diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 7d6f7ff5e92a..8ef6e37133f5 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -49,7 +49,7 @@ jobs:
 
       - name: Create backport PRs
         id: backport
-        uses: korthout/backport-action@3c06f323a58619da1e8522229ebc8d5de2633e46 # v4.3.0
+        uses: korthout/backport-action@ad30f01dbe543be4a24431001c38f3617af8c745 # v4.4.0
         with:
           # Config README: https://github.com/korthout/backport-action#backport-action
           add_author_as_reviewer: true
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index dca724aa467a..591516bb93cf 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -62,7 +62,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+      - uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
         with:
           # Sandbox is disabled on MacOS by default.
           extra_nix_config: sandbox = true
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index bd640e5f530e..fa16aec65997 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -120,7 +120,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+      - uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
 
       - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
         continue-on-error: true
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index 17fddddde51d..4939fa5ec329 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -132,7 +132,7 @@ jobs:
             core.info(`Found pinned.json commit: ${ciPinBumpCommit}`)
 
       - name: Install Nix
-        uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+        uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
 
       - name: Load supported versions
         id: versions
@@ -180,7 +180,7 @@ jobs:
           target-as-trusted-at: ${{ inputs.targetSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+        uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
 
       - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
         continue-on-error: true
@@ -270,7 +270,7 @@ jobs:
           merge-multiple: true
 
       - name: Install Nix
-        uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+        uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
 
       - name: Combine all output paths and eval stats
         run: |
@@ -465,7 +465,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+        uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
 
       - name: Ensure flake outputs on all systems still evaluate
         run: nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1'
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 43653e3c4b3b..536a4757026c 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -35,7 +35,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+      - uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
 
       # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
       # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -70,7 +70,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+      - uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
 
       - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
         continue-on-error: true
@@ -100,7 +100,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@616559265b40713947b9c190a8ff4b507b5df49b # v31.10.4
+      - uses: cachix/install-nix-action@ab739621df7a23f52766f9ccc97f38da6b7af14f # v31.10.5
 
       - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
         continue-on-error: true
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 1bfba6ada308..92b2414814fb 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -145,6 +145,12 @@
     githubId = 67933444;
     keys = [ { fingerprint = "B39E B98E 8860 DAFB 0567  0073 A614 B7D2 5134 987A"; } ];
   };
+  _0xgsvs = {
+    email = "venkat.subrahmanyam.34@gmail.com";
+    name = "0xgsvs";
+    github = "0xgsvs";
+    githubId = 161702876;
+  };
   _0xMillyByte = {
     email = "emilia.daelman@gmail.com";
     name = "Emilia Daelman";
diff --git a/nixos/modules/services/backup/duplicity.nix b/nixos/modules/services/backup/duplicity.nix
index fa0b00db6b2c..b4d9c94748d5 100644
--- a/nixos/modules/services/backup/duplicity.nix
+++ b/nixos/modules/services/backup/duplicity.nix
@@ -47,7 +47,7 @@ in
     includeFileList = lib.mkOption {
       type = lib.types.nullOr lib.types.path;
       default = null;
-      example = /path/to/fileList.txt;
+      example = "/path/to/fileList.txt";
       description = ''
         File containing newline-separated list of paths to include into the
         backups. See the FILE SELECTION section in {manpage}`duplicity(1)` for
@@ -58,7 +58,7 @@ in
     excludeFileList = lib.mkOption {
       type = lib.types.nullOr lib.types.path;
       default = null;
-      example = /path/to/fileList.txt;
+      example = "/path/to/fileList.txt";
       description = ''
         File containing newline-separated list of paths to exclude into the
         backups. See the FILE SELECTION section in {manpage}`duplicity(1)` for
diff --git a/nixos/modules/services/home-automation/evcc.nix b/nixos/modules/services/home-automation/evcc.nix
index 9708a3ce16f1..e6bde74d5f26 100644
--- a/nixos/modules/services/home-automation/evcc.nix
+++ b/nixos/modules/services/home-automation/evcc.nix
@@ -41,7 +41,7 @@ in
     environmentFile = mkOption {
       type = nullOr path;
       default = null;
-      example = /run/keys/evcc;
+      example = "/run/keys/evcc";
       description = ''
         File with environment variables to pass into the runtime environment.
 
diff --git a/nixos/modules/services/mail/maddy.nix b/nixos/modules/services/mail/maddy.nix
index 0bd3a0c2bd99..32dcf0347d2e 100644
--- a/nixos/modules/services/mail/maddy.nix
+++ b/nixos/modules/services/mail/maddy.nix
@@ -329,8 +329,8 @@ in
           This option does not delete accounts which are not (anymore) listed.
         '';
         example = {
-          "user1@localhost".passwordFile = /secrets/user1-localhost;
-          "user2@localhost".passwordFile = /secrets/user2-localhost;
+          "user1@localhost".passwordFile = "/secrets/user1-localhost";
+          "user2@localhost".passwordFile = "/secrets/user2-localhost";
         };
         type = lib.types.attrsOf (
           lib.types.submodule {
diff --git a/nixos/modules/services/networking/ejabberd.nix b/nixos/modules/services/networking/ejabberd.nix
index c4d692812c47..908aaec2d070 100644
--- a/nixos/modules/services/networking/ejabberd.nix
+++ b/nixos/modules/services/networking/ejabberd.nix
@@ -93,6 +93,8 @@ in
   config = lib.mkIf cfg.enable {
     environment.systemPackages = [ cfg.package ];
 
+    services.epmd.enable = true;
+
     users.users = lib.optionalAttrs (cfg.user == "ejabberd") {
       ejabberd = {
         group = cfg.group;
@@ -109,7 +111,11 @@ in
     systemd.services.ejabberd = {
       description = "ejabberd server";
       wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
+      after = [
+        "network.target"
+        "epmd.socket"
+      ];
+      wants = [ "epmd.socket" ];
       path = [
         pkgs.findutils
         pkgs.coreutils
diff --git a/nixos/modules/virtualisation/oci-containers.nix b/nixos/modules/virtualisation/oci-containers.nix
index b7dde1126933..d4033df032e2 100644
--- a/nixos/modules/virtualisation/oci-containers.nix
+++ b/nixos/modules/virtualisation/oci-containers.nix
@@ -132,8 +132,8 @@ let
           default = [ ];
           description = "Environment files for this container.";
           example = [
-            /path/to/.env
-            /path/to/.env.secret
+            "/path/to/.env"
+            "/path/to/.env.secret"
           ];
         };
 
diff --git a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
index b2a096fc5c34..716c717ea6b4 100644
--- a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-code";
     publisher = "anthropic";
-    version = "2.1.118";
-    hash = "sha256-ic7GcsVcmy1pbiqn5mzdoak9sUqHTCotjOjw7NVfsjQ=";
+    version = "2.1.119";
+    hash = "sha256-/KqOJ8dvv6PhQJyfuOFEgKx6U8hH/WoUnocmWxsLLUk=";
   };
 
   postInstall = ''
diff --git a/pkgs/applications/emulators/libretro/cores/fceumm.nix b/pkgs/applications/emulators/libretro/cores/fceumm.nix
index 6fa3f34743a3..43600cf59fca 100644
--- a/pkgs/applications/emulators/libretro/cores/fceumm.nix
+++ b/pkgs/applications/emulators/libretro/cores/fceumm.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "fceumm";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-fceumm";
-    rev = "dbf1f2eb83ebde54a32fbe4f906b5ad89a863c0b";
-    hash = "sha256-UGssF6x/H5met7f2hC6str2urvCZRj/Oqp2R0rv2RUw=";
+    rev = "448a231618186b2af0bb9d6e37aeca05467e112f";
+    hash = "sha256-Kr3DEAk8dsFnUT73pOp5qwkCbcDItQwrRMI8hobrCuI=";
   };
 
   meta = {
diff --git a/pkgs/applications/emulators/libretro/cores/sameboy.nix b/pkgs/applications/emulators/libretro/cores/sameboy.nix
index 086e0c434fb1..a92d226dcede 100644
--- a/pkgs/applications/emulators/libretro/cores/sameboy.nix
+++ b/pkgs/applications/emulators/libretro/cores/sameboy.nix
@@ -7,13 +7,13 @@
 }:
 mkLibretroCore {
   core = "sameboy";
-  version = "0-unstable-2024-06-28";
+  version = "0-unstable-2026-04-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "sameboy";
-    rev = "51433012a871a44555492273fd22f29867d12655";
-    hash = "sha256-vPT2uRGbXmJ62yig/yk485/TxEEKHJeWdNrM2c0IjKw=";
+    rev = "06c184f0b186f161bcdfec50ebd604fe789ed04a";
+    hash = "sha256-sGEISpIGTHsUr4/DxMf5qxyTVdjmvWfqa2hUhj05jBA=";
   };
 
   extraNativeBuildInputs = [
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index ecd9ede45182..aecc44b24b0e 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -828,11 +828,11 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "147.0.7727.101",
+    "version": "147.0.7727.116",
     "deps": {
       "depot_tools": {
-        "rev": "442cbd6d584d2c992ca9bcc19ecbd2235bea772e",
-        "hash": "sha256-CgEu3y/MNRcCN2EmtcVgmGW/bEPKypeyLaANtiplDJU="
+        "rev": "3d94d7c3056847db821c6451be61054c36d7c6d5",
+        "hash": "sha256-hWfmidLPY0bXI58xAwkGnmb3GnSsKIUlDM91MYWfgpM="
       },
       "gn": {
         "version": "0-unstable-2026-03-05",
@@ -840,16 +840,16 @@
         "hash": "sha256-3AfExm7NL5GJXyC5JCPbGC70D59doRfIZIgpt6MLy9Y="
       },
       "ungoogled-patches": {
-        "rev": "147.0.7727.101-1",
-        "hash": "sha256-w/9bzbYHZM3Ot26ZcYWB51z7T+I4OBOxflo1dWxghyQ="
+        "rev": "147.0.7727.116-1",
+        "hash": "sha256-MmVLgbT+uzFzRt7faNvnWrlDwChDPth5eVqcGBXwUu4="
       },
       "npmHash": "sha256-ByB1Ea5tduIJZXyydeBWsoS8OPABOgwHe+dNXRssdvc="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "56536d2a8034c51b0e68e1a0483ab9f1a0165ae3",
-        "hash": "sha256-94TMvPkcWm+IEVYwTh+m1ys5du75bvJcc1RpkSKpAwc=",
+        "rev": "dbcf1b1bfb506cc580859bcb5ff9460a8443af90",
+        "hash": "sha256-pcrElIGFOcPQjJUF1ceHMRjS3YLjbTa9cM3Qg/G3u6I=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -919,8 +919,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "cbc4f074126e6f1acf72ad620a28cd4a8dd86f2a",
-        "hash": "sha256-MUgLUj2L0vmpAoxt/TJy1clsJfvYkQqe3Xm2+e4Y6tw="
+        "rev": "82ab43bfda5a3f59e1876fd3c828f047c689bc12",
+        "hash": "sha256-6WjecQRoyCLUoSbqDMpmsJ5tZazPF171KWnjxxK8hd4="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -959,8 +959,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "2c681aed02b0add6bcf6724175660c4b35ece843",
-        "hash": "sha256-io3X9zu6tHgqJGXjygUXMa98rXELRNl6Y330U2nRc/M="
+        "rev": "ff7b4f6c5d964879b5f4356ef6e732adeed2f627",
+        "hash": "sha256-pURclm6gi0am32tohZTB4iT2BWa55uRBJNRVW0gjDcY="
       },
       "src/third_party/dawn/third_party/glfw": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1089,8 +1089,8 @@
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "82a48c1595e5aefc899ed4528dbd7da0ac9e40e2",
-        "hash": "sha256-nlpFDS04LenRcQqnCkSdX/cUoC/gJcHaGUq+zrrkLSY="
+        "rev": "854a02be78c7ffea104cb523636efa991bef5c5b",
+        "hash": "sha256-CzzUueh2QXX+ExGqh5+JpnDoWF8DiFDff7fWmC01xfg="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -1619,8 +1619,8 @@
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "9179833d210d105aede5d4ec516734a6bd1ef2e8",
-        "hash": "sha256-DuHZimj7Zbx0QGH2ZrdGiSJg2PTwZUipyY06ZWr2fxg="
+        "rev": "997079137283f693a0fac6a5350ae7f6f2cf3b59",
+        "hash": "sha256-SOV9YS8Dk1HFCo00Qe6zttJOP0PEBS4B6Ah79OXmTew="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -1649,8 +1649,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "c207e34c08865143dc6774c1c624f3cea07f7420",
-        "hash": "sha256-5rc28tPK9mOJDO3HA3F1ZgsRQmWXhoLZGeKTzxWSISw="
+        "rev": "9b21082faf16a5f029a4316272c9a627d8b33eb4",
+        "hash": "sha256-dT1f9Df1K1ZLp346Tpqn6Lkq2HDYWWQIAuhqXMIIydk="
       }
     }
   }
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index f176c25ec75d..c11d7d7a9a78 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -679,13 +679,13 @@
     "vendorHash": "sha256-OvotUEh+P2b3ngaD/8lVbemnM3lrtwqduPXPjF/bqVA="
   },
   "hashicorp_vault": {
-    "hash": "sha256-e0BcPLQFUjdZPlKAnuxBB3se+MjDSj78KJy5zNlsHKA=",
+    "hash": "sha256-k/S1ez6q70vvnHMfU2aweTFzRnLlYbxUEh4xZumT1mo=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/vault",
     "owner": "hashicorp",
     "repo": "terraform-provider-vault",
-    "rev": "v5.8.0",
+    "rev": "v5.9.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-XBXkDvblC/u3lYq/dfjm38Hw8uGwumz4ZAiG+kJkNUQ="
+    "vendorHash": "sha256-0TJbC7gG5yduWrzp7MN5WWDjsdyL6RqXmOlIDs3OtaU="
   },
   "hashicorp_vsphere": {
     "hash": "sha256-vRO6vxzi4d0hNc0MmQLhN7roONnsjxPBtFt0fyvxWd8=",
@@ -833,13 +833,13 @@
     "vendorHash": "sha256-SJUlHerlt7Z3g1UJ7QKoCwEYolKL7SZp2O537poje3I="
   },
   "launchdarkly_launchdarkly": {
-    "hash": "sha256-lcemT7kpBlZX35Sb+ujHzSdakBQkUSmYAxTVsJkRW6A=",
+    "hash": "sha256-sFCms2grd7R52ILnRhVubLSEBTaeryS5WBL6+rcTZ/k=",
     "homepage": "https://registry.terraform.io/providers/launchdarkly/launchdarkly",
     "owner": "launchdarkly",
     "repo": "terraform-provider-launchdarkly",
-    "rev": "v2.27.0",
+    "rev": "v2.28.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-BxMhu2gcRuOlYWgx5ZOUBGdfB28+87SG1T/KAPDyei8="
+    "vendorHash": "sha256-OgKOjLwDQxJiv+VWdOzjMcUDPu9LOuhyTRyLyM39vLM="
   },
   "linode_linode": {
     "hash": "sha256-nrNyOcaC5wKJijfubBBuEBKA6dT6Ajo33MR4P80j29k=",
diff --git a/pkgs/by-name/ar/arnis/package.nix b/pkgs/by-name/ar/arnis/package.nix
index 2ad0ce398089..7641b3342691 100644
--- a/pkgs/by-name/ar/arnis/package.nix
+++ b/pkgs/by-name/ar/arnis/package.nix
@@ -12,16 +12,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "arnis";
-  version = "2.6.0";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "louis-e";
     repo = "arnis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FO/8cQkw6CZWMjWgjx0/2KbfnYgIbHHWdgc4c5t4AEk=";
+    hash = "sha256-7Fh/jhKVNeAlJn2PATEMkPROhsyUYTtUp+Dv0FXoIfs=";
   };
 
-  cargoHash = "sha256-R7dW2/7UInK3yLz5YHb6UYhLukPrv8NZ8lRYhQwsiMw=";
+  cargoHash = "sha256-ZKr+BBcn6vKq3JuLkHqaVHM6Ug7BfUUTEmnePs7RKyc=";
 
   nativeBuildInputs = [
     cargo-tauri.hook
diff --git a/pkgs/by-name/br/bruno/package.nix b/pkgs/by-name/br/bruno/package.nix
index 570c8693a478..89d0a6eb48cf 100644
--- a/pkgs/by-name/br/bruno/package.nix
+++ b/pkgs/by-name/br/bruno/package.nix
@@ -21,13 +21,13 @@
 
 buildNpmPackage rec {
   pname = "bruno";
-  version = "3.2.0";
+  version = "3.3.0";
 
   src = fetchFromGitHub {
     owner = "usebruno";
     repo = "bruno";
     tag = "v${version}";
-    hash = "sha256-lDsgAOCUrxhmlmYgObDwUR6gbms/q/rNIkTEwJckMyA=";
+    hash = "sha256-YVZPXrYfOFd9lUdZ0rwWnbSDO91Bn1vZyO3AwnE2pZE=";
 
     postFetch = ''
       ${lib.getExe npm-lockfile-fix} $out/package-lock.json
@@ -36,7 +36,7 @@ buildNpmPackage rec {
 
   nodejs = nodejs_22;
 
-  npmDepsHash = "sha256-vz2I+0+eQk6A4SsiACipTGrYF8LtvWfGhgxqu7mChLE=";
+  npmDepsHash = "sha256-IH2AVyHwMZuyZOUsAP7qoxm5Em32hk90Tp7uvSE9bIE=";
   npmFlags = [ "--legacy-peer-deps" ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cl/claude-code/manifest.json b/pkgs/by-name/cl/claude-code/manifest.json
index a24f8d502f63..774b34827eca 100644
--- a/pkgs/by-name/cl/claude-code/manifest.json
+++ b/pkgs/by-name/cl/claude-code/manifest.json
@@ -1,47 +1,47 @@
 {
-  "version": "2.1.118",
-  "commit": "ef88b5f0a79aac989f53fd18178939a54a48624a",
-  "buildDate": "2026-04-22T22:43:30Z",
+  "version": "2.1.119",
+  "commit": "6f68554839756189e277b8285a18fe47acd9a5a1",
+  "buildDate": "2026-04-23T20:45:14Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "54e5d3f65109b89c6046f47440944d52906c662d1e51748f620a430d26ad3665",
-      "size": 207690848
+      "checksum": "31db3444309d5d0f8b85e8782e2dcd86f31f7e48c1a1e83d69b09268c7b4f9a2",
+      "size": 213404000
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "2cd554070f0588de05e9efd88c1f073770cb620ed3e5f45ba7df833fc3414c1b",
-      "size": 209238608
+      "checksum": "52b3b75cfe80c626982b2ffb3a6ce1c797824f257dc275cf0a3c32c202b6a3df",
+      "size": 214951760
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "b77b22fe93c15409f3c64be67950fe11e5fc17d1cd327891596cb87dd9be0492",
-      "size": 239798848
+      "checksum": "382aa73ea4b07fd8d698e3159b5ef9e1b8739fae7505ba8ddd28b8a6a62819ce",
+      "size": 245500480
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "ba363b2410a47120d2d4b8ece2e11fe0bbc5d59adb1329e8fb87ea0f370f4e46",
-      "size": 239573632
+      "checksum": "cca43053f062949495596b11b6fd1b59cf79102adb13bacbe66997e6fae41e4a",
+      "size": 245230208
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "dcb27938ed10b7da586b6f7ba0dde768980b5e3d38b258c1f4e9a94e7b3dd6d2",
-      "size": 232524224
+      "checksum": "e09bfaedd8bfdeaebe5f1cf9bb81ebeb718312c68fffce379fb51786263143d0",
+      "size": 238225856
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "bd05142de3e3ead48313d4215577c9a9c89f05ca286d771cdff025544c52ae29",
-      "size": 233839040
+      "checksum": "ef41a11653b39c14db2d343f1f5e2a3af7eb9871c63e64deb6e65919670a4e0b",
+      "size": 239495616
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "5a05b03b880de26bb78fb9824bacf08e99dcf05c02e3c66546cccaf2f2930b2e",
-      "size": 249035936
+      "checksum": "e18c7dcfad4a3f5d33d202ec2dde630b648cf5b41622154d6210e793c7cceadc",
+      "size": 254478496
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "b3d8942b49f672ef2e1394e004f0f53e197caefe30890620b6974a3e8dba63ec",
-      "size": 245760672
+      "checksum": "9e0deb10c45108612484ce558fad378206d5ac23feb203067450e6c38d001241",
+      "size": 251203232
     }
   }
 }
diff --git a/pkgs/by-name/de/defuddle-cli/package.nix b/pkgs/by-name/de/defuddle-cli/package.nix
deleted file mode 100644
index 85bbbb4b2c24..000000000000
--- a/pkgs/by-name/de/defuddle-cli/package.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{
-  buildNpmPackage,
-  fetchFromGitHub,
-  gitUpdater,
-  lib,
-}:
-
-buildNpmPackage rec {
-  pname = "defuddle-cli";
-  version = "0.6.4";
-
-  src = fetchFromGitHub {
-    owner = "kepano";
-    repo = "defuddle-cli";
-    tag = version;
-    hash = "sha256-28XmpFKzBKNhRkPOGaacJVw8hjQUZq2nwuR0vNo8aW0=";
-  };
-
-  npmDepsHash = "sha256-rRo+ty/E09OS+cWDnKQkROEdDc0hiB5g1h/+NbJe+/M=";
-
-  passthru.updateScript = gitUpdater { };
-
-  meta = {
-    description = "Command line utility to extract clean html, markdown and metadata from web pages";
-    homepage = "https://github.com/kepano/defuddle-cli";
-    license = lib.licenses.mit;
-    mainProgram = "defuddle";
-    maintainers = with lib.maintainers; [ surfaceflinger ];
-  };
-}
diff --git a/pkgs/by-name/de/defuddle/package.nix b/pkgs/by-name/de/defuddle/package.nix
new file mode 100644
index 000000000000..ef1ca4f9e8f1
--- /dev/null
+++ b/pkgs/by-name/de/defuddle/package.nix
@@ -0,0 +1,36 @@
+{
+  buildNpmPackage,
+  fetchFromGitHub,
+  lib,
+  nix-update-script,
+}:
+
+buildNpmPackage rec {
+  pname = "defuddle";
+  version = "0.17.0";
+
+  src = fetchFromGitHub {
+    owner = "kepano";
+    repo = "defuddle";
+    tag = version;
+    hash = "sha256-w1V2xdaE8Htl6NeDyfKLFHOt3UEUuI4eBPW433qD1WI=";
+  };
+
+  npmDepsHash = "sha256-D+Gn9Dcc+YNeRonnKjEcp3BzpxIdwy7J4lJvxefJSvs=";
+
+  # jsdom is both a peerDependency and devDependency; pruning
+  # devDependencies removes it, but the CLI needs it at runtime.
+  dontNpmPrune = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "Command line utility to extract clean html, markdown and metadata from web pages";
+    homepage = "https://github.com/kepano/defuddle";
+    license = lib.licenses.mit;
+    mainProgram = "defuddle";
+    maintainers = with lib.maintainers; [ surfaceflinger ];
+  };
+}
diff --git a/pkgs/by-name/em/emhash/package.nix b/pkgs/by-name/em/emhash/package.nix
index 4d5e93928276..91fe3bc95c49 100644
--- a/pkgs/by-name/em/emhash/package.nix
+++ b/pkgs/by-name/em/emhash/package.nix
@@ -16,6 +16,9 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-dFj/QaGdTJYdcxKlS9tES6OHae8xPMnrG9ccRNM/hi8=";
   };
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   nativeBuildInputs = [
     cmake
   ];
diff --git a/pkgs/by-name/ex/exo/package.nix b/pkgs/by-name/ex/exo/package.nix
index 81c826cb4ac9..d8acacd3973a 100644
--- a/pkgs/by-name/ex/exo/package.nix
+++ b/pkgs/by-name/ex/exo/package.nix
@@ -18,13 +18,13 @@
   nix-update-script,
 }:
 let
-  version = "1.0.70";
+  version = "1.0.71";
   src = fetchFromGitHub {
     name = "exo";
     owner = "exo-explore";
     repo = "exo";
     tag = "v${version}";
-    hash = "sha256-ytxP5x8PyAPVne2c6OIvhdCuF68zffxypXSTlDAFnro=";
+    hash = "sha256-k3jtrJCxLx8nq1R70CtZWFyNVXEa5Ltw0MgdA0qFVXA=";
   };
 
   pyo3-bindings = python3Packages.buildPythonPackage (finalAttrs: {
diff --git a/pkgs/by-name/fl/flare-signal/package.nix b/pkgs/by-name/fl/flare-signal/package.nix
index ff74d7c87bc1..bbe9e8b108b6 100644
--- a/pkgs/by-name/fl/flare-signal/package.nix
+++ b/pkgs/by-name/fl/flare-signal/package.nix
@@ -24,18 +24,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "flare";
-  version = "0.20.2";
+  version = "0.20.4";
 
   src = fetchFromGitLab {
     owner = "schmiddi-on-mobile";
     repo = "flare";
     tag = finalAttrs.version;
-    hash = "sha256-LjUd+tq4nBJtBXeOH1SyjKS37R8f5rVvDk+jTR/Mdvs=";
+    hash = "sha256-Py5NKH8kBIBMfq3tz59fz5MZdPE6DC6NS2m5HlhSf5M=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-dXPCyHc6+iS4YMIVy0vOkPG57GEW1ce5sSgyw6k0M3U=";
+    hash = "sha256-DD6bqw0RUClkjClS2QjYOt3PMKy3d9uRZVBf7bVR4hg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fo/fosrl-newt/package.nix b/pkgs/by-name/fo/fosrl-newt/package.nix
index 61c667b1a7f2..cd02adca68f6 100644
--- a/pkgs/by-name/fo/fosrl-newt/package.nix
+++ b/pkgs/by-name/fo/fosrl-newt/package.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   versionCheckHook,
   nix-update-script,
+  stdenv,
 }:
 
 buildGoModule (finalAttrs: {
@@ -33,7 +34,13 @@ buildGoModule (finalAttrs: {
 
   passthru.updateScript = nix-update-script { };
 
+  __structuredAttrs = true;
+
   meta = {
+    # Networking failures in tests, even with __darwinAllowLocalNetworking on
+    # and sandbox disabled.
+    # Unclear as of 2026-04-24 whether the program works if tests are disabled.
+    broken = stdenv.hostPlatform.isDarwin;
     description = "Tunneling client for Pangolin";
     homepage = "https://github.com/fosrl/newt";
     changelog = "https://github.com/fosrl/newt/releases/tag/${finalAttrs.src.tag}";
diff --git a/pkgs/by-name/fo/fosrl-olm/package.nix b/pkgs/by-name/fo/fosrl-olm/package.nix
index b3373d8a6f59..ea332c138ace 100644
--- a/pkgs/by-name/fo/fosrl-olm/package.nix
+++ b/pkgs/by-name/fo/fosrl-olm/package.nix
@@ -24,6 +24,8 @@ buildGoModule (finalAttrs: {
 
   doInstallCheck = true;
 
+  __structuredAttrs = true;
+
   meta = {
     description = "Tunneling client for Pangolin";
     homepage = "https://github.com/fosrl/olm";
diff --git a/pkgs/by-name/hy/hydrus/package.nix b/pkgs/by-name/hy/hydrus/package.nix
index aece2ac3c718..743bd933fd4d 100644
--- a/pkgs/by-name/hy/hydrus/package.nix
+++ b/pkgs/by-name/hy/hydrus/package.nix
@@ -16,14 +16,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "hydrus";
-  version = "666";
+  version = "668";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "hydrusnetwork";
     repo = "hydrus";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ikj1COV9eIp6UBk5zmxF1hwTY12K7Ut8hLM2Nvw7jis=";
+    hash = "sha256-F6sQ2AyAIE7z7GH942sgzVbufA5GHEazoG+4YN8cFxQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ia/iaito/package.nix b/pkgs/by-name/ia/iaito/package.nix
index f576375c73d6..38cd87da1013 100644
--- a/pkgs/by-name/ia/iaito/package.nix
+++ b/pkgs/by-name/ia/iaito/package.nix
@@ -7,18 +7,21 @@
   python3,
   qt6Packages,
   radare2,
+  xvfb-run,
+  breakpointHook,
+  writableTmpDirAsHomeHook,
   stdenv,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "iaito";
-  version = "6.1.0";
+  version = "6.1.4";
 
   srcs = [
     (fetchFromGitHub {
       owner = "radareorg";
       repo = "iaito";
       tag = finalAttrs.version;
-      hash = "sha256-nvMx0zbfsphfBgxdQnk+EhRpQnJ2Qv05rF7w+zQUUQg=";
+      hash = "sha256-HKh5D96Dwo6YttWcOMlFy4H9OS3FbQvQ5RK+aOY4V5s=";
       name = "main";
     })
     (fetchFromGitHub {
@@ -47,6 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
     python3
     qt6Packages.qttools
     qt6Packages.wrapQtAppsHook
+    breakpointHook
   ];
 
   buildInputs = [
@@ -79,6 +83,22 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  nativeInstallCheckInputs = [
+    xvfb-run
+    writableTmpDirAsHomeHook
+  ];
+
+  # `iaito -v` does only work with GUI access
+  installCheckPhase = ''
+    runHook preCheck
+    xvfb-run -a ${placeholder "out"}/bin/iaito -v | grep "${finalAttrs.version}"
+    runHook postCheck
+  '';
+
+  doInstallCheck = true;
+
+  passthru.updateScript = ./update.sh;
+
   meta = {
     description = "Official radare2 GUI";
     longDescription = ''
diff --git a/pkgs/by-name/ia/iaito/update.sh b/pkgs/by-name/ia/iaito/update.sh
new file mode 100755
index 000000000000..96dfb64c0a32
--- /dev/null
+++ b/pkgs/by-name/ia/iaito/update.sh
@@ -0,0 +1,54 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i sh -p curl jq nix-prefetch-github coreutils gnused gnugrep
+# shellcheck shell=sh
+set -eu
+
+# Directory of this script / the iaito package
+SCRIPT_DIR="$(readlink -f "$(dirname "$0")")"
+NIXFILE="$SCRIPT_DIR/package.nix"
+
+# Determine latest release version: use $1 if provided, otherwise auto-detect
+if [ -n "${1:-}" ]; then
+    LATEST_VERSION="$1"
+    echo "Using provided iaito version: $LATEST_VERSION"
+else
+    LATEST_VERSION=$(curl -s https://api.github.com/repos/radareorg/iaito/releases/latest | jq -r '.tag_name')
+    echo "Latest iaito version: $LATEST_VERSION"
+fi
+
+CURRENT_VERSION=$(grep 'version = ' "$NIXFILE" | head -1 | sed 's/.*"\(.*\)".*/\1/')
+echo "Current iaito version: $CURRENT_VERSION"
+
+if [ "$LATEST_VERSION" = "$CURRENT_VERSION" ]; then
+    echo "iaito is already up to date"
+    exit 0
+fi
+
+# Update main source version and hash
+echo "Updating main source to $LATEST_VERSION..."
+MAIN_HASH=$(nix-prefetch-github radareorg iaito --rev "$LATEST_VERSION" --json | jq -r '.hash')
+echo "  New main hash: $MAIN_HASH"
+
+sed -i "s|version = \"$CURRENT_VERSION\"|version = \"$LATEST_VERSION\"|" "$NIXFILE"
+sed -i "/repo = \"iaito\";$/,/})/{s|hash = \".*\"|hash = \"$MAIN_HASH\"|}" "$NIXFILE"
+
+# Update translations to latest master revision
+echo "Updating iaito-translations to latest master..."
+LATEST_TRANS_REV=$(curl -s https://api.github.com/repos/radareorg/iaito-translations/commits/master | jq -r '.sha')
+echo "  Latest translations rev: $LATEST_TRANS_REV"
+
+CURRENT_TRANS_REV=$(grep -A3 'repo = "iaito-translations"' "$NIXFILE" | grep 'rev = ' | sed 's/.*"\(.*\)".*/\1/')
+echo "  Current translations rev: $CURRENT_TRANS_REV"
+
+if [ "$LATEST_TRANS_REV" = "$CURRENT_TRANS_REV" ]; then
+    echo "  Translations unchanged"
+else
+    echo "  Updating translations: $CURRENT_TRANS_REV -> $LATEST_TRANS_REV"
+    TRANS_HASH=$(nix-prefetch-github radareorg iaito-translations --rev "$LATEST_TRANS_REV" --json | jq -r '.hash')
+    echo "  New translations hash: $TRANS_HASH"
+
+    sed -i "/repo = \"iaito-translations\"/,/})/{s|rev = \"$CURRENT_TRANS_REV\"|rev = \"$LATEST_TRANS_REV\"|}" "$NIXFILE"
+    sed -i "/repo = \"iaito-translations\"/,/})/{s|hash = \".*\"|hash = \"$TRANS_HASH\"|}" "$NIXFILE"
+fi
+
+echo "Update complete. Please verify with: nix build .#iaito"
diff --git a/pkgs/by-name/ki/kimai/package.nix b/pkgs/by-name/ki/kimai/package.nix
index 3a9ccb269773..1e4e75ed0014 100644
--- a/pkgs/by-name/ki/kimai/package.nix
+++ b/pkgs/by-name/ki/kimai/package.nix
@@ -7,13 +7,13 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "kimai";
-  version = "2.52.0";
+  version = "2.55.0";
 
   src = fetchFromGitHub {
     owner = "kimai";
     repo = "kimai";
     tag = finalAttrs.version;
-    hash = "sha256-lh+12X85MM3Efp2DUQ22itXnqnNzPzxqxQ1GNbDaaPQ=";
+    hash = "sha256-p4Y5hCWr5BVOGYUJtFJhhDftm+A/CWxbdBhPgOR1TcY=";
   };
 
   php = php.buildEnv {
@@ -38,7 +38,7 @@ php.buildComposerProject2 (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-P+YCKz6j30Xtt0BAViUCHoU6xdrzFQFHqK1PTEp4vQg=";
+  vendorHash = "sha256-Vlaqe3FTItRZDiYWzOVDL+q7HZ8TgpiLPFTDzUyL4LY=";
 
   composerNoPlugins = false;
   postInstall = ''
diff --git a/pkgs/by-name/kr/krbjack/package.nix b/pkgs/by-name/kr/krbjack/package.nix
index 8104b8f4502a..8dfeef3dc600 100644
--- a/pkgs/by-name/kr/krbjack/package.nix
+++ b/pkgs/by-name/kr/krbjack/package.nix
@@ -41,7 +41,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   meta = {
     description = "Kerberos AP-REQ hijacking tool with DNS unsecure updates abuse";
     homepage = "https://github.com/almandin/krbjack";
-    changelog = "https://github.com/almandin/krbjack/releases/tag/${finalAttrs.version}}";
+    changelog = "https://github.com/almandin/krbjack/releases/tag/${finalAttrs.version}";
     license = lib.licenses.beerware;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "krbjack";
diff --git a/pkgs/by-name/lr/lrcget/fix-tauri-version-mismatch.patch b/pkgs/by-name/lr/lrcget/fix-tauri-version-mismatch.patch
deleted file mode 100644
index 875eea6a0854..000000000000
--- a/pkgs/by-name/lr/lrcget/fix-tauri-version-mismatch.patch
+++ /dev/null
@@ -1,254 +0,0 @@
-diff --git a/package-lock.json b/package-lock.json
-index 5ddd914..8d4a12a 100644
---- a/package-lock.json
-+++ b/package-lock.json
-@@ -9,11 +9,11 @@
-       "version": "0.0.0",
-       "dependencies": {
-         "@tanstack/vue-virtual": "^3.1.2",
--        "@tauri-apps/api": "^2.1.1",
--        "@tauri-apps/plugin-dialog": "^2.2.0",
--        "@tauri-apps/plugin-global-shortcut": "^2.2.0",
--        "@tauri-apps/plugin-os": "^2.2.0",
--        "@tauri-apps/plugin-shell": "^2.2.0",
-+        "@tauri-apps/api": "2.8.0",
-+        "@tauri-apps/plugin-dialog": "2.4.0",
-+        "@tauri-apps/plugin-global-shortcut": "^2.3.0",
-+        "@tauri-apps/plugin-os": "^2.3.0",
-+        "@tauri-apps/plugin-shell": "^2.3.0",
-         "codemirror": "^6.0.1",
-         "floating-vue": "^5.2.2",
-         "lodash": "^4.17.21",
-@@ -381,9 +381,9 @@
-       }
-     },
-     "node_modules/@tauri-apps/api": {
--      "version": "2.1.1",
--      "resolved": "https://registry.npmjs.org/@tauri-apps/api/-/api-2.1.1.tgz",
--      "integrity": "sha512-fzUfFFKo4lknXGJq8qrCidkUcKcH2UHhfaaCNt4GzgzGaW2iS26uFOg4tS3H4P8D6ZEeUxtiD5z0nwFF0UN30A==",
-+      "version": "2.8.0",
-+      "resolved": "https://registry.npmjs.org/@tauri-apps/api/-/api-2.8.0.tgz",
-+      "integrity": "sha512-ga7zdhbS2GXOMTIZRT0mYjKJtR9fivsXzsyq5U3vjDL0s6DTMwYRm0UHNjzTY5dh4+LSC68Sm/7WEiimbQNYlw==",
-       "license": "Apache-2.0 OR MIT",
-       "funding": {
-         "type": "opencollective",
-@@ -590,39 +590,39 @@
-       }
-     },
-     "node_modules/@tauri-apps/plugin-dialog": {
--      "version": "2.2.0",
--      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-dialog/-/plugin-dialog-2.2.0.tgz",
--      "integrity": "sha512-6bLkYK68zyK31418AK5fNccCdVuRnNpbxquCl8IqgFByOgWFivbiIlvb79wpSXi0O+8k8RCSsIpOquebusRVSg==",
-+      "version": "2.4.0",
-+      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-dialog/-/plugin-dialog-2.4.0.tgz",
-+      "integrity": "sha512-OvXkrEBfWwtd8tzVCEXIvRfNEX87qs2jv6SqmVPiHcJjBhSF/GUvjqUNIDmKByb5N8nvDqVUM7+g1sXwdC/S9w==",
-       "license": "MIT OR Apache-2.0",
-       "dependencies": {
--        "@tauri-apps/api": "^2.0.0"
-+        "@tauri-apps/api": "^2.8.0"
-       }
-     },
-     "node_modules/@tauri-apps/plugin-global-shortcut": {
--      "version": "2.2.0",
--      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-global-shortcut/-/plugin-global-shortcut-2.2.0.tgz",
--      "integrity": "sha512-clI9Bg/BcxWXNDK+ij601o1qC2WxMEy8ovhGgEW5Ai17oPy0KK8uwzmc59KiVnOYKpBWHCUPqBxG+KBNUFXgzw==",
-+      "version": "2.3.1",
-+      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-global-shortcut/-/plugin-global-shortcut-2.3.1.tgz",
-+      "integrity": "sha512-vr40W2N6G63dmBPaha1TsBQLLURXG538RQbH5vAm0G/ovVZyXJrmZR1HF1W+WneNloQvwn4dm8xzwpEXRW560g==",
-       "license": "MIT OR Apache-2.0",
-       "dependencies": {
--        "@tauri-apps/api": "^2.0.0"
-+        "@tauri-apps/api": "^2.8.0"
-       }
-     },
-     "node_modules/@tauri-apps/plugin-os": {
--      "version": "2.2.0",
--      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-os/-/plugin-os-2.2.0.tgz",
--      "integrity": "sha512-HszbCdbisMlu5QhCNAN8YIWyz2v33abAWha6+uvV2CKX8P5VSct/y+kEe22JeyqrxCnWlQ3DRx7s49Byg7/0EA==",
-+      "version": "2.3.2",
-+      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-os/-/plugin-os-2.3.2.tgz",
-+      "integrity": "sha512-n+nXWeuSeF9wcEsSPmRnBEGrRgOy6jjkSU+UVCOV8YUGKb2erhDOxis7IqRXiRVHhY8XMKks00BJ0OAdkpf6+A==",
-       "license": "MIT OR Apache-2.0",
-       "dependencies": {
--        "@tauri-apps/api": "^2.0.0"
-+        "@tauri-apps/api": "^2.8.0"
-       }
-     },
-     "node_modules/@tauri-apps/plugin-shell": {
--      "version": "2.2.0",
--      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-shell/-/plugin-shell-2.2.0.tgz",
--      "integrity": "sha512-iC3Ic1hLmasoboG7BO+7p+AriSoqAwKrIk+Hpk+S/bjTQdXqbl2GbdclghI4gM32X0bls7xHzIFqhRdrlvJeaA==",
-+      "version": "2.3.4",
-+      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-shell/-/plugin-shell-2.3.4.tgz",
-+      "integrity": "sha512-ktsRWf8wHLD17aZEyqE8c5x98eNAuTizR1FSX475zQ4TxaiJnhwksLygQz+AGwckJL5bfEP13nWrlTNQJUpKpA==",
-       "license": "MIT OR Apache-2.0",
-       "dependencies": {
--        "@tauri-apps/api": "^2.0.0"
-+        "@tauri-apps/api": "^2.8.0"
-       }
-     },
-     "node_modules/@types/web-bluetooth": {
-@@ -1043,6 +1043,7 @@
-           "url": "https://tidelift.com/funding/github/npm/browserslist"
-         }
-       ],
-+      "peer": true,
-       "dependencies": {
-         "caniuse-lite": "^1.0.30001400",
-         "electron-to-chromium": "^1.4.251",
-@@ -1124,6 +1125,7 @@
-       "version": "6.0.1",
-       "resolved": "https://registry.npmjs.org/codemirror/-/codemirror-6.0.1.tgz",
-       "integrity": "sha512-J8j+nZ+CdWmIeFIGXEFbFPtpiYacFMDR8GlHK3IyHQJMCaVRfGx9NT+Hxivv1ckLWPvNdZqndbr/7lVhrf/Svg==",
-+      "peer": true,
-       "dependencies": {
-         "@codemirror/autocomplete": "^6.0.0",
-         "@codemirror/commands": "^6.0.0",
-@@ -1681,6 +1683,7 @@
-       "version": "7.6.2",
-       "resolved": "https://registry.npmjs.org/focus-trap/-/focus-trap-7.6.2.tgz",
-       "integrity": "sha512-9FhUxK1hVju2+AiQIDJ5Dd//9R2n2RAfJ0qfhF4IHGHgcoEUTMpbTeG/zbEuwaiYXfuAH6XE0/aCyxDdRM+W5w==",
-+      "peer": true,
-       "dependencies": {
-         "tabbable": "^6.2.0"
-       }
-@@ -2147,6 +2150,7 @@
-           "url": "https://github.com/sponsors/ai"
-         }
-       ],
-+      "peer": true,
-       "dependencies": {
-         "nanoid": "^3.3.7",
-         "picocolors": "^1.1.0",
-@@ -2721,6 +2725,7 @@
-       "resolved": "https://registry.npmjs.org/vite/-/vite-3.1.8.tgz",
-       "integrity": "sha512-m7jJe3nufUbuOfotkntGFupinL/fmuTNuQmiVE7cH2IZMuf4UbfbGYMUT3jVWgGYuRVLY9j8NnrRqgw5rr5QTg==",
-       "dev": true,
-+      "peer": true,
-       "dependencies": {
-         "esbuild": "^0.15.9",
-         "postcss": "^8.4.16",
-@@ -2761,6 +2766,7 @@
-       "version": "3.5.10",
-       "resolved": "https://registry.npmjs.org/vue/-/vue-3.5.10.tgz",
-       "integrity": "sha512-Vy2kmJwHPlouC/tSnIgXVg03SG+9wSqT1xu1Vehc+ChsXsRd7jLkKgMltVEFOzUdBr3uFwBCG+41LJtfAcBRng==",
-+      "peer": true,
-       "dependencies": {
-         "@vue/compiler-dom": "3.5.10",
-         "@vue/compiler-sfc": "3.5.10",
-@@ -3221,9 +3227,9 @@
-       }
-     },
-     "@tauri-apps/api": {
--      "version": "2.1.1",
--      "resolved": "https://registry.npmjs.org/@tauri-apps/api/-/api-2.1.1.tgz",
--      "integrity": "sha512-fzUfFFKo4lknXGJq8qrCidkUcKcH2UHhfaaCNt4GzgzGaW2iS26uFOg4tS3H4P8D6ZEeUxtiD5z0nwFF0UN30A=="
-+      "version": "2.8.0",
-+      "resolved": "https://registry.npmjs.org/@tauri-apps/api/-/api-2.8.0.tgz",
-+      "integrity": "sha512-ga7zdhbS2GXOMTIZRT0mYjKJtR9fivsXzsyq5U3vjDL0s6DTMwYRm0UHNjzTY5dh4+LSC68Sm/7WEiimbQNYlw=="
-     },
-     "@tauri-apps/cli": {
-       "version": "2.1.0",
-@@ -3314,35 +3320,35 @@
-       "optional": true
-     },
-     "@tauri-apps/plugin-dialog": {
--      "version": "2.2.0",
--      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-dialog/-/plugin-dialog-2.2.0.tgz",
--      "integrity": "sha512-6bLkYK68zyK31418AK5fNccCdVuRnNpbxquCl8IqgFByOgWFivbiIlvb79wpSXi0O+8k8RCSsIpOquebusRVSg==",
-+      "version": "2.4.0",
-+      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-dialog/-/plugin-dialog-2.4.0.tgz",
-+      "integrity": "sha512-OvXkrEBfWwtd8tzVCEXIvRfNEX87qs2jv6SqmVPiHcJjBhSF/GUvjqUNIDmKByb5N8nvDqVUM7+g1sXwdC/S9w==",
-       "requires": {
--        "@tauri-apps/api": "^2.0.0"
-+        "@tauri-apps/api": "^2.8.0"
-       }
-     },
-     "@tauri-apps/plugin-global-shortcut": {
--      "version": "2.2.0",
--      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-global-shortcut/-/plugin-global-shortcut-2.2.0.tgz",
--      "integrity": "sha512-clI9Bg/BcxWXNDK+ij601o1qC2WxMEy8ovhGgEW5Ai17oPy0KK8uwzmc59KiVnOYKpBWHCUPqBxG+KBNUFXgzw==",
-+      "version": "2.3.1",
-+      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-global-shortcut/-/plugin-global-shortcut-2.3.1.tgz",
-+      "integrity": "sha512-vr40W2N6G63dmBPaha1TsBQLLURXG538RQbH5vAm0G/ovVZyXJrmZR1HF1W+WneNloQvwn4dm8xzwpEXRW560g==",
-       "requires": {
--        "@tauri-apps/api": "^2.0.0"
-+        "@tauri-apps/api": "^2.8.0"
-       }
-     },
-     "@tauri-apps/plugin-os": {
--      "version": "2.2.0",
--      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-os/-/plugin-os-2.2.0.tgz",
--      "integrity": "sha512-HszbCdbisMlu5QhCNAN8YIWyz2v33abAWha6+uvV2CKX8P5VSct/y+kEe22JeyqrxCnWlQ3DRx7s49Byg7/0EA==",
-+      "version": "2.3.2",
-+      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-os/-/plugin-os-2.3.2.tgz",
-+      "integrity": "sha512-n+nXWeuSeF9wcEsSPmRnBEGrRgOy6jjkSU+UVCOV8YUGKb2erhDOxis7IqRXiRVHhY8XMKks00BJ0OAdkpf6+A==",
-       "requires": {
--        "@tauri-apps/api": "^2.0.0"
-+        "@tauri-apps/api": "^2.8.0"
-       }
-     },
-     "@tauri-apps/plugin-shell": {
--      "version": "2.2.0",
--      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-shell/-/plugin-shell-2.2.0.tgz",
--      "integrity": "sha512-iC3Ic1hLmasoboG7BO+7p+AriSoqAwKrIk+Hpk+S/bjTQdXqbl2GbdclghI4gM32X0bls7xHzIFqhRdrlvJeaA==",
-+      "version": "2.3.4",
-+      "resolved": "https://registry.npmjs.org/@tauri-apps/plugin-shell/-/plugin-shell-2.3.4.tgz",
-+      "integrity": "sha512-ktsRWf8wHLD17aZEyqE8c5x98eNAuTizR1FSX475zQ4TxaiJnhwksLygQz+AGwckJL5bfEP13nWrlTNQJUpKpA==",
-       "requires": {
--        "@tauri-apps/api": "^2.0.0"
-+        "@tauri-apps/api": "^2.8.0"
-       }
-     },
-     "@types/web-bluetooth": {
-@@ -3586,6 +3592,7 @@
-       "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.21.4.tgz",
-       "integrity": "sha512-CBHJJdDmgjl3daYjN5Cp5kbTf1mUhZoS+beLklHIvkOWscs83YAhLlF3Wsh/lciQYAcbBJgTOD44VtG31ZM4Hw==",
-       "dev": true,
-+      "peer": true,
-       "requires": {
-         "caniuse-lite": "^1.0.30001400",
-         "electron-to-chromium": "^1.4.251",
-@@ -3636,6 +3643,7 @@
-       "version": "6.0.1",
-       "resolved": "https://registry.npmjs.org/codemirror/-/codemirror-6.0.1.tgz",
-       "integrity": "sha512-J8j+nZ+CdWmIeFIGXEFbFPtpiYacFMDR8GlHK3IyHQJMCaVRfGx9NT+Hxivv1ckLWPvNdZqndbr/7lVhrf/Svg==",
-+      "peer": true,
-       "requires": {
-         "@codemirror/autocomplete": "^6.0.0",
-         "@codemirror/commands": "^6.0.0",
-@@ -3965,6 +3973,7 @@
-       "version": "7.6.2",
-       "resolved": "https://registry.npmjs.org/focus-trap/-/focus-trap-7.6.2.tgz",
-       "integrity": "sha512-9FhUxK1hVju2+AiQIDJ5Dd//9R2n2RAfJ0qfhF4IHGHgcoEUTMpbTeG/zbEuwaiYXfuAH6XE0/aCyxDdRM+W5w==",
-+      "peer": true,
-       "requires": {
-         "tabbable": "^6.2.0"
-       }
-@@ -4285,6 +4294,7 @@
-       "version": "8.4.47",
-       "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.47.tgz",
-       "integrity": "sha512-56rxCq7G/XfB4EkXq9Egn5GCqugWvDFjafDOThIdMBsI15iqPqR5r15TfSr1YPYeEI19YeaXMCbY6u88Y76GLQ==",
-+      "peer": true,
-       "requires": {
-         "nanoid": "^3.3.7",
-         "picocolors": "^1.1.0",
-@@ -4638,6 +4648,7 @@
-       "resolved": "https://registry.npmjs.org/vite/-/vite-3.1.8.tgz",
-       "integrity": "sha512-m7jJe3nufUbuOfotkntGFupinL/fmuTNuQmiVE7cH2IZMuf4UbfbGYMUT3jVWgGYuRVLY9j8NnrRqgw5rr5QTg==",
-       "dev": true,
-+      "peer": true,
-       "requires": {
-         "esbuild": "^0.15.9",
-         "fsevents": "~2.3.2",
-@@ -4650,6 +4661,7 @@
-       "version": "3.5.10",
-       "resolved": "https://registry.npmjs.org/vue/-/vue-3.5.10.tgz",
-       "integrity": "sha512-Vy2kmJwHPlouC/tSnIgXVg03SG+9wSqT1xu1Vehc+ChsXsRd7jLkKgMltVEFOzUdBr3uFwBCG+41LJtfAcBRng==",
-+      "peer": true,
-       "requires": {
-         "@vue/compiler-dom": "3.5.10",
-         "@vue/compiler-sfc": "3.5.10",
--- 
-2.51.2
-
diff --git a/pkgs/by-name/lr/lrcget/package.nix b/pkgs/by-name/lr/lrcget/package.nix
index 081bdc27398c..35432d837000 100644
--- a/pkgs/by-name/lr/lrcget/package.nix
+++ b/pkgs/by-name/lr/lrcget/package.nix
@@ -22,27 +22,24 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lrcget";
-  version = "1.0.2";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "tranxuanthang";
     repo = "lrcget";
     tag = version;
-    hash = "sha256-4XeOIOV8QyJheVN98u/jo8H+n9AIzvVJITCk9d+kpFA=";
+    hash = "sha256-3dqE64IVvsrY33v3LoLUDJ+g6T5CvePIINWdqidDPdQ=";
   };
 
   patches = [
     # needed to not attempt codesigning on darwin
     ./remove-signing-identity.patch
-
-    # Update npm package versions to fix https://github.com/tranxuanthang/lrcget/issues/309
-    ./fix-tauri-version-mismatch.patch
   ];
 
   cargoRoot = "src-tauri";
   buildAndTestSubdir = "src-tauri";
 
-  cargoHash = "sha256-EjciD794MqUnp3CVloOPugbSfcxgfy7TdCUOlK6P+sk=";
+  cargoHash = "sha256-YRPMzFChmk5laah8yyRtMaUYH/uSOLUIAtl7wTl/qU0=";
 
   # FIXME: This is a workaround, because we have a git dependency node_modules/lrc-kit contains install scripts
   # but has no lockfile, which is something that will probably break.
@@ -51,7 +48,7 @@ rustPlatform.buildRustPackage rec {
   npmDeps = fetchNpmDeps {
     name = "lrcget-${version}-npm-deps";
     inherit src forceGitDeps patches;
-    hash = "sha256-iaxNrZLcb9qM5EPRtzoXw6izZBeS/rqgGaZpA2A2oho=";
+    hash = "sha256-yXRbQ6xM23VrVaS8Hb5sxPPic1yawKtFi2rCGkplgw4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/lu/lurk/package.nix b/pkgs/by-name/lu/lurk/package.nix
index 079087d9bf4a..b8396f564a54 100644
--- a/pkgs/by-name/lu/lurk/package.nix
+++ b/pkgs/by-name/lu/lurk/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lurk";
-  version = "0.3.12";
+  version = "0.3.14";
 
   src = fetchFromGitHub {
     owner = "jakwai01";
     repo = "lurk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gVxul9LeNbsP2eP0j5T6AL7pQh8Ls2lht3ki5JQ9kZM=";
+    hash = "sha256-Q7lxPjEfzbGPes11fP7qJY4cYetem7tKQasQcy67oRU=";
   };
 
-  cargoHash = "sha256-NNwcc4rUol9M59XzoQBNw/MfHw3LP6pUtNjw6OY6bMc=";
+  cargoHash = "sha256-QOdqA3gHfhBUWL5CHA5p4ueKwZusE5NBlGezBG//3FA=";
 
   postPatch = ''
     substituteInPlace src/lib.rs \
diff --git a/pkgs/by-name/ma/man-pages/package.nix b/pkgs/by-name/ma/man-pages/package.nix
index be1ac104d5af..88566c5cc3f7 100644
--- a/pkgs/by-name/ma/man-pages/package.nix
+++ b/pkgs/by-name/ma/man-pages/package.nix
@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "man-pages";
-  version = "6.17";
+  version = "6.18";
 
   # `man` is first: most people installing `man-pages` want man pages.
   # The binaries could be split to a seperate package (as upstream suggests),
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://kernel/linux/docs/man-pages/man-pages-${finalAttrs.version}.tar.xz";
-    hash = "sha256-0Y8hpgKwl3ilqQlr8b6EQbdzPpmBUEdKzPcD0WX06/Q=";
+    hash = "sha256-yTT63ItZdIxoIno09lgdLd+Cgrc83NUlRsjNiLdLJNE=";
   };
 
   # See https://git.kernel.org/pub/scm/docs/man-pages/man-pages.git/tree/man/man7/man.7,
diff --git a/pkgs/by-name/ne/neatvnc/package.nix b/pkgs/by-name/ne/neatvnc/package.nix
index 57651137c8ac..4acbb12b429a 100644
--- a/pkgs/by-name/ne/neatvnc/package.nix
+++ b/pkgs/by-name/ne/neatvnc/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "neatvnc";
-  version = "0.9.5";
+  version = "0.9.6";
 
   src = fetchFromGitHub {
     owner = "any1";
     repo = "neatvnc";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-wAIifLw2rlu44jXMu/k31B7qePdJt6pT6TOhNxcyfLw=";
+    hash = "sha256-VStlTsfXbFxTnRGdK1y7MLtCzxbHzraw5GGph3sS/kI=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index ee3f4acefcb6..60b7eff3761c 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -16,13 +16,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencode";
-  version = "1.14.20";
+  version = "1.14.24";
 
   src = fetchFromGitHub {
     owner = "anomalyco";
     repo = "opencode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9nxxvCkeTW3MasXaOhWaQqxqJeq9Q1+5TGULITjhV2Q=";
+    hash = "sha256-4GL+Lsdzea5nrLNq5Ld0EuiVVuiwTJUIrxdAdAJme1I=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {
@@ -75,7 +75,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     # NOTE: Required else we get errors that our fixed-output derivation references store paths
     dontFixup = true;
 
-    outputHash = "sha256-70F15j+YokvQGzvtniUSeIrdl6/tgpcEzDXrbCnZd6E=";
+    outputHash = "sha256-wQmsgZQGoedvn2RHINfKh9cVwSNYgkGaBOdV/AD70jQ=";
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
   };
diff --git a/pkgs/by-name/pa/patroni/package.nix b/pkgs/by-name/pa/patroni/package.nix
index 23911d710b74..227616e27f64 100644
--- a/pkgs/by-name/pa/patroni/package.nix
+++ b/pkgs/by-name/pa/patroni/package.nix
@@ -23,14 +23,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "patroni";
-  version = "4.1.0";
+  version = "4.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "zalando";
     repo = "patroni";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iY5QLbJXfQtfkzpQxvqSOzYQwgfFsBh8HPYujqxU44k=";
+    hash = "sha256-IEoO50MaEnXevS0HOzend19UHNA12CjDAUBB8fZxTkI=";
   };
 
   build-system = with python3Packages; [ setuptools ];
diff --git a/pkgs/by-name/pd/pdnsgrep/package.nix b/pkgs/by-name/pd/pdnsgrep/package.nix
index 9ad83f89312b..6c75e9ee0fd5 100644
--- a/pkgs/by-name/pd/pdnsgrep/package.nix
+++ b/pkgs/by-name/pd/pdnsgrep/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "pdnsgrep";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "akquinet";
     repo = "pdnsgrep";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bkCd5fIXj3qdbXmHCsnA9yi1LMYbIFdei72kaj2Uxzs=";
+    hash = "sha256-V5Im75vYQYZmAedx4TKGkuoXI0noOfH7wMDoJRWA1hs=";
   };
 
   vendorHash = "sha256-hTlweJAWWrcaYhTH8IuCxDmqNd1qWTYK5F8NQhBbKt0=";
diff --git a/pkgs/by-name/po/powershell/package.nix b/pkgs/by-name/po/powershell/package.nix
index a34c8e700166..64e96bbc1447 100644
--- a/pkgs/by-name/po/powershell/package.nix
+++ b/pkgs/by-name/po/powershell/package.nix
@@ -31,7 +31,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "powershell";
-  version = "7.6.0";
+  version = "7.6.1";
 
   src =
     passthru.sources.${stdenv.hostPlatform.system}
@@ -96,19 +96,19 @@ stdenv.mkDerivation rec {
     sources = {
       aarch64-darwin = fetchurl {
         url = "https://github.com/PowerShell/PowerShell/releases/download/v${version}/powershell-${version}-osx-arm64.tar.gz";
-        hash = "sha256-u1LbkOlk7guR6T9VmzUIeMayfBL9UYMNjsoXk3Erljk=";
+        hash = "sha256-nhB49wsRxA4Q9LrRNU2xzcrzjNZ3X89A4HOOP1rGgH4=";
       };
       aarch64-linux = fetchurl {
         url = "https://github.com/PowerShell/PowerShell/releases/download/v${version}/powershell-${version}-linux-arm64.tar.gz";
-        hash = "sha256-3d91ZPs7UtwmvlWA/FtOCOs/plsJRIiq5tSzytX+pGA=";
+        hash = "sha256-c0mIExlOoNhJ1ZQjMu5uUWV+pm2gghaqEFB4jVxSt0E=";
       };
       x86_64-darwin = fetchurl {
         url = "https://github.com/PowerShell/PowerShell/releases/download/v${version}/powershell-${version}-osx-x64.tar.gz";
-        hash = "sha256-fGJ5z+rQYyRFGhD/dBiDCGyaAPAkuuqSS7nTwQb+DII=";
+        hash = "sha256-tfh0qDK+wrp4zT5E/bywTBthRNnqtCuYgcuLlAC8xQQ=";
       };
       x86_64-linux = fetchurl {
         url = "https://github.com/PowerShell/PowerShell/releases/download/v${version}/powershell-${version}-linux-x64.tar.gz";
-        hash = "sha256-BFF0cs9X1/nL2TiX2pvtRnxzymBjwp12VevCCqHWAj8=";
+        hash = "sha256-38lCKXZ5IWA/fD4csaxaqTFEivdJbM9ldyO2J4BXxBU=";
       };
     };
     tests.version = testers.testVersion {
diff --git a/pkgs/by-name/su/surfpool/package.nix b/pkgs/by-name/su/surfpool/package.nix
new file mode 100644
index 000000000000..131375083577
--- /dev/null
+++ b/pkgs/by-name/su/surfpool/package.nix
@@ -0,0 +1,86 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  fetchzip,
+  pkg-config,
+  versionCheckHook,
+  openssl,
+}:
+
+let
+  studioUiVersion = "v0.1.0";
+  studioUi = fetchzip {
+    url = "https://github.com/solana-foundation/surfpool-web-ui/releases/download/${studioUiVersion}/studio-dist.zip";
+    hash = "sha256-uZZpaAIg7f+ji5yonwNbAxbxi+4x7g5V4xKWUXNn1UI=";
+    stripRoot = false;
+  };
+in
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "surfpool-cli";
+  version = "1.2.0";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "solana-foundation";
+    repo = "surfpool";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-PGCzlnu7YxueQ16uae2818I9vXWdMRFRGaFzg2DIIgo=";
+    fetchSubmodules = true;
+  };
+
+  cargoHash = "sha256-ephKNAJ9PtTz/EN9dGFn6LnIySU0g/GNz8Jg9JDKTSI=";
+
+  postPatch = ''
+    # instead of downloading the surfpool-web-ui at build time, we fetch it beforehand and use it
+    # https://github.com/solana-foundation/surfpool/pull/628
+    substituteInPlace crates/studio/build.rs \
+      --replace-fail \
+        'let url = match env::var("STUDIO_UI_VERSION") {' \
+        'if let Ok(dist_path) = env::var("STUDIO_UI_DIST") {
+            let src = std::path::Path::new(&dist_path);
+            fn copy_dir(s: &std::path::Path, d: &std::path::Path) {
+                std::fs::create_dir_all(d).unwrap();
+                for e in std::fs::read_dir(s).unwrap() {
+                    let e = e.unwrap();
+                    if e.file_type().unwrap().is_dir() { copy_dir(&e.path(), &d.join(e.file_name())); }
+                    else { std::fs::copy(e.path(), d.join(e.file_name())).unwrap(); }
+                }
+            }
+            copy_dir(src, &asset_dir);
+            return;
+        }
+        let url = match env::var("STUDIO_UI_VERSION") {'
+  '';
+
+  env = {
+    RUSTFLAGS = "-Aunused";
+    OPENSSL_NO_VENDOR = 1;
+    STUDIO_UI_DIST = "${studioUi}";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ openssl ];
+
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  meta = {
+    description = "Surfpool is where developers start their Solana journey";
+    homepage = "https://www.surfpool.run/";
+    longDescription = ''
+      Surfpool is a drop-in replacement for solana-test-validator that lets
+      developers spin up local Solana networks mirroring mainnet state without
+      downloading the entire chain. It includes a built-in web UI (Surfpool Studio)
+      served directly from the binary, Infrastructure as Code for declarative
+      program deployment, transaction inspection, time travel, cheatcodes, and
+      an MCP server for agentic workflows
+    '';
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ _0xgsvs ];
+    mainProgram = "surfpool";
+  };
+})
diff --git a/pkgs/by-name/sy/sylpheed/package.nix b/pkgs/by-name/sy/sylpheed/package.nix
deleted file mode 100644
index 218de628020e..000000000000
--- a/pkgs/by-name/sy/sylpheed/package.nix
+++ /dev/null
@@ -1,69 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  pkg-config,
-  gtk2,
-  openssl ? null,
-  gpgme ? null,
-  gpgSupport ? true,
-  sslSupport ? true,
-  fetchpatch,
-}:
-
-assert gpgSupport -> gpgme != null;
-assert sslSupport -> openssl != null;
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "sylpheed";
-  version = "3.7.0";
-
-  src = fetchurl {
-    url = "https://sylpheed.sraoss.jp/sylpheed/v3.7/sylpheed-${finalAttrs.version}.tar.xz";
-    sha256 = "0j9y5vdzch251s264diw9clrn88dn20bqqkwfmis9l7m8vmwasqd";
-  };
-
-  patches = [
-    (fetchpatch {
-      # patch upstream bug https://sylpheed.sraoss.jp/redmine/issues/306
-      name = "patch-libsylph_ssl_c.patch";
-      extraPrefix = "";
-      url = "https://cvsweb.openbsd.org/cgi-bin/cvsweb/~checkout~/ports/mail/sylpheed/patches/patch-libsylph_ssl_c?rev=1.4&content-type=text/plain";
-      sha256 = "sha256-+FetU5vrfvE78nYAjKK/QFZnFw+Zr2PvoUGRWCuZczs=";
-    })
-    (fetchpatch {
-      name = "CVE-2021-37746.patch";
-      url = "https://git.claws-mail.org/?p=claws.git;a=patch;h=ac286a71ed78429e16c612161251b9ea90ccd431";
-      sha256 = "sha256-oLmUShtvO6io3jibKT67eO0O58vEDZEeaB51QTd3UkU=";
-    })
-    (fetchurl {
-      name = "0013-fix-FTBFS-GCC-14.patch";
-      url = "https://salsa.debian.org/sylpheed-team/sylpheed/-/raw/22984c6d2bf76b0667256a9e8b660447497e1220/debian/patches/0013-fix-FTBFS-GCC-14.patch?inline=false";
-      sha256 = "sha256-ZfQKiOK8pMrN87hrP0/2LxYZZdnaciBoa0khG1Djelo=";
-    })
-  ];
-
-  nativeBuildInputs = [ pkg-config ];
-
-  buildInputs = [
-    gtk2
-  ]
-  ++ lib.optionals gpgSupport [ gpgme ]
-  ++ lib.optionals sslSupport [ openssl ];
-
-  configureFlags = lib.optional gpgSupport "--enable-gpgme" ++ lib.optional sslSupport "--enable-ssl";
-
-  # Undefined symbols for architecture arm64: "_OBJC_CLASS_$_NSAutoreleasePool"
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    NIX_LDFLAGS = "-framework Foundation";
-  };
-
-  meta = {
-    homepage = "https://sylpheed.sraoss.jp/en/";
-    description = "Lightweight and user-friendly e-mail client";
-    mainProgram = "sylpheed";
-    maintainers = [ ];
-    platforms = lib.platforms.linux ++ lib.platforms.darwin;
-    license = lib.licenses.gpl2;
-  };
-})
diff --git a/pkgs/by-name/wi/wiiload/fix-gcc15.patch b/pkgs/by-name/wi/wiiload/fix-gcc15.patch
new file mode 100644
index 000000000000..547ecd500407
--- /dev/null
+++ b/pkgs/by-name/wi/wiiload/fix-gcc15.patch
@@ -0,0 +1,21 @@
+diff --git a/source/main.c b/source/main.c
+index 2d817e5..9dfeb3d 100644
+--- a/source/main.c
++++ b/source/main.c
+@@ -28,6 +28,7 @@
+ #include <unistd.h>
+ #include <errno.h>
+ #include <libgen.h>
++#include <stdbool.h>
+ #ifndef _WIN32
+ #include <sys/socket.h>
+ #include <netinet/in.h>
+@@ -62,8 +63,6 @@ typedef signed short s16;
+ typedef signed int s32;
+ typedef signed long long s64;
+
+-typedef enum { false, true } bool;
+-
+ #ifndef __WIN32__
+ static const char *desc_export = "export";
+ #ifndef __APPLE__
\ No newline at end of file
diff --git a/pkgs/by-name/wi/wiiload/package.nix b/pkgs/by-name/wi/wiiload/package.nix
index 24ff433b37f9..6eefa0b0af64 100644
--- a/pkgs/by-name/wi/wiiload/package.nix
+++ b/pkgs/by-name/wi/wiiload/package.nix
@@ -23,6 +23,11 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-pZdZzCAPfAVucuiV/q/ROY3cz/wxQWep6dCTGNn2fSo=";
   };
 
+  patches = [
+    # https://github.com/devkitPro/wiiload/pull/4
+    ./fix-gcc15.patch
+  ];
+
   preConfigure = "./autogen.sh";
 
   meta = {
diff --git a/pkgs/by-name/hy/hyprfreeze/package.nix b/pkgs/by-name/wl/wl-freeze/package.nix
similarity index 54%
rename from pkgs/by-name/hy/hyprfreeze/package.nix
rename to pkgs/by-name/wl/wl-freeze/package.nix
index 004bfe792e41..720a207bdc6a 100644
--- a/pkgs/by-name/hy/hyprfreeze/package.nix
+++ b/pkgs/by-name/wl/wl-freeze/package.nix
@@ -10,33 +10,41 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  pname = "hyprfreeze";
-  version = "1.2.0";
+  pname = "wl-freeze";
+  version = "2.0.2";
+
+  strictDeps = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "Zerodya";
-    repo = "hyprfreeze";
+    repo = "wl-freeze";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-omwAWBEnb14ZBux7bvXSJyi7FI1LZ5GaZFn46/bWJA4=";
+    hash = "sha256-miyDiUN86Zy9RfVm1MefKrYihX4+bFv6Jr4Cl4GzGz8=";
   };
 
+  dontConfigure = true;
+  dontBuild = true;
+
   nativeBuildInputs = [ makeWrapper ];
 
   installPhase = ''
     runHook preInstall
 
-    install -Dm755 hyprfreeze $out/bin/hyprfreeze
+    install -Dm755 wl-freeze $out/bin/wl-freeze
 
     # Install shell completions
-    install -Dm444 completions/bash/hyprfreeze $out/share/bash-completion/completions/hyprfreeze
-    install -Dm444 completions/zsh/_hyprfreeze $out/share/zsh/site-functions/_hyprfreeze
-    install -Dm444 completions/fish/hyprfreeze.fish $out/share/fish/completions/hyprfreeze.fish
+    installShellCompletion \
+      --cmd wl-freeze \
+      --bash completions/bash/wl-freeze \
+      --zsh completions/zsh/_wl-freeze \
+      --fish completions/fish/wl-freeze.fish
 
     runHook postInstall
   '';
 
   postFixup = ''
-    wrapProgram $out/bin/hyprfreeze \
+    wrapProgram $out/bin/wl-freeze \
       --prefix PATH : ${
         lib.makeBinPath [
           jq
@@ -48,11 +56,11 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
-    description = "Utility to suspend a game process (and other programs) in Hyprland";
-    homepage = "https://github.com/Zerodya/hyprfreeze";
+    description = "Utility to suspend a game process (and other programs) in Wayland compositors";
+    homepage = "https://github.com/Zerodya/wl-freeze";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ zerodya ];
     platforms = lib.platforms.linux;
-    mainProgram = "hyprfreeze";
+    mainProgram = "wl-freeze";
   };
 })
diff --git a/pkgs/by-name/xm/xmagnify/package.nix b/pkgs/by-name/xm/xmagnify/package.nix
index 8e08eb4f0cca..eb9abf8515dc 100644
--- a/pkgs/by-name/xm/xmagnify/package.nix
+++ b/pkgs/by-name/xm/xmagnify/package.nix
@@ -17,7 +17,11 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "1ngnp5f5zl3v35vhbdyjpymy6mwrs0476fm5nd7dzkba7n841jdh";
   };
 
-  prePatch = "substituteInPlace ./Makefile --replace /usr $out";
+  prePatch = ''
+    substituteInPlace Makefile --replace-fail /usr $out
+    # gcc15
+    substituteInPlace main.c --replace-fail 'handler ()' 'handler (int sig)'
+  '';
 
   buildInputs = [
     libx11
diff --git a/pkgs/development/beam-modules/expert/default.nix b/pkgs/development/beam-modules/expert/default.nix
index a656cb55203e..7812ec91d380 100644
--- a/pkgs/development/beam-modules/expert/default.nix
+++ b/pkgs/development/beam-modules/expert/default.nix
@@ -1,25 +1,30 @@
 {
+  _experimental-update-script-combinators,
   erlang,
   fetchFromGitHub,
-  mixRelease,
-  lib,
   fetchMixDeps,
+  gnused,
+  lib,
+  mixRelease,
+  nix-update-script,
+  nurl,
+  writeShellApplication,
 }:
 let
-  version = "0.1.0";
+  version = "0.1.1";
 
   src = fetchFromGitHub {
     owner = "elixir-lang";
     repo = "expert";
     tag = "v${version}";
-    hash = "sha256-r/SovUjU12ENT6OqbYuGK7XAmoxchUgiHTswlON/WeI=";
+    hash = "sha256-J38+ESTrygj62wcOOAaq1ERM/ze3+p8Ec369Cz0F1Sg=";
   };
 
   engineDeps = fetchMixDeps {
     pname = "mix-deps-expert-engine";
 
     inherit src version;
-    hash = "sha256-2QCaY4TlscRmklPQ897xjjree7N8cLl7O83syfqPmng=";
+    hash = "sha256-relCdTBialz4Z/BpXZxmuhSYrvJqLINg/AVGfEhuDGo=";
 
     preConfigure = ''
       cd apps/engine
@@ -58,6 +63,24 @@ mixRelease rec {
 
   passthru = {
     inherit engineDeps;
+
+    updateScript = _experimental-update-script-combinators.sequence [
+      (nix-update-script { })
+      (lib.getExe (writeShellApplication {
+        name = "expert-update-engine";
+        runtimeInputs = [
+          gnused
+          nurl
+        ];
+        text = ''
+          nixpkgs="$(git rev-parse --show-toplevel)"
+          engineHashOld=${engineDeps.hash}
+          engineHashNew=$(nurl -e "(import $nixpkgs/. { }).$UPDATE_NIX_ATTR_PATH.engineDeps")
+          echo "$UPDATE_NIX_ATTR_PATH.engineDeps.hash" >&2
+          sed -i "s|$engineHashOld|$engineHashNew|" "$nixpkgs"/pkgs/development/beam-modules/expert/default.nix
+        '';
+      }))
+    ];
   };
 
   meta = {
diff --git a/pkgs/development/python-modules/cssutils/default.nix b/pkgs/development/python-modules/cssutils/default.nix
index 1cc7266a5e85..9d38d4398146 100644
--- a/pkgs/development/python-modules/cssutils/default.nix
+++ b/pkgs/development/python-modules/cssutils/default.nix
@@ -3,6 +3,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   setuptools-scm,
+  encutils,
   more-itertools,
   cssselect,
   jaraco-test,
@@ -13,19 +14,27 @@
 
 buildPythonPackage rec {
   pname = "cssutils";
-  version = "2.11.1";
+  version = "2.14.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jaraco";
     repo = "cssutils";
     tag = "v${version}";
-    hash = "sha256-U9myMfKz1HpYVJXp85izRBpm2wjLHYZj8bUVt3ROTEg=";
+    hash = "sha256-kuqHfwJn+GT1VIC2PWu5Oj1X6SGn/bi2QPN8kfposVs=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail '"coherent.licensed",' ""
+  '';
+
   build-system = [ setuptools-scm ];
 
-  dependencies = [ more-itertools ];
+  dependencies = [
+    encutils
+    more-itertools
+  ];
 
   nativeCheckInputs = [
     cssselect
@@ -37,7 +46,6 @@ buildPythonPackage rec {
 
   disabledTests = [
     # access network
-    "encutils"
     "website.logging"
   ];
 
diff --git a/pkgs/development/python-modules/django-allauth/default.nix b/pkgs/development/python-modules/django-allauth/default.nix
index 458fedfc944a..d36f2048a919 100644
--- a/pkgs/development/python-modules/django-allauth/default.nix
+++ b/pkgs/development/python-modules/django-allauth/default.nix
@@ -41,14 +41,14 @@
 
 buildPythonPackage rec {
   pname = "django-allauth";
-  version = "65.16.0";
+  version = "65.16.1";
   pyproject = true;
 
   src = fetchFromCodeberg {
     owner = "allauth";
     repo = "django-allauth";
     tag = version;
-    hash = "sha256-uYJErt7RElFrSMyVtnUgdkoIVIBzuAENZZHn/7kmfDE=";
+    hash = "sha256-ZtrbIklik0GmVMNtZegXJ8ot+5LKjO0B5ioo5nArKMk=";
   };
 
   nativeBuildInputs = [ gettext ];
diff --git a/pkgs/development/python-modules/encutils/default.nix b/pkgs/development/python-modules/encutils/default.nix
new file mode 100644
index 000000000000..37f91db5a007
--- /dev/null
+++ b/pkgs/development/python-modules/encutils/default.nix
@@ -0,0 +1,39 @@
+{
+  buildPythonPackage,
+  chardet,
+  fetchPypi,
+  flit-core,
+  lib,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "encutils";
+  version = "1.0.0";
+  pyproject = true;
+
+  # pyproject.toml on GitHub uses coherent.build as build-system
+  src = fetchPypi {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-OOylrxjOur2L5DwX8UydP7uoPMX3rI46schuJMSyuRo=";
+  };
+
+  build-system = [ flit-core ];
+
+  dependencies = [
+    chardet
+  ];
+
+  pythonImportsCheck = [ "encutils" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "Collection of helper functions to detect encodings of text files";
+    homepage = "https://github.com/coherent-oss/encutils";
+    license = lib.licenses.lgpl3Plus;
+    maintainers = [ lib.maintainers.dotlambda ];
+  };
+})
diff --git a/pkgs/development/python-modules/exa-py/default.nix b/pkgs/development/python-modules/exa-py/default.nix
new file mode 100644
index 000000000000..0dbe5c755d83
--- /dev/null
+++ b/pkgs/development/python-modules/exa-py/default.nix
@@ -0,0 +1,85 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build
+  poetry-core,
+
+  # deps
+  httpcore,
+  httpx,
+  openai,
+  pydantic,
+  python-dotenv,
+  requests,
+  typing-extensions,
+
+  # tests
+  pytest-asyncio,
+  pytest-cov-stub,
+  pytest-mock,
+  pytestCheckHook,
+
+  # passthru
+  unstableGitUpdater,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "exa-py";
+  version = "2.12.0-unstable-2026-04-15";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  # pypi doesn't include tests but there aren't any upstream git tags
+  src = fetchFromGitHub {
+    owner = "exa-labs";
+    repo = "exa-py";
+    rev = "af7f88999763f1cb7e3c4a67f4aa24cef5f6eb11";
+    hash = "sha256-7rLEvjngSRObFdT1DcrZfqWBCsvWVxdNIgxBNhNNk+4=";
+  };
+
+  # https://github.com/pytest-dev/pytest-asyncio/issues/658
+  # default behaviour changes with new python version.
+  # planning on trying to vendor upstream
+  postPatch = ''
+    substituteInPlace tests/unit/test_search_monitors.py --replace-fail \
+      'get_event_loop().run_until_complete' 'run'
+  '';
+
+  build-system = [
+    poetry-core
+  ];
+
+  dependencies = [
+    httpcore
+    httpx
+    openai
+    pydantic
+    python-dotenv
+    requests
+    typing-extensions
+  ];
+
+  pythonImportsCheck = [
+    "exa_py"
+  ];
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytest-cov-stub
+    pytest-mock
+    pytestCheckHook
+  ];
+
+  pytestFlags = [ "tests/" ];
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = {
+    description = "Official Python SDK for Exa, the web search API for AI";
+    homepage = "https://github.com/exa-labs/exa-py/";
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+    license = lib.licenses.mit;
+  };
+})
diff --git a/pkgs/development/python-modules/fastexcel/default.nix b/pkgs/development/python-modules/fastexcel/default.nix
index 14752fe91b91..b61f484b14cb 100644
--- a/pkgs/development/python-modules/fastexcel/default.nix
+++ b/pkgs/development/python-modules/fastexcel/default.nix
@@ -20,19 +20,20 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "fastexcel";
-  version = "0.19.0";
+  version = "0.20.1";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "ToucanToco";
     repo = "fastexcel";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BMFZOduKN6D3y9aRkt9VAG2T9oNFBUcnmux1qTKgY5c=";
+    hash = "sha256-YL8EkV6IuqAMxooOMbqCrTfDM4uhH9A+v7UFw1f/iek=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-aTYwXJN2hncZsEAGSlQzK5cX4uWpNoS0wpsXL0I6pZo=";
+    hash = "sha256-TK/5eES+RlSDFIbhVjzbPgdrDRRKZlCiuqtLRm8R/go=";
   };
 
   nativeBuildInputs = [
@@ -42,10 +43,6 @@ buildPythonPackage (finalAttrs: {
     rustc
   ];
 
-  maturinBuildFlags = [
-    "--features __maturin"
-  ];
-
   optional-dependencies = {
     pyarrow = [
       pyarrow
diff --git a/pkgs/development/python-modules/gcsfs/default.nix b/pkgs/development/python-modules/gcsfs/default.nix
index dec83f811bf6..1a81e2556ec7 100644
--- a/pkgs/development/python-modules/gcsfs/default.nix
+++ b/pkgs/development/python-modules/gcsfs/default.nix
@@ -2,29 +2,36 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
   setuptools,
+
+  # dependencies
+  aiohttp,
+  decorator,
+  fsspec,
   google-auth,
   google-auth-oauthlib,
   google-cloud-storage,
   google-cloud-storage-control,
   requests,
-  decorator,
-  fsspec,
+
+  # optional-dependencies
   fusepy,
-  aiohttp,
   crcmod,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "gcsfs";
   version = "2026.3.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "fsspec";
     repo = "gcsfs";
-    tag = version;
-    hash = "sha256-eTIAGPin7Ej+aar5ZXATeYfqQJrGnyWfUdBIfq5eq/c=";
+    tag = finalAttrs.version;
+    hash = "sha256-RLh3xFW/0qX5labJeUDsRRmQtnTdkvBS+gzJUJ1IP7k=";
   };
 
   build-system = [
@@ -55,8 +62,8 @@ buildPythonPackage rec {
   meta = {
     description = "Convenient Filesystem interface over GCS";
     homepage = "https://github.com/fsspec/gcsfs";
-    changelog = "https://github.com/fsspec/gcsfs/raw/${src.tag}/docs/source/changelog.rst";
+    changelog = "https://github.com/fsspec/gcsfs/raw/${finalAttrs.src.tag}/docs/source/changelog.rst";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ nbren12 ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/knx-frontend/default.nix b/pkgs/development/python-modules/knx-frontend/default.nix
index 76ef8f87c8b1..077e173e6c86 100644
--- a/pkgs/development/python-modules/knx-frontend/default.nix
+++ b/pkgs/development/python-modules/knx-frontend/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "knx-frontend";
-  version = "2026.3.28.223133";
+  version = "2026.4.22.141111";
   pyproject = true;
 
   # TODO: source build, uses yarn.lock
   src = fetchPypi {
     pname = "knx_frontend";
     inherit version;
-    hash = "sha256-U/lHc4SZcUEG1yq2sMkSzM9n/n6TuNhbx4U2ZmMqAY0=";
+    hash = "sha256-2gzQETX2YayiahCGw9sSS6mCo5DmApBZB54ISQBm43M=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/mlx-lm/default.nix b/pkgs/development/python-modules/mlx-lm/default.nix
index cff7c736fa53..bad832123c92 100644
--- a/pkgs/development/python-modules/mlx-lm/default.nix
+++ b/pkgs/development/python-modules/mlx-lm/default.nix
@@ -24,14 +24,15 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "mlx-lm";
-  version = "0.31.2";
+  version = "0.31.3";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "ml-explore";
     repo = "mlx-lm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ujt0KMs4dzIlbg7cg72TudAvlwJ4uWEG5Lx7+5j8cOU=";
+    hash = "sha256-DPOJfsIucG8mWt4ZKenymCJo/i9Jw+a+iuIygIIYkA8=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/mlx/default.nix b/pkgs/development/python-modules/mlx/default.nix
index 6cdc7cb6e6c9..9f22360363e3 100644
--- a/pkgs/development/python-modules/mlx/default.nix
+++ b/pkgs/development/python-modules/mlx/default.nix
@@ -20,6 +20,7 @@
 
   # tests
   numpy,
+  psutil,
   pytestCheckHook,
   python,
   runCommand,
@@ -41,14 +42,15 @@ let
 in
 buildPythonPackage (finalAttrs: {
   pname = "mlx";
-  version = "0.31.1";
+  version = "0.31.2";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "ml-explore";
     repo = "mlx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PiNk/MdMw9Vpat2KuslBTyaFuK+mJ4UvwJqBnysvvUU=";
+    hash = "sha256-0Oxacz61WGWZrpWw+fMQjEQfwOx1l1L2d0kWl54/LrQ=";
   };
 
   patches = [
@@ -120,6 +122,7 @@ buildPythonPackage (finalAttrs: {
   # Run the mlx Python test suite.
   nativeCheckInputs = [
     numpy
+    psutil
     pytestCheckHook
   ];
 
diff --git a/pkgs/development/python-modules/mlx/dont-fetch-json.patch b/pkgs/development/python-modules/mlx/dont-fetch-json.patch
index e134d25d2cd3..c52f579922c1 100644
--- a/pkgs/development/python-modules/mlx/dont-fetch-json.patch
+++ b/pkgs/development/python-modules/mlx/dont-fetch-json.patch
@@ -1,8 +1,8 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 2451aa65..f88d4889 100644
+index 6d24df02..113629ba 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -241,14 +241,6 @@ else()
+@@ -313,14 +313,6 @@ else()
    set(MLX_BUILD_ACCELERATE OFF)
  endif()
  
@@ -14,7 +14,6 @@ index 2451aa65..f88d4889 100644
 -target_include_directories(
 -  mlx PRIVATE $<BUILD_INTERFACE:${json_SOURCE_DIR}/single_include/nlohmann>)
 -
- add_subdirectory(${CMAKE_CURRENT_LIST_DIR}/mlx)
- 
- target_include_directories(
-
+ # Add standalone JACCL library (RDMA over Thunderbolt distributed backend)
+ if(MLX_BUILD_CPU
+    AND ${CMAKE_SYSTEM_NAME} MATCHES "Darwin"
diff --git a/pkgs/development/python-modules/mlx/dont-fetch-nanobind.patch b/pkgs/development/python-modules/mlx/dont-fetch-nanobind.patch
index f2858448a93b..c9822ae1e2c7 100644
--- a/pkgs/development/python-modules/mlx/dont-fetch-nanobind.patch
+++ b/pkgs/development/python-modules/mlx/dont-fetch-nanobind.patch
@@ -1,15 +1,15 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 0ed30932..e5842707 100644
+index a2395d02..6d24df02 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -339,13 +339,7 @@ if(MLX_BUILD_PYTHON_BINDINGS)
+@@ -354,13 +354,7 @@ if(MLX_BUILD_PYTHON_BINDINGS)
      Python 3.10
      COMPONENTS Interpreter Development.Module
      REQUIRED)
 -  FetchContent_Declare(
 -    nanobind
 -    GIT_REPOSITORY https://github.com/wjakob/nanobind.git
--    GIT_TAG v2.10.2
+-    GIT_TAG v2.12.0
 -    GIT_SHALLOW TRUE
 -    EXCLUDE_FROM_ALL)
 -  FetchContent_MakeAvailable(nanobind)
diff --git a/pkgs/development/python-modules/mne/default.nix b/pkgs/development/python-modules/mne/default.nix
index b967acbe362c..103839e8b383 100644
--- a/pkgs/development/python-modules/mne/default.nix
+++ b/pkgs/development/python-modules/mne/default.nix
@@ -3,6 +3,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   pythonAtLeast,
+  stdenv,
   hatchling,
   hatch-vcs,
   numpy,
@@ -28,14 +29,14 @@
 
 buildPythonPackage rec {
   pname = "mne";
-  version = "1.11.0";
+  version = "1.12.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mne-tools";
     repo = "mne-python";
     tag = "v${version}";
-    hash = "sha256-lssSHlWUj3TU0F/31jTFc+oFdBx1C+9aolee6M8mJtw=";
+    hash = "sha256-j5PpUF7Yle8mFtIjawDaulq1s7zzVPpT3Y4+xNbQ+fk=";
   };
 
   postPatch = ''
@@ -92,9 +93,10 @@ buildPythonPackage rec {
     "test_fine_cal_systems"
     "test_simulate_raw_bem"
   ]
-  ++ lib.optionals (pythonAtLeast "3.14") [
-    #https://github.com/mne-tools/mne-python/issues/13577
-    "test_set_montage_artinis_basic"
+  ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+    # Fails when no "model name" is present in /proc/cpuinfo,
+    # which is common on Arm Linux systems
+    "test_sys_info_basic"
   ];
 
   pytestFlag = [
diff --git a/pkgs/development/python-modules/onnx-ir/default.nix b/pkgs/development/python-modules/onnx-ir/default.nix
index cd419744a99d..60c4a5425d0c 100644
--- a/pkgs/development/python-modules/onnx-ir/default.nix
+++ b/pkgs/development/python-modules/onnx-ir/default.nix
@@ -25,14 +25,15 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "onnx-ir";
-  version = "0.2.0";
+  version = "0.2.1";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "onnx";
     repo = "ir-py";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-U6N1vnsvp2Tr2qSIl9gsUnrKDjeUuUXAXx6ZyRnUTKM=";
+    hash = "sha256-vdo8BiE7m9Qr3JktgcPGDZfykjcf/VYY39tfhtzOrpA=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/onnxscript/default.nix b/pkgs/development/python-modules/onnxscript/default.nix
index 34068be3b9b3..0cce49403530 100644
--- a/pkgs/development/python-modules/onnxscript/default.nix
+++ b/pkgs/development/python-modules/onnxscript/default.nix
@@ -30,14 +30,15 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "onnxscript";
-  version = "0.6.2";
+  version = "0.7.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "onnxscript";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-raeNa/OY9c8g+kHNxSAdLxhj+iwaMf/wrjUaKfW4E2s=";
+    hash = "sha256-PktzMtG8GpeRy3XUz8MFbOSISVzAIubpeOS0ESbVvrI=";
   };
 
   env = {
diff --git a/pkgs/development/python-modules/pydantic-ai-slim/default.nix b/pkgs/development/python-modules/pydantic-ai-slim/default.nix
index 1eeddfc39a13..b2c25e530313 100644
--- a/pkgs/development/python-modules/pydantic-ai-slim/default.nix
+++ b/pkgs/development/python-modules/pydantic-ai-slim/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydantic-ai-slim";
-  version = "1.84.1";
+  version = "1.86.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "pydantic-ai";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LMfRGmLr51DzgJO97I/mJvyrVYD9tsF9OkCfw0ABWfw=";
+    hash = "sha256-4kDZzotCty40undBQoRXIzAFBufPIj3QSvhDjlG+Y6E=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/pydantic_ai_slim";
diff --git a/pkgs/development/python-modules/pydantic-graph/default.nix b/pkgs/development/python-modules/pydantic-graph/default.nix
index 66d55f15247b..3504354d1e8a 100644
--- a/pkgs/development/python-modules/pydantic-graph/default.nix
+++ b/pkgs/development/python-modules/pydantic-graph/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydantic-graph";
-  version = "1.84.1";
+  version = "1.86.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "pydantic-ai";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LMfRGmLr51DzgJO97I/mJvyrVYD9tsF9OkCfw0ABWfw=";
+    hash = "sha256-4kDZzotCty40undBQoRXIzAFBufPIj3QSvhDjlG+Y6E=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/pydantic_graph";
diff --git a/pkgs/development/python-modules/pyeclib/default.nix b/pkgs/development/python-modules/pyeclib/default.nix
index d323075207e0..89502c642dcd 100644
--- a/pkgs/development/python-modules/pyeclib/default.nix
+++ b/pkgs/development/python-modules/pyeclib/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "pyeclib";
-  version = "1.7.0";
+  version = "1.8.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "openstack";
     repo = "pyeclib";
     tag = version;
-    hash = "sha256-wYzZUtr80KgVTznD0ISy7qhGngm4Xmt8Mauu9lP+2T4=";
+    hash = "sha256-v7pkV5s10AxU+vgp+gcQF8lJmm6yzDwkqunWuT0zU4c=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pyexpect/default.nix b/pkgs/development/python-modules/pyexpect/default.nix
index 70acc2ffd1d4..76b84fd27d2b 100644
--- a/pkgs/development/python-modules/pyexpect/default.nix
+++ b/pkgs/development/python-modules/pyexpect/default.nix
@@ -29,7 +29,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "pyexpect" ];
 
   meta = {
-    changelog = "https://dwt/pyexpect/releases/tag/${version}";
+    changelog = "https://github.com/dwt/pyexpect/releases/tag/${version}";
     description = "Minimal but very flexible implementation of the expect pattern";
     homepage = "https://github.com/dwt/pyexpect";
     license = lib.licenses.isc;
diff --git a/pkgs/development/python-modules/pylance/default.nix b/pkgs/development/python-modules/pylance/default.nix
index 9df2ae84c750..97666d8effc7 100644
--- a/pkgs/development/python-modules/pylance/default.nix
+++ b/pkgs/development/python-modules/pylance/default.nix
@@ -34,14 +34,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pylance";
-  version = "4.0.0";
+  version = "4.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lancedb";
     repo = "lance";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Z7lgK7sIeZCL8VXfmwC8G1f7cBqG2nfFM3oyJZfmNQ4=";
+    hash = "sha256-bQnPa+5w5/WXw0i+D8jhk12Q/iKOFieKwZ9NPjAf5VQ=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/python";
@@ -53,7 +53,7 @@ buildPythonPackage (finalAttrs: {
       src
       sourceRoot
       ;
-    hash = "sha256-hZEcTo4B3+viRwWExkaguq+c7DejjaouNf0+L96rms4=";
+    hash = "sha256-Hr3qrCVNpLpEiHKFOaA0gf5wRY3Tn2pBwZf292jmoSU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/ray/default.nix b/pkgs/development/python-modules/ray/default.nix
index ff5a984bac6e..f8f25cb29745 100644
--- a/pkgs/development/python-modules/ray/default.nix
+++ b/pkgs/development/python-modules/ray/default.nix
@@ -73,8 +73,9 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ray";
-  version = "2.55.0";
+  version = "2.55.1";
   format = "wheel";
+  __structuredAttres = true;
 
   disabled = pythonAtLeast "3.15";
 
@@ -90,22 +91,22 @@ buildPythonPackage (finalAttrs: {
       # Results are in ./ray-hashes.nix
       hashes = {
         x86_64-linux = {
-          cp311 = "sha256-UiSRRs/c92ns/+VPWyyvJVUb9up42d2JeIwKZpynabc=";
-          cp312 = "sha256-zUYL2/iopLt2iiDDixxTTYT+Y7wOXzWAxcDvcwK5hrM=";
-          cp313 = "sha256-8W3qMuXMWO1AbA7w3UvmnWDOd6B17bXwOANWpIv4WrM=";
-          cp314 = "sha256-6wpheWQbxCCmbuhcybOC5Y8i7/vTYpfjaDp5PlzcCJg=";
+          cp311 = "sha256-1TgtoYHAPuL1Au9Gzwrku8MBV7W9mmfXZR9qJyUoqFo=";
+          cp312 = "sha256-JjcF9rqynnYiqU+C2iX9f5zq12zfiaB6qyj3nN+PnZU=";
+          cp313 = "sha256-E4DgQ+tXzeabfpGZxvJVjO648PxByX0dXlDqBCEV8wI=";
+          cp314 = "sha256-FW7T5yrZW2RdIAbNcajd28yJtWv8AAJ/YiWt94vZy3Q=";
         };
         aarch64-linux = {
-          cp311 = "sha256-sf1zQnCT0a7x+3vTxUMKTmhtXhD6BAiXVxY6TCpRfes=";
-          cp312 = "sha256-t39AYHKsDOkEMaxDaCjzZMGDq1e6FcOg5oinSuPC0/M=";
-          cp313 = "sha256-zu6HqIRgKqs02xCUFeaDmm6RafR1DKtye36hYQ31uR8=";
-          cp314 = "sha256-t0OQ8gHyjwXI8lAGnf7VTW1qAQn/5IJCXXbBG+gg4wk=";
+          cp311 = "sha256-DqL2cKdyWDOtIzOoxGq2mGWtBsjl3p9laV4PjzUzHOw=";
+          cp312 = "sha256-JlQfabtVYH74M1uqx1su0S/yzgLVYxMhmyntoAMDkiE=";
+          cp313 = "sha256-tBXVkOBi8kiQfg/kKZSUPxFya3F4/PSxz1VGch+xpfg=";
+          cp314 = "sha256-TmGNYeGxS2/emlhhUfP9nUNbC4UEi5l7yqf0pTN0eys=";
         };
         aarch64-darwin = {
-          cp311 = "sha256-JCbpxFE8tIQr+vcKrt9LntwwL7Ad5cGQb2i5tCegwkM=";
-          cp312 = "sha256-bwuN+jcWzJvl/OO1Ppv9tzzqNgJb/m8dJ5KND4TP1pU=";
-          cp313 = "sha256-Hai4dVtuT94D23i2ziu87Pz70g05uTgz0kbFFdru3zw=";
-          cp314 = "sha256-1IvEUzs7dtWe0/nqsea3MipTp83vuPZX2bRu661W2+4=";
+          cp311 = "sha256-AFP9W0APesViY6obvT1o+3k0Gwi43Gl8iHgtWsp7PtQ=";
+          cp312 = "sha256-E3+QBu7ijKq4JggDzKMU83u9o/yU/foxx3C10Bliatg=";
+          cp313 = "sha256-+YRKknLvLm61dxAlhmByz0I0z0x8waMeI1t95xEYZL4=";
+          cp314 = "sha256-sGIEXGTCvOOaUWYWJPcpLHu/MPKp2Hhieq4x1G2lcS0=";
         };
       };
     in
diff --git a/pkgs/development/python-modules/sdds/default.nix b/pkgs/development/python-modules/sdds/default.nix
index ab14e3a07e95..f0257c66503d 100644
--- a/pkgs/development/python-modules/sdds/default.nix
+++ b/pkgs/development/python-modules/sdds/default.nix
@@ -4,12 +4,13 @@
   fetchFromGitHub,
   numpy,
   pytestCheckHook,
+  hatchling,
 }:
 
 buildPythonPackage rec {
   pname = "sdds";
   version = "0.4.3";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pylhc";
@@ -18,7 +19,9 @@ buildPythonPackage rec {
     hash = "sha256-2lsim4FlOKBZ4Lk/iKIcItE/hvqiAK4XTkoxm52At/8=";
   };
 
-  propagatedBuildInputs = [ numpy ];
+  build-system = [ hatchling ];
+
+  dependencies = [ numpy ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
diff --git a/pkgs/development/python-modules/tuya-device-handlers/default.nix b/pkgs/development/python-modules/tuya-device-handlers/default.nix
index fef726756115..574b447b9341 100644
--- a/pkgs/development/python-modules/tuya-device-handlers/default.nix
+++ b/pkgs/development/python-modules/tuya-device-handlers/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tuya-device-handlers";
-  version = "0.0.17";
+  version = "0.0.18";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = "tuya-device-handlers";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-T3jwUeRVSAiRSzyIOo7M046C+Dul1/1I9kZj0OzIIcs=";
+    hash = "sha256-ZzK6IV6AF+5+oOW9ADM/zgwFTmKNT2CzaEuXXK2hyVo=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/xformers/default.nix b/pkgs/development/python-modules/xformers/default.nix
index 1ad3c89c05c3..323159a80690 100644
--- a/pkgs/development/python-modules/xformers/default.nix
+++ b/pkgs/development/python-modules/xformers/default.nix
@@ -13,7 +13,7 @@
 
   # dependencies
   numpy,
-  pynvml,
+  nvidia-ml-py,
 
   # tests
   einops,
@@ -102,7 +102,7 @@ buildPythonPackage.override { stdenv = effectiveStdenv; } (finalAttrs: {
     torch
   ]
   ++ lib.optionals cudaSupport [
-    pynvml
+    nvidia-ml-py
   ];
 
   pythonImportsCheck = [
diff --git a/pkgs/development/tools/analysis/radare2/default.nix b/pkgs/development/tools/analysis/radare2/default.nix
index 7adc62532e4b..0819a899a1dd 100644
--- a/pkgs/development/tools/analysis/radare2/default.nix
+++ b/pkgs/development/tools/analysis/radare2/default.nix
@@ -21,6 +21,7 @@
   python3,
   readline,
   ruby,
+  versionCheckHook,
   vte,
   xxhash,
   zlib,
@@ -46,19 +47,19 @@ let
   qjs = fetchFromGitHub {
     owner = "quickjs-ng";
     repo = "quickjs";
-    rev = "e2b100e8c5fa7131e9fb22b8a0e9ca0f16eb9892"; # https://github.com/radareorg/radare2/blob/master/subprojects/qjs.wrap
-    hash = "sha256-vq+K93MuvFC+JKw4623gKs53ngw1097l5Kf/RBGU+mA=";
+    rev = "3087a2ce5bcb66cc1fcd9f34d3e5ce3bd43a67d9"; # https://github.com/radareorg/radare2/blob/master/subprojects/qjs.wrap
+    hash = "sha256-Z6DUe/W1+3SYPRPCiL3oNL5ovXCsW3dsFuGkA9WF3W4=";
   };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "radare2";
-  version = "6.1.2";
+  version = "6.1.4";
 
   src = fetchFromGitHub {
     owner = "radare";
     repo = "radare2";
     tag = finalAttrs.version;
-    hash = "sha256-YiKbXKKwbeAUkeq4LcUwOxTHU1Hua4YhcwDULiHVmrQ=";
+    hash = "sha256-3MwBtjR3XQMhbJHnD30OVedUEKcje5jDPszNynkGCT8=";
   };
 
   mesonFlags = [
@@ -133,6 +134,12 @@ stdenv.mkDerivation (finalAttrs: {
     install_name_tool -add_rpath $out/lib $out/lib/libr_io.${finalAttrs.version}.dylib
   '';
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "-v";
+  doInstallCheck = true;
+
+  passthru.updateScript = ./update.sh;
+
   meta = {
     description = "UNIX-like reverse engineering framework and command-line toolset";
     longDescription = ''
@@ -163,7 +170,7 @@ stdenv.mkDerivation (finalAttrs: {
       mic92
       raskin
     ];
-    mainProgram = "radare2";
+    mainProgram = "r2";
     platforms = lib.platforms.unix;
   };
 })
diff --git a/pkgs/development/tools/analysis/radare2/update.sh b/pkgs/development/tools/analysis/radare2/update.sh
new file mode 100755
index 000000000000..bb9706815776
--- /dev/null
+++ b/pkgs/development/tools/analysis/radare2/update.sh
@@ -0,0 +1,78 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i sh -p curl jq nix-prefetch-github nix coreutils gnused gnugrep
+# shellcheck shell=sh
+set -eu
+
+# Directory of this script / the radare2 package
+SCRIPT_DIR="$(readlink -f "$(dirname "$0")")"
+NIXFILE="$SCRIPT_DIR/default.nix"
+
+# Determine latest release version
+LATEST_VERSION=$(curl -s https://api.github.com/repos/radareorg/radare2/releases/latest | jq -r '.tag_name')
+echo "Latest radare2 version: $LATEST_VERSION"
+
+CURRENT_VERSION=$(grep 'version = ' "$NIXFILE" | head -1 | sed 's/.*"\(.*\)".*/\1/')
+echo "Current radare2 version: $CURRENT_VERSION"
+
+if [ "$LATEST_VERSION" = "$CURRENT_VERSION" ]; then
+    echo "radare2 is already up to date"
+    exit 0
+fi
+
+# Update main package version and hash
+echo "Updating main source to $LATEST_VERSION..."
+MAIN_HASH=$(nix-prefetch-github radare radare2 --rev "$LATEST_VERSION" --json | jq -r '.hash')
+echo "  New main hash: $MAIN_HASH"
+
+sed -i "s|version = \"$CURRENT_VERSION\"|version = \"$LATEST_VERSION\"|" "$NIXFILE"
+sed -i "/src = fetchFromGitHub/,/};/{s|hash = \".*\"|hash = \"$MAIN_HASH\"|}" "$NIXFILE"
+
+# Update a single subproject
+# Arguments: name owner repo wrap_file ref_type
+update_subproject() {
+    name=$1
+    owner=$2
+    repo=$3
+    wrap_file=$4
+    ref_type=$5
+
+    echo "Checking subproject $name..."
+
+    # Fetch the wrap file from the new version
+    wrap_content=$(curl -sL "https://raw.githubusercontent.com/radareorg/radare2/$LATEST_VERSION/subprojects/$wrap_file")
+    new_rev=$(echo "$wrap_content" | grep '^revision' | sed 's/revision = //')
+
+    # Get the current revision from the nix file
+    current_rev=$(grep -A3 "repo = \"$repo\"" "$NIXFILE" | grep "$ref_type = " | sed 's/.*"\(.*\)".*/\1/')
+
+    if [ "$new_rev" = "$current_rev" ]; then
+        echo "  $name is unchanged at $current_rev"
+        return
+    fi
+
+    echo "  Updating $name: $current_rev -> $new_rev"
+
+    # Prefetch new hash
+    new_hash=$(nix-prefetch-github "$owner" "$repo" --rev "$new_rev" --json | jq -r '.hash')
+    echo "  New hash: $new_hash"
+
+    # Update revision and hash in the nix file
+    sed -i "/repo = \"$repo\"/,/};/{s|$ref_type = \"$current_rev\"|$ref_type = \"$new_rev\"|}" "$NIXFILE"
+    sed -i "/repo = \"$repo\"/,/};/{s|hash = \".*\"|hash = \"$new_hash\"|}" "$NIXFILE"
+}
+
+update_subproject binaryninja Vector35 binaryninja-api binaryninja.wrap rev
+update_subproject sdb radareorg sdb sdb.wrap tag
+update_subproject qjs quickjs-ng quickjs qjs.wrap rev
+
+echo "Update iaito to follow new radare2 version '$LATEST_VERSION'"
+IAITO_UPDATE_SCRIPT="$(readlink -f "$(dirname "$SCRIPT_DIR")/../../../by-name/ia/iaito/update.sh")"
+if "$IAITO_UPDATE_SCRIPT" "$LATEST_VERSION";then
+    echo "iaito updated to $LATEST_VERSION"
+else
+    # iaito release may not have been published yet, release dates are not in sync
+    # sometimes, iaito is released earlier than radare2
+    echo "failed to update iaito to $LATEST_VERSION, continuing"
+fi
+
+echo "Update complete. Please verify with: nix build .#radare2 .#iaito"
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 71ee1c23243e..7286326cbf45 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -594,6 +594,7 @@ mapAliases {
   deco = throw "'deco' has been removed as it is unused"; # Added 2025-12-18
   deepin = throw "the Deepin desktop environment and associated tools have been removed from nixpkgs due to lack of maintenance"; # Added 2025-08-21
   deepsea = throw "deepsea has been removed because it has been marked as broken since at least November 2024."; # Added 2025-09-28
+  defuddle-cli = warnAlias "defuddle-cli has been renamed to/replaced by 'defuddle'" defuddle; # Added 2026-04-16
   degit-rs = throw "'degit-rs' has been removed because it is unmaintained upstream and has vulnerable dependencies."; # Added 2025-07-11
   deltachat-cursed = throw "'deltachat-cursed' has been renamed to/replaced by 'arcanechat-tui'"; # Converted to throw 2025-10-27
   devdocs-desktop = throw "'devdocs-desktop' has been removed as it is unmaintained upstream and vendors insecure dependencies"; # Added 2025-06-11
@@ -926,6 +927,7 @@ mapAliases {
   http-prompt = throw "'http-prompt' has been removed as it was broken and unmaintained upstream"; # Added 2025-11-26
   hydra_unstable = throw "'hydra_unstable' has been renamed to/replaced by 'hydra'"; # Converted to throw 2025-10-27
   hydraAntLogger = warnAlias "'hydraAntLogger' has been renamed to 'hydra-ant-logger'" hydra-ant-logger; # Added 2026-02-08
+  hyprfreeze = warnAlias "'hyprfreeze' has been renamed to 'wl-freeze'" wl-freeze; # Added 2026-04-10
   i3-gaps = throw "'i3-gaps' has been renamed to/replaced by 'i3'"; # Converted to throw 2025-10-27
   i3lock-pixeled = throw "'i3lock-pixeled' has been unmaintained for several years now."; # Converted to throw 2026-01-24
   ibm-sw-tpm2 = throw "ibm-sw-tpm2 has been removed, as it was broken"; # Added 2025-08-25
@@ -1932,6 +1934,7 @@ mapAliases {
   swiPrologWithGui = throw "'swiPrologWithGui' has been renamed to/replaced by 'swi-prolog-gui'"; # Converted to throw 2025-10-27
   swww = warnAlias "'swww' has been renamed to 'awww'" awww; # Added 2026-03-22
   Sylk = throw "'Sylk' has been renamed to/replaced by 'sylk'"; # Converted to throw 2025-10-27
+  sylpheed = throw "'sylpheed' has been removed because it is broken and unmaintained, please use 'claws-mail' instead"; # Added 2026-04-22
   symbiyosys = throw "'symbiyosys' has been renamed to/replaced by 'sby'"; # Converted to throw 2025-10-27
   syn2mas = throw "'syn2mas' has been removed. It has been integrated into the main matrix-authentication-service CLI as a subcommand: 'mas-cli syn2mas'."; # Added 2025-07-07
   synapse-admin-etkecc = warnAlias "'synapse-admin-etkecc' has been renamed to 'ketesa'" ketesa; # Added 2026-04-03
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 70b29fde8d70..d66783552dc8 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5016,6 +5016,8 @@ self: super: with self; {
 
   encodec = callPackage ../development/python-modules/encodec { };
 
+  encutils = callPackage ../development/python-modules/encutils { };
+
   energyflip-client = callPackage ../development/python-modules/energyflip-client { };
 
   energyflow = callPackage ../development/python-modules/energyflow { };
@@ -5194,6 +5196,8 @@ self: super: with self; {
 
   ewmhlib = callPackage ../development/python-modules/ewmhlib { };
 
+  exa-py = callPackage ../development/python-modules/exa-py { };
+
   example-robot-data = callPackage ../development/python-modules/example-robot-data {
     inherit (pkgs) example-robot-data;
   };