diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 562a4b4c1b6f..bb1f5256e0cb 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -7699,6 +7699,12 @@
     githubId = 22300113;
     name = "Eduardo Espadeiro";
   };
+  eduardofuncao = {
+    email = "eduardofuncao@hotmail.com";
+    github = "eduardofuncao";
+    githubId = 45571086;
+    name = "Eduardo Função";
+  };
   eduarrrd = {
     email = "e.bachmakov@gmail.com";
     github = "eduarrrd";
@@ -9338,6 +9344,12 @@
     githubId = 134872;
     name = "Sergei Lukianov";
   };
+  frostplexx = {
+    email = "daniel.inama02@gmail.com";
+    github = "frostplexx";
+    githubId = 62436912;
+    name = "Daniel Inama";
+  };
   fryuni = {
     name = "Luiz Ferraz";
     email = "luiz@lferraz.com";
@@ -20896,6 +20908,13 @@
     githubId = 686076;
     name = "Vitalii Voloshyn";
   };
+  panakotta00 = {
+    name = "Panakotta00";
+    github = "Panakotta00";
+    githubId = 16022267;
+    email = "panakotta00@gmail.com";
+    keys = [ { fingerprint = "ABF8 D539 0F8C F623 8F49  7338 BA6C E8AC 4B73 53B9"; } ];
+  };
   pancaek = {
     github = "pancaek";
     githubId = 20342389;
@@ -24343,6 +24362,12 @@
     githubId = 30531572;
     name = "Robert James Hernandez";
   };
+  sarowish = {
+    email = "berkeenercan@tutanota.com";
+    github = "sarowish";
+    githubId = 20581722;
+    name = "Berke Enercan";
+  };
   sarunint = {
     email = "nixpkgs@sarunint.com";
     github = "sarunint";
@@ -25826,6 +25851,12 @@
     githubId = 6277322;
     name = "Wei Tang";
   };
+  sotormd = {
+    email = "sotormd@proton.me";
+    github = "sotormd";
+    githubId = 201147279;
+    name = "sotormd";
+  };
   soupglasses = {
     email = "sofi+git@mailbox.org";
     github = "soupglasses";
diff --git a/nixos/modules/programs/shadow.nix b/nixos/modules/programs/shadow.nix
index d6d48af0f877..d179283ac559 100644
--- a/nixos/modules/programs/shadow.nix
+++ b/nixos/modules/programs/shadow.nix
@@ -254,7 +254,7 @@ in
           startSession = true;
           allowNullPassword = true;
           showMotd = true;
-          updateWtmp = true;
+          lastlog.enable = true;
         };
         chpasswd.rootOK = true;
       };
diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix
index 41ba7df94be1..5130987bed1c 100644
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -137,6 +137,7 @@ let
       imports = [
         (lib.mkRenamedOptionModule [ "enableKwallet" ] [ "kwallet" "enable" ])
         (lib.mkRenamedOptionModule [ "u2fAuth" ] [ "u2f" "enable" ])
+        (lib.mkRenamedOptionModule [ "updateWtmp" ] [ "lastlog" "enable" ])
       ];
 
       options = {
@@ -583,10 +584,21 @@ let
           '';
         };
 
-        updateWtmp = lib.mkOption {
-          default = false;
-          type = lib.types.bool;
-          description = "Whether to update {file}`/var/log/wtmp`.";
+        lastlog = {
+          enable = lib.mkOption {
+            default = false;
+            type = lib.types.bool;
+            description = "Whether to update {file}`/var/log/wtmp`.";
+          };
+
+          silent = lib.mkOption {
+            default = true;
+            example = false;
+            type = lib.types.bool;
+            description = ''
+              Whether to suppress the message showing the last login date.
+            '';
+          };
         };
 
         logFailures = lib.mkOption {
@@ -1521,11 +1533,11 @@ let
               }
               {
                 name = "lastlog";
-                enable = cfg.updateWtmp;
+                enable = cfg.lastlog.enable;
                 control = "required";
                 modulePath = "${pkgs.util-linux.lastlog}/lib/security/pam_lastlog2.so";
                 settings = {
-                  silent = true;
+                  inherit (cfg.lastlog) silent;
                 };
               }
               # Work around https://github.com/systemd/systemd/issues/8598
@@ -2549,7 +2561,7 @@ in
     environment.etc = lib.mapAttrs' makePAMService enabledServices;
 
     systemd =
-      lib.mkIf (lib.any (service: service.updateWtmp) (lib.attrValues config.security.pam.services))
+      lib.mkIf (lib.any (service: service.lastlog.enable) (lib.attrValues config.security.pam.services))
         {
           tmpfiles.packages = [ pkgs.util-linux.lastlog ]; # /lib/tmpfiles.d/lastlog2-tmpfiles.conf
           services.lastlog2-import = {
diff --git a/nixos/modules/services/backup/btrbk.nix b/nixos/modules/services/backup/btrbk.nix
index c44fc48836ce..3ee21ecebe7e 100644
--- a/nixos/modules/services/backup/btrbk.nix
+++ b/nixos/modules/services/backup/btrbk.nix
@@ -10,6 +10,7 @@ let
     concatMap
     concatMapStringsSep
     concatStringsSep
+    escapeShellArgs
     filterAttrs
     getAttr
     isAttrs
@@ -275,6 +276,15 @@ in
                 ];
                 description = "What actions can be performed with this SSH key. See ssh_filter_btrbk(1) for details";
               };
+              extraArgs = mkOption {
+                type = listOf str;
+                description = "Additional arguments to pass to ssh_filter_btrbk";
+                default = [ ];
+                example = [
+                  "--log"
+                  "--restrict-path <path>"
+                ];
+              };
             };
           });
         default = [ ];
@@ -335,7 +345,7 @@ in
         in
         ''command="${pkgs.util-linux}/bin/ionice -t -c ${toString ioniceClass} ${
           optionalString (cfg.niceness >= 1) "${pkgs.coreutils}/bin/nice -n ${toString cfg.niceness}"
-        } ${pkgs.btrbk}/share/btrbk/scripts/ssh_filter_btrbk.sh ${sudo_doas_flag} ${options}" ${v.key}''
+        } ${pkgs.btrbk}/share/btrbk/scripts/ssh_filter_btrbk.sh ${sudo_doas_flag} ${options} ${escapeShellArgs v.extraArgs}" ${v.key}''
       ) cfg.sshAccess;
     };
     users.groups.btrbk = { };
diff --git a/nixos/modules/services/databases/lldap.nix b/nixos/modules/services/databases/lldap.nix
index fe956c943281..1c02f996005d 100644
--- a/nixos/modules/services/databases/lldap.nix
+++ b/nixos/modules/services/databases/lldap.nix
@@ -288,6 +288,37 @@ in
         Group = "lldap";
         DynamicUser = true;
         EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        RestrictAddressFamilies = [
+          "AF_UNIX"
+          "AF_INET"
+          "AF_INET6"
+        ];
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        SystemCallArchitectures = "native";
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        MemoryDenyWriteExecute = true;
       };
       inherit (cfg) environment;
     };
diff --git a/nixos/modules/services/misc/iio-niri.nix b/nixos/modules/services/misc/iio-niri.nix
index 2c2810b0ee0f..4efdad1a6bc8 100644
--- a/nixos/modules/services/misc/iio-niri.nix
+++ b/nixos/modules/services/misc/iio-niri.nix
@@ -32,7 +32,7 @@ in
     extraArgs = mkOption {
       type = types.listOf types.str;
       default = [ ];
-      description = "Extra arguments to pass to IIO-Niri.";
+      description = "Extra arguments to pass to `iio-niri listen`.";
     };
   };
 
@@ -49,7 +49,7 @@ in
       after = [ cfg.niriUnit ];
       serviceConfig = {
         Type = "simple";
-        ExecStart = "${getExe cfg.package} ${escapeShellArgs cfg.extraArgs}";
+        ExecStart = "${getExe cfg.package} listen ${escapeShellArgs cfg.extraArgs}";
         Restart = "on-failure";
       };
     };
diff --git a/nixos/modules/services/networking/harmonia.nix b/nixos/modules/services/networking/harmonia.nix
index 5a7902f952e7..2eba1bdccad3 100644
--- a/nixos/modules/services/networking/harmonia.nix
+++ b/nixos/modules/services/networking/harmonia.nix
@@ -50,7 +50,7 @@ in
         signKeyPath = lib.mkOption {
           type = lib.types.nullOr lib.types.path;
           default = null;
-          description = "DEPRECATED: Use `services.harmonia-dev.cache.signKeyPaths` instead. Path to the signing key to use for signing the cache";
+          description = "DEPRECATED: Use `services.harmonia.cache.signKeyPaths` instead. Path to the signing key to use for signing the cache";
         };
 
         signKeyPaths = lib.mkOption {
@@ -109,31 +109,30 @@ in
         else
           [ ];
 
-      nix.settings.extra-allowed-users = [ "harmonia" ];
-      users.users.harmonia = {
-        isSystemUser = true;
-        group = "harmonia";
+      services.harmonia.cache.settings = builtins.mapAttrs (_: v: lib.mkDefault v) {
+        bind = "[::]:5000";
+        workers = 4;
+        max_connection_rate = 256;
+        priority = 50;
       };
-      users.groups.harmonia = { };
 
-      services.harmonia.cache.settings = builtins.mapAttrs (_: v: lib.mkDefault v) (
-        {
-          bind = "[::]:5000";
-          workers = 4;
-          max_connection_rate = 256;
-          priority = 50;
-        }
-        // lib.optionalAttrs daemonCfg.enable {
-          daemon_socket = daemonCfg.socketPath;
-        }
-      );
+      # Socket activation lets the service run with PrivateNetwork; the
+      # inherited fd keeps referring to the host netns.
+      systemd.sockets.harmonia = {
+        description = "harmonia binary cache socket";
+        wantedBy = [ "sockets.target" ];
+        socketConfig.ListenStream =
+          let
+            b = cacheCfg.settings.bind;
+          in
+          if lib.hasPrefix "unix:" b then lib.removePrefix "//" (lib.removePrefix "unix:" b) else b;
+      };
 
       systemd.services.harmonia = {
         description = "harmonia binary cache service";
 
-        requires = if daemonCfg.enable then [ "harmonia-daemon.service" ] else [ "nix-daemon.socket" ];
-        after = [ "network.target" ] ++ lib.optional daemonCfg.enable "harmonia-daemon.service";
-        wantedBy = [ "multi-user.target" ];
+        requires = [ "harmonia.socket" ];
+        after = [ "harmonia.socket" ];
 
         environment = {
           CONFIG_FILE = format.generate "harmonia.toml" cacheCfg.settings;
@@ -150,6 +149,9 @@ in
           ExecStart = lib.getExe cfg.package;
           User = "harmonia";
           Group = "harmonia";
+          DynamicUser = true;
+          Type = "notify";
+          WatchdogSec = 15;
           Restart = "on-failure";
           PrivateUsers = true;
           DeviceAllow = [ "" ];
@@ -174,7 +176,12 @@ in
           ProtectProc = "invisible";
           RestrictNamespaces = true;
           SystemCallArchitectures = "native";
-          PrivateNetwork = false;
+
+          # accept(2) on the inherited fd is exempt from both restrictions.
+          PrivateNetwork = true;
+          RestrictAddressFamilies = [ "AF_UNIX" ];
+          IPAddressDeny = "any";
+
           PrivateTmp = true;
           PrivateDevices = true;
           PrivateMounts = true;
@@ -182,7 +189,6 @@ in
           ProtectSystem = "strict";
           ProtectHome = true;
           LockPersonality = true;
-          RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6";
           LimitNOFILE = 65536;
         };
       };
diff --git a/nixos/modules/services/x11/display-managers/default.nix b/nixos/modules/services/x11/display-managers/default.nix
index 2695dc71145d..2f9a8dcb210a 100644
--- a/nixos/modules/services/x11/display-managers/default.nix
+++ b/nixos/modules/services/x11/display-managers/default.nix
@@ -48,7 +48,7 @@ let
       IFS=:
       for i in $XDG_CURRENT_DESKTOP; do
         case $i in
-          KDE|GNOME|Pantheon|Hyprland|X-NIXOS-SYSTEMD-AWARE) echo "1"; exit; ;;
+          KDE|GNOME|Pantheon|Hyprland|niri|X-NIXOS-SYSTEMD-AWARE) echo "1"; exit; ;;
           *) ;;
         esac
       done
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index c724fa0b339f..2da70438e188 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1375,7 +1375,7 @@ in
   pulseaudio-tcp = runTest ./pulseaudio-tcp.nix;
   pykms = runTest ./pykms.nix;
   qbittorrent = runTest ./qbittorrent.nix;
-  qboot = handleTestOn [ "x86_64-linux" "i686-linux" ] ./qboot.nix { };
+  qboot = runTestOn [ "x86_64-linux" "i686-linux" ] ./qboot.nix;
   qemu-vm-credentials-fwcfg = runTest {
     imports = [ ./qemu-vm-credentials.nix ];
     _module.args.mechanism = "fw_cfg";
diff --git a/nixos/tests/grafana-to-ntfy.nix b/nixos/tests/grafana-to-ntfy.nix
index d7e942296e3a..f7d3dd487f13 100644
--- a/nixos/tests/grafana-to-ntfy.nix
+++ b/nixos/tests/grafana-to-ntfy.nix
@@ -148,10 +148,10 @@ in
 
     with subtest("Grafana alert arrives at ntfy"):
       machine.succeed(
-        "curl -sf http://127.0.0.1:${toString ports.grafana}/api/alertmanager/grafana/config/api/v1/receivers/test"
+        "curl -sf http://127.0.0.1:${toString ports.grafana}/apis/notifications.alerting.grafana.app/v1beta1/namespaces/default/receivers/-/test"
         " -u admin:admin"
         " -X POST -H 'Content-Type: application/json'"
-        """ -d '{"receivers": [{"name": "grafana-to-ntfy", "grafana_managed_receiver_configs": [{"uid": "cp_webhook", "name": "webhook", "type": "webhook", "disableResolveMessage": false, "settings": {"url": "http://127.0.0.1:${toString ports.grafana-to-ntfy}", "httpMethod": "POST"}}]}]}'"""
+        """ -d '{"alert": {"labels": {"alertname": "test-alert"}, "annotations": {}}, "integration": {"type": "webhook", "settings": {"url": "http://127.0.0.1:${toString ports.grafana-to-ntfy}", "httpMethod": "POST"}}}'"""
       )
       # grep ensures we wait for the Grafana message specifically (see above)
       resp = machine.wait_until_succeeds(
diff --git a/nixos/tests/pam/pam-lastlog.nix b/nixos/tests/pam/pam-lastlog.nix
index cefc8a3d4e45..4d1dab8e7150 100644
--- a/nixos/tests/pam/pam-lastlog.nix
+++ b/nixos/tests/pam/pam-lastlog.nix
@@ -6,10 +6,7 @@
   nodes.machine =
     { ... }:
     {
-      # we abuse run0 for a quick login as root as to not require setting up accounts and passwords
-      security.pam.services.systemd-run0 = {
-        updateWtmp = true; # enable lastlog
-      };
+      imports = [ ../common/user-account.nix ];
     };
 
   testScript = ''
@@ -23,8 +20,13 @@
 
     with subtest("Test lastlog entries are created by logins"):
       machine.wait_for_unit("multi-user.target")
-      machine.succeed("run0 --pty true") # perform full login
-      print(machine.succeed("lastlog2 --active --user root"))
+      machine.wait_until_tty_matches("1", "login: ")
+      machine.send_chars("alice\n")
+      machine.wait_until_tty_matches("1", "Password: ")
+      machine.send_chars("foobar\n")
+      machine.wait_until_succeeds("pgrep -u alice bash")
+      print(machine.succeed("lastlog2 --active --user alice"))
       machine.succeed("stat /var/lib/lastlog/lastlog2.db")
+      machine.send_chars("exit\n")
   '';
 }
diff --git a/nixos/tests/qboot.nix b/nixos/tests/qboot.nix
index 822f74ed2665..c74110afebd5 100644
--- a/nixos/tests/qboot.nix
+++ b/nixos/tests/qboot.nix
@@ -1,17 +1,15 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "qboot";
+{ pkgs, ... }:
+{
+  name = "qboot";
 
-    nodes.machine =
-      { ... }:
-      {
-        virtualisation.bios = pkgs.qboot;
-      };
+  nodes.machine =
+    { ... }:
+    {
+      virtualisation.bios = pkgs.qboot;
+    };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("multi-user.target")
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+  '';
+}
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 10c057d3f55f..9bbcc30397d1 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -7758,6 +7758,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  inlay-hints-nvim = buildVimPlugin {
+    pname = "inlay-hints.nvim";
+    version = "0.0.7";
+    src = fetchFromGitHub {
+      owner = "MysticalDevil";
+      repo = "inlay-hints.nvim";
+      tag = "v0.0.7";
+      hash = "sha256-136r1/SjBHcrKZZcFHZK7rFTcJHAReZqIzUrKsZStc4=";
+    };
+    meta.homepage = "https://github.com/MysticalDevil/inlay-hints.nvim";
+    meta.license = getLicenseFromSpdxId "Apache-2.0";
+    meta.hydraPlatforms = [ ];
+  };
+
   instant-nvim = buildVimPlugin {
     pname = "instant.nvim";
     version = "0-unstable-2022-06-25";
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/statix/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/statix/default.nix
index 62dd5e9b9bc0..2090ea8ccfe3 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/statix/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/statix/default.nix
@@ -2,14 +2,15 @@
   vimUtils,
   statix,
 }:
-vimUtils.buildVimPlugin rec {
-  inherit (statix) pname src meta;
-  version = "0.1.0";
-  postPatch = ''
-    # check that version is up to date
-    grep 'pname = "statix-vim"' -A 1 flake.nix \
-      | grep -F 'version = "${version}"'
+vimUtils.buildVimPlugin {
+  inherit (statix)
+    pname
+    src
+    meta
+    version
+    ;
 
+  postPatch = ''
     cd vim-plugin
     substituteInPlace ftplugin/nix.vim --replace-fail statix ${statix}/bin/statix
     substituteInPlace plugin/statix.vim --replace-fail statix ${statix}/bin/statix
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index be8e7bb244c1..cf926280f12d 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -552,6 +552,7 @@ https://github.com/Darazaki/indent-o-matic/,,
 https://github.com/arsham/indent-tools.nvim/,,
 https://github.com/Yggdroot/indentLine/,,
 https://github.com/ciaranm/inkpot/,,
+https://github.com/MysticalDevil/inlay-hints/,,
 https://github.com/jbyuki/instant.nvim/,,
 https://github.com/pta2002/intellitab.nvim/,,
 https://github.com/parsonsmatt/intero-neovim/,,
diff --git a/pkgs/applications/misc/dupeguru/remove-setuptools-sandbox.patch b/pkgs/applications/misc/dupeguru/remove-setuptools-sandbox.patch
deleted file mode 100644
index 983ea4dd7efc..000000000000
--- a/pkgs/applications/misc/dupeguru/remove-setuptools-sandbox.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-diff --git a/build.py b/build.py
-index 06905a11..56d54a17 100644
---- a/build.py
-+++ b/build.py
-@@ -10,7 +10,7 @@ from optparse import OptionParser
- import shutil
- from multiprocessing import Pool
- 
--from setuptools import sandbox
-+import subprocess
- from hscommon import sphinxgen
- from hscommon.build import (
-     add_to_pythonpath,
-@@ -118,7 +118,12 @@ def build_normpo():
- def build_pe_modules():
-     print("Building PE Modules")
-     # Leverage setup.py to build modules
--    sandbox.run_setup("setup.py", ["build_ext", "--inplace"])
-+    result = subprocess.run(
-+        [sys.executable, "setup.py", "build_ext", "--inplace"],
-+        check=True,
-+    )
-+    if result.returncode != 0:
-+        sys.exit("Error building PE modules. Please check the output above.")
- 
- 
- def build_normal():
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index f879a7e052f7..aeacf086a87e 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -600,7 +600,7 @@ let
         hash = "sha256-tJ//HE7o9R8nSQDGhi+MKXdNUwnkCZI++CzpAmFn2YY=";
       })
     ]
-    ++ lib.optionals (chromiumVersionAtLeast "146" && lib.versionOlder llvmVersion "23") [
+    ++ lib.optionals (versionRange "146" "148" && lib.versionOlder llvmVersion "23") [
       # clang++: error: unknown argument: '-fsanitize-ignore-for-ubsan-feature=array-bounds'
       (fetchpatch {
         name = "chromium-146-revert-Update-fsanitizer=array-bounds-config.patch";
@@ -626,6 +626,47 @@ let
     ++ lib.optionals (chromiumVersionAtLeast "147" && lib.versionOlder llvmVersion "23") [
       # clang++: error: unknown argument: '-fno-lifetime-dse'
       ./patches/chromium-147-llvm-22.patch
+    ]
+    ++ lib.optionals (chromiumVersionAtLeast "148" && lib.versionOlder llvmVersion "23") [
+      # clang++: error: unknown argument: '-fsanitize-ignore-for-ubsan-feature=return'
+      (fetchpatch {
+        name = "chromium-148-revert-build-Add--fsanitizer=return-config.patch";
+        # https://chromium-review.googlesource.com/c/chromium/src/+/7629257
+        url = "https://chromium.googlesource.com/chromium/src/+/99ba1f5302f9433efdb4df302cb7b7de56c72e4c^!?format=TEXT";
+        decode = "base64 -d";
+        revert = true;
+        hash = "sha256-/qzzxwTdPMwIdsqD/G02S7kKHCj3QxECL+g1WYEaWmU=";
+      })
+      # ERROR Unresolved dependencies.
+      # //apps:apps(//build/toolchain/linux/unbundle:default)
+      #   needs //build/config/compiler:sanitize_return(//build/toolchain/linux/unbundle:default)
+      (fetchpatch {
+        name = "chromium-148-revert-build-Enable--fsanitizer=return-config.patch";
+        # https://chromium-review.googlesource.com/c/chromium/src/+/7629258
+        url = "https://chromium.googlesource.com/chromium/src/+/9357bfbea03753fe52264c9ec36abe74f48cfef5^!?format=TEXT";
+        decode = "base64 -d";
+        revert = true;
+        hash = "sha256-14fTHNh3vGsf4KgeH8uLX+aK3lrjK0VKd1dfK1g7r0I=";
+      })
+      # [33377/55552] LINK ./mksnapshot
+      # ld.lld: error: undefined symbol: __sanitizer_set_death_callback
+      # https://gitlab.archlinux.org/archlinux/packaging/packages/chromium/-/blob/148.0.7778.96-1/PKGBUILD#L168-174
+      (fetchpatch {
+        name = "archlinux-chromium-146-drop-unknown-clang-flag.patch";
+        url = "https://gitlab.archlinux.org/archlinux/packaging/packages/chromium/-/raw/148.0.7778.96-1/chromium-146-drop-unknown-clang-flag.patch";
+        hash = "sha256-jR0G9z2R8VGl2tkB3u0368RyWM1J6qYXqNWwKkYd5zU=";
+      })
+    ]
+    ++ lib.optionals (chromiumVersionAtLeast "148") [
+      # ninja: error: '../../third_party/rust-toolchain/bin/rustc', needed by 'phony/default_for_rust_host_build_tools_rust_bin_inputs', missing and no known rule to make it
+      (fetchpatch {
+        name = "chromium-148-revert-Reland-build-use-tool-inputs-instead-of-siso-config-for-rust-actions.patch";
+        # https://chromium-review.googlesource.com/c/chromium/src/+/7719879
+        url = "https://chromium.googlesource.com/chromium/src/+/9193ab90af24c23ee983e0a8da9bed45712f0d26^!?format=TEXT";
+        decode = "base64 -d";
+        revert = true;
+        hash = "sha256-7xg8IZ2gO+Wtnv7lWLVE3lLpcmMgvtDtcWwUuMBzkrE=";
+      })
     ];
 
     postPatch =
@@ -751,6 +792,12 @@ let
         sed -i 's/OFFICIAL_BUILD/GOOGLE_CHROME_BUILD/' tools/generate_shim_headers/generate_shim_headers.py
 
       ''
+      # https://chromium-review.googlesource.com/c/chromium/src/+/7677517
+      # ninja: error: '../../third_party/gperf/cipd/bin/gperf', needed by 'gen/third_party/blink/renderer/core/css/parser/at_rule_descriptors.cc', missing and no known rule to make it
+      + lib.optionalString (chromiumVersionAtLeast "148") ''
+        mkdir -p third_party/gperf/cipd/bin
+        ln -s "${pkgsBuildHost.gperf}/bin/gperf" third_party/gperf/cipd/bin/gperf
+      ''
       +
         lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform && stdenv.hostPlatform.isAarch64)
           ''
@@ -903,6 +950,11 @@ let
       # but lit_reactive_element.patch only patches the former.
       + lib.optionalString (chromiumVersionAtLeast "146") ''
         rm -r third_party/node/node_modules/@lit/reactive-element/development
+      ''
+      # Similarly, having @types/estree causes:
+      # error TS2352: Conversion of type 'Node[]' to type 'TSPropertySignature[]' [...]
+      + lib.optionalString (chromiumVersionAtLeast "148") ''
+        rm -r third_party/node/node_modules/@types/estree
       '';
 
     configurePhase = ''
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index c47cf4fbdab4..50cf1f4ec7db 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,6 +1,6 @@
 {
   "chromium": {
-    "version": "147.0.7727.137",
+    "version": "148.0.7778.96",
     "chromedriver": {
       "version": "147.0.7727.138",
       "hash_darwin": "sha256-d2dEPcR2mlfkL6XGhzMsgH/OwAI+yLXdS0dF4luPRfM=",
@@ -8,21 +8,21 @@
     },
     "deps": {
       "depot_tools": {
-        "rev": "d0e1a84d5b0c3c556b0fbdbeb77908d9817e6bbb",
-        "hash": "sha256-mc/W0D9MEtNQPeJ66X9T28IB+pvYqDRXj9UYb9hLlvA="
+        "rev": "41c40cfaec7ee3bf0423c59925d8b23982a601f1",
+        "hash": "sha256-s9uvmYHCJKWnNhztmOPb+OHj/HbGo30PupwT4mHWjnM="
       },
       "gn": {
-        "version": "0-unstable-2026-03-05",
-        "rev": "d8c2f07d653520568da7cace755a87dad241b72d",
-        "hash": "sha256-3AfExm7NL5GJXyC5JCPbGC70D59doRfIZIgpt6MLy9Y="
+        "version": "0-unstable-2026-04-01",
+        "rev": "6e8dcdebbadf4f8aa75e6a4b6e0bdf89dce1513a",
+        "hash": "sha256-BTPD8WM1pVAMkFDlHekMdWFGyf63KdhKkKwsqikqoBQ="
       },
-      "npmHash": "sha256-ByB1Ea5tduIJZXyydeBWsoS8OPABOgwHe+dNXRssdvc="
+      "npmHash": "sha256-JuVcY8iFRDWcPcP4Pg+qm5rnTXkiVfNsqSkXbDWqsE8="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "68ba233a543d25e75c30f1228dd3bafa2da96937",
-        "hash": "sha256-ktIkQRYWcyKnZKEhvxFGssMZ///ctd/Ue3VIYPvQzuM=",
+        "rev": "8625e066febc721e015ea99842da12901eb7ed73",
+        "hash": "sha256-coeBYfNPtiRRPuqoBRaxkTQI/a2pYNLI1slUdU1dZAc=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -32,8 +32,8 @@
       },
       "src/third_party/compiler-rt/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt.git",
-        "rev": "338a5c004c774a8927899b1f1c0c25a82d14510f",
-        "hash": "sha256-2lj4oF8IbJoPOBWwQ4ZfDQjPklxQyNyG5AcHazxEYcs="
+        "rev": "76287b5da8e155135536c8e3a67432d97d74fe3a",
+        "hash": "sha256-q6syHriTR8TCQSqTWbbAkVVK0a/i4wojdEGN7sWGxUY="
       },
       "src/third_party/libc++/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git",
@@ -47,13 +47,13 @@
       },
       "src/third_party/libunwind/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git",
-        "rev": "78884e23fe39cf5cc6987ea188a9b802d65a21c9",
-        "hash": "sha256-G8CtxDHzo8WtJ6qrtghXBoYCWwnDvXcAueEGzLc6C14="
+        "rev": "6ca46ff28e3578c57cbead6f233969eb3dabc176",
+        "hash": "sha256-JW4kqpVTCFDN4WZE2S5gEkX1O7eDycl+adm3KGlUoTU="
       },
       "src/third_party/llvm-libc/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git",
-        "rev": "c42ab4598a74eea2cf3efff9d44b22de155d41af",
-        "hash": "sha256-NJCdrmVyF80aQLtrdVgcWQadhj5w7nKrLShaZDen1GA="
+        "rev": "2a826f2fda3cf8d75b47cbc3bb1d9b244f13a6ab",
+        "hash": "sha256-OWe2lAT5XbADWuxHgg53lZiU0My/ys86FEXvn4zlVx0="
       },
       "src/chrome/test/data/perf/canvas_bench": {
         "url": "https://chromium.googlesource.com/chromium/canvas_bench.git",
@@ -72,18 +72,18 @@
       },
       "src/docs/website": {
         "url": "https://chromium.googlesource.com/website.git",
-        "rev": "d3b3b620e65ebaf511c6c8399b98a081cd644a66",
-        "hash": "sha256-xTGvhQUKOgt007WdvzN4eDpue8nheEMSV+Cl3Tnwviw="
+        "rev": "44319eca109f9678595924a90547c1f6650d8664",
+        "hash": "sha256-Trkan7bzRaLFlTkRfNGh7ssoZ3QpMh+mxQacsSM+d2I="
       },
       "src/media/cdm/api": {
         "url": "https://chromium.googlesource.com/chromium/cdm.git",
-        "rev": "9920660ea0162f88c44a648de177e6f8cb976d07",
-        "hash": "sha256-rC/aV3vsFzXQ8BiOIK+OTXxTsgTLEEqC19KDAot1PTs="
+        "rev": "33c977516b3dfe5b065bc298aa74175e1999ab51",
+        "hash": "sha256-GsaRxLnsz1jrFZ3m5tv65d1dioG23uJnmfa+WD7XcFc="
       },
       "src/net/third_party/quiche/src": {
         "url": "https://quiche.googlesource.com/quiche.git",
-        "rev": "435c98c0d9ab7a2b60592c5297635b4791745191",
-        "hash": "sha256-dhsq9kLRcXPxv0Ih6CQhDvLAGjh3EgSCl28Cxjk2aos="
+        "rev": "21ffbe4c7b717d00d2d768c259b5b330fd754ac3",
+        "hash": "sha256-yKMmfdSBvbB3T042TJbZ1Mw+y0kyfHP0knQVFWAFPTg="
       },
       "src/testing/libfuzzer/fuzzers/wasm_corpus": {
         "url": "https://chromium.googlesource.com/v8/fuzzer_wasm_corpus.git",
@@ -92,8 +92,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "534e0d1c1d0fcb4b57fd6a3fb9284cd14eaa28cd",
-        "hash": "sha256-o3UV8X27G7wpaDiKDzgMZN64+d9JQrvcQXpSybxi/h4="
+        "rev": "cc0e3572e8789f4a184dd9714a04b3d98ae81015",
+        "hash": "sha256-3KVTEBcnQTn99ccdKzylzUvua2jlS4g8/nfIDdLk6ug="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -107,8 +107,8 @@
       },
       "src/third_party/angle/third_party/VK-GL-CTS/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/VK-GL-CTS",
-        "rev": "1cf4ed5bc0620ea514404609b1a2958c4518b86d",
-        "hash": "sha256-IZ5tVrld2+wDOWaYX93j2eLZJJs/EMW1+FtxhOeWi6w="
+        "rev": "f52e89f885064b9109501bca16c813bb29389993",
+        "hash": "sha256-3jx4QVR9nB3WggfrORGJGifmJQhAYVSPusa7RlR16qg="
       },
       "src/third_party/anonymous_tokens/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/anonymous-tokens.git",
@@ -127,48 +127,53 @@
       },
       "src/third_party/dav1d/libdav1d": {
         "url": "https://chromium.googlesource.com/external/github.com/videolan/dav1d.git",
-        "rev": "b546257f770768b2c88258c533da38b91a06f737",
-        "hash": "sha256-E3da/LJ8HNy1osExmupovqnL8JHgVNzPUCG5F8TJKXQ="
+        "rev": "d69235dd804b24c04ed05639cffcc912cd6cfd75",
+        "hash": "sha256-iKq6TYscIBK4ydv+0msNV3tcs82Ljk5ZNr954Qv2lII="
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "049880d58d6636a819168c00f44f8a4ed1e33e51",
-        "hash": "sha256-AHUos4ejvcsHTDdretkDHAeyLugtI6Jg14Hb9MbbPPs="
+        "rev": "19696dd088b8ed5804e2f02a8f83f5afdb3e99e3",
+        "hash": "sha256-ihnVPCk9412UzCmoABWVUhiGaIdIYxiYMkk43KDqpg8="
       },
-      "src/third_party/dawn/third_party/glfw": {
+      "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
-        "rev": "b35641f4a3c62aa86a0b3c983d163bc0fe36026d",
-        "hash": "sha256-E1zXIDiw87badrLOZTvV+Wh9NZHu51nb70ZK9vlAlqE="
+        "rev": "043378876a67b092f5d0d3d9748660121a336dd3",
+        "hash": "sha256-4QSD1/uxWfYZPMjShB0h639eqAfuBRXAVfOm6BbZCBs="
       },
       "src/third_party/dawn/third_party/dxc": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectXShaderCompiler",
-        "rev": "2888a8764a33693f5a351e0c4ec87f430ccb0f7a",
-        "hash": "sha256-xAe7SdcOeNiqNF6pYwMPMnd9/2yTWUlVdH1aCco/PEo="
+        "rev": "eb67a9085c758516d940e1ce3fed0acfb6518209",
+        "hash": "sha256-z+yIuVweIyLdOiZDRfSppjTRoYq8S93+JNUla4Umot8="
       },
       "src/third_party/dawn/third_party/dxheaders": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectX-Headers",
         "rev": "980971e835876dc0cde415e8f9bc646e64667bf7",
         "hash": "sha256-0Miw1Cy/jmOo7bLFBOHuTRDV04cSeyvUEyPkpVsX9DA="
       },
-      "src/third_party/dawn/third_party/khronos/OpenGL-Registry": {
+      "src/third_party/dawn/third_party/directx-headers/src": {
+        "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectX-Headers",
+        "rev": "980971e835876dc0cde415e8f9bc646e64667bf7",
+        "hash": "sha256-0Miw1Cy/jmOo7bLFBOHuTRDV04cSeyvUEyPkpVsX9DA="
+      },
+      "src/third_party/dawn/third_party/OpenGL-Registry/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/OpenGL-Registry",
         "rev": "5bae8738b23d06968e7c3a41308568120943ae77",
         "hash": "sha256-K3PcRIiD3AmnbiSm5TwaLs4Gu9hxaN8Y91WMKK8pOXE="
       },
-      "src/third_party/dawn/third_party/khronos/EGL-Registry": {
+      "src/third_party/dawn/third_party/EGL-Registry/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/EGL-Registry",
         "rev": "7dea2ed79187cd13f76183c4b9100159b9e3e071",
         "hash": "sha256-Z6DwLfgQ1wsJXz0KKJyVieOatnDmx3cs0qJ6IEgSq1A="
       },
       "src/third_party/dawn/third_party/webgpu-cts": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts",
-        "rev": "d213d4b8dba58ca7a0685e30cfaf1d29f4fc5d5b",
-        "hash": "sha256-6YGLG9BMQbF2pjV40su5ddHMqDW8/CEwM3RDEc/t2kM="
+        "rev": "09fdb847d90d0b5bfe57068ce2eb9283cb77fc7f",
+        "hash": "sha256-eTAwnTiAHq8rmbw7u9nAwSuAlS5adStUJKfITlYkcgU="
       },
       "src/third_party/dawn/third_party/webgpu-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webgpu-native/webgpu-headers",
-        "rev": "b2b04dde36a941434c88ccff7a730d7e464d638c",
-        "hash": "sha256-+/qXZNkm26p+becMVcyHNUPyEUCejSV+tyTGFE4ivak="
+        "rev": "7d3186c3dd2c708703524027b46b8703534ab3cc",
+        "hash": "sha256-yE3/mfhqc7YtVNg4f/nrUpuRUGRjOzdwl++vPvd+mvc="
       },
       "src/third_party/highway/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/highway.git",
@@ -182,13 +187,13 @@
       },
       "src/third_party/libpfm4/src": {
         "url": "https://chromium.googlesource.com/external/git.code.sf.net/p/perfmon2/libpfm4.git",
-        "rev": "964baf9d35d5f88d8422f96d8a82c672042e7064",
-        "hash": "sha256-awpZ22rovLZWQkX/qog93vL4u2gJ+F3w5IGFNlZ0heQ="
+        "rev": "977a25bb3dfe45f653a6cee71ffaae9a92fc3095",
+        "hash": "sha256-t4LMG38GksMEM5DktyJ0qLUX1biXErQ57MaMtd7hoeo="
       },
       "src/third_party/boringssl/src": {
         "url": "https://boringssl.googlesource.com/boringssl.git",
-        "rev": "27bc28d7f03fb9e3752980dce01de1a529236532",
-        "hash": "sha256-u+yvIPrdb9fWzJXJeIidUQ1MkKUx6sKLs7vdW68QhYc="
+        "rev": "d8be2b4a71155bf82da092ef543176351eeb59ff",
+        "hash": "sha256-fZc95YrREDbf0YcO6zahIjdX6TcRJANcH9MrkLIIIHw="
       },
       "src/third_party/breakpad/breakpad": {
         "url": "https://chromium.googlesource.com/breakpad/breakpad.git",
@@ -202,13 +207,13 @@
       },
       "src/third_party/catapult": {
         "url": "https://chromium.googlesource.com/catapult.git",
-        "rev": "e0ebf38a01214aba11f31daa1c743782def031d5",
-        "hash": "sha256-njtIcvzo2v9uDuP+AostVAZRTtH2vePsshF4cANHkxo="
+        "rev": "4f1d71f6841d210b3a06ab3ef2e2ed679af0ee56",
+        "hash": "sha256-aHlf8gw3KxbKoyyajP4w586iYybx7HSkcKtLcZIgiDE="
       },
       "src/third_party/catapult/third_party/webpagereplay": {
         "url": "https://chromium.googlesource.com/webpagereplay.git",
-        "rev": "22be07d7809409644d7e292d9495fa8a251d5f29",
-        "hash": "sha256-HR6iEDwmxFaiLi+h3MwsNfBOtBNbrKvmRNgMVog3A0Y="
+        "rev": "be48b5e3387780790ecc7723434b6ea6733bcc33",
+        "hash": "sha256-KcFUlQMltsMm4WlTVMLzZXfrvu67ffkKjmBcruwZye0="
       },
       "src/third_party/ced/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/compact_enc_det.git",
@@ -232,8 +237,8 @@
       },
       "src/third_party/cpuinfo/src": {
         "url": "https://chromium.googlesource.com/external/github.com/pytorch/cpuinfo.git",
-        "rev": "7364b490b5f78d58efe23ea76e74210fd6c3c76f",
-        "hash": "sha256-lB6e5zcw5UiwTOf+a+B35apXP5t1bxI6yOMiEeFwIwY="
+        "rev": "7607ca500436b37ad23fb8d18614bec7796b68a7",
+        "hash": "sha256-LnLtCMMRg+DwB7MijBdt/tmCKD/zN5y2oTgXlYw3hTg="
       },
       "src/third_party/crc32c/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/crc32c.git",
@@ -242,28 +247,28 @@
       },
       "src/third_party/cros_system_api": {
         "url": "https://chromium.googlesource.com/chromiumos/platform2/system_api.git",
-        "rev": "1fb70b2851b292e48b612482a6d4d1b4c343c862",
-        "hash": "sha256-YBN8ogJn5Yup9GYrsE9UW15KPCuXbhD6hdqXWWCPD20="
+        "rev": "c27a09148de373889e5d2bf616c4e85a68050ae2",
+        "hash": "sha256-a/mAa1+if6B1FHe9crO8PDpc3o8M+CeIuXjXT0lwZOY="
       },
       "src/third_party/crossbench": {
         "url": "https://chromium.googlesource.com/crossbench.git",
-        "rev": "19cee54825bc57215266f5b14a5874bfbbb57543",
-        "hash": "sha256-HVwX8E3/7yw7zUqZrptN1iSBWF4ls0FAzPObPagNYtM="
+        "rev": "c179f7919aade97c5cff64d14b9171736e7aaef9",
+        "hash": "sha256-Hxazf58z9imnGO1aj2NRtsQ+BYrfAuIuZscADpr1NVI="
       },
       "src/third_party/crossbench-web-tests": {
         "url": "https://chromium.googlesource.com/chromium/web-tests.git",
-        "rev": "909ad1733b50f28510c840ebad7b878a5ce07715",
-        "hash": "sha256-RYih9sn4rIBnFW/styZaUl5H0A1eEy3//DypZjY6n0M="
+        "rev": "b19e4e52c33fb8a105c3fc99598b0b9b4bc59752",
+        "hash": "sha256-7vCQw91L2c97dnVdrJ53zL8hi0KZffDJJjk7GaG3b/U="
       },
       "src/third_party/depot_tools": {
         "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git",
-        "rev": "4ce8ba39a3488397a2d1494f167020f21de502f3",
-        "hash": "sha256-WTzjmLFjh1yDDEvYE7Qfx8aBxMLdATx14+Jprwh8ZgQ="
+        "rev": "41c40cfaec7ee3bf0423c59925d8b23982a601f1",
+        "hash": "sha256-s9uvmYHCJKWnNhztmOPb+OHj/HbGo30PupwT4mHWjnM="
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "854a02be78c7ffea104cb523636efa991bef5c5b",
-        "hash": "sha256-CzzUueh2QXX+ExGqh5+JpnDoWF8DiFDff7fWmC01xfg="
+        "rev": "6efd6eb1d85fd67fdcc2385c54fa56c524bec3f7",
+        "hash": "sha256-1pr3+RK519m+wtcacJB3PcDTL+qSHlOn1ctxpoLzTf8="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -277,8 +282,8 @@
       },
       "src/third_party/eigen3/src": {
         "url": "https://chromium.googlesource.com/external/gitlab.com/libeigen/eigen.git",
-        "rev": "54458cb39d1081d0cfe6b77ed8e085d457a4c921",
-        "hash": "sha256-WXxSe2AY3hSMXz7lHNeFefOHGGkdXoSQLC6FuOa6Exo="
+        "rev": "a3074053a614df7a3896cb4edbcba40222a5f549",
+        "hash": "sha256-9AHpSqemqdwXoMiP3hH1YuEd3+nrudeVGTpInw+8BU4="
       },
       "src/third_party/farmhash/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/farmhash.git",
@@ -292,13 +297,13 @@
       },
       "src/third_party/federated_compute/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google-parfait/federated-compute.git",
-        "rev": "271aa00f8aec5bc801f542710efe1b2f0b5f0ef9",
-        "hash": "sha256-6ZATBYkyIdGuhG0Ps2vr0DT9nq1LhW2XCWWAkiZh9Hc="
+        "rev": "eb170f645b270c7979edb863fd2cf8edab2b2fd1",
+        "hash": "sha256-Cp0WQBbqWvPdrKCMQhH4Z6zl6YlIPLjafWZEwdkYWlc="
       },
       "src/third_party/ffmpeg": {
         "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git",
-        "rev": "946d97db8d906277085e361892b7efda5152e2f1",
-        "hash": "sha256-UxrmVqfX6TvFy1yxWXIQbd3ABD3jEAtDesgfnbJGg1E="
+        "rev": "b5e18fb9da84e26ceef30d4e4886696bf59337c0",
+        "hash": "sha256-JHAicFKBvtkwmZPRBKYPT6JVqYqF8hyXxU0H7kfgCBs="
       },
       "src/third_party/flac": {
         "url": "https://chromium.googlesource.com/chromium/deps/flac.git",
@@ -327,18 +332,18 @@
       },
       "src/third_party/freetype/src": {
         "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git",
-        "rev": "45556a19aab9502b91d6f30931e0cb5256f683f8",
-        "hash": "sha256-eMt2orPeG81o42O/HU+4B5b/G62TYAVIEeWwOmiML14="
+        "rev": "99b479dc34728936b006679a31e12b8cf432fc55",
+        "hash": "sha256-H5RzBFYWIp/QYKyeBM2wfuX7FvXHPbhCAp7qne5Zvhw="
       },
       "src/third_party/fxdiv/src": {
         "url": "https://chromium.googlesource.com/external/github.com/Maratyszcza/FXdiv.git",
         "rev": "63058eff77e11aa15bf531df5dd34395ec3017c8",
         "hash": "sha256-LjX5kivfHbqCIA5pF9qUvswG1gjOFo3CMpX0VR+Cn38="
       },
-      "src/third_party/harfbuzz-ng/src": {
+      "src/third_party/harfbuzz/src": {
         "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git",
-        "rev": "5d4e96ad8d00fc871ffa17707b2ca08fa850e7d6",
-        "hash": "sha256-9ef1P2JVJc7ZiP7TObFOxJbccCLsEgjhj+Z/ooEAGiI="
+        "rev": "4fc96139259ebc35f40118e0382ac8037d928e5c",
+        "hash": "sha256-/RT2OPWFiVwFqmNS4o+gE0JrcVO1cQDkCkgrSEe7BzE="
       },
       "src/third_party/ink/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ink.git",
@@ -347,13 +352,13 @@
       },
       "src/third_party/ink_stroke_modeler/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ink-stroke-modeler.git",
-        "rev": "3fa5129ed1ae6f8b2ec4e9b60fa5d08cc81e2d78",
-        "hash": "sha256-/TBxFsmLH1h3kfeE90LhR0RWJ3NrCTiLKklcaPbean8="
+        "rev": "da42d439389c90ec7574f0381ec53e7f5be0c2eb",
+        "hash": "sha256-W5HgVe0v9O/EuhpKMHp83PLq4p6cuBul3QUGLYdF6rY="
       },
       "src/third_party/instrumented_libs": {
         "url": "https://chromium.googlesource.com/chromium/third_party/instrumented_libraries.git",
-        "rev": "69015643b3f68dbd438c010439c59adc52cac808",
-        "hash": "sha256-8kokdsnn5jD9KgM/6g0NuITBbKkGXWEM4BMr1nCrfdU="
+        "rev": "e8cb570a9a2ee9128e2214c73417ad2a3c47780b",
+        "hash": "sha256-5cb9qhSEzb941pF5HH0Br+x9wEH7MiGwQttvErb2mZo="
       },
       "src/third_party/emoji-segmenter/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/emoji-segmenter.git",
@@ -387,8 +392,8 @@
       },
       "src/third_party/icu": {
         "url": "https://chromium.googlesource.com/chromium/deps/icu.git",
-        "rev": "ee5f27adc28bd3f15b2c293f726d14d2e336cbd5",
-        "hash": "sha256-UQWSAekvYc1bTEAEQTPdeB406Uqb0mptpnGRZSaLewo="
+        "rev": "ff7995a708a10ab44db101358083c7f74752da9f",
+        "hash": "sha256-yQ55MGzqkVkp/arTlmKqySBvQFtaPaBk9UUAFE0imhE="
       },
       "src/third_party/nlohmann_json/src": {
         "url": "https://chromium.googlesource.com/external/github.com/nlohmann/json.git",
@@ -402,8 +407,8 @@
       },
       "src/third_party/leveldatabase/src": {
         "url": "https://chromium.googlesource.com/external/leveldb.git",
-        "rev": "4ee78d7ea98330f7d7599c42576ca99e3c6ff9c5",
-        "hash": "sha256-ANtMVRZmW6iOjDVn2y15ak2fTagFTTaz1Se6flUHL8w="
+        "rev": "7ee830d02b623e8ffe0b95d59a74db1e58da04c5",
+        "hash": "sha256-a1fcVI9Vsm1qE17Fnx5UxwOy4ZFMMJ0OKwNs/gZHYQI="
       },
       "src/third_party/libFuzzer/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt/lib/fuzzer.git",
@@ -412,8 +417,8 @@
       },
       "src/third_party/fuzztest/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git",
-        "rev": "1f7726d61f7afa9aca1198a9395ede472ed70366",
-        "hash": "sha256-RhJ676e6Kr/muR0ZCfZOAcs3kfoK7CjG2cwOpYG/JCY="
+        "rev": "800c545cf9d6e9c01328a1974f93a7e6564a74fd",
+        "hash": "sha256-Pvz+CWTBcWE0N0yfNGZhXDgUrGeIaCNfEjP1jYmF6G0="
       },
       "src/third_party/domato/src": {
         "url": "https://chromium.googlesource.com/external/github.com/googleprojectzero/domato.git",
@@ -427,13 +432,13 @@
       },
       "src/third_party/libaom/source/libaom": {
         "url": "https://aomedia.googlesource.com/aom.git",
-        "rev": "ab9876a5983227865ee26e91caac87c6b8750e27",
-        "hash": "sha256-V40GL7fKj1qratP0KcrhedEPDIsg0XVb3ha5nroM0ws="
+        "rev": "b63f30b6d30028a3d7d9c5223def8f3ad97dcc4c",
+        "hash": "sha256-LaBEcVcSB8WB9ZNRgPSiGaKdQL5f3wll2sPb9OhN5SE="
       },
       "src/third_party/crabbyavif/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git",
-        "rev": "c05daf3e2e6d83f2a359ab97094ce042944020a9",
-        "hash": "sha256-vVKAgvPdba0Lt3BUStOQsILlhiHNJeIv1jS9691+a80="
+        "rev": "7466a44ac80893803d4a7168b98dc6cd02d1fe2d",
+        "hash": "sha256-x1MRNtGLmwlRNenoQKz2Bgm3J5eHlNiJZtzhT9lttmk="
       },
       "src/third_party/nearby/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/nearby-connections.git",
@@ -487,8 +492,8 @@
       },
       "src/third_party/cros-components/src": {
         "url": "https://chromium.googlesource.com/external/google3/cros_components.git",
-        "rev": "ddb611c60142c72be3719e753a42fb434b6f2458",
-        "hash": "sha256-M/b7PKEu+mFxsEeedJeppkwl8aZnX/932zqWlrCx8Y4="
+        "rev": "fb512780dcc5ba4b5be9e8a3118919002077c760",
+        "hash": "sha256-7wx73HZ6aqXQvLxwX6XnJAPefi/t47gIhvDH3FRT1j4="
       },
       "src/third_party/libdrm/src": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/libdrm.git",
@@ -497,8 +502,8 @@
       },
       "src/third_party/expat/src": {
         "url": "https://chromium.googlesource.com/external/github.com/libexpat/libexpat.git",
-        "rev": "69d6c054c1bd5258c2a13405a7f5628c72c177c2",
-        "hash": "sha256-qe8O7otL6YcDDBx2DS/+c5mWIS8Rf8RQXVtLFMIAeyk="
+        "rev": "f31adfd584b7f6c50bbf4d22eb928538ffc9145a",
+        "hash": "sha256-tLz4RejYQ/kFXhsWTduuGcinfUkqxYKPCpsou+WlvBc="
       },
       "src/third_party/libipp/libipp": {
         "url": "https://chromium.googlesource.com/chromiumos/platform2/libipp.git",
@@ -542,13 +547,13 @@
       },
       "src/third_party/libvpx/source/libvpx": {
         "url": "https://chromium.googlesource.com/webm/libvpx.git",
-        "rev": "aec2a6f1cd6e3d9e8cf5d9682fcb8a442799bd22",
-        "hash": "sha256-PNreh1VisA46I0WZqq8wZRCjbQRiVMxbL5Gl2Bfzo3M="
+        "rev": "47ac1ec7f3de7d7cb3d070844c427c8f1fa9d6fc",
+        "hash": "sha256-RyYnkLYafiS6kQKeOmzohtxFRXudDzgEmQkG+qKHozc="
       },
       "src/third_party/libwebm/source": {
         "url": "https://chromium.googlesource.com/webm/libwebm.git",
-        "rev": "f2a982d748b80586ae53b89a2e6ebbc305848b8c",
-        "hash": "sha256-SxDGt7nPVkSxwRF/lMmcch1h+C2Dyh6GZUXoZjnXWb4="
+        "rev": "b7a1e4767fbb02ad467f45ba378e858e897028da",
+        "hash": "sha256-Lzfs15Us8MDDQYvLRVf6xKg9A76aXPnTukx/A8Mf7rw="
       },
       "src/third_party/libwebp/src": {
         "url": "https://chromium.googlesource.com/webm/libwebp.git",
@@ -577,8 +582,8 @@
       },
       "src/third_party/nasm": {
         "url": "https://chromium.googlesource.com/chromium/deps/nasm.git",
-        "rev": "af5eeeb054bebadfbb79c7bcd100a95e2ad4525f",
-        "hash": "sha256-vH3OUzfLZbaPY4DMAvSW0jKYRJmOa7aE8EfIJtZ1/Xs="
+        "rev": "45252858722aad12e545819b2d0f370eb865431b",
+        "hash": "sha256-0KsHYi76IaVNwk0dBhem2AnUXd9PpeS+jUsY+zPmeJ8="
       },
       "src/third_party/neon_2_sse/src": {
         "url": "https://chromium.googlesource.com/external/github.com/intel/ARM_NEON_2_x86_SSE.git",
@@ -592,8 +597,8 @@
       },
       "src/third_party/openscreen/src": {
         "url": "https://chromium.googlesource.com/openscreen",
-        "rev": "571620ad60afc9f317d77605c65335f5412aada2",
-        "hash": "sha256-ktR3EpmkjueEmEip2oUTcSclVkUlPi/7+qmhElG+Bzs="
+        "rev": "448a19d1f24e0f8ce85ad0c1c6a50cf370ae69d7",
+        "hash": "sha256-hRDFnoqAH4HoWZ3oTWlzNge2nwlxpUC/GEq0MQVzBw8="
       },
       "src/third_party/openscreen/src/buildtools": {
         "url": "https://chromium.googlesource.com/chromium/src/buildtools",
@@ -607,13 +612,13 @@
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "e5bafd3be58c26673576fd5bb5cbf413b485de5b",
-        "hash": "sha256-umtG2n6kWYD0hT44GpmnwUVztkZ0RtQDV0h0+4CTC9w="
+        "rev": "a78c62d93a8f514ea2cd98a70bd1d21226be9d93",
+        "hash": "sha256-qd3Oa/JFzoI5hKDY2/OQAzdr2z9srUj0H6oKz0R516U="
       },
       "src/third_party/perfetto": {
         "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
-        "rev": "728eb5626a3bc701d044dd16d9cd289360ff47c3",
-        "hash": "sha256-LeGGkzSMfVXuioVJmRi/TjMYgG/0YrK7PckBJTejSHU="
+        "rev": "46432bb2a7a60e10fcee516f1692e6846d098a8d",
+        "hash": "sha256-jVih4xWota4SZQi4yEtaIP+4qgD03OsELt2aaulIXik="
       },
       "src/third_party/protobuf-javascript/src": {
         "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript",
@@ -627,8 +632,8 @@
       },
       "src/third_party/pyelftools": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git",
-        "rev": "19b3e610c86fcadb837d252c794cb5e8008826ae",
-        "hash": "sha256-I/7p3IEvfP/gkes4kx18PvWwhAKilQKb67GXoW4zFB4="
+        "rev": "8047437615d66d3267ac0134834b80e70639d572",
+        "hash": "sha256-rEnt08K90/Psfa+SQgTUG3YGrhp4/udXG9VKIwPM7pk="
       },
       "src/third_party/quic_trace/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/quic-trace.git",
@@ -657,8 +662,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "6e0fbe154ccaf018b2dd1f0e42eec285e7d79d00",
-        "hash": "sha256-oqfNOSQB+5sbAnw4tPBXn22rk6Ai5b2aZNLJUyM181k="
+        "rev": "afe8b760ada5128164f9826866b4381a3463df41",
+        "hash": "sha256-HsKHffZWTls362kjokxzdhaxb/xJD1g70VHGk9l6GVM="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -672,13 +677,13 @@
       },
       "src/third_party/sqlite/src": {
         "url": "https://chromium.googlesource.com/chromium/deps/sqlite.git",
-        "rev": "727f7c8991f7b622a8b5c833cff99871a8c2cd8e",
-        "hash": "sha256-L42hkqcsuyMkNUeornIul7AYNgachkYpfNFE8H/VeVc="
+        "rev": "508ab21dc25702ed6690c4dd77da209a6bcd1239",
+        "hash": "sha256-SfvLfBKdPjFvZ7CzUeFMcyoHdCzQgNRQwZyzb6MRtJg="
       },
       "src/third_party/swiftshader": {
         "url": "https://swiftshader.googlesource.com/SwiftShader.git",
-        "rev": "313545f85af72f954820e54f4110cda591a6cf7b",
-        "hash": "sha256-EGgC5nK68Wk0b466K9yvLlGMxBd/CeI+KTgyoE+x6DY="
+        "rev": "89556131bf9d48af3c5c9fbb9a3322e706da89a3",
+        "hash": "sha256-h0utcwCnzwhFufggkBNeA674x2Kqwu4sz3jQ/9eoQv0="
       },
       "src/third_party/text-fragments-polyfill/src": {
         "url": "https://chromium.googlesource.com/external/github.com/GoogleChromeLabs/text-fragments-polyfill.git",
@@ -687,23 +692,23 @@
       },
       "src/third_party/tflite/src": {
         "url": "https://chromium.googlesource.com/external/github.com/tensorflow/tensorflow.git",
-        "rev": "b476481b77f6e939e813ac93df22a4a6e7a3dd57",
-        "hash": "sha256-oKLFjed5sbYjEX5kddkAEdhkVOwFf5ddEUlOS55zLWE="
+        "rev": "de8d7f65b6eb670e4dad0225d0d6f99bebaab559",
+        "hash": "sha256-r2b+/VBffxsh1sRM2xcFiBx9K6GD6FsaQXpfFMBFUag="
       },
       "src/third_party/litert/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google-ai-edge/LiteRT.git",
-        "rev": "82bf3bef8a04a416bcb9d1cca5bdd51a6b3ab4ba",
-        "hash": "sha256-uMBuoGQIgRhmc8KJqLUnf13XK9tveuS0/OzzwKHKNUw="
+        "rev": "588075c77c6895cce6397d41d2890b1aa0a14372",
+        "hash": "sha256-rcEPZNSV0DiDrmoBCtJ07wFzzpmpM93jG4jYaEdNWvI="
       },
       "src/third_party/vulkan-deps": {
         "url": "https://chromium.googlesource.com/vulkan-deps",
-        "rev": "4a9f2cec3d5e7cb4810cf84716f597aff768ffa4",
-        "hash": "sha256-PyBxtzesZR/5jrWt96DxK7QwRoG8qhzWzbiE1fqdqkI="
+        "rev": "0ced1107c62836f439f684a5696c4bd69e09fce3",
+        "hash": "sha256-VOyN618wzyyO2Wh18gCnw+FCr/NbegX3A/54MClyhwc="
       },
       "src/third_party/glslang/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/glslang",
-        "rev": "b11b03839c940685b0201026bd2a4ffef1d5a4b8",
-        "hash": "sha256-FjUqETWBiI91hq5wGomPmCeW7K4k9kn5r74pUP0QFNo="
+        "rev": "715c8500e7cd67f2eba9e60e98852a1ed49d2f15",
+        "hash": "sha256-vSbMdTjlRVvYLi5ZvTVmfe76oAQ4AhqyD+ohvkvIYIs="
       },
       "src/third_party/spirv-cross/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Cross",
@@ -712,38 +717,38 @@
       },
       "src/third_party/spirv-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Headers",
-        "rev": "f88a2d766840fc825af1fc065977953ba1fa4a91",
-        "hash": "sha256-VhcGQ+Tr9sH0ZEIk0oJsXh8MvCo2qpA2W3i8YVCwKaE="
+        "rev": "6dd7ba990830f7c15ac1345ff3b43ef6ffdad216",
+        "hash": "sha256-UKBVs2s05hP+paPq1dZFaUEQQ9Kx9acHxYUyJVx22eY="
       },
       "src/third_party/spirv-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Tools",
-        "rev": "7d8d9e58c384949f1615c069d4c9346bf51b9738",
-        "hash": "sha256-AxS7vHw3RoXZLayWEDKBU7H0M1BZ9RMVdIsD/4rYap8="
+        "rev": "2d14d2e76aa7de72404b17078eda15c20a6a0389",
+        "hash": "sha256-8Xtzq8WOdFEw+uEJqMW39LLHt2m165K9OJsIFZuifoM="
       },
       "src/third_party/vulkan-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Headers",
-        "rev": "74d8a6cb930c68ef617b202c3ff3c59d919e086b",
-        "hash": "sha256-bZKNFiZMVYDxa6RKb1c/GxIR+eEFQAyYNaEptzQW5TE="
+        "rev": "afe9eb980aa928a66d1c9c06f38c55dd59868720",
+        "hash": "sha256-/yolWlC7ruRiJ0gSdCoSlqL9+j2uJAh+o+H0OG37pq4="
       },
       "src/third_party/vulkan-loader/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Loader",
-        "rev": "363f465abadab0a8dcfc5c85d2c691e9b0b788d6",
-        "hash": "sha256-Zk2QyKu19g52vzGpNq5Qm+mlEgqk4jCFn/861eK8+64="
+        "rev": "df84d2be47457a8dfd7eb66f8c2b031683bd1ba5",
+        "hash": "sha256-8ParcURRRU3eS9Oej/vHTwOwvYy3HsVJsKh2wQLKUgM="
       },
       "src/third_party/vulkan-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Tools",
-        "rev": "59f963ce1b1d16cc92137a241a0fe98d637d21f4",
-        "hash": "sha256-Hh0N4N4XN7p7PBKk2uCU5g9TO9vmxJbomC1Gvf5oDZc="
+        "rev": "90bf5bc4fd8bea0d300f6564af256a51a34124b8",
+        "hash": "sha256-tmTD/waVX/duaKXvj0FNUS+ncL1agM73kK7pEfHEsSA="
       },
       "src/third_party/vulkan-utility-libraries/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Utility-Libraries",
-        "rev": "20fb10eb1ec08ccd5cacec32b7df1b0e99e48a0c",
-        "hash": "sha256-4XsQN94JsQXFGwJKp3W2gdTCCxUZrpCKiRVXzxL+Qs0="
+        "rev": "48b1fd1a65e436bae806cb6180c9338846b9de97",
+        "hash": "sha256-B3GXmwJEvnGcER5DJt0FGrwqNi3t8iV6VgX8uOrExlU="
       },
       "src/third_party/vulkan-validation-layers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-ValidationLayers",
-        "rev": "20948525099c0ea030ec5b149c809e48010be4ed",
-        "hash": "sha256-H05Ms2a770ApiCz5ERiIm8g893TJG9gRRuM9Qr4bj60="
+        "rev": "ac146eef210b6f52b842111c5d3419ab32a7293f",
+        "hash": "sha256-GqjVHxtda1a47+9G+nqh4qNMJmQaUdZNMUGQ8kAIIkk="
       },
       "src/third_party/vulkan_memory_allocator": {
         "url": "https://chromium.googlesource.com/external/github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator.git",
@@ -777,23 +782,23 @@
       },
       "src/third_party/webgl/src": {
         "url": "https://chromium.googlesource.com/external/khronosgroup/webgl.git",
-        "rev": "8fc2a0dff53abfc0cf2c140d8420759b2036cc54",
-        "hash": "sha256-cU7kfmxgaem6rPHGW+VwjxfKe7c0u1tCc98MQjsp5l8="
+        "rev": "216b10fafd3f6a900c715a8c758a4c7f9883b030",
+        "hash": "sha256-Aax2hr/9Zq6Avk+TMU1OMBLGshUL6hyRTX6eoOQesqM="
       },
       "src/third_party/webgpu-cts/src": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts.git",
-        "rev": "54441b8d176b12a5e2b01b8db78191ace56d7f34",
-        "hash": "sha256-gGvvKMTUJGm4ZwM7C1xTY1DKskCmlrCpSl3HLgVZqoY="
+        "rev": "09fdb847d90d0b5bfe57068ce2eb9283cb77fc7f",
+        "hash": "sha256-eTAwnTiAHq8rmbw7u9nAwSuAlS5adStUJKfITlYkcgU="
       },
       "src/third_party/webpagereplay": {
         "url": "https://chromium.googlesource.com/webpagereplay.git",
-        "rev": "22be07d7809409644d7e292d9495fa8a251d5f29",
-        "hash": "sha256-HR6iEDwmxFaiLi+h3MwsNfBOtBNbrKvmRNgMVog3A0Y="
+        "rev": "be48b5e3387780790ecc7723434b6ea6733bcc33",
+        "hash": "sha256-KcFUlQMltsMm4WlTVMLzZXfrvu67ffkKjmBcruwZye0="
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "28452dff1bf86fec881a47949d4dedd4a2fe1f09",
-        "hash": "sha256-KBz94jvdVgxWuTuSoeHKNdY7wEJDGqG3xVsSVB3ubRQ="
+        "rev": "9600e77d854090669817d22aa2fc941ee92aaacd",
+        "hash": "sha256-jTJv53qt971Va5q6MaULysYiChBVmsFYxG9fzkcE0ak="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -805,25 +810,20 @@
         "rev": "b65be9e699847c975440108a42f05412cc7fddac",
         "hash": "sha256-PySen9syu0OshtlHAZw666FeSQXdnsV8nlW9RmxgapM="
       },
-      "src/third_party/xdg-utils": {
-        "url": "https://chromium.googlesource.com/chromium/deps/xdg-utils.git",
-        "rev": "cb54d9db2e535ee4ef13cc91b65a1e2741a94a44",
-        "hash": "sha256-WuQ9uDq+QD17Y20ACFGres4nbkeOiTE2y+tY1avAT5U="
-      },
       "src/third_party/xnnpack/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/XNNPACK.git",
-        "rev": "abd8e60edf09db5f5ba8e7fa2f1fcab0ae0807e1",
-        "hash": "sha256-VdrA2UwQ7/kHbnlIXBmga3ZjAqWaxCDQcDAssbLrh/M="
+        "rev": "1812bbe2928a32f26c5e48466712ba6460cf290c",
+        "hash": "sha256-xal21wjgeql3MjQXw6F1ezcRsnhVKod5jv0nYWroJ1o="
       },
       "src/third_party/zstd/src": {
         "url": "https://chromium.googlesource.com/external/github.com/facebook/zstd.git",
-        "rev": "1168da0e567960d50cba1b58c9b0ba047ece4733",
-        "hash": "sha256-T2CwRpL/XT/OsBrRfxC8kNIm43U4qPMBju8Ug13Qebo="
+        "rev": "3ae099b48dfcfe02b1b3ba81ab85457f8a922e9f",
+        "hash": "sha256-futF0sM6z9HAl6AMJwUULBRByN92FTBjRIzYb2vBFGg="
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "c152c31c55cd54fd239772532a86c802d95b4617",
-        "hash": "sha256-7qEPh9l94LqyaA9qW0ZfFmmFyMNTjTJaeunLgDhtFuM="
+        "rev": "ddc9a95905de5268332a8f0216dc2bc67d26e829",
+        "hash": "sha256-x2FGL3J+JaWO1m6jBrcayR7Vlz90fYEAuufm4PULYyM="
       }
     }
   },
diff --git a/pkgs/applications/networking/browsers/chromium/update.mjs b/pkgs/applications/networking/browsers/chromium/update.mjs
index 4c2f3e44c520..9aab0753db78 100755
--- a/pkgs/applications/networking/browsers/chromium/update.mjs
+++ b/pkgs/applications/networking/browsers/chromium/update.mjs
@@ -72,11 +72,7 @@ for (const attr_path of Object.keys(lockfile)) {
       DEPS: {},
     }
 
-    // The DEPS schema was modified in https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/7007552
-    // and https://chromium-review.googlesource.com/c/chromium/src/+/7683270. And while the breaking change itself got
-    // backported to M147 (and M146 fwiw), the necessary depot_tools roll was not.
-    // So for now we simply resort to whatever depot_tools is currently pinned on chromium's main branch.
-    const depot_tools = await fetch_depot_tools(/* chromium_rev */ 'main', lockfile_initial[attr_path].deps.depot_tools)
+    const depot_tools = await fetch_depot_tools(chromium_rev, lockfile_initial[attr_path].deps.depot_tools)
     lockfile[attr_path].deps.depot_tools = {
       rev: depot_tools.rev,
       hash: depot_tools.hash,
diff --git a/pkgs/applications/networking/charles/default.nix b/pkgs/applications/networking/charles/default.nix
index 39d066451db5..f9f70bee1b5a 100644
--- a/pkgs/applications/networking/charles/default.nix
+++ b/pkgs/applications/networking/charles/default.nix
@@ -4,7 +4,7 @@
   makeWrapper,
   makeDesktopItem,
   fetchurl,
-  openjdk17-bootstrap,
+  jdk25,
   jdk11,
   jdk8,
   writeScript,
@@ -114,10 +114,10 @@ in
 {
   charles5 = (
     generic {
-      version = "5.0.3";
-      hash = "sha256-SiZ15ekuAW7AyXBHN5Zel4ZFL/4oNy1td64NQ0GNUhE=";
+      version = "5.1";
+      hash = "sha256-gExmuh1A21QGkfcmcwPPgk51Ag7Ced9kPTHha2ofbKg=";
       platform = "_x86_64";
-      jdk = openjdk17-bootstrap;
+      jdk = jdk25;
 
       updateScript = writeScript "update-charles" ''
         #!/usr/bin/env nix-shell
diff --git a/pkgs/applications/networking/instant-messengers/discord/linux.nix b/pkgs/applications/networking/instant-messengers/discord/linux.nix
index 22a815d4f3f7..cf5ec0193b11 100644
--- a/pkgs/applications/networking/instant-messengers/discord/linux.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/linux.nix
@@ -49,7 +49,6 @@
   libgbm,
   nspr,
   nss,
-  openssl_1_1,
   pango,
   systemdLibs,
   libappindicator-gtk3,
@@ -231,11 +230,10 @@ stdenv.mkDerivation (finalAttrs: {
     nss
   ]
   # The new distro layout ships prebuilt `.node` modules:
-  # discord_dispatch is linked against openssl 1.1, discord_voice against libpulseaudio
-  ++ lib.optionals isDistro [
-    openssl_1_1
-    libpulseaudio
-  ];
+  # discord_dispatch is linked against openssl 1.1, discord_voice against libpulseaudio.
+  # Ignore the missing dependency on insecure openssl_1_1: discord_dispatch is
+  # effectively unused in practice.
+  ++ lib.optionals isDistro [ libpulseaudio ];
 
   strictDeps = true;
 
@@ -243,6 +241,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   inherit libPath;
 
+  autoPatchelfIgnoreMissingDeps = lib.optionals isDistro [
+    "libssl.so.1.1"
+    "libcrypto.so.1.1"
+  ];
+
   installPhase = ''
     runHook preInstall
 
diff --git a/pkgs/applications/virtualization/qboot/default.nix b/pkgs/applications/virtualization/qboot/default.nix
index 5b1c556ea5e5..53572437af43 100644
--- a/pkgs/applications/virtualization/qboot/default.nix
+++ b/pkgs/applications/virtualization/qboot/default.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation {
   pname = "qboot";
-  version = "unstable-2020-04-23";
+  version = "unstable-2022-09-19";
 
   src = fetchFromGitHub {
     owner = "bonzini";
     repo = "qboot";
-    rev = "de50b5931c08f5fba7039ddccfb249a5b3b0b18d";
-    sha256 = "1d0h29zz535m0pq18k3aya93q7lqm2858mlcp8mlfkbq54n8c5d8";
+    rev = "8ca302e86d685fa05b16e2b208888243da319941";
+    hash = "sha256-YxVGFiyLdhq7yWaXARh7f0nBZgXfJuYvv1BxfyThupM=";
   };
 
   nativeBuildInputs = [
@@ -33,9 +33,7 @@ stdenv.mkDerivation {
     "pic"
   ];
 
-  passthru.tests = {
-    qboot = nixosTests.qboot;
-  };
+  passthru.tests.qboot = nixosTests.qboot;
 
   meta = {
     description = "Simple x86 firmware for booting Linux";
diff --git a/pkgs/by-name/a4/a4/package.nix b/pkgs/by-name/a4/a4/package.nix
index c18e7d3c4720..44fb6db2832b 100644
--- a/pkgs/by-name/a4/a4/package.nix
+++ b/pkgs/by-name/a4/a4/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "a4";
-  version = "0.2.3";
+  version = "2.0";
 
   src = fetchFromGitHub {
     owner = "rpmohn";
     repo = "a4";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AX5psz9+bLdFFeDR55TIrAWDAkhDygw6289OgIfOJTg=";
+    hash = "sha256-WehME2z/Fm4DOrEUj8+XTOnm2MrplZIeOXSubSN223w=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/ac/acme-client/package.nix b/pkgs/by-name/ac/acme-client/package.nix
index d08602b7d3f3..01903febec36 100644
--- a/pkgs/by-name/ac/acme-client/package.nix
+++ b/pkgs/by-name/ac/acme-client/package.nix
@@ -9,11 +9,11 @@
 
 gccStdenv.mkDerivation (finalAttrs: {
   pname = "acme-client";
-  version = "1.3.3";
+  version = "1.3.7";
 
   src = fetchurl {
-    url = "https://data.wolfsden.cz/sources/acme-client-${finalAttrs.version}.tar.gz";
-    hash = "sha256-HJOk2vlDD7ADrLdf/eLEp+teu9XN0KrghEe6y4FIDoI=";
+    url = "https://files.wolfsden.cz/releases/acme-client/acme-client-${finalAttrs.version}.tar.gz";
+    hash = "sha256-Mq+6epLcgEnlQ0JAPYCxGQu7EM0VS0Y32PYuvEuliAE=";
   };
 
   nativeBuildInputs = [
@@ -29,12 +29,17 @@ gccStdenv.mkDerivation (finalAttrs: {
     "PREFIX=${placeholder "out"}"
   ];
 
+  passthru.updateScript = ./update.sh;
+
   meta = {
     description = "Secure ACME/Let's Encrypt client";
     homepage = "https://git.wolfsden.cz/acme-client-portable";
     platforms = lib.platforms.unix;
     license = lib.licenses.isc;
-    maintainers = with lib.maintainers; [ pmahoney ];
+    maintainers = with lib.maintainers; [
+      pmahoney
+      kybe236
+    ];
     mainProgram = "acme-client";
   };
 })
diff --git a/pkgs/by-name/ac/acme-client/update.sh b/pkgs/by-name/ac/acme-client/update.sh
new file mode 100755
index 000000000000..6b6034bd26cb
--- /dev/null
+++ b/pkgs/by-name/ac/acme-client/update.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnugrep nix-update
+
+set -euo pipefail
+
+VERSION=$(curl https://files.wolfsden.cz/releases/acme-client/ | grep -oP 'acme-client-\K\d+\.\d+\.\d+(?=\.tar\.gz)' | sort -V | tail -n1)
+
+echo ">> acme-client: $VERSION"
+
+nix-update --version "$VERSION" acme-client
diff --git a/pkgs/by-name/al/allure/package.nix b/pkgs/by-name/al/allure/package.nix
index 1f27bd1a8023..30e3928b2ba3 100644
--- a/pkgs/by-name/al/allure/package.nix
+++ b/pkgs/by-name/al/allure/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "allure";
-  version = "2.39.0";
+  version = "2.40.0";
 
   src = fetchurl {
     url = "https://github.com/allure-framework/allure2/releases/download/${finalAttrs.version}/allure-${finalAttrs.version}.tgz";
-    hash = "sha256-dDg/ZgacwPbsLQ/a0vHXYfExhPbNKJM0sdz8QjdzVmU=";
+    hash = "sha256-RXOO/8dGZ0DULqkTjoD8pQgedWbHCvypRwjZxVhdNCQ=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/au/autokey/package.nix b/pkgs/by-name/au/autokey/package.nix
index bfe5ebe550dd..99e85f089f4b 100644
--- a/pkgs/by-name/au/autokey/package.nix
+++ b/pkgs/by-name/au/autokey/package.nix
@@ -4,9 +4,12 @@
   fetchFromGitHub,
   wrapGAppsHook3,
   gobject-introspection,
+  imagemagick,
   gtksourceview3,
   libappindicator-gtk3,
   libnotify,
+  xautomation,
+  xwd,
   zenity,
   wmctrl,
 }:
@@ -19,12 +22,16 @@ python3Packages.buildPythonApplication (finalAttrs: {
   src = fetchFromGitHub {
     owner = "autokey";
     repo = "autokey";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-d1WJLqkdC7QgzuYdnxYhajD3DtCpgceWCAxGrk0KKew=";
   };
 
-  # Tests appear to be broken with import errors within the project structure
-  doCheck = false;
+  postPatch = ''
+    # pyrcc5 embeds resource mtimes; preserve normalized source mtimes for reproducible wheels.
+    substituteInPlace setup.py \
+      --replace-fail "shutil.copy(str(icon), str(target_directory))" \
+        "shutil.copy2(str(icon), str(target_directory))"
+  '';
 
   nativeBuildInputs = [
     wrapGAppsHook3
@@ -41,6 +48,22 @@ python3Packages.buildPythonApplication (finalAttrs: {
     setuptools
   ];
 
+  nativeCheckInputs = with python3Packages; [
+    pyqt5
+    pyhamcrest
+    pytestCheckHook
+    pytest-cov-stub
+  ];
+
+  disabledTestPaths = [
+    # Runs `git describe` during test collection.
+    "tests/test_common.py"
+  ];
+
+  preCheck = ''
+    export HOME=$TMPDIR
+  '';
+
   dependencies = with python3Packages; [
     dbus-python
     pyinotify
@@ -51,7 +74,10 @@ python3Packages.buildPythonApplication (finalAttrs: {
   ];
 
   runtimeDeps = [
+    imagemagick
     zenity
+    xautomation
+    xwd
     wmctrl
   ];
 
@@ -67,10 +93,11 @@ python3Packages.buildPythonApplication (finalAttrs: {
   '';
 
   meta = {
-    homepage = "https://github.com/autokey/autokey";
     description = "Desktop automation utility for Linux and X11";
-    license = with lib.licenses; [ gpl3 ];
-    maintainers = [ ];
+    homepage = "https://github.com/autokey/autokey";
+    changelog = "https://github.com/autokey/autokey/releases/tag/${finalAttrs.src.tag}";
+    license = with lib.licenses; [ gpl3Plus ];
+    maintainers = with lib.maintainers; [ iamanaws ];
     platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/by-name/ca/casacore/casacore-pkgconfig.patch b/pkgs/by-name/ca/casacore/casacore-pkgconfig.patch
new file mode 100644
index 000000000000..58b0e29adf9e
--- /dev/null
+++ b/pkgs/by-name/ca/casacore/casacore-pkgconfig.patch
@@ -0,0 +1,29 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 574150c05..109e96889 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -566,6 +566,14 @@ foreach (module ${_modules})
+ endforeach (module)
+ 
+ # Install pkg-config support file
++set(pc_req_public "")
++if (_usewcs AND WCSLIB_FOUND)
++    list(APPEND pc_req_public "wcslib")
++endif()
++if (_usefits AND CFITSIO_FOUND)
++    list(APPEND pc_req_public "cfitsio")
++endif()
++list(JOIN pc_req_public " " pc_req_public)
+ CONFIGURE_FILE("casacore.pc.in" "casacore.pc" @ONLY)
+ set(CASA_PKGCONFIG_INSTALL_PREFIX "${CMAKE_INSTALL_PREFIX}/lib/pkgconfig")
+ INSTALL(FILES "${CMAKE_CURRENT_BINARY_DIR}/casacore.pc" DESTINATION "${CASA_PKGCONFIG_INSTALL_PREFIX}")
+diff --git a/casacore.pc.in b/casacore.pc.in
+index 6881300df..d0a01b240 100644
+--- a/casacore.pc.in
++++ b/casacore.pc.in
+@@ -9,4 +9,4 @@ Version: @PROJECT_VERSION@
+ Requires: @pc_req_public@
+ Requires.private: @pc_req_private@
+ Libs: -L${libdir} @PRIVATE_LIBS@
+-Cflags: -I${includedir} -I@WCSLIB_INCLUDE_DIR@
++Cflags: -I${includedir}
diff --git a/pkgs/by-name/ca/casacore/package.nix b/pkgs/by-name/ca/casacore/package.nix
index dc1cae89fe07..5a026b41ba10 100644
--- a/pkgs/by-name/ca/casacore/package.nix
+++ b/pkgs/by-name/ca/casacore/package.nix
@@ -14,8 +14,33 @@
   fftwFloat,
   readline,
   gsl,
+  mpi,
+  adios2,
+  hdf5,
+  llvmPackages,
+  mpiSupport ? false,
+  adios2Support ? false,
+  hdf5Support ? false,
 }:
-
+let
+  casacorePackages = {
+    adios2 = adios2.override {
+      inherit mpi mpiSupport;
+    };
+    fftw = fftw.override {
+      inherit mpi;
+      enableMpi = mpiSupport;
+    };
+    fftwFloat = fftwFloat.override {
+      inherit mpi;
+      enableMpi = mpiSupport;
+    };
+    hdf5 = hdf5.override {
+      inherit mpi mpiSupport;
+      cppSupport = !mpiSupport;
+    };
+  };
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "casacore";
   version = "3.8.0";
@@ -27,31 +52,55 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-NOxuHMCuHGk9XuWXMwQTN6kOFDI0QuHMgfNRDdlPw44=";
   };
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     cmake
     gfortran
     flex
     bison
-  ];
+  ]
+  ++ lib.optional mpiSupport mpi;
+
+  propagatedBuildInputs = [
+    wcslib
+    cfitsio
+  ]
+  ++ lib.optional hdf5Support casacorePackages.hdf5
+  ++ lib.optional mpiSupport mpi
+  ++ lib.optional adios2Support casacorePackages.adios2;
 
   buildInputs = [
     blas
     lapack
-    cfitsio
-    wcslib
-    fftw
-    fftwFloat
+    casacorePackages.fftw
+    casacorePackages.fftwFloat
     readline
     gsl
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    llvmPackages.openmp
+  ];
+
+  patches = [
+    # Fix the generated .pc file: set Requires from a variable instead of
+    # leaving it empty, and remove hardcoded absolute cmake build paths from
+    # Cflags (which would embed /nix/store paths from the build environment).
+    ./casacore-pkgconfig.patch
   ];
 
   enableParallelBuilding = true;
 
-  strictDeps = true;
-
   cmakeFlags = [
     (lib.cmakeBool "ENABLE_SHARED" (!stdenv.hostPlatform.isStatic))
-    (lib.cmakeBool "BUILD_PYTHON3" false) # TODO: If/when we package python-casacore, this will change
+    (lib.cmakeBool "BUILD_PYTHON3" false)
+    (lib.cmakeBool "USE_OPENMP" true)
+    (lib.cmakeBool "USE_ADIOS2" adios2Support)
+    (lib.cmakeBool "USE_HDF5" hdf5Support)
+    (lib.cmakeBool "USE_MPI" mpiSupport)
+    (lib.cmakeBool "PORTABLE" true)
+    (lib.cmakeBool "USE_PCH" false)
+    (lib.cmakeBool "BUILD_FFTPACK_DEPRECATED" true) # Needed for casacpp
   ];
 
   meta = {
diff --git a/pkgs/by-name/ca/casacpp/casacpp-pkgconfig.patch b/pkgs/by-name/ca/casacpp/casacpp-pkgconfig.patch
new file mode 100644
index 000000000000..5856af18c55b
--- /dev/null
+++ b/pkgs/by-name/ca/casacpp/casacpp-pkgconfig.patch
@@ -0,0 +1,22 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 4d3cae2326..7954107f8f 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -195,6 +195,7 @@ foreach(_component IN LISTS casacpp_all_components)
+ endforeach()
+ 
+ # Install pkg-config support file
++set(pc_req_public "casacore cfitsio libxml-2.0 gsl protobuf grpc++ fftw3 libsakura")
+ CONFIGURE_FILE("casacpp.pc.in" "casacpp.pc" @ONLY)
+ set(CASACPP_PKGCONFIG_INSTALL_PREFIX "${CMAKE_INSTALL_PREFIX}/lib/pkgconfig")
+ INSTALL(FILES "${CMAKE_CURRENT_BINARY_DIR}/casacpp.pc" DESTINATION "${CASACPP_PKGCONFIG_INSTALL_PREFIX}")
+diff --git a/casacpp.pc.in b/casacpp.pc.in
+index 08a996b2c3..699cfb7319 100644
+--- a/casacpp.pc.in
++++ b/casacpp.pc.in
+@@ -9,4 +9,4 @@ Version: @PROJECT_VERSION@
+ Requires: @pc_req_public@
+ Requires.private: @pc_req_private@
+ Libs: -L${libdir} @PRIVATE_LIBS@
+-Cflags: -DWITHOUT_ACS -DWITHOUT_BOOST -I${includedir}/casacpp -I${includedir}/casacpp/protobuf_generated -I@CASACORE_INCLUDE_DIRS@ -I@CFITSIO_INCLUDE_DIRS@ -I@LibXML_INCLUDE_DIRS@ -I@GSL_INCLUDE_DIRS@
++Cflags: -DWITHOUT_ACS -DWITHOUT_BOOST -I${includedir}/casacpp -I${includedir}/casacpp/protobuf_generated
diff --git a/pkgs/by-name/ca/casacpp/package.nix b/pkgs/by-name/ca/casacpp/package.nix
new file mode 100644
index 000000000000..f495ec40a467
--- /dev/null
+++ b/pkgs/by-name/ca/casacpp/package.nix
@@ -0,0 +1,120 @@
+{
+  lib,
+  stdenv,
+  fetchgit,
+  cmake,
+  common-updater-scripts,
+  curl,
+  gnugrep,
+  writeShellScript,
+  pkg-config,
+  flex,
+  bison,
+  gfortran,
+  casacore,
+  libsakura,
+  grpc,
+  protobuf,
+  gsl,
+  libxml2,
+  libxslt,
+  fftw,
+  fftwFloat,
+  sqlite,
+  openssl,
+  mpi,
+  mpiSupport ? false,
+}:
+let
+  casacppPackages = {
+    fftw = fftw.override {
+      inherit mpi;
+      enableMpi = mpiSupport;
+    };
+    fftwFloat = fftwFloat.override {
+      inherit mpi;
+      enableMpi = mpiSupport;
+    };
+    casacore = casacore.override {
+      inherit mpi mpiSupport;
+    };
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "casacpp";
+  version = "6.7.5.18";
+
+  src = fetchgit {
+    url = "https://open-bitbucket.nrao.edu/scm/casa/casa6.git";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-75oIlaNAyu70KWSjz38LoYAvV7RJgzH/X9uBnGpriF4=";
+    fetchSubmodules = false;
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/casatools/src/code";
+
+  patches = [
+    # Fix the generated .pc file: set Requires from a variable instead of
+    # leaving it empty, and remove hardcoded absolute cmake build paths from
+    # Cflags (which would embed /nix/store paths from the build environment).
+    ./casacpp-pkgconfig.patch
+  ];
+
+  postPatch = ''
+    sed -i '/execute_process(COMMAND/,/OUTPUT_VARIABLE CASACPP_VERSION)/c\set(CASACPP_VERSION "${finalAttrs.version}")' CMakeLists.txt
+    sed -i 's/string(REGEX MATCH.*CASACPP_VERSION)//' CMakeLists.txt
+    substituteInPlace CMakeLists.txt \
+      --replace-fail \
+        'find_package(gRPC QUIET)' \
+        'set(gRPC_FOUND 0)'
+  '';
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    flex
+    bison
+    gfortran
+    grpc # for grpc_cpp_plugin
+  ]
+  ++ lib.optional mpiSupport mpi;
+
+  buildInputs = [
+    libxslt
+    sqlite
+    openssl
+  ];
+
+  propagatedBuildInputs = [
+    casacppPackages.casacore
+    protobuf
+    grpc
+    casacppPackages.fftw
+    casacppPackages.fftwFloat
+    libsakura
+    gsl
+    libxml2
+  ];
+
+  cmakeFlags = lib.optionals stdenv.hostPlatform.isDarwin [
+    (lib.cmakeFeature "CMAKE_CXX_FLAGS" "-ffp-contract=off")
+  ];
+
+  enableParallelBuilding = true;
+
+  passthru.updateScript = writeShellScript "update-casacpp" ''
+    version=$(${lib.getExe curl} -s https://pypi.org/pypi/casatasks/json | ${lib.getExe gnugrep} -oP '"version"\s*:\s*"\K[^"]+' | head -1)
+    ${lib.getExe' common-updater-scripts "update-source-version"} casacpp "$version"
+  '';
+
+  meta = {
+    description = "C++ core libraries for radio interferometry data reduction";
+    homepage = "https://casa.nrao.edu/";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ kiranshila ];
+  };
+})
diff --git a/pkgs/by-name/ca/castxml/package.nix b/pkgs/by-name/ca/castxml/package.nix
index 39ef0f3f3455..491db65d4317 100644
--- a/pkgs/by-name/ca/castxml/package.nix
+++ b/pkgs/by-name/ca/castxml/package.nix
@@ -19,13 +19,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "castxml";
-  version = "0.6.13";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "CastXML";
     repo = "CastXML";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-81I+Uh2HrEenp9iAW+TO+MUyXhXRMVDI+BZuVA4C/pE=";
+    hash = "sha256-nLYh6qb/dc+K1tsCVSm/iBzaJPtKPF1Q66yCpLFM6v4=";
   };
 
   nativeBuildInputs = [ cmake ] ++ lib.optionals (withManual || withHTML) [ sphinx ];
diff --git a/pkgs/by-name/co/coredns/package.nix b/pkgs/by-name/co/coredns/package.nix
index 19c6e7592d74..8fa46e05caa9 100644
--- a/pkgs/by-name/co/coredns/package.nix
+++ b/pkgs/by-name/co/coredns/package.nix
@@ -32,60 +32,61 @@ buildGoModule (finalAttrs: {
     "man"
   ];
 
-  # Override the go-modules fetcher derivation to fetch plugins
-  modBuildPhase = ''
-    cp plugin.cfg plugin.cfg.orig
-    ${
-      (lib.concatMapStringsSep "\n" (
-        plugin:
-        let
-          position = plugin.position or "end-of-file";
-          formatPlugin = { name, repo, ... }: "${name}:${repo}";
-        in
-        if position == "end-of-file" then
-          "echo '${formatPlugin plugin}' >> plugin.cfg"
-        else if position == "start-of-file" then
-          "sed -i '1i ${formatPlugin plugin}' plugin.cfg"
-        else if lib.hasAttrByPath [ "before" ] position then
-          ''
-            if ! grep -q '^${position.before}:' plugin.cfg; then
-              echo 'Failed to insert ${plugin.name} before ${position.before} in plugin.cfg: ${position.before} is not in plugin.cfg'
-              exit 1
-            fi
-            sed -i '/^${position.before}:/i ${formatPlugin plugin}' plugin.cfg
-          ''
-        else if lib.hasAttrByPath [ "after" ] position then
-          ''
-            if ! grep -q '^${position.after}:' plugin.cfg; then
-              echo 'Failed to insert ${plugin.name} after ${position.after} in plugin.cfg: ${position.after} is not in plugin.cfg'
-              exit 1
-            fi
-            sed -i '/^${position.after}:/a ${formatPlugin plugin}' plugin.cfg
-          ''
-        else
-          throw ''
-            Unsupported position value in externalPlugin:
-              ${builtins.toJSON plugin}.
-            Valid values for position attr are:
-              - position = "end-of-file" (the default)
-              - position = "start-of-file"
-              - position.before = "{other plugin}"
-              - position.after = "{other plugin}"
-          ''
-      ) externalPlugins)
-    }
-    diff -u plugin.cfg.orig plugin.cfg || true
-    for src in ${toString (attrsToSources externalPlugins)}; do go get $src; done
-    go mod vendor
-    CC= GOOS= GOARCH= go generate
-    go mod vendor
-    go mod tidy
-  '';
+  overrideModAttrs = {
+    # Add plugins before vendoring the modules.
+    preBuild = ''
+      cp plugin.cfg plugin.cfg.orig
+      ${
+        (lib.concatMapStringsSep "\n" (
+          plugin:
+          let
+            position = plugin.position or "end-of-file";
+            formatPlugin = { name, repo, ... }: "${name}:${repo}";
+          in
+          if position == "end-of-file" then
+            "echo '${formatPlugin plugin}' >> plugin.cfg"
+          else if position == "start-of-file" then
+            "sed -i '1i ${formatPlugin plugin}' plugin.cfg"
+          else if lib.hasAttrByPath [ "before" ] position then
+            ''
+              if ! grep -q '^${position.before}:' plugin.cfg; then
+                echo 'Failed to insert ${plugin.name} before ${position.before} in plugin.cfg: ${position.before} is not in plugin.cfg'
+                exit 1
+              fi
+              sed -i '/^${position.before}:/i ${formatPlugin plugin}' plugin.cfg
+            ''
+          else if lib.hasAttrByPath [ "after" ] position then
+            ''
+              if ! grep -q '^${position.after}:' plugin.cfg; then
+                echo 'Failed to insert ${plugin.name} after ${position.after} in plugin.cfg: ${position.after} is not in plugin.cfg'
+                exit 1
+              fi
+              sed -i '/^${position.after}:/a ${formatPlugin plugin}' plugin.cfg
+            ''
+          else
+            throw ''
+              Unsupported position value in externalPlugin:
+                ${builtins.toJSON plugin}.
+              Valid values for position attr are:
+                - position = "end-of-file" (the default)
+                - position = "start-of-file"
+                - position.before = "{other plugin}"
+                - position.after = "{other plugin}"
+            ''
+        ) externalPlugins)
+      }
+      diff -u plugin.cfg.orig plugin.cfg || true
+      for src in ${toString (attrsToSources externalPlugins)}; do go get $src; done
+      GOFLAGS=''${GOFLAGS//-mod=vendor/} CC= GOOS= GOARCH= go generate
+      go mod tidy
+    '';
 
-  modInstallPhase = ''
-    mv -t vendor go.mod go.sum plugin.cfg
-    cp -r --reflink=auto vendor "$out"
-  '';
+    # Move the modified `go.mod`, `go.sum`, and `plugin.cfg` files into the
+    # vendor directory so we can retrieve them later in the `preBuild` hook.
+    postBuild = ''
+      mv -t vendor go.mod go.sum plugin.cfg
+    '';
+  };
 
   preBuild = ''
     chmod -R u+w vendor
diff --git a/pkgs/by-name/da/daktari/optional-pyclip.patch b/pkgs/by-name/da/daktari/optional-pyclip.patch
new file mode 100644
index 000000000000..47bbb33d56c4
--- /dev/null
+++ b/pkgs/by-name/da/daktari/optional-pyclip.patch
@@ -0,0 +1,33 @@
+diff --git a/daktari/result_printer.py b/daktari/result_printer.py
+--- a/daktari/result_printer.py
++++ b/daktari/result_printer.py
+@@ -1,7 +1,11 @@
+ import re
+ import textwrap
+-import pyclip
+ from typing import Callable, Dict, Optional
+ 
++try:
++    import pyclip
++except ImportError:
++    pyclip = None
++
+ from colors import green, red, underline, yellow
+ 
+ from daktari.check import CheckResult, CheckStatus
+@@ -58,10 +62,13 @@ def copy_to_clipboard(suggestion: Optional[str]):
+         command_regex = re.compile(r"\<cmd\>(.*?)\<\/cmd\>")
+         results = command_regex.findall(suggestion)
+         if len(results) > 0:
+-            try:
+-                pyclip.copy("\n".join(results))
++            if pyclip is not None:
++                try:
++                    pyclip.copy("\n".join(results))
++                    print("ⓘ  Command copied to clipboard")
++                except pyclip.base.ClipboardSetupException:
+                     print("ⓘ  Clipboard not available")
++            else:
++                print("ⓘ  Clipboard not available")
+             return
+     print("ⓘ  No command available to copy to clipboard")
diff --git a/pkgs/by-name/da/daktari/package.nix b/pkgs/by-name/da/daktari/package.nix
new file mode 100644
index 000000000000..0079222b76d2
--- /dev/null
+++ b/pkgs/by-name/da/daktari/package.nix
@@ -0,0 +1,72 @@
+{
+  lib,
+  stdenv,
+  python3Packages,
+  fetchFromGitHub,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "daktari";
+  version = "0.0.319";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "genio-learn";
+    repo = "daktari";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-NxTDyul1BESr/fBow9hwmTLr6jcl4p5RlIKNzFbaJvc=";
+  };
+
+  patches = [ ./optional-pyclip.patch ];
+
+  pythonRelaxDeps = true;
+
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    # pyclip is broken on macOS in nixpkgs
+    substituteInPlace requirements.txt --replace-fail "pyclip==0.7.0" ""
+  '';
+
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  dependencies =
+    with python3Packages;
+    [
+      ansicolors
+      distro
+      pyfiglet
+      importlib-resources
+      packaging
+      requests
+      responses
+      semver
+      python-hosts
+      pyyaml
+      types-pyyaml
+      requests-unixsocket
+      dpath
+      pyopenssl
+      types-pyopenssl
+      urllib3
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      pyclip
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      pyobjc-core
+      pyobjc-framework-Cocoa
+    ];
+
+  pythonImportsCheck = [ "daktari" ];
+
+  meta = {
+    description = "Tool to assist in setting up and maintaining developer environments";
+    homepage = "https://github.com/genio-learn/daktari";
+    changelog = "https://github.com/genio-learn/daktari/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ tymscar ];
+    mainProgram = "daktari";
+  };
+})
diff --git a/pkgs/by-name/da/darkstat/package.nix b/pkgs/by-name/da/darkstat/package.nix
index b907988a7a81..4b62f528da2f 100644
--- a/pkgs/by-name/da/darkstat/package.nix
+++ b/pkgs/by-name/da/darkstat/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "darkstat";
-  version = "3.0.721";
+  version = "3.0.722";
 
   src = fetchFromGitHub {
     owner = "emikulic";
     repo = "darkstat";
     tag = finalAttrs.version;
-    hash = "sha256-kKj4fCgphoe3lojJfARwpITxQh7E6ehUew9FVEW63uQ=";
+    hash = "sha256-WJjunJx9WjzRky1FL0k25h84Ypv273KXR5qT5YhHmbs=";
   };
 
   patches = [
@@ -54,6 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/emikulic/darkstat/releases/tag/${finalAttrs.version}";
     license = lib.licenses.gpl2Only;
     platforms = with lib.platforms; unix;
+    maintainers = with lib.maintainers; [ tbutter ];
     mainProgram = "darkstat";
   };
 })
diff --git a/pkgs/by-name/da/dashy-ui/package.nix b/pkgs/by-name/da/dashy-ui/package.nix
index 5d9f0714653e..c3bfe85af7cf 100644
--- a/pkgs/by-name/da/dashy-ui/package.nix
+++ b/pkgs/by-name/da/dashy-ui/package.nix
@@ -9,24 +9,24 @@
   fixup-yarn-lock,
   prefetch-yarn-deps,
   nixosTests,
-  nodejs_20,
-  nodejs-slim_20,
+  nodejs_24,
+  nodejs-slim_24,
   remarshal_0_17,
   nix-update-script,
   settings ? { },
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "dashy-ui";
-  version = "3.3.1";
+  version = "4.0.5";
   src = fetchFromGitHub {
     owner = "lissy93";
     repo = "dashy";
     tag = finalAttrs.version;
-    hash = "sha256-EvyRLa+qUFPzmU2k5CVK8WH3D3vmcj9F8fzj3LEjYgg=";
+    hash = "sha256-vcNKnRcSQMU4AuvWTFdTlxVOAA0rlPCKUrDZbd+8/mk=";
   };
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-EMns5J8rM4qOfrACoX6lttOXh/RUtZjaKtd+BpsS6Xs=";
+    hash = "sha256-1FRrhNKm38/AP30F6Rf0cCHflIK9bWoxUCMMiT5c1Fc=";
   };
 
   passthru = {
@@ -56,17 +56,17 @@ stdenv.mkDerivation (finalAttrs: {
     # but they've been overridden for the sake of consistency/in case future updates to dashy/node would cause issues with differing major versions
     (yarnConfigHook.override {
       fixup-yarn-lock = fixup-yarn-lock.override {
-        nodejs-slim = nodejs-slim_20;
+        nodejs-slim = nodejs-slim_24;
       };
       prefetch-yarn-deps = prefetch-yarn-deps.override {
-        nodejs-slim = nodejs-slim_20;
+        nodejs-slim = nodejs-slim_24;
       };
       yarn = yarn.override {
-        nodejs = nodejs_20;
+        nodejs = nodejs_24;
       };
     })
     yarnBuildHook
-    nodejs_20
+    nodejs_24
     # For yaml conversion
     remarshal_0_17
   ];
diff --git a/pkgs/by-name/da/dawarich/0001-build-ffi-gem.diff b/pkgs/by-name/da/dawarich/0001-build-ffi-gem.diff
index 52544314e79e..c05bb7d61c4c 100644
--- a/pkgs/by-name/da/dawarich/0001-build-ffi-gem.diff
+++ b/pkgs/by-name/da/dawarich/0001-build-ffi-gem.diff
@@ -1,8 +1,8 @@
 diff --git a/Gemfile.lock b/Gemfile.lock
-index 9a7c7500..9215d45a 100644
+index d8d04266..75b34a35 100644
 --- a/Gemfile.lock
 +++ b/Gemfile.lock
-@@ -191,12 +191,7 @@ GEM
+@@ -194,12 +194,7 @@ GEM
      faraday-net_http (3.4.2)
        net-http (~> 0.5)
      ffaker (2.25.0)
@@ -15,4 +15,4 @@ index 9a7c7500..9215d45a 100644
 +    ffi (1.17.2)
      fit4ruby (3.13.0)
        bindata (~> 2.4.14)
-     foreman (0.90.0)
+     flipper (1.4.1)
diff --git a/pkgs/by-name/da/dawarich/0002-openssl-hotfix.diff b/pkgs/by-name/da/dawarich/0002-openssl-hotfix.diff
deleted file mode 100644
index a17bea34279e..000000000000
--- a/pkgs/by-name/da/dawarich/0002-openssl-hotfix.diff
+++ /dev/null
@@ -1,32 +0,0 @@
-diff --git a/Gemfile b/Gemfile
-index 36cf0d9c..fc914849 100644
---- a/Gemfile
-+++ b/Gemfile
-@@ -28,6 +28,7 @@ gem 'omniauth-github', '~> 2.0.0'
- gem 'omniauth-google-oauth2'
- gem 'omniauth_openid_connect'
- gem 'omniauth-rails_csrf_protection'
-+gem 'openssl'
- gem 'parallel'
- gem 'pg'
- gem 'prometheus_exporter'
-diff --git a/Gemfile.lock b/Gemfile.lock
-index a32eb801..b2fc45bc 100644
---- a/Gemfile.lock
-+++ b/Gemfile.lock
-@@ -348,6 +348,7 @@ GEM
-       tzinfo
-       validate_url
-       webfinger (~> 2.0)
-+    openssl (3.3.1)
-     optimist (3.2.1)
-     orm_adapter (0.5.0)
-     ostruct (0.6.1)
-@@ -665,6 +666,7 @@ DEPENDENCIES
-   omniauth-google-oauth2
-   omniauth-rails_csrf_protection
-   omniauth_openid_connect
-+  openssl
-   parallel
-   pg
-   prometheus_exporter
diff --git a/pkgs/by-name/da/dawarich/gemset.nix b/pkgs/by-name/da/dawarich/gemset.nix
index 24a5a03a7742..569b6969fe74 100644
--- a/pkgs/by-name/da/dawarich/gemset.nix
+++ b/pkgs/by-name/da/dawarich/gemset.nix
@@ -249,6 +249,21 @@
     };
     version = "1.1.0";
   };
+  apple_id = {
+    dependencies = [
+      "json-jwt"
+      "openid_connect"
+      "rack-oauth2"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0na7v2gb10lwhjrwb1nm6cgnggihzhnznzv3ha9qy3jq7gys41cw";
+      type = "gem";
+    };
+    version = "1.6.4";
+  };
   ast = {
     groups = [
       "default"
@@ -410,10 +425,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "19y406nx17arzsbc515mjmr6k5p59afprspa1k423yd9cp8d61wb";
+      sha256 = "1g9zi8c4i7g8zz0c3hxrw6mblrjvgn7akys60clb9si7c1k1gljk";
       type = "gem";
     };
-    version = "4.0.1";
+    version = "4.1.2";
   };
   bindata = {
     groups = [ "default" ];
@@ -431,10 +446,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "14qb2gy6ypnqri92v9x8szbq7fzw27pc1z5cl367n5f5cpd2rmks";
+      sha256 = "057jsch213i42qgdsz2vg1b190n2xvvbi3hgprc8nmaqim2ly9f1";
       type = "gem";
     };
-    version = "1.20.1";
+    version = "1.23.0";
   };
   brakeman = {
     dependencies = [ "racc" ];
@@ -623,25 +638,15 @@
     };
     version = "0.15.0";
   };
-  css-zero = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1jiihfxvfw0wl42m0jzpq94iqa2ra878dqllkk34w49pv0wsgrkz";
-      type = "gem";
-    };
-    version = "1.1.15";
-  };
   csv = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1kfqg0m6vqs6c67296f10cr07im5mffj90k2b5dsm51liidcsvp9";
+      sha256 = "0gz7r2kazwwwyrwi95hbnhy54kwkfac5swh2gy5p5vw36fn38lbf";
       type = "gem";
     };
-    version = "3.3.4";
+    version = "3.3.5";
   };
   data_migrate = {
     dependencies = [
@@ -867,10 +872,10 @@
     ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1rcpq49pyaiclpjp3c3qjl25r95hqvin2q2dczaynaj7qncxvv18";
+      sha256 = "1ncmbdjf2bwmk0jf5cxywns9zbxyfiy4h4p3pzi7yddyjhv81qrq";
       type = "gem";
     };
-    version = "6.0.1";
+    version = "6.0.4";
   };
   erubi = {
     groups = [
@@ -1013,6 +1018,49 @@
     };
     version = "3.13.0";
   };
+  flipper = {
+    dependencies = [ "concurrent-ruby" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0kbf2r2ayb91d1i0lbpj418pcv33dc24pqs9fl1wg4rhzd035105";
+      type = "gem";
+    };
+    version = "1.4.1";
+  };
+  flipper-active_record = {
+    dependencies = [
+      "activerecord"
+      "flipper"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0dss4hhnw6ypn2yh0cq2yi08cwvkv0kqjxxih7214slps0d4i5si";
+      type = "gem";
+    };
+    version = "1.4.1";
+  };
+  flipper-ui = {
+    dependencies = [
+      "erubi"
+      "flipper"
+      "rack"
+      "rack-protection"
+      "rack-session"
+      "sanitize"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "168agvgc6skln31x3r5ic5c6varc3m5b1gxnpkxq5p9gslvm53mp";
+      type = "gem";
+    };
+    version = "1.4.1";
+  };
   foreman = {
     dependencies = [ "thor" ];
     groups = [ "development" ];
@@ -1065,6 +1113,17 @@
     };
     version = "1.3.0";
   };
+  google-id-token = {
+    dependencies = [ "jwt" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1lb9iqzx0fi2f4x2m9dwimpfvxqz3ck73gx9sh8mb88klbhyp26h";
+      type = "gem";
+    };
+    version = "1.4.2";
+  };
   gpx = {
     dependencies = [
       "csv"
@@ -1075,10 +1134,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1cgm6dzzpslhgxcqcgqnpvargrq9d3v2xhxgan1l1cayc33pn837";
+      sha256 = "06p5wkyj6lcj01szv22g1jcx8qkkpc4cypj9hdmji9n9h5ipd8bq";
       type = "gem";
     };
-    version = "1.2.1";
+    version = "1.2.2";
   };
   groupdate = {
     dependencies = [ "activesupport" ];
@@ -1207,6 +1266,7 @@
   irb = {
     dependencies = [
       "pp"
+      "prism"
       "rdoc"
       "reline"
     ];
@@ -1232,10 +1292,10 @@
     ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "01h8bdksg0cr8bw5dhlhr29ix33rp822jmshy6rdqz4lmk4mdgia";
+      sha256 = "1qs8a9vprg7s8krgq4s0pygr91hclqqyz98ik15p0m1sf2h5956y";
       type = "gem";
     };
-    version = "1.16.0";
+    version = "1.18.0";
   };
   jmespath = {
     groups = [ "default" ];
@@ -1428,10 +1488,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1rk0n13c9nmk8di2x5gqk5r04vf8bkp7ff6z0b44wsmc7fndfpnz";
+      sha256 = "011fdngxzr1p9dq2hxqz7qq1glj2g44xnhaadjqlf48cplywfdnl";
       type = "gem";
     };
-    version = "2.25.0";
+    version = "2.25.1";
   };
   mail = {
     dependencies = [
@@ -1528,10 +1588,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0gdwmn2d4sznjdxyl3kz7hr95mvdgm38fk1vd0s63k3fdyamfvnv";
+      sha256 = "1wfnqyfayx9n9j7x871v2ars4hjhfisi1dl24fa64ylq3mns6ghm";
       type = "gem";
     };
-    version = "6.0.2";
+    version = "6.0.6";
   };
   msgpack = {
     groups = [ "default" ];
@@ -1627,10 +1687,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1a9www524fl1ykspznz54i0phfqya4x45hqaz67in9dvw1lfwpfr";
+      sha256 = "18fwy5yqnvgixq3cn0h63lm8jaxsjjxkmj8rhiv8wpzv9271d43c";
       type = "gem";
     };
-    version = "2.7.4";
+    version = "2.7.5";
   };
   nokogiri = {
     dependencies = [
@@ -1646,10 +1706,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "15anyh2ir3kdji93kw770xxwm5rspn9rzx9b9zh1h9gnclcd4173";
+      sha256 = "1s30b7h7qpyim30m8060xs415mbr3ci7i5hdg09chh1aqfx2qcbq";
       type = "gem";
     };
-    version = "1.19.0";
+    version = "1.19.3";
   };
   oauth2 = {
     dependencies = [
@@ -1796,16 +1856,6 @@
     };
     version = "2.3.1";
   };
-  openssl = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0dzq3k5hmqlav2mwf7bc10mr1mlmlnpin498g7jhbhpdpa324s6n";
-      type = "gem";
-    };
-    version = "3.3.1";
-  };
   optimist = {
     groups = [
       "default"
@@ -1839,20 +1889,6 @@
     };
     version = "0.6.1";
   };
-  pagy = {
-    dependencies = [
-      "json"
-      "yaml"
-    ];
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "08pikkvj916fw75l7ycmzb3gf1w9cp3h1jphls0pnqbphf1v3r4g";
-      type = "gem";
-    };
-    version = "43.2.2";
-  };
   parallel = {
     groups = [
       "default"
@@ -2091,10 +2127,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1pa9zpr51kqnsq549p6apvnr95s9flx6bnwqii24s8jg2b5i0p74";
+      sha256 = "1a3jd9qakasizrf7dkq5mqv51fjf02r2chybai2nskjaa6mz93mz";
       type = "gem";
     };
-    version = "7.1.0";
+    version = "7.2.0";
   };
   pundit = {
     dependencies = [ "activesupport" ];
@@ -2141,10 +2177,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1lyn3rh71rlf50p44xmsbha0pip4c95004j8kc9pm7xpq1s0kgac";
+      sha256 = "1hhjy9gcp52dzij05gmidqac8g28ski5xm67prwmdqmjfcgqxmsy";
       type = "gem";
     };
-    version = "3.2.5";
+    version = "3.2.6";
   };
   rack-attack = {
     dependencies = [ "rack" ];
@@ -2198,15 +2234,16 @@
     groups = [
       "default"
       "development"
+      "staging"
       "test"
     ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1sg4laz2qmllxh1c5sqlj9n1r7scdn08p3m4b0zmhjvyx9yw0v8b";
+      sha256 = "1s7zcxlmg88a6dam4aqbgk9xkpy6dkdfqmmcszkkliy3q3w38m2r";
       type = "gem";
     };
-    version = "2.1.1";
+    version = "2.1.2";
   };
   rack-test = {
     dependencies = [ "rack" ];
@@ -2290,15 +2327,16 @@
     groups = [
       "default"
       "development"
+      "staging"
       "test"
     ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0q55i6mpad20m2x1lg5pkqfpbmmapk0sjsrvr1sqgnj2hb5f5z1m";
+      sha256 = "128y5g3fyi8fds41jasrr4va1jrs7hcamzklk1523k7rxb64bc98";
       type = "gem";
     };
-    version = "1.6.2";
+    version = "1.7.0";
   };
   rails_icons = {
     dependencies = [
@@ -2314,25 +2352,6 @@
     };
     version = "1.4.0";
   };
-  rails_pulse = {
-    dependencies = [
-      "css-zero"
-      "groupdate"
-      "pagy"
-      "rails"
-      "ransack"
-      "request_store"
-      "turbo-rails"
-    ];
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1mla44nhcpr57i4dqir173b3jyzfpvy9prnzyz5nlf0ny3hysk5s";
-      type = "gem";
-    };
-    version = "0.2.4";
-  };
   railties = {
     dependencies = [
       "actionpack"
@@ -2381,25 +2400,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "175iisqb211n0qbfyqd8jz2g01q6xj038zjf4q0nm8k6kz88k7lc";
+      sha256 = "009p524zl0p0kfa65nii8wdmaigkmawv9pbvlcffky7islmmp0nb";
       type = "gem";
     };
-    version = "13.3.1";
-  };
-  ransack = {
-    dependencies = [
-      "activerecord"
-      "activesupport"
-      "i18n"
-    ];
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0gd6nwr0xlvgas21p1qgw90cg27xdi70988dw5q8a20rzhvarska";
-      type = "gem";
-    };
-    version = "4.4.1";
+    version = "13.4.2";
   };
   rdoc = {
     dependencies = [
@@ -2429,10 +2433,10 @@
     ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0qvky4s2fx5xbaz1brxanalqbcky3c7xbqd6dicpih860zgrjj29";
+      sha256 = "14iiyb4yi1chdzrynrk74xbhmikml3ixgdayjma3p700singfl46";
       type = "gem";
     };
-    version = "7.1.0";
+    version = "7.2.0";
   };
   redis = {
     dependencies = [ "redis-client" ];
@@ -2853,6 +2857,20 @@
     };
     version = "3.2.2";
   };
+  sanitize = {
+    dependencies = [
+      "crass"
+      "nokogiri"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "111r4xdcf6ihdnrs6wkfc6nqdzrjq0z69x9sf83r7ri6fffip796";
+      type = "gem";
+    };
+    version = "7.0.0";
+  };
   securerandom = {
     groups = [
       "default"
@@ -2893,24 +2911,25 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1rkp3wpikhwvypabw578rqk5660xkv741jl59dvk34h9b1z9g8g1";
+      sha256 = "1r5031qb02xmwmkrrz8ald4gc35xgcgz2h089873w33l5kcd9ygb";
       type = "gem";
     };
-    version = "6.2.0";
+    version = "6.5.0";
   };
   sentry-ruby = {
     dependencies = [
       "bigdecimal"
       "concurrent-ruby"
+      "logger"
     ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "05xcf7dwqd59nklk29r4dmdjjpy8hb19rccls5mm7l50ldca7f6p";
+      sha256 = "0srsbyw11h4gkr75vv4xcws8b9a9h7ii8wf3kb6syyh1d86swmrw";
       type = "gem";
     };
-    version = "6.2.0";
+    version = "6.5.0";
   };
   shoulda-matchers = {
     dependencies = [ "activesupport" ];
@@ -3433,16 +3452,6 @@
     };
     version = "3.2.0";
   };
-  yaml = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0hhr8z9m9yq2kf7ls0vf8ap1hqma1yd72y2r13b88dffwv8nj3i4";
-      type = "gem";
-    };
-    version = "0.4.0";
-  };
   zeitwerk = {
     groups = [
       "default"
@@ -3453,9 +3462,9 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "12zcvhzfnlghzw03czy2ifdlyfpq0kcbqcmxqakfkbxxavrr1vrb";
+      sha256 = "1pbkiwwla5gldgb3saamn91058nl1sq1344l5k36xsh9ih995nnq";
       type = "gem";
     };
-    version = "2.7.4";
+    version = "2.7.5";
   };
 }
diff --git a/pkgs/by-name/da/dawarich/package.nix b/pkgs/by-name/da/dawarich/package.nix
index 14e673531ebb..acd55e201bc0 100644
--- a/pkgs/by-name/da/dawarich/package.nix
+++ b/pkgs/by-name/da/dawarich/package.nix
@@ -35,10 +35,6 @@ stdenv.mkDerivation (finalAttrs: {
     patches = [
       # bundix and bundlerEnv fail with system-specific gems
       ./0001-build-ffi-gem.diff
-      # openssl 3.6.0 breaks ruby openssl gem
-      # See https://github.com/NixOS/nixpkgs/issues/456753
-      # and https://github.com/ruby/openssl/issues/949#issuecomment-3370358680
-      ./0002-openssl-hotfix.diff
     ];
     postPatch = ''
       substituteInPlace ./Gemfile \
@@ -114,7 +110,7 @@ stdenv.mkDerivation (finalAttrs: {
     # tests are not needed at runtime
     rm -rf spec e2e
     # delete artifacts from patching
-    rm *.orig
+    rm -f *.orig
 
     mkdir -p $out
     mv .{ruby*,app_version} $out/
diff --git a/pkgs/by-name/da/dawarich/sources.json b/pkgs/by-name/da/dawarich/sources.json
index a81affa1db83..cbe5e3e0a91d 100644
--- a/pkgs/by-name/da/dawarich/sources.json
+++ b/pkgs/by-name/da/dawarich/sources.json
@@ -1,5 +1,5 @@
 {
-  "version": "1.6.1",
-  "hash": "sha256-IPa8tfDsE3nNpzQ/Fnul3Fd6J5iQvLZR+3n4CHkVuI0=",
-  "npmHash": "sha256-Y6tEaApfGXAtmy0W85+4qGbrEkUkrKXTssl7wXeVnQY="
+  "version": "1.7.5",
+  "hash": "sha256-MjiU7IiAiCpKGbUexHjGl9yX8oLgX7WtVrN5yP6hXsk=",
+  "npmHash": "sha256-CwpVV5xLw75ReS0IqFvV3oaVk6EBlqYIKRa2KehVwFQ="
 }
diff --git a/pkgs/by-name/do/dockerfile-pin/package.nix b/pkgs/by-name/do/dockerfile-pin/package.nix
new file mode 100644
index 000000000000..6300d8438938
--- /dev/null
+++ b/pkgs/by-name/do/dockerfile-pin/package.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  makeWrapper,
+  docker-credential-helpers,
+  gitMinimal,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "dockerfile-pin";
+  version = "1.3.0";
+
+  src = fetchFromGitHub {
+    owner = "azu";
+    repo = "dockerfile-pin";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-vBBcLQ4ZgiLbUMuDvn8Um24yB9EknuUeU+sxMdg+qoc=";
+  };
+
+  vendorHash = "sha256-CgMFIYoM+nWiZ5NXtTlXHhrjzVYxoVg0YVpQq3LLrjI=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=github.com/azu/dockerfile-pin/cmd.version=${finalAttrs.version}"
+  ];
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  postFixup = ''
+    wrapProgram $out/bin/dockerfile-pin \
+      --prefix PATH : ${lib.makeBinPath [ docker-credential-helpers ]}
+  '';
+
+  nativeCheckInputs = [ gitMinimal ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "version";
+
+  passthru.updateScript = nix-update-script { };
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "Add sha256 digests to Docker images in Dockerfiles, Compose, and GitHub Actions";
+    homepage = "https://github.com/azu/dockerfile-pin";
+    changelog = "https://github.com/azu/dockerfile-pin/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ airrnot ];
+    mainProgram = "dockerfile-pin";
+  };
+})
diff --git a/pkgs/by-name/do/doctl/package.nix b/pkgs/by-name/do/doctl/package.nix
index 1549f863373d..4bff43e3673a 100644
--- a/pkgs/by-name/do/doctl/package.nix
+++ b/pkgs/by-name/do/doctl/package.nix
@@ -9,7 +9,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "doctl";
-  version = "1.155.0";
+  version = "1.157.0";
 
   vendorHash = null;
 
@@ -42,7 +42,7 @@ buildGoModule (finalAttrs: {
     owner = "digitalocean";
     repo = "doctl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sN/ZC3TAUiQokSZax3oF6LMl/H7lCCgtEjjcpy44aTY=";
+    hash = "sha256-pkMJg7lTPR2qQ+E5F7Cd0RA/81x5tDvB7zXyzGn2BcM=";
   };
 
   meta = {
diff --git a/pkgs/applications/misc/dupeguru/default.nix b/pkgs/by-name/du/dupeguru/package.nix
similarity index 72%
rename from pkgs/applications/misc/dupeguru/default.nix
rename to pkgs/by-name/du/dupeguru/package.nix
index 06af2c764027..beafc8424f88 100644
--- a/pkgs/applications/misc/dupeguru/default.nix
+++ b/pkgs/by-name/du/dupeguru/package.nix
@@ -4,42 +4,40 @@
   python3Packages,
   gettext,
   qt5,
+  writableTmpDirAsHomeHook,
   fetchFromGitHub,
 }:
-
-python3Packages.buildPythonApplication rec {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "dupeguru";
-  version = "4.3.1";
+  version = "4.3.1-unstable-2026-01-06";
 
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "arsenetar";
     repo = "dupeguru";
-    rev = version;
-    hash = "sha256-/jkZiCapmCLMp7WfgUmpsR8aNCfb3gBELlMYaC4e7zI=";
+    rev = "16aa6c21ffc2c33d44ff4a47bfa1a623c16ed626";
+    hash = "sha256-0x2ZpjaxpWVhm9vimDA06y1BOvpoU6KZYz5MPAoWAts=";
   };
 
-  patches = [
-    ./remove-setuptools-sandbox.patch
-  ];
-
   nativeBuildInputs = [
     gettext
     python3Packages.pyqt5
     python3Packages.setuptools
+    python3Packages.sphinx
     qt5.wrapQtAppsHook
+    writableTmpDirAsHomeHook
   ];
 
   propagatedBuildInputs = with python3Packages; [
-    hsaudiotag3k
+    distro
     mutagen
     polib
     pyqt5
     pyqt5-sip
     semantic-version
     send2trash
-    sphinx
+    xxhash
   ];
 
   makeFlags = [
@@ -51,13 +49,11 @@ python3Packages.buildPythonApplication rec {
     pytestCheckHook
   ];
 
-  preCheck = ''
-    export HOME="$(mktemp -d)"
-  '';
-
   # Avoid double wrapping Python programs.
   dontWrapQtApps = true;
 
+  installTargets = "install installdocs";
+
   # TODO: A bug in python wrapper
   # see https://github.com/NixOS/nixpkgs/pull/75054#discussion_r357656916
   preFixup = ''
@@ -74,9 +70,10 @@ python3Packages.buildPythonApplication rec {
     broken = stdenv.hostPlatform.isDarwin;
     description = "GUI tool to find duplicate files in a system";
     homepage = "https://github.com/arsenetar/dupeguru";
-    license = lib.licenses.bsd3;
+    changelog = "https://github.com/arsenetar/dupeguru/releases/tag/${builtins.head (lib.strings.splitString "-" finalAttrs.version)}";
+    license = lib.licenses.gpl3;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ novoxd ];
     mainProgram = "dupeguru";
   };
-}
+})
diff --git a/pkgs/by-name/fa/fairywren/package.nix b/pkgs/by-name/fa/fairywren/package.nix
index bfd0043cffd6..5228890bf1c8 100644
--- a/pkgs/by-name/fa/fairywren/package.nix
+++ b/pkgs/by-name/fa/fairywren/package.nix
@@ -22,13 +22,13 @@ lib.checkListOfEnum "${pname}: colorVariants" colorVariantList colorVariants
   stdenvNoCC.mkDerivation
   {
     inherit pname;
-    version = "0-unstable-2026-04-27";
+    version = "0-unstable-2026-05-06";
 
     src = fetchFromGitLab {
       owner = "aiyahm";
       repo = "FairyWren-Icons";
-      rev = "480e57a9ee90f8de05189f92dc5651fced9bc913";
-      hash = "sha256-1iz7Sv4XjoFcpo7XqB5iRHmki0hPE0kqqkH+ATVTPpY=";
+      rev = "ea33df10bcc0054b1981f859dcbcc36a77de9107";
+      hash = "sha256-Y4siWzKOmHBATSeoJ+Y5FbntsJYLFp8nmMcQq/UQGXw=";
     };
 
     propagatedBuildInputs = [
diff --git a/pkgs/by-name/fi/fish/disable_suid_test.patch b/pkgs/by-name/fi/fish/disable_suid_test.patch
index bfbfe5797985..ab22ee08b6e2 100644
--- a/pkgs/by-name/fi/fish/disable_suid_test.patch
+++ b/pkgs/by-name/fi/fish/disable_suid_test.patch
@@ -1,17 +1,37 @@
-diff --git a/tests/checks/path.fish b/tests/checks/path.fish
-index 62812571a..b0eebcd91 100644
---- a/tests/checks/path.fish
-+++ b/tests/checks/path.fish
-@@ -117,12 +117,6 @@ path filter --type file,dir --perm exec,write bin/fish .
+diff --git i/tests/checks/path.fish w/tests/checks/path.fish
+index 4bf14878e..4024c6d34 100644
+--- i/tests/checks/path.fish
++++ w/tests/checks/path.fish
+@@ -135,32 +135,6 @@ path filter --type file,dir --perm exec,write bin/fish .
  # So it passes.
  # CHECK: .
  
 -mkdir -p sbin
 -touch sbin/setuid-exe sbin/setgid-exe
--chmod u+s,a+x sbin/setuid-exe
--path filter --perm suid sbin/*
+-
+-# Without POSIX permission, there is no way to set the setuid bit, so fake
+-# the output.
+-if set -q noacl
+-    echo sbin/setuid-exe
+-else
+-    chmod u+s,a+x sbin/setuid-exe
+-    path filter --perm suid sbin/*
+-end
 -# CHECK: sbin/setuid-exe
 -
- # On at least FreeBSD on our CI this fails with "permission denied".
- # So we can't test it, and we fake the output instead.
- if chmod g+s,a+x sbin/setgid-exe 2>/dev/null
+-# Without POSIX permission, there is no way to set the setgid bit, so fake
+-# the result.
+-# And on at least FreeBSD on our CI this fails with "permission denied".
+-# So we can't test it, and we fake the output there too.
+-if set -q noacl
+-    echo sbin/setgid-exe
+-else if chmod g+s,a+x sbin/setgid-exe 2>/dev/null
+-    path filter --perm sgid sbin/*
+-else
+-    echo sbin/setgid-exe
+-end
+-# CHECK: sbin/setgid-exe
+-
+ mkdir stuff
+ touch stuff/{read,write,exec,readwrite,readexec,writeexec,all,none}
+ if set -q noacl
diff --git a/pkgs/by-name/fi/fish/package.nix b/pkgs/by-name/fi/fish/package.nix
index 9ecccf3a9402..d6eead7cd42e 100644
--- a/pkgs/by-name/fi/fish/package.nix
+++ b/pkgs/by-name/fi/fish/package.nix
@@ -148,13 +148,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "fish";
-  version = "4.6.0";
+  version = "4.7.0";
 
   src = fetchFromGitHub {
     owner = "fish-shell";
     repo = "fish-shell";
     tag = finalAttrs.version;
-    hash = "sha256-lhixotjhD8+xb8Hw6Mu1uJPtCq0zlQsBAXpHRzT+moI=";
+    hash = "sha256-LzpWSxhUMcJytxUoD7SZyLc/+hiL6CAyL/0FNbvBk1M=";
   };
 
   env = {
@@ -167,7 +167,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src patches;
-    hash = "sha256-zua2O3eGi7dXh4w0IoUGL2RxvGIW0O3WpVg/tT8942Q=";
+    hash = "sha256-WS7FWws1dIuVM9gE1PBnDZpUcRu96fWR80Az4Q+tZpI=";
   };
 
   patches = [
@@ -238,7 +238,8 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace share/functions/grep.fish \
       --replace-fail "command grep" "command ${lib.getExe gnugrep}"
 
-    substituteInPlace share/completions/{sudo.fish,doas.fish} \
+    substituteInPlace share/completions/doas.fish \
+      share/functions/__fish_complete_sudo.fish \
       --replace-fail "/usr/local/sbin /sbin /usr/sbin" ""
   ''
   + lib.optionalString usePython ''
diff --git a/pkgs/by-name/ga/gat/package.nix b/pkgs/by-name/ga/gat/package.nix
index 8a5b783ecd8d..2baf051172c4 100644
--- a/pkgs/by-name/ga/gat/package.nix
+++ b/pkgs/by-name/ga/gat/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gat";
-  version = "0.27.1";
+  version = "0.27.2";
 
   src = fetchFromGitHub {
     owner = "koki-develop";
     repo = "gat";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8+IpVMbV+1aXNZoIWVZF/GDsLh2G1rHudkyifguGl0g=";
+    hash = "sha256-3qm9kvAL522QCK7nXIWywdHFfxeuCJ9pukpd2ehIBis=";
   };
 
-  vendorHash = "sha256-UUFfM51toafSxK+x7Q7c9wPDiO22f7YfLc05u3uWLAE=";
+  vendorHash = "sha256-4RswVTjVF9pF7u94BbYIP0ukaKkPrTriSbPHOhhrJuI=";
 
   env.CGO_ENABLED = 0;
 
diff --git a/pkgs/by-name/gp/gpac/package.nix b/pkgs/by-name/gp/gpac/package.nix
index 4c771852ffae..8481df4a695d 100644
--- a/pkgs/by-name/gp/gpac/package.nix
+++ b/pkgs/by-name/gp/gpac/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
   gitUpdater,
   unstableGitUpdater,
   cctools,
@@ -39,28 +40,17 @@
 
 let
   stable = rec {
-    version = "2.4.0"; # See below TODO.
+    version = "26.02.0";
     src = fetchFromGitHub {
       owner = "gpac";
       repo = "gpac";
       rev = "v${version}";
-      hash = "sha256-RADDqc5RxNV2EfRTzJP/yz66p0riyn81zvwU3r9xncM=";
+      hash = "sha256-UtL+KG3dsp6dD7cfTK7e17ngt/RHKJL0s5IopTM3VOk=";
     };
     updateScript = gitUpdater {
-      odd-unstable = true;
       rev-prefix = "v";
       ignoredVersions = "^(abi|test)";
     };
-  }
-  // {
-    # ffmpeg 7.0.2 works, but 7.1.1 (which is packaged in nixpkgs) doesn't
-    # because v2.4.0 of this package relies on internal private ffmpeg fields.
-    # TODO: remove this, and switch to simply using ffmpeg-headless,
-    #       when updating stable to 2.6
-    ffmpeg-headless = ffmpeg-headless.override {
-      version = "7.0.2";
-      hash = "sha256-6bcTxMt0rH/Nso3X7zhrFNkkmWYtxsbUqVQKh25R1Fs=";
-    };
   };
   unstable = {
     version = "26.02.0-unstable-2026-04-29";
@@ -74,7 +64,6 @@ let
       tagFormat = "v*";
       tagPrefix = "v";
     };
-    inherit ffmpeg-headless;
   };
   channelToUse = if releaseChannel == "unstable" then unstable else stable;
 in
@@ -89,7 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
     cctools
   ]
   ++ lib.optionals withFfmpeg [
-    channelToUse.ffmpeg-headless
+    ffmpeg-headless
   ];
 
   # ref: https://wiki.gpac.io/Build/build/GPAC-Build-Guide-for-Linux/#gpac-easy-build-recommended-for-most-users
@@ -122,6 +111,14 @@ stdenv.mkDerivation (finalAttrs: {
     curl
   ];
 
+  patches = lib.optionals (releaseChannel == "stable") [
+    (fetchpatch2 {
+      # CVE-2026-7135 fix
+      url = "https://github.com/gpac/gpac/commit/cf6ac48c972eaaee2af270adc3f36615325deb3e.patch?full_index=1";
+      hash = "sha256-JaJiQAQvzdB74ag2/aZTiQa2NqlgqgMYS1tsk/R+wiI=";
+    })
+  ];
+
   enableParallelBuilding = true;
 
   passthru.updateScript = channelToUse.updateScript;
diff --git a/pkgs/by-name/gr/grafana-to-ntfy/package.nix b/pkgs/by-name/gr/grafana-to-ntfy/package.nix
index 498ef0b25a47..1b1c72cf0553 100644
--- a/pkgs/by-name/gr/grafana-to-ntfy/package.nix
+++ b/pkgs/by-name/gr/grafana-to-ntfy/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "grafana-to-ntfy";
-  version = "2026.4.29";
+  version = "2026.5.2";
 
   src = fetchFromGitHub {
     owner = "kittyandrew";
     repo = "grafana-to-ntfy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ac0T8SNCDH9kQTKIfYn9KinnrSCYIBpNByO6NQ8UntA=";
+    hash = "sha256-lbzo/+dQG5u+LfbnhUEL4KDjkod1kCWQ+m2Fsa2VrFo=";
   };
 
-  cargoHash = "sha256-RuWXlofcruR69sg+RO2v1DBgxaPEyu8TeZEiZP7rBV8=";
+  cargoHash = "sha256-vXicD4jUgaioK09oFBn3BgWDR3bzM7m5KStHr4Wqmfk=";
 
   # No unit tests; all testing is NixOS VM-based integration tests
   doCheck = false;
diff --git a/pkgs/by-name/gr/graphia/package.nix b/pkgs/by-name/gr/graphia/package.nix
deleted file mode 100644
index dfe38b62a56e..000000000000
--- a/pkgs/by-name/gr/graphia/package.nix
+++ /dev/null
@@ -1,45 +0,0 @@
-{
-  stdenv,
-  lib,
-  cmake,
-  git,
-  fetchFromGitHub,
-  qt6,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "graphia";
-  version = "5.2";
-
-  src = fetchFromGitHub {
-    owner = "graphia-app";
-    repo = "graphia";
-    rev = finalAttrs.version;
-    sha256 = "sha256-tS5oqpwpqvWGu67s8OuA4uQR3Zb5VzHTY/GnfVQki6k=";
-  };
-
-  nativeBuildInputs = [
-    cmake
-    git # needs to define some hash as a version
-    qt6.wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    qt6.qtbase
-    qt6.qtdeclarative
-    qt6.qtsvg
-    qt6.qtwebengine
-  ];
-
-  meta = {
-    # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/graphia.x86_64-darwin
-    broken =
-      (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) || stdenv.hostPlatform.isDarwin;
-    description = "Visualisation tool for the creation and analysis of graphs";
-    homepage = "https://graphia.app";
-    license = lib.licenses.gpl3Only;
-    mainProgram = "Graphia";
-    maintainers = [ lib.maintainers.bgamari ];
-    platforms = lib.platforms.all;
-  };
-})
diff --git a/pkgs/by-name/gv/gvm-libs/package.nix b/pkgs/by-name/gv/gvm-libs/package.nix
index ac7071c9d71d..6b33013f5935 100644
--- a/pkgs/by-name/gv/gvm-libs/package.nix
+++ b/pkgs/by-name/gv/gvm-libs/package.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gvm-libs";
-  version = "22.41.0";
+  version = "23.0.0";
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "gvm-libs";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6GYy+51Nw1zlppsMIYv4cH/yEMhxJ1lsLPgpsC4YRG4=";
+    hash = "sha256-WmHBR7BCkmyTx7l88lEV9aRrPFp1Dj+qh6bs23E6wnA=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/h2/h2/package.nix b/pkgs/by-name/h2/h2/package.nix
index 38144b2abc98..32684fe191d6 100644
--- a/pkgs/by-name/h2/h2/package.nix
+++ b/pkgs/by-name/h2/h2/package.nix
@@ -7,7 +7,7 @@
   nix-update-script,
 }:
 
-maven.buildMavenPackage rec {
+maven.buildMavenPackage (finalAttrs: {
   pname = "h2";
   version = "2.4.240";
 
@@ -19,7 +19,7 @@ maven.buildMavenPackage rec {
   src = fetchFromGitHub {
     owner = "h2database";
     repo = "h2database";
-    tag = "version-${version}";
+    tag = "version-${finalAttrs.version}";
     hash = "sha256-Cy6MoumJBhhcYT6dCHWeOfmhjGRkdNvSONdIiZaf6uU=";
   };
 
@@ -32,10 +32,10 @@ maven.buildMavenPackage rec {
 
   installPhase = ''
     mkdir -p $out/share/java
-    install -Dm644 h2/target/h2-${version}.jar $out/share/java
+    install -Dm644 h2/target/h2-${finalAttrs.version}.jar $out/share/java
 
     makeWrapper ${jre}/bin/java $out/bin/h2 \
-      --add-flags "-cp \"$out/share/java/h2-${version}.jar:\$H2DRIVERS:\$CLASSPATH\" org.h2.tools.Console"
+      --add-flags "-cp \"$out/share/java/h2-${finalAttrs.version}.jar:\$H2DRIVERS:\$CLASSPATH\" org.h2.tools.Console"
 
     mkdir -p $doc/share/doc/h2
     cp -r h2/src/docsrc/* $doc/share/doc/h2
@@ -60,4 +60,4 @@ maven.buildMavenPackage rec {
     ];
     mainProgram = "h2";
   };
-}
+})
diff --git a/pkgs/by-name/h2/h2o/package.nix b/pkgs/by-name/h2/h2o/package.nix
index c09184ce77d8..c4f27de15afc 100644
--- a/pkgs/by-name/h2/h2o/package.nix
+++ b/pkgs/by-name/h2/h2o/package.nix
@@ -24,13 +24,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "h2o";
-  version = "2.3.0-rolling-2026-04-15";
+  version = "2.3.0-rolling-2026-04-30";
 
   src = fetchFromGitHub {
     owner = "h2o";
     repo = "h2o";
-    rev = "4aa96860e99cc2a2e2777433949bb05aed678ebe";
-    hash = "sha256-0utcajHyLpP+MXwW12pGWd/E58jK5//Erq0dQmzBO5U=";
+    rev = "8cb324bd2d5efb1926d0b8408b1d367687e50cfa";
+    hash = "sha256-4GS2hQzBJXA0C9ClWGppocBdjO4BHDK2Balm0O8Ps/I=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/he/hello/package.nix b/pkgs/by-name/he/hello/package.nix
index 605a4dcf4717..e0b688917e46 100644
--- a/pkgs/by-name/he/hello/package.nix
+++ b/pkgs/by-name/he/hello/package.nix
@@ -14,6 +14,8 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "hello";
   version = "2.12.3";
 
+  __structuredAttrs = true;
+
   src = fetchurl {
     url = "mirror://gnu/hello/hello-${finalAttrs.version}.tar.gz";
     hash = "sha256-DV9gFUOC/uELEUocNOeF2LH0kgc64tOm97FHaHs2aqA=";
diff --git a/pkgs/by-name/hi/highscore-mgba/package.nix b/pkgs/by-name/hi/highscore-mgba/package.nix
index 4e95cb7b5208..72c52a4a2040 100644
--- a/pkgs/by-name/hi/highscore-mgba/package.nix
+++ b/pkgs/by-name/hi/highscore-mgba/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation {
   pname = "highscore-mgba";
-  version = "0-unstable-2026-04-26";
+  version = "0-unstable-2026-05-01";
 
   src = fetchFromGitHub {
     owner = "highscore-emu";
     repo = "mgba";
-    rev = "4a1ca6566fc1c0a67341ddadfc18011aa0a0578f";
-    hash = "sha256-zcRynN01O6zAcOuV/q9u7kL5elFTDJ2tA3wTJR3JBt0=";
+    rev = "eeb3cf0f34af549d9224dd75a1e6cb6361d09aeb";
+    hash = "sha256-yGUAnG8LnZ+hCV+uE1tGX2Zmp5Hriu7LQaWfXZTJqXk=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ii/iio-niri/package.nix b/pkgs/by-name/ii/iio-niri/package.nix
index 73fe38a5fe9f..de670bd7c06f 100644
--- a/pkgs/by-name/ii/iio-niri/package.nix
+++ b/pkgs/by-name/ii/iio-niri/package.nix
@@ -1,31 +1,41 @@
 {
   rustPlatform,
+  stdenv,
   lib,
   fetchFromGitHub,
   dbus,
   pkg-config,
+  installShellFiles,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "iio-niri";
-  version = "1.3.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "Zhaith-Izaliel";
     repo = "iio-niri";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tbCiG/u350U7UbYDV5gWczDQd//RosNHuzB/cP9Dyyo=";
+    hash = "sha256-foE+bPJANKWmPSt3s8BOqEIXGZoFNWRJT731xf5sr1M=";
   };
 
-  cargoHash = "sha256-JnjBnqZXRhxUClvC2hIW898AwwEOS/ELrsrjY2dV3Is=";
+  cargoHash = "sha256-y3Sv3JWg252XbuIqEioNagaQ99Vr9x1OfrFC6Jl4kSY=";
 
   nativeBuildInputs = [
     pkg-config
+    installShellFiles
   ];
 
   buildInputs = [
     dbus
   ];
 
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd iio-niri \
+      --bash <($out/bin/iio-niri completions bash) \
+      --zsh <($out/bin/iio-niri completions zsh) \
+      --fish <($out/bin/iio-niri completions fish)
+  '';
+
   meta = {
     description = "Listen to iio-sensor-proxy and updates Niri output orientation depending on the accelerometer orientation";
     homepage = "https://github.com/Zhaith-Izaliel/iio-niri";
diff --git a/pkgs/by-name/in/intel-llvm/unwrapped.nix b/pkgs/by-name/in/intel-llvm/unwrapped.nix
index e8f2094489d6..f01144744b3a 100644
--- a/pkgs/by-name/in/intel-llvm/unwrapped.nix
+++ b/pkgs/by-name/in/intel-llvm/unwrapped.nix
@@ -135,6 +135,12 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   cmakeBuildType = "Release";
+  # This is to shave a little bit of size off of the final NAR.
+  # Saves about 0.5GiB
+  # Note that the sum of all outputs needs to stay under 4GiB to be cached by Hydra.
+  # To check:
+  #  nix path-info --json --json-format 2 .#intel-llvm.unwrapped{,.lib,.dev,.python} | jq '[.. | .narSize? // empty] | add'
+  stripDebugFlags = [ "--strip-unneeded" ];
 
   patches = [
     # Fix paths so the output can be split properly
diff --git a/pkgs/by-name/kl/kloak/package.nix b/pkgs/by-name/kl/kloak/package.nix
new file mode 100644
index 000000000000..59b2c18c2e5f
--- /dev/null
+++ b/pkgs/by-name/kl/kloak/package.nix
@@ -0,0 +1,66 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  pkg-config,
+  which,
+  wayland-scanner,
+  ronn,
+  installShellFiles,
+  libevdev,
+  libsodium,
+  libinput,
+  wayland,
+  libxkbcommon,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "kloak";
+  version = "0.7.8-1";
+
+  src = fetchFromGitHub {
+    owner = "Whonix";
+    repo = "kloak";
+    tag = finalAttrs.version;
+    hash = "sha256-V9t7fQ3K5OIWKhvFiX5Hsf0WzAQUWiZojgbjc38Z1Nk=";
+  };
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    which
+    wayland-scanner
+    ronn
+    installShellFiles
+  ];
+
+  buildInputs = [
+    libevdev
+    libsodium
+    libinput
+    wayland
+    libxkbcommon
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D kloak $out/bin/kloak
+
+    ronn --roff man/kloak.8.ronn
+    installManPage man/kloak.8
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Privacy tool for anonymizing keyboard and mouse use";
+    homepage = "https://github.com/Whonix/kloak";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ sotormd ];
+    mainProgram = "kloak";
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/kr/krunkit/package.nix b/pkgs/by-name/kr/krunkit/package.nix
index fa0f6df93c4f..894231cb3ea1 100644
--- a/pkgs/by-name/kr/krunkit/package.nix
+++ b/pkgs/by-name/kr/krunkit/package.nix
@@ -13,18 +13,18 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "krunkit";
-  version = "1.1.1";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "krunkit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2O2v4etlXN61f8Goog+/e/6FTCtt7xSJnkq+w2KGxUM=";
+    hash = "sha256-T3PbSDaMqR/DLaTe1/tyMx/KseU5ENFzz1Gxd5/hRao=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
-    hash = "sha256-ckUunlnyf5BXq/EzFYPF8fI996/NgQaXUuVdOgfj1yk=";
+    hash = "sha256-Yb2jyK4UBJCeVXSKl4UABnlMj+7SKpOIi49tD/itHYo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libamplsolver/package.nix b/pkgs/by-name/li/libamplsolver/package.nix
index 129307101b48..e836cc9a5741 100644
--- a/pkgs/by-name/li/libamplsolver/package.nix
+++ b/pkgs/by-name/li/libamplsolver/package.nix
@@ -2,16 +2,19 @@
   lib,
   stdenv,
   substitute,
-  fetchurl,
+  fetchFromGitHub,
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "libamplsolver";
-  version = "20211109";
+  version = "1.0.1";
 
-  src = fetchurl {
-    url = "https://ampl.com/netlib/ampl/solvers.tgz";
-    sha256 = "sha256-LVmScuIvxmZzywPSBl9T9YcUBJP7UFAa3eWs9r4q3JM=";
+  src = fetchFromGitHub {
+    owner = "ampl";
+    repo = "asl";
+    rootDir = "src/solvers";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-D1hB5z6r4n6+u1oWclhIst1mXDvObmOsh1j0uocairQ=";
   };
 
   patches = [
@@ -25,6 +28,10 @@ stdenv.mkDerivation {
     })
   ];
 
+  preConfigure = ''
+    chmod u+x configure configurehere
+  '';
+
   env = {
     # For non-trapping FP architectures like loongarch64 and riscv64
     NIX_CFLAGS_COMPILE = lib.optionalString (
@@ -59,4 +66,4 @@ stdenv.mkDerivation {
     # generates header at compile time
     broken = !stdenv.buildPlatform.canExecute stdenv.hostPlatform;
   };
-}
+})
diff --git a/pkgs/by-name/li/libkrun-efi/package.nix b/pkgs/by-name/li/libkrun-efi/package.nix
index 4dd223a7ef52..2ab20562e614 100644
--- a/pkgs/by-name/li/libkrun-efi/package.nix
+++ b/pkgs/by-name/li/libkrun-efi/package.nix
@@ -20,13 +20,13 @@
   withGpu ? true,
 }:
 let
-  version = "1.17.4";
+  version = "1.18.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "libkrun";
     tag = "v${version}";
-    hash = "sha256-Th4vCg3xHb6lbo26IDZES7tLOUAJTebQK2+h3xSYX7U=";
+    hash = "sha256-R7q52ZwiL9JsGofLPhXVTk/eH6bEob3DoZe21PHSBrU=";
   };
 
   virglrenderer = stdenv.mkDerivation (finalAttrs: {
@@ -78,7 +78,7 @@ let
     buildPhase = ''
       runHook preBuild
       cd init
-      $CC -O2 -static -Wall -o init init.c
+      $CC -O2 -static -Wall -o init init.c dhcp.c
       runHook postBuild
     '';
 
@@ -100,7 +100,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src;
-    hash = "sha256-0xpAyNe1jF1OMtc7FXMsejqIv0xKc1ktEvm3rj/mVFU=";
+    hash = "sha256-3IAEWF+XGeKnb61SUpuVHMPiX6q0FgQFN4/eOBCH80c=";
   };
 
   nativeBuildInputs = [
@@ -124,8 +124,16 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optional withGpu "GPU=1";
 
-  preBuild = ''
-    cp ${initBinary}/init init/init
+  env.KRUN_INIT_BINARY_PATH = "${initBinary}/init";
+
+  postPatch = ''
+    substituteInPlace Makefile --replace-fail \
+      '$(LIBRARY_RELEASE_$(OS)): $(SYSROOT_TARGET) $(INIT_BINARY_BSD)' \
+      '$(LIBRARY_RELEASE_$(OS)):'
+  '';
+
+  postInstall = ''
+    ln -s $out/lib/libkrun-efi.dylib $out/lib/libkrun.dylib
   '';
 
   passthru = {
diff --git a/pkgs/by-name/li/libsakura/package.nix b/pkgs/by-name/li/libsakura/package.nix
new file mode 100644
index 000000000000..93183b65c521
--- /dev/null
+++ b/pkgs/by-name/li/libsakura/package.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  eigen,
+  fftw,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libsakura";
+  version = "5.3.2";
+
+  src = fetchFromGitHub {
+    owner = "tnakazato";
+    repo = "sakura";
+    tag = "${finalAttrs.pname}-${finalAttrs.version}";
+    hash = "sha256-QkVZXb9m4iMTeFYUOK1u+9HM0oMu48bwe7AovafanVU=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/${finalAttrs.pname}";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    eigen
+    fftw
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeFeature "SIMD_ARCH" "GENERIC")
+    (lib.cmakeBool "PYTHON_BINDING" false)
+    (lib.cmakeBool "BUILD_DOC" false)
+    (lib.cmakeBool "ENABLE_TEST" false)
+  ];
+
+  meta = {
+    homepage = "https://tnakazato.github.io/sakura/";
+    changelog = "https://github.com/tnakazato/sakura/releases/tag/${finalAttrs.pname}-${finalAttrs.version}";
+    description = "Thread-safe library for signal processing in radio astronomy";
+    maintainers = with lib.maintainers; [ kiranshila ];
+    license = lib.licenses.lgpl3Plus;
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/li/litecli/package.nix b/pkgs/by-name/li/litecli/package.nix
index f865ba5927ee..844ced7b232e 100644
--- a/pkgs/by-name/li/litecli/package.nix
+++ b/pkgs/by-name/li/litecli/package.nix
@@ -13,7 +13,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   src = fetchFromGitHub {
     owner = "dbcli";
     repo = "litecli";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-YSPNtDL5rNgRh5lJBKfL1jjWemlmf3eesBMSLyJVRLY=";
   };
 
@@ -47,13 +47,13 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   meta = {
     description = "Command-line interface for SQLite";
-    mainProgram = "litecli";
     longDescription = ''
       A command-line client for SQLite databases that has auto-completion and syntax highlighting.
     '';
     homepage = "https://litecli.com";
-    changelog = "https://github.com/dbcli/litecli/blob/v${finalAttrs.version}/CHANGELOG.md";
+    changelog = "https://github.com/dbcli/litecli/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ iamanaws ];
+    mainProgram = "litecli";
   };
 })
diff --git a/pkgs/by-name/ma/magicq/package.nix b/pkgs/by-name/ma/magicq/package.nix
new file mode 100644
index 000000000000..f345f67f38c1
--- /dev/null
+++ b/pkgs/by-name/ma/magicq/package.nix
@@ -0,0 +1,100 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  autoPatchelfHook,
+  copyDesktopItems,
+  makeDesktopItem,
+  dpkg,
+  alsa-lib-with-plugins,
+  ffmpeg_4,
+  libGL,
+  libGLU,
+  libarchive,
+  libgcc,
+  libsForQt5,
+  qt5,
+  libusb-compat-0_1,
+  libusb1,
+  libz,
+  portaudio,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "magicq";
+  version = "1.9.7.3";
+  src_version = builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version;
+
+  src = fetchurl {
+    url = "https://secure.chamsys.co.uk/downloads/v${finalAttrs.src_version}/magicq_ubuntu_v${finalAttrs.src_version}.deb";
+    hash = "sha256-FsVSt9iIhwL/wI2XYmKJrA7800wFQ2qJ/uF3bbMLw0Q=";
+  };
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    copyDesktopItems
+    dpkg
+    qt5.wrapQtAppsHook
+  ];
+  buildInputs = [
+    alsa-lib-with-plugins
+    ffmpeg_4
+    libGL
+    libGLU
+    libarchive
+    libgcc
+    libsForQt5.qt5.qtbase
+    libsForQt5.qt5.qtmultimedia
+    qt5.qtbase
+    libusb-compat-0_1
+    libusb1
+    libz
+    portaudio
+  ];
+
+  installPhase = ''
+    mkdir $out
+    cp -r . $out
+    rm -r $out/opt/magicq/lib
+    rm $out/opt/magicq/plugins/imageformats/libqtiff.so
+    rm $out/opt/magicq/plugins/printsupport/libcupsprintersupport.so
+    rm $out/opt/magicq/plugins/mediaservice/libgstcamerabin.so
+    mv $out/usr/share $out/share
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    mkdir $out/bin
+    makeWrapper $out/opt/magicq/bin/mqqt $out/bin/magicq \
+    --chdir $out/opt/magicq
+    wrapQtApp $out/bin/magicq
+    sed "s|@out@|$out|g" -i $out/share/applications/magicq.desktop
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "magicq";
+      desktopName = "MagicQ by ChamSys Ltd.";
+      genericName = "MagicQ";
+      exec = "@out@/bin/magicq";
+      path = "@out@/opt/magicq/";
+      icon = "magicq";
+      categories = [
+        "AudioVideo"
+        "Qt"
+      ];
+    })
+  ];
+
+  meta = {
+    description = "MagicQ Lighting Console Software";
+    homepage = "https://chamsyslighting.com/product/magicq-software/";
+    license = lib.licenses.unfree;
+    platforms = lib.platforms.linux;
+    mainProgram = "magicq";
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    maintainers = with lib.maintainers; [ panakotta00 ];
+  };
+})
diff --git a/pkgs/by-name/mi/microsoft-edge/package.nix b/pkgs/by-name/mi/microsoft-edge/package.nix
index 6068aee262e3..25532cf8274a 100644
--- a/pkgs/by-name/mi/microsoft-edge/package.nix
+++ b/pkgs/by-name/mi/microsoft-edge/package.nix
@@ -170,11 +170,11 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "microsoft-edge";
-  version = "147.0.3912.60";
+  version = "147.0.3912.98";
 
   src = fetchurl {
     url = "https://packages.microsoft.com/repos/edge/pool/main/m/microsoft-edge-stable/microsoft-edge-stable_${finalAttrs.version}-1_amd64.deb";
-    hash = "sha256-fb7BkPuiP3KjLw4h6idyMiaMuesVLseTgblLnz6ZfTU=";
+    hash = "sha256-GD5bXeEWVQHr+u+B3SUjoNCJIp9hwyCW6sYMDbGUBls=";
   };
 
   # With strictDeps on, some shebangs were not being patched correctly
diff --git a/pkgs/by-name/mi/mistral-vibe/package.nix b/pkgs/by-name/mi/mistral-vibe/package.nix
index 0552f7cc8946..240d729627f1 100644
--- a/pkgs/by-name/mi/mistral-vibe/package.nix
+++ b/pkgs/by-name/mi/mistral-vibe/package.nix
@@ -37,7 +37,7 @@ let
 in
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "mistral-vibe";
-  version = "2.9.3";
+  version = "2.9.4";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -45,7 +45,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "mistralai";
     repo = "mistral-vibe";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3kMilvBmBhP57jPlDLc+S6kDuJjcOjMHEwh8W4hzEVw=";
+    hash = "sha256-TOA1ybK41f3+/I5gCaPlAd3yo9N399l6JumWnATbS00=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/ms/msedgedriver/package.nix b/pkgs/by-name/ms/msedgedriver/package.nix
index dd5608313ef1..6616d4d9c29a 100644
--- a/pkgs/by-name/ms/msedgedriver/package.nix
+++ b/pkgs/by-name/ms/msedgedriver/package.nix
@@ -11,11 +11,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "msedgedriver";
-  version = "147.0.3912.60";
+  version = "147.0.3912.98";
 
   src = fetchzip {
     url = "https://msedgedriver.microsoft.com/${finalAttrs.version}/edgedriver_linux64.zip";
-    hash = "sha256-OvhvTMnY7ckM92wCrM+sfn1e5641rFgi54YZGZZeUh0=";
+    hash = "sha256-w9ekySBlqy0ev3OE/G05UJ6tz8EGC2Pc3fMNpmvmKMU=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/ne/newflasher/package.nix b/pkgs/by-name/ne/newflasher/package.nix
new file mode 100644
index 000000000000..e0d50484180b
--- /dev/null
+++ b/pkgs/by-name/ne/newflasher/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  expat,
+  zlib,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "newflasher";
+  version = "59";
+
+  src = fetchFromGitHub {
+    owner = "munjeni";
+    repo = "newflasher";
+    tag = "${finalAttrs.version}";
+    hash = "sha256-ulcHbSoMXnu0pauYUaZiTVvl5VtEYnYy3ljtZ0oEvGM=";
+  };
+
+  buildInputs = [
+    expat
+    zlib
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 newflasher $out/bin/newflasher
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Flash tool for new Sony flash tool protocol (Xperia XZ Premium and newer)";
+    homepage = "https://github.com/munjeni/newflasher";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ toastal ];
+  };
+})
diff --git a/pkgs/by-name/nu/nuclei-templates/package.nix b/pkgs/by-name/nu/nuclei-templates/package.nix
index 77fd51e70f9e..14ff0131ee0a 100644
--- a/pkgs/by-name/nu/nuclei-templates/package.nix
+++ b/pkgs/by-name/nu/nuclei-templates/package.nix
@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "nuclei-templates";
-  version = "10.4.2";
+  version = "10.4.3";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "nuclei-templates";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wek6YwS9vhHefvIGfI6a4ErGhFPMTtbiIBIRnZMfnR0=";
+    hash = "sha256-Ke1F+rtLPNxMsSDVdv4MgbIETd2N5eBC5Svv7A2LAHM=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/op/opengist/package.nix b/pkgs/by-name/op/opengist/package.nix
index d96f4f34f286..eb27ba77e7c6 100644
--- a/pkgs/by-name/op/opengist/package.nix
+++ b/pkgs/by-name/op/opengist/package.nix
@@ -13,13 +13,13 @@
 buildGoModule (finalAttrs: {
   pname = "opengist";
 
-  version = "1.12.1";
+  version = "1.12.2";
 
   src = fetchFromGitHub {
     owner = "thomiceli";
     repo = "opengist";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vjNrcT4IaCB+QRvvPo0oeLtFgmYXk5DDs5gYvzk4ddo=";
+    hash = "sha256-MZ7aKT4qmWH4NyT32ZUpBmqqLJYCtLpdlSJHh+h7IPI=";
   };
 
   frontend = buildNpmPackage {
@@ -36,10 +36,10 @@ buildGoModule (finalAttrs: {
       cp -R public $out
     '';
 
-    npmDepsHash = "sha256-wjGtA99Cn9FtUbYqhoagDzeuQkc9vKwHsJKI2j+ZgMc=";
+    npmDepsHash = "sha256-KDdXBE5X+fOuXF/hIkyRHscMmBQ/E0PCUednfEm5i8k=";
   };
 
-  vendorHash = "sha256-rRT4SDKtQhLWl1K+DodXO4BBK2SEeJzUph3su306GWU=";
+  vendorHash = "sha256-lhDga5shastI7BfnEnekFnUc2L8Ju6LazeqvD7+CK/o=";
 
   tags = [ "fs_embed" ];
 
diff --git a/pkgs/by-name/pa/parted/package.nix b/pkgs/by-name/pa/parted/package.nix
index 97c63b66c930..9521843fd95b 100644
--- a/pkgs/by-name/pa/parted/package.nix
+++ b/pkgs/by-name/pa/parted/package.nix
@@ -38,23 +38,18 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     libuuid
-  ]
-  ++ lib.optional (readline != null) readline
-  ++ lib.optional (gettext != null) gettext
-  ++ lib.optional (lvm2 != null) lvm2;
+    readline
+    gettext
+    lvm2
+  ];
 
   nativeBuildInputs = [
     pkg-config
   ];
-  configureFlags =
-    (if (readline != null) then [ "--with-readline" ] else [ "--without-readline" ])
-    ++ lib.optional (lvm2 == null) "--disable-device-mapper"
-    ++ lib.optional enableStatic "--enable-static";
+  configureFlags = lib.optional enableStatic "--enable-static";
 
   enableParallelBuilding = true;
 
-  # Tests were previously failing due to Hydra running builds as uid 0.
-  # That should hopefully be fixed now.
   doCheck = !stdenv.hostPlatform.isMusl; # translation test
   nativeCheckInputs = [
     check
diff --git a/pkgs/by-name/ph/phrase-cli/package.nix b/pkgs/by-name/ph/phrase-cli/package.nix
index b438ee9e49bb..7632f2dc7e96 100644
--- a/pkgs/by-name/ph/phrase-cli/package.nix
+++ b/pkgs/by-name/ph/phrase-cli/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "phrase-cli";
-  version = "2.61.0";
+  version = "2.62.0";
 
   src = fetchFromGitHub {
     owner = "phrase";
     repo = "phrase-cli";
     rev = finalAttrs.version;
-    sha256 = "sha256-VSkogD90hLgKw/3xXzfs4TktmoLf/RtfaJxEjk/uFsQ=";
+    sha256 = "sha256-p8ixUGMA1S5TcFDocQ+mm35On+ZUUQRO8OZeXfzox20=";
   };
 
-  vendorHash = "sha256-w3XJUE1iM+yi4cMqMTUDhiafV5v42v4zBJzckv3Fd70=";
+  vendorHash = "sha256-O16CdRqj3NevIunBfgIMJOkW1avE2wyeN1kJG6Wehco=";
 
   ldflags = [ "-X=github.com/phrase/phrase-cli/cmd.PHRASE_CLIENT_VERSION=${finalAttrs.version}" ];
 
diff --git a/pkgs/by-name/pr/privatebin/package.nix b/pkgs/by-name/pr/privatebin/package.nix
index 942d2d42e7e3..58086830458d 100644
--- a/pkgs/by-name/pr/privatebin/package.nix
+++ b/pkgs/by-name/pr/privatebin/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "privatebin";
-  version = "2.0.3";
+  version = "2.0.4";
 
   src = fetchFromGitHub {
     owner = "PrivateBin";
     repo = "PrivateBin";
     tag = finalAttrs.version;
-    hash = "sha256-23NzowQCuvJHenWmFGgIXFMP6oZoTLf0AZA7+uDQs5E=";
+    hash = "sha256-OyTEi1D+B33e0Dqr/l/uTBcPTlC7AAqc2atnClYhyGo=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/pu/pulumi-bin/data.nix b/pkgs/by-name/pu/pulumi-bin/data.nix
index fbadd8775f0d..377f4bad6075 100644
--- a/pkgs/by-name/pu/pulumi-bin/data.nix
+++ b/pkgs/by-name/pu/pulumi-bin/data.nix
@@ -1,12 +1,12 @@
 # DO NOT EDIT! This file is generated automatically by update.sh
 { }:
 {
-  version = "3.234.0";
+  version = "3.235.0";
   pulumiPkgs = {
     x86_64-linux = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.234.0-linux-x64.tar.gz";
-        sha256 = "10gzaiz1200fpm1jsha92pc03v8zjkjkiwckdybq7cryrdr7wy35";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.235.0-linux-x64.tar.gz";
+        sha256 = "01z8gy049da2h3iwqn2pcmd04q93smbjypmlka5zfcai4vwd5hv9";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.53.1-linux-amd64.tar.gz";
@@ -21,8 +21,8 @@
         sha256 = "1bk4wswywss8i5isjrrlpnrkdplpp45sqq1yvdc0jwgzay36n8zl";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v8.10.4-linux-amd64.tar.gz";
-        sha256 = "1j80sayzic63ahyv2x9k7kpisi7rvjml7cid1xzzcac8z7s2nhxq";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v8.10.5-linux-amd64.tar.gz";
+        sha256 = "1bdxzgqjvnyf6bi8i0c4zi5qmlb24ck8qhw9chvfigrqqi655221";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v3.41.0-linux-amd64.tar.gz";
@@ -97,8 +97,8 @@
         sha256 = "0yqbn1niyy2a4gq87r4wk75v3p114xf099gxqgyq39c079bdwlns";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v5.10.0-linux-amd64.tar.gz";
-        sha256 = "082qaqpjl0m3ng30nmvmwibn9yfrbh47kpyx9jdzmwg0k3d60sam";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v5.11.0-linux-amd64.tar.gz";
+        sha256 = "12jr7p6c6xzmywcp39ag0ymladxc83v3sp5j38j82m6qx7fg25c2";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mailgun-v3.7.1-linux-amd64.tar.gz";
@@ -163,8 +163,8 @@
     ];
     x86_64-darwin = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.234.0-darwin-x64.tar.gz";
-        sha256 = "1vn74fm1bbgs8h726l0ma3ljsp4lzjim3h7vnnqa8608vqyvjl3y";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.235.0-darwin-x64.tar.gz";
+        sha256 = "0n5z5crkz1h9xpiic1kvs6418pk9f636x41hncka8ll4h73hk986";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.53.1-darwin-amd64.tar.gz";
@@ -179,8 +179,8 @@
         sha256 = "1rhbpxi9g3pb11cj2yinil8iwsl2zb3ndz3h21grf94ss8h4395h";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v8.10.4-darwin-amd64.tar.gz";
-        sha256 = "142ydaywi8xw3k8w2c2py0x88sxf55v9z26yjkjhn2izcr9yv3fg";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v8.10.5-darwin-amd64.tar.gz";
+        sha256 = "0l4i7h58q23rjhgdam205xx9682j4vqy8v8mh73x9hmi93hnj6kc";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v3.41.0-darwin-amd64.tar.gz";
@@ -255,8 +255,8 @@
         sha256 = "0f313ir5kjv8fqyyrp4k12d3nd5cy4jibjym2p5v88drjn3w1g19";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v5.10.0-darwin-amd64.tar.gz";
-        sha256 = "1v17x7mzx2nas9zfbqkz9h49n8j52gw7cz6hci5rzrxxj98fnsh0";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v5.11.0-darwin-amd64.tar.gz";
+        sha256 = "0k8d5gpqbij61ykish5nkpkpky5y5v7m75vn2bv6ddr1kzgp32m7";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mailgun-v3.7.1-darwin-amd64.tar.gz";
@@ -321,8 +321,8 @@
     ];
     aarch64-linux = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.234.0-linux-arm64.tar.gz";
-        sha256 = "1qdwmzy1v3msnhyb97xfnj56vl7mnarc2dmbrvp94lpl79mdah58";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.235.0-linux-arm64.tar.gz";
+        sha256 = "177qpi8c1dagl1sv66h28vsp0rnk92c58hy4hlvlkkssj6i0d3wi";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.53.1-linux-arm64.tar.gz";
@@ -337,8 +337,8 @@
         sha256 = "0dg2brhn72i5wd7nfqs6dhl99fcpfkdr4nd98ll8k12x4g2qjfim";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v8.10.4-linux-arm64.tar.gz";
-        sha256 = "0xfa9p3dhnmlq5vpdwgsb73mcp8ckkw17pkgjmlsb54nfayj687d";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v8.10.5-linux-arm64.tar.gz";
+        sha256 = "1w0asfdg8dih7v77mmva0kywmyc607l7p3jy7251qcqk2in0fhn4";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v3.41.0-linux-arm64.tar.gz";
@@ -413,8 +413,8 @@
         sha256 = "1ax41ricywlhy1nxjl1gybv9xkfw6ifz1xwlzcps7xdw8bcnrcj0";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v5.10.0-linux-arm64.tar.gz";
-        sha256 = "0i43jyxz8g138iky5ik5wmm8zaijx469ck185wiswihcaw6m7wf0";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v5.11.0-linux-arm64.tar.gz";
+        sha256 = "0zglli3pbn895i6dp6pfc8j8lmp3ns2kn5vpscrh5hmcxa00lf9r";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mailgun-v3.7.1-linux-arm64.tar.gz";
@@ -479,8 +479,8 @@
     ];
     aarch64-darwin = [
       {
-        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.234.0-darwin-arm64.tar.gz";
-        sha256 = "1v7sbyjyyz69hdwqf0h1sfg2g551ys5aqgc970ns06vc70pkjgq0";
+        url = "https://get.pulumi.com/releases/sdk/pulumi-v3.235.0-darwin-arm64.tar.gz";
+        sha256 = "03wha0231261iwngj2wrvzh72r4dp8l27xhn32b71hwgykgfayg6";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-aiven-v6.53.1-darwin-arm64.tar.gz";
@@ -495,8 +495,8 @@
         sha256 = "1crcyyilsj4zsba7mwhqzirikp0ff8x6r3mw4sbm2czi9bba1mv9";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v8.10.4-darwin-arm64.tar.gz";
-        sha256 = "14dwhd8d6683babl6399yqn6dwihxmjs7fa2p40d071ibmpsx307";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-artifactory-v8.10.5-darwin-arm64.tar.gz";
+        sha256 = "1zm352c89rnf78n9xq4pffq1rsd3rddc7v6xi8md41x9vhnpsp6j";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-auth0-v3.41.0-darwin-arm64.tar.gz";
@@ -571,8 +571,8 @@
         sha256 = "0n8my65zbia3kyhcfrzi7119kggkzldmcljhw3i3zh9839a52p7a";
       }
       {
-        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v5.10.0-darwin-arm64.tar.gz";
-        sha256 = "04m3xcxm19kianxmpf9hdw5ay6mkfg251qln8albfzslhlikx054";
+        url = "https://api.pulumi.com/releases/plugins/pulumi-resource-linode-v5.11.0-darwin-arm64.tar.gz";
+        sha256 = "0samqsxs2calvxanf7jljdlk3fimjshwd4w87nzi5amw8grm76l9";
       }
       {
         url = "https://api.pulumi.com/releases/plugins/pulumi-resource-mailgun-v3.7.1-darwin-arm64.tar.gz";
diff --git a/pkgs/by-name/qo/qovery-cli/package.nix b/pkgs/by-name/qo/qovery-cli/package.nix
index 70896bacfbf8..6cc7612e53ef 100644
--- a/pkgs/by-name/qo/qovery-cli/package.nix
+++ b/pkgs/by-name/qo/qovery-cli/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "qovery-cli";
-  version = "1.158.0";
+  version = "1.158.1";
 
   src = fetchFromGitHub {
     owner = "Qovery";
     repo = "qovery-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-b6nvJPLMvqXM+hYJzOG65G15N+ErJnWySQrjJQmsMe8=";
+    hash = "sha256-49xy6lH/diMpE8ZY7vuHevLuVL/hTukBSQjkHpPGbd4=";
   };
 
   vendorHash = "sha256-kENqEnk5RxN8kJ/dnXtG6ypnb8CPcOsHKid1z6uuKAc=";
diff --git a/pkgs/by-name/qw/qwen-code/package.nix b/pkgs/by-name/qw/qwen-code/package.nix
index 37e3baeaa9f9..535eac203372 100644
--- a/pkgs/by-name/qw/qwen-code/package.nix
+++ b/pkgs/by-name/qw/qwen-code/package.nix
@@ -14,17 +14,17 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "qwen-code";
-  version = "0.14.5";
+  version = "0.15.6";
 
   src = fetchFromGitHub {
     owner = "QwenLM";
     repo = "qwen-code";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2d+PaHaUdCEYjYkAG33DxX3rMbVpL/CcngczFeOvy8M=";
+    hash = "sha256-AMp4a1pInYppJmrUP1eg7Vhcca+amA1CK5izdvYrXOE=";
   };
 
   npmDepsFetcherVersion = 3;
-  npmDepsHash = "sha256-7o3ap0+eyCxga18V4qoG+a6b2EM45MkMLjXdY8J/eGg=";
+  npmDepsHash = "sha256-n7QcJjoW2r77qCW6A3qLmsWEJSHKGv+SalNBRzTcz+E=";
 
   # npm 11 incompatible with fetchNpmDeps
   # https://github.com/NixOS/nixpkgs/issues/474535
diff --git a/pkgs/by-name/re/redis/package.nix b/pkgs/by-name/re/redis/package.nix
index b4a0ab80ef87..0a8b742b120b 100644
--- a/pkgs/by-name/re/redis/package.nix
+++ b/pkgs/by-name/re/redis/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitHub,
   fetchpatch2,
+  apple-sdk,
   lua,
   jemalloc,
   pkg-config,
@@ -26,13 +27,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "redis";
-  version = "8.2.3";
+  version = "8.6.3";
 
   src = fetchFromGitHub {
     owner = "redis";
     repo = "redis";
     tag = finalAttrs.version;
-    hash = "sha256-PsTAo92Vz+LNxOsbI9VVnx+rHFm67a3bBMeDcLdhXFA=";
+    hash = "sha256-Zg2bghU4uExwI1SWplYIGCeGRhgRxdh3Oy9k1DZPado=";
   };
 
   patches = lib.optional useSystemJemalloc (fetchpatch2 {
@@ -40,6 +41,20 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-A9qp+PWQRuNy/xmv9KLM7/XAyL7Tzkyn0scpVCGngcc=";
   });
 
+  postPatch = ''
+    # Using `yes` seems to be an invalid value and causes the test to fail. See
+    # https://github.com/redis/redis/blob/bd3b38d41070b478c58bc8b72d2af89cbccd1a40/redis.conf#L674-L688
+    substituteInPlace tests/integration/replication.tcl \
+      --replace-fail 'repl-diskless-load yes' ' repl-diskless-load on-empty-db'
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    # The path `/Library/...` isn't available in the build sandbox. The package `apple-sdk`
+    # can provide that functionality for us.
+    substituteInPlace src/modules/Makefile modules/vector-sets/Makefile tests/modules/Makefile \
+      --replace-fail '/Library/Developer/CommandLineTools/SDKs/MacOSX.sdk/usr/lib' \
+        '${apple-sdk.sdkroot}/usr/lib'
+  '';
+
   nativeBuildInputs = [
     pkg-config
     which
@@ -82,7 +97,7 @@ stdenv.mkDerivation (finalAttrs: {
     # disable test "Connect multiple replicas at the same time": even
     # upstream find this test too timing-sensitive
     substituteInPlace tests/integration/replication.tcl \
-      --replace-fail 'foreach sdl {disabled swapdb} {' 'foreach sdl {} {'
+      --replace-fail 'foreach sdl {disabled swapdb flushdb} {' 'foreach sdl {} {'
 
     substituteInPlace tests/support/server.tcl \
       --replace-fail 'exec /usr/bin/env' 'exec env'
@@ -105,6 +120,7 @@ stdenv.mkDerivation (finalAttrs: {
       --skipunit integration/aof-multi-part \
       --skipunit integration/failover \
       --skipunit integration/replication-rdbchannel \
+      --skipunit unit/cluster/atomic-slot-migration \
       --skiptest "Check MEMORY USAGE for embedded key strings with jemalloc"
       # ^ breaks due to unexpected and varying address space sizes that jemalloc gets built with
 
@@ -127,7 +143,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.agpl3Only;
     platforms = lib.platforms.all;
     changelog = "https://github.com/redis/redis/releases/tag/${finalAttrs.version}";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ hythera ];
     mainProgram = "redis-cli";
   };
 })
diff --git a/pkgs/by-name/re/renderdoc/package.nix b/pkgs/by-name/re/renderdoc/package.nix
index 57e670ec9ee9..e69d1581a1a2 100644
--- a/pkgs/by-name/re/renderdoc/package.nix
+++ b/pkgs/by-name/re/renderdoc/package.nix
@@ -33,13 +33,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "renderdoc";
-  version = "1.43";
+  version = "1.44";
 
   src = fetchFromGitHub {
     owner = "baldurk";
     repo = "renderdoc";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-2oojSjBSdq/1plQ093mlBeZzwg7KEJW4oDiRt1f7plM=";
+    hash = "sha256-EInMFJMs+0bNSWmNP/f17pFCV9tJj6Ys3tZY6D69c/E=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/re/reptyr/package.nix b/pkgs/by-name/re/reptyr/package.nix
index b7567f2e7b93..28ab5ab2ea63 100644
--- a/pkgs/by-name/re/reptyr/package.nix
+++ b/pkgs/by-name/re/reptyr/package.nix
@@ -2,12 +2,8 @@
   stdenv,
   lib,
   fetchFromGitHub,
-  python3,
 }:
 
-let
-  python = python3.withPackages (p: [ p.pexpect ]);
-in
 stdenv.mkDerivation (finalAttrs: {
   version = "0.10.0";
   pname = "reptyr";
@@ -24,16 +20,10 @@ stdenv.mkDerivation (finalAttrs: {
     "DESTDIR=$(out)"
   ];
 
-  nativeCheckInputs = [ python ];
-
   # reptyr needs to do ptrace of a non-child process
   # It can be neither used nor tested if the kernel is not told to allow this
   doCheck = false;
 
-  checkFlags = [
-    "PYTHON_CMD=${python.interpreter}"
-  ];
-
   meta = {
     platforms = [
       "i686-linux"
diff --git a/pkgs/by-name/re/resterm/package.nix b/pkgs/by-name/re/resterm/package.nix
index e78d6658a9fd..529daf6ff0b7 100644
--- a/pkgs/by-name/re/resterm/package.nix
+++ b/pkgs/by-name/re/resterm/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "resterm";
-  version = "0.28.2";
+  version = "0.34.1";
 
   src = fetchFromGitHub {
     owner = "unkn0wn-root";
     repo = "resterm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jJGL9oSThbFeO0c89LMFWVEzyrGeIWZDUKYVqOy2hMk=";
+    hash = "sha256-lmUW0K0gUtZCw4yw8GkgiL+sEdnsF4ZNXkdJhwo8zLQ=";
   };
 
   vendorHash = "sha256-AjckKD6NScBa8w9nWMdVExuNadz3vHnK854XXg3nj84=";
diff --git a/pkgs/by-name/ro/roslyn-ls/deps.json b/pkgs/by-name/ro/roslyn-ls/deps.json
index de0a6fff87ef..5b106ea95e4b 100644
--- a/pkgs/by-name/ro/roslyn-ls/deps.json
+++ b/pkgs/by-name/ro/roslyn-ls/deps.json
@@ -79,9 +79,9 @@
   },
   {
     "pname": "Microsoft.CodeAnalysis.BannedApiAnalyzers",
-    "version": "5.7.0-1.26202.104",
-    "hash": "sha256-p7ybIuiw34dJb1IehSN4v+II42tznBbYYAtVMiKUTbo=",
-    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.bannedapianalyzers/5.7.0-1.26202.104/microsoft.codeanalysis.bannedapianalyzers.5.7.0-1.26202.104.nupkg"
+    "version": "5.7.0-1.26215.121",
+    "hash": "sha256-91me6S6uT9wAM5stwzWc86ilPnVGxuWPg0WeCdhbIRs=",
+    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.bannedapianalyzers/5.7.0-1.26215.121/microsoft.codeanalysis.bannedapianalyzers.5.7.0-1.26215.121.nupkg"
   },
   {
     "pname": "Microsoft.CodeAnalysis.Common",
@@ -103,9 +103,9 @@
   },
   {
     "pname": "Microsoft.CodeAnalysis.PublicApiAnalyzers",
-    "version": "5.7.0-1.26202.104",
-    "hash": "sha256-JUov6s7HgwbliMPxy86J7ok+LfEcFZooVQBiedCSUeo=",
-    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.publicapianalyzers/5.7.0-1.26202.104/microsoft.codeanalysis.publicapianalyzers.5.7.0-1.26202.104.nupkg"
+    "version": "5.7.0-1.26215.121",
+    "hash": "sha256-RwRhXL8XuRypKne2WEH5xm05AePSJcH2LGBF4kwDMH0=",
+    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/microsoft.codeanalysis.publicapianalyzers/5.7.0-1.26215.121/microsoft.codeanalysis.publicapianalyzers.5.7.0-1.26215.121.nupkg"
   },
   {
     "pname": "Microsoft.CSharp",
@@ -121,15 +121,15 @@
   },
   {
     "pname": "Microsoft.DotNet.Arcade.Sdk",
-    "version": "10.0.0-beta.26201.4",
-    "hash": "sha256-A1H87Y8Tvf8+cnKj3a59TFi2utka8e9R1j6p9JbOpzs=",
-    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/1a5f89f6-d8da-4080-b15f-242650c914a8/nuget/v3/flat2/microsoft.dotnet.arcade.sdk/10.0.0-beta.26201.4/microsoft.dotnet.arcade.sdk.10.0.0-beta.26201.4.nupkg"
+    "version": "10.0.0-beta.26208.4",
+    "hash": "sha256-2IyF5OTwwHaOdpvoZK4hI/uXksNozsspxdg8dP8FeWM=",
+    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/1a5f89f6-d8da-4080-b15f-242650c914a8/nuget/v3/flat2/microsoft.dotnet.arcade.sdk/10.0.0-beta.26208.4/microsoft.dotnet.arcade.sdk.10.0.0-beta.26208.4.nupkg"
   },
   {
     "pname": "Microsoft.DotNet.XliffTasks",
-    "version": "10.0.0-beta.26201.4",
-    "hash": "sha256-4UIzFVmuDPIxECOBsAolrCCTb5Mzk5baYHDvGYFh/sc=",
-    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/1a5f89f6-d8da-4080-b15f-242650c914a8/nuget/v3/flat2/microsoft.dotnet.xlifftasks/10.0.0-beta.26201.4/microsoft.dotnet.xlifftasks.10.0.0-beta.26201.4.nupkg"
+    "version": "10.0.0-beta.26208.4",
+    "hash": "sha256-ZGH2bAXTyc0dVJwrPNZrcLEeD0pyKo/9M5p1w/hx0oE=",
+    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/1a5f89f6-d8da-4080-b15f-242650c914a8/nuget/v3/flat2/microsoft.dotnet.xlifftasks/10.0.0-beta.26208.4/microsoft.dotnet.xlifftasks.10.0.0-beta.26208.4.nupkg"
   },
   {
     "pname": "Microsoft.Extensions.Configuration",
@@ -427,15 +427,15 @@
   },
   {
     "pname": "PowerShell",
-    "version": "7.0.0",
-    "hash": "sha256-ioasr71UIhDmeZ2Etw52lQ7QsioEd1pnbpVlEeCyUI4=",
-    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/45bacae2-5efb-47c8-91e5-8ec20c22b4f8/nuget/v3/flat2/powershell/7.0.0/powershell.7.0.0.nupkg"
+    "version": "7.6.0",
+    "hash": "sha256-P6yQHqVi//8oP5zRIH4WQbyCvHvczoubiqpyR3Lk6LA=",
+    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/45bacae2-5efb-47c8-91e5-8ec20c22b4f8/nuget/v3/flat2/powershell/7.6.0/powershell.7.6.0.nupkg"
   },
   {
     "pname": "Roslyn.Diagnostics.Analyzers",
-    "version": "5.7.0-1.26202.104",
-    "hash": "sha256-GO3HaDDOCK+PT4/yoQuj1vXvgGzGmgV2ksBbdP51zW0=",
-    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/roslyn.diagnostics.analyzers/5.7.0-1.26202.104/roslyn.diagnostics.analyzers.5.7.0-1.26202.104.nupkg"
+    "version": "5.7.0-1.26215.121",
+    "hash": "sha256-24oGYM1xHKZHKr0a5d/pAC5d6dIwCsWqq3Ykx6VziWU=",
+    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/d1622942-d16f-48e5-bc83-96f4539e7601/nuget/v3/flat2/roslyn.diagnostics.analyzers/5.7.0-1.26215.121/roslyn.diagnostics.analyzers.5.7.0-1.26215.121.nupkg"
   },
   {
     "pname": "SQLitePCLRaw.bundle_green",
@@ -499,9 +499,9 @@
   },
   {
     "pname": "System.CommandLine",
-    "version": "3.0.0-preview.4.26202.104",
-    "hash": "sha256-Kuh7UZ+fg4mJWismeSS6PNKGFgSYruYOVY7agur6xe8=",
-    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/516521bf-6417-457e-9a9c-0a4bdfde03e7/nuget/v3/flat2/system.commandline/3.0.0-preview.4.26202.104/system.commandline.3.0.0-preview.4.26202.104.nupkg"
+    "version": "3.0.0-preview.4.26215.121",
+    "hash": "sha256-GJjEBeXmrAwXeGfXjJ4GFeFVdKvdAgIMzOhR0svAH2o=",
+    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/516521bf-6417-457e-9a9c-0a4bdfde03e7/nuget/v3/flat2/system.commandline/3.0.0-preview.4.26215.121/system.commandline.3.0.0-preview.4.26215.121.nupkg"
   },
   {
     "pname": "System.ComponentModel.Composition",
diff --git a/pkgs/by-name/ro/roslyn-ls/package.nix b/pkgs/by-name/ro/roslyn-ls/package.nix
index 71fa566c4c49..0d70848f0623 100644
--- a/pkgs/by-name/ro/roslyn-ls/package.nix
+++ b/pkgs/by-name/ro/roslyn-ls/package.nix
@@ -38,18 +38,18 @@ in
 buildDotnetModule (finalAttrs: {
   inherit pname dotnet-sdk dotnet-runtime;
 
-  vsVersion = "2.134.7-prerelease";
+  vsVersion = "2.136.19-prerelease";
   src = fetchFromGitHub {
     owner = "dotnet";
     repo = "roslyn";
     rev = "VSCode-CSharp-${finalAttrs.vsVersion}";
-    hash = "sha256-FzD5KQu5Ij+WBfXib1STBdXZvzvozey1cGghMHFWwvQ=";
+    hash = "sha256-xBxWBh4J8NJWQUDGdVLf/vXz0UTFP8q/2VoN9r55kvc=";
   };
 
   # versioned independently from vscode-csharp
   # "roslyn" in here:
   # https://github.com/dotnet/vscode-csharp/blob/main/package.json
-  version = "5.7.0-1.26203.6";
+  version = "5.7.0-1.26220.12";
   projectFile = "src/LanguageServer/${project}/${project}.csproj";
   useDotnetFromEnv = true;
   nugetDeps = ./deps.json;
diff --git a/pkgs/by-name/rt/rtk/package.nix b/pkgs/by-name/rt/rtk/package.nix
index 7cbb7c0a123a..f4b934e22855 100644
--- a/pkgs/by-name/rt/rtk/package.nix
+++ b/pkgs/by-name/rt/rtk/package.nix
@@ -12,19 +12,19 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rtk";
-  version = "0.37.2";
+  version = "0.38.0";
 
   src = fetchFromGitHub {
     owner = "rtk-ai";
     repo = "rtk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rNuu8B5TnKZHrbVSV8HkcTeTdcol26259GGJEPEMPZY=";
+    hash = "sha256-eINYlatbjpsqe46LNZIXvIrZEBf+QC3+2EjY7Ei7VZI=";
   };
 
   strictDeps = true;
   __structuredAttrs = true;
 
-  cargoHash = "sha256-61+PNuVF8H5+9PHc3MBt8V80ieBBi8HzSC9Gc/WUSzM=";
+  cargoHash = "sha256-qTDj7xTBM8dOOE7XLTewtHVwHtxVDcvCLs0ebtT2uSI=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/by-name/se/sem/package.nix b/pkgs/by-name/se/sem/package.nix
index 52039b84500a..9769c47e7459 100644
--- a/pkgs/by-name/se/sem/package.nix
+++ b/pkgs/by-name/se/sem/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "sem";
-  version = "0.34.0";
+  version = "0.35.0";
 
   src = fetchFromGitHub {
     owner = "semaphoreci";
     repo = "cli";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-FJn1oTtECPZpBi2LsoAxA2kyS3RY1/5oJGOTZiwitsA=";
+    sha256 = "sha256-+rT8Kni7094OjNmGRxPUxXaHopyCNGMCM2ac4lIm9PE=";
   };
 
   vendorHash = "sha256-XEr/vXamJ7GTRpXNdcVQ9PcUVvQ8EW3pmq/tEZMHSDo=";
diff --git a/pkgs/by-name/sh/shpool/package.nix b/pkgs/by-name/sh/shpool/package.nix
index 81ee1d8d4850..7f7f9590d16b 100644
--- a/pkgs/by-name/sh/shpool/package.nix
+++ b/pkgs/by-name/sh/shpool/package.nix
@@ -10,13 +10,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "shpool";
-  version = "0.9.6";
+  version = "0.9.8";
 
   src = fetchFromGitHub {
     owner = "shell-pool";
     repo = "shpool";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Q2sIHOiFP/xj6wO3GNDc53eRwGygAz6nijsUqa3n9v0=";
+    hash = "sha256-iN4ZPayOUhbP3WlQIIyIN73PxH3CFgsQELWt8prtTJo=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail '/usr/bin/shpool' "$out/bin/shpool"
   '';
 
-  cargoHash = "sha256-SkMPP3FwVMmHnsTIYqZjrjdliWk3YbPHsaRe1rx8sIg=";
+  cargoHash = "sha256-bWA0UZLr/z9MWLrp0yxblFTZwSOEIheBhmx71Ftnbcg=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ linux-pam ];
 
diff --git a/pkgs/by-name/sq/squix/package.nix b/pkgs/by-name/sq/squix/package.nix
new file mode 100644
index 000000000000..89ab281abe86
--- /dev/null
+++ b/pkgs/by-name/sq/squix/package.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  writableTmpDirAsHomeHook,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "squix";
+  version = "0.4.0-beta";
+
+  src = fetchFromGitHub {
+    owner = "eduardofuncao";
+    repo = "squix";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-lJOXzBgVgRdUi+btu/eOlYXDLhS2FLEnJQ/UjGk5jF4=";
+  };
+
+  vendorHash = "sha256-JRmNajvCb57dMo8eggOD1m4N01p2RSK8r49pmBB56Z0=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.Version=${finalAttrs.version}"
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    writableTmpDirAsHomeHook
+    versionCheckHook
+  ];
+  versionCheckKeepEnvironment = [ "HOME" ];
+
+  meta = {
+    description = "SQL command-line client with query management and interactive results";
+    homepage = "https://github.com/eduardofuncao/squix";
+    license = lib.licenses.mit;
+    mainProgram = "squix";
+    maintainers = with lib.maintainers; [ eduardofuncao ];
+  };
+})
diff --git a/pkgs/by-name/st/statix/package.nix b/pkgs/by-name/st/statix/package.nix
index ed6e9d7963c2..fbacbcc72b92 100644
--- a/pkgs/by-name/st/statix/package.nix
+++ b/pkgs/by-name/st/statix/package.nix
@@ -3,44 +3,35 @@
   rustPlatform,
   fetchFromGitHub,
   withJson ? true,
-  stdenv,
-  versionCheckHook,
   nix-update-script,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "statix";
-  # also update version of the vim plugin in
-  # pkgs/applications/editors/vim/plugins/overrides.nix
-  # the version can be found in flake.nix of the source code
-  version = "0.5.8";
+  version = "0-unstable-2026-05-03";
 
   src = fetchFromGitHub {
-    owner = "oppiliappan";
+    owner = "molybdenumsoftware";
     repo = "statix";
-    tag = "v${finalAttrs.version}";
-    sha256 = "sha256-bMs3XMiGP6sXCqdjna4xoV6CANOIWuISSzCaL5LYY4c=";
+    rev = "91e28aa76179b5769e8eff7ff4b09464d0913f27";
+    hash = "sha256-JDCJ8fgIs5ZdYygQxlR63H/V4VyfmVMR4FleWwAl+AM=";
   };
 
-  cargoHash = "sha256-Pi1q2qNLjQYr3Wla7rqrktNm0StszB2klcfzwAnF3tE=";
+  cargoHash = "sha256-lODAnIGw8MncMT5xicWORSbCChn2HQXENsOStJYHepQ=";
 
   buildFeatures = lib.optional withJson "json";
 
-  # tests are failing on darwin
-  doCheck = !stdenv.hostPlatform.isDarwin;
-
-  doInstallCheck = true;
-  nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgramArg = "--version";
-
-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = nix-update-script {
+    version = "branch";
+  };
 
   meta = {
     description = "Lints and suggestions for the nix programming language";
-    homepage = "https://github.com/oppiliappan/statix";
+    homepage = "https://github.com/molybdenumsoftware/statix";
     license = lib.licenses.mit;
     mainProgram = "statix";
     maintainers = with lib.maintainers; [
+      mightyiam
       nerdypepper
       progrm_jarvis
     ];
diff --git a/pkgs/by-name/st/stremio-linux-shell/package.nix b/pkgs/by-name/st/stremio-linux-shell/package.nix
index 3b82f29fe336..4a3f62c23a55 100644
--- a/pkgs/by-name/st/stremio-linux-shell/package.nix
+++ b/pkgs/by-name/st/stremio-linux-shell/package.nix
@@ -95,6 +95,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   env.CEF_PATH = "${cef}";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   postInstall = ''
     mkdir -p $out/share/applications
     cp data/com.stremio.Stremio.desktop $out/share/applications/com.stremio.Stremio.desktop
@@ -130,10 +133,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
   meta = {
     description = "Modern media center that gives you the freedom to watch everything you want";
     homepage = "https://www.stremio.com/";
-    license = with lib.licenses; [
-      gpl3Only
-      # server.js is unfree
-      unfree
+    license =
+      with lib.licenses;
+      AND [
+        gpl3Only
+        unfree # server.js
+      ];
+    sourceProvenance = with lib.sourceTypes; [
+      fromSource
+      obfuscatedCode # server.js
     ];
     maintainers = with lib.maintainers; [ thunze ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/ta/taco/package.nix b/pkgs/by-name/ta/taco/package.nix
index 4dd472fd36b1..0d46ae7dc96b 100644
--- a/pkgs/by-name/ta/taco/package.nix
+++ b/pkgs/by-name/ta/taco/package.nix
@@ -6,11 +6,10 @@
   python3,
   llvmPackages,
   enablePython ? false,
-  python ? python3,
 }:
 
 let
-  pyEnv = python.withPackages (
+  pyEnv = python3.withPackages (
     p: with p; [
       numpy
       scipy
@@ -21,17 +20,17 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "taco";
-  version = "unstable-2022-08-02";
+  version = "0-unstable-2025-04-14";
 
   src = fetchFromGitHub {
     owner = "tensor-compiler";
     repo = "taco";
-    rev = "2b8ece4c230a5f0f0a74bc6f48e28edfb6c1c95e";
+    rev = "0e79acb56cb5f3d1785179536256e206790b2a9e";
     fetchSubmodules = true;
-    hash = "sha256-PnBocyRLiLALuVS3Gkt/yJeslCMKyK4zdsBI8BFaTSg=";
+    hash = "sha256-mdT6ZLxtJ7fqyjRqdWf6+RltvMy7YDr9AEnJtnaDmTw=";
   };
 
-  src-new-pybind11 = python.pkgs.pybind11.src;
+  src-new-pybind11 = python3.pkgs.pybind11.src;
 
   postPatch = ''
     rm -rf python_bindings/pybind11/*
@@ -45,6 +44,11 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace apps/tensor_times_vector/CMakeLists.txt --replace-fail \
       "cmake_minimum_required(VERSION 2.8.12)" \
       "cmake_minimum_required(VERSION 3.5)"
+
+    # Newer pybind11 typing wrappers require a single concrete lambda return type.
+    substituteInPlace python_bindings/src/pytaco.cpp --replace-fail \
+      'm.def("get_parallel_schedule", [](){' \
+      'm.def("get_parallel_schedule", []() -> py::tuple {'
   '';
 
   # Remove test cases from cmake build as they violate modern C++ expectations
@@ -62,8 +66,8 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional enablePython "-DPYTHON=ON";
 
   postInstall = lib.strings.optionalString enablePython ''
-    mkdir -p $out/${python.sitePackages}
-    cp -r lib/pytaco $out/${python.sitePackages}/.
+    mkdir -p $out/${python3.sitePackages}
+    cp -r lib/pytaco $out/${python3.sitePackages}/.
   '';
 
   # The standard CMake test suite fails a single test of the CLI interface.
diff --git a/pkgs/by-name/ta/talos-pilot/package.nix b/pkgs/by-name/ta/talos-pilot/package.nix
new file mode 100644
index 000000000000..3103674cfde0
--- /dev/null
+++ b/pkgs/by-name/ta/talos-pilot/package.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  protobuf,
+  nix-update-script,
+  testers,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "talos-pilot";
+  version = "0.1.9";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "Handfish";
+    repo = "talos-pilot";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-OZF74efMWQkZgSbOnzyygzt4pRADY1liWVpvnzWns8Y=";
+  };
+
+  cargoHash = "sha256-loCYAgZhNtYs8aBbOJMLkS9i0XglOn6BrodLQROPMPQ=";
+
+  nativeBuildInputs = [
+    protobuf
+  ];
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+    };
+  };
+
+  meta = {
+    description = "Talos TUI for real-time node monitoring, log streaming, etcd health, and diagnostics";
+    homepage = "https://github.com/Handfish/talos-pilot";
+    changelog = "https://github.com/Handfish/talos-pilot/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ frantathefranta ];
+    mainProgram = "talos-pilot";
+  };
+})
diff --git a/pkgs/by-name/te/terramate/package.nix b/pkgs/by-name/te/terramate/package.nix
index 30c04c341d0c..d81b103a9adb 100644
--- a/pkgs/by-name/te/terramate/package.nix
+++ b/pkgs/by-name/te/terramate/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "terramate";
-  version = "0.16.0";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "terramate-io";
     repo = "terramate";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-UY9Nj6MbQd2RLV0ofo5qpcsnabYwOyeEVXxXvC3efTo=";
+    hash = "sha256-Se1A43fDx4/RK70xNvUUZaAdFVWAijo+VLyHqMYgmfw=";
   };
 
-  vendorHash = "sha256-Ca4ZVna80Gb3L+qWmwXTh4qpDuc42PFFlDmuUqlGwqg=";
+  vendorHash = "sha256-U9ASe8P+c6UDHGpazV7LJXcAAkABqXN1AO0WqxlhEGo=";
 
   # required for version info
   nativeBuildInputs = [ git ];
diff --git a/pkgs/by-name/ti/tidal/package.nix b/pkgs/by-name/ti/tidal/package.nix
new file mode 100644
index 000000000000..2ada01e637fe
--- /dev/null
+++ b/pkgs/by-name/ti/tidal/package.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  undmg,
+}:
+let
+  updateScript = ./update.sh;
+in
+stdenv.mkDerivation {
+  pname = "tidal";
+  version = "2.41.3";
+
+  src =
+    if stdenv.hostPlatform.isAarch64 then
+      (fetchurl {
+        url = "https://web.archive.org/web/20260314112555/https://download.tidal.com/desktop/TIDAL.arm64.dmg";
+        hash = "sha256-18RjsLHhpUSAyITfwu3efokUbezE1b3GpFiafWHW/qo=";
+      })
+    else
+      (fetchurl {
+        url = "https://web.archive.org/web/20260314112436/https://download.tidal.com/desktop/TIDAL.x64.dmg";
+        hash = "sha256-5nUU8TOSph1v1C0+/KR/F5Y7m5TitbYH/ujsiZ/n6LU=";
+      });
+
+  nativeBuildInputs = [ undmg ];
+
+  sourceRoot = ".";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/Applications
+    cp -r *.app $out/Applications
+
+    runHook postInstall
+  '';
+
+  passthru = { inherit updateScript; };
+
+  meta = {
+    description = "Play music from the Tidal streaming service";
+    homepage = "https://tidal.com/";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.unfree;
+    platforms = [
+      "x86_64-darwin"
+      "aarch64-darwin"
+    ];
+    mainProgram = "tidal";
+    maintainers = with lib.maintainers; [
+      frostplexx
+    ];
+  };
+}
diff --git a/pkgs/by-name/ti/tidal/update.sh b/pkgs/by-name/ti/tidal/update.sh
new file mode 100755
index 000000000000..7810ec9c5faa
--- /dev/null
+++ b/pkgs/by-name/ti/tidal/update.sh
@@ -0,0 +1,70 @@
+#!/usr/bin/env nix-shell
+#! nix-shell -i bash -p curl jq git gnused gnugrep nix libplist undmg
+set -euo pipefail
+
+# executing this script without arguments will
+# - find the newest stable spotify version avaiable on snapcraft (https://snapcraft.io/spotify)
+# - read the current spotify version from the current nix expression
+# - update the nix expression if the versions differ
+# - try to build the updated version, exit if that fails
+# - give instructions for upstreaming
+
+# Please test the update manually before pushing. There have been errors before
+# and because the service is proprietary and a paid account is necessary to do
+# anything with spotify automatic testing is not possible.
+
+# As an optional argument you can specify the snapcraft channel to update to.
+# Default is `stable` and only stable updates should be pushed to nixpkgs. For
+# testing you may specify `candidate` or `edge`.
+
+nixpkgs="$(git rev-parse --show-toplevel)"
+
+update_macos() {
+  nix_file="$nixpkgs/pkgs/by-name/ti/tidal/package.nix"
+
+  tmp_dir=$(mktemp -d)
+  trap 'rm -rf "$tmp_dir"' EXIT
+
+  pushd $tmp_dir
+
+  x86_64_url="https://download.tidal.com/desktop/TIDAL.x64.dmg"
+  aarch64_url="https://download.tidal.com/desktop/TIDAL.arm64.dmg"
+
+  curl -OL "$aarch64_url"
+  undmg TIDAL.arm64.dmg
+  upstream_version=$(plistutil -i TIDAL.app/Contents/Info.plist -f json -o - | jq -r '.CFBundleShortVersionString')
+
+  popd
+
+  current_nix_version=$(
+    grep 'version\s*=' "$nix_file" |
+      sed -Ene 's/.*"(.*)".*/\1/p'
+  )
+
+  if [[ "$current_nix_version" != "$upstream_version" ]]; then
+    archive_url="https://web.archive.org/save"
+    archived_x86_64_url=$(curl -s -I -L -o /dev/null "$archive_url/$x86_64_url" -w '%{url_effective}')
+    archived_aarch64_url=$(curl -s -I -L -o /dev/null "$archive_url/$aarch64_url" -w '%{url_effective}')
+
+    aarch64_hash=$(nix-prefetch-url "$archived_aarch64_url" --type sha256 | xargs nix hash convert --hash-algo sha256 --to sri)
+    x86_64_hash=$(nix-prefetch-url "$archived_x86_64_url" --type sha256 | xargs nix hash convert --hash-algo sha256 --to sri)
+
+    sed --regexp-extended \
+      -e 's/version\s*=\s*".*"\s*;/version = "'"${upstream_version}"'";/' \
+      -i "$nix_file"
+
+    # Update aarch64 (first fetchurl block) url and hash
+    sed -e '/isAarch64/,/})/{
+      s|url = ".*"|url = "'"${archived_aarch64_url}"'"|
+      s|hash = ".*"|hash = "'"${aarch64_hash}"'"|
+    }' -i "$nix_file"
+
+    # Update x86_64 (second fetchurl block) url and hash
+    sed -e '/else/,/})/{
+      s|url = ".*"|url = "'"${archived_x86_64_url}"'"|
+      s|hash = ".*"|hash = "'"${x86_64_hash}"'"|
+    }' -i "$nix_file"
+  fi
+}
+
+update_macos
diff --git a/pkgs/by-name/to/tor/package.nix b/pkgs/by-name/to/tor/package.nix
index 34cd1257f932..18b20a0cbc3e 100644
--- a/pkgs/by-name/to/tor/package.nix
+++ b/pkgs/by-name/to/tor/package.nix
@@ -46,11 +46,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tor";
-  version = "0.4.9.6";
+  version = "0.4.9.7";
 
   src = fetchurl {
     url = "https://dist.torproject.org/tor-${finalAttrs.version}.tar.gz";
-    hash = "sha256-qJq6lwUumWOmVLQN8tRr4H6Ka24k5UN5F/2BrNkKcBc=";
+    hash = "sha256-WnQPMvaIrInAZjRcOLR7ooawxDlNNRslH/SLalOUYY8=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/ve/vespa-cli/package.nix b/pkgs/by-name/ve/vespa-cli/package.nix
new file mode 100644
index 000000000000..cea4b89a6b7e
--- /dev/null
+++ b/pkgs/by-name/ve/vespa-cli/package.nix
@@ -0,0 +1,82 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "vespa-cli";
+  version = "8.679.50";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "vespa-engine";
+    repo = "vespa";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-4tABoAA96HoYghIno0qbieYbE4EJZRmFIFDnoOoMIaA=";
+  };
+
+  # case-insensitive conflicts which produce platform `vendorHash` checksumm
+  proxyVendor = true;
+
+  sourceRoot = "${finalAttrs.src.name}/client/go";
+
+  vendorHash = "sha256-qC/8pIhsVbt9uUyLDiAW18tCUWDw3Agvmcx/CIUsCKQ=";
+
+  env.CGO_ENABLED = 0;
+
+  ldflags = [
+    "-s"
+    "-X github.com/vespa-engine/vespa/client/go/internal/build.Version=${finalAttrs.version}"
+  ];
+
+  checkFlags =
+    let
+      skippedTests = [
+        # these tests try to call home
+        "TestAuthShow/auth_show"
+        "TestDeployCloud"
+        "TestDeployCloudFastWait"
+        "TestDeployCloudUnauthorized"
+        "TestDestroy"
+        "TestLogCloud"
+        "TestProdDeploy"
+        "TestProdDeployInvalidZip"
+        "TestProdDeployWarnsOnInstance"
+        "TestProdDeployWithJava"
+        "TestProdDeployWithWait"
+        "TestProdDeployWithoutCertificate"
+        "TestProdDeployWithoutTests"
+        "TestSingleTestWithCloudAndEndpoints"
+        "TestSingleTestWithCloudAndTokenAuth"
+        "TestStatusCloudDeployment"
+        # tries to call home for most recent version but we have our own test
+        "TestVersion"
+        "TestVersionCheckHomebrew"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+  versionCheckProgramArg = "version";
+  versionCheckKeepEnvironment = [ "HOME" ];
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Command-line tool for Vespa.ai";
+    downloadPage = "https://github.com/vespa-engine/vespa/blob/v${finalAttrs.version}/client/go";
+    changelog = "https://github.com/vespa-engine/vespa/releases/tag/v${finalAttrs.version}";
+    homepage = "https://vespa.ai/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ ethancedwards8 ];
+    mainProgram = "vespa";
+  };
+})
diff --git a/pkgs/by-name/wi/wireproxy/package.nix b/pkgs/by-name/wi/wireproxy/package.nix
index 241ed73364f7..f2416df91cc9 100644
--- a/pkgs/by-name/wi/wireproxy/package.nix
+++ b/pkgs/by-name/wi/wireproxy/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "wireproxy";
-  version = "1.0.10";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
-    owner = "pufferffish";
+    owner = "windtf";
     repo = "wireproxy";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-F8WatQsXgq3ex2uAy8eoS2DkG7uClNwZ74eG/mJN83o=";
+    hash = "sha256-R1G/VtyQsl7yoDwZw+24qTdeq//qYQTQwzAPvH8f+ls=";
   };
 
   ldflags = [
@@ -23,7 +23,7 @@ buildGoModule (finalAttrs: {
     "-X main.version=v${finalAttrs.version}"
   ];
 
-  vendorHash = "sha256-uCU5WLCKl5T4I1OccVl7WU0GM/t4RyAEmzHkJ22py30=";
+  vendorHash = "sha256-T6RN7f05bNVL7gfhaAR0+lKZWqXvMcgjiyPldCmmvU4=";
 
   passthru.tests.version = testers.testVersion {
     package = wireproxy;
@@ -33,7 +33,7 @@ buildGoModule (finalAttrs: {
 
   meta = {
     description = "Wireguard client that exposes itself as a socks5 proxy";
-    homepage = "https://github.com/pufferffish/wireproxy";
+    homepage = "https://github.com/windtf/wireproxy";
     license = lib.licenses.isc;
     maintainers = with lib.maintainers; [ _3JlOy-PYCCKUi ];
     mainProgram = "wireproxy";
diff --git a/pkgs/by-name/xp/xpar/package.nix b/pkgs/by-name/xp/xpar/package.nix
index ad9b8a5a4e91..9306a857d44c 100644
--- a/pkgs/by-name/xp/xpar/package.nix
+++ b/pkgs/by-name/xp/xpar/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xpar";
-  version = "1.0";
+  version = "1.1";
 
   src = fetchFromGitHub {
     owner = "iczelia";
     repo = "xpar";
     rev = finalAttrs.version;
-    hash = "sha256-FCYZl8tllGvgoIE/u9lpQJANOfB7phyOegXk82EOzzM=";
+    hash = "sha256-uY+MAFJdjf6i2LlPqdEkUdTB+9OmV1MaVAIS8GbGKEI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/yt/ytsub/package.nix b/pkgs/by-name/yt/ytsub/package.nix
new file mode 100644
index 000000000000..58ea052b356e
--- /dev/null
+++ b/pkgs/by-name/yt/ytsub/package.nix
@@ -0,0 +1,32 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  sqlite,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "ytsub";
+  version = "0.9.0";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "sarowish";
+    repo = "ytsub";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-6qPNSkUAj11Rut/Wx724UsFdRLwZh2Z+ZC7837CeNeQ=";
+  };
+
+  cargoHash = "sha256-RHOG43LTI3K0VzEpGsdSKheL1fjIZ1TyB6FCgoInUm8=";
+
+  buildInputs = [ sqlite ];
+
+  meta = {
+    description = "Subscriptions only TUI Youtube client";
+    homepage = "https://github.com/sarowish/ytsub";
+    changelog = "https://github.com/sarowish/ytsub/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ sarowish ];
+    mainProgram = "ytsub";
+  };
+})
diff --git a/pkgs/by-name/za/zapret2/package.nix b/pkgs/by-name/za/zapret2/package.nix
index 08f96106c855..c7c591cbba1e 100644
--- a/pkgs/by-name/za/zapret2/package.nix
+++ b/pkgs/by-name/za/zapret2/package.nix
@@ -20,7 +20,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zapret2";
-  version = "0.9.5.1";
+  version = "0.9.5.2";
 
   outputs = [
     "out"
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "bol-van";
     repo = "zapret2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uKLHzsi/AYQ8OLj2g8pszSCyD485Sg/s45Ko8gKN5z8=";
+    hash = "sha256-U2Sfm+51QwlBWZGCDwClVeXJrwssoA6tchc/FP+kyF8=";
     leaveDotGit = true;
     postFetch = ''
       cd "$out"
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 23e80e10348a..87529fbae590 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -97,7 +97,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "1.0.1";
+  version = "1.1.5";
 
   outputs = [
     "out"
@@ -110,7 +110,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wru2i6Zu3gnqy3zTpS2jfKaVRTVuhI0yaM2vF3bKtD4=";
+    hash = "sha256-jY73pkncs351ssZOho7fXcr0bKvQ9UynGEjfKTFFnik=";
   };
 
   postPatch = ''
@@ -139,7 +139,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm -r $out/git/*/candle-book/
   '';
 
-  cargoHash = "sha256-lBKexuOri/bI0Xc8ludVtLssGjdk+it83u/RtasaJFs=";
+  cargoHash = "sha256-uQMjh7JdpjcXYBO8GE6ZI24G13qS43AjM4mgmXEn4V4=";
 
   __structuredAttrs = true;
 
diff --git a/pkgs/by-name/zo/zoom-us/package.nix b/pkgs/by-name/zo/zoom-us/package.nix
index 656b646e8b67..d811819729b7 100644
--- a/pkgs/by-name/zo/zoom-us/package.nix
+++ b/pkgs/by-name/zo/zoom-us/package.nix
@@ -54,25 +54,25 @@ let
   # Zoom versions are released at different times per platform and often with different versions.
   # We write them on three lines like this (rather than using {}) so that the updater script can
   # find where to edit them.
-  versions.aarch64-darwin = "6.7.5.75246";
-  versions.x86_64-darwin = "6.7.5.75246";
+  versions.aarch64-darwin = "7.0.0.77593";
+  versions.x86_64-darwin = "7.0.0.77593";
 
   # This is the fallback version so that evaluation can produce a meaningful result.
-  versions.x86_64-linux = "6.7.5.6891";
+  versions.x86_64-linux = "7.0.0.1666";
 
   srcs = {
     aarch64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.aarch64-darwin}/zoomusInstallerFull.pkg?archType=arm64";
       name = "zoomusInstallerFull.pkg";
-      hash = "sha256-oNeoW7WNq9ES4lJjc+zGrQs/yJ2E7DSsh33hEiU1RSE=";
+      hash = "sha256-YSUaM8YAJHigm4M9W34/bD164M8f/hbhtcmHyUwFN20=";
     };
     x86_64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-darwin}/zoomusInstallerFull.pkg";
-      hash = "sha256-2D8Q0rRluBM0UpXL5QN3a67b0X1iIW67YWZvVqsl4Qg=";
+      hash = "sha256-jIKBCrnvF101WJm8Tcpi2R5jRsqRXH7NQVGkSTnAeMA=";
     };
     x86_64-linux = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-linux}/zoom_x86_64.pkg.tar.xz";
-      hash = "sha256-Qy4o3vbgiAjKUGWMFi8rNqyDAohG7TgwX69jKVWTWeY=";
+      hash = "sha256-aPQ44znQfxcjGnUpON5RRj3+SG+IDaBa/s0khwj/AIo=";
     };
   };
 
@@ -148,7 +148,6 @@ let
       maintainers = with lib.maintainers; [
         philiptaron
         ryan4yin
-        yarny
       ];
       mainProgram = "zoom";
     };
@@ -160,41 +159,37 @@ let
     pkgs:
     [
       pkgs.alsa-lib
-      pkgs.at-spi2-atk
-      pkgs.at-spi2-core
       pkgs.atk
       pkgs.cairo
-      pkgs.coreutils
       pkgs.cups
       pkgs.dbus
       pkgs.expat
       pkgs.fontconfig
       pkgs.freetype
-      pkgs.gdk-pixbuf
       pkgs.glib
-      pkgs.glib.dev
       pkgs.gtk3
+      pkgs.ibus
       pkgs.libGL
       pkgs.libGLU
+      pkgs.libatomic_ops
       pkgs.libdrm
       pkgs.libgbm
       pkgs.libkrb5
+      pkgs.libsm
+      pkgs.libxi
       pkgs.libxkbcommon
+      pkgs.libxslt
+      pkgs.mesa
+      pkgs.mesa-demos
       pkgs.nspr
       pkgs.nss
       pkgs.pango
       pkgs.pciutils
       pkgs.pipewire
-      pkgs.procps
-      pkgs.qt5.qt3d
-      pkgs.qt5.qtgamepad
-      pkgs.qt5.qtlottie
-      pkgs.qt5.qtmultimedia
-      pkgs.qt5.qtremoteobjects
-      pkgs.qt5.qtxmlpatterns
+      pkgs.qt6.qtbase
+      pkgs.qt6.qtdeclarative
       pkgs.stdenv.cc.cc
       pkgs.udev
-      pkgs.util-linux
       pkgs.wayland
       pkgs.libx11
       pkgs.libxcomposite
@@ -212,6 +207,7 @@ let
       pkgs.libxcb-render-util
       pkgs.libxcb-wm
       pkgs.zlib
+      pkgs.zstd
     ]
     ++ lib.optionals pulseaudioSupport [
       pkgs.libpulseaudio
diff --git a/pkgs/development/compilers/haxe/default.nix b/pkgs/development/compilers/haxe/default.nix
index 953949b949a0..370163a096f4 100644
--- a/pkgs/development/compilers/haxe/default.nix
+++ b/pkgs/development/compilers/haxe/default.nix
@@ -10,12 +10,13 @@
   pcre2,
   neko,
   mbedtls_2,
+  mbedtls,
 }:
 let
   ocamlDependencies =
     version:
     if lib.versionAtLeast version "4.3" then
-      with ocaml-ng.ocamlPackages_4_14;
+      with ocaml-ng.ocamlPackages;
       [
         ocaml
         findlib
@@ -24,7 +25,7 @@ let
         ptmap
         camlp5
         sha
-        luv-0-5-12
+        luv
         extlib
       ]
     else
@@ -41,17 +42,10 @@ let
         extlib-1-7-7
       ];
 
-  defaultPatch = ''
-    substituteInPlace extra/haxelib_src/src/haxelib/client/Main.hx \
-      --replace '"neko"' '"${neko}/bin/neko"'
-  '';
-
   generic =
     {
       hash,
       version,
-      prePatch ? defaultPatch,
-      patches ? [ ],
     }:
     stdenv.mkDerivation {
       pname = "haxe";
@@ -63,7 +57,9 @@ let
         dune
       ]
       ++ (if lib.versionAtLeast version "4.3" then [ pcre2 ] else [ pcre ])
-      ++ lib.optional (lib.versionAtLeast version "4.1") mbedtls_2
+      ++ lib.optional (lib.versionAtLeast version "4.1") (
+        if lib.versionAtLeast version "4.3" then mbedtls else mbedtls_2
+      )
       ++ ocamlDependencies version;
 
       src = fetchFromGitHub {
@@ -74,7 +70,10 @@ let
         inherit hash;
       };
 
-      inherit prePatch patches;
+      prePatch = ''
+        substituteInPlace extra/haxelib_src/src/haxelib/client/Main.hx \
+          --replace-fail '"neko"' '"${neko}/bin/neko"'
+      '';
 
       buildFlags = [
         "all"
@@ -160,8 +159,7 @@ in
     hash = "sha256-QP5/jwexQXai1A5Iiwiyrm+/vkdAc+9NVGt+jEQz2mY=";
   };
   haxe_4_3 = generic {
-    version = "4.3.6";
-    hash = "sha256-m/A0xxB3fw+syPmH1GPKKCcj0a2G/HMRKOu+FKrO5jQ=";
-    patches = [ ./extlib-1.8.0.patch ];
+    version = "4.3.7";
+    hash = "sha256-sQb7MCoH2dZOvNmDQ9P0yFYrSXYOMn4FS/jlyjth39Y=";
   };
 }
diff --git a/pkgs/development/compilers/haxe/extlib-1.8.0.patch b/pkgs/development/compilers/haxe/extlib-1.8.0.patch
deleted file mode 100644
index c95448f830ac..000000000000
--- a/pkgs/development/compilers/haxe/extlib-1.8.0.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-diff --git a/src/context/typecore.ml b/src/context/typecore.ml
-index dc38a5264..0c3ebde9f 100644
---- a/src/context/typecore.ml
-+++ b/src/context/typecore.ml
-@@ -294,7 +294,7 @@ let add_local ctx k n t p =
- 			begin try
- 				let v' = PMap.find n ctx.locals in
- 				(* ignore std lib *)
--				if not (List.exists (ExtLib.String.starts_with p.pfile) ctx.com.std_path) then begin
-+				if not (List.exists (ExtLib.String.starts_with ~prefix:p.pfile) ctx.com.std_path) then begin
- 					warning ctx WVarShadow "This variable shadows a previously declared variable" p;
- 					warning ~depth:1 ctx WVarShadow (compl_msg "Previous variable was here") v'.v_pos
- 				end
-diff --git a/src/optimization/dce.ml b/src/optimization/dce.ml
-index 4e7b1fc98..90d8fc5d6 100644
---- a/src/optimization/dce.ml
-+++ b/src/optimization/dce.ml
-@@ -76,7 +76,7 @@ let overrides_extern_field cf c =
- 	loop c cf
- 
- let is_std_file dce file =
--	List.exists (ExtString.String.starts_with file) dce.std_dirs
-+	List.exists (ExtString.String.starts_with ~prefix:file) dce.std_dirs
- 
- let keep_metas = [Meta.Keep;Meta.Expose]
- 
diff --git a/pkgs/development/compilers/mrustc/default.nix b/pkgs/development/compilers/mrustc/default.nix
index c08248d9b5fc..aa400a99de2a 100644
--- a/pkgs/development/compilers/mrustc/default.nix
+++ b/pkgs/development/compilers/mrustc/default.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "0.11.2";
+  version = "0.12.0";
   tag = "v${version}";
   rev = "b6754f574f8846eb842feba4ccbeeecb10bdfacc";
 in
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
     owner = "thepowersgang";
     repo = "mrustc";
     rev = tag;
-    hash = "sha256-HW9+2mXri3ismeNeaDoTsCY6lxeH8AELegk+YbIn7Jw=";
+    hash = "sha256-wqHTTnk9c1khLsN6e0v703tUoTlpncMwZPXTKEVZ33s=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/afdko/default.nix b/pkgs/development/python-modules/afdko/default.nix
index a2bb7f770f32..c1df13372fc1 100644
--- a/pkgs/development/python-modules/afdko/default.nix
+++ b/pkgs/development/python-modules/afdko/default.nix
@@ -100,13 +100,19 @@ buildPythonPackage (finalAttrs: {
   ++ fonttools.optional-dependencies.unicode
   ++ fonttools.optional-dependencies.woff;
 
+  postInstall = ''
+    # clean up the install directory
+    # 5.0.0 release revamps the build system and hopefully makes this unnecessary
+    rm -r $out/{_skbuild,c,tests}
+  '';
+
   nativeCheckInputs = [ pytestCheckHook ];
 
   preCheck = ''
     export PATH=$PATH:$out/bin
 
     # Remove build artifacts to prevent them from messing with the tests
-    rm -rf _skbuild
+    rm -r _skbuild
   '';
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/aiovodafone/default.nix b/pkgs/development/python-modules/aiovodafone/default.nix
index bfa99bbc2a50..cb4b5a5beffc 100644
--- a/pkgs/development/python-modules/aiovodafone/default.nix
+++ b/pkgs/development/python-modules/aiovodafone/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aiovodafone";
-  version = "3.1.3";
+  version = "3.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "chemelli74";
     repo = "aiovodafone";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wgoPL/G9wPshhydHSFpSAFKiiFy/UacVbQ7mdcEuit0=";
+    hash = "sha256-CZz/rRRgZwP7gowYORkt8j99mU0CMgOX+M1JExvFNDI=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/airos/default.nix b/pkgs/development/python-modules/airos/default.nix
index 75d6b2b65c88..530aa8608b31 100644
--- a/pkgs/development/python-modules/airos/default.nix
+++ b/pkgs/development/python-modules/airos/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "airos";
-  version = "0.6.4";
+  version = "0.6.5";
   pyproject = true;
 
   disabled = pythonOlder "3.13";
@@ -23,7 +23,7 @@ buildPythonPackage (finalAttrs: {
     owner = "CoMPaTech";
     repo = "python-airos";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PXi4wZv8BcEdFcFvrlxryrp3JTEjDXydnkEKMud8IJc=";
+    hash = "sha256-B94YeY6R+83xo9+tmUbgJNi6AvBZ7h4C9VxovPVOL9E=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/apache-tvm-ffi/default.nix b/pkgs/development/python-modules/apache-tvm-ffi/default.nix
index bc9c5e9704f1..8344d888b80c 100644
--- a/pkgs/development/python-modules/apache-tvm-ffi/default.nix
+++ b/pkgs/development/python-modules/apache-tvm-ffi/default.nix
@@ -21,15 +21,16 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "apache-tvm-ffi";
-  version = "0.1.10";
+  version = "0.1.11";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "apache";
     repo = "tvm-ffi";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-qVO0SOs8eQh+Rl853XJuYIXY6Kis4HqATxhDBAhtxsI=";
+    hash = "sha256-dqAO6RLLGIRzPk7dNQsQCck+ziyONddhK/t4+S28cn8=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/arxiv/default.nix b/pkgs/development/python-modules/arxiv/default.nix
index e1bba8218a19..e76c832ac707 100644
--- a/pkgs/development/python-modules/arxiv/default.nix
+++ b/pkgs/development/python-modules/arxiv/default.nix
@@ -17,14 +17,14 @@
 }:
 buildPythonPackage rec {
   pname = "arxiv";
-  version = "2.4.1";
+  version = "3.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lukasschwab";
     repo = "arxiv.py";
     tag = version;
-    hash = "sha256-3GQ0HBYwkKlZ5WNgbJI/gHNi800WlnZiAJB6aSVBvjo=";
+    hash = "sha256-o2Vqkr5Tlx7Iv1NEWDSU8X6hvlGUslIl4oHiRQNGdqI=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/casaconfig/default.nix b/pkgs/development/python-modules/casaconfig/default.nix
new file mode 100644
index 000000000000..5b0040af4b1a
--- /dev/null
+++ b/pkgs/development/python-modules/casaconfig/default.nix
@@ -0,0 +1,30 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  certifi,
+}:
+buildPythonPackage (finalAttrs: {
+  pname = "casaconfig";
+  version = "1.5.0";
+
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-/O0rzef1Yqn+ezjTWfe1oRIh6FyU1W3Ev9tuXldukys=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ certifi ];
+
+  meta = {
+    description = "Reference data and converters for CASA operation";
+    homepage = "https://casa.nrao.edu/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ kiranshila ];
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/development/python-modules/casatasks/default.nix b/pkgs/development/python-modules/casatasks/default.nix
new file mode 100644
index 000000000000..f778b3340490
--- /dev/null
+++ b/pkgs/development/python-modules/casatasks/default.nix
@@ -0,0 +1,106 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchgit,
+  fetchurl,
+  common-updater-scripts,
+  curl,
+  gnugrep,
+  gnused,
+  writeShellScript,
+  jdk,
+  wheel,
+  casatools,
+  casaconfig,
+  matplotlib,
+  scipy,
+  certifi,
+  pyerfa,
+  setuptools,
+  pipInstallHook,
+}:
+buildPythonPackage (finalAttrs: {
+  pname = "casatasks";
+  version = "6.7.5.18";
+
+  src = fetchgit {
+    url = "https://open-bitbucket.nrao.edu/scm/casa/casa6.git";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-75oIlaNAyu70KWSjz38LoYAvV7RJgzH/X9uBnGpriF4=";
+    fetchSubmodules = false;
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/casatasks";
+
+  format = "other";
+
+  nativeBuildInputs = [
+    jdk
+    wheel
+    setuptools
+    pipInstallHook
+  ];
+
+  propagatedBuildInputs = [
+    casatools
+    casaconfig
+    matplotlib
+    scipy
+    certifi
+    pyerfa
+  ];
+
+  jarName = "xml-casa-assembly-1.88.jar";
+
+  xml_jar = fetchurl {
+    url = "http://casa.nrao.edu/download/devel/xml-casa/java/${finalAttrs.jarName}";
+    hash = "sha256-UJCiXLXAe7Prm1qGXJ9jbuZcgKhPTSrU8qnf4C5Goxs="; # xml-jar
+  };
+
+  postPatch = ''
+    mkdir -p java
+    cp ${finalAttrs.xml_jar} java/${finalAttrs.jarName}
+  '';
+
+  buildPhase = ''
+      runHook preBuild
+      export HOME=$(mktemp -d)
+      mkdir -p $HOME/.casa/data
+      cat > $HOME/.casa/config.py <<EOF
+    measures_auto_update=False
+    data_auto_update=False
+    EOF
+      python setup.py bdist_wheel --version ${finalAttrs.version}
+      runHook postBuild
+  '';
+
+  # Tests require a full CASA data directory and network access
+  doCheck = false;
+
+  passthru.updateScript = writeShellScript "update-casatasks" ''
+    set -euo pipefail
+    version=$(${lib.getExe curl} -s https://pypi.org/pypi/casatasks/json | ${lib.getExe gnugrep} -oP '"version"\s*:\s*"\K[^"]+' | head -1)
+    ${lib.getExe' common-updater-scripts "update-source-version"} python3Packages.casatasks "$version"
+
+    # Extract the jar filename from the xml-casa script at the new tag
+    jar_name=$(${lib.getExe curl} -s \
+      "https://open-bitbucket.nrao.edu/rest/api/1.0/projects/CASA/repos/casa6/raw/casatools/scripts/xml-casa?at=refs/tags/$version" | \
+      ${lib.getExe gnugrep} -oP '(?<=jarfile_name = ").*(?=")')
+    jar_url="http://casa.nrao.edu/download/devel/xml-casa/java/$jar_name"
+    jar_sri=$(nix-prefetch-url --type sha256 "$jar_url" | xargs nix hash convert --hash-algo sha256 --to sri)
+
+    nix_file=pkgs/development/python-modules/casatasks/default.nix
+    ${lib.getExe gnused} -i \
+      -e "s|xml-casa-assembly-[^ \"]*\.jar|$jar_name|" \
+      -e "s|hash = \"sha256-.*\"; # xml-jar|hash = \"$jar_sri\"; # xml-jar|" \
+      "$nix_file"
+  '';
+
+  meta = {
+    description = "High-level Python tasks for radio astronomy data reduction";
+    homepage = "https://casa.nrao.edu/";
+    license = lib.licenses.lgpl2Only;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ kiranshila ];
+  };
+})
diff --git a/pkgs/development/python-modules/casatools/default.nix b/pkgs/development/python-modules/casatools/default.nix
new file mode 100644
index 000000000000..868891e5dc4a
--- /dev/null
+++ b/pkgs/development/python-modules/casatools/default.nix
@@ -0,0 +1,113 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchgit,
+  fetchurl,
+  common-updater-scripts,
+  curl,
+  gnugrep,
+  gnused,
+  writeShellScript,
+  cmake,
+  pkg-config,
+  swig,
+  flex,
+  bison,
+  gfortran,
+  jdk,
+  setuptools,
+  wheel,
+  build,
+  numpy,
+  casaconfig,
+  casacpp,
+  xercesc,
+  grpc,
+  readline,
+}:
+buildPythonPackage (finalAttrs: {
+  pname = "casatools";
+  version = "6.7.5.18";
+
+  src = fetchgit {
+    url = "https://open-bitbucket.nrao.edu/scm/casa/casa6.git";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-75oIlaNAyu70KWSjz38LoYAvV7RJgzH/X9uBnGpriF4=";
+    fetchSubmodules = false;
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/casatools";
+
+  format = "pyproject";
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    swig
+    flex
+    bison
+    gfortran
+    jdk
+    grpc
+    setuptools
+    wheel
+    build
+  ];
+
+  dontConfigure = true;
+
+  buildInputs = [
+    casacpp
+    xercesc
+    readline
+  ];
+
+  propagatedBuildInputs = [
+    numpy
+    casaconfig
+  ];
+
+  jarName = "xml-casa-assembly-1.88.jar";
+
+  xml_jar = fetchurl {
+    url = "http://casa.nrao.edu/download/devel/xml-casa/java/${finalAttrs.jarName}";
+    hash = "sha256-UJCiXLXAe7Prm1qGXJ9jbuZcgKhPTSrU8qnf4C5Goxs="; # xml-jar
+  };
+
+  postPatch = ''
+    mkdir -p scripts/java
+    cp ${finalAttrs.xml_jar} scripts/java/${finalAttrs.jarName}
+    echo "${finalAttrs.version} ${finalAttrs.version}" > version.txt
+    sed -i 's/def compute_version():/def compute_version():\n    return "${finalAttrs.version}"\ndef _compute_version_orig():/' setup.py
+  '';
+
+  # Tests require a full CASA data directory and network access
+  doCheck = false;
+
+  passthru.updateScript = writeShellScript "update-casatools" ''
+    set -euo pipefail
+    version=$(${lib.getExe curl} -s https://pypi.org/pypi/casatools/json | ${lib.getExe gnugrep} -oP '"version"\s*:\s*"\K[^"]+' | head -1)
+    ${lib.getExe' common-updater-scripts "update-source-version"} python3Packages.casatools "$version"
+
+    # Extract the jar filename from the xml-casa script at the new tag
+    jar_name=$(${lib.getExe curl} -s \
+      "https://open-bitbucket.nrao.edu/rest/api/1.0/projects/CASA/repos/casa6/raw/casatools/scripts/xml-casa?at=refs/tags/$version" | \
+      ${lib.getExe gnugrep} -oP '(?<=jarfile_name = ").*(?=")')
+    jar_url="http://casa.nrao.edu/download/devel/xml-casa/java/$jar_name"
+    jar_sri=$(nix-prefetch-url --type sha256 "$jar_url" | xargs nix hash convert --hash-algo sha256 --to sri)
+
+    nix_file=pkgs/development/python-modules/casatools/default.nix
+    ${lib.getExe gnused} -i \
+      -e "s|xml-casa-assembly-[^ \"]*\.jar|$jar_name|" \
+      -e "s|hash = \"sha256-.*\"; # xml-jar|hash = \"$jar_sri\"; # xml-jar|" \
+      "$nix_file"
+  '';
+
+  meta = {
+    description = "Python interface to core radio astronomy data processing routines";
+    homepage = "https://casa.nrao.edu/";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ kiranshila ];
+  };
+})
diff --git a/pkgs/development/python-modules/cuda-pathfinder/default.nix b/pkgs/development/python-modules/cuda-pathfinder/default.nix
index ded37abf88cd..d70070d20644 100644
--- a/pkgs/development/python-modules/cuda-pathfinder/default.nix
+++ b/pkgs/development/python-modules/cuda-pathfinder/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "cuda-pathfinder";
-  version = "1.5.3";
+  version = "1.5.4";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -22,7 +22,7 @@ buildPythonPackage (finalAttrs: {
     owner = "NVIDIA";
     repo = "cuda-python";
     tag = "cuda-pathfinder-v${finalAttrs.version}";
-    hash = "sha256-Tj+0p+nIsOl2pMpKAUpdZ3nIcQ0kHWrPi6Qeu14oMRQ=";
+    hash = "sha256-0hUcc9jZooN7yQ63MJhpNJb1IyfwwTRbp4NjjbK4y1A=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/cuda_pathfinder";
diff --git a/pkgs/development/python-modules/equinox/default.nix b/pkgs/development/python-modules/equinox/default.nix
index 2c71c42b3861..62f10ee108c2 100644
--- a/pkgs/development/python-modules/equinox/default.nix
+++ b/pkgs/development/python-modules/equinox/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "equinox";
-  version = "0.13.7";
+  version = "0.13.8";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -29,7 +29,7 @@ buildPythonPackage (finalAttrs: {
     owner = "patrick-kidger";
     repo = "equinox";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vgmU8cqNCyiZYah1SSwzVtLS+YB2T1uooCC17k12+h8=";
+    hash = "sha256-JiIZKWuSkvrF09GdmegUeTyidaM5IRp4uqjJRsn86E4=";
   };
 
   # Relax speed constraints on tests that can fail on busy builders
diff --git a/pkgs/development/python-modules/gardena-bluetooth/default.nix b/pkgs/development/python-modules/gardena-bluetooth/default.nix
index 89e51bcb059b..fc8530c185a9 100644
--- a/pkgs/development/python-modules/gardena-bluetooth/default.nix
+++ b/pkgs/development/python-modules/gardena-bluetooth/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "gardena-bluetooth";
-  version = "2.7.0";
+  version = "2.8.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "elupus";
     repo = "gardena-bluetooth";
     tag = finalAttrs.version;
-    hash = "sha256-VqGcMz9tFXlrekwWQx2Wx1umbf/q3U9XkQKSkze2cCU=";
+    hash = "sha256-yl1I36p21lemKigijqks7cwOxWej+35bDB2D0KO3pa0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/hyper-connections/default.nix b/pkgs/development/python-modules/hyper-connections/default.nix
index 2a10d0d38e9c..b0ec4af38158 100644
--- a/pkgs/development/python-modules/hyper-connections/default.nix
+++ b/pkgs/development/python-modules/hyper-connections/default.nix
@@ -5,19 +5,21 @@
   fetchFromGitHub,
   hatchling,
   pytestCheckHook,
+  stdenv,
   torch,
+  torch-einops-utils,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "hyper-connections";
-  version = "0.4.7";
+  version = "0.4.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lucidrains";
     repo = "hyper-connections";
     tag = finalAttrs.version;
-    hash = "sha256-x1Yx9Fnow9154kFGLmjeCBLYJsbv6oJiC6Rk1XudqJQ=";
+    hash = "sha256-RDwnRtHUWilyqsDmdiV+kRg7BqTS1yghiu9RAM+MNjE=";
   };
 
   build-system = [ hatchling ];
@@ -25,10 +27,17 @@ buildPythonPackage (finalAttrs: {
   dependencies = [
     einops
     torch
+    torch-einops-utils
   ];
 
   nativeCheckInputs = [ pytestCheckHook ];
 
+  disabledTests = lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+    # torch's cpuinfo init fails to parse /sys/devices/system/cpu/{possible,present}
+    # in the build sandbox on aarch64-linux, breaking `.half()` calls
+    "test_mhc_dtype_restoration"
+  ];
+
   pythonImportsCheck = [ "hyper_connections" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/jupyter-ydoc/default.nix b/pkgs/development/python-modules/jupyter-ydoc/default.nix
index 0d7d3581edab..98e99eb297c1 100644
--- a/pkgs/development/python-modules/jupyter-ydoc/default.nix
+++ b/pkgs/development/python-modules/jupyter-ydoc/default.nix
@@ -21,6 +21,7 @@ buildPythonPackage (finalAttrs: {
   pname = "jupyter-ydoc";
   version = "3.4.1";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "jupyter-server";
@@ -34,6 +35,9 @@ buildPythonPackage (finalAttrs: {
     hatchling
   ];
 
+  pythonRelaxDeps = [
+    "pycrdt"
+  ];
   dependencies = [
     anyio
     pycrdt
diff --git a/pkgs/development/python-modules/lupa/default.nix b/pkgs/development/python-modules/lupa/default.nix
index 64d1ff7f8671..3c82fbc43603 100644
--- a/pkgs/development/python-modules/lupa/default.nix
+++ b/pkgs/development/python-modules/lupa/default.nix
@@ -42,13 +42,27 @@ buildPythonPackage (finalAttrs: {
   postPatch = ''
     (
       set -x
-      rm -rf third-party/lua51;    cp -r ${srcOnly lua5_1}     third-party/lua51
-      rm -rf third-party/lua52;    cp -r ${srcOnly lua5_2}/src third-party/lua52
-      rm -rf third-party/lua53;    cp -r ${srcOnly lua5_3}/src third-party/lua53
-      rm -rf third-party/lua54;    cp -r ${srcOnly lua5_4}/src third-party/lua54
-      rm -rf third-party/lua55;    cp -r ${srcOnly lua5_5}/src third-party/lua55
-      rm -rf third-party/luajit20; cp -r ${srcOnly luajit_2_0} third-party/luajit20
-      rm -rf third-party/luajit21; cp -r ${srcOnly luajit_2_1} third-party/luajit21
+      ${lib.optionalString lua5_1.meta.available ''
+        rm -rf third-party/lua51;    cp -r ${srcOnly lua5_1}     third-party/lua51
+      ''}
+      ${lib.optionalString lua5_2.meta.available ''
+        rm -rf third-party/lua52;    cp -r ${srcOnly lua5_2}/src third-party/lua52
+      ''}
+      ${lib.optionalString lua5_3.meta.available ''
+        rm -rf third-party/lua53;    cp -r ${srcOnly lua5_3}/src third-party/lua53
+      ''}
+      ${lib.optionalString lua5_4.meta.available ''
+        rm -rf third-party/lua54;    cp -r ${srcOnly lua5_4}/src third-party/lua54
+      ''}
+      ${lib.optionalString lua5_5.meta.available ''
+        rm -rf third-party/lua55;    cp -r ${srcOnly lua5_5}/src third-party/lua55
+      ''}
+      ${lib.optionalString luajit_2_0.meta.available ''
+        rm -rf third-party/luajit20; cp -r ${srcOnly luajit_2_0} third-party/luajit20
+      ''}
+      ${lib.optionalString luajit_2_1.meta.available ''
+        rm -rf third-party/luajit21; cp -r ${srcOnly luajit_2_1} third-party/luajit21
+      ''}
       chmod -R +w third-party/*
     )
   '';
diff --git a/pkgs/development/python-modules/oelint-data/default.nix b/pkgs/development/python-modules/oelint-data/default.nix
index d69acef6d247..5d380282a67d 100644
--- a/pkgs/development/python-modules/oelint-data/default.nix
+++ b/pkgs/development/python-modules/oelint-data/default.nix
@@ -8,14 +8,15 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "oelint-data";
-  version = "1.4.12";
+  version = "1.4.13";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "priv-kweihmann";
     repo = "oelint-data";
     tag = finalAttrs.version;
-    hash = "sha256-Q+h5qSCvybxO+RojDNoS6g1Bt/fLpiWVJHRiMkgPpvY=";
+    hash = "sha256-wOpIgCyPIAWsnULbAQINzFkolns97SW/jMK8yXUOxdY=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pycrdt-store/default.nix b/pkgs/development/python-modules/pycrdt-store/default.nix
index ae00c9a260d4..374d2efe93f5 100644
--- a/pkgs/development/python-modules/pycrdt-store/default.nix
+++ b/pkgs/development/python-modules/pycrdt-store/default.nix
@@ -16,15 +16,16 @@
   trio,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pycrdt-store";
   version = "0.1.3";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "y-crdt";
     repo = "pycrdt-store";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-KlB3BDhL/dt1IaQvWOfq1hgTKptrobgoBpus/mjZ26M=";
   };
 
@@ -32,6 +33,9 @@ buildPythonPackage rec {
     hatchling
   ];
 
+  pythonRelaxDeps = [
+    "pycrdt"
+  ];
   dependencies = [
     anyio
     pycrdt
@@ -50,8 +54,8 @@ buildPythonPackage rec {
   meta = {
     description = "Persistent storage for pycrdt";
     homepage = "https://github.com/y-crdt/pycrdt-store";
-    changelog = "https://github.com/y-crdt/pycrdt-store/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/y-crdt/pycrdt-store/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ sarahec ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/pycrdt-websocket/default.nix b/pkgs/development/python-modules/pycrdt-websocket/default.nix
index fd6b9d80a1be..01f4e693bb39 100644
--- a/pkgs/development/python-modules/pycrdt-websocket/default.nix
+++ b/pkgs/development/python-modules/pycrdt-websocket/default.nix
@@ -25,20 +25,24 @@
   websockets,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pycrdt-websocket";
   version = "0.16.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "y-crdt";
     repo = "pycrdt-websocket";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-Qux8IxJR1nGbdpGz7RZBKJjYN0qfwfEpd2UDlduOna0=";
   };
 
   build-system = [ hatchling ];
 
+  pythonRelaxDeps = [
+    "pycrdt"
+  ];
   dependencies = [
     anyio
     pycrdt
@@ -79,8 +83,8 @@ buildPythonPackage rec {
   meta = {
     description = "WebSocket Connector for pycrdt";
     homepage = "https://github.com/jupyter-server/pycrdt-websocket";
-    changelog = "https://github.com/jupyter-server/pycrdt-websocket/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/jupyter-server/pycrdt-websocket/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     teams = [ lib.teams.jupyter ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/pycrdt/Cargo.lock b/pkgs/development/python-modules/pycrdt/Cargo.lock
index cf11b8daccfe..a4b5f93bf0cb 100644
--- a/pkgs/development/python-modules/pycrdt/Cargo.lock
+++ b/pkgs/development/python-modules/pycrdt/Cargo.lock
@@ -4,9 +4,9 @@ version = 4
 
 [[package]]
 name = "arc-swap"
-version = "1.9.0"
+version = "1.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a07d1f37ff60921c83bdfc7407723bdefe89b44b98a9b772f225c8f9d67141a6"
+checksum = "6a3a1fd6f75306b68087b831f025c712524bcb19aad54e557b1129cfa0a2b207"
 dependencies = [
  "rustversion",
 ]
@@ -35,9 +35,9 @@ dependencies = [
 
 [[package]]
 name = "bitflags"
-version = "2.11.0"
+version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "843867be96c8daad0d758b57df9392b6d8d271134fce549de6ce169ff98a92af"
+checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
 
 [[package]]
 name = "bumpalo"
@@ -103,23 +103,24 @@ dependencies = [
 
 [[package]]
 name = "fastrand"
-version = "2.3.0"
+version = "2.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
+checksum = "9f1f227452a390804cdb637b74a86990f2a7d7ba4b7d5693aac9b4dd6defd8d6"
 dependencies = [
  "getrandom",
 ]
 
 [[package]]
 name = "getrandom"
-version = "0.2.17"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
 dependencies = [
  "cfg-if",
  "js-sys",
  "libc",
- "wasi",
+ "r-efi",
+ "wasip2",
  "wasm-bindgen",
 ]
 
@@ -143,19 +144,20 @@ checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "js-sys"
-version = "0.3.91"
+version = "0.3.97"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b49715b7073f385ba4bc528e5747d02e66cb39c6146efb66b781f131f0fb399c"
+checksum = "a1840c94c045fbcf8ba2812c95db44499f7c64910a912551aaaa541decebcacf"
 dependencies = [
+ "cfg-if",
  "once_cell",
  "wasm-bindgen",
 ]
 
 [[package]]
 name = "libc"
-version = "0.2.183"
+version = "0.2.186"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5b646652bf6661599e1da8901b3b9522896f01e736bad5f723fe7a3a27f899d"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
 
 [[package]]
 name = "lock_api"
@@ -220,7 +222,7 @@ dependencies = [
 
 [[package]]
 name = "pycrdt"
-version = "0.12.50"
+version = "0.13.0"
 dependencies = [
  "pyo3",
  "serde_json",
@@ -229,9 +231,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3"
-version = "0.28.2"
+version = "0.28.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf85e27e86080aafd5a22eae58a162e133a589551542b3e5cee4beb27e54f8e1"
+checksum = "91fd8e38a3b50ed1167fb981cd6fd60147e091784c427b8f7183a7ee32c31c12"
 dependencies = [
  "libc",
  "once_cell",
@@ -243,18 +245,18 @@ dependencies = [
 
 [[package]]
 name = "pyo3-build-config"
-version = "0.28.2"
+version = "0.28.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8bf94ee265674bf76c09fa430b0e99c26e319c945d96ca0d5a8215f31bf81cf7"
+checksum = "e368e7ddfdeb98c9bca7f8383be1648fd84ab466bf2bc015e94008db6d35611e"
 dependencies = [
  "target-lexicon",
 ]
 
 [[package]]
 name = "pyo3-ffi"
-version = "0.28.2"
+version = "0.28.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "491aa5fc66d8059dd44a75f4580a2962c1862a1c2945359db36f6c2818b748dc"
+checksum = "7f29e10af80b1f7ccaf7f69eace800a03ecd13e883acfacc1e5d0988605f651e"
 dependencies = [
  "libc",
  "pyo3-build-config",
@@ -262,9 +264,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros"
-version = "0.28.2"
+version = "0.28.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f5d671734e9d7a43449f8480f8b38115df67bef8d21f76837fa75ee7aaa5e52e"
+checksum = "df6e520eff47c45997d2fc7dd8214b25dd1310918bbb2642156ef66a67f29813"
 dependencies = [
  "proc-macro2",
  "pyo3-macros-backend",
@@ -274,9 +276,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros-backend"
-version = "0.28.2"
+version = "0.28.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22faaa1ce6c430a1f71658760497291065e6450d7b5dc2bcf254d49f66ee700a"
+checksum = "c4cdc218d835738f81c2338f822078af45b4afdf8b2e33cbb5916f108b813acb"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -294,6 +296,12 @@ dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "r-efi"
+version = "5.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69cdb34c158ceb288df11e18b4bd39de994f6657d83847bdffdbd7f346754b0f"
+
 [[package]]
 name = "redox_syscall"
 version = "0.5.18"
@@ -417,16 +425,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
 [[package]]
-name = "wasi"
-version = "0.11.1+wasi-snapshot-preview1"
+name = "wasip2"
+version = "1.0.3+wasi-0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
+checksum = "20064672db26d7cdc89c7798c48a0fdfac8213434a1186e5ef29fd560ae223d6"
+dependencies = [
+ "wit-bindgen",
+]
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.114"
+version = "0.2.120"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6532f9a5c1ece3798cb1c2cfdba640b9b3ba884f5db45973a6f442510a87d38e"
+checksum = "df52b6d9b87e0c74c9edfa1eb2d9bf85e5d63515474513aa50fa181b3c4f5db1"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -437,9 +448,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.114"
+version = "0.2.120"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "18a2d50fcf105fb33bb15f00e7a77b772945a2ee45dcf454961fd843e74c18e6"
+checksum = "78b1041f495fb322e64aca85f5756b2172e35cd459376e67f2a6c9dffcedb103"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -447,9 +458,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.114"
+version = "0.2.120"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "03ce4caeaac547cdf713d280eda22a730824dd11e6b8c3ca9e42247b25c631e3"
+checksum = "9dcd0ff20416988a18ac686d4d4d0f6aae9ebf08a389ff5d29012b05af2a1b41"
 dependencies = [
  "bumpalo",
  "proc-macro2",
@@ -460,9 +471,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.114"
+version = "0.2.120"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75a326b8c223ee17883a4251907455a2431acc2791c98c26279376490c378c16"
+checksum = "49757b3c82ebf16c57d69365a142940b384176c24df52a087fb748e2085359ea"
 dependencies = [
  "unicode-ident",
 ]
@@ -474,10 +485,16 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
 [[package]]
-name = "yrs"
-version = "0.25.0"
+name = "wit-bindgen"
+version = "0.57.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6893d39bc55d014e4a1d0e71d06c0c41590d5cdeac35c126be44998bc320cff"
+checksum = "1ebf944e87a7c253233ad6766e082e3cd714b5d03812acc24c318f549614536e"
+
+[[package]]
+name = "yrs"
+version = "0.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "89512f2d869f9947e1c58d57ef86c8f4ca1b1e8ccf24d6e1ff8c7cdbd67d54df"
 dependencies = [
  "arc-swap",
  "async-lock",
diff --git a/pkgs/development/python-modules/pycrdt/default.nix b/pkgs/development/python-modules/pycrdt/default.nix
index fb11fa87245a..05733b1f133a 100644
--- a/pkgs/development/python-modules/pycrdt/default.nix
+++ b/pkgs/development/python-modules/pycrdt/default.nix
@@ -20,14 +20,15 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pycrdt";
-  version = "0.12.50";
+  version = "0.13.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "y-crdt";
     repo = "pycrdt";
     tag = finalAttrs.version;
-    hash = "sha256-YtOgUzoqLnRslHrSWSkP+AexdaBR/1e+NH4gKSIKn9I=";
+    hash = "sha256-gfXdH/V2ZwxfxMFoA20cMv0ilgxuCULl4EFl2vqStqI=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pyinfra/default.nix b/pkgs/development/python-modules/pyinfra/default.nix
index 4266d6f60096..2e6fc8ede05b 100644
--- a/pkgs/development/python-modules/pyinfra/default.nix
+++ b/pkgs/development/python-modules/pyinfra/default.nix
@@ -1,56 +1,50 @@
 {
   lib,
   buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  hatchling,
+  uv-dynamic-versioning,
+
+  # dependencies
   click,
   distro,
-  fetchFromGitHub,
-  fetchpatch,
-  freezegun,
   gevent,
-  hatchling,
   jinja2,
   packaging,
   paramiko,
   pydantic,
+  python-dateutil,
+  typeguard,
+  types-paramiko,
+
+  # tests
+  freezegun,
   pyinfra-testgen,
   pytest-testinfra,
   pytestCheckHook,
-  python-dateutil,
-  typeguard,
-  uv-dynamic-versioning,
+  versionCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pyinfra";
-  version = "3.6.1";
+  version = "3.8.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "Fizzadar";
     repo = "pyinfra";
-    tag = "v${version}";
-    hash = "sha256-SB/V5pV10pBaYyYTp/Ty3J+/NX9oT3u++ZWELCk1qkc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-0DIG1Msttg7tqLbCZKi07uWTg3KYgH9rVlWPeJs4wwA=";
   };
 
-  patches = [
-    # paramiko v4 compat
-    # https://github.com/pyinfra-dev/pyinfra/pull/1525
-    (fetchpatch {
-      name = "remove-DSSKey.patch";
-      url = "https://github.com/pyinfra-dev/pyinfra/commit/a655bdf425884055145cfd0011c3b444c9a3ada2.patch";
-      hash = "sha256-puHcA4+KigltCL2tUYRMc9OT3kxvTeW77bbFbxgkcTs=";
-    })
-  ];
-
   build-system = [
     hatchling
     uv-dynamic-versioning
   ];
 
-  pythonRelaxDeps = [
-    "paramiko"
-  ];
-
   dependencies = [
     click
     distro
@@ -61,6 +55,7 @@ buildPythonPackage rec {
     pydantic
     python-dateutil
     typeguard
+    types-paramiko
   ];
 
   nativeCheckInputs = [
@@ -68,6 +63,7 @@ buildPythonPackage rec {
     pyinfra-testgen
     pytest-testinfra
     pytestCheckHook
+    versionCheckHook
   ];
 
   pythonImportsCheck = [ "pyinfra" ];
@@ -85,9 +81,9 @@ buildPythonPackage rec {
     '';
     homepage = "https://pyinfra.com";
     downloadPage = "https://pyinfra.com/Fizzadar/pyinfra/releases";
-    changelog = "https://github.com/Fizzadar/pyinfra/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/Fizzadar/pyinfra/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ totoroot ];
     mainProgram = "pyinfra";
   };
-}
+})
diff --git a/pkgs/development/python-modules/reno/default.nix b/pkgs/development/python-modules/reno/default.nix
index e778d3576402..2ee12e77fdb9 100644
--- a/pkgs/development/python-modules/reno/default.nix
+++ b/pkgs/development/python-modules/reno/default.nix
@@ -1,5 +1,5 @@
 {
-  buildPythonApplication,
+  buildPythonPackage,
   dulwich,
   docutils,
   lib,
@@ -15,7 +15,7 @@
   testscenarios,
 }:
 
-buildPythonApplication rec {
+buildPythonPackage (finalAttrs: {
   pname = "reno";
   version = "4.1.0";
   pyproject = true;
@@ -23,11 +23,11 @@ buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "openstack";
     repo = "reno";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-le9JtE0XODlYhTFsrjxFXG/Weshr+FyN4M4S3BMBLUE=";
   };
 
-  env.PBR_VERSION = version;
+  env.PBR_VERSION = finalAttrs.version;
 
   build-system = [
     setuptools
@@ -87,4 +87,4 @@ buildPythonApplication rec {
     license = lib.licenses.asl20;
     teams = [ lib.teams.openstack ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/rns/default.nix b/pkgs/development/python-modules/rns/default.nix
index 8e98127716cd..1bcc2cfafef8 100644
--- a/pkgs/development/python-modules/rns/default.nix
+++ b/pkgs/development/python-modules/rns/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "rns";
-  version = "1.2.0";
+  version = "1.2.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "markqvist";
     repo = "Reticulum";
     tag = finalAttrs.version;
-    hash = "sha256-DsEE+KRR4INC6kR39VCWrhMgEHNPexrQABYea5OSntI=";
+    hash = "sha256-4fb0oyS4LZvvMPKEKAE5lLI7ReCW2V6b5J/pQqMrcNM=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/sqlite-anyio/default.nix b/pkgs/development/python-modules/sqlite-anyio/default.nix
index 38f7460b3931..23ab7190efe2 100644
--- a/pkgs/development/python-modules/sqlite-anyio/default.nix
+++ b/pkgs/development/python-modules/sqlite-anyio/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "sqlite-anyio";
-  version = "0.2.3";
+  version = "0.2.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "davidbrochart";
     repo = "sqlite-anyio";
     tag = "v${version}";
-    hash = "sha256-cZyTpFmYD0l20Cmxl+Hwfh3oVkWvtXD45dMpcSwA2QE=";
+    hash = "sha256-1riZiLBccg7Vqq+a8xT5Lr4vxjkeMbf1wqXnTTgY8iY=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/symfc/default.nix b/pkgs/development/python-modules/symfc/default.nix
index 079abdc09506..431790167b6c 100644
--- a/pkgs/development/python-modules/symfc/default.nix
+++ b/pkgs/development/python-modules/symfc/default.nix
@@ -44,7 +44,7 @@ buildPythonPackage (finalAttrs: {
     pytestCheckHook
   ];
 
-  disabledTests = lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
+  disabledTests = lib.optionals stdenv.hostPlatform.isx86_64 [
     # assert (np.float64(0.5555555555555556) == 1.0 ± 1.0e-06
     "test_fc_basis_set_o3"
   ];
diff --git a/pkgs/development/python-modules/torch-einops-utils/default.nix b/pkgs/development/python-modules/torch-einops-utils/default.nix
new file mode 100644
index 000000000000..ffb0fd01cb34
--- /dev/null
+++ b/pkgs/development/python-modules/torch-einops-utils/default.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  buildPythonPackage,
+  einops,
+  fetchFromGitHub,
+  hatchling,
+  pytestCheckHook,
+  torch,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "torch-einops-utils";
+  version = "0.0.29";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "lucidrains";
+    repo = "torch-einops-utils";
+    tag = finalAttrs.version;
+    hash = "sha256-ja3HeBvAQRyGL2anqIQa2iiHhOZUhF73do7pvrTyRo0=";
+  };
+
+  build-system = [ hatchling ];
+
+  dependencies = [
+    einops
+    torch
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "torch_einops_utils" ];
+
+  meta = {
+    description = "Utility functions for torch and einops";
+    homepage = "https://github.com/lucidrains/torch-einops-utils";
+    changelog = "https://github.com/lucidrains/torch-einops-utils/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ miniharinn ];
+  };
+})
diff --git a/pkgs/development/tools/mysql-shell/8.nix b/pkgs/development/tools/mysql-shell/8.nix
index 2e909658bbde..e144cc8a0b04 100644
--- a/pkgs/development/tools/mysql-shell/8.nix
+++ b/pkgs/development/tools/mysql-shell/8.nix
@@ -38,8 +38,8 @@ let
     pyyaml
   ];
 
-  mysqlShellVersion = "8.4.8";
-  mysqlServerVersion = "8.4.8";
+  mysqlShellVersion = "8.4.9";
+  mysqlServerVersion = "8.4.9";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mysql-shell";
@@ -48,11 +48,11 @@ stdenv.mkDerivation (finalAttrs: {
   srcs = [
     (fetchurl {
       url = "https://dev.mysql.com/get/Downloads/MySQL-${lib.versions.majorMinor mysqlServerVersion}/mysql-${mysqlServerVersion}.tar.gz";
-      hash = "sha256-vp2Wzfh/J2lSos3ZYPEGuWCohg5GwRXtOcG18uA4eiA=";
+      hash = "sha256-5KqLOeQtH+B48zu9c2lfrCtU28e7E38L2+Y/e+GgLWs=";
     })
     (fetchurl {
       url = "https://dev.mysql.com/get/Downloads/MySQL-Shell/mysql-shell-${finalAttrs.version}-src.tar.gz";
-      hash = "sha256-0mNO/uJVvVHRSDalOIuvQOOsDR6OukfJuov8Uasr0tE=";
+      hash = "sha256-btYUh/akFRCSOXDL1C5xuXLysHS1lm4H74kqY+4zyiQ=";
     })
   ];
 
diff --git a/pkgs/development/tools/mysql-shell/9.nix b/pkgs/development/tools/mysql-shell/9.nix
new file mode 100644
index 000000000000..0ff2adc4f547
--- /dev/null
+++ b/pkgs/development/tools/mysql-shell/9.nix
@@ -0,0 +1,157 @@
+{
+  lib,
+  stdenv,
+  pkg-config,
+  cmake,
+  fetchurl,
+  git,
+  cctools,
+  darwin,
+  makeWrapper,
+  bison,
+  openssl,
+  protobuf,
+  curl,
+  zlib,
+  libssh,
+  zstd,
+  lz4,
+  readline,
+  libtirpc,
+  rpcsvc-proto,
+  libedit,
+  libevent,
+  icu,
+  re2,
+  ncurses,
+  libfido2,
+  python3,
+  cyrus_sasl,
+  openldap,
+  antlr,
+}:
+
+let
+  pythonDeps = with python3.pkgs; [
+    certifi
+    paramiko
+    pyyaml
+  ];
+
+  mysqlShellVersion = "9.7.0";
+  mysqlServerVersion = "9.7.0";
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "mysql-shell";
+  version = mysqlShellVersion;
+
+  srcs = [
+    (fetchurl {
+      url = "https://dev.mysql.com/get/Downloads/MySQL-${lib.versions.majorMinor mysqlServerVersion}/mysql-${mysqlServerVersion}.tar.gz";
+      hash = "sha256-dLV0urxWsOy2MqvTWdITxnlOz0Qq5Ekov8WB+z1iMG0=";
+    })
+    (fetchurl {
+      url = "https://dev.mysql.com/get/Downloads/MySQL-Shell/mysql-shell-${finalAttrs.version}-src.tar.gz";
+      hash = "sha256-s/omxSFTC/n3B8OtYddDqXzCd4GE4b5O8NUKbLdvwRI=";
+    })
+  ];
+
+  sourceRoot = "mysql-shell-${finalAttrs.version}-src";
+
+  postUnpack = ''
+    mv mysql-${mysqlServerVersion} mysql
+  '';
+
+  patches = [
+    # No openssl bundling on macOS. It's not working.
+    # See https://github.com/mysql/mysql-shell/blob/5b84e0be59fc0e027ef3f4920df15f7be97624c1/cmake/ssl.cmake#L53
+    ./no-openssl-bundling.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace ../mysql/cmake/libutils.cmake --replace-fail /usr/bin/libtool libtool
+    substituteInPlace ../mysql/cmake/os/Darwin.cmake --replace-fail /usr/bin/libtool libtool
+
+    substituteInPlace cmake/libutils.cmake --replace-fail /usr/bin/libtool libtool
+  '';
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+    git
+    bison
+    protobuf
+    makeWrapper
+  ]
+  ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ rpcsvc-proto ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    cctools
+    darwin.DarwinTools
+  ];
+
+  buildInputs = [
+    curl
+    libedit
+    libssh
+    lz4
+    openssl
+    protobuf
+    readline
+    zlib
+    zstd
+    libevent
+    icu
+    re2
+    ncurses
+    libfido2
+    cyrus_sasl
+    openldap
+    python3
+    antlr.runtime.cpp
+  ]
+  ++ pythonDeps
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ libtirpc ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.libutil ];
+
+  env = {
+    ${if stdenv.cc.isGNU then "NIX_CFLAGS_COMPILE" else null} = "-Wno-error=maybe-uninitialized";
+  };
+
+  preConfigure = ''
+    # Build MySQL
+    echo "Building mysqlclient mysqlxclient"
+
+    cmake -DWITH_SYSTEM_LIBS=ON -DWITH_FIDO=system -DWITH_ROUTER=ON -DWITH_UNIT_TESTS=OFF \
+      -DFORCE_UNSUPPORTED_COMPILER=1 -S ../mysql -B ../mysql/build
+
+    cmake --build ../mysql/build --parallel ''${NIX_BUILD_CORES:-1} \
+      --target mysqlclient mysqlxclient mysqlbinlog mysql_binlog_event_standalone mysqlrouter_all
+
+    cmakeFlagsArray+=(
+      "-DMYSQL_SOURCE_DIR=''${NIX_BUILD_TOP}/mysql"
+      "-DMYSQL_BUILD_DIR=''${NIX_BUILD_TOP}/mysql/build"
+      "-DMYSQL_CONFIG_EXECUTABLE=''${NIX_BUILD_TOP}/mysql/build/scripts/mysql_config"
+      "-DWITH_ZSTD=system"
+      "-DWITH_LZ4=system"
+      "-DWITH_ZLIB=system"
+      "-DWITH_PROTOBUF=system"
+      "-DHAVE_PYTHON=1"
+    )
+  '';
+
+  postFixup = ''
+    wrapProgram $out/bin/mysqlsh --set PYTHONPATH "${lib.makeSearchPath python3.sitePackages pythonDeps}"
+  '';
+
+  meta = {
+    homepage = "https://dev.mysql.com/doc/mysql-shell/${lib.versions.majorMinor finalAttrs.version}/en/";
+    description = "New command line scriptable shell for MySQL";
+    license = lib.licenses.gpl2;
+    maintainers = with lib.maintainers; [ aaronjheng ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    mainProgram = "mysqlsh";
+  };
+})
diff --git a/pkgs/development/tools/mysql-shell/innovation.nix b/pkgs/development/tools/mysql-shell/innovation.nix
index 8834c6d69ebd..4d8428a23539 100644
--- a/pkgs/development/tools/mysql-shell/innovation.nix
+++ b/pkgs/development/tools/mysql-shell/innovation.nix
@@ -38,8 +38,8 @@ let
     pyyaml
   ];
 
-  mysqlShellVersion = "9.6.0";
-  mysqlServerVersion = "9.6.0";
+  mysqlShellVersion = "9.7.0";
+  mysqlServerVersion = "9.7.0";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mysql-shell-innovation";
@@ -48,11 +48,11 @@ stdenv.mkDerivation (finalAttrs: {
   srcs = [
     (fetchurl {
       url = "https://dev.mysql.com/get/Downloads/MySQL-${lib.versions.majorMinor mysqlServerVersion}/mysql-${mysqlServerVersion}.tar.gz";
-      hash = "sha256-JABh2GnVrhiMmjM4RZKImenZY8y9Z4Zaii5Lb8tnF4w=";
+      hash = "sha256-dLV0urxWsOy2MqvTWdITxnlOz0Qq5Ekov8WB+z1iMG0=";
     })
     (fetchurl {
       url = "https://dev.mysql.com/get/Downloads/MySQL-Shell/mysql-shell-${finalAttrs.version}-src.tar.gz";
-      hash = "sha256-WnCr/poMsxtaS9k7/6QZDkFPOZlf7WAELsqFGpnUwf4=";
+      hash = "sha256-s/omxSFTC/n3B8OtYddDqXzCd4GE4b5O8NUKbLdvwRI=";
     })
   ];
 
diff --git a/pkgs/servers/http/apache-httpd/2.4.nix b/pkgs/servers/http/apache-httpd/2.4.nix
index 7fb86808a605..81d4ea6199d5 100644
--- a/pkgs/servers/http/apache-httpd/2.4.nix
+++ b/pkgs/servers/http/apache-httpd/2.4.nix
@@ -33,11 +33,11 @@
 
 stdenv.mkDerivation rec {
   pname = "apache-httpd";
-  version = "2.4.66";
+  version = "2.4.67";
 
   src = fetchurl {
     url = "mirror://apache/httpd/httpd-${version}.tar.bz2";
-    hash = "sha256-lNf/K0Ksu4KOhwuinky61I5VinnGI601luQRbvz+olo=";
+    hash = "sha256-Zs0gZjew1cRG+n2r51/gNSXaj7VYVYdsRiiM2IsTaqQ=";
   };
 
   patches = [
diff --git a/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix b/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix
index 2d3b5d87eb89..1f1b78033cfe 100644
--- a/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix
@@ -2,8 +2,8 @@
 
 grafanaPlugin {
   pname = "grafana-lokiexplore-app";
-  version = "2.0.3";
-  zipHash = "sha256-K57ynUi6kRZIMaZD9rMa7aToue75fHAQBFPJLF1cy3o=";
+  version = "2.0.4";
+  zipHash = "sha256-hne6G+Hmih+SYo4A1Gk7yHRMPA1IoCJoPlclTOpMKJc=";
   meta = {
     description = "Browse Loki logs without the need for writing complex queries";
     license = lib.licenses.agpl3Only;
diff --git a/pkgs/servers/monitoring/grafana/plugins/volkovlabs-form-panel/default.nix b/pkgs/servers/monitoring/grafana/plugins/volkovlabs-form-panel/default.nix
index ffd593d22b7f..3a440ef98d61 100644
--- a/pkgs/servers/monitoring/grafana/plugins/volkovlabs-form-panel/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/volkovlabs-form-panel/default.nix
@@ -2,8 +2,8 @@
 
 grafanaPlugin {
   pname = "volkovlabs-form-panel";
-  version = "6.3.2";
-  zipHash = "sha256-RuwZaAqSwMvWN15jz0+r7DuZyrE52zYD8EBffFTQNEg=";
+  version = "6.3.3";
+  zipHash = "sha256-nhHTNKqnSAGSpsAOB1IjcA4zm013ywJf/ucJzAm9osQ=";
   meta = {
     description = "Plugin that allows inserting and updating application data, as well as modifying configuration directly from your Grafana dashboard";
     license = lib.licenses.asl20;
diff --git a/pkgs/tools/misc/tdarr/common.nix b/pkgs/tools/misc/tdarr/common.nix
index 6ef7469c2308..499e642b4c95 100644
--- a/pkgs/tools/misc/tdarr/common.nix
+++ b/pkgs/tools/misc/tdarr/common.nix
@@ -24,6 +24,7 @@
   libxfixes,
   tesseract4,
   perl,
+  apprise,
 }:
 {
   pname,
@@ -129,6 +130,7 @@ stdenv.mkDerivation (finalAttrs: {
     libx11
     libxcursor
     libxfixes
+    apprise
   ];
 
   postPatch = ''
@@ -159,6 +161,12 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   postInstall = ''
+    # Remove musl-only prebuilt Node addons on glibc systems.
+    # autoPatchelf scans all ELF files in $out and fails if musl libc is missing.
+    ${lib.optionalString (stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isMusl) ''
+      find $out/share/${pname} -type f -name '*.musl.node' -delete
+    ''}
+
     makeWrapper $out/share/${pname}/${componentName} $out/bin/${pname} ${commonWrapperArgs}
     makeWrapper $out/share/${pname}/${componentTrayName} $out/bin/${pname}-tray ${commonWrapperArgs}
   ''
diff --git a/pkgs/tools/misc/tdarr/node.nix b/pkgs/tools/misc/tdarr/node.nix
index 869ac289ce23..980cc208b0bb 100644
--- a/pkgs/tools/misc/tdarr/node.nix
+++ b/pkgs/tools/misc/tdarr/node.nix
@@ -1,4 +1,4 @@
-{ callPackage }:
+{ callPackage, ccextractor }:
 
 callPackage ./common.nix { } {
   pname = "tdarr-node";
@@ -10,4 +10,6 @@ callPackage ./common.nix { } {
     darwin_x64 = "sha256-icgzoHqZ+P6gXJ8jQTau3O2D6uRvET4MtNoWJI/JnvM=";
     darwin_arm64 = "sha256-Rw478IpDLLe+Ek3Jt5Duaq1sHL1D3pE0HkVqk+v1ECE=";
   };
+
+  includeInPath = [ ccextractor ];
 }
diff --git a/pkgs/tools/security/metasploit/Gemfile b/pkgs/tools/security/metasploit/Gemfile
index b61946a2ca7f..d585c9aa8529 100644
--- a/pkgs/tools/security/metasploit/Gemfile
+++ b/pkgs/tools/security/metasploit/Gemfile
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 source "https://rubygems.org"
 
-gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.130"
+gem "metasploit-framework", git: "https://github.com/rapid7/metasploit-framework", ref: "refs/tags/6.4.131"
 
 gem "syslog", "~> 0.3.0"
 gem 'mini_portile2', '~> 2.8.0'
diff --git a/pkgs/tools/security/metasploit/Gemfile.lock b/pkgs/tools/security/metasploit/Gemfile.lock
index 1a74f5dd080c..67268ea9ea24 100644
--- a/pkgs/tools/security/metasploit/Gemfile.lock
+++ b/pkgs/tools/security/metasploit/Gemfile.lock
@@ -1,9 +1,9 @@
 GIT
   remote: https://github.com/rapid7/metasploit-framework
-  revision: e80a8066cd4c7177d821c04c886e3d0d90478bed
-  ref: refs/tags/6.4.130
+  revision: 69fa9eb257ea532c8e0f6ecd545b7e1257d42899
+  ref: refs/tags/6.4.131
   specs:
-    metasploit-framework (6.4.130)
+    metasploit-framework (6.4.131)
       aarch64
       abbrev
       actionpack (~> 7.2.0)
@@ -44,6 +44,7 @@ GIT
       jsobfu
       json
       lru_redux
+      mcp (= 0.13.0)
       metasm
       metasploit-concern
       metasploit-credential (>= 6.0.21)
@@ -174,7 +175,7 @@ GEM
     arel-helpers (2.17.0)
       activerecord (>= 3.1.0)
     aws-eventstream (1.4.0)
-    aws-partitions (1.1242.0)
+    aws-partitions (1.1245.0)
     aws-sdk-core (3.246.0)
       aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.992.0)
@@ -183,13 +184,13 @@ GEM
       bigdecimal
       jmespath (~> 1, >= 1.6.1)
       logger
-    aws-sdk-ec2 (1.613.0)
+    aws-sdk-ec2 (1.614.0)
       aws-sdk-core (~> 3, >= 3.244.0)
       aws-sigv4 (~> 1.5)
     aws-sdk-ec2instanceconnect (1.70.0)
       aws-sdk-core (~> 3, >= 3.244.0)
       aws-sigv4 (~> 1.5)
-    aws-sdk-iam (1.142.0)
+    aws-sdk-iam (1.143.0)
       aws-sdk-core (~> 3, >= 3.244.0)
       aws-sigv4 (~> 1.5)
     aws-sdk-kms (1.124.0)
@@ -210,7 +211,7 @@ GEM
     benchmark (0.5.0)
     bigdecimal (4.1.2)
     bindata (2.4.15)
-    bootsnap (1.24.1)
+    bootsnap (1.24.3)
       msgpack (~> 1.2)
     bson (5.2.0)
     builder (3.3.0)
@@ -290,7 +291,10 @@ GEM
     jmespath (1.6.2)
     jsobfu (0.4.2)
       rkelly-remix
-    json (2.19.4)
+    json (2.19.5)
+    json-schema (6.2.0)
+      addressable (~> 2.8)
+      bigdecimal (>= 3.1, < 5)
     little-plugger (1.1.4)
     logger (1.7.0)
     logging (2.4.0)
@@ -300,6 +304,8 @@ GEM
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
     lru_redux (1.1.0)
+    mcp (0.13.0)
+      json-schema (>= 4.1)
     metasm (1.0.5)
     metasploit-concern (5.0.6)
       activemodel (>= 7.0, < 8.1)
@@ -353,7 +359,7 @@ GEM
     mqtt (0.7.0)
       logger
     msgpack (1.6.1)
-    multi_json (1.20.1)
+    multi_json (1.21.1)
     mustermann (3.1.1)
     mutex_m (0.3.0)
     nessus_rest (0.1.6)
diff --git a/pkgs/tools/security/metasploit/default.nix b/pkgs/tools/security/metasploit/default.nix
index 7d5486fb68bd..79373b655e7e 100644
--- a/pkgs/tools/security/metasploit/default.nix
+++ b/pkgs/tools/security/metasploit/default.nix
@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "metasploit-framework";
-  version = "6.4.130";
+  version = "6.4.131";
 
   src = fetchFromGitHub {
     owner = "rapid7";
     repo = "metasploit-framework";
     tag = finalAttrs.version;
-    hash = "sha256-t50ZF2TobEVwQFgLp0lHQq2QNpplqIfVbNjWRIyxMXw=";
+    hash = "sha256-7u03A8H5vLQXekVLQ6oQtLwC6SW0JLqk37GUyjgtiZU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/tools/security/metasploit/gemset.nix b/pkgs/tools/security/metasploit/gemset.nix
index 18e6f0acffe2..5ea6776a5ce2 100644
--- a/pkgs/tools/security/metasploit/gemset.nix
+++ b/pkgs/tools/security/metasploit/gemset.nix
@@ -124,10 +124,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0llkqgj1hzdnj1v0qk7v3lj09c0g7hy60pnmm23r5ksc92snm22q";
+      sha256 = "0ipmr7n0affhj0y08a049wyz3n480i92y2s49v6qgsxs86y02dbi";
       type = "gem";
     };
-    version = "1.1242.0";
+    version = "1.1245.0";
   };
   aws-sdk-core = {
     groups = [ "default" ];
@@ -144,10 +144,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "09qbc4sfqgwmis289w24h4w6b40mg86c54s0xw0jm1sbb7mwv648";
+      sha256 = "0qq191bqffds55aw0dpi7iyl9135p12gj52ianrkan4l5l0bmwkb";
       type = "gem";
     };
-    version = "1.613.0";
+    version = "1.614.0";
   };
   aws-sdk-ec2instanceconnect = {
     groups = [ "default" ];
@@ -164,10 +164,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0jx5xrpw40nv5pfv8rvz7y8xhvxm756igcn4nr08agxd6byv7jk1";
+      sha256 = "14lhz5awd4g7nyaqq7vdigsw45r1vz7vbmkfhgp3946pxiib6cv5";
       type = "gem";
     };
-    version = "1.142.0";
+    version = "1.143.0";
   };
   aws-sdk-kms = {
     groups = [ "default" ];
@@ -274,10 +274,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1vrrblvh512xw4awcjfx2h5zdsv4dciwjjf0mhnv59aaq8fymynp";
+      sha256 = "1n6a9m8rb20yzb20w89fkjgggm2lzf1vl6ha5fjhlbvyb4h3vypp";
       type = "gem";
     };
-    version = "1.24.1";
+    version = "1.24.3";
   };
   bson = {
     groups = [ "default" ];
@@ -744,10 +744,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1b1rabz30grash5wh0lcv109w2ggggmmbclwnajqrcdk7wrps2k7";
+      sha256 = "0n9ch455pnvl9vxs2f3j77bpdmxg5g3mn3vyr9wxa0a87raii2i1";
       type = "gem";
     };
-    version = "2.19.4";
+    version = "2.19.5";
+  };
+  json-schema = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0rinh4347nvl9jm0r4mk7gi1zh1iz367w3dxn8d2r8j5v1pg9gz8";
+      type = "gem";
+    };
+    version = "6.2.0";
   };
   little-plugger = {
     groups = [ "default" ];
@@ -799,6 +809,16 @@
     };
     version = "1.1.0";
   };
+  mcp = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1mdigs4shvxkbs7fyhw8fss9fn4wd1lv9921iq27ply8kkn74plf";
+      type = "gem";
+    };
+    version = "0.13.0";
+  };
   metasm = {
     groups = [ "default" ];
     platforms = [ ];
@@ -834,12 +854,12 @@
     platforms = [ ];
     source = {
       fetchSubmodules = false;
-      rev = "e80a8066cd4c7177d821c04c886e3d0d90478bed";
-      sha256 = "0z1in6649mnqdkaqga35k8v91ba28x4sf2sq81q4av78chbik7dp";
+      rev = "69fa9eb257ea532c8e0f6ecd545b7e1257d42899";
+      sha256 = "15c95lwcm55ivyjbl95l4plh5g5l22m46js5g8bv9g7rq41kgvgf";
       type = "git";
       url = "https://github.com/rapid7/metasploit-framework";
     };
-    version = "6.4.130";
+    version = "6.4.131";
   };
   metasploit-model = {
     groups = [ "default" ];
@@ -946,10 +966,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0vfaab23d85617ps412ydb8ap4ci1sfzi8ainn8yyifc0pl38f9g";
+      sha256 = "1040lr5y2phn7avdyam6zw6ikprlmk77biw3yhclsfwfh0qnl4p6";
       type = "gem";
     };
-    version = "1.20.1";
+    version = "1.21.1";
   };
   mustermann = {
     groups = [ "default" ];
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index d40b1e88a94b..c1b64d3d4e6b 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -910,6 +910,7 @@ mapAliases {
   gradience = throw "`gradience` has been removed because it was archived upstream."; # Added 2025-09-20
   gradleGen = throw "'gradleGen' has been moved to `gradle-packages.mkGradle`."; # Added 2025-11-02
   grafana_reporter = throw "'grafana_reporter' has been renamed to/replaced by 'grafana-reporter'"; # Converted to throw 2025-10-27
+  graphia = throw "'graphia' has been removed due to being unmaintained and broken"; # Added 2026-05-05
   graphite-kde-theme = throw "'graphite-kde-theme' has been removed, as it is only compatible with Plasma 5, which is EOL"; # Added 2025-08-20
   gringo = throw "'gringo' has been renamed to/replaced by 'clingo'"; # Converted to throw 2025-10-27
   grub2_full = throw "'grub2_full' has been renamed to/replaced by 'grub2'"; # Converted to throw 2025-10-27
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index f6aeed056301..dd4e61ff864b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -485,9 +485,6 @@ with pkgs;
 
   buildDotnetPackage = callPackage ../build-support/dotnet/build-dotnet-package { };
   fetchNuGet = callPackage ../build-support/dotnet/fetchnuget { };
-  dupeguru = callPackage ../applications/misc/dupeguru {
-    python3Packages = python311Packages;
-  };
 
   fetchbzr = callPackage ../build-support/fetchbzr { };
 
@@ -560,8 +557,18 @@ with pkgs;
           else
             stdenv;
       };
+
+      mysql-shell_9 = callPackage ../development/tools/mysql-shell/9.nix {
+        antlr = antlr4_10;
+        icu = icu77;
+        protobuf = protobuf_25.override {
+          abseil-cpp = abseil-cpp_202407;
+        };
+        stdenv = if stdenv.cc.isGNU then gcc14Stdenv else stdenv;
+      };
     })
     mysql-shell_8
+    mysql-shell_9
     ;
 
   mysql-shell-innovation = callPackage ../development/tools/mysql-shell/innovation.nix {
@@ -570,13 +577,7 @@ with pkgs;
     protobuf = protobuf_25.override {
       abseil-cpp = abseil-cpp_202407;
     };
-    stdenv =
-      if stdenv.cc.isClang then
-        llvmPackages_19.stdenv
-      else if stdenv.cc.isGNU then
-        gcc14Stdenv
-      else
-        stdenv;
+    stdenv = if stdenv.cc.isGNU then gcc14Stdenv else stdenv;
   };
 
   # this is used by most `fetch*` functions
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e251b68b1217..395e6336b6fd 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2512,6 +2512,8 @@ self: super: with self; {
 
   casa-formats-io = callPackage ../development/python-modules/casa-formats-io { };
 
+  casaconfig = callPackage ../development/python-modules/casaconfig { };
+
   casadi = toPythonModule (
     pkgs.casadi.override {
       pythonSupport = true;
@@ -2519,6 +2521,10 @@ self: super: with self; {
     }
   );
 
+  casatasks = callPackage ../development/python-modules/casatasks { };
+
+  casatools = callPackage ../development/python-modules/casatools { };
+
   case-converter = callPackage ../development/python-modules/case-converter { };
 
   cashaddress = callPackage ../development/python-modules/cashaddress { };
@@ -19041,7 +19047,6 @@ self: super: with self; {
 
   taco = toPythonModule (
     pkgs.taco.override {
-      inherit (self) python;
       enablePython = true;
     }
   );
@@ -19600,6 +19605,8 @@ self: super: with self; {
 
   torch-c-dlpack-ext = callPackage ../development/python-modules/torch-c-dlpack-ext { };
 
+  torch-einops-utils = callPackage ../development/python-modules/torch-einops-utils { };
+
   torch-geometric = callPackage ../development/python-modules/torch-geometric { };
 
   # Required to test triton