diff --git a/pkgs/applications/editors/vscode/extensions/kilocode.kilo-code/default.nix b/pkgs/applications/editors/vscode/extensions/kilocode.kilo-code/default.nix
index 10f8f49aa1a9..91c93f589e79 100644
--- a/pkgs/applications/editors/vscode/extensions/kilocode.kilo-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/kilocode.kilo-code/default.nix
@@ -2,15 +2,43 @@
   lib,
   vscode-utils,
   vscode-extension-update-script,
+  autoPatchelfHook,
+  stdenv,
 }:
 
 vscode-utils.buildVscodeMarketplaceExtension {
-  mktplcRef = {
-    publisher = "kilocode";
-    name = "Kilo-Code";
-    version = "7.0.51";
-    hash = "sha256-1NzwFTFM1gkTcrAVbP6wNctePMAGdy2T9UDn24xhixM=";
-  };
+  mktplcRef =
+    let
+      sources = {
+        "x86_64-linux" = {
+          arch = "linux-x64";
+          hash = "sha256-tG2PUESSzOs5jEPD7Wgtee832pOTOLkxxV/FP7Md6k8=";
+        };
+        "x86_64-darwin" = {
+          arch = "darwin-x64";
+          hash = "sha256-CqgMcb03eA+orz0rmKoSi5qtQXAN/MzrmogGQGV2yzw=";
+        };
+        "aarch64-linux" = {
+          arch = "linux-arm64";
+          hash = "sha256-kDv8t9COz8sWRH9FlrhrDC9UqGBXD7F0IMaWCbZYwBk=";
+        };
+        "aarch64-darwin" = {
+          arch = "darwin-arm64";
+          hash = "sha256-S27qkOYs3arqa68raX+0itOywnlQZAIjxD93GCEjKhs=";
+        };
+      };
+    in
+    {
+      publisher = "kilocode";
+      name = "Kilo-Code";
+      version = "7.0.51";
+    }
+    // sources.${stdenv.hostPlatform.system}
+      or (throw "Unsupported system ${stdenv.hostPlatform.system}");
+
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
+
+  buildInputs = [ stdenv.cc.cc.lib ];
 
   passthru.updateScript = vscode-extension-update-script { };
 
@@ -20,6 +48,12 @@ vscode-utils.buildVscodeMarketplaceExtension {
     downloadPage = "https://marketplace.visualstudio.com/items?itemName=kilocode.Kilo-Code";
     license = lib.licenses.mit;
     sourceProvenance = with lib.sourceTypes; [ fromSource ];
+    platforms = [
+      "aarch64-linux"
+      "aarch64-darwin"
+      "x86_64-linux"
+      "x86_64-darwin"
+    ];
     maintainers = with lib.maintainers; [ xiaoxiangmoe ];
   };
 }
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index fce9c12f2ab9..20d39d296d2c 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,10 +1,10 @@
 {
   "chromium": {
-    "version": "146.0.7680.153",
+    "version": "146.0.7680.164",
     "chromedriver": {
-      "version": "146.0.7680.154",
-      "hash_darwin": "sha256-jSAe8mkJ0mDqKJyzsaAuGwyG5lwdOHkYDUgxR2G+vJE=",
-      "hash_darwin_aarch64": "sha256-tCMADPY/Q2sjyHUvZPO9o+ZkLaZ7iTCLrTiPVUYVQr0="
+      "version": "146.0.7680.165",
+      "hash_darwin": "sha256-qqzgaahlWqaIN2bYxzCQREUrBEpyE4HSG5QT29xJ26E=",
+      "hash_darwin_aarch64": "sha256-XAEirnBWR5/v/uk5pDTKMcnfPZVBrsfSqckGSmbpTMs="
     },
     "deps": {
       "depot_tools": {
@@ -21,8 +21,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "85fd829a1b2049479ead5ed578f5ed105a094fe4",
-        "hash": "sha256-PshNuKAZBXohix711YGjE4X24ixVW29wxgeePNE9Xzs=",
+        "rev": "bbd8c5dd25fb2f569d98e626a9517cf2171abdff",
+        "hash": "sha256-hwZehtGUyuMdHisIaztsYlu0MEftbmmAqN/X+ias4nI=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -132,8 +132,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "3d52cfc8dd0bc2cdbbecd9803cc08102de7e4597",
-        "hash": "sha256-lyAG9tKBWQ2yy/morStUd0ZKDPT58t8516NDCQG/jZs="
+        "rev": "a655251a59c4af3fbf8058bb2572d6a457f896d2",
+        "hash": "sha256-UKoDytne6QD2d6ojy4mYPjLbo9GB4xy1fUf9C1pLKaE="
       },
       "src/third_party/dawn/third_party/glfw": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -332,8 +332,8 @@
       },
       "src/third_party/harfbuzz-ng/src": {
         "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git",
-        "rev": "fa2908bf16d2ccd6623f4d575455fea72a1a722b",
-        "hash": "sha256-pXAQYEotsqZmfaJSQFaJmZAQVzUiNrHw52z0vmbxQRQ="
+        "rev": "c24f6a29e5912332e269891fbdb1ac771d543a08",
+        "hash": "sha256-2utl+HNeomIpdqS3hsYZveFfZ+ksMGRvgCaH3WVvsFw="
       },
       "src/third_party/ink/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ink.git",
@@ -652,8 +652,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "3c7c530c115124b415c1f4e0e35694fbaefd2177",
-        "hash": "sha256-ObLypxiOKH/YoLw6uUA4MmHM44vA8iPhNCEfFcwip0Q="
+        "rev": "6a75afe9792764f6faa76ad50125781899ca05e8",
+        "hash": "sha256-S4AAmNw50ToTZIuHl41Pc+Z1MZfUVf0/ZGGIiEr5cXo="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -817,8 +817,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "abb5d7b829d60a5dae46fbcee0e9d0d554d3a946",
-        "hash": "sha256-hnwiRarq+69BECxJ9FQD0XGqqA/OF66RxZUPWTzDaFE="
+        "rev": "0e999a528db40a3ef6fa917adf96370a18b87d70",
+        "hash": "sha256-rkSuZBdFUHJyYmqp2oN3mLjNtKjk569MocyvnICo+uw="
       }
     }
   },
diff --git a/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix b/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix
index eb10f1dc59c2..a673b4410db6 100644
--- a/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix
+++ b/pkgs/applications/networking/cluster/helm/plugins/helm-diff.nix
@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "helm-diff";
-  version = "3.15.2";
+  version = "3.15.3";
 
   src = fetchFromGitHub {
     owner = "databus23";
     repo = "helm-diff";
     rev = "v${version}";
-    hash = "sha256-gcIwg/EZ8A3RKSPuk3Ot6hPDS0m65V/IVqUs3VPbrSQ=";
+    hash = "sha256-kr6WcWd5dFJUl2loW7dl1fDpngbw0zWCMREU7DYFYOk=";
   };
 
-  vendorHash = "sha256-7Qw5ggvyhffmVZH7jKF21y+m1KTroucQ/ZGP67D+EjY=";
+  vendorHash = "sha256-cpDyDmPpoJptTjUMdo3SYhibRmOrlWtgaNr95tnvMIE=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/build-support/rust/build-rust-crate/configure-crate.nix b/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
index be4bbbe06dc9..060ce25df8db 100644
--- a/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
+++ b/pkgs/build-support/rust/build-rust-crate/configure-crate.nix
@@ -49,7 +49,7 @@ let
   completeDepsDir = lib.concatStringsSep " " completeDeps;
   completeBuildDepsDir = lib.concatStringsSep " " completeBuildDeps;
   envFeatures = lib.concatStringsSep " " (
-    map (f: lib.replaceStrings [ "-" ] [ "_" ] (lib.toUpper f)) crateFeatures
+    map (f: "CARGO_FEATURE_${lib.replaceStrings [ "-" ] [ "_" ] (lib.toUpper f)}=1") crateFeatures
   );
 in
 ''
@@ -206,11 +206,10 @@ in
      (
        # Features should be set as environment variable for build scripts:
        # https://doc.rust-lang.org/cargo/reference/environment-variables.html#environment-variables-cargo-sets-for-build-scripts
-       for feature in ${envFeatures}; do
-         export CARGO_FEATURE_$feature=1
-       done
-
-       target/build/${crateName}/build_script_build | tee target/build/${crateName}.opt
+       #
+       # We use `env` instead of `export` because it's possible for a Cargo feature name to contain a character that Bash does
+       # not support for variables.
+       env ${envFeatures} target/build/${crateName}/build_script_build | tee target/build/${crateName}.opt
      )
 
      set +e
diff --git a/pkgs/build-support/rust/build-rust-crate/lib.sh b/pkgs/build-support/rust/build-rust-crate/lib.sh
index 5fa9b2f21154..09731f29f0c3 100644
--- a/pkgs/build-support/rust/build-rust-crate/lib.sh
+++ b/pkgs/build-support/rust/build-rust-crate/lib.sh
@@ -87,6 +87,12 @@ build_bin_test_file() {
     # above.
     derived_crate_name=${derived_crate_name#"tests_"}
     derived_crate_name="${derived_crate_name%.rs}"
+    # Cargo names tests/<dir>/main.rs as <dir>, not <dir>_main — strip the
+    # trailing _main that the `/`→`_` substitution produced. Guarded so
+    # a flat-style tests/<name>_main.rs keeps its _main suffix.
+    if [[ "$file" == */main.rs ]]; then
+        derived_crate_name="${derived_crate_name%_main}"
+    fi
     build_bin_test "$derived_crate_name" "$file"
 }
 
diff --git a/pkgs/build-support/rust/build-rust-crate/test/default.nix b/pkgs/build-support/rust/build-rust-crate/test/default.nix
index d5c56858c6a4..854aec414466 100644
--- a/pkgs/build-support/rust/build-rust-crate/test/default.nix
+++ b/pkgs/build-support/rust/build-rust-crate/test/default.nix
@@ -91,9 +91,15 @@ let
   mkTest =
     crateArgs:
     let
-      crate = mkHostCrate (removeAttrs crateArgs [ "expectedTestOutput" ]);
+      crate = mkHostCrate (
+        removeAttrs crateArgs [
+          "expectedTestOutputs"
+          "expectedTestBinaries"
+        ]
+      );
       hasTests = crateArgs.buildTests or false;
       expectedTestOutputs = crateArgs.expectedTestOutputs or null;
+      expectedTestBinaries = crateArgs.expectedTestBinaries or [ ];
       binaries = map (v: lib.escapeShellArg v.name) (crateArgs.crateBin or [ ]);
       isLib = crateArgs ? libName || crateArgs ? libPath;
       crateName = crateArgs.crateName or "nixtestcrate";
@@ -134,6 +140,10 @@ let
           ''
         else if stdenv.hostPlatform == stdenv.buildPlatform then
           ''
+            ${lib.concatMapStringsSep "\n" (
+              b:
+              "test -x ${crate}/tests/${lib.escapeShellArg b} || { echo 'expected test binary \"${b}\" not found in:'; ls ${crate}/tests; exit 23; }"
+            ) expectedTestBinaries}
             for file in ${crate}/tests/*; do
               $file 2>&1 >> $out
             done
@@ -419,12 +429,34 @@ rec {
             ];
           };
           buildTests = true;
+          # Cargo names tests/<dir>/main.rs as <dir>, not <dir>_main.
+          expectedTestBinaries = [
+            "foo"
+            "bar"
+          ];
           expectedTestOutputs = [
             "test src_main ... ok"
             "test tests_foo ... ok"
             "test tests_bar ... ok"
           ];
         };
+        rustBinTestsFlatMainSuffix = {
+          # A flat-style test whose name happens to end in _main must keep
+          # its suffix — only tests/<dir>/main.rs gets the _main stripped.
+          src = symlinkJoin {
+            name = "rust-bin-tests-flat-main-suffix";
+            paths = [
+              (mkTestFileWithMain "src/main.rs" "src_main")
+              (mkTestFile "tests/foo_main.rs" "flat_test")
+            ];
+          };
+          buildTests = true;
+          expectedTestBinaries = [ "foo_main" ];
+          expectedTestOutputs = [
+            "test src_main ... ok"
+            "test flat_test ... ok"
+          ];
+        };
         linkAgainstRlibCrate = {
           crateName = "foo";
           src = mkFile "src/main.rs" ''
@@ -477,6 +509,7 @@ rec {
           crateName = "build-script-feature-env";
           features = [
             "some-feature"
+            "some-c++17-thing"
             "crate/another_feature"
           ];
           src = symlinkJoin {
@@ -488,6 +521,10 @@ rec {
                 fn feature_not_visible() {
                   assert!(std::env::var("CARGO_FEATURE_SOME_FEATURE").is_err());
                   assert!(option_env!("CARGO_FEATURE_SOME_FEATURE").is_none());
+                  assert!(std::env::var("CARGO_FEATURE_SOME_C++17_THING").is_err());
+                  assert!(option_env!("CARGO_FEATURE_SOME_C++17_THING").is_none());
+                  assert!(std::env::var("CARGO_FEATURE_ANOTHER_FEATURE").is_err());
+                  assert!(option_env!("CARGO_FEATURE_ANOTHER_FEATURE").is_none());
                 }
                 fn main() {}
               '')
@@ -495,6 +532,10 @@ rec {
                 fn main() {
                   assert!(std::env::var("CARGO_FEATURE_SOME_FEATURE").is_ok());
                   assert!(option_env!("CARGO_FEATURE_SOME_FEATURE").is_none());
+                  assert!(std::env::var("CARGO_FEATURE_SOME_C++17_THING").is_ok());
+                  assert!(option_env!("CARGO_FEATURE_SOME_C++17_THING").is_none());
+                  assert!(std::env::var("CARGO_FEATURE_ANOTHER_FEATURE").is_err());
+                  assert!(option_env!("CARGO_FEATURE_ANOTHER_FEATURE").is_none());
                 }
               '')
             ];
diff --git a/pkgs/by-name/am/amazon-cloudwatch-agent/package.nix b/pkgs/by-name/am/amazon-cloudwatch-agent/package.nix
index ec7bfdb2e59d..73e5454e0dab 100644
--- a/pkgs/by-name/am/amazon-cloudwatch-agent/package.nix
+++ b/pkgs/by-name/am/amazon-cloudwatch-agent/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "amazon-cloudwatch-agent";
-  version = "1.300064.0";
+  version = "1.300065.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "amazon-cloudwatch-agent";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-998kXLAwhSepDOrKGXRrOfrw9SU8tfxtYmPQNUQWhlI=";
+    hash = "sha256-iAM8x3NXLQ20QJFB6Og4YKimUB7r+doTVnq/b9Q7alc=";
   };
 
   vendorHash = "sha256-i5Lhz36ZAfZW2Y3s31TcBx1uWuMKmtROBhmHf2GiGyo=";
diff --git a/pkgs/by-name/an/ananicy-rules-cachyos/package.nix b/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
index 5a3de343b1f7..e9a839161a51 100644
--- a/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
+++ b/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "ananicy-rules-cachyos";
-  version = "0-unstable-2026-03-05";
+  version = "0-unstable-2026-03-21";
 
   src = fetchFromGitHub {
     owner = "CachyOS";
     repo = "ananicy-rules";
-    rev = "c85891564f1c600042cefc38a20b3aa448786e7d";
-    hash = "sha256-0GEZroVztjSDIhLuW4XX8IQ+QwzENOkk44w8Dm5zw/o=";
+    rev = "a0305dc2070306a1af52aad9b03096a51f4147e8";
+    hash = "sha256-WAbJATvx5dWfpB0PYVVlRCVEygDzUU+qeOmhzRKA8GY=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/ap/apparmor-profiles/test_config.nix b/pkgs/by-name/ap/apparmor-profiles/test_config.nix
index 3aa3d2ee2b32..9d89e1e8572f 100644
--- a/pkgs/by-name/ap/apparmor-profiles/test_config.nix
+++ b/pkgs/by-name/ap/apparmor-profiles/test_config.nix
@@ -36,11 +36,11 @@
         ${bashInteractive}/bin/sh = icnu
         ${bashInteractive}/bin/bash = icnu
     '';
-    passAsFile = [ "header" ];
+    __structuredAttrs = true;
   }
   ''
     mkdir $out
-    cp $headerPath $out/logprof.conf
+    printf "%s" "$header" > $out/logprof.conf
     ln -s ${libapparmor.src}/utils/severity.db $out/severity.db
     sed '1,/\[qualifiers\]/d' ${libapparmor.src}/utils/logprof.conf >> $out/logprof.conf
   ''
diff --git a/pkgs/by-name/at/atuin-desktop/0001-fix-Remove-duplicate-dependency-entry-for-tauri-build.patch b/pkgs/by-name/at/atuin-desktop/0001-fix-Remove-duplicate-dependency-entry-for-tauri-build.patch
deleted file mode 100644
index 2206de17ef9e..000000000000
--- a/pkgs/by-name/at/atuin-desktop/0001-fix-Remove-duplicate-dependency-entry-for-tauri-build.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-From 7534c427f720ce2134a4fba7b7c3f8cddadf9069 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?David=20Chocholat=C3=BD?= <chocholaty.david@protonmail.com>
-Date: Sat, 31 Jan 2026 11:04:04 +0100
-Subject: [PATCH] fix: Remove duplicate dependency entry for tauri-build
-
----
- Cargo.lock | 23 -----------------------
- 1 file changed, 23 deletions(-)
-
-diff --git a/Cargo.lock b/Cargo.lock
-index 80a7920f..92a7bef6 100644
---- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -590,7 +590,6 @@ dependencies = [
-  "sqlx",
-  "syntect",
-  "tauri",
-- "tauri-build 2.5.3 (registry+https://github.com/rust-lang/crates.io-index)",
-  "tauri-plugin-deep-link",
-  "tauri-plugin-dialog",
-  "tauri-plugin-fs",
-@@ -8932,28 +8931,6 @@ dependencies = [
-  "windows 0.61.1",
- ]
- 
--[[package]]
--name = "tauri-build"
--version = "2.5.3"
--source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "17fcb8819fd16463512a12f531d44826ce566f486d7ccd211c9c8cebdaec4e08"
--dependencies = [
-- "anyhow",
-- "cargo_toml",
-- "dirs 6.0.0",
-- "glob",
-- "heck 0.5.0",
-- "json-patch",
-- "schemars",
-- "semver",
-- "serde",
-- "serde_json",
-- "tauri-utils",
-- "tauri-winres",
-- "toml 0.9.8",
-- "walkdir",
--]
--
- [[package]]
- name = "tauri-build"
- version = "2.5.3"
--- 
-2.51.2
-
diff --git a/pkgs/by-name/at/atuin-desktop/package.nix b/pkgs/by-name/at/atuin-desktop/package.nix
index 411a27bbd67f..254e156b8884 100644
--- a/pkgs/by-name/at/atuin-desktop/package.nix
+++ b/pkgs/by-name/at/atuin-desktop/package.nix
@@ -31,20 +31,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoRoot = "./.";
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs)
-      # TMP: Include patches from root to ensure Cargo.lock consistency between root and deps.
-      patches
-      src
-      ;
-    hash = "sha256-eOFMUxXPQrhBthuQLgBsixe1vsniGUnoHb2EOhZQ/iY=";
+    inherit (finalAttrs) src;
+    hash = "sha256-68yQkgIVpqUo5tOcvxKh6NOkW565V94zHIZeI4q7nNA=";
   };
 
-  patches = [
-    # TMP: Until a duplicate entry for `tauri-build` dependency in `Cargo.lock` is resolved
-    #  (https://github.com/atuinsh/desktop/issues/364), remove one of the duplicated entries.
-    ./0001-fix-Remove-duplicate-dependency-entry-for-tauri-build.patch
-  ];
-
   node_modules = stdenv.mkDerivation {
     inherit (finalAttrs) src version;
     pname = "${finalAttrs.pname}-node_modules";
@@ -139,7 +129,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
     cp -R ${finalAttrs.node_modules} node_modules/
 
-    # Bun takes executables from this folder
+    # Bun takes executables from this folder.
     chmod -R u+rw node_modules
     chmod -R u+x node_modules/.bin
 
diff --git a/pkgs/by-name/aw/awsebcli/package.nix b/pkgs/by-name/aw/awsebcli/package.nix
index c1a5589f4571..ce900c3de6df 100644
--- a/pkgs/by-name/aw/awsebcli/package.nix
+++ b/pkgs/by-name/aw/awsebcli/package.nix
@@ -17,6 +17,7 @@ let
           inherit pname version;
           hash = "sha256-NC4n21SmYW3RiS7QuzWXoifO4z3C2FVgQm3xf8qQcFg=";
         };
+        patches = [ ];
         build-system = old.build-system or [ ] ++ (with python.pkgs; [ setuptools ]);
         doCheck = false;
       });
diff --git a/pkgs/by-name/b4/b4/package.nix b/pkgs/by-name/b4/b4/package.nix
index dde91f5245b4..dbad85ab21a3 100644
--- a/pkgs/by-name/b4/b4/package.nix
+++ b/pkgs/by-name/b4/b4/package.nix
@@ -7,12 +7,12 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "b4";
-  version = "0.14.3";
+  version = "0.15.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-MaSSe437tcl+38lWnNo7Zze7/YQwiB6MxIoLCIztYUc=";
+    hash = "sha256-TP2Zonr5yr4xn+Ibogr2lfaMZZBMY3McT8WjDqONp8g=";
   };
 
   # tests make dns requests and fails
diff --git a/pkgs/by-name/co/cook-cli/package.nix b/pkgs/by-name/co/cook-cli/package.nix
index 86b2f070ee2c..3a737c7be448 100644
--- a/pkgs/by-name/co/cook-cli/package.nix
+++ b/pkgs/by-name/co/cook-cli/package.nix
@@ -10,16 +10,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cook-cli";
-  version = "0.26.0";
+  version = "0.27.0";
 
   src = fetchFromGitHub {
     owner = "cooklang";
     repo = "cookcli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-UIhecZu2iHOwuHSwoWpMKQ1LrEH5ryZZTZV5hMp+UHo=";
+    hash = "sha256-lU+EgMPG7NfhI3DSfwwy39fz7lPmT3QsICZOHzUOYyU=";
   };
 
-  cargoHash = "sha256-UcrrFYst6E31bgjknRBugBWBm/4w96u8Yl0UPCyfRX8=";
+  cargoHash = "sha256-9oi0jNknMhXpyIbRurkEpn5R3SA4r12JskGEifDVvTA=";
 
   # Build without the self-updating feature
   buildNoDefaultFeatures = true;
diff --git a/pkgs/by-name/fa/factoriolab/package.nix b/pkgs/by-name/fa/factoriolab/package.nix
index 8d8bb29ef2b2..050187ea3622 100644
--- a/pkgs/by-name/fa/factoriolab/package.nix
+++ b/pkgs/by-name/fa/factoriolab/package.nix
@@ -10,13 +10,13 @@
 }:
 buildNpmPackage rec {
   pname = "factoriolab";
-  version = "3.18.1";
+  version = "3.18.2";
 
   src = fetchFromGitHub {
     owner = "factoriolab";
     repo = "factoriolab";
     tag = "v${version}";
-    hash = "sha256-PmP6nb74FhNIBoEZoM+xbe5oTG/juWkuvWnk5Zr2WZ4=";
+    hash = "sha256-M7u9pqr7OGHgNMly1am11R6EcV6LKyPw2JzIAbzt6Wo=";
     fetchLFS = true;
   };
   buildInputs = [ vips ];
diff --git a/pkgs/by-name/fl/flexget/package.nix b/pkgs/by-name/fl/flexget/package.nix
index 9e177c70047f..c42d3ee05694 100644
--- a/pkgs/by-name/fl/flexget/package.nix
+++ b/pkgs/by-name/fl/flexget/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "flexget";
-  version = "3.19.2";
+  version = "3.19.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Flexget";
     repo = "Flexget";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hQNn3q5D1eBsQ7/HzeMv5G/ChL3wdjV3zD+tYirB0zE=";
+    hash = "sha256-wLwP/4h0GXNZ+MOu0DgLgFViynaXjBR9VDtP0c8jk20=";
   };
 
   pythonRelaxDeps = true;
diff --git a/pkgs/by-name/fo/forgejo-runner/package.nix b/pkgs/by-name/fo/forgejo-runner/package.nix
index 209eb9becfd3..8254cb9694d9 100644
--- a/pkgs/by-name/fo/forgejo-runner/package.nix
+++ b/pkgs/by-name/fo/forgejo-runner/package.nix
@@ -49,17 +49,17 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "forgejo-runner";
-  version = "12.7.2";
+  version = "12.7.3";
 
   src = fetchFromGitea {
     domain = "code.forgejo.org";
     owner = "forgejo";
     repo = "runner";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ySqvSh2ZdFVCQfKJbz5h2eRYj8BzFEFXoY6peXOzsIE=";
+    hash = "sha256-HVkyn2MYGAFv0eTDnjs9qB1Kd2v98+hQkNNVFs7KrWs=";
   };
 
-  vendorHash = "sha256-lMBRu7RxF4btWBn4NzlnaTAaEC6txx8iQTJxkzQKQh0=";
+  vendorHash = "sha256-8L3bJtV3kgxRILV7mIY3r77VQuaPn7whwMNWwq5NGN4=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/by-name/fo/fosrl-olm/package.nix b/pkgs/by-name/fo/fosrl-olm/package.nix
index 2e7e8467ed27..78a5ae9970c3 100644
--- a/pkgs/by-name/fo/fosrl-olm/package.nix
+++ b/pkgs/by-name/fo/fosrl-olm/package.nix
@@ -12,7 +12,7 @@ buildGoModule (finalAttrs: {
     owner = "fosrl";
     repo = "olm";
     tag = finalAttrs.version;
-    hash = "sha256-4dzbSW9AoFitypVOD/N4/mnUJwh0USgOwVqcopLkcYs=";
+    hash = "sha256-2FqtucYOfnyOcsEivhZFh18gofcqCGOMhPrr2V91OAM=";
   };
 
   vendorHash = "sha256-D93SPwXAeoTLCbScjyH8AB9TJIF2b/UbLNMIQYi+B+c=";
diff --git a/pkgs/by-name/go/google-cloud-sdk/package.nix b/pkgs/by-name/go/google-cloud-sdk/package.nix
index 4700d958d68d..405206d24cb4 100644
--- a/pkgs/by-name/go/google-cloud-sdk/package.nix
+++ b/pkgs/by-name/go/google-cloud-sdk/package.nix
@@ -88,9 +88,6 @@ stdenv.mkDerivation rec {
     ./gsutil-disable-updates.patch
   ];
 
-  # Prevent Python from writing bytecode to ensure build determinism
-  env.PYTHONDONTWRITEBYTECODE = "1";
-
   installPhase = ''
     runHook preInstall
 
@@ -117,7 +114,7 @@ stdenv.mkDerivation rec {
         binaryPath="$out/bin/$program"
         wrapProgram "$programPath" \
             --set CLOUDSDK_PYTHON "${pythonEnv}/bin/python" \
-            --set CLOUDSDK_PYTHON_ARGS "-S -W ignore" \
+            --set CLOUDSDK_PYTHON_ARGS "-S -B -W ignore" \
             --prefix PYTHONPATH : "${pythonEnv}/${python3.sitePackages}" \
             --prefix PATH : "${openssl.bin}/bin"
 
@@ -168,6 +165,36 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
+  postInstall = ''
+    # create cached byte-code at build time, see https://docs.python.org/3/library/compileall.html
+    # the excluded files contain python 2 syntax that fails to compile with python 3
+    find $out/google-cloud-sdk -name "*.py" \
+      -not -path "*/lib/third_party/yaml/scanner.py" \
+      -not -path "*/lib/third_party/yaml/error.py" \
+      -not -path "*/lib/third_party/yaml/constructor.py" \
+      -not -path "*/lib/third_party/yaml/parser.py" \
+      -not -path "*/lib/third_party/yaml/reader.py" \
+      -not -path "*/lib/third_party/yaml/loader.py" \
+      -not -path "*/lib/third_party/yaml/resolver.py" \
+      -not -path "*/yaml/lib2/scanner.py" \
+      -not -path "*/yaml/lib2/constructor.py" \
+      -not -path "*/yaml/lib2/reader.py" \
+      -not -path "*/yaml/lib2/resolver.py" \
+      -not -path "*/gcloud_crcmod/python2/crcmod.py" \
+      -not -path "*/gcloud_crcmod/python2/_crcfunpy.py" \
+      -not -path "*/concurrent/python2/concurrent/futures/_base.py" \
+      -not -path "*/third_party/gflags/__init__.py" \
+      -not -path "*/third_party/gflags/setup.py" \
+      -not -path "*/third_party/gflags/gflags2man.py" \
+      -not -path "*/third_party/apitools/setup.py" \
+      -not -path "*/third_party/apitools/ez_setup.py" \
+      -not -path "*/lib/third_party/pytz/lazy.py" \
+      -not -path "*/lib/third_party/fancy_urllib/__init__.py" \
+      -not -path "*/oauth2client/_pkce.py" \
+      -not -path "*/ext-runtime/nodejs/test/runtime_test.py" \
+      -exec ${pythonEnv}/bin/python -OO -m compileall {} +
+  '';
+
   doInstallCheck = true;
   installCheckPhase = ''
     # Avoid trying to write logs to homeless-shelter
diff --git a/pkgs/by-name/hy/hyprlock/package.nix b/pkgs/by-name/hy/hyprlock/package.nix
index f7657d82c3dd..7c76ebd828d6 100644
--- a/pkgs/by-name/hy/hyprlock/package.nix
+++ b/pkgs/by-name/hy/hyprlock/package.nix
@@ -28,13 +28,13 @@
 
 gcc15Stdenv.mkDerivation (finalAttrs: {
   pname = "hyprlock";
-  version = "0.9.2";
+  version = "0.9.3";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprlock";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ucJ5C83hJy8XFO8Y+PL9hVcwdrQnj63BjXcO5A4qyNU=";
+    hash = "sha256-qxR0w0wC6Bv96C/Kzx3mL1bUS8ejwhIm7eVVR9AA88c=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/la/lasuite-meet-frontend/package.nix b/pkgs/by-name/la/lasuite-meet-frontend/package.nix
index f6a1d8c581be..11b12b988244 100644
--- a/pkgs/by-name/la/lasuite-meet-frontend/package.nix
+++ b/pkgs/by-name/la/lasuite-meet-frontend/package.nix
@@ -7,13 +7,13 @@
 
 buildNpmPackage rec {
   pname = "lasuite-meet-frontend";
-  version = "1.10.0";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "meet";
     tag = "v${version}";
-    hash = "sha256-RmMFN1hDSU6q0ZROopsIDJ2nbmvdwW29YywX7rAbgP4=";
+    hash = "sha256-CvpGDfdK1+EJ+Tj9NLrfRfK4VpJVcDqezVJL6ZVdOQ8=";
   };
 
   sourceRoot = "source/src/frontend";
@@ -21,7 +21,7 @@ buildNpmPackage rec {
   npmDeps = fetchNpmDeps {
     inherit version src;
     sourceRoot = "source/src/frontend";
-    hash = "sha256-W7X5nDtQYxzFZAhei+EXx+j6THTDwz4gTR/wxfB+GI4=";
+    hash = "sha256-/JvAnfqaWHc91T5NhqEJGcqLMbSJmnGmReGjrqc+Chw=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/la/lasuite-meet/gh1199.patch b/pkgs/by-name/la/lasuite-meet/gh1199.patch
new file mode 100644
index 000000000000..8545a1f6d108
--- /dev/null
+++ b/pkgs/by-name/la/lasuite-meet/gh1199.patch
@@ -0,0 +1,32 @@
+From cacd75fc0aeba7cf1733193c28c6118e2c249999 Mon Sep 17 00:00:00 2001
+From: Martin Weinelt <hexa@darmstadt.ccc.de>
+Date: Tue, 24 Mar 2026 16:07:00 +0100
+Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B(backend):=20fix=20module=20inclusi?=
+ =?UTF-8?q?on=20with=20uv-build?=
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+After migrating to uv-build only the module matching the project name was
+included in sdist/wheel packages. Without a src layout additional modules
+need to be tracked manually to ship them in built packages.
+---
+ pyproject.toml | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/pyproject.toml b/pyproject.toml
+index 1f7757146..4a04e995d 100644
+--- a/pyproject.toml
++++ b/pyproject.toml
+@@ -90,6 +90,11 @@ dev = [
+ ]
+
+ [tool.uv.build-backend]
++module-name = [
++    "core",
++    "demo",
++    "meet"
++]
+ module-root = ""
+ source-exclude = [
+     "**/tests/**",
diff --git a/pkgs/by-name/la/lasuite-meet/package.nix b/pkgs/by-name/la/lasuite-meet/package.nix
index 3b3831673775..3dc1aa9547ee 100644
--- a/pkgs/by-name/la/lasuite-meet/package.nix
+++ b/pkgs/by-name/la/lasuite-meet/package.nix
@@ -13,14 +13,14 @@ in
 
 python.pkgs.buildPythonApplication rec {
   pname = "lasuite-meet";
-  version = "1.10.0";
+  version = "1.11.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "meet";
     tag = "v${version}";
-    hash = "sha256-RmMFN1hDSU6q0ZROopsIDJ2nbmvdwW29YywX7rAbgP4=";
+    hash = "sha256-CvpGDfdK1+EJ+Tj9NLrfRfK4VpJVcDqezVJL6ZVdOQ8=";
   };
 
   sourceRoot = "source/src/backend";
@@ -28,9 +28,18 @@ python.pkgs.buildPythonApplication rec {
   patches = [
     # Support configuration throught environment variables for SECURE_*
     ./secure_settings.patch
+    # Fix module inclusion after switching to uv-build
+    # https://github.com/suitenumerique/meet/pull/1199
+    ./gh1199.patch
+
   ];
 
-  build-system = with python.pkgs; [ setuptools ];
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "uv_build>=0.10.9,<0.11.0" "uv_build"
+  '';
+
+  build-system = with python.pkgs; [ uv-build ];
 
   dependencies =
     with python.pkgs;
@@ -46,6 +55,7 @@ python.pkgs.buildPythonApplication rec {
       django-cors-headers
       django-countries
       django-extensions
+      django-filter
       django-lasuite
       django-parler
       django-pydantic-field
@@ -70,6 +80,7 @@ python.pkgs.buildPythonApplication rec {
       pyjwt
       pyopenssl
       python-frontmatter
+      python-magic
       redis
       requests
       sentry-sdk
diff --git a/pkgs/by-name/li/libation/package.nix b/pkgs/by-name/li/libation/package.nix
index 40094fee9f77..4fa29b4274f7 100644
--- a/pkgs/by-name/li/libation/package.nix
+++ b/pkgs/by-name/li/libation/package.nix
@@ -16,13 +16,13 @@
 
 buildDotnetModule rec {
   pname = "libation";
-  version = "13.3.0";
+  version = "13.3.2";
 
   src = fetchFromGitHub {
     owner = "rmcrackan";
     repo = "Libation";
     tag = "v${version}";
-    hash = "sha256-sq3P1naACfZjvgNxNwSK+6ljkqVnVRKHvCgO0Dre1dc=";
+    hash = "sha256-IwKpM6BBHTbfdH4Sf3nYR0HDIxU8S5Pz0XxYdVRJcn4=";
   };
 
   sourceRoot = "${src.name}/Source";
diff --git a/pkgs/by-name/li/limine/package.nix b/pkgs/by-name/li/limine/package.nix
index 6ca86582dd98..9043eb2b96a9 100644
--- a/pkgs/by-name/li/limine/package.nix
+++ b/pkgs/by-name/li/limine/package.nix
@@ -47,14 +47,14 @@ in
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation (finalAttrs: {
   pname = "limine";
-  version = "10.8.5";
+  version = "11.0.0";
 
   # We don't use the Git source but the release tarball, as the source has a
   # `./bootstrap` script performing network access to download resources.
   # Packaging that in Nix is very cumbersome.
   src = fetchurl {
     url = "https://codeberg.org/Limine/Limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-+56yc0JYpq/TXxKdrCnASHm5bSkwr5QPSWC+ILMDPs4=";
+    hash = "sha256-wQx35dJV5GXFqKeo6JYzKeCsFlALX5NQJFYIMIW32GI=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/ma/manifold/package.nix b/pkgs/by-name/ma/manifold/package.nix
index 1d6cc8a60677..0650714c07bf 100644
--- a/pkgs/by-name/ma/manifold/package.nix
+++ b/pkgs/by-name/ma/manifold/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "manifold";
-  version = "3.4.0";
+  version = "3.4.1";
 
   src = fetchFromGitHub {
     owner = "elalish";
     repo = "manifold";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9h1MLEcqLpiFg8U5rRkR9Qa+ohzehEDCn5rNsN6swlQ=";
+    hash = "sha256-QcsyX1YwjqNaPAMJy6LtfHxocbBrqVGaRpZ2kxE4xXQ=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/mu/mullvad-browser/package.nix b/pkgs/by-name/mu/mullvad-browser/package.nix
index 70210525296e..ebebb8bed797 100644
--- a/pkgs/by-name/mu/mullvad-browser/package.nix
+++ b/pkgs/by-name/mu/mullvad-browser/package.nix
@@ -97,7 +97,7 @@ let
     ++ lib.optionals mediaSupport [ ffmpeg_7 ]
   );
 
-  version = "15.0.7";
+  version = "15.0.8";
 
   sources = {
     x86_64-linux = fetchurl {
@@ -109,7 +109,7 @@ let
         "https://tor.eff.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
       ];
-      hash = "sha256-Uj2H6ONVpn3EtzMNl8xqOAf6UeO6FGAKtyH9DKh976U=";
+      hash = "sha256-EuyDwgNoVECEko66xFnmteVNnPsn2POlXRU9iS9VPlo=";
     };
   };
 
diff --git a/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix b/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix
index aa05c32a18ca..712647c34ec2 100644
--- a/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix
+++ b/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix
@@ -1,14 +1,14 @@
 {
-  version = "1.79.0";
+  version = "1.80.0";
   hashes = {
-    linux-aarch_64 = "sha256-RFuSS6TT9Vq9ZR9xAX1ZJVK+cGs5GK8NeDe3BGgTdHM=";
-    linux-ppcle_64 = "sha256-YecCAFYMSLpHMbeQed97Ckz+OUr0UJJR3PILRgV8le8=";
-    linux-s390_64 = "sha256-CS2U2by6/6D97C6JR6qBW6ho3azKrnwGTjhaI0r7nSI=";
-    linux-x86_32 = "sha256-pRfe/Sd5X1oTY4m+zxYHA6UJT/DvGUKwmtlER46UjCg=";
-    linux-x86_64 = "sha256-PRa3CxiFSYiynEHiDQbKM1jEcAjtueaYa5JsW8p5CBY=";
-    osx-aarch_64 = "sha256-ew3L4svALrrwPlcespX0PAuj2Rm12ej+NAFYRsmIcok=";
-    osx-x86_64 = "sha256-ew3L4svALrrwPlcespX0PAuj2Rm12ej+NAFYRsmIcok=";
-    windows-x86_32 = "sha256-K2ypGzXYmW0frvyjzqKHS1zHY3EswYMAjfu40TFfIXw=";
-    windows-x86_64 = "sha256-N6BMw6NWgL8XugjonWlNKS8Cjm97ok70tb2KHEP6LlI=";
+    linux-aarch_64 = "sha256-YaF1NjaKYecsGJM+2c+zkyYntf81q3TBbY5di26czUY=";
+    linux-ppcle_64 = "sha256-SiGuY0vAgHh2+/ASqvQXcZ5HfIR6RTYA7PyD1m5Yo3k=";
+    linux-s390_64 = "sha256-NizEl/AZMX99wW9o7z9gzDcCJEaQZTEpaCA6/qWzbZg=";
+    linux-x86_32 = "sha256-0Mjwcc+rtHLf7KfeN6ekj50lX2wzwECzHtYDyoHSlkc=";
+    linux-x86_64 = "sha256-daFkR3395N/ErULwq4/lkur+DaRh/QYeZyvsUtMdKX0=";
+    osx-aarch_64 = "sha256-Ml9Rt58pF0GP7hnI003WT/payaPDiEozMBp77TwQsd8=";
+    osx-x86_64 = "sha256-Ml9Rt58pF0GP7hnI003WT/payaPDiEozMBp77TwQsd8=";
+    windows-x86_32 = "sha256-ncK95ydP5jkQd6BDJ5KnkyKesPqgS/+A/KNbKdRQkoo=";
+    windows-x86_64 = "sha256-1ShLOIOv0DHsKfPYGGtRbYx0l+IK6+2qPqUesG/Az+U=";
   };
 }
diff --git a/pkgs/by-name/ra/raycast/package.nix b/pkgs/by-name/ra/raycast/package.nix
index 514c2b8f2156..f94bc174fbaa 100644
--- a/pkgs/by-name/ra/raycast/package.nix
+++ b/pkgs/by-name/ra/raycast/package.nix
@@ -12,19 +12,19 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "raycast";
-  version = "1.104.6";
+  version = "1.104.10";
 
   src =
     {
       aarch64-darwin = fetchurl {
         name = "Raycast.dmg";
         url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=arm";
-        hash = "sha256-edtUZhgMpxUNPjMCxhVo1sDCrfpXi8bPjvRMblsI/KA=";
+        hash = "sha256-YXEynLEEZChlbk+y3yfO0qYHY95eC00kWf9tzmQk5Ho=";
       };
       x86_64-darwin = fetchurl {
         name = "Raycast.dmg";
         url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=x86_64";
-        hash = "sha256-1Mc8zqOLaP5kq2yPkEP4mE4X58OIRrrw13KtIclxVoM=";
+        hash = "sha256-xr2//lFv67QlL1At2OEjAvZMnYbhbGjFTFUN6un3zY4=";
       };
     }
     .${stdenvNoCC.system} or (throw "raycast: ${stdenvNoCC.system} is unsupported.");
diff --git a/pkgs/by-name/sa/sampo/package.nix b/pkgs/by-name/sa/sampo/package.nix
index d4bdc781f31c..2f2dc365998c 100644
--- a/pkgs/by-name/sa/sampo/package.nix
+++ b/pkgs/by-name/sa/sampo/package.nix
@@ -9,20 +9,20 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sampo";
-  version = "0.12.0";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "bruits";
     repo = "sampo";
     tag = "sampo-v${finalAttrs.version}";
-    hash = "sha256-0E9dvyu6mGbuMH8Lf/rVTn3skVq9kaVjQG2eLH8a2IY=";
+    hash = "sha256-NY73wGLS5r7C5GoF6p9Yf1d9nhbis/QZWAgnIVjytjA=";
   };
 
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ openssl ];
 
-  cargoHash = "sha256-gooShQWJY9UKYq99o7qhyz6ROK+VXYG2PpygdVWG0iM=";
+  cargoHash = "sha256-9Z0Jdx220+GrdNZPcJnjxqSOp6GHFXomtME0qczHbvs=";
 
   cargoBuildFlags = [
     "-p"
@@ -35,7 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
 
-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version-regex=sampo-v([0-9\.]*)" ]; };
 
   meta = {
     description = "Automate changelogs, versioning, and publishing—even for monorepos across multiple package registries";
diff --git a/pkgs/by-name/sm/smoked-salmon/package.nix b/pkgs/by-name/sm/smoked-salmon/package.nix
index 56a8174bba68..d1e6331b9ad5 100644
--- a/pkgs/by-name/sm/smoked-salmon/package.nix
+++ b/pkgs/by-name/sm/smoked-salmon/package.nix
@@ -1,7 +1,7 @@
 {
   lib,
   fetchFromGitHub,
-  ffmpeg-headless,
+  curl,
   flac,
   lame,
   mp3val,
@@ -10,7 +10,7 @@
 }:
 let
   runtimeDeps = [
-    ffmpeg-headless
+    curl
     flac
     lame
     mp3val
@@ -19,56 +19,61 @@ let
 in
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "smoked-salmon";
-  version = "0.9.7.4";
+  version = "0.10.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "smokin-salmon";
     repo = "smoked-salmon";
     tag = finalAttrs.version;
-    hash = "sha256-JOwqu/Hu7BjYLo3DdL6o+9TI/OQvlgj5Xu8WQ0cujwo=";
+    hash = "sha256-kgBTdQTWzGmKWsHjtazaVvQoTulyF5WNFPEUuoanCo4=";
   };
 
   # Upstream tends to use very narrow version constraints
   pythonRelaxDeps = true;
 
-  build-system = with python3Packages; [
-    setuptools
-    setuptools-scm
-  ];
+  # `build-system` requirements are seemingly not covered by pythonRelaxDeps
+  postPatch = ''
+    sed -i 's/requires = \["uv_build.*"\]/requires = ["uv_build"]/' pyproject.toml
+  '';
 
-  dependencies = with python3Packages; [
-    aiohttp
-    aiohttp-jinja2
-    beautifulsoup4
-    bitstring
-    click
-    deluge-client
-    ffmpeg-python
-    filetype
-    httpx
-    humanfriendly
-    jinja2
-    msgspec
-    musicbrainzngs
-    mutagen
-    pillow
-    platformdirs
-    pycambia
-    pyoxipng
-    pyperclip
-    qbittorrent-api
-    ratelimit
-    requests
-    rich
-    send2trash
-    setuptools
-    torf
-    tqdm
-    transmission-rpc
-    unidecode
-    wheel
-  ];
+  build-system = with python3Packages; [ uv-build ];
+
+  dependencies =
+    with python3Packages;
+    [
+      aiohttp
+      aiohttp-jinja2
+      aiolimiter
+      anyio
+      asyncclick
+      av
+      beautifulsoup4
+      deluge-client
+      humanfriendly
+      jinja2
+      msgspec
+      musicbrainzngs
+      mutagen
+      numpy
+      pillow
+      platformdirs
+      pycambia
+      pyimgbox
+      pyoxipng
+      pyperclip
+      qbittorrent-api
+      requests
+      send2trash
+      tenacity
+      torf
+      tqdm
+      transmission-rpc
+      unidecode
+    ]
+    ++ aiohttp.optional-dependencies.speedups
+    ++ beautifulsoup4.optional-dependencies.lxml
+    ++ msgspec.optional-dependencies.toml;
 
   makeWrapperArgs = [
     "--suffix"
@@ -82,7 +87,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   };
 
   meta = {
-    description = "Toolkit for checking, editing and uploading music to Gazelle-based trackers";
+    description = "Toolkit for checking, editing and uploading music. Catered to Gazelle-based trackers";
     homepage = "https://github.com/smokin-salmon/smoked-salmon";
     license = with lib.licenses; [ asl20 ];
     mainProgram = "salmon";
diff --git a/pkgs/by-name/ta/taskwarrior-tui/package.nix b/pkgs/by-name/ta/taskwarrior-tui/package.nix
index f14d5066952b..91945c1f5ade 100644
--- a/pkgs/by-name/ta/taskwarrior-tui/package.nix
+++ b/pkgs/by-name/ta/taskwarrior-tui/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "taskwarrior-tui";
-  version = "0.26.5";
+  version = "0.26.6";
 
   src = fetchFromGitHub {
     owner = "kdheepak";
     repo = "taskwarrior-tui";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-mdkGRxe9d92WXBCLhBUWNALS4WwjoeYgZop2frZwNN0=";
+    sha256 = "sha256-3RUTNQe0D9EquqWowsXI3Ho9mKdckC0XilDcNLmtfCk=";
   };
 
-  cargoHash = "sha256-Z9y8LLqTicbw4Q+lFalQo4kZFddU2fVMBl6iR4f6D9g=";
+  cargoHash = "sha256-dXdbvsQ1RJWORZMWsxF///8y1wsar6FiCblHyZD7t8o=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/to/tor-browser/package.nix b/pkgs/by-name/to/tor-browser/package.nix
index 407888bb80b8..22229f479e44 100644
--- a/pkgs/by-name/to/tor-browser/package.nix
+++ b/pkgs/by-name/to/tor-browser/package.nix
@@ -102,7 +102,7 @@ let
     ++ lib.optionals mediaSupport [ ffmpeg_7 ]
   );
 
-  version = "15.0.7";
+  version = "15.0.8";
 
   sources = {
     x86_64-linux = fetchurl {
@@ -112,7 +112,7 @@ let
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
       ];
-      hash = "sha256-/zUA3o9zPdZ/MZan5Uc2puGN+S8QvB42QtXDo8MucVM=";
+      hash = "sha256-m/WZa1O9MTeE8YUku/BAbcl9Dx77yVkt44C5qe/1fP0=";
     };
 
     i686-linux = fetchurl {
@@ -122,7 +122,7 @@ let
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
       ];
-      hash = "sha256-GZ2MT8bSVMKLwgTZGYYegdW94e6mJ97+oMBeZJMlHvY=";
+      hash = "sha256-QMv59Tj2voJAvBF/UM0xNe1byx8qZZtZhWqt2yGjdM4=";
     };
   };
 
diff --git a/pkgs/by-name/uv/uv/package.nix b/pkgs/by-name/uv/uv/package.nix
index 7ca3555da312..aec0a495afa0 100644
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@@ -18,16 +18,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uv";
-  version = "0.10.12";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     tag = finalAttrs.version;
-    hash = "sha256-F0SA+DNCnJMMZK2vWaQB22ErvFOmvFZN6JT1z01DUxI=";
+    hash = "sha256-brKoPk7Wr5QKgJmcUy54zocahbtI1nSnire4o2HAUOU=";
   };
 
-  cargoHash = "sha256-OfakFIDa2sbJSNQKWHaWZFia661h2QCGvrlnp1GrY08=";
+  cargoHash = "sha256-/wWYnsffHWhpDVD3VIybKImmFye5FxeU5h1qXuqNbpc=";
 
   buildInputs = [
     rust-jemalloc-sys
diff --git a/pkgs/by-name/vi/viceroy/package.nix b/pkgs/by-name/vi/viceroy/package.nix
index 95ad8be9da0f..f0fb7019932e 100644
--- a/pkgs/by-name/vi/viceroy/package.nix
+++ b/pkgs/by-name/vi/viceroy/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "viceroy";
-  version = "0.16.4";
+  version = "0.16.5";
 
   src = fetchFromGitHub {
     owner = "fastly";
     repo = "viceroy";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-KeFKh8ZAUJXBUo0MRw/jU0HnBrehX0YkvbvMUX8ovcA=";
+    hash = "sha256-66wRKZgEPey8umpO/P9bFy6PIA6BwktDl39rKUlAFCU=";
   };
 
-  cargoHash = "sha256-PoexldRTp2cPu7iF7te//kO4Ph1P6A/jNZdMkYKERqM=";
+  cargoHash = "sha256-88+/musBwAafwJ4XguFUvhmo77HsZTkCdBk+h0436yE=";
 
   cargoTestFlags = [
     "--package"
diff --git a/pkgs/by-name/wi/wipeout-rewrite/package.nix b/pkgs/by-name/wi/wipeout-rewrite/package.nix
index ef682310e3f9..d8b30287bc12 100644
--- a/pkgs/by-name/wi/wipeout-rewrite/package.nix
+++ b/pkgs/by-name/wi/wipeout-rewrite/package.nix
@@ -25,13 +25,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "wipeout-rewrite";
-  version = "0-unstable-2026-02-20";
+  version = "0-unstable-2026-03-17";
 
   src = fetchFromGitHub {
     owner = "phoboslab";
     repo = "wipeout-rewrite";
-    rev = "8c60cd585ab88bfc375ff07bda96749359f67d9a";
-    hash = "sha256-ojF0AEiX34cluFNn92pFfB+8AOjrbCawMfTN98JFGIA=";
+    rev = "55fd79749ea69d8dce99326830cb0c5097994bca";
+    hash = "sha256-2LzlAx9cNye/ZE0+8ZMWTdEJEGhTnXJrSLhryvfqRqo=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/wi/wiremix/package.nix b/pkgs/by-name/wi/wiremix/package.nix
index b79ec57956c2..5c126fc7ad78 100644
--- a/pkgs/by-name/wi/wiremix/package.nix
+++ b/pkgs/by-name/wi/wiremix/package.nix
@@ -8,14 +8,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wiremix";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-gs6KqluASHTf4fURZKEmNvERguQEH5UDc4044uJddrU=";
+    hash = "sha256-Ievr+xELhhWNYukqsiwv0WfCDRJqeCUdaZVeGsKQr2s=";
   };
 
-  cargoHash = "sha256-WqC+JVjE0zxvn9/64eGmMIwSqIBXj/OsEmvUHnGKEkA=";
+  cargoHash = "sha256-vTLoNXZMlGnOvGHLWJVva09SuwXUSb4BHA61DZ7zSJk=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index 16fc610bbba6..082ea8b18a81 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -2758,12 +2758,12 @@ with haskellLib;
         doJailbreak
         # 2022-12-02: Hackage release lags behind actual releases: https://github.com/PostgREST/postgrest/issues/2275
         (overrideSrc rec {
-          version = "14.6";
+          version = "14.7";
           src = pkgs.fetchFromGitHub {
             owner = "PostgREST";
             repo = "postgrest";
             rev = "v${version}";
-            hash = "sha256-VGEkb5Skq2u9MCJdz9xGJOoK0Dg22vAxXFRx2Xg9Dv8=";
+            hash = "sha256-Kr06TefPaeL4Nk1GKDbGFGgYQcS/e0A+Pn7pqGfdAlQ=";
           };
         })
       ];
diff --git a/pkgs/development/python-modules/apprise/default.nix b/pkgs/development/python-modules/apprise/default.nix
index 0b99d8b6e939..2816e92cb6cf 100644
--- a/pkgs/development/python-modules/apprise/default.nix
+++ b/pkgs/development/python-modules/apprise/default.nix
@@ -23,12 +23,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "apprise";
-  version = "1.9.8";
+  version = "1.9.9";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-Lgb5661H5n8/GEu3iaeWa+wyYaU1VskKyxsc24XYSiw=";
+    hash = "sha256-/WIsDfFr3HntOFU5c1VzSIyv4kBdJXR+h+69awmyYBI=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
diff --git a/pkgs/development/python-modules/bson/default.nix b/pkgs/development/python-modules/bson/default.nix
index c7fc3443f7c5..2bb2f11738fd 100644
--- a/pkgs/development/python-modules/bson/default.nix
+++ b/pkgs/development/python-modules/bson/default.nix
@@ -2,28 +2,44 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
+  setuptools,
   python-dateutil,
   six,
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "bson";
   version = "0.5.10";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "py-bson";
     repo = "bson";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-mirRpo27RoOBlwxVOKnHaDIzJOErp7c2VxCOunUm/u4=";
   };
 
-  postPatch = ''
-    find . -type f -name '*.py' -exec sed -i 's|assertEquals|assertEqual|g' {} +
-  '';
+  patches = [
+    # Upstream PR: https://github.com/py-bson/bson/pull/113
+    (fetchpatch {
+      name = "python-3.11.patch";
+      url = "https://github.com/py-bson/bson/commit/5346e73124de8a1f9e2a1960501416529e4cee02.patch";
+      hash = "sha256-kNs00j/FDjb2av+0WMORrCo75NcuaJXUl4SbYlksnfo=";
+    })
+    # Upstream PR: https://github.com/py-bson/bson/pull/140
+    (fetchpatch {
+      name = "python-3.14.patch";
+      url = "https://github.com/py-bson/bson/commit/4e6b4c206f7204034ef74bff8ae84a95d76d1684.patch";
+      includes = [ "setup.py" ];
+      hash = "sha256-JOmW/KMqzFdXKH4TMR/PG1YU3SvLTBc3L3E9kXag3bQ=";
+    })
+  ];
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     python-dateutil
     six
   ];
@@ -35,7 +51,10 @@ buildPythonPackage rec {
   meta = {
     description = "BSON codec for Python";
     homepage = "https://github.com/py-bson/bson";
-    license = lib.licenses.asl20;
+    license = [
+      lib.licenses.asl20
+      lib.licenses.bsd3
+    ];
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/cement/default.nix b/pkgs/development/python-modules/cement/default.nix
index 460a5d87ebcb..ec8d54a2d729 100644
--- a/pkgs/development/python-modules/cement/default.nix
+++ b/pkgs/development/python-modules/cement/default.nix
@@ -4,6 +4,7 @@
   buildPythonPackage,
   colorlog,
   fetchFromGitHub,
+  fetchpatch,
   jinja2,
   mock,
   pdm-backend,
@@ -30,6 +31,16 @@ buildPythonPackage rec {
     hash = "sha256-hZ9kKQmMomjy5nnHKQ2RWB+6vIID8XMn3qutg0wCBq8=";
   };
 
+  patches = [
+    # Upstream PR: https://github.com/datafolklabs/cement/pull/759
+    (fetchpatch {
+      name = "python-3.14.patch";
+      url = "https://github.com/datafolklabs/cement/commit/8b038170d82be7dbd283d72b9c5db3cceec7163b.patch";
+      includes = [ "tests/*" ];
+      hash = "sha256-GUHAYp2oxHo1vo1gWnOyCAaNyBBIQM1ixC1p+Yc+Fsc=";
+    })
+  ];
+
   build-system = [ pdm-backend ];
 
   optional-dependencies = {
diff --git a/pkgs/development/python-modules/dscribe/default.nix b/pkgs/development/python-modules/dscribe/default.nix
index 28598f530629..7658089a33a0 100644
--- a/pkgs/development/python-modules/dscribe/default.nix
+++ b/pkgs/development/python-modules/dscribe/default.nix
@@ -3,6 +3,7 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
 
   # build-system
   pybind11,
@@ -34,6 +35,15 @@ buildPythonPackage rec {
     hash = "sha256-2JY24cR2ie4+4svVWC4rm3Iy6Wfg0n2vkINz032kPWc=";
   };
 
+  patches = [
+    # Fixes numpy compatibility
+    (fetchpatch {
+      name = "dscribe-numpy-compatibility";
+      url = "https://github.com/SINGROUP/dscribe/pull/162.patch";
+      hash = "sha256-mSKIerAIqdRp6b/ylqcYr8VwLCGxw5fz/5foo0ZQqgk=";
+    })
+  ];
+
   build-system = [
     pybind11
     setuptools
diff --git a/pkgs/development/python-modules/griffelib/default.nix b/pkgs/development/python-modules/griffelib/default.nix
index 5e01d59bc861..c6ae46c79274 100644
--- a/pkgs/development/python-modules/griffelib/default.nix
+++ b/pkgs/development/python-modules/griffelib/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "griffelib";
-  version = "2.0.0";
+  version = "2.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mkdocstrings";
     repo = "griffe";
     tag = finalAttrs.version;
-    hash = "sha256-SiUkgkaHtq2aWraL5BJvItOExTGUQ+e6pQVXEwTM0mk=";
+    hash = "sha256-8lrpIlWuf9/4Lm+YWLC6GHKwRE7vh+lqBIJIO/WnnSg=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/packages/griffelib";
@@ -45,6 +45,7 @@ buildPythonPackage (finalAttrs: {
   ];
 
   meta = {
+    changelog = "https://github.com/mkdocstrings/griffe/releases/tag/${finalAttrs.src.tag}";
     description = "Signatures for entire Python programs. Extract the structure, the frame, the skeleton of your project, to generate API documentation or find breaking changes in your API";
     homepage = "https://github.com/mkdocstrings/griffe";
     license = lib.licenses.isc;
diff --git a/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix b/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix
index a56e70265c91..c179855af210 100644
--- a/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix
+++ b/pkgs/development/python-modules/ha-mqtt-discoverable/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "ha-mqtt-discoverable";
-  version = "0.23.0";
+  version = "0.24.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "unixorn";
     repo = "ha-mqtt-discoverable";
     tag = "v${version}";
-    hash = "sha256-RITgyY9aAkDDm+SrBpfL4s2DJ2ssWddtbm0IvXswXxM=";
+    hash = "sha256-8UgYtWB6CsTF9yCpwwjeYIyjfFH8IM3M0sZpvrSqb3M=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index c4c459446fdc..bdd519ccf475 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202603231";
+  version = "0.1.202603241";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jJe4bp8CWQseCKnx9OG74kWKylaGyX9Pg+glMk2sIC4=";
+    hash = "sha256-bARMqv2K8j+RruodsC4HUxjvu0T1JiWcAmblycLcE/w=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/imgw-pib/default.nix b/pkgs/development/python-modules/imgw-pib/default.nix
index bdd03727b824..aa095f964959 100644
--- a/pkgs/development/python-modules/imgw-pib/default.nix
+++ b/pkgs/development/python-modules/imgw-pib/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "imgw-pib";
-  version = "2.0.2";
+  version = "2.0.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bieniu";
     repo = "imgw-pib";
     tag = finalAttrs.version;
-    hash = "sha256-CXBeKckm73nDuncLbJywgV7SUckISqmESNHPis0n700=";
+    hash = "sha256-87Q1aKUmDPpay4nIhFZ37fU8XgR4mekbpYZ3BPkcmUw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/indevolt-api/default.nix b/pkgs/development/python-modules/indevolt-api/default.nix
index a71243a448df..c88df046d164 100644
--- a/pkgs/development/python-modules/indevolt-api/default.nix
+++ b/pkgs/development/python-modules/indevolt-api/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "indevolt-api";
-  version = "1.2.2";
+  version = "1.2.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Xirt";
     repo = "indevolt-api";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IDX7GgEDLryKTVIQM52hApI5Il+V7ay9usmL5FPc6vc=";
+    hash = "sha256-l5O4Wn3TBG0grAVUnUJPvdavSka+7YX5cpQp7PzxuAg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/nltk/default.nix b/pkgs/development/python-modules/nltk/default.nix
index 6a1fa040f7a6..129b09cd84ff 100644
--- a/pkgs/development/python-modules/nltk/default.nix
+++ b/pkgs/development/python-modules/nltk/default.nix
@@ -2,6 +2,7 @@
   lib,
   pkgs,
   fetchPypi,
+  fetchpatch,
   buildPythonPackage,
   click,
   joblib,
@@ -29,6 +30,24 @@ buildPythonPackage rec {
     hash = "sha256-D0CemwacpBd8GQPD6EPu+Qx+kpkvpJMa5gfabeSeFBk=";
   };
 
+  patches = [
+    # https://github.com/nltk/nltk/security/advisories/GHSA-jm6w-m3j8-898g
+    # https://github.com/NixOS/nixpkgs/issues/502599
+    (fetchpatch {
+      name = "fix-unauthed-shutdown";
+      url = "https://github.com/nltk/nltk/commit/bbaae83db86a0f49e00f5b0db44a7254c268de9b.patch";
+      hash = "sha256-1ZzOQXiNxZ6o7JQs0b9FpsUjZtuUAjXEmDkc9mV3dYU=";
+    })
+
+    # https://github.com/nltk/nltk/security/advisories/GHSA-469j-vmhf-r6v7
+    # https://github.com/NixOS/nixpkgs/issues/502535
+    (fetchpatch {
+      name = "fix-downloader-path-traversal";
+      url = "https://github.com/nltk/nltk/commit/89fe2ec2c6bae6e2e7a46dad65cc34231976ed8a.patch";
+      hash = "sha256-hQJmVEDDcio4Ew+Y10WzMV53mpYZuuDsFcEZKEzl7nk=";
+    })
+  ];
+
   dependencies = [
     click
     joblib
diff --git a/pkgs/development/python-modules/ohme/default.nix b/pkgs/development/python-modules/ohme/default.nix
index ea8b18ec3eba..e1433f8ef8e2 100644
--- a/pkgs/development/python-modules/ohme/default.nix
+++ b/pkgs/development/python-modules/ohme/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "ohme";
-  version = "1.7.0";
+  version = "1.7.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dan-r";
     repo = "ohmepy";
     tag = "v${version}";
-    hash = "sha256-EKi4etpZdt1y0qWsjHLlVbGfTa1vnv0/MbTtgtSOJi0=";
+    hash = "sha256-A+cGgM3pkOv1b3/+3XiqdhLo2JJbSNruZKbNG2o9BaE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pycambia/default.nix b/pkgs/development/python-modules/pycambia/default.nix
index 2e23a766570a..9501585b0931 100644
--- a/pkgs/development/python-modules/pycambia/default.nix
+++ b/pkgs/development/python-modules/pycambia/default.nix
@@ -2,39 +2,26 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
   openssl,
   pkg-config,
   pytestCheckHook,
   rustPlatform,
 }:
-let
-  cargoLockPatch = (
-    fetchpatch {
-      name = "cargo.lock.patch";
-      url = "https://github.com/KyokoMiki/pycambia/commit/00446e13c20a461c323b119e16f3f57489ba662d.patch";
-      hash = "sha256-N7F67VRxfndoN8NllmGKEePOh3mgbjlNaToUvxh+IrE=";
-    }
-  );
-in
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pycambia";
-  version = "0.1.0";
+  version = "0.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "KyokoMiki";
     repo = "pycambia";
-    tag = version;
-    hash = "sha256-ZflLy6Qa4tBlPZkTya3ELu463qcnRcMS57a6FfHpSNE=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-5UHWAIR+qo16UUsi9D0e6W8UmQ4HUujNWLfJpyIrCUI=";
   };
 
-  patches = [ cargoLockPatch ];
-
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit src;
-    hash = "sha256-jmdf+Idg9PR4jgZ7bexPsAyGj86vGxLseTWXnhzP7+E=";
-    patches = [ cargoLockPatch ];
+    inherit (finalAttrs) src;
+    hash = "sha256-w7n/W7PDC3+DPCb//X462mowhEPw0k3HA1raAeu4t/c=";
   };
 
   buildInputs = [ openssl ];
@@ -55,4 +42,4 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ undefined-landmark ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/pymodbus-repl/default.nix b/pkgs/development/python-modules/pymodbus-repl/default.nix
index be7d58e3a980..c9580da4e7dc 100644
--- a/pkgs/development/python-modules/pymodbus-repl/default.nix
+++ b/pkgs/development/python-modules/pymodbus-repl/default.nix
@@ -30,6 +30,7 @@ buildPythonPackage rec {
   build-system = [ poetry-core ];
 
   pythonRelaxDeps = [
+    "tabulate"
     "typer"
   ];
 
diff --git a/pkgs/development/python-modules/pyrainbird/default.nix b/pkgs/development/python-modules/pyrainbird/default.nix
index 7a5114877817..addec658197d 100644
--- a/pkgs/development/python-modules/pyrainbird/default.nix
+++ b/pkgs/development/python-modules/pyrainbird/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "pyrainbird";
-  version = "6.1.0";
+  version = "6.1.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "allenporter";
     repo = "pyrainbird";
     tag = version;
-    hash = "sha256-s4AZXhub1VM4zHvUnhBjmZREE0O3FcK27PPHLzCE2mU=";
+    hash = "sha256-ac/QzhdfvOpqKi8tjz2Udge2+AIg/yEQBmbYCu0i/0A=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/serialx/default.nix b/pkgs/development/python-modules/serialx/default.nix
index 868ea9a7b96d..b65ddd007393 100644
--- a/pkgs/development/python-modules/serialx/default.nix
+++ b/pkgs/development/python-modules/serialx/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "serialx";
-  version = "1.0.0";
+  version = "1.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "puddly";
     repo = "serialx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QYeEtdG3neRRloXOW7cKVyrsGZ5FrKOXs8gfjdyjpIQ=";
+    hash = "sha256-u9+ffkZLfWt98bmPdnpWaziSpsBWDjvrUJprq1FJimI=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
diff --git a/pkgs/development/python-modules/tracerite/default.nix b/pkgs/development/python-modules/tracerite/default.nix
index cef7d5ce190d..0292b7e41a7e 100644
--- a/pkgs/development/python-modules/tracerite/default.nix
+++ b/pkgs/development/python-modules/tracerite/default.nix
@@ -7,7 +7,7 @@
   html5tagger,
   pytestCheckHook,
   beautifulsoup4,
-  torch,
+  numpy,
 }:
 
 buildPythonPackage rec {
@@ -34,11 +34,16 @@ buildPythonPackage rec {
   nativeCheckInputs = [
     pytestCheckHook
     beautifulsoup4
-    torch
+    numpy
   ];
 
   pythonImportsCheck = [ "tracerite" ];
 
+  disabledTestPaths = [
+    # requiring torch to test tensor rendering in tracebacks is too expensive
+    "tests/test_inspector_torch.py"
+  ];
+
   meta = {
     description = "Tracebacks for Humans in Jupyter notebooks";
     homepage = "https://github.com/sanic-org/tracerite";
diff --git a/pkgs/development/python-modules/ultralytics/default.nix b/pkgs/development/python-modules/ultralytics/default.nix
index bd2407b8b87b..3792a5bae5c5 100644
--- a/pkgs/development/python-modules/ultralytics/default.nix
+++ b/pkgs/development/python-modules/ultralytics/default.nix
@@ -34,14 +34,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ultralytics";
-  version = "8.4.21";
+  version = "8.4.26";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ultralytics";
     repo = "ultralytics";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KyTqO5jjYXnw5xwKlvwnY99SE0zkLaz8Ck6hKb7non8=";
+    hash = "sha256-JFOgkKgSQ/QNevORxVpLX7g45TDW6I05ft2o/VBDRa4=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/tcl-modules/by-name/rl/rl_json/package.nix b/pkgs/development/tcl-modules/by-name/rl/rl_json/package.nix
index fd67dfc347f9..aefab7d88c6f 100644
--- a/pkgs/development/tcl-modules/by-name/rl/rl_json/package.nix
+++ b/pkgs/development/tcl-modules/by-name/rl/rl_json/package.nix
@@ -8,16 +8,33 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rl_json";
-  version = "0.15.3";
+  version = "0.15.7";
 
   src = fetchFromGitHub {
     owner = "RubyLane";
     repo = "rl_json";
-    rev = finalAttrs.version;
-    hash = "sha256-JyJBf8lMrO/P5grOMojqs1PRoMPRsPWGQYS33eB7bRI=";
+    tag = finalAttrs.version;
+    hash = "sha256-6Y6bq/Lm6KCFFV3RF6v4fVPEN1LO+jE2xZV50a8zyng=";
     fetchSubmodules = true;
   };
 
+  # The vendored libtommath conflicts with tclTomMath.
+  # Replacing it with tclTomMath fixes the issue.
+  # https://github.com/RubyLane/rl_json/issues/57
+  # The switch to a vendored libtommath was done in 0.15.4 in commit
+  # https://github.com/RubyLane/rl_json/commit/9294d533f4d81288acf53045666b1587cf7fbf92
+  # "for proper bignum handling", but the commit message doesn't explain what's wrong
+  # with tclTomMath's bignum handling and all tests pass anyway.
+  postPatch = ''
+    rm -r deps/libtommath
+    substituteInPlace Makefile.in \
+      --replace-fail 'deps: local/lib/libtommath.a' 'deps:'
+    substituteInPlace configure.ac \
+      --replace-fail -ltommath ""
+    substituteInPlace generic/rl_jsonInt.h \
+      --replace-fail '#include <tommath.h>' '#include <tclTomMath.h>'
+  '';
+
   nativeBuildInputs = [
     autoreconfHook
     tcl.tclPackageHook
@@ -30,6 +47,10 @@ stdenv.mkDerivation (finalAttrs: {
     "--datarootdir=${placeholder "out"}/share"
   ];
 
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
+
+  doCheck = true;
+
   meta = {
     homepage = "https://github.com/RubyLane/rl_json";
     description = "Tcl extension for fast json manipulation";
diff --git a/pkgs/servers/home-assistant/custom-components/octopus_energy/package.nix b/pkgs/servers/home-assistant/custom-components/octopus_energy/package.nix
index 06d5e34b90de..95c960f07d5d 100644
--- a/pkgs/servers/home-assistant/custom-components/octopus_energy/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/octopus_energy/package.nix
@@ -11,13 +11,13 @@
 buildHomeAssistantComponent rec {
   owner = "BottlecapDave";
   domain = "octopus_energy";
-  version = "18.1.1";
+  version = "18.1.2";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "HomeAssistant-OctopusEnergy";
     tag = "v${version}";
-    hash = "sha256-wqhll0K5WKZDGWftaYLVd6uDS4w8mKU4yO4a4FLqseA=";
+    hash = "sha256-+aMMloqNsDMHt5zSfv9EA9QoGG8VCJv5Aw0ctoWcs5Q=";
   };
 
   dependencies = [ pydantic ];