diff --git a/doc/redirects.json b/doc/redirects.json
index 36ad286f9413..5a467f347476 100644
--- a/doc/redirects.json
+++ b/doc/redirects.json
@@ -962,6 +962,9 @@
   "var-stdenv-enableParallelBuilding": [
     "index.html#var-stdenv-enableParallelBuilding"
   ],
+  "var-stdenv-__structuredAttrs": [
+    "index.html#var-stdenv-__structuredAttrs"
+  ],
   "mkderivation-recursive-attributes": [
     "index.html#mkderivation-recursive-attributes"
   ],
diff --git a/doc/stdenv/stdenv.chapter.md b/doc/stdenv/stdenv.chapter.md
index 6cce806b5c8c..afcc6cf807c1 100644
--- a/doc/stdenv/stdenv.chapter.md
+++ b/doc/stdenv/stdenv.chapter.md
@@ -511,6 +511,30 @@ If set to `true`, `stdenv` will pass specific flags to `make` and other build to
 
 Unless set to `false`, some build systems with good support for parallel building including `cmake`, `meson`, and `qmake` will set it to `true`.
 
+#### `__structuredAttrs` {#var-stdenv-__structuredAttrs}
+
+`__structuredAttrs` defines how derivation attributes are passed to the builder.
+
+If enabled, a shell script and a JSON representation of the derivation attributes are created.
+The environment variables {env}`NIX_ATTRS_SH_FILE` and {env}`NIX_ATTRS_JSON_FILE` point to the exact location of these files.
+
+Attributes intended to be _exported_ as environment variables must be defined in the `env` attribute.
+Attributes that are _local_ to the buildscript should be defined outside of `env`, to benefit from structured shell variables.
+
+::: {.important}
+`__structuredAttrs` is a complete replacement for the way attributes are handled currently, and is the preferred default.
+
+`passAsFile` is disabled when `__structuredAttrs` is enabled, since {env}`NIX_ATTRS_JSON_FILE` can be read from instead.
+
+All new top level packages must enable `__structuredAttrs`.
+
+:::
+
+See the upstream nix documentation for more detail:
+  - [Advanced Derivation Attributes](https://nix.dev/manual/nix/2.34/language/advanced-attributes.html#adv-attr-structuredAttrs)
+  - [Builder Execution](https://nix.dev/manual/nix/2.34/store/building.html#builder-execution)
+  - [Structured Attributes](https://nix.dev/manual/nix/2.34/store/derivation/#structured-attrs)
+
 ### Fixed-point arguments of `mkDerivation` {#mkderivation-recursive-attributes}
 
 If you pass a function to `mkDerivation`, it will call the function with an argument that represents the final state of the package: the return value of the function itself, with any overrides applied, as the function is reinvoked by any `overrideAttrs` calls. For example:
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index ff0ab4fbc83e..af556dba5f73 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -8827,6 +8827,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  mellow-nvim = buildVimPlugin {
+    pname = "mellow.nvim";
+    version = "0-unstable-2026-03-30";
+    src = fetchFromGitHub {
+      owner = "mellow-theme";
+      repo = "mellow.nvim";
+      rev = "6273b7f0ddf6ac2b75021b3bc0bd8b3305cfeef1";
+      hash = "sha256-0w4gPMXz3ZlSgt9Pffjy1D5aplog6MD1aKvqObAhqOI=";
+    };
+    meta.homepage = "https://github.com/mellow-theme/mellow.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   messenger-nvim = buildVimPlugin {
     pname = "messenger.nvim";
     version = "0-unstable-2024-07-18";
@@ -11350,6 +11363,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  nvim-dap-docker = buildVimPlugin {
+    pname = "nvim-dap-docker";
+    version = "0.2.0-unstable-2026-04-15";
+    src = fetchFromGitHub {
+      owner = "docker";
+      repo = "nvim-dap-docker";
+      rev = "a7a6d22b786bff09c382d721d2d065fdd64a58ee";
+      hash = "sha256-5uHdDTVdfdJk6WLM6gvVDgEndFkP9SmqrqhHzaalH/k=";
+    };
+    meta.homepage = "https://github.com/docker/nvim-dap-docker/";
+    meta.hydraPlatforms = [ ];
+  };
+
   nvim-dap-go = buildVimPlugin {
     pname = "nvim-dap-go";
     version = "0-unstable-2025-07-11";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 0e25e5f7fb0a..69d7a5d33fb5 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -678,6 +678,7 @@ https://github.com/vim-scripts/mayansmoke/,,
 https://github.com/ravitemer/mcphub.nvim/,HEAD,
 https://github.com/chikamichi/mediawiki.vim/,HEAD,
 https://github.com/savq/melange-nvim/,,
+https://github.com/mellow-theme/mellow.nvim/,HEAD,
 https://github.com/lsig/messenger.nvim/,HEAD,
 https://github.com/xero/miasma.nvim/,,
 https://github.com/dasupradyumna/midnight.nvim/,,
@@ -872,6 +873,7 @@ https://github.com/andythigpen/nvim-coverage/,HEAD,
 https://github.com/ya2s/nvim-cursorline/,,
 https://codeberg.org/mfussenegger/nvim-dap/,,
 https://github.com/jedrzejboczar/nvim-dap-cortex-debug/,HEAD,
+https://github.com/docker/nvim-dap-docker/,HEAD,
 https://github.com/leoluz/nvim-dap-go/,HEAD,
 https://github.com/julianolf/nvim-dap-lldb/,HEAD,
 https://codeberg.org/mfussenegger/nvim-dap-python/,HEAD,
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 4592eed3f5bd..427ed393fbae 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1492,8 +1492,8 @@ let
         mktplcRef = {
           publisher = "editorconfig";
           name = "editorconfig";
-          version = "0.18.1";
-          hash = "sha256-pFd1CTJL3xQ3HHzQs3f4R5f6xlCghNh8Kv+3AT/Qrqo=";
+          version = "0.18.2";
+          hash = "sha256-y8A3D/IEvBbYSj7mgwU2/AQ1WFb6DolasGThoDz8uEo=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/EditorConfig.EditorConfig/changelog";
@@ -2308,8 +2308,8 @@ let
         mktplcRef = {
           name = "vscode-vibrancy-continued";
           publisher = "illixion";
-          version = "1.1.73";
-          hash = "sha256-hQKkqZi8fQoxVzgpg/JE4zPFR+ldi5eBYpgiqbx7OXo=";
+          version = "1.1.75";
+          hash = "sha256-49svwafMoAErwX3K/37IJ8fKx+9FgSpOqj6QPc7jpKs=";
         };
         meta = {
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=illixion.vscode-vibrancy-continued";
diff --git a/pkgs/applications/editors/vscode/extensions/yzane.markdown-pdf/default.nix b/pkgs/applications/editors/vscode/extensions/yzane.markdown-pdf/default.nix
index 8022813e9931..c17d08d1d351 100644
--- a/pkgs/applications/editors/vscode/extensions/yzane.markdown-pdf/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/yzane.markdown-pdf/default.nix
@@ -10,8 +10,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "markdown-pdf";
     publisher = "yzane";
-    version = "1.5.0";
-    hash = "sha256-aiifZgHXC4GUEbkKAbLc0p/jUZxp1jF/J1Y/KIyvLIE=";
+    version = "2.0.1";
+    hash = "sha256-XykOUbCiTVtfmp5H9UC4gFPBxmrIJR7jv9VvLljOSM0=";
   };
   nativeBuildInputs = [
     jq
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index 3484d1ada914..123eacbcdc95 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,15 +1,15 @@
 {
   "chromium": {
-    "version": "147.0.7727.55",
+    "version": "147.0.7727.101",
     "chromedriver": {
-      "version": "147.0.7727.56",
-      "hash_darwin": "sha256-AbHim5zUBLMqlSQgsx0PofidANxk8kSDmQfhLG5xjXM=",
-      "hash_darwin_aarch64": "sha256-9cnKUiay2l5Ti6TC+u7eUKS4VwYNxI50qXfOJxhsxNI="
+      "version": "147.0.7727.102",
+      "hash_darwin": "sha256-OI5e9h2sxF5BtStqxCFQaOZWgZusw/BzjuqSUKPIL2Y=",
+      "hash_darwin_aarch64": "sha256-uE7rgMAZrk4kyafAGqIZa2z/CgLcnqhptkcSXUvBQZc="
     },
     "deps": {
       "depot_tools": {
-        "rev": "4ce8ba39a3488397a2d1494f167020f21de502f3",
-        "hash": "sha256-WTzjmLFjh1yDDEvYE7Qfx8aBxMLdATx14+Jprwh8ZgQ="
+        "rev": "b9d2b54daea64fa757df5ba737e611b691dc6201",
+        "hash": "sha256-GKm6qIrlXLTBvlY+BcXFEL4hR5T63sXUkP0i1vATCAc="
       },
       "gn": {
         "version": "0-unstable-2026-03-05",
@@ -21,8 +21,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "7dc2b8f6f651b42c0a8f3634c9feb5e0b6b25c91",
-        "hash": "sha256-mAauWiP5AlyzoRFOSGA71ljtZ9MtYLKtRlSolCA/spE=",
+        "rev": "56536d2a8034c51b0e68e1a0483ab9f1a0165ae3",
+        "hash": "sha256-94TMvPkcWm+IEVYwTh+m1ys5du75bvJcc1RpkSKpAwc=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -92,8 +92,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "401e94882e22cf2aa7af649b92ab123eaa329321",
-        "hash": "sha256-WD8GaB8LYhICdHZ+meCXSmLylAcISzEaZj06g+z1sfw="
+        "rev": "cbc4f074126e6f1acf72ad620a28cd4a8dd86f2a",
+        "hash": "sha256-MUgLUj2L0vmpAoxt/TJy1clsJfvYkQqe3Xm2+e4Y6tw="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -132,8 +132,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "3ab1df504f1af37a64f8d3949e77b0868e154894",
-        "hash": "sha256-wWoXEvgROx5FLx4nnvaiEW7N9q5VibulffWwCkkEXOs="
+        "rev": "2c681aed02b0add6bcf6724175660c4b35ece843",
+        "hash": "sha256-io3X9zu6tHgqJGXjygUXMa98rXELRNl6Y330U2nRc/M="
       },
       "src/third_party/dawn/third_party/glfw": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -427,8 +427,8 @@
       },
       "src/third_party/libaom/source/libaom": {
         "url": "https://aomedia.googlesource.com/aom.git",
-        "rev": "9dd1b8af51cfd431cbcdeebc95256c0ec6b249eb",
-        "hash": "sha256-IX9mgT9f8fyAd0e1HzBNDE6tNAK4JC+OVqQLJIsvMY0="
+        "rev": "ab9876a5983227865ee26e91caac87c6b8750e27",
+        "hash": "sha256-V40GL7fKj1qratP0KcrhedEPDIsg0XVb3ha5nroM0ws="
       },
       "src/third_party/crabbyavif/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git",
@@ -542,8 +542,8 @@
       },
       "src/third_party/libvpx/source/libvpx": {
         "url": "https://chromium.googlesource.com/webm/libvpx.git",
-        "rev": "9a2d3d1f46afbdfa9b9820a9fd3aacb084e65e2f",
-        "hash": "sha256-9OkXFvBDfh/NFA96IQzaJcXSKSKW6tBN/HJSAwAr3S8="
+        "rev": "aec2a6f1cd6e3d9e8cf5d9682fcb8a442799bd22",
+        "hash": "sha256-PNreh1VisA46I0WZqq8wZRCjbQRiVMxbL5Gl2Bfzo3M="
       },
       "src/third_party/libwebm/source": {
         "url": "https://chromium.googlesource.com/webm/libwebm.git",
@@ -607,8 +607,8 @@
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "f99c212599bb85ce2e60936099f829cbcc3d4f5c",
-        "hash": "sha256-jq5qVIRWmC1xTvV/YwaosJMQH3XpS2N6Xn601uUPFkc="
+        "rev": "e5bafd3be58c26673576fd5bb5cbf413b485de5b",
+        "hash": "sha256-umtG2n6kWYD0hT44GpmnwUVztkZ0RtQDV0h0+4CTC9w="
       },
       "src/third_party/perfetto": {
         "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
@@ -657,8 +657,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "abbe599fb3c0ef2fa82bfadbb0ddcd321f22faf0",
-        "hash": "sha256-QR0R8gwDh6m4RCCCj0EJ/oQQd/mHdUkOVSO8mg74WkE="
+        "rev": "f8cd2da0256752afb0059bf17e4bf2bec422967e",
+        "hash": "sha256-dtSWBpCaewkKMW3Jc1PNDQh0jSQHIPduaXsIU9rcTa0="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -822,8 +822,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "0cd69a9ba82925f5eb2c91376c4e7ba0da9dd445",
-        "hash": "sha256-PKaDXkDkdUVBlcXRmlfWjd5tqvLTCywhC7KdP/xp5NM="
+        "rev": "c207e34c08865143dc6774c1c624f3cea07f7420",
+        "hash": "sha256-5rc28tPK9mOJDO3HA3F1ZgsRQmWXhoLZGeKTzxWSISw="
       }
     }
   },
diff --git a/pkgs/applications/networking/browsers/chromium/update.mjs b/pkgs/applications/networking/browsers/chromium/update.mjs
index 9aab0753db78..4c2f3e44c520 100755
--- a/pkgs/applications/networking/browsers/chromium/update.mjs
+++ b/pkgs/applications/networking/browsers/chromium/update.mjs
@@ -72,7 +72,11 @@ for (const attr_path of Object.keys(lockfile)) {
       DEPS: {},
     }
 
-    const depot_tools = await fetch_depot_tools(chromium_rev, lockfile_initial[attr_path].deps.depot_tools)
+    // The DEPS schema was modified in https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/7007552
+    // and https://chromium-review.googlesource.com/c/chromium/src/+/7683270. And while the breaking change itself got
+    // backported to M147 (and M146 fwiw), the necessary depot_tools roll was not.
+    // So for now we simply resort to whatever depot_tools is currently pinned on chromium's main branch.
+    const depot_tools = await fetch_depot_tools(/* chromium_rev */ 'main', lockfile_initial[attr_path].deps.depot_tools)
     lockfile[attr_path].deps.depot_tools = {
       rev: depot_tools.rev,
       hash: depot_tools.hash,
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index c361da17a91f..850729736728 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -101,11 +101,11 @@
     "vendorHash": "sha256-quoFrJbB1vjz+MdV+jnr7FPACHuUe5Gx9POLubD2IaM="
   },
   "baidubce_baiducloud": {
-    "hash": "sha256-zYWTDk905FpGvN2tsScXAH162TwTacU88G8aoZii83I=",
+    "hash": "sha256-5OwkxWisWpnPF0wwjmqb3OKBw+a9ypSQUKRSB06EC0I=",
     "homepage": "https://registry.terraform.io/providers/baidubce/baiducloud",
     "owner": "baidubce",
     "repo": "terraform-provider-baiducloud",
-    "rev": "v1.22.22",
+    "rev": "v1.22.25",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -571,13 +571,13 @@
     "vendorHash": "sha256-xIagZvWtlNpz5SQfxbA7r9ojAeS3CW2pwV337ObKOwU="
   },
   "hashicorp_google": {
-    "hash": "sha256-g9O6ypO6e9KR2V/85vISHhZpjSdmk/y+FSFGMPlmEdY=",
+    "hash": "sha256-NEPyqlxtpxfpMCygkcN9d/vo/4rwKLJ7qx4WAxgdVPA=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "repo": "terraform-provider-google",
-    "rev": "v7.26.0",
+    "rev": "v7.28.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-znm43JcwFf/NpGIaayyiOazAa7yCStrbuSNnGkyxzFA="
+    "vendorHash": "sha256-39r9+dFJYJrzL0EOK3vXLcftOSqyw/pR5q+zm2lipYY="
   },
   "hashicorp_google-beta": {
     "hash": "sha256-ySzZTmsiPEvgPsqxTi2FMclfp9zR97aaGfmZba2lScM=",
@@ -1121,13 +1121,13 @@
     "vendorHash": "sha256-L1wufPa7LPPyOPTL+jFQgiWzJoJYS+fCdw3N0KZqKtc="
   },
   "rancher_rancher2": {
-    "hash": "sha256-w0ACYyXj3S5yw4ZZ59c0UpPVo2ZL8EOIheGvWQorYLE=",
+    "hash": "sha256-T7nX+sD3FOqXgoNzzGJfIKvMvJ5hkYoHCyzR5Sm08IE=",
     "homepage": "https://registry.terraform.io/providers/rancher/rancher2",
     "owner": "rancher",
     "repo": "terraform-provider-rancher2",
-    "rev": "v13.1.4",
+    "rev": "v14.1.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-33NOGIvqLpgndG68GxAeoiISjWV7ApR4jmvqyZHjPKo="
+    "vendorHash": "sha256-WpI4OZ7BUVgHwQY+7ct+K6CnwXFFuiRbI+iTFSJ8a5A="
   },
   "rootlyhq_rootly": {
     "hash": "sha256-OTXTCAeKsDtjtOqM6gP2/D1D5ZNblqf/1VtnZoEYNNI=",
diff --git a/pkgs/by-name/al/alt-tab-macos/package.nix b/pkgs/by-name/al/alt-tab-macos/package.nix
index 807ec4895027..81564e287fb2 100644
--- a/pkgs/by-name/al/alt-tab-macos/package.nix
+++ b/pkgs/by-name/al/alt-tab-macos/package.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "alt-tab-macos";
-  version = "10.11.0";
+  version = "10.12.0";
 
   src = fetchurl {
     url = "https://github.com/lwouis/alt-tab-macos/releases/download/v${finalAttrs.version}/AltTab-${finalAttrs.version}.zip";
-    hash = "sha256-LLEmcZEC0DaMdp9a5e1wF74oahGvHQpzpKDnbkPqNto=";
+    hash = "sha256-566nXPHdMNumtanvUNoD84m8XbdAieZ6+REpOKQZLBQ=";
   };
 
   sourceRoot = ".";
diff --git a/pkgs/by-name/bo/boulder/package.nix b/pkgs/by-name/bo/boulder/package.nix
index 71a066a55262..1a26b442a091 100644
--- a/pkgs/by-name/bo/boulder/package.nix
+++ b/pkgs/by-name/bo/boulder/package.nix
@@ -3,19 +3,18 @@
   fetchFromGitHub,
   buildGoModule,
   testers,
-  boulder,
   minica,
   nix-update-script,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "boulder";
-  version = "0.20251118.0";
+  version = "0.20260331.0";
 
   src = fetchFromGitHub {
     owner = "letsencrypt";
     repo = "boulder";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     leaveDotGit = true;
     postFetch = ''
       pushd $out
@@ -23,7 +22,7 @@ buildGoModule rec {
       find $out -name .git -print0 | xargs -0 rm -rf
       popd
     '';
-    hash = "sha256-JVkIu8Fh5F8WQXa45I0hnSedAaIQIOFidtWVpVHbAWA=";
+    hash = "sha256-2kYZp/cU9OuXmy8EDoX7htqlM7NpAl45Nf2S5MTVn6Y=";
   };
 
   vendorHash = null;
@@ -35,6 +34,8 @@ buildGoModule rec {
 
   subPackages = [ "cmd/boulder" ];
 
+  excludedPackages = [ "test/integration" ];
+
   ldflags = [
     "-s"
     "-w"
@@ -42,10 +43,12 @@ buildGoModule rec {
   ];
 
   preBuild = ''
-    ldflags+=" -X \"github.com/letsencrypt/boulder/core.BuildID=${version} +$(cat COMMIT)\""
+    ldflags+=" -X \"github.com/letsencrypt/boulder/core.BuildID=${finalAttrs.version} +$(cat COMMIT)\""
     ldflags+=" -X \"github.com/letsencrypt/boulder/core.BuildTime=$(date -u -d @0)\""
   '';
 
+  __darwinAllowLocalNetworking = true;
+
   nativeCheckInputs = [ minica ];
 
   preCheck = ''
@@ -109,6 +112,7 @@ buildGoModule rec {
     "TestCountPendingAuthorizations2"
     "TestCountRegistrationsByIP"
     "TestCountRegistrationsByIPRange"
+    "TestCreateAndFetchRegistrations"
     "TestDbSettings"
     "TestDeactivateAccount"
     "TestDeactivateAuthorization"
@@ -325,7 +329,7 @@ buildGoModule rec {
   ];
 
   checkFlags = [
-    "-skip ${lib.strings.concatStringsSep "|" disabledTests}"
+    "-skip ${lib.strings.concatStringsSep "|" finalAttrs.disabledTests}"
   ];
 
   postInstall = ''
@@ -336,8 +340,8 @@ buildGoModule rec {
 
   passthru = {
     tests.version = testers.testVersion {
-      package = boulder;
-      inherit version;
+      package = finalAttrs.finalPackage;
+      version = finalAttrs.version;
     };
     updateScript = nix-update-script { };
   };
@@ -354,6 +358,6 @@ buildGoModule rec {
     '';
     license = lib.licenses.mpl20;
     mainProgram = "boulder";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ miniharinn ];
   };
-}
+})
diff --git a/pkgs/by-name/ch/chatbox/package.nix b/pkgs/by-name/ch/chatbox/package.nix
index 0d9448b273f4..786ee0d6093a 100644
--- a/pkgs/by-name/ch/chatbox/package.nix
+++ b/pkgs/by-name/ch/chatbox/package.nix
@@ -6,11 +6,11 @@
 }:
 let
   pname = "chatbox";
-  version = "1.20.0";
+  version = "1.20.1";
 
   src = fetchurl {
     url = "https://download.chatboxai.app/releases/Chatbox-${version}-x86_64.AppImage";
-    hash = "sha256-VzrAXWacrX6ldHdSw12RmElMdWmHiCsE3qPEPoJqFA0=";
+    hash = "sha256-975ythOgMwN0/EbXB9GCxnS0aO4z9NxRpfASborU+As=";
   };
 
   appimageContents = appimageTools.extract { inherit pname version src; };
diff --git a/pkgs/by-name/ch/chirp/package.nix b/pkgs/by-name/ch/chirp/package.nix
index 610508b84cc1..81803db671a8 100644
--- a/pkgs/by-name/ch/chirp/package.nix
+++ b/pkgs/by-name/ch/chirp/package.nix
@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication {
   pname = "chirp";
-  version = "0.4.0-unstable-2026-03-24";
+  version = "0.4.0-unstable-2026-04-14";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kk7ds";
     repo = "chirp";
-    rev = "915cdc7410c63a14956b42db2dc1d4111c26d3a8";
-    hash = "sha256-R2e5l6ZEPw1Ztk1doA8d5mSjovOaivHe/NDPTyLdhUU=";
+    rev = "f5d57bd5784b85f9a37e316064d508bad5a70d2b";
+    hash = "sha256-YFGp0uu7coCmDWaI9MKxNo4x6IfQXQMQ85F/z9qTBI8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/co/codeql/package.nix b/pkgs/by-name/co/codeql/package.nix
index 2407f181ae61..b54ea14506f3 100644
--- a/pkgs/by-name/co/codeql/package.nix
+++ b/pkgs/by-name/co/codeql/package.nix
@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation rec {
   pname = "codeql";
-  version = "2.25.1";
+  version = "2.25.2";
 
   dontConfigure = true;
   dontBuild = true;
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
 
   src = fetchzip {
     url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    hash = "sha256-obChRLyt6gZDVkuNgeJFRIpNGdHeaKC/6a0oVku9EZI=";
+    hash = "sha256-ENPcgyZpvxMK/FXAMQmNLRFH9o6K82EOEpzzJR+YO5s=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/co/coroot-node-agent/package.nix b/pkgs/by-name/co/coroot-node-agent/package.nix
index 351f8577ac63..645eb8197861 100644
--- a/pkgs/by-name/co/coroot-node-agent/package.nix
+++ b/pkgs/by-name/co/coroot-node-agent/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "coroot-node-agent";
-  version = "1.31.0";
+  version = "1.32.0";
 
   src = fetchFromGitHub {
     owner = "coroot";
     repo = "coroot-node-agent";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-vS1nf20G++VKA/2WBhXvWjyGyVMPhshw+jUcPRxPcIw=";
+    hash = "sha256-qrIcbJcxVw6LgvpihFlDP3AYT0S5ILHJf+pko94t3/8=";
   };
 
-  vendorHash = "sha256-5+PwysNT3ZZ6epFDrH6BhIn0ERaxntO+ekqaBxc+qkA=";
+  vendorHash = "sha256-I7KxBM3cLF4zrZb6AQSCmg3cR1MrTPzTNHUHN9YP3P0=";
 
   buildInputs = [ systemdLibs ];
 
diff --git a/pkgs/by-name/da/davinci-resolve/package.nix b/pkgs/by-name/da/davinci-resolve/package.nix
index 758c95a3ee25..ca2402d4e1ed 100644
--- a/pkgs/by-name/da/davinci-resolve/package.nix
+++ b/pkgs/by-name/da/davinci-resolve/package.nix
@@ -34,6 +34,7 @@
   buildFHSEnv,
   bash,
   writeText,
+  writeShellScript,
   ocl-icd,
   xkeyboard_config,
   glib,
@@ -171,6 +172,23 @@ let
           appimage-exec.sh -x $out ${lib.escapeShellArg appimageName}
 
           mkdir -p $out/{"Apple Immersive/Calibration",configs,DolbyVision,easyDCP,Extras,Fairlight,GPUCache,logs,Media,"Resolve Disk Database",.crashreport,.license,.LUT}
+
+          # Install udev rules for Blackmagic hardware (color panels, Speed Editor, Editor Keyboard)
+          mkdir -p $out/lib/udev/rules.d
+          cp $out/share/etc/udev/rules.d/99-BlackmagicDevices.rules $out/lib/udev/rules.d/
+          cp $out/share/etc/udev/rules.d/99-ResolveKeyboardHID.rules $out/lib/udev/rules.d/
+          # Generate catch-all rules for Blackmagic Design vendor ID (096e)
+          # USB device access (color panels, general hardware)
+          echo 'SUBSYSTEM=="usb", ENV{DEVTYPE}=="usb_device", ATTRS{idVendor}=="096e", MODE="0666"' \
+            > $out/lib/udev/rules.d/99-DavinciPanel.rules
+          # hidraw access (Speed Editor jog wheel, Editor Keyboard, future HID devices)
+          echo 'KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{idVendor}=="096e", MODE="0666"' \
+            >> $out/lib/udev/rules.d/99-DavinciPanel.rules
+
+          # Verify all three rules files are present
+          test -f $out/lib/udev/rules.d/99-BlackmagicDevices.rules
+          test -f $out/lib/udev/rules.d/99-ResolveKeyboardHID.rules
+          test -f $out/lib/udev/rules.d/99-DavinciPanel.rules
           runHook postInstall
         '';
 
@@ -208,7 +226,59 @@ let
           ];
           startupWMClass = "resolve";
         })
-      ];
+        (makeDesktopItem {
+          name = "blackmagicraw-player";
+          desktopName = "Blackmagic RAW Player";
+          exec = "blackmagicraw-player %f";
+          icon = "blackmagicraw-player";
+          mimeTypes = [
+            "application/x-braw-clip"
+            "application/x-braw-sidecar"
+          ];
+          categories = [
+            "Video"
+            "AudioVideo"
+          ];
+        })
+        (makeDesktopItem {
+          name = "blackmagicraw-speedtest";
+          desktopName = "Blackmagic RAW Speed Test";
+          exec = "blackmagicraw-speedtest";
+          icon = "blackmagicraw-speedtest";
+          categories = [
+            "Video"
+            "AudioVideo"
+          ];
+        })
+        (makeDesktopItem {
+          name = "davinci-control-panels-setup";
+          desktopName = "DaVinci Control Panels Setup";
+          exec = "davinci-control-panels-setup";
+          icon = "davinci-control-panels-setup";
+          categories = [ "Settings" ];
+        })
+        (makeDesktopItem {
+          name = "davinci-fairlight-studio-utility";
+          desktopName = "Fairlight Studio Utility";
+          exec = "davinci-fairlight-studio-utility";
+          icon = "davinci-resolve${lib.optionalString studioVariant "-studio"}";
+          categories = [
+            "AudioVideo"
+            "Audio"
+          ];
+        })
+      ]
+      ++ lib.optional studioVariant (makeDesktopItem {
+        name = "davinci-remote-monitor";
+        desktopName = "DaVinci Remote Monitor";
+        exec = "davinci-remote-monitor";
+        icon = "davinci-remote-monitor";
+        comment = "DaVinci Remote Monitor";
+        categories = [
+          "AudioVideo"
+          "Video"
+        ];
+      });
     }
   );
 in
@@ -240,6 +310,11 @@ buildFHSEnv {
       opencl-headers
       python3
       python3.pkgs.numpy
+      libdrm # libdrm.so.2 needed by bundled Qt6 WebEngine (Control Panels Setup)
+      libxkbfile # libxkbfile.so.1 needed by bundled Qt6 WebEngine (Control Panels Setup)
+      krb5 # libgssapi_krb5.so.2 needed by bundled Qt6 (Control Panels Setup, Fairlight Studio Utility)
+      nss # libsmime3.so needed by bundled Qt6 (Control Panels Setup)
+      libxcb-cursor # libxcb-cursor.so needed by Qt6 xcb platform plugin (Fairlight Studio Utility)
       udev
       xdg-utils # xdg-open needed to open URLs
       libice
@@ -281,14 +356,67 @@ buildFHSEnv {
     export QT_XKB_CONFIG_ROOT="${xkeyboard_config}/share/X11/xkb"
     export QT_PLUGIN_PATH="${davinci}/libs/plugins:$QT_PLUGIN_PATH"
     export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/lib:/usr/lib32:${davinci}/libs
-    ${davinci}/bin/resolve
+    if [ $# -gt 0 ]; then
+      exec "$@"
+    else
+      exec ${davinci}/bin/resolve
+    fi
   ''}";
 
-  extraInstallCommands = ''
-    mkdir -p $out/share/applications $out/share/icons/hicolor/128x128/apps
-    ln -s ${davinci}/share/applications/*.desktop $out/share/applications/
-    ln -s ${davinci}/graphics/DV_Resolve.png $out/share/icons/hicolor/128x128/apps/davinci-resolve${lib.optionalString studioVariant "-studio"}.png
-  '';
+  extraInstallCommands =
+    let
+      execName = "davinci-resolve${lib.optionalString studioVariant "-studio"}";
+      # Each wrapper re-enters the FHS environment and execs a different binary
+      mkWrapper =
+        name: bin:
+        writeShellScript name ''
+          exec "$(dirname "$0")/${execName}" ${bin} "$@"
+        '';
+      wrappers = {
+        "blackmagicraw-player" = "${davinci}/BlackmagicRAWPlayer/BlackmagicRAWPlayer";
+        "blackmagicraw-speedtest" = "${davinci}/BlackmagicRAWSpeedTest/BlackmagicRAWSpeedTest";
+        "davinci-control-panels-setup" =
+          ''"${davinci}/DaVinci Control Panels Setup/DaVinci Control Panels Setup"'';
+        "davinci-fairlight-studio-utility" =
+          ''"${davinci}/Fairlight Studio Utility/Fairlight Studio Utility"'';
+      }
+      // lib.optionalAttrs studioVariant {
+        "davinci-remote-monitor" = ''"${davinci}/bin/DaVinci Remote Monitor"'';
+      };
+    in
+    ''
+      # Desktop files
+      mkdir -p $out/share/applications
+      ln -s ${davinci}/share/applications/*.desktop $out/share/applications/
+
+      # Icons
+      mkdir -p $out/share/icons/hicolor/{128x128,256x256}/apps
+      ln -s ${davinci}/graphics/DV_Resolve.png $out/share/icons/hicolor/128x128/apps/davinci-resolve${lib.optionalString studioVariant "-studio"}.png
+      ln -s ${davinci}/graphics/DV_Panels.png $out/share/icons/hicolor/128x128/apps/davinci-control-panels-setup.png
+      ${lib.optionalString studioVariant ''
+        ln -s ${davinci}/graphics/Remote_Monitoring.png $out/share/icons/hicolor/128x128/apps/davinci-remote-monitor.png
+      ''}
+      ln -s ${davinci}/graphics/blackmagicraw-player_256x256_apps.png $out/share/icons/hicolor/256x256/apps/blackmagicraw-player.png
+      ln -s ${davinci}/graphics/blackmagicraw-speedtest_256x256_apps.png $out/share/icons/hicolor/256x256/apps/blackmagicraw-speedtest.png
+
+      # Wrapper scripts for additional programs
+      ${lib.concatStringsSep "\n" (
+        lib.mapAttrsToList (name: bin: ''
+          ln -s ${mkWrapper name bin} $out/bin/${name}
+        '') wrappers
+      )}
+
+      # MIME type definitions for .drp, .braw, etc.
+      mkdir -p $out/share/mime/packages
+      ln -s ${davinci}/share/resolve.xml $out/share/mime/packages/
+      ln -s ${davinci}/share/blackmagicraw.xml $out/share/mime/packages/
+
+      # Expose udev rules so NixOS can aggregate them from environment.systemPackages
+      mkdir -p $out/lib/udev/rules.d
+      ln -s ${davinci}/lib/udev/rules.d/99-BlackmagicDevices.rules $out/lib/udev/rules.d/
+      ln -s ${davinci}/lib/udev/rules.d/99-ResolveKeyboardHID.rules $out/lib/udev/rules.d/
+      ln -s ${davinci}/lib/udev/rules.d/99-DavinciPanel.rules $out/lib/udev/rules.d/
+    '';
 
   passthru = {
     inherit davinci;
@@ -327,6 +455,7 @@ buildFHSEnv {
       amarshall
       XBagon
       toXel
+      cafkafk
     ];
     platforms = [ "x86_64-linux" ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
diff --git a/pkgs/by-name/dc/dcrwallet/package.nix b/pkgs/by-name/dc/dcrwallet/package.nix
index 729f1478fdb3..10a9b712bbee 100644
--- a/pkgs/by-name/dc/dcrwallet/package.nix
+++ b/pkgs/by-name/dc/dcrwallet/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "dcrwallet";
-  version = "2.1.4";
+  version = "2.1.5";
 
   src = fetchFromGitHub {
     owner = "decred";
     repo = "dcrwallet";
     rev = "release-v${finalAttrs.version}";
-    hash = "sha256-9CblBsZa2jAzp58Qj/Zoq68JcuKxzDO51P19XZJIJ6I=";
+    hash = "sha256-1PCxS67hXmwUD08OGyt6szVSgQ5M9e0j8ivNxmitfR8=";
   };
 
-  vendorHash = "sha256-J1Iy3XWvLNLEf+0kDYbX1UbgBvxz7C3NSPeF/PpuD5E=";
+  vendorHash = "sha256-5rI6z7fC7jKPxovWp7nlZrR25NuUEz5obCn2HA6Crpk=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/de/deno/package.nix b/pkgs/by-name/de/deno/package.nix
index 60292c8c9634..763ba2d517b3 100644
--- a/pkgs/by-name/de/deno/package.nix
+++ b/pkgs/by-name/de/deno/package.nix
@@ -31,17 +31,17 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "deno";
-  version = "2.7.9";
+  version = "2.7.12";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = "deno";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true; # required for tests
-    hash = "sha256-asRSIDpVN8sZgck5cocqfjcFNnP3CekR0lwBi0jr6GM=";
+    hash = "sha256-e1G1y9aGWhFDhsvzmLFD6VIfxU8BseWOa8bBcCC255Y=";
   };
 
-  cargoHash = "sha256-lL9ZeMUi5cwrqikg+GiR5hQNgWPKlpAN7yQIXSsr93k=";
+  cargoHash = "sha256-YahHLz4ykAcFNrh/GFVJ0fZtCNHKG9RzdCUprQDfOUo=";
 
   patches = [
     ./patches/0002-tests-replace-hardcoded-paths.patch
diff --git a/pkgs/by-name/dr/drupal/package.nix b/pkgs/by-name/dr/drupal/package.nix
index 7de52aa11606..3f6921f74d04 100644
--- a/pkgs/by-name/dr/drupal/package.nix
+++ b/pkgs/by-name/dr/drupal/package.nix
@@ -8,18 +8,18 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "drupal";
-  version = "11.3.5";
+  version = "11.3.6";
 
   src = fetchFromGitLab {
     domain = "git.drupalcode.org";
     owner = "project";
     repo = "drupal";
     tag = finalAttrs.version;
-    hash = "sha256-h01wI6EcVwynXVYUJDokG0rS0I7SxDfu1/sNFan96Og=";
+    hash = "sha256-2EKpX4DXsGWBa8jtLqDnE9L97MsqfYhNR2S1r9sLxXE=";
   };
 
   composerNoPlugins = false;
-  vendorHash = "sha256-R/9F7JGMlTnque6Ip5NTN8alKdIUr1+Zyds2ks2sEko=";
+  vendorHash = "sha256-Q5h8EcD3b0pbSU5Jkpne3eYn/fprwe5nOCivKng6PkQ=";
 
   passthru = {
     tests = {
diff --git a/pkgs/by-name/ea/eas-cli/missing-hashes.json b/pkgs/by-name/ea/eas-cli/missing-hashes.json
new file mode 100644
index 000000000000..ddc72dbc5b9f
--- /dev/null
+++ b/pkgs/by-name/ea/eas-cli/missing-hashes.json
@@ -0,0 +1,34 @@
+{
+  "@nx/nx-darwin-arm64@npm:22.4.1": "d1faed4c0f1e45398d7819c384f52dc8070990be07f7b337e87af37b891129f5b3d7a0f08287e71ce3a20902c9881bbf53ad763ff58bd3270a6a9bfd137161bd",
+  "@nx/nx-darwin-x64@npm:22.4.1": "ebe3622f46f691fcda61b4a1e4143ff9a745f044eb6c2f8d3ab8e97582e50a80ebf510bdd39770d62e49f493a46f4d41fedd75ea0c76f4e8bb7db75cf2beea0d",
+  "@nx/nx-freebsd-x64@npm:22.4.1": "76f86487736fa29f88543766512d8440ddc63275670a4b1dbc4010866d9b90dee8cf10b724b551132471985b6ae47ef002985126b62213fca79e01a524738354",
+  "@nx/nx-linux-arm-gnueabihf@npm:22.4.1": "6ce5850aa7710ae3a10e4a78c9182f9301b9f0acb4ac76065b8273c6eebee691f94b72bc77bbcb7612b470b942388a6fb8639d75f3fa5404b339fe4cc2c6b19f",
+  "@nx/nx-linux-arm64-gnu@npm:22.4.1": "8ed10b9b0564546eff71ab4a557d576e9dada624034a156aaf936f3d298086cf0ce8e0126640fd971de6c9381c367934375371d1251f2af657ee150ccfa18cd3",
+  "@nx/nx-linux-arm64-musl@npm:22.4.1": "f630b28c3a3d8f22da6589ff80bd340b01558ff77a14aa3d94ff1e70e218db0a35e06fc1ef428578a1a7e314ff682a651e99763eb9b29374e485fc038377e482",
+  "@nx/nx-linux-x64-gnu@npm:22.4.1": "a92e983f3040d4efc98ae673e55f970eab8839e62e0232776bb5eeb03e45842dd9b26791f8f82091a8f576238fd814432cc9c7d541d12fc6627e65ead7473fc9",
+  "@nx/nx-linux-x64-musl@npm:22.4.1": "85e5acadbc8d1d2586e9c6f6894c13810e940dfb6a5fa9c339a8a2f09d68068c267e8a08184482966fa975ef77b017039706d284ebc2524ec5f812f0c309991c",
+  "@nx/nx-win32-arm64-msvc@npm:22.4.1": "12837e85a771cf1df26b897a74e4e9509dd1781eb952c2bf2dfdbb94b321a5d6c22cd200e36f1009c7340e23eabcedd2d8eb01821412b9c7b8fe0fd58b03a4e5",
+  "@nx/nx-win32-x64-msvc@npm:22.4.1": "fd13df9537b5d066264f01f2f6da655c1c529ca2b300ac813c95ec6a6006542052a5f6f30ba9a229f34a6feefaf2b8c030bbd909bcea9ad7b07f88d3f3a16281",
+  "@oxfmt/darwin-arm64@npm:0.28.0": "93794b11b294722a3043a7b9568dbf811819593c7a3ce251fb9ef796db5aebacc0c4cdd430820516cd2d3f55fa7a58fa6a81a3a4cb87b06a552a3d6617321788",
+  "@oxfmt/darwin-x64@npm:0.28.0": "478babc40bb5a00dda21a834b73a9f0df2b9ed337e043a0610abb2a2ebe51ce3854f16d6a48eb31ee3f03cc0f9a9eab349435699d64a00674e8a84555fb98b26",
+  "@oxfmt/linux-arm64-gnu@npm:0.28.0": "0f8964c8ad90fadd30b882ec56f50cd1130b23fff093c99dbfe44b14ac85f6e28c0c555b193d5185e844a6ec83e31c64c4fe4931e17ee7826b06d030cf7499d4",
+  "@oxfmt/linux-arm64-musl@npm:0.28.0": "78c23082b45caa791fad976813562ebf545f29656cfe43c49f1e49774ff7b6155840fe0ae1686f43a403b37f2a9b2e2fbeec3948e82a62d7cc11fd20c103594b",
+  "@oxfmt/linux-x64-gnu@npm:0.28.0": "b4dce10a922fcda5b58ef387d9ac4e8467286f0f1da45965f191f665b2a27b37552ffd51e27b9087eae6968398a0c12ea8729adc0a93ba8a932367bb12d95110",
+  "@oxfmt/linux-x64-musl@npm:0.28.0": "e9836d05cba18016f1bb21c5277613cdd582568ae159e037a700812ca5d5e4e27b1e0684fa4f0e1b0b8afc41e7e9a44ba402321ef4a5e036f5276dc05b9f27f9",
+  "@oxfmt/win32-arm64@npm:0.28.0": "3bc2f46a50017ce9efbd18880c76d55608a7ecd951b3513eb028a94e70fce5ce3bee2352e5ab839114022ab7ce2a3060be6bcce8b7c02f0afb750ae1440d94f3",
+  "@oxfmt/win32-x64@npm:0.28.0": "ed1c5fbfc432e344859cb6d342eec4635e279e3cf0487bc94db38c9e37a9be76a7c438a89e3e83ddb72870ca76e11e26a0839dfa812e1be21829cbd70283aad7",
+  "@oxlint-tsgolint/darwin-arm64@npm:0.11.1": "1fd510da2dd0e8d702b6a0b45cdba95a18b7297d8ad70b7519f34946f13685f6ab8c738efb8a100d049e6140e66475716b6977dc28f7733dab3866cdacd0ba77",
+  "@oxlint-tsgolint/darwin-x64@npm:0.11.1": "827b645c54da4a3f55427503811a09d8a2347ecb09d1117162f44193a4c975490e959ae741056330afc148e4aa04ca906085f9d4e2eeb80e5580c76df5deb1d5",
+  "@oxlint-tsgolint/linux-arm64@npm:0.11.1": "58a587f696658e6e1f135858b55940db41a925bb4136cb2b28c54432229efba75588aaa9b0cd7ffb53b28bb0e63a540762f6e99a3ed4b10b2fcf3a4a8bb99190",
+  "@oxlint-tsgolint/linux-x64@npm:0.11.1": "e26e38d43b2d9bcc9bec06a448816767c6f10c5847d56bb2f24cc94276eccbda925ec77056d5387e293b6fe618f5805fc69ae1a7c98fe5c11aa8153e75283154",
+  "@oxlint-tsgolint/win32-arm64@npm:0.11.1": "1ade0355cd49c487c5e7e1c12d17329e0eb1aaca593e13f57bf078765eaa432e12c3933a125d79b6e1d7aa91796ec9acaec869b6e0f1b180acf49c60b796b399",
+  "@oxlint-tsgolint/win32-x64@npm:0.11.1": "0c80bed7fd3ef6219aa1c58ad7b86f5fec1d7096d1b9c8207b1aa1366fdd63cb67c8a0211801e613e022018757b4107323b800f2e0f208b0aa86a825ed6e9984",
+  "@oxlint/darwin-arm64@npm:1.43.0": "ba6bba5616b9b2564e1b509adc043e166f3da12a94175d8b648a3426066f7211b3813cd90e8b71ee93567a4acf4afbfd32c5bc77035be5dd16d2fa4faf287e8d",
+  "@oxlint/darwin-x64@npm:1.43.0": "2348aa792129eaad59ef794d62fce18c6ce01dde7dc22e0cfc8ea910f198a5edb9d43168b5c3181aedd283a40b93d7b6faf0bd08d5afb366e6801a4517332eba",
+  "@oxlint/linux-arm64-gnu@npm:1.43.0": "a31a114abb5131e4f41318aa26246e739b0526fad31d02fa201f63e7e4bedec7af92ba3d4dd43a64e26aeb4f19fb304b4650f4c3f1d833a2a5baa25036fde17b",
+  "@oxlint/linux-arm64-musl@npm:1.43.0": "fead0e6a967af05e91bb9115d3f6a68623b76cc2fa69dff9e3844119169b30c66bed24fbd70a8624544aafd6a7e2ee23d920ff572411b2914f1d2f4031b244be",
+  "@oxlint/linux-x64-gnu@npm:1.43.0": "9520d3e1b0fea105fbfe243bee2f30a464c0a1af1b7c93a9b2a7f7677de72c5714fa38fd66f79987d6a19f6efeaf611b709c280a90b0eb998e7384b9714a2958",
+  "@oxlint/linux-x64-musl@npm:1.43.0": "9edd0c27b9d1a2b2d19c26a1769232b92226b7f570c6366679fad833f4d15a9a6a1d9511dbd0b9ccb59e2e953a9af272119095f006d66e8129de54dfe498a348",
+  "@oxlint/win32-arm64@npm:1.43.0": "08a7e19ea87e3235890f8105bdcf8c002c219a5fd074d66f86fb90da5e29874a2b5bf9f9f77acc0ef13dce7d993d05a64e3ec9a70e3115e26f0c8f9f58019747",
+  "@oxlint/win32-x64@npm:1.43.0": "195a63253cc3d3f91a2d52bde35672b01d3f07e353b0307f9405c846027bea0c9de607a23b5025fb3806378d8399a217c7eb804d0980058b7e9a7d6c5efc10fb"
+}
diff --git a/pkgs/by-name/ea/eas-cli/package.nix b/pkgs/by-name/ea/eas-cli/package.nix
index 469efd241de5..fcbe647131d1 100644
--- a/pkgs/by-name/ea/eas-cli/package.nix
+++ b/pkgs/by-name/ea/eas-cli/package.nix
@@ -1,36 +1,50 @@
 {
   lib,
-  stdenvNoCC,
+  stdenv,
   fetchFromGitHub,
-  fetchYarnDeps,
-  yarnConfigHook,
-  yarnBuildHook,
+  yarn-berry_4,
   nodejs,
   jq,
   makeWrapper,
+  pkg-config,
+  python3,
 }:
-stdenvNoCC.mkDerivation (finalAttrs: {
-  pname = "eas-cli";
-  version = "16.32.0";
-
+let
+  version = "18.7.0";
   src = fetchFromGitHub {
     owner = "expo";
     repo = "eas-cli";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-FP3vZKiJeQmIh2zEMWJcgsJJfUI+YhB9IyQlfnbl7ys=";
+    rev = "v${version}";
+    hash = "sha256-Z+PtS88Rv9Vv6FA15KxSBWCmOtwmTqO1etgCV7WaTXo=";
   };
+  missingHashes = ./missing-hashes.json;
+in
+# cc is necessary because of building an npm package without a prebuilt binary
+#  for ARM. See comment in nativeBuildInputs below.
+stdenv.mkDerivation (finalAttrs: {
+  pname = "eas-cli";
+  inherit src version missingHashes;
 
-  yarnOfflineCache = fetchYarnDeps {
-    yarnLock = finalAttrs.src + "/yarn.lock"; # Point to the root lockfile
-    hash = "sha256-IG13BEOH7BUi1HTcXebMQjXZJgIaWJ7hgX3GcmRB8hA=";
+  yarnOfflineCache = yarn-berry_4.fetchYarnBerryDeps {
+    inherit src missingHashes;
+    hash = "sha256-ZlbCHWEwVaYCfzowrm1qrM1MpLo5vNmEG5bWzWT/cTU=";
   };
 
   nativeBuildInputs = [
-    yarnConfigHook
-    yarnBuildHook
+    yarn-berry_4
+    yarn-berry_4.yarnBerryConfigHook
     nodejs
     jq
     makeWrapper
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isAarch64 [
+    # The version of utf-8-validate -> node-gyp -> bufferutil that this package
+    #  uses not have pre-built binary for ARM. It appears that this should be
+    #  fixed by the version of utf-8-validate that this depends on, so there
+    #  may be some underlying transitive dependency causing this.
+    #  https://github.com/websockets/utf-8-validate/issues/106
+    pkg-config
+    python3
   ];
 
   postPatch = ''
diff --git a/pkgs/by-name/et/etherape/package.nix b/pkgs/by-name/et/etherape/package.nix
index 6dd181e18be8..2ea73e51fbfc 100644
--- a/pkgs/by-name/et/etherape/package.nix
+++ b/pkgs/by-name/et/etherape/package.nix
@@ -13,10 +13,10 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "etherape";
-  version = "0.9.21";
+  version = "0.9.22";
   src = fetchurl {
     url = "mirror://sourceforge/etherape/etherape-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-SckN87uIDTxg36xERMqPxdaLqPNrgg7V+Hc4HJoHF1w=";
+    sha256 = "sha256-6UxVArQKeyKMCsptMa/eyQELx/0QG6ZIpiacEBXnIGs=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/gh/ghr/package.nix b/pkgs/by-name/gh/ghr/package.nix
index b17d1975381a..96a6475095d1 100644
--- a/pkgs/by-name/gh/ghr/package.nix
+++ b/pkgs/by-name/gh/ghr/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "ghr";
-  version = "0.18.0";
+  version = "0.18.3";
 
   src = fetchFromGitHub {
     owner = "tcnksm";
     repo = "ghr";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-Dh6po4sdNbxk3PICJLqfpwf0WmSkfzQNZ0FrCb6XXes=";
+    sha256 = "sha256-6PWvqNQfaExvO5oAhCQSEPF85hMBPWalzVrG3imtdnU=";
   };
 
-  vendorHash = "sha256-zn39fh8uX7NN0IAIjBCftP6zfzvK7T6/LPp/awIujtg=";
+  vendorHash = "sha256-ZjIwmmwybkQn+GBqtYI+saU+xuWYn4Moq9zmwRQsaSA=";
 
   # Tests require a Github API token, and networking
   doCheck = false;
diff --git a/pkgs/by-name/gi/github-desktop/package.nix b/pkgs/by-name/gi/github-desktop/package.nix
index da9ad0ae1bdc..d63484b3d085 100644
--- a/pkgs/by-name/gi/github-desktop/package.nix
+++ b/pkgs/by-name/gi/github-desktop/package.nix
@@ -31,18 +31,18 @@
 let
   inherit (stdenv.hostPlatform.node) arch platform;
   cacheRootHash = "sha256-mR5geiPPAv+oK1efT3pMfnUT1keOxB8Ge1yiq4hLtj0=";
-  cacheAppHash = "sha256-y8brlXwBur2RqJD8xlpA9ivg09xIDBuAtolhyzYkRx4=";
+  cacheAppHash = "sha256-Th3I9IPiHXEvj3FTCg3gefClnX1jDT8EPb/FzIVpjiY=";
 in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "github-desktop";
-  version = "3.5.7";
+  version = "3.5.8";
 
   src = fetchFromGitHub {
     owner = "desktop";
     repo = "desktop";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-H6FPMp+Y3PmRtuaOVX+8Yd3a5JA+zvLeGeLp99X1+y0=";
+    hash = "sha256-K3+YpdSheeXMRehkWy044OFO9jpzfBjWOK39uXAqrsE=";
     fetchSubmodules = true;
     postCheckout = "git -C $out rev-parse HEAD > $out/.gitrev";
   };
diff --git a/pkgs/by-name/gn/gnss-sdr/package.nix b/pkgs/by-name/gn/gnss-sdr/package.nix
index 7935a1f217dc..faffc1b85026 100644
--- a/pkgs/by-name/gn/gnss-sdr/package.nix
+++ b/pkgs/by-name/gn/gnss-sdr/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  fetchpatch,
   fetchFromGitHub,
   armadillo,
   cmake,
@@ -38,6 +39,10 @@ gnuradio.pkgs.mkDerivation rec {
     # cpu_features which is bundled in the source. NOTE: Perhaps this patch
     # should be sent upstream.
     ./fix_libcpu_features_install_path.patch
+    (fetchpatch {
+      url = "https://sources.debian.org/data/main/g/gnss-sdr/0.0.20-2/debian/patches/boost1.90.diff";
+      hash = "sha256-IeLV0DIVzw+Nix9RmrqrbGDEjquvSws114UsdYphV58=";
+    })
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/go/go-csp-collector/package.nix b/pkgs/by-name/go/go-csp-collector/package.nix
index 8ca56da69489..e7158b9f2a91 100644
--- a/pkgs/by-name/go/go-csp-collector/package.nix
+++ b/pkgs/by-name/go/go-csp-collector/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  go_1_26,
   buildGoModule,
   fetchFromGitHub,
   versionCheckHook,
@@ -7,18 +8,18 @@
   nixosTests,
 }:
 
-buildGoModule (finalAttrs: {
+buildGoModule.override { go = go_1_26; } (finalAttrs: {
   pname = "go-csp-collector";
-  version = "0.0.17-unstable-2025-11-24";
+  version = "0.0.17";
 
   src = fetchFromGitHub {
     owner = "jacobbednarz";
     repo = "go-csp-collector";
-    rev = "c997e31172ed2d785fc960296b826a9587bd5de9";
-    hash = "sha256-ZfE8xa+og14dlUmvYfatecSdrhmuMbFFNTw5RZ3ZHXU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-NuJM7MneCptlmX0NV7c/7T1E5xhzM8Z59xNwEEGVuHM=";
   };
 
-  vendorHash = "sha256-SrQahSHO5ZIkcLR3BR5CR5BTStW1pH1Ij1Eql0b3tuU=";
+  vendorHash = "sha256-YbpBZhXTlSEKkCRDzFeDWRT8HEsCG2905WVGjxvW6oY=";
 
   ldflags = [
     "-s"
@@ -45,7 +46,7 @@ buildGoModule (finalAttrs: {
   meta = {
     description = "A content security policy violation collector written in Golang";
     homepage = "https://github.com/jacobbednarz/go-csp-collector";
-    changelog = "https://github.com/jacobbednarz/go-csp-collector/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/jacobbednarz/go-csp-collector/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     mainProgram = "go-csp-collector";
     maintainers = with lib.maintainers; [ stepbrobd ];
diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix
index 4c8066faf4c9..ff52f91f7ea6 100644
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -184,11 +184,11 @@ let
 
   linux = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "147.0.7727.55";
+    version = "147.0.7727.101";
 
     src = fetchurl {
       url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-N3uXLBQ+kMttTKMaWijtE5hHXUdnDo97FeS6EaQsuyg=";
+      hash = "sha256-VU41cXkCB/JU2a1bXHGMQVF8ZK95Z7FBI6+k5yjPb80=";
     };
 
     # With strictDeps on, some shebangs were not being patched correctly
@@ -302,11 +302,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "147.0.7727.56";
+    version = "147.0.7727.102";
 
     src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/nrtg4j5s3af3rvfw2czxfvmywu_147.0.7727.56/GoogleChrome-147.0.7727.56.dmg";
-      hash = "sha256-IPeukB7JCeHOWr0Ma7YFfHWO58Py2/x/o2Ajz0Rc4oM=";
+      url = "http://dl.google.com/release2/chrome/adh7lit4ohn55bd2cyoftxkjiixa_147.0.7727.102/GoogleChrome-147.0.7727.102.dmg";
+      hash = "sha256-eslLqiI5DtExI1Hq31wYBNQGu4LktzeW/7Z+R/kPGzo=";
     };
 
     dontPatch = true;
diff --git a/pkgs/by-name/gr/greenmask/package.nix b/pkgs/by-name/gr/greenmask/package.nix
index 5a8d3abae55d..12cf377cd0d8 100644
--- a/pkgs/by-name/gr/greenmask/package.nix
+++ b/pkgs/by-name/gr/greenmask/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "greenmask";
-  version = "0.2.18";
+  version = "0.2.19";
 
   src = fetchFromGitHub {
     owner = "GreenmaskIO";
     repo = "greenmask";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZFlfX6JgJOaq+8OxSzhulRTkKabGoNsnBxFVpg81RDs=";
+    hash = "sha256-X/TfcXhjpY+nd5ThjY7CitvbtZMq35uwZ2yjkVYXw1k=";
   };
 
   vendorHash = "sha256-SB71/Tf9Bw8AlTYGXOaRR8sdiwx8l9wQba93p6vAbAk=";
diff --git a/pkgs/by-name/in/infrastructure-agent/package.nix b/pkgs/by-name/in/infrastructure-agent/package.nix
index 62cd25347365..c4ef3a8518fe 100644
--- a/pkgs/by-name/in/infrastructure-agent/package.nix
+++ b/pkgs/by-name/in/infrastructure-agent/package.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "infrastructure-agent";
-  version = "1.73.0";
+  version = "1.73.1";
 
   src = fetchFromGitHub {
     owner = "newrelic";
     repo = "infrastructure-agent";
     rev = finalAttrs.version;
-    hash = "sha256-NcpfigIpwnesZtD2BQm/NMN3jsdgdH7sAkZ74rbHSZo=";
+    hash = "sha256-fxOvtMAwCR5Y9VhUsR8BF76+REH39+pyGyjxLXwRx1k=";
   };
 
-  vendorHash = "sha256-0yDH9l5NyUzIjjUMnf/u2t02uqNGIK2qfakvImFgmdA=";
+  vendorHash = "sha256-xkoNVXRm8OkVd2f3cSFE1QIF6EHhh8AQh/YZYt22+MU=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ji/jikken/package.nix b/pkgs/by-name/ji/jikken/package.nix
index 3ccbb8755464..c7f6aa25357d 100644
--- a/pkgs/by-name/ji/jikken/package.nix
+++ b/pkgs/by-name/ji/jikken/package.nix
@@ -10,16 +10,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "jikken";
-  version = "0.8.2";
+  version = "0.8.4";
 
   src = fetchFromGitHub {
     owner = "jikkenio";
     repo = "jikken";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-8A9b9Ms/unv+qQRd5jiTV/6SJa6ZYLsE0fK97ohacPI=";
+    hash = "sha256-j9Rmo9szQtTZU2O6YRhkjMr5pV8tflUdr5hgXqYQxjc=";
   };
 
-  cargoHash = "sha256-nwFTKol5phXFuDzAcnPoFq8UrrqMDE6NuitpXE5qJwU=";
+  cargoHash = "sha256-V7Qy+0l3UvW5bM2OV3haGVg3KWDaEiEMvg4wvpwwuk4=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/ju/just-lsp/package.nix b/pkgs/by-name/ju/just-lsp/package.nix
index 1b694cfe89c1..1bc322419cd9 100644
--- a/pkgs/by-name/ju/just-lsp/package.nix
+++ b/pkgs/by-name/ju/just-lsp/package.nix
@@ -2,21 +2,27 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  versionCheckHook,
   nix-update-script,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "just-lsp";
-  version = "0.4.1";
+  version = "0.4.2";
 
   src = fetchFromGitHub {
     owner = "terror";
     repo = "just-lsp";
     tag = finalAttrs.version;
-    hash = "sha256-h6thjPu9XiZJbNgw9Vd41WhMtlaHaNw+ATHGhWWsJLs=";
+    hash = "sha256-bNOQHFULe+gA9UC9JBoTaStQ1geqXqOxydIPF39w2xY=";
   };
 
-  cargoHash = "sha256-g9Py7tIGnZaC8ue9aijnmhWzHEMAMuVaGJCwvpfgLiI=";
+  cargoHash = "sha256-3JsVJ84DWNf1UTYHbreAvj6XoAGaEk6OXML4saiZBlA=";
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/by-name/jx/jx/package.nix b/pkgs/by-name/jx/jx/package.nix
index b081c7badf08..b3f40994a4ef 100644
--- a/pkgs/by-name/jx/jx/package.nix
+++ b/pkgs/by-name/jx/jx/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "jx";
-  version = "3.16.59";
+  version = "3.16.71";
 
   src = fetchFromGitHub {
     owner = "jenkins-x";
     repo = "jx";
     rev = "v${version}";
-    sha256 = "sha256-HIpRJMEk0i9g4HA4N7POAf0oFRIguETrgj33VocAtKk=";
+    sha256 = "sha256-Yc7I5gh9SRXwmKIjuWPK3/cs+rnQ3Nhr1OruIcSu5Vo=";
   };
 
   vendorHash = "sha256-1ErjD+1MdbKN4EPaQX0jxNzoN9dB8beH1csdx1IPKl8=";
diff --git a/pkgs/by-name/ko/komikku/package.nix b/pkgs/by-name/ko/komikku/package.nix
index 5ba08cd49b25..8a1432920ffb 100644
--- a/pkgs/by-name/ko/komikku/package.nix
+++ b/pkgs/by-name/ko/komikku/package.nix
@@ -24,14 +24,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "komikku";
-  version = "50.1.0";
+  version = "50.2.0";
   pyproject = false;
 
   src = fetchFromCodeberg {
     owner = "valos";
     repo = "Komikku";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-F98wvRMpDJSeI6OQYe40hKrnzAzetU7FsmJ4fPdHBWE=";
+    hash = "sha256-djC4v2OTRA/UEiI3foiEvRo6gVN5eS2+eENueQzdkds=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/kr/krep/package.nix b/pkgs/by-name/kr/krep/package.nix
index a814bfbac306..345dc7d647aa 100644
--- a/pkgs/by-name/kr/krep/package.nix
+++ b/pkgs/by-name/kr/krep/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "krep";
-  version = "2.2.0";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "davidesantangelo";
     repo = "krep";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-hSfFFnp1/fDBAvqqg/oHYfYcls9qkftFV27UJWhsRbk=";
+    hash = "sha256-6TJT0YjaTuNPTJP7GdpaLVRGyaL1im5nnqFP+4vtssg=";
   };
 
   makeFlags = [
diff --git a/pkgs/by-name/kr/kronosnet/package.nix b/pkgs/by-name/kr/kronosnet/package.nix
index 77fa7eeb79bb..894f45243e50 100644
--- a/pkgs/by-name/kr/kronosnet/package.nix
+++ b/pkgs/by-name/kr/kronosnet/package.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kronosnet";
-  version = "1.32";
+  version = "1.33";
 
   src = fetchFromGitHub {
     owner = "kronosnet";
     repo = "kronosnet";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-g2AgVAFEmRlMaqH7uRabSNJP0ehUQ6Iws4LT2iB8kTA=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-mLpHV54BqYmWNjkoNt2v/lu/QfMwkHeMgMUCDEGeUPI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libmsquic/package.nix b/pkgs/by-name/li/libmsquic/package.nix
index 6c0943b2359c..10976ba9c5e7 100644
--- a/pkgs/by-name/li/libmsquic/package.nix
+++ b/pkgs/by-name/li/libmsquic/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libmsquic";
-  version = "2.5.6";
+  version = "2.5.7";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "msquic";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Nq7iIOz9duThWQSjJTGK+xnKEH3H3ck9v37ppoGFaEE=";
+    hash = "sha256-BLqCilX6B2yinLJB5zTnIU9q6QK/7lWhEe7VgTerB1E=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/development/libraries/libpulsar/default.nix b/pkgs/by-name/li/libpulsar/package.nix
similarity index 78%
rename from pkgs/development/libraries/libpulsar/default.nix
rename to pkgs/by-name/li/libpulsar/package.nix
index 93880415725f..40426343b9aa 100644
--- a/pkgs/development/libraries/libpulsar/default.nix
+++ b/pkgs/by-name/li/libpulsar/package.nix
@@ -1,38 +1,43 @@
 {
   lib,
-  asioSupport ? true,
+  stdenv,
+  fetchFromGitHub,
+
   asio_1_32_0,
   boost,
   boost186,
-  log4cxxSupport ? false,
   log4cxx,
-  snappySupport ? false,
   snappy,
-  zlibSupport ? true,
   zlib,
-  zstdSupport ? true,
   zstd,
   gtest,
-  gtestSupport ? false,
   cmake,
   curl,
-  fetchFromGitHub,
-  protobuf,
+  protobuf_21,
   jsoncpp,
   openssl,
   pkg-config,
-  stdenv,
+
+  asioSupport ? true,
+  log4cxxSupport ? false,
+  snappySupport ? false,
+  zlibSupport ? true,
+  zstdSupport ? true,
+  gtestSupport ? false,
 }:
 
+let
+  protobuf = protobuf_21;
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "libpulsar";
-  version = "3.7.2";
+  version = "4.1.0";
 
   src = fetchFromGitHub {
     owner = "apache";
     repo = "pulsar-client-cpp";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-3kUyimyv0Si3zUFaIsIVdulzH8l2fxe6BO9a5L6n8I8=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-+gGddndiRot2kW7KGuKfWA85mh8e+9PetnEBQvfZB1I=";
   };
 
   nativeBuildInputs = [
@@ -40,18 +45,28 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     protobuf # protoc
   ]
-  ++ lib.optional gtestSupport gtest.dev;
+  ++ lib.optionals gtestSupport [
+    (lib.getDev gtest)
+  ];
 
   buildInputs = [
+    curl
     jsoncpp
     openssl
-    curl
     protobuf
   ]
-  ++ lib.optional snappySupport snappy.dev
-  ++ lib.optional zlibSupport zlib
-  ++ lib.optional zstdSupport zstd
-  ++ lib.optional log4cxxSupport log4cxx
+  ++ lib.optionals snappySupport [
+    (lib.getDev snappy)
+  ]
+  ++ lib.optionals zlibSupport [
+    zlib
+  ]
+  ++ lib.optionals zstdSupport [
+    zstd
+  ]
+  ++ lib.optionals log4cxxSupport [
+    log4cxx
+  ]
   ++ lib.optionals asioSupport [
     # io_service was removed in 1.33.0
     asio_1_32_0
@@ -85,9 +100,9 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
-    homepage = "https://pulsar.apache.org/docs/next/client-libraries-cpp/";
     description = "Apache Pulsar C++ library";
-    changelog = "https://github.com/apache/pulsar-client-cpp/releases/tag/v${finalAttrs.version}";
+    homepage = "https://pulsar.apache.org/docs/next/client-libraries-cpp/";
+    changelog = "https://github.com/apache/pulsar-client-cpp/releases/tag/${finalAttrs.src.tag}";
     platforms = lib.platforms.all;
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ corbanr ];
diff --git a/pkgs/by-name/lu/lux-cli/package.nix b/pkgs/by-name/lu/lux-cli/package.nix
index e01d48d22635..6ba4c58da862 100644
--- a/pkgs/by-name/lu/lux-cli/package.nix
+++ b/pkgs/by-name/lu/lux-cli/package.nix
@@ -18,18 +18,18 @@
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lux-cli";
 
-  version = "0.27.0";
+  version = "0.28.1";
 
   src = fetchFromGitHub {
     owner = "lumen-oss";
     repo = "lux";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EuAVD+gBd1k8huufgbjdFJC/aGXqlc/66kIIaC7td2Q=";
+    hash = "sha256-InsZGPiiPdZJEl3Nqa9i48ZKWU3eUKUPtoVtPz9FOsk=";
   };
 
   buildAndTestSubdir = "lux-cli";
 
-  cargoHash = "sha256-Xvvw4NbSYdMmihsu1bWNfHzI9oItGlhY/KLNiRUHj+k=";
+  cargoHash = "sha256-gnHhNf8dhCykgdbDzNJNM0tEc7UJR7bXNS0bkKqKEmw=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/ma/mark/package.nix b/pkgs/by-name/ma/mark/package.nix
index f53764f5009a..29d4436a0b6b 100644
--- a/pkgs/by-name/ma/mark/package.nix
+++ b/pkgs/by-name/ma/mark/package.nix
@@ -8,16 +8,16 @@
 # https://github.com/kovetskiy/mark/pull/581#issuecomment-2797872996
 buildGoModule (finalAttrs: {
   pname = "mark";
-  version = "16.2.0";
+  version = "16.3.0";
 
   src = fetchFromGitHub {
     owner = "kovetskiy";
     repo = "mark";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-yD7NsloCoLYwXXSk9ND5xYGIFS/GtMz/Ur66+grmzdI=";
+    sha256 = "sha256-ntTJHeesm3yZmjcRW6Hu2HsQjJaL2mZ0TY1hbfZNp3Q=";
   };
 
-  vendorHash = "sha256-joGVRYp1Yo7IABoBAusQal1/5DXyq0VzpqlHxZaq3XU=";
+  vendorHash = "sha256-04X107Y92qZTX1oK5hKED56CwR1ceUW6Ztppo4diAkw=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/ma/mastodon/gemset.nix b/pkgs/by-name/ma/mastodon/gemset.nix
index 6d490b5b6240..d1b29a4ada50 100644
--- a/pkgs/by-name/ma/mastodon/gemset.nix
+++ b/pkgs/by-name/ma/mastodon/gemset.nix
@@ -324,26 +324,29 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0ys6h3hhhv2w9j9d2ls8d3aaqywdcbipiqnqwr09c6gmqv6fgvv5";
+      sha256 = "0b30n0gwidxrz72whgkd54cj37anib7fn8pfijg63ryplvg1nggs";
       type = "gem";
     };
-    version = "1.1168.0";
+    version = "1.1238.0";
   };
   aws-sdk-core = {
     dependencies = [
       "aws-eventstream"
       "aws-partitions"
       "aws-sigv4"
+      "base64"
+      "bigdecimal"
       "jmespath"
+      "logger"
     ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1vmi65a22dq0rhjiydr94zwpn9hx3vib7vp922ccjg0vrih7mlzy";
+      sha256 = "1shqk9frm15g1ygiy33krwj34jrphfjc6w63bglxwnqcic3qqi9y";
       type = "gem";
     };
-    version = "3.215.1";
+    version = "3.244.0";
   };
   aws-sdk-kms = {
     dependencies = [
@@ -354,10 +357,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0xd3ddd9jiapkgv8im4pl9dcdy2ps7qjsssf2nz3q6sd1ca8x0di";
+      sha256 = "080zh4g1lcjl0bz2l0gjm8vmpd60cvi0p658bh235ypqh9zg61fl";
       type = "gem";
     };
-    version = "1.96.0";
+    version = "1.123.0";
   };
   aws-sdk-s3 = {
     dependencies = [
@@ -369,10 +372,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "10ziy8zslfjs0ihls7wiq6zvsncq89azh36rshmlylry1hhxjbxz";
+      sha256 = "1iziq88dwja5gjimqm875g72h0d1lrf1ha9widsjb1cpfxrmsxba";
       type = "gem";
     };
-    version = "1.177.0";
+    version = "1.219.0";
   };
   aws-sigv4 = {
     dependencies = [ "aws-eventstream" ];
@@ -430,10 +433,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "16a0g2q40biv93i1hch3gw8rbmhp77qnnifj1k0a6m7dng3zh444";
+      sha256 = "0clhya4p8lhjj7hp31inp321wgzb0b5wbwppmya5sw1dikl7400z";
       type = "gem";
     };
-    version = "3.1.20";
+    version = "3.1.22";
   };
   benchmark = {
     groups = [
@@ -1790,10 +1793,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "128bp3mihh175l9wm7hgg9sdisp6hd3kf36fw01iksqnq7kv5hdi";
+      sha256 = "05ni5q7mrbcqisz4xfzb7xznbx3wn1q55p5mwf97cdp5alrk9y6i";
       type = "gem";
     };
-    version = "2.15.1";
+    version = "2.15.2.1";
   };
   json-canonicalization = {
     groups = [ "default" ];
@@ -3245,10 +3248,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1lyn3rh71rlf50p44xmsbha0pip4c95004j8kc9pm7xpq1s0kgac";
+      sha256 = "1hhjy9gcp52dzij05gmidqac8g28ski5xm67prwmdqmjfcgqxmsy";
       type = "gem";
     };
-    version = "3.2.5";
+    version = "3.2.6";
   };
   rack-attack = {
     dependencies = [ "rack" ];
@@ -3334,10 +3337,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1sg4laz2qmllxh1c5sqlj9n1r7scdn08p3m4b0zmhjvyx9yw0v8b";
+      sha256 = "1s7zcxlmg88a6dam4aqbgk9xkpy6dkdfqmmcszkkliy3q3w38m2r";
       type = "gem";
     };
-    version = "2.1.1";
+    version = "2.1.2";
   };
   rack-test = {
     dependencies = [ "rack" ];
diff --git a/pkgs/by-name/ma/mastodon/source.nix b/pkgs/by-name/ma/mastodon/source.nix
index cde24fda16d3..7e7dbff6e5d8 100644
--- a/pkgs/by-name/ma/mastodon/source.nix
+++ b/pkgs/by-name/ma/mastodon/source.nix
@@ -5,17 +5,17 @@
   patches ? [ ],
 }:
 let
-  version = "4.5.8";
+  version = "4.5.9";
 in
 applyPatches {
   src = fetchFromGitHub {
     owner = "mastodon";
     repo = "mastodon";
     rev = "v${version}";
-    hash = "sha256-03PdAB9KOvMgQJPx+7ik13QE18fjdLIab7zEXaPc4nk=";
+    hash = "sha256-EXMJWdcuvQWe2cXONlcN/oB4b0nXwDqRT+miIB7P7js=";
     passthru = {
       inherit version;
-      yarnHash = "sha256-2MOl6kHidkGU2I/cZaUmbQCiEl9SDfL/j9fT/6eNdFA=";
+      yarnHash = "sha256-wgdOcdJdFJrOA2i4U44BjgZiMvHykzbe0X3IPvisppc=";
       yarnMissingHashes = ./missing-hashes.json;
     };
   };
diff --git a/pkgs/by-name/md/mdns-scanner/package.nix b/pkgs/by-name/md/mdns-scanner/package.nix
index e85fed6926aa..eb5165259143 100644
--- a/pkgs/by-name/md/mdns-scanner/package.nix
+++ b/pkgs/by-name/md/mdns-scanner/package.nix
@@ -2,20 +2,23 @@
   lib,
   fetchFromGitHub,
   rustPlatform,
+  nix-update-script,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mdns-scanner";
-  version = "0.27.0";
+  version = "0.27.1";
 
   src = fetchFromGitHub {
     owner = "CramBL";
     repo = "mdns-scanner";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rJhY2U7GMzt8/yoXKyHc0no38nfdYTnGn8ghdeNhM2Q=";
+    hash = "sha256-90+VBCxb4bbmGCpBLmqzhUJ0/9GAH8Fnju61kq7sx+A=";
   };
 
-  cargoHash = "sha256-n/KVarvd3gcWLYZD5Ww7XoMRHRuTcldxI/HB4Wta5NA=";
+  cargoHash = "sha256-LTL5nlT75Y/cALKVLVBWlMZZn9DewZfCbTAO1QsAfXI=";
+
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     homepage = "https://github.com/CramBL/mdns-scanner";
diff --git a/pkgs/by-name/mi/minio-warp/package.nix b/pkgs/by-name/mi/minio-warp/package.nix
index 11d719790e44..d8de36df7a37 100644
--- a/pkgs/by-name/mi/minio-warp/package.nix
+++ b/pkgs/by-name/mi/minio-warp/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "minio-warp";
-  version = "1.4.0";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "warp";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-y76A9m0vLCAEP7/HPRwCPZ5vt2xXw2f+dGmOOi86c1c=";
+    hash = "sha256-4TOlxyF45m6agRnaCW8DsGvhAD0NP0gWRLCdk1sWuYw=";
   };
 
-  vendorHash = "sha256-4gwFXMUCqr3Fui0iMnCNHLJ7ikyAdhX/rgZIarUNIHw=";
+  vendorHash = "sha256-PS06nM2cglw+xT1DoXkonLy1FIXViiDGNXWdFJI+qKc=";
 
   # See .goreleaser.yml
   ldflags = [
diff --git a/pkgs/by-name/mk/mkvtoolnix/package.nix b/pkgs/by-name/mk/mkvtoolnix/package.nix
index bb2397556d4b..7d320d5e78fe 100644
--- a/pkgs/by-name/mk/mkvtoolnix/package.nix
+++ b/pkgs/by-name/mk/mkvtoolnix/package.nix
@@ -52,13 +52,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mkvtoolnix";
-  version = "97.0";
+  version = "98.0";
 
   src = fetchFromCodeberg {
     owner = "mbunkus";
     repo = "mkvtoolnix";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-M8A3d6BOed1A/Bvw25bNGphXNDXJvHdg26OjOdwsNf4=";
+    hash = "sha256-gLs2+hbWFhhpabdknwoozH8WHgVNSR0VjnrmwQA7xrc=";
   };
 
   passthru = {
diff --git a/pkgs/by-name/na/nats-server/package.nix b/pkgs/by-name/na/nats-server/package.nix
index f78f82b1566b..d7b06db3c456 100644
--- a/pkgs/by-name/na/nats-server/package.nix
+++ b/pkgs/by-name/na/nats-server/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "nats-server";
-  version = "2.12.6";
+  version = "2.12.7";
 
   src = fetchFromGitHub {
     owner = "nats-io";
     repo = "nats-server";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-1gFYRbL9Lsw3SXUuBbIP1jyOE4S9iOvh7nBVNRbcwcc=";
+    hash = "sha256-7fv0Zd48eVA9zwAVG2SLs3a/9r7983PgZpUzh1GuSUw=";
   };
 
-  vendorHash = "sha256-+mlDcp9ccfmXiiVVuPn3qzqvqwoqYSMYeDV699zV5QU=";
+  vendorHash = "sha256-3+FAZSymDO1iTAWcgjrczE43Fgz6EEwLgOBEbDH4OyY=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/oc/oci-cli/package.nix b/pkgs/by-name/oc/oci-cli/package.nix
index d94b589dd29a..0e8ae3f64604 100644
--- a/pkgs/by-name/oc/oci-cli/package.nix
+++ b/pkgs/by-name/oc/oci-cli/package.nix
@@ -26,14 +26,14 @@ in
 
 py.pkgs.buildPythonApplication (finalAttrs: {
   pname = "oci-cli";
-  version = "3.77.0";
+  version = "3.79.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "oracle";
     repo = "oci-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2NIgOJejsRcXGEYqPdZZcZuIe/EF98GDN/JvKivAslI=";
+    hash = "sha256-VEGfIIUZj8Ee6XZMzKxltPczFBoC6bg1U+06vMhkGpg=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index 5dd682b3ae68..91501c1f3934 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -16,13 +16,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencode";
-  version = "1.4.3";
+  version = "1.4.6";
 
   src = fetchFromGitHub {
     owner = "anomalyco";
     repo = "opencode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-m+Ue7FWiTjKMAn1QefAwOMfOb2Vybk0mJPV9zcbkOmE=";
+    hash = "sha256-rVbWlVY4ujNVaE1o3SJmD0NrfWDtAfH+8MhOzmGgnhM=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {
@@ -72,7 +72,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     # NOTE: Required else we get errors that our fixed-output derivation references store paths
     dontFixup = true;
 
-    outputHash = "sha256-hVXlQcUuvUudIB35Td6ucBYopM/QOSx59tQbCTqoB/0=";
+    outputHash = "sha256-0vIkCiVnyy3FwXWI3ZooskJGMhEI75BP9Xc/ZLWaTbk=";
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
   };
diff --git a/pkgs/by-name/op/openroad/package.nix b/pkgs/by-name/op/openroad/package.nix
index 1dee04cbf9df..295af9848ab8 100644
--- a/pkgs/by-name/op/openroad/package.nix
+++ b/pkgs/by-name/op/openroad/package.nix
@@ -44,24 +44,16 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "openroad";
-  version = "26Q1";
+  version = "26Q2";
 
   src = fetchFromGitHub {
     owner = "The-OpenROAD-Project";
     repo = "OpenROAD";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-DMyoqDse9W6ahOajEINzFpgLsSKam/I1mQkRSSKepI8=";
+    hash = "sha256-dB9PfPlp6vZ9+Th8LJE65BW9YeuUL0G4JtjzQxg6UpQ=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "fix-openroad-commit-2a8b2c7.patch";
-      url = "https://github.com/The-OpenROAD-Project/OpenROAD/commit/2a8b2c7dcda87679a69df323b2ada5f3a21554ea.patch";
-      hash = "sha256-vgmVpr+vHbOd8UUUUyJ8sTKi0Y7CWYatF006WX4+zFI=";
-    })
-  ];
-
   nativeBuildInputs = [
     bison
     cmake
@@ -104,6 +96,34 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals stdenv.hostPlatform.isLinux [ libx11 ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.openmp ];
 
+  patches = [
+    # Fix UB in OpenSTA dcalc tests: fake Pin* pointers dereference via
+    # PinIdLess comparator, crashing with GCC 15's hardened vector bounds check.
+    # https://github.com/The-OpenROAD-Project/OpenSTA/pull/346
+    (fetchpatch {
+      url = "https://github.com/gonsolo/OpenSTA/commit/0e40b4f8a1c4b6af7225da31cd88a1d29d8a04a2.patch";
+      hash = "sha256-W9USjqp/hL1s3w3nKVMo/a5aSkeQ4Lp7gqASbZSlo9Y=";
+      stripLen = 1;
+      extraPrefix = "src/sta/";
+    })
+    # Feature-test std::from_chars to fix aarch64-darwin build where
+    # libcxx marks from_chars unavailable (macOS 26.0).
+    # https://github.com/The-OpenROAD-Project/OpenSTA/commit/a5921d1ca
+    (fetchpatch {
+      url = "https://github.com/The-OpenROAD-Project/OpenSTA/commit/a5921d1ca964971ada83be2c7c65bb84504fe179.patch";
+      hash = "sha256-j9BneXSIya/euYiol16swmrFkXTDZNTQwq3tPFkCLH0=";
+      stripLen = 1;
+      extraPrefix = "src/sta/";
+    })
+    # Replace deprecated sprintf with snprintf in Logger::error.
+    # macOS Apple SDK 14.4+ marks sprintf as deprecated, breaking -Werror builds.
+    # https://github.com/The-OpenROAD-Project/OpenROAD/pull/10127
+    (fetchpatch {
+      url = "https://github.com/The-OpenROAD-Project/OpenROAD/commit/2a9191bc5b2841a0c357886a2a1bc3ac0fe5271a.patch";
+      hash = "sha256-lxFZvybfG0Qpg1TyKdfZhKLYI3DSCYDE54ta6EnDBDo=";
+    })
+  ];
+
   postPatch = ''
     patchShebangs etc/
 
diff --git a/pkgs/by-name/or/orthanc/package.nix b/pkgs/by-name/or/orthanc/package.nix
index 3cc9566507eb..ba399d26c7e2 100644
--- a/pkgs/by-name/or/orthanc/package.nix
+++ b/pkgs/by-name/or/orthanc/package.nix
@@ -28,12 +28,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "orthanc";
-  version = "1.12.10";
+  version = "1.12.11";
 
   src = fetchhg {
     url = "https://orthanc.uclouvain.be/hg/orthanc/";
     rev = "Orthanc-${finalAttrs.version}";
-    hash = "sha256-+y+99NKyAWoQmvgCfubNuGiJ68uUwUvE2O64gZ/3uNA=";
+    hash = "sha256-EoohVYrnGN3dJUlXAd+10glcKA0AdZSyQ3wy2luycMQ=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/pa/paperless-ngx/package.nix b/pkgs/by-name/pa/paperless-ngx/package.nix
index b10e93e142a9..7d8d55e82a21 100644
--- a/pkgs/by-name/pa/paperless-ngx/package.nix
+++ b/pkgs/by-name/pa/paperless-ngx/package.nix
@@ -29,13 +29,13 @@
   lndir,
 }:
 let
-  version = "2.20.13";
+  version = "2.20.14";
 
   src = fetchFromGitHub {
     owner = "paperless-ngx";
     repo = "paperless-ngx";
     tag = "v${version}";
-    hash = "sha256-Oh0iFcGWsiPe7xCHw1+9z3BuWikEshVDLWeBPHrEJA0=";
+    hash = "sha256-xCpVABOf3rOm/PRZ5Doq8hoZVwRsII+8vFtb28eaBQ8=";
   };
 
   python = python3.override {
@@ -174,6 +174,7 @@ python.pkgs.buildPythonApplication rec {
     "celery"
     "django-allauth"
     "django-auditlog"
+    "django-cachalot"
     "drf-spectacular-sidecar"
     "python-dotenv"
     "gotenberg-client"
diff --git a/pkgs/by-name/pa/parca-agent/package.nix b/pkgs/by-name/pa/parca-agent/package.nix
index f9c6431b3846..bf4ec227d0eb 100644
--- a/pkgs/by-name/pa/parca-agent/package.nix
+++ b/pkgs/by-name/pa/parca-agent/package.nix
@@ -8,18 +8,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "parca-agent";
-  version = "0.46.0";
+  version = "0.47.0";
 
   src = fetchFromGitHub {
     owner = "parca-dev";
     repo = "parca-agent";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WUOHTH5nk5ryv7kE66gfwU25AEbiqyXv6NOj0SA59xQ=";
+    hash = "sha256-jnlynhwvjQRatx+0MO9EDA0q1TqmuDeeTdD7L6HzVi0=";
     fetchSubmodules = true;
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-c1HtY1hlhjtJuhJ1tz2wIzgyLqqpGZCPoLZGSNIxNDo=";
+  vendorHash = "sha256-W6m8L3dsqaHycSrvqY6mmpCHW4cSM+uGKei2JtjRc/Y=";
 
   buildInputs = [
     stdenv.cc.libc.static
diff --git a/pkgs/by-name/ph/phrase-cli/package.nix b/pkgs/by-name/ph/phrase-cli/package.nix
index e24f4407b177..4b4c211250ff 100644
--- a/pkgs/by-name/ph/phrase-cli/package.nix
+++ b/pkgs/by-name/ph/phrase-cli/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "phrase-cli";
-  version = "2.58.0";
+  version = "2.60.0";
 
   src = fetchFromGitHub {
     owner = "phrase";
     repo = "phrase-cli";
     rev = finalAttrs.version;
-    sha256 = "sha256-AFmLtF5XngvJy6hXh0L6dW4dvzVjlf5mHI2MgS3DT+g=";
+    sha256 = "sha256-9bwGtc6vQoxElrUm9Uf52Chy/fDUOSduIfbV5UjA09M=";
   };
 
-  vendorHash = "sha256-TmtDxo724yesSN7hZ4xoLG92BTwhz/hc5voY4wL7DHI=";
+  vendorHash = "sha256-w3XJUE1iM+yi4cMqMTUDhiafV5v42v4zBJzckv3Fd70=";
 
   ldflags = [ "-X=github.com/phrase/phrase-cli/cmd.PHRASE_CLIENT_VERSION=${finalAttrs.version}" ];
 
diff --git a/pkgs/by-name/pi/pijul/fix-rand-0.9-sanakirja-imports.patch b/pkgs/by-name/pi/pijul/fix-rand-0.9-sanakirja-imports.patch
new file mode 100644
index 000000000000..17f34d5d3f43
--- /dev/null
+++ b/pkgs/by-name/pi/pijul/fix-rand-0.9-sanakirja-imports.patch
@@ -0,0 +1,19 @@
+--- a/src/commands/git.rs
++++ b/src/commands/git.rs
+@@ -1,6 +1,7 @@
+ use anyhow::bail;
+ use clap::{Parser, ValueHint};
+ use libpijul::pristine::*;
++use ::sanakirja::RootPageMut as _;
+ use libpijul::*;
+ use log::{debug, error, info, trace};
+ use std::collections::{BTreeMap, BTreeSet, HashSet};
+@@ -564,7 +565,7 @@
+                                     tmp_path.pop();
+                                     use rand::Rng;
+                                     let s: String = rand::thread_rng()
+-                                        .sample_iter(&rand::distributions::Alphanumeric)
++                                        .sample_iter(&rand::distr::Alphanumeric)
+                                         .take(30)
+                                         .map(|x| x as char)
+                                         .collect();
diff --git a/pkgs/by-name/pi/pijul/package.nix b/pkgs/by-name/pi/pijul/package.nix
index 3f46c1e2c890..7252cb7eec97 100644
--- a/pkgs/by-name/pi/pijul/package.nix
+++ b/pkgs/by-name/pi/pijul/package.nix
@@ -5,6 +5,7 @@
   rustPlatform,
   installShellFiles,
   pkg-config,
+  dbus,
   libsodium,
   openssl,
   xxhash,
@@ -14,14 +15,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "pijul";
-  version = "1.0.0-beta.9";
+  version = "1.0.0-beta.11";
 
   src = fetchCrate {
     inherit (finalAttrs) version pname;
-    hash = "sha256-jy0mzgLw9iWuoWe2ictMTL3cHnjJ5kzs6TAK+pdm28g=";
+    hash = "sha256-+rMMqo2LBYlCFQJv8WFCSEJgDUbMi8DnVDKXIWm3tIk=";
   };
 
-  cargoHash = "sha256-d2IlBtR3j6SF8AAagUQftCOqTqN70rDMlHkA9byxXyk=";
+  cargoHash = "sha256-IhArTiReUdj49bA+XseQpOiszK801xX5LdLj8vXD8rs=";
+
+  patches = [ ./fix-rand-0.9-sanakirja-imports.patch ];
 
   doCheck = false;
   nativeBuildInputs = [
@@ -29,6 +32,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     pkg-config
   ];
   buildInputs = [
+    dbus
     openssl
     libsodium
     xxhash
diff --git a/pkgs/by-name/pr/pretix/package.nix b/pkgs/by-name/pr/pretix/package.nix
index 0a8e407c0eb8..b0f6df0356e4 100644
--- a/pkgs/by-name/pr/pretix/package.nix
+++ b/pkgs/by-name/pr/pretix/package.nix
@@ -5,7 +5,7 @@
   fetchPypi,
   libredirect,
   nodejs,
-  python312,
+  python3,
   gettext,
   nixosTests,
   pretix,
@@ -13,7 +13,7 @@
 }:
 
 let
-  python = python312.override {
+  python = python3.override {
     self = python;
     packageOverrides = self: super: {
       django = super.django_5;
@@ -96,6 +96,7 @@ python.pkgs.buildPythonApplication rec {
     "css-inline"
     "django-bootstrap3"
     "django-compressor"
+    "django-filter"
     "django-formset-js-improved"
     "django-i18nfield"
     "django-localflavor"
diff --git a/pkgs/by-name/pr/prismlauncher-unwrapped/package.nix b/pkgs/by-name/pr/prismlauncher-unwrapped/package.nix
index 76d03dc04516..5fa0fb32bf3a 100644
--- a/pkgs/by-name/pr/prismlauncher-unwrapped/package.nix
+++ b/pkgs/by-name/pr/prismlauncher-unwrapped/package.nix
@@ -28,13 +28,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "prismlauncher-unwrapped";
-  version = "11.0.1";
+  version = "11.0.2";
 
   src = fetchFromGitHub {
     owner = "PrismLauncher";
     repo = "PrismLauncher";
     tag = finalAttrs.version;
-    hash = "sha256-5OMDvGEVbF317gzq8w0LasecrEga1gkmSQ6FwwL7AOc=";
+    hash = "sha256-GvAfrZxQSlBnCJ59nvK87jDTVo60D8n25K42SokE1q8=";
   };
 
   postUnpack = ''
diff --git a/pkgs/by-name/py/pywal16/package.nix b/pkgs/by-name/py/pywal16/package.nix
index 5bffaf44d41e..c476be488dda 100644
--- a/pkgs/by-name/py/pywal16/package.nix
+++ b/pkgs/by-name/py/pywal16/package.nix
@@ -17,14 +17,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "pywal16";
-  version = "3.8.14";
+  version = "3.8.15";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "eylles";
     repo = "pywal16";
     tag = version;
-    hash = "sha256-68HbYH4wydaM1yY8kGHNIHTOZuUQRl+9o5ZPaemTlUE=";
+    hash = "sha256-2KlVeOrF/nfRZk12gthDJ08xNvVbP5em3eXPMudo1Vs=";
   };
 
   build-system = [ python3.pkgs.setuptools ];
diff --git a/pkgs/by-name/ra/ramalama/package.nix b/pkgs/by-name/ra/ramalama/package.nix
index 7340223194f4..692a7c5b2979 100644
--- a/pkgs/by-name/ra/ramalama/package.nix
+++ b/pkgs/by-name/ra/ramalama/package.nix
@@ -2,6 +2,7 @@
   lib,
   python3Packages,
   fetchFromGitHub,
+  fetchpatch,
   go-md2man,
 
   llama-cpp-vulkan,
@@ -15,14 +16,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "ramalama";
-  version = "0.17.1";
+  version = "0.18.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "ramalama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BXUWNP3yxuDsL1gY28oWhlu+vTIezYpDbScUsOulyYA=";
+    hash = "sha256-AqX8pNbeDPCxlwaSJg4+XVrfypvXGR77q8tkI7t3vTY=";
   };
 
   build-system = with python3Packages; [
@@ -42,6 +43,14 @@ python3Packages.buildPythonApplication (finalAttrs: {
     go-md2man
   ];
 
+  patches = [
+    # fix darwin tests: https://github.com/containers/ramalama/pull/2567
+    (fetchpatch {
+      url = "https://github.com/containers/ramalama/commit/2b51b749b706261a5f704b4d785dbd45447b14b6.patch";
+      hash = "sha256-HV7gn0W7b0P7OS53Js5JdHoFjvE7tO4e3RMReGZpRIo=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace ramalama/config.py --replace-fail "{sys.prefix}" "$out"
   '';
diff --git a/pkgs/by-name/ra/ranger/package.nix b/pkgs/by-name/ra/ranger/package.nix
index 2c6e22c3a5a1..333aeb46c4ac 100644
--- a/pkgs/by-name/ra/ranger/package.nix
+++ b/pkgs/by-name/ra/ranger/package.nix
@@ -19,14 +19,14 @@
 
 python3Packages.buildPythonApplication {
   pname = "ranger";
-  version = "1.9.4-unstable-2026-04-02";
+  version = "1.9.4-unstable-2026-04-14";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ranger";
     repo = "ranger";
-    rev = "15f607130149540841a0e7700cc4193e80408987";
-    hash = "sha256-QVTkVMlzeYwOmki7K8iUyHI1NsQkCRhupmw6hzPDhL0=";
+    rev = "9f671c6a577d19520ee3afd6e1a93bb35c10582c";
+    hash = "sha256-lZqVi8NakD7a0xCXLNWrbU3Rt1sR6EsWULsBvFM5Klc=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/re/renode-dts2repl/package.nix b/pkgs/by-name/re/renode-dts2repl/package.nix
index 459daa468ec8..8053ab37ace1 100644
--- a/pkgs/by-name/re/renode-dts2repl/package.nix
+++ b/pkgs/by-name/re/renode-dts2repl/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication {
   pname = "renode-dts2repl";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-15";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "antmicro";
     repo = "dts2repl";
-    rev = "89cecd8984777404ce0c905ad3f431131e8ffe8e";
-    hash = "sha256-BFAK3RDLTbMLVZRrirAFpK0FwGNKY1paz4HgtbSndfs=";
+    rev = "92936115afd0a696399cc9b2b79145ac03d4a92c";
+    hash = "sha256-YTdkEKm4C0bgAGnNOcnAxWaGFpOx43Jx8jTBe2YToto=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/se/sendspin-go/package.nix b/pkgs/by-name/se/sendspin-go/package.nix
index 2f0ef02fbb91..03574853b331 100644
--- a/pkgs/by-name/se/sendspin-go/package.nix
+++ b/pkgs/by-name/se/sendspin-go/package.nix
@@ -12,18 +12,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "sendspin-go";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "Sendspin";
     repo = "sendspin-go";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-37qTAjEgA6m9aYSt47z2jhnJwvI2Gk86bdPX+5m8hLw=";
+    hash = "sha256-hhUUtqtQZ48b/1nRcoUoY7H3cmzTfXdF239u7mKIopY=";
   };
 
   __structuredAttrs = true;
 
-  vendorHash = "sha256-l1fHIkyZ513wroyB4Lsn76r+WzijG2ahKVid5ujkTyA=";
+  vendorHash = "sha256-OfomzW2kbkSdkDhie529IbRUNXWM3lqmq/bCGzaWXG4=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/sh/shrinkray/package.nix b/pkgs/by-name/sh/shrinkray/package.nix
index 9d108cab79ec..f1f5b46c2ad6 100644
--- a/pkgs/by-name/sh/shrinkray/package.nix
+++ b/pkgs/by-name/sh/shrinkray/package.nix
@@ -12,14 +12,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "shrinkray";
-  version = "26.3.17.0";
+  version = "26.4.14.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "DRMacIver";
     repo = "shrinkray";
     tag = "v${version}";
-    hash = "sha256-1sdUfgT/2fC6zpFR20okmaueqdjJ5nWwUl3n8nsGXTU=";
+    hash = "sha256-zNOWBpj39R9x/wQ3fAKMzHg61IFGh8aeHBeVsXxXDGM=";
   };
   postPatch = ''
     substituteInPlace tests/test_main.py \
diff --git a/pkgs/by-name/sy/syncthingtray/package.nix b/pkgs/by-name/sy/syncthingtray/package.nix
index 440194a0b53c..2d37c61d419e 100644
--- a/pkgs/by-name/sy/syncthingtray/package.nix
+++ b/pkgs/by-name/sy/syncthingtray/package.nix
@@ -27,14 +27,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "2.0.9";
+  version = "2.0.10";
   pname = "syncthingtray";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = "syncthingtray";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-kWOr+PLO+qxjDZhsMrQwi2bRPlK5hKNaoRcHX1nOYFg=";
+    hash = "sha256-dzsDTb7r1kbVTiapXskE5xvfdzGT2u3utbHGbt/1X7I=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/ta/task-keeper/package.nix b/pkgs/by-name/ta/task-keeper/package.nix
index dcc01b1cc75e..51ac41f7b6a8 100644
--- a/pkgs/by-name/ta/task-keeper/package.nix
+++ b/pkgs/by-name/ta/task-keeper/package.nix
@@ -2,34 +2,86 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  just,
   openssl,
   pkg-config,
+  runCommand,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "task-keeper";
-  version = "0.30.1";
+  version = "0.33.0";
 
   src = fetchFromGitHub {
     owner = "linux-china";
     repo = "task-keeper";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/ZmwCvoYdX733c5QkUE0KuUdHeibJkXD5wNHR7Cr7aU=";
+    hash = "sha256-pSMF0ORwHUV9H6RAMRaEt/A61MVIj5cQcsY+wDDyAwk=";
+  };
+
+  patches = [
+    # https://github.com/linux-china/task-keeper/pull/20
+    ./version.patch
+  ];
+
+  env = {
+    OPENSSL_NO_VENDOR = 1;
   };
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ];
 
-  cargoHash = "sha256-Z56p2jeHvNAT4Pwl8kt1l9RopYCKk5Tt/XWZ7AqIFYw=";
+  cargoHash = "sha256-leQpeB145seO2mPg+eqA3S5ATbRBzsXj9cWNsVpXF+U=";
 
   # tests depend on many packages (java, node, python, sbt, ...) - which I'm not currently willing to set up 😅
   doCheck = false;
 
+  passthru = {
+    tests = {
+      makefile =
+        runCommand "task-keeper-makefile-test"
+          {
+            nativeBuildInputs = [ finalAttrs.finalPackage ];
+          }
+          ''
+            printf "nix-test-task:\n\techo 2047" > Makefile
+            tk > output.txt
+            grep -qF -- "make: Makefile" output.txt
+            grep -qF -- "-- nix-test-task" output.txt
+            tk nix-test-task > output.txt
+            grep -qF -- "[tk] execute nix-test-task from make" output.txt
+            grep -qF -- "echo 2047" output.txt
+            touch $out
+          '';
+      justfile =
+        runCommand "task-keeper-justfile-test"
+          {
+            nativeBuildInputs = [
+              finalAttrs.finalPackage
+              just
+            ];
+          }
+          ''
+            printf "nix-test-just-task:\n\techo 4095" > Justfile
+            tk > output.txt
+            grep -qF -- "just: Justfile" output.txt
+            grep -qF -- "-- nix-test-just-task" output.txt
+            tk nix-test-just-task > stdout.txt 2> stderr.txt
+            grep -qF -- "[tk] execute nix-test-just-task from just" stdout.txt
+            grep -qF -- "echo 4095" stderr.txt
+            touch $out
+          '';
+    };
+  };
+
   meta = {
     homepage = "https://github.com/linux-china/task-keeper";
     description = "CLI to manage tasks from different task runners or package managers";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ tennox ];
+    maintainers = with lib.maintainers; [
+      tennox
+      DimitarNestorov
+    ];
     mainProgram = "tk";
   };
 })
diff --git a/pkgs/by-name/ta/task-keeper/version.patch b/pkgs/by-name/ta/task-keeper/version.patch
new file mode 100644
index 000000000000..2f0326529128
--- /dev/null
+++ b/pkgs/by-name/ta/task-keeper/version.patch
@@ -0,0 +1,13 @@
+diff --git a/src/app.rs b/src/app.rs
+index 77eaee4..daf3633 100644
+--- a/src/app.rs
++++ b/src/app.rs
+@@ -1,7 +1,7 @@
+ //! clap App for command cli
+ use clap::{Command, Arg, ArgAction};
+ 
+-pub const VERSION: &str = "0.32.0";
++pub const VERSION: &str = "0.33.0";
+ 
+ pub fn build_app() -> Command {
+     Command::new("tk")
diff --git a/pkgs/by-name/tv/tvm/package.nix b/pkgs/by-name/tv/tvm/package.nix
index 5bf348d96614..ca39c149b0d3 100644
--- a/pkgs/by-name/tv/tvm/package.nix
+++ b/pkgs/by-name/tv/tvm/package.nix
@@ -7,14 +7,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tvm";
-  version = "0.22.0";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "apache";
     repo = "incubator-tvm";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-KcHUcblwtqxNofHKofuQHu2d7hIqS9FUvc41OkCVtnY=";
+    hash = "sha256-+YnxYIGaPMgfLDsQEiCpqGuJRBTFEbXWI1L2JdnUyfI=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index 9639925e8cad..471069fe1b54 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -14,14 +14,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.30";
+  version = "0.0.31";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-EpCIU4RAYbcZA63tsKiUhnXdZVIBV1oZwPgNGw0xRr0=";
+    hash = "sha256-TJGEI22hp+YZCxIvZgNc8BF2Dd+z/TzpnRW2pO1f3X0=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -35,7 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-juX/Xc53X5OpK3XhcubUkcbDJVyMSTjloUfSPMoMb7M=";
+  cargoHash = "sha256-JTE/zRf+VqBoLaoMaQ4ioVsr3Njm3OGkpMMnsPg3lsA=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/v2/v2ray/package.nix b/pkgs/by-name/v2/v2ray/package.nix
index f053e92d2dbe..85cb335f6836 100644
--- a/pkgs/by-name/v2/v2ray/package.nix
+++ b/pkgs/by-name/v2/v2ray/package.nix
@@ -16,18 +16,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "v2ray-core";
-  version = "5.48.0";
+  version = "5.49.0";
 
   src = fetchFromGitHub {
     owner = "v2fly";
     repo = "v2ray-core";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-MPJffUx9RHC7h3H7wzIUQkZ55Lj25pB3z8uMStZwrSs=";
+    hash = "sha256-a1q/QJpXt3XJZwSteOf3+cQ2W7+KmMfknv1qaByg4Hc=";
   };
 
   # `nix-update` doesn't support `vendorHash` yet.
   # https://github.com/Mic92/nix-update/pull/95
-  vendorHash = "sha256-dHEXhXB/KI3upttmsyT9mNZPCIgFjjKVC8uAEjngAfc=";
+  vendorHash = "sha256-A45fCy9Ytm/zVLQEn1QbUumBYZVG+jbmSFWkS/yAJn4=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/va/vals/package.nix b/pkgs/by-name/va/vals/package.nix
index 07b3b554f7bb..815bb9b59683 100644
--- a/pkgs/by-name/va/vals/package.nix
+++ b/pkgs/by-name/va/vals/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "vals";
-  version = "0.43.8";
+  version = "0.43.9";
 
   src = fetchFromGitHub {
     rev = "v${finalAttrs.version}";
     owner = "helmfile";
     repo = "vals";
-    sha256 = "sha256-rpaftlWYhSA95KrX5Dg6gizqMMzEmvzFe6FWWoXiOuU=";
+    sha256 = "sha256-NMsn5nTgR7t8vN0cAUJryGZatdeQzoBcXyPRe9GyYY4=";
   };
 
-  vendorHash = "sha256-SbvFBoXTjApEucMb664GcI/6Jc7g7RbKzatnHVNF2ss=";
+  vendorHash = "sha256-V/Yhok9OY/jLiWGWSPb3d69ituhQyYFS/xY335XyZgw=";
 
   proxyVendor = true;
 
diff --git a/pkgs/by-name/vi/vintagestory/package.nix b/pkgs/by-name/vi/vintagestory/package.nix
index ce5ee91fcdbc..6d066f7d3d64 100644
--- a/pkgs/by-name/vi/vintagestory/package.nix
+++ b/pkgs/by-name/vi/vintagestory/package.nix
@@ -5,13 +5,9 @@
   makeWrapper,
   makeDesktopItem,
   copyDesktopItems,
-  gtk2,
-  sqlite,
-  openal,
+  versionCheckHook,
   cairo,
   libGLU,
-  SDL2,
-  freealut,
   libglvnd,
   pipewire,
   libpulseaudio,
@@ -39,34 +35,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-LkiL/8W9MKpmJxtK+s5JvqhOza0BLap1SsaDvbLYR0c=";
   };
 
+  __structuredAttrs = true;
+
   nativeBuildInputs = [
     makeWrapper
     copyDesktopItems
     imagemagick
   ];
 
-  runtimeLibs = [
-    gtk2
-    sqlite
-    openal
-    cairo
-    libGLU
-    SDL2
-    freealut
-    libglvnd
-    pipewire
-    libpulseaudio
-  ]
-  ++ lib.optionals x11Support [
-    libx11
-    libxi
-    libxcursor
-  ]
-  ++ lib.optionals waylandSupport [
-    wayland
-    libxkbcommon
-  ];
-
   desktopItems = [
     (makeDesktopItem {
       name = "vintagestory";
@@ -96,41 +72,69 @@ stdenv.mkDerivation (finalAttrs: {
     magick $out/share/vintagestory/assets/gameicon.xpm $out/share/icons/hicolor/512x512/apps/vintagestory.png
     cp $out/share/vintagestory/assets/game/fonts/*.ttf $out/share/fonts/truetype
 
+    rm -rvf $out/share/vintagestory/{install,run,server}.sh
+
     runHook postInstall
   '';
 
-  preFixup =
-    let
-      runtimeLibs' = lib.strings.makeLibraryPath finalAttrs.runtimeLibs;
-    in
-    ''
-      makeWrapper ${lib.meta.getExe dotnet-runtime_8} $out/bin/vintagestory \
-        --prefix LD_LIBRARY_PATH : "${runtimeLibs'}" \
-        --set-default mesa_glthread true \
-        ${lib.strings.optionalString waylandSupport ''
-          --set-default OPENTK_4_USE_WAYLAND 1 \
-        ''} \
-        --add-flags $out/share/vintagestory/Vintagestory.dll
+  makeWrapperArgs = [
+    "--set-default"
+    "mesa_glthread"
+    "true"
+  ]
+  ++ lib.optionals waylandSupport [
+    "--set-default"
+    "OPENTK_4_USE_WAYLAND"
+    "1"
+  ];
 
-      makeWrapper ${lib.meta.getExe dotnet-runtime_8} $out/bin/vintagestory-server \
-        --prefix LD_LIBRARY_PATH : "${runtimeLibs'}" \
-        --set-default mesa_glthread true \
-        --add-flags $out/share/vintagestory/VintagestoryServer.dll
+  runtimeLibraryPath = lib.makeLibraryPath finalAttrs.passthru.runtimeLibs;
+  preFixup = ''
+     makeWrapperArgs+=(--prefix LD_LIBRARY_PATH : "$runtimeLibraryPath")
 
-      find "$out/share/vintagestory/assets/" -not -path "*/fonts/*" -regex ".*/.*[A-Z].*" | while read -r file; do
-        local filename="$(basename -- "$file")"
-        ln -sf "$filename" "''${file%/*}"/"''${filename,,}"
-      done
-    '';
+     makeWrapper ${lib.meta.getExe dotnet-runtime_8} $out/bin/vintagestory \
+      "''${makeWrapperArgs[@]}" \
+       --add-flags $out/share/vintagestory/Vintagestory.dll
 
-  passthru.updateScript = ./update.sh;
+    makeWrapper ${lib.getExe dotnet-runtime_8} $out/bin/vintagestory-server \
+      "''${makeWrapperArgs[@]}" \
+      --add-flags $out/share/vintagestory/VintagestoryServer.dll
+
+     find "$out/share/vintagestory/assets/" -not -path "*/fonts/*" -regex ".*/.*[A-Z].*" | while read -r file; do
+       local filename="$(basename -- "$file")"
+       ln -sf "$filename" "''${file%/*}"/"''${filename,,}"
+     done
+  '';
+
+  doInstallCheck = true;
+  installCheckInputs = [ versionCheckHook ];
+
+  passthru = {
+    updateScript = ./update.sh;
+    runtimeLibs = [
+      cairo
+      libGLU
+      libglvnd
+      pipewire
+      libpulseaudio
+    ]
+    ++ lib.optionals x11Support [
+      libx11
+      libxi
+      libxcursor
+    ]
+    ++ lib.optionals waylandSupport [
+      wayland
+      libxkbcommon
+    ];
+  };
 
   meta = {
     description = "In-development indie sandbox game about innovation and exploration";
     homepage = "https://www.vintagestory.at/";
     license = lib.licenses.unfree;
     sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
-    platforms = lib.platforms.linux;
+    platforms = [ "x86_64-linux" ];
     maintainers = with lib.maintainers; [
       artturin
       gigglesquid
diff --git a/pkgs/by-name/we/webanalyze/package.nix b/pkgs/by-name/we/webanalyze/package.nix
index 38f85fc9185d..5bd59202d210 100644
--- a/pkgs/by-name/we/webanalyze/package.nix
+++ b/pkgs/by-name/we/webanalyze/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "webanalyze";
-  version = "0.4.1";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "rverton";
     repo = "webanalyze";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rnNbEPlbye0gjUamwq1xjFM/4g0eEHsGOAZWziEqxwM=";
+    hash = "sha256-Mz8YPx2pr0h8QpZ/q1ikfKfzyyLn7meLFeyv2meO5NA=";
   };
 
-  vendorHash = "sha256-XPOsC+HoLytgv1fhAaO5HYSvuOP6OhjLyOYTfiD64QI=";
+  vendorHash = "sha256-GesrxrPUMvMFrVPg1t+ArMfbkNUu7CHGmk1423IFnCY=";
 
   meta = {
     description = "Tool to uncover technologies used on websites";
diff --git a/pkgs/by-name/wi/witness/package.nix b/pkgs/by-name/wi/witness/package.nix
index 8b6c974ba796..7d218c133b93 100644
--- a/pkgs/by-name/wi/witness/package.nix
+++ b/pkgs/by-name/wi/witness/package.nix
@@ -12,15 +12,15 @@
 
 buildGoModule (finalAttrs: {
   pname = "witness";
-  version = "0.10.2";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "in-toto";
     repo = "witness";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-rhCp2VhrL/kaZ2MIje7DijKK48rAJsgmjisCyXO7Ydk=";
+    sha256 = "sha256-KdTKzBATux5QgSPd0qQBVZq0oZsDyLWhQtg+O/OFevM=";
   };
-  vendorHash = "sha256-3kvcG6REIR7TNB28yd58fGqwtM8qZBPqBu0/jG6kQIY=";
+  vendorHash = "sha256-wog0BwJSHJxa+YFEMiCr6Cg1cQL50fSiqI3AyJ44xiU=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/xa/xan/package.nix b/pkgs/by-name/xa/xan/package.nix
index b05e9b2d99da..a83c56593325 100644
--- a/pkgs/by-name/xa/xan/package.nix
+++ b/pkgs/by-name/xa/xan/package.nix
@@ -5,16 +5,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "xan";
-  version = "0.57.0";
+  version = "0.57.1";
 
   src = fetchFromGitHub {
     owner = "medialab";
     repo = "xan";
     tag = finalAttrs.version;
-    hash = "sha256-54kLrWOSHnS26nogw/u3Prq6nfxsrT/VaDKEQr8kK48=";
+    hash = "sha256-tuzhQ0sh5wKnHrm9FdNvynwagsqPttLE0too/0ZaTWs=";
   };
 
-  cargoHash = "sha256-3L6WMkCecyhYVWchcFcs5lesxax468pIZc+ZllLwbro=";
+  cargoHash = "sha256-EL0qijX5ELjs13lQ9Es8imKyJQBfS04b4nVOvR5IFWE=";
 
   # FIXME: tests fail and I do not have the time to investigate. Temporarily disable
   # tests so that we can manually run and test the package for packaging purposes.
diff --git a/pkgs/by-name/za/zap-chip/dont-get-version-from-git.patch b/pkgs/by-name/za/zap-chip/dont-get-version-from-git.patch
index ec31cab794fc..e4f126474e50 100644
--- a/pkgs/by-name/za/zap-chip/dont-get-version-from-git.patch
+++ b/pkgs/by-name/za/zap-chip/dont-get-version-from-git.patch
@@ -1,8 +1,8 @@
 diff --git a/src-script/script-util.js b/src-script/script-util.js
-index 1897c2b8..aaf9a08b 100644
+index fb8fe7a8589f..2b2a43f46053 100644
 --- a/src-script/script-util.js
 +++ b/src-script/script-util.js
-@@ -196,23 +194,6 @@ async function rebuildBackendIfNeeded() {
+@@ -237,28 +237,6 @@ async function rebuildBackendIfNeeded() {
   * ads the timestamp and saves it into .version.json
   */
  async function stampVersion() {
@@ -18,7 +18,12 @@ index 1897c2b8..aaf9a08b 100644
 -    version.date = d
 -    version.zapVersion = result.version
 -    let versionFile = path.join(__dirname, '../.version.json')
--    console.log(`🔍 Git commit: ${version.hash} from ${version.date}`)
+-    console.log(
+-      env.formatEmojiMessage(
+-        '🔍',
+-        `Git commit: ${version.hash} from ${version.date}`
+-      )
+-    )
 -    await fsp.writeFile(versionFile, JSON.stringify(version))
 -  } catch (err) {
 -    console.log(`Error retrieving version: ${err}`)
diff --git a/pkgs/by-name/za/zap-chip/package.nix b/pkgs/by-name/za/zap-chip/package.nix
index 12408bcd020a..dfb9b0a3967c 100644
--- a/pkgs/by-name/za/zap-chip/package.nix
+++ b/pkgs/by-name/za/zap-chip/package.nix
@@ -11,21 +11,26 @@
 
 buildNpmPackage rec {
   pname = "zap-chip";
-  version = "2025.07.24";
+  version = "2026.02.26";
 
   src = fetchFromGitHub {
     owner = "project-chip";
     repo = "zap";
     rev = "v${version}";
-    hash = "sha256-MGu4qr+iXqI+GTpThI8yCcjt0KAcEwgJJa7wSnbryco=";
+    hash = "sha256-iAubYY/gFVjqNGnI8PIv3twc5j/8a46ycAiaZ7nw1VY=";
   };
 
-  npmDepsHash = "sha256-2AWqqMm91Ql9JA5oqon7H1YUuzJG+Z9c3LpsbQ9HE90=";
+  npmDepsHash = "sha256-SIworjSX2SLiNA2Oshvem0mOW795WkbHWP8WFD9yp8g=";
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
   env.CYPRESS_INSTALL_BINARY = "0";
 
   patches = [
+    # The release's package-lock.json file is not universal. It misses
+    # architecture-related packages, caused by an NPM bug. Add these to the
+    # lock otherwise `npm ci` complains.
+    # https://github.com/npm/cli/issues/8805
+    ./universal-npm-lock.patch
     # the build system creates a file `.version.json` from a git command
     # as we don't build from a git repo, we create the file manually in postPatch
     # and this patch disables the logic running git
diff --git a/pkgs/by-name/za/zap-chip/universal-npm-lock.patch b/pkgs/by-name/za/zap-chip/universal-npm-lock.patch
new file mode 100644
index 000000000000..ef97b5372d22
--- /dev/null
+++ b/pkgs/by-name/za/zap-chip/universal-npm-lock.patch
@@ -0,0 +1,276 @@
+diff --git a/package-lock.json b/package-lock.json
+index 3034c5e47fdd..b6cf9a9995b9 100644
+--- a/package-lock.json
++++ b/package-lock.json
+@@ -81,20 +81,20 @@
+         "eslint-plugin-vue": "^9.27.0",
+         "eslint-webpack-plugin": "^4.2.0",
+         "folder-hash": "^4.0.1",
+-        "husky": "^9.1.7",
++        "husky": "9.1.7",
+         "is-reachable": "^5.2.1",
+         "jest": "^29.2.2",
+         "jest-junit": "^16.0.0",
+         "jest-sonar-reporter": "^2.0.0",
+-        "jsdoc": "^4.0.5",
++        "jsdoc": "4.0.5",
+         "jsdoc-to-markdown": "^8.0.3",
+         "license-checker": "^25.0.1",
+         "node-7z": "^3.0.0",
+         "node-gyp": "^10.2.0",
+         "nodejs-file-downloader": "^4.9.3",
+         "octokit": "^1.7.2",
+-        "prettier": "^3.6.2",
+-        "pretty-quick": "^4.2.2",
++        "prettier": "3.6.2",
++        "pretty-quick": "4.2.2",
+         "sonar-scanner": "^3.1.0",
+         "test-utils": "^1.1.1",
+         "typescript": "4.6",
+@@ -6071,6 +6071,246 @@
+         }
+       }
+     },
++    "node_modules/@rollup/rollup-android-arm-eabi": {
++      "version": "4.20.0",
++      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.20.0.tgz",
++      "integrity": "sha512-TSpWzflCc4VGAUJZlPpgAJE1+V60MePDQnBd7PPkpuEmOy8i87aL6tinFGKBFKuEDikYpig72QzdT3QPYIi+oA==",
++      "cpu": [
++        "arm"
++      ],
++      "dev": true,
++      "license": "MIT",
++      "optional": true,
++      "os": [
++        "android"
++      ],
++      "peer": true
++    },
++    "node_modules/@rollup/rollup-android-arm64": {
++      "version": "4.20.0",
++      "resolved": "https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.20.0.tgz",
++      "integrity": "sha512-u00Ro/nok7oGzVuh/FMYfNoGqxU5CPWz1mxV85S2w9LxHR8OoMQBuSk+3BKVIDYgkpeOET5yXkx90OYFc+ytpQ==",
++      "cpu": [
++        "arm64"
++      ],
++      "dev": true,
++      "license": "MIT",
++      "optional": true,
++      "os": [
++        "android"
++      ],
++      "peer": true
++    },
++    "node_modules/@rollup/rollup-darwin-arm64": {
++      "version": "4.20.0",
++      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.20.0.tgz",
++      "integrity": "sha512-uFVfvzvsdGtlSLuL0ZlvPJvl6ZmrH4CBwLGEFPe7hUmf7htGAN+aXo43R/V6LATyxlKVC/m6UsLb7jbG+LG39Q==",
++      "cpu": [
++        "arm64"
++      ],
++      "dev": true,
++      "license": "MIT",
++      "optional": true,
++      "os": [
++        "darwin"
++      ],
++      "peer": true
++    },
++    "node_modules/@rollup/rollup-darwin-x64": {
++      "version": "4.20.0",
++      "resolved": "https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.20.0.tgz",
++      "integrity": "sha512-xbrMDdlev53vNXexEa6l0LffojxhqDTBeL+VUxuuIXys4x6xyvbKq5XqTXBCEUA8ty8iEJblHvFaWRJTk/icAQ==",
++      "cpu": [
++        "x64"
++      ],
++      "dev": true,
++      "license": "MIT",
++      "optional": true,
++      "os": [
++        "darwin"
++      ],
++      "peer": true
++    },
++    "node_modules/@rollup/rollup-linux-arm-gnueabihf": {
++      "version": "4.20.0",
++      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.20.0.tgz",
++      "integrity": "sha512-jMYvxZwGmoHFBTbr12Xc6wOdc2xA5tF5F2q6t7Rcfab68TT0n+r7dgawD4qhPEvasDsVpQi+MgDzj2faOLsZjA==",
++      "cpu": [
++        "arm"
++      ],
++      "dev": true,
++      "license": "MIT",
++      "optional": true,
++      "os": [
++        "linux"
++      ],
++      "peer": true
++    },
++    "node_modules/@rollup/rollup-linux-arm-musleabihf": {
++      "version": "4.20.0",
++      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.20.0.tgz",
++      "integrity": "sha512-1asSTl4HKuIHIB1GcdFHNNZhxAYEdqML/MW4QmPS4G0ivbEcBr1JKlFLKsIRqjSwOBkdItn3/ZDlyvZ/N6KPlw==",
++      "cpu": [
++        "arm"
++      ],
++      "dev": true,
++      "license": "MIT",
++      "optional": true,
++      "os": [
++        "linux"
++      ],
++      "peer": true
++    },
++    "node_modules/@rollup/rollup-linux-arm64-gnu": {
++      "version": "4.20.0",
++      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.20.0.tgz",
++      "integrity": "sha512-COBb8Bkx56KldOYJfMf6wKeYJrtJ9vEgBRAOkfw6Ens0tnmzPqvlpjZiLgkhg6cA3DGzCmLmmd319pmHvKWWlQ==",
++      "cpu": [
++        "arm64"
++      ],
++      "dev": true,
++      "license": "MIT",
++      "optional": true,
++      "os": [
++        "linux"
++      ],
++      "peer": true
++    },
++    "node_modules/@rollup/rollup-linux-arm64-musl": {
++      "version": "4.20.0",
++      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.20.0.tgz",
++      "integrity": "sha512-+it+mBSyMslVQa8wSPvBx53fYuZK/oLTu5RJoXogjk6x7Q7sz1GNRsXWjn6SwyJm8E/oMjNVwPhmNdIjwP135Q==",
++      "cpu": [
++        "arm64"
++      ],
++      "dev": true,
++      "license": "MIT",
++      "optional": true,
++      "os": [
++        "linux"
++      ],
++      "peer": true
++    },
++    "node_modules/@rollup/rollup-linux-powerpc64le-gnu": {
++      "version": "4.20.0",
++      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-powerpc64le-gnu/-/rollup-linux-powerpc64le-gnu-4.20.0.tgz",
++      "integrity": "sha512-yAMvqhPfGKsAxHN8I4+jE0CpLWD8cv4z7CK7BMmhjDuz606Q2tFKkWRY8bHR9JQXYcoLfopo5TTqzxgPUjUMfw==",
++      "cpu": [
++        "ppc64"
++      ],
++      "dev": true,
++      "license": "MIT",
++      "optional": true,
++      "os": [
++        "linux"
++      ],
++      "peer": true
++    },
++    "node_modules/@rollup/rollup-linux-riscv64-gnu": {
++      "version": "4.20.0",
++      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.20.0.tgz",
++      "integrity": "sha512-qmuxFpfmi/2SUkAw95TtNq/w/I7Gpjurx609OOOV7U4vhvUhBcftcmXwl3rqAek+ADBwSjIC4IVNLiszoj3dPA==",
++      "cpu": [
++        "riscv64"
++      ],
++      "dev": true,
++      "license": "MIT",
++      "optional": true,
++      "os": [
++        "linux"
++      ],
++      "peer": true
++    },
++    "node_modules/@rollup/rollup-linux-s390x-gnu": {
++      "version": "4.20.0",
++      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.20.0.tgz",
++      "integrity": "sha512-I0BtGXddHSHjV1mqTNkgUZLnS3WtsqebAXv11D5BZE/gfw5KoyXSAXVqyJximQXNvNzUo4GKlCK/dIwXlz+jlg==",
++      "cpu": [
++        "s390x"
++      ],
++      "dev": true,
++      "license": "MIT",
++      "optional": true,
++      "os": [
++        "linux"
++      ],
++      "peer": true
++    },
++    "node_modules/@rollup/rollup-linux-x64-gnu": {
++      "version": "4.20.0",
++      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.20.0.tgz",
++      "integrity": "sha512-y+eoL2I3iphUg9tN9GB6ku1FA8kOfmF4oUEWhztDJ4KXJy1agk/9+pejOuZkNFhRwHAOxMsBPLbXPd6mJiCwew==",
++      "cpu": [
++        "x64"
++      ],
++      "dev": true,
++      "license": "MIT",
++      "optional": true,
++      "os": [
++        "linux"
++      ],
++      "peer": true
++    },
++    "node_modules/@rollup/rollup-linux-x64-musl": {
++      "version": "4.20.0",
++      "resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.20.0.tgz",
++      "integrity": "sha512-hM3nhW40kBNYUkZb/r9k2FKK+/MnKglX7UYd4ZUy5DJs8/sMsIbqWK2piZtVGE3kcXVNj3B2IrUYROJMMCikNg==",
++      "cpu": [
++        "x64"
++      ],
++      "dev": true,
++      "license": "MIT",
++      "optional": true,
++      "os": [
++        "linux"
++      ],
++      "peer": true
++    },
++    "node_modules/@rollup/rollup-win32-arm64-msvc": {
++      "version": "4.20.0",
++      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.20.0.tgz",
++      "integrity": "sha512-psegMvP+Ik/Bg7QRJbv8w8PAytPA7Uo8fpFjXyCRHWm6Nt42L+JtoqH8eDQ5hRP7/XW2UiIriy1Z46jf0Oa1kA==",
++      "cpu": [
++        "arm64"
++      ],
++      "dev": true,
++      "license": "MIT",
++      "optional": true,
++      "os": [
++        "win32"
++      ],
++      "peer": true
++    },
++    "node_modules/@rollup/rollup-win32-ia32-msvc": {
++      "version": "4.20.0",
++      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.20.0.tgz",
++      "integrity": "sha512-GabekH3w4lgAJpVxkk7hUzUf2hICSQO0a/BLFA11/RMxQT92MabKAqyubzDZmMOC/hcJNlc+rrypzNzYl4Dx7A==",
++      "cpu": [
++        "ia32"
++      ],
++      "dev": true,
++      "license": "MIT",
++      "optional": true,
++      "os": [
++        "win32"
++      ],
++      "peer": true
++    },
++    "node_modules/@rollup/rollup-win32-x64-msvc": {
++      "version": "4.20.0",
++      "resolved": "https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.20.0.tgz",
++      "integrity": "sha512-aJ1EJSuTdGnM6qbVC4B5DSmozPTqIag9fSzXRNNo+humQLG89XpPgdt16Ia56ORD7s+H8Pmyx44uczDQ0yDzpg==",
++      "cpu": [
++        "x64"
++      ],
++      "dev": true,
++      "license": "MIT",
++      "optional": true,
++      "os": [
++        "win32"
++      ],
++      "peer": true
++    },
+     "node_modules/@sideway/address": {
+       "version": "4.1.5",
+       "resolved": "https://registry.npmjs.org/@sideway/address/-/address-4.1.5.tgz",
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 6fb9adc99e46..35d40ff53735 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -256,7 +256,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     install -Dm755 $release_target/zed $out/libexec/zed-editor
     install -Dm755 $release_target/cli $out/bin/zeditor
 
-    install -Dm644 $src/crates/zed/resources/app-icon@2x.png $out/share/icons/hicolor/512x512@2x/apps/zed.png
+    install -Dm644 $src/crates/zed/resources/app-icon@2x.png $out/share/icons/hicolor/512x512@2/apps/zed.png
     install -Dm644 $src/crates/zed/resources/app-icon.png $out/share/icons/hicolor/512x512/apps/zed.png
 
     # extracted from https://github.com/zed-industries/zed/blob/v0.141.2/script/bundle-linux (envsubst)
diff --git a/pkgs/by-name/ze/zeno/package.nix b/pkgs/by-name/ze/zeno/package.nix
index 0ba903bcc2b0..55f969baaf5f 100644
--- a/pkgs/by-name/ze/zeno/package.nix
+++ b/pkgs/by-name/ze/zeno/package.nix
@@ -5,16 +5,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "zeno";
-  version = "2.0.21";
+  version = "2.0.23";
 
   src = fetchFromGitHub {
     owner = "internetarchive";
     repo = "Zeno";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cz65oZeCFmyepktYnIfuylyRS7T2/hRb37A7xH6xPdI=";
+    hash = "sha256-1U2XLQJ+PCLcq3baqkd6fsQnAX1dZ6Ct6vF6l/ywLyQ=";
   };
 
-  vendorHash = "sha256-NlHbERpHouIwzjoK1JKl+9zca0OByGqI86/62ft2oC8=";
+  vendorHash = "sha256-a0M9iPrrIurFlVtO8oXfqZJzwE/tZ8Hw9BKjZmJZ/r0=";
 
   env.CGO_ENABLED = true;
   ldFlags = [
diff --git a/pkgs/desktops/enlightenment/evisum/default.nix b/pkgs/desktops/enlightenment/evisum/default.nix
index 29a55d63f6cc..177616509659 100644
--- a/pkgs/desktops/enlightenment/evisum/default.nix
+++ b/pkgs/desktops/enlightenment/evisum/default.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evisum";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchurl {
     url = "https://download.enlightenment.org/rel/apps/${pname}/${pname}-${version}.tar.xz";
-    sha256 = "XuND4zidLkkah3kYYBc7ZLG4r3QvnKpc34NFxA7NR9c=";
+    sha256 = "3Icc41A+JyFZB0RS7F6kzTdJsEnZ4IDc+Ck40myGP20=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/apache-beam/default.nix b/pkgs/development/python-modules/apache-beam/default.nix
index 2baa9c9e8486..671ae205cea0 100644
--- a/pkgs/development/python-modules/apache-beam/default.nix
+++ b/pkgs/development/python-modules/apache-beam/default.nix
@@ -29,6 +29,7 @@
   numpy,
   objsize,
   orjson,
+  pillow,
   proto-plus,
   protobuf,
   pyarrow,
@@ -65,14 +66,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "apache-beam";
-  version = "2.71.0";
+  version = "2.72.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "apache";
     repo = "beam";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pIuRaBN1lmC3EMuUnBovl/pBmNwsDZ/vh/OM/sD9SrI=";
+    hash = "sha256-HlpaKDX/w6g6q8nOB8G83q4/ffgymk/XyTpwYVpbd2U=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/sdks/python";
@@ -120,6 +121,7 @@ buildPythonPackage (finalAttrs: {
     numpy
     objsize
     orjson
+    pillow
     proto-plus
     protobuf
     pyarrow
@@ -241,6 +243,9 @@ buildPythonPackage (finalAttrs: {
   ];
 
   disabledTests = [
+    # importlib.metadata.PackageNotFoundError: No package metadata was found for pip
+    "test_populate_requirements_cache_uses_find_links"
+
     # AssertionError: Lists differ:
     # ['pickled_main_session', 'submission_environment_dependencies.txt'] != ['pickled_main_session']
     "test_main_session_staged_when_using_cloudpickle"
diff --git a/pkgs/development/python-modules/ax-platform/default.nix b/pkgs/development/python-modules/ax-platform/default.nix
index 1ef78166571c..42022b15ebe9 100644
--- a/pkgs/development/python-modules/ax-platform/default.nix
+++ b/pkgs/development/python-modules/ax-platform/default.nix
@@ -30,14 +30,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ax-platform";
-  version = "1.2.3";
+  version = "1.2.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "ax";
     tag = finalAttrs.version;
-    hash = "sha256-zIK3D7QSkfzAxySumdxsA3tiPWYbP9E6SS21837H4ZY=";
+    hash = "sha256-ZeYoLOPF2D1bk89V5/WO/v0UCtDisbAOOL/Su9sB2Fg=";
   };
 
   env.ALLOW_BOTORCH_LATEST = "1";
@@ -120,8 +120,8 @@ buildPythonPackage (finalAttrs: {
     # broken with sqlalchemy 2
     "test_sql_storage"
   ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    # flaky on x86
+  ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
+    # flaky
     "test_gen_with_expanded_parameter_space"
   ];
 
diff --git a/pkgs/development/python-modules/botorch/default.nix b/pkgs/development/python-modules/botorch/default.nix
index fb297754b330..827e86b7151a 100644
--- a/pkgs/development/python-modules/botorch/default.nix
+++ b/pkgs/development/python-modules/botorch/default.nix
@@ -29,14 +29,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "botorch";
-  version = "0.17.0";
+  version = "0.17.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "meta-pytorch";
     repo = "botorch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NDdXsmVdrTEXMXXVf89EkGXVOYnEcXwtzarB5niTNaw=";
+    hash = "sha256-KWkRdgOAhWoVRoBn0XvKhTQX3KPHJrzqWoiaKrYzi7o=";
   };
 
   build-system = [
@@ -82,10 +82,19 @@ buildPythonPackage (finalAttrs: {
     # RuntimeError: Boolean value of Tensor with more than one value is ambiguous
     "test_optimize_acqf_mixed_binary_only"
   ]
-  ++ lib.optionals (stdenv.buildPlatform.system == "x86_64-linux") [
+  ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86_64) [
     # stuck tests on hydra
     "test_moo_predictive_entropy_search"
   ]
+  ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+    # RuntimeError: Failed to initialize cpuinfo!
+    "test_append_features"
+    "test_delattr_ctx"
+    "test_input_perturbation"
+    "test_module_rollback_ctx"
+    "test_parameter_rollback_ctx"
+    "test_zero_grad_ctx"
+  ]
   ++ lib.optionals (stdenv.hostPlatform.isDarwin) [
     # RuntimeError: required keyword attribute 'value' has the wrong type
     "test_posterior_in_trace_mode"
diff --git a/pkgs/development/python-modules/celery/default.nix b/pkgs/development/python-modules/celery/default.nix
index d44dadbff007..2d76c8c237c3 100644
--- a/pkgs/development/python-modules/celery/default.nix
+++ b/pkgs/development/python-modules/celery/default.nix
@@ -51,16 +51,16 @@
   withAmqpRepl ? false,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "celery";
-  version = "5.6.2";
+  version = "5.6.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "celery";
     repo = "celery";
-    tag = "v${version}";
-    hash = "sha256-S84hLGwVVgxnUB6wnqU58tN56t/tQ79ZUni/iP5sx94=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-5YPM8/AnCSjeDDMQ30kTNjPr6QdlUiqzzBadtmjqoNg=";
   };
 
   patches = lib.optionals (!withAmqpRepl) [
@@ -157,7 +157,7 @@ buildPythonPackage rec {
     pytest-xdist
     pytestCheckHook
   ]
-  ++ lib.concatAttrValues optional-dependencies;
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
 
   disabledTestPaths = [
     # test_eventlet touches network
@@ -212,9 +212,9 @@ buildPythonPackage rec {
   meta = {
     description = "Distributed task queue";
     homepage = "https://github.com/celery/celery/";
-    changelog = "https://github.com/celery/celery/blob/${src.tag}/Changelog.rst";
+    changelog = "https://github.com/celery/celery/blob/${finalAttrs.src.tag}/Changelog.rst";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "celery";
   };
-}
+})
diff --git a/pkgs/development/python-modules/claude-agent-sdk/default.nix b/pkgs/development/python-modules/claude-agent-sdk/default.nix
index 059e74dce539..124311c7abaa 100644
--- a/pkgs/development/python-modules/claude-agent-sdk/default.nix
+++ b/pkgs/development/python-modules/claude-agent-sdk/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "claude-agent-sdk";
-  version = "0.1.58";
+  version = "0.1.59";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "anthropics";
     repo = "claude-agent-sdk-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Xpl6/9+e1MFjCG/5fCzubAFIfLejdMPnTLmNmwglEy4=";
+    hash = "sha256-fKPY/ORxIvwJ7MI6gkBQv0Ydy5rPRszQ+/1HvIIzOEA=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/cramjam/default.nix b/pkgs/development/python-modules/cramjam/default.nix
index c6bf9311cc24..cd35c8fee54e 100644
--- a/pkgs/development/python-modules/cramjam/default.nix
+++ b/pkgs/development/python-modules/cramjam/default.nix
@@ -11,21 +11,21 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "cramjam";
-  version = "2.11.0.post1";
+  version = "2.12.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "milesgranger";
     repo = "cramjam";
-    tag = "v${version}";
-    hash = "sha256-iYx/cPQpZVVPAH+HTiYH/E9tmdnHvKf3Cel4yZpXSIA=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-vGT57ou9nnCVCw8LR+w+5MV54EqwT2R+ww9acRQk8Lc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname src version;
-    hash = "sha256-jLGCyrVHtauWhiDghtYgt5MhgOl8wNiM7TAQhrCk2xU=";
+    inherit (finalAttrs) pname src version;
+    hash = "sha256-evXYLbv+GwSBUJBb0upjQTFtMPdQbKka8KfJltMUmDs=";
   };
 
   nativeBuildInputs = with rustPlatform; [
@@ -61,8 +61,8 @@ buildPythonPackage rec {
   meta = {
     description = "Thin Python bindings to de/compression algorithms in Rust";
     homepage = "https://github.com/milesgranger/pyrus-cramjam";
-    changelog = "https://github.com/milesgranger/cramjam/releases/tag/v${version}";
+    changelog = "https://github.com/milesgranger/cramjam/releases/tag/${finalAttrs.src.tag}";
     license = with lib.licenses; [ mit ];
     maintainers = with lib.maintainers; [ veprbl ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/cryptg/default.nix b/pkgs/development/python-modules/cryptg/default.nix
index 90fb851b5b82..1b0cb83f026d 100644
--- a/pkgs/development/python-modules/cryptg/default.nix
+++ b/pkgs/development/python-modules/cryptg/default.nix
@@ -11,19 +11,19 @@
 
 buildPythonPackage rec {
   pname = "cryptg";
-  version = "0.5.2";
+  version = "0.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cher-nov";
     repo = "cryptg";
     rev = "v${version}";
-    hash = "sha256-4WerXUEkdkIkVEyZB4EzM1HITvNbO7a1Cfi3bpJGUVA=";
+    hash = "sha256-3vdZGtr4NTtba42jqklhEEMWqHgEct/0Rw0Krllgcn4=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src;
-    hash = "sha256-kR92lvyBCFxEvIlzRX796XQn71ARrlsfK+fAKrwimEo=";
+    hash = "sha256-dnSxRHpjUIXgWScZS18ImxMOfhyq1iC2QPFs1h4l1AQ=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/ddgs/default.nix b/pkgs/development/python-modules/ddgs/default.nix
index 334dd6153daf..f6e2067e1a1e 100644
--- a/pkgs/development/python-modules/ddgs/default.nix
+++ b/pkgs/development/python-modules/ddgs/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ddgs";
-  version = "9.13.0";
+  version = "9.13.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "deedy5";
     repo = "ddgs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AUfPAHRrhO/n6hFyXEfG+X4ukCqIMCJbXSss0jYUYiY=";
+    hash = "sha256-PCw6P8bYFmdRzDGyOsJ5vOBR8oEQkOSbvy5lGmkzdMQ=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/deltachat2/default.nix b/pkgs/development/python-modules/deltachat2/default.nix
index d23e2f8b6105..806195e0bb71 100644
--- a/pkgs/development/python-modules/deltachat2/default.nix
+++ b/pkgs/development/python-modules/deltachat2/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "deltachat2";
-  version = "0.9.0";
+  version = "0.10.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "adbenitez";
     repo = "deltachat2";
     tag = version;
-    hash = "sha256-/Q524yoY25kcRNYgFw2k/lJJ3ydVN3hhoaC571nh1cw=";
+    hash = "sha256-04MXh1p2xRRnvyu5GrPqMuaraP08WQbFzXYhkXRznA4=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/deltachat2/paths.patch b/pkgs/development/python-modules/deltachat2/paths.patch
index 92cfe11fc6f0..98c236ae4fc8 100644
--- a/pkgs/development/python-modules/deltachat2/paths.patch
+++ b/pkgs/development/python-modules/deltachat2/paths.patch
@@ -1,11 +1,11 @@
 diff --git a/deltachat2/transport.py b/deltachat2/transport.py
-index a93dc7e..251947b 100644
+index c48827e..bfbc390 100644
 --- a/deltachat2/transport.py
 +++ b/deltachat2/transport.py
 @@ -71,7 +71,7 @@ class IOTransport:
              # `process_group` is not supported before Python 3.11.
              kwargs = {"preexec_fn": os.setpgrp, **self._kwargs}  # noqa: PLW1509
-         self.process = subprocess.Popen(  # noqa: R1732
+         self.process = subprocess.Popen(  # pylint:disable=consider-using-with
 -            "deltachat-rpc-server",
 +            "@deltachatrpcserver@",
              stdin=subprocess.PIPE,
diff --git a/pkgs/development/python-modules/dj-database-url/default.nix b/pkgs/development/python-modules/dj-database-url/default.nix
index 3ec990d64a56..1c4544075715 100644
--- a/pkgs/development/python-modules/dj-database-url/default.nix
+++ b/pkgs/development/python-modules/dj-database-url/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "dj-database-url";
-  version = "3.1.0";
+  version = "3.1.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jazzband";
     repo = "dj-database-url";
     tag = "v${version}";
-    hash = "sha256-zQiyEtDTFZHwuEIfRZHdgszyfsRSayFqPv9MIS4Ip6s=";
+    hash = "sha256-d9wkxe7xJSTufc2La4W/etPAaW6YF47y0IqPa5YWknY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/django-cachalot/default.nix b/pkgs/development/python-modules/django-cachalot/default.nix
index be929b9fa30f..73ba6fce519f 100644
--- a/pkgs/development/python-modules/django-cachalot/default.nix
+++ b/pkgs/development/python-modules/django-cachalot/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "django-cachalot";
-  version = "2.8.0";
+  version = "2.9.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "noripyt";
     repo = "django-cachalot";
     tag = "v${version}";
-    hash = "sha256-3W+9cULL3mMtAkxbqetoIj2FL/HRbzWHIDMe9O1e6BM=";
+    hash = "sha256-oCeMta6Bm+3BUu81huirGV9tMhSAYFjbV2vedghznyM=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/django-debug-toolbar/default.nix b/pkgs/development/python-modules/django-debug-toolbar/default.nix
index cf868a493a4e..39c2d7937937 100644
--- a/pkgs/development/python-modules/django-debug-toolbar/default.nix
+++ b/pkgs/development/python-modules/django-debug-toolbar/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "django-debug-toolbar";
-  version = "6.2.0";
+  version = "6.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jazzband";
     repo = "django-debug-toolbar";
     tag = version;
-    hash = "sha256-0NF71cuA55puEjJxd6I0xoeDQPWW+oxfWseDBmhis5k=";
+    hash = "sha256-myKtNT7xIqVdJTlVAbnohaAv/5Ioz5SlSmmuaXIQqZM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/django-filter/default.nix b/pkgs/development/python-modules/django-filter/default.nix
index 57a687c4ce4e..99308a5f1a3f 100644
--- a/pkgs/development/python-modules/django-filter/default.nix
+++ b/pkgs/development/python-modules/django-filter/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "django-filter";
-  version = "25.1";
+  version = "25.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "carltongibson";
     repo = "django-filter";
     tag = version;
-    hash = "sha256-ODbBlaJo6sgXkFxLNhqwGTXSHs2d6R6wGKyDz5qA7bs=";
+    hash = "sha256-hufqurodhd+cKs8UHvxbn62nfcZRg2Hcv2v/inkUoVg=";
   };
 
   build-system = [ flit-core ];
diff --git a/pkgs/development/python-modules/django-soft-delete/default.nix b/pkgs/development/python-modules/django-soft-delete/default.nix
index c1bdd128bb0d..825c01e06bd2 100644
--- a/pkgs/development/python-modules/django-soft-delete/default.nix
+++ b/pkgs/development/python-modules/django-soft-delete/default.nix
@@ -8,13 +8,13 @@
 
 buildPythonPackage rec {
   pname = "django-soft-delete";
-  version = "1.0.22";
+  version = "1.0.23";
   pyproject = true;
 
   src = fetchPypi {
     pname = "django_soft_delete";
     inherit version;
-    hash = "sha256-MtC7lfGAwopAFj54pViswYkB/VYBH5H47nNcFxptQkQ=";
+    hash = "sha256-gUZZ8NGdTyr8WLMf9z+I8K9mcVzO87T82PazoBHVmyo=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/google-cloud-monitoring/default.nix b/pkgs/development/python-modules/google-cloud-monitoring/default.nix
index 1e93248a8a01..eaa6fb87b374 100644
--- a/pkgs/development/python-modules/google-cloud-monitoring/default.nix
+++ b/pkgs/development/python-modules/google-cloud-monitoring/default.nix
@@ -15,13 +15,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "google-cloud-monitoring";
-  version = "2.29.1";
+  version = "2.30.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_monitoring";
     inherit (finalAttrs) version;
-    hash = "sha256-hsrFXN0mCFYYGdGVRPs8Epu7fc7MRF2N5CbjTNb6jkk=";
+    hash = "sha256-qVMKqaokbEkIEN+nvjLWfoNA0ZEIrMmcvALR7UlPunY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/gpytorch/default.nix b/pkgs/development/python-modules/gpytorch/default.nix
index 41df6ade307c..a6cacfc63e87 100644
--- a/pkgs/development/python-modules/gpytorch/default.nix
+++ b/pkgs/development/python-modules/gpytorch/default.nix
@@ -9,7 +9,6 @@
   setuptools-scm,
 
   # dependencies
-  jaxtyping,
   linear-operator,
   mpmath,
   scikit-learn,
@@ -22,31 +21,22 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "gpytorch";
-  version = "1.15.1";
+  version = "1.15.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cornellius-gp";
     repo = "gpytorch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ftiAY02K0EwVQZufk8xR+/21A+2ONWchuWPF3a5lRW0=";
+    hash = "sha256-1CavS+qrV8YqnsT87GjmJV2LOtvExFYQE5YpYZEw9ts=";
   };
 
-  # AttributeError: module 'numpy' has no attribute 'trapz'
-  postPatch = ''
-    substituteInPlace gpytorch/kernels/spectral_mixture_kernel.py \
-      --replace-fail \
-        "np.trapz(emp_spect, freq)" \
-        "np.trapezoid(emp_spect, freq)"
-  '';
-
   build-system = [
     setuptools
     setuptools-scm
   ];
 
   dependencies = [
-    jaxtyping
     linear-operator
     mpmath
     scikit-learn
@@ -67,6 +57,11 @@ buildPythonPackage (finalAttrs: {
     "test_optimization_optimal_error"
     # https://github.com/cornellius-gp/gpytorch/issues/2396
     "test_t_matmul_matrix"
+  ]
+  ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+    # RuntimeError: Failed to initialize cpuinfo!
+    "test_dtype_value_context"
+    "test_half"
   ];
 
   disabledTestPaths = lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
diff --git a/pkgs/development/python-modules/iocsearcher/default.nix b/pkgs/development/python-modules/iocsearcher/default.nix
index 42cc79000e17..059ca673e773 100644
--- a/pkgs/development/python-modules/iocsearcher/default.nix
+++ b/pkgs/development/python-modules/iocsearcher/default.nix
@@ -17,18 +17,19 @@
   python-magic,
   readabilipy,
   setuptools,
+  solders,
 }:
 
 buildPythonPackage rec {
   pname = "iocsearcher";
-  version = "2.5.7";
+  version = "2.7.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "malicialab";
     repo = "iocsearcher";
     tag = "v${version}";
-    hash = "sha256-qykPMtdGjys6d1cdP6cM/lmtU5WR/jk9tc9g+8uc31E=";
+    hash = "sha256-XoBb3V/2ZMrGV+i0abt7+/xEFqv6f0y99scaw8aav04=";
   };
 
   build-system = [ setuptools ];
@@ -48,6 +49,7 @@ buildPythonPackage rec {
     phonenumbers
     python-magic
     readabilipy
+    solders
   ]
   ++ eth-hash.optional-dependencies.pycryptodome;
 
diff --git a/pkgs/development/python-modules/jsonalias/default.nix b/pkgs/development/python-modules/jsonalias/default.nix
new file mode 100644
index 000000000000..20f58b3e20f3
--- /dev/null
+++ b/pkgs/development/python-modules/jsonalias/default.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "jsonalias";
+  version = "0.1.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "kevinheavey";
+    repo = "jsonalias";
+    tag = finalAttrs.version;
+    hash = "sha256-1Pb0VpwnAZiv3z+Ur6FS0LV4D9xKvrfAdUtulvr6ACg=";
+  };
+
+  build-system = [ poetry-core ];
+
+  pythonImportsCheck = [ "jsonalias" ];
+
+  # Module has no tests
+  doCheck = false;
+
+  meta = {
+    description = "Library that defines a Json type alias for Python";
+    homepage = "https://github.com/kevinheavey/jsonalias";
+    changelog = "https://github.com/kevinheavey/jsonalias/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/linear-operator/default.nix b/pkgs/development/python-modules/linear-operator/default.nix
index 7a00d4115e69..b831a21cb603 100644
--- a/pkgs/development/python-modules/linear-operator/default.nix
+++ b/pkgs/development/python-modules/linear-operator/default.nix
@@ -1,26 +1,31 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  jaxtyping,
-  pytestCheckHook,
-  scipy,
+
+  # build-system
   setuptools,
   setuptools-scm,
+
+  # dependencies
+  scipy,
   torch,
-  typeguard,
+
+  # tests
+  pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "linear-operator";
-  version = "0.6";
+  version = "0.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cornellius-gp";
     repo = "linear_operator";
-    tag = "v${version}";
-    hash = "sha256-qBC7wrpcZ8ViFqIOSd2F8heeBRQxrac/l33srHhNaIM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Ghe4a3zMSvTv3J6ROd1RLELK+k24/rO8p+XUPVsl090=";
   };
 
   build-system = [
@@ -29,15 +34,8 @@ buildPythonPackage rec {
   ];
 
   dependencies = [
-    jaxtyping
     scipy
     torch
-    typeguard
-  ];
-
-  pythonRelaxDeps = [
-    "jaxtyping"
-    "typeguard"
   ];
 
   pythonImportsCheck = [ "linear_operator" ];
@@ -49,12 +47,17 @@ buildPythonPackage rec {
     "test_matmul_matrix_broadcast"
     "test_solve_matrix_broadcast"
     "test_svd"
+  ]
+  ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+    # RuntimeError: Failed to initialize cpuinfo!
+    "test_half"
   ];
 
   meta = {
     description = "LinearOperator implementation to wrap the numerical nuts and bolts of GPyTorch";
-    homepage = "https://github.com/cornellius-gp/linear_operator/";
+    homepage = "https://github.com/cornellius-gp/linear_operator";
+    changelog = "https://github.com/cornellius-gp/linear_operator/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ veprbl ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/pulsar-client/default.nix b/pkgs/development/python-modules/pulsar-client/default.nix
index cfe1cfa6b322..cc79373e4e85 100644
--- a/pkgs/development/python-modules/pulsar-client/default.nix
+++ b/pkgs/development/python-modules/pulsar-client/default.nix
@@ -3,8 +3,10 @@
   buildPythonPackage,
   fetchFromGitHub,
 
-  # build
+  # build-system
   setuptools,
+
+  # nativeBuildInputs
   cmake,
   pkg-config,
 
@@ -13,29 +15,34 @@
   pybind11,
   certifi,
 
-  # optional dependencies
+  # optional-dependencies
   fastavro,
   grpcio,
   prometheus-client,
   protobuf,
   ratelimit,
 
-  # test
+  # tests
   unittestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pulsar-client";
-  version = "3.9.0";
+  version = "3.10.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "apache";
     repo = "pulsar-client-python";
-    tag = "v${version}";
-    hash = "sha256-TxX+om+uKjZlgG10qcLAddiUisBWLxBfBSHEHGix1d4=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ZmuZskkviHantE5vOJd0Di8aqu086G36TQJoEFW2VaY=";
   };
 
+  patches = [
+    # Remove TLS bindings removed in libpulsar 4.x
+    ./fix-libpulsar-4.patch
+  ];
+
   build-system = [
     setuptools
   ];
@@ -67,13 +74,12 @@ buildPythonPackage rec {
       ratelimit
     ];
     avro = [ fastavro ];
-    all = lib.concatAttrValues (lib.removeAttrs optional-dependencies [ "all" ]);
   };
 
   nativeCheckInputs = [
     unittestCheckHook
   ]
-  ++ optional-dependencies.all;
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
 
   unittestFlagsArray = [
     "-s"
@@ -87,8 +93,8 @@ buildPythonPackage rec {
   meta = {
     description = "Apache Pulsar Python client library";
     homepage = "https://pulsar.apache.org/docs/next/client-libraries-python/";
-    changelog = "https://github.com/apache/pulsar-client-python/releases/tag/${src.tag}";
+    changelog = "https://github.com/apache/pulsar-client-python/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/pulsar-client/fix-libpulsar-4.patch b/pkgs/development/python-modules/pulsar-client/fix-libpulsar-4.patch
new file mode 100644
index 000000000000..dfa55fb64dc8
--- /dev/null
+++ b/pkgs/development/python-modules/pulsar-client/fix-libpulsar-4.patch
@@ -0,0 +1,23 @@
+Remove TLS bindings that were removed in libpulsar 4.x.
+
+isUseTls/setUseTls were removed because TLS is now inferred from the
+service URL scheme. getTlsTrustCertsFilePath getter was also removed.
+
+This matches upstream's fix in v3.11.0-candidate-1.
+
+--- a/src/config.cc
++++ b/src/config.cc
+@@ -174,11 +174,8 @@ void export_config(module_& m) {
+         .def("stats_interval_in_seconds", &ClientConfiguration::getStatsIntervalInSeconds)
+         .def("stats_interval_in_seconds", &ClientConfiguration::setStatsIntervalInSeconds,
+              return_value_policy::reference)
+-        .def("use_tls", &ClientConfiguration::isUseTls)
+-        .def("use_tls", &ClientConfiguration::setUseTls, return_value_policy::reference)
+-        .def("tls_trust_certs_file_path", &ClientConfiguration::getTlsTrustCertsFilePath,
+-             return_value_policy::copy)
+-        .def("tls_trust_certs_file_path", &ClientConfiguration::setTlsTrustCertsFilePath,
++        .def("tls_trust_certs_file_path",
++             &ClientConfiguration::setTlsTrustCertsFilePath,
+              return_value_policy::reference)
+         .def("tls_private_key_file_path", &ClientConfiguration::getTlsPrivateKeyFilePath,
+              return_value_policy::copy)
diff --git a/pkgs/development/python-modules/pydantic-ai-slim/default.nix b/pkgs/development/python-modules/pydantic-ai-slim/default.nix
index 61e0cf930cd3..993e22e3d512 100644
--- a/pkgs/development/python-modules/pydantic-ai-slim/default.nix
+++ b/pkgs/development/python-modules/pydantic-ai-slim/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydantic-ai-slim";
-  version = "1.79.0";
+  version = "1.82.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "pydantic-ai";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-humCEXsoBNoLG33GjHdvagg3QNxjf/1gSQZUrk6ZnHg=";
+    hash = "sha256-M6CIoSHxxfWGU7zS4uZefRzP1vX/9Z3J1p4wmH2uiRg=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/pydantic_ai_slim";
diff --git a/pkgs/development/python-modules/pydantic-graph/default.nix b/pkgs/development/python-modules/pydantic-graph/default.nix
index 0cd50ab85822..b28589a558a4 100644
--- a/pkgs/development/python-modules/pydantic-graph/default.nix
+++ b/pkgs/development/python-modules/pydantic-graph/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydantic-graph";
-  version = "1.79.0";
+  version = "1.82.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "pydantic-ai";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-humCEXsoBNoLG33GjHdvagg3QNxjf/1gSQZUrk6ZnHg=";
+    hash = "sha256-M6CIoSHxxfWGU7zS4uZefRzP1vX/9Z3J1p4wmH2uiRg=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/pydantic_graph";
diff --git a/pkgs/development/python-modules/pylint-django/default.nix b/pkgs/development/python-modules/pylint-django/default.nix
index be35eeaa96a1..5f5b4df67dc7 100644
--- a/pkgs/development/python-modules/pylint-django/default.nix
+++ b/pkgs/development/python-modules/pylint-django/default.nix
@@ -11,16 +11,16 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pylint-django";
-  version = "2.6.1-unstable-2025-11-09";
+  version = "2.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PyCQA";
     repo = "pylint-django";
-    rev = "e40d785abbf26af0738c14247fb4ac0aa7265b24";
-    hash = "sha256-INQSQjubcwQwspaxevXQOF92L2K9WRLMLYsP18Ffhos=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-f0L/wYedLHtyi3/vro4n29oAY+axnQ5sBv545zD/Gvc=";
   };
 
   build-system = [ poetry-core ];
@@ -38,22 +38,13 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  disabledTests = [
-    # AttributeError: module 'pylint.interfaces' has no attribute 'IAstroidChecker'
-    "test_migrations_plugin"
-    "func_noerror_model_unicode_lambda"
-    "test_linter_should_be_pickleable_with_pylint_django_plugin_installed"
-    "func_noerror_model_fields"
-    "func_noerror_form_fields"
-  ];
-
   pythonImportsCheck = [ "pylint_django" ];
 
   meta = {
     description = "Pylint plugin to analyze Django applications";
     homepage = "https://github.com/PyCQA/pylint-django";
-    changelog = "https://github.com/pylint-dev/pylint-django/releases/tag/v${version}";
+    changelog = "https://github.com/pylint-dev/pylint-django/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ kamadorueda ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/pymilvus/default.nix b/pkgs/development/python-modules/pymilvus/default.nix
index 52285d5bfdd5..0f4ccf9a845d 100644
--- a/pkgs/development/python-modules/pymilvus/default.nix
+++ b/pkgs/development/python-modules/pymilvus/default.nix
@@ -34,14 +34,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pymilvus";
-  version = "2.6.9";
+  version = "2.6.12";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "milvus-io";
     repo = "pymilvus";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2PDN642i+GZG4Uxs4aA5x/jC6vm2cx4RITVqKi3KvtY=";
+    hash = "sha256-vjXqGb4HYxa5qHpy8AJBO2G8s8AndJs+zGvxbfvwObY=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pypdf/default.nix b/pkgs/development/python-modules/pypdf/default.nix
index ee96accd98e7..aa98596c77b0 100644
--- a/pkgs/development/python-modules/pypdf/default.nix
+++ b/pkgs/development/python-modules/pypdf/default.nix
@@ -23,7 +23,7 @@
 
 buildPythonPackage rec {
   pname = "pypdf";
-  version = "6.9.2";
+  version = "6.10.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -32,7 +32,7 @@ buildPythonPackage rec {
     tag = version;
     # fetch sample files used in tests
     fetchSubmodules = true;
-    hash = "sha256-1oiwQf9N6et/o81CyCAFX9UWG2sXC3a50++cGfvXdE4=";
+    hash = "sha256-eAbA6vIRJ/wX5r/X218UG2yEqtGTuDAKFpLB702HvM0=";
   };
 
   outputs = [
diff --git a/pkgs/development/python-modules/pypdfium2/default.nix b/pkgs/development/python-modules/pypdfium2/default.nix
index 21394cf6624f..09795d6263ba 100644
--- a/pkgs/development/python-modules/pypdfium2/default.nix
+++ b/pkgs/development/python-modules/pypdfium2/default.nix
@@ -36,14 +36,14 @@ let
 in
 buildPythonPackage rec {
   pname = "pypdfium2";
-  version = "5.6.0";
+  version = "5.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pypdfium2-team";
     repo = "pypdfium2";
     tag = version;
-    hash = "sha256-3mGjr8GgylxFIFT+NmyJ50ozTQvCIPexAgaQ30Ki2Ww=";
+    hash = "sha256-zc/83Ypmxul8fB3q0lUSgC9yfcdg7tJuZff+0LE0w30=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pyshark/default.nix b/pkgs/development/python-modules/pyshark/default.nix
index edc5bd5c7060..64db47763f55 100644
--- a/pkgs/development/python-modules/pyshark/default.nix
+++ b/pkgs/development/python-modules/pyshark/default.nix
@@ -1,28 +1,42 @@
 {
   lib,
   stdenv,
-  appdirs,
   buildPythonPackage,
+  pythonAtLeast,
   fetchFromGitHub,
+
+  # patches
   fetchpatch,
+  replaceVars,
+  wireshark-cli,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  appdirs,
   lxml,
   packaging,
-  pytestCheckHook,
-  replaceVars,
-  setuptools,
   termcolor,
-  wireshark-cli,
+
+  # tests
+  pytestCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pyshark";
   version = "0.6";
   pyproject = true;
 
+  # Almost all tests fail with:
+  # RuntimeError: There is no current event loop in thread 'MainThread'
+  disabled = pythonAtLeast "3.14";
+
   src = fetchFromGitHub {
     owner = "KimiNewt";
     repo = "pyshark";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-kzJDzUK6zknUyXPdKc4zMvWim4C5NQCSJSS45HI6hKM=";
   };
 
@@ -46,7 +60,7 @@ buildPythonPackage rec {
     })
   ];
 
-  sourceRoot = "${src.name}/src";
+  sourceRoot = "${finalAttrs.src.name}/src";
 
   build-system = [ setuptools ];
 
@@ -59,12 +73,9 @@ buildPythonPackage rec {
 
   nativeCheckInputs = [
     pytestCheckHook
+    writableTmpDirAsHomeHook
   ];
 
-  preCheck = ''
-    export HOME=$(mktemp -d)
-  '';
-
   disabledTests = [
     # flaky
     # KeyError: 'Packet of index 0 does not exist in capture'
@@ -83,8 +94,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python wrapper for tshark, allowing Python packet parsing using Wireshark dissectors";
     homepage = "https://github.com/KimiNewt/pyshark/";
-    changelog = "https://github.com/KimiNewt/pyshark/releases/tag/${version}";
+    changelog = "https://github.com/KimiNewt/pyshark/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = [ ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/pywal16/default.nix b/pkgs/development/python-modules/pywal16/default.nix
index 2dd067a4eb11..4adb13ad4323 100644
--- a/pkgs/development/python-modules/pywal16/default.nix
+++ b/pkgs/development/python-modules/pywal16/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pywal16";
-  version = "3.8.14";
+  version = "3.8.15";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "eylles";
     repo = "pywal16";
     tag = finalAttrs.version;
-    hash = "sha256-68HbYH4wydaM1yY8kGHNIHTOZuUQRl+9o5ZPaemTlUE=";
+    hash = "sha256-2KlVeOrF/nfRZk12gthDJ08xNvVbP5em3eXPMudo1Vs=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pywebtransport/default.nix b/pkgs/development/python-modules/pywebtransport/default.nix
new file mode 100644
index 000000000000..c8116561b720
--- /dev/null
+++ b/pkgs/development/python-modules/pywebtransport/default.nix
@@ -0,0 +1,92 @@
+{
+  lib,
+  buildPythonPackage,
+  clang,
+  fetchFromGitHub,
+  libclang,
+  llvmPackages,
+  msgpack,
+  pkg-config,
+  protobuf,
+  psutil,
+  pytest-asyncio,
+  pytest-cov-stub,
+  pytest-mock,
+  pytestCheckHook,
+  rustPlatform,
+  types-psutil,
+  uvloop,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pywebtransport";
+  version = "0.16.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "wtransport";
+    repo = "pywebtransport";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-DKvWSu2ufoIsBODNfFbM9JUtY81mmUISmD+qMQ6UVDI=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    cargoRoot = "crates";
+    hash = "sha256-gplelmBqntws+64DmjOZ5xbo3L/f+3+oasi5qLXT1pg=";
+  };
+
+  build-system = with rustPlatform; [
+    cargoSetupHook
+    maturinBuildHook
+  ];
+
+  nativeBuildInputs = [
+    clang
+    llvmPackages.libclang.lib
+    pkg-config
+  ];
+
+  env.LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
+  env.LD_LIBRARY_PATH = "${llvmPackages.libclang.lib}/lib:${lib.getLib libclang}/lib";
+
+  prePatch = ''
+    # maturin can't find the file
+    ln -s crates/Cargo.lock Cargo.lock || true
+  '';
+
+  optional-dependencies = {
+    msgpack = [ msgpack ];
+    protobuf = [ protobuf ];
+  };
+
+  nativeCheckInputs = [
+    psutil
+    pytest-asyncio
+    pytest-cov-stub
+    pytest-mock
+    pytestCheckHook
+    types-psutil
+    uvloop
+  ]
+  ++ lib.flatten (builtins.attrValues finalAttrs.passthru.optional-dependencies);
+
+  disabledTestPaths = [
+    # Tests require network access
+    "tests/e2e"
+  ];
+
+  preCheck = ''
+    cp -v $out/lib/python*/site-packages/pywebtransport/_wtransport*.so src/pywebtransport/
+  '';
+
+  pythonImportsCheck = [ "pywebtransport" ];
+
+  meta = {
+    description = "WebTransport stack for Python";
+    homepage = "https://github.com/wtransport/pywebtransport";
+    changelog = "https://github.com/wtransport/pywebtransport/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/resvg-py/default.nix b/pkgs/development/python-modules/resvg-py/default.nix
index fec1c29484c4..0438f8882436 100644
--- a/pkgs/development/python-modules/resvg-py/default.nix
+++ b/pkgs/development/python-modules/resvg-py/default.nix
@@ -12,19 +12,19 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "resvg-py";
-  version = "0.3.0";
+  version = "0.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "baseplate-admin";
     repo = "resvg-py";
     tag = finalAttrs.version;
-    hash = "sha256-XXzNrOR2/bMXR5GWEk8XKlCNHNG4+Sz0+0EgESc8FbQ=";
+    hash = "sha256-YWu05lYHKWnofnfP6TDvc1yJV5GPwDKJ87twbvKW+Ak=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-pIz92GeQctxAbCZ8QPbFhSTmdSVNopw0vL2fwMJXoYc=";
+    hash = "sha256-9v3GtXeeKMw49SCYlTVBvyECNr8gw+D/hVHQWOoUDHc=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/solders/default.nix b/pkgs/development/python-modules/solders/default.nix
new file mode 100644
index 000000000000..ec0e8d023f4c
--- /dev/null
+++ b/pkgs/development/python-modules/solders/default.nix
@@ -0,0 +1,70 @@
+{
+  lib,
+  buildPythonPackage,
+  cargo,
+  pkgs,
+  fetchFromGitHub,
+  jsonalias,
+  openssl,
+  pkg-config,
+  rustc,
+  rustPlatform,
+  typing-extensions,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "solders";
+  version = "0.27.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "kevinheavey";
+    repo = "solders";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-a3G3mMJvnO24w6WEJnEkYUNinXWHR26KupIlq5eik8A=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-+8iaA1Cs+7qiDfQpwPAWSZ1HuF85WaDZB3MN57QOodI=";
+  };
+
+  pythonRelaxDeps = [ "jsonalias" ];
+
+  build-system = [
+    cargo
+    pkg-config
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+    rustc
+  ];
+
+  buildInputs = [
+    openssl
+    pkgs.zstd
+  ];
+
+  dependencies = [
+    jsonalias
+    typing-extensions
+  ];
+
+  env = {
+    OPENSSL_NO_VENDOR = true;
+    ZSTD_SYS_USE_PKG_CONFIG = true;
+    PKG_CONFIG_PATH = lib.makeSearchPathOutput "dev" "lib/pkgconfig" [
+      openssl
+      pkgs.zstd
+    ];
+  };
+
+  pythonImportsCheck = [ "solders" ];
+
+  meta = {
+    description = "Python toolkit for Solana";
+    homepage = "https://github.com/kevinheavey/solders";
+    changelog = "https://github.com/kevinheavey/solders/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/twilio/default.nix b/pkgs/development/python-modules/twilio/default.nix
index b9f8fe15250a..3a1ab16d7216 100644
--- a/pkgs/development/python-modules/twilio/default.nix
+++ b/pkgs/development/python-modules/twilio/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "twilio";
-  version = "9.10.4";
+  version = "9.10.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "twilio";
     repo = "twilio-python";
     tag = finalAttrs.version;
-    hash = "sha256-g3GcKHsLcSBJPhpEVi9ue8rSrxD65GID9F40ndH2ho0=";
+    hash = "sha256-WLgx8kAHfLf7BHhu4A7b4gI3pB7WODb/CPV1qw7oNXM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/ultralytics/default.nix b/pkgs/development/python-modules/ultralytics/default.nix
index 0ab6366a82f6..7588932abd70 100644
--- a/pkgs/development/python-modules/ultralytics/default.nix
+++ b/pkgs/development/python-modules/ultralytics/default.nix
@@ -34,14 +34,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ultralytics";
-  version = "8.4.34";
+  version = "8.4.37";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ultralytics";
     repo = "ultralytics";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rWAsUHI9FInnwav0TEjPeBeSgXXg7Qu9sfCGp5Vu+T8=";
+    hash = "sha256-b6omoISVn/mwwq/GIm2M3B70tO6DanucbcTPitRYRS0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/whitenoise/default.nix b/pkgs/development/python-modules/whitenoise/default.nix
index 452673cdc3aa..2e8b496ce514 100644
--- a/pkgs/development/python-modules/whitenoise/default.nix
+++ b/pkgs/development/python-modules/whitenoise/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "whitenoise";
-  version = "6.11.0";
+  version = "6.12.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "evansd";
     repo = "whitenoise";
     tag = version;
-    hash = "sha256-pcU4qa2dlyPfMgyi1O8zME4GukIvKN4MQhFtJJjdn9w=";
+    hash = "sha256-qNya/3oI9413VUGaLPq4vtuLvq9mIGhaYBt+4OhrkOw=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/willow/default.nix b/pkgs/development/python-modules/willow/default.nix
index 36e258874a33..987eaad438dc 100644
--- a/pkgs/development/python-modules/willow/default.nix
+++ b/pkgs/development/python-modules/willow/default.nix
@@ -43,6 +43,11 @@ buildPythonPackage rec {
   ]
   ++ lib.concatAttrValues optional-dependencies;
 
+  disabledTests = [
+    # Flaky: wand.exceptions.MissingDelegateError: no decode delegate for this image format
+    "test_gif"
+  ];
+
   meta = {
     description = "Python image library that sits on top of Pillow, Wand and OpenCV";
     homepage = "https://github.com/torchbox/Willow/";
diff --git a/pkgs/development/tools/misc/coccinelle/default.nix b/pkgs/development/tools/misc/coccinelle/default.nix
index 5d5a7e81407b..74b046f75557 100644
--- a/pkgs/development/tools/misc/coccinelle/default.nix
+++ b/pkgs/development/tools/misc/coccinelle/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "coccinelle";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     repo = "coccinelle";
     rev = finalAttrs.version;
     owner = "coccinelle";
-    hash = "sha256-be95cuFP6bAdpCT0Z9zBAx9cc3gYuuXAmHYaI/bmyTE=";
+    hash = "sha256-ZNWuloXhAXWNNoVWLOuDbC3e6KNL7nzM2346tB04qXA=";
   };
 
   nativeBuildInputs = with ocamlPackages; [
diff --git a/pkgs/servers/home-assistant/custom-components/battery_notes/package.nix b/pkgs/servers/home-assistant/custom-components/battery_notes/package.nix
index efc5f2336143..225b6ba94873 100644
--- a/pkgs/servers/home-assistant/custom-components/battery_notes/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/battery_notes/package.nix
@@ -7,13 +7,13 @@
 buildHomeAssistantComponent rec {
   owner = "andrew-codechimp";
   domain = "battery_notes";
-  version = "3.4.3";
+  version = "3.4.4";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "HA-Battery-Notes";
     tag = version;
-    hash = "sha256-ftIq0PbTVJ1xuCyHH9MCfxA56x2ZNsPwCjCdivWMwZw=";
+    hash = "sha256-aF6OeTiTuN1A1ffW9LjTtkFW4CAMPWFGX0scjKAUyOE=";
   };
 
   # has no tests
diff --git a/pkgs/servers/monitoring/grafana/plugins/grafana-github-datasource/default.nix b/pkgs/servers/monitoring/grafana/plugins/grafana-github-datasource/default.nix
index 667ec0fa8f3b..c000c67d892e 100644
--- a/pkgs/servers/monitoring/grafana/plugins/grafana-github-datasource/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/grafana-github-datasource/default.nix
@@ -2,12 +2,12 @@
 
 grafanaPlugin {
   pname = "grafana-github-datasource";
-  version = "1.9.2";
+  version = "2.8.0";
   zipHash = {
-    x86_64-linux = "sha256-gh+vdZ8vkG/0OosqJSoh54Gi3JQGGm7YF0YgQCXr0LY=";
-    aarch64-linux = "sha256-OEDT5N/AyL3xocl1nesV9hCcfA/a8XBPBoaOH4UTo+M=";
-    x86_64-darwin = "sha256-5WrWvZriXjQIId52Y6THAVg7RfQFl1CT5qhKr/m0vVk=";
-    aarch64-darwin = "sha256-4IowlmyDGjxHBHvBD/eqZvouuOEvlad0nW8L0n8hf+g";
+    x86_64-linux = "sha256-hKElyWX4fcQtF3eyYVRuaJjvNWY9CV2bNoNkFLeJQLc=";
+    aarch64-linux = "sha256-+ygxJc+ovlqjcs68QD71JQepINTeauA41sKrJa6h8gc=";
+    x86_64-darwin = "sha256-ZrvBxCi6gyRFly0NtTPWUWzTbH3rp92Vy0C4n1hO/pA=";
+    aarch64-darwin = "sha256-s4q+k1gbOBCeMDpkTpui0egOxzoBjbKoX63pwVqmY6A=";
   };
   meta = {
     description = "Allows GitHub API data to be visually represented in Grafana dashboards";
diff --git a/pkgs/servers/monitoring/grafana/plugins/victoriametrics-metrics-datasource/default.nix b/pkgs/servers/monitoring/grafana/plugins/victoriametrics-metrics-datasource/default.nix
index dc2818bdeb3a..6a026ceadd90 100644
--- a/pkgs/servers/monitoring/grafana/plugins/victoriametrics-metrics-datasource/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/victoriametrics-metrics-datasource/default.nix
@@ -2,8 +2,8 @@
 
 grafanaPlugin {
   pname = "victoriametrics-metrics-datasource";
-  version = "0.23.3";
-  zipHash = "sha256-LFniKywQ3ft4nXxAswPoIadD4fUxGD3QXxOobXyoXYE=";
+  version = "0.23.4";
+  zipHash = "sha256-a0EJB+A+Rlfrpd2m1HZ2nw2sh4QuWe1O2oueVi4xPZE=";
   meta = {
     description = "VictoriaMetrics metrics datasource for Grafana";
     license = lib.licenses.agpl3Only;
diff --git a/pkgs/tools/networking/flannel/plugin.nix b/pkgs/tools/networking/flannel/plugin.nix
index f49cb8bbced7..f838aa3c82c1 100644
--- a/pkgs/tools/networking/flannel/plugin.nix
+++ b/pkgs/tools/networking/flannel/plugin.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "cni-plugin-flannel";
-  version = "1.9.0-flannel1";
+  version = "1.9.1-flannel1";
 
   src = fetchFromGitHub {
     owner = "flannel-io";
     repo = "cni-plugin";
     rev = "v${version}";
-    sha256 = "sha256-skYbIU1uqfEiXDEG5N0QVbMH/8X9MIJRH7XoXq5zA7w=";
+    sha256 = "sha256-iCSYr7S4oC8a5ijBgqMO/Gn0x/2had372Tx7lkg+X9I=";
   };
 
-  vendorHash = "sha256-hn4NT/fXu7bremIpYPSva/Od97LiVuHE7+8jgpLMaRs=";
+  vendorHash = "sha256-PVkhwoGepRhD6VFJxhPA2tZ+zOkhQw0aI2yIWVYQnz8=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 17c9104b94b9..f6937e0566c0 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6759,10 +6759,6 @@ with pkgs;
     libprom
     ;
 
-  libpulsar = callPackage ../development/libraries/libpulsar {
-    protobuf = protobuf_21;
-  };
-
   libsigcxx = callPackage ../development/libraries/libsigcxx { };
 
   libsigcxx30 = callPackage ../development/libraries/libsigcxx/3.0.nix { };
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index d84e9332746b..3eb935d80ab2 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -116,11 +116,11 @@ with self;
 
   ack = buildPerlPackage rec {
     pname = "ack";
-    version = "3.8.2";
+    version = "3.9.0";
 
     src = fetchurl {
       url = "mirror://cpan/authors/id/P/PE/PETDANCE/ack-v${version}.tar.gz";
-      hash = "sha256-pSOfWiwS4Me05DL/1+k2/u+UWpYhpBWRx307DPRYVgs=";
+      hash = "sha256-lO1Hfjs/lNEmzscynw6DmfHQzoLHxNiCqUrbFQ5//JA=";
     };
 
     outputs = [
@@ -25710,10 +25710,10 @@ with self;
 
   NetIPXS = buildPerlPackage {
     pname = "Net-IP-XS";
-    version = "0.22";
+    version = "0.23";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/T/TO/TOMHRR/Net-IP-XS-0.22.tar.gz";
-      hash = "sha256-JZe0aDizgur3S6XJnD9gpqC1poHsNqFBchJL9E9LGSA=";
+      url = "mirror://cpan/authors/id/T/TO/TOMHRR/Net-IP-XS-0.23.tar.gz";
+      hash = "sha256-c7E+E68xWC/whLgNUK+LOeGStGc6wvfWj+4Mpa9txX8=";
     };
     propagatedBuildInputs = [
       IOCapture
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a0a7ba92696b..7722d4e1af66 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7979,6 +7979,8 @@ self: super: with self; {
 
   jsonable = callPackage ../development/python-modules/jsonable { };
 
+  jsonalias = callPackage ../development/python-modules/jsonalias { };
+
   jsonargparse = callPackage ../development/python-modules/jsonargparse { };
 
   jsonconversion = callPackage ../development/python-modules/jsonconversion { };
@@ -16283,6 +16285,8 @@ self: super: with self; {
 
   pywebpush = callPackage ../development/python-modules/pywebpush { };
 
+  pywebtransport = callPackage ../development/python-modules/pywebtransport { };
+
   pywebview = callPackage ../development/python-modules/pywebview { };
 
   pywemo = callPackage ../development/python-modules/pywemo { };
@@ -18068,6 +18072,8 @@ self: super: with self; {
 
   solc-select = callPackage ../development/python-modules/solc-select { };
 
+  solders = callPackage ../development/python-modules/solders { };
+
   solidpython2 = callPackage ../development/python-modules/solidpython2 { };
 
   solo-python = callPackage ../development/python-modules/solo-python { };