diff --git a/.github/workflows/bot.yml b/.github/workflows/bot.yml
index c496465885b9..42e5e4d4157d 100644
--- a/.github/workflows/bot.yml
+++ b/.github/workflows/bot.yml
@@ -53,7 +53,7 @@ jobs:
             ci/github-script
 
       - name: Install dependencies
-        run: npm install @actions/artifact@5.0.3 bottleneck@2.19.5
+        run: npm install @actions/artifact@6.2.1 bottleneck@2.19.5
 
       # Use a GitHub App, because it has much higher rate limits: 12,500 instead of 5,000 req / hour.
       - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ea1ddd46e243..ca662723c5d1 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -85,7 +85,9 @@ jobs:
       - name: Build NixOS manual
         if: |
           contains(matrix.builds, 'manual-nixos') && !cancelled() &&
-          contains(fromJSON(inputs.baseBranch).type, 'primary')
+          (contains(fromJSON(inputs.baseBranch).type, 'primary')
+            || startsWith(fromJSON(inputs.baseBranch).branch, 'staging-nixos')
+          )
         run: nix-build-uncached nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned -A manual-nixos --out-link nixos-manual
 
       - name: Build Nixpkgs manual
diff --git a/ci/github-script/bot.js b/ci/github-script/bot.js
index b360d54347f0..0fa2851ff38b 100644
--- a/ci/github-script/bot.js
+++ b/ci/github-script/bot.js
@@ -1,6 +1,6 @@
 module.exports = async ({ github, context, core, dry }) => {
   const path = require('node:path')
-  const { DefaultArtifactClient } = require('@actions/artifact')
+  const { DefaultArtifactClient } = await import('@actions/artifact')
   const { readFile, writeFile } = require('node:fs/promises')
   const withRateLimit = require('./withRateLimit.js')
   const { classify } = require('../supportedBranches.js')
@@ -483,6 +483,7 @@ module.exports = async ({ github, context, core, dry }) => {
           dry,
           pull_request,
           reviews,
+          events,
           // TODO: Use maintainer map instead of the artifact.
           user_maintainers: Object.keys(
             JSON.parse(
diff --git a/ci/github-script/check-target-branch.js b/ci/github-script/check-target-branch.js
index a31520c02fc6..cdb2670aeac0 100644
--- a/ci/github-script/check-target-branch.js
+++ b/ci/github-script/check-target-branch.js
@@ -105,7 +105,7 @@ async function checkTargetBranch({ github, context, core, dry }) {
   // These should go to staging-nixos instead of master,
   // but release-xx.xx (not staging-xx.xx) when backported
   let isExemptKernelUpdate = false
-  if (prInfo.changed_files === 1 && base.startsWith('release-')) {
+  if (prInfo.changed_files === 1) {
     const changedFiles = (
       await github.rest.pulls.listFiles({
         ...context.repo,
@@ -114,8 +114,11 @@ async function checkTargetBranch({ github, context, core, dry }) {
     ).data
     isExemptKernelUpdate =
       changedFiles.length === 1 &&
-      changedFiles[0].filename ===
-        'pkgs/os-specific/linux/kernel/kernels-org.json'
+      (changedFiles[0].filename ===
+        'pkgs/os-specific/linux/kernel/xanmod-kernels.nix' ||
+        (base.startsWith('release-') &&
+          changedFiles[0].filename ===
+            'pkgs/os-specific/linux/kernel/kernels-org.json'))
   }
 
   // https://github.com/NixOS/nixpkgs/pull/483194#issuecomment-3793393218
diff --git a/ci/github-script/package-lock.json b/ci/github-script/package-lock.json
index 0efde5946e28..9e354e74ae46 100644
--- a/ci/github-script/package-lock.json
+++ b/ci/github-script/package-lock.json
@@ -6,57 +6,58 @@
     "": {
       "name": "github-script",
       "dependencies": {
-        "@actions/artifact": "5.0.3",
-        "@actions/core": "1.11.1",
-        "@actions/github": "6.0.1",
+        "@actions/artifact": "6.2.1",
+        "@actions/core": "1.10.1",
+        "@actions/github": "9.1.0",
         "bottleneck": "2.19.5",
         "commander": "14.0.3"
       }
     },
     "node_modules/@actions/artifact": {
-      "version": "5.0.3",
-      "resolved": "https://registry.npmjs.org/@actions/artifact/-/artifact-5.0.3.tgz",
-      "integrity": "sha512-FIEG8Kum0wABZnktJvFi1xuVPc31xrunhZwLCvjrCGISQOm0ifyo7cjqf6PHiEeqoWMa5HIGOsB+lGM4aKCseA==",
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/@actions/artifact/-/artifact-6.2.1.tgz",
+      "integrity": "sha512-sJGH0mhEbEjBCw7o6SaLhUU66u27aFW8HTfkIb5Tk2/Wy0caUDc+oYQEgnuFN7a0HCpAbQyK0U6U7XUJDgDWrw==",
       "license": "MIT",
       "dependencies": {
-        "@actions/core": "^2.0.0",
-        "@actions/github": "^6.0.1",
-        "@actions/http-client": "^3.0.2",
-        "@azure/storage-blob": "^12.29.1",
-        "@octokit/core": "^5.2.1",
-        "@octokit/plugin-request-log": "^1.0.4",
-        "@octokit/plugin-retry": "^3.0.9",
-        "@octokit/request": "^8.4.1",
-        "@octokit/request-error": "^5.1.1",
+        "@actions/core": "^3.0.0",
+        "@actions/github": "^9.0.0",
+        "@actions/http-client": "^4.0.0",
+        "@azure/storage-blob": "^12.30.0",
+        "@octokit/core": "^7.0.6",
+        "@octokit/plugin-request-log": "^6.0.0",
+        "@octokit/plugin-retry": "^8.0.0",
+        "@octokit/request": "^10.0.7",
+        "@octokit/request-error": "^7.1.0",
         "@protobuf-ts/plugin": "^2.2.3-alpha.1",
+        "@protobuf-ts/runtime": "^2.9.4",
         "archiver": "^7.0.1",
-        "jwt-decode": "^3.1.2",
+        "jwt-decode": "^4.0.0",
         "unzip-stream": "^0.3.1"
       }
     },
     "node_modules/@actions/artifact/node_modules/@actions/core": {
-      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/@actions/core/-/core-2.0.3.tgz",
-      "integrity": "sha512-Od9Thc3T1mQJYddvVPM4QGiLUewdh+3txmDYHHxoNdkqysR1MbCT+rFOtNUxYAz+7+6RIsqipVahY2GJqGPyxA==",
+      "version": "3.0.1",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-3.0.1.tgz",
+      "integrity": "sha512-a6d/Nwahm9fliVGRhdhofo40HjHQasUPusmc7vBfyky+7Z+P2A1J68zyFVaNcEclc/Se+eO595oAr5nwEIoIUA==",
       "license": "MIT",
       "dependencies": {
-        "@actions/exec": "^2.0.0",
-        "@actions/http-client": "^3.0.2"
+        "@actions/exec": "^3.0.0",
+        "@actions/http-client": "^4.0.0"
       }
     },
     "node_modules/@actions/artifact/node_modules/@actions/exec": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-2.0.0.tgz",
-      "integrity": "sha512-k8ngrX2voJ/RIN6r9xB82NVqKpnMRtxDoiO+g3olkIUpQNqjArXrCQceduQZCQj3P3xm32pChRLqRrtXTlqhIw==",
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-3.0.0.tgz",
+      "integrity": "sha512-6xH/puSoNBXb72VPlZVm7vQ+svQpFyA96qdDBvhB8eNZOE8LtPf9L4oAsfzK/crCL8YZ+19fKYVnM63Sl+Xzlw==",
       "license": "MIT",
       "dependencies": {
-        "@actions/io": "^2.0.0"
+        "@actions/io": "^3.0.2"
       }
     },
     "node_modules/@actions/artifact/node_modules/@actions/http-client": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.2.tgz",
-      "integrity": "sha512-JP38FYYpyqvUsz+Igqlc/JG6YO9PaKuvqjM3iGvaLqFnJ7TFmcLyy2IDrY0bI0qCQug8E9K+elv5ZNfw62ZJzA==",
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-4.0.1.tgz",
+      "integrity": "sha512-+Nvd1ImaOZBSoPbsUtEhv+1z99H12xzncCkz0a3RuehINE81FZSe2QTj3uvAPTcJX/SCzUQHQ0D1GrPMbrPitg==",
       "license": "MIT",
       "dependencies": {
         "tunnel": "^0.0.6",
@@ -64,9 +65,9 @@
       }
     },
     "node_modules/@actions/artifact/node_modules/@actions/io": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@actions/io/-/io-2.0.0.tgz",
-      "integrity": "sha512-Jv33IN09XLO+0HS79aaODsvIRyduiF7NY/F6LYeK5oeUmrsz7aFdRphQjFoESF4jS7lMauDOttKALcpapVDIAg==",
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@actions/io/-/io-3.0.2.tgz",
+      "integrity": "sha512-nRBchcMM+QK1pdjO7/idu86rbJI5YHUKCvKs0KxnSYbVe3F51UfGxuZX4Qy/fWlp6l7gWFwIkrOzN+oUK03kfw==",
       "license": "MIT"
     },
     "node_modules/@actions/artifact/node_modules/undici": {
@@ -79,97 +80,47 @@
       }
     },
     "node_modules/@actions/core": {
-      "version": "1.11.1",
-      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.11.1.tgz",
-      "integrity": "sha512-hXJCSrkwfA46Vd9Z3q4cpEpHB1rL5NG04+/rbqW9d3+CSvtB1tYe8UTpAlixa1vj0m/ULglfEK2UKxMGxCxv5A==",
+      "version": "1.10.1",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.10.1.tgz",
+      "integrity": "sha512-3lBR9EDAY+iYIpTnTIXmWcNbX3T2kCkAEQGIQx4NVQ0575nk2k3GRZDTPQG+vVtS2izSLmINlxXf0uLtnrTP+g==",
       "license": "MIT",
       "dependencies": {
-        "@actions/exec": "^1.1.1",
-        "@actions/http-client": "^2.0.1"
-      }
-    },
-    "node_modules/@actions/exec": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-1.1.1.tgz",
-      "integrity": "sha512-+sCcHHbVdk93a0XT19ECtO/gIXoxvdsgQLzb2fE2/5sIZmWQuluYyjPQtrtTHdU1YzTZ7bAPN4sITq2xi1679w==",
-      "license": "MIT",
-      "dependencies": {
-        "@actions/io": "^1.0.1"
+        "@actions/http-client": "^2.0.1",
+        "uuid": "^8.3.2"
       }
     },
     "node_modules/@actions/github": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/@actions/github/-/github-6.0.1.tgz",
-      "integrity": "sha512-xbZVcaqD4XnQAe35qSQqskb3SqIAfRyLBrHMd/8TuL7hJSz2QtbDwnNM8zWx4zO5l2fnGtseNE3MbEvD7BxVMw==",
+      "version": "9.1.0",
+      "resolved": "https://registry.npmjs.org/@actions/github/-/github-9.1.0.tgz",
+      "integrity": "sha512-u0hDGQeCS+7VNoLA8hYG65RLdPLMaPGfka0sZ0up7P0AiShqfX6xcuXNteGkQ7X7Tod7AMNwHd4p7DS63i8zzA==",
       "license": "MIT",
       "dependencies": {
-        "@actions/http-client": "^2.2.0",
-        "@octokit/core": "^5.0.1",
-        "@octokit/plugin-paginate-rest": "^9.2.2",
-        "@octokit/plugin-rest-endpoint-methods": "^10.4.0",
-        "@octokit/request": "^8.4.1",
-        "@octokit/request-error": "^5.1.1",
-        "undici": "^5.28.5"
+        "@actions/http-client": "^3.0.2",
+        "@octokit/core": "^7.0.6",
+        "@octokit/plugin-paginate-rest": "^14.0.0",
+        "@octokit/plugin-rest-endpoint-methods": "^17.0.0",
+        "@octokit/request": "^10.0.7",
+        "@octokit/request-error": "^7.1.0",
+        "undici": "^6.23.0"
       }
     },
-    "node_modules/@actions/github/node_modules/@octokit/plugin-paginate-rest": {
-      "version": "9.2.2",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-9.2.2.tgz",
-      "integrity": "sha512-u3KYkGF7GcZnSD/3UP0S7K5XUFT2FkOQdcfXZGZQPGv3lm4F2Xbf71lvjldr8c1H3nNbF+33cLEkWYbokGWqiQ==",
+    "node_modules/@actions/github/node_modules/@actions/http-client": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.2.tgz",
+      "integrity": "sha512-JP38FYYpyqvUsz+Igqlc/JG6YO9PaKuvqjM3iGvaLqFnJ7TFmcLyy2IDrY0bI0qCQug8E9K+elv5ZNfw62ZJzA==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/types": "^12.6.0"
-      },
+        "tunnel": "^0.0.6",
+        "undici": "^6.23.0"
+      }
+    },
+    "node_modules/@actions/github/node_modules/undici": {
+      "version": "6.25.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.25.0.tgz",
+      "integrity": "sha512-ZgpWDC5gmNiuY9CnLVXEH8rl50xhRCuLNA97fAUnKi8RRuV4E6KG31pDTsLVUKnohJE0I3XDrTeEydAXRw47xg==",
+      "license": "MIT",
       "engines": {
-        "node": ">= 18"
-      },
-      "peerDependencies": {
-        "@octokit/core": "5"
-      }
-    },
-    "node_modules/@actions/github/node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/openapi-types": {
-      "version": "20.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-20.0.0.tgz",
-      "integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA==",
-      "license": "MIT"
-    },
-    "node_modules/@actions/github/node_modules/@octokit/plugin-paginate-rest/node_modules/@octokit/types": {
-      "version": "12.6.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.6.0.tgz",
-      "integrity": "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/openapi-types": "^20.0.0"
-      }
-    },
-    "node_modules/@actions/github/node_modules/@octokit/plugin-rest-endpoint-methods": {
-      "version": "10.4.1",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-10.4.1.tgz",
-      "integrity": "sha512-xV1b+ceKV9KytQe3zCVqjg+8GTGfDYwaT1ATU5isiUyVtlVAO3HNdzpS4sr4GBx4hxQ46s7ITtZrAsxG22+rVg==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/types": "^12.6.0"
-      },
-      "engines": {
-        "node": ">= 18"
-      },
-      "peerDependencies": {
-        "@octokit/core": "5"
-      }
-    },
-    "node_modules/@actions/github/node_modules/@octokit/plugin-rest-endpoint-methods/node_modules/@octokit/openapi-types": {
-      "version": "20.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-20.0.0.tgz",
-      "integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA==",
-      "license": "MIT"
-    },
-    "node_modules/@actions/github/node_modules/@octokit/plugin-rest-endpoint-methods/node_modules/@octokit/types": {
-      "version": "12.6.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.6.0.tgz",
-      "integrity": "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/openapi-types": "^20.0.0"
+        "node": ">=18.17"
       }
     },
     "node_modules/@actions/http-client": {
@@ -182,12 +133,6 @@
         "undici": "^5.25.4"
       }
     },
-    "node_modules/@actions/io": {
-      "version": "1.1.3",
-      "resolved": "https://registry.npmjs.org/@actions/io/-/io-1.1.3.tgz",
-      "integrity": "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q==",
-      "license": "MIT"
-    },
     "node_modules/@azure/abort-controller": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
@@ -459,195 +404,161 @@
       "license": "MIT"
     },
     "node_modules/@octokit/auth-token": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-4.0.0.tgz",
-      "integrity": "sha512-tY/msAuJo6ARbK6SPIxZrPBms3xPbfwBrulZe0Wtr/DIY9lje2HeV1uoebShn6mx7SjCHif6EjMvoREj+gZ+SA==",
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-6.0.0.tgz",
+      "integrity": "sha512-P4YJBPdPSpWTQ1NU4XYdvHvXJJDxM6YwpS0FZHRgP7YFkdVxsWcpWGy/NVqlAA7PcPCnMacXlRm1y2PFZRWL/w==",
       "license": "MIT",
       "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
       }
     },
     "node_modules/@octokit/core": {
-      "version": "5.2.2",
-      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-5.2.2.tgz",
-      "integrity": "sha512-/g2d4sW9nUDJOMz3mabVQvOGhVa4e/BN/Um7yca9Bb2XTzPPnfTWHWQg+IsEYO7M3Vx+EXvaM/I2pJWIMun1bg==",
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-7.0.6.tgz",
+      "integrity": "sha512-DhGl4xMVFGVIyMwswXeyzdL4uXD5OGILGX5N8Y+f6W7LhC1Ze2poSNrkF/fedpVDHEEZ+PHFW0vL14I+mm8K3Q==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/auth-token": "^4.0.0",
-        "@octokit/graphql": "^7.1.0",
-        "@octokit/request": "^8.4.1",
-        "@octokit/request-error": "^5.1.1",
-        "@octokit/types": "^13.0.0",
-        "before-after-hook": "^2.2.0",
-        "universal-user-agent": "^6.0.0"
+        "@octokit/auth-token": "^6.0.0",
+        "@octokit/graphql": "^9.0.3",
+        "@octokit/request": "^10.0.6",
+        "@octokit/request-error": "^7.0.2",
+        "@octokit/types": "^16.0.0",
+        "before-after-hook": "^4.0.0",
+        "universal-user-agent": "^7.0.0"
       },
       "engines": {
-        "node": ">= 18"
-      }
-    },
-    "node_modules/@octokit/core/node_modules/@octokit/openapi-types": {
-      "version": "24.2.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
-      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
-      "license": "MIT"
-    },
-    "node_modules/@octokit/core/node_modules/@octokit/types": {
-      "version": "13.10.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
-      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/openapi-types": "^24.2.0"
+        "node": ">= 20"
       }
     },
     "node_modules/@octokit/endpoint": {
-      "version": "9.0.6",
-      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-9.0.6.tgz",
-      "integrity": "sha512-H1fNTMA57HbkFESSt3Y9+FBICv+0jFceJFPWDePYlR/iMGrwM5ph+Dd4XRQs+8X+PUFURLQgX9ChPfhJ/1uNQw==",
+      "version": "11.0.3",
+      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-11.0.3.tgz",
+      "integrity": "sha512-FWFlNxghg4HrXkD3ifYbS/IdL/mDHjh9QcsNyhQjN8dplUoZbejsdpmuqdA76nxj2xoWPs7p8uX2SNr9rYu0Ag==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/types": "^13.1.0",
-        "universal-user-agent": "^6.0.0"
+        "@octokit/types": "^16.0.0",
+        "universal-user-agent": "^7.0.2"
       },
       "engines": {
-        "node": ">= 18"
-      }
-    },
-    "node_modules/@octokit/endpoint/node_modules/@octokit/openapi-types": {
-      "version": "24.2.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
-      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
-      "license": "MIT"
-    },
-    "node_modules/@octokit/endpoint/node_modules/@octokit/types": {
-      "version": "13.10.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
-      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/openapi-types": "^24.2.0"
+        "node": ">= 20"
       }
     },
     "node_modules/@octokit/graphql": {
-      "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-7.1.1.tgz",
-      "integrity": "sha512-3mkDltSfcDUoa176nlGoA32RGjeWjl3K7F/BwHwRMJUW/IteSa4bnSV8p2ThNkcIcZU2umkZWxwETSSCJf2Q7g==",
+      "version": "9.0.3",
+      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-9.0.3.tgz",
+      "integrity": "sha512-grAEuupr/C1rALFnXTv6ZQhFuL1D8G5y8CN04RgrO4FIPMrtm+mcZzFG7dcBm+nq+1ppNixu+Jd78aeJOYxlGA==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/request": "^8.4.1",
-        "@octokit/types": "^13.0.0",
-        "universal-user-agent": "^6.0.0"
+        "@octokit/request": "^10.0.6",
+        "@octokit/types": "^16.0.0",
+        "universal-user-agent": "^7.0.0"
       },
       "engines": {
-        "node": ">= 18"
-      }
-    },
-    "node_modules/@octokit/graphql/node_modules/@octokit/openapi-types": {
-      "version": "24.2.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
-      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
-      "license": "MIT"
-    },
-    "node_modules/@octokit/graphql/node_modules/@octokit/types": {
-      "version": "13.10.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
-      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/openapi-types": "^24.2.0"
+        "node": ">= 20"
       }
     },
     "node_modules/@octokit/openapi-types": {
-      "version": "12.11.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-12.11.0.tgz",
-      "integrity": "sha512-VsXyi8peyRq9PqIz/tpqiL2w3w80OgVMwBHltTml3LmVvXiphgeqmY9mvBw9Wu7e0QWk/fqD37ux8yP5uVekyQ==",
+      "version": "27.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-27.0.0.tgz",
+      "integrity": "sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA==",
       "license": "MIT"
     },
-    "node_modules/@octokit/plugin-request-log": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-request-log/-/plugin-request-log-1.0.4.tgz",
-      "integrity": "sha512-mLUsMkgP7K/cnFEw07kWqXGF5LKrOkD+lhCrKvPHXWDywAwuDUeDwWBpc69XK3pNX0uKiVt8g5z96PJ6z9xCFA==",
+    "node_modules/@octokit/plugin-paginate-rest": {
+      "version": "14.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-14.0.0.tgz",
+      "integrity": "sha512-fNVRE7ufJiAA3XUrha2omTA39M6IXIc6GIZLvlbsm8QOQCYvpq/LkMNGyFlB1d8hTDzsAXa3OKtybdMAYsV/fw==",
       "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^16.0.0"
+      },
+      "engines": {
+        "node": ">= 20"
+      },
       "peerDependencies": {
-        "@octokit/core": ">=3"
+        "@octokit/core": ">=6"
+      }
+    },
+    "node_modules/@octokit/plugin-request-log": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-request-log/-/plugin-request-log-6.0.0.tgz",
+      "integrity": "sha512-UkOzeEN3W91/eBq9sPZNQ7sUBvYCqYbrrD8gTbBuGtHEuycE4/awMXcYvx6sVYo7LypPhmQwwpUe4Yyu4QZN5Q==",
+      "license": "MIT",
+      "engines": {
+        "node": ">= 20"
+      },
+      "peerDependencies": {
+        "@octokit/core": ">=6"
+      }
+    },
+    "node_modules/@octokit/plugin-rest-endpoint-methods": {
+      "version": "17.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-17.0.0.tgz",
+      "integrity": "sha512-B5yCyIlOJFPqUUeiD0cnBJwWJO8lkJs5d8+ze9QDP6SvfiXSz1BF+91+0MeI1d2yxgOhU/O+CvtiZ9jSkHhFAw==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/types": "^16.0.0"
+      },
+      "engines": {
+        "node": ">= 20"
+      },
+      "peerDependencies": {
+        "@octokit/core": ">=6"
       }
     },
     "node_modules/@octokit/plugin-retry": {
-      "version": "3.0.9",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-3.0.9.tgz",
-      "integrity": "sha512-r+fArdP5+TG6l1Rv/C9hVoty6tldw6cE2pRHNGmFPdyfrc696R6JjrQ3d7HdVqGwuzfyrcaLAKD7K8TX8aehUQ==",
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-8.1.0.tgz",
+      "integrity": "sha512-O1FZgXeiGb2sowEr/hYTr6YunGdSAFWnr2fyW39Ah85H8O33ELASQxcvOFF5LE6Tjekcyu2ms4qAzJVhSaJxTw==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/types": "^6.0.3",
+        "@octokit/request-error": "^7.0.2",
+        "@octokit/types": "^16.0.0",
         "bottleneck": "^2.15.3"
+      },
+      "engines": {
+        "node": ">= 20"
+      },
+      "peerDependencies": {
+        "@octokit/core": ">=7"
       }
     },
     "node_modules/@octokit/request": {
-      "version": "8.4.1",
-      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-8.4.1.tgz",
-      "integrity": "sha512-qnB2+SY3hkCmBxZsR/MPCybNmbJe4KAlfWErXq+rBKkQJlbjdJeS85VI9r8UqeLYLvnAenU8Q1okM/0MBsAGXw==",
+      "version": "10.0.9",
+      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.9.tgz",
+      "integrity": "sha512-o8Bi3f608eyM+7BmBiUWxFsdjLb3/ym1cQek5LZOv9KkZcxRrHCPhhRzm6xjO6HVZ85ItD6+sTsjxo821SVa/A==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/endpoint": "^9.0.6",
-        "@octokit/request-error": "^5.1.1",
-        "@octokit/types": "^13.1.0",
-        "universal-user-agent": "^6.0.0"
+        "@octokit/endpoint": "^11.0.3",
+        "@octokit/request-error": "^7.0.2",
+        "@octokit/types": "^16.0.0",
+        "content-type": "^2.0.0",
+        "fast-content-type-parse": "^3.0.0",
+        "json-with-bigint": "^3.5.3",
+        "universal-user-agent": "^7.0.2"
       },
       "engines": {
-        "node": ">= 18"
+        "node": ">= 20"
       }
     },
     "node_modules/@octokit/request-error": {
-      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.1.1.tgz",
-      "integrity": "sha512-v9iyEQJH6ZntoENr9/yXxjuezh4My67CBSu9r6Ve/05Iu5gNgnisNWOsoJHTP6k0Rr0+HQIpnH+kyammu90q/g==",
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-7.1.0.tgz",
+      "integrity": "sha512-KMQIfq5sOPpkQYajXHwnhjCC0slzCNScLHs9JafXc4RAJI+9f+jNDlBNaIMTvazOPLgb4BnlhGJOTbnN0wIjPw==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/types": "^13.1.0",
-        "deprecation": "^2.0.0",
-        "once": "^1.4.0"
+        "@octokit/types": "^16.0.0"
       },
       "engines": {
-        "node": ">= 18"
-      }
-    },
-    "node_modules/@octokit/request-error/node_modules/@octokit/openapi-types": {
-      "version": "24.2.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
-      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
-      "license": "MIT"
-    },
-    "node_modules/@octokit/request-error/node_modules/@octokit/types": {
-      "version": "13.10.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
-      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/openapi-types": "^24.2.0"
-      }
-    },
-    "node_modules/@octokit/request/node_modules/@octokit/openapi-types": {
-      "version": "24.2.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
-      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
-      "license": "MIT"
-    },
-    "node_modules/@octokit/request/node_modules/@octokit/types": {
-      "version": "13.10.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
-      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
-      "license": "MIT",
-      "dependencies": {
-        "@octokit/openapi-types": "^24.2.0"
+        "node": ">= 20"
       }
     },
     "node_modules/@octokit/types": {
-      "version": "6.41.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-6.41.0.tgz",
-      "integrity": "sha512-eJ2jbzjdijiL3B4PrSQaSjuF2sPEQPVCPzBvTHJD9Nz+9dw2SGH4K4xeQJ77YfTq5bRQ+bD8wT11JbeDPmxmGg==",
+      "version": "16.0.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-16.0.0.tgz",
+      "integrity": "sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/openapi-types": "^12.11.0"
+        "@octokit/openapi-types": "^27.0.0"
       }
     },
     "node_modules/@pkgjs/parseargs": {
@@ -855,9 +766,9 @@
       "license": "MIT"
     },
     "node_modules/before-after-hook": {
-      "version": "2.2.3",
-      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-2.2.3.tgz",
-      "integrity": "sha512-NzUnlZexiaH/46WDhANlyR2bXRopNg4F/zuSA3OpZnllCUgRaOF2znDioDWrmbNVsuZk6l9pMquQB38cfBZwkQ==",
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-4.0.0.tgz",
+      "integrity": "sha512-q6tR3RPqIB1pMiTRMFcZwuG5T8vwp+vUvEG0vuI6B+Rikh5BfPp2fQ82c925FOs+b0lcFQ8CFrL+KbilfZFhOQ==",
       "license": "Apache-2.0"
     },
     "node_modules/binary": {
@@ -984,6 +895,19 @@
         "node": ">= 14"
       }
     },
+    "node_modules/content-type": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/content-type/-/content-type-2.0.0.tgz",
+      "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
+      }
+    },
     "node_modules/core-util-is": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.3.tgz",
@@ -1046,12 +970,6 @@
         }
       }
     },
-    "node_modules/deprecation": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/deprecation/-/deprecation-2.3.1.tgz",
-      "integrity": "sha512-xmHIy4F3scKVwMsQ4WnVaS8bHOx0DmVwRywosKhaILI0ywMDWPtBSku2HNxRvF7jtwDRsoEwYQSfbxj8b7RlJQ==",
-      "license": "ISC"
-    },
     "node_modules/eastasianwidth": {
       "version": "0.2.0",
       "resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz",
@@ -1082,6 +1000,22 @@
         "node": ">=0.8.x"
       }
     },
+    "node_modules/fast-content-type-parse": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/fast-content-type-parse/-/fast-content-type-parse-3.0.0.tgz",
+      "integrity": "sha512-ZvLdcY8P+N8mGQJahJV5G4U88CSvT1rP8ApL6uETe88MBXrBHAkZlSEySdUlyztF7ccb+Znos3TFqaepHxdhBg==",
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/fastify"
+        },
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/fastify"
+        }
+      ],
+      "license": "MIT"
+    },
     "node_modules/fast-fifo": {
       "version": "1.3.2",
       "resolved": "https://registry.npmjs.org/fast-fifo/-/fast-fifo-1.3.2.tgz",
@@ -1269,12 +1203,21 @@
         "@pkgjs/parseargs": "^0.11.0"
       }
     },
-    "node_modules/jwt-decode": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/jwt-decode/-/jwt-decode-3.1.2.tgz",
-      "integrity": "sha512-UfpWE/VZn0iP50d8cz9NrZLM9lSWhcJ+0Gt/nm4by88UL+J1SiKN8/5dkjMmbEzwL2CAe+67GsegCbIKtbp75A==",
+    "node_modules/json-with-bigint": {
+      "version": "3.5.8",
+      "resolved": "https://registry.npmjs.org/json-with-bigint/-/json-with-bigint-3.5.8.tgz",
+      "integrity": "sha512-eq/4KP6K34kwa7TcFdtvnftvHCD9KvHOGGICWwMFc4dOOKF5t4iYqnfLK8otCRCRv06FXOzGGyqE8h8ElMvvdw==",
       "license": "MIT"
     },
+    "node_modules/jwt-decode": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/jwt-decode/-/jwt-decode-4.0.0.tgz",
+      "integrity": "sha512-+KJGIyHgkGuIq3IEBNftfhW/LfWhXUIY6OmyVWjliu5KH1y0fw7VQ8YndE2O4qZdMSd9SqbnC8GOcZEy0Om7sA==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
+    },
     "node_modules/lazystream": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/lazystream/-/lazystream-1.0.1.tgz",
@@ -1389,15 +1332,6 @@
         "node": ">=0.10.0"
       }
     },
-    "node_modules/once": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
-      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
-      "license": "ISC",
-      "dependencies": {
-        "wrappy": "1"
-      }
-    },
     "node_modules/package-json-from-dist": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/package-json-from-dist/-/package-json-from-dist-1.0.1.tgz",
@@ -1749,9 +1683,9 @@
       }
     },
     "node_modules/universal-user-agent": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-6.0.1.tgz",
-      "integrity": "sha512-yCzhz6FN2wU1NiiQRogkTQszlQSlpWaw8SvVegAc+bDxbzHgh1vX8uIe8OYyMH6DwH+sdTJsgMl36+mSMdRJIQ==",
+      "version": "7.0.3",
+      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz",
+      "integrity": "sha512-TmnEAEAsBJVZM/AADELsK76llnwcf9vMKuPz8JflO1frO8Lchitr0fNaN9d+Ap0BjKtqWqd/J17qeDnXh8CL2A==",
       "license": "ISC"
     },
     "node_modules/unzip-stream": {
@@ -1770,6 +1704,16 @@
       "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==",
       "license": "MIT"
     },
+    "node_modules/uuid": {
+      "version": "8.3.2",
+      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
+      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
+      "deprecated": "uuid@10 and below is no longer supported.  For ESM codebases, update to uuid@latest.  For CommonJS codebases, use uuid@11 (but be aware this version will likely be deprecated in 2028).",
+      "license": "MIT",
+      "bin": {
+        "uuid": "dist/bin/uuid"
+      }
+    },
     "node_modules/which": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
@@ -1876,12 +1820,6 @@
         "node": ">=8"
       }
     },
-    "node_modules/wrappy": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
-      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
-      "license": "ISC"
-    },
     "node_modules/xml-naming": {
       "version": "0.1.0",
       "resolved": "https://registry.npmjs.org/xml-naming/-/xml-naming-0.1.0.tgz",
diff --git a/ci/github-script/package.json b/ci/github-script/package.json
index 6b25b6fa5603..290ef068e90b 100644
--- a/ci/github-script/package.json
+++ b/ci/github-script/package.json
@@ -7,9 +7,9 @@
     "`.github/workflows/bot.yml`."
   ],
   "dependencies": {
-    "@actions/artifact": "5.0.3",
-    "@actions/core": "1.11.1",
-    "@actions/github": "6.0.1",
+    "@actions/artifact": "6.2.1",
+    "@actions/core": "1.10.1",
+    "@actions/github": "9.1.0",
     "bottleneck": "2.19.5",
     "commander": "14.0.3"
   }
diff --git a/ci/github-script/reviewers.js b/ci/github-script/reviewers.js
index be458ba4eb32..6fc6ede00f96 100644
--- a/ci/github-script/reviewers.js
+++ b/ci/github-script/reviewers.js
@@ -6,6 +6,7 @@ async function handleReviewers({
   dry,
   pull_request,
   reviews,
+  events,
   user_maintainers,
   team_maintainers,
   owners,
@@ -14,20 +15,28 @@ async function handleReviewers({
 }) {
   const pull_number = pull_request.number
 
-  // Users that the PR has already reached, e.g. they've left a review or have been requested for one
-  const users_reached = new Set([
-    ...pull_request.requested_reviewers.map(({ login }) => login.toLowerCase()),
-    ...reviews.map(({ user }) => user.login.toLowerCase()),
-  ])
+  // Users currently requested for review (pending).
+  const pending_users = new Set(
+    pull_request.requested_reviewers.map(({ login }) => login.toLowerCase()),
+  )
+  // Users who actually submitted a review in this PR (any state, including DISMISSED).
+  const users_engaged = new Set(
+    reviews.map(({ user }) => user.login.toLowerCase()),
+  )
+  // Users the PR has already reached: pending OR engaged.
+  const users_reached = pending_users.union(users_engaged)
   log('reviewers - users_reached', Array.from(users_reached).join(', '))
 
-  // Same for teams
-  const teams_reached = new Set([
-    ...pull_request.requested_teams.map(({ slug }) => slug.toLowerCase()),
-    ...reviews.flatMap(({ onBehalfOf }) =>
+  // Same for teams. A team is engaged only via `onBehalfOf` reviews.
+  const pending_teams = new Set(
+    pull_request.requested_teams.map(({ slug }) => slug.toLowerCase()),
+  )
+  const teams_engaged = new Set(
+    reviews.flatMap(({ onBehalfOf }) =>
       onBehalfOf.nodes.map(({ slug }) => slug.toLowerCase()),
     ),
-  ])
+  )
+  const teams_reached = pending_teams.union(teams_engaged)
   log('reviewers - teams_reached', Array.from(teams_reached).join(', '))
 
   // Early sanity check, before we start making any API requests. The list of maintainers
@@ -149,37 +158,101 @@ async function handleReviewers({
   )
   log('reviewers - teams_not_yet_reached', teams_not_yet_reached.join(', '))
 
-  if (
-    users_not_yet_reached.length === 0 &&
-    teams_not_yet_reached.length === 0
-  ) {
+  // The usernames of bots that make review requests we may auto-revoke.
+  const revokable_requesters = ['github-actions[bot]', 'nixpkgs-ci[bot]']
+
+  // Find latest `review_requested` actor per reviewer / team.
+  const last_request_actor_for_user = new Map()
+  const last_request_actor_for_team = new Map()
+  for (const ev of events) {
+    if (ev.event !== 'review_requested') continue
+    if (ev.requested_reviewer?.login) {
+      last_request_actor_for_user.set(
+        ev.requested_reviewer.login.toLowerCase(),
+        ev.actor?.login ?? '',
+      )
+    }
+    if (ev.requested_team?.slug) {
+      last_request_actor_for_team.set(
+        ev.requested_team.slug.toLowerCase(),
+        ev.actor?.login ?? '',
+      )
+    }
+  }
+
+  // Pending requests no longer in the to_reach set, excluding the engaged
+  // and anything not requested by our own bot.
+  const users_to_remove = Array.from(
+    pending_users.difference(users_to_reach).difference(users_engaged),
+  ).filter((login) =>
+    revokable_requesters.includes(last_request_actor_for_user.get(login)),
+  )
+  log('reviewers - users_to_remove', users_to_remove.join(', '))
+
+  // Same for teams.
+  const teams_to_remove = Array.from(
+    pending_teams.difference(teams_to_reach).difference(teams_engaged),
+  ).filter((slug) =>
+    revokable_requesters.includes(last_request_actor_for_team.get(slug)),
+  )
+  log('reviewers - teams_to_remove', teams_to_remove.join(', '))
+
+  const has_adds =
+    users_not_yet_reached.length > 0 || teams_not_yet_reached.length > 0
+  const has_removals = users_to_remove.length > 0 || teams_to_remove.length > 0
+
+  if (!has_adds && !has_removals) {
     log('Has reviewer changes', 'false (skipped)')
   } else if (dry) {
-    core.info(
-      `Requesting user reviewers for #${pull_number}: ${users_not_yet_reached.join(', ')} (dry)`,
-    )
-    core.info(
-      `Requesting team reviewers for #${pull_number}: ${teams_not_yet_reached.join(', ')} (dry)`,
-    )
+    if (has_adds) {
+      core.info(
+        `Requesting user reviewers for #${pull_number}: ${users_not_yet_reached.join(', ')} (dry)`,
+      )
+      core.info(
+        `Requesting team reviewers for #${pull_number}: ${teams_not_yet_reached.join(', ')} (dry)`,
+      )
+    }
+    if (has_removals) {
+      core.info(
+        `Revoking stale reviewers for #${pull_number}: users=[${users_to_remove.join(', ')}], teams=[${teams_to_remove.join(', ')}] (dry)`,
+      )
+    }
   } else {
     // We had tried the "request all reviewers at once" thing in the past, but it didn't work out:
     //   https://github.com/NixOS/nixpkgs/commit/034613f860fcd339bd2c20c8f6bc259a2f9dc034
     // If we're hitting API errors here again, we'll need to investigate - and possibly reverse
     // course.
-    await github.rest.pulls.requestReviewers({
-      ...context.repo,
-      pull_number,
-      reviewers: users_not_yet_reached,
-      team_reviewers: teams_not_yet_reached,
-    })
+    // Add and remove sets are disjoint by construction. Parallel is safe.
+    await Promise.all(
+      [
+        has_adds &&
+          github.rest.pulls.requestReviewers({
+            ...context.repo,
+            pull_number,
+            reviewers: users_not_yet_reached,
+            team_reviewers: teams_not_yet_reached,
+          }),
+        has_removals &&
+          github.rest.pulls.removeRequestedReviewers({
+            ...context.repo,
+            pull_number,
+            reviewers: users_to_remove,
+            team_reviewers: teams_to_remove,
+          }),
+      ].filter(Boolean),
+    )
   }
 
+  // Subtract the just-revoked so revoking the last pending reviewer flips the label.
+  const users_still_reached = users_reached.difference(new Set(users_to_remove))
+  const teams_still_reached = teams_reached.difference(new Set(teams_to_remove))
+
   // Return a boolean on whether the "needs: reviewers" label should be set.
   return (
     users_not_yet_reached.length === 0 &&
     teams_not_yet_reached.length === 0 &&
-    users_reached.size === 0 &&
-    teams_reached.size === 0
+    users_still_reached.size === 0 &&
+    teams_still_reached.size === 0
   )
 }
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index ad70358f6191..d02117ff6d45 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -2796,6 +2796,12 @@
     github = "aware70";
     githubId = 7832566;
   };
+  awildleon = {
+    name = "Leon Hubrich";
+    github = "AWildLeon";
+    githubId = 114652332;
+    email = "git@leon-hubrich.de";
+  };
   axertheaxe = {
     email = "axertheaxe@proton.me";
     github = "AxerTheAxe";
@@ -11277,6 +11283,12 @@
     githubId = 1031119;
     name = "Ian-Woo Kim";
   };
+  ibbem = {
+    name = "ibbem";
+    github = "ibbem";
+    githubId = 61984399;
+    email = "ibbem@ibbem.net";
+  };
   ibizaman = {
     email = "ibizapeanut@gmail.com";
     github = "ibizaman";
diff --git a/nixos/modules/services/desktops/blueman.nix b/nixos/modules/services/desktops/blueman.nix
index 8f62dc6b05ae..2b92d226dfa4 100644
--- a/nixos/modules/services/desktops/blueman.nix
+++ b/nixos/modules/services/desktops/blueman.nix
@@ -13,12 +13,6 @@ in
   options = {
     services.blueman = {
       enable = lib.mkEnableOption "blueman, a bluetooth manager";
-
-      withApplet = lib.mkOption {
-        type = lib.types.bool;
-        default = true;
-        description = "Whether to spawn the Blueman tray applet.";
-      };
     };
   };
 
@@ -30,15 +24,5 @@ in
     services.dbus.packages = [ pkgs.blueman ];
 
     systemd.packages = [ pkgs.blueman ];
-
-    systemd.user.services.blueman-applet = lib.mkIf cfg.withApplet {
-      description = "Blueman tray applet";
-      wantedBy = [ "graphical-session.target" ];
-      partOf = [ "graphical-session.target" ];
-      serviceConfig = {
-        ExecStart = "${pkgs.blueman}/bin/blueman-applet";
-        Restart = "on-failure";
-      };
-    };
   };
 }
diff --git a/pkgs/applications/emulators/libretro/cores/gpsp.nix b/pkgs/applications/emulators/libretro/cores/gpsp.nix
index 33071a1fa586..927fde20bfbd 100644
--- a/pkgs/applications/emulators/libretro/cores/gpsp.nix
+++ b/pkgs/applications/emulators/libretro/cores/gpsp.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "gpsp";
-  version = "0-unstable-2026-04-20";
+  version = "0-unstable-2026-05-12";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "gpsp";
-    rev = "eca3bee1e2d2043d42f0480012c1e7ec85498f88";
-    hash = "sha256-GvS9HoHzT1Dr3OGLJFwMdB6+lw3vyKMRHzHuLdMxpY8=";
+    rev = "d6decfa351b575e2936afebba26d41ec20e4ddcd";
+    hash = "sha256-kqqNyBEaWlj9E4tZz7VK2186Y6DRDtcFBMIH7GpUDx4=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/mame2003-plus.nix b/pkgs/applications/emulators/libretro/cores/mame2003-plus.nix
index 2986784a4b4e..69c42c934586 100644
--- a/pkgs/applications/emulators/libretro/cores/mame2003-plus.nix
+++ b/pkgs/applications/emulators/libretro/cores/mame2003-plus.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mame2003-plus";
-  version = "0-unstable-2026-05-03";
+  version = "0-unstable-2026-05-15";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame2003-plus-libretro";
-    rev = "5373e38e1091eb28f075513ecdc2575bafc8a5e3";
-    hash = "sha256-1BmAwxRVTh0/Pfd3KlxZccdub8bODeypr3eQcv7qGNU=";
+    rev = "a4a02f8f26cc8e983faeabe0a7cfdd55f0ba5403";
+    hash = "sha256-cBl67GBGaI69ETtGhwTiwxaTUl9vw8O69gdskfuoTUo=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/misc/zathura/cb/default.nix b/pkgs/applications/misc/zathura/cb/default.nix
index 241e304c2fe3..ec3b8d21b835 100644
--- a/pkgs/applications/misc/zathura/cb/default.nix
+++ b/pkgs/applications/misc/zathura/cb/default.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zathura-cb";
-  version = "2026.02.03";
+  version = "2026.05.10";
 
   src = fetchFromGitHub {
     owner = "pwmt";
     repo = "zathura-cb";
     tag = finalAttrs.version;
-    hash = "sha256-k5WbJR0PToiSQo00igH/3uHWp7z4dNxwSXiAos6OgJ8=";
+    hash = "sha256-rSRUNPmmAXmxarAE+y4cwfvAZ9AajeaWLWoRFo5DZ7M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/zathura/djvu/default.nix b/pkgs/applications/misc/zathura/djvu/default.nix
index 0c221739fccd..2f082c6a4081 100644
--- a/pkgs/applications/misc/zathura/djvu/default.nix
+++ b/pkgs/applications/misc/zathura/djvu/default.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zathura-djvu";
-  version = "2026.02.03";
+  version = "2026.05.10";
 
   src = fetchFromGitHub {
     owner = "pwmt";
     repo = "zathura-djvu";
     tag = finalAttrs.version;
-    hash = "sha256-5Nl9hK2uOS/NZ4MOxe3m6E9CBt5YKGeh1lZZ5E5bghw=";
+    hash = "sha256-LW5gQhqV4vwXj1BRlNK1ZfTdQcqt4rJtHckFLvUvPI8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/zathura/pdf-mupdf/default.nix b/pkgs/applications/misc/zathura/pdf-mupdf/default.nix
index 73c166ffe6b3..8c9c186aab04 100644
--- a/pkgs/applications/misc/zathura/pdf-mupdf/default.nix
+++ b/pkgs/applications/misc/zathura/pdf-mupdf/default.nix
@@ -24,14 +24,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "2026.02.03";
+  version = "2026.05.10";
   pname = "zathura-pdf-mupdf";
 
   src = fetchFromGitHub {
     owner = "pwmt";
     repo = "zathura-pdf-mupdf";
     tag = finalAttrs.version;
-    hash = "sha256-pNaawaExmBYDJbry/Ek/EpP2mojHp3MZw3cR6ku2jeg=";
+    hash = "sha256-aHXTxmhFZrl701PhJ+jdSrWcHHt9obO24I2AInOem2I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/applications/misc/zathura/pdf-poppler/default.nix b/pkgs/applications/misc/zathura/pdf-poppler/default.nix
index 0e50ce0a5463..b40b12b92735 100644
--- a/pkgs/applications/misc/zathura/pdf-poppler/default.nix
+++ b/pkgs/applications/misc/zathura/pdf-poppler/default.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zathura-pdf-poppler";
-  version = "2026.02.03";
+  version = "2026.05.10";
 
   src = fetchFromGitHub {
     owner = "pwmt";
     repo = "zathura-pdf-poppler";
     tag = finalAttrs.version;
-    hash = "sha256-ddW2SepBoR9BpqcAIAONmd2P5AjkhmWyIjIDeTnHO4Y=";
+    hash = "sha256-Iks3wv9XfdTsgI00njKPW0+yCTZ5hW9N3JAb0b0PNqE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/al/albyhub/ldk-node-go/default.nix b/pkgs/by-name/al/albyhub/ldk-node-go/default.nix
index 59e554be917e..6e0330a0257e 100644
--- a/pkgs/by-name/al/albyhub/ldk-node-go/default.nix
+++ b/pkgs/by-name/al/albyhub/ldk-node-go/default.nix
@@ -7,13 +7,13 @@
 
 buildGoModule {
   pname = "ldk-node-go";
-  version = "0-unstable-2026-02-10";
+  version = "0-unstable-2026-04-24";
 
   src = fetchFromGitHub {
     owner = "getAlby";
     repo = "ldk-node-go";
-    rev = "f4fc565783308dd4835ba1473a17f25162db9c36";
-    hash = "sha256-jemAzRuZU9aQpENwWtvyGAh9EJUgeb1f1SCx/FpOOPc=";
+    rev = "3690cdb3031c75f0ee0a67222c2db3c69fea8f2c";
+    hash = "sha256-OlJGHhal5fkR0r0FtsVbG1aILZSTLsSRcqrZ84pIRLU=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/al/albyhub/ldk-node/default.nix b/pkgs/by-name/al/albyhub/ldk-node/default.nix
index 0199297e2e3f..938f86f2b66a 100644
--- a/pkgs/by-name/al/albyhub/ldk-node/default.nix
+++ b/pkgs/by-name/al/albyhub/ldk-node/default.nix
@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ldk-node";
-  version = "0-unstable-2026-02-10";
+  version = "0-unstable-2026-04-24";
 
   src = fetchFromGitHub {
     owner = "getAlby";
     repo = "ldk-node";
-    rev = "3996cf18b10545f54c377212e155bb6bd664888e";
-    hash = "sha256-mjIs7CeTRQ7Xuk9V/6LeXMDRZsd/wljeFHZ2vgEe1hg=";
+    rev = "6d5546ec5fff10d4e560188cfcff6f294944c16e";
+    hash = "sha256-k3AZ1k/hV4Bh+RfOqmpo22wRQ5sdDaFR4bcnw58iwNI=";
   };
 
   buildFeatures = [ "uniffi" ];
diff --git a/pkgs/by-name/al/albyhub/package.nix b/pkgs/by-name/al/albyhub/package.nix
index 7125bdbc883f..7eb309745360 100644
--- a/pkgs/by-name/al/albyhub/package.nix
+++ b/pkgs/by-name/al/albyhub/package.nix
@@ -21,16 +21,16 @@ in
 
 buildGoModule (finalAttrs: {
   pname = "albyhub";
-  version = "1.21.6";
+  version = "1.22.2";
 
   src = fetchFromGitHub {
     owner = "getAlby";
     repo = "hub";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xjFEou+mDtEf7079en5ypoU5P0tf+looeHZS4j1jKzg=";
+    hash = "sha256-xP/J9zdh4sZ1x+JUpOf12ft8f2II2Mn1Q7/gnMuFzy8=";
   };
 
-  vendorHash = "sha256-NJeIEFc8oc5rMWAuvrgsnOi3j779mhwMKSALswRy+nE=";
+  vendorHash = "sha256-nzdHXY14o4D8NrcXu2JvDagvIfemfVAaGU3IDifhyW0=";
   proxyVendor = true; # needed for secp256k1-zkp CGO bindings
 
   nativeBuildInputs = [
@@ -47,7 +47,7 @@ buildGoModule (finalAttrs: {
 
   frontendYarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/frontend/yarn.lock";
-    hash = "sha256-wdKm8Zk2iAPvH+EbQxvznctkqHgx8xl/Im37vHmHnoA=";
+    hash = "sha256-BeuTBLJ/Iakd4jhIkI2+oHc4MFy6DSn8QcygTHEMmQo=";
   };
 
   preBuild = ''
diff --git a/pkgs/by-name/ca/caido-cli/package.nix b/pkgs/by-name/ca/caido-cli/package.nix
index a113c3f354e1..6fba0e41ffc6 100644
--- a/pkgs/by-name/ca/caido-cli/package.nix
+++ b/pkgs/by-name/ca/caido-cli/package.nix
@@ -9,25 +9,25 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "caido-cli";
-  version = "0.55.3";
+  version = "0.56.0";
 
   src = fetchurl (
     {
       x86_64-linux = {
         url = "https://caido.download/releases/v${finalAttrs.version}/caido-cli-v${finalAttrs.version}-linux-x86_64.tar.gz";
-        hash = "sha256-ys5gMO0jGy5d8ncwQo9ES0gn7Ddckf3496CAyGgKEus=";
+        hash = "sha256-G8E/GtVYzTM5JIkNnQm3PxzfZya3hVJlzUxN3s4CEdM=";
       };
       aarch64-linux = {
         url = "https://caido.download/releases/v${finalAttrs.version}/caido-cli-v${finalAttrs.version}-linux-aarch64.tar.gz";
-        hash = "sha256-JvWktRnNyzu98NeSOFJ6nhF60uQfSL6ys5BmTkYuwCQ=";
+        hash = "sha256-X+jDesBDXOWSQBTPA1kCaGBRvoaDGCR0TkNWNqYtNok=";
       };
       x86_64-darwin = {
         url = "https://caido.download/releases/v${finalAttrs.version}/caido-cli-v${finalAttrs.version}-mac-x86_64.zip";
-        hash = "sha256-bnFGa8GMDTdCjk9xJL9rGvZ1H6MMzzXrlWXGRlE5XPg=";
+        hash = "sha256-6Rnybe9kH65C4PHg7j9Rwz2TMjH1XPGnI1mu0/g0up8=";
       };
       aarch64-darwin = {
         url = "https://caido.download/releases/v${finalAttrs.version}/caido-cli-v${finalAttrs.version}-mac-aarch64.zip";
-        hash = "sha256-UVBQKkGsYJ84cthFkCXrHI85t8LJPy4z5sP5TobVNeA=";
+        hash = "sha256-07huWaIC1wO7RxC2F8VhgqKvtXcrNxbWDKFhuZhv/E8=";
       };
     }
     .${stdenv.hostPlatform.system}
diff --git a/pkgs/by-name/ca/caido-desktop/package.nix b/pkgs/by-name/ca/caido-desktop/package.nix
index 0c26ee5beb60..decf95e9d218 100644
--- a/pkgs/by-name/ca/caido-desktop/package.nix
+++ b/pkgs/by-name/ca/caido-desktop/package.nix
@@ -9,24 +9,24 @@
 
 let
   pname = "caido-desktop";
-  version = "0.55.3";
+  version = "0.56.0";
 
   sources = {
     x86_64-linux = {
       url = "https://caido.download/releases/v${version}/caido-desktop-v${version}-linux-x86_64.AppImage";
-      hash = "sha256-pGRmFYE7uO5Ka94Kfjl9LR5PAwZ5dCxHqCqJKhtLPco=";
+      hash = "sha256-UA4MPEEnFiiR0ueYoE3H1Z5f7J56NYNahTbWyAImmfQ=";
     };
     aarch64-linux = {
       url = "https://caido.download/releases/v${version}/caido-desktop-v${version}-linux-aarch64.AppImage";
-      hash = "sha256-s99+HXf7Ada2wiPUZ/5M/p09JiadFn5GnKrzqo9yNPQ=";
+      hash = "sha256-HTegv6UlWe0gID5sGLlUTFc0z6giF7BCIwbCHb/rLjc=";
     };
     x86_64-darwin = {
       url = "https://caido.download/releases/v${version}/caido-desktop-v${version}-mac-x86_64.dmg";
-      hash = "sha256-V33bRaTwhxozBR/wV83bU89TZluenKpFc8GU0KaaO8w=";
+      hash = "sha256-ZnN8DK3OuzZ0rKE+1czFhn2rH8QHJvlgvjc9k3DrV/Q=";
     };
     aarch64-darwin = {
       url = "https://caido.download/releases/v${version}/caido-desktop-v${version}-mac-aarch64.dmg";
-      hash = "sha256-fEzPN84zoSvlIgUBYVmPta7SUmTDRQghoJMTZXW7eI4=";
+      hash = "sha256-XbcmecB4DKPp0WlqBBnc2TvorXEMsDSR5oW/VeUBcVs=";
     };
   };
 
diff --git a/pkgs/by-name/ce/cell/package.nix b/pkgs/by-name/ce/cell/package.nix
new file mode 100644
index 000000000000..191570862f2b
--- /dev/null
+++ b/pkgs/by-name/ce/cell/package.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "cell";
+  version = "0.5.0";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "garritfra";
+    repo = "cell";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-J13D46ttG7KlePyFZYxqjaMF7ZR5m3nTJ8/GLm4VH5o=";
+  };
+
+  cargoHash = "sha256-ZQXyt/hL6wamGrFvmrShoUCTSGAo8V5CuejAzO5oCuU=";
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Fast terminal spreadsheet editor with Vim keybindings";
+    homepage = "https://github.com/garritfra/cell";
+    changelog = "https://github.com/garritfra/cell/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ airrnot ];
+    mainProgram = "cell";
+  };
+})
diff --git a/pkgs/by-name/ci/cinny-desktop/package.nix b/pkgs/by-name/ci/cinny-desktop/package.nix
index b54b24734e26..e794f0f49d2b 100644
--- a/pkgs/by-name/ci/cinny-desktop/package.nix
+++ b/pkgs/by-name/ci/cinny-desktop/package.nix
@@ -21,18 +21,18 @@
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cinny-desktop";
   # We have to be using the same version as cinny-web or this isn't going to work.
-  version = "4.11.1";
+  version = "4.12.1";
 
   src = fetchFromGitHub {
     owner = "cinnyapp";
     repo = "cinny-desktop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/zHXlAqIxWN1obFO3H/eqFj38pjopF4D5ooz0YiVgD0=";
+    hash = "sha256-SRtnib5C9YlNOC1YgXZVFgO2dIHSmk+I20Ltf4XkJ6E=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/src-tauri";
 
-  cargoHash = "sha256-bchjUTC0/hWPf/cOs+cxRbqho/B9LMJ3ChW530zEoXU=";
+  cargoHash = "sha256-x7rpnhTz454Ftolu4x50NSGKdg8NfenUwdhPY4a+lbA=";
 
   postPatch =
     let
diff --git a/pkgs/by-name/ci/cinny-unwrapped/package.nix b/pkgs/by-name/ci/cinny-unwrapped/package.nix
index 18735628a5cb..bddf77db30db 100644
--- a/pkgs/by-name/ci/cinny-unwrapped/package.nix
+++ b/pkgs/by-name/ci/cinny-unwrapped/package.nix
@@ -7,17 +7,17 @@
 buildNpmPackage (finalAttrs: {
   pname = "cinny-unwrapped";
   # Remember to update cinny-desktop when bumping this version.
-  version = "4.11.1";
+  version = "4.12.1";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "cinnyapp";
     repo = "cinny";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dwI3zNey/ukF3t2fhH/ePf4o4iBDwZyLWMYebPgXmWU=";
+    hash = "sha256-s9nu6hYe0OvRcp8n2cOJnhEzIV+nyjnfwTrY477XDT8=";
   };
 
-  npmDepsHash = "sha256-27WFjb08p09aJRi0S2PvYq3bivEuG5+z2QhFahTSj4Q=";
+  npmDepsHash = "sha256-e37tSrqrEXGH2uInFAiikHNwJ13gXlG50SeYF/HO0z4=";
 
   # Skip rebuilding native modules since they're not needed for the web app
   npmRebuildFlags = [
@@ -38,6 +38,7 @@ buildNpmPackage (finalAttrs: {
     maintainers = with lib.maintainers; [
       abbe
       rebmit
+      ryand56
     ];
     license = lib.licenses.agpl3Only;
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/ec/ecspresso/package.nix b/pkgs/by-name/ec/ecspresso/package.nix
index 12b46aad409f..9efb948daa02 100644
--- a/pkgs/by-name/ec/ecspresso/package.nix
+++ b/pkgs/by-name/ec/ecspresso/package.nix
@@ -7,20 +7,20 @@
 
 buildGoModule (finalAttrs: {
   pname = "ecspresso";
-  version = "2.8.3";
+  version = "2.8.4";
 
   src = fetchFromGitHub {
     owner = "kayac";
     repo = "ecspresso";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ljiYcOw5tvDYyPfgICidMiJElHls/dvgyIJW0wukIws=";
+    hash = "sha256-Mt4jXMPav82267lUlyI8MZ1g2LFsAylgoHo7QV4N0CQ=";
   };
 
   subPackages = [
     "cmd/ecspresso"
   ];
 
-  vendorHash = "sha256-7WUnP5OpLHjjDUt9LMASQrefhGMk5RPpsmWne1eZpjQ=";
+  vendorHash = "sha256-xdj1wPg8YpcLW3QoDe/lBNkoMQR41oca1KI3sptXi9w=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/el/element-desktop/package.nix b/pkgs/by-name/el/element-desktop/package.nix
index fe6791b038ba..c4e70b9ab233 100644
--- a/pkgs/by-name/el/element-desktop/package.nix
+++ b/pkgs/by-name/el/element-desktop/package.nix
@@ -16,6 +16,7 @@
   fetchPnpmDeps,
   pnpmConfigHook,
   pnpm_10,
+  faketty,
   asar,
   copyDesktopItems,
   darwin,
@@ -29,13 +30,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "element-desktop";
-  version = "1.12.14";
+  version = "1.12.18";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "element-web";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yy7CfMOMT1DBXHDHaDyAaOgp3s2KQIKA1A6zUhVOUhM=";
+    hash = "sha256-G2HEOv1fHVgbT79bo8ibp9VmtQ8o5vA6/i6Q5TUKqdw=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -46,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-0yqWObZtRntsH7gk+OB8pMuWsrvCQ4L9173Qv0o5abk=";
+    hash = "sha256-0iGzjwT+99tvRuxYD+1+SrYrCYAI1dcjhXT3x6E/wHg=";
   };
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
@@ -60,6 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
     pnpm
     pnpmConfigHook
     tsx
+    faketty
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     darwin.autoSignDarwinBinariesHook
@@ -85,13 +87,15 @@ stdenv.mkDerivation (finalAttrs: {
     cd ../../
   '';
 
+  # faketty is required to work around a bug in nx.
+  # See: https://github.com/nrwl/nx/issues/22445
   buildPhase = ''
     runHook preBuild
 
     export VERSION=${finalAttrs.version}
 
-    pnpm -C apps/desktop run build:ts
-    pnpm -C apps/desktop run build:res
+    faketty pnpm -C apps/desktop exec nx build:ts
+    faketty pnpm -C apps/desktop exec nx build:res
     pnpm -C apps/desktop exec electron-builder --dir -c.electronDist=electron-dist -c.electronVersion=${electron.version} -c.mac.identity=null
 
     cd apps/desktop
diff --git a/pkgs/by-name/el/element-web-unwrapped/package.nix b/pkgs/by-name/el/element-web-unwrapped/package.nix
index a0d22d6c73c9..389ffe8251ca 100644
--- a/pkgs/by-name/el/element-web-unwrapped/package.nix
+++ b/pkgs/by-name/el/element-web-unwrapped/package.nix
@@ -26,13 +26,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "element-web";
-  version = "1.12.14";
+  version = "1.12.18";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "element-web";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yy7CfMOMT1DBXHDHaDyAaOgp3s2KQIKA1A6zUhVOUhM=";
+    hash = "sha256-G2HEOv1fHVgbT79bo8ibp9VmtQ8o5vA6/i6Q5TUKqdw=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-0yqWObZtRntsH7gk+OB8pMuWsrvCQ4L9173Qv0o5abk=";
+    hash = "sha256-0iGzjwT+99tvRuxYD+1+SrYrCYAI1dcjhXT3x6E/wHg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fl/fladder/package.nix b/pkgs/by-name/fl/fladder/package.nix
index f5fd73a3a53e..60b60a7ee6a7 100644
--- a/pkgs/by-name/fl/fladder/package.nix
+++ b/pkgs/by-name/fl/fladder/package.nix
@@ -1,9 +1,13 @@
 {
   lib,
+  stdenv,
+  fetchurl,
   fetchFromGitHub,
   flutter335,
   copyDesktopItems,
   makeDesktopItem,
+  undmg,
+  makeBinaryWrapper,
 
   alsa-lib,
   libdisplay-info,
@@ -18,82 +22,114 @@
 
 let
   flutter = flutter335;
-in
+  sourceBuild = flutter.buildFlutterApplication (finalAttrs: {
+    pname = "fladder";
+    version = "0.10.3";
 
-flutter.buildFlutterApplication (finalAttrs: {
-  pname = "fladder";
-  version = "0.10.3";
+    src = fetchFromGitHub {
+      owner = "DonutWare";
+      repo = "Fladder";
+      tag = "v${finalAttrs.version}";
+      hash = "sha256-0eFHylRi2UVaKRG7K3tDZVscgoiL5xFrtFhZiJxj4Mk=";
+    };
 
-  src = fetchFromGitHub {
-    owner = "DonutWare";
-    repo = "Fladder";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-0eFHylRi2UVaKRG7K3tDZVscgoiL5xFrtFhZiJxj4Mk=";
-  };
+    inherit targetFlutterPlatform;
 
-  inherit targetFlutterPlatform;
+    pubspecLock = lib.importJSON ./pubspec.lock.json;
 
-  pubspecLock = lib.importJSON ./pubspec.lock.json;
+    gitHashes = lib.importJSON ./git-hashes.json;
 
-  gitHashes = lib.importJSON ./git-hashes.json;
+    nativeBuildInputs = lib.optionals (targetFlutterPlatform == "linux") [
+      copyDesktopItems
+    ];
 
-  nativeBuildInputs = lib.optionals (targetFlutterPlatform == "linux") [
-    copyDesktopItems
-  ];
+    buildInputs = [
+      alsa-lib
+      libdisplay-info
+      mpv-unwrapped
+      libxpresent
+      libxscrnsaver
+    ]
+    ++ lib.optionals (targetFlutterPlatform == "linux") [
+      libepoxy
+    ];
 
-  buildInputs = [
-    alsa-lib
-    libdisplay-info
-    mpv-unwrapped
-    libxpresent
-    libxscrnsaver
-  ]
-  ++ lib.optionals (targetFlutterPlatform == "linux") [
-    libepoxy
-  ];
+    postInstall =
+      lib.optionalString (targetFlutterPlatform == "web") (
+        ''
+          sed -i 's;base href="/";base href="$out";' $out/index.html
+        ''
+        + lib.optionalString (baseUrl != null) ''
+          echo '{"baseUrl": "${baseUrl}"}' > $out/assets/config/config.json
+        ''
+      )
+      + lib.optionalString (targetFlutterPlatform == "linux") ''
+        # Install SVG icon
+        install -Dm644 icons/fladder_icon.svg \
+          $out/share/icons/hicolor/scalable/apps/fladder.svg
+      '';
 
-  postInstall =
-    lib.optionalString (targetFlutterPlatform == "web") (
-      ''
-        sed -i 's;base href="/";base href="$out";' $out/index.html
-      ''
-      + lib.optionalString (baseUrl != null) ''
-        echo '{"baseUrl": "${baseUrl}"}' > $out/assets/config/config.json
-      ''
-    )
-    + lib.optionalString (targetFlutterPlatform == "linux") ''
-      # Install SVG icon
-      install -Dm644 icons/fladder_icon.svg \
-        $out/share/icons/hicolor/scalable/apps/fladder.svg
+    desktopItems = lib.optionals (targetFlutterPlatform == "linux") [
+      (makeDesktopItem {
+        name = "fladder";
+        desktopName = "Fladder";
+        genericName = "Jellyfin Client";
+        exec = "Fladder";
+        icon = "fladder";
+        comment = "Simple Jellyfin Frontend built on top of Flutter";
+        categories = [
+          "AudioVideo"
+          "Video"
+          "Player"
+        ];
+      })
+    ];
+
+    passthru.updateScript = ./update.sh;
+
+    meta = {
+      description = "Simple Jellyfin Frontend built on top of Flutter";
+      homepage = "https://github.com/DonutWare/Fladder";
+      downloadPage = "https://github.com/DonutWare/Fladder/releases";
+      license = lib.licenses.gpl3Only;
+      maintainers = with lib.maintainers; [
+        ratcornu
+        schembriaiden
+      ];
+      mainProgram = "Fladder";
+    };
+  });
+
+  darwin = stdenv.mkDerivation {
+    pname = sourceBuild.pname;
+    inherit (sourceBuild) version;
+
+    src = fetchurl {
+      url = "https://github.com/DonutWare/Fladder/releases/download/v${sourceBuild.version}/Fladder-macOS-${sourceBuild.version}.dmg";
+      hash = "sha256-Vnz0jtmDptcrehE7DrgyTzFJJopirsLaO+lu1V/Xd+o=";
+    };
+
+    nativeBuildInputs = [
+      undmg
+      makeBinaryWrapper
+    ];
+
+    sourceRoot = ".";
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/Applications
+      cp -r Fladder.app $out/Applications
+      makeBinaryWrapper $out/Applications/Fladder.app/Contents/MacOS/Fladder $out/bin/Fladder
+
+      runHook postInstall
     '';
 
-  desktopItems = lib.optionals (targetFlutterPlatform == "linux") [
-    (makeDesktopItem {
-      name = "fladder";
-      desktopName = "Fladder";
-      genericName = "Jellyfin Client";
-      exec = "Fladder";
-      icon = "fladder";
-      comment = "Simple Jellyfin Frontend built on top of Flutter";
-      categories = [
-        "AudioVideo"
-        "Video"
-        "Player"
-      ];
-    })
-  ];
-
-  passthru.updateScript = ./update.sh;
-
-  meta = {
-    description = "Simple Jellyfin Frontend built on top of Flutter";
-    homepage = "https://github.com/DonutWare/Fladder";
-    downloadPage = "https://github.com/DonutWare/Fladder/releases";
-    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [
-      ratcornu
-      schembriaiden
-    ];
-    mainProgram = "Fladder";
+    meta = sourceBuild.meta // {
+      sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+      platforms = lib.platforms.darwin;
+    };
   };
-})
+in
+if stdenv.hostPlatform.isDarwin then darwin else sourceBuild
diff --git a/pkgs/by-name/jb/jbig2enc/package.nix b/pkgs/by-name/jb/jbig2enc/package.nix
index e7abf22a3e1e..14990b26fe8b 100644
--- a/pkgs/by-name/jb/jbig2enc/package.nix
+++ b/pkgs/by-name/jb/jbig2enc/package.nix
@@ -11,20 +11,24 @@
   libtiff,
   python3,
   autoreconfHook,
+  pkg-config,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "jbig2enc";
-  version = "0.30";
+  version = "0.31";
 
   src = fetchFromGitHub {
     owner = "agl";
     repo = "jbig2enc";
     rev = finalAttrs.version;
-    hash = "sha256-B19l2NdMq+wWKQ5f/y5aoPiBtQnn6sqpaIoyIq+ugTg=";
+    hash = "sha256-UafMDNEMr+8keSgIXBNxnhR24qRrx7F0+ShleF/G2AQ=";
   };
 
-  nativeBuildInputs = [ autoreconfHook ];
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+  ];
 
   buildInputs = [
     leptonica
diff --git a/pkgs/by-name/lc/lcevcdec/package.nix b/pkgs/by-name/lc/lcevcdec/package.nix
index 29cc69d434e3..b8c91741953b 100644
--- a/pkgs/by-name/lc/lcevcdec/package.nix
+++ b/pkgs/by-name/lc/lcevcdec/package.nix
@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lcevcdec";
-  version = "4.0.5";
+  version = "4.1.0";
 
   outputs = [
     "out"
@@ -26,7 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "v-novaltd";
     repo = "LCEVCdec";
     tag = finalAttrs.version;
-    hash = "sha256-Ib+2B9o9XUbiEqlP43jKYzvY2pzsFRaS/ZjMn1YgvHE=";
+    hash = "sha256-QzejWq0XGPLu+YVNetfbzczNuZ6Gp5QJP5G2RZUan6M=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index a533be7caf5e..ce1ae9e3c291 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -79,7 +79,7 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "llama-cpp";
-  version = "9080";
+  version = "9190";
 
   outputs = [
     "out"
@@ -90,7 +90,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     owner = "ggml-org";
     repo = "llama.cpp";
     tag = "b${finalAttrs.version}";
-    hash = "sha256-IF2Whu9VLxUbL+oLkQeYERfp8s3RdQBUyqsAsruv60M=";
+    hash = "sha256-zajArFzrLUUVsfG1xBttwzwaT9QNlKzDbvSxvof+FMQ=";
     leaveDotGit = true;
     postFetch = ''
       git -C "$out" rev-parse --short HEAD > $out/COMMIT
@@ -122,8 +122,8 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     ++ optionals vulkanSupport vulkanBuildInputs
     ++ [ openssl ];
 
-  npmRoot = "tools/server/webui";
-  npmDepsHash = "sha256-cV3noOyKmst9vfxyvkCNhihPgwfVGhmPPT4UMloeWZM=";
+  npmRoot = "tools/ui";
+  npmDepsHash = "sha256-WaEePrEZ7O/7deP2KJhe0AwiSKYA8HOqETmMHUkmBe0=";
   npmDeps = fetchNpmDeps {
     name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
     inherit (finalAttrs) src patches;
diff --git a/pkgs/by-name/ma/mainsail/package.nix b/pkgs/by-name/ma/mainsail/package.nix
index b4930f6d226b..3536a2255124 100644
--- a/pkgs/by-name/ma/mainsail/package.nix
+++ b/pkgs/by-name/ma/mainsail/package.nix
@@ -2,7 +2,7 @@
   lib,
   buildNpmPackage,
   fetchFromGitHub,
-  nodejs_20,
+  nodejs_22,
 }:
 
 buildNpmPackage rec {
@@ -18,7 +18,7 @@ buildNpmPackage rec {
 
   npmDepsHash = "sha256-HIErBrQ0VP4vdCFZe7uT5b1q+QdSSf08CIQmNcSryZ8=";
 
-  nodejs = nodejs_20;
+  nodejs = nodejs_22;
 
   # Prevent Cypress binary download.
   env.CYPRESS_INSTALL_BINARY = 0;
diff --git a/pkgs/by-name/ma/martin/package.nix b/pkgs/by-name/ma/martin/package.nix
index ddee160c3a13..fcc5984cb08a 100644
--- a/pkgs/by-name/ma/martin/package.nix
+++ b/pkgs/by-name/ma/martin/package.nix
@@ -2,28 +2,62 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchurl,
   buildNpmPackage,
   rustPlatform,
   pkg-config,
+  curl,
+  libz,
   openssl,
   postgresql,
   postgresqlTestHook,
+  nix-update-script,
 }:
 
+let
+  # check package.metadata.mln in https://github.com/maplibre/maplibre-native-rs/blob/main/Cargo.toml
+  mlnRelease = "core-9b6325a14e2cf1cc29ab28c1855ad376f1ba4903";
+  mlnHeaders = fetchurl {
+    url = "https://github.com/maplibre/maplibre-native/releases/download/${mlnRelease}/maplibre-native-headers.tar.gz";
+    hash = "sha256-VjVEc/+IZTBG9ixP/i7oeel+7gy3+DhSEOi2UDIqeLc=";
+  };
+  mlnLibrary = fetchurl (
+    let
+      sources = {
+        aarch64-linux = {
+          url = "https://github.com/maplibre/maplibre-native/releases/download/${mlnRelease}/libmaplibre-native-core-amalgam-linux-arm64-vulkan.a";
+          hash = "sha256-PHFNdzcG3+kngZmziMccCTnwBUbtsS2RAUNkTyNYXmc";
+        };
+        x86_64-linux = {
+          url = "https://github.com/maplibre/maplibre-native/releases/download/${mlnRelease}/libmaplibre-native-core-amalgam-linux-x64-vulkan.a";
+          hash = "sha256-T9H7NiXHv+hbMgOd5QetQzxjIX1Ufn6gNmBJJ/7Ha50=";
+        };
+      };
+    in
+    sources.${stdenv.hostPlatform.system}
+    // {
+      downloadToTemp = true;
+      recursiveHash = true;
+      postFetch = ''
+        install -Dm644 $downloadedFile $out/libmbgl-core-amalgam.a
+      '';
+    }
+  );
+in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "martin";
-  version = "1.4.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "maplibre";
     repo = "martin";
     tag = "martin-v${finalAttrs.version}";
-    hash = "sha256-wThCAR3SL454HyHAqbfGfUESPVTiOUMQDq37O/bjJbI=";
+    hash = "sha256-LaPRkmzTVNn3qKJjrDNz8bcSWXy5SubevfjGvb+JvUg=";
   };
 
   patches = [ ./dont-build-webui.patch ];
 
-  cargoHash = "sha256-6hPZ3Db6ezPmtBT4XClERiV+MCFZgNLTnZTOeCgRln8=";
+  cargoHash = "sha256-dOTlYQcn2TWtzhJNFf3cVyR5EOvjBgW3qgBReUlfjTg=";
 
   webui = buildNpmPackage {
     pname = "martin-ui";
@@ -37,7 +71,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       ln -sf ${finalAttrs.src}/demo/frontend/public/favicon.ico public/_/assets/favicon.ico
     '';
 
-    npmDepsHash = "sha256-ay8r+gvUVzza0GeJvrmtaEvppIc4wWjrqPGrK8oT+lA=";
+    npmDepsHash = "sha256-kuLnRFubvmskSRg1Jmdw79oTt0jrzbjW64zhcKfcuX4=";
 
     buildPhase = ''
       runHook preBuild
@@ -63,7 +97,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ openssl ];
+  buildInputs = [
+    curl
+    libz
+    openssl
+  ];
 
   nativeCheckInputs = [
     postgresql
@@ -84,6 +122,19 @@ rustPlatform.buildRustPackage (finalAttrs: {
     };
   };
 
+  env = {
+    MLN_PRECOMPILE = 1;
+    MLN_CORE_LIBRARY_PATH = "${mlnLibrary}/libmbgl-core-amalgam.a";
+    MLN_CORE_LIBRARY_HEADERS_PATH = "${mlnHeaders}";
+  };
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex=martin-v(.*)"
+      "--subpackage=webui"
+    ];
+  };
+
   meta = {
     description = "Blazing fast and lightweight PostGIS vector tiles server";
     homepage = "https://martin.maplibre.org/";
@@ -92,5 +143,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
       asl20
     ];
     teams = [ lib.teams.geospatial ];
+    sourceProvenance = with lib.sourceTypes; [
+      binaryNativeCode # maplibre-native
+      fromSource
+    ];
+    platforms = [
+      "aarch64-linux"
+      "x86_64-linux"
+    ];
   };
 })
diff --git a/pkgs/by-name/ma/maturin/package.nix b/pkgs/by-name/ma/maturin/package.nix
index 4f7ef15b36c3..8c08f6a0643f 100644
--- a/pkgs/by-name/ma/maturin/package.nix
+++ b/pkgs/by-name/ma/maturin/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "maturin";
-  version = "1.13.1";
+  version = "1.12.6";
 
   src = fetchFromGitHub {
     owner = "PyO3";
     repo = "maturin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Y/TsAr0WgdD1f7T1unQcOU83nyU/xugPfBt1Xtq7rsQ=";
+    hash = "sha256-NQ94RdQTQlRR5+2dC95cFNhwYliHmkD11JWyGt6BV6g=";
   };
 
-  cargoHash = "sha256-pUSxvPWys9OyRb6sf4KhefHtcrbZEAKkuO3Lkl71yME=";
+  cargoHash = "sha256-9VqS9wvQAsSYNhH7B9WlD6SZjXR4S2sYzYoNy6vbYBM=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     libiconv
diff --git a/pkgs/development/libraries/mbedtls/0001-fix-gcc14-build.patch b/pkgs/by-name/mb/mbedtls/0001-fix-gcc14-build.patch
similarity index 100%
rename from pkgs/development/libraries/mbedtls/0001-fix-gcc14-build.patch
rename to pkgs/by-name/mb/mbedtls/0001-fix-gcc14-build.patch
diff --git a/pkgs/development/libraries/mbedtls/4.nix b/pkgs/by-name/mb/mbedtls/4.nix
similarity index 100%
rename from pkgs/development/libraries/mbedtls/4.nix
rename to pkgs/by-name/mb/mbedtls/4.nix
diff --git a/pkgs/development/libraries/mbedtls/generic.nix b/pkgs/by-name/mb/mbedtls/generic.nix
similarity index 100%
rename from pkgs/development/libraries/mbedtls/generic.nix
rename to pkgs/by-name/mb/mbedtls/generic.nix
diff --git a/pkgs/development/libraries/mbedtls/3.nix b/pkgs/by-name/mb/mbedtls/package.nix
similarity index 100%
rename from pkgs/development/libraries/mbedtls/3.nix
rename to pkgs/by-name/mb/mbedtls/package.nix
diff --git a/pkgs/by-name/me/mediathekview/package.nix b/pkgs/by-name/me/mediathekview/package.nix
index 4f4ddc4f98c2..6786bca9d8af 100644
--- a/pkgs/by-name/me/mediathekview/package.nix
+++ b/pkgs/by-name/me/mediathekview/package.nix
@@ -67,6 +67,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl3Plus;
     mainProgram = "mediathek";
     maintainers = with lib.maintainers; [ makefu ];
-    platforms = lib.platforms.all;
+    platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/by-name/nv/nvitop/package.nix b/pkgs/by-name/nv/nvitop/package.nix
index 7c6e36c6866c..e1c021b739cf 100644
--- a/pkgs/by-name/nv/nvitop/package.nix
+++ b/pkgs/by-name/nv/nvitop/package.nix
@@ -7,14 +7,15 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "nvitop";
-  version = "1.6.2";
+  version = "1.7.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "XuehaiPan";
     repo = "nvitop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CaQO20PF/fVGybyrt2OGASYsKAJsmJkOGis1ff/OOIs=";
+    hash = "sha256-If32hdXWABv8UgSrUlarelQxZEe1h0B3poAAxuN/tN0=";
   };
 
   build-system = with python3Packages; [ setuptools ];
diff --git a/pkgs/by-name/op/opkssh/package.nix b/pkgs/by-name/op/opkssh/package.nix
index d55208e26bc0..1f583c50b702 100644
--- a/pkgs/by-name/op/opkssh/package.nix
+++ b/pkgs/by-name/op/opkssh/package.nix
@@ -8,18 +8,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "opkssh";
-  version = "0.13.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "openpubkey";
     repo = "opkssh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cIIbeCsQq/TWf58m9l07aVg2gJNqsEyGqC3UPPb63sQ=";
+    hash = "sha256-XvA5J4v3+QESJZIaZUdvPmCD/q92ifHlzI3Ejmt1pls=";
   };
 
   ldflags = [ "-X main.Version=${finalAttrs.version}" ];
 
-  vendorHash = "sha256-aZUwuujE5x2ZCbalvH8DzKP835tgRr6MQbDtvcAZRsk=";
+  vendorHash = "sha256-ASa4jXhLdCs+YTP65nkMsQErg22sbl8g0RgzfSFr67A=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/pa/pass-git-helper/package.nix b/pkgs/by-name/pa/pass-git-helper/package.nix
index d5891066cc11..1fb89e316f16 100644
--- a/pkgs/by-name/pa/pass-git-helper/package.nix
+++ b/pkgs/by-name/pa/pass-git-helper/package.nix
@@ -2,25 +2,26 @@
   lib,
   python3Packages,
   fetchFromGitHub,
+  writableTmpDirAsHomeHook,
 }:
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "pass-git-helper";
-  version = "4.1.0";
+  version = "4.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "languitar";
     repo = "pass-git-helper";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-gMhTYIFNCrUm6YoOOesJcQScugQ/SawiyeXjRG3cpQY=";
+    sha256 = "sha256-/Brx86YRmSkSr00xj5B5J/bNBqknoXRwX9B6595dEwU=";
   };
 
   build-system = with python3Packages; [ setuptools ];
 
   dependencies = with python3Packages; [ pyxdg ];
 
-  env.HOME = "$TMPDIR";
+  nativeBuildInputs = [ writableTmpDirAsHomeHook ];
 
   pythonImportsCheck = [ "passgithelper" ];
 
@@ -36,6 +37,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     license = lib.licenses.lgpl3Plus;
     maintainers = with lib.maintainers; [
       hmenke
+      ibbem
     ];
     mainProgram = "pass-git-helper";
   };
diff --git a/pkgs/by-name/pe/pe-parse/package.nix b/pkgs/by-name/pe/pe-parse/package.nix
index 177a90c0be43..432ebd05db97 100644
--- a/pkgs/by-name/pe/pe-parse/package.nix
+++ b/pkgs/by-name/pe/pe-parse/package.nix
@@ -3,26 +3,22 @@
   stdenv,
   fetchFromGitHub,
   cmake,
+  icu,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pe-parse";
-  version = "2.1.1";
+  version = "2.1.1-unstable-2026-01-12";
 
   src = fetchFromGitHub {
     owner = "trailofbits";
     repo = "pe-parse";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-XegSZWRoQg6NEWuTSFI1RMvN3GbpLDrZrloPU2XdK2M=";
+    rev = "b0dabd3fdcccd8f53bab500a45e92f37c6fec936";
+    hash = "sha256-j1QJ12hEy1c7SRIJSiFwQwJhhDKGbUrquFXDZbNNEDk=";
   };
 
   nativeBuildInputs = [ cmake ];
-
-  env.NIX_CFLAGS_COMPILE = toString (
-    lib.optionals stdenv.cc.isClang [
-      "-Wno-error=deprecated-declarations"
-    ]
-  );
+  buildInputs = [ icu ];
 
   doInstallCheck = true;
   installCheckPhase = ''
@@ -32,7 +28,8 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Principled, lightweight parser for Windows portable executable files";
     homepage = "https://github.com/trailofbits/pe-parse";
-    changelog = "https://github.com/trailofbits/pe-parse/releases/tag/v${finalAttrs.version}";
+    ${if lib.hasInfix "unstable" finalAttrs.version then null else "changelog"} =
+      "https://github.com/trailofbits/pe-parse/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ arturcygan ];
     mainProgram = "dump-pe";
diff --git a/pkgs/by-name/pi/pixi/package.nix b/pkgs/by-name/pi/pixi/package.nix
index 4c1497c9976f..b20f4faf9517 100644
--- a/pkgs/by-name/pi/pixi/package.nix
+++ b/pkgs/by-name/pi/pixi/package.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "pixi";
-  version = "0.68.0";
+  version = "0.68.1";
 
   src = fetchFromGitHub {
     owner = "prefix-dev";
     repo = "pixi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZDQzuzrGyY2IsSOxiPKFDxTKBVIQbIDSRappYI9bdAc=";
+    hash = "sha256-nh8F2MEmBjanpj05bugv8URjRwdNTHSHU0BPqj2mRKM=";
   };
 
-  cargoHash = "sha256-m5OfXsdI3MsKHX2Vpck6iCftRNb7yIwn4m1ruIwvklc=";
+  cargoHash = "sha256-UHih9R9VWxL7pSUOCGwiuPKTzI/FNukzNLLmZFo3bto=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/pr/prettier/missing-hashes.json b/pkgs/by-name/pr/prettier/missing-hashes.json
index 48b570c426e2..58edbab4eb91 100644
--- a/pkgs/by-name/pr/prettier/missing-hashes.json
+++ b/pkgs/by-name/pr/prettier/missing-hashes.json
@@ -1,72 +1,86 @@
 {
-  "@esbuild/aix-ppc64@npm:0.25.5": "098d4c3ebe965823ee43fa708457c768caea59a5fab521e1129fbf1bc47dadf8319d7170e25a91a6af779a3b91cf4ce0b01a053410fe796b2235c262f7008e30",
-  "@esbuild/android-arm64@npm:0.25.5": "0a3b0db67072835d003519a7b297f2618b8c65cf168be7421656a3eaa7240499e3f89708e5aec507007bf8637f486dd4a2aeb48183702a5a8d0ee29432c22c8d",
-  "@esbuild/android-arm@npm:0.25.5": "3f85e15beb85467d5ac0bd19774fca6db353f4927a792c2281302e0f29f66931eb4ceac61216e19d9b21a5fc90c556b58bf54b4ed9d3205e81ecba16cff842d9",
-  "@esbuild/android-x64@npm:0.25.5": "2033f7eb50910b4b9f8064926a8d2baf62597230dc07fd931c8def2022bc8d8e15c3ed7aa892041b6605b24d31e80afeb03e59cf7b0dc2f88a6959b821defd58",
-  "@esbuild/darwin-arm64@npm:0.25.5": "08d7238c6ea25cbf7de55ab2378b8bf3bf3d36de9bb3ca9fca15c41e5cec6cfcc619b2cbefd0d71722bd780ef5d1bcff5246b1676b62d131673532aa14e6ae5f",
-  "@esbuild/darwin-x64@npm:0.25.5": "274767e53270755c1d1814eddd25a20e6ebd68cdf8432303d9e73b45a782579a4a898ffd68920f4052c4a5ba6ca85e59ba1a87e0005b94cac98e479e3f623a22",
-  "@esbuild/freebsd-arm64@npm:0.25.5": "b9ef91ca56536e988a72009c04e95f4ce18a6439151029d736c6df2af97a753f5b55f73d14da76c2c22693592a9468d57435af72bf535b2731b8fdda2aadb930",
-  "@esbuild/freebsd-x64@npm:0.25.5": "8b6f53b0c0ffc7770ab078d694b705ca0169e08e0a88849fb0a54280e55f7339abc26aee969799ba6ee725b494653fc7188dc184d2f318be78506132b5e8f955",
-  "@esbuild/linux-arm64@npm:0.25.5": "c0e1925988f0b07aa8c4712f04f3cc858b52d7180ba1600c311206eeef023dbd6f0a00cb2d50fbd81064c15e69502ab95aabb433318638a5af0d9a4bd02f7294",
-  "@esbuild/linux-arm@npm:0.25.5": "b14daff5e6b0e9d6a613e6f11a6c0c4c1a275effe762383e6b3461c6318ec371f69d8c512bda475d634154ded6e0269345fb58281ca64c406d9dd0acfdfcf042",
-  "@esbuild/linux-ia32@npm:0.25.5": "f962303d6dd5062bf8cfa31801c43c4ecf2c33cf42e8e4abbcbbea2d54619ba8bd0700a342e94e13deff856e6985e50f31bf97af283b26ff36b185da40a0f7a3",
-  "@esbuild/linux-loong64@npm:0.25.5": "884863922180e39e9ae05c93f0d5e4e52627416237d892dca80f39bd1ce94c24920868cdeb8a8378b384332343c2b76bd7eba0ab56defaa4fa942bc361941a46",
-  "@esbuild/linux-mips64el@npm:0.25.5": "90da507ace130201e4653e08187b6ec95d4acb9acf37fbd14f7c0aa60ac299cb9a8a2cc1c8541e376ac14206e10abc52e99bd2c1614dce53f6f66d00165671df",
-  "@esbuild/linux-ppc64@npm:0.25.5": "1a82c32464c6e446bba510c5cafff685c113cadc3f65966465a54bed455cfc737ea3c11628785cd4ad8b169be03ef3b3c3e46b4ecd3e1a64a501d6ae3aa500d0",
-  "@esbuild/linux-riscv64@npm:0.25.5": "d9f49b01639ec4ceebf5455151e2632191a2bc0d96ba27ba661f4b97e314c1496a99ed5ea2d3c0bddbcf9da09bf1c06ba8f94bcab283a2f181a1c2c514848631",
-  "@esbuild/linux-s390x@npm:0.25.5": "14ce910d0ed879bf6549c4892a020e2a652fe5cbf8897a7a967ba20801e89582e70a3567659b96049a789a6b3fa5b34b330f4002de51f87bc734a2c83d8089a8",
-  "@esbuild/linux-x64@npm:0.25.5": "31edf2a53f0dede747f57405d2d9e277b1ae25e40eef7a7567b8d9c11c0d23c7aa6d4f94493f5295f95dc0f75a77f8cf3a52144501a6db7bf914cff8a5370258",
-  "@esbuild/netbsd-arm64@npm:0.25.5": "d35b97cf24a5f7e32e880b40a451c7409959acb26c9adaba1c4d5d469853982ce7e5f5e6ff33f32bde78d400c869923d2933d1620779d127e95a693422b4cc07",
-  "@esbuild/netbsd-x64@npm:0.25.5": "7a8ecc712deda1af96de426998f39934ed5fad0cdb12b13ff31170c9dfe44f679d179c16dca7db2d686044a941a7addb9378a01f15b25efe424453ac61a0031f",
-  "@esbuild/openbsd-arm64@npm:0.25.5": "9e1ccd8e6cc87b7f8c83b8fb7091b98078ac96e18d58c7a45c22c981e58be1f86d8328d48906a1869226edf1a21e62eba64e43dd2aed9046a57795ed31b8d617",
-  "@esbuild/openbsd-x64@npm:0.25.5": "a13696c3b5ea9971df702c3c6cf8ddd17490d4becd3c2596a33230e53523c2d8d11d43857973d06292ad6670163e42ca6203dbad5a4f708f250d2d5fc23dc4d0",
-  "@esbuild/sunos-x64@npm:0.25.5": "87789cae50b1aacd24d3f25b903d8016f370c6bc9c2618c243283921eea00119728e824c052fb41056ab7a5c8295442b32f598343788117499fb4145f52b6795",
-  "@esbuild/win32-arm64@npm:0.25.5": "4a02984bb78737aec94eac24347be38aa17e504dc7702b3de9cb59179d5df14a812ecab387ce7654e4e23e58ea7989079bdf90e515bbf774a66243387ad55c52",
-  "@esbuild/win32-ia32@npm:0.25.5": "e214bba446a70d3072c124f45b948af6dba335115c2f17b2bd64f64c1ef875db815cc7f6b5a57e2b9bec0bb76d7b4ebcd3afcb857b9b7e76a7c9d1a80ba0963e",
-  "@esbuild/win32-x64@npm:0.25.5": "4c6381c6dd3ab7c8aa9fdcda4faf0f08c0982c497348844c764d5b0f7b3d1ccb3fc5bf341057a79ce4fdbb8dcddc115a7b9d5af3ea247b3434d3d451a88c7072",
-  "@oxc-parser/binding-android-arm64@npm:0.75.0": "ffbf389dd3930f89c8730e6f2a19238fbab409d26d1daf18c023c42a1a0cded25b7f4dc961a7dacbb65c073566657e84902a09c645059bd6c7e278f1e95c6eaa",
-  "@oxc-parser/binding-darwin-arm64@npm:0.75.0": "14793b0a782e43eac2a1b2452ba813660cc28497f51e848217c21010ade67e1393b91f49d571e6741f26657c7499bf9eb49190077ff082ebead6c789244cee67",
-  "@oxc-parser/binding-darwin-x64@npm:0.75.0": "6f07df67a1311cb1c48e152afb0720b00efb716e0ca4a156b0a0bf7116b1eeaf2583fd420ca29d5d6fe90f4128c97caae704a9885995b16e5db6ec8b558d166e",
-  "@oxc-parser/binding-freebsd-x64@npm:0.75.0": "cc6ae75ff1d3d01cb56ced4dc5801a98ed8211a73b08001a4d88ca48e42796ab3e736c638afd7c95081739a0d50c5de1c9b2afe950752abc75c7f0af7152f5ff",
-  "@oxc-parser/binding-linux-arm-gnueabihf@npm:0.75.0": "84476e3d2792cf589bf1217b22d6108cbd925b30b0910ed1970a221264a2d99da9e53343158f26b310e1f662dc576b128a3035c36c53d9e870379e6a93324085",
-  "@oxc-parser/binding-linux-arm-musleabihf@npm:0.75.0": "f9b9c0b6170394e7cce5f6f48ad7484871f324ed078f861cfd577910e392e4a4350f912d8591b3678451748f3b1a4d90ff181fd642540d03f745c2f7ad6760dc",
-  "@oxc-parser/binding-linux-arm64-gnu@npm:0.75.0": "d0f232b73675c496f12f49351a1f4374e450ada0735ba81113fe3d834ad0475aaa7785a6a4636500e4cea2a51c19c15d0f88395e411eaf801ddc42c397cf3df7",
-  "@oxc-parser/binding-linux-arm64-musl@npm:0.75.0": "f849e9c9e1d6875dc5244ca86391d63ec46c165c6afb3cb1b6ae99254db83c9a4da1167dbdb32f08ae51352ba5d57267b6cdd8c53eff0962e9ca1ddd4285fc94",
-  "@oxc-parser/binding-linux-riscv64-gnu@npm:0.75.0": "bfd17943ac7292388736621ef19fe1d4eac9e0a52386ee4d6969be3ae34ace8bdf2dc2bce60e3be8f94a91eea1095a9ff02dd88891e985f91bd741e944d59fd6",
-  "@oxc-parser/binding-linux-s390x-gnu@npm:0.75.0": "002c4e8f27c73fedab9b7a1792b4e5887edef4953e209b444a468698acd32e26789c28b9ec0bf9a2c6d2057e47db5975ba507820b7bbc1219001e92d2dd034dd",
-  "@oxc-parser/binding-linux-x64-gnu@npm:0.75.0": "430a01fc11a8d8b7a98f8af0ffe9a8f58d3c3b0443657cee8cc65dc951dab36607bf991a878e22783316a25cf734b9d09bd6e8db04d217c7f0415cee2da7a802",
-  "@oxc-parser/binding-linux-x64-musl@npm:0.75.0": "b6d45f29ccf955440d44b021716b1e7568423bf70a7e604fd4d6cef8838a40e1610fab2aa86fd502bba803c042806b3edde065b214960811b6b4991ca0d80402",
-  "@oxc-parser/binding-wasm32-wasi@npm:0.75.0": "98498e1911bf7cf75930d388a5b27e3912554637ec28fbff82746b46958e23251ea4537d0b5364a923c9dd62eaeec2fd48e0d9e633ef3fcc636db478e705efc8",
-  "@oxc-parser/binding-win32-arm64-msvc@npm:0.75.0": "c7cded4af688cbf460ae2104fcda8bc920d94d5f9fe3d9c81e751e815344e0a6caab806c7bd63c4ceb19e9eccbbba66b1d298d3c20b6da3d1b353ef6a213f8ce",
-  "@oxc-parser/binding-win32-x64-msvc@npm:0.75.0": "c518f673f8a03394d7a58f6015e9c54693ff039dba82deef84ebf46414a4b2a1ff596023d40133866e8de2def50a3bc866b6fcfa5954dcec8a8de47252981f08",
-  "@oxc-resolver/binding-darwin-arm64@npm:11.2.0": "e372a937dd7023a600c0bf65bda92ab17a7456738bd67425c0586e10391d61cdd46e52d89f8ae64c96bdcb8f6b8d8f6dc2327f88a6bb6a56d75dfaf3239011e8",
-  "@oxc-resolver/binding-darwin-x64@npm:11.2.0": "811e8bc26c7c49fcf55980bd43eaec43e8741478030eba80cfbf0768706e8dec4b228adc621e82b971356046cb5d64da9caf596baf429439ac6e72ca98ca265f",
-  "@oxc-resolver/binding-freebsd-x64@npm:11.2.0": "29ecf9af4df5c2289677fb1c7cdba86178d829070065b4e4fdc14bf316ce7d83b8a26cb43bca70bcc759caf53b372727dba40a5b75d2975c18bb00ce1b9e0430",
-  "@oxc-resolver/binding-linux-arm-gnueabihf@npm:11.2.0": "05a919357edc9334384f75b75f004f1380435d62aeb6f83a98ebbdbf0006a57808a4da5b85580c5658b15643f0c6ad2a7b872f80f321053b58705da803fab201",
-  "@oxc-resolver/binding-linux-arm64-gnu@npm:11.2.0": "20176fdde6e834ab963b19eb0dc0440c0dbd218e70d42c907ecb53f9444038f534871115549cf18b545d2e51b9c52af549ef49d043ba69e6ce4fdad0e72af768",
-  "@oxc-resolver/binding-linux-arm64-musl@npm:11.2.0": "518dce0dc638179d1e20d9b7ad90d71cbc89432df660c39d1d1c61a51ec9cdd0de0c046efee8afd80734410320d592433ae9cd0e227d9f2f8821bac5d28bf581",
-  "@oxc-resolver/binding-linux-riscv64-gnu@npm:11.2.0": "0b1648c4d838fc3269af744d9bea732078c5545f5fd6bcd8141550c244927ca968eda6f59b9ea6ff71960c5312e711c27994f98aabe92ff039644a67140ff1bf",
-  "@oxc-resolver/binding-linux-s390x-gnu@npm:11.2.0": "39b489ba03d1ed364cab5b4224670e95c984d7775fd9296aa0ed54ec7da20af23c729e8a900f7f28ad81ee7be8ed3b187f4904813ef2fd03a1485ebba4489f46",
-  "@oxc-resolver/binding-linux-x64-gnu@npm:11.2.0": "330a0bc725b9d090f77a1dea372118a6959d958090358fb12e48ecb9cd498facc2fcc306229f88addea5303f350238d645bf116447b4b6c388aba84a7f2accdb",
-  "@oxc-resolver/binding-linux-x64-musl@npm:11.2.0": "1e2f22c8f0130f9556f4ea3f6a208d8e8697a9983aab40f2e75c9b18330a952244f5ffb624114dafe6b91eac090b341e6cd83567cf415e24a31d7c927ffdeba5",
-  "@oxc-resolver/binding-wasm32-wasi@npm:11.2.0": "d94a7788a293b6a77b34e07dd198d451b43478196b55d86727636cd56643ef133113d6c9904fe33c2ea330683f68bf8aeb1e0a360740976036c13578729ebdc6",
-  "@oxc-resolver/binding-win32-arm64-msvc@npm:11.2.0": "3342de93cda0d7787d496a2434c41bca0e3641fa3ed381bd1a53b02afdb16dd76b4cc4bb062e7b238d5964ba3f8220e771233ce7c4bbd7a79f2c8c61139b4f2c",
-  "@oxc-resolver/binding-win32-x64-msvc@npm:11.2.0": "4a6929145a189b998f46bc0826d736f11039bcd3fc5bba7a3c06bd81130f24721cf849232d01ca45f017ad01cbe66316c36530bf2b362e1dcc23b70d1a174650",
-  "@unrs/resolver-binding-darwin-arm64@npm:1.7.11": "d7ba4ca14ae2e1787312b5c1e4ad33a91a0d19578c58176604bebbfd727d9c21bd4cf0d105f48a7e224968bdf3cd53b3b9ec8b6d882b2baf22624ac8ccaf2e2b",
-  "@unrs/resolver-binding-darwin-x64@npm:1.7.11": "615bd56e1534c33f3636b999c8f74ff8350301c0b2396f4289e5b984ddddf09537d973fe92d5e7e5cd145c2d4384a9663362ebf367f8b7534ab398043b189c2d",
-  "@unrs/resolver-binding-freebsd-x64@npm:1.7.11": "33981db9d3bc4bb0f7682ef5ba51cb9ad9eb51d8f5c62703f17524000fa9c38f21d1c566474efcf0d8637be8ffad3b510214908387238633da3282b477018502",
-  "@unrs/resolver-binding-linux-arm-gnueabihf@npm:1.7.11": "0a12a184a31d5ce33d11d5d424a3f3ac68c15594f6cb71e0c8670cfca585e24b1f22b022f9abc0f4a93b844f5232a3b660e4c8cb8df0480a3bef3e3ae994d7fa",
-  "@unrs/resolver-binding-linux-arm-musleabihf@npm:1.7.11": "c8540d77a0dc7354e6c61d988d242b0013ce923790828671e13bc12db216fc04e72da8a241c815d66194df6a69d959bddf20d4bf72139f33b7c41579078e3d15",
-  "@unrs/resolver-binding-linux-arm64-gnu@npm:1.7.11": "b0f1126eea72b1932091eb78fdd4a9556973a120b11d29a8501aa4000120d719859e373daf80f83096d301879b0ee8e5209e716a1f0d2a873e880ff9fbe59985",
-  "@unrs/resolver-binding-linux-arm64-musl@npm:1.7.11": "4d3a716fdb227a30c963c9c2783839783577941885b9bcae214529550e8786d503756a1f32969d0ef5a76fbe9293c865dc4cbc998a19b0aba3c404c1508c246e",
-  "@unrs/resolver-binding-linux-ppc64-gnu@npm:1.7.11": "2fa07f67eeb0131e13c474a3d9031d7b2aa79388fd033a885b4c188c1c3a6392e3393949a4870b6050d4987e7fc6bc32fd602016878f76b135bcc381b99b87d7",
-  "@unrs/resolver-binding-linux-riscv64-gnu@npm:1.7.11": "0df9391c8149f14939c227c007f974921b831af2fac907325191f7d59cc3a08c097e569c16564d2053202fc1fdd3e079853729f4428ba05561cc729313789d65",
-  "@unrs/resolver-binding-linux-riscv64-musl@npm:1.7.11": "10e1aeac0c690651d3c6ad3450da853a2421215a5a39373b67ca3dc50463f9194e5ee89fd2cb1943330e8c40f81ef6fde5b7ab86e6a2b20651b4de0d9fbe40a7",
-  "@unrs/resolver-binding-linux-s390x-gnu@npm:1.7.11": "c3258f7a68bece5e196d9da37105d416d833484ea59d23849d9acb69f9d12205a8dfac6cd5ba09c185276c923f460bafdb5607abe8aff3cda4213cd9ff11a2ee",
-  "@unrs/resolver-binding-linux-x64-gnu@npm:1.7.11": "937493b8986b3b39866c6955e6b64cb04365b4940ca1d78d3ebb37365087326c4ffad404e03977d50d190c765670c1e82629a6f842dba30f08845f47c4f8cb71",
-  "@unrs/resolver-binding-linux-x64-musl@npm:1.7.11": "bec6e6105cefc9e927c66cc378cce466c9e560a96b100dde914c12c1ed2111172363813609ea0075187cc74a6f863591da72dc9f437b768b5b29e3a4b349d72c",
-  "@unrs/resolver-binding-wasm32-wasi@npm:1.7.11": "e4875afc3026b934da497a7426c5092094a63162a229119f750a2a7133c3fef1b4e79e4d8068aafd14b69475c0f137f3369d38e646a97a578a839c4235a793f6",
-  "@unrs/resolver-binding-win32-arm64-msvc@npm:1.7.11": "5db590463e19b572d89414da9377cbb027ec8c4ad9987895925ff497ffbad4e2bcad577e0308cb8842d66d8c697ace5d20d22756317d7b055b187eadc00b4236",
-  "@unrs/resolver-binding-win32-ia32-msvc@npm:1.7.11": "c30223076e76dfd69c1ee4fe3735adca56bbfed874ab9b09baebe6b4e9d33b23a49bc068b31812a3c7aba54f026209c91d4921d9402d8c376045095528d07513",
-  "@unrs/resolver-binding-win32-x64-msvc@npm:1.7.11": "1ddf771f3aea07a590869ad9bdb59f9c896cfdd489941978e554f54a07c8f175e7d34bdae64b0749580d7c1cb522d66529a5a578ac77c60222c1cd78fa7af68f"
+  "@esbuild/aix-ppc64@npm:0.27.0": "a2ca52fdd0d14ed54b30f13cfa4792635cd3f5316194059c80693bcd004e303c30b687837cb50135ef7662977c53670ec6bfc62a199f905b06272326ecbc01e0",
+  "@esbuild/android-arm64@npm:0.27.0": "fbeff03846e18887d3f7e167e186ac31bc7ae4bccbc9e30c5f44d9070dd1b7f60162c73d4b05474fa7488a2e8b19b38f23a7f393cf7c4e4f742782c989c4dd58",
+  "@esbuild/android-arm@npm:0.27.0": "b89b4ed9ab236cb26c82714f691f9a34889091c486678bab3adc5732e6ca39c1c1981ca2986387025eb85605cef97da93c36134da8cbeb574531aeaac2e9d841",
+  "@esbuild/android-x64@npm:0.27.0": "b4567ca295f9aad8b75c1c9586c9219c6494859611d03c906a1fc31dffec8120591f37e4ff2f3e8329027662ab3501a8f4cab6d35ddae10b2422296e974df716",
+  "@esbuild/darwin-arm64@npm:0.27.0": "5bff3ed7158f73866f9a4e80a8a407f0ef326c34ece1bd6b62a792b219471e0e58f852e256823a3e8fb6a667a9b1f5b901ab2247c0bef3e4df079328ded3035e",
+  "@esbuild/darwin-x64@npm:0.27.0": "bb723cb91f9f76905d7e61125e7a01a9b1e43501e48bb4411e7df87c3e6b1520114d9dba1bb1eedb41412a894f5128294e31f8fe8c9e614d7f8e10acf2729e6f",
+  "@esbuild/freebsd-arm64@npm:0.27.0": "a48ebc756ee45f74c2edb47674a99288ff48438622afdf9cf6f36a9b260558ec06c09645dfbee84fc7389be53b174907a2bc3f5cbc3e729720d512fdf2d73c31",
+  "@esbuild/freebsd-x64@npm:0.27.0": "baa873cde5d6902b130e6193afa3d15db82d0fc9d87e83cf53330a85ae813f498fbd8ed287ac302b745ce9abeb7d551b49da9ee6029c4f18cfd7aea6c593b44c",
+  "@esbuild/linux-arm64@npm:0.27.0": "9a2086d7f044574bf92a841d9e904d7ab556561400f45faa60999d3c26bb88fffb0b0c23d50fe7fd8f5af9d2c8dd42293b1956118fa1703c6c6106b5b166affd",
+  "@esbuild/linux-arm@npm:0.27.0": "fca02378927bd2b9e79044aa4d8d12a86a7166cc170ca181840749a0336f1fe934c0b57903447642d4a0c78d89efecf26dc6267fba615e6c34844cd33d4e5ef2",
+  "@esbuild/linux-ia32@npm:0.27.0": "84592030cafe4df7acc412fe6896c409d6759bcb1ddeea0399413dc4ca351e592aa4cb98cfbc62cbf6d96cf45440ad64a20e5b6680b2ba268cd3f73439245865",
+  "@esbuild/linux-loong64@npm:0.27.0": "61e5964361208c18201b794bb1adc94b49f0522b9d07ff7d3172c639cb6745c93cccdfcc1e235574b73a98f7b84ed34a24bb4f4aabaf83232f5905e7040da2a1",
+  "@esbuild/linux-mips64el@npm:0.27.0": "4c7d2f27e2985bae6a15a8575dd009c574d8b37f4a10a192eb8eb6c99113b32d9a1d0dfc75fcd686c1f6f9c8156d690ed8488ae7b44f47de47787df2afd8a0a2",
+  "@esbuild/linux-ppc64@npm:0.27.0": "3b89ad3037e6293965c3228538886164ed499ae54471520c0c3a37d05d7485ca148c9e08dcfbc8eb5479d12e4ae4d5d786b8dd854f031548a390ae7f59c505e5",
+  "@esbuild/linux-riscv64@npm:0.27.0": "91a6cf3ed8b9c98f1cf9056c160c070581f3020a29c1bd8e664a8a13414bd2dd5f1a1ad95c4ce6bed8849fb7a82cb195c47cd6bfada61876a76668371636286b",
+  "@esbuild/linux-s390x@npm:0.27.0": "0be7179d33e7a985b717e6dd4a40ce6315714cf41075ef455f60fad88217fd9455f0d6434109b270c33979255361b8a894f1152bfa629798ae520fa97e98a71d",
+  "@esbuild/linux-x64@npm:0.27.0": "591315fd88c446bb5940dfcf9878116bc60d757b72566f905dc93aeb2b9e7b9998bd70442aa5f7772a102c87ecc131d7561941c2aeb475786a91651c0666bdcd",
+  "@esbuild/netbsd-arm64@npm:0.27.0": "54fdc4bcbe40945c6ba84ec133c94be1e8dec7dc1bde6d5d8675244e72689640300e99485c4feb87f118ffbe8ada58a519fe99a4342cdca052636da587fb2333",
+  "@esbuild/netbsd-x64@npm:0.27.0": "7d2a840fc0c9977555b4afb3070c56fab56765f5b10d9a93b6cbc78550e47366e5bc1b6221df1895a19a5a9de856780ac1b7e8634e4d54416dd1db26d3001831",
+  "@esbuild/openbsd-arm64@npm:0.27.0": "ae418b74912c55b0445bdc0efa4f183c2ee5af6c2a09057380c8311421ccb57f0c38170f2bb035ebf05d51864704570a5917f617b779135ed312bb1ec2917d3e",
+  "@esbuild/openbsd-x64@npm:0.27.0": "178c015043f641105d280a2b2649f46b7d3666a130ab1f808969d83f55d44c8d15fb0971905c4a594eb56b5b4ea805ddc03cb8c504650e5a7167fca3675d548b",
+  "@esbuild/openharmony-arm64@npm:0.27.0": "736634e14e01e13f9567e751b53bea51a511aab5b63ec73cbf499d252badc3695c573ce70b88d3a6e4b5b991ece2f11bc9152b8e4ee57b0c863df846af73e360",
+  "@esbuild/sunos-x64@npm:0.27.0": "397ea01ebf2d2a6359d04e6498eb12b5e0ad68688620a73392b72bee9c1ff4e8435d6717dd6148344f8c918eed40fbdcfabe05a378bc121c6572d146b3cd6672",
+  "@esbuild/win32-arm64@npm:0.27.0": "0764563ecbfcad9c5468ff73e415a5ab2379471d5eccc6077baa81efe7965954da040f79095bfc021a8d717908b7c19cee80017b1dca8fdf1dc565f47d7334c1",
+  "@esbuild/win32-ia32@npm:0.27.0": "94252e06dc62e4b3774f2d881bb5cac43c430895f32e61b53ad06f034ed75dc87a45891cf1c0281388e2ca39e7d44e33c42bf4e113e67001359be5a4542ffa93",
+  "@esbuild/win32-x64@npm:0.27.0": "fd6554d61494458b8f08e6bee8ea5d08b4885f9f9ed765caab9b13430238f7a0d6cb85136eaef439acfed7740abe864d2ba198d39e12a405d73abde641e7f448",
+  "@oxc-parser/binding-android-arm-eabi@npm:0.125.0": "6ff43763cca0b1c8ca86e126db259cb604135e33c2151fd700d7492161af9c144f0214252c0c66025532788667297846f740399b3f075a6a0302dfb9cde3a261",
+  "@oxc-parser/binding-android-arm64@npm:0.125.0": "49a8a368d6d826b7052eeffadcfd6004cc24268e6d6ffb1959d480c902bca597242f0ef1267d6ae1b60477641429c842dc1cbf33b639320b7bacf17e3f1b8589",
+  "@oxc-parser/binding-darwin-arm64@npm:0.125.0": "d9f41dfb1fd7639903aec3d5ce440a408c9681459f55bac1c97da1a2a7106e19c4387a3686d78dd735dcb1b1698722d07e8ce973ea68a37ae3bc6dc57d144aa3",
+  "@oxc-parser/binding-darwin-x64@npm:0.125.0": "e0797ff4f2d7671717603e5e611176c7c4982b78fccc3356c05f8f0c168ac1f47e5eec4751f12d885be214c1c36bf4bc6c163724000084a8cd64796fa84b07ad",
+  "@oxc-parser/binding-freebsd-x64@npm:0.125.0": "515e3133b6db6e9539ee04a63f27efa8f7ab049cdddb8ddb8d746baa89cdd4c336a75a48dc6269e2c1c3b1ffe2390f86c211615b114f763d7b1c44896a560dc9",
+  "@oxc-parser/binding-linux-arm-gnueabihf@npm:0.125.0": "ba8a51e6ff74e81294257eb123441d1bbaa74d5b800e29ee6ef2b4e3b96ebfdcd84e15dda6f3ba4f6063bab088e9889cdce5fe6b351b0d9fd2a14392dc9a18b3",
+  "@oxc-parser/binding-linux-arm-musleabihf@npm:0.125.0": "0cea4f6b9a1bb0f51929c01bbc37c79e1822727e3659a927c50317436c349b4972726a1e1318a8c32fcb554bc570cdb5451c50f480514283dd2e64a395cb13ab",
+  "@oxc-parser/binding-linux-arm64-gnu@npm:0.125.0": "be490df3c5778d4fab023d7b4c277b398fd8fb55e9e61c1f4c27ba62e7ae627c53c1846096ddce77223fe3dc4baba09e2afde4c3778b70297d59708659ad71e3",
+  "@oxc-parser/binding-linux-arm64-musl@npm:0.125.0": "c98e6f4ad3a4c780e55425fcbc127ecc20cede7c75d340ef3249424fde831c2dccba3d3fb0c8b48ad1f185d93e12ba70e05d8569414431c2e067debceec98def",
+  "@oxc-parser/binding-linux-ppc64-gnu@npm:0.125.0": "bd0d00ed0c75f424e26ddd8badefe80e345fbcbdefe9b6a5d872e90775d10d6ff797daa393d2c6158ab8cb1b7f88dd09cb4631601e254ce0c6d61a4bf925ed38",
+  "@oxc-parser/binding-linux-riscv64-gnu@npm:0.125.0": "363576c9612bd36bd870134a3e0fc69b29feeb958a467ea8fd02425364cb6bf33b9a870e8a530c813d6f9742d0980add5393a2aecea254d29b95e6adf9032dbd",
+  "@oxc-parser/binding-linux-riscv64-musl@npm:0.125.0": "fb8b7307478537640fd0a617f32c62faef1dc014eaa51a13bdc325444b39074c51317be69df2ce38eeae8d5b9c1b172fcc95bcdda4d718c7e9895de5a11493bc",
+  "@oxc-parser/binding-linux-s390x-gnu@npm:0.125.0": "39e5d72eaca1b28851fa9d00d3b5d6bca317bbfd390c421215e7153204d0e7d5c1228108d998876b36dfdd9399f9761d338e6c67cd8aee08cb2d62a713fa45bf",
+  "@oxc-parser/binding-linux-x64-gnu@npm:0.125.0": "43bf4a3efbd42656560357dc2a84d90189fdd07dc0c7cd24a0e45060bd8b61123e210af458ca8ada99c1147ea361c14bd86c86e9360e45a32cc9440a10dc5cca",
+  "@oxc-parser/binding-linux-x64-musl@npm:0.125.0": "64d1e08bd8f67d53a173a1eb67b4f2743afda6832bb0fc7ea3996d0821e5f3b9e5d7f55594e17e303cc3057219c903ca5a34221a96064403ca21361e41e37709",
+  "@oxc-parser/binding-openharmony-arm64@npm:0.125.0": "49cf95d5d9433a423581ffaae921bb9a894836da786f178086d326799be4f7370061a12856e1cc6cd2c213117614bf9419aba9420347fe3de38f0b7a191723a0",
+  "@oxc-parser/binding-wasm32-wasi@npm:0.125.0": "b7eaba3d967e41d4edbb8530cbcca56aec2047cd6d77b66dc2e8769f1644db95a841a28b9edceb0bc4eff403e057448ab19c29d3ffeaf5e5269bee6dd274b537",
+  "@oxc-parser/binding-win32-arm64-msvc@npm:0.125.0": "c42b9f91a19d9ecc1346d799b381ed05a7e0b081a6984eed1c171123e6ad99a507e132c93cd2935360d8580de9b8a8238ab89870580acaa4f791f3346d98a548",
+  "@oxc-parser/binding-win32-ia32-msvc@npm:0.125.0": "1671a8aa624c7bb75c0fddb91247a64c0060865a2ec005b8ae8f1c1b6366054326a28e85e8e74ff638bb5a8549a21f4128612d88404ebb8cead77b0d025ca268",
+  "@oxc-parser/binding-win32-x64-msvc@npm:0.125.0": "053cf4c93299f728628617b7f47a69927981b44cc2fc2ea6ca08f3017bf6949b169e75ffbba10ad0fb918a6425e2fd4fa37868519bc8e55c90631c27415c6801",
+  "@oxc-resolver/binding-android-arm-eabi@npm:11.13.2": "7433ba278c276c8727ce61d380b468ce7c0a8d95178710978229c5e9474a6a36fcbc13c220d25bf027d423eb54ae5ed665fabc2203f429bb55f227f50afb7a85",
+  "@oxc-resolver/binding-android-arm64@npm:11.13.2": "3f809e1faf8078fbde69dbf8fc6874587a99707153010f6c1adca0759fe20860f8b4d47830f9055215801903c3c663e6c141bc83d327a0726429e4c322ab13c6",
+  "@oxc-resolver/binding-darwin-arm64@npm:11.13.2": "bc623cbf2983d133f1db852f9526e861c3eba1868687ac18c176995f9963677a7cb8d21dcde0409579bf348461610469f66ae9754dc0378efa30a1761280f8cf",
+  "@oxc-resolver/binding-darwin-x64@npm:11.13.2": "576dcb841d09e5a20d76b9b8aaa245ef8c7b51a22e9fb03780e0bc9fbfc24a097cc947d8e8d02a31739f08e269e9031fc4c45fcdfad81a83fbc11504573adb5d",
+  "@oxc-resolver/binding-freebsd-x64@npm:11.13.2": "4003ff07f4faf4e8fe4176ca8f37cc0c16365852f5a24c082f761067b922451cd227bcfceadd7d2ac6ef65ce6a96177cddf42f03595761ea65127a5fbfb09d88",
+  "@oxc-resolver/binding-linux-arm-gnueabihf@npm:11.13.2": "8ab3605ee226f3486f449d96f440b99bef0335640d2babebc3a180ea25cba34e0ea1b117e702b8f62e6ce889b3cdcf309010dc7f41cf2bdbcbf48206e669f23d",
+  "@oxc-resolver/binding-linux-arm-musleabihf@npm:11.13.2": "1e556acdfc4e68c6dc139ae48c2ddc754a2852bc6c4857baa2131971910353e711cfd546e63b610dade6c012e90f750643ca9739f4f72472038f40aaaf8d72b7",
+  "@oxc-resolver/binding-linux-arm64-gnu@npm:11.13.2": "8ff507dde692731dec867437d649bc1a5a3d7cca7136e129291a88812356a875388255ab2c00b03687649c32e07b94a7d780cc8c305513889bdd8d344d2fb329",
+  "@oxc-resolver/binding-linux-arm64-musl@npm:11.13.2": "1f8741d4ef260e24485b3d8304b8ffdd8ca8e0ee98ded0e0462e53da48de52500ed4637a104e3cd3ba1c62c59b89407c76f9bb82299a949c5bf2c27210bb50ec",
+  "@oxc-resolver/binding-linux-ppc64-gnu@npm:11.13.2": "bf9b9ade08c7b8bc11c613b46ee911544760c2d8b2f5947353fd13482f14a6f969afde66d7277deb8a469e09bcde2ae95d855623e75d24e0152b49176508a221",
+  "@oxc-resolver/binding-linux-riscv64-gnu@npm:11.13.2": "d1018d409b429194be4e84a6b7549ce364f72130de567071d7722c594e5b2478d8897cfb5c726732aeefcab8ad5995a6ef3e207c8ae39a839397635a457ae67a",
+  "@oxc-resolver/binding-linux-riscv64-musl@npm:11.13.2": "e3f05778e0f54eaed054876f2588be7241d58578d23c6f1d5905cf3e15d1c297586ad668015cad5b0c461869ef72b0b61429da68eac3bcba9a9951aeb899bb9d",
+  "@oxc-resolver/binding-linux-s390x-gnu@npm:11.13.2": "12a538c9e7cf53967e48053adc3f8ab54d2538ef9ca7946a02beb530f7eb0f822f5267875363d99dc58f0552e438f4173073a3592537891c32960ef40a19fe40",
+  "@oxc-resolver/binding-linux-x64-gnu@npm:11.13.2": "3ebb57542dcf4c2ebf0ede033f022e9ada9c3c26fd9e69e78dda59644419b1996a379070bf2f8689bb9c7942b4c02f820078a5a9ec0214dcdc838347cf6926fa",
+  "@oxc-resolver/binding-linux-x64-musl@npm:11.13.2": "882bff960eaa7392dbd25df5a69886ac1613360d406b32a6b548cda39772c0d2d407584930e4d2909c55cfff6f2db9b8519c0c94f55dfdd284cd3852614fc40f",
+  "@oxc-resolver/binding-wasm32-wasi@npm:11.13.2": "f252f01fde4b40d046a31ec70dd2493545a18b5d7da70b970b9311741701827219e4e27aace84cfb669b37360968810396993cd4e30a5c13832a68691546d419",
+  "@oxc-resolver/binding-win32-arm64-msvc@npm:11.13.2": "e23db915180d06f88c38d7b71e0397ba3ffdc6af2b15346662b4c3eed43cb6087893f0bddba333a26a87389f8be5314e68089439e6fc53e2b327eb3438320d68",
+  "@oxc-resolver/binding-win32-ia32-msvc@npm:11.13.2": "1e8c27b77cf8fb53e42e07295c23c1ececdad06fd2049e8efad6f0d7d6bbc790e53d034ff6835a686369e08a6f2e0ee5603a210b491e524d144d581b664f3834",
+  "@oxc-resolver/binding-win32-x64-msvc@npm:11.13.2": "ae00dd7c036b55c54c85be7c5a53b1af6a52967a9b0b3f95371c30f313bd642db991a3390f0874552fd800cdabc4dfd8238a2de0bec4a3aa7c7d852fca5be6c2",
+  "@unrs/resolver-binding-android-arm-eabi@npm:1.11.1": "5c8769703d724915224711f718085f541d8558e95d8646c6cca5709f1f7dd00ce65d0e2d0bc03bb1c0c74d22d70d54cfc490176dbb7c6f5d06072365ec7ef6b6",
+  "@unrs/resolver-binding-android-arm64@npm:1.11.1": "7ab93a01b7f4cbc99bfaf8cd35a1454f78826bb2840f0387a19491cb4835b16d81d30ca2b4b71a43643f58aaceb83a63cd89274a3f16637e35887e67a93ea21e",
+  "@unrs/resolver-binding-darwin-arm64@npm:1.11.1": "f8bd59a69ca200f9590a94de5699a0cecbcba120f5b82b2295468d36f943be48d957a8ca466f3fb30466abafee4a9672831c382ff9dea4ccdaa0a92992bb41b1",
+  "@unrs/resolver-binding-darwin-x64@npm:1.11.1": "423acf3a8032b6bde50fabcdeccd4c1954bbede56f8c2fc5134621fd957f931a08ad74b3690762e3e18e2f5f31f35dc93b826a1c2626031d218dc4b16d415efc",
+  "@unrs/resolver-binding-freebsd-x64@npm:1.11.1": "d6b88ea9447328f4f5e373e77524daa52d5630ecc7035ca67121082e2017a91dc9e3fd7b8230e41f1307137ee7487b0bc0c8a922dda1b77b01f735202486e36f",
+  "@unrs/resolver-binding-linux-arm-gnueabihf@npm:1.11.1": "d4a3248f64ab92ea680b3bd5f74c19f15c8f82eb1628e32aeaa058a7fd2efdbba4b5d4e011e453389e42e79cbf00847c79a172ef66d8c9b555feada7a2693772",
+  "@unrs/resolver-binding-linux-arm-musleabihf@npm:1.11.1": "1426c4a182922d16b684cfaff9a2d1cc6ddb06eba6fbe966d8d5a88fc0ed6660f4742c7d90659dc14f9f152132fcbde4afd483b5d0c8aa22eedd1154b0f3c632",
+  "@unrs/resolver-binding-linux-arm64-gnu@npm:1.11.1": "baa3911178e6462c8d682d3ec182e95fc33f308d5b50662f07108a9a5572d365c97604932887113053fada46949580fabc9ca704822c714160ba8eee0387b286",
+  "@unrs/resolver-binding-linux-arm64-musl@npm:1.11.1": "cb7763961f472f201e885753c3daf72231990c65fa5112a76a996f7c5754f2e6688cdc58f1861b05b5f176dae9255e34a860c40b21401318395eb4939759e46a",
+  "@unrs/resolver-binding-linux-ppc64-gnu@npm:1.11.1": "148d28b05c5d50bc4d429f5da3e675b1285387b54c8e5363d7c288b53f2f38688bf9472ac5f2e4ba7fa3c3d7f19bac19738b1815a8973ba29c6bae76990b66f7",
+  "@unrs/resolver-binding-linux-riscv64-gnu@npm:1.11.1": "40ba923597ae297b7be85de1769025578e16af29def72060e7603ec3311fefe537c9608520e771291e934af7e64e3a52d74ccb5ee1f7a657ba2f2a2fcfbf3df7",
+  "@unrs/resolver-binding-linux-riscv64-musl@npm:1.11.1": "193da09875cf4ce3ea9ef24a141f9235da9095808b157b4dc83ce431f97732f2d19f65d4030771187d1a8424f6843e8a50ac6ba2ab4391271f80680c1166b2d7",
+  "@unrs/resolver-binding-linux-s390x-gnu@npm:1.11.1": "c376fbbfbe0909844c188f23eec33c937fbf4a1f2fe81418726aa9bab91b44d9411ec98560ed73aaf15fa2082483fb0907a335535449623e3e4a604ee18b7ac3",
+  "@unrs/resolver-binding-linux-x64-gnu@npm:1.11.1": "c3011171259f4f4c5c1751e565fd6f0ec203558484234cc438279a26f6fb2ec0d4bbed72ed9bfbc9967e43351fd8e3aa716269b8e670a7c9421ff64a1a9123eb",
+  "@unrs/resolver-binding-linux-x64-musl@npm:1.11.1": "27da30650ec1e6378bc47665a944913839ef95e9af1bc7892f6ad3fd7cd10468d5b4da8caa03f83e3c56e03253cae4034ba1ee64d3ceb19a3656f31d362eaabf",
+  "@unrs/resolver-binding-wasm32-wasi@npm:1.11.1": "ca69e8caeed033c074d9413112264fe1c0bdaaedb4fa9e6f5bcbf3a64ee98fa8261a6b5e54c3d7b7144cf020217c9a89f308086ec64d11d78480bd5885dc2e1a",
+  "@unrs/resolver-binding-win32-arm64-msvc@npm:1.11.1": "4aabb2e8c80590650bd2b46f205f24e9f345ead68e7b53c20adb219d0c3f030c605d5434f3895fde68ebfa521ea97ea6da974e342e19487086da6a16332860df",
+  "@unrs/resolver-binding-win32-ia32-msvc@npm:1.11.1": "5b364708ea2985d0e59f235a00e05bf3668704a81e9d32e8929980c84fd0bd67102c2041337b08e266a8bc4883ddf618ac7cb5e1f64614d8f9861cc4e3208905",
+  "@unrs/resolver-binding-win32-x64-msvc@npm:1.11.1": "92ff0d27efe168480a14c8d705c0f68624f01251bdc5f8f41bbd6c7ed8ea23effb8481f01eb93270896822397fe2fd78a427c1756ecabc3cb13a746c918b5949"
 }
diff --git a/pkgs/by-name/pr/prettier/package.nix b/pkgs/by-name/pr/prettier/package.nix
index 791506a71b0f..0f071d92102a 100644
--- a/pkgs/by-name/pr/prettier/package.nix
+++ b/pkgs/by-name/pr/prettier/package.nix
@@ -1,8 +1,12 @@
 {
   fetchFromGitHub,
+  fetchPnpmDeps,
   lib,
+  fetchurl,
   makeBinaryWrapper,
   nodejs,
+  pnpmConfigHook,
+  pnpm_9,
   stdenv,
   versionCheckHook,
   yarn-berry,
@@ -68,16 +72,74 @@ let
         pathAbsoluteNaive -> ${pathAbsoluteNaive}
         pathAbsoluteFallback -> ${pathAbsoluteFallback}
       '' throw "${plugin.pname}: does not provide parse-able entry point";
+
+  yarnHash = "sha256-KQywjBgJcT6CXT8bd11wT26qmfLen8E/gXhPBA5TY9A=";
+
+  prettier-oxc-wasm-parser = stdenv.mkDerivation (finalAttrs: {
+    pname = "binding-wasm32-wasi";
+    version = "0.99.0";
+
+    src = fetchurl {
+      url = "https://registry.npmjs.org/@oxc-parser/${finalAttrs.pname}/-/${finalAttrs.pname}-${finalAttrs.version}.tgz";
+      sha256 = "sha256-7qPLrjsQ6+F565/k4HbVtcbr5HDok5AcaR8W+zTy/SM=";
+    };
+
+    nativeBuildInputs = [
+      nodejs
+      pnpmConfigHook
+      pnpm_9
+    ];
+
+    patches = [
+      ./pnpm-lock_prettier-oxc-wasm-parser.patch
+    ];
+
+    pnpmDeps = fetchPnpmDeps {
+      inherit (finalAttrs)
+        pname
+        version
+        src
+        patches
+        ;
+
+      pnpm = pnpm_9;
+      fetcherVersion = 3;
+      hash = "sha256-WPsVL05rVku2YSbfjHX4/BoFM+qvIm4sZip7pISg0vA=";
+    };
+
+    buildPhase = ''
+      runHook preBuild
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir $out
+      cp -r . $out/
+
+      runHook postInstall
+    '';
+
+    doCheck = false;
+    doInstallCheck = false;
+
+    meta = {
+      description = "Oxc Parser Node API";
+      homepage = "https://oxc.rs/docs/guide/usage/parser";
+      license = "MIT";
+    };
+  });
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "prettier";
-  version = "3.6.2";
+  version = "3.8.3";
 
   src = fetchFromGitHub {
     owner = "prettier";
     repo = "prettier";
     tag = finalAttrs.version;
-    hash = "sha256-uMLRFBZP7/42R6nReONcb9/kVGCn3yGHLcLFajMZLmQ=";
+    hash = "sha256-7B8AnLPC2CcgdR/Jz0TvMhqYCCEf345U6xlWB7QaIqg=";
   };
 
   patches = [
@@ -89,8 +151,10 @@ stdenv.mkDerivation (finalAttrs: {
   missingHashes = ./missing-hashes.json;
 
   offlineCache = yarn-berry.fetchYarnBerryDeps {
+
     inherit (finalAttrs) src missingHashes patches;
-    hash = "sha256-+cDMrVwkTU5rYOQ7d2TqpsYx5F4JVZCpmf1vjOBhZ3M=";
+    hash = yarnHash;
+
   };
 
   nativeBuildInputs = [
@@ -103,6 +167,18 @@ stdenv.mkDerivation (finalAttrs: {
     runHook preInstall
 
     yarn install --immutable
+
+    mkdir -p .tmp/prettier-oxc-wasm-parser/node_modules/@oxc-parser
+
+    cp -r ${prettier-oxc-wasm-parser.out} .tmp/prettier-oxc-wasm-parser/node_modules/@oxc-parser/binding-wasm32-wasi
+
+    find .tmp/prettier-oxc-wasm-parser -type f -exec chmod u+w {} \;
+    find .tmp/prettier-oxc-wasm-parser -type d -exec chmod u+w {} \;
+
+    sed --in-place --expression '/^\s\+const installDirectory = await install(version);$/ {
+      s#await install(version)#new URL("../../.tmp/prettier-oxc-wasm-parser", import.meta.url)#;
+    }' scripts/build/build-oxc-wasm-parser.js
+
     yarn build --clean
 
     mkdir -p $out/lib/node_modules
diff --git a/pkgs/by-name/pr/prettier/pnpm-lock_prettier-oxc-wasm-parser.patch b/pkgs/by-name/pr/prettier/pnpm-lock_prettier-oxc-wasm-parser.patch
new file mode 100644
index 000000000000..eb2197f9dbe5
--- /dev/null
+++ b/pkgs/by-name/pr/prettier/pnpm-lock_prettier-oxc-wasm-parser.patch
@@ -0,0 +1,62 @@
+--- /dev/null	2026-05-11 13:04:22
++++ ./pnpm-lock.yaml	2026-05-11 12:52:25
+@@ -0,0 +1,59 @@
++lockfileVersion: '9.0'
++
++importers:
++
++  .:
++    dependencies:
++      '@napi-rs/wasm-runtime':
++        specifier: ^1.0.7
++        version: 1.1.4(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)
++
++packages:
++
++  '@emnapi/core@1.10.0':
++    resolution: {integrity: sha512-yq6OkJ4p82CAfPl0u9mQebQHKPJkY7WrIuk205cTYnYe+k2Z8YBh11FrbRG/H6ihirqcacOgl2BIO8oyMQLeXw==}
++
++  '@emnapi/runtime@1.10.0':
++    resolution: {integrity: sha512-ewvYlk86xUoGI0zQRNq/mC+16R1QeDlKQy21Ki3oSYXNgLb45GV1P6A0M+/s6nyCuNDqe5VpaY84BzXGwVbwFA==}
++
++  '@emnapi/wasi-threads@1.2.1':
++    resolution: {integrity: sha512-uTII7OYF+/Mes/MrcIOYp5yOtSMLBWSIoLPpcgwipoiKbli6k322tcoFsxoIIxPDqW01SQGAgko4EzZi2BNv2w==}
++
++  '@napi-rs/wasm-runtime@1.1.4':
++    resolution: {integrity: sha512-3NQNNgA1YSlJb/kMH1ildASP9HW7/7kYnRI2szWJaofaS1hWmbGI4H+d3+22aGzXXN9IJ+n+GiFVcGipJP18ow==}
++    peerDependencies:
++      '@emnapi/core': ^1.7.1
++      '@emnapi/runtime': ^1.7.1
++
++  '@tybys/wasm-util@0.10.1':
++    resolution: {integrity: sha512-9tTaPJLSiejZKx+Bmog4uSubteqTvFrVrURwkmHixBo0G4seD0zUxp98E1DzUBJxLQ3NPwXrGKDiVjwx/DpPsg==}
++
++  tslib@2.8.1:
++    resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==}
++
++snapshots:
++
++  '@emnapi/core@1.10.0':
++    dependencies:
++      '@emnapi/wasi-threads': 1.2.1
++      tslib: 2.8.1
++
++  '@emnapi/runtime@1.10.0':
++    dependencies:
++      tslib: 2.8.1
++
++  '@emnapi/wasi-threads@1.2.1':
++    dependencies:
++      tslib: 2.8.1
++
++  '@napi-rs/wasm-runtime@1.1.4(@emnapi/core@1.10.0)(@emnapi/runtime@1.10.0)':
++    dependencies:
++      '@emnapi/core': 1.10.0
++      '@emnapi/runtime': 1.10.0
++      '@tybys/wasm-util': 0.10.1
++
++  '@tybys/wasm-util@0.10.1':
++    dependencies:
++      tslib: 2.8.1
++
++  tslib@2.8.1: {}
diff --git a/pkgs/by-name/pr/prettier/update.sh b/pkgs/by-name/pr/prettier/update.sh
index 623a5a8f0d63..3013d3f75bea 100755
--- a/pkgs/by-name/pr/prettier/update.sh
+++ b/pkgs/by-name/pr/prettier/update.sh
@@ -45,4 +45,7 @@ update-source-version "${package}" "${latest_version}"
 echo "Update yarn offline cache hash…"
 nix-build --attr "${package}.src"
 yarn-berry-fetcher missing-hashes result/yarn.lock >"${package_dir}/missing-hashes.json"
+yarn_hash="$(yarn-berry-fetcher prefetch result/yarn.lock "${package_dir}/missing-hashes.json")"
 rm -f "${package_dir}/package.json"
+
+sed --in-place --expression='s/yarnHash = ".*"/yarnHash = "'${yarn_hash}'"/' "${package_dir}/package.nix"
diff --git a/pkgs/by-name/pr/prettier/yarn-4.14-support.patch b/pkgs/by-name/pr/prettier/yarn-4.14-support.patch
index ac5d685b2049..879ad1098041 100644
--- a/pkgs/by-name/pr/prettier/yarn-4.14-support.patch
+++ b/pkgs/by-name/pr/prettier/yarn-4.14-support.patch
@@ -5,7 +5,7 @@ diff --git a/.yarnrc.yml b/.yarnrc.yml
  plugins:
    - .yarn/plugins/plugin-setup-editor.cjs
  
--yarnPath: .yarn/releases/yarn-4.9.2.cjs
+-yarnPath: .yarn/releases/yarn-4.12.0.cjs
 +approvedGitRepositories:
 + - "**"
 +
diff --git a/pkgs/by-name/r2/r2modman/missing-hashes.json b/pkgs/by-name/r2/r2modman/missing-hashes.json
index 177a3a8b249c..06ea5077f7b0 100644
--- a/pkgs/by-name/r2/r2modman/missing-hashes.json
+++ b/pkgs/by-name/r2/r2modman/missing-hashes.json
@@ -79,7 +79,6 @@
   "@rollup/rollup-win32-x64-gnu@npm:4.60.0": "1400b3aace00dc90638bfd39d68275bb5f16143d240b9c36eb70f242ed2080c26fe14192fd3375120308ff94a7da1e169a8e0e56efbe41483f59731602d3be84",
   "@rollup/rollup-win32-x64-msvc@npm:4.60.0": "c948b3a8ed6e73f2382dc41ffab3e9928f95c4a0e3481272b26ad04a5f73084ca13fd5c253887f9077c37cb1c91bd8494b4a45a7764c874aa105684e8424289a",
   "dmg-license@npm:1.0.11": "feef35cfb45270a72daadcca9584be5cb840f924448b9d4e543fcd61f1b6d471151049f277c91de1d8b003fad6203d0176066a5f427a01df5fb073402cb8c8b7",
-  "electron-installer-flatpak@npm:0.8.0": "aeaadb5f8f3de96640d3616544700e2c458262f61c7923afd96686223450ed9dbf6d284c1fc6943a6e995957be65cdd140bc4b1c00dd28bf1015fd81ae1e155d",
   "iconv-corefoundation@npm:1.1.7": "bc6f08ac421e5e92ed20f3825f123fd705e036612b2b6aa687958de753c06f32e54f0203ef55540869e3ee189eaea15e43a2757f3a90e555c4dd512c9422da43",
   "lightningcss-android-arm64@npm:1.32.0": "1cb326ad39dcb02cf9f45025c167b6900e3a04b08f5149d3c5ee26054b00d08db3736fb69183a6c3ed1cb32dddd148608c784b6631b4777623f7dd0c032c392d",
   "lightningcss-darwin-arm64@npm:1.32.0": "da954d0c215d0e95f15a92c8717f871017586e1332b98fd40e96196571d2fd3d51a727dc530768afee9f6a04da210510740574dd0c8dbf2ecced79e5996f1a06",
diff --git a/pkgs/by-name/r2/r2modman/package.nix b/pkgs/by-name/r2/r2modman/package.nix
index 5e16807f8899..f665b4bef0a8 100644
--- a/pkgs/by-name/r2/r2modman/package.nix
+++ b/pkgs/by-name/r2/r2modman/package.nix
@@ -13,19 +13,19 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "r2modman";
-  version = "3.2.15";
+  version = "3.2.16";
 
   src = fetchFromGitHub {
     owner = "ebkr";
     repo = "r2modmanPlus";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AU2fswh2gNJr1JWTHjtxJh/vVwvDqFXjaaF+QaLprFo=";
+    hash = "sha256-ya7VPb+bmOvtXNex9R80N6rZLSCVoyntqCzaHXIwb1M=";
   };
 
   missingHashes = ./missing-hashes.json;
   offlineCache = yarn-berry.fetchYarnBerryDeps {
     inherit (finalAttrs) src patches missingHashes;
-    hash = "sha256-6WfpOAt9XRw4fC+Ix9OoDPvg7oIxcdKRX5ttIywG14E=";
+    hash = "sha256-RAQgaxcQl15JqZsLA9ISfOiGgob4yYuc4bhjZFzW8xk=";
   };
 
   patches = [
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
     ./steam-launch-fix.patch
 
     # Remove after upstream updates to Yarn 4.14
-    # https://github.com/ebkr/r2modmanPlus/blob/develop/package.json#L117
+    # https://github.com/ebkr/r2modmanPlus/blob/develop/package.json#L118
     ./yarn-4.14-support.patch
   ];
 
diff --git a/pkgs/by-name/sc/scanservjs/package.nix b/pkgs/by-name/sc/scanservjs/package.nix
index b63f7b214770..c386bf6b3dca 100644
--- a/pkgs/by-name/sc/scanservjs/package.nix
+++ b/pkgs/by-name/sc/scanservjs/package.nix
@@ -2,7 +2,7 @@
   lib,
   fetchFromGitHub,
   buildNpmPackage,
-  nodejs_20,
+  nodejs,
 }:
 
 buildNpmPackage (finalAttrs: {
@@ -18,13 +18,9 @@ buildNpmPackage (finalAttrs: {
 
   npmDepsHash = "sha256-HIWT09G8gqSFt9CIjsjJaDRnj2GO0G6JOGeI0p4/1vw=";
 
-  # Build fails on node 22, presumably because of esm.
-  # https://github.com/NixOS/nixpkgs/issues/371649
-  nodejs = nodejs_20;
-
   postInstall = ''
     mkdir $out/bin
-    makeWrapper ${lib.getExe finalAttrs.nodejs} $out/bin/scanservjs \
+    makeWrapper ${lib.getExe nodejs} $out/bin/scanservjs \
       --set NODE_ENV production \
       --add-flags "'$out/lib/node_modules/scanservjs/app-server/src/server.js'"
   '';
diff --git a/pkgs/by-name/te/technitium-dns-server-library/nuget-deps.json b/pkgs/by-name/te/technitium-dns-server-library/nuget-deps.json
index 27256167cce8..55abcf33388d 100644
--- a/pkgs/by-name/te/technitium-dns-server-library/nuget-deps.json
+++ b/pkgs/by-name/te/technitium-dns-server-library/nuget-deps.json
@@ -11,12 +11,12 @@
   },
   {
     "pname": "QRCoder",
-    "version": "1.7.0",
-    "hash": "sha256-sssSQBTHf1cUWNQYFEEJ8PRLs486ciDsXtrwL+ozZIU="
+    "version": "1.8.0",
+    "hash": "sha256-UvOeFFxUZ/bddmDs6IamiYGDIfgxybE/CSpPyy5DMxI="
   },
   {
     "pname": "System.Drawing.Common",
     "version": "6.0.0",
     "hash": "sha256-/9EaAbEeOjELRSMZaImS1O8FmUe8j4WuFUw1VOrPyAo="
   }
-]
+]
\ No newline at end of file
diff --git a/pkgs/by-name/te/technitium-dns-server-library/package.nix b/pkgs/by-name/te/technitium-dns-server-library/package.nix
index 185f1f4519c4..1a7f086d303c 100644
--- a/pkgs/by-name/te/technitium-dns-server-library/package.nix
+++ b/pkgs/by-name/te/technitium-dns-server-library/package.nix
@@ -7,17 +7,17 @@
 }:
 buildDotnetModule rec {
   pname = "technitium-dns-server-library";
-  version = "14.3.0";
+  version = "15.2.0";
 
   src = fetchFromGitHub {
     owner = "TechnitiumSoftware";
     repo = "TechnitiumLibrary";
     tag = "dns-server-v${version}";
-    hash = "sha256-Z8qGp9zMsmPNroO2cS7t7A4lwQ7pnGdzCAcCCEYoXrE=";
+    hash = "sha256-PC8j7JT4JiisGGfHORke63boLC4W1gLoaQQ3jPz5Qtc=";
     name = "${pname}-${version}";
   };
 
-  dotnet-sdk = dotnetCorePackages.sdk_9_0;
+  dotnet-sdk = dotnetCorePackages.sdk_10_0;
 
   nugetDeps = ./nuget-deps.json;
 
@@ -35,7 +35,10 @@ buildDotnetModule rec {
     homepage = "https://github.com/TechnitiumSoftware/DnsServer";
     license = lib.licenses.gpl3Only;
     mainProgram = "technitium-dns-server-library";
-    maintainers = with lib.maintainers; [ fabianrig ];
+    maintainers = with lib.maintainers; [
+      fabianrig
+      awildleon
+    ];
     platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/by-name/te/technitium-dns-server/nuget-deps.json b/pkgs/by-name/te/technitium-dns-server/nuget-deps.json
index 27256167cce8..3c5b4c6e4f0a 100644
--- a/pkgs/by-name/te/technitium-dns-server/nuget-deps.json
+++ b/pkgs/by-name/te/technitium-dns-server/nuget-deps.json
@@ -4,6 +4,41 @@
     "version": "2.6.2",
     "hash": "sha256-Yjk2+x/RcVeccGOQOQcRKCiYzyx1mlFnhS5auCII+Ms="
   },
+  {
+    "pname": "Microsoft.AspNetCore.Authentication.OpenIdConnect",
+    "version": "10.0.7",
+    "hash": "sha256-hr1QgB9miQO2rXj5heibTX/fa3Tj/Nci8G/pDcrq11c="
+  },
+  {
+    "pname": "Microsoft.IdentityModel.Abstractions",
+    "version": "8.0.1",
+    "hash": "sha256-zPWUKTCfGm4MWcYPU037NzezsFE1g8tEijjQkw5iooI="
+  },
+  {
+    "pname": "Microsoft.IdentityModel.JsonWebTokens",
+    "version": "8.0.1",
+    "hash": "sha256-Xv9MUnjb66U3xeR9drOcSX5n2DjOCIJZPMNSKjWHo9Y="
+  },
+  {
+    "pname": "Microsoft.IdentityModel.Logging",
+    "version": "8.0.1",
+    "hash": "sha256-FfwrH/2eLT521Kqw+RBIoVfzlTNyYMqlWP3z+T6Wy2Y="
+  },
+  {
+    "pname": "Microsoft.IdentityModel.Protocols",
+    "version": "8.0.1",
+    "hash": "sha256-v3DIpG6yfIToZBpHOjtQHRo2BhXGDoE70EVs6kBtrRg="
+  },
+  {
+    "pname": "Microsoft.IdentityModel.Protocols.OpenIdConnect",
+    "version": "8.0.1",
+    "hash": "sha256-ZHKaZxqESk+OU1SFTFGxvZ71zbdgWqv1L6ET9+fdXX0="
+  },
+  {
+    "pname": "Microsoft.IdentityModel.Tokens",
+    "version": "8.0.1",
+    "hash": "sha256-beVbbVQy874HlXkTKarPTT5/r7XR1NGHA/50ywWp7YA="
+  },
   {
     "pname": "Microsoft.Win32.SystemEvents",
     "version": "6.0.0",
@@ -11,12 +46,17 @@
   },
   {
     "pname": "QRCoder",
-    "version": "1.7.0",
-    "hash": "sha256-sssSQBTHf1cUWNQYFEEJ8PRLs486ciDsXtrwL+ozZIU="
+    "version": "1.8.0",
+    "hash": "sha256-UvOeFFxUZ/bddmDs6IamiYGDIfgxybE/CSpPyy5DMxI="
   },
   {
     "pname": "System.Drawing.Common",
     "version": "6.0.0",
     "hash": "sha256-/9EaAbEeOjELRSMZaImS1O8FmUe8j4WuFUw1VOrPyAo="
+  },
+  {
+    "pname": "System.IdentityModel.Tokens.Jwt",
+    "version": "8.0.1",
+    "hash": "sha256-hW4f9zWs0afxPbcMqCA/FAGvBZbBFSkugIOurswomHg="
   }
-]
+]
\ No newline at end of file
diff --git a/pkgs/by-name/te/technitium-dns-server/package.nix b/pkgs/by-name/te/technitium-dns-server/package.nix
index 4fabd1c7f8f3..a5375f487124 100644
--- a/pkgs/by-name/te/technitium-dns-server/package.nix
+++ b/pkgs/by-name/te/technitium-dns-server/package.nix
@@ -10,18 +10,18 @@
 }:
 buildDotnetModule rec {
   pname = "technitium-dns-server";
-  version = "14.3.0";
+  version = "15.2.0";
 
   src = fetchFromGitHub {
     owner = "TechnitiumSoftware";
     repo = "DnsServer";
     tag = "v${version}";
-    hash = "sha256-NUH1gn8kdtMBKC5+XEqqTGySNMCDFGF5yy6NbGeRvvY=";
+    hash = "sha256-464jhswTOJnQnxetl9hH5U3aDP0RXzJTicot9nWzpAo=";
     name = "${pname}-${version}";
   };
 
-  dotnet-sdk = dotnetCorePackages.sdk_9_0;
-  dotnet-runtime = dotnetCorePackages.aspnetcore_9_0;
+  dotnet-sdk = dotnetCorePackages.sdk_10_0;
+  dotnet-runtime = dotnetCorePackages.aspnetcore_10_0;
 
   nugetDeps = ./nuget-deps.json;
 
@@ -53,7 +53,10 @@ buildDotnetModule rec {
     homepage = "https://github.com/TechnitiumSoftware/DnsServer";
     license = lib.licenses.gpl3Only;
     mainProgram = "technitium-dns-server";
-    maintainers = with lib.maintainers; [ fabianrig ];
+    maintainers = with lib.maintainers; [
+      fabianrig
+      awildleon
+    ];
     platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/by-name/up/upsies/package.nix b/pkgs/by-name/up/upsies/package.nix
index 7fbb97301e17..82475d40c785 100644
--- a/pkgs/by-name/up/upsies/package.nix
+++ b/pkgs/by-name/up/upsies/package.nix
@@ -18,14 +18,14 @@ let
 in
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "upsies";
-  version = "2026.01.26";
+  version = "2026.05.14";
   pyproject = true;
 
   src = fetchFromCodeberg {
     owner = "plotski";
     repo = "upsies";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gsWIyyUkpdUQjwZJXcevMLG0T1fgJj7brbVHfcks31w=";
+    hash = "sha256-/3jR49Rn1itps4Zz8h2//8Sq2+skVgk2Ydm+qvAzAw4=";
   };
 
   patches = [
diff --git a/pkgs/by-name/va/vacuum-go/package.nix b/pkgs/by-name/va/vacuum-go/package.nix
index ee015b75a1ce..b3c4da17d7ba 100644
--- a/pkgs/by-name/va/vacuum-go/package.nix
+++ b/pkgs/by-name/va/vacuum-go/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "vacuum-go";
-  version = "0.26.4";
+  version = "0.26.5";
 
   src = fetchFromGitHub {
     owner = "daveshanley";
     repo = "vacuum";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-shJblJz5+DhVUju8L/KJ3rFixq3CpvV5o0fC9hx7ivk=";
+    hash = "sha256-Em+wmDt2kI4mfqS9u/Jq499tQiLh3w/CiZlrkixZjg4=";
   };
 
-  vendorHash = "sha256-kyKPWbDFPWmIJmn3Np8Geogen3+OxePcSulWBeJFrD4=";
+  vendorHash = "sha256-AWn/J/BAPIFKXpTdUej1uMBkwh3r5v8DpZHh4D7GRKg=";
 
   env.CGO_ENABLED = 0;
   ldflags = [
diff --git a/pkgs/by-name/yt/yt-dlp/package.nix b/pkgs/by-name/yt/yt-dlp/package.nix
index b2dbeba28665..9beb3ddae167 100644
--- a/pkgs/by-name/yt/yt-dlp/package.nix
+++ b/pkgs/by-name/yt/yt-dlp/package.nix
@@ -4,6 +4,9 @@
   python3Packages,
   atomicparsley,
   deno,
+  # Override jsRuntime with `nodejs`, `bun`, `quickjs`, or `quickjs-ng` if you want to use another default JS runtime.
+  # You still need to enable them in your yt-dlp config with `--js-runtimes [runtime]`.
+  jsRuntime ? deno,
   fetchFromGitHub,
   ffmpeg-headless,
   installShellFiles,
@@ -16,6 +19,12 @@
   withAlias ? false, # Provides bin/youtube-dl for backcompat
   withSecretStorage ? !stdenvNoCC.hostPlatform.isDarwin,
   nix-update-script,
+  # required for tests
+  yt-dlp,
+  nodejs,
+  bun,
+  quickjs,
+  quickjs-ng,
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -37,11 +46,11 @@ python3Packages.buildPythonApplication rec {
     substituteInPlace yt_dlp/version.py \
       --replace-fail "UPDATE_HINT = None" 'UPDATE_HINT = "Nixpkgs/NixOS likely already contain an updated version.\n       To get it run nix-channel --update or nix flake update in your config directory."'
     ${lib.optionalString javascriptSupport ''
-      # deno is required for full YouTube support (since 2025.11.12).
-      # This makes yt-dlp find deno even if it is used as a python dependency, i.e. in kodiPackages.sendtokodi.
-      # Crafted so people can replace deno with one of the other JS runtimes.
+      # A JavaScript runtime is required for full YouTube support (since 2025.11.12).
+      # This makes yt-dlp find `jsRuntime` even if it is used as a python dependency, i.e. in kodiPackages.sendtokodi.
+      # Crafted so people can replace the default deno with one of the other JS runtimes.
       substituteInPlace yt_dlp/utils/_jsruntime.py \
-        --replace-fail "path = _determine_runtime_path(self._path, '${deno.meta.mainProgram}')" "path = '${lib.getExe deno}'"
+        --replace-fail "path = _determine_runtime_path(self._path, '${jsRuntime.meta.mainProgram}')" "path = '${lib.getExe jsRuntime}'"
     ''}
   '';
 
@@ -136,6 +145,15 @@ python3Packages.buildPythonApplication rec {
 
   passthru = {
     updateScript = nix-update-script { };
+    # Try to build with each of the supported JS runtimes
+    tests = lib.genAttrs' [ nodejs bun quickjs quickjs-ng ] (
+      runtime:
+      lib.nameValuePair runtime.pname (
+        yt-dlp.override {
+          jsRuntime = runtime;
+        }
+      )
+    );
   };
 
   meta = {
diff --git a/pkgs/by-name/zi/zipline/package.nix b/pkgs/by-name/zi/zipline/package.nix
index 5707257e3e81..6a19b8a751f7 100644
--- a/pkgs/by-name/zi/zipline/package.nix
+++ b/pkgs/by-name/zi/zipline/package.nix
@@ -36,13 +36,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zipline";
-  version = "4.5.3";
+  version = "4.6.0";
 
   src = fetchFromGitHub {
     owner = "diced";
     repo = "zipline";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uZnN+kqtCGydrqnOVkhlNiCNSz4g2qLPiYTXpdmv/Mc=";
+    hash = "sha256-8Uay/+GRuVhu3MHg6gunHfWmKWBWDRy7zWAQkxKqh0k=";
     leaveDotGit = true;
     postFetch = ''
       git -C $out rev-parse --short HEAD > $out/.git_head
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm';
     fetcherVersion = 3;
-    hash = "sha256-QnKYtSBiTFnBmzVRJ8wZsKDzi99Y4039N9fsJmJkDYc=";
+    hash = "sha256-AaXlkn6Fz9EMlxIpRhI0GH73DuK00qbgr19nlmd4ZOo=";
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/cometx/default.nix b/pkgs/development/python-modules/cometx/default.nix
index dcb8d0a3dfd9..29fde5dac071 100644
--- a/pkgs/development/python-modules/cometx/default.nix
+++ b/pkgs/development/python-modules/cometx/default.nix
@@ -13,6 +13,9 @@
   urllib3,
   zipfile2,
   tqdm,
+  reportlab,
+  streamlit,
+  boto3,
 }:
 
 buildPythonPackage rec {
@@ -40,6 +43,9 @@ buildPythonPackage rec {
     urllib3
     zipfile2
     tqdm
+    reportlab
+    streamlit
+    boto3
   ];
 
   # WARNING: Running the tests will create experiments, models, assets, etc.
diff --git a/pkgs/development/python-modules/dask-ml/default.nix b/pkgs/development/python-modules/dask-ml/default.nix
index d78a16803c21..4153970a052e 100644
--- a/pkgs/development/python-modules/dask-ml/default.nix
+++ b/pkgs/development/python-modules/dask-ml/default.nix
@@ -36,6 +36,12 @@ buildPythonPackage rec {
     hash = "sha256-DHxx0LFuJmGWYuG/WGHj+a5XHAEekBmlHUUb90rl2IY=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail 'addopts = "-rsx -v --durations=10 --color=yes"' \
+                     'addopts = ["-rsx", "-v", "--durations=10", "--color=yes"]'
+  '';
+
   build-system = [
     hatch-vcs
     hatchling
@@ -74,6 +80,10 @@ buildPythonPackage rec {
     "tests/model_selection/test_incremental.py"
     "tests/model_selection/test_incremental_warns.py"
     "tests/model_selection/test_successive_halving.py"
+
+    # MockClassifier predates sklearn 1.6 __sklearn_tags__
+    "tests/model_selection/dask_searchcv/test_model_selection.py"
+    "tests/model_selection/dask_searchcv/test_model_selection_sklearn.py"
   ];
 
   disabledTests = [
@@ -89,6 +99,28 @@ buildPythonPackage rec {
     "test_lr_score"
     "test_ok"
     "test_scoring_string"
+
+    # sklearn 1.7+: PCA / IncrementalPCA missing power_iteration_normalizer
+    "test_pca_randomized_solver"
+    "test_pca_check_projection"
+    "test_pca_inverse"
+    "test_pca_score"
+    "test_pca_score2"
+    "test_randomized_pca_check_projection"
+    "test_randomized_pca_inverse"
+    "test_pca_int_dtype_upcast_to_double"
+    "test_incremental_pca"
+    "test_incremental_pca_against_pca_iris"
+    "test_incremental_pca_against_pca_random_data"
+    "test_singular_values"
+    "test_whitening"
+
+    # sklearn 1.8 API drift in LogisticRegression/ParallelPostFit
+    "test_predict"
+    "test_multiclass"
+
+    # XPASS becomes failure under xfail_strict (now honored on pytest 9)
+    "test_soft_voting_frame"
   ];
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/haystack-ai/default.nix b/pkgs/development/python-modules/haystack-ai/default.nix
index 5a8249999456..fd9700dd0579 100644
--- a/pkgs/development/python-modules/haystack-ai/default.nix
+++ b/pkgs/development/python-modules/haystack-ai/default.nix
@@ -3,6 +3,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   hatchling,
+  writableTmpDirAsHomeHook,
   boilerpy3,
   events,
   httpx,
@@ -103,6 +104,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [
     hatchling
+    writableTmpDirAsHomeHook
   ];
 
   propagatedBuildInputs = [
@@ -131,8 +133,6 @@ buildPythonPackage rec {
     transformers
   ];
 
-  env.HOME = "$(mktemp -d)";
-
   optional-dependencies = {
     # all = [
     #   farm-haystack
diff --git a/pkgs/development/python-modules/molecule/default.nix b/pkgs/development/python-modules/molecule/default.nix
index 14c7a725c332..762c29351013 100644
--- a/pkgs/development/python-modules/molecule/default.nix
+++ b/pkgs/development/python-modules/molecule/default.nix
@@ -16,6 +16,7 @@
   testers,
   wcmatch,
   withPlugins ? true,
+  writableTmpDirAsHomeHook,
   molecule-plugins,
   yamllint,
 }:
@@ -61,7 +62,7 @@ buildPythonPackage rec {
     }).overrideAttrs
       (old: {
         # workaround the error: Permission denied: '/homeless-shelter'
-        HOME = "$(mktemp -d)";
+        nativeBuildInputs = old.nativeBuildInputs ++ [ writableTmpDirAsHomeHook ];
       });
 
   meta = {
diff --git a/pkgs/development/python-modules/netbox-attachments/default.nix b/pkgs/development/python-modules/netbox-attachments/default.nix
index 660a0d1fb011..9ee7b3642de4 100644
--- a/pkgs/development/python-modules/netbox-attachments/default.nix
+++ b/pkgs/development/python-modules/netbox-attachments/default.nix
@@ -10,7 +10,7 @@
 }:
 buildPythonPackage (finalAttrs: {
   pname = "netbox-attachments";
-  version = "11.1.0";
+  version = "11.2.1";
   pyproject = true;
 
   disabled = python.pythonVersion != netbox.python.pythonVersion;
@@ -19,7 +19,7 @@ buildPythonPackage (finalAttrs: {
     owner = "Kani999";
     repo = "netbox-attachments";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xe5p2PaLI+PBkQohmueth32BOQ7u9ZOCllq/WByAu6c=";
+    hash = "sha256-vljF55gYykxHnitYoag9G8PzAxjRe4YpPmu8gGMNMd8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/tools/build-managers/sbt/default.nix b/pkgs/development/tools/build-managers/sbt/default.nix
index 18e241d88aec..ce9f9554e35e 100644
--- a/pkgs/development/tools/build-managers/sbt/default.nix
+++ b/pkgs/development/tools/build-managers/sbt/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sbt";
-  version = "1.12.4";
+  version = "1.12.11";
 
   src = fetchurl {
     url = "https://github.com/sbt/sbt/releases/download/v${finalAttrs.version}/sbt-${finalAttrs.version}.tgz";
-    hash = "sha256-OgLUzZhn/OJZgvmxaMJF/05HjddpQV21QuW+65+fuHo=";
+    hash = "sha256-X5cqedKlv48pFBp0w15oa7CGCmtuxneviS+Uz5sSRkU=";
   };
 
   postPatch = ''
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 934f23df7bce..340f4a0a7089 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6746,8 +6746,12 @@ with pkgs;
     )
       haskellPackages.matterhorn;
 
-  mbedtls = callPackage ../development/libraries/mbedtls/3.nix { };
-  mbedtls_4 = callPackage ../development/libraries/mbedtls/4.nix { };
+  inherit
+    ({
+      mbedtls_4 = callPackage ../by-name/mb/mbedtls/4.nix { };
+    })
+    mbedtls_4
+    ;
 
   simple-dftd3 = callPackage ../development/libraries/science/chemistry/simple-dftd3 { };