diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ff8ee5068117..8cc2e8e19630 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -67,7 +67,7 @@ jobs:
           # Sandbox is disabled on MacOS by default.
           extra_nix_config: sandbox = true
 
-      - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
+      - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
         continue-on-error: true
         with:
           # The nixpkgs-gha cache should not be trusted or used outside of Nixpkgs and its forks' CI.
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 5162580ed80b..e6125fb557ea 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -87,7 +87,7 @@ jobs:
 
       - uses: cachix/install-nix-action@1ca7d21a94afc7c957383a2d217460d980de4934 # v31.10.1
 
-      - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
+      - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
         continue-on-error: true
         with:
           # The nixpkgs-gha cache should not be trusted or used outside of Nixpkgs and its forks' CI.
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index 4db9079e186f..255ac58a86f8 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -182,7 +182,7 @@ jobs:
       - name: Install Nix
         uses: cachix/install-nix-action@1ca7d21a94afc7c957383a2d217460d980de4934 # v31.10.1
 
-      - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
+      - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
         continue-on-error: true
         with:
           # The nixpkgs-gha cache should not be trusted or used outside of Nixpkgs and its forks' CI.
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 860e4538b484..0cd358a17730 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -72,7 +72,7 @@ jobs:
 
       - uses: cachix/install-nix-action@1ca7d21a94afc7c957383a2d217460d980de4934 # v31.10.1
 
-      - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
+      - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
         continue-on-error: true
         with:
           # The nixpkgs-gha cache should not be trusted or used outside of Nixpkgs and its forks' CI.
@@ -102,7 +102,7 @@ jobs:
 
       - uses: cachix/install-nix-action@1ca7d21a94afc7c957383a2d217460d980de4934 # v31.10.1
 
-      - uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16
+      - uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c # v17
         continue-on-error: true
         with:
           # The nixpkgs-gha cache should not be trusted or used outside of Nixpkgs and its forks' CI.
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 4b13f7911470..fca8333325bf 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -15063,6 +15063,12 @@
     githubId = 31388299;
     name = "Leonardo Eugênio";
   };
+  lenianiva = {
+    name = "Leni Aniva";
+    email = "aniva@stanford.edu";
+    github = "lenianiva";
+    githubId = 107011294;
+  };
   lenivaya = {
     name = "Danylo Osipchuk";
     email = "danylo.osipchuk@proton.me";
diff --git a/nixos/modules/services/web-apps/dawarich.nix b/nixos/modules/services/web-apps/dawarich.nix
index 9d2d83242fc1..aa6d82eb83f1 100644
--- a/nixos/modules/services/web-apps/dawarich.nix
+++ b/nixos/modules/services/web-apps/dawarich.nix
@@ -701,6 +701,7 @@ in
 
   meta.maintainers = with lib.maintainers; [
     diogotcorreia
+    tmarkus
   ];
 
 }
diff --git a/nixos/modules/services/web-apps/olivetin.nix b/nixos/modules/services/web-apps/olivetin.nix
index 718c732e3c5a..2709fbb885ba 100644
--- a/nixos/modules/services/web-apps/olivetin.nix
+++ b/nixos/modules/services/web-apps/olivetin.nix
@@ -17,7 +17,17 @@ in
   options.services.olivetin = {
     enable = lib.mkEnableOption "OliveTin";
 
-    package = lib.mkPackageOption pkgs "olivetin" { };
+    package = lib.mkOption {
+      type = lib.types.package;
+      description = "The olivetin package to use.";
+      default =
+        if lib.versionAtLeast config.system.stateVersion "26.05" then pkgs.olivetin-3k else pkgs.olivetin;
+      defaultText = lib.literalExpression ''
+        if lib.versionAtLeast config.system.stateVersion "26.05"
+        then pkgs.olivetin-3k
+        else pkgs.olivetin
+      '';
+    };
 
     user = lib.mkOption {
       type = lib.types.str;
diff --git a/nixos/tests/olivetin.nix b/nixos/tests/olivetin.nix
index f9d9e98610ef..552ff24ff282 100644
--- a/nixos/tests/olivetin.nix
+++ b/nixos/tests/olivetin.nix
@@ -1,4 +1,4 @@
-{ lib, ... }:
+{ config, lib, ... }:
 
 {
   name = "olivetin";
@@ -41,16 +41,26 @@
 
   testScript = ''
     import json
+    import shlex
 
     machine.wait_for_unit("olivetin.service")
     machine.wait_for_open_port(8000)
 
-    response = json.loads(machine.succeed("curl http://localhost:8000/api/StartActionByGetAndWait/hello_world"))
+    def start_action(action):
+      if "${config.nodes.machine.services.olivetin.package.releaseSeries}" == "2k":
+        cmd = f"curl http://localhost:8000/api/StartActionByGetAndWait/{action}"
+      else:
+        req = {"actionId": action}
+        cmd = f"curl -H 'Content-Type: application/json' http://localhost:8000/api/olivetin.api.v1.OliveTinApiService/StartActionAndWait -d {shlex.quote(json.dumps(req))}"
+
+      return json.loads(machine.succeed(cmd))
+
+    response = start_action("hello_world")
     assert response["logEntry"]["exitCode"] == 0
     assert response["logEntry"]["output"] == "Hello World!"
     assert machine.succeed("cat /tmp/result") == "Hello World!"
 
-    response = json.loads(machine.succeed("curl http://localhost:8000/api/StartActionByGetAndWait/secret"))
+    response = start_action("secret")
     assert response["logEntry"]["exitCode"] == 0
     assert machine.succeed("cat /tmp/result2") == "secret"
   '';
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/blink-cmp/0001-pin-frizbee-0.6.0.patch b/pkgs/applications/editors/vim/plugins/non-generated/blink-cmp/0001-pin-frizbee-0.6.0.patch
deleted file mode 100644
index cc7defc93d90..000000000000
--- a/pkgs/applications/editors/vim/plugins/non-generated/blink-cmp/0001-pin-frizbee-0.6.0.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
-index 35bb10e..71c79eb 100644
---- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -144,9 +144,9 @@ checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
-
- [[package]]
- name = "frizbee"
--version = "0.7.0"
-+version = "0.6.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "4d024031f1a5bc5f19917baa0b618f1067610e35ba23e9f105653fcb27e74f5c"
-+checksum = "c3365720de81dac18e889afa72f5907aa061c975548da68e2400c056ebc94aec"
- dependencies = [
-  "multiversion",
-  "rayon",
-diff --git a/Cargo.toml b/Cargo.toml
-index 392d1bb..c776c7d 100644
---- a/Cargo.toml
-+++ b/Cargo.toml
-@@ -9,7 +9,7 @@ crate-type = ["cdylib"]
-
- [dependencies]
- regex = "1.11.2"
--frizbee = "0.7.0"
-+frizbee = "0.6.0"
- mlua = { version = "0.11.3", features = ["module", "luajit"] }
- thiserror = "2.0.16"
- blake3 = "1.8.2"
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/blink-cmp/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/blink-cmp/default.nix
index 245470f302e3..071e37831d9f 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/blink-cmp/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/blink-cmp/default.nix
@@ -8,24 +8,18 @@
   gitMinimal,
 }:
 let
-  version = "1.9.1";
+  version = "1.10.1";
   src = fetchFromGitHub {
     owner = "Saghen";
     repo = "blink.cmp";
     tag = "v${version}";
-    hash = "sha256-GgodXdWpQoF2z1g1/WvnSpfuhskw0aMcOoyZM5l66q8=";
+    hash = "sha256-y8f+bmPkb3M6DzcUkJMxd2woDLoBYslne7aB8A0ejCk=";
   };
   blink-fuzzy-lib = rustPlatform.buildRustPackage {
     inherit version src;
     pname = "blink-fuzzy-lib";
 
-    cargoHash = "sha256-Qdt8O7IGj2HySb1jxsv3m33ZxJg96Ckw26oTEEyQjfs=";
-
-    # NOTE: The only change in frizbee 0.7.0 was nixpkgs incompatible rust semantic changes
-    # Patch just reverts https://github.com/saghen/blink.cmp/commit/cc824ec85b789a54d05241389993c6ab8c040810
-    cargoPatches = [
-      ./0001-pin-frizbee-0.6.0.patch
-    ];
+    cargoHash = "sha256-3o2n4xwNF9Fc3VlPKf3lnvmN7FVus5jQB8gcXXwz50c=";
 
     nativeBuildInputs = [ gitMinimal ];
 
diff --git a/pkgs/by-name/ac/actool/package.nix b/pkgs/by-name/ac/actool/package.nix
new file mode 100644
index 000000000000..ad7511d763b9
--- /dev/null
+++ b/pkgs/by-name/ac/actool/package.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+  icu,
+}:
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "actool";
+  version = "1.3.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "viraptor";
+    repo = "actool";
+    tag = finalAttrs.version;
+    hash = "sha256-8v2P6Z1ZOP65M30+7dTtfXvD0dvaKYSLA9aaP2uzA7E=";
+  };
+
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  dependencies = with python3Packages; [
+    pillow
+    liblzfse
+    icu
+  ];
+
+  meta = {
+    description = "Apple's actool reimplementation";
+    homepage = "https://github.com/viraptor/actool";
+    license = [ lib.licenses.mit ];
+    mainProgram = "actool";
+    maintainers = [ lib.maintainers.viraptor ];
+  };
+})
diff --git a/pkgs/by-name/aw/awsebcli/package.nix b/pkgs/by-name/aw/awsebcli/package.nix
index e1c6596b0b40..0ba14c745934 100644
--- a/pkgs/by-name/aw/awsebcli/package.nix
+++ b/pkgs/by-name/aw/awsebcli/package.nix
@@ -26,7 +26,7 @@ in
 
 python.pkgs.buildPythonApplication rec {
   pname = "awsebcli";
-  version = "3.26";
+  version = "3.27";
   pyproject = true;
   doInstallCheck = true;
 
@@ -34,7 +34,7 @@ python.pkgs.buildPythonApplication rec {
     owner = "aws";
     repo = "aws-elastic-beanstalk-cli";
     tag = version;
-    hash = "sha256-HiVRlXND1ErZhmQow+VV4HkY4Auhbcq1afR1Lf8ITPI=";
+    hash = "sha256-bqGed3LCOAG5+bSwdaenxM3HtNXI6iRq191XS5Aau8c=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/az/azurehound/package.nix b/pkgs/by-name/az/azurehound/package.nix
index 24a24b4dca2a..c21c58408c3c 100644
--- a/pkgs/by-name/az/azurehound/package.nix
+++ b/pkgs/by-name/az/azurehound/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "azurehound";
-  version = "2.10.0";
+  version = "2.11.0";
 
   src = fetchFromGitHub {
     owner = "SpecterOps";
     repo = "AzureHound";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hvSnm7+xyar7E1yf2Fi6JlYU8dlgO3M+Z510VBYgHIA=";
+    hash = "sha256-HelzDMnQOZP8LBcF5eoQfgTOk6fBK5oCx+gu4v638JA=";
   };
 
-  vendorHash = "sha256-+iNFWKFNON4HX2mf4O29zAdElEkIGIx55Wi9MRtg1dg=";
+  vendorHash = "sha256-QCZFIDUL/RbSMrDfQ8L0A6xJPcWJorBXvHhdIA1WK4Q=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 
diff --git a/pkgs/by-name/br/bruno/package.nix b/pkgs/by-name/br/bruno/package.nix
index 429d211c2cba..570c8693a478 100644
--- a/pkgs/by-name/br/bruno/package.nix
+++ b/pkgs/by-name/br/bruno/package.nix
@@ -21,13 +21,13 @@
 
 buildNpmPackage rec {
   pname = "bruno";
-  version = "3.1.4";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "usebruno";
     repo = "bruno";
     tag = "v${version}";
-    hash = "sha256-BKrDJc0koOPHno+VOgfsUvvImJuKEkWdZvmCVffSRX8=";
+    hash = "sha256-lDsgAOCUrxhmlmYgObDwUR6gbms/q/rNIkTEwJckMyA=";
 
     postFetch = ''
       ${lib.getExe npm-lockfile-fix} $out/package-lock.json
@@ -36,7 +36,7 @@ buildNpmPackage rec {
 
   nodejs = nodejs_22;
 
-  npmDepsHash = "sha256-XJsQFyi448yoRM8pUvaNpGDIZ41q0vpwYTgJufBBu1g=";
+  npmDepsHash = "sha256-vz2I+0+eQk6A4SsiACipTGrYF8LtvWfGhgxqu7mChLE=";
   npmFlags = [ "--legacy-peer-deps" ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ch/chirp/package.nix b/pkgs/by-name/ch/chirp/package.nix
index 83656454bfef..67c08d96d3ac 100644
--- a/pkgs/by-name/ch/chirp/package.nix
+++ b/pkgs/by-name/ch/chirp/package.nix
@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication {
   pname = "chirp";
-  version = "0.4.0-unstable-2026-03-11";
+  version = "0.4.0-unstable-2026-03-19";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kk7ds";
     repo = "chirp";
-    rev = "74e1075fd884d30837e78fc3212984a508c124a3";
-    hash = "sha256-Z2z2p0It13JFAFQAa4BDICeF4P9JfMneO4fLKioa1yg=";
+    rev = "d5dbf01d39fafe7df6f29c61f21cbf7be72f2ce7";
+    hash = "sha256-fb824XkNzvOfICVBBE2YLA2G+eGqHL5HT2iaA9ptlF4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/da/dawarich/gemset.nix b/pkgs/by-name/da/dawarich/gemset.nix
index d0fe707b3d25..5189d9a17866 100644
--- a/pkgs/by-name/da/dawarich/gemset.nix
+++ b/pkgs/by-name/da/dawarich/gemset.nix
@@ -663,10 +663,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "19yf280vw91ji4prrbk17qy336l1y1jqvwsnhf3fc7yscim431sj";
+      sha256 = "1ya5gbz8p4qm1h4p33b99zfna4n5flmccvwp5air4086j4sv5bzy";
       type = "gem";
     };
-    version = "2.0.6";
+    version = "3.0.0";
   };
   date = {
     groups = [
@@ -935,10 +935,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1ka175ci0q9ylpcy651pjj580diplkaskycn4n7jcmbyv7jwz6c6";
+      sha256 = "077n5ss3z3ds4vj54w201kd12smai853dp9c9n7ii7g3q7nwwg54";
       type = "gem";
     };
-    version = "2.14.0";
+    version = "2.14.1";
   };
   faraday-follow_redirects = {
     dependencies = [ "faraday" ];
@@ -957,10 +957,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0fxbckg468dabkkznv48ss8zv14d9cd8mh1rr3m98aw7wzx5fmq9";
+      sha256 = "0v4hfmc7d4lrqqj2wl366rm9551gd08zkv2ppwwnjlnkc217aizi";
       type = "gem";
     };
-    version = "3.4.1";
+    version = "3.4.2";
   };
   ffaker = {
     groups = [
@@ -1228,10 +1228,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "01fmiz052cvnxgdnhb3qwcy88xbv7l3liz0fkvs5qgqqwjp0c1di";
+      sha256 = "0b888h9v2y4aasi9aapxqimiaj1i1csk56l22dczigs8kv2zv56x";
       type = "gem";
     };
-    version = "2.18.0";
+    version = "2.19.1";
   };
   json-jwt = {
     dependencies = [
@@ -1488,7 +1488,10 @@
     version = "2.8.9";
   };
   minitest = {
-    dependencies = [ "prism" ];
+    dependencies = [
+      "drb"
+      "prism"
+    ];
     groups = [
       "default"
       "development"
@@ -1498,10 +1501,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1fslin1vyh60snwygx8jnaj4kwhk83f3m0v2j2b7bsg2917wfm3q";
+      sha256 = "0gdwmn2d4sznjdxyl3kz7hr95mvdgm38fk1vd0s63k3fdyamfvnv";
       type = "gem";
     };
-    version = "6.0.1";
+    version = "6.0.2";
   };
   msgpack = {
     groups = [ "default" ];
@@ -1529,10 +1532,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0wyzwvch1a4c77g5zjwjhgf9z5inzngq42b197dm9qzqjb8dqjld";
+      sha256 = "0nnzdswa9l6w8k5ndgbv5al9f0jkg14dqwzyic4fjd5c1cls1nxd";
       type = "gem";
     };
-    version = "0.8.0";
+    version = "0.8.1";
   };
   net-http = {
     dependencies = [ "uri" ];
@@ -1540,10 +1543,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1ysrwaabhf0sn24jrp0nnp51cdv0jf688mh5i6fsz63q2c6b48cn";
+      sha256 = "15k96fj6qwbaiv6g52l538ass95ds1qwgynqdridz29yqrkhpfi5";
       type = "gem";
     };
-    version = "0.6.0";
+    version = "0.9.1";
   };
   net-imap = {
     dependencies = [
@@ -1635,10 +1638,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0dcqwwlm8afr97mg1i633yia3hzd61f0j5csrspzsvf0mfp85qf4";
+      sha256 = "11rj80dgjz05x5xx93y4bfk9rcn7fl56srj8fgqn7ffzf3j13kxs";
       type = "gem";
     };
-    version = "2.0.17";
+    version = "2.0.18";
   };
   oj = {
     dependencies = [
@@ -1695,10 +1698,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1pdf3bx036l6ggz6lkkykv77m9k4jypwsiw1q7874czwh2v50768";
+      sha256 = "04dyy57rlgvrv69pq2pm4rsj658zbaqjy2a6i29qy10w4b8g7hvl";
       type = "gem";
     };
-    version = "1.2.1";
+    version = "1.2.2";
   };
   omniauth-oauth2 = {
     dependencies = [
@@ -1709,10 +1712,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0y4y122xm8zgrxn5nnzwg6w39dnjss8pcq2ppbpx9qn7kiayky5j";
+      sha256 = "1s7yagqmzzqcr5l1rrb4bdjf7g2k2jf5pk0lw5y81489sbczc5gd";
       type = "gem";
     };
-    version = "1.8.0";
+    version = "1.9.0";
   };
   omniauth-rails_csrf_protection = {
     dependencies = [
@@ -2111,10 +2114,21 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1xmnrk076sqymilydqgyzhkma3hgqhcv8xhy7ks479l2a3vvcx2x";
+      sha256 = "1lyn3rh71rlf50p44xmsbha0pip4c95004j8kc9pm7xpq1s0kgac";
       type = "gem";
     };
-    version = "3.2.4";
+    version = "3.2.5";
+  };
+  rack-attack = {
+    dependencies = [ "rack" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1wpcxspprm187k6mch9fxhaaq1a3s9bzybd2fdaw1g45pzg9yjgj";
+      type = "gem";
+    };
+    version = "6.8.0";
   };
   rack-oauth2 = {
     dependencies = [
@@ -3127,10 +3141,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1nqf9rg974k4bjji7aggalg8pfvbkd9hys4hv5y450jb21qgkxph";
+      sha256 = "1bz11pq7n1g51f50jqmgyf5b1v64p1pfqmy5l21y6vpr37b2lwkd";
       type = "gem";
     };
-    version = "0.4.4";
+    version = "0.6.0";
   };
   tsort = {
     groups = [
diff --git a/pkgs/by-name/da/dawarich/package.nix b/pkgs/by-name/da/dawarich/package.nix
index c2b9b425f16d..14e673531ebb 100644
--- a/pkgs/by-name/da/dawarich/package.nix
+++ b/pkgs/by-name/da/dawarich/package.nix
@@ -138,6 +138,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.agpl3Only;
     maintainers = with lib.maintainers; [
       diogotcorreia
+      tmarkus
     ];
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/by-name/da/dawarich/sources.json b/pkgs/by-name/da/dawarich/sources.json
index 88268ba1d56b..3600c6d9a40a 100644
--- a/pkgs/by-name/da/dawarich/sources.json
+++ b/pkgs/by-name/da/dawarich/sources.json
@@ -1,5 +1,5 @@
 {
-  "version": "1.3.1",
-  "hash": "sha256-ziOp6R00uaWdv7KHHPe+2H5bX5fRtHmwhfoiQSSqEn4=",
+  "version": "1.3.4",
+  "hash": "sha256-PfSII/8rsQX+exBa5xcQc9f7zIh7IGHSJaQCu+yTKzw=",
   "npmHash": "sha256-Y6tEaApfGXAtmy0W85+4qGbrEkUkrKXTssl7wXeVnQY="
 }
diff --git a/pkgs/by-name/en/en-croissant/package.nix b/pkgs/by-name/en/en-croissant/package.nix
index e50cb07a5c75..734b88abc458 100644
--- a/pkgs/by-name/en/en-croissant/package.nix
+++ b/pkgs/by-name/en/en-croissant/package.nix
@@ -27,13 +27,13 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "en-croissant";
-  version = "0.14.2";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "franciscoBSalgueiro";
     repo = "en-croissant";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iihAanR0kYkniO3NeWleYz3QyszeJKiJoFLHH+712d8=";
+    hash = "sha256-xP/u3EABj11bylZKDpvBsuUF6QRmtArQV/pTY+0ANb0=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -44,7 +44,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       ;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-Y452U+Y0deicZjOyoDiJqEICdFrWsg4LF8p4jSmPa84=";
+    hash = "sha256-icJ5cU0ZNnYSZl+MPASNmGanc9Vaa61sotza8/G/xs4=";
   };
 
   postPatch = ''
@@ -58,7 +58,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoRoot = "src-tauri";
 
-  cargoHash = "sha256-5TDG5HT0zxu4UuGqfFGhw1HUkuu3gbBtiKKgU92TM8k=";
+  cargoHash = "sha256-/L3URUdUIVrWHlXgRJfmDfFfOKGz9slDe49iE5nPw5k=";
 
   buildAndTestSubdir = finalAttrs.cargoRoot;
 
diff --git a/pkgs/by-name/fa/faust2/package.nix b/pkgs/by-name/fa/faust2/package.nix
index 25a359d0e913..60296db0ac76 100644
--- a/pkgs/by-name/fa/faust2/package.nix
+++ b/pkgs/by-name/fa/faust2/package.nix
@@ -24,13 +24,13 @@
 
 let
 
-  version = "2.83.1";
+  version = "2.85.5";
 
   src = fetchFromGitHub {
     owner = "grame-cncm";
     repo = "faust";
     tag = version;
-    hash = "sha256-DojqKLoGb6aGpqpeTAXyLFsbWs/UgYr9nA+JMGa712A=";
+    hash = "sha256-QKCyOiYGLh67lS0WS+LCCl/edhl/A+zccCWyWRTV1vM=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/fi/firefox_decrypt/package.nix b/pkgs/by-name/fi/firefox_decrypt/package.nix
index 12c46382888d..74b6c316de6c 100644
--- a/pkgs/by-name/fi/firefox_decrypt/package.nix
+++ b/pkgs/by-name/fi/firefox_decrypt/package.nix
@@ -1,7 +1,7 @@
 {
   lib,
   fetchFromGitHub,
-  nss,
+  nss_latest,
   nixosTests,
   nix-update-script,
   stdenv,
@@ -30,16 +30,16 @@ python3Packages.buildPythonApplication (finalAttrs: {
     "--prefix"
     (if stdenv.hostPlatform.isDarwin then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH")
     ":"
-    (lib.makeLibraryPath [ nss ])
+    (lib.makeLibraryPath [ nss_latest ])
   ];
 
   checkPhase = ''
     runHook preCheck
 
     patchShebangs tests
-    (cd tests && ${
-      if stdenv.hostPlatform.isDarwin then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH"
-    }=${lib.makeLibraryPath [ nss ]} ./run_all)
+    (cd tests && ${if stdenv.hostPlatform.isDarwin then "DYLD_LIBRARY_PATH" else "LD_LIBRARY_PATH"}=${
+      lib.makeLibraryPath [ nss_latest ]
+    } ./run_all)
 
     runHook postCheck
   '';
diff --git a/pkgs/by-name/gd/gdu/package.nix b/pkgs/by-name/gd/gdu/package.nix
index 761ac7cfd41e..ef297948495b 100644
--- a/pkgs/by-name/gd/gdu/package.nix
+++ b/pkgs/by-name/gd/gdu/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "gdu";
-  version = "5.34.0";
+  version = "5.34.1";
 
   src = fetchFromGitHub {
     owner = "dundee";
     repo = "gdu";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-y3a43CLn76Aq/jCPhrurbZk3wTQOg3t5FmObbTUOidQ=";
+    hash = "sha256-u/71Zt5LRt0pHiGyuiE57OYdjA9wtliRI+2rLjFzchg=";
   };
 
   vendorHash = "sha256-Dtjirx2sHbN4AWxED5weRGtCRNc2VIdaz7RHssGuJeQ=";
diff --git a/pkgs/by-name/ho/homebank/package.nix b/pkgs/by-name/ho/homebank/package.nix
index e91edb61e306..83f62f87bbe9 100644
--- a/pkgs/by-name/ho/homebank/package.nix
+++ b/pkgs/by-name/ho/homebank/package.nix
@@ -13,10 +13,10 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "homebank";
-  version = "5.9.7";
+  version = "5.10";
   src = fetchurl {
     url = "https://www.gethomebank.org/public/sources/homebank-${finalAttrs.version}.tar.gz";
-    hash = "sha256-K4/fUSQpow7XpFfPWvR2dWwM/dyfznYA2rlcfwO+JuQ=";
+    hash = "sha256-eD/Yuy67oJcT5dfBg9RU9KQ5PoKK9XY/dotIr6vFQ4Y=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/im/imsprog/package.nix b/pkgs/by-name/im/imsprog/package.nix
index 8b7f96fe887c..6ca7e8b661e9 100644
--- a/pkgs/by-name/im/imsprog/package.nix
+++ b/pkgs/by-name/im/imsprog/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imsprog";
-  version = "1.7.3";
+  version = "1.8.2";
 
   src = fetchFromGitHub {
     owner = "bigbigmdm";
     repo = "IMSProg";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+poPHy1q7lWuXgSvpbBpwVzRcXhYR8xjy3cs9nHExJo=";
+    hash = "sha256-VV4qlMd4hj37AIRSMY/EzbJEz3gRLb9Q38ujwQddi0M=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/ir/irpf/package.nix b/pkgs/by-name/ir/irpf/package.nix
index a2d5d9088685..404798b5bb71 100644
--- a/pkgs/by-name/ir/irpf/package.nix
+++ b/pkgs/by-name/ir/irpf/package.nix
@@ -3,7 +3,7 @@
   stdenvNoCC,
   fetchzip,
   copyDesktopItems,
-  jdk11,
+  jdk17,
   makeDesktopItem,
   makeWrapper,
   unzip,
@@ -11,10 +11,16 @@
   imagemagick,
   writeScript,
 }:
+let
+  # The officially recommended version is Java 17
+  java = jdk17;
 
+  # It's not clear yet if this version follows the app version, further updates will probably solve this question
+  pgd-updater-version = "1.0.0";
+in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "irpf";
-  version = "2025-1.7";
+  version = "2026-1.0";
 
   # https://www.gov.br/receitafederal/pt-br/centrais-de-conteudo/download/pgd/dirpf
   # Para outros sistemas operacionais -> Multi
@@ -24,19 +30,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     in
     fetchzip {
       url = "https://downloadirpf.receita.fazenda.gov.br/irpf/${year}/irpf/arquivos/IRPF${finalAttrs.version}.zip";
-      hash = "sha256-VLB/Ni+sZ0Xugh3v7vb4rqTlAZz3eHU33lbljCX3Yic=";
+      hash = "sha256-hePdoDbFPOMjdSzsJqZWyFhHX138bMuocwCNpdOEkKA=";
     };
 
-  passthru.updateScript = writeScript "update-irpf" ''
-    #!/usr/bin/env nix-shell
-    #!nix-shell -i bash -p curl pup common-updater-scripts
-
-    set -eu -o pipefail
-    #parses the html with the install links for the containers that contain the instalation files of type 'file archive, gets the version number of each version, and sorts to get the latest one on the website
-    version="$(curl -s https://www.gov.br/receitafederal/pt-br/centrais-de-conteudo/download/pgd/dirpf | pup '.rfb_container .rfb_ositem:parent-of(.fa-file-archive) attr{href}' | grep -oP "IRPF\K(\d+)-[\d.]+\d" | sort -r |  head -1)"
-    update-source-version irpf "$version"
-  '';
-
   nativeBuildInputs = [
     unzip
     makeWrapper
@@ -63,10 +59,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
     cp --no-preserve=mode -r help lib lib-modulos "$BASEDIR"
 
-    install -Dm644 irpf.jar Leia-me.htm offline.png online.png pgd-updater.jar "$BASEDIR"
+    install -Dm644 irpf.jar Leia-me.htm offline.png online.png pgd-updater-${pgd-updater-version}.jar "$BASEDIR"
 
     # make xdg-open overrideable at runtime
-    makeWrapper ${jdk11}/bin/java $out/bin/irpf \
+    makeWrapper ${lib.getExe java} $out/bin/irpf \
       --add-flags "-Dawt.useSystemAAFontSettings=gasp" \
       --add-flags "-Dswing.aatext=true" \
       --add-flags "-jar $BASEDIR/irpf.jar" \
@@ -78,9 +74,20 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     unzip -jp lib/ppgd-icones-4.0.jar icones/rfb64.png | magick - -background none -gravity center -extent 96x96 $out/share/icons/hicolor/96x96/apps/rfb.png
     unzip -jp lib/ppgd-icones-4.0.jar icones/rfb48.png | magick - -background none -gravity center -extent 72x72 $out/share/icons/hicolor/72x72/apps/rfb.png
     unzip -j lib/ppgd-icones-4.0.jar icones/rfb.png -d $out/share/icons/hicolor/32x32/apps
+
     runHook postInstall
   '';
 
+  passthru.updateScript = writeScript "update-irpf" ''
+    #!/usr/bin/env nix-shell
+    #!nix-shell -i bash -p curl pup common-updater-scripts
+
+    set -eu -o pipefail
+    #parses the html with the install links for the containers that contain the instalation files of type 'file archive, gets the version number of each version, and sorts to get the latest one on the website
+    version="$(curl -s https://www.gov.br/receitafederal/pt-br/centrais-de-conteudo/download/pgd/dirpf | pup '.rfb_container .rfb_ositem:parent-of(.fa-file-archive) attr{href}' | grep -oP "IRPF\K(\d+)-[\d.]+\d" | sort -r |  head -1)"
+    update-source-version irpf "$version"
+  '';
+
   meta = {
     description = "Brazillian government application for reporting income tax";
     longDescription = ''
diff --git a/pkgs/by-name/li/libime/package.nix b/pkgs/by-name/li/libime/package.nix
index b48a8570a40b..2b59381bfbfc 100644
--- a/pkgs/by-name/li/libime/package.nix
+++ b/pkgs/by-name/li/libime/package.nix
@@ -30,13 +30,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "libime";
-  version = "1.1.12";
+  version = "1.1.14";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = "libime";
     tag = finalAttrs.version;
-    hash = "sha256-LqbwXpmqUCbaKHaaE9pOrHb1Qdp20/S3QEf9F4/3oiE=";
+    hash = "sha256-q9OSY1q4MNlFqw6lRMrHO6QT9xP8Czz4b4M0BuIkp34=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/li/libskk/package.nix b/pkgs/by-name/li/libskk/package.nix
index 938024b676be..90fa81c8b875 100644
--- a/pkgs/by-name/li/libskk/package.nix
+++ b/pkgs/by-name/li/libskk/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   libtool,
   gettext,
   pkg-config,
@@ -17,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libskk";
-  version = "1.0.5";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "ueno";
     repo = "libskk";
     tag = finalAttrs.version;
-    hash = "sha256-xXed7mQqseefIldGjNsQf8n0YTcI9L9T1FkO/dhNR3g=";
+    hash = "sha256-Dciz5VeflaX2eYt1B90NpgLKNtCHY/CDabuCx+T/SS0=";
   };
 
   env = {
@@ -32,15 +31,6 @@ stdenv.mkDerivation (finalAttrs: {
     ];
   };
 
-  patches = [
-    # fix parse error in default.json
-    # https://github.com/ueno/libskk/pull/90
-    (fetchpatch {
-      url = "https://github.com/ueno/libskk/commit/2382ebedc8dca88e745d223ad7badb8b73bbb0de.diff";
-      hash = "sha256-e1bKVteNjqmr40XI82Qar63LXPWYIfnUVlo5zQSkPNw=";
-    })
-  ];
-
   buildInputs = [ libxkbcommon ];
   nativeBuildInputs = [
     vala
diff --git a/pkgs/by-name/mo/models-dev/package.nix b/pkgs/by-name/mo/models-dev/package.nix
index 9fd8db5db6a4..17c1b6ba0d9b 100644
--- a/pkgs/by-name/mo/models-dev/package.nix
+++ b/pkgs/by-name/mo/models-dev/package.nix
@@ -9,12 +9,12 @@
 }:
 let
   pname = "models-dev";
-  version = "0-unstable-2026-03-09";
+  version = "0-unstable-2026-03-17";
   src = fetchFromGitHub {
     owner = "anomalyco";
     repo = "models.dev";
-    rev = "a9f79d67946f658af9e92b4ab81aa55b0f862cc4";
-    hash = "sha256-w0Ed092mWKXlMPgaofwn7UxZm9uDP5NzIduSrADVmwc=";
+    rev = "7d3cc61a48f545739f05042b43110ea11147ac03";
+    hash = "sha256-Iyg1IAp3AiqxPqYil/ZhH7dXxkwxW9B3t3LwYMTiRjE=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {
diff --git a/pkgs/by-name/ol/olivetin/3k.nix b/pkgs/by-name/ol/olivetin/3k.nix
new file mode 100644
index 000000000000..fe8023a74651
--- /dev/null
+++ b/pkgs/by-name/ol/olivetin/3k.nix
@@ -0,0 +1,141 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+  stdenvNoCC,
+  writableTmpDirAsHomeHook,
+  buf,
+  protoc-gen-go,
+  protoc-gen-go-grpc,
+  grpc-gateway,
+  buildNpmPackage,
+  installShellFiles,
+  versionCheckHook,
+  nixosTests,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "olivetin";
+  version = "3000.11.3";
+
+  src = fetchFromGitHub {
+    owner = "OliveTin";
+    repo = "OliveTin";
+    tag = finalAttrs.version;
+    hash = "sha256-GSCqtekFj0c2TPSygRiUAfSMQAyPbfuR0dxAGQ/Rghw=";
+  };
+
+  modRoot = "service";
+
+  vendorHash = "sha256-iH9tgw4KSER/xIPOIontSQLWrI4ORayRjyHsT1HU0m8=";
+
+  subPackages = [ "." ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${finalAttrs.version}"
+  ];
+
+  __darwinAllowLocalNetworking = true;
+
+  gen = stdenvNoCC.mkDerivation {
+    pname = "olivetin-gen";
+    inherit (finalAttrs) version src;
+
+    nativeBuildInputs = [
+      writableTmpDirAsHomeHook
+      buf
+      protoc-gen-go
+      protoc-gen-go-grpc
+      grpc-gateway
+    ];
+
+    buildPhase = ''
+      runHook preBuild
+
+      pushd proto
+      buf generate
+      popd
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      cp -r service/gen $out
+
+      runHook postInstall
+    '';
+
+    postFixup = ''
+      find $out -type f -name '*.go' -exec \
+        sed -i -E 's|//.*protoc-gen-go(-grpc)? +v.*$||' {} +
+    '';
+
+    outputHashMode = "recursive";
+    outputHash = "sha256-SaGHxawFw55zI37psqI9kdaR8DLnx4iV2XZdomr28b8=";
+  };
+
+  webui = buildNpmPackage {
+    pname = "olivetin-webui";
+    inherit (finalAttrs) version src;
+
+    npmDepsHash = "sha256-vrvwy96wtXxt0JJDs8YG0Lm3kpVRoJ2Qmu8nlggH6qc=";
+
+    sourceRoot = "${finalAttrs.src.name}/frontend";
+
+    buildPhase = ''
+      runHook preBuild
+
+      make build
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      cp -r dist $out
+
+      runHook postInstall
+    '';
+  };
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  preBuild = ''
+    ln -s ${finalAttrs.gen} gen
+    substituteInPlace internal/config/config.go \
+      --replace-fail 'config.WebUIDir = "./webui"' 'config.WebUIDir = "${finalAttrs.webui}"'
+  '';
+
+  postInstall = ''
+    installManPage ../var/manpage/OliveTin.1.gz
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "-version";
+  doInstallCheck = true;
+
+  passthru = {
+    tests.olivetin = nixosTests.olivetin.extendNixOS {
+      module = {
+        services.olivetin.package = finalAttrs.finalPackage;
+      };
+    };
+    releaseSeries = "3k";
+    updateScript = ./update-3k.sh;
+  };
+
+  meta = {
+    description = "Gives safe and simple access to predefined shell commands from a web interface";
+    homepage = "https://www.olivetin.app/";
+    downloadPage = "https://github.com/OliveTin/OliveTin";
+    changelog = "https://github.com/OliveTin/OliveTin/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ defelo ];
+    mainProgram = "OliveTin";
+  };
+})
diff --git a/pkgs/by-name/ol/olivetin/package.nix b/pkgs/by-name/ol/olivetin/package.nix
index 90b5bb036013..219c7367d106 100644
--- a/pkgs/by-name/ol/olivetin/package.nix
+++ b/pkgs/by-name/ol/olivetin/package.nix
@@ -14,145 +14,142 @@
   nixosTests,
 }:
 
-buildGoModule (
-  finalAttrs:
+buildGoModule (finalAttrs: {
+  pname = "olivetin";
+  version = "2025.11.25";
 
-  let
-    gen = stdenvNoCC.mkDerivation {
-      pname = "olivetin-gen";
-      inherit (finalAttrs) version src;
+  src = fetchFromGitHub {
+    owner = "OliveTin";
+    repo = "OliveTin";
+    tag = finalAttrs.version;
+    hash = "sha256-HQLInEVXowWpDaSW/4bduUMdYsvQ0Rju1Rl2l9jupYA=";
+  };
 
-      nativeBuildInputs = [
-        writableTmpDirAsHomeHook
-        buf
-        protoc-gen-go
-        protoc-gen-go-grpc
-        grpc-gateway
-      ];
+  patches = [ ./update-go-sum.patch ];
 
-      buildPhase = ''
-        runHook preBuild
+  modRoot = "service";
 
-        pushd proto
-        buf generate
-        popd
+  vendorHash = "sha256-xSroaS6fwHrQ0s09uD3bkBZWWxbIndiOGL2JPvKzC6E=";
 
-        runHook postBuild
-      '';
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${finalAttrs.version}"
+  ];
 
-      installPhase = ''
-        runHook preInstall
+  __darwinAllowLocalNetworking = true;
 
-        cp -r service/gen $out
+  gen = stdenvNoCC.mkDerivation {
+    pname = "olivetin-gen";
+    inherit (finalAttrs) version src;
 
-        runHook postInstall
-      '';
-
-      postFixup = ''
-        find $out -type f -name '*.go' -exec \
-          sed -i -E 's|//.*protoc-gen-go(-grpc)? +v.*$||' {} +
-      '';
-
-      outputHashMode = "recursive";
-      outputHash = "sha256-wHqXsSV18mF/CfLQ0S4rGtT3QRcLnneYXAa8nXZaHpQ=";
-    };
-
-    webui = buildNpmPackage {
-      pname = "olivetin-webui";
-      inherit (finalAttrs) version src;
-
-      npmDepsHash = "sha256-a1BBNlGusdMlmDXgclGqkO8AywSd4DTQKkuBVzuzAfE=";
-
-      sourceRoot = "${finalAttrs.src.name}/webui.dev";
-
-      buildPhase = ''
-        runHook preBuild
-
-        npx parcel build --public-url "."
-
-        runHook postBuild
-      '';
-
-      installPhase = ''
-        runHook preInstall
-
-        cp -r dist $out
-        cp -r *.png $out
-
-        runHook postInstall
-      '';
-    };
-  in
-
-  {
-    pname = "olivetin";
-    version = "2025.11.25";
-
-    src = fetchFromGitHub {
-      owner = "OliveTin";
-      repo = "OliveTin";
-      tag = finalAttrs.version;
-      hash = "sha256-HQLInEVXowWpDaSW/4bduUMdYsvQ0Rju1Rl2l9jupYA=";
-    };
-
-    patches = [ ./update-go-sum.patch ];
-
-    modRoot = "service";
-
-    vendorHash = "sha256-xSroaS6fwHrQ0s09uD3bkBZWWxbIndiOGL2JPvKzC6E=";
-
-    ldflags = [
-      "-s"
-      "-w"
-      "-X main.version=${finalAttrs.version}"
+    nativeBuildInputs = [
+      writableTmpDirAsHomeHook
+      buf
+      protoc-gen-go
+      protoc-gen-go-grpc
+      grpc-gateway
     ];
 
-    __darwinAllowLocalNetworking = true;
+    buildPhase = ''
+      runHook preBuild
 
-    nativeBuildInputs = [ installShellFiles ];
+      pushd proto
+      buf generate
+      popd
 
-    preBuild = ''
-      ln -s ${gen} gen
-      substituteInPlace internal/config/config.go \
-        --replace-fail 'config.WebUIDir = "./webui"' 'config.WebUIDir = "${webui}"'
-      substituteInPlace internal/httpservers/webuiServer_test.go \
-        --replace-fail '"../webui/"' '"${webui}"'
+      runHook postBuild
     '';
 
-    postInstall = ''
-      installManPage ../var/manpage/OliveTin.1.gz
+    installPhase = ''
+      runHook preInstall
+
+      cp -r service/gen $out
+
+      runHook postInstall
     '';
 
-    nativeInstallCheckInputs = [ versionCheckHook ];
-    versionCheckProgram = "${placeholder "out"}/bin/OliveTin";
-    versionCheckProgramArg = "-version";
-    doInstallCheck = true;
+    postFixup = ''
+      find $out -type f -name '*.go' -exec \
+        sed -i -E 's|//.*protoc-gen-go(-grpc)? +v.*$||' {} +
+    '';
 
-    passthru = {
-      inherit gen webui;
-      tests = { inherit (nixosTests) olivetin; };
-      updateScript = ./update.sh;
-    };
+    outputHashMode = "recursive";
+    outputHash = "sha256-fTsJE9ymtJ0TU2OhXLE+XfEOckFMG7IPi0IHHAmN84s=";
+  };
 
-    meta = {
-      description = "Gives safe and simple access to predefined shell commands from a web interface";
-      homepage = "https://www.olivetin.app/";
-      downloadPage = "https://github.com/OliveTin/OliveTin";
-      changelog = "https://github.com/OliveTin/OliveTin/releases/tag/${finalAttrs.version}";
-      license = lib.licenses.agpl3Only;
-      maintainers = with lib.maintainers; [ defelo ];
-      mainProgram = "OliveTin";
-      knownVulnerabilities = [
-        "CVE-2026-27626: OS Command Injection via password argument type and webhook JSON extraction bypasses shell safety checks"
-        "CVE-2026-28342: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint"
-        "CVE-2026-28789: Unauthenticated DoS via concurrent map writes in OAuth2 state handling"
-        "CVE-2026-28790: Unauthenticated Action Termination via KillAction When Guests Must Login"
-        "CVE-2026-30223: JWT Audience Validation Bypass in Local Key and HMAC Modes"
-        "CVE-2026-30224: Session Fixation - Logout Fails to Invalidate Server-Side Session"
-        "CVE-2026-30225: RestartAction always runs actions as guest"
-        "CVE-2026-30233: View permission not being checked when returning dashboards"
-        "CVE-2026-31817: Unsafe parsing of UniqueTrackingId can be used to write files"
-      ];
+  webui = buildNpmPackage {
+    pname = "olivetin-webui";
+    inherit (finalAttrs) version src;
+
+    npmDepsHash = "sha256-a1BBNlGusdMlmDXgclGqkO8AywSd4DTQKkuBVzuzAfE=";
+
+    sourceRoot = "${finalAttrs.src.name}/webui.dev";
+
+    buildPhase = ''
+      runHook preBuild
+
+      npx parcel build --public-url "."
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      cp -r dist $out
+      cp -r *.png $out
+
+      runHook postInstall
+    '';
+  };
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  preBuild = ''
+    ln -s ${finalAttrs.gen} gen
+    substituteInPlace internal/config/config.go \
+      --replace-fail 'config.WebUIDir = "./webui"' 'config.WebUIDir = "${finalAttrs.webui}"'
+    substituteInPlace internal/httpservers/webuiServer_test.go \
+      --replace-fail '"../webui/"' '"${finalAttrs.webui}"'
+  '';
+
+  postInstall = ''
+    installManPage ../var/manpage/OliveTin.1.gz
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "-version";
+  doInstallCheck = true;
+
+  passthru = {
+    tests.olivetin = nixosTests.olivetin.extendNixOS {
+      module = {
+        services.olivetin.package = finalAttrs.finalPackage;
+      };
     };
-  }
-)
+    releaseSeries = "2k";
+    updateScript = ./update.sh;
+  };
+
+  meta = {
+    description = "Gives safe and simple access to predefined shell commands from a web interface";
+    homepage = "https://www.olivetin.app/";
+    downloadPage = "https://github.com/OliveTin/OliveTin";
+    changelog = "https://github.com/OliveTin/OliveTin/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ defelo ];
+    mainProgram = "OliveTin";
+    knownVulnerabilities = [
+      "CVE-2026-27626: OS Command Injection via password argument type and webhook JSON extraction bypasses shell safety checks"
+      "CVE-2026-28342: Unauthenticated Denial of Service via Memory Exhaustion in PasswordHash API Endpoint"
+      "CVE-2026-28789: Unauthenticated DoS via concurrent map writes in OAuth2 state handling"
+      "CVE-2026-28790: Unauthenticated Action Termination via KillAction When Guests Must Login"
+      "CVE-2026-30223: JWT Audience Validation Bypass in Local Key and HMAC Modes"
+      "CVE-2026-30224: Session Fixation - Logout Fails to Invalidate Server-Side Session"
+      "CVE-2026-30225: RestartAction always runs actions as guest"
+      "CVE-2026-30233: View permission not being checked when returning dashboards"
+      "CVE-2026-31817: Unsafe parsing of UniqueTrackingId can be used to write files"
+    ];
+  };
+})
diff --git a/pkgs/by-name/ol/olivetin/update-3k.sh b/pkgs/by-name/ol/olivetin/update-3k.sh
new file mode 100755
index 000000000000..683d80cd9682
--- /dev/null
+++ b/pkgs/by-name/ol/olivetin/update-3k.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix-update common-updater-scripts
+
+set -euo pipefail
+
+nix-update olivetin-3k --src-only --override-filename
+update-source-version olivetin-3k --source-key=gen --ignore-same-version
+update-source-version olivetin-3k --source-key=webui.npmDeps --ignore-same-version
+update-source-version olivetin-3k --source-key=goModules --ignore-same-version
diff --git a/pkgs/by-name/op/opencode-claude-auth/package.nix b/pkgs/by-name/op/opencode-claude-auth/package.nix
new file mode 100644
index 000000000000..24ada2f9b246
--- /dev/null
+++ b/pkgs/by-name/op/opencode-claude-auth/package.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "opencode-claude-auth";
+  version = "0.5.5";
+
+  src = fetchFromGitHub {
+    owner = "griffinmartin";
+    repo = "opencode-claude-auth";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ntqMpyXOyOvtZVbe5nZmQ3COxW3kM7IG8CCUbGWYYEk=";
+  };
+
+  npmDepsHash = "sha256-j4h/PUVWcgW9XRnaUqpMSdfb9TZtQfp1cOfxwG4FX5A=";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "OpenCode plugin that uses your existing Claude Code credentials";
+    homepage = "https://github.com/griffinmartin/opencode-claude-auth";
+    changelog = "https://github.com/griffinmartin/opencode-claude-auth/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/pr/proxytunnel/package.nix b/pkgs/by-name/pr/proxytunnel/package.nix
new file mode 100644
index 000000000000..61e5b5864481
--- /dev/null
+++ b/pkgs/by-name/pr/proxytunnel/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  stdenv,
+  openssl,
+  fetchFromGitHub,
+  versionCheckHook,
+  asciidoc,
+  xmlto,
+  docbook-xsl-nons,
+  docbook_xml_dtd_45,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "proxytunnel";
+  version = "1.12.3";
+
+  src = fetchFromGitHub {
+    owner = "proxytunnel";
+    repo = "proxytunnel";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-+IRbL3VcnW+uYLIkwvaFJ8zBYbQAkqmzVluDsCrdURk=";
+  };
+
+  makeFlags = [ "prefix=${placeholder "out"}" ];
+  buildInputs = [ openssl ];
+  nativeBuildInputs = [
+    asciidoc
+    xmlto
+    docbook-xsl-nons
+    docbook_xml_dtd_45
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  meta = {
+    mainProgram = "proxytunnel";
+    homepage = "http://proxytunnel.sf.net/";
+    description = "Stealth tunneling through HTTP(S) proxies";
+    platforms = lib.platforms.unix;
+    license = lib.licenses.gpl2Only;
+    changelog = "https://github.com/proxytunnel/proxytunnel/raw/${finalAttrs.src.tag}/CHANGES";
+    maintainers = with lib.maintainers; [
+      lenianiva
+    ];
+  };
+})
diff --git a/pkgs/by-name/rb/rbspy/package.nix b/pkgs/by-name/rb/rbspy/package.nix
index bed19b580cab..dbeceb008830 100644
--- a/pkgs/by-name/rb/rbspy/package.nix
+++ b/pkgs/by-name/rb/rbspy/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rbspy";
-  version = "0.40.0";
+  version = "0.44.0";
 
   src = fetchFromGitHub {
     owner = "rbspy";
     repo = "rbspy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4VNiz+b8fxJ0uEVn8PZJPIvqB2dK/mx74RnRGRCxeR8=";
+    hash = "sha256-5oCSrKtNmvleJwkJN2Sz/1i7MpaiNTD9i0whlFLHSgg=";
   };
 
-  cargoHash = "sha256-bmKG0/9XWIT2rMEejmp4DCMj5JZe2k4AdHSmsOeXmak=";
+  cargoHash = "sha256-3AK/No9rbPvS2QhUwVDl7OsvUzWaW9DCkNlf3PSp1Ic=";
 
   doCheck = true;
 
diff --git a/pkgs/by-name/rg/rgx/package.nix b/pkgs/by-name/rg/rgx/package.nix
new file mode 100644
index 000000000000..dd5d3e4ca122
--- /dev/null
+++ b/pkgs/by-name/rg/rgx/package.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "rgx";
+  version = "0.7.0";
+
+  src = fetchFromGitHub {
+    owner = "brevity1swos";
+    repo = "rgx";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Yb0ZjITRTmYZYW4OAYlxtuZRmW4yeOMNEqnexLa6TXo=";
+  };
+
+  cargoHash = "sha256-i1+ZRUFw+EXbs7MRhoFvgz622eH05XZvEiyjYMY9RYM=";
+
+  meta = {
+    homepage = "https://github.com/brevity1swos/rgx";
+    description = "Terminal regex tester with real-time matching and multi-engine support";
+    changelog = "https://github.com/brevity1swos/rgx/releases/tag/${finalAttrs.src.tag}";
+    license = with lib.licenses; [
+      asl20 # or
+      mit
+    ];
+    maintainers = with lib.maintainers; [ Cameo007 ];
+    mainProgram = "rgx";
+  };
+})
diff --git a/pkgs/by-name/ri/river/build.zig.zon.nix b/pkgs/by-name/ri/river/build.zig.zon.nix
new file mode 100644
index 000000000000..82218cc8dbfd
--- /dev/null
+++ b/pkgs/by-name/ri/river/build.zig.zon.nix
@@ -0,0 +1,52 @@
+# generated by zon2nix (https://github.com/nix-community/zon2nix)
+
+{
+  linkFarm,
+  fetchzip,
+  fetchgit,
+}:
+
+linkFarm "zig-packages" [
+  {
+    name = "pixman-0.3.0-LClMnz2VAAAs7QSCGwLimV5VUYx0JFnX5xWU6HwtMuDX";
+    path = fetchzip {
+      url = "https://codeberg.org/ifreund/zig-pixman/archive/v0.3.0.tar.gz";
+      hash = "sha256-8tA4auo5FEI4IPnomV6bkpQHUe302tQtorFQZ1l14NU=";
+    };
+  }
+  {
+    name = "wayland-0.4.0-lQa1khbMAQAsLS2eBR7M5lofyEGPIbu2iFDmoz8lPC27";
+    path = fetchzip {
+      url = "https://codeberg.org/ifreund/zig-wayland/archive/v0.4.0.tar.gz";
+      hash = "sha256-ulIII5iJpM/W/VJB0HcdktEO2eb9T9J0ln2A1Z94dU4=";
+    };
+  }
+  {
+    name = "wayland-0.5.0-lQa1knz8AQCh08NA8BeQrwJB9U3CfqcVAdHZYGRKIGuu";
+    path = fetchzip {
+      url = "https://codeberg.org/ifreund/zig-wayland/archive/v0.5.0.tar.gz";
+      hash = "sha256-mhqOtC26iACIvQUq74AbLSXSPsnWMi3AvDV7G2uElpo=";
+    };
+  }
+  {
+    name = "wlroots-0.19.4-jmOlcqQMBABhKYH6NMSnoK1sohTbhc97_JP-hGg2UZaK";
+    path = fetchzip {
+      url = "https://codeberg.org/ifreund/zig-wlroots/archive/v0.19.4.tar.gz";
+      hash = "sha256-g1LOSMMnjGJIS+U7zrx6FAoUyavqwaQ2UrDv6GxCQsY=";
+    };
+  }
+  {
+    name = "xkbcommon-0.3.0-VDqIe3K9AQB2fG5ZeRcMC9i7kfrp5m2rWgLrmdNn9azr";
+    path = fetchzip {
+      url = "https://codeberg.org/ifreund/zig-xkbcommon/archive/v0.3.0.tar.gz";
+      hash = "sha256-e5bPEfxl4SQf0cqccLt/py1KOW1+Q1+kWZUEXBbh9oQ=";
+    };
+  }
+  {
+    name = "xkbcommon-0.4.0-VDqIe0i2AgDRsok2GpMFYJ8SVhQS10_PI2M_CnHXsJJZ";
+    path = fetchzip {
+      url = "https://codeberg.org/ifreund/zig-xkbcommon/archive/v0.4.0.tar.gz";
+      hash = "sha256-zQkmP/cuhAtjOLqYS5D15khKzpqyhbyZ0TD6/8jOkqE=";
+    };
+  }
+]
diff --git a/pkgs/by-name/ri/river/package.nix b/pkgs/by-name/ri/river/package.nix
new file mode 100644
index 000000000000..1cc925fc1d17
--- /dev/null
+++ b/pkgs/by-name/ri/river/package.nix
@@ -0,0 +1,106 @@
+{
+  lib,
+  stdenv,
+  callPackage,
+  fetchFromCodeberg,
+  libGL,
+  libx11,
+  libevdev,
+  libinput,
+  libxkbcommon,
+  pixman,
+  pkg-config,
+  scdoc,
+  udev,
+  versionCheckHook,
+  wayland,
+  wayland-protocols,
+  wayland-scanner,
+  wlroots_0_19,
+  xwayland,
+  zig_0_15,
+  withManpages ? true,
+  xwaylandSupport ? true,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "river";
+  version = "0.4.1";
+
+  outputs = [ "out" ] ++ lib.optionals withManpages [ "man" ];
+
+  src = fetchFromCodeberg {
+    owner = "river";
+    repo = "river";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-EGWLJY9VPdoc4LrXkWi8cNLkahorvDeAIfSOc5yDfbU=";
+  };
+
+  strictDeps = true;
+
+  deps = callPackage ./build.zig.zon.nix { };
+
+  nativeBuildInputs = [
+    pkg-config
+    wayland-scanner
+    xwayland
+    zig_0_15
+  ]
+  ++ lib.optional withManpages scdoc;
+
+  buildInputs = [
+    libGL
+    libevdev
+    libinput
+    libxkbcommon
+    pixman
+    udev
+    wayland
+    wayland-protocols
+    wayland-scanner
+    wlroots_0_19
+  ]
+  ++ lib.optionals xwaylandSupport [
+    libx11
+  ];
+
+  zigBuildFlags = [
+    "--system"
+    "${finalAttrs.deps}"
+  ]
+  ++ lib.optional withManpages "-Dman-pages"
+  ++ lib.optional xwaylandSupport "-Dxwayland";
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "-version";
+
+  passthru = {
+    providedSessions = [ "river" ];
+    updateScript = ./update.sh;
+  };
+
+  meta = {
+    description = "Non-monolithic Wayland compositor";
+    homepage = "https://codeberg.org/river/river";
+    longDescription = ''
+      River is a non-monolithic Wayland compositor.
+      Unlike other Wayland compositors, river does not combine the compositor and window manager into one program.
+      Instead, users can choose any window manager implementing the river-window-management-v1 protocol.
+    '';
+    changelog = "https://codeberg.org/river/river/releases/tag/v${finalAttrs.version}";
+    license = with lib.licenses; [
+      # source code
+      gpl3Only
+
+      # wayland protocols
+      mit
+    ];
+    maintainers = with lib.maintainers; [
+      GaetanLepage
+      adamcstephens
+    ];
+    mainProgram = "river";
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/ri/river/update.sh b/pkgs/by-name/ri/river/update.sh
new file mode 100755
index 000000000000..7d7875e5c8c6
--- /dev/null
+++ b/pkgs/by-name/ri/river/update.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bash common-updater-scripts gnused zon2nix
+
+latest_tag=$(list-git-tags --url=https://codeberg.org/river/river | sed 's/^v//' | sort --version-sort | tail --lines=1)
+
+update-source-version river "$latest_tag"
+
+wget "https://codeberg.org/river/river/raw/tag/v${latest_tag}/build.zig.zon"
+zon2nix build.zig.zon >pkgs/by-name/ri/river/build.zig.zon.nix
+nixfmt pkgs/by-name/ri/river/build.zig.zon.nix
+
+rm -f build.zig.zon build.zig.zon.nix
diff --git a/pkgs/by-name/ru/ruffle/package.nix b/pkgs/by-name/ru/ruffle/package.nix
index f0977cebb46b..371e39805b12 100644
--- a/pkgs/by-name/ru/ruffle/package.nix
+++ b/pkgs/by-name/ru/ruffle/package.nix
@@ -27,13 +27,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruffle";
-  version = "0.2.0-nightly-2026-03-04";
+  version = "0.2.0-nightly-2026-03-20";
 
   src = fetchFromGitHub {
     owner = "ruffle-rs";
     repo = "ruffle";
     tag = lib.strings.removePrefix "0.2.0-" finalAttrs.version;
-    hash = "sha256-IEldR8Pze17scKkKAfLrAPyZW7aak/6EKHSaO2t5MxY=";
+    hash = "sha256-CONx48SDjHu22AXasIMwCpD+s6+6Tsr8+XtderuQzpM=";
   };
 
   postPatch =
@@ -49,7 +49,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
                        "OpenH264Version(${major}, ${minor}, ${patch})"
     '';
 
-  cargoHash = "sha256-w2uzH9b/zuWPeRBpo/KgAXYUOC2OnFRSHGewsbfVVww=";
+  cargoHash = "sha256-LfGZuTDkfz0Wn9O8t474Y9US85ewWMPx7qPBjK9gFg8=";
   cargoBuildFlags = lib.optional withRuffleTools "--workspace";
 
   env =
diff --git a/pkgs/by-name/sv/sview/package.nix b/pkgs/by-name/sv/sview/package.nix
index 2175f700478d..b6ed4983857c 100644
--- a/pkgs/by-name/sv/sview/package.nix
+++ b/pkgs/by-name/sv/sview/package.nix
@@ -1,30 +1,36 @@
 {
+  cmake,
   fetchFromGitHub,
   fetchurl,
-  ffmpeg_4,
+  ffmpeg,
   fontconfig,
-  gtk2,
+  freetype,
   lib,
   libconfig,
   libGL,
+  libx11,
+  libxext,
   libxpm,
+  libxrandr,
   makeFontsConf,
   makeWrapper,
   nanum,
   openal,
+  openvr,
   pkg-config,
   stdenv,
+  zenity,
 }:
 
 stdenv.mkDerivation rec {
   pname = "sview";
-  version = "20_08";
+  version = "26_02";
 
   src = fetchFromGitHub {
     owner = "gkv311";
     repo = "sview";
     tag = version;
-    hash = "sha256-mbEacdBQchziXoZ5vJUiEpa/iHeXeaozte2aXs50/Fo=";
+    hash = "sha256-UIA8bDGYVN8Zw23PkKprYrvcMubHzoquaSArLShu+aw=";
   };
 
   droidSansFallback = fetchurl {
@@ -33,17 +39,31 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [
+    cmake
     makeWrapper
     pkg-config
   ];
 
+  cmakeFlags = [
+    "-DUSE_UPDATER=OFF"
+    "-DCMAKE_BUILD_TYPE=Release"
+    "-DCMAKE_INSTALL_LIBDIR=/lib"
+    "-DCMAKE_INSTALL_BINDIR=/bin"
+    "-DCMAKE_INSTALL_DATAROOTDIR=/share"
+  ];
+
   buildInputs = [
-    ffmpeg_4
-    gtk2
+    freetype
+    ffmpeg
+    fontconfig
     libconfig
     libGL
+    libx11
+    libxext
     libxpm
+    libxrandr
     openal
+    openvr
   ];
 
   fontsConf = makeFontsConf {
@@ -55,7 +75,7 @@ stdenv.mkDerivation rec {
 
   installPhase = ''
     runHook preInstall
-    make install APP_PREFIX=$out DISABLE_UPDATER=1
+    make & make install
     mkdir -p $out/share/sView/fonts
     cp ${droidSansFallback} $out/share/sView/fonts/DroidSansFallbackFull.ttf
     cp '${fontsConf}' $out/share/sView/fonts/fonts.conf
@@ -66,7 +86,7 @@ stdenv.mkDerivation rec {
     substituteInPlace $out/share/sView/fonts/fonts.conf \
       --replace-warn "placeholder" "$out/share/sView/fonts/";
     wrapProgram $out/bin/sView \
-      --set StShare $out/share/sView \
+      --prefix PATH : "${zenity}/bin" \
       --set FONTCONFIG_FILE $out/share/sView/fonts/fonts.conf
   '';
 
diff --git a/pkgs/by-name/un/unifi/package.nix b/pkgs/by-name/un/unifi/package.nix
index cbaf91789b49..e05dd5ce4ecc 100644
--- a/pkgs/by-name/un/unifi/package.nix
+++ b/pkgs/by-name/un/unifi/package.nix
@@ -10,12 +10,12 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "unifi-controller";
-  version = "10.1.85";
+  version = "10.1.89";
 
   # see https://community.ui.com/releases / https://www.ui.com/download/unifi
   src = fetchurl {
     url = "https://dl.ui.com/unifi/${finalAttrs.version}/unifi_sysvinit_all.deb";
-    hash = "sha256-bmTk17n2N7+SV+E90C8xoeFVoTgA6WhX746wOTSiU6c=";
+    hash = "sha256-gtnDr+CBeoOKqIeDwKJixW5W20lje7nzR4DC/D+1S3o=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ve/vencord/package.nix b/pkgs/by-name/ve/vencord/package.nix
index 448f9cdf9fb8..67fedf81acc2 100644
--- a/pkgs/by-name/ve/vencord/package.nix
+++ b/pkgs/by-name/ve/vencord/package.nix
@@ -19,13 +19,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vencord";
-  version = "1.14.5";
+  version = "1.14.6";
 
   src = fetchFromGitHub {
     owner = "Vendicated";
     repo = "Vencord";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FZ00lhPr4R0Bo8zwBfc/Y8eMfbTcRxjH3YwDBm1NSQk=";
+    hash = "sha256-Wl89sRv49os6uRuYQVB/LgsOD7Rz3DPoxqeeELyY/o4=";
   };
 
   patches = [ ./fix-deps.patch ];
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     pnpm = pnpm_10;
     fetcherVersion = 2;
-    hash = "sha256-K9rjPsODn56kM2k5KZHxY99n8fKvWbRbxuxFpYVXYks=";
+    hash = "sha256-b8Ko87Ddu3jcigbxluhsADJTsGVatiW5snXSXtrYho0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/wa/warp-terminal/versions.json b/pkgs/by-name/wa/warp-terminal/versions.json
index 0612a19c43f7..4fc0433d5cf0 100644
--- a/pkgs/by-name/wa/warp-terminal/versions.json
+++ b/pkgs/by-name/wa/warp-terminal/versions.json
@@ -1,14 +1,14 @@
 {
   "darwin": {
-    "hash": "sha256-9pLlhZzkfJcuoO1NTy1oUAFE5HTpFRFjJHabcJnP3qg=",
-    "version": "0.2026.03.04.08.20.stable_03"
+    "hash": "sha256-/c0uVS3bclXQuriHaxJK9cjqdiz036OkzbXxLWrFkMI=",
+    "version": "0.2026.03.04.08.20.stable_04"
   },
   "linux_x86_64": {
-    "hash": "sha256-SLH8GEyC5QI+6ZNRK20Kpgrm1ynOufCxRBk7hpV5asE=",
-    "version": "0.2026.03.04.08.20.stable_03"
+    "hash": "sha256-WldEfTHEAGKo2QaTi7bvZsw14RU+xoKqQaVQfy4KGHg=",
+    "version": "0.2026.03.04.08.20.stable_04"
   },
   "linux_aarch64": {
-    "hash": "sha256-0DNg5yjoOdEL2KJ+gIFKaJgthiKFZ6JHqaa4DUVtcgY=",
-    "version": "0.2026.03.04.08.20.stable_03"
+    "hash": "sha256-Kb85V9OLdIxEHbUBUkrpI5Y/hjJCjkDuBJkgztiPy7Y=",
+    "version": "0.2026.03.04.08.20.stable_04"
   }
 }
diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index 27d2678c8740..16fc610bbba6 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -3629,13 +3629,13 @@ with haskellLib;
 # Manually maintained
 // (
   let
-    version = "1.10.1";
+    version = "1.11.0";
 
     src = pkgs.fetchFromGitHub {
       owner = "cachix";
       repo = "cachix";
       tag = "v${version}";
-      hash = "sha256-kNwoplCrqAymyFIzoR1rpEj0I1Ass+wuP8YsVS61630=";
+      hash = "sha256-CWhnwL2M83/ItapPVeJqCevRoQttesYxJ1h0Mo6ZCXs=";
     };
   in
   {
@@ -3649,9 +3649,6 @@ with haskellLib;
         inherit version;
         src = src + "/cachix";
       })
-      (addBuildDepends [
-        self.pqueue
-      ])
       (
         drv:
         drv.override {
diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index c98d1bb4d43c..6f90732dc92c 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -407,8 +407,8 @@ in
   };
 
   ruby_4_0 = generic {
-    version = rubyVersion "4" "0" "1" "";
-    hash = "sha256-OSS+LQXbMPTjX4Wb8Ci+hfS33QFxQUL9gj5K9d4vr50=";
+    version = rubyVersion "4" "0" "2" "";
+    hash = "sha256-UVArJrULaN9JYzNspB42jN6SySj6+RZU3kxMF5H4Kqw=";
     cargoHash = "sha256-z7NwWc4TaR042hNx0xgRkh/BQEpEJtE53cfrN0qNiE0=";
   };
 
diff --git a/pkgs/development/python-modules/aiohomeconnect/default.nix b/pkgs/development/python-modules/aiohomeconnect/default.nix
index 54047e831363..9a7274af9033 100644
--- a/pkgs/development/python-modules/aiohomeconnect/default.nix
+++ b/pkgs/development/python-modules/aiohomeconnect/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aiohomeconnect";
-  version = "0.32.0";
+  version = "0.33.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "MartinHjelmare";
     repo = "aiohomeconnect";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fantj1npAPikWarJ+5zTBSLJfGW2JvM0N49np4eUHqM=";
+    hash = "sha256-hpM1Fr1CPBKNJ/GJtNiL/ifR0UN/VrDL3GVanmBIb9U=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/aiovlc/default.nix b/pkgs/development/python-modules/aiovlc/default.nix
index 857cba015c20..0996fc96e86e 100644
--- a/pkgs/development/python-modules/aiovlc/default.nix
+++ b/pkgs/development/python-modules/aiovlc/default.nix
@@ -2,27 +2,27 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  poetry-core,
   pytest-asyncio,
   pytest-cov-stub,
   pytest-timeout,
   pytestCheckHook,
+  setuptools,
   typer,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "aiovlc";
-  version = "0.6.6";
+  version = "0.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "MartinHjelmare";
     repo = "aiovlc";
-    tag = "v${version}";
-    hash = "sha256-HnMzr6yKEtPFJlaKbvKYTXXjlz1wDLdOw65IPZJkWB0=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-PA8meWB0LOZX503+GVep03GiUh65MsLI+C6Fe9Iz6nc=";
   };
 
-  build-system = [ poetry-core ];
+  build-system = [ setuptools ];
 
   optional-dependencies = {
     cli = [ typer ];
@@ -34,15 +34,15 @@ buildPythonPackage rec {
     pytest-timeout
     pytestCheckHook
   ]
-  ++ lib.concatAttrValues optional-dependencies;
+  ++ lib.flatten (builtins.attrValues finalAttrs.passthru.optional-dependencies);
 
   pythonImportsCheck = [ "aiovlc" ];
 
   meta = {
     description = "Python module to control VLC";
     homepage = "https://github.com/MartinHjelmare/aiovlc";
-    changelog = "https://github.com/MartinHjelmare/aiovlc/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/MartinHjelmare/aiovlc/blob/v${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/androidtvremote2/default.nix b/pkgs/development/python-modules/androidtvremote2/default.nix
index 9d863d46c7bf..1ca07612292a 100644
--- a/pkgs/development/python-modules/androidtvremote2/default.nix
+++ b/pkgs/development/python-modules/androidtvremote2/default.nix
@@ -8,16 +8,16 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "androidtvremote2";
-  version = "0.3.0";
+  version = "0.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tronikos";
     repo = "androidtvremote2";
-    tag = "v${version}";
-    hash = "sha256-kpp4wLAMF5lAkQKdhFvFlu0n+TdmVbaNncv8tjUcqVs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-W+L1yQ7FAoKIlYtlM7gfPv8Tco/9hCDDUQQ16xg+++s=";
   };
 
   build-system = [ setuptools ];
@@ -36,8 +36,8 @@ buildPythonPackage rec {
   meta = {
     description = "Library to interact with the Android TV Remote protocol v2";
     homepage = "https://github.com/tronikos/androidtvremote2";
-    changelog = "https://github.com/tronikos/androidtvremote2/releases/tag/${src.tag}";
+    changelog = "https://github.com/tronikos/androidtvremote2/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index afba1ffac752..f2d4ad7a5a54 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "boto3-stubs";
-  version = "1.42.71";
+  version = "1.42.72";
   pyproject = true;
 
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit (finalAttrs) version;
-    hash = "sha256-fs4w2/5xlVboTYiHKDPTTi6oHo+l379YHm7sgPv0AOM=";
+    hash = "sha256-QfxAte69QqzESXZJMarmy9RUPv04F7G0+mC0H1RJ1LY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/claude-agent-sdk/default.nix b/pkgs/development/python-modules/claude-agent-sdk/default.nix
index 51579a8dd0cf..0020ba6df90e 100644
--- a/pkgs/development/python-modules/claude-agent-sdk/default.nix
+++ b/pkgs/development/python-modules/claude-agent-sdk/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "claude-agent-sdk";
-  version = "0.1.48";
+  version = "0.1.49";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "anthropics";
     repo = "claude-agent-sdk-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1J915Q+/fUQEqaJbW/wn4aA4hqzAn0yZ7BxkTnfhTu0=";
+    hash = "sha256-UM2kZAKC89NQAkrR6Asyc/fh7U0jziRU5uU5DgQ+iY4=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/cyvest/default.nix b/pkgs/development/python-modules/cyvest/default.nix
index fc1f7866ba60..16dec35d6a08 100644
--- a/pkgs/development/python-modules/cyvest/default.nix
+++ b/pkgs/development/python-modules/cyvest/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "cyvest";
-  version = "5.3.0";
+  version = "5.3.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PakitoSec";
     repo = "cyvest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FoQxhQHV1VuLfCsi3eRtxhFhuiHOtRDQc8+bhln+MOQ=";
+    hash = "sha256-4vNfv5dIoeRhnTXNFgqvtxBaCONceXnJhF9RsLD1CIA=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/frigidaire/default.nix b/pkgs/development/python-modules/frigidaire/default.nix
index 6e81fdf5ed20..1b0403ec49ba 100644
--- a/pkgs/development/python-modules/frigidaire/default.nix
+++ b/pkgs/development/python-modules/frigidaire/default.nix
@@ -10,21 +10,21 @@
   urllib3,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "frigidaire";
-  version = "0.18.28";
+  version = "0.18.29";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bm1549";
     repo = "frigidaire";
-    tag = version;
-    hash = "sha256-2VleZyisva2HQPDmPoZbxnYu3t1S/HTuaZtFWFiU1nU=";
+    tag = finalAttrs.version;
+    hash = "sha256-OVaXo1UFB0deCHfDXR+uUnIsPsW6RhE/OJLG1WD4Ykg=";
   };
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace-warn 'version = "SNAPSHOT"' 'version = "${version}"'
+      --replace-warn 'version = "SNAPSHOT"' 'version = "${finalAttrs.version}"'
   '';
 
   nativeBuildInputs = [ setuptools ];
@@ -45,8 +45,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python API for the Frigidaire devices";
     homepage = "https://github.com/bm1549/frigidaire";
-    changelog = "https://github.com/bm1549/frigidaire/releases/tag/${src.tag}";
+    changelog = "https://github.com/bm1549/frigidaire/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/google-ai-generativelanguage/default.nix b/pkgs/development/python-modules/google-ai-generativelanguage/default.nix
index 47fa213a0dc6..23b078be98bb 100644
--- a/pkgs/development/python-modules/google-ai-generativelanguage/default.nix
+++ b/pkgs/development/python-modules/google-ai-generativelanguage/default.nix
@@ -1,32 +1,44 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
   google-api-core,
   google-auth,
-  google-cloud-testutils,
   grpcio,
-  mock,
   proto-plus,
   protobuf,
+
+  # tests
+  google-cloud-testutils,
+  mock,
   pytest-asyncio,
   pytestCheckHook,
-  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "google-ai-generativelanguage";
   version = "0.10.0";
   pyproject = true;
 
-  src = fetchPypi {
-    pname = "google_ai_generativelanguage";
-    inherit version;
-    hash = "sha256-F+mYCUADpWbg+lIkn91J6PTAMM6+f+DFIbQNYFq6eD4=";
+  src = fetchFromGitHub {
+    owner = "googleapis";
+    repo = "google-cloud-python";
+    tag = "google-ai-generativelanguage-v${finalAttrs.version}";
+    hash = "sha256-dVgcnnInqjUjySL7wjxGzI33t1YZJ8e9mSsmjAJ+fBI=";
   };
 
+  sourceRoot = "${finalAttrs.src.name}/packages/google-ai-generativelanguage";
+
   build-system = [ setuptools ];
 
+  pythonRelaxDeps = [
+    "protobuf"
+  ];
   dependencies = [
     google-api-core
     google-auth
@@ -51,8 +63,8 @@ buildPythonPackage rec {
   meta = {
     description = "Google Ai Generativelanguage API client library";
     homepage = "https://github.com/googleapis/google-cloud-python/tree/main/packages/google-ai-generativelanguage";
-    changelog = "https://github.com/googleapis/google-cloud-python/blob/google-ai-generativelanguage-v${version}/packages/google-ai-generativelanguage/CHANGELOG.md";
+    changelog = "https://github.com/googleapis/google-cloud-python/blob/${finalAttrs.src.tag}/packages/google-ai-generativelanguage/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index dfdc141d4fad..7f506dfc763c 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202603191";
+  version = "0.1.202603201";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KzVLTnXipFCI/wblV790JundbpCbFhidV7tZ2IRVPCM=";
+    hash = "sha256-fKyOrDBwHMPMibzS7R75kslvuVolyYnIh8e1+7VP2eA=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/logurich/default.nix b/pkgs/development/python-modules/logurich/default.nix
index 98f7b34876a0..d5797f8bd0ae 100644
--- a/pkgs/development/python-modules/logurich/default.nix
+++ b/pkgs/development/python-modules/logurich/default.nix
@@ -26,6 +26,8 @@ buildPythonPackage (finalAttrs: {
       --replace-fail "uv_build>=0.9.20,<0.10.0" "uv_build"
   '';
 
+  pythonRelaxDeps = [ "rich" ];
+
   build-system = [ uv-build ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 6199052921e9..55379c368b19 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -163,8 +163,8 @@ in
       "sha256-G3kwLm2IEgXNFrs8V2uCj0su2S3P72FzmWSOEYjlV4c=";
 
   mypy-boto3-batch =
-    buildMypyBoto3Package "batch" "1.42.59"
-      "sha256-RYL6s/uF5iFEIEFewaq2gXX7YeKgC1EWomCRyerJZS4=";
+    buildMypyBoto3Package "batch" "1.42.72"
+      "sha256-n5buQA3+fBUS3DFwl1s0Oe8h4xyikw7hCmy5ByIQxSg=";
 
   mypy-boto3-billingconductor =
     buildMypyBoto3Package "billingconductor" "1.42.7"
@@ -443,8 +443,8 @@ in
       "sha256-92qhSUqTiLgbtvCdi/Mmgve18mcYR00ABL+bNy7/OnY=";
 
   mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.42.71"
-      "sha256-nlMYh/t5dGbsfMG/epaIgUZK5AcgXBTWmFK8PPRppg0=";
+    buildMypyBoto3Package "ec2" "1.42.72"
+      "sha256-UPFFQExnYTNMXUMU0MojPlWMa8V6aDG9te6yu464F5k=";
 
   mypy-boto3-ec2-instance-connect =
     buildMypyBoto3Package "ec2-instance-connect" "1.42.3"
@@ -1046,8 +1046,8 @@ in
       "sha256-315QgDF/CNolDYIYUcEGqdc5rQotI1uw0q8aQN9sW08=";
 
   mypy-boto3-polly =
-    buildMypyBoto3Package "polly" "1.42.66"
-      "sha256-uAOOFj4S9ip3VVjuS6bceXpUpVhOXHBklkfPbOT7Hzg=";
+    buildMypyBoto3Package "polly" "1.42.72"
+      "sha256-0/LaF7Oqt3d7fPNc9TWSXqB3JS43PodvmscfauqAU1U=";
 
   mypy-boto3-pricing =
     buildMypyBoto3Package "pricing" "1.42.3"
diff --git a/pkgs/development/python-modules/tyro/default.nix b/pkgs/development/python-modules/tyro/default.nix
index c7e5298da2a8..1a50bfdaf78c 100644
--- a/pkgs/development/python-modules/tyro/default.nix
+++ b/pkgs/development/python-modules/tyro/default.nix
@@ -27,16 +27,16 @@
   universal-pathlib,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "tyro";
-  version = "1.0.8";
+  version = "1.0.10";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "brentyi";
     repo = "tyro";
-    tag = "v${version}";
-    hash = "sha256-GTgbzGIIZrkMUgjqMWZVXRVhp9mcxfnDQ/dRApotjww=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-k8f0eSeBBCROSsf7WooapDIFoy1G4Guxpbb7eNbj6ps=";
   };
 
   build-system = [ hatchling ];
@@ -80,8 +80,8 @@ buildPythonPackage rec {
   meta = {
     description = "CLI interfaces & config objects, from types";
     homepage = "https://github.com/brentyi/tyro";
-    changelog = "https://github.com/brentyi/tyro/releases/tag/${src.tag}";
+    changelog = "https://github.com/brentyi/tyro/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ hoh ];
   };
-}
+})
diff --git a/pkgs/servers/home-assistant/custom-components/browser-mod/package.nix b/pkgs/servers/home-assistant/custom-components/browser-mod/package.nix
index c8d42e345c4a..c63b895025d2 100644
--- a/pkgs/servers/home-assistant/custom-components/browser-mod/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/browser-mod/package.nix
@@ -10,13 +10,13 @@
 buildHomeAssistantComponent rec {
   owner = "thomasloven";
   domain = "browser_mod";
-  version = "2.9.0";
+  version = "2.10.0";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "hass-browser_mod";
     tag = "v${version}";
-    hash = "sha256-LTXoehq7N2wURRuwXq6G0MlI8o24TxSU/EoHNiByeY0=";
+    hash = "sha256-83cwjgS4JsqZrf8sNXz6wjJOF5pGrmOZko+UfMgn70Q=";
   };
 
   nativeBuildInputs = [
@@ -27,7 +27,7 @@ buildHomeAssistantComponent rec {
 
   npmDeps = fetchNpmDeps {
     inherit src;
-    hash = "sha256-FNf/8Ah1KV/Lmi0OYYQy2NaTCy17KuDEDOp3sWG2wH8=";
+    hash = "sha256-JFfoqhFt1JEM4SsRkJg13QRPsjukUPs5iKpSx6Nvgzs=";
   };
 
   npmBuildScript = "build";
diff --git a/pkgs/tools/inputmethods/fcitx5/default.nix b/pkgs/tools/inputmethods/fcitx5/default.nix
index 236be8942ad3..42123c74edcc 100644
--- a/pkgs/tools/inputmethods/fcitx5/default.nix
+++ b/pkgs/tools/inputmethods/fcitx5/default.nix
@@ -15,7 +15,7 @@
   wayland,
   systemd,
   wayland-protocols,
-  json_c,
+  nlohmann_json,
   isocodes,
   xkeyboard_config,
   enchant,
@@ -45,13 +45,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "fcitx5";
-  version = "5.1.16";
+  version = "5.1.19";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = pname;
     rev = version;
-    hash = "sha256-aedYDpxYeUXadJnV+u1cQrNGoiW8WZKAgP4eNcvkScI=";
+    hash = "sha256-ZsGRVuUpWIJnsSqcAQcerxvwWIRaGdAO2FM1k3D3g0M=";
+    fetchSubmodules = true;
   };
 
   prePatch = ''
@@ -79,7 +80,7 @@ stdenv.mkDerivation rec {
     gdk-pixbuf
     wayland
     wayland-protocols
-    json_c
+    nlohmann_json
     libGL
     libuuid
     libselinux
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-chinese-addons.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-chinese-addons.nix
index 07be73d31bfc..900e7a3a5953 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-chinese-addons.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-chinese-addons.nix
@@ -35,13 +35,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "fcitx5-chinese-addons";
-  version = "5.1.10";
+  version = "5.1.12";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = pname;
     rev = version;
-    hash = "sha256-kVBDfr8NKsQQQX69N3/fVqJgObRNSX2p0GNSUjbZvcg=";
+    hash = "sha256-bAx5m+tU8hT1WdaLChpQV3J0l+QJzDLzMEPTgjEGCuw=";
   };
 
   nativeBuildInputs = [
@@ -51,15 +51,6 @@ stdenv.mkDerivation rec {
     fcitx5-lua
   ];
 
-  patches = [
-    # Without this patch, setting ENABLE_CLOUDPINYIN to off would fail to build
-    (fetchpatch {
-      name = "cloudpinyin-disable-build";
-      url = "https://github.com/fcitx/fcitx5-chinese-addons/commit/024fff9c8587ca2fb01905e9a25df838e7d99da2.patch";
-      hash = "sha256-Mo5l8tsn1JQxTFHxOZfQRmbCeWZHLyxfn2Qwv/gQXGA=";
-    })
-  ];
-
   prePatch = ''
     ln -s ${pyStroke} modules/pinyinhelper/$(stripHash ${pyStroke})
     ln -s ${pyTable} modules/pinyinhelper/$(stripHash ${pyTable})
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix
index f5bfc812df94..3674a7c0bb48 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix
@@ -16,13 +16,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "fcitx5-qt${majorVersion}";
-  version = "5.1.12";
+  version = "5.1.13";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = "fcitx5-qt";
     rev = version;
-    hash = "sha256-Nrt49TltV3Us93MWUX4tBs0576jEC1kRX+T9IddVgZk=";
+    hash = "sha256-CrrQQPtWQwE6eZOJB+uLVUjPJMKW/sz/tij41dyEe0U=";
   };
 
   postPatch = ''
diff --git a/pkgs/tools/inputmethods/fcitx5/fcitx5-skk.nix b/pkgs/tools/inputmethods/fcitx5/fcitx5-skk.nix
index 0af6cde4079f..931da19219ca 100644
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-skk.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-skk.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fcitx5-skk";
-  version = "5.1.8";
+  version = "5.1.10";
 
   src = fetchFromGitHub {
     owner = "fcitx";
     repo = pname;
     rev = version;
-    hash = "sha256-1omxT31hKe7gQ5BARJ+0tIp4RT5eM+Tjufd6s/PxBoY=";
+    hash = "sha256-4ApXom3SDwlT55lj0q3u5wBmKRGAzJCvpx1H30z3Ubo=";
   };
 
   nativeBuildInputs = [
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     (lib.cmakeBool "ENABLE_QT" enableQt)
-    "-DSKK_DEFAULT_PATH=${skkDictionaries.l}/share/skk/SKK-JISYO.L"
+    "-DSKK_PATH=${skkDictionaries.l}/share/skk"
   ];
 
   dontWrapQtApps = true;
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 574c7002bd7f..2e2701fc7f34 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -225,14 +225,14 @@ lib.makeExtensible (
 
       nixComponents_2_34 =
         (nixDependencies.callPackage ./modular/packages.nix rec {
-          version = "2.34.1";
+          version = "2.34.2";
           inherit (self.nix_2_33.meta) teams;
           otherSplices = generateSplicesForNixComponents "nixComponents_2_34";
           src = fetchFromGitHub {
             owner = "NixOS";
             repo = "nix";
             tag = version;
-            hash = "sha256-qzVtneydMSjNZXzNbxQG9VvJc490keS9RNlbUCfiQas=";
+            hash = "sha256-f2GohMEufOqm6Flw+yWxnLF6LXGh6XNTY1abhQosQ0Q=";
           };
         }).appendPatches
           patches_common;
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index dd59e64d9ef6..5d7c4e3a9a41 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1722,7 +1722,6 @@ mapAliases {
   rewind-ai = throw "'rewind-ai' has been removed due to lack of of maintenance upstream"; # Added 2025-08-03
   rigsofrods = throw "'rigsofrods' has been renamed to/replaced by 'rigsofrods-bin'"; # Converted to throw 2025-10-27
   rili = throw "'rili' has been dropped in favor of its maintained fork 'li-ri'"; # Added 2026-01-03
-  river = throw "'river' has been renamed to/replaced by 'river-classic'"; # Added 2025-08-30
   rke2_1_29 = throw "'rke2_1_29' has been removed from nixpkgs as it has reached end of life"; # Added 2025-05-05
   rke2_1_30 = throw "'rke2_1_30' has been removed from nixpkgs as it has reached end of life"; # Added 2025-11-04
   rke2_1_31 = throw "'rke2_1_31' has been removed from nixpkgs as it has reached end of life"; # Added 2025-12-08
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 30e09f146f38..b337dc2037a6 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6320,8 +6320,6 @@ with pkgs;
     fmt_12
     ;
 
-  firefox_decrypt = callPackage ../by-name/fi/firefox_decrypt/package.nix { nss = nss_latest; };
-
   fmt = fmt_12;
 
   fontconfig = callPackage ../development/libraries/fontconfig { };
@@ -12418,6 +12416,8 @@ with pkgs;
 
   radicle-node-unstable = callPackage ../by-name/ra/radicle-node/unstable.nix { };
 
+  olivetin-3k = callPackage ../by-name/ol/olivetin/3k.nix { };
+
   newlib-nano = newlib.override {
     nanoizeNewlib = true;
   };
diff --git a/pkgs/top-level/stage.nix b/pkgs/top-level/stage.nix
index be333d3bddc1..6c237bc6dd55 100644
--- a/pkgs/top-level/stage.nix
+++ b/pkgs/top-level/stage.nix
@@ -155,7 +155,11 @@ let
           overlays
           ;
       } res self super;
+
+      conflictingAttrs = lib.intersectAttrs res super;
     in
+    assert lib.assertMsg (conflictingAttrs == { })
+      "The following attributes were defined both in `pkgs/top-level/all-packages.nix` and elsewhere, most likely in `pkgs/by-name/`: ${lib.concatStringsSep ", " (lib.attrNames conflictingAttrs)}";
     res;
 
   aliases = self: super: lib.optionalAttrs config.allowAliases (import ./aliases.nix lib self super);