diff --git a/nixos/modules/services/networking/cjdns.nix b/nixos/modules/services/networking/cjdns.nix
index 1b9f53c9b28a..43ea76d5d710 100644
--- a/nixos/modules/services/networking/cjdns.nix
+++ b/nixos/modules/services/networking/cjdns.nix
@@ -49,7 +49,7 @@ let
         k: v:
         lib.optionalString (
           v.hostname != ""
-        ) "echo $(${pkgs.cjdns}/bin/publictoip6 ${v.publicKey}) ${v.hostname}"
+        ) "echo $(${pkgs.cjdns}/bin/cjdnstool util key2ip6 ${v.publicKey}) ${v.hostname}"
       ) (cfg.ETHInterface.connectTo // cfg.UDPInterface.connectTo)
     )}
   '';
@@ -268,7 +268,7 @@ in
 
         if [ -z "$CJDNS_PRIVATE_KEY" ]; then
             shopt -s lastpipe
-            ${pkg}/bin/makekeys | { read private ipv6 public; }
+            ${pkg}/bin/cjdnstool util keygen | { read private ipv6 public; }
 
             install -m 600 <(echo "CJDNS_PRIVATE_KEY=$private") /etc/cjdns.keys
             install -m 444 <(echo -e "CJDNS_IPV6=$ipv6\nCJDNS_PUBLIC_KEY=$public") /etc/cjdns.public
diff --git a/nixos/tests/cjdns.nix b/nixos/tests/cjdns.nix
index 52762f853e20..4bff3b15035f 100644
--- a/nixos/tests/cjdns.nix
+++ b/nixos/tests/cjdns.nix
@@ -105,7 +105,7 @@ in
 
     def cjdns_ip(machine):
         res = machine.succeed("ip -o -6 addr show dev tun0")
-        ip = re.split("\s+|/", res)[3]
+        ip = re.split("\\s+|/", res)[3]
         machine.log("has ip {}".format(ip))
         return ip
 
@@ -116,14 +116,14 @@ in
 
     # ping a few times each to let the routing table establish itself
 
-    alice.succeed("ping -c 4 {}".format(carol_ip6))
-    bob.succeed("ping -c 4 {}".format(carol_ip6))
+    alice.wait_until_succeeds("ping -c 4 {}".format(carol_ip6))
+    bob.wait_until_succeeds("ping -c 4 {}".format(carol_ip6))
 
-    carol.succeed("ping -c 4 {}".format(alice_ip6))
-    carol.succeed("ping -c 4 {}".format(bob_ip6))
+    carol.wait_until_succeeds("ping -c 4 {}".format(alice_ip6))
+    carol.wait_until_succeeds("ping -c 4 {}".format(bob_ip6))
 
-    alice.succeed("ping -c 4 {}".format(bob_ip6))
-    bob.succeed("ping -c 4 {}".format(alice_ip6))
+    alice.wait_until_succeeds("ping -c 4 {}".format(bob_ip6))
+    bob.wait_until_succeeds("ping -c 4 {}".format(alice_ip6))
 
     alice.wait_for_unit("httpd.service")
 
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index e287dff0031a..423426bc2f57 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -24,8 +24,8 @@ let
     sha256Hash = "sha256-qA7iu4nK+29aHKsUmyQWuwV0SFnv5cYQvFq5CAMKyKw=";
   };
   latestVersion = {
-    version = "2025.1.3.2"; # "Android Studio Narwhal Feature Drop | 2025.1.3 Canary 2"
-    sha256Hash = "sha256-6ZjjIzZ5y6VzbbKSIeDlXE+77fAksy532D+LlqMCmo4=";
+    version = "2025.1.3.3"; # "Android Studio Narwhal Feature Drop | 2025.1.3 Canary 3"
+    sha256Hash = "sha256-0BdbAJMQi9qgss1IJTMxjQpOjynLFuiY0Vlw5VYCY+c=";
   };
 in
 {
diff --git a/pkgs/by-name/ai/airwindows/package.nix b/pkgs/by-name/ai/airwindows/package.nix
index 87bbb32856cf..f0c14298cdfa 100644
--- a/pkgs/by-name/ai/airwindows/package.nix
+++ b/pkgs/by-name/ai/airwindows/package.nix
@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation {
   pname = "airwindows";
-  version = "0-unstable-2025-07-19";
+  version = "0-unstable-2025-07-27";
 
   src = fetchFromGitHub {
     owner = "airwindows";
     repo = "airwindows";
-    rev = "6761d77156cc93073ac578613f5c245676189948";
-    hash = "sha256-67+docPO0alsPEp3BApW9rOlXAQOa0wHdvZ5gykpNYo=";
+    rev = "52565448b14ea481682b4c67cd6f4732fb6bc644";
+    hash = "sha256-VJhxe7hKjECUsyNfX32yGdEX4hkGD3CaO+QnNnXGBhc=";
   };
 
   # we patch helpers because honestly im spooked out by where those variables
diff --git a/pkgs/by-name/ca/cargo-3ds/package.nix b/pkgs/by-name/ca/cargo-3ds/package.nix
index 9aa6fc65432c..801e5171d018 100644
--- a/pkgs/by-name/ca/cargo-3ds/package.nix
+++ b/pkgs/by-name/ca/cargo-3ds/package.nix
@@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "cargo-3ds";
-  version = "0.1.4";
+  version = "0.1.5";
 
   src = fetchFromGitHub {
     owner = "rust3ds";
     repo = "cargo-3ds";
     tag = "v${version}";
-    hash = "sha256-APi1K5LtdHFI5kjPfZUOFcsZ/xoQixjKq5xZxwlW9CE=";
+    hash = "sha256-UMeIxYxQ+0VGyDJTu78n9O5iXw3ZBg8mHqmnUtbnXo4=";
   };
 
-  cargoHash = "sha256-2JpBm0ahgiL4KSM4J/nQRbdo3MDZgZj6EDg7Jr5ZanA=";
+  cargoHash = "sha256-ZH4JGBoXf6eTD35QPQBTIUYIlSyMOtWW2tWF5MkjqFk=";
 
   # Integration tests do not run in Nix build environment due to needing to
   # create and build Cargo workspaces.
diff --git a/pkgs/by-name/ca/cargo-public-api/package.nix b/pkgs/by-name/ca/cargo-public-api/package.nix
index 47ce0d270a10..499ac2a562ec 100644
--- a/pkgs/by-name/ca/cargo-public-api/package.nix
+++ b/pkgs/by-name/ca/cargo-public-api/package.nix
@@ -9,14 +9,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-public-api";
-  version = "0.49.0";
+  version = "0.50.1";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-OUWTRnV1cH+a0LtYau5v4kt+1Br8Yn8RPMIPlGNcvHc=";
+    hash = "sha256-npSZT8ivdG1e+8mcRKlFHgjjwgLPOOGRqLHsPcu4vu0=";
   };
 
-  cargoHash = "sha256-UPtD5udR/avho3Sw3dyRjNGS5UmdwWWJJHkdSY92g8s=";
+  cargoHash = "sha256-VHZsUWyUEGMVOJkAuIRGVmej4KdAtAiTjagAvv+k/Os=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/cd/cdncheck/package.nix b/pkgs/by-name/cd/cdncheck/package.nix
index 3440b4d40554..55989c4848a0 100644
--- a/pkgs/by-name/cd/cdncheck/package.nix
+++ b/pkgs/by-name/cd/cdncheck/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "cdncheck";
-  version = "1.1.29";
+  version = "1.1.30";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "cdncheck";
     tag = "v${version}";
-    hash = "sha256-+R6IRMdkLVJ6rtkCQUMDc5scNWlv0rMa0urHhfiEwro=";
+    hash = "sha256-DA68sGa1CbWfNjmRjzh+/NpMPUIxe8HCj2QjzFjDXz4=";
   };
 
   vendorHash = "sha256-/1REkZ5+sz/H4T4lXhloz7fu5cLv1GoaD3dlttN+Qd4=";
diff --git a/pkgs/by-name/cj/cjdns-tools/package.nix b/pkgs/by-name/cj/cjdns-tools/package.nix
index 9e68412928e6..43c2fb28cafb 100644
--- a/pkgs/by-name/cj/cjdns-tools/package.nix
+++ b/pkgs/by-name/cj/cjdns-tools/package.nix
@@ -37,12 +37,12 @@ stdenv.mkDerivation {
     cp -r node_modules $out/node_modules
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/cjdelisle/cjdns";
     description = "Tools for cjdns managment";
-    license = licenses.gpl3Plus;
+    license = lib.licenses.gpl3Plus;
     maintainers = [ ];
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
     mainProgram = "cjdns-tools";
   };
 }
diff --git a/pkgs/by-name/cj/cjdns/package.nix b/pkgs/by-name/cj/cjdns/package.nix
index e095b3f3b35f..34199ed5b181 100644
--- a/pkgs/by-name/cj/cjdns/package.nix
+++ b/pkgs/by-name/cj/cjdns/package.nix
@@ -2,11 +2,10 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   rustPlatform,
   nodejs,
   which,
-  python3,
-  libuv,
   util-linux,
   nixosTests,
   libsodium,
@@ -16,26 +15,34 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cjdns";
-  version = "21.4";
+  version = "22.1";
 
   src = fetchFromGitHub {
     owner = "cjdelisle";
     repo = "cjdns";
-    rev = "cjdns-v${version}";
-    sha256 = "sha256-vI3uHZwmbFqxGasKqgCl0PLEEO8RNEhwkn5ZA8K7bxU=";
+    tag = "cjdns-v${version}";
+    hash = "sha256-0imQrkcvIA+2Eq/zlC65USMR7T3OUKwQxrB1KtVexyU=";
   };
 
   patches = [
     (replaceVars ./system-libsodium.patch {
       libsodium_include_dir = "${libsodium.dev}/include";
     })
+    # Remove mkpasswd since it is failing the build
+    (fetchpatch {
+      url = "https://github.com/cjdelisle/cjdns/commit/6391dba3f5fdab45df4b4b6b71dbe9620286ce32.patch";
+      hash = "sha256-XVA4tdTVMLrV6zuGoBCkOgQq6NXh0x7u8HgmaxFeoRI=";
+    })
+    (fetchpatch {
+      url = "https://github.com/cjdelisle/cjdns/commit/436d9a9784bae85734992c2561c778fbd2f5ac32.patch";
+      hash = "sha256-THcYNGVbMx/xf3/5UIxEhz3OlODE0qiYgDBOlHunhj8=";
+    })
   ];
 
-  cargoHash = "sha256-LJEKjhyAsK6b7mKObX8tNJdKt53iagMD/YLzoY5GVPw=";
+  cargoHash = "sha256-f96y6ZW0HxC+73ts5re8GIo2aigQgK3gXyF7fMrcJ0o=";
 
   nativeBuildInputs = [
     which
-    python3
     nodejs
     pkg-config
   ]
@@ -43,10 +50,7 @@ rustPlatform.buildRustPackage rec {
     # for flock
     lib.optional stdenv.hostPlatform.isLinux util-linux;
 
-  buildInputs = [
-    libuv
-    libsodium
-  ];
+  buildInputs = [ libsodium ];
 
   env.SODIUM_USE_PKG_CONFIG = 1;
   env.NIX_CFLAGS_COMPILE = toString (
@@ -61,14 +65,26 @@ rustPlatform.buildRustPackage rec {
     ]
   );
 
+  cargoTestFlags = [
+    # don't run doctests since they fail with "cannot find type `Ctx` in this scope"
+    "--lib"
+    "--bins"
+    "--tests"
+  ];
+
+  checkFlags = [
+    # Tests don't seem to work - "called `Result::unwrap()` on an `Err` value: DecryptErr: NO_SESSION"
+    "--skip=crypto::crypto_auth::tests::test_wireguard_iface_encrypt_decrypt"
+    "--skip=crypto::crypto_auth::tests::test_wireguard_iface_encrypt_decrypt_with_auth"
+  ];
+
   passthru.tests.basic = nixosTests.cjdns;
 
-  meta = with lib; {
-    broken = true; # outdated, incompatible with supported python versions
+  meta = {
     homepage = "https://github.com/cjdelisle/cjdns";
     description = "Encrypted networking for regular people";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ ehmry ];
-    platforms = platforms.linux;
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ ehmry ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
 }
diff --git a/pkgs/by-name/de/dep-scan/package.nix b/pkgs/by-name/de/dep-scan/package.nix
index 10bcae2eea10..58fa53c24581 100644
--- a/pkgs/by-name/de/dep-scan/package.nix
+++ b/pkgs/by-name/de/dep-scan/package.nix
@@ -1,41 +1,34 @@
 {
   lib,
   fetchFromGitHub,
-  python3,
+  python3Packages,
+  writableTmpDirAsHomeHook,
+  makeWrapper,
+  cdxgen,
 }:
 
-let
-  appthreat-vulnerability-db = (
-    python3.pkgs.appthreat-vulnerability-db.overrideAttrs (oldAttrs: rec {
-      version = "5.8.1";
-      src = oldAttrs.src.override {
-        tag = "v${version}";
-        hash = "sha256-/Yo0yyDp2vd9KJhy3LGRml55eqTiaHSSuSoe2h2bSw0=";
-      };
-    })
-  );
-
-in
-python3.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "dep-scan";
-  version = "5.5.0";
+  version = "6.0.0b3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "owasp-dep-scan";
     repo = "dep-scan";
     tag = "v${version}";
-    hash = "sha256-lgqS8GY5JuHL3strNcb0B3mGieFkQTzGuRyV4dBp5e4=";
+    hash = "sha256-GdrFsECcBZ2J47ojM33flqOtrY3avchGpsZk6pt8Aks=";
   };
 
-  pythonRelaxDeps = [ "oras" ];
+  build-system = with python3Packages; [ setuptools ];
 
-  build-system = with python3.pkgs; [ setuptools ];
-
-  dependencies = with python3.pkgs; [
+  dependencies = with python3Packages; [
     appthreat-vulnerability-db
+    custom-json-diff
     cvss
     defusedxml
+    ds-analysis-lib
+    ds-reporting-lib
+    ds-xbom-lib
     jinja2
     oras
     packageurl-python
@@ -47,29 +40,41 @@ python3.pkgs.buildPythonApplication rec {
     toml
   ];
 
-  nativeCheckInputs = with python3.pkgs; [
+  nativeCheckInputs = with python3Packages; [
     httpretty
     pytest-cov-stub
     pytestCheckHook
+    writableTmpDirAsHomeHook
   ];
 
   pythonImportsCheck = [ "depscan" ];
 
-  preCheck = ''
-    export HOME=$(mktemp -d)
-  '';
-
   disabledTests = [
     # Test is not present
     "test_query_metadata2"
   ];
 
+  # depscan --src shiftleft/scan-slim -o containertests -t docker
+  #
+  # WARNING [2025-07-28 20:17:35,654] cdxgen command not found. Please install using npm install @cyclonedx/cdxgen or set PATH variable
+  # WARNING [2025-07-28 20:17:35,654] /nix/store/56bxjw4rgdqa82f61w70z92qq6b14ass-dep-scan-5.5.0/lib/python3.13/site-packages/depscan/lib/local_bin/cdxgen command not found. Please install using npm install @cyclonedx/cdxgen or set PATH variable
+  # INFO [2025-07-28 20:17:35,654] Generating Software Bill-of-Materials for container image shiftleft/scan-slim. This might take a few mins ...
+  # WARNING [2025-07-28 20:17:35,654] Unable to locate cdxgen command.
+  makeWrapperArgs = [
+    "--prefix PATH : ${
+      lib.makeBinPath [
+        cdxgen
+      ]
+    }"
+  ];
+
   meta = {
     description = "Security and risk audit tool based on known vulnerabilities, advisories, and license limitations for project dependencies";
     homepage = "https://github.com/owasp-dep-scan/dep-scan";
     changelog = "https://github.com/owasp-dep-scan/dep-scan/releases/tag/v${version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
+    teams = [ lib.teams.ngi ];
     mainProgram = "dep-scan";
   };
 }
diff --git a/pkgs/by-name/dn/dnsmonster/package.nix b/pkgs/by-name/dn/dnsmonster/package.nix
index 64c40c4d9f54..0b6795440893 100644
--- a/pkgs/by-name/dn/dnsmonster/package.nix
+++ b/pkgs/by-name/dn/dnsmonster/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "dnsmonster";
-  version = "1.0.0";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "mosajjal";
     repo = "dnsmonster";
     tag = "v${version}";
-    hash = "sha256-0WHTrqnc3vYQro+nSsQipAPVymR8L4uOwtd9GJHxhVM=";
+    hash = "sha256-sg+88WbjlfcPgWQ9RnmLr6/VWwXEjsctfWt4TGx1oNc=";
   };
 
-  vendorHash = "sha256-QCG/rhs4Y3lLDVU15cBNUZqbKc4faNAqKMhMOFwK2SY=";
+  vendorHash = "sha256-PIiSpxfZmhxWkHUnoDYKppI7/gzGm0RKh7u9HK4zrEU=";
 
   buildInputs = [ libpcap ];
 
@@ -30,7 +30,7 @@ buildGoModule rec {
   meta = {
     description = "Passive DNS Capture and Monitoring Toolkit";
     homepage = "https://github.com/mosajjal/dnsmonster";
-    changelog = "https://github.com/mosajjal/dnsmonster/releases/tag/v${version}";
+    changelog = "https://github.com/mosajjal/dnsmonster/releases/tag/${src.tag}";
     license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [ fab ];
     broken = stdenv.hostPlatform.isDarwin;
diff --git a/pkgs/by-name/gc/gcc-arm-embedded-14/info-fix.patch b/pkgs/by-name/gc/gcc-arm-embedded-14/info-fix.patch
deleted file mode 100644
index 5304fcc73002..000000000000
--- a/pkgs/by-name/gc/gcc-arm-embedded-14/info-fix.patch
+++ /dev/null
@@ -1,12 +0,0 @@
---- a/share/info/porting.info
-+++ b/share/info/porting.info
-@@ -16,9 +16,7 @@ a permission notice identical to this one.
- manual into another language, under the above conditions for modified
- versions.
- START-INFO-DIR-ENTRY
--START-INFO-DIR-ENTRY
- * Embed with GNU: (porting-).         Embed with GNU
--END-INFO-DIR-ENTRY
- END-INFO-DIR-ENTRY
- 
-    Copyright (C) 1993, 1994, 1995 Cygnus Support
diff --git a/pkgs/by-name/gc/gcc-arm-embedded-14/package.nix b/pkgs/by-name/gc/gcc-arm-embedded-14/package.nix
index 253705829c2e..2174e828a598 100644
--- a/pkgs/by-name/gc/gcc-arm-embedded-14/package.nix
+++ b/pkgs/by-name/gc/gcc-arm-embedded-14/package.nix
@@ -6,19 +6,16 @@
   libxcrypt-legacy,
   xz,
   zstd,
-  makeBinaryWrapper,
-  darwin,
 }:
 
 stdenv.mkDerivation rec {
   pname = "gcc-arm-embedded";
-  version = "14.2.rel1";
+  version = "14.3.rel1";
 
   platform =
     {
       aarch64-darwin = "darwin-arm64";
       aarch64-linux = "aarch64";
-      x86_64-darwin = "darwin-x86_64";
       x86_64-linux = "x86_64";
     }
     .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
@@ -28,25 +25,13 @@ stdenv.mkDerivation rec {
     # hashes obtained from location ${url}.sha256asc
     sha256 =
       {
-        aarch64-darwin = "c7c78ffab9bebfce91d99d3c24da6bf4b81c01e16cf551eb2ff9f25b9e0a3818";
-        aarch64-linux = "87330bab085dd8749d4ed0ad633674b9dc48b237b61069e3b481abd364d0a684";
-        x86_64-darwin = "2d9e717dd4f7751d18936ae1365d25916534105ebcb7583039eff1092b824505";
-        x86_64-linux = "62a63b981fe391a9cbad7ef51b17e49aeaa3e7b0d029b36ca1e9c3b2a9b78823";
+        aarch64-darwin = "30f4d08b219190a37cded6aa796f4549504902c53cfc3c7e044a8490b6eba1f7";
+        aarch64-linux = "2d465847eb1d05f876270494f51034de9ace9abe87a4222d079f3360240184d3";
+        x86_64-linux = "8f6903f8ceb084d9227b9ef991490413014d991874a1e34074443c2a72b14dbd";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
 
-  nativeBuildInputs = lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
-    makeBinaryWrapper
-    darwin.sigtool
-  ];
-
-  patches = [
-    # fix double entry in share/info/porting.info
-    # https://github.com/NixOS/nixpkgs/issues/363902
-    ./info-fix.patch
-  ];
-
   dontConfigure = true;
   dontBuild = true;
   dontPatchELF = true;
@@ -59,34 +44,22 @@ stdenv.mkDerivation rec {
     rm $out/bin/{arm-none-eabi-gdb-py,arm-none-eabi-gdb-add-index-py} || :
   '';
 
-  preFixup =
-    lib.optionalString stdenv.hostPlatform.isLinux ''
-      find $out -type f | while read f; do
-        patchelf "$f" > /dev/null 2>&1 || continue
-        patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f" || true
-        patchelf --set-rpath ${
-          lib.makeLibraryPath [
-            "$out"
-            stdenv.cc.cc
-            ncurses6
-            libxcrypt-legacy
-            xz
-            zstd
-          ]
-        } "$f" || true
-      done
-    ''
-    + lib.optionalString (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) ''
-      find "$out" -executable -type f | while read executable; do
-        ( \
-          install_name_tool \
-            -change "/usr/local/opt/zstd/lib/libzstd.1.dylib" "${lib.getLib zstd}/lib/libzstd.1.dylib" \
-            -change "/usr/local/opt/xz/lib/liblzma.5.dylib" "${lib.getLib xz}/lib/liblzma.5.dylib" \
-            "$executable" \
-          && codesign -f -s - "$executable" \
-        ) || true
-      done
-    '';
+  preFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
+    find $out -type f | while read f; do
+      patchelf "$f" > /dev/null 2>&1 || continue
+      patchelf --set-interpreter $(cat ${stdenv.cc}/nix-support/dynamic-linker) "$f" || true
+      patchelf --set-rpath ${
+        lib.makeLibraryPath [
+          "$out"
+          stdenv.cc.cc
+          ncurses6
+          libxcrypt-legacy
+          xz
+          zstd
+        ]
+      } "$f" || true
+    done
+  '';
 
   meta = with lib; {
     description = "Pre-built GNU toolchain from ARM Cortex-M & Cortex-R processors";
@@ -106,7 +79,6 @@ stdenv.mkDerivation rec {
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
-      "x86_64-darwin"
       "aarch64-darwin"
     ];
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
diff --git a/pkgs/by-name/go/gost/package.nix b/pkgs/by-name/go/gost/package.nix
index 8fba34d55f27..d3d5cd33fed8 100644
--- a/pkgs/by-name/go/gost/package.nix
+++ b/pkgs/by-name/go/gost/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gost";
-  version = "3.1.0";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "go-gost";
     repo = "gost";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4ZfGxhXespaZNspvbwZ/Yz2ncqtY3wxJPQsqVILayao=";
+    hash = "sha256-pdDCBknAXHIFD7vNkinsoq7Uec6g3VJsNNoE1lvKkW4=";
   };
 
-  vendorHash = "sha256-lWuLvYF9Sl+k8VnsujvRmj7xb9zst+g//Gkg7VwtWkg=";
+  vendorHash = "sha256-6oRw2tCiQFExWhF1l+vvbL1uoJNx+rzPz+LX2J5r4no=";
 
   # Based on ldflags in upstream's .goreleaser.yaml
   ldflags = [
diff --git a/pkgs/by-name/go/gotty/package.nix b/pkgs/by-name/go/gotty/package.nix
index 38f040f0bb52..80e9238a4f52 100644
--- a/pkgs/by-name/go/gotty/package.nix
+++ b/pkgs/by-name/go/gotty/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "gotty";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "sorenisanerd";
     repo = "gotty";
     rev = "v${version}";
-    sha256 = "sha256-VSu0ASnLmRzOGOEKqb/zB43+HxEwMpKLpbdbWY5QrEk=";
+    sha256 = "sha256-6TFfBS/uZ5I/h1S22O5x8VaCBfjDtXDfk0stMZad7B4=";
   };
 
-  vendorHash = "sha256-XtqIiREtKg0LRnwOg8UyYrWUWJNQbCJUw+nVvaiN3GQ=";
+  vendorHash = "sha256-OcBwkA28k54rSZP66L+wdkiWPvUv7Z9pTlEK7/LXjBM=";
 
   # upstream did not update the tests, so they are broken now
   # https://github.com/sorenisanerd/gotty/issues/13
diff --git a/pkgs/by-name/ha/hashcat/package.nix b/pkgs/by-name/ha/hashcat/package.nix
index 24b3b76bb837..ddc90d75be08 100644
--- a/pkgs/by-name/ha/hashcat/package.nix
+++ b/pkgs/by-name/ha/hashcat/package.nix
@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation rec {
   pname = "hashcat";
-  version = "6.2.6";
+  version = "7.0.0";
 
   src = fetchurl {
     url = "https://hashcat.net/files/hashcat-${version}.tar.gz";
-    sha256 = "sha256-sl4Qd7zzSQjMjxjBppouyYsEeyy88PURRNzzuh4Leyo=";
+    sha256 = "sha256-hCtx0NNLAgAFiCR6rp/smg/BMnfyzTpqSSWw8Jszv3U=";
   };
 
   postPatch = ''
@@ -61,6 +61,9 @@ stdenv.mkDerivation rec {
   ]
   ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform == stdenv.buildPlatform) [
     "IS_APPLE_SILICON='${if stdenv.hostPlatform.isAarch64 then "1" else "0"}'"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isAarch64 [
+    "IS_AARCH64=1"
   ];
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/ip/ipxe/package.nix b/pkgs/by-name/ip/ipxe/package.nix
index a4a8347d6bd7..0e17b4112041 100644
--- a/pkgs/by-name/ip/ipxe/package.nix
+++ b/pkgs/by-name/ip/ipxe/package.nix
@@ -48,7 +48,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ipxe";
-  version = "1.21.1-unstable-2025-07-24";
+  version = "1.21.1-unstable-2025-07-30";
 
   nativeBuildInputs = [
     mtools
@@ -66,8 +66,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "ipxe";
     repo = "ipxe";
-    rev = "e3a6e9230c4e513e6a529427d71a714849b6f788";
-    hash = "sha256-/09YxHQGbSdiLwhxOIWh2lPPabTL9QQsOUYpo8zp2f0=";
+    rev = "f7a1e9ef8e1dc22ebded786507b872a45e3fb05d";
+    hash = "sha256-dNnZH6ENxx3K2lAIE0B8mLjOo05D/TBguarrGrxXozc=";
   };
 
   # Calling syslinux on a FAT image isn't going to work on Aarch64.
diff --git a/pkgs/by-name/li/libation/deps.json b/pkgs/by-name/li/libation/deps.json
index ed15ed24cf79..427bb5cf9aba 100644
--- a/pkgs/by-name/li/libation/deps.json
+++ b/pkgs/by-name/li/libation/deps.json
@@ -1,28 +1,28 @@
 [
   {
     "pname": "AAXClean",
-    "version": "2.0.1.1",
-    "hash": "sha256-3xjH9bEapK/LXsJnnAbIHJyIv2BaWyS61gOrsLcv/Xo="
+    "version": "2.0.1.3",
+    "hash": "sha256-a7H1BVqHU25wxkrLJm0ZkWtcxXTHX9s3lDuWVQv29Ak="
   },
   {
     "pname": "AAXClean.Codecs",
-    "version": "2.0.1.1",
-    "hash": "sha256-4tN56SIHiAkvGCTffUoIGRrmfV2pzetITIMbtmj2cXw="
+    "version": "2.0.1.3",
+    "hash": "sha256-3+kSgIMB0b6K8YiJE1olvyyiGcjPiW3eUntDuVn9q90="
   },
   {
     "pname": "AudibleApi",
-    "version": "9.4.0.1",
-    "hash": "sha256-M8+6dTpNXkY/wIXlyVAqzjXFy9HpR32fDbvc2kCTJwU="
+    "version": "9.4.1.1",
+    "hash": "sha256-l0i0JB4ghxLbCAWd6ni7coVpYiGvLrKIMUNhaiA0aWU="
   },
   {
     "pname": "Avalonia",
-    "version": "11.2.8",
-    "hash": "sha256-GbZIXopQh6VSRLAg47TRWHvMYEl5/c7rtvNmFnlDhAo="
+    "version": "11.3.2",
+    "hash": "sha256-eDptsmrO7QxIvHm5kCs9ZE/N1tAuIBvaJMKiAcsu9yk="
   },
   {
     "pname": "Avalonia.Angle.Windows.Natives",
-    "version": "2.1.22045.20230930",
-    "hash": "sha256-RxPcWUT3b/+R3Tu5E5ftpr5ppCLZrhm+OTsi0SwW3pc="
+    "version": "2.1.25547.20250602",
+    "hash": "sha256-LE/lENAHptmz6t3T/AoJwnhpda+xs7PqriNGzdcfg8M="
   },
   {
     "pname": "Avalonia.BuildServices",
@@ -31,78 +31,73 @@
   },
   {
     "pname": "Avalonia.Controls.ColorPicker",
-    "version": "11.2.8",
-    "hash": "sha256-jcCErs44R9tl6zjMkRxdwU9lBxv13MOZMi9Hcm7Tals="
+    "version": "11.3.2",
+    "hash": "sha256-Lr943SkpYMZz3+TPA7vc/mtbQH0r/eLewZFNGNf3i2M="
   },
   {
     "pname": "Avalonia.Controls.DataGrid",
-    "version": "11.2.8",
-    "hash": "sha256-bAbHI5bKyTYksXsnOS5poBBxdhYQE/HSj52YxqGvkok="
-  },
-  {
-    "pname": "Avalonia.Controls.ItemsRepeater",
-    "version": "11.1.5",
-    "hash": "sha256-k4ZYqXFtyLet3wJB4ZJvaPYbcl0K0oKK04yoesbmCXQ="
+    "version": "11.3.2",
+    "hash": "sha256-PFz2fgrBzXQWPLj9X1wdDKDH2iy/54E4NBa+yO7DTfQ="
   },
   {
     "pname": "Avalonia.Desktop",
-    "version": "11.2.8",
-    "hash": "sha256-Mr2x3hm3ArlQwGlWO9MuFWUelf4EVmVPAGANm1MxM1o="
+    "version": "11.3.2",
+    "hash": "sha256-A3LV30ekjXWdo/pRldL4S68AAA6BTuLU8ZGCinkNrvk="
   },
   {
     "pname": "Avalonia.Diagnostics",
-    "version": "11.2.8",
-    "hash": "sha256-3+88G0O1LrQSCSxI6s0aFD34nhgqTH1b3rMXBaXqY0M="
+    "version": "11.3.2",
+    "hash": "sha256-fMXY9p16o/wpUXFjRngf96gVwSlX/WCY0fn3nE/TmIY="
   },
   {
     "pname": "Avalonia.FreeDesktop",
-    "version": "11.2.8",
-    "hash": "sha256-X9VxRmeK6Vu8c9ILtF/KyDi0B0CmjeZcTRnwouCYOWg="
+    "version": "11.3.2",
+    "hash": "sha256-Mxvpd5JKmIpjQCZmuiSb6IkKfwQhA3o712Ubdx0gP28="
   },
   {
     "pname": "Avalonia.Native",
-    "version": "11.2.8",
-    "hash": "sha256-YVjhd2fjOamYdYEh4jGGZy06xPAq3juTH2nC7cOlGOA="
+    "version": "11.3.2",
+    "hash": "sha256-HLVKaAVIRnm77lk7LJfrbiEmGWVIim7XMMoZAyGVUFA="
   },
   {
     "pname": "Avalonia.ReactiveUI",
-    "version": "11.2.8",
-    "hash": "sha256-ReMIcC/paWEVWVI8saKhy9j/W4NN89+MNY80GHztUAQ="
+    "version": "11.3.2",
+    "hash": "sha256-lYKhqoKqEZB4tttXehK5KoBMkwVeTxAThh87dns4C/c="
   },
   {
     "pname": "Avalonia.Remote.Protocol",
-    "version": "11.2.8",
-    "hash": "sha256-v30kDbStvHAS4IOV0wEkWYXOdh4SdjaDEcKVD+6xpzc="
+    "version": "11.3.2",
+    "hash": "sha256-NIkrj4pMvxVvznexzEXmNI8KXWLSXmVbHHWpwz9h3M8="
   },
   {
     "pname": "Avalonia.Skia",
-    "version": "11.2.8",
-    "hash": "sha256-V84jNsrMNguAt9ZdSEf74F4OTC3WyXLuLrkByxfHJe4="
+    "version": "11.3.2",
+    "hash": "sha256-cBJo/tTewA2/LSygJ5aAyPPr11KpLPwS1I6kQxDMy24="
   },
   {
     "pname": "Avalonia.Themes.Fluent",
-    "version": "11.2.8",
-    "hash": "sha256-qHwn8BPAPHxNJ3Ya3xPUhEzItXVjNbI5YjEsNqQLJ8s="
+    "version": "11.3.2",
+    "hash": "sha256-wwMxvJCMdRqnNYmsvzE+122D02HszLsfazPyik1yrBI="
   },
   {
     "pname": "Avalonia.Themes.Simple",
-    "version": "11.2.8",
-    "hash": "sha256-vEFjwS+X6EkxVXDFk97b4S4AjbLVjPD3dYVADrBnoXo="
+    "version": "11.3.2",
+    "hash": "sha256-c8QtpXv+B1CTkW9ovxOZwjRZAkD4KZzIvhIhI5WJXdo="
   },
   {
     "pname": "Avalonia.Win32",
-    "version": "11.2.8",
-    "hash": "sha256-3XYJXXT9IMECwCNbrzV49x0pyJZx6Vbib53Vbe9Gfjg="
+    "version": "11.3.2",
+    "hash": "sha256-FNs+O2knXcmUpfDjd/9JcNmpzEi8g3UQ3pQHItnN2U8="
   },
   {
     "pname": "Avalonia.X11",
-    "version": "11.2.8",
-    "hash": "sha256-+m8pNxda2vyFVBR+7IhkTaQ4Zm7gqkT0XgKSp+lWWmA="
+    "version": "11.3.2",
+    "hash": "sha256-OCH5bwJ7Zje0/L7qtDcFa+yje/uwm2pYNE169J866/I="
   },
   {
     "pname": "BouncyCastle.Cryptography",
-    "version": "2.3.1",
-    "hash": "sha256-r/vNfB00Cjqt1/eFeFdYAoblVhcUuxBRuVUEtqLIT3E="
+    "version": "2.4.0",
+    "hash": "sha256-DoDZNWtYM+0OLIclOEZ+tjcGXymGlXvdvq2ZMPmiAJA="
   },
   {
     "pname": "CommandLineParser",
@@ -111,8 +106,8 @@
   },
   {
     "pname": "CsvHelper",
-    "version": "33.0.1",
-    "hash": "sha256-4MwA/WerpI0VYWiaEudNCNnE1v6/k2tPmLbRjmgijV4="
+    "version": "33.1.0",
+    "hash": "sha256-pEfX4o63xupI7uuwe6qa05One0pJ7UbzzJqLh4Shju8="
   },
   {
     "pname": "Dinah.Core",
@@ -136,8 +131,8 @@
   },
   {
     "pname": "Enums.NET",
-    "version": "4.0.1",
-    "hash": "sha256-ZTWgmbLlOvF9rKQAa4cwPBA0NLZhZ0rwrgZtg/RuJY8="
+    "version": "5.0.0",
+    "hash": "sha256-8cRZVOuu38cso7mNAEifxnN+v0W3T7xB+uR4SBvTkwc="
   },
   {
     "pname": "ExtendedNumerics.BigDecimal",
@@ -146,33 +141,33 @@
   },
   {
     "pname": "Google.Protobuf",
-    "version": "3.30.2",
-    "hash": "sha256-GbyaRLeBNyvJrx4+SkgewClk1nCTtdE7sNqnSjk8VBM="
+    "version": "3.31.1",
+    "hash": "sha256-UEcn4H8F+zK0AjSmz1aTyyMksLxJOGNf2IROtF+DydA="
   },
   {
     "pname": "HarfBuzzSharp",
-    "version": "7.3.0.3",
-    "hash": "sha256-1vDIcG1aVwVABOfzV09eAAbZLFJqibip9LaIx5k+JxM="
+    "version": "8.3.1.1",
+    "hash": "sha256-614yv6bK9ynhdUnvW4wIkgpBe2sqTh28U9cDZzdhPc0="
   },
   {
     "pname": "HarfBuzzSharp.NativeAssets.Linux",
-    "version": "7.3.0.3",
-    "hash": "sha256-HW5r16wdlgDMbE/IfE5AQGDVFJ6TS6oipldfMztx+LM="
+    "version": "8.3.1.1",
+    "hash": "sha256-sBbez6fc9axVcsBbIHbpQh/MM5NHlMJgSu6FyuZzVyU="
   },
   {
     "pname": "HarfBuzzSharp.NativeAssets.macOS",
-    "version": "7.3.0.3",
-    "hash": "sha256-UpAVfRIYY8Wh8xD4wFjrXHiJcvlBLuc2Xdm15RwQ76w="
+    "version": "8.3.1.1",
+    "hash": "sha256-hK20KbX2OpewIO5qG5gWw5Ih6GoLcIDgFOqCJIjXR/Q="
   },
   {
     "pname": "HarfBuzzSharp.NativeAssets.WebAssembly",
-    "version": "7.3.0.3",
-    "hash": "sha256-jHrU70rOADAcsVfVfozU33t/5B5Tk0CurRTf4fVQe3I="
+    "version": "8.3.1.1",
+    "hash": "sha256-mLKoLqI47ZHXqTMLwP1UCm7faDptUfQukNvdq6w/xxw="
   },
   {
     "pname": "HarfBuzzSharp.NativeAssets.Win32",
-    "version": "7.3.0.3",
-    "hash": "sha256-v/PeEfleJcx9tsEQAo5+7Q0XPNgBqiSLNnB2nnAGp+I="
+    "version": "8.3.1.1",
+    "hash": "sha256-Um4iwLdz9XtaDSAsthNZdev6dMiy7OBoHOrorMrMYyo="
   },
   {
     "pname": "HtmlAgilityPack",
@@ -261,8 +256,8 @@
   },
   {
     "pname": "Microsoft.Data.Sqlite.Core",
-    "version": "9.0.4",
-    "hash": "sha256-OJs5gZSKnmDabm6UehVhzYFtsgEmScyNrzbQ+ojiRoI="
+    "version": "9.0.7",
+    "hash": "sha256-cTD6Q27SIKDZ9FYN5FrrfJ7qwo4We7seLz7Ex3F6ENI="
   },
   {
     "pname": "Microsoft.EntityFrameworkCore",
@@ -271,8 +266,8 @@
   },
   {
     "pname": "Microsoft.EntityFrameworkCore",
-    "version": "9.0.4",
-    "hash": "sha256-zjIBv5cnhTVzG7YE+tqSI+havSCAHQdCE3Ha4JjecuQ="
+    "version": "9.0.7",
+    "hash": "sha256-AUKHfIjr2whZ3hIz0oANmesJM/7pDBdywSXWkQ/Psio="
   },
   {
     "pname": "Microsoft.EntityFrameworkCore.Abstractions",
@@ -281,8 +276,8 @@
   },
   {
     "pname": "Microsoft.EntityFrameworkCore.Abstractions",
-    "version": "9.0.4",
-    "hash": "sha256-CaGhHINjggzaZSmdP51BBM4osWKpbck/2DgoMVCR3bc="
+    "version": "9.0.7",
+    "hash": "sha256-SeCmWrkFFnvQSDcTyzSwb3yxe4Fix/OCxg0GomS7ZNA="
   },
   {
     "pname": "Microsoft.EntityFrameworkCore.Analyzers",
@@ -291,13 +286,13 @@
   },
   {
     "pname": "Microsoft.EntityFrameworkCore.Analyzers",
-    "version": "9.0.4",
-    "hash": "sha256-Htc1qQ8dTS+tGDaT0gQVsZNtVar3p/LT54YcFkoHTLI="
+    "version": "9.0.7",
+    "hash": "sha256-sc5+4wh4FoMdtbg8mHI0pEQgEQl6tAKT1Usep5/j4xo="
   },
   {
     "pname": "Microsoft.EntityFrameworkCore.Design",
-    "version": "9.0.4",
-    "hash": "sha256-mwW5DH+pX0cRx+wRHoh850u2b6/SxvvhBkKjwe8wRiQ="
+    "version": "9.0.7",
+    "hash": "sha256-pcASogSqabBEtqlBfRO//MJ7A9gx8ya4mbqyOA6NWf0="
   },
   {
     "pname": "Microsoft.EntityFrameworkCore.Relational",
@@ -306,28 +301,28 @@
   },
   {
     "pname": "Microsoft.EntityFrameworkCore.Relational",
-    "version": "9.0.4",
-    "hash": "sha256-cZ8qUtvGgICA8F2XS9sNci14AzLC84mcGv6GibifYKc="
+    "version": "9.0.7",
+    "hash": "sha256-jgzudU4gzKnb/+v77+9PQ0bRN1IuJ48+gaZ4ykxkC7M="
   },
   {
     "pname": "Microsoft.EntityFrameworkCore.Sqlite",
-    "version": "9.0.4",
-    "hash": "sha256-9KBVCa/lr6UX2WFrMAU+S4WD0AG51kLI6YP9GxQmZK8="
+    "version": "9.0.7",
+    "hash": "sha256-I2A/O3THFuIqygxzhE+xUySD1FNqu5SRv+/yaywuOd0="
   },
   {
     "pname": "Microsoft.EntityFrameworkCore.Sqlite.Core",
-    "version": "9.0.4",
-    "hash": "sha256-pka9/9W+B4gVY7H7VJ3qCSaEJJW5Thqd6LAdQaIMRQ0="
+    "version": "9.0.7",
+    "hash": "sha256-nZTEqAhpmsNNhWy+zWSqJWI19LWXornmf75abEd7Z3k="
   },
   {
     "pname": "Microsoft.EntityFrameworkCore.Tools",
-    "version": "9.0.4",
-    "hash": "sha256-sUyI6VH/QpBNwz2bjQZlCTP41MjC4SlxCDqr063VVsM="
+    "version": "9.0.7",
+    "hash": "sha256-PyTUZx0OoLB945Tiz1hYV5uvpKjl9TFxpvKEW4L5n40="
   },
   {
     "pname": "Microsoft.Extensions.Caching.Abstractions",
-    "version": "9.0.4",
-    "hash": "sha256-/VJBbIJzRXjzQ07s4Bicb+WNV0ZAC+/naG2nLVxFvjU="
+    "version": "9.0.7",
+    "hash": "sha256-6k/RzXSpQEoLHXAlEpV3KJ/zXknkguWEZ5SWY7z/4SM="
   },
   {
     "pname": "Microsoft.Extensions.Caching.Memory",
@@ -336,8 +331,8 @@
   },
   {
     "pname": "Microsoft.Extensions.Caching.Memory",
-    "version": "9.0.4",
-    "hash": "sha256-5uynkW+dK61Zp1+vs5uW6mwpnkZl7mH/bGSQoGjJH2c="
+    "version": "9.0.7",
+    "hash": "sha256-Amw5+liq7vmRc3YMEvbFErUiUyMB+tEKgx0/g4nCepE="
   },
   {
     "pname": "Microsoft.Extensions.Configuration",
@@ -346,8 +341,8 @@
   },
   {
     "pname": "Microsoft.Extensions.Configuration",
-    "version": "9.0.4",
-    "hash": "sha256-01yWDq/dHgU1Trx2OqVsXK/yobwVTClJXB07LrPc8lU="
+    "version": "9.0.7",
+    "hash": "sha256-Su+YntNqtLuY0XEYo1vfQZ4sA0wrHu0ZrcM33blvHWI="
   },
   {
     "pname": "Microsoft.Extensions.Configuration.Abstractions",
@@ -356,8 +351,8 @@
   },
   {
     "pname": "Microsoft.Extensions.Configuration.Abstractions",
-    "version": "9.0.4",
-    "hash": "sha256-5hwq73FCWAJJ8Yb1VHaaryJJhUUiVsetPTrPLlo8N9o="
+    "version": "9.0.7",
+    "hash": "sha256-45ZR8liM/A6II+WPX9X6v9+g2auAKInPbVvY6a79VLk="
   },
   {
     "pname": "Microsoft.Extensions.Configuration.Binder",
@@ -376,8 +371,8 @@
   },
   {
     "pname": "Microsoft.Extensions.Configuration.FileExtensions",
-    "version": "9.0.4",
-    "hash": "sha256-i6BP99iTLEVt7aSw2Fu0ogUnY6FlVMat+BMIlndHCkQ="
+    "version": "9.0.7",
+    "hash": "sha256-9+XLNylnsYd/IcLZfDyW/Q+nuYB51BQJeyA+ZMsKan0="
   },
   {
     "pname": "Microsoft.Extensions.Configuration.Json",
@@ -386,18 +381,18 @@
   },
   {
     "pname": "Microsoft.Extensions.Configuration.Json",
-    "version": "9.0.4",
-    "hash": "sha256-scTrZeY5CKX9kMcN7MYQPJVgEFwDTvO+JOk+G3wXrjs="
+    "version": "9.0.7",
+    "hash": "sha256-4lWXlwwGPgv3nrL5V890LPVKxSDM8w4UJYYQlSA28/M="
   },
   {
     "pname": "Microsoft.Extensions.DependencyInjection",
-    "version": "9.0.4",
-    "hash": "sha256-ck7PqIL/3vodYky+d7YX218n+detOoEjZeMr1EqTFPg="
+    "version": "9.0.7",
+    "hash": "sha256-/TCCT7WPZpEWP9E3M441y+SZsmdqQ/WMTgL+ce7p2hw="
   },
   {
     "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
-    "version": "9.0.4",
-    "hash": "sha256-6WcGpsAYRhrpHloEom0oVP7Ff4Gh/O1XWJETJJ3LvEQ="
+    "version": "9.0.7",
+    "hash": "sha256-Ltlh01iGj6641DaZSFif/2/2y3y9iFk7GEd+HuRnxPs="
   },
   {
     "pname": "Microsoft.Extensions.DependencyModel",
@@ -411,8 +406,8 @@
   },
   {
     "pname": "Microsoft.Extensions.DependencyModel",
-    "version": "9.0.4",
-    "hash": "sha256-ziWOK9GykM9HufwYy18FYu6AyOncLOeumi3F/4W3AVE="
+    "version": "9.0.7",
+    "hash": "sha256-yRnJOylILhZMOj3J7W0pR8h7igyUrz6SilQSMxDpj/w="
   },
   {
     "pname": "Microsoft.Extensions.FileProviders.Abstractions",
@@ -421,8 +416,8 @@
   },
   {
     "pname": "Microsoft.Extensions.FileProviders.Abstractions",
-    "version": "9.0.4",
-    "hash": "sha256-OkAq+1NUG0d1Ww6zT/hZWcPB5+fCr8AJIWmkpX7CQxU="
+    "version": "9.0.7",
+    "hash": "sha256-e/oPQDche6WBSJlVwNIhSu4qknO2TmMMkhX+OqbYGFA="
   },
   {
     "pname": "Microsoft.Extensions.FileProviders.Physical",
@@ -431,8 +426,8 @@
   },
   {
     "pname": "Microsoft.Extensions.FileProviders.Physical",
-    "version": "9.0.4",
-    "hash": "sha256-whn/jRYaH56Lha20yChG5wgIllttTq2EtOwyDW+ZDO4="
+    "version": "9.0.7",
+    "hash": "sha256-L7XMdKdZa4UT01TKEjunha3RAK5BBi2E020wRbrvUOU="
   },
   {
     "pname": "Microsoft.Extensions.FileSystemGlobbing",
@@ -441,8 +436,8 @@
   },
   {
     "pname": "Microsoft.Extensions.FileSystemGlobbing",
-    "version": "9.0.4",
-    "hash": "sha256-lzNTCxATfJvnsl1hlAxhI4cibixYYBq99fK9b9tEo0A="
+    "version": "9.0.7",
+    "hash": "sha256-KjxkTcn1aNZUdoFb6v/xhdG92D5FmwdW2MFL1xAH1x8="
   },
   {
     "pname": "Microsoft.Extensions.Logging",
@@ -451,18 +446,18 @@
   },
   {
     "pname": "Microsoft.Extensions.Logging",
-    "version": "9.0.4",
-    "hash": "sha256-Vj+NGOamKeuMrLNUWlVKFFkz7IKGIv6h1A5X4CK9D5E="
+    "version": "9.0.7",
+    "hash": "sha256-7n8guHFss8HPnJuAByfzn9ipguDz7dack/udL1uH3h0="
   },
   {
     "pname": "Microsoft.Extensions.Logging.Abstractions",
-    "version": "9.0.4",
-    "hash": "sha256-n0ZRhQ7U/5Kv1hVqUXGoa5gfrhzcy77yFhfonjq6VFc="
+    "version": "9.0.7",
+    "hash": "sha256-G8x9e+2D2FzUsYNkXHd4HKQ71iEv5njFiGlvS+7OXLQ="
   },
   {
     "pname": "Microsoft.Extensions.Options",
-    "version": "9.0.4",
-    "hash": "sha256-QyjtRCG+L9eyH/UWHf/S+7/ZiSOmuGNoKGO9nlXmjxI="
+    "version": "9.0.7",
+    "hash": "sha256-nfUnZxx1tKERUddNNyxhGTK7VDTNZIJGYkiOWSHCt/M="
   },
   {
     "pname": "Microsoft.Extensions.Primitives",
@@ -471,13 +466,13 @@
   },
   {
     "pname": "Microsoft.Extensions.Primitives",
-    "version": "9.0.4",
-    "hash": "sha256-v/Ygyo1TMTUbnhdQSV2wzD4FOgAEWd1mpESo3kZ557g="
+    "version": "9.0.7",
+    "hash": "sha256-Vv1EuoBSfjCJ7EKzxh10/nA/rpaFU8D8+bdZZQWzw2I="
   },
   {
     "pname": "Microsoft.IO.RecyclableMemoryStream",
-    "version": "3.0.0",
-    "hash": "sha256-WBXkqxC5g4tJ481sa1uft39LqA/5hx5yOfiTfMRMg/4="
+    "version": "3.0.1",
+    "hash": "sha256-unFg/5EcU/XKJbob4GtQC43Ydgi5VjeBGs7hfhj4EYo="
   },
   {
     "pname": "Microsoft.NETCore.Platforms",
@@ -526,8 +521,8 @@
   },
   {
     "pname": "NPOI",
-    "version": "2.7.3",
-    "hash": "sha256-xDVGyQoUaynZ0LS7+/gIM3JJO88jakE2vKxTFsVAngo="
+    "version": "2.7.4",
+    "hash": "sha256-HrKC49BTCxR2/jJRWgwuLsOTvq1KynRnBR2Xklsokcs="
   },
   {
     "pname": "Octokit",
@@ -541,13 +536,13 @@
   },
   {
     "pname": "Polly",
-    "version": "8.5.2",
-    "hash": "sha256-IrN06ddOIJ0VYuVefe3LvfW0kX20ATRQkEBg9CBomRA="
+    "version": "8.6.2",
+    "hash": "sha256-JWPe3Une30ljf2z4aeshNSjz2CfIQZWw3IHiPvFgy6E="
   },
   {
     "pname": "Polly.Core",
-    "version": "8.5.2",
-    "hash": "sha256-PAwsWqrCieCf/7Y87fV7XMKoaY2abCQNtI+4oyyMifk="
+    "version": "8.6.2",
+    "hash": "sha256-jX1i7tkQwaY74qgVarx6vLeLIg7zonQwisFvm6nWrHs="
   },
   {
     "pname": "ReactiveUI",
@@ -604,11 +599,6 @@
     "version": "7.0.0",
     "hash": "sha256-LxZYUoUPkCjIIVarJilnXnqQiMrFNJtoRilmzTNtUjo="
   },
-  {
-    "pname": "Serilog.Sinks.ZipFile",
-    "version": "3.1.1",
-    "hash": "sha256-W4oXuOZF+Ic6rKma2PkmKW5O7GvuzooNsiB17p5H6lQ="
-  },
   {
     "pname": "SharpZipLib",
     "version": "1.4.2",
@@ -626,8 +616,8 @@
   },
   {
     "pname": "SixLabors.ImageSharp",
-    "version": "3.1.8",
-    "hash": "sha256-cE9BQfbCvJ0Mf+fQiTD8elOZEPcfZHjDz2BHdiO+D08="
+    "version": "3.1.10",
+    "hash": "sha256-6bVTSCxLY8Dt+9lpo4F4xEtMv5oPve2vS76O/lcuIok="
   },
   {
     "pname": "SkiaSharp",
@@ -871,8 +861,8 @@
   },
   {
     "pname": "System.Text.Json",
-    "version": "9.0.4",
-    "hash": "sha256-oIOqfOIIUXXVkfFiTCI9wwIJBETQqF7ZcOJv2iYuq1s="
+    "version": "9.0.7",
+    "hash": "sha256-f3leKX3r7JoUbKo6tnuIsPVYJHNbElHWffhyqk1+2C0="
   },
   {
     "pname": "System.Threading",
@@ -891,7 +881,12 @@
   },
   {
     "pname": "Tmds.DBus.Protocol",
-    "version": "0.20.0",
-    "hash": "sha256-CRW/tkgsuBiBJfRwou12ozRQsWhHDooeP88E5wWpWJw="
+    "version": "0.21.2",
+    "hash": "sha256-gaK/5aAummyin6ptnhaJbnA0ih4+2xADrtrLfFbHwYI="
+  },
+  {
+    "pname": "ZString",
+    "version": "2.6.0",
+    "hash": "sha256-9Q/L1SPmI+oVxvUBIz202mUn+UVsoV/y2OfhopHXzeo="
   }
 ]
diff --git a/pkgs/by-name/li/libation/package.nix b/pkgs/by-name/li/libation/package.nix
index cfa6b499eaa5..ba5a77382408 100644
--- a/pkgs/by-name/li/libation/package.nix
+++ b/pkgs/by-name/li/libation/package.nix
@@ -8,17 +8,18 @@
   glew,
   gtk3,
   xorg,
+  nix-update-script,
 }:
 
 buildDotnetModule rec {
   pname = "libation";
-  version = "12.3.1";
+  version = "12.4.9";
 
   src = fetchFromGitHub {
     owner = "rmcrackan";
     repo = "Libation";
     tag = "v${version}";
-    hash = "sha256-jir1r78HbAhlOiCj6pSw0+o4V9ceCkJQWnKtt6VzLDY=";
+    hash = "sha256-o5bmu5OU5Md85AucbNrm30dGCj+prWwmWDL3R6Dp8Mk=";
   };
 
   sourceRoot = "${src.name}/Source";
@@ -64,20 +65,13 @@ buildDotnetModule rec {
   dontDotnetFixup = true;
 
   preFixup = ''
-    # remove binaries for other platform, like upstream does
-    pushd $out/lib/libation
-    rm -f *.x86.dll *.x64.dll
-    ${lib.optionalString (stdenv.system != "x86_64-linux") "rm -f *.x64.so"}
-    ${lib.optionalString (stdenv.system != "aarch64-linux") "rm -f *.arm64.so"}
-    ${lib.optionalString (stdenv.system != "x86_64-darwin") "rm -f *.x64.dylib"}
-    ${lib.optionalString (stdenv.system != "aarch64-darwin") "rm -f *.arm64.dylib"}
-    popd
-
     wrapDotnetProgram $out/lib/libation/Libation $out/bin/libation
     wrapDotnetProgram $out/lib/libation/LibationCli $out/bin/libationcli
     wrapDotnetProgram $out/lib/libation/Hangover $out/bin/hangover
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     changelog = "https://github.com/rmcrackan/Libation/releases/tag/v${version}";
     description = "Audible audiobook manager";
diff --git a/pkgs/by-name/mo/moonlight/package.nix b/pkgs/by-name/mo/moonlight/package.nix
index a33f4c6d1a84..b22688a1d1de 100644
--- a/pkgs/by-name/mo/moonlight/package.nix
+++ b/pkgs/by-name/mo/moonlight/package.nix
@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "moonlight";
-  version = "1.3.24";
+  version = "1.3.25";
 
   src = fetchFromGitHub {
     owner = "moonlight-mod";
     repo = "moonlight";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qyKn4qHEpGqis82ALjsog0iH6nM8HKMl4y1KLazXT7I=";
+    hash = "sha256-raqn8TVqD/VFgPw6kiv69JoBmUUVp9Ltj9n2EeEg85U=";
   };
 
   nativeBuildInputs = [
@@ -27,8 +27,8 @@ stdenv.mkDerivation (finalAttrs: {
 
     buildInputs = [ nodejs_22 ];
 
-    fetcherVersion = 1;
-    hash = "sha256-Ij2jc5K0WpIIeI/iKXAdU+fxyqkWpkCuQSNqHvhkQS8=";
+    fetcherVersion = 2;
+    hash = "sha256-KZOAbU6IBytkZzwB8jbSwmlkM69uhjNUEKmIu5/DySI=";
   };
 
   env = {
diff --git a/pkgs/by-name/nu/nuclei-templates/package.nix b/pkgs/by-name/nu/nuclei-templates/package.nix
index 179385cb77fe..13c6cdd72f8f 100644
--- a/pkgs/by-name/nu/nuclei-templates/package.nix
+++ b/pkgs/by-name/nu/nuclei-templates/package.nix
@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "nuclei-templates";
-  version = "10.2.5";
+  version = "10.2.6";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "nuclei-templates";
     tag = "v${version}";
-    hash = "sha256-fJykVJHfuSmnSuR/Sxup8pr+KKwqQoYqLeNLoXMau4E=";
+    hash = "sha256-76PtEYXvZxKEBky0fqdWmjWxrKHfYLBWe+3nqqXUNOw=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/pu/punes-qt6/package.nix b/pkgs/by-name/pu/punes-qt6/package.nix
new file mode 100644
index 000000000000..8b89e6951278
--- /dev/null
+++ b/pkgs/by-name/pu/punes-qt6/package.nix
@@ -0,0 +1,7 @@
+{
+  punes,
+}:
+
+punes.override {
+  withQt6 = true;
+}
diff --git a/pkgs/applications/emulators/punes/default.nix b/pkgs/by-name/pu/punes/package.nix
similarity index 80%
rename from pkgs/applications/emulators/punes/default.nix
rename to pkgs/by-name/pu/punes/package.nix
index 1267a40b4b26..02b06b13a3c9 100644
--- a/pkgs/applications/emulators/punes/default.nix
+++ b/pkgs/by-name/pu/punes/package.nix
@@ -12,12 +12,14 @@
   libX11,
   libXrandr,
   sndio,
-  qtbase,
-  qtsvg,
-  qttools,
-  wrapQtAppsHook,
+  libsForQt5,
+  qt6Packages,
+  withQt6 ? false,
 }:
 
+let
+  qtPackages = if withQt6 then qt6Packages else libsForQt5;
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "punes";
   version = "0.111";
@@ -25,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "punesemu";
     repo = "puNES";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-TIXjYkInWV3yVnvXrdHcmeWYeps5TcvkG2Xjg4roIds=";
   };
 
@@ -50,16 +52,20 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     cmake
     pkg-config
+  ]
+  ++ (with qtPackages; [
     qttools
     wrapQtAppsHook
-  ];
+  ]);
 
   buildInputs = [
     ffmpeg
     libGLU
+  ]
+  ++ (with qtPackages; [
     qtbase
     qtsvg
-  ]
+  ])
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     alsa-lib
     libX11
@@ -74,20 +80,20 @@ stdenv.mkDerivation (finalAttrs: {
     "-DENABLE_RELEASE=ON"
     "-DENABLE_FFMPEG=ON"
     "-DENABLE_OPENGL=ON"
-    "-DENABLE_QT6_LIBS=${if lib.versionAtLeast qtbase.version "6.0" then "ON" else "OFF"}"
+    (lib.strings.cmakeBool "ENABLE_QT6_LIBS" withQt6)
   ];
 
   passthru.updateScript = gitUpdater {
     rev-prefix = "v";
   };
 
-  meta = with lib; {
+  meta = {
     description = "Qt-based Nintendo Entertainment System emulator and NSF/NSFe Music Player";
     mainProgram = "punes";
     homepage = "https://github.com/punesemu/puNES";
     changelog = "https://github.com/punesemu/puNES/blob/v${finalAttrs.version}/ChangeLog";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ OPNA2608 ];
-    platforms = with platforms; linux ++ freebsd ++ openbsd ++ windows;
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ OPNA2608 ];
+    platforms = with lib.platforms; linux ++ freebsd ++ openbsd ++ windows;
   };
 })
diff --git a/pkgs/by-name/tp/tpnote/package.nix b/pkgs/by-name/tp/tpnote/package.nix
index 2a494b093a03..d770c2e190d1 100644
--- a/pkgs/by-name/tp/tpnote/package.nix
+++ b/pkgs/by-name/tp/tpnote/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tpnote";
-  version = "1.25.12";
+  version = "1.25.14";
 
   src = fetchFromGitHub {
     owner = "getreu";
     repo = "tp-note";
     tag = "v${version}";
-    hash = "sha256-rjRZVD0EDRtSiF8kU3VyQJhBJEGDqDsjJgEZkVeC+L0=";
+    hash = "sha256-CgC4aLg1GdqDXzuWfV4i5C4//I3GJ2RJa0y3oFOM0II=";
   };
 
-  cargoHash = "sha256-lUwusYFt7shEt2fTV4N5bn6bYTWDjUU7hY9VsC2bDHo=";
+  cargoHash = "sha256-LF17FrWiqfFaVFbOjm9GiW9AsZmleZL++i8YDyrVZVM=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/vs/vscode-extension-update/vscode_extension_update.py b/pkgs/by-name/vs/vscode-extension-update/vscode_extension_update.py
index d1e179e23e2a..9859c4d3d430 100755
--- a/pkgs/by-name/vs/vscode-extension-update/vscode_extension_update.py
+++ b/pkgs/by-name/vs/vscode-extension-update/vscode_extension_update.py
@@ -89,16 +89,31 @@ class VSCodeExtensionUpdater:
         """
         Retrieves a raw Nix attribute value.
         """
-        return self.execute_command(["nix", "eval", "--raw", "-f", ".", attribute_path])
+        return self.execute_command([
+            "nix",
+            "--extra-experimental-features",
+            "nix-command",
+            "eval",
+            "--raw",
+            "-f",
+            ".",
+            attribute_path
+        ])
 
     def get_nix_system(self) -> str:
         """
         Retrieves system from Nix.
         """
-        return self._get_nix_attribute("system")
+        return self._get_nix_attribute("stdenv.hostPlatform.system")
 
     def get_supported_nix_systems(self) -> list[str]:
-        nix_config = self.execute_command(["nix", "config", "show"])
+        nix_config = self.execute_command([
+            "nix",
+            "--extra-experimental-features",
+            "nix-command",
+            "config",
+            "show"
+        ])
         system = None
         extra_platforms = []
         for line in nix_config.splitlines():
@@ -120,6 +135,8 @@ class VSCodeExtensionUpdater:
     def _get_nix_vscode_extension_src_hash(self, system: str) -> str:
         url = self.execute_command([
             "nix",
+            "--extra-experimental-features",
+            "nix-command",
             "eval",
             "--raw",
             "-f",
@@ -131,6 +148,8 @@ class VSCodeExtensionUpdater:
         sha256 = self.execute_command(["nix-prefetch-url", url])
         return self.execute_command([
             "nix",
+            "--extra-experimental-features",
+            "nix-command",
             "hash",
             "convert",
             "--to",
@@ -183,6 +202,8 @@ class VSCodeExtensionUpdater:
             return json.loads(
                 self.execute_command([
                     "nix",
+                    "--extra-experimental-features",
+                    "nix-command",
                     "eval",
                     "--json",
                     "-f",
diff --git a/pkgs/development/python-modules/ds-analysis-lib/default.nix b/pkgs/development/python-modules/ds-analysis-lib/default.nix
new file mode 100644
index 000000000000..66df91b9d28e
--- /dev/null
+++ b/pkgs/development/python-modules/ds-analysis-lib/default.nix
@@ -0,0 +1,59 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  appthreat-vulnerability-db,
+  custom-json-diff,
+  cvss,
+  rich,
+  toml,
+  writableTmpDirAsHomeHook,
+  pytestCheckHook,
+  pytest-cov-stub,
+}:
+
+buildPythonPackage rec {
+  pname = "ds-analysis-lib";
+  version = "6.0.0b3";
+  pyproject = true;
+
+  # pypi because library is embedded into another project's repo
+  src = fetchPypi {
+    inherit version;
+    pname = "ds_analysis_lib";
+    hash = "sha256-XZZzAxQJk65Xoq6z2OadlHUN0REYTjKmSvwz17tvVqc=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    appthreat-vulnerability-db
+    custom-json-diff
+    cvss
+    rich
+    toml
+  ];
+
+  pythonImportsCheck = [ "analysis_lib" ];
+
+  # relies on data files that pypi doesn't include
+  disabledTestPaths = [
+    "tests/test_analysis.py"
+    "tests/test_csaf.py"
+  ];
+
+  nativeCheckInputs = [
+    writableTmpDirAsHomeHook
+    pytestCheckHook
+    pytest-cov-stub
+  ];
+
+  meta = {
+    description = "Analysis library for owasp depscan";
+    homepage = "https://pypi.org/project/ds-analysis-lib/";
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+    teams = [ lib.teams.ngi ];
+    license = with lib.licenses; [ mit ];
+  };
+}
diff --git a/pkgs/development/python-modules/ds-reporting-lib/default.nix b/pkgs/development/python-modules/ds-reporting-lib/default.nix
new file mode 100644
index 000000000000..26697a6033ae
--- /dev/null
+++ b/pkgs/development/python-modules/ds-reporting-lib/default.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "ds-reporting-lib";
+  version = "6.0.0b3";
+  pyproject = true;
+
+  # pypi because library is embedded into another project's repo
+  src = fetchPypi {
+    inherit version;
+    pname = "ds_reporting_lib";
+    hash = "sha256-0C/UgAM7VIWEjuRq1ZCTL5CjJ6OK+0/Yw+AN4j7jj6E=";
+  };
+
+  build-system = [ setuptools ];
+
+  pythonImportsCheck = [ "reporting_lib" ];
+
+  # no tests
+  doCheck = false;
+
+  meta = {
+    description = "Reporting library for owasp depscan";
+    homepage = "https://pypi.org/project/ds-reporting-lib/";
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+    teams = [ lib.teams.ngi ];
+    license = with lib.licenses; [ mit ];
+  };
+}
diff --git a/pkgs/development/python-modules/ds-xbom-lib/default.nix b/pkgs/development/python-modules/ds-xbom-lib/default.nix
new file mode 100644
index 000000000000..20464510118e
--- /dev/null
+++ b/pkgs/development/python-modules/ds-xbom-lib/default.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "ds-xbom-lib";
+  version = "6.0.0b3";
+  pyproject = true;
+
+  # pypi because library is embedded into another project's repo
+  src = fetchPypi {
+    inherit version;
+    pname = "ds_xbom_lib";
+    hash = "sha256-/L0AFAuIDzbyXwpg0bigy2AR4GT0RSdXrjPAEbEO7cI=";
+  };
+
+  build-system = [ setuptools ];
+
+  pythonImportsCheck = [ "xbom_lib" ];
+
+  # no tests
+  doCheck = false;
+
+  meta = {
+    description = "xBOM library for owasp depscan";
+    homepage = "https://pypi.org/project/ds-xbom-lib/";
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+    teams = [ lib.teams.ngi ];
+    license = with lib.licenses; [ mit ];
+  };
+}
diff --git a/pkgs/development/python-modules/fastcore/default.nix b/pkgs/development/python-modules/fastcore/default.nix
index 9d4b9b346e31..920c03bea751 100644
--- a/pkgs/development/python-modules/fastcore/default.nix
+++ b/pkgs/development/python-modules/fastcore/default.nix
@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "fastcore";
-  version = "1.8.6";
+  version = "1.8.7";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "fastai";
     repo = "fastcore";
     tag = version;
-    hash = "sha256-m/22tTIysVFgNWUUWKC/1TV/dkEki8dDACb0XvKayAw=";
+    hash = "sha256-CF6bODkD1ooIWK4AnOXXKOKyu09cQP876BXgoGtGoXk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/llama-index-instrumentation/default.nix b/pkgs/development/python-modules/llama-index-instrumentation/default.nix
index 8f430b775c9e..40774b99d19f 100644
--- a/pkgs/development/python-modules/llama-index-instrumentation/default.nix
+++ b/pkgs/development/python-modules/llama-index-instrumentation/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "llama-index-instrumentation";
-  version = "0.3.0";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "llama_index_instrumentation";
     inherit version;
-    hash = "sha256-d3QcHZhh6tCA5vmDUGJZcUiNHgRr7ekc7J4M4vY+o0o=";
+    hash = "sha256-847MHwK2wferhCY7qmRn+sn4ZTjA7iVUKFPeRieKvqc=";
   };
 
   pythonRelaxDeps = [ "pydantic" ];
diff --git a/pkgs/development/python-modules/netbox-dns/default.nix b/pkgs/development/python-modules/netbox-dns/default.nix
index b1bc4e20da25..802c03563237 100644
--- a/pkgs/development/python-modules/netbox-dns/default.nix
+++ b/pkgs/development/python-modules/netbox-dns/default.nix
@@ -7,14 +7,14 @@
 }:
 buildPythonPackage rec {
   pname = "netbox-plugin-dns";
-  version = "1.3.4";
+  version = "1.3.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "peteeckel";
     repo = "netbox-plugin-dns";
     tag = version;
-    hash = "sha256-Tk+Kzcve7jtJ8UyKdNUoNzct8AxOkZ84g/eg/vX1FEc=";
+    hash = "sha256-7Ej+YDpV/irXUujDsgNnhpFdKduT/ALXvjQjyb9PLOA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pynetdicom/default.nix b/pkgs/development/python-modules/pynetdicom/default.nix
index 93666e9c17da..5d5042a8ee32 100644
--- a/pkgs/development/python-modules/pynetdicom/default.nix
+++ b/pkgs/development/python-modules/pynetdicom/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "pynetdicom";
-  version = "3.0.3";
+  version = "3.0.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydicom";
     repo = "pynetdicom";
     tag = "v${version}";
-    hash = "sha256-CiCP5H0RVbbeNQKO/GpP/hZ6nBE5Q9Wp+/b/wHehIpA=";
+    hash = "sha256-4LISckHH+fVBmPcBr8rM62E6r3IkKAgdUneVHyc5Vm8=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/python-modules/pyosohotwaterapi/default.nix b/pkgs/development/python-modules/pyosohotwaterapi/default.nix
index 9ba2348636ff..6aee8b17fbdb 100644
--- a/pkgs/development/python-modules/pyosohotwaterapi/default.nix
+++ b/pkgs/development/python-modules/pyosohotwaterapi/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pyosohotwaterapi";
-  version = "1.2.0";
+  version = "1.2.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "osohotwateriot";
     repo = "apyosohotwaterapi";
     tag = version;
-    hash = "sha256-GFjA1RtJC2bxSoH2TIZwEdSAvpteYBTbsS81hhp4Y3E=";
+    hash = "sha256-hpbmiSOLawKVSh7BGV70bRi45HCDKmdxEEhCOdJuIww=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/roadrecon/default.nix b/pkgs/development/python-modules/roadrecon/default.nix
index 748a0fabd13d..3eb00bdd7ec2 100644
--- a/pkgs/development/python-modules/roadrecon/default.nix
+++ b/pkgs/development/python-modules/roadrecon/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "roadrecon";
-  version = "1.6.2";
+  version = "1.7.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-AbZnYM02s8DXTLzakuyb3WSh6UvUSxanMYkfdJATK7M=";
+    hash = "sha256-JJJPQcgZOdqyAXYgLmCQuNBhSGwg8WIDW8+2jfVyvyc=";
   };
 
   pythonRelaxDeps = [ "flask" ];
diff --git a/pkgs/development/python-modules/timezonefinder/default.nix b/pkgs/development/python-modules/timezonefinder/default.nix
index a844e96f36b9..90ee140bf0ca 100644
--- a/pkgs/development/python-modules/timezonefinder/default.nix
+++ b/pkgs/development/python-modules/timezonefinder/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "timezonefinder";
-  version = "6.6.2";
+  version = "7.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jannikmi";
     repo = "timezonefinder";
     tag = version;
-    hash = "sha256-5BScSnMYKPwVn4lO4qFeqPik1TAFu9AhOnmUADBW+3U=";
+    hash = "sha256-Pp4VHCaYH4yZh25Z8ETTpPW8YHeBro+st/5MM4XDwxk=";
   };
 
   build-system = [
diff --git a/pkgs/servers/asterisk/default.nix b/pkgs/servers/asterisk/default.nix
index da2845f8ea80..1f4854c0b9c3 100644
--- a/pkgs/servers/asterisk/default.nix
+++ b/pkgs/servers/asterisk/default.nix
@@ -147,7 +147,7 @@ let
       postInstall = ''
         # Install sample configuration files for this version of Asterisk
         make samples
-        ${lib.optionalString (lib.versionAtLeast version "17.0.0") "make install-headers"}
+        make install-headers
       '';
 
       meta = with lib; {
@@ -163,19 +163,20 @@ let
       };
     };
 
-  pjproject_2_14_1 =
-    fetchurl {
-      url = "https://raw.githubusercontent.com/asterisk/third-party/master/pjproject/2.14.1/pjproject-2.14.1.tar.bz2";
-      hash = "sha256-MtsK8bOc0fT/H/pUydqK/ahMIVg8yiRDt3TSM1uhUFQ=";
-    }
-    // {
-      pjsip_patches = [ ];
-    };
+  pjproject_2_14_1 = fetchurl {
+    url = "https://raw.githubusercontent.com/asterisk/third-party/master/pjproject/2.14.1/pjproject-2.14.1.tar.bz2";
+    hash = "sha256-MtsK8bOc0fT/H/pUydqK/ahMIVg8yiRDt3TSM1uhUFQ=";
+  };
 
-  mp3-202 = fetchsvn {
+  pjproject_2_15_1 = fetchurl {
+    url = "https://raw.githubusercontent.com/asterisk/third-party/master/pjproject/2.15.1/pjproject-2.15.1.tar.bz2";
+    hash = "sha256-WLuDzsTUMfSNAG5FXYIWaEUPjPa2yV8JDe9HBi+jpgw=";
+  };
+
+  mp3-204 = fetchsvn {
     url = "http://svn.digium.com/svn/thirdparty/mp3/trunk";
-    rev = "202";
-    sha256 = "1s9idx2miwk178sa731ig9r4fzx4gy1q8xazfqyd7q4lfd70s1cy";
+    rev = "204";
+    hash = "sha256-Viec0LwFPfR7ewy+2hc/LIUR1LiDZfYos3RUbc+tyNk=";
   };
 
   asterisk-opus = fetchFromGitHub {
@@ -183,7 +184,7 @@ let
     repo = "asterisk-opus";
     # No releases, points to master as of 2022-04-06
     rev = "a959f072d3f364be983dd27e6e250b038aaef747";
-    sha256 = "sha256-CASlTvTahOg9D5jccF/IN10LP/U8rRy9BFCSaHGQfCw=";
+    hash = "sha256-CASlTvTahOg9D5jccF/IN10LP/U8rRy9BFCSaHGQfCw=";
   };
 
   # auto-generated by update.py
@@ -191,14 +192,13 @@ let
     _:
     { version, sha256 }:
     let
-      pjsip = pjproject_2_14_1;
+      pjsip = if lib.versionAtLeast version "20" then pjproject_2_15_1 else pjproject_2_14_1;
     in
     common {
       inherit version sha256;
-      inherit (pjsip) pjsip_patches;
       externals = {
         "externals_cache/${pjsip.name}" = pjsip;
-        "addons/mp3" = mp3-202;
+        "addons/mp3" = mp3-204;
       };
     }
   ) (lib.importJSON ./versions.json);
diff --git a/pkgs/servers/asterisk/update.py b/pkgs/servers/asterisk/update.py
index 1e5029416938..8a127be3952e 100755
--- a/pkgs/servers/asterisk/update.py
+++ b/pkgs/servers/asterisk/update.py
@@ -10,7 +10,7 @@ from pathlib import Path
 URL = "https://downloads.asterisk.org/pub/telephony/asterisk/"
 
 page = requests.get(URL)
-changelog = re.compile("^ChangeLog-\d+\.\d+\.\d+\.md$")
+changelog = re.compile(r"^ChangeLog-\d+\.\d+\.\d+\.md$")
 changelogs = [a.get_text() for a in BeautifulSoup(page.text, 'html.parser').find_all('a') if changelog.match(a.get_text())]
 major_versions = {}
 for changelog in changelogs:
diff --git a/pkgs/servers/asterisk/versions.json b/pkgs/servers/asterisk/versions.json
index 367ba20f8fc7..3b8142f6e35d 100644
--- a/pkgs/servers/asterisk/versions.json
+++ b/pkgs/servers/asterisk/versions.json
@@ -1,18 +1,18 @@
 {
   "asterisk_18": {
-    "sha256": "5df5d1c3885428b8bf03e78d7b8c3079d4512679137ef1d47e865dc2058aa825",
-    "version": "18.26.1"
+    "sha256": "745689c84d63ae94dfa0b3d4bdde3c6907b72472018532f757d9c0d169705964",
+    "version": "18.26.2"
   },
   "asterisk_20": {
-    "sha256": "5ad25c136c7772f0ad10ae02d59f19b32c0cf64027278e3de6a6314ee24d5ff9",
-    "version": "20.11.1"
+    "sha256": "7c45cf254c7442748fa14ba4e31ae8f09cd2ad958168577de091c0bf0b0a2d2e",
+    "version": "20.15.0"
   },
   "asterisk_21": {
-    "sha256": "8df00a37b448fdaf63ffe25be0df02112211c1617efcb00b21cdb58f1baed89d",
-    "version": "21.6.1"
+    "sha256": "16051efbcc6fb95c0408f0ecc9dcf2d78a9346323f5d1fcd9723faedcb0f3fd8",
+    "version": "21.10.0"
   },
   "asterisk_22": {
-    "sha256": "e697740d91c33bf02d506d4da04635da48bfb0b5bb79bf8863c1a9b8f791264f",
-    "version": "22.1.1"
+    "sha256": "944967288ec01587feeef42869a97baa37ab635bea7d539df16f70d3af48c613",
+    "version": "22.5.0"
   }
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 82bf52639856..37bbfc607b95 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1418,10 +1418,6 @@ with pkgs;
     in
     ppsspp.override argset;
 
-  punes = libsForQt5.callPackage ../applications/emulators/punes { };
-
-  punes-qt6 = qt6Packages.callPackage ../applications/emulators/punes { };
-
   py65 = with python3.pkgs; toPythonApplication py65;
 
   rmg-wayland = callPackage ../by-name/rm/rmg/package.nix {
@@ -10064,6 +10060,7 @@ with pkgs;
     asterisk-lts
     asterisk_18
     asterisk_20
+    asterisk_22
     ;
 
   asterisk-ldap = lowPrio (asterisk.override { ldapSupport = true; });
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 1e5e4e2af05d..7021483d12af 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4352,8 +4352,14 @@ self: super: with self; {
 
   dropmqttapi = callPackage ../development/python-modules/dropmqttapi { };
 
+  ds-analysis-lib = callPackage ../development/python-modules/ds-analysis-lib { };
+
+  ds-reporting-lib = callPackage ../development/python-modules/ds-reporting-lib { };
+
   ds-store = callPackage ../development/python-modules/ds-store { };
 
+  ds-xbom-lib = callPackage ../development/python-modules/ds-xbom-lib { };
+
   ds4drv = callPackage ../development/python-modules/ds4drv { };
 
   dscribe = callPackage ../development/python-modules/dscribe { };