diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index 65e3d7ae270b..cc4ec42afe15 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -154,6 +154,8 @@
 
 - Plugins for the JetBrains IDEs have been removed from Nixpkgs.
 
+- `spacetimedb` has been updated from 1.12.0 to [2.0.3](https://github.com/clockworklabs/SpacetimeDB/releases/tag/v2.0.3). Breaking changes and migration notes from 1.0 to 2.0 can be found [here](https://spacetimedb.com/docs/upgrade/).
+
 - `jetbrains.plugins.addPlugins` no longer supports plugin names or ID strings.
   You can still use `addPlugins` with plugin derivations, such as plugins packaged outside of Nixpkgs.
 
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index e43dc3a2e38d..53f01c93aa9e 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -10125,6 +10125,12 @@
     githubId = 28863828;
     name = "guserav";
   };
+  gustlik501 = {
+    email = "sevcnikar.gregor2@gmail.com";
+    github = "Gustlik501";
+    githubId = 36334538;
+    name = "Gustlik501";
+  };
   guttermonk = {
     github = "guttermonk";
     githubId = 4753752;
@@ -19935,6 +19941,11 @@
     githubId = 7397786;
     name = "Odysseas Georgoudis";
   };
+  oenu = {
+    github = "oenu";
+    githubId = 51684443;
+    name = "Adam Newton-Blows";
+  };
   ofalvai = {
     email = "ofalvai@gmail.com";
     github = "ofalvai";
@@ -25420,6 +25431,12 @@
     github = "spectre256";
     githubId = 72505298;
   };
+  Sped0n = {
+    name = "Ryan Wen";
+    email = "hi@sped0n.com";
+    github = "Sped0n";
+    githubId = 197479310;
+  };
   spencerjanssen = {
     email = "spencerjanssen@gmail.com";
     matrix = "@sjanssen:matrix.org";
diff --git a/nixos/modules/services/web-servers/nginx/default.nix b/nixos/modules/services/web-servers/nginx/default.nix
index e557ee92f7a7..6be3703d91da 100644
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -202,7 +202,11 @@ let
 
             ssl_protocols ${cfg.sslProtocols};
             ${optionalString (cfg.sslCiphers != null) "ssl_ciphers ${cfg.sslCiphers};"}
-            ${optionalString (cfg.sslDhparam != null) "ssl_dhparam ${cfg.sslDhparam};"}
+            ${optionalString (cfg.sslDhparam != false)
+              "ssl_dhparam ${
+                if cfg.sslDhparam == true then config.security.dhparams.params.nginx.path else cfg.sslDhparam
+              };"
+            }
 
             ${optionalString cfg.recommendedTlsSettings ''
               # Consider https://ssl-config.mozilla.org/#server=nginx&config=intermediate as the lower bound
@@ -978,10 +982,10 @@ in
       };
 
       sslDhparam = mkOption {
-        type = types.nullOr types.path;
-        default = null;
+        type = types.either types.path types.bool;
+        default = false;
         example = "/path/to/dhparams.pem";
-        description = "Path to DH parameters file.";
+        description = "Path to DH parameters file, or `true` to generate with `security.dhparms.params.nginx`.";
       };
 
       proxyResolveWhileRunning = mkOption {
@@ -1653,6 +1657,8 @@ in
       in
       listToAttrs acmePairs;
 
+    security.dhparams.params.nginx = lib.mkIf (cfg.sslDhparam == true) { };
+
     users.users = optionalAttrs (cfg.user == "nginx") {
       nginx = {
         group = cfg.group;
diff --git a/pkgs/applications/editors/vscode/extensions/nomicfoundation.hardhat-solidity/default.nix b/pkgs/applications/editors/vscode/extensions/nomicfoundation.hardhat-solidity/default.nix
index 8437955ff8c8..f0b48aae3b8c 100644
--- a/pkgs/applications/editors/vscode/extensions/nomicfoundation.hardhat-solidity/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/nomicfoundation.hardhat-solidity/default.nix
@@ -4,8 +4,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "hardhat-solidity";
     publisher = "nomicfoundation";
-    version = "0.8.26";
-    hash = "sha256-AXiGdUjoFl0R41bRJeGc1Gqs/O6foDwqiH2MmkKxhdo=";
+    version = "0.8.28";
+    hash = "sha256-IKJ0d/Da0haRmtR5r/bKvDNkDV58cDdARuPGoJ2mUqI=";
   };
 
   meta = {
diff --git a/pkgs/applications/editors/vscode/update-vscode.sh b/pkgs/applications/editors/vscode/update-vscode.sh
index c092ae92c86f..ea9ecc5d8359 100755
--- a/pkgs/applications/editors/vscode/update-vscode.sh
+++ b/pkgs/applications/editors/vscode/update-vscode.sh
@@ -13,7 +13,7 @@ if [[ -n "$version" ]]; then
   latestVersion="$version"
 else
   latestVersion=$(curl --fail --silent https://api.github.com/repos/Microsoft/vscode/releases | jq --raw-output 'map(select(.prerelease==false)) | .[].tag_name' | sort -V | tail -n1)
-  if ! [[ "$latestVersion" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+  if ! [[ "$latestVersion" =~ ^[0-9]+\.[0-9]+(\.[0-9]+)?$ ]]; then
     echo "Error: Invalid version from GitHub API: $latestVersion"
     exit 1
   fi
diff --git a/pkgs/applications/editors/vscode/vscode.nix b/pkgs/applications/editors/vscode/vscode.nix
index 02424724f631..ad8d71d371b6 100644
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@@ -17,7 +17,6 @@
   commandLineArgs ? "",
   useVSCodeRipgrep ? stdenv.hostPlatform.isDarwin,
 }:
-
 let
   inherit (stdenv.hostPlatform) system;
   throwSystem = throw "Unsupported system: ${system}";
@@ -36,20 +35,25 @@ let
 
   hash =
     {
-      x86_64-linux = "sha256-cBYBA8DdpQ9lGjfuJ6ZammSmk4c0zxoLzUnYNhK9sac=";
-      x86_64-darwin = "sha256-84PnRIUTfsf4T36GkgNaeaKAcz0Ul/BsP6Sd93G/F2g=";
-      aarch64-linux = "sha256-nncqNGnODOgu66jp7ok/spblLSl0iZ1lPJqrkSDncIA=";
-      aarch64-darwin = "sha256-ckwFJ4P2hCy7TTUS+peUNad00ydk4RnAthkggrbYzAQ=";
-      armv7l-linux = "sha256-I5Phy1eY+oYAVBklvtUldkYbmgJUYCBr7hAGIxnNTvA=";
+      x86_64-linux = "sha256-3s0UzfkufKXXm57JgKaMan/SRAlGTLmdIRXXpzxQvAo=";
+      x86_64-darwin = "sha256-1+1Lin4KH3BiriA6m0TJlVG4m9Xl+PyE5cJFborOATM=";
+      aarch64-linux = "sha256-p68lztb+e8OMXtyaqXDdElhuhmv4Og7R+tdRXG85DnU=";
+      aarch64-darwin = "sha256-DUjT+vqjct8WMiRecltPcL+Jn78DfnuyGTMWhaGVcRY=";
+      armv7l-linux = "sha256-70WqRdVnx4zTY5eUFrxz4MiREXNSvahuINcu/9VNkZU=";
     }
     .${system} or throwSystem;
 
   # Please backport all compatible updates to the stable release.
   # This is important for the extension ecosystem.
-  version = "1.109.5";
+  version = "1.111.0";
+
+  # The update server (update.code.visualstudio.com) expects the version path
+  # segment in X.Y.Z form, so we normalize X.Y to X.Y.0 (e.g. "1.110" → "1.110.0").
+  # Upstream GitHub release tags may use X.Y, which is why this normalization is needed.
+  downloadVersion = lib.versions.pad 3 version;
 
   # This is used for VS Code - Remote SSH test
-  rev = "072586267e68ece9a47aa43f8c108e0dcbf44622";
+  rev = "ce099c1ed25d9eb3076c11e4a280f3eb52b4fbeb";
 in
 buildVscode {
   pname = "vscode" + lib.optionalString isInsiders "-insiders";
@@ -66,8 +70,8 @@ buildVscode {
     ;
 
   src = fetchurl {
-    name = "VSCode_${version}_${plat}.${archive_fmt}";
-    url = "https://update.code.visualstudio.com/${version}/${plat}/stable";
+    name = "VSCode_${downloadVersion}_${plat}.${archive_fmt}";
+    url = "https://update.code.visualstudio.com/${downloadVersion}/${plat}/stable";
     inherit hash;
   };
 
@@ -82,7 +86,7 @@ buildVscode {
     src = fetchurl {
       name = "vscode-server-${rev}.tar.gz";
       url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-      hash = "sha256-E9Oruk0rwp1TcJ0QXwBoNMStJYmhzvXXkY0SA8bQv3Y=";
+      hash = "sha256-0fEyS5/FtUBVE6J8NGghKITtIq6Yykyi5Vt8S20INP8=";
     };
     stdenv = stdenvNoCC;
   };
@@ -117,6 +121,7 @@ buildVscode {
       johnrtitor
       jefflabonte
       wetrustinprize
+      oenu
     ];
     platforms = [
       "x86_64-linux"
diff --git a/pkgs/applications/misc/electrum/default.nix b/pkgs/applications/misc/electrum/default.nix
index 3bde96adaf13..805e4b5bb948 100644
--- a/pkgs/applications/misc/electrum/default.nix
+++ b/pkgs/applications/misc/electrum/default.nix
@@ -23,12 +23,12 @@ let
 in
 python3.pkgs.buildPythonApplication rec {
   pname = "electrum";
-  version = "4.7.0";
+  version = "4.7.1";
   pyproject = true;
 
   src = fetchurl {
     url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz";
-    hash = "sha256-1bC437EJWECmO+lmZVXbL2WQwxEIynlVmRJyEfsYLO8=";
+    hash = "sha256-kKxjMhfjF1wVYDiEZ6t9PgAyFQLuUeS+2lZulEv2BR8=";
   };
 
   build-system = with python3.pkgs; [
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 9eef994c5f2e..7d23164cbc2b 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -128,13 +128,13 @@
     "vendorHash": "sha256-/dOiXO2aPkuZaFiwv/6AXJdIADgx8T7eOwvJfBBoqg8="
   },
   "buildkite_buildkite": {
-    "hash": "sha256-kQ0uFyRdhZYNVTd1YdzyZZVdQrZVpnZeYeThhiML5ng=",
+    "hash": "sha256-0FtTYHRWUJk2c/4f8bvF8mU1L7L8rFK6YyKqSX6EHFg=",
     "homepage": "https://registry.terraform.io/providers/buildkite/buildkite",
     "owner": "buildkite",
     "repo": "terraform-provider-buildkite",
-    "rev": "v1.31.1",
+    "rev": "v1.31.2",
     "spdx": "MIT",
-    "vendorHash": "sha256-XyM6C5OL/xRJ2oVhANQQBmm2eT0Pj5RrEqe7ld2un70="
+    "vendorHash": "sha256-fRDthgXec+AdKDx0n2/8msa78bd1cUSDPx7VJ+UP8oI="
   },
   "camptocamp_pass": {
     "hash": "sha256-GQ2g7VyK+eeBqW3LMR4U0gMYsvQnG3y+KEKKkvnmfsk=",
@@ -328,11 +328,11 @@
     "vendorHash": "sha256-fP6brpY/wRI1Yjgapzi+FfOci65gxWeOZulXbGdilrE="
   },
   "dnsimple_dnsimple": {
-    "hash": "sha256-zPvHTSmptdm5w28rpgmwrYBIo+0Y077wZ+FNKbKHaT4=",
+    "hash": "sha256-pbc7jLhIm+ogcpCBhi4CVsr2qM5vDzH0QuP3+cEVYLw=",
     "homepage": "https://registry.terraform.io/providers/dnsimple/dnsimple",
     "owner": "dnsimple",
     "repo": "terraform-provider-dnsimple",
-    "rev": "v2.0.0",
+    "rev": "v2.0.1",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-DRMbcAR+DDrxrg1jNgnoWUg+OjlKm7wkqgIN6Hhkp3U="
   },
diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index fa8e35be7153..6671d40e752b 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -438,14 +438,14 @@ in
 
   docker_29 =
     let
-      version = "29.2.1";
+      version = "29.3.0";
     in
     callPackage dockerGen {
       inherit version;
       cliRev = "v${version}";
-      cliHash = "sha256-9foA1MThtq1sQnwki+cxPuU1dZbukOgdMg99Z1EElxk=";
+      cliHash = "sha256-h4GyKwAbeF5y971iH4zRmfnvx/PxbttPBWc12u5IYvQ=";
       mobyRev = "docker-v${version}";
-      mobyHash = "sha256-LN/IVgKdBwpTR2fUq2Syi6zWP4YN7DQS4bfJVk8Agtg=";
+      mobyHash = "sha256-CYkZ9geZPQdWMqFc3MOT9aA0GVBtsoRVzxZU801DKlA=";
       runcRev = "v1.3.4";
       runcHash = "sha256-1IfY08sBoDpbLrwz1AKBRSTuCZyOgQzYPHTDUI6fOZ8=";
       containerdRev = "v2.2.1";
diff --git a/pkgs/build-support/teleport/default.nix b/pkgs/build-support/teleport/default.nix
index c1b180f13966..1dfeb063abe3 100644
--- a/pkgs/build-support/teleport/default.nix
+++ b/pkgs/build-support/teleport/default.nix
@@ -10,7 +10,7 @@
   nodejs,
   openssl,
   pkg-config,
-  pnpm_10,
+  pnpm_10_29_2,
   fetchPnpmDeps,
   pnpmConfigHook,
   rustc,
@@ -81,7 +81,7 @@ let
         pname
         version
         ;
-      pnpm = pnpm_10;
+      pnpm = pnpm_10_29_2;
       fetcherVersion = 2;
       hash = pnpmHash;
     };
@@ -91,7 +91,7 @@ let
       cargo
       nodejs
       pnpmConfigHook
-      pnpm_10
+      pnpm_10_29_2
       rustc
       rustc.llvmPackages.lld
       rustPlatform.cargoSetupHook
diff --git a/pkgs/by-name/ar/ardour/package.nix b/pkgs/by-name/ar/ardour/package.nix
index 1a2e14771506..22bd1873cdeb 100644
--- a/pkgs/by-name/ar/ardour/package.nix
+++ b/pkgs/by-name/ar/ardour/package.nix
@@ -72,14 +72,14 @@ stdenv.mkDerivation (
   in
   {
     pname = "ardour";
-    version = "9.0";
+    version = "9.2";
 
     # We can't use `fetchFromGitea` here, as attempting to fetch release archives from git.ardour.org
     # result in an empty archive. See https://tracker.ardour.org/view.php?id=7328 for more info.
     src = fetchgit {
       url = "git://git.ardour.org/ardour/ardour.git";
       rev = finalAttrs.version;
-      hash = "sha256-zgWNKYN45qa2xLWnL3W/UWfRVBJN3+hya9dpIZLLJvo=";
+      hash = "sha256-zbEfEuWdhlKtYE0gVB/N0dFrcmNoJqgEMuvQ0wdmRpM=";
     };
 
     bundledContent = fetchzip {
diff --git a/pkgs/by-name/br/browsr/package.nix b/pkgs/by-name/br/browsr/package.nix
index 6a1ab78df485..db45c39c6d68 100644
--- a/pkgs/by-name/br/browsr/package.nix
+++ b/pkgs/by-name/br/browsr/package.nix
@@ -6,7 +6,7 @@
   extras ? [ "all" ],
 }:
 
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "browsr";
   version = "1.22.1";
   pyproject = true;
@@ -14,7 +14,7 @@ python3Packages.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "juftin";
     repo = "browsr";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-eISOADs++ZF62qkWbhFZu6JkEVtTytg3q5nbwS2m+8g=";
   };
 
@@ -46,7 +46,7 @@ python3Packages.buildPythonApplication rec {
       textual
       textual-universal-directorytree
     ]
-    ++ lib.attrVals extras optional-dependencies;
+    ++ lib.attrVals extras finalAttrs.passthru.optional-dependencies;
 
   optional-dependencies = with python3Packages; {
     all = [
@@ -77,6 +77,7 @@ python3Packages.buildPythonApplication rec {
     "rich-pixels"
     "rich"
     "textual"
+    "universal-pathlib"
   ];
 
   pythonImportsCheck = [
@@ -95,8 +96,8 @@ python3Packages.buildPythonApplication rec {
     description = "File explorer in your terminal";
     mainProgram = "browsr";
     homepage = "https://juftin.com/browsr";
-    changelog = "https://github.com/juftin/browsr/releases/tag/v${version}";
+    changelog = "https://github.com/juftin/browsr/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/by-name/ch/chatgpt/source.nix b/pkgs/by-name/ch/chatgpt/source.nix
index ee7a715de7fc..30fe580a11f0 100644
--- a/pkgs/by-name/ch/chatgpt/source.nix
+++ b/pkgs/by-name/ch/chatgpt/source.nix
@@ -1,7 +1,7 @@
 {
-  version = "1.2025.203";
+  version = "1.2026.048";
   src = {
-    url = "https://persistent.oaistatic.com/sidekick/public/ChatGPT_Desktop_public_1.2025.203_1753492939.dmg";
-    hash = "sha256-m+KvDXcNz4M6MhgOGwsTGytXzAuC6WKd/Dr+3PESQtg=";
+    url = "https://persistent.oaistatic.com/sidekick/public/ChatGPT_Desktop_public_1.2026.048_1771630681.dmg";
+    hash = "sha256-6V3H0sA9dlLa/FygZrOO9FqjSVsVgkdH1ZAYLdbET9U=";
   };
 }
diff --git a/pkgs/by-name/co/commitizen/package.nix b/pkgs/by-name/co/commitizen/package.nix
index b910a8af7a29..9bbdda3ad1bd 100644
--- a/pkgs/by-name/co/commitizen/package.nix
+++ b/pkgs/by-name/co/commitizen/package.nix
@@ -12,14 +12,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "commitizen";
-  version = "4.13.8";
+  version = "4.13.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "commitizen-tools";
     repo = "commitizen";
     tag = "v${version}";
-    hash = "sha256-xRje/iCXeUJSmt1qdQ8cOTC8vqJSW8XFIIkplgzMpCo=";
+    hash = "sha256-bT154qRnZCf3StYs+acv4Be/SUCA5ovGjY/j2EDmUEc=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/cw/cwal/package.nix b/pkgs/by-name/cw/cwal/package.nix
new file mode 100644
index 000000000000..0536cb7fb978
--- /dev/null
+++ b/pkgs/by-name/cw/cwal/package.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  imagemagick,
+  libimagequant,
+  lua,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "cwal";
+  version = "0.4.1";
+
+  src = fetchFromGitHub {
+    owner = "nitinbhat972";
+    repo = "cwal";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-H7liUw/KUT8U0KxBbUFvfu+L1vD7CbGw0cjbwjwwKrY=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    imagemagick
+    libimagequant
+    lua
+  ];
+
+  meta = {
+    description = "Blazing-fast pywal-like color palette generator written in C";
+    homepage = "https://github.com/nitinbhat972/cwal";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "cwal";
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ gustlik501 ];
+  };
+})
diff --git a/pkgs/by-name/da/davmail/package.nix b/pkgs/by-name/da/davmail/package.nix
index 4f84ba6f1ab6..45ab61b1649c 100644
--- a/pkgs/by-name/da/davmail/package.nix
+++ b/pkgs/by-name/da/davmail/package.nix
@@ -12,24 +12,22 @@
   libxtst,
   coreutils,
   gnugrep,
-  zulu,
   preferGtk3 ? true,
-  preferZulu ? true,
 }:
 
 let
-  jre' = (if preferZulu then zulu else jdk).override { enableJavaFX = true; };
+  jre' = jdk.override { enableJavaFX = true; };
   gtk' = if preferGtk3 then gtk3 else gtk2;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "davmail";
-  version = "6.4.0";
+  version = "6.5.1";
 
   src = fetchFromGitHub {
     owner = "mguessan";
     repo = "davmail";
     tag = finalAttrs.version;
-    hash = "sha256-dj+7e0b8GcyoDzEWGG1SEMijqRBo1IJUFtgxkt9XNRU=";
+    hash = "sha256-D/MEWq696PFXlarQZdSrTS9VFODg7u7yhUsbCwHV9qs=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/di/diun/package.nix b/pkgs/by-name/di/diun/package.nix
new file mode 100644
index 000000000000..8a492b58ecbf
--- /dev/null
+++ b/pkgs/by-name/di/diun/package.nix
@@ -0,0 +1,67 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+}:
+buildGoModule (finalAttrs: {
+  pname = "diun";
+  version = "4.31.0";
+
+  src = fetchFromGitHub {
+    owner = "crazy-max";
+    repo = "diun";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-H05yZSH2rUrwM+ZR/PDCxXmrDkZ/Gd4RrpywGk5eW2A=";
+  };
+  vendorHash = null;
+
+  # upstream disable CGO in release build
+  # https://github.com/crazy-max/diun/blob/76c0fe99212adc58d6a3433bbcde1ffa9fb879c4/Dockerfile#L11
+  env.CGO_ENABLED = false;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X"
+    "main.version=${finalAttrs.version}"
+  ];
+
+  checkFlags =
+    let
+      # these tests require a network connection
+      skippedTests = [
+        "TestTags"
+        "TestTagsWithDigest"
+        "TestCompareDigest"
+        "TestManifest"
+        "TestManifestMultiUpdatedPlatform"
+        "TestManifestMultiNotUpdatedPlatform"
+        "TestManifestVariant"
+        "TestManifestTaggedDigest"
+        "TestManifestTaggedDigestUnknownTag"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+
+  postInstall = ''
+    mv $out/bin/cmd $out/bin/diun
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "CLI application to receive notifications when a Docker image is updated on a Docker registry";
+    homepage = "https://crazymax.dev/diun";
+    changelog = "https://crazymax.dev/diun/changelog";
+    license = lib.licenses.mit;
+    mainProgram = "diun";
+    maintainers = with lib.maintainers; [ Sped0n ];
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/e-/e-search/package.nix b/pkgs/by-name/e-/e-search/package.nix
index 951cc856cb65..4973b63580db 100644
--- a/pkgs/by-name/e-/e-search/package.nix
+++ b/pkgs/by-name/e-/e-search/package.nix
@@ -9,7 +9,7 @@
   gobject-introspection,
   makeWrapper,
   nodejs_20,
-  pnpm_10,
+  pnpm_10_29_2,
   fetchPnpmDeps,
   pnpmConfigHook,
   electron,
@@ -37,7 +37,7 @@
 }:
 
 let
-  pnpm' = pnpm_10.override { nodejs = nodejs_20; };
+  pnpm' = pnpm_10_29_2.override { nodejs = nodejs_20; };
   eSearch-OCR-ch = fetchzip {
     url = "https://github.com/xushengfeng/eSearch-OCR/releases/download/4.0.0/ch.zip";
     hash = "sha256-0NCXuy8k9/AdpK4ie49S8032u37gNhX6Jc6bOGufrV4=";
diff --git a/pkgs/by-name/fe/feishin/package.nix b/pkgs/by-name/fe/feishin/package.nix
index 0b319f7449c9..1433abc515ea 100644
--- a/pkgs/by-name/fe/feishin/package.nix
+++ b/pkgs/by-name/fe/feishin/package.nix
@@ -8,7 +8,7 @@
   mpv-unwrapped,
   fetchPnpmDeps,
   pnpmConfigHook,
-  pnpm,
+  pnpm_10_29_2,
   darwin,
   copyDesktopItems,
   makeDesktopItem,
@@ -41,6 +41,7 @@ buildNpmPackage {
       version
       src
       ;
+    pnpm = pnpm_10_29_2;
     fetcherVersion = 3;
     hash = "sha256-LeoOksMWZjhVkEjTn5sS2xuX3QxGX8O7iC/3suVwiug=";
   };
@@ -48,7 +49,7 @@ buildNpmPackage {
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
   nativeBuildInputs = [
-    pnpm
+    pnpm_10_29_2
   ]
   ++ lib.optionals (stdenv.hostPlatform.isLinux) [ copyDesktopItems ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.autoSignDarwinBinariesHook ];
diff --git a/pkgs/by-name/fi/filebrowser/package.nix b/pkgs/by-name/fi/filebrowser/package.nix
index 78cee393db85..496adbf26209 100644
--- a/pkgs/by-name/fi/filebrowser/package.nix
+++ b/pkgs/by-name/fi/filebrowser/package.nix
@@ -12,13 +12,13 @@
 }:
 
 let
-  version = "2.57.1";
+  version = "2.61.2";
 
   src = fetchFromGitHub {
     owner = "filebrowser";
     repo = "filebrowser";
     rev = "v${version}";
-    hash = "sha256-rd/I5M1SoL6fUNkiv/KwWImbtWCoy0/DR993C714xU8=";
+    hash = "sha256-/8bBYRzWJ00FpcLMB8M6hkyMUEM/0PM8jsvR+m7jfpc=";
   };
 
   frontend = buildNpmPackage rec {
@@ -41,7 +41,7 @@ let
         ;
       fetcherVersion = 3;
       pnpm = pnpm_10;
-      hash = "sha256-AfQNSIiTRv+aEGsrRAymwpUO2IWDtvSruLuuTAjWy/0=";
+      hash = "sha256-2e3Gr5/pdOsT3cSTdOz5mAjZaWB1C3qGDikpoa5BoII=";
     };
 
     installPhase = ''
@@ -59,7 +59,7 @@ buildGoModule {
   pname = "filebrowser";
   inherit version src;
 
-  vendorHash = "sha256-P6R+lBmzYYMqC5D6VwLOE7UnKuYcLN7UDVkZHWLLjMk=";
+  vendorHash = "sha256-aY3OIr0Kbno38Y/PZ03JK5wCCD4HRdnznJ3OaaH/WVA=";
 
   excludedPackages = [ "tools" ];
 
diff --git a/pkgs/by-name/fl/fladder/git-hashes.json b/pkgs/by-name/fl/fladder/git-hashes.json
new file mode 100644
index 000000000000..dd101c41ff60
--- /dev/null
+++ b/pkgs/by-name/fl/fladder/git-hashes.json
@@ -0,0 +1,10 @@
+{
+  "media_kit": "sha256-wQ5HOztwfJRymo+GzgTgHcRS/rzJfZcvBul5teSf/h8=",
+  "media_kit_libs_android_video": "sha256-wQ5HOztwfJRymo+GzgTgHcRS/rzJfZcvBul5teSf/h8=",
+  "media_kit_libs_ios_video": "sha256-wQ5HOztwfJRymo+GzgTgHcRS/rzJfZcvBul5teSf/h8=",
+  "media_kit_libs_linux": "sha256-wQ5HOztwfJRymo+GzgTgHcRS/rzJfZcvBul5teSf/h8=",
+  "media_kit_libs_macos_video": "sha256-wQ5HOztwfJRymo+GzgTgHcRS/rzJfZcvBul5teSf/h8=",
+  "media_kit_libs_video": "sha256-wQ5HOztwfJRymo+GzgTgHcRS/rzJfZcvBul5teSf/h8=",
+  "media_kit_libs_windows_video": "sha256-wQ5HOztwfJRymo+GzgTgHcRS/rzJfZcvBul5teSf/h8=",
+  "media_kit_video": "sha256-wQ5HOztwfJRymo+GzgTgHcRS/rzJfZcvBul5teSf/h8="
+}
diff --git a/pkgs/by-name/fl/fladder/package.nix b/pkgs/by-name/fl/fladder/package.nix
index e987af6a1c47..6d0c5fb6aaf4 100644
--- a/pkgs/by-name/fl/fladder/package.nix
+++ b/pkgs/by-name/fl/fladder/package.nix
@@ -18,35 +18,24 @@
 
 let
   flutter = flutter335;
-
-  media_kit_hash = "sha256-oJQ9sRQI4HpAIzoS995yfnzvx5ZzIubVANzbmxTt6LE=";
 in
 
 flutter.buildFlutterApplication (finalAttrs: {
   pname = "fladder";
-  version = "0.10.1";
+  version = "0.10.2";
 
   src = fetchFromGitHub {
     owner = "DonutWare";
     repo = "Fladder";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lmtEgBxCmEYcckhSAXhMPDzNQBluTyW0yjkt6Rr9byA=";
+    hash = "sha256-D2FFIBRWi66TRB4LkUWZu/jc+edVXo70FZDzGFh11Wk=";
   };
 
   inherit targetFlutterPlatform;
 
   pubspecLock = lib.importJSON ./pubspec.lock.json;
 
-  gitHashes = {
-    media_kit = media_kit_hash;
-    media_kit_video = media_kit_hash;
-    media_kit_libs_linux = media_kit_hash;
-    media_kit_libs_video = media_kit_hash;
-    media_kit_libs_android_video = media_kit_hash;
-    media_kit_libs_ios_video = media_kit_hash;
-    media_kit_libs_macos_video = media_kit_hash;
-    media_kit_libs_windows_video = media_kit_hash;
-  };
+  gitHashes = lib.importJSON ./git-hashes.json;
 
   nativeBuildInputs = lib.optionals (targetFlutterPlatform == "linux") [
     copyDesktopItems
diff --git a/pkgs/by-name/fl/fladder/pubspec.lock.json b/pkgs/by-name/fl/fladder/pubspec.lock.json
index cf883febfb8a..ccddce04be62 100644
--- a/pkgs/by-name/fl/fladder/pubspec.lock.json
+++ b/pkgs/by-name/fl/fladder/pubspec.lock.json
@@ -54,11 +54,11 @@
       "dependency": "direct main",
       "description": {
         "name": "archive",
-        "sha256": "a96e8b390886ee8abb49b7bd3ac8df6f451c621619f52a26e815fdcf568959ff",
+        "sha256": "2fde1607386ab523f7a36bb3e7edb43bd58e6edaf2ffb29d8a6d578b297fdbbd",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.0.9"
+      "version": "4.0.7"
     },
     "args": {
       "dependency": "transitive",
@@ -124,11 +124,11 @@
       "dependency": "direct main",
       "description": {
         "name": "auto_route",
-        "sha256": "6d3ccc11b520b6eff0ab5a2c3d1c43c46d1486249cc746c4bb14486d876e8b43",
+        "sha256": "4916e0fe1cb782e315d0e1ebdd34170f1836a8f6e24cb528083671302b486ace",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "10.3.0"
+      "version": "10.2.2"
     },
     "auto_route_generator": {
       "dependency": "direct dev",
@@ -154,11 +154,11 @@
       "dependency": "direct main",
       "description": {
         "name": "background_downloader",
-        "sha256": "2ea5322fe836c0aaf96aefd29ef1936771c71927f687cf18168dcc119666a45f",
+        "sha256": "a913b37cc47a656a225e9562b69576000d516f705482f392e2663500e6ff6032",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "9.5.2"
+      "version": "9.3.0"
     },
     "boolean_selector": {
       "dependency": "transitive",
@@ -254,11 +254,11 @@
       "dependency": "transitive",
       "description": {
         "name": "built_value",
-        "sha256": "6ae8a6435a8c6520c7077b107e77f1fb4ba7009633259a4d49a8afd8e7efc5e9",
+        "sha256": "a30f0a0e38671e89a492c44d005b5545b830a961575bbd8336d42869ff71066d",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.12.4"
+      "version": "8.12.0"
     },
     "cached_network_image": {
       "dependency": "direct main",
@@ -294,11 +294,11 @@
       "dependency": "transitive",
       "description": {
         "name": "characters",
-        "sha256": "faf38497bda5ead2a8c7615f4f7939df04333478bf32e4173fcb06d428b5716b",
+        "sha256": "f71061c654a3380576a52b451dd5532377954cf9dbd272a78fc8479606670803",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.4.1"
+      "version": "1.4.0"
     },
     "charcode": {
       "dependency": "transitive",
@@ -394,11 +394,11 @@
       "dependency": "transitive",
       "description": {
         "name": "code_builder",
-        "sha256": "6a6cab2ba4680d6423f34a9b972a4c9a94ebe1b62ecec4e1a1f2cba91fd1319d",
+        "sha256": "11654819532ba94c34de52ff5feb52bd81cba1de00ef2ed622fd50295f9d4243",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.11.1"
+      "version": "4.11.0"
     },
     "collection": {
       "dependency": "direct main",
@@ -444,11 +444,11 @@
       "dependency": "transitive",
       "description": {
         "name": "cross_file",
-        "sha256": "28bb3ae56f117b5aec029d702a90f57d285cd975c3c5c281eaca38dbc47c5937",
+        "sha256": "942a4791cd385a68ccb3b32c71c427aba508a1bb949b86dff2adbe4049f16239",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.3.5+2"
+      "version": "0.3.5"
     },
     "crypto": {
       "dependency": "transitive",
@@ -554,11 +554,11 @@
       "dependency": "transitive",
       "description": {
         "name": "dbus",
-        "sha256": "d0c98dcd4f5169878b6cf8f6e0a52403a9dff371a3e2f019697accbf6f44a270",
+        "sha256": "79e0c23480ff85dc68de79e2cd6334add97e48f7f4865d17686dd6ea81a47e8c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.7.12"
+      "version": "0.7.11"
     },
     "decimal": {
       "dependency": "transitive",
@@ -644,11 +644,11 @@
       "dependency": "direct main",
       "description": {
         "name": "drift_sync",
-        "sha256": "2ddb41cfe92a0d644ec2cb9cd25a6273bf0940693dddb9411c2c350f5f1cdb3f",
+        "sha256": "f358c39bdfa474c020ddd6022ef91540d30b21ef0faab6be331f1e0349e585e5",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.14.1"
+      "version": "0.14.0"
     },
     "dynamic_color": {
       "dependency": "direct main",
@@ -664,11 +664,11 @@
       "dependency": "transitive",
       "description": {
         "name": "equatable",
-        "sha256": "3e0141505477fd8ad55d6eb4e7776d3fe8430be8e497ccb1521370c3f21a3e2b",
+        "sha256": "567c64b3cb4cf82397aac55f4f0cbd3ca20d77c6c03bedbc4ceaddc08904aef7",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.0.8"
+      "version": "2.0.7"
     },
     "extended_image": {
       "dependency": "direct main",
@@ -704,11 +704,11 @@
       "dependency": "transitive",
       "description": {
         "name": "ffi",
-        "sha256": "6d7fd89431262d8f3125e81b50d3847a091d846eafcd4fdb88dd06f36d705a45",
+        "sha256": "289279317b4b16eb2bb7e271abccd4bf84ec9bdcbe999e278a94b804f5630418",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.2.0"
+      "version": "2.1.4"
     },
     "file": {
       "dependency": "transitive",
@@ -724,11 +724,11 @@
       "dependency": "direct main",
       "description": {
         "name": "file_picker",
-        "sha256": "57d9a1dd5063f85fa3107fb42d1faffda52fdc948cefd5fe5ea85267a5fc7343",
+        "sha256": "f8f4ea435f791ab1f817b4e338ed958cb3d04ba43d6736ffc39958d950754967",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "10.3.10"
+      "version": "10.3.6"
     },
     "fixnum": {
       "dependency": "transitive",
@@ -780,51 +780,51 @@
       "dependency": "direct main",
       "description": {
         "name": "flutter_custom_tabs",
-        "sha256": "8c3d92b074a8109f1dc76333c5ff8f87ea5896c118264c4b6b6e7d880058e820",
+        "sha256": "ac3543d7b4e0ac6ecdf3744360039ebb573656c0ce759149d228e1934d4f7535",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.5.0"
+      "version": "2.4.0"
     },
     "flutter_custom_tabs_android": {
       "dependency": "transitive",
       "description": {
         "name": "flutter_custom_tabs_android",
-        "sha256": "84e6b856fae8ca347bf47156f2106aac5671441fd6b3c531d1b793d22d29dece",
+        "sha256": "925fc5e7d27372ee523962dcfcd4b77c0443549482c284dd7897b77815547621",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.0"
+      "version": "2.3.1"
     },
     "flutter_custom_tabs_ios": {
       "dependency": "transitive",
       "description": {
         "name": "flutter_custom_tabs_ios",
-        "sha256": "5f8bbfedad7ff60da4875d888085c05b1d0fd90acbfa4a624ae71b78c5cc6e37",
+        "sha256": "c61a58d30b29ccb09ea4da0daa335bbf8714bcf8798d0d9f4f58a0b83c6c421b",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.5.0"
+      "version": "2.4.0"
     },
     "flutter_custom_tabs_platform_interface": {
       "dependency": "transitive",
       "description": {
         "name": "flutter_custom_tabs_platform_interface",
-        "sha256": "2b66c541f3ca87fbf3e63808dbd41b28cb76f512acce5940f2468b33abe69031",
+        "sha256": "54a6ff5cc7571cb266a47ade9f6f89d1980b9ed2dba18162a6d5300afc408449",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.0"
+      "version": "2.3.0"
     },
     "flutter_custom_tabs_web": {
       "dependency": "transitive",
       "description": {
         "name": "flutter_custom_tabs_web",
-        "sha256": "d606b231859c79679c78dbf05293528a543e3e067c2893a3a5bed1ab9a8300bb",
+        "sha256": "236e035c73b6d3ef0a2f85cd8b6b815954e7559c9f9d50a15ed2e53a297b58b0",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.0"
+      "version": "2.3.0"
     },
     "flutter_highlight": {
       "dependency": "transitive",
@@ -966,11 +966,11 @@
       "dependency": "transitive",
       "description": {
         "name": "flutter_plugin_android_lifecycle",
-        "sha256": "ee8068e0e1cd16c4a82714119918efdeed33b3ba7772c54b5d094ab53f9b7fd1",
+        "sha256": "306f0596590e077338312f38837f595c04f28d6cdeeac392d3d74df2f0003687",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.0.33"
+      "version": "2.0.32"
     },
     "flutter_riverpod": {
       "dependency": "direct main",
@@ -1016,11 +1016,11 @@
       "dependency": "direct main",
       "description": {
         "name": "flutter_svg",
-        "sha256": "87fbd7c534435b6c5d9d98b01e1fd527812b82e68ddd8bd35fc45ed0fa8f0a95",
+        "sha256": "055de8921be7b8e8b98a233c7a5ef84b3a6fcc32f46f1ebf5b9bb3576d108355",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.2.3"
+      "version": "2.2.2"
     },
     "flutter_test": {
       "dependency": "direct dev",
@@ -1108,11 +1108,11 @@
       "dependency": "direct main",
       "description": {
         "name": "fvp",
-        "sha256": "e03c4ba02c367cde8610c09325d085c9b1efe4f7d98a563950993a1fee17a28b",
+        "sha256": "33e34a78d3e4bd3ab87af7279d7bc88ff6025291574edc7e8592abea91e04cb4",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.35.2"
+      "version": "0.35.0"
     },
     "fwfh_cached_network_image": {
       "dependency": "transitive",
@@ -1328,11 +1328,11 @@
       "dependency": "direct main",
       "description": {
         "name": "image",
-        "sha256": "f9881ff4998044947ec38d098bc7c8316ae1186fa786eddffdb867b9bc94dfce",
+        "sha256": "4e973fcf4caae1a4be2fa0a13157aa38a8f9cb049db6529aa00b4d71abc4d928",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.8.0"
+      "version": "4.5.4"
     },
     "intl": {
       "dependency": "direct main",
@@ -1358,11 +1358,11 @@
       "dependency": "transitive",
       "description": {
         "name": "js",
-        "sha256": "53385261521cc4a0c4658fd0ad07a7d14591cf8fc33abbceae306ddb974888dc",
+        "sha256": "f2c445dce49627136094980615a031419f7f3eb393237e4ecd97ac15dea343f3",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.7.2"
+      "version": "0.6.7"
     },
     "json_annotation": {
       "dependency": "direct main",
@@ -1458,11 +1458,11 @@
       "dependency": "transitive",
       "description": {
         "name": "lints",
-        "sha256": "12f842a479589fea194fe5c5a3095abc7be0c1f2ddfa9a0e76aed1dbd26a87df",
+        "sha256": "a5e2b223cb7c9c8efdc663ef484fdd95bb243bff242ef5b13e26883547fce9a0",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.1.0"
+      "version": "6.0.0"
     },
     "local_auth": {
       "dependency": "direct main",
@@ -1528,11 +1528,11 @@
       "dependency": "direct main",
       "description": {
         "name": "macos_window_utils",
-        "sha256": "cb918e1ff0b31fdaa5cd8631eded7c24bd72e1025cf1f95c819e483f0057c652",
+        "sha256": "d4df3501fd32ac0d2d7590cb6a8e4758337d061c8fa0db816fdd636be63a8438",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.9.1"
+      "version": "1.9.0"
     },
     "markdown": {
       "dependency": "transitive",
@@ -1558,21 +1558,21 @@
       "dependency": "transitive",
       "description": {
         "name": "matcher",
-        "sha256": "12956d0ad8390bbcc63ca2e1469c0619946ccb52809807067a7020d57e647aa6",
+        "sha256": "dc58c723c3c24bf8d3e2d3ad3f2f9d7bd9cf43ec6feaa64181775e60190153f2",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.12.18"
+      "version": "0.12.17"
     },
     "material_color_utilities": {
       "dependency": "transitive",
       "description": {
         "name": "material_color_utilities",
-        "sha256": "9c337007e82b1889149c82ed242ed1cb24a66044e30979c44912381e9be4c48b",
+        "sha256": "f7142bb1154231d7ea5f96bc7bde4bda2a0945d2806bb11670e30b850d56bdec",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.13.0"
+      "version": "0.11.1"
     },
     "media_kit": {
       "dependency": "direct main",
@@ -1666,11 +1666,11 @@
       "dependency": "transitive",
       "description": {
         "name": "meta",
-        "sha256": "23f08335362185a5ea2ad3a4e597f1375e78bce8a040df5c600c8d3552ef2394",
+        "sha256": "e3641ec5d63ebf0d9b41bd43201a66e3fc79a65db5f61fc181f04cd27aab950c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.17.0"
+      "version": "1.16.0"
     },
     "mime": {
       "dependency": "transitive",
@@ -1806,21 +1806,21 @@
       "dependency": "transitive",
       "description": {
         "name": "path_provider_android",
-        "sha256": "f2c65e21139ce2c3dad46922be8272bb5963516045659e71bb16e151c93b580e",
+        "sha256": "95c68a74d3cab950fd0ed8073d9fab15c1c06eb1f3eec68676e87aabc9ecee5a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.2.22"
+      "version": "2.2.21"
     },
     "path_provider_foundation": {
       "dependency": "transitive",
       "description": {
         "name": "path_provider_foundation",
-        "sha256": "6d13aece7b3f5c5a9731eaf553ff9dcbc2eff41087fd2df587fd0fed9a3eb0c4",
+        "sha256": "97390a0719146c7c3e71b6866c34f1cde92685933165c1c671984390d2aca776",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.5.1"
+      "version": "2.4.4"
     },
     "path_provider_linux": {
       "dependency": "transitive",
@@ -1916,11 +1916,11 @@
       "dependency": "transitive",
       "description": {
         "name": "petitparser",
-        "sha256": "91bd59303e9f769f108f8df05e371341b15d59e995e6806aefab827b58336675",
+        "sha256": "1a97266a94f7350d30ae522c0af07890c70b8e62c71e8e3920d1db4d23c057d1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "7.0.2"
+      "version": "7.0.1"
     },
     "pigeon": {
       "dependency": "direct dev",
@@ -2012,6 +2012,16 @@
       "source": "hosted",
       "version": "6.0.3"
     },
+    "pretty_qr_code": {
+      "dependency": "direct main",
+      "description": {
+        "name": "pretty_qr_code",
+        "sha256": "474f8a4512113fba06f14a6ec9bbf42353b4e651d7a520e3096f2a9b6bbe7a8a",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.6.0"
+    },
     "protobuf": {
       "dependency": "transitive",
       "description": {
@@ -2062,15 +2072,25 @@
       "source": "hosted",
       "version": "0.2.2"
     },
+    "qr": {
+      "dependency": "transitive",
+      "description": {
+        "name": "qr",
+        "sha256": "5a1d2586170e172b8a8c8470bbbffd5eb0cd38a66c0d77155ea138d3af3a4445",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.0.2"
+    },
     "qs_dart": {
       "dependency": "transitive",
       "description": {
         "name": "qs_dart",
-        "sha256": "0e46bec269e1c32befc20c6e7b809186f7463c98b16e685b11dc5a98bc14b8c8",
+        "sha256": "27da57e8b394163f96b74bccb6eb6115bfd2585de4b9ad6241bdf1a9797ab54f",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.7.0"
+      "version": "1.6.0"
     },
     "rational": {
       "dependency": "transitive",
@@ -2096,11 +2116,11 @@
       "dependency": "direct main",
       "description": {
         "name": "reorderable_grid",
-        "sha256": "15873d8afa6c0a106f0e165f4fbb2bb92dbfe18837e0c9f5d62ac4e26448863d",
+        "sha256": "c7d2e1f2e032a8fffe121f9da828546ee58db35c9c7d19d7a2d189dea2f9939d",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.0.13"
+      "version": "1.0.12"
     },
     "riverpod": {
       "dependency": "transitive",
@@ -2156,11 +2176,11 @@
       "dependency": "transitive",
       "description": {
         "name": "safe_local_storage",
-        "sha256": "287ea1f667c0b93cdc127dccc707158e2d81ee59fba0459c31a0c7da4d09c755",
+        "sha256": "e9a21b6fec7a8aa62cc2585ff4c1b127df42f3185adbd2aca66b47abe2e80236",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.0.3"
+      "version": "2.0.1"
     },
     "screen_brightness": {
       "dependency": "direct main",
@@ -2316,21 +2336,21 @@
       "dependency": "direct main",
       "description": {
         "name": "shared_preferences",
-        "sha256": "2939ae520c9024cb197fc20dee269cd8cdbf564c8b5746374ec6cacdc5169e64",
+        "sha256": "6e8bf70b7fef813df4e9a36f658ac46d107db4b4cfe1048b477d4e453a8159f5",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.5.4"
+      "version": "2.5.3"
     },
     "shared_preferences_android": {
       "dependency": "transitive",
       "description": {
         "name": "shared_preferences_android",
-        "sha256": "cbc40be9be1c5af4dab4d6e0de4d5d3729e6f3d65b89d21e1815d57705644a6f",
+        "sha256": "07d552dbe8e71ed720e5205e760438ff4ecfb76ec3b32ea664350e2ca4b0c43b",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.20"
+      "version": "2.4.16"
     },
     "shared_preferences_foundation": {
       "dependency": "transitive",
@@ -2452,11 +2472,11 @@
       "dependency": "transitive",
       "description": {
         "name": "source_span",
-        "sha256": "56a02f1f4cd1a2d96303c0144c93bd6d909eea6bee6bf5a0e0b685edbd4c47ab",
+        "sha256": "254ee5351d6cb365c859e20ee823c3bb479bf4a293c22d17a9f1bf144ce86f7c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.10.2"
+      "version": "1.10.1"
     },
     "sqflite": {
       "dependency": "transitive",
@@ -2522,11 +2542,11 @@
       "dependency": "transitive",
       "description": {
         "name": "sqlite3_flutter_libs",
-        "sha256": "1e800ebe7f85a80a66adacaa6febe4d5f4d8b75f244e9838a27cb2ffc7aec08d",
+        "sha256": "69c80d812ef2500202ebd22002cbfc1b6565e9ff56b2f971e757fac5d42294df",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.5.41"
+      "version": "0.5.40"
     },
     "sqlparser": {
       "dependency": "transitive",
@@ -2642,11 +2662,11 @@
       "dependency": "transitive",
       "description": {
         "name": "test_api",
-        "sha256": "93167629bfc610f71560ab9312acdda4959de4df6fac7492c89ff0d3886f6636",
+        "sha256": "522f00f556e73044315fa4585ec3270f1808a4b186c936e612cab0b565ff1e00",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.7.9"
+      "version": "0.7.6"
     },
     "timezone": {
       "dependency": "transitive",
@@ -2732,11 +2752,11 @@
       "dependency": "transitive",
       "description": {
         "name": "uri_parser",
-        "sha256": "051c62e5f693de98ca9f130ee707f8916e2266945565926be3ff20659f7853ce",
+        "sha256": "ff4d2c720aca3f4f7d5445e23b11b2d15ef8af5ddce5164643f38ff962dcb270",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.0.2"
+      "version": "3.0.0"
     },
     "url_launcher": {
       "dependency": "direct main",
@@ -2752,11 +2772,11 @@
       "dependency": "transitive",
       "description": {
         "name": "url_launcher_android",
-        "sha256": "767344bf3063897b5cf0db830e94f904528e6dd50a6dfaf839f0abf509009611",
+        "sha256": "dff5e50339bf30b06d7950b50fda58164d3d8c40042b104ed041ddc520fbff28",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.3.28"
+      "version": "6.3.25"
     },
     "url_launcher_ios": {
       "dependency": "transitive",
@@ -2822,11 +2842,11 @@
       "dependency": "transitive",
       "description": {
         "name": "uuid",
-        "sha256": "1fef9e8e11e2991bb773070d4656b7bd5d850967a2456cfc83cf47925ba79489",
+        "sha256": "a11b666489b1954e01d992f3d601b1804a33937b5a8fe677bd26b8a9f96f96e8",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.5.3"
+      "version": "4.5.2"
     },
     "value_layout_builder": {
       "dependency": "transitive",
@@ -2862,11 +2882,11 @@
       "dependency": "transitive",
       "description": {
         "name": "vector_graphics_compiler",
-        "sha256": "5a88dd14c0954a5398af544651c7fb51b457a2a556949bfb25369b210ef73a74",
+        "sha256": "d354a7ec6931e6047785f4db12a1f61ec3d43b207fc0790f863818543f8ff0dc",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.2.0"
+      "version": "1.1.19"
     },
     "vector_math": {
       "dependency": "transitive",
@@ -2892,21 +2912,21 @@
       "dependency": "transitive",
       "description": {
         "name": "video_player_android",
-        "sha256": "9862c67c4661c98f30fe707bc1a4f97d6a0faa76784f485d282668e4651a7ac3",
+        "sha256": "36913f94430b474c4a9033d59b7552b800e736a8521e7166e84895ddcedd0b03",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.9.4"
+      "version": "2.8.19"
     },
     "video_player_avfoundation": {
       "dependency": "transitive",
       "description": {
         "name": "video_player_avfoundation",
-        "sha256": "d1eb970495a76abb35e5fa93ee3c58bd76fb6839e2ddf2fbb636674f2b971dd4",
+        "sha256": "6bced1739cf1f96f03058118adb8ac0dd6f96aa1a1a6e526424ab92fd2a6a77d",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.8.9"
+      "version": "2.8.7"
     },
     "video_player_platform_interface": {
       "dependency": "transitive",
@@ -2972,11 +2992,11 @@
       "dependency": "transitive",
       "description": {
         "name": "watcher",
-        "sha256": "1398c9f081a753f9226febe8900fce8f7d0a67163334e1c94a2438339d79d635",
+        "sha256": "592ab6e2892f67760543fb712ff0177f4ec76c031f02f5b4ff8d3fc5eb9fb61a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.2.1"
+      "version": "1.1.4"
     },
     "weak_map": {
       "dependency": "transitive",
@@ -3022,21 +3042,21 @@
       "dependency": "transitive",
       "description": {
         "name": "webview_flutter",
-        "sha256": "a3da219916aba44947d3a5478b1927876a09781174b5a2b67fa5be0555154bf9",
+        "sha256": "c3e4fe614b1c814950ad07186007eff2f2e5dd2935eba7b9a9a1af8e5885f1ba",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.13.1"
+      "version": "4.13.0"
     },
     "webview_flutter_android": {
       "dependency": "transitive",
       "description": {
         "name": "webview_flutter_android",
-        "sha256": "eeeb3fcd5f0ff9f8446c9f4bbc18a99b809e40297528a3395597d03aafb9f510",
+        "sha256": "f754fec262c5bf826615e8c7f035da1c536ba6ad9b1181936fad900d297cb687",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.10.11"
+      "version": "4.10.6"
     },
     "webview_flutter_platform_interface": {
       "dependency": "transitive",
@@ -3052,11 +3072,11 @@
       "dependency": "transitive",
       "description": {
         "name": "webview_flutter_wkwebview",
-        "sha256": "108bd85d0ff20bff1e8b52a040f5c19b6b9fc4a78fdf3160534ff5a11a82e267",
+        "sha256": "8f4fa32670375f4ce9bfe0f1c773e0857dd191f4e6b3518a1dcdeb7a880bae2e",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.23.7"
+      "version": "3.23.3"
     },
     "win32": {
       "dependency": "transitive",
diff --git a/pkgs/by-name/fl/fladder/update.sh b/pkgs/by-name/fl/fladder/update.sh
index 22d47fd969d0..99db6d75c69e 100755
--- a/pkgs/by-name/fl/fladder/update.sh
+++ b/pkgs/by-name/fl/fladder/update.sh
@@ -1,10 +1,10 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p yq nix bash coreutils nix-update common-updater-scripts ripgrep flutter
+#!nix-shell -i bash -p curl jq yq-go nix bash nix-update common-updater-scripts ripgrep
 
 set -eou pipefail
 
 PACKAGE_DIR="$(realpath "$(dirname "$0")")"
-cd "$PACKAGE_DIR"/..
+cd "$PACKAGE_DIR"
 while ! test -f flake.nix; do cd ..; done
 NIXPKGS_DIR="$PWD"
 
@@ -15,20 +15,15 @@ latestVersion=$(
     tail -n1
 )
 
-currentVersion=$(nix-instantiate --eval -E "with import ./. {}; fladder.version or (lib.getVersion fladder)" | tr -d '"')
+currentVersion=$(nix eval --raw --file . fladder.version)
 
 if [[ "$currentVersion" == "$latestVersion" ]]; then
     echo "package is up-to-date: $currentVersion"
     exit 0
 fi
 
-nix-update --version=$latestVersion fladder
+nix-update --version="$latestVersion" fladder
 
-export HOME="$(mktemp -d)"
-src="$(nix-build --no-link "$NIXPKGS_DIR" -A fladder.src)"
-TMPDIR="$(mktemp -d)"
-cp --recursive --no-preserve=mode "$src"/* $TMPDIR
-cd "$TMPDIR"
-flutter pub get
-yq . pubspec.lock >"$PACKAGE_DIR"/pubspec.lock.json
-rm -rf $TMPDIR
+curl --fail --silent "https://raw.githubusercontent.com/DonutWare/Fladder/v${latestVersion}/pubspec.lock" | yq eval --output-format=json --prettyPrint >"$PACKAGE_DIR"/pubspec.lock.json
+
+$(nix eval --file "$NIXPKGS_DIR" dart.fetchGitHashesScript) --input "$PACKAGE_DIR"/pubspec.lock.json --output "$PACKAGE_DIR"/git-hashes.json
diff --git a/pkgs/by-name/fo/folo/package.nix b/pkgs/by-name/fo/folo/package.nix
index 56385c1c24be..c48cb706ac23 100644
--- a/pkgs/by-name/fo/folo/package.nix
+++ b/pkgs/by-name/fo/folo/package.nix
@@ -6,7 +6,7 @@
   makeDesktopItem,
   makeWrapper,
   nodejs,
-  pnpm_10,
+  pnpm_10_29_2,
   fetchPnpmDeps,
   pnpmConfigHook,
   stdenv,
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     nodejs
     pnpmConfigHook
-    pnpm_10
+    pnpm_10_29_2
     makeWrapper
     imagemagick
   ];
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
       version
       src
       ;
-    pnpm = pnpm_10;
+    pnpm = pnpm_10_29_2;
     fetcherVersion = 3;
     hash = "sha256-EP7bpbJUcKmHm7KMlKc0Fz2u0niQ3jC7YN/9pp7vucE=";
   };
diff --git a/pkgs/by-name/gd/gdu/package.nix b/pkgs/by-name/gd/gdu/package.nix
index 3be16791b295..761ac7cfd41e 100644
--- a/pkgs/by-name/gd/gdu/package.nix
+++ b/pkgs/by-name/gd/gdu/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gdu";
-  version = "5.33.0";
+  version = "5.34.0";
 
   src = fetchFromGitHub {
     owner = "dundee";
     repo = "gdu";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DotSJ7fz70lQH21evxA4Sy4Al7xcWpKtQJM7/Fp0fvY=";
+    hash = "sha256-y3a43CLn76Aq/jCPhrurbZk3wTQOg3t5FmObbTUOidQ=";
   };
 
-  vendorHash = "sha256-cusc2ckY3RJTFYY4swuHhJvl9L5uuWKOWokrk2ylSFo=";
+  vendorHash = "sha256-Dtjirx2sHbN4AWxED5weRGtCRNc2VIdaz7RHssGuJeQ=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/gi/gitify/package.nix b/pkgs/by-name/gi/gitify/package.nix
index 3aab70fbac23..b2ae1005fc07 100644
--- a/pkgs/by-name/gi/gitify/package.nix
+++ b/pkgs/by-name/gi/gitify/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  pnpm_10,
+  pnpm_10_29_2,
   fetchPnpmDeps,
   pnpmConfigHook,
   nodejs,
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     nodejs
     pnpmConfigHook
-    pnpm_10
+    pnpm_10_29_2
     copyDesktopItems
     imagemagick
     makeWrapper
@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
-    pnpm = pnpm_10;
+    pnpm = pnpm_10_29_2;
     fetcherVersion = 2;
     hash = "sha256-uK3CNyPewUVAmqBJq1WMCrNeMP5I18BEBkZIBP0qPsI=";
   };
diff --git a/pkgs/by-name/gl/glab/package.nix b/pkgs/by-name/gl/glab/package.nix
index 89583d0ae6da..fdff2d50f8ce 100644
--- a/pkgs/by-name/gl/glab/package.nix
+++ b/pkgs/by-name/gl/glab/package.nix
@@ -13,13 +13,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "glab";
-  version = "1.86.0";
+  version = "1.89.0";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-udb62BuKhOkI3Llkw9ZaF0Hysz0wYpn64sSXDenaYRY=";
+    hash = "sha256-kc3ievJASceFGwv/c84719FlIKFX90i2H8wG8Yr08io=";
     leaveDotGit = true;
     postFetch = ''
       cd "$out"
@@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-1sO7rTnu91KG8lm4dn8vzibdGiH4qrVR2Y5lOs06R98=";
+  vendorHash = "sha256-eKwYddkcFDmiZbGFJGx53FuyMHeeWYnMfX3WbDWb40w=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/he/heroic-unwrapped/package.nix b/pkgs/by-name/he/heroic-unwrapped/package.nix
index 24bd10a53ad1..4e15de84522e 100644
--- a/pkgs/by-name/he/heroic-unwrapped/package.nix
+++ b/pkgs/by-name/he/heroic-unwrapped/package.nix
@@ -4,7 +4,7 @@
   stdenv,
   fetchFromGitHub,
   # Pinned, because our FODs are not guaranteed to be stable between major versions.
-  pnpm_10,
+  pnpm_10_29_2,
   fetchPnpmDeps,
   pnpmConfigHook,
   nodejs,
@@ -21,7 +21,7 @@
 }:
 
 let
-  pnpm = pnpm_10;
+  pnpm = pnpm_10_29_2;
   electron = electron_39;
 
   legendary = callPackage ./legendary.nix { };
diff --git a/pkgs/by-name/ke/keto/package.nix b/pkgs/by-name/ke/keto/package.nix
index 4913a13a6d28..582bae643c67 100644
--- a/pkgs/by-name/ke/keto/package.nix
+++ b/pkgs/by-name/ke/keto/package.nix
@@ -5,8 +5,8 @@
 }:
 let
   pname = "keto";
-  version = "0.14.0";
-  commit = "613779b6dad89f6fb6b4fa6968f13ede11963c97";
+  version = "25.4.0";
+  commit = "f5635433a56324f266ea414727bf7395bb2da429";
 in
 buildGoModule {
   inherit pname version commit;
@@ -15,10 +15,10 @@ buildGoModule {
     owner = "ory";
     repo = "keto";
     rev = "v${version}";
-    hash = "sha256-DQiE7PvRnOzdRITRl7LgUDmCJO5/aUzbFdEIyiofZfU=";
+    hash = "sha256-2DktCLYOj2azYBAhMVuqfU7QQ+eC3qDLtcp+fPljFAg=";
   };
 
-  vendorHash = "sha256-deQxdG3HZiMzzwTr6moILBSNeNR/3noFlJlIx1eyBZs=";
+  vendorHash = "sha256-+zHvIf3CBMMqKVmQYzMRGQg9iGf9Khnhpgt95lA0BBA=";
 
   tags = [
     "sqlite"
@@ -40,6 +40,9 @@ buildGoModule {
     description = "ORY Keto, the open source access control server";
     homepage = "https://www.ory.sh/keto/";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ mrmebelman ];
+    maintainers = with lib.maintainers; [
+      mrmebelman
+      debtquity
+    ];
   };
 }
diff --git a/pkgs/by-name/ki/kirimoto/package.nix b/pkgs/by-name/ki/kirimoto/package.nix
new file mode 100644
index 000000000000..47f70c734141
--- /dev/null
+++ b/pkgs/by-name/ki/kirimoto/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  appimageTools,
+  fetchurl,
+}:
+
+let
+  version = "4.6.3";
+  pname = "kirimoto";
+
+  src = fetchurl {
+    url = "https://github.com/GridSpace/grid-apps/releases/download/${version}/KiriMoto-linux-x86_64.AppImage";
+    hash = "sha256-YCfDCR92xtwL3634iIMYf6IjkeqoWrF7/YNCwKSjnfs==";
+  };
+
+  appimageContents = appimageTools.extractType2 { inherit pname version src; };
+
+in
+appimageTools.wrapType2 rec {
+  inherit pname version src;
+
+  extraInstallCommands = ''
+    install -Dm444 ${appimageContents}/grid-apps.desktop -t $out/share/applications/
+    install -Dm444 ${appimageContents}/grid-apps.png -t $out/share/icons/hicolor/512x512/apps/
+
+    substituteInPlace $out/share/applications/grid-apps.desktop \
+      --replace-fail 'Exec=AppRun' 'Exec=${meta.mainProgram} --no-sandbox --ozone-platform=x11 --disable-gpu-sandbox --in-process-gpu'
+  '';
+
+  meta = {
+    description = "Open source Slicer for CAM, Laser and 3D-printer";
+    homepage = "https://grid.space/";
+    downloadPage = "https://grid.space/downloads.html";
+    changelog = "https://grid.space/news";
+    license = lib.licenses.mit;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    maintainers = with lib.maintainers; [ FlorisMenninga ];
+    platforms = [ "x86_64-linux" ];
+    mainProgram = "kirimoto";
+  };
+}
diff --git a/pkgs/by-name/la/lazygit/package.nix b/pkgs/by-name/la/lazygit/package.nix
index 7336a31fccf4..8274bb89d241 100644
--- a/pkgs/by-name/la/lazygit/package.nix
+++ b/pkgs/by-name/la/lazygit/package.nix
@@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "lazygit";
-  version = "0.59.0";
+  version = "0.60.0";
 
   src = fetchFromGitHub {
     owner = "jesseduffield";
     repo = "lazygit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DVeWHkyZRzrp0Dl3xx5LMYdUhB94/Bp84mnquF6Fc3g=";
+    hash = "sha256-BTcm3wF0bXIGsheDUv437aGO2TgU+oKXYqfagW0N8DQ=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/le/legcord/package.nix b/pkgs/by-name/le/legcord/package.nix
index 7fe9bea8c55e..7f16dc953abd 100644
--- a/pkgs/by-name/le/legcord/package.nix
+++ b/pkgs/by-name/le/legcord/package.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
   fetchPnpmDeps,
   pnpmConfigHook,
-  pnpm,
+  pnpm_10_29_2,
   nodejs,
   electron,
   makeWrapper,
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     pnpmConfigHook
-    pnpm
+    pnpm_10_29_2
     nodejs
     # we use a script wrapper here for environment variable expansion at runtime
     # https://github.com/NixOS/nixpkgs/issues/172583
@@ -47,6 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
+    pnpm = pnpm_10_29_2;
     fetcherVersion = 3;
     hash = "sha256-MgUOOr188t+t/4sTXVpbr+xYT/1qf7/B0ZG0w+QkVxc=";
   };
diff --git a/pkgs/by-name/li/libtraceevent/package.nix b/pkgs/by-name/li/libtraceevent/package.nix
index 38932b914532..0e4f075a3905 100644
--- a/pkgs/by-name/li/libtraceevent/package.nix
+++ b/pkgs/by-name/li/libtraceevent/package.nix
@@ -15,12 +15,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libtraceevent";
-  version = "1.8.7";
+  version = "1.9";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/libs/libtrace/libtraceevent.git";
     rev = "libtraceevent-${finalAttrs.version}";
-    hash = "sha256-9rDgAHK1m369CGKxC+NEkW7fzOJsgKTQtk9GLfVEoLg=";
+    hash = "sha256-4KuF+UNMWxfxXYVlS0cBY5/p242UQ/NoRRVK+wmn04E=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ma/matrix-authentication-service/package.nix b/pkgs/by-name/ma/matrix-authentication-service/package.nix
index 97fe5df6fdd6..e794f24eb58c 100644
--- a/pkgs/by-name/ma/matrix-authentication-service/package.nix
+++ b/pkgs/by-name/ma/matrix-authentication-service/package.nix
@@ -72,10 +72,26 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail ./share/policy.wasm "$out/share/$pname/policy.wasm"
   '';
 
-  preBuild = ''
-    make -C policies
-    (cd "$npmRoot" && npm run build)
-  '';
+  preBuild =
+    let
+      rustTarget = stdenv.hostPlatform.rust.rustcTarget;
+      rustTargetUnderscore = builtins.replaceStrings [ "-" ] [ "_" ] rustTarget;
+    in
+    ''
+      make -C policies
+      (cd "$npmRoot" && npm run build)
+
+      # Fix aws-lc-sys cross-compilation:
+      # The cc crate looks for "aarch64-linux-gnu-gcc")
+      # when CC is unset and TARGET != HOST, but Nix's cross-compiler is
+      # named "aarch64-unknown-linux-gnu-gcc" (with vendor).
+      # We set the target-specific CC_<target> variable so the cc crate
+      # and aws-lc-sys find the correct cross-compiler, then unset the
+      # generic CC so aws-lc-sys doesn't misassign it.
+      export CC_${rustTargetUnderscore}=$CC
+      export CXX_${rustTargetUnderscore}=$CXX
+      unset CC CXX
+    '';
 
   # Adapted from https://github.com/element-hq/matrix-authentication-service/blob/v0.20.0/.github/workflows/build.yaml#L75-L84
   postInstall = ''
diff --git a/pkgs/by-name/ma/matrix-tuwunel/package.nix b/pkgs/by-name/ma/matrix-tuwunel/package.nix
index 76b72138ce42..5973ee5f0a31 100644
--- a/pkgs/by-name/ma/matrix-tuwunel/package.nix
+++ b/pkgs/by-name/ma/matrix-tuwunel/package.nix
@@ -16,6 +16,7 @@
   enableJemalloc ? true,
   rust-jemalloc-sys,
   enableLiburing ? stdenv.hostPlatform.isLinux,
+  enableLdap ? true,
   liburing,
   nixosTests,
   writeTextFile,
@@ -144,7 +145,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "jemalloc"
     "jemalloc_conf"
   ]
-  ++ lib.optional enableLiburing "io_uring";
+  ++ lib.optional enableLiburing "io_uring"
+  ++ lib.optional enableLdap "ldap";
 
   nativeCheckInputs = [
     libredirect.hook
diff --git a/pkgs/by-name/mi/mistral-vibe/package.nix b/pkgs/by-name/mi/mistral-vibe/package.nix
index dcad705b4937..82d106e5cb0e 100644
--- a/pkgs/by-name/mi/mistral-vibe/package.nix
+++ b/pkgs/by-name/mi/mistral-vibe/package.nix
@@ -12,14 +12,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "mistral-vibe";
-  version = "2.3.0";
+  version = "2.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mistralai";
     repo = "mistral-vibe";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-aXRceZAW4XUAXfD8HzGnS6qkFAj6VoTwVepZJmvf48Q=";
+    hash = "sha256-e5F4NZUQCgEYonQqC62+kWkHRWCJmMv+F2WOu9BRIFk=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/mu/musescore-evolution/package.nix b/pkgs/by-name/mu/musescore-evolution/package.nix
index 2e8ca20d2d02..833ca12c694d 100644
--- a/pkgs/by-name/mu/musescore-evolution/package.nix
+++ b/pkgs/by-name/mu/musescore-evolution/package.nix
@@ -22,21 +22,26 @@
   libopus,
   tinyxml-2,
   qt5, # Needed for musescore 3.X
+  fetchpatch,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "musescore-evolution";
-  version = "3.7.0-unstable-2026-01-12";
+  version = "3.7.0-unstable-2026-03-03";
 
   src = fetchFromGitHub {
     owner = "Jojo-Schmitz";
     repo = "MuseScore";
-    rev = "0b4543baca9b1b70d54cecb33cbf846dabc073d1";
-    hash = "sha256-piOXHKlnfCO1n0kAgeszqa6JVoHgF8B2OF7agpadGKQ=";
+    rev = "67504236fa073783f6616545185ec8bde6c22647";
+    hash = "sha256-QUUvUkdrJ4iL6cgDob+PdVRZp44kzHeoOi2N0Xb51To=";
   };
 
   patches = [
     ./musescore-evolution-pch-fix.patch
+    (fetchpatch {
+      url = "https://github.com/Jojo-Schmitz/MuseScore/commit/bbaa38ba2babb339043f87d50cec3240ca49fe0b.patch";
+      hash = "sha256-TbbrBo4uWCHeAs0Er3eYL+i0JWafI0zhetLpFjN0xg8=";
+    })
   ];
 
   # From top-level CMakeLists.txt:
diff --git a/pkgs/by-name/mu/musescore-evolution/update.sh b/pkgs/by-name/mu/musescore-evolution/update.sh
index 129ae0ef87bb..3449d304edbf 100755
--- a/pkgs/by-name/mu/musescore-evolution/update.sh
+++ b/pkgs/by-name/mu/musescore-evolution/update.sh
@@ -3,24 +3,25 @@
 
 set -euo pipefail
 
+# Fallback to default attribute path if not set
+attr_path="${UPDATE_NIX_ATTR_PATH:-musescore-evolution}"
+
 # Run nix-update on the default branch (updates rev and sha256)
-nix-update musescore-evolution --version=branch
+nix-update $attr_path --version=branch
 
 # Now we need to update the version name
 
 # Find the new version generated from the nix-update command (e.g. "0-unstable-2026-01-12")
-generated_version=$(nix eval --raw -f . ${UPDATE_NIX_ATTR_PATH}.version)
+generated_version=$(nix eval --raw -f . ${attr_path}.version)
 
-# Extract only the date part (after the last dash) (e.g. 0-unstable-2026-01-12)
-parts=(${generated_version//-/ }) # Split up by dashes
-clean_date="${parts[2]}-${parts[3]}-${parts[4]}" # Get clean date in YYYY-MM-DD format (e.g. "2026-01-12")
+# Extract the last ISO date (YYYY-MM-DD) found in the generated version (e.g. 2026-01-12)
+clean_date=$(printf '%s\n' "$generated_version" | grep -oE '[0-9]{4}-[0-9]{2}-[0-9]{2}' | tail -n1 || true)
 
-# Compute version prefix based on previous version
-old_version="$UPDATE_NIX_OLD_VERSION"
-prefix="${old_version%-*}" # e.g. "3.7.0-unstable"
+# Version prefix remains unchanged
+prefix="3.7.0-unstable"
 
-new_version="${prefix}-${clean_date}"
+new_version="${prefix}-${clean_date}" # (e.g. "3.7.0-unstable-2026-01-12")
 
 # Patch version in nix file
 # Strip any existing version line and replace with new one
-sed -i "s/version = \".*\"/version = \"${new_version}\"/" $(nix eval --raw -f . ${UPDATE_NIX_ATTR_PATH}.meta.position | cut -d: -f1)
+sed -i "s/version = \".*\"/version = \"${new_version}\"/" $(nix eval --raw -f . ${attr_path}.meta.position | cut -d: -f1)
diff --git a/pkgs/by-name/ni/nixoscope/package.nix b/pkgs/by-name/ni/nixoscope/package.nix
new file mode 100644
index 000000000000..4280080b4540
--- /dev/null
+++ b/pkgs/by-name/ni/nixoscope/package.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+}:
+python3Packages.buildPythonPackage {
+  pname = "nixoscope";
+  version = "0-unstable-2026-03-05";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "giomf";
+    repo = "nixoscope";
+    rev = "71de2ff0b4c9376db759a05ad58ace87d2b52ccb";
+    hash = "sha256-5yNGtEWlSAfJcy4X8C3dHQ+4Xaawi6aX20C82bfZxG4=";
+  };
+
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  dependencies = with python3Packages; [
+    graphviz
+  ];
+
+  meta = {
+    description = "Visualize dependencies between NixOS modules";
+    homepage = "https://github.com/giomf/NixoScope";
+    license = with lib.licenses; [
+      mit
+    ];
+    maintainers = with lib.maintainers; [
+      giomf
+    ];
+    mainProgram = "nixoscope";
+  };
+}
diff --git a/pkgs/by-name/ni/nixtamal/package.nix b/pkgs/by-name/ni/nixtamal/package.nix
index 46fcd6d3def2..f60cf4b12bc4 100644
--- a/pkgs/by-name/ni/nixtamal/package.nix
+++ b/pkgs/by-name/ni/nixtamal/package.nix
@@ -17,7 +17,7 @@
 
 ocamlPackages.buildDunePackage (finalAttrs: {
   pname = "nixtamal";
-  version = "1.1.3";
+  version = "1.1.4";
   release_year = 2026;
 
   minimalOCamlVersion = "5.3";
@@ -26,7 +26,7 @@ ocamlPackages.buildDunePackage (finalAttrs: {
     url = "https://darcs.toastal.in.th/nixtamal/stable/";
     mirrors = [ "https://smeder.ee/~toastal/nixtamal.darcs" ];
     rev = finalAttrs.version;
-    hash = "sha256-jqPdtgdfQC28QgGPvLkjFMrC470vOAkLGo3EEKCs8hQ=";
+    hash = "sha256-iLjVuNS0pgoWoXp/Yr6ovEazXqhe5bflqtuzFupxmw0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/nu/nushell-plugin-skim/package.nix b/pkgs/by-name/nu/nushell-plugin-skim/package.nix
index e6a439920a06..65f638d99e88 100644
--- a/pkgs/by-name/nu/nushell-plugin-skim/package.nix
+++ b/pkgs/by-name/nu/nushell-plugin-skim/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nu_plugin_skim";
-  version = "0.24.1";
+  version = "0.25.0";
 
   src = fetchFromGitHub {
     owner = "idanarye";
     repo = "nu_plugin_skim";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-a8wC5RowtLiVJXkDr2SDQaaLvK9jjW5x9z/cYCgJMRI=";
+    hash = "sha256-uS6xCefVPnYmNl1MLHOk6WDwHgoJFyRcsmbxoVHvwZg=";
   };
 
-  cargoHash = "sha256-/6dUbz2c0r6oV4NlmkOcu4Awky3fGkf2IkrwBpYg3ZM=";
+  cargoHash = "sha256-bT7RqN102o85Z+g/psz7KVq7ZCaE9Tk5huMxAMAO2J0=";
 
   nativeBuildInputs = lib.optionals stdenv.cc.isClang [ rustPlatform.bindgenHook ];
 
diff --git a/pkgs/by-name/oa/oathkeeper/package.nix b/pkgs/by-name/oa/oathkeeper/package.nix
index 2cba65f26625..65493b2c262e 100644
--- a/pkgs/by-name/oa/oathkeeper/package.nix
+++ b/pkgs/by-name/oa/oathkeeper/package.nix
@@ -5,8 +5,8 @@
 }:
 let
   pname = "oathkeeper";
-  version = "0.40.9";
-  commit = "c75695837f170334b526359f28967aa33d61bce6";
+  version = "25.4.0";
+  commit = "2020997ed914fbc8c4b048effbe28841c34ac23d";
 in
 buildGoModule {
   inherit pname version commit;
@@ -15,10 +15,10 @@ buildGoModule {
     owner = "ory";
     repo = "oathkeeper";
     rev = "v${version}";
-    hash = "sha256-R7xKhKF7mhS/vmSpOj+QDL0OBBWnh42X2Kr3TDQxVIo=";
+    hash = "sha256-J+76oQbm/CulzfJOhXVzlXWNtpl7PaEJPM96p1ko3Cg=";
   };
 
-  vendorHash = "sha256-qETVUpxckZGa41Ll+SZTGcDlImsCvbvGQBcIwuIzSY8=";
+  vendorHash = "sha256-YNpWjDOcjELCpNcxmd8eatMvPUTHos52yvDg4jsHAQk=";
 
   tags = [
     "sqlite"
diff --git a/pkgs/by-name/oc/ocm/package.nix b/pkgs/by-name/oc/ocm/package.nix
index 4222f65ad932..89171250eed4 100644
--- a/pkgs/by-name/oc/ocm/package.nix
+++ b/pkgs/by-name/oc/ocm/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "ocm";
-  version = "1.0.11";
+  version = "1.0.12";
 
   src = fetchFromGitHub {
     owner = "openshift-online";
     repo = "ocm-cli";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-nyfuXgpgQEpiXRIpAxFiNG+ANChwunl19qeibZIse10=";
+    sha256 = "sha256-f5y7debNrMVTjGXyFtCjGnTtV8LuPHnblQ9tmllfsRs=";
   };
 
-  vendorHash = "sha256-4GwmUURR0yUAbTJc6v66JiqmvcDEPs6pVgOzuho//Lk=";
+  vendorHash = "sha256-vlFMN0490J48+koPgB6ezVJyjda+kGWmU+d+rLgVSmg=";
 
   # Strip the final binary.
   ldflags = [
diff --git a/pkgs/by-name/oc/octodns/providers/desec/package.nix b/pkgs/by-name/oc/octodns/providers/desec/package.nix
new file mode 100644
index 000000000000..61c57b140ba9
--- /dev/null
+++ b/pkgs/by-name/oc/octodns/providers/desec/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  octodns,
+  pytestCheckHook,
+  requests,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "octodns-desec";
+  version = "1.3.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "rootshell-labs";
+    repo = "octodns-desec";
+    tag = version;
+    hash = "sha256-tRviqrNkKYWj4a3EWCJEco8AnzFuRkvSCzZ1HrSye/I=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    octodns
+    requests
+  ];
+
+  env.OCTODNS_RELEASE = 1;
+
+  pythonImportsCheck = [ "octodns_desec" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "deSEC DNS provider for octoDNS";
+    homepage = "https://github.com/rootshell-labs/octodns-desec";
+    changelog = "https://github.com/rootshell-labs/octodns-desec/blob/${src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    teams = [ lib.teams.octodns ];
+  };
+}
diff --git a/pkgs/by-name/op/openvscode-server/package.nix b/pkgs/by-name/op/openvscode-server/package.nix
index 6a166a566048..55375fa981ab 100644
--- a/pkgs/by-name/op/openvscode-server/package.nix
+++ b/pkgs/by-name/op/openvscode-server/package.nix
@@ -39,13 +39,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "openvscode-server";
-  version = "1.106.3";
+  version = "1.109.5";
 
   src = fetchFromGitHub {
     owner = "gitpod-io";
     repo = "openvscode-server";
     rev = "openvscode-server-v${finalAttrs.version}";
-    hash = "sha256-wcmk35oqJ6d5MR9YnqC/pR0pC03/vCFCd9KLRByQWqk=";
+    hash = "sha256-FWexstn6pmKPkMuoXOWr4+levM+3FK74q1HLu4kFWTc=";
   };
 
   ## fetchNpmDeps doesn't correctly process git dependencies
@@ -58,7 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
         inherit (finalAttrs) src nativeBuildInputs;
         outputHashMode = "recursive";
         outputHashAlgo = "sha256";
-        outputHash = "sha256-FnlzXlhu72G9dUnezzc62qH2TG5mU9EJNe9akWtR6zg=";
+        outputHash = "sha256-DMjqFMdp7ocGdvMEmrKqB8RhF+BTN/9ybOKQAeuSG/o=";
         env = {
           FORCE_EMPTY_CACHE = true;
           FORCE_GIT_DEPS = true;
diff --git a/pkgs/by-name/or/ory-hydra/package.nix b/pkgs/by-name/or/ory-hydra/package.nix
new file mode 100644
index 000000000000..97b54a394e3d
--- /dev/null
+++ b/pkgs/by-name/or/ory-hydra/package.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+buildGoModule (finalAttrs: {
+  pname = "hydra";
+  version = "25.4.0";
+
+  src = fetchFromGitHub {
+    owner = "ory";
+    repo = "hydra";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-vcbJiwWoq7WA7K5WpD68za1VecNwdzqfyXuPfUpa1QU=";
+  };
+
+  vendorHash = "sha256-ADS1kBqSJXDwmCS4CCfiMvmlzzL39E0G4J2UEKXy2Qs=";
+
+  # `json1` not needed (see: https://github.com/ory/hydra/commit/93edc9ad894771c67f46ae2c57ee7e50382d73cd)
+  # `sqlite_omit_load_extension` consistency with upstream (see: https://github.com/ory/hydra/blob/master/.docker/Dockerfile-local-build#L20C58-L20C84). Will disable sqlite runtime extension loading (see: https://sqlite.org/loadext.html)
+  tags = [
+    "hsm"
+    "sqlite"
+    "sqlite_omit_load_extension"
+  ];
+
+  subPackages = [ "." ];
+
+  ldflags = [
+    "-s"
+    "-X github.com/ory/hydra/v2/driver/config.Version=v${finalAttrs.version}"
+    "-X github.com/ory/hydra/v2/driver/config.Commit=${finalAttrs.src.rev}"
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = [ "version" ];
+
+  meta = {
+    description = "OpenID Certified™ OAuth 2.0 Server and OpenID Connect Provider";
+    homepage = "https://www.ory.com/hydra";
+    changelog = "https://github.com/ory/hydra/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      debtquity
+    ];
+    mainProgram = "hydra";
+  };
+})
diff --git a/pkgs/by-name/or/ory/package.nix b/pkgs/by-name/or/ory/package.nix
index 32b43bbc8c62..be07e3ec9d48 100644
--- a/pkgs/by-name/or/ory/package.nix
+++ b/pkgs/by-name/or/ory/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "ory";
-  version = "0.3.4";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "ory";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-q7+Fpttgx62GbKxCCiEDlX//e/pNO24e7KhhBeGRDH0=";
+    hash = "sha256-WqVcVqdgzlI6OvgLA4OViBsU0DGaTnv5F+Ew58UzQlM=";
   };
 
   nativeBuildInputs = [
@@ -34,12 +34,12 @@ buildGoModule (finalAttrs: {
     "sqlite"
   ];
 
-  vendorHash = "sha256-B0y1JVjJmC5eitn7yIcDpl+9+xaBDJBMdvm+7N/ZxTk=";
-
+  vendorHash = "sha256-W7yi6CSioLnLmOsK7hdB3C96fV7METOe+wzKKMWpphw=";
   postInstall = ''
     mv $out/bin/cli $out/bin/ory
   ''
   + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    export version=v${finalAttrs.version}
     installShellCompletion --cmd ory \
       --bash <($out/bin/ory completion bash) \
       --fish <($out/bin/ory completion fish) \
diff --git a/pkgs/by-name/pe/pear-desktop/package.nix b/pkgs/by-name/pe/pear-desktop/package.nix
index 347ac7a1b02d..6be7ed05d005 100644
--- a/pkgs/by-name/pe/pear-desktop/package.nix
+++ b/pkgs/by-name/pe/pear-desktop/package.nix
@@ -7,7 +7,7 @@
   python3,
   copyDesktopItems,
   nodejs,
-  pnpm_10,
+  pnpm_10_29_2,
   fetchPnpmDeps,
   pnpmConfigHook,
   makeDesktopItem,
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
-    pnpm = pnpm_10;
+    pnpm = pnpm_10_29_2;
     fetcherVersion = 2;
     hash = "sha256-xZQ8rnLGD0ZxxUUPLHmNJ6mA+lnUHCTBvtJTiIPxaZU=";
   };
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
     python3
     nodejs
     pnpmConfigHook
-    pnpm_10
+    pnpm_10_29_2
   ]
   ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ copyDesktopItems ];
 
diff --git a/pkgs/by-name/pg/pgpdump/package.nix b/pkgs/by-name/pg/pgpdump/package.nix
index 8af5a40262ea..d1f7391b0fc8 100644
--- a/pkgs/by-name/pg/pgpdump/package.nix
+++ b/pkgs/by-name/pg/pgpdump/package.nix
@@ -2,31 +2,25 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch2,
   supportCompressedPackets ? true,
   zlib,
   bzip2,
+  autoreconfHook,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pgpdump";
-  version = "0.36";
+  version = "0.37";
 
   src = fetchFromGitHub {
     owner = "kazu-yamamoto";
     repo = "pgpdump";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-JKedgHCTDnvLyLR3nGl4XFAaxXDU1TgHrxPMlRFwtBo=";
+    sha256 = "sha256-nB7f6VTxRidymi9RV7W1x9JbWi9Eoa/CYzYmekYDVOo=";
   };
 
-  patches = [
-    # Fix for GCC 15. Remove on next package update.
-    # https://github.com/kazu-yamamoto/pgpdump/pull/45
-    (fetchpatch2 {
-      name = "fix-c23-compatibility.patch";
-      url = "https://github.com/kazu-yamamoto/pgpdump/commit/541442dc04259bde680b46742522177be40cc065.patch?full_index=1";
-      hash = "sha256-ye+B8hy0etGcwCG9pD0jCnrg+U5VpFkERad61CexW9Y=";
-    })
+  nativeBuildInputs = [
+    autoreconfHook
   ];
 
   buildInputs = lib.optionals supportCompressedPackets [
diff --git a/pkgs/by-name/pi/picoclaw/package.nix b/pkgs/by-name/pi/picoclaw/package.nix
index e67e36479e08..18575c949f6f 100644
--- a/pkgs/by-name/pi/picoclaw/package.nix
+++ b/pkgs/by-name/pi/picoclaw/package.nix
@@ -7,17 +7,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "picoclaw";
-  version = "0.2.0";
+  version = "0.2.1";
 
   src = fetchFromGitHub {
     owner = "sipeed";
     repo = "picoclaw";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zCeURNN152yL3Qi1UFDvSB85xflbLAMzQUTwGThALss=";
+    hash = "sha256-JvcvpaGPPBiABK28rQhe63chYm7MRdfU6uflZosNRKg=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-CsTGC5Ajo9RV6rJPQgnFqA+bQ2TEafI4tt3iXpVwaeY=";
+  vendorHash = "sha256-K9LssS1Hff19dv6oa8EaFOUZIRnOtAqC5jgnY5HuWTk=";
 
   preBuild = ''
     go generate ./...
diff --git a/pkgs/by-name/pl/plantuml/package.nix b/pkgs/by-name/pl/plantuml/package.nix
index 2f11e053304b..e2612cb367c7 100644
--- a/pkgs/by-name/pl/plantuml/package.nix
+++ b/pkgs/by-name/pl/plantuml/package.nix
@@ -11,11 +11,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "plantuml";
-  version = "1.2026.1";
+  version = "1.2026.2";
 
   src = fetchurl {
     url = "https://github.com/plantuml/plantuml/releases/download/v${finalAttrs.version}/plantuml-pdf-${finalAttrs.version}.jar";
-    hash = "sha256-QzZ4N2bSZNPaBzt8pG1q3wM/E/XC3bTAOrmeRHHA2uA=";
+    hash = "sha256-jbQjZrcUh9PTeizylcqb3Q7A4kKZH9ZcaEReymc3lo8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/po/podman-desktop/package.nix b/pkgs/by-name/po/podman-desktop/package.nix
index 3ff7d7425ec6..07c668f7b55c 100644
--- a/pkgs/by-name/po/podman-desktop/package.nix
+++ b/pkgs/by-name/po/podman-desktop/package.nix
@@ -6,7 +6,7 @@
   copyDesktopItems,
   electron_39,
   nodejs,
-  pnpm_10,
+  pnpm_10_29_2,
   fetchPnpmDeps,
   pnpmConfigHook,
   makeDesktopItem,
@@ -64,7 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
-    pnpm = pnpm_10;
+    pnpm = pnpm_10_29_2;
     fetcherVersion = 2;
     hash = "sha256-nBjAmXzjR0qGCM91UAonQKP0NG7+DXImueSbhbnMK/k=";
   };
@@ -81,7 +81,7 @@ stdenv.mkDerivation (finalAttrs: {
     makeBinaryWrapper
     nodejs
     pnpmConfigHook
-    pnpm_10
+    pnpm_10_29_2
   ]
   ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
     copyDesktopItems
diff --git a/pkgs/by-name/pr/prometheus-tailscale-exporter/package.nix b/pkgs/by-name/pr/prometheus-tailscale-exporter/package.nix
index a82c2cba2509..23684a49b1c4 100644
--- a/pkgs/by-name/pr/prometheus-tailscale-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-tailscale-exporter/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "tailscale-exporter";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "adinhodovic";
     repo = "tailscale-exporter";
     tag = finalAttrs.version;
-    hash = "sha256-zZxKTEm23iXv4qYwx6gBtBuz5pduuIXLwMX0ZrrYxZs=";
+    hash = "sha256-1q4csOORVFc1tYoPv6Ll11+xgkPhzUQ/UAJrfLpD87k=";
   };
 
-  vendorHash = "sha256-WHtmis8r62th90BrM+f63yuyRkW4bVT/vPDfcIJ3Fg8=";
+  vendorHash = "sha256-GMaMNEJbSA39DTAXPh5jEy3LC0VzH3UInjnkZIFxT7I=";
 
   subPackages = [
     "cmd/tailscale-exporter"
diff --git a/pkgs/by-name/pr/protonvpn-gui/package.nix b/pkgs/by-name/pr/protonvpn-gui/package.nix
index e3443bf9d661..a08bcb6a5fc5 100644
--- a/pkgs/by-name/pr/protonvpn-gui/package.nix
+++ b/pkgs/by-name/pr/protonvpn-gui/package.nix
@@ -12,14 +12,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "protonvpn-gui";
-  version = "4.14.2";
+  version = "4.15.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "proton-vpn-gtk-app";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-np6uFQn7tlxL8JwUBvBCZIWMRFwvymv88c0+gueqxjk=";
+    hash = "sha256-bKUhrbfOLVjknljwW9UPo3Ros1Ayzb+be5KTUjPnIW0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/qd/qdelay/package.nix b/pkgs/by-name/qd/qdelay/package.nix
index 8eda65088db0..4453316263c7 100644
--- a/pkgs/by-name/qd/qdelay/package.nix
+++ b/pkgs/by-name/qd/qdelay/package.nix
@@ -23,14 +23,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qdelay";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "tiagolr";
     repo = "qdelay";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-hGUZhnA+aix17hTJZ9hE+W+5HEhI9IMYk05avzFaKAg=";
+    hash = "sha256-RKTfKKsPSnraLS6SFKWB/wRPSFqeRpl/DYVKF4BKAYU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/qo/qobuz-player/package.nix b/pkgs/by-name/qo/qobuz-player/package.nix
index c193aaac2216..433d03d51450 100644
--- a/pkgs/by-name/qo/qobuz-player/package.nix
+++ b/pkgs/by-name/qo/qobuz-player/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "qobuz-player";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "SofusA";
     repo = "qobuz-player";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LStCoBr3BblXRpuno+QKxyJstvrNmP+wub61491NkPY=";
+    hash = "sha256-PQhuMGUKKquxZn/Tru8rYapzcoWiZR2Q7q6R+XT2z1s=";
   };
 
-  cargoHash = "sha256-6fUwZkXurjV9yM2Mur0lAkgFxTAEmt92DFKzbPj3Vo4=";
+  cargoHash = "sha256-H2dZJgNTMqLvQ4PMF0JRngTBK4hFF8a/Z/8jAhL7NDM=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ro/rosa/package.nix b/pkgs/by-name/ro/rosa/package.nix
index f5a972992c26..cf3659abc31f 100644
--- a/pkgs/by-name/ro/rosa/package.nix
+++ b/pkgs/by-name/ro/rosa/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "rosa";
-  version = "1.2.60";
+  version = "1.2.61";
 
   src = fetchFromGitHub {
     owner = "openshift";
     repo = "rosa";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-VKaoN91kxfGp9rFmO6VyD4WwmppITirenF1qpASDbDI=";
+    hash = "sha256-tcvNtFM8e2U9C5Nis3RzVJvBh+wvPlLID2MyYjHRdVs=";
   };
   vendorHash = null;
 
diff --git a/pkgs/by-name/sd/sdl3-shadercross/package.nix b/pkgs/by-name/sd/sdl3-shadercross/package.nix
index 03cf32663093..72f8134ca376 100644
--- a/pkgs/by-name/sd/sdl3-shadercross/package.nix
+++ b/pkgs/by-name/sd/sdl3-shadercross/package.nix
@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sdl3-shadercross";
-  version = "0-unstable-2025-12-30";
+  version = "0-unstable-2026-03-01";
 
   outputs = [
     "out"
@@ -24,8 +24,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "libsdl-org";
     repo = "SDL_shadercross";
-    rev = "7b7365a86611b2a7b6462e521cf1c43a037d0970";
-    hash = "sha256-4HAdX2+yqk5a+UfpCdAaF0o0Dxv2PTtxPU7I205KfXk=";
+    rev = "3a314481ede01f5d966f0e834019942e34c02b82";
+    hash = "sha256-ngJymfBU9YzVEHmNpAlkHQ3Q3UDN6OCq/2kuZIHQjcw=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/sh/sharkey/package.nix b/pkgs/by-name/sh/sharkey/package.nix
index 5ed574bb3e29..899c6dc7224e 100644
--- a/pkgs/by-name/sh/sharkey/package.nix
+++ b/pkgs/by-name/sh/sharkey/package.nix
@@ -28,14 +28,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "sharkey";
-  version = "2025.4.4";
+  version = "2025.4.6";
 
   src = fetchFromGitLab {
     domain = "activitypub.software";
     owner = "TransFem-org";
     repo = "Sharkey";
     tag = finalAttrs.version;
-    hash = "sha256-h6FkjwJ+TI5NZmGYOl/+yNP7gyc7FKmpdkfXmgqxh/s=";
+    hash = "sha256-TtwlveTIjzDYpFR+F5c0If6E1D2E5MI9I2IoDIV0u7E=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/si/signal-desktop/package.nix b/pkgs/by-name/si/signal-desktop/package.nix
index c31fc54d4929..20b8145c2c6e 100644
--- a/pkgs/by-name/si/signal-desktop/package.nix
+++ b/pkgs/by-name/si/signal-desktop/package.nix
@@ -2,7 +2,7 @@
   stdenv,
   lib,
   nodejs_24,
-  pnpm_10,
+  pnpm_10_29_2,
   fetchPnpmDeps,
   pnpmConfigHook,
   electron_40,
@@ -25,7 +25,7 @@
 }:
 let
   nodejs = nodejs_24;
-  pnpm = pnpm_10;
+  pnpm = pnpm_10_29_2;
   electron = electron_40;
 
   libsignal-node = callPackage ./libsignal-node.nix { inherit nodejs; };
diff --git a/pkgs/by-name/sp/spacetimedb/package.nix b/pkgs/by-name/sp/spacetimedb/package.nix
index d229cb16ac21..954f9681374c 100644
--- a/pkgs/by-name/sp/spacetimedb/package.nix
+++ b/pkgs/by-name/sp/spacetimedb/package.nix
@@ -15,16 +15,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "spacetimedb";
-  version = "1.12.0";
+  version = "2.0.3";
 
   src = fetchFromGitHub {
     owner = "clockworklabs";
     repo = "spacetimedb";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JuZ9odvMTIOIG4G0M4IBS9I9mWV+dk6qltIgn2a/W9I=";
+    hash = "sha256-QmzuXuFru/yt/32PXVydmLWpH9JnYD+sInorz9AqIMI=";
   };
 
-  cargoHash = "sha256-yAXcTNBITuBm7NPCTiS/RDaxMYgH6mq+ud3VsOELEqE=";
+  cargoHash = "sha256-mUmFkMpJq25lao2B7Ggigx6vd3hg534XTpPJw48Jw5s=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/sp/splayer/package.nix b/pkgs/by-name/sp/splayer/package.nix
index 200b68c320ff..233952567431 100644
--- a/pkgs/by-name/sp/splayer/package.nix
+++ b/pkgs/by-name/sp/splayer/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  pnpm_10,
+  pnpm_10_29_2,
   fetchPnpmDeps,
   pnpmConfigHook,
   nodejs,
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
       version
       src
       ;
-    pnpm = pnpm_10;
+    pnpm = pnpm_10_29_2;
     fetcherVersion = 2;
     hash = "sha256-PTfZopse+9RS7qh0miLu3duYlWDfifZS254tZKqgxKk=";
   };
@@ -53,7 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     pnpmConfigHook
-    pnpm_10
+    pnpm_10_29_2
     nodejs
     rustPlatform.cargoSetupHook
     cargo
diff --git a/pkgs/by-name/sp/spotatui/package.nix b/pkgs/by-name/sp/spotatui/package.nix
index 10774bcd2542..3db3fcf443cf 100644
--- a/pkgs/by-name/sp/spotatui/package.nix
+++ b/pkgs/by-name/sp/spotatui/package.nix
@@ -12,16 +12,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "spotatui";
-  version = "0.37.0";
+  version = "0.37.3";
 
   src = fetchFromGitHub {
     owner = "LargeModGames";
     repo = "spotatui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XAL9MkDtH0wbLV+XMskC5z5DsH9f1xgwQUNXReTHKw8=";
+    hash = "sha256-FRmKkrxMyLmSb1rq7+lFxJ1TqvV5CuI7ZX2PQChWESI=";
   };
 
-  cargoHash = "sha256-7AwvlyAAwCr20hD7h8g0/zh1bxU2hple+nABJZZyGA0=";
+  cargoHash = "sha256-3yxf0othDv5tp85PpLjJBglATbDGgzsMKyOqWjJLuMg=";
 
   nativeBuildInputs = [ pkg-config ] ++ lib.optional withPipewireVisualizer rustPlatform.bindgenHook;
 
diff --git a/pkgs/by-name/sq/sqlitebrowser/macos.patch b/pkgs/by-name/sq/sqlitebrowser/macos.patch
index 6da7d67a0326..e4016f9d8502 100644
--- a/pkgs/by-name/sq/sqlitebrowser/macos.patch
+++ b/pkgs/by-name/sq/sqlitebrowser/macos.patch
@@ -1,17 +1,6 @@
 diff -ru source/CMakeLists.txt source-patched/CMakeLists.txt
 --- source/CMakeLists.txt	1970-01-01 01:00:01.000000000 +0100
 +++ source-patched/CMakeLists.txt	2024-09-03 11:09:48.289053141 +0200
-@@ -39,9 +39,7 @@
- set(CMAKE_AUTOMOC ON)
- set(CMAKE_INCLUDE_CURRENT_DIR ON)
- 
--if(APPLE)
--    add_executable(${PROJECT_NAME} MACOSX_BUNDLE)
--elseif(WIN32)
-+if(WIN32)
-     add_executable(${PROJECT_NAME} WIN32)
- else()
-     add_executable(${PROJECT_NAME})
 @@ -106,33 +104,6 @@
      list(PREPEND CMAKE_PREFIX_PATH ${QT5_PATH} ${SQLITE3_PATH})
  endif()
@@ -60,27 +49,3 @@ diff -ru source/CMakeLists.txt source-patched/CMakeLists.txt
  find_package(${LIBSQLITE_NAME})
  if (sqlcipher)
      target_link_libraries(${PROJECT_NAME} SQLCipher::SQLCipher)
-@@ -510,7 +474,7 @@
-     endif()
- endif()
- 
--if((NOT WIN32 AND NOT APPLE) OR MINGW)
-+if(NOT WIN32 OR MINGW)
-     install(TARGETS ${PROJECT_NAME}
-         RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
-         LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
-@@ -630,14 +594,6 @@
-     )
- endif()
- 
--if(APPLE)
--    set_target_properties(${PROJECT_NAME} PROPERTIES
--        BUNDLE True
--        OUTPUT_NAME "DB Browser for SQLite"
--        MACOSX_BUNDLE_INFO_PLIST ${CMAKE_SOURCE_DIR}/src/app.plist
--    )
--endif()
--
- # CPack configuration
- set(CPACK_STRIP_FILES ON)
- set(CPACK_DEBIAN_PACKAGE_PRIORITY optional)
diff --git a/pkgs/by-name/sq/sqlitebrowser/package.nix b/pkgs/by-name/sq/sqlitebrowser/package.nix
index d11c3b469bd2..b4f18bf67981 100644
--- a/pkgs/by-name/sq/sqlitebrowser/package.nix
+++ b/pkgs/by-name/sq/sqlitebrowser/package.nix
@@ -6,6 +6,7 @@
   pkg-config,
   libsForQt5,
   sqlcipher,
+  nix-update-script,
 }:
 
 let
@@ -28,6 +29,9 @@ stdenv.mkDerivation (finalAttrs: {
   postPatch = ''
     substituteInPlace CMakeLists.txt \
       --replace-fail '"Unknown"' '"${finalAttrs.src.rev}"'
+
+    substituteInPlace src/app.plist \
+      --replace-fail '@ICON@' 'icon.icns'
   ''
   # Fix build with CMake 4
   # Will be part of the Qt6 port
@@ -62,10 +66,22 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeFeature "QSCINTILLA_INCLUDE_DIR" "${lib.getDev qt'.qscintilla}/include")
   ];
 
+  postInstall = lib.optional stdenv.hostPlatform.isDarwin ''
+    # Copy the icon file to the app bundle
+    target="$(find . -name "*.app")"
+    mkdir -p "$target/Contents/Resources/"
+    cp $src/installer/macos/macapp.icns "$target/Contents/Resources/icon.icns"
+
+    mkdir -p $out/Applications
+    cp -r *.app $out/Applications
+  '';
+
   env.LANG = "C.UTF-8";
 
   doCheck = true;
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "DB Browser for SQLite";
     mainProgram = "sqlitebrowser";
diff --git a/pkgs/by-name/te/telegraf/package.nix b/pkgs/by-name/te/telegraf/package.nix
index 3a678b42cec4..96851b60b614 100644
--- a/pkgs/by-name/te/telegraf/package.nix
+++ b/pkgs/by-name/te/telegraf/package.nix
@@ -10,7 +10,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "telegraf";
-  version = "1.37.3";
+  version = "1.38.0";
 
   subPackages = [ "cmd/telegraf" ];
 
@@ -18,10 +18,10 @@ buildGoModule (finalAttrs: {
     owner = "influxdata";
     repo = "telegraf";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-HMmniDwEyM5jciHVGsR4VT1oPlv9ZvxoVZcdQQr99b8=";
+    hash = "sha256-y5SmQ6e0pySB8w34w82jy2bFkXfHsFEJTW2WAoIbPuA=";
   };
 
-  vendorHash = "sha256-kSCJI2tUdwG5JuP+P785zpMnLbkU91GhZ0i9YZNTFxo=";
+  vendorHash = "sha256-2R7hxIprCzpB6iAnZzF7SBiqnGXR9Gy9KmrCkQ3kvso=";
   proxyVendor = true;
 
   ldflags = [
diff --git a/pkgs/by-name/uv/uv/package.nix b/pkgs/by-name/uv/uv/package.nix
index e2369f7fc84d..00c00908f43d 100644
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@@ -18,16 +18,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uv";
-  version = "0.10.8";
+  version = "0.10.9";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     tag = finalAttrs.version;
-    hash = "sha256-kdIzLKdpqEnIo4ca7fAaerF8IRw1UTpn3deMZ/HCbAk=";
+    hash = "sha256-IAbewFab4X21SYqhjfxfWI9LsNSNVMIChbNc3j3EJQA=";
   };
 
-  cargoHash = "sha256-ZIgDdP3O9MI5k6hePo2yMcrVoGVRm9Fno5NVqUbOSWw=";
+  cargoHash = "sha256-LqrHze1MVaWq31Td/EGDeJCG+hRmPOSV1t7+ayQorlA=";
 
   buildInputs = [
     rust-jemalloc-sys
diff --git a/pkgs/by-name/ve/vesktop/package.nix b/pkgs/by-name/ve/vesktop/package.nix
index 02c902c4a8b5..bed9156bf587 100644
--- a/pkgs/by-name/ve/vesktop/package.nix
+++ b/pkgs/by-name/ve/vesktop/package.nix
@@ -13,7 +13,7 @@
   pipewire,
   libpulseaudio,
   autoPatchelfHook,
-  pnpm_10,
+  pnpm_10_29_2,
   fetchPnpmDeps,
   pnpmConfigHook,
   nodejs,
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
       src
       patches
       ;
-    pnpm = pnpm_10;
+    pnpm = pnpm_10_29_2;
     fetcherVersion = 2;
     hash = "sha256-o9dxtqXfCKTQpvNrbD/h0F3Hh39TEEA1qqYA9tN3j5I=";
   };
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     nodejs
     pnpmConfigHook
-    pnpm_10
+    pnpm_10_29_2
     jq
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
diff --git a/pkgs/by-name/vi/vikunja-desktop/package.nix b/pkgs/by-name/vi/vikunja-desktop/package.nix
index e7a0985d9496..658e44a14d11 100644
--- a/pkgs/by-name/vi/vikunja-desktop/package.nix
+++ b/pkgs/by-name/vi/vikunja-desktop/package.nix
@@ -3,7 +3,7 @@
   stdenv,
   makeWrapper,
   makeDesktopItem,
-  pnpm,
+  pnpm_10_29_2,
   pnpmConfigHook,
   nodejs,
   electron,
@@ -39,6 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
       sourceRoot
       pnpmInstallFlags
       ;
+    pnpm = pnpm_10_29_2;
     fetcherVersion = 1;
     hash = "sha256-yiVlEr1gi2g3m+hkYfDv6qd/wRlwwknM6lAaIeR58Ok=";
   };
@@ -50,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     makeWrapper
     nodejs
-    pnpm
+    pnpm_10_29_2
     pnpmConfigHook
     vikunja.passthru.frontend
   ];
diff --git a/pkgs/by-name/vi/vikunja/package.nix b/pkgs/by-name/vi/vikunja/package.nix
index 07e9c5424849..d66f71f8c894 100644
--- a/pkgs/by-name/vi/vikunja/package.nix
+++ b/pkgs/by-name/vi/vikunja/package.nix
@@ -3,7 +3,7 @@
   fetchFromGitHub,
   stdenv,
   nodejs_24,
-  pnpm_10,
+  pnpm_10_29_2,
   fetchPnpmDeps,
   pnpmConfigHook,
   buildGoModule,
@@ -35,7 +35,7 @@ let
         src
         sourceRoot
         ;
-      pnpm = pnpm_10;
+      pnpm = pnpm_10_29_2;
       fetcherVersion = 1;
       hash = "sha256-oY8DXJFFwLBjUno3EithLhmnA8hTksq4xgMSSOGtwuo=";
     };
@@ -44,7 +44,7 @@ let
       nodejs_24
       dart-sass
       pnpmConfigHook
-      pnpm_10
+      pnpm_10_29_2
     ];
 
     doCheck = true;
diff --git a/pkgs/by-name/vo/voicevox/package.nix b/pkgs/by-name/vo/voicevox/package.nix
index be05fd058311..eec83720f5bd 100644
--- a/pkgs/by-name/vo/voicevox/package.nix
+++ b/pkgs/by-name/vo/voicevox/package.nix
@@ -13,7 +13,7 @@
   nodejs,
   fetchPnpmDeps,
   pnpmConfigHook,
-  pnpm,
+  pnpm_10_29_2,
 
   _7zz,
   electron,
@@ -58,6 +58,8 @@ stdenv.mkDerivation (finalAttrs: {
       postPatch
       ;
 
+    pnpm = pnpm_10_29_2;
+
     # let's just be safe and add these explicitly to nativeBuildInputs
     # even though the fetcher already uses them in its implementation
     nativeBuildInputs = [
@@ -76,7 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
     moreutils
     nodejs
     pnpmConfigHook
-    pnpm
+    pnpm_10_29_2
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     copyDesktopItems
diff --git a/pkgs/by-name/wh/wheelwizard/package.nix b/pkgs/by-name/wh/wheelwizard/package.nix
index ee98afc7ead3..c1663a9e5fc5 100644
--- a/pkgs/by-name/wh/wheelwizard/package.nix
+++ b/pkgs/by-name/wh/wheelwizard/package.nix
@@ -14,13 +14,13 @@
 }:
 buildDotnetModule rec {
   pname = "wheelwizard";
-  version = "2.4.0";
+  version = "2.4.1";
 
   src = fetchFromGitHub {
     owner = "TeamWheelWizard";
     repo = "WheelWizard";
     tag = version;
-    hash = "sha256-3qFJ08v9JI7VDSG9Nm0EuWJG8WHVLfpkk8TLYezWV5Y=";
+    hash = "sha256-pxz4aZozpQQB8GgL/D2AgbtCy+cTbd5DNsODoDd2Xa0=";
   };
   postPatch = ''
     rm .config/dotnet-tools.json
diff --git a/pkgs/by-name/zu/zulip/package.nix b/pkgs/by-name/zu/zulip/package.nix
index b52ae9fb3910..34657eefa06b 100644
--- a/pkgs/by-name/zu/zulip/package.nix
+++ b/pkgs/by-name/zu/zulip/package.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
   fetchPnpmDeps,
   nodejs,
-  pnpm_10,
+  pnpm_10_29_2,
   pnpmConfigHook,
   python3,
   electron_39,
@@ -26,14 +26,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
-    pnpm = pnpm_10;
+    pnpm = pnpm_10_29_2;
     fetcherVersion = 3;
     hash = "sha256-s/KllzT46L2o4SWS3z3Z7FDQD6FEEEAnPdM6tsfGRUo=";
   };
 
   nativeBuildInputs = [
     nodejs
-    pnpm_10
+    pnpm_10_29_2
     pnpmConfigHook
     makeBinaryWrapper
     copyDesktopItems
diff --git a/pkgs/development/python-modules/atopile/default.nix b/pkgs/development/python-modules/atopile/default.nix
index 50bdeb18a84a..44509b3b0c0b 100644
--- a/pkgs/development/python-modules/atopile/default.nix
+++ b/pkgs/development/python-modules/atopile/default.nix
@@ -130,6 +130,7 @@ buildPythonPackage (finalAttrs: {
   ];
 
   pythonRelaxDeps = [
+    "deprecated"
     "posthog"
     "prompt-toolkit"
   ];
diff --git a/pkgs/development/python-modules/django-crispy-forms/default.nix b/pkgs/development/python-modules/django-crispy-forms/default.nix
index f46a74e348f6..ad544f5eff1e 100644
--- a/pkgs/development/python-modules/django-crispy-forms/default.nix
+++ b/pkgs/development/python-modules/django-crispy-forms/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "django-crispy-forms";
-  version = "2.5";
+  version = "2.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "django-crispy-forms";
     repo = "django-crispy-forms";
     tag = finalAttrs.version;
-    hash = "sha256-UZw860dOmQOAHcOPn5JO5OPe0kei4Mivy5FTh25Zo1s=";
+    hash = "sha256-yU5xNlV3OFZUdO6zK1sG7mHGkNXLwZocEH8JhvAwyAc=";
   };
 
   propagatedBuildInputs = [
diff --git a/pkgs/development/python-modules/hf-xet/default.nix b/pkgs/development/python-modules/hf-xet/default.nix
index c45fea1311de..d25cf2928dae 100644
--- a/pkgs/development/python-modules/hf-xet/default.nix
+++ b/pkgs/development/python-modules/hf-xet/default.nix
@@ -7,28 +7,28 @@
   openssl,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "hf-xet";
-  version = "1.2.0";
+  version = "1.3.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "xet-core";
-    tag = "v${version}";
-    hash = "sha256-nRxLVCJF3meoVa1mc3jt0hJUFDwfSFl7U/fFLDQL44M=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-IiV+qsUiahJr/MA9oTULSUvFBEw/sw9DyzuGxXHHnoM=";
   };
 
-  sourceRoot = "${src.name}/hf_xet";
+  sourceRoot = "${finalAttrs.src.name}/hf_xet";
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit
+    inherit (finalAttrs)
       pname
       version
       src
       sourceRoot
       ;
-    hash = "sha256-xMfsd7xOghktQu/do7TMmkUx4uTBHPK44XODePluUgc=";
+    hash = "sha256-+uz6bKAV99JmTIWVDXPEq0kPWQGIYL8dV17XN0TP6hY=";
   };
 
   nativeBuildInputs = [
@@ -51,8 +51,8 @@ buildPythonPackage rec {
   meta = {
     description = "Xet client tech, used in huggingface_hub";
     homepage = "https://github.com/huggingface/xet-core/tree/main/hf_xet";
-    changelog = "https://github.com/huggingface/xet-core/releases/tag/v${version}";
+    changelog = "https://github.com/huggingface/xet-core/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ GaetanLepage ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/kicad-python/default.nix b/pkgs/development/python-modules/kicad-python/default.nix
index ad36f17fbe15..7ff7938917c2 100644
--- a/pkgs/development/python-modules/kicad-python/default.nix
+++ b/pkgs/development/python-modules/kicad-python/default.nix
@@ -4,7 +4,7 @@
   fetchFromGitLab,
   poetry-core,
   protoletariat,
-  mypy-protobuf,
+  mypy-protobuf_3_6,
   pkgs,
   protobuf,
   pynng,
@@ -34,13 +34,12 @@ buildPythonPackage (finalAttrs: {
   dependencies = [
     protobuf
     pynng
-    mypy-protobuf
   ]
   ++ (lib.optional (pythonOlder "3.13") typing-extensions);
 
   nativeBuildInputs = [
     pkgs.protobuf
-    mypy-protobuf
+    mypy-protobuf_3_6
     gitMinimal
   ];
 
diff --git a/pkgs/development/python-modules/mypy-protobuf_3_6/default.nix b/pkgs/development/python-modules/mypy-protobuf_3_6/default.nix
new file mode 100644
index 000000000000..d51ab7a1a898
--- /dev/null
+++ b/pkgs/development/python-modules/mypy-protobuf_3_6/default.nix
@@ -0,0 +1,51 @@
+{
+  buildPythonPackage,
+  fetchFromGitHub,
+  grpcio-tools,
+  lib,
+  protobuf,
+  pytestCheckHook,
+  setuptools,
+  types-protobuf,
+  versionCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "mypy-protobuf";
+  version = "3.6.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "nipunn1313";
+    repo = "mypy-protobuf";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-YBm/qfmas0kPmzhlgAwCdT8nsnC45fj2bhK3cXpvANo=";
+  };
+
+  pythonRelaxDeps = [ "protobuf" ];
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    grpcio-tools
+    protobuf
+    types-protobuf
+  ];
+
+  doCheck = false; # ModuleNotFoundError: No module named 'testproto'
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "mypy_protobuf" ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  meta = {
+    changelog = "https://github.com/nipunn1313/mypy-protobuf/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    description = "Generate mypy stub files from protobuf specs";
+    homepage = "https://github.com/nipunn1313/mypy-protobuf";
+    license = lib.licenses.asl20;
+    mainProgram = "protoc-gen-mypy";
+    maintainers = with lib.maintainers; [ sigmanificient ];
+  };
+})
diff --git a/pkgs/development/python-modules/oelint-data/default.nix b/pkgs/development/python-modules/oelint-data/default.nix
index 7e9b34daec37..7150513cbb98 100644
--- a/pkgs/development/python-modules/oelint-data/default.nix
+++ b/pkgs/development/python-modules/oelint-data/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "oelint-data";
-  version = "1.4.4";
+  version = "1.4.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "priv-kweihmann";
     repo = "oelint-data";
     tag = finalAttrs.version;
-    hash = "sha256-gbTbGrTwdHnC0Ydqta0SJP7tujqyz5TCeLJ4tSbkAkU=";
+    hash = "sha256-QEzpNnDcubQnZbGOgJlSZQfQg8rZH0A2SFm3qViFL5c=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/oelint-parser/default.nix b/pkgs/development/python-modules/oelint-parser/default.nix
index 4125fe410959..d2a2800cc0ea 100644
--- a/pkgs/development/python-modules/oelint-parser/default.nix
+++ b/pkgs/development/python-modules/oelint-parser/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "oelint-parser";
-  version = "8.9.0";
+  version = "8.9.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "priv-kweihmann";
     repo = "oelint-parser";
     tag = finalAttrs.version;
-    hash = "sha256-STWfz2qdQPOFWmNZJkgGNBDFAeQwEj+g6pZgLJf++ps=";
+    hash = "sha256-k/8NESePMe70PbqZNaMJu3aPSDMfT1JkixWYBvnmR9I=";
   };
 
   pythonRelaxDeps = [ "regex" ];
diff --git a/pkgs/development/python-modules/posthog/default.nix b/pkgs/development/python-modules/posthog/default.nix
index 593ab78fd07d..50d0c294bf44 100644
--- a/pkgs/development/python-modules/posthog/default.nix
+++ b/pkgs/development/python-modules/posthog/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "posthog";
-  version = "7.9.4";
+  version = "7.9.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PostHog";
     repo = "posthog-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-E6cO6v79Sk0ItR3Je+pw+V4i4gJyRzeQnxIFgRIK1Xs=";
+    hash = "sha256-iVtAQHhl48cR+Rh3voNBDzpalvqL11R9H4uYmw+0Zgc=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/protoletariat/default.nix b/pkgs/development/python-modules/protoletariat/default.nix
index 2187bdbece57..92f5a09ed77c 100644
--- a/pkgs/development/python-modules/protoletariat/default.nix
+++ b/pkgs/development/python-modules/protoletariat/default.nix
@@ -8,7 +8,7 @@
   click,
   pkgs,
   protobuf,
-  mypy-protobuf,
+  mypy-protobuf_3_6,
   pytestCheckHook,
   writableTmpDirAsHomeHook,
 }:
@@ -47,11 +47,10 @@ buildPythonPackage (finalAttrs: {
   nativeCheckInputs = [
     pytestCheckHook
     writableTmpDirAsHomeHook
-    mypy-protobuf
+    mypy-protobuf_3_6
   ];
 
   meta = {
-    broken = true;
     description = "Python protocol buffers for the rest of us";
     changelog = "https://github.com/cpcloud/protoletariat/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = with lib.licenses; [ asl20 ];
diff --git a/pkgs/development/python-modules/proton-vpn-api-core/default.nix b/pkgs/development/python-modules/proton-vpn-api-core/default.nix
index 2b6aec691cde..2a723c203c99 100644
--- a/pkgs/development/python-modules/proton-vpn-api-core/default.nix
+++ b/pkgs/development/python-modules/proton-vpn-api-core/default.nix
@@ -27,14 +27,14 @@
 
 buildPythonPackage rec {
   pname = "proton-vpn-api-core";
-  version = "4.14.3";
+  version = "4.16.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ProtonVPN";
     repo = "python-proton-vpn-api-core";
     rev = "v${version}";
-    hash = "sha256-yWiUiR0us+ISa9cdjfN4IzlbiZEzUlndNFy/BpfHYqk=";
+    hash = "sha256-XYyDEAUQ0fzg2J8NJbYlGqd2vG1cUTyfo9YzPisbWSY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyeconet/default.nix b/pkgs/development/python-modules/pyeconet/default.nix
index 9cfd661f6f0f..12bbc1e6f7a5 100644
--- a/pkgs/development/python-modules/pyeconet/default.nix
+++ b/pkgs/development/python-modules/pyeconet/default.nix
@@ -7,16 +7,16 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pyeconet";
-  version = "0.2.1";
+  version = "0.2.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "w1ll1am23";
     repo = "pyeconet";
-    tag = "v${version}";
-    hash = "sha256-Gep2XGWiaO7IRJ1BouwQ2VrbDPNPZVhiqlGTVWOsQgM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-sQXIMm5ddkqkFgTYOsy9srKxLUy505iFhrtGAbOLzc0=";
   };
 
   build-system = [ setuptools ];
@@ -36,8 +36,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python interface to the EcoNet API";
     homepage = "https://github.com/w1ll1am23/pyeconet";
-    changelog = "https://github.com/w1ll1am23/pyeconet/releases/tag/${src.tag}";
+    changelog = "https://github.com/w1ll1am23/pyeconet/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/pymupdf/default.nix b/pkgs/development/python-modules/pymupdf/default.nix
index 589b57f819a3..29ae26cd4837 100644
--- a/pkgs/development/python-modules/pymupdf/default.nix
+++ b/pkgs/development/python-modules/pymupdf/default.nix
@@ -42,16 +42,16 @@ let
   mupdf-cxx-lib = toPythonModule (lib.getLib mupdf-cxx);
   mupdf-cxx-dev = lib.getDev mupdf-cxx;
 in
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pymupdf";
-  version = "1.26.7";
+  version = "1.27.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pymupdf";
     repo = "PyMuPDF";
-    tag = version;
-    hash = "sha256-7OidTOG3KAx7EaQ3Bu4i1Fw007oXVAipBHeYNkmbIcA=";
+    tag = finalAttrs.version;
+    hash = "sha256-Ebvdkvp0y7seG0sciMMnztflIBVRHh/Cowpw/lSLYLE=";
   };
 
   patches = [
@@ -122,6 +122,7 @@ buildPythonPackage rec {
     "test_codespell"
     "test_pylint"
     "test_flake8"
+    "test_4751"
     # Upstream recommends disabling these when not using bundled MuPDF build
     "test_color_count"
     "test_3050"
@@ -140,6 +141,9 @@ buildPythonPackage rec {
   disabledTestPaths = [
     # mad about markdown table formatting
     "tests/test_tables.py::test_markdown"
+
+    # Do not lint code
+    "tests/test_typing.py"
   ]
   ++ lib.optional stdenv.hostPlatform.isDarwin [
     # Trace/BPT trap: 5 when getting widget options
@@ -164,9 +168,9 @@ buildPythonPackage rec {
   meta = {
     description = "Python bindings for MuPDF's rendering library";
     homepage = "https://github.com/pymupdf/PyMuPDF";
-    changelog = "https://github.com/pymupdf/PyMuPDF/releases/tag/${src.tag}";
+    changelog = "https://github.com/pymupdf/PyMuPDF/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.agpl3Only;
     maintainers = with lib.maintainers; [ sarahec ];
     platforms = lib.platforms.unix;
   };
-}
+})
diff --git a/pkgs/development/python-modules/pymupdf4llm/default.nix b/pkgs/development/python-modules/pymupdf4llm/default.nix
index 695dc03b962e..b93929758c47 100644
--- a/pkgs/development/python-modules/pymupdf4llm/default.nix
+++ b/pkgs/development/python-modules/pymupdf4llm/default.nix
@@ -4,25 +4,29 @@
   fetchFromGitHub,
   setuptools,
   pymupdf,
+  tabulate,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pymupdf4llm";
-  version = "0.2.9";
+  version = "0.3.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pymupdf";
     repo = "RAG";
-    tag = version;
-    hash = "sha256-iuffv49voZLiuabwhag+YC3j3Oa2IAevZtcJtMVzX/4=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-SgJ47jkE6GcSXVsOMOx8Hm+Ce6pCAjLEhdxGeJEu6DQ=";
   };
 
-  sourceRoot = "${src.name}/pymupdf4llm";
+  sourceRoot = "${finalAttrs.src.name}/pymupdf4llm";
 
   build-system = [ setuptools ];
 
-  dependencies = [ pymupdf ];
+  dependencies = [
+    pymupdf
+    tabulate
+  ];
 
   checkPhase = ''
     runHook preCheck
@@ -49,8 +53,8 @@ buildPythonPackage rec {
   meta = {
     description = "PyMuPDF Utilities for LLM/RAG - converts PDF pages to Markdown format for Retrieval-Augmented Generation";
     homepage = "https://github.com/pymupdf/RAG";
-    changelog = "https://github.com/pymupdf/RAG/blob/${src.tag}/CHANGES.md";
+    changelog = "https://github.com/pymupdf/RAG/blob/${finalAttrs.src.tag}/CHANGES.md";
     license = lib.licenses.agpl3Only;
     maintainers = with lib.maintainers; [ ryota2357 ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/python-keystoneclient/default.nix b/pkgs/development/python-modules/python-keystoneclient/default.nix
index e39f57f5c41c..1e0fc4b24283 100644
--- a/pkgs/development/python-modules/python-keystoneclient/default.nix
+++ b/pkgs/development/python-modules/python-keystoneclient/default.nix
@@ -16,13 +16,13 @@
 
 buildPythonPackage rec {
   pname = "python-keystoneclient";
-  version = "5.7.0";
+  version = "5.8.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "python_keystoneclient";
     inherit version;
-    hash = "sha256-jOe/HIzdym1xQPx2kYtE7d8dZAQKYMuP9wWRNhBNTOs=";
+    hash = "sha256-PKh8Z8QEKYzoYjELVp9UWlis91zVaFCUyC81Mgs6NV0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/python-otcextensions/default.nix b/pkgs/development/python-modules/python-otcextensions/default.nix
new file mode 100644
index 000000000000..56b435ffc307
--- /dev/null
+++ b/pkgs/development/python-modules/python-otcextensions/default.nix
@@ -0,0 +1,81 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  mock,
+  openstacksdk,
+  osc-lib,
+  oslo-config,
+  oslo-i18n,
+  oslotest,
+  pbr,
+  prometheus-client,
+  python-novaclient,
+  python-openstackclient,
+  requests-mock,
+  setuptools,
+  stestrCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "python-otcextensions";
+  version = "0.32.29";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "opentelekomcloud";
+    repo = "python-otcextensions";
+    tag = version;
+    hash = "sha256-hqxCnIfVJPnlwree0+kY9iXXjPMoGd06tVT+yT6rex8=";
+  };
+
+  env.PBR_VERSION = version;
+
+  build-system = [
+    pbr
+    setuptools
+  ];
+
+  dependencies = [
+    openstacksdk
+    osc-lib
+    oslo-config
+    oslo-i18n
+    python-novaclient
+    python-openstackclient
+  ];
+
+  nativeCheckInputs = [
+    mock
+    oslotest
+    prometheus-client
+    requests-mock
+    stestrCheckHook
+  ];
+
+  disabledTests = [
+    # Requires networking
+    "otcextensions.tests.unit.test_stats.TestNoStats.test_no_stats"
+    "otcextensions.tests.unit.test_stats.TestStats.test_list_projects"
+    "otcextensions.tests.unit.test_stats.TestStats.test_projects"
+    "otcextensions.tests.unit.test_stats.TestStats.test_servers_error"
+    "otcextensions.tests.unit.test_stats.TestStats.test_servers_no_detail"
+    "otcextensions.tests.unit.test_stats.TestStats.test_sfsturbo_share"
+    "otcextensions.tests.unit.test_stats.TestStats.test_timeout"
+  ];
+
+  pythonImportsCheck = [
+    "otcextensions"
+    "otcextensions.common"
+    "otcextensions.osclient"
+    "otcextensions.sdk"
+  ];
+
+  meta = {
+    description = "OpenStack SDK and client extensions for Open Telekom Cloud services";
+    homepage = "https://github.com/opentelekomcloud/python-otcextensions";
+    changelog = "https://github.com/opentelekomcloud/python-otcextensions/releases/tag/${version}";
+    license = lib.licenses.asl20;
+    teams = [ lib.teams.openstack ];
+  };
+}
diff --git a/pkgs/development/python-modules/pywerview/default.nix b/pkgs/development/python-modules/pywerview/default.nix
index c6ea7e7b7d20..35b6d10f9939 100644
--- a/pkgs/development/python-modules/pywerview/default.nix
+++ b/pkgs/development/python-modules/pywerview/default.nix
@@ -11,16 +11,16 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pywerview";
-  version = "0.7.5";
+  version = "0.7.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "the-useless-one";
     repo = "pywerview";
-    tag = "v${version}";
-    hash = "sha256-wl7/u9Uja/FflO3tN3UyanX2LIRG417RfWdyZCtUtGs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-i4YV6PfcazoW8z2Awbn8ake4qhA/m43UzECqiEO4QLg=";
   };
 
   build-system = [ setuptools ];
@@ -46,9 +46,9 @@ buildPythonPackage rec {
   meta = {
     description = "Module for PowerSploit's PowerView support";
     homepage = "https://github.com/the-useless-one/pywerview";
-    changelog = "https://github.com/the-useless-one/pywerview/releases/tag/${src.tag}";
+    changelog = "https://github.com/the-useless-one/pywerview/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "pywerview";
   };
-}
+})
diff --git a/pkgs/development/python-modules/sphinx-markdown-builder/default.nix b/pkgs/development/python-modules/sphinx-markdown-builder/default.nix
index ca5ea53928cd..900dd28ac63b 100644
--- a/pkgs/development/python-modules/sphinx-markdown-builder/default.nix
+++ b/pkgs/development/python-modules/sphinx-markdown-builder/default.nix
@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   nix-update-script,
-  fetchpatch2,
 
   # build system
   setuptools,
@@ -43,15 +42,6 @@ buildPythonPackage rec {
     hash = "sha256-DTc+yVFOGLXFyrgkwfgY3X60chyU3UDs0GwuPCzff28=";
   };
 
-  patches = [
-    # FIX: tests (remove with the next release)
-    # https://github.com/liran-funaro/sphinx-markdown-builder/issues/32
-    (fetchpatch2 {
-      url = "https://github.com/liran-funaro/sphinx-markdown-builder/commit/967edca036a73f7644251abd52a5da8451a10dd4.patch";
-      hash = "sha256-FGMYzd5k3Q0UvOccCvUSW3y6gor+AUncj2qv38xyOp4=";
-    })
-  ];
-
   build-system = [
     setuptools
     wheel
diff --git a/pkgs/development/python-modules/trimesh/default.nix b/pkgs/development/python-modules/trimesh/default.nix
index b8ecab21278a..f08f1363d7f1 100644
--- a/pkgs/development/python-modules/trimesh/default.nix
+++ b/pkgs/development/python-modules/trimesh/default.nix
@@ -27,14 +27,14 @@
 
 buildPythonPackage rec {
   pname = "trimesh";
-  version = "4.11.2";
+  version = "4.11.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mikedh";
     repo = "trimesh";
     tag = version;
-    hash = "sha256-E78gIZ+lzobEt5xckiCZoA6+FomhSxFjnbjchPLYNio=";
+    hash = "sha256-0GIeCNqNjV7BlhjHxEpdwgdiX+diq4keM2PvjSI1FdM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/txtai/default.nix b/pkgs/development/python-modules/txtai/default.nix
index bb0dc8982c58..2a2dfe4db5f3 100644
--- a/pkgs/development/python-modules/txtai/default.nix
+++ b/pkgs/development/python-modules/txtai/default.nix
@@ -93,7 +93,7 @@
   pytestCheckHook,
 }:
 let
-  version = "9.5.0";
+  version = "9.6.0";
   agent = [
     mcpadapt
     smolagents
@@ -241,7 +241,7 @@ let
     owner = "neuml";
     repo = "txtai";
     tag = "v${version}";
-    hash = "sha256-V/XgFQjw/GLmFx5wseMnYwT5gbUVYIQwek9eVOVqafg=";
+    hash = "sha256-CNq49tZDyD9OY2MPv0Xeg15hdERv83Juq6I7CA1z19o=";
   };
 in
 buildPythonPackage {
diff --git a/pkgs/development/python-modules/wgpu-py/default.nix b/pkgs/development/python-modules/wgpu-py/default.nix
index 72d937d01fc3..2592f6a765bb 100644
--- a/pkgs/development/python-modules/wgpu-py/default.nix
+++ b/pkgs/development/python-modules/wgpu-py/default.nix
@@ -37,16 +37,16 @@
   testers,
   wgpu-py,
 }:
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "wgpu-py";
-  version = "0.29.0";
+  version = "0.31.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pygfx";
     repo = "wgpu-py";
-    tag = "v${version}";
-    hash = "sha256-drXO3NHIuK34tbOZjxOCz1lnlcrfx6mADZ2WlEc9vDU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-qy5tBlmA9mwEkk87WhIa5UxbXYNVFct6CrUWKm3Fy5s=";
   };
 
   postPatch =
@@ -142,10 +142,10 @@ buildPythonPackage rec {
   meta = {
     description = "WebGPU for Python";
     homepage = "https://github.com/pygfx/wgpu-py";
-    changelog = "https://github.com/pygfx/wgpu-py/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/pygfx/wgpu-py/blob/${finalAttrs.src.tag}/CHANGELOG.md";
 
     platforms = lib.platforms.all;
     license = lib.licenses.bsd2;
     maintainers = [ lib.maintainers.bengsparks ];
   };
-}
+})
diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index 448f57e30562..de952551a1a1 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -14,10 +14,17 @@ let
       version = "9.15.9";
       hash = "sha256-z4anrXZEBjldQoam0J1zBxFyCsxtk+nc6ax6xNxKKKc=";
     };
-    "10" = {
+    # 10.29.3 made a breaking change: https://github.com/pnpm/pnpm/issues/10601.
+    # Pnpm packages that depend on electron builder must be upgraded to 26.8.2 or newer
+    # otherwise a runtime error will occur when launching the application.
+    "10_29_2" = {
       version = "10.29.2";
       hash = "sha256-hAL2daH0zJ1PJ7v6s1wtSi4dfrATHfA9rQlhnoZnTQw=";
     };
+    "10" = {
+      version = "10.30.3";
+      hash = "sha256-/wpyFA9qbWbAsoT2yVYK/2BVGOKMKa6sJfsmK3QzFYg=";
+    };
   };
 
   callPnpm = variant: callPackage ./generic.nix { inherit (variant) version hash; };
diff --git a/pkgs/servers/home-assistant/custom-components/powercalc/package.nix b/pkgs/servers/home-assistant/custom-components/powercalc/package.nix
index a343146adc2a..ef61e89e392e 100644
--- a/pkgs/servers/home-assistant/custom-components/powercalc/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/powercalc/package.nix
@@ -17,13 +17,13 @@
 buildHomeAssistantComponent rec {
   owner = "bramstroker";
   domain = "powercalc";
-  version = "1.20.6";
+  version = "1.20.8";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "homeassistant-powercalc";
     tag = "v${version}";
-    hash = "sha256-OOTqek+0CoAPHJugrzhpvOAvNNxZxG/KUjNxfsq71qQ=";
+    hash = "sha256-E23GJOnc54iefgf5Y+purEPH4OrtlNiIs1EkcR2TjHM=";
   };
 
   dependencies = [ numpy ];
diff --git a/pkgs/tools/misc/steampipe-packages/steampipe-plugin-aws/default.nix b/pkgs/tools/misc/steampipe-packages/steampipe-plugin-aws/default.nix
index 80adc8fcc790..8afea81ef3ba 100644
--- a/pkgs/tools/misc/steampipe-packages/steampipe-plugin-aws/default.nix
+++ b/pkgs/tools/misc/steampipe-packages/steampipe-plugin-aws/default.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "steampipe-plugin-aws";
-  version = "1.29.0";
+  version = "1.30.0";
 
   src = fetchFromGitHub {
     owner = "turbot";
     repo = "steampipe-plugin-aws";
     tag = "v${version}";
-    hash = "sha256-tpRiQUdZro0wkGn/XJDlMtOsFNicmgLqb+fI1ozrOf0=";
+    hash = "sha256-SiiiWPSNLp5pVVokrKUvHFFm1qiU4zU/pKfUZyRB8xI=";
   };
 
-  vendorHash = "sha256-ZN1OordavH5BCarEpUxjgsIUvM4PruAeIaNRMYXrmRM=";
+  vendorHash = "sha256-4xHWVbqdEfnB6GIqqeyMg/xc42a1WKbhTgdo0GhA+NU=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b93e1ced5053..c85ac4ed6fb3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3258,6 +3258,7 @@ with pkgs;
   inherit (callPackage ../development/tools/pnpm { })
     pnpm_8
     pnpm_9
+    pnpm_10_29_2
     pnpm_10
     ;
   pnpm = pnpm_10;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 9151d256002d..eff1c6141994 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -10735,6 +10735,8 @@ self: super: with self; {
 
   mypy-protobuf = callPackage ../development/python-modules/mypy-protobuf { };
 
+  mypy-protobuf_3_6 = callPackage ../development/python-modules/mypy-protobuf_3_6 { };
+
   mypyllant = callPackage ../development/python-modules/mypyllant { };
 
   mysql-connector = callPackage ../development/python-modules/mysql-connector { };
@@ -15761,6 +15763,8 @@ self: super: with self; {
 
   python-otbr-api = callPackage ../development/python-modules/python-otbr-api { };
 
+  python-otcextensions = callPackage ../development/python-modules/python-otcextensions { };
+
   python-overseerr = callPackage ../development/python-modules/python-overseerr { };
 
   python-owasp-zap-v2-4 = callPackage ../development/python-modules/python-owasp-zap-v2-4 { };