diff --git a/doc/channels.chapter.md b/doc/channels.chapter.md
new file mode 100644
index 000000000000..1b6b28a4382d
--- /dev/null
+++ b/doc/channels.chapter.md
@@ -0,0 +1,26 @@
+# How channels work {#how-channels-work}
+
+nixpkgs uses the [channels feature](https://nixos.org/nix/manual/#sec-channels) of nix.
+
+nixpkgs is distributed for users of Nix on non-NixOS distributions through the channel
+`nixpkgs-unstable`. Users of NixOS generally use one of the `nixos-*` channels,
+e.g. `nixos-22.11`, which includes all packages and modules for the stable NixOS
+22.11. Stable NixOS releases are generally only given
+security updates. More up to date packages and modules are available via the
+`nixos-unstable` channel.
+
+Both `nixos-unstable` and `nixpkgs-unstable` follow the `master` branch of the
+nixpkgs repository, although both do lag the `master` branch by generally
+[a couple of days](https://status.nixos.org/). Updates to a channel are
+distributed as soon as all tests for that channel pass, e.g.
+[this table](https://hydra.nixos.org/job/nixpkgs/trunk/unstable#tabs-constituents)
+shows the status of tests for the `nixpkgs-unstable` channel.
+
+The tests are conducted by a cluster called [Hydra](https://nixos.org/hydra/),
+which also builds binary packages from the Nix expressions in Nixpkgs for
+`x86_64-linux`, `aarch64-linux`, `x86_64-darwin` and `aarch64-darwin`.
+The binaries are made available via a [binary cache](https://cache.nixos.org).
+
+The current Nix expressions of the channels are available in the
+[nixpkgs repository](https://github.com/NixOS/nixpkgs) in branches
+that correspond to the channel names (e.g. `nixos-22.11-small`).
diff --git a/doc/preface.chapter.md b/doc/preface.chapter.md
index 30722e9fcdaa..204ccf1fb2dd 100644
--- a/doc/preface.chapter.md
+++ b/doc/preface.chapter.md
@@ -1,50 +1,14 @@
-# Preface {#preface}
+# Overview {#preface}
 
-The Nix Packages collection (Nixpkgs) is a set of thousands of packages for the
-[Nix package manager](https://nixos.org/nix/), released under a
-[permissive MIT license](https://github.com/NixOS/nixpkgs/blob/master/COPYING).
-Packages are available for several platforms, and can be used with the Nix
-package manager on most GNU/Linux distributions as well as [NixOS](https://nixos.org/nixos).
+Nixpkgs is a set of packages for the [Nix package manager](https://nixos.org/nix/), released under the [MIT license](https://github.com/NixOS/nixpkgs/blob/master/COPYING).
 
-This document is the user [_reference_](https://nix.dev/contributing/documentation/diataxis#reference) manual for Nixpkgs.
-It describes the entire public interface of Nixpkgs in a concise and orderly manner, and all relevant behaviors, with examples and cross-references.
+Further documentation:
 
-To discover other kinds of documentation:
 - [nix.dev](https://nix.dev/): Tutorials and guides for getting things done with Nix
-- [NixOS **Option Search**](https://search.nixos.org/options) and reference documentation
-- [Nixpkgs **Package Search**](https://search.nixos.org/packages)
-- [**NixOS** manual](https://nixos.org/manual/nixos/stable/): Reference documentation for the NixOS Linux distribution
-- [`CONTRIBUTING.md`](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md): Contributing to Nixpkgs, including this manual
-
-## Overview of Nixpkgs {#overview-of-nixpkgs}
+- [NixOS Search](https://search.nixos.org)
+- [Contributing](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md): to Nixpkgs
 
 Nix expressions describe how to build packages from source and are collected in
-the [Nixpkgs repository](https://github.com/NixOS/nixpkgs). Also included in the
-collection are Nix expressions for
-[NixOS modules](https://nixos.org/nixos/manual/index.html#sec-writing-modules).
-With these expressions the Nix package manager can build binary packages.
+the [nixpkgs repository](https://github.com/NixOS/nixpkgs).
 
-Packages, including the Nix packages collection, are distributed through
-[channels](https://nixos.org/nix/manual/#sec-channels). The collection is
-distributed for users of Nix on non-NixOS distributions through the channel
-`nixpkgs-unstable`. Users of NixOS generally use one of the `nixos-*` channels,
-e.g., `nixos-22.11`, which includes all packages and modules for the stable NixOS
-22.11. Stable NixOS releases are generally only given
-security updates. More up-to-date packages and modules are available via the
-`nixos-unstable` channel.
-
-Both `nixos-unstable` and `nixpkgs-unstable` follow the `master` branch of the
-Nixpkgs repository, although both do lag the `master` branch by generally
-[a couple of days](https://status.nixos.org/). Updates to a channel are
-distributed as soon as all tests for that channel pass, e.g.,
-[this table](https://hydra.nixos.org/job/nixpkgs/trunk/unstable#tabs-constituents)
-shows the status of tests for the `nixpkgs-unstable` channel.
-
-The tests are conducted by a cluster called [Hydra](https://nixos.org/hydra/),
-which also builds binary packages from the Nix expressions in Nixpkgs for
-`x86_64-linux`, `aarch64-linux`, and `aarch64-darwin`.
-The binaries are made available via a [binary cache](https://cache.nixos.org).
-
-The current Nix expressions of the channels are available in the
-[Nixpkgs repository](https://github.com/NixOS/nixpkgs) in branches
-that correspond to the channel names (e.g., `nixos-22.11-small`).
+Packages are distributed through [channels](#how-channels-work).
diff --git a/doc/redirects.json b/doc/redirects.json
index 04d844ceaa2c..19ac1ce89977 100644
--- a/doc/redirects.json
+++ b/doc/redirects.json
@@ -152,6 +152,9 @@
   "ghc-deprecation-policy": [
     "index.html#ghc-deprecation-policy"
   ],
+  "how-channels-work": [
+    "index.html#how-channels-work"
+  ],
   "inkscape-plugins": [
     "index.html#inkscape-plugins"
   ],
@@ -395,9 +398,7 @@
     "index.html#pnpm-build-hook-honored-variables"
   ],
   "preface": [
-    "index.html#preface"
-  ],
-  "overview-of-nixpkgs": [
+    "index.html#preface",
     "index.html#overview-of-nixpkgs"
   ],
   "part-using": [
diff --git a/doc/using-nixpkgs.md b/doc/using-nixpkgs.md
index f850b2e83c28..a8546d0cc0f1 100644
--- a/doc/using-nixpkgs.md
+++ b/doc/using-nixpkgs.md
@@ -1,6 +1,7 @@
 # Using Nixpkgs {#part-using}
 
 ```{=include=} chapters
+channels.chapter.md
 using/platform-support.chapter.md
 using/configuration.chapter.md
 using/overlays.chapter.md
diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index 848ec7504431..0f0c252654b1 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -155,4 +155,4 @@
   - If [`system.stateVersion`](#opt-system.stateVersion) is >=25.11, `pkgs.nextcloud32` will be installed by default.
   - Please note that Nextcloud prohibits skipping major versions while upgrading. You can upgrade to specific versions by declaring `services.nextcloud.package = pkgs.nextcloud33;`.
 
-  - `trilium-desktop` and `trilium-server` have been updated to 0.104.0. This release includes security hardening fixes that may break functionality. [See upstream release note for details](https://github.com/TriliumNext/Trilium/releases/tag/v0.104.0).
+- `trilium-desktop` and `trilium-server` have been updated to 0.104.0. This release includes security hardening fixes that may break functionality. [See upstream release note for details](https://github.com/TriliumNext/Trilium/releases/tag/v0.104.0).
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index cc8c6e00da6f..fa043d3cdb9e 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -16,9 +16,9 @@ let
       inherit tiling_wm;
     };
   stableVersion = {
-    version = "2026.1.1.10"; # "Android Studio Quail 1 | 2026.1.1 Patch 2"
-    sha256Hash = "sha256-+9PxFtEsrtck6o2g0s2ufnkRcPefKqESc+oPLSKiJNw=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.1.10/android-studio-quail1-patch2-linux.tar.gz";
+    version = "2026.1.2.10"; # "Android Studio Quail 2 | 2026.1.2"
+    sha256Hash = "sha256-ZERaVAkucFbG638aia0RbQ/uwu9flluOWU1iq9tYWQ8=";
+    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.2.10/android-studio-quail2-linux.tar.gz";
   };
   betaVersion = {
     version = "2026.1.3.5"; # "Android Studio Quail 3 | 2026.1.3 RC 1"
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index cbd1d9c429a9..7c0b5e1fb31f 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -12142,12 +12142,12 @@ final: prev: {
 
   none-ls-extras-nvim = buildVimPlugin {
     pname = "none-ls-extras.nvim";
-    version = "0-unstable-2026-06-06";
+    version = "0-unstable-2026-07-17";
     src = fetchFromGitHub {
       owner = "nvimtools";
       repo = "none-ls-extras.nvim";
-      rev = "27681d797a26f1b4d6119296df42f5204c88a2dc";
-      hash = "sha256-GZLT8X1eLeSkiV5EN1nOkCQg5nwNATURi/KMj90i40I=";
+      rev = "9a8b8a9aeb43382e5aaf49b00b7cfb5d42d32118";
+      hash = "sha256-YmDhDUqSJPOllXzkyrVUgnshrI5+Kt5Te8tEmnjOAVQ=";
     };
     meta.homepage = "https://github.com/nvimtools/none-ls-extras.nvim/";
     meta.license = getLicenseFromSpdxId "Unlicense";
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 5ccb9ddd6506..aee1f1aa5955 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -3602,7 +3602,6 @@ assertNoAdditions {
       snacks-nvim
       telescope-nvim
     ];
-    dependencies = [ self.plenary-nvim ];
     nvimSkipModules = [
       # Issue reproduction file
       "minimal"
diff --git a/pkgs/applications/editors/vscode/generic.nix b/pkgs/applications/editors/vscode/generic.nix
index 7c365bee3791..31e906008227 100644
--- a/pkgs/applications/editors/vscode/generic.nix
+++ b/pkgs/applications/editors/vscode/generic.nix
@@ -419,7 +419,11 @@ stdenv.mkDerivation (
         let
           nodeModulesPath =
             if stdenv.hostPlatform.isDarwin then
-              if lib.versionAtLeast vscodeVersion "1.94.0" then
+              # 1.129 moved node_modules back into app.asar, shipping native
+              # binaries in the asar.unpacked directory like before 1.94
+              if lib.versionAtLeast vscodeVersion "1.129.0" then
+                "Contents/Resources/app/node_modules.asar.unpacked"
+              else if lib.versionAtLeast vscodeVersion "1.94.0" then
                 "Contents/Resources/app/node_modules"
               else
                 "Contents/Resources/app/node_modules.asar.unpacked"
diff --git a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprland-plugins.nix b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprland-plugins.nix
index 042337749148..f6ee4ff81dab 100644
--- a/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprland-plugins.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprland-plugins.nix
@@ -13,13 +13,13 @@ let
             mkHyprlandPlugin,
           }:
           let
-            version = "0.55.0";
+            version = "0.56.0";
 
             hyprland-plugins-src = fetchFromGitHub {
               owner = "hyprwm";
               repo = "hyprland-plugins";
               tag = "v${version}";
-              hash = "sha256-WMUJ7tyw/9QbKUyRzLndEQSqX05fQLmFlRdMAmPD7tI=";
+              hash = "sha256-piRpwar7VZI3YviYo0a/UMFz9+rLesfv3nRLGKxjVGg=";
             };
           in
           mkHyprlandPlugin {
diff --git a/pkgs/by-name/ae/aerion-creds/package.nix b/pkgs/by-name/ae/aerion-creds/package.nix
new file mode 100644
index 000000000000..1a35d0db6abe
--- /dev/null
+++ b/pkgs/by-name/ae/aerion-creds/package.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+}:
+
+let
+  version = "0.3.2";
+
+  archMap = {
+    "x86_64-linux" = "x86_64";
+    "aarch64-linux" = "aarch64";
+  };
+  sysArch =
+    archMap.${stdenv.hostPlatform.system}
+      or (throw "Unsupported architecture: ${stdenv.hostPlatform.system}");
+
+  shimHashes = {
+    "x86_64" = "sha256-8WvuQgWTJNe4UpmS6uSYDYm46sIqxJbwVZ/J3CRz0OI=";
+    "aarch64" = "sha256-4RvFbxJGwM70huziY2ELoCouTrtMasgoqFUncBeBFvU=";
+  };
+in
+stdenv.mkDerivation {
+  pname = "aerion-creds";
+  inherit version;
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchurl {
+    url = "https://github.com/hkdb/aerion/releases/download/v${version}/flathub-build-env-v${version}-linux-${sysArch}";
+    hash = shimHashes.${sysArch};
+  };
+
+  dontUnpack = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp $src $out/bin/aerion-creds
+    chmod +x $out/bin/aerion-creds
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "OAuth credentials shim for Aerion";
+    homepage = "https://github.com/hkdb/aerion";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ curious ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+}
diff --git a/pkgs/by-name/ae/aerion/package.nix b/pkgs/by-name/ae/aerion/package.nix
new file mode 100644
index 000000000000..d4325f5ce8b6
--- /dev/null
+++ b/pkgs/by-name/ae/aerion/package.nix
@@ -0,0 +1,103 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  buildNpmPackage,
+  fetchFromGitHub,
+  pkg-config,
+  wrapGAppsHook3,
+  gtk3,
+  webkitgtk_4_1,
+  glib,
+
+  aerion-creds,
+  withOAuth ? false,
+}:
+
+let
+  version = "0.3.2";
+
+  src = fetchFromGitHub {
+    owner = "hkdb";
+    repo = "aerion";
+    rev = "v${version}";
+    hash = "sha256-elmk4huz4mvc7t+5/ZM5AK2R4pSKrLsZM0HxWFmQldE=";
+  };
+
+  frontend = buildNpmPackage {
+    pname = "aerion-frontend";
+    inherit version src;
+
+    sourceRoot = "${src.name}/frontend";
+
+    npmDepsHash = "sha256-dC+xGwSqdzItIfDipAVIVnbUJHiFkmzanjV/5xFsbkc=";
+
+    buildPhase = ''
+      npm run build
+    '';
+
+    installPhase = ''
+      mkdir -p $out
+      cp -r dist/* $out/
+    '';
+  };
+
+in
+buildGoModule {
+  pname = "aerion";
+  inherit version src;
+
+  __structuredAttrs = true;
+
+  vendorHash = "sha256-ptsrOpJo3i+yRSCGuHynbzi+C+GD/mBmPuHqWSVV/+4=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    wrapGAppsHook3
+  ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    gtk3
+    webkitgtk_4_1
+    glib
+  ];
+
+  tags = [
+    "production"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    "desktop"
+    "webkit2_41"
+  ];
+
+  preBuild = ''
+    mkdir -p frontend/dist
+    cp -r ${frontend}/* frontend/dist/
+  '';
+
+  postInstall = lib.optionalString stdenv.hostPlatform.isLinux (
+    ''
+      install -Dm644 build/linux/aerion.png $out/share/pixmaps/io.github.hkdb.Aerion.png
+      install -Dm644 build/linux/aerion.desktop $out/share/applications/io.github.hkdb.Aerion.desktop
+    ''
+    + lib.optionalString withOAuth ''
+      rm -f $out/bin/aerion-creds
+      ln -s ${aerion-creds}/bin/aerion-creds $out/bin/aerion-creds
+    ''
+  );
+
+  passthru = {
+    inherit frontend;
+    updateScript = ./update.sh;
+  };
+
+  meta = {
+    description = "An Open Source Lightweight E-Mail Client";
+    homepage = "https://github.com/hkdb/aerion";
+    license = lib.licenses.asl20;
+    mainProgram = "aerion";
+    maintainers = with lib.maintainers; [ curious ];
+  };
+}
diff --git a/pkgs/by-name/ae/aerion/update.sh b/pkgs/by-name/ae/aerion/update.sh
new file mode 100755
index 000000000000..b07f4e73f5ed
--- /dev/null
+++ b/pkgs/by-name/ae/aerion/update.sh
@@ -0,0 +1,33 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix nix-update nix-prefetch-scripts common-updater-scripts
+
+set -euo pipefail
+
+nixpkgs="$(git rev-parse --show-toplevel)"
+aerion_creds_file="$nixpkgs/pkgs/by-name/ae/aerion-creds/package.nix"
+
+version=$(list-git-tags --url=https://github.com/hkdb/aerion \
+  | grep -oP '^v\d+\.\d+\.\d+$' \
+  | sed 's/^v//' \
+  | sort -V \
+  | tail -1)
+
+echo "Updating aerion and aerion-creds to v$version"
+
+# Update version in creds file
+sed -i "s/version = \".*\";/version = \"$version\";/" "$aerion_creds_file"
+
+# Update creds binary hashes
+for arch in x86_64 aarch64; do
+    url="https://github.com/hkdb/aerion/releases/download/v$version/flathub-build-env-v$version-linux-$arch"
+    echo "  Fetching creds hash for $arch..."
+    hash=$(nix-prefetch-url --type sha256 "$url")
+    sri_hash=$(nix-hash --to-sri --type sha256 "$hash")
+    sed -i "s|\"$arch\" = \"sha256-[^\"]*\";|\"$arch\" = \"$sri_hash\";|" "$aerion_creds_file"
+done
+
+# Update main package (handles version, source hash, npmDepsHash, vendorHash)
+cd "$nixpkgs"
+nix-update --version="$version" --subpackage frontend aerion
+
+echo "Done!"
diff --git a/pkgs/by-name/an/android-studio-tools/package.nix b/pkgs/by-name/an/android-studio-tools/package.nix
index a461d9b81ec7..ea2d93edd66f 100644
--- a/pkgs/by-name/an/android-studio-tools/package.nix
+++ b/pkgs/by-name/an/android-studio-tools/package.nix
@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "android-studio-tools";
-  version = "14742923";
+  version = "15859902";
 
   src = fetchzip {
     # The only difference between the Linux and Mac versions is a single comment at the top of all the scripts
     # Therefore, we will use the Linux version and just patch the comment
-    url = "https://dl.google.com/android/repository/commandlinetools-linux-14742923_latest.zip";
-    hash = "sha256-oimC4ToDFIa8Rlv+5RB+swl8M5PHdX4omlrMZMQEx8M=";
+    url = "https://dl.google.com/android/repository/commandlinetools-linux-15859902_latest.zip";
+    hash = "sha256-tCbccw7qa7ncHGyWPWjwQOpaisN3QMRYXRpK7WtyjWY=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/aq/aquamarine/package.nix b/pkgs/by-name/aq/aquamarine/package.nix
index a0c4c6ccc057..70eabcf2a3fc 100644
--- a/pkgs/by-name/aq/aquamarine/package.nix
+++ b/pkgs/by-name/aq/aquamarine/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  gcc15Stdenv,
+  gcc16Stdenv,
   cmake,
   fetchFromGitHub,
   hwdata,
@@ -21,7 +21,7 @@
   wayland-protocols,
   wayland-scanner,
 }:
-gcc15Stdenv.mkDerivation (finalAttrs: {
+gcc16Stdenv.mkDerivation (finalAttrs: {
   pname = "aquamarine";
   version = "0.13.0";
 
diff --git a/pkgs/by-name/cl/clickhouse/lts.nix b/pkgs/by-name/cl/clickhouse/lts.nix
index 297d75ea3bd9..aed4568a8329 100644
--- a/pkgs/by-name/cl/clickhouse/lts.nix
+++ b/pkgs/by-name/cl/clickhouse/lts.nix
@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "26.3.17.4-lts";
-  rev = "00f5ad7bc29d8bb65e1f7eb24208da15db3cf642";
-  hash = "sha256-RJSqcsn3ZOL145RTUs4QujPm6DHjDSYiL9jI1C1YCVE=";
+  version = "26.3.17.56-lts";
+  rev = "c57540de480d8a501b601163471d3843674378cf";
+  hash = "sha256-fcRxZbcp7t28bC9vlmgVAV9gB63cQwFWsc0gyKxGhvQ=";
   lts = true;
 }
diff --git a/pkgs/by-name/co/cockpit-zfs/package.nix b/pkgs/by-name/co/cockpit-zfs/package.nix
index 5ead4c6b4786..23189d2644da 100644
--- a/pkgs/by-name/co/cockpit-zfs/package.nix
+++ b/pkgs/by-name/co/cockpit-zfs/package.nix
@@ -46,14 +46,14 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cockpit-zfs";
-  version = "1.2.30";
+  version = "1.2.33";
 
   src = fetchFromGitHub {
     owner = "45Drives";
     repo = "cockpit-zfs";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-G24xNoKoBnlXxxyo9IJIoQW3PrktQxsx37/cX6QYfyE=";
+    hash = "sha256-3KoCp4gcWYuama+7t1oQhif3/Ii/zSlhyeNTH3mvbNg=";
   };
 
   missingHashes = ./missing-hashes.json;
diff --git a/pkgs/by-name/gi/git-gamble/package.nix b/pkgs/by-name/gi/git-gamble/package.nix
index 80b21f663197..cccfb68ae07b 100644
--- a/pkgs/by-name/gi/git-gamble/package.nix
+++ b/pkgs/by-name/gi/git-gamble/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "git-gamble";
-  version = "2.14.4";
+  version = "2.14.6";
 
   src = fetchFromGitLab {
     owner = "pinage404";
     repo = "git-gamble";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-DjwdoM9/W1UeD/XqVMXTyzjdcJLfHiAqRA3r//rkn1U=";
+    hash = "sha256-+YjAXELI4AnHTZ7PvBWhvu3BQP7kys5VV2EllyABYKo=";
   };
 
-  cargoHash = "sha256-X3kJT0pscCH9sQxV3NkX0hL2sccTJHgMj0UeIpJOWJ4=";
+  cargoHash = "sha256-UHj/rhL9/r/UUtlgqTgMr9jFNRwwFDrfltyB5PyZanM=";
 
   nativeCheckInputs = [ gitMinimal ];
   preCheck = ''
diff --git a/pkgs/by-name/gi/github-copilot-cli/package.nix b/pkgs/by-name/gi/github-copilot-cli/package.nix
index 300fb5ba4bdf..059625b1bb30 100644
--- a/pkgs/by-name/gi/github-copilot-cli/package.nix
+++ b/pkgs/by-name/gi/github-copilot-cli/package.nix
@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "github-copilot-cli";
-  version = "1.0.26";
+  version = "1.0.61";
 
   # GitHub provide platform-specific SEA binaries as well as a "universal"
   # package.  Use the universal package as it gives us a bit more flexibility
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
   # about how paths should be set up which don't reliably hold when using Nix.
   src = fetchurl {
     url = "https://github.com/github/copilot-cli/releases/download/v${finalAttrs.version}/github-copilot-${finalAttrs.version}.tgz";
-    hash = "sha256-zNO0clQRfgw6CX9K8NaJXsoOhhNjBfK7KAr0AoL7Oqo=";
+    hash = "sha256-8Lks8lHa5XF9ZrC+fU/9VlzD1W32MbRZ7PZtL5YWLTA=";
   };
 
   nativeBuildInputs = [
@@ -58,6 +58,10 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   postInstall = ''
+    # Upstream bundles linuxmusl prebuilds in the universal tarball; they are
+    # not needed on glibc systems and make autoPatchelf fail on musl libc deps.
+    find "$out"/lib/github-copilot-cli -depth -path '*/linuxmusl-*' -exec rm -rf '{}' +
+
     makeWrapper ${nodejs}/bin/node "$out"/bin/copilot \
       --add-flag "$out"/lib/github-copilot-cli/index.js \
       --add-flag --no-auto-update \
@@ -82,6 +86,11 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/github/copilot-cli";
     changelog = "https://github.com/github/copilot-cli/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.unfree;
+    sourceProvenance = with lib.sourceTypes; [
+      binaryNativeCode # including contents of the prebuild directory
+      binaryBytecode # including WASM files
+      obfuscatedCode # including minified JavaScript
+    ];
     maintainers = with lib.maintainers; [
       me-and
     ];
diff --git a/pkgs/by-name/ha/handheld-daemon-ui/package.nix b/pkgs/by-name/ha/handheld-daemon-ui/package.nix
index 2f9401cb7c7e..b857c4f8d5b3 100644
--- a/pkgs/by-name/ha/handheld-daemon-ui/package.nix
+++ b/pkgs/by-name/ha/handheld-daemon-ui/package.nix
@@ -5,11 +5,11 @@
 }:
 let
   pname = "handheld-daemon-ui";
-  version = "3.4.0";
+  version = "3.4.2";
 
   src = fetchurl {
     url = "https://github.com/hhd-dev/hhd-ui/releases/download/v${version}/hhd-ui.Appimage";
-    hash = "sha256-OeZMh3lC3fluwz1pU3JnLRkwFYiIkthGuclYkOJm430=";
+    hash = "sha256-91Wa50dJAW6Re1MBperHFoftAPagihUP4fv5cMb+pxI=";
   };
   extractedFiles = appimageTools.extractType2 { inherit pname version src; };
 in
diff --git a/pkgs/by-name/hy/hyprcursor/package.nix b/pkgs/by-name/hy/hyprcursor/package.nix
index e5d88a861a59..8a80d746c340 100644
--- a/pkgs/by-name/hy/hyprcursor/package.nix
+++ b/pkgs/by-name/hy/hyprcursor/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  gcc15Stdenv,
+  gcc16Stdenv,
   fetchFromGitHub,
   cmake,
   pkg-config,
@@ -12,7 +12,7 @@
   tomlplusplus,
   nix-update-script,
 }:
-gcc15Stdenv.mkDerivation (finalAttrs: {
+gcc16Stdenv.mkDerivation (finalAttrs: {
   pname = "hyprcursor";
   version = "0.1.13";
 
diff --git a/pkgs/by-name/hy/hyprgraphics/package.nix b/pkgs/by-name/hy/hyprgraphics/package.nix
index f86e13d8b3fb..334342d67dfc 100644
--- a/pkgs/by-name/hy/hyprgraphics/package.nix
+++ b/pkgs/by-name/hy/hyprgraphics/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  gcc15Stdenv,
+  gcc16Stdenv,
   fetchFromGitHub,
   nix-update-script,
   cmake,
@@ -20,7 +20,7 @@
   pixman,
 }:
 
-gcc15Stdenv.mkDerivation (finalAttrs: {
+gcc16Stdenv.mkDerivation (finalAttrs: {
   pname = "hyprgraphics";
   version = "0.5.1";
 
diff --git a/pkgs/by-name/hy/hypridle/package.nix b/pkgs/by-name/hy/hypridle/package.nix
index 6ee8b3d9a6b0..ac234335a428 100644
--- a/pkgs/by-name/hy/hypridle/package.nix
+++ b/pkgs/by-name/hy/hypridle/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  gcc15Stdenv,
+  gcc16Stdenv,
   fetchFromGitHub,
   pkg-config,
   cmake,
@@ -16,7 +16,7 @@
   nix-update-script,
 }:
 
-gcc15Stdenv.mkDerivation (finalAttrs: {
+gcc16Stdenv.mkDerivation (finalAttrs: {
   pname = "hypridle";
   version = "0.1.7";
 
diff --git a/pkgs/by-name/hy/hyprland-protocols/package.nix b/pkgs/by-name/hy/hyprland-protocols/package.nix
index 4f86862e1d81..32080ececc2f 100644
--- a/pkgs/by-name/hy/hyprland-protocols/package.nix
+++ b/pkgs/by-name/hy/hyprland-protocols/package.nix
@@ -1,11 +1,11 @@
 {
   lib,
-  gcc15Stdenv,
+  gcc16Stdenv,
   fetchFromGitHub,
   meson,
   ninja,
 }:
-gcc15Stdenv.mkDerivation (finalAttrs: {
+gcc16Stdenv.mkDerivation (finalAttrs: {
   pname = "hyprland-protocols";
   version = "0.7.0";
 
diff --git a/pkgs/by-name/hy/hyprland-qt-support/package.nix b/pkgs/by-name/hy/hyprland-qt-support/package.nix
index 7e57ce1683d1..bc39d8d3b1a7 100644
--- a/pkgs/by-name/hy/hyprland-qt-support/package.nix
+++ b/pkgs/by-name/hy/hyprland-qt-support/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  gcc15Stdenv,
+  gcc16Stdenv,
   fetchFromGitHub,
   cmake,
   ninja,
@@ -8,7 +8,7 @@
   pkg-config,
   hyprlang,
 }:
-gcc15Stdenv.mkDerivation (finalAttrs: {
+gcc16Stdenv.mkDerivation (finalAttrs: {
   pname = "hyprland-qt-support";
   version = "0.1.0";
 
diff --git a/pkgs/by-name/hy/hyprland-qtutils/package.nix b/pkgs/by-name/hy/hyprland-qtutils/package.nix
index d4dc6b4bb4db..6b01abe566c9 100644
--- a/pkgs/by-name/hy/hyprland-qtutils/package.nix
+++ b/pkgs/by-name/hy/hyprland-qtutils/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  gcc15Stdenv,
+  gcc16Stdenv,
   fetchFromGitHub,
   fetchpatch,
   cmake,
@@ -13,7 +13,7 @@
 let
   inherit (lib.strings) makeBinPath;
 in
-gcc15Stdenv.mkDerivation (finalAttrs: {
+gcc16Stdenv.mkDerivation (finalAttrs: {
   pname = "hyprland-qtutils";
   version = "0.1.5";
 
diff --git a/pkgs/by-name/hy/hyprland/info.json b/pkgs/by-name/hy/hyprland/info.json
index 4d58cbca04d1..ca344a406950 100644
--- a/pkgs/by-name/hy/hyprland/info.json
+++ b/pkgs/by-name/hy/hyprland/info.json
@@ -1,7 +1,7 @@
 {
-  "branch": "v0.55.4-b",
-  "commit_hash": "a0136d8c04687bb36eb8a28eb9d1ff92aea99704",
-  "commit_message": "[gha] Nix: update inputs",
-  "date": "2026-06-11",
-  "tag": "v0.55.4"
+  "branch": "main",
+  "commit_hash": "36b2e0cfe0c6094dbc47bd42a437431315bb3087",
+  "commit_message": "version: bump to 0.56.0",
+  "date": "2026-07-20",
+  "tag": "v0.56.0"
 }
diff --git a/pkgs/by-name/hy/hyprland/package.nix b/pkgs/by-name/hy/hyprland/package.nix
index d7034ce9cb8e..dc16a98cc29c 100644
--- a/pkgs/by-name/hy/hyprland/package.nix
+++ b/pkgs/by-name/hy/hyprland/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  gcc15Stdenv,
+  gcc16Stdenv,
   stdenvAdapters,
   fetchFromGitHub,
   pkg-config,
@@ -22,6 +22,7 @@
   lcms2,
   libGL,
   libdrm,
+  libei,
   libexecinfo,
   libgbm,
   libinput,
@@ -34,6 +35,7 @@
   pkgconf,
   python3,
   re2,
+  readline,
   systemd,
   tomlplusplus,
   uwsm,
@@ -48,7 +50,7 @@
   xwayland,
   debug ? false,
   enableXWayland ? true,
-  withSystemd ? lib.meta.availableOn gcc15Stdenv.hostPlatform systemd,
+  withSystemd ? lib.meta.availableOn gcc16Stdenv.hostPlatform systemd,
   wrapRuntimeDeps ? true,
 }:
 let
@@ -75,22 +77,22 @@ let
   # which would be controlled by the `debug` flag
   # Condition on darwin to avoid breaking eval for darwin in CI,
   # even though darwin is not supported anyway.
-  adapters = lib.optionals (!gcc15Stdenv.targetPlatform.isDarwin) [
+  adapters = lib.optionals (!gcc16Stdenv.targetPlatform.isDarwin) [
     stdenvAdapters.useMoldLinker
   ];
 
-  customStdenv = foldl' (acc: adapter: adapter acc) gcc15Stdenv adapters;
+  customStdenv = foldl' (acc: adapter: adapter acc) gcc16Stdenv adapters;
 in
 customStdenv.mkDerivation (finalAttrs: {
   pname = "hyprland" + optionalString debug "-debug";
-  version = "0.55.4";
+  version = "0.56.0";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprland";
     fetchSubmodules = true;
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IuT0HnOr/0rAw+GXr+OwWx89FjA4Og1FqP7vywEwRJM=";
+    hash = "sha256-TWj51lMAgmEYl5x87wsKbuyWDk6QEG5t1uchw9zdJNE=";
   };
 
   postPatch = ''
@@ -156,6 +158,7 @@ customStdenv.mkDerivation (finalAttrs: {
       lcms2
       libGL
       libdrm
+      libei
       libgbm
       libinput
       libuuid
@@ -166,6 +169,7 @@ customStdenv.mkDerivation (finalAttrs: {
       pango
       pciutils
       re2
+      readline
       tomlplusplus
       wayland
       wayland-protocols
diff --git a/pkgs/by-name/hy/hyprlang/package.nix b/pkgs/by-name/hy/hyprlang/package.nix
index 86aaf9d5cc68..673b0b49cdf5 100644
--- a/pkgs/by-name/hy/hyprlang/package.nix
+++ b/pkgs/by-name/hy/hyprlang/package.nix
@@ -1,13 +1,13 @@
 {
   lib,
-  gcc15Stdenv,
+  gcc16Stdenv,
   fetchFromGitHub,
   cmake,
   pkg-config,
   hyprutils,
 }:
 
-gcc15Stdenv.mkDerivation (finalAttrs: {
+gcc16Stdenv.mkDerivation (finalAttrs: {
   pname = "hyprlang";
   version = "0.6.8";
 
diff --git a/pkgs/by-name/hy/hyprlauncher/package.nix b/pkgs/by-name/hy/hyprlauncher/package.nix
index f3369ddfb7f0..e148ad41ccb0 100644
--- a/pkgs/by-name/hy/hyprlauncher/package.nix
+++ b/pkgs/by-name/hy/hyprlauncher/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  gcc15Stdenv,
+  gcc16Stdenv,
   fetchFromGitHub,
   cmake,
   pkg-config,
@@ -17,7 +17,7 @@
   pixman,
 }:
 
-gcc15Stdenv.mkDerivation (finalAttrs: {
+gcc16Stdenv.mkDerivation (finalAttrs: {
   pname = "hyprlauncher";
   version = "0.1.6";
 
diff --git a/pkgs/by-name/hy/hyprlock/package.nix b/pkgs/by-name/hy/hyprlock/package.nix
index bb82409fb347..cc06099e8625 100644
--- a/pkgs/by-name/hy/hyprlock/package.nix
+++ b/pkgs/by-name/hy/hyprlock/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  gcc15Stdenv,
+  gcc16Stdenv,
   fetchFromGitHub,
   cmake,
   pkg-config,
@@ -26,7 +26,7 @@
   nix-update-script,
 }:
 
-gcc15Stdenv.mkDerivation (finalAttrs: {
+gcc16Stdenv.mkDerivation (finalAttrs: {
   pname = "hyprlock";
   version = "0.9.6";
 
diff --git a/pkgs/by-name/hy/hyprpaper/package.nix b/pkgs/by-name/hy/hyprpaper/package.nix
index 53b68a517dac..3e5d3c75f357 100644
--- a/pkgs/by-name/hy/hyprpaper/package.nix
+++ b/pkgs/by-name/hy/hyprpaper/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  gcc15Stdenv,
+  gcc16Stdenv,
   fetchFromGitHub,
   cmake,
   hyprwayland-scanner,
@@ -34,7 +34,7 @@
   versionCheckHook,
 }:
 
-gcc15Stdenv.mkDerivation (finalAttrs: {
+gcc16Stdenv.mkDerivation (finalAttrs: {
   pname = "hyprpaper";
   version = "0.8.4";
 
@@ -97,7 +97,7 @@ gcc15Stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.bsd3;
     teams = [ lib.teams.hyprland ];
     inherit (wayland.meta) platforms;
-    broken = gcc15Stdenv.hostPlatform.isDarwin;
+    broken = gcc16Stdenv.hostPlatform.isDarwin;
     mainProgram = "hyprpaper";
   };
 })
diff --git a/pkgs/by-name/hy/hyprpicker/package.nix b/pkgs/by-name/hy/hyprpicker/package.nix
index c427bd3cfb20..454b0fd38186 100644
--- a/pkgs/by-name/hy/hyprpicker/package.nix
+++ b/pkgs/by-name/hy/hyprpicker/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  gcc15Stdenv,
+  gcc16Stdenv,
   fetchFromGitHub,
   nix-update-script,
   pkg-config,
@@ -18,7 +18,7 @@
   libxdmcp,
   debug ? false,
 }:
-gcc15Stdenv.mkDerivation (finalAttrs: {
+gcc16Stdenv.mkDerivation (finalAttrs: {
   pname = "hyprpicker" + lib.optionalString debug "-debug";
   version = "0.4.7";
 
diff --git a/pkgs/by-name/hy/hyprpolkitagent/package.nix b/pkgs/by-name/hy/hyprpolkitagent/package.nix
index 2cbc31de60c0..5c9b8f16b807 100644
--- a/pkgs/by-name/hy/hyprpolkitagent/package.nix
+++ b/pkgs/by-name/hy/hyprpolkitagent/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  gcc15Stdenv,
+  gcc16Stdenv,
   cmake,
   pkg-config,
   fetchFromGitHub,
@@ -10,7 +10,7 @@
   polkit,
   qt6,
 }:
-gcc15Stdenv.mkDerivation (finalAttrs: {
+gcc16Stdenv.mkDerivation (finalAttrs: {
   pname = "hyprpolkitagent";
   version = "0.1.3";
 
diff --git a/pkgs/by-name/hy/hyprpwcenter/package.nix b/pkgs/by-name/hy/hyprpwcenter/package.nix
index ecf0d5e2229e..473fb57b5c86 100644
--- a/pkgs/by-name/hy/hyprpwcenter/package.nix
+++ b/pkgs/by-name/hy/hyprpwcenter/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  gcc15Stdenv,
+  gcc16Stdenv,
   fetchFromGitHub,
   cmake,
   pkg-config,
@@ -14,7 +14,7 @@
   pixman,
 }:
 
-gcc15Stdenv.mkDerivation (finalAttrs: {
+gcc16Stdenv.mkDerivation (finalAttrs: {
   pname = "hyprpwcenter";
   version = "0.1.2";
 
diff --git a/pkgs/by-name/hy/hyprshutdown/package.nix b/pkgs/by-name/hy/hyprshutdown/package.nix
index 37d2a123203e..b1da70e88410 100644
--- a/pkgs/by-name/hy/hyprshutdown/package.nix
+++ b/pkgs/by-name/hy/hyprshutdown/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  gcc15Stdenv,
+  gcc16Stdenv,
   fetchFromGitHub,
   cmake,
   pkg-config,
@@ -16,7 +16,7 @@
   versionCheckHook,
 }:
 
-gcc15Stdenv.mkDerivation (finalAttrs: {
+gcc16Stdenv.mkDerivation (finalAttrs: {
   pname = "hyprshutdown";
   version = "0.1.1";
 
diff --git a/pkgs/by-name/hy/hyprsunset/package.nix b/pkgs/by-name/hy/hyprsunset/package.nix
index 687450a0d4bc..7e677b8d4794 100644
--- a/pkgs/by-name/hy/hyprsunset/package.nix
+++ b/pkgs/by-name/hy/hyprsunset/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  gcc15Stdenv,
+  gcc16Stdenv,
   cmake,
   fetchFromGitHub,
   pkg-config,
@@ -13,7 +13,7 @@
   wayland-scanner,
   nix-update-script,
 }:
-gcc15Stdenv.mkDerivation (finalAttrs: {
+gcc16Stdenv.mkDerivation (finalAttrs: {
   pname = "hyprsunset";
   version = "0.3.3";
 
diff --git a/pkgs/by-name/hy/hyprsysteminfo/package.nix b/pkgs/by-name/hy/hyprsysteminfo/package.nix
index a3067b584af9..9f2f505a767f 100644
--- a/pkgs/by-name/hy/hyprsysteminfo/package.nix
+++ b/pkgs/by-name/hy/hyprsysteminfo/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  gcc15Stdenv,
+  gcc16Stdenv,
   fetchFromGitHub,
   fetchpatch,
   cmake,
@@ -13,7 +13,7 @@
 let
   inherit (lib.strings) makeBinPath;
 in
-gcc15Stdenv.mkDerivation (finalAttrs: {
+gcc16Stdenv.mkDerivation (finalAttrs: {
   pname = "hyprsysteminfo";
   version = "0.1.3";
 
diff --git a/pkgs/by-name/hy/hyprtoolkit/package.nix b/pkgs/by-name/hy/hyprtoolkit/package.nix
index d3575fd8779d..603bcd17b984 100644
--- a/pkgs/by-name/hy/hyprtoolkit/package.nix
+++ b/pkgs/by-name/hy/hyprtoolkit/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  gcc15Stdenv,
+  gcc16Stdenv,
   fetchFromGitHub,
   cmake,
   pkg-config,
@@ -23,7 +23,7 @@
   wayland-protocols,
 }:
 
-gcc15Stdenv.mkDerivation (finalAttrs: {
+gcc16Stdenv.mkDerivation (finalAttrs: {
   pname = "hyprtoolkit";
   version = "0.5.4";
 
diff --git a/pkgs/by-name/hy/hyprutils/package.nix b/pkgs/by-name/hy/hyprutils/package.nix
index f3556668cf4b..0ee825ffbf46 100644
--- a/pkgs/by-name/hy/hyprutils/package.nix
+++ b/pkgs/by-name/hy/hyprutils/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  gcc15Stdenv,
+  gcc16Stdenv,
   cmake,
   pkg-config,
   pixman,
@@ -8,15 +8,15 @@
   nix-update-script,
 }:
 
-gcc15Stdenv.mkDerivation (finalAttrs: {
+gcc16Stdenv.mkDerivation (finalAttrs: {
   pname = "hyprutils";
-  version = "0.13.1";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprutils";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jAcsogZwWMfXT9MfXxZzkwliAqIuZUV0p71h6Ba9ReE=";
+    hash = "sha256-XnAVV+H4f8Xdv0yZcSwJ5kCjLyE8fHxPeLX6a3HSrAU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/hy/hyprwayland-scanner/package.nix b/pkgs/by-name/hy/hyprwayland-scanner/package.nix
index 752e54bb2134..a4b2d66e231f 100644
--- a/pkgs/by-name/hy/hyprwayland-scanner/package.nix
+++ b/pkgs/by-name/hy/hyprwayland-scanner/package.nix
@@ -1,13 +1,13 @@
 {
   lib,
-  gcc15Stdenv,
+  gcc16Stdenv,
   fetchFromGitHub,
   cmake,
   pkg-config,
   pugixml,
   nix-update-script,
 }:
-gcc15Stdenv.mkDerivation (finalAttrs: {
+gcc16Stdenv.mkDerivation (finalAttrs: {
   pname = "hyprwayland-scanner";
   version = "0.4.6";
 
diff --git a/pkgs/by-name/hy/hyprwire/package.nix b/pkgs/by-name/hy/hyprwire/package.nix
index c90a2f0c1e62..907354ae5c58 100644
--- a/pkgs/by-name/hy/hyprwire/package.nix
+++ b/pkgs/by-name/hy/hyprwire/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  gcc15Stdenv,
+  gcc16Stdenv,
   fetchFromGitHub,
   cmake,
   pkg-config,
@@ -9,7 +9,7 @@
   pugixml,
 }:
 
-gcc15Stdenv.mkDerivation (finalAttrs: {
+gcc16Stdenv.mkDerivation (finalAttrs: {
   pname = "hyprwire";
   version = "0.3.1";
 
diff --git a/pkgs/by-name/jt/jtdx/package.nix b/pkgs/by-name/jt/jtdx/package.nix
index 018ed5d53c05..7204d9669390 100644
--- a/pkgs/by-name/jt/jtdx/package.nix
+++ b/pkgs/by-name/jt/jtdx/package.nix
@@ -21,5 +21,7 @@ wsjtx.overrideAttrs (old: {
       pkharvey
     ];
     homepage = "https://github.com/jtdx-project/jtdx";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.linux;
   };
 })
diff --git a/pkgs/by-name/ka/kanban/package.nix b/pkgs/by-name/ka/kanban/package.nix
index f5e519993705..d3e3b48c9e9b 100644
--- a/pkgs/by-name/ka/kanban/package.nix
+++ b/pkgs/by-name/ka/kanban/package.nix
@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       built with Rust. Features include file persistence, keyboard-driven
       navigation, multi-select capabilities, and sprint management.
     '';
-    homepage = "https://kanban.yoon.se";
+    homepage = "https://kanban.rs";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fulsomenko ];
     mainProgram = "kanban";
diff --git a/pkgs/by-name/li/limine/package.nix b/pkgs/by-name/li/limine/package.nix
index 502904f11810..1b5f6193612a 100644
--- a/pkgs/by-name/li/limine/package.nix
+++ b/pkgs/by-name/li/limine/package.nix
@@ -47,14 +47,14 @@ in
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation (finalAttrs: {
   pname = "limine";
-  version = "12.5.0";
+  version = "12.5.1";
 
   # We don't use the Git source but the release tarball, as the source has a
   # `./bootstrap` script performing network access to download resources.
   # Packaging that in Nix is very cumbersome.
   src = fetchurl {
     url = "https://github.com/Limine-Bootloader/Limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-U9XLJ3LqigBuE37i4yDYTvlP98V/iApkDReH2S55/Oc=";
+    hash = "sha256-aGdx+IynrVBtI3Z5Zic/e5aVNWQeAFsxXr8xjIV1MTM=";
   };
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/mc/mcp-gateway/package.nix b/pkgs/by-name/mc/mcp-gateway/package.nix
index 9ce89d546bf4..5824cd389793 100644
--- a/pkgs/by-name/mc/mcp-gateway/package.nix
+++ b/pkgs/by-name/mc/mcp-gateway/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mcp-gateway";
-  version = "3.3.0";
+  version = "3.3.2";
 
   src = fetchFromGitHub {
     owner = "MikkoParkkola";
     repo = "mcp-gateway";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-R+k9NpbYcqu56cALHCU15lp0UCc3aJQGdk6ZJgs02D8=";
+    hash = "sha256-jSEstrmEdeQ7NzWCHCNZPBgBaroCbQ96oeQbZVxL5p0=";
   };
 
-  cargoHash = "sha256-quIQXrJ/ANOyh76Q3ZErUamLDfJpqPMYSZe9wUyS0Pg=";
+  cargoHash = "sha256-KZseznJdv28JbABgg4oV/Gj7y25JGdQ8UWq5KgzxVpk=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/me/meilisearch/package.nix b/pkgs/by-name/me/meilisearch/package.nix
index e257bfba31b3..03aa669ec133 100644
--- a/pkgs/by-name/me/meilisearch/package.nix
+++ b/pkgs/by-name/me/meilisearch/package.nix
@@ -8,18 +8,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "meilisearch";
-  version = "1.49.0";
+  version = "1.50.0";
 
   src = fetchFromGitHub {
     owner = "meilisearch";
     repo = "meilisearch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-obUX84KNeJzkuRjOFBtLmCo/lcq0AwsaY/WDgaLhN2k=";
+    hash = "sha256-CTCfaWtLdRFCPEkcbewjz3zZ6NM1N8MaaeGM73T9QQk=";
   };
 
   cargoBuildFlags = [ "--package=meilisearch" ];
 
-  cargoHash = "sha256-1UjXuvzT3gN0byKtYs6fv6xyKAi4uPBip9l+r6I1lHU=";
+  cargoHash = "sha256-mhXRHn+4i9lW81Cc7kzkGWODox2G6mYrmBkrhbcVYS8=";
 
   # Default features include mini dashboard which downloads something from the internet.
   buildNoDefaultFeatures = true;
diff --git a/pkgs/by-name/mi/middleclick/package.nix b/pkgs/by-name/mi/middleclick/package.nix
new file mode 100644
index 000000000000..0ab33594dc9a
--- /dev/null
+++ b/pkgs/by-name/mi/middleclick/package.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  nix-update-script,
+  unzip,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "middleclick";
+  version = "3.2.0";
+
+  __structuredAttrs = true;
+
+  src = fetchurl {
+    url = "https://github.com/artginzburg/MiddleClick/releases/download/${finalAttrs.version}/MiddleClick.zip";
+    hash = "sha256-6T8XYSp3QTxefO+UI/DcnbFm1m841B14OpkOLqa6aYw=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ unzip ];
+
+  dontUnpack = true;
+  dontBuild = true;
+
+  # Preserve the upstream Developer ID signature and notarized app bundle.
+  dontFixup = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p unpacked "$out/Applications"
+    unzip -q "$src" -d unpacked
+    mv unpacked/MiddleClick.app "$out/Applications/"
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Utility for emulating middle clicks with trackpad and Magic Mouse gestures";
+    homepage = "https://github.com/artginzburg/MiddleClick";
+    downloadPage = "https://github.com/artginzburg/MiddleClick/releases";
+    changelog = "https://github.com/artginzburg/MiddleClick/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ akosseres ];
+    platforms = lib.platforms.darwin;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
diff --git a/pkgs/by-name/mi/mise/package.nix b/pkgs/by-name/mi/mise/package.nix
index 51d6a9def25f..855e36e1ebdf 100644
--- a/pkgs/by-name/mi/mise/package.nix
+++ b/pkgs/by-name/mi/mise/package.nix
@@ -13,8 +13,8 @@
   openssl,
   cmake,
   cacert,
+  tzdata,
   usage,
-  mise,
   testers,
   runCommand,
   jq,
@@ -22,16 +22,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mise";
-  version = "2026.7.5";
+  version = "2026.7.10";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "mise";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oHZXd9u+FbwOs60yrmg5oSnQoHskVCi29TRgu0RKOpM=";
+    hash = "sha256-klEexXMGaGM0YkcSDaHa8lD1jdwAfCcms7soRKy3r3w=";
   };
 
-  cargoHash = "sha256-JXipQn9gN5cJx6PSpDYHuxjYLNRyAwpjSaROxqSvIog=";
+  cargoHash = "sha256-O32fVQGb8+ECopUPeU9Pm8xKP4Aj494MtyHYwR3wFnM=";
 
   nativeBuildInputs = [
     installShellFiles
@@ -69,8 +69,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rustPlatform.bindgenHook
   ];
 
-  # disable warnings as errors for aws-lc-sys in checkPhase
-  env.NIX_CFLAGS_COMPILE = "-Wno-error";
+  env = {
+    # disable warnings as errors for aws-lc-sys in checkPhase
+    NIX_CFLAGS_COMPILE = "-Wno-error";
+    # tera date helper tests look up timezone data via TZDIR.
+    TZDIR = "${tzdata}/share/zoneinfo";
+  };
 
   checkFlags = [
     # last_modified will always be different in nix
@@ -113,7 +117,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       ];
     };
     tests = {
-      version = (testers.testVersion { package = mise; }).overrideAttrs (old: {
+      version = (testers.testVersion { package = finalAttrs.finalPackage; }).overrideAttrs (old: {
         nativeBuildInputs = old.nativeBuildInputs ++ [ cacert ];
       });
       usageCompat =
@@ -121,7 +125,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
         runCommand "mise-usage-compatibility"
           {
             nativeBuildInputs = [
-              mise
+              finalAttrs.finalPackage
               usage
               jq
             ];
diff --git a/pkgs/by-name/os/osslsigncode/package.nix b/pkgs/by-name/os/osslsigncode/package.nix
index c55685efdae0..06afc90d5f06 100644
--- a/pkgs/by-name/os/osslsigncode/package.nix
+++ b/pkgs/by-name/os/osslsigncode/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "osslsigncode";
-  version = "2.13";
+  version = "2.14";
 
   src = fetchFromGitHub {
     owner = "mtrojnar";
     repo = "osslsigncode";
     rev = finalAttrs.version;
-    sha256 = "sha256-63SIyjG91i6ldA3NpOG5X5fT8vTRqNaXDtOE/ZStqFA=";
+    sha256 = "sha256-jAiGW6B3wxasESvpMRYxh0sWIPkV7L37owpwlNNlyxs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/re/reader/package.nix b/pkgs/by-name/re/reader/package.nix
index 4dfe73781199..872633225492 100644
--- a/pkgs/by-name/re/reader/package.nix
+++ b/pkgs/by-name/re/reader/package.nix
@@ -5,16 +5,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "reader";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "mrusme";
     repo = "reader";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qu48ikqm4EmoeL9j67tGkX3EFBd1JdrLWhhmoElCoJY=";
+    hash = "sha256-R7U+atLrpx7ppdyMR381JUSOM7KAfDr8P9oEAzuZbCY=";
   };
 
-  vendorHash = "sha256-8IjN7hm5Rg9ItkxE9pbnkVr5t+tG95W9vvXyGaWmEIA=";
+  vendorHash = "sha256-XOcqyUGfE7tq1OY6h7WV33nBNgn+oLmKRSJfVKmXIz4=";
 
   meta = {
     description = "Lightweight tool offering better readability of web pages on the CLI";
diff --git a/pkgs/by-name/rk/rkmon/package.nix b/pkgs/by-name/rk/rkmon/package.nix
new file mode 100644
index 000000000000..99f3f4609b4a
--- /dev/null
+++ b/pkgs/by-name/rk/rkmon/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "rkmon";
+  version = "0.3.1";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "isac322";
+    repo = "rkmon";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-LFvv/CvZxtulGQdFVU7XVDitzgQwkOIFF9mfZBAUe1Y=";
+  };
+
+  vendorHash = "sha256-f9+5iVGvkLuFHqDdeSvx4Vu6paVsRS0EZxKB9a3sr/I=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-extldflags"
+    "-static"
+    "-X=main.Version=${finalAttrs.version}"
+    "-X=main.GitSHA=${finalAttrs.src.rev}"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Real-time hardware monitor TUI for Rockchip RK3588 SBCs. Like htop, but for the GPU, NPU, VPU, RGA, and thermal zones of your Rock 5B+ / RK3588 board";
+    homepage = "https://github.com/isac322/rkmon";
+    changelog = "https://github.com/isac322/rkmon/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ matthewcroughan ];
+    mainProgram = "rkmon";
+  };
+})
diff --git a/pkgs/by-name/sa/sandbox-runtime/package.nix b/pkgs/by-name/sa/sandbox-runtime/package.nix
index a4f76cb342f0..830679f453ed 100644
--- a/pkgs/by-name/sa/sandbox-runtime/package.nix
+++ b/pkgs/by-name/sa/sandbox-runtime/package.nix
@@ -17,7 +17,7 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "sandbox-runtime";
-  version = "0.0.64";
+  version = "0.0.66";
 
   __structuredAttrs = true;
 
@@ -25,7 +25,7 @@ buildNpmPackage (finalAttrs: {
     owner = "anthropic-experimental";
     repo = "sandbox-runtime";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kKXGZcK3hx3ugud+DxLrBC+IwnUzEe0Gae2lq7DU8hA=";
+    hash = "sha256-fwu5rVXd3xlpn++CXvT+jjcLWtZ2/ZDb1humrXwr+D0=";
   };
 
   postPatch =
@@ -37,7 +37,7 @@ buildNpmPackage (finalAttrs: {
 
   strictDeps = true;
 
-  npmDepsHash = "sha256-3HOGoIG9syQJ407C8Bg7J7mtPpoIjVtUoFCdbSmT8BU=";
+  npmDepsHash = "sha256-ERIKGZstnixcrdoyWkZtkEq5eDQFxrZmeWTPteOgXgU=";
 
   postFixup =
     let
diff --git a/pkgs/by-name/se/sentry-native/package.nix b/pkgs/by-name/se/sentry-native/package.nix
index 46ab40e702e3..9037ef83a23a 100644
--- a/pkgs/by-name/se/sentry-native/package.nix
+++ b/pkgs/by-name/se/sentry-native/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sentry-native";
-  version = "0.15.3";
+  version = "0.15.4";
 
   src = fetchFromGitHub {
     owner = "getsentry";
     repo = "sentry-native";
     tag = finalAttrs.version;
-    hash = "sha256-9UwF8B1dd4RhboMgkZCHI3UqAm8aZAhgLo9VzjwlW/I=";
+    hash = "sha256-McOb4ICd6/6CTjG63Pzei5LAvfLcnL34qnwvU0RDm1A=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sh/shopify-cli/package.nix b/pkgs/by-name/sh/shopify-cli/package.nix
index e6a2e4a3dc08..fd1c7735d024 100644
--- a/pkgs/by-name/sh/shopify-cli/package.nix
+++ b/pkgs/by-name/sh/shopify-cli/package.nix
@@ -19,20 +19,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "shopify";
-  version = "3.91.1";
+  version = "4.5.1";
 
   src = fetchFromGitHub {
     owner = "shopify";
     repo = "cli";
     tag = finalAttrs.version;
-    hash = "sha256-cOq4LpTMr59ev04PIu0GYAAK0N0n2SrYCnz8sHfcXrs=";
+    hash = "sha256-uunVTgq3njrnuKHksXpGhAcAQanOFtsLRa/Ab6adoXo=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-gwEVlvr8hxgyCsGjxjz1UkbDZYYq1iukKTPJ7JHdo2U=";
+    hash = "sha256-IvPxHUdjFVkWpQnmmZz82rn8XJVljPbgNoVGpg7uU84=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sy/syslogng/package.nix b/pkgs/by-name/sy/syslogng/package.nix
index 35e58e18ab5b..3c9edf4f23ea 100644
--- a/pkgs/by-name/sy/syslogng/package.nix
+++ b/pkgs/by-name/sy/syslogng/package.nix
@@ -65,13 +65,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "syslog-ng";
-  version = "4.11.0";
+  version = "4.12.0";
 
   src = fetchFromGitHub {
     owner = "syslog-ng";
     repo = "syslog-ng";
     tag = "syslog-ng-${finalAttrs.version}";
-    hash = "sha256-7t1Q3qaPMp36siQALmeB27G6hfsql+kepERGB0yPsVU=";
+    hash = "sha256-89v0Ape6FZVYePb+wjy0RO+NOyzluQNJliexM04li3Y=";
     fetchSubmodules = true;
   };
   nativeBuildInputs = [
diff --git a/pkgs/by-name/za/zapzap/package.nix b/pkgs/by-name/za/zapzap/package.nix
index 0ae9f8dce25b..7a6d8ff0fead 100644
--- a/pkgs/by-name/za/zapzap/package.nix
+++ b/pkgs/by-name/za/zapzap/package.nix
@@ -1,22 +1,31 @@
 {
   lib,
   fetchFromGitHub,
+  fetchpatch,
   python3Packages,
   qt6,
 }:
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "zapzap";
-  version = "6.5.2.5";
+  version = "7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "rafatosta";
     repo = "zapzap";
     tag = finalAttrs.version;
-    hash = "sha256-VybcZNB0k1DwAmluQpEMuM7cHKI8sGyG284g9E3YcP8=";
+    hash = "sha256-0LrIx7k9b0+zsmezjF6CmJo4nqU7GPW1HHWAUVVnbzk=";
   };
 
+  patches = [
+    # Support setting dict lookup path. Remove with next release.
+    (fetchpatch {
+      url = "https://github.com/rafatosta/zapzap/commit/3517079e8fbd3853fe184c393137709de68f020e.patch";
+      hash = "sha256-Eqy483+mJHLHsS21B8LnJ9oIqwTRCMVKhHBO8hleBh4=";
+    })
+  ];
+
   nativeBuildInputs = [
     qt6.wrapQtAppsHook
   ];
diff --git a/pkgs/by-name/ze/zenroom/package.nix b/pkgs/by-name/ze/zenroom/package.nix
index d9e43ef9d6c8..ad212d45432a 100644
--- a/pkgs/by-name/ze/zenroom/package.nix
+++ b/pkgs/by-name/ze/zenroom/package.nix
@@ -14,16 +14,24 @@
 
   # tests
   callPackage,
+  jq,
+  meson,
+  ninja,
 }:
 
+let
+  inherit (stdenv.hostPlatform)
+    isDarwin
+    isLinux
+    isMusl
+    isUnix
+    ;
+in
+
 stdenv.mkDerivation (finalAttrs: {
   pname = "zenroom";
   version = "5.37.2";
 
-  __structuredAttrs = true;
-  dontUseCmakeConfigure = true; # cmake is a dependency, but we use make to build
-  strictDeps = true;
-
   src = fetchFromGitHub {
     owner = "dyne";
     repo = "Zenroom";
@@ -38,9 +46,22 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   postPatch = ''
-    patchShebangs build/embed-lualibs
+    patchShebangs build/{embed-lualibs,meson_version.sh}
+    patchShebangs test/
   '';
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  # cmake is required to build dependencies, not the main package
+  dontUseCmakeConfigure = true;
+
+  # manually invoken while testing
+  dontUseMesonConfigure = true;
+  dontUseNinjaBuild = true;
+  dontUseNinjaCheck = true;
+  dontUseNinjaInstall = true;
+
   nativeBuildInputs = [
     cmake
     which # ar
@@ -51,23 +72,27 @@ stdenv.mkDerivation (finalAttrs: {
     readline
   ];
 
-  buildFlags =
-    with stdenv.hostPlatform;
-    lib.optionals (isLinux && !isMusl) [
-      "linux-lib"
-      "linux-exe"
-    ]
-    ++ lib.optionals (isLinux && isMusl) [
-      "musl"
-    ]
-    ++ lib.optionals isDarwin [
-      "osx-lib"
-      "osx-exe"
-    ]
-    ++ lib.optionals (isUnix && !isLinux && !isDarwin) [
-      "posix-lib"
-      "posix-exe"
-    ];
+  buildFlags = [
+    "VERSION=${finalAttrs.version}"
+    "COMMIT=0000000"
+    "BRANCH=master"
+    "CURRENT_YEAR=1970" # unix epoch
+  ]
+  ++ lib.optionals (isLinux && !isMusl) [
+    "linux-lib"
+    "linux-exe"
+  ]
+  ++ lib.optionals (isLinux && isMusl) [
+    "musl"
+  ]
+  ++ lib.optionals isDarwin [
+    "osx-lib"
+    "osx-exe"
+  ]
+  ++ lib.optionals (isUnix && !isLinux && !isDarwin) [
+    "posix-lib"
+    "posix-exe"
+  ];
 
   hardeningDisable = [ "format" ]; # -Werror=format-security
 
@@ -82,11 +107,30 @@ stdenv.mkDerivation (finalAttrs: {
     install -D libzenroom${stdenv.hostPlatform.extensions.sharedLibrary} -t $out/lib
   '';
 
+  nativeCheckInputs = [
+    jq
+    meson
+    ninja
+  ];
+
+  doCheck = true;
+  checkTarget = "check" + lib.optionalString isDarwin "-osx";
+
+  preCheck =
+    lib.optionalString isDarwin # sh
+      ''
+        # on darwin, we're using GNU base64
+        substituteInPlace test/zencode/cookbook_{hash_pdf,ecdh_encrypt_json}.bats \
+          --replace-fail \
+            'cmd_base64="base64 -b 0"' \
+            'cmd_base64="base64 -w 0"'
+      '';
+
   passthru.updateScript = nix-update-script { };
   passthru.tests = callPackage ./tests { zenroom = finalAttrs.finalPackage; };
 
   meta = {
-    description = "no-code cryptographic virtual machine";
+    description = "No-code cryptographic virtual machine";
     longDescription = ''
       Zenroom is a tiny, portable, and fully isolated crypto VM for building
       privacy-preserving applications, smart contracts, and secure data
diff --git a/pkgs/by-name/zi/zizmor/package.nix b/pkgs/by-name/zi/zizmor/package.nix
index 668d20d678fc..0c4a670ffc9f 100644
--- a/pkgs/by-name/zi/zizmor/package.nix
+++ b/pkgs/by-name/zi/zizmor/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zizmor";
-  version = "1.26.1";
+  version = "1.27.0";
 
   src = fetchFromGitHub {
     owner = "zizmorcore";
     repo = "zizmor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AL4y9lB60zvWhr5U6vzVyg0DhxFCaKkP8+6DWdg2vYA=";
+    hash = "sha256-wiVAZ26JJB3C9WYiM5OfK83oT1HDr1jlfvcpELFHy0E=";
   };
 
-  cargoHash = "sha256-PGU9R6EKT+9ZdgxBgQqlvvmyEtDRG6zT2EdQPzlPIM0=";
+  cargoHash = "sha256-Cbu0ur4WUURgrgITe5UCz5qTHR3F6PjxEqbm1t+lpBA=";
 
   buildInputs = [
     rust-jemalloc-sys
diff --git a/pkgs/development/libraries/qgpgme/default.nix b/pkgs/development/libraries/qgpgme/default.nix
index d1f7e6ca669e..3e628fd6bb37 100644
--- a/pkgs/development/libraries/qgpgme/default.nix
+++ b/pkgs/development/libraries/qgpgme/default.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qgpgme";
-  version = "2.1.0";
+  version = "2.2.0";
 
   src = fetchurl {
     url = "mirror://gnupg/qgpgme/qgpgme-${finalAttrs.version}.tar.xz";
-    hash = "sha256-WzL+s+7kp/lALSK3IGSAkI3EO7TfOCkXwHXFEhFvjwg=";
+    hash = "sha256-PGKQ/1v+q5gbtIspUXA3YfHb6mQMtje+s1YNX++w4LM=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/knx-frontend/default.nix b/pkgs/development/python-modules/knx-frontend/default.nix
index 9229225803a1..9abb49158f97 100644
--- a/pkgs/development/python-modules/knx-frontend/default.nix
+++ b/pkgs/development/python-modules/knx-frontend/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "knx-frontend";
-  version = "2026.7.8.100603";
+  version = "2026.7.17.104339";
   pyproject = true;
 
   # TODO: source build, uses yarn.lock
   src = fetchPypi {
     pname = "knx_frontend";
     inherit (finalAttrs) version;
-    hash = "sha256-80yeDZ8a8WDf/NEXjFSkcfpglp9yTnmg+4csFbgdFpM=";
+    hash = "sha256-//Tjixp8mXP2KFuW2U9iEW1BXMi2jfbuJBj/LuijW4Q=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/rns/default.nix b/pkgs/development/python-modules/rns/default.nix
index 844ef6a1f2f8..0fdd71f19769 100644
--- a/pkgs/development/python-modules/rns/default.nix
+++ b/pkgs/development/python-modules/rns/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "rns";
-  version = "1.3.9";
+  version = "1.4.0";
   pyproject = true;
   __structuredAttrs = true;
 
   src = fetchPypi {
     pname = "rns";
     version = finalAttrs.version;
-    hash = "sha256-/TdFwauk3L+IM/qHoxV+yZAHRaMtbZa6Mw1iOpiTKhU=";
+    hash = "sha256-+p520KeL8lPq5mE35rvcZfRw2zlQqVsDTOMsqEX/DkQ=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/shaperglot/default.nix b/pkgs/development/python-modules/shaperglot/default.nix
index 16492234750e..cd4c5682209f 100644
--- a/pkgs/development/python-modules/shaperglot/default.nix
+++ b/pkgs/development/python-modules/shaperglot/default.nix
@@ -2,66 +2,46 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  gflanguages,
-  num2words,
-  protobuf,
   pytestCheckHook,
-  pyyaml,
-  setuptools-scm,
-  setuptools,
-  strictyaml,
-  termcolor,
-  ufo2ft,
-  vharfbuzz,
-  youseedee,
+  rustPlatform,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "shaperglot";
-  version = "0.6.4";
+  version = "1.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googlefonts";
     repo = "shaperglot";
-    tag = "v${version}";
-    hash = "sha256-O6z7TJpC54QkqX5/G1HKSvaDYty7B9BnCQ4FpsLsEMs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-g8f8Q2DvYNvm8i6S+9K/jhhUiuGw366dht0Khx3/INg=";
   };
 
-  env.PROTOCOL_BUFFERS_PYTHON_IMPLEMENTATION = "python";
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-ivl3Zq0HRn4yP9JKfbjSaaERjbQ3SAEWhHk6toFp8dE=";
+  };
 
   postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail "setuptools>=75.0.0" "setuptools"
+    cd shaperglot-py
   '';
 
-  build-system = [
-    setuptools
-    setuptools-scm
-  ];
+  cargoRoot = "..";
 
-  dependencies = [
-    gflanguages
-    num2words
-    protobuf
-    pyyaml
-    strictyaml
-    termcolor
-    ufo2ft
-    vharfbuzz
-    youseedee
+  nativeBuildInputs = with rustPlatform; [
+    cargoSetupHook
+    maturinBuildHook
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
-
   pythonImportsCheck = [ "shaperglot" ];
 
   meta = {
     description = "Tool to test OpenType fonts for language support";
     homepage = "https://github.com/googlefonts/shaperglot";
-    changelog = "https://github.com/googlefonts/shaperglot/releases/tag/v${version}";
+    changelog = "https://github.com/googlefonts/shaperglot/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ danc86 ];
     mainProgram = "shaperglot";
   };
-}
+})
diff --git a/pkgs/development/python-modules/sqlalchemy/1.3-0001-fix-create-new-event-loop-if-not-exists.patch b/pkgs/development/python-modules/sqlalchemy/1.3-0001-fix-create-new-event-loop-if-not-exists.patch
deleted file mode 100644
index e10c13868423..000000000000
--- a/pkgs/development/python-modules/sqlalchemy/1.3-0001-fix-create-new-event-loop-if-not-exists.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From 98fd6e87243c6d5992429a9b90426af73dbcc3ff Mon Sep 17 00:00:00 2001
-From: Bart Oostveen <bart@bartoostveen.nl>
-Date: Fri, 10 Jul 2026 13:59:21 +0200
-Subject: [PATCH] fix: create new event loop if not exists
-
----
- lib/sqlalchemy/util/_concurrency_py3k.py | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/lib/sqlalchemy/util/_concurrency_py3k.py b/lib/sqlalchemy/util/_concurrency_py3k.py
-index 1e4ffef..5aaf12c 100644
---- a/lib/sqlalchemy/util/_concurrency_py3k.py
-+++ b/lib/sqlalchemy/util/_concurrency_py3k.py
-@@ -190,6 +190,8 @@ def get_event_loop():
-         try:
-             return asyncio.get_running_loop()
-         except RuntimeError:
--            return asyncio.get_event_loop_policy().get_event_loop()
-+            loop = asyncio.new_event_loop()
-+            asyncio.set_event_loop(loop)
-+            return loop
-     else:
-         return asyncio.get_event_loop()
--- 
-2.54.0
-
diff --git a/pkgs/development/python-modules/sqlalchemy/1_3.nix b/pkgs/development/python-modules/sqlalchemy/1_3.nix
deleted file mode 100644
index 38670bc2b31c..000000000000
--- a/pkgs/development/python-modules/sqlalchemy/1_3.nix
+++ /dev/null
@@ -1,90 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-
-  # build-system
-  setuptools,
-
-  # dependencies
-  greenlet,
-
-  # optionals
-  cx-oracle,
-  mysqlclient,
-  pg8000,
-  psycopg2,
-  psycopg2cffi,
-  # TODO: pymssql
-  pymysql,
-  pyodbc,
-
-  # tests
-  mock,
-  pytest-xdist,
-  pytestCheckHook,
-}:
-
-buildPythonPackage (finalAttrs: {
-  pname = "sqlalchemy";
-  version = "1.3.24";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "sqlalchemy";
-    repo = "sqlalchemy";
-    tag = "rel_${lib.replaceStrings [ "." ] [ "_" ] finalAttrs.version}";
-    hash = "sha256-6qAjyqMVrugABHssAQuql3z1YHTAOSm5hARJuJXJJvo=";
-  };
-
-  patches = [ ./1.3-0001-fix-create-new-event-loop-if-not-exists.patch ];
-
-  postPatch = ''
-    sed -i '/tag_build = dev/d' setup.cfg
-  '';
-
-  build-system = [ setuptools ];
-
-  dependencies = [ greenlet ];
-
-  optional-dependencies = lib.fix (self: {
-    mssql = [ pyodbc ];
-    mssql_pymysql = [
-      # TODO: pymssql
-    ];
-    mssql_pyodbc = [ pyodbc ];
-    mysql = [ mysqlclient ];
-    oracle = [ cx-oracle ];
-    postgresql = [ psycopg2 ];
-    postgresql_pg8000 = [ pg8000 ];
-    postgresql_psycopg2binary = [ psycopg2 ];
-    postgresql_psycopg2cffi = [ psycopg2cffi ];
-    pymysql = [ pymysql ];
-  });
-
-  nativeCheckInputs = [
-    pytest-xdist
-    pytestCheckHook
-    mock
-  ];
-
-  disabledTestPaths = [
-    # typing correctness, not interesting
-    "test/ext/mypy"
-    # slow and high memory usage, not interesting
-    "test/aaa_profiling"
-  ];
-
-  pythonImportsCheck = [ "sqlalchemy" ];
-
-  meta = {
-    changelog =
-      let
-        shortVersion = lib.replaceString "." "" (lib.versions.majorMinor finalAttrs.version);
-      in
-      "https://github.com/sqlalchemy/sqlalchemy/blob/${finalAttrs.src.rev}/doc/build/changelog/changelog_${shortVersion}.rst";
-    description = "Database Toolkit for Python";
-    homepage = "https://github.com/sqlalchemy/sqlalchemy";
-    license = lib.licenses.mit;
-  };
-})
diff --git a/pkgs/servers/web-apps/lemmy/pin.json b/pkgs/servers/web-apps/lemmy/pin.json
index b7e07bc4303b..67de1c08e6fb 100644
--- a/pkgs/servers/web-apps/lemmy/pin.json
+++ b/pkgs/servers/web-apps/lemmy/pin.json
@@ -1,8 +1,8 @@
 {
-  "serverVersion": "0.19.19",
-  "uiVersion": "0.19.19",
-  "serverHash": "sha256-JcJV1dEWlFsbv9eH2yQMGYEZEFB/Pe1xtL1UNtKI6c4=",
-  "serverCargoHash": "sha256-cwmz8Gf7T1IsCRyxo3ap+byX+Aj7+iCTHmZ/IeMN2no=",
-  "uiHash": "sha256-67OMwzOGl+dMX5YNPPBG/QwKOVerkSa7ICbrQl4YBp4=",
+  "serverVersion": "0.19.20",
+  "uiVersion": "0.19.20",
+  "serverHash": "sha256-qwc9hu+oCveG6DsBcUt6f2OZt68pogE7/rdG3L+EwJY=",
+  "serverCargoHash": "sha256-Bw64QDL0v6SpcJkukB6lzNrrmsHPstLU/sFtAAbEgXI=",
+  "uiHash": "sha256-hHZWIg7C6ZkJGlWJSNPMnc1rHRR4ZC1N1w3IcknFR5Y=",
   "uiPNPMDepsHash": "sha256-50IUUymGyaCAeMnWbYJlBytcULr9lvuY9kLVSEqHGL0="
 }
diff --git a/pkgs/servers/web-apps/szurubooru/server.nix b/pkgs/servers/web-apps/szurubooru/server.nix
index 575ccc977009..a2309f694e85 100644
--- a/pkgs/servers/web-apps/szurubooru/server.nix
+++ b/pkgs/servers/web-apps/szurubooru/server.nix
@@ -21,6 +21,8 @@ let
         };
         doCheck = false;
       });
+
+      sqlalchemy = self.sqlalchemy_1_4;
     })
   ];
 
@@ -54,7 +56,7 @@ python.pkgs.buildPythonApplication {
     pyrfc3339
     pytz
     pyyaml
-    sqlalchemy_1_3
+    sqlalchemy
     yt-dlp
   ];
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 757f07702573..587454e936e9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9747,7 +9747,7 @@ with pkgs;
   xdg-desktop-portal-hyprland =
     callPackage ../applications/window-managers/hyprwm/xdg-desktop-portal-hyprland
       {
-        stdenv = gcc15Stdenv;
+        stdenv = gcc16Stdenv;
         inherit (qt6)
           qtbase
           qttools
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index a1a91a4f07f2..8a566c266dc1 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -639,6 +639,7 @@ mapAliases {
   sphinxcontrib_plantuml = throw "'sphinxcontrib_plantuml' has been renamed to/replaced by 'sphinxcontrib-plantuml'"; # Converted to throw 2025-10-29
   sqlalchemy-utc = throw "'sqlalchemy-utc' has been removed as it was unmaintained upstream"; # Added 2026-03-19
   sqlalchemy-views = throw "'sqlalchemy-views' has been removed as it was broken and unmaintained upstream"; # Added 2025-11-09
+  sqlalchemy_1_3 = throw "'sqlalchemy_1_3' has been removed because it was actually version 1.4.54"; # added 2026-07-20
   sqlalchemy_migrate = throw "'sqlalchemy_migrate' has been renamed to/replaced by 'sqlalchemy-migrate'"; # Converted to throw 2025-10-29
   steamship = throw "'steamship' has been removed because it is broken and unmaintained upstream"; # Added 2026-05-06
   strawberry-django = strawberry-graphql-django; # Added 2026-07-14
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a48c1f552066..da8342e4c4ca 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -19329,8 +19329,6 @@ self: super: with self; {
 
   sqlalchemy-utils = callPackage ../development/python-modules/sqlalchemy-utils { };
 
-  sqlalchemy_1_3 = callPackage ../development/python-modules/sqlalchemy/1_3.nix { };
-
   sqlalchemy_1_4 = callPackage ../development/python-modules/sqlalchemy/1_4.nix { };
 
   sqlcipher3 = callPackage ../development/python-modules/sqlcipher3 { };