diff --git a/doc/languages-frameworks/javascript.section.md b/doc/languages-frameworks/javascript.section.md
index 508b8f3f97f6..f85a416fee86 100644
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@@ -354,7 +354,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    fetcherVersion = 2;
+    fetcherVersion = 3;
     hash = "...";
   };
 })
@@ -501,6 +501,7 @@ Changes can include workarounds or bug fixes to existing PNPM issues.
 
 - 1: Initial version, nothing special
 - 2: [Ensure consistent permissions](https://github.com/NixOS/nixpkgs/pull/422975)
+- 3: [Build a reproducible tarball](https://github.com/NixOS/nixpkgs/pull/469950)
 
 ### Yarn {#javascript-yarn}
 
diff --git a/nixos/modules/services/audio/mpd.nix b/nixos/modules/services/audio/mpd.nix
index 904b0a8c60a4..1a58732ca944 100644
--- a/nixos/modules/services/audio/mpd.nix
+++ b/nixos/modules/services/audio/mpd.nix
@@ -12,46 +12,85 @@ let
   gid = config.ids.gids.mpd;
   cfg = config.services.mpd;
 
-  credentialsPlaceholder = (
-    creds:
-    let
-      placeholders = (
-        lib.imap0 (
-          i: c: ''password "{{password-${toString i}}}@${lib.concatStringsSep "," c.permissions}"''
-        ) creds
-      );
-    in
-    lib.concatStringsSep "\n" placeholders
-  );
-
-  mpdConf = pkgs.writeText "mpd.conf" ''
-    # This file was automatically generated by NixOS. Edit mpd's configuration
-    # via NixOS' configuration.nix, as this file will be rewritten upon mpd's
-    # restart.
-
-    music_directory     "${cfg.musicDirectory}"
-    playlist_directory  "${cfg.playlistDirectory}"
-    ${lib.optionalString (cfg.dbFile != null) ''
-      db_file             "${cfg.dbFile}"
-    ''}
-    state_file          "${cfg.dataDir}/state"
-    sticker_file        "${cfg.dataDir}/sticker.sql"
-
-    ${lib.optionalString (
-      cfg.network.listenAddress != "any"
-    ) ''bind_to_address "${cfg.network.listenAddress}"''}
-    ${lib.optionalString (cfg.network.port != 6600) ''port "${toString cfg.network.port}"''}
-    ${lib.optionalString (cfg.fluidsynth) ''
-      decoder {
-              plugin "fluidsynth"
-              soundfont "${pkgs.soundfont-fluid}/share/soundfonts/FluidR3_GM2-2.sf2"
-      }
-    ''}
-
-    ${lib.optionalString (cfg.credentials != [ ]) (credentialsPlaceholder cfg.credentials)}
-
-    ${cfg.extraConfig}
-  '';
+  mkKeyValue =
+    a:
+    lib.mapAttrsToList (
+      k: v:
+      k
+      + " "
+      + (
+        if builtins.isBool v then
+          # Mainly for https://mpd.readthedocs.io/en/stable/user.html#zeroconf
+          "\"" + (lib.boolToYesNo v) + "\""
+        else
+          "\"" + (toString v) + "\""
+      )
+    ) a;
+  nonBlockSettings = lib.filterAttrs (n: v: !(builtins.isAttrs v || builtins.isList v)) cfg.settings;
+  pureBlockSettings = builtins.removeAttrs cfg.settings (builtins.attrNames nonBlockSettings);
+  blocks =
+    pureBlockSettings
+    // lib.optionalAttrs cfg.fluidsynth {
+      decoder = (pureBlockSettings.decoder or [ ]) ++ [
+        {
+          plugin = "fluidsynth";
+          soundfont = "${pkgs.soundfont-fluid}/share/soundfonts/FluidR3_GM2-2.sf2";
+        }
+      ];
+    };
+  processSingleBlock =
+    n: v:
+    [
+      (n + " {")
+    ]
+    # Add indentation, for better readability
+    ++ (map (l: "    " + l) (mkKeyValue v))
+    ++ [ "}" ];
+  mpdConf = pkgs.writeTextFile {
+    name = "mpd.conf";
+    text = ''
+      # This file was automatically generated by NixOS. Edit mpd's configuration
+      # via NixOS' configuration.nix, as this file will be rewritten upon mpd's
+      # restart.
+    ''
+    + lib.concatStringsSep "\n" (
+      mkKeyValue (
+        {
+          state_file = "${cfg.dataDir}/state";
+          sticker_file = "${cfg.dataDir}/sticker.sql";
+        }
+        // nonBlockSettings
+      )
+      ++ lib.flatten (
+        lib.mapAttrsToList (
+          n: v: if builtins.isList v then (map (b: processSingleBlock n b) v) else (processSingleBlock n v)
+        ) blocks
+      )
+      ++ lib.imap0 (
+        i: a: "password \"{{password-${toString i}}}@${lib.concatStringsSep "," a.permissions}\""
+      ) cfg.credentials
+    );
+    derivationArgs = {
+      expectScript = ''
+        spawn ${lib.getExe pkgs.buildPackages.mpd} --no-daemon "$env(out)"
+        expect {
+          "exception: Error in \"$env(out)\"" {
+            puts "Config file invalid\n"
+            exit 1
+          }
+          "exception:" {
+            exit 0
+          }
+        }
+      '';
+      passAsFile = [
+        "expectScript"
+      ];
+    };
+    checkPhase = ''
+      ${lib.getExe pkgs.buildPackages.expect} -f "$expectScriptPath"
+    '';
+  };
 
 in
 {
@@ -80,39 +119,16 @@ in
         '';
       };
 
-      musicDirectory = lib.mkOption {
-        type = with lib.types; either path (strMatching "(http|https|nfs|smb)://.+");
-        default = "${cfg.dataDir}/music";
-        defaultText = lib.literalExpression ''"''${dataDir}/music"'';
-        description = ''
-          The directory or NFS/SMB network share where MPD reads music from. If left
-          as the default value this directory will automatically be created before
-          the MPD server starts, otherwise the sysadmin is responsible for ensuring
-          the directory exists with appropriate ownership and permissions.
-        '';
+      user = lib.mkOption {
+        type = lib.types.str;
+        default = name;
+        description = "User account under which MPD runs.";
       };
 
-      playlistDirectory = lib.mkOption {
-        type = lib.types.path;
-        default = "${cfg.dataDir}/playlists";
-        defaultText = lib.literalExpression ''"''${dataDir}/playlists"'';
-        description = ''
-          The directory where MPD stores playlists. If left as the default value
-          this directory will automatically be created before the MPD server starts,
-          otherwise the sysadmin is responsible for ensuring the directory exists
-          with appropriate ownership and permissions.
-        '';
-      };
-
-      extraConfig = lib.mkOption {
-        type = lib.types.lines;
-        default = "";
-        description = ''
-          Extra directives added to to the end of MPD's configuration file,
-          mpd.conf. Basic configuration like file location and uid/gid
-          is added automatically to the beginning of the file. For available
-          options see {manpage}`mpd.conf(5)`.
-        '';
+      group = lib.mkOption {
+        type = lib.types.str;
+        default = name;
+        description = "Group account under which MPD runs.";
       };
 
       dataDir = lib.mkOption {
@@ -126,48 +142,135 @@ in
         '';
       };
 
-      user = lib.mkOption {
-        type = lib.types.str;
-        default = name;
-        description = "User account under which MPD runs.";
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Open ports in the firewall for mpd.";
       };
 
-      group = lib.mkOption {
-        type = lib.types.str;
-        default = name;
-        description = "Group account under which MPD runs.";
-      };
+      settings = lib.mkOption {
+        type = lib.types.submodule {
+          freeformType =
+            let
+              inherit (lib.types)
+                oneOf
+                attrsOf
+                listOf
+                str
+                int
+                bool
+                path
+                ;
+              atomType = oneOf [
+                str
+                int
+                bool
+                path
+              ];
+            in
+            attrsOf (oneOf [
+              atomType
+              (listOf (attrsOf atomType))
+            ]);
+          options = {
+            music_directory = lib.mkOption {
+              type = with lib.types; either path (strMatching "([a-z]+)://.+");
+              default = "${cfg.dataDir}/music";
+              defaultText = lib.literalExpression ''"''${dataDir}/music"'';
+              description = ''
+                The directory or URI where MPD reads music from. If left
+                as the default value this directory will automatically be created before
+                the MPD server starts, otherwise the sysadmin is responsible for ensuring
+                the directory exists with appropriate ownership and permissions.
+              '';
+            };
 
-      network = {
+            playlist_directory = lib.mkOption {
+              type = lib.types.path;
+              default = "${cfg.dataDir}/playlists";
+              defaultText = lib.literalExpression ''"''${dataDir}/playlists"'';
+              description = ''
+                The directory where MPD stores playlists. If left as the default value
+                this directory will automatically be created before the MPD server starts,
+                otherwise the sysadmin is responsible for ensuring the directory exists
+                with appropriate ownership and permissions.
+              '';
+            };
 
-        listenAddress = lib.mkOption {
-          type = lib.types.str;
-          default = "127.0.0.1";
-          example = "any";
-          description = ''
-            The address for the daemon to listen on.
-            Use `any` to listen on all addresses.
-          '';
+            bind_to_address = lib.mkOption {
+              type = lib.types.str;
+              default = "127.0.0.1";
+              example = "any";
+              description = ''
+                The address for the daemon to listen on.
+                Use `any` to listen on all addresses.
+              '';
+            };
+
+            port = lib.mkOption {
+              type = lib.types.port;
+              default = 6600;
+              description = ''
+                This setting is the TCP port that is desired for the daemon to get assigned
+                to.
+              '';
+            };
+
+            db_file = lib.mkOption {
+              type = lib.types.path;
+              default = "${cfg.dataDir}/tag_cache";
+              defaultText = lib.literalExpression ''"''${dataDir}/tag_cache"'';
+              description = ''
+                The path to MPD's database.
+              '';
+            };
+          };
         };
-
-        port = lib.mkOption {
-          type = lib.types.port;
-          default = 6600;
-          description = ''
-            This setting is the TCP port that is desired for the daemon to get assigned
-            to.
-          '';
-        };
-
-      };
-
-      dbFile = lib.mkOption {
-        type = lib.types.nullOr lib.types.str;
-        default = "${cfg.dataDir}/tag_cache";
-        defaultText = lib.literalExpression ''"''${dataDir}/tag_cache"'';
+        default = { };
         description = ''
-          The path to MPD's database. If set to `null` the
-          parameter is omitted from the configuration.
+          Configuration for MPD. MPD supports key-value like blocks for settings
+          like `audio_output` and `neighbor`. Some of these blocks can be
+          specified multiple times, so the following configuration:
+
+          ```txt
+          audio_output {
+              device "iec958:CARD=Intel,DEV=0"
+              mixer_control "PCM"
+              name "My specific ALSA output"
+              type "alsa"
+          }
+          audio_output {
+              mixer_type "null"
+              name "ALSA Null"
+              type "alsa"
+          }
+          audio_output {
+              name "The Pulse"
+              type "pulse"
+          }
+          ```
+
+          Can be inserted with:
+
+          ```nix
+          audio_output = [
+            {
+              type = "alsa";
+              name = "My specific ALSA output";
+              device = "iec958:CARD=Intel,DEV=0";
+              mixer_control = "PCM";
+            }
+            {
+              type = "alsa";
+              name = "ALSA Null";
+              mixer_type = "null";
+            }
+            {
+              type = "pulse";
+              name = "The Pulse";
+            }
+          ];
+          ```
         '';
       };
 
@@ -226,7 +329,7 @@ in
         type = lib.types.bool;
         default = false;
         description = ''
-          If set, add fluidsynth soundfont and configure the plugin.
+          If set, add fluidsynth soundfont `decoder` block.
         '';
       };
     };
@@ -235,8 +338,47 @@ in
 
   ###### implementation
 
+  imports = [
+    (lib.mkRenamedOptionModule
+      [ "services" "mpd" "musicDirectory" ]
+      [ "services" "mpd" "settings" "music_directory" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "mpd" "playlistDirectory" ]
+      [ "services" "mpd" "settings" "playlist_directory" ]
+    )
+    (lib.mkRenamedOptionModule [ "services" "mpd" "dbFile" ] [ "services" "mpd" "settings" "db_file" ])
+    (lib.mkRenamedOptionModule
+      [ "services" "mpd" "network" "listenAddress" ]
+      [ "services" "mpd" "settings" "bind_to_address" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "mpd" "network" "port" ]
+      [ "services" "mpd" "settings" "port" ]
+    )
+    (lib.mkRemovedOptionModule
+      [
+        "services"
+        "mpd"
+        "extraConfig"
+      ]
+      "services.mpd.extraConfig was replaced by the declarative services.mpd.settings option, per RFC42."
+    )
+  ];
+
   config = lib.mkIf cfg.enable {
 
+    warnings =
+      lib.optional
+        (
+          !(builtins.elem cfg.bind_to_address [
+            "localhost"
+            "127.0.0.1"
+          ])
+          && !cfg.openFirewall
+        )
+        "Using '${cfg.bind_to_address}' as services.mpd.settings.bind_to_address without enabling services.mpd.openFirewall, might prevent you from accessing MPD from other clients.";
+
     # install mpd units
     systemd.packages = [ pkgs.mpd ];
 
@@ -245,12 +387,12 @@ in
       listenStreams = [
         "" # Note: this is needed to override the upstream unit
         (
-          if pkgs.lib.hasPrefix "/" cfg.network.listenAddress then
-            cfg.network.listenAddress
+          if pkgs.lib.hasPrefix "/" cfg.settings.bind_to_address then
+            cfg.settings.bind_to_address
           else
             "${
-              lib.optionalString (cfg.network.listenAddress != "any") "${cfg.network.listenAddress}:"
-            }${toString cfg.network.port}"
+              lib.optionalString (cfg.settings.bind_to_address != "any") "${cfg.settings.bind_to_address}:"
+            }${toString cfg.settings.port}"
         )
       ];
     };
@@ -282,17 +424,19 @@ in
         StateDirectory =
           [ ]
           ++ lib.optionals (cfg.dataDir == "/var/lib/${name}") [ name ]
-          ++ lib.optionals (cfg.playlistDirectory == "/var/lib/${name}/playlists") [
+          ++ lib.optionals (cfg.settings.playlist_directory == "/var/lib/${name}/playlists") [
             name
             "${name}/playlists"
           ]
-          ++ lib.optionals (cfg.musicDirectory == "/var/lib/${name}/music") [
+          ++ lib.optionals (cfg.settings.music_directory == "/var/lib/${name}/music") [
             name
             "${name}/music"
           ];
       };
     };
 
+    networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall [ cfg.settings.port ];
+
     users.users = lib.optionalAttrs (cfg.user == name) {
       ${name} = {
         inherit uid;
diff --git a/nixos/modules/services/audio/mpdscribble.nix b/nixos/modules/services/audio/mpdscribble.nix
index 39dab7105968..cd874f000b3a 100644
--- a/nixos/modules/services/audio/mpdscribble.nix
+++ b/nixos/modules/services/audio/mpdscribble.nix
@@ -8,7 +8,6 @@
 let
   cfg = config.services.mpdscribble;
   mpdCfg = config.services.mpd;
-  mpdOpt = options.services.mpd;
 
   endpointUrls = {
     "last.fm" = "http://post.audioscrobbler.com";
@@ -114,11 +113,11 @@ in
 
     host = lib.mkOption {
       default = (
-        if mpdCfg.network.listenAddress != "any" then mpdCfg.network.listenAddress else "localhost"
+        if mpdCfg.settings.bind_to_address != "any" then mpdCfg.settings.bind_to_address else "localhost"
       );
       defaultText = lib.literalExpression ''
-        if config.${mpdOpt.network.listenAddress} != "any"
-        then config.${mpdOpt.network.listenAddress}
+        if config.services.mpd.settings.bind_to_address != "any"
+        then config.services.mpd.settings.bind_to_address
         else "localhost"
       '';
       type = lib.types.str;
@@ -148,8 +147,8 @@ in
     };
 
     port = lib.mkOption {
-      default = mpdCfg.network.port;
-      defaultText = lib.literalExpression "config.${mpdOpt.network.port}";
+      default = mpdCfg.settings.port;
+      defaultText = lib.literalExpression "config.services.mpd.settings.port";
       type = lib.types.port;
       description = ''
         Port for the mpdscribble daemon to search for a mpd daemon on.
diff --git a/nixos/modules/services/audio/ympd.nix b/nixos/modules/services/audio/ympd.nix
index 12672eb935f1..0999291ca0da 100644
--- a/nixos/modules/services/audio/ympd.nix
+++ b/nixos/modules/services/audio/ympd.nix
@@ -33,8 +33,8 @@ in
 
         port = lib.mkOption {
           type = lib.types.port;
-          default = config.services.mpd.network.port;
-          defaultText = lib.literalExpression "config.services.mpd.network.port";
+          default = config.services.mpd.settings.port;
+          defaultText = lib.literalExpression "config.services.mpd.settings.port";
           description = "The port where MPD is listening.";
           example = 6600;
         };
diff --git a/nixos/modules/services/misc/moonraker.nix b/nixos/modules/services/misc/moonraker.nix
index 53b69a729f27..639f9798a627 100644
--- a/nixos/modules/services/misc/moonraker.nix
+++ b/nixos/modules/services/misc/moonraker.nix
@@ -176,6 +176,7 @@ in
     ]
     ++ lib.optional (cfg.configDir != null) "d '${cfg.configDir}' - ${cfg.user} ${cfg.group} - -"
     ++ lib.optionals cfg.analysis.enable [
+      "d '${cfg.stateDir}/tools' - ${cfg.user} ${cfg.group} - -"
       "d '${cfg.stateDir}/tools/klipper_estimator' - ${cfg.user} ${cfg.group} - -"
       "L+ '${cfg.stateDir}/tools/klipper_estimator/klipper_estimator_linux' - - - - ${lib.getExe pkgs.klipper-estimator}"
     ];
diff --git a/nixos/modules/services/torrent/rtorrent.nix b/nixos/modules/services/torrent/rtorrent.nix
index 822e1ab1c3c5..6b8a9d55d6e9 100644
--- a/nixos/modules/services/torrent/rtorrent.nix
+++ b/nixos/modules/services/torrent/rtorrent.nix
@@ -245,6 +245,7 @@ in
               RestrictSUIDSGID = true;
               SystemCallArchitectures = "native";
               SystemCallFilter = [
+                "@chown"
                 "@system-service"
                 "~@privileged"
               ];
diff --git a/nixos/tests/lomiri-calendar-app.nix b/nixos/tests/lomiri-calendar-app.nix
index 2d8a7ae10026..5b18e7dd50b4 100644
--- a/nixos/tests/lomiri-calendar-app.nix
+++ b/nixos/tests/lomiri-calendar-app.nix
@@ -63,19 +63,28 @@
         # On New Event page
         machine.succeed("xdotool mousemove 500 230 click 1")
         machine.sleep(2)
-        machine.send_chars("foobar")
+        machine.send_chars("Poke")
         machine.sleep(2) # make sure they're actually in there
         machine.succeed("xdotool mousemove 1000 40 click 1")
+        machine.sleep(10) # Give the app some time to save the event
+
+        # Can't consistently OCR for "Agenda". Just restart it.
+        machine.succeed("pgrep -afx lomiri-calendar-app >&2")
+        machine.succeed("pkill -efx lomiri-calendar-app >&2")
+        machine.wait_until_fails("pgrep -afx lomiri-calendar-app >&2")
+        machine.succeed("lomiri-calendar-app >&2 &")
+        machine.sleep(10)
+        machine.send_key("alt-f10")
         machine.sleep(2)
-        machine.wait_for_text("Agenda")
-        machine.screenshot("lomiri-calendar_eventadded")
 
         # Back on main page
         # Event was created, does it have the correct name?
-        machine.wait_for_text("foobar")
+        machine.wait_for_text("Poke")
         machine.screenshot("lomiri-calendar_works")
 
-    machine.succeed("pkill -f lomiri-calendar-app")
+    machine.succeed("pgrep -afx lomiri-calendar-app >&2")
+    machine.succeed("pkill -efx lomiri-calendar-app >&2")
+    machine.wait_until_fails("pgrep -afx lomiri-calendar-app >&2")
 
     with subtest("lomiri calendar localisation works"):
         machine.succeed("env LANG=de_DE.UTF-8 lomiri-calendar-app >&2 &")
diff --git a/nixos/tests/lomiri-music-app.nix b/nixos/tests/lomiri-music-app.nix
index a54b6a11dac1..49872b9938c5 100644
--- a/nixos/tests/lomiri-music-app.nix
+++ b/nixos/tests/lomiri-music-app.nix
@@ -145,12 +145,12 @@ in
     with subtest("lomiri music plays music"):
         machine.succeed("xdotool mousemove 30 720 click 1") # Skip intro
         machine.sleep(2)
-        machine.wait_for_text("Albums")
+        machine.wait_for_window("Albums")
         machine.succeed("xdotool mousemove 25 45 click 1") # Open categories
         machine.sleep(2)
         machine.succeed("xdotool mousemove 25 240 click 1") # Switch to Tracks category
         machine.sleep(2)
-        machine.wait_for_text("Tracks") # Written in larger text now, easier for OCR
+        machine.wait_for_window("Tracks")
         machine.screenshot("lomiri-music_listing")
 
         # Ensure pause colours isn't present already
@@ -192,7 +192,7 @@ in
         machine.sleep(10)
         machine.send_key("alt-f10")
         machine.sleep(2)
-        machine.wait_for_text("Titel")
+        machine.wait_for_window("Titel")
         machine.screenshot("lomiri-music_localised")
   '';
 }
diff --git a/nixos/tests/mpd.nix b/nixos/tests/mpd.nix
index f80c6658c621..36337bfbb4de 100644
--- a/nixos/tests/mpd.nix
+++ b/nixos/tests/mpd.nix
@@ -1,28 +1,18 @@
 { pkgs, lib, ... }:
 let
   track = pkgs.fetchurl {
-    # Sourced from http://freemusicarchive.org/music/Blue_Wave_Theory/Surf_Music_Month_Challenge/Skyhawk_Beach_fade_in
+    # Sourced from https://freemusicarchive.org/music/Jazz_at_Mladost_Club/Jazz_Night/Blue_bossa/
 
-    name = "Blue_Wave_Theory-Skyhawk_Beach.mp3";
-    url = "https://freemusicarchive.org/file/music/ccCommunity/Blue_Wave_Theory/Surf_Music_Month_Challenge/Blue_Wave_Theory_-_04_-_Skyhawk_Beach.mp3";
-    hash = "sha256-91VDWwrcP6Cw4rk72VHvZ8RGfRBrpRE8xo/02dcJhHc=";
+    name = "Blue bossa - Jazz at Miadost Club.mp3";
+    url = "https://files.freemusicarchive.org/storage-freemusicarchive-org/music/no_curator/Jazz_at_Mladost_Club/Jazz_Night/Jazz_at_Mladost_Club_-_07_-_Blue_bossa.mp3?download=1&name=Jazz%20at%20Mladost%20Club%20-%20Blue%20bossa.mp3";
+    hash = "sha256-cAG4nBuc97J3ZJc9cm/6vWTgnPL/Hfkar7cA3+89rto=";
     meta.license = lib.licenses.cc-by-sa-40;
   };
 
-  defaultCfg = rec {
+  defaultMpdCfg = {
     user = "mpd";
     group = "mpd";
     dataDir = "/var/lib/mpd";
-    musicDirectory = "${dataDir}/music";
-  };
-
-  defaultMpdCfg = {
-    inherit (defaultCfg)
-      dataDir
-      musicDirectory
-      user
-      group
-      ;
     enable = true;
   };
 
@@ -30,7 +20,7 @@ let
     {
       user,
       group,
-      musicDirectory,
+      dataDir,
     }:
     {
       description = "Sets up the music file(s) for MPD to use.";
@@ -38,7 +28,7 @@ let
       after = [ "mpd.service" ];
       wantedBy = [ "default.target" ];
       script = ''
-        cp ${track} ${musicDirectory}
+        cp ${track} ${dataDir}/music
       '';
       serviceConfig = {
         User = user;
@@ -57,7 +47,10 @@ in
 {
   name = "mpd";
   meta = {
-    maintainers = with lib.maintainers; [ emmanuelrosa ];
+    maintainers = with lib.maintainers; [
+      emmanuelrosa
+      doronbehar
+    ];
   };
 
   nodes = {
@@ -68,18 +61,20 @@ in
       lib.mkMerge [
         (mkServer {
           mpd = defaultMpdCfg // {
-            network.listenAddress = "any";
-            extraConfig = ''
-              audio_output {
-                type "alsa"
-                name "ALSA"
-                mixer_type "null"
-              }
-            '';
+            settings = {
+              bind_to_address = "any";
+              audio_output = [
+                {
+                  type = "alsa";
+                  name = "ALSA";
+                  mixer_type = "null";
+                }
+              ];
+            };
+            openFirewall = true;
           };
-          musicService = musicService { inherit (defaultMpdCfg) user group musicDirectory; };
+          musicService = musicService { inherit (defaultMpdCfg) user group dataDir; };
         })
-        { networking.firewall.allowedTCPPorts = [ 6600 ]; }
       ];
 
     serverPulseAudio =
@@ -87,15 +82,15 @@ in
       lib.mkMerge [
         (mkServer {
           mpd = defaultMpdCfg // {
-            extraConfig = ''
-              audio_output {
-                type "pulse"
-                name "The Pulse"
+            settings.audio_output = [
+              {
+                type = "pulse";
+                name = "The Pulse";
               }
-            '';
+            ];
           };
 
-          musicService = musicService { inherit (defaultMpdCfg) user group musicDirectory; };
+          musicService = musicService { inherit (defaultMpdCfg) user group dataDir; };
         })
         {
           services.pulseaudio = {
@@ -144,5 +139,8 @@ in
     # The PulseAudio-based server is configured not to accept external client connections
     # to perform the following test:
     client.fail(f"{mpc} -h serverPulseAudio status")
+    # For inspecting these files
+    serverALSA.copy_from_vm("/run/mpd/mpd.conf", "ALSA")
+    serverPulseAudio.copy_from_vm("/run/mpd/mpd.conf", "PulseAudio")
   '';
 }
diff --git a/pkgs/applications/editors/vscode/extensions/WakaTime.vscode-wakatime/default.nix b/pkgs/applications/editors/vscode/extensions/WakaTime.vscode-wakatime/default.nix
index b520cce8670a..224b7b3595cf 100644
--- a/pkgs/applications/editors/vscode/extensions/WakaTime.vscode-wakatime/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/WakaTime.vscode-wakatime/default.nix
@@ -1,14 +1,13 @@
-{ lib, vscode-utils }:
-
-let
-  inherit (vscode-utils) buildVscodeMarketplaceExtension;
-in
-buildVscodeMarketplaceExtension {
+{
+  lib,
+  vscode-utils,
+}:
+vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "vscode-wakatime";
     publisher = "WakaTime";
-    version = "25.3.2";
-    hash = "sha256-xX1vejS8zoidcI6fnp7vvtSw4rMHIe2IF4JQJB5hvqs=";
+    version = "25.4.0";
+    hash = "sha256-furuRhQPcK9r4G878WKD9BiQuiwRbn+pJpNWAbpIgOw=";
   };
 
   meta = {
diff --git a/pkgs/applications/networking/cluster/rke2/README.md b/pkgs/applications/networking/cluster/rke2/README.md
index e511c1a5ef6c..e21a98b954b0 100644
--- a/pkgs/applications/networking/cluster/rke2/README.md
+++ b/pkgs/applications/networking/cluster/rke2/README.md
@@ -16,27 +16,116 @@ version skew policy.
 > Upgrade the server nodes first, one at a time. Once all servers have been upgraded, you may then
 > upgrade agent nodes.
 
-## Release Channels
+## Release Maintenance
+
+This section describes how new RKE2 releases are published in nixpkgs.
+
+Before contributing new RKE2 packages or updating existing packages, make sure that
+
+- New packages build (e.g. `nix-build -A rke2_1_34`)
+- All tests pass (e.g. `nix-build -A rke2_1_34.tests`)
+- You respect the nixpkgs [contributing guidelines](/CONTRIBUTING.md)
+
+### Release Channels
 
 RKE2 has two named release channels, i.e. `stable` and `latest`. Additionally, there exists a
 release channel tied to each Kubernetes minor version, e.g. `v1.32`.
 
 Nixpkgs follows active minor version release channels (typically 4 at a time) and sets aliases for
-`rke2_stable` and `rke2_latest` accordingly.
-
-Patch releases should be backported to the latest stable release branch; however, new minor
-versions are not backported.
+`rke2_stable` and `rke2_latest` accordingly. The [update-script](./update-script.sh) takes care of
+updating the aliases automatically.
 
 For further information visit the
 [RKE2 release channels documentation](https://docs.rke2.io/upgrades/manual_upgrade?_highlight=manua#release-channels).
 
-## EOL Versions
+### Patch Releases
 
-Approximately every 4 months a minor RKE2 version reaches EOL. EOL versions should be removed from
-`nixpkgs-unstable`, preferably by throwing with an explanatory message in
-`pkgs/top-level/aliases.nix`. With stable releases, however, it isn't expected that packages will be
-removed. Instead we set `meta.knownVulnerabilities` for stable EOL packages, like it is also done
-for EOL JDKs, browser engines, Node.js versions, etc.
+Updates to existing packages should be performed by the update script. In order to update an RKE2
+package, you call the update script and pass it the minor version of the package you want to update.
 
-For further information on the RKE2 lifecycle, see the
-[SUSE Product Support Lifecycle page](https://www.suse.com/lifecycle#rke2).
+For example, to update `rke2_1_34`:
+
+```
+./pkgs/applications/networking/cluster/rke2/update-script.sh 34
+```
+
+Patch releases for packages that are also available on the latest stable release channel should be
+backported. The backport PR can be created automatically by adding the `backport release-XX.XX`
+label on the update PR.
+
+### Minor Releases
+
+Every minor release gets a dedicated package in nixpkgs. For example, you would release `rke2_1_35`
+by doing the following:
+
+1. Copy the version information of an existing release, its contents will be updated by the update
+   script later on
+   - `cp -r ./pkgs/applications/networking/cluster/rke2/1_34 ./pkgs/applications/networking/cluster/rke2/1_35`
+2. Add a new package block to [default.nix](./default.nix), you can copy an existing block from a
+   previous release and update the version numbers
+   - `rke2_1_35 = ...`
+3. Run the update script for the new package
+   - `./pkgs/applications/networking/cluster/rke2/update-script.sh 35`
+
+New minor versions are **not** backported to stable release channels.
+
+### Final Patch Releases (EOL)
+
+RKE2 follows Kubernetes' release schedule. In general, there is a final patch release with which a
+minor version enters end-of-life. See Kubernetes'
+[non-active branch history](https://kubernetes.io/releases/patch-releases/#non-active-branch-history)
+for further information. Approximately every 4 months a minor RKE2 version reaches EOL.
+
+Due to the delay between Kubernetes releases and RKE2 releases, the final patch version for RKE2 may
+be released slightly after the EOL date. Usually this is nothing to worry about.
+
+#### Handling EOL on unstable
+
+EOL packages are removed from unstable. The final patch version should not be released on unstable,
+if it has entered end-of-life already.
+
+In order to remove a versioned RKE2 package, create a PR achieving the following:
+
+1. Remove the versioned folder containing the version files
+   - `rm -r ./pkgs/applications/networking/cluster/rke2/1_34`
+2. Remove the package block from [default.nix](../default.nix) (`rke2_1_34 = ...`)
+3. Remove the package reference from
+   [pkgs/top-level/all-packages.nix](/pkgs/top-level/all-packages.nix)
+4. Add a deprecation notice in [pkgs/top-level/aliases.nix](/pkgs/top-level/aliases.nix)
+   - Such as
+     `rke2_1_34 = throw "'rke2_1_34' has been removed from nixpkgs as it has reached end of life"; # Added 2026-10-27`
+
+#### Handling EOL on stable
+
+EOL packages should **not** be removed from a stable release branch. Instead we mark stable EOL
+packages as vulnerable due to EOL, like it is also done for EOL JDKs, browser engines, Node.js
+versions, etc.
+
+In order to mark a versioned RKE2 package as vulnerable, override `meta.knownVulnerabilities` on the
+respective package block.
+
+```nix
+{
+  rke2_1_34 =
+    (common (
+      (import ./1_34/versions.nix)
+      // {
+        updateScript = [
+          ./update-script.sh
+          "34"
+        ];
+      }
+    ) extraArgs).overrideAttrs
+      {
+        meta.knownVulnerabilities = [ "rke2_1_34 has reached end-of-life on 2026-10-27" ];
+      };
+}
+```
+
+> [!NOTE]
+> Remember to add "Not-cherry-picked-because: <reason>" in the commit message for commits on stable
+> that are not cherry picked.
+
+#### Additional Resources
+
+- [RKE2 Product Support Lifecycle page](https://www.suse.com/lifecycle#rke2)
diff --git a/pkgs/applications/networking/instant-messengers/linphone/default.nix b/pkgs/applications/networking/instant-messengers/linphone/default.nix
index 41273eb64b05..bd20ef145db2 100644
--- a/pkgs/applications/networking/instant-messengers/linphone/default.nix
+++ b/pkgs/applications/networking/instant-messengers/linphone/default.nix
@@ -9,7 +9,7 @@ makeScopeWithSplicing' {
     mkLinphoneDerivation = self.mk-linphone-derivation;
 
     linphoneSdkVersion = "5.4.67";
-    linphoneSdkHash = "sha256-QM4EVm7VJeOTt5Dc4DFAJOrGphCRcGniN0Tnfl4zab8=";
+    linphoneSdkHash = "sha256-YG+GF6En1r8AYoIj7E5hqPcmXidMmO0ZKVx/YC5w55I=";
   };
   f =
     self:
diff --git a/pkgs/build-support/fetchurl/builder.sh b/pkgs/build-support/fetchurl/builder.sh
index 44ac80737bc0..ae6c372208e1 100644
--- a/pkgs/build-support/fetchurl/builder.sh
+++ b/pkgs/build-support/fetchurl/builder.sh
@@ -109,7 +109,7 @@ tryHashedMirrors() {
 set -o noglob
 
 urls2=
-for url in $urls; do
+for url in "${urls[@]}"; do
     if test "${url:0:9}" != "mirror://"; then
         urls2="$urls2 $url"
     else
diff --git a/pkgs/by-name/ap/appflowy/package.nix b/pkgs/by-name/ap/appflowy/package.nix
index 6565c8c0a8af..5b4e4edff427 100644
--- a/pkgs/by-name/ap/appflowy/package.nix
+++ b/pkgs/by-name/ap/appflowy/package.nix
@@ -10,6 +10,7 @@
   xdg-user-dirs,
   keybinder3,
   libnotify,
+  gst_all_1,
 }:
 
 let
@@ -17,11 +18,11 @@ let
     rec {
       x86_64-linux = {
         urlSuffix = "linux-x86_64.tar.gz";
-        hash = "sha256-HXBRWQfdhlKmOOULdRELrGcxVVhKV+PvgtRHW1yU6+I=";
+        hash = "sha256-87mauW50ccOaPyK04O4I7+0bsvxVrdFxhi/Muc53wDY=";
       };
       x86_64-darwin = {
         urlSuffix = "macos-universal.zip";
-        hash = "sha256-Mv4HfG93+NpbMAhDwcXZ260APL+sbYM6C+DqGZr6ogU=";
+        hash = "sha256-a1WhOQ8NU3/aGAdaw8o3y7ckRdBsNgLZZ2nOrMsQdOA=";
       };
       aarch64-darwin = x86_64-darwin;
     }
@@ -30,7 +31,7 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "appflowy";
-  version = "0.10.4";
+  version = "0.10.6";
 
   src = fetchzip {
     url = "https://github.com/AppFlowy-IO/appflowy/releases/download/${finalAttrs.version}/AppFlowy-${finalAttrs.version}-${dist.urlSuffix}";
@@ -48,6 +49,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     gtk3
     keybinder3
     libnotify
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
   ];
 
   dontBuild = true;
diff --git a/pkgs/by-name/ar/arduino-create-agent/package.nix b/pkgs/by-name/ar/arduino-create-agent/package.nix
index 093eee137e65..4b5883ffc5d6 100644
--- a/pkgs/by-name/ar/arduino-create-agent/package.nix
+++ b/pkgs/by-name/ar/arduino-create-agent/package.nix
@@ -1,12 +1,12 @@
 {
   lib,
   stdenv,
-  buildGoModule,
+  buildGo124Module,
   fetchFromGitHub,
   go-task,
 }:
 
-buildGoModule rec {
+buildGo124Module rec {
   pname = "arduino-create-agent";
   version = "1.7.0";
 
diff --git a/pkgs/by-name/as/asusctl/package.nix b/pkgs/by-name/as/asusctl/package.nix
index 7b53d3916c2f..b322fba81723 100644
--- a/pkgs/by-name/as/asusctl/package.nix
+++ b/pkgs/by-name/as/asusctl/package.nix
@@ -18,16 +18,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "asusctl";
-  version = "6.1.17";
+  version = "6.2.0";
 
   src = fetchFromGitLab {
     owner = "asus-linux";
     repo = "asusctl";
     tag = version;
-    hash = "sha256-rNLQYCE7NZAel2fr5VoAMlm7QkH1KrySKdEn2+WMPo8=";
+    hash = "sha256-frQbfCdK7bD6IAUa+MAOaRLhMrbdFRdHocQ0Z1tzsqE=";
   };
 
-  cargoHash = "sha256-/vMVSGUO6Zu/8GSTq1jsXLWVP9sWsuD7fJty3NnKXf4=";
+  cargoHash = "sha256-Z3JFp/qH3mD3Hy/kqSONOZ+syulgr+t0ZzFRvNN+Ayg=";
 
   postPatch = ''
     files="
@@ -46,7 +46,6 @@ rustPlatform.buildRustPackage rec {
     substituteInPlace rog-control-center/src/main.rs \
       --replace-fail 'std::env::var("RUST_TRANSLATIONS").is_ok()' 'true'
 
-    substituteInPlace data/asusd.rules --replace-fail /usr/bin/systemctl ${lib.getExe' systemd "systemctl"}
     substituteInPlace data/asusd.service \
       --replace-fail /usr/bin/asusd $out/bin/asusd \
       --replace-fail /bin/sleep ${lib.getExe' coreutils "sleep"}
@@ -106,6 +105,7 @@ rustPlatform.buildRustPackage rec {
     maintainers = with lib.maintainers; [
       k900
       aacebedo
+      yuannan
     ];
   };
 }
diff --git a/pkgs/by-name/au/auto-editor/package.nix b/pkgs/by-name/au/auto-editor/package.nix
index 0f4d53d5e79b..4083ec87315a 100644
--- a/pkgs/by-name/au/auto-editor/package.nix
+++ b/pkgs/by-name/au/auto-editor/package.nix
@@ -19,8 +19,6 @@
 
   python3,
   python3Packages,
-  nimble,
-  nim,
 }:
 
 buildNimPackage rec {
@@ -71,26 +69,23 @@ buildNimPackage rec {
       --replace-fail '"main=auto-editor"' '"main"'
   '';
 
-  # TODO: Fix checks
-  /*
-    nativeCheckInputs = [
-      python3Packages.av
-      python3
-    ];
+  nativeCheckInputs = [
+    python3
+    python3Packages.av
+  ];
 
-    checkPhase = ''
-      runHook preCheck
+  checkPhase = ''
+    runHook preCheck
 
-      nim c \
-      ${if withHEVC then "-d:enable_hevc" else ""} \
-      ${if withWhisper then "-d:enable_whisper" else ""} \
-      -r $src/src/rationals
+    eval "nim r --nimcache:$NIX_BUILD_TOP/nimcache $nimFlags $src/tests/rationals.nim"
 
-      python3 $src/tests/test.py
+    substituteInPlace tests/test.py \
+      --replace-fail '"./auto-editor"' "\"$out/bin/main\""
 
-      runHook postCheck
-    '';
-  */
+    python3 tests/test.py
+
+    runHook postCheck
+  '';
 
   postInstall = ''
     mv $out/bin/main $out/bin/auto-editor
diff --git a/pkgs/by-name/ba/bash-language-server/package.nix b/pkgs/by-name/ba/bash-language-server/package.nix
index 1fc4de499a2c..197db43a194b 100644
--- a/pkgs/by-name/ba/bash-language-server/package.nix
+++ b/pkgs/by-name/ba/bash-language-server/package.nix
@@ -28,8 +28,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       src
       pnpmWorkspaces
       ;
-    fetcherVersion = 1;
-    hash = "sha256-NvyqPv5OKgZi3hW98Da8LhsYatmrzrPX8kLOfLr+BrI=";
+    fetcherVersion = 3;
+    hash = "sha256-6i+1V3ZkjiJ/IXDun3JfwmfDOiemxCmAXMzS/rGT6ZU=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/be/bettercap/package.nix b/pkgs/by-name/be/bettercap/package.nix
index e189c63b70e7..c04f05a6f12b 100644
--- a/pkgs/by-name/be/bettercap/package.nix
+++ b/pkgs/by-name/be/bettercap/package.nix
@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "bettercap";
-  version = "2.41.4";
+  version = "2.41.5";
 
   src = fetchFromGitHub {
     owner = "bettercap";
     repo = "bettercap";
     rev = "v${version}";
-    sha256 = "sha256-y23gNqS5f/MP+wyRMxe40I+9RuZGyZEok17LIc9Z8O4=";
+    sha256 = "sha256-mw2Fe/7kSowozUpmXC5tMHZ02bF5+UHmy+lmkJ6SeLM=";
   };
 
-  vendorHash = "sha256-1kgjMPsj8z2Cl0YWe/1zY0Zuiza0X+ZAIgsMqPhCrMw=";
+  vendorHash = "sha256-ssNGy40KMJ9P33uEGyYOer92QRS2T6DQlKaf/3XMFwQ=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/bo/bolt-launcher/package.nix b/pkgs/by-name/bo/bolt-launcher/package.nix
index 81f60521132d..ddf07bb60edc 100644
--- a/pkgs/by-name/bo/bolt-launcher/package.nix
+++ b/pkgs/by-name/bo/bolt-launcher/package.nix
@@ -98,6 +98,7 @@ let
         exec = "bolt-launcher";
         icon = "bolt-launcher";
         categories = [ "Game" ];
+        startupWMClass = "BoltLauncher";
       })
     ];
   });
diff --git a/pkgs/by-name/bs/bstring/package.nix b/pkgs/by-name/bs/bstring/package.nix
new file mode 100644
index 000000000000..2aa06c3b7fe1
--- /dev/null
+++ b/pkgs/by-name/bs/bstring/package.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  ninja,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "bstring";
+  version = "1.0.3";
+
+  src = fetchFromGitHub {
+    owner = "msteinert";
+    repo = "bstring";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-efXMSRcPgo+WlOdbS1kY2PYQqSVwcsVSyU1JfsU8OOo=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+  ];
+
+  meta = {
+    description = "Better String Library for C";
+    homepage = "https://github.com/msteinert/bstring";
+    changelog = "https://github.com/msteinert/bstring/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.bsd3;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ nulleric ];
+  };
+})
diff --git a/pkgs/by-name/co/coredns/package.nix b/pkgs/by-name/co/coredns/package.nix
index 449c0ee660d8..982b34bd4550 100644
--- a/pkgs/by-name/co/coredns/package.nix
+++ b/pkgs/by-name/co/coredns/package.nix
@@ -6,7 +6,7 @@
   installShellFiles,
   nixosTests,
   externalPlugins ? [ ],
-  vendorHash ? "sha256-pU8INVCKjYfAFOeobM7N1XCMHod7Kz0N5NKwpMpA2lU=",
+  vendorHash ? "sha256-bnNpJgy54wvTST1Jtfbd1ldLJrIzTW62TL7wyHeqz28=",
 }:
 
 let
@@ -14,13 +14,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "coredns";
-  version = "1.13.1";
+  version = "1.13.2";
 
   src = fetchFromGitHub {
     owner = "coredns";
     repo = "coredns";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rWa4xjHRREoMtvPqW6ZP6Ym9qNTa0l8Opd15FsmxraI=";
+    hash = "sha256-9ggyFixdNy0t4UA8ZxU5oMUzA/8EB/k1jors4f8Q6YE=";
   };
 
   inherit vendorHash;
@@ -135,6 +135,7 @@ buildGoModule (finalAttrs: {
     maintainers = with lib.maintainers; [
       deltaevo
       djds
+      johanot
       rtreffer
       rushmorem
     ];
diff --git a/pkgs/by-name/dd/ddnet/package.nix b/pkgs/by-name/dd/ddnet/package.nix
index a718b1c19582..faec95dc4e5d 100644
--- a/pkgs/by-name/dd/ddnet/package.nix
+++ b/pkgs/by-name/dd/ddnet/package.nix
@@ -32,13 +32,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ddnet";
-  version = "19.5";
+  version = "19.6";
 
   src = fetchFromGitHub {
     owner = "ddnet";
     repo = "ddnet";
     tag = version;
-    hash = "sha256-L9n6jvI9rzrBp8yzKQPZRBSbT5/ZnEm6eLW6qMA+sy0=";
+    hash = "sha256-U0Yd3Xus0hsBpbXUsEC7EyoMtmsOXZJT4c3cFai918g=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
diff --git a/pkgs/by-name/ex/exfatprogs/package.nix b/pkgs/by-name/ex/exfatprogs/package.nix
index 97a2e38c4ea3..26ea0b9d31c0 100644
--- a/pkgs/by-name/ex/exfatprogs/package.nix
+++ b/pkgs/by-name/ex/exfatprogs/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exfatprogs";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "exfatprogs";
     repo = "exfatprogs";
     rev = version;
-    sha256 = "sha256-2kD2ZENAyhApYHs6+NNYkxfLj5fw/cIHRUhw0UnQx04=";
+    sha256 = "sha256-AwY5TkQRfWjkkcleymNN580mKGxIdZ0O30tt6yBbo5M=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fl/flaca/package.nix b/pkgs/by-name/fl/flaca/package.nix
index 6db3eb49b0e9..18bba90c1a25 100644
--- a/pkgs/by-name/fl/flaca/package.nix
+++ b/pkgs/by-name/fl/flaca/package.nix
@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "flaca";
-  version = "3.4.2";
+  version = "3.5.3";
 
   lockFile = fetchurl {
     url = "https://github.com/Blobfolio/flaca/releases/download/v${finalAttrs.version}/Cargo.lock";
-    hash = "sha256-6SpIqz/iLGVvOkwfiTcvf2EdlbVafQ+aHVc7taYLPDc=";
+    hash = "sha256-NNeq8qr+z0s98mgFYyUu9aNRqaAi2CZfQx0vQzSzOc8=";
   };
 
   src = fetchFromGitHub {
     owner = "Blobfolio";
     repo = "flaca";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9fD+nfSe0Rk06d+o3hnMH2lC6OAFa10gDNiDW57lSTg=";
+    hash = "sha256-Fh+nWnAG87NL3scr/y2jCNqaeJtEwi4nCYTGwnmEsIQ=";
   };
 
   postUnpack = ''
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   nativeBuildInputs = [ rustPlatform.bindgenHook ];
 
-  cargoHash = "sha256-LVY1+Nvcy7WoJ7Bsf1rgrdTzLMRqpquDXD8X3X8jX20=";
+  cargoHash = "sha256-yHkUsxJppHhIpgX7Vtrs8TCy43xaNpqoVkMZ0msr02k=";
 
   meta = {
     description = "CLI tool to losslessly compress JPEG and PNG images";
diff --git a/pkgs/by-name/fo/foundry/package.nix b/pkgs/by-name/fo/foundry/package.nix
index 481b6a205b88..28689b0e3e02 100644
--- a/pkgs/by-name/fo/foundry/package.nix
+++ b/pkgs/by-name/fo/foundry/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "foundry";
-  version = "1.4.4";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "foundry-rs";
     repo = "foundry";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-u+JCurH1gx4onC5Poxxd9+gVrUyyebcd6xnXY4Le6Rs=";
+    hash = "sha256-mbOv5XZH+AYZQjSUI+ksuAdLxZyRdF0LXK/8Q1DIgrU=";
   };
 
-  cargoHash = "sha256-JLuCZckiNv0t+kPuDk6TWmPIXKOvqf3HR/oFrQ5fKKQ=";
+  cargoHash = "sha256-vws7LcBRtoha+Sa4TLDNxMKA8caKkWFOauCLZs6we4Y=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/fo/foundry/svm-lists/linux-amd64.json b/pkgs/by-name/fo/foundry/svm-lists/linux-amd64.json
index 2469120c1331..2f10ef7fdf39 100644
--- a/pkgs/by-name/fo/foundry/svm-lists/linux-amd64.json
+++ b/pkgs/by-name/fo/foundry/svm-lists/linux-amd64.json
@@ -945,9 +945,21 @@
       "urls": [
         "dweb:/ipfs/QmPsmKxpd5berCgcTBXXPBC4PLHrb56tr3f6ZMxPGEf6vn"
       ]
+    },
+    {
+      "path": "solc-linux-amd64-v0.8.31+commit.fd3a2265",
+      "version": "0.8.31",
+      "build": "commit.fd3a2265",
+      "longVersion": "0.8.31+commit.fd3a2265",
+      "keccak256": "0xc6f3968537d87ec3432a06c25840491a3fac9d538c3e7c30900f47722f978f31",
+      "sha256": "0xaac9cd0116e9ae0cd3d8f64a8641381845dc9f12e2a52653de36fb619323e557",
+      "urls": [
+        "dweb:/ipfs/QmcpFFGAaoKkwiqng4czei7sa5Mvd9Hv4vRwUpRNNTCb9r"
+      ]
     }
   ],
   "releases": {
+    "0.8.31": "solc-linux-amd64-v0.8.31+commit.fd3a2265",
     "0.8.30": "solc-linux-amd64-v0.8.30+commit.73712a01",
     "0.8.29": "solc-linux-amd64-v0.8.29+commit.ab55807c",
     "0.8.28": "solc-linux-amd64-v0.8.28+commit.7893614a",
@@ -1035,5 +1047,5 @@
     "0.4.11": "solc-linux-amd64-v0.4.11+commit.68ef5810",
     "0.4.10": "solc-linux-amd64-v0.4.10+commit.9e8cc01b"
   },
-  "latestRelease": "0.8.30"
+  "latestRelease": "0.8.31"
 }
diff --git a/pkgs/by-name/fo/foundry/svm-lists/macosx-amd64.json b/pkgs/by-name/fo/foundry/svm-lists/macosx-amd64.json
index 4d8855a809f4..0c51ce896891 100644
--- a/pkgs/by-name/fo/foundry/svm-lists/macosx-amd64.json
+++ b/pkgs/by-name/fo/foundry/svm-lists/macosx-amd64.json
@@ -1066,9 +1066,21 @@
       "urls": [
         "dweb:/ipfs/QmbrZ9EQQakmwZ2MKzdT6Xp6RQfwbbc6bhrP7ZSeMGE6fx"
       ]
+    },
+    {
+      "path": "solc-macosx-amd64-v0.8.31+commit.fd3a2265",
+      "version": "0.8.31",
+      "build": "commit.fd3a2265",
+      "longVersion": "0.8.31+commit.fd3a2265",
+      "keccak256": "0xe24d2e6c51018020bd86cd51369e4087f3f59288577dd038326ebf84becf26c2",
+      "sha256": "0xf5a243d6b2dd8fba307e36c5fefa2d8eb3ae74ba81036d1c17c971b5d346ade9",
+      "urls": [
+        "dweb:/ipfs/QmXnqLGQF6Dgpkegp59Z8DcSq7UeT9jY7ENAWUzYjPaq8H"
+      ]
     }
   ],
   "releases": {
+    "0.8.31": "solc-macosx-amd64-v0.8.31+commit.fd3a2265",
     "0.8.30": "solc-macosx-amd64-v0.8.30+commit.73712a01",
     "0.8.29": "solc-macosx-amd64-v0.8.29+commit.ab55807c",
     "0.8.28": "solc-macosx-amd64-v0.8.28+commit.7893614a",
@@ -1167,5 +1179,5 @@
     "0.4.0": "solc-macosx-amd64-v0.4.0+commit.acd334c9",
     "0.3.6": "solc-macosx-amd64-v0.3.6+commit.988fe5e5"
   },
-  "latestRelease": "0.8.30"
+  "latestRelease": "0.8.31"
 }
diff --git a/pkgs/by-name/fo/foundry/update-svm-lists.sh b/pkgs/by-name/fo/foundry/update-svm-lists.sh
index 7393f776b1af..a0a743bfee1a 100755
--- a/pkgs/by-name/fo/foundry/update-svm-lists.sh
+++ b/pkgs/by-name/fo/foundry/update-svm-lists.sh
@@ -40,8 +40,8 @@ for url in "${urls[@]}"; do
     # Extract filename from URL
     filename=$(extract_filename "$url")
 
-    # Download the file and fix line endings
+    # Download the file, filter out prereleases, and fix line endings
     echo "Fetching $url to $dir/$filename"
-    curl -sL "$url" -o "${dir}/${filename}"
+    curl -sL "$url" | jq 'del(.builds[] | select(has("prerelease")))' > "${dir}/${filename}"
     ensure_unix_format "${dir}/${filename}"
 done
diff --git a/pkgs/by-name/ho/homepage-dashboard/package.nix b/pkgs/by-name/ho/homepage-dashboard/package.nix
index 901792fe5e31..072fff4b2aca 100644
--- a/pkgs/by-name/ho/homepage-dashboard/package.nix
+++ b/pkgs/by-name/ho/homepage-dashboard/package.nix
@@ -29,13 +29,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "homepage-dashboard";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "gethomepage";
     repo = "homepage";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-03am9z381UozNsmWZefopMp8/tLycXJyiZ5BUGaV1kY=";
+    hash = "sha256-T2bAN8ucCjcWhXScTI8YxtfrwK9NEfHGHIE8xJgD6Bs=";
   };
 
   pnpmDeps = pnpm_10.fetchDeps {
@@ -45,7 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
       src
       ;
     fetcherVersion = 1;
-    hash = "sha256-svkqmRFwZpcExFWtAbLL0lpHhzsI2s7RiLfQajIqjck=";
+    hash = "sha256-42dT1za9M4DowBh27UYh2QDyoVoNWA/L/9lyIY5OVwM=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ic/iconic/package.nix b/pkgs/by-name/ic/iconic/package.nix
index 293de5d6c18e..9bf12f4a5bf8 100644
--- a/pkgs/by-name/ic/iconic/package.nix
+++ b/pkgs/by-name/ic/iconic/package.nix
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "iconic";
-  version = "2025.3.2";
+  version = "2025.9.1";
 
   src = fetchFromGitHub {
     owner = "youpie";
     repo = "Iconic";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mj95GShV/PxFXweL14zTVANO10CGpXyktJjJGtD1XS8=";
+    hash = "sha256-vjtPVE+n1p5DB+KewhylA9w1kVkpKyDz0WF5Mrd+BBM=";
   };
 
   postPatch = ''
@@ -33,15 +33,13 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail "/app" "$out"
     substituteInPlace src/windows/regeneration.rs \
       --replace-fail "/app" "$out"
-    substituteInPlace src/config.rs \
-      --replace-fail "/app" "$out"
     substituteInPlace src/window.rs \
       --replace-fail "create_dir" "create_dir_all"
   '';
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-/D4l85PO2h+172f8AgQFze665otIeouxEdVL56f+hoM=";
+    hash = "sha256-Ma+ryvDaFfP3BYrtuPPKMVjF2l83xP+T7GlIiOenRAo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/iv/ivpn-service/package.nix b/pkgs/by-name/iv/ivpn-service/package.nix
new file mode 100644
index 000000000000..98db81a7c214
--- /dev/null
+++ b/pkgs/by-name/iv/ivpn-service/package.nix
@@ -0,0 +1,102 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  lib,
+  wirelesstools,
+  makeWrapper,
+  wireguard-tools,
+  openvpn,
+  obfs4,
+  iproute2,
+  dnscrypt-proxy,
+  iptables,
+  gawk,
+  util-linux,
+  nix-update-script,
+}:
+buildGoModule (finalAttrs: {
+  pname = "ivpn-service";
+  version = "3.15.0";
+
+  buildInputs = [ wirelesstools ];
+  nativeBuildInputs = [ makeWrapper ];
+
+  src = fetchFromGitHub {
+    owner = "ivpn";
+    repo = "desktop-app";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Y+oW/2WDkH/YydR+xSzEHPdCNKTmmsV4yEsju+OmDYE=";
+  };
+
+  modRoot = "daemon";
+  vendorHash = "sha256-DVKSCcEeE7vI8aOYuEwk22n0wtF7MMDOyAgYoXYadwI=";
+
+  proxyVendor = true; # .c file
+
+  patches = [ ./permissions.patch ];
+
+  postPatch = ''
+    substituteInPlace daemon/service/platform/platform_linux.go \
+      --replace 'openVpnBinaryPath = "/usr/sbin/openvpn"' \
+      'openVpnBinaryPath = "${openvpn}/bin/openvpn"' \
+      --replace 'routeCommand = "/sbin/ip route"' \
+      'routeCommand = "${iproute2}/bin/ip route"'
+
+    substituteInPlace daemon/netinfo/netinfo_linux.go \
+      --replace 'retErr := shell.ExecAndProcessOutput(log, outParse, "", "/sbin/ip", "route")' \
+      'retErr := shell.ExecAndProcessOutput(log, outParse, "", "${iproute2}/bin/ip", "route")'
+
+    substituteInPlace daemon/service/platform/platform_linux_release.go \
+      --replace 'installDir := "/opt/ivpn"' "installDir := \"$out\"" \
+      --replace 'obfsproxyStartScript = path.Join(installDir, "obfsproxy/obfs4proxy")' \
+      'obfsproxyStartScript = "${lib.getExe obfs4}"' \
+      --replace 'wgBinaryPath = path.Join(installDir, "wireguard-tools/wg-quick")' \
+      'wgBinaryPath = "${wireguard-tools}/bin/wg-quick"' \
+      --replace 'wgToolBinaryPath = path.Join(installDir, "wireguard-tools/wg")' \
+      'wgToolBinaryPath = "${wireguard-tools}/bin/wg"' \
+      --replace 'dnscryptproxyBinPath = path.Join(installDir, "dnscrypt-proxy/dnscrypt-proxy")' \
+      'dnscryptproxyBinPath = "${dnscrypt-proxy}/bin/dnscrypt-proxy"'
+  '';
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/ivpn/desktop-app/daemon/version._version=${finalAttrs.version}"
+    "-X github.com/ivpn/desktop-app/daemon/version._time=1970-01-01"
+  ];
+
+  postInstall = ''
+    mv $out/bin/{daemon,ivpn-service}
+  '';
+
+  postFixup = ''
+    mkdir -p $out/etc
+    cp -r $src/daemon/References/Linux/etc/* $out/etc/
+    cp -r $src/daemon/References/common/etc/* $out/etc/
+
+    patchShebangs --build $out/etc/firewall.sh $out/etc/splittun.sh $out/etc/client.down $out/etc/client.up
+
+    wrapProgram "$out/bin/ivpn-service" \
+      --suffix PATH : ${
+        lib.makeBinPath [
+          iptables
+          gawk
+          util-linux
+        ]
+      }
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Official IVPN Desktop app service daemon";
+    homepage = "https://www.ivpn.net/apps";
+    changelog = "https://github.com/ivpn/desktop-app/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [
+      urandom
+      blenderfreaky
+    ];
+    mainProgram = "ivpn-service";
+  };
+})
diff --git a/pkgs/tools/networking/ivpn/permissions.patch b/pkgs/by-name/iv/ivpn-service/permissions.patch
similarity index 100%
rename from pkgs/tools/networking/ivpn/permissions.patch
rename to pkgs/by-name/iv/ivpn-service/permissions.patch
diff --git a/pkgs/by-name/iv/ivpn-ui/package.nix b/pkgs/by-name/iv/ivpn-ui/package.nix
index f55e3b12d323..8c5a79d4b851 100644
--- a/pkgs/by-name/iv/ivpn-ui/package.nix
+++ b/pkgs/by-name/iv/ivpn-ui/package.nix
@@ -9,23 +9,20 @@
   makeWrapper,
   ivpn-service,
 }:
-let
-  version = "3.14.34";
-in
-buildNpmPackage {
+buildNpmPackage (finalAttrs: {
   pname = "ivpn-ui";
-  inherit version;
+  version = "3.15.0";
 
   src = fetchFromGitHub {
     owner = "ivpn";
     repo = "desktop-app";
-    tag = "v${version}";
-    hash = "sha256-Q96G5mJahJnXxpqJ8IF0oFie7l0Nd1p8drHH9NSpwEw=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Y+oW/2WDkH/YydR+xSzEHPdCNKTmmsV4yEsju+OmDYE=";
   };
 
   sourceRoot = "source/ui";
 
-  npmDepsHash = "sha256-y/VxvSZUvcIuckJF87639i5pcVJLg8SDAbWmg5bO3/s=";
+  npmDepsHash = "sha256-OOBBUDJwTP2T/KqzJPRV+A9ncRmb14KBoAXqa0T6c58=";
 
   nativeBuildInputs = [
     copyDesktopItems
@@ -85,9 +82,9 @@ buildNpmPackage {
     mainProgram = "ivpn-ui";
     homepage = "https://www.ivpn.net";
     downloadPage = "https://github.com/ivpn/desktop-app";
-    changelog = "https://github.com/ivpn/desktop-app/releases/tag/v${version}";
+    changelog = "https://github.com/ivpn/desktop-app/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ blenderfreaky ];
     platforms = [ "x86_64-linux" ];
   };
-}
+})
diff --git a/pkgs/by-name/iv/ivpn/package.nix b/pkgs/by-name/iv/ivpn/package.nix
new file mode 100644
index 000000000000..76c74c08932a
--- /dev/null
+++ b/pkgs/by-name/iv/ivpn/package.nix
@@ -0,0 +1,50 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  lib,
+  wirelesstools,
+  nix-update-script,
+}:
+buildGoModule (finalAttrs: {
+  pname = "ivpn";
+  version = "3.15.0";
+
+  buildInputs = [ wirelesstools ];
+
+  src = fetchFromGitHub {
+    owner = "ivpn";
+    repo = "desktop-app";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Y+oW/2WDkH/YydR+xSzEHPdCNKTmmsV4yEsju+OmDYE=";
+  };
+
+  modRoot = "cli";
+  vendorHash = "sha256-xZ1tMiv06fE2wtpDagKjHiVTPYWpj32hM6n/v9ZcgrE=";
+
+  proxyVendor = true; # .c file
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/ivpn/desktop-app/daemon/version._version=${finalAttrs.version}"
+    "-X github.com/ivpn/desktop-app/daemon/version._time=1970-01-01"
+  ];
+
+  postInstall = ''
+    mv $out/bin/{cli,ivpn}
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Official IVPN Desktop app";
+    homepage = "https://www.ivpn.net/apps";
+    changelog = "https://github.com/ivpn/desktop-app/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [
+      urandom
+      blenderfreaky
+    ];
+    mainProgram = "ivpn";
+  };
+})
diff --git a/pkgs/by-name/kn/knot-resolver-manager_6/package.nix b/pkgs/by-name/kn/knot-resolver-manager_6/package.nix
index 0f10f208e7be..c7c6f7d7f493 100644
--- a/pkgs/by-name/kn/knot-resolver-manager_6/package.nix
+++ b/pkgs/by-name/kn/knot-resolver-manager_6/package.nix
@@ -25,6 +25,12 @@ python3Packages.buildPythonPackage {
     substitute '${knot-resolver.unwrapped.config_py}'/knot_resolver/constants.py ./python/knot_resolver/constants.py \
       --replace-fail '${knot-resolver.unwrapped.out}/etc' '/etc' \
       --replace-fail '${knot-resolver.unwrapped.out}/sbin' '${knot-resolver}/bin'
+  ''
+  # On non-Linux let's simplify construction of the knot-resolver command line,
+  # as it would break because of nixpkgs-specific wrapping of python packages.
+  + ''
+    substituteInPlace python/knot_resolver/controller/supervisord/config_file.py \
+      --replace-fail 'args = [sys.executable] + sys.argv' 'args = sys.argv'
   '';
 
   build-system = with python3Packages; [
@@ -42,6 +48,7 @@ python3Packages.buildPythonPackage {
     typing-extensions
   ];
 
+  doCheck = python3Packages.stdenv.isLinux; # maybe in future
   nativeCheckInputs = with python3Packages; [
     augeas
     dnspython
diff --git a/pkgs/by-name/kn/knot-resolver_6/package.nix b/pkgs/by-name/kn/knot-resolver_6/package.nix
index 3aaf30ae4a65..f961f28e4209 100644
--- a/pkgs/by-name/kn/knot-resolver_6/package.nix
+++ b/pkgs/by-name/kn/knot-resolver_6/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   # native deps.
   runCommand,
   pkg-config,
@@ -48,6 +49,15 @@ let
       "config_py"
     ];
 
+    patches = [
+      (fetchpatch {
+        name = "test-cache-aarch64-darwin.patch";
+        url = "https://gitlab.nic.cz/knot/knot-resolver/-/commit/d155d0dbe408a3327b39f70e122aea6fb2b86684.diff";
+        excludes = [ "NEWS" ];
+        hash = "sha256-3w33v8UfhGdA50BlkfHpQLFxg+5ELk0lp7RzgvkSzK8=";
+      })
+    ];
+
     # Path fixups for the NixOS service.
     # systemd Exec* options are difficult to override in NixOS *if present*, so we drop them.
     postPatch = ''
diff --git a/pkgs/by-name/le/lego/package.nix b/pkgs/by-name/le/lego/package.nix
index 3be9fa4af401..7e821735c306 100644
--- a/pkgs/by-name/le/lego/package.nix
+++ b/pkgs/by-name/le/lego/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "lego";
-  version = "4.27.0";
+  version = "4.29.0";
 
   src = fetchFromGitHub {
     owner = "go-acme";
     repo = "lego";
     tag = "v${version}";
-    hash = "sha256-mc/aWjYvgF5PSl6Ng9oLNWAlGDjnhzEouo9LXh/PFsE=";
+    hash = "sha256-czCOrgC3Xy42KigAe+tsPRdWqxgdHFl0KN3Ei2zeyy8=";
   };
 
-  vendorHash = "sha256-648FrZqSatEYONzj03x8z8pV0WIvfYnIOcxERxYxSPw=";
+  vendorHash = "sha256-OnCtobizqDrqZTQenRPBTlUHvNx/xX34PYw8K4rgxSk=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/mp/mpd/package.nix b/pkgs/by-name/mp/mpd/package.nix
index 661f95ed122b..0620c6e60c71 100644
--- a/pkgs/by-name/mp/mpd/package.nix
+++ b/pkgs/by-name/mp/mpd/package.nix
@@ -232,8 +232,8 @@ stdenv.mkDerivation (finalAttrs: {
       (stdenv.hostPlatform.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinSdkVersion "12.0")
       ''
         substituteInPlace src/output/plugins/OSXOutputPlugin.cxx \
-          --replace kAudioObjectPropertyElement{Main,Master} \
-          --replace kAudioHardwareServiceDeviceProperty_Virtual{Main,Master}Volume
+          --replace-fail kAudioObjectPropertyElement{Main,Master} \
+          --replace-fail kAudioHardwareServiceDeviceProperty_Virtual{Main,Master}Volume
       ''
     +
       lib.optionalString
@@ -262,17 +262,19 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   mesonFlags = [
-    "-Dtest=true"
-    "-Dmanpages=true"
-    "-Dhtml_manual=true"
+    (lib.mesonBool "test" true)
+    (lib.mesonBool "manpages" true)
+    (lib.mesonBool "html_manual" true)
   ]
-  ++ map (x: "-D${x}=enabled") features_
-  ++ map (x: "-D${x}=disabled") (lib.subtractLists features_ knownFeatures)
+  ++ map (x: lib.mesonEnable x true) features_
+  ++ map (x: lib.mesonEnable x false) (lib.subtractLists features_ knownFeatures)
   ++ lib.optional (builtins.elem "zeroconf" features_) (
-    "-Dzeroconf=" + (if stdenv.hostPlatform.isDarwin then "bonjour" else "avahi")
+    lib.mesonOption "zeroconf" (if stdenv.hostPlatform.isDarwin then "bonjour" else "avahi")
   )
-  ++ lib.optional (builtins.elem "systemd" features_) "-Dsystemd_system_unit_dir=etc/systemd/system"
-  ++ lib.optional (builtins.elem "qobuz" features_) "-Dnlohmann_json=enabled";
+  ++ lib.optional (builtins.elem "systemd" features_) (
+    lib.mesonOption "systemd_system_unit_dir" "etc/systemd/system"
+  )
+  ++ lib.optional (builtins.elem "qobuz" features_) (lib.mesonEnable "nlohmann_json" true);
 
   passthru.tests.nixos = nixosTests.mpd;
 
@@ -282,6 +284,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [
       tobim
+      doronbehar
     ];
     platforms = lib.platforms.unix;
     mainProgram = "mpd";
diff --git a/pkgs/by-name/ne/netatalk/package.nix b/pkgs/by-name/ne/netatalk/package.nix
index 900bfe70bef7..c6111d502cc3 100644
--- a/pkgs/by-name/ne/netatalk/package.nix
+++ b/pkgs/by-name/ne/netatalk/package.nix
@@ -5,6 +5,7 @@
   acl,
   autoreconfHook,
   avahi,
+  bstring,
   db,
   libevent,
   libgcrypt,
@@ -28,11 +29,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "netatalk";
-  version = "4.2.4";
+  version = "4.3.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/netatalk/netatalk/netatalk-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Twe74RipUd10DT9RqHtcr7oklr0LIucEQ49CGqZnD5k=";
+    hash = "sha256-KXe0/RExgvDMGDM3uiPVcB+yvk4N/Ox+5XW01zpzjTo=";
   };
 
   nativeBuildInputs = [
@@ -45,6 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     acl
     avahi
+    bstring
     db
     libevent
     libgcrypt
@@ -69,7 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dwith-bdb-include-path=${db.dev}/include"
     "-Dwith-install-hooks=false"
     "-Dwith-init-hooks=false"
-    "-Dwith-lockfile-path=/run/lock/"
+    "-Dwith-lockfile-path=/run/lock"
     "-Dwith-cracklib=true"
     "-Dwith-cracklib-path=${cracklib.out}"
     "-Dwith-statedir-creation=false"
@@ -82,6 +84,9 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://netatalk.io/";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ jcumming ];
+    maintainers = with lib.maintainers; [
+      jcumming
+      nulleric
+    ];
   };
 })
diff --git a/pkgs/by-name/ne/networkmanager/package.nix b/pkgs/by-name/ne/networkmanager/package.nix
index 16f1b80d9eb6..e814fd6ce5ee 100644
--- a/pkgs/by-name/ne/networkmanager/package.nix
+++ b/pkgs/by-name/ne/networkmanager/package.nix
@@ -64,11 +64,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "networkmanager";
-  version = "1.54.1";
+  version = "1.54.3";
 
   src = fetchurl {
     url = "https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/releases/${finalAttrs.version}/downloads/NetworkManager-${finalAttrs.version}.tar.xz";
-    hash = "sha256-APPwvhKsTUhY6/FSQwuS3vFXSAP/YQf378dkoFbUxMc=";
+    hash = "sha256-z0/vw76WgCxaTas+aQvcTOTHglGVTvChtlAm2IZwmYk=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/op/opa-envoy-plugin/package.nix b/pkgs/by-name/op/opa-envoy-plugin/package.nix
index b63bca544378..dea0fd6cfb3c 100644
--- a/pkgs/by-name/op/opa-envoy-plugin/package.nix
+++ b/pkgs/by-name/op/opa-envoy-plugin/package.nix
@@ -14,16 +14,16 @@ assert
 
 buildGoModule rec {
   pname = "opa-envoy-plugin";
-  version = "1.10.0-envoy";
+  version = "1.11.0-envoy";
 
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "opa-envoy-plugin";
     tag = "v${version}";
-    hash = "sha256-qKLeSpVy/ImeJ2WPLa3uQSHA/6Y4Visb9lgC4PkURkI=";
+    hash = "sha256-BYNwr4smlY5evtja1CdCeVzKZIY0pFjiJwwhWOFHIm0=";
   };
 
-  vendorHash = "sha256-l/0IaHz1wTNqX/Im8g0fjTqVOtMHSdqSpl0Oo1ByyxA=";
+  vendorHash = "sha256-wwXl115vhqUro5yhaMmlR8ms/uJMhFw9IzsX9mGRy+0=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/po/podman/package.nix b/pkgs/by-name/po/podman/package.nix
index 717edf5d64ad..00abf3c86245 100644
--- a/pkgs/by-name/po/podman/package.nix
+++ b/pkgs/by-name/po/podman/package.nix
@@ -5,6 +5,7 @@
   pkg-config,
   installShellFiles,
   buildGoModule,
+  buildPackages,
   gpgme,
   lvm2,
   btrfs-progs,
@@ -12,7 +13,6 @@
   libseccomp,
   libselinux,
   systemdMinimal,
-  go-md2man,
   nixosTests,
   python3,
   makeBinaryWrapper,
@@ -71,7 +71,6 @@ buildGoModule (finalAttrs: {
 
   nativeBuildInputs = [
     pkg-config
-    go-md2man
     installShellFiles
     makeBinaryWrapper
     python3
@@ -90,6 +89,7 @@ buildGoModule (finalAttrs: {
   env = {
     HELPER_BINARIES_DIR = "${placeholder "out"}/libexec/podman"; # used in buildPhase & installPhase
     PREFIX = "${placeholder "out"}";
+    GOMD2MAN = "${buildPackages.go-md2man}/bin/go-md2man";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/po/polkit/package.nix b/pkgs/by-name/po/polkit/package.nix
index f269b0ee61bb..f804931304d8 100644
--- a/pkgs/by-name/po/polkit/package.nix
+++ b/pkgs/by-name/po/polkit/package.nix
@@ -116,10 +116,10 @@ stdenv.mkDerivation rec {
     (python3.pythonOnBuildForHost.withPackages (
       pp: with pp; [
         dbus-python
-        (python-dbusmock.overridePythonAttrs (attrs: {
+        (python-dbusmock.override {
           # Avoid dependency cycle.
           doCheck = false;
-        }))
+        })
       ]
     ))
   ];
diff --git a/pkgs/by-name/po/positron-bin/package.nix b/pkgs/by-name/po/positron-bin/package.nix
index ddd532f8a4a2..060d7853b2c5 100644
--- a/pkgs/by-name/po/positron-bin/package.nix
+++ b/pkgs/by-name/po/positron-bin/package.nix
@@ -22,7 +22,7 @@
 }:
 let
   pname = "positron-bin";
-  version = "2025.12.0-167";
+  version = "2025.12.1-4";
 in
 stdenv.mkDerivation {
   inherit version pname;
@@ -31,17 +31,17 @@ stdenv.mkDerivation {
     if stdenv.hostPlatform.isDarwin then
       fetchurl {
         url = "https://cdn.posit.co/positron/releases/mac/universal/Positron-${version}-universal.dmg";
-        hash = "sha256-GrABm5PJFZ1ugb4Lj3y/Ynnt/RTkY0DMk3GZKqVAlk0=";
+        hash = "sha256-9T0ae4m60TZkGUzJscZ1HTAbaw7y0Boi8EDy7HTt5+s=";
       }
     else if stdenv.hostPlatform.system == "aarch64-linux" then
       fetchurl {
         url = "https://cdn.posit.co/positron/releases/deb/arm64/Positron-${version}-arm64.deb";
-        hash = "sha256-WP8ULCMY268av8W0Op0j6P6ry8MwTjNsjV1iJV50wTg=";
+        hash = "sha256-dH1bV1iX7ISYGcfPg8y7itoYF8y2ApHs9kcSUIDnZUw=";
       }
     else
       fetchurl {
         url = "https://cdn.posit.co/positron/releases/deb/x86_64/Positron-${version}-x64.deb";
-        hash = "sha256-3Z4mRN5WOV0wj51TzoyC0wfU1Zu6wEAb1gTH5IFQRIg=";
+        hash = "sha256-MurH+NEIejOHp3h69buyb/1MAxnOJ7KkU9mWJVTN5Xw=";
       };
 
   buildInputs = [
diff --git a/pkgs/by-name/qu/qui/package.nix b/pkgs/by-name/qu/qui/package.nix
index 90fe6b5fa63f..5da73191efe6 100644
--- a/pkgs/by-name/qu/qui/package.nix
+++ b/pkgs/by-name/qu/qui/package.nix
@@ -11,12 +11,12 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "qui";
-  version = "1.9.1";
+  version = "1.10.0";
   src = fetchFromGitHub {
     owner = "autobrr";
     repo = "qui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PcJl9nxHPWv17AqtEok0qHhrTQ1WInUKAtxrxoSeMSw=";
+    hash = "sha256-aGCEv/HX2XYhtJqWtLHKjsBIy8WYOwezxGQxfF6lu0M=";
   };
 
   qui-web = stdenvNoCC.mkDerivation (finalAttrs': {
@@ -39,7 +39,7 @@ buildGoModule (finalAttrs: {
         sourceRoot
         ;
       fetcherVersion = 2;
-      hash = "sha256-bDaMax5RS+ot6vaJmNJm6p4gFaCD9aslJXI/58ua9DI=";
+      hash = "sha256-6brOEC1UAxjIZB4pujhA624jKTTxfZQiiz/PzqooPeA=";
     };
 
     postBuild = ''
@@ -51,7 +51,7 @@ buildGoModule (finalAttrs: {
     '';
   });
 
-  vendorHash = "sha256-UF6V737MF2la24oW8oPp+0N8nv0uEykMrTbzvx/gtec=";
+  vendorHash = "sha256-EJ26MqXxdV9m5reqWAYTXwuHLMbf2l1J3667e1FEv7A=";
 
   preBuild = ''
     cp -r ${finalAttrs.qui-web}/* web/dist
diff --git a/pkgs/by-name/re/remnote/package.nix b/pkgs/by-name/re/remnote/package.nix
index b46b79bb0b2e..42c34372b33d 100644
--- a/pkgs/by-name/re/remnote/package.nix
+++ b/pkgs/by-name/re/remnote/package.nix
@@ -6,10 +6,10 @@
 }:
 let
   pname = "remnote";
-  version = "1.22.28";
+  version = "1.22.31";
   src = fetchurl {
     url = "https://download2.remnote.io/remnote-desktop2/RemNote-${version}.AppImage";
-    hash = "sha256-suYd2IK/lwPd0sEoRmKPydgyExX5aRNyBLikubBmMpI=";
+    hash = "sha256-P2kjlskK+rrLWHMebt2UcbE0mJDOEa/OnAuRQGODkSA=";
   };
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
 in
diff --git a/pkgs/by-name/re/renode-unstable/package.nix b/pkgs/by-name/re/renode-unstable/package.nix
index 6a2f03fd70d5..a9f77aa6edf2 100644
--- a/pkgs/by-name/re/renode-unstable/package.nix
+++ b/pkgs/by-name/re/renode-unstable/package.nix
@@ -2,7 +2,17 @@
   fetchFromGitHub,
   nix-update-script,
   renode,
+  lib,
 }:
+let
+  normalizedVersion =
+    v:
+    let
+      parts = lib.splitString "-" v;
+      result = builtins.head parts;
+    in
+    result;
+in
 renode.overrideAttrs (old: rec {
   pname = "renode-unstable";
   version = "1.16.0-unstable-2025-08-08";
@@ -16,9 +26,9 @@ renode.overrideAttrs (old: rec {
   };
 
   prePatch = ''
-    substituteInPlace tools/building/createAssemblyInfo.sh \
-      --replace CURRENT_INFORMATIONAL_VERSION="`git rev-parse --short=8 HEAD`" \
-      CURRENT_INFORMATIONAL_VERSION="${builtins.substring 0 8 src.rev}"
+    sed -i 's/AssemblyVersion("%VERSION%.*")/AssemblyVersion("${normalizedVersion version}.0")/g' src/Renode/Properties/AssemblyInfo.template
+    sed -i 's/AssemblyInformationalVersion("%INFORMATIONAL_VERSION%")/AssemblyInformationalVersion("${src.rev}")/g' src/Renode/Properties/AssemblyInfo.template
+    mv src/Renode/Properties/AssemblyInfo.template src/Renode/Properties/AssemblyInfo.cs
   '';
 
   passthru = old.passthru // {
diff --git a/pkgs/by-name/re/renode/deps.json b/pkgs/by-name/re/renode/deps.json
index c50fb3ed5d39..3ec3cdaf13f6 100644
--- a/pkgs/by-name/re/renode/deps.json
+++ b/pkgs/by-name/re/renode/deps.json
@@ -129,6 +129,11 @@
     "version": "4.5.0",
     "hash": "sha256-dAhj/CgXG5VIy2dop1xplUsLje7uBPFjxasz9rdFIgY="
   },
+  {
+    "pname": "Microsoft.CSharp",
+    "version": "4.6.0",
+    "hash": "sha256-16OdEKbPLxh+jLYS4cOiGRX/oU6nv3KMF4h5WnZAsHs="
+  },
   {
     "pname": "Microsoft.CSharp",
     "version": "4.7.0",
@@ -139,11 +144,6 @@
     "version": "1.0.0",
     "hash": "sha256-HX3iOXH75I1L7eNihCbMNDDpcotfZpfQUdqdRTGM6FY="
   },
-  {
-    "pname": "Microsoft.Extensions.ObjectPool",
-    "version": "5.0.10",
-    "hash": "sha256-tAjiU3w0hdPAGUitszxZ6jtEilRn977MY7N5eZMx0x0="
-  },
   {
     "pname": "Microsoft.Extensions.ObjectPool",
     "version": "6.0.16",
@@ -244,11 +244,6 @@
     "version": "4.4.0",
     "hash": "sha256-ZumsykAAIYKmVtP4QI5kZ0J10n2zcOZZ69PmAK0SEiE="
   },
-  {
-    "pname": "Microsoft.Win32.SystemEvents",
-    "version": "4.7.0",
-    "hash": "sha256-GHxnD1Plb32GJWVWSv0Y51Kgtlb+cdKgOYVBYZSgVF4="
-  },
   {
     "pname": "Microsoft.Win32.SystemEvents",
     "version": "5.0.0",
@@ -286,13 +281,13 @@
   },
   {
     "pname": "NETStandard.Library",
-    "version": "2.0.0",
-    "hash": "sha256-Pp7fRylai8JrE1O+9TGfIEJrAOmnWTJRLWE+qJBahK0="
+    "version": "1.6.1",
+    "hash": "sha256-iNan1ix7RtncGWC9AjAZ2sk70DoxOsmEOgQ10fXm4Pw="
   },
   {
     "pname": "NETStandard.Library",
-    "version": "2.0.3",
-    "hash": "sha256-Prh2RPebz/s8AzHb2sPHg3Jl8s31inv9k+Qxd293ybo="
+    "version": "2.0.0",
+    "hash": "sha256-Pp7fRylai8JrE1O+9TGfIEJrAOmnWTJRLWE+qJBahK0="
   },
   {
     "pname": "Newtonsoft.Json",
@@ -339,6 +334,11 @@
     "version": "4.3.0",
     "hash": "sha256-PaiITTFI2FfPylTEk7DwzfKeiA/g/aooSU1pDcdwWLU="
   },
+  {
+    "pname": "runtime.any.System.Globalization.Calendars",
+    "version": "4.3.0",
+    "hash": "sha256-AYh39tgXJVFu8aLi9Y/4rK8yWMaza4S4eaxjfcuEEL4="
+  },
   {
     "pname": "runtime.any.System.IO",
     "version": "4.3.0",
@@ -394,6 +394,11 @@
     "version": "4.3.0",
     "hash": "sha256-agdOM0NXupfHbKAQzQT8XgbI9B8hVEh+a/2vqeHctg4="
   },
+  {
+    "pname": "runtime.any.System.Threading.Timer",
+    "version": "4.3.0",
+    "hash": "sha256-BgHxXCIbicVZtpgMimSXixhFC3V+p5ODqeljDjO8hCs="
+  },
   {
     "pname": "runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl",
     "version": "4.3.0",
@@ -414,6 +419,21 @@
     "version": "4.3.0",
     "hash": "sha256-ZBZaodnjvLXATWpXXakFgcy6P+gjhshFXmglrL5xD5Y="
   },
+  {
+    "pname": "runtime.native.System.IO.Compression",
+    "version": "4.3.0",
+    "hash": "sha256-DWnXs4vlKoU6WxxvCArTJupV6sX3iBbZh8SbqfHace8="
+  },
+  {
+    "pname": "runtime.native.System.Net.Http",
+    "version": "4.3.0",
+    "hash": "sha256-c556PyheRwpYhweBjSfIwEyZHnAUB8jWioyKEcp/2dg="
+  },
+  {
+    "pname": "runtime.native.System.Security.Cryptography.Apple",
+    "version": "4.3.0",
+    "hash": "sha256-2IhBv0i6pTcOyr8FFIyfPEaaCHUmJZ8DYwLUwJ+5waw="
+  },
   {
     "pname": "runtime.native.System.Security.Cryptography.OpenSsl",
     "version": "4.3.0",
@@ -429,6 +449,11 @@
     "version": "4.3.0",
     "hash": "sha256-zi+b4sCFrA9QBiSGDD7xPV27r3iHGlV99gpyVUjRmc4="
   },
+  {
+    "pname": "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.Apple",
+    "version": "4.3.0",
+    "hash": "sha256-serkd4A7F6eciPiPJtUyJyxzdAtupEcWIZQ9nptEzIM="
+  },
   {
     "pname": "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.OpenSsl",
     "version": "4.3.0",
@@ -459,6 +484,11 @@
     "version": "4.3.0",
     "hash": "sha256-LZb23lRXzr26tRS5aA0xyB08JxiblPDoA7HBvn6awXg="
   },
+  {
+    "pname": "runtime.unix.System.Console",
+    "version": "4.3.0",
+    "hash": "sha256-AHkdKShTRHttqfMjmi+lPpTuCrM5vd/WRy6Kbtie190="
+  },
   {
     "pname": "runtime.unix.System.Diagnostics.Debug",
     "version": "4.3.0",
@@ -469,6 +499,16 @@
     "version": "4.3.0",
     "hash": "sha256-Pf4mRl6YDK2x2KMh0WdyNgv0VUNdSKVDLlHqozecy5I="
   },
+  {
+    "pname": "runtime.unix.System.Net.Primitives",
+    "version": "4.3.0",
+    "hash": "sha256-pHJ+I6i16MV6m77uhTC6GPY6jWGReE3SSP3fVB59ti0="
+  },
+  {
+    "pname": "runtime.unix.System.Net.Sockets",
+    "version": "4.3.0",
+    "hash": "sha256-IvgOeA2JuBjKl5yAVGjPYMPDzs9phb3KANs95H9v1w4="
+  },
   {
     "pname": "runtime.unix.System.Private.Uri",
     "version": "4.3.0",
@@ -489,20 +529,20 @@
     "version": "4.1.0",
     "hash": "sha256-v6YfyfrKmhww+EYHUq6cwYUMj00MQ6SOfJtcGVRlYzs="
   },
+  {
+    "pname": "System.AppContext",
+    "version": "4.3.0",
+    "hash": "sha256-yg95LNQOwFlA1tWxXdQkVyJqT4AnoDc+ACmrNvzGiZg="
+  },
   {
     "pname": "System.Buffers",
     "version": "4.3.0",
     "hash": "sha256-XqZWb4Kd04960h4U9seivjKseGA/YEIpdplfHYHQ9jk="
   },
-  {
-    "pname": "System.Buffers",
-    "version": "4.5.1",
-    "hash": "sha256-wws90sfi9M7kuCPWkv1CEYMJtCqx9QB/kj0ymlsNaxI="
-  },
   {
     "pname": "System.CodeDom",
-    "version": "6.0.0",
-    "hash": "sha256-uPetUFZyHfxjScu5x4agjk9pIhbCkt5rG4Axj25npcQ="
+    "version": "8.0.0",
+    "hash": "sha256-uwVhi3xcvX7eiOGQi7dRETk3Qx1EfHsUfchZsEto338="
   },
   {
     "pname": "System.Collections",
@@ -514,6 +554,11 @@
     "version": "4.3.0",
     "hash": "sha256-afY7VUtD6w/5mYqrce8kQrvDIfS2GXDINDh73IjxJKc="
   },
+  {
+    "pname": "System.Collections.Concurrent",
+    "version": "4.3.0",
+    "hash": "sha256-KMY5DfJnDeIsa13DpqvyN8NkReZEMAFnlmNglVoFIXI="
+  },
   {
     "pname": "System.Collections.Immutable",
     "version": "5.0.0",
@@ -579,6 +624,11 @@
     "version": "1.0.31",
     "hash": "sha256-w9ApcUJr7jYP4Vf5+efIIqoWmr5v9R56W4uC0n8KktQ="
   },
+  {
+    "pname": "System.Console",
+    "version": "4.3.0",
+    "hash": "sha256-Xh3PPBZr0pDbDaK8AEHbdGz7ePK6Yi1ZyRWI1JM6mbo="
+  },
   {
     "pname": "System.Diagnostics.Debug",
     "version": "4.0.11",
@@ -589,6 +639,11 @@
     "version": "4.3.0",
     "hash": "sha256-fkA79SjPbSeiEcrbbUsb70u9B7wqbsdM9s1LnoKj0gM="
   },
+  {
+    "pname": "System.Diagnostics.DiagnosticSource",
+    "version": "4.3.0",
+    "hash": "sha256-OFJRb0ygep0Z3yDBLwAgM/Tkfs4JCDtsNhwDH9cd1Xw="
+  },
   {
     "pname": "System.Diagnostics.EventLog",
     "version": "6.0.0",
@@ -619,11 +674,6 @@
     "version": "4.7.0",
     "hash": "sha256-D3qG+xAe78lZHvlco9gHK2TEAM370k09c6+SQi873Hk="
   },
-  {
-    "pname": "System.Drawing.Common",
-    "version": "5.0.0",
-    "hash": "sha256-8PgFBZ3Agd+UI9IMxr4fRIW8IA1hqCl15nqlLTJETzk="
-  },
   {
     "pname": "System.Drawing.Common",
     "version": "5.0.3",
@@ -634,11 +684,6 @@
     "version": "4.0.11",
     "hash": "sha256-qWqFVxuXioesVftv2RVJZOnmojUvRjb7cS3Oh3oTit4="
   },
-  {
-    "pname": "System.Formats.Asn1",
-    "version": "5.0.0",
-    "hash": "sha256-9nL3dN4w/dZ49W1pCkTjRqZm6Dh0mMVExNungcBHrKs="
-  },
   {
     "pname": "System.Formats.Asn1",
     "version": "6.0.0",
@@ -654,6 +699,11 @@
     "version": "4.3.0",
     "hash": "sha256-caL0pRmFSEsaoeZeWN5BTQtGrAtaQPwFi8YOZPZG5rI="
   },
+  {
+    "pname": "System.Globalization.Calendars",
+    "version": "4.3.0",
+    "hash": "sha256-uNOD0EOVFgnS2fMKvMiEtI9aOw00+Pfy/H+qucAQlPc="
+  },
   {
     "pname": "System.Globalization.Extensions",
     "version": "4.3.0",
@@ -669,6 +719,16 @@
     "version": "4.3.0",
     "hash": "sha256-ruynQHekFP5wPrDiVyhNiRIXeZ/I9NpjK5pU+HPDiRY="
   },
+  {
+    "pname": "System.IO.Compression",
+    "version": "4.3.0",
+    "hash": "sha256-f5PrQlQgj5Xj2ZnHxXW8XiOivaBvfqDao9Sb6AVinyA="
+  },
+  {
+    "pname": "System.IO.Compression.ZipFile",
+    "version": "4.3.0",
+    "hash": "sha256-WQl+JgWs+GaRMeiahTFUbrhlXIHapzcpTFXbRvAtvvs="
+  },
   {
     "pname": "System.IO.FileSystem",
     "version": "4.0.1",
@@ -720,9 +780,24 @@
     "hash": "sha256-3sCEfzO4gj5CYGctl9ZXQRRhwAraMQfse7yzKoRe65E="
   },
   {
-    "pname": "System.Numerics.Vectors",
-    "version": "4.4.0",
-    "hash": "sha256-auXQK2flL/JpnB/rEcAcUm4vYMCYMEMiWOCAlIaqu2U="
+    "pname": "System.Net.Http",
+    "version": "4.3.0",
+    "hash": "sha256-UoBB7WPDp2Bne/fwxKF0nE8grJ6FzTMXdT/jfsphj8Q="
+  },
+  {
+    "pname": "System.Net.NameResolution",
+    "version": "4.3.0",
+    "hash": "sha256-eGZwCBExWsnirWBHyp2sSSSXp6g7I6v53qNmwPgtJ5c="
+  },
+  {
+    "pname": "System.Net.Primitives",
+    "version": "4.3.0",
+    "hash": "sha256-MY7Z6vOtFMbEKaLW9nOSZeAjcWpwCtdO7/W1mkGZBzE="
+  },
+  {
+    "pname": "System.Net.Sockets",
+    "version": "4.3.0",
+    "hash": "sha256-il7dr5VT/QWDg/0cuh+4Es2u8LY//+qqiY9BZmYxSus="
   },
   {
     "pname": "System.Numerics.Vectors",
@@ -871,8 +946,8 @@
   },
   {
     "pname": "System.Runtime.CompilerServices.Unsafe",
-    "version": "4.5.3",
-    "hash": "sha256-lnZMUqRO4RYRUeSO8HSJ9yBHqFHLVbmenwHWkIU20ak="
+    "version": "4.5.2",
+    "hash": "sha256-8eUXXGWO2LL7uATMZye2iCpQOETn2jCcjUhG6coR5O8="
   },
   {
     "pname": "System.Runtime.CompilerServices.Unsafe",
@@ -909,11 +984,21 @@
     "version": "4.3.0",
     "hash": "sha256-8sDH+WUJfCR+7e4nfpftj/+lstEiZixWUBueR2zmHgI="
   },
+  {
+    "pname": "System.Runtime.InteropServices.RuntimeInformation",
+    "version": "4.0.0",
+    "hash": "sha256-5j53amb76A3SPiE3B0llT2XPx058+CgE7OXL4bLalT4="
+  },
   {
     "pname": "System.Runtime.InteropServices.RuntimeInformation",
     "version": "4.3.0",
     "hash": "sha256-MYpl6/ZyC6hjmzWRIe+iDoldOMW1mfbwXsduAnXIKGA="
   },
+  {
+    "pname": "System.Runtime.Numerics",
+    "version": "4.3.0",
+    "hash": "sha256-P5jHCgMbgFMYiONvzmaKFeOqcAIDPu/U8bOVrNPYKqc="
+  },
   {
     "pname": "System.Runtime.Serialization.Primitives",
     "version": "4.1.1",
@@ -929,16 +1014,26 @@
     "version": "4.7.0",
     "hash": "sha256-/9ZCPIHLdhzq7OW4UKqTsR0O93jjHd6BRG1SRwgHE1g="
   },
-  {
-    "pname": "System.Security.AccessControl",
-    "version": "5.0.0",
-    "hash": "sha256-ueSG+Yn82evxyGBnE49N4D+ngODDXgornlBtQ3Omw54="
-  },
   {
     "pname": "System.Security.AccessControl",
     "version": "6.0.0",
     "hash": "sha256-qOyWEBbNr3EjyS+etFG8/zMbuPjA+O+di717JP9Cxyg="
   },
+  {
+    "pname": "System.Security.Claims",
+    "version": "4.3.0",
+    "hash": "sha256-Fua/rDwAqq4UByRVomAxMPmDBGd5eImRqHVQIeSxbks="
+  },
+  {
+    "pname": "System.Security.Cryptography.Algorithms",
+    "version": "4.3.0",
+    "hash": "sha256-tAJvNSlczYBJ3Ed24Ae27a55tq/n4D3fubNQdwcKWA8="
+  },
+  {
+    "pname": "System.Security.Cryptography.Cng",
+    "version": "4.3.0",
+    "hash": "sha256-u17vy6wNhqok91SrVLno2M1EzLHZm6VMca85xbVChsw="
+  },
   {
     "pname": "System.Security.Cryptography.Cng",
     "version": "4.5.0",
@@ -950,35 +1045,45 @@
     "hash": "sha256-MvVSJhAojDIvrpuyFmcSVRSZPl3dRYOI9hSptbA+6QA="
   },
   {
-    "pname": "System.Security.Cryptography.Cng",
-    "version": "5.0.0",
-    "hash": "sha256-nOJP3vdmQaYA07TI373OvZX6uWshETipvi5KpL7oExo="
+    "pname": "System.Security.Cryptography.Csp",
+    "version": "4.3.0",
+    "hash": "sha256-oefdTU/Z2PWU9nlat8uiRDGq/PGZoSPRgkML11pmvPQ="
+  },
+  {
+    "pname": "System.Security.Cryptography.Encoding",
+    "version": "4.3.0",
+    "hash": "sha256-Yuge89N6M+NcblcvXMeyHZ6kZDfwBv3LPMDiF8HhJss="
+  },
+  {
+    "pname": "System.Security.Cryptography.OpenSsl",
+    "version": "4.3.0",
+    "hash": "sha256-DL+D2sc2JrQiB4oAcUggTFyD8w3aLEjJfod5JPe+Oz4="
   },
   {
     "pname": "System.Security.Cryptography.Pkcs",
     "version": "4.7.0",
     "hash": "sha256-lZMmOxtg5d7Oyoof8p6awVALUsYQstc2mBNNrQr9m9c="
   },
-  {
-    "pname": "System.Security.Cryptography.Pkcs",
-    "version": "5.0.0",
-    "hash": "sha256-kq/tvYQSa24mKSvikFK2fKUAnexSL4PO4LkPppqtYkE="
-  },
   {
     "pname": "System.Security.Cryptography.Pkcs",
     "version": "6.0.1",
     "hash": "sha256-OJ4NJ8E/8l86aR+Hsw+k/7II63Y/zPS+MgC+UfeCXHM="
   },
+  {
+    "pname": "System.Security.Cryptography.Primitives",
+    "version": "4.3.0",
+    "hash": "sha256-fnFi7B3SnVj5a+BbgXnbjnGNvWrCEU6Hp/wjsjWz318="
+  },
+  {
+    "pname": "System.Security.Cryptography.X509Certificates",
+    "version": "4.3.0",
+    "hash": "sha256-MG3V/owDh273GCUPsGGraNwaVpcydupl3EtPXj6TVG0="
+  },
   {
     "pname": "System.Security.Cryptography.Xml",
     "version": "4.7.0",
     "hash": "sha256-67k24CjNisMJUtnyWb08V/t7mBns+pxLyNhBG5YXiCE="
   },
-  {
-    "pname": "System.Security.Cryptography.Xml",
-    "version": "5.0.0",
-    "hash": "sha256-0LyU7KmpFRFZFCugAgDnp93Unw3rL4hFSqx6GNqov9o="
-  },
   {
     "pname": "System.Security.Cryptography.Xml",
     "version": "6.0.1",
@@ -995,9 +1100,14 @@
     "hash": "sha256-BGgXMLUi5rxVmmChjIhcXUxisJjvlNToXlyaIbUxw40="
   },
   {
-    "pname": "System.Security.Permissions",
-    "version": "5.0.0",
-    "hash": "sha256-BI1Js3L4R32UkKOLMTAVpXzGlQ27m+oaYHSV3J+iQfc="
+    "pname": "System.Security.Principal",
+    "version": "4.3.0",
+    "hash": "sha256-rjudVUHdo8pNJg2EVEn0XxxwNo5h2EaYo+QboPkXlYk="
+  },
+  {
+    "pname": "System.Security.Principal.Windows",
+    "version": "4.3.0",
+    "hash": "sha256-mbdLVUcEwe78p3ZnB6jYsizNEqxMaCAWI3tEQNhRQAE="
   },
   {
     "pname": "System.Security.Principal.Windows",
@@ -1009,11 +1119,6 @@
     "version": "4.7.0",
     "hash": "sha256-rWBM2U8Kq3rEdaa1MPZSYOOkbtMGgWyB8iPrpIqmpqg="
   },
-  {
-    "pname": "System.Security.Principal.Windows",
-    "version": "5.0.0",
-    "hash": "sha256-CBOQwl9veFkrKK2oU8JFFEiKIh/p+aJO+q9Tc2Q/89Y="
-  },
   {
     "pname": "System.ServiceModel.Duplex",
     "version": "4.8.1",
@@ -1119,11 +1224,6 @@
     "version": "4.3.0",
     "hash": "sha256-Z5rXfJ1EXp3G32IKZGiZ6koMjRu0n8C1NGrwpdIen4w="
   },
-  {
-    "pname": "System.Threading.Tasks.Extensions",
-    "version": "4.0.0",
-    "hash": "sha256-+YdcPkMhZhRbMZHnfsDwpNbUkr31X7pQFGxXYcAPZbE="
-  },
   {
     "pname": "System.Threading.Tasks.Extensions",
     "version": "4.3.0",
@@ -1144,6 +1244,11 @@
     "version": "4.3.0",
     "hash": "sha256-wW0QdvssRoaOfQLazTGSnwYTurE4R8FxDx70pYkL+gg="
   },
+  {
+    "pname": "System.Threading.Timer",
+    "version": "4.3.0",
+    "hash": "sha256-pmhslmhQhP32TWbBzoITLZ4BoORBqYk25OWbru04p9s="
+  },
   {
     "pname": "System.ValueTuple",
     "version": "4.5.0",
@@ -1154,11 +1259,6 @@
     "version": "4.7.0",
     "hash": "sha256-yW+GvQranReaqPw5ZFv+mSjByQ5y1pRLl05JIEf3tYU="
   },
-  {
-    "pname": "System.Windows.Extensions",
-    "version": "5.0.0",
-    "hash": "sha256-fzWnaRBCDuoq3hQsGIi0PvCEJN7yGaaJvlU6pq4052A="
-  },
   {
     "pname": "System.Xml.ReaderWriter",
     "version": "4.0.11",
@@ -1174,6 +1274,11 @@
     "version": "4.0.11",
     "hash": "sha256-KPz1kxe0RUBM+aoktJ/f9p51GudMERU8Pmwm//HdlFg="
   },
+  {
+    "pname": "System.Xml.XDocument",
+    "version": "4.3.0",
+    "hash": "sha256-rWtdcmcuElNOSzCehflyKwHkDRpiOhJJs8CeQ0l1CCI="
+  },
   {
     "pname": "System.Xml.XmlDocument",
     "version": "4.3.0",
diff --git a/pkgs/by-name/re/renode/package.nix b/pkgs/by-name/re/renode/package.nix
index 85f4a4dd846d..cad261b20253 100644
--- a/pkgs/by-name/re/renode/package.nix
+++ b/pkgs/by-name/re/renode/package.nix
@@ -2,8 +2,7 @@
   buildDotnetModule,
   cmake,
   dconf,
-  dotnet-runtime_8,
-  dotnet-sdk_6,
+  dotnetCorePackages,
   fetchFromGitHub,
   fetchpatch,
   gcc,
@@ -23,13 +22,6 @@ let
     rev = "d3d69f8f17ed164ee23e46f0c06844a69bf4c004";
     hash = "sha256-wR3heL58NOQLENwCzL4lPM4KuvT/ON7dlc/KUqrlRjg=";
   };
-  assemblyVersion =
-    s:
-    let
-      part = lib.strings.splitString "-" s;
-      result = builtins.head part;
-    in
-    result;
 
   pythonLibs =
     with python3Packages;
@@ -79,17 +71,18 @@ buildDotnetModule rec {
 
   projectFile = "Renode_NET.sln";
 
-  dotnet-runtime = dotnet-runtime_8;
-  dotnet-sdk = dotnet-sdk_6;
+  dotnet-sdk = dotnetCorePackages.sdk_9_0;
 
   nugetDeps = ./deps.json;
 
   patches = [ ./renode-test.patch ];
 
+  dotnetFlags = [ "-p:TargetFrameworks=net9.0" ];
+
   prePatch = ''
-    substituteInPlace tools/building/createAssemblyInfo.sh \
-      --replace CURRENT_INFORMATIONAL_VERSION="`git rev-parse --short=8 HEAD`" \
-      CURRENT_INFORMATIONAL_VERSION="${builtins.substring 0 8 src.rev}"
+    sed -i 's/AssemblyVersion("%VERSION%.*")/AssemblyVersion("${version}.0")/g' src/Renode/Properties/AssemblyInfo.template
+    sed -i 's/AssemblyInformationalVersion("%INFORMATIONAL_VERSION%")/AssemblyInformationalVersion("${src.rev}")/g' src/Renode/Properties/AssemblyInfo.template
+    mv src/Renode/Properties/AssemblyInfo.template src/Renode/Properties/AssemblyInfo.cs
   '';
 
   postPatch = ''
@@ -105,7 +98,6 @@ buildDotnetModule rec {
     patchShebangs build.sh tools/
 
     # Fixes determinism build error
-    sed -i 's/AssemblyVersion("%VERSION%.*")/AssemblyVersion("${assemblyVersion version}")/g' src/Renode/Properties/AssemblyInfo.template
     sed -i 's/AssemblyVersion("1.0.*")/AssemblyVersion("1.0.0.0")/g' lib/AntShell/AntShell/Properties/AssemblyInfo.cs lib/CxxDemangler/CxxDemangler/Properties/AssemblyInfo.cs
   '';
 
@@ -117,7 +109,6 @@ buildDotnetModule rec {
     cmake
     gcc
   ];
-
   runtimeDeps = [
     gtk3
     mono
@@ -169,7 +160,7 @@ buildDotnetModule rec {
     ln -s $out/lib/*.so src/Infrastructure/src/Emulator/Cores/bin/Release/lib
   '';
 
-  dotnetInstallFlags = [ "-p:TargetFramework=net6.0" ];
+  dotnetInstallFlags = [ "-p:TargetFramework=net9.0" ];
 
   postInstall = ''
     mkdir -p $out/lib/renode
diff --git a/pkgs/by-name/sa/saber/git-hashes.json b/pkgs/by-name/sa/saber/git-hashes.json
index caa97b756568..3ee14f88f491 100644
--- a/pkgs/by-name/sa/saber/git-hashes.json
+++ b/pkgs/by-name/sa/saber/git-hashes.json
@@ -1,5 +1,4 @@
 {
   "flutter_secure_storage_linux": "sha256-cFNHW7dAaX8BV7arwbn68GgkkBeiAgPfhMOAFSJWlyY=",
-  "receive_sharing_intent": "sha256-8D5ZENARPZ7FGrdIErxOoV3Ao35/XoQ2tleegI42ZUY=",
-  "yaru": "sha256-1sx2jtU6TXtzdGQn14dGZUszxqRBAEJkuEM5mDG7cR4="
+  "receive_sharing_intent": "sha256-8D5ZENARPZ7FGrdIErxOoV3Ao35/XoQ2tleegI42ZUY="
 }
diff --git a/pkgs/by-name/sa/saber/package.nix b/pkgs/by-name/sa/saber/package.nix
index 4f87c815fd7c..cb8665cc7711 100644
--- a/pkgs/by-name/sa/saber/package.nix
+++ b/pkgs/by-name/sa/saber/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  flutter335,
+  flutter338,
   fetchFromGitHub,
   gst_all_1,
   libunwind,
@@ -24,16 +24,16 @@ let
     ln -s ${zlib}/lib $out/lib
   '';
 
-  version = "0.26.10";
+  version = "1.29.1";
 
   src = fetchFromGitHub {
     owner = "saber-notes";
     repo = "saber";
     tag = "v${version}";
-    hash = "sha256-PmkhIyRbRWp+ZujP8R1/h7NpKwYsaKx4JtYIikZjVzc=";
+    hash = "sha256-+hqZQQtuNsyAIUKb0fydSnRTqc8EGVxWRtGubccsK2w=";
   };
 in
-flutter335.buildFlutterApplication {
+flutter338.buildFlutterApplication {
   pname = "saber";
   inherit version src;
 
diff --git a/pkgs/by-name/sa/saber/pubspec.lock.json b/pkgs/by-name/sa/saber/pubspec.lock.json
index 68d4c3d117c2..4589956cb45c 100644
--- a/pkgs/by-name/sa/saber/pubspec.lock.json
+++ b/pkgs/by-name/sa/saber/pubspec.lock.json
@@ -1,5 +1,15 @@
 {
   "packages": {
+    "_fe_analyzer_shared": {
+      "dependency": "transitive",
+      "description": {
+        "name": "_fe_analyzer_shared",
+        "sha256": "c209688d9f5a5f26b2fb47a188131a6fb9e876ae9e47af3737c0b4f58a93470d",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "91.0.0"
+    },
     "abstract_sync": {
       "dependency": "direct main",
       "description": {
@@ -10,6 +20,16 @@
       "source": "hosted",
       "version": "1.3.1"
     },
+    "analyzer": {
+      "dependency": "transitive",
+      "description": {
+        "name": "analyzer",
+        "sha256": "f51c8499b35f9b26820cfe914828a6a98a94efd5cc78b37bb7d03debae3a1d08",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "8.4.1"
+    },
     "animated_vector": {
       "dependency": "transitive",
       "description": {
@@ -34,11 +54,11 @@
       "dependency": "direct main",
       "description": {
         "name": "animations",
-        "sha256": "d3d6dcfb218225bbe68e87ccf6378bbb2e32a94900722c5f81611dad089911cb",
+        "sha256": "18938cefd7dcc04e1ecac0db78973761a01e4bc2d6bfae0cfa596bfeac9e96ab",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.0.11"
+      "version": "2.1.1"
     },
     "ansicolor": {
       "dependency": "transitive",
@@ -100,75 +120,15 @@
       "source": "hosted",
       "version": "2.13.0"
     },
-    "audioplayers": {
+    "background_downloader": {
       "dependency": "direct main",
       "description": {
-        "name": "audioplayers",
-        "sha256": "5441fa0ceb8807a5ad701199806510e56afde2b4913d9d17c2f19f2902cf0ae4",
+        "name": "background_downloader",
+        "sha256": "a3b340e42bc45598918944e378dc6a05877e587fcd0e1b8d2ea26339de87bdf9",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.5.1"
-    },
-    "audioplayers_android": {
-      "dependency": "transitive",
-      "description": {
-        "name": "audioplayers_android",
-        "sha256": "60a6728277228413a85755bd3ffd6fab98f6555608923813ce383b190a360605",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "5.2.1"
-    },
-    "audioplayers_darwin": {
-      "dependency": "transitive",
-      "description": {
-        "name": "audioplayers_darwin",
-        "sha256": "0811d6924904ca13f9ef90d19081e4a87f7297ddc19fc3d31f60af1aaafee333",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "6.3.0"
-    },
-    "audioplayers_linux": {
-      "dependency": "transitive",
-      "description": {
-        "name": "audioplayers_linux",
-        "sha256": "f75bce1ce864170ef5e6a2c6a61cd3339e1a17ce11e99a25bae4474ea491d001",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "4.2.1"
-    },
-    "audioplayers_platform_interface": {
-      "dependency": "transitive",
-      "description": {
-        "name": "audioplayers_platform_interface",
-        "sha256": "0e2f6a919ab56d0fec272e801abc07b26ae7f31980f912f24af4748763e5a656",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "7.1.1"
-    },
-    "audioplayers_web": {
-      "dependency": "transitive",
-      "description": {
-        "name": "audioplayers_web",
-        "sha256": "1c0f17cec68455556775f1e50ca85c40c05c714a99c5eb1d2d57cc17ba5522d7",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "5.1.1"
-    },
-    "audioplayers_windows": {
-      "dependency": "transitive",
-      "description": {
-        "name": "audioplayers_windows",
-        "sha256": "4048797865105b26d47628e6abb49231ea5de84884160229251f37dfcbe52fd7",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "4.2.1"
+      "version": "9.4.0"
     },
     "barcode": {
       "dependency": "transitive",
@@ -224,11 +184,11 @@
       "dependency": "transitive",
       "description": {
         "name": "built_value",
-        "sha256": "a30f0a0e38671e89a492c44d005b5545b830a961575bbd8336d42869ff71066d",
+        "sha256": "426cf75afdb23aa74bd4e471704de3f9393f3c7b04c1e2d9c6f1073ae0b8b139",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.12.0"
+      "version": "8.12.1"
     },
     "chalkdart": {
       "dependency": "transitive",
@@ -260,6 +220,36 @@
       "source": "hosted",
       "version": "1.4.0"
     },
+    "checked_yaml": {
+      "dependency": "transitive",
+      "description": {
+        "name": "checked_yaml",
+        "sha256": "959525d3162f249993882720d52b7e0c833978df229be20702b33d48d91de70f",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.0.4"
+    },
+    "cli_config": {
+      "dependency": "transitive",
+      "description": {
+        "name": "cli_config",
+        "sha256": "ac20a183a07002b700f0c25e61b7ee46b23c309d76ab7b7640a028f18e4d99ec",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.2.0"
+    },
+    "cli_util": {
+      "dependency": "transitive",
+      "description": {
+        "name": "cli_util",
+        "sha256": "ff6785f7e9e3c38ac98b2fb035701789de90154024a75b6cb926445e83197d1c",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.4.2"
+    },
     "clock": {
       "dependency": "transitive",
       "description": {
@@ -300,25 +290,35 @@
       "source": "hosted",
       "version": "3.1.2"
     },
+    "coverage": {
+      "dependency": "transitive",
+      "description": {
+        "name": "coverage",
+        "sha256": "5da775aa218eaf2151c721b16c01c7676fbfdd99cebba2bf64e8b807a28ff94d",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.15.0"
+    },
     "cross_file": {
       "dependency": "transitive",
       "description": {
         "name": "cross_file",
-        "sha256": "7caf6a750a0c04effbb52a676dce9a4a592e10ad35c34d6d2d0e4811160d5670",
+        "sha256": "701dcfc06da0882883a2657c445103380e53e647060ad8d9dfb710c100996608",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.3.4+2"
+      "version": "0.3.5+1"
     },
     "crypto": {
       "dependency": "direct main",
       "description": {
         "name": "crypto",
-        "sha256": "1e445881f28f22d6140f181e07737b22f1e099a5e1ff94b0af2f9e4a463f4855",
+        "sha256": "c8ea0233063ba03258fbcf2ca4d6dadfefe14f02fab57702265467a19f27fadf",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.0.6"
+      "version": "3.0.7"
     },
     "crypton": {
       "dependency": "transitive",
@@ -364,11 +364,11 @@
       "dependency": "transitive",
       "description": {
         "name": "dart_pubspec_licenses",
-        "sha256": "fafb90d50c182dd3d4f441c6aea75baff1e5311aab2f6430d3f40f6e3a1f5885",
+        "sha256": "c3dd75f25ef705d4e8ab09f07afc7a83a80f5635eea11ea2d7b2b4600588b302",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.0.12"
+      "version": "3.0.14"
     },
     "dart_quill_delta": {
       "dependency": "transitive",
@@ -534,41 +534,41 @@
       "dependency": "direct main",
       "description": {
         "name": "file_picker",
-        "sha256": "f2d9f173c2c14635cc0e9b14c143c49ef30b4934e8d1d274d6206fcb0086a06f",
+        "sha256": "7872545770c277236fd32b022767576c562ba28366204ff1a5628853cf8f2200",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "10.3.3"
+      "version": "10.3.7"
     },
     "file_selector_linux": {
       "dependency": "transitive",
       "description": {
         "name": "file_selector_linux",
-        "sha256": "54cbbd957e1156d29548c7d9b9ec0c0ebb6de0a90452198683a7d23aed617a33",
+        "sha256": "2567f398e06ac72dcf2e98a0c95df2a9edd03c2c2e0cacd4780f20cdf56263a0",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.9.3+2"
+      "version": "0.9.4"
     },
     "file_selector_platform_interface": {
       "dependency": "transitive",
       "description": {
         "name": "file_selector_platform_interface",
-        "sha256": "a3994c26f10378a039faa11de174d7b78eb8f79e4dd0af2a451410c1a5c3f66b",
+        "sha256": "35e0bd61ebcdb91a3505813b055b09b79dfdc7d0aee9c09a7ba59ae4bb13dc85",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.6.2"
+      "version": "2.7.0"
     },
     "file_selector_windows": {
       "dependency": "transitive",
       "description": {
         "name": "file_selector_windows",
-        "sha256": "320fcfb6f33caa90f0b58380489fc5ac05d99ee94b61aa96ec2bff0ba81d3c2b",
+        "sha256": "62197474ae75893a62df75939c777763d39c2bc5f73ce5b88497208bc269abfd",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.9.3+4"
+      "version": "0.9.3+5"
     },
     "fixnum": {
       "dependency": "direct main",
@@ -584,21 +584,21 @@
       "dependency": "direct main",
       "description": {
         "name": "flex_color_picker",
-        "sha256": "8f753a1a026a13ea5cc5eddbae3ceb886f2537569ab2e5208efb1e3bb5af72ff",
+        "sha256": "a0979dd61f21b634717b98eb4ceaed2bfe009fe020ce8597aaf164b9eeb57aaa",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.7.1"
+      "version": "3.8.0"
     },
     "flex_seed_scheme": {
       "dependency": "transitive",
       "description": {
         "name": "flex_seed_scheme",
-        "sha256": "b06d8b367b84cbf7ca5c5603c858fa5edae88486c4e4da79ac1044d73b6c62ec",
+        "sha256": "a3183753bbcfc3af106224bff3ab3e1844b73f58062136b7499919f49f3667e7",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.5.1"
+      "version": "4.0.1"
     },
     "flutter": {
       "dependency": "direct main",
@@ -692,21 +692,21 @@
       "dependency": "transitive",
       "description": {
         "name": "flutter_plugin_android_lifecycle",
-        "sha256": "b0694b7fb1689b0e6cc193b3f1fcac6423c4f93c74fb20b806c6b6f196db0c31",
+        "sha256": "ee8068e0e1cd16c4a82714119918efdeed33b3ba7772c54b5d094ab53f9b7fd1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.0.30"
+      "version": "2.0.33"
     },
     "flutter_quill": {
       "dependency": "direct main",
       "description": {
         "name": "flutter_quill",
-        "sha256": "8e33ef670abad16405582a37ce63ac82b7531998682e8bd8348d0f3da998b8ce",
+        "sha256": "b96bb8525afdeaaea52f5d02f525e05cc34acd176467ab6d6f35d434cf14fde2",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "11.4.2"
+      "version": "11.5.0"
     },
     "flutter_quill_delta_from_html": {
       "dependency": "transitive",
@@ -722,21 +722,21 @@
       "dependency": "direct main",
       "description": {
         "name": "flutter_secure_storage",
-        "sha256": "f7eceb0bc6f4fd0441e29d43cab9ac2a1c5ffd7ea7b64075136b718c46954874",
+        "sha256": "79d53f3393ac2b73bcba45317b6c1a29002f89c680225cdea0bd6770a1682ce0",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "10.0.0-beta.4"
+      "version": "10.0.0-beta.5"
     },
     "flutter_secure_storage_darwin": {
       "dependency": "transitive",
       "description": {
         "name": "flutter_secure_storage_darwin",
-        "sha256": "f226f2a572bed96bc6542198ebaec227150786e34311d455a7e2d3d06d951845",
+        "sha256": "81ef5abfb9cbeb78110d8043ba29f0b36cd7ffa989baa1b2d9482542b2200051",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.1.0"
+      "version": "0.1.1"
     },
     "flutter_secure_storage_linux": {
       "dependency": "direct overridden",
@@ -803,11 +803,11 @@
       "dependency": "direct main",
       "description": {
         "name": "flutter_svg",
-        "sha256": "b9c2ad5872518a27507ab432d1fb97e8813b05f0fc693f9d40fad06d073e0678",
+        "sha256": "87fbd7c534435b6c5d9d98b01e1fd527812b82e68ddd8bd35fc45ed0fa8f0a95",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.2.1"
+      "version": "2.2.3"
     },
     "flutter_test": {
       "dependency": "direct dev",
@@ -845,11 +845,21 @@
       "dependency": "direct main",
       "description": {
         "name": "font_awesome_flutter",
-        "sha256": "f50ce90dbe26d977415b9540400d6778bef00894aced6358ae578abd92b14b10",
+        "sha256": "b9011df3a1fa02993630b8fb83526368cf2206a711259830325bab2f1d2a4eb0",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "10.9.0"
+      "version": "10.12.0"
+    },
+    "frontend_server_client": {
+      "dependency": "transitive",
+      "description": {
+        "name": "frontend_server_client",
+        "sha256": "f64a0333a82f30b0cca061bc3d143813a486dc086b574bfb233b7c1372427694",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "4.0.0"
     },
     "fuchsia_remote_debug_protocol": {
       "dependency": "transitive",
@@ -881,21 +891,21 @@
       "dependency": "direct main",
       "description": {
         "name": "go_router",
-        "sha256": "c752e2d08d088bf83742cb05bf83003f3e9d276ff1519b5c92f9d5e60e5ddd23",
+        "sha256": "c92d18e1fe994cb06d48aa786c46b142a5633067e8297cff6b5a3ac742620104",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "16.2.4"
+      "version": "17.0.0"
     },
     "golden_screenshot": {
       "dependency": "direct dev",
       "description": {
         "name": "golden_screenshot",
-        "sha256": "3cc52015a1acd506d4618ab7e863248f238f1230eaee2897cbbe8d86c3bba54c",
+        "sha256": "2bf16846c42e75a9eaed2aaf0ec0b53f3ba76332ebb3396fdfe085302f68854b",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "5.0.0"
+      "version": "9.1.1"
     },
     "gsettings": {
       "dependency": "transitive",
@@ -931,11 +941,21 @@
       "dependency": "direct main",
       "description": {
         "name": "http",
-        "sha256": "bb2ce4590bc2667c96f318d68cac1b5a7987ec819351d32b1c987239a815e007",
+        "sha256": "87721a4a50b19c7f1d49001e51409bddc46303966ce89a65af4f4e6004896412",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.5.0"
+      "version": "1.6.0"
+    },
+    "http_multi_server": {
+      "dependency": "transitive",
+      "description": {
+        "name": "http_multi_server",
+        "sha256": "aa6199f908078bb1c5efb8d8638d4ae191aac11b311132c3ef48ce352fb52ef8",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.2.2"
     },
     "http_parser": {
       "dependency": "transitive",
@@ -993,6 +1013,16 @@
       "source": "hosted",
       "version": "0.20.2"
     },
+    "io": {
+      "dependency": "transitive",
+      "description": {
+        "name": "io",
+        "sha256": "dfd5a80599cf0165756e3181807ed3e77daf6dd4137caaad72d0b7931597650b",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.0.5"
+    },
     "irondash_engine_context": {
       "dependency": "transitive",
       "description": {
@@ -1147,11 +1177,11 @@
       "dependency": "direct main",
       "description": {
         "name": "material_symbols_icons",
-        "sha256": "9a7de58ffc299c8e362b4e860e36e1d198fa0981a894376fe1b6bfe52773e15b",
+        "sha256": "02555a48e1ec02b16e532dfd4ef13c4f6bf7ec7c20230e58e56641a393433dc3",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.2874.0"
+      "version": "4.2892.0"
     },
     "matrix4_transform": {
       "dependency": "transitive",
@@ -1167,11 +1197,11 @@
       "dependency": "direct main",
       "description": {
         "name": "meta",
-        "sha256": "e3641ec5d63ebf0d9b41bd43201a66e3fc79a65db5f61fc181f04cd27aab950c",
+        "sha256": "23f08335362185a5ea2ad3a4e597f1375e78bce8a040df5c600c8d3552ef2394",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.16.0"
+      "version": "1.17.0"
     },
     "mime": {
       "dependency": "transitive",
@@ -1213,6 +1243,16 @@
       "source": "hosted",
       "version": "8.1.0"
     },
+    "node_preamble": {
+      "dependency": "transitive",
+      "description": {
+        "name": "node_preamble",
+        "sha256": "6e7eac89047ab8a8d26cf16127b5ed26de65209847630400f9aefd7cd5c730db",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.0.2"
+    },
     "objective_c": {
       "dependency": "transitive",
       "description": {
@@ -1240,7 +1280,7 @@
         "relative": true
       },
       "source": "path",
-      "version": "1.2.5"
+      "version": "1.3.0"
     },
     "open_file": {
       "dependency": "direct main",
@@ -1362,6 +1402,16 @@
       "source": "hosted",
       "version": "0.1.1"
     },
+    "pana": {
+      "dependency": "transitive",
+      "description": {
+        "name": "pana",
+        "sha256": "bbad5a3e085fcc2475f08fe1240041e25d74482da80d9af00bc17cce99989e29",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.22.24"
+    },
     "path": {
       "dependency": "direct main",
       "description": {
@@ -1406,21 +1456,21 @@
       "dependency": "transitive",
       "description": {
         "name": "path_provider_android",
-        "sha256": "993381400e94d18469750e5b9dcb8206f15bc09f9da86b9e44a9b0092a0066db",
+        "sha256": "f2c65e21139ce2c3dad46922be8272bb5963516045659e71bb16e151c93b580e",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.2.18"
+      "version": "2.2.22"
     },
     "path_provider_foundation": {
       "dependency": "transitive",
       "description": {
         "name": "path_provider_foundation",
-        "sha256": "16eef174aacb07e09c351502740fa6254c165757638eba1e9116b0a781201bbd",
+        "sha256": "6d13aece7b3f5c5a9731eaf553ff9dcbc2eff41087fd2df587fd0fed9a3eb0c4",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.2"
+      "version": "2.5.1"
     },
     "path_provider_linux": {
       "dependency": "transitive",
@@ -1482,35 +1532,55 @@
       "source": "hosted",
       "version": "1.0.4"
     },
+    "pdfium_dart": {
+      "dependency": "transitive",
+      "description": {
+        "name": "pdfium_dart",
+        "sha256": "f1683b9070ddc5c9189c6ee008c285791da66328ce1b882c7162d3393f3a4a74",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.1.3"
+    },
+    "pdfium_flutter": {
+      "dependency": "transitive",
+      "description": {
+        "name": "pdfium_flutter",
+        "sha256": "8b3f79c61a5e84f0ec43efb5708b42d032e72cb024244e050896eb5a31665ea5",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.1.7"
+    },
     "pdfrx": {
       "dependency": "direct main",
       "description": {
         "name": "pdfrx",
-        "sha256": "e9663e265928dea8ef6f35fde4f9bbfbdafcb894feede38d4bf2b67394051a09",
+        "sha256": "40ab38d80af88ab58e9bab63a706a69f18f516fd0f1433f71833af236b159f42",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.1.25"
+      "version": "2.2.16"
     },
     "pdfrx_engine": {
       "dependency": "transitive",
       "description": {
         "name": "pdfrx_engine",
-        "sha256": "7327361eb4e63660996a16773b6f57120a267796431cd29d7d3b1150d51934de",
+        "sha256": "6b7810d0fdd467760bf8e0afafb67140971bf297c9f9b12add5b2033bb55064f",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.1.21"
+      "version": "0.3.5"
     },
     "perfect_freehand": {
       "dependency": "direct main",
       "description": {
         "name": "perfect_freehand",
-        "sha256": "399c16dc35a6eb1dee4d9a2c638ff0fe71ebb5e8980ab41261bf4306dafaa4af",
+        "sha256": "7a6a591832be33fe82d8ecab68562a794d39837af16e7413fe0ccebdd0c3e3c0",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.5.0"
+      "version": "2.5.1"
     },
     "permission_handler": {
       "dependency": "direct main",
@@ -1632,6 +1702,16 @@
       "source": "hosted",
       "version": "3.9.1"
     },
+    "pool": {
+      "dependency": "transitive",
+      "description": {
+        "name": "pool",
+        "sha256": "978783255c543aa3586a1b3c21f6e9d720eb315376a915872c61ef8b5c20177d",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.5.2"
+    },
     "posix": {
       "dependency": "transitive",
       "description": {
@@ -1702,6 +1782,16 @@
       "source": "hosted",
       "version": "2.2.0"
     },
+    "pubspec_parse": {
+      "dependency": "transitive",
+      "description": {
+        "name": "pubspec_parse",
+        "sha256": "0560ba233314abbed0a48a2956f7f022cce7c3e1e73df540277da7544cad4082",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.5.0"
+    },
     "qr": {
       "dependency": "transitive",
       "description": {
@@ -1833,6 +1923,16 @@
       "source": "hosted",
       "version": "2.0.0+1"
     },
+    "retry": {
+      "dependency": "transitive",
+      "description": {
+        "name": "retry",
+        "sha256": "822e118d5b3aafed083109c72d5f484c6dc66707885e07c0fbcb8b986bba7efc",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.1.2"
+    },
     "rxdart": {
       "dependency": "transitive",
       "description": {
@@ -1843,15 +1943,25 @@
       "source": "hosted",
       "version": "0.28.0"
     },
+    "safe_url_check": {
+      "dependency": "transitive",
+      "description": {
+        "name": "safe_url_check",
+        "sha256": "49a3e060a7869cbafc8f4845ca1ecbbaaa53179980a32f4fdfeab1607e90f41d",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.1.2"
+    },
     "saver_gallery": {
       "dependency": "direct main",
       "description": {
         "name": "saver_gallery",
-        "sha256": "bf59475e50b73d666630bed7a5fdb621fed92d637f64e3c61ce81653ec6a833c",
+        "sha256": "1d942bd7f4fedc162d9a751e156ebac592e4b81fc2e757af82de9077f3437003",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.0.1"
+      "version": "4.1.0"
     },
     "screen_retriever": {
       "dependency": "transitive",
@@ -1917,51 +2027,51 @@
       "dependency": "transitive",
       "description": {
         "name": "sentry",
-        "sha256": "0a3a1e6b3b3873070d4dbefc6968f0d31e698ed55b4eb8ee185b230f35733b59",
+        "sha256": "10a0bc25f5f21468e3beeae44e561825aaa02cdc6829438e73b9b64658ff88d9",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "9.7.0"
+      "version": "9.8.0"
     },
     "sentry_dart_plugin": {
       "dependency": "direct dev",
       "description": {
         "name": "sentry_dart_plugin",
-        "sha256": "8c0c9fe19368890381101f5000759b2ae203a0bf6158a25584b55d197e847f53",
+        "sha256": "4b25aa60b5cbb46bb23859ac9212c4de5b22e2b3bc3fecbcd611756ada8973b5",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.1.1"
+      "version": "3.2.0"
     },
     "sentry_flutter": {
       "dependency": "direct main",
       "description": {
         "name": "sentry_flutter",
-        "sha256": "493b4adb378dfc93fb1595acca91834bbf56194a9038c400c9306588ad6a2f88",
+        "sha256": "aafbf41c63c98a30b17bdbf3313424d5102db62b08735c44bff810f277e786a5",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "9.7.0"
+      "version": "9.8.0"
     },
     "sentry_logging": {
       "dependency": "direct main",
       "description": {
         "name": "sentry_logging",
-        "sha256": "d6a51795c5643a40928f77424dd2bd28a9a58f7c527d3f8d5e001c54ee98c51a",
+        "sha256": "1ff2f99a9e8289c06e40ec35e63370b8eece091e956529315e221c5867593d99",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "9.7.0"
+      "version": "9.8.0"
     },
     "share_plus": {
       "dependency": "direct main",
       "description": {
         "name": "share_plus",
-        "sha256": "3424e9d5c22fd7f7590254ba09465febd6f8827c8b19a44350de4ac31d92d3a6",
+        "sha256": "14c8860d4de93d3a7e53af51bff479598c4e999605290756bbbe45cf65b37840",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "12.0.0"
+      "version": "12.0.1"
     },
     "share_plus_platform_interface": {
       "dependency": "transitive",
@@ -1987,21 +2097,21 @@
       "dependency": "transitive",
       "description": {
         "name": "shared_preferences_android",
-        "sha256": "0b0f98d535319cb5cdd4f65783c2a54ee6d417a2f093dbb18be3e36e4c3d181f",
+        "sha256": "83af5c682796c0f7719c2bbf74792d113e40ae97981b8f266fa84574573556bc",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.14"
+      "version": "2.4.18"
     },
     "shared_preferences_foundation": {
       "dependency": "transitive",
       "description": {
         "name": "shared_preferences_foundation",
-        "sha256": "6a52cfcdaeac77cad8c97b539ff688ccfc458c007b4db12be584fbe5c0e49e03",
+        "sha256": "4e7eaffc2b17ba398759f1151415869a34771ba11ebbccd1b0145472a619a64f",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.5.4"
+      "version": "2.5.6"
     },
     "shared_preferences_linux": {
       "dependency": "transitive",
@@ -2043,6 +2153,46 @@
       "source": "hosted",
       "version": "2.4.1"
     },
+    "shelf": {
+      "dependency": "transitive",
+      "description": {
+        "name": "shelf",
+        "sha256": "e7dd780a7ffb623c57850b33f43309312fc863fb6aa3d276a754bb299839ef12",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.4.2"
+    },
+    "shelf_packages_handler": {
+      "dependency": "transitive",
+      "description": {
+        "name": "shelf_packages_handler",
+        "sha256": "89f967eca29607c933ba9571d838be31d67f53f6e4ee15147d5dc2934fee1b1e",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.0.2"
+    },
+    "shelf_static": {
+      "dependency": "transitive",
+      "description": {
+        "name": "shelf_static",
+        "sha256": "c87c3875f91262785dade62d135760c2c69cb217ac759485334c5857ad89f6e3",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.1.3"
+    },
+    "shelf_web_socket": {
+      "dependency": "transitive",
+      "description": {
+        "name": "shelf_web_socket",
+        "sha256": "3632775c8e90d6c9712f883e633716432a27758216dfb61bd86a8321c0580925",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.0.0"
+    },
     "simplytranslate": {
       "dependency": "direct dev",
       "description": {
@@ -2063,21 +2213,41 @@
       "dependency": "direct main",
       "description": {
         "name": "slang",
-        "sha256": "47182d10ce284e232f25a02eb74a421a11e7eb6a6fab9ab84fd8182bb0761130",
+        "sha256": "263159a93864a13a0f2486326e200cb38214a8e82a3c83a48c20ac24a8eed329",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.9.0"
+      "version": "4.11.1"
     },
     "slang_flutter": {
       "dependency": "direct main",
       "description": {
         "name": "slang_flutter",
-        "sha256": "5ecf841d6252c05ea335920ec299bb7edbb860eb793eebb4b40f68b9d148a571",
+        "sha256": "a6ebc0a855faa62053f44d333ae3b3cde24945357e88506d1d3e7fb0d3fc0c70",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.9.0"
+      "version": "4.11.0"
+    },
+    "source_map_stack_trace": {
+      "dependency": "transitive",
+      "description": {
+        "name": "source_map_stack_trace",
+        "sha256": "c0713a43e323c3302c2abe2a1cc89aa057a387101ebd280371d6a6c9fa68516b",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.1.2"
+    },
+    "source_maps": {
+      "dependency": "transitive",
+      "description": {
+        "name": "source_maps",
+        "sha256": "190222579a448b03896e0ca6eca5998fa810fda630c1d65e2f78b3f638f54812",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.10.13"
     },
     "source_span": {
       "dependency": "transitive",
@@ -2089,16 +2259,6 @@
       "source": "hosted",
       "version": "1.10.1"
     },
-    "sprintf": {
-      "dependency": "transitive",
-      "description": {
-        "name": "sprintf",
-        "sha256": "1fc9ffe69d4df602376b52949af107d8f5703b77cda567c4d7d86a0693120f23",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "7.0.0"
-    },
     "stack_trace": {
       "dependency": "transitive",
       "description": {
@@ -2219,6 +2379,16 @@
       "source": "hosted",
       "version": "4.1.0"
     },
+    "tar": {
+      "dependency": "transitive",
+      "description": {
+        "name": "tar",
+        "sha256": "b338bacfd24dae6cf527acb4242003a71fc88ce183a9002376fabbc4ebda30c9",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.0.2"
+    },
     "term_glyph": {
       "dependency": "transitive",
       "description": {
@@ -2229,15 +2399,35 @@
       "source": "hosted",
       "version": "1.2.2"
     },
+    "test": {
+      "dependency": "transitive",
+      "description": {
+        "name": "test",
+        "sha256": "75906bf273541b676716d1ca7627a17e4c4070a3a16272b7a3dc7da3b9f3f6b7",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.26.3"
+    },
     "test_api": {
       "dependency": "transitive",
       "description": {
         "name": "test_api",
-        "sha256": "522f00f556e73044315fa4585ec3270f1808a4b186c936e612cab0b565ff1e00",
+        "sha256": "ab2726c1a94d3176a45960b6234466ec367179b87dd74f1611adb1f3b5fb9d55",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.7.6"
+      "version": "0.7.7"
+    },
+    "test_core": {
+      "dependency": "transitive",
+      "description": {
+        "name": "test_core",
+        "sha256": "0cc24b5ff94b38d2ae73e1eb43cc302b77964fbf67abad1e296025b78deb53d0",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.6.12"
     },
     "timezone": {
       "dependency": "transitive",
@@ -2263,11 +2453,11 @@
       "dependency": "transitive",
       "description": {
         "name": "universal_io",
-        "sha256": "1722b2dcc462b4b2f3ee7d188dad008b6eb4c40bbd03a3de451d82c78bba9aad",
+        "sha256": "f63cbc48103236abf48e345e07a03ce5757ea86285ed313a6a032596ed9301e2",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.2.2"
+      "version": "2.3.1"
     },
     "uri": {
       "dependency": "transitive",
@@ -2293,41 +2483,41 @@
       "dependency": "transitive",
       "description": {
         "name": "url_launcher_android",
-        "sha256": "c0fb544b9ac7efa10254efaf00a951615c362d1ea1877472f8f6c0fa00fcf15b",
+        "sha256": "767344bf3063897b5cf0db830e94f904528e6dd50a6dfaf839f0abf509009611",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.3.23"
+      "version": "6.3.28"
     },
     "url_launcher_ios": {
       "dependency": "transitive",
       "description": {
         "name": "url_launcher_ios",
-        "sha256": "d80b3f567a617cb923546034cc94bfe44eb15f989fe670b37f26abdb9d939cb7",
+        "sha256": "cfde38aa257dae62ffe79c87fab20165dfdf6988c1d31b58ebf59b9106062aad",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.3.4"
+      "version": "6.3.6"
     },
     "url_launcher_linux": {
       "dependency": "transitive",
       "description": {
         "name": "url_launcher_linux",
-        "sha256": "4e9ba368772369e3e08f231d2301b4ef72b9ff87c31192ef471b380ef29a4935",
+        "sha256": "d5e14138b3bc193a0f63c10a53c94b91d399df0512b1f29b94a043db7482384a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.2.1"
+      "version": "3.2.2"
     },
     "url_launcher_macos": {
       "dependency": "transitive",
       "description": {
         "name": "url_launcher_macos",
-        "sha256": "c043a77d6600ac9c38300567f33ef12b0ef4f4783a2c1f00231d2b1941fea13f",
+        "sha256": "368adf46f71ad3c21b8f06614adb38346f193f3a59ba8fe9a2fd74133070ba18",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.2.3"
+      "version": "3.2.5"
     },
     "url_launcher_platform_interface": {
       "dependency": "transitive",
@@ -2353,21 +2543,21 @@
       "dependency": "transitive",
       "description": {
         "name": "url_launcher_windows",
-        "sha256": "3284b6d2ac454cf34f114e1d3319866fdd1e19cdc329999057e44ffe936cfa77",
+        "sha256": "712c70ab1b99744ff066053cbe3e80c73332b38d46e5e945c98689b2e66fc15f",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.1.4"
+      "version": "3.1.5"
     },
     "uuid": {
       "dependency": "transitive",
       "description": {
         "name": "uuid",
-        "sha256": "a5be9ef6618a7ac1e964353ef476418026db906c4facdedaa299b7a2e71690ff",
+        "sha256": "a11b666489b1954e01d992f3d601b1804a33937b5a8fe677bd26b8a9f96f96e8",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.5.1"
+      "version": "4.5.2"
     },
     "vector_graphics": {
       "dependency": "transitive",
@@ -2449,6 +2639,26 @@
       "source": "hosted",
       "version": "1.1.1"
     },
+    "web_socket": {
+      "dependency": "transitive",
+      "description": {
+        "name": "web_socket",
+        "sha256": "34d64019aa8e36bf9842ac014bb5d2f5586ca73df5e4d9bf5c936975cae6982c",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.0.1"
+    },
+    "web_socket_channel": {
+      "dependency": "transitive",
+      "description": {
+        "name": "web_socket_channel",
+        "sha256": "d645757fb0f4773d602444000a8131ff5d48c9e47adfe9772652dd1a4f2d45c8",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.0.3"
+    },
     "webdriver": {
       "dependency": "transitive",
       "description": {
@@ -2459,6 +2669,16 @@
       "source": "hosted",
       "version": "3.1.0"
     },
+    "webkit_inspection_protocol": {
+      "dependency": "transitive",
+      "description": {
+        "name": "webkit_inspection_protocol",
+        "sha256": "87d3f2333bb240704cd3f1c6b5b7acd8a10e7f0bc28c28dcf14e782014f4a572",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.2.1"
+    },
     "win32": {
       "dependency": "transitive",
       "description": {
@@ -2592,13 +2812,12 @@
     "yaru": {
       "dependency": "direct main",
       "description": {
-        "path": ".",
-        "ref": "fix/keep-text-style",
-        "resolved-ref": "87779a4a78b793ad86a5d7177f223664e1ae0152",
-        "url": "https://github.com/adil192/yaru.dart.git"
+        "name": "yaru",
+        "sha256": "704e10633b173d8f5308677d0879d31339204c5ae063aa904e46d8182e1cf191",
+        "url": "https://pub.dev"
       },
-      "source": "git",
-      "version": "8.3.0"
+      "source": "hosted",
+      "version": "9.0.0"
     },
     "yaru_window": {
       "dependency": "transitive",
@@ -2652,7 +2871,7 @@
     }
   },
   "sdks": {
-    "dart": ">=3.9.0 <4.0.0",
-    "flutter": ">=3.35.0"
+    "dart": ">=3.10.0 <4.0.0",
+    "flutter": ">=3.38.2"
   }
 }
diff --git a/pkgs/by-name/sn/snakemake/package.nix b/pkgs/by-name/sn/snakemake/package.nix
index e7baebcdbf09..b2d5d06bed1a 100644
--- a/pkgs/by-name/sn/snakemake/package.nix
+++ b/pkgs/by-name/sn/snakemake/package.nix
@@ -10,14 +10,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "snakemake";
-  version = "9.14.1";
+  version = "9.14.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "snakemake";
     repo = "snakemake";
     tag = "v${version}";
-    hash = "sha256-yRnoo6vaq2Gw+/WJ3Jjk4AMnj0OPylgPI2lezCzK/B4=";
+    hash = "sha256-r8Fz0ZOGZbkQ5x5oarxkxzGMYSuh15N4RYlZZxPwPA0=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/so/solanum/package.nix b/pkgs/by-name/so/solanum/package.nix
index b7b49f128975..e7fe6017165a 100644
--- a/pkgs/by-name/so/solanum/package.nix
+++ b/pkgs/by-name/so/solanum/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation {
   pname = "solanum";
-  version = "0-unstable-2025-10-23";
+  version = "0-unstable-2025-12-10";
 
   src = fetchFromGitHub {
     owner = "solanum-ircd";
     repo = "solanum";
-    rev = "4544f823127c59951c7695f0f260128ee0691a67";
-    hash = "sha256-x+i4LUImepwIz5H13W5eNYl9GzgFvNGS1OSLVtl9qmE=";
+    rev = "b58ba9b980389b064c67fa42052a66508db73b40";
+    hash = "sha256-FAT1k9ETN4TozWhXSLWQ7SpvqQ0j/G/uEL0ErYFs8B8=";
   };
 
   patches = [
diff --git a/pkgs/by-name/sp/sparkle/package.nix b/pkgs/by-name/sp/sparkle/package.nix
index 5679b347c2ef..8af81c16c516 100644
--- a/pkgs/by-name/sp/sparkle/package.nix
+++ b/pkgs/by-name/sp/sparkle/package.nix
@@ -25,7 +25,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sparkle";
-  version = "1.6.12";
+  version = "1.6.15";
 
   src =
     let
@@ -40,8 +40,8 @@ stdenv.mkDerivation (finalAttrs: {
     fetchurl {
       url = "https://github.com/xishang0128/sparkle/releases/download/${finalAttrs.version}/sparkle-linux-${finalAttrs.version}-${arch}.deb";
       hash = selectSystem {
-        x86_64-linux = "sha256-jExqA15faSvkjXMAvKMwDwsdBjijG3hOyf0j1J7jH/A=";
-        aarch64-linux = "sha256-1hZa5Dr+Fh9vc+066TNcvgH44Lgx5sebvMKSO+bh9B4=";
+        x86_64-linux = "sha256-6WGMFmsUr/17lxZd+Q2Ellgs8ftn2YRb/lwmSR7uqLE=";
+        aarch64-linux = "sha256-lo19xwSqNgTxBxZuNIV7cq2qE93xtbxnsn7K3vROmrc=";
       };
     };
 
@@ -81,7 +81,6 @@ stdenv.mkDerivation (finalAttrs: {
     runHook preInstall
 
     mkdir -p $out/bin
-    chmod 0755 opt/sparkle/resources/files/sysproxy
     cp -r opt $out/opt
     substituteInPlace usr/share/applications/sparkle.desktop \
       --replace-fail "/opt/sparkle/sparkle" "sparkle"
diff --git a/pkgs/by-name/sq/sqlpage/package.nix b/pkgs/by-name/sq/sqlpage/package.nix
index bef63a5b00e4..31c6706bb988 100644
--- a/pkgs/by-name/sq/sqlpage/package.nix
+++ b/pkgs/by-name/sq/sqlpage/package.nix
@@ -42,13 +42,13 @@ in
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sqlpage";
-  version = "0.39.0";
+  version = "0.40.0";
 
   src = fetchFromGitHub {
     owner = "lovasoa";
     repo = "SQLpage";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-M9WtpDc067G/EfRTJBoDxBrdXRMqOwVTdGgyXSdHlhE=";
+    hash = "sha256-CmsAImnySdXlPQGWNMkPYhVj0HsvCzFB2LXeqFnjWG4=";
   };
 
   postPatch = ''
@@ -71,9 +71,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     substituteInPlace sqlpage/tomselect.js \
       --replace-fail '/* !include https://cdn.jsdelivr.net/npm/tom-select@2.4.1/dist/js/tom-select.popular.min.js */' \
       "$(cat ${tomselect})"
+    substituteInPlace build.rs \
+      --replace-fail "https://cdn.jsdelivr.net/npm/@tabler/icons-sprite@3.35.0/dist/tabler-sprite.svg" "${tablerIcons}" \
+      --replace-fail "copy_url_to_opened_file(&client, sprite_url, &mut sprite_content).await;" "sprite_content = std::fs::read(sprite_url).unwrap();"
   '';
 
-  cargoHash = "sha256-lUQ1j2f/LXpqpb6VK4Bq2NI0L9KoyEdlPkENMOKkt0w=";
+  cargoHash = "sha256-CTJYFzSOLYFq7I9lJhD3JcO2PuqQjqtXnBCEk2VfLfI=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/ve/vencord/package.nix b/pkgs/by-name/ve/vencord/package.nix
index 6a5d5dd1c4c7..230f911d40f1 100644
--- a/pkgs/by-name/ve/vencord/package.nix
+++ b/pkgs/by-name/ve/vencord/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vencord";
-  version = "1.13.8";
+  version = "1.13.9";
 
   src = fetchFromGitHub {
     owner = "Vendicated";
     repo = "Vencord";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qVR5LcRWuh5KUoK0VRTpjEK3Er8VNjb71NP5G3RSDQM=";
+    hash = "sha256-AvwYAsc/dozSfIGPcsySAqOa47jg6bXvHj53eVsjYiM=";
   };
 
   patches = [ ./fix-deps.patch ];
diff --git a/pkgs/by-name/xm/xmind/package.nix b/pkgs/by-name/xm/xmind/package.nix
index fa05346abf4e..fafd6faf69af 100644
--- a/pkgs/by-name/xm/xmind/package.nix
+++ b/pkgs/by-name/xm/xmind/package.nix
@@ -25,11 +25,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xmind";
-  version = "25.07.03033-202507241842";
+  version = "26.01.03145-202510170359";
 
   src = fetchurl {
     url = "https://dl3.xmind.app/Xmind-for-Linux-amd64bit-${finalAttrs.version}.deb";
-    hash = "sha256-ZD5sFILeMgyO+jV+oArGqqDogW33JE8y49KkclEUHzE=";
+    hash = "sha256-h7qxDf219+t8oAk8IABs7MyasNd3K/PAM6a79kyaLdw=";
   };
 
   nativeBuildInputs = [
@@ -95,7 +95,7 @@ stdenv.mkDerivation (finalAttrs: {
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     mainProgram = "xmind";
     license = lib.licenses.unfree;
-    platforms = lib.platforms.linux;
+    platforms = [ "x86_64-linux" ];
     maintainers = with lib.maintainers; [ michalrus ];
   };
 })
diff --git a/pkgs/by-name/yu/yubioath-flutter/package.nix b/pkgs/by-name/yu/yubioath-flutter/package.nix
index 4cc2f0100e89..f3a4b4725e9c 100644
--- a/pkgs/by-name/yu/yubioath-flutter/package.nix
+++ b/pkgs/by-name/yu/yubioath-flutter/package.nix
@@ -1,31 +1,28 @@
 {
   lib,
   flutter335,
-  python3,
+  python3Packages,
   fetchFromGitHub,
   pcre2,
   libnotify,
   libappindicator,
-  pkg-config,
   gnome-screenshot,
-  makeWrapper,
   removeReferencesTo,
   runCommand,
-  yq,
-  yubioath-flutter,
+  yq-go,
   _experimental-update-script-combinators,
-  gitUpdater,
+  nix-update-script,
 }:
 
 flutter335.buildFlutterApplication rec {
   pname = "yubioath-flutter";
-  version = "7.3.0";
+  version = "7.3.1";
 
   src = fetchFromGitHub {
     owner = "Yubico";
     repo = "yubioath-flutter";
     tag = version;
-    hash = "sha256-1Hr8ZDHXiLiYfQg4PEpmIuIJR/USbsGCgI4YZSex2Eg=";
+    hash = "sha256-jfWLj5pN1NGfnmYQ0lYeKwlc0v7pCdvAjmmWX5GP7aM=";
   };
 
   pubspecLock = lib.importJSON ./pubspec.lock.json;
@@ -39,11 +36,7 @@ flutter335.buildFlutterApplication rec {
       --replace-fail "../build/linux/helper" "${passthru.helper}/libexec/helper"
   '';
 
-  nativeBuildInputs = [
-    makeWrapper
-    removeReferencesTo
-    pkg-config
-  ];
+  nativeBuildInputs = [ removeReferencesTo ];
 
   buildInputs = [
     pcre2
@@ -86,19 +79,24 @@ flutter335.buildFlutterApplication rec {
   '';
 
   passthru = {
-    helper = python3.pkgs.callPackage ./helper.nix { inherit src version meta; };
+    helper = python3Packages.callPackage ./helper.nix { inherit src version meta; };
     pubspecSource =
       runCommand "pubspec.lock.json"
         {
-          nativeBuildInputs = [ yq ];
-          inherit (yubioath-flutter) src;
+          inherit src;
+          nativeBuildInputs = [ yq-go ];
         }
         ''
-          cat $src/pubspec.lock | yq > $out
+          yq eval --output-format=json --prettyPrint $src/pubspec.lock > "$out"
         '';
     updateScript = _experimental-update-script-combinators.sequence [
-      (gitUpdater { })
-      (_experimental-update-script-combinators.copyAttrOutputToFile "yubioath-flutter.pubspecSource" ./pubspec.lock.json)
+      (nix-update-script { extraArgs = [ "--use-github-releases" ]; })
+      (
+        (_experimental-update-script-combinators.copyAttrOutputToFile "yubioath-flutter.pubspecSource" ./pubspec.lock.json)
+        // {
+          supportedFeatures = [ ];
+        }
+      )
     ];
   };
 
diff --git a/pkgs/desktops/gnome/extensions/extensionOverrides.nix b/pkgs/desktops/gnome/extensions/extensionOverrides.nix
index ea502378c0ef..494262b34a28 100644
--- a/pkgs/desktops/gnome/extensions/extensionOverrides.nix
+++ b/pkgs/desktops/gnome/extensions/extensionOverrides.nix
@@ -2,6 +2,7 @@
   lib,
   fetchFromGitLab,
   cpio,
+  cups,
   ddcutil,
   easyeffects,
   gjs,
@@ -184,6 +185,14 @@ lib.trivial.pipe super [
     }
   ))
 
+  (patchExtension "printers@linux-man.org" (old: {
+    patches = [
+      (replaceVars ./extensionOverridesPatches/printers_at_linux-man.org.patch {
+        inherit cups;
+      })
+    ];
+  }))
+
   (patchExtension "system-monitor@gnome-shell-extensions.gcampax.github.com" (old: {
     patches = [
       (replaceVars
diff --git a/pkgs/desktops/gnome/extensions/extensionOverridesPatches/printers_at_linux-man.org.patch b/pkgs/desktops/gnome/extensions/extensionOverridesPatches/printers_at_linux-man.org.patch
new file mode 100644
index 000000000000..ed13f99e7ef3
--- /dev/null
+++ b/pkgs/desktops/gnome/extensions/extensionOverridesPatches/printers_at_linux-man.org.patch
@@ -0,0 +1,42 @@
+diff --git a/extension.js b/extension.js
+index 91b81dc..e4a2552 100755
+--- a/extension.js
++++ b/extension.js
+@@ -122,8 +122,8 @@ const PrintersManager = GObject.registerClass(class PrintersManager extends Pane
+         this.menu.addMenuItem(printers);
+ //Add Printers
+         this.printers = [];
+-        let p_list = await exec_async(['/usr/bin/lpstat', '-a']);
+-        let p_default = await exec_async(['/usr/bin/lpstat', '-d']);
++        let p_list = await exec_async(['@cups@/bin/lpstat', '-a']);
++        let p_default = await exec_async(['@cups@/bin/lpstat', '-d']);
+         if(p_default.split(': ')[1] != undefined) p_default = p_default.split(': ')[1].trim();
+         else p_default = 'no default';
+         p_list = p_list.split('\n');
+@@ -143,7 +143,7 @@ const PrintersManager = GObject.registerClass(class PrintersManager extends Pane
+             }
+         }
+ //Jobs
+-        let p_jobs = await exec_async(['/usr/bin/lpstat', '-o']);
++        let p_jobs = await exec_async(['@cups@/bin/lpstat', '-o']);
+ //Cancel all Jobs
+         if(p_jobs.length > 0) {
+             this.menu.addMenuItem(new PopupMenu.PopupSeparatorMenuItem());
+@@ -154,7 +154,7 @@ const PrintersManager = GObject.registerClass(class PrintersManager extends Pane
+ //Add Jobs
+         p_jobs = p_jobs.split(/\n/);
+         this.jobsCount = p_jobs.length - 1
+-        let p_jobs2 = await exec_async(['/usr/bin/lpq', '-a']);
++        let p_jobs2 = await exec_async(['@cups@/bin/lpq', '-a']);
+         p_jobs2 = p_jobs2.replace(/\n/g, ' ').split(/\s+/);
+         let sendJobs = [];
+         for(var n = 0; n < p_jobs.length - 1; n++) {
+@@ -194,7 +194,7 @@ const PrintersManager = GObject.registerClass(class PrintersManager extends Pane
+         this.show();
+         if(this.show_icon == 0 || (this.show_icon == 1 && this.printersCount > 0) || (this.show_icon == 2 && this.jobsCount > 0)) {
+ 			this.show();
+-			let p_error = await exec_async(['/usr/bin/lpstat', '-l']);
++			let p_error = await exec_async(['@cups@/bin/lpstat', '-l']);
+ 			this.printError = p_error.indexOf('Unable') >= 0 || p_error.indexOf(' not ') >= 0 || p_error.indexOf(' failed') >= 0;
+ 			if(this.printWarning) this._icon.icon_name = warningIcon;
+ 			else if(this.show_error && this.printError) this._icon.icon_name = errorIcon;
diff --git a/pkgs/development/ocaml-modules/cow/default.nix b/pkgs/development/ocaml-modules/cow/default.nix
index 5fee7a517f92..5b9a624625b3 100644
--- a/pkgs/development/ocaml-modules/cow/default.nix
+++ b/pkgs/development/ocaml-modules/cow/default.nix
@@ -36,6 +36,7 @@ buildDunePackage rec {
       Markdown, to name but a few! This library provides OCaml combinators
       for these web formats.
     '';
+    homepage = "https://mirage.github.io/ocaml-cow/";
     license = lib.licenses.isc;
     maintainers = with lib.maintainers; [ sternenseemann ];
   };
diff --git a/pkgs/development/ocaml-modules/extunix/default.nix b/pkgs/development/ocaml-modules/extunix/default.nix
new file mode 100644
index 000000000000..da2bc782a2a1
--- /dev/null
+++ b/pkgs/development/ocaml-modules/extunix/default.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  buildDunePackage,
+  fetchFromGitHub,
+  dune-configurator,
+  ppxlib,
+}:
+
+buildDunePackage (finalAttrs: {
+  pname = "extunix";
+  version = "0.4.4";
+
+  src = fetchFromGitHub {
+    owner = "ygrek";
+    repo = "extunix";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-7wJDGv19etkDHRwwQ+WONtJswxNMjr2Q2Vhis4WgFek=";
+  };
+
+  postPatch = ''
+    substituteInPlace src/dune --replace-fail 'libraries unix bigarray bytes' 'libraries unix bigarray'
+  '';
+
+  buildInputs = [
+    dune-configurator
+  ];
+
+  propagatedBuildInputs = [
+    ppxlib
+  ];
+
+  # need absolute paths outside from sandbox
+  doCheck = false;
+
+  meta = {
+    description = "Collection of thin bindings to various low-level system API";
+    homepage = "https://github.com/ygrek/extunix";
+    changelog = "https://github.com/ygrek/extunix/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.lgpl21Only;
+    maintainers = with lib.maintainers; [ redianthus ];
+  };
+})
diff --git a/pkgs/development/ocaml-modules/ppx_deriving_variant_string/default.nix b/pkgs/development/ocaml-modules/ppx_deriving_variant_string/default.nix
new file mode 100644
index 000000000000..c8fe782e271c
--- /dev/null
+++ b/pkgs/development/ocaml-modules/ppx_deriving_variant_string/default.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  fetchurl,
+  buildDunePackage,
+  ppxlib,
+  ounit2,
+}:
+
+buildDunePackage (finalAttrs: {
+  pname = "ppx_deriving_variant_string";
+  version = "1.0.1";
+
+  src = fetchurl {
+    url = "https://github.com/ahrefs/ppx_deriving_variant_string/releases/download/${finalAttrs.version}/ppx_deriving_variant_string-${finalAttrs.version}.tbz";
+    hash = "sha256-nSU9LEwPOOQuCpNAVQgBGucHuk5wjJ3dDIj708djLwc=";
+  };
+
+  propagatedBuildInputs = [
+    ppxlib
+  ];
+
+  doCheck = true;
+  checkInputs = [
+    ounit2
+  ];
+
+  meta = {
+    homepage = "https://github.com/ahrefs/ppx_deriving_variant_string";
+    description = "OCaml PPX deriver that generates converters between regular or polymorphic variants and strings.";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.marijanp ];
+    changelog = "https://raw.githubusercontent.com/ahrefs/ppx_deriving_variant_string/${finalAttrs.version}/CHANGES.md";
+  };
+})
diff --git a/pkgs/development/python-modules/aistudio-sdk/default.nix b/pkgs/development/python-modules/aistudio-sdk/default.nix
new file mode 100644
index 000000000000..5d55607efa26
--- /dev/null
+++ b/pkgs/development/python-modules/aistudio-sdk/default.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  bce-python-sdk,
+  click,
+  prettytable,
+  psutil,
+  requests,
+  tqdm,
+}:
+
+let
+  version = "0.3.8";
+
+  format = "wheel";
+in
+buildPythonPackage {
+  pname = "aistudio-sdk";
+  inherit version format;
+
+  # No source code dist available
+  src = fetchPypi {
+    pname = "aistudio_sdk";
+    inherit version format;
+    dist = "py3";
+    python = "py3";
+    hash = "sha256-v8lq9yQ6wu4zAwFISapAKHF8zlr6Yir4z+Oh1E0ZQdY=";
+  };
+
+  dependencies = [
+    bce-python-sdk
+    click
+    prettytable
+    psutil
+    requests
+    tqdm
+  ];
+
+  pythonImportsCheck = [ "aistudio_sdk" ];
+
+  meta = {
+    description = "Python client library for the AIStudio API";
+    homepage = "https://pypi.org/project/aistudio-sdk";
+    license = lib.licenses.unfree;
+    mainProgram = "aistudio";
+    maintainers = with lib.maintainers; [ kyehn ];
+    sourceProvenance = with lib.sourceTypes; [ fromSource ];
+  };
+}
diff --git a/pkgs/development/python-modules/approvaltests/default.nix b/pkgs/development/python-modules/approvaltests/default.nix
index 7d737d062646..dfd246335670 100644
--- a/pkgs/development/python-modules/approvaltests/default.nix
+++ b/pkgs/development/python-modules/approvaltests/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "approvaltests";
-  version = "16.1.0";
+  version = "16.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "approvals";
     repo = "ApprovalTests.Python";
     tag = "v${version}";
-    hash = "sha256-9zBpq4/jAH441eeMMV2WS767Rz+1qCX/QIfbToUHnAQ=";
+    hash = "sha256-SAevC6yIDndtNRakyzsRNw4vM2wLc/Qbs3ZlmXEa+40=";
   };
 
   postPatch = ''
@@ -36,8 +36,6 @@ buildPythonPackage rec {
     substituteInPlace setup.py \
       --replace-fail "from setup_utils" "from setup.setup_utils"
 
-    echo 'version_number = "${version}"' > version.py
-
     patchShebangs internal_documentation/scripts
   '';
 
diff --git a/pkgs/development/python-modules/bce-python-sdk/default.nix b/pkgs/development/python-modules/bce-python-sdk/default.nix
new file mode 100644
index 000000000000..f98f4c5cb2d8
--- /dev/null
+++ b/pkgs/development/python-modules/bce-python-sdk/default.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildPythonPackage,
+  pythonAtLeast,
+  fetchPypi,
+  setuptools,
+  future,
+  pycryptodome,
+  six,
+}:
+
+let
+  version = "0.9.46";
+in
+buildPythonPackage {
+  pname = "bce-python-sdk";
+  inherit version;
+  pyproject = true;
+
+  disabled = pythonAtLeast "3.13";
+
+  src = fetchPypi {
+    pname = "bce_python_sdk";
+    inherit version;
+    hash = "sha256-S/AbIubRcszZSqIB+LxvKpjQ2keEFg53z6z8xxwmhr4=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    future
+    pycryptodome
+    six
+  ];
+
+  pythonImportsCheck = [ "baidubce" ];
+
+  meta = {
+    description = "Baidu Cloud Engine SDK for python";
+    homepage = "https://github.com/baidubce/bce-sdk-python";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ kyehn ];
+  };
+}
diff --git a/pkgs/development/python-modules/countryinfo/default.nix b/pkgs/development/python-modules/countryinfo/default.nix
new file mode 100644
index 000000000000..0db9aead3932
--- /dev/null
+++ b/pkgs/development/python-modules/countryinfo/default.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  poetry-core,
+  pydantic,
+  typer,
+  pytestCheckHook,
+}:
+buildPythonPackage rec {
+  pname = "countryinfo";
+  version = "1.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "porimol";
+    repo = "countryinfo";
+    tag = "v${version}";
+    hash = "sha256-Y4nJnjXg8raJx2f00DFMktdcWoLO09wqTFK6Fc8RKSI=";
+  };
+
+  build-system = [ poetry-core ];
+
+  patches = [ ./fix-pyproject-file.patch ];
+
+  dependencies = [
+    pydantic
+    typer
+  ];
+
+  pythonRelaxDeps = [ "typer" ];
+
+  pythonImportsCheck = [ "countryinfo" ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  meta = {
+    homepage = "https://github.com/porimol/countryinfo";
+    description = "Data about countries, ISO info and states/provinces within them";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      cizniarova
+    ];
+  };
+}
diff --git a/pkgs/development/python-modules/countryinfo/fix-pyproject-file.patch b/pkgs/development/python-modules/countryinfo/fix-pyproject-file.patch
new file mode 100644
index 000000000000..a07a02b15d26
--- /dev/null
+++ b/pkgs/development/python-modules/countryinfo/fix-pyproject-file.patch
@@ -0,0 +1,11 @@
+diff --git a/pyproject.toml b/pyproject.toml
+index f31c9e3..31fa9c8 100644
+--- a/pyproject.toml
++++ b/pyproject.toml
+@@ -1,3 +1,6 @@
++[project]
++name = "countryinfo"
++
+ [tool.poetry]
+ name = "countryinfo"
+ version = "1.0.0"
diff --git a/pkgs/development/python-modules/meshcore/default.nix b/pkgs/development/python-modules/meshcore/default.nix
index 0fb38fbcb28f..03b67619309f 100644
--- a/pkgs/development/python-modules/meshcore/default.nix
+++ b/pkgs/development/python-modules/meshcore/default.nix
@@ -14,12 +14,12 @@
 
 buildPythonPackage rec {
   pname = "meshcore";
-  version = "2.2.2";
+  version = "2.2.3";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-vn/vF4avMDwDLL0EMVrrMWkZrZ1GTiUxGyTBOtKvG1I=";
+    sha256 = "sha256-lmMflAlrNnfsc10J3CBxor9ftHK10bWyGTbjASJv82s=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/modelscope/default.nix b/pkgs/development/python-modules/modelscope/default.nix
new file mode 100644
index 000000000000..cfbd2791d11b
--- /dev/null
+++ b/pkgs/development/python-modules/modelscope/default.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  filelock,
+  requests,
+  tqdm,
+}:
+
+let
+  version = "1.31.0";
+in
+buildPythonPackage {
+  pname = "modelscope";
+  inherit version;
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "modelscope";
+    repo = "modelscope";
+    tag = "v${version}";
+    hash = "sha256-3o3iI4LGDSsF36jnrUTN3bBaM8XGCw+msIPS3WauMNQ=";
+  };
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail "exec(compile(f.read(), version_file, 'exec'))" "ns = {}; exec(compile(f.read(), version_file, 'exec'), ns)" \
+      --replace-fail "return locals()['__version__']" "return ns['__version__']"
+  '';
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    filelock
+    requests
+    setuptools
+    tqdm
+  ];
+
+  doCheck = false; # need network
+
+  pythonImportsCheck = [ "modelscope" ];
+
+  meta = {
+    description = "Bring the notion of Model-as-a-Service to life";
+    homepage = "https://github.com/modelscope/modelscope";
+    license = lib.licenses.asl20;
+    mainProgram = "modelscope";
+    maintainers = with lib.maintainers; [ kyehn ];
+  };
+}
diff --git a/pkgs/development/python-modules/nitrokey/default.nix b/pkgs/development/python-modules/nitrokey/default.nix
index b3176af8ad5b..1b09ee0f9a31 100644
--- a/pkgs/development/python-modules/nitrokey/default.nix
+++ b/pkgs/development/python-modules/nitrokey/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   buildPythonPackage,
-  pythonOlder,
   fetchPypi,
   poetry-core,
   cryptography,
@@ -25,7 +24,10 @@ buildPythonPackage rec {
     hash = "sha256-ZyB5gNZc5HxohZypc/198PPBxqG9URscQfXYAWzs7n8=";
   };
 
-  pythonRelaxDeps = [ "protobuf" ];
+  pythonRelaxDeps = [
+    "protobuf"
+    "hidapi"
+  ];
 
   build-system = [ poetry-core ];
 
diff --git a/pkgs/development/python-modules/paddlepaddle/binary-hashes.nix b/pkgs/development/python-modules/paddlepaddle/binary-hashes.nix
deleted file mode 100644
index 2b205f662d5b..000000000000
--- a/pkgs/development/python-modules/paddlepaddle/binary-hashes.nix
+++ /dev/null
@@ -1,34 +0,0 @@
-{
-  x86_64-linux = {
-    platform = "manylinux1_x86_64";
-    cpu = {
-      cp312 = "sha256-gafFsQFQsHUh0c0Ukdyh+3b/YhsU2xDomdlZ86d5Neo=";
-      cp313 = "sha256-j8SGXv02Vu6ZQkEkeSy4imQhUbTVkafW1KXGr9rpWVk=";
-    };
-    gpu = {
-      cp311 = "sha256-KWlGhjg9k1+wlm3Tk/mvMqh9LWZ0yGA1g99bCPlFf0U=";
-      cp312 = "sha256-KJ2drJWLuwdaYsCj7egh1nQV4j35vT+UgH0qTdxoyHk=";
-    };
-  };
-  aarch64-linux = {
-    platform = "manylinux2014_aarch64";
-    cpu = {
-      cp312 = "sha256-3aqZaosKANvkJp2iHWUFKHfsNpOiLswHucraPs0RaIY=";
-      cp313 = "sha256-u8TVc7NdJKJi4C1yaW6A9bSu5B9phnGvlXTe6xqD5vc=";
-    };
-  };
-  x86_64-darwin = {
-    platform = "macosx_10_9_x86_64";
-    cpu = {
-      cp312 = "sha256-3P6/sQ3rFaoz0qLWbVoS2d5lRh2KQNJofi+zIhFQ0Lo=";
-      cp313 = "sha256-UsQB/+Sq5WMWZgozAVpv11XNoj09cKKLE7c9cMvbuMs=";
-    };
-  };
-  aarch64-darwin = {
-    platform = "macosx_11_0_arm64";
-    cpu = {
-      cp312 = "sha256-hnfo1C/2b3T7yjL/Mti2S749Vu0pqS1D3EGPDxaPy2k=";
-      cp313 = "sha256-nRBR8uII2h1Dna7nyGG8tQJA8JcSSW62Hpzoxhj68vk=";
-    };
-  };
-}
diff --git a/pkgs/development/python-modules/paddlepaddle/default.nix b/pkgs/development/python-modules/paddlepaddle/default.nix
index a4f5d7b09515..05342e2fb68e 100644
--- a/pkgs/development/python-modules/paddlepaddle/default.nix
+++ b/pkgs/development/python-modules/paddlepaddle/default.nix
@@ -3,10 +3,13 @@
   lib,
   stdenv,
   buildPythonPackage,
+  fetchurl,
   fetchPypi,
   python,
   pythonOlder,
   pythonAtLeast,
+  autoPatchelfHook,
+  bash,
   zlib,
   setuptools,
   cudaSupport ? config.cudaSupport or false,
@@ -25,27 +28,34 @@
 
 let
   pname = "paddlepaddle" + lib.optionalString cudaSupport "-gpu";
-  version = if cudaSupport then "2.6.2" else "3.0.0";
+  sources = import ./sources.nix;
+  version = sources.version;
   format = "wheel";
   pyShortVersion = "cp${builtins.replaceStrings [ "." ] [ "" ] python.pythonVersion}";
   cpuOrGpu = if cudaSupport then "gpu" else "cpu";
-  allHashAndPlatform = import ./binary-hashes.nix;
   hash =
-    allHashAndPlatform."${stdenv.hostPlatform.system}"."${cpuOrGpu}"."${pyShortVersion}"
-      or (throw "${pname} has no binary-hashes.nix entry for '${stdenv.hostPlatform.system}.${cpuOrGpu}.${pyShortVersion}' attribute");
-  platform = allHashAndPlatform."${stdenv.hostPlatform.system}".platform;
-  src = fetchPypi {
-    inherit
-      version
-      format
-      hash
-      platform
-      ;
-    pname = builtins.replaceStrings [ "-" ] [ "_" ] pname;
-    dist = pyShortVersion;
-    python = pyShortVersion;
-    abi = pyShortVersion;
-  };
+    sources."${stdenv.hostPlatform.system}"."${cpuOrGpu}"."${pyShortVersion}"
+      or (throw "${pname} has no sources.nix entry for '${stdenv.hostPlatform.system}.${cpuOrGpu}.${pyShortVersion}' attribute");
+  platform = sources."${stdenv.hostPlatform.system}".platform;
+  src =
+    if cudaSupport then
+      (fetchurl {
+        url = "https://paddle-whl.bj.bcebos.com/stable/cu128/paddlepaddle-gpu/paddlepaddle-${version}-${pyShortVersion}-${pyShortVersion}-linux_x86_64.whl";
+        inherit hash;
+      })
+    else
+      (fetchPypi {
+        inherit
+          version
+          format
+          hash
+          platform
+          ;
+        pname = "paddlepaddle";
+        dist = pyShortVersion;
+        python = pyShortVersion;
+        abi = pyShortVersion;
+      });
 in
 buildPythonPackage {
   inherit
@@ -55,13 +65,12 @@ buildPythonPackage {
     src
     ;
 
-  disabled =
-    if cudaSupport then
-      (pythonOlder "3.11" || pythonAtLeast "3.13")
-    else
-      (pythonOlder "3.12" || pythonAtLeast "3.14");
+  disabled = pythonOlder "3.12" || pythonAtLeast "3.14";
 
-  nativeBuildInputs = [ addDriverRunpath ];
+  nativeBuildInputs = [
+    addDriverRunpath
+  ]
+  ++ lib.optionals cudaSupport [ autoPatchelfHook ];
 
   dependencies = [
     setuptools
@@ -75,40 +84,48 @@ buildPythonPackage {
     typing-extensions
   ];
 
-  pythonImportsCheck = [ "paddle" ];
+  # Segmentation fault in darwin sandbox
+  pythonImportsCheck = lib.optionals stdenv.hostPlatform.isLinux [ "paddle" ];
 
   # no tests
   doCheck = false;
 
-  postFixup = lib.optionalString stdenv.hostPlatform.isLinux (
-    let
-      libraryPath = lib.makeLibraryPath (
-        [
-          zlib
-          (lib.getLib stdenv.cc.cc)
-        ]
-        ++ lib.optionals cudaSupport (
-          with cudaPackages;
+  postFixup =
+    lib.optionalString stdenv.hostPlatform.isLinux (
+      let
+        libraryPath = lib.makeLibraryPath (
           [
-            cudatoolkit.lib
-            cudatoolkit.out
-            cudnn
+            zlib
+            (lib.getLib stdenv.cc.cc)
           ]
-        )
-      );
-    in
-    ''
-      function fixRunPath {
-        p=$(patchelf --print-rpath $1)
-        patchelf --set-rpath "$p:${libraryPath}" $1
-        ${lib.optionalString cudaSupport ''
-          addDriverRunpath $1
-        ''}
-      }
-      fixRunPath $out/${python.sitePackages}/paddle/base/libpaddle.so
-      fixRunPath $out/${python.sitePackages}/paddle/libs/lib*.so
-    ''
-  );
+          ++ lib.optionals cudaSupport (
+            with cudaPackages;
+            [
+              cudatoolkit.lib
+              cudatoolkit.out
+              cudnn
+            ]
+          )
+        );
+      in
+      ''
+        function fixRunPath {
+          patchelf --add-rpath ${libraryPath} $1
+          ${lib.optionalString cudaSupport ''
+            addDriverRunpath $1
+          ''}
+        }
+        fixRunPath $out/${python.sitePackages}/paddle/base/libpaddle.so
+        fixRunPath $out/${python.sitePackages}/paddle/libs/lib*.so
+      ''
+    )
+    + ''
+      substituteInPlace $out/bin/paddle \
+        --replace-fail "/bin/bash" "${lib.getExe bash}" \
+        --replace-fail "python -"  "${lib.getExe (python.withPackages (ps: with ps; [ distutils ]))} -"
+      sed -i '/# Check python lib installed or not./,/^fi$/d' $out/bin/paddle
+      sed -i 's/^INSTALLED_VERSION=.*/INSTALLED_VERSION="${version}"/' $out/bin/paddle
+    '';
 
   meta = {
     description = "Machine Learning Framework from Industrial Practice";
@@ -120,7 +137,6 @@ buildPythonPackage {
     ]
     ++ lib.optionals (!cudaSupport) [
       "aarch64-linux"
-      "x86_64-darwin"
       "aarch64-darwin"
     ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
diff --git a/pkgs/development/python-modules/paddlepaddle/sources.nix b/pkgs/development/python-modules/paddlepaddle/sources.nix
new file mode 100644
index 000000000000..1f2588fd3aaa
--- /dev/null
+++ b/pkgs/development/python-modules/paddlepaddle/sources.nix
@@ -0,0 +1,28 @@
+{
+  version = "3.2.0";
+  x86_64-linux = {
+    platform = "manylinux1_x86_64";
+    cpu = {
+      cp312 = "sha256-LBf2daJevQZ19wP3uCd36pLbDDYL1Vpcay36rXvD8mA=";
+      cp313 = "sha256-+irs0GFCQ1D2dwqD3aB5aR9yJGNc/ydurvTj4XRAA50=";
+    };
+    gpu = {
+      cp312 = "sha256-YqxAWSvjhYOQUCiUPtjC3PdRxFeWGm/be8FxOrpaLZo=";
+      cp313 = "sha256-TdFx5Ut3iOTRg8USL2eIHyRYv8QT4KrLBPdiPkaK+Nc=";
+    };
+  };
+  aarch64-linux = {
+    platform = "manylinux2014_aarch64";
+    cpu = {
+      cp312 = "sha256-TOUUEUr3Zxh1/Ekn6gBa+51dD9d3rrVqEHjSL39Os/s=";
+      cp313 = "sha256-KqDlAvbdKE7aIcKH0yZFTfomrMqIwjqgrFgdHvmDGMU=";
+    };
+  };
+  aarch64-darwin = {
+    platform = "macosx_11_0_arm64";
+    cpu = {
+      cp312 = "sha256-rDNK9y0bDUnUyTPP1OtC1z7C3HpqryJIxihkPUGbbac=";
+      cp313 = "sha256-OBhOHqf9e/A4g+ph9FYZuXEtksE60foWk06p4NbT6ZE=";
+    };
+  };
+}
diff --git a/pkgs/development/python-modules/paddlepaddle/update.sh b/pkgs/development/python-modules/paddlepaddle/update.sh
new file mode 100755
index 000000000000..ecf3bcce0f97
--- /dev/null
+++ b/pkgs/development/python-modules/paddlepaddle/update.sh
@@ -0,0 +1,21 @@
+#! /usr/bin/env nix-shell
+#!nix-shell -i bash -p bash nix-update common-updater-scripts jq
+
+set -eou pipefail
+
+nix-update --system=x86_64-linux --url=https://github.com/PaddlePaddle/Paddle --override-filename=pkgs/development/python-modules/paddlepaddle/sources.nix --use-github-releases python313Packages.paddlepaddle || true
+
+latestVersion=$(nix eval --raw --file . python313Packages.paddlepaddle.version)
+
+systems=$(nix eval --json -f . python313Packages.paddlepaddle.meta.platforms | jq --raw-output '.[]')
+for system in $systems; do
+    for pythonPackages in "python313Packages" "python312Packages"; do
+        hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 $(nix-prefetch-url $(nix eval --raw --file . $pythonPackages.paddlepaddle.src.url --system "$system")))
+        update-source-version $pythonPackages.paddlepaddle $latestVersion $hash --file=pkgs/development/python-modules/paddlepaddle/sources.nix --system=$system --ignore-same-version --ignore-same-hash
+    done
+done
+
+for pythonPackages in "python313Packages" "python312Packages"; do
+    hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 $(nix-prefetch-url $(nix eval --raw --file . pkgsCuda.$pythonPackages.paddlepaddle.src.url --system x86_64-linux)))
+    update-source-version pkgsCuda.$pythonPackages.paddlepaddle $latestVersion $hash --file=pkgs/development/python-modules/paddlepaddle/sources.nix --system=x86_64-linux --ignore-same-version --ignore-same-hash
+done
diff --git a/pkgs/development/python-modules/paddlex/default.nix b/pkgs/development/python-modules/paddlex/default.nix
index 73809b2385f3..d0c2497c13b5 100644
--- a/pkgs/development/python-modules/paddlex/default.nix
+++ b/pkgs/development/python-modules/paddlex/default.nix
@@ -19,6 +19,8 @@
   ujson,
   distutils,
   huggingface-hub,
+  modelscope,
+  aistudio-sdk,
   nix-update-script,
 }:
 
@@ -63,11 +65,6 @@ buildPythonPackage rec {
 
   build-system = [ setuptools ];
 
-  pythonRemoveDeps = [
-    # unpackaged
-    "aistudio-sdk"
-    "modelscope"
-  ];
   pythonRelaxDeps = [
     "numpy"
     "pandas"
@@ -91,6 +88,8 @@ buildPythonPackage rec {
     ujson
     gputil
     huggingface-hub
+    modelscope
+    aistudio-sdk
   ];
 
   passthru.updateScript = nix-update-script { };
diff --git a/pkgs/development/python-modules/pysrdaligateway/default.nix b/pkgs/development/python-modules/pysrdaligateway/default.nix
index 618ab5a25b64..ce1ccb5e252f 100644
--- a/pkgs/development/python-modules/pysrdaligateway/default.nix
+++ b/pkgs/development/python-modules/pysrdaligateway/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "pysrdaligateway";
-  version = "0.19.0";
+  version = "0.19.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "maginawin";
     repo = "PySrDaliGateway";
     tag = "v${version}";
-    hash = "sha256-m4gkhDYrw+58FN80zTKjSPK/3Wsl7rZ+Xlo/iWNZTWw=";
+    hash = "sha256-ONwWEgipiXW8lsF6KLeZRKfIGKxoQVVqkqL9IW/ldrw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/python-dbusmock/default.nix b/pkgs/development/python-modules/python-dbusmock/default.nix
index 804d40f32bfd..6465fb7014ac 100644
--- a/pkgs/development/python-modules/python-dbusmock/default.nix
+++ b/pkgs/development/python-modules/python-dbusmock/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
   runCommand,
 
   # build-system
@@ -12,6 +13,7 @@
   dbus-python,
 
   # checks
+  doCheck ? true,
   dbus,
   gobject-introspection,
   pygobject3,
@@ -40,6 +42,14 @@ buildPythonPackage rec {
     hash = "sha256-9YnMOQUuwAcrL0ZaQr7iGly9esZaSRIFThQRNUtSndo=";
   };
 
+  patches = lib.optionals doCheck [
+    (fetchpatch {
+      name = "networkmanager-1.54.2.patch";
+      url = "https://github.com/martinpitt/python-dbusmock/commit/1ce6196a687d324a55fbf1f74e0f66a4e83f7a15.patch";
+      hash = "sha256-Wo7AhmZu74cTHT9I36+NGGSU9dcFwmcDvtzgseTj/yA=";
+    })
+  ];
+
   build-system = [
     setuptools
     setuptools-scm
@@ -47,6 +57,8 @@ buildPythonPackage rec {
 
   dependencies = [ dbus-python ];
 
+  inherit doCheck;
+
   nativeCheckInputs = [
     dbus
     gobject-introspection
diff --git a/pkgs/development/python-modules/raylib-python-cffi/default.nix b/pkgs/development/python-modules/raylib-python-cffi/default.nix
index 48266a89d7c2..c7d49044215c 100644
--- a/pkgs/development/python-modules/raylib-python-cffi/default.nix
+++ b/pkgs/development/python-modules/raylib-python-cffi/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "raylib-python-cffi";
-  version = "5.5.0.3";
+  version = "5.5.0.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "electronstudio";
     repo = "raylib-python-cffi";
     tag = "v${version}";
-    hash = "sha256-VsdUOk26xXEwha7kGYHy4Cgwrr3yOiSlJg4nYn+ZYYs=";
+    hash = "sha256-MKyTpGnup4QmRui2OVBpnyn9KENATWcwYcikOmYX4c8=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/xclim/default.nix b/pkgs/development/python-modules/xclim/default.nix
new file mode 100644
index 000000000000..aa6ba7aecd2e
--- /dev/null
+++ b/pkgs/development/python-modules/xclim/default.nix
@@ -0,0 +1,99 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  flit,
+  setuptools,
+
+  # dependencies
+  boltons,
+  bottleneck,
+  cf-xarray,
+  cftime,
+  click,
+  dask,
+  filelock,
+  jsonpickle,
+  numba,
+  packaging,
+  pandas,
+  pint,
+  platformdirs,
+  pooch,
+  pyarrow,
+  pyyaml,
+  scikit-learn,
+  scipy,
+  statsmodels,
+  xarray,
+  yamale,
+
+  # test
+  versionCheckHook,
+}:
+buildPythonPackage rec {
+  pname = "xclim";
+  version = "0.59.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "Ouranosinc";
+    repo = "xclim";
+    tag = "v${version}";
+    hash = "sha256-n9HJoIHLyLWxrgCuDZDQ9dcW7frgEA/LoYqnTEBLqD8=";
+  };
+
+  build-system = [
+    flit
+    setuptools
+  ];
+
+  dependencies = [
+    boltons
+    bottleneck
+    cf-xarray
+    cftime
+    click
+    dask
+    filelock
+    jsonpickle
+    numba
+    packaging
+    pandas
+    pint
+    platformdirs
+    pooch
+    pyarrow
+    pyyaml
+    scikit-learn
+    scipy
+    statsmodels
+    xarray
+    yamale
+  ];
+
+  # No python test hooks has been added as all tests seems to be relying on network data
+  # https://github.com/Ouranosinc/xclim/blob/e8ce9bf37083832517afb3375acc853191782d8f/tests/conftest.py#L314
+  nativeCheckInputs = [
+    versionCheckHook
+  ];
+
+  versionCheckProgramArg = "--version";
+
+  pythonImportsCheck = [
+    "xclim"
+    "xclim.ensembles"
+    "xclim.indices"
+  ];
+
+  meta = {
+    description = "Operational Python library supporting climate services, based on xarray";
+    homepage = "https://github.com/Ouranosinc/xclim";
+    changelog = "https://github.com/Ouranosinc/xclim/releases/tag/${src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ daspk04 ];
+    mainProgram = "xclim";
+  };
+}
diff --git a/pkgs/development/tools/pnpm/fetch-deps/default.nix b/pkgs/development/tools/pnpm/fetch-deps/default.nix
index 91eb685f0671..4fb7c6d6d736 100644
--- a/pkgs/development/tools/pnpm/fetch-deps/default.nix
+++ b/pkgs/development/tools/pnpm/fetch-deps/default.nix
@@ -8,6 +8,7 @@
   makeSetupHook,
   pnpm,
   yq,
+  zstd,
 }:
 
 let
@@ -16,6 +17,7 @@ let
   supportedFetcherVersions = [
     1 # First version. Here to preserve backwards compatibility
     2 # Ensure consistent permissions. See https://github.com/NixOS/nixpkgs/pull/422975
+    3 # Build a reproducible tarball. See https://github.com/NixOS/nixpkgs/pull/469950
   ];
 in
 {
@@ -72,6 +74,7 @@ in
             moreutils
             args.pnpm or pnpm'
             yq
+            zstd
           ];
 
           impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [ "NIX_NPM_REGISTRY" ];
@@ -87,13 +90,23 @@ in
 
             export HOME=$(mktemp -d)
 
+            # For fetcherVersion < 3, the pnpm store files are placed directly into $out.
+            # For fetcherVersion >= 3, it is bundled into a compressed tarball within $out,
+            # without distributing the uncompressed store files.
+            if [[ ${toString fetcherVersion} -ge 3 ]]; then
+              mkdir $out
+              storePath=$(mktemp -d)
+            else
+              storePath=$out
+            fi
+
             # If the packageManager field in package.json is set to a different pnpm version than what is in nixpkgs,
             # any pnpm command would fail in that directory, the following disables this
             pushd ..
             pnpm config set manage-package-manager-versions false
             popd
 
-            pnpm config set store-dir $out
+            pnpm config set store-dir $storePath
             # Some packages produce platform dependent outputs. We do not want to cache those in the global store
             pnpm config set side-effects-cache false
             # As we pin pnpm versions, we don't really care about updates
@@ -122,8 +135,8 @@ in
             runHook preFixup
 
             # Remove timestamp and sort the json files
-            rm -rf $out/{v3,v10}/tmp
-            for f in $(find $out -name "*.json"); do
+            rm -rf $storePath/{v3,v10}/tmp
+            for f in $(find $storePath -name "*.json"); do
               jq --sort-keys "del(.. | .checkedAt?)" $f | sponge $f
             done
 
@@ -139,9 +152,22 @@ in
             # See https://github.com/NixOS/nixpkgs/pull/350063
             # See https://github.com/NixOS/nixpkgs/issues/422889
             if [[ ${toString fetcherVersion} -ge 2 ]]; then
-              find $out -type f -name "*-exec" -print0 | xargs -0 chmod 555
-              find $out -type f -not -name "*-exec" -print0 | xargs -0 chmod 444
-              find $out -type d -print0 | xargs -0 chmod 555
+              find $storePath -type f -name "*-exec" -print0 | xargs -0 chmod 555
+              find $storePath -type f -not -name "*-exec" -print0 | xargs -0 chmod 444
+              find $storePath -type d -print0 | xargs -0 chmod 555
+            fi
+
+            if [[ ${toString fetcherVersion} -ge 3 ]]; then
+              (
+                cd $storePath
+
+                # Build a reproducible tarball, per instructions at https://reproducible-builds.org/docs/archives/
+                tar --sort=name \
+                  --mtime="@$SOURCE_DATE_EPOCH" \
+                  --owner=0 --group=0 --numeric-owner \
+                  --pax-option=exthdr.name=%d/PaxHeaders/%f,delete=atime,delete=ctime \
+                  --zstd -cf $out/pnpm-store.tar.zst .
+              )
             fi
 
             runHook postFixup
@@ -166,7 +192,10 @@ in
 
   configHook = makeSetupHook {
     name = "pnpm-config-hook";
-    propagatedBuildInputs = [ pnpm ];
+    propagatedBuildInputs = [
+      pnpm
+      zstd
+    ];
     substitutions = {
       npmArch = stdenvNoCC.targetPlatform.node.arch;
       npmPlatform = stdenvNoCC.targetPlatform.node.platform;
diff --git a/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh b/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh
index fbeebc8dff94..2532e5d465c1 100644
--- a/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh
+++ b/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh
@@ -12,10 +12,7 @@ pnpmConfigHook() {
       exit 1
     fi
 
-    fetcherVersion=1
-    if [[ -e "${pnpmDeps}/.fetcher-version" ]]; then
-      fetcherVersion=$(cat "${pnpmDeps}/.fetcher-version")
-    fi
+    fetcherVersion=$(cat "${pnpmDeps}/.fetcher-version" || echo 1)
 
     echo "Using fetcherVersion: $fetcherVersion"
 
@@ -26,7 +23,12 @@ pnpmConfigHook() {
     export npm_config_arch="@npmArch@"
     export npm_config_platform="@npmPlatform@"
 
-    cp -Tr "$pnpmDeps" "$STORE_PATH"
+    if [[ $fetcherVersion -ge 3 ]]; then
+      tar --zstd -xf "$pnpmDeps/pnpm-store.tar.zst" -C "$STORE_PATH"
+    else
+      cp -Tr "$pnpmDeps" "$STORE_PATH"
+    fi
+
     chmod -R +w "$STORE_PATH"
 
 
diff --git a/pkgs/development/tools/pnpm/fetch-deps/serve.nix b/pkgs/development/tools/pnpm/fetch-deps/serve.nix
index a60aaa3b928f..9aa5d380a0cd 100644
--- a/pkgs/development/tools/pnpm/fetch-deps/serve.nix
+++ b/pkgs/development/tools/pnpm/fetch-deps/serve.nix
@@ -2,6 +2,7 @@
   writeShellApplication,
   pnpm,
   pnpmDeps,
+  zstd,
 }:
 
 writeShellApplication {
@@ -9,11 +10,14 @@ writeShellApplication {
 
   runtimeInputs = [
     pnpm
+    zstd
   ];
 
   text = ''
     storePath=$(mktemp -d)
 
+    fetcherVersion=$(cat "${pnpmDeps}/.fetcher-version" || echo 1)
+
     clean() {
       echo "Cleaning up temporary store at '$storePath'..."
 
@@ -22,7 +26,12 @@ writeShellApplication {
 
     echo "Copying pnpm store '${pnpmDeps}' to temporary store..."
 
-    cp -Tr "${pnpmDeps}" "$storePath"
+    if [[ $fetcherVersion -ge 3 ]]; then
+      tar --zstd -xf "${pnpmDeps}/pnpm-store.tar.zst" -C "$storePath"
+    else
+      cp -Tr "${pnpmDeps}" "$storePath"
+    fi
+
     chmod -R +w "$storePath"
 
     echo "Run 'pnpm install --store-dir \"$storePath\"' to install packages from this store."
diff --git a/pkgs/kde/frameworks/kirigami/default.nix b/pkgs/kde/frameworks/kirigami/default.nix
index 8344d03c1dbb..39b7f8dca2db 100644
--- a/pkgs/kde/frameworks/kirigami/default.nix
+++ b/pkgs/kde/frameworks/kirigami/default.nix
@@ -6,6 +6,7 @@
   qtdeclarative,
   qt5compat,
   qqc2-desktop-style,
+  fetchpatch,
 }:
 # Kirigami has a runtime dependency on qqc2-desktop-style,
 # which has a build time dependency on Kirigami.
@@ -19,6 +20,13 @@ let
 
     patches = [
       ./rb-templates.patch
+
+      # Fix rendering issues in some applications
+      # FIXME: remove in next update
+      (fetchpatch {
+        url = "https://invent.kde.org/frameworks/kirigami/-/commit/19127672cd812d177192cf84da4107f9abed2934.diff";
+        hash = "sha256-dh1OwMTksbVTEsEDw4vfBarR3fyBaulQa8SSHsddht0=";
+      })
     ];
 
     extraNativeBuildInputs = [
diff --git a/pkgs/kde/plasma/libplasma/default.nix b/pkgs/kde/plasma/libplasma/default.nix
index f13240876725..453c9d328f9e 100644
--- a/pkgs/kde/plasma/libplasma/default.nix
+++ b/pkgs/kde/plasma/libplasma/default.nix
@@ -8,6 +8,11 @@
 mkKdeDerivation {
   pname = "libplasma";
 
+  patches = [
+    # https://invent.kde.org/plasma/libplasma/-/merge_requests/1406
+    ./rb-extracomponents.patch
+  ];
+
   extraNativeBuildInputs = [ pkg-config ];
 
   extraBuildInputs = [
diff --git a/pkgs/kde/plasma/libplasma/rb-extracomponents.patch b/pkgs/kde/plasma/libplasma/rb-extracomponents.patch
new file mode 100644
index 000000000000..e2f7f1a94997
--- /dev/null
+++ b/pkgs/kde/plasma/libplasma/rb-extracomponents.patch
@@ -0,0 +1,27 @@
+commit fd5e1a04b024a9b955d6942e52295582144fbea7
+Author: Arnout Engelen <arnout@bzzt.net>
+Date:   Sun Dec 14 10:43:57 2025 +0100
+
+    reproducible builds: make qml dependency explicit
+    
+    Similar to https://qt-project.atlassian.net/browse/QTBUG-137440
+    
+    To fix https://bugs.kde.org/show_bug.cgi?id=512868
+    
+    I'll admit I don't quite know what I'm doing here, I'm mostly guessing and mimicking, but it does seem to remove the nondeterminism :)
+
+diff --git a/src/declarativeimports/plasmaextracomponents/CMakeLists.txt b/src/declarativeimports/plasmaextracomponents/CMakeLists.txt
+index 1a7827819..989318c80 100644
+--- a/src/declarativeimports/plasmaextracomponents/CMakeLists.txt
++++ b/src/declarativeimports/plasmaextracomponents/CMakeLists.txt
+@@ -44,6 +44,10 @@ target_link_libraries(plasmaextracomponentsplugin PRIVATE
+         KF6::WidgetsAddons
+         Plasma::Plasma)
+ 
++add_dependencies(plasmaextracomponentsplugin
++    org_kde_plasmacomponents3
++)
++
+ ecm_finalize_qml_module(plasmaextracomponentsplugin DESTINATION ${KDE_INSTALL_QMLDIR})
+ 
+ ecm_generate_qdoc(plasmaextracomponentsplugin plasmaextras.qdocconf)
diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index b99f2531831c..28de9c68110e 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -15,15 +15,15 @@ let
     concatMapStrings
     concatMapStringsSep
     concatStrings
+    filter
     findFirst
+    getName
     isDerivation
     length
     concatMap
     mutuallyExclusive
     optional
-    optionalAttrs
     optionalString
-    optionals
     isAttrs
     isString
     mapAttrs
@@ -47,6 +47,11 @@ let
     toPretty
     ;
 
+  inherit (builtins)
+    getEnv
+    trace
+    ;
+
   # If we're in hydra, we can dispense with the more verbose error
   # messages and make problems easier to spot.
   inHydra = config.inHydra or false;
@@ -57,11 +62,11 @@ let
   getNameWithVersion =
     attrs: attrs.name or "${attrs.pname or "«name-missing»"}-${attrs.version or "«version-missing»"}";
 
-  allowUnfree = config.allowUnfree || builtins.getEnv "NIXPKGS_ALLOW_UNFREE" == "1";
+  allowUnfree = config.allowUnfree || getEnv "NIXPKGS_ALLOW_UNFREE" == "1";
 
   allowNonSource =
     let
-      envVar = builtins.getEnv "NIXPKGS_ALLOW_NONSOURCE";
+      envVar = getEnv "NIXPKGS_ALLOW_NONSOURCE";
     in
     if envVar != "" then envVar != "0" else config.allowNonSource or true;
 
@@ -74,33 +79,34 @@ let
     else
       throw "allowlistedLicenses and blocklistedLicenses are not mutually exclusive.";
 
-  hasLicense = attrs: attrs ? meta.license;
-
   hasListedLicense =
     assert areLicenseListsValid;
-    list: attrs:
-    length list > 0
-    && hasLicense attrs
-    && (
-      if isList attrs.meta.license then
-        any (l: elem l list) attrs.meta.license
-      else
-        elem attrs.meta.license list
-    );
+    list:
+    if list == [ ] then
+      attrs: false
+    else
+      attrs:
+      attrs ? meta.license
+      && (
+        if isList attrs.meta.license then
+          any (l: elem l list) attrs.meta.license
+        else
+          elem attrs.meta.license list
+      );
 
-  hasAllowlistedLicense = attrs: hasListedLicense allowlist attrs;
+  hasAllowlistedLicense = hasListedLicense allowlist;
 
-  hasBlocklistedLicense = attrs: hasListedLicense blocklist attrs;
+  hasBlocklistedLicense = hasListedLicense blocklist;
 
-  allowBroken = config.allowBroken || builtins.getEnv "NIXPKGS_ALLOW_BROKEN" == "1";
+  allowBroken = config.allowBroken || getEnv "NIXPKGS_ALLOW_BROKEN" == "1";
 
   allowUnsupportedSystem =
-    config.allowUnsupportedSystem || builtins.getEnv "NIXPKGS_ALLOW_UNSUPPORTED_SYSTEM" == "1";
+    config.allowUnsupportedSystem || getEnv "NIXPKGS_ALLOW_UNSUPPORTED_SYSTEM" == "1";
 
   isUnfree =
     licenses:
     if isAttrs licenses then
-      !licenses.free or true
+      !(licenses.free or true)
     # TODO: Returning false in the case of a string is a bug that should be fixed.
     # In a previous implementation of this function the function body
     # was `licenses: lib.lists.any (l: !l.free or true) licenses;`
@@ -108,9 +114,9 @@ let
     else if isString licenses then
       false
     else
-      any (l: !l.free or true) licenses;
+      any (l: !(l.free or true)) licenses;
 
-  hasUnfreeLicense = attrs: hasLicense attrs && isUnfree attrs.meta.license;
+  hasUnfreeLicense = attrs: attrs ? meta.license && isUnfree attrs.meta.license;
 
   hasNoMaintainers =
     # To get usable output, we want to avoid flagging "internal" derivations.
@@ -161,19 +167,13 @@ let
     attrs: hasUnfreeLicense attrs && !allowUnfree && !allowUnfreePredicate attrs;
 
   allowInsecureDefaultPredicate =
-    x: builtins.elem (getNameWithVersion x) (config.permittedInsecurePackages or [ ]);
-  allowInsecurePredicate = x: (config.allowInsecurePredicate or allowInsecureDefaultPredicate) x;
+    x: elem (getNameWithVersion x) (config.permittedInsecurePackages or [ ]);
+  allowInsecurePredicate = config.allowInsecurePredicate or allowInsecureDefaultPredicate;
 
-  hasAllowedInsecure =
-    attrs:
-    !(isMarkedInsecure attrs)
-    || allowInsecurePredicate attrs
-    || builtins.getEnv "NIXPKGS_ALLOW_INSECURE" == "1";
+  allowInsecure = getEnv "NIXPKGS_ALLOW_INSECURE" == "1";
 
-  isNonSource = sourceTypes: any (t: !t.isSource) sourceTypes;
-
-  hasNonSourceProvenance =
-    attrs: (attrs ? meta.sourceProvenance) && isNonSource attrs.meta.sourceProvenance;
+  hasDisallowedInsecure =
+    attrs: isMarkedInsecure attrs && !allowInsecure && !allowInsecurePredicate attrs;
 
   # Allow granular checks to allow only some non-source-built packages
   # Example:
@@ -188,7 +188,11 @@ let
   # package has non-source provenance and is not explicitly allowed by the
   # `allowNonSourcePredicate` function.
   hasDeniedNonSourceProvenance =
-    attrs: hasNonSourceProvenance attrs && !allowNonSource && !allowNonSourcePredicate attrs;
+    attrs:
+    attrs ? meta.sourceProvenance
+    && any (t: !t.isSource) attrs.meta.sourceProvenance
+    && !allowNonSource
+    && !allowNonSourcePredicate attrs;
 
   showLicenseOrSourceType =
     value: toString (map (v: v.shortName or v.fullName or "unknown") (toList value));
@@ -197,17 +201,6 @@ let
 
   pos_str = meta: meta.position or "«unknown-file»";
 
-  remediation = {
-    unfree = remediate_allowlist "Unfree" (remediate_predicate "allowUnfreePredicate");
-    non-source = remediate_allowlist "NonSource" (remediate_predicate "allowNonSourcePredicate");
-    broken = remediate_allowlist "Broken" (x: "");
-    unsupported = remediate_allowlist "UnsupportedSystem" (x: "");
-    blocklisted = x: "";
-    insecure = remediate_insecure;
-    broken-outputs = remediateOutputsToInstall;
-    unknown-meta = x: "";
-    maintainerless = x: "";
-  };
   remediation_env_var =
     allow_attr:
     {
@@ -230,7 +223,7 @@ let
 
     Alternatively you can configure a predicate to allow specific packages:
       { nixpkgs.config.${predicateConfigAttr} = pkg: builtins.elem (lib.getName pkg) [
-          "${lib.getName attrs}"
+          "${getName attrs}"
         ];
       }
   '';
@@ -241,7 +234,7 @@ let
          then pass `--impure` in order to allow use of environment variables.
     ";
 
-  remediate_allowlist = allow_attr: rebuild_amendment: attrs: ''
+  remediate_allowlist = allow_attr: rebuild_amendment: ''
     a) To temporarily allow ${remediation_phrase allow_attr}, you can use an environment variable
        for a single invocation of the nix tools.
 
@@ -250,7 +243,7 @@ let
     b) For `nixos-rebuild` you can set
       { nixpkgs.config.allow${allow_attr} = true; }
     in configuration.nix to override this.
-    ${rebuild_amendment attrs}
+    ${rebuild_amendment}
     c) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
       { allow${allow_attr} = true; }
     to ~/.config/nixpkgs/config.nix.
@@ -300,7 +293,7 @@ let
     let
       expectedOutputs = attrs.meta.outputsToInstall or [ ];
       actualOutputs = attrs.outputs or [ "out" ];
-      missingOutputs = builtins.filter (output: !builtins.elem output actualOutputs) expectedOutputs;
+      missingOutputs = filter (output: !elem output actualOutputs) expectedOutputs;
     in
     ''
       The package ${getNameWithVersion attrs} has set meta.outputsToInstall to: ${builtins.concatStringsSep ", " expectedOutputs}
@@ -312,45 +305,6 @@ let
       ${concatStrings (map (output: "  - ${output}\n") missingOutputs)}
     '';
 
-  handleEvalIssue =
-    { meta, attrs }:
-    {
-      reason,
-      errormsg ? "",
-    }:
-    let
-      msg =
-        if inHydra then
-          "Failed to evaluate ${getNameWithVersion attrs}: «${reason}»: ${errormsg}"
-        else
-          ''
-            Package ‘${getNameWithVersion attrs}’ in ${pos_str meta} ${errormsg}, refusing to evaluate.
-
-          ''
-          + (builtins.getAttr reason remediation) attrs;
-
-      handler = if config ? handleEvalIssue then config.handleEvalIssue reason else throw;
-    in
-    handler msg;
-
-  handleEvalWarning =
-    { meta, attrs }:
-    {
-      reason,
-      errormsg ? "",
-    }:
-    let
-      remediationMsg = (builtins.getAttr reason remediation) attrs;
-      msg =
-        if inHydra then
-          "Warning while evaluating ${getNameWithVersion attrs}: «${reason}»: ${errormsg}"
-        else
-          "Package ${getNameWithVersion attrs} in ${pos_str meta} ${errormsg}, continuing anyway."
-          + (optionalString (remediationMsg != "") "\n${remediationMsg}");
-      isEnabled = findFirst (x: x == reason) null showWarnings;
-    in
-    if isEnabled != null then builtins.trace msg true else true;
-
   metaTypes =
     let
       types = import ./meta-types.nix { inherit lib; };
@@ -446,11 +400,10 @@ let
       identifiers = attrs;
     };
 
+  # Map attrs directly to the verify function for performance
+  metaTypes' = mapAttrs (_: t: t.verify) metaTypes;
+
   checkMetaAttr =
-    let
-      # Map attrs directly to the verify function for performance
-      metaTypes' = mapAttrs (_: t: t.verify) metaTypes;
-    in
     k: v:
     if metaTypes ? ${k} then
       if metaTypes'.${k} v then
@@ -467,81 +420,80 @@ let
           concatMapStringsSep ", " (x: "'${x}'") (attrNames metaTypes)
         }]"
       ];
-  checkMeta =
-    meta:
-    optionals config.checkMeta (concatMap (attr: checkMetaAttr attr meta.${attr}) (attrNames meta));
+
+  checkMeta = meta: concatMap (attr: checkMetaAttr attr meta.${attr}) (attrNames meta);
+
+  metaInvalid =
+    if config.checkMeta then
+      meta: !all (attr: metaTypes ? ${attr} && metaTypes'.${attr} meta.${attr}) (attrNames meta)
+    else
+      meta: false;
 
   checkOutputsToInstall =
-    attrs:
-    let
-      expectedOutputs = attrs.meta.outputsToInstall or [ ];
-      actualOutputs = attrs.outputs or [ "out" ];
-      missingOutputs = builtins.filter (output: !builtins.elem output actualOutputs) expectedOutputs;
-    in
-    if config.checkMeta then builtins.length missingOutputs > 0 else false;
+    if config.checkMeta then
+      attrs:
+      let
+        actualOutputs = attrs.outputs or [ "out" ];
+      in
+      any (output: !elem output actualOutputs) (attrs.meta.outputsToInstall or [ ])
+    else
+      attrs: false;
 
   # Check if a derivation is valid, that is whether it passes checks for
   # e.g brokenness or license.
   #
   # Return { valid: "yes", "warn" or "no" } and additionally
-  # { reason: String; errormsg: String } if it is not valid, where
+  # { reason: String; errormsg: String, remediation: String } if it is not valid, where
   # reason is one of "unfree", "blocklisted", "broken", "insecure", ...
   # !!! reason strings are hardcoded into OfBorg, make sure to keep them in sync
   # Along with a boolean flag for each reason
   checkValidity =
-    let
-      validYes = {
-        valid = "yes";
-        handled = true;
-      };
-    in
     attrs:
     # Check meta attribute types first, to make sure it is always called even when there are other issues
     # Note that this is not a full type check and functions below still need to by careful about their inputs!
-    let
-      res = checkMeta (attrs.meta or { });
-    in
-    if res != [ ] then
+    if metaInvalid (attrs.meta or { }) then
       {
-        valid = "no";
         reason = "unknown-meta";
-        errormsg = "has an invalid meta attrset:${concatMapStrings (x: "\n  - " + x) res}\n";
+        errormsg = "has an invalid meta attrset:${
+          concatMapStrings (x: "\n  - " + x) (checkMeta attrs.meta)
+        }\n";
+        remediation = "";
       }
 
     # --- Put checks that cannot be ignored here ---
     else if checkOutputsToInstall attrs then
       {
-        valid = "no";
         reason = "broken-outputs";
         errormsg = "has invalid meta.outputsToInstall";
+        remediation = remediateOutputsToInstall attrs;
       }
 
     # --- Put checks that can be ignored here ---
     else if hasDeniedUnfreeLicense attrs && !(hasAllowlistedLicense attrs) then
       {
-        valid = "no";
         reason = "unfree";
         errormsg = "has an unfree license (‘${showLicense attrs.meta.license}’)";
+        remediation = remediate_allowlist "Unfree" (remediate_predicate "allowUnfreePredicate" attrs);
       }
     else if hasBlocklistedLicense attrs then
       {
-        valid = "no";
         reason = "blocklisted";
         errormsg = "has a blocklisted license (‘${showLicense attrs.meta.license}’)";
+        remediation = "";
       }
     else if hasDeniedNonSourceProvenance attrs then
       {
-        valid = "no";
         reason = "non-source";
         errormsg = "contains elements not built from source (‘${showSourceType attrs.meta.sourceProvenance}’)";
+        remediation = remediate_allowlist "NonSource" (remediate_predicate "allowNonSourcePredicate" attrs);
       }
     else if hasDeniedBroken attrs then
       {
-        valid = "no";
         reason = "broken";
         errormsg = "is marked as broken";
+        remediation = remediate_allowlist "Broken" "";
       }
-    else if !allowUnsupportedSystem && hasUnsupportedPlatform attrs then
+    else if hasUnsupportedPlatform attrs && !allowUnsupportedSystem then
       let
         toPretty' = toPretty {
           allowPrettyValues = true;
@@ -549,7 +501,6 @@ let
         };
       in
       {
-        valid = "no";
         reason = "unsupported";
         errormsg = ''
           is not available on the requested hostPlatform:
@@ -557,25 +508,28 @@ let
             package.meta.platforms = ${toPretty' (attrs.meta.platforms or [ ])}
             package.meta.badPlatforms = ${toPretty' (attrs.meta.badPlatforms or [ ])}
         '';
+        remediation = remediate_allowlist "UnsupportedSystem" "";
       }
-    else if !(hasAllowedInsecure attrs) then
+    else if hasDisallowedInsecure attrs then
       {
-        valid = "no";
         reason = "insecure";
         errormsg = "is marked as insecure";
+        remediation = remediate_insecure attrs;
       }
+    else
+      null;
 
-    # --- warnings ---
-    # Please also update the type in /pkgs/top-level/config.nix alongside this.
-    else if hasNoMaintainers attrs then
+  # Please also update the type in /pkgs/top-level/config.nix alongside this.
+  checkWarnings =
+    attrs:
+    if hasNoMaintainers attrs then
       {
-        valid = "warn";
         reason = "maintainerless";
         errormsg = "has no maintainers or teams";
+        remediation = "";
       }
-    # -----
     else
-      validYes;
+      null;
 
   # Helper functions and declarations to handle identifiers, extracted to reduce allocations
   hasAllCPEParts =
@@ -730,34 +684,57 @@ let
 
       available =
         validity.valid != "no"
-        && (
-          if config.checkMetaRecursively or false then all (d: d.meta.available or true) references else true
-        );
+        && ((config.checkMetaRecursively or false) -> all (d: d.meta.available or true) references);
     };
 
+  validYes = {
+    valid = "yes";
+    handled = true;
+  };
+
   assertValidity =
     { meta, attrs }:
     let
-      validity = checkValidity attrs;
-      inherit (validity) valid;
+      invalid = checkValidity attrs;
+      warning = checkWarnings attrs;
     in
-    if validity ? handled then
-      validity
+    if isNull invalid then
+      if isNull warning then
+        validYes
+      else
+        let
+          msg =
+            if inHydra then
+              "Warning while evaluating ${getNameWithVersion attrs}: «${warning.reason}»: ${warning.errormsg}"
+            else
+              "Package ${getNameWithVersion attrs} in ${pos_str meta} ${warning.errormsg}, continuing anyway."
+              + (optionalString (warning.remediation != "") "\n${warning.remediation}");
+
+          handled = if elem warning.reason showWarnings then trace msg true else true;
+        in
+        warning
+        // {
+          valid = "warn";
+          handled = handled;
+        }
     else
-      validity
-      // {
-        # Throw an error if trying to evaluate a non-valid derivation
-        # or, alternatively, just output a warning message.
-        handled = (
-          if valid == "yes" then
-            true
-          else if valid == "no" then
-            (handleEvalIssue { inherit meta attrs; } { inherit (validity) reason errormsg; })
-          else if valid == "warn" then
-            (handleEvalWarning { inherit meta attrs; } { inherit (validity) reason errormsg; })
+      let
+        msg =
+          if inHydra then
+            "Failed to evaluate ${getNameWithVersion attrs}: «${invalid.reason}»: ${invalid.errormsg}"
           else
-            throw "Unknown validity: '${valid}'"
-        );
+            ''
+              Package ‘${getNameWithVersion attrs}’ in ${pos_str meta} ${invalid.errormsg}, refusing to evaluate.
+
+            ''
+            + invalid.remediation;
+
+        handled = if config ? handleEvalIssue then config.handleEvalIssue invalid.reason msg else throw msg;
+      in
+      invalid
+      // {
+        valid = "no";
+        handled = handled;
       };
 
 in
diff --git a/pkgs/tools/networking/ivpn/default.nix b/pkgs/tools/networking/ivpn/default.nix
deleted file mode 100644
index 39299da1a681..000000000000
--- a/pkgs/tools/networking/ivpn/default.nix
+++ /dev/null
@@ -1,118 +0,0 @@
-{
-  buildGoModule,
-  fetchFromGitHub,
-  lib,
-  wirelesstools,
-  makeWrapper,
-  wireguard-tools,
-  openvpn,
-  obfs4,
-  iproute2,
-  dnscrypt-proxy,
-  iptables,
-  gawk,
-  util-linux,
-  nix-update-script,
-}:
-
-builtins.mapAttrs
-  (
-    pname: attrs:
-    buildGoModule (
-      attrs
-      // rec {
-        inherit pname;
-        version = "3.14.34";
-
-        buildInputs = [
-          wirelesstools
-        ];
-
-        src = fetchFromGitHub {
-          owner = "ivpn";
-          repo = "desktop-app";
-          tag = "v${version}";
-          hash = "sha256-Q96G5mJahJnXxpqJ8IF0oFie7l0Nd1p8drHH9NSpwEw=";
-        };
-
-        proxyVendor = true; # .c file
-
-        ldflags = [
-          "-s"
-          "-w"
-          "-X github.com/ivpn/desktop-app/daemon/version._version=${version}"
-          "-X github.com/ivpn/desktop-app/daemon/version._time=1970-01-01"
-        ];
-
-        postInstall = ''
-          mv $out/bin/{${attrs.modRoot},${pname}}
-        '';
-
-        passthru.updateScript = nix-update-script { };
-
-        meta = {
-          description = "Official IVPN Desktop app";
-          homepage = "https://www.ivpn.net/apps";
-          changelog = "https://github.com/ivpn/desktop-app/releases/tag/v${version}";
-          license = lib.licenses.gpl3Only;
-          maintainers = with lib.maintainers; [
-            urandom
-            blenderfreaky
-          ];
-          mainProgram = "ivpn";
-        };
-      }
-    )
-  )
-  {
-    ivpn = {
-      modRoot = "cli";
-      vendorHash = "sha256-xZ1tMiv06fE2wtpDagKjHiVTPYWpj32hM6n/v9ZcgrE=";
-    };
-    ivpn-service = {
-      modRoot = "daemon";
-      vendorHash = "sha256-DVKSCcEeE7vI8aOYuEwk22n0wtF7MMDOyAgYoXYadwI=";
-      nativeBuildInputs = [ makeWrapper ];
-
-      patches = [ ./permissions.patch ];
-      postPatch = ''
-        substituteInPlace daemon/service/platform/platform_linux.go \
-          --replace 'openVpnBinaryPath = "/usr/sbin/openvpn"' \
-          'openVpnBinaryPath = "${openvpn}/bin/openvpn"' \
-          --replace 'routeCommand = "/sbin/ip route"' \
-          'routeCommand = "${iproute2}/bin/ip route"'
-
-        substituteInPlace daemon/netinfo/netinfo_linux.go \
-          --replace 'retErr := shell.ExecAndProcessOutput(log, outParse, "", "/sbin/ip", "route")' \
-          'retErr := shell.ExecAndProcessOutput(log, outParse, "", "${iproute2}/bin/ip", "route")'
-
-        substituteInPlace daemon/service/platform/platform_linux_release.go \
-          --replace 'installDir := "/opt/ivpn"' "installDir := \"$out\"" \
-          --replace 'obfsproxyStartScript = path.Join(installDir, "obfsproxy/obfs4proxy")' \
-          'obfsproxyStartScript = "${lib.getExe obfs4}"' \
-          --replace 'wgBinaryPath = path.Join(installDir, "wireguard-tools/wg-quick")' \
-          'wgBinaryPath = "${wireguard-tools}/bin/wg-quick"' \
-          --replace 'wgToolBinaryPath = path.Join(installDir, "wireguard-tools/wg")' \
-          'wgToolBinaryPath = "${wireguard-tools}/bin/wg"' \
-          --replace 'dnscryptproxyBinPath = path.Join(installDir, "dnscrypt-proxy/dnscrypt-proxy")' \
-          'dnscryptproxyBinPath = "${dnscrypt-proxy}/bin/dnscrypt-proxy"'
-      '';
-
-      postFixup = ''
-        mkdir -p $out/etc
-        cp -r $src/daemon/References/Linux/etc/* $out/etc/
-        cp -r $src/daemon/References/common/etc/* $out/etc/
-
-        patchShebangs --build $out/etc/firewall.sh $out/etc/splittun.sh $out/etc/client.down $out/etc/client.up
-
-        wrapProgram "$out/bin/ivpn-service" \
-          --suffix PATH : ${
-            lib.makeBinPath [
-              iptables
-              gawk
-              util-linux
-            ]
-          }
-      '';
-    };
-  }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5258d291e0fe..0232c5389c22 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1061,11 +1061,6 @@ with pkgs;
     iroh-dns-server
     ;
 
-  inherit (callPackages ../tools/networking/ivpn/default.nix { })
-    ivpn
-    ivpn-service
-    ;
-
   kanata-with-cmd = kanata.override { withCmd = true; };
 
   linux-router-without-wifi = linux-router.override { useWifiDependencies = false; };
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index cd43baf5471b..76d3bb4c41dc 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -570,6 +570,8 @@ let
 
         extlib-1-7-7 = callPackage ../development/ocaml-modules/extlib/1.7.7.nix { };
 
+        extunix = callPackage ../development/ocaml-modules/extunix/default.nix { };
+
         ezjsonm = callPackage ../development/ocaml-modules/ezjsonm { };
 
         ezjsonm-encoding = callPackage ../development/ocaml-modules/ezjsonm-encoding { };
@@ -1713,6 +1715,10 @@ let
 
         ppx_deriving_rpc = callPackage ../development/ocaml-modules/ppx_deriving_rpc { };
 
+        ppx_deriving_variant_string =
+          callPackage ../development/ocaml-modules/ppx_deriving_variant_string
+            { };
+
         ppx_deriving_yaml = callPackage ../development/ocaml-modules/ppx_deriving_yaml {
           mdx = mdx.override { inherit logs; };
         };
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index abe158c96288..cf4364fa8118 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -582,6 +582,8 @@ self: super: with self; {
 
   airtouch5py = callPackage ../development/python-modules/airtouch5py { };
 
+  aistudio-sdk = callPackage ../development/python-modules/aistudio-sdk { };
+
   ajpy = callPackage ../development/python-modules/ajpy { };
 
   ajsonrpc = callPackage ../development/python-modules/ajsonrpc { };
@@ -1824,6 +1826,8 @@ self: super: with self; {
 
   bcdoc = callPackage ../development/python-modules/bcdoc { };
 
+  bce-python-sdk = callPackage ../development/python-modules/bce-python-sdk { };
+
   bcf = callPackage ../development/python-modules/bcf { };
 
   bcg = callPackage ../development/python-modules/bcg { };
@@ -3160,6 +3164,8 @@ self: super: with self; {
 
   countryguess = callPackage ../development/python-modules/countryguess { };
 
+  countryinfo = callPackage ../development/python-modules/countryinfo { };
+
   courlan = callPackage ../development/python-modules/courlan { };
 
   coverage = callPackage ../development/python-modules/coverage { };
@@ -9837,6 +9843,8 @@ self: super: with self; {
 
   modeled = callPackage ../development/python-modules/modeled { };
 
+  modelscope = callPackage ../development/python-modules/modelscope { };
+
   modern-colorthief = callPackage ../development/python-modules/modern-colorthief { };
 
   moderngl = callPackage ../development/python-modules/moderngl { };
@@ -20679,6 +20687,8 @@ self: super: with self; {
 
   xcffib = callPackage ../development/python-modules/xcffib { };
 
+  xclim = callPackage ../development/python-modules/xclim { };
+
   xdg = callPackage ../development/python-modules/xdg { };
 
   xdg-base-dirs = callPackage ../development/python-modules/xdg-base-dirs { };