diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index ce1be9fd1fcc..5ba06e83692f 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -7576,6 +7576,12 @@
     githubId = 20847625;
     name = "Elizabeth Paź";
   };
+  ehrenschwan-gh = {
+    email = "luca@ehrenschwan.dev";
+    github = "ehrenschwan-gh";
+    githubId = 25820532;
+    name = "Luca Schwan";
+  };
   eigengrau = {
     email = "seb@schattenkopie.de";
     name = "Sebastian Reuße";
@@ -24503,6 +24509,11 @@
     githubId = 46294732;
     name = "Sharzy";
   };
+  shaunren = {
+    name = "Shaun Ren";
+    github = "shaunren";
+    githubId = 388428;
+  };
   shavyn = {
     name = "Marco Desiderati";
     email = "desideratimarco@gmail.com";
@@ -25786,6 +25797,11 @@
     githubId = 7543617;
     name = "Struan Robertson";
   };
+  structix = {
+    github = "STRUCTiX";
+    githubId = 15931333;
+    name = "Janek";
+  };
   stteague = {
     email = "stteague505@yahoo.com";
     github = "stteague";
diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index a685d5e025c2..c1bdf097f317 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -58,6 +58,8 @@
 
 - [Ente Auth](https://ente.io/auth/), an open source 2FA authenticator, with end-to-end encrypted backups. Available as [programs.ente-auth](#opt-programs.ente-auth.enable).
 
+- [Tinyauth](https://tinyauth.app/), a simple authentication middleware for web apps, with OAuth and LDAP support. Available as [services.tinyauth](#opt-services.tinyauth.enable).
+
 - [Dawarich](https://dawarich.app/), a self-hostable location history tracker. Available as [services.dawarich](#opt-services.dawarich.enable).
 
 - [Howdy](https://github.com/boltgolt/howdy), a Windows Hello™ style facial authentication program for Linux.
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 75c6a35e5115..532ce6340f05 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1525,6 +1525,7 @@
   ./services/security/step-ca.nix
   ./services/security/tang.nix
   ./services/security/timekpr.nix
+  ./services/security/tinyauth.nix
   ./services/security/tor.nix
   ./services/security/torify.nix
   ./services/security/torsocks.nix
diff --git a/nixos/modules/programs/shadow.nix b/nixos/modules/programs/shadow.nix
index 12c9a84333bf..d6d48af0f877 100644
--- a/nixos/modules/programs/shadow.nix
+++ b/nixos/modules/programs/shadow.nix
@@ -22,6 +22,13 @@ in
       '';
     };
 
+    security.shadow.su.package = lib.mkPackageOption pkgs [ "shadow" "su" ] {
+      extraDescription = ''
+        This can be overridden by other modules (e.g. sudo-rs) to provide
+        an alternative `su` implementation.
+      '';
+    };
+
     security.loginDefs = {
       package = lib.mkPackageOption pkgs "shadow" { };
 
@@ -262,7 +269,7 @@ in
           };
         in
         {
-          su = mkSetuidRoot "${cfg.package.su}/bin/su";
+          su = mkSetuidRoot "${config.security.shadow.su.package}/bin/su";
           sg = mkSetuidRoot "${cfg.package.out}/bin/sg";
           newgrp = mkSetuidRoot "${cfg.package.out}/bin/newgrp";
           newuidmap = mkSetuidRoot "${cfg.package.out}/bin/newuidmap";
diff --git a/nixos/modules/security/sudo-rs.nix b/nixos/modules/security/sudo-rs.nix
index 50e50e77b851..7965bbe3c7f3 100644
--- a/nixos/modules/security/sudo-rs.nix
+++ b/nixos/modules/security/sudo-rs.nix
@@ -215,6 +215,8 @@ in
     ];
     security.sudo.enable = lib.mkDefault false;
 
+    security.shadow.su.package = lib.mkDefault cfg.package;
+
     security.sudo-rs.extraRules =
       let
         defaultRule =
diff --git a/nixos/modules/services/networking/suricata/default.nix b/nixos/modules/services/networking/suricata/default.nix
index bfab541097b6..2e17655fc1e8 100644
--- a/nixos/modules/services/networking/suricata/default.nix
+++ b/nixos/modules/services/networking/suricata/default.nix
@@ -117,15 +117,16 @@ in
       type = types.listOf types.str;
       # see: nix-shell -p suricata python3Packages.pyyaml --command 'suricata-update list-sources'
       default = [
+        "abuse.ch/sslbl-blacklist"
+        "abuse.ch/sslbl-c2"
+        "abuse.ch/sslbl-ja3"
         "et/open"
         "etnetera/aggressive"
         "stamus/lateral"
         "oisf/trafficid"
         "tgreen/hunting"
-        "sslbl/ja3-fingerprints"
-        "sslbl/ssl-fp-blacklist"
-        "malsilo/win-malware"
         "pawpatrules"
+        "ptrules/open"
       ];
       description = ''
         List of sources that should be enabled.
@@ -197,6 +198,17 @@ in
         "d ${cfg.settings."default-rule-path"} 755 ${cfg.settings.run-as.user} ${cfg.settings.run-as.group}"
       ];
 
+      systemd.timers = {
+        suricata-update = {
+          timerConfig = {
+            OnBootSec = lib.mkDefault "30s";
+            OnUnitActiveSec = lib.mkDefault "24h";
+            Persistent = true;
+            Unit = config.systemd.services.suricata-update.name;
+          };
+        };
+      };
+
       systemd.services = {
         suricata-update = {
           description = "Update Suricata Rules";
diff --git a/nixos/modules/services/security/tinyauth.nix b/nixos/modules/services/security/tinyauth.nix
new file mode 100644
index 000000000000..3cceabecfb64
--- /dev/null
+++ b/nixos/modules/services/security/tinyauth.nix
@@ -0,0 +1,246 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+
+let
+  inherit (lib)
+    getExe
+    maintainers
+    mapAttrs'
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    nameValuePair
+    optionalAttrs
+    types
+    ;
+
+  cfg = config.services.tinyauth;
+
+  format = pkgs.formats.keyValue { };
+  settingsFile = format.generate "tinyauth-env-vars" (
+    mapAttrs' (name: value: nameValuePair "TINYAUTH_${name}" value) cfg.settings
+  );
+in
+{
+  options.services.tinyauth = {
+    enable = mkEnableOption "Tinyauth server";
+
+    package = mkPackageOption pkgs "tinyauth" { };
+
+    environmentFile = mkOption {
+      type = types.path;
+      description = ''
+        Path to an environment file loaded for Tinyauth.
+
+        This can be used to securely store tokens and secrets outside of the world-readable Nix store.
+
+        Example contents of the file:
+        ```
+        TINYAUTH_AUTH_USERS=user-hash
+        TINYAUTH_OAUTH_PROVIDERS_GOOGLE_CLIENTSECRET=client-secret
+        ```
+      '';
+      default = "/dev/null";
+      example = "/var/lib/secrets/tinyauth";
+    };
+
+    settings = mkOption {
+      type = types.submodule {
+        freeformType = format.type;
+
+        options = {
+          SERVER_ADDRESS = mkOption {
+            type = types.str;
+            description = ''
+              Address to bind the server to.
+            '';
+            default = "0.0.0.0";
+          };
+
+          SERVER_PORT = mkOption {
+            type = types.port;
+            description = ''
+              The port to run the server on.
+            '';
+            default = 3000;
+          };
+
+          APPURL = mkOption {
+            type = types.str;
+            description = ''
+              URL of the app.
+            '';
+            example = "https://auth.example.com";
+          };
+
+          ANALYTICS_ENABLED = mkOption {
+            type = types.bool;
+            description = ''
+              Whether to enable anonymous version collection.
+            '';
+            default = false;
+          };
+
+          RESOURCES_ENABLED = mkOption {
+            type = types.bool;
+            description = ''
+              Whether to enable the resources server.
+            '';
+            default = true;
+          };
+
+          AUTH_LOGINMAXRETRIES = mkOption {
+            type = types.ints.unsigned;
+            description = ''
+              Maximum login attempts before timeout (0 to disable).
+            '';
+            default = 3;
+          };
+
+          AUTH_LOGINTIMEOUT = mkOption {
+            type = types.ints.unsigned;
+            description = ''
+              Login timeout in seconds after max retries reached (0 to disable).
+            '';
+            default = 300;
+          };
+
+          AUTH_TRUSTEDPROXIES = mkOption {
+            type = types.str;
+            description = ''
+              Comma-separated list of trusted proxy addresses.
+            '';
+            default = "";
+          };
+        };
+      };
+
+      default = { };
+
+      description = ''
+        Environment variables that will be passed to Tinyauth.
+        The "TINYAUTH_" prefix will be prepended to the setting names.
+        See [configuration options](https://tinyauth.app/docs/reference/configuration)
+        for supported values.
+      '';
+    };
+
+    dataDir = mkOption {
+      type = types.path;
+      default = "/var/lib/tinyauth";
+      description = ''
+        The directory where Tinyauth will store its data.
+      '';
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = "tinyauth";
+      description = "User account under which Tinyauth runs.";
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = "tinyauth";
+      description = "Group account under which Tinyauth runs.";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.tmpfiles.settings.tinyauth = {
+      "${cfg.dataDir}".d = {
+        mode = "0750";
+        user = cfg.user;
+        group = cfg.group;
+      };
+    };
+
+    systemd.services.tinyauth = {
+      description = "Tinyauth";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      restartTriggers = [
+        cfg.package
+        cfg.environmentFile
+        settingsFile
+      ];
+
+      environment = {
+        GIN_MODE = "release";
+        TINYAUTH_DATABASE_PATH = "${cfg.dataDir}/tinyauth.db";
+        TINYAUTH_RESOURCES_PATH = "${cfg.dataDir}/resources";
+      };
+
+      serviceConfig = {
+        Type = "simple";
+        User = cfg.user;
+        Group = cfg.group;
+        WorkingDirectory = cfg.dataDir;
+        ExecStart = getExe cfg.package;
+        Restart = "always";
+
+        EnvironmentFile = [
+          cfg.environmentFile
+          settingsFile
+        ];
+
+        # Hardening
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = "disconnected";
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        ReadWritePaths = [ cfg.dataDir ];
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        UMask = "0077";
+      };
+    };
+
+    users.users = optionalAttrs (cfg.user == "tinyauth") {
+      tinyauth = {
+        isSystemUser = true;
+        group = cfg.group;
+        description = "Tinyauth user";
+        home = cfg.dataDir;
+      };
+    };
+
+    users.groups = optionalAttrs (cfg.group == "tinyauth") {
+      tinyauth = { };
+    };
+  };
+
+  meta.maintainers = with maintainers; [ shaunren ];
+}
diff --git a/nixos/modules/services/web-apps/castopod.nix b/nixos/modules/services/web-apps/castopod.nix
index 1567ad1d2dc9..9bd82d9d5ef0 100644
--- a/nixos/modules/services/web-apps/castopod.nix
+++ b/nixos/modules/services/web-apps/castopod.nix
@@ -236,7 +236,7 @@ in
           ${
             if (cfg.database.passwordFile != null) then
               ''
-                echo "database.default.password=$(cat "$CREDENTIALS_DIRECTORY/dbpasswordfile)" >> ${envFile}
+                echo "database.default.password=$(<"$CREDENTIALS_DIRECTORY/dbpasswordfile")" >> ${envFile}
               ''
             else
               ''
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 322ce943c529..c20e978ea124 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1646,6 +1646,7 @@ in
   timezone = runTest ./timezone.nix;
   timidity = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./timidity { };
   tinc = handleTest ./tinc { };
+  tinyauth = runTest ./tinyauth.nix;
   tinydns = runTest ./tinydns.nix;
   tinyproxy = runTest ./tinyproxy.nix;
   tinywl = runTest ./tinywl.nix;
diff --git a/nixos/tests/shadow.nix b/nixos/tests/shadow.nix
index 04ee0a2bf95d..17ab1a3710ae 100644
--- a/nixos/tests/shadow.nix
+++ b/nixos/tests/shadow.nix
@@ -171,5 +171,10 @@ in
         shadow.wait_for_file("/tmp/leo")
         assert "leo" in shadow.succeed("cat /tmp/leo")
         shadow.send_chars("logout\n")
+
+    with subtest("su wrapper should point to shadow by default"):
+        output = shadow.succeed("grep -aoP '/nix/store/[a-z0-9]{32}-[^\\x00]+' /run/wrappers/bin/su | head -1").strip()
+        assert "shadow" in output, \
+            f"su should come from shadow, but points to: {output}"
   '';
 }
diff --git a/nixos/tests/sudo-rs.nix b/nixos/tests/sudo-rs.nix
index 7e691ef7e51b..62891ed01d53 100644
--- a/nixos/tests/sudo-rs.nix
+++ b/nixos/tests/sudo-rs.nix
@@ -162,5 +162,10 @@ in
 
       with subtest("non-wheel users should be unable to run sudo thanks to execWheelOnly"):
           strict.fail('faketty -- su - noadmin -c "sudo --help"')
+
+      with subtest("su should come from sudo-rs"):
+          output = machine.succeed("grep -aoP '/nix/store/[a-z0-9]{32}-[^\\x00]+' /run/wrappers/bin/su | head -1").strip()
+          assert "sudo-rs" in output, \
+              f"su should come from sudo-rs, but points to: {output}"
     '';
 }
diff --git a/nixos/tests/tinyauth.nix b/nixos/tests/tinyauth.nix
new file mode 100644
index 000000000000..c5abb3592429
--- /dev/null
+++ b/nixos/tests/tinyauth.nix
@@ -0,0 +1,31 @@
+{ lib, pkgs, ... }:
+
+let
+  port = 3001;
+in
+{
+  name = "tinyauth";
+  meta.maintainers = with lib.maintainers; [ shaunren ];
+
+  nodes.machine = {
+    services.tinyauth = {
+      enable = true;
+      settings = {
+        APPURL = "http://auth.example.com";
+        SERVER_PORT = port;
+        ANALYTICS_ENABLED = false;
+      };
+
+      environmentFile = pkgs.writeText "tinyauth-env" ''
+        TINYAUTH_AUTH_USERS=test:$$2a$$10$$NP5wKRFw5GuVVI.g07zvAucRYk0cyL83WDPVQ81Zai.Xi5tkNvxL6
+      '';
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("tinyauth.service")
+    machine.wait_for_open_port(${toString port})
+
+    machine.succeed("curl -sSf -H Host:auth.example.com http://localhost:${toString port}")
+  '';
+}
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/codesnap-nvim/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/codesnap-nvim/default.nix
index 9c886ec01a33..4d2f7094ba13 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/codesnap-nvim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/codesnap-nvim/default.nix
@@ -10,12 +10,12 @@
   nix-update-script,
 }:
 let
-  version = "2.0.0";
+  version = "2.0.1";
   src = fetchFromGitHub {
     owner = "mistricky";
     repo = "codesnap.nvim";
     tag = "v${version}";
-    hash = "sha256-gpsNug6lSc/AifW8DeJy9R3LYuiTStuYZV02MiIZhq8=";
+    hash = "sha256-pYBB647UX3okpfUlZ3MhrlEwILXv/V0r42j7xp4aDO0=";
   };
   codesnap-lib = rustPlatform.buildRustPackage {
     pname = "codesnap-lib";
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 86af5c7b5f06..e8f90c49f903 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -200,13 +200,13 @@
     "vendorHash": "sha256-w21DXJoylvysubXItM+wvuwD2RdqzoUKNC9zElTedEo="
   },
   "cloudflare_cloudflare": {
-    "hash": "sha256-RuHAVcDK3KPO4I4FG/DodhNiWe63AexTo9IcyTZ360Q=",
+    "hash": "sha256-D5Kk6xCz3CQWbGHjLKU/+SPBzCYFQlphCTMG6+LvFek=",
     "homepage": "https://registry.terraform.io/providers/cloudflare/cloudflare",
     "owner": "cloudflare",
     "repo": "terraform-provider-cloudflare",
-    "rev": "v5.17.0",
+    "rev": "v5.18.0",
     "spdx": "Apache-2.0",
-    "vendorHash": "sha256-Z3qSDIkzD4hs2WREuV06q4GC+qwMvfHvsnze/8c7f20="
+    "vendorHash": "sha256-8d6cnbdPhfc/9B8JUq1HbReOYBauY6SQf3xKqgK1PeQ="
   },
   "cloudfoundry-community_cloudfoundry": {
     "hash": "sha256-1nYncJLVU/f9WD6Quh9IieIXgixPzbPk4zbtI1zmf9g=",
@@ -1076,11 +1076,11 @@
     "vendorHash": "sha256-F1AuO/dkldEDRvkwrbq2EjByxjg3K2rohZAM4DzKPUw="
   },
   "pagerduty_pagerduty": {
-    "hash": "sha256-UJ5XTAECoZMAcQayespmVFKyv8lJ/9CJIS0bJxn9+S4=",
+    "hash": "sha256-xuy7bc+YRDsEenMRfaCpV6uBAopjYbrCmOFzdowTqYM=",
     "homepage": "https://registry.terraform.io/providers/PagerDuty/pagerduty",
     "owner": "PagerDuty",
     "repo": "terraform-provider-pagerduty",
-    "rev": "v3.31.2",
+    "rev": "v3.31.3",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1499,12 +1499,12 @@
     "vendorHash": "sha256-Z4DfoG4ApXbPNXZs9YvBWQj1bH7moLNI6P+nKDHt/Jc="
   },
   "yandex-cloud_yandex": {
-    "hash": "sha256-TitL9PaqN2j4mDz1yCz4Mqde1CxIG4Z2sJFm3emsVRM=",
+    "hash": "sha256-/rOaPVyWKEdcHMfjpetpVCxaibOWQT6O+32vQ6Zp324=",
     "homepage": "https://registry.terraform.io/providers/yandex-cloud/yandex",
     "owner": "yandex-cloud",
     "repo": "terraform-provider-yandex",
-    "rev": "v0.189.0",
+    "rev": "v0.191.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-ZYVGqcviq7auN2JwqHEFWiFPvy+PkaYV7MamNKF8Frc="
+    "vendorHash": "sha256-RXyiOBOedsA+DzbTXaeKMeZhM/ABMSDwzprDMpfSvmU="
   }
 }
diff --git a/pkgs/by-name/al/alt-tab-macos/package.nix b/pkgs/by-name/al/alt-tab-macos/package.nix
index e788ac297efb..b70c74a9f021 100644
--- a/pkgs/by-name/al/alt-tab-macos/package.nix
+++ b/pkgs/by-name/al/alt-tab-macos/package.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "alt-tab-macos";
-  version = "8.3.4";
+  version = "10.4.0";
 
   src = fetchurl {
     url = "https://github.com/lwouis/alt-tab-macos/releases/download/v${finalAttrs.version}/AltTab-${finalAttrs.version}.zip";
-    hash = "sha256-I5Dx/71+rY6qThE8ton4EtDtcfMQzx4Yle+1tpOAkDI=";
+    hash = "sha256-CbeQi50EbGP+GoXLN/M8iLJ65RI6awXjDoPzEB8Pb38=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/by-name/ap/apko/package.nix b/pkgs/by-name/ap/apko/package.nix
index 988c6ea5f160..43da427faabd 100644
--- a/pkgs/by-name/ap/apko/package.nix
+++ b/pkgs/by-name/ap/apko/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "apko";
-  version = "1.1.11";
+  version = "1.1.12";
 
   src = fetchFromGitHub {
     owner = "chainguard-dev";
     repo = "apko";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vBX1uFYIDOLrws6LQ2lccPxCwNVes8mw2Mx4uXSZhm0=";
+    hash = "sha256-UqvmHIHHMNJ3VX6UT/CdK6vhrAW6TLwtfvmRPPGXjVI=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -29,7 +29,7 @@ buildGoModule (finalAttrs: {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorHash = "sha256-9UWCqFSKCrjPUaOypcmkk6TvMZE9xPLPj06fEzduqMY=";
+  vendorHash = "sha256-Pi0egpWT/12CZI84NtJKYpRT7OwzwF9MTq9Q+9DN2cw=";
 
   excludedPackages = [
     "internal/gen-jsonschema"
@@ -96,7 +96,6 @@ buildGoModule (finalAttrs: {
     maintainers = with lib.maintainers; [
       jk
       developer-guy
-      emilylange
     ];
   };
 })
diff --git a/pkgs/by-name/ap/apl387/package.nix b/pkgs/by-name/ap/apl387/package.nix
new file mode 100644
index 000000000000..2e776e644600
--- /dev/null
+++ b/pkgs/by-name/ap/apl387/package.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  installFonts,
+  python3,
+  fontforge,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "apl387";
+  version = "0-unstable-2025-12-13";
+
+  src = fetchFromGitHub {
+    owner = "dyalog";
+    repo = "APL387";
+    rev = "60ff47a728ee043f878dc2ed801d53e29fcebe9d";
+    hash = "sha256-VyO+7PUYcmmhbFVAW37yvWQLUpt0K/ihA/JGmbt+4Uk=";
+  };
+
+  nativeBuildInputs = [
+    python3
+    fontforge
+    installFonts
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+    ${python3.executable} script.py . "${finalAttrs.src.rev}"
+    runHook postBuild
+  '';
+
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
+  postInstall = ''
+    installFont svg $out/share/fonts/svg
+  '';
+
+  meta = {
+    homepage = "https://dyalog.github.io/APL387";
+    description = "Redrawn and extended version of Adrian Smith's classic APL385 font with clean rounded look";
+    license = lib.licenses.unlicense;
+    maintainers = [
+      lib.maintainers.sternenseemann
+      lib.maintainers.sigmanificient
+    ];
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/ar/argonaut/package.nix b/pkgs/by-name/ar/argonaut/package.nix
new file mode 100644
index 000000000000..4625009caec2
--- /dev/null
+++ b/pkgs/by-name/ar/argonaut/package.nix
@@ -0,0 +1,53 @@
+{
+  buildGoModule,
+  lib,
+  fetchFromGitHub,
+  testers,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "argonaut";
+  version = "2.14.1";
+
+  src = fetchFromGitHub {
+    owner = "darksworm";
+    repo = "argonaut";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-vD7XDgENQWexNNMq41W0eC0snUA+JUZeXIBTCH1lbks=";
+  };
+
+  vendorHash = "sha256-xln/WmZbi0+rHqMMHRgt0ar/EaBDNscCsd/NckJZnMw=";
+  proxyVendor = true;
+  subPackages = [ "cmd/app" ];
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.appVersion=${finalAttrs.version}"
+    "-X main.commit=${finalAttrs.version}"
+    "-X main.buildDate=1970-01-01T00:00:00Z"
+  ];
+
+  doCheck = true;
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  postInstall = ''
+    mv $out/bin/app $out/bin/argonaut
+  '';
+
+  meta = {
+    description = "Keyboard-first terminal UI for Argo CD";
+    homepage = "https://github.com/darksworm/argonaut";
+    changelog = "https://github.com/darksworm/argonaut/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "argonaut";
+    maintainers = with lib.maintainers; [
+      ehrenschwan-gh
+    ];
+  };
+})
diff --git a/pkgs/by-name/aw/aws-lc/package.nix b/pkgs/by-name/aw/aws-lc/package.nix
index 29d3068f3676..82c9506c9ca5 100644
--- a/pkgs/by-name/aw/aws-lc/package.nix
+++ b/pkgs/by-name/aw/aws-lc/package.nix
@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-lc";
-  version = "1.67.0";
+  version = "1.69.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-lc";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-p58Re3HvBY/nzyCFvM5Ntx7Mb5OgcNQoZNloAJitDTY=";
+    hash = "sha256-ykpPbMONAJK6rEANOn0O7JfIkXPSoPXs1Zr4Bv+eXqQ=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ch/charls/package.nix b/pkgs/by-name/ch/charls/package.nix
index d62da5e9670f..d00e450b37f5 100644
--- a/pkgs/by-name/ch/charls/package.nix
+++ b/pkgs/by-name/ch/charls/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "charls";
-  version = "2.4.2";
+  version = "2.4.3";
 
   src = fetchFromGitHub {
     owner = "team-charls";
     repo = "charls";
     tag = finalAttrs.version;
-    hash = "sha256-c1wrk6JLcAH7TFPwjARlggaKXrAsLWyUQF/3WHlqoqg=";
+    hash = "sha256-U21SdVRTPNI5BFGOyM3Y/ByKDP6ZI2g/BtAJYXH5Dv4=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/cl/classicube/fix-linking.patch b/pkgs/by-name/cl/classicube/fix-linking.patch
deleted file mode 100644
index a35d19caaca4..000000000000
--- a/pkgs/by-name/cl/classicube/fix-linking.patch
+++ /dev/null
@@ -1,14 +0,0 @@
-diff --git a/Makefile b/Makefile
-index a10eb5214..70e2f720e 100644
---- a/Makefile
-+++ b/Makefile
-@@ -55,7 +55,7 @@ endif
- 
- ifeq ($(PLAT),linux)
- 	CFLAGS  += -DCC_BUILD_ICON
--	LIBS    =  -lX11 -lXi -lpthread -lGL -ldl
-+	LIBS    =  -lX11 -lXi -lpthread -lGL -ldl -lcurl -lopenal
- 	BUILD_DIR = build-linux
- endif
- 
-
diff --git a/pkgs/by-name/cl/classicube/package.nix b/pkgs/by-name/cl/classicube/package.nix
index 4076d261d389..8caab86b7259 100644
--- a/pkgs/by-name/cl/classicube/package.nix
+++ b/pkgs/by-name/cl/classicube/package.nix
@@ -14,15 +14,15 @@
   liberation_ttf,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "ClassiCube";
-  version = "1.3.7";
+  version = "1.3.8";
 
   src = fetchFromGitHub {
     owner = "UnknownShadow200";
     repo = "ClassiCube";
-    rev = version;
-    sha256 = "sha256-ZITyfxkQB4Jpm2ZsQyM+ouPLqCVmGB7UZRXDSU/BX0k=";
+    tag = finalAttrs.version;
+    hash = "sha256-AF4cr3ZXCixwiihS+2ayrzVH5eYShkjlfF0myb2PbHM=";
   };
 
   nativeBuildInputs = [
@@ -33,8 +33,8 @@ stdenv.mkDerivation rec {
 
   desktopItems = [
     (makeDesktopItem {
-      name = pname;
-      desktopName = pname;
+      name = finalAttrs.pname;
+      desktopName = finalAttrs.pname;
       genericName = "Sandbox Block Game";
       exec = "ClassiCube";
       icon = "CCicon";
@@ -52,9 +52,6 @@ stdenv.mkDerivation rec {
   patches = [
     # Fix hardcoded font paths
     ./font-location.patch
-    # For some reason, the Makefile doesn't link
-    # with libcurl and openal when ClassiCube requires them.
-    ./fix-linking.patch
   ];
 
   font_path = "${liberation_ttf}/share/fonts/truetype";
@@ -66,11 +63,12 @@ stdenv.mkDerivation rec {
     # This changes the hardcoded location
     # to the path of liberation_ttf instead
     substituteInPlace src/Platform_Posix.c \
-      --replace '%NIXPKGS_FONT_PATH%' "${font_path}"
-    # ClassiCube's Makefile hardcodes JOBS=1 for some reason,
-    # even though it works perfectly well multi-threaded.
+      --replace-fail '%NIXPKGS_FONT_PATH%' "${finalAttrs.font_path}"
+    # For some reason, the Makefile doesn't link
+    # with libcurl and openal when ClassiCube requires them.
     substituteInPlace Makefile \
-      --replace 'JOBS=1' "JOBS=$NIX_BUILD_CORES"
+      --replace-fail '-lX11 -lXi -lpthread -lGL -ldl -lm' \
+                     '-lX11 -lXi -lpthread -lGL -ldl -lm -lcurl -lopenal'
   '';
 
   buildInputs = [
@@ -111,4 +109,4 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [ _360ied ];
     mainProgram = "ClassiCube";
   };
-}
+})
diff --git a/pkgs/by-name/de/deezer-desktop/package.nix b/pkgs/by-name/de/deezer-desktop/package.nix
new file mode 100644
index 000000000000..ee9556a02ace
--- /dev/null
+++ b/pkgs/by-name/de/deezer-desktop/package.nix
@@ -0,0 +1,74 @@
+{
+  stdenv,
+  lib,
+  fetchurl,
+  makeWrapper,
+  electron,
+}:
+
+let
+  version = "7.1.100";
+  srcs = {
+    x86_64-linux = fetchurl {
+      url = "https://github.com/aunetx/deezer-linux/releases/download/v${version}/deezer-desktop-${version}-x64.tar.xz";
+      hash = "sha256-KU7dmXXJGLVoDf/iHP3LBcbc/+ldTdYsRD3LyGvbvZc=";
+    };
+    aarch64-linux = fetchurl {
+      url = "https://github.com/aunetx/deezer-linux/releases/download/v${version}/deezer-desktop-${version}-arm64.tar.xz";
+      hash = "sha256-sLso74DJaJK/o8cYYHEI/XNXjcl1MgfkegsCEOw+79Y=";
+    };
+  };
+
+  src = srcs.${stdenv.hostPlatform.system} or (throw "${stdenv.hostPlatform.system} not supported");
+
+  # Architecture string for directory names
+  archDir =
+    if stdenv.hostPlatform.isx86_64 then
+      "x64"
+    else if stdenv.hostPlatform.isAarch64 then
+      "arm64"
+    else
+      throw "Unsupported architecture";
+in
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "deezer-desktop";
+  inherit version src;
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  sourceRoot = ".";
+
+  dontBuild = true;
+  installPhase = ''
+    runHook preInstall
+    install -d $out/bin $out/share/deezer-desktop/resources $out/share/applications $out/share/icons/hicolor/scalable/apps
+
+    substituteInPlace deezer-desktop-${version}-${archDir}/resources/dev.aunetx.deezer.desktop \
+      --replace-fail "run.sh" "deezer-desktop" \
+      --replace-fail "dev.aunetx.deezer" "deezer-desktop"
+    cp deezer-desktop-${version}-${archDir}/resources/dev.aunetx.deezer.desktop $out/share/applications/deezer-desktop.desktop
+    cp deezer-desktop-${version}-${archDir}/resources/dev.aunetx.deezer.svg $out/share/icons/hicolor/scalable/apps/deezer-desktop.svg
+    cp -r deezer-desktop-${version}-${archDir}/resources/{app.asar,linux} $out/share/deezer-desktop/resources/
+
+    makeWrapper "${lib.getExe electron}" "$out/bin/deezer-desktop" \
+      --inherit-argv0 \
+      --add-flags "$out/share/deezer-desktop/resources/app.asar" \
+      --set-default ELECTRON_FORCE_IS_PACKAGED 1 \
+      --set DZ_RESOURCES_PATH "$out/share/deezer-desktop/resources"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Unofficial Linux port of the music streaming application";
+    homepage = "https://github.com/aunetx/deezer-linux";
+    downloadPage = "https://github.com/aunetx/deezer-linux/releases";
+    platforms = lib.platforms.linux;
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ FelixLusseau ];
+    mainProgram = "deezer-desktop";
+  };
+})
diff --git a/pkgs/by-name/de/devcontainer/package.nix b/pkgs/by-name/de/devcontainer/package.nix
index ff4b6d705edd..325de7adbae2 100644
--- a/pkgs/by-name/de/devcontainer/package.nix
+++ b/pkgs/by-name/de/devcontainer/package.nix
@@ -16,18 +16,18 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "devcontainer";
-  version = "0.83.0";
+  version = "0.84.0";
 
   src = fetchFromGitHub {
     owner = "devcontainers";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rFp7u+swJdA3wKR6bAfPUIXomwyN5v1oKfu/Y/hflx0=";
+    hash = "sha256-gXhGMMSTBEK5uwtTjc/NxUiaW8unjAihbLsH6qM8ukk=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-aVjhIb46CjUS+IEfS5O7I2apAC51UfjPj16q/GNsIzI=";
+    hash = "sha256-yTetnr4Z1qqSPwfQHuR7uqQpDFPFHlGu6+//yoIx1jA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/de/devenv/package.nix b/pkgs/by-name/de/devenv/package.nix
index 208cdc7e6988..d00a52ada07f 100644
--- a/pkgs/by-name/de/devenv/package.nix
+++ b/pkgs/by-name/de/devenv/package.nix
@@ -23,16 +23,16 @@
 }:
 
 let
-  version = "2.0.2";
+  version = "2.0.3";
   devenvNixVersion = "2.32";
-  devenvNixRev = "7eb6c427c7a86fdc3ebf9e6cbf2a84e80e8974fd";
+  devenvNixRev = "41eee9d3b1f611b1b90d51caa858b6d83834c44a";
 
   nix_components =
     (nixVersions.nixComponents_git.overrideSource (fetchFromGitHub {
       owner = "cachix";
       repo = "nix";
       rev = devenvNixRev;
-      hash = "sha256-H26FQmOyvIGnedfAioparJQD8Oe+/byD6OpUpnI/hkE=";
+      hash = "sha256-vtf03lfgQKNkPH9FdXdboBDS5DtFkXB8xRw5EBpuDas=";
     })).overrideScope
       (
         finalScope: prevScope: {
@@ -48,16 +48,15 @@ rustPlatform.buildRustPackage {
     owner = "cachix";
     repo = "devenv";
     tag = "v${version}";
-    hash = "sha256-38crLoAfEOdnEDDZD2NyAEDVlBSFn+MlZyLwztAsC8Q=";
+    hash = "sha256-1DpF5F7zgOZ7QrRjz23315pUoF532dHnsU/V4UQithk=";
   };
 
-  cargoHash = "sha256-e56HmkS+p8P/X7vS+hTT78lfQ2YDCuONM+6yW0RIfSE=";
+  cargoHash = "sha256-gZFRbTDPQNKf2msBv9wOavaH1iB1Tk3shYf0/4TSZBQ=";
 
   env = {
     RUSTFLAGS = "--cfg tracing_unstable";
     LIBSQLITE3_SYS_USE_PKG_CONFIG = "1";
-    VERGEN_IDEMPOTENT = "1";
-    DEVENV_ON_RELEASE_TAG = true;
+    DEVENV_IS_RELEASE = true;
   };
 
   cargoBuildFlags = [
diff --git a/pkgs/by-name/do/dolphin-emu/package.nix b/pkgs/by-name/do/dolphin-emu/package.nix
index b23dab82c6a7..5d520d64927d 100644
--- a/pkgs/by-name/do/dolphin-emu/package.nix
+++ b/pkgs/by-name/do/dolphin-emu/package.nix
@@ -198,10 +198,6 @@ stdenv.mkDerivation (finalAttrs: {
     branch = "master";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.unix;
-    badPlatforms = [
-      # error: implicit instantiation of undefined template 'std::char_traits<unsigned int>'
-      lib.systems.inspect.patterns.isDarwin
-    ];
     maintainers = with lib.maintainers; [ pbsds ];
   };
 })
diff --git a/pkgs/by-name/du/duckstation/package.nix b/pkgs/by-name/du/duckstation/package.nix
index 374380073240..c6c7bef1f66d 100644
--- a/pkgs/by-name/du/duckstation/package.nix
+++ b/pkgs/by-name/du/duckstation/package.nix
@@ -51,9 +51,7 @@ let
     '';
     homepage = "https://duckstation.org";
     license = lib.licenses.cc-by-nc-nd-40;
-    maintainers = with lib.maintainers; [
-      matteopacini
-    ];
+    maintainers = [ ];
   };
 
   pkgSources = lib.importJSON ./sources.json;
diff --git a/pkgs/by-name/ed/edk2/package.nix b/pkgs/by-name/ed/edk2/package.nix
index f37043b1d54e..32d2848178e1 100644
--- a/pkgs/by-name/ed/edk2/package.nix
+++ b/pkgs/by-name/ed/edk2/package.nix
@@ -182,8 +182,6 @@ stdenv.mkDerivation (finalAttrs: {
           ++ attrs.nativeBuildInputs or [ ];
           strictDeps = true;
 
-          env.${"GCC5_${targetArch}_PREFIX"} = stdenv.cc.targetPrefix;
-
           prePatch = ''
             rm -rf BaseTools
             ln -sv ${buildPackages.edk2}/BaseTools BaseTools
@@ -211,7 +209,14 @@ stdenv.mkDerivation (finalAttrs: {
         // removeAttrs attrs [
           "nativeBuildInputs"
           "depsBuildBuild"
+          "env"
         ]
+        // {
+          env = {
+            ${"GCC5_${targetArch}_PREFIX"} = stdenv.cc.targetPrefix;
+          }
+          // (attrs.env or { });
+        }
       );
   };
 })
diff --git a/pkgs/by-name/en/enzyme/package.nix b/pkgs/by-name/en/enzyme/package.nix
index 9f34ddd41e0a..5613977152eb 100644
--- a/pkgs/by-name/en/enzyme/package.nix
+++ b/pkgs/by-name/en/enzyme/package.nix
@@ -7,13 +7,13 @@
 }:
 llvmPackages.stdenv.mkDerivation rec {
   pname = "enzyme";
-  version = "0.0.249";
+  version = "0.0.250";
 
   src = fetchFromGitHub {
     owner = "EnzymeAD";
     repo = "Enzyme";
     rev = "v${version}";
-    hash = "sha256-M15AUk5x/vB6TpWVXueXGAChnlVvKCgrQxJb6tY2Y0M=";
+    hash = "sha256-wyvYVI/HmCtBwIb1mIYJ/p2YQTH8fleP3xPUZsMeb1U=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/fa/faiss/package.nix b/pkgs/by-name/fa/faiss/package.nix
index c38b23b0704d..184c1cc53b22 100644
--- a/pkgs/by-name/fa/faiss/package.nix
+++ b/pkgs/by-name/fa/faiss/package.nix
@@ -42,7 +42,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "faiss";
-  version = "1.13.2";
+  version = "1.14.1";
 
   outputs = [ "out" ] ++ lib.optionals pythonSupport [ "dist" ];
 
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "facebookresearch";
     repo = "faiss";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EiqkOkMI65T2kNNMQvjl51GIN4XGzTKpkpQ3ImFa3rs=";
+    hash = "sha256-+7BgxSvVEqdwT3fGqK62nysFLZMpLXeQwVXcvP9pgqQ=";
   };
 
   nativeBuildInputs = [
@@ -107,7 +107,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Library for efficient similarity search and clustering of dense vectors by Facebook Research";
     mainProgram = "demo_ivfpq_indexing";
     homepage = "https://github.com/facebookresearch/faiss";
-    changelog = "https://github.com/facebookresearch/faiss/blob/v${finalAttrs.version}/CHANGELOG.md";
+    changelog = "https://github.com/facebookresearch/faiss/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ SomeoneSerge ];
diff --git a/pkgs/by-name/fe/fermyon-spin/package.nix b/pkgs/by-name/fe/fermyon-spin/package.nix
index 8329af29b065..104ebe0d78d9 100644
--- a/pkgs/by-name/fe/fermyon-spin/package.nix
+++ b/pkgs/by-name/fe/fermyon-spin/package.nix
@@ -20,17 +20,17 @@ let
     .${system} or (throw "Unsupported system: ${system}");
 
   packageHashes = {
-    x86_64-linux = "sha256-B+LKXK7DFakiFNdanaqMeGxnfxoEI4caNtxnyZEcWgQ=";
-    aarch64-linux = "sha256-FMYIO1miEulnz9logtXxau2mIuR1zS8oCG04DMx0HyQ=";
-    x86_64-darwin = "sha256-I3Z1QqIu0iJBZWq6fUWouGfTYzNr/wj+0UFfq0wSy4Y=";
-    aarch64-darwin = "sha256-AL1TUJO5jSNhjfZ/rLo9Do22oqVhpLqiRdGnvVaqvog=";
+    x86_64-linux = "sha256-xlBByHwsyV/ygbQZf1k4cWCI7jqcuufseVpNc4lERaM=";
+    aarch64-linux = "sha256-7/UEYdPsedLEqa/kCR23lz4tmhkhYVwFkXutRAtF8eo=";
+    x86_64-darwin = "sha256-IeA5VWobAZtBsmE15U57PmwWRGhW0l+abytRA9AEERk=";
+    aarch64-darwin = "sha256-HwO3G6MnQP8yG4rzQKt1GkxCfuSSOtC1zOrSNWQzxx4=";
   };
 
   packageHash = packageHashes.${system} or (throw "Unsupported system: ${system}");
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "fermyon-spin";
-  version = "3.5.1";
+  version = "3.6.2";
 
   # Use fetchurl rather than fetchzip as these tarballs are built by the project
   # and not by GitHub (and thus are stable) - this simplifies the update script
diff --git a/pkgs/by-name/fo/fokus/package.nix b/pkgs/by-name/fo/fokus/package.nix
new file mode 100644
index 000000000000..0ac85516f8a5
--- /dev/null
+++ b/pkgs/by-name/fo/fokus/package.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  kdePackages,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "fokus";
+  version = "2.3.3";
+
+  src = fetchFromGitLab {
+    owner = "divinae";
+    repo = "focus-plasmoid";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-S/0hAAt9zzj8pP5juFDvT0Z2B+GKpFnBsIVdJjSEakI=";
+  };
+
+  dontWrapQtApps = true;
+
+  postPatch = ''
+    substituteInPlace package/contents/config/main.xml package/contents/ui/configNotifications.qml \
+         --replace-fail "/usr/share/sounds" "${kdePackages.ocean-sound-theme}/share/sounds"
+
+    substituteInPlace package/contents/ui/configNotifications.qml package/contents/ui/configScripts.qml package/contents/ui/main.qml package/contents/ui/NotificationManager.qml \
+         --replace-fail 'import QtMultimedia' 'import "file://${kdePackages.qtmultimedia}/lib/qt-6/qml/QtMultimedia"'
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/plasma/plasmoids/com.dv.fokus
+    cp -r package/* $out/share/plasma/plasmoids/com.dv.fokus/
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Simple pomodoro KDE Plasma plasmoid";
+    homepage = "https://gitlab.com/divinae/focus-plasmoid";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ structix ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/gp/gpauth/package.nix b/pkgs/by-name/gp/gpauth/package.nix
index 37f4afd5aa29..0ebd8cb93433 100644
--- a/pkgs/by-name/gp/gpauth/package.nix
+++ b/pkgs/by-name/gp/gpauth/package.nix
@@ -12,19 +12,19 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gpauth";
-  version = "2.5.0";
+  version = "2.5.1";
 
   src = fetchFromGitHub {
     owner = "yuezk";
     repo = "GlobalProtect-openconnect";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dxRqf5iOlgJegeAqtTwoVqNHXU3eOse5eMYFknhAh2M=";
+    hash = "sha256-rux2rToqs5GZEDTryPAkm62yGdhWfEqapTMQOGyqCRI=";
     fetchSubmodules = true;
   };
 
   buildAndTestSubdir = "apps/gpauth";
 
-  cargoHash = "sha256-VkDq98Y6uBSal7m4V9vjW1XermOPOWulo3Jo34QFRsA=";
+  cargoHash = "sha256-xza7AfuOcSUkDyliGHUx9bEd+M94d23xVrVVvZo2nas=";
 
   nativeBuildInputs = [
     perl
diff --git a/pkgs/by-name/gp/gpclient/package.nix b/pkgs/by-name/gp/gpclient/package.nix
index 14c334bb4a5e..bdd6c40375ac 100644
--- a/pkgs/by-name/gp/gpclient/package.nix
+++ b/pkgs/by-name/gp/gpclient/package.nix
@@ -1,43 +1,43 @@
 {
   lib,
   rustPlatform,
-  glib-networking,
   stdenv,
-  gpauth,
-  makeWrapper,
+  atk,
   autoconf,
   automake,
+  cairo,
+  glib,
+  glib-networking,
+  gnutls,
+  gpauth,
+  gtk3,
   libtool,
+  libxml2,
+  lz4,
+  makeBinaryWrapper,
   openssl,
+  p11-kit,
+  pango,
   perl,
   pkg-config,
   vpnc-scripts,
-  glib,
-  pango,
-  cairo,
-  atk,
-  gtk3,
-  libxml2,
-  p11-kit,
-  lz4,
-  gnutls,
 }:
 
 rustPlatform.buildRustPackage {
   pname = "gpclient";
 
   inherit (gpauth)
-    src
-    version
     cargoHash
     meta
+    src
+    version
     ;
 
   buildAndTestSubdir = "apps/gpclient";
 
   nativeBuildInputs = [
+    makeBinaryWrapper
     perl
-    makeWrapper
     pkg-config
 
     # used to build vendored openconnect
@@ -46,37 +46,49 @@ rustPlatform.buildRustPackage {
     libtool
   ];
   buildInputs = [
+    glib
+    glib-networking
     gpauth
     openssl
-    glib-networking
-    glib
-    pango
-    cairo
-    atk
-    gtk3
 
     # used for vendored openconnect
+    gnutls
     libxml2
     lz4
     p11-kit
-    gnutls
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    atk
+    cairo
+    gtk3
+    pango
   ];
 
   postPatch = ''
-    substituteInPlace crates/common/src/constants.rs \
-      --replace-fail /usr/bin/gpauth ${gpauth}/bin/gpauth
     substituteInPlace crates/openconnect/src/vpn_utils.rs \
-      --replace-fail /usr/sbin/vpnc-script ${vpnc-scripts}/bin/vpnc-script
-    substituteInPlace packaging/files/usr/share/applications/gpgui.desktop \
-      --replace-fail /usr/bin/gpclient gpclient
+      --replace-fail /etc/vpnc/vpnc-script ${vpnc-scripts}/bin/vpnc-script \
+      --replace-fail /usr/libexec/gpclient/hipreport.sh $out/libexec/gpclient/hipreport.sh
+
+    substituteInPlace crates/common/src/constants.rs \
+      --replace-fail /usr/bin/gpclient $out/bin/gpclient \
+      --replace-fail /usr/bin/gpservice $out/bin/gpservice \
+      --replace-fail /usr/bin/gpauth ${gpauth}/bin/gpauth \
+      --replace-fail /opt/homebrew/ $out/
   '';
 
-  postInstall = lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
-    mkdir -p $out/share/applications
-    cp packaging/files/usr/share/applications/gpgui.desktop $out/share/applications/gpgui.desktop
+  postInstall = ''
+    cp -r packaging/files/usr/libexec $out/libexec
+
+    substituteInPlace $out/libexec/gpclient/hipreport.sh \
+      --replace-fail /usr/bin/gpclient $out/bin/gpclient
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
+    cp -r packaging/files/usr/lib $out/lib
+    substituteInPlace $out/lib/NetworkManager/dispatcher.d/pre-down.d/gpclient.down \
+      --replace-fail /usr/bin/gpclient $out/bin/gpclient
   '';
 
-  preFixup = ''
+  postFixup = ''
     wrapProgram "$out/bin/gpclient" \
       --prefix GIO_EXTRA_MODULES : ${glib-networking}/lib/gio/modules
   '';
diff --git a/pkgs/by-name/gr/groovy/package.nix b/pkgs/by-name/gr/groovy/package.nix
index 2f898a97000f..453da0c52e72 100644
--- a/pkgs/by-name/gr/groovy/package.nix
+++ b/pkgs/by-name/gr/groovy/package.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "groovy";
-  version = "5.0.2";
+  version = "5.0.4";
 
   src = fetchurl {
     url = "mirror://apache/groovy/${finalAttrs.version}/distribution/apache-groovy-binary-${finalAttrs.version}.zip";
-    sha256 = "sha256-cPgvEbG3ZOIH3PVWiILHjcdyk/MHgWJCOUo/enTyDoE=";
+    hash = "sha256-Xl6aRo1DRODI7gzWjGJ1HM9OX4+E162birxqAQFLn3k=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gw/gws/package.nix b/pkgs/by-name/gw/gws/package.nix
new file mode 100644
index 000000000000..1e6d45cc66b8
--- /dev/null
+++ b/pkgs/by-name/gw/gws/package.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  dbus,
+  apple-sdk_14,
+  darwinMinVersionHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "gws";
+  version = "0.6.3";
+
+  src = fetchFromGitHub {
+    owner = "googleworkspace";
+    repo = "cli";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-8vRBW7RUwHHAvAiF8WahkRh0pH205UiuJloY0DgFwLM=";
+  };
+
+  cargoHash = "sha256-tIJikoRFbUYYlkOjfWoPogoB+yhY80TTtSzEXgSEP8A=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs =
+    lib.optionals stdenv.hostPlatform.isLinux [ dbus ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      apple-sdk_14
+      (darwinMinVersionHook "10.15")
+    ];
+
+  doCheck = false;
+
+  meta = {
+    description = "One CLI for all of Google Workspace";
+    homepage = "https://github.com/googleworkspace/cli";
+    changelog = "https://github.com/googleworkspace/cli/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    mainProgram = "gws";
+    maintainers = with lib.maintainers; [ imalison ];
+  };
+})
diff --git a/pkgs/by-name/in/intel-compute-runtime/package.nix b/pkgs/by-name/in/intel-compute-runtime/package.nix
index 9f8462c012f4..fde782d02e58 100644
--- a/pkgs/by-name/in/intel-compute-runtime/package.nix
+++ b/pkgs/by-name/in/intel-compute-runtime/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "intel-compute-runtime";
-  version = "26.01.36711.4";
+  version = "26.05.37020.3";
 
   src = fetchFromGitHub {
     owner = "intel";
     repo = "compute-runtime";
     tag = finalAttrs.version;
-    hash = "sha256-77fVA2T6niK2a9i6v6sAR98fHnExbHqRdHexKBkqd7M=";
+    hash = "sha256-V5PoGvUJtNL9Y7RkFWqhpYEbpiqv3Gj4GB1uBUKOvNg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/in/intelephense/package-lock.json b/pkgs/by-name/in/intelephense/package-lock.json
index 0a4d34dffaf5..66b106df25bd 100644
--- a/pkgs/by-name/in/intelephense/package-lock.json
+++ b/pkgs/by-name/in/intelephense/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "intelephense",
-  "version": "1.16.1",
+  "version": "1.16.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "intelephense",
-      "version": "1.16.1",
+      "version": "1.16.5",
       "license": "SEE LICENSE IN LICENSE.txt",
       "dependencies": {
         "@bmewburn/js-beautify": "1.15.2",
@@ -198,9 +198,9 @@
       }
     },
     "node_modules/@azure/opentelemetry-instrumentation-azure-sdk/node_modules/@opentelemetry/core": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.2.0.tgz",
-      "integrity": "sha512-FuabnnUm8LflnieVxs6eP7Z383hgQU4W1e3KJS6aOG3RxWxcHyBxH8fDMHNgu/gFx/M2jvTOW/4/PHhLz6bjWw==",
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.5.1.tgz",
+      "integrity": "sha512-Dwlc+3HAZqpgTYq0MUyZABjFkcrKTePwuiFVLjahGD8cx3enqihmpAmdgNFO1R4m/sIe5afjJrA25Prqy4NXlA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@opentelemetry/semantic-conventions": "^1.29.0"
@@ -233,13 +233,13 @@
       }
     },
     "node_modules/@babel/parser": {
-      "version": "7.28.5",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.28.5.tgz",
-      "integrity": "sha512-KKBU1VGYR7ORr3At5HAtUQ+TV3SzRCXmA/8OdDZiLDBIZxVyzXuztPjfLd3BV1PRAQGCMWWSHYhL0F8d5uHBDQ==",
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.0.tgz",
+      "integrity": "sha512-IyDgFV5GeDUVX4YdF/3CPULtVGSXXMLh1xVIgdCgxApktqnQV0r7/8Nqthg+8YLGaAtdyIlo2qIdZrbCv4+7ww==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/types": "^7.28.5"
+        "@babel/types": "^7.29.0"
       },
       "bin": {
         "parser": "bin/babel-parser.js"
@@ -249,9 +249,9 @@
       }
     },
     "node_modules/@babel/types": {
-      "version": "7.28.5",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.28.5.tgz",
-      "integrity": "sha512-qQ5m48eI/MFLQ5PxQj4PFaprjyCTLI37ElWMmNs0K8Lk3dVeOdNpB3ks8jc7yM5CDmVC73eMVk/trk3fgmrUpA==",
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz",
+      "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -405,13 +405,13 @@
       }
     },
     "node_modules/@jsdoc/salty": {
-      "version": "0.2.9",
-      "resolved": "https://registry.npmjs.org/@jsdoc/salty/-/salty-0.2.9.tgz",
-      "integrity": "sha512-yYxMVH7Dqw6nO0d5NIV8OQWnitU8k6vXH8NtgqAfIa/IUqRMxRv/NUJJ08VEKbAakwxlgBl5PJdrU0dMPStsnw==",
+      "version": "0.2.10",
+      "resolved": "https://registry.npmjs.org/@jsdoc/salty/-/salty-0.2.10.tgz",
+      "integrity": "sha512-VFHSsQAQp8y1NJvAJBpLs9I2shHE6hz9TwukocDObuUgGVAq62yZGbTgJg04Z3Fj0XSMWe0sJqGg5dhKGTV92A==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "lodash": "^4.17.21"
+        "lodash": "^4.17.23"
       },
       "engines": {
         "node": ">=v12.0.0"
@@ -475,6 +475,7 @@
       "resolved": "https://registry.npmjs.org/@opentelemetry/api/-/api-1.9.0.tgz",
       "integrity": "sha512-3giAOQvZiH5F9bMlMiv8+GSPMeqg0dbaeo58/0SlA9sxSqZhnUtxzX9/2FzyhS9sWQf5S0GJE0AKBrFqjpeYcg==",
       "license": "Apache-2.0",
+      "peer": true,
       "engines": {
         "node": ">=8.0.0"
       }
@@ -586,13 +587,13 @@
       }
     },
     "node_modules/@opentelemetry/sdk-trace-web": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-web/-/sdk-trace-web-2.2.0.tgz",
-      "integrity": "sha512-x/LHsDBO3kfqaFx5qSzBljJ5QHsRXrvS4MybBDy1k7Svidb8ZyIPudWVzj3s5LpPkYZIgi9e+7tdsNCnptoelw==",
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-web/-/sdk-trace-web-2.5.1.tgz",
+      "integrity": "sha512-4PWFtMJ5nqWMP2YqgKjcMlQlUeN1imUYSXdhy6Xl/3bnO0/Ryo5Y3/kWG8T66uMHo2RpTQLloZjoQACKdbHbxg==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/sdk-trace-base": "2.2.0"
+        "@opentelemetry/core": "2.5.1",
+        "@opentelemetry/sdk-trace-base": "2.5.1"
       },
       "engines": {
         "node": "^18.19.0 || >=20.6.0"
@@ -602,9 +603,9 @@
       }
     },
     "node_modules/@opentelemetry/sdk-trace-web/node_modules/@opentelemetry/core": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.2.0.tgz",
-      "integrity": "sha512-FuabnnUm8LflnieVxs6eP7Z383hgQU4W1e3KJS6aOG3RxWxcHyBxH8fDMHNgu/gFx/M2jvTOW/4/PHhLz6bjWw==",
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/core/-/core-2.5.1.tgz",
+      "integrity": "sha512-Dwlc+3HAZqpgTYq0MUyZABjFkcrKTePwuiFVLjahGD8cx3enqihmpAmdgNFO1R4m/sIe5afjJrA25Prqy4NXlA==",
       "license": "Apache-2.0",
       "dependencies": {
         "@opentelemetry/semantic-conventions": "^1.29.0"
@@ -617,12 +618,12 @@
       }
     },
     "node_modules/@opentelemetry/sdk-trace-web/node_modules/@opentelemetry/resources": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.2.0.tgz",
-      "integrity": "sha512-1pNQf/JazQTMA0BiO5NINUzH0cbLbbl7mntLa4aJNmCCXSj0q03T5ZXXL0zw4G55TjdL9Tz32cznGClf+8zr5A==",
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/resources/-/resources-2.5.1.tgz",
+      "integrity": "sha512-BViBCdE/GuXRlp9k7nS1w6wJvY5fnFX5XvuEtWsTAOQFIO89Eru7lGW3WbfbxtCuZ/GbrJfAziXG0w0dpxL7eQ==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
+        "@opentelemetry/core": "2.5.1",
         "@opentelemetry/semantic-conventions": "^1.29.0"
       },
       "engines": {
@@ -633,13 +634,13 @@
       }
     },
     "node_modules/@opentelemetry/sdk-trace-web/node_modules/@opentelemetry/sdk-trace-base": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-2.2.0.tgz",
-      "integrity": "sha512-xWQgL0Bmctsalg6PaXExmzdedSp3gyKV8mQBwK/j9VGdCDu2fmXIb2gAehBKbkXCpJ4HPkgv3QfoJWRT4dHWbw==",
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/sdk-trace-base/-/sdk-trace-base-2.5.1.tgz",
+      "integrity": "sha512-iZH3Gw8cxQn0gjpOjJMmKLd9GIaNh/E3v3ST67vyzLSxHBs14HsG4dy7jMYyC5WXGdBVEcM7U/XTF5hCQxjDMw==",
       "license": "Apache-2.0",
       "dependencies": {
-        "@opentelemetry/core": "2.2.0",
-        "@opentelemetry/resources": "2.2.0",
+        "@opentelemetry/core": "2.5.1",
+        "@opentelemetry/resources": "2.5.1",
         "@opentelemetry/semantic-conventions": "^1.29.0"
       },
       "engines": {
@@ -650,9 +651,9 @@
       }
     },
     "node_modules/@opentelemetry/semantic-conventions": {
-      "version": "1.38.0",
-      "resolved": "https://registry.npmjs.org/@opentelemetry/semantic-conventions/-/semantic-conventions-1.38.0.tgz",
-      "integrity": "sha512-kocjix+/sSggfJhwXqClZ3i9Y/MI0fp7b+g7kCRm6psy2dsf8uApTRclwG18h8Avm7C9+fnt+O36PspJ/OzoWg==",
+      "version": "1.39.0",
+      "resolved": "https://registry.npmjs.org/@opentelemetry/semantic-conventions/-/semantic-conventions-1.39.0.tgz",
+      "integrity": "sha512-R5R9tb2AXs2IRLNKLBJDynhkfmx7mX0vi8NkhZb3gUkPWHn6HXk5J8iQ/dql0U3ApfWym4kXXmBDRGO+oeOfjg==",
       "license": "Apache-2.0",
       "engines": {
         "node": ">=14"
@@ -756,9 +757,9 @@
       }
     },
     "node_modules/@sinonjs/fake-timers": {
-      "version": "13.0.5",
-      "resolved": "https://registry.npmjs.org/@sinonjs/fake-timers/-/fake-timers-13.0.5.tgz",
-      "integrity": "sha512-36/hTbH2uaWuGVERyC6da9YwGWnzUZXuPro/F2LfsdOsLnCojz/iSH8MxUt/FD2S5XBSVPhmArFUXcpCQ2Hkiw==",
+      "version": "15.1.0",
+      "resolved": "https://registry.npmjs.org/@sinonjs/fake-timers/-/fake-timers-15.1.0.tgz",
+      "integrity": "sha512-cqfapCxwTGsrR80FEgOoPsTonoefMBY7dnUEbQ+GRcved0jvkJLzvX6F4WtN+HBqbPX/SiFsIRUp+IrCW/2I2w==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
@@ -938,6 +939,7 @@
       "integrity": "sha512-promo4eFwuiW+TfGxhi+0x3czqTYJkG8qB17ZUJiVF10Xm7NLVRSLUsfRTU/6h1e24VvRnXCx+hG7li58lkzog==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@types/linkify-it": "^5",
         "@types/mdurl": "^2"
@@ -968,10 +970,11 @@
       "license": "MIT"
     },
     "node_modules/@types/node": {
-      "version": "22.19.1",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.19.1.tgz",
-      "integrity": "sha512-LCCV0HdSZZZb34qifBsyWlUmok6W7ouER+oQIGBScS8EsZsQbrtFTUrDX4hOl+CS6p7cnNC4td+qrSVGSCTUfQ==",
+      "version": "22.19.11",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.19.11.tgz",
+      "integrity": "sha512-BH7YwL6rA93ReqeQS1c4bsPpcfOmJasG+Fkr6Y59q83f9M1WcBRHR2vM+P9eOisYRcN3ujQoiZY8uk5W+1WL8w==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "undici-types": "~6.21.0"
       }
@@ -1007,9 +1010,9 @@
       "license": "MIT"
     },
     "node_modules/@typespec/ts-http-runtime": {
-      "version": "0.3.2",
-      "resolved": "https://registry.npmjs.org/@typespec/ts-http-runtime/-/ts-http-runtime-0.3.2.tgz",
-      "integrity": "sha512-IlqQ/Gv22xUC1r/WQm4StLkYQmaaTsXAhUVsNE0+xiyf0yRFiH5++q78U3bw6bLKDCTmh0uqKB9eG9+Bt75Dkg==",
+      "version": "0.3.3",
+      "resolved": "https://registry.npmjs.org/@typespec/ts-http-runtime/-/ts-http-runtime-0.3.3.tgz",
+      "integrity": "sha512-91fp6CAAJSRtH5ja95T1FHSKa8aPW9/Zw6cta81jlZTUw/+Vq8jM/AfF/14h2b71wwR84JUTW/3Y8QPhDAawFA==",
       "license": "MIT",
       "dependencies": {
         "http-proxy-agent": "^7.0.0",
@@ -1293,10 +1296,11 @@
       }
     },
     "node_modules/acorn": {
-      "version": "8.15.0",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.15.0.tgz",
-      "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
+      "version": "8.16.0",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.16.0.tgz",
+      "integrity": "sha512-UVJyE9MttOsBQIDKw1skb9nAwQuR5wuGD3+82K6JgJlm/Y+KI92oNsMNGZCYdDsVtRHSak0pcV5Dno5+4jh9sw==",
       "license": "MIT",
+      "peer": true,
       "bin": {
         "acorn": "bin/acorn"
       },
@@ -1337,9 +1341,9 @@
       }
     },
     "node_modules/acorn-walk": {
-      "version": "8.3.4",
-      "resolved": "https://registry.npmjs.org/acorn-walk/-/acorn-walk-8.3.4.tgz",
-      "integrity": "sha512-ueEepnujpqee2o5aIYnvHU6C0A42MNdsIDeqy5BydrkuC5R1ZuUFnm27EeFJGoEHJQgn3uleRvmTXaJgfXbt4g==",
+      "version": "8.3.5",
+      "resolved": "https://registry.npmjs.org/acorn-walk/-/acorn-walk-8.3.5.tgz",
+      "integrity": "sha512-HEHNfbars9v4pgpW6SO1KSPkfoS0xVOM/9UzkJltjlsHZmJasxg8aXkuZa7SMf8vKGIBhpUsPluQSqhJFCqebw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -1362,11 +1366,12 @@
       }
     },
     "node_modules/ajv": {
-      "version": "8.17.1",
-      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.17.1.tgz",
-      "integrity": "sha512-B/gBuNg5SiMTrPkC+A2+cW0RszwxYmn6VYxB/inlBStS5nx6xHIt/ehKRhIMhqusl7a8LjQoZnjCs5vhwxOQ1g==",
+      "version": "8.18.0",
+      "resolved": "https://registry.npmjs.org/ajv/-/ajv-8.18.0.tgz",
+      "integrity": "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "fast-deep-equal": "^3.1.3",
         "fast-uri": "^3.0.1",
@@ -1562,19 +1567,22 @@
       }
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.8.30",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.8.30.tgz",
-      "integrity": "sha512-aTUKW4ptQhS64+v2d6IkPzymEzzhw+G0bA1g3uBRV3+ntkH+svttKseW5IOR4Ed6NUVKqnY7qT3dKvzQ7io4AA==",
+      "version": "2.10.0",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.0.tgz",
+      "integrity": "sha512-lIyg0szRfYbiy67j9KN8IyeD7q7hcmqnJ1ddWmNt19ItGpNN64mnllmxUNFIOdOm6by97jlL6wfpTTJrmnjWAA==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
-        "baseline-browser-mapping": "dist/cli.js"
+        "baseline-browser-mapping": "dist/cli.cjs"
+      },
+      "engines": {
+        "node": ">=6.0.0"
       }
     },
     "node_modules/basic-ftp": {
-      "version": "5.0.5",
-      "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-5.0.5.tgz",
-      "integrity": "sha512-4Bcg1P8xhUuqcii/S0Z9wiHIrQVPMermM1any+MX5GeGD7faD3/msQUDGLol9wOcz4/jbg/WJnGqoJF6LiBdtg==",
+      "version": "5.2.0",
+      "resolved": "https://registry.npmjs.org/basic-ftp/-/basic-ftp-5.2.0.tgz",
+      "integrity": "sha512-VoMINM2rqJwJgfdHq6RiUudKt2BV+FY5ZFezP/ypmwayk68+NzzAQy4XXLlqsGD4MCzq3DrmNFD/uUmBJuGoXw==",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"
@@ -1616,9 +1624,9 @@
       "license": "ISC"
     },
     "node_modules/browserslist": {
-      "version": "4.28.0",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.0.tgz",
-      "integrity": "sha512-tbydkR/CxfMwelN0vwdP/pLkDwyAASZ+VfWm4EOwlB6SWhx1sYnWLqo8N5j0rAzPfzfRaxt0mM/4wPU/Su84RQ==",
+      "version": "4.28.1",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.1.tgz",
+      "integrity": "sha512-ZC5Bd0LgJXgwGqUknZY/vkUQ04r8NXnJZ3yYi4vDmSiZmC/pdSN0NbNRPxZpbtO4uAfDUAFffO8IZoM3Gj8IkA==",
       "dev": true,
       "funding": [
         {
@@ -1635,12 +1643,13 @@
         }
       ],
       "license": "MIT",
+      "peer": true,
       "dependencies": {
-        "baseline-browser-mapping": "^2.8.25",
-        "caniuse-lite": "^1.0.30001754",
-        "electron-to-chromium": "^1.5.249",
+        "baseline-browser-mapping": "^2.9.0",
+        "caniuse-lite": "^1.0.30001759",
+        "electron-to-chromium": "^1.5.263",
         "node-releases": "^2.0.27",
-        "update-browserslist-db": "^1.1.4"
+        "update-browserslist-db": "^1.2.0"
       },
       "bin": {
         "browserslist": "cli.js"
@@ -1683,9 +1692,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001756",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001756.tgz",
-      "integrity": "sha512-4HnCNKbMLkLdhJz3TToeVWHSnfJvPaq6vu/eRP0Ahub/07n484XHhBF5AJoSGHdVrS8tKFauUQz8Bp9P7LVx7A==",
+      "version": "1.0.30001774",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001774.tgz",
+      "integrity": "sha512-DDdwPGz99nmIEv216hKSgLD+D4ikHQHjBC/seF98N9CPqRX4M5mSxT9eTV6oyisnJcuzxtZy4n17yKKQYmYQOA==",
       "dev": true,
       "funding": [
         {
@@ -1717,9 +1726,9 @@
       }
     },
     "node_modules/chai": {
-      "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/chai/-/chai-6.2.1.tgz",
-      "integrity": "sha512-p4Z49OGG5W/WBCPSS/dH3jQ73kD6tiMmUM+bckNK6Jr5JHMG3k9bg/BvKR8lKmtVBKmOiuVaV2ws8s9oSbwysg==",
+      "version": "6.2.2",
+      "resolved": "https://registry.npmjs.org/chai/-/chai-6.2.2.tgz",
+      "integrity": "sha512-NUPRluOfOiTKBKvWPtSD4PhFvWCqOi0BGStNWs57X9js7XGTprSmFoz5F0tWhR4WPjNeR9jXqdC7/UpSJTnlRg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -2119,6 +2128,7 @@
       "resolved": "https://registry.npmjs.org/diagnostic-channel/-/diagnostic-channel-1.1.1.tgz",
       "integrity": "sha512-r2HV5qFkUICyoaKlBEpLKHjxMXATUf/l+h8UZPGBHGLy4DDiY2sOLcIctax4eRnTw5wH2jTMExLntGPJ8eOJxw==",
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "semver": "^7.5.3"
       }
@@ -2236,9 +2246,9 @@
       }
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.259",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.259.tgz",
-      "integrity": "sha512-I+oLXgpEJzD6Cwuwt1gYjxsDmu/S/Kd41mmLA3O+/uH2pFRO/DvOjUyGozL8j3KeLV6WyZ7ssPwELMsXCcsJAQ==",
+      "version": "1.5.302",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.302.tgz",
+      "integrity": "sha512-sM6HAN2LyK82IyPBpznDRqlTQAtuSaO+ShzFiWTvoMJLHyZ+Y39r8VMfHzwbU8MVBzQ4Wdn85+wlZl2TLGIlwg==",
       "dev": true,
       "license": "ISC"
     },
@@ -2258,14 +2268,14 @@
       "license": "MIT"
     },
     "node_modules/enhanced-resolve": {
-      "version": "5.18.3",
-      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.18.3.tgz",
-      "integrity": "sha512-d4lC8xfavMeBjzGr2vECC3fsGXziXZQyJxD868h2M/mBI3PwAuODxAkLkq5HYuvrPYcUtiLzsTo8U3PgX3Ocww==",
+      "version": "5.19.0",
+      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.19.0.tgz",
+      "integrity": "sha512-phv3E1Xl4tQOShqSte26C7Fl84EwUdZsyOuSSk9qtAGyyQs2s3jJzComh+Abf4g187lUUAvH+H26omrqia2aGg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "graceful-fs": "^4.2.4",
-        "tapable": "^2.2.0"
+        "tapable": "^2.3.0"
       },
       "engines": {
         "node": ">=10.13.0"
@@ -2284,9 +2294,9 @@
       }
     },
     "node_modules/envinfo": {
-      "version": "7.20.0",
-      "resolved": "https://registry.npmjs.org/envinfo/-/envinfo-7.20.0.tgz",
-      "integrity": "sha512-+zUomDcLXsVkQ37vUqWBvQwLaLlj8eZPSi61llaEFAVBY5mhcXdaSw1pSJVl4yTYD5g/gEfpNl28YYk4IPvrrg==",
+      "version": "7.21.0",
+      "resolved": "https://registry.npmjs.org/envinfo/-/envinfo-7.21.0.tgz",
+      "integrity": "sha512-Lw7I8Zp5YKHFCXL7+Dz95g4CcbMEpgvqZNNq3AmlT5XAV6CgAAk6gyAMqn2zjw08K9BHfcNuKrMiCPLByGafow==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -2583,9 +2593,9 @@
       }
     },
     "node_modules/fastq": {
-      "version": "1.19.1",
-      "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.19.1.tgz",
-      "integrity": "sha512-GwLTyxkCXjXbxqIhTsMI2Nui8huMPtnxg7krajPJAjnEG/iiOS7i+zCtWGZR9G0NBKbXKh6X9m9UIsYX/N6vvQ==",
+      "version": "1.20.1",
+      "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.20.1.tgz",
+      "integrity": "sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==",
       "license": "ISC",
       "dependencies": {
         "reusify": "^1.0.4"
@@ -2663,9 +2673,9 @@
       }
     },
     "node_modules/fs-extra": {
-      "version": "11.3.2",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.2.tgz",
-      "integrity": "sha512-Xr9F6z6up6Ws+NjzMCZc6WXg2YFRlrLP9NQDO3VQrWrfiojdhS56TzueT88ze0uBdCTwEIhQ3ptnmKeWGFAe0A==",
+      "version": "11.3.3",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.3.tgz",
+      "integrity": "sha512-VWSRii4t0AFm6ixFFmLLx1t7wS1gh+ckoa84aOeapGum0h+EZd1EhEumSB+ZdDLnEPuucsVB9oB7cxJHap6Afg==",
       "license": "MIT",
       "dependencies": {
         "graceful-fs": "^4.2.0",
@@ -2757,6 +2767,7 @@
       "version": "10.5.0",
       "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz",
       "integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==",
+      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "license": "ISC",
       "dependencies": {
         "foreground-child": "^3.1.0",
@@ -2793,13 +2804,34 @@
       "dev": true,
       "license": "BSD-2-Clause"
     },
+    "node_modules/glob/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/glob/node_modules/brace-expansion": {
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.3.tgz",
+      "integrity": "sha512-fy6KJm2RawA5RcHkLa1z/ScpBeA762UF9KmZQxwIbDtRJrgLzM10depAiEQ+CXYcoiqW1/m96OAAoke2nE9EeA==",
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
     "node_modules/glob/node_modules/minimatch": {
-      "version": "9.0.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
-      "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
+      "version": "9.0.8",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.8.tgz",
+      "integrity": "sha512-reYkDYtj/b19TeqbNZCV4q9t+Yxylf/rYBsLb42SXJatTv4/ylq5lEiAmhA/IToxO7NI2UzNMghHoHuaqDkAjw==",
       "license": "ISC",
       "dependencies": {
-        "brace-expansion": "^2.0.1"
+        "brace-expansion": "^5.0.2"
       },
       "engines": {
         "node": ">=16 || 14 >=14.17"
@@ -3351,9 +3383,9 @@
       }
     },
     "node_modules/lodash": {
-      "version": "4.17.21",
-      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
-      "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg==",
+      "version": "4.17.23",
+      "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.23.tgz",
+      "integrity": "sha512-LgVTMpQtIopCi79SJeDiP0TfWi5CNEc/L/aRdTh3yIvmZXTnheWpKjSZhnvMl8iXbC1tFg9gdHHDMLoV7CnG+w==",
       "dev": true,
       "license": "MIT"
     },
@@ -3381,10 +3413,10 @@
       "license": "Apache-2.0"
     },
     "node_modules/lru-cache": {
-      "version": "11.2.2",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.2.2.tgz",
-      "integrity": "sha512-F9ODfyqML2coTIsQpSkRHnLSZMtkU8Q+mSfcaIyKwy58u+8k5nvAYeiNhsyMARvzNcXJ9QfWVrcPsC9e9rAxtg==",
-      "license": "ISC",
+      "version": "11.2.6",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.2.6.tgz",
+      "integrity": "sha512-ESL2CrkS/2wTPfuend7Zhkzo2u0daGJ/A2VucJOgQ/C48S/zB8MMeMHSGKYpXhIjbPxfuezITkaBH1wqv00DDQ==",
+      "license": "BlueOak-1.0.0",
       "engines": {
         "node": "20 || >=22"
       }
@@ -3397,11 +3429,12 @@
       "license": "ISC"
     },
     "node_modules/markdown-it": {
-      "version": "14.1.0",
-      "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.1.0.tgz",
-      "integrity": "sha512-a54IwgWPaeBCAAsv13YgmALOF1elABB08FxO9i+r4VFk5Vl4pKokRPeX8u5TCgSsPi6ec1otfLjdOpVcgbpshg==",
+      "version": "14.1.1",
+      "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.1.1.tgz",
+      "integrity": "sha512-BuU2qnTti9YKgK5N+IeMubp14ZUKUUw7yeJbkjtosvHiP0AZ5c8IAgEMk79D0eC8F23r4Ac/q8cAIFdm2FtyoA==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "argparse": "^2.0.1",
         "entities": "^4.4.0",
@@ -3530,10 +3563,10 @@
       }
     },
     "node_modules/minipass": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.2.tgz",
-      "integrity": "sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==",
-      "license": "ISC",
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
+      "license": "BlueOak-1.0.0",
       "engines": {
         "node": ">=16 || 14 >=14.17"
       }
@@ -3588,14 +3621,37 @@
         "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
       }
     },
+    "node_modules/mocha/node_modules/balanced-match": {
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
+    "node_modules/mocha/node_modules/brace-expansion": {
+      "version": "5.0.3",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.3.tgz",
+      "integrity": "sha512-fy6KJm2RawA5RcHkLa1z/ScpBeA762UF9KmZQxwIbDtRJrgLzM10depAiEQ+CXYcoiqW1/m96OAAoke2nE9EeA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
+    },
     "node_modules/mocha/node_modules/minimatch": {
-      "version": "9.0.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
-      "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
+      "version": "9.0.8",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.8.tgz",
+      "integrity": "sha512-reYkDYtj/b19TeqbNZCV4q9t+Yxylf/rYBsLb42SXJatTv4/ylq5lEiAmhA/IToxO7NI2UzNMghHoHuaqDkAjw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
-        "brace-expansion": "^2.0.1"
+        "brace-expansion": "^5.0.2"
       },
       "engines": {
         "node": ">=16 || 14 >=14.17"
@@ -3985,6 +4041,7 @@
       "integrity": "sha512-CvexbZtbov6jW2eXAvLukXjXUW1TzFaivC46BpWc/3BpcCysb5Vffu+B3XHMm8lVEuy2Mm4XGex8hBSg1yapPg==",
       "hasInstallScript": true,
       "license": "BSD-3-Clause",
+      "peer": true,
       "dependencies": {
         "@protobufjs/aspromise": "^1.1.2",
         "@protobufjs/base64": "^1.1.2",
@@ -4036,7 +4093,7 @@
       "version": "8.1.0",
       "resolved": "https://registry.npmjs.org/glob/-/glob-8.1.0.tgz",
       "integrity": "sha512-r8hpEjiQEYlF2QU0df3dS+nxxSIreXQS1qRhMJM0Q5NDdR386C7jb7Hwwod8Fgiuex+k0GFjgft18yvxm5XoCQ==",
-      "deprecated": "Glob versions prior to v9 are no longer supported",
+      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -4054,9 +4111,9 @@
       }
     },
     "node_modules/protobufjs-cli/node_modules/minimatch": {
-      "version": "5.1.6",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.6.tgz",
-      "integrity": "sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g==",
+      "version": "5.1.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.9.tgz",
+      "integrity": "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
@@ -4376,9 +4433,9 @@
       }
     },
     "node_modules/semver": {
-      "version": "7.7.3",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
-      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
+      "version": "7.7.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.4.tgz",
+      "integrity": "sha512-vFKC2IEtQnVhpT78h1Yp8wzwrf8CM+MzKMHGJZfBtzhZNycRFnXsHk6E5TxIkkMsgNS7mdX3AGB7x2QM2di4lA==",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
@@ -4450,16 +4507,16 @@
       }
     },
     "node_modules/sinon": {
-      "version": "21.0.0",
-      "resolved": "https://registry.npmjs.org/sinon/-/sinon-21.0.0.tgz",
-      "integrity": "sha512-TOgRcwFPbfGtpqvZw+hyqJDvqfapr1qUlOizROIk4bBLjlsjlB00Pg6wMFXNtJRpu+eCZuVOaLatG7M8105kAw==",
+      "version": "21.0.1",
+      "resolved": "https://registry.npmjs.org/sinon/-/sinon-21.0.1.tgz",
+      "integrity": "sha512-Z0NVCW45W8Mg5oC/27/+fCqIHFnW8kpkFOq0j9XJIev4Ld0mKmERaZv5DMLAb9fGCevjKwaEeIQz5+MBXfZcDw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
         "@sinonjs/commons": "^3.0.1",
-        "@sinonjs/fake-timers": "^13.0.5",
-        "@sinonjs/samsam": "^8.0.1",
-        "diff": "^7.0.0",
+        "@sinonjs/fake-timers": "^15.1.0",
+        "@sinonjs/samsam": "^8.0.3",
+        "diff": "^8.0.2",
         "supports-color": "^7.2.0"
       },
       "funding": {
@@ -4467,6 +4524,16 @@
         "url": "https://opencollective.com/sinon"
       }
     },
+    "node_modules/sinon/node_modules/diff": {
+      "version": "8.0.3",
+      "resolved": "https://registry.npmjs.org/diff/-/diff-8.0.3.tgz",
+      "integrity": "sha512-qejHi7bcSD4hQAZE0tNAawRK1ZtafHDmMTMkrrIGgSLl7hTnQHmKCeB45xAcbfTqK2zowkM3j3bHt/4b/ARbYQ==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "engines": {
+        "node": ">=0.3.1"
+      }
+    },
     "node_modules/sinon/node_modules/supports-color": {
       "version": "7.2.0",
       "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
@@ -4706,9 +4773,9 @@
       }
     },
     "node_modules/terser": {
-      "version": "5.44.1",
-      "resolved": "https://registry.npmjs.org/terser/-/terser-5.44.1.tgz",
-      "integrity": "sha512-t/R3R/n0MSwnnazuPpPNVO60LX0SKL45pyl9YlvxIdkH0Of7D5qM2EVe+yASRIlY5pZ73nclYJfNANGWPwFDZw==",
+      "version": "5.46.0",
+      "resolved": "https://registry.npmjs.org/terser/-/terser-5.46.0.tgz",
+      "integrity": "sha512-jTwoImyr/QbOWFFso3YoU3ik0jBBDJ6JTOQiy/J2YxVJdZCc+5u7skhNwiOR3FQIygFqVUPHl7qbbxtjW2K3Qg==",
       "dev": true,
       "license": "BSD-2-Clause",
       "dependencies": {
@@ -4725,9 +4792,9 @@
       }
     },
     "node_modules/terser-webpack-plugin": {
-      "version": "5.3.14",
-      "resolved": "https://registry.npmjs.org/terser-webpack-plugin/-/terser-webpack-plugin-5.3.14.tgz",
-      "integrity": "sha512-vkZjpUjb6OMS7dhV+tILUW6BhpDR7P2L/aQSAv+Uwk+m8KATX9EccViHTJR2qDtACKPIYndLGCyl3FMo+r2LMw==",
+      "version": "5.3.16",
+      "resolved": "https://registry.npmjs.org/terser-webpack-plugin/-/terser-webpack-plugin-5.3.16.tgz",
+      "integrity": "sha512-h9oBFCWrq78NyWWVcSwZarJkZ01c2AyGrzs1crmHZO3QUg9D61Wu4NPjBy69n7JqylFF5y+CsUZYmYEIZ3mR+Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4807,6 +4874,7 @@
       "integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "engines": {
         "node": ">=12"
       },
@@ -4912,9 +4980,9 @@
       }
     },
     "node_modules/ts-node/node_modules/diff": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/diff/-/diff-4.0.2.tgz",
-      "integrity": "sha512-58lmxKSA4BNyLz+HHMUzlOEpg09FV+ev6ZMe3vJihgdxzgcwZ8VoEEPmALCZG9LmqfVoNMMKpttIYTVG6uDY7A==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/diff/-/diff-4.0.4.tgz",
+      "integrity": "sha512-X07nttJQkwkfKfvTPG/KSnE2OMdcUCao6+eXF3wmnIQRn2aPAHH3VxDbDOdegkd6JbPsXqShpvEOHfAT+nCNwQ==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
@@ -4970,6 +5038,7 @@
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
       "license": "Apache-2.0",
+      "peer": true,
       "bin": {
         "tsc": "bin/tsc",
         "tsserver": "bin/tsserver"
@@ -4999,9 +5068,9 @@
       }
     },
     "node_modules/underscore": {
-      "version": "1.13.7",
-      "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.13.7.tgz",
-      "integrity": "sha512-GMXzWtsc57XAtguZgaQViUOzs0KTkk8ojr3/xAxXLITqf/3EMwxC0inyETfDFjH/Krbhuep0HNbbjI9i/q3F3g==",
+      "version": "1.13.8",
+      "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.13.8.tgz",
+      "integrity": "sha512-DXtD3ZtEQzc7M8m4cXotyHR+FAS18C64asBYY5vqZexfYryNNnDc02W4hKg3rdQuqOYas1jkseX0+nZXjTXnvQ==",
       "dev": true,
       "license": "MIT"
     },
@@ -5021,9 +5090,9 @@
       }
     },
     "node_modules/update-browserslist-db": {
-      "version": "1.1.4",
-      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.1.4.tgz",
-      "integrity": "sha512-q0SPT4xyU84saUX+tomz1WLkxUbuaJnR1xWt17M7fJtEJigJeWUNGUqrauFXsHnqev9y9JTRGwk13tFBuKby4A==",
+      "version": "1.2.3",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.2.3.tgz",
+      "integrity": "sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==",
       "dev": true,
       "funding": [
         {
@@ -5068,9 +5137,9 @@
       "license": "MIT"
     },
     "node_modules/vscode-css-languageservice": {
-      "version": "6.3.8",
-      "resolved": "https://registry.npmjs.org/vscode-css-languageservice/-/vscode-css-languageservice-6.3.8.tgz",
-      "integrity": "sha512-dBk/9ullEjIMbfSYAohGpDOisOVU1x2MQHOeU12ohGJQI7+r0PCimBwaa/pWpxl/vH4f7ibrBfxIZY3anGmHKQ==",
+      "version": "6.3.10",
+      "resolved": "https://registry.npmjs.org/vscode-css-languageservice/-/vscode-css-languageservice-6.3.10.tgz",
+      "integrity": "sha512-eq5N9Er3fC4vA9zd9EFhyBG90wtCCuXgRSpAndaOgXMh1Wgep5lBgRIeDgjZBW9pa+332yC9+49cZMW8jcL3MA==",
       "license": "MIT",
       "dependencies": {
         "@vscode/l10n": "^0.0.18",
@@ -5080,9 +5149,9 @@
       }
     },
     "node_modules/vscode-html-languageservice": {
-      "version": "5.6.0",
-      "resolved": "https://registry.npmjs.org/vscode-html-languageservice/-/vscode-html-languageservice-5.6.0.tgz",
-      "integrity": "sha512-FIVz83oGw2tBkOr8gQPeiREInnineCKGCz3ZD1Pi6opOuX3nSRkc4y4zLLWsuop+6ttYX//XZCI6SLzGhRzLmA==",
+      "version": "5.6.2",
+      "resolved": "https://registry.npmjs.org/vscode-html-languageservice/-/vscode-html-languageservice-5.6.2.tgz",
+      "integrity": "sha512-ulCrSnFnfQ16YzvwnYUgEbUEl/ZG7u2eV27YhvLObSHKkb8fw1Z9cgsnUwjTEeDIdJDoTDTDpxuhQwoenoLNMg==",
       "license": "MIT",
       "dependencies": {
         "@vscode/l10n": "^0.0.18",
@@ -5141,9 +5210,9 @@
       "license": "MIT"
     },
     "node_modules/watchpack": {
-      "version": "2.4.4",
-      "resolved": "https://registry.npmjs.org/watchpack/-/watchpack-2.4.4.tgz",
-      "integrity": "sha512-c5EGNOiyxxV5qmTtAB7rbiXxi1ooX1pQKMLX/MIabJjRA0SJBQOjKF+KSVfHkr9U1cADPon0mRiVe/riyaiDUA==",
+      "version": "2.5.1",
+      "resolved": "https://registry.npmjs.org/watchpack/-/watchpack-2.5.1.tgz",
+      "integrity": "sha512-Zn5uXdcFNIA1+1Ei5McRd+iRzfhENPCe7LeABkJtNulSxjma+l7ltNx55BWZkRlwRnpOgHqxnjyaDgJnNXnqzg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5160,6 +5229,7 @@
       "integrity": "sha512-7h/weGm9d/ywQ6qzJ+Xy+r9n/3qgp/thalBbpOi5i223dPXKi04IBtqPN9nTd+jBc7QKfvDbaBnFipYp4sJAUQ==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "@types/eslint-scope": "^3.7.7",
         "@types/estree": "^1.0.8",
@@ -5272,9 +5342,9 @@
       }
     },
     "node_modules/webpack-sources": {
-      "version": "3.3.3",
-      "resolved": "https://registry.npmjs.org/webpack-sources/-/webpack-sources-3.3.3.tgz",
-      "integrity": "sha512-yd1RBzSGanHkitROoPFd6qsrxt+oFhg/129YzheDGqeustzX0vTZJZsSsQjVQC4yzBQ56K55XU8gaNCtIzOnTg==",
+      "version": "3.3.4",
+      "resolved": "https://registry.npmjs.org/webpack-sources/-/webpack-sources-3.3.4.tgz",
+      "integrity": "sha512-7tP1PdV4vF+lYPnkMR0jMY5/la2ub5Fc/8VQrrU+lXkiM6C4TjVfGw7iKfyhnTQOsD+6Q/iKw0eFciziRgD58Q==",
       "dev": true,
       "license": "MIT",
       "engines": {
diff --git a/pkgs/by-name/in/intelephense/package.nix b/pkgs/by-name/in/intelephense/package.nix
index 0383ce4147d2..8941e7675c29 100644
--- a/pkgs/by-name/in/intelephense/package.nix
+++ b/pkgs/by-name/in/intelephense/package.nix
@@ -4,7 +4,7 @@
   fetchurl,
 }:
 let
-  version = "1.16.1";
+  version = "1.16.5";
 in
 buildNpmPackage {
   pname = "intelephense";
@@ -12,14 +12,14 @@ buildNpmPackage {
 
   src = fetchurl {
     url = "https://registry.npmjs.org/intelephense/-/intelephense-${version}.tgz";
-    hash = "sha256-hbKl0kCdqGnVMJvGeWgz8ivQnpS9qzyLUwToQQQ7uMY=";
+    hash = "sha256-Qqc5canlBafwCeLxquT+K3MdH5SqdZVuYBZNfinAXIk=";
   };
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json
   '';
 
-  npmDepsHash = "sha256-gzalO/qXD2ZXXeb3FmzIWBbHpeBrQcNcu2j4udmsZvc=";
+  npmDepsHash = "sha256-BKnv65e+BgJrBKQ2J1glvfbd0Gt3BF9shgGDk9cNWcQ=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/is/iscc/package.nix b/pkgs/by-name/is/iscc/package.nix
index c51d965e228f..8c9197038f02 100644
--- a/pkgs/by-name/is/iscc/package.nix
+++ b/pkgs/by-name/is/iscc/package.nix
@@ -1,5 +1,5 @@
 {
-  stdenv,
+  stdenvNoCC,
   fetchurl,
   innoextract,
   runtimeShell,
@@ -8,15 +8,15 @@
 }:
 
 let
-  version = "6.2.2";
+  version = "6.4.1";
   majorVersion = builtins.substring 0 1 version;
 in
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "iscc";
   inherit version;
   src = fetchurl {
     url = "https://files.jrsoftware.org/is/${majorVersion}/innosetup-${version}.exe";
-    hash = "sha256-gRfRDQCirTOhOQl46jhyhhwzDgh5FEEKY3eyLExbhWM=";
+    hash = "sha256-9Bdg4fGuFdIIm7arFi4hcguSrnUG7XBmezkgAGPWjjQ=";
   };
   nativeBuildInputs = [
     innoextract
@@ -63,6 +63,7 @@ stdenv.mkDerivation rec {
     changelog = "https://jrsoftware.org/files/is6-whatsnew.htm";
     license = lib.licenses.unfreeRedistributable;
     maintainers = [ ];
+    mainProgram = "iscc";
     platforms = wineWow64Packages.stable.meta.platforms;
   };
 }
diff --git a/pkgs/by-name/li/libgff/package.nix b/pkgs/by-name/li/libgff/package.nix
index 0f0e7d808927..866a905f9f4f 100644
--- a/pkgs/by-name/li/libgff/package.nix
+++ b/pkgs/by-name/li/libgff/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libgff";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "COMBINE-lab";
     repo = "libgff";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ZCb3UyuB/+ykrYFQ9E5VytT65gAAULiOzIEu5IXISTc=";
+    hash = "sha256-OgXnNGIgWZDIChRdEfmHwvl+oQM03V3a/HnndGLjcHk=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/ma/maven/package.nix b/pkgs/by-name/ma/maven/package.nix
index fda649544867..a5a3030fe81e 100644
--- a/pkgs/by-name/ma/maven/package.nix
+++ b/pkgs/by-name/ma/maven/package.nix
@@ -78,6 +78,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       manage a project's build, reporting and documentation from a central piece
       of information.
     '';
+    changelog = "https://maven.apache.org/docs/${finalAttrs.version}/release-notes.html";
     sourceProvenance = with lib.sourceTypes; [
       binaryBytecode
       binaryNativeCode
diff --git a/pkgs/by-name/me/metabase/package.nix b/pkgs/by-name/me/metabase/package.nix
index d56fe12b05bb..c90fe4294efc 100644
--- a/pkgs/by-name/me/metabase/package.nix
+++ b/pkgs/by-name/me/metabase/package.nix
@@ -12,11 +12,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "metabase";
-  version = "0.58.5";
+  version = "0.59.1";
 
   src = fetchurl {
     url = "https://downloads.metabase.com/v${finalAttrs.version}/metabase.jar";
-    hash = "sha256-JjpDsI7G0b5YVjICXe9ZeprnipeyVg79qW42LTcE4U4=";
+    hash = "sha256-pPJdFljzzNuhRvH6ofPkNGq0Ly/RpHcqeQQh3JTG08I=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/mi/mise/package.nix b/pkgs/by-name/mi/mise/package.nix
index 600463ef09d8..cdfe74b26461 100644
--- a/pkgs/by-name/mi/mise/package.nix
+++ b/pkgs/by-name/mi/mise/package.nix
@@ -22,16 +22,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mise";
-  version = "2026.2.20";
+  version = "2026.3.3";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "mise";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vZzfXsnOw0HIuPfQIfVxCKcl5EQd+zARO/IqzGtNMDk=";
+    hash = "sha256-ZDlzFSjOqizj6eBBk1UOL6BgAqsbnchVHc0BwsO67L8=";
   };
 
-  cargoHash = "sha256-dWCDYcIkkopg7SMqAHjKoj0Wp4P47T7IdnXu9BriY00=";
+  cargoHash = "sha256-Vl66x8fJkt04JmQm9Z3wvv6Bvb1r/IrI3g49HC3mmFw=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/mo/moonlight/package.nix b/pkgs/by-name/mo/moonlight/package.nix
index c6c59fc92ed7..11cf3e28b49f 100644
--- a/pkgs/by-name/mo/moonlight/package.nix
+++ b/pkgs/by-name/mo/moonlight/package.nix
@@ -14,13 +14,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "moonlight";
-  version = "2026.2.2";
+  version = "2026.3.0";
 
   src = fetchFromGitHub {
     owner = "moonlight-mod";
     repo = "moonlight";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wZEpoUlDEbObXD5d2uA5vNBRrFOw4A6VLAc/MVNC4EE=";
+    hash = "sha256-Tuv0IFhvZzvmf29EWNtrb5Y6YOCn+lIBzXpt7lfLVS8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ne/nextpnr-xilinx/package.nix b/pkgs/by-name/ne/nextpnr-xilinx/package.nix
new file mode 100644
index 000000000000..09d2fc588f53
--- /dev/null
+++ b/pkgs/by-name/ne/nextpnr-xilinx/package.nix
@@ -0,0 +1,107 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  gitMinimal,
+  nix-update-script,
+  python312,
+  python312Packages,
+  eigen,
+  llvmPackages,
+}:
+
+let
+  prjxrayDb = fetchFromGitHub {
+    owner = "openxc7";
+    repo = "prjxray-db";
+    rev = "381966a746cb4cf4a7f854f0e53caa3bf74fbe62";
+    hash = "sha256-tQ1KfYj6kQq3fKBv6PAsqxm9btMNWFd5fT9UzOGMlkE=";
+  };
+
+  nextpnrXilinxMeta = fetchFromGitHub {
+    owner = "openxc7";
+    repo = "nextpnr-xilinx-meta";
+    rev = "491aefcc15be159efc8ad8bff2a1a4b93fe487fe";
+    hash = "sha256-oRVFPzdw9ctzT6iQ8YI3Q92LZTIlRPBZvJVjMqvDJQE=";
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "nextpnr-xilinx";
+  version = "0.8.2-unstable-2026-02-25";
+
+  src = fetchFromGitHub {
+    owner = "openXC7";
+    repo = "nextpnr-xilinx";
+    rev = "72d8217b80cafed22cbac1253a2f23ca1ee10806";
+    hash = "sha256-YIwJfh6epUDGfWwHS0zjfcrx5A68NUY6gxyuEBb0g3A=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    gitMinimal
+    python312
+  ];
+
+  buildInputs = [
+    # Newer python fails with 'No version of Boost::Python 3.x could be found'
+    python312Packages.boost
+    python312
+    eigen
+  ]
+  ++ (lib.optional stdenv.cc.isClang llvmPackages.openmp);
+
+  cmakeFlags = [
+    "-DCURRENT_GIT_VERSION=${lib.substring 0 7 finalAttrs.src.rev}"
+    "-DARCH=xilinx"
+    "-DBUILD_GUI=OFF"
+    "-DBUILD_TESTS=OFF"
+    "-DUSE_OPENMP=ON"
+  ];
+
+  postPatch = ''
+    # Boost.System is header-only in modern Boost; requiring the component fails
+    # with CMake's FindBoost in nixpkgs.
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "set(boost_libs filesystem thread program_options iostreams system)" \
+                     "set(boost_libs filesystem thread program_options iostreams)"
+
+    # GCC 15 requires explicit <cstdint> include for uint8_t in vendored json11.
+    substituteInPlace 3rdparty/json11/json11.cpp \
+      --replace-fail "#include <climits>" $'#include <climits>\n#include <cstdint>'
+
+    rm -rf xilinx/external/prjxray-db xilinx/external/nextpnr-xilinx-meta
+    ln -s ${prjxrayDb} xilinx/external/prjxray-db
+    ln -s ${nextpnrXilinxMeta} xilinx/external/nextpnr-xilinx-meta
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp nextpnr-xilinx bbasm $out/bin/
+
+    mkdir -p $out/share/nextpnr/external
+    ln -s ${prjxrayDb} $out/share/nextpnr/external/prjxray-db
+    cp -r ../xilinx/external/nextpnr-xilinx-meta $out/share/nextpnr/external/
+    cp -r ../xilinx/python $out/share/nextpnr/
+    cp ../xilinx/constids.inc $out/share/nextpnr/
+
+    runHook postInstall
+  '';
+
+  strictDeps = true;
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
+
+  meta = {
+    description = "Place and route tool for Xilinx 7-series FPGAs";
+    homepage = "https://github.com/openXC7/nextpnr-xilinx";
+    license = lib.licenses.isc;
+    mainProgram = "nextpnr-xilinx";
+    maintainers = with lib.maintainers; [ rcoeurjoly ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index 78feb72062a9..ef7df20122a6 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -14,12 +14,12 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencode";
-  version = "1.2.17";
+  version = "1.2.20";
   src = fetchFromGitHub {
     owner = "anomalyco";
     repo = "opencode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4I243hvqQjPU09GsIyQu/3Cv+THKFf5QTbC3x0aO83Q=";
+    hash = "sha256-FBmF7/uwZYY/qY1252Hz+XhXdE+Qp5axySAy5Jw7XUQ=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {
@@ -68,7 +68,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     # NOTE: Required else we get errors that our fixed-output derivation references store paths
     dontFixup = true;
 
-    outputHash = "sha256-orNyesv8Y3vooV1upr+X1CKHUdygyDQ3hmyPVlHC6Zk=";
+    outputHash = "sha256-OwlJRAeKnX5YMwQgaV4op40rjt5kxsP4WrOzpp9t90w=";
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
   };
diff --git a/pkgs/by-name/op/openpgp-card-tools/package.nix b/pkgs/by-name/op/openpgp-card-tools/package.nix
index 411789da106f..74d9d1c303f5 100644
--- a/pkgs/by-name/op/openpgp-card-tools/package.nix
+++ b/pkgs/by-name/op/openpgp-card-tools/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "openpgp-card-tools";
-  version = "0.11.10";
+  version = "0.11.11";
 
   src = fetchFromCodeberg {
     owner = "openpgp-card";
     repo = "openpgp-card-tools";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-1sm/zaKhUPMGdYg8sX/IXAI4vIRRZezSD89rljG4S/Y=";
+    hash = "sha256-4kmBWbfB9A36359zhR5fz0XFcN839gTtJFRFhJL1lL0=";
   };
 
-  cargoHash = "sha256-S+TOSUh/sr647aUBjo+aaZgVrrOubwa+XVFcwNBOxmI=";
+  cargoHash = "sha256-kXBPDwHkoB/W2sSIjChf4VnoNykvIKSSIv8YsW3iu1Y=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/ox/oxdraw/font-lookup.patch b/pkgs/by-name/ox/oxdraw/font-lookup.patch
new file mode 100644
index 000000000000..1111d0c816da
--- /dev/null
+++ b/pkgs/by-name/ox/oxdraw/font-lookup.patch
@@ -0,0 +1,25 @@
+diff --git a/app/layout.tsx b/app/layout.tsx
+index f589fac..56ccb67 100644
+--- a/app/layout.tsx
++++ b/app/layout.tsx
+@@ -1,15 +1,15 @@
+ import type { Metadata } from "next";
+-import { Geist, Geist_Mono } from "next/font/google";
++import localFont from "next/font/local";
+ import "./globals.css";
+ 
+-const geistSans = Geist({
++const geistSans = localFont({
++  src: '../Geist-Regular.otf',
+   variable: "--font-geist-sans",
+-  subsets: ["latin"],
+ });
+ 
+-const geistMono = Geist_Mono({
++const geistMono = localFont({
++  src: '../GeistMono-Regular.otf',
+   variable: "--font-geist-mono",
+-  subsets: ["latin"],
+ });
+ 
+ export const metadata: Metadata = {
diff --git a/pkgs/by-name/ox/oxdraw/package.nix b/pkgs/by-name/ox/oxdraw/package.nix
new file mode 100644
index 000000000000..d8fe85772f44
--- /dev/null
+++ b/pkgs/by-name/ox/oxdraw/package.nix
@@ -0,0 +1,79 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  openssl,
+  buildNpmPackage,
+  geist-font,
+  nix-update-script,
+}:
+rustPlatform.buildRustPackage (
+  finalAttrs:
+  let
+    # We manually build the frontend because otherwise it'll try to download stuff from within the sandbox and fail
+    frontend = buildNpmPackage {
+      pname = "oxdraw-frontend";
+      inherit (finalAttrs) version src;
+
+      sourceRoot = "source/frontend";
+
+      patches = [
+        # By default, NextJS tries to fetch fonts from google
+        # Because of sandboxing, that fails, so we use the
+        # font from nixpkgs
+        ./font-lookup.patch
+      ];
+
+      buildPhase = ''
+        runHook preBuild
+        cp ${geist-font}/share/fonts/opentype/Geist{,Mono}-Regular.otf .
+        npm run build
+        runHook postBuild
+      '';
+
+      installPhase = ''
+        runHook preInstall
+        cp -r out $out
+        runHook postInstall
+      '';
+
+      npmDepsHash = "sha256-Yyox/x78spQqCJDJkPVuzfeAbtd/fdyihDHudIqruo4=";
+    };
+  in
+  {
+    pname = "oxdraw";
+    version = "0.2.0";
+
+    src = fetchFromGitHub {
+      owner = "RohanAdwankar";
+      repo = "oxdraw";
+      tag = "v${finalAttrs.version}";
+      hash = "sha256-2B0G5aWRtUvZiCsX1fOw6M2UhShZaDj11r/fXCemGVc=";
+    };
+
+    cargoHash = "sha256-YedNESkXKbfl7FWea7VpDR+59b9WLtZ7GNcyJ7D9yPg=";
+
+    nativeBuildInputs = [ pkg-config ];
+    buildInputs = [ openssl ];
+
+    preBuild = ''
+      # The build.rs builds the frontend, which we manually build via Nix already
+      rm build.rs
+    '';
+
+    env.OXDRAW_BUNDLED_WEB_DIST = frontend;
+
+    passthru.updateScript = nix-update-script { };
+
+    meta = {
+      description = "Diagram as Code Tool Written in Rust with Draggable Editing";
+      homepage = "https://github.com/RohanAdwankar/oxdraw";
+      changelog = "https://github.com/RohanAdwankar/oxdraw/releases/tag/v${finalAttrs.version}";
+      license = lib.licenses.mit;
+      maintainers = [ lib.maintainers.kilyanni ];
+      mainProgram = "oxdraw";
+      platforms = lib.platforms.linux;
+    };
+  }
+)
diff --git a/pkgs/by-name/pe/performous/package.nix b/pkgs/by-name/pe/performous/package.nix
index 9256a64c627a..71fc1b56f3bd 100644
--- a/pkgs/by-name/pe/performous/package.nix
+++ b/pkgs/by-name/pe/performous/package.nix
@@ -7,7 +7,7 @@
   aubio,
   boost,
   cmake,
-  ffmpeg_7,
+  ffmpeg,
   fmt,
   gettext,
   glew,
@@ -62,6 +62,12 @@ stdenv.mkDerivation rec {
       extraPrefix = "ced-src/";
       hash = "sha256-23VD/4X4BOtcX5k+koSlRMowlbo2jAXbp3XKTXP7VrM=";
     })
+    (fetchpatch {
+      name = "performous-ffmpeg_8.patch";
+      url = "https://github.com/performous/performous/commit/783befe576051458da7ea0d915d2b4cb986eaf86.patch";
+      excludes = [ "osx-utils/macos-bundler.py" ];
+      hash = "sha256-Srkjr8BI98N8Ws853goonvjOrEyWvzjHAIhypgEydns=";
+    })
   ];
 
   prePatch = ''
@@ -72,6 +78,8 @@ stdenv.mkDerivation rec {
   postPatch = ''
     substituteInPlace data/CMakeLists.txt \
       --replace "/usr" "$out"
+    substituteInPlace {game,testing}/CMakeLists.txt \
+      --replace-fail "system locale" "locale"
   '';
 
   nativeBuildInputs = [
@@ -84,7 +92,7 @@ stdenv.mkDerivation rec {
     SDL2
     aubio
     boost
-    ffmpeg_7
+    ffmpeg
     fmt
     glew
     glibmm
diff --git a/pkgs/by-name/rc/rclone-ui/package.nix b/pkgs/by-name/rc/rclone-ui/package.nix
index b89245f10ba0..c39ce507afce 100644
--- a/pkgs/by-name/rc/rclone-ui/package.nix
+++ b/pkgs/by-name/rc/rclone-ui/package.nix
@@ -20,26 +20,26 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rclone-ui";
-  version = "3.4.3";
+  version = "3.5.0";
 
   src = fetchFromGitHub {
     owner = "rclone-ui";
     repo = "rclone-ui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YKlznqgKePx6x6P+1nE6sZwYSRZwvpAvMSDjd+MKCvg=";
+    hash = "sha256-U2bhhNqw2dWqyd5You1L8vTe30Q81DQd7YwHf6KcdBQ=";
   };
 
   npmDeps = fetchNpmDeps {
     name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
     inherit (finalAttrs) src;
     forceGitDeps = true;
-    hash = "sha256-SW2bWKM/H3fuRD0Q0Sctbpk13bfpMawU+HohJxfWg+E=";
+    hash = "sha256-omZprG5ozCrwkxB7G9n82wvpF7wXz+IWPEI8FEnOJvk=";
   };
 
   cargoRoot = "src-tauri";
   buildAndTestSubdir = finalAttrs.cargoRoot;
 
-  cargoHash = "sha256-toq1lscvDvVyQP0oPtf4IeNpxBTxrqJa8JH3cC3iQzk=";
+  cargoHash = "sha256-5JlqhhrHyHGTQ+9gYLgSQm+jF8th5UYdnLvXMRPKCTY=";
 
   # Disable tauri bundle updater, can be removed when #389107 is merged
   patches = [ ./remove_updater.patch ];
diff --git a/pkgs/by-name/sf/sfml/package.nix b/pkgs/by-name/sf/sfml/package.nix
index 75172272f475..9c5991f7801e 100644
--- a/pkgs/by-name/sf/sfml/package.nix
+++ b/pkgs/by-name/sf/sfml/package.nix
@@ -34,7 +34,8 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-YqlrY0iIsxcjlLb+buMU0zpXo7/eKSKxOsITWf7BX6s=";
   };
 
-  patches = [
+  # Only unvendor miniaudio on non-Darwin as Darwin cannot build the miniaudio package.
+  patches = lib.optional (!stdenv.hostPlatform.isDarwin) [
     # Not upstreamble in the near future, see https://github.com/SFML/SFML/pull/3555
     ./unvendor-miniaudio.patch
   ];
@@ -49,10 +50,10 @@ stdenv.mkDerivation (finalAttrs: {
     glew
     libjpeg
     libvorbis
-    miniaudio
   ]
   ++ lib.optional stdenv.hostPlatform.isLinux udev
   ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+    miniaudio
     libx11
     libxi
     libxcursor
diff --git a/pkgs/by-name/sv/svgo/package.nix b/pkgs/by-name/sv/svgo/package.nix
index 2cd74ca00403..f691b0adcd61 100644
--- a/pkgs/by-name/sv/svgo/package.nix
+++ b/pkgs/by-name/sv/svgo/package.nix
@@ -12,20 +12,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "svgo";
-  version = "4.0.0";
+  version = "4.0.1";
 
   src = fetchFromGitHub {
     owner = "svg";
     repo = "svgo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eSttRNHxcZquIxrTogk+7YS7rhp083qnOwJI71cmO20=";
+    hash = "sha256-HYI3E14MN0XhREQMYkhLB1gZOBtrpjayC1RyVEhvkOU=";
   };
 
   missingHashes = ./missing-hashes.json;
 
   offlineCache = yarn-berry.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes;
-    hash = "sha256-DrIbnm0TWviCfylCI/12XYsx7YOIk7JFVV18Q4dImwU=";
+    hash = "sha256-oBWUTYlMa3wi7TYAOTXSNBbSMiAZI6APXZvPyQzoPbM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ta/taterclient-ddnet/package.nix b/pkgs/by-name/ta/taterclient-ddnet/package.nix
index 81c5ac4f3cb3..b73722c26036 100644
--- a/pkgs/by-name/ta/taterclient-ddnet/package.nix
+++ b/pkgs/by-name/ta/taterclient-ddnet/package.nix
@@ -33,13 +33,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "taterclient-ddnet";
-  version = "10.8.5";
+  version = "10.8.6";
 
   src = fetchFromGitHub {
     owner = "TaterClient";
     repo = "TClient";
     tag = "V${finalAttrs.version}";
-    hash = "sha256-wdX7AZG4hDzRDUl6XjzL2bTMwBxMWdRt4geE7NuqpdQ=";
+    hash = "sha256-7NhRJMQjap+9ppGeCYRSGgB+D3H/THmJ/PgZ4mTPls0=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
@@ -103,7 +103,7 @@ stdenv.mkDerivation (finalAttrs: {
   # Since we are not building the server executable, the `run_tests` Makefile target
   # will not be generated.
   #
-  # See https://github.com/TaterClient/TClient/blob/V10.7.0/CMakeLists.txt#L3207
+  # See https://github.com/TaterClient/TClient/blob/V10.8.6/CMakeLists.txt#L3260
   doCheck = false;
 
   preFixup = lib.optionalString stdenv.hostPlatform.isDarwin ''
diff --git a/pkgs/by-name/ti/tinyauth/package.nix b/pkgs/by-name/ti/tinyauth/package.nix
new file mode 100644
index 000000000000..1dc47be0a486
--- /dev/null
+++ b/pkgs/by-name/ti/tinyauth/package.nix
@@ -0,0 +1,112 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  git,
+  stdenvNoCC,
+  bun,
+  nixosTests,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "tinyauth";
+  version = "5.0.1";
+
+  src = fetchFromGitHub {
+    owner = "steveiliop56";
+    repo = "tinyauth";
+    tag = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-ypM56yrUWF1OzCj5RBGyEhZzjyDcko7SPQ+eVhHEzmA=";
+  };
+
+  vendorHash = "sha256-qELLarAR78WkDoJKtqaqzIZaTBCuHP41JCyjLZ4aMtM=";
+
+  subPackages = [ "cmd/tinyauth" ];
+
+  env.CGO_ENABLED = 0;
+  ldflags = [
+    "-s"
+    "-w"
+    "-X tinyauth/internal/config.Version=v${finalAttrs.version}"
+    "-X tinyauth/internal/config.CommitHash=${finalAttrs.src.rev}"
+  ];
+
+  preBuild = ''
+    cp -r ${finalAttrs.frontend}/dist internal/assets/dist
+  '';
+
+  postPatch = ''
+    ${lib.getExe git} apply --directory paerser/ patches/nested_maps.diff
+  '';
+
+  frontend = stdenvNoCC.mkDerivation {
+    pname = "tinyauth-frontend";
+    inherit (finalAttrs) version src;
+    sourceRoot = "${finalAttrs.src.name}/frontend";
+
+    impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
+      "GIT_PROXY_COMMAND"
+      "SOCKS_SERVER"
+    ];
+
+    nativeBuildInputs = [
+      bun
+    ];
+
+    configurePhase = ''
+      runHook preConfigure
+
+      bun install --no-progress --frozen-lockfile
+      substituteInPlace node_modules/.bin/{tsc,vite} \
+        --replace-fail "/usr/bin/env node" "${lib.getExe bun}"
+
+      runHook postConfigure
+    '';
+
+    buildPhase = ''
+      runHook preBuild
+
+      bun run build
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/dist
+      cp -r dist $out
+
+      runHook postInstall
+    '';
+
+    outputHashMode = "recursive";
+    outputHash = "sha256-pB94TUwjm5GmEmgjqkr7QH9BoRhKCSbxQVOc+2fCz2c=";
+  };
+
+  passthru = {
+    tests = {
+      inherit (nixosTests) tinyauth;
+    };
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--subpackage"
+        "frontend"
+      ];
+    };
+  };
+
+  meta = {
+    description = "Simple authentication middleware for web apps";
+    homepage = "https://tinyauth.app";
+    changelog = "https://github.com/steveiliop56/tinyauth/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "tinyauth";
+    maintainers = with lib.maintainers; [
+      shaunren
+    ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/vi/vitejs/package.nix b/pkgs/by-name/vi/vitejs/package.nix
new file mode 100644
index 000000000000..c1829197c7ad
--- /dev/null
+++ b/pkgs/by-name/vi/vitejs/package.nix
@@ -0,0 +1,70 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  pnpm_10,
+  nodejs_24,
+  makeWrapper,
+  pnpmConfigHook,
+  fetchPnpmDeps,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "vitejs";
+  version = "7.3.1";
+
+  src = fetchFromGitHub {
+    owner = "vitejs";
+    repo = "vite";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-ewtFvWeNFb6LowvA83p53+ilsMDugLzXK1I63lhZUAU=";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+    nodejs_24
+    pnpmConfigHook
+    pnpm_10
+  ];
+
+  pnpmWorkspaces = [ "vite" ];
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      pnpmWorkspaces
+      ;
+    fetcherVersion = 3;
+    hash = "sha256-02s37dcEvxFlaGO+RNxTMPuTV0/sx7hiX1Nzc3A/qro=";
+  };
+
+  buildPhase = ''
+    runHook preBuild
+
+    pnpm --filter=vite build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{bin,lib/vite}
+    cp -r {packages,node_modules} $out/lib/vite
+
+    makeWrapper ${lib.getExe nodejs_24} $out/bin/vite \
+      --inherit-argv0 \
+      --add-flags $out/lib/vite/packages/vite/bin/vite.js
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Frontend tooling for NodeJS";
+    homepage = "https://github.com/vitejs/vite";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+    mainProgram = "vite";
+  };
+})
diff --git a/pkgs/by-name/vi/vitess/package.nix b/pkgs/by-name/vi/vitess/package.nix
index 1024dea0ad9c..4532cc40fa3c 100644
--- a/pkgs/by-name/vi/vitess/package.nix
+++ b/pkgs/by-name/vi/vitess/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "vitess";
-  version = "23.0.0";
+  version = "23.0.3";
 
   src = fetchFromGitHub {
     owner = "vitessio";
     repo = "vitess";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-gP++iix4jonsSgrAblhnT7XFCggCEMG7ve3GKTJuOoo=";
+    hash = "sha256-cLpVpdYpMzJX5Y4RBuUp2SbedBHiqG+SRu8Oh+dowFY=";
   };
 
-  vendorHash = "sha256-jwlIOfBuIi1D40p21jF3LJw508zrovw0ukXUn27Sb9U=";
+  vendorHash = "sha256-YhWa5eUeMCqmA+8Mi3lxQTSQ29xMpWWAb2BQPN1/+N8=";
 
   buildInputs = [ sqlite ];
 
diff --git a/pkgs/by-name/vl/vlang/package.nix b/pkgs/by-name/vl/vlang/package.nix
index ef330235d743..3c9b30ee5e2f 100644
--- a/pkgs/by-name/vl/vlang/package.nix
+++ b/pkgs/by-name/vl/vlang/package.nix
@@ -16,7 +16,7 @@
 }:
 
 let
-  version = "0.4.11";
+  version = "0.5";
   ptraceSubstitution = ''
     #include <sys/types.h>
     #include <sys/ptrace.h>
@@ -25,12 +25,12 @@ let
   # So we fix its rev to correspond to the V version.
   vc = stdenv.mkDerivation {
     pname = "v.c";
-    version = "0.4.11";
+    version = "0.5";
     src = fetchFromGitHub {
       owner = "vlang";
       repo = "vc";
-      rev = "a17f1105aa18b604ed8dac8fa5ca9424362c6e15";
-      hash = "sha256-DAsVr1wtRfGbKO74Vfq7ejci+zQabSWeir8njbHYV3o=";
+      rev = "294bff4ef87427743d0b35c0f7eb1b34a6dd061b";
+      hash = "sha256-NZR9Sxa9+iI0hGjB7Hwxl24K0Ra6ZJiUTk9yHp1J7kw=";
     };
 
     # patch the ptrace reference for darwin
@@ -63,7 +63,7 @@ stdenv.mkDerivation {
     owner = "vlang";
     repo = "v";
     rev = version;
-    hash = "sha256-K5B/fjdCYLE14LPg3ccS+sGC8CS7jZiuuxYkHvljGFA=";
+    hash = "sha256-iS9tXeEsEjxEpgJNjz/08MQfZkSfFZWHy0CMurITr+E=";
   };
 
   propagatedBuildInputs = [
@@ -107,6 +107,11 @@ stdenv.mkDerivation {
     ln -s $out/lib/v $out/bin/v
     wrapProgram $out/bin/v --prefix PATH : ${lib.makeBinPath [ stdenv.cc ]}
 
+    # gen_vc is a V-maintainer tool for pushing bootstrap C files to the vc
+    # repo; it requires network/SSH access and a v.mod root that doesn't exist
+    # in the installed layout, so it cannot be built in the Nix sandbox.
+    rm $out/lib/cmd/tools/gen_vc.v
+
     mkdir -p $HOME/.vmodules;
     ln -sf ${markdown} $HOME/.vmodules/markdown
     $out/lib/v -v build-tools
@@ -120,6 +125,7 @@ stdenv.mkDerivation {
 
   meta = {
     homepage = "https://vlang.io/";
+    changelog = "https://github.com/vlang/v/releases/tag/${version}";
     description = "Simple, fast, safe, compiled language for developing maintainable software";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/we/webcamize/package.nix b/pkgs/by-name/we/webcamize/package.nix
new file mode 100644
index 000000000000..8d6696014af9
--- /dev/null
+++ b/pkgs/by-name/we/webcamize/package.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  pkg-config,
+  ffmpeg,
+  libgphoto2,
+  kmod,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "webcamize";
+  version = "2.0.1";
+
+  src = fetchFromGitHub {
+    owner = "cowtoolz";
+    repo = "webcamize";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-rmATEcAcngCHidMFXNocrhP06LKNLEb+9jfFMGL4AKU=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    ffmpeg
+    libgphoto2
+    kmod
+  ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    install -Dm755 -t $out/bin bin/webcamize
+  '';
+
+  meta = {
+    description = "Use (almost) any camera as a webcam";
+    homepage = "https://github.com/cowtoolz/webcamize";
+    changelog = "https://github.com/cowtoolz/webcamize/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.bsd2;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ imurx ];
+    mainProgram = "webcamize";
+  };
+})
diff --git a/pkgs/by-name/ya/yash/package.nix b/pkgs/by-name/ya/yash/package.nix
index 41736ab834a1..faf8dca5497d 100644
--- a/pkgs/by-name/ya/yash/package.nix
+++ b/pkgs/by-name/ya/yash/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "yash";
-  version = "2.60";
+  version = "2.61";
 
   src = fetchFromGitHub {
     owner = "magicant";
     repo = "yash";
     rev = finalAttrs.version;
-    hash = "sha256-iHM1f+zdYsfuqmyel+vlFi+TQukmN91SyZCHJLXPnTs=";
+    hash = "sha256-ih5BXzhG/DNeWghptXXTXVbZLT63AE8blWTzzfssqXU=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/za/zarf/package.nix b/pkgs/by-name/za/zarf/package.nix
index 900d518803f8..8ff433db8ad7 100644
--- a/pkgs/by-name/za/zarf/package.nix
+++ b/pkgs/by-name/za/zarf/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "zarf";
-  version = "0.70.1";
+  version = "0.73.0";
 
   src = fetchFromGitHub {
     owner = "zarf-dev";
     repo = "zarf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3ucUB6KAIm4dPf/8CysZVwKbWp9QZIeP435Aclyzhfs=";
+    hash = "sha256-zl33nIUsThq1+uuT7C6OVkoICsQwx+RM8xGqZQt8Tm8=";
   };
 
-  vendorHash = "sha256-WjnM9G5Dcn0dawghw6NLGUebIGQ7zJ97nMPL3JgqRKM=";
+  vendorHash = "sha256-K8natFIvEomIcPTu73NsMWbN8D0qzWqLTLGjHrLSaK0=";
   proxyVendor = true;
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/zo/zookeeper/package.nix b/pkgs/by-name/zo/zookeeper/package.nix
index 8b5b21cf7a3d..ad6c01e43717 100644
--- a/pkgs/by-name/zo/zookeeper/package.nix
+++ b/pkgs/by-name/zo/zookeeper/package.nix
@@ -10,16 +10,16 @@
 }:
 let
   # Latest supported LTS JDK for Zookeeper 3.9:
-  # https://zookeeper.apache.org/doc/r3.9.4/zookeeperAdmin.html#sc_requiredSoftware
+  # https://zookeeper.apache.org/doc/r3.9.5/zookeeperAdmin.html#sc_requiredSoftware
   jre = jdk11_headless;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "zookeeper";
-  version = "3.9.4";
+  version = "3.9.5";
 
   src = fetchurl {
     url = "mirror://apache/zookeeper/zookeeper-${finalAttrs.version}/apache-zookeeper-${finalAttrs.version}-bin.tar.gz";
-    hash = "sha512-Nr/65kQO0Nce2DpiG4xSxYOGC0FIEhlzcyN/DBSL0W5rWZl3yQ5euBwPzmuC70SqeCYhU1QXz/xMKgpRpW8s3w==";
+    hash = "sha512-uqHCHdpNVyOPynUeT6K78dr/mihhKxJeSX3M1cGI7mRJ4veZR+R0wt1NGZknidTTayexui/rgMKwxF598OIqqA==";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/development/libraries/opencv/4.x.nix b/pkgs/development/libraries/opencv/4.x.nix
index b2381fee1d08..3e81c8a5b008 100644
--- a/pkgs/development/libraries/opencv/4.x.nix
+++ b/pkgs/development/libraries/opencv/4.x.nix
@@ -459,9 +459,11 @@ effectiveStdenv.mkDerivation {
     cudaPackages.cuda_nvcc
   ];
 
-  # Configure can't find the library without this.
-  OpenBLAS_HOME = optionalString withOpenblas openblas_.dev;
-  OpenBLAS = optionalString withOpenblas openblas_;
+  env = {
+    # Configure can't find the library without this.
+    OpenBLAS_HOME = optionalString withOpenblas openblas_.dev;
+    OpenBLAS = optionalString withOpenblas openblas_;
+  };
 
   cmakeFlags = [
     (cmakeBool "BUILD_INFO_SKIP_SYSTEM_VERSION" true)
diff --git a/pkgs/development/python-modules/apache-tvm-ffi/default.nix b/pkgs/development/python-modules/apache-tvm-ffi/default.nix
new file mode 100644
index 000000000000..b4cd7aa67562
--- /dev/null
+++ b/pkgs/development/python-modules/apache-tvm-ffi/default.nix
@@ -0,0 +1,69 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  cmake,
+  cython,
+  ninja,
+  scikit-build-core,
+  setuptools-scm,
+
+  # dependencies
+  typing-extensions,
+
+  # tests
+  numpy,
+  pytestCheckHook,
+  writableTmpDirAsHomeHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "apache-tvm-ffi";
+  version = "0.1.9";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "apache";
+    repo = "tvm-ffi";
+    tag = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-XnlM//WW2TbjbmzYBq6itJQ7R3J646UMVQUVhV5Afwc=";
+  };
+
+  build-system = [
+    cmake
+    cython
+    ninja
+    scikit-build-core
+    setuptools-scm
+  ];
+  dontUseCmakeConfigure = true;
+
+  dependencies = [
+    typing-extensions
+  ];
+
+  optional-dependencies = {
+    cpp = [
+      ninja
+    ];
+  };
+
+  pythonImportsCheck = [ "tvm_ffi" ];
+
+  nativeCheckInputs = [
+    numpy
+    pytestCheckHook
+    writableTmpDirAsHomeHook
+  ];
+
+  meta = {
+    description = "Open ABI and FFI for Machine Learning Systems";
+    changelog = "https://github.com/apache/tvm-ffi/releases/tag/${finalAttrs.src.tag}";
+    homepage = "https://github.com/apache/tvm-ffi";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+})
diff --git a/pkgs/development/python-modules/cuda-pathfinder/default.nix b/pkgs/development/python-modules/cuda-pathfinder/default.nix
new file mode 100644
index 000000000000..1ca842a476d4
--- /dev/null
+++ b/pkgs/development/python-modules/cuda-pathfinder/default.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+  setuptools-scm,
+
+  # tests
+  pytest-mock,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "cuda-pathfinder";
+  version = "1.4.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "NVIDIA";
+    repo = "cuda-python";
+    tag = "cuda-pathfinder-v${finalAttrs.version}";
+    hash = "sha256-Bsou6vLyMBNbVMPT4vtnWpoi05lXG6pjhuee6Hg/Mm8=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/cuda_pathfinder";
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  pythonImportsCheck = [
+    "cuda"
+    "cuda.pathfinder"
+  ];
+
+  nativeCheckInputs = [
+    pytest-mock
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "one-stop solution for locating CUDA components";
+    homepage = "https://github.com/NVIDIA/cuda-python/tree/main/cuda_pathfinder";
+    changelog = "https://nvidia.github.io/cuda-python/cuda-pathfinder/${finalAttrs.version}/release/${finalAttrs.version}-notes.html";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/development/python-modules/cupy/default.nix b/pkgs/development/python-modules/cupy/default.nix
index c8793df35e88..024c99843ba0 100644
--- a/pkgs/development/python-modules/cupy/default.nix
+++ b/pkgs/development/python-modules/cupy/default.nix
@@ -1,17 +1,24 @@
 {
   lib,
-  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
   cython,
-  fastrlock,
-  numpy,
-  pytestCheckHook,
-  mock,
   setuptools,
+
+  # nativeBuildInputs
   cudaPackages,
-  addDriverRunpath,
   symlinkJoin,
+  addDriverRunpath,
+
+  # dependencies
+  numpy,
+  cuda-pathfinder,
+
+  # tests
+  pytest-mock,
+  pytestCheckHook,
 }:
 
 let
@@ -39,8 +46,7 @@ let
       libcurand
       libcusolver
       libcusparse
-      # NOTE: libcusparse_lt is too new for CuPy, so we must do without.
-      # libcusparse_lt
+      libcusparse_lt # cusparseLt.h
     ]
   );
   cudatoolkit-joined = symlinkJoin {
@@ -49,19 +55,26 @@ let
       outpaths ++ lib.concatMap (outpath: lib.map (output: outpath.${output}) outpath.outputs) outpaths;
   };
 in
-buildPythonPackage.override { stdenv = cudaPackages.backendStdenv; } rec {
+buildPythonPackage.override { stdenv = cudaPackages.backendStdenv; } (finalAttrs: {
   pname = "cupy";
-  version = "13.6.0";
+  version = "14.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cupy";
     repo = "cupy";
-    tag = "v${version}";
-    hash = "sha256-nU3VL0MSCN+mI5m7C5sKAjBSL6ybM6YAk5lJiIDY0ck=";
+    tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
+    hash = "sha256-TaEJ0BveUCXCRrNq9L49Tfbu0334+cANcVm5qnSOE1Q=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail \
+        "Cython>=3.1,<3.2" \
+        "Cython"
+  '';
+
   env = {
     LDFLAGS = toString [
       # Fake libcuda.so (the real one is deployed impurely)
@@ -83,7 +96,6 @@ buildPythonPackage.override { stdenv = cudaPackages.backendStdenv; } rec {
 
   build-system = [
     cython
-    fastrlock
     setuptools
   ];
 
@@ -100,13 +112,13 @@ buildPythonPackage.override { stdenv = cudaPackages.backendStdenv; } rec {
   ];
 
   dependencies = [
-    fastrlock
+    cuda-pathfinder
     numpy
   ];
 
   nativeCheckInputs = [
+    pytest-mock
     pytestCheckHook
-    mock
   ];
 
   # Won't work with the GPU, whose drivers won't be accessible from the build
@@ -124,12 +136,12 @@ buildPythonPackage.override { stdenv = cudaPackages.backendStdenv; } rec {
   meta = {
     description = "NumPy-compatible matrix library accelerated by CUDA";
     homepage = "https://cupy.chainer.org/";
-    changelog = "https://github.com/cupy/cupy/releases/tag/${src.tag}";
+    changelog = "https://github.com/cupy/cupy/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     platforms = [
       "aarch64-linux"
       "x86_64-linux"
     ];
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ GaetanLepage ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/dbt-common/default.nix b/pkgs/development/python-modules/dbt-common/default.nix
index ef8b3b25c92c..81f52aefd1e0 100644
--- a/pkgs/development/python-modules/dbt-common/default.nix
+++ b/pkgs/development/python-modules/dbt-common/default.nix
@@ -30,14 +30,14 @@
 
 buildPythonPackage rec {
   pname = "dbt-common";
-  version = "1.37.2-unstable-2026-02-16";
+  version = "1.37.3-unstable-2026-03-02";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dbt-labs";
     repo = "dbt-common";
-    rev = "db568b8aa2d7c081f36a144c379668dd65007803"; # They don't tag releases
-    hash = "sha256-FIc98xjdmEQ8QJQwvEktj7oT/hJwwqCg4agpR4gaZIc=";
+    rev = "5b0fcac03a1a01e4001ef1ff75a4132cdb412886"; # They don't tag releases
+    hash = "sha256-b4nMtIkQ8RzBjVexwoiv+V26P/7emdSEEj58BdaggnM=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/disposable-email-domains/default.nix b/pkgs/development/python-modules/disposable-email-domains/default.nix
index 591994c20de4..3710c72e89fa 100644
--- a/pkgs/development/python-modules/disposable-email-domains/default.nix
+++ b/pkgs/development/python-modules/disposable-email-domains/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "disposable-email-domains";
-  version = "0.0.162";
+  version = "0.0.165";
   pyproject = true;
 
   # No tags on GitHub
   src = fetchPypi {
     pname = "disposable_email_domains";
     inherit (finalAttrs) version;
-    hash = "sha256-qgiH+yx9URguWMgeaTUI12RkRpmv2e4ZSl0UUoPyyrg=";
+    hash = "sha256-mYxdUIbCJIPnrEAJ5xMf8sVvgk0DElrPHcp+emAMNgY=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/flashinfer/default.nix b/pkgs/development/python-modules/flashinfer/default.nix
index 2e1119edc390..b66cce0288ff 100644
--- a/pkgs/development/python-modules/flashinfer/default.nix
+++ b/pkgs/development/python-modules/flashinfer/default.nix
@@ -9,9 +9,9 @@
   config,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch2,
 
   # build-system
+  apache-tvm-ffi,
   setuptools,
 
   # nativeBuildInputs
@@ -29,30 +29,24 @@
   tqdm,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "flashinfer";
-  version = "0.6.1";
+  version = "0.6.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "flashinfer-ai";
     repo = "flashinfer";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-NRjas11VvvCY6MZiZaYtxG5MXEaFqfbhJxflUT/uraE=";
+    hash = "sha256-Hq3oTeEJHRvXwThI8vc06E3Ot/FnPP0sZUfze3ISa2o=";
   };
 
-  patches = [
-    # TODO: remove patch with update to v0.5.2+
-    # Switch pynvml to nvidia-ml-py
-    (fetchpatch2 {
-      url = "https://github.com/flashinfer-ai/flashinfer/commit/a42f99255d68d1a54b689bd4985339c6b44963a6.patch?full_index=1";
-      hash = "sha256-3XJFcdQeZ/c5fwiQvd95z4p9BzTn8pjle21WzeBxUgk=";
-    })
+  build-system = [
+    apache-tvm-ffi
+    setuptools
   ];
 
-  build-system = [ setuptools ];
-
   nativeBuildInputs = [
     cmake
     ninja
@@ -91,6 +85,7 @@ buildPythonPackage rec {
 
   pythonRemoveDeps = [
     "nvidia-cudnn-frontend"
+    "nvidia-cutlass-dsl"
   ];
   dependencies = [
     click
@@ -119,4 +114,4 @@ buildPythonPackage rec {
       daniel-fahey
     ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/hatch-min-requirements/default.nix b/pkgs/development/python-modules/hatch-min-requirements/default.nix
index f04a12949468..dd650dd811f9 100644
--- a/pkgs/development/python-modules/hatch-min-requirements/default.nix
+++ b/pkgs/development/python-modules/hatch-min-requirements/default.nix
@@ -1,12 +1,17 @@
 {
+  lib,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
   hatch-vcs,
   hatchling,
-  lib,
+
+  # dependencies
+  tomlkit,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "hatch-min-requirements";
   version = "0.2.0";
   pyproject = true;
@@ -14,7 +19,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "tlambert03";
     repo = "hatch-min-requirements";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-QKO5fVvjSqwY+48Fc8sAiZazrxZ4eBYxzVElHr2lcEA=";
   };
 
@@ -23,6 +28,10 @@ buildPythonPackage rec {
     hatch-vcs
   ];
 
+  dependencies = [
+    tomlkit
+  ];
+
   # As of v0.1.0 all tests attempt to use the network
   doCheck = false;
 
@@ -31,9 +40,10 @@ buildPythonPackage rec {
   meta = {
     description = "Hatchling plugin to create optional-dependencies pinned to minimum versions";
     homepage = "https://github.com/tlambert03/hatch-min-requirements";
+    changelog = "https://github.com/tlambert03/hatch-min-requirements/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [
       samuela
     ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/kmapper/default.nix b/pkgs/development/python-modules/kmapper/default.nix
index 895e94b1db51..7208df3a28d0 100644
--- a/pkgs/development/python-modules/kmapper/default.nix
+++ b/pkgs/development/python-modules/kmapper/default.nix
@@ -22,7 +22,7 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "kmapper";
   version = "2.1.0";
   pyproject = true;
@@ -30,7 +30,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "scikit-tda";
     repo = "kepler-mapper";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-i909J0yI8v8BqGbCkcjBAdA02Io+qpILdDkojZj0wv4=";
   };
 
@@ -55,11 +55,18 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # UnboundLocalError: cannot access local variable 'X_blend' where it is not associated with a value
+    "test_tuple_projection"
+    "test_tuple_projection_fit"
+  ];
+
   meta = {
     description = "Python implementation of Mapper algorithm for Topological Data Analysis";
     homepage = "https://kepler-mapper.scikit-tda.org/";
-    changelog = "https://github.com/scikit-tda/kepler-mapper/releases/tag/v${version}";
+    downloadPage = "https://github.com/scikit-tda/kepler-mapper";
+    changelog = "https://github.com/scikit-tda/kepler-mapper/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/langchain-anthropic/default.nix b/pkgs/development/python-modules/langchain-anthropic/default.nix
index f925977727d5..3ca06b41a74d 100644
--- a/pkgs/development/python-modules/langchain-anthropic/default.nix
+++ b/pkgs/development/python-modules/langchain-anthropic/default.nix
@@ -22,19 +22,19 @@
   gitUpdater,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "langchain-anthropic";
-  version = "1.3.3";
+  version = "1.3.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
-    tag = "langchain-anthropic==${version}";
-    hash = "sha256-vQ2h92oP3gpSEu3HjQUF+1KWX9gm4Q7osTynu77UlvA=";
+    tag = "langchain-anthropic==${finalAttrs.version}";
+    hash = "sha256-8dGP26N2aheMTtI2wYMBVitlzrTsJZa5Zt5xVl+vqI4=";
   };
 
-  sourceRoot = "${src.name}/libs/partners/anthropic";
+  sourceRoot = "${finalAttrs.src.name}/libs/partners/anthropic";
 
   build-system = [ hatchling ];
 
@@ -72,7 +72,7 @@ buildPythonPackage rec {
   };
 
   meta = {
-    changelog = "https://github.com/langchain-ai/langchain-anthropic/releases/tag/${src.tag}";
+    changelog = "https://github.com/langchain-ai/langchain-anthropic/releases/tag/${finalAttrs.src.tag}";
     description = "Build LangChain applications with Anthropic";
     homepage = "https://github.com/langchain-ai/langchain/tree/master/libs/partners/anthropic";
     license = lib.licenses.mit;
@@ -80,4 +80,4 @@ buildPythonPackage rec {
       lib.maintainers.sarahec
     ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/langchain-aws/default.nix b/pkgs/development/python-modules/langchain-aws/default.nix
index 3581dfa14354..a1b15105683a 100644
--- a/pkgs/development/python-modules/langchain-aws/default.nix
+++ b/pkgs/development/python-modules/langchain-aws/default.nix
@@ -12,6 +12,10 @@
   numpy,
   pydantic,
 
+  # optional-dependencies
+  langchain-anthropic,
+  anthropic,
+
   # tests
   langchain-tests,
   pytest-asyncio,
@@ -22,16 +26,16 @@
   gitUpdater,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "langchain-aws";
-  version = "1.2.5";
+  version = "1.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain-aws";
-    tag = "langchain-aws==${version}";
-    hash = "sha256-mOK7rTDJPU4eS5jCzQ+yUDl2fkY3x4Mpl5bGEF3eLFc=";
+    tag = "langchain-aws==${finalAttrs.version}";
+    hash = "sha256-hKMTzN2NVMSMCVsFroFFUM0embz8KHbDnmunwOb9ofw=";
   };
 
   postPatch = ''
@@ -39,7 +43,7 @@ buildPythonPackage rec {
       --replace-fail "--snapshot-warn-unused" ""
   '';
 
-  sourceRoot = "${src.name}/libs/aws";
+  sourceRoot = "${finalAttrs.src.name}/libs/aws";
 
   build-system = [ hatchling ];
 
@@ -51,19 +55,25 @@ buildPythonPackage rec {
   ];
 
   pythonRelaxDeps = [
-    # Boto @ 1.35 has outstripped the version requirement
+    # Boto3 spec has outstripped the version requirement
     "boto3"
-    # Each component release requests the exact latest core.
-    # That prevents us from updating individual components.
-    "langchain-core"
   ];
 
+  optional-dependencies = {
+    anthropic = [
+      anthropic.optional-dependencies.bedrock
+      langchain-anthropic
+    ];
+  };
+
   nativeCheckInputs = [
+    anthropic
     langchain-tests
     pytest-asyncio
     pytest-cov-stub
     pytestCheckHook
-  ];
+  ]
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
 
   enabledTestPaths = [ "tests/unit_tests" ];
 
@@ -83,7 +93,7 @@ buildPythonPackage rec {
   };
 
   meta = {
-    changelog = "https://github.com/langchain-ai/langchain-aws/releases/tag/${src.tag}";
+    changelog = "https://github.com/langchain-ai/langchain-aws/releases/tag/${finalAttrs.src.tag}";
     description = "Build LangChain application on AWS";
     homepage = "https://github.com/langchain-ai/langchain-aws/";
     license = lib.licenses.mit;
@@ -92,4 +102,4 @@ buildPythonPackage rec {
       sarahec
     ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/langchain-classic/default.nix b/pkgs/development/python-modules/langchain-classic/default.nix
index b6302540fc5d..4484a351fae5 100644
--- a/pkgs/development/python-modules/langchain-classic/default.nix
+++ b/pkgs/development/python-modules/langchain-classic/default.nix
@@ -40,27 +40,22 @@
   gitUpdater,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "langchain-classic";
-  version = "1.0.1";
+  version = "1.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
-    tag = "langchain-classic==${version}";
-    hash = "sha256-4DlKOxt5OoPm38szMEJpw6gDl247eRsx4LZpofUKpUk=";
+    tag = "langchain-classic==${finalAttrs.version}";
+    hash = "sha256-NH2l2Htt5nAzzvwKUgQNwvQBLxZKhOLxnxthvK/Yh4I=";
   };
 
-  sourceRoot = "${src.name}/libs/langchain";
+  sourceRoot = "${finalAttrs.src.name}/libs/langchain";
 
   build-system = [ hatchling ];
 
-  pythonRelaxDeps = [
-    # Each component release requests the exact latest core.
-    "langchain-core"
-  ];
-
   dependencies = [
     langchain-core
     langchain-text-splitters
@@ -121,4 +116,4 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ sarahec ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/langchain-core/default.nix b/pkgs/development/python-modules/langchain-core/default.nix
index 1ce07affc04d..c2b31f9710ff 100644
--- a/pkgs/development/python-modules/langchain-core/default.nix
+++ b/pkgs/development/python-modules/langchain-core/default.nix
@@ -21,7 +21,6 @@
   blockbuster,
   freezegun,
   grandalf,
-  httpx,
   langchain-core,
   langchain-tests,
   numpy,
@@ -35,19 +34,19 @@
   gitUpdater,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "langchain-core";
-  version = "1.2.12";
+  version = "1.2.17";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
-    tag = "langchain-core==${version}";
-    hash = "sha256-KSZhuABk5OpfJ1e1/h/Vr7RA5f9eSK7VBJKaJ5i6xv4=";
+    tag = "langchain-core==${finalAttrs.version}";
+    hash = "sha256-vuMVNRQSgj3o1KRBgspUglLECPF+YYWpH4/e5iE8ZYY=";
   };
 
-  sourceRoot = "${src.name}/libs/core";
+  sourceRoot = "${finalAttrs.src.name}/libs/core";
 
   build-system = [ hatchling ];
 
@@ -136,11 +135,11 @@ buildPythonPackage rec {
   meta = {
     description = "Building applications with LLMs through composability";
     homepage = "https://github.com/langchain-ai/langchain/tree/master/libs/core";
-    changelog = "https://github.com/langchain-ai/langchain/releases/tag/${src.tag}";
+    changelog = "https://github.com/langchain-ai/langchain/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       natsukium
       sarahec
     ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/langchain-openai/default.nix b/pkgs/development/python-modules/langchain-openai/default.nix
index ca02978305cf..9f1f52625f8e 100644
--- a/pkgs/development/python-modules/langchain-openai/default.nix
+++ b/pkgs/development/python-modules/langchain-openai/default.nix
@@ -31,19 +31,19 @@
   gitUpdater,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "langchain-openai";
-  version = "1.1.6";
+  version = "1.1.10";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
-    tag = "langchain-openai==${version}";
-    hash = "sha256-Y+GV48rlqMfT4TrmoJFGqbHKfc8gxq61NhcUpwSsOwk=";
+    tag = "langchain-openai==${finalAttrs.version}";
+    hash = "sha256-k0JpzgF+2UaYUbtzOB+NFxq7Ge/eRbT8M4PgvDpRG2g=";
   };
 
-  sourceRoot = "${src.name}/libs/partners/openai";
+  sourceRoot = "${finalAttrs.src.name}/libs/partners/openai";
 
   build-system = [ hatchling ];
 
@@ -100,7 +100,7 @@ buildPythonPackage rec {
   };
 
   meta = {
-    changelog = "https://github.com/langchain-ai/langchain/releases/tag/${src.tag}";
+    changelog = "https://github.com/langchain-ai/langchain/releases/tag/${finalAttrs.src.tag}";
     description = "Integration package connecting OpenAI and LangChain";
     homepage = "https://github.com/langchain-ai/langchain/tree/master/libs/partners/openai";
     license = lib.licenses.mit;
@@ -109,4 +109,4 @@ buildPythonPackage rec {
       sarahec
     ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/langchain-tests/default.nix b/pkgs/development/python-modules/langchain-tests/default.nix
index bb08244095a2..28add86608d3 100644
--- a/pkgs/development/python-modules/langchain-tests/default.nix
+++ b/pkgs/development/python-modules/langchain-tests/default.nix
@@ -26,19 +26,19 @@
   gitUpdater,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "langchain-tests";
-  version = "1.1.2";
+  version = "1.1.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
-    tag = "langchain-tests==${version}";
-    hash = "sha256-g5s7zL4l/kIUoIu7/3+Ve3SXW3O9tj8f2N3bZ0gbBts=";
+    tag = "langchain-tests==${finalAttrs.version}";
+    hash = "sha256-HyPJ3binXV3ypksvpyz1t6B1Zdz3NY6z4Ttq7K4yo+g=";
   };
 
-  sourceRoot = "${src.name}/libs/standard-tests";
+  sourceRoot = "${finalAttrs.src.name}/libs/standard-tests";
 
   build-system = [ hatchling ];
 
@@ -84,7 +84,7 @@ buildPythonPackage rec {
   };
 
   meta = {
-    changelog = "https://github.com/langchain-ai/langchain/releases/tag/${src.tag}";
+    changelog = "https://github.com/langchain-ai/langchain/releases/tag/${finalAttrs.src.tag}";
     description = "Build context-aware reasoning applications";
     homepage = "https://github.com/langchain-ai/langchain";
     license = lib.licenses.mit;
@@ -93,4 +93,4 @@ buildPythonPackage rec {
       sarahec
     ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/langchain-text-splitters/default.nix b/pkgs/development/python-modules/langchain-text-splitters/default.nix
index 6e51732c08ad..437270e4ba75 100644
--- a/pkgs/development/python-modules/langchain-text-splitters/default.nix
+++ b/pkgs/development/python-modules/langchain-text-splitters/default.nix
@@ -19,7 +19,7 @@
   gitUpdater,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "langchain-text-splitters";
   version = "1.1.1";
   pyproject = true;
@@ -27,20 +27,14 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
-    tag = "langchain-text-splitters==${version}";
+    tag = "langchain-text-splitters==${finalAttrs.version}";
     hash = "sha256-I5eMc/E7sCxEQG8+jw3E/M4uB7adKU5IMHRsS6pacsA=";
   };
 
-  sourceRoot = "${src.name}/libs/text-splitters";
+  sourceRoot = "${finalAttrs.src.name}/libs/text-splitters";
 
   build-system = [ hatchling ];
 
-  pythonRelaxDeps = [
-    # Each component release requests the exact latest core.
-    # That prevents us from updating individual components.
-    "langchain-core"
-  ];
-
   dependencies = [ langchain-core ];
 
   pythonImportsCheck = [ "langchain_text_splitters" ];
@@ -63,7 +57,7 @@ buildPythonPackage rec {
   };
 
   meta = {
-    changelog = "https://github.com/langchain-ai/langchain/releases/tag/${src.tag}";
+    changelog = "https://github.com/langchain-ai/langchain/releases/tag/${finalAttrs.src.tag}";
     description = "LangChain utilities for splitting into chunks a wide variety of text documents";
     homepage = "https://github.com/langchain-ai/langchain/tree/master/libs/text-splitters";
     license = lib.licenses.mit;
@@ -72,4 +66,4 @@ buildPythonPackage rec {
       sarahec
     ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/langchain-xai/default.nix b/pkgs/development/python-modules/langchain-xai/default.nix
index 2fd340bbc476..ab01b237473e 100644
--- a/pkgs/development/python-modules/langchain-xai/default.nix
+++ b/pkgs/development/python-modules/langchain-xai/default.nix
@@ -23,19 +23,19 @@
   gitUpdater,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "langchain-xai";
-  version = "1.2.1";
+  version = "1.2.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
-    tag = "langchain-xai==${version}";
-    hash = "sha256-Eryr68TQDN37AwJVEm1jJvwqcxMjl2KO42dy7doJCrA=";
+    tag = "langchain-xai==${finalAttrs.version}";
+    hash = "sha256-RUklm627HiwMcpKkm+0uWZgHp4iDtSsmEpLb9MxumqI=";
   };
 
-  sourceRoot = "${src.name}/libs/partners/xai";
+  sourceRoot = "${finalAttrs.src.name}/libs/partners/xai";
 
   build-system = [ hatchling ];
 
@@ -46,12 +46,6 @@ buildPythonPackage rec {
     requests
   ];
 
-  pythonRelaxDeps = [
-    # Each component release requests the exact latest core.
-    # That prevents us from updating individual components.
-    "langchain-core"
-  ];
-
   nativeCheckInputs = [
     langchain-tests
     pytest-asyncio
@@ -78,7 +72,7 @@ buildPythonPackage rec {
   };
 
   meta = {
-    changelog = "https://github.com/langchain-ai/langchain-xai/releases/tag/${src.tag}";
+    changelog = "https://github.com/langchain-ai/langchain-xai/releases/tag/${finalAttrs.src.tag}";
     description = "Build LangChain applications with X AI";
     homepage = "https://github.com/langchain-ai/langchain/tree/master/libs/partners/xai";
     license = lib.licenses.mit;
@@ -86,4 +80,4 @@ buildPythonPackage rec {
       lib.maintainers.sarahec
     ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/langchain/default.nix b/pkgs/development/python-modules/langchain/default.nix
index 1282a6a0c1a6..cb439c307d79 100644
--- a/pkgs/development/python-modules/langchain/default.nix
+++ b/pkgs/development/python-modules/langchain/default.nix
@@ -30,6 +30,7 @@
   runtimeShell,
 
   # tests
+  blockbuster,
   langchain-tests,
   pytest-asyncio,
   pytest-mock,
@@ -43,19 +44,19 @@
   gitUpdater,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "langchain";
-  version = "1.2.7";
+  version = "1.2.10";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
-    tag = "langchain==${version}";
-    hash = "sha256-vwd8FoXeMLQyFcEViXx/3LqpNieyp4HHevMAv2AxNVY=";
+    tag = "langchain==${finalAttrs.version}";
+    hash = "sha256-Icgka7z1wLuxEjUO5baxMya7KfltYsK8TXtCMg73E1Q=";
   };
 
-  sourceRoot = "${src.name}/libs/langchain_v1";
+  sourceRoot = "${finalAttrs.src.name}/libs/langchain_v1";
 
   postPatch = ''
     substituteInPlace langchain/agents/middleware/shell_tool.py \
@@ -64,14 +65,6 @@ buildPythonPackage rec {
 
   build-system = [ hatchling ];
 
-  pythonRelaxDeps = [
-    # Each component release requests the exact latest core.
-    # That prevents us from updating individual components.
-    "langchain-core"
-    "numpy"
-    "tenacity"
-  ];
-
   dependencies = [
     langchain-core
     langgraph
@@ -98,6 +91,7 @@ buildPythonPackage rec {
   };
 
   nativeCheckInputs = [
+    blockbuster
     langchain-tests
     # langchain-openai -- causes recursion error
     pytest-asyncio
@@ -150,11 +144,11 @@ buildPythonPackage rec {
   meta = {
     description = "Building applications with LLMs through composability";
     homepage = "https://github.com/langchain-ai/langchain";
-    changelog = "https://github.com/langchain-ai/langchain/releases/tag/${src.tag}";
+    changelog = "https://github.com/langchain-ai/langchain/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       natsukium
       sarahec
     ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/nexusformat/default.nix b/pkgs/development/python-modules/nexusformat/default.nix
index b9c9ffdc7117..8d218dd2d041 100644
--- a/pkgs/development/python-modules/nexusformat/default.nix
+++ b/pkgs/development/python-modules/nexusformat/default.nix
@@ -2,10 +2,12 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  colored,
   h5py,
   hdf5plugin,
   numpy,
   pytestCheckHook,
+  python-dateutil,
   scipy,
   setuptools-scm,
   setuptools,
@@ -27,9 +29,11 @@ buildPythonPackage rec {
   ];
 
   dependencies = [
+    colored
     h5py
     hdf5plugin
     numpy
+    python-dateutil
     scipy
   ];
 
diff --git a/pkgs/development/python-modules/pymatting/default.nix b/pkgs/development/python-modules/pymatting/default.nix
index 6daa3f4950c3..e74dbd1eb9fd 100644
--- a/pkgs/development/python-modules/pymatting/default.nix
+++ b/pkgs/development/python-modules/pymatting/default.nix
@@ -2,19 +2,29 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
   numba,
   numpy,
   pillow,
-  pytestCheckHook,
   scipy,
-  setuptools,
-  config,
-  cudaSupport ? config.cudaSupport,
+  # cuda-only
   cupy,
   pyopencl,
+
+  # tests
+  pocl,
+  pytestCheckHook,
+  writableTmpDirAsHomeHook,
+
+  config,
+  cudaSupport ? config.cudaSupport,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pymatting";
   version = "1.1.15";
   pyproject = true;
@@ -22,7 +32,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "pymatting";
     repo = "pymatting";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-rcatlQE+YgppY//ZgGY9jO5KI0ED30fLlqW9N+xRNqk=";
   };
 
@@ -39,10 +49,19 @@ buildPythonPackage rec {
     pyopencl
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
-
   pythonImportsCheck = [ "pymatting" ];
 
+  nativeCheckInputs = [
+    pytestCheckHook
+  ]
+  ++ lib.optionals cudaSupport [
+    # Provides a CPU-based OpenCL ICD so that pyopencl's module-level
+    # cl.create_some_context() succeeds without GPU hardware.
+    pocl
+    # pocl needs a writable $HOME for its kernel cache directory.
+    writableTmpDirAsHomeHook
+  ];
+
   disabledTests = [
     # no access to input data set
     # see: https://github.com/pymatting/pymatting/blob/master/tests/download_images.py
@@ -52,14 +71,16 @@ buildPythonPackage rec {
     "test_lkm"
   ];
 
-  # pyopencl._cl.LogicError: clGetPlatformIDs failed: PLATFORM_NOT_FOUND_KHR
-  disabledTestPaths = lib.optional cudaSupport "tests/test_foreground.py";
+  disabledTestPaths = lib.optionals cudaSupport [
+    # Requires a CUDA driver for cupy GPU operations
+    "tests/test_foreground.py"
+  ];
 
   meta = {
     description = "Python library for alpha matting";
     homepage = "https://github.com/pymatting/pymatting";
-    changelog = "https://github.com/pymatting/pymatting/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/pymatting/pymatting/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/pynndescent/default.nix b/pkgs/development/python-modules/pynndescent/default.nix
index 22d4e586f3bd..4be6ffb850da 100644
--- a/pkgs/development/python-modules/pynndescent/default.nix
+++ b/pkgs/development/python-modules/pynndescent/default.nix
@@ -17,7 +17,7 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pynndescent";
   version = "0.6.0";
   pyproject = true;
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "lmcinnes";
     repo = "pynndescent";
-    tag = "release-${version}";
+    tag = "release-${finalAttrs.version}";
     hash = "sha256-RfIbPPyx+Y7niuFrLjA02cUDHTSv9s5E4JiXv4ZBNEc=";
   };
 
@@ -39,14 +39,24 @@ buildPythonPackage rec {
     scipy
   ];
 
+  pythonImportsCheck = [ "pynndescent" ];
+
   nativeCheckInputs = [ pytestCheckHook ];
 
-  pythonImportsCheck = [ "pynndescent" ];
+  disabledTests = [
+    # AssertionError: Arrays are not almost equal to 6 decimals
+    "test_seuclidean"
+
+    # sklearn.utils._param_validation.InvalidParameterError: The 'metric' parameter of
+    # pairwise_distances must be a str among ...
+    "test_binary_check"
+    "test_sparse_binary_check"
+  ];
 
   meta = {
     description = "Nearest Neighbor Descent";
     homepage = "https://github.com/lmcinnes/pynndescent";
-    changelog = "https://github.com/lmcinnes/pynndescent/releases/tag/release-${src.tag}";
+    changelog = "https://github.com/lmcinnes/pynndescent/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd2;
     maintainers = with lib.maintainers; [ mic92 ];
     badPlatforms = [
@@ -55,4 +65,4 @@ buildPythonPackage rec {
       "aarch64-linux"
     ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/python-openstackclient/default.nix b/pkgs/development/python-modules/python-openstackclient/default.nix
index bc21af90799d..a3f49b0f63a3 100644
--- a/pkgs/development/python-modules/python-openstackclient/default.nix
+++ b/pkgs/development/python-modules/python-openstackclient/default.nix
@@ -3,6 +3,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   ddt,
+  installShellFiles,
   openstackdocstheme,
   osc-lib,
   osc-placement,
@@ -27,6 +28,7 @@
   setuptools,
   sphinxHook,
   sphinxcontrib-apidoc,
+  stdenv,
   stestrCheckHook,
   versionCheckHook,
 }:
@@ -68,6 +70,10 @@ buildPythonPackage (finalAttrs: {
   # to support proxy envs like ALL_PROXY in requests
   ++ requests.optional-dependencies.socks;
 
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
   nativeCheckInputs = [
     ddt
     requests-mock
@@ -116,6 +122,11 @@ buildPythonPackage (finalAttrs: {
   ];
   doInstallCheck = true;
 
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd openstack \
+      --bash <($out/bin/openstack complete)
+  '';
+
   meta = {
     description = "OpenStack Command-line Client";
     mainProgram = "openstack";
diff --git a/pkgs/development/python-modules/python-swiftclient/default.nix b/pkgs/development/python-modules/python-swiftclient/default.nix
index af7def06f0c7..72bea8934f72 100644
--- a/pkgs/development/python-modules/python-swiftclient/default.nix
+++ b/pkgs/development/python-modules/python-swiftclient/default.nix
@@ -1,59 +1,89 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
-  installShellFiles,
-  mock,
-  openstacksdk,
+  fetchFromGitHub,
   pbr,
+  setuptools,
+  installShellFiles,
+
+  # direct
   python-keystoneclient,
+
+  # tests
+  stestrCheckHook,
+  versionCheckHook,
+  hacking,
+  coverage,
+  keystoneauth1,
   stestr,
+  openstacksdk,
+
+  # docs
+  sphinxHook,
+  openstackdocstheme,
+  sphinxcontrib-apidoc,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "python-swiftclient";
-  version = "4.9.0";
+  version = "4.10.0";
   pyproject = true;
 
-  src = fetchPypi {
-    pname = "python_swiftclient";
-    inherit version;
-    hash = "sha256-niB7guwxeG8Q24/vbiBWgcJJl6C2ANKKGU+dFakO13I=";
-  };
-
-  nativeBuildInputs = [ installShellFiles ];
-
   build-system = [
     pbr
+    setuptools
   ];
 
+  env.PBR_VERSION = finalAttrs.version;
+
+  src = fetchFromGitHub {
+    owner = "openstack";
+    repo = "python-swiftclient";
+    tag = finalAttrs.version;
+    hash = "sha256-G3o9R3+hDQgvSnmle0paZo/KV56OMU38tIXqUJGmUaQ=";
+  };
+
+  nativeBuildInputs = [
+    openstackdocstheme
+    sphinxcontrib-apidoc
+    sphinxHook
+    installShellFiles
+  ];
+
+  sphinxBuilders = [ "man" ];
+
   dependencies = [
     python-keystoneclient
   ];
 
   nativeCheckInputs = [
-    mock
+    stestrCheckHook
     openstacksdk
+    hacking
+    coverage
+    keystoneauth1
     stestr
+    openstacksdk
   ];
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
   postInstall = ''
-    installShellCompletion --cmd swift \
-      --bash tools/swift.bash_completion
+    installShellCompletion --cmd swift --bash tools/swift.bash_completion
     installManPage doc/manpages/*
   '';
 
-  checkPhase = ''
-    stestr run
-  '';
-
-  pythonImportsCheck = [ "swiftclient" ];
+  pythonImportsCheck = [
+    "swiftclient"
+  ];
 
   meta = {
-    homepage = "https://github.com/openstack/python-swiftclient";
-    description = "Python bindings to the OpenStack Object Storage API";
+    description = "Client library for OpenStack Swift API";
     mainProgram = "swift";
+    homepage = "https://docs.openstack.org/python-swiftclient/latest/";
+    downloadPage = "https://github.com/openstack/python-swiftclient/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     teams = [ lib.teams.openstack ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/python-watcherclient/default.nix b/pkgs/development/python-modules/python-watcherclient/default.nix
index 5733e4bb5fd9..e83e3940b97f 100644
--- a/pkgs/development/python-modules/python-watcherclient/default.nix
+++ b/pkgs/development/python-modules/python-watcherclient/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "python-watcherclient";
-  version = "4.9.0";
+  version = "4.10.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "openstack";
     repo = "python-watcherclient";
     tag = version;
-    hash = "sha256-ik//J9R9F4SCljexijcfXuSbDgDUNnMTqfpxIPd2Jm8=";
+    hash = "sha256-TYMV55uvTCvHKj5w5QA2zRqVr6pXCXh2Oc07Yo7epjs=";
   };
 
   env.PBR_VERSION = version;
diff --git a/pkgs/development/python-modules/rembg/default.nix b/pkgs/development/python-modules/rembg/default.nix
index 209a1df7c07f..4100177c2646 100644
--- a/pkgs/development/python-modules/rembg/default.nix
+++ b/pkgs/development/python-modules/rembg/default.nix
@@ -33,8 +33,12 @@
 
   # tests
   versionCheckHook,
+  pocl,
 
   withCli ? false,
+  config,
+  cudaSupport ? config.cudaSupport,
+  writableTmpDirAsHomeHook,
 }:
 
 let
@@ -100,9 +104,24 @@ buildPythonPackage (finalAttrs: {
   postInstall = lib.optionalString (!withCli) "rm -r $out/bin";
 
   # not running python tests, as they require network access
-  nativeCheckInputs = lib.optionals withCli [
-    versionCheckHook
-  ];
+  nativeCheckInputs =
+    lib.optionals
+      (
+        withCli
+        # Crashes in the sandbox as no drivers are available
+        # opencl._cl.RuntimeError: no CL platforms available to ICD loader
+        && (!cudaSupport)
+      )
+      [
+        versionCheckHook
+      ]
+    ++ lib.optionals cudaSupport [
+      # Provides a CPU-based OpenCL ICD so that pyopencl's module-level
+      # cl.create_some_context() succeeds without GPU hardware.
+      pocl
+      # pocl needs a writable $HOME for its kernel cache directory.
+      writableTmpDirAsHomeHook
+    ];
   versionCheckKeepEnvironment = [
     # Otherwise, fail with:
     # RuntimeError: cannot cache function '_make_tree': no locator available for file
diff --git a/pkgs/development/python-modules/scanpy/default.nix b/pkgs/development/python-modules/scanpy/default.nix
index 88b1f4c7f624..6d4880c5f0b4 100644
--- a/pkgs/development/python-modules/scanpy/default.nix
+++ b/pkgs/development/python-modules/scanpy/default.nix
@@ -45,6 +45,7 @@
   scikit-misc,
 
   # tests
+  dependency-groups,
   jinja2,
   pytest-cov-stub,
   pytest-mock,
@@ -156,6 +157,7 @@ buildPythonPackage (finalAttrs: {
   };
 
   nativeCheckInputs = [
+    dependency-groups
     jinja2
     pytest-cov-stub
     pytest-mock
@@ -172,6 +174,12 @@ buildPythonPackage (finalAttrs: {
     export NUMBA_CACHE_DIR=$(mktemp -d);
   '';
 
+  pytestFlagsArray = [
+    # UserWarning: 'where' used without 'out', expect unitialized memory in output.
+    # If this is intentional, use out=None.
+    "-Wignore::UserWarning"
+  ];
+
   disabledTestPaths = [
     # try to download data:
     "tests/test_aggregated.py"
@@ -221,6 +229,11 @@ buildPythonPackage (finalAttrs: {
     # 'write/test.h5ad', errno = 2, error message = 'No such file or directory', flags = 13, o_flags
     # = 242)
     "test_write"
+
+    # Snapshot tests failing because of warnings in output
+    "scanpy.datasets._datasets.krumsiek11"
+    "scanpy.datasets._datasets.toggleswitch"
+    "scanpy.preprocessing._simple.filter_cells"
   ];
 
   pythonImportsCheck = [ "scanpy" ];
diff --git a/pkgs/development/python-modules/skrl/default.nix b/pkgs/development/python-modules/skrl/default.nix
index 991899643be9..0b37d4d0261b 100644
--- a/pkgs/development/python-modules/skrl/default.nix
+++ b/pkgs/development/python-modules/skrl/default.nix
@@ -2,18 +2,30 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
   setuptools,
+
+  # dependencies
   gym,
   gymnasium,
-  torch,
+  packaging,
   tensorboard,
+  torch,
   tqdm,
   wandb,
-  packaging,
+
+  # tests
+  flax,
+  jax,
+  optax,
+  pettingzoo,
+  pygame,
+  pymunk,
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "skrl";
   version = "1.4.3";
   pyproject = true;
@@ -21,49 +33,49 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "Toni-SM";
     repo = "skrl";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-5lkoYAmMIWqK3+E3WxXMWS9zal2DhZkfl30EkrHKpdI=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     gym
     gymnasium
-    torch
+    packaging
     tensorboard
+    torch
     tqdm
     wandb
-    packaging
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
-  doCheck = torch.cudaSupport;
+  pythonImportsCheck = [ "skrl" ];
 
-  pythonImportsCheck = [
-    "skrl"
-    "skrl.agents"
-    "skrl.agents.torch"
-    "skrl.envs"
-    "skrl.envs.torch"
-    "skrl.models"
-    "skrl.models.torch"
-    "skrl.resources"
-    "skrl.resources.noises"
-    "skrl.resources.noises.torch"
-    "skrl.resources.schedulers"
-    "skrl.resources.schedulers.torch"
-    "skrl.trainers"
-    "skrl.trainers.torch"
-    "skrl.utils"
-    "skrl.utils.model_instantiators"
+  nativeCheckInputs = [
+    flax
+    jax
+    optax
+    pettingzoo
+    pygame
+    pymunk
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # TypeError: The array passed to from_dlpack must have __dlpack__ and __dlpack_device__ methods
+    "test_env"
+    "test_multi_agent_env"
+
+    # OverflowError
+    "test_key"
   ];
 
   meta = {
     description = "Reinforcement learning library using PyTorch focusing on readability and simplicity";
-    changelog = "https://github.com/Toni-SM/skrl/releases/tag/${version}";
     homepage = "https://skrl.readthedocs.io";
+    downloadPage = "https://github.com/Toni-SM/skrl";
+    changelog = "https://github.com/Toni-SM/skrl/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ bcdarwin ];
   };
-}
+})
diff --git a/pkgs/servers/home-assistant/custom-components/octopus_energy/package.nix b/pkgs/servers/home-assistant/custom-components/octopus_energy/package.nix
index 7fa157eafeae..c4e99fa654db 100644
--- a/pkgs/servers/home-assistant/custom-components/octopus_energy/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/octopus_energy/package.nix
@@ -11,13 +11,13 @@
 buildHomeAssistantComponent rec {
   owner = "BottlecapDave";
   domain = "octopus_energy";
-  version = "18.0.0";
+  version = "18.1.0";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "HomeAssistant-OctopusEnergy";
     tag = "v${version}";
-    hash = "sha256-nCE3cdvaDTIeallI+0gr8IRHyXORzJyWgC4gxXIfLh8=";
+    hash = "sha256-V8y/td0873X+rXxu9kQGQq0D3Vs+TuPk4KTqd3oagtE=";
   };
 
   dependencies = [ pydantic ];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 51b83fe3ce19..e818ef702d99 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3857,12 +3857,10 @@ with pkgs;
   wrapNonDeterministicGcc =
     stdenv: ccWrapper:
     if ccWrapper.isGNU then
-      ccWrapper.overrideAttrs (old: {
-        env = old.env // {
-          cc = old.env.cc.override {
-            reproducibleBuild = false;
-            profiledCompiler = with stdenv; (!isDarwin && hostPlatform.isx86);
-          };
+      ccWrapper.override (prev: {
+        cc = prev.cc.override {
+          reproducibleBuild = false;
+          profiledCompiler = with stdenv; (!isDarwin && hostPlatform.isx86);
         };
       })
     else
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b6bb7a027f12..5749d69bc2fd 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -834,6 +834,8 @@ self: super: with self; {
 
   apache-beam = callPackage ../development/python-modules/apache-beam { };
 
+  apache-tvm-ffi = callPackage ../development/python-modules/apache-tvm-ffi { };
+
   apcaccess = callPackage ../development/python-modules/apcaccess { };
 
   apeye = callPackage ../development/python-modules/apeye { };
@@ -3384,6 +3386,8 @@ self: super: with self; {
 
   cuda-bindings = callPackage ../development/python-modules/cuda-bindings { };
 
+  cuda-pathfinder = callPackage ../development/python-modules/cuda-pathfinder { };
+
   cupy = callPackage ../development/python-modules/cupy {
     cudaPackages =
       # CuDNN 9 is not supported: