diff --git a/doc/release-notes/rl-2505.section.md b/doc/release-notes/rl-2505.section.md
index defb47f1e5b6..fb46f6ac04d6 100644
--- a/doc/release-notes/rl-2505.section.md
+++ b/doc/release-notes/rl-2505.section.md
@@ -374,6 +374,7 @@
   - `i18n.extraLocales` should now be the preferred way to install additional locales.
   - `i18n.supportedLocales` is now considered an implementation detail and will be hidden from the documentation. But the option will still continue to work.
   - `i18n.supportedLocales` will now trigger a warning when it omits any locale set in `i18n.defaultLocale`, `i18n.extraLocales` or `i18n.extraLocaleSettings`.
+  - The options `i18n.defaultCharset` & `i18n.localeCharsets` were added, and they complement `i18n.defaultLocale` & `i18n.extraLocaleSettings` respectively - allowing to control the character set used per locale setting.
 
 - `titaniumenv`, `titanium`, and `titanium-alloy` have been removed due to lack of maintenance in Nixpkgs []{#sec-nixpkgs-release-25.05-incompatibilities-titanium-removed}.
 
diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index a396aa591703..794c0dc6a633 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -18,6 +18,8 @@
 
 - The `services.polipo` module has been removed as `polipo` is unmaintained and archived upstream.
 
+- `renovate` was updated to v40. See the [upstream release notes](https://github.com/renovatebot/renovate/releases/tag/40.0.0) for breaking changes.
+
 ## Other Notable Changes {#sec-release-25.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/config/i18n.nix b/nixos/modules/config/i18n.nix
index 42b91ff9628a..22a47d5bdffa 100644
--- a/nixos/modules/config/i18n.nix
+++ b/nixos/modules/config/i18n.nix
@@ -5,15 +5,19 @@
   ...
 }:
 let
+  sanitizeUTF8Capitalization =
+    lang: (lib.replaceStrings [ "utf8" "utf-8" "UTF8" ] [ "UTF-8" "UTF-8" "UTF-8" ] lang);
   aggregatedLocales =
-    (builtins.map
-      (l: (lib.replaceStrings [ "utf8" "utf-8" "UTF8" ] [ "UTF-8" "UTF-8" "UTF-8" ] l) + "/UTF-8")
-      (
-        [ config.i18n.defaultLocale ]
-        ++ (lib.optionals (builtins.isList config.i18n.extraLocales) config.i18n.extraLocales)
-        ++ (lib.attrValues (lib.filterAttrs (n: v: n != "LANGUAGE") config.i18n.extraLocaleSettings))
-      )
-    )
+    [
+      "${config.i18n.defaultLocale}/${config.i18n.defaultCharset}"
+    ]
+    ++ lib.pipe config.i18n.extraLocaleSettings [
+      (lib.mapAttrs (n: v: (sanitizeUTF8Capitalization v)))
+      (lib.mapAttrsToList (LCRole: lang: lang + "/" + (config.i18n.localeCharsets.${LCRole} or "UTF-8")))
+    ]
+    ++ (builtins.map sanitizeUTF8Capitalization (
+      lib.optionals (builtins.isList config.i18n.extraLocales) config.i18n.extraLocales
+    ))
     ++ (lib.optional (builtins.isString config.i18n.extraLocales) config.i18n.extraLocales);
 in
 {
@@ -48,16 +52,24 @@ in
         default = "en_US.UTF-8";
         example = "nl_NL.UTF-8";
         description = ''
-          The default locale.  It determines the language for program
-          messages, the format for dates and times, sort order, and so on.
-          It also determines the character set, such as UTF-8.
+          The default locale. It determines the language for program messages,
+          the format for dates and times, sort order, and so on. Setting the
+          default character set is done via {option}`i18n.defaultCharset`.
+        '';
+      };
+      defaultCharset = lib.mkOption {
+        type = lib.types.str;
+        default = "UTF-8";
+        example = "ISO-8859-8";
+        description = ''
+          The default locale character set.
         '';
       };
 
       extraLocales = lib.mkOption {
         type = lib.types.either (lib.types.listOf lib.types.str) (lib.types.enum [ "all" ]);
         default = [ ];
-        example = [ "nl_NL.UTF-8" ];
+        example = [ "nl_NL.UTF-8/UTF-8" ];
         description = ''
           Additional locales that the system should support, besides the ones
           configured with {option}`i18n.defaultLocale` and
@@ -74,9 +86,24 @@ in
           LC_TIME = "de_DE.UTF-8";
         };
         description = ''
-          A set of additional system-wide locale settings other than
-          `LANG` which can be configured with
-          {option}`i18n.defaultLocale`.
+          A set of additional system-wide locale settings other than `LANG`
+          which can be configured with {option}`i18n.defaultLocale`. Note that
+          the `/UTF-8` suffix used in {option}`i18n.extraLocales` indicates a
+          character set, and it must not be added manually here. To use a
+          non-`UTF-8` character set such as ISO-XXXX-8, the
+          {option}`i18n.localeCharsets` can be used.
+        '';
+      };
+      localeCharsets = lib.mkOption {
+        type = lib.types.attrsOf lib.types.str;
+        default = { };
+        example = {
+          LC_MESSAGES = "ISO-8859-15";
+          LC_TIME = "ISO-8859-1";
+        };
+        description = ''
+          Per each {option}`i18n.extraLocaleSettings`, choose the character set
+          to use for it. Essentially defaults to UTF-8 for all of them.
         '';
       };
 
diff --git a/nixos/modules/system/boot/systemd/journald.nix b/nixos/modules/system/boot/systemd/journald.nix
index c30630e04e4b..4d2ca7f11f21 100644
--- a/nixos/modules/system/boot/systemd/journald.nix
+++ b/nixos/modules/system/boot/systemd/journald.nix
@@ -116,22 +116,19 @@ in
   };
 
   config = {
-    systemd.additionalUpstreamSystemUnits =
-      [
-        "systemd-journald.socket"
-        "systemd-journald@.socket"
-        "systemd-journald-varlink@.socket"
-        "systemd-journald.service"
-        "systemd-journald@.service"
-        "systemd-journal-flush.service"
-        "systemd-journal-catalog-update.service"
-        "systemd-journald-sync@.service"
-      ]
-      ++ (lib.optional (!config.boot.isContainer) "systemd-journald-audit.socket")
-      ++ [
-        "systemd-journald-dev-log.socket"
-        "syslog.socket"
-      ];
+    systemd.additionalUpstreamSystemUnits = [
+      "systemd-journald.socket"
+      "systemd-journald@.socket"
+      "systemd-journald-varlink@.socket"
+      "systemd-journald.service"
+      "systemd-journald@.service"
+      "systemd-journal-flush.service"
+      "systemd-journal-catalog-update.service"
+      "systemd-journald-sync@.service"
+      "systemd-journald-audit.socket"
+      "systemd-journald-dev-log.socket"
+      "syslog.socket"
+    ];
 
     systemd.sockets.systemd-journald-audit.wantedBy = [
       "systemd-journald.service"
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 3eb2327baf63..03a736fdd7dc 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -994,6 +994,7 @@ in
   orthanc = runTest ./orthanc.nix;
   owncast = handleTest ./owncast.nix { };
   outline = handleTest ./outline.nix { };
+  i18n = runTest ./i18n.nix;
   image-contents = handleTest ./image-contents.nix { };
   openvscode-server = handleTest ./openvscode-server.nix { };
   open-webui = runTest ./open-webui.nix;
diff --git a/nixos/tests/i18n.nix b/nixos/tests/i18n.nix
new file mode 100644
index 000000000000..a0493b7c62f5
--- /dev/null
+++ b/nixos/tests/i18n.nix
@@ -0,0 +1,43 @@
+{ lib, ... }:
+{
+  name = "glibLocales-custom-builds";
+  meta.maintainers = with lib.maintainers; [ doronbehar ];
+
+  nodes = {
+    nonUTF8Charset = {
+      i18n = {
+        defaultLocale = "en_US";
+        defaultCharset = "ISO-8859-1";
+      };
+    };
+    extraLocales1 = {
+      i18n = {
+        defaultLocale = "en_US.UTF-8";
+        extraLocales = [
+          "nl_NL.UTF-8/UTF-8"
+        ];
+      };
+    };
+    extraLocaleSettings = {
+      i18n = {
+        defaultLocale = "en_US.UTF-8";
+        extraLocaleSettings = {
+          LC_MESSAGES = "en_US.UTF-8";
+          LC_TIME = "de_DE.UTF-8";
+        };
+      };
+    };
+    localeCharsets = {
+      i18n = {
+        defaultLocale = "en_US.UTF-8";
+        extraLocaleSettings = {
+          LC_TIME = "de_DE";
+        };
+        localeCharsets = {
+          LC_TIME = "ISO-8859-1";
+        };
+      };
+    };
+  };
+  testScript = { nodes, ... }: "";
+}
diff --git a/nixos/tests/kernel-generic.nix b/nixos/tests/kernel-generic.nix
index 2a1ab38267a3..34e0597777a6 100644
--- a/nixos/tests/kernel-generic.nix
+++ b/nixos/tests/kernel-generic.nix
@@ -42,6 +42,7 @@ let
       linux_6_6_hardened
       linux_6_12_hardened
       linux_6_13_hardened
+      linux_6_14_hardened
       linux_rt_5_4
       linux_rt_5_10
       linux_rt_5_15
diff --git a/nixos/tests/systemd-journal.nix b/nixos/tests/systemd-journal.nix
index 63ae58970e84..c39fc50e5006 100644
--- a/nixos/tests/systemd-journal.nix
+++ b/nixos/tests/systemd-journal.nix
@@ -12,11 +12,23 @@ import ./make-test-python.nix (
     };
     nodes.auditd = {
       security.auditd.enable = true;
+      security.audit.enable = true;
       environment.systemPackages = [ pkgs.audit ];
+      boot.kernel.sysctl."kernel.printk_ratelimit" = 0;
+      boot.kernelParams = [ "audit_backlog_limit=8192" ];
     };
     nodes.journaldAudit = {
       services.journald.audit = true;
+      security.audit.enable = true;
       environment.systemPackages = [ pkgs.audit ];
+      boot.kernel.sysctl."kernel.printk_ratelimit" = 0;
+      boot.kernelParams = [ "audit_backlog_limit=8192" ];
+    };
+    nodes.containerCheck = {
+      containers.c1 = {
+        autoStart = true;
+        config = { };
+      };
     };
 
     testScript = ''
@@ -50,6 +62,16 @@ import ./make-test-python.nix (
         # logs ideally should NOT end up in kmesg, but they do due to
         # https://github.com/systemd/systemd/issues/15324
         journaldAudit.succeed("journalctl _TRANSPORT=kernel --grep 'unit=systemd-journald'")
+
+
+      with subtest("container systemd-journald-audit not running"):
+        containerCheck.wait_for_unit("multi-user.target");
+        containerCheck.wait_until_succeeds("systemctl -M c1 is-active default.target");
+
+        # systemd-journald-audit.socket should exist but not run due to the upstream unit's `Condition*` settings
+        (status, output) = containerCheck.execute("systemctl -M c1 is-active systemd-journald-audit.socket")
+        containerCheck.log(output)
+        assert status == 3 and output == "inactive\n", f"systemd-journald-audit.socket should exist in a container but remain inactive, was {output}"
     '';
   }
 )
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 3ead0f241e3c..6039303c58b9 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1841,8 +1841,8 @@ let
         mktplcRef = {
           name = "dependi";
           publisher = "fill-labs";
-          version = "0.7.14";
-          hash = "sha256-iLF2kxhSw39JBIs5K6hVmrEKueS8C22rnKCs+CiphwY=";
+          version = "0.7.15";
+          hash = "sha256-BXilurHO9WATC0PhT/scpZWEiRhJ9cSlq59opEM6wlE=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/fill-labs.dependi/changelog";
diff --git a/pkgs/applications/misc/rofi/default.nix b/pkgs/applications/misc/rofi/default.nix
index 95597a6ee411..cb3793b782f4 100644
--- a/pkgs/applications/misc/rofi/default.nix
+++ b/pkgs/applications/misc/rofi/default.nix
@@ -29,14 +29,14 @@
 
 stdenv.mkDerivation rec {
   pname = "rofi-unwrapped";
-  version = "1.7.8";
+  version = "1.7.9";
 
   src = fetchFromGitHub {
     owner = "davatorium";
     repo = "rofi";
     rev = version;
     fetchSubmodules = true;
-    hash = "sha256-TEn3LoTUc5mxYcVkckIFTfkqQ9cUJxkXyg/5TFv5TZ0=";
+    hash = "sha256-YI6ShRRBJ9ExkzDnI31YjtI1mWRWPzVRYQvpTAtLTeI=";
   };
 
   preConfigure = ''
diff --git a/pkgs/applications/video/obs-studio/plugins/obs-3d-effect.nix b/pkgs/applications/video/obs-studio/plugins/obs-3d-effect.nix
index 0a80098f5d1b..ff4cbf415c9d 100644
--- a/pkgs/applications/video/obs-studio/plugins/obs-3d-effect.nix
+++ b/pkgs/applications/video/obs-studio/plugins/obs-3d-effect.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "obs-3d-effect";
-  version = "0.1.3";
+  version = "0.1.4";
 
   src = fetchFromGitHub {
     owner = "exeldro";
     repo = "obs-3d-effect";
     rev = version;
-    sha256 = "sha256-SgxrBhuO3IaqINwjwdtn31cIcu3hXiPZyVMZJiNsO+s=";
+    sha256 = "sha256-5cPXfEcKIATFQktjIN5lmYjvakYe/k26aHKlJz5FqPE=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprland-plugins.nix b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprland-plugins.nix
index 09d0f12903a8..8884bd4eb130 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprland-plugins.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprland-plugins.nix
@@ -14,13 +14,13 @@ let
             mkHyprlandPlugin,
           }:
           let
-            version = "0.49.0";
+            version = "0.49.0-fix";
 
             hyprland-plugins-src = fetchFromGitHub {
               owner = "hyprwm";
               repo = "hyprland-plugins";
               tag = "v${version}";
-              hash = "sha256-GpsLyK/U05q7QnyFIWrnGS2loVyjPZByTtPitwu9UNw=";
+              hash = "sha256-5wjvmFtk85uBJLnrKZbfrgo9OTTQlFP18ZNgfBwFsz0=";
             };
           in
           mkHyprlandPlugin hyprland {
diff --git a/pkgs/build-support/vm/default.nix b/pkgs/build-support/vm/default.nix
index 95923cace296..fe2e42855e0e 100644
--- a/pkgs/build-support/vm/default.nix
+++ b/pkgs/build-support/vm/default.nix
@@ -984,277 +984,11 @@ rec {
 
   # The set of supported RPM-based distributions.
 
-  rpmDistros = {
-
-    # Note: no i386 release for Fedora >= 26
-    fedora26x86_64 =
-      let
-        version = "26";
-      in
-      {
-        name = "fedora-${version}-x86_64";
-        fullName = "Fedora ${version} (x86_64)";
-        packagesList = fetchurl rec {
-          url = "mirror://fedora/linux/releases/${version}/Everything/x86_64/os/repodata/${sha256}-primary.xml.gz";
-          sha256 = "880055a50c05b20641530d09b23f64501a000b2f92fe252417c530178730a95e";
-        };
-        urlPrefix = "mirror://fedora/linux/releases/${version}/Everything/x86_64/os";
-        archs = [
-          "noarch"
-          "x86_64"
-        ];
-        packages = commonFedoraPackages ++ [
-          "cronie"
-          "util-linux"
-        ];
-        unifiedSystemDir = true;
-      };
-
-    fedora27x86_64 =
-      let
-        version = "27";
-      in
-      {
-        name = "fedora-${version}-x86_64";
-        fullName = "Fedora ${version} (x86_64)";
-        packagesList = fetchurl rec {
-          url = "mirror://fedora/linux/releases/${version}/Everything/x86_64/os/repodata/${sha256}-primary.xml.gz";
-          sha256 = "48986ce4583cd09825c6d437150314446f0f49fa1a1bd62dcfa1085295030fe9";
-        };
-        urlPrefix = "mirror://fedora/linux/releases/${version}/Everything/x86_64/os";
-        archs = [
-          "noarch"
-          "x86_64"
-        ];
-        packages = commonFedoraPackages ++ [
-          "cronie"
-          "util-linux"
-        ];
-        unifiedSystemDir = true;
-      };
-
-    centos6i386 =
-      let
-        version = "6.9";
-      in
-      rec {
-        name = "centos-${version}-i386";
-        fullName = "CentOS ${version} (i386)";
-        urlPrefix = "mirror://centos/${version}/os/i386";
-        packagesList = fetchurl rec {
-          url = "${urlPrefix}/repodata/${sha256}-primary.xml.gz";
-          sha256 = "b826a45082ef68340325c0855f3d2e5d5a4d0f77d28ba3b871791d6f14a97aeb";
-        };
-        archs = [
-          "noarch"
-          "i386"
-        ];
-        packages = commonCentOSPackages ++ [ "procps" ];
-      };
-
-    centos6x86_64 =
-      let
-        version = "6.9";
-      in
-      rec {
-        name = "centos-${version}-x86_64";
-        fullName = "CentOS ${version} (x86_64)";
-        urlPrefix = "mirror://centos/${version}/os/x86_64";
-        packagesList = fetchurl rec {
-          url = "${urlPrefix}/repodata/${sha256}-primary.xml.gz";
-          sha256 = "ed2b2d4ac98d774d4cd3e91467e1532f7e8b0275cfc91a0d214b532dcaf1e979";
-        };
-        archs = [
-          "noarch"
-          "x86_64"
-        ];
-        packages = commonCentOSPackages ++ [ "procps" ];
-      };
-
-    # Note: no i386 release for 7.x
-    centos7x86_64 =
-      let
-        version = "7.4.1708";
-      in
-      rec {
-        name = "centos-${version}-x86_64";
-        fullName = "CentOS ${version} (x86_64)";
-        urlPrefix = "mirror://centos/${version}/os/x86_64";
-        packagesList = fetchurl rec {
-          url = "${urlPrefix}/repodata/${sha256}-primary.xml.gz";
-          sha256 = "b686d3a0f337323e656d9387b9a76ce6808b26255fc3a138b1a87d3b1cb95ed5";
-        };
-        archs = [
-          "noarch"
-          "x86_64"
-        ];
-        packages = commonCentOSPackages ++ [ "procps-ng" ];
-      };
-  };
+  rpmDistros = { };
 
   # The set of supported Dpkg-based distributions.
 
   debDistros = {
-    ubuntu1404i386 = {
-      name = "ubuntu-14.04-trusty-i386";
-      fullName = "Ubuntu 14.04 Trusty (i386)";
-      packagesLists = [
-        (fetchurl {
-          url = "mirror://ubuntu/dists/trusty/main/binary-i386/Packages.bz2";
-          sha256 = "1d5y3v3v079gdq45hc07ja0bjlmzqfwdwwlq0brwxi8m75k3iz7x";
-        })
-        (fetchurl {
-          url = "mirror://ubuntu/dists/trusty/universe/binary-i386/Packages.bz2";
-          sha256 = "03x9w92by320rfklrqhcl3qpwmnxds9c8ijl5zhcb21d6dcz5z1a";
-        })
-      ];
-      urlPrefix = "mirror://ubuntu";
-      packages = commonDebPackages ++ [
-        "diffutils"
-        "libc-bin"
-      ];
-    };
-
-    ubuntu1404x86_64 = {
-      name = "ubuntu-14.04-trusty-amd64";
-      fullName = "Ubuntu 14.04 Trusty (amd64)";
-      packagesLists = [
-        (fetchurl {
-          url = "mirror://ubuntu/dists/trusty/main/binary-amd64/Packages.bz2";
-          sha256 = "1hhzbyqfr5i0swahwnl5gfp5l9p9hspywb1vpihr3b74p1z935bh";
-        })
-        (fetchurl {
-          url = "mirror://ubuntu/dists/trusty/universe/binary-amd64/Packages.bz2";
-          sha256 = "04560ba8s4z4v5iawknagrkn9q1nzvpn081ycmqvhh73p3p3g1jm";
-        })
-      ];
-      urlPrefix = "mirror://ubuntu";
-      packages = commonDebPackages ++ [
-        "diffutils"
-        "libc-bin"
-      ];
-    };
-
-    ubuntu1604i386 = {
-      name = "ubuntu-16.04-xenial-i386";
-      fullName = "Ubuntu 16.04 Xenial (i386)";
-      packagesLists = [
-        (fetchurl {
-          url = "mirror://ubuntu/dists/xenial/main/binary-i386/Packages.xz";
-          sha256 = "13r75sp4slqy8w32y5dnr7pp7p3cfvavyr1g7gwnlkyrq4zx4ahy";
-        })
-        (fetchurl {
-          url = "mirror://ubuntu/dists/xenial/universe/binary-i386/Packages.xz";
-          sha256 = "14fid1rqm3sc0wlygcvn0yx5aljf51c2jpd4x0zxij4019316hsh";
-        })
-      ];
-      urlPrefix = "mirror://ubuntu";
-      packages = commonDebPackages ++ [
-        "diffutils"
-        "libc-bin"
-      ];
-    };
-
-    ubuntu1604x86_64 = {
-      name = "ubuntu-16.04-xenial-amd64";
-      fullName = "Ubuntu 16.04 Xenial (amd64)";
-      packagesLists = [
-        (fetchurl {
-          url = "mirror://ubuntu/dists/xenial/main/binary-amd64/Packages.xz";
-          sha256 = "110qnkhjkkwm316fbig3aivm2595ydz6zskc4ld5cr8ngcrqm1bn";
-        })
-        (fetchurl {
-          url = "mirror://ubuntu/dists/xenial/universe/binary-amd64/Packages.xz";
-          sha256 = "0mm7gj491yi6q4v0n4qkbsm94s59bvqir6fk60j73w7y4la8rg68";
-        })
-      ];
-      urlPrefix = "mirror://ubuntu";
-      packages = commonDebPackages ++ [
-        "diffutils"
-        "libc-bin"
-      ];
-    };
-
-    ubuntu1804i386 = {
-      name = "ubuntu-18.04-bionic-i386";
-      fullName = "Ubuntu 18.04 Bionic (i386)";
-      packagesLists = [
-        (fetchurl {
-          url = "mirror://ubuntu/dists/bionic/main/binary-i386/Packages.xz";
-          sha256 = "0f0v4131kwf7m7f8j3288rlqdxk1k3vqy74b7fcfd6jz9j8d840i";
-        })
-        (fetchurl {
-          url = "mirror://ubuntu/dists/bionic/universe/binary-i386/Packages.xz";
-          sha256 = "1v75c0dqr0wp0dqd4hnci92qqs4hll8frqdbpswadgxm5chn91bw";
-        })
-      ];
-      urlPrefix = "mirror://ubuntu";
-      packages = commonDebPackages ++ [
-        "diffutils"
-        "libc-bin"
-      ];
-    };
-
-    ubuntu1804x86_64 = {
-      name = "ubuntu-18.04-bionic-amd64";
-      fullName = "Ubuntu 18.04 Bionic (amd64)";
-      packagesLists = [
-        (fetchurl {
-          url = "mirror://ubuntu/dists/bionic/main/binary-amd64/Packages.xz";
-          sha256 = "1ls81bjyvmfz6i919kszl7xks1ibrh1xqhsk6698ackndkm0wp39";
-        })
-        (fetchurl {
-          url = "mirror://ubuntu/dists/bionic/universe/binary-amd64/Packages.xz";
-          sha256 = "1832nqpn4ap95b3sj870xqayrza9in4kih9jkmjax27pq6x15v1r";
-        })
-      ];
-      urlPrefix = "mirror://ubuntu";
-      packages = commonDebPackages ++ [
-        "diffutils"
-        "libc-bin"
-      ];
-    };
-
-    ubuntu2004i386 = {
-      name = "ubuntu-20.04-focal-i386";
-      fullName = "Ubuntu 20.04 Focal (i386)";
-      packagesLists = [
-        (fetchurl {
-          url = "mirror://ubuntu/dists/focal/main/binary-i386/Packages.xz";
-          sha256 = "sha256-7RAYURoN3RKYQAHpwBS9TIV6vCmpURpphyMJQmV4wLc=";
-        })
-        (fetchurl {
-          url = "mirror://ubuntu/dists/focal/universe/binary-i386/Packages.xz";
-          sha256 = "sha256-oA551xVE80volUPgkMyvzpQ1d+GhuZd4DAe7dXZnULM=";
-        })
-      ];
-      urlPrefix = "mirror://ubuntu";
-      packages = commonDebPackages ++ [
-        "diffutils"
-        "libc-bin"
-      ];
-    };
-
-    ubuntu2004x86_64 = {
-      name = "ubuntu-20.04-focal-amd64";
-      fullName = "Ubuntu 20.04 Focal (amd64)";
-      packagesLists = [
-        (fetchurl {
-          url = "mirror://ubuntu/dists/focal/main/binary-amd64/Packages.xz";
-          sha256 = "sha256-d1eSH/j+7Zw5NKDJk21EG6SiOL7j6myMHfXLzUP8mGE=";
-        })
-        (fetchurl {
-          url = "mirror://ubuntu/dists/focal/universe/binary-amd64/Packages.xz";
-          sha256 = "sha256-RqdG2seJvZU3rKVNsWgLnf9RwkgVMRE1A4IZnX2WudE=";
-        })
-      ];
-      urlPrefix = "mirror://ubuntu";
-      packages = commonDebPackages ++ [
-        "diffutils"
-        "libc-bin"
-      ];
-    };
-
     ubuntu2204i386 = {
       name = "ubuntu-22.04-jammy-i386";
       fullName = "Ubuntu 22.04 Jammy (i386)";
@@ -1315,28 +1049,6 @@ rec {
       ];
     };
 
-    debian10i386 = {
-      name = "debian-10.13-buster-i386";
-      fullName = "Debian 10.13 Buster (i386)";
-      packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20221126T084953Z/dists/buster/main/binary-i386/Packages.xz";
-        hash = "sha256-n9JquhtZgxw3qr9BX0MQoY3ZTIHN0dit+iru3DC31UY=";
-      };
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20221126T084953Z";
-      packages = commonDebianPackages;
-    };
-
-    debian10x86_64 = {
-      name = "debian-10.13-buster-amd64";
-      fullName = "Debian 10.13 Buster (amd64)";
-      packagesList = fetchurl {
-        url = "https://snapshot.debian.org/archive/debian/20221126T084953Z/dists/buster/main/binary-amd64/Packages.xz";
-        hash = "sha256-YukIIB3u87jgp9oudwklsxyKVKjSL618wFgDSXiFmjU=";
-      };
-      urlPrefix = "https://snapshot.debian.org/archive/debian/20221126T084953Z";
-      packages = commonDebianPackages;
-    };
-
     debian11i386 = {
       name = "debian-11.8-bullseye-i386";
       fullName = "Debian 11.8 Bullseye (i386)";
diff --git a/pkgs/by-name/ca/catppuccin/package.nix b/pkgs/by-name/ca/catppuccin/package.nix
index 32914fe6da4b..dbd858137473 100644
--- a/pkgs/by-name/ca/catppuccin/package.nix
+++ b/pkgs/by-name/ca/catppuccin/package.nix
@@ -92,8 +92,8 @@ let
       name = "element";
       owner = "catppuccin";
       repo = "element";
-      rev = "ddced941a2014107918484263b63e030889777fe";
-      hash = "sha256-8EP/IQW3rdtomHBfnQNIjGbiD6OapPzXPFLjziNDcmc=";
+      rev = "70b7ee121dcef28c6c8191d60df2f88b23c89084";
+      hash = "sha256-iUSPlmEvwL9akbPobkbDWPr6TTHA/LdCK2Nty7Zslls=";
     };
 
     grub = fetchFromGitHub {
@@ -254,7 +254,7 @@ lib.checkListOfEnum "${pname}: variant" validVariants [ variant ] lib.checkListO
       ''
       + lib.optionalString (lib.elem "element" themeList) ''
         mkdir -p "$out/element"
-        cp -r "${sources.element}/themes/Catppuccin-${variant}.json" "$out/element/"
+        cp -r "${sources.element}/themes/${variant}/${accent}.json" "$out/element/"
 
       ''
       + lib.optionalString (lib.elem "grub" themeList) ''
diff --git a/pkgs/by-name/do/doctoc/package.nix b/pkgs/by-name/do/doctoc/package.nix
index faded51f4431..1f7bde794ff3 100644
--- a/pkgs/by-name/do/doctoc/package.nix
+++ b/pkgs/by-name/do/doctoc/package.nix
@@ -18,6 +18,10 @@ buildNpmPackage rec {
 
   npmDepsHash = "sha256-TbAnFpiN/v6xjQQznL/B180f0W48HPRqW21cO9XZhYA=";
 
+  postInstall = ''
+    find $out/lib/node_modules -xtype l -delete
+  '';
+
   dontNpmBuild = true;
 
   passthru.tests = {
diff --git a/pkgs/by-name/dp/dprint/package.nix b/pkgs/by-name/dp/dprint/package.nix
index fcb400baf9a4..76da0cdd957b 100644
--- a/pkgs/by-name/dp/dprint/package.nix
+++ b/pkgs/by-name/dp/dprint/package.nix
@@ -9,9 +9,9 @@
   dprint,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dprint";
-  version = "0.49.1";
+  version = "0.50.0";
 
   # Prefer repository rather than crate here
   #   - They have Cargo.lock in the repository
@@ -19,17 +19,27 @@ rustPlatform.buildRustPackage rec {
   src = fetchFromGitHub {
     owner = "dprint";
     repo = "dprint";
-    tag = version;
-    hash = "sha256-6ye9FqOGW40TqoDREQm6pZAQaSuO2o9SY5RSfpmwKV4=";
+    tag = finalAttrs.version;
+    hash = "sha256-6AgbKH5f7N/yYqq7KBVHOqYbyuZkjFSaYwZwIXsgd9o=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-OHRXujyewiDlY4AQEEqmcnmdec1lbWH/y6tPW1nNExE=";
+  cargoHash = "sha256-OnrsuVK1gEDweldq+P8lDkkrHjklsG8MRpM0wqWsdlM=";
 
   nativeBuildInputs = lib.optionals (stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
     installShellFiles
   ];
 
+  cargoBuildFlags = [
+    "--package=dprint"
+    # Required only for dprint package tests; the binary is removed in postInstall.
+    "--package=test-process-plugin"
+  ];
+
+  cargoTestFlags = [
+    "--package=dprint"
+  ];
+
   checkFlags = [
     # Require creating directory and network access
     "--skip=plugins::cache_fs_locks::test"
@@ -40,17 +50,21 @@ rustPlatform.buildRustPackage rec {
     "--skip=utils::url::test::unsafe_ignore_cert"
   ];
 
-  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-    export DPRINT_CACHE_DIR="$(mktemp -d)"
-    installShellCompletion --cmd dprint \
-      --bash <($out/bin/dprint completions bash) \
-      --zsh <($out/bin/dprint completions zsh) \
-      --fish <($out/bin/dprint completions fish)
-  '';
+  postInstall =
+    ''
+      rm "$out/bin/test-process-plugin"
+    ''
+    + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+      export DPRINT_CACHE_DIR="$(mktemp -d)"
+      installShellCompletion --cmd dprint \
+        --bash <($out/bin/dprint completions bash) \
+        --zsh <($out/bin/dprint completions zsh) \
+        --fish <($out/bin/dprint completions fish)
+    '';
 
   passthru = {
     tests.version = testers.testVersion {
-      inherit version;
+      inherit (finalAttrs) version;
 
       package = dprint;
       command = ''
@@ -68,7 +82,7 @@ rustPlatform.buildRustPackage rec {
       It offers multiple WASM plugins to support various languages. It's written in
       Rust, so it’s small, fast, and portable.
     '';
-    changelog = "https://github.com/dprint/dprint/releases/tag/${version}";
+    changelog = "https://github.com/dprint/dprint/releases/tag/${finalAttrs.version}";
     homepage = "https://dprint.dev";
     license = licenses.mit;
     maintainers = with maintainers; [
@@ -78,4 +92,4 @@ rustPlatform.buildRustPackage rec {
     ];
     mainProgram = "dprint";
   };
-}
+})
diff --git a/pkgs/by-name/dp/dprint/plugins/default.nix b/pkgs/by-name/dp/dprint/plugins/default.nix
index 94dc9db6819c..810d5d23481c 100644
--- a/pkgs/by-name/dp/dprint/plugins/default.nix
+++ b/pkgs/by-name/dp/dprint/plugins/default.nix
@@ -47,7 +47,7 @@ let
         runHook preInstallCheck
 
         mkdir empty && cd empty
-        dprint check --allow-no-files --plugins "$out/plugin.wasm"
+        dprint check --allow-no-files --config-discovery=false --plugins "$out/plugin.wasm"
 
         runHook postInstallCheck
       '';
diff --git a/pkgs/by-name/fi/firebase-tools/package.nix b/pkgs/by-name/fi/firebase-tools/package.nix
index 288d145f9202..b75b27de2dc4 100644
--- a/pkgs/by-name/fi/firebase-tools/package.nix
+++ b/pkgs/by-name/fi/firebase-tools/package.nix
@@ -10,16 +10,16 @@
 
 buildNpmPackage rec {
   pname = "firebase-tools";
-  version = "14.3.0";
+  version = "14.4.0";
 
   src = fetchFromGitHub {
     owner = "firebase";
     repo = "firebase-tools";
     tag = "v${version}";
-    hash = "sha256-Y3+Nw6+ZCnHOJeoMRhWafBVi0yrb41NX/4FcpqHk4eA=";
+    hash = "sha256-mcb0rCI7tJE6A/CK4rGUJ2qqvjrld0Yzl9l4mMipCoA=";
   };
 
-  npmDepsHash = "sha256-+rAwYopIP/NEb602TVuZEZUY+dQPzkuTXpWCBeLCjmg=";
+  npmDepsHash = "sha256-Ezjn5oVjvVJnfw0oBTxNbmfmgHYBDixdiIJHft9FbQE=";
 
   postPatch = ''
     ln -s npm-shrinkwrap.json package-lock.json
diff --git a/pkgs/by-name/gi/gitlab-runner/package.nix b/pkgs/by-name/gi/gitlab-runner/package.nix
index 978f0a0a6f77..9a78beeaf392 100644
--- a/pkgs/by-name/gi/gitlab-runner/package.nix
+++ b/pkgs/by-name/gi/gitlab-runner/package.nix
@@ -22,7 +22,7 @@ buildGoModule (finalAttrs: {
   vendorHash = "sha256-wxFVDkqiqs7jaZEPGyawWfs6h6UgAhCWSckM90G44lA=";
 
   # For patchShebangs
-  nativeBuildInputs = [ bash ];
+  buildInputs = [ bash ];
 
   patches = [
     ./fix-shell-path.patch
diff --git a/pkgs/by-name/ju/julec/package.nix b/pkgs/by-name/ju/julec/package.nix
index abc2c8aa05c2..598e616c7649 100644
--- a/pkgs/by-name/ju/julec/package.nix
+++ b/pkgs/by-name/ju/julec/package.nix
@@ -1,43 +1,43 @@
 {
   lib,
-  stdenv,
+  clangStdenv,
   fetchFromGitHub,
 }:
 
 let
   irFile =
-    if stdenv.hostPlatform.system == "x86_64-linux" then
+    if clangStdenv.hostPlatform.system == "x86_64-linux" then
       "linux-amd64.cpp"
-    else if stdenv.hostPlatform.system == "aarch64-linux" then
+    else if clangStdenv.hostPlatform.system == "aarch64-linux" then
       "linux-arm64.cpp"
-    else if stdenv.hostPlatform.system == "i686-linux" then
+    else if clangStdenv.hostPlatform.system == "i686-linux" then
       "linux-i386.cpp"
-    else if stdenv.hostPlatform.system == "x86_64-darwin" then
+    else if clangStdenv.hostPlatform.system == "x86_64-darwin" then
       "darwin-amd64.cpp"
-    else if stdenv.hostPlatform.system == "aarch64-darwin" then
+    else if clangStdenv.hostPlatform.system == "aarch64-darwin" then
       "darwin-arm64.cpp"
     else
-      throw "Unsupported platform: ${stdenv.hostPlatform.system}";
+      throw "Unsupported platform: ${clangStdenv.hostPlatform.system}";
 in
-stdenv.mkDerivation (finalAttrs: {
+clangStdenv.mkDerivation (finalAttrs: {
   pname = "julec";
-  version = "0.1.3";
+  version = "0.1.5";
 
   src = fetchFromGitHub {
     owner = "julelang";
     repo = "jule";
     tag = "jule${finalAttrs.version}";
     name = "jule-${finalAttrs.version}";
-    hash = "sha256-hFWoGeTmfXIPcICWXa5W36QDOk3yB7faORxFaM9shcQ=";
+    hash = "sha256-gFlca9XdRNv2CI3jfMiWejcmGGzabP0VGs4vlvFs72o=";
   };
 
   irSrc = fetchFromGitHub {
     owner = "julelang";
     repo = "julec-ir";
     # revision determined by the upstream commit hash in julec-ir/README.md
-    rev = "a274782922e4275c4a036d63acffd3369dbc382f";
+    rev = "4a3bf4fc84b53aa607855df6635d95d3e310f7ad";
     name = "jule-ir-${finalAttrs.version}";
-    hash = "sha256-TXMSXTGTzZntPUhT6QTmn3nD2k855ZoAW9aQWyhrE8s=";
+    hash = "sha256-Wl5AYRGYcQpj/R9nynxNC5r1HK1EmImwkLokdZfp9sE=";
   };
 
   dontConfigure = true;
@@ -58,16 +58,20 @@ stdenv.mkDerivation (finalAttrs: {
   buildPhase = ''
     runHook preBuild
 
-    echo "Building ${finalAttrs.meta.mainProgram} v${finalAttrs.version} for ${stdenv.hostPlatform.system}..."
+    echo "Building ${finalAttrs.meta.mainProgram}-bootstrap v${finalAttrs.version} for ${clangStdenv.hostPlatform.system}..."
     mkdir -p bin
-    ${stdenv.cc.targetPrefix}c++ ir.cpp \
+    ${clangStdenv.cc.targetPrefix}c++ ir.cpp \
       --std=c++17 \
       -Wno-everything \
-      -O3 \
-      -flto \
+      -fwrapv \
+      -ffloat-store \
       -DNDEBUG \
       -fomit-frame-pointer \
-      -o "bin/${finalAttrs.meta.mainProgram}"
+      -fno-strict-aliasing \
+      -o "bin/${finalAttrs.meta.mainProgram}-bootstrap"
+
+    echo "Building ${finalAttrs.meta.mainProgram} v${finalAttrs.version} for ${clangStdenv.hostPlatform.system}..."
+    bin/${finalAttrs.meta.mainProgram}-bootstrap --opt L2 -p -o "bin/${finalAttrs.meta.mainProgram}" "src/${finalAttrs.meta.mainProgram}"
 
     runHook postBuild
   '';
diff --git a/pkgs/by-name/ke/keepassxc-go/package.nix b/pkgs/by-name/ke/keepassxc-go/package.nix
index 1e6cf584d6d2..fac1d231a96e 100644
--- a/pkgs/by-name/ke/keepassxc-go/package.nix
+++ b/pkgs/by-name/ke/keepassxc-go/package.nix
@@ -8,18 +8,18 @@
 
 buildGoModule rec {
   pname = "keepassxc-go";
-  version = "1.5.1";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "MarkusFreitag";
     repo = "keepassxc-go";
     rev = "v${version}";
-    hash = "sha256-seCeHNEj5GxAI7BVMPzh+YuoxivmTwvhVCqY5LKHpQk=";
+    hash = "sha256-Z4SbPxhs+umsUlby7idxofCjP+uLPvp/2oUCpnAS2/A=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
 
-  vendorHash = "sha256-jscyNyVr+RDN1EaxIOc3aYCAVT+1eO/c+dxEsIorDIs=";
+  vendorHash = "sha256-+cgf2FxpbLu+Yuhk6T0ZBnDH7We2DVu65xFaruk9I0E=";
 
   checkFlags = [
     # Test tries to monkey-patch the stdlib, fails with permission denied error.
diff --git a/pkgs/by-name/li/libfpx/package.nix b/pkgs/by-name/li/libfpx/package.nix
deleted file mode 100644
index 08851aa47759..000000000000
--- a/pkgs/by-name/li/libfpx/package.nix
+++ /dev/null
@@ -1,47 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  fetchpatch,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "libfpx";
-  version = "1.3.1-7";
-
-  src = fetchurl {
-    url = "mirror://imagemagick/delegates/${pname}-${version}.tar.xz";
-    sha256 = "1s28mwb06w6dj0zl6ashpj8m1qiyadawzl7cvbw7dmj1w39ipghh";
-  };
-
-  # Darwin gets misdetected as Windows without this
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-D__unix";
-
-  patches = [
-    (fetchpatch {
-      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/media-libs/libfpx/files/libfpx-1.3.1_p6-gcc6.patch?id=f28a947813dbc0a1fd1a8d4a712d58a64c48ca01";
-      sha256 = "032y8110zgnkdhkdq3745zk53am1x34d912rai8q70k3sskyq22p";
-    })
-    # Pull upstream fix for -fno-common:
-    #  https://github.com/ImageMagick/libfpx/pull/1
-    (fetchpatch {
-      name = "fno-common.patch";
-      url = "https://github.com/ImageMagick/libfpx/commit/c32b340581ba6c88c5092f374f655c7579b598a6.patch";
-      sha256 = "1gbc0qb2ri1mj9r66wx0yn28fsr7zhhlyz2mwbica8wh34xijgz9";
-    })
-    # fix clang build: remove register keyword
-    # remove on next update
-    (fetchpatch {
-      name = "remove-register-keyword.patch";
-      url = "https://github.com/ImageMagick/libfpx/commit/5f340b0a490450b40302cc9948c7dfac60d40041.patch";
-      hash = "sha256-6m9MFb1eWGK5cMvPmTu7uh3Pac65r2HPB8wJ8xc1O5o=";
-    })
-  ];
-
-  meta = with lib; {
-    homepage = "http://www.imagemagick.org";
-    description = "Library for manipulating FlashPIX images";
-    license = "Flashpix";
-    platforms = platforms.all;
-  };
-}
diff --git a/pkgs/by-name/li/libxmp/package.nix b/pkgs/by-name/li/libxmp/package.nix
index c5d177117f59..e23be1dd83a3 100644
--- a/pkgs/by-name/li/libxmp/package.nix
+++ b/pkgs/by-name/li/libxmp/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libxmp";
-  version = "4.6.2";
+  version = "4.6.3";
 
   src = fetchFromGitHub {
     owner = "libxmp";
     repo = "libxmp";
     tag = "libxmp-${finalAttrs.version}";
-    hash = "sha256-AfHathuBmF9OhtTyt8WabZKzFtnAkX1YeiYFF079z80=";
+    hash = "sha256-VTjS5bVu+jiswP4GCTxcAdhtVdtopy4A3hxlzIQlZVU=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/lu/lug-helper/package.nix b/pkgs/by-name/lu/lug-helper/package.nix
index 047410317329..92ca76d081d6 100644
--- a/pkgs/by-name/lu/lug-helper/package.nix
+++ b/pkgs/by-name/lu/lug-helper/package.nix
@@ -15,12 +15,12 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   name = "lug-helper";
-  version = "3.8";
+  version = "3.9";
   src = fetchFromGitHub {
     owner = "starcitizen-lug";
     repo = "lug-helper";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-e0pq3E9Jsx9pBRhN0gFJxZPDUbK/Xe84+5AO2/RlsLo=";
+    hash = "sha256-Fne0esV/1o+f4Fnn8oeUL+gc29d0ndGpYG21YQvZDvM=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/mp/mpls/package.nix b/pkgs/by-name/mp/mpls/package.nix
index 6bad2eb54488..9498995027d8 100644
--- a/pkgs/by-name/mp/mpls/package.nix
+++ b/pkgs/by-name/mp/mpls/package.nix
@@ -7,16 +7,16 @@
 }:
 buildGoModule rec {
   pname = "mpls";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "mhersson";
     repo = "mpls";
     tag = "v${version}";
-    hash = "sha256-z3miAbL3qQHusWoofUp8kNNZjoGANhPjeIj39KPYyvc=";
+    hash = "sha256-7uBhc4FRe9KxRloHJQoDb8JvKPcev2DuTftnMBnmiGs=";
   };
 
-  vendorHash = "sha256-xILlYrwcnMWAPACeELwVKGUBIK9QbrUSR03xVmNXsnE=";
+  vendorHash = "sha256-zEJBB5xJBJuLZQ/+yDyoFbkYXpqEkRXuIIhReBPKi+g=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/nc/nchat/package.nix b/pkgs/by-name/nc/nchat/package.nix
index 1b27543b8270..2d8439b5cbad 100644
--- a/pkgs/by-name/nc/nchat/package.nix
+++ b/pkgs/by-name/nc/nchat/package.nix
@@ -15,13 +15,13 @@
 }:
 
 let
-  version = "5.6.7";
+  version = "5.7.24";
 
   src = fetchFromGitHub {
     owner = "d99kris";
     repo = "nchat";
     tag = "v${version}";
-    hash = "sha256-tHyNwTmpNRKsjjoX2RP1jk5wzn2xLgKE9KZXPo2Beco=";
+    hash = "sha256-qyx4LOhCFcwg2ou4QgiiolGgLs2fxfQu6gwDIeMUcb4=";
   };
 
   libcgowm = buildGoModule {
@@ -29,7 +29,7 @@ let
     inherit version src;
 
     sourceRoot = "${src.name}/lib/wmchat/go";
-    vendorHash = "sha256-8q2156gYsKduzEKvxDTZJNzsxqcJr62bD4JNuJMR/Qc=";
+    vendorHash = "sha256-LPcIfXOlkejyLlYtew26FTOl7eBGhuNxjAVrmUItkxY=";
 
     buildPhase = ''
       runHook preBuild
diff --git a/pkgs/by-name/ne/netcoredbg/deps.json b/pkgs/by-name/ne/netcoredbg/deps.json
index 002cb71be2ad..66a3323b62c1 100644
--- a/pkgs/by-name/ne/netcoredbg/deps.json
+++ b/pkgs/by-name/ne/netcoredbg/deps.json
@@ -31,68 +31,63 @@
   },
   {
     "pname": "Microsoft.Diagnostics.DbgShim",
-    "version": "8.0.532401",
-    "hash": "sha256-rvTxIxaW6WYlbNqV0mVjX3JkjxOB2eoDtm7HD3qgKvg="
+    "version": "9.0.621003",
+    "hash": "sha256-xdRwwLonXgqp4G+HWmFe5pEdv/x0L51/8jOqV5allZ4="
   },
   {
     "pname": "Microsoft.Diagnostics.DbgShim.linux-arm",
-    "version": "8.0.532401",
-    "hash": "sha256-LYDAN85Qsnj3TIdH1VzzIbeQRQfo4A9kYp/da0nZMX4="
+    "version": "9.0.621003",
+    "hash": "sha256-wcr6S8ktct8XNtXnEOCUHqA13N+7rQytgGkUsp1j4aU="
   },
   {
     "pname": "Microsoft.Diagnostics.DbgShim.linux-arm64",
-    "version": "8.0.532401",
-    "hash": "sha256-/1eElmNjO8ug2i0hzsnX+ksaeTlSrJNxuHBZZ5Mxw7A="
+    "version": "9.0.621003",
+    "hash": "sha256-OGsfVeZ4LcgOb2aM/e38Kyw9YGBn0t0uH8qgFdj8SIA="
   },
   {
     "pname": "Microsoft.Diagnostics.DbgShim.linux-musl-arm",
-    "version": "8.0.532401",
-    "hash": "sha256-3FsyQbXHgUErMg4islyZ68ZOi22Dtc7bHuzV4cHTetQ="
+    "version": "9.0.621003",
+    "hash": "sha256-ZUno/Sd0UWYVVD20sJj/HleDfLcb7kf32j5NvIAYSMc="
   },
   {
     "pname": "Microsoft.Diagnostics.DbgShim.linux-musl-arm64",
-    "version": "8.0.532401",
-    "hash": "sha256-UCGQZZ9ZQKgdvVpgJfKAUL1hDxopEOpkb71x11mZ5go="
+    "version": "9.0.621003",
+    "hash": "sha256-SKrqZiGnDdisdCIIETozCuSgj3JCAZeWfo2Ru/sMmOw="
   },
   {
     "pname": "Microsoft.Diagnostics.DbgShim.linux-musl-x64",
-    "version": "8.0.532401",
-    "hash": "sha256-zpKJdEGHfrk/ty0s2TuPiNi/yanEk6iAVZDOgBlv20s="
+    "version": "9.0.621003",
+    "hash": "sha256-/kEBxB4puJJHwC71W2QQlOMykKCeNGvNy2j6s91g6jc="
   },
   {
     "pname": "Microsoft.Diagnostics.DbgShim.linux-x64",
-    "version": "8.0.532401",
-    "hash": "sha256-maN37KzN1GxFW37E2t8suG1XHNfTIdDLTHxiaiwGfdc="
+    "version": "9.0.621003",
+    "hash": "sha256-rW9QGI1awjHBHWaMwFtfhgXuR3X/PBxuks0DgnT2684="
   },
   {
     "pname": "Microsoft.Diagnostics.DbgShim.osx-arm64",
-    "version": "8.0.532401",
-    "hash": "sha256-4+hYe0f09F/seep1K1O9uF1S+g0ygyNJIcqA3b4Fhh4="
+    "version": "9.0.621003",
+    "hash": "sha256-BXi0IePavjClLQcSrXZXGOqkkoymdecw9ZFf5w0mpRs="
   },
   {
     "pname": "Microsoft.Diagnostics.DbgShim.osx-x64",
-    "version": "8.0.532401",
-    "hash": "sha256-K/0i5SGl3rG8ciXbhSu2dWURlzfB2uVorv2yc7KKP4I="
-  },
-  {
-    "pname": "Microsoft.Diagnostics.DbgShim.win-arm",
-    "version": "8.0.532401",
-    "hash": "sha256-m/XEdwtXKGGIB1ORetiEaJ5qnQa+wz1Ou+aspxHAhe0="
+    "version": "9.0.621003",
+    "hash": "sha256-FXkjxK3Bq4twUJ69aqsCgv2hNpO2Lkuz7EPAtqxJWd0="
   },
   {
     "pname": "Microsoft.Diagnostics.DbgShim.win-arm64",
-    "version": "8.0.532401",
-    "hash": "sha256-QPo/eFVr7HCAeOcLlsOrukL78BWfs+nZHVr5ClZzCiQ="
+    "version": "9.0.621003",
+    "hash": "sha256-NScEkmv6oh+wXn5D7Nb0AoNSb1PU+HgUpd8fpup+a6o="
   },
   {
     "pname": "Microsoft.Diagnostics.DbgShim.win-x64",
-    "version": "8.0.532401",
-    "hash": "sha256-gxTB3KBr/ROgbBpLGQogtg2dz7a8F26UWyzsMJYMzv4="
+    "version": "9.0.621003",
+    "hash": "sha256-sfe0tF2D3BpktS9J0o1xsR2cWIkDGhzXaUvKsgHDqC0="
   },
   {
     "pname": "Microsoft.Diagnostics.DbgShim.win-x86",
-    "version": "8.0.532401",
-    "hash": "sha256-CP1WHi8a3Xr0ml2Dnhmhc14xSGqHPnrfnrfeuhZmm6o="
+    "version": "9.0.621003",
+    "hash": "sha256-CRUYEGm3lqOO3FDn8kr3OUjxmIHNe1ntihN6UaFeDs8="
   },
   {
     "pname": "Microsoft.NETCore.Platforms",
diff --git a/pkgs/by-name/ne/netcoredbg/package.nix b/pkgs/by-name/ne/netcoredbg/package.nix
index f2dc49a18410..f0e6f88abe98 100644
--- a/pkgs/by-name/ne/netcoredbg/package.nix
+++ b/pkgs/by-name/ne/netcoredbg/package.nix
@@ -12,17 +12,17 @@
 }:
 let
   pname = "netcoredbg";
-  build = "1031";
-  release = "3.1.0";
+  build = "1054";
+  release = "3.1.2";
   version = "${release}-${build}";
-  hash = "sha256-/ScV6NPGOun47D88e7BLisSOipeQWdUbYaEryrlPbHg=";
+  hash = "sha256-WORGZXbq6d3sxGqyG8oZSwcBoVaD3D56t9K6PJoKFsM=";
 
-  coreclr-version = "v8.0.7";
+  coreclr-version = "v8.0.16";
   coreclr-src = fetchFromGitHub {
     owner = "dotnet";
     repo = "runtime";
     rev = coreclr-version;
-    hash = "sha256-vxyhZ1Z5TB/2jpF4qiXTpUj1hKeqV7xPgG1BJYOLIko=";
+    hash = "sha256-/fSKCIugR3UhqxBxtQRw+Bw+UpaSjB4xj0iBiXJaiR4=";
   };
 
   dotnet-sdk = dotnetCorePackages.sdk_8_0;
diff --git a/pkgs/by-name/ni/nixpkgs-review/package.nix b/pkgs/by-name/ni/nixpkgs-review/package.nix
index 4627def80b68..fe7f6de6c107 100644
--- a/pkgs/by-name/ni/nixpkgs-review/package.nix
+++ b/pkgs/by-name/ni/nixpkgs-review/package.nix
@@ -18,14 +18,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "nixpkgs-review";
-  version = "3.2.0";
+  version = "3.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = "nixpkgs-review";
     tag = version;
-    hash = "sha256-XJRZpAiIbwN5itqxHTcAqd6VnuUOO8TwShZiupJc8dc=";
+    hash = "sha256-Ey07yahJQv5ppf8TiwIt1Cn4xo4QMZ5v+CsJRDelWNY=";
   };
 
   build-system = [
diff --git a/pkgs/by-name/pr/prefect/package.nix b/pkgs/by-name/pr/prefect/package.nix
index 5378da18d94c..7d566da9aea9 100644
--- a/pkgs/by-name/pr/prefect/package.nix
+++ b/pkgs/by-name/pr/prefect/package.nix
@@ -8,7 +8,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "prefect";
-  version = "3.4.0";
+  version = "3.4.2";
   pyproject = true;
 
   # Trying to install from source is challenging
@@ -17,7 +17,7 @@ python3Packages.buildPythonApplication rec {
   # Source will be missing sdist, uv.lock, ui artefacts ...
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-uguh6sOIy0mOASFsw8ADb8vpmQm7S+t4ZS/6MFFYiic=";
+    hash = "sha256-BORFXIikiX5Cu1rT8jUijkjAnncTACr8lEs/k2fC5Mk=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/pr/proton-ge-bin/package.nix b/pkgs/by-name/pr/proton-ge-bin/package.nix
index 21b76e2eb4cc..3a24fa2ae7dd 100644
--- a/pkgs/by-name/pr/proton-ge-bin/package.nix
+++ b/pkgs/by-name/pr/proton-ge-bin/package.nix
@@ -9,11 +9,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "proton-ge-bin";
-  version = "GE-Proton10-2";
+  version = "GE-Proton10-3";
 
   src = fetchzip {
     url = "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/${finalAttrs.version}/${finalAttrs.version}.tar.gz";
-    hash = "sha256-fCxiwATohvdpfxXkHY1ty5WHS0phARrDszGmwNRmVQE=";
+    hash = "sha256-V4znOni53KMZ0rs7O7TuBst5kDSaEOyWUGgL7EESVAU=";
   };
 
   dontUnpack = true;
@@ -70,6 +70,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://github.com/GloriousEggroll/proton-ge-custom";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [
+      Gliczy
       NotAShelf
       Scrumplex
       shawn8901
diff --git a/pkgs/by-name/ql/qlog/package.nix b/pkgs/by-name/ql/qlog/package.nix
index 9a6121bdb15f..dfedb53dfe7e 100644
--- a/pkgs/by-name/ql/qlog/package.nix
+++ b/pkgs/by-name/ql/qlog/package.nix
@@ -56,7 +56,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/foldynl/QLog";
     maintainers = with lib.maintainers; [
       oliver-koss
-      mkg20001
     ];
     platforms = with lib.platforms; unix;
   };
diff --git a/pkgs/by-name/re/remnote/package.nix b/pkgs/by-name/re/remnote/package.nix
index 90686ae038e4..e3576832234d 100644
--- a/pkgs/by-name/re/remnote/package.nix
+++ b/pkgs/by-name/re/remnote/package.nix
@@ -6,10 +6,10 @@
 }:
 let
   pname = "remnote";
-  version = "1.19.24";
+  version = "1.19.35";
   src = fetchurl {
     url = "https://download2.remnote.io/remnote-desktop2/RemNote-${version}.AppImage";
-    hash = "sha256-+ZNQ94itLdSuw7HS3cLPgJNqVcQ1OfPHF68hFwHpaDQ=";
+    hash = "sha256-UrldNDYof3lYDyP6z3ukFdpiOkJZUJpO8iygI3JaBY4=";
   };
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
 in
diff --git a/pkgs/by-name/re/renderdoc/package.nix b/pkgs/by-name/re/renderdoc/package.nix
index f4b20fb253c9..dba59f5d201a 100644
--- a/pkgs/by-name/re/renderdoc/package.nix
+++ b/pkgs/by-name/re/renderdoc/package.nix
@@ -32,13 +32,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "renderdoc";
-  version = "1.37";
+  version = "1.38";
 
   src = fetchFromGitHub {
     owner = "baldurk";
     repo = "renderdoc";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-udi3v5DyJ9aDBsfTv+T9VTa7SyhNAyuNB3LF5G8vZVg=";
+    hash = "sha256-6DvBV2amPfQff3LleXaqfoKzWvoHUJ0dh/bg/WcGIeA=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/re/renovate/package.nix b/pkgs/by-name/re/renovate/package.nix
index e84299018587..841fb24a3123 100644
--- a/pkgs/by-name/re/renovate/package.nix
+++ b/pkgs/by-name/re/renovate/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "renovate";
-  version = "39.264.0";
+  version = "40.14.4";
 
   src = fetchFromGitHub {
     owner = "renovatebot";
     repo = "renovate";
     tag = finalAttrs.version;
-    hash = "sha256-ACeZ0RAIplcaRKyoEXFCwA/zu96CaLxTwjV0ok3TQ8w=";
+    hash = "sha256-qL1pXlY9rBoZ5o4ZdiDAEv2zmLN42q9kma5/5yOlOno=";
   };
 
   postPatch = ''
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-2F4vcdu2f0yh+hvs1WWM6MsWv2mmUUhzFVWN3BQvfNk=";
+    hash = "sha256-Uj+w9jzbWKLoJgRS5GVGY5QZAwIKsH/MoIu6OailgAw=";
   };
 
   env.COREPACK_ENABLE_STRICT = 0;
diff --git a/pkgs/by-name/sy/synapse-admin-etkecc/package.nix b/pkgs/by-name/sy/synapse-admin-etkecc/package.nix
index 7b0229ab3da6..b4356f22f81f 100644
--- a/pkgs/by-name/sy/synapse-admin-etkecc/package.nix
+++ b/pkgs/by-name/sy/synapse-admin-etkecc/package.nix
@@ -17,18 +17,18 @@ assert lib.asserts.assertMsg (
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "synapse-admin-etkecc";
-  version = "0.10.4-etke40";
+  version = "0.10.4-etke41";
 
   src = fetchFromGitHub {
     owner = "etkecc";
     repo = "synapse-admin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QIOQ25K/QCpSAz3HMOADSIVb3iqfdNCNmWrn7xD0ytU=";
+    hash = "sha256-LHZtB6139sV2HdbIKCZruwH1G5+8iTfKXwjjo4gbNcI=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-YQZN9tj0zGnC4gmTvHM32mdaOw5RFuUL2ZKd9/8GNZA=";
+    hash = "sha256-wdnmsz41rIu8HvsoVHSW8PZLwtmwpz+YSeeDs1GT/vA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ve/vectorcode/package.nix b/pkgs/by-name/ve/vectorcode/package.nix
index 7c86b426cec2..2a422966a661 100644
--- a/pkgs/by-name/ve/vectorcode/package.nix
+++ b/pkgs/by-name/ve/vectorcode/package.nix
@@ -2,6 +2,7 @@
   lib,
   python3Packages,
   fetchFromGitHub,
+  installShellFiles,
   versionCheckHook,
 
   lspSupport ? true,
@@ -63,10 +64,17 @@ python3Packages.buildPythonApplication rec {
     ];
   };
 
+  postInstall = ''
+    $out/bin/vectorcode --print-completion=bash >vectorcode.bash
+    $out/bin/vectorcode --print-completion=zsh >vectorcode.zsh
+    installShellCompletion vectorcode.{bash,zsh}
+  '';
+
   pythonImportsCheck = [ "vectorcode" ];
 
   nativeCheckInputs =
     [
+      installShellFiles
       versionCheckHook
     ]
     ++ (with python3Packages; [
diff --git a/pkgs/by-name/ve/veilid/package.nix b/pkgs/by-name/ve/veilid/package.nix
index bab5c1c96643..bde4286180b5 100644
--- a/pkgs/by-name/ve/veilid/package.nix
+++ b/pkgs/by-name/ve/veilid/package.nix
@@ -12,17 +12,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "veilid";
-  version = "0.4.4";
+  version = "0.4.6";
 
   src = fetchFromGitLab {
     owner = "veilid";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-p9bQ90zUXVeVPUDuns+gmZb9SJHpAVrJOHe+RvEru7w=";
+    hash = "sha256-bKll7VB6LjkmmhN5lmjcSeP2zZbyWnl4XiZbZe3tKgg=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-xbtlZ7PP+RHPlW4a9UCmaCOcsQkDyPim3yPObbXVqns=";
+  cargoHash = "sha256-505gf4P/Hlo8KFynhAQdBagzEqGXhydhTTknat/jWmk=";
 
   nativeBuildInputs = [
     capnproto
diff --git a/pkgs/by-name/vs/vsce/package.nix b/pkgs/by-name/vs/vsce/package.nix
index 91429d8bd801..b98b8844994a 100644
--- a/pkgs/by-name/vs/vsce/package.nix
+++ b/pkgs/by-name/vs/vsce/package.nix
@@ -12,16 +12,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "vsce";
-  version = "3.3.2";
+  version = "3.4.1";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "vscode-vsce";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-6Rls+t1NkU1bZuT8ZWpKYeGmAdMpNFuYGfdZhtszZQ8=";
+    hash = "sha256-ufSEKkLqP+D/D5l5teL82RsoVgIFhbyOVjnZfnecsKI=";
   };
 
-  npmDepsHash = "sha256-HZkzH5flOPiTUvFW/DOi5n034RAvMoU9lRvB6Omdb2M=";
+  npmDepsHash = "sha256-J7ES/a6RHeTY1grdzgYu9ex7BOzadqng2/h2LlTZLns=";
 
   postPatch = ''
     substituteInPlace package.json --replace-fail '"version": "0.0.0"' '"version": "${finalAttrs.version}"'
diff --git a/pkgs/by-name/wo/worldpainter/package.nix b/pkgs/by-name/wo/worldpainter/package.nix
index d37b99ce782f..22c13cf57525 100644
--- a/pkgs/by-name/wo/worldpainter/package.nix
+++ b/pkgs/by-name/wo/worldpainter/package.nix
@@ -10,11 +10,11 @@
 }:
 stdenv.mkDerivation rec {
   pname = "worldpainter";
-  version = "2.23.2";
+  version = "2.24.1";
 
   src = fetchurl {
     url = "https://www.worldpainter.net/files/${pname}_${version}.tar.gz";
-    hash = "sha256-FhrfI2/mBeIZAg26Q8x8T2YU2ANwAkoC3h9Tgw6ggoY=";
+    hash = "sha256-I7bf+BKaHSsR08stLtJu+wY5ek8cj+SjRVwu+RwqEq0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/wy/wyoming-piper/package.nix b/pkgs/by-name/wy/wyoming-piper/package.nix
index 37118de9d98b..1a91f7380b32 100644
--- a/pkgs/by-name/wy/wyoming-piper/package.nix
+++ b/pkgs/by-name/wy/wyoming-piper/package.nix
@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "wyoming-piper";
-  version = "1.5.2";
+  version = "1.5.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "rhasspy";
     repo = "wyoming-piper";
     tag = "v${version}";
-    hash = "sha256-HxLs2NH5muYzVfOtfLlV09BQ3waIfZKBCTiK/Tha6r4=";
+    hash = "sha256-yPGiOF9RXhW7zjvFMi1UCXLyrWiqhJTvvIAtkYb9kBg=";
   };
 
   build-system = with python3Packages; [
@@ -35,7 +35,7 @@ python3Packages.buildPythonApplication rec {
   doCheck = false;
 
   meta = with lib; {
-    changelog = "https://github.com/rhasspy/wyoming-piper/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/rhasspy/wyoming-piper/blob/${src.tag}/CHANGELOG.md";
     description = "Wyoming Server for Piper";
     mainProgram = "wyoming-piper";
     homepage = "https://github.com/rhasspy/wyoming-piper";
diff --git a/pkgs/development/libraries/libpulsar/default.nix b/pkgs/development/libraries/libpulsar/default.nix
index c255ee432d0e..e3952caea88b 100644
--- a/pkgs/development/libraries/libpulsar/default.nix
+++ b/pkgs/development/libraries/libpulsar/default.nix
@@ -48,13 +48,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: rec {
   pname = "libpulsar";
-  version = "3.7.0";
+  version = "3.7.1";
 
   src = fetchFromGitHub {
     owner = "apache";
     repo = "pulsar-client-cpp";
     rev = "v${version}";
-    hash = "sha256-hY6ivTKWgl/2KLeP6MMAdWcM/LJ5b7zoNVRlg6nx6Sc=";
+    hash = "sha256-RHWi0KCq7U7Dr3Ic7kduc8P64VpAThTQ3lDxLLEqzIU=";
   };
 
   nativeBuildInputs =
diff --git a/pkgs/development/octave-modules/io/default.nix b/pkgs/development/octave-modules/io/default.nix
index f5f99b8b108f..989b78ad875f 100644
--- a/pkgs/development/octave-modules/io/default.nix
+++ b/pkgs/development/octave-modules/io/default.nix
@@ -9,11 +9,11 @@
 
 buildOctavePackage rec {
   pname = "io";
-  version = "2.6.4";
+  version = "2.7.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/octave/${pname}-${version}.tar.gz";
-    sha256 = "sha256-p0pAC70ZIn9sB8WFiS3oec165S2CDaH2nxo+PolFL1o=";
+    sha256 = "sha256-SqSEaLNpeTS/jIVOJ9uriCdgXp3U/jflaDQmXmEwum8=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/aiontfy/default.nix b/pkgs/development/python-modules/aiontfy/default.nix
index f369add3574b..625522b20319 100644
--- a/pkgs/development/python-modules/aiontfy/default.nix
+++ b/pkgs/development/python-modules/aiontfy/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "aiontfy";
-  version = "0.5.1";
+  version = "0.5.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tr4nt0r";
     repo = "aiontfy";
     tag = "v${version}";
-    hash = "sha256-WQb6sNjpQVgh+9vH7EyrmJHCWL0Mcmw4hHPHa8KsLYc=";
+    hash = "sha256-xDcx0darzaTRNdtsNTK7rdO5W22Tpt13ZPDOSmO8M8M=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/bitarray/default.nix b/pkgs/development/python-modules/bitarray/default.nix
index fae1cf96cc82..554b317c273d 100644
--- a/pkgs/development/python-modules/bitarray/default.nix
+++ b/pkgs/development/python-modules/bitarray/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "bitarray";
-  version = "3.3.0";
+  version = "3.4.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-BEkJzmO3et9XOd5A4vYhRzRT6dS9uRPvLRTBhaRTLOc=";
+    hash = "sha256-5fqIcyu8+1Q37lVOGPhCqPbIa+c2VrBYDuFG/Tcxdsk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/cloudpathlib/default.nix b/pkgs/development/python-modules/cloudpathlib/default.nix
index 61a65025bf79..00ec94cf771a 100644
--- a/pkgs/development/python-modules/cloudpathlib/default.nix
+++ b/pkgs/development/python-modules/cloudpathlib/default.nix
@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "cloudpathlib";
-  version = "0.21.0";
+  version = "0.21.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     owner = "drivendataorg";
     repo = "cloudpathlib";
     tag = "v${version}";
-    hash = "sha256-sChYdXltPPQ5XP7obY5EoMz/dq3fHQ3FqI0w8noEI+4=";
+    hash = "sha256-Bhr92xMK/WV3u0SG8q9SvO0kGnwSVXHzq6lK/RD2ssk=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/web/playwright/chromium.nix b/pkgs/development/web/playwright/chromium.nix
index ffc93fc2a18c..7561b985f344 100644
--- a/pkgs/development/web/playwright/chromium.nix
+++ b/pkgs/development/web/playwright/chromium.nix
@@ -41,8 +41,8 @@ let
       url = "https://playwright.azureedge.net/builds/chromium/${revision}/chromium-${suffix}.zip";
       hash =
         {
-          x86_64-linux = "sha256-9bK8HOGoQY5kYYfJypYHeuAoVlXIh/1tv1IsXPpUTpA=";
-          aarch64-linux = "sha256-KL6tYnPDszXjCHiSNOPHLtz839JPljSOoP7biQfTTAI=";
+          x86_64-linux = "sha256-7oQQCAIt1VJiMNFEJO40K8oENK/L0BICXm2D/3fZ8bA=";
+          aarch64-linux = "sha256-1OmByLX2jNHXAzWdXF8Od7S7pj/jl4wwvOQcsZc5R7o=";
         }
         .${system} or throwSystem;
     };
diff --git a/pkgs/os-specific/linux/kernel/hardened/patches.json b/pkgs/os-specific/linux/kernel/hardened/patches.json
index 87028b4d077f..1acd79c2ca82 100644
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -2,71 +2,81 @@
     "5.10": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-v5.10.235-hardened1.patch",
-            "sha256": "1xhpwy62jbwbc71s2cglxhrn7radpp256v05d587gf7jwhbi2zmc",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.10.235-hardened1/linux-hardened-v5.10.235-hardened1.patch"
+            "name": "linux-hardened-v5.10.237-hardened1.patch",
+            "sha256": "09a4dx65vn96s62viyhpjnz2hwcwxq8araxhk7x6ximyky888kmr",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.10.237-hardened1/linux-hardened-v5.10.237-hardened1.patch"
         },
-        "sha256": "1k7iq4np3pflkq3d71ya8xs5czhslhy2iha4ls9lma81269y6fwm",
-        "version": "5.10.235"
+        "sha256": "098gvqfaahabqqz64m5fwri57drwiz3006pr805sxw74w0vjgj0z",
+        "version": "5.10.237"
     },
     "5.15": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-v5.15.179-hardened1.patch",
-            "sha256": "18255w5x7fjx37zdzbmigp641izc5h8fp2h8z7lj33z2mf7gfs9y",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.15.179-hardened1/linux-hardened-v5.15.179-hardened1.patch"
+            "name": "linux-hardened-v5.15.182-hardened1.patch",
+            "sha256": "1q6sm4542lb8zcgybxz9gjckvpll1nfyf87yqx9h5rn6a9mlwyl0",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.15.182-hardened1/linux-hardened-v5.15.182-hardened1.patch"
         },
-        "sha256": "0vqk4wd0cacigz42gigdzbj415hcdn2k2m01yr7k8pcv3rxs86ck",
-        "version": "5.15.179"
+        "sha256": "07m3yrkqpmh4cmsmhz8i6da0h7xlprc7r4hb0xcy812s659zmaxn",
+        "version": "5.15.182"
     },
     "5.4": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-v5.4.291-hardened1.patch",
-            "sha256": "1i7x7pdmqbrj306jbqv75ij1lq4hvdmw1qnfa4975zyzdd8d0khq",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.4.291-hardened1/linux-hardened-v5.4.291-hardened1.patch"
+            "name": "linux-hardened-v5.4.293-hardened1.patch",
+            "sha256": "0wblrpmwp3rh1adyg1jbyifdfsdlm3p2mgw2xm9a03vwd0jkdd6f",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.4.293-hardened1/linux-hardened-v5.4.293-hardened1.patch"
         },
-        "sha256": "0vpgb3lmhgv5iw9b1z0kqr6vdv44if49marfp5858z3a8yj69bdk",
-        "version": "5.4.291"
+        "sha256": "0b9p8l6ndm75751f7s03rnxg7yg9c4pj9rb537lhsv6pqx096n1l",
+        "version": "5.4.293"
     },
     "6.1": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-v6.1.131-hardened1.patch",
-            "sha256": "005qvy3r69cy007fvj7m4b49m3vplndb280p2q72wnk9mpw8axrp",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.1.131-hardened1/linux-hardened-v6.1.131-hardened1.patch"
+            "name": "linux-hardened-v6.1.138-hardened1.patch",
+            "sha256": "1llqkxp7kch0ryf6n658z06mv7a7igp0zpxcl3kiqysilm3f93nr",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.1.138-hardened1/linux-hardened-v6.1.138-hardened1.patch"
         },
-        "sha256": "05jvvv3khadvfgdrv43fcrnm606jk4064a7qivkvnk1vc08gbjj4",
-        "version": "6.1.131"
+        "sha256": "04br4ln81skk4lgrgxqhpn2qjvkifi4bm360rfw9zfj9j2xsa6g3",
+        "version": "6.1.138"
     },
     "6.12": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-v6.12.19-hardened1.patch",
-            "sha256": "1f78k1bns49gfb8ari5jg5wkfai206nfpsnwj0y5h5yrjg0x8sx8",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.12.19-hardened1/linux-hardened-v6.12.19-hardened1.patch"
+            "name": "linux-hardened-v6.12.28-hardened1.patch",
+            "sha256": "1l0r20i72p6x362a7i74qjrlf2c7yc92cgla7s1lflcb87yynnzl",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.12.28-hardened1/linux-hardened-v6.12.28-hardened1.patch"
         },
-        "sha256": "0cb5ri6xsd9fyf0s48xrrsbhqzbgjd0iddnid6qk8i60prbz0fyp",
-        "version": "6.12.19"
+        "sha256": "07kpsl6lbsr0zw6p8bglgbchdrv1jivcwwnyh7vwzbk24lc9k878",
+        "version": "6.12.28"
     },
     "6.13": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-v6.13.7-hardened1.patch",
-            "sha256": "0s0h6z9qxqcfdz14zbaalapl2py7z40hf4p6405f2hy5hajdcxq3",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.13.7-hardened1/linux-hardened-v6.13.7-hardened1.patch"
+            "name": "linux-hardened-v6.13.12-hardened1.patch",
+            "sha256": "0i9raq3qcc6pxvs9l6yn5b6k8kiywwlis33kkpd8byqhs57aqsic",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.13.12-hardened1/linux-hardened-v6.13.12-hardened1.patch"
         },
-        "sha256": "07c08x68fgcsgriss5z8w427h69y52s887vas91jzb5p70hbcf9s",
-        "version": "6.13.7"
+        "sha256": "0hhj49k3ksjcp0dg5yiahqzryjfdpr9c1a9ph6j9slzmkikbn7v1",
+        "version": "6.13.12"
+    },
+    "6.14": {
+        "patch": {
+            "extra": "-hardened1",
+            "name": "linux-hardened-v6.14.6-hardened1.patch",
+            "sha256": "0ph6kkgbc0pk83xisggk7xsacryqlzkxgc1nxx590lg285bh33ld",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.14.6-hardened1/linux-hardened-v6.14.6-hardened1.patch"
+        },
+        "sha256": "1acpjxscw5nvgp19jzd29zhl1c6wdzx0bxp4yy0hy8z2k0cpz091",
+        "version": "6.14.6"
     },
     "6.6": {
         "patch": {
             "extra": "-hardened1",
-            "name": "linux-hardened-v6.6.83-hardened1.patch",
-            "sha256": "0wzgkj4ypa3clbzq40jkm3qjhbnj8wj48wc9vxx8v15gl4rppgga",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.6.83-hardened1/linux-hardened-v6.6.83-hardened1.patch"
+            "name": "linux-hardened-v6.6.90-hardened1.patch",
+            "sha256": "0w43dv0179drcg7w7j6gq8l6di0aj4rhfphyz7xlkx6x54jlxbvv",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.6.90-hardened1/linux-hardened-v6.6.90-hardened1.patch"
         },
-        "sha256": "0262q81mwhy8plql8hnnfvagp460vfl127kaayya113l7gkbnjw9",
-        "version": "6.6.83"
+        "sha256": "0kh1ax0j0vl0n267cpij5lf170ab1fg0j6gjzvzc2a8ncx46g1gz",
+        "version": "6.6.90"
     }
 }
diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 7c024a3fbabe..a2f3305bfdb9 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -1,7 +1,7 @@
 {
     "testing": {
-        "version": "6.15-rc6",
-        "hash": "sha256:1l18hsnzh28m2f34rsvq4khwblzl60qc61qs6ic13jbd8jsnhsi9"
+        "version": "6.15-rc7",
+        "hash": "sha256:0b9149pyg4lzzxqwx6sg8nz9ca1md7aijg9nrcagrq9sypl53hxn"
     },
     "6.1": {
         "version": "6.1.139",
diff --git a/pkgs/os-specific/linux/kernel/linux-libre.nix b/pkgs/os-specific/linux/kernel/linux-libre.nix
index 119dbb34b6ab..3420af2b3188 100644
--- a/pkgs/os-specific/linux/kernel/linux-libre.nix
+++ b/pkgs/os-specific/linux/kernel/linux-libre.nix
@@ -5,8 +5,8 @@
   linux,
   scripts ? fetchsvn {
     url = "https://www.fsfla.org/svn/fsfla/software/linux-libre/releases/branches/";
-    rev = "19769";
-    sha256 = "0mfn2pa587laj45zlah424g953yjxmlh49x36byjylmzj079a42n";
+    rev = "19792";
+    sha256 = "1ygpb3i0m6zi2jhxl9kasf54blygsv7qh45nafv4shfk8bg80sn6";
   },
   ...
 }@args:
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
index b5e18343a3e7..6bc23341acad 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.10.nix
@@ -10,7 +10,7 @@
 }@args:
 
 let
-  version = "5.10.234-rt127"; # updated by ./update-rt.sh
+  version = "5.10.237-rt131"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in
@@ -25,7 +25,7 @@ buildLinux (
 
     src = fetchurl {
       url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-      sha256 = "1rgb4v6dvqlw1mgzsli0hxaj2d5d4m1nylgcrwm4bkpiwbzc95wm";
+      sha256 = "098gvqfaahabqqz64m5fwri57drwiz3006pr805sxw74w0vjgj0z";
     };
 
     kernelPatches =
@@ -34,7 +34,7 @@ buildLinux (
           name = "rt";
           patch = fetchurl {
             url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-            sha256 = "1pmfba5sjmhai2hbzgbwhak46jhc45rcxf7zdgx5hbhbpgbl9d49";
+            sha256 = "15f4dylrwm9q0dl3jhcy57611w5kzz74rf9aqfvh7cqxi5q4g8fs";
           };
         };
       in
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix b/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
index ec8816894f78..d7724c5d1046 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-5.15.nix
@@ -10,7 +10,7 @@
 }@args:
 
 let
-  version = "5.15.177-rt83"; # updated by ./update-rt.sh
+  version = "5.15.179-rt84"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in
@@ -29,7 +29,7 @@ buildLinux (
 
     src = fetchurl {
       url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-      sha256 = "1q56w3lqwi3ynny6z7siqzv3h8nryksyw70r3fhghca2il4bi7pa";
+      sha256 = "0vqk4wd0cacigz42gigdzbj415hcdn2k2m01yr7k8pcv3rxs86ck";
     };
 
     kernelPatches =
@@ -38,7 +38,7 @@ buildLinux (
           name = "rt";
           patch = fetchurl {
             url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-            sha256 = "1rc0cbc5jkgr3q3q2syqidak744lxcq3f5zdq6si2rsfxjz45www";
+            sha256 = "0p2yq4ahv0rwynivvlldhalpw65ka6hmjxh26p3pi5qrv3rbwja1";
           };
         };
       in
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
index 9b6afa18763d..6c6459e8b14e 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-6.1.nix
@@ -10,7 +10,7 @@
 }@args:
 
 let
-  version = "6.1.128-rt49"; # updated by ./update-rt.sh
+  version = "6.1.134-rt51"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in
@@ -29,7 +29,7 @@ buildLinux (
 
     src = fetchurl {
       url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-      sha256 = "1wshgkgcxaf4mnm4ngngsj8gq1cg8kq56f5kqsdfcw0m339nfkc7";
+      sha256 = "08xx0w5gz7w5hqsnpckmizi1zpg38iwfchj20163ivnxf3fhriv0";
     };
 
     kernelPatches =
@@ -38,7 +38,7 @@ buildLinux (
           name = "rt";
           patch = fetchurl {
             url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-            sha256 = "1gyy9zwfcczy9v8790f06kaz7gg75a4cf4qpyjffqx3s21lwzbjf";
+            sha256 = "18nznajrbjx9y76lki6aa10jkh33v60fnmyrbc0ds9x9xsnfahzz";
           };
         };
       in
diff --git a/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix b/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
index 7e217a23ea28..5a877d6c32fb 100644
--- a/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
+++ b/pkgs/os-specific/linux/kernel/linux-rt-6.6.nix
@@ -10,7 +10,7 @@
 }@args:
 
 let
-  version = "6.6.77-rt50"; # updated by ./update-rt.sh
+  version = "6.6.87-rt54"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in
@@ -29,7 +29,7 @@ buildLinux (
 
     src = fetchurl {
       url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-      sha256 = "0km855dnimg1clilnpcz293bd2gpbycvn3llm9kyynhjrzgqj408";
+      sha256 = "1iks6msk4cajyy0khyhrwsdl123hr81n67xzdnhlgg6dvb1famw9";
     };
 
     kernelPatches =
@@ -38,7 +38,7 @@ buildLinux (
           name = "rt";
           patch = fetchurl {
             url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-            sha256 = "10kzns1c6yqn7az2i7zwm1lnss56mi6w44rw7xm2kk6n1h80590n";
+            sha256 = "0qxfs10y1ndq346gvcmhv0a02bbd3804yn1hvpx3p7bjp91j2as6";
           };
         };
       in
diff --git a/pkgs/os-specific/linux/qc71_laptop/default.nix b/pkgs/os-specific/linux/qc71_laptop/default.nix
index 73a6a77dbad9..2705375237ce 100644
--- a/pkgs/os-specific/linux/qc71_laptop/default.nix
+++ b/pkgs/os-specific/linux/qc71_laptop/default.nix
@@ -40,6 +40,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/pobrn/qc71_laptop/";
     license = licenses.gpl2Only;
     maintainers = with maintainers; [ aacebedo ];
-    platforms = platforms.linux;
+    platforms = [ "x86_64-linux" ];
   };
 }
diff --git a/pkgs/tools/misc/opentelemetry-collector/builder.nix b/pkgs/tools/misc/opentelemetry-collector/builder.nix
index 0637e73a4211..79aff8206e66 100644
--- a/pkgs/tools/misc/opentelemetry-collector/builder.nix
+++ b/pkgs/tools/misc/opentelemetry-collector/builder.nix
@@ -7,17 +7,17 @@ buildGoModule rec {
   pname = "ocb";
   # Also update `pkgs/tools/misc/opentelemetry-collector/releases.nix`
   # whenever that version changes.
-  version = "0.124.0";
+  version = "0.126.0";
 
   src = fetchFromGitHub {
     owner = "open-telemetry";
     repo = "opentelemetry-collector";
     rev = "cmd/builder/v${version}";
-    hash = "sha256-CfqCMVObS1TUYO0DqNdqRSPS1cG0TiKvyBaHH57BPNw=";
+    hash = "sha256-YxNo5xY+Fnw690eKzLgnJHeR0qxzk+ZtOlqKIpnaFjM=";
   };
 
   sourceRoot = "${src.name}/cmd/builder";
-  vendorHash = "sha256-1wgS9AIoFHlSUoELEQVvx+bCnTApEvwKRhTKGrcUGM8=";
+  vendorHash = "sha256-tZXghqPpvLU5+TPXXyWaXm0xBaTd8FdKslPoK02WFr8=";
 
   env.CGO_ENABLED = 0;
   ldflags = [
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index d767c8eb2842..f81e70d39f25 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -991,6 +991,7 @@ mapAliases {
   libbitcoin-protocol = throw "libbitcoin-protocol has been removed as it required an obsolete version of Boost and had no maintainer in Nixpkgs"; # Added 2024-11-24
   libchop = throw "libchop has been removed due to failing to build and being unmaintained upstream"; # Added 2025-05-02
   libdwg = throw "libdwg has been removed as upstream is unmaintained, the code doesn't build without significant patches, and the package had no reverse dependencies"; # Added 2024-12-28
+  libfpx = throw "libfpx has been removed as it was unmaintained in Nixpkgs and had known vulnerabilities"; # Added 2025-05-20
   libgadu = throw "'libgadu' has been removed as upstream is unmaintained and has no dependents or maintainers in Nixpkgs"; # Added 2025-05-17
   libgcrypt_1_8 = throw "'libgcrypt_1_8' is end-of-life. Consider using 'libgcrypt' instead"; # Added 2025-01-05
   libgda = lib.warnOnInstantiate "‘libgda’ has been renamed to ‘libgda5’" libgda5; # Added 2025-01-21
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 77c0304e4387..198ea1b474a6 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11200,6 +11200,8 @@ with pkgs;
   linux_6_12_hardened = linuxKernel.kernels.linux_6_12_hardened;
   linuxPackages_6_13_hardened = linuxKernel.packages.linux_6_13_hardened;
   linux_6_13_hardened = linuxKernel.kernels.linux_6_13_hardened;
+  linuxPackages_6_14_hardened = linuxKernel.packages.linux_6_14_hardened;
+  linux_6_14_hardened = linuxKernel.kernels.linux_6_14_hardened;
 
   # GNU Linux-libre kernels
   linuxPackages-libre = linuxKernel.packages.linux_libre;
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index 900ef2f76a26..a700297a9c97 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -327,6 +327,7 @@ in
         linux_6_6_hardened = hardenedKernelFor kernels.linux_6_6 { };
         linux_6_12_hardened = hardenedKernelFor kernels.linux_6_12 { };
         linux_6_13_hardened = hardenedKernelFor kernels.linux_6_13 { };
+        linux_6_14_hardened = hardenedKernelFor kernels.linux_6_14 { };
 
       }
       // lib.optionalAttrs config.allowAliases {
@@ -793,6 +794,7 @@ in
       linux_6_6_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_6_hardened);
       linux_6_12_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_12_hardened);
       linux_6_13_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_13_hardened);
+      linux_6_14_hardened = recurseIntoAttrs (packagesFor kernels.linux_6_14_hardened);
 
       linux_zen = recurseIntoAttrs (packagesFor kernels.linux_zen);
       linux_lqx = recurseIntoAttrs (packagesFor kernels.linux_lqx);