diff --git a/ci/eval/attrpaths.nix b/ci/eval/attrpaths.nix
new file mode 100644
index 000000000000..6938e5dfe3cb
--- /dev/null
+++ b/ci/eval/attrpaths.nix
@@ -0,0 +1,83 @@
+# This expression will, as efficiently as possible, dump a
+# *superset* of all attrpaths of derivations which might be
+# part of a release on *any* platform.
+#
+# This expression runs single-threaded under all current Nix
+# implementations, but much faster and with much less memory
+# used than ./outpaths.nix itself.
+#
+# Once you have the list of attrnames you can split it up into
+# $NUM_CORES batches and evaluate the outpaths separately for each
+# batch, in parallel.
+#
+# To dump the attrnames:
+#
+#   nix-instantiate --eval --strict --json ci/eval/attrpaths.nix -A names
+#
+{
+  lib ? import (path + "/lib"),
+  trace ? false,
+  path ? ./../..,
+}:
+let
+
+  # TODO: Use mapAttrsToListRecursiveCond when this PR lands:
+  # https://github.com/NixOS/nixpkgs/pull/395160
+  justAttrNames =
+    path: value:
+    let
+      result =
+        if path == [ "AAAAAASomeThingsFailToEvaluate" ] || !(lib.isAttrs value) then
+          [ ]
+        else if lib.isDerivation value then
+          [ path ]
+        else
+          lib.pipe value [
+            (lib.mapAttrsToList (
+              name: value:
+              lib.addErrorContext "while evaluating package set attribute path '${
+                lib.showAttrPath (path ++ [ name ])
+              }'" (justAttrNames (path ++ [ name ]) value)
+            ))
+            lib.concatLists
+          ];
+    in
+    lib.traceIf trace "** ${lib.showAttrPath path}" result;
+
+  outpaths = import ./outpaths.nix {
+    inherit path;
+    attrNamesOnly = true;
+  };
+
+  paths = [
+    # Some of the following are based on variants, which are disabled with `attrNamesOnly = true`.
+    # Until these have been removed from release.nix / hydra, we manually add them to the list.
+    [
+      "pkgsLLVM"
+      "stdenv"
+    ]
+    [
+      "pkgsArocc"
+      "stdenv"
+    ]
+    [
+      "pkgsZig"
+      "stdenv"
+    ]
+    [
+      "pkgsStatic"
+      "stdenv"
+    ]
+    [
+      "pkgsMusl"
+      "stdenv"
+    ]
+  ]
+  ++ justAttrNames [ ] outpaths;
+
+  names = map lib.showAttrPath paths;
+
+in
+{
+  inherit paths names;
+}
diff --git a/pkgs/top-level/release-outpaths-parallel.nix b/ci/eval/chunk.nix
similarity index 82%
rename from pkgs/top-level/release-outpaths-parallel.nix
rename to ci/eval/chunk.nix
index 46d10c6a9504..43c684074602 100644
--- a/pkgs/top-level/release-outpaths-parallel.nix
+++ b/ci/eval/chunk.nix
@@ -1,5 +1,4 @@
-# This file works in tandem with ../../ci/eval/default.nix
-# It turns ./release-outpaths.nix into chunks of a fixed size
+# This turns ./outpaths.nix into chunks of a fixed size.
 {
   lib ? import ../../lib,
   path ? ../..,
@@ -7,7 +6,6 @@
   attrpathFile,
   chunkSize,
   myChunk,
-  checkMeta,
   includeBroken,
   systems,
 }:
@@ -16,9 +14,9 @@ let
   attrpaths = lib.importJSON attrpathFile;
   myAttrpaths = lib.sublist (chunkSize * myChunk) chunkSize attrpaths;
 
-  unfiltered = import ./release-outpaths.nix {
+  unfiltered = import ./outpaths.nix {
     inherit path;
-    inherit checkMeta includeBroken systems;
+    inherit includeBroken systems;
   };
 
   # Turns the unfiltered recursive attribute set into one that is limited to myAttrpaths
diff --git a/ci/eval/compare/default.nix b/ci/eval/compare/default.nix
index cfd9b78510d0..f5c1b1b1dab0 100644
--- a/ci/eval/compare/default.nix
+++ b/ci/eval/compare/default.nix
@@ -105,7 +105,6 @@ let
           ) rebuildsByKernel
           # Set the "11.by: package-maintainer" label to whether all packages directly
           # changed are maintained by the PR's author.
-          # (https://github.com/NixOS/ofborg/blob/df400f44502d4a4a80fa283d33f2e55a4e43ee90/ofborg/src/tagger.rs#L83-L88)
           // {
             "11.by: package-maintainer" =
               maintainers ? ${githubAuthorId}
diff --git a/ci/eval/compare/maintainers.nix b/ci/eval/compare/maintainers.nix
index 488eb0ea9201..d0c5057a0499 100644
--- a/ci/eval/compare/maintainers.nix
+++ b/ci/eval/compare/maintainers.nix
@@ -1,7 +1,6 @@
 {
   lib,
 }:
-# Almost directly vendored from https://github.com/NixOS/ofborg/blob/5a4e743f192fb151915fcbe8789922fa401ecf48/ofborg/src/maintainers.nix
 {
   changedattrs,
   changedpathsjson,
diff --git a/ci/eval/default.nix b/ci/eval/default.nix
index 14005ea401af..a379594dbc6d 100644
--- a/ci/eval/default.nix
+++ b/ci/eval/default.nix
@@ -26,6 +26,11 @@ let
       root = ../..;
       fileset = unions (
         map (lib.path.append ../..) [
+          ".version"
+          "ci/supportedSystems.json"
+          "ci/eval/attrpaths.nix"
+          "ci/eval/chunk.nix"
+          "ci/eval/outpaths.nix"
           "default.nix"
           "doc"
           "lib"
@@ -33,8 +38,6 @@ let
           "modules"
           "nixos"
           "pkgs"
-          ".version"
-          "ci/supportedSystems.json"
         ]
       );
     };
@@ -60,7 +63,7 @@ let
         export GC_INITIAL_HEAP_SIZE=4g
         command time -f "Attribute eval done [%MKB max resident, %Es elapsed] %C" \
           nix-instantiate --eval --strict --json --show-trace \
-            "$src/pkgs/top-level/release-attrpaths-superset.nix" \
+            "$src/ci/eval/attrpaths.nix" \
             -A paths \
             -I "$src" \
             --option restrict-eval true \
@@ -78,7 +81,6 @@ let
       attrpathFile ? "${attrpathsSuperset { inherit evalSystem; }}/paths.json",
       # The number of attributes per chunk, see ./README.md for more info.
       chunkSize ? 5000,
-      checkMeta ? true,
 
       # Don't try to eval packages marked as broken.
       includeBroken ? false,
@@ -99,7 +101,7 @@ let
         set +e
         command time -o "$outputDir/timestats/$myChunk" \
           -f "Chunk $myChunk on $system done [%MKB max resident, %Es elapsed] %C" \
-          nix-env -f "${nixpkgs}/pkgs/top-level/release-outpaths-parallel.nix" \
+          nix-env -f "${nixpkgs}/ci/eval/chunk.nix" \
           --eval-system "$system" \
           --option restrict-eval true \
           --option allow-import-from-derivation false \
@@ -110,7 +112,6 @@ let
           --arg myChunk "$myChunk" \
           --arg attrpathFile "${attrpathFile}" \
           --arg systems "[ \"$system\" ]" \
-          --arg checkMeta ${lib.boolToString checkMeta} \
           --arg includeBroken ${lib.boolToString includeBroken} \
           -I ${nixpkgs} \
           -I ${attrpathFile} \
diff --git a/pkgs/top-level/release-outpaths.nix b/ci/eval/outpaths.nix
similarity index 85%
rename from pkgs/top-level/release-outpaths.nix
rename to ci/eval/outpaths.nix
index 18840848c185..4efe8d1dc061 100644
--- a/pkgs/top-level/release-outpaths.nix
+++ b/ci/eval/outpaths.nix
@@ -1,19 +1,16 @@
 #!/usr/bin/env nix-shell
 # When using as a callable script, passing `--argstr path some/path` overrides $PWD.
-#!nix-shell -p nix -i "nix-env -qaP --no-name --out-path --arg checkMeta true -f pkgs/top-level/release-outpaths.nix"
+#!nix-shell -p nix -i "nix-env -qaP --no-name --out-path -f ci/eval/outpaths.nix"
 
-# Vendored from:
-#   https://raw.githubusercontent.com/NixOS/ofborg/74f38efa7ef6f0e8e71ec3bfc675ae4fb57d7491/ofborg/src/outpaths.nix
 {
-  checkMeta,
   includeBroken ? true, # set this to false to exclude meta.broken packages from the output
   path ? ./../..,
 
-  # used by pkgs/top-level/release-attrnames-superset.nix
+  # used by ./attrpaths.nix
   attrNamesOnly ? false,
 
   # Set this to `null` to build for builtins.currentSystem only
-  systems ? builtins.fromJSON (builtins.readFile ../../ci/supportedSystems.json),
+  systems ? builtins.fromJSON (builtins.readFile ../supportedSystems.json),
 }:
 let
   lib = import (path + "/lib");
@@ -30,7 +27,7 @@ let
             allowUnfree = true;
             allowInsecurePredicate = x: true;
             allowVariants = !attrNamesOnly;
-            checkMeta = checkMeta;
+            checkMeta = true;
 
             handleEvalIssue =
               reason: errormsg:
diff --git a/doc/release-notes/rl-2511.section.md b/doc/release-notes/rl-2511.section.md
index adff696ab92b..2c33fdab116d 100644
--- a/doc/release-notes/rl-2511.section.md
+++ b/doc/release-notes/rl-2511.section.md
@@ -65,6 +65,13 @@
 
 - `ansible-later` has been removed because it was discontinued by the author.
 
+- `k3s` airgap images passthru attributes have changed:
+  - `imagesList` was removed
+  - `airgapImages` was renamed to `airgap-images`
+  - `airgapImagesAmd64` was renamed to `airgap-images-amd64-tar-zst`
+  - `airgapImagesArm64` was renamed to `airgap-images-arm64-tar-zst`
+  - `airgapImagesArm` was renamed to `airgap-images-arm-tar-zst`
+
 - `stalwart-mail` since `0.13.0` "introduces a significant redesign of the MTA’s delivery and queueing subsystem". See [the upgrading announcement for the `0.13.0` release](https://github.com/stalwartlabs/stalwart/blob/89b561b5ca1c5a11f2a768b4a2cfef0f473b7a01/UPGRADING.md#upgrading-from-v012x-and-v011x-to-v013x).
 
 - Greetd and its original greeters (`tuigreet`, `gtkgreet`, `qtgreet`, `regreet`, `wlgreet`) were moved from `greetd` namespace to top level (`greetd.tuigreet` -> `tuigreet`, `greetd.greetd` -> `greetd`, etc). The original attrs are available for compatibility as passthrus of `greetd`, but will emit a warning. They will be removed in future releases.
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index a46d85828993..18954cc4828b 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -6070,6 +6070,14 @@
     name = "Dee Engan";
     keys = [ { fingerprint = "9C24 79F5 F0CE 48F4 00EE  4A5B B8ED 46EB 468B F72D"; } ];
   };
+  deej-io = {
+    email = "me@deej.io";
+    github = "deej-io";
+    githubId = 7419862;
+    name = "Daniel Rollins";
+    matrix = "@deej-io:matrix.org";
+    keys = [ { fingerprint = "A0BE BED3 A3A0 7127 1411 6234 6830 B0AE 30DD 38DB"; } ];
+  };
   deejayem = {
     email = "nixpkgs.bu5hq@simplelogin.com";
     github = "deejayem";
@@ -20421,6 +20429,12 @@
     name = "Kevin Mullins";
     keys = [ { fingerprint = "2CD2 B030 BD22 32EF DF5A  008A 3618 20A4 5DB4 1E9A"; } ];
   };
+  podium868909 = {
+    email = "89096245@proton.me";
+    github = "podium868909";
+    githubId = 150333826;
+    name = "podium868909";
+  };
   podocarp = {
     email = "xdjiaxd@gmail.com";
     github = "podocarp";
@@ -21325,6 +21339,13 @@
     githubId = 23345803;
     name = "Szymon Scholz";
   };
+  ratakor = {
+    name = "Ratakor";
+    github = "ratakor";
+    githubId = 45130910;
+    email = "ratakor@disroot.org";
+    keys = [ { fingerprint = "B60F 8F80 D6CD C5D2 58CF  14C3 241B 1CBE 567B 287E"; } ];
+  };
   ratcornu = {
     email = "ratcornu+programmation@skaven.org";
     github = "RatCornu";
diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 40d4ec599c74..dcb03a56919f 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -50,6 +50,8 @@
 
 - [go-httpbin](https://github.com/mccutchen/go-httpbin), a reasonably complete and well-tested golang port of httpbin, with zero dependencies outside the go stdlib. Available as [services.go-httpbin](#opt-services.go-httpbin.enable).
 
+- [llama-swap](https://github.com/mostlygeek/llama-swap), a light weight transparent proxy server that provides automatic model swapping to llama.cpp's server (or any server with an OpenAI compatible endpoint). Available as [](#opt-services.llama-swap.enable).
+
 - [tuwunel](https://matrix-construct.github.io/tuwunel/), a federated chat server implementing the Matrix protocol, forked from Conduwuit. Available as [services.matrix-tuwunel](#opt-services.matrix-tuwunel.enable).
 
 - [Broadcast Box](https://github.com/Glimesh/broadcast-box), a WebRTC broadcast server. Available as [services.broadcast-box](options.html#opt-services.broadcast-box.enable).
@@ -62,6 +64,8 @@
 
 - [TuneD](https://tuned-project.org/), a system tuning service for Linux. Available as [services.tuned](#opt-services.tuned.enable).
 
+- [yubikey-manager](https://github.com/Yubico/yubikey-manager), a tool for configuring YubiKey devices. Available as [programs.yubikey-manager](#opt-programs.yubikey-manager.enable).
+
 - [Draupnir](https://github.com/the-draupnir-project/draupnir), a Matrix moderation bot. Available as [services.draupnir](#opt-services.draupnir.enable).
 
 - [postfix-tlspol](https://github.com/Zuplu/postfix-tlspol), MTA-STS and DANE resolver and TLS policy server for Postfix. Available as [services.postfix-tlspol](#opt-services.postfix-tlspol.enable).
diff --git a/nixos/modules/installer/tools/nix-fallback-paths.nix b/nixos/modules/installer/tools/nix-fallback-paths.nix
index 2fa265cda818..d4caef1a09ab 100644
--- a/nixos/modules/installer/tools/nix-fallback-paths.nix
+++ b/nixos/modules/installer/tools/nix-fallback-paths.nix
@@ -1,8 +1,8 @@
 {
-  x86_64-linux = "/nix/store/gy397nw6h414f4l4vxny1wg8cn4i955d-nix-2.28.4";
-  i686-linux = "/nix/store/k192aqw8zh71zrli5abqd5wg01bqwmh9-nix-2.28.4";
-  aarch64-linux = "/nix/store/cp0bzvj8vf5y2z0nimq57crcq6h419fj-nix-2.28.4";
-  riscv64-linux = "/nix/store/zav2zzhxld8fqvj7hb5z83ggd3ij6888-nix-riscv64-unknown-linux-gnu-2.28.4";
-  x86_64-darwin = "/nix/store/gj4y690ligr5gawmpnkiw2qs087m068w-nix-2.28.4";
-  aarch64-darwin = "/nix/store/nb6nkjac7nj242j3m56pkdkbikfjw343-nix-2.28.4";
+  x86_64-linux = "/nix/store/0bvxg6fr61zrlhi93azhp8yfhb5rcrs9-nix-2.28.5";
+  i686-linux = "/nix/store/m5na49mxl4xpcs3xh086s5v08jqjhbmb-nix-2.28.5";
+  aarch64-linux = "/nix/store/95rhdhjfwbi7ilwy5j0knj1852p7x6c6-nix-2.28.5";
+  riscv64-linux = "/nix/store/cqiiv36c773023p6lp9h4ff57fjlzisk-nix-riscv64-unknown-linux-gnu-2.28.5";
+  x86_64-darwin = "/nix/store/xiw5636h616yi3balx96pmdk6b052rhk-nix-2.28.5";
+  aarch64-darwin = "/nix/store/sax8chv80d9fy4s0y3ahsr9y4kc2f0ib-nix-2.28.5";
 }
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index d65241265b31..5326f1b216d5 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -362,6 +362,7 @@
   ./programs/xwayland.nix
   ./programs/yazi.nix
   ./programs/ydotool.nix
+  ./programs/yubikey-manager.nix
   ./programs/yubikey-touch-detector.nix
   ./programs/zmap.nix
   ./programs/zoom-us.nix
@@ -1216,6 +1217,7 @@
   ./services/networking/libreswan.nix
   ./services/networking/livekit-ingress.nix
   ./services/networking/livekit.nix
+  ./services/networking/llama-swap.nix
   ./services/networking/lldpd.nix
   ./services/networking/logmein-hamachi.nix
   ./services/networking/lokinet.nix
diff --git a/nixos/modules/programs/yubikey-manager.nix b/nixos/modules/programs/yubikey-manager.nix
new file mode 100644
index 000000000000..1dc2b15e202c
--- /dev/null
+++ b/nixos/modules/programs/yubikey-manager.nix
@@ -0,0 +1,29 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.programs.yubikey-manager;
+in
+{
+  options = {
+    programs.yubikey-manager = {
+      enable = lib.mkEnableOption "yubikey-manager";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    services = {
+      pcscd.enable = true;
+
+      # The udev rules we want aren't included in the yubikey-manager package, but
+      # we can get them from yubikey-personalization.
+      udev.packages = [ pkgs.yubikey-personalization ];
+    };
+  };
+}
diff --git a/nixos/modules/services/networking/llama-swap.nix b/nixos/modules/services/networking/llama-swap.nix
new file mode 100644
index 000000000000..c23107a89d58
--- /dev/null
+++ b/nixos/modules/services/networking/llama-swap.nix
@@ -0,0 +1,124 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.llama-swap;
+  settingsFormat = pkgs.formats.yaml { };
+  configFile = settingsFormat.generate "config.yaml" cfg.settings;
+in
+{
+  options.services.llama-swap = {
+    enable = lib.mkEnableOption "enable the llama-swap service";
+
+    package = lib.mkPackageOption pkgs "llama-swap" { };
+
+    port = lib.mkOption {
+      default = 8080;
+      example = 11343;
+      type = lib.types.port;
+      description = ''
+        Port that llama-swap listens on.
+      '';
+    };
+
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Whether to open the firewall for llama-swap.
+        This adds {option}`port` to [](#opt-networking.firewall.allowedTCPPorts).
+      '';
+    };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule { freeformType = settingsFormat.type; };
+      description = ''
+        llama-swap configuration. Refer to the [llama-swap example configuration](https://github.com/mostlygeek/llama-swap/blob/main/config.example.yaml)
+        for details on supported values.
+      '';
+      example = lib.literalExpression ''
+        let
+          llama-cpp = pkgs.llama-cpp.override { rocmSupport = true; };
+          llama-server = lib.getExe' llama-cpp "llama-server";
+        in
+        {
+          healthCheckTimeout = 60;
+          models = {
+            "some-model" = {
+              cmd = "$\{llama-server\} --port ''\${PORT} -m /var/lib/llama-cpp/models/some-model.gguf -ngl 0 --no-webui";
+              aliases = [
+                "the-best"
+              ];
+            };
+            "other-model" = {
+              proxy = "http://127.0.0.1:5555";
+              cmd = "$\{llama-server\} --port 5555 -m /var/lib/llama-cpp/models/other-model.gguf -ngl 0 -c 4096 -np 4 --no-webui";
+              concurrencyLimit = 4;
+            };
+          };
+        };
+      '';
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    systemd.services.llama-swap = {
+      description = "Model swapping for LLaMA C++ Server (or any local OpenAPI compatible server)";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        Type = "exec";
+        ExecStart = "${lib.getExe cfg.package} --listen :${toString cfg.port} --config ${configFile}";
+        Restart = "on-failure";
+        RestartSec = 3;
+
+        # for GPU acceleration
+        PrivateDevices = false;
+
+        # hardening
+        DynamicUser = true;
+        CapabilityBoundingSet = "";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        NoNewPrivileges = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        MemoryDenyWriteExecute = true;
+        LockPersonality = true;
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+        ];
+        SystemCallErrorNumber = "EPERM";
+        ProtectProc = "invisible";
+        ProtectHostname = true;
+        ProcSubset = "pid";
+      };
+    };
+    networking.firewall = lib.mkIf cfg.openFirewall { allowedTCPPorts = [ cfg.port ]; };
+  };
+
+  meta.maintainers = with lib.maintainers; [
+    jk
+    podium868909
+  ];
+}
diff --git a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
index bfae30eb3aa1..9f36dff3cc67 100644
--- a/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
+++ b/nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py
@@ -258,6 +258,8 @@ def remove_old_entries(gens: list[SystemIdentifier]) -> None:
         bootspec = get_bootspec(gen.profile, gen.generation)
         known_paths.append(copy_from_file(bootspec.kernel, True).name)
         known_paths.append(copy_from_file(bootspec.initrd, True).name)
+        if bootspec.devicetree is not None:
+            known_paths.append(copy_from_file(bootspec.devicetree, True).name)
     for path in (BOOT_MOUNT_POINT / "loader/entries").glob("nixos*-generation-[1-9]*.conf", case_sensitive=False):
         if rex_profile.match(path.name):
             prof = rex_profile.sub(r"\1", path.name)
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index e4f1fb1614f9..a50c15852666 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -848,6 +848,7 @@ in
   litellm = runTest ./litellm.nix;
   litestream = runTest ./litestream.nix;
   lk-jwt-service = runTest ./matrix/lk-jwt-service.nix;
+  llama-swap = runTest ./web-servers/llama-swap.nix;
   lldap = runTest ./lldap.nix;
   localsend = runTest ./localsend.nix;
   locate = runTest ./locate.nix;
diff --git a/nixos/tests/k3s/airgap-images.nix b/nixos/tests/k3s/airgap-images.nix
index 84a535feb7fc..79fd2c77025b 100644
--- a/nixos/tests/k3s/airgap-images.nix
+++ b/nixos/tests/k3s/airgap-images.nix
@@ -22,21 +22,13 @@ import ../make-test-python.nix (
           "--disable servicelb"
           "--disable traefik"
         ];
-        images = [ k3s.airgapImages ];
+        images = [ k3s.airgap-images ];
       };
     };
 
     testScript = ''
-      import json
-
-      start_all()
       machine.wait_for_unit("k3s")
       machine.wait_until_succeeds("journalctl -r --no-pager -u k3s | grep \"Imported images from /var/lib/rancher/k3s/agent/images/\"")
-      images = json.loads(machine.succeed("crictl img -o json"))
-      image_names = [i["repoTags"][0] for i in images["images"]]
-      with open("${k3s.imagesList}") as expected_images:
-        for line in expected_images:
-          assert line.rstrip() in image_names, f"The image {line.rstrip()} is not present in the airgap images archive"
     '';
   }
 )
diff --git a/nixos/tests/web-servers/llama-swap.nix b/nixos/tests/web-servers/llama-swap.nix
new file mode 100644
index 000000000000..698b562515ad
--- /dev/null
+++ b/nixos/tests/web-servers/llama-swap.nix
@@ -0,0 +1,258 @@
+{ pkgs, lib, ... }:
+
+let
+  wrapSrc = attrs: pkgs.runCommand "${attrs.pname}-${attrs.version}" attrs "ln -s $src $out";
+
+  smollm2-135m = wrapSrc rec {
+    pname = "smollm2-135m";
+    version = "9e6855bc4be717fca1ef21360a1db4b29d5c559a";
+    src = pkgs.fetchurl {
+      url = "https://huggingface.co/unsloth/SmolLM2-135M-Instruct-GGUF/resolve/${version}/SmolLM2-135M-Instruct-Q4_K_M.gguf";
+      hash = "sha256-7V+jDEh7KC7BVsKQYvEiLlwgh1qUSsmCidvSQulH90c=";
+    };
+
+    meta.license = with lib.licenses; [
+      asl20 # actual license of the model
+      unfree # to force an opt-in - do not remove
+    ];
+  };
+
+  # grab allowUnfreePredicate if it exists or default deny
+  allowUnfreePredicate =
+    if builtins.hasAttr "allowUnfreePredicate" pkgs.config then
+      pkgs.config.allowUnfreePredicate
+    else
+      (_: false);
+
+  # check if we can use smollm2-135m taking either globally allowUnfree or
+  # explicit allow with predicate
+  useSmollm2-135m = pkgs.config.allowUnfree || allowUnfreePredicate smollm2-135m;
+in
+{
+  name = "llama-swap";
+  meta.maintainers = with lib.maintainers; [
+    jk
+    podium868909
+  ];
+
+  nodes = {
+    machine =
+      { pkgs, ... }:
+      {
+        # running models can be memory intensive but
+        # default `virtualisation.memorySize` is fine
+
+        services.llama-swap = {
+          enable = true;
+          settings =
+            # config for basic tests
+            if !useSmollm2-135m then
+              { }
+            # config for extended tests using SmolLM2
+            else
+              let
+                llama-cpp = pkgs.llama-cpp;
+                llama-server = lib.getExe' llama-cpp "llama-server";
+              in
+              {
+                hooks.on_startup.preload = [
+                  "smollm2"
+                ];
+                # temperature and top-k important for SmolLM2 performance/accuracy
+                models = {
+                  "smollm2" = {
+                    ttl = 10;
+                    cmd = "${llama-server} --port \${PORT} -m ${smollm2-135m} --no-webui --temp 0.2 --top-k 9";
+                  };
+                  "smollm2-group-1" = {
+                    cmd = "${llama-server} --port \${PORT} -m ${smollm2-135m} --no-webui --temp 0.2 --top-k 9 -c 1024";
+                  };
+                  "smollm2-group-2" = {
+                    proxy = "http://127.0.0.1:5802";
+                    cmd = "${llama-server} --port 5802 -m ${smollm2-135m} --no-webui --temp 0.2 --top-k 9 -c 1024";
+                  };
+                };
+                groups = {
+                  "standalone" = {
+                    swap = true;
+                    exclusive = true;
+                    members = [
+                      "smollm2"
+                    ];
+                  };
+                  "group" = {
+                    swap = false;
+                    exclusive = true;
+                    members = [
+                      "smollm2-group-1"
+                      "smollm2-group-2"
+                    ];
+                  };
+                };
+              };
+        };
+      };
+  };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      # core tests
+      import json
+
+      def get_json(route):
+        args = [
+          '-v',
+          '-s',
+          '--fail',
+          '-H "Content-Type: application/json"'
+        ]
+        return json.loads(machine.succeed("curl {args} http://localhost:8080{route}".format(args=" ".join(args), route=route)))
+
+      def post_json(route, data):
+        args = [
+          '-v',
+          '-s',
+          '--fail',
+          '-H "Content-Type: application/json"',
+          '-H "Authorization: Bearer no-key"',
+          "-d '{d}'".format(d=json.dumps(data))
+        ]
+        return json.loads(machine.succeed('curl {args} http://localhost:8080{route}'.format(args=" ".join(args), route=route)))
+
+      machine.wait_for_unit('llama-swap')
+      machine.wait_for_open_port(8080)
+
+      with subtest('check is serving ui'):
+        machine.succeed('curl --fail http:/localhost:8080/ui/')
+
+      with subtest('check is healthy'):
+        machine.wait_until_succeeds('curl --silent --fail http://localhost:8080/health | grep "OK"')
+
+    ''
+    + lib.optionalString useSmollm2-135m ''
+      # extended tests using SmolLM2
+      with subtest('check `/running` for preloaded smollm2'):
+        machine.wait_until_succeeds('curl --silent --fail http://localhost:8080/running | grep "smollm2"')
+        running_response = get_json('/running')
+        assert len(running_response['running']) == 1
+        running_model = running_response['running'][0]
+        assert running_model['model'] == 'smollm2'
+        assert running_model['state'] == 'ready'
+
+      with subtest('runs smollm2'):
+        response = None
+        with subtest('send request to smollm2'):
+          data = {
+            'model': 'smollm2',
+            'messages': [
+              {
+                'role': 'user',
+                'content': 'Say hello'
+              }
+            ]
+          }
+          response = post_json('/v1/chat/completions', data)
+
+        with subtest('response is from smollm2'):
+          assert response['model'] == 'smollm2'
+
+        with subtest('response contains at least one item in "choices"'):
+          assert len(response['choices']) >= 1
+
+        assistant_choices = None
+        with subtest('response contains at least one "assistant" message'):
+          assistant_choices = [c for c in response['choices'] if c['message']['role'] == 'assistant']
+          assert len(assistant_choices) >= 1
+
+        with subtest('first message (lowercase) starts with "hello"'):
+          assert assistant_choices[0]['message']['content'].lower()[:5] == 'hello'
+
+        with subtest('check `/running` for just smollm2'):
+          running_response = get_json('/running')
+          assert len(running_response['running']) == 1
+          running_model = running_response['running'][0]
+          assert running_model['model'] == 'smollm2'
+          assert running_model['state'] == 'ready'
+
+      with subtest('check `/running` for smollm2 to timeout'):
+        machine.succeed('curl --silent --fail http://localhost:8080/running | grep "smollm2"')
+        machine.wait_until_succeeds('curl --silent --fail http://localhost:8080/running | grep -v "smollm2"', timeout=11)
+        running_response = get_json('/running')
+        assert len(running_response['running']) == 0
+
+      with subtest('runs smollm2-group-1 and smollm2-group-2'):
+        response_1 = None
+        with subtest('send request to smollm2-group-1'):
+          data = {
+            'model': 'smollm2-group-1',
+            'messages': [
+              {
+                'role': 'user',
+                'content': 'Say hello'
+              }
+            ]
+          }
+          response_1 = post_json('/v1/chat/completions', data)
+
+        with subtest('response 1 is from smollm2-group-1'):
+          assert response_1['model'] == 'smollm2-group-1'
+
+        with subtest('response 1 contains at least one item in "choices"'):
+          assert len(response['choices']) >= 1
+
+        assistant_choices_1 = None
+        with subtest('response 1 contains at least one "assistant" message'):
+          assistant_choices_1 = [c for c in response_1['choices'] if c['message']['role'] == 'assistant']
+          assert len(assistant_choices_1) >= 1
+
+        with subtest('first message (lowercase) in response 1 starts with "hello"'):
+          assert assistant_choices_1[0]['message']['content'].lower()[:5] == 'hello'
+
+        with subtest('check `/running` for just smollm2-group-1'):
+          running_response = get_json('/running')
+          assert len(running_response['running']) == 1
+          running_model = running_response['running'][0]
+          assert running_model['model'] == 'smollm2-group-1'
+          assert running_model['state'] == 'ready'
+
+        response_2 = None
+        with subtest('send request to smollm2-group-2'):
+          data = {
+            'model': 'smollm2-group-2',
+            'messages': [
+              {
+                'role': 'user',
+                'content': 'Say hello'
+              }
+            ]
+          }
+          response_2 = post_json('/v1/chat/completions', data)
+
+        with subtest('response 2 is from smollm2-group-2'):
+          assert response_2['model'] == 'smollm2-group-2'
+
+        with subtest('response 2 contains at least one item in "choices"'):
+          assert len(response['choices']) >= 1
+
+        assistant_choices_2 = None
+        with subtest('response 2 contains at least one "assistant" message'):
+          assistant_choices_2 = [c for c in response_2['choices'] if c['message']['role'] == 'assistant']
+          assert len(assistant_choices_2) >= 1
+
+        with subtest('first message (lowercase) in response 1 starts with "hello"'):
+          assert assistant_choices_2[0]['message']['content'].lower()[:5] == 'hello'
+
+        with subtest('check `/running` for both smollm2-group-1 and smollm2-group-2'):
+          running_response = get_json('/running')['running']
+          assert len(running_response) == 2
+          assert len([
+            rm for rm in running_response
+            if rm['state'] == 'ready' and rm['model'] == 'smollm2-group-1'
+          ]) == 1
+          assert len([
+            rm for rm in running_response
+            if rm['state'] == 'ready' and rm['model'] == 'smollm2-group-2'
+          ]) == 1
+    '';
+}
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 1170b2db2768..312e7f5bc4f4 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -3581,8 +3581,8 @@ let
         mktplcRef = {
           name = "one-dark-theme";
           publisher = "mskelton";
-          version = "1.14.2";
-          hash = "sha256-6nIfEPbau5Dy1DGJ0oQ5L2EGn2NDhpd8jSdYujtOU68=";
+          version = "1.14.3";
+          hash = "sha256-AYOX6I1R34HdNNdY9LpLkM/JHm/f1h+Q9HTtEnKMhdU=";
         };
         meta = {
           license = lib.licenses.mit;
diff --git a/pkgs/applications/editors/vscode/extensions/mkhl.shfmt/default.nix b/pkgs/applications/editors/vscode/extensions/mkhl.shfmt/default.nix
index 84c2bd9a93a0..510a4827cc5e 100644
--- a/pkgs/applications/editors/vscode/extensions/mkhl.shfmt/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/mkhl.shfmt/default.nix
@@ -9,8 +9,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "shfmt";
     publisher = "mkhl";
-    version = "1.3.1";
-    hash = "sha256-V7pXPwabmUJLC/T0X4dsc52IZa7SaN70zd4mCjqk4X4=";
+    version = "1.4.0";
+    hash = "sha256-5qi2BRwftuW9Isveb7vRwPPPu2w7LTfhNO0xHFNruGI=";
   };
 
   postInstall = ''
diff --git a/pkgs/applications/emulators/libretro/cores/flycast.nix b/pkgs/applications/emulators/libretro/cores/flycast.nix
index 5190b6e64404..39e922260fa4 100644
--- a/pkgs/applications/emulators/libretro/cores/flycast.nix
+++ b/pkgs/applications/emulators/libretro/cores/flycast.nix
@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "flycast";
-  version = "0-unstable-2025-08-20";
+  version = "0-unstable-2025-08-29";
 
   src = fetchFromGitHub {
     owner = "flyinghead";
     repo = "flycast";
-    rev = "9c5408a6d3fff939ae06a319c2fce3aa6f2a4d69";
-    hash = "sha256-AH/XVN7Ah2DzN8/jlagOEAsNSciQMf8WBhfdC7YIMHw=";
+    rev = "0243f81c264ea8d1bbaa107f26fb6644f767c1e8";
+    hash = "sha256-iLEOAOMzdhlG4qogJiAhdK03YZ57dAV15TwBBjK7iSY=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/applications/graphics/ImageMagick/default.nix b/pkgs/applications/graphics/ImageMagick/default.nix
index 5eb50ac2ef42..c5056d2b5f81 100644
--- a/pkgs/applications/graphics/ImageMagick/default.nix
+++ b/pkgs/applications/graphics/ImageMagick/default.nix
@@ -85,13 +85,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.2-2";
+  version = "7.1.2-3";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-bQzHZGTr3dl8G7cMSjC5Is+H/7pnRtqgp/rvYZeJDu0=";
+    hash = "sha256-L4apUdF1VJXSVqWAyjYFG/4qDJoJ0ObmSOpd90kqXsU=";
   };
 
   outputs = [
diff --git a/pkgs/applications/networking/cluster/k3s/1_30/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_30/images-versions.json
index c37737fbbfd6..9ec9d1b5d8a2 100644
--- a/pkgs/applications/networking/cluster/k3s/1_30/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_30/images-versions.json
@@ -1,18 +1,26 @@
 {
-  "airgap-images-amd64": {
+  "airgap-images-amd64-tar-gz": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.14%2Bk3s2/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "f98a57f7b25a4537096fbe9755f96cfd05bfe6fc6315f111c0f44e1abf4aad6d"
+  },
+  "airgap-images-amd64-tar-zst": {
     "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.14%2Bk3s2/k3s-airgap-images-amd64.tar.zst",
     "sha256": "9bda99cde833c4e13fb4d35fa46fd57d4b1a2eefc33e00fa352ce686c871c842"
   },
-  "airgap-images-arm": {
+  "airgap-images-arm-tar-gz": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.14%2Bk3s2/k3s-airgap-images-arm.tar.gz",
+    "sha256": "33df3a2b155118198c48e66426a04292a348aa53fef126a3cb8e4fe7aea83ccc"
+  },
+  "airgap-images-arm-tar-zst": {
     "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.14%2Bk3s2/k3s-airgap-images-arm.tar.zst",
     "sha256": "d40a78ff14b40547bca6d05db3d7e767b272bb9257628ebd3905d1659bc49bd5"
   },
-  "airgap-images-arm64": {
+  "airgap-images-arm64-tar-gz": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.14%2Bk3s2/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "bba9c2e417ece797a5ae8bf9346bb35dc8ab163828c801a2cb512d6097610b52"
+  },
+  "airgap-images-arm64-tar-zst": {
     "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.14%2Bk3s2/k3s-airgap-images-arm64.tar.zst",
     "sha256": "6561f91f14c8419c9d1c20fb9af7948757d87bd91855b376058d9f2e16010452"
-  },
-  "images-list": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.14%2Bk3s2/k3s-images.txt",
-    "sha256": "1f87ad26acac5e553279a64942c0e3eeef5c026cc2f82661d358990848672584"
   }
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_31/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_31/images-versions.json
index 3eb41c7c1b00..8ea08a211171 100644
--- a/pkgs/applications/networking/cluster/k3s/1_31/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_31/images-versions.json
@@ -1,18 +1,26 @@
 {
-  "airgap-images-amd64": {
+  "airgap-images-amd64-tar-gz": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.11%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "fa4f87e7e82c0e613f854eedf8f64d2cdabbd127f3ae84707ed1ca59e2137855"
+  },
+  "airgap-images-amd64-tar-zst": {
     "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.11%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
     "sha256": "c98ad7590af33ef7e148920eb809dfd0f8145a623fdd8d32c6efeecab6088412"
   },
-  "airgap-images-arm": {
+  "airgap-images-arm-tar-gz": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.11%2Bk3s1/k3s-airgap-images-arm.tar.gz",
+    "sha256": "0b6009407069fdd684d9627c5fa4bdb31ea4644172f1f429a2cce15d2c18631d"
+  },
+  "airgap-images-arm-tar-zst": {
     "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.11%2Bk3s1/k3s-airgap-images-arm.tar.zst",
     "sha256": "c1bd7557836538592dbd59f798e7a4b91d7aef74c8f9f71631060c96a5288dd6"
   },
-  "airgap-images-arm64": {
+  "airgap-images-arm64-tar-gz": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.11%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "6fa41db4ee001c1db8a404dd38f17f2426f27f688f9f7a2a76f4ef336f51c886"
+  },
+  "airgap-images-arm64-tar-zst": {
     "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.11%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
     "sha256": "97f0db38f57a2dc63167795620ba34a89348d874ecc91fbf3d8d962dc1392e47"
-  },
-  "images-list": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.11%2Bk3s1/k3s-images.txt",
-    "sha256": "1f87ad26acac5e553279a64942c0e3eeef5c026cc2f82661d358990848672584"
   }
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json
index b5c452ddc819..5755fbf56aff 100644
--- a/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_32/images-versions.json
@@ -1,18 +1,26 @@
 {
-  "airgap-images-amd64": {
+  "airgap-images-amd64-tar-gz": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.7%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "f6a8720aa9bb03d0c8a97a93e994557292f1efba1fa6648cd8a07830622ce748"
+  },
+  "airgap-images-amd64-tar-zst": {
     "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.7%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
     "sha256": "965f5767c08cffc96bf0967813e7c3fec4c41309e9952a480f0a50865bebd039"
   },
-  "airgap-images-arm": {
+  "airgap-images-arm-tar-gz": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.7%2Bk3s1/k3s-airgap-images-arm.tar.gz",
+    "sha256": "9aa6f9f33e58e04fb9d8f9cd5c51dd01c6092d7b5434f84341b2f74bc8de783e"
+  },
+  "airgap-images-arm-tar-zst": {
     "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.7%2Bk3s1/k3s-airgap-images-arm.tar.zst",
     "sha256": "57ab9c306cc96f8dd925bc788c80e49c2d13ee7a222a12235fb525529ad25ac0"
   },
-  "airgap-images-arm64": {
+  "airgap-images-arm64-tar-gz": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.7%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "9633b71655ed0f4af556c148f9bf7753221b3c9b42a8d902391187789302adca"
+  },
+  "airgap-images-arm64-tar-zst": {
     "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.7%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
     "sha256": "1aa05a55492ba0872fa8a0ff518d6e947869bea32dc2b8e5223bdcf53450c7f9"
-  },
-  "images-list": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.7%2Bk3s1/k3s-images.txt",
-    "sha256": "e786e9a6f0331a92a2257a12995028761bfee1b5bfaac866025b64162e69bfe0"
   }
 }
diff --git a/pkgs/applications/networking/cluster/k3s/1_33/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_33/images-versions.json
index 6e80722b9f5a..bd07f3e8f7a2 100644
--- a/pkgs/applications/networking/cluster/k3s/1_33/images-versions.json
+++ b/pkgs/applications/networking/cluster/k3s/1_33/images-versions.json
@@ -1,18 +1,26 @@
 {
-  "airgap-images-amd64": {
+  "airgap-images-amd64-tar-gz": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.3%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "64690dc963f6cbff8adb175a1bc41e6bf207734a9a214362544a36361a2d8350"
+  },
+  "airgap-images-amd64-tar-zst": {
     "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.3%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
     "sha256": "51b6ddeafa465e542f0707272736100916886dd49abcb1420ee52878dd3638a9"
   },
-  "airgap-images-arm": {
+  "airgap-images-arm-tar-gz": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.3%2Bk3s1/k3s-airgap-images-arm.tar.gz",
+    "sha256": "878d17722dd98e7d88de93a83606e0c9b0d7587c7e4a043559b5236a353fb224"
+  },
+  "airgap-images-arm-tar-zst": {
     "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.3%2Bk3s1/k3s-airgap-images-arm.tar.zst",
     "sha256": "339dd2b33b40f03bf95ee2e5dcb8e543ab6852e156cb8aaebe3885717a2966b5"
   },
-  "airgap-images-arm64": {
+  "airgap-images-arm64-tar-gz": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.3%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "e4ab063deb50241e60218a3a30ce090a5817daa0f38dacd10651e27b2be28b9e"
+  },
+  "airgap-images-arm64-tar-zst": {
     "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.3%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
     "sha256": "c12ec7b122f34eb1f89310b05e66b500a2f49522d7cd4ceb3475a675cab6ebc6"
-  },
-  "images-list": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.3%2Bk3s1/k3s-images.txt",
-    "sha256": "e786e9a6f0331a92a2257a12995028761bfee1b5bfaac866025b64162e69bfe0"
   }
 }
diff --git a/pkgs/applications/networking/cluster/k3s/builder.nix b/pkgs/applications/networking/cluster/k3s/builder.nix
index a165b8f68fb7..d7f98cd7ba93 100644
--- a/pkgs/applications/networking/cluster/k3s/builder.nix
+++ b/pkgs/applications/networking/cluster/k3s/builder.nix
@@ -130,38 +130,15 @@ let
   traefikChart = fetchurl chartVersions.traefik;
   traefik-crdChart = fetchurl chartVersions.traefik-crd;
 
-  mutFirstChar =
-    f: s:
-    let
-      firstChar = f (lib.substring 0 1 s);
-      rest = lib.substring 1 (-1) s;
-    in
-    firstChar + rest;
-
-  kebabToCamel =
-    s:
-    mutFirstChar lib.toLower (lib.concatMapStrings (mutFirstChar lib.toUpper) (lib.splitString "-" s));
-
-  # finds the images archive for the desired architecture, throws in case no suitable archive is found
-  findImagesArchive =
-    arch:
-    let
-      imagesVersionsNames = builtins.attrNames imagesVersions;
-    in
-    lib.findFirst (
-      n: lib.hasInfix arch n
-    ) (throw "k3s: no airgap images for ${arch} available") imagesVersionsNames;
-
   # a shortcut that provides the images archive for the host platform. Currently only supports
   # aarch64 (arm64) and x86_64 (amd64), throws on other architectures.
-  airgapImages = fetchurl (
-    if stdenv.hostPlatform.isAarch64 then
-      imagesVersions.${findImagesArchive "arm64"}
-    else if stdenv.hostPlatform.isx86_64 then
-      imagesVersions.${findImagesArchive "amd64"}
-    else
-      throw "k3s: airgap images cannot be found automatically for architecture ${stdenv.hostPlatform.linuxArch}, consider using an image archive with an explicit architecture."
-  );
+  airgap-images =
+    {
+      x86_64-linux = fetchurl imagesVersions.airgap-images-amd64-tar-zst;
+      aarch64-linux = fetchurl imagesVersions.airgap-images-arm64-tar-zst;
+    }
+    .${stdenv.hostPlatform.system}
+      or (throw "k3s: no airgap images available for system ${stdenv.hostPlatform.system}, consider using an image archive with an explicit architecture.");
 
   # so, k3s is a complicated thing to package
   # This derivation attempts to avoid including any random binaries from the
@@ -467,7 +444,7 @@ buildGoModule rec {
   '';
 
   passthru = {
-    inherit airgapImages;
+    inherit airgap-images;
     k3sCNIPlugins = k3sCNIPlugins;
     k3sContainerd = k3sContainerd;
     k3sRepo = k3sRepo;
@@ -481,10 +458,13 @@ buildGoModule rec {
       lib.mapAttrs (name: value: nixosTests.k3s.${name}.${k3s_version}) nixosTests.k3s;
     tests = passthru.mkTests k3sVersion;
     updateScript = updateScript;
+    imagesList = throw "k3s.imagesList was removed";
+    airgapImages = throw "k3s.airgapImages was renamed to k3s.airgap-images";
+    airgapImagesAmd64 = throw "k3s.airgapImagesAmd64 was renamed to k3s.airgap-images-amd64-tar-zst";
+    airgapImagesArm64 = throw "k3s.airgapImagesArm64 was renamed to k3s.airgap-images-arm64-tar-zst";
+    airgapImagesArm = throw "k3s.airgapImagesArm was renamed to k3s.airgap-images-arm-tar-zst";
   }
-  // (lib.mapAttrs' (
-    name: _: lib.nameValuePair (kebabToCamel name) (fetchurl imagesVersions.${name})
-  ) imagesVersions);
+  // (lib.mapAttrs (_: value: fetchurl value) imagesVersions);
 
   meta = baseMeta;
 }
diff --git a/pkgs/applications/networking/cluster/k3s/update-script.sh b/pkgs/applications/networking/cluster/k3s/update-script.sh
index 0a1d06a656c0..aced5253abf1 100755
--- a/pkgs/applications/networking/cluster/k3s/update-script.sh
+++ b/pkgs/applications/networking/cluster/k3s/update-script.sh
@@ -83,22 +83,20 @@ mv chart-versions.nix.update chart-versions.nix
 SHA256_HASHES="\
 $($CURL "https://github.com/k3s-io/k3s/releases/download/v${K3S_VERSION}/sha256sum-amd64.txt")
 $($CURL "https://github.com/k3s-io/k3s/releases/download/v${K3S_VERSION}/sha256sum-arm64.txt")
-$($CURL "https://github.com/k3s-io/k3s/releases/download/v${K3S_VERSION}/sha256sum-arm.txt")
-$($CURL "https://github.com/k3s-io/k3s/releases/download/v${K3S_VERSION}/k3s-images.txt" | sha256sum | cut -d' ' -f1)  k3s-images.txt"
+$($CURL "https://github.com/k3s-io/k3s/releases/download/v${K3S_VERSION}/sha256sum-arm.txt")"
 
 # Get all airgap images files associated with this release
 IMAGES_ARCHIVES=$($CURL "https://api.github.com/repos/k3s-io/k3s/releases/tags/v${K3S_VERSION}" | \
-    # Filter the assets so that only zstd archives and text files that have "images" in their name remain
-    jq -r '.assets[] | select(.name | (contains("images") and (endswith(".tar.zst") or endswith("k3s-images.txt")))) |
-        "\(.name) \(.browser_download_url)"')
+    # Filter the assets for airgap images archives
+    jq -r '.assets[] | select(.name | test("^k3s-airgap-images-.*\\.tar\\.")) | "\(.name) \(.browser_download_url)"')
 
 # Create a JSON object for each airgap images file and prefetch all download URLs in the process
 # Combine all JSON objects and write the result to images-versions.json
 while read -r name url; do
     # Pick the right hash based on the name
     sha256=$(grep "$name" <<< "$SHA256_HASHES" | cut -d ' ' -f 1)
-    # Remove the k3s- prefix and file endings
-    clean_name=$(sed -e 's/^k3s-//' -e 's/\.tar\.zst//' -e 's/\.txt/-list/' <<< "$name")
+    # Remove the k3s prefix and replace all dots with hyphens
+    clean_name=$(sed -e "s/^k3s-//" -e "s/\./-/g" <<< "$name")
     jq --null-input --arg name "$clean_name" \
             --arg url "$url" \
             --arg sha256 "$sha256" \
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 2533b149deec..7d395f40facd 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -840,11 +840,11 @@
     "vendorHash": "sha256-GN1h8DXFeAQpg4v7S95VJs17HY4twFGoZKN1modJSRI="
   },
   "minio": {
-    "hash": "sha256-TLWbbWYTjnvxT1LaV3FsL31xHHov8LpDYhA/nchMyMo=",
+    "hash": "sha256-XYo+nn9rgK9OtwdowqcTyuMir+7KPPjVeMLwFeWvdEQ=",
     "homepage": "https://registry.terraform.io/providers/aminueza/minio",
     "owner": "aminueza",
     "repo": "terraform-provider-minio",
-    "rev": "v3.6.3",
+    "rev": "v3.6.4",
     "spdx": "AGPL-3.0",
     "vendorHash": "sha256-QWBzQXx/dzWZr9dn3LHy8RIvZL1EA9xYqi7Ppzvju7g="
   },
diff --git a/pkgs/applications/science/molecular-dynamics/gromacs/default.nix b/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
index f13c5487a4bf..31d4b31dc56c 100644
--- a/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
+++ b/pkgs/applications/science/molecular-dynamics/gromacs/default.nix
@@ -53,8 +53,8 @@ let
       }
     else
       {
-        version = "2025.2";
-        hash = "sha256-DfCfnUWpnvAOZrm6qUk6J+kGgTdjo7bHZyIXxmtD6hE=";
+        version = "2025.3";
+        hash = "sha256-i9/KAmjz8Qp8o8BuWbYvc+oCQgxnIRwP85EvMteDPGU=";
       };
 
 in
diff --git a/pkgs/applications/science/molecular-dynamics/gromacs/pkgconfig-2025.patch b/pkgs/applications/science/molecular-dynamics/gromacs/pkgconfig-2025.patch
index f5f5e117ed24..246ffb898b66 100644
--- a/pkgs/applications/science/molecular-dynamics/gromacs/pkgconfig-2025.patch
+++ b/pkgs/applications/science/molecular-dynamics/gromacs/pkgconfig-2025.patch
@@ -30,7 +30,7 @@ index af9b5a6dc0..5f58d549bf 100644
 @@ -1,5 +1,4 @@
 -prefix=@CMAKE_INSTALL_PREFIX@
 -libdir=${prefix}/@CMAKE_INSTALL_LIBDIR@
-+libdir=@CMAKE_INSTALL_FULL_LIBDIR
- 
++libdir=@CMAKE_INSTALL_FULL_LIBDIR@
+
  Name: libgromacs@GMX_LIBS_SUFFIX@
  Description: Gromacs library
diff --git a/pkgs/applications/virtualization/krunvm/default.nix b/pkgs/applications/virtualization/krunvm/default.nix
index d67c4e64b78c..55fd7718aafb 100644
--- a/pkgs/applications/virtualization/krunvm/default.nix
+++ b/pkgs/applications/virtualization/krunvm/default.nix
@@ -16,18 +16,18 @@
 
 stdenv.mkDerivation rec {
   pname = "krunvm";
-  version = "0.2.3";
+  version = "0.2.4";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-IXofYsOmbrjq8Zq9+a6pvBYsvZFcKzN5IvCuHaxwazI=";
+    hash = "sha256-YbK4DKw0nh9IO1F7QsJcbOMlHekEdeUBbDHwuQ2x1Ww=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src;
-    hash = "sha256-Vmb5IgGyKGekuL018/Xiz9QroWIwTIUxVB57fb0X7Kw=";
+    hash = "sha256-TMV9xCcqBQgPsUSzsTJAi4qsplTOSm3ilaUmtmdaGnE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/_3/_389-ds-base/package.nix b/pkgs/by-name/_3/_389-ds-base/package.nix
index d2ed8b1f4164..9d3dec9e04c4 100644
--- a/pkgs/by-name/_3/_389-ds-base/package.nix
+++ b/pkgs/by-name/_3/_389-ds-base/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   autoconf,
   automake,
   cargo,
@@ -49,6 +50,15 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-hRTK9xBu8v8+SGa/3IB8Alh/aGUiRRn2LmYOvXy0Yd4=";
   };
 
+  patches = [
+    (fetchpatch {
+      # https://github.com/389ds/389-ds-base/pull/6930
+      name = "389-ds-base-rustc-1_89.patch";
+      url = "https://github.com/389ds/389-ds-base/commit/1701419551c246e9dc21778b118220eeb2258125.patch";
+      hash = "sha256-trzY/fDH3rs66DWbWI+PY46tIC9ShuVqspMHqEEKZYA=";
+    })
+  ];
+
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
     sourceRoot = "${finalAttrs.src.name}/src";
diff --git a/pkgs/by-name/ag/age-plugin-se/package.nix b/pkgs/by-name/ag/age-plugin-se/package.nix
index b1b27481805d..3d3fb847dc20 100644
--- a/pkgs/by-name/ag/age-plugin-se/package.nix
+++ b/pkgs/by-name/ag/age-plugin-se/package.nix
@@ -1,13 +1,14 @@
 {
   lib,
   fetchFromGitHub,
+  llvmPackages,
   swiftPackages,
   swift,
   swiftpm,
   nix-update-script,
 }:
 let
-  inherit (swiftPackages) stdenv;
+  inherit (llvmPackages) stdenv;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "age-plugin-se";
diff --git a/pkgs/by-name/ap/api-linter/package.nix b/pkgs/by-name/ap/api-linter/package.nix
index 6eeb224c6b88..faa37966618c 100644
--- a/pkgs/by-name/ap/api-linter/package.nix
+++ b/pkgs/by-name/ap/api-linter/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "api-linter";
-  version = "1.70.2";
+  version = "1.71.0";
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "api-linter";
     tag = "v${version}";
-    hash = "sha256-2ILG+FW+58WnmL5Ts1K32ee0SR15yp9NnEtmEo6r6w8=";
+    hash = "sha256-WZvaPYiz1pHW6OLl6ahV3/b9RXW6S/c/kbQxJFfAn28=";
   };
 
-  vendorHash = "sha256-CHObiSQudxZw5KjimQk8myTsLeQMBZU8SewW4I2dNsw=";
+  vendorHash = "sha256-KW5+THuV7U09ZV0eShLCDJYDPOM09/bUi7t0WiVx6pk=";
 
   subPackages = [ "cmd/api-linter" ];
 
diff --git a/pkgs/by-name/ar/argon/package.nix b/pkgs/by-name/ar/argon/package.nix
index 5be8406da410..4480dd0e86a3 100644
--- a/pkgs/by-name/ar/argon/package.nix
+++ b/pkgs/by-name/ar/argon/package.nix
@@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "argon";
-  version = "2.0.25";
+  version = "2.0.26";
 
   src = fetchFromGitHub {
     owner = "argon-rbx";
     repo = "argon";
     tag = version;
-    hash = "sha256-nQdh263qFS3seazdoNxme7SxQ7aJsRmFdoyfsZMDjw0=";
+    hash = "sha256-3IftPWrBETU7zJLaB9uTrc08c37XGmFPPArzrlIFG3Q=";
   };
 
-  cargoHash = "sha256-s3/i7RnwadgGBg0lZmttxpLC/hZUba+PGc8WD30aAQI=";
+  cargoHash = "sha256-60BQ7PsKATq5jX5DqCGdOx3xvRzwm5TAM1RtKuPy49M=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/az/azure-cli/extensions-generated.json b/pkgs/by-name/az/azure-cli/extensions-generated.json
index 4d0a3bd11a51..46fea7c8919b 100644
--- a/pkgs/by-name/az/azure-cli/extensions-generated.json
+++ b/pkgs/by-name/az/azure-cli/extensions-generated.json
@@ -36,9 +36,9 @@
   },
   "aem": {
     "pname": "aem",
-    "version": "1.0.0",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/aem-1.0.0-py2.py3-none-any.whl",
-    "hash": "sha256-3QYsiwJ7avGM4Fg8H88shs3JKBo2cOSh0F39bTN/8vA=",
+    "version": "1.0.1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/aem-1.0.1-py2.py3-none-any.whl",
+    "hash": "sha256-QDkq7GjOpqZSUFXkxrL5OjJwSnGHmRH/8r6N/Amriq0=",
     "description": "Manage Azure Enhanced Monitoring Extensions for SAP"
   },
   "ai-examples": {
@@ -50,23 +50,16 @@
   },
   "aks-preview": {
     "pname": "aks-preview",
-    "version": "18.0.0b15",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/aks_preview-18.0.0b15-py2.py3-none-any.whl",
-    "hash": "sha256-YjRPELWfLshLQHgZTa7jXS96nyYiZ7h2Gu25/wKvw7c=",
+    "version": "18.0.0b33",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/aks_preview-18.0.0b33-py2.py3-none-any.whl",
+    "hash": "sha256-Zkp5Nzl+eQ7PPniDF7/K5II2xIG6OKC3Rhm3ZTpyILc=",
     "description": "Provides a preview for upcoming AKS features"
   },
-  "akshybrid": {
-    "pname": "akshybrid",
-    "version": "0.1.2",
-    "url": "https://hybridaksstorage.z13.web.core.windows.net/HybridAKS/CLI/akshybrid-0.1.2-py3-none-any.whl",
-    "hash": "sha256-l2fNpETEIVc7wiDgHNWKZ8MKNhdc7bposEVKPG6YOo4=",
-    "description": "Microsoft Azure Command-Line Tools HybridContainerService Extension"
-  },
   "alb": {
     "pname": "alb",
-    "version": "2.0.0",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/alb-2.0.0-py3-none-any.whl",
-    "hash": "sha256-Z9Pbk2dkAqSyFDlpuyD7jsYidiTsUUnTF6GRtX0WqcM=",
+    "version": "2.0.1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/alb-2.0.1-py3-none-any.whl",
+    "hash": "sha256-B3/01NiuZFVvTGrqQK9lBEu++7hnhHGLM6bL8gvBLx4=",
     "description": "Microsoft Azure Command-Line Tools ALB Extension"
   },
   "alertsmanagement": {
@@ -78,9 +71,9 @@
   },
   "amg": {
     "pname": "amg",
-    "version": "2.6.1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/amg-2.6.1-py3-none-any.whl",
-    "hash": "sha256-ERGri8mXJtLy/acz8R2UqdmILr7JT4bTQaU6GtxhKjs=",
+    "version": "2.8.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/amg-2.8.0-py3-none-any.whl",
+    "hash": "sha256-E4Id15eoKStqeQynaHisZLcZsiApMf6uV/J8xWz/s5w=",
     "description": "Microsoft Azure Command-Line Tools Azure Managed Grafana Extension"
   },
   "amlfs": {
@@ -92,9 +85,9 @@
   },
   "apic-extension": {
     "pname": "apic-extension",
-    "version": "1.2.0b2",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/apic_extension-1.2.0b2-py3-none-any.whl",
-    "hash": "sha256-QtaiixX5daX3pOpi7jnJFH2cXe+J0+J/q9PJVZqkE28=",
+    "version": "1.2.0b3",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/apic_extension-1.2.0b3-py3-none-any.whl",
+    "hash": "sha256-ATO7B3Dzzk8nswan5Tvym7eloe3OD9ZO+yrfkpTWZns=",
     "description": "Microsoft Azure Command-Line Tools ApicExtension Extension"
   },
   "appservice-kube": {
@@ -111,6 +104,13 @@
     "hash": "sha256-Mw/R8ZdL7OFtySTjU3MbHw9EA6WONuM0dwXwHb2/A9E=",
     "description": "Microsoft Azure Command-Line Tools Arcgateway Extension"
   },
+  "arize-ai": {
+    "pname": "arize-ai",
+    "version": "1.0.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/arize_ai-1.0.0-py3-none-any.whl",
+    "hash": "sha256-re+iMmNO+fYl5j5oTGy4vm6OHATHytv5TIaYl2k6fVg=",
+    "description": "Microsoft Azure Command-Line Tools ArizeAi Extension"
+  },
   "astronomer": {
     "pname": "astronomer",
     "version": "1.0.1",
@@ -162,9 +162,9 @@
   },
   "bastion": {
     "pname": "bastion",
-    "version": "1.4.1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/bastion-1.4.1-py3-none-any.whl",
-    "hash": "sha256-Zx50jU9Vmt8vNe/50g8jWaxjeuXlHlMYVNG/v8exRmU=",
+    "version": "1.4.2",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/bastion-1.4.2-py3-none-any.whl",
+    "hash": "sha256-TTaKDFaydQ4lW+LfvEHbWX4WARj3Xwg/yeHmq9aNEoI=",
     "description": "Microsoft Azure Command-Line Tools Bastion Extension"
   },
   "billing-benefits": {
@@ -225,9 +225,9 @@
   },
   "confluent": {
     "pname": "confluent",
-    "version": "1.0.0",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/confluent-1.0.0-py3-none-any.whl",
-    "hash": "sha256-CmHPSaZdVmhow/CwCb45gua03Dw2m+nP1Cu35agO7xk=",
+    "version": "1.1.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/confluent-1.1.0-py3-none-any.whl",
+    "hash": "sha256-X/jWCmB/B01Z56Y/6xcl+4e2d7DDDsMHaqZ0/PtU6TU=",
     "description": "Microsoft Azure Command-Line Tools ConfluentManagementClient Extension"
   },
   "connectedmachine": {
@@ -246,9 +246,9 @@
   },
   "cosmosdb-preview": {
     "pname": "cosmosdb-preview",
-    "version": "1.6.0",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/cosmosdb_preview-1.6.0-py2.py3-none-any.whl",
-    "hash": "sha256-OO8IjVRhGOfsCb/Oot7Dc7PmfNsDmaXiCuG0at8Hb44=",
+    "version": "1.6.1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/cosmosdb_preview-1.6.1-py2.py3-none-any.whl",
+    "hash": "sha256-kfhttzgrlnyAoD6pe7PKjGHdKE0U6G1GYNe1a4ZA3f0=",
     "description": "Microsoft Azure Command-Line Tools Cosmosdb-preview Extension"
   },
   "costmanagement": {
@@ -258,13 +258,6 @@
     "hash": "sha256-bl4FPQW61q1jBb0CT1HjVeYP3ou2oDNQ39gcJUN9LkU=",
     "description": "Microsoft Azure Command-Line Tools CostManagementClient Extension"
   },
-  "csvmware": {
-    "pname": "csvmware",
-    "version": "0.3.0",
-    "url": "https://github.com/Azure/az-csvmware-cli/releases/download/0.3.0/csvmware-0.3.0-py2.py3-none-any.whl",
-    "hash": "sha256-37l2fwWsE8di6p3EMnFp5jpcEYeRI1RLIA7bmiyaikI=",
-    "description": "Manage Azure VMware Solution by CloudSimple"
-  },
   "custom-providers": {
     "pname": "custom-providers",
     "version": "0.2.1",
@@ -281,9 +274,9 @@
   },
   "data-transfer": {
     "pname": "data-transfer",
-    "version": "1.0.0b1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/data_transfer-1.0.0b1-py3-none-any.whl",
-    "hash": "sha256-dnF7ZpUcGP7d3uywoXZdMmr/INH5y46glKuJwrlenfU=",
+    "version": "1.0.0b2",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/data_transfer-1.0.0b2-py3-none-any.whl",
+    "hash": "sha256-PqiantcGNb58p+pQm0kQEPcVkY2dg64IfE9VZhOwz2U=",
     "description": "Microsoft Azure Command-Line Tools DataTransfer Extension"
   },
   "databox": {
@@ -316,9 +309,9 @@
   },
   "datamigration": {
     "pname": "datamigration",
-    "version": "1.0.0b5",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/datamigration-1.0.0b5-py3-none-any.whl",
-    "hash": "sha256-0ZcMgeoUIB5M+e3qrdnkerWj5jiRd3SDfyQJKip+SBI=",
+    "version": "1.0.0b6",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/datamigration-1.0.0b6-py3-none-any.whl",
+    "hash": "sha256-4YPJCSMBr+10f+FRQtOiqwbhE6POAHpYFQcdESJppzg=",
     "description": "Microsoft Azure Command-Line Tools DataMigrationManagementClient Extension"
   },
   "dataprotection": {
@@ -428,9 +421,9 @@
   },
   "elastic": {
     "pname": "elastic",
-    "version": "1.0.0b3",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/elastic-1.0.0b3-py3-none-any.whl",
-    "hash": "sha256-LzrkMNPDTdQAfIxag3SWNWjMI1WIckZCQoEcxaJuLec=",
+    "version": "1.0.0b4",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/elastic-1.0.0b4-py3-none-any.whl",
+    "hash": "sha256-+zjE4PUe1FvB7z1i4FFP3EyWBDco/dZe9DbBDMogijY=",
     "description": "Microsoft Azure Command-Line Tools MicrosoftElastic Extension"
   },
   "elastic-san": {
@@ -463,9 +456,9 @@
   },
   "fleet": {
     "pname": "fleet",
-    "version": "1.5.2",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/fleet-1.5.2-py3-none-any.whl",
-    "hash": "sha256-oshfK8G4NECSNxucAke46csKnw4eRBvOrQG2gGLCbq8=",
+    "version": "1.6.2",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/fleet-1.6.2-py3-none-any.whl",
+    "hash": "sha256-YZpmg1dWiZOerGTgotBstzYB9FgnxPKGurS7OP01Wbc=",
     "description": "Microsoft Azure Command-Line Tools Fleet Extension"
   },
   "fluid-relay": {
@@ -531,13 +524,6 @@
     "hash": "sha256-rEoQ4sxkpNCBjkj/vN3+tDB91WuIdbwBwCaH1HPJ/ps=",
     "description": "Microsoft Azure Command-Line Tools AzureDedicatedHSMResourceProvider Extension"
   },
-  "hdinsightonaks": {
-    "pname": "hdinsightonaks",
-    "version": "1.0.0b3",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/hdinsightonaks-1.0.0b3-py3-none-any.whl",
-    "hash": "sha256-9Um4UQe3uD/2T8+lyQpdfpAKXqLv527smx+BaJ5Yw2U=",
-    "description": "Microsoft Azure Command-Line Tools Hdinsightonaks Extension"
-  },
   "healthbot": {
     "pname": "healthbot",
     "version": "0.1.0",
@@ -561,9 +547,9 @@
   },
   "image-copy-extension": {
     "pname": "image-copy-extension",
-    "version": "1.0.2",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/image_copy_extension-1.0.2-py2.py3-none-any.whl",
-    "hash": "sha256-POLkBXJTiA9mZ8ezYUJDcl3/CSClNdffYBcQbJTbolY=",
+    "version": "1.0.3",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/image_copy_extension-1.0.3-py2.py3-none-any.whl",
+    "hash": "sha256-YTQFsRYinh4Bk2p747oyMAsC3a9rKiR444woUeGTKGg=",
     "description": "Support for copying managed vm images between regions"
   },
   "image-gallery": {
@@ -610,9 +596,9 @@
   },
   "k8s-extension": {
     "pname": "k8s-extension",
-    "version": "1.6.5",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/k8s_extension-1.6.5-py3-none-any.whl",
-    "hash": "sha256-MZJr6cLtg9m1TD5aYHw2ynfI1Rin5UvaAS7k0QsmZ7k=",
+    "version": "1.6.7",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/k8s_extension-1.6.7-py3-none-any.whl",
+    "hash": "sha256-TU2bAc44Zpd//GyziclX7V8BU1cExK/SduKLV++FxqE=",
     "description": "Microsoft Azure Command-Line Tools K8s-extension Extension"
   },
   "k8s-runtime": {
@@ -631,9 +617,9 @@
   },
   "lambda-test": {
     "pname": "lambda-test",
-    "version": "1.0.0b1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/lambda_test-1.0.0b1-py3-none-any.whl",
-    "hash": "sha256-KnNCZsTNn4948xKiHJ6Nba3NYLHy+T5yEF55BtQ9a1Q=",
+    "version": "1.0.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/lambda_test-1.0.0-py3-none-any.whl",
+    "hash": "sha256-6C2Db8ZPDRs8QY2v1RM2cyGVIM/hwtpBAj6c9V4CXxQ=",
     "description": "Microsoft Azure Command-Line Tools LambdaTest Extension"
   },
   "log-analytics": {
@@ -673,9 +659,9 @@
   },
   "managednetworkfabric": {
     "pname": "managednetworkfabric",
-    "version": "8.0.0b5",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/managednetworkfabric-8.0.0b5-py3-none-any.whl",
-    "hash": "sha256-+6ueiYJnSMnGbawqTGoKkbN9Fvl5NCJuz3RUXW6mGBk=",
+    "version": "8.1.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/managednetworkfabric-8.1.0-py3-none-any.whl",
+    "hash": "sha256-HWfTuuYq3P02F3zaK8s8HLkqRcdP7/dWwCy/nX/y4u8=",
     "description": "Support for managednetworkfabric commands based on 2024-06-15-preview API version"
   },
   "managementpartner": {
@@ -722,9 +708,9 @@
   },
   "mongo-db": {
     "pname": "mongo-db",
-    "version": "1.0.0b1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/mongo_db-1.0.0b1-py3-none-any.whl",
-    "hash": "sha256-z/i+P/kx4MT8XskhqjohRL3Xpne9teLe6jmfCv6iv+0=",
+    "version": "1.0.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/mongo_db-1.0.0-py3-none-any.whl",
+    "hash": "sha256-kbU/GRizMppGD2OJ29awQaFUXIMLin0DJpX8Nnymqzo=",
     "description": "Microsoft Azure Command-Line Tools MongoDb Extension"
   },
   "monitor-control-service": {
@@ -750,9 +736,9 @@
   },
   "neon": {
     "pname": "neon",
-    "version": "1.0.0b4",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/neon-1.0.0b4-py3-none-any.whl",
-    "hash": "sha256-iak+Dt5UD+YpVO1mQzatzIYybEyVIZaRabL0Jbgr17M=",
+    "version": "1.0.0b6",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/neon-1.0.0b6-py3-none-any.whl",
+    "hash": "sha256-qCyfYQIDoZo8l1bPYDJsLTFfBQJEi7/FyNL6jmS1tTc=",
     "description": "Microsoft Azure Command-Line Tools Neon Extension"
   },
   "network-analytics": {
@@ -771,9 +757,9 @@
   },
   "new-relic": {
     "pname": "new-relic",
-    "version": "1.0.1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/new_relic-1.0.1-py3-none-any.whl",
-    "hash": "sha256-VKbfg2sflMylsHcjvJ1QUhbVW3fOG+JViuCSIt4mJ2A=",
+    "version": "1.0.2",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/new_relic-1.0.2-py3-none-any.whl",
+    "hash": "sha256-/h2TeDcQyRFvcZBwNzxcPrlf638sjfZxYZ97pm7AxB4=",
     "description": "Microsoft Azure Command-Line Tools NewRelic Extension"
   },
   "next": {
@@ -827,9 +813,9 @@
   },
   "palo-alto-networks": {
     "pname": "palo-alto-networks",
-    "version": "1.1.1b1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/palo_alto_networks-1.1.1b1-py3-none-any.whl",
-    "hash": "sha256-jU9qS3I2a9V3gL0VjWwls2OZnhoT6oXUkYCcyaTSlgg=",
+    "version": "1.1.2b2",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/palo_alto_networks-1.1.2b2-py3-none-any.whl",
+    "hash": "sha256-xOjYa4QakDrL4Xud0OHvJuY7Df2l2B1mnqw8aMlqiAg=",
     "description": "Microsoft Azure Command-Line Tools PaloAltoNetworks Extension"
   },
   "peering": {
@@ -867,6 +853,13 @@
     "hash": "sha256-mqrXcCKvAEqWOzQZrBDSM4IO81Jduen2+fx5fhqFmtY=",
     "description": "Microsoft Azure Command-Line Tools ProviderHub Extension"
   },
+  "pscloud": {
+    "pname": "pscloud",
+    "version": "1.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/pscloud-1.0.0b1-py3-none-any.whl",
+    "hash": "sha256-aIobuwrf1z72gUzYZLLIzk1mRrsbIfWlxgpfJ+1n20U=",
+    "description": "Microsoft Azure Command-Line Tools Pscloud Extension"
+  },
   "purview": {
     "pname": "purview",
     "version": "0.1.0",
@@ -876,9 +869,9 @@
   },
   "quantum": {
     "pname": "quantum",
-    "version": "1.0.0b6",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/quantum-1.0.0b6-py3-none-any.whl",
-    "hash": "sha256-KTYDvglCzrPy4XWsPbBvKKhFI1/mxKwsyBi5/8q2+y8=",
+    "version": "1.0.0b9",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/quantum-1.0.0b9-py3-none-any.whl",
+    "hash": "sha256-DYnSYOsA+nZJ9V2JIqIHB/697a9ATJLBneyrPsHGoVY=",
     "description": "Microsoft Azure Command-Line Tools Quantum Extension"
   },
   "qumulo": {
@@ -974,9 +967,9 @@
   },
   "stack-hci-vm": {
     "pname": "stack-hci-vm",
-    "version": "1.9.1",
-    "url": "https://hciarcvmsstorage.z13.web.core.windows.net/cli-extensions/stack_hci_vm-1.9.1-py3-none-any.whl",
-    "hash": "sha256-BZSQ1tVLSkQE+jQPpZWIHEoM/86RPKT5kAlmKmNa0qY=",
+    "version": "1.10.4",
+    "url": "https://hciarcvmsstorage.z13.web.core.windows.net/cli-extensions/stack_hci_vm-1.10.4-py3-none-any.whl",
+    "hash": "sha256-MjcpQ7a+5Rw6Z7MAVzoa/qT6HSX6uaV+kWoiMBhK/JM=",
     "description": "Microsoft Azure Command-Line Tools Stack-HCi-VM Extension"
   },
   "standbypool": {
@@ -1002,11 +995,18 @@
   },
   "storage-blob-preview": {
     "pname": "storage-blob-preview",
-    "version": "1.0.0b1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/storage_blob_preview-1.0.0b1-py2.py3-none-any.whl",
-    "hash": "sha256-H/5FHkFlfI8ooiq+44c3HRHO3YDS5Sz8vtCtrAqRe0E=",
+    "version": "1.0.0b3",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/storage_blob_preview-1.0.0b3-py2.py3-none-any.whl",
+    "hash": "sha256-88MkEV7z+bGUJXxv16lu14Xj8uRh2wWTji1O3nswYq8=",
     "description": "Microsoft Azure Command-Line Tools Storage-blob-preview Extension"
   },
+  "storage-discovery": {
+    "pname": "storage-discovery",
+    "version": "1.0.0b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/storage_discovery-1.0.0b1-py3-none-any.whl",
+    "hash": "sha256-qa4B0qEbeg09vZRN1E4J2E5LvwbrPd2OG1V/WOhfI1o=",
+    "description": "Microsoft Azure Command-Line Tools StorageDiscovery Extension"
+  },
   "storage-mover": {
     "pname": "storage-mover",
     "version": "1.1.0",
@@ -1072,9 +1072,9 @@
   },
   "virtual-network-manager": {
     "pname": "virtual-network-manager",
-    "version": "2.0.0",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/virtual_network_manager-2.0.0-py3-none-any.whl",
-    "hash": "sha256-EbmCqrszG4PC80yCDl+IfzdKw0tO4R0SL6iD+wymu9w=",
+    "version": "2.0.1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/virtual_network_manager-2.0.1-py3-none-any.whl",
+    "hash": "sha256-p/qdOH8arVdfUoslBT0Al26hMihL8VPMClfNZhwtxto=",
     "description": "Microsoft Azure Command-Line Tools NetworkManagementClient Extension"
   },
   "virtual-network-tap": {
@@ -1093,9 +1093,9 @@
   },
   "vme": {
     "pname": "vme",
-    "version": "1.0.0b4",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/vme-1.0.0b4-py3-none-any.whl",
-    "hash": "sha256-TMOUIL/cntB9DcQubv7B1OMs+nSwv2RRcFD6KCRwFrk=",
+    "version": "1.0.0b5",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/vme-1.0.0b5-py3-none-any.whl",
+    "hash": "sha256-DVb8jVymvcXEEmPsz+qGh3Q3iTFVTI904VD3Kq5d3fc=",
     "description": "Microsoft Azure Command-Line Tools Vme Extension"
   },
   "vmware": {
@@ -1114,9 +1114,9 @@
   },
   "workload-orchestration": {
     "pname": "workload-orchestration",
-    "version": "1.0.0",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/workload_orchestration-1.0.0-py3-none-any.whl",
-    "hash": "sha256-5o0meWmZDeM45AGTTkD9weX1/tcdg7JJzW1XJRWVdkE=",
+    "version": "2.0.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/workload_orchestration-2.0.0-py3-none-any.whl",
+    "hash": "sha256-19yRNNBkY4h+KR4RMeu8rGox1kFKDYOdaNM/dEwSrSU=",
     "description": "Microsoft Azure Command-Line Tools WorkloadOperations Extension"
   },
   "workloads": {
diff --git a/pkgs/by-name/az/azure-cli/extensions-manual.nix b/pkgs/by-name/az/azure-cli/extensions-manual.nix
index f5a2155c0d1c..abb5abef805b 100644
--- a/pkgs/by-name/az/azure-cli/extensions-manual.nix
+++ b/pkgs/by-name/az/azure-cli/extensions-manual.nix
@@ -151,11 +151,14 @@
 // lib.optionalAttrs config.allowAliases {
   # Removed extensions
   adp = throw "The 'adp' extension for azure-cli was deprecated upstream"; # Added 2024-11-02, https://github.com/Azure/azure-cli-extensions/pull/8038
+  akshybrid = throw "The 'akshybrid' extension for azure-cli was removed upstream"; # https://github.com/Azure/azure-cli-extensions/pull/8955
   azurestackhci = throw "The 'azurestackhci' extension for azure-cli was deprecated upstream"; # Added 2025-07-01, https://github.com/Azure/azure-cli-extensions/pull/8898
   blockchain = throw "The 'blockchain' extension for azure-cli was deprecated upstream"; # Added 2024-04-26, https://github.com/Azure/azure-cli-extensions/pull/7370
   compute-diagnostic-rp = throw "The 'compute-diagnostic-rp' extension for azure-cli was deprecated upstream"; # Added 2024-11-12, https://github.com/Azure/azure-cli-extensions/pull/8240
   connection-monitor-preview = throw "The 'connection-monitor-preview' extension for azure-cli was deprecated upstream"; # Added 2024-11-02, https://github.com/Azure/azure-cli-extensions/pull/8194
+  csvmware = throw "The 'csvmware' extension for azure-cli was removed upstream"; # https://github.com/Azure/azure-cli-extensions/pull/8931
   deidservice = throw "The 'deidservice' extension for azure-cli was moved under healthcareapis"; # Added 2024-11-19, https://github.com/Azure/azure-cli-extensions/pull/8224
+  hdinsightonaks = throw "The 'hdinsightonaks' extension for azure-cli was removed upstream"; # https://github.com/Azure/azure-cli-extensions/pull/8956
   logz = throw "The 'logz' extension for azure-cli was deprecated upstream"; # Added 2024-11-02, https://github.com/Azure/azure-cli-extensions/pull/8459
   pinecone = throw "The 'pinecone' extension for azure-cli was removed upstream"; # Added 2025-06-03, https://github.com/Azure/azure-cli-extensions/pull/8763
   sap-hana = throw "The 'sap-hana' extension for azure-cli was deprecated upstream"; # Added 2025-07-01, https://github.com/Azure/azure-cli-extensions/pull/8904
diff --git a/pkgs/by-name/ba/base16384/package.nix b/pkgs/by-name/ba/base16384/package.nix
index b5d004c7d71d..ca6badfda00d 100644
--- a/pkgs/by-name/ba/base16384/package.nix
+++ b/pkgs/by-name/ba/base16384/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "base16384";
-  version = "2.3.1";
+  version = "2.3.2";
 
   src = fetchFromGitHub {
     owner = "fumiama";
     repo = "base16384";
     rev = "v${version}";
-    hash = "sha256-2HZeom+8eEH4CrphCoOV+wJbqhYKVUcAQrYLyEVACkQ=";
+    hash = "sha256-Xkub0sWT+1oJlznDnnV1mDgQNiMQj8gsWemrCOAYYgE=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/bp/bpftop/package.nix b/pkgs/by-name/bp/bpftop/package.nix
index 4421eb8e9dac..d6585257cc9b 100644
--- a/pkgs/by-name/bp/bpftop/package.nix
+++ b/pkgs/by-name/bp/bpftop/package.nix
@@ -10,7 +10,7 @@
 }:
 let
   pname = "bpftop";
-  version = "0.7.0";
+  version = "0.7.1";
 in
 rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } {
   inherit pname version;
@@ -18,10 +18,10 @@ rustPlatform.buildRustPackage.override { stdenv = clangStdenv; } {
     owner = "Netflix";
     repo = "bpftop";
     tag = "v${version}";
-    hash = "sha256-h6iNc2z5UF+Z4FTaZXfhbz7gIIGlT8pbJ7OcP6uZENc=";
+    hash = "sha256-8vb32+wHOnADpIIfO9mMlGu7GdlA0hS9ij0zSLcrO7A=";
   };
 
-  cargoHash = "sha256-Z7E61XiEKM6zKm7LFIXPYCFoSwSHfq6QCfbRMmiBW+o=";
+  cargoHash = "sha256-euiI4R4nCgnwiBA22kzn0c91hjOr0IOOAyFkW5ZadIk=";
 
   buildInputs = [
     elfutils
diff --git a/pkgs/by-name/bu/butterfly/gitHashes.json b/pkgs/by-name/bu/butterfly/gitHashes.json
index 91bfb336e105..112579c175ea 100644
--- a/pkgs/by-name/bu/butterfly/gitHashes.json
+++ b/pkgs/by-name/bu/butterfly/gitHashes.json
@@ -1,6 +1,6 @@
 {
   "dart_leap": "sha256-oO5851cIdrW/asgOePxvwUgjn1XchkH9CKJUruvlLYI=",
-  "lw_file_system": "sha256-P5zr781SKHqZGwM2dNRi0O53oZuaY2zaM7q2Z7th0F4=",
+  "lw_file_system": "sha256-S2zNpZWPtUH8Q+gUPEX9zW+agH8rq6Wsz7aj/i1DF9c=",
   "lw_file_system_api": "sha256-/Ur9zu4Ovb4x8j1n6Q6FWFuJ9yp92YQG3b7H5CMf3II=",
   "lw_sysapi": "sha256-oGs5q8N46WNcRzbsgsPB/6fVBH3g9utK4tlXBpwU4Qc=",
   "material_leap": "sha256-AHkXi+ENvLmJBXyF8jdXOCn/CThb6/LDr18gl9sL0XE=",
diff --git a/pkgs/by-name/bu/butterfly/package.nix b/pkgs/by-name/bu/butterfly/package.nix
index 47b684f3d4f2..4b6664f1520e 100644
--- a/pkgs/by-name/bu/butterfly/package.nix
+++ b/pkgs/by-name/bu/butterfly/package.nix
@@ -9,13 +9,13 @@
 }:
 
 let
-  version = "2.3.3";
+  version = "2.3.4";
 
   src = fetchFromGitHub {
     owner = "LinwoodDev";
     repo = "Butterfly";
     tag = "v${version}";
-    hash = "sha256-3cDT1t74SrDUqUtFmNZFQHUx+eCdDjZhPseT3lhNOYE=";
+    hash = "sha256-qmgM6h2HxvRwUv4UwkIBR3uYz2NiaWEgJWWjrpumQug=";
   };
 in
 flutter332.buildFlutterApplication {
@@ -40,7 +40,7 @@ flutter332.buildFlutterApplication {
           nativeBuildInputs = [ yq-go ];
         }
         ''
-          yq eval --output-format=json --prettyPrint $src/pubspec.lock > "$out"
+          yq eval --output-format=json --prettyPrint $src/app/pubspec.lock > "$out"
         '';
     updateScript = _experimental-update-script-combinators.sequence [
       (gitUpdater {
diff --git a/pkgs/by-name/bu/butterfly/pubspec.lock.json b/pkgs/by-name/bu/butterfly/pubspec.lock.json
index c997c6ec520e..f781dc3eb04c 100644
--- a/pkgs/by-name/bu/butterfly/pubspec.lock.json
+++ b/pkgs/by-name/bu/butterfly/pubspec.lock.json
@@ -114,21 +114,21 @@
       "dependency": "transitive",
       "description": {
         "name": "build",
-        "sha256": "7d95cbbb1526ab5ae977df9b4cc660963b9b27f6d1075c0b34653868911385e4",
+        "sha256": "6439a9c71a4e6eca8d9490c1b380a25b02675aa688137dfbe66d2062884a23ac",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.0.0"
+      "version": "3.0.2"
     },
     "build_config": {
       "dependency": "transitive",
       "description": {
         "name": "build_config",
-        "sha256": "4ae2de3e1e67ea270081eaee972e1bd8f027d459f249e0f1186730784c2e7e33",
+        "sha256": "4f64382b97504dc2fcdf487d5aae33418e08b4703fc21249e4db6d804a4d0187",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.2"
+      "version": "1.2.0"
     },
     "build_daemon": {
       "dependency": "transitive",
@@ -144,31 +144,31 @@
       "dependency": "transitive",
       "description": {
         "name": "build_resolvers",
-        "sha256": "38c9c339333a09b090a638849a4c56e70a404c6bdd3b511493addfbc113b60c2",
+        "sha256": "2b21a125d66a86b9511cc3fb6c668c42e9a1185083922bf60e46d483a81a9712",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.0.0"
+      "version": "3.0.2"
     },
     "build_runner": {
       "dependency": "direct dev",
       "description": {
         "name": "build_runner",
-        "sha256": "b971d4a1c789eba7be3e6fe6ce5e5b50fd3719e3cb485b3fad6d04358304351d",
+        "sha256": "fd3c09f4bbff7fa6e8d8ef688a0b2e8a6384e6483a25af0dac75fef362bcfe6f",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.6.0"
+      "version": "2.7.0"
     },
     "build_runner_core": {
       "dependency": "transitive",
       "description": {
         "name": "build_runner_core",
-        "sha256": "c04e612ca801cd0928ccdb891c263a2b1391cb27940a5ea5afcf9ba894de5d62",
+        "sha256": "ab27e46c8aa233e610cf6084ee6d8a22c6f873a0a9929241d8855b7a72978ae7",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "9.2.0"
+      "version": "9.3.0"
     },
     "built_collection": {
       "dependency": "transitive",
@@ -184,11 +184,11 @@
       "dependency": "transitive",
       "description": {
         "name": "built_value",
-        "sha256": "0b1b12a0a549605e5f04476031cd0bc91ead1d7c8e830773a18ee54179b3cb62",
+        "sha256": "ba95c961bafcd8686d1cf63be864eb59447e795e124d98d6a27d91fcd13602fb",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.11.0"
+      "version": "8.11.1"
     },
     "butterfly_api": {
       "dependency": "direct main",
@@ -197,7 +197,7 @@
         "relative": true
       },
       "source": "path",
-      "version": "2.3.3"
+      "version": "2.3.4"
     },
     "camera": {
       "dependency": "direct main",
@@ -223,11 +223,11 @@
       "dependency": "transitive",
       "description": {
         "name": "camera_avfoundation",
-        "sha256": "04e1f052ef268085a4f0550389211cc46005a9af015e444c7b1ee7aa19332e5d",
+        "sha256": "e4aca5bccaf897b70cac87e5fdd789393310985202442837922fd40325e2733b",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.9.20+6"
+      "version": "0.9.21+1"
     },
     "camera_platform_interface": {
       "dependency": "transitive",
@@ -323,11 +323,11 @@
       "dependency": "direct main",
       "description": {
         "name": "connectivity_plus",
-        "sha256": "051849e2bd7c7b3bc5844ea0d096609ddc3a859890ec3a9ac4a65a2620cc1f99",
+        "sha256": "b5e72753cf63becce2c61fd04dfe0f1c430cc5278b53a1342dc5ad839eab29ec",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.1.4"
+      "version": "6.1.5"
     },
     "connectivity_plus_platform_interface": {
       "dependency": "transitive",
@@ -414,11 +414,11 @@
       "dependency": "transitive",
       "description": {
         "name": "dart_mappable",
-        "sha256": "2255b2c00e328a65fef5a8df2dabfc0dc9c2e518c33a50051a4519b1c7a28c48",
+        "sha256": "15f41a35da8ee690bbfa0059fa241edeeaea73f89a2ba685b354ece07cd8ada6",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.5.0"
+      "version": "4.6.0"
     },
     "dart_style": {
       "dependency": "transitive",
@@ -464,11 +464,11 @@
       "dependency": "direct main",
       "description": {
         "name": "dynamic_color",
-        "sha256": "eae98052fa6e2826bdac3dd2e921c6ce2903be15c6b7f8b6d8a5d49b5086298d",
+        "sha256": "43a5a6679649a7731ab860334a5812f2067c2d9ce6452cf069c5e0c25336c17c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.7.0"
+      "version": "1.8.1"
     },
     "equatable": {
       "dependency": "direct main",
@@ -524,21 +524,21 @@
       "dependency": "transitive",
       "description": {
         "name": "file_selector_android",
-        "sha256": "6bba3d590ee9462758879741abc132a19133600dd31832f55627442f1ebd7b54",
+        "sha256": "3015702ab73987000e7ff2df5ddc99666d2bcd65cdb243f59da35729d3be6cff",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.5.1+14"
+      "version": "0.5.1+15"
     },
     "file_selector_ios": {
       "dependency": "transitive",
       "description": {
         "name": "file_selector_ios",
-        "sha256": "94b98ad950b8d40d96fee8fa88640c2e4bd8afcdd4817993bd04e20310f45420",
+        "sha256": "fe9f52123af16bba4ad65bd7e03defbbb4b172a38a8e6aaa2a869a0c56a5f5fb",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.5.3+1"
+      "version": "0.5.3+2"
     },
     "file_selector_linux": {
       "dependency": "transitive",
@@ -554,11 +554,11 @@
       "dependency": "transitive",
       "description": {
         "name": "file_selector_macos",
-        "sha256": "8c9250b2bd2d8d4268e39c82543bacbaca0fda7d29e0728c3c4bbb7c820fd711",
+        "sha256": "19124ff4a3d8864fdc62072b6a2ef6c222d55a3404fe14893a3c02744907b60c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.9.4+3"
+      "version": "0.9.4+4"
     },
     "file_selector_platform_interface": {
       "dependency": "transitive",
@@ -672,11 +672,11 @@
       "dependency": "transitive",
       "description": {
         "name": "flutter_plugin_android_lifecycle",
-        "sha256": "f948e346c12f8d5480d2825e03de228d0eb8c3a737e4cdaa122267b89c022b5e",
+        "sha256": "6382ce712ff69b0f719640ce957559dde459e55ecd433c767e06d139ddf16cab",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.0.28"
+      "version": "2.0.29"
     },
     "flutter_secure_storage": {
       "dependency": "direct main",
@@ -800,11 +800,11 @@
       "dependency": "transitive",
       "description": {
         "name": "get_it",
-        "sha256": "e87cd1d108e472a0580348a543a0c49ed3d70c8a5c809c6d418583e595d0a389",
+        "sha256": "a4292e7cf67193f8e7c1258203104eb2a51ec8b3a04baa14695f4064c144297b",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.1.0"
+      "version": "8.2.0"
     },
     "glob": {
       "dependency": "transitive",
@@ -820,11 +820,11 @@
       "dependency": "direct main",
       "description": {
         "name": "go_router",
-        "sha256": "c489908a54ce2131f1d1b7cc631af9c1a06fac5ca7c449e959192089f9489431",
+        "sha256": "8b1f37dfaf6e958c6b872322db06f946509433bec3de753c3491a42ae9ec2b48",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "16.0.0"
+      "version": "16.1.0"
     },
     "graphs": {
       "dependency": "transitive",
@@ -840,11 +840,11 @@
       "dependency": "direct main",
       "description": {
         "name": "http",
-        "sha256": "2c11f3f94c687ee9bad77c171151672986360b2b001d109814ee7140b2cf261b",
+        "sha256": "bb2ce4590bc2667c96f318d68cac1b5a7987ec819351d32b1c987239a815e007",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.4.0"
+      "version": "1.5.0"
     },
     "http_multi_server": {
       "dependency": "transitive",
@@ -1016,8 +1016,8 @@
       "dependency": "direct main",
       "description": {
         "path": "packages/lw_file_system",
-        "ref": "ad67d9835e5fc673c9e7d1bcaad10c89423d4b61",
-        "resolved-ref": "ad67d9835e5fc673c9e7d1bcaad10c89423d4b61",
+        "ref": "3eb0c455dd56cfcde08a7c7efaba5adbc38dd976",
+        "resolved-ref": "3eb0c455dd56cfcde08a7c7efaba5adbc38dd976",
         "url": "https://github.com/LinwoodDev/dart_pkgs.git"
       },
       "source": "git",
@@ -1110,11 +1110,11 @@
       "dependency": "direct dev",
       "description": {
         "name": "msix",
-        "sha256": "bbb9b3ff4a9f8e7e7507b2a22dc0517fd1fe3db44e72de7ab052cb6b362406ee",
+        "sha256": "f88033fcb9e0dd8de5b18897cbebbd28ea30596810f4a7c86b12b0c03ace87e5",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.16.10"
+      "version": "3.16.12"
     },
     "nested": {
       "dependency": "transitive",
@@ -1213,21 +1213,21 @@
       "dependency": "direct main",
       "description": {
         "name": "package_info_plus",
-        "sha256": "7976bfe4c583170d6cdc7077e3237560b364149fcd268b5f53d95a991963b191",
+        "sha256": "16eee997588c60225bda0488b6dcfac69280a6b7a3cf02c741895dd370a02968",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.3.0"
+      "version": "8.3.1"
     },
     "package_info_plus_platform_interface": {
       "dependency": "transitive",
       "description": {
         "name": "package_info_plus_platform_interface",
-        "sha256": "6c935fb612dff8e3cc9632c2b301720c77450a126114126ffaafe28d2e87956c",
+        "sha256": "202a487f08836a592a6bd4f901ac69b3a8f146af552bbd14407b6b41e1c3f086",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.2.0"
+      "version": "3.2.1"
     },
     "path": {
       "dependency": "transitive",
@@ -1273,11 +1273,11 @@
       "dependency": "transitive",
       "description": {
         "name": "path_provider_foundation",
-        "sha256": "4843174df4d288f5e29185bd6e72a6fbdf5a4a4602717eed565497429f179942",
+        "sha256": "16eef174aacb07e09c351502740fa6254c165757638eba1e9116b0a781201bbd",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.1"
+      "version": "2.4.2"
     },
     "path_provider_linux": {
       "dependency": "transitive",
@@ -1575,21 +1575,21 @@
       "dependency": "direct main",
       "description": {
         "name": "share_plus",
-        "sha256": "b2961506569e28948d75ec346c28775bb111986bb69dc6a20754a457e3d97fa0",
+        "sha256": "d7dc0630a923883c6328ca31b89aa682bacbf2f8304162d29f7c6aaff03a27a1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "11.0.0"
+      "version": "11.1.0"
     },
     "share_plus_platform_interface": {
       "dependency": "transitive",
       "description": {
         "name": "share_plus_platform_interface",
-        "sha256": "1032d392bc5d2095a77447a805aa3f804d2ae6a4d5eef5e6ebb3bd94c1bc19ef",
+        "sha256": "88023e53a13429bd65d8e85e11a9b484f49d4c190abbd96c7932b74d6927cc9a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.0.0"
+      "version": "6.1.0"
     },
     "shared_preferences": {
       "dependency": "direct main",
@@ -1605,11 +1605,11 @@
       "dependency": "transitive",
       "description": {
         "name": "shared_preferences_android",
-        "sha256": "20cbd561f743a342c76c151d6ddb93a9ce6005751e7aa458baad3858bfbfb6ac",
+        "sha256": "5bcf0772a761b04f8c6bf814721713de6f3e5d9d89caf8d3fe031b02a342379e",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.10"
+      "version": "2.4.11"
     },
     "shared_preferences_foundation": {
       "dependency": "transitive",
@@ -1691,21 +1691,21 @@
       "dependency": "transitive",
       "description": {
         "name": "source_gen",
-        "sha256": "fc787b1f89ceac9580c3616f899c9a447413cbdac1df071302127764c023a134",
+        "sha256": "7b19d6ba131c6eb98bfcbf8d56c1a7002eba438af2e7ae6f8398b2b0f4f381e3",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.0.0"
+      "version": "3.1.0"
     },
     "source_helper": {
       "dependency": "transitive",
       "description": {
         "name": "source_helper",
-        "sha256": "4f81479fe5194a622cdd1713fe1ecb683a6e6c85cd8cec8e2e35ee5ab3fdf2a1",
+        "sha256": "a447acb083d3a5ef17f983dd36201aeea33fedadb3228fa831f2f0c92f0f3aca",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.3.6"
+      "version": "1.3.7"
     },
     "source_span": {
       "dependency": "transitive",
@@ -1882,21 +1882,21 @@
       "dependency": "transitive",
       "description": {
         "name": "url_launcher_android",
-        "sha256": "8582d7f6fe14d2652b4c45c9b6c14c0b678c2af2d083a11b604caeba51930d79",
+        "sha256": "0aedad096a85b49df2e4725fa32118f9fa580f3b14af7a2d2221896a02cd5656",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.3.16"
+      "version": "6.3.17"
     },
     "url_launcher_ios": {
       "dependency": "transitive",
       "description": {
         "name": "url_launcher_ios",
-        "sha256": "7f2022359d4c099eea7df3fdf739f7d3d3b9faf3166fb1dd390775176e0b76cb",
+        "sha256": "d80b3f567a617cb923546034cc94bfe44eb15f989fe670b37f26abdb9d939cb7",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.3.3"
+      "version": "6.3.4"
     },
     "url_launcher_linux": {
       "dependency": "transitive",
@@ -1912,11 +1912,11 @@
       "dependency": "transitive",
       "description": {
         "name": "url_launcher_macos",
-        "sha256": "17ba2000b847f334f16626a574c702b196723af2a289e7a93ffcb79acff855c2",
+        "sha256": "c043a77d6600ac9c38300567f33ef12b0ef4f4783a2c1f00231d2b1941fea13f",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.2.2"
+      "version": "3.2.3"
     },
     "url_launcher_platform_interface": {
       "dependency": "transitive",
@@ -1982,11 +1982,11 @@
       "dependency": "transitive",
       "description": {
         "name": "vector_graphics_compiler",
-        "sha256": "557a315b7d2a6dbb0aaaff84d857967ce6bdc96a63dc6ee2a57ce5a6ee5d3331",
+        "sha256": "ca81fdfaf62a5ab45d7296614aea108d2c7d0efca8393e96174bf4d51e6725b0",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.17"
+      "version": "1.1.18"
     },
     "vector_math": {
       "dependency": "transitive",
diff --git a/pkgs/by-name/ca/catalyst/package.nix b/pkgs/by-name/ca/catalyst/package.nix
index 0f0ef574fab7..ad433092bc2a 100644
--- a/pkgs/by-name/ca/catalyst/package.nix
+++ b/pkgs/by-name/ca/catalyst/package.nix
@@ -65,10 +65,6 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "CATALYST_BUILD_TESTING" finalAttrs.finalPackage.doCheck)
   ];
 
-  postInstall = lib.optionalString pythonSupport ''
-    python -m compileall -s $out $out/${python3Packages.python.sitePackages}
-  '';
-
   doCheck = true;
 
   preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
diff --git a/pkgs/by-name/ca/catt/package.nix b/pkgs/by-name/ca/catt/package.nix
index 433b60f53a36..6178174355ca 100644
--- a/pkgs/by-name/ca/catt/package.nix
+++ b/pkgs/by-name/ca/catt/package.nix
@@ -1,58 +1,28 @@
 {
   lib,
   fetchPypi,
-  fetchpatch,
-  python3,
+  python3Packages,
 }:
-
-let
-  python = python3.override {
-    self = python;
-    packageOverrides = self: super: {
-      pychromecast = super.pychromecast.overridePythonAttrs (_: rec {
-        version = "13.1.0";
-
-        src = fetchPypi {
-          pname = "PyChromecast";
-          inherit version;
-          hash = "sha256-COYai1S9IRnTyasewBNtPYVjqpfgo7V4QViLm+YMJnY=";
-        };
-
-        postPatch = "";
-      });
-    };
-  };
-in
-
-python.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "catt";
-  version = "0.12.11";
-  format = "pyproject";
+  version = "0.13.1";
+  pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-0bqYYfWwF7yYoAbjZPhi/f4CLcL89imWGYaMi5Bwhtc=";
+    hash = "sha256-hlCB06l4nzafvcnBNCXWiJsJNmP8n731bQgq5xvUZvM=";
   };
 
-  patches = [
-    (fetchpatch {
-      # set explicit build-system
-      url = "https://github.com/skorokithakis/catt/commit/08e7870a239e85badd30982556adc2aa8a8e4fc1.patch";
-      hash = "sha256-QH5uN3zQNVPP6Th2LHdDBF53WxwMhoyhhQUAZOeHh4k=";
-    })
+  build-system = [
+    python3Packages.poetry-core
   ];
 
-  nativeBuildInputs = with python.pkgs; [
-    poetry-core
-  ];
-
-  propagatedBuildInputs = with python.pkgs; [
-    click
-    ifaddr
-    pychromecast
-    protobuf
-    requests
-    yt-dlp
+  dependencies = [
+    python3Packages.click
+    python3Packages.ifaddr
+    python3Packages.pychromecast
+    python3Packages.requests
+    python3Packages.yt-dlp
   ];
 
   doCheck = false; # attempts to access various URLs
@@ -61,11 +31,12 @@ python.pkgs.buildPythonApplication rec {
     "catt"
   ];
 
-  meta = with lib; {
-    description = "Tool to send media from online sources to Chromecast devices";
+  meta = {
+    description = "Send media from online sources to Chromecast devices";
     homepage = "https://github.com/skorokithakis/catt";
-    license = licenses.bsd2;
-    maintainers = [ ];
+    changelog = "https://github.com/skorokithakis/catt/releases/tag/v${version}";
+    license = lib.licenses.bsd2;
+    maintainers = [ lib.maintainers.RossSmyth ];
     mainProgram = "catt";
   };
 }
diff --git a/pkgs/by-name/cf/cfclient/package.nix b/pkgs/by-name/cf/cfclient/package.nix
index d744757fe5d5..6443e83082d6 100644
--- a/pkgs/by-name/cf/cfclient/package.nix
+++ b/pkgs/by-name/cf/cfclient/package.nix
@@ -37,6 +37,7 @@ python3Packages.buildPythonApplication rec {
   pythonRelaxDeps = [
     "numpy"
     "pyqt6"
+    "pyzmq"
     "vispy"
   ];
 
diff --git a/pkgs/by-name/ch/chatterino2/common.nix b/pkgs/by-name/ch/chatterino2/common.nix
index 0e8fb6cd4bb1..3f45d34812a9 100644
--- a/pkgs/by-name/ch/chatterino2/common.nix
+++ b/pkgs/by-name/ch/chatterino2/common.nix
@@ -38,6 +38,12 @@ stdenv.mkDerivation {
     ]
     ++ lib.optional enableAvifSupport libavif;
 
+  preConfigure = ''
+    if [[ -f "$src/GIT_HASH" ]]; then
+      export GIT_HASH="$(cat $src/GIT_HASH)"
+    fi
+  '';
+
   cmakeFlags = [
     (lib.cmakeBool "BUILD_WITH_QT6" true)
     (lib.cmakeBool "USE_SYSTEM_QTKEYCHAIN" true)
diff --git a/pkgs/by-name/ch/chatterino2/package.nix b/pkgs/by-name/ch/chatterino2/package.nix
index 7e109330875f..9ad3e6b96e71 100644
--- a/pkgs/by-name/ch/chatterino2/package.nix
+++ b/pkgs/by-name/ch/chatterino2/package.nix
@@ -18,8 +18,13 @@
         owner = "Chatterino";
         repo = "chatterino2";
         tag = "v${finalAttrs.version}";
-        hash = "sha256-W2sqlqL6aa68aQ3nE161G64x7K7p8iByX03g1dseQbs=";
+        hash = "sha256-XV8WhdjdnVrOg0PVyIhGfxC4sJ62oH03KchvGr1c2w8=";
         fetchSubmodules = true;
+        leaveDotGit = true;
+        postFetch = ''
+          git -C $out rev-parse --short HEAD > $out/GIT_HASH
+          find "$out" -name .git -print0 | xargs -0 rm -rf
+        '';
       };
 
       passthru = {
diff --git a/pkgs/by-name/ch/chatterino7/package.nix b/pkgs/by-name/ch/chatterino7/package.nix
index bd60c3dc2a5a..19e6e5897bc8 100644
--- a/pkgs/by-name/ch/chatterino7/package.nix
+++ b/pkgs/by-name/ch/chatterino7/package.nix
@@ -17,8 +17,13 @@
         owner = "SevenTV";
         repo = "chatterino7";
         tag = "v${finalAttrs.version}";
-        hash = "sha256-KrAr3DcQDjb+LP+vIf0qLSSgII0m5rNwhncLNHlLaC8=";
+        hash = "sha256-tft0+vcE+LGPrlv4ZBgzmeF66Jf66iTjUr0pdF1vx24=";
         fetchSubmodules = true;
+        leaveDotGit = true;
+        postFetch = ''
+          git -C $out rev-parse --short HEAD > $out/GIT_HASH
+          find "$out" -name .git -print0 | xargs -0 rm -rf
+        '';
       };
 
       passthru.updateScript = gitUpdater {
diff --git a/pkgs/by-name/ch/chirp/package.nix b/pkgs/by-name/ch/chirp/package.nix
index b2131feb003f..509b98358904 100644
--- a/pkgs/by-name/ch/chirp/package.nix
+++ b/pkgs/by-name/ch/chirp/package.nix
@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication {
   pname = "chirp";
-  version = "0.4.0-unstable-2025-08-19";
+  version = "0.4.0-unstable-2025-08-31";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kk7ds";
     repo = "chirp";
-    rev = "0705a4c61e11f952ef1bcdb282f22a74dc72782f";
-    hash = "sha256-gUiSuulthiEC94SuXfGzuDDrf2dYTsJLsAjtjAsTIPY=";
+    rev = "906d7ec8b2e09f53710e1ef9616d58f8270841e2";
+    hash = "sha256-lsB8m9qn+pJp8tBekOo2DnQQrjF5P+NizdWaj0HaYPU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cl/cloudmonkey/package.nix b/pkgs/by-name/cl/cloudmonkey/package.nix
index 8505984541db..170aa84853ac 100644
--- a/pkgs/by-name/cl/cloudmonkey/package.nix
+++ b/pkgs/by-name/cl/cloudmonkey/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "cloudmonkey";
-  version = "6.4.0";
+  version = "6.5.0";
 
   src = fetchFromGitHub {
     owner = "apache";
     repo = "cloudstack-cloudmonkey";
     rev = version;
-    sha256 = "sha256-mkEGOZw7GDIFnYUpgvCetA4dU9R1m4q6MOUDG0TWN64=";
+    sha256 = "sha256-CdqKaKUVqeAujrWh7u0npZ6ON/nmL/8uIBIljAPPUv0=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/dn/dnf5/package.nix b/pkgs/by-name/dn/dnf5/package.nix
index 3bfc7c350215..a46b70cc0794 100644
--- a/pkgs/by-name/dn/dnf5/package.nix
+++ b/pkgs/by-name/dn/dnf5/package.nix
@@ -25,7 +25,7 @@
   sphinx,
   sqlite,
   systemd,
-  testers,
+  versionCheckHook,
   toml11,
   zchunk,
   nix-update-script,
@@ -115,10 +115,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   dontFixCmake = true;
 
-  passthru = {
-    tests.version = testers.testVersion { package = finalAttrs.finalPackage; };
-    updateScript = nix-update-script { };
-  };
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+  preVersionCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  passthru.updateScript = nix-update-script { };
 
   meta = with lib; {
     description = "Next-generation RPM package management system";
diff --git a/pkgs/by-name/dn/dnsrecon/package.nix b/pkgs/by-name/dn/dnsrecon/package.nix
index d6be4da92d9c..44d0d3496c1a 100644
--- a/pkgs/by-name/dn/dnsrecon/package.nix
+++ b/pkgs/by-name/dn/dnsrecon/package.nix
@@ -6,21 +6,29 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "dnsrecon";
-  version = "1.4.0";
+  version = "1.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "darkoperator";
     repo = "dnsrecon";
     tag = version;
-    hash = "sha256-uBb19JNlbevwqFSNzLzUmmDw063Hl7RPbu453tYZ3Gc=";
+    hash = "sha256-RX7A/vF19wTcvm+kP4ynarzGY+pUIj84zQJIM3tO/2M=";
   };
 
+  pythonRelaxDeps = true;
+
   build-system = with python3.pkgs; [ setuptools ];
 
   dependencies = with python3.pkgs; [
     dnspython
     loguru
+    httpx
+    fastapi
+    uvicorn
+    slowapi
+    stamina
+    ujson
     lxml
     netaddr
     requests
diff --git a/pkgs/by-name/ds/dsremote/package.nix b/pkgs/by-name/ds/dsremote/package.nix
new file mode 100644
index 000000000000..1ccf68f1c3d1
--- /dev/null
+++ b/pkgs/by-name/ds/dsremote/package.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  libsForQt5,
+}:
+stdenv.mkDerivation {
+  pname = "dsremote";
+  version = "0-unstable-2025-07-07";
+
+  src = fetchFromGitLab {
+    owner = "Teuniz";
+    repo = "DSRemote";
+    rev = "b290debcfecd4fecf2069fb958bd43fe9e5ce5e1";
+    hash = "sha256-7a13T8MwIFDhrXe7xqB84D6MwfTYs1gJj6VWs4JbzEM=";
+  };
+
+  nativeBuildInputs = [
+    libsForQt5.qmake
+    libsForQt5.qt5.wrapQtAppsHook
+    libsForQt5.qt5.qtbase
+  ];
+
+  hardeningDisable = [ "fortify" ];
+
+  postPatch = ''
+    substituteInPlace dsremote.pro \
+      --replace-fail "/usr/" "$out/" \
+      --replace-fail "/etc/" "$out/etc/"
+  '';
+
+  meta = {
+    description = "Rigol DS1000Z remote control and waveform viewer";
+    homepage = "https://www.teuniz.net/DSRemote";
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ mksafavi ];
+    mainProgram = "dsremote";
+  };
+}
diff --git a/pkgs/by-name/ec/ecm/package.nix b/pkgs/by-name/ec/ecm/package.nix
index 93d7b56c0d35..b3dda039fd12 100644
--- a/pkgs/by-name/ec/ecm/package.nix
+++ b/pkgs/by-name/ec/ecm/package.nix
@@ -26,8 +26,13 @@ stdenv.mkDerivation {
     substituteInPlace test.ecm --replace /bin/rm rm
   '';
 
-  # See https://trac.sagemath.org/ticket/19233
-  configureFlags = lib.optional stdenv.hostPlatform.isDarwin "--disable-asm-redc";
+  configureFlags = [
+    # Otherwise, undesired flags from gmp (such as -std=c99) are leaking
+    "-enable-gmp-cflags=false"
+  ]
+  ++
+    # See https://trac.sagemath.org/ticket/19233
+    lib.optional stdenv.hostPlatform.isDarwin "--disable-asm-redc";
 
   buildInputs = [
     m4
diff --git a/pkgs/by-name/en/enpass-cli/package.nix b/pkgs/by-name/en/enpass-cli/package.nix
new file mode 100644
index 000000000000..4b973979fff9
--- /dev/null
+++ b/pkgs/by-name/en/enpass-cli/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  sqlcipher,
+  pkg-config,
+  nix-update-script,
+}:
+
+buildGoModule rec {
+  pname = "enpass-cli";
+  version = "1.6.5";
+
+  src = fetchFromGitHub {
+    owner = "HazCod";
+    repo = "enpass-cli";
+    tag = "v${version}";
+    hash = "sha256-13AhK0qDDANEgicggy1Sdlmo5b0Vlf2sEDzJerhUvG8=";
+  };
+
+  vendorHash = "sha256-7K7gdMjJ4cfv6xmuI73U+oW9JlmdN6wGg8vMcD/YThQ=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    sqlcipher
+  ];
+
+  env.CGO_ENABLED = "1";
+
+  postInstall = ''
+    mv $out/bin/enpasscli $out/bin/enpass-cli
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Command line client for Enpass password manager";
+    mainProgram = "enpass-cli";
+    homepage = "https://github.com/HazCod/enpass-cli";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ deej-io ];
+    platforms = lib.platforms.unix;
+  };
+}
diff --git a/pkgs/by-name/en/envoy/bazel_nix.BUILD.bazel b/pkgs/by-name/en/envoy/bazel_nix.BUILD.bazel
index 5531517addfb..17844db5112a 100644
--- a/pkgs/by-name/en/envoy/bazel_nix.BUILD.bazel
+++ b/pkgs/by-name/en/envoy/bazel_nix.BUILD.bazel
@@ -1,12 +1,26 @@
 load("@bazel_tools//tools/sh:sh_toolchain.bzl", "sh_toolchain")
 load("@rules_rust//rust:toolchain.bzl", "rust_toolchain")
+load("@rules_rust//rust:defs.bzl", "rust_stdlib_filegroup")
 
 toolchains = {
     "x86_64": "x86_64-unknown-linux-gnu",
     "aarch64": "aarch64-unknown-linux-gnu",
 }
 
-exports_files(["cargo", "rustdoc", "ruststd", "rustc"])
+exports_files(["cargo", "rustdoc", "rustc"])
+
+[
+    rust_stdlib_filegroup(
+        name = "rust_nix_" + k + "_stdlib",
+        srcs = glob(
+            [
+                "rustcroot/lib/rustlib/" + v + "/lib/**",
+            ],
+            allow_empty=True,
+        ),
+    )
+    for k, v in toolchains.items()
+]
 
 [
     rust_toolchain(
@@ -16,7 +30,7 @@ exports_files(["cargo", "rustdoc", "ruststd", "rustc"])
         exec_triple = v,
         cargo = ":cargo",
         rust_doc = ":rustdoc",
-        rust_std = ":ruststd",
+        rust_std = ":rust_nix_" + k + "_stdlib",
         rustc = ":rustc",
         stdlib_linkflags = ["-ldl", "-lpthread"],
         staticlib_ext = ".a",
diff --git a/pkgs/by-name/en/envoy/package.nix b/pkgs/by-name/en/envoy/package.nix
index 37a5037e0c41..327af100c23f 100644
--- a/pkgs/by-name/en/envoy/package.nix
+++ b/pkgs/by-name/en/envoy/package.nix
@@ -23,9 +23,14 @@
   gnutar,
   gnugrep,
   envoy,
+  git,
 
   # v8 (upstream default), wavm, wamr, wasmtime, disabled
-  wasmRuntime ? "wamr",
+  wasmRuntime ? "wasmtime",
+
+  # Allows overriding the deps hash used for building - you will likely need to
+  # set this if you have changed the 'wasmRuntime' setting.
+  depsHash ? null,
 }:
 
 let
@@ -40,12 +45,15 @@ let
   };
 
   # these need to be updated for any changes to fetchAttrs
-  depsHash =
-    {
-      x86_64-linux = "sha256-E6yUSd00ngmjaMds+9UVZLtcYhzeS8F9eSIkC1mZSps=";
-      aarch64-linux = "sha256-ivboOrV/uORKVHRL3685aopcElGvzsxgVcUmYsBwzXY=";
-    }
-    .${stdenv.system} or (throw "unsupported system ${stdenv.system}");
+  depsHash' =
+    if depsHash != null then
+      depsHash
+    else
+      {
+        x86_64-linux = "sha256-t4Xv4UGYW5YU0kmv+1rdf2JvM1BYQyNWdtpz6Cdmxm4=";
+        aarch64-linux = "sha256-aIBnNGzc0hTdlTgRyJ7eLnWvHqZ5ywhqOM+mHfH3/18=";
+      }
+      .${stdenv.system} or (throw "unsupported system ${stdenv.system}");
 
   python3 = python312;
 
@@ -94,7 +102,7 @@ buildBazelPackage rec {
     ln -sf "${cargo}/bin/cargo" bazel/nix/cargo
     ln -sf "${rustc}/bin/rustc" bazel/nix/rustc
     ln -sf "${rustc}/bin/rustdoc" bazel/nix/rustdoc
-    ln -sf "${rustPlatform.rustLibSrc}" bazel/nix/ruststd
+    ln -sf "${rustc.unwrapped}" bazel/nix/rustcroot
     substituteInPlace bazel/dependency_imports.bzl \
       --replace-fail 'crate_universe_dependencies()' 'crate_universe_dependencies(rust_toolchain_cargo_template="@@//bazel/nix:cargo", rust_toolchain_rustc_template="@@//bazel/nix:rustc")' \
       --replace-fail 'crates_repository(' 'crates_repository(rust_toolchain_cargo_template="@@//bazel/nix:cargo", rust_toolchain_rustc_template="@@//bazel/nix:rustc",'
@@ -120,12 +128,13 @@ buildBazelPackage rec {
     ninja
     patchelf
     cacert
+    git
   ];
 
   buildInputs = [ linuxHeaders ];
 
   fetchAttrs = {
-    sha256 = depsHash;
+    sha256 = depsHash';
     env.CARGO_BAZEL_REPIN = true;
     dontUseCmakeConfigure = true;
     dontUseGnConfigure = true;
@@ -239,6 +248,7 @@ buildBazelPackage rec {
     "--linkopt=-Wl,-z,noexecstack"
     "--config=gcc"
     "--verbose_failures"
+    "--incompatible_enable_cc_toolchain_resolution=true"
 
     # Force use of system Java.
     "--extra_toolchains=@local_jdk//:all"
diff --git a/pkgs/by-name/fz/fzf-git-sh/package.nix b/pkgs/by-name/fz/fzf-git-sh/package.nix
index cef62cca45cb..7899c70f5a71 100644
--- a/pkgs/by-name/fz/fzf-git-sh/package.nix
+++ b/pkgs/by-name/fz/fzf-git-sh/package.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fzf-git-sh";
-  version = "0-unstable-2025-07-10";
+  version = "0-unstable-2025-08-31";
 
   src = fetchFromGitHub {
     owner = "junegunn";
     repo = "fzf-git.sh";
-    rev = "79e10ccaa8b3bddff95cd1dcb44b0c30a39da71f";
-    hash = "sha256-5+rV3l1Jdy28IxGLMdmj0heLxmmpRwwobyg9sjdBRco=";
+    rev = "2eef6bf288bf19a6402784a63336f06f87d9a584";
+    hash = "sha256-r3b05erlNGw3GQq/nMPqTHRroGEFmhufpiXqaIhQGTA=";
   };
 
   dontBuild = true;
diff --git a/pkgs/by-name/gi/git-buildpackage/package.nix b/pkgs/by-name/gi/git-buildpackage/package.nix
index 1c23f7cc4dae..91d0e1488111 100644
--- a/pkgs/by-name/gi/git-buildpackage/package.nix
+++ b/pkgs/by-name/gi/git-buildpackage/package.nix
@@ -1,10 +1,11 @@
 {
   lib,
+  stdenv,
 
   coreutils,
   fetchFromGitHub,
+  nix-update-script,
   python3Packages,
-  stdenv,
 
   # nativeCheckInputs
   debian-devscripts,
@@ -16,14 +17,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "git-buildpackage";
-  version = "0.9.37";
+  version = "0.9.38";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "agx";
     repo = "git-buildpackage";
     tag = "debian/${version}";
-    hash = "sha256-0gfryd1GrVfL11u/IrtLSJAABRsTpFfPOGxWfVdYtgE=";
+    hash = "sha256-dZ/uJLcDPkpwIz+Y6WInJ4XlSJ5zzDY65li/xghsJTQ=";
     fetchSubmodules = true;
   };
 
@@ -39,6 +40,8 @@ python3Packages.buildPythonApplication rec {
 
   dependencies = with python3Packages; [
     python-dateutil
+    pyyaml
+    rpm
   ];
 
   pythonImportsCheck = [
@@ -56,8 +59,6 @@ python3Packages.buildPythonApplication rec {
     coverage
     pytest-cov
     pytestCheckHook
-    pyyaml
-    rpm
   ]);
 
   disabledTests = [
@@ -77,6 +78,13 @@ python3Packages.buildPythonApplication rec {
     "tests.doctests.test_GitRepository.test_create_noperm"
   ];
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "debian/(.*)"
+    ];
+  };
+
   meta = {
     description = "Suite to help with maintaining Debian packages in Git repositories";
     homepage = "https://honk.sigxcpu.org/piki/projects/git-buildpackage/";
diff --git a/pkgs/by-name/gi/git-get/package.nix b/pkgs/by-name/gi/git-get/package.nix
index 1508687989cc..4d100f572c4c 100644
--- a/pkgs/by-name/gi/git-get/package.nix
+++ b/pkgs/by-name/gi/git-get/package.nix
@@ -2,6 +2,7 @@
   lib,
   fetchFromGitHub,
   buildGoModule,
+  nix-update-script,
 }:
 
 let
@@ -9,13 +10,13 @@ let
 in
 buildGoModule rec {
   pname = "git-get";
-  version = "0.5.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "grdl";
     repo = "git-get";
     tag = "v${version}";
-    hash = "sha256-v98Ff7io7j1LLzciHNWJBU3LcdSr+lhwYrvON7QjyCI=";
+    hash = "sha256-xnmFqNIabiTyf9ZPKlm5S42rfFUXnTp/jLDDY51eoMw=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -27,7 +28,7 @@ buildGoModule rec {
     '';
   };
 
-  vendorHash = "sha256-C+XOjMDMFneKJNeBh0KWPx8yM7XiiIpTlc2daSfhZhY=";
+  vendorHash = "sha256-8DLS1pSyh1OgnULMvAppl/+D2yfyi/dcZs08S1IMzaE=";
 
   doCheck = false;
 
@@ -44,14 +45,17 @@ buildGoModule rec {
   ];
 
   preInstall = ''
-    mv "$GOPATH/bin/get" "$GOPATH/bin/git-get"
-    mv "$GOPATH/bin/list" "$GOPATH/bin/git-list"
+    mv "$GOPATH/bin/cmd" "$GOPATH/bin/git-get"
+    ln -s ./git-get "$GOPATH/bin/git-list"
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     description = "Better way to clone, organize and manage multiple git repositories";
     homepage = "https://github.com/grdl/git-get";
     license = licenses.mit;
     maintainers = with maintainers; [ sumnerevans ];
+    mainProgram = "git-get";
   };
 }
diff --git a/pkgs/by-name/go/go-camo/package.nix b/pkgs/by-name/go/go-camo/package.nix
index 22103521ed83..32cb089b4da3 100644
--- a/pkgs/by-name/go/go-camo/package.nix
+++ b/pkgs/by-name/go/go-camo/package.nix
@@ -1,24 +1,24 @@
 {
   lib,
-  buildGo124Module,
+  buildGo125Module,
   fetchFromGitHub,
   installShellFiles,
   nixosTests,
   scdoc,
 }:
 
-buildGo124Module rec {
+buildGo125Module rec {
   pname = "go-camo";
-  version = "2.6.4";
+  version = "2.6.5";
 
   src = fetchFromGitHub {
     owner = "cactus";
     repo = "go-camo";
     tag = "v${version}";
-    hash = "sha256-BdKIfDDN6GXc53SFDkJ8Dui5rrm27blA+EEOS/oAanE=";
+    hash = "sha256-+EHJIohHSWg12Tmn6hu1XUSVRyYWu3aFI7MF7+PnfFg=";
   };
 
-  vendorHash = "sha256-0DkIbD+9gIbARqvmudRavwcWVLADGKwEYMMX6a5Qoq4=";
+  vendorHash = "sha256-rKdBAu0tNsxw7I66qjZhtrA2hs1qpBtOSuzq34paziw=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/gu/gui-for-clash/package.nix b/pkgs/by-name/gu/gui-for-clash/package.nix
index ffa7591ef6d5..b0f709e86ed9 100644
--- a/pkgs/by-name/gu/gui-for-clash/package.nix
+++ b/pkgs/by-name/gu/gui-for-clash/package.nix
@@ -16,17 +16,18 @@
 
 let
   pname = "gui-for-clash";
-  version = "1.9.8";
+  version = "1.9.10";
 
   src = fetchFromGitHub {
     owner = "GUI-for-Cores";
     repo = "GUI.for.Clash";
     tag = "v${version}";
-    hash = "sha256-YwolOIN4pQ9ykXruKAetUDMFkNnQppkzioDNlrPefL8=";
+    hash = "sha256-odASuy0zaXf6vvd5CRVtuuVIX1EgEO7GsMgXWUR+fxk=";
   };
 
   metaCommon = {
     homepage = "https://github.com/GUI-for-Cores/GUI.for.Clash";
+    hydraPlatforms = [ ]; # https://gui-for-cores.github.io/guide/#note
     license = with lib.licenses; [ gpl3Plus ];
     maintainers = with lib.maintainers; [ ];
   };
@@ -49,7 +50,7 @@ let
         sourceRoot
         ;
       fetcherVersion = 2;
-      hash = "sha256-iVD/9uTK3cUzKE20pJk67uk53UCtfj/YCpgwgxmmg8k=";
+      hash = "sha256-AuBUneWOR9oCuj811iCB3l5dlpeKhxt6KrF7KDs27a0=";
     };
 
     buildPhase = ''
@@ -85,7 +86,7 @@ buildGoModule {
       --subst-var out
   '';
 
-  vendorHash = "sha256-7pFjfUFkpXyYEVjiXbfFUC7FQSlZubKJJ5MI8WY0IVA=";
+  vendorHash = "sha256-UArCB5U2bF5HXFDU1oCfm+SaURe6e9gyCx+UjtWI/ug=";
 
   nativeBuildInputs = [
     autoPatchelfHook
@@ -133,6 +134,8 @@ buildGoModule {
     inherit frontend;
     updateScript = nix-update-script {
       extraArgs = [
+        "--version-regex"
+        "^v([0-9.]+)$"
         "--subpackage"
         "frontend"
       ];
diff --git a/pkgs/by-name/gu/gui-for-singbox/package.nix b/pkgs/by-name/gu/gui-for-singbox/package.nix
index 17127d567eb7..a594d4086f1b 100644
--- a/pkgs/by-name/gu/gui-for-singbox/package.nix
+++ b/pkgs/by-name/gu/gui-for-singbox/package.nix
@@ -16,17 +16,18 @@
 
 let
   pname = "gui-for-singbox";
-  version = "1.9.8";
+  version = "1.9.9";
 
   src = fetchFromGitHub {
     owner = "GUI-for-Cores";
     repo = "GUI.for.SingBox";
     tag = "v${version}";
-    hash = "sha256-9Vai/C9cJgqM3n+FzFPXismR5vF6eQNJHdI7o47zinI=";
+    hash = "sha256-6Y0eEJmPBp+J1r6LCxYEM6i3fdCYSo4LrimpqwOCVT8=";
   };
 
   metaCommon = {
     homepage = "https://github.com/GUI-for-Cores/GUI.for.SingBox";
+    hydraPlatforms = [ ]; # https://gui-for-cores.github.io/guide/#note
     license = with lib.licenses; [ gpl3Plus ];
     maintainers = with lib.maintainers; [ ];
   };
@@ -49,7 +50,7 @@ let
         sourceRoot
         ;
       fetcherVersion = 2;
-      hash = "sha256-iVD/9uTK3cUzKE20pJk67uk53UCtfj/YCpgwgxmmg8k=";
+      hash = "sha256-kSIPkXD0Wxe8TaKDd4DUAL7pkQeU8xyLY9K3lFSAODI=";
     };
 
     buildPhase = ''
@@ -86,7 +87,7 @@ buildGoModule {
       --subst-var out
   '';
 
-  vendorHash = "sha256-7pFjfUFkpXyYEVjiXbfFUC7FQSlZubKJJ5MI8WY0IVA=";
+  vendorHash = "sha256-UArCB5U2bF5HXFDU1oCfm+SaURe6e9gyCx+UjtWI/ug=";
 
   nativeBuildInputs = [
     autoPatchelfHook
@@ -134,6 +135,8 @@ buildGoModule {
     inherit frontend;
     updateScript = nix-update-script {
       extraArgs = [
+        "--version-regex"
+        "^v([0-9.]+)$"
         "--subpackage"
         "frontend"
       ];
diff --git a/pkgs/by-name/ho/hoppscotch/package.nix b/pkgs/by-name/ho/hoppscotch/package.nix
index a0f3b63889a4..6da2a3ef5c0b 100644
--- a/pkgs/by-name/ho/hoppscotch/package.nix
+++ b/pkgs/by-name/ho/hoppscotch/package.nix
@@ -8,22 +8,22 @@
 
 let
   pname = "hoppscotch";
-  version = "25.7.1-0";
+  version = "25.8.0-0";
 
   src =
     fetchurl
       {
         aarch64-darwin = {
           url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_mac_aarch64.dmg";
-          hash = "sha256-Qr7xv3XyneA9RzvO7MqtblBF+oO4auYi5DX/F0n/I0c=";
+          hash = "sha256-MaQiJOnLvrmv5D97emF7P7gOn3WiAu0Uz7eX8q9G7co=";
         };
         x86_64-darwin = {
           url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_mac_x64.dmg";
-          hash = "sha256-/5++4ifR2xcCmU7jg+qm4zsi8swSXTbU7Hdz80p+UCM=";
+          hash = "sha256-qHAxSwEL2BvDB5ynCIYrP0+uNn+MRIL3IvZxC94ktgA=";
         };
         x86_64-linux = {
           url = "https://github.com/hoppscotch/releases/releases/download/v${version}/Hoppscotch_linux_x64.AppImage";
-          hash = "sha256-EToScp/zKv4KAuVPJmhKmBtx3WeM+CH38jXinhnT0tE=";
+          hash = "sha256-0bENzqKjPPEoCb+4QEfdbHXKfrvaC72mFVdPb0G8+Uk=";
         };
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
diff --git a/pkgs/by-name/im/immich-cli/package.nix b/pkgs/by-name/im/immich-cli/package.nix
index d41dc764f26d..092f2a9fe1ad 100644
--- a/pkgs/by-name/im/immich-cli/package.nix
+++ b/pkgs/by-name/im/immich-cli/package.nix
@@ -1,26 +1,52 @@
 {
   lib,
   immich,
-  buildNpmPackage,
+  jq,
   nodejs,
   makeWrapper,
+  stdenv,
 }:
-buildNpmPackage {
+
+let
+  inherit (immich) pnpm;
+in
+stdenv.mkDerivation rec {
   pname = "immich-cli";
-  src = "${immich.src}/cli";
-  inherit (immich.sources.components.cli) version npmDepsHash;
+  version = "2.2.86";
+  inherit (immich) src pnpmDeps;
 
-  nativeBuildInputs = [ makeWrapper ];
+  postPatch = ''
+    local -r cli_version="$(jq -r .version cli/package.json)"
+    test "$cli_version" = ${version} \
+      || (echo "error: update immich-cli version to $cli_version" && exit 1)
+  '';
 
-  inherit (immich.web) preBuild;
+  nativeBuildInputs = [
+    jq
+    makeWrapper
+    nodejs
+    pnpm
+    pnpm.configHook
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    pnpm --filter @immich/sdk build
+    pnpm --filter @immich/cli build
+
+    runHook postBuild
+  '';
 
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out
-    mv package.json package-lock.json node_modules dist $out/
+    local -r packageOut="$out/lib/node_modules/@immich/cli"
 
-    makeWrapper ${lib.getExe nodejs} $out/bin/immich --add-flags $out/dist/index.js
+    pnpm --filter @immich/cli deploy --prod --no-optional "$packageOut"
+
+    makeWrapper '${lib.getExe nodejs}' "$out/bin/immich" \
+      --add-flags "$packageOut/dist/index.js"
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/im/immich/package.nix b/pkgs/by-name/im/immich/package.nix
index d6889a2a0412..5fd4926b2caa 100644
--- a/pkgs/by-name/im/immich/package.nix
+++ b/pkgs/by-name/im/immich/package.nix
@@ -1,8 +1,8 @@
 {
   lib,
   stdenv,
-  buildNpmPackage,
   fetchFromGitHub,
+  pnpm_10,
   python3,
   nodejs,
   node-gyp,
@@ -10,7 +10,6 @@
   nixosTests,
   immich-machine-learning,
   # build-time deps
-  glib,
   pkg-config,
   makeWrapper,
   curl,
@@ -32,12 +31,10 @@
   pixman,
   vips,
   buildPackages,
-  sourcesJSON ? ./sources.json,
 }:
 let
-  buildNpmPackage' = buildNpmPackage.override { inherit nodejs; };
-  sources = lib.importJSON sourcesJSON;
-  inherit (sources) version;
+  pnpm = pnpm_10;
+  version = "1.140.1";
 
   esbuild' = buildPackages.esbuild.override {
     buildGoModule =
@@ -77,14 +74,14 @@ let
   # The geodata website is not versioned, so we use the internet archive
   geodata =
     let
-      inherit (sources.components.geonames) timestamp;
+      timestamp = "20250818205425";
       date =
         "${lib.substring 0 4 timestamp}-${lib.substring 4 2 timestamp}-${lib.substring 6 2 timestamp}T"
         + "${lib.substring 8 2 timestamp}:${lib.substring 10 2 timestamp}:${lib.substring 12 2 timestamp}Z";
     in
     runCommand "immich-geodata"
       {
-        outputHash = sources.components.geonames.hash;
+        outputHash = "sha256-zZHAomW1C4qReFbhme5dkVnTiLw+jmhZhzuYvoBVBCY=";
         outputHashMode = "recursive";
         nativeBuildInputs = [
           cacert
@@ -111,69 +108,39 @@ let
     owner = "immich-app";
     repo = "immich";
     tag = "v${version}";
-    inherit (sources) hash;
+    hash = "sha256-Bo9wFP0u39aoaNjc8K4Im3HRGZR/TLrDB7+UDAhV1xA=";
   };
 
-  openapi = buildNpmPackage' {
-    pname = "immich-openapi-sdk";
-    inherit version;
-    src = "${src}/open-api/typescript-sdk";
-    inherit (sources.components."open-api/typescript-sdk") npmDepsHash;
-
-    installPhase = ''
-      runHook preInstall
-
-      npm config delete cache
-      npm prune --omit=dev --omit=optional
-
-      mkdir -p $out
-      mv package.json package-lock.json node_modules build $out/
-
-      runHook postInstall
-    '';
-  };
-
-  web = buildNpmPackage' {
-    pname = "immich-web";
+  pnpmDeps = pnpm.fetchDeps {
+    pname = "immich";
     inherit version src;
-    sourceRoot = "${src.name}/web";
-    inherit (sources.components.web) npmDepsHash;
+    fetcherVersion = 2;
+    hash = "sha256-DIcUKuU+ToRh/kSLcs4ZEHy7zhFir2nlbRx+/kMagrA=";
+  };
 
-    # prePatch is needed because npmConfigHook is a postPatch
-    prePatch = ''
-      # some part of the build wants to use un-prefixed binaries. let them.
-      mkdir -p $TMP/bin
-      ln -s "$(type -p ${stdenv.cc.targetPrefix}pkg-config)" $TMP/bin/pkg-config || true
-      ln -s "$(type -p ${stdenv.cc.targetPrefix}c++filt)" $TMP/bin/c++filt || true
-      ln -s "$(type -p ${stdenv.cc.targetPrefix}readelf)" $TMP/bin/readelf || true
-      export PATH="$TMP/bin:$PATH"
-    '';
-
-    preBuild = ''
-      rm node_modules/@immich/sdk
-      ln -s ${openapi} node_modules/@immich/sdk
-    '';
-
-    env.npm_config_build_from_source = "true";
+  web = stdenv.mkDerivation {
+    pname = "immich-web";
+    inherit version src pnpmDeps;
 
     nativeBuildInputs = [
-      pkg-config
+      nodejs
+      pnpm
+      pnpm.configHook
     ];
 
-    buildInputs = [
-      # https://github.com/Automattic/node-canvas/blob/master/Readme.md#compiling
-      cairo
-      giflib
-      libjpeg
-      libpng
-      librsvg
-      pango
-      pixman
-    ];
+    buildPhase = ''
+      runHook preBuild
+
+      pnpm --filter @immich/sdk build
+      pnpm --filter immich-web build
+
+      runHook postBuild
+    '';
 
     installPhase = ''
       runHook preInstall
 
+      cd web
       cp -r build $out
 
       runHook postInstall
@@ -184,32 +151,24 @@ let
     mesonFlags = prev.mesonFlags ++ [ "-Dtiff=disabled" ];
   });
 in
-buildNpmPackage' {
+stdenv.mkDerivation {
   pname = "immich";
-  inherit version;
-  src = "${src}/server";
-  inherit (sources.components.server) npmDepsHash;
+  inherit version src pnpmDeps;
 
-  # prePatch is needed because npmConfigHook is a postPatch
-  prePatch = ''
+  postPatch = ''
     # pg_dumpall fails without database root access
     # see https://github.com/immich-app/immich/issues/13971
-    substituteInPlace src/services/backup.service.ts \
+    substituteInPlace server/src/services/backup.service.ts \
       --replace-fail '`/usr/lib/postgresql/''${databaseMajorVersion}/bin/pg_dumpall`' '`pg_dump`'
-
-    # some part of the build wants to use un-prefixed binaries. let them.
-    mkdir -p $TMP/bin
-    ln -s "$(type -p ${stdenv.cc.targetPrefix}pkg-config)" $TMP/bin/pkg-config || true
-    ln -s "$(type -p ${stdenv.cc.targetPrefix}c++filt)" $TMP/bin/c++filt || true
-    ln -s "$(type -p ${stdenv.cc.targetPrefix}readelf)" $TMP/bin/readelf || true
-    export PATH="$TMP/bin:$PATH"
   '';
 
   nativeBuildInputs = [
+    nodejs
     pkg-config
+    pnpm_10
+    pnpm_10.configHook
     python3
     makeWrapper
-    glib
     node-gyp # for building node_modules/sharp from source
   ];
 
@@ -230,43 +189,60 @@ buildNpmPackage' {
     vips'
   ];
 
-  # Required because vips tries to write to the cache dir
-  makeCacheWritable = true;
-
   env.SHARP_FORCE_GLOBAL_LIBVIPS = 1;
   env.ESBUILD_BINARY_PATH = lib.getExe esbuild';
+  # fix for node-gyp, see https://github.com/nodejs/node-gyp/issues/1191#issuecomment-301243919
+  env.npm_config_nodedir = nodejs;
+
+  buildPhase = ''
+    runHook preBuild
 
-  preBuild = ''
     # If exiftool-vendored.pl isn't found, exiftool is searched for on the PATH
-    rm -r node_modules/exiftool-vendored.*
+    rm node_modules/.pnpm/node_modules/exiftool-vendored.pl
+
+    pnpm --filter immich build
+
+    runHook postBuild
   '';
 
   installPhase = ''
     runHook preInstall
 
-    npm config delete cache
-    npm prune --omit=dev
+    local -r packageOut="$out/lib/node_modules/immich"
+
+    # install node_modules and built files in $out
+    # upstream uses pnpm deploy to build their docker images
+    pnpm --filter immich deploy --prod --no-optional "$packageOut"
 
     # remove build artifacts that bloat the closure
-    rm -r node_modules/**/{*.target.mk,binding.Makefile,config.gypi,Makefile,Release/.deps}
+    find "$packageOut/node_modules" \( \
+      -name config.gypi \
+      -o -name .deps \
+      -o -name '*Makefile' \
+      -o -name '*.target.mk' \
+    \) -exec rm -r {} +
 
-    mkdir -p $out/build
-    mv package.json package-lock.json node_modules dist resources $out/
-    ln -s ${web} $out/build/www
-    ln -s ${geodata} $out/build/geodata
+    mkdir -p "$packageOut/build"
+    ln -s '${web}' "$packageOut/build/www"
+    ln -s '${geodata}' "$packageOut/build/geodata"
 
-    echo '${builtins.toJSON buildLock}' > $out/build/build-lock.json
+    echo '${builtins.toJSON buildLock}' > "$packageOut/build/build-lock.json"
 
-    makeWrapper ${lib.getExe nodejs} $out/bin/admin-cli --add-flags $out/dist/main --add-flags cli
-    makeWrapper ${lib.getExe nodejs} $out/bin/server --add-flags $out/dist/main --chdir $out \
-      --set IMMICH_BUILD_DATA $out/build --set NODE_ENV production \
-      --suffix PATH : "${
+    makeWrapper '${lib.getExe nodejs}' "$out/bin/admin-cli" \
+      --add-flags "$packageOut/dist/main" \
+      --add-flags cli
+    makeWrapper '${lib.getExe nodejs}' "$out/bin/server" \
+      --add-flags "$packageOut/dist/main" \
+      --chdir "$packageOut" \
+      --set IMMICH_BUILD_DATA "$packageOut/build" \
+      --set NODE_ENV production \
+      --suffix PATH : '${
         lib.makeBinPath [
           exiftool
           jellyfin-ffmpeg
           perl # exiftool-vendored checks for Perl even if exiftool comes from $PATH
         ]
-      }"
+      }'
 
     runHook postInstall
   '';
@@ -280,11 +256,10 @@ buildNpmPackage' {
 
     inherit
       src
-      sources
       web
       geodata
+      pnpm
       ;
-    updateScript = ./update.sh;
   };
 
   meta = {
diff --git a/pkgs/by-name/im/immich/sources.json b/pkgs/by-name/im/immich/sources.json
deleted file mode 100644
index 70e02e44a510..000000000000
--- a/pkgs/by-name/im/immich/sources.json
+++ /dev/null
@@ -1,26 +0,0 @@
-{
-  "version": "1.138.1",
-  "hash": "sha256-oaZN0kF82mS25bDSTXRjYnWG9RAMSbCUhXn9t0am96U=",
-  "components": {
-    "cli": {
-      "npmDepsHash": "sha256-6k83QOdKh+FlVnYvA9j60115oohUMDc2YvGaj/GMukE=",
-      "version": "2.2.79"
-    },
-    "server": {
-      "npmDepsHash": "sha256-4sqWIIGQ8ZW7TvJoNjNNliriuV6Su0askAN6pAq9VFc=",
-      "version": "1.138.1"
-    },
-    "web": {
-      "npmDepsHash": "sha256-+W8cDgy3qe6RDen8SEdHPNADkKb4zZH8C/Am/bdU42c=",
-      "version": "1.138.1"
-    },
-    "open-api/typescript-sdk": {
-      "npmDepsHash": "sha256-GfmFPsnFu7l4EsnPDv4nj5KLkOz8nEJvMT1BE7zIQ3k=",
-      "version": "1.138.1"
-    },
-    "geonames": {
-      "timestamp": "20250818205425",
-      "hash": "sha256-zZHAomW1C4qReFbhme5dkVnTiLw+jmhZhzuYvoBVBCY="
-    }
-  }
-}
diff --git a/pkgs/by-name/im/immich/update.sh b/pkgs/by-name/im/immich/update.sh
deleted file mode 100755
index 1e11085e3adf..000000000000
--- a/pkgs/by-name/im/immich/update.sh
+++ /dev/null
@@ -1,62 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl jq prefetch-npm-deps nix-prefetch-github coreutils ripgrep
-
-set -euo pipefail
-cd "$(dirname "${BASH_SOURCE[0]}")"
-
-old_version=$(jq -r ".version" sources.json || echo -n "0.0.1")
-version=$(curl -s "https://api.github.com/repos/immich-app/immich/releases/latest" | jq -r ".tag_name")
-version="${version#v}"
-
-echo "Updating to $version"
-
-if [[ "$old_version" == "$version" ]]; then
-    echo "Already up to date!"
-    exit 0
-fi
-
-echo "Fetching src"
-src_hash=$(nix-prefetch-github immich-app immich --rev "v${version}" | jq -r .hash)
-upstream_src="https://raw.githubusercontent.com/immich-app/immich/v$version"
-
-sources_tmp="$(mktemp)"
-cat <<EOF > "$sources_tmp"
-{
-  "version": "$version",
-  "hash": "$src_hash",
-  "components": {}
-}
-EOF
-
-lock=$(mktemp)
-for npm_component in cli server web "open-api/typescript-sdk"; do
-    echo "fetching $npm_component"
-    curl -s -o "$lock" "$upstream_src/$npm_component/package-lock.json"
-    hash=$(prefetch-npm-deps "$lock")
-    echo "$(jq --arg npm_component "$npm_component" \
-      --arg hash "$hash" \
-      --arg version "$(jq -r '.version' <"$lock")" \
-      '.components += {($npm_component): {npmDepsHash: $hash, version: $version}}' \
-      "$sources_tmp")" > "$sources_tmp"
-done
-rm "$lock"
-
-url="http://download.geonames.org/export/dump"
-curl -s "http://web.archive.org/save/$url/cities500.zip"
-curl -s "http://web.archive.org/save/$url/admin1CodesASCII.txt"
-curl -s "http://web.archive.org/save/$url/admin1Codes.txt"
-timestamp=$(curl -s \
-    "http://archive.org/wayback/available?url=$url/cities500.zip" \
-    | jq -r ".archived_snapshots.closest.timestamp")
-echo "$(jq --arg timestamp "$timestamp" --arg hash "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=" \
-    '.components += {geonames: {timestamp: $timestamp, hash: $hash}}' \
-    "$sources_tmp")" > "$sources_tmp"
-
-cp "$sources_tmp" sources.json
-set +o pipefail
-output="$(nix-build ../../../.. -A immich.geodata 2>&1 || true)"
-set -o pipefail
-hash=$(echo "$output" | rg 'got:\s+(sha256-.*)$' -or '$1')
-echo "$(jq --arg hash "$hash" '.components.geonames.hash = $hash' "$sources_tmp")" > "$sources_tmp"
-
-mv "$sources_tmp" sources.json
diff --git a/pkgs/by-name/jq/jql/package.nix b/pkgs/by-name/jq/jql/package.nix
index 094c60b189d4..96c385844721 100644
--- a/pkgs/by-name/jq/jql/package.nix
+++ b/pkgs/by-name/jq/jql/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "jql";
-  version = "8.0.7";
+  version = "8.0.8";
 
   src = fetchFromGitHub {
     owner = "yamafaktory";
     repo = "jql";
     rev = "jql-v${version}";
-    hash = "sha256-OBv7uScgFnLhkeQ2dKey+QYUvX4y/iLFjfCUJeqhXBs=";
+    hash = "sha256-VujhFNC0nHFRZ5t/X6ZdEp5xpeMwEr0vPrpN9g/9c1U=";
   };
 
-  cargoHash = "sha256-AAdYjlPpyhxKQ8mXdLBdivMp8G91Ho5ntS73HC8wMfQ=";
+  cargoHash = "sha256-wkVHzFzQU9O2LAUmR6EYiCeFg29TxJVXJ2COJBB8BZw=";
 
   meta = with lib; {
     description = "JSON Query Language CLI tool built with Rust";
diff --git a/pkgs/by-name/kc/kcc/package.nix b/pkgs/by-name/kc/kcc/package.nix
index 7a6a7a5ff4ab..01ef570e63e7 100644
--- a/pkgs/by-name/kc/kcc/package.nix
+++ b/pkgs/by-name/kc/kcc/package.nix
@@ -30,7 +30,10 @@ python3.pkgs.buildPythonApplication rec {
     copyDesktopItems
   ];
 
-  buildInputs = [ qt6.qtbase ];
+  buildInputs = [
+    qt6.qtbase
+    qt6.qtwayland
+  ];
 
   build-system = with python3.pkgs; [ setuptools ];
 
diff --git a/pkgs/by-name/ki/kine/package.nix b/pkgs/by-name/ki/kine/package.nix
index 5aba2f449a3d..e763b06178ec 100644
--- a/pkgs/by-name/ki/kine/package.nix
+++ b/pkgs/by-name/ki/kine/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "kine";
-  version = "0.13.18";
+  version = "0.13.19";
 
   src = fetchFromGitHub {
     owner = "k3s-io";
     repo = "kine";
     rev = "v${version}";
-    hash = "sha256-zgazHJtGzEbsgB3Sr9gBuAov2TXqbWNAuoHiIGngjMI=";
+    hash = "sha256-UL1HhN5qWgtzltY4eAU9SlnK80tKUHBORMFHunDCi+Q=";
   };
 
-  vendorHash = "sha256-XJmy61YrtHmQj0rT7+WpF+yPus/fVBy1hCE9aJYS41I=";
+  vendorHash = "sha256-1Dwu1b6y1ibGt7w6Iu3lKWItwVn9H/TQFbTL2z2rVoc=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ku/kubectl-ai/package.nix b/pkgs/by-name/ku/kubectl-ai/package.nix
index 6a35ec8699e9..6e4e65668f91 100644
--- a/pkgs/by-name/ku/kubectl-ai/package.nix
+++ b/pkgs/by-name/ku/kubectl-ai/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubectl-ai";
-  version = "0.0.22";
+  version = "0.0.23";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = "kubectl-ai";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sU8CATzhp0seUJNYjvxFkRoA/Xqb57kZqGpEOCxypUA=";
+    hash = "sha256-rQJHgBBMTDIa2CrWlxLubZ446PqFz5ejiFyrYRb3jec=";
   };
 
-  vendorHash = "sha256-OJnpd8z4e6ytoUi5ydFHYPMA77ryU7Tp8wriuab7yuk=";
+  vendorHash = "sha256-fvkaVdQlDT+95UTaN/zCIX8924MDoKam49U8lbq6yLs=";
 
   # Build the main command
   subPackages = [ "cmd" ];
diff --git a/pkgs/by-name/li/libkrun/package.nix b/pkgs/by-name/li/libkrun/package.nix
index 4659c00b715a..11c96a659b8d 100644
--- a/pkgs/by-name/li/libkrun/package.nix
+++ b/pkgs/by-name/li/libkrun/package.nix
@@ -14,21 +14,31 @@
   libkrunfw,
   rustc,
   withBlk ? false,
+  withNet ? false,
   withGpu ? false,
   withSound ? false,
-  withNet ? false,
-  sevVariant ? false,
+  withTimesync ? false,
+  variant ? null,
 }:
 
+assert lib.elem variant [
+  null
+  "sev"
+  "tdx"
+];
+
+let
+  libkrunfw' = (libkrunfw.override { inherit variant; });
+in
 stdenv.mkDerivation (finalAttrs: {
-  pname = "libkrun";
-  version = "1.11.2";
+  pname = "libkrun" + lib.optionalString (variant != null) "-${variant}";
+  version = "1.15.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "libkrun";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-B11f7uG/oODwkME2rauCFbVysxUtUrUmd6RKeuBdnUU=";
+    hash = "sha256-VhlFyYJ/TH12I3dUq0JTus60rQEJq5H4Pm1puCnJV5A=";
   };
 
   outputs = [
@@ -38,15 +48,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
-    hash = "sha256-bcHy8AfO9nzSZKoFlEpPKvwupt3eMb+A2rHDaUzO3/U=";
+    hash = "sha256-dK3V7HCCvTqmQhB5Op2zmBPa9FO3h9gednU9tpQk+1U=";
   };
 
   # Make sure libkrunfw can be found by dlopen()
-  # FIXME: This wasn't needed previously. What changed?
   env.RUSTFLAGS = toString (
     map (flag: "-C link-arg=" + flag) [
       "-Wl,--push-state,--no-as-needed"
-      (if sevVariant then "-lkrunfw-sev" else "-lkrunfw")
+      ("-lkrunfw" + lib.optionalString (variant != null) "-${variant}")
       "-Wl,--pop-state"
     ]
   );
@@ -57,10 +66,10 @@ stdenv.mkDerivation (finalAttrs: {
     cargo
     rustc
   ]
-  ++ lib.optional (sevVariant || withGpu) pkg-config;
+  ++ lib.optional (variant == "sev" || variant == "tdx" || withGpu) pkg-config;
 
   buildInputs = [
-    (libkrunfw.override { inherit sevVariant; })
+    libkrunfw'
     glibc
     glibc.static
   ]
@@ -70,16 +79,18 @@ stdenv.mkDerivation (finalAttrs: {
     virglrenderer
   ]
   ++ lib.optional withSound pipewire
-  ++ lib.optional sevVariant openssl;
+  ++ lib.optional (variant == "sev" || variant == "tdx") openssl;
 
   makeFlags = [
     "PREFIX=${placeholder "out"}"
   ]
   ++ lib.optional withBlk "BLK=1"
+  ++ lib.optional withNet "NET=1"
   ++ lib.optional withGpu "GPU=1"
   ++ lib.optional withSound "SND=1"
-  ++ lib.optional withNet "NET=1"
-  ++ lib.optional sevVariant "SEV=1";
+  ++ lib.optional withTimesync "TIMESYNC=1"
+  ++ lib.optional (variant == "sev") "SEV=1"
+  ++ lib.optional (variant == "tdx") "TDX=1";
 
   postInstall = ''
     mkdir -p $dev/lib/pkgconfig
@@ -87,15 +98,17 @@ stdenv.mkDerivation (finalAttrs: {
     mv $out/include $dev/
   '';
 
-  meta = with lib; {
+  env.OPENSSL_NO_VENDOR = true;
+
+  meta = {
     description = "Dynamic library providing Virtualization-based process isolation capabilities";
     homepage = "https://github.com/containers/libkrun";
-    license = licenses.asl20;
-    maintainers = with maintainers; [
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
       nickcao
       RossComputerGuy
       nrabulinski
     ];
-    platforms = libkrunfw.meta.platforms;
+    platforms = libkrunfw'.meta.platforms;
   };
 })
diff --git a/pkgs/by-name/li/libkrunfw/package.nix b/pkgs/by-name/li/libkrunfw/package.nix
index 395d892c971e..2977487ee116 100644
--- a/pkgs/by-name/li/libkrunfw/package.nix
+++ b/pkgs/by-name/li/libkrunfw/package.nix
@@ -10,23 +10,29 @@
   perl,
   elfutils,
   python3,
-  sevVariant ? false,
+  variant ? null,
 }:
 
+assert lib.elem variant [
+  null
+  "sev"
+  "tdx"
+];
+
 stdenv.mkDerivation (finalAttrs: {
-  pname = "libkrunfw";
-  version = "4.9.0";
+  pname = "libkrunfw" + lib.optionalString (variant != null) "-${variant}";
+  version = "4.10.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "libkrunfw";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wmvjex68Mh7qehA33WNBYHhV9Q/XWLixokuGWnqJ3n0=";
+    hash = "sha256-mq2gw0+xL6qUZE/fk0vLT3PEpzPV8p+iwRFJHXVOMnk=";
   };
 
   kernelSrc = fetchurl {
-    url = "mirror://kernel/linux/kernel/v6.x/linux-6.12.20.tar.xz";
-    hash = "sha256-Iw6JsHsKuC508H7MG+4xBdyoHQ70qX+QCSnEBySbasc=";
+    url = "mirror://kernel/linux/kernel/v6.x/linux-6.12.34.tar.xz";
+    hash = "sha256-p/P+OB9n7KQXLptj77YaFL1/nhJ44DYD0P9ak/Jwwk0=";
   };
 
   postPatch = ''
@@ -51,8 +57,11 @@ stdenv.mkDerivation (finalAttrs: {
   makeFlags = [
     "PREFIX=${placeholder "out"}"
   ]
-  ++ lib.optionals sevVariant [
+  ++ lib.optionals (variant == "sev") [
     "SEV=1"
+  ]
+  ++ lib.optionals (variant == "tdx") [
+    "TDX=1"
   ];
 
   # Fixes https://github.com/containers/libkrunfw/issues/55
@@ -60,18 +69,18 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
-  meta = with lib; {
+  meta = {
     description = "Dynamic library bundling the guest payload consumed by libkrun";
     homepage = "https://github.com/containers/libkrunfw";
-    license = with licenses; [
+    license = with lib.licenses; [
       lgpl2Only
       lgpl21Only
     ];
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       nickcao
       RossComputerGuy
       nrabulinski
     ];
-    platforms = [ "x86_64-linux" ] ++ lib.optionals (!sevVariant) [ "aarch64-linux" ];
+    platforms = [ "x86_64-linux" ] ++ lib.optionals (variant == null) [ "aarch64-linux" ];
   };
 })
diff --git a/pkgs/by-name/ll/llama-swap/package.nix b/pkgs/by-name/ll/llama-swap/package.nix
new file mode 100644
index 000000000000..8361419894df
--- /dev/null
+++ b/pkgs/by-name/ll/llama-swap/package.nix
@@ -0,0 +1,120 @@
+{
+  lib,
+  stdenv,
+
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+
+  callPackage,
+
+  nixosTests,
+}:
+
+let
+  canExecute = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+in
+buildGoModule (finalAttrs: {
+  pname = "llama-swap";
+  version = "156";
+
+  src = fetchFromGitHub {
+    owner = "mostlygeek";
+    repo = "llama-swap";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-z0262afVjsdGe6WPoWO1wbccLO538fXBuxOOqLnJHRU=";
+    # populate values that require us to use git. By doing this in postFetch we
+    # can delete .git afterwards and maintain better reproducibility of the src.
+    leaveDotGit = true;
+    postFetch = ''
+      cd "$out"
+      git rev-parse HEAD > $out/COMMIT
+      # '0000-00-00T00:00:00Z'
+      date -u -d "@$(git log -1 --pretty=%ct)" "+'%Y-%m-%dT%H:%M:%SZ'" > $out/SOURCE_DATE_EPOCH
+      find "$out" -name .git -print0 | xargs -0 rm -rf
+    '';
+  };
+
+  vendorHash = "sha256-5mmciFAGe8ZEIQvXejhYN+ocJL3wOVwevIieDuokhGU=";
+
+  passthru.ui = callPackage ./ui.nix { llama-swap = finalAttrs.finalPackage; };
+  passthru.npmDepsHash = "sha256-Sbvz3oudMVf+PxOJ6s7LsDaxFwvftNc8ZW5KPpbI/cA=";
+
+  nativeBuildInputs = [
+    versionCheckHook
+  ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${finalAttrs.version}"
+  ];
+
+  preBuild = ''
+    # ldflags based on metadata from git and source
+    ldflags+=" -X main.commit=$(cat COMMIT)"
+    ldflags+=" -X main.date=$(cat SOURCE_DATE_EPOCH)"
+
+    # copy for go:embed in proxy/ui_embed.go
+    cp -r ${finalAttrs.passthru.ui}/ui_dist proxy/
+  '';
+
+  excludedPackages = [
+    # regression testing tool
+    "misc/process-cmd-test"
+    # benchmark/regression testing tool
+    "misc/benchmark-chatcompletion"
+  ]
+  ++ lib.optionals (!canExecute) [
+    # some tests expect to execute `simple-something`; if it can't be executed
+    # it's unneeded
+    "misc/simple-responder"
+  ];
+
+  # some tests expect to execute `simple-something` and proxy/helpers_test.go
+  # checks the file exists
+  doCheck = canExecute;
+  preCheck = ''
+    mkdir build
+    ln -s "$GOPATH/bin/simple-responder" "./build/simple-responder_''${GOOS}_''${GOARCH}"
+  '';
+  postCheck = ''
+    rm "$GOPATH/bin/simple-responder"
+  '';
+
+  preInstall = ''
+    install -Dm444 -t "$out/share/llama-swap" config.example.yaml
+  '';
+
+  doInstallCheck = true;
+  versionCheckProgramArg = "-version";
+
+  passthru.tests.nixos = nixosTests.llama-swap;
+
+  meta = {
+    homepage = "https://github.com/mostlygeek/llama-swap";
+    changelog = "https://github.com/mostlygeek/llama-swap/releases/tag/${finalAttrs.src.tag}";
+    description = "Model swapping for llama.cpp (or any local OpenAPI compatible server)";
+    longDescription = ''
+      llama-swap is a light weight, transparent proxy server that provides
+      automatic model swapping to llama.cpp's server.
+
+      When a request is made to an OpenAI compatible endpoint, llama-swap will
+      extract the `model` value and load the appropriate server configuration to
+      serve it. If the wrong upstream server is running, it will be replaced
+      with the correct one. This is where the "swap" part comes in. The upstream
+      server is automatically swapped to the correct one to serve the request.
+
+      In the most basic configuration llama-swap handles one model at a time.
+      For more advanced use cases, the `groups` feature allows multiple models
+      to be loaded at the same time. You have complete control over how your
+      system resources are used.
+    '';
+    license = lib.licenses.mit;
+    mainProgram = "llama-swap";
+    maintainers = with lib.maintainers; [
+      jk
+      podium868909
+    ];
+  };
+})
diff --git a/pkgs/by-name/ll/llama-swap/ui.nix b/pkgs/by-name/ll/llama-swap/ui.nix
new file mode 100644
index 000000000000..6a6ac83b4f6e
--- /dev/null
+++ b/pkgs/by-name/ll/llama-swap/ui.nix
@@ -0,0 +1,26 @@
+{
+  llama-swap,
+
+  buildNpmPackage,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "${llama-swap.pname}-ui";
+  inherit (llama-swap) version src npmDepsHash;
+
+  postPatch = ''
+    substituteInPlace vite.config.ts \
+      --replace-fail "../proxy/ui_dist" "${placeholder "out"}/ui_dist"
+  '';
+
+  sourceRoot = "${finalAttrs.src.name}/ui";
+
+  # bundled "ui_dist" doesn't need node_modules
+  postInstall = ''
+    rm -rf $out/lib
+  '';
+
+  meta = (builtins.removeAttrs llama-swap.meta [ "mainProgram" ]) // {
+    description = "${llama-swap.meta.description} - UI";
+  };
+})
diff --git a/pkgs/by-name/ma/mattermostLatest/package.nix b/pkgs/by-name/ma/mattermostLatest/package.nix
index 21467244b2a9..cdf9b2a73fc6 100644
--- a/pkgs/by-name/ma/mattermostLatest/package.nix
+++ b/pkgs/by-name/ma/mattermostLatest/package.nix
@@ -11,8 +11,8 @@ mattermost.override {
     # and make sure the version regex is up to date here.
     # Ensure you also check ../mattermost/package.nix for ESR releases.
     regex = "^v(10\\.[0-9]+\\.[0-9]+)$";
-    version = "10.11.1";
-    srcHash = "sha256-iWznWqnsPDcq9hZqnPHCxqsOJESolVWDC6413hitFpk=";
+    version = "10.11.2";
+    srcHash = "sha256-lqMdH7jvnO6Z+dP+DHbxeM4iHU6EoJ3/bx8t/oJau0Q=";
     vendorHash = "sha256-Lqa463LLy41aaRbrtJFclfOj55vLjK4pWFAFLzX3TJE=";
     npmDepsHash = "sha256-p9dq31qw0EZDQIl2ysKE38JgDyLA6XvSv+VtHuRh+8A=";
     lockfileOverlay = ''
diff --git a/pkgs/by-name/me/mergiraf/package.nix b/pkgs/by-name/me/mergiraf/package.nix
index a79bd7c99340..7284c7f3da77 100644
--- a/pkgs/by-name/me/mergiraf/package.nix
+++ b/pkgs/by-name/me/mergiraf/package.nix
@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mergiraf";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "mergiraf";
     repo = "mergiraf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MPmpS4iLur05jkSUrGl6NCtzRO/8Pch9pRNuT6psNRo=";
+    hash = "sha256-ad5A3d/E1PyfI1/vKdHmiVcDokPSiGoMfg1eXKCbhtA=";
   };
 
-  cargoHash = "sha256-nT9HsG9eRBf4mRr7fqmRSQVI+yz+yr7wKCSQHG5JtD4=";
+  cargoHash = "sha256-8zOEFGkrlyaZMRbTzFVk3CujC1LlAxKqGslwZyjXoKw=";
 
   nativeCheckInputs = [ git ];
 
diff --git a/pkgs/by-name/mq/mqtt-exporter/package.nix b/pkgs/by-name/mq/mqtt-exporter/package.nix
index aa89deb73a48..167a2bb17720 100644
--- a/pkgs/by-name/mq/mqtt-exporter/package.nix
+++ b/pkgs/by-name/mq/mqtt-exporter/package.nix
@@ -1,23 +1,21 @@
 {
   lib,
-  python3,
   fetchFromGitHub,
+  python3,
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "mqtt-exporter";
-  version = "1.7.0";
+  version = "1.8.1-1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kpetremann";
     repo = "mqtt-exporter";
     tag = "v${version}";
-    hash = "sha256-aEuwJeNMB6sou6oyAwCj11lOdMCjCyEsrDcMF/pHzcg=";
+    hash = "sha256-FBB8KvSLrcJ9pdfVq18ykovwApNZoOcU0xTfvAWTxpc=";
   };
 
-  pythonRelaxDeps = [ "prometheus-client" ];
-
   build-system = with python3.pkgs; [ setuptools ];
 
   dependencies = with python3.pkgs; [
diff --git a/pkgs/by-name/na/nak/package.nix b/pkgs/by-name/na/nak/package.nix
index eac7b61676bd..1da7c7b694ff 100644
--- a/pkgs/by-name/na/nak/package.nix
+++ b/pkgs/by-name/na/nak/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "nak";
-  version = "0.15.3";
+  version = "0.15.4";
 
   src = fetchFromGitHub {
     owner = "fiatjaf";
     repo = "nak";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PSg+27uTpPIrKlYArWOv92l5muQRQiFZ6Vvu7hDLt5s=";
+    hash = "sha256-9Ap342HKD9byMGjFS8/3Ai14T5QJfsA5eYvUvqM02Gg=";
   };
 
-  vendorHash = "sha256-qwi3awU1DHjT/4scGUrhsdlmXJYwq0g/t4LaZ8FGYB0=";
+  vendorHash = "sha256-CoEwwxKyW2bYwVA6mpIdGjzEyN8m7K+1bODnPLajGJo=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ne/netpeek/package.nix b/pkgs/by-name/ne/netpeek/package.nix
index 9ecd9cd7f69c..626dbc3dd7e2 100644
--- a/pkgs/by-name/ne/netpeek/package.nix
+++ b/pkgs/by-name/ne/netpeek/package.nix
@@ -15,14 +15,14 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "netpeek";
-  version = "0.2.3.1";
+  version = "0.2.4";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "ZingyTomato";
     repo = "NetPeek";
     tag = "v${version}";
-    hash = "sha256-3PbGK8e/W4pHlXwIvW6kmyeBMvzBIS2DrV0pxafgJOY=";
+    hash = "sha256-mouXMFYhCBEUTyPfuaw570ZC40TJuprldiSiP0Il0KA=";
   };
 
   nativeBuildInputs = [
@@ -43,6 +43,7 @@ python3Packages.buildPythonApplication rec {
   dependencies = with python3Packages; [
     pygobject3
     ping3
+    python-nmap
   ];
 
   dontWrapGApps = true;
diff --git a/pkgs/by-name/nf/nfs-ganesha/allow-bypassing-dbus-pkg-config-test.patch b/pkgs/by-name/nf/nfs-ganesha/allow-bypassing-dbus-pkg-config-test.patch
new file mode 100644
index 000000000000..0f83ba51870c
--- /dev/null
+++ b/pkgs/by-name/nf/nfs-ganesha/allow-bypassing-dbus-pkg-config-test.patch
@@ -0,0 +1,44 @@
+diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
+index 73276dff6..94027f5cb 100644
+--- a/src/CMakeLists.txt
++++ b/src/CMakeLists.txt
+@@ -974,21 +974,27 @@ endif(USE_EFENCE)
+
+ gopt_test(USE_DBUS)
+ if(USE_DBUS)
+-  find_package(PkgConfig)
+-  # pkg_check_modules doesn't fatal error on REQUIRED, so handle it ourselves
+-  pkg_check_modules(DBUS ${USE_DBUS_REQUIRED} dbus-1)
+-  if(NOT DBUS_FOUND)
+-    if(USE_DBUS_REQUIRED)
+-      message(FATAL_ERROR "Cannot find DBUS libs but requested on command line")
+-    else(USE_DBUS_REQUIRED)
+-      message(WARNING "Cannot find DBUS libs. Disabling DBUS support")
+-      set(USE_DBUS OFF)
+-    endif(USE_DBUS_REQUIRED)
+-  else(NOT DBUS_FOUND)
++  if(DBUS_NO_PKGCONFIG)
+     set(SYSTEM_LIBRARIES ${DBUS_LIBRARIES} ${SYSTEM_LIBRARIES})
+     LIST(APPEND CMAKE_LIBRARY_PATH ${DBUS_LIBRARY_DIRS})
+     link_directories (${DBUS_LIBRARY_DIRS})
+-  endif(NOT DBUS_FOUND)
++  else(DBUS_NO_PKGCONFIG)
++    find_package(PkgConfig)
++    # pkg_check_modules doesn't fatal error on REQUIRED, so handle it ourselves
++    pkg_check_modules(DBUS ${USE_DBUS_REQUIRED} dbus-1)
++    if(NOT DBUS_FOUND)
++      if(USE_DBUS_REQUIRED)
++        message(FATAL_ERROR "Cannot find DBUS libs but requested on command line")
++      else(USE_DBUS_REQUIRED)
++        message(WARNING "Cannot find DBUS libs. Disabling DBUS support")
++        set(USE_DBUS OFF)
++      endif(USE_DBUS_REQUIRED)
++    else(NOT DBUS_FOUND)
++      set(SYSTEM_LIBRARIES ${DBUS_LIBRARIES} ${SYSTEM_LIBRARIES})
++      LIST(APPEND CMAKE_LIBRARY_PATH ${DBUS_LIBRARY_DIRS})
++      link_directories (${DBUS_LIBRARY_DIRS})
++    endif(NOT DBUS_FOUND)
++  endif(DBUS_NO_PKGCONFIG)
+ endif(USE_DBUS)
+
+ if(USE_CB_SIMULATOR AND NOT USE_DBUS)
diff --git a/pkgs/by-name/nf/nfs-ganesha/package.nix b/pkgs/by-name/nf/nfs-ganesha/package.nix
index c3b65eb37243..8825d169e0da 100644
--- a/pkgs/by-name/nf/nfs-ganesha/package.nix
+++ b/pkgs/by-name/nf/nfs-ganesha/package.nix
@@ -8,7 +8,6 @@
   krb5,
   xfsprogs,
   jemalloc,
-  dbus,
   libcap,
   ntirpc,
   liburcu,
@@ -16,6 +15,10 @@
   flex,
   nfs-utils,
   acl,
+  useCeph ? false,
+  ceph,
+  useDbus ? true,
+  dbus,
 }:
 
 stdenv.mkDerivation rec {
@@ -35,6 +38,8 @@ stdenv.mkDerivation rec {
     hash = "sha256-OHGmEzHu8y/TPQ70E2sicaLtNgvlf/bRq8JRs6S1tpY=";
   };
 
+  patches = lib.optional useDbus ./allow-bypassing-dbus-pkg-config-test.patch;
+
   preConfigure = "cd src";
 
   cmakeFlags = [
@@ -44,6 +49,19 @@ stdenv.mkDerivation rec {
     "-DUSE_ACL_MAPPING=ON"
     "-DCMAKE_BUILD_WITH_INSTALL_RPATH=ON"
     "-DUSE_MAN_PAGE=ON"
+  ]
+  ++ lib.optionals useCeph [
+    "-DUSE_RADOS_RECOV=ON"
+    "-DRADOS_URLS=ON"
+    "-DUSE_FSAL_CEPH=ON"
+    "-DUSE_FSAL_RGW=ON"
+  ]
+  ++ lib.optionals useDbus [
+    "-DUSE_DBUS=ON"
+    "-DDBUS_NO_PKGCONFIG=ON"
+    "-DDBUS_LIBRARY_DIRS=${lib.getLib dbus}/lib"
+    "-DDBUS_INCLUDE_DIRS=${lib.getDev dbus}/include/dbus-1.0\\;${lib.getLib dbus}/lib/dbus-1.0/include"
+    "-DDBUS_LIBRARIES=dbus-1"
   ];
 
   nativeBuildInputs = [
@@ -52,7 +70,8 @@ stdenv.mkDerivation rec {
     bison
     flex
     sphinx
-  ];
+  ]
+  ++ lib.optional useDbus dbus;
 
   buildInputs = [
     acl
@@ -64,7 +83,8 @@ stdenv.mkDerivation rec {
     ntirpc
     liburcu
     nfs-utils
-  ];
+  ]
+  ++ lib.optional useCeph ceph;
 
   postPatch = ''
     substituteInPlace src/tools/mount.9P --replace "/bin/mount" "/usr/bin/env mount"
@@ -72,10 +92,20 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
     patchelf --add-rpath $out/lib $out/bin/ganesha.nfsd
+    patchelf --add-rpath $out/lib $out/lib/libganesha_nfsd.so
+  ''
+  + lib.optionalString useCeph ''
+    patchelf --add-rpath $out/lib $out/bin/ganesha-rados-grace
+    patchelf --add-rpath $out/lib $out/lib/libganesha_rados_recov.so
+    patchelf --add-rpath $out/lib $out/lib/libganesha_rados_urls.so
   '';
 
   postInstall = ''
     install -Dm755 $src/src/tools/mount.9P $tools/bin/mount.9P
+  ''
+  + lib.optionalString useDbus ''
+    # Policy for D-Bus statistics interface
+    install -Dm644 $src/src/scripts/ganeshactl/org.ganesha.nfsd.conf $out/etc/dbus-1/system.d/org.ganesha.nfsd.conf
   '';
 
   meta = with lib; {
diff --git a/pkgs/by-name/ok/okteto/package.nix b/pkgs/by-name/ok/okteto/package.nix
index a23d8913633f..611752b98fa7 100644
--- a/pkgs/by-name/ok/okteto/package.nix
+++ b/pkgs/by-name/ok/okteto/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "okteto";
-  version = "3.10.1";
+  version = "3.11.0";
 
   src = fetchFromGitHub {
     owner = "okteto";
     repo = "okteto";
     tag = finalAttrs.version;
-    hash = "sha256-gYdws+cUJpr0tIztO9tjc/dVtBWau6HdriP/Y8p+kOQ=";
+    hash = "sha256-gzOymFkzz2MStbhLA1viJuHNbsBFDLqbhG0lIaxAC+w=";
   };
 
-  vendorHash = "sha256-Pun9LgQAv/wlX0CwU4AJuEkMeZgPTL+ExmUevURvjYE=";
+  vendorHash = "sha256-wkuCUMzmYAWf8RjM6DkTTHaY7qEIjGNYiT4grtCbYs8=";
 
   postPatch = ''
     # Disable some tests that need file system & network access.
diff --git a/pkgs/by-name/op/openapv/package.nix b/pkgs/by-name/op/openapv/package.nix
index b4f7e162b8b5..6d3fdcbf4f8e 100644
--- a/pkgs/by-name/op/openapv/package.nix
+++ b/pkgs/by-name/op/openapv/package.nix
@@ -11,13 +11,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "openapv";
-  version = "0.2.0.1";
+  version = "0.2.0.2";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "openapv";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Edj3xQ7AcHcdIbg4o2FidAGZ06fUBltW+1ojJPoIktA=";
+    hash = "sha256-Eam53Fc0oYOE2YH+Q1Cx6TxClMoUaDZuRhrC8LX6S7g=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/op/opentelemetry-cpp/0001-Disable-tests-requiring-network-access.patch b/pkgs/by-name/op/opentelemetry-cpp/0001-Disable-tests-requiring-network-access.patch
index 067fb7f23878..5d8b4be59b5d 100644
--- a/pkgs/by-name/op/opentelemetry-cpp/0001-Disable-tests-requiring-network-access.patch
+++ b/pkgs/by-name/op/opentelemetry-cpp/0001-Disable-tests-requiring-network-access.patch
@@ -1,8 +1,8 @@
 diff --git a/ext/test/http/curl_http_test.cc b/ext/test/http/curl_http_test.cc
-index 7c66d98b..62d40f49 100644
+index e8299202..19dbd7b1 100644
 --- a/ext/test/http/curl_http_test.cc
 +++ b/ext/test/http/curl_http_test.cc
-@@ -229,7 +229,7 @@ TEST_F(BasicCurlHttpTests, HttpResponse)
+@@ -270,7 +270,7 @@ TEST_F(BasicCurlHttpTests, HttpResponse)
    ASSERT_EQ(count, 4);
  }
  
@@ -11,8 +11,8 @@ index 7c66d98b..62d40f49 100644
  {
    received_requests_.clear();
    auto session_manager = http_client::HttpClientFactory::Create();
-@@ -246,7 +246,7 @@ TEST_F(BasicCurlHttpTests, SendGetRequest)
-   ASSERT_TRUE(handler->got_response_);
+@@ -287,7 +287,7 @@ TEST_F(BasicCurlHttpTests, SendGetRequest)
+   ASSERT_TRUE(handler->got_response_.load(std::memory_order_acquire));
  }
  
 -TEST_F(BasicCurlHttpTests, SendPostRequest)
@@ -20,25 +20,25 @@ index 7c66d98b..62d40f49 100644
  {
    received_requests_.clear();
    auto session_manager = http_client::HttpClientFactory::Create();
-@@ -325,7 +325,7 @@ TEST_F(BasicCurlHttpTests, CurlHttpOperations)
-   delete handler;
+@@ -313,7 +313,7 @@ TEST_F(BasicCurlHttpTests, SendPostRequest)
+   session_manager->FinishAllSessions();
  }
  
+-TEST_F(BasicCurlHttpTests, RequestTimeout)
++TEST_F(BasicCurlHttpTests, DISABLED_RequestTimeout)
+ {
+   received_requests_.clear();
+   auto session_manager = http_client::HttpClientFactory::Create();
+@@ -442,7 +442,7 @@ TEST_F(BasicCurlHttpTests, ExponentialBackoffRetry)
+ }
+ #endif  // ENABLE_OTLP_RETRY_PREVIEW
+ 
 -TEST_F(BasicCurlHttpTests, SendGetRequestSync)
 +TEST_F(BasicCurlHttpTests, DISABLED_SendGetRequestSync)
  {
    received_requests_.clear();
    curl::HttpClientSync http_client;
-@@ -336,7 +336,7 @@ TEST_F(BasicCurlHttpTests, SendGetRequestSync)
-   EXPECT_EQ(result.GetSessionState(), http_client::SessionState::Response);
- }
- 
--TEST_F(BasicCurlHttpTests, SendGetRequestSyncTimeout)
-+TEST_F(BasicCurlHttpTests, DISABLED_SendGetRequestSyncTimeout)
- {
-   received_requests_.clear();
-   curl::HttpClientSync http_client;
-@@ -350,7 +350,7 @@ TEST_F(BasicCurlHttpTests, SendGetRequestSyncTimeout)
+@@ -467,7 +467,7 @@ TEST_F(BasicCurlHttpTests, SendGetRequestSyncTimeout)
                result.GetSessionState() == http_client::SessionState::SendFailed);
  }
  
@@ -47,7 +47,7 @@ index 7c66d98b..62d40f49 100644
  {
    received_requests_.clear();
    curl::HttpClientSync http_client;
-@@ -378,7 +378,7 @@ TEST_F(BasicCurlHttpTests, GetBaseUri)
+@@ -495,7 +495,7 @@ TEST_F(BasicCurlHttpTests, GetBaseUri)
              "http://127.0.0.1:31339/");
  }
  
@@ -56,7 +56,7 @@ index 7c66d98b..62d40f49 100644
  {
    curl::HttpClient http_client;
  
-@@ -452,7 +452,7 @@ TEST_F(BasicCurlHttpTests, SendGetRequestAsyncTimeout)
+@@ -570,7 +570,7 @@ TEST_F(BasicCurlHttpTests, SendGetRequestAsyncTimeout)
    }
  }
  
@@ -65,7 +65,7 @@ index 7c66d98b..62d40f49 100644
  {
    curl::HttpClient http_client;
  
-@@ -491,7 +491,7 @@ TEST_F(BasicCurlHttpTests, SendPostRequestAsync)
+@@ -609,7 +609,7 @@ TEST_F(BasicCurlHttpTests, SendPostRequestAsync)
    }
  }
  
@@ -74,6 +74,12 @@ index 7c66d98b..62d40f49 100644
  {
    curl::HttpClient http_client;
  
--- 
-2.40.1
-
+@@ -647,7 +647,7 @@ TEST_F(BasicCurlHttpTests, FinishInAsyncCallback)
+   }
+ }
+ 
+-TEST_F(BasicCurlHttpTests, ElegantQuitQuick)
++TEST_F(BasicCurlHttpTests, DISABLED_ElegantQuitQuick)
+ {
+   auto http_client = http_client::HttpClientFactory::Create();
+   std::static_pointer_cast<curl::HttpClient>(http_client)->MaybeSpawnBackgroundThread();
diff --git a/pkgs/by-name/op/opentelemetry-cpp/package.nix b/pkgs/by-name/op/opentelemetry-cpp/package.nix
index 000208061581..0210970b3bd1 100644
--- a/pkgs/by-name/op/opentelemetry-cpp/package.nix
+++ b/pkgs/by-name/op/opentelemetry-cpp/package.nix
@@ -10,25 +10,30 @@
   prometheus-cpp,
   nlohmann_json,
   nix-update-script,
+  cxxStandard ? null,
+  enableHttp ? false,
+  enableGrpc ? false,
+  enablePrometheus ? false,
+  enableElasticSearch ? false,
+  enableZipkin ? false,
 }:
-
 let
   opentelemetry-proto = fetchFromGitHub {
     owner = "open-telemetry";
     repo = "opentelemetry-proto";
-    rev = "v1.3.2";
-    hash = "sha256-bkVqPSVhyMHrmFvlI9DTAloZzDozj3sefIEwfW7OVrI=";
+    rev = "v1.5.0";
+    hash = "sha256-PkG0npG3nKQwq6SxWdIliIQ/wrYAOG9qVb26IeVkBfc=";
   };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "opentelemetry-cpp";
-  version = "1.16.1";
+  version = "1.20.0";
 
   src = fetchFromGitHub {
     owner = "open-telemetry";
     repo = "opentelemetry-cpp";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-31zwIZ4oehhfn+oCyg8VQTurPOmdgp72plH1Pf/9UKQ=";
+    hash = "sha256-ibLuHIg01wGYPhLRz+LVYA34WaWzlUlNtg7DSONLe9g=";
   };
 
   patches = [
@@ -40,12 +45,18 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     curl
-    grpc
     nlohmann_json
-    prometheus-cpp
-    protobuf
   ];
 
+  propagatedBuildInputs =
+    lib.optionals (enableGrpc || enableHttp) [ protobuf ]
+    ++ lib.optionals enableGrpc [
+      grpc
+    ]
+    ++ lib.optionals enablePrometheus [
+      prometheus-cpp
+    ];
+
   doCheck = true;
 
   checkInputs = [
@@ -55,15 +66,18 @@ stdenv.mkDerivation (finalAttrs: {
   strictDeps = true;
 
   cmakeFlags = [
-    "-DBUILD_SHARED_LIBS=ON"
-    "-DWITH_OTLP_HTTP=ON"
-    "-DWITH_OTLP_GRPC=ON"
-    "-DWITH_ABSEIL=ON"
-    "-DWITH_PROMETHEUS=ON"
-    "-DWITH_ELASTICSEARCH=ON"
-    "-DWITH_ZIPKIN=ON"
-    "-DWITH_BENCHMARK=OFF"
-    "-DOTELCPP_PROTO_PATH=${opentelemetry-proto}"
+    (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
+    (lib.cmakeBool "WITH_BENCHMARK" false)
+    (lib.cmakeBool "WITH_OTLP_HTTP" enableHttp)
+    (lib.cmakeBool "WITH_OTLP_GRPC" enableGrpc)
+    (lib.cmakeBool "WITH_PROMETHEUS" enablePrometheus)
+    (lib.cmakeBool "WITH_ELASTICSEARCH" enableElasticSearch)
+    (lib.cmakeBool "WITH_ZIPKIN" enableZipkin)
+    (lib.cmakeFeature "OTELCPP_PROTO_PATH" "${opentelemetry-proto}")
+  ]
+  ++ lib.optionals (cxxStandard != null) [
+    (lib.cmakeFeature "CMAKE_CXX_STANDARD" cxxStandard)
+    (lib.cmakeFeature "WITH_STL" "CXX${cxxStandard}")
   ];
 
   outputs = [
@@ -72,8 +86,8 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   postInstall = ''
-    substituteInPlace $out/lib/cmake/opentelemetry-cpp/opentelemetry-cpp-target.cmake \
-      --replace-fail "\''${_IMPORT_PREFIX}/include" "$dev/include"
+    substituteInPlace $out/lib/cmake/opentelemetry-cpp/opentelemetry-cpp*-target.cmake \
+      --replace-quiet "\''${_IMPORT_PREFIX}/include" "$dev/include"
   '';
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/by-name/op/opentofu/package.nix b/pkgs/by-name/op/opentofu/package.nix
index d9959676436c..67bb63b137a9 100644
--- a/pkgs/by-name/op/opentofu/package.nix
+++ b/pkgs/by-name/op/opentofu/package.nix
@@ -15,16 +15,16 @@
 let
   package = buildGoModule rec {
     pname = "opentofu";
-    version = "1.10.5";
+    version = "1.10.6";
 
     src = fetchFromGitHub {
       owner = "opentofu";
       repo = "opentofu";
       tag = "v${version}";
-      hash = "sha256-w7uzTG0zqa+izncQoqCSbIJCCIz+jOVbPg9/HiCm7Ik=";
+      hash = "sha256-IEdnESrhDT2rDha7TNgUnGnPioNPnKrUuOXSGRnUOBI=";
     };
 
-    vendorHash = "sha256-+cwFkqhFuLJCb02tvYjccpkNzy7tz979mjgCeqi2DC4=";
+    vendorHash = "sha256-ZnQDRiLdg12Dx9RdK1xBWUrAm3QQLGhwH1vxh4ieVv0=";
     ldflags = [
       "-s"
       "-w"
diff --git a/pkgs/by-name/op/openvas-scanner/package.nix b/pkgs/by-name/op/openvas-scanner/package.nix
index 9813e9ceb4fe..0531e722c863 100644
--- a/pkgs/by-name/op/openvas-scanner/package.nix
+++ b/pkgs/by-name/op/openvas-scanner/package.nix
@@ -31,13 +31,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openvas-scanner";
-  version = "23.23.1";
+  version = "23.24.0";
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "openvas-scanner";
     tag = "v${version}";
-    hash = "sha256-+G8wFkPYxGsh6esQEpQ5GckTYgPvwqxhibTOe12riyk=";
+    hash = "sha256-6ZqUfqwtotVrMOLh0QiAjN+Syz0HhP1r8GIFhMfYVio=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/os/osmo-bsc/package.nix b/pkgs/by-name/os/osmo-bsc/package.nix
index 74aff521c2e0..5a25b604eda8 100644
--- a/pkgs/by-name/os/osmo-bsc/package.nix
+++ b/pkgs/by-name/os/osmo-bsc/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "osmo-bsc";
-  version = "1.13.0";
+  version = "1.13.2";
 
   src = fetchFromGitHub {
     owner = "osmocom";
     repo = "osmo-bsc";
     rev = version;
-    hash = "sha256-wQtGyqqaEW+mM6Eg85N+i3ZiKC/Z6wxYk2Wwvz7qOFw=";
+    hash = "sha256-YSCbVqELh/id9sK4G5xF8riYXhwFtXU/lXMlH6XxvXY=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/os/ospd-openvas/package.nix b/pkgs/by-name/os/ospd-openvas/package.nix
index c4017f2e521e..0900aa4a1250 100644
--- a/pkgs/by-name/os/ospd-openvas/package.nix
+++ b/pkgs/by-name/os/ospd-openvas/package.nix
@@ -18,6 +18,7 @@ python3.pkgs.buildPythonApplication rec {
 
   pythonRelaxDeps = [
     "defusedxml"
+    "lxml"
     "packaging"
     "psutil"
     "python-gnupg"
diff --git a/pkgs/by-name/pr/proggyfonts/package.nix b/pkgs/by-name/pr/proggyfonts/package.nix
index 046798a444aa..4f78c8f9cef7 100644
--- a/pkgs/by-name/pr/proggyfonts/package.nix
+++ b/pkgs/by-name/pr/proggyfonts/package.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    homepage = "https://www.upperbounds.net";
+    homepage = "https://github.com/bluescan/proggyfonts";
     description = "Set of fixed-width screen fonts that are designed for code listings";
     license = licenses.mit;
     platforms = platforms.all;
diff --git a/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix b/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix
new file mode 100644
index 000000000000..58229d06f822
--- /dev/null
+++ b/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix
@@ -0,0 +1,14 @@
+{
+  version = "1.75.0";
+  hashes = {
+    linux-aarch_64 = "sha256-fkWjH5rq+rmirorx+SgjgabYw8DZKbUVt5o2poxfAGg=";
+    linux-ppcle_64 = "sha256-FC0NgeMZuj1KfSyiqffZyK6/dzvmrZLoI5vz4q8IdlE=";
+    linux-s390_64 = "sha256-+oXkS7B9o07k1k+J3/fkwVrMhji4R8lLdUcdStP6PK0=";
+    linux-x86_32 = "sha256-givjTIdi/vJtLgitkUW9IxbS5jb7qh42fhFS9drudo0=";
+    linux-x86_64 = "sha256-WTZvtYoZ79TjZ0wVaOlO8WeBYVGs+q0C+k7wS7yrKT0=";
+    osx-aarch_64 = "sha256-kzfvzNrQHdj0tO8n+mcMHKZ5QVgAaXkJf6qsDAvCuJY=";
+    osx-x86_64 = "sha256-kzfvzNrQHdj0tO8n+mcMHKZ5QVgAaXkJf6qsDAvCuJY=";
+    windows-x86_32 = "sha256-fOa2fuO+q/DTg0Om79mGlUN39Dhr/IvzM8j42/DG7KI=";
+    windows-x86_64 = "sha256-yaiM0ILXQfMZBBX9IwtpEkO6qqz7h7KurH56mKT+NbA=";
+  };
+}
diff --git a/pkgs/by-name/pr/protoc-gen-grpc-java/hashes.nix b/pkgs/by-name/pr/protoc-gen-grpc-java/hashes.nix
deleted file mode 100644
index da9182e6d068..000000000000
--- a/pkgs/by-name/pr/protoc-gen-grpc-java/hashes.nix
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  linux-aarch_64 = "sha256-sgdZoaSM7LgK4DbbKPJO3FdBA37YAX86meaKDLQiOmg=";
-  linux-ppcle_64 = "sha256-k4nQGJNwtd8W4nJLyWPRhqjikczy7p7ffDIrWxkcUTA=";
-  linux-s390_64 = "sha256-fcuNlJeUmduFzqt5WaefYk3lFVmdHeSFIEkbwT2I1O0=";
-  linux-x86_32 = "sha256-KNvqGkeERd2UxzhjO/Fp6Uv7DGBt15rPGviRmH7pmno=";
-  linux-x86_64 = "sha256-7LI115E3BOz3jnHavkQBbN0hsjKuSbnXNAjXFw/D14I=";
-  osx-aarch_64 = "sha256-gAo2bcsivjDVFX5cUvzngoHgqTAPt+3Hiuynd17/KTo=";
-  osx-x86_64 = "sha256-gAo2bcsivjDVFX5cUvzngoHgqTAPt+3Hiuynd17/KTo=";
-  windows-x86_32 = "sha256-ERbksXFy4AFhZSFG9G4AMOi68EzEScBvDJFF9+rnPnU=";
-  windows-x86_64 = "sha256-wZU6on7A84fPm8xwD8pBgSk8+fkB14LdvWZXEniz8LU=";
-}
diff --git a/pkgs/by-name/pr/protoc-gen-grpc-java/package.nix b/pkgs/by-name/pr/protoc-gen-grpc-java/package.nix
index 277a914bfc7b..5d2dbdf68d18 100644
--- a/pkgs/by-name/pr/protoc-gen-grpc-java/package.nix
+++ b/pkgs/by-name/pr/protoc-gen-grpc-java/package.nix
@@ -33,13 +33,14 @@ let
           throw "Unsupported CPU \"${platform.parsed.cpu.name}\"";
     in
     "${os}-${arch}";
+  data = import ./data.nix;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "protoc-gen-grpc-java";
-  version = "1.73.0";
+  inherit (data) version;
   src = fetchurl {
     url = "https://repo1.maven.org/maven2/io/grpc/protoc-gen-grpc-java/${finalAttrs.version}/protoc-gen-grpc-java-${finalAttrs.version}-${hostArch}.exe";
-    hash = (import ./hashes.nix).${hostArch} or (throw "Unsuported host arch ${hostArch}");
+    hash = data.hashes.${hostArch} or (throw "Unsuported host arch ${hostArch}");
   };
   dontUnpack = true;
   dontConfigure = true;
diff --git a/pkgs/by-name/pr/protoc-gen-grpc-java/update.sh b/pkgs/by-name/pr/protoc-gen-grpc-java/update.sh
index b0c8e2f98df4..f9fd21ff09b0 100755
--- a/pkgs/by-name/pr/protoc-gen-grpc-java/update.sh
+++ b/pkgs/by-name/pr/protoc-gen-grpc-java/update.sh
@@ -14,7 +14,7 @@ ARCHS=(
   'windows-x86_32'
   'windows-x86_64'
 )
-HASHES_FILE=pkgs/by-name/pr/protoc-gen-grpc-java/hashes.nix
+DATA_FILE=pkgs/by-name/pr/protoc-gen-grpc-java/data.nix
 
 version="$(
   curl --silent --location --fail \
@@ -24,10 +24,13 @@ version="$(
     sed 's/^v//'
 )"
 
-echo '{' >"${HASHES_FILE}"
+echo '{' >"${DATA_FILE}"
+echo "  version = \"${version}\";" >>"${DATA_FILE}"
+echo '  hashes = {' >>"${DATA_FILE}"
 for arch in "${ARCHS[@]}"; do
   url="https://repo1.maven.org/maven2/io/grpc/protoc-gen-grpc-java/${version}/protoc-gen-grpc-java-${version}-${arch}.exe"
   hash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri "$(nix-prefetch-url "${url}")")
-  echo "  ${arch} = \"${hash}\";" >>"${HASHES_FILE}"
+  echo "    ${arch} = \"${hash}\";" >>"${DATA_FILE}"
 done
-echo '}' >>"${HASHES_FILE}"
+echo '  };' >>"${DATA_FILE}"
+echo '}' >>"${DATA_FILE}"
diff --git a/pkgs/by-name/qu/quake-injector/deps.json b/pkgs/by-name/qu/quake-injector/deps.json
deleted file mode 100644
index 3f0440140798..000000000000
--- a/pkgs/by-name/qu/quake-injector/deps.json
+++ /dev/null
@@ -1,190 +0,0 @@
-{
- "!comment": "This is a nixpkgs Gradle dependency lockfile. For more details, refer to the Gradle section in the nixpkgs manual.",
- "!version": 1,
- "https://github.com": {
-  "adoptium/temurin17-binaries/releases/download/jdk-17.0.10%2B7/OpenJDK17U-jdk_x86-32_windows_hotspot_17.0.10_7": {
-   "zip": "sha256-EWZ+nnu8uYBDDWzGMFUxYqDBikI4xLBAu2cc2AYHcQY="
-  }
- },
- "https://jcenter.bintray.com": {
-  "com/github/spotbugs#spotbugs-annotations/4.2.2": {
-   "jar": "sha256-VlfEgKMYg88/xtEuauUiyfzJpjA7RZOe5Cyi4Mz07QQ=",
-   "module": "sha256-yjYif6H3bmbT7boJ5N9R38nyrfkyttH6EjT+Lx0KB5s=",
-   "pom": "sha256-vz9CdawvbTnQq1gV28D2/yYBUoRztjtpkGdM3uuuRaM="
-  },
-  "com/github/spotbugs#spotbugs/4.2.2": {
-   "jar": "sha256-JO9T3cYiZAe+ndgHzFy5ZFQwKG91Bb0yK24Cc9Bz8DY=",
-   "module": "sha256-vRozvig14GQmmfibS3VeJ1iNrYu5vbuAYxT6LdWECRQ=",
-   "pom": "sha256-M2abH/xQYg2pZA2xlZepdre64Cab/05yd7Gg3D1qUNA="
-  },
-  "com/google/code/findbugs#jsr305/3.0.2": {
-   "jar": "sha256-dmrSoHg/JoeWLIrXTO7MOKKLn3Ki0IXuQ4t4E+ko0Mc=",
-   "pom": "sha256-GYidvfGyVLJgGl7mRbgUepdGRIgil2hMeYr+XWPXjf4="
-  },
-  "com/google/code/gson#gson-parent/2.8.6": {
-   "pom": "sha256-NzZGOFnsGSZyleiUlAroKo9oRBMDESL+Nc58/34wp3Q="
-  },
-  "com/google/code/gson#gson/2.8.6": {
-   "jar": "sha256-yPtIOQVNKAswM/gA0fWpfeLwKOuLoutFitKH5Tbz8l8=",
-   "pom": "sha256-IXRBWmRzMtMP2gS9HPxwij7MhOr3UX9ZYYjYJE4QORE="
-  },
-  "edu/stanford/ejalbert#BrowserLauncher2/1.3": {
-   "jar": "sha256-pt7rHbhm7S+cyE7uu4kIgOfOAgptYS9pnpBAOuP371o=",
-   "pom": "sha256-zcuMk+OUxzYg8zUs1ALIN0rF3wI7bJArOhDST1SUeG0="
-  },
-  "jaxen#jaxen/1.2.0": {
-   "jar": "sha256-cP7vndda0GTe8Fo86Jda66UV7n0b4UbRIZnIgopkF0w=",
-   "pom": "sha256-zEgr+qIqVQepb6WzorYVkRRDrT9zZOAgBNGQsGfzsH8="
-  },
-  "net/jcip#jcip-annotations/1.0": {
-   "jar": "sha256-vlgFOSBgxxR0v2yaZ6CZRxJ00wuD7vhL/E4IiaTx3MA=",
-   "pom": "sha256-XBnmhIzFUKlWZPsIIwS8X5/Pe2cvrwOvFjXw6TwmgXc="
-  },
-  "net/sf/launch4j#launch4j/3.14": {
-   "pom": "sha256-xEYpdod2nJWyb2Qg9zsr0qKd90TYllTAdKhVb2Is+Vs="
-  },
-  "net/sf/launch4j#launch4j/3.14/workdir-linux64": {
-   "jar": "sha256-mphFGb9E6CWlsEFZfgVPi/qy+Tpm+na30aM79JIcNUY="
-  },
-  "net/sf/saxon#Saxon-HE/10.3": {
-   "jar": "sha256-ZgqJFipXfP1zvD2zxTy+x+gtSrIFEkfzGSfxNa/3yQg=",
-   "pom": "sha256-FfRI8O2fblTGre47tov582btryOPYW33hB8dzXc3hpg="
-  },
-  "org/apache#apache/21": {
-   "pom": "sha256-rxDBCNoBTxfK+se1KytLWjocGCZfoq+XoyXZFDU3s4A="
-  },
-  "org/apache#apache/23": {
-   "pom": "sha256-vBBiTgYj82V3+sVjnKKTbTJA7RUvttjVM6tNJwVDSRw="
-  },
-  "org/apache/bcel#bcel/6.5.0": {
-   "jar": "sha256-ves4HQ0ZmZ4iHmoPjYv0T1sZwuV+q/aLcNwJhlKu+vU=",
-   "pom": "sha256-/B6eb17UvSAMsGYghsiYwAAmOGoutKY0hBH34OBotcU="
-  },
-  "org/apache/commons#commons-lang3/3.12.0": {
-   "jar": "sha256-2RnZBEhsA3+NGTQS2gyS4iqfokIwudZ6V4VcXDHH6U4=",
-   "pom": "sha256-gtMfHcxFg+/9dE6XkWWxbaZL+GvKYj/F0bA+2U9FyFo="
-  },
-  "org/apache/commons#commons-parent/50": {
-   "pom": "sha256-e3ots/dHB0tYZ/VT1e/IByvibt4yh50FLDR+fIERfwY="
-  },
-  "org/apache/commons#commons-parent/51": {
-   "pom": "sha256-m3edGLItjeVZYFVY57sKCjGz8Awqu5yHgRfDmKrKvso="
-  },
-  "org/apache/commons#commons-parent/52": {
-   "pom": "sha256-ddvo806Y5MP/QtquSi+etMvNO18QR9VEYKzpBtu0UC4="
-  },
-  "org/apache/commons#commons-text/1.9": {
-   "jar": "sha256-CBLyhKxd0NYXRh2aKrasaBETfyUSLf/9R4ikhx5zLQA=",
-   "pom": "sha256-n5IWz8lE3KeC5jEdYnV/13Fk/mfaKbWPAVaH+gn0QFA="
-  },
-  "org/dom4j#dom4j/2.1.3": {
-   "jar": "sha256-VJ8wB8YpD2qQHlfR0zG07Q5r9zhPeL8QMW/87sqDTeY=",
-   "module": "sha256-3sfF/Y1SDa+1exXi87a+LxgFYTQqP0Ub7u6QVUO8FwM=",
-   "pom": "sha256-zcnEn1nSMNQnF3G7dkqnCX1qy83CUAFJ5NLJUd9crDA="
-  },
-  "org/junit#junit-bom/5.7.1": {
-   "module": "sha256-mFTjiU1kskhSB+AEa8oHs9QtFp54L0+oyc4imnj67gQ=",
-   "pom": "sha256-C5sUo9YhBvr+jGinF7h7h60YaFiZRRt1PAT6QbaFd4Q="
-  },
-  "org/ow2#ow2/1.5": {
-   "pom": "sha256-D4obEW52C4/mOJxRuE5LB6cPwRCC1Pk25FO1g91QtDs="
-  },
-  "org/ow2/asm#asm-analysis/9.1": {
-   "jar": "sha256-gaiAQbG4vtpaiplkYJgEbEhwlTgnDEne9oq/8lrDvjQ=",
-   "pom": "sha256-rFRUwRsDQxypUd9x+06GyMTIDfaXn5W3V8rtOrD0cVY="
-  },
-  "org/ow2/asm#asm-commons/9.1": {
-   "jar": "sha256-r8sm3B/BLAxKma2mcJCN2C4Y38SIyvXuklRplrRwwAw=",
-   "pom": "sha256-oPZRsnuK/pwOYS16Ambqy197HHh7xLWsgkXz16EYG38="
-  },
-  "org/ow2/asm#asm-tree/9.1": {
-   "jar": "sha256-/QCvpJ6VlddkYgWwnOy0p3ao/wugby1ZuPe/nHBLSnM=",
-   "pom": "sha256-tqANkgfANUYPgcfXDtQSU/DSFmUr7UX6GjBS/81QuUw="
-  },
-  "org/ow2/asm#asm-util/9.1": {
-   "jar": "sha256-OA4uzRb3zA8adrqboEkXm1dgpXsoKoekxlPK7/LNW9Y=",
-   "pom": "sha256-jd108aHiuTxwnZdtAgXnT7850AVwPJYmpe1cxXTK+88="
-  },
-  "org/ow2/asm#asm/9.1": {
-   "jar": "sha256-zaTeRV+rSP8Ly3xItGOUR9TehZp6/DCglKmG8JNr66I=",
-   "pom": "sha256-xoOpDdaPKxeIy9/EZH6pQF71kls3HBmfj9OdRNPO3o0="
-  },
-  "org/slf4j#slf4j-api/1.8.0-beta4": {
-   "jar": "sha256-YCtxIynIS0qDxARk9P39D+QjjFPvOXE5qGcGRznb9OA=",
-   "pom": "sha256-+DFtKKzyUrIbHp6O7ZqEwq+9yOBA9p06ELq4E9PYWoU="
-  },
-  "org/slf4j#slf4j-parent/1.8.0-beta4": {
-   "pom": "sha256-uvujCoPVOpRVAZZEdWKqjNrRRWFcKJMsaku0QcNVMQE="
-  },
-  "org/slf4j#slf4j-simple/1.8.0-beta4": {
-   "jar": "sha256-usZqvFtEYt/2Lh4ZqzsKZcFg681WTPJZENsAOo5WnP0=",
-   "pom": "sha256-oXrS6OU00OgZ6o0UIT3nSNRlD/8qJX0+kqE9oxAoe/c="
-  },
-  "org/sonatype/oss#oss-parent/7": {
-   "pom": "sha256-tR+IZ8kranIkmVV/w6H96ne9+e9XRyL+kM5DailVlFQ="
-  }
- },
- "https://plugins.gradle.org/m2": {
-  "com/formdev#flatlaf/1.0": {
-   "jar": "sha256-E12NWsOf7CnZs/9SyzBybT+XawaYYVvjJTT9eSTynsc=",
-   "module": "sha256-dStur7AL/wRCGXCYLcqvz1l7SajJE64M73XkKHYKC68=",
-   "pom": "sha256-ylkCGnUHptHH0ZM+DN+hxKlpqgTsaMYsMdYTMtMAlpo="
-  },
-  "com/github/spotbugs#com.github.spotbugs.gradle.plugin/4.7.1": {
-   "pom": "sha256-vzSvShy4wBuhRYlSW5K1KXuRB3UmfD4r86m9Y5WEIXc="
-  },
-  "com/thoughtworks/xstream#xstream-parent/1.4.15": {
-   "pom": "sha256-GDOZpW5OtAJkCjcZURmuZx61kW17OKX2PpTvGvkPuc4="
-  },
-  "com/thoughtworks/xstream#xstream/1.4.15": {
-   "jar": "sha256-MneEmWGqnrBV+HcYEEUAhtOMwuQH7rg0bQI56gIYpFM=",
-   "pom": "sha256-sX3W1xyyywYmTZ6q0a6Mgg5FdhTx1jRcdgmSB3Ei1EY="
-  },
-  "commons-beanutils#commons-beanutils/1.9.4": {
-   "jar": "sha256-fZOMgXiQKARcCMBl6UvnX8KAUnYg1b1itRnVg4UyNoo=",
-   "pom": "sha256-w1zKe2HUZ42VeMvAuQG4cXtTmr+SVEQdp4uP5g3gZNA="
-  },
-  "commons-logging#commons-logging/1.2": {
-   "jar": "sha256-2t3qHqC+D1aXirMAa4rJKDSv7vvZt+TmMW/KV98PpjY=",
-   "pom": "sha256-yRq1qlcNhvb9B8wVjsa8LFAIBAKXLukXn+JBAHOfuyA="
-  },
-  "edu/sc/seis/launch4j#edu.sc.seis.launch4j.gradle.plugin/2.5.0": {
-   "pom": "sha256-n0puUetm4COQOF+0PkmHup+PCZ5QD8WCPwKh9ZFQ4Q4="
-  },
-  "edu/sc/seis/launch4j#launch4j/2.5.0": {
-   "jar": "sha256-UX6wYGabD7AySfEXvtG5UbckhI1XLhpeSgnHRWnC8CQ=",
-   "module": "sha256-ujuCeHwFd2TaKUOOoAxuVaD1xcppLb6Pm0zt1QZVSXs=",
-   "pom": "sha256-sadCLzKqOPcR43vhoilGBV2MJiby9Xy2LUHMWR6h4TI="
-  },
-  "gradle/plugin/com/github/spotbugs/snom#spotbugs-gradle-plugin/4.7.1": {
-   "jar": "sha256-4zxJQ+EOPtJ1mRoZMFagVtdXUYUcvWGqysipEXTm4Kc=",
-   "pom": "sha256-aBZTKWh+foW+JoNs7+nuoWT4xFhi+M70qkP9yr+P7T8="
-  },
-  "net/sf/launch4j#launch4j/3.14": {
-   "pom": "sha256-xEYpdod2nJWyb2Qg9zsr0qKd90TYllTAdKhVb2Is+Vs="
-  },
-  "net/sf/launch4j#launch4j/3.14/core": {
-   "jar": "sha256-pGVAv4Nrz3s1AHM9n6f1muzYyDeUJz5zZlWrLKdXYjA="
-  },
-  "org/apache#apache/13": {
-   "pom": "sha256-/1E9sDYf1BI3vvR4SWi8FarkeNTsCpSW+BEHLMrzhB0="
-  },
-  "org/apache#apache/19": {
-   "pom": "sha256-kfejMJbqabrCy69tAf65NMrAAsSNjIz6nCQLQPHsId8="
-  },
-  "org/apache/commons#commons-parent/34": {
-   "pom": "sha256-Oi5p0G1kHR87KTEm3J4uTqZWO/jDbIfgq2+kKS0Et5w="
-  },
-  "org/apache/commons#commons-parent/47": {
-   "pom": "sha256-io7LVwVTv58f+uIRqNTKnuYwwXr+WSkzaPunvZtC/Lc="
-  },
-  "xmlpull#xmlpull/1.1.3.1": {
-   "jar": "sha256-NOCO5iEWBxy7acDtcNFaelsgjWJ5jFnyEgu4kpMky2M=",
-   "pom": "sha256-jxD/2N8NPpgZyMyEAnCcaySLxTqVTvbkVHDZrjpXNfs="
-  },
-  "xpp3#xpp3_min/1.1.4c": {
-   "jar": "sha256-v8kOnjLQ6rHzl/uXS18VCoFRiDgqxB83KnFJ1bwXgAg=",
-   "pom": "sha256-tbRqwMCdpBsE28dTRWtIkShWp/+7FJBnaRC1EMRx0T8="
-  }
- }
-}
diff --git a/pkgs/by-name/qu/quake-injector/package.nix b/pkgs/by-name/qu/quake-injector/package.nix
index 02db59fc26f5..da5f23d57827 100644
--- a/pkgs/by-name/qu/quake-injector/package.nix
+++ b/pkgs/by-name/qu/quake-injector/package.nix
@@ -1,56 +1,65 @@
 {
   lib,
   stdenv,
-  fetchFromGitHub,
-  gradle,
   jre,
   makeWrapper,
   jdk,
-  git,
   makeDesktopItem,
   copyDesktopItems,
+  fetchzip,
+  fetchurl,
 }:
+let
+  icon = fetchurl {
+    url = "https://raw.githubusercontent.com/hrehfeld/QuakeInjector/b741bae9904acbf2e18cdb1ca8e71a12e7d416cf/src/main/resources/Inject2_256.png";
+    hash = "sha256-769YoSJ52+BTk7s+wh4oOyHwPPrR7AeOxCS58CdQ93s=";
+  };
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "quake-injector";
-  version = "06";
+  version = "07";
 
-  src = fetchFromGitHub {
-    owner = "hrehfeld";
-    repo = "QuakeInjector";
-    tag = "alpha${finalAttrs.version}";
-    hash = "sha256-bbvLp5/Grg+mXBuV5aJCMOSjFp1+ukZS+AivcbhBxHU=";
+  src = fetchzip {
+    url = "https://github.com/hrehfeld/QuakeInjector/releases/download/alpha${finalAttrs.version}/QuakeInjector-alpha${finalAttrs.version}.zip";
+    hash = "sha256-Lixac9K3+9j7QvprZGzhnYuvlJV9V+ja4EipygELkWA=";
   };
 
   nativeBuildInputs = [
-    gradle
     makeWrapper
-    git
     copyDesktopItems
   ];
 
-  mitmCache = gradle.fetchDeps {
-    inherit (finalAttrs) pname;
-    data = ./deps.json;
-  };
+  installPhase =
+    let
+      # Explicit needed JAR filenames
+      filenames = [
+        "QuakeInjector-alpha${finalAttrs.version}.jar"
+        "BrowserLauncher2-1.3.jar"
+        "jackson-annotations-2.13.3.jar"
+        "jackson-core-2.13.3.jar"
+        "jackson-databind-2.13.3.jar"
+      ];
 
-  __darwinAllowLocalNetworking = true;
+      mkClasspath = prefix: lib.concatMapStringsSep ":" (filename: "${prefix}/${filename}") filenames;
+      classpath = mkClasspath "$out/share/quake-injector";
+    in
+    ''
+      runHook preInstall
 
-  doCheck = true;
+      mkdir -p $out/{bin,share/quake-injector}
+      cp lib/*.jar $out/share/quake-injector
 
-  installPhase = ''
-    runHook preInstall
+      mkdir -p $out/share/icons/hicolor/256x256/apps
+      cp ${icon} $out/share/icons/hicolor/256x256/apps/quake-injector.png
 
-    mkdir -p $out/{bin,share/quake-injector}
-    cp build/libs/QuakeInjector.jar $out/share/quake-injector
+      makeWrapper ${jre}/bin/java $out/bin/quake-injector \
+        --add-flags "-classpath ${classpath} de.haukerehfeld.quakeinjector.QuakeInjector"
 
-    mkdir -p $out/share/icons/hicolor/256x256/apps
-    cp src/main/resources/Inject2_256.png $out/share/icons/hicolor/256x256/apps/quake-injector.png
+      runHook postInstall
+    '';
 
-    makeWrapper ${jre}/bin/java $out/bin/quake-injector \
-      --add-flags "-jar $out/share/quake-injector/QuakeInjector.jar"
-
-    runHook postInstall
-  '';
+  # There are no tests.
+  doCheck = false;
 
   desktopItems = [
     (makeDesktopItem {
@@ -71,9 +80,6 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [ theobori ];
     mainProgram = "quake-injector";
     platforms = jdk.meta.platforms;
-    sourceProvenance = with lib.sourceTypes; [
-      fromSource
-      binaryBytecode # mitm cache
-    ];
+    sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
   };
 })
diff --git a/pkgs/by-name/re/release-plz/package.nix b/pkgs/by-name/re/release-plz/package.nix
index 535fdaea13a8..8ec0f02070a7 100644
--- a/pkgs/by-name/re/release-plz/package.nix
+++ b/pkgs/by-name/re/release-plz/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "release-plz";
-  version = "0.3.140";
+  version = "0.3.142";
 
   src = fetchFromGitHub {
     owner = "MarcoIeni";
     repo = "release-plz";
     rev = "release-plz-v${version}";
-    hash = "sha256-pJHyf1aSn4YqzFYW6otuRY+gJ6TBCKFGQuH2Py5uWlE=";
+    hash = "sha256-e+EafNBXHUAE4UjJJ7ujfd4QVxQ6AAYTpH6TmNot6jk=";
   };
 
-  cargoHash = "sha256-LfadgdrGD9g/PNeFs/XNUk2x0h1i3znzMhIV+w1DjMk=";
+  cargoHash = "sha256-TE2l9Mk41RBaHo/fRdXSLHc8UGiMDIY6LXc33iIDjvA=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/rs/rsign2/package.nix b/pkgs/by-name/rs/rsign2/package.nix
index 25017ff43852..8c7a54f32460 100644
--- a/pkgs/by-name/rs/rsign2/package.nix
+++ b/pkgs/by-name/rs/rsign2/package.nix
@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rsign2";
-  version = "0.6.3";
+  version = "0.6.4";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-bJeM1HTzmC8QZ488PpqQ0qqdFg1/rjPWuTtqo1GXyHM=";
+    hash = "sha256-SmrTMMHnB5r0K6zL9B2qJwyywFxUTidQDejnFsOTT4E=";
   };
 
-  cargoHash = "sha256-dCZcxtaqcRHhAmgGigBjN0jDfh1VjoosqTDTkqwlXp0=";
+  cargoHash = "sha256-eWPZROftFA0pTgFDl4AuUP5yO863ar+HAcjCRk5c+cA=";
 
   meta = with lib; {
     description = "Command-line tool to sign files and verify signatures";
diff --git a/pkgs/by-name/se/sentry-cli/package.nix b/pkgs/by-name/se/sentry-cli/package.nix
index 350aa25bd8de..66f54c2cc84f 100644
--- a/pkgs/by-name/se/sentry-cli/package.nix
+++ b/pkgs/by-name/se/sentry-cli/package.nix
@@ -9,13 +9,13 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "sentry-cli";
-  version = "2.52.0";
+  version = "2.53.0";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "sentry-cli";
     rev = version;
-    hash = "sha256-iu1WbtgNxrS5JgsEZo1xGtTfnkZcYQUm3sY1NquCFpI=";
+    hash = "sha256-M/F9Qkpmaz6p1l8hYVJ4EeD8SpKzweKexZ/fR4luCQw=";
   };
   doCheck = false;
 
@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  cargoHash = "sha256-/V2Q8QPDDQkE5oJMGx51CtoZ1zoE/iVPegmMi1PLgYw=";
+  cargoHash = "sha256-STwAUUHUlXhrjSXQVYDgkFXym4S/JgofbdQ5lWTCUoA=";
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd sentry-cli \
diff --git a/pkgs/by-name/se/sentry-native/package.nix b/pkgs/by-name/se/sentry-native/package.nix
index 40ee50c38261..fab7f4652829 100644
--- a/pkgs/by-name/se/sentry-native/package.nix
+++ b/pkgs/by-name/se/sentry-native/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "sentry-native";
-  version = "0.10.0";
+  version = "0.10.1";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "sentry-native";
     tag = version;
-    hash = "sha256-65Eylc0l3R0bQeKyb7JgULbZCldaR7TZmMvYB9wz/1M=";
+    hash = "sha256-99C4Nd2YdUElMpbKrNIBjicaWHR2MVqHUu5KryYAT/I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/se/server-box/gitHashes.json b/pkgs/by-name/se/server-box/gitHashes.json
index 576007e56a39..5fceb20789d7 100644
--- a/pkgs/by-name/se/server-box/gitHashes.json
+++ b/pkgs/by-name/se/server-box/gitHashes.json
@@ -3,8 +3,9 @@
   "computer": "sha256-qaD6jn78zDyZBktwJ4WTQa8oCvCWQJOBDaozBVsXNb8=",
   "dartssh2": "sha256-XlbruyraMmZGNRppQdBLS89Qyd7mm5Noiap2BhZjEPw=",
   "fl_build": "sha256-hCojuXFuN33/prCyuPcMoehWiGfaR2yOJA2V6dOuz4E=",
-  "fl_lib": "sha256-7nwj5eE3nCezjrv5N2cz/9r+CqMKTOIuhaeH4AGVchY=",
+  "fl_lib": "sha256-kg52OMCznepmqUl8PpikabeDyRoRwDbyo997PDcTxJA=",
+  "gtk": "sha256-nt7d2MvIfizxezWhQNm2/yHEzYuPKDvfHGM9Bnq3f04=",
   "plain_notification_token": "sha256-Cy1/S8bAtKCBnjfDEeW4Q2nP4jtwyCstAC1GH1efu8I=",
   "watch_connectivity": "sha256-9TyuElr0PNoiUvbSTOakdw1/QwWp6J2GAwzVHsgYWtM=",
-  "xterm": "sha256-yMETVh1qEdQAIYaQWbL5958N5dGpczJ/Y8Zvl1WjRnw="
+  "xterm": "sha256-j1+cN6r0qcmOk7YneRVM5SzimqiTUcG/a+cTsCqsq9k="
 }
diff --git a/pkgs/by-name/se/server-box/package.nix b/pkgs/by-name/se/server-box/package.nix
index 3837cdc5c0c4..66fc3c200d1d 100644
--- a/pkgs/by-name/se/server-box/package.nix
+++ b/pkgs/by-name/se/server-box/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  flutter332,
+  flutter335,
   fetchFromGitHub,
   autoPatchelfHook,
   copyDesktopItems,
@@ -12,16 +12,16 @@
 }:
 
 let
-  version = "1.0.1201";
+  version = "1.0.1241";
 
   src = fetchFromGitHub {
     owner = "lollipopkit";
     repo = "flutter_server_box";
     tag = "v${version}";
-    hash = "sha256-ScPpEL2YxWw1aKEyzhoa0b931WF4hrdren4aSAlMpoU=";
+    hash = "sha256-qiMCOd6U66VNo5NRUwOh0Pvb84g2v9V/DIWAy7/bCuk=";
   };
 in
-flutter332.buildFlutterApplication {
+flutter335.buildFlutterApplication {
   pname = "server-box";
   inherit version src;
 
@@ -52,7 +52,7 @@ flutter332.buildFlutterApplication {
   ];
 
   postInstall = ''
-    install -Dm0644 assets/app_icon.png $out/share/pixmaps/server-box.png
+    install -D --mode=0644 assets/app_icon.png $out/share/icons/hicolor/512x512/apps/server-box.png
   '';
 
   passthru = {
diff --git a/pkgs/by-name/se/server-box/pubspec.lock.json b/pkgs/by-name/se/server-box/pubspec.lock.json
index af41ecce261e..c5fef2751232 100644
--- a/pkgs/by-name/se/server-box/pubspec.lock.json
+++ b/pkgs/by-name/se/server-box/pubspec.lock.json
@@ -4,31 +4,31 @@
       "dependency": "transitive",
       "description": {
         "name": "_fe_analyzer_shared",
-        "sha256": "e55636ed79578b9abca5fecf9437947798f5ef7456308b5cb85720b793eac92f",
+        "sha256": "da0d9209ca76bde579f2da330aeb9df62b6319c834fa7baae052021b0462401f",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "82.0.0"
+      "version": "85.0.0"
     },
     "analyzer": {
       "dependency": "direct dev",
       "description": {
         "name": "analyzer",
-        "sha256": "904ae5bb474d32c38fb9482e2d925d5454cda04ddd0e55d2e6826bc72f6ba8c0",
+        "sha256": "f4ad0fea5f102201015c9aae9d93bc02f75dd9491529a8c21f88d17a8523d44c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "7.4.5"
+      "version": "7.6.0"
     },
     "analyzer_plugin": {
       "dependency": "transitive",
       "description": {
         "name": "analyzer_plugin",
-        "sha256": "ee188b6df6c85f1441497c7171c84f1392affadc0384f71089cb10a3bc508cef",
+        "sha256": "a5ab7590c27b779f3d4de67f31c4109dbe13dd7339f86461a6f2a8ab2594d8ce",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.13.1"
+      "version": "0.13.4"
     },
     "animations": {
       "dependency": "transitive",
@@ -54,11 +54,11 @@
       "dependency": "transitive",
       "description": {
         "name": "app_links",
-        "sha256": "85ed8fc1d25a76475914fff28cc994653bd900bc2c26e4b57a49e097febb54ba",
+        "sha256": "5f88447519add627fe1cbcab4fd1da3d4fed15b9baf29f28b22535c95ecee3e8",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.4.0"
+      "version": "6.4.1"
     },
     "app_links_linux": {
       "dependency": "transitive",
@@ -114,11 +114,11 @@
       "dependency": "transitive",
       "description": {
         "name": "asn1lib",
-        "sha256": "0511d6be23b007e95105ae023db599aea731df604608978dada7f9faf2637623",
+        "sha256": "9a8f69025044eb466b9b60ef3bc3ac99b4dc6c158ae9c56d25eeccf5bc56d024",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.6.4"
+      "version": "1.6.5"
     },
     "async": {
       "dependency": "transitive",
@@ -144,11 +144,11 @@
       "dependency": "transitive",
       "description": {
         "name": "build",
-        "sha256": "cef23f1eda9b57566c81e2133d196f8e3df48f244b317368d65c5943d91148f0",
+        "sha256": "51dc711996cbf609b90cbe5b335bbce83143875a9d58e4b5c6d3c4f684d3dda7",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.2"
+      "version": "2.5.4"
     },
     "build_config": {
       "dependency": "transitive",
@@ -174,31 +174,31 @@
       "dependency": "transitive",
       "description": {
         "name": "build_resolvers",
-        "sha256": "b9e4fda21d846e192628e7a4f6deda6888c36b5b69ba02ff291a01fd529140f0",
+        "sha256": "ee4257b3f20c0c90e72ed2b57ad637f694ccba48839a821e87db762548c22a62",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.4"
+      "version": "2.5.4"
     },
     "build_runner": {
       "dependency": "direct dev",
       "description": {
         "name": "build_runner",
-        "sha256": "058fe9dce1de7d69c4b84fada934df3e0153dd000758c4d65964d0166779aa99",
+        "sha256": "382a4d649addbfb7ba71a3631df0ec6a45d5ab9b098638144faf27f02778eb53",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.15"
+      "version": "2.5.4"
     },
     "build_runner_core": {
       "dependency": "transitive",
       "description": {
         "name": "build_runner_core",
-        "sha256": "22e3aa1c80e0ada3722fe5b63fd43d9c8990759d0a2cf489c8c5d7b2bdebc021",
+        "sha256": "85fbbb1036d576d966332a3f5ce83f2ce66a40bea1a94ad2d5fc29a19a0d3792",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.0.0"
+      "version": "9.1.2"
     },
     "built_collection": {
       "dependency": "transitive",
@@ -214,41 +214,41 @@
       "dependency": "transitive",
       "description": {
         "name": "built_value",
-        "sha256": "082001b5c3dc495d4a42f1d5789990505df20d8547d42507c29050af6933ee27",
+        "sha256": "ba95c961bafcd8686d1cf63be864eb59447e795e124d98d6a27d91fcd13602fb",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.10.1"
+      "version": "8.11.1"
     },
     "camera": {
       "dependency": "transitive",
       "description": {
         "name": "camera",
-        "sha256": "413d2b34fe28496c35c69ede5b232fb9dd5ca2c3a4cb606b14efc1c7546cc8cb",
+        "sha256": "d6ec2cbdbe2fa8f5e0d07d8c06368fe4effa985a4a5ddade9cc58a8cd849557d",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.11.1"
+      "version": "0.11.2"
     },
     "camera_android_camerax": {
       "dependency": "transitive",
       "description": {
         "name": "camera_android_camerax",
-        "sha256": "68d7ec97439108ac22cfba34bb74d0ab53adbc017175116d2cbc5a3d8fc8ea5e",
+        "sha256": "2d438248554f44766bf9ea34c117a5bb0074e241342ef7c22c768fb431335234",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.6.18+2"
+      "version": "0.6.21"
     },
     "camera_avfoundation": {
       "dependency": "transitive",
       "description": {
         "name": "camera_avfoundation",
-        "sha256": "a33cd9a250296271cdf556891b7c0986a93772426f286595eccd5f45b185933c",
+        "sha256": "951ef122d01ebba68b7a54bfe294e8b25585635a90465c311b2f875ae72c412f",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.9.18+14"
+      "version": "0.9.21+2"
     },
     "camera_platform_interface": {
       "dependency": "transitive",
@@ -386,11 +386,11 @@
       "dependency": "transitive",
       "description": {
         "name": "coverage",
-        "sha256": "aa07dbe5f2294c827b7edb9a87bba44a9c15a3cc81bc8da2ca19b37322d30080",
+        "sha256": "5da775aa218eaf2151c721b16c01c7676fbfdd99cebba2bf64e8b807a28ff94d",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.14.1"
+      "version": "1.15.0"
     },
     "cross_file": {
       "dependency": "transitive",
@@ -436,21 +436,21 @@
       "dependency": "transitive",
       "description": {
         "name": "custom_lint_visitor",
-        "sha256": "cba5b6d7a6217312472bf4468cdf68c949488aed7ffb0eab792cd0b6c435054d",
+        "sha256": "4a86a0d8415a91fbb8298d6ef03e9034dc8e323a599ddc4120a0e36c433983a2",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.0.0+7.4.5"
+      "version": "1.0.0+7.7.0"
     },
     "dart_style": {
       "dependency": "transitive",
       "description": {
         "name": "dart_style",
-        "sha256": "5b236382b47ee411741447c1f1e111459c941ea1b3f2b540dde54c210a3662af",
+        "sha256": "8a0e5fba27e8ee025d2ffb4ee820b4e6e2cf5e4246a6b1a477eb66866947e0bb",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.1.0"
+      "version": "3.1.1"
     },
     "dartssh2": {
       "dependency": "direct main",
@@ -477,11 +477,11 @@
       "dependency": "direct main",
       "description": {
         "name": "dio",
-        "sha256": "253a18bbd4851fecba42f7343a1df3a9a4c1d31a2c1b37e221086b4fa8c8dbc9",
+        "sha256": "d90ee57923d1828ac14e492ca49440f65477f4bb1263575900be731a3dac66a9",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "5.8.0+1"
+      "version": "5.9.0"
     },
     "dio_web_adapter": {
       "dependency": "transitive",
@@ -497,11 +497,11 @@
       "dependency": "direct main",
       "description": {
         "name": "dynamic_color",
-        "sha256": "eae98052fa6e2826bdac3dd2e921c6ce2903be15c6b7f8b6d8a5d49b5086298d",
+        "sha256": "43a5a6679649a7731ab860334a5812f2067c2d9ce6452cf069c5e0c25336c17c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.7.0"
+      "version": "1.8.1"
     },
     "easy_isolate": {
       "dependency": "direct main",
@@ -577,11 +577,11 @@
       "dependency": "direct main",
       "description": {
         "name": "file_picker",
-        "sha256": "77f8e81d22d2a07d0dee2c62e1dda71dc1da73bf43bb2d45af09727406167964",
+        "sha256": "e7e16c9d15c36330b94ca0e2ad8cb61f93cd5282d0158c09805aed13b5452f22",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "10.1.9"
+      "version": "10.3.2"
     },
     "fixnum": {
       "dependency": "transitive",
@@ -608,18 +608,18 @@
       "dependency": "direct main",
       "description": {
         "name": "fl_chart",
-        "sha256": "577aeac8ca414c25333334d7c4bb246775234c0e44b38b10a82b559dd4d764e7",
+        "sha256": "d3f82f4a38e33ba23d05a08ff304d7d8b22d2a59a5503f20bd802966e915db89",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.0.0"
+      "version": "1.1.0"
     },
     "fl_lib": {
       "dependency": "direct main",
       "description": {
         "path": ".",
-        "ref": "v1.0.327",
-        "resolved-ref": "5075a679b814b10742f967066858ba4df92ea4ae",
+        "ref": "v1.0.346",
+        "resolved-ref": "f277b7a4259e45889320ef6d80ab320662558784",
         "url": "https://github.com/lppcg/fl_lib"
       },
       "source": "git",
@@ -641,6 +641,16 @@
       "source": "hosted",
       "version": "0.6.0"
     },
+    "flutter_gbk2utf8": {
+      "dependency": "direct main",
+      "description": {
+        "name": "flutter_gbk2utf8",
+        "sha256": "c17323808d6ae7cfaf7676669e0130c33df6be322eb807cdd32face5824c1134",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.0.1"
+    },
     "flutter_highlight": {
       "dependency": "direct main",
       "description": {
@@ -711,11 +721,11 @@
       "dependency": "transitive",
       "description": {
         "name": "flutter_plugin_android_lifecycle",
-        "sha256": "f948e346c12f8d5480d2825e03de228d0eb8c3a737e4cdaa122267b89c022b5e",
+        "sha256": "b0694b7fb1689b0e6cc193b3f1fcac6423c4f93c74fb20b806c6b6f196db0c31",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.0.28"
+      "version": "2.0.30"
     },
     "flutter_riverpod": {
       "dependency": "direct main",
@@ -791,11 +801,11 @@
       "dependency": "transitive",
       "description": {
         "name": "flutter_svg",
-        "sha256": "d44bf546b13025ec7353091516f6881f1d4c633993cb109c3916c3a0159dadf1",
+        "sha256": "cd57f7969b4679317c17af6fd16ee233c1e60a82ed209d8a475c54fd6fd6f845",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.0"
+      "version": "2.2.0"
     },
     "flutter_test": {
       "dependency": "direct dev",
@@ -813,21 +823,21 @@
       "dependency": "direct dev",
       "description": {
         "name": "freezed",
-        "sha256": "6022db4c7bfa626841b2a10f34dd1e1b68e8f8f9650db6112dcdeeca45ca793c",
+        "sha256": "2d399f823b8849663744d2a9ddcce01c49268fb4170d0442a655bf6a2f47be22",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.0.6"
+      "version": "3.1.0"
     },
     "freezed_annotation": {
       "dependency": "direct main",
       "description": {
         "name": "freezed_annotation",
-        "sha256": "c87ff004c8aa6af2d531668b46a4ea379f7191dc6dfa066acd53d506da6e044b",
+        "sha256": "7294967ff0a6d98638e7acb774aac3af2550777accd8149c90af5b014e6d44d8",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.0.0"
+      "version": "3.1.0"
     },
     "frontend_server_client": {
       "dependency": "transitive",
@@ -839,6 +849,16 @@
       "source": "hosted",
       "version": "4.0.0"
     },
+    "get_it": {
+      "dependency": "direct main",
+      "description": {
+        "name": "get_it",
+        "sha256": "a4292e7cf67193f8e7c1258203104eb2a51ec8b3a04baa14695f4064c144297b",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "8.2.0"
+    },
     "glob": {
       "dependency": "transitive",
       "description": {
@@ -860,13 +880,14 @@
       "version": "2.3.2"
     },
     "gtk": {
-      "dependency": "transitive",
+      "dependency": "direct overridden",
       "description": {
-        "name": "gtk",
-        "sha256": "e8ce9ca4b1df106e4d72dad201d345ea1a036cc12c360f1a7d5a758f78ffa42c",
-        "url": "https://pub.dev"
+        "path": ".",
+        "ref": "v0.0.36",
+        "resolved-ref": "c62c45857fb4f60ca3d6b5fc7fa2a26df8ba9fa7",
+        "url": "https://github.com/lollipopkit/gtk.dart"
       },
-      "source": "hosted",
+      "source": "git",
       "version": "2.1.0"
     },
     "highlight": {
@@ -893,11 +914,11 @@
       "dependency": "direct main",
       "description": {
         "name": "hive_ce_flutter",
-        "sha256": "a0989670652eab097b47544f1e5a4456e861b1b01b050098ea0b80a5fabe9909",
+        "sha256": "f5bd57fda84402bca7557fedb8c629c96c8ea10fab4a542968d7b60864ca02cc",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.3.1"
+      "version": "2.3.2"
     },
     "hive_ce_generator": {
       "dependency": "direct dev",
@@ -923,11 +944,11 @@
       "dependency": "transitive",
       "description": {
         "name": "http",
-        "sha256": "2c11f3f94c687ee9bad77c171151672986360b2b001d109814ee7140b2cf261b",
+        "sha256": "bb2ce4590bc2667c96f318d68cac1b5a7987ec819351d32b1c987239a815e007",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.4.0"
+      "version": "1.5.0"
     },
     "http_client_helper": {
       "dependency": "transitive",
@@ -1073,31 +1094,31 @@
       "dependency": "transitive",
       "description": {
         "name": "leak_tracker",
-        "sha256": "6bb818ecbdffe216e81182c2f0714a2e62b593f4a4f13098713ff1685dfb6ab0",
+        "sha256": "8dcda04c3fc16c14f48a7bb586d4be1f0d1572731b6d81d51772ef47c02081e0",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "10.0.9"
+      "version": "11.0.1"
     },
     "leak_tracker_flutter_testing": {
       "dependency": "transitive",
       "description": {
         "name": "leak_tracker_flutter_testing",
-        "sha256": "f8b613e7e6a13ec79cfdc0e97638fddb3ab848452eff057653abd3edba760573",
+        "sha256": "1dbc140bb5a23c75ea9c4811222756104fbcd1a27173f0c34ca01e16bea473c1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.0.9"
+      "version": "3.0.10"
     },
     "leak_tracker_testing": {
       "dependency": "transitive",
       "description": {
         "name": "leak_tracker_testing",
-        "sha256": "6ba465d5d76e67ddf503e1161d1f4a6bc42306f9d66ca1e8f079a47290fb06d3",
+        "sha256": "8d5a2d49f4a66b49744b23b018848400d23e54caf9463f4eb20df3eb8acb2eb1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.0.1"
+      "version": "3.0.2"
     },
     "lints": {
       "dependency": "transitive",
@@ -1123,21 +1144,21 @@
       "dependency": "transitive",
       "description": {
         "name": "local_auth_android",
-        "sha256": "63ad7ca6396290626dc0cb34725a939e4cfe965d80d36112f08d49cf13a8136e",
+        "sha256": "48924f4a8b3cc45994ad5993e2e232d3b00788a305c1bf1c7db32cef281ce9a3",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.0.49"
+      "version": "1.0.52"
     },
     "local_auth_darwin": {
       "dependency": "transitive",
       "description": {
         "name": "local_auth_darwin",
-        "sha256": "630996cd7b7f28f5ab92432c4b35d055dd03a747bc319e5ffbb3c4806a3e50d2",
+        "sha256": "0e9706a8543a4a2eee60346294d6a633dd7c3ee60fae6b752570457c4ff32055",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.4.3"
+      "version": "1.6.0"
     },
     "local_auth_platform_interface": {
       "dependency": "transitive",
@@ -1233,11 +1254,11 @@
       "dependency": "transitive",
       "description": {
         "name": "multi_split_view",
-        "sha256": "99c02f128e7423818d13b8f2e01e3027e953b35508019dcee214791bd0525db5",
+        "sha256": "06f5126a65d3010ce0a9d5c003e793041fe99377b23e3534bb05059f79a580e9",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.6.0"
+      "version": "3.6.1"
     },
     "nested": {
       "dependency": "transitive",
@@ -1273,21 +1294,21 @@
       "dependency": "transitive",
       "description": {
         "name": "package_info_plus",
-        "sha256": "7976bfe4c583170d6cdc7077e3237560b364149fcd268b5f53d95a991963b191",
+        "sha256": "16eee997588c60225bda0488b6dcfac69280a6b7a3cf02c741895dd370a02968",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.3.0"
+      "version": "8.3.1"
     },
     "package_info_plus_platform_interface": {
       "dependency": "transitive",
       "description": {
         "name": "package_info_plus_platform_interface",
-        "sha256": "6c935fb612dff8e3cc9632c2b301720c77450a126114126ffaafe28d2e87956c",
+        "sha256": "202a487f08836a592a6bd4f901ac69b3a8f146af552bbd14407b6b41e1c3f086",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.2.0"
+      "version": "3.2.1"
     },
     "path": {
       "dependency": "transitive",
@@ -1323,21 +1344,21 @@
       "dependency": "transitive",
       "description": {
         "name": "path_provider_android",
-        "sha256": "d0d310befe2c8ab9e7f393288ccbb11b60c019c6b5afc21973eeee4dda2b35e9",
+        "sha256": "993381400e94d18469750e5b9dcb8206f15bc09f9da86b9e44a9b0092a0066db",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.2.17"
+      "version": "2.2.18"
     },
     "path_provider_foundation": {
       "dependency": "transitive",
       "description": {
         "name": "path_provider_foundation",
-        "sha256": "4843174df4d288f5e29185bd6e72a6fbdf5a4a4602717eed565497429f179942",
+        "sha256": "16eef174aacb07e09c351502740fa6254c165757638eba1e9116b0a781201bbd",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.1"
+      "version": "2.4.2"
     },
     "path_provider_linux": {
       "dependency": "transitive",
@@ -1373,11 +1394,11 @@
       "dependency": "transitive",
       "description": {
         "name": "petitparser",
-        "sha256": "07c8f0b1913bcde1ff0d26e57ace2f3012ccbf2b204e070290dad3bb22797646",
+        "sha256": "1a97266a94f7350d30ae522c0af07890c70b8e62c71e8e3920d1db4d23c057d1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.1.0"
+      "version": "7.0.1"
     },
     "pinenacl": {
       "dependency": "transitive",
@@ -1444,31 +1465,31 @@
       "dependency": "transitive",
       "description": {
         "name": "posix",
-        "sha256": "f0d7856b6ca1887cfa6d1d394056a296ae33489db914e365e2044fdada449e62",
+        "sha256": "6323a5b0fa688b6a010df4905a56b00181479e6d10534cecfecede2aa55add61",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.0.2"
+      "version": "6.0.3"
     },
     "pretty_qr_code": {
       "dependency": "transitive",
       "description": {
         "name": "pretty_qr_code",
-        "sha256": "b078bd5d51956dea4342378af1b092ad962b81bdbb55b10fffce03461da8db74",
+        "sha256": "2291db3f68d70a3dcd46c6bd599f30991ae4c02f27f36215fbb3f4865a609259",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.4.0"
+      "version": "3.5.0"
     },
     "provider": {
       "dependency": "transitive",
       "description": {
         "name": "provider",
-        "sha256": "4abbd070a04e9ddc287673bf5a030c7ca8b685ff70218720abab8b092f53dd84",
+        "sha256": "4e82183fa20e5ca25703ead7e05de9e4cceed1fbd1eadc1ac3cb6f565a09f272",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.1.5"
+      "version": "6.1.5+1"
     },
     "pub_semver": {
       "dependency": "transitive",
@@ -1514,11 +1535,11 @@
       "dependency": "transitive",
       "description": {
         "name": "qr_code_dart_scan",
-        "sha256": "8c9a63dac44ea51c82e72c0fed28b850d22be26348c582f77486f128cf1c2760",
+        "sha256": "1b317b47f475f6995c19e0f41d790902a8cd158b23c435d936763d86ba44309c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.11.1"
+      "version": "0.11.3"
     },
     "quiver": {
       "dependency": "transitive",
@@ -1664,21 +1685,21 @@
       "dependency": "transitive",
       "description": {
         "name": "share_plus",
-        "sha256": "b2961506569e28948d75ec346c28775bb111986bb69dc6a20754a457e3d97fa0",
+        "sha256": "d7dc0630a923883c6328ca31b89aa682bacbf2f8304162d29f7c6aaff03a27a1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "11.0.0"
+      "version": "11.1.0"
     },
     "share_plus_platform_interface": {
       "dependency": "transitive",
       "description": {
         "name": "share_plus_platform_interface",
-        "sha256": "1032d392bc5d2095a77447a805aa3f804d2ae6a4d5eef5e6ebb3bd94c1bc19ef",
+        "sha256": "88023e53a13429bd65d8e85e11a9b484f49d4c190abbd96c7932b74d6927cc9a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.0.0"
+      "version": "6.1.0"
     },
     "shared_preferences": {
       "dependency": "direct main",
@@ -1694,11 +1715,11 @@
       "dependency": "transitive",
       "description": {
         "name": "shared_preferences_android",
-        "sha256": "20cbd561f743a342c76c151d6ddb93a9ce6005751e7aa458baad3858bfbfb6ac",
+        "sha256": "a2608114b1ffdcbc9c120eb71a0e207c71da56202852d4aab8a5e30a82269e74",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.10"
+      "version": "2.4.12"
     },
     "shared_preferences_foundation": {
       "dependency": "transitive",
@@ -1810,11 +1831,11 @@
       "dependency": "transitive",
       "description": {
         "name": "source_helper",
-        "sha256": "86d247119aedce8e63f4751bd9626fc9613255935558447569ad42f9f5b48b3c",
+        "sha256": "a447acb083d3a5ef17f983dd36201aeea33fedadb3228fa831f2f0c92f0f3aca",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.3.5"
+      "version": "1.3.7"
     },
     "source_map_stack_trace": {
       "dependency": "transitive",
@@ -1920,31 +1941,31 @@
       "dependency": "direct dev",
       "description": {
         "name": "test",
-        "sha256": "301b213cd241ca982e9ba50266bd3f5bd1ea33f1455554c5abb85d1be0e2d87e",
+        "sha256": "65e29d831719be0591f7b3b1a32a3cda258ec98c58c7b25f7b84241bc31215bb",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.25.15"
+      "version": "1.26.2"
     },
     "test_api": {
       "dependency": "transitive",
       "description": {
         "name": "test_api",
-        "sha256": "fb31f383e2ee25fbbfe06b40fe21e1e458d14080e3c67e7ba0acfde4df4e0bbd",
+        "sha256": "522f00f556e73044315fa4585ec3270f1808a4b186c936e612cab0b565ff1e00",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.7.4"
+      "version": "0.7.6"
     },
     "test_core": {
       "dependency": "transitive",
       "description": {
         "name": "test_core",
-        "sha256": "84d17c3486c8dfdbe5e12a50c8ae176d15e2a771b96909a9442b40173649ccaa",
+        "sha256": "80bf5a02b60af04b09e14f6fe68b921aad119493e26e490deaca5993fef1b05a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.6.8"
+      "version": "0.6.11"
     },
     "timing": {
       "dependency": "transitive",
@@ -1990,31 +2011,31 @@
       "dependency": "transitive",
       "description": {
         "name": "url_launcher",
-        "sha256": "9d06212b1362abc2f0f0d78e6f09f726608c74e3b9462e8368bb03314aa8d603",
+        "sha256": "f6a7e5c4835bb4e3026a04793a4199ca2d14c739ec378fdfe23fc8075d0439f8",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.3.1"
+      "version": "6.3.2"
     },
     "url_launcher_android": {
       "dependency": "transitive",
       "description": {
         "name": "url_launcher_android",
-        "sha256": "8582d7f6fe14d2652b4c45c9b6c14c0b678c2af2d083a11b604caeba51930d79",
+        "sha256": "69ee86740f2847b9a4ba6cffa74ed12ce500bbe2b07f3dc1e643439da60637b7",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.3.16"
+      "version": "6.3.18"
     },
     "url_launcher_ios": {
       "dependency": "transitive",
       "description": {
         "name": "url_launcher_ios",
-        "sha256": "7f2022359d4c099eea7df3fdf739f7d3d3b9faf3166fb1dd390775176e0b76cb",
+        "sha256": "d80b3f567a617cb923546034cc94bfe44eb15f989fe670b37f26abdb9d939cb7",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.3.3"
+      "version": "6.3.4"
     },
     "url_launcher_linux": {
       "dependency": "transitive",
@@ -2030,11 +2051,11 @@
       "dependency": "transitive",
       "description": {
         "name": "url_launcher_macos",
-        "sha256": "17ba2000b847f334f16626a574c702b196723af2a289e7a93ffcb79acff855c2",
+        "sha256": "c043a77d6600ac9c38300567f33ef12b0ef4f4783a2c1f00231d2b1941fea13f",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.2.2"
+      "version": "3.2.3"
     },
     "url_launcher_platform_interface": {
       "dependency": "transitive",
@@ -2080,11 +2101,11 @@
       "dependency": "transitive",
       "description": {
         "name": "vector_graphics",
-        "sha256": "44cc7104ff32563122a929e4620cf3efd584194eec6d1d913eb5ba593dbcf6de",
+        "sha256": "a4f059dc26fc8295b5921376600a194c4ec7d55e72f2fe4c7d2831e103d461e6",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.18"
+      "version": "1.1.19"
     },
     "vector_graphics_codec": {
       "dependency": "transitive",
@@ -2100,31 +2121,31 @@
       "dependency": "transitive",
       "description": {
         "name": "vector_graphics_compiler",
-        "sha256": "557a315b7d2a6dbb0aaaff84d857967ce6bdc96a63dc6ee2a57ce5a6ee5d3331",
+        "sha256": "d354a7ec6931e6047785f4db12a1f61ec3d43b207fc0790f863818543f8ff0dc",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.17"
+      "version": "1.1.19"
     },
     "vector_math": {
       "dependency": "transitive",
       "description": {
         "name": "vector_math",
-        "sha256": "80b3257d1492ce4d091729e3a67a60407d227c27241d6927be0130c98e741803",
+        "sha256": "d530bd74fea330e6e364cda7a85019c434070188383e1cd8d9777ee586914c5b",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.4"
+      "version": "2.2.0"
     },
     "vm_service": {
       "dependency": "transitive",
       "description": {
         "name": "vm_service",
-        "sha256": "ddfa8d30d89985b96407efce8acbdd124701f96741f2d981ca860662f1c0dc02",
+        "sha256": "45caa6c5917fa127b5dbcfbd1fa60b14e583afdc08bfc96dda38886ca252eb60",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "15.0.0"
+      "version": "15.0.2"
     },
     "wake_on_lan": {
       "dependency": "direct main",
@@ -2171,11 +2192,11 @@
       "dependency": "transitive",
       "description": {
         "name": "watcher",
-        "sha256": "69da27e49efa56a15f8afe8f4438c4ec02eff0a117df1b22ea4aad194fe1c104",
+        "sha256": "5bf046f41320ac97a469d506261797f35254fa61c641741ef32dacda98b7d39c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.1"
+      "version": "1.1.3"
     },
     "web": {
       "dependency": "transitive",
@@ -2231,21 +2252,21 @@
       "dependency": "transitive",
       "description": {
         "name": "win32",
-        "sha256": "329edf97fdd893e0f1e3b9e88d6a0e627128cc17cc316a8d67fda8f1451178ba",
+        "sha256": "66814138c3562338d05613a6e368ed8cfb237ad6d64a9e9334be3f309acfca03",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "5.13.0"
+      "version": "5.14.0"
     },
     "window_manager": {
       "dependency": "transitive",
       "description": {
         "name": "window_manager",
-        "sha256": "51d50168ab267d344b975b15390426b1243600d436770d3f13de67e55b05ec16",
+        "sha256": "7eb6d6c4164ec08e1bf978d6e733f3cebe792e2a23fb07cbca25c2872bfdbdcd",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.5.0"
+      "version": "0.5.1"
     },
     "xdg_directories": {
       "dependency": "transitive",
@@ -2261,18 +2282,18 @@
       "dependency": "direct main",
       "description": {
         "name": "xml",
-        "sha256": "b015a8ad1c488f66851d762d3090a21c600e479dc75e68328c52774040cf9226",
+        "sha256": "971043b3a0d3da28727e40ed3e0b5d18b742fa5a68665cca88e74b7876d5e025",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.5.0"
+      "version": "6.6.1"
     },
     "xterm": {
       "dependency": "direct main",
       "description": {
         "path": ".",
-        "ref": "v1.0.588",
-        "resolved-ref": "d28207b988b5bed38c799618b9c412486592c689",
+        "ref": "v4.0.3",
+        "resolved-ref": "c64183346b924173eb7251800001a64771911185",
         "url": "https://github.com/lollipopkit/xterm.dart"
       },
       "source": "git",
@@ -2320,7 +2341,7 @@
     }
   },
   "sdks": {
-    "dart": ">=3.8.0 <4.0.0",
-    "flutter": ">=3.32.1"
+    "dart": ">=3.9.0 <4.0.0",
+    "flutter": ">=3.35.0"
   }
 }
diff --git a/pkgs/by-name/sk/sketchybar-app-font/package.nix b/pkgs/by-name/sk/sketchybar-app-font/package.nix
index b78e1d4a8f88..2e76b9a9c8f2 100644
--- a/pkgs/by-name/sk/sketchybar-app-font/package.nix
+++ b/pkgs/by-name/sk/sketchybar-app-font/package.nix
@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "sketchybar-app-font";
-  version = "2.0.41";
+  version = "2.0.42";
 
   src = fetchFromGitHub {
     owner = "kvndrsslr";
     repo = "sketchybar-app-font";
-    rev = "v2.0.41";
-    hash = "sha256-jK4NR7j7tsmCjdwvBQMIS8M3QJkfNEWaUo9H2n27kG8=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ERYbwtOmMKJNnp4Gn35dbjukFpcD8t1GjI7eDXubAjo=";
   };
 
   pnpmDeps = pnpm_9.fetchDeps {
diff --git a/pkgs/by-name/sk/skyscraper/package.nix b/pkgs/by-name/sk/skyscraper/package.nix
index 6254dc5d3ea7..00504c8d0281 100644
--- a/pkgs/by-name/sk/skyscraper/package.nix
+++ b/pkgs/by-name/sk/skyscraper/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "skyscraper";
-  version = "3.17.4";
+  version = "3.17.5";
 
   src = fetchFromGitHub {
     owner = "Gemba";
     repo = "skyscraper";
     rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-XUye/Iojp1JrsG+LuONwX6RghTPL8UbsxzdO2LCEbPo=";
+    hash = "sha256-JbU3enkzVUNOwJ4NuqIxAscvFShSCssj95W5nmSaO6c=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/sm/smtp4dev/deps.json b/pkgs/by-name/sm/smtp4dev/deps.json
index a3e7e8fa90f8..a9645096e9a7 100644
--- a/pkgs/by-name/sm/smtp4dev/deps.json
+++ b/pkgs/by-name/sm/smtp4dev/deps.json
@@ -211,8 +211,8 @@
   },
   {
     "pname": "Microsoft.Extensions.ApiDescription.Server",
-    "version": "6.0.3",
-    "hash": "sha256-1G+68E/fg89Vkgo4V7pCGqWlDdBErZMFfW+AV1q5brA="
+    "version": "8.0.14",
+    "hash": "sha256-mfNB1+5kcIr8burRrsr5LR5pVEAISQ8o9m8FrCtye3M="
   },
   {
     "pname": "Microsoft.Extensions.Caching.Abstractions",
@@ -581,8 +581,8 @@
   },
   {
     "pname": "Microsoft.TypeScript.MSBuild",
-    "version": "5.8.1",
-    "hash": "sha256-5x81TEhXaEEYnBeosK8zmBwPLKPifMf4JUFrGsk/IxA="
+    "version": "5.8.3",
+    "hash": "sha256-zL02BnZRCc5v1GUmzhaL1TnUq9+8Vkz5rGDPt+7CkD8="
   },
   {
     "pname": "Microsoft.VisualStudio.Web.CodeGeneration.Contracts",
@@ -636,8 +636,8 @@
   },
   {
     "pname": "Namotion.Reflection",
-    "version": "3.3.0",
-    "hash": "sha256-YBYWLYmnCZrKfiJWQo7tofiz2A7ROpxFfAYdYLa5cgI="
+    "version": "3.4.2",
+    "hash": "sha256-iaQrE5VwRHqXOyzym4vY3+4aDw6eswN5P3LDd3FoFZk="
   },
   {
     "pname": "NETStandard.Library",
@@ -666,53 +666,53 @@
   },
   {
     "pname": "NJsonSchema",
-    "version": "11.2.0",
-    "hash": "sha256-Y1FggfzRf54+ioMKvyyzMW30psrHF7hmAwnYom/Ud8s="
+    "version": "11.3.2",
+    "hash": "sha256-x+vNknToh2X1qk7NmsQEUWCoEJ5CGc1b9XNOrIbCOLc="
   },
   {
     "pname": "NJsonSchema.Annotations",
-    "version": "11.2.0",
-    "hash": "sha256-uQYU/NuAbz+HlImemuv1Yi4ODKoaQ38BSrWONOR9jFs="
+    "version": "11.3.2",
+    "hash": "sha256-MWC0Hvd6knCAjViSKOY7lugxGbVEcn3lyzEUO5unphQ="
   },
   {
     "pname": "NJsonSchema.NewtonsoftJson",
-    "version": "11.2.0",
-    "hash": "sha256-NyXB3rcdPpjaZq0CAZy5xMmvLqqzPGyddeTVtowqaBU="
+    "version": "11.3.2",
+    "hash": "sha256-jIRsXWHVNmWgz2WlmiJnfyXNofwrrdkLVlx4x3PPPlM="
   },
   {
     "pname": "NJsonSchema.Yaml",
-    "version": "11.2.0",
-    "hash": "sha256-NtlUldW5D0VSj10XqfMvxDMVULdw99owTS1zGYg4aKg="
+    "version": "11.3.2",
+    "hash": "sha256-7IzmfufXlhTZoESAIsd5zqBZ/x30tAAZl9Bx/m3QaxA="
   },
   {
     "pname": "NSwag.Annotations",
-    "version": "14.3.0",
-    "hash": "sha256-kz+fEwUlEjsPsOiFCTcXYHAAYCJa2cepDRIY4mkye4U="
+    "version": "14.4.0",
+    "hash": "sha256-NbAAQ+tlgi+/766JeEsD+W6SQMEHy2qyTsoMlxvuuo8="
   },
   {
     "pname": "NSwag.AspNetCore",
-    "version": "14.3.0",
-    "hash": "sha256-lGeH27yzj5fXPpBMqtoFOTRiu+gve8oSgugW2u4tMAk="
+    "version": "14.4.0",
+    "hash": "sha256-3nMNWDrr6k6q5vaskxWc6oioUkLoyJciZ4ocyW5oN+w="
   },
   {
     "pname": "NSwag.Core",
-    "version": "14.3.0",
-    "hash": "sha256-FjWms/V5+j4ut1TShKWDsTr1LuBsHxRQIFs1fwD0jGw="
+    "version": "14.4.0",
+    "hash": "sha256-l1nBCyf/ed2Xm8Yk5TL3ni8kQxQSAf0ajAfwaAL3/6I="
   },
   {
     "pname": "NSwag.Core.Yaml",
-    "version": "14.3.0",
-    "hash": "sha256-CcGXuyNUvF/e3f9K3wZY+h0RIbzoLOLLguUcj+VVFXI="
+    "version": "14.4.0",
+    "hash": "sha256-YBlNeIqgZgcYvf/VvJXelTIxDCRqyPJPo7ZzTIo16ak="
   },
   {
     "pname": "NSwag.Generation",
-    "version": "14.3.0",
-    "hash": "sha256-M487C7OsnZnURcAN90DGIhZTnxlToaIskkztCKkXzQc="
+    "version": "14.4.0",
+    "hash": "sha256-DH7C00KVAiv6i8lJxNAzkDtuNHykyGQAfgT6MAbeBko="
   },
   {
     "pname": "NSwag.Generation.AspNetCore",
-    "version": "14.3.0",
-    "hash": "sha256-DvjSjbM2ug0AvjAE8CwVUej2hZbLWopmZMbOx4Oy2IU="
+    "version": "14.4.0",
+    "hash": "sha256-YT2v9ddGAFk8gMj1aQ2yHOK3UWX3mcIoGYWBl+OsJ2s="
   },
   {
     "pname": "NuGet.Frameworks",
@@ -1396,8 +1396,8 @@
   },
   {
     "pname": "System.Linq.Dynamic.Core",
-    "version": "1.6.0.2",
-    "hash": "sha256-5qzEVm+33ATR+SQljwe/LcP5o0MNjv49nHfXIVG27dw="
+    "version": "1.6.4",
+    "hash": "sha256-Mpp+3UYARo+Hnh3ybtHtdN0LI5HQV07CBZP7jRnVk10="
   },
   {
     "pname": "System.Linq.Expressions",
diff --git a/pkgs/by-name/sm/smtp4dev/package.nix b/pkgs/by-name/sm/smtp4dev/package.nix
index 7a4abeaa4a71..d59f12863677 100644
--- a/pkgs/by-name/sm/smtp4dev/package.nix
+++ b/pkgs/by-name/sm/smtp4dev/package.nix
@@ -11,13 +11,13 @@
 
 buildDotnetModule (finalAttrs: {
   pname = "smtp4dev";
-  version = "3.8.6";
+  version = "3.9.0";
 
   src = fetchFromGitHub {
     owner = "rnwood";
     repo = "smtp4dev";
     tag = finalAttrs.version;
-    hash = "sha256-k4nerh4cVVcFQF7a4Wvcfhefa3SstEOASk+0soN0n9k=";
+    hash = "sha256-LGhx+i4PIExC6GbBwDOLi/g1TxNoMFMZomdnbtc/wNc=";
   };
 
   patches = [ ./smtp4dev-npm-packages.patch ];
@@ -33,7 +33,7 @@ buildDotnetModule (finalAttrs: {
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src patches;
-    hash = "sha256-Uj0EnnsA+QHq5KHF2B93OG8rwxYrV6sEgMTbd43ttCA=";
+    hash = "sha256-Xjx3V5FH72D+CXBRZgmlkbp5evnp6F4zaHMWQB5o61w=";
     postPatch = "cd ${finalAttrs.npmRoot}";
   };
 
@@ -47,6 +47,15 @@ buildDotnetModule (finalAttrs: {
     mv $out/bin/Rnwood.Smtp4dev $out/bin/smtp4dev
   '';
 
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    $out/bin/smtp4dev --help | head -1 | grep -F "smtp4dev version ${finalAttrs.version}"
+
+    runHook postInstallCheck
+  '';
+
   passthru.updateScript = ./update.sh;
 
   meta = {
diff --git a/pkgs/by-name/sm/smtp4dev/smtp4dev-npm-packages.patch b/pkgs/by-name/sm/smtp4dev/smtp4dev-npm-packages.patch
index 6889e774cad2..0d65bea9a725 100644
--- a/pkgs/by-name/sm/smtp4dev/smtp4dev-npm-packages.patch
+++ b/pkgs/by-name/sm/smtp4dev/smtp4dev-npm-packages.patch
@@ -1,18 +1,17 @@
 diff --git a/Rnwood.Smtp4dev/ClientApp/package-lock.json b/Rnwood.Smtp4dev/ClientApp/package-lock.json
-index be143b7..6e8b0b4 100644
+index c25a9ca..59acfb5 100644
 --- a/Rnwood.Smtp4dev/ClientApp/package-lock.json
 +++ b/Rnwood.Smtp4dev/ClientApp/package-lock.json
-@@ -20,7 +20,8 @@
+@@ -21,7 +21,7 @@
          "@microsoft/signalr": "^8.0.0",
          "@types/jest": "^29.5.12",
          "@types/sanitize-html": "^2.11.0",
 -        "@typescript-eslint/parser": "^8.0.0",
-+        "@typescript-eslint/eslint-plugin": "^8.31.1",
-+        "@typescript-eslint/parser": "^8.31.1",
++        "@typescript-eslint/parser": "^8.32.1",
          "@vitejs/plugin-vue": "^5.0.4",
          "@vue/eslint-config-typescript": "^13.0.0",
          "@vue/vue3-jest": "^29.2.6",
-@@ -2937,7 +2938,8 @@
+@@ -2938,7 +2938,8 @@
        "version": "7.0.15",
        "resolved": "https://registry.npmjs.org/@types/json-schema/-/json-schema-7.0.15.tgz",
        "integrity": "sha512-5+fP8P8MFNC+AyZCDxrB2pkZFPGzqQWUzpSeuuVLvm8VMcorNYavBqoFcxK8bQz4Qsbn4oUEEem4wDLfcysGHA==",
@@ -22,7 +21,7 @@ index be143b7..6e8b0b4 100644
      },
      "node_modules/@types/lodash": {
        "version": "4.17.0",
-@@ -2993,12 +2995,6 @@
+@@ -2994,12 +2995,6 @@
          "entities": "^4.4.0"
        }
      },
@@ -35,45 +34,36 @@ index be143b7..6e8b0b4 100644
      "node_modules/@types/stack-utils": {
        "version": "2.0.3",
        "resolved": "https://registry.npmjs.org/@types/stack-utils/-/stack-utils-2.0.3.tgz",
-@@ -3039,84 +3035,59 @@
+@@ -3039,74 +3034,6 @@
+       "integrity": "sha512-I4q9QU9MQv4oEOz4tAHJtNz1cwuLxn2F3xcc2iV5WdqLPpUnj30aUuxt1mAxYTG+oe8CZMV/+6rU4S4gRDzqtQ==",
        "dev": true
      },
-     "node_modules/@typescript-eslint/eslint-plugin": {
+-    "node_modules/@typescript-eslint/eslint-plugin": {
 -      "version": "7.6.0",
 -      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-7.6.0.tgz",
 -      "integrity": "sha512-gKmTNwZnblUdnTIJu3e9kmeRRzV2j1a/LUO27KNNAnIC5zjy1aSvXSRp4rVNlmAoHlQ7HzX42NbKpcSr4jF80A==",
-+      "version": "8.31.1",
-+      "resolved": "https://registry.npmjs.org/@typescript-eslint/eslint-plugin/-/eslint-plugin-8.31.1.tgz",
-+      "integrity": "sha512-oUlH4h1ABavI4F0Xnl8/fOtML/eu8nI2A1nYd+f+55XI0BLu+RIqKoCiZKNo6DtqZBEQm5aNKA20G3Z5w3R6GQ==",
-       "dev": true,
-+      "license": "MIT",
-       "dependencies": {
-         "@eslint-community/regexpp": "^4.10.0",
+-      "dev": true,
+-      "dependencies": {
+-        "@eslint-community/regexpp": "^4.10.0",
 -        "@typescript-eslint/scope-manager": "7.6.0",
 -        "@typescript-eslint/type-utils": "7.6.0",
 -        "@typescript-eslint/utils": "7.6.0",
 -        "@typescript-eslint/visitor-keys": "7.6.0",
 -        "debug": "^4.3.4",
-+        "@typescript-eslint/scope-manager": "8.31.1",
-+        "@typescript-eslint/type-utils": "8.31.1",
-+        "@typescript-eslint/utils": "8.31.1",
-+        "@typescript-eslint/visitor-keys": "8.31.1",
-         "graphemer": "^1.4.0",
-         "ignore": "^5.3.1",
-         "natural-compare": "^1.4.0",
+-        "graphemer": "^1.4.0",
+-        "ignore": "^5.3.1",
+-        "natural-compare": "^1.4.0",
 -        "semver": "^7.6.0",
 -        "ts-api-utils": "^1.3.0"
-+        "ts-api-utils": "^2.0.1"
-       },
-       "engines": {
+-      },
+-      "engines": {
 -        "node": "^18.18.0 || >=20.0.0"
-+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-       },
-       "funding": {
-         "type": "opencollective",
-         "url": "https://opencollective.com/typescript-eslint"
-       },
-       "peerDependencies": {
+-      },
+-      "funding": {
+-        "type": "opencollective",
+-        "url": "https://opencollective.com/typescript-eslint"
+-      },
+-      "peerDependencies": {
 -        "@typescript-eslint/parser": "^7.0.0",
 -        "eslint": "^8.56.0"
 -      },
@@ -81,25 +71,17 @@ index be143b7..6e8b0b4 100644
 -        "typescript": {
 -          "optional": true
 -        }
-+        "@typescript-eslint/parser": "^8.0.0 || ^8.0.0-alpha.0",
-+        "eslint": "^8.57.0 || ^9.0.0",
-+        "typescript": ">=4.8.4 <5.9.0"
-       }
-     },
+-      }
+-    },
 -    "node_modules/@typescript-eslint/eslint-plugin/node_modules/lru-cache": {
 -      "version": "6.0.0",
 -      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
 -      "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
-+    "node_modules/@typescript-eslint/eslint-plugin/node_modules/ts-api-utils": {
-+      "version": "2.1.0",
-+      "resolved": "https://registry.npmjs.org/ts-api-utils/-/ts-api-utils-2.1.0.tgz",
-+      "integrity": "sha512-CUgTZL1irw8u29bzrOD/nH85jqyc74D6SshFgujOIA7osm2Rz7dYH77agkx7H4FBNxDq7Cjf+IjaX/8zwFW+ZQ==",
-       "dev": true,
+-      "dev": true,
 -      "dependencies": {
 -        "yallist": "^4.0.0"
 -      },
-+      "license": "MIT",
-       "engines": {
+-      "engines": {
 -        "node": ">=10"
 -      }
 -    },
@@ -113,14 +95,11 @@ index be143b7..6e8b0b4 100644
 -      },
 -      "bin": {
 -        "semver": "bin/semver.js"
-+        "node": ">=18.12"
-       },
+-      },
 -      "engines": {
 -        "node": ">=10"
-+      "peerDependencies": {
-+        "typescript": ">=4.8.4"
-       }
-     },
+-      }
+-    },
 -    "node_modules/@typescript-eslint/eslint-plugin/node_modules/yallist": {
 -      "version": "4.0.0",
 -      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
@@ -128,281 +107,93 @@ index be143b7..6e8b0b4 100644
 -      "dev": true
 -    },
      "node_modules/@typescript-eslint/parser": {
--      "version": "8.31.0",
--      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.31.0.tgz",
--      "integrity": "sha512-67kYYShjBR0jNI5vsf/c3WG4u+zDnCTHTPqVMQguffaWWFs7artgwKmfwdifl+r6XyM5LYLas/dInj2T0SgJyw==",
-+      "version": "8.31.1",
-+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.31.1.tgz",
-+      "integrity": "sha512-oU/OtYVydhXnumd0BobL9rkJg7wFJ9bFFPmSmB/bf/XWN85hlViji59ko6bSKBXyseT9V8l+CN1nwmlbiN0G7Q==",
-       "dev": true,
-       "license": "MIT",
-       "dependencies": {
--        "@typescript-eslint/scope-manager": "8.31.0",
--        "@typescript-eslint/types": "8.31.0",
--        "@typescript-eslint/typescript-estree": "8.31.0",
--        "@typescript-eslint/visitor-keys": "8.31.0",
-+        "@typescript-eslint/scope-manager": "8.31.1",
-+        "@typescript-eslint/types": "8.31.1",
-+        "@typescript-eslint/typescript-estree": "8.31.1",
-+        "@typescript-eslint/visitor-keys": "8.31.1",
-         "debug": "^4.3.4"
-       },
-       "engines": {
-@@ -3131,15 +3102,15 @@
-         "typescript": ">=4.8.4 <5.9.0"
+       "version": "8.32.1",
+       "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.32.1.tgz",
+@@ -3275,13 +3202,14 @@
        }
      },
--    "node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/scope-manager": {
--      "version": "8.31.0",
--      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.31.0.tgz",
--      "integrity": "sha512-knO8UyF78Nt8O/B64i7TlGXod69ko7z6vJD9uhSlm0qkAbGeRUSudcm0+K/4CrRjrpiHfBCjMWlc08Vav1xwcw==",
-+    "node_modules/@typescript-eslint/scope-manager": {
-+      "version": "8.31.1",
-+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.31.1.tgz",
-+      "integrity": "sha512-BMNLOElPxrtNQMIsFHE+3P0Yf1z0dJqV9zLdDxN/xLlWMlXK/ApEsVEKzpizg9oal8bAT5Sc7+ocal7AC1HCVw==",
-       "dev": true,
-       "license": "MIT",
-       "dependencies": {
--        "@typescript-eslint/types": "8.31.0",
--        "@typescript-eslint/visitor-keys": "8.31.0"
-+        "@typescript-eslint/types": "8.31.1",
-+        "@typescript-eslint/visitor-keys": "8.31.1"
-       },
-       "engines": {
-         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-@@ -3149,34 +3120,16 @@
-         "url": "https://opencollective.com/typescript-eslint"
-       }
-     },
--    "node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/types": {
--      "version": "8.31.0",
--      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.31.0.tgz",
--      "integrity": "sha512-Ch8oSjVyYyJxPQk8pMiP2FFGYatqXQfQIaMp+TpuuLlDachRWpUAeEu1u9B/v/8LToehUIWyiKcA/w5hUFRKuQ==",
--      "dev": true,
--      "license": "MIT",
--      "engines": {
--        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
--      },
--      "funding": {
--        "type": "opencollective",
--        "url": "https://opencollective.com/typescript-eslint"
--      }
--    },
--    "node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/typescript-estree": {
--      "version": "8.31.0",
--      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.31.0.tgz",
--      "integrity": "sha512-xLmgn4Yl46xi6aDSZ9KkyfhhtnYI15/CvHbpOy/eR5NWhK/BK8wc709KKwhAR0m4ZKRP7h07bm4BWUYOCuRpQQ==",
-+    "node_modules/@typescript-eslint/type-utils": {
-+      "version": "8.31.1",
-+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-8.31.1.tgz",
-+      "integrity": "sha512-fNaT/m9n0+dpSp8G/iOQ05GoHYXbxw81x+yvr7TArTuZuCA6VVKbqWYVZrV5dVagpDTtj/O8k5HBEE/p/HM5LA==",
-       "dev": true,
-       "license": "MIT",
-       "dependencies": {
--        "@typescript-eslint/types": "8.31.0",
--        "@typescript-eslint/visitor-keys": "8.31.0",
-+        "@typescript-eslint/typescript-estree": "8.31.1",
-+        "@typescript-eslint/utils": "8.31.1",
-         "debug": "^4.3.4",
--        "fast-glob": "^3.3.2",
--        "is-glob": "^4.0.3",
--        "minimatch": "^9.0.4",
--        "semver": "^7.6.0",
-         "ts-api-utils": "^2.0.1"
-       },
-       "engines": {
-@@ -3187,80 +3140,11 @@
-         "url": "https://opencollective.com/typescript-eslint"
-       },
-       "peerDependencies": {
-+        "eslint": "^8.57.0 || ^9.0.0",
-         "typescript": ">=4.8.4 <5.9.0"
-       }
-     },
--    "node_modules/@typescript-eslint/parser/node_modules/@typescript-eslint/visitor-keys": {
--      "version": "8.31.0",
--      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.31.0.tgz",
--      "integrity": "sha512-QcGHmlRHWOl93o64ZUMNewCdwKGU6WItOU52H0djgNmn1EOrhVudrDzXz4OycCRSCPwFCDrE2iIt5vmuUdHxuQ==",
--      "dev": true,
--      "license": "MIT",
--      "dependencies": {
--        "@typescript-eslint/types": "8.31.0",
--        "eslint-visitor-keys": "^4.2.0"
--      },
--      "engines": {
--        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
--      },
--      "funding": {
--        "type": "opencollective",
--        "url": "https://opencollective.com/typescript-eslint"
--      }
--    },
--    "node_modules/@typescript-eslint/parser/node_modules/brace-expansion": {
--      "version": "2.0.1",
--      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
--      "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==",
--      "dev": true,
--      "license": "MIT",
--      "dependencies": {
--        "balanced-match": "^1.0.0"
--      }
--    },
--    "node_modules/@typescript-eslint/parser/node_modules/eslint-visitor-keys": {
--      "version": "4.2.0",
--      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-4.2.0.tgz",
--      "integrity": "sha512-UyLnSehNt62FFhSwjZlHmeokpRK59rcz29j+F1/aDgbkbRTk7wIc9XzdoasMUbRNKDM0qQt/+BJ4BrpFeABemw==",
--      "dev": true,
--      "license": "Apache-2.0",
--      "engines": {
--        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
--      },
--      "funding": {
--        "url": "https://opencollective.com/eslint"
--      }
--    },
--    "node_modules/@typescript-eslint/parser/node_modules/minimatch": {
--      "version": "9.0.5",
--      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
--      "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
--      "dev": true,
--      "license": "ISC",
--      "dependencies": {
--        "brace-expansion": "^2.0.1"
--      },
--      "engines": {
--        "node": ">=16 || 14 >=14.17"
--      },
--      "funding": {
--        "url": "https://github.com/sponsors/isaacs"
--      }
--    },
--    "node_modules/@typescript-eslint/parser/node_modules/semver": {
--      "version": "7.7.1",
--      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.1.tgz",
--      "integrity": "sha512-hlq8tAfn0m/61p4BVRcPzIGr6LKiMwo4VM6dGi6pt4qcRkmNzTcWq6eCEjEh+qXjkMDvPlOFFSGwQjoEa6gyMA==",
--      "dev": true,
--      "license": "ISC",
--      "bin": {
--        "semver": "bin/semver.js"
--      },
--      "engines": {
--        "node": ">=10"
--      }
--    },
--    "node_modules/@typescript-eslint/parser/node_modules/ts-api-utils": {
-+    "node_modules/@typescript-eslint/type-utils/node_modules/ts-api-utils": {
-       "version": "2.1.0",
-       "resolved": "https://registry.npmjs.org/ts-api-utils/-/ts-api-utils-2.1.0.tgz",
-       "integrity": "sha512-CUgTZL1irw8u29bzrOD/nH85jqyc74D6SshFgujOIA7osm2Rz7dYH77agkx7H4FBNxDq7Cjf+IjaX/8zwFW+ZQ==",
-@@ -3273,57 +3157,14 @@
-         "typescript": ">=4.8.4"
-       }
-     },
--    "node_modules/@typescript-eslint/scope-manager": {
+     "node_modules/@typescript-eslint/scope-manager": {
 -      "version": "7.6.0",
 -      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-7.6.0.tgz",
 -      "integrity": "sha512-ngttyfExA5PsHSx0rdFgnADMYQi+Zkeiv4/ZxGYUWd0nLs63Ha0ksmp8VMxAIC0wtCFxMos7Lt3PszJssG/E6w==",
--      "dev": true,
--      "dependencies": {
++      "version": "7.18.0",
++      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-7.18.0.tgz",
++      "integrity": "sha512-jjhdIE/FPF2B7Z1uzc6i3oWKbGcHb87Qw7AWj6jmEqNOfDFbJWtjt/XfwCpvNkpGWlcJaog5vTR+VV8+w9JflA==",
+       "dev": true,
++      "license": "MIT",
+       "dependencies": {
 -        "@typescript-eslint/types": "7.6.0",
 -        "@typescript-eslint/visitor-keys": "7.6.0"
--      },
--      "engines": {
--        "node": "^18.18.0 || >=20.0.0"
--      },
--      "funding": {
--        "type": "opencollective",
--        "url": "https://opencollective.com/typescript-eslint"
--      }
--    },
--    "node_modules/@typescript-eslint/type-utils": {
++        "@typescript-eslint/types": "7.18.0",
++        "@typescript-eslint/visitor-keys": "7.18.0"
+       },
+       "engines": {
+         "node": "^18.18.0 || >=20.0.0"
+@@ -3292,13 +3220,14 @@
+       }
+     },
+     "node_modules/@typescript-eslint/type-utils": {
 -      "version": "7.6.0",
 -      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-7.6.0.tgz",
 -      "integrity": "sha512-NxAfqAPNLG6LTmy7uZgpK8KcuiS2NZD/HlThPXQRGwz6u7MDBWRVliEEl1Gj6U7++kVJTpehkhZzCJLMK66Scw==",
--      "dev": true,
--      "dependencies": {
++      "version": "7.18.0",
++      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-7.18.0.tgz",
++      "integrity": "sha512-XL0FJXuCLaDuX2sYqZUUSOJ2sG5/i1AAze+axqmLnSkNEVMVYLF+cbwlB2w8D1tinFuSikHmFta+P+HOofrLeA==",
+       "dev": true,
++      "license": "MIT",
+       "dependencies": {
 -        "@typescript-eslint/typescript-estree": "7.6.0",
 -        "@typescript-eslint/utils": "7.6.0",
--        "debug": "^4.3.4",
--        "ts-api-utils": "^1.3.0"
--      },
--      "engines": {
--        "node": "^18.18.0 || >=20.0.0"
--      },
--      "funding": {
--        "type": "opencollective",
--        "url": "https://opencollective.com/typescript-eslint"
--      },
--      "peerDependencies": {
--        "eslint": "^8.56.0"
--      },
--      "peerDependenciesMeta": {
--        "typescript": {
--          "optional": true
--        }
--      }
--    },
++        "@typescript-eslint/typescript-estree": "7.18.0",
++        "@typescript-eslint/utils": "7.18.0",
+         "debug": "^4.3.4",
+         "ts-api-utils": "^1.3.0"
+       },
+@@ -3319,10 +3248,11 @@
+       }
+     },
      "node_modules/@typescript-eslint/types": {
 -      "version": "7.6.0",
 -      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-7.6.0.tgz",
 -      "integrity": "sha512-h02rYQn8J+MureCvHVVzhl69/GAfQGPQZmOMjG1KfCl7o3HtMSlPaPUAPu6lLctXI5ySRGIYk94clD/AUMCUgQ==",
-+      "version": "8.31.1",
-+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.31.1.tgz",
-+      "integrity": "sha512-SfepaEFUDQYRoA70DD9GtytljBePSj17qPxFHA/h3eg6lPTqGJ5mWOtbXCk1YrVU1cTJRd14nhaXWFu0l2troQ==",
++      "version": "7.18.0",
++      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-7.18.0.tgz",
++      "integrity": "sha512-iZqi+Ds1y4EDYUtlOOC+aUmxnE9xS/yCigkjA7XpTKV6nCBd3Hp/PRGGmdwnfkV2ThMyYldP1wRpm/id99spTQ==",
        "dev": true,
 +      "license": "MIT",
        "engines": {
--        "node": "^18.18.0 || >=20.0.0"
-+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
+         "node": "^18.18.0 || >=20.0.0"
        },
-       "funding": {
-         "type": "opencollective",
-@@ -3331,31 +3172,30 @@
+@@ -3332,13 +3262,14 @@
        }
      },
      "node_modules/@typescript-eslint/typescript-estree": {
 -      "version": "7.6.0",
 -      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-7.6.0.tgz",
 -      "integrity": "sha512-+7Y/GP9VuYibecrCQWSKgl3GvUM5cILRttpWtnAu8GNL9j11e4tbuGZmZjJ8ejnKYyBRb2ddGQ3rEFCq3QjMJw==",
-+      "version": "8.31.1",
-+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.31.1.tgz",
-+      "integrity": "sha512-kaA0ueLe2v7KunYOyWYtlf/QhhZb7+qh4Yw6Ni5kgukMIG+iP773tjgBiLWIXYumWCwEq3nLW+TUywEp8uEeag==",
++      "version": "7.18.0",
++      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-7.18.0.tgz",
++      "integrity": "sha512-aP1v/BSPnnyhMHts8cf1qQ6Q1IFwwRvAQGRvBFkWlo3/lH29OXA3Pts+c10nxRxIBrDnoMqzhgdwVe5f2D6OzA==",
        "dev": true,
-+      "license": "MIT",
++      "license": "BSD-2-Clause",
        "dependencies": {
 -        "@typescript-eslint/types": "7.6.0",
 -        "@typescript-eslint/visitor-keys": "7.6.0",
-+        "@typescript-eslint/types": "8.31.1",
-+        "@typescript-eslint/visitor-keys": "8.31.1",
++        "@typescript-eslint/types": "7.18.0",
++        "@typescript-eslint/visitor-keys": "7.18.0",
          "debug": "^4.3.4",
--        "globby": "^11.1.0",
-+        "fast-glob": "^3.3.2",
+         "globby": "^11.1.0",
          "is-glob": "^4.0.3",
-         "minimatch": "^9.0.4",
-         "semver": "^7.6.0",
--        "ts-api-utils": "^1.3.0"
-+        "ts-api-utils": "^2.0.1"
-       },
-       "engines": {
--        "node": "^18.18.0 || >=20.0.0"
-+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-       },
-       "funding": {
-         "type": "opencollective",
-         "url": "https://opencollective.com/typescript-eslint"
-       },
--      "peerDependenciesMeta": {
--        "typescript": {
--          "optional": true
--        }
-+      "peerDependencies": {
-+        "typescript": ">=4.8.4 <5.9.0"
+@@ -3360,31 +3291,21 @@
        }
      },
      "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
-@@ -3363,27 +3203,17 @@
-       "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
-       "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==",
+-      "version": "2.0.1",
+-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
+-      "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==",
++      "version": "2.0.2",
++      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
++      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
        "dev": true,
 +      "license": "MIT",
        "dependencies": {
@@ -433,16 +224,16 @@ index be143b7..6e8b0b4 100644
        "dependencies": {
          "brace-expansion": "^2.0.1"
        },
-@@ -3395,13 +3225,11 @@
+@@ -3396,13 +3317,11 @@
        }
      },
      "node_modules/@typescript-eslint/typescript-estree/node_modules/semver": {
 -      "version": "7.6.0",
 -      "resolved": "https://registry.npmjs.org/semver/-/semver-7.6.0.tgz",
 -      "integrity": "sha512-EnwXhrlwXMk9gKu5/flx5sv/an57AkRplG3hTK68W7FRDN+k+OWBj65M7719OkA82XLBxrcX0KSHj+X5COhOVg==",
-+      "version": "7.7.1",
-+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.1.tgz",
-+      "integrity": "sha512-hlq8tAfn0m/61p4BVRcPzIGr6LKiMwo4VM6dGi6pt4qcRkmNzTcWq6eCEjEh+qXjkMDvPlOFFSGwQjoEa6gyMA==",
++      "version": "7.7.2",
++      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.2.tgz",
++      "integrity": "sha512-RF0Fw+rO5AMf9MAyaRXI4AV0Ulj5lMHqVxxdSgiVbixSCXoEmmX/jk0CuJw4+3SqroYO9VoUh+HcuJivvtJemA==",
        "dev": true,
 -      "dependencies": {
 -        "lru-cache": "^6.0.0"
@@ -451,7 +242,7 @@ index be143b7..6e8b0b4 100644
        "bin": {
          "semver": "bin/semver.js"
        },
-@@ -3409,85 +3237,72 @@
+@@ -3410,25 +3329,17 @@
          "node": ">=10"
        }
      },
@@ -460,26 +251,14 @@ index be143b7..6e8b0b4 100644
 -      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
 -      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
 -      "dev": true
-+    "node_modules/@typescript-eslint/typescript-estree/node_modules/ts-api-utils": {
-+      "version": "2.1.0",
-+      "resolved": "https://registry.npmjs.org/ts-api-utils/-/ts-api-utils-2.1.0.tgz",
-+      "integrity": "sha512-CUgTZL1irw8u29bzrOD/nH85jqyc74D6SshFgujOIA7osm2Rz7dYH77agkx7H4FBNxDq7Cjf+IjaX/8zwFW+ZQ==",
-+      "dev": true,
-+      "license": "MIT",
-+      "engines": {
-+        "node": ">=18.12"
-+      },
-+      "peerDependencies": {
-+        "typescript": ">=4.8.4"
-+      }
-     },
+-    },
      "node_modules/@typescript-eslint/utils": {
 -      "version": "7.6.0",
 -      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-7.6.0.tgz",
 -      "integrity": "sha512-x54gaSsRRI+Nwz59TXpCsr6harB98qjXYzsRxGqvA5Ue3kQH+FxS7FYU81g/omn22ML2pZJkisy6Q+ElK8pBCA==",
-+      "version": "8.31.1",
-+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.31.1.tgz",
-+      "integrity": "sha512-2DSI4SNfF5T4oRveQ4nUrSjUqjMND0nLq9rEkz0gfGr3tg0S5KB6DhwR+WZPCjzkZl3cH+4x2ce3EsL50FubjQ==",
++      "version": "7.18.0",
++      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-7.18.0.tgz",
++      "integrity": "sha512-kK0/rNa2j74XuHVcoCZxdFBMF+aq/vH83CXAOHieC+2Gis4mF8jJXT5eAfyD3K0sAxtPuwxaIOIOvhwzVDt/kw==",
        "dev": true,
 +      "license": "MIT",
        "dependencies": {
@@ -490,40 +269,25 @@ index be143b7..6e8b0b4 100644
 -        "@typescript-eslint/types": "7.6.0",
 -        "@typescript-eslint/typescript-estree": "7.6.0",
 -        "semver": "^7.6.0"
-+        "@typescript-eslint/scope-manager": "8.31.1",
-+        "@typescript-eslint/types": "8.31.1",
-+        "@typescript-eslint/typescript-estree": "8.31.1"
++        "@typescript-eslint/scope-manager": "7.18.0",
++        "@typescript-eslint/types": "7.18.0",
++        "@typescript-eslint/typescript-estree": "7.18.0"
        },
        "engines": {
--        "node": "^18.18.0 || >=20.0.0"
-+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-       },
-       "funding": {
-         "type": "opencollective",
-         "url": "https://opencollective.com/typescript-eslint"
-       },
-       "peerDependencies": {
--        "eslint": "^8.56.0"
-+        "eslint": "^8.57.0 || ^9.0.0",
-+        "typescript": ">=4.8.4 <5.9.0"
+         "node": "^18.18.0 || >=20.0.0"
+@@ -3441,46 +3352,14 @@
+         "eslint": "^8.56.0"
        }
      },
 -    "node_modules/@typescript-eslint/utils/node_modules/lru-cache": {
 -      "version": "6.0.0",
 -      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-6.0.0.tgz",
 -      "integrity": "sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==",
-+    "node_modules/@typescript-eslint/visitor-keys": {
-+      "version": "8.31.1",
-+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.31.1.tgz",
-+      "integrity": "sha512-I+/rgqOVBn6f0o7NDTmAPWWC6NuqhV174lfYvAm9fUaWeiefLdux9/YI3/nLugEn9L8fcSi0XmpKi/r5u0nmpw==",
-       "dev": true,
-+      "license": "MIT",
-       "dependencies": {
+-      "dev": true,
+-      "dependencies": {
 -        "yallist": "^4.0.0"
-+        "@typescript-eslint/types": "8.31.1",
-+        "eslint-visitor-keys": "^4.2.0"
-       },
-       "engines": {
+-      },
+-      "engines": {
 -        "node": ">=10"
 -      }
 -    },
@@ -537,47 +301,33 @@ index be143b7..6e8b0b4 100644
 -      },
 -      "bin": {
 -        "semver": "bin/semver.js"
-+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
-       },
+-      },
 -      "engines": {
 -        "node": ">=10"
-+      "funding": {
-+        "type": "opencollective",
-+        "url": "https://opencollective.com/typescript-eslint"
-       }
-     },
+-      }
+-    },
 -    "node_modules/@typescript-eslint/utils/node_modules/yallist": {
 -      "version": "4.0.0",
 -      "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
 -      "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A==",
 -      "dev": true
 -    },
--    "node_modules/@typescript-eslint/visitor-keys": {
+     "node_modules/@typescript-eslint/visitor-keys": {
 -      "version": "7.6.0",
 -      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-7.6.0.tgz",
 -      "integrity": "sha512-4eLB7t+LlNUmXzfOu1VAIAdkjbu5xNSerURS9X/S5TUKWFRpXRQZbmtPqgKmYx8bj3J0irtQXSiWAOY82v+cgw==",
-+    "node_modules/@typescript-eslint/visitor-keys/node_modules/eslint-visitor-keys": {
-+      "version": "4.2.0",
-+      "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-4.2.0.tgz",
-+      "integrity": "sha512-UyLnSehNt62FFhSwjZlHmeokpRK59rcz29j+F1/aDgbkbRTk7wIc9XzdoasMUbRNKDM0qQt/+BJ4BrpFeABemw==",
++      "version": "7.18.0",
++      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-7.18.0.tgz",
++      "integrity": "sha512-cDF0/Gf81QpY3xYyJKDV14Zwdmid5+uuENhjH2EqFaF0ni+yAyq/LzMaIJdhNJXZI7uLzwIlA+V7oWoyn6Curg==",
        "dev": true,
--      "dependencies": {
++      "license": "MIT",
+       "dependencies": {
 -        "@typescript-eslint/types": "7.6.0",
--        "eslint-visitor-keys": "^3.4.3"
--      },
-+      "license": "Apache-2.0",
-       "engines": {
--        "node": "^18.18.0 || >=20.0.0"
-+        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
++        "@typescript-eslint/types": "7.18.0",
+         "eslint-visitor-keys": "^3.4.3"
        },
-       "funding": {
--        "type": "opencollective",
--        "url": "https://opencollective.com/typescript-eslint"
-+        "url": "https://opencollective.com/eslint"
-       }
-     },
-     "node_modules/@ungap/structured-clone": {
-@@ -3591,6 +3406,40 @@
+       "engines": {
+@@ -3592,6 +3471,40 @@
          }
        }
      },
@@ -618,82 +368,141 @@ index be143b7..6e8b0b4 100644
      "node_modules/@vue/eslint-config-typescript/node_modules/@typescript-eslint/parser": {
        "version": "7.18.0",
        "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-7.18.0.tgz",
-@@ -3638,6 +3487,34 @@
-         "url": "https://opencollective.com/typescript-eslint"
-       }
-     },
-+    "node_modules/@vue/eslint-config-typescript/node_modules/@typescript-eslint/type-utils": {
-+      "version": "7.18.0",
-+      "resolved": "https://registry.npmjs.org/@typescript-eslint/type-utils/-/type-utils-7.18.0.tgz",
-+      "integrity": "sha512-XL0FJXuCLaDuX2sYqZUUSOJ2sG5/i1AAze+axqmLnSkNEVMVYLF+cbwlB2w8D1tinFuSikHmFta+P+HOofrLeA==",
-+      "dev": true,
-+      "license": "MIT",
-+      "dependencies": {
-+        "@typescript-eslint/typescript-estree": "7.18.0",
-+        "@typescript-eslint/utils": "7.18.0",
-+        "debug": "^4.3.4",
-+        "ts-api-utils": "^1.3.0"
-+      },
-+      "engines": {
-+        "node": "^18.18.0 || >=20.0.0"
-+      },
-+      "funding": {
-+        "type": "opencollective",
-+        "url": "https://opencollective.com/typescript-eslint"
-+      },
-+      "peerDependencies": {
-+        "eslint": "^8.56.0"
-+      },
-+      "peerDependenciesMeta": {
-+        "typescript": {
-+          "optional": true
-+        }
-+      }
-+    },
-     "node_modules/@vue/eslint-config-typescript/node_modules/@typescript-eslint/types": {
-       "version": "7.18.0",
-       "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-7.18.0.tgz",
-@@ -3681,6 +3558,29 @@
+@@ -3621,124 +3534,6 @@
          }
        }
      },
-+    "node_modules/@vue/eslint-config-typescript/node_modules/@typescript-eslint/utils": {
-+      "version": "7.18.0",
-+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-7.18.0.tgz",
-+      "integrity": "sha512-kK0/rNa2j74XuHVcoCZxdFBMF+aq/vH83CXAOHieC+2Gis4mF8jJXT5eAfyD3K0sAxtPuwxaIOIOvhwzVDt/kw==",
-+      "dev": true,
-+      "license": "MIT",
-+      "dependencies": {
-+        "@eslint-community/eslint-utils": "^4.4.0",
-+        "@typescript-eslint/scope-manager": "7.18.0",
-+        "@typescript-eslint/types": "7.18.0",
-+        "@typescript-eslint/typescript-estree": "7.18.0"
-+      },
-+      "engines": {
-+        "node": "^18.18.0 || >=20.0.0"
-+      },
-+      "funding": {
-+        "type": "opencollective",
-+        "url": "https://opencollective.com/typescript-eslint"
-+      },
-+      "peerDependencies": {
-+        "eslint": "^8.56.0"
-+      }
-+    },
-     "node_modules/@vue/eslint-config-typescript/node_modules/@typescript-eslint/visitor-keys": {
-       "version": "7.18.0",
-       "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-7.18.0.tgz",
+-    "node_modules/@vue/eslint-config-typescript/node_modules/@typescript-eslint/scope-manager": {
+-      "version": "7.18.0",
+-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-7.18.0.tgz",
+-      "integrity": "sha512-jjhdIE/FPF2B7Z1uzc6i3oWKbGcHb87Qw7AWj6jmEqNOfDFbJWtjt/XfwCpvNkpGWlcJaog5vTR+VV8+w9JflA==",
+-      "dev": true,
+-      "license": "MIT",
+-      "dependencies": {
+-        "@typescript-eslint/types": "7.18.0",
+-        "@typescript-eslint/visitor-keys": "7.18.0"
+-      },
+-      "engines": {
+-        "node": "^18.18.0 || >=20.0.0"
+-      },
+-      "funding": {
+-        "type": "opencollective",
+-        "url": "https://opencollective.com/typescript-eslint"
+-      }
+-    },
+-    "node_modules/@vue/eslint-config-typescript/node_modules/@typescript-eslint/types": {
+-      "version": "7.18.0",
+-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-7.18.0.tgz",
+-      "integrity": "sha512-iZqi+Ds1y4EDYUtlOOC+aUmxnE9xS/yCigkjA7XpTKV6nCBd3Hp/PRGGmdwnfkV2ThMyYldP1wRpm/id99spTQ==",
+-      "dev": true,
+-      "license": "MIT",
+-      "engines": {
+-        "node": "^18.18.0 || >=20.0.0"
+-      },
+-      "funding": {
+-        "type": "opencollective",
+-        "url": "https://opencollective.com/typescript-eslint"
+-      }
+-    },
+-    "node_modules/@vue/eslint-config-typescript/node_modules/@typescript-eslint/typescript-estree": {
+-      "version": "7.18.0",
+-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-7.18.0.tgz",
+-      "integrity": "sha512-aP1v/BSPnnyhMHts8cf1qQ6Q1IFwwRvAQGRvBFkWlo3/lH29OXA3Pts+c10nxRxIBrDnoMqzhgdwVe5f2D6OzA==",
+-      "dev": true,
+-      "license": "BSD-2-Clause",
+-      "dependencies": {
+-        "@typescript-eslint/types": "7.18.0",
+-        "@typescript-eslint/visitor-keys": "7.18.0",
+-        "debug": "^4.3.4",
+-        "globby": "^11.1.0",
+-        "is-glob": "^4.0.3",
+-        "minimatch": "^9.0.4",
+-        "semver": "^7.6.0",
+-        "ts-api-utils": "^1.3.0"
+-      },
+-      "engines": {
+-        "node": "^18.18.0 || >=20.0.0"
+-      },
+-      "funding": {
+-        "type": "opencollective",
+-        "url": "https://opencollective.com/typescript-eslint"
+-      },
+-      "peerDependenciesMeta": {
+-        "typescript": {
+-          "optional": true
+-        }
+-      }
+-    },
+-    "node_modules/@vue/eslint-config-typescript/node_modules/@typescript-eslint/visitor-keys": {
+-      "version": "7.18.0",
+-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-7.18.0.tgz",
+-      "integrity": "sha512-cDF0/Gf81QpY3xYyJKDV14Zwdmid5+uuENhjH2EqFaF0ni+yAyq/LzMaIJdhNJXZI7uLzwIlA+V7oWoyn6Curg==",
+-      "dev": true,
+-      "license": "MIT",
+-      "dependencies": {
+-        "@typescript-eslint/types": "7.18.0",
+-        "eslint-visitor-keys": "^3.4.3"
+-      },
+-      "engines": {
+-        "node": "^18.18.0 || >=20.0.0"
+-      },
+-      "funding": {
+-        "type": "opencollective",
+-        "url": "https://opencollective.com/typescript-eslint"
+-      }
+-    },
+-    "node_modules/@vue/eslint-config-typescript/node_modules/brace-expansion": {
+-      "version": "2.0.1",
+-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
+-      "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==",
+-      "dev": true,
+-      "license": "MIT",
+-      "dependencies": {
+-        "balanced-match": "^1.0.0"
+-      }
+-    },
+-    "node_modules/@vue/eslint-config-typescript/node_modules/minimatch": {
+-      "version": "9.0.5",
+-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
+-      "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
+-      "dev": true,
+-      "license": "ISC",
+-      "dependencies": {
+-        "brace-expansion": "^2.0.1"
+-      },
+-      "engines": {
+-        "node": ">=16 || 14 >=14.17"
+-      },
+-      "funding": {
+-        "url": "https://github.com/sponsors/isaacs"
+-      }
+-    },
+-    "node_modules/@vue/eslint-config-typescript/node_modules/semver": {
+-      "version": "7.6.3",
+-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.6.3.tgz",
+-      "integrity": "sha512-oVekP1cKtI+CTDvHWYFUcMtsK/00wmAEfyqKfNdARm8u1wNVhSgaX7A8d4UuIlUI5e84iEwOhs7ZPYRmzU9U6A==",
+-      "dev": true,
+-      "license": "ISC",
+-      "bin": {
+-        "semver": "bin/semver.js"
+-      },
+-      "engines": {
+-        "node": ">=10"
+-      }
+-    },
+     "node_modules/@vue/reactivity": {
+       "version": "3.5.13",
+       "resolved": "https://registry.npmjs.org/@vue/reactivity/-/reactivity-3.5.13.tgz",
 diff --git a/Rnwood.Smtp4dev/ClientApp/package.json b/Rnwood.Smtp4dev/ClientApp/package.json
-index a9e301a..619e55b 100644
+index 46c7a6f..75a3a4a 100644
 --- a/Rnwood.Smtp4dev/ClientApp/package.json
 +++ b/Rnwood.Smtp4dev/ClientApp/package.json
-@@ -19,7 +19,8 @@
+@@ -19,7 +19,7 @@
      "@microsoft/signalr": "^8.0.0",
      "@types/jest": "^29.5.12",
      "@types/sanitize-html": "^2.11.0",
 -    "@typescript-eslint/parser": "^8.0.0",
-+    "@typescript-eslint/eslint-plugin": "^8.31.1",
-+    "@typescript-eslint/parser": "^8.31.1",
++    "@typescript-eslint/parser": "^8.32.1",
      "@vitejs/plugin-vue": "^5.0.4",
      "@vue/eslint-config-typescript": "^13.0.0",
      "@vue/vue3-jest": "^29.2.6",
diff --git a/pkgs/by-name/sp/spacectl/package.nix b/pkgs/by-name/sp/spacectl/package.nix
index 3d945eab6513..24bf98e002c5 100644
--- a/pkgs/by-name/sp/spacectl/package.nix
+++ b/pkgs/by-name/sp/spacectl/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "spacectl";
-  version = "1.15.0";
+  version = "1.15.1";
 
   src = fetchFromGitHub {
     owner = "spacelift-io";
     repo = "spacectl";
     rev = "v${version}";
-    hash = "sha256-nqB39rOHxDge4iopX7BmQpVcpxm2C7e2UMQHNWjfEuY=";
+    hash = "sha256-2cEYo2wWEvKvYyegov7ruaJImCV38xHz/KOrTzDqywQ=";
   };
 
-  vendorHash = "sha256-iyB6GFkTa4ci+TC2mDTtkuqCXFBnz3rwLns+3ovkUxg=";
+  vendorHash = "sha256-jLUqGQJbYAfsCUJ6amnyAuOsjcslSJzD6Barapzzm9Q=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ta/tageditor/package.nix b/pkgs/by-name/ta/tageditor/package.nix
index e781976b018d..49ba340dbb2e 100644
--- a/pkgs/by-name/ta/tageditor/package.nix
+++ b/pkgs/by-name/ta/tageditor/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tageditor";
-  version = "3.9.6";
+  version = "3.9.7";
 
   src = fetchFromGitHub {
     owner = "martchus";
     repo = "tageditor";
     tag = "v${version}";
-    hash = "sha256-weGLC8TPSA9XQ/TuLj4DBswmlEbpxPplsxI4sqygHfU=";
+    hash = "sha256-ETRlyAOCWIz8tioCsGXnmnuTnzWiUOb64vKsPm1hIt0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ta/tagparser/package.nix b/pkgs/by-name/ta/tagparser/package.nix
index 5bd6c959a538..d834998f22f6 100644
--- a/pkgs/by-name/ta/tagparser/package.nix
+++ b/pkgs/by-name/ta/tagparser/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "tagparser";
-  version = "12.5.0";
+  version = "12.5.1";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = "tagparser";
     rev = "v${version}";
-    hash = "sha256-Xu6pvqyBWew3xD0nD5k7QKUOEpDchF1FiuSN7oHfYME=";
+    hash = "sha256-i9WJcdMvPg6Hg6auyPa9dwgtd7Ihte2oPLUImRelO50=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/tl/tlsinfo/package.nix b/pkgs/by-name/tl/tlsinfo/package.nix
index 1f88b9f8cf61..d5ccd084678f 100644
--- a/pkgs/by-name/tl/tlsinfo/package.nix
+++ b/pkgs/by-name/tl/tlsinfo/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "tlsinfo";
-  version = "0.1.48";
+  version = "0.1.49";
 
   src = fetchFromGitHub {
     owner = "paepckehh";
     repo = "tlsinfo";
     tag = "v${version}";
-    hash = "sha256-1483Y1SoAVsXIjpa1CbOvVQsOol6adoQD9PCxHgSgU4=";
+    hash = "sha256-Lp1RTyQMkYSMS+qdr0R8zkBI/68zzltq3F4pjyrKfFo=";
   };
 
-  vendorHash = "sha256-wHCHj7/DBzW0m16aXdQBjPRKjIlf2iab1345ud+ulVQ=";
+  vendorHash = "sha256-RB/EoSRbWPYNFg73+nWuxf7i+kMAUQsJk0KQAZyJgj0=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/tu/tun2proxy/package.nix b/pkgs/by-name/tu/tun2proxy/package.nix
index 01430fabc31f..f14cd2a49d4c 100644
--- a/pkgs/by-name/tu/tun2proxy/package.nix
+++ b/pkgs/by-name/tu/tun2proxy/package.nix
@@ -4,24 +4,26 @@
   fetchCrate,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tun2proxy";
-  version = "0.7.6";
+  version = "0.7.14";
 
   src = fetchCrate {
     pname = "tun2proxy";
-    inherit version;
-    hash = "sha256-hAZZ9pSoIgAb4JYhi9mGHMD4CIjnxVJU00PDsQe6OLY=";
+    inherit (finalAttrs) version;
+    hash = "sha256-rrBlCtimcQJ8487X5wxsWVk20v9UK0+0B6HRdzV5Sj0=";
   };
 
-  cargoHash = "sha256-A/hBV/koIR7gLIZVCoaRk5DI11NZ5HI+xn6qkU+fxaI=";
+  cargoHash = "sha256-73SHsJUvPTvI3kxkpNI2Go11TWyQ8/SckuQBCkWjixA=";
+
+  env.GIT_HASH = "000000000000000000000000000000000000000000000000000";
 
   meta = {
     homepage = "https://github.com/tun2proxy/tun2proxy";
     description = "Tunnel (TUN) interface for SOCKS and HTTP proxies";
-    changelog = "https://github.com/tun2proxy/tun2proxy/releases/tag/v${version}";
+    changelog = "https://github.com/tun2proxy/tun2proxy/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
     mainProgram = "tun2proxy-bin";
     maintainers = with lib.maintainers; [ mksafavi ];
   };
-}
+})
diff --git a/pkgs/by-name/tu/turnon/package.nix b/pkgs/by-name/tu/turnon/package.nix
index 9b7e28c0c4b7..69f4ee1e4974 100644
--- a/pkgs/by-name/tu/turnon/package.nix
+++ b/pkgs/by-name/tu/turnon/package.nix
@@ -1,6 +1,7 @@
 {
   lib,
-  fetchFromGitHub,
+  stdenv,
+  fetchFromGitea,
   rustPlatform,
   cairo,
   pango,
@@ -9,20 +10,25 @@
   blueprint-compiler,
   wrapGAppsHook4,
   gsettings-desktop-schemas,
+  just,
 }:
 
-rustPlatform.buildRustPackage rec {
+let
+  version = "2.7.4";
+in
+rustPlatform.buildRustPackage {
   pname = "turnon";
-  version = "2.6.3";
+  version = version;
 
-  src = fetchFromGitHub {
+  src = fetchFromGitea {
+    domain = "codeberg.org";
     owner = "swsnr";
     repo = "turnon";
     rev = "v${version}";
-    hash = "sha256-fRDyfgS+jLGFJTYIEXJ27cCM9knfbIjlGpYNU4OyoJ0=";
+    hash = "sha256-RTLFajUMJHZoXKhy83G3c7a2fZ+P6CZXadFpbcPFLY8=";
   };
 
-  cargoHash = "sha256-Bg3+PX5/BlqeN3EEFzBX42Dw4BbyKHlN1dnQSHnEz+c=";
+  cargoHash = "sha256-8vqsQPbl3c2++8T5bjDjAWzm00qSDogT1YaumOC7qzk=";
 
   doCheck = true;
 
@@ -39,6 +45,7 @@ rustPlatform.buildRustPackage rec {
     pkg-config
     blueprint-compiler
     wrapGAppsHook4
+    just
   ];
 
   buildInputs = [
@@ -48,20 +55,23 @@ rustPlatform.buildRustPackage rec {
 
   strictDeps = true;
 
-  postInstall =
-    # The build.rs compiles the settings schema and writes the compiled file next to the .xml file.
-    # This copies the compiled file to a path that can be detected by gsettings-desktop-schemas
-    ''
-      mkdir -p "$out/share/glib-2.0/schemas"
-      cp "schemas/gschemas.compiled" "$out/share/glib-2.0/schemas"
-    '';
+  postPatch = ''
+    substituteInPlace justfile \
+        --replace-fail "version := \`git describe\`" "version := \"${version}\"" \
+        --replace-fail "DESTPREFIX := '/app'" "DESTPREFIX := '$out'" \
+        --replace-fail "just --list" "just compile" # Replacing the default recipe with the compile command as just-hook-buildPhase runs the default recipe to compile the package.
+  '';
+
+  postBuild = ''
+    cargo build --release
+  '';
 
   meta = {
     description = "Turn on devices in your local network";
-    homepage = "https://github.com/swsnr/turnon";
-    license = lib.licenses.mpl20;
+    homepage = "https://codeberg.org/swsnr/turnon";
+    license = lib.licenses.eupl12;
     maintainers = with lib.maintainers; [ mksafavi ];
-    mainProgram = "turnon";
+    mainProgram = "de.swsnr.turnon";
     platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index 4022ce0795c3..d4d19e59d36e 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -14,14 +14,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.1-alpha.19";
+  version = "0.0.1-alpha.20";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-CCk6ZrhEFMLYtjNrzp7PBH2W4QFSH1Bqlw+Wh2OPFC4=";
+    hash = "sha256-PxOi4eLWIZeWbh97b6KlZv2u5Y6M022uksN+arAJnF0=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -35,7 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-TNXWRBJInnLiFyf29O8c6ZE7Qhb6sXM0fPRDqMPWSSw=";
+  cargoHash = "sha256-R416MUg5kuib7Yq6EADsgdkeFr0XYZ+bOfvEcs75E+E=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/uw/uwsm/package.nix b/pkgs/by-name/uw/uwsm/package.nix
index 06b270c2ab0c..6900841f575f 100644
--- a/pkgs/by-name/uw/uwsm/package.nix
+++ b/pkgs/by-name/uw/uwsm/package.nix
@@ -28,13 +28,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "uwsm";
-  version = "0.23.2";
+  version = "0.23.3";
 
   src = fetchFromGitHub {
     owner = "Vladimir-csp";
     repo = "uwsm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lKPCtlTfIAb7axthl/PUU82cULafYIhZ5xJolFKSOno=";
+    hash = "sha256-UP9Ztps5oWl0bdXhSlE4SCxHFprUf74DWygJy6GvO4k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ve/venera/package.nix b/pkgs/by-name/ve/venera/package.nix
index bfa13a7b6436..a297044de68d 100644
--- a/pkgs/by-name/ve/venera/package.nix
+++ b/pkgs/by-name/ve/venera/package.nix
@@ -1,27 +1,29 @@
 {
   lib,
-  flutter332,
+  flutter335,
   fetchFromGitHub,
   webkitgtk_4_1,
   copyDesktopItems,
   makeDesktopItem,
   runCommand,
-  venera,
-  yq,
+  yq-go,
   _experimental-update-script-combinators,
   gitUpdater,
 }:
 
-flutter332.buildFlutterApplication rec {
-  pname = "venera";
-  version = "1.4.6";
+let
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "venera-app";
     repo = "venera";
     tag = "v${version}";
-    hash = "sha256-WGzgx+QbAurv9yOJjO40R8t4WtSt/iIkkBuBizT94lQ=";
+    hash = "sha256-5TO68+h49l0KCT99rZ+iXzgZiT7H0H0XeRWjSbrc9yM=";
   };
+in
+flutter335.buildFlutterApplication {
+  pname = "venera";
+  inherit version src;
 
   pubspecLock = lib.importJSON ./pubspec.lock.json;
 
@@ -50,7 +52,7 @@ flutter332.buildFlutterApplication rec {
   ];
 
   postInstall = ''
-    install -Dm0644 debian/gui/venera.png $out/share/pixmaps/venera.png
+    install -D --mode=0644 debian/gui/venera.png $out/share/icons/hicolor/1024x1024/apps/venera.png
   '';
 
   extraWrapProgramArgs = ''
@@ -61,11 +63,11 @@ flutter332.buildFlutterApplication rec {
     pubspecSource =
       runCommand "pubspec.lock.json"
         {
-          buildInputs = [ yq ];
-          inherit (venera) src;
+          inherit src;
+          nativeBuildInputs = [ yq-go ];
         }
         ''
-          cat $src/pubspec.lock | yq > $out
+          yq eval --output-format=json --prettyPrint $src/pubspec.lock > "$out"
         '';
     updateScript = _experimental-update-script-combinators.sequence [
       (gitUpdater { rev-prefix = "v"; })
diff --git a/pkgs/by-name/ve/venera/pubspec.lock.json b/pkgs/by-name/ve/venera/pubspec.lock.json
index b74a0f19e56c..5891ffafb0f0 100644
--- a/pkgs/by-name/ve/venera/pubspec.lock.json
+++ b/pkgs/by-name/ve/venera/pubspec.lock.json
@@ -689,31 +689,31 @@
       "dependency": "transitive",
       "description": {
         "name": "leak_tracker",
-        "sha256": "6bb818ecbdffe216e81182c2f0714a2e62b593f4a4f13098713ff1685dfb6ab0",
+        "sha256": "8dcda04c3fc16c14f48a7bb586d4be1f0d1572731b6d81d51772ef47c02081e0",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "10.0.9"
+      "version": "11.0.1"
     },
     "leak_tracker_flutter_testing": {
       "dependency": "transitive",
       "description": {
         "name": "leak_tracker_flutter_testing",
-        "sha256": "f8b613e7e6a13ec79cfdc0e97638fddb3ab848452eff057653abd3edba760573",
+        "sha256": "1dbc140bb5a23c75ea9c4811222756104fbcd1a27173f0c34ca01e16bea473c1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.0.9"
+      "version": "3.0.10"
     },
     "leak_tracker_testing": {
       "dependency": "transitive",
       "description": {
         "name": "leak_tracker_testing",
-        "sha256": "6ba465d5d76e67ddf503e1161d1f4a6bc42306f9d66ca1e8f079a47290fb06d3",
+        "sha256": "8d5a2d49f4a66b49744b23b018848400d23e54caf9463f4eb20df3eb8acb2eb1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.0.1"
+      "version": "3.0.2"
     },
     "lints": {
       "dependency": "transitive",
@@ -1169,11 +1169,11 @@
       "dependency": "transitive",
       "description": {
         "name": "test_api",
-        "sha256": "fb31f383e2ee25fbbfe06b40fe21e1e458d14080e3c67e7ba0acfde4df4e0bbd",
+        "sha256": "522f00f556e73044315fa4585ec3270f1808a4b186c936e612cab0b565ff1e00",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.7.4"
+      "version": "0.7.6"
     },
     "typed_data": {
       "dependency": "transitive",
@@ -1289,11 +1289,11 @@
       "dependency": "transitive",
       "description": {
         "name": "vector_math",
-        "sha256": "80b3257d1492ce4d091729e3a67a60407d227c27241d6927be0130c98e741803",
+        "sha256": "d530bd74fea330e6e364cda7a85019c434070188383e1cd8d9777ee586914c5b",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.4"
+      "version": "2.2.0"
     },
     "vm_service": {
       "dependency": "transitive",
@@ -1389,6 +1389,6 @@
   },
   "sdks": {
     "dart": ">=3.8.0 <4.0.0",
-    "flutter": ">=3.32.6"
+    "flutter": ">=3.35.2"
   }
 }
diff --git a/pkgs/by-name/vi/vivictpp/package.nix b/pkgs/by-name/vi/vivictpp/package.nix
index 9d18dee80066..2e5709600e93 100644
--- a/pkgs/by-name/vi/vivictpp/package.nix
+++ b/pkgs/by-name/vi/vivictpp/package.nix
@@ -16,18 +16,22 @@
   ffmpeg,
   cacert,
   zlib,
+  writeShellScript,
+  nix-update,
 }:
 
 let
-  version = "1.1.0";
+  version = "1.3.0";
   withSubprojects = stdenv.mkDerivation {
-    name = "sources-with-subprojects";
+    pname = "sources-with-subprojects";
+    inherit version;
 
     src = fetchFromGitHub {
       owner = "vivictorg";
       repo = "vivictpp";
-      rev = "v${version}";
-      hash = "sha256-ScuCOmcK714YXEHncizwj6EWdiNIJA1xRMn5gfmg4K4=";
+      tag = "v${version}";
+      fetchSubmodules = true;
+      hash = "sha256-yzUgLZbqEzyJINWQUTC/j33XbjSXP1vpDlgiKv6Jx9Q=";
     };
 
     nativeBuildInputs = [
@@ -45,7 +49,7 @@ let
     '';
 
     outputHashMode = "recursive";
-    outputHash = "sha256-/6nuTKjQEXfJlHkTkeX/A4PeGb8SOk6Q801gjx1SB6M=";
+    outputHash = "sha256-PtOb47QOffGje1U8Tle9AQon7ZCgMp/lITPAfM9/wr4=";
   };
 in
 stdenv.mkDerivation {
@@ -78,12 +82,17 @@ stdenv.mkDerivation {
     patchShebangs .
   '';
 
-  meta = with lib; {
+  passthru.updateScript = writeShellScript "update-vivictpp" ''
+    ${lib.getExe nix-update} vivictpp.src
+    ${lib.getExe nix-update} vivictpp --version skip
+  '';
+
+  meta = {
     description = "Easy to use tool for subjective comparison of the visual quality of different encodings of the same video source";
     homepage = "https://github.com/vivictorg/vivictpp";
-    license = licenses.gpl2Plus;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [ tilpner ];
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ tilpner ];
     mainProgram = "vivictpp";
   };
 }
diff --git a/pkgs/by-name/vu/vulnix/package.nix b/pkgs/by-name/vu/vulnix/package.nix
index e676c525b2fc..0b53d2c6e3a9 100644
--- a/pkgs/by-name/vu/vulnix/package.nix
+++ b/pkgs/by-name/vu/vulnix/package.nix
@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "vulnix";
-  version = "1.12.0";
+  version = "1.12.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "vulnix";
     tag = version;
-    hash = "sha256-Z13YbGpXnOZByweGhsdmNwpYelcd96/jlWyvnsmn7tM=";
+    hash = "sha256-Nxhv3K/wF7AYi5kTJxL2pjiDWgWN+27wKsMXf0yaXrk=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/by-name/vu/vultr-cli/package.nix b/pkgs/by-name/vu/vultr-cli/package.nix
index 5d342f6c84f3..522e015028a4 100644
--- a/pkgs/by-name/vu/vultr-cli/package.nix
+++ b/pkgs/by-name/vu/vultr-cli/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "vultr-cli";
-  version = "3.6.0";
+  version = "3.7.0";
 
   src = fetchFromGitHub {
     owner = "vultr";
     repo = "vultr-cli";
     rev = "v${version}";
-    hash = "sha256-ljFtla6aWrrQACIzKqbxW0Naf+iArqO3kpbjOfu3RDU=";
+    hash = "sha256-qBl3fduyPKw+R6X5EguVGUkKKGD+XbJH30CdRroEV4M=";
   };
 
-  vendorHash = "sha256-OoXsKBzNK6DtuA0yc21IAty8p0uv043BYMX3oT/5QN8=";
+  vendorHash = "sha256-JrIJ/8l+TWXEdFtrnS1fCEyEb89/nixjr3Y7/R+iqBI=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/we/werf/package.nix b/pkgs/by-name/we/werf/package.nix
index dde28c787c1e..ec0177690ac3 100644
--- a/pkgs/by-name/we/werf/package.nix
+++ b/pkgs/by-name/we/werf/package.nix
@@ -10,13 +10,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "werf";
-  version = "2.47.2";
+  version = "2.47.4";
 
   src = fetchFromGitHub {
     owner = "werf";
     repo = "werf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Dzd5Bo2583J1A08uOMUhApqiSQUlQ1gDh8lmUi8vft0=";
+    hash = "sha256-V/RwHwPp1THlzFdMts5qt4Ueqcoxx932eMqgF6yiZpM=";
   };
 
   proxyVendor = true;
diff --git a/pkgs/by-name/yu/yubikey-manager/package.nix b/pkgs/by-name/yu/yubikey-manager/package.nix
index ce4c65a21b33..ad133173372f 100644
--- a/pkgs/by-name/yu/yubikey-manager/package.nix
+++ b/pkgs/by-name/yu/yubikey-manager/package.nix
@@ -9,27 +9,30 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "yubikey-manager";
-  version = "5.7.2";
+  version = "5.8.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Yubico";
     repo = "yubikey-manager";
     tag = version;
-    hash = "sha256-dgOi9gJ7jO3+EjZQjHfx+KDsBtj6b4JWR3Bp9xWM6FI=";
+    hash = "sha256-Z3krdKP6hhhIxN7nl/k5r30jFVC0kZK9Z6Aqllp/KrA=";
   };
 
   postPatch = ''
     substituteInPlace "ykman/pcsc/__init__.py" \
-      --replace 'pkill' '${if stdenv.hostPlatform.isLinux then procps else "/usr"}/bin/pkill'
+      --replace-fail 'pkill' '${if stdenv.hostPlatform.isLinux then procps else "/usr"}/bin/pkill'
   '';
 
-  nativeBuildInputs = with python3Packages; [
-    poetry-core
+  nativeBuildInputs = [
     installShellFiles
   ];
 
-  propagatedBuildInputs = with python3Packages; [
+  build-system = with python3Packages; [
+    poetry-core
+  ];
+
+  dependencies = with python3Packages; [
     cryptography
     pyscard
     fido2
@@ -37,10 +40,6 @@ python3Packages.buildPythonPackage rec {
     keyring
   ];
 
-  pythonRelaxDeps = [
-    "keyring"
-  ];
-
   postInstall = ''
     installManPage man/ykman.1
 
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 953b31155e5a..9fbe74288ee4 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -112,7 +112,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4cP6cohUZdhvr6mvIOozhg1ahEZEypCCjvAz0fjAtec=";
+    hash = "sha256-Q7Ord+GJJcOCH/S3qNwAbzILqQiIC94qb8V+JkzQqaQ=";
   };
 
   patches = [
diff --git a/pkgs/by-name/zu/zulip/package.nix b/pkgs/by-name/zu/zulip/package.nix
index 0ed9a5429972..c3cc29806fc9 100644
--- a/pkgs/by-name/zu/zulip/package.nix
+++ b/pkgs/by-name/zu/zulip/package.nix
@@ -11,16 +11,16 @@
 
 buildNpmPackage rec {
   pname = "zulip";
-  version = "5.12.1";
+  version = "5.12.2";
 
   src = fetchFromGitHub {
     owner = "zulip";
     repo = "zulip-desktop";
     tag = "v${version}";
-    hash = "sha256-YuiPf/ciSm0nBlF8U55EkPSTz+RI148QKOFv6FmYRD0=";
+    hash = "sha256-+OS3Fw4Z1ZOzXou1sK39AUFLI78nUl4UBVYA3SNH7I0=";
   };
 
-  npmDepsHash = "sha256-RNXhDV0b1FZglIS5UsTn6YboJ4Au1/CZVtRz1BvcP2E=";
+  npmDepsHash = "sha256-5qjBZfl9kse97y5Mru4RF4RLTbojoXeUp84I/bOHEcw=";
   makeCacheWritable = true;
 
   env = {
diff --git a/pkgs/desktops/lomiri/development/cmake-extras/default.nix b/pkgs/desktops/lomiri/development/cmake-extras/default.nix
index eae5e2c3b163..16b1d5580201 100644
--- a/pkgs/desktops/lomiri/development/cmake-extras/default.nix
+++ b/pkgs/desktops/lomiri/development/cmake-extras/default.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cmake-extras";
-  version = "1.8";
+  version = "1.9";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/core/cmake-extras";
     tag = finalAttrs.version;
-    hash = "sha256-4KPk8GrpmrrwN6epmzGVh0fCBgP765xR3Im5mMmE9vw=";
+    hash = "sha256-7dIuQ2SdtpG93cPZTmoxXUCwFhsq11gmg4OJlGTQ3VY=";
   };
 
   postPatch = ''
diff --git a/pkgs/desktops/pantheon/apps/elementary-music/default.nix b/pkgs/desktops/pantheon/apps/elementary-music/default.nix
index 071c2dd9737c..dbd86217c587 100644
--- a/pkgs/desktops/pantheon/apps/elementary-music/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-music/default.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-music";
-  version = "8.0.0";
+  version = "8.1.0";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "music";
     rev = version;
-    sha256 = "sha256-pqOAeHTFWSoJqXE9UCUkVIy5T7EoYsieJ4PMU1oX9ko=";
+    sha256 = "sha256-ALAQh+iFhRhAMCwYDM0Bcww1K/xJ/AajZu/52baI3gQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/compilers/crystal/default.nix b/pkgs/development/compilers/crystal/default.nix
index 43b9dd87d97c..3a575396c71b 100644
--- a/pkgs/development/compilers/crystal/default.nix
+++ b/pkgs/development/compilers/crystal/default.nix
@@ -328,5 +328,13 @@ rec {
     doCheck = false;
   };
 
+  crystal_1_17 = generic {
+    version = "1.17.1";
+    sha256 = "sha256-+wHhozPhpIsfQy1Lw+V48zvuWCfXzT4IC9KA1AU/DLw=";
+    binary = binaryCrystal_1_10;
+    llvmPackages = llvmPackages_18;
+    doCheck = false;
+  };
+
   crystal = crystal_1_16;
 }
diff --git a/pkgs/development/compilers/swift/compiler/default.nix b/pkgs/development/compilers/swift/compiler/default.nix
index d8089b22e44f..5de54078f519 100644
--- a/pkgs/development/compilers/swift/compiler/default.nix
+++ b/pkgs/development/compilers/swift/compiler/default.nix
@@ -111,6 +111,18 @@ let
     "swift-remote-mirror-headers"
   ];
 
+  clangForWrappers = clang.override (prev: {
+    extraBuildCommands =
+      prev.extraBuildCommands
+      # We need to use the resource directory corresponding to Swift’s
+      # version of Clang instead of passing along the one from the
+      # `cc-wrapper` flags.
+      + ''
+        substituteInPlace $out/nix-support/cc-cflags \
+          --replace-fail " -resource-dir=$out/resource-root" ""
+      '';
+  });
+
   # Build a tool used during the build to create a custom clang wrapper, with
   # which we wrap the clang produced by the swift build.
   #
@@ -130,11 +142,14 @@ let
     unwrappedClang="$targetFile-unwrapped"
 
     mv "$targetFile" "$unwrappedClang"
-    sed < '${clang}/bin/clang' > "$targetFile" \
+    sed < '${clangForWrappers}/bin/clang' > "$targetFile" \
       -e 's|^\s*exec|exec -a "$0"|g' \
       -e 's|^\[\[ "${clang.cc}/bin/clang" = \*++ ]]|[[ "$0" = *++ ]]|' \
       -e "s|${clang.cc}/bin/clang|$unwrappedClang|g" \
-      -e "s|^\(\s*\)\($unwrappedClang\) \"@\\\$responseFile\"|\1argv0=\$0\n\1${bash}/bin/bash -c \"exec -a '\$argv0' \2 '@\$responseFile'\"|"
+      -e "s|^\(\s*\)\($unwrappedClang\) \"@\\\$responseFile\"|\1argv0=\$0\n\1${bash}/bin/bash -c \"exec -a '\$argv0' \2 '@\$responseFile'\"|" \
+    ${lib.optionalString (clang.libcxx != null) ''
+      -e 's|$NIX_CXXSTDLIB_COMPILE_${clang.suffixSalt}|-isystem '$SWIFT_BUILD_ROOT'/libcxx/include/c++/v1|g'
+    ''}
     chmod a+x "$targetFile"
   '';
 
@@ -146,13 +161,12 @@ let
   # executable uses $0 to detect what tool is called.
   wrapperParams = {
     inherit bintools;
-    default_cc_wrapper = clang; # Instead of `@out@` in the original.
     coreutils_bin = lib.getBin coreutils;
     gnugrep_bin = gnugrep;
     suffixSalt = lib.replaceStrings [ "-" "." ] [ "_" "_" ] targetPlatform.config;
     use_response_file_by_default = 1;
     swiftDriver = "";
-    # NOTE: @prog@ needs to be filled elsewhere.
+    # NOTE: @cc_wrapper@ and @prog@ need to be filled elsewhere.
   };
   swiftWrapper = runCommand "swift-wrapper.sh" wrapperParams ''
     # Make empty to avoid adding the SDK’s modules in the bootstrap wrapper. Otherwise, the SDK conflicts with the
@@ -168,7 +182,11 @@ let
     mv "$targetFile" "$unwrappedSwift"
     sed < '${swiftWrapper}' > "$targetFile" \
       -e "s|@prog@|'$unwrappedSwift'|g" \
-      -e 's|exec "$prog"|exec -a "$0" "$prog"|g'
+      -e 's|@cc_wrapper@|${clangForWrappers}|g' \
+      -e 's|exec "$prog"|exec -a "$0" "$prog"|g' \
+    ${lib.optionalString (clang.libcxx != null) ''
+      -e 's|$NIX_CXXSTDLIB_COMPILE_${clang.suffixSalt}|-isystem '$SWIFT_BUILD_ROOT'/libcxx/include/c++/v1|g'
+    ''}
     chmod a+x "$targetFile"
   '';
 
@@ -308,10 +326,12 @@ stdenv.mkDerivation {
 
      patch -p1 -d swift -i ${./patches/swift-cmake-3.25-compat.patch}
      patch -p1 -d swift -i ${./patches/swift-wrap.patch}
-     patch -p1 -d swift -i ${./patches/swift-nix-resource-root.patch}
      patch -p1 -d swift -i ${./patches/swift-linux-fix-libc-paths.patch}
-     patch -p1 -d swift -i ${./patches/swift-linux-fix-linking.patch}
-     patch -p1 -d swift -i ${./patches/swift-darwin-libcxx-flags.patch}
+     patch -p1 -d swift -i ${
+       replaceVars ./patches/swift-linux-fix-linking.patch {
+         inherit clang;
+       }
+     }
      patch -p1 -d swift -i ${
        replaceVars ./patches/swift-darwin-plistbuddy-workaround.patch {
          inherit swiftArch;
@@ -354,6 +374,19 @@ stdenv.mkDerivation {
            stripLen = 1;
            hash = "sha256-u0zSejEjfrH3ZoMFm1j+NVv2t5AP9cE5yhsrdTS1dG4=";
          })
+
+         # Fix the build with modern libc++.
+         (fetchpatch {
+           name = "add-cstdio.patch";
+           url = "https://github.com/llvm/llvm-project/commit/73e15b5edb4fa4a77e68c299a6e3b21e610d351f.patch";
+           stripLen = 1;
+           hash = "sha256-eFcvxZaAuBsY/bda1h9212QevrXyvCHw8Cr9ngetDr0=";
+         })
+         (fetchpatch {
+           url = "https://github.com/llvm/llvm-project/commit/68744ffbdd7daac41da274eef9ac0d191e11c16d.patch";
+           stripLen = 1;
+           hash = "sha256-QCGhsL/mi7610ZNb5SqxjRGjwJeK2rwtsFVGeG3PUGc=";
+         })
        ]
      }; do
        patch -p1 -d llvm-project/lldb -i $lldbPatch
@@ -361,7 +394,7 @@ stdenv.mkDerivation {
 
      patch -p1 -d llvm-project/clang -i ${./patches/clang-toolchain-dir.patch}
      patch -p1 -d llvm-project/clang -i ${./patches/clang-wrap.patch}
-     patch -p1 -d llvm-project/clang -i ${../../llvm/12/clang/purity.patch}
+     patch -p1 -d llvm-project/clang -i ${./patches/clang-purity.patch}
      patch -p2 -d llvm-project/clang -i ${
        fetchpatch {
          name = "clang-cmake-fix-interpreter.patch";
@@ -419,6 +452,14 @@ stdenv.mkDerivation {
      patchShebangs .
 
      ${lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
+       patch -p1 -d swift-corelibs-libdispatch -i ${
+         # Fix the build with modern Clang.
+         fetchpatch {
+           url = "https://github.com/swiftlang/swift-corelibs-libdispatch/commit/30bb8019ba79cdae0eb1dc0c967c17996dd5cc0a.patch";
+           hash = "sha256-wPZQ4wtEWk8HaKMfzjamlU6p/IW5EFiTssY63rGM+ZA=";
+         }
+       }
+
        # NOTE: This interferes with ABI stability on Darwin, which uses the system
        # libraries in the hardcoded path /usr/lib/swift.
        fixCmakeFiles .
@@ -426,7 +467,11 @@ stdenv.mkDerivation {
   '';
 
   # > clang-15-unwrapped: error: unsupported option '-fzero-call-used-regs=used-gpr' for target 'arm64-apple-macosx10.9.0'
-  hardeningDisable = lib.optional stdenv.hostPlatform.isAarch64 "zerocallusedregs";
+  # > clang-15-unwrapped: error: argument unused during compilation: '-fstack-clash-protection' [-Werror,-Wunused-command-line-argument]
+  hardeningDisable = lib.optionals stdenv.hostPlatform.isAarch64 [
+    "zerocallusedregs"
+    "stackclashprotection"
+  ];
 
   configurePhase = ''
     export SWIFT_SOURCE_ROOT="$PWD"
@@ -469,6 +514,19 @@ stdenv.mkDerivation {
     cmakeFlags="-GNinja"
     buildProject swift-cmark
 
+    ${lib.optionalString (clang.libcxx != null) ''
+      # Install the libc++ headers corresponding to the LLVM version of
+      # Swift’s Clang.
+      cmakeFlags="
+        -GNinja
+        -DLLVM_ENABLE_RUNTIMES=libcxx;libcxxabi
+        -DLIBCXXABI_INSTALL_INCLUDE_DIR=$dev/include/c++/v1
+      "
+      ninjaFlags="install-cxx-headers install-cxxabi-headers"
+      buildProject libcxx llvm-project/runtimes
+      unset ninjaFlags
+    ''}
+
     # Some notes:
     # - The Swift build just needs Clang.
     # - We can further reduce targets to just our targetPlatform.
@@ -486,6 +544,10 @@ stdenv.mkDerivation {
     "
     buildProject llvm llvm-project/llvm
 
+    # Ensure that the built Clang can find the runtime libraries by
+    # copying the symlinks from the main wrapper.
+    cp -P ${clang}/resource-root/{lib,share} $SWIFT_BUILD_ROOT/llvm/lib/clang/15.0.0/
+
   ''
   + lib.optionalString stdenv.hostPlatform.isDarwin ''
     # Add appleSwiftCore to the search paths. Adding the whole SDK results in build failures.
@@ -658,7 +720,7 @@ stdenv.mkDerivation {
     mv llvm/bin/clang-15{-unwrapped,}
     mv swift/bin/swift-frontend{-unwrapped,}
 
-    mkdir $out $lib
+    mkdir $lib
 
     # Install clang binaries only. We hide these with the wrapper, so they are
     # for private use by Swift only.
@@ -693,14 +755,8 @@ stdenv.mkDerivation {
     ln -s $lib/lib/swift $out/lib/swift
 
     # Swift has a separate resource root from Clang, but locates the Clang
-    # resource root via subdir or symlink. Provide a default here, but we also
-    # patch Swift to prefer NIX_CC if set.
-    #
-    # NOTE: We don't symlink directly here, because that'd add a run-time dep
-    # on the full Clang compiler to every Swift executable. The copy here is
-    # just copying the 3 symlinks inside to smaller closures.
-    mkdir $lib/lib/swift/clang
-    cp -P ${clang}/resource-root/* $lib/lib/swift/clang/
+    # resource root via subdir or symlink.
+    mv $SWIFT_BUILD_ROOT/llvm/lib/clang/15.0.0 $lib/lib/swift/clang
   '';
 
   preFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
@@ -756,6 +812,10 @@ stdenv.mkDerivation {
       swiftStaticLibSubdir
       ;
 
+    tests = {
+      cxx-interop-test = callPackage ../cxx-interop-test { };
+    };
+
     # Internal attr for the wrapper.
     _wrapperParams = wrapperParams;
   };
diff --git a/pkgs/development/compilers/swift/compiler/patches/clang-purity.patch b/pkgs/development/compilers/swift/compiler/patches/clang-purity.patch
new file mode 100644
index 000000000000..deb230a36c5b
--- /dev/null
+++ b/pkgs/development/compilers/swift/compiler/patches/clang-purity.patch
@@ -0,0 +1,28 @@
+From 4add81bba40dcec62c4ea4481be8e35ac53e89d8 Mon Sep 17 00:00:00 2001
+From: Will Dietz <w@wdtz.org>
+Date: Thu, 18 May 2017 11:56:12 -0500
+Subject: [PATCH] "purity" patch for 5.0
+
+---
+ lib/Driver/ToolChains/Gnu.cpp | 7 -------
+ 1 file changed, 7 deletions(-)
+
+diff --git a/lib/Driver/ToolChains/Gnu.cpp b/lib/Driver/ToolChains/Gnu.cpp
+index fe3c0191bb..c6a482bece 100644
+--- a/lib/Driver/ToolChains/Gnu.cpp
++++ b/lib/Driver/ToolChains/Gnu.cpp
+@@ -487,12 +487,6 @@ void tools::gnutools::Linker::ConstructJob(Compilation &C, const JobAction &JA,
+   if (!IsStatic) {
+     if (Args.hasArg(options::OPT_rdynamic))
+       CmdArgs.push_back("-export-dynamic");
+-
+-    if (!Args.hasArg(options::OPT_shared) && !IsStaticPIE) {
+-      CmdArgs.push_back("-dynamic-linker");
+-      CmdArgs.push_back(Args.MakeArgString(Twine(D.DyldPrefix) +
+-                                           ToolChain.getDynamicLinker(Args)));
+-    }
+   }
+ 
+   CmdArgs.push_back("-o");
+-- 
+2.11.0
diff --git a/pkgs/development/compilers/swift/compiler/patches/swift-darwin-libcxx-flags.patch b/pkgs/development/compilers/swift/compiler/patches/swift-darwin-libcxx-flags.patch
deleted file mode 100644
index c2b5adafa592..000000000000
--- a/pkgs/development/compilers/swift/compiler/patches/swift-darwin-libcxx-flags.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-On Darwin, the SDK is a directory of stubs, and libc++ lives separately. We
-need to patch the CMake files in several places to make the build for C++
-interop succeed. The required flags can be read from cc-wrapper support files.
-
---- a/SwiftCompilerSources/CMakeLists.txt
-+++ b/SwiftCompilerSources/CMakeLists.txt
-@@ -105,18 +105,11 @@ function(add_swift_compiler_modules_library name)
-       get_filename_component(swift_exec_bin_dir ${ALS_SWIFT_EXEC} DIRECTORY)
-       set(sdk_option ${sdk_option} "-resource-dir" "${swift_exec_bin_dir}/../bootstrapping0/lib/swift")
-     endif()
--    if(NOT EXISTS "${sdk_path}/usr/include/c++")
--      # Darwin SDKs in Xcode 12 or older do not include libc++, which prevents clang from finding libc++ when invoked
--      # from ClangImporter. This results in build errors. To workaround this, let's explicitly pass the path to libc++
--      # to clang.
--      message(WARNING "Building with an outdated Darwin SDK: libc++ missing from the ${SWIFT_HOST_VARIANT_SDK} SDK. Will use libc++ from the toolchain.")
--      get_filename_component(absolute_libcxx_path "${CMAKE_C_COMPILER}/../../include/c++/v1" REALPATH)
--      if (EXISTS "${absolute_libcxx_path}")
--        set(sdk_option ${sdk_option} "-Xcc" "-isystem" "-Xcc" "${absolute_libcxx_path}")
--      else()
--        message(ERROR "libc++ not found in the toolchain.")
--      endif()
--    endif()
-+    file(READ "$ENV{NIX_CC}/nix-support/libcxx-cxxflags" nix_libcxx_cxxflags)
-+    separate_arguments(nix_libcxx_cxxflags)
-+    foreach(nix_libcxx_cxxflag ${nix_libcxx_cxxflags})
-+      set(sdk_option ${sdk_option} "-Xcc" "${nix_libcxx_cxxflag}")
-+    endforeach()
-   elseif(BOOTSTRAPPING_MODE STREQUAL "CROSSCOMPILE")
-     set(sdk_option "-sdk" "${SWIFT_SDK_${SWIFT_HOST_VARIANT_SDK}_ARCH_${SWIFT_HOST_VARIANT_ARCH}_PATH}")
-     get_filename_component(swift_exec_bin_dir ${ALS_SWIFT_EXEC} DIRECTORY)
---- a/cmake/modules/SwiftConfigureSDK.cmake
-+++ b/cmake/modules/SwiftConfigureSDK.cmake
-@@ -270,6 +270,18 @@ macro(configure_sdk_darwin
-   # Add this to the list of known SDKs.
-   list(APPEND SWIFT_CONFIGURED_SDKS "${prefix}")
- 
-+  set(cxx_overlay_opt "")
-+  if("${prefix}" STREQUAL "OSX")
-+    file(READ "$ENV{NIX_CC}/nix-support/libcxx-cxxflags" nix_libcxx_cxxflags)
-+    separate_arguments(nix_libcxx_cxxflags)
-+    foreach(nix_libcxx_cxxflag ${nix_libcxx_cxxflags})
-+      set(cxx_overlay_opt ${cxx_overlay_opt} "-Xcc" "${nix_libcxx_cxxflag}")
-+    endforeach()
-+  endif()
-+  set(SWIFT_SDK_${prefix}_CXX_OVERLAY_SWIFT_COMPILE_FLAGS
-+      ${cxx_overlay_opt}
-+    CACHE STRING "Extra flags for compiling the C++ overlay")
-+
-   _report_sdk("${prefix}")
- endmacro()
- 
---- a/stdlib/public/Cxx/std/CMakeLists.txt
-+++ b/stdlib/public/Cxx/std/CMakeLists.txt
-@@ -145,6 +145,9 @@ add_swift_target_library(swiftstd STATIC NO_LINK_NAME IS_STDLIB
-     SWIFT_COMPILE_FLAGS_LINUX
-     ${SWIFT_SDK_LINUX_CXX_OVERLAY_SWIFT_COMPILE_FLAGS}
- 
-+    SWIFT_COMPILE_FLAGS_OSX
-+    ${SWIFT_SDK_OSX_CXX_OVERLAY_SWIFT_COMPILE_FLAGS}
-+
-     LINK_FLAGS "${SWIFT_RUNTIME_SWIFT_LINK_FLAGS}"
-     TARGET_SDKS ALL_APPLE_PLATFORMS LINUX
-     INSTALL_IN_COMPONENT compiler
diff --git a/pkgs/development/compilers/swift/compiler/patches/swift-linux-fix-linking.patch b/pkgs/development/compilers/swift/compiler/patches/swift-linux-fix-linking.patch
index e09d5162a93a..c10b4038a9c4 100644
--- a/pkgs/development/compilers/swift/compiler/patches/swift-linux-fix-linking.patch
+++ b/pkgs/development/compilers/swift/compiler/patches/swift-linux-fix-linking.patch
@@ -1,21 +1,17 @@
+diff --git a/lib/Driver/ToolChains.cpp b/lib/Driver/ToolChains.cpp
+index c0ee9217e8..bf7737d6fa 100644
 --- a/lib/Driver/ToolChains.cpp
 +++ b/lib/Driver/ToolChains.cpp
-@@ -1475,7 +1475,17 @@ const char *ToolChain::getClangLinkerDriver(
- 
-     // If there is a linker driver in the toolchain folder, use that instead.
-     if (auto tool = llvm::sys::findProgramByName(LinkerDriver, {toolchainPath}))
--      LinkerDriver = Args.MakeArgString(tool.get());
-+      return Args.MakeArgString(tool.get());
-+  }
-+
-+  // For Nix, prefer linking using the wrapped system clang, instead of using
-+  // the unwrapped clang packaged with swift. The latter is unable to link, but
-+  // we still want to use it for other purposes (clang importer).
-+  if (auto nixCC = llvm::sys::Process::GetEnv("NIX_CC")) {
-+    llvm::SmallString<128> binDir(nixCC.getValue());
-+    llvm::sys::path::append(binDir, "bin");
-+    if (auto tool = llvm::sys::findProgramByName(LinkerDriver, {binDir.str()}))
-+      return Args.MakeArgString(tool.get());
+@@ -1489,6 +1489,12 @@
+       LinkerDriver = Args.MakeArgString(tool.get());
    }
  
++  // For Nix, prefer linking using the wrapped Nixpkgs clang, instead of using
++  // the unwrapped clang packaged with swift. The latter is unable to link, but
++  // we still want to use it for other purposes (clang importer).
++  if (auto tool = llvm::sys::findProgramByName(LinkerDriver, {"@clang@/bin"}))
++    return Args.MakeArgString(tool.get());
++
    return LinkerDriver;
+ }
+ 
diff --git a/pkgs/development/compilers/swift/compiler/patches/swift-nix-resource-root.patch b/pkgs/development/compilers/swift/compiler/patches/swift-nix-resource-root.patch
deleted file mode 100644
index b67286a5d1c3..000000000000
--- a/pkgs/development/compilers/swift/compiler/patches/swift-nix-resource-root.patch
+++ /dev/null
@@ -1,67 +0,0 @@
-Swift normally looks for the Clang resource dir in a subdir/symlink of its own
-resource dir. We provide a symlink to the Swift build-time Clang as a default
-there, but we also here patch two checks to try locate it via NIX_CC.
-
-The first (ClangImporter.cpp) happens when Swift code imports C modules. The
-second (ToolChains.cpp) happens when Swift is used to link the final product.
-
---- a/lib/ClangImporter/ClangImporter.cpp
-+++ b/lib/ClangImporter/ClangImporter.cpp
-@@ -73,6 +73,7 @@
- #include "llvm/Support/FileSystem.h"
- #include "llvm/Support/Memory.h"
- #include "llvm/Support/Path.h"
-+#include "llvm/Support/Process.h"
- #include "llvm/Support/VirtualFileSystem.h"
- #include "llvm/Support/YAMLParser.h"
- #include <algorithm>
-@@ -786,6 +787,17 @@ importer::addCommonInvocationArguments(
- 
-   const std::string &overrideResourceDir = importerOpts.OverrideResourceDir;
-   if (overrideResourceDir.empty()) {
-+    // Prefer the Clang resource directory from NIX_CC, to allow swapping in a
-+    // different stdenv.
-+    // TODO: Figure out how to provide a user override for this. Probably a
-+    // niche use case, though, and for now a user can unset NIX_CC to work
-+    // around it if necessary.
-+    if (auto nixCC = llvm::sys::Process::GetEnv("NIX_CC")) {
-+      llvm::SmallString<128> resourceDir(nixCC.getValue());
-+      llvm::sys::path::append(resourceDir, "resource-root");
-+      invocationArgStrs.push_back("-resource-dir");
-+      invocationArgStrs.push_back(std::string(resourceDir.str()));
-+    } else {
-     llvm::SmallString<128> resourceDir(searchPathOpts.RuntimeResourcePath);
- 
-     // Adjust the path to refer to our copy of the Clang resource directory
-@@ -801,6 +813,7 @@ importer::addCommonInvocationArguments(
-     // Set the Clang resource directory to the path we computed.
-     invocationArgStrs.push_back("-resource-dir");
-     invocationArgStrs.push_back(std::string(resourceDir.str()));
-+    } // nixCC
-   } else {
-     invocationArgStrs.push_back("-resource-dir");
-     invocationArgStrs.push_back(overrideResourceDir);
---- a/lib/Driver/ToolChains.cpp
-+++ b/lib/Driver/ToolChains.cpp
-@@ -1393,10 +1393,20 @@ void ToolChain::getClangLibraryPath(const ArgList &Args,
-                                     SmallString<128> &LibPath) const {
-   const llvm::Triple &T = getTriple();
- 
-+  // Nix: We provide a `clang` symlink in the default Swift resource root, but
-+  // prefer detecting the Clang resource root via NIX_CC, to allow swapping in
-+  // a different stdenv. However, always honor a user-provided `-resource-dir`.
-+  auto nixCC = llvm::sys::Process::GetEnv("NIX_CC");
-+  if (nixCC && !Args.hasArgNoClaim(options::OPT_resource_dir)) {
-+    LibPath.assign(nixCC.getValue());
-+    llvm::sys::path::append(LibPath, "resource-root");
-+  } else {
-   getResourceDirPath(LibPath, Args, /*Shared=*/true);
-   // Remove platform name.
-   llvm::sys::path::remove_filename(LibPath);
--  llvm::sys::path::append(LibPath, "clang", "lib",
-+  llvm::sys::path::append(LibPath, "clang");
-+  } // nixCC
-+  llvm::sys::path::append(LibPath, "lib",
-                           T.isOSDarwin() ? "darwin"
-                                          : getPlatformNameForTriple(T));
- }
diff --git a/pkgs/development/compilers/swift/cxx-interop-test/default.nix b/pkgs/development/compilers/swift/cxx-interop-test/default.nix
new file mode 100644
index 000000000000..12640750d622
--- /dev/null
+++ b/pkgs/development/compilers/swift/cxx-interop-test/default.nix
@@ -0,0 +1,57 @@
+{
+  lib,
+  stdenv,
+  swift,
+  swiftpm,
+  swiftPackages,
+}:
+
+swiftPackages.stdenv.mkDerivation (finalAttrs: {
+  name = "swift-cxx-interop-test";
+
+  src = ./src;
+
+  nativeBuildInputs = [
+    swift
+    swiftpm
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    binPath="$(swiftpmBinPath)"
+    mkdir -p -- "$out/bin"
+    cp -- "$binPath/${finalAttrs.meta.mainProgram}" "$out/bin"
+
+    runHook postInstall
+  '';
+
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    "$out/bin/${finalAttrs.meta.mainProgram}" | grep 'Hello, world!'
+
+    runHook postInstallCheck
+  '';
+
+  doInstallCheck = true;
+
+  env = {
+    # Gross hack copied from `protoc-gen-swift` :(
+    LD_LIBRARY_PATH = lib.optionalString stdenv.hostPlatform.isLinux (
+      lib.makeLibraryPath [
+        swiftPackages.Dispatch
+      ]
+    );
+  };
+
+  meta = {
+    inherit (swift.meta)
+      team
+      platforms
+      badPlatforms
+      ;
+    license = lib.licenses.mit;
+    mainProgram = "CxxInteropTest";
+  };
+})
diff --git a/pkgs/development/compilers/swift/cxx-interop-test/src/.gitignore b/pkgs/development/compilers/swift/cxx-interop-test/src/.gitignore
new file mode 100644
index 000000000000..3b29812086f2
--- /dev/null
+++ b/pkgs/development/compilers/swift/cxx-interop-test/src/.gitignore
@@ -0,0 +1,9 @@
+.DS_Store
+/.build
+/Packages
+/*.xcodeproj
+xcuserdata/
+DerivedData/
+.swiftpm/config/registries.json
+.swiftpm/xcode/package.xcworkspace/contents.xcworkspacedata
+.netrc
diff --git a/pkgs/development/compilers/swift/cxx-interop-test/src/Package.swift b/pkgs/development/compilers/swift/cxx-interop-test/src/Package.swift
new file mode 100644
index 000000000000..e11bf47989ba
--- /dev/null
+++ b/pkgs/development/compilers/swift/cxx-interop-test/src/Package.swift
@@ -0,0 +1,16 @@
+// swift-tools-version: 5.8
+
+import PackageDescription
+
+let package = Package(
+    name: "CxxInteropTest",
+    targets: [
+        .executableTarget(
+            name: "CxxInteropTest",
+            path: "Sources",
+            swiftSettings: [
+                .unsafeFlags(["-enable-experimental-cxx-interop"])
+            ]
+        )
+    ]
+)
diff --git a/pkgs/development/compilers/swift/cxx-interop-test/src/Sources/main.swift b/pkgs/development/compilers/swift/cxx-interop-test/src/Sources/main.swift
new file mode 100644
index 000000000000..c4ea568704ff
--- /dev/null
+++ b/pkgs/development/compilers/swift/cxx-interop-test/src/Sources/main.swift
@@ -0,0 +1,3 @@
+import CxxStdlib
+
+print(String(cxxString: std.string("Hello, world!")))
diff --git a/pkgs/development/compilers/swift/default.nix b/pkgs/development/compilers/swift/default.nix
index 0215cd6f0ba3..ad4fe81c46cb 100644
--- a/pkgs/development/compilers/swift/default.nix
+++ b/pkgs/development/compilers/swift/default.nix
@@ -1,44 +1,21 @@
 {
   lib,
-  pkgs,
   newScope,
-  darwin,
+  stdenv,
   llvmPackages,
-  llvmPackages_15,
-  overrideCC,
-  overrideLibcxx,
+  darwin,
 }:
 
 let
-  swiftLlvmPackages = llvmPackages_15;
-
   self = rec {
 
     callPackage = newScope self;
 
-    # Swift builds its own Clang for internal use. We wrap that clang with a
-    # cc-wrapper derived from the clang configured below. Because cc-wrapper
-    # applies a specific resource-root, the two versions are best matched, or
-    # we'll often run into compilation errors.
-    #
-    # The following selects the correct Clang version, matching the version
-    # used in Swift.
-    inherit (swiftLlvmPackages) clang;
-
-    # Overrides that create a useful environment for swift packages, allowing
-    # packaging with `swiftPackages.callPackage`.
-    inherit (clang) bintools;
-    stdenv =
-      let
-        stdenv' = overrideCC pkgs.stdenv clang;
-      in
-      # Ensure that Swift’s internal clang uses the same libc++ and libc++abi as the
-      # default clang’s stdenv. Using the default libc++ avoids issues (such as crashes)
-      # that can happen when a Swift application dynamically links different versions
-      # of libc++ and libc++abi than libraries it links are using.
-      if stdenv'.cc.libcxx != null then overrideLibcxx stdenv' else stdenv';
+    # Provided for backwards compatibility.
+    inherit stdenv;
 
     swift-unwrapped = callPackage ./compiler {
+      inherit (llvmPackages) stdenv;
       inherit (darwin) DarwinTools sigtool;
     };
 
@@ -51,13 +28,19 @@ let
       if stdenv.hostPlatform.isDarwin then
         null # part of apple-sdk
       else
-        callPackage ./libdispatch { swift = swiftNoSwiftDriver; };
+        callPackage ./libdispatch {
+          inherit (llvmPackages) stdenv;
+          swift = swiftNoSwiftDriver;
+        };
 
     Foundation =
       if stdenv.hostPlatform.isDarwin then
         null # part of apple-sdk
       else
-        callPackage ./foundation { swift = swiftNoSwiftDriver; };
+        callPackage ./foundation {
+          inherit (llvmPackages) stdenv;
+          swift = swiftNoSwiftDriver;
+        };
 
     # TODO: Apple distributes a binary XCTest with Xcode, but it is not part of
     # CLTools (or SUS), so would have to figure out how to fetch it. The binary
@@ -68,11 +51,13 @@ let
     };
 
     swiftpm = callPackage ./swiftpm {
+      inherit (llvmPackages) stdenv;
       inherit (darwin) DarwinTools;
       swift = swiftNoSwiftDriver;
     };
 
     swift-driver = callPackage ./swift-driver {
+      inherit (llvmPackages) stdenv;
       swift = swiftNoSwiftDriver;
     };
 
@@ -80,11 +65,17 @@ let
       swift = swift-unwrapped;
     };
 
-    sourcekit-lsp = callPackage ./sourcekit-lsp { };
+    sourcekit-lsp = callPackage ./sourcekit-lsp {
+      inherit (llvmPackages) stdenv;
+    };
 
-    swift-docc = callPackage ./swift-docc { };
+    swift-docc = callPackage ./swift-docc {
+      inherit (llvmPackages) stdenv;
+    };
 
-    swift-format = callPackage ./swift-format { };
+    swift-format = callPackage ./swift-format {
+      inherit (llvmPackages) stdenv;
+    };
 
     swiftpm2nix = callPackage ./swiftpm2nix { };
 
diff --git a/pkgs/development/compilers/swift/foundation/default.nix b/pkgs/development/compilers/swift/foundation/default.nix
index de20db4ce258..e2ada783ea0c 100644
--- a/pkgs/development/compilers/swift/foundation/default.nix
+++ b/pkgs/development/compilers/swift/foundation/default.nix
@@ -28,6 +28,16 @@ stdenv.mkDerivation {
       url = "https://github.com/apple/swift-corelibs-foundation/commit/47260803a108c6e0d639adcebeed3ac6a76e8bcd.patch";
       hash = "sha256-1JUSQW86IHKkBZqxvpk0P8zcSKntzOTNlMoGBfgeT4c=";
     })
+
+    # Fix the build with modern Clang.
+    (fetchpatch {
+      url = "https://github.com/swiftlang/swift-corelibs-foundation/commit/76058114e5f5b47e02dd4441a6389858bb599bd6.patch";
+      hash = "sha256-N/hdTGCWMz092xh3AI28v3b+zjQHRmsb1F/2Q2u/jik=";
+    })
+    (fetchpatch {
+      url = "https://github.com/swiftlang/swift-corelibs-foundation/commit/5f3e896e522ff364780e6330df867e20e26269b4.patch";
+      hash = "sha256-AaBWSysNpZ7NV10RGD4TehZqE0k8Sn+TlhlGw1PiRdI=";
+    })
   ];
 
   outputs = [
diff --git a/pkgs/development/compilers/swift/libdispatch/default.nix b/pkgs/development/compilers/swift/libdispatch/default.nix
index 3760dfb405b9..4b30a1d80673 100644
--- a/pkgs/development/compilers/swift/libdispatch/default.nix
+++ b/pkgs/development/compilers/swift/libdispatch/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   callPackage,
+  fetchpatch,
   cmake,
   ninja,
   useSwift ? true,
@@ -31,7 +32,15 @@ stdenv.mkDerivation {
     swift
   ];
 
-  patches = [ ./disable-swift-overlay.patch ];
+  patches = [
+    # Fix the build with modern Clang.
+    (fetchpatch {
+      url = "https://github.com/swiftlang/swift-corelibs-libdispatch/commit/30bb8019ba79cdae0eb1dc0c967c17996dd5cc0a.patch";
+      hash = "sha256-wPZQ4wtEWk8HaKMfzjamlU6p/IW5EFiTssY63rGM+ZA=";
+    })
+
+    ./disable-swift-overlay.patch
+  ];
 
   cmakeFlags = lib.optional useSwift "-DENABLE_SWIFT=ON";
 
diff --git a/pkgs/development/compilers/swift/sourcekit-lsp/default.nix b/pkgs/development/compilers/swift/sourcekit-lsp/default.nix
index fff5cd6aaef7..d2e0ae6fbc0e 100644
--- a/pkgs/development/compilers/swift/sourcekit-lsp/default.nix
+++ b/pkgs/development/compilers/swift/sourcekit-lsp/default.nix
@@ -43,6 +43,13 @@ stdenv.mkDerivation {
   configurePhase = generated.configure + ''
     swiftpmMakeMutable indexstore-db
     patch -p1 -d .build/checkouts/indexstore-db -i ${./patches/indexstore-db-macos-target.patch}
+    patch -p1 -d .build/checkouts/indexstore-db -i ${
+      # Fix the build with modern Clang.
+      fetchpatch {
+        url = "https://github.com/swiftlang/indexstore-db/commit/6120b53b1e8774ef4e2ad83438d4d94961331e72.patch";
+        hash = "sha256-tMAfTIa3RKiA/jDtP02mHcpPaF2s9a+3q/PLJxqn30M=";
+      }
+    }
 
     swiftpmMakeMutable swift-tools-support-core
     patch -p1 -d .build/checkouts/swift-tools-support-core -i ${
diff --git a/pkgs/development/compilers/swift/swift-docc/default.nix b/pkgs/development/compilers/swift/swift-docc/default.nix
index 5dbcf50e83bf..2ec0b4c10746 100644
--- a/pkgs/development/compilers/swift/swift-docc/default.nix
+++ b/pkgs/development/compilers/swift/swift-docc/default.nix
@@ -30,7 +30,16 @@ stdenv.mkDerivation {
     XCTest
   ];
 
-  configurePhase = generated.configure;
+  configurePhase =
+    generated.configure
+    # Fix the build with modern Clang.
+    #
+    # Based on the upstream fix for Musl:
+    # <https://github.com/apple/swift-nio/commit/fc6e3c0eefb28adf641531180b81aaf41b02ed20>
+    + ''
+      swiftpmMakeMutable swift-nio
+      patch -p1 -d .build/checkouts/swift-nio -i ${./fix-swift-nio.patch}
+    '';
 
   # We only install the docc binary, so don't need the other products.
   # This works around a failure building generate-symbol-graph:
diff --git a/pkgs/development/compilers/swift/swift-docc/fix-swift-nio.patch b/pkgs/development/compilers/swift/swift-docc/fix-swift-nio.patch
new file mode 100644
index 000000000000..ccab988906fa
--- /dev/null
+++ b/pkgs/development/compilers/swift/swift-docc/fix-swift-nio.patch
@@ -0,0 +1,13 @@
+diff --git a/Package.swift b/Package.swift
+index 39c6fb4b2f..02c08b898d 100644
+--- a/Package.swift
++++ b/Package.swift
+@@ -26,7 +26,7 @@
+     .target(name: "NIOFoundationCompat", dependencies: ["NIO"]),
+     .target(name: "CNIOAtomics", dependencies: []),
+     .target(name: "CNIOSHA1", dependencies: []),
+-    .target(name: "CNIOLinux", dependencies: []),
++    .target(name: "CNIOLinux", dependencies: [], cSettings: [.define("_GNU_SOURCE")]),
+     .target(name: "CNIODarwin", dependencies: [], cSettings: [.define("__APPLE_USE_RFC_3542")]),
+     .target(name: "CNIOWindows", dependencies: []),
+     .target(name: "NIOConcurrencyHelpers",
diff --git a/pkgs/development/compilers/swift/swift-driver/default.nix b/pkgs/development/compilers/swift/swift-driver/default.nix
index d84d5be2ca74..3da4e5bacdf9 100644
--- a/pkgs/development/compilers/swift/swift-driver/default.nix
+++ b/pkgs/development/compilers/swift/swift-driver/default.nix
@@ -10,6 +10,7 @@
   XCTest,
   sqlite,
   ncurses,
+  clang,
   replaceVars,
 }:
 let
@@ -40,9 +41,10 @@ stdenv.mkDerivation {
   ];
 
   patches = [
-    ./patches/nix-resource-root.patch
     ./patches/disable-catalyst.patch
-    ./patches/linux-fix-linking.patch
+    (replaceVars ./patches/linux-fix-linking.patch {
+      inherit clang;
+    })
     # TODO: Replace with branch patch once merged:
     # https://github.com/apple/swift-driver/pull/1197
     (fetchpatch {
diff --git a/pkgs/development/compilers/swift/swift-driver/patches/linux-fix-linking.patch b/pkgs/development/compilers/swift/swift-driver/patches/linux-fix-linking.patch
index 8f91b3a234b5..be4147d44f07 100644
--- a/pkgs/development/compilers/swift/swift-driver/patches/linux-fix-linking.patch
+++ b/pkgs/development/compilers/swift/swift-driver/patches/linux-fix-linking.patch
@@ -1,3 +1,5 @@
+diff --git a/Sources/SwiftDriver/Jobs/GenericUnixToolchain+LinkerSupport.swift b/Sources/SwiftDriver/Jobs/GenericUnixToolchain+LinkerSupport.swift
+index a4a735f498..381522cc1f 100644
 --- a/Sources/SwiftDriver/Jobs/GenericUnixToolchain+LinkerSupport.swift
 +++ b/Sources/SwiftDriver/Jobs/GenericUnixToolchain+LinkerSupport.swift
 @@ -10,6 +10,7 @@
@@ -8,19 +10,17 @@
  import SwiftOptions
  
  import func TSCBasic.lookupExecutablePath
-@@ -120,7 +121,20 @@ extension GenericUnixToolchain {
+@@ -120,7 +121,18 @@
        // just using `clang` and avoid a dependency on the C++ runtime.
        let clangTool: Tool =
          parsedOptions.hasArgument(.enableExperimentalCxxInterop) ? .clangxx : .clang
 -      var clangPath = try getToolPath(clangTool)
 +
-+      // For Nix, prefer linking using the wrapped system clang, instead of using
++      // For Nix, prefer linking using the wrapped Nixpkgs clang, instead of using
 +      // the unwrapped clang packaged with swift. The latter is unable to link, but
 +      // we still want to use it for other purposes (clang importer).
 +      var clangPath: AbsolutePath
-+      let env = ProcessInfo.processInfo.environment
-+      if let nixCC = env["NIX_CC"],
-+         let binPath = try? AbsolutePath(validating: "\(nixCC)/bin"),
++      if let binPath = try? AbsolutePath(validating: "@clang@/bin"),
 +         let tool = lookupExecutablePath(filename: parsedOptions.hasArgument(.enableExperimentalCxxInterop)
 +                                                        ? "clang++" : "clang",
 +                                         searchPaths: [binPath]) {
@@ -30,11 +30,11 @@
        if let toolsDirPath = parsedOptions.getLastArgument(.toolsDirectory) {
          // FIXME: What if this isn't an absolute path?
          let toolsDir = try AbsolutePath(validating: toolsDirPath.asSingle)
-@@ -136,6 +150,7 @@ extension GenericUnixToolchain {
+@@ -136,6 +148,7 @@
          commandLine.appendFlag("-B")
          commandLine.appendPath(toolsDir)
        }
-+      } // nixCC
++      } // Nix
  
        // Executables on Linux get -pie
        if targetTriple.os == .linux && linkerOutputType == .executable {
diff --git a/pkgs/development/compilers/swift/swift-driver/patches/nix-resource-root.patch b/pkgs/development/compilers/swift/swift-driver/patches/nix-resource-root.patch
deleted file mode 100644
index 8c24db5aad1d..000000000000
--- a/pkgs/development/compilers/swift/swift-driver/patches/nix-resource-root.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-Swift normally looks for the Clang resource dir in a subdir/symlink of its own
-resource dir. We provide a symlink to the Swift build-time Clang as a default
-there, but we also here patch a check to try locate it via NIX_CC.
-
---- a/Sources/SwiftDriver/Jobs/Toolchain+LinkerSupport.swift
-+++ b/Sources/SwiftDriver/Jobs/Toolchain+LinkerSupport.swift
-@@ -10,6 +10,7 @@
- //
- //===----------------------------------------------------------------------===//
- 
-+import Foundation
- import SwiftOptions
- 
- import protocol TSCBasic.FileSystem
-@@ -26,6 +27,13 @@ extension Toolchain {
-     for targetInfo: FrontendTargetInfo,
-     parsedOptions: inout ParsedOptions
-   ) throws -> VirtualPath {
-+    let env = ProcessInfo.processInfo.environment
-+    if let nixCC = env["NIX_CC"] {
-+      return try VirtualPath(path: nixCC)
-+        .appending(components: "resource-root", "lib",
-+                   targetInfo.target.triple.platformName(conflatingDarwin: true)!)
-+    }
-+
-     return VirtualPath.lookup(targetInfo.runtimeResourcePath.path)
-       .appending(components: "clang", "lib",
-                  targetInfo.target.triple.platformName(conflatingDarwin: true)!)
diff --git a/pkgs/development/compilers/swift/wrapper/default.nix b/pkgs/development/compilers/swift/wrapper/default.nix
index d8b08cf5e3c2..e446bec66868 100644
--- a/pkgs/development/compilers/swift/wrapper/default.nix
+++ b/pkgs/development/compilers/swift/wrapper/default.nix
@@ -4,6 +4,7 @@
   swift,
   useSwiftDriver ? true,
   swift-driver,
+  clang,
 }:
 
 stdenv.mkDerivation (
@@ -28,6 +29,25 @@ stdenv.mkDerivation (
       swiftStaticLibSubdir
       ;
     swiftDriver = lib.optionalString useSwiftDriver "${swift-driver}/bin/swift-driver";
+    cc_wrapper = clang.override (prev: {
+      extraBuildCommands =
+        prev.extraBuildCommands
+        # We need to use the resource directory corresponding to Swift’s
+        # version of Clang instead of passing along the one from the
+        # `cc-wrapper` flags.
+        + ''
+          rm -r $out/resource-root
+          substituteInPlace $out/nix-support/cc-cflags \
+            --replace-fail \
+              "-resource-dir=$out/resource-root" \
+              "-resource-dir=${lib.getLib swift}/lib/swift/clang"
+        ''
+        # We need the libc++ headers corresponding to the LLVM version of
+        # Swift’s Clang.
+        + lib.optionalString (clang.libcxx != null) ''
+          include -isystem "${lib.getDev swift}/include/c++/v1" > $out/nix-support/libcxx-cxxflags
+        '';
+    });
 
     env.darwinMinVersion = lib.optionalString stdenv.targetPlatform.isDarwin (
       stdenv.targetPlatform.darwinMinVersion
@@ -79,6 +99,7 @@ stdenv.mkDerivation (
         swiftArch
         swiftModuleSubdir
         swiftLibSubdir
+        tests
         ;
     };
   }
diff --git a/pkgs/development/compilers/swift/wrapper/wrapper.sh b/pkgs/development/compilers/swift/wrapper/wrapper.sh
index bb9c07a5b444..a0f706dfbe6c 100644
--- a/pkgs/development/compilers/swift/wrapper/wrapper.sh
+++ b/pkgs/development/compilers/swift/wrapper/wrapper.sh
@@ -8,7 +8,7 @@ if (( "${NIX_DEBUG:-0}" >= 7 )); then
     set -x
 fi
 
-cc_wrapper="${NIX_CC:-@default_cc_wrapper@}"
+cc_wrapper="@cc_wrapper@"
 
 source $cc_wrapper/nix-support/utils.bash
 
diff --git a/pkgs/development/julia-modules/default.nix b/pkgs/development/julia-modules/default.nix
index 8568c70e4c52..1c6d33326f53 100644
--- a/pkgs/development/julia-modules/default.nix
+++ b/pkgs/development/julia-modules/default.nix
@@ -11,6 +11,7 @@
 
   # Artifacts dependencies
   fetchurl,
+  gcc,
   glibc,
   pkgs,
   stdenv,
@@ -79,7 +80,9 @@ let
     PythonCall = [ "PyCall" ];
   };
 
-  # Invoke Julia resolution logic to determine the full dependency closure
+  # Invoke Julia resolution logic to determine the full dependency closure. Also
+  # gather information on the Julia standard libraries, which we'll need to
+  # generate a Manifest.toml.
   packageOverridesRepoified = lib.mapAttrs util.repoifySimple packageOverrides;
   closureYaml = callPackage ./package-closure.nix {
     inherit
@@ -90,6 +93,9 @@ let
       ;
     packageOverrides = packageOverridesRepoified;
   };
+  stdlibInfos = callPackage ./stdlib-infos.nix {
+    inherit julia;
+  };
 
   # Generate a Nix file consisting of a map from dependency UUID --> package info with fetchgit call:
   # {
@@ -181,6 +187,27 @@ let
           "${dependencyUuidToRepoYaml}" \
           "$out"
       '';
+  project =
+    runCommand "julia-project"
+      {
+        buildInputs = [
+          (python3.withPackages (
+            ps: with ps; [
+              toml
+              pyyaml
+            ]
+          ))
+          git
+        ];
+      }
+      ''
+        python ${./python}/project.py \
+          "${closureYaml}" \
+          "${stdlibInfos}" \
+          '${lib.generators.toJSON { } overridesOnly}' \
+          "${dependencyUuidToRepoYaml}" \
+          "$out"
+      '';
 
   # Next, deal with artifacts. Scan each artifacts file individually and generate a Nix file that
   # produces the desired Overrides.toml.
@@ -220,7 +247,7 @@ let
         ;
     }
     // lib.optionalAttrs (!stdenv.targetPlatform.isDarwin) {
-      inherit glibc;
+      inherit gcc glibc;
     }
   );
   overridesJson = writeTextFile {
@@ -235,8 +262,7 @@ let
           "$out"
       '';
 
-  # Build a Julia project and depot. The project contains Project.toml/Manifest.toml, while the
-  # depot contains package build products (including the precompiled libraries, if precompile=true)
+  # Build a Julia project and depot under $out/project and $out/depot respectively
   projectAndDepot = callPackage ./depot.nix {
     inherit
       closureYaml
@@ -247,12 +273,8 @@ let
       precompile
       ;
     julia = juliaWrapped;
+    inherit project;
     registry = minimalRegistry;
-    packageNames =
-      if makeTransitiveDependenciesImportable then
-        lib.mapAttrsToList (uuid: info: info.name) dependencyUuidToInfo
-      else
-        packageNames;
   };
 
 in
@@ -276,7 +298,9 @@ runCommand "julia-${julia.version}-env"
       inherit artifactsNix;
       inherit overridesJson;
       inherit overridesToml;
+      inherit project;
       inherit projectAndDepot;
+      inherit stdlibInfos;
     };
   }
   (
diff --git a/pkgs/development/julia-modules/depot.nix b/pkgs/development/julia-modules/depot.nix
index be5693d2b5d9..bf461f3e3759 100644
--- a/pkgs/development/julia-modules/depot.nix
+++ b/pkgs/development/julia-modules/depot.nix
@@ -14,7 +14,7 @@
   juliaCpuTarget,
   overridesToml,
   packageImplications,
-  packageNames,
+  project,
   precompile,
   registry,
 }:
@@ -44,7 +44,7 @@ runCommand "julia-depot"
       (python3.withPackages (ps: with ps; [ pyyaml ]))
     ]
     ++ extraLibs;
-    inherit precompile registry;
+    inherit precompile project registry;
   }
   (
     ''
@@ -52,19 +52,21 @@ runCommand "julia-depot"
 
       echo "Building Julia depot and project with the following inputs"
       echo "Julia: ${julia}"
+      echo "Project: $project"
       echo "Registry: $registry"
       echo "Overrides ${overridesToml}"
 
       mkdir -p $out/project
       export JULIA_PROJECT="$out/project"
+      cp "$project/Manifest.toml" "$JULIA_PROJECT/Manifest.toml"
+      cp "$project/Project.toml" "$JULIA_PROJECT/Project.toml"
 
       mkdir -p $out/depot/artifacts
       export JULIA_DEPOT_PATH="$out/depot"
       cp ${overridesToml} $out/depot/artifacts/Overrides.toml
 
       # These can be useful to debug problems
-      # export JULIA_DEBUG=Pkg
-      # export JULIA_DEBUG=loading
+      # export JULIA_DEBUG=Pkg,loading
 
       ${setJuliaSslCaRootsPath}
 
@@ -104,26 +106,21 @@ runCommand "julia-depot"
 
         Pkg.Registry.add(Pkg.RegistrySpec(path="${registry}"))
 
-        input = ${lib.generators.toJSON { } packageNames} ::Vector{String}
+        # No need to Pkg.activate() since we set JULIA_PROJECT above
+        println("Running Pkg.instantiate()")
+        Pkg.instantiate()
 
-        if isfile("extra_package_names.txt")
-          append!(input, readlines("extra_package_names.txt"))
-        end
+        # Build is a separate step from instantiate.
+        # Needed for packages like Conda.jl to set themselves up.
+        println("Running Pkg.build()")
+        Pkg.build()
 
-        input = unique(input)
-
-        if !isempty(input)
-          println("Adding packages: " * join(input, " "))
-          Pkg.add(input; preserve=PRESERVE_NONE)
-          Pkg.instantiate()
-
-          if "precompile" in keys(ENV) && ENV["precompile"] != "0" && ENV["precompile"] != ""
-            if isdefined(Sys, :CPU_NAME)
-              println("Precompiling with CPU_NAME = " * Sys.CPU_NAME)
-            end
-
-            Pkg.precompile()
+        if "precompile" in keys(ENV) && ENV["precompile"] != "0" && ENV["precompile"] != ""
+          if isdefined(Sys, :CPU_NAME)
+            println("Precompiling with CPU_NAME = " * Sys.CPU_NAME)
           end
+
+          Pkg.precompile()
         end
 
         # Remove the registry to save space
diff --git a/pkgs/development/julia-modules/package-closure.nix b/pkgs/development/julia-modules/package-closure.nix
index a393a2f49427..f0095366455f 100644
--- a/pkgs/development/julia-modules/package-closure.nix
+++ b/pkgs/development/julia-modules/package-closure.nix
@@ -43,12 +43,21 @@ let
             println(io, "- name: " * spec.name)
             println(io, "  uuid: " * string(spec.uuid))
             println(io, "  version: " * string(spec.version))
+            println(io, "  tree_hash: " * string(spec.tree_hash))
             if endswith(spec.name, "_jll") && haskey(deps_map, spec.uuid)
                 println(io, "  depends_on: ")
                 for (dep_name, dep_uuid) in pairs(deps_map[spec.uuid])
                     println(io, "    \"$(dep_name)\": \"$(dep_uuid)\"")
                 end
             end
+            println(io, "  deps: ")
+            for (dep_name, dep_uuid) in pairs(deps_map[spec.uuid])
+                println(io, "  - name: \"$(dep_name)\"")
+                println(io, "    uuid: \"$(dep_uuid)\"")
+            end
+            if spec.name in input
+                println(io, "  is_input: true")
+            end
         end
     end
   '';
diff --git a/pkgs/development/julia-modules/python/extract_artifacts.py b/pkgs/development/julia-modules/python/extract_artifacts.py
index 134294321f26..642611e029c4 100755
--- a/pkgs/development/julia-modules/python/extract_artifacts.py
+++ b/pkgs/development/julia-modules/python/extract_artifacts.py
@@ -47,14 +47,17 @@ def get_archive_derivation(uuid, artifact_name, url, sha256, closure_dependencie
 
             ''"""
   else:
+    # We provide gcc.cc.lib by default in order to get some common libraries
+    # like libquadmath.so. A number of packages expect this to be available and
+    # will give linker errors if it isn't.
     fixup = f"""fixupPhase = let
             libs = lib.concatMap (lib.mapAttrsToList (k: v: v.path))
                                [{" ".join(["uuid-" + x for x in depends_on])}];
             in ''
               find $out -type f -executable -exec \
-                patchelf --set-rpath \$ORIGIN:\$ORIGIN/../lib:${{lib.makeLibraryPath (["$out" glibc] ++ libs ++ (with pkgs; [{" ".join(other_libs)}]))}} {{}} \;
+                patchelf --set-rpath \\$ORIGIN:\\$ORIGIN/../lib:${{lib.makeLibraryPath (["$out" glibc gcc.cc.lib] ++ libs ++ (with pkgs; [{" ".join(other_libs)}]))}} {{}} \\;
               find $out -type f -executable -exec \
-                patchelf --set-interpreter ${{glibc}}/lib/ld-linux-x86-64.so.2 {{}} \;
+                patchelf --set-interpreter ${{glibc}}/lib/ld-linux-x86-64.so.2 {{}} \\;
             ''"""
 
   return f"""stdenv.mkDerivation {{
@@ -145,7 +148,7 @@ def main():
     if is_darwin:
       f.write("{ lib, fetchurl, pkgs, stdenv }:\n\n")
     else:
-      f.write("{ lib, fetchurl, glibc, pkgs, stdenv }:\n\n")
+      f.write("{ lib, fetchurl, gcc, glibc, pkgs, stdenv }:\n\n")
 
     f.write("rec {\n")
 
diff --git a/pkgs/development/julia-modules/python/minimal_registry.py b/pkgs/development/julia-modules/python/minimal_registry.py
index bdab0716ef89..ab33ac366ca8 100755
--- a/pkgs/development/julia-modules/python/minimal_registry.py
+++ b/pkgs/development/julia-modules/python/minimal_registry.py
@@ -24,14 +24,15 @@ with open(desired_packages_path, "r") as f:
 
 uuid_to_versions = defaultdict(list)
 for pkg in desired_packages:
-    uuid_to_versions[pkg["uuid"]].append(pkg["version"])
+  uuid_to_versions[pkg["uuid"]].append(pkg["version"])
 
 with open(dependencies_path, "r") as f:
   uuid_to_store_path = yaml.safe_load(f)
 
 os.makedirs(out_path)
 
-registry = toml.load(registry_path / "Registry.toml")
+full_registry = toml.load(registry_path / "Registry.toml")
+registry = full_registry.copy()
 registry["packages"] = {k: v for k, v in registry["packages"].items() if k in uuid_to_versions}
 
 for (uuid, versions) in uuid_to_versions.items():
@@ -80,20 +81,48 @@ for (uuid, versions) in uuid_to_versions.items():
       if (registry_path / path / f).exists():
         shutil.copy2(registry_path / path / f, out_path / path)
 
-    # Copy the Versions.toml file, trimming down to the versions we care about
+    # Copy the Versions.toml file, trimming down to the versions we care about.
+    # In the case where versions=None, this is a weak dep, and we keep all versions.
     all_versions = toml.load(registry_path / path / "Versions.toml")
-    versions_to_keep = {k: v for k, v in all_versions.items() if k in versions}
+    versions_to_keep = {k: v for k, v in all_versions.items() if k in versions} if versions != None else all_versions
     for k, v in versions_to_keep.items():
       del v["nix-sha256"]
     with open(out_path / path / "Versions.toml", "w") as f:
       toml.dump(versions_to_keep, f)
 
-    # Fill in the local store path for the repo
-    if not uuid in uuid_to_store_path: continue
-    package_toml = toml.load(registry_path / path / "Package.toml")
-    package_toml["repo"] = "file://" + uuid_to_store_path[uuid]
-    with open(out_path / path / "Package.toml", "w") as f:
-      toml.dump(package_toml, f)
+    if versions is None:
+      # This is a weak dep; just grab the whole Package.toml
+      shutil.copy2(registry_path / path / "Package.toml", out_path / path / "Package.toml")
+    elif uuid in uuid_to_store_path:
+      # Fill in the local store path for the repo
+      package_toml = toml.load(registry_path / path / "Package.toml")
+      package_toml["repo"] = "file://" + uuid_to_store_path[uuid]
+      with open(out_path / path / "Package.toml", "w") as f:
+        toml.dump(package_toml, f)
 
+# Look for missing weak deps and include them. This can happen when our initial
+# resolve step finds dependencies, but we fail to resolve them at the project.py
+# stage. Usually this happens because the package that depends on them does so
+# as a weak dep, but doesn't have a Package.toml in its repo making this clear.
+for pkg in desired_packages:
+  for dep in (pkg.get("deps", []) or []):
+    uuid = dep["uuid"]
+    if not uuid in uuid_to_versions:
+      entry = full_registry["packages"].get(uuid)
+      if not entry:
+        print(f"""WARNING: found missing UUID but couldn't resolve it: {uuid}""")
+        continue
+
+      # Add this entry back to the minimal Registry.toml
+      registry["packages"][uuid] = entry
+
+      # Bring over the Package.toml
+      path = Path(entry["path"])
+      if (out_path / path / "Package.toml").exists():
+        continue
+      Path(out_path / path).mkdir(parents=True, exist_ok=True)
+      shutil.copy2(registry_path / path / "Package.toml", out_path / path / "Package.toml")
+
+# Finally, dump the Registry.toml
 with open(out_path / "Registry.toml", "w") as f:
     toml.dump(registry, f)
diff --git a/pkgs/development/julia-modules/python/project.py b/pkgs/development/julia-modules/python/project.py
new file mode 100755
index 000000000000..4a5f2ae20719
--- /dev/null
+++ b/pkgs/development/julia-modules/python/project.py
@@ -0,0 +1,104 @@
+
+from collections import defaultdict
+import json
+import os
+from pathlib import Path
+import sys
+import toml
+import yaml
+
+
+desired_packages_path = Path(sys.argv[1])
+stdlib_infos_path = Path(sys.argv[2])
+package_overrides = json.loads(sys.argv[3])
+dependencies_path = Path(sys.argv[4])
+out_path = Path(sys.argv[5])
+
+with open(desired_packages_path, "r") as f:
+  desired_packages = yaml.safe_load(f) or []
+
+with open(stdlib_infos_path, "r") as f:
+  stdlib_infos = yaml.safe_load(f) or []
+
+with open(dependencies_path, "r") as f:
+  uuid_to_store_path = yaml.safe_load(f)
+
+result = {
+  "deps": defaultdict(list)
+}
+
+for pkg in desired_packages:
+  if pkg["uuid"] in package_overrides:
+    info = package_overrides[pkg["uuid"]]
+    result["deps"][info["name"]].append({
+      "uuid": pkg["uuid"],
+      "path": info["src"],
+    })
+    continue
+
+  path = uuid_to_store_path.get(pkg["uuid"], None)
+  isStdLib = False
+  if pkg["uuid"] in stdlib_infos["stdlibs"]:
+    path = stdlib_infos["stdlib_root"] + "/" + stdlib_infos["stdlibs"][pkg["uuid"]]["name"]
+    isStdLib = True
+
+  if path:
+    if (Path(path) / "Project.toml").exists():
+      project_toml = toml.load(Path(path) / "Project.toml")
+
+      deps = []
+      weak_deps = project_toml.get("weakdeps", {})
+      extensions = project_toml.get("extensions", {})
+
+      if "deps" in project_toml:
+        # Build up deps for the manifest, excluding weak deps
+        weak_deps_uuids = weak_deps.values()
+        for (dep_name, dep_uuid) in project_toml["deps"].items():
+          if not (dep_uuid in weak_deps_uuids):
+            deps.append(dep_name)
+    else:
+      # Not all projects have a Project.toml. In this case, use the deps we
+      # calculated from the package resolve step. This isn't perfect since it
+      # will fail to properly split out weak deps, but it's better than nothing.
+      print(f"""WARNING: package {pkg["name"]} didn't have a Project.toml in {path}""")
+      deps = [x["name"] for x in pkg.get("deps", [])]
+      weak_deps = {}
+      extensions = {}
+
+    tree_hash = pkg.get("tree_hash", "")
+
+    result["deps"][pkg["name"]].append({
+      "version": pkg["version"],
+      "uuid": pkg["uuid"],
+      "git-tree-sha1": (tree_hash if tree_hash != "nothing" else None) or None,
+      "deps": deps or None,
+      "weakdeps": weak_deps or None,
+      "extensions": extensions or None,
+
+      # We *don't* set "path" here, because then Julia will try to use the
+      # read-only Nix store path instead of cloning to the depot. This will
+      # cause packages like Conda.jl to fail during the Pkg.build() step.
+      #
+      # "path": None if isStdLib else path ,
+    })
+  else:
+    print("WARNING: adding a package that we didn't have a path for, and it doesn't seem to be a stdlib", pkg)
+    result["deps"][pkg["name"]].append({
+      "version": pkg["version"],
+      "uuid": pkg["uuid"],
+      "deps": [x["name"] for x in pkg["deps"]]
+    })
+
+os.makedirs(out_path)
+
+with open(out_path / "Manifest.toml", "w") as f:
+  f.write(f'julia_version = "{stdlib_infos["julia_version"]}"\n')
+  f.write('manifest_format = "2.0"\n\n')
+  toml.dump(result, f)
+
+with open(out_path / "Project.toml", "w") as f:
+  f.write('[deps]\n')
+
+  for pkg in desired_packages:
+    if pkg.get("is_input", False):
+      f.write(f'''{pkg["name"]} = "{pkg["uuid"]}"\n''')
diff --git a/pkgs/development/julia-modules/python/sources_nix.py b/pkgs/development/julia-modules/python/sources_nix.py
index 989bf6bf186f..b0f0a21e3b22 100755
--- a/pkgs/development/julia-modules/python/sources_nix.py
+++ b/pkgs/development/julia-modules/python/sources_nix.py
@@ -24,7 +24,7 @@ def ensure_version_valid(version):
   Ensure a version string is a valid Julia-parsable version.
   It doesn't really matter what it looks like as it's just used for overrides.
   """
-  return re.sub('[^0-9\.]','', version)
+  return re.sub('[^0-9.]','', version)
 
 with open(out_path, "w") as f:
   f.write("{fetchgit}:\n")
@@ -41,6 +41,9 @@ with open(out_path, "w") as f:
     treehash = "{treehash}";
   }};\n""")
     elif uuid in registry["packages"]:
+      # The treehash is missing for stdlib packages. Don't bother downloading these.
+      if (not ("tree_hash" in pkg)) or pkg["tree_hash"] == "nothing": continue
+
       registry_info = registry["packages"][uuid]
       path = registry_info["path"]
       packageToml = toml.load(registry_path / path / "Package.toml")
@@ -65,7 +68,8 @@ with open(out_path, "w") as f:
     treehash = "{version_to_use["git-tree-sha1"]}";
   }};\n""")
     else:
-      # print("Warning: couldn't figure out what to do with pkg in sources_nix.py", pkg)
+      # This is probably a stdlib
+      # print("WARNING: couldn't figure out what to do with pkg in sources_nix.py", pkg)
       pass
 
   f.write("}")
diff --git a/pkgs/development/julia-modules/registry.nix b/pkgs/development/julia-modules/registry.nix
index 6daca3d17b42..a58adf812385 100644
--- a/pkgs/development/julia-modules/registry.nix
+++ b/pkgs/development/julia-modules/registry.nix
@@ -3,7 +3,7 @@
 fetchFromGitHub {
   owner = "CodeDownIO";
   repo = "General";
-  rev = "998c6da1553dc0776dfff314d2f1bd5af488ed71";
-  sha256 = "sha256-57RiIPTu9895mdk3oSfo7I3PYw7G0BfJG1u+mYkJeLk=";
-  # date = "2024-07-01T12:22:35+00:00";
+  rev = "4b19a1dc55d2877e85a5d0e98702b75872210e9d";
+  sha256 = "sha256-mVeBTpEQnW3fvJu1+4T8z+earMjEgtdy0tnZnAxz/pk=";
+  # date = "2025-08-12T05:20:40+00:00";
 }
diff --git a/pkgs/development/julia-modules/resolve_packages.jl b/pkgs/development/julia-modules/resolve_packages.jl
index fce60035d5f5..c53763827aab 100644
--- a/pkgs/development/julia-modules/resolve_packages.jl
+++ b/pkgs/development/julia-modules/resolve_packages.jl
@@ -46,54 +46,6 @@ end
 foreach(pkg -> ctx.env.project.deps[pkg.name] = pkg.uuid, pkgs)
 
 # Save the original pkgs for later. We might need to augment it with the weak dependencies
-orig_pkgs = pkgs
+orig_pkgs = deepcopy(pkgs)
 
 pkgs, deps_map = _resolve(ctx.io, ctx.env, ctx.registries, pkgs, PRESERVE_NONE, ctx.julia_version)
-
-if VERSION >= VersionNumber("1.9")
-    while true
-        # Check for weak dependencies, which appear on the RHS of the deps_map but not in pkgs.
-        # Build up weak_name_to_uuid
-        uuid_to_name = Dict()
-        for pkg in pkgs
-            uuid_to_name[pkg.uuid] = pkg.name
-        end
-        weak_name_to_uuid = Dict()
-        for (uuid, deps) in pairs(deps_map)
-            for (dep_name, dep_uuid) in pairs(deps)
-                if !haskey(uuid_to_name, dep_uuid)
-                    weak_name_to_uuid[dep_name] = dep_uuid
-                end
-            end
-        end
-
-        if isempty(weak_name_to_uuid)
-            break
-        end
-
-        # We have nontrivial weak dependencies, so add each one to the initial pkgs and then re-run _resolve
-        println("Found weak dependencies: $(keys(weak_name_to_uuid))")
-
-        orig_uuids = Set([pkg.uuid for pkg in orig_pkgs])
-
-        for (name, uuid) in pairs(weak_name_to_uuid)
-            if uuid in orig_uuids
-                continue
-            end
-
-            pkg = PackageSpec(name, uuid)
-
-            push!(orig_uuids, uuid)
-            push!(orig_pkgs, pkg)
-            ctx.env.project.deps[name] = uuid
-            entry = Pkg.Types.manifest_info(ctx.env.manifest, uuid)
-            if VERSION >= VersionNumber("1.11")
-                orig_pkgs[length(orig_pkgs)] = update_package_add(ctx, pkg, entry, nothing, nothing, false)
-            else
-                orig_pkgs[length(orig_pkgs)] = update_package_add(ctx, pkg, entry, false)
-            end
-        end
-
-        global pkgs, deps_map = _resolve(ctx.io, ctx.env, ctx.registries, orig_pkgs, PRESERVE_NONE, ctx.julia_version)
-    end
-end
diff --git a/pkgs/development/julia-modules/stdlib-infos.nix b/pkgs/development/julia-modules/stdlib-infos.nix
new file mode 100644
index 000000000000..1b5d10962c2f
--- /dev/null
+++ b/pkgs/development/julia-modules/stdlib-infos.nix
@@ -0,0 +1,36 @@
+{
+  julia,
+  runCommand,
+}:
+
+let
+  juliaExpression = ''
+    using Pkg
+    open(ENV["out"], "w") do io
+        println(io, "stdlib_root: \"$(Sys.STDLIB)\"")
+
+        println(io, "julia_version: \"$(string(VERSION))\"")
+
+        stdlibs = Pkg.Types.stdlibs()
+        println(io, "stdlibs:")
+        for (uuid, (name, version)) in stdlibs
+            println(io, "  \"$(uuid)\": ")
+            println(io, "    name: $name")
+            println(io, "    version: $version")
+        end
+    end
+  '';
+in
+
+runCommand "julia-stdlib-infos.yml"
+  {
+    buildInputs = [
+      julia
+    ];
+  }
+  ''
+    # Prevent a warning where Julia tries to download package server info
+    export JULIA_PKG_SERVER=""
+
+    julia -e '${juliaExpression}';
+  ''
diff --git a/pkgs/development/julia-modules/tests/julia-top-n/app/Main.hs b/pkgs/development/julia-modules/tests/julia-top-n/app/Main.hs
index c8d935a608b8..2aa81245e67b 100644
--- a/pkgs/development/julia-modules/tests/julia-top-n/app/Main.hs
+++ b/pkgs/development/julia-modules/tests/julia-top-n/app/Main.hs
@@ -12,8 +12,8 @@
 
 module Main (main) where
 
-import Control.Exception
 import Control.Monad
+import Control.Monad.IO.Class
 import Data.Aeson as A hiding (Options, defaultOptions)
 import qualified Data.Aeson.Key             as A
 import qualified Data.Aeson.KeyMap          as HM
@@ -24,12 +24,14 @@ import Data.Text as T hiding (count)
 import qualified Data.Vector as V
 import qualified Data.Yaml as Yaml
 import GHC.Generics
-import Options.Applicative
+import Options.Applicative hiding (info)
 import System.Exit
 import System.FilePath
-import Test.Sandwich hiding (info)
+import Test.Sandwich
+import UnliftIO.Exception
 import UnliftIO.MVar
 import UnliftIO.Process
+import UnliftIO.QSem
 
 
 data Args = Args {
@@ -67,13 +69,15 @@ main = do
     Left err -> throwIO $ userError ("Couldn't decode names and counts YAML file: " <> show err)
     Right x -> pure x
 
-  runSandwichWithCommandLineArgs' defaultOptions argsParser $ do
+  runSandwichWithCommandLineArgs' defaultOptions argsParser $ parallel $ do
     miscTests args
 
     describe ("Building environments for top " <> show topN <> " Julia packages") $
-      parallelN parallelism $
-        forM_ (L.take topN namesAndCounts) $ \(NameAndCount {..}) ->
-          testExpr args name [i|#{juliaAttr}.withPackages ["#{name}"]|]
+      introduce "Introduce parallel semaphore" parallelSemaphore (liftIO $ newQSem parallelism) (const $ return ()) $
+      parallel $
+      forM_ (L.take topN namesAndCounts) $ \(NameAndCount {..}) ->
+      around "Claim semaphore" claimRunSlot $
+      testExpr args name [i|#{juliaAttr}.withPackages ["#{name}"]|]
 
 miscTests :: Args -> SpecFree ctx IO ()
 miscTests args@(Args {..}) = describe "Misc tests" $ do
@@ -89,6 +93,9 @@ miscTests args@(Args {..}) = describe "Misc tests" $ do
                                       };
                                     }) [ "HelloWorld" ]|]
 
+  describe "misc cases" $ do
+    testExpr args "Optimization" [iii|(#{juliaAttr}.withPackages) [ "Optimization" "OptimizationOptimJL" ]|]
+
 -- * Low-level
 
 testExpr :: Args -> Text -> String -> SpecFree ctx IO ()
@@ -98,7 +105,9 @@ testExpr _args name expr = do
       let cp = proc "nix" ["build", "--impure", "--no-link", "--json", "--expr", [i|with import ../../../../. {}; #{expr}|]]
       output <- readCreateProcessWithLogging cp ""
       juliaPath <- case A.eitherDecode (BL8.pack output) of
-        Right (A.Array ((V.!? 0) -> Just (A.Object (aesonLookup "outputs" -> Just (A.Object (aesonLookup "out" -> Just (A.String t))))))) -> pure (JuliaPath ((T.unpack t) </> "bin" </> "julia"))
+        Right (A.Array ((V.!? 0) -> Just (A.Object (aesonLookup "outputs" -> Just (A.Object (aesonLookup "out" -> Just (A.String t))))))) -> do
+          info [i|built: #{t}|]
+          pure (JuliaPath ((T.unpack t) </> "bin" </> "julia"))
         x -> expectationFailure ("Couldn't parse output: " <> show x)
 
       getContext julia >>= flip modifyMVar_ (const $ return (Just juliaPath))
@@ -113,3 +122,8 @@ testExpr _args name expr = do
   where
     aesonLookup :: Text -> HM.KeyMap v -> Maybe v
     aesonLookup = HM.lookup . A.fromText
+
+claimRunSlot :: (HasParallelSemaphore ctx) => ExampleT ctx IO a -> ExampleT ctx IO ()
+claimRunSlot f = do
+  s <- getContext parallelSemaphore
+  bracket_ (liftIO $ waitQSem s) (liftIO $ signalQSem s) (void f)
diff --git a/pkgs/development/julia-modules/util.nix b/pkgs/development/julia-modules/util.nix
index b1c63b2b234e..c9e3fb54e092 100644
--- a/pkgs/development/julia-modules/util.nix
+++ b/pkgs/development/julia-modules/util.nix
@@ -1,5 +1,6 @@
 {
   gitMinimal,
+  lib,
   runCommand,
 }:
 
@@ -10,7 +11,10 @@
   # See https://github.com/NixOS/nixpkgs/pull/97467#issuecomment-689315186
   addPackagesToPython =
     python: packages:
-    if python ? "env" then
+    # TODO: this stopped working because "env" ended up being a key of the base
+    # derivation like "python3" as well. Is there a robust way to determine if
+    # this Python is already wrapped?
+    if python ? "env" && lib.isDerivation python.env then
       python.override (old: {
         extraLibs = old.extraLibs ++ packages;
       })
diff --git a/pkgs/development/libraries/qtutilities/default.nix b/pkgs/development/libraries/qtutilities/default.nix
index 20e2fb5ac02c..f1e07e9d6397 100644
--- a/pkgs/development/libraries/qtutilities/default.nix
+++ b/pkgs/development/libraries/qtutilities/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qtutilities";
-  version = "6.18.0";
+  version = "6.18.1";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = "qtutilities";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-2KEzuYUFmOeDzBU5UX9MknTNvTLX0we7QiUtg5SVUCc=";
+    hash = "sha256-GFLNZgY6Q3+4lsFYznbiVhDqU8ALzVRLO02qmyZrnKw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/aiohomematic/default.nix b/pkgs/development/python-modules/aiohomematic/default.nix
index 51820f1e13ce..9303e7d28bb6 100644
--- a/pkgs/development/python-modules/aiohomematic/default.nix
+++ b/pkgs/development/python-modules/aiohomematic/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "aiohomematic";
-  version = "2025.8.6";
+  version = "2025.8.10";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "SukramJ";
     repo = "aiohomematic";
     tag = version;
-    hash = "sha256-HmcBl+uFjEeyZdilqqTxQ8wrFbDr/8tsh/l0yoVfYJg=";
+    hash = "sha256-ii+fvjn54IT376YzwljPz2tkx2bv8jojI4rNracCgwA=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 7609aaf09d93..72f00018004d 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -359,7 +359,7 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.40.21";
+  version = "1.40.22";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -367,7 +367,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit version;
-    hash = "sha256-7zb2XH/ob/vJPBQY+okEgDzjvP/DyTLD0a4zqdAvoc0=";
+    hash = "sha256-cVpE7wRrVEUfHCIH03nTs6pOrkOk5TrTHiCprJuZdTc=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/botocore-stubs/default.nix b/pkgs/development/python-modules/botocore-stubs/default.nix
index cd38dad91fb6..0897fd501deb 100644
--- a/pkgs/development/python-modules/botocore-stubs/default.nix
+++ b/pkgs/development/python-modules/botocore-stubs/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.40.21";
+  version = "1.40.22";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-Gld35OTwM17X0xhbDypVwfxeoeYP4mTN6lGhccOwsBE=";
+    hash = "sha256-y24G5tSY4WkVl3H91bjYkh9PAZFj4Jke5OSgKM6I+EU=";
   };
 
   nativeBuildInputs = [ setuptools ];
diff --git a/pkgs/development/python-modules/cflib/default.nix b/pkgs/development/python-modules/cflib/default.nix
index a76c9568643d..b5a8ec105851 100644
--- a/pkgs/development/python-modules/cflib/default.nix
+++ b/pkgs/development/python-modules/cflib/default.nix
@@ -34,7 +34,10 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
-  pythonRelaxDeps = [ "numpy" ];
+  pythonRelaxDeps = [
+    "numpy"
+    "packaging"
+  ];
 
   dependencies = [
     libusb-package
diff --git a/pkgs/development/python-modules/cloudcheck/default.nix b/pkgs/development/python-modules/cloudcheck/default.nix
index 9fc21ba22a5f..b9094e6ca190 100644
--- a/pkgs/development/python-modules/cloudcheck/default.nix
+++ b/pkgs/development/python-modules/cloudcheck/default.nix
@@ -24,7 +24,10 @@ buildPythonPackage rec {
     hash = "sha256-z2KJ6EaqQLc2oQBZCfKMejPlTdgYGzmDPm/rGLHXCQA=";
   };
 
-  pythonRelaxDeps = [ "radixtarget" ];
+  pythonRelaxDeps = [
+    "radixtarget"
+    "regex"
+  ];
 
   build-system = [
     poetry-core
diff --git a/pkgs/development/python-modules/colcon-installed-package-information/default.nix b/pkgs/development/python-modules/colcon-installed-package-information/default.nix
new file mode 100644
index 000000000000..09ded6a64ea4
--- /dev/null
+++ b/pkgs/development/python-modules/colcon-installed-package-information/default.nix
@@ -0,0 +1,57 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  # build-system
+  setuptools,
+  # dependencies
+  colcon,
+  importlib-metadata,
+  # tests
+  pytestCheckHook,
+  pytest-cov-stub,
+  scspell,
+  writableTmpDirAsHomeHook,
+}:
+
+buildPythonPackage rec {
+  pname = "colcon-installed-package-information";
+  version = "0.2.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "colcon";
+    repo = "colcon-installed-package-information";
+    tag = version;
+    hash = "sha256-7PjLWLwX5QwxWCN1iWOGB3cyArjnxQKT5BHmukj0MII=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    colcon
+    importlib-metadata
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-cov-stub
+    scspell
+    writableTmpDirAsHomeHook
+  ];
+
+  disabledTestPaths = [
+    # Skip the linter tests that require additional dependencies
+    "test/test_flake8.py"
+  ];
+
+  pythonImportsCheck = [ "colcon_installed_package_information" ];
+
+  meta = {
+    description = "Extensions for colcon to inspect packages which have already been installed";
+    homepage = "https://colcon.readthedocs.io/en/released/";
+    downloadPage = "https://github.com/colcon/colcon-installed-package-information";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ guelakais ];
+  };
+}
diff --git a/pkgs/development/python-modules/datashader/default.nix b/pkgs/development/python-modules/datashader/default.nix
index 6300fc352f3b..0ae4dce1fb7e 100644
--- a/pkgs/development/python-modules/datashader/default.nix
+++ b/pkgs/development/python-modules/datashader/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "datashader";
-  version = "0.18.1";
+  version = "0.18.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "holoviz";
     repo = "datashader";
     tag = "v${version}";
-    hash = "sha256-nQsVuj4zK5bfF617K71n+El5/ZC7vNia7dhrIqv7t+M=";
+    hash = "sha256-ad1L0QyqLtMafFr+ZK1dItlFuPQZ0Caa96RgkLsqNkA=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/deezer-python/default.nix b/pkgs/development/python-modules/deezer-python/default.nix
index 698fad17cb82..bd5dd45e596a 100644
--- a/pkgs/development/python-modules/deezer-python/default.nix
+++ b/pkgs/development/python-modules/deezer-python/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "deezer-python";
-  version = "7.1.1";
+  version = "7.1.2";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "browniebroke";
     repo = "deezer-python";
     tag = "v${version}";
-    hash = "sha256-3TYgOa8NWGhkVIT5HkDdpHGyj7FzP8n02a36KHW6IC4=";
+    hash = "sha256-sPg5jasIOtkpxteKxn8273VQh+OuL+V8/IE9S0lp5ys=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/dissect-fve/default.nix b/pkgs/development/python-modules/dissect-fve/default.nix
index a7608a4012af..cf05f4451e78 100644
--- a/pkgs/development/python-modules/dissect-fve/default.nix
+++ b/pkgs/development/python-modules/dissect-fve/default.nix
@@ -27,6 +27,10 @@ buildPythonPackage rec {
     hash = "sha256-OgagTnt4y6Fzd7jbsCgbkTzcsdnozImfdKI9ew9JaqI=";
   };
 
+  pythonRelaxDeps = [
+    "pycryptodome"
+  ];
+
   build-system = [
     setuptools
     setuptools-scm
diff --git a/pkgs/development/python-modules/django/5_1.nix b/pkgs/development/python-modules/django/5_1.nix
index bf01cf87c85c..7ea62daad3d9 100644
--- a/pkgs/development/python-modules/django/5_1.nix
+++ b/pkgs/development/python-modules/django/5_1.nix
@@ -44,7 +44,7 @@
 
 buildPythonPackage rec {
   pname = "django";
-  version = "5.1.11";
+  version = "5.1.12";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -53,7 +53,7 @@ buildPythonPackage rec {
     owner = "django";
     repo = "django";
     rev = "refs/tags/${version}";
-    hash = "sha256-yHoK7NGa91QEVFLeHqJo126qNg1pTE7W6LEtbCLy4sw=";
+    hash = "sha256-QWBxP728D/HQb+WLPkaXMOQtlO8b+FWcYxZyHoVcxVI=";
   };
 
   patches = [
@@ -72,11 +72,6 @@ buildPythonPackage rec {
       hash = "sha256-+K20/V8sh036Ox9U7CSPgfxue7f28Sdhr3MsB7erVOk=";
     })
   ]
-  ++ lib.optionals (pythonAtLeast "3.13") [
-    # https://code.djangoproject.com/ticket/36499
-    # https://github.com/django/django/pull/19639
-    ./3.13.6-html-parser.patch
-  ]
   ++ lib.optionals withGdal [
     (replaceVars ./django_5_set_geos_gdal_lib.patch {
       geos = geos;
diff --git a/pkgs/development/python-modules/django/5_2.nix b/pkgs/development/python-modules/django/5_2.nix
index c1db9106da63..15d5be84173d 100644
--- a/pkgs/development/python-modules/django/5_2.nix
+++ b/pkgs/development/python-modules/django/5_2.nix
@@ -43,7 +43,7 @@
 
 buildPythonPackage rec {
   pname = "django";
-  version = "5.2.5";
+  version = "5.2.6";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -52,7 +52,7 @@ buildPythonPackage rec {
     owner = "django";
     repo = "django";
     rev = "refs/tags/${version}";
-    hash = "sha256-1Lw0L+mPynf9CmioiTQhePgqCLniUkv9E0ZIoHhhBTs=";
+    hash = "sha256-Bzm4FTzYeXEEFenkT2gN1IzYnUIo7tlD2GI/sX2THkw=";
   };
 
   patches = [
@@ -64,11 +64,6 @@ buildPythonPackage rec {
     # disable test that expects timezone issues
     ./django_5_disable_failing_tests.patch
   ]
-  ++ lib.optionals (pythonAtLeast "3.13") [
-    # https://code.djangoproject.com/ticket/36499
-    # https://github.com/django/django/pull/19639
-    ./3.13.6-html-parser.patch
-  ]
   ++ lib.optionals withGdal [
     (replaceVars ./django_5_set_geos_gdal_lib.patch {
       geos = geos;
diff --git a/pkgs/development/python-modules/granian/default.nix b/pkgs/development/python-modules/granian/default.nix
index 7ba56ea7b8c7..3827b97cadb9 100644
--- a/pkgs/development/python-modules/granian/default.nix
+++ b/pkgs/development/python-modules/granian/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "granian";
-  version = "2.5.1";
+  version = "2.5.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "emmett-framework";
     repo = "granian";
     tag = "v${version}";
-    hash = "sha256-+K1M4cWJkZF7oeod8PMT3hSYERUjsE6rxN3QZlwQnVM=";
+    hash = "sha256-HeTmfOJ5DEW47UJdovqKpbIOGAoKof5wPDJ1VTsFo2o=";
   };
 
   # Granian forces a custom allocator for all the things it runs,
@@ -39,7 +39,7 @@ buildPythonPackage rec {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-JHZiHRfU5CPhKMSdf0nD5SVDPAviyxsJrxhorEg3W64=";
+    hash = "sha256-8bvjetAgTz3mRzC+jI09djyyo9amTrIg4hnZx9ir1wU=";
   };
 
   nativeBuildInputs = with rustPlatform; [
diff --git a/pkgs/development/python-modules/habiticalib/default.nix b/pkgs/development/python-modules/habiticalib/default.nix
index 6973b86e6922..46cc9fd4c64b 100644
--- a/pkgs/development/python-modules/habiticalib/default.nix
+++ b/pkgs/development/python-modules/habiticalib/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "habiticalib";
-  version = "0.4.2";
+  version = "0.4.4";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "tr4nt0r";
     repo = "habiticalib";
     tag = "v${version}";
-    hash = "sha256-LSyFCietbdUTr/kEwNhROeK3eoriyNh2U8jO4Zk9QQc=";
+    hash = "sha256-hnZS6YIO6mZHS3EXEmeTxwT3LhKkQLYYzls6xMDqOBk=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/mocket/default.nix b/pkgs/development/python-modules/mocket/default.nix
index 7c0ae8c4335b..c142f6c6d2e3 100644
--- a/pkgs/development/python-modules/mocket/default.nix
+++ b/pkgs/development/python-modules/mocket/default.nix
@@ -36,12 +36,12 @@
 
 buildPythonPackage rec {
   pname = "mocket";
-  version = "3.13.10";
+  version = "3.13.11";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-MnFH77ryrLyu//IH6FYb3ZVFlsdkimJKzKGbDH1sgmw=";
+    hash = "sha256-kdG2Md90YknRA265u+JjHuiKw/6h1NcdwYOLXy8UF1o=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/moyopy/default.nix b/pkgs/development/python-modules/moyopy/default.nix
new file mode 100644
index 000000000000..34cf7e73d9c0
--- /dev/null
+++ b/pkgs/development/python-modules/moyopy/default.nix
@@ -0,0 +1,80 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  rustPlatform,
+
+  # dependencies
+  typing-extensions,
+
+  # tests
+  numpy,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "moyopy";
+  version = "0.4.4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "spglib";
+    repo = "moyo";
+    tag = "v${version}";
+    hash = "sha256-TWZAqvtPeJqKXUFiNxD8H/aqjiDSWaTkMEQW0cuhEMY=";
+  };
+
+  sourceRoot = "${src.name}/moyopy";
+  cargoRoot = "..";
+
+  nativeBuildInputs = with rustPlatform; [
+    cargoSetupHook
+    maturinBuildHook
+  ];
+
+  env = {
+    CARGO_TARGET_DIR = "./target";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit
+      pname
+      version
+      src
+      sourceRoot
+      cargoRoot
+      ;
+    hash = "sha256-L4SAX4HWx+TSPQm7K6C5IEpFkx/AlscmKRs2wPEQun4=";
+  };
+
+  build-system = [
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+  ];
+
+  dependencies = [
+    typing-extensions
+  ];
+
+  pythonImportsCheck = [ "moyopy" ];
+
+  nativeCheckInputs = [
+    numpy
+    pytestCheckHook
+  ];
+
+  disabledTestPaths = [
+    # Circular dependency with pymatgen
+    "python/tests/test_interface.py"
+  ];
+
+  meta = {
+    description = "Python interface of moyo, a fast and robust crystal symmetry finder";
+    homepage = "https://spglib.github.io/moyo/python/";
+    changelog = "https://github.com/spglib/moyo/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+}
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 2cf6fab1e8ac..5d52bf0b7e75 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -446,8 +446,8 @@ rec {
       "sha256-jtkx0kbI7SB74U5uWyGdVhKMlsy/T82lz3P89k8LMPA=";
 
   mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.40.21"
-      "sha256-Qyut3NPzxS/3A0ntPzzTmPQyldtKetrBdV0Rx6KJGjY=";
+    buildMypyBoto3Package "ec2" "1.40.22"
+      "sha256-/3K4h289byzH6csvWD2SiBSrgjTmfqAsxj3Uxu7Rl3E=";
 
   mypy-boto3-ec2-instance-connect =
     buildMypyBoto3Package "ec2-instance-connect" "1.40.20"
@@ -941,8 +941,8 @@ rec {
       "sha256-w/km0Eq/rEX182tDtxVsFCm3bK2pUr1Fh6ZnsX6thAI=";
 
   mypy-boto3-neptune =
-    buildMypyBoto3Package "neptune" "1.40.0"
-      "sha256-8qRxsvdg0NMRgE3/oMqKkWB/E0/lUKM04rOHSeb4/FA=";
+    buildMypyBoto3Package "neptune" "1.40.22"
+      "sha256-I2YroCl0veUVR3vJ+jXN09SU4oHjhrWS3fR3ZvTV6sY=";
 
   mypy-boto3-neptunedata =
     buildMypyBoto3Package "neptunedata" "1.40.0"
@@ -1417,8 +1417,8 @@ rec {
       "sha256-AgK4Xg1dloJmA+h4+mcBQQVTvYKjLCk5tPDbl/ItCVQ=";
 
   mypy-boto3-workmail =
-    buildMypyBoto3Package "workmail" "1.40.19"
-      "sha256-A5N1xhW0bgB7N60uWf3mqtDAhtRTz05GO7RmapdG1c4=";
+    buildMypyBoto3Package "workmail" "1.40.22"
+      "sha256-Qnuq7/wu/rlW3mr4oCJ5isJJd9SHxzZA/cSiayVpTI0=";
 
   mypy-boto3-workmailmessageflow =
     buildMypyBoto3Package "workmailmessageflow" "1.40.20"
diff --git a/pkgs/development/python-modules/nitrokey/default.nix b/pkgs/development/python-modules/nitrokey/default.nix
index 158925460e5c..8ad52bc039c6 100644
--- a/pkgs/development/python-modules/nitrokey/default.nix
+++ b/pkgs/development/python-modules/nitrokey/default.nix
@@ -17,16 +17,14 @@
 
 buildPythonPackage rec {
   pname = "nitrokey";
-  version = "0.4.0";
+  version = "0.4.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-uZ3KF+8PUwVjwf73buFpq/6Fu+fqkfIecP3A33FmtKk=";
+    hash = "sha256-m351pDLMuZaddbUqJz5r/ljz/vVq+RBDGk4xskc3HCk=";
   };
 
-  disabled = pythonOlder "3.9";
-
   pythonRelaxDeps = [ "protobuf" ];
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/pixel-font-builder/default.nix b/pkgs/development/python-modules/pixel-font-builder/default.nix
index 66ef417e6b5d..c7035184bb96 100644
--- a/pkgs/development/python-modules/pixel-font-builder/default.nix
+++ b/pkgs/development/python-modules/pixel-font-builder/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "pixel-font-builder";
-  version = "0.0.37";
+  version = "0.0.39";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "pixel_font_builder";
     inherit version;
-    hash = "sha256-qlF+dp2umL3H7l/9R5kbpFLOsaZnl5V2WjLaeXMzGls=";
+    hash = "sha256-osEaZDmby0Xcg3oec4m6TEXJQDfMvWeJeLOCIOwEMZA=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/pyannote-metrics/default.nix b/pkgs/development/python-modules/pyannote-metrics/default.nix
index 7c8ade1342b0..ca463bb216cd 100644
--- a/pkgs/development/python-modules/pyannote-metrics/default.nix
+++ b/pkgs/development/python-modules/pyannote-metrics/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "pyannote-metrics";
-  version = "3.2.1";
+  version = "3.3.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "pyannote";
     repo = "pyannote-metrics";
     tag = version;
-    hash = "sha256-V4qyaCaFsoikfFILm2sccf6m7lqJSDTdLxS1sr/LXAY=";
+    hash = "sha256-tinNdFiUISnzUDnzM8wT3+0W8Dlc9gbCiNoIMo9xNKY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pycasbin/default.nix b/pkgs/development/python-modules/pycasbin/default.nix
index 1405569bc3f5..8fdbf648e47a 100644
--- a/pkgs/development/python-modules/pycasbin/default.nix
+++ b/pkgs/development/python-modules/pycasbin/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "pycasbin";
-  version = "2.1.0";
+  version = "2.2.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "casbin";
     repo = "pycasbin";
     tag = "v${version}";
-    hash = "sha256-rlEO6ZBy23MbYICRWOo/RmiphuN5JtiKNK/+k2Ian+g=";
+    hash = "sha256-JSaQq5BX+aXJ2iaCudzbCcMwNnf4INS/iWfMOua6fjw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pymatgen/default.nix b/pkgs/development/python-modules/pymatgen/default.nix
index 36e22e559e1a..4497c333346a 100644
--- a/pkgs/development/python-modules/pymatgen/default.nix
+++ b/pkgs/development/python-modules/pymatgen/default.nix
@@ -46,6 +46,7 @@
 
   # tests
   addBinToPathHook,
+  moyopy,
   pytest-xdist,
   pytestCheckHook,
 }:
@@ -122,6 +123,7 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     addBinToPathHook
+    moyopy
     pytestCheckHook
     pytest-xdist
   ]
@@ -169,11 +171,7 @@ buildPythonPackage rec {
     "test_timer"
   ];
 
-  disabledTestPaths = [
-    # We have not packaged moyopy yet.
-    "tests/analysis/test_prototypes.py::test_get_protostructure_label_from_moyopy"
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+  disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
     # Crash when running the pmg command
     # Critical error: required built-in appearance SystemAppearance not found
     "tests/cli/test_pmg_plot.py"
diff --git a/pkgs/development/python-modules/resend/default.nix b/pkgs/development/python-modules/resend/default.nix
index 11ac2437b948..6b99bb736688 100644
--- a/pkgs/development/python-modules/resend/default.nix
+++ b/pkgs/development/python-modules/resend/default.nix
@@ -11,7 +11,7 @@
 
 buildPythonPackage rec {
   pname = "resend";
-  version = "2.13.0";
+  version = "2.13.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
     owner = "resend";
     repo = "resend-python";
     tag = "v${version}";
-    hash = "sha256-3NMZPoKC2VIsu5A45MkGikB7cfYpswJU8CKpxCdRTcg=";
+    hash = "sha256-TE0sfNg6m71Chl6TPAssEiX+jeeHv0ZYOcv/HOe30OM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/roma/default.nix b/pkgs/development/python-modules/roma/default.nix
index f728bb872c39..9dd6844aa0e2 100644
--- a/pkgs/development/python-modules/roma/default.nix
+++ b/pkgs/development/python-modules/roma/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "roma";
-  version = "1.5.1";
+  version = "1.5.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "naver";
     repo = "roma";
     tag = "v${version}";
-    hash = "sha256-DuQjnHoZKQF/xnFMYb0OXhycsRcK4oHoocq6o+NoGRs=";
+    hash = "sha256-byPW58I+6mCE2fR6eVNQfNDCLbZSfoPmPbc/GuRpKGo=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/smpclient/default.nix b/pkgs/development/python-modules/smpclient/default.nix
index c9c61cef2cf6..1ade72dcb2dd 100644
--- a/pkgs/development/python-modules/smpclient/default.nix
+++ b/pkgs/development/python-modules/smpclient/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "smpclient";
-  version = "5.0.0";
+  version = "5.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "intercreate";
     repo = "smpclient";
     tag = version;
-    hash = "sha256-NQRVEvi/B+KdhPIzw8pm22uXpYPkoaatkCNFnEcibzo=";
+    hash = "sha256-/prS2w14yTT2t/CKDAVimh6lyXx4wRT3wQ1d18dhpSo=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/sopel/default.nix b/pkgs/development/python-modules/sopel/default.nix
index 02da03091cfd..7fc37cd1f6f6 100644
--- a/pkgs/development/python-modules/sopel/default.nix
+++ b/pkgs/development/python-modules/sopel/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "sopel";
-  version = "8.0.3";
+  version = "8.0.4";
   pyproject = true;
 
   disabled = isPyPy || pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-lhoEgfYaqaZfrfVgyHSwl/algqjnvAc/pnVPwK8YdCc=";
+    hash = "sha256-16QDzsZCquAPH3FPyBjxeXGcvSdjYLZFTXN0ASneROU=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/stamina/default.nix b/pkgs/development/python-modules/stamina/default.nix
index 7b764abe8bcb..f21ad8209c6a 100644
--- a/pkgs/development/python-modules/stamina/default.nix
+++ b/pkgs/development/python-modules/stamina/default.nix
@@ -1,17 +1,15 @@
 {
   lib,
+  anyio,
   buildPythonPackage,
+  dirty-equals,
   fetchFromGitHub,
-
   hatch-fancy-pypi-readme,
   hatch-vcs,
   hatchling,
-
+  pytestCheckHook,
   tenacity,
   typing-extensions,
-
-  anyio,
-  pytestCheckHook,
 }:
 
 buildPythonPackage rec {
@@ -26,24 +24,25 @@ buildPythonPackage rec {
     hash = "sha256-TehGqR3vbjLNByHZE2+Ytq52dpEpiL6+7TRUKwXcC1M=";
   };
 
-  nativeBuildInputs = [
+  build-system = [
     hatch-fancy-pypi-readme
     hatch-vcs
     hatchling
   ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     tenacity
     typing-extensions
   ];
 
-  pythonImportsCheck = [ "stamina" ];
-
   nativeCheckInputs = [
-    pytestCheckHook
     anyio
+    dirty-equals
+    pytestCheckHook
   ];
 
+  pythonImportsCheck = [ "stamina" ];
+
   meta = with lib; {
     description = "Production-grade retries for Python";
     homepage = "https://github.com/hynek/stamina";
diff --git a/pkgs/development/python-modules/torch/source/default.nix b/pkgs/development/python-modules/torch/source/default.nix
index cf1794581f51..eb13db86a483 100644
--- a/pkgs/development/python-modules/torch/source/default.nix
+++ b/pkgs/development/python-modules/torch/source/default.nix
@@ -1,7 +1,6 @@
 {
   stdenv,
   lib,
-  pkgs,
   fetchFromGitHub,
   fetchFromGitLab,
   fetchpatch,
@@ -251,9 +250,6 @@ let
     "Magma cudaPackages does not match cudaPackages" =
       cudaSupport
       && (effectiveMagma.cudaPackages.cudaMajorMinorVersion != cudaPackages.cudaMajorMinorVersion);
-    # Should be fixed by WIP https://github.com/NixOS/nixpkgs/pull/438399
-    "ROCm support on non-default python versions is temporarily broken" =
-      rocmSupport && (pkgs.python3.version != python.version);
   };
 
   unroll-src = writeShellScript "unroll-src" ''
diff --git a/pkgs/development/python-modules/torchmetrics/default.nix b/pkgs/development/python-modules/torchmetrics/default.nix
index 08c8964a51f8..e376fe6fbed8 100644
--- a/pkgs/development/python-modules/torchmetrics/default.nix
+++ b/pkgs/development/python-modules/torchmetrics/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "torchmetrics";
-  version = "1.8.1";
+  version = "1.8.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Lightning-AI";
     repo = "torchmetrics";
     tag = "v${version}";
-    hash = "sha256-Qisp5RTfcKr6W9K6FDFUHMqICSpVshsrZWwpDEgTTQM=";
+    hash = "sha256-OsU2JpKcbe1AuSIAyZLjDpFdsSk2q3kMGBcNXtIJm3Q=";
   };
 
   dependencies = [
diff --git a/pkgs/development/python-modules/treelib/default.nix b/pkgs/development/python-modules/treelib/default.nix
index 77b3fc634047..2dd12c5cb06d 100644
--- a/pkgs/development/python-modules/treelib/default.nix
+++ b/pkgs/development/python-modules/treelib/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  poetry-core,
   six,
   pytestCheckHook,
 }:
@@ -9,7 +10,7 @@
 buildPythonPackage rec {
   pname = "treelib";
   version = "1.8.0";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "caesar0301";
@@ -18,7 +19,9 @@ buildPythonPackage rec {
     hash = "sha256-jvaZVy+FUcCcIdvWK6zFL8IBVH+hMiPMmv5shFXLo0k=";
   };
 
-  propagatedBuildInputs = [ six ];
+  build-system = [ poetry-core ];
+
+  dependencies = [ six ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
diff --git a/pkgs/development/rocm-modules/6/composable_kernel/base.nix b/pkgs/development/rocm-modules/6/composable_kernel/base.nix
index 251efb63946d..6856b3378576 100644
--- a/pkgs/development/rocm-modules/6/composable_kernel/base.nix
+++ b/pkgs/development/rocm-modules/6/composable_kernel/base.nix
@@ -8,6 +8,7 @@
   rocm-merged-llvm,
   clr,
   rocminfo,
+  python3,
   hipify,
   gitMinimal,
   gtest,
@@ -69,6 +70,7 @@ stdenv.mkDerivation (finalAttrs: {
     clr
     hipify
     zstd
+    python3
   ];
 
   buildInputs = [
diff --git a/pkgs/development/rocm-modules/6/hiprt/default.nix b/pkgs/development/rocm-modules/6/hiprt/default.nix
index 01deca5685bd..2ba4cd5dcbfe 100644
--- a/pkgs/development/rocm-modules/6/hiprt/default.nix
+++ b/pkgs/development/rocm-modules/6/hiprt/default.nix
@@ -5,6 +5,7 @@
   cmake,
   clr,
   gcc,
+  python3,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -25,6 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     gcc # required for replacing easy-encryption binary
     cmake
+    python3
   ];
 
   buildInputs = [
diff --git a/pkgs/development/rocm-modules/6/rccl/default.nix b/pkgs/development/rocm-modules/6/rccl/default.nix
index 4e7d32bd4bc4..b4c24708eece 100644
--- a/pkgs/development/rocm-modules/6/rccl/default.nix
+++ b/pkgs/development/rocm-modules/6/rccl/default.nix
@@ -11,6 +11,7 @@
   mscclpp,
   perl,
   hipify,
+  python3,
   gtest,
   chrpath,
   rocprofiler,
@@ -62,6 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
     clr
     perl
     hipify
+    python3
     autoPatchelfHook # ASAN doesn't add rpath without this
   ];
 
diff --git a/pkgs/development/rocm-modules/6/rocminfo/default.nix b/pkgs/development/rocm-modules/6/rocminfo/default.nix
index 19d1f76dbbc6..18166bc780df 100644
--- a/pkgs/development/rocm-modules/6/rocminfo/default.nix
+++ b/pkgs/development/rocm-modules/6/rocminfo/default.nix
@@ -30,13 +30,15 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-fQPtO5TNbCbaZZ7VtGkkqng5QZ+FcScdh1opWr5YkLU=";
   };
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     cmake
     rocm-cmake
+    python3
   ];
 
   buildInputs = [ rocm-runtime ];
-  propagatedBuildInputs = [ python3 ];
   cmakeFlags = [ "-DROCRTST_BLD_TYPE=Release" ];
 
   prePatch = ''
@@ -58,6 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "ROCm Application for Reporting System Info";
     homepage = "https://github.com/ROCm/rocminfo";
     license = licenses.ncsa;
+    mainProgram = "rocminfo";
     maintainers = with maintainers; [ lovesegfault ];
     teams = [ teams.rocm ];
     platforms = platforms.linux;
diff --git a/pkgs/games/chiaki-ng/default.nix b/pkgs/games/chiaki-ng/default.nix
index c230fe10768b..3ec054b901ed 100644
--- a/pkgs/games/chiaki-ng/default.nix
+++ b/pkgs/games/chiaki-ng/default.nix
@@ -35,15 +35,15 @@
   xxHash,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "chiaki-ng";
-  version = "1.9.8";
+  version = "1.9.9";
 
   src = fetchFromGitHub {
     owner = "streetpea";
     repo = "chiaki-ng";
-    rev = "v${version}";
-    hash = "sha256-HQmXbi2diewA/+AMjlkyffvD73TkX6D+lMh+FL2Rcz4=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-7pDQnlElnBkW+Nr6R+NaylZbsGH8dB31nd7jxYD66yQ=";
     fetchSubmodules = true;
   };
 
@@ -87,12 +87,6 @@ stdenv.mkDerivation rec {
     xxHash
   ];
 
-  # handle library name discrepancy when curl not built with cmake
-  postPatch = ''
-    substituteInPlace lib/CMakeLists.txt \
-      --replace-fail 'libcurl_shared' 'libcurl'
-  '';
-
   cmakeFlags = [
     "-Wno-dev"
     (lib.cmakeFeature "CHIAKI_USE_SYSTEM_CURL" "true")
@@ -126,4 +120,4 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     mainProgram = "chiaki";
   };
-}
+})
diff --git a/pkgs/servers/home-assistant/custom-components/homematicip_local/package.nix b/pkgs/servers/home-assistant/custom-components/homematicip_local/package.nix
index c7b9cd9b766c..c83d1a0087aa 100644
--- a/pkgs/servers/home-assistant/custom-components/homematicip_local/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/homematicip_local/package.nix
@@ -9,13 +9,13 @@
 buildHomeAssistantComponent rec {
   owner = "SukramJ";
   domain = "homematicip_local";
-  version = "1.85.2";
+  version = "1.86.0";
 
   src = fetchFromGitHub {
     owner = "SukramJ";
     repo = "custom_homematic";
     tag = version;
-    hash = "sha256-uhSpWD7L1T345PjfAgywdscbHKVLKlzUVCG88HaKAac=";
+    hash = "sha256-QGQVSx6yPfT178GAPPbfiOMuEJ6aPFc0SUp5vO9AYUQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/servers/mautrix-telegram/default.nix b/pkgs/servers/mautrix-telegram/default.nix
index ba6e624ba355..a5f25d2c5d09 100644
--- a/pkgs/servers/mautrix-telegram/default.nix
+++ b/pkgs/servers/mautrix-telegram/default.nix
@@ -17,6 +17,7 @@ let
           inherit pname version;
           hash = "sha256-ewqc6s5xXquZJTZVBsFmHeamBLDw6PnTSNcmTNKD0sk=";
         };
+        patches = [ ];
         doCheck = false;
       });
     };
diff --git a/pkgs/servers/minio/default.nix b/pkgs/servers/minio/default.nix
index 0296130ba6a3..430f5a6574fa 100644
--- a/pkgs/servers/minio/default.nix
+++ b/pkgs/servers/minio/default.nix
@@ -30,13 +30,13 @@ let
 in
 buildGoModule rec {
   pname = "minio";
-  version = "2025-07-18T21-56-31Z";
+  version = "2025-07-23T15-54-02Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "minio";
     rev = "RELEASE.${version}";
-    hash = "sha256-kQxCrL1hzyEttpqCtJiK6so8L1bKvKaVU5wGWfb24fM=";
+    hash = "sha256-hBkWekmzTuvA8aiUrZjQXFEDB2+vT42bBy9fl9iXBlo=";
   };
 
   vendorHash = "sha256-XxvSTdHC8l3EwRP8odtcyGv9dlCTCl9dho8BOg6J8zY=";
diff --git a/pkgs/test/default.nix b/pkgs/test/default.nix
index 7d086c0afd22..0b6a0b7375ca 100644
--- a/pkgs/test/default.nix
+++ b/pkgs/test/default.nix
@@ -154,9 +154,7 @@ with pkgs;
 
   go = recurseIntoAttrs (callPackage ../build-support/go/tests.nix { });
 
-  pkg-config = recurseIntoAttrs (callPackage ../top-level/pkg-config/tests.nix { }) // {
-    __recurseIntoDerivationForReleaseJobs = true;
-  };
+  pkg-config = recurseIntoAttrs (callPackage ../top-level/pkg-config/tests.nix { });
 
   buildRustCrate = recurseIntoAttrs (callPackage ../build-support/rust/build-rust-crate/test { });
   importCargoLock = recurseIntoAttrs (callPackage ../build-support/rust/test/import-cargo-lock { });
diff --git a/pkgs/tools/admin/pulumi-bin/data.nix b/pkgs/tools/admin/pulumi-bin/data.nix
index 550e8554482b..c83fd2f26b08 100644
--- a/pkgs/tools/admin/pulumi-bin/data.nix
+++ b/pkgs/tools/admin/pulumi-bin/data.nix
@@ -1,20 +1,20 @@
 # DO NOT EDIT! This file is generated automatically by update.sh
 { }:
 {
-  version = "3.190.0";
+  version = "3.192.0";
   pulumiPkgs = {
     x86_64-linux = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.190.0-linux-x64.tar.gz";
-        sha256 = "0l3vhn847dm9lvd21pcl254ad030ybann4fkrvl37x10znhabkd8";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.192.0-linux-x64.tar.gz";
+        sha256 = "1vpib37pj825vl1v2xp8vzg6fk84vhxsd0c38dljnqh5ypn9d60z";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.42.0-linux-amd64.tar.gz";
         sha256 = "1ppijk93zazfhdfwxdg47xwfvc4s70mir8dpcll5a08xrjccjv9f";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-akamai-v9.0.0-linux-amd64.tar.gz";
-        sha256 = "0xi7c5r4m26m7qn72v8gk2d5a1q7iiny7zh9208g7g3zkmx6qi3x";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-akamai-v9.0.1-linux-amd64.tar.gz";
+        sha256 = "1jql72iwqhxyk5z03fjals4581nf839nq9pjxzcjbvkq0fq3wa0i";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-alicloud-v3.83.0-linux-amd64.tar.gz";
@@ -25,56 +25,56 @@
         sha256 = "07zkrskavhxaghnhdcmprhcpblvz5zvwsypr11vnq0vjjv1vy406";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v3.24.0-linux-amd64.tar.gz";
-        sha256 = "0wajqrdjwfbsvi6isfwiglp60bsdrihp5svbxw44c5wb8hmc3wg9";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v3.26.0-linux-amd64.tar.gz";
+        sha256 = "0b3pw0v6gzqbp4p4khld9ia9vk0x7mv8m11llb1bvksaj21nl474";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v7.4.0-linux-amd64.tar.gz";
-        sha256 = "19y7n0lj610wzwylic9d89qpfachyf1qyqwnzjykchiqkq222yrw";
-      }
-      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v6.25.0-linux-amd64.tar.gz";
-        sha256 = "1nh5w1ay2bf3prnp4bld5d2gidqd6b9iv9dqhlmw23flx5qjlf2y";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v7.6.0-linux-amd64.tar.gz";
+        sha256 = "0b2qwl5481hj077svp9mf0jqf5d18vq7nnhwl4mikag7ddf2b9vn";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v6.5.2-linux-amd64.tar.gz";
         sha256 = "0ivwl6j8ws22lhw4w94450pbri6lvxg3san1hy3bs2gdhp4p7xcz";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v3.10.0-linux-amd64.tar.gz";
-        sha256 = "1wn62hc40zvzr6lh81ha0668y89kfdy67nmc6vpb4jwbr5s8zdvi";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v3.10.1-linux-amd64.tar.gz";
+        sha256 = "0r0s72v99wx2ggb45ifs0hjy76nq8aa6z66zlxjb8wgda3yrsldz";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v6.5.0-linux-amd64.tar.gz";
-        sha256 = "13a1sak2chv56plds2pkb0nr5sw63b1kksmia191zcx0j5s6gnc5";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v6.25.0-linux-amd64.tar.gz";
+        sha256 = "1nh5w1ay2bf3prnp4bld5d2gidqd6b9iv9dqhlmw23flx5qjlf2y";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-consul-v3.13.0-linux-amd64.tar.gz";
-        sha256 = "17gpdyk3lb6js6b5x7dhzppzk1xab7rp7kcapmxjpjvmfbcgqbbj";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v6.8.0-linux-amd64.tar.gz";
+        sha256 = "06x508ksj5avyb7a7sjw7pda60rrbwvdwyc7v0g6fzjqb2v2vl7s";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-datadog-v4.53.0-linux-amd64.tar.gz";
-        sha256 = "11ipmh8rllcylf564cydpx7s92mgygwd6jwqx0ap1dpsi8i78piy";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-consul-v3.13.1-linux-amd64.tar.gz";
+        sha256 = "00gkdgb6s0wqjl6m69sc8dz320aiy2s751qqn73894jyaqa8v9zk";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.51.0-linux-amd64.tar.gz";
-        sha256 = "0ff8kdjy18mqrlihi2rdaf959d2sckc8a4pkcrz98z1xnskm8888";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-datadog-v4.54.0-linux-amd64.tar.gz";
+        sha256 = "1hw1d0jf31kqvcrc0nwi81gjfn06c38f5p5cdlk690dnf4zpb631";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.8.0-linux-amd64.tar.gz";
-        sha256 = "1r4pdqhixlh1hdxj22smj88mrh490p34bsh9dxkqiw2gln1zf1g0";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.52.0-linux-amd64.tar.gz";
+        sha256 = "0p8l9hq9bpk97a5wjmq0drsbg1mjpqwy271pnmijgjajfrqm25vl";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.8.2-linux-amd64.tar.gz";
+        sha256 = "17xhgz6y2z78f2091brm4jslk783dmc3lvaxksi4j8ii6gi2ka0h";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-equinix-metal-v3.2.1-linux-amd64.tar.gz";
         sha256 = "0hnardid0kbzy65dmn7vz8ddy5hq78nf2871zz6srf2hfyiv7qa4";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v10.1.0-linux-amd64.tar.gz";
-        sha256 = "0yzdsz3qmvsim63ndfyw3rikvd3acpwd63hav3n95qc91p7gf92j";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v10.1.1-linux-amd64.tar.gz";
+        sha256 = "17035warwa3grflkkq9bfscp86j9hia7qaarswm3h1cq1l9cmfj4";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v8.40.0-linux-amd64.tar.gz";
-        sha256 = "00w451g5l29vzkl67cp0245hfdnvpp36fzfb72n26i7qljcny3pm";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v8.41.1-linux-amd64.tar.gz";
+        sha256 = "15nz6g0jmv8g9ny83z03d3vv4wr90a6xwl37ylppwwsph52il57n";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v6.7.3-linux-amd64.tar.gz";
@@ -101,8 +101,8 @@
         sha256 = "1l9kjc8xi2hfxskgczxn1a090zg38lpycx7c6kf709ffk5ymjvic";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mailgun-v3.5.10-linux-amd64.tar.gz";
-        sha256 = "192gnwf3kzhy3lzy3d1kvdggrjk9ixi9phq44x35w2pizh13xazn";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mailgun-v3.5.11-linux-amd64.tar.gz";
+        sha256 = "1vvdn7p0m9kyb62r0g52ypidbm7060mhaz1iy0zd7915whxk900p";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mysql-v3.2.11-linux-amd64.tar.gz";
@@ -113,16 +113,16 @@
         sha256 = "07vi2qzapg7dgl8hlikadrc0idlf8xx9fqy3d6v64hbmhabrav6y";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-postgresql-v3.15.2-linux-amd64.tar.gz";
-        sha256 = "0j73752fpljn2gydw1jzp8dknrvx2qcldjjqmd7yigf9spbnagj5";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-postgresql-v3.16.0-linux-amd64.tar.gz";
+        sha256 = "1wyl8xr07b8gj933w7lxip36mc7xxqwb9i46826il7w67gb2vfb4";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.18.3-linux-amd64.tar.gz";
         sha256 = "1n3ndir2n1pq4mmnbkiqvv0rf3w4dgz3a9b221vimsi2lks212kw";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v2.4.0-linux-amd64.tar.gz";
-        sha256 = "0dlg2bpwdh1kwmiwirl0r29sdr49q4wmcj337mg2a5iw9l95wqxn";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v2.5.0-linux-amd64.tar.gz";
+        sha256 = "1r0r4a7j9xx0khj58gzngskc1hps0qsi16disxaj7mgnyan8pp5k";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.124.0-linux-amd64.tar.gz";
@@ -133,24 +133,24 @@
         sha256 = "0pppwgwl726rfy92fnya9afj3cciw13vzs9r60w2477i3250slqj";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tailscale-v0.21.0-linux-amd64.tar.gz";
-        sha256 = "11rpismkdrbvcmfcx49i8wh7c959dm9hm6h6zbw1y0fllqyhhiqv";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tailscale-v0.21.1-linux-amd64.tar.gz";
+        sha256 = "1lj0rrkvx97yqhvd0hbs5i0xf0n0spzmsfdaks5k3q1fvq4k1814";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tls-v5.2.1-linux-amd64.tar.gz";
-        sha256 = "1cwmszvx6q63pdwyv96aphcz42b8vh574x0p02g5qas2d06ynhik";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tls-v5.2.2-linux-amd64.tar.gz";
+        sha256 = "1vh28r2gk85a82c7jsa95n21my19hzavkyc9pjdpw517r63gvyjw";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v7.1.0-linux-amd64.tar.gz";
-        sha256 = "041svni5yqmymfx0kxqm9l4amvnla6sxfvlp1p2fpgw77mdwp98m";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v7.2.1-linux-amd64.tar.gz";
+        sha256 = "14wz8fjkv52z0p2bdh4c6ay6sh8ja0jvzyw3yi4j106b2wq2bvxc";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.11.4-linux-amd64.tar.gz";
         sha256 = "0qznn0lncblhmzclrznblv569s1gkxh1zmh98zxyg5g4h2zz1zci";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.15.0-linux-amd64.tar.gz";
-        sha256 = "14ga54m7xakk5r8bvxhqh88fh6zvd07rsg5gsria0rcganf9kwd6";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.16.0-linux-amd64.tar.gz";
+        sha256 = "0p3rjsppf2zl7xwcs9qr2s262bxkilvzy8yi7nybydhfscl1rmrr";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-wavefront-v3.1.10-linux-amd64.tar.gz";
@@ -163,16 +163,16 @@
     ];
     x86_64-darwin = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.190.0-darwin-x64.tar.gz";
-        sha256 = "0n6lzfal21zh6wx4hr18s32kmp4cr6dqcdg5cq3yll34r54sj4c0";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.192.0-darwin-x64.tar.gz";
+        sha256 = "055ya5ddf2b19h1gkzdyblzib0z7mspy1llp60bphbyn0z4sjkb5";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.42.0-darwin-amd64.tar.gz";
         sha256 = "114g6kzkqyi4ghh9s2bs2fb4x688f7a821yrnw85fhcb4q590ia2";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-akamai-v9.0.0-darwin-amd64.tar.gz";
-        sha256 = "1by1rwasfs7v88f19i4f8d7fd3541h0rbciv4r64ipc5wj329vm1";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-akamai-v9.0.1-darwin-amd64.tar.gz";
+        sha256 = "1fi6y9y151b0c3389p2f7a3m28ay9ka0r57ynpnb8jawflgnx6bc";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-alicloud-v3.83.0-darwin-amd64.tar.gz";
@@ -183,56 +183,56 @@
         sha256 = "0a0yv352abz9av6rkjpwz5k3q7jikhhvbkf8jd7pa387hfzqchrh";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v3.24.0-darwin-amd64.tar.gz";
-        sha256 = "10ir2l4pxlbqn2jf1nh8x9q31msbifdliv75iysg85gnpjd0x2f4";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v3.26.0-darwin-amd64.tar.gz";
+        sha256 = "12zh6cincr7k0pw9fa3r3yfxnwjmsmd6kp31ds585xyz1l9gicn4";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v7.4.0-darwin-amd64.tar.gz";
-        sha256 = "0gn8nmh56viy9f9hii2kckj8j6x3900ydfqkyapwg5w0fgkph2ni";
-      }
-      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v6.25.0-darwin-amd64.tar.gz";
-        sha256 = "10vggqap983dl2l8xps2qm9d4l32slc014y1g6cqc5qiq3zlwhr4";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v7.6.0-darwin-amd64.tar.gz";
+        sha256 = "0b2kl4818wh3wlw4nzl875x8m91f5vfg706pba5pdw3b59891n66";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v6.5.2-darwin-amd64.tar.gz";
         sha256 = "09rn3w7fxkzf2g9rapk52c92039dfrrgx914pkcafg74cs3920ik";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v3.10.0-darwin-amd64.tar.gz";
-        sha256 = "1dwn0xjr0p6rd2r5x59flscfg911xaahp3bvhbkrz8pgkkg6ygcz";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v3.10.1-darwin-amd64.tar.gz";
+        sha256 = "124fk2mxxzc06dav25kk1wn8gqrys6607gg3nm53fk813wx76zg6";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v6.5.0-darwin-amd64.tar.gz";
-        sha256 = "1q24ihrjlx4ikcc42sc3zg3g0p9w4afrsd1r33hckp3makk6cz5c";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v6.25.0-darwin-amd64.tar.gz";
+        sha256 = "10vggqap983dl2l8xps2qm9d4l32slc014y1g6cqc5qiq3zlwhr4";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-consul-v3.13.0-darwin-amd64.tar.gz";
-        sha256 = "0yxaq32jr8y8da3b252fkwh9lhb4jah96zryzqprlgh0jxa4nbcl";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v6.8.0-darwin-amd64.tar.gz";
+        sha256 = "1wflkiphhhv14l3472cdpjvyig5lxc35fi2rsfa27hx83d3c8548";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-datadog-v4.53.0-darwin-amd64.tar.gz";
-        sha256 = "1qc9b3gigzk44x011cckdls33ww5qkd2p0zxnnd7r6ip8nqcl745";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-consul-v3.13.1-darwin-amd64.tar.gz";
+        sha256 = "1n3afyncwk16cbkc8wch3370z08b2vabpvpp8g55xarhqvqk1qpz";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.51.0-darwin-amd64.tar.gz";
-        sha256 = "1fsn7iddjwb0kpr2f9yhaza43ixbn2mg2j0qc1m23yd0p0c0w56c";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-datadog-v4.54.0-darwin-amd64.tar.gz";
+        sha256 = "12yqra9njdkb1nlj7nj2ldinbs37pkslwz5vc11six6zdyh7l6np";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.8.0-darwin-amd64.tar.gz";
-        sha256 = "04l1xy4b1sqncs4s31wwgw1qdpqsmxaf9ydknjcgirw1kd6kap4r";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.52.0-darwin-amd64.tar.gz";
+        sha256 = "1bv76h455iflw1jfjikk9gh8lr1zwm6ils3ibf2nskjkjyw8f3g9";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.8.2-darwin-amd64.tar.gz";
+        sha256 = "1yh74dk52b21nhpvfxmqf033b4n1pavhb4fmsaq1g1j37vzxpcxb";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-equinix-metal-v3.2.1-darwin-amd64.tar.gz";
         sha256 = "1m5lh59h7nck1flzxs9m4n0ag0klk3jmnpf7hc509vffxs89xnjq";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v10.1.0-darwin-amd64.tar.gz";
-        sha256 = "0843nw4w6l2sz0yp5ny39scbx4yz1hzm9c1099cxn764xdbv6w5x";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v10.1.1-darwin-amd64.tar.gz";
+        sha256 = "0hk32m37xiiai14lnq9qc4xsrzr3i2vcvjjj48i909ag1l3c4xgq";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v8.40.0-darwin-amd64.tar.gz";
-        sha256 = "0xnpx9wwswdlfw10l9cx1wx7jz0n3dfsb02sksipp5njkzwfvscq";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v8.41.1-darwin-amd64.tar.gz";
+        sha256 = "16mm0rcgf81misf1vvfzx0mqsa5vyfd60731prl2p39qnpsbjxp0";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v6.7.3-darwin-amd64.tar.gz";
@@ -259,8 +259,8 @@
         sha256 = "00f7ql3am9xmx3vqvv0sg6qrqzgmglngw29drr2rnzjl82m8kazn";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mailgun-v3.5.10-darwin-amd64.tar.gz";
-        sha256 = "11341v1nkr2y0pj3k9d79xwqgwjwxdh4y2zg04qqjrdrikv36n85";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mailgun-v3.5.11-darwin-amd64.tar.gz";
+        sha256 = "0pzc0girgfy3p03rxzwm6n9g72x2qinn4g151dmwl0mdgn0bh8rh";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mysql-v3.2.11-darwin-amd64.tar.gz";
@@ -271,16 +271,16 @@
         sha256 = "0xzj4hjkqppban49jhszm83aqh8fyay55q54pglcmywfihdwf7rr";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-postgresql-v3.15.2-darwin-amd64.tar.gz";
-        sha256 = "1pfkqfviizl1n0kvnm90r02vrnmda0k4a7bhy52dask4vvb3g387";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-postgresql-v3.16.0-darwin-amd64.tar.gz";
+        sha256 = "0vjjki7lzx4kxi91qfsm07vs2jz4nl3l816hcn3kkj22ypnx11w2";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.18.3-darwin-amd64.tar.gz";
         sha256 = "1b3znzx5m20xlvmgj9njmip7q32fs6hm62zfckra73bqh2mc9492";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v2.4.0-darwin-amd64.tar.gz";
-        sha256 = "14h7hrbcwcvfzqklkc13j176ra05i9x94xwj81fa47i9cxi7vsia";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v2.5.0-darwin-amd64.tar.gz";
+        sha256 = "08wkp2axw7w0klpsd0cc4whr2bxdd9m46hh3sz14yxad95xaamzq";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.124.0-darwin-amd64.tar.gz";
@@ -291,24 +291,24 @@
         sha256 = "1jpcyp3lqiz4aab331x7shhqxzp4m6nz68vhkyqksvdplzr9rj44";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tailscale-v0.21.0-darwin-amd64.tar.gz";
-        sha256 = "1fgrnw3vhclfld28rdg6rkr21gfp1q8bxdbkrsim5lvzi80ih18s";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tailscale-v0.21.1-darwin-amd64.tar.gz";
+        sha256 = "0l4fzbsmy3kw223jq4vssggnxzbjp2cl7iwi9qzfxlf17b5kdbjy";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tls-v5.2.1-darwin-amd64.tar.gz";
-        sha256 = "1864rxhdwxqx31kkvfid7n91ia5in6x7q9dqql79kpf9v89zhbcy";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tls-v5.2.2-darwin-amd64.tar.gz";
+        sha256 = "1ji9zz1r7rj57w7spf6mwa9fxl1jgiy0qmxvlia21hpj60b536f5";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v7.1.0-darwin-amd64.tar.gz";
-        sha256 = "066pnfn4s26hx3l1x9d27a076b6py3gn1q9b58li05azy1rr1iwf";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v7.2.1-darwin-amd64.tar.gz";
+        sha256 = "050zdywwjxvkw2qlmxgxmj9cca3xsdrbqs7yfa7a2c182gnim17w";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.11.4-darwin-amd64.tar.gz";
         sha256 = "0sg6j8z1cyzhji2fm61q6mjl5yyfcsfhyi413jyp3d5wkx3spaf2";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.15.0-darwin-amd64.tar.gz";
-        sha256 = "1i5nlxkbzmjxlkcxbf35vvffz8y4f9vnh7bwnvqd31s1ccxv8f89";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.16.0-darwin-amd64.tar.gz";
+        sha256 = "0jrzy2dm6wnkxwk97njhvyw36gy9l1axcw2962drilc60zdc82mb";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-wavefront-v3.1.10-darwin-amd64.tar.gz";
@@ -321,16 +321,16 @@
     ];
     aarch64-linux = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.190.0-linux-arm64.tar.gz";
-        sha256 = "0sb1vz0aykz05wsiv57xgzj7nxvrz04axxwxnlfv3anvma1rdp1i";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.192.0-linux-arm64.tar.gz";
+        sha256 = "146bgfz4ygqn9nlyh0bcl1yngfjqp2a42zjsrg3jdx0vba1gzc1h";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.42.0-linux-arm64.tar.gz";
         sha256 = "04ld832v18f3qsjd1zy11j4ai2gjdb5qmc1w70x1lk5zqi6mmndc";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-akamai-v9.0.0-linux-arm64.tar.gz";
-        sha256 = "0hzr8cyz3l84ad86w4hqqlnx4m63cxk07jinan1li3fv60dg6y1q";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-akamai-v9.0.1-linux-arm64.tar.gz";
+        sha256 = "0dhcqkkmfvryy6smj972jr7z6qaq9kaw8qvlv68b9wgix126dp6s";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-alicloud-v3.83.0-linux-arm64.tar.gz";
@@ -341,56 +341,56 @@
         sha256 = "1qbd2hjbv202afcsm3kfjr50h3a2bnzips29l7a863k8vcd6bhmm";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v3.24.0-linux-arm64.tar.gz";
-        sha256 = "0v5v2chw0d0ff61z6vx1jcr9vs3iaq8pdnqkjvxgfz89jmc638dz";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v3.26.0-linux-arm64.tar.gz";
+        sha256 = "10s6m8arvasspmnwdlffir3x88c4yyvr10jj08aix6ap878sxrlf";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v7.4.0-linux-arm64.tar.gz";
-        sha256 = "0xbh82z6f9vnn3ym9mf9nmpm2ldcybz8i66x6s3ji6964sggvrnj";
-      }
-      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v6.25.0-linux-arm64.tar.gz";
-        sha256 = "1715fxw8y7sknyfwwnpbgjfrjkin70iknpqpafimkzg2n9n3xjbc";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v7.6.0-linux-arm64.tar.gz";
+        sha256 = "0g6kmy5raalxm2wlai71sh70w6vvfgphh2x79fqwn4llmqmrbdvh";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v6.5.2-linux-arm64.tar.gz";
         sha256 = "0gvqc91xd2sk2w5zmvy11m5a92kgry43sajvnlwd8hx04byhlw2s";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v3.10.0-linux-arm64.tar.gz";
-        sha256 = "0bqqng9mpv7k6npdq01w058ram5zmfvand39s075hh73xc6hp5c5";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v3.10.1-linux-arm64.tar.gz";
+        sha256 = "0mmkjim8q5wh0mikwjw3qzg87hm845777jyisz7256p211nrsmyx";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v6.5.0-linux-arm64.tar.gz";
-        sha256 = "1jzkx8blrngx5lh1zylswvdmn9147f40b364qwndy5yh222n4fjx";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v6.25.0-linux-arm64.tar.gz";
+        sha256 = "1715fxw8y7sknyfwwnpbgjfrjkin70iknpqpafimkzg2n9n3xjbc";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-consul-v3.13.0-linux-arm64.tar.gz";
-        sha256 = "1hybm4d3hcp977j0wb4bwl5ndl72cix7b2arw755xd7qw6xxvyrk";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v6.8.0-linux-arm64.tar.gz";
+        sha256 = "1p82d55a423alppisgfi912qiscbawfzqcrlk96l956w4gcnzcb2";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-datadog-v4.53.0-linux-arm64.tar.gz";
-        sha256 = "10bgk3bgh1dnzclj04jcjzddzm718lkzcwmv69vhdgc5ybws4lsv";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-consul-v3.13.1-linux-arm64.tar.gz";
+        sha256 = "15n44dya58sqpirhpiicp1x6w9x15qf94a6vamk2h6jbzpfi7c03";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.51.0-linux-arm64.tar.gz";
-        sha256 = "1l82mm39x4sfnkd97fbygkr3rzj7yiah7a6bscs1zbg5nggfhlhg";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-datadog-v4.54.0-linux-arm64.tar.gz";
+        sha256 = "1rj4wgz9cbcl9pkm0h2i9ykxcjhdgdmcywc8i2p0p991f011jivv";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.8.0-linux-arm64.tar.gz";
-        sha256 = "08ia3kiqr0bynjdcgrxr9g55mxhx4z8nc97kswng7ln7mlb4yzx8";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.52.0-linux-arm64.tar.gz";
+        sha256 = "1i0xrhsm6xiwjs173rhs6faz7x64j5vn47lyxq6pmg83qlg902k0";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.8.2-linux-arm64.tar.gz";
+        sha256 = "147j869ysd9984mdl1hg70b9gmfl6a7cn255nnxa0rgvk15kcggb";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-equinix-metal-v3.2.1-linux-arm64.tar.gz";
         sha256 = "111pia2f5xwkwaqs6p90ri29l5b3ivmahsa1bji4fwyyjyp22h4r";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v10.1.0-linux-arm64.tar.gz";
-        sha256 = "15aivjbj4sl8pck9d339mgngs3habz8vr4gd7hy4i04vykxwiwmg";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v10.1.1-linux-arm64.tar.gz";
+        sha256 = "0ij97gim1dmh73gfxwbj5l59bqhwindxp4r5sj59fmv7ps13d3k0";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v8.40.0-linux-arm64.tar.gz";
-        sha256 = "17z8z3qsdb5qj57b80rqigphjc3qnb31gdm81nw3s56i1xzpv0fl";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v8.41.1-linux-arm64.tar.gz";
+        sha256 = "0zijs8sh75fh8q8lwknvs5j8lkc92lv871ndszcf1qg6gc9197in";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v6.7.3-linux-arm64.tar.gz";
@@ -417,8 +417,8 @@
         sha256 = "19hhlbdwx22yg0x5g6310z2mjsv0wfgwc420a5r6f40jr3fwfnyz";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mailgun-v3.5.10-linux-arm64.tar.gz";
-        sha256 = "17920c9wlaf5yg9q890ypc55d1h1yk8l1jbvgk97g9qdjsm7bia6";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mailgun-v3.5.11-linux-arm64.tar.gz";
+        sha256 = "0by18hd8zyfl0xac4wanz5lq6sw6wmkclvy0va9cjpfgns916qsk";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mysql-v3.2.11-linux-arm64.tar.gz";
@@ -429,16 +429,16 @@
         sha256 = "1xds90d0lg86c1i320bjhqk0h84xl39hwd91gdq9rllrva413cfl";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-postgresql-v3.15.2-linux-arm64.tar.gz";
-        sha256 = "12j121fv3n2p54cmqjbx7yc7p8hqi7sb7bf4pcz6v1mmzxfsfz1c";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-postgresql-v3.16.0-linux-arm64.tar.gz";
+        sha256 = "0arnnishqszj7s9a2azjk0a61n2sp3wb97snj9xpj9bp243w5lmf";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.18.3-linux-arm64.tar.gz";
         sha256 = "02jix4w49n9mal8wg6ixgxvnd865ml7zx0lnz6prckfrzgrj36ih";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v2.4.0-linux-arm64.tar.gz";
-        sha256 = "1y6f2wl56nh57m0gkv21fh53hygjb5kaq40vbdbpa4aa5q80fxq0";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v2.5.0-linux-arm64.tar.gz";
+        sha256 = "1rr0yyczin558p6hj5g9fpb9zyb4rndc772drng3axkvznmjv7r1";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.124.0-linux-arm64.tar.gz";
@@ -449,24 +449,24 @@
         sha256 = "0glljz03v764n53n5l33ji64vj86ipdv5bkr03ijl8wrc22j5syy";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tailscale-v0.21.0-linux-arm64.tar.gz";
-        sha256 = "1dz5d91x40l1fh513b45bphfvx6pc7gzzb3n3h72ssmg2x09rf76";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tailscale-v0.21.1-linux-arm64.tar.gz";
+        sha256 = "0qnh0xmv0mgnk8xz9gwkmx94s43qbg7nig79h7sn5rpqd4bj63qz";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tls-v5.2.1-linux-arm64.tar.gz";
-        sha256 = "1pl4kn79j8ha270q2vkx5rcapslx7yhxja13ssggn2api1zi4w6d";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tls-v5.2.2-linux-arm64.tar.gz";
+        sha256 = "1zbm7ql3rqypqmckbmlzbiy4akmqjkbzfkl7788q6sm7xh6bm8q1";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v7.1.0-linux-arm64.tar.gz";
-        sha256 = "1i8jrny0aq22x9kb3qglhmp025bjwj5xvi5znc1c3p9a6q41z63s";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v7.2.1-linux-arm64.tar.gz";
+        sha256 = "0nc4yn7y2wlkarn2n7s4nl9fkhqjprl1cswnrybbhdi6h3hf1zjn";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.11.4-linux-arm64.tar.gz";
         sha256 = "1p95vhwl44iq6yd9ycccwa2sbhcx6x5pxwk21wbzy5lsg8nhsa2h";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.15.0-linux-arm64.tar.gz";
-        sha256 = "08s8asqcl859sm7ifaysdk0d14bwyiridnk16f64k4prdiq6dqii";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.16.0-linux-arm64.tar.gz";
+        sha256 = "1sbxv37pi1yy6dvjz0yifj44l68mscxaf033a7nbgb3281r15lq1";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-wavefront-v3.1.10-linux-arm64.tar.gz";
@@ -479,16 +479,16 @@
     ];
     aarch64-darwin = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.190.0-darwin-arm64.tar.gz";
-        sha256 = "1vh5w2p8c6jv9a2l4hgk0b5hg9ad6rsk6jjjzr1b1cry0sz2csgl";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.192.0-darwin-arm64.tar.gz";
+        sha256 = "0pad07m4s04fmpbn7h1lq13zq5jxsbsry96135izr9ghk303wslm";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.42.0-darwin-arm64.tar.gz";
         sha256 = "1afm9ng48h5zf07jas6bgyq0jsn0r9gs3bm7dmwrf41vfin75kw0";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-akamai-v9.0.0-darwin-arm64.tar.gz";
-        sha256 = "0n8d67nzpas21mmxc6vl2vqqq4vgd54gr9r94dcm2666ssad6ii4";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-akamai-v9.0.1-darwin-arm64.tar.gz";
+        sha256 = "184s2cmnn8nn17bvkgbsxfhllc4bi86m1awa77n2rc7gcszj203h";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-alicloud-v3.83.0-darwin-arm64.tar.gz";
@@ -499,56 +499,56 @@
         sha256 = "063y0bhim02sydknk5ijsb0574f80rv3hsqv2h63iz6pj1si5sfd";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v3.24.0-darwin-arm64.tar.gz";
-        sha256 = "0xfq38zx5sy6fq3x3kl24qg7j2sfap7rq9qkc7zy7sx2x9ckddbv";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v3.26.0-darwin-arm64.tar.gz";
+        sha256 = "10g7mir6cgdpwvai6qdccl72wqi2zqpkn401vhli41z2dcv0gpnb";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v7.4.0-darwin-arm64.tar.gz";
-        sha256 = "0sdbcbx3nh3vm5gzhxdqiddjxdyl0x071n1a06qcjg7yvv4a47ah";
-      }
-      {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v6.25.0-darwin-arm64.tar.gz";
-        sha256 = "1ladpq9i6iyafsrm7wfgl35hfxfx0d769hh2894j0a7msfkj4cxj";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aws-v7.6.0-darwin-arm64.tar.gz";
+        sha256 = "1i1xzsvpy60igksj9x25nn8b473hbhzg6whhjdk45ic8z8n5n5pq";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuread-v6.5.2-darwin-arm64.tar.gz";
         sha256 = "0vp65ccimrzhbg3h7rq1p18rjwhb2b4s0y90wvan22nsvwnv5b0p";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v3.10.0-darwin-arm64.tar.gz";
-        sha256 = "1j3anypzdv3qicg5nagn6zckxr877f39kzazdi0slki9cpwnzkhi";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azuredevops-v3.10.1-darwin-arm64.tar.gz";
+        sha256 = "00gahf4jlihzywbsd7rmw73jrnjfdsqxhag4qm7ms90gwl5qspa4";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v6.5.0-darwin-arm64.tar.gz";
-        sha256 = "1w2fy9hvzr3z3cmkm7krxr9hsrmdzylr5d8dsssr3fmw5sqr9zr8";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-azure-v6.25.0-darwin-arm64.tar.gz";
+        sha256 = "1ladpq9i6iyafsrm7wfgl35hfxfx0d769hh2894j0a7msfkj4cxj";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-consul-v3.13.0-darwin-arm64.tar.gz";
-        sha256 = "1w1xhhrhw0l7442s88h5hs9qzm8k0ihm41mgzz2s3843gqpq9ay7";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-cloudflare-v6.8.0-darwin-arm64.tar.gz";
+        sha256 = "1bdcfwhp1r518mlixl94rmlqrwriljgf55rj9jj424isc29ryx3i";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-datadog-v4.53.0-darwin-arm64.tar.gz";
-        sha256 = "0ns4nijkgvavy5bxsvq7qgc9pnsy25isdm8gwym2r0q63pgqlkqd";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-consul-v3.13.1-darwin-arm64.tar.gz";
+        sha256 = "1lva9jp2fbz58gfgsdbwlyrdd60wpy1xy55af7f8dmabgcc8j391";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.51.0-darwin-arm64.tar.gz";
-        sha256 = "1z3md6bk08pzr559yds1rw4brgrvwdz472r97yhhknw9w6aw4lyw";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-datadog-v4.54.0-darwin-arm64.tar.gz";
+        sha256 = "10siibgg271qg5czrhd8xv20dn4allix8qhmlabbqkih0zwdimyr";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.8.0-darwin-arm64.tar.gz";
-        sha256 = "0r4rbsbgg14n90wa8y1inmynmdlqp31p9qdmfzjrl6ikd3s8z5fm";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-digitalocean-v4.52.0-darwin-arm64.tar.gz";
+        sha256 = "1mw9dnjp62944zijpg25s0zvdm4wjh7mljj1pqxnmjim30jxa17k";
+      }
+      {
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-docker-v4.8.2-darwin-arm64.tar.gz";
+        sha256 = "0kd9wp3g2lfcrisp0v443cb2ih6wgx8p40mg0j0fy50rb0hmaqlk";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-equinix-metal-v3.2.1-darwin-arm64.tar.gz";
         sha256 = "12bzicm43l7yvh02v5fx3z8v46l9i7a9f677735xi5rjbmd2an4c";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v10.1.0-darwin-arm64.tar.gz";
-        sha256 = "09wwvhxchd5qkvq3rk6k742arfk3y5ysxvcygn56pvbwjlzjc654";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-fastly-v10.1.1-darwin-arm64.tar.gz";
+        sha256 = "0y3hhvp21j1xm7pmfq7j2mzdvz68zc2ljn0sxbiv50084m9vaa7y";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v8.40.0-darwin-arm64.tar.gz";
-        sha256 = "1bdwhdm9ghgbqvirwikcsld7388wf78vdn3lwr579brsxynh3iay";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-gcp-v8.41.1-darwin-arm64.tar.gz";
+        sha256 = "108pvbzr4l0qrl521404jj83calpqyhj6n7wy4w746zg9nkrzy0z";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-github-v6.7.3-darwin-arm64.tar.gz";
@@ -575,8 +575,8 @@
         sha256 = "13n9mdhfnnrcfaasr2ca0myyrk09mbazllzhrrxkriahw64a878h";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mailgun-v3.5.10-darwin-arm64.tar.gz";
-        sha256 = "1lg4jqficsy58wyl52gwqx5ch1wmasnz96ipcyci79dlpz6dbksg";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mailgun-v3.5.11-darwin-arm64.tar.gz";
+        sha256 = "1kkbgmhgp02qzxsh37m9x3jahwjnq5ls9dhjhgbxjjq6xalcqf79";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mysql-v3.2.11-darwin-arm64.tar.gz";
@@ -587,16 +587,16 @@
         sha256 = "12b397zam5m3d88kbcj1jj84qss8a81haf6bwhw7xhzq278i0rm1";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-postgresql-v3.15.2-darwin-arm64.tar.gz";
-        sha256 = "1braby52wys2ddfbb99yhhn6n3izr4sc70b7jl6ryrb6b17qqk0f";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-postgresql-v3.16.0-darwin-arm64.tar.gz";
+        sha256 = "0k7w2a1zppw1pgy077iidvnlic21ynw4w7f15z3hw793inzj2wm3";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-random-v4.18.3-darwin-arm64.tar.gz";
         sha256 = "1bb3bzybmfi5blagh13bm6q1avjbp80lmjdv4q5yc2dbfbs653xi";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v2.4.0-darwin-arm64.tar.gz";
-        sha256 = "1c3qy2a4i96f9ybmkzs6jslarncg35r02r86q96pz0j5i9zz8fsn";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-snowflake-v2.5.0-darwin-arm64.tar.gz";
+        sha256 = "0zwa32wdf6cbiq00fc7xpkpzawnx4spa8qc6hgznvz9p27d9pim0";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-spotinst-v3.124.0-darwin-arm64.tar.gz";
@@ -607,24 +607,24 @@
         sha256 = "1c4pn5nr8d97n9bqd7vz9gzlbi50hnfjylwwch445ylqp5l8gvqf";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tailscale-v0.21.0-darwin-arm64.tar.gz";
-        sha256 = "0pywbp952p7n1gh1rwdxkk1nvp7ri4kzanvi4qs3ca1nw7dvalqy";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tailscale-v0.21.1-darwin-arm64.tar.gz";
+        sha256 = "0fafswdlzk0d8q8rcnzvlmzfygssyh3xjk33i8c3c6p3b6q3xksd";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tls-v5.2.1-darwin-arm64.tar.gz";
-        sha256 = "0mz13356yyml557s5bxm0f30ypxjkv399jn6bacy5isi7qlv4d01";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-tls-v5.2.2-darwin-arm64.tar.gz";
+        sha256 = "1qih4kprfaa82p7mg4zg8amy8vp4c76vqkmwf3df2x8bn69jdrc0";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v7.1.0-darwin-arm64.tar.gz";
-        sha256 = "0kn0plsw4qj9jky6mmbvla3ql6bqdajz0c54cqsjvxz6qjswrjnn";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vault-v7.2.1-darwin-arm64.tar.gz";
+        sha256 = "0zl97iwv90qp1rwnpfb95abjc8g5zl3gkxy0r3gm5ni60073046p";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-venafi-v1.11.4-darwin-arm64.tar.gz";
         sha256 = "0zb2v0mjqzvgasb8xi8svi7770hp8fabga7whd4vybdcildwp83s";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.15.0-darwin-arm64.tar.gz";
-        sha256 = "0ilqpzcjfnj0496s5pagzsykp5sjxm1a72gxyp33pk5wjcic7la5";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-vsphere-v4.16.0-darwin-arm64.tar.gz";
+        sha256 = "1x3g6j9adkc1k937s271zqwk82w9w07fkm4d8dwcv85sf1m1phhj";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-wavefront-v3.1.10-darwin-arm64.tar.gz";
diff --git a/pkgs/tools/networking/flannel/default.nix b/pkgs/tools/networking/flannel/default.nix
index 227dc6d4053e..f43f4bbf474e 100644
--- a/pkgs/tools/networking/flannel/default.nix
+++ b/pkgs/tools/networking/flannel/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "flannel";
-  version = "0.27.2";
+  version = "0.27.3";
   rev = "v${version}";
 
-  vendorHash = "sha256-48/BYhVWS/Tp1UKgpGX31/gdMC1xpWr06+Y+WoXPAs4=";
+  vendorHash = "sha256-JchHjQh1ZP6wdpgUwfNyhD93Wlf4FvCD0h4Tte47z3U=";
 
   src = fetchFromGitHub {
     inherit rev;
     owner = "flannel-io";
     repo = "flannel";
-    sha256 = "sha256-d92kv1cWwZr4BzrFaI3t/JBvYERaClqFSRzrAUFkqRc=";
+    sha256 = "sha256-r+9pII4zlPJ7UNdE0sR6Aul7p0sK+BRHq71S+NEekvM=";
   };
 
   ldflags = [ "-X github.com/flannel-io/flannel/pkg/version.Version=${rev}" ];
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 39e546b0651e..37e3ebd4b612 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -131,8 +131,8 @@ lib.makeExtensible (
   (
     {
       nix_2_28 = commonMeson {
-        version = "2.28.4";
-        hash = "sha256-V1tPrBkPteqF8VWUgpotNFYJ2Xm6WmB3aMPexuEHl9I=";
+        version = "2.28.5";
+        hash = "sha256-oIfAHxO+BCtHXJXLHBnsKkGl1Pw+Uuq1PwNxl+lZ+Oc=";
         self_attribute_name = "nix_2_28";
       };
 
diff --git a/pkgs/tools/virtualization/mkosi/default.nix b/pkgs/tools/virtualization/mkosi/default.nix
index 42705165bf61..10108277497e 100644
--- a/pkgs/tools/virtualization/mkosi/default.nix
+++ b/pkgs/tools/virtualization/mkosi/default.nix
@@ -58,7 +58,7 @@ let
 in
 python3Packages.buildPythonApplication rec {
   pname = "mkosi";
-  version = "25.3-unstable-2025-04-01";
+  version = "25.3";
   format = "pyproject";
 
   outputs = [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index dbda0ca4014e..6a6e8b70cef6 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4719,6 +4719,8 @@ with pkgs;
     crystal_1_11
     crystal_1_14
     crystal_1_15
+    crystal_1_16
+    crystal_1_17
     crystal
     ;
 
@@ -5152,10 +5154,7 @@ with pkgs;
           haskell.packages.ghc96
         else
           haskell.packages.ghc98
-      )
-    // {
-      __recurseIntoDerivationForReleaseJobs = true;
-    };
+      );
 
   # haskellPackages.ghc is build->host (it exposes the compiler used to build the
   # set, similarly to stdenv.cc), but pkgs.ghc should be host->target to be more
@@ -8798,22 +8797,18 @@ with pkgs;
     }
   );
 
-  libsForQt5 =
-    (recurseIntoAttrs (
-      import ./qt5-packages.nix {
-        inherit
-          lib
-          config
-          __splicedPackages
-          makeScopeWithSplicing'
-          generateSplicesForMkScope
-          pkgsHostTarget
-          ;
-      }
-    ))
-    // {
-      __recurseIntoDerivationForReleaseJobs = true;
-    };
+  libsForQt5 = recurseIntoAttrs (
+    import ./qt5-packages.nix {
+      inherit
+        lib
+        config
+        __splicedPackages
+        makeScopeWithSplicing'
+        generateSplicesForMkScope
+        pkgsHostTarget
+        ;
+    }
+  );
 
   # plasma5Packages maps to the Qt5 packages set that is used to build the plasma5 desktop
   plasma5Packages = libsForQt5;
@@ -10442,7 +10437,8 @@ with pkgs;
 
   jool-cli = callPackage ../os-specific/linux/jool/cli.nix { };
 
-  libkrun-sev = libkrun.override { sevVariant = true; };
+  libkrun-sev = libkrun.override { variant = "sev"; };
+  libkrun-tdx = libkrun.override { variant = "tdx"; };
 
   linthesia = callPackage ../games/linthesia/default.nix { };
 
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index 26829450d243..8f3f0fd241c5 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -781,7 +781,6 @@ in
       linux_libre = recurseIntoAttrs (packagesFor kernels.linux_libre);
 
       linux_latest_libre = recurseIntoAttrs (packagesFor kernels.linux_latest_libre);
-      __recurseIntoDerivationForReleaseJobs = true;
     }
     // lib.optionalAttrs config.allowAliases {
 
diff --git a/pkgs/top-level/pkg-config/tests.nix b/pkgs/top-level/pkg-config/tests.nix
index 345283f83d81..4f3e6c8fb7cf 100644
--- a/pkgs/top-level/pkg-config/tests.nix
+++ b/pkgs/top-level/pkg-config/tests.nix
@@ -22,7 +22,5 @@ let
   };
 in
 lib.recurseIntoAttrs {
-  defaultPkgConfigPackages = allPkgs.callPackage ./test-defaultPkgConfigPackages.nix { } // {
-    __recurseIntoDerivationForReleaseJobs = true;
-  };
+  defaultPkgConfigPackages = allPkgs.callPackage ./test-defaultPkgConfigPackages.nix { };
 }
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e2e934c1be5e..c2829650473c 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2805,6 +2805,10 @@ self: super: with self; {
 
   colcon-defaults = callPackage ../development/python-modules/colcon-defaults { };
 
+  colcon-installed-package-information =
+    callPackage ../development/python-modules/colcon-installed-package-information
+      { };
+
   colcon-library-path = callPackage ../development/python-modules/colcon-library-path { };
 
   colcon-mixin = callPackage ../development/python-modules/colcon-mixin { };
@@ -9615,6 +9619,8 @@ self: super: with self; {
 
   moviepy = callPackage ../development/python-modules/moviepy { };
 
+  moyopy = callPackage ../development/python-modules/moyopy { };
+
   mozart-api = callPackage ../development/python-modules/mozart-api { };
 
   mozilla-django-oidc = callPackage ../development/python-modules/mozilla-django-oidc { };
diff --git a/pkgs/top-level/release-attrpaths-superset.nix b/pkgs/top-level/release-attrpaths-superset.nix
deleted file mode 100644
index 80544ced5165..000000000000
--- a/pkgs/top-level/release-attrpaths-superset.nix
+++ /dev/null
@@ -1,114 +0,0 @@
-# This expression will, as efficiently as possible, dump a
-# *superset* of all attrpaths of derivations which might be
-# part of a release on *any* platform.
-#
-# Both this expression and what ofborg uses (release-outpaths.nix)
-# are essentially single-threaded (under the current cppnix
-# implementation).
-#
-# This expression runs much, much, much faster and uses much, much
-# less memory than the ofborg script by skipping the
-# platform-relevance checks.  The ofborg outpaths.nix script takes
-# half an hour on a 3ghz core and peaks at 60gbytes of memory; this
-# expression runs on the same machine in 44 seconds with peak memory
-# usage of 5gbytes.
-#
-# Once you have the list of attrnames you can split it up into
-# $NUM_CORES batches and run the platform checks separately for each
-# batch, in parallel.
-#
-# To dump the attrnames:
-#
-#   nix-instantiate --eval --strict --json pkgs/top-level/release-attrpaths-superset.nix -A names
-#
-{
-  lib ? import (path + "/lib"),
-  trace ? false,
-  checkMeta ? true,
-  path ? ./../..,
-}:
-let
-
-  # The intended semantics are that an attrpath rooted at pkgs is
-  # part of the (unfiltered) release jobset iff both of the following
-  # are true:
-  #
-  # 1. The attrpath leads to a value for which lib.isDerivation is true
-  #
-  # 2. Any proper prefix of the attrpath at which lib.isDerivation
-  #    is true also has __recurseIntoDerivationForReleaseJobs=true.
-  #
-  # The second condition is unfortunately necessary because there are
-  # Hydra release jobnames which have proper prefixes which are
-  # attrnames of derivations (!).  We should probably restructure
-  # the job tree so that this is not the case.
-  #
-  justAttrNames =
-    path: value:
-    let
-      result =
-        if path == [ "AAAAAASomeThingsFailToEvaluate" ] then
-          [ ]
-        else if
-          lib.isDerivation value
-          &&
-            # in some places we have *derivations* with jobsets as subattributes, ugh
-            !(value.__recurseIntoDerivationForReleaseJobs or false)
-        then
-          [ path ]
-
-        # Even wackier case: we have meta.broken==true jobs with
-        # !meta.broken jobs as subattributes with license=unfree, and
-        # check-meta.nix won't throw an "unfree" failure because the
-        # enclosing derivation is marked broken.  Yeah.  Bonkers.
-        # We should just forbid jobsets enclosed by derivations.
-        else if lib.isDerivation value && !value.meta.available then
-          [ ]
-
-        else if !(lib.isAttrs value) then
-          [ ]
-        else
-          lib.pipe value [
-            (builtins.mapAttrs (
-              name: value:
-              builtins.addErrorContext "while evaluating package set attribute path '${
-                lib.showAttrPath (path ++ [ name ])
-              }'" (justAttrNames (path ++ [ name ]) value)
-            ))
-            builtins.attrValues
-            builtins.concatLists
-          ];
-    in
-    if !trace then result else lib.trace "** ${lib.concatStringsSep "." path}" result;
-
-  releaseOutpaths = import ./release-outpaths.nix {
-    inherit checkMeta;
-    attrNamesOnly = true;
-    inherit path;
-  };
-
-  paths = [
-    # I am not entirely sure why these three packages end up in
-    # the Hydra jobset.  But they do, and they don't meet the
-    # criteria above, so at the moment they are special-cased.
-    [
-      "pkgsLLVM"
-      "stdenv"
-    ]
-    [
-      "pkgsStatic"
-      "stdenv"
-    ]
-    [
-      "pkgsMusl"
-      "stdenv"
-    ]
-  ]
-  ++ justAttrNames [ ] releaseOutpaths;
-
-  names = map (path: (lib.concatStringsSep "." path)) paths;
-
-in
-{
-  inherit paths names;
-}
diff --git a/pkgs/top-level/release-python.nix b/pkgs/top-level/release-python.nix
index 18774202503f..b02b749577a9 100644
--- a/pkgs/top-level/release-python.nix
+++ b/pkgs/top-level/release-python.nix
@@ -36,11 +36,7 @@ let
       res = builtins.tryEval (
         if isDerivation value then
           value.meta.isBuildPythonPackage or [ ]
-        else if
-          value.recurseForDerivations or false
-          || value.recurseForRelease or false
-          || value.__recurseIntoDerivationForReleaseJobs or false
-        then
+        else if value.recurseForDerivations or false || value.recurseForRelease or false then
           packagePython value
         else
           [ ]
diff --git a/pkgs/top-level/release-unfree-redistributable.nix b/pkgs/top-level/release-unfree-redistributable.nix
index 45940c4d02cc..cf5c8a4d4987 100644
--- a/pkgs/top-level/release-unfree-redistributable.nix
+++ b/pkgs/top-level/release-unfree-redistributable.nix
@@ -69,11 +69,7 @@ let
               value.meta.hydraPlatforms
                 or (lib.subtractLists (value.meta.badPlatforms or [ ]) (value.meta.platforms or [ "x86_64-linux" ]))
             )
-          else if
-            value.recurseForDerivations or false
-            || value.recurseForRelease or false
-            || value.__recurseIntoDerivationForReleaseJobs or false
-          then
+          else if value.recurseForDerivations or false || value.recurseForRelease or false then
             # Recurse
             packagesWith attrPath cond value
           else
diff --git a/pkgs/top-level/release.nix b/pkgs/top-level/release.nix
index f2fb056ab1ca..6f35d9c84f73 100644
--- a/pkgs/top-level/release.nix
+++ b/pkgs/top-level/release.nix
@@ -57,12 +57,10 @@
   # resulting tree of attributes to *not* have a ".${system}"
   # suffixed upon every job name like Hydra expects.
   #
-  # This flag exists mainly for use by
-  # pkgs/top-level/release-attrnames-superset.nix; see that file for
-  # full details.  The exact behavior of this flag may change; it
-  # should be considered an internal implementation detail of
-  # pkgs/top-level/.
-  #
+  # This flag exists mainly for use by ci/eval/attrpaths.nix; see
+  # that file for full details.  The exact behavior of this flag
+  # may change; it should be considered an internal implementation
+  # detail of ci/eval.
   attrNamesOnly ? false,
 }: