diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index ac65bfd7509c..400443af13c6 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -24,8 +24,8 @@ let
     sha256Hash = "sha256-S8KK/EGev0v03fVywIkD6Ym3LrciGKXJVorzyZ1ljdQ=";
   };
   latestVersion = {
-    version = "2025.1.4.3"; # "Android Studio Narwhal 4 Feature Drop | 2025.1.4 Canary 3"
-    sha256Hash = "sha256-YYacdZ7YdmmrTSsKtCfmSSrrZV+/GGPK34KnlO0+aKQ=";
+    version = "2025.1.4.4"; # "Android Studio Narwhal 4 Feature Drop | 2025.1.4 Canary 4"
+    sha256Hash = "sha256-Cp5oZiCJJDffZRAg7CPNNR82Mn6k4QpjQtqMiokFAws=";
   };
 in
 {
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 64fcc74388e9..227c59f526f9 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -3004,8 +3004,8 @@ let
         mktplcRef = {
           name = "rainbow-csv";
           publisher = "mechatroner";
-          version = "3.20.0";
-          hash = "sha256-qQ05km8jLLoMFItVbgVWNXmmaBDWd0Bcbq88HPaRdWs=";
+          version = "3.21.0";
+          hash = "sha256-IPgPE5vM9tzHPioRBZeJs4hqut6t++SjZJlHnz/ismA=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/mechatroner.rainbow-csv/changelog";
diff --git a/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix b/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
index 5bd5f108be26..a2acc917cc9c 100644
--- a/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-dev";
     publisher = "saoudrizwan";
-    version = "3.25.3";
-    hash = "sha256-9a4QvVZ0vWR0zWgYAZN0zv95J2VNBbFQHc8mAH6H680=";
+    version = "3.27.1";
+    hash = "sha256-+gCQ9p/FI7LlORC0sMwD501iCh5cDurqv2UzOs43ckU=";
   };
 
   meta = {
diff --git a/pkgs/applications/video/mpv/scripts/sponsorblock-minimal.nix b/pkgs/applications/video/mpv/scripts/sponsorblock-minimal.nix
index 681815459091..071097720686 100644
--- a/pkgs/applications/video/mpv/scripts/sponsorblock-minimal.nix
+++ b/pkgs/applications/video/mpv/scripts/sponsorblock-minimal.nix
@@ -9,15 +9,15 @@
 
 buildLua {
   pname = "mpv_sponsorblock_minimal";
-  version = "0-unstable-2023-08-20";
+  version = "0-unstable-2025-09-09";
   scriptPath = "sponsorblock_minimal.lua";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "jouni";
     repo = "mpv_sponsorblock_minimal";
-    rev = "ca2844b8cf7674bfccd282d389a50427742251d3";
-    hash = "sha256-28HWZ6nOhKiE+5Ya1N3Vscd8aeH9OKS0t72e/xPfFQQ=";
+    rev = "fc0db1fbffc873ca02ced7602274393fde8857e5";
+    hash = "sha256-DOgJ1gZybfIFJQ5qt4B93ugHz1o+RJ7E8Cnb7itYfTs=";
   };
   passthru.updateScript = unstableGitUpdater { };
 
diff --git a/pkgs/by-name/as/ast-grep/package.nix b/pkgs/by-name/as/ast-grep/package.nix
index 75450ebdf8b1..33b034cbde85 100644
--- a/pkgs/by-name/as/ast-grep/package.nix
+++ b/pkgs/by-name/as/ast-grep/package.nix
@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ast-grep";
-  version = "0.39.4";
+  version = "0.39.5";
 
   src = fetchFromGitHub {
     owner = "ast-grep";
     repo = "ast-grep";
     tag = finalAttrs.version;
-    hash = "sha256-V5nBfYCPJKxhpWRG44GdoFIL5fRFyZB4W7YBtTNPv2I=";
+    hash = "sha256-hgJD3cc+FbOuI2ZCuKDN2u9vMZngIvPGUqFRjpFE/zY=";
   };
 
   # error: linker `aarch64-linux-gnu-gcc` not found
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm .cargo/config.toml
   '';
 
-  cargoHash = "sha256-qVUWK3p7S3biucy5Mz3eMjBndrlwJ8pn1TS8qLutNYs=";
+  cargoHash = "sha256-KLiE1lbgrWj8RYLTFLMqukeH1W9ipE1vYaId2/DJHrE=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/cl/closurecompiler/package.nix b/pkgs/by-name/cl/closurecompiler/package.nix
index 931fa70ff3cc..a9b2a115f6fa 100644
--- a/pkgs/by-name/cl/closurecompiler/package.nix
+++ b/pkgs/by-name/cl/closurecompiler/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "closure-compiler";
-  version = "20250706";
+  version = "20250820";
 
   src = fetchurl {
     url = "mirror://maven/com/google/javascript/closure-compiler/v${version}/closure-compiler-v${version}.jar";
-    sha256 = "sha256-yf2w6a04S1Y60nL1hkxrhdLAiYO7yjdrUUqTPbyT2Ow=";
+    sha256 = "sha256-Fx0kNU/+fc03j+Tfsw5Gc4WTkfTaEacLoE/awN1NgtI=";
   };
 
   dontUnpack = true;
diff --git a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-typescript.nix b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-typescript.nix
index c5967b2769e9..734b48ba4b81 100644
--- a/pkgs/by-name/dp/dprint/plugins/dprint-plugin-typescript.nix
+++ b/pkgs/by-name/dp/dprint/plugins/dprint-plugin-typescript.nix
@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "TypeScript/JavaScript code formatter";
-  hash = "sha256-gzwhGs3udzxLeYW4/OHqZRaD6y9WBNS2QlSYne8QAao=";
+  hash = "sha256-azXAPEwle+VeKFWeWooNn7dPv0DD6zaKer0mdr1K9II=";
   initConfig = {
     configExcludes = [ "**/node_modules" ];
     configKey = "typescript";
@@ -16,6 +16,6 @@ mkDprintPlugin {
   };
   pname = "dprint-plugin-typescript";
   updateUrl = "https://plugins.dprint.dev/dprint/typescript/latest.json";
-  url = "https://plugins.dprint.dev/typescript-0.95.10.wasm";
-  version = "0.95.10";
+  url = "https://plugins.dprint.dev/typescript-0.95.11.wasm";
+  version = "0.95.11";
 }
diff --git a/pkgs/by-name/fr/frei0r/package.nix b/pkgs/by-name/fr/frei0r/package.nix
index 33e4bce96c39..4d890bbbb6e7 100644
--- a/pkgs/by-name/fr/frei0r/package.nix
+++ b/pkgs/by-name/fr/frei0r/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "frei0r-plugins";
-  version = "2.3.3";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "dyne";
     repo = "frei0r";
     rev = "v${version}";
-    hash = "sha256-uKYCJD88TnrJTTnzCCietNt01QPeFW+hhnjcBNKUWsY=";
+    hash = "sha256-95d1aXfCq4mPccY8VKmO7jkX57li6OVSwtfIf9459n4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/hy/hyprland/info.json b/pkgs/by-name/hy/hyprland/info.json
index fb957092746d..9d7b62731399 100644
--- a/pkgs/by-name/hy/hyprland/info.json
+++ b/pkgs/by-name/hy/hyprland/info.json
@@ -1,7 +1,7 @@
 {
-  "branch": "v0.50.1-b",
-  "commit_hash": "4e242d086e20b32951fdc0ebcbfb4d41b5be8dcc",
-  "commit_message": "[gha] Nix: update inputs",
-  "date": "2025-07-19",
-  "tag": "v0.50.1"
+  "branch": "main",
+  "commit_hash": "46174f78b374b6cea669c48880877a8bdcf7802f",
+  "commit_message": "version: bump to 0.51.0",
+  "date": "2025-09-10",
+  "tag": "v0.51.0"
 }
diff --git a/pkgs/by-name/hy/hyprland/package.nix b/pkgs/by-name/hy/hyprland/package.nix
index 728fb8d719c9..02352aa054e9 100644
--- a/pkgs/by-name/hy/hyprland/package.nix
+++ b/pkgs/by-name/hy/hyprland/package.nix
@@ -91,14 +91,14 @@ assert assertMsg (
 
 customStdenv.mkDerivation (finalAttrs: {
   pname = "hyprland" + optionalString debug "-debug";
-  version = "0.50.1";
+  version = "0.51.0";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprland";
     fetchSubmodules = true;
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ALp/WkfOfXMScwytTmjxpjRNmbezrgFQdEX6n3py7L8=";
+    hash = "sha256-aZCTbfKkxsEinY5V7R0NYuuitKLYc8ig8T91+yDMGJ0=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/iw/iw/package.nix b/pkgs/by-name/iw/iw/package.nix
index 38228ed96d31..8ab7b853ce65 100644
--- a/pkgs/by-name/iw/iw/package.nix
+++ b/pkgs/by-name/iw/iw/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "iw";
-  version = "6.9";
+  version = "6.17";
 
   src = fetchurl {
     url = "https://www.kernel.org/pub/software/network/iw/iw-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Py2yKtQcZ1JCuYrjlC2/MRJUjGCkL/c5IQ8t5OmOSJQ=";
+    hash = "sha256-fRguSYKJqzmyV9pngNVi5BU3cQf1A1juW1W4z+QLHjM=";
   };
 
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/by-name/on/oniux/package.nix b/pkgs/by-name/on/oniux/package.nix
index e5a831835093..1d2beb22012f 100644
--- a/pkgs/by-name/on/oniux/package.nix
+++ b/pkgs/by-name/on/oniux/package.nix
@@ -7,17 +7,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "oniux";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.torproject.org";
     owner = "tpo/core";
     repo = "oniux";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KLtII1pO1G9dsmu7Fq+CwvgYfrWCaSRiCs1+VhlU3Ck=";
+    hash = "sha256-icrNKF9cGPBZPbaGCj2c8OtdP6A14whPoP39zhs4wlo=";
   };
 
-  cargoHash = "sha256-tYHGuBEuwrB/gSCWbSKEavlADIYiNpWjOpVQxYgEC+U=";
+  cargoHash = "sha256-juWtf0aX70xJTx9KpXOATyXARhk7aTaveUFN0OPKrbs=";
 
   nativeBuildInputs = [
     perl
diff --git a/pkgs/by-name/pg/pgf3/package.nix b/pkgs/by-name/pg/pgf3/package.nix
index 234908c8606e..2ee9301d60b0 100644
--- a/pkgs/by-name/pg/pgf3/package.nix
+++ b/pkgs/by-name/pg/pgf3/package.nix
@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "pgf";
-  version = "3.1.11";
+  version = "3.1.11a";
 
   src = fetchFromGitHub {
     owner = "pgf-tikz";
     repo = "pgf";
     tag = finalAttrs.version;
-    hash = "sha256-YBoGukCggj0jb1Y+EWZBoaW2XIQpb7ks/nHp4jsSBak=";
+    hash = "sha256-+OxQ7sf5qh9hiVdCapJOUUwxDNsbvCXZEupN52wqldE=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/pi/pike/package.nix b/pkgs/by-name/pi/pike/package.nix
index ea06e6a0d499..0016b9891b22 100644
--- a/pkgs/by-name/pi/pike/package.nix
+++ b/pkgs/by-name/pi/pike/package.nix
@@ -120,13 +120,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "pike";
-  version = "8.0.2020";
+  version = "8.0.2024";
 
   src = fetchFromGitHub {
     owner = "pikelang";
     repo = "Pike";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VHfMfICtvCHdFTIjiYw9tR5g9KycR7jqdg3wT+T37mA=";
+    hash = "sha256-a5egJww2O0pGzoAy/M5VXEQ70f74cto4X/HyD7et9MU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/qo/qownnotes/package.nix b/pkgs/by-name/qo/qownnotes/package.nix
index 3265160fe9fe..f94fbe48d78d 100644
--- a/pkgs/by-name/qo/qownnotes/package.nix
+++ b/pkgs/by-name/qo/qownnotes/package.nix
@@ -18,11 +18,11 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "25.8.7";
+  version = "25.9.1";
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${finalAttrs.version}/qownnotes-${finalAttrs.version}.tar.xz";
-    hash = "sha256-OBLFdJAiBleymmWVDYIu7zeMNDU++HAlyPJi5qSoRO4=";
+    hash = "sha256-YTlQroUtcu6p64ZVIhRhyXRY9X+ujTEgdCLz78HGU1g=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/qu/quisk/package.nix b/pkgs/by-name/qu/quisk/package.nix
index b2db75f7f036..4423d723b787 100644
--- a/pkgs/by-name/qu/quisk/package.nix
+++ b/pkgs/by-name/qu/quisk/package.nix
@@ -9,12 +9,12 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "quisk";
-  version = "4.2.42";
+  version = "4.2.43";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Di5B0irH6G8XQtwXVDk4FXwLRo5Nh+cyt9zsG7+dMkc=";
+    hash = "sha256-z5O7Oz6Wa0Orr1RgKVoBzlyfdlpLKi96NHNjffLkJ80=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/wa/waydroid-helper/package.nix b/pkgs/by-name/wa/waydroid-helper/package.nix
index 569e8206c726..b18ed959773f 100644
--- a/pkgs/by-name/wa/waydroid-helper/package.nix
+++ b/pkgs/by-name/wa/waydroid-helper/package.nix
@@ -26,13 +26,13 @@
 }:
 
 let
-  version = "0.2.6";
+  version = "0.2.7";
 
   src = fetchFromGitHub {
     owner = "ayasa520";
     repo = "waydroid-helper";
     tag = "v${version}";
-    hash = "sha256-iLBgryNb8NGsfjZmI0xxGFv+lAt0XFT2uXdEabTIRyA=";
+    hash = "sha256-I8DwaPQQz4eSyuTCwkbidhXACfpdOYcmGjP7d03DIU0=";
   };
 in
 python3Packages.buildPythonApplication {
diff --git a/pkgs/by-name/wh/whisparr/package.nix b/pkgs/by-name/wh/whisparr/package.nix
index 16d30470493d..50d934ded76e 100644
--- a/pkgs/by-name/wh/whisparr/package.nix
+++ b/pkgs/by-name/wh/whisparr/package.nix
@@ -29,16 +29,16 @@ let
     ."${system}" or (throw "Unsupported system: ${system}");
   hash =
     {
-      arm64-linux-hash = "sha256-UxdqLIaMXSLEMeNKoDBgOIRt72Lmjdl1YCY2U4qNXys=";
-      arm64-osx-hash = "sha256-qufwdptO7WKkAmLi3EO/09XQUX7RLlRPwssq6OovTxY=";
-      x64-linux-hash = "sha256-a1UadZq1UWSFh1VVf3bZVK2wY1hqh59jxgu06Ib6kSc=";
-      x64-osx-hash = "sha256-z9Oo/0Gda4QKiPMxXXE14Be/PhBR8yEvqKY011Et+Yo=";
+      arm64-linux-hash = "sha256-rzxvj+jLtHzHnHY31YiJsf7hAhn2Lxzra/cfPl/ibV8=";
+      arm64-osx-hash = "sha256-7ITEK4Nu63BBX+WnuLN89RLtxbDn7QWQ3iFkgUEn+oc=";
+      x64-linux-hash = "sha256-191CTseBjOKhMX1O8vTnOOYh+x0x43r6jQyz1oU946o=";
+      x64-osx-hash = "sha256-DZgdcpE6kIdlL58AOlQI8V4fWytkA9QGrEW7QwIHzkM=";
     }
     ."${arch}-${os}-hash";
 in
 stdenv.mkDerivation rec {
   pname = "whisparr";
-  version = "2.0.0.1250";
+  version = "2.0.0.1253";
 
   src = fetchurl {
     name = "${pname}-${arch}-${os}-${version}.tar.gz";
diff --git a/pkgs/by-name/xe/xen/package.nix b/pkgs/by-name/xe/xen/package.nix
index 6604e3b89736..cc472848e0e5 100644
--- a/pkgs/by-name/xe/xen/package.nix
+++ b/pkgs/by-name/xe/xen/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   testers,
   fetchgit,
+  fetchpatch,
   replaceVars,
 
   # Xen
@@ -184,6 +185,30 @@ stdenv.mkDerivation (finalAttrs: {
     ./0001-makefile-efi-output-directory.patch
 
     (replaceVars ./0002-scripts-external-executable-calls.patch scriptDeps)
+
+    # XSA 472
+    (fetchpatch {
+      url = "https://xenbits.xen.org/xsa/xsa472-1.patch";
+      hash = "sha256-6k/X7KFno9uBG0mUtJxl7TMavaRs2Xlj9JlW9ai6p0k=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xen.org/xsa/xsa472-2.patch";
+      hash = "sha256-BisdztU9Wa5nIGmHo4IikqYPHdEhBehHaNqj1IuBe6I=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xen.org/xsa/xsa472-3.patch";
+      hash = "sha256-rikOofQeuLNMBkdQS3xzmwh7BlgMOTMSsQcAOEzNOso=";
+    })
+
+    # XSA 473
+    (fetchpatch {
+      url = "https://xenbits.xen.org/xsa/xsa473-1.patch";
+      hash = "sha256-594tTalWcGJSLj3++4QB/ADkHH1qJNrdvg7FG6kOuB8=";
+    })
+    (fetchpatch {
+      url = "https://xenbits.xen.org/xsa/xsa473-2.patch";
+      hash = "sha256-tGuIGxJFBXbckIruSUeTyrM6GabdIj6Pr3cVxeDvNNY=";
+    })
   ];
 
   outputs = [
diff --git a/pkgs/development/python-modules/pywinbox/default.nix b/pkgs/development/python-modules/pywinbox/default.nix
index 6d857e11fa22..29d87942bd17 100644
--- a/pkgs/development/python-modules/pywinbox/default.nix
+++ b/pkgs/development/python-modules/pywinbox/default.nix
@@ -1,4 +1,5 @@
 {
+  stdenv,
   lib,
   buildPythonPackage,
   fetchFromGitHub,
@@ -7,6 +8,8 @@
   ewmhlib,
   xlib,
   typing-extensions,
+  pyobjc-core,
+  pyobjc-framework-Cocoa,
 }:
 
 buildPythonPackage rec {
@@ -27,6 +30,10 @@ buildPythonPackage rec {
     ewmhlib
     xlib
     typing-extensions
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    pyobjc-core
+    pyobjc-framework-Cocoa
   ];
 
   # requires x session (use ewmhlib)
diff --git a/pkgs/kde/misc/klevernotes/default.nix b/pkgs/kde/misc/klevernotes/default.nix
index 2a7c14b9cefd..408c06b83c3f 100644
--- a/pkgs/kde/misc/klevernotes/default.nix
+++ b/pkgs/kde/misc/klevernotes/default.nix
@@ -9,11 +9,11 @@
 }:
 mkKdeDerivation rec {
   pname = "klevernotes";
-  version = "1.2.2";
+  version = "1.2.3";
 
   src = fetchurl {
     url = "mirror://kde/stable/klevernotes/${version}/klevernotes-${version}.tar.xz";
-    hash = "sha256-WQoeozREN4GsqUC4OlYTrirt+fYa1yeT90RaJxvTH3I=";
+    hash = "sha256-eWCjZrOfjqu6uC9WDqwoYg9Vyss8PGxEXKzR+MgEg24=";
   };
 
   extraBuildInputs = [