diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 0f62dca72cf4..802dabdd269c 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -813,6 +813,13 @@
     githubId = 19290901;
     name = "Andrew Brooks";
   };
+  agentelement = {
+    email = "agentelement@agentelement.net";
+    github = "agentelement";
+    githubId = 38045210;
+    name = "AgentElement";
+    keys = [ { fingerprint = "D37E 581D AD71 2378 A622  5BC0 CD13 9E3B 4354 34F1"; } ];
+  };
   agilesteel = {
     email = "agilesteel@gmail.com";
     github = "agilesteel";
diff --git a/maintainers/scripts/luarocks-packages.csv b/maintainers/scripts/luarocks-packages.csv
index 51583b8e2b6f..5a7ff4b27883 100644
--- a/maintainers/scripts/luarocks-packages.csv
+++ b/maintainers/scripts/luarocks-packages.csv
@@ -12,6 +12,7 @@ cassowary,,,,,,alerque
 cldr,,,,,,alerque
 commons.nvim,,,,,5.1,mrcjkb
 compat53,,,,,,vcunat
+coop.nvim,,,,,,
 cosmo,,,,,,
 coxpcall,,,,1.17.0-1,,
 cqueues,,,,,,vcunat
@@ -53,8 +54,8 @@ lrexlib-pcre2,,,,,,wishstudio
 lrexlib-posix,,,,,,
 lsp-progress.nvim,,,,,5.1,gepbird
 lsqlite3,,,,,,
-ltreesitter-ts,,,,,,
 ltreesitter,,,,,,
+ltreesitter-ts,,,,,,
 lua-cjson,,,,,,
 lua-cmsgpack,,,,,,
 lua-curl,,,,,,
@@ -174,8 +175,8 @@ tree-sitter-http,,,,0.0.33-1,,
 tree-sitter-norg,,,,,5.1,mrcjkb
 tree-sitter-norg-meta,,,,,,
 tree-sitter-orgmode,,,,,5.1,
-utf8,,,,,,
 tree-sitter-teal,,,,,,
+utf8,,,,,,
 vicious,,,,,,
 vstruct,,,,,,
 vusted,,,,,,
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 9f1374926b11..822fedca09c5 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -245,6 +245,7 @@
   ./programs/iio-hyprland.nix
   ./programs/immersed.nix
   ./programs/iotop.nix
+  ./programs/jai-jail.nix
   ./programs/java.nix
   ./programs/joycond-cemuhook.nix
   ./programs/k3b.nix
diff --git a/nixos/modules/programs/jai-jail.nix b/nixos/modules/programs/jai-jail.nix
new file mode 100644
index 000000000000..aa493a9ccfcf
--- /dev/null
+++ b/nixos/modules/programs/jai-jail.nix
@@ -0,0 +1,45 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.programs.jai-jail;
+
+in
+{
+  options.programs.jai-jail = {
+    enable = lib.mkEnableOption "jai, a sandbox for AI agents";
+
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.jai-jail;
+      defaultText = lib.literalExpression "pkgs.jai-jail";
+      description = "The jai package to use.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    security.wrappers.jai = {
+      setuid = true;
+      owner = "root";
+      group = "root";
+      source = "${cfg.package}/bin/jai";
+    };
+
+    users.users.jai = {
+      isSystemUser = true;
+      group = "jai";
+      home = "/";
+      description = "JAI sandbox untrusted user";
+    };
+
+    users.groups.jai = { };
+
+    environment.systemPackages = [ cfg.package ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ agentelement ];
+}
diff --git a/nixos/modules/services/home-automation/home-assistant.nix b/nixos/modules/services/home-automation/home-assistant.nix
index 687128b81f4e..382c09cb0fa3 100644
--- a/nixos/modules/services/home-automation/home-assistant.nix
+++ b/nixos/modules/services/home-automation/home-assistant.nix
@@ -864,12 +864,19 @@ in
 
     networking.firewall.allowedTCPPorts = mkMerge [
       (mkIf cfg.openFirewall [ cfg.config.http.server_port ])
-      (mkIf cfg.openFirewallForComponents
+      (mkIf cfg.openFirewallForComponents (
+        # https://www.home-assistant.io/integrations/homekit/#firewall
+        optionals (useComponent "homekit") [ 21063 ]
         # https://www.home-assistant.io/integrations/sonos/#network-requirements
-        (optionals (useComponent "sonos") [ 1400 ])
-      )
+        ++ optionals (useComponent "sonos") [ 1400 ]
+      ))
     ];
 
+    networking.firewall.allowedUDPPorts = mkIf cfg.openFirewallForComponents (
+      # https://www.home-assistant.io/integrations/homekit/#firewall
+      optionals (useComponent "homekit") [ 5353 ]
+    );
+
     # symlink the configuration to /etc/home-assistant
     environment.etc = mkMerge [
       (mkIf (cfg.config != null && !cfg.configWritable) {
diff --git a/nixos/modules/services/mail/stalwart.nix b/nixos/modules/services/mail/stalwart.nix
index f64f334ee9d4..4e596ad3e572 100644
--- a/nixos/modules/services/mail/stalwart.nix
+++ b/nixos/modules/services/mail/stalwart.nix
@@ -304,7 +304,6 @@ in
   meta = {
     maintainers = with lib.maintainers; [
       happysalada
-      euxane
       onny
       norpol
     ];
diff --git a/nixos/modules/services/misc/inventree.nix b/nixos/modules/services/misc/inventree.nix
index 2c4b1df16621..70d386e96063 100644
--- a/nixos/modules/services/misc/inventree.nix
+++ b/nixos/modules/services/misc/inventree.nix
@@ -252,12 +252,13 @@ in
             in
             {
               "/" = {
+                # recommendedProxySettings sets the standard headers (Host, X-Forwarded-*), so
+                # don't also set them via proxy_set_header in extraConfig below. Nginx would then
+                # send Host twice and Django rejects it with DisallowedHost. Enabled per-location
+                # so it works even if the host's global recommendedProxySettings is off.
+                recommendedProxySettings = true;
                 extraConfig = ''
-                  proxy_set_header Host $host;
                   proxy_set_header X-Forwarded-By $server_addr:$server_port;
-                  proxy_set_header X-Forwarded-For $remote_addr;
-                  proxy_set_header X-Forwarded-Proto $scheme;
-                  proxy_set_header X-Real-IP $remote_addr;
                   proxy_set_header CLIENT_IP $remote_addr;
 
                   proxy_pass_request_headers on;
@@ -272,6 +273,8 @@ in
                 proxyPass = "http://unix:${unixPath}";
               };
               "/auth" = {
+                # same reasoning as "/"; this subrequest also reaches Django
+                recommendedProxySettings = true;
                 extraConfig = ''
                   internal;
                   proxy_pass_request_body off;
diff --git a/nixos/tests/stalwart/stalwart.nix b/nixos/tests/stalwart/stalwart.nix
index 2fa61e0e74fe..dd47543eea90 100644
--- a/nixos/tests/stalwart/stalwart.nix
+++ b/nixos/tests/stalwart/stalwart.nix
@@ -79,7 +79,6 @@ in
   meta = {
     maintainers = with lib.maintainers; [
       happysalada
-      euxane
       onny
     ];
   };
diff --git a/pkgs/applications/editors/emacs/make-emacs.nix b/pkgs/applications/editors/emacs/make-emacs.nix
index cf0bdf44e488..7178b8931ca5 100644
--- a/pkgs/applications/editors/emacs/make-emacs.nix
+++ b/pkgs/applications/editors/emacs/make-emacs.nix
@@ -408,6 +408,8 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.withFeature withSelinux "selinux")
   ];
 
+  __structuredAttrs = true;
+
   env =
     lib.optionalAttrs withNativeCompilation {
       NATIVE_FULL_AOT = "1";
diff --git a/pkgs/applications/editors/rednotebook/default.nix b/pkgs/applications/editors/rednotebook/default.nix
index 535adc0dc200..98a14bbca26d 100644
--- a/pkgs/applications/editors/rednotebook/default.nix
+++ b/pkgs/applications/editors/rednotebook/default.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
   gdk-pixbuf,
   glib,
@@ -9,12 +9,9 @@
   gtksourceview,
   pango,
   webkitgtk_4_1,
-  pygobject3,
-  pyyaml,
-  setuptools,
 }:
 
-buildPythonApplication (finalAttrs: {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "rednotebook";
   version = "2.42";
   pyproject = true;
@@ -31,7 +28,7 @@ buildPythonApplication (finalAttrs: {
 
   nativeBuildInputs = [ gobject-introspection ];
 
-  build-system = [ setuptools ];
+  build-system = with python3Packages; [ setuptools ];
 
   propagatedBuildInputs = [
     gdk-pixbuf
@@ -40,9 +37,11 @@ buildPythonApplication (finalAttrs: {
     gtksourceview
     pango
     webkitgtk_4_1
+  ]
+  ++ (with python3Packages; [
     pygobject3
     pyyaml
-  ];
+  ]);
 
   makeWrapperArgs = [
     "--set GI_TYPELIB_PATH $GI_TYPELIB_PATH"
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index e300c0a3bf1b..0b749e2678af 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -4043,20 +4043,6 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
-  coop-nvim = buildVimPlugin {
-    pname = "coop.nvim";
-    version = "0-unstable-2026-04-20";
-    src = fetchFromGitHub {
-      owner = "gregorias";
-      repo = "coop.nvim";
-      rev = "b156e541316aee14be4ae64c93ed8bddb6d03bc1";
-      hash = "sha256-S6iGmdakI714Im0tetgfASbe0K4/olYsjj26+WP+rSU=";
-    };
-    meta.homepage = "https://github.com/gregorias/coop.nvim/";
-    meta.license = getLicenseFromSpdxId "GPL-3.0-only";
-    meta.hydraPlatforms = [ ];
-  };
-
   copilot-cmp = buildVimPlugin {
     pname = "copilot-cmp";
     version = "0-unstable-2024-12-11";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 540a4fb4e206..8eec0b617b60 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -287,7 +287,6 @@ https://github.com/niklasdewally/conjure.nvim/,,
 https://github.com/wellle/context.vim/,,
 https://github.com/Shougo/context_filetype.vim/,,
 https://github.com/banjo/contextfiles.nvim/,,
-https://github.com/gregorias/coop.nvim/,,
 https://github.com/zbirenbaum/copilot-cmp/,,
 https://github.com/copilotlsp-nvim/copilot-lsp/,,
 https://github.com/AndreM222/copilot-lualine/,,
diff --git a/pkgs/applications/editors/vscode/vscode.nix b/pkgs/applications/editors/vscode/vscode.nix
index d3685fdf55f0..e72fec4cbe0b 100644
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@@ -113,6 +113,9 @@ buildVscode {
     '';
     homepage = "https://code.visualstudio.com/";
     downloadPage = "https://code.visualstudio.com/Updates";
+    changelog = "https://code.visualstudio.com/updates/v${
+      lib.replaceString "." "_" (lib.versions.majorMinor version)
+    }";
     license = lib.licenses.unfree;
     maintainers = with lib.maintainers; [
       eadwu
diff --git a/pkgs/applications/editors/vscode/vscodium.nix b/pkgs/applications/editors/vscode/vscodium.nix
index 1eb119129897..af9fa5cc4eba 100644
--- a/pkgs/applications/editors/vscode/vscodium.nix
+++ b/pkgs/applications/editors/vscode/vscodium.nix
@@ -79,6 +79,7 @@ buildVscode rec {
     '';
     homepage = "https://github.com/VSCodium/vscodium";
     downloadPage = "https://github.com/VSCodium/vscodium/releases";
+    changelog = "https://github.com/VSCodium/vscodium/releases/tag/${version}";
     license = lib.licenses.mit;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     maintainers = with lib.maintainers; [
diff --git a/pkgs/applications/emulators/libretro/cores/opera.nix b/pkgs/applications/emulators/libretro/cores/opera.nix
index ff06084247b9..35dd849c0993 100644
--- a/pkgs/applications/emulators/libretro/cores/opera.nix
+++ b/pkgs/applications/emulators/libretro/cores/opera.nix
@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "opera";
-  version = "0-unstable-2026-05-30";
+  version = "0-unstable-2026-06-09";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "opera-libretro";
-    rev = "d0a3b910f8bef6b8d48fb5eec4ad72ea5f022394";
-    hash = "sha256-OH9gkbMC4PJnpboiYrKV+XkQqq5ldq5tneyVJHfDzsM=";
+    rev = "5e36d4a9fbb2afbb8de2313b8e2bf83998ec2341";
+    hash = "sha256-TmSk0PIXOLToElUnyRkDFfpq3bvBh7+P8r8brYICJSY=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/misc/bitwarden-menu/default.nix b/pkgs/applications/misc/bitwarden-menu/default.nix
index ed5ef5cb7112..930ad053107b 100644
--- a/pkgs/applications/misc/bitwarden-menu/default.nix
+++ b/pkgs/applications/misc/bitwarden-menu/default.nix
@@ -1,14 +1,10 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchPypi,
-  hatch-vcs,
-  hatchling,
-  pynput,
-  xdg-base-dirs,
 }:
 
-buildPythonApplication (finalAttrs: {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "bitwarden-menu";
   version = "0.4.5";
   pyproject = true;
@@ -19,12 +15,12 @@ buildPythonApplication (finalAttrs: {
     hash = "sha256-vUlNqSVdGhfN5WjDjf1ub32Y2WoBndIdFzfCNwo5+Vg=";
   };
 
-  nativeBuildInputs = [
+  nativeBuildInputs = with python3Packages; [
     hatch-vcs
     hatchling
   ];
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     pynput
     xdg-base-dirs
   ];
diff --git a/pkgs/applications/misc/bluetooth_battery/default.nix b/pkgs/applications/misc/bluetooth_battery/default.nix
index ae694f30f8f5..afae33d6616a 100644
--- a/pkgs/applications/misc/bluetooth_battery/default.nix
+++ b/pkgs/applications/misc/bluetooth_battery/default.nix
@@ -1,11 +1,10 @@
 {
   lib,
+  python3Packages,
   fetchFromGitHub,
-  buildPythonApplication,
-  pybluez,
 }:
 
-buildPythonApplication (finalAttrs: {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "bluetooth_battery";
   version = "1.3.1";
 
@@ -16,7 +15,7 @@ buildPythonApplication (finalAttrs: {
     sha256 = "067qfxh228cy1x95bnjp88dx4k00ajj7ay7fz5vr1gkj2yfa203s";
   };
 
-  propagatedBuildInputs = [ pybluez ];
+  propagatedBuildInputs = with python3Packages; [ pybluez ];
 
   pyproject = false;
 
diff --git a/pkgs/applications/misc/mu-repo/default.nix b/pkgs/applications/misc/mu-repo/default.nix
index 8948f9317f54..99f52a5901b3 100644
--- a/pkgs/applications/misc/mu-repo/default.nix
+++ b/pkgs/applications/misc/mu-repo/default.nix
@@ -1,14 +1,13 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
-  pytestCheckHook,
   git,
   testers,
   mu-repo,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "mu-repo";
   version = "1.9.0";
   format = "setuptools";
@@ -23,7 +22,7 @@ buildPythonApplication rec {
   dependencies = [ git ];
 
   nativeCheckInputs = [
-    pytestCheckHook
+    python3Packages.pytestCheckHook
     git
   ];
 
diff --git a/pkgs/applications/misc/remarkable/remarkable-mouse/default.nix b/pkgs/applications/misc/remarkable/remarkable-mouse/default.nix
index c77cb1ca44f5..f446cac8c610 100644
--- a/pkgs/applications/misc/remarkable/remarkable-mouse/default.nix
+++ b/pkgs/applications/misc/remarkable/remarkable-mouse/default.nix
@@ -1,16 +1,10 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
-  libevdev,
-  paramiko,
-  pynput,
-  setuptools,
-  screeninfo,
-  tkinter,
 }:
 
-buildPythonApplication {
+python3Packages.buildPythonApplication {
   pname = "remarkable-mouse";
   version = "unstable-2024-02-23";
 
@@ -22,9 +16,9 @@ buildPythonApplication {
   };
 
   pyproject = true;
-  build-system = [ setuptools ];
+  build-system = with python3Packages; [ setuptools ];
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     screeninfo
     paramiko
     pynput
diff --git a/pkgs/applications/misc/termpdf.py/default.nix b/pkgs/applications/misc/termpdf.py/default.nix
index b09cc763abec..e565a54542c9 100644
--- a/pkgs/applications/misc/termpdf.py/default.nix
+++ b/pkgs/applications/misc/termpdf.py/default.nix
@@ -1,19 +1,11 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
   bibtool,
-  pybtex,
-  pymupdf,
-  pynvim,
-  pyperclip,
-  roman,
-  pdfrw,
-  pagelabels,
-  setuptools,
 }:
 
-buildPythonApplication {
+python3Packages.buildPythonApplication {
   pname = "termpdf.py";
   version = "2022-03-28";
   format = "setuptools";
@@ -27,6 +19,8 @@ buildPythonApplication {
 
   propagatedBuildInputs = [
     bibtool
+  ]
+  ++ (with python3Packages; [
     pybtex
     pymupdf
     pyperclip
@@ -35,7 +29,7 @@ buildPythonApplication {
     pdfrw
     pynvim
     setuptools
-  ];
+  ]);
 
   # upstream doesn't contain tests
   doCheck = false;
diff --git a/pkgs/applications/misc/yokadi/default.nix b/pkgs/applications/misc/yokadi/default.nix
index 2922ac095448..506143bce85d 100644
--- a/pkgs/applications/misc/yokadi/default.nix
+++ b/pkgs/applications/misc/yokadi/default.nix
@@ -1,15 +1,10 @@
 {
   lib,
+  python3Packages,
   fetchurl,
-  buildPythonApplication,
-  python-dateutil,
-  sqlalchemy,
-  setproctitle,
-  icalendar,
-  colorama,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "yokadi";
   version = "1.3.0";
   format = "setuptools";
@@ -19,7 +14,7 @@ buildPythonApplication rec {
     hash = "sha256-zF2ffHeU+i7wzu1u4DhQ5zJXr8AjXboiyFAisXNX6TM=";
   };
 
-  dependencies = [
+  dependencies = with python3Packages; [
     python-dateutil
     sqlalchemy
     setproctitle
diff --git a/pkgs/applications/networking/droopy/default.nix b/pkgs/applications/networking/droopy/default.nix
index a458b4a81af6..18057ff6997c 100644
--- a/pkgs/applications/networking/droopy/default.nix
+++ b/pkgs/applications/networking/droopy/default.nix
@@ -1,9 +1,9 @@
 {
-  stdenv,
   lib,
+  stdenv,
   fetchFromGitHub,
-  wrapPython,
   fetchpatch,
+  python3Packages,
 }:
 
 stdenv.mkDerivation {
@@ -28,7 +28,7 @@ stdenv.mkDerivation {
     })
   ];
 
-  nativeBuildInputs = [ wrapPython ];
+  nativeBuildInputs = [ python3Packages.wrapPython ];
 
   installPhase = ''
     install -vD droopy $out/bin/droopy
@@ -43,5 +43,4 @@ stdenv.mkDerivation {
     maintainers = [ ];
     mainProgram = "droopy";
   };
-
 }
diff --git a/pkgs/applications/networking/instant-messengers/matrix-commander/default.nix b/pkgs/applications/networking/instant-messengers/matrix-commander/default.nix
index 8b435e3f3400..a31c193028cb 100644
--- a/pkgs/applications/networking/instant-messengers/matrix-commander/default.nix
+++ b/pkgs/applications/networking/instant-messengers/matrix-commander/default.nix
@@ -1,22 +1,11 @@
 {
   lib,
+  python3Packages,
   fetchFromGitHub,
-  buildPythonApplication,
   cacert,
-  setuptools,
-  matrix-nio,
-  python-magic,
-  markdown,
-  pillow,
-  aiofiles,
-  notify2,
-  dbus-python,
-  pyxdg,
-  python-olm,
-  emoji,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "matrix-commander";
   version = "8.0.5";
 
@@ -41,6 +30,8 @@ buildPythonApplication rec {
 
   propagatedBuildInputs = [
     cacert
+  ]
+  ++ (with python3Packages; [
     setuptools
     (matrix-nio.override { withOlm = true; })
     python-magic
@@ -52,7 +43,7 @@ buildPythonApplication rec {
     pyxdg
     python-olm
     emoji
-  ];
+  ]);
 
   meta = {
     description = "Simple but convenient CLI-based Matrix client app for sending and receiving";
diff --git a/pkgs/applications/science/robotics/mavproxy/default.nix b/pkgs/applications/science/robotics/mavproxy/default.nix
index d7f077670950..872628416793 100644
--- a/pkgs/applications/science/robotics/mavproxy/default.nix
+++ b/pkgs/applications/science/robotics/mavproxy/default.nix
@@ -1,24 +1,13 @@
 {
-  stdenv,
   lib,
-  billiard,
-  buildPythonApplication,
+  stdenv,
+  python3Packages,
   fetchFromGitHub,
   fetchpatch,
-  gnureadline,
-  lxml,
-  matplotlib,
-  numpy,
-  opencv-python,
-  pymavlink,
-  pynmeagps,
-  pyserial,
-  setuptools,
   versionCheckHook,
-  wxpython,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "MAVProxy";
   version = "1.8.74";
   pyproject = true;
@@ -38,23 +27,25 @@ buildPythonApplication rec {
     })
   ];
 
-  build-system = [ setuptools ];
+  build-system = with python3Packages; [ setuptools ];
 
-  dependencies = [
-    lxml
-    matplotlib
-    numpy
-    opencv-python
-    pymavlink
-    pynmeagps
-    pyserial
-    setuptools # Imports `pkg_resources` at runtime
-    wxpython
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    billiard
-    gnureadline
-  ];
+  dependencies =
+    with python3Packages;
+    [
+      lxml
+      matplotlib
+      numpy
+      opencv-python
+      pymavlink
+      pynmeagps
+      pyserial
+      setuptools # Imports `pkg_resources` at runtime
+      wxpython
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      billiard
+      gnureadline
+    ];
 
   pythonImportsCheck = [ "MAVProxy" ];
 
diff --git a/pkgs/applications/science/robotics/sumorobot-manager/default.nix b/pkgs/applications/science/robotics/sumorobot-manager/default.nix
index 64539e3f8aee..fefee038a714 100644
--- a/pkgs/applications/science/robotics/sumorobot-manager/default.nix
+++ b/pkgs/applications/science/robotics/sumorobot-manager/default.nix
@@ -1,12 +1,9 @@
 {
   lib,
   stdenv,
-  python,
+  python3Packages,
   qt5,
   fetchFromGitHub,
-  wrapPython,
-  pyqt5,
-  pyserial,
   dos2unix,
 }:
 
@@ -21,14 +18,15 @@ stdenv.mkDerivation rec {
     sha256 = "07snhwmqqp52vdgr66vx50zxx0nmpmns5cdjgh50hzlhji2z1fl9";
   };
 
-  buildInputs = [ python ];
-  pythonPath = [
+  buildInputs = [ python3Packages.python ];
+
+  pythonPath = with python3Packages; [
     pyqt5.dev
     pyserial
   ];
 
   nativeBuildInputs = [
-    wrapPython
+    python3Packages.wrapPython
     qt5.wrapQtAppsHook
     dos2unix
   ];
diff --git a/pkgs/applications/video/jellyfin-mpv-shim/default.nix b/pkgs/applications/video/jellyfin-mpv-shim/default.nix
index 72ebac3f7f01..0f1334afafdb 100644
--- a/pkgs/applications/video/jellyfin-mpv-shim/default.nix
+++ b/pkgs/applications/video/jellyfin-mpv-shim/default.nix
@@ -1,25 +1,14 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   copyDesktopItems,
   fetchPypi,
   gobject-introspection,
-  jellyfin-apiclient-python,
-  jinja2,
   makeDesktopItem,
-  mpv,
-  pillow,
-  pystray,
-  python,
-  python-mpv-jsonipc,
-  pywebview,
-  setuptools,
-  tkinter,
   wrapGAppsHook3,
-  pypresence,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "jellyfin-mpv-shim";
   version = "2.9.0";
   pyproject = true;
@@ -35,9 +24,9 @@ buildPythonApplication rec {
     gobject-introspection
   ];
 
-  build-system = [ setuptools ];
+  build-system = with python3Packages; [ setuptools ];
 
-  dependencies = [
+  dependencies = with python3Packages; [
     jellyfin-apiclient-python
     mpv
     pillow
@@ -51,7 +40,7 @@ buildPythonApplication rec {
     jinja2
     pywebview
 
-    # discord rich presence dependencie
+    # discord rich presence dependency
     pypresence
   ];
 
@@ -80,7 +69,7 @@ buildPythonApplication rec {
   postInstall = ''
     for s in 16 32 48 64 128 256; do
       mkdir -p $out/share/icons/hicolor/''${s}x''${s}/apps
-      ln -s $out/${python.sitePackages}/jellyfin_mpv_shim/integration/jellyfin-''${s}.png \
+      ln -s $out/${python3Packages.python.sitePackages}/jellyfin_mpv_shim/integration/jellyfin-''${s}.png \
         $out/share/icons/hicolor/''${s}x''${s}/apps/${pname}.png
     done
   '';
diff --git a/pkgs/applications/video/plex-mpv-shim/default.nix b/pkgs/applications/video/plex-mpv-shim/default.nix
index 7044f915d016..7861f5be7edc 100644
--- a/pkgs/applications/video/plex-mpv-shim/default.nix
+++ b/pkgs/applications/video/plex-mpv-shim/default.nix
@@ -1,20 +1,13 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
-  fetchpatch,
-  python,
-  mpv,
-  requests,
-  python-mpv-jsonipc,
-  pystray,
-  tkinter,
   wrapGAppsHook3,
   gobject-introspection,
   mpv-shim-default-shaders,
 }:
 
-buildPythonApplication {
+python3Packages.buildPythonApplication {
   pname = "plex-mpv-shim";
   version = "1.11.0-unstable-2025-03-17";
   format = "setuptools";
@@ -31,7 +24,7 @@ buildPythonApplication {
     gobject-introspection
   ];
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     mpv
     requests
     python-mpv-jsonipc
@@ -47,7 +40,7 @@ buildPythonApplication {
 
   postInstall = ''
     # put link to shaders where upstream package expects them
-    ln -s ${mpv-shim-default-shaders}/share/mpv-shim-default-shaders $out/${python.sitePackages}/plex_mpv_shim/default_shader_pack
+    ln -s ${mpv-shim-default-shaders}/share/mpv-shim-default-shaders $out/${python3Packages.python.sitePackages}/plex_mpv_shim/default_shader_pack
   '';
 
   # does not contain tests
diff --git a/pkgs/applications/window-managers/hyprwm/hyprshade/default.nix b/pkgs/applications/window-managers/hyprwm/hyprshade/default.nix
index 13093dded9ac..79f4342066c0 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprshade/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprshade/default.nix
@@ -1,15 +1,12 @@
 {
   lib,
-  buildPythonPackage,
+  python3Packages,
   fetchFromGitHub,
-  hatchling,
-  more-itertools,
-  click,
   hyprland,
   makeWrapper,
 }:
 
-buildPythonPackage (finalAttrs: {
+python3Packages.buildPythonPackage (finalAttrs: {
   pname = "hyprshade";
   version = "4.0.1";
   pyproject = true;
@@ -22,11 +19,11 @@ buildPythonPackage (finalAttrs: {
   };
 
   nativeBuildInputs = [
-    hatchling
+    python3Packages.hatchling
     makeWrapper
   ];
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     more-itertools
     click
   ];
diff --git a/pkgs/by-name/al/alvr/ffmpeg.nix b/pkgs/by-name/al/alvr/ffmpeg.nix
new file mode 100644
index 000000000000..356b1800bd6d
--- /dev/null
+++ b/pkgs/by-name/al/alvr/ffmpeg.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  ffmpeg_6,
+  alvr,
+}:
+
+(ffmpeg_6.override {
+  version = "6.0";
+  hash = "sha256-RVbgsafIbeUUNXmUbDQ03ZN42oaUo0njqROo7KOQgv0=";
+
+  withHardcodedTables = false;
+
+  withHtmlDoc = false;
+  withManPages = false;
+  withPodDoc = false;
+  withTxtDoc = false;
+  withDocumentation = false;
+}).overrideAttrs
+  (old: {
+    # apply our own ffmpeg patches, but skip texinfo-7.1.patch as it does not apply to 6.0.
+    # apply upstream patches for ALVR as well.
+    patches =
+      (lib.filter (p: !(lib.hasSuffix "texinfo-7.1.patch" (baseNameOf (toString p)))) old.patches)
+      ++ [
+        (alvr.src + "/alvr/xtask/patches/0001-Add-AV_VAAPI_DRIVER_QUIRK_HEVC_ENCODER_ALIGN_64_16-f.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-av1-encode-backport.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-clip-constants-used-with-shift-instr.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-guid-conftest.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-lavu-hwcontext_vulkan-Fix-importing-RGBx-frames-to-C.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-update-rc-modes.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-vaapi_encode-Add-filler_data-option.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-vaapi_encode-Allow-to-dynamically-change-bitrate-and.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-vaapi_encode-Enable-global-header.patch")
+        (alvr.src + "/alvr/xtask/patches/0001-vaapi_encode_h265-Set-vui_parameters_present_flag.patch")
+      ];
+
+    doCheck = false;
+  })
diff --git a/pkgs/by-name/al/alvr/package.nix b/pkgs/by-name/al/alvr/package.nix
index 6de02465903e..d3ba6a6d1a68 100644
--- a/pkgs/by-name/al/alvr/package.nix
+++ b/pkgs/by-name/al/alvr/package.nix
@@ -2,8 +2,10 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  fetchpatch,
   replaceVars,
   nix-update-script,
+  callPackage,
   pkg-config,
   autoAddDriverRunpath,
   alsa-lib,
@@ -11,7 +13,7 @@
   brotli,
   bzip2,
   celt,
-  ffmpeg_7,
+  ffmpeg-alvr ? callPackage ./ffmpeg.nix { },
   gmp,
   jack2,
   lame,
@@ -42,6 +44,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "alvr";
+
   version = "20.14.1";
 
   src = fetchFromGitHub {
@@ -56,20 +59,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   patches = [
     (replaceVars ./fix-finding-libs.patch {
-      ffmpeg = lib.getDev ffmpeg_7;
+      ffmpeg = lib.getDev ffmpeg-alvr;
       x264 = lib.getDev x264;
     })
+    (fetchpatch {
+      url = "https://github.com/alvr-org/ALVR/commit/12a238b9ac9d63438163ff82cbd689733558a1e4.patch";
+      hash = "sha256-yvIGjopXIwGXajs5/RlAo+eqfVNnXlomKy/VO/dL+gc=";
+    })
   ];
 
-  postPatch = ''
-    substituteInPlace alvr/server_openvr/cpp/platform/linux/EncodePipelineVAAPI.cpp \
-      --replace-fail 'FF_PROFILE_H264_MAIN' 'AV_PROFILE_H264_MAIN' \
-      --replace-fail 'FF_PROFILE_H264_BASELINE' 'AV_PROFILE_H264_BASELINE' \
-      --replace-fail 'FF_PROFILE_H264_HIGH' 'AV_PROFILE_H264_HIGH' \
-      --replace-fail 'FF_PROFILE_HEVC_MAIN' 'AV_PROFILE_HEVC_MAIN' \
-      --replace-fail 'FF_PROFILE_AV1_MAIN' 'AV_PROFILE_AV1_MAIN'
-  '';
-
   env = {
     NIX_CFLAGS_COMPILE = toString [
       "-lbrotlicommon"
@@ -107,7 +105,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     brotli
     bzip2
     celt
-    ffmpeg_7
+    ffmpeg-alvr
     gmp
     jack2
     lame
@@ -153,7 +151,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ln -s $out/lib $out/lib64
   '';
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    inherit ffmpeg-alvr;
+    updateScript = nix-update-script { };
+  };
 
   meta = {
     description = "Stream VR games from your PC to your headset via Wi-Fi";
@@ -164,6 +165,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     maintainers = with lib.maintainers; [
       luNeder
       jopejoe1
+      eyjhb
     ];
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/by-name/an/anytype-heart/package.nix b/pkgs/by-name/an/anytype-heart/package.nix
index 69e632df434c..5b11214a178c 100644
--- a/pkgs/by-name/an/anytype-heart/package.nix
+++ b/pkgs/by-name/an/anytype-heart/package.nix
@@ -26,7 +26,7 @@ buildGoModule (finalAttrs: {
 
   # Use only versions specified in anytype-ts middleware.version file:
   #  https://github.com/anyproto/anytype-ts/blob/v<anytype-ts-version>/middleware.version
-  version = "0.49.0-rc08";
+  version = "0.50.8";
 
   # Update only together with 'anytype' package.
   # nixpkgs-update: no auto update
@@ -34,10 +34,10 @@ buildGoModule (finalAttrs: {
     owner = "anyproto";
     repo = "anytype-heart";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gTUesFf6cDwsFCEUjpcy9VA67GwuZ9mNTih4HC0Vi7g=";
+    hash = "sha256-h59Vnmv+iB0NbLQPCHPlmHBDaYoFimrZP/4Cv/IQ7b8=";
   };
 
-  vendorHash = "sha256-1D7v/lgmoKOOHNG3vgpzDpWQ66lmmP8IeZ5rvXe4D9M=";
+  vendorHash = "sha256-uJ/Z2zxqIne3UuxAglZejoqHV/IchYdPhefL9K51U2I=";
 
   subPackages = [ "cmd/grpcserver" ];
   tags = [
@@ -59,16 +59,11 @@ buildGoModule (finalAttrs: {
     cp ${tantivy-go}/lib/libtantivy_go.a deps/libs/${arch}
   '';
 
-  postBuild = ''
-    protoc -I ./  --js_out=import_style=commonjs,binary:./dist/js/pb pb/protos/service/*.proto pb/protos/*.proto pkg/lib/pb/model/protos/*.proto
-    protoc -I ./  --grpc-web_out=import_style=commonjs+dts,mode=grpcwebtext:./dist/js/pb pb/protos/service/*.proto pb/protos/*.proto pkg/lib/pb/model/protos/*.proto
-  '';
-
   postInstall = ''
     mv $out/bin/grpcserver $out/bin/anytypeHelper
-    mkdir -p $out/lib
-    cp -r dist/js/pb/* $out/lib
-    cp -r dist/js/pb/* $out/lib
+    mkdir -p $out/lib/protos
+    find pb -type f -name "*.proto" -exec cp {} $out/lib/protos/ \;
+    find pkg/lib/pb -type f -name "*.proto" -exec cp {} $out/lib/protos/ \;
 
     mkdir -p $out/lib/json/generated
     cp pkg/lib/bundle/system*.json $out/lib/json/generated
diff --git a/pkgs/by-name/an/anytype/0001-feat-update-Disable-auto-checking-for-updates-and-updating-manually.patch b/pkgs/by-name/an/anytype/0001-feat-update-Disable-auto-checking-for-updates-and-updating-manually.patch
index 7931ec439968..c8e17042b595 100644
--- a/pkgs/by-name/an/anytype/0001-feat-update-Disable-auto-checking-for-updates-and-updating-manually.patch
+++ b/pkgs/by-name/an/anytype/0001-feat-update-Disable-auto-checking-for-updates-and-updating-manually.patch
@@ -1,18 +1,8 @@
-From d236396b1da80a7233168e01e8164256e7f69cc1 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?David=20Chocholat=C3=BD?= <chocholaty.david@protonmail.com>
-Date: Fri, 25 Apr 2025 12:29:37 +0200
-Subject: [PATCH] feat(update): Disable auto checking for updates and updating
- manually
-
----
- electron/js/update.js | 6 +++++-
- 1 file changed, 5 insertions(+), 1 deletion(-)
-
-diff --git a/electron/js/update.js b/electron/js/update.js
-index 0e34efa..9386c90 100644
---- a/electron/js/update.js
-+++ b/electron/js/update.js
-@@ -29,7 +29,8 @@ class UpdateManager {
+diff --git a/electron/ts/update.ts b/electron/ts/update.ts
+index 8d63cb8eb7..ea2dadf0c9 100644
+--- a/electron/ts/update.ts
++++ b/electron/ts/update.ts
+@@ -31,7 +31,8 @@ class UpdateManager {
  		autoUpdater.autoInstallOnAppQuit = false;
  		autoUpdater.channel = channel;
  
@@ -22,16 +12,13 @@ index 0e34efa..9386c90 100644
  
  		autoUpdater.on('checking-for-update', () => {
  			Util.log('info', 'Checking for update');
-@@ -93,6 +94,9 @@ class UpdateManager {
+@@ -79,6 +80,9 @@ class UpdateManager {
  	};
  
- 	isAllowed () {
+ 	isAllowed (): boolean {
 +		// PATCH(update): Always disallow update check, even when requested by the user manually or when Anytype starts.
 +		return false;
 +
  		const { config } = ConfigManager;
  
  		if (config.updateDisabled) {
--- 
-2.49.0
-
diff --git a/pkgs/by-name/an/anytype/0002-remove-grpc-devtools.patch b/pkgs/by-name/an/anytype/0002-remove-grpc-devtools.patch
index b0dad3b73d7b..9e594683b70e 100644
--- a/pkgs/by-name/an/anytype/0002-remove-grpc-devtools.patch
+++ b/pkgs/by-name/an/anytype/0002-remove-grpc-devtools.patch
@@ -1,12 +1,12 @@
-diff --git a/electron.js b/electron.js
-index c5d6760882..17afc05e26 100644
---- a/electron.js
-+++ b/electron.js
-@@ -15,7 +15,6 @@ const store = new Store({ name: [ 'localStorage', suffix ].join('-') });
- 
- // gRPC DevTools extension ID
- const GRPC_DEVTOOLS_ID = 'fohdnlaeecihjiendkfhifhlgldpeopm';
--const { installExtension } = require('@tomjs/electron-devtools-installer');
- 
- // Fix notifications app name
- if (is.windows) {
+diff --git a/electron/ts/main.ts b/electron/ts/main.ts
+index 373518ee2d..8eefcd58be 100644
+--- a/electron/ts/main.ts
++++ b/electron/ts/main.ts
+@@ -15,7 +15,6 @@ import storage from 'electron-json-storage';
+ import * as remote from '@electron/remote/main';
+ import { installNativeMessagingHost } from './lib/installNativeMessagingHost';
+ import { getSafeStorage } from './safeStorage';
+-import { installExtension } from '@tomjs/electron-devtools-installer';
+ import Api from './api';
+ import ConfigManager from './config';
+ import UpdateManager from './update';
diff --git a/pkgs/by-name/an/anytype/0003-remove-desktop-entry.patch b/pkgs/by-name/an/anytype/0003-remove-desktop-entry.patch
index e772bdff71c6..2b8eeb826c18 100644
--- a/pkgs/by-name/an/anytype/0003-remove-desktop-entry.patch
+++ b/pkgs/by-name/an/anytype/0003-remove-desktop-entry.patch
@@ -1,13 +1,12 @@
-diff --git a/electron/js/util.js b/electron/js/util.js
-index da18f41ad0..bb07ec9f21 100644
---- a/electron/js/util.js
-+++ b/electron/js/util.js
-@@ -314,7 +314,9 @@ class Util {
- 		if (!is.linux) {
+diff --git a/electron/ts/util.ts b/electron/ts/util.ts
+index 1c5d6fd4b4..8c7811b58e 100644
+--- a/electron/ts/util.ts
++++ b/electron/ts/util.ts
+@@ -318,6 +318,9 @@ class Util {
  			return;
  		};
--
-+		// NixOS: desktop entries are managed by the package, avoid 
+ 
++		// NixOS: desktop entries are managed by the package, avoid
 +		// writing user-local anytype.desktop which goes stale on updates
 +		return;
  		const { execFile } = require('child_process');
diff --git a/pkgs/by-name/an/anytype/package.nix b/pkgs/by-name/an/anytype/package.nix
index 12391fb12824..c51ad8832da4 100644
--- a/pkgs/by-name/an/anytype/package.nix
+++ b/pkgs/by-name/an/anytype/package.nix
@@ -1,57 +1,116 @@
 {
   lib,
   stdenv,
+  stdenvNoCC,
   fetchFromGitHub,
-  buildNpmPackage,
-  nodejs_22,
+  makeWrapper,
+  coreutils,
+  nodejs,
+  node-gyp,
+  python3,
+  bun,
   pkg-config,
   anytype-heart,
   libsecret,
   electron,
   go,
   lsof,
+  protobuf,
   makeDesktopItem,
   copyDesktopItems,
+  writableTmpDirAsHomeHook,
   commandLineArgs ? "",
 }:
 
-buildNpmPackage (finalAttrs: {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "anytype";
-  version = "0.54.11";
+  version = "0.55.5";
+
+  strictDeps = true;
 
   src = fetchFromGitHub {
     owner = "anyproto";
     repo = "anytype-ts";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HF7bP3Ry3djNQnFDl0v6x9hzMpSLMXyI6UBItgGT+DI=";
+    hash = "sha256-9myOd7LTH/NoRY4SjU7+FSSNIhDMGKRPTBOQOURk/Hs=";
   };
 
   locales = fetchFromGitHub {
     owner = "anyproto";
     repo = "l10n-anytype-ts";
-    rev = "afa12aeb0cea6c77ce38c3e3bfd082d532948a1c";
-    hash = "sha256-YpOkmm7vW97t19twfLNExRHQvLVcrC+oDtHjwJL9dx8=";
+    rev = "b96bf7b76f10e764e7a60c7f284854aaabedcec6";
+    hash = "sha256-+vkProHi25CWxG74QB5eo0Pnwj0u5vXoZeeCoXyMOv4=";
   };
 
-  npmDepsHash = "sha256-/QWHJ2grw34LOEIDn93WDTEpQH001vVtuQgncR2SRYQ=";
+  node_modules = stdenvNoCC.mkDerivation {
+    pname = "${finalAttrs.pname}-node_modules";
+    inherit (finalAttrs) version src;
 
-  # npm dependency install fails with nodejs_24: https://github.com/NixOS/nixpkgs/issues/474535
-  nodejs = nodejs_22;
+    impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
+      "GIT_PROXY_COMMAND"
+      "SOCKS_SERVER"
+    ];
+
+    nativeBuildInputs = [
+      bun
+      writableTmpDirAsHomeHook
+    ];
+
+    dontConfigure = true;
+
+    buildPhase = ''
+      runHook preBuild
+
+      export BUN_INSTALL_CACHE_DIR=$(mktemp -d)
+      # https://bun.com/docs/pm/cli/install#configuring-with-environment-variables
+
+      # Bun always tries to use the fastest available installation method for the target platform. On macOS, that’s clonefile and on Linux, that’s hardlink.
+      bun install \
+        --backend=copyfile \
+        --cpu="*" \
+        --frozen-lockfile \
+        --ignore-scripts \
+        --no-progress \
+        --os="*"
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out
+      find . -type d -name node_modules -exec cp -R --parents {} $out \;
+
+      runHook postInstall
+    '';
+
+    dontFixup = true;
+
+    #TODO: update it in update script
+    outputHash = "sha256-6IHFidjVDDzUOCRXVwjvzcLGKV6dWWS7k2jwrOuJ748=";
+    outputHashMode = "recursive";
+  };
 
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
   };
 
   nativeBuildInputs = [
+    bun
+    nodejs
     pkg-config
     go
+    protobuf
     copyDesktopItems
+    makeWrapper
+    node-gyp
+    stdenv.cc
+    python3
   ];
-  buildInputs = [ libsecret ];
 
-  npmFlags = [
-    # keytar needs to be built against electron's ABI
-    "--nodedir=${electron.headers}"
+  buildInputs = [
+    libsecret
   ];
 
   patches = [
@@ -60,26 +119,54 @@ buildNpmPackage (finalAttrs: {
     ./0003-remove-desktop-entry.patch
   ];
 
+  configurePhase = ''
+    runHook preConfigure
+
+    cp -R ${finalAttrs.node_modules}/. .
+    patchShebangs node_modules
+
+    runHook postConfigure
+  '';
+
   buildPhase = ''
     runHook preBuild
 
+    # Building keytar against electron's ABI
+    # Trying to build in temp dir, will not work due to the keytar calling the node -p require('node-addon-api').include_dir
+    # but building inside the node_modules/keytar will find the ../node-addon-api automatically
+    chmod -R u+w node_modules/keytar node_modules/node-addon-api
+    pushd node_modules/keytar
+    HOME=$(mktemp -d) node-gyp rebuild --nodedir=${electron.headers}
+    popd
+
+    substituteInPlace scripts/generate-protos.sh \
+      --replace-fail "/usr/bin/env" "${coreutils}/bin/env"
+
     cp -r ${anytype-heart}/lib dist/
     cp -r ${anytype-heart}/bin/anytypeHelper dist/
 
+    # Without this, build fails when trying to copy/write into that directory during the js bundle step
+    chmod -R u+w dist/
+
+    bash ./scripts/generate-protos.sh --from-dist
+
+    bun run build
+
     for lang in ${finalAttrs.locales}/locales/*; do
       cp "$lang" "dist/lib/json/lang/$(basename $lang)"
     done
 
-    npm run build
-    npm run build:nmh
+    # $HOME/.cache/go-build.
+    export GOCACHE=$(mktemp -d)
+    # Runs "go build -o dist/nativeMessagingHost ./go/nativeMessagingHost.go"
+    bun run build:nmh
 
     runHook postBuild
   '';
 
   # remove unnecessary files
   preInstall = ''
-    npm prune --omit=dev
-    chmod u+w -R dist
+    chmod u+w -R dist node_modules
     find -type f \( -name "*.ts" -o -name "*.map" \) -exec rm -rf {} +
   '';
 
@@ -103,7 +190,7 @@ buildNpmPackage (finalAttrs: {
       --add-flags ${lib.escapeShellArg commandLineArgs}
 
     wrapProgram $out/lib/anytype/dist/nativeMessagingHost \
-       --prefix PATH : ${lib.makeBinPath [ lsof ]}
+      --prefix PATH : ${lib.makeBinPath [ lsof ]}
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/ba/bazaar/package.nix b/pkgs/by-name/ba/bazaar/package.nix
index 0768b6623617..5ef3c44b4f71 100644
--- a/pkgs/by-name/ba/bazaar/package.nix
+++ b/pkgs/by-name/ba/bazaar/package.nix
@@ -34,7 +34,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bazaar";
-  version = "0.8.1";
+  version = "0.8.3";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "bazaar-org";
     repo = "bazaar";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ni2WfZu4LpCIXueGJYnZ2c7sCQ9VJAeI9zVNNrh7BLE=";
+    hash = "sha256-s0l548kuVD+eNAxA3BnbpuMHD1alq0/xGBIkXb7WpC0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ba/bazel_9/package.nix b/pkgs/by-name/ba/bazel_9/package.nix
index 29838dd3bb6d..4b7d2b692d7a 100644
--- a/pkgs/by-name/ba/bazel_9/package.nix
+++ b/pkgs/by-name/ba/bazel_9/package.nix
@@ -29,7 +29,7 @@
   cctools,
   # Allow to independently override the jdks used to build and run respectively
   jdk_headless,
-  version ? "9.1.0",
+  version ? "9.1.1",
 }:
 
 let
@@ -89,7 +89,7 @@ let
 
   src = fetchzip {
     url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-dist.zip";
-    hash = "sha256-RbRM9HxcBij5gbd0aeArslc/IyjvycM5v7zOnaDT3cU=";
+    hash = "sha256-NwZQcycUMAzos1wLdSlwv2EjhDcPVJgQTkLT57AjFvI=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/bl/blackfire/package.nix b/pkgs/by-name/bl/blackfire/package.nix
index d90289827fa2..923a0e46d950 100644
--- a/pkgs/by-name/bl/blackfire/package.nix
+++ b/pkgs/by-name/bl/blackfire/package.nix
@@ -107,7 +107,7 @@ stdenv.mkDerivation rec {
     homepage = "https://blackfire.io/";
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ spk ];
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
diff --git a/pkgs/by-name/bl/blackfire/php-probe.nix b/pkgs/by-name/bl/blackfire/php-probe.nix
index 0216baee623c..d6eedd99df7a 100644
--- a/pkgs/by-name/bl/blackfire/php-probe.nix
+++ b/pkgs/by-name/bl/blackfire/php-probe.nix
@@ -16,57 +16,57 @@ let
   phpMajor = lib.versions.majorMinor php.version;
   inherit (stdenv.hostPlatform) system;
 
-  version = "1.92.51";
+  version = "2026.5.0";
 
   hashes = {
     "x86_64-linux" = {
       system = "amd64";
       hash = {
-        "8.1" = "sha256-HxVqkPupo3LrKfbQGOqoxpGJjFN17Jlkdya4BjBsBVw=";
-        "8.2" = "sha256-ssbMa4Wa27nwhJZ16FT+qrB4LH/HztOtCx+MI+i16Pg=";
-        "8.3" = "sha256-p9SXxHQGmsjtSeRFt9vYS5XK6nouT7qbqmlWbEpb2Hk=";
-        "8.4" = "sha256-ArI/SNjPIbjwEBMHvKCdSOkth8qqBWT6W0RnoWyWA+o=";
-        "8.5" = "sha256-5e4f9iEn5QPZY6Z+05O7QxTwaW+cjmP6nB5fkpValoM=";
+        "8.1" = "sha256-FQzmRL1Dk4HBnrfbfOclDWGvqflFXTUMK8b1NLIb880=";
+        "8.2" = "sha256-e2+hVsoBXt8gURRvGC4bgAkLpB1GriefokAjFFUuO8c=";
+        "8.3" = "sha256-C/NsbJ8XlkBPlZ0lPeNL4SWxfVWSLxvQYDxTVf2PfyA=";
+        "8.4" = "sha256-gqEV9thI/oe38/dyrGZxhPtv4+ufzMDXJL0zgt8IbOA=";
+        "8.5" = "sha256-kw57CBFOcRpaToXD/V2veXjcQnVaM3uTLC3tgrKyNzc=";
       };
     };
     "i686-linux" = {
       system = "i386";
       hash = {
-        "8.1" = "sha256-mTw8v5DaP7D5qb3XwRZvx8XH4bTiuu2xzzo82KsrrZU=";
-        "8.2" = "sha256-Vtb0DVfPBC0JtK1XOPQ8KmA0Jq0pBBA3jkDaCV7icGg=";
-        "8.3" = "sha256-vnL8gfA6ejMcpnfKXalSOvl7vixwQLJBC3DTO4Dafow=";
-        "8.4" = "sha256-x9/BcZPJib0hal6M2vUVk1cLmN1gc3k6hypViTqForo=";
-        "8.5" = "sha256-aVmQ8vHS/oQeb44RyV5hggOt+VXLqP7wKDxgfpbopQQ=";
+        "8.1" = "sha256-Cccapa4s6Wvo/MOjReCbbJY4H1HNe5uF8Fe4UX8ftFs=";
+        "8.2" = "sha256-1k8m4Mram806XIbR4x0Kf6IH7rvhbLbaqPgM9v1SHS4=";
+        "8.3" = "sha256-Si0boOO5BRDKARZbAbPPrxRIaUjwViQLepZ5tNvkjGk=";
+        "8.4" = "sha256-BOjlJy48fS2SWK28Lcd9/MVhciDEaBJe6mRIhTa9JhI=";
+        "8.5" = "sha256-OBySA7eGI+YqvMnsOlr7p6RznqYq7DJptnYjhMfqk2Q=";
       };
     };
     "aarch64-linux" = {
       system = "arm64";
       hash = {
-        "8.1" = "sha256-S41qr5wU2dsK0IBsR/mTALguPQU+SKYVTLP7DwGQo40=";
-        "8.2" = "sha256-eQkvDRxwQNXlkZ9XzcSRfkKjp/CTZGaFwolXq6TZWaE=";
-        "8.3" = "sha256-GBjjx0cSJjYCOdDiArUPA4iqOcgpk3y9o0wi6b6UJgM=";
-        "8.4" = "sha256-s4zcHogsOy1GjTAGJuO6i7S6dp/lmRVzbjJk3/t8Zn4=";
-        "8.5" = "sha256-/lFwv6p9izXj7X+pqZe9clcp+wSYtzIPnwqeE/HFqNk=";
+        "8.1" = "sha256-Od+c9X4yg4xW9aAI0x1CacUNp7PdJl1KRIi++m4DLY8=";
+        "8.2" = "sha256-ZI2n0lXkwUg8BvpjdhqHz1F3Z7dlX+oGv6IsjRVzzWA=";
+        "8.3" = "sha256-6NMvylxdwPpbmIN5EDVcBuplP2kEQDyY+fD23k89k48=";
+        "8.4" = "sha256-356ECFSrqu5kJX/qP+SNtKl7bsGGD/ROJd9vgEX5wSM=";
+        "8.5" = "sha256-z7GMQ9wqIr2/BKi3G2Wf3cZBtU/ZC+uKMcbnmYfmm8w=";
       };
     };
     "aarch64-darwin" = {
       system = "arm64";
       hash = {
-        "8.1" = "sha256-+ko465G24UELdMmEg4ZqOA9p0/0DSs3p+On6Gg2IVMM=";
-        "8.2" = "sha256-TERILY6E1vnl+L6t+oel+1H3HTHWTTeEb1rVXtriJ8w=";
-        "8.3" = "sha256-R5Ue3erVCe1gOPk1SuDRXGA05WPm1IisHCnbXfmjFcw=";
-        "8.4" = "sha256-qqbmZa4qd7Ck87GylHeHP9m3K47DAEiTxlKdtXEnzVo=";
-        "8.5" = "sha256-3d9glqfXCMXwtLZm8fuj9DVzCIczynX7MRxnbMC7/NE=";
+        "8.1" = "sha256-vlb6HCz9KqSL+bSuVixiHVgVVkEAuCaoR7ww0/ZSdR8=";
+        "8.2" = "sha256-3XVHonZ7UW3LENuKgywyZ5q3Mo/6XBhnbiuARRGqPAg=";
+        "8.3" = "sha256-Dw+L0Bo/6BeFi+w3sm5kekR0mXoMUcsCuEksCdFpVA0=";
+        "8.4" = "sha256-i5R+vUn08yNWvPaJGRRHBPAbpxdqDmvPq3l9NPCuqxg=";
+        "8.5" = "sha256-vyBbyS8Y1mD+zFO01bMbim8Riq45+ns9YA4k41KQup8=";
       };
     };
     "x86_64-darwin" = {
       system = "amd64";
       hash = {
-        "8.1" = "sha256-XvV6x8LKjR4j081PIdKpYCVl+ayXOmPsXf+gsMeFOro=";
-        "8.2" = "sha256-qxFWj1HpWokwzsFTiRhi4vw67H8yLwu1xbhja+fAxqY=";
-        "8.3" = "sha256-ffrwc48MZzX0MJHbaDmWQpday1LicOxhR2+fwylItD0=";
-        "8.4" = "sha256-P8j8gc8lZRbuVd1UmSpYmle88h50vhJfNxTZp3v9/Sg=";
-        "8.5" = "sha256-zy24hLCTajY+BVdkJCiXoy8abhQ82Ntw7Wuqn6zJKOQ=";
+        "8.1" = "sha256-0xf09E58+kOGZbfpUeaCNdeeJx/Sv4QazfgcdV3Fqho=";
+        "8.2" = "sha256-BU3INTjuVXJ+WB16Q/6I1I5y0k+7sR158vKOiuh6H4w=";
+        "8.3" = "sha256-TBTuabrEpQR7ff+ULjZCD99a1xX4KNjTWlMQTJ1l6NU=";
+        "8.4" = "sha256-45R0CrE6MZ4RU4HslaF5/jbMOz32fCMnzj8R1F9tu34=";
+        "8.5" = "sha256-40+kki7h6DLQemLyoKOSdd8hmQXJE+Yt4rcC4V706vs=";
       };
     };
   };
@@ -161,7 +161,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Blackfire Profiler PHP module";
     homepage = "https://blackfire.io/";
     license = lib.licenses.unfree;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ spk ];
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
diff --git a/pkgs/by-name/bl/bluesky-pds/package.nix b/pkgs/by-name/bl/bluesky-pds/package.nix
index cd0355d27cb7..3c990477451a 100644
--- a/pkgs/by-name/bl/bluesky-pds/package.nix
+++ b/pkgs/by-name/bl/bluesky-pds/package.nix
@@ -8,7 +8,7 @@
   fetchPnpmDeps,
   pnpmConfigHook,
   fetchFromGitHub,
-  nodejs_22,
+  nodejs_24,
   vips,
   pkg-config,
   nixosTests,
@@ -18,22 +18,22 @@
 }:
 
 let
-  # build failure against better-sqlite3, so we use nodejs_22; upstream
-  # bluesky-pds uses 20
-  nodejs = nodejs_22;
+  # upstream bluesky-social/atproto uses nodejs 22+
+  nodejs = nodejs_24;
   nodeSources = srcOnly nodejs;
   pythonEnv = python3.withPackages (p: [ p.setuptools ]);
+  pnpm = pnpm_9;
 in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pds";
-  version = "0.4.219";
+  version = "0.4.5001";
 
   src = fetchFromGitHub {
     owner = "bluesky-social";
     repo = "pds";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zXNg1rtXN9qdTBvRlSiPlRu6k1Pv3T8nhROsEarev5U=";
+    hash = "sha256-j7XNZYZHHj5HdtEuTAhNU9TD7S7eMILMflZJn0nDVaY=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/service";
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     pythonEnv
     pkg-config
     pnpmConfigHook
-    pnpm_9
+    pnpm
     removeReferencesTo
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
@@ -61,9 +61,9 @@ stdenv.mkDerivation (finalAttrs: {
       src
       sourceRoot
       ;
-    pnpm = pnpm_9;
-    fetcherVersion = 3;
-    hash = "sha256-rZpimxX4oDXIaUdAkkNPEff6qYJ9C8KptsPWJKwPiFo=";
+    inherit pnpm;
+    fetcherVersion = 4;
+    hash = "sha256-3/gjhQIMxI/mwqmKV1wZ6oMiCGHutXuDY2CFSN3QnE4=";
   };
 
   buildPhase = ''
@@ -76,7 +76,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     makeWrapper "${lib.getExe nodejs}" "$out/bin/pds" \
       --add-flags --enable-source-maps \
-      --add-flags "$out/lib/pds/index.js" \
+      --add-flags "$out/lib/pds/index.ts" \
       --set-default NODE_ENV production
 
     runHook postBuild
@@ -87,7 +87,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     mkdir -p $out/{bin,lib/pds}
     mv node_modules $out/lib/pds
-    mv index.js $out/lib/pds
+    mv index.ts $out/lib/pds
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/cl/clickhouse/package.nix b/pkgs/by-name/cl/clickhouse/package.nix
index a8d8e8883c11..e364e6a97376 100644
--- a/pkgs/by-name/cl/clickhouse/package.nix
+++ b/pkgs/by-name/cl/clickhouse/package.nix
@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "26.5.1.882-stable";
-  rev = "5b96a8d8a5e2f4800b43a780911a39dc5a666e1c";
-  hash = "sha256-Z+xcmHIkCuYSqOFdWSRWk2BFuCeI9yXnJIntSa4zXUk=";
+  version = "26.5.2.39-stable";
+  rev = "8462fd8f3dea8603e67666414b2781ab57a8adb6";
+  hash = "sha256-lbVveT6cFT9ZhSl+0qh3NhtO4FHakFWDBJd757J8WJg=";
   lts = false;
 }
diff --git a/pkgs/by-name/cl/clj-kondo/package.nix b/pkgs/by-name/cl/clj-kondo/package.nix
index b482f11963af..36c66478b6f8 100644
--- a/pkgs/by-name/cl/clj-kondo/package.nix
+++ b/pkgs/by-name/cl/clj-kondo/package.nix
@@ -6,11 +6,11 @@
 
 buildGraalvmNativeImage (finalAttrs: {
   pname = "clj-kondo";
-  version = "2026.04.15";
+  version = "2026.05.25";
 
   src = fetchurl {
     url = "https://github.com/clj-kondo/clj-kondo/releases/download/v${finalAttrs.version}/clj-kondo-${finalAttrs.version}-standalone.jar";
-    sha256 = "sha256-BJw4A5c9F6S6T5d3dP0VdfEaayqoLbHiXUyEyqKFP94=";
+    sha256 = "sha256-SzrfsIHUW+KzZITesZ9aS00Gx7S4hekLsXXdjQJJxLM=";
   };
 
   extraNativeImageBuildArgs = [
diff --git a/pkgs/by-name/co/copyq/package.nix b/pkgs/by-name/co/copyq/package.nix
index c7797d34a2ce..e0f11443eeba 100644
--- a/pkgs/by-name/co/copyq/package.nix
+++ b/pkgs/by-name/co/copyq/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "CopyQ";
-  version = "15.0.0";
+  version = "16.0.0";
 
   src = fetchFromGitHub {
     owner = "hluk";
     repo = "CopyQ";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-D1huGKvYa/GsVeLQcP69MCWF8p+ytcQxlu0qynmYbGw=";
+    hash = "sha256-QO7iOFwO++tXZMWvJVmzUDrjnuz0Fl2XYsqfIPl5GBA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/dc/dcp/package.nix b/pkgs/by-name/dc/dcp/package.nix
index e6cbf069396a..a6bae8b8afc9 100644
--- a/pkgs/by-name/dc/dcp/package.nix
+++ b/pkgs/by-name/dc/dcp/package.nix
@@ -15,13 +15,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "dcp";
-  version = "0.24.3";
+  version = "0.25.0";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "dcp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-SHMthGpQ3zKJXmltIjSEI0vq1fysdUCs1rIiaBHi0JI=";
+    hash = "sha256-9+z+umhxnu4X9Yk76qk5Li/6ltT9qR3IVgkKgFrLf2c=";
   };
 
   vendorHash = "sha256-hcuVUUr3kr3iBmSEhHy365LIWGGLFTYnBRa5jnt7kPw=";
diff --git a/pkgs/by-name/di/dix/package.nix b/pkgs/by-name/di/dix/package.nix
index 3e71f00c6470..7db7dadc9143 100644
--- a/pkgs/by-name/di/dix/package.nix
+++ b/pkgs/by-name/di/dix/package.nix
@@ -7,7 +7,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dix";
-  version = "2.0.0";
+  version = "2.0.1";
 
   __structuredAttrs = true;
 
@@ -15,18 +15,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "manic-systems";
     repo = "dix";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5aH8zX/Wm+KHzd1fjmjlxjDB+psDG42JAY5U8lrjGDU=";
+    hash = "sha256-KTlFgBEVKJIXymfN2UU8hvGM71PYRcNgJ1XWUmG2AI4=";
   };
 
-  cargoHash = "sha256-llStz2BaHBH9iHhfbptAE+Td5HPsvzAlPtXohrCxY4w=";
-
-  env.TMPDIR = "/tmp/";
-  checkFlags = [
-    "--skip=store::nix_command::tests::test_query_closure_path_info"
-    "--skip=store::nix_command::tests::test_query_closure_size"
-    "--skip=store::nix_command::tests::test_query_dependents"
-    "--skip=store::nix_command::tests::test_query_system_derivations"
-  ];
+  cargoHash = "sha256-pNkSdsxOpv0E/xXs7tMg2vtP0PBU7p8fh3H4IX/u5k4=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
diff --git a/pkgs/by-name/dt/dtop/package.nix b/pkgs/by-name/dt/dtop/package.nix
index 1cc6abf3a689..6d7cd35ae900 100644
--- a/pkgs/by-name/dt/dtop/package.nix
+++ b/pkgs/by-name/dt/dtop/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dtop";
-  version = "0.7.6";
+  version = "0.7.7";
 
   src = fetchFromGitHub {
     owner = "amir20";
     repo = "dtop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-v4LG0k9eMZiFYmIecHXwQqrTINaMAiqPYiXYEuQxx2A=";
+    hash = "sha256-kYSOJCQfoYXhdZ3cyRv/+Ifov4VzOv0gqvjueVMmnuQ=";
   };
 
-  cargoHash = "sha256-4F5eCt8AaVtGJRe7uBMHqdM3g1mLlWDXIpZCojRUjjc=";
+  cargoHash = "sha256-fspIjgctyhQwyDygrSrtJBb/EYxY8o00/UJy/z89yso=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";
diff --git a/pkgs/by-name/gi/git-bug/package.nix b/pkgs/by-name/gi/git-bug/package.nix
index dc9051dc0c64..a426932eb317 100644
--- a/pkgs/by-name/gi/git-bug/package.nix
+++ b/pkgs/by-name/gi/git-bug/package.nix
@@ -53,6 +53,7 @@ buildGoModule (finalAttrs: {
 
   postInstall = ''
     installShellCompletion \
+      --cmd git-bug \
       --bash misc/completion/bash/git-bug \
       --zsh misc/completion/zsh/git-bug \
       --fish misc/completion/fish/git-bug
diff --git a/pkgs/by-name/gi/gitsign/package.nix b/pkgs/by-name/gi/gitsign/package.nix
index 296da485a734..c648c687d265 100644
--- a/pkgs/by-name/gi/gitsign/package.nix
+++ b/pkgs/by-name/gi/gitsign/package.nix
@@ -10,15 +10,15 @@
 
 buildGoModule (finalAttrs: {
   pname = "gitsign";
-  version = "0.16.0";
+  version = "0.16.1";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = "gitsign";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-XFeKU956FIfQhaca2M/OtYgCF8qErzPcyMBEGvzPAcc=";
+    hash = "sha256-BkaEI3YSnfMbRQ0r/rGUgZqUaCe3L1BXGxO4Ft19TdQ=";
   };
-  vendorHash = "sha256-fjrdQZVXgBvdKQFnmjtLShBHsKNIp5Y/uW7aU2cP1aY=";
+  vendorHash = "sha256-Sltj/DwS3T7puIaH5HAZ+BE9vlv79+FlvK+t5O2VSM0=";
 
   subPackages = [
     "."
diff --git a/pkgs/by-name/he/helmify/package.nix b/pkgs/by-name/he/helmify/package.nix
new file mode 100644
index 000000000000..09b6b9505417
--- /dev/null
+++ b/pkgs/by-name/he/helmify/package.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "helmify";
+  version = "0.4.20";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "arttor";
+    repo = "helmify";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Az/rNrNwWkQCZ8iy2qkix8xqsWA+eUbFw7YstA9usdw=";
+  };
+
+  vendorHash = "sha256-a2uA2P9eenpgb2bFMvy3ioI9crG0FpvD1vEXqCwwwyw=";
+
+  ldflags = [
+    "-s"
+    "-X main.version=${finalAttrs.version}"
+    "-X main.commit=${finalAttrs.src.tag}"
+    "-X main.date=19700101"
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Creates Helm chart from Kubernetes yaml";
+    homepage = "https://github.com/arttor/helmify";
+    changelog = "https://github.com/arttor/helmify/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jlesquembre ];
+    mainProgram = "helmify";
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/ib/ibm-plex/fonts.nix b/pkgs/by-name/ib/ibm-plex/fonts.nix
new file mode 100644
index 000000000000..cda27fb6be87
--- /dev/null
+++ b/pkgs/by-name/ib/ibm-plex/fonts.nix
@@ -0,0 +1,99 @@
+{
+  math = {
+    hash = "sha256-dJA6uqxa/yb3eLY4l39NeP0yIl2NfrbaRpf6h0/F7Xc=";
+    name = "IBM Plex Math";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-math@1.1.0/ibm-plex-math.zip";
+    version = "1.1.0";
+  };
+  mono = {
+    hash = "sha256-OwUmrPfEehLDz0fl2ChYLK8FQM2p0G1+EMrGsYEq+6g=";
+    name = "IBM Plex Mono";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-mono@1.1.0/ibm-plex-mono.zip";
+    version = "1.1.0";
+  };
+  sans = {
+    hash = "sha256-mK+8GGl2ugF2+fS6yd3p5NWPHHcKEJWiShDS3lihOlI=";
+    name = "IBM Plex Sans";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans@1.1.0/ibm-plex-sans.zip";
+    version = "1.1.0";
+  };
+  sans-arabic = {
+    hash = "sha256-qi4k7kMLftIuq87idyxq46FOD6QYycdG6j3zJmu8mhI=";
+    name = "IBM Plex Sans Arabic";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-arabic@1.1.0/ibm-plex-sans-arabic.zip";
+    version = "1.1.0";
+  };
+  sans-condensed = {
+    hash = "sha256-prqyJIPs+UpQxFTbn/eAfsG/jKwQTOO72fZNzAtXUWg=";
+    name = "IBM Plex Sans Condensed";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-condensed@2.0.0/ibm-plex-sans-condensed.zip";
+    version = "2.0.0";
+  };
+  sans-devanagari = {
+    hash = "sha256-K57OVqcH5r9tZx8NFEoz1P3xpUooqpF7xxJzNmnObwE=";
+    name = "IBM Plex Sans Devanagari";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-devanagari@1.1.0/ibm-plex-sans-devanagari.zip";
+    version = "1.1.0";
+  };
+  sans-hebrew = {
+    hash = "sha256-rTuBQYLI+6gEFTumCdaWpeoLzRoyFSmqWbXziq+UG6I=";
+    name = "IBM Plex Sans Hebrew";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-hebrew@1.1.0/ibm-plex-sans-hebrew.zip";
+    version = "1.1.0";
+  };
+  sans-jp = {
+    hash = "sha256-2BbhqsutMXEoS2JoZjJprrElIpFa9lgvPaM65pnYdfs=";
+    name = "IBM Plex Sans Japanese";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-jp@3.0.0/ibm-plex-sans-jp.zip";
+    version = "3.0.0";
+  };
+  sans-kr = {
+    hash = "sha256-FsHxMvLlI4yylgG96DOZIdW2DYpk7I+c5QgkVIkNZIE=";
+    name = "IBM Plex Sans Korean";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-kr@1.1.0/ibm-plex-sans-kr.zip";
+    version = "1.1.0";
+  };
+  sans-sc = {
+    hash = "sha256-Q3cEVlR/UkNZaGIhNMIdojId6fHmAsZdLwMsKq1zLRY=";
+    name = "IBM Plex Sans Chinese SC";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-sc@1.1.0/ibm-plex-sans-sc.zip";
+    version = "1.1.0";
+  };
+  sans-tc = {
+    hash = "sha256-kZvzSK6fEjfVMR4kxC4lxtD7GskqvJZx8BBJVT4T9MU=";
+    name = "IBM Plex Sans Chinese TC";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-tc@1.1.1/ibm-plex-sans-tc.zip";
+    version = "1.1.1";
+  };
+  sans-thai = {
+    hash = "sha256-JZVbvZdj+IfBthiqivOXHrvAUe392M9ECGsiJkm0saE=";
+    name = "IBM Plex Sans Thai";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-thai@1.1.0/ibm-plex-sans-thai.zip";
+    version = "1.1.0";
+  };
+  sans-thai-looped = {
+    hash = "sha256-cry/Ctwt1bsrdbvWkJIYWLjsvV6a1lLFsT85znqERnw=";
+    name = "IBM Plex Sans Thai Looped";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-thai-looped@1.1.0/ibm-plex-sans-thai-looped.zip";
+    version = "1.1.0";
+  };
+  sans-variable = {
+    hash = "sha256-W45wPOmmP4KuJ3TVes2x0n25KgyDzX48ce1lQrjAXpw=";
+    name = "IBM Plex Sans (Variable)";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-sans-variable@0.2.0/plex-sans-variable.zip";
+    version = "0.2.0";
+  };
+  serif = {
+    hash = "sha256-PO9KxV4K3a7fB4fR/i7LSf0mhK4I2eUDMsbSYWDQcb4=";
+    name = "IBM Plex Serif";
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-serif@2.0.0/ibm-plex-serif.zip";
+    version = "2.0.0";
+  };
+  serif-variable = {
+    hash = "sha256-xhjmeIMT7FAFhfR8fekAxzQEl1hOtPdQ6qsVpnZN6Xg=";
+    name = "IBM Plex Serif (Variable)";
+    stripRoot = false;
+    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-serif-variable@2.0.0/plex-serif-variable.zip";
+    version = "2.0.0";
+  };
+}
diff --git a/pkgs/by-name/ib/ibm-plex/hashes.nix b/pkgs/by-name/ib/ibm-plex/hashes.nix
deleted file mode 100644
index 87997ed6362f..000000000000
--- a/pkgs/by-name/ib/ibm-plex/hashes.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-{
-  "serif" = "sha256-8ygaAeMKygYS4GCub4YUQmkh87pYHfi3s0PQ6AbaeGw=";
-  "sans" = "sha256-mK+8GGl2ugF2+fS6yd3p5NWPHHcKEJWiShDS3lihOlI=";
-  "sans-condensed" = "sha256-/aJTXmrHuoPSrtCKNodBY7I0CriayNTx5LCXw+/MFvE=";
-  "sans-arabic" = "sha256-qi4k7kMLftIuq87idyxq46FOD6QYycdG6j3zJmu8mhI=";
-  "sans-devanagari" = "sha256-K57OVqcH5r9tZx8NFEoz1P3xpUooqpF7xxJzNmnObwE=";
-  "sans-thai" = "sha256-JZVbvZdj+IfBthiqivOXHrvAUe392M9ECGsiJkm0saE=";
-  "sans-thai-looped" = "sha256-cry/Ctwt1bsrdbvWkJIYWLjsvV6a1lLFsT85znqERnw=";
-  "sans-sc" = "sha256-Q3cEVlR/UkNZaGIhNMIdojId6fHmAsZdLwMsKq1zLRY=";
-  "sans-tc" = "sha256-kZvzSK6fEjfVMR4kxC4lxtD7GskqvJZx8BBJVT4T9MU=";
-  "sans-kr" = "sha256-FsHxMvLlI4yylgG96DOZIdW2DYpk7I+c5QgkVIkNZIE=";
-  "sans-jp" = "sha256-hUl/SSkN6q3pDTtrY2mJepw3ljhhLJskGbxfsTl9TuI=";
-  "sans-hebrew" = "sha256-rTuBQYLI+6gEFTumCdaWpeoLzRoyFSmqWbXziq+UG6I=";
-  "mono" = "sha256-OwUmrPfEehLDz0fl2ChYLK8FQM2p0G1+EMrGsYEq+6g=";
-  "math" = "sha256-dJA6uqxa/yb3eLY4l39NeP0yIl2NfrbaRpf6h0/F7Xc=";
-}
diff --git a/pkgs/by-name/ib/ibm-plex/package.nix b/pkgs/by-name/ib/ibm-plex/package.nix
index 56b6d2a6510c..b87f6cabff55 100644
--- a/pkgs/by-name/ib/ibm-plex/package.nix
+++ b/pkgs/by-name/ib/ibm-plex/package.nix
@@ -1,60 +1,71 @@
 {
   lib,
   stdenvNoCC,
-  fetchzip,
   symlinkJoin,
+  fetchzip,
   installFonts,
   families ? [ ],
 }:
 let
-  version = import ./version.nix;
-  availableFamilies = import ./hashes.nix;
-
-  availableFamilyNames = builtins.attrNames availableFamilies;
+  allFonts = import ./fonts.nix;
+  availableFamilyNames = builtins.attrNames allFonts;
   selectedFamilies = if (families == [ ]) then availableFamilyNames else families;
-
   unknownFamilies = lib.subtractLists availableFamilyNames families;
-in
-assert lib.assertMsg (unknownFamilies == [ ]) "Unknown font(s): ${toString unknownFamilies}";
-stdenvNoCC.mkDerivation {
-  pname = "ibm-plex";
-  inherit version;
+  fontsToBuild = lib.filterAttrs (name: _: lib.elem name selectedFamilies) allFonts;
+  makeFont =
+    font:
+    stdenvNoCC.mkDerivation (finalAttrs: {
+      pname = lib.toLower (lib.replaceStrings [ " (" ")" " " ] [ "-" "" "-" ] font.name);
+      inherit (font) version;
 
-  src = symlinkJoin {
-    name = "ibm-plex-src";
-    paths = map (
-      family:
-      fetchzip {
-        url = "https://github.com/IBM/plex/releases/download/%40ibm%2Fplex-${family}%40${version}/ibm-plex-${family}.zip";
-        hash = availableFamilies.${family};
-      }
-    ) selectedFamilies;
-    postBuild = ''
-      find "$out" \( -name unhinted -or -name split \) -exec rm -fr {} +
-    '';
-  };
+      nativeBuildInputs = [ installFonts ];
 
-  sourceRoot = ".";
+      outputs = [
+        "out"
+        "webfont"
+      ];
 
-  nativeBuildInputs = [ installFonts ];
+      src = fetchzip {
+        inherit (font) hash url;
+        stripRoot = font.stripRoot or true;
+      };
 
-  outputs = [
-    "out"
-    "webfont"
-  ];
-
-  passthru.updateScript = ./update.sh;
+      # Some fonts, e.g. "ibm-plex-sans-korean" and "ibm-plex-sans-japanese"
+      # include both unhinted and hinted variants of the ttf and woff/woff2 type
+      # fonts, which collide when using the `installFonts` hook.
+      # Default to installing the hinted variant of the fonts.
+      #
+      # Additionally, fonts with webfonts include complete and split forms.
+      # Default to the complete forms.
+      preInstall = ''
+        find . -type d \( -name unhinted -or -name split \) -exec rm -rf {} +
+      '';
 
+      meta = meta // {
+        description = font.name;
+      };
+    });
+  fontDerivations = lib.mapAttrs (_: v: makeFont v) fontsToBuild;
   meta = {
     description = "IBM Plex Typeface";
     homepage = "https://www.ibm.com/plex/";
-    changelog = "https://github.com/IBM/plex/raw/v${version}/CHANGELOG.md";
     license = lib.licenses.ofl;
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [
+      magicquark
       ners
       romildo
       ryanccn
     ];
   };
+in
+assert lib.assertMsg (unknownFamilies == [ ]) "Unknown font(s): ${toString unknownFamilies}";
+symlinkJoin {
+  pname = "ibm-plex";
+  version = "0-unstable-2026-02-12";
+  paths = lib.attrValues fontDerivations;
+  passthru = fontDerivations // {
+    updateScript = ./update.py;
+  };
+  inherit meta;
 }
diff --git a/pkgs/by-name/ib/ibm-plex/update.py b/pkgs/by-name/ib/ibm-plex/update.py
new file mode 100755
index 000000000000..17e8493110c8
--- /dev/null
+++ b/pkgs/by-name/ib/ibm-plex/update.py
@@ -0,0 +1,85 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i python3 -p nix nix-prefetch python3
+import json
+import subprocess
+import urllib.request
+
+fonts_file = "fonts.nix"
+fonts_data = json.loads(
+    subprocess.check_output(["nix", "eval", "--json", "-f", fonts_file])
+)
+
+releases_url = "https://api.github.com/repos/IBM/plex/releases"
+releases = json.loads(urllib.request.urlopen(releases_url).read())
+
+for font in fonts_data.keys():
+    font_tag = f"@ibm/plex-{font}@"
+    font_file = f"plex-{font}.zip"
+    current_version = fonts_data.get(font, {}).get("version")
+
+    latest_release = next(
+        (r for r in releases if r["tag_name"].lower().startswith(font_tag)), None
+    )
+
+    if latest_release is None:
+        print(f"No release found for {font}")
+        continue
+
+    latest_version = latest_release["tag_name"].split("@")[-1]
+
+    if current_version == latest_version:
+        print(f"Font {font} is up-to-date")
+        continue
+
+    print(f"Updating {font} from {current_version} to {latest_version}")
+
+    asset = next(
+        (
+            a
+            for a in latest_release["assets"]
+            if font_file.lower() in a["name"].lower()
+        ),
+        None,
+    )
+
+    if asset is None:
+        print(f"Warning: No asset found for {font}")
+        continue
+
+    asset_url = asset["browser_download_url"]
+
+    raw_hash = (
+        subprocess.check_output(["nix-prefetch-url", "--unpack", asset_url])
+        .decode()
+        .strip()
+    )
+
+    sri_hash = (
+        subprocess.check_output(
+            ["nix", "--extra-experimental-features", "nix-command", "hash", "convert", "--hash-algo", "sha256", raw_hash]
+        )
+        .decode()
+        .strip()
+    )
+
+    for x, y in zip(
+        ["version", "hash", "url"],
+        [latest_version, sri_hash, asset_url]
+    ):
+        if fonts_data[font].get(x) != y:
+            fonts_data[font][x] = y
+
+
+with open(fonts_file, "w") as f:
+    f.write("{\n")
+    for font in sorted(fonts_data.keys()):
+        attrs = fonts_data[font]
+        f.write(f"  {font} = {{\n")
+        for k in sorted(attrs.keys()):
+            v = attrs[k]
+            if isinstance(v, bool):
+                f.write(f"    {k} = {'true' if v else 'false'};\n")
+            else:
+                f.write(f'    {k} = "{v}";\n')
+        f.write("  };\n")
+    f.write("}\n")
diff --git a/pkgs/by-name/ib/ibm-plex/update.sh b/pkgs/by-name/ib/ibm-plex/update.sh
deleted file mode 100755
index c44aac891530..000000000000
--- a/pkgs/by-name/ib/ibm-plex/update.sh
+++ /dev/null
@@ -1,43 +0,0 @@
-#! /usr/bin/env nix-shell
-#! nix-shell -i bash -p nix nix-prefetch jq
-#  shellcheck shell=bash
-set -eo pipefail
-
-families=(
-    "serif"
-    "sans"
-    "sans-condensed"
-    "sans-arabic"
-    "sans-devanagari"
-    "sans-thai"
-    "sans-thai-looped"
-    "sans-sc"
-    "sans-tc"
-    "sans-kr"
-    "sans-jp"
-    "sans-hebrew"
-    "mono"
-    "math"
-)
-
-version=$(curl --silent 'https://api.github.com/repos/IBM/plex/releases/latest' | jq -r '.tag_name | sub("^@ibm/[\\w-]+@"; "")')
-
-dirname="$(dirname "$0")"
-echo \""${version}"\" >"$dirname/version-new.nix"
-if diff -q "$dirname/version-new.nix" "$dirname/version.nix"; then
-    echo No new version available, current: "$version"
-    rm "$dirname/version-new.nix"
-    exit 0
-else
-    echo Updated to version "$version"
-    mv "$dirname/version-new.nix" "$dirname/version.nix"
-fi
-
-printf '{\n' > "$dirname/hashes.nix"
-
-for family in "${families[@]}"; do
-    url="https://github.com/IBM/plex/releases/download/%40ibm%2Fplex-${family}%40${version}/ibm-plex-${family}.zip"
-    printf '  "%s" = "%s";\n' "$family" "$(nix-prefetch-url --unpack "$url" | xargs nix --extra-experimental-features nix-command hash convert --hash-algo sha256)" >>"$dirname/hashes.nix"
-done
-
-printf '}\n' >> "$dirname/hashes.nix"
diff --git a/pkgs/by-name/ib/ibm-plex/version.nix b/pkgs/by-name/ib/ibm-plex/version.nix
deleted file mode 100644
index f0947f091566..000000000000
--- a/pkgs/by-name/ib/ibm-plex/version.nix
+++ /dev/null
@@ -1 +0,0 @@
-"1.1.0"
diff --git a/pkgs/by-name/ja/jai-jail/package.nix b/pkgs/by-name/ja/jai-jail/package.nix
new file mode 100644
index 000000000000..ba62001d368c
--- /dev/null
+++ b/pkgs/by-name/ja/jai-jail/package.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  gcc15Stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  pkg-config,
+  pandoc,
+  systemd,
+  util-linux,
+  acl,
+}:
+
+gcc15Stdenv.mkDerivation (finalAttrs: {
+  pname = "jai-jail";
+  version = "0.3";
+
+  src = fetchFromGitHub {
+    owner = "stanford-scs";
+    repo = "jai";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-AByC7Xh1FYbQ/4Au396m2zYUxsLqcF1PEbpdz7x6LaQ=";
+  };
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    pandoc
+    systemd
+  ];
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  buildInputs = [
+    util-linux # libmount
+    acl
+  ];
+
+  configureFlags = [ "--with-untrusted-user=jai" ];
+
+  meta = {
+    description = "Lightweight jail for AI CLIs";
+    mainProgram = "jai";
+    homepage = "https://jai.scs.stanford.edu";
+    changelog = "https://github.com/stanford-scs/jai/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ agentelement ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/je/jellyfin-ffmpeg/package.nix b/pkgs/by-name/je/jellyfin-ffmpeg/package.nix
index 4100158669c9..0b5e59a90e85 100644
--- a/pkgs/by-name/je/jellyfin-ffmpeg/package.nix
+++ b/pkgs/by-name/je/jellyfin-ffmpeg/package.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "7.1.4-1";
+  version = "7.1.4-3";
 in
 
 (ffmpeg_7-full.override {
@@ -14,7 +14,7 @@ in
     owner = "jellyfin";
     repo = "jellyfin-ffmpeg";
     tag = "v${version}";
-    hash = "sha256-VijSSbtcaeQNf1UwpPKTIfzAHHp2BHvBdhXeigTQEbI=";
+    hash = "sha256-3aPiR4BJrR/5UFKRbrK8IbyW6HN9wC6oTSYKH4Ak4EU=";
   };
 }).overrideAttrs
   (old: {
diff --git a/pkgs/by-name/je/jellyfin-web/package.nix b/pkgs/by-name/je/jellyfin-web/package.nix
index 9a3cdc75d5f3..29f64fc61ab8 100644
--- a/pkgs/by-name/je/jellyfin-web/package.nix
+++ b/pkgs/by-name/je/jellyfin-web/package.nix
@@ -13,7 +13,7 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "jellyfin-web";
-  version = "10.11.10";
+  version = "10.11.11";
 
   src =
     assert finalAttrs.version == jellyfin.version;
@@ -21,7 +21,7 @@ buildNpmPackage (finalAttrs: {
       owner = "jellyfin";
       repo = "jellyfin-web";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-fSpzF6Arx0JfL9fuQHjzf3m82XZR2BZkV0lA37L4DN4=";
+      hash = "sha256-3Gyg0eSbOXO0wgdgzuOtD8nDmSM37z7Bc0fKcbo9ffA=";
     };
 
   nodejs = nodejs_22;
@@ -31,7 +31,7 @@ buildNpmPackage (finalAttrs: {
       --replace-fail "git describe --always --dirty" "echo ${finalAttrs.src.rev}"
   '';
 
-  npmDepsHash = "sha256-DCFgivbZrDufRaB+4PeFxO6ISbEM9lXhXmlzc/5GbVU=";
+  npmDepsHash = "sha256-4kZo50xY/SvjpHToeIt0E91yeM7ab6Q6XtBMU5zSrF4=";
 
   preBuild = ''
     # using sass-embedded fails at executing node_modules/sass-embedded-linux-x64/dart-sass/src/dart
diff --git a/pkgs/by-name/je/jellyfin/package.nix b/pkgs/by-name/je/jellyfin/package.nix
index 89353c557a47..15505b3a49a6 100644
--- a/pkgs/by-name/je/jellyfin/package.nix
+++ b/pkgs/by-name/je/jellyfin/package.nix
@@ -14,13 +14,13 @@
 
 buildDotnetModule (finalAttrs: {
   pname = "jellyfin";
-  version = "10.11.10"; # ensure that jellyfin-web has matching version
+  version = "10.11.11"; # ensure that jellyfin-web has matching version
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bad532F8Ln5Y3TV4x5c7mgsiI+ZJGTZoahuSZhefMvQ=";
+    hash = "sha256-HCs4ZsutVoVH+bBZANjpPeMyV8e63Yemjg9DSr0R9zg=";
   };
 
   propagatedBuildInputs = [ sqlite ];
diff --git a/pkgs/by-name/k3/k3d/package.nix b/pkgs/by-name/k3/k3d/package.nix
index 7a6642680f83..d26b809d552a 100644
--- a/pkgs/by-name/k3/k3d/package.nix
+++ b/pkgs/by-name/k3/k3d/package.nix
@@ -17,16 +17,16 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "k3d";
-  version = "5.8.3";
+  version = "5.9.0";
 
   src = fetchFromGitHub {
     owner = "k3d-io";
     repo = "k3d";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UBiDDZf/UtgPGRV9WUnoC32wc64nthBpBheEYOTp6Hk=";
+    hash = "sha256-W/fcpIgpE6kn87EXNVU+K9rFis5QAvVC2LgthI9M6yg=";
   };
 
-  vendorHash = "sha256-lFmIRtkUiohva2Vtg4AqHaB5McVOWW5+SFShkNqYVZ8=";
+  vendorHash = "sha256-QRr8dmiqoNHu30OILwrS9AXK68hnNIqXlKMkASbcKVo=";
   deleteVendor = true;
 
   nativeBuildInputs = [ installShellFiles ];
diff --git a/pkgs/by-name/ke/keepassxc/package.nix b/pkgs/by-name/ke/keepassxc/package.nix
index f4849334326b..682337647b57 100644
--- a/pkgs/by-name/ke/keepassxc/package.nix
+++ b/pkgs/by-name/ke/keepassxc/package.nix
@@ -196,6 +196,7 @@ stdenv.mkDerivation (finalAttrs: {
       using the KeePassXC Browser Extension (https://github.com/keepassxreboot/keepassxc-browser)
     '';
     homepage = "https://keepassxc.org/";
+    donationPage = "https://keepassxc.org/donate/";
     changelog = "https://github.com/keepassxreboot/keepassxc/blob/${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.gpl2Plus;
     mainProgram = "keepassxc";
diff --git a/pkgs/by-name/mi/misskey/package.nix b/pkgs/by-name/mi/misskey/package.nix
index ff93f8a46789..58f4552604a4 100644
--- a/pkgs/by-name/mi/misskey/package.nix
+++ b/pkgs/by-name/mi/misskey/package.nix
@@ -108,6 +108,7 @@ stdenv.mkDerivation (finalAttrs: {
       runHook preInstall
 
       mkdir -p $out/data
+      sed -i '/"packageManager":/d' package.json
       cp -r . $out/data
 
       # Set up symlink for use at runtime
@@ -119,6 +120,7 @@ stdenv.mkDerivation (finalAttrs: {
       makeWrapper ${pnpm}/bin/pnpm $out/bin/misskey \
         --run "${checkEnvVarScript} || exit" \
         --chdir $out/data \
+        --add-flag "--config.store-dir=/tmp/pnpm-store" \
         --add-flag "--config.verify-deps-before-run=false" \
         --add-flag run \
         --set-default NODE_ENV production \
diff --git a/pkgs/by-name/mu/muffet/package.nix b/pkgs/by-name/mu/muffet/package.nix
index 3fc4f08fc6b9..6e119f51b85c 100644
--- a/pkgs/by-name/mu/muffet/package.nix
+++ b/pkgs/by-name/mu/muffet/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "muffet";
-  version = "2.11.4";
+  version = "2.11.5";
 
   src = fetchFromGitHub {
     owner = "raviqqe";
     repo = "muffet";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xczs3H1Jcr+WH8SCOhXRZx7Aft2BNpI+Kg4He8YEVVA=";
+    hash = "sha256-dPScTdOGR3cgcFBa09iez0/DkCugXseIGGRMiCPJeYo=";
   };
 
-  vendorHash = "sha256-94ytPGPbpXADIyDl28wWU2KmtwT17GyQFUe/bUc4RkA=";
+  vendorHash = "sha256-FXV+wP22R3gPAMGbhyz/v1Rk7w6z2ovoWirbLM1Wl24=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
diff --git a/pkgs/by-name/ne/necesse-server/package.nix b/pkgs/by-name/ne/necesse-server/package.nix
index 73e8e1bf9b73..88e7c558b6e1 100644
--- a/pkgs/by-name/ne/necesse-server/package.nix
+++ b/pkgs/by-name/ne/necesse-server/package.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "1.2.0-22728942";
+  version = "1.2.0-23522718";
   urlVersion = lib.replaceStrings [ "." ] [ "-" ] version;
 
 in
@@ -15,8 +15,8 @@ stdenvNoCC.mkDerivation {
   inherit version;
 
   src = fetchzip {
-    url = "https://necessegame.com/content/server/${urlVersion}/necesse-server-linux64-${urlVersion}.zip";
-    hash = "sha256-kSBql3oHG368DczSM7FkWeAZcfTrNP1x31LX7HRrgTE=";
+    url = "https://necesse.pwn.sh/server/necesse-server-linux64-${urlVersion}.zip";
+    hash = "sha256-PIguTYULddLKj6PpoSvX3gNSvqrS7oRTOPuwoA0/XOc=";
   };
 
   # removing packaged jre since we use our own
diff --git a/pkgs/by-name/ne/necesse-server/update.sh b/pkgs/by-name/ne/necesse-server/update.sh
index 19c409d3700a..d034702d1713 100755
--- a/pkgs/by-name/ne/necesse-server/update.sh
+++ b/pkgs/by-name/ne/necesse-server/update.sh
@@ -3,13 +3,30 @@
 
 set -eu -o pipefail
 
+website=$(curl -sL https://necessegame.com/server)
+
 version=$(
-    curl -s http://www.necessegame.com/server \
+    echo "$website" \
         | pup 'a[href*="linux64"] text{}' \
         | awk -F'[v ]' '/Linux64/ {print $4"-"$6}' \
         | sort -Vu \
         | tail -n1
 )
 
-[[ $version =~ ^[0-9]+\.[0-9]+\.[0-9]+\-[0-9]+$ ]] \
-    && update-source-version necesse-server "$version"
+if [[ $version =~ ^[0-9]+\.[0-9]+\.[0-9]+\-[0-9]+$ ]]; then
+    version_url=${version//./-}
+
+    # extract the expiring presigned S3 URL for the new zip
+    url=$(
+        echo "$website" \
+            | pup "a[href*=\"linux64-${version_url}\"] attr{href}" \
+            | sed 's/\&amp;/\&/g'
+    )
+
+    # call API to remote-fetch the zip immediately and keep it cached,
+    # then fetch the zip locally to get the SRI hash, then update.
+    # fails early if the zip cannot be remote-fetched / cached.
+    curl -s --fail-with-body "https://necesse.pwn.sh/cache.php?version=${version_url}" \
+        && sri=$(nix-prefetch-url --unpack "$url" | xargs nix hash convert --hash-algo sha256 --to sri) \
+        && update-source-version necesse-server "$version" "$sri"
+fi
diff --git a/pkgs/by-name/ne/neovim-unwrapped/package.nix b/pkgs/by-name/ne/neovim-unwrapped/package.nix
index 0f0f799d5ccd..ae0c858bf89f 100644
--- a/pkgs/by-name/ne/neovim-unwrapped/package.nix
+++ b/pkgs/by-name/ne/neovim-unwrapped/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   gettext,
   libuv,
@@ -123,6 +124,11 @@ stdenv.mkDerivation (
       # necessary so that nix can handle `UpdateRemotePlugins` for the plugins
       # it installs. See https://github.com/neovim/neovim/issues/9413.
       ./system_rplugin_manifest.patch
+      (fetchpatch {
+        name = "CVE-2026-11487.patch";
+        url = "https://github.com/neovim/neovim/commit/f83e0dcaf8cf18de94828341b0a1a61a86c75baf.patch";
+        hash = "sha256-iWnq0ezbKYJqjvevVlcTJBvUc17ZvrhsanhtuKrh8zM=";
+      })
     ];
 
     inherit lua;
diff --git a/pkgs/by-name/ol/ollama/package.nix b/pkgs/by-name/ol/ollama/package.nix
index 86699d35e31d..d2f5b86b850b 100644
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -152,13 +152,13 @@ let
 in
 goBuild (finalAttrs: {
   pname = "ollama";
-  version = "0.30.5";
+  version = "0.30.6";
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jh/B/FkmAliCVzqc8DGCPYa5+XejE3cFZTzSuRxjPvw=";
+    hash = "sha256-qO+Tsjg64QekGHNNiNy5YGSDoToGSnqiN5hN+0LCp4Q=";
   };
 
   vendorHash = "sha256-lZdGzGb9xRjTm1Rm7/wHjqM490gLznLEndmb4mNbCX0=";
diff --git a/pkgs/by-name/op/openfga-cli/package.nix b/pkgs/by-name/op/openfga-cli/package.nix
index d91004e90f34..732640969d02 100644
--- a/pkgs/by-name/op/openfga-cli/package.nix
+++ b/pkgs/by-name/op/openfga-cli/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "openfga-cli";
-  version = "0.7.13";
+  version = "0.7.15";
 
   src = fetchFromGitHub {
     owner = "openfga";
     repo = "cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-nV0Y0oCPH0zRWdhjGhXqX7dkMwhlEjwucr3K6dN0vDg=";
+    hash = "sha256-KChWGGbrgAAbIW6JU6FBaxMbkxv50hNzcOK44ebt7hI=";
   };
 
-  vendorHash = "sha256-kzxuFP1D3oD2P2goU48nj40/4KyY9bDhf9gTtpuoz1I=";
+  vendorHash = "sha256-4PLtThxswBnxHhCI6zDePOge8lpqTfAYXkKbktP+C5E=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/op/openfga/package.nix b/pkgs/by-name/op/openfga/package.nix
index 4ec3cacd1cec..84df0c3a1540 100644
--- a/pkgs/by-name/op/openfga/package.nix
+++ b/pkgs/by-name/op/openfga/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "openfga";
-  version = "1.14.2";
+  version = "1.16.1";
 
   src = fetchFromGitHub {
     owner = "openfga";
     repo = "openfga";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-nY5HRkZCKgjr1a5XxxRcUwCms9PCQs3IZiFgAEaD7To=";
+    hash = "sha256-4vp2lyONLP5YJzbzJidg3+LAsQ/NhJAh+mvI2IrZWKI=";
   };
 
-  vendorHash = "sha256-q5NZLPtdwFeHzLi+ZmRzGScxkl0OOxTVo/W6yUL1lO8=";
+  vendorHash = "sha256-S47vnGCnDiXUMINc53X1n0vVqU8fs0LHz3vbdtNZjlY=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/pi/pipeform/package.nix b/pkgs/by-name/pi/pipeform/package.nix
new file mode 100644
index 000000000000..c4f6b3e4f529
--- /dev/null
+++ b/pkgs/by-name/pi/pipeform/package.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  libx11,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "pipeform";
+  version = "0.2.1";
+
+  src = fetchFromGitHub {
+    owner = "magodo";
+    repo = "pipeform";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-qmA+4xNstR1VRoYZW+xukNCEuEq6aGVkja3DYxZZVyY=";
+  };
+
+  vendorHash = "sha256-QI6Rnq3JxQuKRMkeo9Fvv6wfcTMgDEQ3Ot+es3IAUIA=";
+
+  subPackages = [ "." ];
+
+  __structuredAttrs = true;
+
+  # Clipboard support
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libx11 ];
+
+  meta = {
+    description = "TUI for Terraform runtime progress";
+    homepage = "https://github.com/magodo/pipeform";
+    license = lib.licenses.mpl20;
+    mainProgram = "pipeform";
+    maintainers = with lib.maintainers; [ jlesquembre ];
+  };
+})
diff --git a/pkgs/by-name/po/pocketbase/package.nix b/pkgs/by-name/po/pocketbase/package.nix
index 513a14fdb9d6..29a13537b49d 100644
--- a/pkgs/by-name/po/pocketbase/package.nix
+++ b/pkgs/by-name/po/pocketbase/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "pocketbase";
-  version = "0.39.0";
+  version = "0.39.3";
 
   src = fetchFromGitHub {
     owner = "pocketbase";
     repo = "pocketbase";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-4myp2MleKb6mAwDKhN39uyc5PZJhB3lvm2x/KDR9u0g=";
+    hash = "sha256-eCOGApbp/PLFpsX1GC2p56t3H+ksjiw5TL3iT7wnPGM=";
   };
 
-  vendorHash = "sha256-VBsClxCOA9Mp/kCHQKuBPd2Nt5sfXkVRx/8mGk5Gkcg=";
+  vendorHash = "sha256-ZKDMy+XUjCAvyis8wp9ddjuH+nFHh/A4bl5QZ33wtLE=";
 
   # This is the released subpackage from upstream repo
   subPackages = [ "examples/base" ];
diff --git a/pkgs/by-name/pr/pretix/package.nix b/pkgs/by-name/pr/pretix/package.nix
index 17283dbc80ae..092a1e01d824 100644
--- a/pkgs/by-name/pr/pretix/package.nix
+++ b/pkgs/by-name/pr/pretix/package.nix
@@ -54,14 +54,14 @@ let
 in
 pythonPackages.buildPythonApplication (finalAttrs: {
   pname = "pretix";
-  version = "2026.5.0";
+  version = "2026.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pretix";
     repo = "pretix";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-twXz3RaFujhZmARzZ5zIjGAwWchwhV8knq8Cr3h0Gjg=";
+    hash = "sha256-p4ZZzfoR4Wg65xeqk9JyCdZ+S7RqBVd1drWpHjj8oqc=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ra/rabbitmqadmin-ng/package.nix b/pkgs/by-name/ra/rabbitmqadmin-ng/package.nix
index 415c77e9b913..75300aa7f258 100644
--- a/pkgs/by-name/ra/rabbitmqadmin-ng/package.nix
+++ b/pkgs/by-name/ra/rabbitmqadmin-ng/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rabbitmqadmin-ng";
-  version = "2.29.0";
+  version = "2.32.0";
 
   src = fetchFromGitHub {
     owner = "rabbitmq";
     repo = "rabbitmqadmin-ng";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-On4eUeFM4/GDfbGJ7249LTAu3srAbxU6vizsGP3sXj4=";
+    hash = "sha256-RCDjMOKPRRm1l9hcLPyxa6Qzf7fHXe1898SLqwZ+n7I=";
   };
 
-  cargoHash = "sha256-Xr6j5lCdl0CXj3nWBMawHAWoizrMR7KABC3nIFc9kgk=";
+  cargoHash = "sha256-VO7Kwm2mtED4/eirL6lsYSFMsyE8A2LdAFkXIjHFgUE=";
 
   buildInputs = [ openssl ];
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/by-name/sp/spotiflac/package.nix b/pkgs/by-name/sp/spotiflac/package.nix
index 01c5c871325b..ad19754db2c0 100644
--- a/pkgs/by-name/sp/spotiflac/package.nix
+++ b/pkgs/by-name/sp/spotiflac/package.nix
@@ -18,14 +18,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "spotiflac";
-  version = "7.1.7";
+  version = "7.1.8";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "afkarxyz";
     repo = "SpotiFLAC";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2bCKsgrJH8jfggluNdNqX+LdG8NLcsuhrJwkaRTXAOs=";
+    hash = "sha256-Uz+9vsneP8xLGi5pgwYIufCPUzKSH4CRAdt0o+FifAM=";
   };
 
   nativeBuildInputs = [
@@ -88,7 +88,7 @@ buildGoModule (finalAttrs: {
     runHook postInstall;
   '';
 
-  vendorHash = "sha256-0H3U+i7SbbO7WkF9O8U8JoRxtroyEofzi2XrrWi6HWY=";
+  vendorHash = "sha256-dTrfLnuo7W3m3mg32wBDv8IbmQA44KXsazRLdanIi/Y=";
 
   desktopItems = [
     (makeDesktopItem {
diff --git a/pkgs/by-name/te/telemt/package.nix b/pkgs/by-name/te/telemt/package.nix
index b4df4da56277..254fdca322b0 100644
--- a/pkgs/by-name/te/telemt/package.nix
+++ b/pkgs/by-name/te/telemt/package.nix
@@ -5,16 +5,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "telemt";
-  version = "3.4.13";
+  version = "3.4.15";
 
   src = fetchFromGitHub {
     owner = "telemt";
     repo = "telemt";
     tag = version;
-    hash = "sha256-ChzvbbWS/h7bZXqG4h3Iftslzsv2Rad+hXx+SyY2p30=";
+    hash = "sha256-YnV6lE+NyI8Wqj4Lf37G0McJyWYatebTnGn7yObXs5k=";
   };
 
-  cargoHash = "sha256-UicmtNQvGUZJtj3I8zztyGiy+oU66LWwNV+MNpZ3omc=";
+  cargoHash = "sha256-ekVPICi/UyVrtAB9kHaFhBe0PXoxjgF85cQMtVEPGjY=";
 
   checkFlags = [
     # flaky: races between MiddleClientWriterCancelled and TrafficBudgetWaitCancelled observation paths
diff --git a/pkgs/by-name/te/tempo/package.nix b/pkgs/by-name/te/tempo/package.nix
index 4f8005cb77eb..35ecfead06ae 100644
--- a/pkgs/by-name/te/tempo/package.nix
+++ b/pkgs/by-name/te/tempo/package.nix
@@ -7,14 +7,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "tempo";
-  version = "2.10.5";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "tempo";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-1eacaqyKyHF/uS0Ja7oq+YKn/3K2QpDmd6jysGVBOjg=";
+    hash = "sha256-KYb3QJ4jdPsEmxVCezpakRRDtdyeGc4JUgeCHkZTG50=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/tr/traccar/package.nix b/pkgs/by-name/tr/traccar/package.nix
index 856a07b8d20e..d91f3869b083 100644
--- a/pkgs/by-name/tr/traccar/package.nix
+++ b/pkgs/by-name/tr/traccar/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenvNoCC.mkDerivation rec {
   pname = "traccar";
-  version = "6.13.0";
+  version = "6.13.3";
   nativeBuildInputs = [ pkgs.makeWrapper ];
 
   src = fetchzip {
     stripRoot = false;
     url = "https://github.com/traccar/traccar/releases/download/v${version}/traccar-other-${version}.zip";
-    hash = "sha256-nrAT/ewMpRXTN7bTU02VIJ4YoK5yvgfVZqMvQ1fXPo8=";
+    hash = "sha256-QQJ3+QByXkdfGBPA38F8+sQ72NnRbet6zcD3K82JLbI=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/tr/treefmt/check-wrapper.nix b/pkgs/by-name/tr/treefmt/check-wrapper.nix
new file mode 100644
index 000000000000..a7f16e0bdf90
--- /dev/null
+++ b/pkgs/by-name/tr/treefmt/check-wrapper.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  gitMinimal,
+  runCommandLocal,
+  stdenv,
+  wrapper,
+}:
+/**
+  Test that the given project tree is formatted with the treefmt config.
+
+  Input argument is the path to the project tree.
+*/
+project:
+runCommandLocal "${lib.getName wrapper}-check"
+  {
+    __structuredAttrs = true;
+    strictDeps = true;
+    nativeBuildInputs = [
+      gitMinimal
+      wrapper
+    ];
+    inherit project;
+    env = {
+      LANG = if stdenv.buildPlatform.isDarwin then "en_US.UTF-8" else "C.UTF-8";
+      LC_ALL = if stdenv.buildPlatform.isDarwin then "en_US.UTF-8" else "C.UTF-8";
+    };
+    meta.description = "Check that the project tree is formatted";
+  }
+  ''
+    # Copy project files into the build-dir
+    cp -r "$project" project
+    chmod -R a+w project
+    cd project
+
+    # Setup a git repo
+    git init --initial-branch main
+    git config user.name nixbld
+    git config user.email nixbld@example.com
+    git add .
+    git commit -m init --quiet
+
+    # Run treefmt
+    treefmt --version
+    treefmt --no-cache
+
+    # Ensure nothing changed
+    git status
+    git --no-pager diff --exit-code
+    touch "$out"
+  ''
diff --git a/pkgs/by-name/tr/treefmt/lib.nix b/pkgs/by-name/tr/treefmt/lib.nix
index a38fb5354bca..d7515833ed6c 100644
--- a/pkgs/by-name/tr/treefmt/lib.nix
+++ b/pkgs/by-name/tr/treefmt/lib.nix
@@ -40,6 +40,20 @@
   /**
     Wrap treefmt, configured using structured settings.
 
+    # Check
+
+    The resulting package has a `check` attribute of type `Path -> Derivation`.
+    The derivation returned will only build if the path supplied is already formatted correctly.
+
+    ```
+    { pkgs }:
+    let
+      myTreefmt = pkgs.treefmt.withConfig ./treefmt-config.nix;
+      project = ../.;
+    in
+    myTreefmt.check project
+    ```
+
     # Type
 
     ```
diff --git a/pkgs/by-name/tr/treefmt/modules/wrapper.nix b/pkgs/by-name/tr/treefmt/modules/wrapper.nix
index d736db5b5d77..b394912ce0b1 100644
--- a/pkgs/by-name/tr/treefmt/modules/wrapper.nix
+++ b/pkgs/by-name/tr/treefmt/modules/wrapper.nix
@@ -15,7 +15,7 @@
     internal = true;
   };
 
-  config.result = pkgs.symlinkJoin {
+  config.result = pkgs.symlinkJoin (finalAttrs: {
     pname = config.name;
     inherit (config.package) meta version;
     nativeBuildInputs = [ pkgs.makeBinaryWrapper ];
@@ -27,11 +27,14 @@
     passthru = {
       inherit (config) runtimeInputs;
       inherit config options;
+      check = pkgs.callPackage ../check-wrapper.nix {
+        wrapper = finalAttrs.finalPackage;
+      };
     };
     postBuild = ''
       wrapProgram "$out/bin/treefmt" \
         --prefix PATH : "$binPath" \
         --add-flags "--config-file $configFile"
     '';
-  };
+  });
 }
diff --git a/pkgs/by-name/tr/treefmt/tests.nix b/pkgs/by-name/tr/treefmt/tests.nix
index 57bcfda45cd3..80b3a9e8712e 100644
--- a/pkgs/by-name/tr/treefmt/tests.nix
+++ b/pkgs/by-name/tr/treefmt/tests.nix
@@ -1,6 +1,7 @@
 {
   lib,
   runCommand,
+  runCommandLocal,
   testers,
   treefmt,
   nixfmt,
@@ -31,6 +32,28 @@ let
     settings = nixfmtExampleConfig;
     runtimeInputs = [ nixfmt ];
   };
+
+  wellFormattedTree = runCommandLocal "well-formatted-project" { } ''
+    mkdir "$out"
+    cat > "$out/file.nix" <<EOF
+    {
+      foo = "bar";
+      attrs = { };
+      list = [ ];
+    }
+    EOF
+  '';
+
+  unformattedTree = runCommandLocal "unformatted-project" { } ''
+    mkdir "$out"
+    cat > "$out/file.nix" <<EOF
+    {
+      foo="bar";
+      attrs={};
+      list=[];
+    }
+    EOF
+  '';
 in
 {
   buildConfigEmpty = testEqualContents {
@@ -68,6 +91,22 @@ in
     '';
   };
 
+  nixfmtExampleCheckPasses = nixfmtExamplePackage.check wellFormattedTree;
+
+  nixfmtExampleCheckFails = testers.testBuildFailure' {
+    drv = nixfmtExamplePackage.check unformattedTree;
+    expectedBuilderExitCode = 1;
+    expectedBuilderLogEntries = [
+      "diff --git a/file.nix b/file.nix"
+      "-  foo=\"bar\";"
+      "+  foo = \"bar\";"
+      "-  attrs={};"
+      "+  attrs = { };"
+      "-  list=[];"
+      "+  list = [ ];"
+    ];
+  };
+
   runNixfmtExample =
     runCommand "run-nixfmt-example"
       {
diff --git a/pkgs/by-name/un/unblob/package.nix b/pkgs/by-name/un/unblob/package.nix
index 0a8c427d0947..552040ab866e 100644
--- a/pkgs/by-name/un/unblob/package.nix
+++ b/pkgs/by-name/un/unblob/package.nix
@@ -46,21 +46,21 @@ let
 in
 python3.pkgs.buildPythonApplication rec {
   pname = "unblob";
-  version = "26.3.30";
+  version = "26.6.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "onekey-sec";
     repo = "unblob";
     tag = version;
-    hash = "sha256-wYWuKvxAagctlmdO5Fi9/WzfJ4zkDgfXejgDTJPHsTI=";
+    hash = "sha256-NV4xnTejDW8mTxv0BGB4n+M/bxTMd4GWQQPXhqw5f2Y=";
     forceFetchGit = true;
     fetchLFS = true;
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-wjN4QPOUYFWWYMWL9aAgGqEucM7q+H6YyoS9Mv2dpp4=";
+    hash = "sha256-lEpnpvPwred1KRXxuM1KPxKbIIJUGvR0tmj16QyL5UQ=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/v2/v2ray-domain-list-community/package.nix b/pkgs/by-name/v2/v2ray-domain-list-community/package.nix
index 0358e2142496..472f808922dd 100644
--- a/pkgs/by-name/v2/v2ray-domain-list-community/package.nix
+++ b/pkgs/by-name/v2/v2ray-domain-list-community/package.nix
@@ -9,12 +9,12 @@
 let
   generator = pkgsBuildBuild.buildGoModule rec {
     pname = "v2ray-domain-list-community";
-    version = "20260531040030";
+    version = "20260609060640";
     src = fetchFromGitHub {
       owner = "v2fly";
       repo = "domain-list-community";
       rev = version;
-      hash = "sha256-+3lr7x+Ye2FcNjPNlxzI51yaNjQZl0CKeJ497HQZkm0=";
+      hash = "sha256-iedleoE+KXtCSEVgC7R8nSWgTFBXEVnp56J/PsmQ41I=";
     };
     vendorHash = "sha256-9tXv+rDBowxDN9gH4zHCr4TRbic4kijco3Y6bojJKRk=";
     meta = {
diff --git a/pkgs/development/interpreters/octave/default.nix b/pkgs/development/interpreters/octave/default.nix
index 19a3314a36e9..aac3d80afcfe 100644
--- a/pkgs/development/interpreters/octave/default.nix
+++ b/pkgs/development/interpreters/octave/default.nix
@@ -100,12 +100,12 @@ let
   allPkgs = pkgs;
 in
 stdenv.mkDerivation (finalAttrs: {
-  version = "11.2.0";
+  version = "11.3.0";
   pname = "octave";
 
   src = fetchurl {
     url = "mirror://gnu/octave/octave-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-zV0nMbYchh/yDKMN3ezrNmREuRjHoulZmG8DrsNuT6I=";
+    sha256 = "sha256-y1if6zzvhNE0hUaDcYycE+C0ceqRbQdhvnqMTiYaMtE=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/lua-modules/generated-packages.nix b/pkgs/development/lua-modules/generated-packages.nix
index 59ef98f45882..6dbace9edac2 100644
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -490,6 +490,38 @@ final: prev: {
     }
   ) { };
 
+  coop-nvim = callPackage (
+    {
+      buildLuarocksPackage,
+      fetchFromGitHub,
+      fetchurl,
+      luaOlder,
+    }:
+    buildLuarocksPackage {
+      pname = "coop.nvim";
+      version = "1.2.0-0";
+      knownRockspec =
+        (fetchurl {
+          url = "mirror://luarocks/coop.nvim-1.2.0-0.rockspec";
+          sha256 = "1fkpdddk2c2wibk0khgmvr03in2hz8wd3gdmmfbfbpb6jybhcckg";
+        }).outPath;
+      src = fetchFromGitHub {
+        owner = "gregorias";
+        repo = "coop.nvim";
+        rev = "b156e541316aee14be4ae64c93ed8bddb6d03bc1";
+        hash = "sha256-S6iGmdakI714Im0tetgfASbe0K4/olYsjj26+WP+rSU=";
+      };
+
+      disabled = luaOlder "5.1";
+
+      meta = {
+        homepage = "https://github.com/gregorias/coop.nvim";
+        license = lib.licenses.gpl3Only;
+        description = "A Neovim plugin for structured concurrency with coroutines.";
+      };
+    }
+  ) { };
+
   cosmo = callPackage (
     {
       buildLuarocksPackage,
diff --git a/pkgs/development/python-modules/emmiai-noether/default.nix b/pkgs/development/python-modules/emmiai-noether/default.nix
index 0568a24f7acd..d2e626088d01 100644
--- a/pkgs/development/python-modules/emmiai-noether/default.nix
+++ b/pkgs/development/python-modules/emmiai-noether/default.nix
@@ -51,6 +51,7 @@ buildPythonPackage (finalAttrs: {
 
   pythonRelaxDeps = [
     "numpy"
+    "torch"
   ];
   dependencies = [
     aistore
@@ -87,6 +88,23 @@ buildPythonPackage (finalAttrs: {
     "test_total_cpu_count_linux"
     "test_total_cpu_count_mac"
     "test_total_cpu_count_windows"
+
+    # Numerical precision asertion errors since torch was updated to 2.12.0
+    # AssertionError: Output is not as expected
+    "test_ab_upt_determinism_regression_check"
+    "test_double_kwargs"
+    "test_forward_shape"
+    "test_forward_transolver_attention"
+    "test_forward_with_mask"
+    "test_perceiver_attention_forward_shape"
+    "test_perceiver_block_forward"
+    "test_rope_perceiver"
+    "test_rope_transformer"
+    "test_single"
+    "test_transformer_block_forward"
+    "test_transformer_determinism_regression_check"
+    "test_transolver_determinism_regression_check"
+    "test_upt_determinism_regression_check"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # flaky: assert 0.32007395901018754 == 0.3 ± 0.02
diff --git a/pkgs/development/python-modules/libmobility/default.nix b/pkgs/development/python-modules/libmobility/default.nix
new file mode 100644
index 000000000000..bb4b74e1ffe7
--- /dev/null
+++ b/pkgs/development/python-modules/libmobility/default.nix
@@ -0,0 +1,170 @@
+{
+  lib,
+  config,
+  buildPythonPackage,
+  fetchFromGitHub,
+  python,
+
+  # build-system
+  cmake,
+  nanobind,
+  setuptools,
+
+  # nativeBuildInputs
+  autoAddDriverRunpath,
+  cudaPackages,
+
+  # buildInputs
+  blas,
+  lapack,
+
+  # dependencies
+  numpy,
+  scipy,
+
+  # tests
+  pytest-xdist,
+  pytestCheckHook,
+
+  # passthru
+  libmobility,
+}:
+let
+  uammd-src = fetchFromGitHub {
+    owner = "RaulPPelaez";
+    repo = "uammd";
+    tag = "v3.0.1";
+    hash = "sha256-/7ceXlA96dZQs1WzkV1OpRv61xa0Tdt5gFe17I0s1BI=";
+  };
+in
+buildPythonPackage.override { stdenv = cudaPackages.backendStdenv; } (finalAttrs: {
+  pname = "libmobility";
+  version = "1.1.2";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "stochasticHydroTools";
+    repo = "libMobility";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-7jUpVR4bS9vkgeKN68of6VNZzGPlQMcRMBStQ+wFEx4=";
+  };
+
+  postPatch =
+    # Various setup.py patches:
+    # - Inject nix's cmakeFlags
+    # - Patch install destination
+    # - Don't let setuptools ship the `solvers/` directory as the package is
+    #   already installed by cmake
+    # - Patch the version
+    ''
+      substituteInPlace setup.py \
+        --replace-fail \
+          "cmake_args = [" \
+          "cmake_args = [${lib.concatStringsSep "," (map (f: "'${f}'") finalAttrs.cmakeFlags)}," \
+        --replace-fail \
+          "sys.prefix" \
+          'os.environ["out"]' \
+        --replace-fail \
+          "packages=find_packages()," \
+          "packages=[]," \
+        --replace-fail \
+          'version = "0"' \
+          'version = "${finalAttrs.version}"'
+    ''
+    # Upstream installs the modules into the (read-only) absolute `Python_SITEARCH`.
+    # Make the destination relative so it lands under CMAKE_INSTALL_PREFIX ($out).
+    + ''
+      substituteInPlace solvers/CMakeLists.txt \
+        --replace-fail "$""{Python_SITEARCH}" "${python.sitePackages}"
+    ''
+    # The C++ test suite unconditionally fetches googletest over the network and
+    # is not run here (it requires a GPU); drop it.
+    + ''
+      substituteInPlace CMakeLists.txt \
+        --replace-fail "add_subdirectory(tests/cpp)" ""
+    '';
+
+  build-system = [
+    cmake
+    nanobind
+    setuptools
+  ];
+  dontUseCmakeConfigure = true;
+
+  nativeBuildInputs = [
+    autoAddDriverRunpath
+    cudaPackages.cuda_nvcc
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_UAMMD" uammd-src.outPath)
+    (lib.cmakeFeature "nanobind_DIR" "${nanobind}/${python.sitePackages}/nanobind/cmake")
+  ];
+
+  env = {
+    CMAKE_CUDA_ARCHITECTURES = cudaPackages.flags.cmakeCudaArchitecturesString;
+  };
+
+  preBuild = ''
+    export BUILD_JOBS="$NIX_BUILD_CORES"
+  '';
+
+  buildInputs = [
+    blas
+    lapack
+  ]
+  ++ (with cudaPackages; [
+    cuda_cccl # <nv/target>
+    cuda_cudart # CUDA::cuda_driver (driver stub)
+    libcublas
+    libcufft
+    libcurand
+    libcusolver
+  ]);
+
+  dependencies = [
+    numpy
+    scipy
+  ];
+
+  pythonImportsCheck = [ "libMobility" ];
+
+  nativeCheckInputs = [
+    pytest-xdist
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # FileNotFoundError: [Errno 2] No such file or directory: './ref/pair_mobility_nbody_freespace.npz'
+    "test_pair_mobility_angular_nbody"
+
+    # AssertionError (numerical assertion)
+    "test_deterministic_divM_matches_rfd"
+    "test_non_square_box"
+
+    # TypeError: Iterator operand 1 dtype could not be cast from dtype('complex128') to
+    # dtype('float64') according to the rule 'safe'
+    "test_fluctuation_dissipation_angular_displacements"
+
+    # Extremely long
+    "test_fluctuation_dissipation_linear_displacements"
+  ];
+
+  # Tests require GPU access
+  doCheck = false;
+  passthru.gpuCheck = libmobility.overridePythonAttrs {
+    requiredSystemFeatures = [ "cuda" ];
+    doCheck = true;
+  };
+
+  meta = {
+    description = "Python interface to a collection of GPU hydrodynamic mobility solvers";
+    homepage = "https://github.com/stochasticHydroTools/libMobility";
+    changelog = "https://github.com/stochasticHydroTools/libMobility/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    platforms = lib.platforms.linux;
+    broken = !config.cudaSupport;
+  };
+})
diff --git a/pkgs/development/python-modules/lxmf/default.nix b/pkgs/development/python-modules/lxmf/default.nix
index 81de08cf79c3..3ce65bf5f059 100644
--- a/pkgs/development/python-modules/lxmf/default.nix
+++ b/pkgs/development/python-modules/lxmf/default.nix
@@ -25,8 +25,6 @@ buildPythonPackage (finalAttrs: {
 
   build-system = [ setuptools ];
 
-  pythonRelaxDeps = [ "rns" ];
-
   buildInputs = lib.optionals (!propagateRns) [
     rns
   ];
diff --git a/pkgs/development/python-modules/python-duco-connectivity/default.nix b/pkgs/development/python-modules/python-duco-connectivity/default.nix
new file mode 100644
index 000000000000..987422109bdd
--- /dev/null
+++ b/pkgs/development/python-modules/python-duco-connectivity/default.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  aiohttp,
+  aioresponses,
+  pytest-asyncio,
+  pytest-cov-stub,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "python-duco-connectivity";
+  version = "0.5.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "ronaldvdmeer";
+    repo = "python-duco-connectivity";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-AH8EhC0v8GDNvPSUaTownV9d4upvKRiO//2sipGHz9g=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ aiohttp ];
+
+  nativeCheckInputs = [
+    aioresponses
+    pytest-asyncio
+    pytest-cov-stub
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "duco_connectivity" ];
+
+  meta = {
+    description = "Async HTTP client for the local Duco Connectivity API";
+    homepage = "https://github.com/ronaldvdmeer/python-duco-connectivity";
+    changelog = "https://github.com/ronaldvdmeer/python-duco-connectivity/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+})
diff --git a/pkgs/development/python-modules/rns/default.nix b/pkgs/development/python-modules/rns/default.nix
index 2ab0dc34895e..81b59755d7c4 100644
--- a/pkgs/development/python-modules/rns/default.nix
+++ b/pkgs/development/python-modules/rns/default.nix
@@ -4,7 +4,7 @@
   buildPythonPackage,
   cryptography,
   esptool,
-  fetchFromGitHub,
+  fetchPypi,
   netifaces,
   pyserial,
   replaceVars,
@@ -14,15 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "rns";
-  version = "1.3.4";
+  version = "1.3.5";
   pyproject = true;
   __structuredAttrs = true;
 
-  src = fetchFromGitHub {
-    owner = "markqvist";
-    repo = "Reticulum";
-    tag = finalAttrs.version;
-    hash = "sha256-rhZfkSV2OtCVPbUyTrYry2lwIeSfz3JnX+mVTkZt+Rc=";
+  src = fetchPypi {
+    pname = "rns";
+    version = finalAttrs.version;
+    hash = "sha256-YxReocD6Ump5FMCnLEqCJ5tZcZh1kYsFWNBJ0pGYzuM=";
   };
 
   patches = [
@@ -49,7 +48,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Cryptography-based networking stack for wide-area networks";
     homepage = "https://reticulum.network";
-    changelog = "https://github.com/markqvist/Reticulum/blob/${finalAttrs.src.tag}/Changelog.md";
+    changelog = "https://github.com/markqvist/Reticulum/blob/${finalAttrs.version}/Changelog.md";
     # Reticulum License
     # https://github.com/markqvist/Reticulum/blob/master/LICENSE
     license = lib.licenses.unfree;
diff --git a/pkgs/development/python-modules/transformer-engine/default.nix b/pkgs/development/python-modules/transformer-engine/default.nix
index 6cb337762753..6a656dd359d8 100644
--- a/pkgs/development/python-modules/transformer-engine/default.nix
+++ b/pkgs/development/python-modules/transformer-engine/default.nix
@@ -80,7 +80,7 @@ let
 in
 buildPythonPackage.override { stdenv = backendStdenv; } (finalAttrs: {
   pname = "transformer-engine";
-  version = "2.15";
+  version = "2.16";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -90,7 +90,7 @@ buildPythonPackage.override { stdenv = backendStdenv; } (finalAttrs: {
     tag = "v${finalAttrs.version}";
     # Their CMakeLists.txt does not easily let us inject dependencies
     fetchSubmodules = true;
-    hash = "sha256-0a6etDttNoTL1pe2OZb1CcS0/AtozeAG8NFz2Hkppn8=";
+    hash = "sha256-PUs/qIdF894232GmdjLsDD2rzU5NPTt/u20v93yZTog=";
   };
 
   patches = optionals cudaSupport [
diff --git a/pkgs/development/tools/asn2quickder/default.nix b/pkgs/development/tools/asn2quickder/default.nix
index 14c5fe339cf7..99c6dcee3e9e 100644
--- a/pkgs/development/tools/asn2quickder/default.nix
+++ b/pkgs/development/tools/asn2quickder/default.nix
@@ -1,16 +1,11 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitLab,
   makeWrapper,
-  cmake,
-  six,
-  pyparsing,
-  asn1ate,
-  colored,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "asn2quickder";
   version = "1.7.1";
   format = "setuptools";
@@ -33,10 +28,10 @@ buildPythonApplication rec {
 
   nativeBuildInputs = [
     makeWrapper
-    cmake
+    python3Packages.cmake
   ];
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     pyparsing
     asn1ate
     six
diff --git a/pkgs/development/tools/enochecker-test/default.nix b/pkgs/development/tools/enochecker-test/default.nix
index 54fe3e3521a3..bda92eaf7153 100644
--- a/pkgs/development/tools/enochecker-test/default.nix
+++ b/pkgs/development/tools/enochecker-test/default.nix
@@ -1,25 +1,10 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchPypi,
-
-  certifi,
-  charset-normalizer,
-  enochecker-core,
-  exceptiongroup,
-  idna,
-  iniconfig,
-  jsons,
-  packaging,
-  pluggy,
-  pytest,
-  requests,
-  tomli,
-  typish,
-  urllib3,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "enochecker-test";
   version = "0.9.0";
   format = "setuptools";
@@ -35,7 +20,7 @@ buildPythonApplication rec {
 
   pythonRelaxDeps = true;
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     certifi
     charset-normalizer
     enochecker-core
diff --git a/pkgs/development/tools/misc/cvise/default.nix b/pkgs/development/tools/misc/cvise/default.nix
index 9c170e7c3ea9..0dc731809d4f 100644
--- a/pkgs/development/tools/misc/cvise/default.nix
+++ b/pkgs/development/tools/misc/cvise/default.nix
@@ -1,23 +1,18 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
   clang-tools,
-  cmake,
   colordiff,
   flex,
   libclang,
   llvm,
   unifdef,
-  chardet,
-  pebble,
-  psutil,
-  pytestCheckHook,
   testers,
   cvise,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "cvise";
   version = "2.12.0";
   pyproject = false;
@@ -46,7 +41,7 @@ buildPythonApplication rec {
   '';
 
   nativeBuildInputs = [
-    cmake
+    python3Packages.cmake # TODO: swap this out for the non-python cmake
     flex
     llvm.dev
   ];
@@ -58,14 +53,14 @@ buildPythonApplication rec {
     unifdef
   ];
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     chardet
     pebble
     psutil
   ];
 
   nativeCheckInputs = [
-    pytestCheckHook
+    python3Packages.pytestCheckHook
     unifdef
   ];
 
diff --git a/pkgs/development/tools/misc/gdbgui/default.nix b/pkgs/development/tools/misc/gdbgui/default.nix
index 0998ecaa38ba..a64c37640a15 100644
--- a/pkgs/development/tools/misc/gdbgui/default.nix
+++ b/pkgs/development/tools/misc/gdbgui/default.nix
@@ -1,23 +1,19 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchPypi,
   gdb,
-  eventlet,
-  flask-compress,
-  flask-socketio,
-  pygdbmi,
-  pygments,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "gdbgui";
 
   version = "0.15.3.0";
   format = "setuptools";
 
   buildInputs = [ gdb ];
-  propagatedBuildInputs = [
+
+  propagatedBuildInputs = with python3Packages; [
     eventlet
     flask-compress
     flask-socketio
diff --git a/pkgs/development/tools/misc/yakut/default.nix b/pkgs/development/tools/misc/yakut/default.nix
index 5380c7e1d6ff..12bd27538ddc 100644
--- a/pkgs/development/tools/misc/yakut/default.nix
+++ b/pkgs/development/tools/misc/yakut/default.nix
@@ -1,22 +1,11 @@
 {
   lib,
-  buildPythonApplication,
-  fetchPypi,
   stdenv,
-  click,
-  coloredlogs,
-  mido,
-  psutil,
-  pycyphal,
-  pysdl2,
-  python-rtmidi,
-  ruamel-yaml,
-  requests,
-  scipy,
-  simplejson,
+  python3Packages,
+  fetchPypi,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "yakut";
   version = "0.14.2";
   format = "setuptools";
@@ -29,7 +18,8 @@ buildPythonApplication rec {
   buildInputs = [
     (lib.getLib stdenv.cc.cc)
   ];
-  dependencies = [
+
+  dependencies = with python3Packages; [
     click
     coloredlogs
     psutil
@@ -39,7 +29,8 @@ buildPythonApplication rec {
     scipy
     simplejson
   ];
-  optional-dependencies.joystick = [
+
+  optional-dependencies.joystick = with python3Packages; [
     pysdl2
     mido
     python-rtmidi
diff --git a/pkgs/os-specific/linux/cpupower-gui/default.nix b/pkgs/os-specific/linux/cpupower-gui/default.nix
index 243bae936cf9..b823fdb21359 100644
--- a/pkgs/os-specific/linux/cpupower-gui/default.nix
+++ b/pkgs/os-specific/linux/cpupower-gui/default.nix
@@ -1,10 +1,9 @@
 {
   lib,
+  python3Packages,
   fetchFromGitHub,
   fetchpatch,
-  buildPythonApplication,
   appstream-glib,
-  dbus-python,
   desktop-file-utils,
   gettext,
   glib,
@@ -14,14 +13,11 @@
   libappindicator,
   libhandy,
   meson,
-  ninja,
   pkg-config,
-  pygobject3,
-  pyxdg,
   wrapGAppsHook3,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "cpupower-gui";
   version = "1.0.0";
 
@@ -57,15 +53,13 @@ buildPythonApplication rec {
     gobject-introspection # need for gtk namespace to be available
     hicolor-icon-theme # needed for postinstall script
     meson
-    ninja
+    python3Packages.ninja # TODO: maybe swap out for the non-python package
     pkg-config
     wrapGAppsHook3
-
-    # Python packages
-    dbus-python
+    python3Packages.dbus-python
     libappindicator
-    pygobject3
-    pyxdg
+    python3Packages.pygobject3
+    python3Packages.pyxdg
   ];
 
   buildInputs = [
@@ -75,10 +69,10 @@ buildPythonApplication rec {
   ];
 
   propagatedBuildInputs = [
-    dbus-python
+    python3Packages.dbus-python
     libappindicator
-    pygobject3
-    pyxdg
+    python3Packages.pygobject3
+    python3Packages.pyxdg
   ];
 
   mesonFlags = [
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 4ac6ec7ea259..5f244f47270b 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -1496,7 +1496,8 @@
       ];
     "duco" =
       ps: with ps; [
-      ]; # missing inputs: python-duco-connectivity
+        python-duco-connectivity
+      ];
     "dunehd" =
       ps: with ps; [
         pdunehd
@@ -7927,6 +7928,7 @@
     "dsmr"
     "dsmr_reader"
     "duckdns"
+    "duco"
     "dunehd"
     "duotecno"
     "dwd_weather_warnings"
diff --git a/pkgs/tools/inputmethods/input-remapper/default.nix b/pkgs/tools/inputmethods/input-remapper/default.nix
index 6a27efe55775..3b7a60156f8e 100644
--- a/pkgs/tools/inputmethods/input-remapper/default.nix
+++ b/pkgs/tools/inputmethods/input-remapper/default.nix
@@ -1,8 +1,7 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
-  pkgconfig,
   wrapGAppsHook3,
   gettext,
   gtk3,
@@ -10,12 +9,6 @@
   dbus,
   gobject-introspection,
   xmodmap,
-  pygobject3,
-  setuptools,
-  evdev,
-  pydantic,
-  pydbus,
-  psutil,
   procps,
   gtksourceview4,
   bash,
@@ -37,7 +30,7 @@
 let
   maybeXmodmap = lib.optional withXmodmap xmodmap;
 in
-(buildPythonApplication rec {
+(python3Packages.buildPythonApplication rec {
   pname = "input-remapper";
   version = "2.2.0";
   format = "setuptools";
@@ -66,11 +59,11 @@ in
     gtk3
     glib
     gobject-introspection
-    pygobject3
+    python3Packages.pygobject3
   ]
   ++ maybeXmodmap;
 
-  dependencies = [
+  dependencies = with python3Packages; [
     setuptools # needs pkg_resources
     pygobject3
     evdev
@@ -86,7 +79,7 @@ in
     udevCheckHook
     versionCheckHook
   ]
-  ++ lib.optionals withDoCheck [ psutil ];
+  ++ lib.optionals withDoCheck [ python3Packages.psutil ];
 
   versionCheckProgram = "${placeholder "out"}/bin/input-remapper-control";
 
diff --git a/pkgs/tools/misc/online-judge-template-generator/default.nix b/pkgs/tools/misc/online-judge-template-generator/default.nix
index 1335fcc6a52e..1f4592222a88 100644
--- a/pkgs/tools/misc/online-judge-template-generator/default.nix
+++ b/pkgs/tools/misc/online-judge-template-generator/default.nix
@@ -1,21 +1,10 @@
 {
   lib,
-  buildPythonApplication,
-  appdirs,
-  beautifulsoup4,
-  colorlog,
+  python3Packages,
   fetchFromGitHub,
-  mako,
-  online-judge-api-client,
-  online-judge-tools,
-  ply,
-  pyyaml,
-  requests,
-  setuptools,
-  toml,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "online-judge-template-generator";
   version = "4.8.1";
   format = "setuptools";
@@ -27,7 +16,7 @@ buildPythonApplication rec {
     sha256 = "sha256-cS1ED1a92fEFqy6ht8UFjxocWIm35IA/VuaPSLsdlqg=";
   };
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     appdirs
     beautifulsoup4
     colorlog
diff --git a/pkgs/tools/misc/pandoc-acro/default.nix b/pkgs/tools/misc/pandoc-acro/default.nix
index 95f15d32d76c..73b6c937ff55 100644
--- a/pkgs/tools/misc/pandoc-acro/default.nix
+++ b/pkgs/tools/misc/pandoc-acro/default.nix
@@ -1,9 +1,7 @@
 {
-  buildPythonApplication,
-  fetchPypi,
-  pandocfilters,
-  panflute,
   lib,
+  python3Packages,
+  fetchPypi,
   pandoc,
   pandoc-acro,
   texliveTeTeX,
@@ -19,11 +17,11 @@ let
     hash = "sha256-JMfSQXX+BCGdFQYPFB+r08WRnhT3aXfnBNINROxCUA0=";
   };
 in
-buildPythonApplication {
+python3Packages.buildPythonApplication {
   format = "setuptools";
   inherit pname version src;
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     pandocfilters
     panflute
   ];
diff --git a/pkgs/tools/misc/pandoc-drawio-filter/default.nix b/pkgs/tools/misc/pandoc-drawio-filter/default.nix
index c49a057289b1..dad4b5e784be 100644
--- a/pkgs/tools/misc/pandoc-drawio-filter/default.nix
+++ b/pkgs/tools/misc/pandoc-drawio-filter/default.nix
@@ -1,10 +1,9 @@
 {
-  buildPythonApplication,
-  drawio-headless,
-  fetchFromGitHub,
   lib,
+  python3Packages,
+  fetchFromGitHub,
+  drawio-headless,
   pandoc,
-  pandocfilters,
   runCommand,
   texliveTeTeX,
 }:
@@ -19,7 +18,7 @@ let
     sha256 = "sha256-2XJSAfxqEmmamWIAM3vZqi0mZjUUugmR3zWw8Imjadk=";
   };
 
-  pandoc-drawio-filter = buildPythonApplication {
+  pandoc-drawio-filter = python3Packages.buildPythonApplication {
     format = "setuptools";
     pname = "pandoc-drawio-filter";
 
@@ -27,7 +26,7 @@ let
 
     propagatedBuildInputs = [
       drawio-headless
-      pandocfilters
+      python3Packages.pandocfilters
     ];
 
     passthru.tests.example-doc =
diff --git a/pkgs/tools/misc/pandoc-eqnos/default.nix b/pkgs/tools/misc/pandoc-eqnos/default.nix
index 4c5521b1d7aa..edc639a84c7b 100644
--- a/pkgs/tools/misc/pandoc-eqnos/default.nix
+++ b/pkgs/tools/misc/pandoc-eqnos/default.nix
@@ -1,12 +1,10 @@
 {
-  buildPythonApplication,
-  fetchFromGitHub,
   lib,
-  pandoc-xnos,
-  setuptools,
+  python3Packages,
+  fetchFromGitHub,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "pandoc-eqnos";
   version = "2.5.0";
   pyproject = true;
@@ -18,11 +16,11 @@ buildPythonApplication rec {
     hash = "sha256-7GQdfGHhtQs6LZK+ZyMmcPSkoFfBWmATTMejMiFcS7Y=";
   };
 
-  nativeBuildInputs = [
+  nativeBuildInputs = with python3Packages; [
     setuptools
   ];
 
-  propagatedBuildInputs = [ pandoc-xnos ];
+  propagatedBuildInputs = with python3Packages; [ pandoc-xnos ];
 
   # Different pandoc executables are not available
   doCheck = false;
diff --git a/pkgs/tools/misc/pandoc-fignos/default.nix b/pkgs/tools/misc/pandoc-fignos/default.nix
index 75ef5eb4559b..eb257c306ae4 100644
--- a/pkgs/tools/misc/pandoc-fignos/default.nix
+++ b/pkgs/tools/misc/pandoc-fignos/default.nix
@@ -1,12 +1,10 @@
 {
-  buildPythonApplication,
-  fetchFromGitHub,
   lib,
-  pandoc-xnos,
-  setuptools,
+  python3Packages,
+  fetchFromGitHub,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "pandoc-fignos";
   version = "2.4.0";
   pyproject = true;
@@ -18,11 +16,11 @@ buildPythonApplication rec {
     sha256 = "sha256-eDwAW0nLB4YqrWT3Ajt9bmX1A43wl+tOPm2St5VpCLk=";
   };
 
-  nativeBuildInputs = [
+  nativeBuildInputs = with python3Packages; [
     setuptools
   ];
 
-  propagatedBuildInputs = [ pandoc-xnos ];
+  propagatedBuildInputs = with python3Packages; [ pandoc-xnos ];
 
   # Different pandoc executables are not available
   doCheck = false;
diff --git a/pkgs/tools/misc/pandoc-imagine/default.nix b/pkgs/tools/misc/pandoc-imagine/default.nix
index 8307eda4974c..aed98010d7f3 100644
--- a/pkgs/tools/misc/pandoc-imagine/default.nix
+++ b/pkgs/tools/misc/pandoc-imagine/default.nix
@@ -1,12 +1,10 @@
 {
-  fetchFromGitHub,
-  buildPythonApplication,
   lib,
-  pandocfilters,
-  six,
+  python3Packages,
+  fetchFromGitHub,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "pandoc-imagine";
   version = "0.1.7";
   format = "setuptools";
@@ -18,7 +16,7 @@ buildPythonApplication rec {
     sha256 = "sha256-IJAXrJakKjROF2xi9dsLvGzyGIyB+GDnx/Z7BRlwSqc=";
   };
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     pandocfilters
     six
   ];
diff --git a/pkgs/tools/misc/pandoc-include/default.nix b/pkgs/tools/misc/pandoc-include/default.nix
index ee39ddd10259..99263c7495f1 100644
--- a/pkgs/tools/misc/pandoc-include/default.nix
+++ b/pkgs/tools/misc/pandoc-include/default.nix
@@ -1,15 +1,11 @@
 {
-  buildPythonApplication,
-  fetchFromGitHub,
   lib,
-  natsort,
-  panflute,
-  lxml,
-  setuptools,
+  python3Packages,
+  fetchFromGitHub,
   nix-update-script,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "pandoc-include";
   version = "1.4.4";
   pyproject = true;
@@ -21,13 +17,13 @@ buildPythonApplication rec {
     hash = "sha256-M0frQGg2nHbgY53ejMdbXKLJjXQgx8aNUVxeDDIHdp4=";
   };
 
-  build-system = [
+  build-system = with python3Packages; [
     setuptools
   ];
 
   passthru.updateScript = nix-update-script { };
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     natsort
     panflute
     lxml
diff --git a/pkgs/tools/misc/pandoc-plantuml-filter/default.nix b/pkgs/tools/misc/pandoc-plantuml-filter/default.nix
index 194c804fd990..f84e72e72f8b 100644
--- a/pkgs/tools/misc/pandoc-plantuml-filter/default.nix
+++ b/pkgs/tools/misc/pandoc-plantuml-filter/default.nix
@@ -1,13 +1,10 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchPypi,
-  setuptools,
-  setuptools-scm,
-  pandocfilters,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "pandoc-plantuml-filter";
   version = "0.1.5";
   pyproject = true;
@@ -17,12 +14,12 @@ buildPythonApplication rec {
     hash = "sha256-9qXeIZuCu44m9EoPCPL7MgEboEwN91OylLfbkwhkZYQ=";
   };
 
-  build-system = [
+  build-system = with python3Packages; [
     setuptools
     setuptools-scm
   ];
 
-  dependencies = [ pandocfilters ];
+  dependencies = with python3Packages; [ pandocfilters ];
 
   meta = {
     homepage = "https://github.com/timofurrer/pandoc-plantuml-filter";
diff --git a/pkgs/tools/misc/pandoc-secnos/default.nix b/pkgs/tools/misc/pandoc-secnos/default.nix
index 70616ec5adc3..c32530bf5a32 100644
--- a/pkgs/tools/misc/pandoc-secnos/default.nix
+++ b/pkgs/tools/misc/pandoc-secnos/default.nix
@@ -1,12 +1,10 @@
 {
-  buildPythonApplication,
-  fetchFromGitHub,
   lib,
-  pandoc-xnos,
-  setuptools,
+  python3Packages,
+  fetchFromGitHub,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "pandoc-secnos";
   version = "2.2.2";
   pyproject = true;
@@ -18,11 +16,11 @@ buildPythonApplication rec {
     sha256 = "sha256-J9KLZvioYM3Pl2UXjrEgd4PuLTwCLYy9SsJIzgw5/jU=";
   };
 
-  nativeBuildInputs = [
+  nativeBuildInputs = with python3Packages; [
     setuptools
   ];
 
-  propagatedBuildInputs = [ pandoc-xnos ];
+  propagatedBuildInputs = with python3Packages; [ pandoc-xnos ];
 
   patches = [
     ./patch/fix-manifest.patch
diff --git a/pkgs/tools/misc/pandoc-tablenos/default.nix b/pkgs/tools/misc/pandoc-tablenos/default.nix
index f8202cd8f695..318c7725b84d 100644
--- a/pkgs/tools/misc/pandoc-tablenos/default.nix
+++ b/pkgs/tools/misc/pandoc-tablenos/default.nix
@@ -1,12 +1,10 @@
 {
-  buildPythonApplication,
-  fetchFromGitHub,
   lib,
-  pandoc-xnos,
-  setuptools,
+  python3Packages,
+  fetchFromGitHub,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "pandoc-tablenos";
   version = "2.3.0";
   pyproject = true;
@@ -18,11 +16,11 @@ buildPythonApplication rec {
     hash = "sha256-FwzsRziY3PoySo9hIFuLw6tOO9oQij6oQEyoY8HgnII=";
   };
 
-  nativeBuildInputs = [
+  nativeBuildInputs = with python3Packages; [
     setuptools
   ];
 
-  propagatedBuildInputs = [ pandoc-xnos ];
+  propagatedBuildInputs = with python3Packages; [ pandoc-xnos ];
 
   # Different pandoc executables are not available
   doCheck = false;
diff --git a/pkgs/tools/misc/pdd/default.nix b/pkgs/tools/misc/pdd/default.nix
index 433d28c19b0b..41dbd38ece0d 100644
--- a/pkgs/tools/misc/pdd/default.nix
+++ b/pkgs/tools/misc/pdd/default.nix
@@ -1,11 +1,10 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
-  python-dateutil,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "pdd";
   version = "1.7";
   pyproject = false;
@@ -27,7 +26,7 @@ buildPythonApplication rec {
     mkdir -p $out/share/fish/vendor_completions.d
   '';
 
-  dependencies = [ python-dateutil ];
+  dependencies = with python3Packages; [ python-dateutil ];
 
   installFlags = [ "PREFIX=$(out)" ];
 
diff --git a/pkgs/tools/misc/remote-exec/default.nix b/pkgs/tools/misc/remote-exec/default.nix
index fb4c4e1e3355..ed738f85dd7b 100644
--- a/pkgs/tools/misc/remote-exec/default.nix
+++ b/pkgs/tools/misc/remote-exec/default.nix
@@ -1,19 +1,13 @@
 {
   lib,
   stdenv,
+  python3Packages,
   fetchpatch,
   fetchFromGitHub,
-  buildPythonApplication,
-  click,
-  pydantic,
-  toml,
-  watchdog,
-  pytestCheckHook,
-  pytest-cov-stub,
   rsync,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "remote-exec";
   version = "1.13.3";
   format = "setuptools";
@@ -40,7 +34,7 @@ buildPythonApplication rec {
       --replace-fail '"mremote' '#"mremote'
   '';
 
-  dependencies = [
+  dependencies = with python3Packages; [
     click
     pydantic
     toml
@@ -53,7 +47,7 @@ buildPythonApplication rec {
     rsync
   ];
 
-  checkInputs = [
+  checkInputs = with python3Packages; [
     pytestCheckHook
     pytest-cov-stub
   ];
diff --git a/pkgs/tools/misc/vimwiki-markdown/default.nix b/pkgs/tools/misc/vimwiki-markdown/default.nix
index 00cf23aa9b36..f0214cacddbb 100644
--- a/pkgs/tools/misc/vimwiki-markdown/default.nix
+++ b/pkgs/tools/misc/vimwiki-markdown/default.nix
@@ -1,12 +1,10 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchPypi,
-  markdown,
-  pygments,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   version = "0.4.1";
   format = "setuptools";
   pname = "vimwiki-markdown";
@@ -16,7 +14,7 @@ buildPythonApplication rec {
     hash = "sha256-hJl0OTE6kHucVGOxgOZBG0noYRfxma3yZSrUWEssLN4=";
   };
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     markdown
     pygments
   ];
diff --git a/pkgs/tools/networking/namespaced-openvpn/default.nix b/pkgs/tools/networking/namespaced-openvpn/default.nix
index a19e2aa53903..2325c09d8d44 100644
--- a/pkgs/tools/networking/namespaced-openvpn/default.nix
+++ b/pkgs/tools/networking/namespaced-openvpn/default.nix
@@ -1,14 +1,14 @@
 {
   lib,
+  python3Packages,
   fetchFromGitHub,
-  buildPythonPackage,
   openvpn,
   iproute2,
   iptables,
   util-linux,
 }:
 
-buildPythonPackage rec {
+python3Packages.buildPythonPackage rec {
   pname = "namespaced-openvpn";
   version = "0.6.0";
   pyproject = false;
diff --git a/pkgs/tools/networking/s3cmd/default.nix b/pkgs/tools/networking/s3cmd/default.nix
index 72d23e85acbe..7e76de2f114d 100644
--- a/pkgs/tools/networking/s3cmd/default.nix
+++ b/pkgs/tools/networking/s3cmd/default.nix
@@ -1,12 +1,10 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
-  python-magic,
-  python-dateutil,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "s3cmd";
   version = "2.4.0";
   format = "setuptools";
@@ -18,7 +16,7 @@ buildPythonApplication rec {
     sha256 = "sha256-cxwf6+9WFt3U7+JdKRgZxFElD+Dgf2P2VyejHVoiDJk=";
   };
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     python-magic
     python-dateutil
   ];
diff --git a/pkgs/tools/networking/vpn-slice/default.nix b/pkgs/tools/networking/vpn-slice/default.nix
index 6d4abb23d99f..6c534086972c 100644
--- a/pkgs/tools/networking/vpn-slice/default.nix
+++ b/pkgs/tools/networking/vpn-slice/default.nix
@@ -1,18 +1,15 @@
 {
   lib,
   stdenv,
-  buildPythonApplication,
+  python3Packages,
   nix-update-script,
   fetchFromGitHub,
-  dnspython,
   iproute2,
   iptables,
-  setproctitle,
-  setuptools,
   unixtools,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "vpn-slice";
   version = "0.16.1";
   pyproject = true;
@@ -35,11 +32,11 @@ buildPythonApplication rec {
         --replace-fail "'/sbin/iptables'" "'${iptables}/bin/iptables'"
     '';
 
-  build-system = [
+  build-system = with python3Packages; [
     setuptools
   ];
 
-  dependencies = [
+  dependencies = with python3Packages; [
     setuptools # can be removed with next package update, upstream no longer has a dependency on distutils
     setproctitle
     dnspython
diff --git a/pkgs/tools/security/cve-bin-tool/default.nix b/pkgs/tools/security/cve-bin-tool/default.nix
index 07ca4a07e60c..acabb46b2584 100644
--- a/pkgs/tools/security/cve-bin-tool/default.nix
+++ b/pkgs/tools/security/cve-bin-tool/default.nix
@@ -1,37 +1,8 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
 
-  # build-system
-  setuptools,
-
-  # dependencies
-  aiohttp,
-  beautifulsoup4,
-  brotlipy,
-  cvss,
-  distro,
-  filetype,
-  jinja2,
-  jsonschema,
-  lib4sbom,
-  lib4vex,
-  packageurl-python,
-  packaging,
-  plotly,
-  python-gnupg,
-  pyyaml,
-  requests,
-  rich,
-  rpmfile,
-  xmlschema,
-  zipp,
-  zstandard,
-
-  # optional-dependencies
-  reportlab,
-
   # runtime-dependencies
   google-cloud-sdk,
 
@@ -39,7 +10,7 @@
   versionCheckHook,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "cve-bin-tool";
   version = "3.4";
   pyproject = true;
@@ -51,35 +22,37 @@ buildPythonApplication rec {
     hash = "sha256-pv8XjKjZBUw5FmmUn1dakGeS1uw2xzF3wSIZOYQ2/3c=";
   };
 
-  build-system = [ setuptools ];
+  build-system = with python3Packages; [ setuptools ];
 
-  dependencies = [
-    aiohttp
-    beautifulsoup4
-    brotlipy
-    cvss
-    distro
-    filetype
-    jinja2
-    jsonschema
-    lib4sbom
-    lib4vex
-    packageurl-python
-    packaging
-    plotly
-    python-gnupg
-    pyyaml
-    requests
-    rich
-    rpmfile
-    setuptools
-    xmlschema
-    zipp
-    zstandard
-  ]
-  ++ aiohttp.optional-dependencies.speedups;
+  dependencies =
+    with python3Packages;
+    [
+      aiohttp
+      beautifulsoup4
+      brotlipy
+      cvss
+      distro
+      filetype
+      jinja2
+      jsonschema
+      lib4sbom
+      lib4vex
+      packageurl-python
+      packaging
+      plotly
+      python-gnupg
+      pyyaml
+      requests
+      rich
+      rpmfile
+      setuptools
+      xmlschema
+      zipp
+      zstandard
+    ]
+    ++ aiohttp.optional-dependencies.speedups;
 
-  optional-dependencies = {
+  optional-dependencies = with python3Packages; {
     pdf = [ reportlab ];
   };
 
diff --git a/pkgs/tools/security/nitrokey-app2/default.nix b/pkgs/tools/security/nitrokey-app2/default.nix
index a7942093436a..6dc5284cfe4b 100644
--- a/pkgs/tools/security/nitrokey-app2/default.nix
+++ b/pkgs/tools/security/nitrokey-app2/default.nix
@@ -1,13 +1,8 @@
 {
   lib,
   stdenv,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
-  poetry-core,
-  fido2,
-  nitrokey,
-  pyside6,
-  usb-monitor,
   qt6,
 }:
 
@@ -20,7 +15,7 @@ let
     ;
 in
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "nitrokey-app2";
   version = "2.5.2";
   pyproject = true;
@@ -44,11 +39,11 @@ buildPythonApplication rec {
     qtsvg
   ];
 
-  build-system = [
+  build-system = with python3Packages; [
     poetry-core
   ];
 
-  dependencies = [
+  dependencies = with python3Packages; [
     fido2
     nitrokey
     pyside6
diff --git a/pkgs/tools/security/pass2csv/default.nix b/pkgs/tools/security/pass2csv/default.nix
index 8325ebe8fef8..1bcc2707c964 100644
--- a/pkgs/tools/security/pass2csv/default.nix
+++ b/pkgs/tools/security/pass2csv/default.nix
@@ -1,12 +1,10 @@
 {
-  buildPythonApplication,
-  fetchPypi,
   lib,
-  python-gnupg,
-  setuptools,
+  python3Packages,
+  fetchPypi,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "pass2csv";
   version = "1.2.0";
   pyproject = true;
@@ -16,11 +14,11 @@ buildPythonApplication rec {
     hash = "sha256-IdcSwQ9O2HmCvT8p4tC7e2GQuhkE3kvMINszZH970og=";
   };
 
-  nativeBuildInputs = [
+  nativeBuildInputs = with python3Packages; [
     setuptools
   ];
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     python-gnupg
   ];
 
diff --git a/pkgs/tools/system/cm-rgb/default.nix b/pkgs/tools/system/cm-rgb/default.nix
index 1a0510a646c9..2333e32b0b8c 100644
--- a/pkgs/tools/system/cm-rgb/default.nix
+++ b/pkgs/tools/system/cm-rgb/default.nix
@@ -1,19 +1,14 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
   atk,
   gobject-introspection,
   wrapGAppsHook3,
-  click,
-  hidapi,
-  psutil,
-  pygobject3,
   udevCheckHook,
-  stdenv,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "cm-rgb";
   version = "0.3.6";
   format = "setuptools";
@@ -34,7 +29,7 @@ buildPythonApplication rec {
     udevCheckHook
   ];
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     click
     hidapi
     psutil
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5611e35fc810..30674f248999 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -407,7 +407,7 @@ with pkgs;
 
   dnf4 = python3Packages.callPackage ../development/python-modules/dnf4/wrapper.nix { };
 
-  enochecker-test = with python3Packages; callPackage ../development/tools/enochecker-test { };
+  enochecker-test = callPackage ../development/tools/enochecker-test { };
 
   inherit (gridlock) nyarr;
 
@@ -1433,7 +1433,7 @@ with pkgs;
     bitwarden-directory-connector
     ;
 
-  bitwarden-menu = python3Packages.callPackage ../applications/misc/bitwarden-menu { };
+  bitwarden-menu = callPackage ../applications/misc/bitwarden-menu { };
 
   blocksat-cli = with python3Packages; toPythonApplication blocksat-cli;
 
@@ -1746,7 +1746,7 @@ with pkgs;
     cairo = cairo.override { xcbSupport = true; };
   };
 
-  hyprshade = python3Packages.callPackage ../applications/window-managers/hyprwm/hyprshade { };
+  hyprshade = callPackage ../applications/window-managers/hyprwm/hyprshade { };
 
   hyprlandPlugins = recurseIntoAttrs (
     callPackage ../applications/window-managers/hyprwm/hyprland-plugins { }
@@ -1754,7 +1754,7 @@ with pkgs;
 
   intensity-normalization = with python3Packages; toPythonApplication intensity-normalization;
 
-  jellyfin-mpv-shim = python3Packages.callPackage ../applications/video/jellyfin-mpv-shim { };
+  jellyfin-mpv-shim = callPackage ../applications/video/jellyfin-mpv-shim { };
 
   klaus = with python3Packages; toPythonApplication klaus;
 
@@ -1823,9 +1823,7 @@ with pkgs;
 
   ocrmypdf = with python3.pkgs; toPythonApplication ocrmypdf;
 
-  online-judge-template-generator =
-    python3Packages.callPackage ../tools/misc/online-judge-template-generator
-      { };
+  online-judge-template-generator = callPackage ../tools/misc/online-judge-template-generator { };
 
   online-judge-tools = with python3.pkgs; toPythonApplication online-judge-tools;
 
@@ -1835,7 +1833,7 @@ with pkgs;
 
   pixcat = with python3Packages; toPythonApplication pixcat;
 
-  remarkable-mouse = python3Packages.callPackage ../applications/misc/remarkable/remarkable-mouse { };
+  remarkable-mouse = callPackage ../applications/misc/remarkable/remarkable-mouse { };
 
   ropgadget = with python3Packages; toPythonApplication ropgadget;
 
@@ -1995,7 +1993,7 @@ with pkgs;
 
   blacken-docs = with python3Packages; toPythonApplication blacken-docs;
 
-  bluetooth_battery = python3Packages.callPackage ../applications/misc/bluetooth_battery { };
+  bluetooth_battery = callPackage ../applications/misc/bluetooth_battery { };
 
   cffconvert = python3Packages.toPythonApplication python3Packages.cffconvert;
 
@@ -2070,7 +2068,7 @@ with pkgs;
     ngtcp2 = ngtcp2-gnutls;
   };
 
-  cve-bin-tool = python3Packages.callPackage ../tools/security/cve-bin-tool { };
+  cve-bin-tool = callPackage ../tools/security/cve-bin-tool { };
 
   dconf2nix = callPackage ../development/tools/haskell/dconf2nix { };
 
@@ -2429,7 +2427,7 @@ with pkgs;
 
   infisical = callPackage ../development/tools/infisical { };
 
-  input-remapper = python3Packages.callPackage ../tools/inputmethods/input-remapper { };
+  input-remapper = callPackage ../tools/inputmethods/input-remapper { };
 
   internetarchive = with python3Packages; toPythonApplication internetarchive;
 
@@ -2790,21 +2788,20 @@ with pkgs;
 
   nvfetcher = haskell.lib.compose.justStaticExecutables haskellPackages.nvfetcher;
 
-  pandoc-acro = python3Packages.callPackage ../tools/misc/pandoc-acro { };
+  pandoc-acro = callPackage ../tools/misc/pandoc-acro { };
 
-  pandoc-imagine = python3Packages.callPackage ../tools/misc/pandoc-imagine { };
+  pandoc-imagine = callPackage ../tools/misc/pandoc-imagine { };
 
-  pandoc-include = python3Packages.callPackage ../tools/misc/pandoc-include { };
+  pandoc-include = callPackage ../tools/misc/pandoc-include { };
 
-  pandoc-drawio-filter = python3Packages.callPackage ../tools/misc/pandoc-drawio-filter { };
+  pandoc-drawio-filter = callPackage ../tools/misc/pandoc-drawio-filter { };
 
-  pandoc-plantuml-filter = python3Packages.callPackage ../tools/misc/pandoc-plantuml-filter { };
+  pandoc-plantuml-filter = callPackage ../tools/misc/pandoc-plantuml-filter { };
 
-  # pandoc-*nos is a filter suite, where pandoc-xnos has all functionality and the others are used for only specific functionality
-  pandoc-eqnos = python3Packages.callPackage ../tools/misc/pandoc-eqnos { };
-  pandoc-fignos = python3Packages.callPackage ../tools/misc/pandoc-fignos { };
-  pandoc-secnos = python3Packages.callPackage ../tools/misc/pandoc-secnos { };
-  pandoc-tablenos = python3Packages.callPackage ../tools/misc/pandoc-tablenos { };
+  pandoc-eqnos = callPackage ../tools/misc/pandoc-eqnos { };
+  pandoc-fignos = callPackage ../tools/misc/pandoc-fignos { };
+  pandoc-secnos = callPackage ../tools/misc/pandoc-secnos { };
+  pandoc-tablenos = callPackage ../tools/misc/pandoc-tablenos { };
 
   pgbadger = perlPackages.callPackage ../tools/misc/pgbadger { };
 
@@ -2874,7 +2871,7 @@ with pkgs;
     inherit (llvmPackages) stdenv;
   };
 
-  namespaced-openvpn = python3Packages.callPackage ../tools/networking/namespaced-openvpn { };
+  namespaced-openvpn = callPackage ../tools/networking/namespaced-openvpn { };
 
   update-dotdee = with python3Packages; toPythonApplication update-dotdee;
 
@@ -2933,7 +2930,7 @@ with pkgs;
     polkitSupport = true;
   };
 
-  pdd = python3Packages.callPackage ../tools/misc/pdd { };
+  pdd = callPackage ../tools/misc/pdd { };
 
   pdfminer = with python3Packages; toPythonApplication pdfminer-six;
 
@@ -3041,7 +3038,7 @@ with pkgs;
 
   recoll-nox = recoll.override { withGui = false; };
 
-  remote-exec = python3Packages.callPackage ../tools/misc/remote-exec { };
+  remote-exec = callPackage ../tools/misc/remote-exec { };
 
   reptor = with python3.pkgs; toPythonApplication reptor;
 
@@ -3067,7 +3064,7 @@ with pkgs;
 
   ruby-lsp = rubyPackages.ruby-lsp;
 
-  s3cmd = python3Packages.callPackage ../tools/networking/s3cmd { };
+  s3cmd = callPackage ../tools/networking/s3cmd { };
 
   s3-credentials = with python3Packages; toPythonApplication s3-credentials;
 
@@ -3117,9 +3114,7 @@ with pkgs;
 
   strip-nondeterminism = perlPackages.strip-nondeterminism;
 
-  sumorobot-manager =
-    python3Packages.callPackage ../applications/science/robotics/sumorobot-manager
-      { };
+  sumorobot-manager = callPackage ../applications/science/robotics/sumorobot-manager { };
 
   sslscan = callPackage ../tools/security/sslscan {
     openssl = openssl.override { withZlib = true; };
@@ -3209,12 +3204,12 @@ with pkgs;
   vimpager = callPackage ../tools/misc/vimpager { };
   vimpager-latest = callPackage ../tools/misc/vimpager/latest.nix { };
 
-  vimwiki-markdown = python3Packages.callPackage ../tools/misc/vimwiki-markdown { };
+  vimwiki-markdown = callPackage ../tools/misc/vimwiki-markdown { };
 
   voxtype-vulkan = callPackage ../by-name/vo/voxtype/package.nix { vulkanSupport = true; };
   voxtype-onnx = callPackage ../by-name/vo/voxtype/package.nix { onnxSupport = true; };
 
-  vpn-slice = python3Packages.callPackage ../tools/networking/vpn-slice { };
+  vpn-slice = callPackage ../tools/networking/vpn-slice { };
 
   openconnectPackages = callPackage ../tools/networking/openconnect { };
 
@@ -5043,7 +5038,7 @@ with pkgs;
 
   ansible-builder = with python3Packages; toPythonApplication ansible-builder;
 
-  yakut = python3Packages.callPackage ../development/tools/misc/yakut { };
+  yakut = callPackage ../development/tools/misc/yakut { };
 
   ### DEVELOPMENT / TOOLS / LANGUAGE-SERVERS
 
@@ -5075,7 +5070,7 @@ with pkgs;
 
   apacheKafka = apacheKafka_4_2;
 
-  asn2quickder = python3Packages.callPackage ../development/tools/asn2quickder { };
+  asn2quickder = callPackage ../development/tools/asn2quickder { };
 
   libastyle = astyle.override { asLibrary = true; };
 
@@ -5350,7 +5345,7 @@ with pkgs;
 
   css-html-js-minify = with python3Packages; toPythonApplication css-html-js-minify;
 
-  cvise = python3Packages.callPackage ../development/tools/misc/cvise {
+  cvise = callPackage ../development/tools/misc/cvise {
     # cvise needs a port to latest llvm-21:
     #   https://github.com/marxin/cvise/issues/340
     inherit (llvmPackages_20) llvm libclang;
@@ -5427,7 +5422,7 @@ with pkgs;
     haskellPackages.callPackage ../tools/misc/fffuu { }
   );
 
-  gdbgui = python3Packages.callPackage ../development/tools/misc/gdbgui { };
+  gdbgui = callPackage ../development/tools/misc/gdbgui { };
 
   flex_2_5_35 = callPackage ../development/tools/parsing/flex/2.5.35.nix { };
   flex = callPackage ../development/tools/parsing/flex { };
@@ -5488,7 +5483,7 @@ with pkgs;
   maven3 = maven;
   inherit (maven) buildMaven;
 
-  mavproxy = python3Packages.callPackage ../applications/science/robotics/mavproxy { };
+  mavproxy = callPackage ../applications/science/robotics/mavproxy { };
 
   python-matter-server =
     with python3Packages;
@@ -8056,7 +8051,7 @@ with pkgs;
   };
   busybox-sandbox-shell = callPackage ../os-specific/linux/busybox/sandbox-shell.nix { };
 
-  cm-rgb = python3Packages.callPackage ../tools/system/cm-rgb { };
+  cm-rgb = callPackage ../tools/system/cm-rgb { };
 
   conky = callPackage ../os-specific/linux/conky (
     {
@@ -8066,9 +8061,7 @@ with pkgs;
     // config.conky or { }
   );
 
-  cpupower-gui = python3Packages.callPackage ../os-specific/linux/cpupower-gui {
-    inherit (pkgs) meson;
-  };
+  cpupower-gui = callPackage ../os-specific/linux/cpupower-gui { };
 
   # Darwin package set
   #
@@ -8869,7 +8862,7 @@ with pkgs;
 
   drawterm-wayland = callPackage ../by-name/dr/drawterm/package.nix { withWayland = true; };
 
-  droopy = python3Packages.callPackage ../applications/networking/droopy { };
+  droopy = callPackage ../applications/networking/droopy { };
 
   evilwm = callPackage ../applications/window-managers/evilwm {
     patches = config.evilwm.patches or [ ];
@@ -9186,7 +9179,7 @@ with pkgs;
     ocamlPackages = ocaml-ng.ocamlPackages_4_14;
   };
 
-  pass2csv = python3Packages.callPackage ../tools/security/pass2csv { };
+  pass2csv = callPackage ../tools/security/pass2csv { };
 
   pinboard = with python3Packages; toPythonApplication pinboard;
 
@@ -9376,9 +9369,7 @@ with pkgs;
     shelfMultiBand = callPackage ../applications/audio/magnetophonDSP/shelfMultiBand { };
   };
 
-  matrix-commander =
-    python3Packages.callPackage ../applications/networking/instant-messengers/matrix-commander
-      { };
+  matrix-commander = callPackage ../applications/networking/instant-messengers/matrix-commander { };
 
   mediaelch-qt5 = callPackage ../by-name/me/mediaelch/package.nix { qtVersion = 5; };
   mediaelch-qt6 = mediaelch;
@@ -9441,7 +9432,7 @@ with pkgs;
 
   mpvScripts = callPackage ../by-name/mp/mpv/scripts.nix { };
 
-  mu-repo = python3Packages.callPackage ../applications/misc/mu-repo { };
+  mu-repo = callPackage ../applications/misc/mu-repo { };
 
   murmur =
     (callPackages ../applications/networking/mumble {
@@ -9581,7 +9572,7 @@ with pkgs;
 
   inherit (pidginPackages) pidgin;
 
-  plex-mpv-shim = python3Packages.callPackage ../applications/video/plex-mpv-shim { };
+  plex-mpv-shim = callPackage ../applications/video/plex-mpv-shim { };
 
   # perhaps there are better apps for this task? It's how I had configured my previous system.
   # And I don't want to rewrite all rules
@@ -9669,7 +9660,7 @@ with pkgs;
     withXineBackend = true;
   };
 
-  rednotebook = python3Packages.callPackage ../applications/editors/rednotebook { };
+  rednotebook = callPackage ../applications/editors/rednotebook { };
 
   ringboard-wayland = callPackage ../by-name/ri/ringboard/package.nix { displayServer = "wayland"; };
 
@@ -10189,7 +10180,7 @@ with pkgs;
 
   ydiff = with python3.pkgs; toPythonApplication ydiff;
 
-  yokadi = python3Packages.callPackage ../applications/misc/yokadi { };
+  yokadi = callPackage ../applications/misc/yokadi { };
 
   your-editor = callPackage ../applications/editors/your-editor { stdenv = gccStdenv; };
 
@@ -11339,7 +11330,7 @@ with pkgs;
     hasktags = haskellPackages.hasktags;
   };
 
-  termpdfpy = python3Packages.callPackage ../applications/misc/termpdf.py { };
+  termpdfpy = callPackage ../applications/misc/termpdf.py { };
 
   inherit (callPackage ../applications/networking/cluster/terraform { })
     mkTerraform
@@ -11451,7 +11442,7 @@ with pkgs;
 
   torcs-without-data = callPackage ../by-name/to/torcs/without-data.nix { };
 
-  nitrokey-app2 = python3Packages.callPackage ../tools/security/nitrokey-app2 { };
+  nitrokey-app2 = callPackage ../tools/security/nitrokey-app2 { };
 
   hy = with python3Packages; toPythonApplication hy;
 
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index e6481e26e4fd..984026690e5e 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -8901,6 +8901,8 @@ self: super: with self; {
 
   libmambapy = callPackage ../development/python-modules/libmambapy { };
 
+  libmobility = callPackage ../development/python-modules/libmobility { };
+
   libmodulemd = lib.pipe pkgs.libmodulemd [
     toPythonModule
     (
@@ -15921,6 +15923,8 @@ self: super: with self; {
 
   python-duco-client = callPackage ../development/python-modules/python-duco-client { };
 
+  python-duco-connectivity = callPackage ../development/python-modules/python-duco-connectivity { };
+
   python-ecobee-api = callPackage ../development/python-modules/python-ecobee-api { };
 
   python-editor = callPackage ../development/python-modules/python-editor { };