diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index bd22094e2e63..697129906711 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -168,6 +168,10 @@
 
 - the `xorg` package set has been deprecated, packages have moved to the top level.
 
+- `python3Packages.buildPythonPackage` and `python3Packages.buildPythonApplication` now throw errors in the presence of `pytestFlagsArray`.
+  Please use [`pytestFlags` and `(enabled|disabled)(TestPaths|Tests|TestMarks)`](#using-pytestcheckhook) instead.
+  If modifying the Nix expression is not feasible, users can remediate the error by overriding `pytestFlagsArray` with `null` or `[ ]`.
+
 - `python3Packages.pygame` has been been renamed to `python3Packages.pygame-original`, the attribute `python3Packages.pygame` will from python 3.14 default to the more actively maintained `python3Packages.pygame-ce`
 
 - `fastly` has been updated to major version 14. For more information, you can check the [release notes](https://github.com/fastly/cli/releases/tag/v14.0.0)
diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index 3955c8051299..6d73d66d0d17 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -182,6 +182,9 @@
 
 - `services.uptime` has been removed because the package it relies on does not exist anymore in nixpkgs.
 
+- `services.mattermost` now defaults to version 11, which has dropped support for MySQL in favor of Postgres. As a result, all support for MySQL has been removed from the module.
+  See the [migration steps](https://docs.mattermost.com/deployment-guide/manual-postgres-migration.html) if you were not running Postgres.
+
 - `post-resume.target` has been removed. See {manpage}`systemd.special(7)` about `sleep.target` for instructions on ordering a process after resume with `ExecStop=`.
 
 - `services.kubernetes.addons.dns.coredns` has been renamed to `services.kubernetes.addons.dns.corednsImage` and now expects a
@@ -271,6 +274,8 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
 - `ceph` has been upgraded to v20. See the [Ceph "tentacle" release notes](https://docs.ceph.com/en/latest/releases/tentacle/#v20-2-0-tentacle) for details and recommended upgrade procedure.
   Note that **upgrades of server-side components are one-way**, and downgrading e.g. an OSD from *Tentacle* to *Squid* is not just not supported but is known to break.
 
+- `services.unifi`'s `jrePackage` option now defaults to `jdk25_headless` instead of `jdk17_headless`, in order to be compatible with new versions of `unifi`.
+
 - The `networking.wireless` module has been security hardened by default: the `wpa_supplicant` daemon now runs under an unprivileged user with restricted access to the system.
 
   As part of these changes, `/etc/wpa_supplicant.conf` has been deprecated: the NixOS-generated configuration file is now linked to `/etc/wpa_supplicant/nixos.conf` and `/etc/wpa_supplicant/imperative.conf` has been added for imperatively configuring `wpa_supplicant` or when using [allowAuxiliaryImperativeNetworks](#opt-networking.wireless.allowAuxiliaryImperativeNetworks).
diff --git a/nixos/modules/services/networking/unifi.nix b/nixos/modules/services/networking/unifi.nix
index 1e6236e6d47c..eaee405f8bda 100644
--- a/nixos/modules/services/networking/unifi.nix
+++ b/nixos/modules/services/networking/unifi.nix
@@ -41,7 +41,7 @@ in
     };
 
     services.unifi.jrePackage = lib.mkPackageOption pkgs "jdk" {
-      default = "jdk17_headless";
+      default = "jdk25_headless";
       extraDescription = ''
         Check the UniFi controller release notes to ensure it is supported.
       '';
diff --git a/nixos/modules/services/web-apps/mattermost.nix b/nixos/modules/services/web-apps/mattermost.nix
index cbec4ca230bf..26b6ebc171a9 100644
--- a/nixos/modules/services/web-apps/mattermost.nix
+++ b/nixos/modules/services/web-apps/mattermost.nix
@@ -27,9 +27,9 @@ let
 
   inherit (lib.modules)
     mkRenamedOptionModule
+    mkRemovedOptionModule
     mkMerge
     mkIf
-    mkDefault
     ;
 
   inherit (lib.trivial) warnIf throwIf;
@@ -55,10 +55,13 @@ let
   # Ensure that it's inside mutableDataDir since it can get rather large.
   tempDir = "${mutableDataDir}/tmp";
 
+  # Database supported by Mattermost.
+  databaseDriverName = "postgres";
+
   # Creates a database URI.
   mkDatabaseUri =
     {
-      scheme,
+      scheme ? databaseDriverName,
       user ? null,
       password ? null,
       escapeUserAndPassword ? true,
@@ -105,54 +108,24 @@ let
     let
       hostIsPath = hasInfix "/" cfg.database.host;
     in
-    if cfg.database.driver == "postgres" then
-      if cfg.database.peerAuth then
-        mkDatabaseUri {
-          scheme = cfg.database.driver;
-          inherit (cfg.database) user;
-          path = escapeURL cfg.database.name;
-          query = {
-            host = cfg.database.socketPath;
-          }
-          // cfg.database.extraConnectionOptions;
-        }
-      else
-        mkDatabaseUri {
-          scheme = cfg.database.driver;
-          inherit (cfg.database) user password;
-          host = if hostIsPath then null else cfg.database.host;
-          port = if hostIsPath then null else cfg.database.port;
-          path = escapeURL cfg.database.name;
-          query =
-            optionalAttrs hostIsPath { host = cfg.database.host; } // cfg.database.extraConnectionOptions;
-        }
-    else if cfg.database.driver == "mysql" then
-      if cfg.database.peerAuth then
-        mkDatabaseUri {
-          scheme = null;
-          inherit (cfg.database) user;
-          escapeUserAndPassword = false;
-          host = "unix(${cfg.database.socketPath})";
-          escapeHost = false;
-          path = escapeURL cfg.database.name;
-          query = cfg.database.extraConnectionOptions;
-        }
-      else
-        mkDatabaseUri {
-          scheme = null;
-          inherit (cfg.database) user password;
-          escapeUserAndPassword = false;
-          host =
-            if hostIsPath then
-              "unix(${cfg.database.host})"
-            else
-              "tcp(${cfg.database.host}:${toString cfg.database.port})";
-          escapeHost = false;
-          path = escapeURL cfg.database.name;
-          query = cfg.database.extraConnectionOptions;
+    if cfg.database.peerAuth then
+      mkDatabaseUri {
+        inherit (cfg.database) user;
+        path = escapeURL cfg.database.name;
+        query = {
+          host = cfg.database.socketPath;
         }
+        // cfg.database.extraConnectionOptions;
+      }
     else
-      throw "Invalid database driver: ${cfg.database.driver}";
+      mkDatabaseUri {
+        inherit (cfg.database) user password;
+        host = if hostIsPath then null else cfg.database.host;
+        port = if hostIsPath then null else cfg.database.port;
+        path = escapeURL cfg.database.name;
+        query =
+          optionalAttrs hostIsPath { host = cfg.database.host; } // cfg.database.extraConnectionOptions;
+      };
 
   mattermostPluginDerivations = map (
     plugin:
@@ -213,7 +186,7 @@ let
       EnableSecurityFixAlert = cfg.telemetry.enableSecurityAlerts;
     };
     TeamSettings.SiteName = cfg.siteName;
-    SqlSettings.DriverName = cfg.database.driver;
+    SqlSettings.DriverName = databaseDriverName;
     SqlSettings.DataSource =
       if cfg.database.fromEnvironment then
         null
@@ -358,6 +331,11 @@ in
         "dataDir"
       ]
     )
+    (mkRemovedOptionModule [ "services" "mattermost" "database" "driver" ] ''
+      services.mattermost.database.driver has been removed, as the only option is '${databaseDriverName}' in v11+.
+      If you were using MySQL, please migrate to Postgres:
+      https://docs.mattermost.com/deployment-guide/manual-postgres-migration.html
+    '')
   ];
 
   options = {
@@ -558,22 +536,11 @@ in
       };
 
       database = {
-        driver = mkOption {
-          type = types.enum [
-            "postgres"
-            "mysql"
-          ];
-          default = "postgres";
-          description = ''
-            The database driver to use (Postgres or MySQL).
-          '';
-        };
-
         create = mkOption {
           type = types.bool;
           default = true;
           description = ''
-            Create a local PostgreSQL or MySQL database for Mattermost automatically.
+            Create a local PostgreSQL database for Mattermost automatically.
           '';
         };
 
@@ -591,13 +558,9 @@ in
 
         socketPath = mkOption {
           type = types.path;
-          default =
-            if cfg.database.driver == "postgres" then "/run/postgresql" else "/run/mysqld/mysqld.sock";
-          defaultText = ''
-            if config.services.mattermost.database.driver == "postgres" then "/run/postgresql" else "/run/mysqld/mysqld.sock";
-          '';
+          default = "/run/postgresql";
           description = ''
-            The database (Postgres or MySQL) socket path.
+            The database socket path.
           '';
         };
 
@@ -630,11 +593,8 @@ in
 
         port = mkOption {
           type = types.port;
-          default = if cfg.database.driver == "postgres" then 5432 else 3306;
-          defaultText = ''
-            if config.services.mattermost.database.type == "postgres" then 5432 else 3306
-          '';
-          example = 3306;
+          default = 5432;
+          example = 1234;
           description = ''
             Port to use for the database.
           '';
@@ -660,34 +620,15 @@ in
 
         extraConnectionOptions = mkOption {
           type = with types; attrsOf (either int str);
-          default =
-            if cfg.database.driver == "postgres" then
-              {
-                sslmode = "disable";
-                connect_timeout = 60;
-              }
-            else if cfg.database.driver == "mysql" then
-              {
-                charset = "utf8mb4";
-                writeTimeout = "60s";
-                readTimeout = "60s";
-              }
-            else
-              throw "Invalid database driver ${cfg.database.driver}";
+          default = {
+            sslmode = "disable";
+            connect_timeout = 60;
+          };
           defaultText = ''
-            if config.mattermost.database.driver == "postgres" then
-              {
-                sslmode = "disable";
-                connect_timeout = 60;
-              }
-            else if config.mattermost.database.driver == "mysql" then
-              {
-                charset = "utf8mb4";
-                writeTimeout = "60s";
-                readTimeout = "60s";
-              }
-            else
-              throw "Invalid database driver";
+            {
+              sslmode = "disable";
+              connect_timeout = 60;
+            }
           '';
           description = ''
             Extra options that are placed in the connection URI's query parameters.
@@ -756,7 +697,7 @@ in
         };
       };
 
-      services.postgresql = mkIf (cfg.database.driver == "postgres" && cfg.database.create) {
+      services.postgresql = mkIf cfg.database.create {
         enable = true;
         ensureDatabases = singleton cfg.database.name;
         ensureUsers = singleton {
@@ -772,26 +713,6 @@ in
         };
       };
 
-      services.mysql = mkIf (cfg.database.driver == "mysql" && cfg.database.create) {
-        enable = true;
-        package = mkDefault pkgs.mariadb;
-        ensureDatabases = singleton cfg.database.name;
-        ensureUsers = singleton {
-          name = cfg.database.user;
-          ensurePermissions = {
-            "${cfg.database.name}.*" = "ALL PRIVILEGES";
-          };
-        };
-        settings = rec {
-          mysqld = {
-            collation-server = mkDefault "utf8mb4_general_ci";
-            init-connect = mkDefault "SET NAMES utf8mb4";
-            character-set-server = mkDefault "utf8mb4";
-          };
-          mysqld_safe = mysqld;
-        };
-      };
-
       environment = {
         variables = mkIf cfg.socket.export {
           MMCTL_LOCAL = "true";
@@ -840,8 +761,7 @@ in
         wantedBy = [ "multi-user.target" ];
         after = mkMerge [
           [ "network.target" ]
-          (mkIf (cfg.database.driver == "postgres" && cfg.database.create) [ "postgresql.target" ])
-          (mkIf (cfg.database.driver == "mysql" && cfg.database.create) [ "mysql.service" ])
+          (mkIf cfg.database.create [ "postgresql.target" ])
         ];
         requires = after;
 
@@ -945,8 +865,7 @@ in
         ];
 
         unitConfig.JoinsNamespaceOf = mkMerge [
-          (mkIf (cfg.database.driver == "postgres" && cfg.database.create) [ "postgresql.target" ])
-          (mkIf (cfg.database.driver == "mysql" && cfg.database.create) [ "mysql.service" ])
+          (mkIf cfg.database.create [ "postgresql.target" ])
         ];
       };
 
@@ -966,13 +885,6 @@ in
             or hostname, and services.mattermost.port to specify the port separately.
           '';
         }
-        {
-          # Can't use MySQL on version 11.
-          assertion = versionAtLeast cfg.package.version "11" -> cfg.database.driver == "postgres";
-          message = ''
-            Only Postgres is supported as the database driver in Mattermost 11 and later.
-          '';
-        }
       ];
     })
     (mkIf cfg.matterircd.enable {
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index 36f4114dacc1..eac46ec4e53a 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -16,9 +16,9 @@ let
       inherit tiling_wm;
     };
   stableVersion = {
-    version = "2025.3.3.7"; # "Android Studio Panda 3 | 2025.3.3 Patch 1"
-    sha256Hash = "sha256-FTAJ9rZPwLgIA/uPKl4d9haBxLL4O2Z+H8sY6RqaeOA=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2025.3.3.7/android-studio-panda3-patch1-linux.tar.gz";
+    version = "2025.3.4.6"; # "Android Studio Panda 4 | 2025.3.4"
+    sha256Hash = "sha256-Mqf/CayqOLSNYciIK+5+ITAiqLoNHxbABzOA+stQn9M=";
+    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2025.3.4.6/android-studio-panda4-linux.tar.gz";
   };
   betaVersion = {
     version = "2025.3.4.5"; # "Android Studio Panda 4 | 2025.3.4 RC 1"
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 3f80e197ffaa..d95a325a8f86 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -200,13 +200,13 @@
     "vendorHash": "sha256-sagrygtfsZWQUuIuGTUldZYYR5OhQfpZDxDKZAaIR4Y="
   },
   "cloudflare_cloudflare": {
-    "hash": "sha256-D5Kk6xCz3CQWbGHjLKU/+SPBzCYFQlphCTMG6+LvFek=",
+    "hash": "sha256-2hlL7N6jP7or3l0HczbRhnAmMYJ0XQTXl0f+sIFdlZc=",
     "homepage": "https://registry.terraform.io/providers/cloudflare/cloudflare",
     "owner": "cloudflare",
     "repo": "terraform-provider-cloudflare",
-    "rev": "v5.18.0",
+    "rev": "v5.19.0",
     "spdx": "Apache-2.0",
-    "vendorHash": "sha256-8d6cnbdPhfc/9B8JUq1HbReOYBauY6SQf3xKqgK1PeQ="
+    "vendorHash": "sha256-Gkb493fesB/jOdvnQrwt4MrNKO+YlR3+9Mu5TiaG084="
   },
   "cloudfoundry-community_cloudfoundry": {
     "hash": "sha256-1nYncJLVU/f9WD6Quh9IieIXgixPzbPk4zbtI1zmf9g=",
@@ -1076,11 +1076,11 @@
     "vendorHash": "sha256-F1AuO/dkldEDRvkwrbq2EjByxjg3K2rohZAM4DzKPUw="
   },
   "pagerduty_pagerduty": {
-    "hash": "sha256-w5FNU3HYIrplFyyw3V6RpJ6exW83F+u/CRdr9htbuxs=",
+    "hash": "sha256-JEV+nNJjEM7RlQ6RKEawftB/OHaf8vcNHDYKhkUJRw0=",
     "homepage": "https://registry.terraform.io/providers/PagerDuty/pagerduty",
     "owner": "PagerDuty",
     "repo": "terraform-provider-pagerduty",
-    "rev": "v3.32.2",
+    "rev": "v3.32.3",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
diff --git a/pkgs/by-name/aq/aquamarine/package.nix b/pkgs/by-name/aq/aquamarine/package.nix
index c458f0521c0c..03774520b95c 100644
--- a/pkgs/by-name/aq/aquamarine/package.nix
+++ b/pkgs/by-name/aq/aquamarine/package.nix
@@ -23,13 +23,13 @@
 }:
 gcc15Stdenv.mkDerivation (finalAttrs: {
   pname = "aquamarine";
-  version = "0.10.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "aquamarine";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XnkWjCpeXfip9tqYdL0b0zzBDjq+dgdISvEdSVGdVyA=";
+    hash = "sha256-nGiqEpbQK/tg7Mzyb8kIik9uDcm3cInWDcHRquFAOS4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ar/art-standalone/package.nix b/pkgs/by-name/ar/art-standalone/package.nix
index 6f0a62d6b9eb..cb7c5904a462 100644
--- a/pkgs/by-name/ar/art-standalone/package.nix
+++ b/pkgs/by-name/ar/art-standalone/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitLab,
-  wolfssl,
   bionic-translation,
   python3,
   which,
@@ -35,6 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [
     # Do not hardocde addr2line binary path
     ./no-hardcode-path-addr2line.patch
+    ./remove-wolfssljni.patch
   ];
 
   postPatch = ''
@@ -65,7 +65,6 @@ stdenv.mkDerivation (finalAttrs: {
     libpng
     lz4
     openssl
-    (wolfssl.override { enableJni = true; })
     xz
     zlib
   ];
diff --git a/pkgs/by-name/ar/art-standalone/remove-wolfssljni.patch b/pkgs/by-name/ar/art-standalone/remove-wolfssljni.patch
new file mode 100644
index 000000000000..f3aac163d0a7
--- /dev/null
+++ b/pkgs/by-name/ar/art-standalone/remove-wolfssljni.patch
@@ -0,0 +1,96 @@
+diff --git a/Makefile b/Makefile
+index 3383a64b36..b658f49c23 100644
+--- a/Makefile
++++ b/Makefile
+@@ -53,7 +53,7 @@
+ 
+ default: ____art_all
+ 
+-____art_all: dalvikvm art dex2oat libjavacore libcore libopenjdk libopenjdkjvm core-libart-hostdex core-oj-hostdex apachehttp-hostdex apache-xml-hostdex hamcrest-hostdex core-junit-hostdex junit-runner-hostdex bouncycastle-hostdex wolfssljni-hostdex okhttp-hostdex libandroidfw art-standalone.pc
++____art_all: dalvikvm art dex2oat libjavacore libcore libopenjdk libopenjdkjvm core-libart-hostdex core-oj-hostdex apachehttp-hostdex apache-xml-hostdex hamcrest-hostdex core-junit-hostdex junit-runner-hostdex bouncycastle-hostdex okhttp-hostdex libandroidfw art-standalone.pc
+ 
+ art-standalone.pc: art-standalone.pc.in
+ 	sed -e 's|@prefix@|$(____PREFIX)|g' \
+@@ -68,8 +68,7 @@
+ 	install -Dt $(____INSTALL_LIBDIR)/java/dex/art/natives/ $(____TOPDIR)/out/host/linux-x86/lib64/libjavacore.so \
+ 	                                                        $(____TOPDIR)/out/host/linux-x86/lib64/libnativehelper.so \
+ 	                                                        $(____TOPDIR)/out/host/linux-x86/lib64/libopenjdk.so \
+-	                                                        $(____TOPDIR)/out/host/linux-x86/lib64/libopenjdkjvm.so \
+-	                                                        $(____TOPDIR)/out/host/linux-x86/lib64/libwolfssljni.so
++	                                                        $(____TOPDIR)/out/host/linux-x86/lib64/libopenjdkjvm.so
+ #
+ # these are mostly internal libs which there's no point in versioning because they don't have any kind of stable ABI - so we just shove them in art/ namespace
+ # even the libunwind is actually a fork of libunwind 1.1 with added stuff that will likely never be upstreamed, especially since google stopped using libunwind
+@@ -108,8 +107,7 @@
+ 	                                                $(____TOPDIR)/out/host/linux-x86/framework/core-oj-hostdex.jar \
+ 	                                                $(____TOPDIR)/out/host/linux-x86/framework/hamcrest-hostdex.jar \
+ 	                                                $(____TOPDIR)/out/host/linux-x86/framework/junit-runner-hostdex.jar \
+-	                                                $(____TOPDIR)/out/host/linux-x86/framework/okhttp-hostdex.jar \
+-	                                                $(____TOPDIR)/out/host/linux-x86/framework/wolfssljni-hostdex.jar
++	                                                $(____TOPDIR)/out/host/linux-x86/framework/okhttp-hostdex.jar
+ #
+ # packaging note: this is needed as bootclasspath when compiling android_translation_layer. Can be in -dev package.
+ 	install -D $(____TOPDIR)/out/host/common/obj/JAVA_LIBRARIES/core-all-hostdex_intermediates/classes.jar $(____INSTALL_LIBDIR)/java/core-all_classes.jar
+diff --git a/art/runtime/parsed_options.cc b/art/runtime/parsed_options.cc
+index 1f8936114a..b8f7566401 100644
+--- a/art/runtime/parsed_options.cc
++++ b/art/runtime/parsed_options.cc
+@@ -597,8 +597,7 @@
+                                         bootclasspath_prefix + "/core-libart-hostdex.jar"  + ':' +
+                                         bootclasspath_prefix + "/hamcrest-hostdex.jar"     + ':' +
+                                         bootclasspath_prefix + "/junit-runner-hostdex.jar" + ':' +
+-                                        bootclasspath_prefix + "/okhttp-hostdex.jar"       + ':' +
+-                                        bootclasspath_prefix + "/wolfssljni-hostdex.jar";
++                                        bootclasspath_prefix + "/okhttp-hostdex.jar";
+       free(bootclasspath_prefix);
+ 
+       if(args.Exists(M::BootClassPath_a))
+diff --git a/libcore/luni/src/main/java/java/security/security.properties b/libcore/luni/src/main/java/java/security/security.properties
+index ca55328279..b17437f81e 100644
+--- a/libcore/luni/src/main/java/java/security/security.properties
++++ b/libcore/luni/src/main/java/java/security/security.properties
+@@ -18,15 +18,13 @@
+ # Providers
+ # See also: J2SE doc. "How to Implement a Provider for the JavaTM Cryptography Architecture"
+ #
+-# Android's provider of OpenSSL backed implementations
+-security.provider.1=com.wolfssl.provider.jsse.WolfSSLProvider
+ # Android's stripped down BouncyCastle provider
+-security.provider.2=com.android.org.bouncycastle.jce.provider.BouncyCastleProvider
++security.provider.1=com.android.org.bouncycastle.jce.provider.BouncyCastleProvider
+ # provides implementations that would normally be provided by sun.security.provider.Sun
+ # (CertPathValidator, CertPathBuilder and (ATL added) JKS)
+-security.provider.3=sun.security.provider.CertPathProvider
++security.provider.2=sun.security.provider.CertPathProvider
+ # Remaining Harmony providers
+-security.provider.4=org.apache.harmony.security.provider.crypto.CryptoProvider
++security.provider.3=org.apache.harmony.security.provider.crypto.CryptoProvider
+ 
+ 
+ 
+@@ -39,13 +37,6 @@
+ # javax/net/ssl/SSLSocketFactory.html#getDefault()
+ # javax/net/ssl/SSLServerSocketFactory.html#getDefault()
+ 
+-# For regular SSLSockets, we have two implementations:
+-ssl.SocketFactory.provider=com.wolfssl.provider.jsse.WolfSSLSocketFactory
+-#ssl.SocketFactory.provider=com.android.org.conscrypt.SSLSocketFactoryImpl
+-
+-# For SSLServerSockets, there's only the new, OpenSSL-based implementation:
+-ssl.ServerSocketFactory.provider=com.wolfssl.provider.jsse.WolfSSLServerSocketFactory
+-
+ # Default KeyStore type.
+ # See specification for java/security/KeyStore.html#getDefaultType()
+ keystore.type=BKS
+diff --git a/libcore/ojluni/src/main/java/sun/security/jca/Providers.java b/libcore/ojluni/src/main/java/sun/security/jca/Providers.java
+index e60c3e3ba8..ec66dcb8f0 100644
+--- a/libcore/ojluni/src/main/java/sun/security/jca/Providers.java
++++ b/libcore/ojluni/src/main/java/sun/security/jca/Providers.java
+@@ -103,7 +103,6 @@
+         */
+         "com.android.org.bouncycastle.jce.provider.BouncyCastleProvider",
+         "org.apache.harmony.security.provider.crypto.CryptoProvider", // we need SecureRandom
+-        "com.wolfssl.provider.jsse.WolfSSLProvider",
+         // END Android-changed: Use Conscrypt and BC, not the sun.security providers.
+         BACKUP_PROVIDER_CLASSNAME,
+     };
diff --git a/pkgs/by-name/aw/aws-vault/package.nix b/pkgs/by-name/aw/aws-vault/package.nix
index e4cdcec4065e..f45102a0947f 100644
--- a/pkgs/by-name/aw/aws-vault/package.nix
+++ b/pkgs/by-name/aw/aws-vault/package.nix
@@ -10,17 +10,17 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "aws-vault";
-  version = "7.9.15";
+  version = "7.10.2";
 
   src = fetchFromGitHub {
     owner = "ByteNess";
     repo = "aws-vault";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-kDzFiuzSyxNyJnj3nechenhvm4bg+fSif+D+/stdTyo=";
+    hash = "sha256-d8Rk+Qkfv4fcQYt+U/QF1hF+c03dj2dWHRUtuxIi73U=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-92k0E4zCKgWyCAvXWU49dFaYuiTByYNAWxdTYDeTzoE=";
+  vendorHash = "sha256-dub/57nE3ERKJEsx5bjTWjJBwIeJcmNSYoG/7iZqe+0=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/cu/curlMinimal/package.nix b/pkgs/by-name/cu/curlMinimal/package.nix
index 1d1c9c0fe0c2..b3bd7cd1d94f 100644
--- a/pkgs/by-name/cu/curlMinimal/package.nix
+++ b/pkgs/by-name/cu/curlMinimal/package.nix
@@ -48,8 +48,6 @@
   rtmpdump,
   scpSupport ? zlibSupport && !stdenv.hostPlatform.isSunOS && !stdenv.hostPlatform.isCygwin,
   libssh2,
-  wolfsslSupport ? false,
-  wolfssl,
   rustlsSupport ? false,
   rustls-ffi,
   zlibSupport ? true,
@@ -80,7 +78,6 @@ assert
     (lib.count (x: x) [
       gnutlsSupport
       opensslSupport
-      wolfsslSupport
       rustlsSupport
     ]) > 1
   );
@@ -160,7 +157,6 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional pslSupport libpsl
     ++ lib.optional rtmpSupport rtmpdump
     ++ lib.optional scpSupport libssh2
-    ++ lib.optional wolfsslSupport wolfssl
     ++ lib.optional rustlsSupport rustls-ffi
     ++ lib.optional zlibSupport zlib
     ++ lib.optional zstdSupport zstd;
@@ -192,7 +188,8 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.withFeatureAs idnSupport "libidn2" (lib.getDev libidn2))
     (lib.withFeatureAs opensslSupport "openssl" (lib.getDev openssl))
     (lib.withFeatureAs scpSupport "libssh2" (lib.getDev libssh2))
-    (lib.withFeatureAs wolfsslSupport "wolfssl" (lib.getDev wolfssl))
+    # TODO: Clean up on `staging`.
+    "--without-wolfssl"
   ]
   ++ lib.optional gssSupport "--with-gssapi=${lib.getDev libkrb5}"
   # For the 'urandom', maybe it should be a cross-system option
@@ -203,7 +200,7 @@ stdenv.mkDerivation (finalAttrs: {
     "--without-ca-bundle"
     "--without-ca-path"
   ]
-  ++ lib.optionals (!gnutlsSupport && !opensslSupport && !wolfsslSupport && !rustlsSupport) [
+  ++ lib.optionals (!gnutlsSupport && !opensslSupport && !rustlsSupport) [
     "--without-ssl"
   ]
   ++ lib.optionals (rustlsSupport && !stdenv.hostPlatform.isDarwin) [
diff --git a/pkgs/by-name/du/dumpyara/package.nix b/pkgs/by-name/du/dumpyara/package.nix
new file mode 100644
index 000000000000..3ace3aafdc9d
--- /dev/null
+++ b/pkgs/by-name/du/dumpyara/package.nix
@@ -0,0 +1,83 @@
+{
+  lib,
+  runCommand,
+  python3Packages,
+  fetchFromGitHub,
+  callPackage,
+  nix-update-script,
+  _7zz,
+  android-tools,
+  cpio,
+  dumpyara,
+  erofs-utils,
+  squashfsTools,
+  zip,
+}:
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "dumpyara";
+  version = "1.1.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "sebaubuntu-python";
+    repo = "dumpyara";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-V7SX1XR+De3py6B3Fmqn1IehN0sGPxUKJ0YlGpBPHG4=";
+  };
+
+  build-system = with python3Packages; [ poetry-core ];
+
+  dependencies = with python3Packages; [
+    brotli
+    liblp
+    lz4
+    protobuf5
+    py7zr
+    sebaubuntu-libs
+    zstandard
+  ];
+
+  makeWrapperArgs = [
+    "--prefix"
+    "PATH"
+    ":"
+    (lib.makeBinPath [
+      _7zz
+      android-tools
+      cpio
+      erofs-utils
+    ])
+  ];
+
+  passthru = {
+    tests.requiredTools =
+      runCommand "check-required-tools"
+        {
+          nativeBuildInputs = [
+            android-tools
+            dumpyara
+            squashfsTools
+            zip
+          ];
+        }
+        ''
+          echo foo > bar.txt
+          mkbootimg --kernel bar.txt -o boot.img
+          mksquashfs bar.txt system.img
+          zip system.zip *.img
+          dumpyara system.zip
+          touch $out
+        '';
+    updateScript = nix-update-script { };
+  };
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "Android firmware dumper";
+    homepage = "https://github.com/sebaubuntu-python/dumpyara";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ ungeskriptet ];
+    mainProgram = "dumpyara";
+  };
+})
diff --git a/pkgs/by-name/ha/haproxy/package.nix b/pkgs/by-name/ha/haproxy/package.nix
index 806d008ac75b..cd0f97ea0835 100644
--- a/pkgs/by-name/ha/haproxy/package.nix
+++ b/pkgs/by-name/ha/haproxy/package.nix
@@ -12,7 +12,6 @@
   aws-lc,
   libressl,
   openssl,
-  wolfssl,
   lua5_4,
   pcre2,
 }:
@@ -21,7 +20,6 @@ assert lib.assertOneOf "sslLibrary" sslLibrary [
   "aws-lc"
   "libressl"
   "openssl"
-  "wolfssl"
 ];
 let
   sslPkgs = {
@@ -30,10 +28,6 @@ let
       libressl
       openssl
       ;
-    wolfssl = wolfssl.override {
-      variant = "haproxy";
-      extraConfigureFlags = [ "--enable-quic" ];
-    };
   };
   sslPkg = sslPkgs.${sslLibrary};
 in
@@ -85,9 +79,6 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals (sslLibrary == "openssl" && lib.versionOlder openssl.version "3.5.2") [
     "USE_QUIC_OPENSSL_COMPAT=yes"
   ]
-  ++ lib.optionals (sslLibrary == "wolfssl") [
-    "USE_OPENSSL_WOLFSSL=yes"
-  ]
   ++ lib.optionals usePcre [
     "USE_PCRE2=yes"
     "USE_PCRE2_JIT=yes"
diff --git a/pkgs/by-name/it/itch-dl/package.nix b/pkgs/by-name/it/itch-dl/package.nix
index bb217dc02101..a1076b02eb38 100644
--- a/pkgs/by-name/it/itch-dl/package.nix
+++ b/pkgs/by-name/it/itch-dl/package.nix
@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "itch-dl";
-  version = "0.6.1";
+  version = "0.7.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "DragoonAethis";
     repo = "itch-dl";
     tag = finalAttrs.version;
-    hash = "sha256-zwsiG38wOVi3pP0gQWkZqfAmdWKadjB65qiTg68tZWg=";
+    hash = "sha256-4+Idh76o/VbdQ6hgvQsrz9AGYeOGC2hgN0kMJz+ik2E=";
   };
 
   nativeBuildInputs = with python3Packages; [
@@ -36,6 +36,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     "urllib3"
     "beautifulsoup4"
     "lxml"
+    "tqdm"
   ];
 
   meta = {
diff --git a/pkgs/by-name/kh/khard/package.nix b/pkgs/by-name/kh/khard/package.nix
index be52eab3c6d2..5adfdb61364e 100644
--- a/pkgs/by-name/kh/khard/package.nix
+++ b/pkgs/by-name/kh/khard/package.nix
@@ -60,7 +60,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     python3.pkgs.pytestCheckHook
   ];
 
-  pytestFlagsArray = [
+  pytestFlags = [
     # Nixpkgs' default is `--capture=fd`, and with it, 2 command mock tests
     # fail, see: https://github.com/lucc/khard/issues/353
     "--capture=no"
diff --git a/pkgs/by-name/li/lightway/package.nix b/pkgs/by-name/li/lightway/package.nix
index 26d0ba9082dd..bd48ef60bcff 100644
--- a/pkgs/by-name/li/lightway/package.nix
+++ b/pkgs/by-name/li/lightway/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage {
   pname = "lightway";
-  version = "0-unstable-2026-04-10";
+  version = "0-unstable-2026-04-24";
 
   src = fetchFromGitHub {
     owner = "expressvpn";
     repo = "lightway";
-    rev = "72a924935df9db641e7f4fe28cbeafaead59014f";
-    hash = "sha256-tygK2CQmbbynJiwGkMvYzt2dHoE17DCJeqD+jlai/m8=";
+    rev = "8e0940f047ee72db5daa1fb7c3bb82bc89e0f1d9";
+    hash = "sha256-OFMAEw613aIGG7N5LBAGbVrpkqMUBi7lUy7jm5tZowc=";
   };
 
-  cargoHash = "sha256-NdVOphyBW5sflv5jZPV/ShfAJXb3ZOyDRctmn/2JY38=";
+  cargoHash = "sha256-gY8KokOtdBT7Vq+lGn2sk4/o3A0TypEqv09TVJqaZjc=";
 
   cargoBuildFlags = lib.cli.toCommandLineGNU { } {
     package = [
diff --git a/pkgs/by-name/lu/luau/package.nix b/pkgs/by-name/lu/luau/package.nix
index 9a22f71312ed..e94f1b447b26 100644
--- a/pkgs/by-name/lu/luau/package.nix
+++ b/pkgs/by-name/lu/luau/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "luau";
-  version = "0.714";
+  version = "0.718";
 
   src = fetchFromGitHub {
     owner = "luau-lang";
     repo = "luau";
     tag = finalAttrs.version;
-    hash = "sha256-TSkiVG0ORRU4+4TsAoLBYfMbB1Ki/ctn3cZDAEsRn/Q=";
+    hash = "sha256-PB+sUCRmvz5ijdtPyDNxpP7asQAhe9GczEHx962GLKA=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/ma/mattermost/package.nix b/pkgs/by-name/ma/mattermost/package.nix
index 1efa00694488..51e25ec144dc 100644
--- a/pkgs/by-name/ma/mattermost/package.nix
+++ b/pkgs/by-name/ma/mattermost/package.nix
@@ -5,7 +5,7 @@
   buildGoModule,
   fetchFromGitHub,
   buildNpmPackage,
-  nodejs_22,
+  nodejs,
   nix-update-script,
   npm-lockfile-fix,
   fetchNpmDeps,
@@ -13,20 +13,21 @@
   nixosTests,
 
   versionInfo ? {
-    # ESR releases only.
-    # See https://docs.mattermost.com/upgrade/extended-support-release.html
+    # ESR releases only. Note: if NixOS would release with an ESR that goes out
+    # of support during the lifetime of the NixOS release, it is acceptable
+    # to put the latest non-ESR release here if we change it to an ESR shortly after
+    # the NixOS release.
+    #
+    # See <https://docs.mattermost.com/upgrade/extended-support-release.html>.
     # When a new ESR version is available (e.g. 8.1.x -> 9.5.x), update
     # the version regex here as well.
     #
     # Ensure you also check ../mattermostLatest/package.nix.
-    regex = "^v(10\\.11\\.[0-9]+)$";
-    version = "10.11.15";
-    srcHash = "sha256-b/hXZHYULl9nNJZT4GtKsaOfX8BEzz/v3Uy3EEbzN8U=";
-    vendorHash = "sha256-Z94d1eCIkuMG72Mlvk5su/99+4kJoaeHxaeZuk96Hlc=";
-    npmDepsHash = "sha256-p9dq31qw0EZDQIl2ysKE38JgDyLA6XvSv+VtHuRh+8A=";
-    lockfileOverlay = ''
-      unlock(.; "@floating-ui/react"; "channels/node_modules/@floating-ui/react")
-    '';
+    regex = "^v(11\\.[67]\\.[0-9]+)$";
+    version = "11.6.1";
+    srcHash = "sha256-0TUh5qKi64jt3YhgCTceoizOGzqyt70Rh8VH+bSfS5o=";
+    vendorHash = "sha256-bWl1rdVRTOJzS2HKKsSRhzVcH1sPgEAlRLjrc+/o0lo=";
+    npmDepsHash = "sha256-30xwoizNh6fAWS0YdEheXtcO6I9MjoFdCekvLnnoBMc=";
   },
   ...
 }:
@@ -223,9 +224,7 @@ buildMattermost rec {
           --replace-fail 'options: {}' 'options: { disable: true }'
       '';
 
-      # https://github.com/NixOS/nixpkgs/issues/474535
-      nodejs = nodejs_22;
-
+      inherit nodejs;
       npmDepsHash = npmDeps.hash;
       makeCacheWritable = true;
       forceGitDeps = true;
@@ -235,10 +234,9 @@ buildMattermost rec {
       buildPhase = ''
         runHook preBuild
 
-        npm run build --workspace=platform/types
-        npm run build --workspace=platform/client
-        npm run build --workspace=platform/components
-        npm run build --workspace=channels
+        for ws in platform/{types,client,components,shared} channels; do
+          npm run build --workspace="$ws"
+        done
 
         runHook postBuild
       '';
diff --git a/pkgs/by-name/ma/mattermost/tests.nix b/pkgs/by-name/ma/mattermost/tests.nix
index 53ccc82ab558..4283d6971b87 100644
--- a/pkgs/by-name/ma/mattermost/tests.nix
+++ b/pkgs/by-name/ma/mattermost/tests.nix
@@ -4,7 +4,6 @@
   gotestsum,
   which,
   postgresql,
-  mariadb,
   redis,
   curl,
   net-tools,
@@ -20,7 +19,6 @@ mattermost.overrideAttrs (
     nativeCheckInputs = [
       which
       postgresql
-      mariadb
       redis
       curl
       net-tools
@@ -113,11 +111,6 @@ mattermost.overrideAttrs (
         fi
       }
 
-      # Waits for MySQL to come up or down.
-      wait_mysql() {
-        wait_cmd mysql "$1" mysqladmin ping
-      }
-
       # Waits for Postgres to come up or down.
       wait_postgres() {
         wait_cmd postgres "$1" pg_isready -h localhost
@@ -128,33 +121,6 @@ mattermost.overrideAttrs (
         wait_cmd redis "$1" redis-cli ping
       }
 
-      # Starts MySQL.
-      start_mysql() {
-        echo "Starting MySQL at $MYSQL_HOME" >&2
-        mysqld &
-        mysql_pid=$!
-        echo "... PID $mysql_pid" >&2
-        wait_mysql up
-      }
-
-      # Stops MySQL.
-      stop_mysql() {
-        if [ "$mysql_pid" -gt 0 ]; then
-          echo "Terminating MySQL at $MYSQL_HOME (PID $mysql_pid)" >&2
-          mysqladmin --host=127.0.0.1 --user=root --password=mostest --wait-for-all-slaves --shutdown-timeout=30 shutdown
-          wait_mysql down
-          wait_cmd 'mysql pid' down kill -0 "$mysql_pid"
-
-          # Make sure the worker PID went down too (but it may be already gone).
-          local worker_pid="$(<"$MYSQL_HOME"/mysqld.pid || echo 0)"
-          if [ -n "$worker_pid" ] && [ $worker_pid -gt 0 ]; then
-            wait_cmd 'mysql workers' down kill -0 "$worker_pid"
-          fi
-
-          mysql_pid=0
-        fi
-      }
-
       # Starts Postgres.
       start_postgres() {
         echo "Starting Postgres at $PGDATA" >&2
@@ -186,52 +152,6 @@ mattermost.overrideAttrs (
         redis_pid=0
       }
 
-      # Configure MySQL.
-      export MYSQL_HOME="$NIX_BUILD_TOP/.mysql"
-      mkdir -p "$MYSQL_HOME"
-      cat <<EOF >"$MYSQL_HOME/my.cnf"
-      [client]
-      port = 3306
-      default-character-set = utf8mb4
-      socket = $MYSQL_HOME/mysqld.sock
-
-      [mysqld]
-      skip-host-cache
-      skip-name-resolve
-      basedir = ${mariadb}
-      datadir = $MYSQL_HOME/
-      pid-file = $MYSQL_HOME/mysqld.pid
-      socket = $MYSQL_HOME/mysqld.sock
-      port = 3306
-      explicit_defaults_for_timestamp
-      collation-server = utf8mb4_general_ci
-      init-connect = 'SET NAMES utf8mb4'
-      character-set-server = utf8mb4
-      EOF
-
-      # Start MySQL.
-      mysql_install_db --skip-name-resolve --auth-root-authentication-method=normal
-      start_mysql
-
-      # Init MySQL.
-      cat <<EOF | mysql --defaults-file="$MYSQL_HOME/my.cnf" -u root -v
-      -- This is the admin password for tests; see the docker-compose:
-      -- https://github.com/mattermost/mattermost/blob/v${final.version}/server/docker-compose.yaml
-      create user if not exists 'mmuser' identified by 'mostest';
-      create database if not exists mattermost_test;
-      grant all privileges on *.* to 'mmuser' with grant option;
-
-      -- Also need to set up root (tests seem to override the user to root)
-      alter user 'root'@'127.0.0.1' identified by 'mostest';
-
-      flush privileges;
-      show grants for 'root'@'127.0.0.1';
-      show grants for 'mmuser';
-      EOF
-
-      # Need to change this so we use 127.0.0.1 in tests.
-      export TEST_DATABASE_MYSQL_DSN='root:mostest@tcp(127.0.0.1:3306)/mattermost_test?charset=utf8mb4&readTimeout=30s&writeTimeout=30s'
-
       # Start Postgres.
       export PGDATA="$NIX_BUILD_TOP/.postgres"
       initdb -E UTF8 -U postgres
@@ -284,12 +204,6 @@ mattermost.overrideAttrs (
     '';
 
     postCheck = ''
-      # Clean up MySQL.
-      if [ -d "$MYSQL_HOME" ]; then
-        stop_mysql
-        rm -rf "$MYSQL_HOME"
-      fi
-
       # Clean up Postgres.
       if [ -d "$PGDATA" ]; then
         stop_postgres
diff --git a/pkgs/by-name/ma/mattermostLatest/package.nix b/pkgs/by-name/ma/mattermostLatest/package.nix
index 7f5ef6c0490b..c601200a51c2 100644
--- a/pkgs/by-name/ma/mattermostLatest/package.nix
+++ b/pkgs/by-name/ma/mattermostLatest/package.nix
@@ -3,25 +3,4 @@
   ...
 }@args:
 
-mattermost.override (
-  {
-    versionInfo = {
-      # Latest, non-RC releases only.
-      # If the latest is an ESR (Extended Support Release),
-      # duplicate it here to facilitate the update script.
-      # See https://docs.mattermost.com/about/mattermost-server-releases.html
-      # and make sure the version regex is up to date here.
-      # Ensure you also check ../mattermost/package.nix for ESR releases.
-      regex = "^v(11\\.[0-9]+\\.[0-9]+)$";
-      version = "11.5.3";
-      srcHash = "sha256-r7rfiQ4C0E511QWdpQihydsuoRZCzboodmh1iT4a8r4=";
-      vendorHash = "sha256-/ts6j86tvbYFjVACkJwcSnXDd+8BXzpaFVdV9DRHkqY=";
-      npmDepsHash = "sha256-r7iq1pCAJjFyspZBdeNWe00W7A3l73PGC6rrsZ7O6Uw=";
-      lockfileOverlay = ''
-        unlock(.; "@floating-ui/react"; "channels/node_modules/@floating-ui/react")
-      '';
-      autoUpdate = ./package.nix;
-    };
-  }
-  // args
-)
+mattermost.override args
diff --git a/pkgs/by-name/mi/mise/package.nix b/pkgs/by-name/mi/mise/package.nix
index 05025fed802c..05c0129dd694 100644
--- a/pkgs/by-name/mi/mise/package.nix
+++ b/pkgs/by-name/mi/mise/package.nix
@@ -22,16 +22,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mise";
-  version = "2026.4.6";
+  version = "2026.4.20";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "mise";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tdHjJjLwnf0/0ZxVb9+tgCD8cD8/3TEE3hw6dM3fKtY=";
+    hash = "sha256-6WGYjXx1AuUDbYIAHh0PdSUC+zDXq4mC5LY+r1vLiKc=";
   };
 
-  cargoHash = "sha256-8JLwlEqxt8Ixg/b67ZICBBoOjGw8PFIYzNIBRiBJ8OA=";
+  cargoHash = "sha256-8JAxt9m8StOSNbUKZBNwQWoXwX+gXLGdNZYlRSH0SLM=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/on/onnxruntime/package.nix b/pkgs/by-name/on/onnxruntime/package.nix
index b01633221af1..08514fbd6c7c 100644
--- a/pkgs/by-name/on/onnxruntime/package.nix
+++ b/pkgs/by-name/on/onnxruntime/package.nix
@@ -21,7 +21,7 @@
   protobuf,
   microsoft-gsl,
   darwinMinVersionHook,
-  pythonSupport ? true,
+  pythonSupport ? (stdenv.buildPlatform.canExecute stdenv.hostPlatform),
   cudaSupport ? config.cudaSupport,
   ncclSupport ? cudaSupport && cudaPackages.nccl.meta.available,
   rocmSupport ? config.rocmSupport,
@@ -165,6 +165,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     libpng
     nlohmann_json
     microsoft-gsl
+    protobuf
     zlib
   ]
   ++ lib.optionals (lib.meta.availableOn effectiveStdenv.hostPlatform cpuinfo) [
@@ -313,6 +314,8 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     !(
       cudaSupport
       || rocmSupport
+      # cross-compiled test binaries can't execute on the build platform
+      || (effectiveStdenv.hostPlatform != effectiveStdenv.buildPlatform)
       || builtins.elem effectiveStdenv.buildPlatform.system [
         # aarch64-linux fails cpuinfo test, because /sys/devices/system/cpu/ does not exist in the sandbox
         "aarch64-linux"
diff --git a/pkgs/by-name/op/openfreebuds/package.nix b/pkgs/by-name/op/openfreebuds/package.nix
index b0f5c07e8b77..29fd14b2a4e0 100644
--- a/pkgs/by-name/op/openfreebuds/package.nix
+++ b/pkgs/by-name/op/openfreebuds/package.nix
@@ -38,7 +38,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     pytestCheckHook
   ];
 
-  pytestFlagsArray = [
+  enabledTestPaths = [
     "openfreebuds/driver/huawei/test/"
     "openfreebuds/test/test_event_bus.py"
   ];
diff --git a/pkgs/by-name/or/orca-slicer/package.nix b/pkgs/by-name/or/orca-slicer/package.nix
index bff4abbdf27e..c1a154e1fb19 100644
--- a/pkgs/by-name/or/orca-slicer/package.nix
+++ b/pkgs/by-name/or/orca-slicer/package.nix
@@ -28,7 +28,9 @@
   hicolor-icon-theme,
   libsecret,
   libpng,
+  makeFontsConf,
   mpfr,
+  nanum,
   nlopt,
   opencascade-occt_7_6,
   openvdb,
@@ -59,6 +61,12 @@ let
           "--enable-secretstore"
         ];
       });
+
+  # Workaround for crash due to missing font
+  # https://github.com/OrcaSlicer/OrcaSlicer/issues/11641
+  fontsConf = makeFontsConf {
+    fontDirectories = [ nanum ];
+  };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "orca-slicer";
@@ -219,6 +227,7 @@ stdenv.mkDerivation (finalAttrs: {
         ]
       }"
       --set WEBKIT_DISABLE_COMPOSITING_MODE 1
+      --set FONTCONFIG_FILE "${fontsConf}"
       ${lib.optionalString withNvidiaGLWorkaround ''
         --set __GLX_VENDOR_LIBRARY_NAME mesa
         --set __EGL_VENDOR_LIBRARY_FILENAMES /run/opengl-driver/share/glvnd/egl_vendor.d/50_mesa.json
diff --git a/pkgs/by-name/ox/oxlint/package.nix b/pkgs/by-name/ox/oxlint/package.nix
index 59acd68893fb..036540e23212 100644
--- a/pkgs/by-name/ox/oxlint/package.nix
+++ b/pkgs/by-name/ox/oxlint/package.nix
@@ -23,25 +23,25 @@
 # runs without an external linter, which leaves `jsPlugins` configs inert.
 stdenv.mkDerivation (finalAttrs: {
   pname = "oxlint";
-  version = "1.59.0";
+  version = "1.60.0";
 
   src = fetchFromGitHub {
     owner = "oxc-project";
     repo = "oxc";
     tag = "oxlint_v${finalAttrs.version}";
-    hash = "sha256-o4vacOuKNUdLdkd6v94jQcevA8dCXG32fYmO2ZEj330=";
+    hash = "sha256-RMADw7oEf407J7/KDmIma0k3JKALMBkLqp9pyE+uRkA=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-lppnmePEmbguoDDGyIM3gWbEX0ShgymoCjvrx1tK2Lw=";
+    hash = "sha256-Xla3mPOkBIfA4BMd+3/lO3mXy4V96DgyT+CzuhTTAd0=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-5T3lrAjMH03Rngc7u7oCLzp9E1sz7jOvG2XmPhouAz0=";
+    hash = "sha256-fomJmm0GXIClng63wql3hCo1Pf4CbVUiEtbvAv9DPIo=";
   };
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/by-name/po/postmoogle/package.nix b/pkgs/by-name/po/postmoogle/package.nix
index 8d002b98f0ad..85227f7c7669 100644
--- a/pkgs/by-name/po/postmoogle/package.nix
+++ b/pkgs/by-name/po/postmoogle/package.nix
@@ -5,13 +5,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "postmoogle";
-  version = "0.9.29";
+  version = "0.9.30";
 
   src = fetchFromGitHub {
     owner = "etkecc";
     repo = "postmoogle";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VBRlsPfNqDehR07vbLvh0nGUgE6H8izW4jqWfMeHmTE=";
+    hash = "sha256-eNXc2PK3yfetyEvTyoiuoFXjEpO4ZYbDFyFaLbzwqeY=";
   };
 
   tags = [
diff --git a/pkgs/by-name/pt/pt2-clone/package.nix b/pkgs/by-name/pt/pt2-clone/package.nix
index ca74bd04a5ba..2f5a6facf8c3 100644
--- a/pkgs/by-name/pt/pt2-clone/package.nix
+++ b/pkgs/by-name/pt/pt2-clone/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pt2-clone";
-  version = "1.87";
+  version = "1.88";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "pt2-clone";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-Kur9gQEEeGYHKQz6hNIEzohF1mJ9EDKAGycgiKehXhM=";
+    sha256 = "sha256-PdoncYnl7jD9iM0PDi0O92t9uAlhbrQciIr/+xk3igE=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/ri/riemann_c_client/package.nix b/pkgs/by-name/ri/riemann_c_client/package.nix
index ec82a124948f..abc0b7308119 100644
--- a/pkgs/by-name/ri/riemann_c_client/package.nix
+++ b/pkgs/by-name/ri/riemann_c_client/package.nix
@@ -7,8 +7,6 @@
   pkg-config,
   file,
   protobufc,
-  withWolfSSL ? false,
-  wolfssl,
   withGnuTLS ? false,
   gnutls,
   withJSON ? true,
@@ -45,12 +43,10 @@ stdenv.mkDerivation (finalAttrs: {
     file
     protobufc
   ]
-  ++ lib.optional withWolfSSL wolfssl
   ++ lib.optional withGnuTLS gnutls
   ++ lib.optional withJSON json_c;
 
-  configureFlags =
-    [ ] ++ lib.optional withWolfSSL "--with-tls=wolfssl" ++ lib.optional withGnuTLS "--with-tls=gnutls";
+  configureFlags = [ ] ++ lib.optional withGnuTLS "--with-tls=gnutls";
 
   doCheck = true;
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/rp/rpcs3/package.nix b/pkgs/by-name/rp/rpcs3/package.nix
index 567ceffe0f1e..b5d5c085f865 100644
--- a/pkgs/by-name/rp/rpcs3/package.nix
+++ b/pkgs/by-name/rp/rpcs3/package.nix
@@ -18,7 +18,6 @@
   libusb1,
   zlib,
   curl,
-  wolfssl,
   python3,
   pugixml,
   protobuf_33,
@@ -50,19 +49,19 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "rpcs3";
-  version = "0.0.39-unstable-2026-02-20";
+  version = "0.0.40-unstable-2026-04-25";
 
   src = fetchFromGitHub {
     owner = "RPCS3";
     repo = "rpcs3";
-    rev = "6bfb33279f6989f3ff9ea2dc40ef45d6aeb57ef8";
+    rev = "96f73f4497fd6fdafd40dc50f24c95c90cd4acc9";
     postCheckout = ''
       cd $out/3rdparty
       git submodule update --init \
         fusion/fusion asmjit/asmjit yaml-cpp/yaml-cpp SoundTouch/soundtouch stblib/stb \
-        feralinteractive/feralinteractive
+        feralinteractive/feralinteractive wolfssl/wolfssl
     '';
-    hash = "sha256-Cu4Zaze0FZ00sRvPtUzUkOiX5ZAHWTtmWa536gNOTNY=";
+    hash = "sha256-KTF2Oj1p+EplRgWQ/We8mqu60h161/1gniKWjVAvAso=";
   };
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
@@ -82,7 +81,6 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "USE_SYSTEM_LIBPNG" true)
     (lib.cmakeBool "USE_SYSTEM_FFMPEG" true)
     (lib.cmakeBool "USE_SYSTEM_CURL" true)
-    (lib.cmakeBool "USE_SYSTEM_WOLFSSL" true)
     (lib.cmakeBool "USE_SYSTEM_FAUDIO" true)
     (lib.cmakeBool "USE_SYSTEM_OPENAL" true)
     (lib.cmakeBool "USE_SYSTEM_PUGIXML" true)
@@ -127,7 +125,6 @@ stdenv.mkDerivation (finalAttrs: {
     zlib
     libusb1
     curl
-    wolfssl
     python3
     pugixml
     sdl3
@@ -168,7 +165,25 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [
       ilian
     ];
-    license = lib.licenses.gpl2Only;
+    license = [
+      lib.licenses.gpl2Only
+      # Vendors wolfSSL, which changed its licence from
+      # `GPL-2.0-or-later` to `GPL-3.0-or-later`, which is incompatible
+      # with RPCS3’s `GPL-2.0-only`. They have a “GPLv2 exception list”
+      # (<https://github.com/wolfSSL/wolfssl/blob/v5.9.1-stable/LICENSING>),
+      # but this is dubious; either the exception likely negates the
+      # licence change by letting you take wolfSSL out of a
+      # `GPL-2.0-only` combination and redistribute it under those
+      # terms, negating the licence change entirely, or else it doesn’t
+      # allow distribution of the combination under the `GPL-2.0-only`
+      # at all and therefore would still constitute a licence
+      # violation to redistribute.
+      #
+      # We use `lib.licenses.unfree` to represent this awkward
+      # situation and keep Hydra from building the package.
+      lib.licenses.gpl3Plus
+      lib.licenses.unfree
+    ];
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
diff --git a/pkgs/by-name/te/tempo/package.nix b/pkgs/by-name/te/tempo/package.nix
index 25cf8cc431e8..4f8005cb77eb 100644
--- a/pkgs/by-name/te/tempo/package.nix
+++ b/pkgs/by-name/te/tempo/package.nix
@@ -7,14 +7,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "tempo";
-  version = "2.10.4";
+  version = "2.10.5";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "tempo";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-0RW77pa6e8+kg7T5z2VLTd0bnJKpf+io7FaHWWQDpcQ=";
+    hash = "sha256-1eacaqyKyHF/uS0Ja7oq+YKn/3K2QpDmd6jysGVBOjg=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/te/terraform-plugin-docs/package.nix b/pkgs/by-name/te/terraform-plugin-docs/package.nix
index 697ef200fefd..00da0911e7c0 100644
--- a/pkgs/by-name/te/terraform-plugin-docs/package.nix
+++ b/pkgs/by-name/te/terraform-plugin-docs/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "terraform-plugin-docs";
-  version = "0.24.0";
+  version = "0.25.0";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "terraform-plugin-docs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wN85uTZgHasP4EsG/tNkt28tnLRFfosN6N89iwcAX80=";
+    hash = "sha256-QgN2gcGu9Laq4gQkYBvbE7gadiwzAyERLaKVLI+XiHQ=";
   };
 
-  vendorHash = "sha256-ZL61b2LAE+GFRtfUBIAoF7O65s7FeQw7cX4Aw2Cfd+k=";
+  vendorHash = "sha256-+D3JwUpLJ6gZAkTFO0fQAFpl0OCp36HMbWES/+lK+9g=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/uh/uhttpd/package.nix b/pkgs/by-name/uh/uhttpd/package.nix
index c5293b422df7..3c02e8ec259a 100644
--- a/pkgs/by-name/uh/uhttpd/package.nix
+++ b/pkgs/by-name/uh/uhttpd/package.nix
@@ -6,7 +6,7 @@
   pkg-config,
   lua5_1,
   json_c,
-  libubox-wolfssl,
+  libubox,
   ubus,
   libxcrypt,
   unstableGitUpdater,
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     lua5_1
     json_c
-    libubox-wolfssl
+    libubox
     ubus
     libxcrypt
   ];
diff --git a/pkgs/by-name/un/unifi/package.nix b/pkgs/by-name/un/unifi/package.nix
index e05dd5ce4ecc..8009886e0a45 100644
--- a/pkgs/by-name/un/unifi/package.nix
+++ b/pkgs/by-name/un/unifi/package.nix
@@ -10,12 +10,12 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "unifi-controller";
-  version = "10.1.89";
+  version = "10.2.105";
 
   # see https://community.ui.com/releases / https://www.ui.com/download/unifi
   src = fetchurl {
     url = "https://dl.ui.com/unifi/${finalAttrs.version}/unifi_sysvinit_all.deb";
-    hash = "sha256-gtnDr+CBeoOKqIeDwKJixW5W20lje7nzR4DC/D+1S3o=";
+    hash = "sha256-MBTFxNwrIbx6UKZYCcZ+BjYjSlfdxL60Ogei/ba4O+U=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ve/vega-cli/package.nix b/pkgs/by-name/ve/vega-cli/package.nix
index d16fb6c64a87..00b952f147b1 100644
--- a/pkgs/by-name/ve/vega-cli/package.nix
+++ b/pkgs/by-name/ve/vega-cli/package.nix
@@ -27,8 +27,8 @@ buildNpmPackage (finalAttrs: {
       --replace-fail "npm run data" "true"
 
     # Patch lerna.json to not use nx
-    mv lerna.json lerna.old.json
-    jq '. + {useNx: false}' < lerna.old.json > lerna.json
+    ${jq}/bin/jq '. + {useNx: false}' lerna.json > lerna.json.tmp
+    mv lerna.json.tmp lerna.json
   '';
 
   npmDepsHash = "sha256-mBe1fHnhor7ZR8CuRNs1zD7JzaZXZI5VM7mdAieVKqE=";
@@ -72,6 +72,8 @@ buildNpmPackage (finalAttrs: {
     description = "Command line tools for the Vega visualization grammar";
     homepage = "https://vega.github.io/vega/";
     license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ pyrox0 ];
+    maintainers = with lib.maintainers; [
+      philocalyst
+    ];
   };
 })
diff --git a/pkgs/by-name/wo/wolfssl/package.nix b/pkgs/by-name/wo/wolfssl/package.nix
deleted file mode 100644
index 6cde924b81f7..000000000000
--- a/pkgs/by-name/wo/wolfssl/package.nix
+++ /dev/null
@@ -1,135 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  autoreconfHook,
-  util-linux,
-  openssl,
-  cacert,
-  # The primary --enable-XXX variant. 'all' enables most features, but causes build-errors for some software,
-  # requiring to build a special variant for that software. Example: 'haproxy'
-  variant ? "all",
-  extraConfigureFlags ? [ ],
-  enableJni ? false,
-  enableARMCryptoExtensions ?
-    stdenv.hostPlatform.isAarch64
-    && ((builtins.match "^.*\\+crypto.*$" stdenv.hostPlatform.gcc.arch) != null),
-  enableLto ? !(stdenv.hostPlatform.isStatic || stdenv.cc.isClang),
-}:
-stdenv.mkDerivation (finalAttrs: {
-  pname = "wolfssl-${variant}";
-  version = "5.9.1";
-
-  src = fetchFromGitHub {
-    owner = "wolfSSL";
-    repo = "wolfssl";
-    tag = "v${finalAttrs.version}-stable";
-    hash = "sha256-FyEb94hsO2BaTEi1CJRfCsUiT1xyWCzu7Uys81g2CBE=";
-  };
-
-  postPatch = ''
-    patchShebangs ./scripts
-    # ensure test detects musl-based systems too
-    substituteInPlace scripts/ocsp-stapling2.test \
-      --replace '"linux-gnu"' '"linux-"'
-  ''
-  + lib.optionalString enableJni ''
-    # Some tests fail when JNI is enabled
-    sed -i '/TEST_DECL(test_wolfSSL_Tls13_ECH)/d;
-            /TEST_DECL(test_wolfSSL_Tls13_ECH_HRR)/d;
-            /TEST_DECL(test_TLSX_CA_NAMES_bad_extension)/d' tests/api.c
-    sed -i '/quic/d' tests/include.am
-    sed -i '/WOLFSSL_QUIC/,/#endif/d' tests/unit.c
-  '';
-
-  configureFlags = [
-    "--enable-${variant}"
-    "--enable-reproducible-build"
-  ]
-  ++ lib.optionals (variant == "all") [
-    # Extra feature flags to add while building the 'all' variant.
-    # Since they conflict while building other variants, only specify them for this one.
-    "--enable-pkcs11"
-    "--enable-writedup"
-    "--enable-base64encode"
-  ]
-  ++ [
-    # We're not on tiny embedded machines.
-    # Increase TLS session cache from 33 sessions to 20k.
-    "--enable-bigcache"
-
-    # Use WolfSSL's Single Precision Math with timing-resistant cryptography.
-    "--enable-sp=yes${
-      lib.optionalString (stdenv.hostPlatform.isx86_64 || stdenv.hostPlatform.isAarch) ",asm"
-    }"
-    "--enable-sp-math-all"
-    "--enable-harden"
-  ]
-  ++ lib.optionals (stdenv.hostPlatform.isx86_64) [
-    # Enable AVX/AVX2/AES-NI instructions, gated by runtime detection via CPUID.
-    "--enable-intelasm"
-    "--enable-aesni"
-  ]
-  ++ lib.optionals (stdenv.hostPlatform.isAarch64) [
-    # No runtime detection under ARM and no platform function checks like for X86.
-    (if enableARMCryptoExtensions then "--enable-armasm=inline" else "--disable-armasm")
-  ]
-  ++ lib.optionals enableJni [
-    "--enable-jni"
-  ]
-  ++ extraConfigureFlags;
-
-  # Breaks tls13 tests on aarch64-darwin.
-  hardeningDisable = lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
-    "zerocallusedregs"
-  ];
-
-  # LTO should help with the C implementations.
-  env.NIX_CFLAGS_COMPILE = lib.optionalString enableLto "-flto";
-  env.NIX_LDFLAGS_COMPILE = lib.optionalString enableLto "-flto";
-
-  # Don't attempt connections to external services in the test suite.
-  env.WOLFSSL_EXTERNAL_TEST = "0";
-
-  outputs = [
-    "dev"
-    "doc"
-    "lib"
-    "out"
-  ];
-
-  nativeBuildInputs = [
-    autoreconfHook
-    util-linux
-  ];
-
-  # FAILURES:
-  #    497: test_wolfSSL_EVP_PBE_scrypt
-  doCheck = !stdenv.hostPlatform.isLoongArch64;
-
-  nativeCheckInputs = [
-    openssl
-    cacert
-  ];
-
-  postInstall = ''
-    # fix recursive cycle:
-    # wolfssl-config points to dev, dev propagates bin
-    moveToOutput bin/wolfssl-config "$dev"
-    # moveToOutput also removes "$out" so recreate it
-    mkdir -p "$out"
-  '';
-
-  meta = {
-    description = "Small, fast, portable implementation of TLS/SSL for embedded devices";
-    mainProgram = "wolfssl-config";
-    homepage = "https://www.wolfssl.com/";
-    changelog = "https://github.com/wolfSSL/wolfssl/releases/tag/v${finalAttrs.version}-stable";
-    platforms = lib.platforms.all;
-    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [
-      fab
-      vifino
-    ];
-  };
-})
diff --git a/pkgs/by-name/yb/yb/package.nix b/pkgs/by-name/yb/yb/package.nix
index ad9cbfe8cd81..b96acb2db702 100644
--- a/pkgs/by-name/yb/yb/package.nix
+++ b/pkgs/by-name/yb/yb/package.nix
@@ -66,7 +66,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   # Run subset of tests that don't require YubiKey hardware
   doCheck = true;
-  pytestFlagsArray = [
+  enabledTestPaths = [
     "tests"
   ];
 
diff --git a/pkgs/development/interpreters/python/mk-python-derivation.nix b/pkgs/development/interpreters/python/mk-python-derivation.nix
index 5bbde1ab2f97..5f4ac7b84645 100644
--- a/pkgs/development/interpreters/python/mk-python-derivation.nix
+++ b/pkgs/development/interpreters/python/mk-python-derivation.nix
@@ -112,6 +112,9 @@ lib.extendMkDerivation {
     "dependencies"
     "optional-dependencies"
     "build-system"
+
+    # Deprecated arguments
+    "pytestFlagsArray"
   ];
 
   extendDrvArgs =
@@ -439,6 +442,19 @@ lib.extendMkDerivation {
       # Longer-term we should get rid of `checkPhase` and use `installCheckPhase`.
       installCheckPhase = attrs.checkPhase;
     }
+    // (
+      let
+        deprecatedFlagNotEmpty =
+          attrs ? pytestFlagsArray && attrs.pytestFlagsArray != null && attrs.pytestFlagsArray != [ ];
+        pos = builtins.unsafeGetAttrPos "pytestFlagsArray" attrs;
+      in
+      {
+        ${if deprecatedFlagNotEmpty then "pytestFlagsArray" else null} = throw ''
+          buildPythonPackage: Deprecated flag pytestFlagsArray found at ${pos.file}:${toString pos.line}
+            Use pytestFlags or (enabled|disabled)(TestPaths|Tests|TestMarks) instead.
+        '';
+      }
+    )
     //
       lib.mapAttrs
         (
diff --git a/pkgs/development/libraries/ustream-ssl/default.nix b/pkgs/development/libraries/ustream-ssl/default.nix
index 3f24ddce7222..e787cdf8adc5 100644
--- a/pkgs/development/libraries/ustream-ssl/default.nix
+++ b/pkgs/development/libraries/ustream-ssl/default.nix
@@ -6,7 +6,6 @@
   pkg-config,
   libubox-nossl,
   ssl_implementation,
-  additional_buildInputs ? [ ],
 }:
 
 stdenv.mkDerivation {
@@ -35,7 +34,7 @@ stdenv.mkDerivation {
     cmake
     pkg-config
   ];
-  buildInputs = [ ssl_implementation ] ++ additional_buildInputs;
+  buildInputs = [ ssl_implementation ];
 
   passthru = {
     inherit ssl_implementation;
diff --git a/pkgs/development/python-modules/connect-box/default.nix b/pkgs/development/python-modules/connect-box/default.nix
index 3376f3ea67ed..f34d7dbc1ba4 100644
--- a/pkgs/development/python-modules/connect-box/default.nix
+++ b/pkgs/development/python-modules/connect-box/default.nix
@@ -41,10 +41,9 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "connect_box" ];
 
-  pytestFlagsArray = [
+  pytestFlags = [
     "--vcr-record=none"
-    "-W"
-    "ignore::DeprecationWarning"
+    "-Wignore::DeprecationWarning"
   ];
 
   meta = {
diff --git a/pkgs/development/python-modules/country-list/default.nix b/pkgs/development/python-modules/country-list/default.nix
index 8e4ee9ab6d95..2a301e1f6c33 100644
--- a/pkgs/development/python-modules/country-list/default.nix
+++ b/pkgs/development/python-modules/country-list/default.nix
@@ -31,7 +31,7 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  pytestFlagsArray = [
+  enabledTestPaths = [
     "tests.py"
   ];
 
diff --git a/pkgs/development/python-modules/crewai/default.nix b/pkgs/development/python-modules/crewai/default.nix
index 55cd5934cc11..307440f10bc7 100644
--- a/pkgs/development/python-modules/crewai/default.nix
+++ b/pkgs/development/python-modules/crewai/default.nix
@@ -552,7 +552,7 @@ buildPythonPackage (finalAttrs: {
     writableTmpDirAsHomeHook
   ];
 
-  pytestFlagsArray = [
+  pytestFlags = [
     "--override-ini=addopts="
   ];
 
diff --git a/pkgs/development/python-modules/django-jinja/default.nix b/pkgs/development/python-modules/django-jinja/default.nix
index 20f88ca5ac2c..b48a32ee4ae8 100644
--- a/pkgs/development/python-modules/django-jinja/default.nix
+++ b/pkgs/development/python-modules/django-jinja/default.nix
@@ -44,7 +44,7 @@ buildPythonPackage rec {
     export DJANGO_SETTINGS_MODULE=settings
   '';
 
-  pytestFlagsArray = [
+  enabledTestPaths = [
     "testapp/tests.py"
   ];
 
diff --git a/pkgs/development/python-modules/pylint/default.nix b/pkgs/development/python-modules/pylint/default.nix
index 99bcf2293409..e91972254e54 100644
--- a/pkgs/development/python-modules/pylint/default.nix
+++ b/pkgs/development/python-modules/pylint/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pylint";
-  version = "4.0.4";
+  version = "4.0.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pylint-dev";
     repo = "pylint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mKI/sRYl2ZwZ3JklmqBTs7vRG9EA4zDHaW61d/Xozb4=";
+    hash = "sha256-RMoX3RR7T54Bvx0bBSmyuEsezqkxfdE/hIUa4G9exjQ=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/scanpy/default.nix b/pkgs/development/python-modules/scanpy/default.nix
index 1bb17259226a..cad855c690a3 100644
--- a/pkgs/development/python-modules/scanpy/default.nix
+++ b/pkgs/development/python-modules/scanpy/default.nix
@@ -180,7 +180,7 @@ buildPythonPackage (finalAttrs: {
     export NUMBA_CACHE_DIR=$(mktemp -d);
   '';
 
-  pytestFlagsArray = [
+  pytestFlags = [
     # UserWarning: 'where' used without 'out', expect unitialized memory in output.
     # If this is intentional, use out=None.
     "-Wignore::UserWarning"
diff --git a/pkgs/development/python-modules/sebaubuntu-libs/default.nix b/pkgs/development/python-modules/sebaubuntu-libs/default.nix
new file mode 100644
index 000000000000..91a1429d2bcd
--- /dev/null
+++ b/pkgs/development/python-modules/sebaubuntu-libs/default.nix
@@ -0,0 +1,68 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  nix-update-script,
+  android-image-kitchen,
+  gitpython,
+  poetry-core,
+  pyelftools,
+  requests,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "sebaubuntu-libs";
+  version = "2.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "sebaubuntu-python";
+    repo = "sebaubuntu_libs";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-LV7Me+GmgOvDh0XGoLaftCKtP/fnB5xVqb8nArOMIys=";
+  };
+
+  build-system = [
+    poetry-core
+  ];
+
+  dependencies = [
+    gitpython
+    pyelftools
+    requests
+  ];
+
+  postPatch = ''
+    # Patch libaik to use AIK from nixpkgs
+    substituteInPlace sebaubuntu_libs/libaik/__init__.py \
+      --replace-fail \
+        "Repo.clone_from(AIK_REPO, self.path)" "" \
+      --replace-fail \
+        "unpackimg.sh" "${lib.getExe' android-image-kitchen "aik-unpackimg"}" \
+      --replace-fail \
+        "repack.sh" "${lib.getExe' android-image-kitchen "aik-repackimg"}" \
+      --replace-fail \
+        "cleanup.sh" "${lib.getExe' android-image-kitchen "aik-cleanup"}" \
+      --replace-fail \
+        'command = [self.path / script, "--nosudo", *args]' \
+        'command = [script, "--nosudo", *args]' \
+      --replace-fail \
+        'return check_output(command, stderr=STDOUT, universal_newlines=True, encoding="utf-8")' \
+        'return check_output(command, stderr=STDOUT, universal_newlines=True, encoding="utf-8",
+          cwd=self.path)'
+  '';
+
+  # Module has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "sebaubuntu_libs" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "SebaUbuntu's shared libs";
+    homepage = "https://github.com/sebaubuntu-python/sebaubuntu_libs";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ ungeskriptet ];
+  };
+})
diff --git a/pkgs/development/python-modules/sklearn2pmml/default.nix b/pkgs/development/python-modules/sklearn2pmml/default.nix
index 93e1e83c9485..53dea7d9bfa8 100644
--- a/pkgs/development/python-modules/sklearn2pmml/default.nix
+++ b/pkgs/development/python-modules/sklearn2pmml/default.nix
@@ -66,7 +66,7 @@ buildPythonPackage (finalAttrs: {
     statsmodels
   ];
 
-  pytestFlagsArray = [
+  enabledTestPaths = [
     # Only run the main test suite; subpackage tests require
     # sklearn-pandas which is not available in nixpkgs
     "sklearn2pmml/tests"
diff --git a/pkgs/development/python-modules/tree-sitter-language-pack/default.nix b/pkgs/development/python-modules/tree-sitter-language-pack/default.nix
index 090b6215651d..20e3c8d6f426 100644
--- a/pkgs/development/python-modules/tree-sitter-language-pack/default.nix
+++ b/pkgs/development/python-modules/tree-sitter-language-pack/default.nix
@@ -127,7 +127,7 @@ buildPythonPackage (finalAttrs: {
     EOF
   '';
 
-  pytestFlagsArray = [
+  enabledTestPaths = [
     "e2e/python/tests"
     "tests/test_apps/python/smoke_test.py"
   ];
diff --git a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
index 1a9eeb4a3a40..814c7cf79b50 100644
--- a/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
+++ b/pkgs/development/tools/parsing/tree-sitter/grammars/grammar-sources.nix
@@ -2246,10 +2246,10 @@
   };
 
   rescript = {
-    version = "5.0.0-unstable-2025-03-03";
+    version = "6.0.0-unstable-2026-04-26";
     url = "github:rescript-lang/tree-sitter-rescript";
-    rev = "d2df8a285fff95de56a91d2f8152aeceb66f40ef";
-    hash = "sha256-yNZrihl4BNvLu0Zqr4lSqvdZCeXU3KnCY7ZYC1U42R0=";
+    rev = "5b90cd4e4138b1231a67977303bda47eb608480a";
+    hash = "sha256-f5/z566/Ez8+jzQSXoWkEK3LJGYjWupQw+BFPDyOxsE=";
     meta = {
       license = lib.licenses.mit;
       maintainers = with lib.maintainers; [
diff --git a/pkgs/tools/package-management/lix/default.nix b/pkgs/tools/package-management/lix/default.nix
index 9ef54924323f..aa635e3e943a 100644
--- a/pkgs/tools/package-management/lix/default.nix
+++ b/pkgs/tools/package-management/lix/default.nix
@@ -24,6 +24,7 @@
   nix-fast-build,
   haskell,
   nix-serve-ng,
+  nixos-rebuild-ng,
   colmena,
   nix-update,
   nix-init,
@@ -148,6 +149,10 @@ let
             }))
           ];
 
+          nixos-rebuild-ng = nixos-rebuild-ng.override {
+            nix = self.lix;
+          };
+
           colmena = colmena.override {
             nix = self.lix;
             inherit (self) nix-eval-jobs;
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 976879de7631..11c1707ba984 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1128,6 +1128,7 @@ mapAliases {
   libtorrent = throw "'libtorrent' has been renamed to 'libtorrent-rakshasa' for clearer distinction from 'libtorrent-rasterbar'"; # Added 2025-09-10
   libtransmission = throw "libtransmission_3 has been removed in favour of libtransmission_4. Note that upgrade caused data loss for some users so backup is recommended (see NixOS 24.11 release notes for details)"; # Converted to throw 2025-10-26
   libtransmission_3 = throw "libtransmission_3 has been removed in favour of libtransmission_4. Note that upgrade caused data loss for some users so backup is recommended (see NixOS 24.11 release notes for details)"; # Converted to throw 2025-10-26
+  libubox-wolfssl = throw "'libubox-wolfssl' has been removed, use 'libubox' or 'libubox-mbedtls'"; # Added 2026-03-29
   libuinputplus = throw "'libuinputplus' has been removed, as it was unmaintained upstream since 2021, no longer builds, and is no longer used by anything"; # Added 2025-11-02
   libviper = throw "'libviper' was removed as it is broken and not maintained upstream"; # Added 2025-05-17
   libWindowsWM = libwindowswm; # Added 2026-01-19
@@ -2077,6 +2078,7 @@ mapAliases {
   unixODBCDrivers = warnAlias "'unixODBCDrivers' has been renamed to 'unixodbcDrivers'" unixodbcDrivers; # Added 2026-02-12
   unrar_6 = throw "'unrar_6' has been renamed to/replaced by 'unrar'"; # Added 2026-03-11
   unzoo = throw "'unzoo' has been removed since it is unmaintained upstream and doesn't compile with newer versions of GCC anymore"; # Removed 2025-05-24
+  ustream-ssl-wolfssl = throw "'ustream-ssl-wolfssl' has been removed, use 'ustream-ssl' or 'ustream-ssl-mbedtls'"; # Added 2026-03-29
   usync = throw "'usync' has been removed as it is unused and unmaintained upstream"; # Added 2025-12-18
   util-linuxCurses = throw "'util-linuxCurses' has been renamed to/replaced by 'util-linux'"; # Converted to throw 2025-10-27
   utillinux = warnAlias "'utillinux' has been renamed to/replaced by 'util-linux'" util-linux; # Converted to warning 2025-10-28
@@ -2158,6 +2160,7 @@ mapAliases {
   wlroots_0_17 = throw "'wlroots_0_17' has been removed in favor of newer versions"; # Added 2026-03-07
   wlx-overlay-s = throw "'wlx-overlay-s' and 'wayvr-dashboard' have been merged into a single application. Please switch to 'wayvr'"; # Added 2026-01-09
   wmii_hg = throw "'wmii_hg' has been renamed to/replaced by 'wmii'"; # Converted to throw 2025-10-27
+  wolfssl = throw "'wolfssl' has been removed because it has an unclear licensing situation and no remaining users in Nixpkgs"; # Added 2026-04-03
   woof = throw "'woof' has been removed as it is broken and unmaintained upstream"; # Added 2025-09-04
   worldengine-cli = throw "'worldengine-cli' has been removed because it has been marked as broken since at least November 2024."; # Added 2025-10-04
   wpa_supplicant_ro_ssids = throw "'wpa_supplicant_ro_ssids' has been renamed to/replaced by 'wpa_supplicant'"; # Converted to throw 2025-10-27
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 4459a938526d..f1f74c09074e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6119,11 +6119,6 @@ with pkgs;
 
   ustream-ssl = callPackage ../development/libraries/ustream-ssl { ssl_implementation = openssl; };
 
-  ustream-ssl-wolfssl = callPackage ../development/libraries/ustream-ssl {
-    ssl_implementation = wolfssl;
-    additional_buildInputs = [ openssl ];
-  };
-
   ustream-ssl-mbedtls = callPackage ../development/libraries/ustream-ssl {
     ssl_implementation = mbedtls_2;
   };
@@ -6737,11 +6732,6 @@ with pkgs;
 
   libubox = callPackage ../development/libraries/libubox { with_ustream_ssl = true; };
 
-  libubox-wolfssl = callPackage ../development/libraries/libubox {
-    with_ustream_ssl = true;
-    ustream-ssl = ustream-ssl-wolfssl;
-  };
-
   libubox-mbedtls = callPackage ../development/libraries/libubox {
     with_ustream_ssl = true;
     ustream-ssl = ustream-ssl-mbedtls;
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index f3c9d96815be..9c61ca27f5e5 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -17466,6 +17466,8 @@ self: super: with self; {
 
   seatconnect = callPackage ../development/python-modules/seatconnect { };
 
+  sebaubuntu-libs = callPackage ../development/python-modules/sebaubuntu-libs { };
+
   seccomp = callPackage ../development/python-modules/seccomp { };
 
   secp256k1 = callPackage ../development/python-modules/secp256k1 { inherit (pkgs) secp256k1; };