackage "apigatewayv2" "2.23.2"
-      "sha256-nZrB3Sb1yEhF/jWah5Jucwv4SqpF5QGIodHDIdUxfPw=";
+    buildTypesAiobotocorePackage "apigatewayv2" "2.24.2"
+      "sha256-qwjb1OM+twzJEoplHC1TAs4h6uUwShSUcI1ONe/UH8w=";
 
   types-aiobotocore-appconfig =
-    buildTypesAiobotocorePackage "appconfig" "2.23.2"
-      "sha256-z+zACz2w0ES+ruSBIukDwKOHp4zEgjoK2L8wnn5OvHg=";
+    buildTypesAiobotocorePackage "appconfig" "2.24.2"
+      "sha256-MvKcniYWdhKCt0BhEhTIMdl3oIEicxSDtKqH8R6p/HU=";
 
   types-aiobotocore-appconfigdata =
-    buildTypesAiobotocorePackage "appconfigdata" "2.23.2"
-      "sha256-pticQtJzTeXXI+C1QDd1J1C5pYvkBQ9KCzMJPQgld9M=";
+    buildTypesAiobotocorePackage "appconfigdata" "2.24.2"
+      "sha256-ouScqz5tDrS4VDrFTHJuedaqBNg8TEH3aJzKMlq4zPU=";
 
   types-aiobotocore-appfabric =
-    buildTypesAiobotocorePackage "appfabric" "2.23.2"
-      "sha256-6UyXmjLPPHUYAq7+yFKgppn8YpJcZysRnI5gqimYENk=";
+    buildTypesAiobotocorePackage "appfabric" "2.24.2"
+      "sha256-FgOYrPPTGTwpPft6yoqUY4/gWXmbnb9IGRkjHvUjYvI=";
 
   types-aiobotocore-appflow =
-    buildTypesAiobotocorePackage "appflow" "2.23.2"
-      "sha256-DpQHpXC3YVMb4jLCRjFi8HL0qUn/nP1g9vqYl/bNTE8=";
+    buildTypesAiobotocorePackage "appflow" "2.24.2"
+      "sha256-TZAGlGG8w/AO6eiihhmVQyFb/wAtM5aOkQV2hdALo6M=";
 
   types-aiobotocore-appintegrations =
-    buildTypesAiobotocorePackage "appintegrations" "2.23.2"
-      "sha256-xR44BE0eqNYtQhfZhoo7BpOBgEAcG3AAIR9nJh98EPk=";
+    buildTypesAiobotocorePackage "appintegrations" "2.24.2"
+      "sha256-jxQX7Q6xrNLBrMBSLc8XZvPDnpE6js2Zko00iu5i4SA=";
 
   types-aiobotocore-application-autoscaling =
-    buildTypesAiobotocorePackage "application-autoscaling" "2.23.2"
-      "sha256-BohE1I2Y8lqc6lSRYaDBVhSata1TUT9jXj+KfFBwt70=";
+    buildTypesAiobotocorePackage "application-autoscaling" "2.24.2"
+      "sha256-5N3c6jExJsLOlgBqhMKLROSyl6NUSCMyJPeFxZKUj9c=";
 
   types-aiobotocore-application-insights =
-    buildTypesAiobotocorePackage "application-insights" "2.23.2"
-      "sha256-iT9gABIcvfCudtFZAmsre0i+af1a/XbuSS+hN90mMvM=";
+    buildTypesAiobotocorePackage "application-insights" "2.24.2"
+      "sha256-bo5bRcu/NipY366EjhcRZS/9w4VBq5qA7GcduVtPugU=";
 
   types-aiobotocore-applicationcostprofiler =
-    buildTypesAiobotocorePackage "applicationcostprofiler" "2.23.2"
-      "sha256-FQ/AdX/BNcxvK3U/aWTGvcUKGS2b7OCfAVz+nnnUHXU=";
+    buildTypesAiobotocorePackage "applicationcostprofiler" "2.24.2"
+      "sha256-UQ+K2R3wHPKnr1h9X+7nse7+sVZCFRfiGd3PvF6AOQ0=";
 
   types-aiobotocore-appmesh =
-    buildTypesAiobotocorePackage "appmesh" "2.23.2"
-      "sha256-nbn7ReLpicq215qSnvCl4Ls7tRAGRTyQxUztzVgKH3s=";
+    buildTypesAiobotocorePackage "appmesh" "2.24.2"
+      "sha256-RD8BVHNfyVhKv2dsAI6KZT0BGVklMFTmapao9pwSiy4=";
 
   types-aiobotocore-apprunner =
-    buildTypesAiobotocorePackage "apprunner" "2.23.2"
-      "sha256-0IuFzWZbBCowCrl543mf05opd96OKMsAxChRqS2Dk5A=";
+    buildTypesAiobotocorePackage "apprunner" "2.24.2"
+      "sha256-UJjlQAhaNoy0SJ956XGV4PTOtNWqaxWfSJQQEqD8K6E=";
 
   types-aiobotocore-appstream =
-    buildTypesAiobotocorePackage "appstream" "2.23.2"
-      "sha256-PKv+1kd4gK8TDbi+fcFh9XlFtsUmA1MGShpbur4VNCE=";
+    buildTypesAiobotocorePackage "appstream" "2.24.2"
+      "sha256-JnCrfTFxA0JDAFbyLLPFLZSfWT1NWE/0/4AL7fetOLg=";
 
   types-aiobotocore-appsync =
-    buildTypesAiobotocorePackage "appsync" "2.23.2"
-      "sha256-pOC9LH6DSLbzCv4VDjcD56DP0m+VfCa6/ijEuYgCszQ=";
+    buildTypesAiobotocorePackage "appsync" "2.24.2"
+      "sha256-VKbvEPLabwcVbl/Ru0RdF63eHcDduaPyUIn79XXdKx0=";
 
   types-aiobotocore-arc-zonal-shift =
-    buildTypesAiobotocorePackage "arc-zonal-shift" "2.23.2"
-      "sha256-gnUBYq0R0Qgn3tnB0ifjUsVgD30LaIg1RbyiLKXGacg=";
+    buildTypesAiobotocorePackage "arc-zonal-shift" "2.24.2"
+      "sha256-auDK8kPp3+FmXcdfxYmF1Mj2RAUicTX3P4ycCv+EOFM=";
 
   types-aiobotocore-athena =
-    buildTypesAiobotocorePackage "athena" "2.23.2"
-      "sha256-eKLyLF++seWkmP/7J5nVXeUt2E7X3aUoYAq4FlbBUMc=";
+    buildTypesAiobotocorePackage "athena" "2.24.2"
+      "sha256-V237GwxnJP5NbrEhXYGUzCdAU0ACoQ7gQNmssjbW6Ac=";
 
   types-aiobotocore-auditmanager =
-    buildTypesAiobotocorePackage "auditmanager" "2.23.2"
-      "sha256-kxYExGYPSd/p9cJfgI/GRZw8x4QAcTBJI+N/BTezh1Y=";
+    buildTypesAiobotocorePackage "auditmanager" "2.24.2"
+      "sha256-UeCSg/FZGcG/Lz7LmjRcC26Q3KWyxp6uhQXbfp9HHJY=";
 
   types-aiobotocore-autoscaling =
-    buildTypesAiobotocorePackage "autoscaling" "2.23.2"
-      "sha256-hCtbxzZFGvKyTpO6aMl+u9OSfsvaGP3Il7UtC/voMWs=";
+    buildTypesAiobotocorePackage "autoscaling" "2.24.2"
+      "sha256-ttfpiNeEn7DSBT3YLtVyAzjesfjWuv9S8H6keIqqGs4=";
 
   types-aiobotocore-autoscaling-plans =
-    buildTypesAiobotocorePackage "autoscaling-plans" "2.23.2"
-      "sha256-ZPPqzA+ad5kX8RmuHgFSRu9CEexf7XNctP+W4RlYBLI=";
+    buildTypesAiobotocorePackage "autoscaling-plans" "2.24.2"
+      "sha256-rMmht7tguFEeNSkTIyR+JbPE/Qg7N70880qEJJXnmj4=";
 
   types-aiobotocore-backup =
-    buildTypesAiobotocorePackage "backup" "2.23.2"
-      "sha256-4jKj5Aab3i0j0JTn20pxy/E4SUFHIwh2vzEN6QEMMg8=";
+    buildTypesAiobotocorePackage "backup" "2.24.2"
+      "sha256-fmS4ea7J0Fp1xeSEvGU1Vm97ZtXeJImmkVQ7z1IPVy0=";
 
   types-aiobotocore-backup-gateway =
-    buildTypesAiobotocorePackage "backup-gateway" "2.23.2"
-      "sha256-4NImInnNG6lduC5jG38c73uB6Xmx5Nvv5LNFTTmVzH4=";
+    buildTypesAiobotocorePackage "backup-gateway" "2.24.2"
+      "sha256-SeJwCUDky9HahpM9k0w3LzbUCnL12oC8NIFUNnZtHe8=";
 
   types-aiobotocore-backupstorage =
     buildTypesAiobotocorePackage "backupstorage" "2.13.0"
       "sha256-YUKtBdBrdwL2yqDqOovvzDPbcv/sD8JLRnKz3Oh7iSU=";
 
   types-aiobotocore-batch =
-    buildTypesAiobotocorePackage "batch" "2.23.2"
-      "sha256-kf6dZjECxcde61Ps7vKmcBW8CIiWZSiIMo6pXQyIyus=";
+    buildTypesAiobotocorePackage "batch" "2.24.2"
+      "sha256-JfAVxXHodPJKVWffNXrUYuP1/q65ktbiXnJK4POC8YE=";
 
   types-aiobotocore-billingconductor =
-    buildTypesAiobotocorePackage "billingconductor" "2.23.2"
-      "sha256-0EEp3iOFjKFG51dbXzaGInqm4EncTqWLUl8yfIUSpgo=";
+    buildTypesAiobotocorePackage "billingconductor" "2.24.2"
+      "sha256-iUu//Y8FUcpkOy0e4JfzVRuM82AEX+b+BrPZRRVpLZw=";
 
   types-aiobotocore-braket =
-    buildTypesAiobotocorePackage "braket" "2.23.2"
-      "sha256-koF1ALOGevT+OfJauz2+hLVuWVGIdSfQ97Vxc8YdiNg=";
+    buildTypesAiobotocorePackage "braket" "2.24.2"
+      "sha256-QNIbpza8dtKXPZZeUDaDGWGflCWgUChQZsRIQaaMMoY=";
 
   types-aiobotocore-budgets =
-    buildTypesAiobotocorePackage "budgets" "2.23.2"
-      "sha256-/14rRleiCat5rG6J0vkvfjSIMaZHxd2R6LkXV8lb4nY=";
+    buildTypesAiobotocorePackage "budgets" "2.24.2"
+      "sha256-Ut2hPxaLIzAXmXjpKpWsxrrBFN3Z7wAix9mIrNwynYI=";
 
   types-aiobotocore-ce =
-    buildTypesAiobotocorePackage "ce" "2.23.2"
-      "sha256-1mppzt5UVvRKNhvIi/q2tvyJ5osAmaKyEEv0vQbNuVU=";
+    buildTypesAiobotocorePackage "ce" "2.24.2"
+      "sha256-Ly01UOnq2pbCpVyI2iWTkCrp0lTmFsLbOgGGWFnRJxY=";
 
   types-aiobotocore-chime =
-    buildTypesAiobotocorePackage "chime" "2.23.2"
-      "sha256-69K69vJ5xI7KOXg5KVWfLaL+PplzBnimjd+LbOjZFq0=";
+    buildTypesAiobotocorePackage "chime" "2.24.2"
+      "sha256-JWM4qd0Qw+BCi3eIcwO8IDmWoQnR1qAZcJMW+dG5uW0=";
 
   types-aiobotocore-chime-sdk-identity =
-    buildTypesAiobotocorePackage "chime-sdk-identity" "2.23.2"
-      "sha256-mOk0h08g3qqqnQbMQLeF8qWc85AZUl74Ow55rMEy8kc=";
+    buildTypesAiobotocorePackage "chime-sdk-identity" "2.24.2"
+      "sha256-UdOUp0jMf3l5CtEEsjuYEGYlnnA1qHw5nYj+yB3Djok=";
 
   types-aiobotocore-chime-sdk-media-pipelines =
-    buildTypesAiobotocorePackage "chime-sdk-media-pipelines" "2.23.2"
-      "sha256-TjxkeGWHWBBf0gvlBMqksdimkRsqGIt2T8Sie5UvIWI=";
+    buildTypesAiobotocorePackage "chime-sdk-media-pipelines" "2.24.2"
+      "sha256-Bn1jVhX4tvpb7lEuQsD3lT1SVcVUBpd41TZ0EzJFDqE=";
 
   types-aiobotocore-chime-sdk-meetings =
-    buildTypesAiobotocorePackage "chime-sdk-meetings" "2.23.2"
-      "sha256-mvGKopptLyXOsMeK1sBPJg7bXMwkTeWztKYDELpnjWs=";
+    buildTypesAiobotocorePackage "chime-sdk-meetings" "2.24.2"
+      "sha256-U1gGJB5reBwdh7+VNxfnSpcWPiVqR52RawLKG0vZ5LU=";
 
   types-aiobotocore-chime-sdk-messaging =
-    buildTypesAiobotocorePackage "chime-sdk-messaging" "2.23.2"
-      "sha256-oyKVa4IoVTOU3CzpbFNctwfswGsNmCgHPDuo4KQBjeY=";
+    buildTypesAiobotocorePackage "chime-sdk-messaging" "2.24.2"
+      "sha256-Gu6JRDjSLGcIRq+tgjTmQVlOx5TYMT4qU7qAwqM/UqQ=";
 
   types-aiobotocore-chime-sdk-voice =
-    buildTypesAiobotocorePackage "chime-sdk-voice" "2.23.2"
-      "sha256-qpXB8K/YgiGSF0erKot/IElM2+MsiWDEkAI+e3A+J2g=";
+    buildTypesAiobotocorePackage "chime-sdk-voice" "2.24.2"
+      "sha256-UBL6uIkuQG5c/6ok5lj/8aFEvopp1F73Q1PMkk3ZQP8=";
 
   types-aiobotocore-cleanrooms =
-    buildTypesAiobotocorePackage "cleanrooms" "2.23.2"
-      "sha256-brW5pdH+L7MThUjbyG0Qqbsoifd4FnYmyU7xdZiYMP4=";
+    buildTypesAiobotocorePackage "cleanrooms" "2.24.2"
+      "sha256-KyU4DQPDCgWyK8HlVp5Cwqvc+2NYIefz0RJcHlX9HP4=";
 
   types-aiobotocore-cloud9 =
-    buildTypesAiobotocorePackage "cloud9" "2.23.2"
-      "sha256-33DduyTThEWXQR5ho1GwzPcUH6bceRGmOw2pZIt7y7o=";
+    buildTypesAiobotocorePackage "cloud9" "2.24.2"
+      "sha256-nb7IXPGnweUKfA7Bs53VRKjqP1jPKRTALJT2bwx/R3U=";
 
   types-aiobotocore-cloudcontrol =
-    buildTypesAiobotocorePackage "cloudcontrol" "2.23.2"
-      "sha256-Cc/7gQ3xGsv95xZNkq+PpAB9iqsEGY+UbGZQuOCILGQ=";
+    buildTypesAiobotocorePackage "cloudcontrol" "2.24.2"
+      "sha256-O3jzUpR+2XGFB3ddVYvpUZoquc3h6uZ8JeKnPNt4kGY=";
 
   types-aiobotocore-clouddirectory =
-    buildTypesAiobotocorePackage "clouddirectory" "2.23.2"
-      "sha256-Q/b9E136onaZaKynohGHGeTuC+B1/53Dzz4wyiyni/c=";
+    buildTypesAiobotocorePackage "clouddirectory" "2.24.2"
+      "sha256-DoVQ0D97Ifi83NB47PQffvlq/m6Kw6Amx3Isz2qOmqc=";
 
   types-aiobotocore-cloudformation =
-    buildTypesAiobotocorePackage "cloudformation" "2.23.2"
-      "sha256-iIvIoKq4lzmMUFWpwomWRIQftMJ9jr/YExBupQNuLTg=";
+    buildTypesAiobotocorePackage "cloudformation" "2.24.2"
+      "sha256-T85g17JLCpOZ6E3xe0j0RQuQF6SKNjvthosakbGMK1E=";
 
   types-aiobotocore-cloudfront =
-    buildTypesAiobotocorePackage "cloudfront" "2.23.2"
-      "sha256-7JcjLO+VSEPzn2WalspvVAGIWZdH9MdMHSNovCQht40=";
+    buildTypesAiobotocorePackage "cloudfront" "2.24.2"
+      "sha256-u8Kt67d3g4bMiTYocgAayEbDhw312n7EGW5eBh/4KlE=";
 
   types-aiobotocore-cloudhsm =
-    buildTypesAiobotocorePackage "cloudhsm" "2.23.2"
-      "sha256-xJe6SMVNVN0Gf/ntOU6jWyS0hJU0NyZz76XHkKFNlcs=";
+    buildTypesAiobotocorePackage "cloudhsm" "2.24.2"
+      "sha256-3TO0pbMDVelh3t4lPQG6Alm2TFtRguYhkrCKjk+IHc4=";
 
   types-aiobotocore-cloudhsmv2 =
-    buildTypesAiobotocorePackage "cloudhsmv2" "2.23.2"
-      "sha256-FsCsd4J2+vRDR4d+R8wZ6XJvqLs3aE5bWCCUztvvmaM=";
+    buildTypesAiobotocorePackage "cloudhsmv2" "2.24.2"
+      "sha256-vyLIhLQCsvudKz8qW2Za1sGcLDOKC/i+bZafGdnsKdo=";
 
   types-aiobotocore-cloudsearch =
-    buildTypesAiobotocorePackage "cloudsearch" "2.23.2"
-      "sha256-hjDrMZLrxBPQB92VAQQhO16CcH19whNKDaDmAtVy7q8=";
+    buildTypesAiobotocorePackage "cloudsearch" "2.24.2"
+      "sha256-SbTlqvcmAdpq/JTNrpzHip5fV9evqQNUoXeCIYl45uY=";
 
   types-aiobotocore-cloudsearchdomain =
-    buildTypesAiobotocorePackage "cloudsearchdomain" "2.23.2"
-      "sha256-v42vIMJigatiYTVClLaPyvQvekxIyCFdMkyrGXQFbZY=";
+    buildTypesAiobotocorePackage "cloudsearchdomain" "2.24.2"
+      "sha256-O1603Tib62gwI2OjZKxG/oZRHY0OxyCi8vPKoOTYAlU=";
 
   types-aiobotocore-cloudtrail =
-    buildTypesAiobotocorePackage "cloudtrail" "2.23.2"
-      "sha256-RQgvqeSXrw16Zxf1UuOc7OUJBEcdqwTK0qRXaiXo9Do=";
+    buildTypesAiobotocorePackage "cloudtrail" "2.24.2"
+      "sha256-OnitXo0mwutxrRAE+v/8UbjUZBXrJ5lCjA7Q8Xeo2nE=";
 
   types-aiobotocore-cloudtrail-data =
-    buildTypesAiobotocorePackage "cloudtrail-data" "2.23.2"
-      "sha256-oa83uEuVUVtkC3wgCZbyUVfRzoUKDHcXn1TKLlvwSGM=";
+    buildTypesAiobotocorePackage "cloudtrail-data" "2.24.2"
+      "sha256-WLB46B4fOCKMoODjvEG5OBlLh/W4duiYDaOsD8vOvLc=";
 
   types-aiobotocore-cloudwatch =
-    buildTypesAiobotocorePackage "cloudwatch" "2.23.2"
-      "sha256-m1RDaV5UdprjSagMAWF+Sl0CWbgfkbdio9PGhZNDHwM=";
+    buildTypesAiobotocorePackage "cloudwatch" "2.24.2"
+      "sha256-t8V9nj24WlXDrK0042jnnO+s8JDRN6GXm/rU4D0XcTU=";
 
   types-aiobotocore-codeartifact =
-    buildTypesAiobotocorePackage "codeartifact" "2.23.2"
-      "sha256-dzV7QcGNfH6wbqeAht9dZcnws/TQpSBPxOUPiVsPxkw=";
+    buildTypesAiobotocorePackage "codeartifact" "2.24.2"
+      "sha256-pm26JANLcZD6FflTMUjOLJ16i7xNcSuyGbD3ST//jE8=";
 
   types-aiobotocore-codebuild =
-    buildTypesAiobotocorePackage "codebuild" "2.23.2"
-      "sha256-gA4NKHQ5sm6epHEGn6fjT1s9SeBmwY5QiRIjUY8gXLs=";
+    buildTypesAiobotocorePackage "codebuild" "2.24.2"
+      "sha256-nBZFMkjzwQ5qvJqot1lhAqdGiuNrLQ/iIdTn+YwOJ/Y=";
 
   types-aiobotocore-codecatalyst =
-    buildTypesAiobotocorePackage "codecatalyst" "2.23.2"
-      "sha256-KUvmATsHPeaSY2YKvBDcdShT9tv9QQb7qZwvtw2lZB8=";
+    buildTypesAiobotocorePackage "codecatalyst" "2.24.2"
+      "sha256-XTxYED8Bg+QkHEt6CrBP6A+meexwqtnvWW0wmebnOPY=";
 
   types-aiobotocore-codecommit =
-    buildTypesAiobotocorePackage "codecommit" "2.23.2"
-      "sha256-/6Y2qianxhFy7FRcNEoRwkjmVCtC50vlEQcEdj5nnpY=";
+    buildTypesAiobotocorePackage "codecommit" "2.24.2"
+      "sha256-+6RfUNRHISompRNTUIKQ/t5fe2U8QbWKkhkvWUq4D90=";
 
   types-aiobotocore-codedeploy =
-    buildTypesAiobotocorePackage "codedeploy" "2.23.2"
-      "sha256-k0udsa5yu1tH1KdfsC+S/lm+rBXxnbeH2NYoTqxqoOI=";
+    buildTypesAiobotocorePackage "codedeploy" "2.24.2"
+      "sha256-XAm+0b8CRqcqY7BSRPPAZW0il3JB+eOZgk5VLneB/nw=";
 
   types-aiobotocore-codeguru-reviewer =
-    buildTypesAiobotocorePackage "codeguru-reviewer" "2.23.2"
-      "sha256-DWWRZ2LeE7hA9R7zj52q4De6q5/DvG9f/w1C6HtEVvs=";
+    buildTypesAiobotocorePackage "codeguru-reviewer" "2.24.2"
+      "sha256-pWlMGu0f7Iq98LvS7PLvp3d5TkTODJ9y9Z8biOfS12o=";
 
   types-aiobotocore-codeguru-security =
-    buildTypesAiobotocorePackage "codeguru-security" "2.23.2"
-      "sha256-3b1XHUtEKi8Aqxw93kj5uboGvepzMUzf757OQTCJQW0=";
+    buildTypesAiobotocorePackage "codeguru-security" "2.24.2"
+      "sha256-iKe+nmmueHlpOM9eIZs/Rn9CM4ARm/8RVF3OyiAJ3Ks=";
 
   types-aiobotocore-codeguruprofiler =
-    buildTypesAiobotocorePackage "codeguruprofiler" "2.23.2"
-      "sha256-TqPmC6VN/Q0Uga5iWzvfRuWnyjgkKdhLzMqeb79CtGc=";
+    buildTypesAiobotocorePackage "codeguruprofiler" "2.24.2"
+      "sha256-eEvUrd4KWX3vwgRecmh/bje3Z1Cztc70BdxSIk37E58=";
 
   types-aiobotocore-codepipeline =
-    buildTypesAiobotocorePackage "codepipeline" "2.23.2"
-      "sha256-kCIiIFAQYZwKI7dIH7pGsvc5EI5xRupasSvockzB0OQ=";
+    buildTypesAiobotocorePackage "codepipeline" "2.24.2"
+      "sha256-s1y0FIoJ66aJqYUfBSIAs7n4gTr8jF1KxRnMZRpfXAE=";
 
   types-aiobotocore-codestar =
     buildTypesAiobotocorePackage "codestar" "2.13.3"
       "sha256-Z1ewx2RjmxbOQZ7wXaN54PVOuRs6LP3rMpsrVTacwjo=";
 
   types-aiobotocore-codestar-connections =
-    buildTypesAiobotocorePackage "codestar-connections" "2.23.2"
-      "sha256-5IpmJ9cLPZbI74u/pncFlFxKRRwexY3UyR2nmwwSHPI=";
+    buildTypesAiobotocorePackage "codestar-connections" "2.24.2"
+      "sha256-NmK/yfD4otBBRWVlsdiRKvjBazARib2Igw+/aCKOPPU=";
 
   types-aiobotocore-codestar-notifications =
-    buildTypesAiobotocorePackage "codestar-notifications" "2.23.2"
-      "sha256-wP327TnG74TA1zKRYXgIoNqCjL5CLzovounnIllEeCQ=";
+    buildTypesAiobotocorePackage "codestar-notifications" "2.24.2"
+      "sha256-ojgy93U6slWbbXBhZJm8jkFeAZVcpSS1ZCjR958gA94=";
 
   types-aiobotocore-cognito-identity =
-    buildTypesAiobotocorePackage "cognito-identity" "2.23.2"
-      "sha256-vsD8SfbcM/KHefMZLri6WLi2ay38XqjTZeigDVp7ThU=";
+    buildTypesAiobotocorePackage "cognito-identity" "2.24.2"
+      "sha256-EsCYEhGWO/Fv6/xw6oEYiF7membA9B+GRTlqSsd4wpk=";
 
   types-aiobotocore-cognito-idp =
-    buildTypesAiobotocorePackage "cognito-idp" "2.23.2"
-      "sha256-IE6hqrkyfetjf336F2ets50fj/xJwU/dRG9LnfdeoNU=";
+    buildTypesAiobotocorePackage "cognito-idp" "2.24.2"
+      "sha256-YzapP+glU+pEdvEpMuUl7KVQIr0Pcq2omi8pfOo4Bw8=";
 
   types-aiobotocore-cognito-sync =
-    buildTypesAiobotocorePackage "cognito-sync" "2.23.2"
-      "sha256-MgZrWQaQGfHSNsiVPKkbTmsEZc5OnLhBH7DTURF/Il4=";
+    buildTypesAiobotocorePackage "cognito-sync" "2.24.2"
+      "sha256-/K5802KQg8mxE49QopLEyv06kjRxOrxulYPJBqrk5LA=";
 
   types-aiobotocore-comprehend =
-    buildTypesAiobotocorePackage "comprehend" "2.23.2"
-      "sha256-NMhgEqy/ooPFu0o+6xXrV4JMwnojkjGU0hI78tsyS3U=";
+    buildTypesAiobotocorePackage "comprehend" "2.24.2"
+      "sha256-vgKn9OcPOWDPL8amA3djiLUNTXP0QDyq9d250lsGJ7c=";
 
   types-aiobotocore-comprehendmedical =
-    buildTypesAiobotocorePackage "comprehendmedical" "2.23.2"
-      "sha256-J/HR/gDb5cxuoln56EjjnzDf+7+H9dJgL/lGqWv3bkk=";
+    buildTypesAiobotocorePackage "comprehendmedical" "2.24.2"
+      "sha256-5dzg7xd2GRpxgbFE9o0ZDe8J46wm87Z6oFpVTvV4cnI=";
 
   types-aiobotocore-compute-optimizer =
-    buildTypesAiobotocorePackage "compute-optimizer" "2.23.2"
-      "sha256-q2kun8tyOa20gyds91T2zslj1/UF98+q2AmEPjokKaw=";
+    buildTypesAiobotocorePackage "compute-optimizer" "2.24.2"
+      "sha256-CoiHfA/P9x5s7ZG7UvQ/5cPz0JiKk6X5W9gWGOQujrA=";
 
   types-aiobotocore-config =
-    buildTypesAiobotocorePackage "config" "2.23.2"
-      "sha256-/JD+E7IWh79eChZstt9iw1OnMIP54mCwxKGCc/SlK3c=";
+    buildTypesAiobotocorePackage "config" "2.24.2"
+      "sha256-e7thylFVxio2iInrfN3skF5CXn9m0SCJtPNgyasPfB8=";
 
   types-aiobotocore-connect =
-    buildTypesAiobotocorePackage "connect" "2.23.2"
-      "sha256-FUP3QrecVm8gT7KC5ROXIzAuQK89llaG7PaBiOGm1FA=";
+    buildTypesAiobotocorePackage "connect" "2.24.2"
+      "sha256-wTD00XKdHNMPe67DbyKV3ZLfFcFmh+sgAUyt6+dVyhg=";
 
   types-aiobotocore-connect-contact-lens =
-    buildTypesAiobotocorePackage "connect-contact-lens" "2.23.2"
-      "sha256-vead9IBLIfcMl+2JJTg1GnFot16s9LnKaczteryKG2E=";
+    buildTypesAiobotocorePackage "connect-contact-lens" "2.24.2"
+      "sha256-idcEfm10xXLYVLBlyN8jyKCEpuwAvWUcO4P5UNqPjBo=";
 
   types-aiobotocore-connectcampaigns =
-    buildTypesAiobotocorePackage "connectcampaigns" "2.23.2"
-      "sha256-fhDaAsgZLWAOi7WxZdVXiaS1QgnhVoPE9wH3tHgFmOk=";
+    buildTypesAiobotocorePackage "connectcampaigns" "2.24.2"
+      "sha256-+ZA0Bgw9xmC63l8aA3JUR2Qc5GLfDAt4lhAtNOoFVag=";
 
   types-aiobotocore-connectcases =
-    buildTypesAiobotocorePackage "connectcases" "2.23.2"
-      "sha256-FHg6VLlONMr/RwnAzXo45nr4XSu1TkAwUhn2cd1SPPg=";
+    buildTypesAiobotocorePackage "connectcases" "2.24.2"
+      "sha256-yAMhG6AR8zcjjDpN5C/9Hjwfe/U2LEJiWPXaHN4bCdE=";
 
   types-aiobotocore-connectparticipant =
-    buildTypesAiobotocorePackage "connectparticipant" "2.23.2"
-      "sha256-YtKiKULuUK6KC6ZjQ4xmfpCOBquTi8r9ClsJ6S1spVM=";
+    buildTypesAiobotocorePackage "connectparticipant" "2.24.2"
+      "sha256-SLoqYt4koIIwgfR8A1C3yuf7F1sh04EPjGebUPZh32U=";
 
   types-aiobotocore-controltower =
-    buildTypesAiobotocorePackage "controltower" "2.23.2"
-      "sha256-altpqGxtN42mCqk4bEpO9Sm+9wCsMwBDKKAMGldOrvs=";
+    buildTypesAiobotocorePackage "controltower" "2.24.2"
+      "sha256-Sgq5NhzHdlgs2wAcJSfxI4KQcIuxoSGt3jnh2TmMMjM=";
 
   types-aiobotocore-cur =
-    buildTypesAiobotocorePackage "cur" "2.23.2"
-      "sha256-7HgObtMuk22/YyxFTjqQOtMNnM8Wb6wlS1MAt2CtXUQ=";
+    buildTypesAiobotocorePackage "cur" "2.24.2"
+      "sha256-zDcjGpwoCQOImGVXNfvg3MJAZj1xRMupXkFQieq8v60=";
 
   types-aiobotocore-customer-profiles =
-    buildTypesAiobotocorePackage "customer-profiles" "2.23.2"
-      "sha256-bFBAxhHoJ61VC0TX/XFyAA/gtKlRe50ljEPF4LhuMAA=";
+    buildTypesAiobotocorePackage "customer-profiles" "2.24.2"
+      "sha256-PWVet5tRs/ziWkAttexCQ8j9ET6vD71FFiWMRnTaYPc=";
 
   types-aiobotocore-databrew =
-    buildTypesAiobotocorePackage "databrew" "2.23.2"
-      "sha256-sdmd9zirohBCtz3BrpTt0ThcseFRVGgLkgq509gOxV4=";
+    buildTypesAiobotocorePackage "databrew" "2.24.2"
+      "sha256-661En00xwAZEDWuCG96Db+bMMxMrYFu1qAkRCmPD74o=";
 
   types-aiobotocore-dataexchange =
-    buildTypesAiobotocorePackage "dataexchange" "2.23.2"
-      "sha256-GFLKEb6yk8PL90WFhTICmKeGbjqf22F+19X5xQWUU8k=";
+    buildTypesAiobotocorePackage "dataexchange" "2.24.2"
+      "sha256-hOyR/Uv41F16Kb0P/RZ5TfLIyGsB9zxCp8PSeUYUdng=";
 
   types-aiobotocore-datapipeline =
-    buildTypesAiobotocorePackage "datapipeline" "2.23.2"
-      "sha256-njBIEQBs5cx9jDo6fZYKyBiyr/UL3puSkGd2fEDDdlE=";
+    buildTypesAiobotocorePackage "datapipeline" "2.24.2"
+      "sha256-k+N8cRLIGplcM7BrlWb2eS3R5bkZIP/yhkfXdSlteiA=";
 
   types-aiobotocore-datasync =
-    buildTypesAiobotocorePackage "datasync" "2.23.2"
-      "sha256-seNkGXJNpaxJGwLsYNsy879g8m5GVLUdYpILVgvHjJw=";
+    buildTypesAiobotocorePackage "datasync" "2.24.2"
+      "sha256-O06DEH9tzEoZYfbPyy3jesQ047otvSAumXg1jMLNvZc=";
 
   types-aiobotocore-dax =
-    buildTypesAiobotocorePackage "dax" "2.23.2"
-      "sha256-6COs0A3r66wtnVgYJRS5lihjLVR//6N8kOTzbCIEkFI=";
+    buildTypesAiobotocorePackage "dax" "2.24.2"
+      "sha256-vK1ify2vQqu8R3f9tabLwaeO+J4puPgINz2lfwm8jy4=";
 
   types-aiobotocore-detective =
-    buildTypesAiobotocorePackage "detective" "2.23.2"
-      "sha256-Fqnn/1jKVMPc14Hwy0cgoNcBh1AeXd5CbWXI7+rRuvk=";
+    buildTypesAiobotocorePackage "detective" "2.24.2"
+      "sha256-eqeOpGaF8dKnrQzHleDmpvKgT4z4Q7BxR934oc8xB3c=";
 
   types-aiobotocore-devicefarm =
-    buildTypesAiobotocorePackage "devicefarm" "2.23.2"
-      "sha256-INOhvvLfQRYesMcKByKpTQRLTskSEnjoG/DTbpv9Ba0=";
+    buildTypesAiobotocorePackage "devicefarm" "2.24.2"
+      "sha256-Vqb5/H7ONdzZh/GYe3FYe4Ow0wv0MVeQSjcV9GQjz8U=";
 
   types-aiobotocore-devops-guru =
-    buildTypesAiobotocorePackage "devops-guru" "2.23.2"
-      "sha256-XcMLmnSha4Y5Px9XFSEu3K+v0im6eTLdXwmCDjeqQYI=";
+    buildTypesAiobotocorePackage "devops-guru" "2.24.2"
+      "sha256-KY4nvDCewVI6/paaOCVBmwuH+YikpUU9wAd+e8p1f2I=";
 
   types-aiobotocore-directconnect =
-    buildTypesAiobotocorePackage "directconnect" "2.23.2"
-      "sha256-z7vr+UHi0ILfdfkncwoiJ4wsvGM4Z5SAEIoavj3trr0=";
+    buildTypesAiobotocorePackage "directconnect" "2.24.2"
+      "sha256-7VYCzVsdl8X2gBmlPUDyLCU7i02/k+/lfI4yTKqkUmw=";
 
   types-aiobotocore-discovery =
-    buildTypesAiobotocorePackage "discovery" "2.23.2"
-      "sha256-Yz5nbQQ6AQWrbPGN7u0mOwcx3U+nec/gL+2cygWBIh0=";
+    buildTypesAiobotocorePackage "discovery" "2.24.2"
+      "sha256-b8bYx/7hByPRudWpwfrFgq8YQSGoWoovVQYypS3X8C0=";
 
   types-aiobotocore-dlm =
-    buildTypesAiobotocorePackage "dlm" "2.23.2"
-      "sha256-Y/TmbgiaAIz36SJvPqtuB9nX7KRusO4eh2Zjtbdn7FE=";
+    buildTypesAiobotocorePackage "dlm" "2.24.2"
+      "sha256-5A0pI0eIv7zlldJrMonB5Dch2A1w0COROA4lb62t9rk=";
 
   types-aiobotocore-dms =
-    buildTypesAiobotocorePackage "dms" "2.23.2"
-      "sha256-dYQgNhsLp/8VJ5q1CiHawt4/xuQ7gwVC7OdIMnyME4A=";
+    buildTypesAiobotocorePackage "dms" "2.24.2"
+      "sha256-UH2xTTCuQOM0A2x8NxMhuS33GVs1w+PELijqnzw/vgY=";
 
   types-aiobotocore-docdb =
-    buildTypesAiobotocorePackage "docdb" "2.23.2"
-      "sha256-3zEsTqF3fsrM7mvV279JyPc5qVByf1LzIQGFYceerpQ=";
+    buildTypesAiobotocorePackage "docdb" "2.24.2"
+      "sha256-jFyO+3pZfN7Hty/wQzVzoY7dN4trO92rGz0gWrJ0mtQ=";
 
   types-aiobotocore-docdb-elastic =
-    buildTypesAiobotocorePackage "docdb-elastic" "2.23.2"
-      "sha256-+NbJROoovjnrsCaR3ggs70cbBJFJvdjKIDhzkMfKNIE=";
+    buildTypesAiobotocorePackage "docdb-elastic" "2.24.2"
+      "sha256-T+JXvvm764SrlDL+3p2yYy0V5dePBDEwQNLqDVUpyGg=";
 
   types-aiobotocore-drs =
-    buildTypesAiobotocorePackage "drs" "2.23.2"
-      "sha256-GOQu9WTLnES9etpXfUScjySKD4dSL9fLo3D0S7ExHHY=";
+    buildTypesAiobotocorePackage "drs" "2.24.2"
+      "sha256-ktu/hq4x/cj/JnW87IXqXJtF7l+R00BCkl68ClnLiOE=";
 
   types-aiobotocore-ds =
-    buildTypesAiobotocorePackage "ds" "2.23.2"
-      "sha256-FnkkKFzgQTdZwCIyWZm6taKErY9nWqctw5/rY+IZXes=";
+    buildTypesAiobotocorePackage "ds" "2.24.2"
+      "sha256-Pbm//dPtJXjcBqZU9zgLFl2CcCF+3lbvkuCo+fpRkUk=";
 
   types-aiobotocore-dynamodb =
-    buildTypesAiobotocorePackage "dynamodb" "2.23.2"
-      "sha256-2qxyD2S+UAR1Q3ZX0g6VqBFgqVXo/mPo5eFbNNc1G5A=";
+    buildTypesAiobotocorePackage "dynamodb" "2.24.2"
+      "sha256-gxhdXqwYDs4lJSok5Z59Oi8RM4HMTwwlcmIgBnSVN+o=";
 
   types-aiobotocore-dynamodbstreams =
-    buildTypesAiobotocorePackage "dynamodbstreams" "2.23.2"
-      "sha256-TTw51HbpRi5nVcAkHG9kPLBgW4u74IDa3HCYV0RX9ZM=";
+    buildTypesAiobotocorePackage "dynamodbstreams" "2.24.2"
+      "sha256-bGE3YYrndf33IgvV2Hme4W2FQymrETdU+iW7jVPwkjg=";
 
   types-aiobotocore-ebs =
-    buildTypesAiobotocorePackage "ebs" "2.23.2"
-      "sha256-OHJwBgblvdj3+lN7EfvczE+CT5eVfJNpPGJoPU5iddI=";
+    buildTypesAiobotocorePackage "ebs" "2.24.2"
+      "sha256-avCP4tEr2sF4oTXKEGyEg2USac+EVcPs6M0Md5+Zq6A=";
 
   types-aiobotocore-ec2 =
-    buildTypesAiobotocorePackage "ec2" "2.23.2"
-      "sha256-4pVG1Vmmp+lEEQGc9uNgR0ff4eKBP2Zrk+HkFpgFawA=";
+    buildTypesAiobotocorePackage "ec2" "2.24.2"
+      "sha256-agIFowMCcRcF8tKLksSjc0ZZ8mlSEbpODhRgjmihvn8=";
 
   types-aiobotocore-ec2-instance-connect =
-    buildTypesAiobotocorePackage "ec2-instance-connect" "2.23.2"
-      "sha256-8L3K/XwW3W4kbTt8niYtO4z8Ail66A4aDGN6yY/u8jI=";
+    buildTypesAiobotocorePackage "ec2-instance-connect" "2.24.2"
+      "sha256-nxujNa3pS1JnsbyiJt9g7m5u6x3dgt00rO/0ZJD4TN0=";
 
   types-aiobotocore-ecr =
-    buildTypesAiobotocorePackage "ecr" "2.23.2"
-      "sha256-r0i5wrvmcYgIxO1NrVAEQN14jNZUIaSfxANGOF0A8zQ=";
+    buildTypesAiobotocorePackage "ecr" "2.24.2"
+      "sha256-5pcrKVd67h4yoWmVqig6NfyaLqcT/LBObkCJhqiQVko=";
 
   types-aiobotocore-ecr-public =
-    buildTypesAiobotocorePackage "ecr-public" "2.23.2"
-      "sha256-xz6kOKIOFfieVC0e0DrKpSr2eGFl+f3UmI7wUZZKiLg=";
+    buildTypesAiobotocorePackage "ecr-public" "2.24.2"
+      "sha256-mcKkxYFsqOw7dZjEAMLB07TvNNbMETkcjtBcQbNfTbM=";
 
   types-aiobotocore-ecs =
-    buildTypesAiobotocorePackage "ecs" "2.23.2"
-      "sha256-RelW/a/LofzAbMgOdnYiv+DL7UEJJ/wgxfCMqasDdNU=";
+    buildTypesAiobotocorePackage "ecs" "2.24.2"
+      "sha256-MlNAp8YTK31j67YAGN2NjHFbE0Bl3Ayg5osrUykwn4I=";
 
   types-aiobotocore-efs =
-    buildTypesAiobotocorePackage "efs" "2.23.2"
-      "sha256-0CAilMg7Fgodmiy+szLH+pW613sh9JAtZIR8IbvIFuY=";
+    buildTypesAiobotocorePackage "efs" "2.24.2"
+      "sha256-Djn0qEIW8y+9OXE7CibMg9wHhaPPkc9bo1qrakz2QMI=";
 
   types-aiobotocore-eks =
-    buildTypesAiobotocorePackage "eks" "2.23.2"
-      "sha256-XlJykcAWkelakJH5wh+/fQRwce+ojXpbtRdf+qO2GZM=";
+    buildTypesAiobotocorePackage "eks" "2.24.2"
+      "sha256-xwYcNWhioWdRGMhlwSvCYXT4YDT4FJ1n/a6q7FxFWdc=";
 
   types-aiobotocore-elastic-inference =
     buildTypesAiobotocorePackage "elastic-inference" "2.20.0"
       "sha256-jFSY7JBVjDQi6dCqlX2LG7jxpSKfILv3XWbYidvtGos=";
 
   types-aiobotocore-elasticache =
-    buildTypesAiobotocorePackage "elasticache" "2.23.2"
-      "sha256-g+49mKJejMj4tpAvvhgG0PdAk4AfzkEZo1zsGr9JFno=";
+    buildTypesAiobotocorePackage "elasticache" "2.24.2"
+      "sha256-l08rv4WmHu6X3aX3SNoDDIES+IruhJz5DZivEBwFHxI=";
 
   types-aiobotocore-elasticbeanstalk =
-    buildTypesAiobotocorePackage "elasticbeanstalk" "2.23.2"
-      "sha256-6fCDofpsbgAqZFw28b9mz4fAsUX51+IAeuD3WO7LuO0=";
+    buildTypesAiobotocorePackage "elasticbeanstalk" "2.24.2"
+      "sha256-ImXUwxSTWbjY7PQZlv8IN2t5I5B/TgSNsYDQuPIPd+Q=";
 
   types-aiobotocore-elastictranscoder =
-    buildTypesAiobotocorePackage "elastictranscoder" "2.23.2"
-      "sha256-TBI0mFGKAnzbWjkrmLS6Wmk44P6VgnHCBKBEOsigkW8=";
+    buildTypesAiobotocorePackage "elastictranscoder" "2.24.2"
+      "sha256-4Yd9pzTHXnduEI+862BcdfDRvHyF+PZ73VdPiBRHEBc=";
 
   types-aiobotocore-elb =
-    buildTypesAiobotocorePackage "elb" "2.23.2"
-      "sha256-/2cRU2y7741hxzF1BtjmivBoxbJ42jktcbd5VSAf/a0=";
+    buildTypesAiobotocorePackage "elb" "2.24.2"
+      "sha256-edmrQ+xet9pKuJe6vp+lr8C/QCSMuzAytReTV0YYZNs=";
 
   types-aiobotocore-elbv2 =
-    buildTypesAiobotocorePackage "elbv2" "2.23.2"
-      "sha256-tZZla1J4nyyde0kVXoztUnFqINRJiB0EPehzabpmDHM=";
+    buildTypesAiobotocorePackage "elbv2" "2.24.2"
+      "sha256-1TkRw/jIXFZcVfMlFyZkV1FcJ7nTNUUI1cy+zWjor7U=";
 
   types-aiobotocore-emr =
-    buildTypesAiobotocorePackage "emr" "2.23.2"
-      "sha256-1PrCOWQ64PR9rloq/YvCkblKyg1CVnzHQmG49IG6Fp4=";
+    buildTypesAiobotocorePackage "emr" "2.24.2"
+      "sha256-xJJm3vczFrAMkBklsoZcsBSjUy/mDiI1ecPIATroBcw=";
 
   types-aiobotocore-emr-containers =
-    buildTypesAiobotocorePackage "emr-containers" "2.23.2"
-      "sha256-Vxzd0FsaWPtpVdH+WH+VwJjMvUDirrqHuGcIZ2ENRkU=";
+    buildTypesAiobotocorePackage "emr-containers" "2.24.2"
+      "sha256-Tth/Un0ByMSOSyK6TtXniuxj7N4QAVLQBQrxSYKxBrA=";
 
   types-aiobotocore-emr-serverless =
-    buildTypesAiobotocorePackage "emr-serverless" "2.23.2"
-      "sha256-vha16t+XLCpcICch9PCeRKkUMZW6bds9RSHGIMb9H2g=";
+    buildTypesAiobotocorePackage "emr-serverless" "2.24.2"
+      "sha256-+YoLuW9TZza/W+Nd0tKnMfNQ16duHel1eRUq6V6Q6N0=";
 
   types-aiobotocore-entityresolution =
-    buildTypesAiobotocorePackage "entityresolution" "2.23.2"
-      "sha256-w8kK9ZmeDVox+BsTkhbH7r2hHZJBXmORQI3tHdqs9JE=";
+    buildTypesAiobotocorePackage "entityresolution" "2.24.2"
+      "sha256-9dOhCYPmUAnz6WWm8oOEoyLWewD6OoE1iiEenkL1Txg=";
 
   types-aiobotocore-es =
-    buildTypesAiobotocorePackage "es" "2.23.2"
-      "sha256-5qKswPbIuItDROww4XBUq72G3zOdYEDUHd9Iw7qSb6g=";
+    buildTypesAiobotocorePackage "es" "2.24.2"
+      "sha256-73cxsND14OzTAH4NRxYJn/E6OYHG1hxZ8pQ7yOHq3is=";
 
   types-aiobotocore-events =
-    buildTypesAiobotocorePackage "events" "2.23.2"
-      "sha256-68Fd1Va78bd9KZQwwWs0Xj8Fq10Je71hKouuEtFRKwM=";
+    buildTypesAiobotocorePackage "events" "2.24.2"
+      "sha256-3obbkPfeB+RJeEbSiKRtMjhjX5to/u/EZ+10xTgdSQc=";
 
   types-aiobotocore-evidently =
-    buildTypesAiobotocorePackage "evidently" "2.23.2"
-      "sha256-2i9goFj1msqtZIo+Yem05Qt+mHN1o4puThgdlVpzyrI=";
+    buildTypesAiobotocorePackage "evidently" "2.24.2"
+      "sha256-5d7mng7noHGeBeGqHhZw0S1UNGytaaeu5qLskM02z4s=";
 
   types-aiobotocore-finspace =
-    buildTypesAiobotocorePackage "finspace" "2.23.2"
-      "sha256-Jfx+sO74F3GA+/gn+eIDD2HAFBmpCRurzFrzsPw3H0s=";
+    buildTypesAiobotocorePackage "finspace" "2.24.2"
+      "sha256-nDWns0hpcDksWs2Jh/JaZW8Xup1NVpRBNSCBCSN9/ng=";
 
   types-aiobotocore-finspace-data =
-    buildTypesAiobotocorePackage "finspace-data" "2.23.2"
-      "sha256-AjmJK7KuxZ1sHYCH4U2igkmqhAFNgsg6tfFESYDZtro=";
+    buildTypesAiobotocorePackage "finspace-data" "2.24.2"
+      "sha256-zcIvEakpSUnTRoJM7Gnkobe4nv9q5qrDDFmH1vsuuzM=";
 
   types-aiobotocore-firehose =
-    buildTypesAiobotocorePackage "firehose" "2.23.2"
-      "sha256-Ok+9I9SL77DxUondcB2ukg+qhMZPFRIS2hFm9OaA1mA=";
+    buildTypesAiobotocorePackage "firehose" "2.24.2"
+      "sha256-iLUEdqnpK4nNJdU86P4da7Xo1HyqOiI7AfHB4gK9/p0=";
 
   types-aiobotocore-fis =
-    buildTypesAiobotocorePackage "fis" "2.23.2"
-      "sha256-mKQG4aKb5xn+r3s6eJpBPX4fwWcetOaMrJPXq5wERdc=";
+    buildTypesAiobotocorePackage "fis" "2.24.2"
+      "sha256-D8H69rx99pYkldEM9Reipxx0alEJ1QBC3WsE4Zch6Gg=";
 
   types-aiobotocore-fms =
-    buildTypesAiobotocorePackage "fms" "2.23.2"
-      "sha256-vsrL3JygyO1jBCXjpGbQQqhXN+Bfq9OX0Nq5703XAjc=";
+    buildTypesAiobotocorePackage "fms" "2.24.2"
+      "sha256-/IkImf0n5IEuu+9z5ICg16B5FviFDLrwOhZhgz0RepU=";
 
   types-aiobotocore-forecast =
-    buildTypesAiobotocorePackage "forecast" "2.23.2"
-      "sha256-8/JC5cmWqpt3iiraS7AkDRuy6I3WbQvGpT5rBsuN/rM=";
+    buildTypesAiobotocorePackage "forecast" "2.24.2"
+      "sha256-RAfZiA4y5VIc3txN4ur/EiFyzK78R16fOXAg+oRXN+Y=";
 
   types-aiobotocore-forecastquery =
-    buildTypesAiobotocorePackage "forecastquery" "2.23.2"
-      "sha256-TqVmE7agH18iGJixn3vQ7XMQsO3ApG49kIwx+CkZO1E=";
+    buildTypesAiobotocorePackage "forecastquery" "2.24.2"
+      "sha256-va93iPKTRDtWrAD4ZOhlAPV62+VPwVZYIyTaXSi2R/s=";
 
   types-aiobotocore-frauddetector =
-    buildTypesAiobotocorePackage "frauddetector" "2.23.2"
-      "sha256-DDRFT+cUhgsw9t0Ch6nwkiV/cuK0Wn4LEuCQDe6WC2s=";
+    buildTypesAiobotocorePackage "frauddetector" "2.24.2"
+      "sha256-C1w31nv8uwvvm/6qy8tb1R7eUSm5/weTHHXj8bgwuI4=";
 
   types-aiobotocore-fsx =
-    buildTypesAiobotocorePackage "fsx" "2.23.2"
-      "sha256-XCTzrtmjqxS9WZBsoMcWFomdmsUqHoW7tACJ3Zy3vEg=";
+    buildTypesAiobotocorePackage "fsx" "2.24.2"
+      "sha256-yGC0u31EXD7gJPvrTD0qu1Ob026Jtn0Ks/W6n/8CNJ8=";
 
   types-aiobotocore-gamelift =
-    buildTypesAiobotocorePackage "gamelift" "2.23.2"
-      "sha256-n5ljDZ7yVn2pefKLXRFnU2+bc3bGSSOD1PAYXY8kwG0=";
+    buildTypesAiobotocorePackage "gamelift" "2.24.2"
+      "sha256-W9tNxnHy4PPnZaoU/TVyCkTAzMSlh+gKsVcROw6yW4s=";
 
   types-aiobotocore-gamesparks =
     buildTypesAiobotocorePackage "gamesparks" "2.7.0"
       "sha256-oVbKtuLMPpCQcZYx/cH1Dqjv/t6/uXsveflfFVqfN+8=";
 
   types-aiobotocore-glacier =
-    buildTypesAiobotocorePackage "glacier" "2.23.2"
-      "sha256-YPIO71oJXGqiGu3AvNq6+ilHUQPkDpRJZLr+8nj4ecQ=";
+    buildTypesAiobotocorePackage "glacier" "2.24.2"
+      "sha256-+YoHoQGFnCWwUcWgE1uUyC49t06+X1HqI+FkQW9erbo=";
 
   types-aiobotocore-globalaccelerator =
-    buildTypesAiobotocorePackage "globalaccelerator" "2.23.2"
-      "sha256-+OoOin6DK3wwK2QnSR+E0efARuNxRfQZ7KWY/8Sn3Eg=";
+    buildTypesAiobotocorePackage "globalaccelerator" "2.24.2"
+      "sha256-Q0ULIOYW2tnhgtAICH4/4ogGlUuSniZdTYc/4DqtN1M=";
 
   types-aiobotocore-glue =
-    buildTypesAiobotocorePackage "glue" "2.23.2"
-      "sha256-Hk1uistHevHtQR/BwT5jPNs66pYhYqeh0nVvOlorEb0=";
+    buildTypesAiobotocorePackage "glue" "2.24.2"
+      "sha256-hf//Zk4cfxkOiLNSF9KzekGgv8Kr7ZqfN5uoF+VHpEY=";
 
   types-aiobotocore-grafana =
-    buildTypesAiobotocorePackage "grafana" "2.23.2"
-      "sha256-t07+2j3G39YliL+wmach/UINxe0+di2MS2pHQDnMMRI=";
+    buildTypesAiobotocorePackage "grafana" "2.24.2"
+      "sha256-CkBkfW6RSDsFRuCm9M050toLyxwruPXwk6eOIuvNCqU=";
 
   types-aiobotocore-greengrass =
-    buildTypesAiobotocorePackage "greengrass" "2.23.2"
-      "sha256-9UT5gBtKSGSbYwwshQUvZpDGJCg4WwvO1qnDKBfciLw=";
+    buildTypesAiobotocorePackage "greengrass" "2.24.2"
+      "sha256-eamIn4c2WWG9b6IXdCCGs7YatwbFDPJ1z57M05odKIU=";
 
   types-aiobotocore-greengrassv2 =
-    buildTypesAiobotocorePackage "greengrassv2" "2.23.2"
-      "sha256-9tBAAec0Ht5gyCZczmotb3k4V0XHJkVIRXnemF9tbn0=";
+    buildTypesAiobotocorePackage "greengrassv2" "2.24.2"
+      "sha256-tZuWtDX2yM7K+W2N6AA52CLfCZ05cwBkWQt8SYh9BnA=";
 
   types-aiobotocore-groundstation =
-    buildTypesAiobotocorePackage "groundstation" "2.23.2"
-      "sha256-3T8Y2/z3bdlaFmIg8/WB3EcKUxu3ZYpJIMw3+k9bpQ4=";
+    buildTypesAiobotocorePackage "groundstation" "2.24.2"
+      "sha256-AcpT3lQLTiIZI/SDOQLT5mUjmX/kpB+SOMM1a//+Hi8=";
 
   types-aiobotocore-guardduty =
-    buildTypesAiobotocorePackage "guardduty" "2.23.2"
-      "sha256-jzIEVT/h8U+s14S757sFYjDjuUjk7SDsHKHu3ULHiLI=";
+    buildTypesAiobotocorePackage "guardduty" "2.24.2"
+      "sha256-IHs8mk1h6kPVGhqqj5Bj8d1lHutm3Ogz8mhzrfzCb7k=";
 
   types-aiobotocore-health =
-    buildTypesAiobotocorePackage "health" "2.23.2"
-      "sha256-VpnMibAW10aHtHnEHRQt/ZIGwXwzwfguZlVO69LSRok=";
+    buildTypesAiobotocorePackage "health" "2.24.2"
+      "sha256-Ffzy5Q30Vq4sIcE2uSm8496hYbO114qbL4adhxBMEHo=";
 
   types-aiobotocore-healthlake =
-    buildTypesAiobotocorePackage "healthlake" "2.23.2"
-      "sha256-8HcMNigQAGfKq2YTxnAVZm0Qsux5GfoC4igDfV2K84Y=";
+    buildTypesAiobotocorePackage "healthlake" "2.24.2"
+      "sha256-5/Xb95rUwgbDHCnkQR/lFLEu6tVvRDeS7aXXp2NvBeU=";
 
   types-aiobotocore-honeycode =
     buildTypesAiobotocorePackage "honeycode" "2.13.0"
       "sha256-DeeheoQeFEcDH21DSNs2kSR1rjnPLtTgz0yNCFnE+Io=";
 
   types-aiobotocore-iam =
-    buildTypesAiobotocorePackage "iam" "2.23.2"
-      "sha256-ijOqQJzQdTVNZhudaWQWhjv7PpLZO0jr9pmrtHxS1Ns=";
+    buildTypesAiobotocorePackage "iam" "2.24.2"
+      "sha256-cSWarlJrk/xF1sp9xL3OrVVTUdtr9Tvgf41O3yYZmt8=";
 
   types-aiobotocore-identitystore =
-    buildTypesAiobotocorePackage "identitystore" "2.23.2"
-      "sha256-vwi3s8fFxuMK7fSrWwQP772B/Y9cKJXLMiufCPEd9nM=";
+    buildTypesAiobotocorePackage "identitystore" "2.24.2"
+      "sha256-5RwWLygCiVry5UeEdg+lXf8n3sx0l7eDwylgUl+bG6k=";
 
   types-aiobotocore-imagebuilder =
-    buildTypesAiobotocorePackage "imagebuilder" "2.23.2"
-      "sha256-f+GEEmigWz4VS0XDhvrWHxWRHpnMG+uGcUnSBvznQuo=";
+    buildTypesAiobotocorePackage "imagebuilder" "2.24.2"
+      "sha256-lYw2xiEywKVXzFdAYFPqeL1AqwusrxBeZ/+g+7KzAOY=";
 
   types-aiobotocore-importexport =
-    buildTypesAiobotocorePackage "importexport" "2.23.2"
-      "sha256-/nMZ4zhYLfWo86I5NvoxEyHqxFpNISTnMqhBtDfv83g=";
+    buildTypesAiobotocorePackage "importexport" "2.24.2"
+      "sha256-97VtrmdxDCMQivIa1tTXfgfLupnsEpfA68SzlEqxaYs=";
 
   types-aiobotocore-inspector =
-    buildTypesAiobotocorePackage "inspector" "2.23.2"
-      "sha256-N2vVCGxSopkmbE5mAQRsYImncxIFimZXTCDGRfDzojI=";
+    buildTypesAiobotocorePackage "inspector" "2.24.2"
+      "sha256-UiTY/ubA3c9vrydX6BdMvvGlq0iZ0k0s89a/48FMUdg=";
 
   types-aiobotocore-inspector2 =
-    buildTypesAiobotocorePackage "inspector2" "2.23.2"
-      "sha256-s9c+lFJ8TPGhi2DWVJ7sQ2tPEuJ4ML1DtEhMxO3EMvs=";
+    buildTypesAiobotocorePackage "inspector2" "2.24.2"
+      "sha256-axNbJh4vc9M5OJj1/cwYouFE28IVMFG4juV/tixWtjI=";
 
   types-aiobotocore-internetmonitor =
-    buildTypesAiobotocorePackage "internetmonitor" "2.23.2"
-      "sha256-h6dTStOqtygfQZtZFLsxToBPyl7vmgeRDOgZeu5Tm7Y=";
+    buildTypesAiobotocorePackage "internetmonitor" "2.24.2"
+      "sha256-r4UmPV7v6n8NzZtYB7s4jcYvpP851M9vCZlHu8E5VcM=";
 
   types-aiobotocore-iot =
-    buildTypesAiobotocorePackage "iot" "2.23.2"
-      "sha256-7kOhvR27eH4sx8/bkS0Mj1d40rXFT13ZFD0lXwOo9jQ=";
+    buildTypesAiobotocorePackage "iot" "2.24.2"
+      "sha256-WJ6Nk5REaRgbqcPHmyHPEhRKkPvdzIGbp08zCa0eZ7o=";
 
   types-aiobotocore-iot-data =
-    buildTypesAiobotocorePackage "iot-data" "2.23.2"
-      "sha256-rEEQ9U354WxFAF8daukNRzSC/7GC1iCmEe+5MrhTUGM=";
+    buildTypesAiobotocorePackage "iot-data" "2.24.2"
+      "sha256-KM0c3gVKaT3ylKrGA9dn96OqPvebu65Gh/oBjFlM5tc=";
 
   types-aiobotocore-iot-jobs-data =
-    buildTypesAiobotocorePackage "iot-jobs-data" "2.23.2"
-      "sha256-kPG2ALQyKPOahQj6c90S04H8B+928WWS8X8wMtHOA7Q=";
+    buildTypesAiobotocorePackage "iot-jobs-data" "2.24.2"
+      "sha256-4IMLV0MhvBhaRCu4D4AzMccks/V17sfgM2KaCtRC1eg=";
 
   types-aiobotocore-iot-roborunner =
     buildTypesAiobotocorePackage "iot-roborunner" "2.12.2"
@@ -689,786 +689,786 @@ in
       "sha256-qK5dPunPAbC7xIramYINSda50Zum6yQ4n2BfuOgLC58=";
 
   types-aiobotocore-iotanalytics =
-    buildTypesAiobotocorePackage "iotanalytics" "2.23.2"
-      "sha256-9vr2itjH2kY0cwsF+EKCmXZLJ2e5CUy2PRSlwtFO5uA=";
+    buildTypesAiobotocorePackage "iotanalytics" "2.24.2"
+      "sha256-dHv1Cgq1kAQg+ILjhsgmAmflpHaqYq9M1RWCQB2ARSA=";
 
   types-aiobotocore-iotdeviceadvisor =
-    buildTypesAiobotocorePackage "iotdeviceadvisor" "2.23.2"
-      "sha256-tquJaEq0/YXZeQUyFpbYuKwfh6miEAR00S717KM6P20=";
+    buildTypesAiobotocorePackage "iotdeviceadvisor" "2.24.2"
+      "sha256-NpNVL021CLtbpolFFFbOL4hMAtC4owS4TkV1ULWQAwQ=";
 
   types-aiobotocore-iotevents =
-    buildTypesAiobotocorePackage "iotevents" "2.23.2"
-      "sha256-oggwzvFnBYSfFuwIB6uUeNOT52aXmMGZUWtcRJXfokk=";
+    buildTypesAiobotocorePackage "iotevents" "2.24.2"
+      "sha256-iYRdSZCrt/sKpgEuXSSd/d/CX8E0u8Hl0cczo/KhyoM=";
 
   types-aiobotocore-iotevents-data =
-    buildTypesAiobotocorePackage "iotevents-data" "2.23.2"
-      "sha256-TJfMUjbI1JnuW3mr/eVxLRxlvz44sbrECvXfv03E11k=";
+    buildTypesAiobotocorePackage "iotevents-data" "2.24.2"
+      "sha256-zsI/mOQXZWgb68kj+IWuaW06YwsCFmmsiDgJ2G9T0mk=";
 
   types-aiobotocore-iotfleethub =
-    buildTypesAiobotocorePackage "iotfleethub" "2.23.2"
-      "sha256-YrweZku7IAtXTl7NsFQE3beZ23/oOwxybxIaCAt0agk=";
+    buildTypesAiobotocorePackage "iotfleethub" "2.24.2"
+      "sha256-WzdCGMVRCl8x+UswlyApMYMYT3Rvtng0ID2YyV08NzA=";
 
   types-aiobotocore-iotfleetwise =
-    buildTypesAiobotocorePackage "iotfleetwise" "2.23.2"
-      "sha256-37Wg4t1NNOYdiPA/b1o5Ok73QfQjKR6mItl/8JZSrJk=";
+    buildTypesAiobotocorePackage "iotfleetwise" "2.24.2"
+      "sha256-V6HT6174p3JWZ/yqCLqL/MCBuL31+iKTxmzJRFT6q/8=";
 
   types-aiobotocore-iotsecuretunneling =
-    buildTypesAiobotocorePackage "iotsecuretunneling" "2.23.2"
-      "sha256-56MLx7Li/vrTHn4WJMo5Ooy725MlP8hDuIbP8nRHnLw=";
+    buildTypesAiobotocorePackage "iotsecuretunneling" "2.24.2"
+      "sha256-69Q9k4IyHC9hj9A7Dtc6aurPogyXcBTURfuF0e3eQUI=";
 
   types-aiobotocore-iotsitewise =
-    buildTypesAiobotocorePackage "iotsitewise" "2.23.2"
-      "sha256-BxUGTYq3yF4Sa3AMeqAS5HBuO8Q4PpX+GU5r3bS+1Xc=";
+    buildTypesAiobotocorePackage "iotsitewise" "2.24.2"
+      "sha256-+SkP8s7GUx0J055HdOp/Ea5qypUSsGXHJCrIyCvJfEw=";
 
   types-aiobotocore-iotthingsgraph =
-    buildTypesAiobotocorePackage "iotthingsgraph" "2.23.2"
-      "sha256-9RD4qhtp19MOROR3bUGNEELwrEPovErq5nZimT222wg=";
+    buildTypesAiobotocorePackage "iotthingsgraph" "2.24.2"
+      "sha256-4s4SdzaqSiWvRypHJc+2e0VbvxyKXjhQ7qEKAdh+nYE=";
 
   types-aiobotocore-iottwinmaker =
-    buildTypesAiobotocorePackage "iottwinmaker" "2.23.2"
-      "sha256-Kdmyx7vtE2BkzlCJ7TQ4y4bZPT1jJ1v02lrmZ9Bg06o=";
+    buildTypesAiobotocorePackage "iottwinmaker" "2.24.2"
+      "sha256-JUPQao6JLT4exkOvD/JN/XSj78HOUg06rGS1D7a/OGY=";
 
   types-aiobotocore-iotwireless =
-    buildTypesAiobotocorePackage "iotwireless" "2.23.2"
-      "sha256-Z6THQbu6vLJIRmt1LqTA870qGZSND8xK6eXzRPbz2io=";
+    buildTypesAiobotocorePackage "iotwireless" "2.24.2"
+      "sha256-0I3ZFI8/DesRVg9z7Y1AVqk6CDyLhint9CFOUA5Q45o=";
 
   types-aiobotocore-ivs =
-    buildTypesAiobotocorePackage "ivs" "2.23.2"
-      "sha256-vUEUMb4h9jrPkTJM0nMawVlpIcrcSzATRX7CcaJeexk=";
+    buildTypesAiobotocorePackage "ivs" "2.24.2"
+      "sha256-P4r7etZrrO0NJh0RC7LlJRLmQJCHXSrAczk6Li8xZuk=";
 
   types-aiobotocore-ivs-realtime =
-    buildTypesAiobotocorePackage "ivs-realtime" "2.23.2"
-      "sha256-axiEU0UAyNtxQVc1PJSPAKj/yesdMoPliTqTkf0u+u4=";
+    buildTypesAiobotocorePackage "ivs-realtime" "2.24.2"
+      "sha256-LZLjkRlHfsMD3X46ihM98ZnvGTUQkWK6L5+szgJiVU4=";
 
   types-aiobotocore-ivschat =
-    buildTypesAiobotocorePackage "ivschat" "2.23.2"
-      "sha256-8t1VBLeq7BSsXoRr0eAFnzk2ibJna+3p+Z6TpjjG70M=";
+    buildTypesAiobotocorePackage "ivschat" "2.24.2"
+      "sha256-+ObG3jUiJO5IVZ1QG50cgoU/EiPdZMtIG4qXhBmDdtE=";
 
   types-aiobotocore-kafka =
-    buildTypesAiobotocorePackage "kafka" "2.23.2"
-      "sha256-nz5QLZ8My3f/QzwtrUI5vl/T2HiQHbeVWu7mfa+6MxE=";
+    buildTypesAiobotocorePackage "kafka" "2.24.2"
+      "sha256-CkPGGzr/FRNgwSG2blLd6jPhNjKldS7h0aeJkVAUoyo=";
 
   types-aiobotocore-kafkaconnect =
-    buildTypesAiobotocorePackage "kafkaconnect" "2.23.2"
-      "sha256-mE0hxWyBRPpnDFPJaH2vtsrrrN6fQ2BkjB3xJbZoiNU=";
+    buildTypesAiobotocorePackage "kafkaconnect" "2.24.2"
+      "sha256-8LfqY0pCnyy9f79VoWYOMbdRvRNuwyhv4Msv2plL6zw=";
 
   types-aiobotocore-kendra =
-    buildTypesAiobotocorePackage "kendra" "2.23.2"
-      "sha256-qKsh3BV5Cf1k9f4D/69ZHlHoB8Ipf3fTfdyCAUN0M7g=";
+    buildTypesAiobotocorePackage "kendra" "2.24.2"
+      "sha256-EDxqABwkv4pV1fqv98QffGEZu+8rFFQ2tUM2M4k+wPk=";
 
   types-aiobotocore-kendra-ranking =
-    buildTypesAiobotocorePackage "kendra-ranking" "2.23.2"
-      "sha256-le19UtodR9jzTIbZXH/WbEZ9cXyKE/xpf5KdsN7Czho=";
+    buildTypesAiobotocorePackage "kendra-ranking" "2.24.2"
+      "sha256-lP+7IEFvncIKtk3md3fj40mV7K7Jf0+1PfJIN36FrsI=";
 
   types-aiobotocore-keyspaces =
-    buildTypesAiobotocorePackage "keyspaces" "2.23.2"
-      "sha256-tc6vIZ8TKvaBtEDQcmQNI+e4RLt/tm+P3s19Ax9GRL0=";
+    buildTypesAiobotocorePackage "keyspaces" "2.24.2"
+      "sha256-a7b2dGdBEOnhI9LwTuiaC4EwSgVgUNkWS2bdGK4JqTQ=";
 
   types-aiobotocore-kinesis =
-    buildTypesAiobotocorePackage "kinesis" "2.23.2"
-      "sha256-kl9Ka4q0o8LcS3+ln4Kq3iCpoIeBGroDL2WCq+0iQSs=";
+    buildTypesAiobotocorePackage "kinesis" "2.24.2"
+      "sha256-pX6wMBgj4CBWjXxCvLnqoe8TRe78YYrtXhwDnz+qxMA=";
 
   types-aiobotocore-kinesis-video-archived-media =
-    buildTypesAiobotocorePackage "kinesis-video-archived-media" "2.23.2"
-      "sha256-SlcYHrj/qNNLivkN71rvUL9Tt/MMorfxjz1ogLTA0Wk=";
+    buildTypesAiobotocorePackage "kinesis-video-archived-media" "2.24.2"
+      "sha256-5zNAuEcjhTKIMTkRJkwmI6Ysfe+Cc8+Ha0wxcF4At2Q=";
 
   types-aiobotocore-kinesis-video-media =
-    buildTypesAiobotocorePackage "kinesis-video-media" "2.23.2"
-      "sha256-DhpJhnF29VKrtj+hvVaG+/o1fZF3SAQ5+fdth2l3tzg=";
+    buildTypesAiobotocorePackage "kinesis-video-media" "2.24.2"
+      "sha256-Vkrp+UK8SVwQF9ElSH0v2qe0PGhzuiJ/NBVgCJnyZCs=";
 
   types-aiobotocore-kinesis-video-signaling =
-    buildTypesAiobotocorePackage "kinesis-video-signaling" "2.23.2"
-      "sha256-999zPvf6iGeQAvDS2rFHNW9p2bNLNqlVpEVIxwa+FjI=";
+    buildTypesAiobotocorePackage "kinesis-video-signaling" "2.24.2"
+      "sha256-PmPgTUqZ1bwo1wcQmg40AzX2wuCeq2Z1ZvAZJ15qBKk=";
 
   types-aiobotocore-kinesis-video-webrtc-storage =
-    buildTypesAiobotocorePackage "kinesis-video-webrtc-storage" "2.23.2"
-      "sha256-pS/NXBo3MPrQkJzIrbyJCe+7hQGTXwF724NV4JXZMN4=";
+    buildTypesAiobotocorePackage "kinesis-video-webrtc-storage" "2.24.2"
+      "sha256-yW4BIH6r2iQcRemT2WrDtrv2B9Vrwp/gY0AjXXYDI4c=";
 
   types-aiobotocore-kinesisanalytics =
-    buildTypesAiobotocorePackage "kinesisanalytics" "2.23.2"
-      "sha256-xMZFE/l4Bs8ekNY3qCoE5VmmGhV8MqY16lybHu2I7FY=";
+    buildTypesAiobotocorePackage "kinesisanalytics" "2.24.2"
+      "sha256-COAewa+KVHdGoNtG7IxFEEXzergkmVMoiyGCkyTG62k=";
 
   types-aiobotocore-kinesisanalyticsv2 =
-    buildTypesAiobotocorePackage "kinesisanalyticsv2" "2.23.2"
-      "sha256-BW5ES/6JvheA9qnsEcw1cw0z3xWFfuRzsS8QDBQ4+UQ=";
+    buildTypesAiobotocorePackage "kinesisanalyticsv2" "2.24.2"
+      "sha256-LuXtYPXx6HVhvq3aVLuhhy+zYL5ai1Pp3ii2/KacgAg=";
 
   types-aiobotocore-kinesisvideo =
-    buildTypesAiobotocorePackage "kinesisvideo" "2.23.2"
-      "sha256-nQcAUFZeybb34WbGJOLOpu5/VoEDPXYo0wMvpQgK+ho=";
+    buildTypesAiobotocorePackage "kinesisvideo" "2.24.2"
+      "sha256-LWnunA8RUkig+/X6l7GfArakS8aLP32dLBO661MfwXA=";
 
   types-aiobotocore-kms =
-    buildTypesAiobotocorePackage "kms" "2.23.2"
-      "sha256-1DryHMvJlL29ALd8Cbc8FXvx/+v+AzHk34sIpxZVmu8=";
+    buildTypesAiobotocorePackage "kms" "2.24.2"
+      "sha256-DE6G0mJ004rOpx5v5KwwGhnUKZZTnf52F1sMXI4DcXo=";
 
   types-aiobotocore-lakeformation =
-    buildTypesAiobotocorePackage "lakeformation" "2.23.2"
-      "sha256-U0PMF7Ym7Lht152Qj0uKr0Def94x+Z04riTL/DWj0ik=";
+    buildTypesAiobotocorePackage "lakeformation" "2.24.2"
+      "sha256-2layyc8x5/7wn3tV8vHfduJMygGIKt3vy5phomAVQAM=";
 
   types-aiobotocore-lambda =
-    buildTypesAiobotocorePackage "lambda" "2.23.2"
-      "sha256-18PyTV75muSvs4oYBfKsEaQSra8KGUX/5p/b3K/CW5s=";
+    buildTypesAiobotocorePackage "lambda" "2.24.2"
+      "sha256-Fdcuuf3rFmmb0+3MG5jYT4UPoLXgtcd3uZnMGCu0cKo=";
 
   types-aiobotocore-lex-models =
-    buildTypesAiobotocorePackage "lex-models" "2.23.2"
-      "sha256-9mxWTK9laXCmENe/B1WX1NliTMaCQydMgbjTvk4yOPY=";
+    buildTypesAiobotocorePackage "lex-models" "2.24.2"
+      "sha256-4TsRPgTxx1FlHSLffeYGOMeWKMCnpWHwHQiFYSfSxyE=";
 
   types-aiobotocore-lex-runtime =
-    buildTypesAiobotocorePackage "lex-runtime" "2.23.2"
-      "sha256-rTpdkh8y4W2M/NqbfFIvZQ+rf2gciZ+IvkVs60Qp/Io=";
+    buildTypesAiobotocorePackage "lex-runtime" "2.24.2"
+      "sha256-rs1oc1UdI8HJR/bhlkTq/PamtrSqTT6jpYRJiVynlPo=";
 
   types-aiobotocore-lexv2-models =
-    buildTypesAiobotocorePackage "lexv2-models" "2.23.2"
-      "sha256-3+EW03CRG9TWVOm8RafVtFEZhH+Tkr89xW5ahtljHns=";
+    buildTypesAiobotocorePackage "lexv2-models" "2.24.2"
+      "sha256-Fzr2KrlofnUu+8YgjVMvWZfbTC8LsgRLdzxls4//AHo=";
 
   types-aiobotocore-lexv2-runtime =
-    buildTypesAiobotocorePackage "lexv2-runtime" "2.23.2"
-      "sha256-OGjJcOwQ8eOvC7aKOCFixfzOnlGV4gEK67yhz3/8xss=";
+    buildTypesAiobotocorePackage "lexv2-runtime" "2.24.2"
+      "sha256-8QOhnsTOR7pIH/SyhylAN+JpkBEnATGdMlQppqUitz4=";
 
   types-aiobotocore-license-manager =
-    buildTypesAiobotocorePackage "license-manager" "2.23.2"
-      "sha256-rrAoivy/jBQJEeQUJZE8YOlNPvaEft+xph3II0XNt6M=";
+    buildTypesAiobotocorePackage "license-manager" "2.24.2"
+      "sha256-hPUWplaONyW4rqAULA9TVVIue1th0mxMUYvu/Fi874M=";
 
   types-aiobotocore-license-manager-linux-subscriptions =
-    buildTypesAiobotocorePackage "license-manager-linux-subscriptions" "2.23.2"
-      "sha256-xQwAiuZ3QoCE3bcDZN31fWSDZi/TdUzM2z5xCCsnbdA=";
+    buildTypesAiobotocorePackage "license-manager-linux-subscriptions" "2.24.2"
+      "sha256-K7s9qmCeqHbARY7hk1+Fhb+9bRzxNuQxRjQQntjaPUw=";
 
   types-aiobotocore-license-manager-user-subscriptions =
-    buildTypesAiobotocorePackage "license-manager-user-subscriptions" "2.23.2"
-      "sha256-F60gr5vecjLvCHevXJO1aIH/c7S03forB5MrRBFniVA=";
+    buildTypesAiobotocorePackage "license-manager-user-subscriptions" "2.24.2"
+      "sha256-bcKcsCdnunnVfMZ2ECHOCg6AWkpkJdHoyvCYf7+Npr4=";
 
   types-aiobotocore-lightsail =
-    buildTypesAiobotocorePackage "lightsail" "2.23.2"
-      "sha256-28+DecEGbDMwX/Mdmo3nIVVIh/q5ycj12CwuMm841FQ=";
+    buildTypesAiobotocorePackage "lightsail" "2.24.2"
+      "sha256-ey9nCJt/pAJnLfJsPl2IO9gsPJwLKLAPpHsuClA+Zac=";
 
   types-aiobotocore-location =
-    buildTypesAiobotocorePackage "location" "2.23.2"
-      "sha256-1ibAW8jrYtSDmfZkW5kmp7t46C+PqLGSdz9x2VGHWq4=";
+    buildTypesAiobotocorePackage "location" "2.24.2"
+      "sha256-s8RMtyfoPy1cqqaW02JIwo2T/5RD4N0slFpdU1hxXqU=";
 
   types-aiobotocore-logs =
-    buildTypesAiobotocorePackage "logs" "2.23.2"
-      "sha256-9MBRw/JahwyVzPDg02YFsIUYaRQ0CCRWP4KfJFit5wE=";
+    buildTypesAiobotocorePackage "logs" "2.24.2"
+      "sha256-T8MG2FMRZ08rAkRysgY+f+JzS7/2pgpJA0H31iDRkjI=";
 
   types-aiobotocore-lookoutequipment =
-    buildTypesAiobotocorePackage "lookoutequipment" "2.23.2"
-      "sha256-Sj4gvNn9ZkIrPlJaBwCL6qnYhVSy9EhoLhf90SYCm2c=";
+    buildTypesAiobotocorePackage "lookoutequipment" "2.24.2"
+      "sha256-UbD66HiEabAqzElfWX9gkZqLlxdUQ0ah0Cvf6rqVPFg=";
 
   types-aiobotocore-lookoutmetrics =
-    buildTypesAiobotocorePackage "lookoutmetrics" "2.23.2"
-      "sha256-n0rAIITRe+YUja7QOLr0b4+M7nGDJn8F2CaEPTsaIC4=";
+    buildTypesAiobotocorePackage "lookoutmetrics" "2.24.2"
+      "sha256-u84KeWwmp42KajZ3HnztG1106RN4dGh3jcMfSkJYXNY=";
 
   types-aiobotocore-lookoutvision =
-    buildTypesAiobotocorePackage "lookoutvision" "2.23.2"
-      "sha256-cIX0lvrmf/p/CvDvNeoUXe8Xs/ZIsncGIi/P37/QIcc=";
+    buildTypesAiobotocorePackage "lookoutvision" "2.24.2"
+      "sha256-HvNqynXLpYFJceCmrlncodqWuoczilMB8QtbCS5pcDM=";
 
   types-aiobotocore-m2 =
-    buildTypesAiobotocorePackage "m2" "2.23.2"
-      "sha256-cYFXKLaYPaPzy+n/bpwaRgvo0N5xuB4cKGZnIqwSz8s=";
+    buildTypesAiobotocorePackage "m2" "2.24.2"
+      "sha256-MzXOrYFqYZ2CHrgmrrSnfC4UxlqFVvJ7z4c4J1pYmNA=";
 
   types-aiobotocore-machinelearning =
-    buildTypesAiobotocorePackage "machinelearning" "2.23.2"
-      "sha256-PZl/FzjoRNiFDU4+TjBwKEK1gBBwEgbNgLcWH1Dn4Pw=";
+    buildTypesAiobotocorePackage "machinelearning" "2.24.2"
+      "sha256-QXxV5SrXJrYaaT+1XBJwL+QY5r7nB5+ASJII/jz1AQk=";
 
   types-aiobotocore-macie =
     buildTypesAiobotocorePackage "macie" "2.7.0"
       "sha256-hJJtGsK2b56nKX1ZhiarC+ffyjHYWRiC8II4oyDZWWw=";
 
   types-aiobotocore-macie2 =
-    buildTypesAiobotocorePackage "macie2" "2.23.2"
-      "sha256-BMMku2V/qPub4qLr3ldZrACCyAACOXKq0aCquI8bLvI=";
+    buildTypesAiobotocorePackage "macie2" "2.24.2"
+      "sha256-ZITR3jLAxcnarqOyTw2qNmcB5/n+/2mFQFSYRfdor0Y=";
 
   types-aiobotocore-managedblockchain =
-    buildTypesAiobotocorePackage "managedblockchain" "2.23.2"
-      "sha256-sBmNx7Pqi8+0rBBUNwxub7lhgE97MvSpzx4FY+ILsm0=";
+    buildTypesAiobotocorePackage "managedblockchain" "2.24.2"
+      "sha256-6+0VrYkzmtYrT06Pk5V7JigppeOf+PMG70zFaFaEVT8=";
 
   types-aiobotocore-managedblockchain-query =
-    buildTypesAiobotocorePackage "managedblockchain-query" "2.23.2"
-      "sha256-itFFjnDvYkbbf8A+lW4oxa6TZKGioe46pT9vb6BZ/EY=";
+    buildTypesAiobotocorePackage "managedblockchain-query" "2.24.2"
+      "sha256-5QutHPKR0kxqNulDPdbrf31S/dnRsu5C0rSBg3NHDG8=";
 
   types-aiobotocore-marketplace-catalog =
-    buildTypesAiobotocorePackage "marketplace-catalog" "2.23.2"
-      "sha256-IYCr3ZoV9eibijHWX0vl1YKy4XMzS8RcxvsaBPoxU5Q=";
+    buildTypesAiobotocorePackage "marketplace-catalog" "2.24.2"
+      "sha256-43jliVfhzoQmCF9eTWImal5Z9cSUspRx22npcxOsG2U=";
 
   types-aiobotocore-marketplace-entitlement =
-    buildTypesAiobotocorePackage "marketplace-entitlement" "2.23.2"
-      "sha256-ysySxME6brUqTS4wLkURvjdcofZQCe3V+huXTWgvEMA=";
+    buildTypesAiobotocorePackage "marketplace-entitlement" "2.24.2"
+      "sha256-AaHVWDpJ6IefcD0GaozfcZhoqkq2T4EZG6HyKca8dg0=";
 
   types-aiobotocore-marketplacecommerceanalytics =
-    buildTypesAiobotocorePackage "marketplacecommerceanalytics" "2.23.2"
-      "sha256-CVFRj0wNwT5WK/OURgDWuJruqqQcMTaaG6GHoVsEWBA=";
+    buildTypesAiobotocorePackage "marketplacecommerceanalytics" "2.24.2"
+      "sha256-I1rmfaDPsGhij4agxvg+p/bhTDYwdcjwL6sTWcN/hYA=";
 
   types-aiobotocore-mediaconnect =
-    buildTypesAiobotocorePackage "mediaconnect" "2.23.2"
-      "sha256-fjEkRaAqhN6AfjjuVbcAL0OjqeCoq9NvbnHlB6f25/A=";
+    buildTypesAiobotocorePackage "mediaconnect" "2.24.2"
+      "sha256-cK5bnzjeOOgzj1efTOHWITFHxSpUg3oHK/3SmVWlXqk=";
 
   types-aiobotocore-mediaconvert =
-    buildTypesAiobotocorePackage "mediaconvert" "2.23.2"
-      "sha256-CRle4rDOnM5TkzFL9AVTbtERPl+URsWXLgr9lQBu6Ec=";
+    buildTypesAiobotocorePackage "mediaconvert" "2.24.2"
+      "sha256-sVa5E4bM9534hB5RQs7HZPUm5czfEt9hfa9+9xof4RQ=";
 
   types-aiobotocore-medialive =
-    buildTypesAiobotocorePackage "medialive" "2.23.2"
-      "sha256-utkvcVYn7aj+wxSHlMg0rn28PYnixQc4Is7+KSAmmi8=";
+    buildTypesAiobotocorePackage "medialive" "2.24.2"
+      "sha256-SuJZWqjuVQc6FF774h5PVHxwP/sLDuLXCtIrFgsZhjY=";
 
   types-aiobotocore-mediapackage =
-    buildTypesAiobotocorePackage "mediapackage" "2.23.2"
-      "sha256-kuH+ofTE3mwRyZCbRvo/e2wvI0inDL+o3CZfKfXsRkM=";
+    buildTypesAiobotocorePackage "mediapackage" "2.24.2"
+      "sha256-H0MPnB5iuodeUbvd11/QZ7k+iYc37m+xQD4Jalk2o7g=";
 
   types-aiobotocore-mediapackage-vod =
-    buildTypesAiobotocorePackage "mediapackage-vod" "2.23.2"
-      "sha256-RQ4kOxg/PHq7wPxz9S1FVSxlWRfOxNFKORfVfzCtM3A=";
+    buildTypesAiobotocorePackage "mediapackage-vod" "2.24.2"
+      "sha256-hk5aCtWQY32vrTPbEeiI0ur8FJOf4sbyGQ3RbGwvHmI=";
 
   types-aiobotocore-mediapackagev2 =
-    buildTypesAiobotocorePackage "mediapackagev2" "2.23.2"
-      "sha256-I7neo0bWojDAsz0zBwIvfJVIRzfRiuRB0uiJBYj4TTQ=";
+    buildTypesAiobotocorePackage "mediapackagev2" "2.24.2"
+      "sha256-kMk1O0riu7xSARJXN9o7xdbcqtjdevunuZ7YOnxhslU=";
 
   types-aiobotocore-mediastore =
-    buildTypesAiobotocorePackage "mediastore" "2.23.2"
-      "sha256-EQgtCLfs6AjuloMvhkLlxJclgOx+CBfVB2FZBOtizFc=";
+    buildTypesAiobotocorePackage "mediastore" "2.24.2"
+      "sha256-2xu7ikEIxcj0/DGaGOaOsi0qHM4FdS04jx3f3mUiAIs=";
 
   types-aiobotocore-mediastore-data =
-    buildTypesAiobotocorePackage "mediastore-data" "2.23.2"
-      "sha256-v620OATZVx7y0ZkCY/XvtMo6jBaOf7rByEIRr3T30c4=";
+    buildTypesAiobotocorePackage "mediastore-data" "2.24.2"
+      "sha256-X9S0tX0YouD1FfoAZyPBMxz06M7WjXizwKQSR3U5woI=";
 
   types-aiobotocore-mediatailor =
-    buildTypesAiobotocorePackage "mediatailor" "2.23.2"
-      "sha256-RNqXcEGGJsuO4jNl9zDDkB3GqAVrWsmnwgwBTuQutKY=";
+    buildTypesAiobotocorePackage "mediatailor" "2.24.2"
+      "sha256-oY7F0Dx8cUgp+SIXc+GrI158APjF2thtBURqxL9Dyxg=";
 
   types-aiobotocore-medical-imaging =
-    buildTypesAiobotocorePackage "medical-imaging" "2.23.2"
-      "sha256-85eAmVjVV27EItse5Mmnik2E0V8mVN8mgS42xLpdLz4=";
+    buildTypesAiobotocorePackage "medical-imaging" "2.24.2"
+      "sha256-Ez8R6CM88liCtQcDOqIfl4Jon8Tt7yeiWTZVjNgtDXU=";
 
   types-aiobotocore-memorydb =
-    buildTypesAiobotocorePackage "memorydb" "2.23.2"
-      "sha256-6lmVpW09jQqKdyTx9xavuRsEJSbWOmQ3hHltNk8eZ+A=";
+    buildTypesAiobotocorePackage "memorydb" "2.24.2"
+      "sha256-r0AE2YTCF4yTVIxwUIWeWEHjnbbeVzkWW5ja5680RTk=";
 
   types-aiobotocore-meteringmarketplace =
-    buildTypesAiobotocorePackage "meteringmarketplace" "2.23.2"
-      "sha256-FY1XyeqBhWWr/aBGvzM8tgnhl0tPcjGze1AGrIEZso4=";
+    buildTypesAiobotocorePackage "meteringmarketplace" "2.24.2"
+      "sha256-HuSeuOA4xb6HWUVUzEmzulAyjRhAkFf/1QGpo1DkYmY=";
 
   types-aiobotocore-mgh =
-    buildTypesAiobotocorePackage "mgh" "2.23.2"
-      "sha256-fj3+loK/Xe4w/IrLeaP3nSYKlovjgiMoVUOlSNVP3hE=";
+    buildTypesAiobotocorePackage "mgh" "2.24.2"
+      "sha256-gn9V+XbxwW4wE8xVsSxNiTtN27lGa1e2JFdT9IMQGA0=";
 
   types-aiobotocore-mgn =
-    buildTypesAiobotocorePackage "mgn" "2.23.2"
-      "sha256-Dv9yQ/85FVrH4vDR2V4u6nWRJVm0VdfUEoePbQc/ljA=";
+    buildTypesAiobotocorePackage "mgn" "2.24.2"
+      "sha256-CgsKRXCW7HQI1Ntw7OD3qvoOw1HMVPhpgxRqDOJ6R/0=";
 
   types-aiobotocore-migration-hub-refactor-spaces =
-    buildTypesAiobotocorePackage "migration-hub-refactor-spaces" "2.23.2"
-      "sha256-gGq6ebu6FbAlmEaYeEV2oQ4kkzxSs8aAEbuOgM6pBK4=";
+    buildTypesAiobotocorePackage "migration-hub-refactor-spaces" "2.24.2"
+      "sha256-DI9F6W3P9HZHz9RZmJa8jNXZVlXQeidgwdgnrOf5Z0Y=";
 
   types-aiobotocore-migrationhub-config =
-    buildTypesAiobotocorePackage "migrationhub-config" "2.23.2"
-      "sha256-yqAQoFLYAkpDiAWPEi2xEglzeDM8jzNgIfPw3e3M8oo=";
+    buildTypesAiobotocorePackage "migrationhub-config" "2.24.2"
+      "sha256-O2eAq9Jzwf6THmNWU2tHjYLMv68+DmhPYG6IDI8XKFM=";
 
   types-aiobotocore-migrationhuborchestrator =
-    buildTypesAiobotocorePackage "migrationhuborchestrator" "2.23.2"
-      "sha256-gdXq+JyqKQfWN38NEE3sPRfYT68hpEt6VxTAHwTDWgQ=";
+    buildTypesAiobotocorePackage "migrationhuborchestrator" "2.24.2"
+      "sha256-46QQE/4LReVi9/ZpzdQvLoDdIG0og/d4Jx94d4aaiM0=";
 
   types-aiobotocore-migrationhubstrategy =
-    buildTypesAiobotocorePackage "migrationhubstrategy" "2.23.2"
-      "sha256-BErOEQwrtu+O1Su8kcUyRreHmo4xhbg1ropDl9DiYaw=";
+    buildTypesAiobotocorePackage "migrationhubstrategy" "2.24.2"
+      "sha256-DjfE9Z40ghxyfGuFLto6Ko2/4VBxrKxodvuUYQFh/Pk=";
 
   types-aiobotocore-mobile =
     buildTypesAiobotocorePackage "mobile" "2.13.2"
       "sha256-OxB91BCAmYnY72JBWZaBlEkpAxN2Q5aY4i1Pt3eD9hc=";
 
   types-aiobotocore-mq =
-    buildTypesAiobotocorePackage "mq" "2.23.2"
-      "sha256-sHNIS6MsZTJnmGU6xNd1Qu23leqLVQzZK0B2UqoN5vg=";
+    buildTypesAiobotocorePackage "mq" "2.24.2"
+      "sha256-StK4zD9PE2brgEKyWQhA37s5RMYRbMeaCwhuAt5i8fw=";
 
   types-aiobotocore-mturk =
-    buildTypesAiobotocorePackage "mturk" "2.23.2"
-      "sha256-tky9YLOOpw7qA65qlOumWyXYHfuqEIDlLfkODDVRlY8=";
+    buildTypesAiobotocorePackage "mturk" "2.24.2"
+      "sha256-WXe1ZkbaUqPEkcTm41upvks97LCKH39Gt7UpGDx2Yj8=";
 
   types-aiobotocore-mwaa =
-    buildTypesAiobotocorePackage "mwaa" "2.23.2"
-      "sha256-j2KmiJzSb7PzrjJlDDLAiTztj8DBR8yl7vtDSb2Gx/o=";
+    buildTypesAiobotocorePackage "mwaa" "2.24.2"
+      "sha256-AxPMwVTbJze/cP1wwUwBxNMLLtc2wN2D478doOi0j7c=";
 
   types-aiobotocore-neptune =
-    buildTypesAiobotocorePackage "neptune" "2.23.2"
-      "sha256-F20C5yf7s7b9UzFBQfL+wkKkD4w4iV+nfhTBOxxI2q8=";
+    buildTypesAiobotocorePackage "neptune" "2.24.2"
+      "sha256-hSernf72v8x1ofTPF/wz1jPVw49ON+19XoFlQvuhj44=";
 
   types-aiobotocore-network-firewall =
-    buildTypesAiobotocorePackage "network-firewall" "2.23.2"
-      "sha256-1ZowibYjjwPZxJ6tmxVvBFuuc7+A85hliWoZoXdqkDM=";
+    buildTypesAiobotocorePackage "network-firewall" "2.24.2"
+      "sha256-pL1hnB4TnbHlZJLrRj4wxEJyeuQcvNAWcwiCwLloegM=";
 
   types-aiobotocore-networkmanager =
-    buildTypesAiobotocorePackage "networkmanager" "2.23.2"
-      "sha256-2Mu2D6LUYNdhBAIv5VHtUeM24fc5MQpaR1cTBQZMXUQ=";
+    buildTypesAiobotocorePackage "networkmanager" "2.24.2"
+      "sha256-FZ2Q8hIgMNesma0dwGGYwWlDPtrcJztpLWN14sdqrV0=";
 
   types-aiobotocore-nimble =
     buildTypesAiobotocorePackage "nimble" "2.15.2"
       "sha256-PChX5Jbgr0d1YaTZU9AbX3cM7NrhkyunK6/X3l+I8Q0=";
 
   types-aiobotocore-oam =
-    buildTypesAiobotocorePackage "oam" "2.23.2"
-      "sha256-ZLzPyqdJNNKsHdVRzYpCsGjuKfOeR+ONRBheYr/pI+U=";
+    buildTypesAiobotocorePackage "oam" "2.24.2"
+      "sha256-rvvUi5TJvv+MIym1fmO+XEX96vOU6EkI4rs3+LpliKM=";
 
   types-aiobotocore-omics =
-    buildTypesAiobotocorePackage "omics" "2.23.2"
-      "sha256-vL7QbSKkP+f5g7xFlfpXF1J6toxLuL2YtiT9EDX+CqQ=";
+    buildTypesAiobotocorePackage "omics" "2.24.2"
+      "sha256-f6R2rq5wPw5CGFXPTSJbGh8AAQob+oSxTkcOAm8LBec=";
 
   types-aiobotocore-opensearch =
-    buildTypesAiobotocorePackage "opensearch" "2.23.2"
-      "sha256-MlrprOk7qJU9WPmwLP41NjWZqLS3sXIa8pGKaQF9+Yw=";
+    buildTypesAiobotocorePackage "opensearch" "2.24.2"
+      "sha256-aj9FN/fsteofcpswaTZFqT6RSUYtM7WxZBrv/ixFudw=";
 
   types-aiobotocore-opensearchserverless =
-    buildTypesAiobotocorePackage "opensearchserverless" "2.23.2"
-      "sha256-KvTpXJEuzUnR0Y2tgtaCpkLpvrqnVmbD3L3Ac1tB7uY=";
+    buildTypesAiobotocorePackage "opensearchserverless" "2.24.2"
+      "sha256-/OuhaaITiatFCIwOvXLHxtqQUwNpebk/3CIJbNiFJkU=";
 
   types-aiobotocore-opsworks =
-    buildTypesAiobotocorePackage "opsworks" "2.23.2"
-      "sha256-OFujKA1yPN9JWRKKBaTRqUZVWsShd2XhqWPBJ5fJE3c=";
+    buildTypesAiobotocorePackage "opsworks" "2.24.2"
+      "sha256-ScEMFhogJRX6ykymK3rqYniGVcyJEsECKvnnbT3xv1A=";
 
   types-aiobotocore-opsworkscm =
-    buildTypesAiobotocorePackage "opsworkscm" "2.23.2"
-      "sha256-Ez3TEIPIVOZ4Wyl9ygC5adwLA7c4Rqi1CV5XNEQLFpc=";
+    buildTypesAiobotocorePackage "opsworkscm" "2.24.2"
+      "sha256-i+qoE5XXWpZ7dQeDagkD2MhnBjwbKTJYyZxATDh8h9M=";
 
   types-aiobotocore-organizations =
-    buildTypesAiobotocorePackage "organizations" "2.23.2"
-      "sha256-hWHud/4bM+uyEc9a8xEfdjNCD9Qq89ESnl2fRwL7N70=";
+    buildTypesAiobotocorePackage "organizations" "2.24.2"
+      "sha256-6q9Fh8L1zjRM2z++CsowbIpmGBsuJBVE3QtW8xGcaIU=";
 
   types-aiobotocore-osis =
-    buildTypesAiobotocorePackage "osis" "2.23.2"
-      "sha256-pt3eeOB/ZdU/7XznzBNjbVHctgnR9eSaF8R4gmPv09o=";
+    buildTypesAiobotocorePackage "osis" "2.24.2"
+      "sha256-+xgI7bY/GpbLdeIGgD3SiwlhIFbRLTSw8Qq1HkjmkUM=";
 
   types-aiobotocore-outposts =
-    buildTypesAiobotocorePackage "outposts" "2.23.2"
-      "sha256-IIlmfn19zmloC8PSSwUgkBGsgoyHB96STr+Q17UeIfo=";
+    buildTypesAiobotocorePackage "outposts" "2.24.2"
+      "sha256-gw49Mv9vQa7vQxbvNpdfcG6d7rZpxpRrHjzOt/plDQk=";
 
   types-aiobotocore-panorama =
-    buildTypesAiobotocorePackage "panorama" "2.23.2"
-      "sha256-KHQh8mRolYDc8bHpojTc/zGLhDBXG6r5I44AkR3uuKQ=";
+    buildTypesAiobotocorePackage "panorama" "2.24.2"
+      "sha256-ZRvxSMAjs17e1zhtNe119O0Zwt/nkARcTZ99WZNuzro=";
 
   types-aiobotocore-payment-cryptography =
-    buildTypesAiobotocorePackage "payment-cryptography" "2.23.2"
-      "sha256-hC/qbhYJR2SVDBAbxcRGxmiTP4jJ9oxryJtZRlNZ7RQ=";
+    buildTypesAiobotocorePackage "payment-cryptography" "2.24.2"
+      "sha256-iyKwi8Kx2i06PHsyhX8RFNpoIc3dero9nlrp/e22nFY=";
 
   types-aiobotocore-payment-cryptography-data =
-    buildTypesAiobotocorePackage "payment-cryptography-data" "2.23.2"
-      "sha256-BoEGBAzC+HN0pf1IRC3kSdQcmHA04CFHj6bbYDGEiII=";
+    buildTypesAiobotocorePackage "payment-cryptography-data" "2.24.2"
+      "sha256-qtsMwaB8rJvv/JnCB9lJkCtH0Db9xsoklGq3qqDRFYk=";
 
   types-aiobotocore-personalize =
-    buildTypesAiobotocorePackage "personalize" "2.23.2"
-      "sha256-lw2XuCdj0EA5WV/xK4/KzugFcSXyN1bIJ6vdQZ+C5dw=";
+    buildTypesAiobotocorePackage "personalize" "2.24.2"
+      "sha256-ZeSWS+JLMwuLsb01C9nAlK309zpGI3/E5DuWBogdvIg=";
 
   types-aiobotocore-personalize-events =
-    buildTypesAiobotocorePackage "personalize-events" "2.23.2"
-      "sha256-9u6KBY2LNfnON+/J1IHoJS2VFPGfKYDPKalxnGa0jwc=";
+    buildTypesAiobotocorePackage "personalize-events" "2.24.2"
+      "sha256-nYycBLVHIXMItZXej0sgn2VE3PMkod8m2wNE1i5YDdE=";
 
   types-aiobotocore-personalize-runtime =
-    buildTypesAiobotocorePackage "personalize-runtime" "2.23.2"
-      "sha256-q4VsWLcmnlXsDRpSk82vmNUbB3rvaT1wWGtYHLqPQ/Q=";
+    buildTypesAiobotocorePackage "personalize-runtime" "2.24.2"
+      "sha256-CBLrj1rh4j4FfJ+E+8QZl6O+hvkhhcAV7Rf/ppNBKcg=";
 
   types-aiobotocore-pi =
-    buildTypesAiobotocorePackage "pi" "2.23.2"
-      "sha256-SnUtXL7NfNYFmV6JcSHhW6cQE8Es6iOMV5cg9P3NL6k=";
+    buildTypesAiobotocorePackage "pi" "2.24.2"
+      "sha256-/OQfwXyrx0Ko83v9BN6l8e87paLhSljqZvsR0yyW03Y=";
 
   types-aiobotocore-pinpoint =
-    buildTypesAiobotocorePackage "pinpoint" "2.23.2"
-      "sha256-Oqj9HqjR1rcPVK+9zzDVtarmpspzLfF2/MASaCY+APo=";
+    buildTypesAiobotocorePackage "pinpoint" "2.24.2"
+      "sha256-BdoiK86wxIeKCisj+8jK9eMIPGC75n3HVgaFNroEhbY=";
 
   types-aiobotocore-pinpoint-email =
-    buildTypesAiobotocorePackage "pinpoint-email" "2.23.2"
-      "sha256-k1ZsOYPmD3WT/qnPvT92AlyimQEN06aInS5TA83ZXn0=";
+    buildTypesAiobotocorePackage "pinpoint-email" "2.24.2"
+      "sha256-l4/h7OvhZHcFOggXM5nIYs/hw31cvJjnpHn8IFDHIj4=";
 
   types-aiobotocore-pinpoint-sms-voice =
-    buildTypesAiobotocorePackage "pinpoint-sms-voice" "2.23.2"
-      "sha256-QSZjHkrf2//XGcj1zEvQyjt33v3kK35kRYI/kRH8WTI=";
+    buildTypesAiobotocorePackage "pinpoint-sms-voice" "2.24.2"
+      "sha256-hUo2MBhY1lVJAYoGaAVSmMio4bmiFD1AV5tzjNLBlrg=";
 
   types-aiobotocore-pinpoint-sms-voice-v2 =
-    buildTypesAiobotocorePackage "pinpoint-sms-voice-v2" "2.23.2"
-      "sha256-ZA8MboUbZDiy8toQrZe0IIhgtV3OkYIHPjJxoTtpBCc=";
+    buildTypesAiobotocorePackage "pinpoint-sms-voice-v2" "2.24.2"
+      "sha256-ej/eZTLMz9GM3T4wPSMl89eKUW/HI5Q6+PXmWJB5YRM=";
 
   types-aiobotocore-pipes =
-    buildTypesAiobotocorePackage "pipes" "2.23.2"
-      "sha256-JQ7YmKZjYT8QhXQ71Aqcry1FwV3dagDjWcQyxcS01Z8=";
+    buildTypesAiobotocorePackage "pipes" "2.24.2"
+      "sha256-IoJl3XeqBHR+D2XeKd0MiRznkyNRRobW1KUTC+aTVxw=";
 
   types-aiobotocore-polly =
-    buildTypesAiobotocorePackage "polly" "2.23.2"
-      "sha256-DvmGM1PKfjgbnz5byq+YwXnG44Z/cVkIRWhGbbEVYJU=";
+    buildTypesAiobotocorePackage "polly" "2.24.2"
+      "sha256-k2qsn0gDe+tXNNttNy2gAWLWKD/gRSmdmYMB305K7ws=";
 
   types-aiobotocore-pricing =
-    buildTypesAiobotocorePackage "pricing" "2.23.2"
-      "sha256-VLkB7VAtuHn9gpMBfRiCXN3hW98A24mlPCtmsCfMwUY=";
+    buildTypesAiobotocorePackage "pricing" "2.24.2"
+      "sha256-U9nTKOtagDy7VsfUaBbDS779pTofn9d1Xrb2PuEzB8w=";
 
   types-aiobotocore-privatenetworks =
     buildTypesAiobotocorePackage "privatenetworks" "2.22.0"
       "sha256-yaYvgVKcr3l2eq0dMzmQEZHxgblTLlVF9cZRnObiB7M=";
 
   types-aiobotocore-proton =
-    buildTypesAiobotocorePackage "proton" "2.23.2"
-      "sha256-xXUdoSbbq1auaJyBq4Z147LcVW256M76/1LJz9sG/gk=";
+    buildTypesAiobotocorePackage "proton" "2.24.2"
+      "sha256-ihbt/y+HRwrQOGtbauQVZksLHNZ5IScFai8cgZyVIJs=";
 
   types-aiobotocore-qldb =
-    buildTypesAiobotocorePackage "qldb" "2.23.2"
-      "sha256-4Zbs1SynybFunfhQH+/kXcET4KbwBY8GUXuwZ0sL/WE=";
+    buildTypesAiobotocorePackage "qldb" "2.24.2"
+      "sha256-qrSbXgc4DBb2kNg0ydb1vT9EmRqQWNIfuNOVsK8BPY0=";
 
   types-aiobotocore-qldb-session =
-    buildTypesAiobotocorePackage "qldb-session" "2.23.2"
-      "sha256-C2t2633V0i1OfDL1GNPt5HMEoFuXMspT4SbYTP3sTKc=";
+    buildTypesAiobotocorePackage "qldb-session" "2.24.2"
+      "sha256-Lk9RLigcg4F/AsgKneBUoyPyeUh46ra+BLCw94b74eU=";
 
   types-aiobotocore-quicksight =
-    buildTypesAiobotocorePackage "quicksight" "2.23.2"
-      "sha256-LrnBajbP6B5trm0Ebd/Rlu4997tQ2V1qWTJ78FWD7tw=";
+    buildTypesAiobotocorePackage "quicksight" "2.24.2"
+      "sha256-FGqfkRrlRFjL7y8VbhQAWb4kfNuSfjuaSHOCuJ5hRNo=";
 
   types-aiobotocore-ram =
-    buildTypesAiobotocorePackage "ram" "2.23.2"
-      "sha256-cQ+xCOu2h+hCxH4SPX29wHEYZw/0zPZGdIWmEdbcYHo=";
+    buildTypesAiobotocorePackage "ram" "2.24.2"
+      "sha256-rOL3se5O69NMWmisPeQU9NpCvsEBIWJogdw4F5Cl1Cg=";
 
   types-aiobotocore-rbin =
-    buildTypesAiobotocorePackage "rbin" "2.23.2"
-      "sha256-34okwB5Kxu58go/go+ePfjYI9WB+Qr0vtS7IWzSrvnM=";
+    buildTypesAiobotocorePackage "rbin" "2.24.2"
+      "sha256-nz/wHHe0/bbflsn0gchrHhKXM72MEXiIc4Q+9BHOU9g=";
 
   types-aiobotocore-rds =
-    buildTypesAiobotocorePackage "rds" "2.23.2"
-      "sha256-bj8wy8iW4ae74GAmDjzFDM6XgSFn7HuudjduyMpqaPA=";
+    buildTypesAiobotocorePackage "rds" "2.24.2"
+      "sha256-VGfdqg/0n9zb1R1PHbYUwWaWuQ0o1sqtjbETk+bfczU=";
 
   types-aiobotocore-rds-data =
-    buildTypesAiobotocorePackage "rds-data" "2.23.2"
-      "sha256-LVmnPQBvTIy7WFDTMWKWMwuosIwAEnqePaklqRNHH18=";
+    buildTypesAiobotocorePackage "rds-data" "2.24.2"
+      "sha256-4zo3haKYjZd1adFJufIqAnLc3XfYSgx6ZG1ttiURoIw=";
 
   types-aiobotocore-redshift =
-    buildTypesAiobotocorePackage "redshift" "2.23.2"
-      "sha256-8uyGssIcvC2aEM/1osGd/QxT7Oq1Hv5b/odPpIXEynE=";
+    buildTypesAiobotocorePackage "redshift" "2.24.2"
+      "sha256-DAi2/p2NPo7naUqOczPBDUfS5cvcaTh2UgEdbt7xpjY=";
 
   types-aiobotocore-redshift-data =
-    buildTypesAiobotocorePackage "redshift-data" "2.23.2"
-      "sha256-tyNsHjd/jrALXasfhX8JNklJ63zNZ4OiO97AyyW/yl0=";
+    buildTypesAiobotocorePackage "redshift-data" "2.24.2"
+      "sha256-2wikSmqpfeusOoar9HG/7MCcSFfS7wSRVhsNS78X20M=";
 
   types-aiobotocore-redshift-serverless =
-    buildTypesAiobotocorePackage "redshift-serverless" "2.23.2"
-      "sha256-XWQPUghyV2npeQO09GvrLBU1+3+Z9W/RIwu0I7625MU=";
+    buildTypesAiobotocorePackage "redshift-serverless" "2.24.2"
+      "sha256-u6AZoFB6qmkf+Zkx6XFBlgr6dSKydMzs1QUAfpRJuS0=";
 
   types-aiobotocore-rekognition =
-    buildTypesAiobotocorePackage "rekognition" "2.23.2"
-      "sha256-l7GFbw2/x+Ob7ZAgKJ1eFCkLQLv1nMXC8A/uBamFpLM=";
+    buildTypesAiobotocorePackage "rekognition" "2.24.2"
+      "sha256-MuF3QbKzh3RAJqvAjaUYhLkh9bQKieJtClQpXhP6FQA=";
 
   types-aiobotocore-resiliencehub =
-    buildTypesAiobotocorePackage "resiliencehub" "2.23.2"
-      "sha256-Jl3KBs5n+Edk4/iY8Oq2KO7ocaoCqZE83L94Si8g+g8=";
+    buildTypesAiobotocorePackage "resiliencehub" "2.24.2"
+      "sha256-t1IGFU5fjFNLLgqNCB/ojf0rNifcbYb6ATvGoV4xdYE=";
 
   types-aiobotocore-resource-explorer-2 =
-    buildTypesAiobotocorePackage "resource-explorer-2" "2.23.2"
-      "sha256-ynDccEiN6+DPIcy+YgFTSb0crIMfCp1uLxBoevQacM8=";
+    buildTypesAiobotocorePackage "resource-explorer-2" "2.24.2"
+      "sha256-gNOZFlt+fXs2eOLrVjNq5pgsVVXAjGK+hKImnbVW6mE=";
 
   types-aiobotocore-resource-groups =
-    buildTypesAiobotocorePackage "resource-groups" "2.23.2"
-      "sha256-ybqLQWSddVa3WSaiuGQ1OQKG9VD71bvZ+fpcnAXczcg=";
+    buildTypesAiobotocorePackage "resource-groups" "2.24.2"
+      "sha256-2HPbyo6yNP/KUlON11d6kUxJGclGYiWBDztWc+dDIE4=";
 
   types-aiobotocore-resourcegroupstaggingapi =
-    buildTypesAiobotocorePackage "resourcegroupstaggingapi" "2.23.2"
-      "sha256-38Ok7Ugz1Y7xWoY1ffToO4TjX5Ai2qD4CGsyUG8ylto=";
+    buildTypesAiobotocorePackage "resourcegroupstaggingapi" "2.24.2"
+      "sha256-AeiIN0AZCxV/zA/OleBKaLs8skjP/FyHbiP5XwtQg88=";
 
   types-aiobotocore-robomaker =
-    buildTypesAiobotocorePackage "robomaker" "2.23.2"
-      "sha256-khpQA5VSeN09SH/0ycSoyRKuEWUbzevbhtSuuljvCeU=";
+    buildTypesAiobotocorePackage "robomaker" "2.24.2"
+      "sha256-EczunxMisSO9t2iYzXuzTeFiNalu2EyDRIOE7TW5fOg=";
 
   types-aiobotocore-rolesanywhere =
-    buildTypesAiobotocorePackage "rolesanywhere" "2.23.2"
-      "sha256-aAgG+we4gKYIvOiCQjE9IZAXPHOzLhZt7w9iAQc1vXY=";
+    buildTypesAiobotocorePackage "rolesanywhere" "2.24.2"
+      "sha256-MKkz1y+UH/2DqDlc7HFgGPsdTgsmh4CiHVgnQRmsOr4=";
 
   types-aiobotocore-route53 =
-    buildTypesAiobotocorePackage "route53" "2.23.2"
-      "sha256-qXNMbFyiKD6Ra46LBWebAzE/royjqrrgHJls2PSCs1M=";
+    buildTypesAiobotocorePackage "route53" "2.24.2"
+      "sha256-1ABS/Cd9dVBWUyxiyHC2n23a6oGfkTvmH0J8SHqp2LM=";
 
   types-aiobotocore-route53-recovery-cluster =
-    buildTypesAiobotocorePackage "route53-recovery-cluster" "2.23.2"
-      "sha256-ABfDIOgE/6af0L4tcV15VaOl/8zhfLy3rGQakF/Bd4o=";
+    buildTypesAiobotocorePackage "route53-recovery-cluster" "2.24.2"
+      "sha256-57I1uOrzTRroD7VG9lRNxl1FSWGahGqod4VSjTH10I8=";
 
   types-aiobotocore-route53-recovery-control-config =
-    buildTypesAiobotocorePackage "route53-recovery-control-config" "2.23.2"
-      "sha256-C9Pkxa9yLUqEuSaQAGaHCzOQeLQDKuGQD3fNFbWhQZE=";
+    buildTypesAiobotocorePackage "route53-recovery-control-config" "2.24.2"
+      "sha256-0yGK1VPpRWk5ulvTZse8AGcWuBeqwLFd82rcOJKN6kM=";
 
   types-aiobotocore-route53-recovery-readiness =
-    buildTypesAiobotocorePackage "route53-recovery-readiness" "2.23.2"
-      "sha256-W6BIeUuTi8QSbT4Ja9B0UBQ2YeC5YOAbjumrPBc3P7E=";
+    buildTypesAiobotocorePackage "route53-recovery-readiness" "2.24.2"
+      "sha256-n75Fw9K9a3d+SDvQrj0EFPK/8hPRvuWRb50oS5FPb4k=";
 
   types-aiobotocore-route53domains =
-    buildTypesAiobotocorePackage "route53domains" "2.23.2"
-      "sha256-fv8Pg1qhaigHqxyr9UimqwXuu3UeLxoFrzRnclT8nTc=";
+    buildTypesAiobotocorePackage "route53domains" "2.24.2"
+      "sha256-IQ4mkUHnDpn+OMBHm9a3SldrpgB2KbyfqD0KnoG88Qw=";
 
   types-aiobotocore-route53resolver =
-    buildTypesAiobotocorePackage "route53resolver" "2.23.2"
-      "sha256-Iw1xkRzfuBIeOP6bohWiKFeL/odd3yuQxIfGovV/+ks=";
+    buildTypesAiobotocorePackage "route53resolver" "2.24.2"
+      "sha256-5qefScEDO5g/zETcjCEjRc9Rx3KGptRyGrb/0V2zDGo=";
 
   types-aiobotocore-rum =
-    buildTypesAiobotocorePackage "rum" "2.23.2"
-      "sha256-e56DR0g48Vf5Iub8IFHOgCZA+W4ryZMnXeLZcm+Pk8U=";
+    buildTypesAiobotocorePackage "rum" "2.24.2"
+      "sha256-GC14nlxculn+aGXVvl3Gi9nQmNzBxp6IO9EoI2fCVMM=";
 
   types-aiobotocore-s3 =
-    buildTypesAiobotocorePackage "s3" "2.23.2"
-      "sha256-8BoIF42zH97jiQCWWkMHerWYtFybVI8/8VEtaspF44I=";
+    buildTypesAiobotocorePackage "s3" "2.24.2"
+      "sha256-cnS8ylWDhe9fmAN/VHT0WDZjY0FB1G2dl4q303ypYyQ=";
 
   types-aiobotocore-s3control =
-    buildTypesAiobotocorePackage "s3control" "2.23.2"
-      "sha256-tMpWWfGh39vE/q8dTekgS1DM/FCZ8EIV/QwMCSd8+CM=";
+    buildTypesAiobotocorePackage "s3control" "2.24.2"
+      "sha256-w7he88CqX24v+k22HpHAx1KCPjsDJrW5kO51VQ4DCDE=";
 
   types-aiobotocore-s3outposts =
-    buildTypesAiobotocorePackage "s3outposts" "2.23.2"
-      "sha256-7GY9uT4S4sJSoW44IDQCjHt7FZ3z3z5HjtklVP+tP0Q=";
+    buildTypesAiobotocorePackage "s3outposts" "2.24.2"
+      "sha256-4kgsEBJRe2usinaPm/j+nl688XtzsIW3mOcVjlvyPZk=";
 
   types-aiobotocore-sagemaker =
-    buildTypesAiobotocorePackage "sagemaker" "2.23.2"
-      "sha256-JitwKHs3dWtIEzPLs2E3K1ocjK+6V9ifYly4KHYKEeU=";
+    buildTypesAiobotocorePackage "sagemaker" "2.24.2"
+      "sha256-wU85s5DUzfZZj2Mm6K5qMuxXbzPFw0Ns/nrHUHx4Gh8=";
 
   types-aiobotocore-sagemaker-a2i-runtime =
-    buildTypesAiobotocorePackage "sagemaker-a2i-runtime" "2.23.2"
-      "sha256-rDLAQ0CmJFkovbX/aFuSvG2p43y5MWWxeZhjyRudjys=";
+    buildTypesAiobotocorePackage "sagemaker-a2i-runtime" "2.24.2"
+      "sha256-pMuZtpwP/B0XalmJhAZcMc/hd5UPT39X0tTSdnFh9dE=";
 
   types-aiobotocore-sagemaker-edge =
-    buildTypesAiobotocorePackage "sagemaker-edge" "2.23.2"
-      "sha256-6f+bHHgmCiFJtFDWpOHc48t3UdgVqOn0QgpZRBdGdMA=";
+    buildTypesAiobotocorePackage "sagemaker-edge" "2.24.2"
+      "sha256-8QxrxAGOZxrSgLaNOqYpB1UfpEaPrQ9V+jBhEvOvHDc=";
 
   types-aiobotocore-sagemaker-featurestore-runtime =
-    buildTypesAiobotocorePackage "sagemaker-featurestore-runtime" "2.23.2"
-      "sha256-bBhEDfJkcfpssFVozGDp81EWAf31u0Arw1k/7DP0OrE=";
+    buildTypesAiobotocorePackage "sagemaker-featurestore-runtime" "2.24.2"
+      "sha256-J3GJCghF9HQwhtiCYLmcbqXZOYtpojNCNzVqGTW/j1E=";
 
   types-aiobotocore-sagemaker-geospatial =
-    buildTypesAiobotocorePackage "sagemaker-geospatial" "2.23.2"
-      "sha256-BLQdDCrPFGqXso6ZmC93j1sA4QWo78aW0bDpcRFBMkg=";
+    buildTypesAiobotocorePackage "sagemaker-geospatial" "2.24.2"
+      "sha256-7eY1kquSmH4Z89UZ2Ufsyn28ajHGjalyFM6S47cHvzg=";
 
   types-aiobotocore-sagemaker-metrics =
-    buildTypesAiobotocorePackage "sagemaker-metrics" "2.23.2"
-      "sha256-ytMnM7y8UBrsLjFg8oibB6HcljtUiWSpx5397K2NtWg=";
+    buildTypesAiobotocorePackage "sagemaker-metrics" "2.24.2"
+      "sha256-uBSJRkwqF89NBJ6ImofA3e8T5fj+ki6nYqBb/jAQa4E=";
 
   types-aiobotocore-sagemaker-runtime =
-    buildTypesAiobotocorePackage "sagemaker-runtime" "2.23.2"
-      "sha256-HPNsoVupHTLz3ng1kFk4f+Yo4uWB9SYsc6QUVq0GrBs=";
+    buildTypesAiobotocorePackage "sagemaker-runtime" "2.24.2"
+      "sha256-zaWBrhJPIhBfX7xIkkUS8WlsSRddF4+p2QIx8LjJFZw=";
 
   types-aiobotocore-savingsplans =
-    buildTypesAiobotocorePackage "savingsplans" "2.23.2"
-      "sha256-obeU/yDoPkMREN7+VMDjpaz5SQXI99u8fjYhPx5jUKQ=";
+    buildTypesAiobotocorePackage "savingsplans" "2.24.2"
+      "sha256-jcWDWcR2kbF9pG9EyCUyAEYNZeIzQaHfJDY5MB+lMa4=";
 
   types-aiobotocore-scheduler =
-    buildTypesAiobotocorePackage "scheduler" "2.23.2"
-      "sha256-QcePY3cWP0VGqVvdAOC8E1BtCiJnLl4Hg2PWlFLkiw0=";
+    buildTypesAiobotocorePackage "scheduler" "2.24.2"
+      "sha256-zOiJpp2MuZ/IcllgTZYAh17mQPzx+BMyFJr3NVl6auM=";
 
   types-aiobotocore-schemas =
-    buildTypesAiobotocorePackage "schemas" "2.23.2"
-      "sha256-JEAObIWiMvOk/rJ30ZerKa/c60mcyZpGOqNHorAme0Y=";
+    buildTypesAiobotocorePackage "schemas" "2.24.2"
+      "sha256-iJFpB6KokPPzGXD49yxNSyVkejNhzd49ncSteEfg1R0=";
 
   types-aiobotocore-sdb =
-    buildTypesAiobotocorePackage "sdb" "2.23.2"
-      "sha256-bxLLaVaGkiFVcBxaiV8Vag/Pl/x2pSg73NvTeio2RS0=";
+    buildTypesAiobotocorePackage "sdb" "2.24.2"
+      "sha256-yXF9EEiFwjLGonHSbTBC+BnZ0exCk76/sSeIklQ1tDI=";
 
   types-aiobotocore-secretsmanager =
-    buildTypesAiobotocorePackage "secretsmanager" "2.23.2"
-      "sha256-HvxxDQK3RbYu5B6Ram/Nrb+vWTzxitPRL4Ul2+52my8=";
+    buildTypesAiobotocorePackage "secretsmanager" "2.24.2"
+      "sha256-QgWV5Kprk3UYDWocrmi52Ap4Hm+HoRRaOgKGgsT+nMQ=";
 
   types-aiobotocore-securityhub =
-    buildTypesAiobotocorePackage "securityhub" "2.23.2"
-      "sha256-VpYXbMgtozOfaSrhBAFjafSEvX309RcqItUvVM0d6lE=";
+    buildTypesAiobotocorePackage "securityhub" "2.24.2"
+      "sha256-SV1TXuwUfgN+G4va1wnu/rMOYW5tnkqeEeMBXV6uBkY=";
 
   types-aiobotocore-securitylake =
-    buildTypesAiobotocorePackage "securitylake" "2.23.2"
-      "sha256-OQlkvKJ3ysq3EHS/dZ140vsEGlrdmP/JyRZlzF7RZKM=";
+    buildTypesAiobotocorePackage "securitylake" "2.24.2"
+      "sha256-4ZQKsMt4J9RWylsZs7TfIkLdTuRdac3sanT8jV+ab9s=";
 
   types-aiobotocore-serverlessrepo =
-    buildTypesAiobotocorePackage "serverlessrepo" "2.23.2"
-      "sha256-moaKI/4wxP1jtuUiqi6APyMLLXAQza/hcZiXxaEn1aE=";
+    buildTypesAiobotocorePackage "serverlessrepo" "2.24.2"
+      "sha256-krCbDcKMzZNA7nXL0J/OBctbO8yh0nNW3o7nao4F1PI=";
 
   types-aiobotocore-service-quotas =
-    buildTypesAiobotocorePackage "service-quotas" "2.23.2"
-      "sha256-KHlbTbpS5qGXxbCH4Dl+86jpW1wQIrELJgDAnAeZOII=";
+    buildTypesAiobotocorePackage "service-quotas" "2.24.2"
+      "sha256-BQ7G27WFY3tpt+xWOaD8gmMjkYzkO7mifkd+CKSKSuI=";
 
   types-aiobotocore-servicecatalog =
-    buildTypesAiobotocorePackage "servicecatalog" "2.23.2"
-      "sha256-6IhUJJTGcEjr4739JSacTFOmwzUv6dkTJ9dB7F2PtCI=";
+    buildTypesAiobotocorePackage "servicecatalog" "2.24.2"
+      "sha256-0cD04vy9SlxDinwmpZb2UOPz/Mn7NRsi6bQGdM800tY=";
 
   types-aiobotocore-servicecatalog-appregistry =
-    buildTypesAiobotocorePackage "servicecatalog-appregistry" "2.23.2"
-      "sha256-m8qcxSftCo66f3lZrMXAyVEDtVP8Y2DzKFmTMbSbtRc=";
+    buildTypesAiobotocorePackage "servicecatalog-appregistry" "2.24.2"
+      "sha256-OYxDS4bjTVK3OwRvgZ1JV1cGD25AD9Q288V5Aav1FSA=";
 
   types-aiobotocore-servicediscovery =
-    buildTypesAiobotocorePackage "servicediscovery" "2.23.2"
-      "sha256-2+EHVE4zLIDT9ZHIwaiSHV0G+dt4NNeXlAgOHbftPJo=";
+    buildTypesAiobotocorePackage "servicediscovery" "2.24.2"
+      "sha256-+uDJyXTA5WJzlwEy2qMafNNrk7Gzh2e0NH1l79Q8Qns=";
 
   types-aiobotocore-ses =
-    buildTypesAiobotocorePackage "ses" "2.23.2"
-      "sha256-Bmy7lEEZcJ1RiEqy1usFUskGlHdnAdU5+a3ASM6fNPw=";
+    buildTypesAiobotocorePackage "ses" "2.24.2"
+      "sha256-HW+gBptVK2qoT1peVrjcJgJMB954IWWuE+mbriHwYmM=";
 
   types-aiobotocore-sesv2 =
-    buildTypesAiobotocorePackage "sesv2" "2.23.2"
-      "sha256-cVlYXOvK1ovaAzn3YYWU8ZvW6yHd7IOUqIcpAgxyipQ=";
+    buildTypesAiobotocorePackage "sesv2" "2.24.2"
+      "sha256-JlgOpehKnxl3yQLV2OjqY4s5riJKpfPW8W7darDfhXM=";
 
   types-aiobotocore-shield =
-    buildTypesAiobotocorePackage "shield" "2.23.2"
-      "sha256-M8l45iCeZ3Rq4Ok6iVE5wb96oOF/m6h6PP9pDTXQJWg=";
+    buildTypesAiobotocorePackage "shield" "2.24.2"
+      "sha256-86oJDWCKkURbn/EYzzlQgrwPRygLlft7DRCs5hZhbjc=";
 
   types-aiobotocore-signer =
-    buildTypesAiobotocorePackage "signer" "2.23.2"
-      "sha256-O7LGJ9RLGc7/1+C+OhJG2G0u6FyrzYnriAA7ESLdKpE=";
+    buildTypesAiobotocorePackage "signer" "2.24.2"
+      "sha256-2VFXzHMKAam29FWujUH55oGWYVI88WnF76/yVgN40+g=";
 
   types-aiobotocore-simspaceweaver =
-    buildTypesAiobotocorePackage "simspaceweaver" "2.23.2"
-      "sha256-4yDLoGFAOHyYFa6FoqwNnA7A3OirFCyTiXNx7BYcDKQ=";
+    buildTypesAiobotocorePackage "simspaceweaver" "2.24.2"
+      "sha256-ywjOF3N5hyIfzIYlOb5zbDRcWUVaQnMr2RV+3FLNXPU=";
 
   types-aiobotocore-sms =
-    buildTypesAiobotocorePackage "sms" "2.23.2"
-      "sha256-bjW6LqsZ5i/DLPFlH8kGItnpUw9yn+/Z1VeNEs39k8E=";
+    buildTypesAiobotocorePackage "sms" "2.24.2"
+      "sha256-aZuGmKtxe3ERjMUZ5jNiZUaVUqDaCHKQQ6wMTsGkcVs=";
 
   types-aiobotocore-sms-voice =
     buildTypesAiobotocorePackage "sms-voice" "2.22.0"
       "sha256-nlg8QppdMa4MMLUQZXcxnypzv5II9PqEtuVc09UmjKU=";
 
   types-aiobotocore-snow-device-management =
-    buildTypesAiobotocorePackage "snow-device-management" "2.23.2"
-      "sha256-2GOOg1R7phu2w+pS6DnqOWwnSBd9pbCouBqruz1p8VY=";
+    buildTypesAiobotocorePackage "snow-device-management" "2.24.2"
+      "sha256-1Dj+yn1iPugGiG2reRiZQKaKABM6zWp1kSjoS+jDANY=";
 
   types-aiobotocore-snowball =
-    buildTypesAiobotocorePackage "snowball" "2.23.2"
-      "sha256-WIIZldfYq2+QEszAiXx5+OaSUZnEpihpQAjSR/zvttg=";
+    buildTypesAiobotocorePackage "snowball" "2.24.2"
+      "sha256-0Dpk8/02D7XyEP0PA48qTnUQEofHijYhfSOS7KEipwg=";
 
   types-aiobotocore-sns =
-    buildTypesAiobotocorePackage "sns" "2.23.2"
-      "sha256-sFt/Tk5pJGKUf1FzLPzh2MaV3s48mhS5Z45DB1cc/7g=";
+    buildTypesAiobotocorePackage "sns" "2.24.2"
+      "sha256-nTL+9mpRTGXy/xYDfOI1PNhWT10qYOGLkCKwDzDNkw8=";
 
   types-aiobotocore-sqs =
-    buildTypesAiobotocorePackage "sqs" "2.23.2"
-      "sha256-Qkt/diu4NvIqErOrbB6V8Gut0mFT8GFmPEmeYSV7AO0=";
+    buildTypesAiobotocorePackage "sqs" "2.24.2"
+      "sha256-oGwzbJnk5ryzauXFejj9HZyNihIKYbqF2/KAYGI5Zn4=";
 
   types-aiobotocore-ssm =
-    buildTypesAiobotocorePackage "ssm" "2.23.2"
-      "sha256-VTNG6NymkJ6okACKCzjBJKoN9+RgxXP92tQI9CcKGYs=";
+    buildTypesAiobotocorePackage "ssm" "2.24.2"
+      "sha256-Uj/0ItMfwFIiCMM57yzPj/Rxt5Rwg+ST0bDTWiPeTiM=";
 
   types-aiobotocore-ssm-contacts =
-    buildTypesAiobotocorePackage "ssm-contacts" "2.23.2"
-      "sha256-bGGJUoS47GS0rQ2+pUbJ24oxuTT1tzbXBLjTPAfnq54=";
+    buildTypesAiobotocorePackage "ssm-contacts" "2.24.2"
+      "sha256-pSYFWqTFZTBHJ3JzRju2O9kKKROLP76KL3DsnROmfWw=";
 
   types-aiobotocore-ssm-incidents =
-    buildTypesAiobotocorePackage "ssm-incidents" "2.23.2"
-      "sha256-LDce4hukTKGAubLAgAO6MYRPxPZU0BPB9reKwsUFlpQ=";
+    buildTypesAiobotocorePackage "ssm-incidents" "2.24.2"
+      "sha256-PXJvb2eMt2Z8R4WXHbkoji6LCZk6IGFSRJgUE67ES7c=";
 
   types-aiobotocore-ssm-sap =
-    buildTypesAiobotocorePackage "ssm-sap" "2.23.2"
-      "sha256-qPLEJcTarmBpzTzrDZmhXuO3MX/btewKtY4HrZDlZiM=";
+    buildTypesAiobotocorePackage "ssm-sap" "2.24.2"
+      "sha256-IS5mYxADDlrXS8DNkhgjk6ltwbJ1w94L36iX5BHMtYg=";
 
   types-aiobotocore-sso =
-    buildTypesAiobotocorePackage "sso" "2.23.2"
-      "sha256-ID4gwlyyrbdZubDHvlM4ttCT4gBuY6O0Wairt5dwbo0=";
+    buildTypesAiobotocorePackage "sso" "2.24.2"
+      "sha256-Zm0n+Aw4B48vFTV2S64X2hdkQ2hqj0oxcmQ9qZGj120=";
 
   types-aiobotocore-sso-admin =
-    buildTypesAiobotocorePackage "sso-admin" "2.23.2"
-      "sha256-F83K8WvDTK/ATIH+wGH5vz07DOBdedy+x5sUbcdrdWo=";
+    buildTypesAiobotocorePackage "sso-admin" "2.24.2"
+      "sha256-L+cfr/lzUoAPfMJ7PjEt+sxicg98R5Ytmlhl3+6ieXc=";
 
   types-aiobotocore-sso-oidc =
-    buildTypesAiobotocorePackage "sso-oidc" "2.23.2"
-      "sha256-KKRZZj8WMN5Arfl6MOvp5VEHWUOcoAMyeZTU8SrvkcE=";
+    buildTypesAiobotocorePackage "sso-oidc" "2.24.2"
+      "sha256-70zdjnOllUJi0lHD7HwwChC21eHA4TkvJ+RE9TzdJh8=";
 
   types-aiobotocore-stepfunctions =
-    buildTypesAiobotocorePackage "stepfunctions" "2.23.2"
-      "sha256-SNephRpMQbFRdPIFJg228CIbYXPmFP0VQBCMt6o5eSM=";
+    buildTypesAiobotocorePackage "stepfunctions" "2.24.2"
+      "sha256-m6n0ibBv1Ov76spxP7LMqs27VgId2P2KhpGSL+qFzLY=";
 
   types-aiobotocore-storagegateway =
-    buildTypesAiobotocorePackage "storagegateway" "2.23.2"
-      "sha256-5AfrT9iNcHdMuslQ1Yt+r/zPvKn3FAPcgjOV4hq7XXE=";
+    buildTypesAiobotocorePackage "storagegateway" "2.24.2"
+      "sha256-OVHNkue3xUFidNiDh4pQ9r7H2nnwaFWoF1d3li7gTj0=";
 
   types-aiobotocore-sts =
-    buildTypesAiobotocorePackage "sts" "2.23.2"
-      "sha256-1Pbxy7xiqYQaEnukC4A9dfdLol9C6FLdQ6lFbYrjUHU=";
+    buildTypesAiobotocorePackage "sts" "2.24.2"
+      "sha256-FuuHtSxd/+3avj4qka2DF0hg1pPXyh6R6ywdbbYOFoA=";
 
   types-aiobotocore-support =
-    buildTypesAiobotocorePackage "support" "2.23.2"
-      "sha256-dM80XCLpE6Ce0YhI+CrlmWQBZaq1WyAh7dc5o5d7PD8=";
+    buildTypesAiobotocorePackage "support" "2.24.2"
+      "sha256-oWd1Zk/EboEs5mYrVmh2Uereh08K5FxO4bd1NFa61U8=";
 
   types-aiobotocore-support-app =
-    buildTypesAiobotocorePackage "support-app" "2.23.2"
-      "sha256-rXgza6VCCJFUVtpRh517lHmpEw1SJt/FJ/hCn/pwp0w=";
+    buildTypesAiobotocorePackage "support-app" "2.24.2"
+      "sha256-LcIfPkSdfew2u061BMlRUpVzJcWNmjFVW7oQ6Od5EUE=";
 
   types-aiobotocore-swf =
-    buildTypesAiobotocorePackage "swf" "2.23.2"
-      "sha256-OD06lxrb36mlg2byV/LWOUrtH8bn50qQ1oZVMgTvv8Y=";
+    buildTypesAiobotocorePackage "swf" "2.24.2"
+      "sha256-aS3yAJYlhGkL+T7llRdIrtLJM1sL7ZqaqEbkQBRzT28=";
 
   types-aiobotocore-synthetics =
-    buildTypesAiobotocorePackage "synthetics" "2.23.2"
-      "sha256-tQo5/c59YE49ByNfOUvjU1it4voa46RPJ/UgfTeEvpM=";
+    buildTypesAiobotocorePackage "synthetics" "2.24.2"
+      "sha256-Nt+2mhGMv2wHFF20mjb26WqeKU0rp0L+07/PIaqVjAE=";
 
   types-aiobotocore-textract =
-    buildTypesAiobotocorePackage "textract" "2.23.2"
-      "sha256-f4dp8RXYWTIyEpLRK2j2JT8YuDDmcFfoM1F4WSVliAs=";
+    buildTypesAiobotocorePackage "textract" "2.24.2"
+      "sha256-9yZRD/3NLu4jX4S9oloGsWvj/8moAsEomUMhAHYJBww=";
 
   types-aiobotocore-timestream-query =
-    buildTypesAiobotocorePackage "timestream-query" "2.23.2"
-      "sha256-od2tkolG3+aJq6b6e4ZCk9K4v1JwV9fEtIUdGaE2qvU=";
+    buildTypesAiobotocorePackage "timestream-query" "2.24.2"
+      "sha256-cBKynyH3wCyACq4Zpgw+2kCOKIvttfWOq7B5Jbts/Xw=";
 
   types-aiobotocore-timestream-write =
-    buildTypesAiobotocorePackage "timestream-write" "2.23.2"
-      "sha256-m9GaN2G/dZdIe9tPD5ZsBEkpvjzxQ29XHRCaNoGW4SA=";
+    buildTypesAiobotocorePackage "timestream-write" "2.24.2"
+      "sha256-lT+BmQPtf9K4QbvyS+YRo/s77NqH+omEChSZVkBiJT4=";
 
   types-aiobotocore-tnb =
-    buildTypesAiobotocorePackage "tnb" "2.23.2"
-      "sha256-Ift2pv89c4Mv324BGFFFNHhys8e5/Y04Bp5cuKdNCL4=";
+    buildTypesAiobotocorePackage "tnb" "2.24.2"
+      "sha256-Z8DJnCDGlEqW9f89DaNWes8zLhIVe96Zl78VCggHP+g=";
 
   types-aiobotocore-transcribe =
-    buildTypesAiobotocorePackage "transcribe" "2.23.2"
-      "sha256-PEkelbZJGFEF802Zth53Eb6LQpMnrD0g+Y7MywqiYP0=";
+    buildTypesAiobotocorePackage "transcribe" "2.24.2"
+      "sha256-lMjMem51b53yoitik+2yv+XkLAOJrUtYgDUHZn+gi1k=";
 
   types-aiobotocore-transfer =
-    buildTypesAiobotocorePackage "transfer" "2.23.2"
-      "sha256-WOyuJUQp4BkFpBqBNdHsRIC+OY1hNVUZN84tPUpqjDE=";
+    buildTypesAiobotocorePackage "transfer" "2.24.2"
+      "sha256-PNFym3xZYP+Qca1fs00xBBkI8L+OiUvH2ruhJo16YZs=";
 
   types-aiobotocore-translate =
-    buildTypesAiobotocorePackage "translate" "2.23.2"
-      "sha256-cxYoHczI9Sr62CsHo8+SjpbkzmYcA9lRH/U98kaKaIw=";
+    buildTypesAiobotocorePackage "translate" "2.24.2"
+      "sha256-8nE8Vx7RHMCFZ237tvWsZ6xkZ6b8EjtrH9gSu5MOrN4=";
 
   types-aiobotocore-verifiedpermissions =
-    buildTypesAiobotocorePackage "verifiedpermissions" "2.23.2"
-      "sha256-rYs0eoxjU/PtYOF2ADgiBd9O8mLXMT/+6WLprfdbzCs=";
+    buildTypesAiobotocorePackage "verifiedpermissions" "2.24.2"
+      "sha256-5Ilxnh1JjeF/QQ7uHhvoOPLjTzbazJS5b6OGmtbLHCc=";
 
   types-aiobotocore-voice-id =
-    buildTypesAiobotocorePackage "voice-id" "2.23.2"
-      "sha256-hsgme2tduhW3eF/6PIUTyub2lEGHGr9+HOU/kI0zpnk=";
+    buildTypesAiobotocorePackage "voice-id" "2.24.2"
+      "sha256-grProRGMfRFdSkkOiw3GQBVnDioOczsBZf+oK+m69kE=";
 
   types-aiobotocore-vpc-lattice =
-    buildTypesAiobotocorePackage "vpc-lattice" "2.23.2"
-      "sha256-sxWLnz+Rh+KHwOeRqmW3DIOQLmvLv41UCqTkWC0TRFE=";
+    buildTypesAiobotocorePackage "vpc-lattice" "2.24.2"
+      "sha256-ILg82/EqdXJilWfTlq0TwT7Arjj+sY0qWRlKpvlMrBc=";
 
   types-aiobotocore-waf =
-    buildTypesAiobotocorePackage "waf" "2.23.2"
-      "sha256-x+RsDo6RIQEKZK+Fsezr/Ve+J3qoD4YVVEw7zzLJROU=";
+    buildTypesAiobotocorePackage "waf" "2.24.2"
+      "sha256-fnsqPhceAF+7UAsV9RwAIdK4mSjcy+JJ97VZeX3D0VU=";
 
   types-aiobotocore-waf-regional =
-    buildTypesAiobotocorePackage "waf-regional" "2.23.2"
-      "sha256-++Tx6/Ex+gGYJAX7Nxut9oXE0ECJ8Ad9CKeZIMZwOJ0=";
+    buildTypesAiobotocorePackage "waf-regional" "2.24.2"
+      "sha256-2J48HocSAXxluN4/q0A/7wAyARjxjnsc6IycbnIG5DA=";
 
   types-aiobotocore-wafv2 =
-    buildTypesAiobotocorePackage "wafv2" "2.23.2"
-      "sha256-PNohPrEZAsYtPnf2p/bOS456halWyP8ewQ1jF9dCd20=";
+    buildTypesAiobotocorePackage "wafv2" "2.24.2"
+      "sha256-uf8upfwYqyeaemtToUdBiVWYuk53drfIzyY3DNAxlNU=";
 
   types-aiobotocore-wellarchitected =
-    buildTypesAiobotocorePackage "wellarchitected" "2.23.2"
-      "sha256-pYonw9Bt7FHQUw8yrnY2+nceeO42BWawibssxeIs6X8=";
+    buildTypesAiobotocorePackage "wellarchitected" "2.24.2"
+      "sha256-Ir+6LJ6+r5Aotmf0oCG5WRZWF3RkTZFZJfRhB3Z8g+k=";
 
   types-aiobotocore-wisdom =
-    buildTypesAiobotocorePackage "wisdom" "2.23.2"
-      "sha256-pH6b8DRar3gPWZAIioTPswn+fRmZfhEP8CLS4EMFl1A=";
+    buildTypesAiobotocorePackage "wisdom" "2.24.2"
+      "sha256-9yivTGhoXtJ1rG0ymil3SmG4V5xGmj2FGpkMnMaI7TE=";
 
   types-aiobotocore-workdocs =
-    buildTypesAiobotocorePackage "workdocs" "2.23.2"
-      "sha256-4EkeBQRPO8tmEtVYVQGqTBpa2ZH39YSrS+P/9d2t4CE=";
+    buildTypesAiobotocorePackage "workdocs" "2.24.2"
+      "sha256-YelR8k567W2+2Bv9w24gdI0rIpP1TyssxEPIGuW16Do=";
 
   types-aiobotocore-worklink =
     buildTypesAiobotocorePackage "worklink" "2.15.1"
       "sha256-VvuxiybvGaehPqyVUYGO1bbVSQ0OYgk6LbzgoKLHF2c=";
 
   types-aiobotocore-workmail =
-    buildTypesAiobotocorePackage "workmail" "2.23.2"
-      "sha256-lJfvx80/+CvbhXD3QM6x4vACNEjguNK0yHuLxjTGseI=";
+    buildTypesAiobotocorePackage "workmail" "2.24.2"
+      "sha256-AaiFHb/3Or5BDLcNSIfXIKUF4R7eJ230/HPJdd1SWn4=";
 
   types-aiobotocore-workmailmessageflow =
-    buildTypesAiobotocorePackage "workmailmessageflow" "2.23.2"
-      "sha256-pccbWkeio5leYT9M1F3idCWbqYhZssHVftKZe0TUuSk=";
+    buildTypesAiobotocorePackage "workmailmessageflow" "2.24.2"
+      "sha256-K66w3+72jZxXmamgp0PgUiD/VM9LUPIskPNQ68UTFm4=";
 
   types-aiobotocore-workspaces =
-    buildTypesAiobotocorePackage "workspaces" "2.23.2"
-      "sha256-/h2kDKfngF3Sbu3++sbGTxiW06A2aDM6VzuSTnG4JsE=";
+    buildTypesAiobotocorePackage "workspaces" "2.24.2"
+      "sha256-biQpJKh3oKk5bKhaGCJr5gK63Hco3pbGT6o5oVDabms=";
 
   types-aiobotocore-workspaces-web =
-    buildTypesAiobotocorePackage "workspaces-web" "2.23.2"
-      "sha256-MHCnARP17nK9c0EOueaQItZohXhSP6aV1kTc1vZwyWM=";
+    buildTypesAiobotocorePackage "workspaces-web" "2.24.2"
+      "sha256-DVMMtkds8zwHMGpUNI5a+JVoCZQe5Odukqe0GA9U3hA=";
 
   types-aiobotocore-xray =
-    buildTypesAiobotocorePackage "xray" "2.23.2"
-      "sha256-WqODS2sC6bV03hlAzFMTgqxU4b2kVJHUCOZfCJTTIRc=";
+    buildTypesAiobotocorePackage "xray" "2.24.2"
+      "sha256-+Kwey/y+rgaJ1EsczvY6+io72lGq9MvL6SlytJALuAM=";
 }
diff --git a/pkgs/development/python-modules/types-aiobotocore/default.nix b/pkgs/development/python-modules/types-aiobotocore/default.nix
index dc97e39fd751..a075384f036a 100644
--- a/pkgs/development/python-modules/types-aiobotocore/default.nix
+++ b/pkgs/development/python-modules/types-aiobotocore/default.nix
@@ -364,13 +364,13 @@
 
 buildPythonPackage rec {
   pname = "types-aiobotocore";
-  version = "2.24.1";
+  version = "2.24.2";
   pyproject = true;
 
   src = fetchPypi {
     pname = "types_aiobotocore";
     inherit version;
-    hash = "sha256-gq1YqgW819qazbzB9Y+xtCC4F6Xq26bljzCkGqFMXeg=";
+    hash = "sha256-TSmuDoSPIKzr/NIpzavsrj4cE/E9n8yemHMlRGFBOxw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/types-aiobotocore/update.sh b/pkgs/development/python-modules/types-aiobotocore/update.sh
index de00ff30f3ff..089a6b92267f 100755
--- a/pkgs/development/python-modules/types-aiobotocore/update.sh
+++ b/pkgs/development/python-modules/types-aiobotocore/update.sh
@@ -12,7 +12,6 @@ packages=(
   types-aiobotocore-account
   types-aiobotocore-acm
   types-aiobotocore-acm-pca
-  # types-aiobotocore-alexaforbusiness  Obsolete, will be removed soon
   types-aiobotocore-amp
   types-aiobotocore-amplify
   types-aiobotocore-amplifybackend
@@ -39,7 +38,6 @@ packages=(
   types-aiobotocore-autoscaling-plans
   types-aiobotocore-backup
   types-aiobotocore-backup-gateway
-  # types-aiobotocore-backupstorage  Obsolete, will be removed soon
   types-aiobotocore-batch
   types-aiobotocore-billingconductor
   types-aiobotocore-braket
@@ -73,7 +71,6 @@ packages=(
   types-aiobotocore-codeguru-security
   types-aiobotocore-codeguruprofiler
   types-aiobotocore-codepipeline
-  # types-aiobotocore-codestar  Obsolete, will be removed soon
   types-aiobotocore-codestar-connections
   types-aiobotocore-codestar-notifications
   types-aiobotocore-cognito-identity
@@ -117,7 +114,6 @@ packages=(
   types-aiobotocore-ecs
   types-aiobotocore-efs
   types-aiobotocore-eks
-  types-aiobotocore-elastic-inference
   types-aiobotocore-elasticache
   types-aiobotocore-elasticbeanstalk
   types-aiobotocore-elastictranscoder
@@ -140,7 +136,6 @@ packages=(
   types-aiobotocore-frauddetector
   types-aiobotocore-fsx
   types-aiobotocore-gamelift
-  # types-aiobotocore-gamesparks  Obsolete, will be removed soon
   types-aiobotocore-glacier
   types-aiobotocore-globalaccelerator
   types-aiobotocore-glue
@@ -151,7 +146,6 @@ packages=(
   types-aiobotocore-guardduty
   types-aiobotocore-health
   types-aiobotocore-healthlake
-  # types-aiobotocore-honeycode  Obsolete, will be removed soon
   types-aiobotocore-iam
   types-aiobotocore-identitystore
   types-aiobotocore-imagebuilder
@@ -162,9 +156,6 @@ packages=(
   types-aiobotocore-iot
   types-aiobotocore-iot-data
   types-aiobotocore-iot-jobs-data
-  # types-aiobotocore-iot-roborunner  Obsolete, will be removed soon
-  # types-aiobotocore-iot1click-devices
-  # types-aiobotocore-iot1click-projects
   types-aiobotocore-iotanalytics
   types-aiobotocore-iotdeviceadvisor
   types-aiobotocore-iotevents
@@ -210,7 +201,6 @@ packages=(
   types-aiobotocore-lookoutvision
   types-aiobotocore-m2
   types-aiobotocore-machinelearning
-  # types-aiobotocore-macie  Obsolete, will be removed soon
   types-aiobotocore-macie2
   types-aiobotocore-managedblockchain
   types-aiobotocore-managedblockchain-query
@@ -235,14 +225,12 @@ packages=(
   types-aiobotocore-migrationhub-config
   types-aiobotocore-migrationhuborchestrator
   types-aiobotocore-migrationhubstrategy
-  # types-aiobotocore-mobile  Obsolete, will be removed soon
   types-aiobotocore-mq
   types-aiobotocore-mturk
   types-aiobotocore-mwaa
   types-aiobotocore-neptune
   types-aiobotocore-network-firewall
   types-aiobotocore-networkmanager
-  types-aiobotocore-nimble
   types-aiobotocore-oam
   types-aiobotocore-omics
   types-aiobotocore-opensearch
@@ -266,7 +254,6 @@ packages=(
   types-aiobotocore-pipes
   types-aiobotocore-polly
   types-aiobotocore-pricing
-  types-aiobotocore-privatenetworks
   types-aiobotocore-proton
   types-aiobotocore-qldb
   types-aiobotocore-qldb-session
@@ -320,7 +307,6 @@ packages=(
   types-aiobotocore-signer
   types-aiobotocore-simspaceweaver
   types-aiobotocore-sms
-  types-aiobotocore-sms-voice
   types-aiobotocore-snow-device-management
   types-aiobotocore-snowball
   types-aiobotocore-sns
@@ -355,7 +341,6 @@ packages=(
   types-aiobotocore-wellarchitected
   types-aiobotocore-wisdom
   types-aiobotocore-workdocs
-  # types-aiobotocore-worklink
   types-aiobotocore-workmail
   types-aiobotocore-workmailmessageflow
   types-aiobotocore-workspaces
diff --git a/pkgs/development/python-modules/uproot/default.nix b/pkgs/development/python-modules/uproot/default.nix
index 497167201a1c..190b3ed4bd9a 100644
--- a/pkgs/development/python-modules/uproot/default.nix
+++ b/pkgs/development/python-modules/uproot/default.nix
@@ -27,14 +27,14 @@
 
 buildPythonPackage rec {
   pname = "uproot";
-  version = "5.6.4";
+  version = "5.6.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scikit-hep";
     repo = "uproot5";
     tag = "v${version}";
-    hash = "sha256-2F2uatdrZd5p6baYuGj24EmUv045Jk3Pp76Zv6eH5yg=";
+    hash = "sha256-1zZr+SrGRNBz/Wd1cT2aYOH/MzSZTCuqxYIlA+NXqLk=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/urllib3-future/default.nix b/pkgs/development/python-modules/urllib3-future/default.nix
index 84c1d9eb6405..a5f7869421ed 100644
--- a/pkgs/development/python-modules/urllib3-future/default.nix
+++ b/pkgs/development/python-modules/urllib3-future/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "urllib3-future";
-  version = "2.13.908";
+  version = "2.14.900";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jawah";
     repo = "urllib3.future";
     tag = version;
-    hash = "sha256-0Kvq9RxW/ClHQpnPl3JosTh2r195bpou3dSPmGwTGtY=";
+    hash = "sha256-TMxYnvGkLZEaE4ECgzIN6XTI8OMI5N9mNcsvXeYCVbM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/tools/electron/binary/generic.nix b/pkgs/development/tools/electron/binary/generic.nix
index 8bd49c6ed39c..7de6c458757f 100644
--- a/pkgs/development/tools/electron/binary/generic.nix
+++ b/pkgs/development/tools/electron/binary/generic.nix
@@ -58,7 +58,7 @@ let
     ];
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     # https://www.electronjs.org/docs/latest/tutorial/electron-timelines
-    knownVulnerabilities = optional (versionOlder version "35.0.0") "Electron version ${version} is EOL";
+    knownVulnerabilities = optional (versionOlder version "36.0.0") "Electron version ${version} is EOL";
   };
 
   fetcher =
diff --git a/pkgs/development/tools/electron/info.json b/pkgs/development/tools/electron/info.json
index 62668b28d7a0..c918739ee7f0 100644
--- a/pkgs/development/tools/electron/info.json
+++ b/pkgs/development/tools/electron/info.json
@@ -1,1312 +1,4 @@
 {
-    "35": {
-        "chrome": "134.0.6998.205",
-        "chromium": {
-            "deps": {
-                "gn": {
-                    "hash": "sha256-U0f/Q134UJrSke+/o9Hs4+mQa/vSM2hdkRXhLfhnqME=",
-                    "rev": "ed1abc107815210dc66ec439542bee2f6cbabc00",
-                    "version": "0-unstable-2025-01-13"
-                }
-            },
-            "version": "134.0.6998.205"
-        },
-        "chromium_npm_hash": "sha256-oVoTruhxTymYiGkELd2Oa1wOfjGLtChQZozP4GzOO1A=",
-        "deps": {
-            "src": {
-                "args": {
-                    "hash": "sha256-LL0lmb23zTjOwi8Sbz0Vb3Nj3ptqpRL/5V5rI8vXu0U=",
-                    "postFetch": "rm -r $out/third_party/blink/web_tests; rm -r $out/content/test/data; rm -rf $out/courgette/testdata; rm -r $out/extensions/test/data; rm -r $out/media/test/data; ",
-                    "tag": "134.0.6998.205",
-                    "url": "https://chromium.googlesource.com/chromium/src.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/chrome/test/data/perf/canvas_bench": {
-                "args": {
-                    "hash": "sha256-svOuyBGKloBLM11xLlWCDsB4PpRjdKTBdW2UEW4JQjM=",
-                    "rev": "a7b40ea5ae0239517d78845a5fc9b12976bfc732",
-                    "url": "https://chromium.googlesource.com/chromium/canvas_bench.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/chrome/test/data/perf/frame_rate/content": {
-                "args": {
-                    "hash": "sha256-t4kcuvH0rkPBkcdiMsoNQaRwU09eU+oSvyHDiAHrKXo=",
-                    "rev": "c10272c88463efeef6bb19c9ec07c42bc8fe22b9",
-                    "url": "https://chromium.googlesource.com/chromium/frame_rate/content.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/chrome/test/data/xr/webvr_info": {
-                "args": {
-                    "hash": "sha256-BsAPwc4oEWri0TlqhyxqFNqKdfgVSrB0vQyISmYY4eg=",
-                    "rev": "c58ae99b9ff9e2aa4c524633519570bf33536248",
-                    "url": "https://chromium.googlesource.com/external/github.com/toji/webvr.info.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/docs/website": {
-                "args": {
-                    "hash": "sha256-f3Tdz0ykxQ2FHbNweJwPdAZHA8eVpjPuxqRpxwhYtRM=",
-                    "rev": "600fc3a0b121d5007b4bb97b001e756625e6d418",
-                    "url": "https://chromium.googlesource.com/website.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/electron": {
-                "args": {
-                    "hash": "sha256-uwPynVLl+BVB2eO479YLg1Gbo8lv5h5iHSxNz+M5Wyg=",
-                    "owner": "electron",
-                    "repo": "electron",
-                    "tag": "v35.7.5"
-                },
-                "fetcher": "fetchFromGitHub"
-            },
-            "src/media/cdm/api": {
-                "args": {
-                    "hash": "sha256-FgeuOsxToA4qx3H76czCPeO/WVtprRkllDMPancw3Ik=",
-                    "rev": "5a1675c86821a48f8983842d07f774df28dfb43c",
-                    "url": "https://chromium.googlesource.com/chromium/cdm.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/net/third_party/quiche/src": {
-                "args": {
-                    "hash": "sha256-5YFqWgkyQ/PUKTkk1j3mAFD8JMbI+E4XRdSq34HFMWA=",
-                    "rev": "e7d001c82ee5bead5140481671828d5e156a525a",
-                    "url": "https://quiche.googlesource.com/quiche.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/testing/libfuzzer/fuzzers/wasm_corpus": {
-                "args": {
-                    "hash": "sha256-gItDOfNqm1tHlmelz3l2GGdiKi9adu1EpPP6U7+8EQY=",
-                    "rev": "1df5e50a45db9518a56ebb42cb020a94a090258b",
-                    "url": "https://chromium.googlesource.com/v8/fuzzer_wasm_corpus.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/accessibility_test_framework/src": {
-                "args": {
-                    "hash": "sha256-mzVgoxxBWebesG6okyMxxmO6oH+TITA4o9ucHHMMzkQ=",
-                    "rev": "4a764c690353ea136c82f1a696a70bf38d1ef5fe",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/Accessibility-Test-Framework-for-Android.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/angle": {
-                "args": {
-                    "hash": "sha256-Y4eX8YHwVXiXW4U8KGbFd4fTU/v/EAUpfwv6lB127Y4=",
-                    "rev": "914c97c116e09ef01a99fbbbe9cd28cda56552c7",
-                    "url": "https://chromium.googlesource.com/angle/angle.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/angle/third_party/VK-GL-CTS/src": {
-                "args": {
-                    "hash": "sha256-g59uC7feByGR1Ema8LqUCr5XWKpDMeXXvlS2thOo5Ks=",
-                    "rev": "48e7f3020f52ef9adc31aa0f5db01dc42cc487cd",
-                    "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/VK-GL-CTS"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/angle/third_party/glmark2/src": {
-                "args": {
-                    "hash": "sha256-kqBpWHCxUl1ekmrbdPn6cL2y75nK4FxECJ5mo83Zgf4=",
-                    "rev": "cb550a25c75a99ae0def91a02e16ae29d73e6d1e",
-                    "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/angle/third_party/rapidjson/src": {
-                "args": {
-                    "hash": "sha256-btUl1a/B0sXwf/+hyvCvVJjWqIkXfVYCpHm3TeBuOxk=",
-                    "rev": "781a4e667d84aeedbeb8184b7b62425ea66ec59f",
-                    "url": "https://chromium.googlesource.com/external/github.com/Tencent/rapidjson"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/anonymous_tokens/src": {
-                "args": {
-                    "hash": "sha256-mh4s57NonFQzWNaPiKfe9kW4Ow7XAN+hW6Xpvgjvb0w=",
-                    "rev": "2e328dd4eace9648adcc943cac6a1792b5dcdec5",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/anonymous-tokens.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/beto-core/src": {
-                "args": {
-                    "hash": "sha256-QPFGjtu/I0r4+dTQ2eSlWIEYwJ43B3yW0q4QtVFTVGY=",
-                    "rev": "89563fec14c756482afa08b016eeba9087c8d1e3",
-                    "url": "https://beto-core.googlesource.com/beto-core.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/boringssl/src": {
-                "args": {
-                    "hash": "sha256-g9i5v11uZy/3Smn8zSCFmC27Gdp5VP2b0ROrj+VmP1k=",
-                    "rev": "ea42fe28775844ec8fe0444fc421398be42d51fe",
-                    "url": "https://boringssl.googlesource.com/boringssl.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/breakpad/breakpad": {
-                "args": {
-                    "hash": "sha256-jOTRgF2WxsX5P0LgUI9zdCc0+NcqSnO310aq15msThY=",
-                    "rev": "0dfd77492fdb0dcd06027c5842095e2e908adc90",
-                    "url": "https://chromium.googlesource.com/breakpad/breakpad.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/cast_core/public/src": {
-                "args": {
-                    "hash": "sha256-o5/Lbhh6HHSWCVCEyDwDCgs+PLm67si981w0HuIWY7c=",
-                    "rev": "fbc5e98031e1271a0a566fcd4d9092b2d3275d05",
-                    "url": "https://chromium.googlesource.com/cast_core/public"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/catapult": {
-                "args": {
-                    "hash": "sha256-xkvz743+w0xsI0w4reAo2rfC4J7opl1biA3eNYuRn+o=",
-                    "rev": "d5166861902b565df446e15181eba270fe168275",
-                    "url": "https://chromium.googlesource.com/catapult.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/ced/src": {
-                "args": {
-                    "hash": "sha256-ySG74Rj2i2c/PltEgHVEDq+N8yd9gZmxNktc56zIUiY=",
-                    "rev": "ba412eaaacd3186085babcd901679a48863c7dd5",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/compact_enc_det.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/chromium-variations": {
-                "args": {
-                    "hash": "sha256-zXAmoKyj104BaIe4Rug18WbVKkyAsyWPCTPPEerinVo=",
-                    "rev": "84c18c7a0205fbd0a27b0214b16ded7fc44dc062",
-                    "url": "https://chromium.googlesource.com/chromium-variations.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/clang-format/script": {
-                "args": {
-                    "hash": "sha256-d9uweklBffiuCWEb03ti1eFLnMac2qRtvggzXY1n/RU=",
-                    "rev": "37f6e68a107df43b7d7e044fd36a13cbae3413f2",
-                    "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/clang/tools/clang-format.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/cld_3/src": {
-                "args": {
-                    "hash": "sha256-C3MOMBUy9jgkT9BAi/Fgm2UH4cxRuwSBEcRl3hzM2Ss=",
-                    "rev": "b48dc46512566f5a2d41118c8c1116c4f96dc661",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/cld_3.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/colorama/src": {
-                "args": {
-                    "hash": "sha256-6ZTdPYSHdQOLYMSnE+Tp7PgsVTs3U2awGu9Qb4Rg/tk=",
-                    "rev": "3de9f013df4b470069d03d250224062e8cf15c49",
-                    "url": "https://chromium.googlesource.com/external/colorama.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/content_analysis_sdk/src": {
-                "args": {
-                    "hash": "sha256-f5Jmk1MiGjaRdLun+v/GKVl8Yv9hOZMTQUSxgiJalcY=",
-                    "rev": "9a408736204513e0e95dd2ab3c08de0d95963efc",
-                    "url": "https://chromium.googlesource.com/external/github.com/chromium/content_analysis_sdk.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/cpu_features/src": {
-                "args": {
-                    "hash": "sha256-E8LoVzhe+TAmARWZTSuINlsVhzpUJMxPPCGe/dHZcyA=",
-                    "rev": "936b9ab5515dead115606559502e3864958f7f6e",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/cpu_features.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/cpuinfo/src": {
-                "args": {
-                    "hash": "sha256-dKmZ5YXLhvVdxaJ4PefR+SWlh+MTFHNxOMeM6Vj7Gvo=",
-                    "rev": "8a1772a0c5c447df2d18edf33ec4603a8c9c04a6",
-                    "url": "https://chromium.googlesource.com/external/github.com/pytorch/cpuinfo.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/crabbyavif/src": {
-                "args": {
-                    "hash": "sha256-+6339vcd0KJj5V11dvJvs0YpQpTxsLmDuBoYVzyn9Ec=",
-                    "rev": "c5938b119ef52f9ff628436c1e66c9a5322ece83",
-                    "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/crc32c/src": {
-                "args": {
-                    "hash": "sha256-KBraGaO5LmmPP+p8RuDogGldbTWdNDK+WzF4Q09keuE=",
-                    "rev": "d3d60ac6e0f16780bcfcc825385e1d338801a558",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/crc32c.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/cros-components/src": {
-                "args": {
-                    "hash": "sha256-80WqSMP5Vlc4OY+gfpU3SRGavs7fJbTQVW1AIhq6jmE=",
-                    "rev": "1f1c782f06956a2deb5d33f09c466e4852099c71",
-                    "url": "https://chromium.googlesource.com/external/google3/cros_components.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/cros_system_api": {
-                "args": {
-                    "hash": "sha256-xUaGf4MaEXg2RHgrGS1Uuz97vq5Vbt4HFV/AXYB4lCA=",
-                    "rev": "ea21b22629965105426f3df5e58190513e95a17e",
-                    "url": "https://chromium.googlesource.com/chromiumos/platform2/system_api.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/crossbench": {
-                "args": {
-                    "hash": "sha256-EL+lOTe1Vzg4JW2q7t3UoXzHHiEmLjf7khH9fXdplbo=",
-                    "rev": "0391f0d11cbf3cf3c5bcf82e19e9d9839b1936ed",
-                    "url": "https://chromium.googlesource.com/crossbench.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/dav1d/libdav1d": {
-                "args": {
-                    "hash": "sha256-qcs9QoZ/uWEQ8l1ChZ8nYctZnnWJ0VvCw1q2rEktC9g=",
-                    "rev": "42b2b24fb8819f1ed3643aa9cf2a62f03868e3aa",
-                    "url": "https://chromium.googlesource.com/external/github.com/videolan/dav1d.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/dawn": {
-                "args": {
-                    "hash": "sha256-aYlcplXSGjFov9dqql6d+a1PxJWtZJNQaaezof0u9QQ=",
-                    "rev": "7056f50fdefc6bc46aa442e720d0336e2855b570",
-                    "url": "https://dawn.googlesource.com/dawn.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/dawn/third_party/dxc": {
-                "args": {
-                    "hash": "sha256-jecGwARtdSr2OEC68749mpFUAHuYP/IzYUZyj23CwJE=",
-                    "rev": "c2ed9ad4ee775f3de903ce757c994aecc59a5306",
-                    "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectXShaderCompiler"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/dawn/third_party/dxheaders": {
-                "args": {
-                    "hash": "sha256-0Miw1Cy/jmOo7bLFBOHuTRDV04cSeyvUEyPkpVsX9DA=",
-                    "rev": "980971e835876dc0cde415e8f9bc646e64667bf7",
-                    "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectX-Headers"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/dawn/third_party/glfw": {
-                "args": {
-                    "hash": "sha256-E1zXIDiw87badrLOZTvV+Wh9NZHu51nb70ZK9vlAlqE=",
-                    "rev": "b35641f4a3c62aa86a0b3c983d163bc0fe36026d",
-                    "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/dawn/third_party/khronos/EGL-Registry": {
-                "args": {
-                    "hash": "sha256-Z6DwLfgQ1wsJXz0KKJyVieOatnDmx3cs0qJ6IEgSq1A=",
-                    "rev": "7dea2ed79187cd13f76183c4b9100159b9e3e071",
-                    "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/EGL-Registry"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/dawn/third_party/khronos/OpenGL-Registry": {
-                "args": {
-                    "hash": "sha256-K3PcRIiD3AmnbiSm5TwaLs4Gu9hxaN8Y91WMKK8pOXE=",
-                    "rev": "5bae8738b23d06968e7c3a41308568120943ae77",
-                    "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/OpenGL-Registry"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/dawn/third_party/webgpu-cts": {
-                "args": {
-                    "hash": "sha256-AEGYE2rSsPcRzJSm97DGsrPVbhCH+lyVI61Z4qavKc8=",
-                    "rev": "24d5dfa7725d6ece31941c3f3343ba6362986d6b",
-                    "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/depot_tools": {
-                "args": {
-                    "hash": "sha256-BvEkk15Rm4nSoV/uWiwmQW/+gg2vpLQ187TbBAHl9Rk=",
-                    "rev": "e42fac3e9c1726ab14a61a25e6291d9ccc49e688",
-                    "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/devtools-frontend/src": {
-                "args": {
-                    "hash": "sha256-rdBpJWdQ5VtFnIfbr/Vq1q1euSvkbY8iIqyuTMAS2KM=",
-                    "rev": "65b3f414b81ffe4df49202af6fc75bc26a3cb109",
-                    "url": "https://chromium.googlesource.com/devtools/devtools-frontend"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/dom_distiller_js/dist": {
-                "args": {
-                    "hash": "sha256-yuEBD2XQlV3FGI/i7lTmJbCqzeBiuG1Qow8wvsppGJw=",
-                    "rev": "199de96b345ada7c6e7e6ba3d2fa7a6911b8767d",
-                    "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/domato/src": {
-                "args": {
-                    "hash": "sha256-fYxoA0fxKe9U23j+Jp0MWj4m7RfsRpM0XjF6/yOhX1I=",
-                    "rev": "053714bccbda79cf76dac3fee48ab2b27f21925e",
-                    "url": "https://chromium.googlesource.com/external/github.com/googleprojectzero/domato.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/eigen3/src": {
-                "args": {
-                    "hash": "sha256-WG7uiduuMnXrvEpXJNGksrYkBsim+l7eiu5N+mx0Yr0=",
-                    "rev": "2a35a917be47766a895be610bedd66006980b7e6",
-                    "url": "https://chromium.googlesource.com/external/gitlab.com/libeigen/eigen.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/electron_node": {
-                "args": {
-                    "hash": "sha256-rp48HOQB13nZJUByXaL8MMkHNFp/V0qtbDZgoFBIcJY=",
-                    "owner": "nodejs",
-                    "repo": "node",
-                    "tag": "v22.16.0"
-                },
-                "fetcher": "fetchFromGitHub"
-            },
-            "src/third_party/emoji-segmenter/src": {
-                "args": {
-                    "hash": "sha256-KdQdKBBipEBRT8UmNGao6yCB4m2CU8/SrMVvcXlb5qE=",
-                    "rev": "955936be8b391e00835257059607d7c5b72ce744",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/emoji-segmenter.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/engflow-reclient-configs": {
-                "args": {
-                    "hash": "sha256-aZXYPj9KYBiZnljqOLlWJWS396Fg3EhjiQLZmkwCBsY=",
-                    "owner": "EngFlow",
-                    "repo": "reclient-configs",
-                    "rev": "955335c30a752e9ef7bff375baab5e0819b6c00d"
-                },
-                "fetcher": "fetchFromGitHub"
-            },
-            "src/third_party/expat/src": {
-                "args": {
-                    "hash": "sha256-Iwu9+i/0vsPyu6pOWFxjNNblVxMl6bTPW5eWyaju4Mg=",
-                    "rev": "624da0f593bb8d7e146b9f42b06d8e6c80d032a3",
-                    "url": "https://chromium.googlesource.com/external/github.com/libexpat/libexpat.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/farmhash/src": {
-                "args": {
-                    "hash": "sha256-5n58VEUxa/K//jAfZqG4cXyfxrp50ogWDNYcgiXVHdc=",
-                    "rev": "816a4ae622e964763ca0862d9dbd19324a1eaf45",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/farmhash.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/fast_float/src": {
-                "args": {
-                    "hash": "sha256-CG5je117WYyemTe5PTqznDP0bvY5TeXn8Vu1Xh5yUzQ=",
-                    "rev": "cb1d42aaa1e14b09e1452cfdef373d051b8c02a4",
-                    "url": "https://chromium.googlesource.com/external/github.com/fastfloat/fast_float.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/ffmpeg": {
-                "args": {
-                    "hash": "sha256-OXumpRb9XB38dOCJmL3jDcabiJ08wAvydVlJwMgpCoQ=",
-                    "rev": "d10a0f8bf5ddcce572df95105152bc74041cae0c",
-                    "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/flac": {
-                "args": {
-                    "hash": "sha256-gvTFPNOlBfozptaH7lTb9iD/09AmpdT3kCl9ClszjEs=",
-                    "rev": "689da3a7ed50af7448c3f1961d1791c7c1d9c85c",
-                    "url": "https://chromium.googlesource.com/chromium/deps/flac.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/flatbuffers/src": {
-                "args": {
-                    "hash": "sha256-tbc45o0MbMvK5XqRUJt5Eg8BU6+TJqlmwFgQhHq6wRM=",
-                    "rev": "8db59321d9f02cdffa30126654059c7d02f70c32",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/flatbuffers.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/fontconfig/src": {
-                "args": {
-                    "hash": "sha256-W5WIgC6A52kY4fNkbsDEa0o+dfd97Rl5NKfgnIRpI00=",
-                    "rev": "14d466b30a8ab4a9d789977ed94f2c30e7209267",
-                    "url": "https://chromium.googlesource.com/external/fontconfig.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/fp16/src": {
-                "args": {
-                    "hash": "sha256-m2d9bqZoGWzuUPGkd29MsrdscnJRtuIkLIMp3fMmtRY=",
-                    "rev": "0a92994d729ff76a58f692d3028ca1b64b145d91",
-                    "url": "https://chromium.googlesource.com/external/github.com/Maratyszcza/FP16.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/freetype-testing/src": {
-                "args": {
-                    "hash": "sha256-cpzz5QDeAT3UgAZzwW7c0SgLDQsBwy/1Q+5hz2XW4lE=",
-                    "rev": "04fa94191645af39750f5eff0a66c49c5cb2c2cc",
-                    "url": "https://chromium.googlesource.com/external/github.com/freetype/freetype2-testing.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/freetype/src": {
-                "args": {
-                    "hash": "sha256-YxWz3O9see1dktqZnC551V12yU5jcOERTB1Hn1lwUNM=",
-                    "rev": "b1f47850878d232eea372ab167e760ccac4c4e32",
-                    "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/fuzztest/src": {
-                "args": {
-                    "hash": "sha256-AKXKxXqOMUb3APf5r15NmIMyhJ4ZmW5+t7y5XdgdZkw=",
-                    "rev": "44ac6c2594a880edbb9cb1e4e197c2b53d078130",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/fxdiv/src": {
-                "args": {
-                    "hash": "sha256-LjX5kivfHbqCIA5pF9qUvswG1gjOFo3CMpX0VR+Cn38=",
-                    "rev": "63058eff77e11aa15bf531df5dd34395ec3017c8",
-                    "url": "https://chromium.googlesource.com/external/github.com/Maratyszcza/FXdiv.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/gemmlowp/src": {
-                "args": {
-                    "hash": "sha256-O5wD8wxgis0qYMaY+xZ21GBDVQFphMRvInCOswS6inA=",
-                    "rev": "13d57703abca3005d97b19df1f2db731607a7dc2",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/gemmlowp.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/glslang/src": {
-                "args": {
-                    "hash": "sha256-LwspMo771iaV5YeEJWgdb8xi37KMa0rsSdvO3uqMOAI=",
-                    "rev": "0549c7127c2fbab2904892c9d6ff491fa1e93751",
-                    "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/glslang"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/google_benchmark/src": {
-                "args": {
-                    "hash": "sha256-cH8s1gP6kCcojAAfTt5iQCVqiAaSooNk4BdaILujM3w=",
-                    "rev": "761305ec3b33abf30e08d50eb829e19a802581cc",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/benchmark.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/googletest/src": {
-                "args": {
-                    "hash": "sha256-jpXIcz5Uy6fDEvxTq8rTFx/M+0+SQ6TCDaqnp7nMtng=",
-                    "rev": "e235eb34c6c4fed790ccdad4b16394301360dcd4",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/googletest.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/grpc/src": {
-                "args": {
-                    "hash": "sha256-RKGZWtH2JmP2mXN+4ln/nCJvOyzynrYcfrxSY8k1vVg=",
-                    "rev": "a363b6c001139b9c8ffb7cd63f60a72f15349c3b",
-                    "url": "https://chromium.googlesource.com/external/github.com/grpc/grpc.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/harfbuzz-ng/src": {
-                "args": {
-                    "hash": "sha256-isQvwaVdL4cM465A8Gs06VioAu8RvZFrwXDsXhfOoFo=",
-                    "rev": "6d8035a99c279e32183ad063f0de201ef1b2f05c",
-                    "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/highway/src": {
-                "args": {
-                    "hash": "sha256-IS7m1wBwpPBUNhx2GttY1fzvmLIeAp3o2gXfrFpRdvY=",
-                    "rev": "00fe003dac355b979f36157f9407c7c46448958e",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/highway.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/hunspell_dictionaries": {
-                "args": {
-                    "hash": "sha256-67mvpJRFFa9eMfyqFMURlbxOaTJBICnk+gl0b0mEHl8=",
-                    "rev": "41cdffd71c9948f63c7ad36e1fb0ff519aa7a37e",
-                    "url": "https://chromium.googlesource.com/chromium/deps/hunspell_dictionaries.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/icu": {
-                "args": {
-                    "hash": "sha256-Omv4sp9z44eINXtaE0+1TzIU1q2hWviANA79fmkF78U=",
-                    "rev": "c9fb4b3a6fb54aa8c20a03bbcaa0a4a985ffd34b",
-                    "url": "https://chromium.googlesource.com/chromium/deps/icu.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/ink/src": {
-                "args": {
-                    "hash": "sha256-OcGUJxKEjeiYJgknpyb/KvDu76GMaddxWO0Lj7l9Eu8=",
-                    "rev": "bf387a71d7def4b48bf24c8e09d412dfb9962746",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/ink.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/ink_stroke_modeler/src": {
-                "args": {
-                    "hash": "sha256-IQ+n+kHdEq8Q8/qaPGMvgD7cPN3zzaY8dbiokq6r/Vs=",
-                    "rev": "0999e4cf816b42c770d07916698bce943b873048",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/ink-stroke-modeler.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/instrumented_libs": {
-                "args": {
-                    "hash": "sha256-7w5wMcmPcKLS91buxyRdcgaQjbKGFdmrKClvYVO3iko=",
-                    "rev": "3cc43119a29158bcde39d288a8def4b8ec49baf8",
-                    "url": "https://chromium.googlesource.com/chromium/third_party/instrumented_libraries.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/jsoncpp/source": {
-                "args": {
-                    "hash": "sha256-bSLNcoYBz3QCt5VuTR056V9mU2PmBuYBa0W6hFg2m8Q=",
-                    "rev": "42e892d96e47b1f6e29844cc705e148ec4856448",
-                    "url": "https://chromium.googlesource.com/external/github.com/open-source-parsers/jsoncpp.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/leveldatabase/src": {
-                "args": {
-                    "hash": "sha256-ANtMVRZmW6iOjDVn2y15ak2fTagFTTaz1Se6flUHL8w=",
-                    "rev": "4ee78d7ea98330f7d7599c42576ca99e3c6ff9c5",
-                    "url": "https://chromium.googlesource.com/external/leveldb.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libFuzzer/src": {
-                "args": {
-                    "hash": "sha256-Lb+HczYax0T7qvC0/Nwhc5l2szQTUYDouWRMD/Qz7sA=",
-                    "rev": "e31b99917861f891308269c36a32363b120126bb",
-                    "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt/lib/fuzzer.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libaddressinput/src": {
-                "args": {
-                    "hash": "sha256-6h4/DQUBoBtuGfbaTL5Te1Z+24qjTaBuIydcTV18j80=",
-                    "rev": "2610f7b1043d6784ada41392fc9392d1ea09ea07",
-                    "url": "https://chromium.googlesource.com/external/libaddressinput.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libaom/source/libaom": {
-                "args": {
-                    "hash": "sha256-4NOQug0MlWZ18527V3IDuGcxGEJ4b+mZZbdzugWoBgQ=",
-                    "rev": "3990233fc06a35944d6d33797e63931802122a95",
-                    "url": "https://aomedia.googlesource.com/aom.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libc++/src": {
-                "args": {
-                    "hash": "sha256-QxEbtsEKCs2Xgulq7nVWtAeOGkIYFOy/L1ROfXa5u8U=",
-                    "rev": "2e25154d49c29fa9aa42c30ad4a027bd30123434",
-                    "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libc++abi/src": {
-                "args": {
-                    "hash": "sha256-ln/DCNYJXVksbwdDBnxCfc4VwtjQlJXF7ktl/NxLupg=",
-                    "rev": "634228a732a1d9ae1a6d459556e8fc58707cf961",
-                    "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libdrm/src": {
-                "args": {
-                    "hash": "sha256-woSYEDUfcEBpYOYnli13wLMt754A7KnUbmTEcFQdFGw=",
-                    "rev": "ad78bb591d02162d3b90890aa4d0a238b2a37cde",
-                    "url": "https://chromium.googlesource.com/chromiumos/third_party/libdrm.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libgav1/src": {
-                "args": {
-                    "hash": "sha256-BgTfWmbcMvJB1KewJpRcMtbOd2FVuJ+fi1zAXBXfkrg=",
-                    "rev": "c05bf9be660cf170d7c26bd06bb42b3322180e58",
-                    "url": "https://chromium.googlesource.com/codecs/libgav1.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libipp/libipp": {
-                "args": {
-                    "hash": "sha256-gxU92lHLd6uxO8T3QWhZIK0hGy97cki705DV0VimCPY=",
-                    "rev": "2209bb84a8e122dab7c02fe66cc61a7b42873d7f",
-                    "url": "https://chromium.googlesource.com/chromiumos/platform2/libipp.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libjpeg_turbo": {
-                "args": {
-                    "hash": "sha256-qgHXAjCDFxQ+QqJ8pSmI1NUvHvKKTi4MkIe1I/+hUAI=",
-                    "rev": "927aabfcd26897abb9776ecf2a6c38ea5bb52ab6",
-                    "url": "https://chromium.googlesource.com/chromium/deps/libjpeg_turbo.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/liblouis/src": {
-                "args": {
-                    "hash": "sha256-EI/uaHXe0NlqdEw764q0SjerThYEVLRogUlmrsZwXnY=",
-                    "rev": "9700847afb92cb35969bdfcbbfbbb74b9c7b3376",
-                    "url": "https://chromium.googlesource.com/external/liblouis-github.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libphonenumber/dist": {
-                "args": {
-                    "hash": "sha256-ZbuDrZEUVp/ekjUP8WO/FsjAomRjeDBptT4nQZvTVi4=",
-                    "rev": "9d46308f313f2bf8dbce1dfd4f364633ca869ca7",
-                    "url": "https://chromium.googlesource.com/external/libphonenumber.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libprotobuf-mutator/src": {
-                "args": {
-                    "hash": "sha256-ZyPweW+V5foxFQwjjMLkaRUo+FNV+kEDGIH/4oRV614=",
-                    "rev": "a304ec48dcf15d942607032151f7e9ee504b5dcf",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/libprotobuf-mutator.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libsrtp": {
-                "args": {
-                    "hash": "sha256-bkG1+ss+1a2rCHGwZjhvf5UaNVbPPZJt9HZSIPBKGwM=",
-                    "rev": "a52756acb1c5e133089c798736dd171567df11f5",
-                    "url": "https://chromium.googlesource.com/chromium/deps/libsrtp.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libsync/src": {
-                "args": {
-                    "hash": "sha256-Mkl6C1LxF3RYLwYbxiSfoQPt8QKFwQWj/Ati2sNJ32E=",
-                    "rev": "f4f4387b6bf2387efbcfd1453af4892e8982faf6",
-                    "url": "https://chromium.googlesource.com/aosp/platform/system/core/libsync.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libunwind/src": {
-                "args": {
-                    "hash": "sha256-JazjgI+ch9RgnsDgu6p4cT4UmCBor4x4sRi1ClLISAY=",
-                    "rev": "e55d8cf51c6db1fdd4bb56c158945ec59772c8ee",
-                    "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libva-fake-driver/src": {
-                "args": {
-                    "hash": "sha256-em/8rNqwv6szlxyji7mnYr3nObSW/x3OzEEnkiLuqpI=",
-                    "rev": "a9bcab9cd6b15d4e3634ca44d5e5f7652c612194",
-                    "url": "https://chromium.googlesource.com/chromiumos/platform/libva-fake-driver.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libvpx/source/libvpx": {
-                "args": {
-                    "hash": "sha256-2FgBb0HzgMihGsWbEtQqyN2EXZs/y5+ToWL1ZXG35W0=",
-                    "rev": "7b3fa8114cf8ef23cbf91e50c368c1ca768d95d5",
-                    "url": "https://chromium.googlesource.com/webm/libvpx.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libwebm/source": {
-                "args": {
-                    "hash": "sha256-yQ5MIUKtuWQM5SfD74vPeqGEdLJNss2/RBUZfq5701A=",
-                    "rev": "b4f01ea3ed6fd00923caa383bb2cf6f7a0b7f633",
-                    "url": "https://chromium.googlesource.com/webm/libwebm.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libwebp/src": {
-                "args": {
-                    "hash": "sha256-0sKGhXr6Rrpq0eoitAdLQ4l4fgNOzMWIEICrPyzwNz4=",
-                    "rev": "2af6c034ac871c967e04c8c9f8bf2dbc2e271b18",
-                    "url": "https://chromium.googlesource.com/webm/libwebp.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libyuv": {
-                "args": {
-                    "hash": "sha256-E5ePVHrEXMM8mS1qaUwPTqYO0BdP7TYuUhfX+BCiq/0=",
-                    "rev": "5a9a6ea936085310f3b9fbd4a774868e6a984ec4",
-                    "url": "https://chromium.googlesource.com/libyuv/libyuv.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/llvm-libc/src": {
-                "args": {
-                    "hash": "sha256-bF4hV9fY0GLYAHUnxSXkCxdZLMKR3wYWaqYJaM9aQiE=",
-                    "rev": "6d0c8ee02e2fd44e69ac30e721e13be463035ee5",
-                    "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/lss": {
-                "args": {
-                    "hash": "sha256-hE8uZf9Fst66qJkoVYChiB8G41ie+k9M4X0W+5JUSdw=",
-                    "rev": "ce877209e11aa69dcfffbd53ef90ea1d07136521",
-                    "url": "https://chromium.googlesource.com/linux-syscall-support.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/material_color_utilities/src": {
-                "args": {
-                    "hash": "sha256-Y85XU+z9W6tvmDNHJ/dXQnUKXvvDkO3nH/kUJRLqbc4=",
-                    "rev": "13434b50dcb64a482cc91191f8cf6151d90f5465",
-                    "url": "https://chromium.googlesource.com/external/github.com/material-foundation/material-color-utilities.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/minigbm/src": {
-                "args": {
-                    "hash": "sha256-9HwvjTETerbQ7YKXH9kUB2eWa8PxGWMAJfx1jAluhrs=",
-                    "rev": "3018207f4d89395cc271278fb9a6558b660885f5",
-                    "url": "https://chromium.googlesource.com/chromiumos/platform/minigbm.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/nan": {
-                "args": {
-                    "hash": "sha256-cwti+BWmF/l/dqa/cN0C587EK4WwRWcWy6gjFVkaMTg=",
-                    "owner": "nodejs",
-                    "repo": "nan",
-                    "rev": "e14bdcd1f72d62bca1d541b66da43130384ec213"
-                },
-                "fetcher": "fetchFromGitHub"
-            },
-            "src/third_party/nasm": {
-                "args": {
-                    "hash": "sha256-SiRXHsUlWXtH6dbDjDjqNAm105ibEB3jOfNtQAM4CaY=",
-                    "rev": "f477acb1049f5e043904b87b825c5915084a9a29",
-                    "url": "https://chromium.googlesource.com/chromium/deps/nasm.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/nearby/src": {
-                "args": {
-                    "hash": "sha256-d1D9/6d7a1+27nD8VijhzRMglE2PqvAMK8+GbMeesSQ=",
-                    "rev": "97690c6996f683a6f3e07d75fc4557958c55ac7b",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/nearby-connections.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/neon_2_sse/src": {
-                "args": {
-                    "hash": "sha256-AkDAHOPO5NdXXk0hETS5D67mzw0RVXwPDDKqM0XXo5g=",
-                    "rev": "eb8b80b28f956275e291ea04a7beb5ed8289e872",
-                    "url": "https://chromium.googlesource.com/external/github.com/intel/ARM_NEON_2_x86_SSE.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/openh264/src": {
-                "args": {
-                    "hash": "sha256-lZlZjX8GCJOc77VJ9i1fSWn63pfVOEcwwlzh0UpIgy4=",
-                    "rev": "33f7f48613258446decb33b3575fc0a3c9ed14e3",
-                    "url": "https://chromium.googlesource.com/external/github.com/cisco/openh264"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/openscreen/src": {
-                "args": {
-                    "hash": "sha256-KGVFyGp7ItKeapub3Bd+htXH/gMaaBd+k8iC7hLtvl0=",
-                    "rev": "38d1445b41d1eb597fcd100688dbaff98aa072ed",
-                    "url": "https://chromium.googlesource.com/openscreen"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/openscreen/src/buildtools": {
-                "args": {
-                    "hash": "sha256-Dz7wMYQHVR7sjCGaQe2nxIxZsAxsK6GGDNpDvypPefo=",
-                    "rev": "56013b77b6c0a650d00bde40e750e7c3b7c6bc3d",
-                    "url": "https://chromium.googlesource.com/chromium/src/buildtools"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/openscreen/src/third_party/tinycbor/src": {
-                "args": {
-                    "hash": "sha256-fMKBFUSKmODQyg4hKIa1hwnEKIV6WBbY1Gb8DOSnaHA=",
-                    "rev": "d393c16f3eb30d0c47e6f9d92db62272f0ec4dc7",
-                    "url": "https://chromium.googlesource.com/external/github.com/intel/tinycbor.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/ots/src": {
-                "args": {
-                    "hash": "sha256-kiUXrXsaGOzPkKh0dVmU1I13WHt0Stzj7QLMqHN9FbU=",
-                    "rev": "46bea9879127d0ff1c6601b078e2ce98e83fcd33",
-                    "url": "https://chromium.googlesource.com/external/github.com/khaledhosny/ots.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/pdfium": {
-                "args": {
-                    "hash": "sha256-/u+HYjmxSIX2GlriEWYZQJ8TDFNfzSufATGq1j9zx9w=",
-                    "rev": "12f7715a6390050c5cffb7e4c9b2be1c2f2956d0",
-                    "url": "https://pdfium.googlesource.com/pdfium.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/perfetto": {
-                "args": {
-                    "hash": "sha256-bjgSwq4LPz9qN9rVqIJUTHetRguCx67Uq5oe1ksPqGE=",
-                    "rev": "0d78d85c2bfb993ab8dd9a85b6fee6caa6a0f357",
-                    "url": "https://android.googlesource.com/platform/external/perfetto.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/protobuf-javascript/src": {
-                "args": {
-                    "hash": "sha256-TmP6xftUVTD7yML7UEM/DB8bcsL5RFlKPyCpcboD86U=",
-                    "rev": "e34549db516f8712f678fcd4bc411613b5cc5295",
-                    "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/pthreadpool/src": {
-                "args": {
-                    "hash": "sha256-cFRELaRtWspZaqtmdKmVPqM7HVskHlFMAny+Zv/Zflw=",
-                    "rev": "e1469417238e13eebaa001779fa031ed25c59def",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/pthreadpool.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/pyelftools": {
-                "args": {
-                    "hash": "sha256-I/7p3IEvfP/gkes4kx18PvWwhAKilQKb67GXoW4zFB4=",
-                    "rev": "19b3e610c86fcadb837d252c794cb5e8008826ae",
-                    "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/pywebsocket3/src": {
-                "args": {
-                    "hash": "sha256-WEqqu2/7fLqcf/2/IcD7/FewRSZ6jTgVlVBvnihthYQ=",
-                    "rev": "50602a14f1b6da17e0b619833a13addc6ea78bc2",
-                    "url": "https://chromium.googlesource.com/external/github.com/GoogleChromeLabs/pywebsocket3.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/quic_trace/src": {
-                "args": {
-                    "hash": "sha256-N1uFoNd3mz/LH1z06581Ds7BUyc67SNXUPzqomYREr8=",
-                    "rev": "413da873d93a03d3662f24b881ea459a79f9c589",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/quic-trace.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/re2/src": {
-                "args": {
-                    "hash": "sha256-IeANwJlJl45yf8iu/AZNDoiyIvTCZIeK1b74sdCfAIc=",
-                    "rev": "6dcd83d60f7944926bfd308cc13979fc53dd69ca",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/re2.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/ruy/src": {
-                "args": {
-                    "hash": "sha256-O3JEtXchCdIHdGvjD6kGMJzj7TWVczQCW2YUHK3cABA=",
-                    "rev": "83fd40d730feb0804fafbc2d8814bcc19a17b2e5",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/ruy.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/search_engines_data/resources": {
-                "args": {
-                    "hash": "sha256-8RY3AU2V4iZKEmVwT7Z1Q3QlcTXDIdeyYwnQoyJcAUY=",
-                    "rev": "6dc3b54b420e6e03a34ee7259fcd2b1978fac5f3",
-                    "url": "https://chromium.googlesource.com/external/search_engines_data.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/securemessage/src": {
-                "args": {
-                    "hash": "sha256-GS4ccnuiqxMs/LVYAtvSlVAYFp4a5GoZsxcriTX3k78=",
-                    "rev": "fa07beb12babc3b25e0c5b1f38c16aa8cb6b8f84",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/securemessage.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/skia": {
-                "args": {
-                    "hash": "sha256-QIWB5fVCo9r+AKE8MeeKLEpcWYG6lCfBzxNDR2yD3kg=",
-                    "rev": "b467149a72ca10a2e46345a1e5cd031ce8637023",
-                    "url": "https://skia.googlesource.com/skia.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/smhasher/src": {
-                "args": {
-                    "hash": "sha256-OgZQwkQcVgRMf62ROGuY+3zQhBoWuUSP4naTmSKdq8s=",
-                    "rev": "0ff96f7835817a27d0487325b6c16033e2992eb5",
-                    "url": "https://chromium.googlesource.com/external/smhasher.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/snappy/src": {
-                "args": {
-                    "hash": "sha256-jUwnjbaqXz7fgI2TPRK7SlUPQUVzcpjp4ZlFbEzwA+o=",
-                    "rev": "32ded457c0b1fe78ceb8397632c416568d6714a0",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/snappy.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/speedometer/main": {
-                "args": {
-                    "hash": "sha256-lCwGk4Q+OXwO8vOlOQrkgygYqLrwpku/PkR03oEdX3Y=",
-                    "rev": "d6b5ffea959ad31e231c203d7446bf8b39e987ce",
-                    "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/speedometer/v2.0": {
-                "args": {
-                    "hash": "sha256-p7WUS8gZUaS+LOm7pNmRkwgxjx+V8R6yy7bbaEHaIs4=",
-                    "rev": "732af0dfe867f8815e662ac637357e55f285dbbb",
-                    "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/speedometer/v2.1": {
-                "args": {
-                    "hash": "sha256-0z5tZlz32fYh9I1ALqfLm2WWO8HiRBwt0hcmgKQhaeM=",
-                    "rev": "8bf7946e39e47c875c00767177197aea5727e84a",
-                    "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/speedometer/v3.0": {
-                "args": {
-                    "hash": "sha256-qMQ4naX+4uUu3vtzzinjkhxX9/dNoTwj6vWCu4FdQmU=",
-                    "rev": "8d67f28d0281ac4330f283495b7f48286654ad7d",
-                    "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/spirv-cross/src": {
-                "args": {
-                    "hash": "sha256-H43M9DXfEuyKuvo6rjb5k0KEbYOSFodbPJh8ZKY4PQg=",
-                    "rev": "b8fcf307f1f347089e3c46eb4451d27f32ebc8d3",
-                    "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Cross"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/spirv-headers/src": {
-                "args": {
-                    "hash": "sha256-/p7kBW7mwpG/Uz0goMM7L3zjpOMBzGiuN+0ZBEOpORo=",
-                    "rev": "e7294a8ebed84f8c5bd3686c68dbe12a4e65b644",
-                    "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Headers"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/spirv-tools/src": {
-                "args": {
-                    "hash": "sha256-SJcxmKdzOjg6lOJk/3m8qo7puvtci1YEU6dXKjthx0Q=",
-                    "rev": "ce37fd67f83cd1e8793b988d2e4126bbf72b19dd",
-                    "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Tools"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/sqlite/src": {
-                "args": {
-                    "hash": "sha256-ltl3OTk/wZPSj3yYthNlKd3mBxef6l5uW6UYTwebNek=",
-                    "rev": "567495a62a62dc013888500526e82837d727fe01",
-                    "url": "https://chromium.googlesource.com/chromium/deps/sqlite.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/squirrel.mac": {
-                "args": {
-                    "hash": "sha256-4GfKQg0u3c9GI+jl3ixESNqWXQJKRMi+00QT0s2Shqw=",
-                    "owner": "Squirrel",
-                    "repo": "Squirrel.Mac",
-                    "rev": "0e5d146ba13101a1302d59ea6e6e0b3cace4ae38"
-                },
-                "fetcher": "fetchFromGitHub"
-            },
-            "src/third_party/squirrel.mac/vendor/Mantle": {
-                "args": {
-                    "hash": "sha256-ogFkMJybf2Ue606ojXJu6Gy5aXSi1bSKm60qcTAIaPk=",
-                    "owner": "Mantle",
-                    "repo": "Mantle",
-                    "rev": "78d3966b3c331292ea29ec38661b25df0a245948"
-                },
-                "fetcher": "fetchFromGitHub"
-            },
-            "src/third_party/squirrel.mac/vendor/ReactiveObjC": {
-                "args": {
-                    "hash": "sha256-/MCqC1oFe3N9TsmfVLgl+deR6qHU6ZFQQjudb9zB5Mo=",
-                    "owner": "ReactiveCocoa",
-                    "repo": "ReactiveObjC",
-                    "rev": "74ab5baccc6f7202c8ac69a8d1e152c29dc1ea76"
-                },
-                "fetcher": "fetchFromGitHub"
-            },
-            "src/third_party/swiftshader": {
-                "args": {
-                    "hash": "sha256-PSkIU8zC+4AVcYu0vaYo6I1SSykrHgcgGVMBJanux8o=",
-                    "rev": "86cf34f50cbe5a9f35da7eedad0f4d4127fb8342",
-                    "url": "https://swiftshader.googlesource.com/SwiftShader.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/text-fragments-polyfill/src": {
-                "args": {
-                    "hash": "sha256-4rW2u1cQAF4iPWHAt1FvVXIpz2pmI901rEPks/w/iFA=",
-                    "rev": "c036420683f672d685e27415de0a5f5e85bdc23f",
-                    "url": "https://chromium.googlesource.com/external/github.com/GoogleChromeLabs/text-fragments-polyfill.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/tflite/src": {
-                "args": {
-                    "hash": "sha256-qXHENS/6NwHAr1/16eb079XzmwAnpLtVZuva8uGCf+8=",
-                    "rev": "51c6eed226abcfeeb46864e837d01563cc5b907b",
-                    "url": "https://chromium.googlesource.com/external/github.com/tensorflow/tensorflow.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/ukey2/src": {
-                "args": {
-                    "hash": "sha256-aaLs6ZS+CdBlCJ6ZhsmdAPFxiBIij6oufsDcNeRSV1E=",
-                    "rev": "0275885d8e6038c39b8a8ca55e75d1d4d1727f47",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/ukey2.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/vulkan-deps": {
-                "args": {
-                    "hash": "sha256-9ebWETg/fsS4MYZg74XHs/Nz3nX6BXBNVRN2PmyWXWM=",
-                    "rev": "2e4b45a53a0e2e66bcb6540ae384c53a517218d0",
-                    "url": "https://chromium.googlesource.com/vulkan-deps"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/vulkan-headers/src": {
-                "args": {
-                    "hash": "sha256-twJJVBfnZbH/8Wn273h45K3BOnlAicqL2zJl6OfLm2E=",
-                    "rev": "39f924b810e561fd86b2558b6711ca68d4363f68",
-                    "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Headers"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/vulkan-loader/src": {
-                "args": {
-                    "hash": "sha256-QqFC3Iyhw9Pq6TwBHxa0Ss7SW0bHo0Uz5N18oxl2ROg=",
-                    "rev": "0508dee4ff864f5034ae6b7f68d34cb2822b827d",
-                    "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Loader"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/vulkan-tools/src": {
-                "args": {
-                    "hash": "sha256-nIzrishMMxWzOuD3aX8B6Iuq2kPsUF0Uuvz7GijTulY=",
-                    "rev": "c52931f012cb7b48e42bbf2050a7fb2183b76406",
-                    "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Tools"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/vulkan-utility-libraries/src": {
-                "args": {
-                    "hash": "sha256-zI3y5aoP4QcYp677Oxj5Ef7lJyJwOMdGsaRBe+X9vpI=",
-                    "rev": "fe7a09b13899c5c77d956fa310286f7a7eb2c4ed",
-                    "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Utility-Libraries"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/vulkan-validation-layers/src": {
-                "args": {
-                    "hash": "sha256-foa5hzqf1hPwOj3k57CloCe/j0qXW3zCQ4mwCT4epF4=",
-                    "rev": "a30aa23cfaff4f28f039c025c159128a6c336a7e",
-                    "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-ValidationLayers"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/vulkan_memory_allocator": {
-                "args": {
-                    "hash": "sha256-YzxHZagz/M8Y54UnI4h1wu5jSTuaOgv0ifC9d3fJZlQ=",
-                    "rev": "56300b29fbfcc693ee6609ddad3fdd5b7a449a21",
-                    "url": "https://chromium.googlesource.com/external/github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/wasm_tts_engine/src": {
-                "args": {
-                    "hash": "sha256-bV+1YFEtCyTeZujsZtZiexT/aUTN3MaVerR2UdkUPBY=",
-                    "rev": "7a91dbfddd93afa096a69fb7d292e22d4afecad2",
-                    "url": "https://chromium.googlesource.com/chromium/wasm-tts-engine"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/wayland-protocols/gtk": {
-                "args": {
-                    "hash": "sha256-75XNnLkF5Lt1LMRGT+T61k0/mLa3kkynfN+QWvZ0LiQ=",
-                    "rev": "40ebed3a03aef096addc0af09fec4ec529d882a0",
-                    "url": "https://chromium.googlesource.com/external/github.com/GNOME/gtk.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/wayland-protocols/kde": {
-                "args": {
-                    "hash": "sha256-Dmcp/2ms/k7NxPPmPkp0YNfM9z2Es1ZO0uX10bc7N2Y=",
-                    "rev": "0b07950714b3a36c9b9f71fc025fc7783e82926e",
-                    "url": "https://chromium.googlesource.com/external/github.com/KDE/plasma-wayland-protocols.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/wayland-protocols/src": {
-                "args": {
-                    "hash": "sha256-o/adWEXYSqWib6KoK7XMCWbojapcS4O/CEPxv7iFCw8=",
-                    "rev": "7d5a3a8b494ae44cd9651f9505e88a250082765e",
-                    "url": "https://chromium.googlesource.com/external/anongit.freedesktop.org/git/wayland/wayland-protocols.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/wayland/src": {
-                "args": {
-                    "hash": "sha256-oK0Z8xO2ILuySGZS0m37ZF0MOyle2l8AXb0/6wai0/w=",
-                    "rev": "a156431ea66fe67d69c9fbba8a8ad34dabbab81c",
-                    "url": "https://chromium.googlesource.com/external/anongit.freedesktop.org/git/wayland/wayland.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/webdriver/pylib": {
-                "args": {
-                    "hash": "sha256-WIqWXIKVgElgg8P8laLAlUrgwodGdeVcwohZxnPKedw=",
-                    "rev": "fc5e7e70c098bfb189a9a74746809ad3c5c34e04",
-                    "url": "https://chromium.googlesource.com/external/github.com/SeleniumHQ/selenium/py.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/webgl/src": {
-                "args": {
-                    "hash": "sha256-32r3BdmsNA89mo0k+vK1G3718AOjseE7cJlopZ/0pSw=",
-                    "rev": "450cceb587613ac1469c5a131fac15935c99e0e7",
-                    "url": "https://chromium.googlesource.com/external/khronosgroup/webgl.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/webgpu-cts/src": {
-                "args": {
-                    "hash": "sha256-tjY5ADd5tMFsYHk6xT+TXwsDYV5eI2oOywmyTjjAxYc=",
-                    "rev": "fb2b951ac3c23e453335edf35c9b3bad431d9009",
-                    "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/webpagereplay": {
-                "args": {
-                    "hash": "sha256-KAkkFVxEfQxbSjD+55LO4UZYWWwmGK6B9ENFSPljNu0=",
-                    "rev": "d812e180206934eb3b7ae411d82d61bc21c22f70",
-                    "url": "https://chromium.googlesource.com/webpagereplay.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/webrtc": {
-                "args": {
-                    "hash": "sha256-IsjTrEnxIqINYYjWJmDp7rlubl5dJ2YMpJf/DrG/mRM=",
-                    "rev": "8d78f5de6c27b2c793039989ea381f1428fb0100",
-                    "url": "https://webrtc.googlesource.com/src.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/weston/src": {
-                "args": {
-                    "hash": "sha256-y2srFaPUOoB2umzpo4+hFfhNlqXM2AoMGOpUy/ZSacg=",
-                    "rev": "ccf29cb237c3ed09c5f370f35239c93d07abfdd7",
-                    "url": "https://chromium.googlesource.com/external/anongit.freedesktop.org/git/wayland/weston.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/wuffs/src": {
-                "args": {
-                    "hash": "sha256-373d2F/STcgCHEq+PO+SCHrKVOo6uO1rqqwRN5eeBCw=",
-                    "rev": "e3f919ccfe3ef542cfc983a82146070258fb57f8",
-                    "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/xdg-utils": {
-                "args": {
-                    "hash": "sha256-WuQ9uDq+QD17Y20ACFGres4nbkeOiTE2y+tY1avAT5U=",
-                    "rev": "cb54d9db2e535ee4ef13cc91b65a1e2741a94a44",
-                    "url": "https://chromium.googlesource.com/chromium/deps/xdg-utils.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/xnnpack/src": {
-                "args": {
-                    "hash": "sha256-eb9B9lXPB2GiC4qehB/HOU36W1e9RZ0N2oEbIifyrHE=",
-                    "rev": "0824e2965f6edc2297e55c8dff5a8ac4cb12aaad",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/XNNPACK.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/zstd/src": {
-                "args": {
-                    "hash": "sha256-UJsuaSzR4V8alLdtxzpla1v9WYHPKPp13YrgA4Y6/yA=",
-                    "rev": "ea0aa030cdf31f7897c5bfc153f0d36e92768095",
-                    "url": "https://chromium.googlesource.com/external/github.com/facebook/zstd.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/v8": {
-                "args": {
-                    "hash": "sha256-wpz9W/ZurpCT/dGIHGpmdkI3dsXbP8TPNeee2w9zBU8=",
-                    "rev": "4f282ae4acae85cdcc8c167cbc296a86d24c1cf6",
-                    "url": "https://chromium.googlesource.com/v8/v8.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            }
-        },
-        "electron_yarn_hash": "0kiknh04rr87yzd5k13ghvk36kb7a4pcfwwinpqcsdvgka62kf1c",
-        "modules": "133",
-        "node": "22.16.0",
-        "version": "35.7.5"
-    },
     "36": {
         "chrome": "136.0.7103.177",
         "chromium": {
diff --git a/pkgs/development/tools/kustomize/4.nix b/pkgs/development/tools/kustomize/4.nix
index e7f9c4e978fe..3cb015099741 100644
--- a/pkgs/development/tools/kustomize/4.nix
+++ b/pkgs/development/tools/kustomize/4.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -35,7 +36,7 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd kustomize \
       --bash <($out/bin/kustomize completion bash) \
       --fish <($out/bin/kustomize completion fish) \
diff --git a/pkgs/development/tools/kustomize/default.nix b/pkgs/development/tools/kustomize/default.nix
index 5b71777928ef..d401c7f9f833 100644
--- a/pkgs/development/tools/kustomize/default.nix
+++ b/pkgs/development/tools/kustomize/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -35,7 +36,7 @@ buildGoModule (finalAttrs: {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd kustomize \
       --bash <($out/bin/kustomize completion bash) \
       --fish <($out/bin/kustomize completion fish) \
diff --git a/pkgs/development/tools/language-servers/nixd/default.nix b/pkgs/development/tools/language-servers/nixd/default.nix
index 0813dcc24fe9..ceb3f269c904 100644
--- a/pkgs/development/tools/language-servers/nixd/default.nix
+++ b/pkgs/development/tools/language-servers/nixd/default.nix
@@ -20,15 +20,15 @@
 }:
 
 let
-  nix = nixVersions.nix_2_28;
+  nixComponents = nixVersions.nixComponents_2_30;
   common = rec {
-    version = "2.6.4";
+    version = "2.7.0";
 
     src = fetchFromGitHub {
       owner = "nix-community";
       repo = "nixd";
       tag = version;
-      hash = "sha256-K7S626SPzlNCmRhntSKhGP1iyHJXBZEeHliX4iEwbKk=";
+      hash = "sha256-VPUX/68ysFUr1S8JW9I1rU5UcRoyZiCjL+9u2owrs6w=";
     };
 
     nativeBuildInputs = [
@@ -102,7 +102,10 @@ in
       ];
 
       buildInputs = [
-        nix
+        nixComponents.nix-main
+        nixComponents.nix-expr
+        nixComponents.nix-cmd
+        nixComponents.nix-flake
         gtest
         boost
       ];
@@ -126,7 +129,10 @@ in
       sourceRoot = "${common.src.name}/nixd";
 
       buildInputs = [
-        nix
+        nixComponents.nix-main
+        nixComponents.nix-expr
+        nixComponents.nix-cmd
+        nixComponents.nix-flake
         nixf
         nixt
         llvmPackages.llvm
diff --git a/pkgs/os-specific/darwin/xcode/default.nix b/pkgs/os-specific/darwin/xcode/default.nix
index 41f64795bcbb..06b2ebd39234 100644
--- a/pkgs/os-specific/darwin/xcode/default.nix
+++ b/pkgs/os-specific/darwin/xcode/default.nix
@@ -6,9 +6,10 @@
 
 let
   requireXcode =
-    version: sha256:
+    release: sha256:
     let
-      xip = "Xcode_" + version + ".xip";
+      xip = "Xcode_" + release + ".xip";
+      version = lib.removeSuffix "_Universal" (lib.removeSuffix "_Apple_silicon" release);
 
       unxip =
         if stdenv.buildPlatform.isDarwin then
@@ -42,8 +43,9 @@ let
         '';
       };
       meta = with lib; {
-        homepage = "https://developer.apple.com/downloads/";
-        description = "Apple's XCode SDK";
+        homepage = "https://developer.apple.com/xcode/";
+        description = "Apple's Xcode developer tools";
+        maintainers = with lib.maintainers; [ DimitarNestorov ];
         license = licenses.unfree;
         platforms = platforms.darwin ++ platforms.linux;
         hydraPlatforms = [ ];
@@ -105,6 +107,8 @@ lib.makeExtensible (self: {
   xcode_16_2 = requireXcode "16.2" "sha256-wQjNuFZu/cN82mEEQbC1MaQt39jLLDsntsbnDidJFEs=";
   xcode_16_3 = requireXcode "16.3" "sha256-hkIlRYUc1SD2lBwhRtqBGJapUIa+tdOyPKG19Su5OUU=";
   xcode_16_4 = requireXcode "16.4" "sha256-voCEZlKrp9NYGmXAsf1FHxO69EgWZHDIWtQZ2qEzElA=";
+  xcode_26 = requireXcode "26_Universal" "sha256-p4INqf85CSIzd7xHRCS9tCigQkOQPKnS/+D5nue3PsY=";
+  xcode_26_Apple_silicon = requireXcode "26_Apple_silicon" "sha256-dlfZ2sM6a9pUPdukoMoqvQAj7EEUyj0a/VkXKwkkFT8=";
   xcode =
     self."xcode_${
       lib.replaceStrings [ "." ] [ "_" ] (
diff --git a/pkgs/os-specific/linux/sssd/default.nix b/pkgs/os-specific/linux/sssd/default.nix
index d3786baebb13..04118ecc168f 100644
--- a/pkgs/os-specific/linux/sssd/default.nix
+++ b/pkgs/os-specific/linux/sssd/default.nix
@@ -29,6 +29,7 @@
   openldap,
   pcre2,
   libkrb5,
+  libcap,
   cifs-utils,
   glib,
   keyutils,
@@ -51,6 +52,7 @@
   docbook_xsl,
   docbook_xml_dtd_45,
   testers,
+  versionCheckHook,
   nix-update-script,
   nixosTests,
   withSudo ? false,
@@ -61,13 +63,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "sssd";
-  version = "2.9.7";
+  version = "2.11.1";
 
   src = fetchFromGitHub {
     owner = "SSSD";
     repo = "sssd";
     tag = finalAttrs.version;
-    hash = "sha256-29KTvwm9ei1Z7yTSYmzcZtZMVvZpFWIlcLMlvRyWp/w=";
+    hash = "sha256-JN4GVx5rBfNBLaMpLcKgyd+CyNDafz85BXUcfg5kDXQ=";
   };
 
   postPatch = ''
@@ -93,6 +95,7 @@ stdenv.mkDerivation (finalAttrs: {
       --with-pid-path=/run
       --with-python3-bindings
       --with-syslog=journald
+      --with-initscript=systemd
       --without-selinux
       --without-semanage
       --with-xml-catalog-path=''${SGML_CATALOG_FILES%%:*}
@@ -108,12 +111,14 @@ stdenv.mkDerivation (finalAttrs: {
   # Disable parallel install due to missing depends:
   #   libtool:   error: error: relink '_py3sss.la' with the above command before installing i
   enableParallelInstalling = false;
+
   nativeBuildInputs = [
     autoreconfHook
     makeWrapper
     pkg-config
     doxygen
   ];
+
   buildInputs = [
     augeas
     dnsutils
@@ -121,6 +126,7 @@ stdenv.mkDerivation (finalAttrs: {
     curl
     cyrus_sasl
     ding-libs
+    libcap
     libnl
     libunistring
     nss
@@ -129,6 +135,7 @@ stdenv.mkDerivation (finalAttrs: {
     p11-kit
     (python3.withPackages (
       p: with p; [
+        setuptools
         distutils
         python-ldap
       ]
@@ -187,31 +194,37 @@ stdenv.mkDerivation (finalAttrs: {
     rm -f "$out"/modules/ldb/memberof.la
     find "$out" -depth -type d -exec rmdir --ignore-fail-on-non-empty {} \;
   '';
+
   postFixup = ''
     for f in $out/bin/sss{ctl,_cache,_debuglevel,_override,_seed}; do
       wrapProgram $f --prefix LDB_MODULES_PATH : $out/modules/ldb
     done
   '';
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
   passthru = {
     tests = {
       inherit (nixosTests) sssd sssd-ldap;
       pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
-      version = testers.testVersion {
-        package = finalAttrs.finalPackage;
-        command = "sssd --version";
-      };
     };
     updateScript = nix-update-script { };
   };
 
-  meta = with lib; {
+  meta = {
     description = "System Security Services Daemon";
     homepage = "https://sssd.io/";
     changelog = "https://sssd.io/release-notes/sssd-${finalAttrs.version}.html";
-    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ illustris ];
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      illustris
+      liberodark
+    ];
     pkgConfigModules = [
       "ipa_hbac"
       "sss_certmap"
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index a0ea402e5382..0bf921dd0853 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -97,7 +97,6 @@
   # compiles systemd-boot, assumes EFI is available.
   withBootloader ?
     withEfi
-    && !stdenv.hostPlatform.isMusl
     # "Unknown 64-bit data model"
     && !stdenv.hostPlatform.isRiscV32,
   # adds bzip2, lz4, xz and zstd
@@ -297,6 +296,10 @@ stdenv.mkDerivation (finalAttrs: {
         hash = "sha256-Uaewo3jPrZGJttlLcqO6cCj1w3IGZmvbur4+TBdIPxc=";
         excludes = [ "src/udev/udevd.c" ];
       })
+      (fetchpatch {
+        url = "https://gitlab.postmarketos.org/postmarketOS/systemd/-/commit/5760be33bd26d7e7c66a7294c5f6fd6c7044683f.patch";
+        hash = "sha256-Om+OhGyZJfZNpbtMInm3vGagLbbtOY71fDMZXj6pbPY=";
+      })
     ]
   );
 
diff --git a/pkgs/servers/headscale/default.nix b/pkgs/servers/headscale/default.nix
index 8d542562e43a..a4da9dbc82ac 100644
--- a/pkgs/servers/headscale/default.nix
+++ b/pkgs/servers/headscale/default.nix
@@ -43,7 +43,7 @@ buildGoModule rec {
     export NIX_REDIRECTS=/etc/protocols=${iana-etc}/etc/protocols:/etc/services=${iana-etc}/etc/services
   '';
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd headscale \
       --bash <($out/bin/headscale completion bash) \
       --fish <($out/bin/headscale completion fish) \
diff --git a/pkgs/servers/home-assistant/custom-components/xiaomi_miot/package.nix b/pkgs/servers/home-assistant/custom-components/xiaomi_miot/package.nix
index ef1c4afb291d..a001489108ff 100644
--- a/pkgs/servers/home-assistant/custom-components/xiaomi_miot/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/xiaomi_miot/package.nix
@@ -11,13 +11,13 @@
 buildHomeAssistantComponent rec {
   owner = "al-one";
   domain = "xiaomi_miot";
-  version = "1.0.20";
+  version = "1.0.21";
 
   src = fetchFromGitHub {
     owner = "al-one";
     repo = "hass-xiaomi-miot";
     rev = "v${version}";
-    hash = "sha256-qn//le4zaS7URP4pWofwsA4FbB20DK7iRRUn8NWzwAI=";
+    hash = "sha256-P/IcWaBv+yj9bMeSm/vDtht0S7YQPOb0+/rWR7DLiJU=";
   };
 
   dependencies = [
diff --git a/pkgs/servers/sql/postgresql/ext/pg_squeeze.nix b/pkgs/servers/sql/postgresql/ext/pg_squeeze.nix
index c05a00168bdf..7f7d55fc5bc5 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_squeeze.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_squeeze.nix
@@ -9,13 +9,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "pg_squeeze";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "cybertec-postgresql";
     repo = "pg_squeeze";
     tag = "REL${lib.replaceString "." "_" finalAttrs.version}";
-    hash = "sha256-RrG7qeX0NQ4cq6N+9uVfalNW+HfiSt4wcjeZjInnfgE=";
+    hash = "sha256-KbCS3kg2MoxKHl+35UOFCSF4kPPsIMeO7AfwfHZYZVg=";
   };
 
   passthru.updateScript = nix-update-script {
diff --git a/pkgs/tools/admin/pulumi-bin/default.nix b/pkgs/tools/admin/pulumi-bin/default.nix
index d36e3afaa1d7..2e5376442c88 100644
--- a/pkgs/tools/admin/pulumi-bin/default.nix
+++ b/pkgs/tools/admin/pulumi-bin/default.nix
@@ -26,7 +26,7 @@ stdenv.mkDerivation {
   + lib.optionalString stdenv.hostPlatform.isLinux ''
     wrapProgram $out/bin/pulumi --set LD_LIBRARY_PATH "${lib.getLib stdenv.cc.cc}/lib"
   ''
-  + ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd pulumi \
       --bash <($out/bin/pulumi completion bash) \
       --fish <($out/bin/pulumi completion fish) \
diff --git a/pkgs/tools/package-management/lix/default.nix b/pkgs/tools/package-management/lix/default.nix
index 6df95540ead8..1bfcb7ffd1ca 100644
--- a/pkgs/tools/package-management/lix/default.nix
+++ b/pkgs/tools/package-management/lix/default.nix
@@ -22,6 +22,7 @@
   haskell,
   nix-serve-ng,
   colmena,
+  nix-update,
 
   storeDir ? "/nix/store",
   stateDir ? "/nix/var",
@@ -127,6 +128,11 @@ let
             nix = self.lix;
             inherit (self) nix-eval-jobs;
           };
+
+          nix-update = nix-update.override {
+            nix = self.lix;
+            inherit (self) nixpkgs-review;
+          };
         };
     };
 
diff --git a/pkgs/tools/security/rekor/default.nix b/pkgs/tools/security/rekor/default.nix
index 37d03ae690f6..7841745b93d6 100644
--- a/pkgs/tools/security/rekor/default.nix
+++ b/pkgs/tools/security/rekor/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
@@ -52,7 +53,7 @@ let
         ldflags+=" -X sigs.k8s.io/release-utils/version.buildDate=$(cat SOURCE_DATE_EPOCH)"
       '';
 
-      postInstall = ''
+      postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
         installShellCompletion --cmd ${pname} \
           --bash <($out/bin/${pname} completion bash) \
           --fish <($out/bin/${pname} completion fish) \
diff --git a/pkgs/tools/virtualization/linode-cli/default.nix b/pkgs/tools/virtualization/linode-cli/default.nix
index a174e47c63ed..831e8dbf2440 100644
--- a/pkgs/tools/virtualization/linode-cli/default.nix
+++ b/pkgs/tools/virtualization/linode-cli/default.nix
@@ -1,4 +1,5 @@
 {
+  stdenv,
   buildPythonApplication,
   colorclass,
   fetchPypi,
@@ -71,7 +72,7 @@ buildPythonApplication rec {
     $out/bin/linode-cli --skip-config --version | grep ${version} > /dev/null
   '';
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     for shell in bash fish; do
       installShellCompletion --cmd linode-cli \
         --$shell <($out/bin/linode-cli --skip-config completion $shell)
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index a30a122bbfa3..3983c112f00e 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -989,6 +989,7 @@ mapAliases {
   gdmd = throw "gdmd has been removed from Nixpkgs, as it depends on GDC which was removed"; # Added 2025-08-08
   gdome2 = throw "'gdome2' has been removed from nixpkgs, as it is umaintained and obsolete"; # Added 2024-12-29
   geocode-glib = throw "'geocode-glib' has been removed, as it was unused and used outdated libraries"; # Added 2025-04-16
+  geos_3_9 = throw "geos_3_9 has been removed from nixpkgs. Please use a more recent 'geos' instead."; # Added 2025-09-21
   geos_3_11 = throw "geos_3_11 has been removed from nixpkgs. Please use a more recent 'geos' instead."; # Added 2024-11-29
   gfbgraph = throw "'gfbgraph' has been removed as it was archived upstream and unused in nixpkgs"; # Added 2025-04-20
   gfortran48 = throw "'gfortran48' has been removed from nixpkgs"; # Added 2024-09-10
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5d3e2da3e019..cbb67cde3c8e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6410,11 +6410,7 @@ with pkgs;
     electron-chromedriver_38
     ;
 
-  electron_35 =
-    if lib.meta.availableOn stdenv.hostPlatform electron-source.electron_35 then
-      electron-source.electron_35
-    else
-      electron_35-bin;
+  electron_35 = electron_35-bin;
   electron_36 =
     if lib.meta.availableOn stdenv.hostPlatform electron-source.electron_36 then
       electron-source.electron_36
@@ -7518,8 +7514,6 @@ with pkgs;
 
   geos = callPackage ../development/libraries/geos { };
 
-  geos_3_9 = callPackage ../development/libraries/geos/3.9.nix { };
-
   gettext = callPackage ../development/libraries/gettext { };
 
   gdalMinimal = gdal.override {
diff --git a/pkgs/top-level/darwin-packages.nix b/pkgs/top-level/darwin-packages.nix
index 395e7196bd6f..0bf52553d029 100644
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -172,6 +172,8 @@ makeScopeWithSplicing' {
           xcode_16_2
           xcode_16_3
           xcode_16_4
+          xcode_26
+          xcode_26_Apple_silicon
           xcode
           requireXcode
           ;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 3a8500b0412d..0fa2df7e9269 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1915,6 +1915,8 @@ self: super: with self; {
 
   binsync = callPackage ../development/python-modules/binsync { };
 
+  biocframe = callPackage ../development/python-modules/biocframe { };
+
   biocutils = callPackage ../development/python-modules/biocutils { };
 
   biom-format = callPackage ../development/python-modules/biom-format { };
@@ -7856,6 +7858,8 @@ self: super: with self; {
 
   knot-floer-homology = callPackage ../development/python-modules/knot-floer-homology { };
 
+  knowit = callPackage ../development/python-modules/knowit { };
+
   knx-frontend = callPackage ../development/python-modules/knx-frontend { };
 
   kokoro = callPackage ../development/python-modules/kokoro { };
@@ -8436,6 +8440,8 @@ self: super: with self; {
 
   linear-operator = callPackage ../development/python-modules/linear-operator { };
 
+  linearmodels = callPackage ../development/python-modules/linearmodels { };
+
   lineax = callPackage ../development/python-modules/lineax { };
 
   linecache2 = callPackage ../development/python-modules/linecache2 { };
@@ -13136,6 +13142,8 @@ self: super: with self; {
 
   pyhcl = callPackage ../development/python-modules/pyhcl { };
 
+  pyhdfe = callPackage ../development/python-modules/pyhdfe { };
+
   pyheck = callPackage ../development/python-modules/pyheck { };
 
   pyheos = callPackage ../development/python-modules/pyheos { };
diff --git a/pkgs/top-level/qt5-packages.nix b/pkgs/top-level/qt5-packages.nix
index f39f342b7036..6fbf6cfd6db0 100644
--- a/pkgs/top-level/qt5-packages.nix
+++ b/pkgs/top-level/qt5-packages.nix
@@ -221,10 +221,6 @@ makeScopeWithSplicing' {
 
         qtwebkit-plugins = callPackage ../development/libraries/qtwebkit-plugins { };
 
-        # Not a library, but we do want it to be built for every qt version there
-        # is, to allow users to choose the right build if needed.
-        sddm = callPackage ../applications/display-managers/sddm { };
-
         signond = callPackage ../development/libraries/signond { };
 
         timed = callPackage ../applications/system/timed { };
diff --git a/pkgs/top-level/qt6-packages.nix b/pkgs/top-level/qt6-packages.nix
index 7ee501d1f94e..6aae3abf5efd 100644
--- a/pkgs/top-level/qt6-packages.nix
+++ b/pkgs/top-level/qt6-packages.nix
@@ -138,8 +138,6 @@ makeScopeWithSplicing' {
         callPackage ../development/libraries/sailfish-access-control-plugin
           { };
 
-      # Not a library, but we do want it to be built for every qt version there
-      # is, to allow users to choose the right build if needed.
       sddm = kdePackages.callPackage ../applications/display-managers/sddm { };
 
       sierra-breeze-enhanced =