diff --git a/doc/hooks/index.md b/doc/hooks/index.md
index 18f66a7ddc05..7fb76b72953e 100644
--- a/doc/hooks/index.md
+++ b/doc/hooks/index.md
@@ -37,6 +37,7 @@ npm-install-hook.section.md
 patch-rc-path-hooks.section.md
 perl.section.md
 pkg-config.section.md
+pnpm.section.md
 postgresql-test-hook.section.md
 premake.section.md
 python.section.md
diff --git a/doc/hooks/pnpm.section.md b/doc/hooks/pnpm.section.md
new file mode 100644
index 000000000000..b00e7bfe81ff
--- /dev/null
+++ b/doc/hooks/pnpm.section.md
@@ -0,0 +1,142 @@
+# pnpmBuildHook {#pnpm-build-hook}
+
+[pnpm](https://pnpm.io/) is a an NPM-compatible package manager focused on increasing managment speeds, and reducing disk space.
+
+The `pnpmBuildHook` in Nixpkgs overrides the default build phase for building packages that use pnpm.
+
+:::{.example #ex-pnpm-build-hook}
+## pnpmBuildHook example code snippet {#pnpm-build-hook-code-snippet}
+
+```
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchPnpmDeps,
+  pnpmConfigHook,
+  pnpmBuildHook,
+  makeBinaryWrapper,
+  pnpm_10,
+}:
+let
+  pnpm = pnpm_10;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "coolPackages";
+  version = "1.0";
+
+  src = fetchFromGitHub {
+    owner = "JaneCool";
+    repo = "coolpackage";
+    tag = finalAttrs.version;
+    hash = lib.fakeHash;
+  };
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs) pname version src;
+    inherit pnpm;
+    fetcherversion = 4;
+    hash = lib.fakeHash;
+  };
+
+  nativeBuildInputs = [
+    pnpmConfigHook
+    pnpmBuildHook
+    makeBinaryWrapper
+  ];
+
+  pnpmBuildScript = "build";
+  pnpmBuildFlags = [
+    "--mode"
+    "production"
+  ];
+  pnpmWorkspaces = [
+    "test"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir "$out"
+    cp -r dist/. "$out"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "very cool package that does cool things";
+    mainProgram = "cool";
+  };
+})
+```
+:::
+
+## Variables controlling pnpmBuildHook {#pnpm-build-hook-variables}
+
+### pnpm Exclusive Variables {#pnpm-build-hook-exclusive-variables}
+
+#### `pnpmBuildScript` {#pnpm-build-hook-script}
+
+Controls the script ran to build the package, by default the script is `build`.
+
+#### `pnpmFlags` {#pnpm-build-hook-flags}
+
+Controls flags used for all invocations of pnpm across all hooks local to this derivation.
+
+#### `pnpmBuildFlags` {#pnpm-build-hook-build-flags}
+
+Controls the flags pass only to the pnpm build script invocation.
+
+#### `dontPnpmBuild` {#pnpm-build-hook-dont}
+
+Disables automatically running `pnpmBuildHook`. The build can still be run manually if needed, for example:
+
+```
+{
+  lib,
+  rustPlatform,
+  pnpmBuildHook,
+  pnpmConfigHook,
+  fetchPnpmDeps,
+  emptyDirectory,
+  pnpm_10,
+}:
+let
+  pnpm = pnpm_10;
+in
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "super-fast-application";
+  version = "1.0";
+
+  src = emptyDirectory;
+
+  cargoHash = lib.fakeHash;
+
+  nativeBuildInputs = [
+    pnpmBuildHook
+    pnpmConfigHook
+  ];
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs) pname version src;
+    inherit pnpm;
+    fetcherversion = 3;
+    hash = lib.fakeHash;
+  }
+
+  dontPnpmBuild = true;
+  postBuild = ''
+    pnpmBuildHook
+  '';
+})
+```
+
+### Honored Variables {#pnpm-build-hook-honored-variables}
+
+The following variables are honored by `pnpmBuildHook`.
+
+* [`pnpmRoot`](#javascript-pnpm-sourceRoot)
+* [`pnpmWorkspaces`](#javascript-pnpm-workspaces)
diff --git a/doc/languages-frameworks/javascript.section.md b/doc/languages-frameworks/javascript.section.md
index a9f151372508..9fb6ea662746 100644
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@@ -309,6 +309,8 @@ pnpm is available as the top-level package `pnpm`. Additionally, there are varia
 
 When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The function `fetchPnpmDeps` can create this pnpm store derivation. In conjunction, the setup hook `pnpmConfigHook` will prepare the build environment to install the pre-fetched dependencies store. Here is an example for a package that contains `package.json` and a `pnpm-lock.yaml` files using the fetcher and setup hook above:
 
+There is also the [`pnpmBuildHook`](#pnpm-build-hook) for building packages with `pnpm`, as seen in [](#ex-pnpm-build-hook).
+
 ```nix
 {
   fetchPnpmDeps,
@@ -511,10 +513,10 @@ Changes can include workarounds or bug fixes to existing PNPM issues.
 
 ##### Version history {#javascript-pnpm-fetcherVersion-versionHistory}
 
-Version 3 is the recommended value for new packages. Versions 1 and 2 are deprecated and scheduled for removal in the 26.11 release; existing packages must migrate.
+Version 3 is the minimum supported value. Versions 1 and 2 were removed in the 26.11 release; packages that still use them fail to evaluate and must migrate to `fetcherVersion = 3` (or later) and regenerate their hashes.
 
-- 1: Initial version, nothing special.
-- 2: [Ensure consistent permissions](https://github.com/NixOS/nixpkgs/pull/422975)
+- 1: Initial version, nothing special. (removed in 26.11)
+- 2: [Ensure consistent permissions](https://github.com/NixOS/nixpkgs/pull/422975) (removed in 26.11)
 - 3: [Build a reproducible tarball](https://github.com/NixOS/nixpkgs/pull/469950)
 - 4: [Dump SQLite database to an SQL file](https://github.com/NixOS/nixpkgs/pull/522703)
 
diff --git a/doc/redirects.json b/doc/redirects.json
index 51cb45eaaad8..21e7d9a68d31 100644
--- a/doc/redirects.json
+++ b/doc/redirects.json
@@ -113,6 +113,9 @@
   "ex-pkgs-replace-vars-with": [
     "index.html#ex-pkgs-replace-vars-with"
   ],
+  "ex-pnpm-build-hook": [
+    "index.html#ex-pnpm-build-hook"
+  ],
   "ex-shfmt": [
     "index.html#ex-shfmt"
   ],
@@ -346,6 +349,33 @@
   "pkgs.treefmt.withConfig": [
     "index.html#pkgs.treefmt.withConfig"
   ],
+  "pnpm-build-hook": [
+    "index.html#pnpm-build-hook"
+  ],
+  "pnpm-build-hook-build-flags": [
+    "index.html#pnpm-build-hook-build-flags"
+  ],
+  "pnpm-build-hook-code-snippet": [
+    "index.html#pnpm-build-hook-code-snippet"
+  ],
+  "pnpm-build-hook-dont": [
+    "index.html#pnpm-build-hook-dont"
+  ],
+  "pnpm-build-hook-exclusive-variables": [
+    "index.html#pnpm-build-hook-exclusive-variables"
+  ],
+  "pnpm-build-hook-flags": [
+    "index.html#pnpm-build-hook-flags"
+  ],
+  "pnpm-build-hook-script": [
+    "index.html#pnpm-build-hook-script"
+  ],
+  "pnpm-build-hook-variables": [
+    "index.html#pnpm-build-hook-variables"
+  ],
+  "pnpm-build-hook-honored-variables": [
+    "index.html#pnpm-build-hook-honored-variables"
+  ],
   "preface": [
     "index.html#preface"
   ],
diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index 1df5e6b9a01c..5e674df1f8da 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -29,6 +29,13 @@
 
 - `librest` providing 0.7 ABI was removed. `librest_1_0` providing 1.0 ABI was renamed to `librest` and `librest_1_0` was kept as an alias.
 
+- `fetchPnpmDeps`' `fetcherVersion = 1` and `fetcherVersion = 2` have been
+  removed, as announced in the 26.05 release. Packages still using them now
+  throw an evaluation error and must migrate to `fetcherVersion = 3` (or later)
+  and regenerate their hashes. See the
+  [pnpm `fetcherVersion` section](#javascript-pnpm-fetcherVersion) of the manual
+  for details.
+
 ## Other Notable Changes {#sec-nixpkgs-release-26.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/services/web-apps/weblate.nix b/nixos/modules/services/web-apps/weblate.nix
index 9ab21a8b7e52..f0a1e4b94fdc 100644
--- a/nixos/modules/services/web-apps/weblate.nix
+++ b/nixos/modules/services/web-apps/weblate.nix
@@ -9,6 +9,7 @@ let
   cfg = config.services.weblate;
 
   dataDir = "/var/lib/weblate";
+  cacheDir = "${dataDir}/cache";
   settingsDir = "${dataDir}/settings";
 
   finalPackage = cfg.package.overridePythonAttrs (old: {
@@ -362,6 +363,18 @@ in
       ];
       inherit environment;
       path = weblatePath;
+      # Weblate generates SSH wrappers with some preset options that use the
+      # absolute paths of the ssh and scp binaries internally.
+      # As the wrapper is only regenerated when the generator itself is changed,
+      # this absolute nix store path becomes unusable once ssh is updated and
+      # the path is garbage collected.
+      # As generating the wrappers is a quick operation, simply deleting the
+      # wrapper directory before service start ensures they are up to date.
+      preStart = ''
+        if [ -d "${cacheDir}/ssh" ]; then
+          rm -r "${cacheDir}/ssh"
+        fi
+      '';
       serviceConfig = {
         Type = "notify";
         NotifyAccess = "all";
diff --git a/nixos/modules/system/etc/etc-activation.nix b/nixos/modules/system/etc/etc-activation.nix
index c294a3a6d436..b00c25e37802 100644
--- a/nixos/modules/system/etc/etc-activation.nix
+++ b/nixos/modules/system/etc/etc-activation.nix
@@ -173,5 +173,18 @@
 
     })
 
+    (lib.mkIf (config.system.etc.overlay.enable && !config.system.etc.overlay.mutable) {
+      # Systemd requires /etc/machine-id exists or can be initialized on first
+      # boot. This file should not be part of an image or system config because
+      # it is unique to the machine, so it is initialized at first boot and
+      # persisted in the system state directory, /var/lib/nixos.
+      environment.etc."machine-id".source = lib.mkDefault "/var/lib/nixos/machine-id";
+      boot.initrd.systemd.tmpfiles.settings.machine-id."/sysroot/var/lib/nixos/machine-id".f =
+        lib.mkDefault
+          {
+            argument = "uninitialized";
+          };
+    })
+
   ];
 }
diff --git a/nixos/tests/gocryptfs.nix b/nixos/tests/gocryptfs.nix
index 7474bdd56f23..548f8b424e16 100644
--- a/nixos/tests/gocryptfs.nix
+++ b/nixos/tests/gocryptfs.nix
@@ -14,7 +14,8 @@
       ];
 
       specialisation.fstab-test.configuration = {
-        fileSystems."/plain" = {
+        # This can't be fileSytems, as the qemu machinery doesn't honor it.
+        virtualisation.fileSystems."/plain" = {
           device = "/encrypted";
           fsType = "fuse.gocryptfs";
           options = [
@@ -27,31 +28,24 @@
     };
 
   testScript = ''
+    # Initialize a gocryptfs filesystem and mount it
+    machine.succeed("openssl rand -base64 32 > /tmp/password.txt")
+    machine.succeed("mkdir -p /encrypted /plain")
+    machine.succeed("gocryptfs -init /encrypted  -passfile /tmp/password.txt -quiet")
+    machine.succeed("gocryptfs /encrypted /plain  -passfile /tmp/password.txt -quiet")
 
-    # Generate a password
-    machine.execute("openssl rand -base64 32 > /tmp/password.txt")
+    # Drop a canary file and unmount
+    machine.succeed("echo success > /plain/data.txt")
+    machine.succeed("fusermount -u /plain")
 
-    # Initialize an encrypted vault
-    machine.execute("mkdir -p /encrypted /plain")
-    machine.execute("gocryptfs -init /encrypted  -passfile /password.txt -quiet")
+    # Switch to a specialisation that has this in /etc/fstab
+    machine.succeed("/run/current-system/specialisation/fstab-test/bin/switch-to-configuration switch")
 
-    # Open and mount vault
-    machine.execute("gocryptfs /encrypted /plain  -passfile /tmp/password.txt -quiet")
-
-    machine.execute("echo test > /plain/data.txt")
-    machine.execute("echo test > /tmp/data.txt")
-
-    # Unmount
-    machine.execute("fusermount -u /plain")
-
-    # Switch to the specialisation
-    machine.succeed("/run/current-system/specialisation/fstab-test/bin/switch-to-configuration test")
-
-    # Wait for mount
+    # Wait for mounts
     machine.wait_for_unit("local-fs.target")
 
-    # Check data
-    machine.succeed("diff /plain/data.txt /tmp/data.txt")
+    # Ensure the canary is alive
+    machine.succeed("grep -q success /plain/data.txt")
 
   '';
 }
diff --git a/pkgs/applications/editors/neovim/tests/default.nix b/pkgs/applications/editors/neovim/tests/default.nix
index c7d3bbb29d06..20045b23a10a 100644
--- a/pkgs/applications/editors/neovim/tests/default.nix
+++ b/pkgs/applications/editors/neovim/tests/default.nix
@@ -444,4 +444,51 @@ pkgs.lib.recurseIntoAttrs rec {
   '';
 
   inherit (vimPlugins) corePlugins;
+
+  nvim_require_check_lua_module =
+    let
+      inherit (neovim-unwrapped.lua.pkgs) luaexpat luassert;
+    in
+    vimUtils.buildVimPlugin {
+      pname = "neovim-require-check-lua-module-test";
+      version = "0";
+      src = runCommandLocal "neovim-require-check-lua-module-src" { } ''
+        mkdir -p "$out/lua/require-check-luamods"
+        mkdir -p "$out/plugin"
+        cat > "$out/plugin/require-check-luamods.vim" <<'EOF'
+        let g:require_check_luamods_plugin_loaded = 1
+        EOF
+        cat > "$out/lua/require-check-luamods/init.lua" <<'EOF'
+        if vim.g.require_check_luamods_plugin_loaded ~= 1 then
+          error("plugin script was not sourced")
+        end
+        -- lxp: direct C dependency from luaexpat (package.cpath)
+        require("lxp")
+        -- say: transitive dependency of luassert (package.path closure)
+        require("say")
+        return {}
+        EOF
+      '';
+      requiredLuaModules = [
+        luaexpat
+        luassert
+      ];
+    };
+
+  nvim_require_check_passthru_lua_module =
+    let
+      inherit (neovim-unwrapped.lua.pkgs) luassert;
+    in
+    vimUtils.buildVimPlugin {
+      pname = "neovim-require-check-passthru-lua-module-test";
+      version = "0";
+      src = runCommandLocal "neovim-require-check-passthru-lua-module-src" { } ''
+        mkdir -p "$out/lua/require-check-passthru-luamods"
+        cat > "$out/lua/require-check-passthru-luamods/init.lua" <<'EOF'
+        require("say")
+        return {}
+        EOF
+      '';
+      passthru.requiredLuaModules = [ luassert ];
+    };
 }
diff --git a/pkgs/applications/editors/vim/plugins/hooks/neovim-require-check-hook.sh b/pkgs/applications/editors/vim/plugins/hooks/neovim-require-check-hook.sh
index 56f92e6e1eb9..60e6d6758198 100644
--- a/pkgs/applications/editors/vim/plugins/hooks/neovim-require-check-hook.sh
+++ b/pkgs/applications/editors/vim/plugins/hooks/neovim-require-check-hook.sh
@@ -53,6 +53,12 @@ run_require_checks() {
     local deps="${dependencies[*]}"
     local nativeCheckInputs="${nativeBuildInputs[*]}"
     local checkInputs="${buildInputs[*]}"
+
+    local -a luaPathArgs=()
+    if [ -n "${nvimRequireCheckLuaPath:-}" ] || [ -n "${nvimRequireCheckLuaCPath:-}" ]; then
+        luaPathArgs=(--cmd "lua package.path='${nvimRequireCheckLuaPath:-}'..';'..package.path; package.cpath='${nvimRequireCheckLuaCPath:-}'..';'..package.cpath")
+    fi
+
     set +e
 
     if [ -v 'nvimSkipModule' ]; then
@@ -85,6 +91,7 @@ run_require_checks() {
                 --cmd "set rtp+=$out,${deps// /,}" \
                 --cmd "set rtp+=$out,${nativeCheckInputs// /,}" \
                 --cmd "set rtp+=$out,${checkInputs// /,}" \
+                "${luaPathArgs[@]}" \
                 --cmd "set packpath^=$packPathDir" \
                 --cmd "packadd testPlugin" \
                 --cmd "lua require('$name')"; then
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/difftastic-nvim/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/difftastic-nvim/default.nix
new file mode 100644
index 000000000000..f6b056b1391d
--- /dev/null
+++ b/pkgs/applications/editors/vim/plugins/non-generated/difftastic-nvim/default.nix
@@ -0,0 +1,63 @@
+{
+  vimPlugins,
+  lib,
+  vimUtils,
+  rustPlatform,
+  stdenv,
+  nix-update-script,
+  fetchFromGitHub,
+}:
+let
+  version = "0.0.9";
+  src = fetchFromGitHub {
+    owner = "clabby";
+    repo = "difftastic.nvim";
+    rev = "6041ef0244b3fecf3b7f07de9af8cfbf8dbc4945";
+    hash = "sha256-23NGKhytF3OsLJgdrC51IH/sIGoqe/yBfmPsZKHOMSk=";
+  };
+
+  difftastic-nvim-lib = rustPlatform.buildRustPackage {
+    pname = "difftastic-nvim-lib";
+    inherit version src;
+    cargoHash = "sha256-VSlFlLa4knQ7bH8yFHSKTTtt1cQ76dstlCdWBAtkf1I=";
+    postInstall = ''
+      ln -s $out/lib/libdifftastic_nvim${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/difftastic_nvim.so
+    '';
+    env.RUSTFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-C link-arg=-undefined -C link-arg=dynamic_lookup";
+  };
+in
+vimUtils.buildVimPlugin {
+  pname = "difftastic-nvim";
+  inherit version src;
+  dependencies = [
+    vimPlugins.nui-nvim
+  ];
+
+  postPatch = ''
+    substituteInPlace lua/difftastic-nvim/binary.lua \
+      --replace-fail \
+      'release_dir = plugin_root .. "/target/release"' \
+      "release_dir = '${difftastic-nvim-lib}/lib'"
+  '';
+
+  passthru = {
+    updateScript = nix-update-script {
+      attrPath = "vimPlugins.difftastic-nvim.difftastic-nvim-lib";
+    };
+
+    # needed for the update script
+    inherit difftastic-nvim-lib;
+
+  };
+
+  meta = {
+    description = "Neovim plugin that displays difftastic's structural diffs in a side-by-side view with syntax highlighting";
+    homepage = "https://github.com/clabby/difftastic.nvim/";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+
+    maintainers = with lib.maintainers; [
+      auscyber
+    ];
+  };
+}
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index e2d9bfdb2009..9a2b2e6f6653 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -1372,35 +1372,6 @@ assertNoAdditions {
   diffview-nvim = super.diffview-nvim.overrideAttrs (old: {
     dependencies = [ self.plenary-nvim ];
 
-    nvimSkipModules = [
-      # https://github.com/sindrets/diffview.nvim/issues/498
-      "diffview.api.views.diff.diff_view"
-      "diffview.scene.layouts.diff_2"
-      "diffview.scene.layouts.diff_2_hor"
-      "diffview.scene.layouts.diff_2_ver"
-      "diffview.scene.layouts.diff_3"
-      "diffview.scene.layouts.diff_3_hor"
-      "diffview.scene.layouts.diff_3_mixed"
-      "diffview.scene.layouts.diff_3_ver"
-      "diffview.scene.layouts.diff_4"
-      "diffview.scene.layouts.diff_4_mixed"
-      "diffview.scene.views.diff.diff_view"
-      "diffview.scene.views.file_history.file_history_panel"
-      "diffview.scene.views.file_history.option_panel"
-      "diffview.scene.window"
-      "diffview.ui.panels.commit_log_panel"
-      "diffview.ui.panels.help_panel"
-      "diffview.ui.panel"
-      "diffview.vcs.adapters.git.init"
-      "diffview.vcs.adapters.hg.init"
-      "diffview.vcs.adapter"
-      "diffview.vcs.init"
-      "diffview.vcs.utils"
-      "diffview.job"
-      "diffview.lib"
-      "diffview.multi_job"
-    ];
-
     doInstallCheck = true;
     meta = old.meta // {
       license = lib.licenses.gpl3Plus;
@@ -2788,6 +2759,7 @@ assertNoAdditions {
     dependencies = [ self.plenary-nvim ];
     nvimSkipModules = [
       # E5108: Error executing lua ...vim-2024-06-13/lua/diffview/api/views/diff/diff_view.lua:13: attempt to index global 'DiffviewGlobal' (a nil value)
+      # Requires diffview-nvim's plugin script to be sourced.
       "neogit.integrations.diffview"
       "neogit.popups.diff.actions"
       "neogit.popups.diff.init"
diff --git a/pkgs/applications/editors/vim/plugins/utils/vim-utils.nix b/pkgs/applications/editors/vim/plugins/utils/vim-utils.nix
index d297ffab0114..7d5af312e476 100644
--- a/pkgs/applications/editors/vim/plugins/utils/vim-utils.nix
+++ b/pkgs/applications/editors/vim/plugins/utils/vim-utils.nix
@@ -4,6 +4,7 @@
   stdenv,
   vim,
   vimPlugins,
+  neovim-unwrapped,
   buildEnv,
   symlinkJoin,
   writeText,
@@ -516,35 +517,47 @@ rec {
     drv:
     let
       drv-name = drv.name or "${drv.pname}-${drv.version}";
+      lua = neovim-unwrapped.lua;
     in
-    drv.overrideAttrs (oldAttrs: {
-      name = "vimplugin-${drv-name}";
-      # dont move the "doc" folder since vim expects it
-      forceShare = [
-        "man"
-        "info"
-      ];
-
-      nativeBuildInputs =
-        oldAttrs.nativeBuildInputs or [ ]
-        ++ lib.optionals (stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
-          vimGenDocHook
+    drv.overrideAttrs (
+      finalAttrs: oldAttrs:
+      let
+        getRequiredLuaModules = attrs: attrs.requiredLuaModules or attrs.passthru.requiredLuaModules or [ ];
+        modules = getRequiredLuaModules finalAttrs;
+        luaEnv = lua.withPackages (_: modules);
+      in
+      {
+        name = "vimplugin-${drv-name}";
+        # dont move the "doc" folder since vim expects it
+        forceShare = [
+          "man"
+          "info"
         ];
 
-      doCheck = oldAttrs.doCheck or true;
+        nativeBuildInputs =
+          oldAttrs.nativeBuildInputs or [ ]
+          ++ lib.optionals (stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+            vimGenDocHook
+          ];
 
-      nativeCheckInputs =
-        oldAttrs.nativeCheckInputs or [ ]
-        ++ lib.optionals (stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
-          vimCommandCheckHook
-          # many neovim plugins keep using buildVimPlugin
-          neovimRequireCheckHook
-        ];
+        doCheck = oldAttrs.doCheck or true;
 
-      passthru = (oldAttrs.passthru or { }) // {
-        vimPlugin = true;
-      };
-    });
+        nativeCheckInputs =
+          oldAttrs.nativeCheckInputs or [ ]
+          ++ lib.optionals (stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+            vimCommandCheckHook
+            # many neovim plugins keep using buildVimPlugin
+            neovimRequireCheckHook
+          ];
+
+        nvimRequireCheckLuaPath = lib.optionalString (modules != [ ]) (lua.pkgs.getLuaPath luaEnv);
+        nvimRequireCheckLuaCPath = lib.optionalString (modules != [ ]) (lua.pkgs.getLuaCPath luaEnv);
+
+        passthru = (oldAttrs.passthru or { }) // {
+          vimPlugin = true;
+        };
+      }
+    );
 }
 // lib.optionalAttrs config.allowAliases {
   vimWithRC = throw "vimWithRC was removed, please use vim.customize instead";
diff --git a/pkgs/applications/networking/browsers/chromium/common.nix b/pkgs/applications/networking/browsers/chromium/common.nix
index b935568ffe66..3d4138570f74 100644
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@@ -621,7 +621,7 @@ let
       # clang++: error: unknown argument: '-fno-lifetime-dse'
       ./patches/chromium-147-llvm-22.patch
     ]
-    ++ lib.optionals (chromiumVersionAtLeast "148" && lib.versionOlder llvmVersion "23") [
+    ++ lib.optionals (versionRange "148" "149" && lib.versionOlder llvmVersion "23") [
       # clang++: error: unknown argument: '-fsanitize-ignore-for-ubsan-feature=return'
       (fetchpatch {
         name = "chromium-148-revert-build-Add--fsanitizer=return-config.patch";
@@ -651,7 +651,22 @@ let
         hash = "sha256-jR0G9z2R8VGl2tkB3u0368RyWM1J6qYXqNWwKkYd5zU=";
       })
     ]
-    ++ lib.optionals (chromiumVersionAtLeast "148") [
+    ++ lib.optionals (chromiumVersionAtLeast "149" && lib.versionOlder llvmVersion "23") [
+      # clang++: error: unknown argument: '-fdiagnostics-show-inlining-chain'
+      # clang++: error: unknown argument: '-fsanitize-ignore-for-ubsan-feature=array-bounds'
+      # clang++: error: unknown argument: '-fsanitize-ignore-for-ubsan-feature=return'
+      ./patches/chromium-149-llvm-22.patch
+    ]
+    ++ lib.optionals (chromiumVersionAtLeast "149" && stdenv.hostPlatform.isAarch64) [
+      # [43731/56364] CXX obj/media/gpu/sandbox/sandbox/hardware_video_decoding_sandbox_hook_linux.o
+      # FAILED: [code=1] obj/media/gpu/sandbox/sandbox/hardware_video_decoding_sandbox_hook_linux.o
+      # clang++ -MD -MF obj/media/gpu/sandbox/sandbox/hardware_video_decoding_sandbox_hook_linux.o.d [...]
+      # ../../media/gpu/sandbox/hardware_video_decoding_sandbox_hook_linux.cc:123:9: error: use of undeclared identifier 'ERROR'
+      #   123 |     LOG(ERROR) << "dlopen(radeonsi_dri.so) failed with error: " << dlerror();
+      #       |         ^~~~~
+      ./patches/chromium-149-use-of-undeclared-identifier-ERROR.patch
+    ]
+    ++ lib.optionals (versionRange "148" "149") [
       # ninja: error: '../../third_party/rust-toolchain/bin/rustc', needed by 'phony/default_for_rust_host_build_tools_rust_bin_inputs', missing and no known rule to make it
       (fetchpatch {
         name = "chromium-148-revert-Reland-build-use-tool-inputs-instead-of-siso-config-for-rust-actions.patch";
@@ -792,6 +807,12 @@ let
         mkdir -p third_party/gperf/cipd/bin
         ln -s "${pkgsBuildHost.gperf}/bin/gperf" third_party/gperf/cipd/bin/gperf
       ''
+      # https://chromium-review.googlesource.com/c/chromium/src/+/7719879
+      # ninja: error: '../../third_party/rust-toolchain/bin/rustc', needed by 'phony/default_for_rust_host_build_tools_rust_bin_inputs', missing and no known rule to make it
+      + lib.optionalString (chromiumVersionAtLeast "149") ''
+        mkdir -p third_party/rust-toolchain/bin
+        ln -s "${buildPackages.rustc}/bin/rustc" third_party/rust-toolchain/bin/rustc
+      ''
       +
         lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform && stdenv.hostPlatform.isAarch64)
           ''
@@ -973,7 +994,11 @@ let
     # Mute some warnings that are enabled by default. This is useful because
     # our Clang is always older than Chromium's and the build logs have a size
     # of approx. 25 MB without this option (and this saves e.g. 66 %).
-    env.NIX_CFLAGS_COMPILE = "-Wno-unknown-warning-option -Wno-unused-command-line-argument -Wno-shadow";
+    env.NIX_CFLAGS_COMPILE =
+      "-Wno-unknown-warning-option -Wno-unused-command-line-argument -Wno-shadow"
+      # warning: '_LIBCPP_HARDENING_MODE' macro redefined [-Wmacro-redefined]
+      # because of hardeningDisable = [ "strictflexarrays1" ];
+      + lib.optionalString (chromiumVersionAtLeast "149") " -Wno-macro-redefined";
     env.BUILD_CC = "$CC_FOR_BUILD";
     env.BUILD_CXX = "$CXX_FOR_BUILD";
     env.BUILD_AR = "$AR_FOR_BUILD";
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index c8de6d799966..0cf6a86d4e7a 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,44 +1,44 @@
 {
   "chromium": {
-    "version": "148.0.7778.215",
+    "version": "149.0.7827.53",
     "chromedriver": {
-      "version": "148.0.7778.216",
-      "hash_darwin": "sha256-gsK7Q3rwfQQ0iE5e/st/3gGtU+D8dGsTycffpEejmhw=",
-      "hash_darwin_aarch64": "sha256-zHASbRPnYf2q1qq8FsKnYrLwPjzoGk0tzLxB9SdTXFw="
+      "version": "149.0.7827.53",
+      "hash_darwin": "sha256-JzeQy8O9gcoV195sQrfUV1TclUyAI4lzOcE5+BmgKrM=",
+      "hash_darwin_aarch64": "sha256-nEkMVGUVYP0q9UECGT0ibc2vzjVRIO69dFrYOB05lqg="
     },
     "deps": {
       "depot_tools": {
-        "rev": "41c40cfaec7ee3bf0423c59925d8b23982a601f1",
-        "hash": "sha256-s9uvmYHCJKWnNhztmOPb+OHj/HbGo30PupwT4mHWjnM="
+        "rev": "45dedc4c3b87c982fd846b3dc599b233ed3aff90",
+        "hash": "sha256-Ttklyw6IdNeMExlzeiQg/qsCkTmqVhUJ34MFgYmCWD4="
       },
       "gn": {
-        "version": "0-unstable-2026-04-01",
-        "rev": "6e8dcdebbadf4f8aa75e6a4b6e0bdf89dce1513a",
-        "hash": "sha256-BTPD8WM1pVAMkFDlHekMdWFGyf63KdhKkKwsqikqoBQ="
+        "version": "0-unstable-2026-05-01",
+        "rev": "1740f5c25bcac5a650ee3d1c1ec22bfa25fcd756",
+        "hash": "sha256-oFs7fZAZEs/gQ7X1A4uigo9+Y+iEN9sMMQYwAjEuD04="
       },
-      "npmHash": "sha256-JuVcY8iFRDWcPcP4Pg+qm5rnTXkiVfNsqSkXbDWqsE8="
+      "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "7c855c70efe3f6ade6663c1520913fa7f63a0b2b",
-        "hash": "sha256-uDVYgSjxQ+xw8DHVd5UNkqnUrJ6P5ZWxL2tZToBhgQg=",
+        "rev": "9d2c8156a72129edca4785abb98866fad60ea338",
+        "hash": "sha256-RPFeHTWAeJUzbWU7QyRPmT3sqf3bAEuJ7/IJ3TP40pA=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/clang/tools/clang-format.git",
-        "rev": "c2725e0622e1a86d55f14514f2177a39efea4a0e",
-        "hash": "sha256-f+BbQ6xIubloSzx/MhPSZ8ymCskmS+9+epDGtPjZqXc="
+        "rev": "6eddfb5ec5f92127a531eda66c568d3a11e7ec11",
+        "hash": "sha256-Cm6BOOlEyD0kdYxMSmk6Fj1Dnfs3zCzXsm+BOXgBme0="
       },
       "src/third_party/compiler-rt/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt.git",
-        "rev": "76287b5da8e155135536c8e3a67432d97d74fe3a",
-        "hash": "sha256-q6syHriTR8TCQSqTWbbAkVVK0a/i4wojdEGN7sWGxUY="
+        "rev": "0408cce08083f3d81379ed7d9f5bd26c03e1495b",
+        "hash": "sha256-kR5osTmp2girvNRVHzEKMZDCelgux9RrRuMoXMCRSGM="
       },
       "src/third_party/libc++/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git",
-        "rev": "7ab65651aed6802d2599dcb7a73b1f82d5179d05",
-        "hash": "sha256-7O/X2JW8ghkPTjmFZmT9cgG3Ui5zk3gUb436KlPww34="
+        "rev": "be1c391acca009d8d80535ce924e3d285451cdfa",
+        "hash": "sha256-zKb9PUiiBvhVhWnbQwR8uOFJ9gt3uYmfJ4M9ijpgKRc="
       },
       "src/third_party/libc++abi/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git",
@@ -47,13 +47,13 @@
       },
       "src/third_party/libunwind/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git",
-        "rev": "6ca46ff28e3578c57cbead6f233969eb3dabc176",
-        "hash": "sha256-JW4kqpVTCFDN4WZE2S5gEkX1O7eDycl+adm3KGlUoTU="
+        "rev": "71192be150bbe04d87bb5298512d464e38d2f654",
+        "hash": "sha256-PxXemxdWZoEavKDOovi67IVWEr2YW8YK2F0LXM3LZPw="
       },
       "src/third_party/llvm-libc/src": {
         "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git",
-        "rev": "2a826f2fda3cf8d75b47cbc3bb1d9b244f13a6ab",
-        "hash": "sha256-OWe2lAT5XbADWuxHgg53lZiU0My/ys86FEXvn4zlVx0="
+        "rev": "deb95b5e48e875920a2eaae799c8dbcd76a6a4db",
+        "hash": "sha256-oAgIT3+vjBrX86jgi/Pb0SCyco0lozjBjXlrKm6i56M="
       },
       "src/chrome/test/data/perf/canvas_bench": {
         "url": "https://chromium.googlesource.com/chromium/canvas_bench.git",
@@ -72,8 +72,8 @@
       },
       "src/docs/website": {
         "url": "https://chromium.googlesource.com/website.git",
-        "rev": "44319eca109f9678595924a90547c1f6650d8664",
-        "hash": "sha256-Trkan7bzRaLFlTkRfNGh7ssoZ3QpMh+mxQacsSM+d2I="
+        "rev": "c9a9ad55e9ec9934244e58a5a8cab9a295526010",
+        "hash": "sha256-2GKWEnlExrTzoIYMxeP4n2klLLT/phB5ZVJ5Nj3/aoY="
       },
       "src/media/cdm/api": {
         "url": "https://chromium.googlesource.com/chromium/cdm.git",
@@ -82,8 +82,8 @@
       },
       "src/net/third_party/quiche/src": {
         "url": "https://quiche.googlesource.com/quiche.git",
-        "rev": "21ffbe4c7b717d00d2d768c259b5b330fd754ac3",
-        "hash": "sha256-yKMmfdSBvbB3T042TJbZ1Mw+y0kyfHP0knQVFWAFPTg="
+        "rev": "fafc2fe9efc9f2e28a0815229fc14ca30c266ba8",
+        "hash": "sha256-4UmjE41MOFCBa3APDMyyJwkeV6LhHl5UsMxZpPRDsRY="
       },
       "src/testing/libfuzzer/fuzzers/wasm_corpus": {
         "url": "https://chromium.googlesource.com/v8/fuzzer_wasm_corpus.git",
@@ -92,8 +92,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "a101e2d1db6da927325273566fe8f5404fa3a9bd",
-        "hash": "sha256-uIqodvHxEY9xNse2IHNns2Mz9zLAUZSSIN7pAXB8cPs="
+        "rev": "ded782bca9d5f165d1c4a70124cdc5384043a8b3",
+        "hash": "sha256-7+Hhx/V554hO3zzGuIZswkaRVDElz7ost7vbnf2wyZc="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -102,18 +102,18 @@
       },
       "src/third_party/angle/third_party/rapidjson/src": {
         "url": "https://chromium.googlesource.com/external/github.com/Tencent/rapidjson",
-        "rev": "781a4e667d84aeedbeb8184b7b62425ea66ec59f",
-        "hash": "sha256-btUl1a/B0sXwf/+hyvCvVJjWqIkXfVYCpHm3TeBuOxk="
+        "rev": "24b5e7a8b27f42fa16b96fc70aade9106cf7102f",
+        "hash": "sha256-oHHLYRDMb7Y/k0CwsdsxPC5lglr2IChQi0AiOMiFn78="
       },
       "src/third_party/angle/third_party/VK-GL-CTS/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/VK-GL-CTS",
-        "rev": "f52e89f885064b9109501bca16c813bb29389993",
-        "hash": "sha256-3jx4QVR9nB3WggfrORGJGifmJQhAYVSPusa7RlR16qg="
+        "rev": "3fe33a325af90c1c820b1e8109f11ea0f4b60c9b",
+        "hash": "sha256-JgOdlwtjC5HiCWBAaeM+Ffp9KlbI7+erT0ZRZBlWxXI="
       },
       "src/third_party/anonymous_tokens/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/anonymous-tokens.git",
-        "rev": "fdff40da0398d2c229308aed169345f6ff1a150f",
-        "hash": "sha256-eJP45x3vXOG1rWvRl/0H0c2IV7nQ/9dYjAzJGHHszdc="
+        "rev": "208ea23596884f6d86476ea88b64e7931cdec08a",
+        "hash": "sha256-HLUX0mUzA3xcXbw71sIxFBNEkL8x86urcdJH2Yuuy04="
       },
       "src/third_party/readability/src": {
         "url": "https://chromium.googlesource.com/external/github.com/mozilla/readability.git",
@@ -127,28 +127,23 @@
       },
       "src/third_party/dav1d/libdav1d": {
         "url": "https://chromium.googlesource.com/external/github.com/videolan/dav1d.git",
-        "rev": "d69235dd804b24c04ed05639cffcc912cd6cfd75",
-        "hash": "sha256-iKq6TYscIBK4ydv+0msNV3tcs82Ljk5ZNr954Qv2lII="
+        "rev": "5cfc3832687e3229117203905faf5425ac6bc0d7",
+        "hash": "sha256-MWDDrb8P5AIFszY0u5gCrK+kZlbYffIt9Y1b/thXL7I="
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "78a9030d63048d832c4b822839bffe38ad4f20e5",
-        "hash": "sha256-ZknkLN64TYAN5j9WsgtKlRBrAc3iCM084zpc8Zui8Ts="
+        "rev": "1815a06195d9c74ac737a96f87c05111926e04f8",
+        "hash": "sha256-71KbW0w60VB67+HM48WpOo18hrVId4/4QBDl+xl5pgo="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
-        "rev": "043378876a67b092f5d0d3d9748660121a336dd3",
-        "hash": "sha256-4QSD1/uxWfYZPMjShB0h639eqAfuBRXAVfOm6BbZCBs="
+        "rev": "b00e6a8a88ad1b60c0a045e696301deb92c9a13e",
+        "hash": "sha256-uVJOf+D3bgS/CyEL1y52gvkml6VUTtNPMTU6X5/XyS4="
       },
-      "src/third_party/dawn/third_party/dxc": {
+      "src/third_party/dawn/third_party/directx-shader-compiler/src": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectXShaderCompiler",
-        "rev": "eb67a9085c758516d940e1ce3fed0acfb6518209",
-        "hash": "sha256-z+yIuVweIyLdOiZDRfSppjTRoYq8S93+JNUla4Umot8="
-      },
-      "src/third_party/dawn/third_party/dxheaders": {
-        "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectX-Headers",
-        "rev": "980971e835876dc0cde415e8f9bc646e64667bf7",
-        "hash": "sha256-0Miw1Cy/jmOo7bLFBOHuTRDV04cSeyvUEyPkpVsX9DA="
+        "rev": "d73829d4e677ef00931e8e57de6d544396ab46cb",
+        "hash": "sha256-BIXNgVeF5x3BZWFWZ1Gz+zpNSOEl+hZWB0GgMEaNS2w="
       },
       "src/third_party/dawn/third_party/directx-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectX-Headers",
@@ -157,33 +152,33 @@
       },
       "src/third_party/dawn/third_party/OpenGL-Registry/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/OpenGL-Registry",
-        "rev": "5bae8738b23d06968e7c3a41308568120943ae77",
-        "hash": "sha256-K3PcRIiD3AmnbiSm5TwaLs4Gu9hxaN8Y91WMKK8pOXE="
+        "rev": "9cb90ca4902d588bef3c830fbb1da484893bd5fb",
+        "hash": "sha256-mWVORjrbNFINr5WKAIDVnPs2T+96vkxWqZdJwp8oT9I="
       },
       "src/third_party/dawn/third_party/EGL-Registry/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/EGL-Registry",
-        "rev": "7dea2ed79187cd13f76183c4b9100159b9e3e071",
-        "hash": "sha256-Z6DwLfgQ1wsJXz0KKJyVieOatnDmx3cs0qJ6IEgSq1A="
+        "rev": "3d7796b3721d93976b6bfe536aa97bbc4bce8667",
+        "hash": "sha256-csSV8Yp0p0UIrodbX5793uO5iZMjQfy+0D2wPif2+Fw="
       },
       "src/third_party/dawn/third_party/webgpu-cts": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts",
-        "rev": "09fdb847d90d0b5bfe57068ce2eb9283cb77fc7f",
-        "hash": "sha256-eTAwnTiAHq8rmbw7u9nAwSuAlS5adStUJKfITlYkcgU="
+        "rev": "5c6b119c4fa0d9059c45f7637df1fe26fc80a6e4",
+        "hash": "sha256-9DAdS2u2YtrCFJu0KTuwRJjTUNexFxdmnn7LkwQ+KiQ="
       },
       "src/third_party/dawn/third_party/webgpu-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webgpu-native/webgpu-headers",
-        "rev": "7d3186c3dd2c708703524027b46b8703534ab3cc",
-        "hash": "sha256-yE3/mfhqc7YtVNg4f/nrUpuRUGRjOzdwl++vPvd+mvc="
+        "rev": "dc16b3e531cf4f31be54236d1a3e988ba5f295a2",
+        "hash": "sha256-tFn3OChLKsYz52Vml7WVgqyrK7SI6WR1Z2C2vvFfakI="
       },
       "src/third_party/highway/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/highway.git",
-        "rev": "84379d1c73de9681b54fbe1c035a23c7bd5d272d",
-        "hash": "sha256-HNrlqtAs1vKCoSJ5TASs34XhzjEbLW+ISco1NQON+BI="
+        "rev": "2607d3b5b0113992fe84d3848859eae13b3b52c1",
+        "hash": "sha256-YUYZO9KLffczjwIz3mBBceD6oM1giLCFLDHgDCevdRA="
       },
       "src/third_party/google_benchmark/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/benchmark.git",
-        "rev": "188e8278990a9069ffc84441cb5a024fd0bede37",
-        "hash": "sha256-GfqY2d+Nd7ovNrXxzTRm/AYWj7GuxIO6FawzUEzwOVA="
+        "rev": "8abf1e701fbd88c8170f48fe0558247e2e5f8e7d",
+        "hash": "sha256-M8QkA8+bckoRjlcVneYXNetmPEWEvmWy/mca5JA40Ho="
       },
       "src/third_party/libpfm4/src": {
         "url": "https://chromium.googlesource.com/external/git.code.sf.net/p/perfmon2/libpfm4.git",
@@ -192,13 +187,13 @@
       },
       "src/third_party/boringssl/src": {
         "url": "https://boringssl.googlesource.com/boringssl.git",
-        "rev": "d8be2b4a71155bf82da092ef543176351eeb59ff",
-        "hash": "sha256-fZc95YrREDbf0YcO6zahIjdX6TcRJANcH9MrkLIIIHw="
+        "rev": "65818adf16411ca394625f5747a1af28faf95d2c",
+        "hash": "sha256-tcTTzQnBp8Od1jdDMrFoCr9bnW0OCjGqUjH3QMnusmo="
       },
       "src/third_party/breakpad/breakpad": {
         "url": "https://chromium.googlesource.com/breakpad/breakpad.git",
-        "rev": "8be0e3114685fcc1589561067282edf75ea1259a",
-        "hash": "sha256-igcX5XwacIwoGbqIcZKwlJYpRWl9Uc32WdpXyHO7UVA="
+        "rev": "afa2870e449ef33ad41545e7670c574cf70926a4",
+        "hash": "sha256-+N6FPtSiLQmNqf5+x5XDSksrRq/YDVSMVx5Rv1PGjfI="
       },
       "src/third_party/cast_core/public/src": {
         "url": "https://chromium.googlesource.com/cast_core/public",
@@ -207,13 +202,13 @@
       },
       "src/third_party/catapult": {
         "url": "https://chromium.googlesource.com/catapult.git",
-        "rev": "4f1d71f6841d210b3a06ab3ef2e2ed679af0ee56",
-        "hash": "sha256-aHlf8gw3KxbKoyyajP4w586iYybx7HSkcKtLcZIgiDE="
+        "rev": "6e4188cabb4f37314ea41e9adfcb2cf9b64e2641",
+        "hash": "sha256-/kleYYllR22KjxHT2gTMGf6LEUZ1Ud7j593fIIAgqAA="
       },
       "src/third_party/catapult/third_party/webpagereplay": {
         "url": "https://chromium.googlesource.com/webpagereplay.git",
-        "rev": "be48b5e3387780790ecc7723434b6ea6733bcc33",
-        "hash": "sha256-KcFUlQMltsMm4WlTVMLzZXfrvu67ffkKjmBcruwZye0="
+        "rev": "b7ac48f52cd298e966a76eb054412915c3e445d4",
+        "hash": "sha256-smtwB6vzLgCAePz0jNfrpm8TxrxBnBkigLxERhxUEvE="
       },
       "src/third_party/ced/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/compact_enc_det.git",
@@ -232,13 +227,13 @@
       },
       "src/third_party/cpu_features/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/cpu_features.git",
-        "rev": "936b9ab5515dead115606559502e3864958f7f6e",
-        "hash": "sha256-E8LoVzhe+TAmARWZTSuINlsVhzpUJMxPPCGe/dHZcyA="
+        "rev": "d3b2440fcfc25fe8e6d0d4a85f06d68e98312f5b",
+        "hash": "sha256-IBJc1sHHh4G3oTzQm1RAHHahsEECC+BDl14DHJ8M1Ys="
       },
       "src/third_party/cpuinfo/src": {
         "url": "https://chromium.googlesource.com/external/github.com/pytorch/cpuinfo.git",
-        "rev": "7607ca500436b37ad23fb8d18614bec7796b68a7",
-        "hash": "sha256-LnLtCMMRg+DwB7MijBdt/tmCKD/zN5y2oTgXlYw3hTg="
+        "rev": "3681f0ce1446167d01dfe125d6db96ba2ac31c3c",
+        "hash": "sha256-PhWbzQgZSUb3eVyx+JTSnxVOAC2WzL2Dw1I9/6LEIsw="
       },
       "src/third_party/crc32c/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/crc32c.git",
@@ -247,28 +242,28 @@
       },
       "src/third_party/cros_system_api": {
         "url": "https://chromium.googlesource.com/chromiumos/platform2/system_api.git",
-        "rev": "c27a09148de373889e5d2bf616c4e85a68050ae2",
-        "hash": "sha256-a/mAa1+if6B1FHe9crO8PDpc3o8M+CeIuXjXT0lwZOY="
+        "rev": "7ecd2b41460516ecd7b7d6e5c298db25e1436b6f",
+        "hash": "sha256-ehbAXv4DZStWDMC3iOjmWkAc4PhAamyI4C9bdXO7FfA="
       },
       "src/third_party/crossbench": {
         "url": "https://chromium.googlesource.com/crossbench.git",
-        "rev": "c179f7919aade97c5cff64d14b9171736e7aaef9",
-        "hash": "sha256-Hxazf58z9imnGO1aj2NRtsQ+BYrfAuIuZscADpr1NVI="
+        "rev": "cecd70a5f49f777f603d38d11ac1f66c03c3e8af",
+        "hash": "sha256-zLwIY8fQVebkfN4KFMbitZODhmiN65JK2s9IG/5Cd+o="
       },
       "src/third_party/crossbench-web-tests": {
         "url": "https://chromium.googlesource.com/chromium/web-tests.git",
-        "rev": "b19e4e52c33fb8a105c3fc99598b0b9b4bc59752",
-        "hash": "sha256-7vCQw91L2c97dnVdrJ53zL8hi0KZffDJJjk7GaG3b/U="
+        "rev": "baf176aadedccc44329231d5dd40346874c2a63e",
+        "hash": "sha256-oY1/uGB6ykePIklWe35rmJWsnpu/wjkER4TJeP4TTdw="
       },
       "src/third_party/depot_tools": {
         "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git",
-        "rev": "41c40cfaec7ee3bf0423c59925d8b23982a601f1",
-        "hash": "sha256-s9uvmYHCJKWnNhztmOPb+OHj/HbGo30PupwT4mHWjnM="
+        "rev": "45dedc4c3b87c982fd846b3dc599b233ed3aff90",
+        "hash": "sha256-Ttklyw6IdNeMExlzeiQg/qsCkTmqVhUJ34MFgYmCWD4="
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "1fb83ff123c44ab59a480056c8c1ba3d33c2caf0",
-        "hash": "sha256-S6agM7HMZ2g2W6e9tYdLSXr0Lc6zeQF9hAYLIeImAYQ="
+        "rev": "33c2f401a9c8ddad2159eb0ab83aa244a5247361",
+        "hash": "sha256-M9aULI+HECgA0ptAG47OPK0QuB+xzmb29iOtJ3whpB0="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -282,8 +277,8 @@
       },
       "src/third_party/eigen3/src": {
         "url": "https://chromium.googlesource.com/external/gitlab.com/libeigen/eigen.git",
-        "rev": "a3074053a614df7a3896cb4edbcba40222a5f549",
-        "hash": "sha256-9AHpSqemqdwXoMiP3hH1YuEd3+nrudeVGTpInw+8BU4="
+        "rev": "2cf9891537250255f50df5109ffe9e700e2a73de",
+        "hash": "sha256-1bu1Y9itHIKcwY5J0sF08DSyfElLHiZ6SRsNZkFjz8o="
       },
       "src/third_party/farmhash/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/farmhash.git",
@@ -292,18 +287,18 @@
       },
       "src/third_party/fast_float/src": {
         "url": "https://chromium.googlesource.com/external/github.com/fastfloat/fast_float.git",
-        "rev": "cb1d42aaa1e14b09e1452cfdef373d051b8c02a4",
-        "hash": "sha256-CG5je117WYyemTe5PTqznDP0bvY5TeXn8Vu1Xh5yUzQ="
+        "rev": "05087a303dad9c98768b33c829d398223a649bc6",
+        "hash": "sha256-ZQm8kDMYdwjKugc2vBG5mwTqXa01u6hODQc/Tai2I9A="
       },
       "src/third_party/federated_compute/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google-parfait/federated-compute.git",
-        "rev": "eb170f645b270c7979edb863fd2cf8edab2b2fd1",
-        "hash": "sha256-Cp0WQBbqWvPdrKCMQhH4Z6zl6YlIPLjafWZEwdkYWlc="
+        "rev": "3112513bf1a80872311e7718c5385f535a819b89",
+        "hash": "sha256-jnG3PCxjaYcClRgzOfIkHbbD3xU9TDLyQR3VZUwHIgU="
       },
       "src/third_party/ffmpeg": {
         "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git",
-        "rev": "b5e18fb9da84e26ceef30d4e4886696bf59337c0",
-        "hash": "sha256-JHAicFKBvtkwmZPRBKYPT6JVqYqF8hyXxU0H7kfgCBs="
+        "rev": "f45bab87ce4c5fafc67fd53fcde777578d01bfa0",
+        "hash": "sha256-fsZSqmG6vFOPJYuBgG6OSWkzRu27B3mv/PqAP8s4ARk="
       },
       "src/third_party/flac": {
         "url": "https://chromium.googlesource.com/chromium/deps/flac.git",
@@ -332,8 +327,8 @@
       },
       "src/third_party/freetype/src": {
         "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git",
-        "rev": "6d9fc45fc4bca8aef0b8f65592520673638c3334",
-        "hash": "sha256-A21ONLz8HxoBkOL/jHfs5YwePmOnFyNdlNYSJa9wers="
+        "rev": "b6bcd2177f72bb4842c7701d7b7f633bb3fc951a",
+        "hash": "sha256-TUz3yUD9HxqUMCOpLk74rEf8J0tMTh4ZCuD94AD4+q4="
       },
       "src/third_party/fxdiv/src": {
         "url": "https://chromium.googlesource.com/external/github.com/Maratyszcza/FXdiv.git",
@@ -342,18 +337,13 @@
       },
       "src/third_party/harfbuzz/src": {
         "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git",
-        "rev": "67bb413f586f36ba44d740319cb7a28b3d283ea6",
-        "hash": "sha256-WCPEkbiiU8dENM+ik0KokW9Uxmz0xlsRFVVPPOEOZXw="
+        "rev": "e6741e2205309752839da60ff075b7fa2e7cddd3",
+        "hash": "sha256-XjUuY17fcZi+dIZFojq+eDsDVrBxtAWRydPdudt56+8="
       },
       "src/third_party/ink/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ink.git",
-        "rev": "9d5367423281a8fcf5bc1c418e20477a992b270a",
-        "hash": "sha256-uDaK/cDA52Cn+ioPW2bXAJze1eW8TK3xF7+bl/Ylh6Y="
-      },
-      "src/third_party/ink_stroke_modeler/src": {
-        "url": "https://chromium.googlesource.com/external/github.com/google/ink-stroke-modeler.git",
-        "rev": "da42d439389c90ec7574f0381ec53e7f5be0c2eb",
-        "hash": "sha256-W5HgVe0v9O/EuhpKMHp83PLq4p6cuBul3QUGLYdF6rY="
+        "rev": "a988417b6d0b1ea03fb0b40269fbc42313acc6fd",
+        "hash": "sha256-6O+N/ULn8sqsdgFw7VZ7TMjWvCAZbYo398PruPScU/k="
       },
       "src/third_party/instrumented_libs": {
         "url": "https://chromium.googlesource.com/chromium/third_party/instrumented_libraries.git",
@@ -417,8 +407,8 @@
       },
       "src/third_party/fuzztest/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git",
-        "rev": "800c545cf9d6e9c01328a1974f93a7e6564a74fd",
-        "hash": "sha256-Pvz+CWTBcWE0N0yfNGZhXDgUrGeIaCNfEjP1jYmF6G0="
+        "rev": "e24a91020ab19c3d6f590bd0911b7acb492f81be",
+        "hash": "sha256-wFjuvJzGEaal+pIo5UtkdLHYTpoWxRE6Vf5OGLObGQk="
       },
       "src/third_party/domato/src": {
         "url": "https://chromium.googlesource.com/external/github.com/googleprojectzero/domato.git",
@@ -432,13 +422,13 @@
       },
       "src/third_party/libaom/source/libaom": {
         "url": "https://aomedia.googlesource.com/aom.git",
-        "rev": "343cee0a952f8c7d329e59ff3ac2c8bdbe70ec6a",
-        "hash": "sha256-H8Eu3BiUIiZcyReGDyFq9UvjdMJOX00ERjru8+I0zL8="
+        "rev": "33dba9e12a9f12e737eaa7c2624e8c580950a89a",
+        "hash": "sha256-01DbV0kQFg1yyFpVeo82KBoZHhizA7xnZ1qOuu4HTcs="
       },
       "src/third_party/crabbyavif/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git",
-        "rev": "7466a44ac80893803d4a7168b98dc6cd02d1fe2d",
-        "hash": "sha256-x1MRNtGLmwlRNenoQKz2Bgm3J5eHlNiJZtzhT9lttmk="
+        "rev": "c433c9a32320aed983e4106931596fbbae3f77ee",
+        "hash": "sha256-yw1cXB6s6biD2vj2K/3sVbKiaNK7bt+NkbQovbYlJ2Q="
       },
       "src/third_party/nearby/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/nearby-connections.git",
@@ -492,8 +482,8 @@
       },
       "src/third_party/cros-components/src": {
         "url": "https://chromium.googlesource.com/external/google3/cros_components.git",
-        "rev": "fb512780dcc5ba4b5be9e8a3118919002077c760",
-        "hash": "sha256-7wx73HZ6aqXQvLxwX6XnJAPefi/t47gIhvDH3FRT1j4="
+        "rev": "e580888fcc1c108e25c218ccf8b7a4372de18d57",
+        "hash": "sha256-p0Wfvhg/j8v9xL9Pueo7xPVHBKowOLI00AeIZXPQw4k="
       },
       "src/third_party/libdrm/src": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/libdrm.git",
@@ -520,20 +510,20 @@
         "rev": "9700847afb92cb35969bdfcbbfbbb74b9c7b3376",
         "hash": "sha256-EI/uaHXe0NlqdEw764q0SjerThYEVLRogUlmrsZwXnY="
       },
-      "src/third_party/libphonenumber/dist": {
+      "src/third_party/libphonenumber/src": {
         "url": "https://chromium.googlesource.com/external/libphonenumber.git",
-        "rev": "9d46308f313f2bf8dbce1dfd4f364633ca869ca7",
-        "hash": "sha256-ZbuDrZEUVp/ekjUP8WO/FsjAomRjeDBptT4nQZvTVi4="
+        "rev": "ade546d8856475d0493863ee270eb3be9628106b",
+        "hash": "sha256-cLtsM35Ir3iG3j8+Cy2McL1ysRB0Y1PXealAKl05Twg="
       },
       "src/third_party/libprotobuf-mutator/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/libprotobuf-mutator.git",
-        "rev": "7bf98f78a30b067e22420ff699348f084f802e12",
-        "hash": "sha256-EaEC6R7SzqLw4QjEcWXFXhZc84lNBp6RSa9izjGnWKE="
+        "rev": "c1c950eae0440c3808f2b8bd7c57d0c6a42c1a90",
+        "hash": "sha256-Su1SPr/GEFi7/N8/HrFkVbGfWH0vYdcJ5/on8zLMcyU="
       },
       "src/third_party/libsrtp": {
         "url": "https://chromium.googlesource.com/chromium/deps/libsrtp.git",
-        "rev": "e8383771af8aa4096f5bcfe3743a5ea128f88a9a",
-        "hash": "sha256-xC//VEFrI94nCkyLnRa6uQ+hJQqe41v0Qjm4LJ7K84I="
+        "rev": "cd5d177bf1fde755ddb4c7f0d9ff7693f8b49e5e",
+        "hash": "sha256-6tIbthIcUw58AgaNzvSenZPp/e5vHVTp5K2bpPF+Zg0="
       },
       "src/third_party/libsync/src": {
         "url": "https://chromium.googlesource.com/aosp/platform/system/core/libsync.git",
@@ -547,13 +537,13 @@
       },
       "src/third_party/libvpx/source/libvpx": {
         "url": "https://chromium.googlesource.com/webm/libvpx.git",
-        "rev": "47ac1ec7f3de7d7cb3d070844c427c8f1fa9d6fc",
-        "hash": "sha256-RyYnkLYafiS6kQKeOmzohtxFRXudDzgEmQkG+qKHozc="
+        "rev": "640d4ce27ba918783e28a0da46a8a37abe4a65b6",
+        "hash": "sha256-uCa/MEfw2s05kK91uubi/TqztHulwattzt1vfr0LR4E="
       },
       "src/third_party/libwebm/source": {
         "url": "https://chromium.googlesource.com/webm/libwebm.git",
-        "rev": "b7a1e4767fbb02ad467f45ba378e858e897028da",
-        "hash": "sha256-Lzfs15Us8MDDQYvLRVf6xKg9A76aXPnTukx/A8Mf7rw="
+        "rev": "6184f4484a826724b5293837134ab9492261b941",
+        "hash": "sha256-zXPuisCv2KkGQq23qTNhHeXpyCClUIeyjHra08DHJIw="
       },
       "src/third_party/libwebp/src": {
         "url": "https://chromium.googlesource.com/webm/libwebp.git",
@@ -562,8 +552,8 @@
       },
       "src/third_party/libyuv": {
         "url": "https://chromium.googlesource.com/libyuv/libyuv.git",
-        "rev": "30809ff64a9ca5e45f86439c0d474c2d3eef3d05",
-        "hash": "sha256-DW7PuRqA1x0K8/uJbxBJ4Cn9YEPFhZ9vhuGVVyGKK98="
+        "rev": "a7849e8a5e9c996bef2332efae897e7301055a20",
+        "hash": "sha256-ftOTwWULKNplqjQQ9oM9t+PU3S6/ySDOBoE5E/HWuHg="
       },
       "src/third_party/lss": {
         "url": "https://chromium.googlesource.com/linux-syscall-support.git",
@@ -582,13 +572,13 @@
       },
       "src/third_party/nasm": {
         "url": "https://chromium.googlesource.com/chromium/deps/nasm.git",
-        "rev": "45252858722aad12e545819b2d0f370eb865431b",
-        "hash": "sha256-0KsHYi76IaVNwk0dBhem2AnUXd9PpeS+jUsY+zPmeJ8="
+        "rev": "358842b6b7dd69b2ed635bef17f941e030a05e5f",
+        "hash": "sha256-YwjwubijMZ9OvYeMUVMSunWZ2VCuqUFEOyv/MK/oojc="
       },
       "src/third_party/neon_2_sse/src": {
         "url": "https://chromium.googlesource.com/external/github.com/intel/ARM_NEON_2_x86_SSE.git",
-        "rev": "662a85912e8f86ec808f9b15ce77f8715ba53316",
-        "hash": "sha256-4OzG4wIPwnKbFD9LG+stxHt5O4qB85ZIXVeSrNqDAyM="
+        "rev": "ed59be8546632d5126ff69c87122ae5de20ffe4f",
+        "hash": "sha256-ydHSMPJS+axvW7KIR/9SLWNFq/lP67dpg9Yt7shLCng="
       },
       "src/third_party/openh264/src": {
         "url": "https://chromium.googlesource.com/external/github.com/cisco/openh264",
@@ -597,8 +587,8 @@
       },
       "src/third_party/openscreen/src": {
         "url": "https://chromium.googlesource.com/openscreen",
-        "rev": "448a19d1f24e0f8ce85ad0c1c6a50cf370ae69d7",
-        "hash": "sha256-hRDFnoqAH4HoWZ3oTWlzNge2nwlxpUC/GEq0MQVzBw8="
+        "rev": "684bcd767271a21f3e5d475b17a0fd862f16c65e",
+        "hash": "sha256-Yjz2E1/h+zp7L2x0zE0l+ktQIiSrJ4ZknXOhaVPKQVE="
       },
       "src/third_party/openscreen/src/buildtools": {
         "url": "https://chromium.googlesource.com/chromium/src/buildtools",
@@ -612,13 +602,13 @@
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "72ea487e4399c44c3a53a48b104f9612ca772008",
-        "hash": "sha256-0VgmDPyF5k81nBXdo88CcIIbz6XRhaiADnG8gwDGZZk="
+        "rev": "74d747ce1d383caca3ec0e604d77bac35ccd1e58",
+        "hash": "sha256-qMY6L93hlnMgGZ5Blk5ldDnI/LUXYyuk+b7FXCiVV6s="
       },
       "src/third_party/perfetto": {
         "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
-        "rev": "46432bb2a7a60e10fcee516f1692e6846d098a8d",
-        "hash": "sha256-jVih4xWota4SZQi4yEtaIP+4qgD03OsELt2aaulIXik="
+        "rev": "846203c4b3b25f834a0bebc101fa8e1b8f9d0ca9",
+        "hash": "sha256-YOgOau9vNrOOqyUf6WylI/oQ2drCxoW7jnrHt7fAfQM="
       },
       "src/third_party/protobuf-javascript/src": {
         "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript",
@@ -627,8 +617,8 @@
       },
       "src/third_party/pthreadpool/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/pthreadpool.git",
-        "rev": "9003ee6c137cea3b94161bd5c614fb43be523ee1",
-        "hash": "sha256-Es9QNblzo5b+x4K7myQJwIiUKvqyP16QExWPhGqqDO8="
+        "rev": "a56dcd79c699366e7ac6466792c3025883ff7704",
+        "hash": "sha256-WfyuPfII4eSmLskZV0TAcu4K6OyW38TjkDHm+VUx5eY="
       },
       "src/third_party/pyelftools": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git",
@@ -657,13 +647,13 @@
       },
       "src/third_party/search_engines_data/resources": {
         "url": "https://chromium.googlesource.com/external/search_engines_data.git",
-        "rev": "2ecec7b3a56bcb5d7a4a1fc9bc71d7e1cda2a8d1",
-        "hash": "sha256-UPP47dgdXxr+LPvTcEc6gi89OxmvdKD3CdwV4wKXvwQ="
+        "rev": "2345fee6ce4ae24d9c365d5c0884ece593c55c67",
+        "hash": "sha256-5qkra6FURaMvEOk+ZKMRH1hc8ixEnk3u4rxNm0G8tuQ="
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "03c3234e64f9fbbbcf6a7b9c79e94059df49dbfe",
-        "hash": "sha256-e0MSCbqv4u4995nowzipKorkn6mPpO7tf8+ygj3/nFY="
+        "rev": "53348aa333da02b77c4b5797e2de722f5abde7d0",
+        "hash": "sha256-Qh0ytA45zP67VQE417iUtjPcJmJmDzcu4BAatyh6p0w="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -682,8 +672,8 @@
       },
       "src/third_party/swiftshader": {
         "url": "https://swiftshader.googlesource.com/SwiftShader.git",
-        "rev": "89556131bf9d48af3c5c9fbb9a3322e706da89a3",
-        "hash": "sha256-h0utcwCnzwhFufggkBNeA674x2Kqwu4sz3jQ/9eoQv0="
+        "rev": "f9d5d49a3c599a315e3493dc1e9b5309cffb3305",
+        "hash": "sha256-kBfqgXXJeEPT80mu6CJ2Bwmdv/y8jVzM6TedMXbzo4o="
       },
       "src/third_party/text-fragments-polyfill/src": {
         "url": "https://chromium.googlesource.com/external/github.com/GoogleChromeLabs/text-fragments-polyfill.git",
@@ -692,23 +682,23 @@
       },
       "src/third_party/tflite/src": {
         "url": "https://chromium.googlesource.com/external/github.com/tensorflow/tensorflow.git",
-        "rev": "de8d7f65b6eb670e4dad0225d0d6f99bebaab559",
-        "hash": "sha256-r2b+/VBffxsh1sRM2xcFiBx9K6GD6FsaQXpfFMBFUag="
+        "rev": "2216f531fb72119745382c62f232acf9790f4b6e",
+        "hash": "sha256-zySLNPmug5HS5pwJ/lEMAWjjZSOuxdTgup7Y90k7NZI="
       },
       "src/third_party/litert/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google-ai-edge/LiteRT.git",
-        "rev": "588075c77c6895cce6397d41d2890b1aa0a14372",
-        "hash": "sha256-rcEPZNSV0DiDrmoBCtJ07wFzzpmpM93jG4jYaEdNWvI="
+        "rev": "9b5418dd7a1a318eed20395743dcc868df17d8b0",
+        "hash": "sha256-80amwDPF3RrcoTaTQsunNmlvBGs6KCv369FW3J/Xcts="
       },
       "src/third_party/vulkan-deps": {
         "url": "https://chromium.googlesource.com/vulkan-deps",
-        "rev": "0ced1107c62836f439f684a5696c4bd69e09fce3",
-        "hash": "sha256-VOyN618wzyyO2Wh18gCnw+FCr/NbegX3A/54MClyhwc="
+        "rev": "d234b7b29748c07ef389279dd24f533ebd04cadc",
+        "hash": "sha256-w49HOjPixSI/C5IGlxQMj/Ol9f/Lr2zI2oMhQzzu1zk="
       },
       "src/third_party/glslang/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/glslang",
-        "rev": "715c8500e7cd67f2eba9e60e98852a1ed49d2f15",
-        "hash": "sha256-vSbMdTjlRVvYLi5ZvTVmfe76oAQ4AhqyD+ohvkvIYIs="
+        "rev": "458ff50a67cb69371850068a62b78f1990a1ff9a",
+        "hash": "sha256-2WauVjAEeZn16b4fE4ImKPX3wjDmeN92mqWi3NMiXSw="
       },
       "src/third_party/spirv-cross/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Cross",
@@ -717,38 +707,38 @@
       },
       "src/third_party/spirv-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Headers",
-        "rev": "6dd7ba990830f7c15ac1345ff3b43ef6ffdad216",
-        "hash": "sha256-UKBVs2s05hP+paPq1dZFaUEQQ9Kx9acHxYUyJVx22eY="
+        "rev": "126038020c2bd47efaa942ccc364ca5353ffccde",
+        "hash": "sha256-QBX2M+ZSWgVvCx58NeDIdf6mIkdJbecDktBfUWGPvNc="
       },
       "src/third_party/spirv-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Tools",
-        "rev": "2d14d2e76aa7de72404b17078eda15c20a6a0389",
-        "hash": "sha256-8Xtzq8WOdFEw+uEJqMW39LLHt2m165K9OJsIFZuifoM="
+        "rev": "2ec8457ab33d539b6f1fecc998360c0b8b05ed4f",
+        "hash": "sha256-9TBb/gnDXgZRZXhF27KEQ0XQI5itRHKJQjLrkFDQq7Q="
       },
       "src/third_party/vulkan-headers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Headers",
-        "rev": "afe9eb980aa928a66d1c9c06f38c55dd59868720",
-        "hash": "sha256-/yolWlC7ruRiJ0gSdCoSlqL9+j2uJAh+o+H0OG37pq4="
+        "rev": "f6a6f7ab165cedbfa2a7d0c93fe27a2d01ce09c8",
+        "hash": "sha256-ZbjmxbRUiVJADNRWziCH0UIM09qKf+lm9PRnWOhZFhQ="
       },
       "src/third_party/vulkan-loader/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Loader",
-        "rev": "df84d2be47457a8dfd7eb66f8c2b031683bd1ba5",
-        "hash": "sha256-8ParcURRRU3eS9Oej/vHTwOwvYy3HsVJsKh2wQLKUgM="
+        "rev": "15a84652b94e465e9a7b25eb507193929863bc2f",
+        "hash": "sha256-pdC3YCM0Nzeabi5TPD+qR5PVdsxmWMnf2L9HsOcbv84="
       },
       "src/third_party/vulkan-tools/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Tools",
-        "rev": "90bf5bc4fd8bea0d300f6564af256a51a34124b8",
-        "hash": "sha256-tmTD/waVX/duaKXvj0FNUS+ncL1agM73kK7pEfHEsSA="
+        "rev": "7c46da2b39036a80ce088576d5794bf39e667f56",
+        "hash": "sha256-nAyNVveeGg9sA0E37YiEPm+UdKsy48nAOjnUYHQnuqw="
       },
       "src/third_party/vulkan-utility-libraries/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Utility-Libraries",
-        "rev": "48b1fd1a65e436bae806cb6180c9338846b9de97",
-        "hash": "sha256-B3GXmwJEvnGcER5DJt0FGrwqNi3t8iV6VgX8uOrExlU="
+        "rev": "2c909c1ab6f9c6caba39a84a4887186b3fafdead",
+        "hash": "sha256-k3xeKHQbd2rTQJsOZKXEMPrYjcHwoCC1N12F6AIP6Ho="
       },
       "src/third_party/vulkan-validation-layers/src": {
         "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-ValidationLayers",
-        "rev": "ac146eef210b6f52b842111c5d3419ab32a7293f",
-        "hash": "sha256-GqjVHxtda1a47+9G+nqh4qNMJmQaUdZNMUGQ8kAIIkk="
+        "rev": "b105d8ea361af258abed65efb5a1565c031dcf1c",
+        "hash": "sha256-GgznBGYgnCFMNaqAOQ15dlw2dOFfSp3mAV2KokVLzgk="
       },
       "src/third_party/vulkan_memory_allocator": {
         "url": "https://chromium.googlesource.com/external/github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator.git",
@@ -787,23 +777,23 @@
       },
       "src/third_party/webgpu-cts/src": {
         "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts.git",
-        "rev": "09fdb847d90d0b5bfe57068ce2eb9283cb77fc7f",
-        "hash": "sha256-eTAwnTiAHq8rmbw7u9nAwSuAlS5adStUJKfITlYkcgU="
+        "rev": "3b327ebc44f11212fd3872972a6dd394634fb9e3",
+        "hash": "sha256-RSZVKv2Z0pg2cGa3Elr2r5VZqdxlRJ+6mzm1Au1qg1I="
       },
       "src/third_party/webpagereplay": {
         "url": "https://chromium.googlesource.com/webpagereplay.git",
-        "rev": "be48b5e3387780790ecc7723434b6ea6733bcc33",
-        "hash": "sha256-KcFUlQMltsMm4WlTVMLzZXfrvu67ffkKjmBcruwZye0="
+        "rev": "b7ac48f52cd298e966a76eb054412915c3e445d4",
+        "hash": "sha256-smtwB6vzLgCAePz0jNfrpm8TxrxBnBkigLxERhxUEvE="
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "e3ee86921c57b9f8921045e77f098604803cb66c",
-        "hash": "sha256-n39HENOXmatsZLF6jdYRsb+wl2cM0i6ngT4Zbyu5ayE="
+        "rev": "5a7e0ff57a52e12f834d64c57d040d1105ea17f2",
+        "hash": "sha256-V1accCSU6LV5Ixhd+HBOvqZ7GxT57ALsvaF8ABLIXxM="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
-        "rev": "e3f919ccfe3ef542cfc983a82146070258fb57f8",
-        "hash": "sha256-373d2F/STcgCHEq+PO+SCHrKVOo6uO1rqqwRN5eeBCw="
+        "rev": "50869df0ea703b4f41b238bfe26aec6ec9c86889",
+        "hash": "sha256-V7inWJqH7Q4Ac/ZB//7XHrpgfAYUPBxWBerBem6Q/Kk="
       },
       "src/third_party/weston/src": {
         "url": "https://chromium.googlesource.com/external/anongit.freedesktop.org/git/wayland/weston.git",
@@ -812,8 +802,13 @@
       },
       "src/third_party/xnnpack/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/XNNPACK.git",
-        "rev": "1812bbe2928a32f26c5e48466712ba6460cf290c",
-        "hash": "sha256-xal21wjgeql3MjQXw6F1ezcRsnhVKod5jv0nYWroJ1o="
+        "rev": "2ad25fc09167df69c6c02eb8082a0b9658dd5e80",
+        "hash": "sha256-vBMGBXzJPCcsc2kMyGecjti68oZHWUwJKd7tkKub6kg="
+      },
+      "src/third_party/libei/src": {
+        "url": "https://chromium.googlesource.com/external/gitlab.freedesktop.org/libinput/libei.git",
+        "rev": "5d6d8e6590df210b75559a889baa9459c68d9366",
+        "hash": "sha256-lSrIC93Cke90/Xc8dqd3e/TU32tflYHYqc5fE8wglBI="
       },
       "src/third_party/zstd/src": {
         "url": "https://chromium.googlesource.com/external/github.com/facebook/zstd.git",
@@ -822,8 +817,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "5e24a1fd6ffb840b93ee90a800897fcb4d60eeab",
-        "hash": "sha256-JcBGaXhqNRIA4NPPV4eANVM93wsQ9QxSLO/Ecz3wklU="
+        "rev": "5a39b146dd810a52812202fae891281d5dc4db7d",
+        "hash": "sha256-UbX88nE4VyWUm4PvFTOy3mC04MzSdgC006ZpQrEY8cQ="
       }
     }
   },
diff --git a/pkgs/applications/networking/browsers/chromium/patches/chromium-149-llvm-22.patch b/pkgs/applications/networking/browsers/chromium/patches/chromium-149-llvm-22.patch
new file mode 100644
index 000000000000..256073872316
--- /dev/null
+++ b/pkgs/applications/networking/browsers/chromium/patches/chromium-149-llvm-22.patch
@@ -0,0 +1,30 @@
+diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn
+index f977c9fed76e6f50c50351ca22128e8c8c8897b1..81460f3591b734f3354a6f9ac7bb0990e5b28889 100644
+--- a/build/config/compiler/BUILD.gn
++++ b/build/config/compiler/BUILD.gn
+@@ -589,7 +589,7 @@ config("compiler") {
+     # Flags for diagnostics.
+     cflags += [ "-fcolor-diagnostics" ]
+     if (!is_win) {
+-      cflags += [ "-fdiagnostics-show-inlining-chain" ]
++      cflags += [ ]
+     } else {
+       # Combine after https://github.com/llvm/llvm-project/pull/192241
+       cflags += [ "/clang:-fdiagnostics-show-inlining-chain" ]
+@@ -1911,7 +1911,7 @@ config("clang_warning_suppression") {
+ # See also: https://crbug.com/40891132#comment10
+ ubsan_hardening("c_array_bounds") {
+   sanitizer = "array-bounds"
+-  condition = !(is_asan && target_cpu == "x86")
++  condition = false
+ 
+   # Because we've enabled array-bounds sanitizing we also want to suppress
+   # the related warning about "unsafe-buffer-usage-in-static-sized-array",
+@@ -1925,6 +1925,7 @@ ubsan_hardening("c_array_bounds") {
+ # `NOTREACHED()` at the end of such functions.
+ ubsan_hardening("return") {
+   sanitizer = "return"
++  condition = false
+ }
+ 
+ config("rustc_revision") {
diff --git a/pkgs/applications/networking/browsers/chromium/patches/chromium-149-use-of-undeclared-identifier-ERROR.patch b/pkgs/applications/networking/browsers/chromium/patches/chromium-149-use-of-undeclared-identifier-ERROR.patch
new file mode 100644
index 000000000000..4bf9859d4619
--- /dev/null
+++ b/pkgs/applications/networking/browsers/chromium/patches/chromium-149-use-of-undeclared-identifier-ERROR.patch
@@ -0,0 +1,12 @@
+diff --git a/media/gpu/sandbox/hardware_video_decoding_sandbox_hook_linux.cc b/media/gpu/sandbox/hardware_video_decoding_sandbox_hook_linux.cc
+index 58ab0db508f73dbac36a84cb71ffdad972b3fc3c..b5b97f6c6b22a79fd5e4e53393859a107cc0f399 100644
+--- a/media/gpu/sandbox/hardware_video_decoding_sandbox_hook_linux.cc
++++ b/media/gpu/sandbox/hardware_video_decoding_sandbox_hook_linux.cc
+@@ -7,6 +7,7 @@
+ #include <dlfcn.h>
+ #include <sys/stat.h>
+ 
++#include "base/logging.h"
+ #include "base/process/process_metrics.h"
+ #include "base/strings/stringprintf.h"
+ #include "build/build_config.h"
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 17403eb5163a..aebfa6f8cc63 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -155,13 +155,13 @@
     "vendorHash": "sha256-SO3CX7pZ+q7ytz/55cxTPlW7ByY1zKhxkQxMiqAvm8o="
   },
   "checkly_checkly": {
-    "hash": "sha256-v9px/k2b6zUza8ZvoOfxQLNyofcIKOLYVmGAmkyA3TQ=",
+    "hash": "sha256-C85OWP4y5Kh4coaUwxW07bgQWrB6LntEKtXia3Xu7Bg=",
     "homepage": "https://registry.terraform.io/providers/checkly/checkly",
     "owner": "checkly",
     "repo": "terraform-provider-checkly",
-    "rev": "v1.23.0",
+    "rev": "v1.24.0",
     "spdx": null,
-    "vendorHash": "sha256-fY1oLzNYYNmUvOVNCWZlo2pvn2SgGjc4JnMORZdt/ss="
+    "vendorHash": "sha256-CkrDrGP20Gby2wWsl+un3hp3u5gAmWOpjzgs9HQytjg="
   },
   "ciscodevnet_aci": {
     "hash": "sha256-Z3qat3S7dv5kGpc82RxAwlgp3hfscFbkokVsgGnBRHY=",
diff --git a/pkgs/build-support/node/fetch-pnpm-deps/default.nix b/pkgs/build-support/node/fetch-pnpm-deps/default.nix
index 65d7063efac0..58e6370404ae 100644
--- a/pkgs/build-support/node/fetch-pnpm-deps/default.nix
+++ b/pkgs/build-support/node/fetch-pnpm-deps/default.nix
@@ -17,8 +17,6 @@ let
   pnpmLatest = pnpm;
 
   supportedFetcherVersions = [
-    1 # First version. Here to preserve backwards compatibility
-    2 # Ensure consistent permissions. See https://github.com/NixOS/nixpkgs/pull/422975
     3 # Build a reproducible tarball. See https://github.com/NixOS/nixpkgs/pull/469950
     4 # Dump SQLite database to an SQL file. See https://github.com/NixOS/nixpkgs/pull/522703
   ];
@@ -63,178 +61,167 @@ in
       fetcherVersion != null
       || throw "fetchPnpmDeps: `fetcherVersion` is not set, see https://nixos.org/manual/nixpkgs/stable/#javascript-pnpm-fetcherVersion.";
 
+    assert
+      !(fetcherVersion == 1 || fetcherVersion == 2)
+      || throw "fetchPnpmDeps: `fetcherVersion = ${toString fetcherVersion}` was removed in the 26.11 release. Please migrate `${pname}` to `fetcherVersion = 3` and regenerate the hash. See https://nixos.org/manual/nixpkgs/stable/#javascript-pnpm-fetcherVersion.";
+
     assert
       builtins.elem fetcherVersion supportedFetcherVersions
       || throw "fetchPnpmDeps `fetcherVersion` is not set to a supported value (${lib.concatStringsSep ", " (map toString supportedFetcherVersions)}), see https://nixos.org/manual/nixpkgs/stable/#javascript-pnpm-fetcherVersion.";
 
-    lib.warnIf (fetcherVersion < 3)
-      "fetchPnpmDeps: `fetcherVersion = ${toString fetcherVersion}` is deprecated and scheduled for removal in the 26.11 release. Please migrate `${pname}` to `fetcherVersion = 3` and regenerate the hash. See https://nixos.org/manual/nixpkgs/stable/#javascript-pnpm-fetcherVersion."
-
-      stdenvNoCC.mkDerivation
+    stdenvNoCC.mkDerivation (
+      finalAttrs:
       (
-        finalAttrs:
-        (
-          args'
-          // {
-            name = "${pname}-pnpm-deps";
+        args'
+        // {
+          name = "${pname}-pnpm-deps";
 
-            nativeBuildInputs = [
-              cacert
-              jq
-              moreutils
-              pnpm # from args
-              pnpm-fixup-state-db'
-              sqlite
-              writableTmpDirAsHomeHook
-              yq
-              zstd
-            ]
-            ++ args.nativeBuildInputs or [ ];
+          nativeBuildInputs = [
+            cacert
+            jq
+            moreutils
+            pnpm # from args
+            pnpm-fixup-state-db'
+            sqlite
+            writableTmpDirAsHomeHook
+            yq
+            zstd
+          ]
+          ++ args.nativeBuildInputs or [ ];
 
-            impureEnvVars =
-              lib.fetchers.proxyImpureEnvVars ++ [ "NIX_NPM_REGISTRY" ] ++ args.impureEnvVars or [ ];
+          impureEnvVars =
+            lib.fetchers.proxyImpureEnvVars ++ [ "NIX_NPM_REGISTRY" ] ++ args.impureEnvVars or [ ];
 
-            installPhase = ''
-              runHook preInstall
+          installPhase = ''
+            runHook preInstall
 
-              versionAtLeast () {
-                  local cur_version=$1 min_version=$2
-                  printf "%s\0%s" "$min_version" "$cur_version" | sort -zVC
-              }
+            versionAtLeast () {
+                local cur_version=$1 min_version=$2
+                printf "%s\0%s" "$min_version" "$cur_version" | sort -zVC
+            }
 
-              lockfileVersion="$(yq -r .lockfileVersion pnpm-lock.yaml)"
-              if [[ ''${lockfileVersion:0:1} -gt ${lib.versions.major pnpm.version} ]]; then
-                echo "ERROR: lockfileVersion $lockfileVersion in pnpm-lock.yaml is too new for the provided pnpm version ${lib.versions.major pnpm.version}!"
-                exit 1
+            lockfileVersion="$(yq -r .lockfileVersion pnpm-lock.yaml)"
+            if [[ ''${lockfileVersion:0:1} -gt ${lib.versions.major pnpm.version} ]]; then
+              echo "ERROR: lockfileVersion $lockfileVersion in pnpm-lock.yaml is too new for the provided pnpm version ${lib.versions.major pnpm.version}!"
+              exit 1
+            fi
+
+            # The pnpm store is bundled into a compressed tarball within $out,
+            # without distributing the uncompressed store files.
+            mkdir $out
+            storePath=$(mktemp -d)
+
+            pushd "$HOME"
+            pnpmVersion=$(pnpm --version)
+
+            if versionAtLeast "$pnpmVersion" "11"; then
+              # pnpm 11 uses a different mechanism to manage package manager versions
+              export pnpm_config_pm_on_fail=ignore
+
+              # Some packages produce platform dependent outputs. We do not want to cache those in the global store
+              export pnpm_config_side_effects_cache=false
+
+              export pnpm_config_update_notifier=false
+            else
+              pnpm config set manage-package-manager-versions false
+              pnpm config set side-effects-cache false
+              pnpm config set update-notifier false
+            fi
+            popd
+
+            pnpm config set store-dir $storePath
+
+            # Run any additional pnpm configuration commands that users provide.
+            ${prePnpmInstall}
+
+            echo "Final pnpm config:"
+            pnpm config list
+            echo
+
+            # pnpm is going to warn us about using --force
+            # --force allows us to fetch all dependencies including ones that aren't meant for our host platform
+            pnpm install \
+                --force \
+                --ignore-scripts \
+                ${lib.escapeShellArgs filterFlags} \
+                ${lib.escapeShellArgs pnpmInstallFlags} \
+                --registry="$NIX_NPM_REGISTRY" \
+                --frozen-lockfile
+
+            # Record the fetcherVersion in the output for introspection.
+            echo ${toString fetcherVersion} > $out/.fetcher-version
+
+            runHook postInstall
+          '';
+
+          fixupPhase = ''
+            runHook preFixup
+
+            # Remove timestamp and sort the json files
+            rm -rf $storePath/{v3,v10,v11}/tmp
+            for f in $(find $storePath -name "*.json"); do
+              jq --sort-keys "del(.. | .checkedAt?)" $f | sponge $f
+            done
+
+            if [ -f "$storePath/v11/index.db" ]; then
+              pnpm-fixup-state-db "$storePath/v11";
+              # Dump the SQLite database to a SQL text file for reproducibility.
+              # SQLite's binary format is non-deterministic (version-valid-for number, etc),
+              # so we store the logical contents as SQL statements and reconstruct during build.
+              if [[ ${toString fetcherVersion} -ge 4 ]]; then
+                sqlite3 "$storePath/v11/index.db" .dump > "$storePath/v11/index.db.sql"
+                rm "$storePath/v11/index.db"
               fi
+            fi
 
-              # For fetcherVersion < 3, the pnpm store files are placed directly into $out.
-              # For fetcherVersion >= 3, it is bundled into a compressed tarball within $out,
-              # without distributing the uncompressed store files.
-              if [[ ${toString fetcherVersion} -ge 3 ]]; then
-                mkdir $out
-                storePath=$(mktemp -d)
-              else
-                storePath=$out
-              fi
+            # This folder contains symlinks to /build/source which we don't need
+            # since https://github.com/pnpm/pnpm/releases/tag/v10.27.0
+            rm -rf $storePath/{v3,v10,v11}/projects
 
-              pushd "$HOME"
-              pnpmVersion=$(pnpm --version)
+            # Ensure consistent permissions
+            # NOTE: For reasons not yet fully understood, pnpm might create files with
+            # inconsistent permissions, for example inside the ubuntu-24.04
+            # github actions runner.
+            # To ensure stable derivations, we need to set permissions
+            # consistently, namely:
+            # * All files with `-exec` suffix have 555.
+            # * All other files have 444.
+            # * All folders have 555.
+            # See https://github.com/NixOS/nixpkgs/pull/350063
+            # See https://github.com/NixOS/nixpkgs/issues/422889
+            find $storePath -type f -name "*-exec" -print0 | xargs --no-run-if-empty -0 chmod 555
+            find $storePath -type f -not -name "*-exec" -print0 | xargs --no-run-if-empty -0 chmod 444
+            find $storePath -type d -print0 | xargs --no-run-if-empty -0 chmod 555
 
-              if versionAtLeast "$pnpmVersion" "11"; then
-                # pnpm 11 uses a different mechanism to manage package manager versions
-                export pnpm_config_pm_on_fail=ignore
+            (
+              cd $storePath
 
-                # Some packages produce platform dependent outputs. We do not want to cache those in the global store
-                export pnpm_config_side_effects_cache=false
+              # Build a reproducible tarball, per instructions at https://reproducible-builds.org/docs/archives/
+              tar --sort=name \
+                --mtime="@$SOURCE_DATE_EPOCH" \
+                --owner=0 --group=0 --numeric-owner \
+                --pax-option=exthdr.name=%d/PaxHeaders/%f,delete=atime,delete=ctime \
+                --zstd -cf $out/pnpm-store.tar.zst .
+            )
 
-                export pnpm_config_update_notifier=false
-              else
-                pnpm config set manage-package-manager-versions false
-                pnpm config set side-effects-cache false
-                pnpm config set update-notifier false
-              fi
-              popd
+            runHook postFixup
+          '';
 
-              pnpm config set store-dir $storePath
-
-              # Run any additional pnpm configuration commands that users provide.
-              ${prePnpmInstall}
-
-              echo "Final pnpm config:"
-              pnpm config list
-              echo
-
-              # pnpm is going to warn us about using --force
-              # --force allows us to fetch all dependencies including ones that aren't meant for our host platform
-              pnpm install \
-                  --force \
-                  --ignore-scripts \
-                  ${lib.escapeShellArgs filterFlags} \
-                  ${lib.escapeShellArgs pnpmInstallFlags} \
-                  --registry="$NIX_NPM_REGISTRY" \
-                  --frozen-lockfile
-
-              # Store newer fetcherVersion in case pnpmConfigHook also needs it
-              if [[ ${toString fetcherVersion} -gt 1 ]]; then
-                echo ${toString fetcherVersion} > $out/.fetcher-version
-              fi
-
-              runHook postInstall
-            '';
-
-            fixupPhase = ''
-              runHook preFixup
-
-              # Remove timestamp and sort the json files
-              rm -rf $storePath/{v3,v10,v11}/tmp
-              for f in $(find $storePath -name "*.json"); do
-                jq --sort-keys "del(.. | .checkedAt?)" $f | sponge $f
-              done
-
-              if [ -f "$storePath/v11/index.db" ]; then
-                pnpm-fixup-state-db "$storePath/v11";
-                # Dump the SQLite database to a SQL text file for reproducibility.
-                # SQLite's binary format is non-deterministic (version-valid-for number, etc),
-                # so we store the logical contents as SQL statements and reconstruct during build.
-                if [[ ${toString fetcherVersion} -ge 4 ]]; then
-                  sqlite3 "$storePath/v11/index.db" .dump > "$storePath/v11/index.db.sql"
-                  rm "$storePath/v11/index.db"
-                fi
-              fi
-
-              # This folder contains symlinks to /build/source which we don't need
-              # since https://github.com/pnpm/pnpm/releases/tag/v10.27.0
-              rm -rf $storePath/{v3,v10,v11}/projects
-
-              # Ensure consistent permissions
-              # NOTE: For reasons not yet fully understood, pnpm might create files with
-              # inconsistent permissions, for example inside the ubuntu-24.04
-              # github actions runner.
-              # To ensure stable derivations, we need to set permissions
-              # consistently, namely:
-              # * All files with `-exec` suffix have 555.
-              # * All other files have 444.
-              # * All folders have 555.
-              # See https://github.com/NixOS/nixpkgs/pull/350063
-              # See https://github.com/NixOS/nixpkgs/issues/422889
-              if [[ ${toString fetcherVersion} -ge 2 ]]; then
-                find $storePath -type f -name "*-exec" -print0 | xargs --no-run-if-empty -0 chmod 555
-                find $storePath -type f -not -name "*-exec" -print0 | xargs --no-run-if-empty -0 chmod 444
-                find $storePath -type d -print0 | xargs --no-run-if-empty -0 chmod 555
-              fi
-
-              if [[ ${toString fetcherVersion} -ge 3 ]]; then
-                (
-                  cd $storePath
-
-                  # Build a reproducible tarball, per instructions at https://reproducible-builds.org/docs/archives/
-                  tar --sort=name \
-                    --mtime="@$SOURCE_DATE_EPOCH" \
-                    --owner=0 --group=0 --numeric-owner \
-                    --pax-option=exthdr.name=%d/PaxHeaders/%f,delete=atime,delete=ctime \
-                    --zstd -cf $out/pnpm-store.tar.zst .
-                )
-              fi
-
-              runHook postFixup
-            '';
-
-            passthru = args.passthru or { } // {
-              inherit fetcherVersion;
-              serve = callPackage ./serve.nix {
-                inherit pnpm; # from args
-                pnpmDeps = finalAttrs.finalPackage;
-              };
+          passthru = args.passthru or { } // {
+            inherit fetcherVersion;
+            serve = callPackage ./serve.nix {
+              inherit pnpm; # from args
+              pnpmDeps = finalAttrs.finalPackage;
             };
+          };
 
-            dontConfigure = true;
-            dontBuild = true;
-            outputHashMode = "recursive";
-          }
-          // hash'
-        )
+          dontConfigure = true;
+          dontBuild = true;
+          outputHashMode = "recursive";
+        }
+        // hash'
       )
+    )
   );
 
   pnpmConfigHook = makeSetupHook {
diff --git a/pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh b/pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh
index 30c8bd444c24..5cafdd6d1d8b 100644
--- a/pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh
+++ b/pkgs/build-support/node/fetch-pnpm-deps/pnpm-config-hook.sh
@@ -40,7 +40,7 @@ pnpmConfigHook() {
 
     echo "Found 'pnpm' with version '$pnpmVersion'"
 
-    fetcherVersion=$(cat "${pnpmDeps}/.fetcher-version" || echo 1)
+    fetcherVersion=$(cat "${pnpmDeps}/.fetcher-version")
 
     echo "Using fetcherVersion: $fetcherVersion"
 
@@ -52,11 +52,7 @@ pnpmConfigHook() {
     export npm_config_platform="@npmPlatform@"
     export pnpm_config_platform="@npmPlatform@"
 
-    if [[ $fetcherVersion -ge 3 ]]; then
-      tar --zstd -xf "$pnpmDeps/pnpm-store.tar.zst" -C "$STORE_PATH"
-    else
-      cp -Tr "$pnpmDeps" "$STORE_PATH"
-    fi
+    tar --zstd -xf "$pnpmDeps/pnpm-store.tar.zst" -C "$STORE_PATH"
 
     chmod -R +w "$STORE_PATH"
 
diff --git a/pkgs/build-support/node/fetch-pnpm-deps/serve.nix b/pkgs/build-support/node/fetch-pnpm-deps/serve.nix
index 46288e974660..2c3292180d8f 100644
--- a/pkgs/build-support/node/fetch-pnpm-deps/serve.nix
+++ b/pkgs/build-support/node/fetch-pnpm-deps/serve.nix
@@ -17,8 +17,6 @@ writeShellApplication {
   text = ''
     storePath=$(mktemp -d)
 
-    fetcherVersion=$(cat "${pnpmDeps}/.fetcher-version" || echo 1)
-
     clean() {
       echo "Cleaning up temporary store at '$storePath'..."
 
@@ -27,11 +25,7 @@ writeShellApplication {
 
     echo "Copying pnpm store '${pnpmDeps}' to temporary store..."
 
-    if [[ $fetcherVersion -ge 3 ]]; then
-      tar --zstd -xf "${pnpmDeps}/pnpm-store.tar.zst" -C "$storePath"
-    else
-      cp -Tr "${pnpmDeps}" "$storePath"
-    fi
+    tar --zstd -xf "${pnpmDeps}/pnpm-store.tar.zst" -C "$storePath"
 
     chmod -R +w "$storePath"
 
diff --git a/pkgs/build-support/trivial-builders/default.nix b/pkgs/build-support/trivial-builders/default.nix
index 379ca706fdc3..35372d9e4fb8 100644
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@@ -723,6 +723,7 @@ rec {
       meta ? { },
       passthru ? { },
       substitutions ? { },
+      __structuredAttrs ? false,
     }@args:
     script:
     runCommand name
@@ -735,7 +736,7 @@ rec {
           # TODO(@Artturin:) substitutions should be inside the env attrset
           # but users are likely passing non-substitution arguments through substitutions
           # turn off __structuredAttrs to unbreak substituteAll
-          __structuredAttrs = false;
+          inherit __structuredAttrs;
           pname = name;
           version = "26.05pre-git";
           inherit meta;
diff --git a/pkgs/by-name/ac/actool/package.nix b/pkgs/by-name/ac/actool/package.nix
index d511bafbed37..a33cf769d26a 100644
--- a/pkgs/by-name/ac/actool/package.nix
+++ b/pkgs/by-name/ac/actool/package.nix
@@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "actool";
-  version = "2.1.2";
+  version = "2.2.4";
 
   src = fetchFromGitHub {
     owner = "viraptor";
     repo = "actool";
     tag = finalAttrs.version;
-    hash = "sha256-LN35yD9iynU1sCkp5kWL9jUgRIvNTkssherTBaSBenU=";
+    hash = "sha256-dDTa6J2by6uvg4gecwCcBIRGesZ1F0gAXSLr+6DYjGc=";
   };
 
-  cargoHash = "sha256-Fw/0KmFDqXs3IjqnoYfvdrQS3QzF7QhIwmTRt18JEq4=";
+  cargoHash = "sha256-Q0fSZNXw/71kMemYzwVsBRFcAMNl4ItKu56YdB0AAdM=";
 
   meta = {
     description = "Apple's actool reimplementation";
diff --git a/pkgs/by-name/ap/apache-airflow/providers.nix b/pkgs/by-name/ap/apache-airflow/providers.nix
index daeb8ea84589..db03b3269823 100644
--- a/pkgs/by-name/ap/apache-airflow/providers.nix
+++ b/pkgs/by-name/ap/apache-airflow/providers.nix
@@ -473,6 +473,7 @@
       "kerberos"
       "marshmallow"
       "msgpack"
+      "pyjwt"
       "werkzeug"
       "wtforms"
     ];
@@ -644,7 +645,10 @@
   };
 
   jdbc = {
-    deps = [ "jaydebeapi" ];
+    deps = [
+      "jaydebeapi"
+      "jpype1"
+    ];
     imports = [
       "airflow.providers.jdbc"
       "airflow.providers.jdbc.get_provider_info"
@@ -754,6 +758,7 @@
     deps = [
       "aiomysql"
       "mysqlclient"
+      "pymysql"
     ];
     imports = [
       "airflow.providers.mysql"
diff --git a/pkgs/by-name/ap/apache-airflow/python-package.nix b/pkgs/by-name/ap/apache-airflow/python-package.nix
index 1d6bee59763a..d77fa769c3c8 100644
--- a/pkgs/by-name/ap/apache-airflow/python-package.nix
+++ b/pkgs/by-name/ap/apache-airflow/python-package.nix
@@ -19,6 +19,7 @@
   attrs,
   babel,
   buildPythonPackage,
+  cachetools,
   cadwyn,
   colorlog,
   cron-descriptor,
@@ -88,13 +89,13 @@
   enabledProviders,
 }:
 let
-  version = "3.2.1";
+  version = "3.2.2";
 
   src = fetchFromGitHub {
     owner = "apache";
     repo = "airflow";
     tag = version;
-    hash = "sha256-jwWxH9fTTCFdLAaAN18/FUAbN0cTCPkkk9+0ZMYNXek=";
+    hash = "sha256-nAFSLdcKmP2CNm3rx+/fwIsJnpju7wBl+fYWQV8p+sU=";
   };
 
   pnpm = pnpm_10;
@@ -119,7 +120,7 @@ let
         pnpm
         ;
       fetcherVersion = 3;
-      hash = "sha256-OkSDQoWsHQ6w1vIoX5W9zXHghV0obvL6Wji0HYN6CSs=";
+      hash = "sha256-wJ2u+y3umecL4IeVW/29/yDgYZ77ffOBQLHeplD3XlQ=";
     };
 
     buildPhase = ''
@@ -146,9 +147,14 @@ let
 
     pnpmDeps = fetchPnpmDeps {
       pname = "simple-auth-manager-ui";
-      inherit sourceRoot src version;
+      inherit
+        sourceRoot
+        src
+        version
+        pnpm
+        ;
       fetcherVersion = 3;
-      hash = "sha256-uQIVHzX0BcJuxgbPp6wqKhALbsfACSJjiMOdmrpuzOk=";
+      hash = "sha256-AKaafmDjIlg4eFJT1JGyelXVjcId8f0iXTR3JK4ZMq0=";
     };
 
     buildPhase = ''
@@ -212,6 +218,7 @@ let
       sed -i -E 's/"GitPython==[^"]+"/"GitPython"/' pyproject.toml
       sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
       sed -i -E 's/"smmap==[^"]+"/"smmap"/' pyproject.toml
+      sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml
 
       # Copy built UI assets
       cp -r ${airflowUi}/share/airflow/ui/dist src/airflow/ui/
@@ -235,6 +242,7 @@ let
       argcomplete
       asgiref
       attrs
+      cachetools
       cadwyn
       colorlog
       cron-descriptor
@@ -291,6 +299,8 @@ let
       uvicorn
     ]
     ++ (map buildProvider requiredProviders);
+
+    pythonRelaxDeps = [ "starlette" ];
   };
 
   taskSdk = buildPythonPackage {
@@ -308,6 +318,7 @@ let
       sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
       sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
       sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
+      sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml
 
       # task-sdk needs config.yml from core subpackage
       mkdir -p src/airflow/config_templates
@@ -354,6 +365,7 @@ buildPythonPackage rec {
     sed -i -E 's/"hatchling==[^"]+"/"hatchling"/' pyproject.toml
     sed -i -E 's/"packaging==[^"]+"/"packaging"/' pyproject.toml
     sed -i -E 's/"trove-classifiers==[^"]+"/"trove-classifiers"/' pyproject.toml
+    sed -i -E 's/"pathspec==[^"]+"/"pathspec"/' pyproject.toml
   '';
 
   nativeBuildInputs = [ writableTmpDirAsHomeHook ];
diff --git a/pkgs/by-name/as/ast-grep/package.nix b/pkgs/by-name/as/ast-grep/package.nix
index da7eb9e734c5..9b7f2886b605 100644
--- a/pkgs/by-name/as/ast-grep/package.nix
+++ b/pkgs/by-name/as/ast-grep/package.nix
@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ast-grep";
-  version = "0.42.3";
+  version = "0.43.0";
 
   src = fetchFromGitHub {
     owner = "ast-grep";
     repo = "ast-grep";
     tag = finalAttrs.version;
-    hash = "sha256-CbZDibpdEMQayd9tzNTZRUmyx4/9K5VzhbqeFatOn+Q=";
+    hash = "sha256-qQkG04aGaw3U/FFP1omlsoAKfNsVKafgJlVzAxvHkcA=";
   };
 
   # error: linker `aarch64-linux-gnu-gcc` not found
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm .cargo/config.toml
   '';
 
-  cargoHash = "sha256-WhhSD2doqdwGnSKTVjnpjnuPep+4+nB2ZPiFFi8VbQQ=";
+  cargoHash = "sha256-YL76pCvCco9u8nAGIuiEciQrgUgaPx1s8hHyu2x3KmI=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/bo/boringssl/package.nix b/pkgs/by-name/bo/boringssl/package.nix
index c5647b4e37d4..3ac6ddb79621 100644
--- a/pkgs/by-name/bo/boringssl/package.nix
+++ b/pkgs/by-name/bo/boringssl/package.nix
@@ -13,12 +13,12 @@
 # reference: https://boringssl.googlesource.com/boringssl/+/refs/tags/0.20250818.0/BUILDING.md
 stdenv.mkDerivation (finalAttrs: {
   pname = "boringssl";
-  version = "0.20260508.0";
+  version = "0.20260526.0";
 
   src = fetchgit {
     url = "https://boringssl.googlesource.com/boringssl";
     tag = finalAttrs.version;
-    hash = "sha256-7fW0OmOj+Hduq5YCc5xpcfICpC8qAc/05/UMgZ70jhM=";
+    hash = "sha256-SmyImyzGn7v2b5qGJbMmQZX5bODA9i6+8jy3uGwOawA=";
   };
 
   patches = [
diff --git a/pkgs/by-name/bo/bottles-unwrapped/package.nix b/pkgs/by-name/bo/bottles-unwrapped/package.nix
index 9ccf2896fa6d..65e998ba9d05 100644
--- a/pkgs/by-name/bo/bottles-unwrapped/package.nix
+++ b/pkgs/by-name/bo/bottles-unwrapped/package.nix
@@ -34,13 +34,13 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "bottles-unwrapped";
-  version = "63.2";
+  version = "64.1";
 
   src = fetchFromGitHub {
     owner = "bottlesdevs";
     repo = "bottles";
     tag = finalAttrs.version;
-    hash = "sha256-cBqKUf96BLYyVD8onkvejL7pcxYrVCnhjhhT9FSwuNo=";
+    hash = "sha256-RwH2XLY9PmyDvIYu3Wr2qL89ErJBfC58i0jHLLNnKJQ=";
   };
 
   patches = [
diff --git a/pkgs/by-name/ci/cimg/package.nix b/pkgs/by-name/ci/cimg/package.nix
index 9aca84ce0340..5b80cab7dbc5 100644
--- a/pkgs/by-name/ci/cimg/package.nix
+++ b/pkgs/by-name/ci/cimg/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cimg";
-  version = "3.6.3";
+  version = "3.7.6";
 
   src = fetchFromGitHub {
     owner = "GreycLab";
     repo = "CImg";
     tag = "v.${finalAttrs.version}";
-    hash = "sha256-X99t7X6Z1OssRrcYSJdj/ptfn0Q7ocSzf1z6bzMdT1Q=";
+    hash = "sha256-7VZU1/iZH0mtnWaPLRXXYRmpv1tbHKlTglQXIFaocWs=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/da/daktari/package.nix b/pkgs/by-name/da/daktari/package.nix
index b790d4e82dae..aadaa467d2e7 100644
--- a/pkgs/by-name/da/daktari/package.nix
+++ b/pkgs/by-name/da/daktari/package.nix
@@ -7,7 +7,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "daktari";
-  version = "0.0.324";
+  version = "0.0.328";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "genio-learn";
     repo = "daktari";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-f9TpdxarSTMmXhalrjFmGT+zIUNMY+add5OiTq/xW7A=";
+    hash = "sha256-WTxZTfW4KVACxR3wS9+nDV/pYlCrCu8TBQRVulxqiRo=";
   };
 
   patches = [ ./optional-pyclip.patch ];
diff --git a/pkgs/by-name/ef/efficient-compression-tool/ect-gcc-15-O3-fix.patch b/pkgs/by-name/ef/efficient-compression-tool/ect-gcc-15-O3-fix.patch
new file mode 100644
index 000000000000..f4c6221058e3
--- /dev/null
+++ b/pkgs/by-name/ef/efficient-compression-tool/ect-gcc-15-O3-fix.patch
@@ -0,0 +1,13 @@
+diff --git a/src/LzFind.c b/src/LzFind.c
+index 98d0ac6..f1bee55 100755
+--- a/src/LzFind.c
++++ b/src/LzFind.c
+@@ -229,7 +229,7 @@ static unsigned short * GetMatches2(UInt32 lenLimit, UInt32 curMatch, UInt32 pos
+     const unsigned char* _min = min;
+     unsigned cnt = 0;
+     if (_min < pb - (rle_len - len)) {_min = pb - (rle_len - len);}
+-    while (rle_pos > _min && *(uint64_t*)(rle_pos - 8) == starter_full) {rle_pos-=8; cnt+=8;}
++    while (rle_pos > _min && *(__typeof__(const uint64_t __attribute__((aligned(1))))*)(rle_pos - 8) == starter_full) {rle_pos-=8; cnt+=8;}
+     if (cnt) {
+       if (cnt + len > rle_len - 1) {cnt = rle_len - 1 - len;}
+       curMatch_rle -= cnt;
diff --git a/pkgs/by-name/ef/efficient-compression-tool/package.nix b/pkgs/by-name/ef/efficient-compression-tool/package.nix
index 10da59dc6f3b..6871e59a01f7 100644
--- a/pkgs/by-name/ef/efficient-compression-tool/package.nix
+++ b/pkgs/by-name/ef/efficient-compression-tool/package.nix
@@ -22,6 +22,11 @@ stdenv.mkDerivation (finalAttrs: {
     fetchSubmodules = true;
   };
 
+  patches = [
+    # from https://github.com/fhanau/Efficient-Compression-Tool/issues/145
+    ./ect-gcc-15-O3-fix.patch
+  ];
+
   # devendor libpng
   postPatch = ''
     substituteInPlace src/CMakeLists.txt \
diff --git a/pkgs/by-name/ei/eigen_5/package.nix b/pkgs/by-name/ei/eigen_5/package.nix
index 4f2f8f6135ce..83c2928b6eb6 100644
--- a/pkgs/by-name/ei/eigen_5/package.nix
+++ b/pkgs/by-name/ei/eigen_5/package.nix
@@ -10,6 +10,8 @@
   doxygen,
   cmake,
   graphviz,
+
+  withDoc ? true, # upstream disable for cross, even if it seems to build fine
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -34,16 +36,25 @@ stdenv.mkDerivation (finalAttrs: {
 
   outputs = [
     "out"
-    "doc"
-  ];
+  ]
+  ++ lib.optional withDoc "doc";
 
   nativeBuildInputs = [
-    doxygen
     cmake
+  ]
+  ++ lib.optionals withDoc [
+    doxygen
     graphviz
   ];
 
-  postInstall = ''
+  cmakeFlags = [
+    (lib.cmakeBool "EIGEN_BUILD_DOC" withDoc)
+  ];
+
+  postInstall = lib.optionalString withDoc ''
+    # Fontconfig error: No writable cache directories
+    export XDG_CACHE_HOME="$(mktemp -d)"
+
     cmake --build . -t install-doc
   '';
 
diff --git a/pkgs/by-name/es/esphome/package.nix b/pkgs/by-name/es/esphome/package.nix
index 13ac763dd27b..ee88e5019115 100644
--- a/pkgs/by-name/es/esphome/package.nix
+++ b/pkgs/by-name/es/esphome/package.nix
@@ -33,14 +33,14 @@ let
 in
 python.pkgs.buildPythonApplication (finalAttrs: {
   pname = "esphome";
-  version = "2026.5.1";
+  version = "2026.5.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "esphome";
     repo = "esphome";
     tag = finalAttrs.version;
-    hash = "sha256-faW44FhAymqGQG4khAUEcv6QoAn49KPSghi3YcXttNk=";
+    hash = "sha256-DLM4hzbEWaJURtCIpKdL9Igy53puEGW+qRiBpDdFZ4o=";
   };
 
   patches = [
diff --git a/pkgs/by-name/et/etlegacy-unwrapped/package.nix b/pkgs/by-name/et/etlegacy-unwrapped/package.nix
index dfbe335729c1..eacd38703062 100644
--- a/pkgs/by-name/et/etlegacy-unwrapped/package.nix
+++ b/pkgs/by-name/et/etlegacy-unwrapped/package.nix
@@ -19,28 +19,39 @@
   SDL2,
   sqlite,
   zlib,
+  versionCheckHook,
 }:
 let
-  version = "2.83.2";
+  version = "2.84.0";
   fakeGit = writeScriptBin "git" ''
     if [ "$1" = "describe" ]; then
       echo "${version}"
     fi
   '';
+  binarySuffix =
+    if stdenv.hostPlatform.isx86_64 then
+      "x86_64"
+    else if stdenv.hostPlatform.isAarch64 then
+      "aarch64"
+    else if stdenv.hostPlatform.isi686 then
+      "386"
+    else
+      throw "Unsupported architecture: ${stdenv.hostPlatform.system}";
 in
 stdenv.mkDerivation {
   pname = "etlegacy-unwrapped";
   inherit version;
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src = fetchFromGitHub {
     owner = "etlegacy";
     repo = "etlegacy";
     tag = "v${version}";
-    hash = "sha256-hZwLYaYV0j3YwFi8KRr4DZV73L2yIwFJ3XqCyq6L7hE=";
+    hash = "sha256-E1eR0OIfXn2QkSGYNu1JFXDIVrkz+pxM7IU0GVkvAFQ=";
   };
 
-  strictDeps = true;
-
   nativeBuildInputs = [
     cmake
     fakeGit
@@ -69,6 +80,9 @@ stdenv.mkDerivation {
     (lib.cmakeFeature "CMAKE_BUILD_TYPE" "Release")
     (lib.cmakeBool "BUILD_SERVER" true)
     (lib.cmakeBool "BUILD_CLIENT" true)
+    (lib.cmakeBool "BUNDLED_WOLFSSL" false)
+    (lib.cmakeBool "BUNDLED_OPENSSL" false)
+    (lib.cmakeBool "BUNDLED_CURL" false)
     (lib.cmakeBool "BUNDLED_ZLIB" false)
     (lib.cmakeBool "BUNDLED_CJSON" false)
     (lib.cmakeBool "BUNDLED_JPEG" false)
@@ -86,12 +100,18 @@ stdenv.mkDerivation {
     (lib.cmakeBool "INSTALL_OMNIBOT" false)
     (lib.cmakeBool "INSTALL_GEOIP" false)
     (lib.cmakeBool "INSTALL_WOLFADMIN" false)
+    (lib.cmakeBool "FEATURE_FREETYPE" true)
+    (lib.cmakeBool "FEATURE_GETTEXT" true)
     (lib.cmakeBool "FEATURE_AUTOUPDATE" false)
     (lib.cmakeBool "FEATURE_RENDERER2" false)
+    (lib.cmakeBool "RENDERER_DYNAMIC" true)
     (lib.cmakeFeature "INSTALL_DEFAULT_BASEDIR" "${placeholder "out"}/lib/etlegacy")
     (lib.cmakeFeature "INSTALL_DEFAULT_BINDIR" "${placeholder "out"}/bin")
   ];
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
   meta = {
     description = "ET: Legacy is an open source project based on the code of Wolfenstein: Enemy Territory which was released in 2010 under the terms of the GPLv3 license";
     homepage = "https://etlegacy.com";
@@ -104,5 +124,7 @@ stdenv.mkDerivation {
     maintainers = with lib.maintainers; [
       ashleyghooper
     ];
+    mainProgram = "etl." + binarySuffix;
+    platforms = lib.platforms.linux;
   };
 }
diff --git a/pkgs/by-name/et/etlegacy/package.nix b/pkgs/by-name/et/etlegacy/package.nix
index 250775ae043e..b420c87e66a7 100644
--- a/pkgs/by-name/et/etlegacy/package.nix
+++ b/pkgs/by-name/et/etlegacy/package.nix
@@ -7,9 +7,20 @@
   makeBinaryWrapper,
 }:
 
+let
+  binarySuffix =
+    if stdenv.hostPlatform.isx86_64 then
+      "x86_64"
+    else if stdenv.hostPlatform.isAarch64 then
+      "aarch64"
+    else if stdenv.hostPlatform.isi686 then
+      "386"
+    else
+      throw "Unsupported architecture: ${stdenv.hostPlatform.system}";
+in
 symlinkJoin {
   pname = "etlegacy";
-  version = "2.83.2";
+  version = "2.84.0";
 
   paths = [
     etlegacy-assets
@@ -39,7 +50,7 @@ symlinkJoin {
       for the popular online FPS game Wolfenstein: Enemy Territory - whose
       gameplay is still considered unmatched by many, despite its great age.
     '';
-    mainProgram = "etl." + (if stdenv.hostPlatform.isi686 then "i386" else "x86_64");
+    mainProgram = "etl." + binarySuffix;
     maintainers = with lib.maintainers; [
       ashleyghooper
     ];
diff --git a/pkgs/by-name/fu/fulcrum/package.nix b/pkgs/by-name/fu/fulcrum/package.nix
index e01961275487..e5f2536e39f6 100644
--- a/pkgs/by-name/fu/fulcrum/package.nix
+++ b/pkgs/by-name/fu/fulcrum/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fulcrum";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "cculianu";
     repo = "Fulcrum";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5DsZcnmqO8ZuD3+H/1lkfBrKeGq7efAjji0JDXTPQ1M=";
+    hash = "sha256-ygUzDhqUDeoNgNNXjuIfcy1b5B1KxDGBV4dMdn83GR8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gm/gmic/package.nix b/pkgs/by-name/gm/gmic/package.nix
index 02d74a40179b..77558ae90efd 100644
--- a/pkgs/by-name/gm/gmic/package.nix
+++ b/pkgs/by-name/gm/gmic/package.nix
@@ -31,7 +31,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gmic";
-  version = "3.6.3";
+  version = "3.7.6";
 
   outputs = [
     "out"
@@ -43,8 +43,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "GreycLab";
     repo = "gmic";
-    rev = "v.${finalAttrs.version}";
-    hash = "sha256-+q4GnpL/XeroQ2FUxjrrENlEE5Zi1bEnDkIMtOVIZHQ=";
+    tag = "v.${finalAttrs.version}";
+    hash = "sha256-hewDoraw6DCmj1EryZrODFDqzbKI2RhgRuXAop+pg7c=";
   };
 
   # TODO: build this from source
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
     url = "https://gmic.eu/gmic_stdlib_community${
       lib.replaceStrings [ "." ] [ "" ] finalAttrs.version
     }.h";
-    hash = "sha256-dfn4ayQs4pg3TEMGvp1D+mllehNYFvWvzeqxR72F3aE=";
+    hash = "sha256-ek8w9uCp4ey5zT8Y1+yM9gXtzigNINOQ0XW6kT6Zj5Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/go/gocryptfs/package.nix b/pkgs/by-name/go/gocryptfs/package.nix
index bb1d70ff710f..04de5bd09ea1 100644
--- a/pkgs/by-name/go/gocryptfs/package.nix
+++ b/pkgs/by-name/go/gocryptfs/package.nix
@@ -8,6 +8,7 @@
   pandoc,
   pkg-config,
   libfido2,
+  nixosTests,
 }:
 
 buildGoModule (finalAttrs: {
@@ -63,6 +64,8 @@ buildGoModule (finalAttrs: {
     ln -s $out/bin/gocryptfs $out/bin/mount.fuse.gocryptfs
   '';
 
+  passthru.tests.gocryptfs = nixosTests.gocryptfs;
+
   meta = {
     description = "Encrypted overlay filesystem written in Go";
     license = lib.licenses.mit;
diff --git a/pkgs/by-name/gr/graphite/package.nix b/pkgs/by-name/gr/graphite/package.nix
index 2b65fde38a29..b8d4c50571cf 100644
--- a/pkgs/by-name/gr/graphite/package.nix
+++ b/pkgs/by-name/gr/graphite/package.nix
@@ -15,7 +15,7 @@
   wasm-pack,
   cargo-about,
   nodejs,
-  wasm-bindgen-cli_0_2_100,
+  wasm-bindgen-cli_0_2_121,
   xz,
   removeReferencesTo,
   cef-binary,
@@ -30,16 +30,16 @@
 }:
 
 let
-  version = "0-unstable-2026-05-02";
-  rev = "ab7f59ca61004a1b11f9ae4b1c511cefc7a0f404";
+  version = "0-unstable-2026-05-25";
+  rev = "bbbe04903f28673a86203910b250bf12f3d38b55";
 
-  srcHash = "sha256-DV3/1dgtUiTmGkOm4z3GVJcWzvCjO/crzc/l8ovW0XA=";
-  shaderHash = "sha256-76hOCx1fpFBI5nVmIAIGd2StCRzhbCgs+GHMvxbflLc=";
-  cargoHash = "sha256-ZesLyXKjz2CSrAWUT5Hq6w97pR55I+C79qPwF0dqXXI=";
+  srcHash = "sha256-aEOH0NFUIt0iQNKNlAdKXobVPqbZbeQYB96lDzEsJ3U=";
+  shaderHash = "sha256-4lKBrGh1rfhTBczmCDvIF2KxLyEHzHdKVGgQ+jLd/Dw=";
+  cargoHash = "sha256-iW1hk67zexp/b7HO4q4le8/7ARIn+/VJIZ54RBau238=";
   npmHash = "sha256-AX5Jqk2E+WyQJyHbgvvq74MRsYmWUju4bOkabhYoeig=";
 
-  brandingRev = "1939ca82f3341427059e15bfa205f7c22aaf867a";
-  brandingHash = "sha256-SDnCpLuppHVE7cUVidevH2O/2ma0S2tuQDhFkS/JLvA=";
+  brandingRev = "0d004aa61e6b48d316e8e5db6d59ccc4788f192d";
+  brandingHash = "sha256-wAA6fR+NSxlCAqgwWmpiIAnji9k/jsMXpR0Vt04Ntmk=";
 
   src = fetchFromGitHub {
     owner = "GraphiteEditor";
@@ -96,7 +96,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkg-config
     npmHooks.npmConfigHook
     binaryen
-    wasm-bindgen-cli_0_2_100
+    wasm-bindgen-cli_0_2_121
     wasm-pack
     nodejs
     cargo-about
diff --git a/pkgs/by-name/gr/graphite/update.nu b/pkgs/by-name/gr/graphite/update.nu
index 816acbe71f41..b4d8e4667dd4 100755
--- a/pkgs/by-name/gr/graphite/update.nu
+++ b/pkgs/by-name/gr/graphite/update.nu
@@ -4,11 +4,18 @@
 ^nix-update graphite --version=branch --version-regex '(0-unstable-.*)'
 
 let pkg = "./pkgs/by-name/gr/graphite/package.nix"
-let rev = (open $pkg | lines | where ($it | str contains 'rev = "') | first | str trim | parse 'rev = "{rev}";' | get 0.rev)
-let meta = (http get $"https://raw.githubusercontent.com/GraphiteEditor/Graphite/($rev)/.branding" | lines)
-let branding_rev = ($meta | get 0 | path basename | str replace ".tar.gz" "")
-let branding_hash = (^nix hash convert --to sri --hash-algo sha256 ($meta | get 1) | str trim)
+let rev = open $pkg | lines | where ($it | str contains 'rev = "') | first | str trim | parse 'rev = "{rev}";' | get 0.rev
+
+let shader_url = $"https://raw.githubusercontent.com/timon-schelling/graphite-artifacts/refs/heads/main/rev/($rev)/raster_nodes_shaders_entrypoint.wgsl"
+let shader_hash = ^nix store prefetch-file --hash-type sha256 $shader_url --json | from json | get hash
+
+let branding = http get $"https://raw.githubusercontent.com/GraphiteEditor/Graphite/($rev)/.branding" | lines
+let branding_url = $branding | get 0
+let branding_rev = $branding_url | path basename | str replace ".tar.gz" ""
+let branding_hash = ^nix store prefetch-file --hash-type sha256 --unpack $branding_url --json | from json | get hash
+
 open $pkg
+| str replace --regex 'shaderHash = "[^"]*"' $'shaderHash = "($shader_hash)"'
 | str replace --regex 'brandingRev = "[^"]*"' $'brandingRev = "($branding_rev)"'
 | str replace --regex 'brandingHash = "[^"]*"' $'brandingHash = "($branding_hash)"'
 | save --force $pkg
diff --git a/pkgs/by-name/in/intelli-shell/package.nix b/pkgs/by-name/in/intelli-shell/package.nix
index 380f7935c564..721eeb78e875 100644
--- a/pkgs/by-name/in/intelli-shell/package.nix
+++ b/pkgs/by-name/in/intelli-shell/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "intelli-shell";
-  version = "3.4.1";
+  version = "3.4.2";
 
   src = fetchFromGitHub {
     owner = "lasantosr";
     repo = "intelli-shell";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-s5gbpobCxTtrlEwe1AAidoM8p/1yU/mnZ7JKUu4A0Qk=";
+    hash = "sha256-p0o1KFNo+gR/eTaYGd3HkE1Ndwt8mqQOz0gHzM8lnBk=";
   };
 
-  cargoHash = "sha256-D17BqWiUECM9DeOu/I3xN+aopmw8lZBbUyAIygse0kA=";
+  cargoHash = "sha256-xJ2hjv3JlzMcnjoTAzuXA8Hongb9gfuXxnWFBQkffOc=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/in/inventree/package.nix b/pkgs/by-name/in/inventree/package.nix
index d43f84756647..8395a06f3d56 100644
--- a/pkgs/by-name/in/inventree/package.nix
+++ b/pkgs/by-name/in/inventree/package.nix
@@ -6,6 +6,7 @@
   python3,
   python3Packages,
   gettext,
+  gitMinimal,
   stdenv,
   yarnBuildHook,
   yarnConfigHook,
@@ -13,12 +14,16 @@
 }:
 let
 
-  version = "1.2.6";
+  version = "1.3.0";
   src = fetchFromGitHub {
     owner = "inventree";
     repo = "inventree";
     tag = "${version}";
-    hash = "sha256-JJtjW0PAsGiDnM8vwqrSdDtO6QuzdVoyY4MeEyaSH4w=";
+    hash = "sha256-nsGqfm7XTwHblvqHmsMo8yQgl7ZtbtPdjOfrpXSQbn0=";
+    postCheckout = ''
+      git -C $out rev-parse HEAD > $out/commit_hash.txt
+      git -C $out show -s --format=%cd --date=short HEAD > $out/commit_date.txt
+    '';
   };
 
   frontend =
@@ -34,7 +39,7 @@ let
 
       yarnOfflineCache = fetchYarnDeps {
         yarnLock = finalAttrs.src + "/yarn.lock";
-        hash = "sha256-tZHrl6NC4MGpmH7+Ge2V/y9FRNd9NdbQ/NreHE10b10=";
+        hash = "sha256-PIhmMIFHW+6jVZcS394yU9L5Zn+wkfrWmJH7lAbevbU=";
       };
 
       nativeBuildInputs = [
@@ -119,6 +124,7 @@ python3Packages.buildPythonApplication rec {
       feedparser
       gunicorn
       jinja2
+      nh3
       pdf2image
       pillow
       pint
@@ -161,7 +167,10 @@ python3Packages.buildPythonApplication rec {
     ++ django-allauth.optional-dependencies.mfa;
 
   build-system = [ python3Packages.setuptools ];
-  nativeBuildInputs = [ gettext ];
+  nativeBuildInputs = [
+    gettext
+    gitMinimal
+  ];
 
   prePatch =
     let
@@ -188,7 +197,7 @@ python3Packages.buildPythonApplication rec {
         # TODO figure out why this fails
         "test_setting_object"
       ];
-      skippedFuncScripts = builtins.map (funcName: ''
+      skippedFuncScripts = map (funcName: ''
         grep -rlZ ${funcName} . | while IFS= read -r -d "" file; do
           substituteInPlace "$file" --replace-fail "${funcName}" "skip_${funcName}"
         done
@@ -208,24 +217,27 @@ python3Packages.buildPythonApplication rec {
       # Don't need to bother with a non-maintained library from ages ago
       substituteInPlace src/backend/InvenTree/InvenTree/settings.py --replace-fail "django_slowtests.testrunner.DiscoverSlowestTestsRunner" "django.test.runner.DiscoverRunner"
 
-      mkdir -p $out/lib/${pname}/src/backend/InvenTree/web/
-      cp -r src $out/lib/${pname}
-      ln -s ${frontend}/static $out/lib/${pname}/src/backend/InvenTree/web
+      mkdir -p $out/lib/inventree/src/backend/InvenTree/web/
+      cp -r src $out/lib/inventree
+      ln -s ${frontend}/static $out/lib/inventree/src/backend/InvenTree/web
 
-      chmod +x $out/lib/${pname}/src/backend/InvenTree/manage.py
+      chmod +x $out/lib/inventree/src/backend/InvenTree/manage.py
 
-      makeWrapper $out/lib/${pname}/src/backend/InvenTree/manage.py $out/bin/${pname} \
-        --prefix PYTHONPATH : "${pythonPath}:$out/lib/${pname}/src/backend/InvenTree" \
-        --set INVENTREE_COMMIT_HASH abcdef \
-        --set INVENTREE_COMMIT_DATE 1970-01-01
+      INVENTREE_COMMIT_HASH=$(cat $src/commit_hash.txt)
+      INVENTREE_COMMIT_DATE=$(cat $src/commit_date.txt)
+
+      makeWrapper $out/lib/inventree/src/backend/InvenTree/manage.py $out/bin/inventree \
+        --prefix PYTHONPATH : "${pythonPath}:$out/lib/inventree/src/backend/InvenTree" \
+        --set INVENTREE_COMMIT_HASH $INVENTREE_COMMIT_HASH \
+        --set INVENTREE_COMMIT_DATE $INVENTREE_COMMIT_DATE
 
       makeWrapper ${lib.getExe python3Packages.gunicorn} $out/bin/gunicorn \
-        --prefix PYTHONPATH : "${pythonPath}:$out/${python3.sitePackages}":"${pythonPath}:$out/lib/${pname}/src/backend/InvenTree" \
-        --set INVENTREE_COMMIT_HASH abcdef \
-        --set INVENTREE_COMMIT_DATE 1970-01-01
+        --prefix PYTHONPATH : "${pythonPath}:$out/${python3.sitePackages}":"${pythonPath}:$out/lib/inventree/src/backend/InvenTree" \
+        --set INVENTREE_COMMIT_HASH $INVENTREE_COMMIT_HASH \
+        --set INVENTREE_COMMIT_DATE $INVENTREE_COMMIT_DATE
 
       # Generate static assets
-      pushd $out/lib/${pname}/src/backend/InvenTree &>/dev/null
+      pushd $out/lib/inventree/src/backend/InvenTree &>/dev/null
       export INVENTREE_STATIC_ROOT=$out/lib/inventree/static
       export INVENTREE_MEDIA_ROOT=$(mktemp -d)
       export INVENTREE_BACKUP_DIR=$(mktemp -d)
diff --git a/pkgs/by-name/ir/ironcalc/0001-FIX-test-message.patch b/pkgs/by-name/ir/ironcalc/0001-FIX-test-message.patch
new file mode 100644
index 000000000000..bb7f1fae5d7b
--- /dev/null
+++ b/pkgs/by-name/ir/ironcalc/0001-FIX-test-message.patch
@@ -0,0 +1,26 @@
+From 29add00f50083f14b52f8fd18ee1913dacbb3271 Mon Sep 17 00:00:00 2001
+From: phanirithvij <phanirithvij2000@gmail.com>
+Date: Mon, 16 Mar 2026 14:16:24 +0530
+Subject: [PATCH] FIX: test message
+
+Signed-off-by: phanirithvij <phanirithvij2000@gmail.com>
+---
+ base/src/test/user_model/test_to_from_bytes.rs | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/base/src/test/user_model/test_to_from_bytes.rs b/base/src/test/user_model/test_to_from_bytes.rs
+index f9a9a2f..508a589 100644
+--- a/base/src/test/user_model/test_to_from_bytes.rs
++++ b/base/src/test/user_model/test_to_from_bytes.rs
+@@ -25,7 +25,7 @@ fn errors() {
+     let model_bytes = "Early in the morning, late in the century, Cricklewood Broadway.".as_bytes();
+     assert_eq!(
+         &UserModel::from_bytes(model_bytes, "en").unwrap_err(),
+-        "Error parsing workbook: invalid packing"
++        "Error parsing workbook: bitcode error"
+     );
+ }
+ 
+-- 
+2.53.0
+
diff --git a/pkgs/by-name/ir/ironcalc/docs.nix b/pkgs/by-name/ir/ironcalc/docs.nix
new file mode 100644
index 000000000000..9f0a5cbc9cf0
--- /dev/null
+++ b/pkgs/by-name/ir/ironcalc/docs.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  buildNpmPackage,
+  ironcalc,
+  gitMinimal,
+}:
+
+buildNpmPackage {
+  pname = "ironcalc-docs";
+  inherit (ironcalc) version src;
+
+  postPatch = ''
+    cd docs
+  '';
+
+  npmDepsHash = "sha256-lH4HUUiVSGcF/5cSse0l2ZWial3tkwOO8peb5Wl35rI=";
+
+  nativeBuildInputs = [
+    gitMinimal
+  ];
+
+  # https://discourse.nixos.org/t/nix-build-of-vuepress-project-is-slow-or-hangs/56521/5
+  buildPhase = ''
+    runHook preBuild
+
+    # Icons are expected in public/
+    mkdir -p src/public
+    cp -v src/*.svg src/*.png src/public/ || true
+
+    npm run build > tmp 2>&1
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    mkdir -p $out/share/doc/ironcalc
+    cp -r src/.vitepress/dist/* $out/share/doc/ironcalc/
+  '';
+
+  meta = ironcalc.meta // {
+    description = "Documentation for IronCalc";
+  };
+}
diff --git a/pkgs/by-name/ir/ironcalc/frontend.nix b/pkgs/by-name/ir/ironcalc/frontend.nix
new file mode 100644
index 000000000000..d729b5943b8b
--- /dev/null
+++ b/pkgs/by-name/ir/ironcalc/frontend.nix
@@ -0,0 +1,183 @@
+{
+  rustPlatform,
+  buildNpmPackage,
+  python3,
+  pkg-config,
+  binaryen,
+  bzip2,
+  zstd,
+  esbuild,
+  wasm-bindgen-cli_0_2_108,
+  wasm-pack,
+  nodejs,
+  typescript,
+  lld,
+  writableTmpDirAsHomeHook,
+
+  ironcalc,
+}:
+let
+  inherit (ironcalc)
+    version
+    src
+    cargoHash
+    ;
+
+  wasm = rustPlatform.buildRustPackage {
+    pname = "ironcalc-wasm";
+    inherit
+      version
+      src
+      cargoHash
+      ;
+
+    nativeBuildInputs = [
+      binaryen
+      pkg-config
+      python3
+      wasm-bindgen-cli_0_2_108
+      wasm-pack
+      nodejs
+      typescript
+      lld
+      writableTmpDirAsHomeHook
+    ];
+
+    buildInputs = [
+      bzip2
+      zstd
+    ];
+
+    buildPhase = ''
+      cd bindings/wasm
+      make tests
+
+      wasm-pack build --target web --scope ironcalc --release
+      cp README.pkg.md pkg/README.md
+      tsc types.ts --target esnext --module esnext
+      python3 fix_types.py
+      rm -f types.js
+
+      # wasm-pack generates a package.json, we must provide one
+      cat > pkg/package.json <<EOF
+      {
+        "name": "@ironcalc/wasm",
+        "version": "${ironcalc.version}",
+        "type": "module",
+        "files": [
+          "wasm_bg.wasm",
+          "wasm.js",
+          "wasm.d.ts"
+        ],
+        "main": "wasm.js",
+        "module": "wasm.js",
+        "types": "wasm.d.ts",
+        "exports": {
+          ".": {
+            "types": "./wasm.d.ts",
+            "import": "./wasm.js"
+          }
+        },
+        "sideEffects": false
+      }
+      EOF
+    '';
+
+    doCheck = true;
+
+    installPhase = ''
+      cp -r pkg $out
+    '';
+
+    __structuredAttrs = true;
+    strictDeps = true;
+
+    meta = ironcalc.meta // {
+      description = "Ironcalc wasm bindings";
+    };
+  };
+
+  widget = buildNpmPackage {
+    pname = "ironcalc-widget";
+    inherit version src;
+    sourceRoot = "source";
+
+    postPatch = ''
+      cd webapp/IronCalc
+      chmod -R u+w ../../..
+      mkdir -p ../../bindings/wasm/pkg
+      echo '{"name": "@ironcalc/wasm", "version": "${ironcalc.version}"}' > ../../bindings/wasm/pkg/package.json
+    '';
+
+    npmDepsHash = "sha256-jPnUUEOjW9WHVjpBH/qKB4P5RuMI0uvjog8C41cPQdY=";
+
+    preConfigure = ''
+      cp -rv ${wasm}/. ../../bindings/wasm/pkg/
+    '';
+
+    buildPhase = ''
+      npm run build
+    '';
+
+    installPhase = ''
+      mkdir -p $out
+      cp -r . $out
+    '';
+
+    __structuredAttrs = true;
+    strictDeps = true;
+
+    meta = ironcalc.meta // {
+      description = "Ironcalc frontend widget package";
+    };
+  };
+
+  frontend = buildNpmPackage {
+    pname = "ironcalc-frontend";
+    inherit version src;
+    sourceRoot = "source";
+
+    postPatch = ''
+      cd webapp/app.ironcalc.com/frontend
+      chmod -R u+w ../../..
+
+      # wasm location fix
+      mkdir -p ../../../bindings/wasm/pkg
+      cp -rv ${wasm}/. ../../../bindings/wasm/pkg/
+
+      rm -rf ../../IronCalc
+      cp -r ${widget} ../../IronCalc
+      chmod -R u+w ../../IronCalc
+
+      substituteInPlace src/components/WorkbookTitle.tsx \
+        --replace-warn 'onInput={handleChange}' 'onChange={handleChange}'
+    '';
+
+    npmDepsHash = "sha256-QVpUV3dxaqiWCF8RC1MR2ylYC500Lbp5pJgzzOrF20c=";
+
+    preBuild = ''
+      # wasm resolution fix
+      mkdir -p node_modules/@ironcalc
+      cp -rv ${wasm}/. node_modules/@ironcalc/wasm
+    '';
+
+    installPhase = ''
+      mkdir -p $out
+      cp -r dist/. $out
+    '';
+
+    __structuredAttrs = true;
+    strictDeps = true;
+
+    meta = ironcalc.meta // {
+      description = "Ironcalc frontend package";
+    };
+  };
+in
+{
+  inherit
+    wasm
+    widget
+    frontend
+    ;
+}
diff --git a/pkgs/by-name/ir/ironcalc/nodejs.nix b/pkgs/by-name/ir/ironcalc/nodejs.nix
new file mode 100644
index 000000000000..50cb077de5db
--- /dev/null
+++ b/pkgs/by-name/ir/ironcalc/nodejs.nix
@@ -0,0 +1,84 @@
+{
+  lib,
+  stdenv,
+  pnpm,
+  pnpmConfigHook,
+  fetchPnpmDeps,
+  rustPlatform,
+  pkg-config,
+  bzip2,
+  zstd,
+  ironcalc,
+  nodejs,
+  cargo,
+  rustc,
+  writableTmpDirAsHomeHook,
+}:
+
+stdenv.mkDerivation {
+  pname = "ironcalc-nodejs";
+  inherit (ironcalc) version src;
+
+  postPatch = ''
+    cd bindings/nodejs
+  '';
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (ironcalc) src;
+    pname = "ironcalc-nodejs";
+    hash = "sha256-q0PTXKAX0mhrMKMnFzV65YU948lh+/rGn9ttWzBfdNc=";
+    fetcherVersion = 3;
+    preInstall = ''
+      cd bindings/nodejs
+    '';
+  };
+
+  makeCacheWritable = true;
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (ironcalc) src;
+    hash = ironcalc.cargoHash;
+  };
+
+  cargoRoot = "../..";
+
+  nativeBuildInputs = [
+    pkg-config
+    pnpm
+    nodejs
+    cargo
+    rustc
+    pnpmConfigHook
+    rustPlatform.cargoSetupHook
+    rustPlatform.cargoCheckHook
+    writableTmpDirAsHomeHook
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+    pnpm run build
+    runHook postBuild
+  '';
+
+  doCheck = true;
+
+  checkPhase = ''
+    runHook preCheck
+    pnpm run test
+    runHook postCheck
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/lib/node_modules/@ironcalc/nodejs
+    cp index.js index.d.ts package.json *.node $out/lib/node_modules/@ironcalc/nodejs/
+    runHook postInstall
+  '';
+
+  meta = ironcalc.meta // {
+    description = "Node.js bindings for IronCalc";
+  };
+}
diff --git a/pkgs/by-name/ir/ironcalc/package.nix b/pkgs/by-name/ir/ironcalc/package.nix
new file mode 100644
index 000000000000..c1f998745787
--- /dev/null
+++ b/pkgs/by-name/ir/ironcalc/package.nix
@@ -0,0 +1,197 @@
+{
+  lib,
+  callPackage,
+  fetchFromGitHub,
+
+  rustPlatform,
+
+  pkg-config,
+  python3,
+  python3Packages,
+  bzip2,
+  zstd,
+  stdenv,
+
+  coreutils,
+  sqlite,
+  writeShellApplication,
+  symlinkJoin,
+  nix-update-script,
+}:
+
+let
+  version = "0.7.1-unstable-2026-04-29";
+
+  src = fetchFromGitHub {
+    owner = "ironcalc";
+    repo = "ironcalc";
+    rev = "8461ff71347ab19145cd7ad50ef829181ba765c2";
+    hash = "sha256-vjI3M+hS9bXK8QQlopAy6f4dCISfQHGMvN9sMNKp88Q=";
+  };
+
+  cargoHash = "sha256-q5DnqhIYKUUqfJ4/TNHYF1QgTbH198QtgirQ+lP30wk=";
+
+  meta = {
+    description = "Open source selfhosted spreadsheet engine";
+    homepage = "https://github.com/ironcalc/IronCalc";
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    mainProgram = "ironcalc";
+    maintainers = with lib.maintainers; [ phanirithvij ];
+    teams = with lib.teams; [ ngi ];
+    # see checkNoDefaultFeatures below
+    broken = stdenv.hostPlatform.isAarch64;
+  };
+
+  server = rustPlatform.buildRustPackage {
+    pname = "ironcalc-server";
+    inherit src version;
+
+    buildAndTestSubdir = "webapp/app.ironcalc.com/server";
+    cargoRoot = "webapp/app.ironcalc.com/server";
+
+    cargoHash = "sha256-46IwZJI9AOs+IQFbfz89A2yIi5db7rVMVNsO9W+tn+c=";
+
+    __structuredAttrs = true;
+    strictDeps = true;
+
+    nativeBuildInputs = [ pkg-config ];
+    buildInputs = [
+      bzip2
+      zstd
+    ];
+
+    postInstall = ''
+      install -Dm644 webapp/app.ironcalc.com/server/init_db.sql $out/share/ironcalc/init_db.sql
+    '';
+
+    meta = meta // {
+      description = "IronCalc server package";
+      mainProgram = "ironcalc_server";
+    };
+  };
+
+  frontend_packages = callPackage ./frontend.nix { };
+
+  inherit (frontend_packages)
+    frontend
+    wasm
+    widget
+    ;
+
+  tools = rustPlatform.buildRustPackage {
+    pname = "ironcalc-tools";
+    inherit src version;
+    inherit cargoHash;
+
+    patches = [
+      # nix specific issue, can't reproduce without nix, not upstreaming
+      ./0001-FIX-test-message.patch
+    ];
+
+    __structuredAttrs = true;
+    strictDeps = true;
+
+    nativeBuildInputs = [
+      pkg-config
+      python3
+    ];
+
+    buildInputs = [
+      bzip2
+      zstd
+    ];
+
+    doCheck = true;
+
+    # for aarch64-darwin and aarch64-linux
+    # there are a lot of undefined references to Py
+    # https://github.com/PyO3/pyo3/issues/1800
+    checkNoDefaultFeatures = stdenv.hostPlatform.isAarch64;
+
+    doInstallCheck = true;
+    installCheckPhase = ''
+      runHook preInstallCheck
+      { $out/bin/xlsx_2_icalc 2>&1 || true; } | grep -q "Usage:"
+
+      $out/bin/xlsx_2_icalc xlsx/tests/docs/CHOOSE.xlsx test.ic
+      test -f test.ic
+      runHook postInstallCheck
+    '';
+
+    meta = meta // {
+      description = "IronCalc helper tools";
+      mainProgram = "xlsx_2_icalc";
+    };
+  };
+
+  wrapper = writeShellApplication {
+    name = "ironcalc";
+
+    runtimeInputs = [
+      coreutils
+      sqlite
+      server
+    ];
+
+    text = ''
+      IRONCALC_DB_PATH="''${IRONCALC_DB_PATH:-ironcalc.sqlite}"
+      mkdir -p "$(dirname "$IRONCALC_DB_PATH")"
+
+      if [ ! -f "$IRONCALC_DB_PATH" ]; then
+        echo "Initializing database..."
+        sqlite3 "$IRONCALC_DB_PATH" < "${server}/share/ironcalc/init_db.sql"
+      fi
+
+      export ROCKET_DATABASES="{ironcalc={url=\"$IRONCALC_DB_PATH\"}}"
+      export IRONCALC_WEBAPP_DIR="''${IRONCALC_WEBAPP_DIR:-${frontend}}"
+
+      exec ironcalc_server "$@"
+    '';
+  };
+
+  python = python3Packages.ironcalc;
+  nodejs = callPackage ./nodejs.nix { };
+  docs = callPackage ./docs.nix { };
+in
+symlinkJoin {
+  pname = "ironcalc";
+  inherit version;
+  paths = [
+    tools
+    wrapper
+  ];
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  passthru =
+    let
+      exports = {
+        inherit
+          frontend
+          widget
+          server
+          tools
+          docs
+          wasm
+          nodejs
+          python
+          wrapper
+          ;
+      };
+    in
+    {
+      inherit
+        src
+        cargoHash
+        ;
+      updateScript = [ ./update.sh ];
+      tests = exports;
+    }
+    // exports;
+
+  inherit meta;
+}
diff --git a/pkgs/by-name/ir/ironcalc/python.nix b/pkgs/by-name/ir/ironcalc/python.nix
new file mode 100644
index 000000000000..8bff79b33c64
--- /dev/null
+++ b/pkgs/by-name/ir/ironcalc/python.nix
@@ -0,0 +1,56 @@
+{
+  python3,
+  buildPythonPackage,
+  rustPlatform,
+  pkg-config,
+  bzip2,
+  zstd,
+  pytestCheckHook,
+
+  ironcalc,
+}:
+
+buildPythonPackage {
+  pname = "ironcalc";
+  inherit (ironcalc) src version;
+  pyproject = true;
+
+  postPatch = ''
+    cd bindings/python
+  '';
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (ironcalc) src;
+    hash = ironcalc.cargoHash;
+  };
+
+  cargoRoot = "../..";
+
+  env.PYO3_PYTHON = "${python3}/bin/python3";
+
+  nativeBuildInputs = [
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+    pkg-config
+  ];
+
+  buildInputs = [
+    bzip2
+    zstd
+  ];
+
+  doCheck = true;
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "ironcalc" ];
+
+  meta = ironcalc.meta // {
+    description = "Python bindings for IronCalc";
+  };
+}
diff --git a/pkgs/by-name/ir/ironcalc/update.sh b/pkgs/by-name/ir/ironcalc/update.sh
new file mode 100755
index 000000000000..f8dfab297e48
--- /dev/null
+++ b/pkgs/by-name/ir/ironcalc/update.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq common-updater-scripts nix-update
+
+set -euo pipefail
+
+owner="ironcalc"
+repo="ironcalc"
+branch="main"
+
+commit=$(curl -s "https://api.github.com/repos/$owner/$repo/branches/$branch" | jq -r .commit.sha)
+date=$(curl -s "https://api.github.com/repos/$owner/$repo/commits/$commit" | jq -r .commit.committer.date | cut -d'T' -f1)
+
+current_version=$(nix-instantiate --eval -A ironcalc.version 2>/dev/null | tr -d '"' || echo "0.0.0")
+base_version=$(echo "$current_version" | sed -E 's/-unstable-.*//')
+new_version="$base_version-unstable-$date"
+
+echo "Updating ironcalc to $new_version ($commit)"
+
+if [ "$current_version" = "$new_version" ]; then
+    echo "Already up to date: $current_version"
+    exit 0
+fi
+
+update-source-version ironcalc "$new_version" --rev="$commit"
+
+echo "Updating hashes..."
+
+nix-update ironcalc.tools --version=skip
+nix-update ironcalc.server --version=skip
+nix-update ironcalc.widget --version=skip
+nix-update ironcalc.frontend --version=skip
+nix-update ironcalc.nodejs --version=skip
diff --git a/pkgs/by-name/ki/kin-openapi/package.nix b/pkgs/by-name/ki/kin-openapi/package.nix
index 4ea9858cc033..7a22e1454880 100644
--- a/pkgs/by-name/ki/kin-openapi/package.nix
+++ b/pkgs/by-name/ki/kin-openapi/package.nix
@@ -5,14 +5,14 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "kin-openapi";
-  version = "0.139.0";
-  vendorHash = "sha256-4/UfPkRSA/w7d73hIUkDsoKZLLpLshN9obLcusWtHMk=";
+  version = "0.140.0";
+  vendorHash = "sha256-o6JX0WWT0402VUDz2Y7Clq7txcjvAQhrLJk+8+Xj78k=";
 
   src = fetchFromGitHub {
     owner = "getkin";
     repo = "kin-openapi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7nH6F8QSujWlgXXwDbrZfX9OJzaUjMLdEqCkjEtaJ9g=";
+    hash = "sha256-KmESbc9oPlBBTN9Mgx5xlBWcT6/tVXepxqd/uTWVpAk=";
   };
 
   checkFlags =
diff --git a/pkgs/by-name/ki/kiro-cli/package.nix b/pkgs/by-name/ki/kiro-cli/package.nix
index e697c5e90f3b..727e16c43fd4 100644
--- a/pkgs/by-name/ki/kiro-cli/package.nix
+++ b/pkgs/by-name/ki/kiro-cli/package.nix
@@ -14,23 +14,23 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "kiro-cli";
-  version = "2.4.1";
+  version = "2.5.1";
 
   src =
     let
       darwinDmg = fetchurl {
         url = "https://desktop-release.q.us-east-1.amazonaws.com/${finalAttrs.version}/Kiro%20CLI.dmg";
-        hash = "sha256-rJaKbNhNlSL3CfTRY4Fin5CUhrvjhOJrUuqGCTlRXkQ=";
+        hash = "sha256-fSwq1iMCB/st3u+WI7nNxhx/ZAVfjpKIcLcmv+jJfv4=";
       };
     in
     {
       x86_64-linux = fetchurl {
         url = "https://desktop-release.q.us-east-1.amazonaws.com/${finalAttrs.version}/kirocli-x86_64-linux.tar.gz";
-        hash = "sha256-fXTKu1lO5hPZn1YwRkHI6B+edNatR4KJGqHXzi9Epa8=";
+        hash = "sha256-hl3SeItsJ3uAXtZeoBISWJArefXfKBmLgzmnWKYVXxw=";
       };
       aarch64-linux = fetchurl {
         url = "https://desktop-release.q.us-east-1.amazonaws.com/${finalAttrs.version}/kirocli-aarch64-linux.tar.gz";
-        hash = "sha256-4/HJH3cHHX4Z3/P4eHfnWA6f43TAfAUiqQsZNIehRBY=";
+        hash = "sha256-DLJY/VHexAToA3EjwYaGwSz3E2aTtT7Xbxnw9nBQ0Pk=";
       };
       x86_64-darwin = darwinDmg;
       aarch64-darwin = darwinDmg;
diff --git a/pkgs/by-name/la/labwc/package.nix b/pkgs/by-name/la/labwc/package.nix
index a3386c574a6c..6c9a6a2dc2a1 100644
--- a/pkgs/by-name/la/labwc/package.nix
+++ b/pkgs/by-name/la/labwc/package.nix
@@ -22,22 +22,28 @@
   wayland,
   wayland-protocols,
   wayland-scanner,
-  wlroots_0_19,
+  wlroots_0_20,
   libxcb-wm,
   xwayland,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "labwc";
-  version = "0.9.7";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "labwc";
     repo = "labwc";
     tag = finalAttrs.version;
-    hash = "sha256-7lq/lcaYSc+mJOTkjtwF0LjOAg4Uck3BwAc+2RIntYo=";
+    hash = "sha256-JSs1Xys0+XAPbxLv5pR91K0/e78mu5xLKu0HGdFFCEM=";
   };
 
+  postPatch = ''
+    substituteInPlace meson.build \
+      --replace-fail "install_dir: systemd.get_variable('systemduserunitdir')" \
+                     "install_dir: '$out/lib/systemd/user'"
+  '';
+
   outputs = [
     "out"
     "doc"
@@ -67,7 +73,7 @@ stdenv.mkDerivation (finalAttrs: {
     pango
     wayland
     wayland-protocols
-    wlroots_0_19
+    wlroots_0_20
     libxcb-wm
     xwayland
   ];
diff --git a/pkgs/by-name/li/lima/source.nix b/pkgs/by-name/li/lima/source.nix
index 7b989f69319e..e9fcc3aefe8c 100644
--- a/pkgs/by-name/li/lima/source.nix
+++ b/pkgs/by-name/li/lima/source.nix
@@ -4,7 +4,7 @@
 }:
 
 let
-  version = "2.1.1";
+  version = "2.1.2";
 in
 {
   inherit version;
@@ -13,10 +13,10 @@ in
     owner = "lima-vm";
     repo = "lima";
     tag = "v${version}";
-    hash = "sha256-U054xA3utBcSfpyvsZi4MvgJGNa7QyAYJf9usNXpgXg=";
+    hash = "sha256-WN0HsSnxLh8MiA9UQoYWnfp5fJyEc6w1XJaencZCsL4=";
   };
 
-  vendorHash = "sha256-C4YCuFVXkL5vS6lWZCGkEeZQgAkP55buPDGZ/wvMnAA=";
+  vendorHash = "sha256-8AksUgle1SlWuALi553TlpZ2qwO+jMA1kZQke91fimU=";
 
   meta = {
     homepage = "https://github.com/lima-vm/lima";
diff --git a/pkgs/by-name/ma/matcha/package.nix b/pkgs/by-name/ma/matcha/package.nix
index d53765f5df02..04720b6bd494 100644
--- a/pkgs/by-name/ma/matcha/package.nix
+++ b/pkgs/by-name/ma/matcha/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  buildGoModule,
+  buildGoLatestModule,
   fetchFromGitHub,
   pkg-config,
   pcsclite,
@@ -10,7 +10,7 @@
   versionCheckHook,
 }:
 
-buildGoModule (finalAttrs: {
+buildGoLatestModule (finalAttrs: {
   __structuredAttrs = true;
 
   pname = "matcha";
diff --git a/pkgs/by-name/ma/mattermost/mattermost-remove-free-banner.patch b/pkgs/by-name/ma/mattermost/mattermost-remove-free-banner.patch
index d3365beed9c2..0b31bb032b51 100644
--- a/pkgs/by-name/ma/mattermost/mattermost-remove-free-banner.patch
+++ b/pkgs/by-name/ma/mattermost/mattermost-remove-free-banner.patch
@@ -1,7 +1,7 @@
-diff --git a/webapp/channels/src/components/global_header/left_controls/product_menu/product_branding_team_edition/product_branding_free_edition.tsx b/webapp/channels/src/components/global_header/left_controls/product_menu/product_branding_team_edition/product_branding_free_edition.tsx
+diff --git a/channels/src/components/global_header/left_controls/product_menu/product_branding_team_edition/product_branding_free_edition.tsx b/channels/src/components/global_header/left_controls/product_menu/product_branding_team_edition/product_branding_free_edition.tsx
 index 93cb8ab263..3d12cd5e54 100644
---- a/webapp/channels/src/components/global_header/left_controls/product_menu/product_branding_team_edition/product_branding_free_edition.tsx
-+++ b/webapp/channels/src/components/global_header/left_controls/product_menu/product_branding_team_edition/product_branding_free_edition.tsx
+--- a/channels/src/components/global_header/left_controls/product_menu/product_branding_team_edition/product_branding_free_edition.tsx
++++ b/channels/src/components/global_header/left_controls/product_menu/product_branding_team_edition/product_branding_free_edition.tsx
 @@ -57,7 +57,6 @@ const ProductBrandingFreeEdition = (): JSX.Element => {
                  width={116}
                  height={20}
@@ -10,10 +10,10 @@ index 93cb8ab263..3d12cd5e54 100644
          </ProductBrandingFreeEditionContainer>
      );
  };
-diff --git a/webapp/channels/src/components/header_footer_route/header.scss b/webapp/channels/src/components/header_footer_route/header.scss
-index c2e6fbd187..bc1cedcff1 100644
---- a/webapp/channels/src/components/header_footer_route/header.scss
-+++ b/webapp/channels/src/components/header_footer_route/header.scss
+diff --git a/channels/src/components/header_footer_route/header.scss b/channels/src/components/header_footer_route/header.scss
+index c2e6fbd187..828955cc79 100644
+--- a/channels/src/components/header_footer_route/header.scss
++++ b/channels/src/components/header_footer_route/header.scss
 @@ -47,20 +47,7 @@
              }
  
@@ -36,23 +36,10 @@ index c2e6fbd187..bc1cedcff1 100644
              }
          }
      }
-@@ -83,12 +70,6 @@
-             margin-top: 12px;
-         }
-     }
--
--    &.has-free-banner.has-custom-site-name {
--        .header-back-button {
--            bottom: -20px;
--        }
--    }
- }
- 
- @media screen and (max-width: 699px) {
-diff --git a/webapp/channels/src/components/widgets/menu/menu_items/menu_item.scss b/webapp/channels/src/components/widgets/menu/menu_items/menu_item.scss
+diff --git a/channels/src/components/widgets/menu/menu_items/menu_item.scss b/channels/src/components/widgets/menu/menu_items/menu_item.scss
 index dee9b57f8c..8ef4aa073a 100644
---- a/webapp/channels/src/components/widgets/menu/menu_items/menu_item.scss
-+++ b/webapp/channels/src/components/widgets/menu/menu_items/menu_item.scss
+--- a/channels/src/components/widgets/menu/menu_items/menu_item.scss
++++ b/channels/src/components/widgets/menu/menu_items/menu_item.scss
 @@ -316,14 +316,7 @@
      }
  
@@ -69,11 +56,11 @@ index dee9b57f8c..8ef4aa073a 100644
  
          button {
              padding: 3px 0;
-diff --git a/webapp/channels/webpack.config.js b/webapp/channels/webpack.config.js
-index f29f19f9ab..ab85fc3b86 100644
---- a/webapp/channels/webpack.config.js
-+++ b/webapp/channels/webpack.config.js
-@@ -469,6 +469,9 @@ if (targetIsDevServer) {
+diff --git a/channels/webpack.config.js b/channels/webpack.config.js
+index 852046de70..cf28fdcbd6 100644
+--- a/channels/webpack.config.js
++++ b/channels/webpack.config.js
+@@ -470,6 +470,9 @@ if (targetIsDevServer) {
              historyApiFallback: {
                  index: '/static/root.html',
              },
diff --git a/pkgs/by-name/ma/mattermost/mattermost-remove-user-limit.patch b/pkgs/by-name/ma/mattermost/mattermost-remove-user-limit.patch
index 2667c1e82cd2..574d7f012fbf 100644
--- a/pkgs/by-name/ma/mattermost/mattermost-remove-user-limit.patch
+++ b/pkgs/by-name/ma/mattermost/mattermost-remove-user-limit.patch
@@ -1,16 +1,46 @@
 diff --git a/server/channels/app/limits.go b/server/channels/app/limits.go
-index 4c88c1f049..3c1af8d02f 100644
+index 4c88c1f049..fb7d84ef05 100644
 --- a/server/channels/app/limits.go
 +++ b/server/channels/app/limits.go
-@@ -10,8 +10,8 @@ import (
- )
+@@ -18,23 +18,8 @@ func (a *App) GetServerLimits() (*model.ServerLimits, *model.AppError) {
+ 	limits := &model.ServerLimits{}
+ 	license := a.License()
  
- const (
--	maxUsersLimit     = 200
--	maxUsersHardLimit = 250
-+	maxUsersLimit     = 10000000
-+	maxUsersHardLimit = 10000000
- )
+-	if license == nil && maxUsersLimit > 0 {
+-		// Enforce hard-coded limits for unlicensed servers (no grace period).
+-		limits.MaxUsersLimit = maxUsersLimit
+-		limits.MaxUsersHardLimit = maxUsersHardLimit
+-	} else if license != nil && license.IsSeatCountEnforced && license.Features != nil && license.Features.Users != nil {
+-		// Enforce license limits as required by the license with configurable extra users.
+-		licenseUserLimit := int64(*license.Features.Users)
+-		limits.MaxUsersLimit = licenseUserLimit
+-
+-		// Use ExtraUsers if configured, otherwise default to 0 (no extra users)
+-		extraUsers := 0
+-		if license.ExtraUsers != nil {
+-			extraUsers = *license.ExtraUsers
+-		}
+-
+-		limits.MaxUsersHardLimit = licenseUserLimit + int64(extraUsers)
+-	}
++	limits.MaxUsersLimit = 0
++	limits.MaxUsersHardLimit = 0
  
- func (a *App) GetServerLimits() (*model.ServerLimits, *model.AppError) {
-    
\ No newline at end of file
+ 	// Check if license has post history limits and get the calculated timestamp
+ 	if license != nil && license.Limits != nil && license.Limits.PostHistory > 0 {
+@@ -99,14 +84,5 @@ func (a *App) GetPostHistoryLimit() int64 {
+ }
+ 
+ func (a *App) isAtUserLimit() (bool, *model.AppError) {
+-	userLimits, appErr := a.GetServerLimits()
+-	if appErr != nil {
+-		return false, appErr
+-	}
+-
+-	if userLimits.MaxUsersHardLimit == 0 {
+-		return false, nil
+-	}
+-
+-	return userLimits.ActiveUserCount >= userLimits.MaxUsersHardLimit, appErr
++	return false, nil
+ }
diff --git a/pkgs/by-name/ma/mattermost/package.nix b/pkgs/by-name/ma/mattermost/package.nix
index dfc4038bfde9..37edd7302c9d 100644
--- a/pkgs/by-name/ma/mattermost/package.nix
+++ b/pkgs/by-name/ma/mattermost/package.nix
@@ -138,13 +138,9 @@ buildMattermost rec {
     '';
   };
 
-  patches =
-    lib.optionals removeFreeBadge [
-      ./mattermost-remove-free-banner.patch
-    ]
-    ++ lib.optionals removeUserLimit [
-      ./mattermost-remove-user-limit.patch
-    ];
+  patches = lib.optionals removeUserLimit [
+    ./mattermost-remove-user-limit.patch
+  ];
 
   # Needed because buildGoModule does not support go workspaces yet.
   # We use go 1.22's workspace vendor command, which is not yet available
@@ -248,6 +244,10 @@ buildMattermost rec {
 
       sourceRoot = "${src.name}/webapp";
 
+      patches = lib.optionals removeFreeBadge [
+        ./mattermost-remove-free-banner.patch
+      ];
+
       # Remove deprecated image-webpack-loader causing build failures
       # See: https://github.com/tcoopman/image-webpack-loader#deprecated
       postPatch = ''
diff --git a/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix b/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
index 99a6e03c8abe..9e8a465665d6 100644
--- a/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
+++ b/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
@@ -31,13 +31,13 @@ in
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "modrinth-app-unwrapped";
-  version = "0.13.17";
+  version = "0.14.2";
 
   src = fetchFromGitHub {
     owner = "modrinth";
     repo = "code";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Qn4IlqJagLoIcP9p9QdKzu2wdcBDLvfq/2sgVwIjbm4=";
+    hash = "sha256-j4HaBmWzCFAmkzeEWln+nSwNuvlv5zmwf89ClGqCvus=";
   };
 
   patches = [
@@ -67,7 +67,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail '1.0.0-local' '${finalAttrs.version}'
   '';
 
-  cargoHash = "sha256-iI1AjFApd9fzss3hSVJLofHLZ6SJqUccHJ7PHqtBk+k=";
+  cargoHash = "sha256-VKz06Z3bFuJrzNEeIF6O4N0Mju1RtuZVQfw2ONIBwmg=";
 
   mitmCache = gradle.fetchDeps {
     inherit (finalAttrs) pname;
@@ -78,7 +78,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-oPZt68SosRgzl50VR/xWozcc0weQKiY6T1UcvgMRq1M=";
+    hash = "sha256-bBXnRtFeMzBr3XvXqYsY2iGHD7q4qDrPhxW163N0MTo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mu/musescore/package.nix b/pkgs/by-name/mu/musescore/package.nix
index 80d57dbef7e7..0deadb2f1cfe 100644
--- a/pkgs/by-name/mu/musescore/package.nix
+++ b/pkgs/by-name/mu/musescore/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
 
   # nativeBuildInputs
   cmake,
@@ -33,6 +34,53 @@
   nixosTests,
 }:
 
+let
+  # TODO(@doronbehar): Contribute this one day to lib/? See:
+  # https://discourse.nixos.org/t/rfc-nix-function-that-overrides-a-scope-with-automatic-inheritance-propagation/78025
+  overrideScopeFully =
+    s: scopeOverrideFunc:
+    let
+      partiallyOverriddenScope = s.overrideScope scopeOverrideFunc;
+      directlyOverriddenAttrs = builtins.attrNames (scopeOverrideFunc partiallyOverriddenScope s);
+    in
+    builtins.mapAttrs (
+      attrName: pkg:
+      pkg.override (
+        lib.pipe directlyOverriddenAttrs [
+          (builtins.filter (
+            oAttr:
+            # Don't include in this filter the attribute `attrName` from the
+            # full scope, if it is already part of the _directly_ overridden
+            # attributes.
+            !(builtins.elem attrName directlyOverriddenAttrs)
+            && pkg ? override
+            # Continue with the creation of the `.override` arguments only for
+            # overridden attributes (`oAttr`) which are possible arguments to the
+            # `.override` function of the `pkg` at hand.
+            && pkg.override.__functionArgs ? ${oAttr}
+          ))
+          # Generate the `.override` argument using the attribute names `aNames`
+          (aNames: lib.genAttrs aNames (oAttr: partiallyOverriddenScope.${oAttr}))
+        ]
+      )
+    ) partiallyOverriddenScope;
+  kdePackages' = overrideScopeFully kdePackages (
+    self: super: {
+      # Fix for: https://github.com/NixOS/nixpkgs/issues/526825
+      # reported upstream at: https://github.com/musescore/MuseScore/issues/33015
+      qtdeclarative = super.qtdeclarative.overrideAttrs (
+        new: old: {
+          patches = old.patches ++ [
+            (fetchpatch {
+              url = "https://github.com/qt/qtdeclarative/commit/9d4d376726a6ce15c429128dc65b927e411e40da.patch";
+              hash = "sha256-XhfliF5wZuN4/E55f8hfipIRjxBe9V7vL1cgn5p4xqA=";
+            })
+          ];
+        }
+      );
+    }
+  );
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "musescore";
   version = "4.7.2";
@@ -94,8 +142,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
-    kdePackages.qttools
-    kdePackages.wrapQtAppsHook
+    kdePackages'.qttools
+    kdePackages'.wrapQtAppsHook
     ninja
     pkg-config
   ]
@@ -108,12 +156,12 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     flac
     freetype
-    kdePackages.qt5compat
-    kdePackages.qtbase
-    kdePackages.qtdeclarative
-    kdePackages.qtnetworkauth
-    kdePackages.qtscxml
-    kdePackages.qtsvg
+    kdePackages'.qt5compat
+    kdePackages'.qtbase
+    kdePackages'.qtdeclarative
+    kdePackages'.qtnetworkauth
+    kdePackages'.qtscxml
+    kdePackages'.qtsvg
     lame
     libjack2
     libogg
@@ -130,9 +178,12 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     alsa-lib
-    kdePackages.qtwayland
+    kdePackages'.qtwayland
   ];
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     mkdir -p "$out/Applications"
     mv "$out/mscore.app" "$out/Applications/mscore.app"
@@ -166,7 +217,7 @@ stdenv.mkDerivation (finalAttrs: {
   # Don't run bundled upstreams tests, as they require a running X window system.
   doCheck = false;
 
-  passthru.tests = nixosTests.musescore;
+  passthru.tests.nixos = nixosTests.musescore;
 
   meta = {
     description = "Music notation and composition software";
diff --git a/pkgs/by-name/no/nocturne/disable-navidrome-setup.patch b/pkgs/by-name/no/nocturne/disable-navidrome-setup.patch
new file mode 100644
index 000000000000..cb21fa39db22
--- /dev/null
+++ b/pkgs/by-name/no/nocturne/disable-navidrome-setup.patch
@@ -0,0 +1,14 @@
+--- a/src/integrations/navidrome.py
++++ b/src/integrations/navidrome.py
+@@ -556,11 +556,6 @@
+     process = None
+ 
+     def check_if_ready(self, row) -> bool:
+-        if get_navidrome_path():
+-            return True
+-        else:
+-            row.get_root().main_stack.set_visible_child_name('setup')
+-            row.get_root().main_stack.get_child_by_name('setup').set_integration(self)
+         return False
+ 
+     def start_instance(self) -> bool:
diff --git a/pkgs/by-name/no/nocturne/package.nix b/pkgs/by-name/no/nocturne/package.nix
index b61300697859..a531a0daa18a 100644
--- a/pkgs/by-name/no/nocturne/package.nix
+++ b/pkgs/by-name/no/nocturne/package.nix
@@ -12,7 +12,6 @@
   glib,
   glib-networking,
   pkg-config,
-  cmake,
   gtk4,
   python3,
   python3Packages,
@@ -50,7 +49,6 @@ stdenv.mkDerivation (finalAttrs: {
     appstream
     glib
     pkg-config
-    cmake
     gtk4
     python3
   ];
@@ -64,6 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
     gst_all_1.gstreamer
     gst_all_1.gst-plugins-base
     gst_all_1.gst-plugins-good
+    gst_all_1.gst-plugins-bad
   ];
 
   pythonDependencies = [
@@ -73,7 +72,6 @@ stdenv.mkDerivation (finalAttrs: {
     python3Packages.syncedlyrics
     python3Packages.pycairo
     python3Packages.colorthief
-    python3Packages.favicon
     python3Packages.mpris-server
     python3Packages.pillow
   ];
@@ -85,8 +83,11 @@ stdenv.mkDerivation (finalAttrs: {
     )
   '';
 
+  # avoid installing Navidrome at runtime if not available, incompatible with the nix store
+  patches = [ ./disable-navidrome-setup.patch ];
+
   meta = {
-    description = "Adwaita Music Player and Library Manager";
+    description = "Adwaita music player for OpenSubsonic servers like Navidrome";
     homepage = "https://jeffser.com/nocturne/";
     changelog = "https://github.com/Jeffser/Nocturne/releases";
     license = lib.licenses.gpl3Plus;
diff --git a/pkgs/by-name/oc/ocis/web.nix b/pkgs/by-name/oc/ocis/web.nix
index 8aa78a3d340c..c4b1b3df0315 100644
--- a/pkgs/by-name/oc/ocis/web.nix
+++ b/pkgs/by-name/oc/ocis/web.nix
@@ -5,6 +5,7 @@
   pnpm_9,
   fetchPnpmDeps,
   pnpmConfigHook,
+  pnpmBuildHook,
   fetchFromGitHub,
 }:
 stdenvNoCC.mkDerivation rec {
@@ -21,15 +22,10 @@ stdenvNoCC.mkDerivation rec {
   nativeBuildInputs = [
     nodejs
     pnpmConfigHook
+    pnpmBuildHook
     pnpm_9
   ];
 
-  buildPhase = ''
-    runHook preBuild
-    pnpm build
-    runHook postBuild
-  '';
-
   installPhase = ''
     runHook preInstall
     mkdir -p $out/share
diff --git a/pkgs/by-name/op/opencloud/idp-web.nix b/pkgs/by-name/op/opencloud/idp-web.nix
index d45cf16afd54..0b31c9cbc460 100644
--- a/pkgs/by-name/op/opencloud/idp-web.nix
+++ b/pkgs/by-name/op/opencloud/idp-web.nix
@@ -5,6 +5,7 @@
   pnpm_9,
   fetchPnpmDeps,
   pnpmConfigHook,
+  pnpmBuildHook,
   nodejs,
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
@@ -25,26 +26,21 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     nodejs
     pnpmConfigHook
+    pnpmBuildHook
     pnpm_9
   ];
 
-  buildPhase = ''
-    runHook preBuild
-
-    cd $pnpmRoot
-    pnpm build
-    mkdir -p assets/identifier/static
-    cp -v src/images/favicon.svg assets/identifier/static/favicon.svg
-    cp -v src/images/icon-lilac.svg assets/identifier/static/icon-lilac.svg
-
-    runHook postBuild
+  postBuild = ''
+    mkdir -p services/idp/assets/identifier/static
+    cp -v services/idp/src/images/favicon.svg services/idp/assets/identifier/static/favicon.svg
+    cp -v services/idp/src/images/icon-lilac.svg services/idp/assets/identifier/static/icon-lilac.svg
   '';
 
   installPhase = ''
     runHook preInstall
 
     mkdir $out
-    cp -r assets $out
+    cp -r services/idp/assets $out
 
     runHook postInstall
   '';
diff --git a/pkgs/by-name/op/openimageio/package.nix b/pkgs/by-name/op/openimageio/package.nix
index 0b05357e6412..570d5c6619e9 100644
--- a/pkgs/by-name/op/openimageio/package.nix
+++ b/pkgs/by-name/op/openimageio/package.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "openimageio";
-  version = "3.1.13.1";
+  version = "3.1.14.0";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "OpenImageIO";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GlQ4e0YGHqQxlwcyC8SVf4y0mKZiEyaT4jtxw0Pva4U=";
+    hash = "sha256-sA4NzGdT+K9uQM+h8Ew1EvjO8TGMGyyLS5KYYMJAToE=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/op/openlist/frontend.nix b/pkgs/by-name/op/openlist/frontend.nix
index b1705127ab80..3a58dd89834a 100644
--- a/pkgs/by-name/op/openlist/frontend.nix
+++ b/pkgs/by-name/op/openlist/frontend.nix
@@ -6,24 +6,24 @@
   fetchzip,
 
   nodejs,
-  openlistPnpm ? pnpm_10,
+  openlistPnpm ? pnpm_11,
   pnpmConfigHook,
-  pnpm_10,
+  pnpm_11,
 }:
 buildNpmPackage (finalAttrs: {
   pname = "openlist-frontend";
-  version = "4.2.1";
+  version = "4.2.2";
 
   src = fetchFromGitHub {
     owner = "OpenListTeam";
     repo = "OpenList-Frontend";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4WSL6j0dANUNlHFkMBb8j/KyNHWDQmLnC1y2FFJiBEI=";
+    hash = "sha256-RLuAGjiYELy+roip2TtvUXGOw6Vk+GkczT1LSI0Vx+8=";
   };
 
   i18n = fetchzip {
     url = "https://github.com/OpenListTeam/OpenList-Frontend/releases/download/v${finalAttrs.version}/i18n.tar.gz";
-    hash = "sha256-VzHNZh0ZA2FncAkyozHeBilN4KKsPqbpMESx4QCppW0=";
+    hash = "sha256-ZO/ozyRNqh2W4/acQmGHoEMpjpf2jph7Gn/kOlwVSFs=";
     stripRoot = false;
   };
 
@@ -40,8 +40,8 @@ buildNpmPackage (finalAttrs: {
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = openlistPnpm;
-    fetcherVersion = 3;
-    hash = "sha256-rTDk1p568AKim+ZD00uq1q4XNNMeUFL1rGDBWx2C6DQ=";
+    fetcherVersion = 4;
+    hash = "sha256-ujsCuQexnKPNwoJzaWmhu3+4xMkZ0jR04m2exG674dI=";
   };
 
   npmConfigHook = pnpmConfigHook;
@@ -50,6 +50,13 @@ buildNpmPackage (finalAttrs: {
   # Error: getaddrinfo ENOTFOUND localhost
   __darwinAllowLocalNetworking = true;
 
+  preBuild = ''
+    rm -rf node_modules/mpegts.js
+    cp -R ${finalAttrs.passthru.mpegts-js}/lib/node_modules/mpegts.js node_modules/mpegts.js
+    chmod -R u+w node_modules/mpegts.js
+    test -f node_modules/mpegts.js/dist/mpegts.js
+  '';
+
   installPhase = ''
     runHook preInstall
 
@@ -59,6 +66,25 @@ buildNpmPackage (finalAttrs: {
     runHook postInstall
   '';
 
+  passthru = {
+    # OpenList depends on a forked mpegts.js git package whose source does not include the generated dist/
+    mpegts-js = buildNpmPackage {
+      pname = "mpegts-js-openlist";
+      version = "1.8.1-unstable-2026-05-16";
+
+      src = fetchFromGitHub {
+        owner = "OpenListTeam";
+        repo = "mpegts.js";
+        rev = "1e51e0f6f918cf08e05dfae9c7bfcf658d6b4ac2";
+        hash = "sha256-z+S3iSYqrMuxFRGa5JZIfGMyi7IErpnluwZUVLxqz2o=";
+      };
+
+      npmDepsHash = "sha256-UDI0iPK/ouVgpzscGrQXNnVUseLWYmR0W9THpBm4WqA=";
+
+      meta.license = lib.licenses.asl20;
+    };
+  };
+
   meta = {
     description = "Frontend of OpenList";
     homepage = "https://github.com/OpenListTeam/OpenList-Frontend";
diff --git a/pkgs/by-name/op/openlist/package.nix b/pkgs/by-name/op/openlist/package.nix
index f49df3ded44f..022bb7240bee 100644
--- a/pkgs/by-name/op/openlist/package.nix
+++ b/pkgs/by-name/op/openlist/package.nix
@@ -8,18 +8,17 @@
   installShellFiles,
   libredirect,
   versionCheckHook,
-  fuse,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "openlist";
-  version = "4.2.1";
+  version = "4.2.2";
 
   src = fetchFromGitHub {
     owner = "OpenListTeam";
     repo = "OpenList";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9MDcAQh06W6mOhYpFR49bxvTTrIoJnKY9P3WRVWsujI=";
+    hash = "sha256-MxoF+hpzn/44knjVeaINo4/1T4ia7HG8mm+tbvJEsfQ=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -35,17 +34,20 @@ buildGoModule (finalAttrs: {
   frontend = callPackage ./frontend.nix { };
 
   proxyVendor = true;
-  vendorHash = "sha256-Ho9zVKdzpGKZ/ftJmidUkMBsN4qfvLa96Fg3ayTfYac=";
+  vendorHash = "sha256-ScPfry0PtSlABdyG+7egMAndG7D3iz1+ceAAhLQPtkM=";
 
   nativeBuildInputs = [
     installShellFiles
   ]
   ++ lib.optional stdenv.hostPlatform.isDarwin libredirect.hook;
 
-  buildInputs = [ fuse ];
-
   tags = [ "jsoniter" ];
 
+  subPackages = [
+    "."
+    "pkg/gowebdav/cmd/gowebdav"
+  ];
+
   ldflags = [
     "-s"
     "-X \"github.com/OpenListTeam/OpenList/v4/internal/conf.GitAuthor=The OpenList Projects Contributors <noreply@openlist.team>\""
diff --git a/pkgs/by-name/op/openlist/update.nix b/pkgs/by-name/op/openlist/update.nix
index fc181992d576..3a822ebce8bf 100644
--- a/pkgs/by-name/op/openlist/update.nix
+++ b/pkgs/by-name/op/openlist/update.nix
@@ -18,7 +18,6 @@ writeShellApplication {
   ];
 
   text = ''
-    # get old info
     oldVersion=$(nix-instantiate --eval --strict -A "openlist.version" | jq -e -r)
 
     get_latest_release() {
@@ -27,6 +26,24 @@ writeShellApplication {
              -s "https://api.github.com/repos/OpenListTeam/$repo/releases/latest" | jq -r ".tag_name"
     }
 
+    get_github_commit_date() {
+        local repo=$1
+        local rev=$2
+
+        curl --fail ''${GITHUB_TOKEN:+ -H "Authorization: bearer $GITHUB_TOKEN"} \
+             -s "https://api.github.com/repos/OpenListTeam/$repo/commits/$rev" \
+          | jq -e -r '.commit.committer.date[0:10]'
+    }
+
+    get_github_package_version_at_rev() {
+        local repo=$1
+        local rev=$2
+
+        curl --fail ''${GITHUB_TOKEN:+ -H "Authorization: bearer $GITHUB_TOKEN"} \
+             -s "https://raw.githubusercontent.com/OpenListTeam/$repo/$rev/package.json" \
+          | jq -e -r '.version'
+    }
+
     version=$(get_latest_release "OpenList")
     version="''${version#v}"
     frontendVersion=$(get_latest_release "OpenList-Frontend")
@@ -42,6 +59,18 @@ writeShellApplication {
       --source-key=i18n --ignore-same-version \
       --file=pkgs/by-name/op/openlist/frontend.nix
 
+    frontendLockFile="$(nix-build --no-out-link -A openlist.frontend.src)/pnpm-lock.yaml"
+    mpegtsRev=$(sed -nE 's/.*github:OpenListTeam\/mpegts\.js#([0-9a-f]{40}).*/\1/p' "$frontendLockFile"| head -n1)
+    mpegtsBaseVersion=$(get_github_package_version_at_rev "mpegts.js" "$mpegtsRev")
+    mpegtsDate=$(get_github_commit_date "mpegts.js" "$mpegtsRev")
+
+    update-source-version openlist.frontend.mpegts-js "$mpegtsBaseVersion-unstable-$mpegtsDate" \
+      --rev="$mpegtsRev" \
+      --file=pkgs/by-name/op/openlist/frontend.nix
+    nix-update openlist.frontend.mpegts-js \
+      --version=skip \
+      --override-filename=pkgs/by-name/op/openlist/frontend.nix
+
     nix-update openlist --version="$version"
   '';
 }
diff --git a/pkgs/by-name/op/opensc/package.nix b/pkgs/by-name/op/opensc/package.nix
index 4206d8e002e7..5abc31d88d1f 100644
--- a/pkgs/by-name/op/opensc/package.nix
+++ b/pkgs/by-name/op/opensc/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   autoreconfHook,
   pkg-config,
   zlib,
@@ -28,6 +29,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-s/3bIhPGa3+SKjMh0CNgsU3nOkhEaxPTpmEbc6VIn3Q=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2026-10275.patch";
+      url = "https://github.com/OpenSC/OpenSC/commit/814f745b3b6d100295f65f1935edd33d520d33ab.patch";
+      hash = "sha256-S8PeXCRAUlkKUPYOl/n5+4QIqWOZtHX3yEDnpFhJO8k=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
     autoreconfHook
diff --git a/pkgs/by-name/pn/pnpmBuildHook/package.nix b/pkgs/by-name/pn/pnpmBuildHook/package.nix
new file mode 100644
index 000000000000..361c15a16b99
--- /dev/null
+++ b/pkgs/by-name/pn/pnpmBuildHook/package.nix
@@ -0,0 +1,10 @@
+{
+  makeSetupHook,
+}:
+makeSetupHook {
+  # Shouldn't need to propagate anything because for this to do anything useful,
+  # the config hook must also be used.
+  name = "pnpm-build-hook";
+
+  __structuredAttrs = true;
+} ./pnpm-build-hook.sh
diff --git a/pkgs/by-name/pn/pnpmBuildHook/pnpm-build-hook.sh b/pkgs/by-name/pn/pnpmBuildHook/pnpm-build-hook.sh
new file mode 100644
index 000000000000..69f5fa4ed2ef
--- /dev/null
+++ b/pkgs/by-name/pn/pnpmBuildHook/pnpm-build-hook.sh
@@ -0,0 +1,52 @@
+# shellcheck shell=bash
+
+pnpmBuildHook() {
+    echo "Executing pnpmBuildHook"
+
+    if [[ $pnpmRoot ]]; then
+      pushd "$pnpmRoot"
+    fi
+
+    # Add workspace flags before the other flags
+    local -a pnpmWorkspacesArray
+    concatTo pnpmWorkspacesArray pnpmWorkspaces
+
+    local -a pnpmBuildFlagsArray
+    concatTo pnpmBuildFlagsArray pnpmFlags pnpmBuildFlags
+
+
+    echo
+    echo "Running"
+    echo "pnpm run ${pnpmWorkspacesArray[*]/#/--filter=} ${pnpmBuildScript:-build} ${pnpmBuildFlagsArray[*]}"
+    echo
+
+    if ! pnpm run "${pnpmWorkspacesArray[@]/#/--filter=}" "${pnpmBuildScript:-build}" "${pnpmBuildFlagsArray[@]}"; then
+        echo
+        echo "ERROR: 'pnpm run ${pnpmBuildScript:-build}' failed"
+        echo
+        echo "Here are a few things you can try, depending on the error:"
+        echo "1. Make sure your build script (${pnpmBuildScript:-build}) exists"
+        echo '   If there isnt one, set `dontPnpmBuild = true`.'
+        echo
+
+        exit 1
+    fi
+
+    if [[ $pnpmRoot ]]; then
+      popd
+    fi
+
+    echo "Finished pnpmBuildHook"
+}
+
+pnpmBuildPhase() {
+  runHook preBuild
+
+  pnpmBuildHook
+
+  runHook postBuild
+}
+
+if [ -z "${dontPnpmBuild-}" ] && [ -z "${buildPhase-}" ]; then
+    buildPhase=pnpmBuildPhase
+fi
diff --git a/pkgs/by-name/sa/samloader-rs/package.nix b/pkgs/by-name/sa/samloader-rs/package.nix
index 37a1c4d40720..6bf18c84c4e2 100644
--- a/pkgs/by-name/sa/samloader-rs/package.nix
+++ b/pkgs/by-name/sa/samloader-rs/package.nix
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "samloader-rs";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "topjohnwu";
     repo = "samloader-rs";
     tag = finalAttrs.version;
-    hash = "sha256-LgN/vGfb5hdy9/YH4x3+vFUjH97omGu2iNtkDJRMmsk=";
+    hash = "sha256-0EsSs7GI4D4N3w33NBHKIEDmGk29aRceOwzDA7cy924=";
   };
 
-  cargoHash = "sha256-o0+Kb8teYhuhvl8U6FiAq8Z6vd4IWA8k4Z104Z9BkMw=";
+  cargoHash = "sha256-3i2232Rq9AEqPK8teVmu5kPX10ZopXTm7djUalfPFng=";
 
   nativeBuildInputs = [ perl ];
 
diff --git a/pkgs/by-name/se/seconlay/package.nix b/pkgs/by-name/se/seconlay/package.nix
index 405a92cad0f3..7752899a46f4 100644
--- a/pkgs/by-name/se/seconlay/package.nix
+++ b/pkgs/by-name/se/seconlay/package.nix
@@ -12,14 +12,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "seconlay";
-  version = "0-unstable-2026-05-21";
+  version = "0-unstable-2026-05-29";
 
   src = fetchFromGitLab {
     group = "alasca.cloud";
     owner = "scl";
     repo = "scl-management";
-    rev = "3ebeeda26e919750790c24899320ac1f6ba82904";
-    hash = "sha256-+erlSKH8FBG2Ncpn6D61itTiB2IhbMefgO7EZ7NgZa8=";
+    rev = "58c9b1ef34d950a356edde4da746e4238fc77c2c";
+    hash = "sha256-33YmlPS8Js0JebsBEzSj23qErUpyhdIINltcljVBKEI=";
   };
 
   cargoHash = "sha256-pb9xqdgWrf8Lc10jSkkDb/1n0e15fMQ3AcKNPw6/vi8=";
diff --git a/pkgs/by-name/si/siyuan/package.nix b/pkgs/by-name/si/siyuan/package.nix
index 88c6090f1809..66e82b19253e 100644
--- a/pkgs/by-name/si/siyuan/package.nix
+++ b/pkgs/by-name/si/siyuan/package.nix
@@ -9,6 +9,7 @@
   pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
+  pnpmBuildHook,
   electron,
   makeWrapper,
   makeDesktopItem,
@@ -84,6 +85,7 @@ stdenv.mkDerivation (finalAttrs: {
     pnpm
   ]
   ++ lib.optionals isLinux [
+    pnpmBuildHook
     makeWrapper
     copyDesktopItems
   ]
@@ -120,11 +122,7 @@ stdenv.mkDerivation (finalAttrs: {
     chmod -R u+w electron-dist
   '';
 
-  buildPhase = ''
-    runHook preBuild
-
-    pnpm build
-
+  postBuild = ''
     electronBuilderArgs=(
       --dir
       --config electron-builder-${platformId}.yml
@@ -134,8 +132,6 @@ stdenv.mkDerivation (finalAttrs: {
     )
 
     npm exec electron-builder -- "''${electronBuilderArgs[@]}"
-
-    runHook postBuild
   '';
 
   installPhase = ''
diff --git a/pkgs/by-name/st/strictdoc/package.nix b/pkgs/by-name/st/strictdoc/package.nix
index c02084371d6a..3aae31a5185d 100644
--- a/pkgs/by-name/st/strictdoc/package.nix
+++ b/pkgs/by-name/st/strictdoc/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "strictdoc";
-  version = "0.21.1";
+  version = "0.22.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "strictdoc-project";
     repo = "strictdoc";
     tag = finalAttrs.version;
-    hash = "sha256-kKygvUCrkftEEKLoinVkP5DARsHGguSfsPaTpYYXPpU=";
+    hash = "sha256-mDsI/pGMIcyfFqX9uWWlg09As+4Mth9WK5xylQvSVGM=";
   };
 
   build-system = [
diff --git a/pkgs/by-name/sw/swiftlint/sources.json b/pkgs/by-name/sw/swiftlint/sources.json
index ef824e9e9828..88c75b7de05a 100644
--- a/pkgs/by-name/sw/swiftlint/sources.json
+++ b/pkgs/by-name/sw/swiftlint/sources.json
@@ -1,21 +1,21 @@
 {
-  "version": "0.63.2",
+  "version": "0.63.3",
   "platforms": {
-    "x86_64-linux": {
-      "filename": "swiftlint_linux_amd64.zip",
-      "hash": "sha256-3RAXz9IKFFfyZFkLy1h1pu4GzXW5qdT3fNQ6VSSZFDs="
-    },
     "aarch64-linux": {
       "filename": "swiftlint_linux_arm64.zip",
-      "hash": "sha256-EE3t/3YhV/XP93UvHMKiibYPPqZ35y1lHG86Mof92Ug="
+      "hash": "sha256-1e/L7V7Byp63+DPf3Z+A9WKJdQtyWCx8Foa0Uo4YJFQ="
+    },
+    "x86_64-linux": {
+      "filename": "swiftlint_linux_amd64.zip",
+      "hash": "sha256-Jtt0HUPy8twmwM8WkREAo+GGw9HbtZ5VrTrIew3kU48="
     },
     "x86_64-darwin": {
       "filename": "portable_swiftlint.zip",
-      "hash": "sha256-xZpAXIX5W5LO1nelAIBOCBWWpMrkpqSFr3YGVVfW7Sk="
+      "hash": "sha256-+wRehefLM3T0KkhAtrhaAQYwKvppA1wMbymvSkTIELY="
     },
     "aarch64-darwin": {
       "filename": "portable_swiftlint.zip",
-      "hash": "sha256-xZpAXIX5W5LO1nelAIBOCBWWpMrkpqSFr3YGVVfW7Sk="
+      "hash": "sha256-+wRehefLM3T0KkhAtrhaAQYwKvppA1wMbymvSkTIELY="
     }
   }
 }
diff --git a/pkgs/by-name/to/tonearm/package.nix b/pkgs/by-name/to/tonearm/package.nix
index 8a9b1fe44c04..22a2c4a8d49d 100644
--- a/pkgs/by-name/to/tonearm/package.nix
+++ b/pkgs/by-name/to/tonearm/package.nix
@@ -40,14 +40,14 @@ let
 in
 buildGo126Module (finalAttrs: {
   pname = "tonearm";
-  version = "1.4.0";
+  version = "1.4.1";
   src = fetchFromCodeberg {
     owner = "dergs";
     repo = "Tonearm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tfnJiEJD0SWKxi5MjGbDLVe80niMcMHpzNaOM1SNEQo=";
+    hash = "sha256-uhKWUF8IhihaCA+BkKBEIYB/kbnxdxmJwidsJ52L4yQ=";
   };
-  vendorHash = "sha256-/pUSUfOt5heiObZNQRlZjN1a+j9JocB43F9072pyLjw=";
+  vendorHash = "sha256-vOkOSquBbWjx1eK7h3vmmHKzaopkbu2iL5mbknMo1Kg=";
 
   ldflags = [
     "-X \"codeberg.org/dergs/tonearm/internal/ui.Version=${finalAttrs.version}\""
diff --git a/pkgs/by-name/um/umami/package.nix b/pkgs/by-name/um/umami/package.nix
index d5a95c25f349..2ebc6b7a3550 100644
--- a/pkgs/by-name/um/umami/package.nix
+++ b/pkgs/by-name/um/umami/package.nix
@@ -9,6 +9,7 @@
   nodejs,
   fetchPnpmDeps,
   pnpmConfigHook,
+  pnpmBuildHook,
   pnpm_10,
   prisma_7,
   prisma-engines_7,
@@ -83,6 +84,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     makeWrapper
     nodejs
     pnpmConfigHook
+    pnpmBuildHook
     pnpm
   ];
 
@@ -135,14 +137,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   env.PRISMA_QUERY_ENGINE_LIBRARY = "${finalAttrs.passthru.prisma-engines}/lib/libquery_engine.node";
   env.PRISMA_SCHEMA_ENGINE_BINARY = "${finalAttrs.passthru.prisma-engines}/bin/schema-engine";
 
-  buildPhase = ''
-    runHook preBuild
-
-    pnpm build
-
-    runHook postBuild
-  '';
-
   checkPhase = ''
     runHook preCheck
 
diff --git a/pkgs/by-name/us/usb-modeswitch/configurable-usb-modeswitch.patch b/pkgs/by-name/us/usb-modeswitch/configurable-usb-modeswitch.patch
new file mode 100644
index 000000000000..e51d55a4f14a
--- /dev/null
+++ b/pkgs/by-name/us/usb-modeswitch/configurable-usb-modeswitch.patch
@@ -0,0 +1,284 @@
+Index: usb-modeswitch-2.6.2/Makefile
+===================================================================
+--- usb-modeswitch-2.6.2/Makefile
++++ usb-modeswitch-2.6.2/Makefile
+@@ -5,17 +5,24 @@ CFLAGS      += -Wall -Wno-deprecated-dec
+ LIBS        = `pkg-config --libs --cflags libusb-1.0`
+ RM          = /bin/rm -f
+ OBJS        = usb_modeswitch.c
+-PREFIX      = $(DESTDIR)/usr
+-ETCDIR      = $(DESTDIR)/etc
++PREFIX      = /usr/local
++ETCDIR      = $(PREFIX)/etc
+ SYSDIR      = $(ETCDIR)/systemd/system
+ UPSDIR      = $(ETCDIR)/init
+-UDEVDIR     = $(DESTDIR)/lib/udev
++UDEVDIR     = $(PREFIX)/lib/udev
+ SBINDIR     = $(PREFIX)/sbin
+ MANDIR      = $(PREFIX)/share/man/man1
+ 
++USE_UPSTART=$(shell if command -v initctl > /dev/null; then echo "true"; fi)
++USE_SYSTEMD=$(shell if command -v systemctl > /dev/null; then echo "true"; fi)
++
+ .PHONY: clean install install-common uninstall \
+ 	dispatcher-script dispatcher-dynlink dispatcher-statlink \
+-	install-script install-dynlink install-statlink
++	install-script install-dynlink install-statlink \
++	install-upstart install-systemd \
++	configure-dispatcher configure-script \
++	configure-upstart configure-systemd \
++	configure
+ 
+ all: all-with-script-dispatcher
+ 
+@@ -28,7 +35,25 @@ all-with-statlink-dispatcher: $(PROG) di
+ $(PROG): $(OBJS) usb_modeswitch.h
+ 	$(CC) -o $(PROG) $(OBJS) $(CFLAGS) $(LIBS) $(LDFLAGS)
+ 
+-dispatcher-script: usb_modeswitch_dispatcher.tcl
++configure-dispatcher:
++	sed -i \
++	  -e 's,^\(set setup(sbindir) \).*$$,\1$(SBINDIR),' \
++	  -e 's,^\(set setup(etcdir) \).*$$,\1$(ETCDIR),' \
++	  usb_modeswitch_dispatcher.tcl
++
++configure-script:
++	sed -i -e 's,^\(SBINDIR=\).*$$,\1$(SBINDIR),' usb_modeswitch.sh
++
++configure-systemd:
++	sed -i -e 's,@sbindir@,$(SBINDIR),' usb_modeswitch@.service
++
++configure-upstart:
++	sed -i -e 's,@sbindir@,$(SBINDIR),' usb-modeswitch-upstart.conf
++
++configure: configure-dispatcher configure-script \
++	configure-systemd configure-upstart
++
++dispatcher-script: configure-dispatcher usb_modeswitch_dispatcher.tcl
+ 	DISPATCH=dispatcher-script
+ 	cp -f usb_modeswitch_dispatcher.tcl usb_modeswitch_dispatcher
+ 
+@@ -53,16 +78,28 @@ distclean: clean
+ # If the systemd folder is present, install the service for starting the dispatcher
+ # If not, use the dispatcher directly from the udev rule as in previous versions
+ 
+-install-common: $(PROG) $(DISPATCH)
+-	install -D --mode=755 usb_modeswitch $(SBINDIR)/usb_modeswitch
+-	install -D --mode=755 usb_modeswitch.sh $(UDEVDIR)/usb_modeswitch
+-	install -D --mode=644 usb_modeswitch.conf $(ETCDIR)/usb_modeswitch.conf
+-	install -D --mode=644 usb_modeswitch.1 $(MANDIR)/usb_modeswitch.1
+-	install -D --mode=644 usb_modeswitch_dispatcher.1 $(MANDIR)/usb_modeswitch_dispatcher.1
+-	install -D --mode=755 usb_modeswitch_dispatcher $(SBINDIR)/usb_modeswitch_dispatcher
++install-common: $(PROG) configure $(DISPATCH)
++	install -D --mode=755 usb_modeswitch $(DESTDIR)$(SBINDIR)/usb_modeswitch
++	install -D --mode=755 usb_modeswitch.sh $(DESTDIR)$(UDEVDIR)/usb_modeswitch
++	install -D --mode=644 usb_modeswitch.conf $(DESTDIR)$(ETCDIR)/usb_modeswitch.conf
++	install -D --mode=644 usb_modeswitch.1 $(DESTDIR)$(MANDIR)/usb_modeswitch.1
++	install -D --mode=644 usb_modeswitch_dispatcher.1 $(DESTDIR)$(MANDIR)/usb_modeswitch_dispatcher.1
++	install -D --mode=755 usb_modeswitch_dispatcher $(DESTDIR)$(SBINDIR)/usb_modeswitch_dispatcher
+ 	install -d $(DESTDIR)/var/lib/usb_modeswitch
+-	test -d $(UPSDIR) -a -e /sbin/initctl && install --mode=644 usb-modeswitch-upstart.conf $(UPSDIR) || test 1
+-	test -d $(SYSDIR) -a \( -e /usr/bin/systemctl -o -e /bin/systemctl \) && install --mode=644 usb_modeswitch@.service $(SYSDIR) || test 1
++
++install-upstart:
++	install -D --mode=644 usb-modeswitch-upstart.conf $(DESTDIR)$(UPSDIR)/usb-modeswitch-upstart.conf
++
++install-systemd:
++	install -D --mode=644 usb_modeswitch@.service $(DESTDIR)$(SYSDIR)/usb_modeswitch@.service
++
++ifeq ($(USE_UPSTART),true)
++install-common: install-upstart
++endif
++
++ifeq ($(USE_SYSTEMD),true)
++install-common: install-systemd
++endif
+ 
+ install: install-script
+ 
+@@ -73,10 +110,10 @@ install-dynlink: dispatcher-dynlink inst
+ install-statlink: dispatcher-statlink install-common
+ 
+ uninstall:
+-	$(RM) $(SBINDIR)/usb_modeswitch
+-	$(RM) $(SBINDIR)/usb_modeswitch_dispatcher
+-	$(RM) $(UDEVDIR)/usb_modeswitch
+-	$(RM) $(ETCDIR)/usb_modeswitch.conf
+-	$(RM) $(MANDIR)/usb_modeswitch.1
++	$(RM) $(DESTDIR)$(SBINDIR)/usb_modeswitch
++	$(RM) $(DESTDIR)$(SBINDIR)/usb_modeswitch_dispatcher
++	$(RM) $(DESTDIR)$(UDEVDIR)/usb_modeswitch
++	$(RM) $(DESTDIR)$(ETCDIR)/usb_modeswitch.conf
++	$(RM) $(DESTDIR)$(MANDIR)/usb_modeswitch.1
+ 	$(RM) -R $(DESTDIR)/var/lib/usb_modeswitch
+-	$(RM) $(SYSDIR)/usb_modeswitch@.service
++	$(RM) $(DESTDIR)$(SYSDIR)/usb_modeswitch@.service
+Index: usb-modeswitch-2.6.2/usb-modeswitch-upstart.conf
+===================================================================
+--- usb-modeswitch-2.6.2.orig/usb-modeswitch-upstart.conf
++++ usb-modeswitch-2.6.2/usb-modeswitch-upstart.conf
+@@ -1,5 +1,5 @@
+ start on usb-modeswitch-upstart
+ task
+ script
+-	exec /usr/sbin/usb_modeswitch_dispatcher --switch-mode $UMS_PARAM
++	exec @sbindir@/usb_modeswitch_dispatcher --switch-mode $UMS_PARAM
+ end script
+Index: usb-modeswitch-2.6.2/usb_modeswitch.sh
+===================================================================
+--- usb-modeswitch-2.6.2.orig/usb_modeswitch.sh
++++ usb-modeswitch-2.6.2/usb_modeswitch.sh
+@@ -1,5 +1,9 @@
+ #!/bin/sh
+ # part of usb_modeswitch 2.6.2
++
++# Compile time configuration, injected by the Makefile
++SBINDIR=/usr/sbin
++
+ device_in()
+ {
+ 	if [ ! -e /var/lib/usb_modeswitch/$1 ]; then
+@@ -37,7 +41,7 @@ if [ $(expr "$1" : "--.*") ]; then
+ 		v_id=$3
+ 	fi
+ fi
+-PATH=/sbin:/usr/sbin:$PATH
++
+ case "$1" in
+ 	--driver-bind)
+ 		# driver binding code removed
+@@ -46,9 +50,7 @@ case "$1" in
+ 	--symlink-name)
+ 		device_in "link_list" $v_id $p_id
+ 		if [ "$?" = "1" ]; then
+-			if [ -e "/usr/sbin/usb_modeswitch_dispatcher" ]; then
+-				exec usb_modeswitch_dispatcher $1 $2 2>>/dev/null
+-			fi
++			exec $SBINDIR/usb_modeswitch_dispatcher $1 $2 2>>/dev/null
+ 		fi
+ 		exit 0
+ 		;;
+@@ -61,15 +63,13 @@ if [ "$p2" = "" -a "$p1" != "" ]; then
+ 	p2=$p1
+ fi
+ 
+-PATH=/bin:/sbin:/usr/bin:/usr/sbin
+-init_path=`readlink -f /sbin/init`
+-if [ `basename $init_path` = "systemd" ]; then
++if command -v systemctl > /dev/null; then
+ 	systemctl --no-block restart usb_modeswitch@$p2.service
+-elif [ -e "/etc/init/usb-modeswitch-upstart.conf" ]; then
++elif command -v initctl > /dev/null; then
+ 	initctl emit --no-wait usb-modeswitch-upstart UMS_PARAM=$p2
+ else
+ 	# only old distros, new udev will kill all subprocesses
+ 	exec 1<&- 2<&- 5<&- 7<&-
+-	exec usb_modeswitch_dispatcher --switch-mode $p2 &
++	exec $SBINDIR/usb_modeswitch_dispatcher --switch-mode $p2 &
+ fi
+ exit 0
+Index: usb-modeswitch-2.6.2/usb_modeswitch@.service
+===================================================================
+--- usb-modeswitch-2.6.2.orig/usb_modeswitch@.service
++++ usb-modeswitch-2.6.2/usb_modeswitch@.service
+@@ -3,7 +3,7 @@ Description=USB_ModeSwitch_%i
+ 
+ [Service]
+ Type=oneshot
+-ExecStart=/usr/sbin/usb_modeswitch_dispatcher --switch-mode %i
++ExecStart=@sbindir@/usb_modeswitch_dispatcher --switch-mode %i
+ # Testing
+ #ExecStart=/bin/echo "usb_modeswitch.service: device name is %i"
+ 
+Index: usb-modeswitch-2.6.2/usb_modeswitch_dispatcher.tcl
+===================================================================
+--- usb-modeswitch-2.6.2.orig/usb_modeswitch_dispatcher.tcl
++++ usb-modeswitch-2.6.2/usb_modeswitch_dispatcher.tcl
+@@ -24,6 +24,16 @@
+ #
+ # http://www.gnu.org/licenses/gpl.txt
+
++# Compile-time configuration, injected by the Makefile.
++set setup(sbindir) /usr/sbin
++set setup(etcdir) /etc
++
++# External dependency default location
++set setup(dbdir) /usr/share/usb_modeswitch
++
++# Derived configuration
++set setup(dbdir_etc) $setup(etcdir)/usb_modeswitch.d
++
+ set arg0 [lindex $argv 0]
+ if [regexp {\.tcl$} $arg0] {
+ 	if [file exists $arg0] {
+@@ -115,10 +125,8 @@ if {![regexp {(.*?):.*$} $arg1 d device]
+ 	}
+ }
+ 
+-set setup(dbdir) /usr/share/usb_modeswitch
+-set setup(dbdir_etc) /etc/usb_modeswitch.d
+ if {![file exists $setup(dbdir)] && ![file exists $setup(dbdir_etc)]} {
+-	Log "\nError: no config database found in /usr/share or /etc. Exit"
++	Log "\nError: no config database found in $setup(dbdir) or $setup(dbdir_etc). Exit"
+ 	SafeExit
+ }
+ 
+@@ -285,7 +293,7 @@ if {$config(NoMBIMCheck)==0 && $usb(bNum
+ 	if [CheckMBIM] {
+ 		Log " driver for MBIM devices is available"
+ 		Log "Find MBIM configuration number ..."
+-		if [catch {set cfgno [exec /usr/sbin/usb_modeswitch -j -Q $busParam $devParam -v $usb(idVendor) -p $usb(idProduct)]} err] {
++		if [catch {set cfgno [exec $setup(sbindir)/usb_modeswitch -j -Q $busParam $devParam -v $usb(idVendor) -p $usb(idProduct)]} err] {
+ 			Log "Error when trying to find MBIM configuration, switch to legacy modem mode"
+ 		} else {
+ 			set cfgno [string trim $cfgno]
+@@ -321,7 +329,7 @@ if {$report == ""} {
+ 	# Now we are actually switching
+ 	if $flags(logging) {
+ 		Log "Command line:\nusb_modeswitch -W -D $configParam $busParam $devParam -v $usb(idVendor) -p $usb(idProduct) -f \$flags(config)"
+-		catch {set report [exec /usr/sbin/usb_modeswitch -W -D $configParam $busParam $devParam -v $usb(idVendor) -p $usb(idProduct) -f "$flags(config)" 2>@1]} report
++		catch {set report [exec $setup(sbindir)/usb_modeswitch -W -D $configParam $busParam $devParam -v $usb(idVendor) -p $usb(idProduct) -f "$flags(config)" 2>@1]} report
+ 		Log "\nVerbose debug output of usb_modeswitch and libusb follows"
+ 		Log "(Note that some USB errors are to be expected in the process)"
+ 		Log "--------------------------------"
+@@ -329,7 +337,7 @@ if {$report == ""} {
+ 		Log "--------------------------------"
+ 		Log "(end of usb_modeswitch output)\n"
+ 	} else {
+-		catch {set report [exec /usr/sbin/usb_modeswitch -Q -D $configParam $busParam $devParam -v $usb(idVendor) -p $usb(idProduct) -f "$flags(config)" 2>@1]} report
++		catch {set report [exec $setup(sbindir)/usb_modeswitch -Q -D $configParam $busParam $devParam -v $usb(idVendor) -p $usb(idProduct) -f "$flags(config)" 2>@1]} report
+ 	}
+ }
+ 
+@@ -522,12 +530,12 @@ return 1
+ 
+ proc {ParseGlobalConfig} {path} {
+ 
+-global flags
++global flags setup
+ set configFile ""
+ if [string length $path] {
+ 	set places [list $path]
+ } else {
+-	set places [list /etc/usb_modeswitch.conf /etc/sysconfig/usb_modeswitch /etc/default/usb_modeswitch]
++	set places [list $setup(etcdir)/usb_modeswitch.conf $setup(etcdir)/sysconfig/usb_modeswitch $setup(etcdir)/default/usb_modeswitch]
+ }
+ foreach cfg $places {
+ 	if [file exists $cfg] {
+@@ -923,10 +931,12 @@ proc {SysLog} {msg} {
+ 
+ global flags
+ if {![info exists flags(logger)]} {
+-	set flags(logger) ""
+-	foreach fn {/bin/logger /usr/bin/logger} {
+-		if [file exists $fn] {
+-			set flags(logger) $fn
++	set flags(logger) [exec sh -c "command -v logger || true"]
++	if {$flags(logger) == ""} {
++		foreach fn {/bin/logger /usr/bin/logger} {
++			if [file exists $fn] {
++				set flags(logger) $fn
++			}
+ 		}
+ 	}
+ 	Log "Logger is $flags(logger)"
diff --git a/pkgs/by-name/us/usb-modeswitch/package.nix b/pkgs/by-name/us/usb-modeswitch/package.nix
index 8f2d9f9da4f5..d5cb5668516a 100644
--- a/pkgs/by-name/us/usb-modeswitch/package.nix
+++ b/pkgs/by-name/us/usb-modeswitch/package.nix
@@ -20,7 +20,10 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-96vTN3hKnRvTnLilh1GK/28qQ9kWFF6v2Asbi3FG22Y=";
   };
 
-  patches = [ ./pkg-config.patch ];
+  patches = [
+    ./configurable-usb-modeswitch.patch
+    ./pkg-config.patch
+  ];
 
   # Remove attempts to write to /etc and /var/lib.
   postPatch = ''
diff --git a/pkgs/development/libraries/irrlicht/common.nix b/pkgs/development/libraries/irrlicht/common.nix
index f330c30fda11..becfde842993 100644
--- a/pkgs/development/libraries/irrlicht/common.nix
+++ b/pkgs/development/libraries/irrlicht/common.nix
@@ -2,10 +2,10 @@
 
 rec {
   pname = "irrlicht";
-  version = "1.8.4";
+  version = "1.8.5";
 
   src = fetchzip {
     url = "mirror://sourceforge/irrlicht/${pname}-${version}.zip";
-    sha256 = "02sq067fn4xpf0lcyb4vqxmm43qg2nxx770bgrl799yymqbvih5f";
+    hash = "sha256-cTkzxquMLl84/cSDZnSSQsmXRX/htV8M5NUTbnQuHoM=";
   };
 }
diff --git a/pkgs/development/libraries/irrlicht/mac.nix b/pkgs/development/libraries/irrlicht/mac.nix
index b99806505961..2d077a2924d8 100644
--- a/pkgs/development/libraries/irrlicht/mac.nix
+++ b/pkgs/development/libraries/irrlicht/mac.nix
@@ -43,5 +43,6 @@ stdenv.mkDerivation {
     license = lib.licenses.zlib;
     description = "Open source high performance realtime 3D engine written in C++";
     platforms = lib.platforms.darwin;
+    broken = true;
   };
 }
diff --git a/pkgs/development/libraries/mesa/common.nix b/pkgs/development/libraries/mesa/common.nix
index 6d238ea44927..979a4c44a604 100644
--- a/pkgs/development/libraries/mesa/common.nix
+++ b/pkgs/development/libraries/mesa/common.nix
@@ -5,14 +5,14 @@
 # nix build .#legacyPackages.x86_64-darwin.mesa .#legacyPackages.aarch64-darwin.mesa
 rec {
   pname = "mesa";
-  version = "26.1.1";
+  version = "26.1.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "mesa";
     repo = "mesa";
     rev = "mesa-${version}";
-    hash = "sha256-OmhBmBGR12Tl+5msiyL8lYQ3XYcDYCqUUjQObEqjytI=";
+    hash = "sha256-GqIU9BL57n+ihpeXug+K9kOtvHZ+LCUQg1wi/rrYWuc=";
   };
 
   meta = {
diff --git a/pkgs/development/libraries/mesa/darwin.nix b/pkgs/development/libraries/mesa/darwin.nix
index fb64f9e70d60..d683cc3bfe89 100644
--- a/pkgs/development/libraries/mesa/darwin.nix
+++ b/pkgs/development/libraries/mesa/darwin.nix
@@ -59,6 +59,13 @@ stdenv.mkDerivation {
     ./opencl.patch
   ];
 
+  postPatch = ''
+    # Darwin only installs `swrast_dri.so`. It is symlinked to `libdril_dri.dylib`, but the script never terminates
+    # checking for `swrast_dri.dylib`, which isn’t what will be created.
+    substituteInPlace bin/install_megadrivers.py \
+      --replace-fail "            while ext != '.' + args.libname_suffix" "            while ext != '.so'"
+  '';
+
   outputs = [
     "out"
     "dev"
diff --git a/pkgs/development/python-modules/disposable-email-domains/default.nix b/pkgs/development/python-modules/disposable-email-domains/default.nix
index 479d579f46cb..ca3392a22637 100644
--- a/pkgs/development/python-modules/disposable-email-domains/default.nix
+++ b/pkgs/development/python-modules/disposable-email-domains/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "disposable-email-domains";
-  version = "0.0.188";
+  version = "0.0.193";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -16,7 +16,7 @@ buildPythonPackage (finalAttrs: {
   src = fetchPypi {
     pname = "disposable_email_domains";
     inherit (finalAttrs) version;
-    hash = "sha256-CRSFrSo7wSUIBY3l/n5Uf3wM0AwbrxRiELepz0NWOXQ=";
+    hash = "sha256-5XT3UtSwPM2xQM44QgezX0YitUXR4xS/2tICH/O6BB4=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/flash-mla/default.nix b/pkgs/development/python-modules/flash-mla/default.nix
index e301ce5b1454..34533a683320 100644
--- a/pkgs/development/python-modules/flash-mla/default.nix
+++ b/pkgs/development/python-modules/flash-mla/default.nix
@@ -28,17 +28,18 @@ let
 in
 buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
   pname = "flash-mla";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-29";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "deepseek-ai";
     repo = "FlashMLA";
-    rev = "71c737929f2567bd0a094ae140f8f60f390b1232";
+    rev = "9241ae3ef9bac614dd25e45e507e089f888280e0";
     # Using the cutlass git subodules is necessary to get cutlass/util/command_line.h which is not
     # shipped in cudaPackages.cutlass
     fetchSubmodules = true;
-    hash = "sha256-d8Hh+1QFwD6cl9fE8/XSYdWiJJjY9bSRk5h4N2sEV2U=";
+    hash = "sha256-rHHoDGEbBIvLRT0ZYOWQHrqyPBWtCpmF/AIcqFieomE=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix b/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix
index 5badc3aa4ced..062f44c3dffb 100644
--- a/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "microsoft-kiota-abstractions";
-  version = "1.10.1";
+  version = "1.10.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
     tag = "microsoft-kiota-abstractions-v${finalAttrs.version}";
-    hash = "sha256-KBCjVNZDPMh0wxWm8UVLsrfl2AYp3rKMjAT5c8F7+64=";
+    hash = "sha256-rj0NpuXvqS5rB6TrD3FyuMWb7Dl8/SIBcW/Lzj4cY6I=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/packages/abstractions/";
diff --git a/pkgs/development/python-modules/pyopengl/default.nix b/pkgs/development/python-modules/pyopengl/default.nix
index 5d0e8665499c..bd2d9a6ffa06 100644
--- a/pkgs/development/python-modules/pyopengl/default.nix
+++ b/pkgs/development/python-modules/pyopengl/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   buildPythonPackage,
+  replaceVars,
   fetchPypi,
   setuptools,
   pkgs,
@@ -9,13 +10,13 @@
   mesa,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pyopengl";
   version = "3.1.10";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-xKAtaGa1TrEZyOmz+wT6g1qVq4At2WYHq0zbABLfgzU=";
   };
 
@@ -23,46 +24,20 @@ buildPythonPackage rec {
 
   dependencies = [ pillow ];
 
-  patchPhase =
-    let
-      ext = stdenv.hostPlatform.extensions.sharedLibrary;
-    in
-    lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
-      # Theses lines are patching the name of dynamic libraries
-      # so pyopengl can find them at runtime.
-      substituteInPlace OpenGL/platform/glx.py \
-        --replace-fail "'OpenGL'"  '"${pkgs.libGL}/lib/libOpenGL${ext}"' \
-        --replace-fail "'GL'"  '"${pkgs.libGL}/lib/libGL${ext}"' \
-        --replace-fail '"GLU",' '"${pkgs.libGLU}/lib/libGLU${ext}",' \
-        --replace-fail "'GLX'" '"${pkgs.libglvnd}/lib/libGLX${ext}"' \
-        --replace-fail '"glut",' '"${pkgs.libglut}/lib/libglut${ext}",' \
-        --replace-fail '"GLESv1_CM",' '"${pkgs.libGL}/lib/libGLESv1_CM${ext}",' \
-        --replace-fail '"GLESv2",' '"${pkgs.libGL}/lib/libGLESv2${ext}",' \
-        --replace-fail '"gle",' '"${pkgs.gle}/lib/libgle${ext}",' \
-        --replace-fail "'EGL'" "'${pkgs.libGL}/lib/libEGL${ext}'"
-      substituteInPlace OpenGL/platform/egl.py \
-        --replace-fail "('OpenGL','GL')" "('${pkgs.libGL}/lib/libOpenGL${ext}', '${pkgs.libGL}/lib/libGL${ext}')" \
-        --replace-fail "'GLU'," "'${pkgs.libGLU}/lib/libGLU${ext}'," \
-        --replace-fail "'glut'," "'${pkgs.libglut}/lib/libglut${ext}'," \
-        --replace-fail "'GLESv1_CM'," "'${pkgs.libGL}/lib/libGLESv1_CM${ext}'," \
-        --replace-fail "'GLESv2'," "'${pkgs.libGL}/lib/libGLESv2${ext}'," \
-        --replace-fail "'gle'," '"${pkgs.gle}/lib/libgle${ext}",' \
-        --replace-fail "'EGL'," "'${pkgs.libGL}/lib/libEGL${ext}',"
-      substituteInPlace OpenGL/platform/darwin.py \
-        --replace-fail "'OpenGL'," "'${pkgs.libGL}/lib/libGL${ext}'," \
-        --replace-fail "'GLUT'," "'${pkgs.libglut}/lib/libglut${ext}',"
-    ''
-    + ''
-      # https://github.com/NixOS/nixpkgs/issues/76822
-      # pyopengl introduced a new "robust" way of loading libraries in 3.1.4.
-      # The later patch of the filepath does not work anymore because
-      # pyopengl takes the "name" (for us: the path) and tries to add a
-      # few suffix during its loading phase.
-      # The following patch put back the "name" (i.e. the path) in the
-      # list of possible files.
-      substituteInPlace OpenGL/platform/ctypesloader.py \
-        --replace-fail "filenames_to_try = [base_name]" "filenames_to_try = [name]"
-    '';
+  passthru.runtimeLibs = lib.optionals (!stdenv.hostPlatform.isDarwin) [
+    "/run/opengl-driver/lib"
+    pkgs.libglvnd
+    pkgs.libGLU
+    pkgs.libglut
+    pkgs.gle
+  ];
+
+  patches = lib.optionals (finalAttrs.passthru.runtimeLibs != [ ]) [
+    # patch OpenGL.platform.ctypesloader::_loadLibraryPosix with extra search paths
+    (replaceVars ./ld-preload-gl.patch {
+      GL_LD_LIBRARY_PATH = lib.makeLibraryPath finalAttrs.passthru.runtimeLibs;
+    })
+  ];
 
   # Need to fix test runner
   # Tests have many dependencies
@@ -70,12 +45,19 @@ buildPythonPackage rec {
   # Should run test suite from $out/${python.sitePackages}
   doCheck = false; # does not affect pythonImportsCheck
 
-  # OpenGL looks for libraries during import, making this a somewhat decent test of the flaky patching above.
+  # PyOpenGL looks for libraries during import, making this a somewhat decent test of our patching
+  # (these are impure deps on darwin)
   pythonImportsCheck = [
     "OpenGL"
     "OpenGL.GL"
+    "OpenGL.GLE"
+    "OpenGL.GLU"
   ]
   ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+    "OpenGL.EGL"
+    "OpenGL.GLES1"
+    "OpenGL.GLES2"
+    "OpenGL.GLES3"
     "OpenGL.GLX"
   ];
 
@@ -91,4 +73,4 @@ buildPythonPackage rec {
     license = lib.licenses.bsd3;
     inherit (mesa.meta) platforms;
   };
-}
+})
diff --git a/pkgs/development/python-modules/pyopengl/ld-preload-gl.patch b/pkgs/development/python-modules/pyopengl/ld-preload-gl.patch
new file mode 100644
index 000000000000..f955bf6682b3
--- /dev/null
+++ b/pkgs/development/python-modules/pyopengl/ld-preload-gl.patch
@@ -0,0 +1,17 @@
+diff --git a/OpenGL/platform/ctypesloader.py b/OpenGL/platform/ctypesloader.py
+index d9ff006..ce7d99e 100644
+--- a/OpenGL/platform/ctypesloader.py
++++ b/OpenGL/platform/ctypesloader.py
+@@ -59,6 +59,12 @@ def _loadLibraryPosix(dllType, name, mode):
+     ])))
+     err = None
+ 
++    filenames_to_try = [
++        (f"{prefix}/{filename}" if prefix else filename)
++        for prefix in ":@GL_LD_LIBRARY_PATH@".split(":")
++        for filename in filenames_to_try
++    ]
++
+     for filename in filenames_to_try:
+         try:
+             result = dllType(filename, mode)
diff --git a/pkgs/development/python-modules/pyutil/default.nix b/pkgs/development/python-modules/pyutil/default.nix
index 64ce8a20fdeb..03ef8b58d741 100644
--- a/pkgs/development/python-modules/pyutil/default.nix
+++ b/pkgs/development/python-modules/pyutil/default.nix
@@ -14,12 +14,12 @@
 
 buildPythonPackage rec {
   pname = "pyutil";
-  version = "3.3.6";
+  version = "3.4.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-XcPWu5xbq6u10Ldz4JQEXXVxLos0ry0psOKGAmaCZ8A=";
+    hash = "sha256-8RHsCEieQ3/uHPkNai+sUBR2hDJAVrYy5DMlp6YRw6c=";
   };
 
   prePatch = lib.optionalString isPyPy ''
diff --git a/pkgs/development/python-modules/stanza/default.nix b/pkgs/development/python-modules/stanza/default.nix
index ce4d4d1003f5..6b598f1dbd96 100644
--- a/pkgs/development/python-modules/stanza/default.nix
+++ b/pkgs/development/python-modules/stanza/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "stanza";
-  version = "1.12.0";
+  version = "1.12.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "stanfordnlp";
     repo = "stanza";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uarx5HY6sxm2Fr12Vti4IluqOhFosf8QYIP2WMxdFfI=";
+    hash = "sha256-e4f/Th9zCVBe05v7NI+IXiSbCfcKVZvDFAKq8ZrsQjA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/torch-memory-saver/default.nix b/pkgs/development/python-modules/torch-memory-saver/default.nix
new file mode 100644
index 000000000000..cba5fd9c72c1
--- /dev/null
+++ b/pkgs/development/python-modules/torch-memory-saver/default.nix
@@ -0,0 +1,94 @@
+{
+  lib,
+  buildPythonPackage,
+  cudaPackages,
+  fetchFromGitHub,
+  symlinkJoin,
+
+  # build-system
+  setuptools,
+
+  # nativeBuildInputs
+  autoAddDriverRunpath,
+
+  # dependencies
+  torch,
+
+  # tests
+  nvidia-ml-py,
+  pytestCheckHook,
+  torch-memory-saver,
+}:
+buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
+  pname = "torch-memory-saver";
+  version = "0.0.9.post1";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "fzyzcjy";
+    repo = "torch_memory_saver";
+    # branch 0.0.9.post1
+    rev = "0c88c358824bd304daeec34ac792a55e3fa2c1f2";
+    hash = "sha256-xYkHhfCj3cOzAK5pmWCDfRw5FL8BzBkeUaDnqVlmSiY=";
+  };
+
+  # fix CUDA library_dirs
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail lib64 lib
+  '';
+
+  build-system = [
+    setuptools
+  ];
+
+  nativeBuildInputs = [
+    autoAddDriverRunpath
+  ];
+
+  env = {
+    TMS_CUDA_MAJOR = cudaPackages.cudaMajorVersion;
+    CUDA_HOME = symlinkJoin {
+      name = "cudatoolkit-joined";
+      paths = [
+        cudaPackages.cuda_nvcc # crt/host_defines.h
+        cudaPackages.cuda_cudart # cuda_runtime_api.h
+      ];
+    };
+  };
+
+  dependencies = [
+    nvidia-ml-py
+    torch
+  ];
+
+  pythonImportsCheck = [ "torch_memory_saver" ];
+
+  preCheck = ''
+    rm -r torch_memory_saver
+  '';
+
+  # requires GPU
+  doCheck = false;
+  nativeCheckInputs = [
+    # propagated from torch
+    nvidia-ml-py
+    pytestCheckHook
+  ];
+
+  passthru.gpuCheck = torch-memory-saver.overridePythonAttrs {
+    requiredSystemFeatures = [ "cuda" ];
+    doCheck = true;
+  };
+
+  meta = {
+    description = "Library that allows tensor memory to be temporarily released and resumed later";
+    homepage = "https://github.com/fzyzcjy/torch_memory_saver";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ prince213 ];
+    # TODO: ROCm
+    broken = !torch.cudaSupport;
+  };
+})
diff --git a/pkgs/development/python-modules/torchtitan/default.nix b/pkgs/development/python-modules/torchtitan/default.nix
index 44bb493de581..e7e16da4040f 100644
--- a/pkgs/development/python-modules/torchtitan/default.nix
+++ b/pkgs/development/python-modules/torchtitan/default.nix
@@ -22,6 +22,7 @@
   # tests
   pytestCheckHook,
   tomli-w,
+  triton,
   writableTmpDirAsHomeHook,
 }:
 
@@ -60,6 +61,7 @@ buildPythonPackage (finalAttrs: {
     pytestCheckHook
     tomli-w
     transformers
+    triton
     writableTmpDirAsHomeHook
   ];
 
diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index e0083addb03f..e5f06e7d481d 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -185,7 +185,6 @@ let
       X86_INTEL_LPSS = yes;
       X86_INTEL_PSTATE = yes;
       X86_AMD_PSTATE = whenAtLeast "5.17" yes;
-      X86_AMD_PSTATE_DYNAMIC_EPP = whenAtLeast "7.1" yes;
       # Intel DPTF (Dynamic Platform and Thermal Framework) Support
       ACPI_DPTF = yes;
 
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/lovelace-expander-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/lovelace-expander-card/package.nix
new file mode 100644
index 000000000000..3c349b0a31e5
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/lovelace-expander-card/package.nix
@@ -0,0 +1,69 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  fetchPnpmDeps,
+  pnpmConfigHook,
+  pnpm_10,
+  nodejs,
+}:
+let
+  pnpm = pnpm_10;
+in
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "lovelace-expander-card";
+  version = "0.1.5";
+
+  src = fetchFromGitHub {
+    owner = "Alia5";
+    repo = "lovelace-expander-card";
+    tag = finalAttrs.version;
+    hash = "sha256-D76gZR2yEZJrfaesomrpyMg/OPRfVjdDUwcl0EqqNmg=";
+  };
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs) pname version src;
+    inherit pnpm;
+    fetcherVersion = 3;
+    hash = "sha256-L+lLJICyh7BhW9CF0+yhYginUx95EQ4de9gXQl8XmOo=";
+  };
+
+  nativeBuildInputs = [
+    pnpmConfigHook
+    pnpm
+    nodejs
+  ];
+
+  # Upstream tries to get the version via git; since Nix' fetchers don't give us
+  # the .git directory this'll fail, so we provide it manually
+  postPatch = ''
+    substituteInPlace package.json \
+      --replace-fail 'VERSION=$(git describe --tags)' 'VERSION=${finalAttrs.version}'
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    pnpm run build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out"
+    cp dist/*.js "$out"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Home Assistant Lovelace card that wraps other cards in a collapsible expander";
+    homepage = "https://github.com/Alia5/lovelace-expander-card";
+    changelog = "https://github.com/Alia5/lovelace-expander-card/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ kilyanni ];
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 75b4ff0e3a9c..42f7e233afab 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -7832,6 +7832,10 @@ self: super: with self; {
 
   irm-kmi-api = callPackage ../development/python-modules/irm-kmi-api { };
 
+  ironcalc = callPackage ../by-name/ir/ironcalc/python.nix {
+    inherit (pkgs) ironcalc;
+  };
+
   isal = callPackage ../development/python-modules/isal { };
 
   isbnlib = callPackage ../development/python-modules/isbnlib { };
@@ -19830,6 +19834,8 @@ self: super: with self; {
 
   torch-geometric = callPackage ../development/python-modules/torch-geometric { };
 
+  torch-memory-saver = callPackage ../development/python-modules/torch-memory-saver { };
+
   # Required to test triton
   torch-no-triton = self.torch.override { tritonSupport = false; };