diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 0c8b968578da..5cfd1ccf8237 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -9218,6 +9218,12 @@
     githubId = 119691;
     name = "Michael Gough";
   };
+  fraioveio = {
+    email = "francesco@vecchia.lol";
+    github = "FraioVeio";
+    githubId = 181361445;
+    name = "Francesco Vecchia";
+  };
   franciscod = {
     github = "franciscod";
     githubId = 726447;
@@ -19066,6 +19072,12 @@
       { fingerprint = "5A1D C7CE 51DC 0A85 6DEA  41F7 31A8 CE0D 2E7D 30C3"; }
     ];
   };
+  naomieow = {
+    name = "Naomi Roberts";
+    email = "mia@naomieow.xyz";
+    github = "naomieow";
+    githubId = 79906167;
+  };
   naora = {
     name = "Joris Gundermann";
     email = "jorisgundermann@gmail.com";
diff --git a/nixos/modules/services/databases/redis.nix b/nixos/modules/services/databases/redis.nix
index d55658bb25b2..b735ffd79e70 100644
--- a/nixos/modules/services/databases/redis.nix
+++ b/nixos/modules/services/databases/redis.nix
@@ -571,7 +571,7 @@ in
       lib.nameValuePair (redisName name) {
         description = "System user for the redis-server instance ${name}";
         isSystemUser = true;
-        group = redisName name;
+        group = conf.group;
       }
     ) (lib.filterAttrs (name: conf: conf.user == redisName name) enabledServers);
     users.groups = lib.mapAttrs' (
diff --git a/nixos/modules/services/home-automation/home-assistant.nix b/nixos/modules/services/home-automation/home-assistant.nix
index 34624c3f8b2d..99858a55bb6e 100644
--- a/nixos/modules/services/home-automation/home-assistant.nix
+++ b/nixos/modules/services/home-automation/home-assistant.nix
@@ -71,7 +71,7 @@ let
   # Filter null values from the configuration, so that we can still advertise
   # optional options in the config attribute.
   filteredConfig = converge (filterAttrsRecursive (_: v: !elem v [ null ])) (
-    recursiveUpdate customLovelaceModulesResources (cfg.config or { })
+    recursiveUpdate (customLovelaceModulesResources // themesConfig) (cfg.config or { })
   );
   configFile = renderYAMLFile "configuration.yaml" filteredConfig;
 
@@ -143,7 +143,7 @@ let
     paths = cfg.customLovelaceModules;
   };
 
-  # Create parts of the lovelace config that reference lovelave modules as resources
+  # Create parts of the lovelace config that reference lovelace modules as resources
   customLovelaceModulesResources = {
     lovelace.resources = map (card: {
       url = "/local/nixos-lovelace-modules/${card.entrypoint or (card.pname + ".js")}?${card.version}";
@@ -151,6 +151,21 @@ let
     }) cfg.customLovelaceModules;
   };
 
+  # Create a directory that holds all lovelace themes
+  themesDir = pkgs.buildEnv {
+    name = "home-assistant-themes";
+    paths = cfg.themes;
+  };
+
+  # Auto-inject frontend.themes include directive when themes are used.
+  themesConfig =
+    if cfg.themes != [ ] then
+      {
+        frontend.themes = "!include_dir_merge_named ${themesDir}/themes";
+      }
+    else
+      { };
+
   componentsUsingBluetooth = [
     # Components that require the AF_BLUETOOTH address family
     "august"
@@ -444,6 +459,33 @@ in
       '';
     };
 
+    themes = mkOption {
+      type = types.listOf (
+        types.addCheck types.package (p: p.isHomeAssistantTheme or false)
+        // {
+          name = "home-assistant-theme";
+          description = "package that is a Home Assistant theme";
+        }
+      );
+      default = [ ];
+      example = literalExpression ''
+        with pkgs.home-assistant-themes; [
+          material-you-theme
+        ];
+      '';
+      description = ''
+        List of themes to load.
+
+        Available themes can be found below `pkgs.home-assistant-themes`.
+
+        ::: {.note}
+        When `themes` is set, the module takes authoritative control
+        over the `frontend.themes` setting in
+        {option}`services.home-assistant.config`.
+        :::
+      '';
+    };
+
     config = mkOption {
       type = types.nullOr (
         types.submodule {
@@ -797,6 +839,10 @@ in
         assertion = !(cfg.lovelaceConfig != null && cfg.lovelaceConfigFile != null);
         message = "Only one of `lovelaceConfig` or `lovelaceConfigFile` can be configured at the same time.";
       }
+      {
+        assertion = cfg.themes != [ ] -> !(hasAttrByPath [ "frontend" "themes" ] (cfg.config or { }));
+        message = "`services.home-assistant.themes` and `services.home-assistant.config.frontend.themes` cannot both be set. When `themes` is non-empty the module sets `frontend.themes` authoritatively.";
+      }
     ];
 
     networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.config.http.server_port ];
@@ -880,6 +926,7 @@ in
               ln -fns "''${paths[@]}" "${cfg.configDir}/custom_components/"
             done
           '';
+
           removeBlueprints = ''
             # remove blueprints symlinked in from below the /nix/store
             readarray -d "" blueprints < <(find "${cfg.configDir}/blueprints" -maxdepth 2 -type l -print0)
diff --git a/nixos/modules/services/web-apps/lasuite-docs.nix b/nixos/modules/services/web-apps/lasuite-docs.nix
index 6e1d39108079..f33853edd25b 100644
--- a/nixos/modules/services/web-apps/lasuite-docs.nix
+++ b/nixos/modules/services/web-apps/lasuite-docs.nix
@@ -17,6 +17,7 @@ let
     types
     optional
     optionalString
+    escapeShellArg
     ;
 
   cfg = config.services.lasuite-docs;
@@ -76,6 +77,20 @@ let
     SystemCallArchitectures = "native";
     UMask = "0077";
   };
+
+  # Convert environment variables to be used as systemd-run arguments
+  envArgs = lib.concatStringsSep " " (
+    lib.mapAttrsToList (name: value: "-E ${escapeShellArg "${name}=${value}"}") pythonEnvironment
+  );
+
+  # Easier usage of django manage.py stuff
+  manage = pkgs.writeShellScriptBin "lasuite-docs-manage" ''
+    exec ${lib.getExe' config.systemd.package "systemd-run"} \
+      -p User=${commonServiceConfig.User} -p DynamicUser=yes \
+      -p StateDirectory=${commonServiceConfig.StateDirectory} --working-directory=${commonServiceConfig.WorkingDirectory} \
+      --quiet --collect --pipe --pty \
+      ${envArgs} ${lib.getExe cfg.backendPackage} "$@"
+  '';
 in
 {
   options.services.lasuite-docs = {
@@ -346,6 +361,7 @@ in
   };
 
   config = mkIf cfg.enable {
+    environment.systemPackages = [ manage ];
     systemd.services.lasuite-docs-postgresql-setup = mkIf cfg.postgresql.createLocally {
       wantedBy = [ "lasuite-docs.target" ];
       requiredBy = [ "lasuite-docs.service" ];
@@ -534,6 +550,10 @@ in
           recommendedProxySettings = true;
         };
 
+        locations."/static/" = {
+          alias = "${cfg.backendPackage}/share/static/";
+        };
+
         locations."/collaboration/ws/" = {
           proxyPass = "http://localhost:${toString cfg.collaborationServer.port}";
           recommendedProxySettings = true;
diff --git a/nixos/tests/home-assistant.nix b/nixos/tests/home-assistant.nix
index bc9c173f04d6..fbed5250c7ec 100644
--- a/nixos/tests/home-assistant.nix
+++ b/nixos/tests/home-assistant.nix
@@ -71,6 +71,11 @@ in
           mini-graph-card
         ];
 
+        # test loading themes
+        themes = with pkgs.home-assistant-themes; [
+          material-you-theme
+        ];
+
         config = {
           homeassistant = {
             name = "Home";
@@ -250,6 +255,11 @@ in
           hass.succeed("grep -q 'mini-graph-card-bundle.js' '${configDir}/configuration.yaml'")
           hass.succeed("curl --fail http://localhost:8123/local/nixos-lovelace-modules/mini-graph-card-bundle.js")
 
+      with subtest("Check that themes are referenced and installed"):
+          hass.succeed("grep -q '!include_dir_merge_named.*themes' '${configDir}/configuration.yaml'")
+          themes_dir = hass.succeed("sed -n 's/.*!include_dir_merge_named \\(.*\\)/\\1/p' '${configDir}/configuration.yaml'").strip()
+          hass.succeed(f"test -f {themes_dir}/material_you.yaml")
+
       with subtest("Check that optional dependencies are in the PYTHONPATH"):
           env = get_unit_property("Environment")
           python_path = env.split("PYTHONPATH=")[1].split()[0]
diff --git a/pkgs/applications/emulators/libretro/cores/snes9x2010.nix b/pkgs/applications/emulators/libretro/cores/snes9x2010.nix
index 70391d943e7a..3121978358ac 100644
--- a/pkgs/applications/emulators/libretro/cores/snes9x2010.nix
+++ b/pkgs/applications/emulators/libretro/cores/snes9x2010.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore rec {
   core = "snes9x2010";
-  version = "0-unstable-2026-04-09";
+  version = "0-unstable-2026-05-05";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "snes9x2010";
-    rev = "a7a4bfaed4c6408908c76af20ad625e1645c3d11";
-    hash = "sha256-mtTgh/koM7jS7/cH7qRgTa+xJXBBJSdxHHbhOd/q4i4=";
+    rev = "d9cba8a41b3407ebb929816a7033e0407fd7b2d0";
+    hash = "sha256-OdJStJK823PayWS+bmwG+kDrdx6KeVWYiSAu61C9UFs=";
   };
 
   makeFlags = [ "GIT_VERSION=${builtins.substring 0 7 src.rev}" ];
diff --git a/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix b/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix
index b4261e3197a3..deeecde37523 100644
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix
@@ -9,11 +9,11 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "140.10.1esr";
+  version = "140.10.2esr";
   applicationName = "Firefox ESR";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "aa3481dbdda0a302acefff52007ba2e6927962523408b942a7df673e80618fc381faf1ca70ebaac3760645bf7cb382b85658af49beca705cd636ce9de58349a5";
+    sha512 = "bda7d5e6d59a2ad310e3f3e6e8ec05c78222edce266671d5d454dfa3e8f0086add3b9c0099db907cb62b2587ed47026ba7b3aa4f0406693d142d8d91b818d551";
   };
 
   meta = {
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index f27c14412f99..bf861e4596d7 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -959,13 +959,13 @@
     "vendorHash": "sha256-OAd8SeTqTrH0kMoM2LsK3vM2PI23b3gl57FaJYM9hM0="
   },
   "newrelic_newrelic": {
-    "hash": "sha256-j4DQRsw7QP7d83HTIchgSVt3CPUCIJ8CKmuMSKr5GaQ=",
+    "hash": "sha256-m8KZQUmDyMTR3S1BC5nmo15j5TUDV3ZZsy4hg16VZlc=",
     "homepage": "https://registry.terraform.io/providers/newrelic/newrelic",
     "owner": "newrelic",
     "repo": "terraform-provider-newrelic",
-    "rev": "v3.85.1",
+    "rev": "v3.87.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-zFg0xT6iLBxnM9ysKB/Dmveffp6Ohbj9akgr6lbU8MI="
+    "vendorHash": "sha256-W/a04lDiPVh/tkcWz9eJp/pupI46cXxqukdv1h17xYY="
   },
   "ns1-terraform_ns1": {
     "hash": "sha256-MX/Wd9Lztjn7uwDzJjs4bsSSp0PFzUgsu4jXke9jHL8=",
@@ -1031,13 +1031,13 @@
     "vendorHash": "sha256-ofzbDmivXgH1i1Gjhpyp0bk3FDs5SnxwoRuNAWyMqyI="
   },
   "opentelekomcloud_opentelekomcloud": {
-    "hash": "sha256-rhufSDVO6Yu5EXwduREFg3dkA/SkjzTyW3rR+Tqivbg=",
+    "hash": "sha256-NQ8yB4maHOF/sfFSSeCW9MNnAo/PgYrXAPRuM4NNti0=",
     "homepage": "https://registry.terraform.io/providers/opentelekomcloud/opentelekomcloud",
     "owner": "opentelekomcloud",
     "repo": "terraform-provider-opentelekomcloud",
-    "rev": "v1.36.64",
+    "rev": "v1.36.65",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-qtH6jjhzGRGaHYKjpJLPWjwRL5PQIyOPvI33BVf4cO4="
+    "vendorHash": "sha256-NOsmv0G+tfNwqbPF8U4vihp3cd5Kn9N0dJBWh9m5X+Y="
   },
   "opsgenie_opsgenie": {
     "hash": "sha256-Y67kcg/ovvZc22l1CBz0Mqu7DAIit5F0jQNfQrl2EGI=",
diff --git a/pkgs/by-name/ai/aileron/package.nix b/pkgs/by-name/ai/aileron/package.nix
index e741dcbe4480..c2c914b5cb4c 100644
--- a/pkgs/by-name/ai/aileron/package.nix
+++ b/pkgs/by-name/ai/aileron/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenvNoCC,
   fetchzip,
+  installFonts,
 }:
 
 let
@@ -18,13 +19,7 @@ stdenvNoCC.mkDerivation {
     stripRoot = false;
   };
 
-  installPhase = ''
-    runHook preInstall
-
-    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
-
-    runHook postInstall
-  '';
+  nativeBuildInputs = [ installFonts ];
 
   meta = {
     homepage = "https://dotcolon.net/font/aileron/";
diff --git a/pkgs/by-name/an/anydesk/package.nix b/pkgs/by-name/an/anydesk/package.nix
index 3d1e6d1a197b..5e0d5804dbf2 100644
--- a/pkgs/by-name/an/anydesk/package.nix
+++ b/pkgs/by-name/an/anydesk/package.nix
@@ -42,6 +42,9 @@
   copyDesktopItems,
   pulseaudio,
   udev,
+  libxkbcommon,
+  wayland,
+  libepoxy,
 }:
 
 let
@@ -100,6 +103,9 @@ stdenv.mkDerivation (finalAttrs: {
     libsm
     libxrender
     udev
+    libxkbcommon
+    wayland
+    libepoxy
   ];
 
   nativeBuildInputs = [
@@ -188,6 +194,6 @@ stdenv.mkDerivation (finalAttrs: {
       "aarch64-linux"
     ];
     mainProgram = "anydesk";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ fraioveio ];
   };
 })
diff --git a/pkgs/by-name/an/anydesk/pin.json b/pkgs/by-name/an/anydesk/pin.json
index 825e8fdd0a83..be59d275a145 100644
--- a/pkgs/by-name/an/anydesk/pin.json
+++ b/pkgs/by-name/an/anydesk/pin.json
@@ -1,5 +1,5 @@
 {
-  "version": "7.1.3",
-  "x86_64-linux": "sha256-b1WSQMRlFaqhECCBKoPjUIww5Fj3yfN8wxwACuO7RR4=",
-  "aarch64-linux": "sha256-Yb5Jnjxs8AmMeFvWY+VYGTovpLwW1PRPBEJZUF63gA0="
+  "version": "8.0.2",
+  "x86_64-linux": "sha256-6noMPfe0x6kx/whyd66qcmk7WhEivx3xK5q58Se9Ij0=",
+  "aarch64-linux": "sha256-wfY+OCx9OyLCmiA29RjnYzcg/pApMIXWT5UrcdcyRYM="
 }
diff --git a/pkgs/by-name/ar/arcdps-log-manager/package.nix b/pkgs/by-name/ar/arcdps-log-manager/package.nix
index 7015c17454fe..1ccbe05a2b3c 100644
--- a/pkgs/by-name/ar/arcdps-log-manager/package.nix
+++ b/pkgs/by-name/ar/arcdps-log-manager/package.nix
@@ -13,13 +13,13 @@
 }:
 buildDotnetModule (finalAttrs: {
   pname = "arcdps-log-manager";
-  version = "1.15";
+  version = "1.15.1";
 
   src = fetchFromGitHub {
     owner = "gw2scratch";
     repo = "evtc";
     tag = "manager-v${finalAttrs.version}";
-    hash = "sha256-z7SuE+MPhN4/XW3CtYabbAd2ZjL2M/ii+VCdyUUukoA=";
+    hash = "sha256-JevVLlWcPu0/inLjzsxyNCcwOTp1jwNMp/rZH9h1wO0=";
   };
 
   nugetDeps = ./deps.json;
diff --git a/pkgs/by-name/co/cosmic-applets/package.nix b/pkgs/by-name/co/cosmic-applets/package.nix
index acb6ab6403a9..baf172b48f90 100644
--- a/pkgs/by-name/co/cosmic-applets/package.nix
+++ b/pkgs/by-name/co/cosmic-applets/package.nix
@@ -20,17 +20,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-applets";
-  version = "1.0.10";
+  version = "1.0.12";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-applets";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-+E7d8I9xKaTzJzVlJhPb23ak8M9wgjnB6rwYFdpnjcs=";
+    hash = "sha256-8/9Cj30bAxxtMhqFgWvYJiuApDNgclPPTYh7aNR6OAs=";
   };
 
-  cargoHash = "sha256-uxz6kMuxhDTehHxDcA43iO+zVHBofbtO6HZoWEf3E30=";
+  cargoHash = "sha256-gA+dpodk6u8dv9VaKNi/xzI8ys39iztQdia+eGkzXs4=";
 
   nativeBuildInputs = [
     just
diff --git a/pkgs/by-name/co/cosmic-applibrary/package.nix b/pkgs/by-name/co/cosmic-applibrary/package.nix
index ed00811f5cfb..f331ee49a2f9 100644
--- a/pkgs/by-name/co/cosmic-applibrary/package.nix
+++ b/pkgs/by-name/co/cosmic-applibrary/package.nix
@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-applibrary";
-  version = "1.0.10";
+  version = "1.0.12";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-applibrary";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-+ewcDeRskge8mgGo7b9rf0i0vg+mdR3iwK/LF38UTvM=";
+    hash = "sha256-deE9xXvRSZWSEdKPJr1HuA/gVs0a22lAVRmUnhwpDJM=";
   };
 
-  cargoHash = "sha256-Cd4tNG+qXYwCUKIXnE5+LzaCBmRJnDWrI1uGwFiFhWA=";
+  cargoHash = "sha256-uR0wm2+zmcec3esfYwgq4pRqSHkZnd3O8XhgnANf/1Q=";
 
   nativeBuildInputs = [
     just
diff --git a/pkgs/by-name/co/cosmic-bg/package.nix b/pkgs/by-name/co/cosmic-bg/package.nix
index 81f68f77e579..75b780b65c95 100644
--- a/pkgs/by-name/co/cosmic-bg/package.nix
+++ b/pkgs/by-name/co/cosmic-bg/package.nix
@@ -13,14 +13,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-bg";
-  version = "1.0.10";
+  version = "1.0.12";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-bg";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-f8XVAxxP+RdsVaVKqicZBkZiGXPCMfpP6Z4sBDeoYyo=";
+    hash = "sha256-E4OWxoGyRNFcMl7ni7PB6PE0Yl7dE+Wd4JGDMHO94Yw=";
   };
 
   postPatch = ''
@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       "${cosmic-wallpapers}/share/backgrounds/cosmic/orion_nebula_nasa_heic0601a.jpg"
   '';
 
-  cargoHash = "sha256-ahz/isgQpt48lWQM4V7Y4NwUlyX8+tW9LHNxZJe3SD4=";
+  cargoHash = "sha256-xXq8Dckg3YOf2AT9uOZqVfq00FhZp/X5UU8hLmAln1U=";
 
   nativeBuildInputs = [
     just
diff --git a/pkgs/by-name/co/cosmic-comp/package.nix b/pkgs/by-name/co/cosmic-comp/package.nix
index f4aa7b67143a..dfc8da54c91f 100644
--- a/pkgs/by-name/co/cosmic-comp/package.nix
+++ b/pkgs/by-name/co/cosmic-comp/package.nix
@@ -20,17 +20,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-comp";
-  version = "1.0.10";
+  version = "1.0.12";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-comp";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-eFUvLBk+EkemDWJk7A0bd3R0fip31u2zqjmKKVim8Y0=";
+    hash = "sha256-C0s0u7g2LlLccaHsZLHvFs4JAPzQboEcqtwe0x8SVO4=";
   };
 
-  cargoHash = "sha256-80xojIrLd8Foxu9Qbf/cCImP4T4I7otA1iJbr7/lEb8=";
+  cargoHash = "sha256-G2/nVy9I4iGZiG3+uVMnnqj82Wg2s5/SmNyQERqDhXY=";
 
   separateDebugInfo = true;
 
diff --git a/pkgs/by-name/co/cosmic-edit/package.nix b/pkgs/by-name/co/cosmic-edit/package.nix
index 0a336fc306fa..7d68865c1e85 100644
--- a/pkgs/by-name/co/cosmic-edit/package.nix
+++ b/pkgs/by-name/co/cosmic-edit/package.nix
@@ -16,17 +16,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-edit";
-  version = "1.0.10";
+  version = "1.0.12";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-edit";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-L4OtNqcvXMjQZtt26H+NIh6bzgDoFlyZuViXoG9RdaI=";
+    hash = "sha256-ucDMl2qX7NApWxrfn4vk5eWrlESZNLBZCsR/tK0zwkI=";
   };
 
-  cargoHash = "sha256-Qs+THwbp6TNcSzO33Y0j/o8WP9E5ti0HCxknOo7h1H0=";
+  cargoHash = "sha256-iWZRxn0puWwAibjbj/jdk4t6qgETEUJUv612RZSavMw=";
 
   postPatch = ''
     substituteInPlace justfile --replace-fail '#!/usr/bin/env' "#!$(command -v env)"
diff --git a/pkgs/by-name/co/cosmic-files/package.nix b/pkgs/by-name/co/cosmic-files/package.nix
index 166ae96b3d89..0f552ae1f95b 100644
--- a/pkgs/by-name/co/cosmic-files/package.nix
+++ b/pkgs/by-name/co/cosmic-files/package.nix
@@ -12,17 +12,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-files";
-  version = "1.0.10";
+  version = "1.0.12";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-files";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-cPnsnn9VLyTFA9htsovboDygt7NEAr9XdrJsP45bE08=";
+    hash = "sha256-q9dNpSjwvqWTGaWg9VA4zJXQo8+YiYJ4qo/Ev4Nk4IY=";
   };
 
-  cargoHash = "sha256-DB5u0MSdrxYIGcndbyUUeNPuXXN0OScd519XBxB1lLg=";
+  cargoHash = "sha256-tMSqyl75XK2rgqRtgHAPtr+KFotx61HGqzv0iqzakS8=";
 
   nativeBuildInputs = [
     just
diff --git a/pkgs/by-name/co/cosmic-greeter/package.nix b/pkgs/by-name/co/cosmic-greeter/package.nix
index a7c47b818d02..75473be3d5ba 100644
--- a/pkgs/by-name/co/cosmic-greeter/package.nix
+++ b/pkgs/by-name/co/cosmic-greeter/package.nix
@@ -19,17 +19,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-greeter";
-  version = "1.0.10";
+  version = "1.0.12";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-greeter";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-59t0jKXspmhwnTYPa96tNkYrOuCFZ80g/VJsyrZ0s10=";
+    hash = "sha256-mfgIVi/o5O715IX7Wt8QHfxzBX6ye+wztWU/GHaj9C0=";
   };
 
-  cargoHash = "sha256-MZmbwmc1DPCZ9g4OM9gy0IuXgy/zxreujEYY3Ji5Ad8=";
+  cargoHash = "sha256-jhugV3eF7g6WU5ez3LzqKc/wP952Zpi8Hplg9SZflns=";
 
   env.VERGEN_GIT_SHA = finalAttrs.src.tag;
 
diff --git a/pkgs/by-name/co/cosmic-icons/package.nix b/pkgs/by-name/co/cosmic-icons/package.nix
index 3b1bc8237b88..0bc5a0168044 100644
--- a/pkgs/by-name/co/cosmic-icons/package.nix
+++ b/pkgs/by-name/co/cosmic-icons/package.nix
@@ -9,14 +9,14 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cosmic-icons";
-  version = "1.0.10";
+  version = "1.0.12";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-icons";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-h6vnOL3T4o2VDoQ5vLGg3s6nMYcPKysI5RxbjnbnCFI=";
+    hash = "sha256-3owl4M4vRyzjR4v74clyAxpNDu77rieSpYAVYfADHzY=";
   };
 
   nativeBuildInputs = [ just ];
diff --git a/pkgs/by-name/co/cosmic-idle/package.nix b/pkgs/by-name/co/cosmic-idle/package.nix
index e09dca350c55..6619478f8376 100644
--- a/pkgs/by-name/co/cosmic-idle/package.nix
+++ b/pkgs/by-name/co/cosmic-idle/package.nix
@@ -16,7 +16,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-idle";
-  version = "1.0.10";
+  version = "1.0.12";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/co/cosmic-initial-setup/package.nix b/pkgs/by-name/co/cosmic-initial-setup/package.nix
index ab06d9cd4256..e590dd9356ed 100644
--- a/pkgs/by-name/co/cosmic-initial-setup/package.nix
+++ b/pkgs/by-name/co/cosmic-initial-setup/package.nix
@@ -14,17 +14,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-initial-setup";
-  version = "1.0.10";
+  version = "1.0.12";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-initial-setup";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-wq0uqS0gNM4w6E+1pTPU6C8Mx4j8/MNp+0Oiw1kbwck=";
+    hash = "sha256-GyLh7vucn62SpxolYNjJodkb41BT1CDZdEa/TasJXYM=";
   };
 
-  cargoHash = "sha256-Kj+eaTMHMQQHN0X3prIuZm1wvfnaV7BUlUKem6JLtc8=";
+  cargoHash = "sha256-DESnl5NjakU4++Ep6CHxDZzHn+o0Gi0eREpXk5BN5iY=";
 
   buildFeatures = [ "nixos" ];
 
diff --git a/pkgs/by-name/co/cosmic-launcher/package.nix b/pkgs/by-name/co/cosmic-launcher/package.nix
index 8f1ccd36a539..a44c59b15cb3 100644
--- a/pkgs/by-name/co/cosmic-launcher/package.nix
+++ b/pkgs/by-name/co/cosmic-launcher/package.nix
@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-launcher";
-  version = "1.0.10";
+  version = "1.0.12";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-launcher";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-g2j0rh/gNe30DXSjPaGE8HH2aQ0tOW0wimSUt5D08yo=";
+    hash = "sha256-pyfRGiVyXJPLoLdaeo7/TaW6+jm43SoPKk04NJLfLvc=";
   };
 
-  cargoHash = "sha256-KsiW+/WYKCfoUJB++ov0FGcmZhew2NjvzkBlcH/Vubw=";
+  cargoHash = "sha256-wZgxlq9MVCeESH093MaQybVMyq50L7aYwj//2r/B0QM=";
 
   nativeBuildInputs = [
     just
diff --git a/pkgs/by-name/co/cosmic-notifications/package.nix b/pkgs/by-name/co/cosmic-notifications/package.nix
index eb409e186074..cf05ef1f18d6 100644
--- a/pkgs/by-name/co/cosmic-notifications/package.nix
+++ b/pkgs/by-name/co/cosmic-notifications/package.nix
@@ -12,17 +12,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-notifications";
-  version = "1.0.10";
+  version = "1.0.12";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-notifications";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-/q+OIkKxqsLK2b9jjwDyVEkdNy0Xav3t4DicD3GeQD8=";
+    hash = "sha256-84e+idGKYDBerS84Cl9jPc/Z9RzuVvND7nHzmApsrgA=";
   };
 
-  cargoHash = "sha256-+yNXOKZYWoR3yK1ulNRStJZbNTEDsKErL1N1wNiYsOM=";
+  cargoHash = "sha256-EIwYabYWSHTMnNFcammidn3bI4fc6JFdcVkGj7RmWqA=";
 
   nativeBuildInputs = [
     just
diff --git a/pkgs/by-name/co/cosmic-osd/package.nix b/pkgs/by-name/co/cosmic-osd/package.nix
index a788c0a1a9cc..6f7a39f84a7e 100644
--- a/pkgs/by-name/co/cosmic-osd/package.nix
+++ b/pkgs/by-name/co/cosmic-osd/package.nix
@@ -15,17 +15,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-osd";
-  version = "1.0.10";
+  version = "1.0.12";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-osd";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-TniUR2CwqHkouQ1OPYi8z3jxDiXJoWYqUjheKtmggD8=";
+    hash = "sha256-XpjU0Pad/xUK1vnpq4qT4UmfkBH8yuiOaC4EZWiphkE=";
   };
 
-  cargoHash = "sha256-Q6nsaYlAZwSoANsrrdaIrNdnzaJiBRMUzZdbtHLupio=";
+  cargoHash = "sha256-1YRWWI2qhCI0GrxBAAkGT/AbtkTHgdbYsG8obriZ+zg=";
 
   nativeBuildInputs = [
     just
diff --git a/pkgs/by-name/co/cosmic-panel/package.nix b/pkgs/by-name/co/cosmic-panel/package.nix
index 7b4aa8c5fbe0..e0dff5e9e822 100644
--- a/pkgs/by-name/co/cosmic-panel/package.nix
+++ b/pkgs/by-name/co/cosmic-panel/package.nix
@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-panel";
-  version = "1.0.10";
+  version = "1.0.12";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-panel";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-QbdLYJMe1jxBb5c2LsQXwfURNldkR+WAYq+7fpoXJJU=";
+    hash = "sha256-1yry1cA/friBzyE6LH3G6rd8ZzBPt5aTGWVzATO839Y=";
   };
 
-  cargoHash = "sha256-vXmLoyHtHvzy47CZvtCEeyyZrYCc+RciE54OKwqJiBw=";
+  cargoHash = "sha256-vU++jreNHCRjxyyoj53LB2Sa7cdVUWGAvECcqoDofF8=";
 
   nativeBuildInputs = [
     just
diff --git a/pkgs/by-name/co/cosmic-player/package.nix b/pkgs/by-name/co/cosmic-player/package.nix
index 3c5e81c42d8d..6aaaf42d43b9 100644
--- a/pkgs/by-name/co/cosmic-player/package.nix
+++ b/pkgs/by-name/co/cosmic-player/package.nix
@@ -18,17 +18,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-player";
-  version = "1.0.10";
+  version = "1.0.12";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-player";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-VmOTEpnDic2PMEhmFNDXz7CHw3MdInZXZlp237BU+jY=";
+    hash = "sha256-74iYH1jW5Tau9enem0SeLLTnWhaa/+ow1m3hvGfOt9c=";
   };
 
-  cargoHash = "sha256-FyvBjJEwluKFZtFYByd4aeMhtLHKjnoAa+qIaOUS0vE=";
+  cargoHash = "sha256-YPxbOSz/E3hoMT4dutk60jWJMpJHqOWpCSA91b+mHaE=";
 
   nativeBuildInputs = [
     just
diff --git a/pkgs/by-name/co/cosmic-randr/package.nix b/pkgs/by-name/co/cosmic-randr/package.nix
index 93aac664a948..64d833e3aad7 100644
--- a/pkgs/by-name/co/cosmic-randr/package.nix
+++ b/pkgs/by-name/co/cosmic-randr/package.nix
@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-randr";
-  version = "1.0.10";
+  version = "1.0.12";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/co/cosmic-screenshot/package.nix b/pkgs/by-name/co/cosmic-screenshot/package.nix
index ea37323fbf71..ccbb1e64b857 100644
--- a/pkgs/by-name/co/cosmic-screenshot/package.nix
+++ b/pkgs/by-name/co/cosmic-screenshot/package.nix
@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-screenshot";
-  version = "1.0.10";
+  version = "1.0.12";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-screenshot";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-w7UySGvCibxDEyu/LBckvHDruOH3v1IVoKezgvt0zak=";
+    hash = "sha256-vWLjMAyR2vgOGfIYZQFYPWGHx+T1ZrWAztm60qdHgBk=";
   };
 
-  cargoHash = "sha256-O8fFeg1TkKCg+QbTnNjsH52xln4+ophh/BW/b4zQs9o=";
+  cargoHash = "sha256-q0RJST1yeqPBjU5MseNZIrZw+brfDtQLKiw7wyViflE=";
 
   nativeBuildInputs = [
     just
diff --git a/pkgs/by-name/co/cosmic-session/package.nix b/pkgs/by-name/co/cosmic-session/package.nix
index a26d15b46c68..b4b5a8054fec 100644
--- a/pkgs/by-name/co/cosmic-session/package.nix
+++ b/pkgs/by-name/co/cosmic-session/package.nix
@@ -12,17 +12,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-session";
-  version = "1.0.10";
+  version = "1.0.12";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-session";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-t7BUBJ9MjTSd2rSkKtiYkltbfcpOcXl2smXxV84l3GY=";
+    hash = "sha256-ugVj4SIO77Fw9ET4zIyK3OJaRFH3ujbQBJ57Vc+f2Ao=";
   };
 
-  cargoHash = "sha256-wFh9AYQRZB9qK0vCrhW9Zk61Yg+VY3VPAqJRD47NbK4=";
+  cargoHash = "sha256-5dLG40X+yxJo566guyHqOCLNp+uNSE+HONS8GIDm58A=";
 
   postPatch = ''
     substituteInPlace data/start-cosmic \
diff --git a/pkgs/by-name/co/cosmic-settings-daemon/package.nix b/pkgs/by-name/co/cosmic-settings-daemon/package.nix
index 803520857390..4c8e862d5435 100644
--- a/pkgs/by-name/co/cosmic-settings-daemon/package.nix
+++ b/pkgs/by-name/co/cosmic-settings-daemon/package.nix
@@ -16,7 +16,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-settings-daemon";
-  version = "1.0.10";
+  version = "1.0.12";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/co/cosmic-settings/package.nix b/pkgs/by-name/co/cosmic-settings/package.nix
index 73136945a57d..c13ed1b1fb05 100644
--- a/pkgs/by-name/co/cosmic-settings/package.nix
+++ b/pkgs/by-name/co/cosmic-settings/package.nix
@@ -27,17 +27,17 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-settings";
-  version = "1.0.10";
+  version = "1.0.12";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-settings";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-/gFJvV5v4T30mkA8ppSc/kevwwR1RgIXWMGI+HmxK+U=";
+    hash = "sha256-NRaavbpNUh4sSHwW0seSpJFBbH06nmKiofoJ4cmQFcY=";
   };
 
-  cargoHash = "sha256-Nxc9VYtyG1avv1a32IZjsNQIQo5WmRJzjMEcf20B06s=";
+  cargoHash = "sha256-O6d47H+vcSn9G6EIMpSshfL+cBJWZMYXHHKsu2n/huk=";
 
   nativeBuildInputs = [
     cmake
diff --git a/pkgs/by-name/co/cosmic-store/package.nix b/pkgs/by-name/co/cosmic-store/package.nix
index 268f12f884a8..f6dc3b86df48 100644
--- a/pkgs/by-name/co/cosmic-store/package.nix
+++ b/pkgs/by-name/co/cosmic-store/package.nix
@@ -15,17 +15,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-store";
-  version = "1.0.10";
+  version = "1.0.12";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-store";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-miR50DtNaUOOoVZ25vD0WuQ+PN/8DYy2cPFGcUE7Y+Y=";
+    hash = "sha256-oybxrzKofTbw8u8KMvcU0kODKZ3ttPtSfcoXRjgLq6s=";
   };
 
-  cargoHash = "sha256-AsppupxVQlzKbdd+qt9oMZa3flcpC8fUwN3Lw0cgzW8=";
+  cargoHash = "sha256-DCqEXoJ1qTwKemSCGe7AwQCdOFw7Qh3PoxbB9XdLfHk=";
 
   nativeBuildInputs = [
     just
diff --git a/pkgs/by-name/co/cosmic-term/package.nix b/pkgs/by-name/co/cosmic-term/package.nix
index 5c5a3b3967ed..af483dfd11fe 100644
--- a/pkgs/by-name/co/cosmic-term/package.nix
+++ b/pkgs/by-name/co/cosmic-term/package.nix
@@ -15,17 +15,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-term";
-  version = "1.0.10";
+  version = "1.0.12";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-term";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-Hb5FMJH5P/kQZ7Ess6fAVYoR7EVFyH019bI3+YSHPdw=";
+    hash = "sha256-GpbLNr6B16hy7emdkjDfzOFfGgMOz6vfmmhCSL7lR5c=";
   };
 
-  cargoHash = "sha256-MS0yUwg/MAtHq6YgxfikAbEUwLmx5OrLnsrle3MlIpg=";
+  cargoHash = "sha256-9iHcmImA2tscpRuRKE/nUrwhR5RU5xA2zxJpcDt+2sE=";
 
   nativeBuildInputs = [
     just
diff --git a/pkgs/by-name/co/cosmic-wallpapers/package.nix b/pkgs/by-name/co/cosmic-wallpapers/package.nix
index 4a724d8b8edb..c27c8e18db3f 100644
--- a/pkgs/by-name/co/cosmic-wallpapers/package.nix
+++ b/pkgs/by-name/co/cosmic-wallpapers/package.nix
@@ -7,7 +7,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cosmic-wallpapers";
-  version = "1.0.10";
+  version = "1.0.12";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix b/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
index 1c80ed47ea17..ec2bb120e7a1 100644
--- a/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
+++ b/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
@@ -14,17 +14,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-workspaces-epoch";
-  version = "1.0.10";
+  version = "1.0.12";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-workspaces-epoch";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-pzIRH/AQwUllvJxL3u6P+wTM8ndhsbYQhABFNSrvGmE=";
+    hash = "sha256-WYPVzFKMJ3Xhubr0rWW/u9Ex5NwuG2ZjSio6iWJwbCc=";
   };
 
-  cargoHash = "sha256-wdRUvjeRLxJzF2g8+Q+O5KPA3b2DimE0pluvxEuyDps=";
+  cargoHash = "sha256-Z5dC3W8QoDBZWBjHwRj9MC8EScDjQwUiUcOPTRDToDA=";
 
   separateDebugInfo = true;
 
diff --git a/pkgs/by-name/ct/ctre/package.nix b/pkgs/by-name/ct/ctre/package.nix
index 7c62280763bb..fc590b6a21c3 100644
--- a/pkgs/by-name/ct/ctre/package.nix
+++ b/pkgs/by-name/ct/ctre/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ctre";
-  version = "3.10.0";
+  version = "3.11.0";
 
   src = fetchFromGitHub {
     owner = "hanickadot";
     repo = "compile-time-regular-expressions";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-/44oZi6j8+a1D6ZGZpoy82GHjPtqzOvuS7d3SPbH7fs=";
+    hash = "sha256-YtshxSdVT9V9V0KcYF+9NtgW0kYUCQ4I9EbcWNajuxI=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/da/davmail/package.nix b/pkgs/by-name/da/davmail/package.nix
index de6b66ae1c57..771510a5ff7d 100644
--- a/pkgs/by-name/da/davmail/package.nix
+++ b/pkgs/by-name/da/davmail/package.nix
@@ -23,13 +23,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "davmail";
-  version = "6.6.0";
+  version = "6.7.0";
 
   src = fetchFromGitHub {
     owner = "mguessan";
     repo = "davmail";
     tag = finalAttrs.version;
-    hash = "sha256-La6nrbAGeZlIhs0i5dm6pIcvn+V1wQjuqBza4w+Aa3A=";
+    hash = "sha256-bQyZ+Sela70fOle+uqqG+y3fACeItvkmidXOFXW+DOk=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/dn/dns-collector/package.nix b/pkgs/by-name/dn/dns-collector/package.nix
index 7c595f178c0d..2a5f099884c9 100644
--- a/pkgs/by-name/dn/dns-collector/package.nix
+++ b/pkgs/by-name/dn/dns-collector/package.nix
@@ -5,29 +5,30 @@
   nix-update-script,
   versionCheckHook,
 }:
+
 buildGoModule (finalAttrs: {
   pname = "dns-collector";
-  version = "2.2.2";
+  version = "2.2.3";
 
   src = fetchFromGitHub {
     owner = "dmachard";
     repo = "dns-collector";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Vqru5JK3QCz1ij08ezuJgozhJaEplp92c2jBOiijB+M=";
+    hash = "sha256-hqSfL3R0fp7uYBGoD1Wu0ZNLq1VnOvcN0n8zzfRXTfA=";
   };
+
   subPackages = [ "." ];
 
   ldflags = [
     "-s"
-    "-w"
-    "-X github.com/prometheus/common/version.BuildDate=1970-01-01T00:00:00Z"
-    "-X github.com/prometheus/common/version.BuildUser=nix@nixpkgs"
-    "-X github.com/prometheus/common/version.Branch=master"
-    "-X github.com/prometheus/common/version.Revision=${finalAttrs.src.rev}"
-    "-X github.com/prometheus/common/version.Version=${finalAttrs.version}"
+    "-X=github.com/prometheus/common/version.BuildDate=1970-01-01T00:00:00Z"
+    "-X=github.com/prometheus/common/version.BuildUser=nix@nixpkgs"
+    "-X=github.com/prometheus/common/version.Branch=master"
+    "-X=github.com/prometheus/common/version.Revision=${finalAttrs.src.rev}"
+    "-X=github.com/prometheus/common/version.Version=${finalAttrs.version}"
   ];
 
-  vendorHash = "sha256-wyfbxdmF3OeWgZ9IeiCyo9PZFnSfnCmlZXM5/1Jq38w=";
+  vendorHash = "sha256-i1Ogo5zRYaEgiYMMTUjI2WiL2gABw2r31/WslXLzowI=";
 
   passthru.updateScript = nix-update-script { };
 
@@ -39,7 +40,7 @@ buildGoModule (finalAttrs: {
   meta = {
     changelog = "https://github.com/dmachart/dns-collector/releases/tag/v${finalAttrs.version}";
     homepage = "https://github.com/dmachart/dns-collector";
-    description = "Ingesting, pipelining, and enhancing your DNS logs with usage indicators, security analysis, and additional metadata. ";
+    description = "Ingesting, pipelining, and enhancing your DNS logs with usage indicators, security analysis, and additional metadata";
     license = lib.licenses.mit;
     mainProgram = "go-dnscollector";
     maintainers = with lib.maintainers; [ paepcke ];
diff --git a/pkgs/by-name/dr/draupnir/package.nix b/pkgs/by-name/dr/draupnir/package.nix
index a02eef927117..4152c07609d2 100644
--- a/pkgs/by-name/dr/draupnir/package.nix
+++ b/pkgs/by-name/dr/draupnir/package.nix
@@ -20,13 +20,13 @@ in
 
 buildNpmPackage (finalAttrs: {
   pname = "draupnir";
-  version = "3.0.0";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "the-draupnir-project";
     repo = "Draupnir";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WrMYak6ztIy3KqjcVuN2OmIy1uxlIVNvHPGw7e3LRw0=";
+    hash = "sha256-e6d9z5dkJg4ZpkN+yJFr8J8RWl9tcAhEYTOM+9413Ok=";
   };
 
   nativeBuildInputs = [
@@ -36,7 +36,7 @@ buildNpmPackage (finalAttrs: {
   ]
   ++ lib.optional stdenv.hostPlatform.isDarwin cctools.libtool;
 
-  npmDepsHash = "sha256-CnSeg7sGFzPD+VQl8sWXtiBfuSdeieNhDrLFjWlHcUs=";
+  npmDepsHash = "sha256-DvQM9Kr9Hc7/1OEZadZ1GvpAjfRmbdIcA6UDuFBQ+vo=";
 
   preBuild = ''
     # install proper version and branch info
@@ -44,8 +44,7 @@ buildNpmPackage (finalAttrs: {
     echo "main" > apps/draupnir/branch.txt
 
     # we already set the version and branch above
-    substituteInPlace apps/draupnir/package.json \
-      --replace-fail " && npm run describe-version && npm run describe-branch" ""
+    sed -i "/build:assets/d" apps/draupnir/package.json
   '';
 
   postInstall = ''
diff --git a/pkgs/by-name/fa/fanwood/package.nix b/pkgs/by-name/fa/fanwood/package.nix
index 0b0c7274148b..7dda66cccf6b 100644
--- a/pkgs/by-name/fa/fanwood/package.nix
+++ b/pkgs/by-name/fa/fanwood/package.nix
@@ -2,6 +2,7 @@
   lib,
   fetchFromGitHub,
   stdenvNoCC,
+  installFonts,
 }:
 
 stdenvNoCC.mkDerivation {
@@ -15,13 +16,12 @@ stdenvNoCC.mkDerivation {
     hash = "sha256-OroFhhb4RxPHkx+/8PtFnxs1GQVXMPiYTd+2vnRbIjg=";
   };
 
-  installPhase = ''
-    runHook preInstall
+  outputs = [
+    "out"
+    "webfont"
+  ];
 
-    install -D -m444 -t $out/share/fonts/opentype $src/*.otf
-
-    runHook postInstall
-  '';
+  nativeBuildInputs = [ installFonts ];
 
   meta = {
     description = "Serif based on the work of a famous Czech-American type designer of yesteryear";
diff --git a/pkgs/by-name/fm/fmd-server/package.nix b/pkgs/by-name/fm/fmd-server/package.nix
index efd319a5dae0..e5fad6c9ac32 100644
--- a/pkgs/by-name/fm/fmd-server/package.nix
+++ b/pkgs/by-name/fm/fmd-server/package.nix
@@ -17,12 +17,12 @@ buildGoModule (
   in
   {
     pname = "fmd-server";
-    version = "0.14.2";
+    version = "0.15.0";
     src = fetchFromGitLab {
       owner = "fmd-foss";
       repo = "fmd-server";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-zAGwKOfPu7AEYhaDxx1P3EoA1K9p/f3Vwh7GrynqKho=";
+      hash = "sha256-EzhXrB15lRtDnFicdH7fjpcm1BYoAb1SBeylGSub69s=";
     };
 
     pnpmDeps = fetchPnpmDeps {
@@ -30,7 +30,7 @@ buildGoModule (
       inherit pnpm_10;
       sourceRoot = "${finalAttrs.src.name}/${ui.pnpmRoot}";
       fetcherVersion = 3;
-      hash = "sha256-fgqNaFQ4+uJxXzDJJq+D0+EFaLaYR+WUzi5kGq5ezjs=";
+      hash = "sha256-vKSKPwOkb7TwDUlkl8lUvO6tLKp2NyBQ0BGxThUN2P8=";
     };
 
     vendorHash = "sha256-cFIg9mOSQbrYHW4kg4aTeTaF+gy1jNpAlg8qepb81Jc=";
diff --git a/pkgs/by-name/ge/gegl/package.nix b/pkgs/by-name/ge/gegl/package.nix
index d1da3ad9284f..b9251fd7ed4e 100644
--- a/pkgs/by-name/ge/gegl/package.nix
+++ b/pkgs/by-name/ge/gegl/package.nix
@@ -79,6 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
     gexiv2
     openexr
     suitesparse
+    vala
   ]
   ++ lib.optionals stdenv.cc.isClang [
     llvmPackages.openmp
@@ -94,6 +95,8 @@ stdenv.mkDerivation (finalAttrs: {
     babl
   ];
 
+  strictDeps = true;
+
   mesonFlags = [
     "-Dmrg=disabled" # not sure what that is
     "-Dsdl2=disabled"
diff --git a/pkgs/by-name/go/go-font/package.nix b/pkgs/by-name/go/go-font/package.nix
index b9a6c8970ad3..e8f4214af470 100644
--- a/pkgs/by-name/go/go-font/package.nix
+++ b/pkgs/by-name/go/go-font/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenvNoCC,
   fetchzip,
+  installFonts,
 }:
 
 stdenvNoCC.mkDerivation {
@@ -14,15 +15,11 @@ stdenvNoCC.mkDerivation {
     hash = "sha256-rdzt51wY4b7HEr7W/0Ar/FB0zMyf+nKLsOT+CRSEP3o=";
   };
 
-  installPhase = ''
-    runHook preInstall
+  nativeBuildInputs = [ installFonts ];
 
-    mkdir -p $out/share/fonts/truetype
+  postInstall = ''
     mkdir -p $out/share/doc/go-font
-    mv *.ttf $out/share/fonts/truetype
-    mv README $out/share/doc/go-font/LICENSE
-
-    runHook postInstall
+    cp $src/README $out/share/doc/go-font/LICENSE
   '';
 
   meta = {
diff --git a/pkgs/by-name/jd/jdupes/package.nix b/pkgs/by-name/jd/jdupes/package.nix
index 767ba5ac7527..102dd142399a 100644
--- a/pkgs/by-name/jd/jdupes/package.nix
+++ b/pkgs/by-name/jd/jdupes/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromCodeberg,
+  fetchpatch2,
   libjodycode,
 }:
 
@@ -20,6 +21,14 @@ stdenv.mkDerivation (finalAttrs: {
     postFetch = "rm -r $out/testdir";
   };
 
+  patches = [
+    (fetchpatch2 {
+      name = "use-stat-time-macros-for-compatibility-reasons.patch";
+      url = "https://codeberg.org/jbruchon/jdupes/commit/464f72c82f2ce81dd33bfb5381f1bcf148da4091.patch";
+      hash = "sha256-/B6iNAG3Fsmot5MGSBMs99QnAc/bFZJjPtnbiq21QZg=";
+    })
+  ];
+
   buildInputs = [ libjodycode ];
 
   dontConfigure = true;
diff --git a/pkgs/by-name/ma/matlab-language-server/package.nix b/pkgs/by-name/ma/matlab-language-server/package.nix
index 60b607fed740..d65b973762e7 100644
--- a/pkgs/by-name/ma/matlab-language-server/package.nix
+++ b/pkgs/by-name/ma/matlab-language-server/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "matlab-language-server";
-  version = "1.3.10";
+  version = "1.3.11";
 
   src = fetchFromGitHub {
     owner = "mathworks";
     repo = "matlab-language-server";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DDtgommUDZbrTIGvH8xQyV+qNeDkxwwsx/0uQgGECPM=";
+    hash = "sha256-UY+rYWfLHSc+1wDZsRfttX9asFOmV4i42/vxdqLQSuw=";
   };
 
-  npmDepsHash = "sha256-BW2J8yTGegugvPxmj1i1K/GDc5bZH8sHOpLOPgwFGKg=";
+  npmDepsHash = "sha256-r4GE9uQwjyPWUitaxXLejH4Ej8SWw+slGlYIo0OX3HM=";
 
   npmBuildScript = "package";
 
diff --git a/pkgs/by-name/mm/mmtui/package.nix b/pkgs/by-name/mm/mmtui/package.nix
index 12eee2974e76..fd3f75b155f5 100644
--- a/pkgs/by-name/mm/mmtui/package.nix
+++ b/pkgs/by-name/mm/mmtui/package.nix
@@ -9,6 +9,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mmtui";
   version = "0.2.0";
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "SL-RU";
     repo = "mmtui";
@@ -22,7 +24,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rustPlatform.bindgenHook
   ];
 
-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "mmt-v(.*)"
+    ];
+  };
 
   meta = {
     changelog = "https://github.com/SL-RU/mmtui/releases/tag/v${finalAttrs.version}";
diff --git a/pkgs/by-name/om/omnictl/package.nix b/pkgs/by-name/om/omnictl/package.nix
index f6518f9553f8..0149f028048e 100644
--- a/pkgs/by-name/om/omnictl/package.nix
+++ b/pkgs/by-name/om/omnictl/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "omnictl";
-  version = "1.6.2";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "siderolabs";
     repo = "omni";
     rev = "v${version}";
-    hash = "sha256-IxPsm361gYdYWDy16vai5JsmJ5NWUSIRQ9k2Qnwi2K8=";
+    hash = "sha256-3nqyhJnJgOyegLtJchqoo6BtGbvvRaGxwo28Ef1gb4k=";
   };
 
-  vendorHash = "sha256-snrOKwD4xbMTdjP13KLTVVB7ikXG+yHS8QT60/tHZ3I=";
+  vendorHash = "sha256-6Yy/qEcZb4nheCplXmYo65NUJzImEQpRW/+g0rA3VW4=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/op/openclaw/package.nix b/pkgs/by-name/op/openclaw/package.nix
index c1c5460b3f7c..6f99a452cf40 100644
--- a/pkgs/by-name/op/openclaw/package.nix
+++ b/pkgs/by-name/op/openclaw/package.nix
@@ -11,7 +11,7 @@
   versionCheckHook,
   rolldown,
   installShellFiles,
-  version ? "2026.5.6",
+  version ? "2026.5.7",
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "openclaw";
@@ -21,10 +21,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     owner = "openclaw";
     repo = "openclaw";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-svziVePavoMxEUQAaNkv+67tSUOywblefmeTWtmKo9Y=";
+    hash = "sha256-ICkq6YfMJVvRC93sM+7/q2JI82wUhjaYAI3pRzmTHYc=";
   };
 
-  pnpmDepsHash = "sha256-kz9vE1A/GTkw/HH2ts4hxTJzrdkYhiLaJQP0AeAS3Bo=";
+  pnpmDepsHash = "sha256-LXaRfZ0WY8VDpDc2zFr+Oel6AuYo6SiTrp37yokT1VU=";
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
diff --git a/pkgs/by-name/se/sesh/package.nix b/pkgs/by-name/se/sesh/package.nix
index 5b5bffdadd70..ce1a5d98f63b 100644
--- a/pkgs/by-name/se/sesh/package.nix
+++ b/pkgs/by-name/se/sesh/package.nix
@@ -9,6 +9,7 @@
 buildGoModule (finalAttrs: {
   pname = "sesh";
   version = "2.26.1";
+  __structuredAttrs = true;
 
   nativeBuildInputs = [
     go-mockery
diff --git a/pkgs/by-name/sh/shiru/0001-Remove-Windows-specific-dep.patch b/pkgs/by-name/sh/shiru/0001-Remove-Windows-specific-dep.patch
new file mode 100644
index 000000000000..291b61fc6954
--- /dev/null
+++ b/pkgs/by-name/sh/shiru/0001-Remove-Windows-specific-dep.patch
@@ -0,0 +1,134 @@
+From 12b0c98a4e844ab18545c8ba521ac1ef71301938 Mon Sep 17 00:00:00 2001
+From: Naomi Roberts <mia@naomieow.xyz>
+Date: Thu, 4 Dec 2025 19:59:48 +0000
+Subject: [PATCH] Remove Windows-specific dep
+
+Signed-off-by: Naomi Roberts <mia@naomieow.xyz>
+---
+ electron/package.json       |  1 -
+ electron/src/main/app.js    | 17 +----------------
+ electron/webpack.config.cjs |  4 +---
+ package.json                |  1 -
+ pnpm-lock.yaml              | 11 -----------
+ 5 files changed, 2 insertions(+), 32 deletions(-)
+
+diff --git a/electron/package.json b/electron/package.json
+index a7b2bd3e..ce55d877 100644
+--- a/electron/package.json
++++ b/electron/package.json
+@@ -26,7 +26,6 @@
+     "electron-updater": "^6.8.4"
+   },
+   "dependencies": {
+-    "@paymoapp/electron-shutdown-handler": "^1.1.2",
+     "@xhayper/discord-rpc": "^1.3.4",
+     "concurrently": "^9.2.1",
+     "jimp": "0.22.12",
+diff --git a/electron/src/main/app.js b/electron/src/main/app.js
+index 5875d276..682d3bb1 100644
+--- a/electron/src/main/app.js
++++ b/electron/src/main/app.js
+@@ -7,7 +7,6 @@ import Jimp from 'jimp'
+ import fs from 'fs'
+ 
+ import { BrowserWindow, MessageChannelMain, Notification, Tray, Menu, nativeImage, app, dialog, ipcMain, powerMonitor, shell, session } from 'electron'
+-import electronShutdownHandler from '@paymoapp/electron-shutdown-handler'
+ 
+ import { development, getWindowState, saveWindowState, getDefaultBounds } from './util.js'
+ import Discord from './discord.js'
+@@ -157,21 +156,7 @@ export default class App {
+       notification.show()
+     })
+ 
+-    if (process.platform === 'win32') {
+-      app.setAppUserModelId('com.github.rockinchaos.shiru')
+-      // this message usually fires in dev-mode from the parent process
+-      process.on('message', data => {
+-        if (data === 'graceful-exit') this.destroy()
+-      })
+-      electronShutdownHandler.setWindowHandle(this.mainWindow.getNativeWindowHandle())
+-      electronShutdownHandler.blockShutdown('Saving torrent data...')
+-      electronShutdownHandler.on('shutdown', async () => {
+-        await this.destroy()
+-        electronShutdownHandler.releaseShutdown()
+-      })
+-    } else {
+-      process.on('SIGTERM', () => this.destroy())
+-    }
++    process.on('SIGTERM', () => this.destroy())
+ 
+     this.mainWindow.loadURL(development ? 'http://localhost:5000/app.html' : `file://${join(__dirname, '/app.html')}`)
+ 
+diff --git a/electron/webpack.config.cjs b/electron/webpack.config.cjs
+index 716dfcf7..3c9e4d1f 100644
+--- a/electron/webpack.config.cjs
++++ b/electron/webpack.config.cjs
+@@ -78,9 +78,7 @@ module.exports = [
+       path: join(__dirname, 'build'),
+       filename: 'main.js'
+     },
+-    externals: {
+-      '@paymoapp/electron-shutdown-handler': 'require("@paymoapp/electron-shutdown-handler")'
+-    },
++    externals: {},
+     resolve: {
+       aliasFields: [],
+       alias: {
+diff --git a/package.json b/package.json
+index 52de5f3a..470faf9d 100644
+--- a/package.json
++++ b/package.json
+@@ -48,7 +48,6 @@
+       "svelte-keybinds": "patches/svelte-keybinds.patch"
+     },
+     "onlyBuiltDependencies": [
+-      "@paymoapp/electron-shutdown-handler",
+       "bufferutil",
+       "electron",
+       "fs-native-extensions",
+diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
+index c373d877..e774678a 100644
+--- a/pnpm-lock.yaml
++++ b/pnpm-lock.yaml
+@@ -257,9 +257,6 @@ importers:
+ 
+   electron:
+     dependencies:
+-      '@paymoapp/electron-shutdown-handler':
+-        specifier: ^1.1.2
+-        version: 1.1.2
+       '@xhayper/discord-rpc':
+         specifier: ^1.3.4
+         version: 1.3.4(bufferutil@4.0.8)(utf-8-validate@6.0.4)
+@@ -848,9 +845,6 @@ packages:
+   '@paralleldrive/cuid2@2.3.1':
+     resolution: {integrity: sha512-XO7cAxhnTZl0Yggq6jOgjiOHhbgcO4NqFqwSmQpjK3b6TEE6Uj/jfSk6wzYyemh3+I0sHirKSetjQwn5cZktFw==}
+ 
+-  '@paymoapp/electron-shutdown-handler@1.1.2':
+-    resolution: {integrity: sha512-/MIC+wdRlVw1Sm56qJcT17O/KBpQARP2tOcAgg1OKB4W83B9IyBBtIoLXkRlpCOEJnGEleuv5HiSBryUgwbFvQ==}
+-
+   '@peculiar/asn1-cms@2.6.1':
+     resolution: {integrity: sha512-vdG4fBF6Lkirkcl53q6eOdn3XYKt+kJTG59edgRZORlg/3atWWEReRCx5rYE1ZzTTX6vLK5zDMjHh7vbrcXGtw==}
+ 
+@@ -4112,9 +4106,6 @@ packages:
+   node-addon-api@4.3.0:
+     resolution: {integrity: sha512-73sE9+3UaLYYFmDsFZnqCInzPyh3MqIwZO9cw58yIqAZhONrrabrYyYe3TuIqtIiOuTXVhsGau8hcrhhwSsDIQ==}
+ 
+-  node-addon-api@5.1.0:
+-    resolution: {integrity: sha512-eh0GgfEkpnoWDq+VY8OyvYhFEzBk6jIYbRKdIlyTiAXIVJ8PyBaKb0rp7oDtoddbdoHWhq8wwr+XZ81F1rpNdA==}
+-
+   node-addon-api@6.1.0:
+     resolution: {integrity: sha512-+eawOlIgy680F0kBzPUNFhMZGtJ1YmqM6l4+Crf4IkImjYrO/mqPwRMh352g23uIaQKFItcQ64I7KMaJxHgAVA==}
+ 
+@@ -10823,8 +10814,6 @@ snapshots:
+ 
+   node-addon-api@4.3.0: {}
+ 
+-  node-addon-api@5.1.0: {}
+-
+   node-addon-api@6.1.0: {}
+ 
+   node-api-version@0.2.1:
+-- 
+2.53.0
+
diff --git a/pkgs/by-name/sh/shiru/package.nix b/pkgs/by-name/sh/shiru/package.nix
new file mode 100644
index 000000000000..71f050bff3e9
--- /dev/null
+++ b/pkgs/by-name/sh/shiru/package.nix
@@ -0,0 +1,120 @@
+{
+  lib,
+  stdenv,
+  pnpm,
+  nodejs,
+  fetchFromGitHub,
+  python3,
+  electron_39,
+  makeDesktopItem,
+  makeBinaryWrapper,
+  copyDesktopItems,
+  fetchPnpmDeps,
+  pnpmConfigHook,
+  nix-update-script,
+}:
+let
+  electron = electron_39;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "shiru";
+  version = "6.6.0";
+
+  src = fetchFromGitHub {
+    owner = "RockinChaos";
+    repo = "shiru";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-LccI6Z4hhkmzWHt0CKum9giJMVGm3qM0ZKNvChUCYQ4=";
+  };
+
+  patches = [
+    # electron-shutdown-handler is only used on Windows and tries to download
+    # files during build
+    ./0001-Remove-Windows-specific-dep.patch
+  ];
+
+  nativeBuildInputs = [
+    nodejs
+    pnpm
+    pnpmConfigHook
+    python3
+    makeBinaryWrapper
+    copyDesktopItems
+  ];
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs) pname version src;
+    prePnpmInstall = ''
+      cd electron
+    '';
+    fetcherVersion = 3;
+    hash = "sha256-bTo6sEQuUghwm2I99WB7+akL4AOZ1ZN2ovaLWrd5MMg=";
+  };
+
+  buildPhase = ''
+    runHook preBuild
+
+    cd electron
+
+    cp -r ${electron.dist} electron-dist
+    chmod -R u+w electron-dist
+
+    npm run web:build
+
+    ./node_modules/.bin/electron-builder --dir \
+      --c.electronDist=electron-dist \
+      --c.electronVersion=${electron.version}
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/share/lib/shiru"
+    cp -r dist/*-unpacked/{locales,resources{,.pak}} "$out/share/lib/shiru"
+
+    install -Dm644 buildResources/icon.png "$out/share/icons/hicolor/512x512/apps/shiru.png"
+
+    makeWrapper '${electron}/bin/electron' "$out/bin/shiru" \
+      --add-flags "$out/share/lib/shiru/resources/app.asar" \
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ stdenv.cc.cc.lib ]}" \
+      --inherit-argv0
+
+    runHook postInstall
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "shiru";
+      exec = "shiru %U";
+      icon = "shiru";
+      desktopName = "Shiru";
+      genericName = "Personal Media Library";
+      comment = "Manage your personal media library, organize your collection, and stream your content in real time, no waiting required!";
+      categories = [
+        "Video"
+        "AudioVideo"
+      ];
+      keywords = [ "Anime" ];
+      mimeTypes = [ "x-scheme-handler/shiru" ];
+    })
+  ];
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Stream your personal media library in real-time";
+    homepage = "https://github.com/RockinChaos/Shiru";
+    changelog = "https://github.com/RockinChaos/Shiru/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [
+      naomieow
+    ];
+    platforms = [ "x86_64-linux" ];
+    mainProgram = "shiru";
+  };
+})
diff --git a/pkgs/by-name/sh/shogihome/package.nix b/pkgs/by-name/sh/shogihome/package.nix
index 0bc7c9ed2ed8..e7db98e5c729 100644
--- a/pkgs/by-name/sh/shogihome/package.nix
+++ b/pkgs/by-name/sh/shogihome/package.nix
@@ -22,16 +22,16 @@ let
 in
 buildNpmPackage (finalAttrs: {
   pname = "shogihome";
-  version = "1.27.1";
+  version = "1.27.2";
 
   src = fetchFromGitHub {
     owner = "sunfish-shogi";
     repo = "shogihome";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Uns66oj5TGlIgOTayRqFa8wGntbgm9Molerzn5yJWDE=";
+    hash = "sha256-VaHIDhTYcGT4J7ken/Cz0QwSlL42RMcP4lqFR4P7/SM=";
   };
 
-  npmDepsHash = "sha256-xl4B77luiMTT1L7E4FXP3q2lZT2WhUhH9zDu1HYAjQ0=";
+  npmDepsHash = "sha256-2NeiCpcX1j7z+PtIF3euQamVTa+6G4SEHPGk8IVC1Dw=";
 
   postPatch = ''
     substituteInPlace package.json \
diff --git a/pkgs/by-name/si/simple-completion-language-server/package.nix b/pkgs/by-name/si/simple-completion-language-server/package.nix
index 763d3b4689e9..f2cd825097f3 100644
--- a/pkgs/by-name/si/simple-completion-language-server/package.nix
+++ b/pkgs/by-name/si/simple-completion-language-server/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage {
   pname = "simple-completion-language-server";
-  version = "0-unstable-2025-07-29";
+  version = "0-unstable-2026-04-21";
 
   src = fetchFromGitHub {
     owner = "estin";
     repo = "simple-completion-language-server";
-    rev = "cc57b08ebc68805266beacb512a453e16f86bf17";
-    hash = "sha256-TiVzgwsP1KZxTxW71eQyp1bkDnyTaMJdBYmkdvl1RX0=";
+    rev = "f8319589ab87b18f441627999f4a8316dd712234";
+    hash = "sha256-PKJVaj5et+afrMk7x/H/d/ygabjDALGKM3fr/16EKoQ=";
   };
 
-  cargoHash = "sha256-M+kjdT9X69kdZcBHC2ChR7WGgxtcUaU8woE2bqhu8IM=";
+  cargoHash = "sha256-RgRmbQVZK/4U37CO8AjNQOqR/SXvL1TQU03LX7LnqPY=";
 
   buildFeatures = lib.optional withCitation [ "citation" ];
 
diff --git a/pkgs/by-name/su/subxt/package.nix b/pkgs/by-name/su/subxt/package.nix
index 5a04072a41a2..f2dad1fd6e10 100644
--- a/pkgs/by-name/su/subxt/package.nix
+++ b/pkgs/by-name/su/subxt/package.nix
@@ -2,21 +2,20 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
-  cmake,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "subxt";
-  version = "0.44.2";
+  version = "0.50.0";
 
   src = fetchFromGitHub {
     owner = "paritytech";
     repo = "subxt";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-3yTX2H4T0nnA0Kh1Lx1/blK/Edd1ZOHQVEXiiOLxino=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-nMal78+TYZ1f9X/YZhsqOsEIrjxhi9fEcevnQW8u97o=";
   };
 
-  cargoHash = "sha256-zJpzsPHK9Mq0KF0WvbBINxSQVr0m4Z5+M6/nFD8jiMg=";
+  cargoHash = "sha256-sqspcTwODoRzaaUSXT+2yPUTzUqcW1gNu0c1Lv9D1u0=";
 
   # Only build the command line client
   cargoBuildFlags = [
@@ -24,20 +23,21 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "subxt"
   ];
 
-  # Needed by wabt-sys
-  nativeBuildInputs = [ cmake ];
-
   # Requires a running substrate node
   doCheck = false;
 
   meta = {
     homepage = "https://github.com/paritytech/subxt";
-    description = "Submit transactions to a substrate node via RPC";
+    description = "Subxt is a CLI tool for interacting with chains in the Polkadot network";
+    changelog = "https://github.com/paritytech/subxt/releases/tag/${finalAttrs.src.tag}";
     mainProgram = "subxt";
     license = with lib.licenses; [
       gpl3Plus
       asl20
     ];
-    maintainers = [ lib.maintainers.FlorianFranzen ];
+    maintainers = with lib.maintainers; [
+      FlorianFranzen
+      kilyanni
+    ];
   };
 })
diff --git a/pkgs/by-name/sw/swagger-typescript-api/package.nix b/pkgs/by-name/sw/swagger-typescript-api/package.nix
index 564483ef58f0..609e16f551d5 100644
--- a/pkgs/by-name/sw/swagger-typescript-api/package.nix
+++ b/pkgs/by-name/sw/swagger-typescript-api/package.nix
@@ -9,10 +9,10 @@
 }:
 let
   pname = "swagger-typescript-api";
-  version = "13.7.2";
+  version = "13.9.1";
 
   node-modules-hash = {
-    "x86_64-linux" = "sha256-1Wy9RWNvMmxSY72Qcam/jCVwurGk4ms9PTR5tt6t03I=";
+    "x86_64-linux" = "sha256-QxnqTaV5oN5WoYvLzTckWrYAZVAUxTSLYHVTmmqhmgM=";
   };
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "acacode";
     repo = "swagger-typescript-api";
     rev = "v${version}";
-    hash = "sha256-2sAE3wD/vUjaxvlhfrBRSErB3PsjQfi4UAcc4tU0le4=";
+    hash = "sha256-PnQ2aTj8oVUqoqM9voupfBqPu7MZSVflUtuGrXznifo=";
   };
 
   node_modules = stdenv.mkDerivation {
diff --git a/pkgs/by-name/te/teamspeak6-client/package.nix b/pkgs/by-name/te/teamspeak6-client/package.nix
index 62f2db8b663e..f40a42d204e1 100644
--- a/pkgs/by-name/te/teamspeak6-client/package.nix
+++ b/pkgs/by-name/te/teamspeak6-client/package.nix
@@ -36,11 +36,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "teamspeak6-client";
-  version = "6.0.0-beta3.4";
+  version = "6.0.0-beta4";
 
   src = fetchurl {
     url = "https://files.teamspeak-services.com/pre_releases/client/${finalAttrs.version}/teamspeak-client.tar.gz";
-    hash = "sha256-ubpAigtYFwzjI4T8i7pWgAhA1pS9MQBQy63QkkbUvyc=";
+    hash = "sha256-tDMECBWmh4QJzyVdvlkQW7Mqu8Mn6JjFiXMJJS45Efg=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/by-name/up/uptime-kuma/package.nix b/pkgs/by-name/up/uptime-kuma/package.nix
index 8d3f30f7dc24..c498932d617d 100644
--- a/pkgs/by-name/up/uptime-kuma/package.nix
+++ b/pkgs/by-name/up/uptime-kuma/package.nix
@@ -9,16 +9,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "uptime-kuma";
-  version = "2.3.0";
+  version = "2.3.2";
 
   src = fetchFromGitHub {
     owner = "louislam";
     repo = "uptime-kuma";
     tag = finalAttrs.version;
-    hash = "sha256-L/+vadToq9CXz6SZnucIMg4Lf43aZ3OKLVhuFblY7zY=";
+    hash = "sha256-TJCpmUT/E7Il9h7UM1rs2s8l2Vey+X3PZToFLTgxFdA=";
   };
 
-  npmDepsHash = "sha256-kD+nOU+FVdnlVphVJ3FGUjuHf1f5UbSbpq7Cjc1muh4=";
+  npmDepsHash = "sha256-FnUjHi0l/WDBX0T65bomElcEG+mRc81n/s22npeHnlM=";
 
   patches = [
     # Fixes the permissions of the database being not set correctly
diff --git a/pkgs/by-name/ur/uriparser/package.nix b/pkgs/by-name/ur/uriparser/package.nix
index edd664cd811b..fe0deaa66631 100644
--- a/pkgs/by-name/ur/uriparser/package.nix
+++ b/pkgs/by-name/ur/uriparser/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "uriparser";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "uriparser";
     repo = "uriparser";
     tag = "uriparser-${finalAttrs.version}";
-    hash = "sha256-tXEcJ6NAKVoFg/GLkldRcrSlXDcGpvjp7cguM9Xqcps=";
+    hash = "sha256-BM2Nf7iKlS336RG7f+ZKBm/+yru5wB9p2TVdY7kYgKg=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/vi/vivaldi/package.nix b/pkgs/by-name/vi/vivaldi/package.nix
index dd18a2d425b8..0e6a6aba443c 100644
--- a/pkgs/by-name/vi/vivaldi/package.nix
+++ b/pkgs/by-name/vi/vivaldi/package.nix
@@ -67,7 +67,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vivaldi";
-  version = "7.9.3970.60";
+  version = "7.9.3970.64";
 
   suffix =
     {
@@ -80,8 +80,8 @@ stdenv.mkDerivation rec {
     url = "https://downloads.vivaldi.com/stable/vivaldi-stable_${version}-1_${suffix}.deb";
     hash =
       {
-        aarch64-linux = "sha256-2ZI1M1G/l5wRd+vfcc189NWURyVQp05mTCtwk+cEYpU=";
-        x86_64-linux = "sha256-nZn51rotZ8s/tu86OXbBb7LMwqcZPhEvLtfqIOJM1qg=";
+        aarch64-linux = "sha256-51Lsbs1Vv8Qy9aBUxPzfadpKia+PHnBjptHY4LSN1Mo=";
+        x86_64-linux = "sha256-WJn7vmIPJ7/e0UG2uoNedji/Vd0QTY2LNJMBNqTF9Po=";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
diff --git a/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix b/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
index 1caf513cd6e1..c010bf1bc1e8 100644
--- a/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
+++ b/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
@@ -17,17 +17,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "xdg-desktop-portal-cosmic";
-  version = "1.0.10";
+  version = "1.0.12";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "xdg-desktop-portal-cosmic";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-vltoh2n2Tt8TAQdpZDV2woaaacS5Z+o0hDHJfysR4P8=";
+    hash = "sha256-o1H5Cw20sgcE8I5L5u64YM6l+vhlHIcaY6cEH9it0gQ=";
   };
 
-  cargoHash = "sha256-eherqBRuIVcs7ZxYfMyiRC4SUIbPzVUcflScoeKrpVA=";
+  cargoHash = "sha256-/7jxEktXW1+4nFK7ZFUO3oJhmLNuKMwErnqwgjBQiao=";
 
   separateDebugInfo = true;
   strictDeps = true;
diff --git a/pkgs/development/interpreters/php/default.nix b/pkgs/development/interpreters/php/default.nix
index 9908a0b3d1e8..24f3a0b7beb5 100644
--- a/pkgs/development/interpreters/php/default.nix
+++ b/pkgs/development/interpreters/php/default.nix
@@ -77,8 +77,8 @@ in
     hash = "sha256-5phrH9N+slQCEn/kpyeKPgO3+QJbt6S9KSonG9+TD7k=";
   };
   php84 = mkPhp {
-    version = "8.4.20";
-    hash = "sha256-ziXSYQpflSKsj1P7t7goC1wCGZHpvZE3BoycYp2f+1Y=";
+    version = "8.4.21";
+    hash = "sha256-XgvSh/O+Nb9XwhGwEFJ65eEKiBcPluZNM2BE61+u9DA=";
   };
   php85 = mkPhp {
     version = "8.5.6";
diff --git a/pkgs/development/python-modules/aiortc/default.nix b/pkgs/development/python-modules/aiortc/default.nix
index c1111963e9f0..12710d9f4eaf 100644
--- a/pkgs/development/python-modules/aiortc/default.nix
+++ b/pkgs/development/python-modules/aiortc/default.nix
@@ -50,6 +50,8 @@ buildPythonPackage rec {
     dnspython
   ];
 
+  pythonRelaxDeps = [ "av" ];
+
   nativeCheckInputs = [
     numpy
     pytestCheckHook
diff --git a/pkgs/development/python-modules/av/default.nix b/pkgs/development/python-modules/av/default.nix
index a4faab93c6ad..006cd2ee46d0 100644
--- a/pkgs/development/python-modules/av/default.nix
+++ b/pkgs/development/python-modules/av/default.nix
@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
 
@@ -23,16 +22,17 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "av";
-  version = "16.1.0";
+  version = "17.0.1";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "PyAV-Org";
     repo = "PyAV";
-    tag = "v${version}";
-    hash = "sha256-mz0VI72lqtur5HdCkPNxInk0pUWxji0boIZnfvdrxIs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-IS+qSwvpNbhOazkgZh9hzzaTLxSgU7uZjGmaOIkhskc=";
   };
 
   build-system = [
@@ -63,13 +63,17 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  disabledTests = [
+    # network access
+    "test_index_entries_len_webm"
+  ];
+
   __darwinAllowLocalNetworking = true;
 
   pythonImportsCheck = [
     "av"
     "av.audio"
     "av.buffer"
-    "av.bytesource"
     "av.codec"
     "av.container"
     "av._core"
@@ -94,8 +98,8 @@ buildPythonPackage rec {
     description = "Pythonic bindings for FFmpeg";
     mainProgram = "pyav";
     homepage = "https://github.com/PyAV-Org/PyAV";
-    changelog = "https://github.com/PyAV-Org/PyAV/blob/${src.tag}/CHANGELOG.rst";
+    changelog = "https://github.com/PyAV-Org/PyAV/blob/${finalAttrs.src.tag}/CHANGELOG.rst";
     license = lib.licenses.bsd2;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/django-mdeditor/default.nix b/pkgs/development/python-modules/django-mdeditor/default.nix
index 205c71de4f14..d80f497386bd 100644
--- a/pkgs/development/python-modules/django-mdeditor/default.nix
+++ b/pkgs/development/python-modules/django-mdeditor/default.nix
@@ -35,5 +35,9 @@ buildPythonPackage {
     changelog = "https://github.com/pylixm/django-mdeditor/releases";
     license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [ augustebaum ];
+    knownVulnerabilities = [
+      # https://nvd.nist.gov/vuln/detail/CVE-2025-13030
+      "CVE-2025-13030"
+    ];
   };
 }
diff --git a/pkgs/development/python-modules/pysma/default.nix b/pkgs/development/python-modules/pysma/default.nix
index bf743bd24bc4..bd7f782675d0 100644
--- a/pkgs/development/python-modules/pysma/default.nix
+++ b/pkgs/development/python-modules/pysma/default.nix
@@ -14,19 +14,19 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pysma";
-  version = "1.1.1";
+  version = "1.1.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kellerza";
     repo = "pysma";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9y93BQz3x0IAcYhVNmuHN2vqgUu2tqITjoZioR8InjY=";
+    hash = "sha256-0+hnsHFTZHyhtLiYe7V2SjmS6powjgER4azcVTUV0+A=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail "uv-build>=0.9,<0.10" uv-build
+      --replace-fail "uv-build>=0.9,<0.11" uv-build
   '';
 
   build-system = [ uv-build ];
diff --git a/pkgs/development/python-modules/python-discovery/default.nix b/pkgs/development/python-modules/python-discovery/default.nix
index 52f1d8119f4e..702b42bfd543 100644
--- a/pkgs/development/python-modules/python-discovery/default.nix
+++ b/pkgs/development/python-modules/python-discovery/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "python-discovery";
-  version = "1.2.2";
+  version = "1.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tox-dev";
     repo = "python-discovery";
     tag = finalAttrs.version;
-    hash = "sha256-udyPGZ3vz+1nld2m3igLNZ+i1pnutkLeXFpHn738KRQ=";
+    hash = "sha256-PCqE/WwhH+kzWw6Q4L/ZBwgDqHI1G1P8KsMMANO4BIQ=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/schedula/default.nix b/pkgs/development/python-modules/schedula/default.nix
index d43ba5db2c2e..038276e6aff5 100644
--- a/pkgs/development/python-modules/schedula/default.nix
+++ b/pkgs/development/python-modules/schedula/default.nix
@@ -1,6 +1,7 @@
 {
   lib,
   buildPythonPackage,
+  pythonAtLeast,
   fetchFromGitHub,
 
   # build-system
@@ -79,6 +80,21 @@ buildPythonPackage rec {
     # ERROR tests/utils/test_form.py::TestDispatcherForm::test_form1 - ModuleNotFoundError: No module named 'chromedriver_autoinstaller'
     # ERROR tests/utils/test_form.py::TestDispatcherForm::test_form_stripe - ModuleNotFoundError: No module named 'chromedriver_autoinstaller'
     "tests/utils/test_form.py"
+    # requires schedula[form] extras
+    "tests/utils/test_form_items.py"
+  ]
+  ++ lib.optionals (pythonAtLeast "3.14") [
+    # itertools iterators no longer picklable in 3.14 (cpython#101588)
+    "tests/test_dispatcher.py::TestAsyncParallel"
+    "tests/test_dispatcher.py::TestCopyDispatcher::test_copy"
+    "tests/utils/test_blue.py::TestBlueDispatcher::test_blue_io"
+    "tests/utils/test_io.py::TestReadWrite::test_load_dispatcher"
+    "tests/utils/test_io.py::TestReadWrite::test_save_dispatcher"
+    # exception repr format changed in 3.14
+    "tests/test_dispatcher.py::TestDispatch::test_raises"
+    # doctest output drift on 3.14
+    "tests/test_dispatcher.py::TestDoctest::runTest"
+    "tests/utils/test_io.py::TestDoctest::runTest"
   ];
 
   pythonImportsCheck = [ "schedula" ];
diff --git a/pkgs/development/python-modules/weaviate-client/default.nix b/pkgs/development/python-modules/weaviate-client/default.nix
index d5a886d223cb..86d56facfead 100644
--- a/pkgs/development/python-modules/weaviate-client/default.nix
+++ b/pkgs/development/python-modules/weaviate-client/default.nix
@@ -43,6 +43,7 @@ buildPythonPackage rec {
     "httpx"
     "validators"
     "authlib"
+    "grpcio"
     "protobuf"
   ];
 
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 8f07e6479bb3..ca2ca6fbb412 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -18,7 +18,7 @@ in
 buildLinux (
   args
   // rec {
-    version = "7.0.3";
+    version = "7.0.5";
     pname = "linux-zen";
     modDirVersion = lib.versions.pad 3 "${version}-${suffix}";
     isZen = true;
@@ -27,7 +27,7 @@ buildLinux (
       owner = "zen-kernel";
       repo = "zen-kernel";
       rev = "v${version}-${suffix}";
-      sha256 = "16qbgrqq8wkp5gyy60n6rabpbyv47imaw9pnndg2mzisbb3cb808";
+      sha256 = "1xnxjknlsx4fr6jf62ncvnad7r7nxkjpkaj9fdj0fqq8h4bpkhh1";
     };
 
     # This is based on the following source:
diff --git a/pkgs/servers/home-assistant/themes/README.md b/pkgs/servers/home-assistant/themes/README.md
new file mode 100644
index 000000000000..0e43f6e4f4ba
--- /dev/null
+++ b/pkgs/servers/home-assistant/themes/README.md
@@ -0,0 +1,13 @@
+# Packaging guidelines
+
+## isHomeAssistantTheme
+
+The nixos module checks for `passthru.isHomeAssistantTheme` on every
+package passed to `services.home-assistant.themes`, and rejects packages
+that don't have it set. Mark a theme package like this:
+
+```nix
+{ passthru.isHomeAssistantTheme = true; }
+```
+
+Themes are expected to install their `.yaml` files into `$out/themes/`.
diff --git a/pkgs/servers/home-assistant/themes/material-you-theme/package.nix b/pkgs/servers/home-assistant/themes/material-you-theme/package.nix
new file mode 100644
index 000000000000..0d9fe767c0e8
--- /dev/null
+++ b/pkgs/servers/home-assistant/themes/material-you-theme/package.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+}:
+
+buildNpmPackage rec {
+  pname = "material-you-theme";
+  version = "5.0.1";
+
+  src = fetchFromGitHub {
+    owner = "Nerwyn";
+    repo = "material-you-theme";
+    tag = version;
+    hash = "sha256-xJXhvKwp/l08/ZWi3OcGPmCdsUiMjBDwrKz5OIpD2t8=";
+  };
+
+  npmDepsHash = "sha256-g133Je2Md4nKLZucSeM6TVEdaCsR2Ja1Aj2kf7JQk6w=";
+
+  installPhase = ''
+    runHook preInstall
+    install -Dt $out/themes themes/material_you.yaml
+    runHook postInstall
+  '';
+
+  passthru.isHomeAssistantTheme = true;
+
+  meta = {
+    description = "Material Design 3 Theme for Home Assistant";
+    homepage = "https://github.com/Nerwyn/material-you-theme";
+    changelog = "https://github.com/Nerwyn/material-you-theme/releases/tag/${src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ jpinz ];
+  };
+}
diff --git a/pkgs/stdenv/darwin/default.nix b/pkgs/stdenv/darwin/default.nix
index 385a315f9c87..3cf47e5a7334 100644
--- a/pkgs/stdenv/darwin/default.nix
+++ b/pkgs/stdenv/darwin/default.nix
@@ -261,7 +261,6 @@ let
     inherit (prevStage."llvmPackages_${llvmVersion}") compiler-rt libcxx;
   };
   llvmLibrariesDarwinDepsNoCC = prevStage: { inherit (prevStage.darwin) libcxx; };
-  llvmLibrariesDeps = _: { };
 
   llvmToolsPackages = prevStage: {
     inherit (prevStage."llvmPackages_${llvmVersion}")
@@ -666,7 +665,6 @@ assert bootstrapTools.passthru.isFromBootstrapFiles or false; # sanity check
     assert allDeps isBuiltByBootstrapFilesCompiler [
       (stage1Packages prevStage)
       (darwinPackages prevStage)
-      (llvmLibrariesDeps prevStage)
       (llvmToolsDeps prevStage)
       (sdkPackages prevStage)
       (sdkDarwinPackages prevStage)
@@ -739,7 +737,6 @@ assert bootstrapTools.passthru.isFromBootstrapFiles or false; # sanity check
     ];
 
     assert allDeps isBuiltByNixpkgsCompiler [
-      (llvmLibrariesDeps prevStage)
       (llvmLibrariesPackages prevStage)
     ];
 
@@ -757,7 +754,6 @@ assert bootstrapTools.passthru.isFromBootstrapFiles or false; # sanity check
           (stage1Packages prevStage)
           (disallowedPackages prevStage)
           (bintoolsPackages prevStage)
-          (llvmLibrariesDeps prevStage)
           (llvmToolsDeps prevStage)
           {
             inherit (prevStage) ccWrapperStdenv;
@@ -818,7 +814,6 @@ assert bootstrapTools.passthru.isFromBootstrapFiles or false; # sanity check
     ];
 
     assert allDeps isBuiltByNixpkgsCompiler [
-      (llvmLibrariesDeps prevStage)
       (llvmLibrariesPackages prevStage)
       (sdkPackages prevStage)
       (sdkDarwinPackages prevStage)
@@ -837,7 +832,6 @@ assert bootstrapTools.passthru.isFromBootstrapFiles or false; # sanity check
         mergeDisjointAttrs [
           (stage1Packages prevStage)
           (disallowedPackages prevStage)
-          (llvmLibrariesDeps prevStage)
           (sdkPackages prevStage)
           {
             inherit (prevStage) ccWrapperStdenv;
@@ -894,7 +888,6 @@ assert bootstrapTools.passthru.isFromBootstrapFiles or false; # sanity check
 
     assert allDeps isBuiltByNixpkgsCompiler [
       (bintoolsPackages prevStage)
-      (llvmLibrariesDeps prevStage)
       (llvmLibrariesPackages prevStage)
       (llvmToolsDeps prevStage)
       (llvmToolsPackages prevStage)
@@ -915,7 +908,6 @@ assert bootstrapTools.passthru.isFromBootstrapFiles or false; # sanity check
         mergeDisjointAttrs [
           (bintoolsPackages prevStage)
           (disallowedPackages prevStage)
-          (llvmLibrariesDeps prevStage)
           (llvmToolsDeps prevStage)
           (sdkPackages prevStage)
           (sdkPackagesNoCC prevStage)
@@ -965,7 +957,6 @@ assert bootstrapTools.passthru.isFromBootstrapFiles or false; # sanity check
       (lib.filterAttrs (_: pkg: lib.getName pkg != "pkg-config-wrapper") (stage1Packages prevStage)) # pkg-config is a wrapper
       (bintoolsPackages prevStage)
       (darwinPackages prevStage)
-      (llvmLibrariesDeps prevStage)
       (llvmLibrariesPackages prevStage)
       (llvmToolsDeps prevStage)
       (llvmToolsPackages prevStage)
@@ -1099,7 +1090,6 @@ assert bootstrapTools.passthru.isFromBootstrapFiles or false; # sanity check
         overrides =
           self: super:
           mergeDisjointAttrs [
-            (llvmLibrariesDeps prevStage)
             (llvmToolsDeps prevStage)
             (sdkPackages prevStage)
             (sdkPackagesNoCC prevStage)
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index 12a6dffb426f..e6df0134b234 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -13,6 +13,7 @@ stdenv:
 let
   # Lib attributes are inherited to the lexical scope for performance reasons.
   inherit (lib)
+    all
     assertMsg
     attrNames
     concatLists
@@ -31,6 +32,7 @@ let
     isDerivation
     isInt
     isList
+    isPath
     isString
     mapAttrs
     mapNullable
@@ -44,7 +46,6 @@ let
     toFunction
     unique
     zipAttrsWith
-    isPath
     seq
     ;
 
@@ -226,10 +227,12 @@ let
   # TODO(@Ericson2314): Make always true and remove / resolve #178468
   defaultStrictDeps = if config.strictDepsByDefault then true else hostPlatform != buildPlatform;
 
+  isSingularDependency = dep: dep == null || isDerivation dep || isString dep || isPath dep;
+
   canExecuteHostOnBuild = buildPlatform.canExecute hostPlatform;
-  defaultHardeningFlags =
-    (if stdenvHasCC then stdenv.cc else { }).defaultHardeningFlags or knownHardeningFlags;
-  stdenvHostSuffix = optionalString (hostPlatform != buildPlatform) "-${hostPlatform.config}";
+  defaultHardeningFlags = stdenv.cc.defaultHardeningFlags or knownHardeningFlags;
+  hostSuffixNecessary = hostPlatform != buildPlatform && stdenvHasCC;
+  stdenvHostSuffix = "-${hostPlatform.config}";
   stdenvStaticMarker = optionalString isStatic "-static";
   userHook = config.stdenv.userHook or null;
 
@@ -247,6 +250,14 @@ let
     );
   gccArchFeature = [ "gccarch-${buildPlatform.gcc.arch}" ];
 
+  cachedOutputChecks = {
+    out = { };
+  };
+  debugCachedOutputChecks = {
+    out = { };
+    debug = { };
+  };
+
   # Turn a derivation into its outPath without a string context attached.
   # See the comment at the usage site.
   unsafeDerivationToUntrackedOutpath =
@@ -396,20 +407,7 @@ let
           } requires __structuredAttrs if {dis,}allowedRequisites or {dis,}allowedReferences is set"
         else
           actualValue;
-      outputs' = outputs ++ optional separateDebugInfo' "debug";
-
-      noNonNativeDeps =
-        (
-          depsBuildTarget
-          ++ depsBuildTargetPropagated
-          ++ depsHostHost
-          ++ depsHostHostPropagated
-          ++ buildInputs
-          ++ propagatedBuildInputs
-          ++ depsTargetTarget
-          ++ depsTargetTargetPropagated
-        ) == [ ];
-      dontAddHostSuffix = attrs ? outputHash && !noNonNativeDeps || !stdenvHasCC;
+      outputs' = if separateDebugInfo' then outputs ++ [ "debug" ] else outputs;
 
       concretizeFlagImplications =
         flag: impliesFlags: list:
@@ -438,17 +436,24 @@ let
       checkDependencyList = checkDependencyList' [ ];
       checkDependencyList' =
         positions: name: deps:
-        seq (foldl' (
-          index: dep:
-          if dep == null || isDerivation dep || isString dep || isPath dep then
-            index + 1
-          else if isList dep then
-            seq (checkDependencyList' ([ index ] ++ positions) name dep) (index + 1)
-          else
-            throw "Dependency is not of a valid type: ${
-              concatMapStrings (ix: "element ${toString ix} of ") ([ index ] ++ positions)
-            }${name} for ${attrs.name or attrs.pname}"
-        ) 1 deps) deps;
+        if all isSingularDependency deps then
+          deps
+        else
+          # iterate again with the index if an invalid type was passed, or we
+          # need to recurse into a sublist. making sublists take longer is
+          # worth it, since nobody uses them and handling them makes normal
+          # dependencies slower
+          seq (foldl' (
+            index: dep:
+            if isSingularDependency dep then
+              index + 1
+            else if isList dep then
+              seq (checkDependencyList' ([ index ] ++ positions) name dep) (index + 1)
+            else
+              throw "Dependency is not of a valid type: ${
+                concatMapStrings (ix: "element ${toString ix} of ") ([ index ] ++ positions)
+              }${name} for ${attrs.name or attrs.pname}"
+          ) 1 deps) deps;
     in
     if erroneousHardeningFlags != [ ] then
       abort (
@@ -477,24 +482,44 @@ let
 
         outputs = outputs';
 
-        buildBuildOutputs = map (drv: getDev drv.__spliced.buildBuild or drv) (
-          checkDependencyList "depsBuildBuild" depsBuildBuild
-        );
-        buildHostOutputs = map (drv: getDev drv.__spliced.buildHost or drv) (
-          checkDependencyList "nativeBuildInputs" nativeBuildInputs'
-        );
-        buildTargetOutputs = map (drv: getDev drv.__spliced.buildTarget or drv) (
-          checkDependencyList "depsBuildTarget" depsBuildTarget
-        );
-        hostHostOutputs = map (drv: getDev drv.__spliced.hostHost or drv) (
-          checkDependencyList "depsHostHost" depsHostHost
-        );
-        hostTargetOutputs = map (drv: getDev drv.__spliced.hostTarget or drv) (
-          checkDependencyList "buildInputs" buildInputs'
-        );
-        targetTargetOutputs = map (drv: getDev drv.__spliced.targetTarget or drv) (
-          checkDependencyList "depsTargetTarget" depsTargetTarget
-        );
+        buildBuildOutputs =
+          if depsBuildBuild == [ ] then
+            [ ]
+          else
+            map (drv: getDev drv.__spliced.buildBuild or drv) (
+              checkDependencyList "depsBuildBuild" depsBuildBuild
+            );
+        buildHostOutputs =
+          if nativeBuildInputs' == [ ] then
+            [ ]
+          else
+            map (drv: getDev drv.__spliced.buildHost or drv) (
+              checkDependencyList "nativeBuildInputs" nativeBuildInputs'
+            );
+        buildTargetOutputs =
+          if depsBuildTarget == [ ] then
+            [ ]
+          else
+            map (drv: getDev drv.__spliced.buildTarget or drv) (
+              checkDependencyList "depsBuildTarget" depsBuildTarget
+            );
+        hostHostOutputs =
+          if depsHostHost == [ ] then
+            [ ]
+          else
+            map (drv: getDev drv.__spliced.hostHost or drv) (checkDependencyList "depsHostHost" depsHostHost);
+        hostTargetOutputs =
+          if buildInputs' == [ ] then
+            [ ]
+          else
+            map (drv: getDev drv.__spliced.hostTarget or drv) (checkDependencyList "buildInputs" buildInputs');
+        targetTargetOutputs =
+          if depsTargetTarget == [ ] then
+            [ ]
+          else
+            map (drv: getDev drv.__spliced.targetTarget or drv) (
+              checkDependencyList "depsTargetTarget" depsTargetTarget
+            );
         allDependencies = concatLists [
           buildBuildOutputs
           buildHostOutputs
@@ -504,24 +529,48 @@ let
           targetTargetOutputs
         ];
 
-        propagatedBuildBuildOutputs = map (drv: getDev drv.__spliced.buildBuild or drv) (
-          checkDependencyList "depsBuildBuildPropagated" depsBuildBuildPropagated
-        );
-        propagatedBuildHostOutputs = map (drv: getDev drv.__spliced.buildHost or drv) (
-          checkDependencyList "propagatedNativeBuildInputs" propagatedNativeBuildInputs
-        );
-        propagatedBuildTargetOutputs = map (drv: getDev drv.__spliced.buildTarget or drv) (
-          checkDependencyList "depsBuildTargetPropagated" depsBuildTargetPropagated
-        );
-        propagatedHostHostOutputs = map (drv: getDev drv.__spliced.hostHost or drv) (
-          checkDependencyList "depsHostHostPropagated" depsHostHostPropagated
-        );
-        propagatedHostTargetOutputs = map (drv: getDev drv.__spliced.hostTarget or drv) (
-          checkDependencyList "propagatedBuildInputs" propagatedBuildInputs
-        );
-        propagatedTargetTargetOutputs = map (drv: getDev drv.__spliced.targetTarget or drv) (
-          checkDependencyList "depsTargetTargetPropagated" depsTargetTargetPropagated
-        );
+        propagatedBuildBuildOutputs =
+          if depsBuildBuildPropagated == [ ] then
+            [ ]
+          else
+            map (drv: getDev drv.__spliced.buildBuild or drv) (
+              checkDependencyList "depsBuildBuildPropagated" depsBuildBuildPropagated
+            );
+        propagatedBuildHostOutputs =
+          if propagatedNativeBuildInputs == [ ] then
+            [ ]
+          else
+            map (drv: getDev drv.__spliced.buildHost or drv) (
+              checkDependencyList "propagatedNativeBuildInputs" propagatedNativeBuildInputs
+            );
+        propagatedBuildTargetOutputs =
+          if depsBuildTargetPropagated == [ ] then
+            [ ]
+          else
+            map (drv: getDev drv.__spliced.buildTarget or drv) (
+              checkDependencyList "depsBuildTargetPropagated" depsBuildTargetPropagated
+            );
+        propagatedHostHostOutputs =
+          if depsHostHostPropagated == [ ] then
+            [ ]
+          else
+            map (drv: getDev drv.__spliced.hostHost or drv) (
+              checkDependencyList "depsHostHostPropagated" depsHostHostPropagated
+            );
+        propagatedHostTargetOutputs =
+          if propagatedBuildInputs == [ ] then
+            [ ]
+          else
+            map (drv: getDev drv.__spliced.hostTarget or drv) (
+              checkDependencyList "propagatedBuildInputs" propagatedBuildInputs
+            );
+        propagatedTargetTargetOutputs =
+          if depsTargetTargetPropagated == [ ] then
+            [ ]
+          else
+            map (drv: getDev drv.__spliced.targetTarget or drv) (
+              checkDependencyList "depsTargetTargetPropagated" depsTargetTargetPropagated
+            );
         allPropagatedDependencies = concatLists [
           propagatedBuildBuildOutputs
           propagatedBuildHostOutputs
@@ -539,7 +588,22 @@ let
               # suffix. But we have some weird ones with run-time deps that are
               # just used for their side-affects. Those might as well since the
               # hash can't be the same. See #32986.
-              hostSuffix = optionalString (!dontAddHostSuffix) stdenvHostSuffix;
+              hostSuffix = optionalString (
+                hostSuffixNecessary
+                && (
+                  !(attrs ? outputHash)
+                  ||
+                    depsBuildTarget == [ ]
+                    && depsBuildTargetPropagated == [ ]
+                    && depsHostHost == [ ]
+                    && depsHostHostPropagated == [ ]
+                    && buildInputs == [ ]
+                    && propagatedBuildInputs == [ ]
+                    && depsTargetTarget == [ ]
+                    && depsTargetTargetPropagated == [ ]
+
+                )
+              ) stdenvHostSuffix;
 
               # Disambiguate statically built packages. This was originally
               # introduce as a means to prevent nix-env to get confused between
@@ -719,31 +783,42 @@ let
               attrsOutputChecks = makeOutputChecks attrs;
               attrsOutputChecksFiltered = filterAttrs (_: v: v != null) attrsOutputChecks;
             in
-            builtins.listToAttrs (
-              map (name: {
-                inherit name;
-                value =
-                  let
-                    raw = zipAttrsWith (_: concatLists) [
-                      attrsOutputChecksFiltered
-                      (makeOutputChecks attrs.outputChecks.${name} or { })
-                    ];
-                  in
-                  # separateDebugInfo = true will put all sorts of files in
-                  # the debug output which could carry references, but
-                  # that's "normal". Notably it symlinks to the source.
-                  # So disable reference checking for the debug output
-                  if separateDebugInfo' && name == "debug" then
-                    removeAttrs raw [
-                      "allowedReferences"
-                      "allowedRequisites"
-                      "disallowedReferences"
-                      "disallowedRequisites"
-                    ]
-                  else
-                    raw;
-              }) outputs
-            );
+            # to avoid the listToAttrs in most common situations, we replicate
+            # what it would produce for most derivations. this can be improved
+            # in the future at the cost of a mass rebuild - empty attrsets for
+            # each output is a noop
+            if
+              !attrs ? outputs
+              && !attrs ? outputChecks
+              && (attrsOutputChecks == { } || attrsOutputChecksFiltered == { })
+            then
+              if separateDebugInfo' then debugCachedOutputChecks else cachedOutputChecks
+            else
+              builtins.listToAttrs (
+                map (name: {
+                  inherit name;
+                  value =
+                    let
+                      raw = zipAttrsWith (_: concatLists) [
+                        attrsOutputChecksFiltered
+                        (makeOutputChecks (attrs.outputChecks.${name} or { }))
+                      ];
+                    in
+                    # separateDebugInfo = true will put all sorts of files in
+                    # the debug output which could carry references, but
+                    # that's "normal". Notably it symlinks to the source.
+                    # So disable reference checking for the debug output
+                    if separateDebugInfo' && name == "debug" then
+                      removeAttrs raw [
+                        "allowedReferences"
+                        "allowedRequisites"
+                        "disallowedReferences"
+                        "disallowedRequisites"
+                      ]
+                    else
+                      raw;
+                }) outputs
+              );
         };
       in
       derivationArg;
@@ -806,9 +881,8 @@ let
       );
 
     let
-      env' = env // {
-        ${if meta ? mainProgram then "NIX_MAIN_PROGRAM" else null} = meta.mainProgram;
-      };
+      env' =
+        if attrs ? meta.mainProgram then env // { NIX_MAIN_PROGRAM = attrs.meta.mainProgram; } else env;
 
       derivationArg = makeDerivationArgument (
         removeAttrs attrs [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5332f7af0131..548a7ae256d8 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7931,6 +7931,13 @@ with pkgs;
     )
   );
 
+  home-assistant-themes = lib.recurseIntoAttrs (
+    lib.packagesFromDirectoryRecursive {
+      inherit callPackage;
+      directory = ../servers/home-assistant/themes;
+    }
+  );
+
   home-assistant-cli = callPackage ../servers/home-assistant/cli.nix { };
 
   _surrealdbPackage = ../by-name/su/surrealdb/package.nix;