diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index b855729692f6..e7c7d13e1c0a 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -342,6 +342,8 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
 
 - `services.openssh` now supports generating host SSH keys by setting `services.openssh.generateHostKeys = true` while leaving `services.openssh.enable` disabled.  This is particularly useful for systems that have no need of an SSH daemon but want SSH host keys for other purposes such as using agenix or sops-nix.
 
+- `services.openssh.enableRecommendedAlgorithms` has been added to allow users to opt out of NixOS's curated set of recommended algorithms. This set to true by default, and thus is not a breaking change. Users may want to set this to false if they prefer upstream's default algorithms. See <https://github.com/NixOS/nixpkgs/pull/471330>.
+
 - IPVLAN interfaces can now be configured through the `networking.ipvlans` option in the networking module.
 
 - `services.caddy` now supports setting `httpPort` and `httpsPort` and opening them in the firewall via `openFirewall`.
diff --git a/nixos/modules/services/networking/ssh/sshd.nix b/nixos/modules/services/networking/ssh/sshd.nix
index b87e5ccad65f..9736387fd57a 100644
--- a/nixos/modules/services/networking/ssh/sshd.nix
+++ b/nixos/modules/services/networking/ssh/sshd.nix
@@ -412,6 +412,16 @@ in
         '';
       };
 
+      enableRecommendedAlgorithms = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Use algorithms curated and recommended by NixOS.
+
+          Set to false to use upstream's default algorithms.
+        '';
+      };
+
       authorizedKeysFiles = lib.mkOption {
         type = lib.types.listOf lib.types.str;
         default = [ ];
@@ -571,37 +581,64 @@ in
               };
               KexAlgorithms = lib.mkOption {
                 type = lib.types.nullOr (lib.types.listOf lib.types.str);
-                default = [
-                  "mlkem768x25519-sha256"
-                  "sntrup761x25519-sha512"
-                  "sntrup761x25519-sha512@openssh.com"
-                  "curve25519-sha256"
-                  "curve25519-sha256@libssh.org"
-                  "diffie-hellman-group-exchange-sha256"
-                ];
+                default =
+                  if config.services.openssh.enableRecommendedAlgorithms then
+                    [
+                      "mlkem768x25519-sha256"
+                      "sntrup761x25519-sha512"
+                      "sntrup761x25519-sha512@openssh.com"
+                      "curve25519-sha256"
+                      "curve25519-sha256@libssh.org"
+                      "diffie-hellman-group-exchange-sha256"
+                    ]
+                  else
+                    null;
+                defaultText = ''
+                  if config.services.openssh.enableRecommendedAlgorithms then
+                    [
+                      "mlkem768x25519-sha256"
+                      "sntrup761x25519-sha512"
+                      "sntrup761x25519-sha512@openssh.com"
+                      "curve25519-sha256"
+                      "curve25519-sha256@libssh.org"
+                      "diffie-hellman-group-exchange-sha256"
+                    ]
+                  else
+                    null;
+                '';
                 description = ''
                   Allowed key exchange algorithms
 
-                  Uses the lower bound recommended in both
-                  <https://stribika.github.io/2015/01/04/secure-secure-shell.html>
-                  and
-                  <https://infosec.mozilla.org/guidelines/openssh#modern-openssh-67>
+                  Defaults to a curated set of algorithms.
+                  Set enableRecommendedAlgorithms to false to use upstream's defaults.
                 '';
               };
               Macs = lib.mkOption {
                 type = lib.types.nullOr (lib.types.listOf lib.types.str);
-                default = [
-                  "hmac-sha2-512-etm@openssh.com"
-                  "hmac-sha2-256-etm@openssh.com"
-                  "umac-128-etm@openssh.com"
-                ];
+                default =
+                  if config.services.openssh.enableRecommendedAlgorithms then
+                    [
+                      "hmac-sha2-512-etm@openssh.com"
+                      "hmac-sha2-256-etm@openssh.com"
+                      "umac-128-etm@openssh.com"
+                    ]
+                  else
+                    null;
+                defaultText = ''
+                  if config.services.openssh.enableRecommendedAlgorithms then
+                    [
+                      "hmac-sha2-512-etm@openssh.com"
+                      "hmac-sha2-256-etm@openssh.com"
+                      "umac-128-etm@openssh.com"
+                    ]
+                  else
+                    null;
+                '';
                 description = ''
                   Allowed MACs
 
-                  Defaults to recommended settings from both
-                  <https://stribika.github.io/2015/01/04/secure-secure-shell.html>
-                  and
-                  <https://infosec.mozilla.org/guidelines/openssh#modern-openssh-67>
+                  Defaults to a curated set of algorithms.
+                  Set enableRecommendedAlgorithms to false to use upstream's defaults.
                 '';
               };
               StrictModes = lib.mkOption {
@@ -613,21 +650,36 @@ in
               };
               Ciphers = lib.mkOption {
                 type = lib.types.nullOr (lib.types.listOf lib.types.str);
-                default = [
-                  "chacha20-poly1305@openssh.com"
-                  "aes256-gcm@openssh.com"
-                  "aes128-gcm@openssh.com"
-                  "aes256-ctr"
-                  "aes192-ctr"
-                  "aes128-ctr"
-                ];
+                default =
+                  if config.services.openssh.enableRecommendedAlgorithms then
+                    [
+                      "chacha20-poly1305@openssh.com"
+                      "aes256-gcm@openssh.com"
+                      "aes128-gcm@openssh.com"
+                      "aes256-ctr"
+                      "aes192-ctr"
+                      "aes128-ctr"
+                    ]
+                  else
+                    null;
+                defaultText = ''
+                  if config.services.openssh.enableRecommendedAlgorithms then
+                    [
+                      "chacha20-poly1305@openssh.com"
+                      "aes256-gcm@openssh.com"
+                      "aes128-gcm@openssh.com"
+                      "aes256-ctr"
+                      "aes192-ctr"
+                      "aes128-ctr"
+                    ]
+                  else
+                    null;
+                '';
                 description = ''
                   Allowed ciphers
 
-                  Defaults to recommended settings from both
-                  <https://stribika.github.io/2015/01/04/secure-secure-shell.html>
-                  and
-                  <https://infosec.mozilla.org/guidelines/openssh#modern-openssh-67>
+                  Defaults to a curated set of algorithms.
+                  Set enableRecommendedAlgorithms to false to use upstream's defaults.
                 '';
               };
               AllowUsers = lib.mkOption {
diff --git a/nixos/modules/system/boot/systemd/initrd.nix b/nixos/modules/system/boot/systemd/initrd.nix
index c3713c026b0e..370fceb94844 100644
--- a/nixos/modules/system/boot/systemd/initrd.nix
+++ b/nixos/modules/system/boot/systemd/initrd.nix
@@ -265,10 +265,12 @@ in
     };
 
     root = lib.mkOption {
-      type = lib.types.enum [
-        "fstab"
-        "gpt-auto"
-      ];
+      type = lib.types.nullOr (
+        lib.types.enum [
+          "fstab"
+          "gpt-auto"
+        ]
+      );
       default = "fstab";
       example = "gpt-auto";
       description = ''
@@ -277,6 +279,7 @@ in
         allow specifying the root file system itself this
         way. Instead, the `fstab` value is used in order to interpret
         the root file system specified with the `fileSystems` option.
+        If root shall be omitted, set this option to `null`.
       '';
     };
 
@@ -489,13 +492,13 @@ in
     ]
     ++ lib.optional cfg.package.withEfi "efivarfs";
 
-    boot.kernelParams = [
-      "root=${config.boot.initrd.systemd.root}"
-    ]
-    ++ lib.optional (config.boot.resumeDevice != "") "resume=${config.boot.resumeDevice}"
-    # `systemd` mounts root in initrd as read-only unless "rw" is on the kernel command line.
-    # For NixOS activation to succeed, we need to have root writable in initrd.
-    ++ lib.optional (config.boot.initrd.systemd.root == "gpt-auto") "rw";
+    boot.kernelParams =
+      lib.optional (config.boot.initrd.systemd.root != null) "root=${config.boot.initrd.systemd.root}"
+
+      ++ lib.optional (config.boot.resumeDevice != "") "resume=${config.boot.resumeDevice}"
+      # `systemd` mounts root in initrd as read-only unless "rw" is on the kernel command line.
+      # For NixOS activation to succeed, we need to have root writable in initrd.
+      ++ lib.optional (config.boot.initrd.systemd.root == "gpt-auto") "rw";
 
     boot.initrd.systemd = {
       initrdBin = [
diff --git a/nixos/tests/openssh.nix b/nixos/tests/openssh.nix
index 97ed224b5afb..c6b2f6d707d6 100644
--- a/nixos/tests/openssh.nix
+++ b/nixos/tests/openssh.nix
@@ -90,9 +90,11 @@ in
         ];
       };
 
-    server-lazy-socket = {
+    # IP addresses are allocated according to the alphabetical order of the machine name, and since tests rely on the IP address of this machine, let's name it so it's order (and thus address) is predictable.
+    aaa-server-lazy-socket = {
       virtualisation.vlans = [
         1
+        # Allocate another VLAN so we can exercise listening on a non-standard address.
         2
       ];
       services.openssh = {
@@ -191,12 +193,32 @@ in
               path = "/etc/ssh/ssh_host_ed25519_key";
             }
           ];
+          # The NixOS-curated algorithms require OpenSSL, and so since this test is against an OpenSSH-without-OpenSSL, we have to use the default algorithms, which adapt to not having OpenSSL.
+          enableRecommendedAlgorithms = false;
+        };
+        users.users.root.openssh.authorizedKeys.keys = [
+          snakeOilEd25519PublicKey
+        ];
+      };
+
+    server-default-algorithms =
+      { ... }:
+      {
+        services.openssh = {
+          enable = true;
+          enableRecommendedAlgorithms = false;
+        };
+        users.users.root.openssh.authorizedKeys.keys = [
+          snakeOilEd25519PublicKey
+        ];
+      };
+
+    server-null-algorithms =
+      { ... }:
+      {
+        services.openssh = {
+          enable = true;
           settings = {
-            # Since this test is against an OpenSSH-without-OpenSSL,
-            # we have to override NixOS's defaults ciphers (which require OpenSSL)
-            # and instead set these to null, which will mean OpenSSH uses its defaults.
-            # Expectedly, OpenSSH's defaults don't require OpenSSL when it's compiled
-            # without OpenSSL.
             Ciphers = null;
             KexAlgorithms = null;
             Macs = null;
@@ -292,17 +314,19 @@ in
 
     server.wait_for_unit("sshd", timeout=60)
     server_allowed_users.wait_for_unit("sshd", timeout=60)
+    server_default_algorithms.wait_for_unit("sshd", timeout=60)
     server_localhost_only.wait_for_unit("sshd", timeout=60)
     server_match_rule.wait_for_unit("sshd", timeout=60)
     server_no_openssl.wait_for_unit("sshd", timeout=60)
     server_no_pam.wait_for_unit("sshd", timeout=60)
+    server_null_algorithms.wait_for_unit("sshd", timeout=60)
     server_null_pam.wait_for_unit("sshd", timeout=60)
     server_null_pam.fail("journalctl -u sshd.service | grep 'Unsupported option UsePAM'")
     server_sftp.wait_for_unit("sshd", timeout=60)
 
     server_lazy.wait_for_unit("sshd.socket", timeout=60)
     server_localhost_only_lazy.wait_for_unit("sshd.socket", timeout=60)
-    server_lazy_socket.wait_for_unit("sshd.socket", timeout=60)
+    aaa_server_lazy_socket.wait_for_unit("sshd.socket", timeout=60)
 
     # sshd-keygen is a oneshot unit, so just wait for multi-user.target, which
     # pulls it in.
@@ -340,14 +364,14 @@ in
             timeout=30
         )
 
-    with subtest("socket activation on a non-standard port"):
+    with subtest("socket activation on a non-standard address and port"):
         client.succeed(
             "cat ${snakeOilPrivateKey} > privkey.snakeoil"
         )
         client.succeed("chmod 600 privkey.snakeoil")
         # The final segment in this IP is allocated according to the alphabetical order of machines in this test.
         client.succeed(
-            "ssh -p 2222 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil root@192.168.2.5 true",
+            "ssh -p 2222 -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil root@192.168.2.1 true",
             timeout=30
         )
 
@@ -400,6 +424,26 @@ in
             timeout=30
         )
 
+    with subtest("null-algorithms"):
+        client.succeed(
+            "cat ${snakeOilEd25519PrivateKey} > privkey.snakeoil"
+        )
+        client.succeed("chmod 600 privkey.snakeoil")
+        client.succeed(
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server-null-algorithms true",
+            timeout=30
+        )
+
+    with subtest("no-openssl"):
+        client.succeed(
+            "cat ${snakeOilEd25519PrivateKey} > privkey.snakeoil"
+        )
+        client.succeed("chmod 600 privkey.snakeoil")
+        client.succeed(
+            "ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i privkey.snakeoil server-default-algorithms true",
+            timeout=30
+        )
+
     with subtest("no-pam"):
         client.succeed(
             "cat ${snakeOilPrivateKey} > privkey.snakeoil"
diff --git a/pkgs/applications/editors/android-studio/default.nix b/pkgs/applications/editors/android-studio/default.nix
index 5d7533f5e414..9884c28b95d3 100644
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -26,9 +26,9 @@ let
     url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2025.3.3.5/android-studio-panda3-rc1-linux.tar.gz";
   };
   latestVersion = {
-    version = "2025.3.4.3"; # "Android Studio Panda 4 | 2025.3.4 Canary 3"
-    sha256Hash = "sha256-8fqHdU6IPuRmcJeCZQOqUPgfild9k98sLnN77dl2Hs8=";
-    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2025.3.4.3/android-studio-panda4-canary3-linux.tar.gz";
+    version = "2025.3.4.4"; # "Android Studio Panda 4 | 2025.3.4 Canary 4"
+    sha256Hash = "sha256-sPGJuOm5T7EZV5hhOJsZc7P8CTXyv9A6k82hM1GZGpY=";
+    url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2025.3.4.4/android-studio-panda4-canary4-linux.tar.gz";
   };
 in
 {
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 3ee78e301c17..f0685afd88d8 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -4634,8 +4634,8 @@ let
         mktplcRef = {
           name = "ayu";
           publisher = "teabyii";
-          version = "1.1.11";
-          sha256 = "sha256-0gfevhXxrZC2rpWIaZM7aNfZrh/KIjoDWkZreeVU+EI=";
+          version = "1.1.12";
+          sha256 = "sha256-pwLvik3GRMLyr6GeTmZh1MrkgH1MgbyoembNmQxg4I0=";
         };
         meta = {
           description = "Simple theme with bright colors and comes in three versions — dark, light and mirage for all day long comfortable work";
diff --git a/pkgs/applications/editors/vscode/extensions/james-yu.latex-workshop/default.nix b/pkgs/applications/editors/vscode/extensions/james-yu.latex-workshop/default.nix
index f67b77f25dcc..0fff354b20da 100644
--- a/pkgs/applications/editors/vscode/extensions/james-yu.latex-workshop/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/james-yu.latex-workshop/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "latex-workshop";
     publisher = "James-Yu";
-    version = "10.13.1";
-    hash = "sha256-UyujvtuS0dok5xC4w1lGCwDxOSr58t1/YQ5Mpe6yNPM=";
+    version = "10.14.1";
+    hash = "sha256-lsbiKzZTlkq/9K7ptLg0kHAd4i5OyNh2pLGGYUOJS9A=";
   };
   meta = {
     changelog = "https://marketplace.visualstudio.com/items/James-Yu.latex-workshop/changelog";
diff --git a/pkgs/applications/editors/vscode/extensions/ms-vsliveshare.vsliveshare/default.nix b/pkgs/applications/editors/vscode/extensions/ms-vsliveshare.vsliveshare/default.nix
index d734acc1ea4f..b72aa226fffd 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-vsliveshare.vsliveshare/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-vsliveshare.vsliveshare/default.nix
@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "vsliveshare";
     publisher = "ms-vsliveshare";
-    version = "1.1.119";
-    hash = "sha256-s7GCJvlMCcZ+OOwdSh82moU7BlQLz1hVPMwZ9MYtahM=";
+    version = "1.1.122";
+    hash = "sha256-XD8iLG8HA9u5Y4CKQKLnmeAN4IFf1LGDvhTKuroxkHg=";
   };
 
   postPatch = ''
diff --git a/pkgs/applications/editors/vscode/generic.nix b/pkgs/applications/editors/vscode/generic.nix
index b2686a9df4e6..7f1b627c5ef0 100644
--- a/pkgs/applications/editors/vscode/generic.nix
+++ b/pkgs/applications/editors/vscode/generic.nix
@@ -3,9 +3,9 @@
   lib,
   coreutils,
   gawk,
+  getconf,
   gnugrep,
   gnused,
-  glibc,
   jq,
   copyDesktopItems,
   makeDesktopItem,
@@ -354,18 +354,23 @@ stdenv.mkDerivation (
               "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libdbusmenu ]}"
           }
         --prefix PATH : ${
-          lib.makeBinPath [
-            # for moving files to trash
-            glib
+          lib.makeBinPath (
+            [
+              # for moving files to trash
+              glib
 
-            # for launcher and bundled helper scripts
-            gawk
-            glibc.bin
-            gnugrep
-            gnused
-            coreutils
-            which
-          ]
+              # for launcher and bundled helper scripts
+              gawk
+              gnugrep
+              gnused
+              coreutils
+              which
+            ]
+            # provides `getconf` for ps-fallback script that only runs on Linux
+            # https://github.com/microsoft/vscode/blob/97c807618b413805fde466739ba14f77a1f12307/src/vs/base/node/ps.sh#L2
+            # https://github.com/microsoft/vscode/blob/97c807618b413805fde466739ba14f77a1f12307/src/vs/base/node/ps.ts#L203-L217
+            ++ lib.optional stdenv.hostPlatform.isLinux getconf
+          )
         }
         --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true --wayland-text-input-version=3}}"
         --add-flags ${lib.escapeShellArg commandLineArgs}
diff --git a/pkgs/applications/emulators/libretro/cores/twenty-fortyeight.nix b/pkgs/applications/emulators/libretro/cores/twenty-fortyeight.nix
index af41c0b0ef4d..352f9c8ff282 100644
--- a/pkgs/applications/emulators/libretro/cores/twenty-fortyeight.nix
+++ b/pkgs/applications/emulators/libretro/cores/twenty-fortyeight.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "2048";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-10";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-2048";
-    rev = "1892de39d80ec37e1fac79729cd91917b21f1349";
-    hash = "sha256-lNcDdkiWiXhvwwpzMnceTDY+mJl1JTZfGCY+WIOvrP8=";
+    rev = "c90437d3c3913999624deca3fb55ecfa632b72c4";
+    hash = "sha256-dE3PanK+rpf01R4aoD3KMwVhEVvmmVS2klVPQUGTUC0=";
   };
 
   meta = {
diff --git a/pkgs/applications/emulators/libretro/cores/vba-m.nix b/pkgs/applications/emulators/libretro/cores/vba-m.nix
index 7beabad5155d..f5b26fe8b8e8 100644
--- a/pkgs/applications/emulators/libretro/cores/vba-m.nix
+++ b/pkgs/applications/emulators/libretro/cores/vba-m.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "vbam";
-  version = "0-unstable-2024-10-21";
+  version = "0-unstable-2026-04-10";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "vbam-libretro";
-    rev = "60b48a3a4a46562f29120c1868a54778b40b60a2";
-    hash = "sha256-UbXSHdKfa91MpcYityo+aILbI0DfkLqZh8YfGcRx/BI=";
+    rev = "e8b2875d6cad10fc3c7c9f57bb5f1acc324d7c10";
+    hash = "sha256-tq2MxjPwVPkZotaZAKxmiz7Zjws22E8tK+FPcS+uujk=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/by-name/ch/chatbox/package.nix b/pkgs/by-name/ch/chatbox/package.nix
index f9b26d324c1a..0d9448b273f4 100644
--- a/pkgs/by-name/ch/chatbox/package.nix
+++ b/pkgs/by-name/ch/chatbox/package.nix
@@ -6,11 +6,11 @@
 }:
 let
   pname = "chatbox";
-  version = "1.19.1";
+  version = "1.20.0";
 
   src = fetchurl {
     url = "https://download.chatboxai.app/releases/Chatbox-${version}-x86_64.AppImage";
-    hash = "sha256-xR653w7jiJlSHvbDcJG5pFjbgf/jZzbyx8C+pa0cPp4=";
+    hash = "sha256-VzrAXWacrX6ldHdSw12RmElMdWmHiCsE3qPEPoJqFA0=";
   };
 
   appimageContents = appimageTools.extract { inherit pname version src; };
diff --git a/pkgs/by-name/ch/cherry-studio/package.nix b/pkgs/by-name/ch/cherry-studio/package.nix
index 0d9c30858ca1..87b79a3b9452 100644
--- a/pkgs/by-name/ch/cherry-studio/package.nix
+++ b/pkgs/by-name/ch/cherry-studio/package.nix
@@ -31,13 +31,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "cherry-studio";
-  version = "1.8.4";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "CherryHQ";
     repo = "cherry-studio";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TLV4N9WYuTD24UY+2lYmxRLO2jtdvuXyIOeH5mXb1V0=";
+    hash = "sha256-gk/sTkBr7PKBGS96bYVUXGpZuoaech4/0npB+NSstTA=";
   };
 
   postPatch = ''
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-qryToH1tytLSwPORkLBCCn3m/Xsl+vift9WF3Pn8oGg=";
+    hash = "sha256-DidMffZQEdYSERZZgDpQ8DqV773iBju89Pa0Z1Gz3I8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cn/cnspec/package.nix b/pkgs/by-name/cn/cnspec/package.nix
index 62a3285c2696..3da84146f582 100644
--- a/pkgs/by-name/cn/cnspec/package.nix
+++ b/pkgs/by-name/cn/cnspec/package.nix
@@ -6,18 +6,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "cnspec";
-  version = "13.3.3";
+  version = "13.4.1";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yCxry1f5CEF51WSgrYN1m9F8YpVjtt+UNZG978nPXbY=";
+    hash = "sha256-3Uo2x30K7b7NA5OGP8YYlcoEJmFhlkL7t7ohvzUlmYI=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-wgebRTa1ox+LUzxlYLb3pqcLEF/uUushZ1Oq2mvRGCk=";
+  vendorHash = "sha256-7XwLkvG0LYL0pIbjMs78wMSqbXR5SScPAgjRxYsPwlA=";
 
   subPackages = [ "apps/cnspec" ];
 
diff --git a/pkgs/by-name/do/dokieli/missing-hashes.json b/pkgs/by-name/do/dokieli/missing-hashes.json
index eb73dcb5f662..9b0ac522e2ec 100644
--- a/pkgs/by-name/do/dokieli/missing-hashes.json
+++ b/pkgs/by-name/do/dokieli/missing-hashes.json
@@ -1,19 +1,19 @@
 {
-  "@rolldown/binding-android-arm64@npm:1.0.0-rc.9": "1777af709a7dee1cf188aa8248f915b9a8e33ebf08e542dad502bbc71d2b4da454cdb27099177606e8b180df406273abcd45d52774ce4e27cf2a439b84d52683",
-  "@rolldown/binding-darwin-arm64@npm:1.0.0-rc.9": "7c5a281f86d91ba3d18d079e8b67b4bb6cc9f0d414b13be2f0c4e9d4b821e8a16045c1324244841be48b94bb5312cb61295f9bf97808553614c6d5eddeb7a64a",
-  "@rolldown/binding-darwin-x64@npm:1.0.0-rc.9": "eec443021e7fc115a8378f3d664df84db7cd6e97b1741d663efdd7c68340d7e61558241031ea5434ef9ca1dfa66c1a4a480177e194cfd38925de876c157efb85",
-  "@rolldown/binding-freebsd-x64@npm:1.0.0-rc.9": "51c5863b592936299620c9200e704880ebd38b6f1ce4c4ba944558162913a8d7891c24982e85a484838fa80b025737dbd4042f94e2a25a2d927379ad572c1631",
-  "@rolldown/binding-linux-arm-gnueabihf@npm:1.0.0-rc.9": "d5b5391a590a9d3f0a792d78be5eaef4595c6bc25704caf28c7cc2b01853322d807bae922deabb1f2c2a197ac48dbf97b9ef4aef0212e8830a1f3c1d70af3608",
-  "@rolldown/binding-linux-arm64-gnu@npm:1.0.0-rc.9": "504c4d38e115f77fb44aa9ac56948e8d870021a5f4153af5b91fc5823b468f0268a9d451b11f7dea9aab47bc5fa07a014eecf34ad0baeb12eec46282aa8b4a22",
-  "@rolldown/binding-linux-arm64-musl@npm:1.0.0-rc.9": "e3ebfeb46b68eca14fd36177d8e40edd5a3e8634f2b00a55531a88fa467ddc46a9a9d650e3b085b85b7a8377ad5223ebdf5b226507f3ac150528758eab70ed29",
-  "@rolldown/binding-linux-ppc64-gnu@npm:1.0.0-rc.9": "e240025464e6bf73aaff02e9412937948b6b944eee24a26ed578956e0ab7c6b00da5300e35650c1fbd5c37dee3cc8ad66c9ac3c1e036e17ea33b3cbca58f1356",
-  "@rolldown/binding-linux-s390x-gnu@npm:1.0.0-rc.9": "50e631b2efcdc93573311bc8ce8d1319bee3212c1872929d2b3752bf0be0896100f271aae829d3aafa9413b24ef47edf4a0fea48ee8dfa8386edbb23381dcd93",
-  "@rolldown/binding-linux-x64-gnu@npm:1.0.0-rc.9": "8d59328c46ac1250c7666f2d723ec30be3119553c60e22656d08391c2a217c938f906906b6662da1984666643ba00ad7d43899041380fe6a7f5072f5e1cc4b97",
-  "@rolldown/binding-linux-x64-musl@npm:1.0.0-rc.9": "cd27570608123a824d4c779cca3cee1e93ac3a8318e030a881bb72d80a6ff3b9a22add1f550c13fd7472407aea02cda2cfbd04016975f88474826848bf463b0e",
-  "@rolldown/binding-openharmony-arm64@npm:1.0.0-rc.9": "0bb2f5ab0e2a461ac0f05e1efafaf4145702479792afc7b5229c92da18d0544fd63189fd15f6bca71a511d07131b231665933470ceceec7db67c628e2c43a152",
-  "@rolldown/binding-wasm32-wasi@npm:1.0.0-rc.9": "7208c5618e61b484d1272650c68d8908ac0a1b35ce365ef78f0b4290afa171055b24a15585c2a62d95abf1e6298e4aa3d08b71db6656415b8e7d2fdf37fd8b24",
-  "@rolldown/binding-win32-arm64-msvc@npm:1.0.0-rc.9": "f2605a92b218d088c20b0a2e71a8f47a5d5b5b04ed2edcafc59d692974cf62984228350eee176e94ea605b4326363c0962a8e97e2de34c926447c38ed6a73636",
-  "@rolldown/binding-win32-x64-msvc@npm:1.0.0-rc.9": "091a4d27b9675b61dd598aa6ee827c5a2959b532ae52a0ac73aafd167567328a53fb38f2c0d556f8f78625c275f86d54491134fceefa9e43cb796c6af982fb75",
+  "@rolldown/binding-android-arm64@npm:1.0.0-rc.15": "0c78d6321d2dedc0c6ed4b5541328f6c04e8530a3c294b477cd9741e2af7c8377a51474f0171c85ecf63bff5c8bb31ee586f40f13fa265a869247ec3d6293204",
+  "@rolldown/binding-darwin-arm64@npm:1.0.0-rc.15": "598b8cb87d8ba8df4e880e0d6903f7f4f32b3e7b2804429cb3ccc47a69b8e7b852b2e3115a8c3a882d14979909f9464e8da55c2c52a52cb18a81df7e8a1aa654",
+  "@rolldown/binding-darwin-x64@npm:1.0.0-rc.15": "92fdfa58a8d9edaec4c1766c38c34f657715d2c8faec141590812d11ba6a6ce52530e55a6a2515fcd2ec6287e50187a458f06ca3c6813130cb9869a99c9f6f29",
+  "@rolldown/binding-freebsd-x64@npm:1.0.0-rc.15": "04e8288accf007c82e8bbe75af62d4ed570bddd7b25a178506fcf97daa0907cf6f85ea095be5826095242ac1a4923196059f53a9e8fdd0e3c34d9ed1c00d64ae",
+  "@rolldown/binding-linux-arm-gnueabihf@npm:1.0.0-rc.15": "4cd7452e4fe4433b730585bcbaf210efc50621bca5906204179ffe80748bea187398d4091dae64079f0c7ebfea1987f0b1c045ff60209ab0f60be9e04eccbef7",
+  "@rolldown/binding-linux-arm64-gnu@npm:1.0.0-rc.15": "fbddea791134b45a94aa5aea640a177d6feacd81a44f9ee3615da3daa824dc2a193ced6e8f2a0bb0676fca7b224525513b451cd8f78b379d7b1983fe6a0360ff",
+  "@rolldown/binding-linux-arm64-musl@npm:1.0.0-rc.15": "b325fa98753bf41100c5d95145f30ce92b5f69f6989973306344b1644fb21633454aa216f28355c74d0e7bd5885bb6d2c80d0f96dcc2b869ca7e63d8b22dbe91",
+  "@rolldown/binding-linux-ppc64-gnu@npm:1.0.0-rc.15": "0bff0d2724912079dcedfbc0a86dbad8e3e376d2d619cf36917964701b9ae5a39afa5ff49d3cb5b2c3e17437c559314cf8e17433ad3bfb4b64229d9c8bf1ebca",
+  "@rolldown/binding-linux-s390x-gnu@npm:1.0.0-rc.15": "6718fd91ead389f3bdefe22fd0344b490d3f9350697e4aa35a0fb55957aa1b127d26aaecf9bc2d49f1dfde62d9d4717cf5dfb7d93ce3b871372ef9c6cb7a1b1a",
+  "@rolldown/binding-linux-x64-gnu@npm:1.0.0-rc.15": "cb7628e1a7398ab5fd07dc79a38c73a27524d45adc989b5d906ea37e23b7692123d607d07fb9fda35485d6caba545ae41c561b9632aefa0bff76997208f83eae",
+  "@rolldown/binding-linux-x64-musl@npm:1.0.0-rc.15": "f59fb354b8cac55d123f6f3fe7bf8210402f97ed4be3f3a883c6c544ce1b825e36154f479d45f6e9f23c1fcd8861e9f3873dc24278631db871d263db3bea5580",
+  "@rolldown/binding-openharmony-arm64@npm:1.0.0-rc.15": "b6c220a48ace9c381d238dce2caaa8453da1d3fe9312bab7babf127a500bdec2bbe30bd381f9945af79c30fe9ca0185108b86ef311fc83ecb83ef24f7a587902",
+  "@rolldown/binding-wasm32-wasi@npm:1.0.0-rc.15": "9cd39e02ad5f43fc45901d074df10c0e3532d9077a6e334e431de60f90555c15e5445d1b5156c10df49d28839f9f15d5d808666bc8e70ab065bb9af3b8567e7a",
+  "@rolldown/binding-win32-arm64-msvc@npm:1.0.0-rc.15": "cfc32a72e8a3900f356b0b359520df3f18ac79379a273a4c53b00b1555123dcfd8204cf9976762664898b0c6c949c0edd4be850ae254d2e84a40fcb8352858eb",
+  "@rolldown/binding-win32-x64-msvc@npm:1.0.0-rc.15": "f0bd2876247f0834f135c1ae150b7d5626d54ff399b4a6193626dc46a0eca22374a43c64afdf3eff8e8e9cf1f20df826bcd9fd4219df3fece03972b8ae080e20",
   "lightningcss-android-arm64@npm:1.32.0": "1cb326ad39dcb02cf9f45025c167b6900e3a04b08f5149d3c5ee26054b00d08db3736fb69183a6c3ed1cb32dddd148608c784b6631b4777623f7dd0c032c392d",
   "lightningcss-darwin-arm64@npm:1.32.0": "da954d0c215d0e95f15a92c8717f871017586e1332b98fd40e96196571d2fd3d51a727dc530768afee9f6a04da210510740574dd0c8dbf2ecced79e5996f1a06",
   "lightningcss-darwin-x64@npm:1.32.0": "b1d298c9173f839e8447d1917ed8bc5ab098ed0fc4e4b419d36ac5afe8b27bf21cb47d00a35c3d2edadcac598086e9b4f26c992a809d79f9681d6865a230d79e",
diff --git a/pkgs/by-name/do/dokieli/package.nix b/pkgs/by-name/do/dokieli/package.nix
index 008686575811..2ad85464c592 100644
--- a/pkgs/by-name/do/dokieli/package.nix
+++ b/pkgs/by-name/do/dokieli/package.nix
@@ -16,19 +16,19 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "dokieli";
-  version = "0-unstable-2026-03-25";
+  version = "0-unstable-2026-04-13";
 
   src = fetchFromGitHub {
     owner = "dokieli";
     repo = "dokieli";
-    rev = "d684e852325b2247b831b179efed5d96c211f864";
-    hash = "sha256-Af8KsH1tqPDuOUEaHRN3ULJwGWgZc5JgFT99sGKkkec=";
+    rev = "6f574408bc914347c3ba27869e61225fabbe6272";
+    hash = "sha256-PSDsV5Gg+JT9qwMBiRkyv/ZiZY9qvqhRuKjEiPMuQDU=";
   };
 
   missingHashes = ./missing-hashes.json;
   offlineCache = yarn-berry.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes;
-    hash = "sha256-bUXAYeTJqz11Rl7vaNPNRBTqjLdSr0FrEQBAFLd9oEs=";
+    hash = "sha256-bO3yEh+P8al/oXXjqNOMOpXc0ggc17Wc00WtahniilE=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/do/dotenvx/package.nix b/pkgs/by-name/do/dotenvx/package.nix
index 6e0ba140cff9..04dab004f602 100644
--- a/pkgs/by-name/do/dotenvx/package.nix
+++ b/pkgs/by-name/do/dotenvx/package.nix
@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "dotenvx";
-  version = "1.59.1";
+  version = "1.61.0";
 
   src = fetchFromGitHub {
     owner = "dotenvx";
     repo = "dotenvx";
     tag = "v${version}";
-    hash = "sha256-P1k1cd6DfxGom2VKPKkNqhfs0h89QHQW19ZtePlutJk=";
+    hash = "sha256-Ph/L+OOoO3UMc8FmZSNSLNqyMSAnxyXL+jFV3WkAfMw=";
   };
 
-  npmDepsHash = "sha256-OUggLKCzvgH158HSavEJBKtVs2EsddHDs/1q7H/5pPY=";
+  npmDepsHash = "sha256-7Ei3roqBrwtdko6qdD88ljRw3MzkgonMyT7fFQDdSpo=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/fi/filebeat8/package.nix b/pkgs/by-name/fi/filebeat8/package.nix
index 72db913dcf73..3d36d5e8a399 100644
--- a/pkgs/by-name/fi/filebeat8/package.nix
+++ b/pkgs/by-name/fi/filebeat8/package.nix
@@ -8,18 +8,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "filebeat";
-  version = "8.19.13";
+  version = "8.19.14";
 
   src = fetchFromGitHub {
     owner = "elastic";
     repo = "beats";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-KUbGtQW0GsMmEQPQA5DJtxMt+5pNs0LdQHr66e8sW/I=";
+    hash = "sha256-rNXT8GVL5M/Hx0XA3oksbW1w+tt9FhobZlg2tCQxroc=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
 
-  vendorHash = "sha256-eZuqIOLNMnFBkZocYP1OCtny5DOPl+k2Hym51rqVQPA=";
+  vendorHash = "sha256-4jLLZxnjV8QnHh/FtBWD0OcvcdqEMSJxFeRjURZPAVo=";
 
   subPackages = [ "filebeat" ];
 
diff --git a/pkgs/by-name/fr/fresh-editor/package.nix b/pkgs/by-name/fr/fresh-editor/package.nix
index 0049fd656899..8a87d81b52e2 100644
--- a/pkgs/by-name/fr/fresh-editor/package.nix
+++ b/pkgs/by-name/fr/fresh-editor/package.nix
@@ -12,16 +12,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "fresh";
-  version = "0.2.21";
+  version = "0.2.23";
 
   src = fetchFromGitHub {
     owner = "sinelaw";
     repo = "fresh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-du5YCDPqrGsbajT676Zs2oPvJPPAFseTkd3bXNNg64M=";
+    hash = "sha256-yF17RnuUWj8hmVbYlAjXLgYQluKnxinEfFPSm+LqDgM=";
   };
 
-  cargoHash = "sha256-UDbW8R8XNbif+beReQsCrCqtpUw8DhDMIAlZBKqUWaQ=";
+  cargoHash = "sha256-G5cJBLhlSGp7KWOAnk+HEB+iGnZfnkHY9iqMSfaof3Y=";
 
   nativeBuildInputs = [
     gzip
diff --git a/pkgs/by-name/ga/gauge-unwrapped/package.nix b/pkgs/by-name/ga/gauge-unwrapped/package.nix
index db7335577ee3..7c466c165d38 100644
--- a/pkgs/by-name/ga/gauge-unwrapped/package.nix
+++ b/pkgs/by-name/ga/gauge-unwrapped/package.nix
@@ -6,7 +6,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "gauge";
-  version = "1.6.29";
+  version = "1.6.30";
 
   patches = [
     # adds a check which adds an error message when trying to
@@ -18,10 +18,10 @@ buildGoModule (finalAttrs: {
     owner = "getgauge";
     repo = "gauge";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mZmIxss0W5eufz7EzchjVxdXpM/npbIBWls5C3KYVbY=";
+    hash = "sha256-tAS2FVg1TCWyRlEMDcepC+riYxzIOTh2sHBbHL+TrsU=";
   };
 
-  vendorHash = "sha256-nZPRjCzYSdtx6Q4VGdTunfK9+4X14l3gXwMLJc855JY=";
+  vendorHash = "sha256-pCnf8wtj44eubq03noZs7MGxzssWFFn3AhL1v0icLa8=";
 
   excludedPackages = [
     "build"
diff --git a/pkgs/by-name/ge/gefyra/package.nix b/pkgs/by-name/ge/gefyra/package.nix
index febfc6194dfe..5e18be3f7040 100644
--- a/pkgs/by-name/ge/gefyra/package.nix
+++ b/pkgs/by-name/ge/gefyra/package.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gefyra";
-  version = "2.4.0";
+  version = "2.4.1";
 
   src = fetchzip {
     url = "https://github.com/gefyrahq/gefyra/releases/download/${finalAttrs.version}/gefyra-${finalAttrs.version}-linux-amd64.zip";
-    hash = "sha256-PBwAVdTa1DL7KwAFhei1AcTdPyrcaCsyo6zif+UwJPk=";
+    hash = "sha256-XS+vtwb6UIJK7f3R3QLoyX9+P4n79Fh+v7odiot7Yic=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/gi/github-desktop/package.nix b/pkgs/by-name/gi/github-desktop/package.nix
index 3ac3f6182756..da9ad0ae1bdc 100644
--- a/pkgs/by-name/gi/github-desktop/package.nix
+++ b/pkgs/by-name/gi/github-desktop/package.nix
@@ -1,108 +1,207 @@
 {
-  stdenvNoCC,
   lib,
-  fetchurl,
-  autoPatchelfHook,
-  buildPackages,
+  stdenv,
+  copyDesktopItems,
+  desktopToDarwinBundle,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  makeBinaryWrapper,
+  makeDesktopItem,
+  yarnBuildHook,
+  yarnConfigHook,
+
+  electron,
+  git,
+  git-lfs,
+  node-gyp,
+  nodejs,
+  pkg-config,
+  python3,
+  typescript,
+  zip,
+
   gnome-keyring,
   libsecret,
-  git,
   curl,
-  nss,
-  nspr,
-  libxdamage,
-  libx11,
-  libdrm,
-  alsa-lib,
-  cups,
-  libgbm,
-  systemdLibs,
-  openssl,
-  libglvnd,
+
+  _experimental-update-script-combinators,
+  nix-update-script,
 }:
 
 let
-  rcversion = "1";
+  inherit (stdenv.hostPlatform.node) arch platform;
+  cacheRootHash = "sha256-mR5geiPPAv+oK1efT3pMfnUT1keOxB8Ge1yiq4hLtj0=";
+  cacheAppHash = "sha256-y8brlXwBur2RqJD8xlpA9ivg09xIDBuAtolhyzYkRx4=";
 in
-stdenvNoCC.mkDerivation (finalAttrs: {
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "github-desktop";
-  version = "3.4.13";
+  version = "3.5.7";
 
-  src =
-    let
-      urls = {
-        "x86_64-linux" = {
-          url = "https://github.com/shiftkey/desktop/releases/download/release-${finalAttrs.version}-linux${rcversion}/GitHubDesktop-linux-amd64-${finalAttrs.version}-linux${rcversion}.deb";
-          hash = "sha256-i1V3dhx5AMrCiWtfvB2I9a6ki2zncUNyYr4qZqs42Yc=";
-        };
-        "aarch64-linux" = {
-          url = "https://github.com/shiftkey/desktop/releases/download/release-${finalAttrs.version}-linux${rcversion}/GitHubDesktop-linux-arm64-${finalAttrs.version}-linux${rcversion}.deb";
-          hash = "sha256-SN4qtEI4q/AAgfUaBiM5eWyCK5Kr77CrTHsIAmvEceU=";
-        };
-      };
-    in
-    fetchurl
-      urls."${stdenvNoCC.hostPlatform.system}"
-        or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}");
+  src = fetchFromGitHub {
+    owner = "desktop";
+    repo = "desktop";
+    tag = "release-${finalAttrs.version}";
+    hash = "sha256-H6FPMp+Y3PmRtuaOVX+8Yd3a5JA+zvLeGeLp99X1+y0=";
+    fetchSubmodules = true;
+    postCheckout = "git -C $out rev-parse HEAD > $out/.gitrev";
+  };
 
-  nativeBuildInputs = [
-    autoPatchelfHook
-    # override doesn't preserve splicing https://github.com/NixOS/nixpkgs/issues/132651
-    # Has to use `makeShellWrapper` from `buildPackages` even though `makeShellWrapper` from the inputs is spliced because `propagatedBuildInputs` would pick the wrong one because of a different offset.
-    (buildPackages.wrapGAppsHook3.override { makeWrapper = buildPackages.makeShellWrapper; })
-  ];
+  yarnBuildScript = "build:prod";
 
   buildInputs = [
     gnome-keyring
-    libxdamage
-    libx11
     libsecret
-    git
     curl
-    nss
-    nspr
-    libdrm
-    alsa-lib
-    cups
-    libgbm
-    openssl
   ];
 
-  unpackPhase = ''
-    runHook preUnpack
-    mkdir -p $TMP/github-desktop $out/{opt,bin}
-    cp $src $TMP/github-desktop.deb
-    ar vx github-desktop.deb
-    tar --no-overwrite-dir -xvf data.tar.xz -C $TMP/github-desktop/
-    runHook postUnpack
+  nativeBuildInputs = [
+    copyDesktopItems
+    makeBinaryWrapper
+    yarnBuildHook
+    yarnConfigHook
+
+    git
+    nodejs
+    node-gyp
+    pkg-config
+    python3
+    # desktop-notifications build doesn't pick up tsc from node_modules for some reason
+    typescript
+    zip
+  ]
+  ++ lib.optional stdenv.hostPlatform.isDarwin desktopToDarwinBundle;
+
+  env = {
+    ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+    npm_config_nodedir = electron.headers;
+  };
+
+  cacheRoot = fetchYarnDeps {
+    name = "${finalAttrs.pname}-cache-root";
+    yarnLock = finalAttrs.src + "/yarn.lock";
+    hash = cacheRootHash;
+  };
+
+  cacheApp = fetchYarnDeps {
+    name = "${finalAttrs.pname}-cache-app";
+    yarnLock = finalAttrs.src + "/app/yarn.lock";
+    hash = cacheAppHash;
+  };
+
+  dontYarnInstallDeps = true;
+
+  postConfigure = ''
+    yarnOfflineCache="$cacheRoot" runHook yarnConfigHook
+
+    pushd app
+    yarnOfflineCache="$cacheApp" runHook yarnConfigHook
+    popd
+
+    yarn --cwd app/node_modules/desktop-notifications run install
+
+    # use git from nixpkgs instead of an automatically downloaded one by dugite
+    makeWrapper ${lib.getExe git} app/node_modules/dugite/git/bin/git \
+      --prefix PATH : ${lib.makeBinPath [ git-lfs ]}
+
+
+    # exception: printenvz needs `node-gyp` configure first for some reason
+    pushd node_modules/printenvz
+    node node_modules/.bin/node-gyp configure
+    popd
+
+    declare -a natives=(
+      app/node_modules/fs-admin
+      app/node_modules/keytar
+      app/node_modules/desktop-trampoline
+      app/node_modules/windows-argv-parser
+      node_modules/printenvz
+    )
+    for native in "''${natives[@]}"; do
+      yarn --offline --cwd $native build
+    done
+
+    # exception: desktop-trampoline doesn't include `node-gyp rebuild` in its build script anymore
+    pushd app/node_modules/desktop-trampoline
+    node-gyp rebuild
+    popd
+
+    yarn compile:script
+
+    touch electron
+    zip -0Xqr electron-v${electron.version}-${platform}-${arch}.zip electron
+    rm electron
+
+    substituteInPlace script/build.ts \
+      --replace-fail "return packager({" "return packager({electronZipDir:\"$(pwd)\",electronVersion: \"${electron.version}\","
   '';
 
+  preBuild = ''
+    export CIRCLE_SHA1="$(cat .gitrev)"
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "github-desktop";
+      desktopName = "GitHub Desktop";
+      comment = "Focus on what matters instead of fighting with Git";
+      exec = "github-desktop %u";
+      icon = "github-desktop";
+      mimeTypes = [
+        "x-scheme-handler/x-github-client"
+        "x-scheme-handler/x-github-desktop-auth"
+        "x-scheme-handler/x-github-desktop-dev-auth"
+      ];
+      terminal = false;
+    })
+  ];
+
   installPhase = ''
     runHook preInstall
-    cp -R $TMP/github-desktop/usr/share $out/
-    cp -R $TMP/github-desktop/usr/lib/github-desktop/* $out/opt/
-    ln -sf $out/opt/github-desktop $out/bin/github-desktop
+
+    mkdir -p $out/share/github-desktop
+
+    # transpose [name][size] into [size][name]
+    for icon in app/static/logos/*.png; do
+      size="$(basename "$icon" .png)"
+      install -Dm444 "$icon" -T "$out/share/icons/hicolor/$size/github-desktop.png"
+    done
+
+    cp -r dist/*/resources $out/share/github-desktop
+
+    makeWrapper ${lib.getExe electron} $out/bin/github-desktop \
+      --add-flag $out/share/github-desktop/resources/app \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
+      --inherit-argv0
+
+    mkdir -p $out/share/icons/hicolor/512x512/apps
+    ln -s $out/share/github-desktop/resources/app/static/icon-logo.png $out/share/icons/hicolor/512x512/apps/github-desktop.png
+
     runHook postInstall
   '';
 
-  preFixup = ''
-    gappsWrapperArgs+=(
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-wayland-ime=true}}"
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libglvnd ]}
-    )
-  '';
-
-  runtimeDependencies = [
-    systemdLibs
-  ];
+  passthru = {
+    inherit (finalAttrs) cacheRoot cacheApp;
+    updateScript = _experimental-update-script-combinators.sequence [
+      (nix-update-script {
+        extraArgs = [
+          "--version-regex"
+          ''^release-(\d\.\d\.\d)$''
+        ];
+      })
+      # TODO: in the future, use `nix-update --custom-dep`.
+      ./update-yarn-caches.sh
+    ];
+  };
 
   meta = {
     description = "GUI for managing Git and GitHub";
-    homepage = "https://desktop.github.com/";
+    homepage = "https://desktop.github.com";
+    changelog = "https://desktop.github.com/release-notes";
+    downloadPage = "https://desktop.github.com/download";
     license = lib.licenses.mit;
     mainProgram = "github-desktop";
-    maintainers = [ ];
-    platforms = lib.platforms.linux;
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    maintainers = with lib.maintainers; [ dtomvan ];
+    inherit (electron.meta) platforms;
   };
 })
diff --git a/pkgs/by-name/gi/github-desktop/update-yarn-caches.sh b/pkgs/by-name/gi/github-desktop/update-yarn-caches.sh
new file mode 100755
index 000000000000..21909d82c06e
--- /dev/null
+++ b/pkgs/by-name/gi/github-desktop/update-yarn-caches.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix gnused common-updater-scripts
+
+set -euxo pipefail
+
+cd "$(dirname $0)"
+
+setKV() {
+  sed -i "s|$1 = \".*\"|$1 = \"${2:-}\"|" package.nix
+}
+
+for cache in cacheApp cacheRoot; do
+  hashKey="${cache}Hash"
+  setKV "$hashKey" sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
+
+  pushd ../../../..
+  set +e
+  newHash="$(nix-build --no-out-link -A github-desktop.$cache 2>&1 >/dev/null | grep "got:" | cut -d':' -f2 | sed 's| ||g')"
+  set -e
+  popd
+
+  if [ -z "$newHash" ]; then
+    echo Failed to update hash for $cache
+    exit 1
+  fi
+  setKV "$hashKey" "$newHash"
+done
diff --git a/pkgs/by-name/js/jsonschema-cli/package.nix b/pkgs/by-name/js/jsonschema-cli/package.nix
index 65817362a240..91c508cb1f5c 100644
--- a/pkgs/by-name/js/jsonschema-cli/package.nix
+++ b/pkgs/by-name/js/jsonschema-cli/package.nix
@@ -9,15 +9,15 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "jsonschema-cli";
-  version = "0.45.0";
+  version = "0.46.0";
 
   src = fetchCrate {
     pname = "jsonschema-cli";
     inherit (finalAttrs) version;
-    hash = "sha256-9pz07T7i7pxNNOV/YGbneIA45VG9uBzhI+ygwknW07Q=";
+    hash = "sha256-tpapiI6FYHEgmI0XY5KZNNsZxKxkEN4BIJaNQXsMIJI=";
   };
 
-  cargoHash = "sha256-EiLXX0wZi9v8vsMxCeg8/XMfWH9FckuNjqPpLEUK5lc=";
+  cargoHash = "sha256-1Wih2VwK3hzdjuoAZI/1j0jPwWwL4l4y4rQRX0VV4Sc=";
 
   preCheck = ''
     export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
diff --git a/pkgs/by-name/ku/kubecolor/package.nix b/pkgs/by-name/ku/kubecolor/package.nix
index 410e41c0905a..b56665058b86 100644
--- a/pkgs/by-name/ku/kubecolor/package.nix
+++ b/pkgs/by-name/ku/kubecolor/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubecolor";
-  version = "0.5.3";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "kubecolor";
     repo = "kubecolor";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-F/ws7KevH0mGtSqp+iHyWpNccIBdF5gIoZfmLJ5H4YM=";
+    sha256 = "sha256-1eLt75w/l6AQDDUMhKIvWnaQox87r5M3c30AtpNyZFw=";
   };
 
-  vendorHash = "sha256-QenYTQTNXaBvzpyVHOCx3lEheiWZMfulEfzB+ll+q+4=";
+  vendorHash = "sha256-oTeDByJ81eWCCsIHyuScQS+lhE9cHqiATIlw2UdUZNo=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/la/lazyhetzner/package.nix b/pkgs/by-name/la/lazyhetzner/package.nix
index fb7e20ce1003..03ab775dbc4d 100644
--- a/pkgs/by-name/la/lazyhetzner/package.nix
+++ b/pkgs/by-name/la/lazyhetzner/package.nix
@@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "lazyhetzner";
-  version = "1.1.1";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "grammeaway";
     repo = "lazyhetzner";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QFtlcio3yVyltoTqYH8RJknx/tKpn6dNu1WwnLLJY/A=";
+    hash = "sha256-G7IfB/tnhPKf/tG0b2HKUshc4x+AySiHlJZNSlOJr2I=";
 
     leaveDotGit = true;
     postFetch = ''
diff --git a/pkgs/by-name/n8/n8n/package.nix b/pkgs/by-name/n8/n8n/package.nix
index 7168f00a8e3a..00fc217462bc 100644
--- a/pkgs/by-name/n8/n8n/package.nix
+++ b/pkgs/by-name/n8/n8n/package.nix
@@ -25,20 +25,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "n8n";
-  version = "2.14.2";
+  version = "2.15.0";
 
   src = fetchFromGitHub {
     owner = "n8n-io";
     repo = "n8n";
     tag = "n8n@${finalAttrs.version}";
-    hash = "sha256-nWV3DFDkBlfDdoOxwYB0HSrTyKpTt70YxAQYUPartkE=";
+    hash = "sha256-TOIJqLa68ibry9LSqMkHrJJ+v9t2bK2ybNPUDdiJ66Q=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-0SnPF3CgIja3M1ubLrwyFcx7vY0eHz9DEgn/gDLXN80=";
+    hash = "sha256-YGplNNvIOIY1BthWmejAzucXujq8AkgPJus774GmWCA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/no/nominatim/nominatim-api.nix b/pkgs/by-name/no/nominatim/nominatim-api.nix
index 0280d402f82b..762257db1d96 100644
--- a/pkgs/by-name/no/nominatim/nominatim-api.nix
+++ b/pkgs/by-name/no/nominatim/nominatim-api.nix
@@ -12,16 +12,16 @@
   sqlalchemy,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "nominatim";
-  version = "5.3.0";
+  version = "5.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "osm-search";
     repo = "Nominatim";
-    tag = "v${version}";
-    hash = "sha256-cICDzsEJ2yRi8PaQpjfVC9ZI3KeQPiqGu4U1nTxxBvk=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-3WU8n121JbFFZTntcKG6t0x2mC1AzI97q/fMe/UTGTs=";
   };
 
   postPatch = ''
@@ -34,9 +34,7 @@ buildPythonPackage rec {
     cd packaging/nominatim-api
   '';
 
-  build-system = [
-    hatchling
-  ];
+  build-system = [ hatchling ];
 
   dependencies = [
     async-timeout
@@ -61,4 +59,4 @@ buildPythonPackage rec {
       ngi
     ];
   };
-}
+})
diff --git a/pkgs/by-name/nu/nushell/package.nix b/pkgs/by-name/nu/nushell/package.nix
index 923b5481191a..2555ec7ad100 100644
--- a/pkgs/by-name/nu/nushell/package.nix
+++ b/pkgs/by-name/nu/nushell/package.nix
@@ -24,16 +24,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # NOTE: when updating this to a new non-patch version, please also try to
   # update the plugins. Plugins only work if they are compiled for the same
   # major/minor version.
-  version = "0.111.0";
+  version = "0.112.1";
 
   src = fetchFromGitHub {
     owner = "nushell";
     repo = "nushell";
     tag = finalAttrs.version;
-    hash = "sha256-/jS75aVUCLWDq3zw8yv2pUjUneyYSngfELuKfDQtqqA=";
+    hash = "sha256-y0EfP95XEVvse0xaSWK5Yr748tTVYRG7Bx+Qf5JrlYY=";
   };
 
-  cargoHash = "sha256-7hXmBNvNRdO4pXfF7RNcPrB7BmKL/BWqjQoz6pB4P2A=";
+  cargoHash = "sha256-Y/yaWj2akccehFVxrGHrsjzZd02L8qE9KoSSwzAeEwg=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/nz/nzbhydra2/package.nix b/pkgs/by-name/nz/nzbhydra2/package.nix
index dcb4014ce633..fa52d77f1d05 100644
--- a/pkgs/by-name/nz/nzbhydra2/package.nix
+++ b/pkgs/by-name/nz/nzbhydra2/package.nix
@@ -35,13 +35,13 @@ let
 in
 maven.buildMavenPackage rec {
   pname = "nzbhydra2";
-  version = "8.5.3";
+  version = "8.5.4";
 
   src = fetchFromGitHub {
     owner = "theotherp";
     repo = "nzbhydra2";
     tag = "v${version}";
-    hash = "sha256-yaXHbm2gBvmmST4Rurn7s4a1F7GSKfuYhswIDl8bTMA=";
+    hash = "sha256-chP++0ve734wOO7qNy4f+4KyYgBWlkzjaMJiueW4LkM=";
   };
 
   mvnHash = "sha256-dodZT40zNqfaPd8VxfNYY10VrFNlL4xESDdTrgcFaaY=";
@@ -90,6 +90,7 @@ maven.buildMavenPackage rec {
   meta = {
     description = "Usenet meta search";
     homepage = "https://github.com/theotherp/nzbhydra2";
+    changelog = "https://github.com/theotherp/nzbhydra2/releases/tag/v${version}";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [
       matteopacini
diff --git a/pkgs/by-name/ra/radcli/package.nix b/pkgs/by-name/ra/radcli/package.nix
index f60a527e42bc..42ec2653ec4a 100644
--- a/pkgs/by-name/ra/radcli/package.nix
+++ b/pkgs/by-name/ra/radcli/package.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "radcli";
     repo = "radcli";
     tag = finalAttrs.version;
-    hash = "sha256-PpPKNH9gDE9FewDCeBCog3p5C6FBBYBPVnhahVHYKnA=";
+    hash = "sha256-Q+rcNhYmQpEE5LYC/zvbh4RIxx2g9djuWmrSUdh00+c=";
   };
 
   postUnpack = ''
diff --git a/pkgs/by-name/re/renode-unstable/package.nix b/pkgs/by-name/re/renode-unstable/package.nix
index f4a0c0ec0394..15c6772e4c73 100644
--- a/pkgs/by-name/re/renode-unstable/package.nix
+++ b/pkgs/by-name/re/renode-unstable/package.nix
@@ -14,13 +14,13 @@ let
 in
 renode.overrideAttrs (old: rec {
   pname = "renode-unstable";
-  version = "1.16.1-unstable-2026-04-03";
+  version = "1.16.1-unstable-2026-04-12";
 
   src = fetchFromGitHub {
     owner = "renode";
     repo = "renode";
-    rev = "a5e76fbb6f3b2a15e6b1e3bfe021fdc2619f773a";
-    hash = "sha256-FCeZ/6Dp/IgFgaKu589rMAOk0NIisR4uJyCKcuSsM90=";
+    rev = "1ad93ffd5b0f2d67ff04f593de6318d12379d897";
+    hash = "sha256-MOCjxn4VB9uaq5UkHbZiGOdJDetUP816lnuPN0kXjTM=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/ro/rocketchat-desktop/package.nix b/pkgs/by-name/ro/rocketchat-desktop/package.nix
index f1a0d6952860..ff8b89b8a7d9 100644
--- a/pkgs/by-name/ro/rocketchat-desktop/package.nix
+++ b/pkgs/by-name/ro/rocketchat-desktop/package.nix
@@ -21,13 +21,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "rocketchat-desktop";
-  version = "4.13.0";
+  version = "4.14.0";
 
   src = fetchFromGitHub {
     owner = "RocketChat";
     repo = "Rocket.Chat.Electron";
     tag = finalAttrs.version;
-    hash = "sha256-u2bGCtF+PBYUsYUytgJfhDVXlCwEeQCon5iRecvspEI=";
+    hash = "sha256-5p0WmTKHqiRtNeWxJuBUKVHc2DHtAGMyBsXq9SpytWA=";
   };
 
   # This might need to be updated between releases.
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   offlineCache = yarn-berry.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes;
-    hash = "sha256-OevWuXmLlDPENVpc7L5mCY+iguqtrEeoFBHmD8YAxeY=";
+    hash = "sha256-Y6wdGp8Q5DW3f7pIrcE3ElKHFHYPxcAQFiM4R1cSYUA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sd/sdformat/package.nix b/pkgs/by-name/sd/sdformat/package.nix
new file mode 100644
index 000000000000..1c84dcf5950a
--- /dev/null
+++ b/pkgs/by-name/sd/sdformat/package.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  util-linuxMinimal,
+  installShellFiles,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "sdformat";
+  version = "0.2.0";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "profi200";
+    repo = "sdFormatLinux";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-AoAhP1dr+hQSnOpZC0oHt0j3fUVNVhD+3jWm6iMfskk=";
+  };
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  patches = [ ./remove-hardcoded-lsblk-path.diff ];
+
+  strictDeps = true;
+
+  makeFlags = [
+    "TARGET=${finalAttrs.pname}"
+    "LSBLK_PATH=${lib.getExe' util-linuxMinimal "lsblk"}"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    installBin ${finalAttrs.pname}
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Format your SD card the way the SD Association intended";
+    homepage = "https://github.com/profi200/sdFormatLinux";
+    license = lib.licenses.mit;
+    mainProgram = finalAttrs.pname;
+    maintainers = with lib.maintainers; [ thiagokokada ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/sd/sdformat/remove-hardcoded-lsblk-path.diff b/pkgs/by-name/sd/sdformat/remove-hardcoded-lsblk-path.diff
new file mode 100644
index 000000000000..22d786ae9fb7
--- /dev/null
+++ b/pkgs/by-name/sd/sdformat/remove-hardcoded-lsblk-path.diff
@@ -0,0 +1,39 @@
+diff --git i/Makefile w/Makefile
+index c45b32b..258189c 100644
+--- i/Makefile
++++ w/Makefile
+@@ -5,7 +5,8 @@ TARGET   := $(notdir $(CURDIR))
+ BUILD    := build
+ INCLUDES := include
+ SOURCES  := source
+-DEFINES  := -D_FORTIFY_SOURCE=2
++LSBLK_PATH ?= /usr/bin/lsblk
++DEFINES  := -D_FORTIFY_SOURCE=2 -DLSBLK_PATH=\"$(LSBLK_PATH)\"
+ 
+ 
+ # Compiler settings
+diff --git i/source/blockdev.cpp w/source/blockdev.cpp
+index a179604..b4de5ef 100644
+--- i/source/blockdev.cpp
++++ w/source/blockdev.cpp
+@@ -7,6 +7,7 @@
+ #include <errno.h>
+ #include <fcntl.h>     // open()...
+ #include <linux/fs.h>  // BLKGETSIZE64...
++#include <limits.h>    // PATH_MAX
+ #include <sys/ioctl.h> // ioctl()...
+ #include <sys/stat.h>  // S_IRUSR, S_IWUSR...
+ #include <unistd.h>    // write(), close()...
+@@ -21,8 +22,10 @@
+ static int checkDevice(const char *const path)
+ {
+ 	int res = EINVAL; // By default assume the given path is not a suitable device.
+-	char cmd[64] = "/usr/bin/lsblk -dnr -oTYPE,HOTPLUG,PHY-SEC ";
+-	strncpy(&cmd[43], path, sizeof(cmd) - 43);
++	const char cmdPrefix[] = LSBLK_PATH " -dnr -oTYPE,HOTPLUG,PHY-SEC ";
++	char cmd[sizeof(cmdPrefix) + PATH_MAX];
++	memcpy(cmd, cmdPrefix, sizeof(cmdPrefix) - 1);
++	strncpy(&cmd[sizeof(cmdPrefix) - 1], path, sizeof(cmd) - sizeof(cmdPrefix));
+ 	cmd[sizeof(cmd) - 1] = '\0';
+ 	FILE *const p = ::popen(cmd, "r");
+ 	if(p == nullptr)
diff --git a/pkgs/by-name/sh/shaka-packager/package.nix b/pkgs/by-name/sh/shaka-packager/package.nix
index 44eb296226a2..b4f01d912c02 100644
--- a/pkgs/by-name/sh/shaka-packager/package.nix
+++ b/pkgs/by-name/sh/shaka-packager/package.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "shaka-packager";
-  version = "3.7.1";
+  version = "3.7.2";
 
   src = fetchFromGitHub {
     owner = "shaka-project";
     repo = "shaka-packager";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-z98DXYa/M0SvohNxFWXPJGBSPWJzrz8oFUBO5DajknE=";
+    hash = "sha256-E493sleVbsuytneK51lxuQnaEzvAEJwAXYmsxcaOXSs=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sp/spire-tpm-plugin/package.nix b/pkgs/by-name/sp/spire-tpm-plugin/package.nix
new file mode 100644
index 000000000000..299bae4d1d00
--- /dev/null
+++ b/pkgs/by-name/sp/spire-tpm-plugin/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  openssl,
+  tpm2-tools,
+  xxd,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "spire-tpm-plugin";
+  version = "1.11.1";
+
+  src = fetchFromGitHub {
+    owner = "spiffe";
+    repo = "spire-tpm-plugin";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-6hy1aQg0tS2wxOZRbZLv82HQEufVmW/a5L6Da+bNeHU=";
+  };
+
+  proxyVendor = true;
+  vendorHash = "sha256-cENDkx/iz6H/AhAO1lKypHhOFz+F3gC3bMg8Jw7eeo0=";
+
+  ldflags = [ "-s" ];
+
+  buildInputs = [ openssl ];
+
+  nativeCheckInputs = [
+    openssl.bin
+    tpm2-tools
+    xxd
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "Provides agent and server plugins for SPIRE to allow TPM 2-based node attestation";
+    homepage = "https://github.com/spiffe/spire-tpm-plugin";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ arianvp ];
+  };
+})
diff --git a/pkgs/by-name/tc/tcping-rs/package.nix b/pkgs/by-name/tc/tcping-rs/package.nix
index 715ec913de2d..df108e82e57f 100644
--- a/pkgs/by-name/tc/tcping-rs/package.nix
+++ b/pkgs/by-name/tc/tcping-rs/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tcping-rs";
-  version = "1.2.24";
+  version = "1.2.26";
 
   src = fetchFromGitHub {
     owner = "lvillis";
     repo = "tcping-rs";
     tag = finalAttrs.version;
-    hash = "sha256-gsTZls5guqtDk8x+3q4nFYGwhr+TAV5iE9kiZgbmzCI=";
+    hash = "sha256-qcvoV57t36c230p7KRec9CBIb+F+dVeGU4EVs0DrREM=";
   };
 
-  cargoHash = "sha256-m/juo6+SPFAxQ7E2JgTkv47kxn4LhwfI4UGSDzHAXMc=";
+  cargoHash = "sha256-Y+Hv4oWHTzC/8DQ6/wQ3QLtDy/rqQs+89x312cYOpKY=";
 
   checkFlags = [
     # This test requires external network access
diff --git a/pkgs/by-name/up/updatecli/package.nix b/pkgs/by-name/up/updatecli/package.nix
index 8f574346f95a..06da056b38c0 100644
--- a/pkgs/by-name/up/updatecli/package.nix
+++ b/pkgs/by-name/up/updatecli/package.nix
@@ -12,16 +12,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "updatecli";
-  version = "0.115.0";
+  version = "0.116.0";
 
   src = fetchFromGitHub {
     owner = "updatecli";
     repo = "updatecli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-TUFOtMABC8Ut9EHhEveyLK9UTDxRS5Yz6znj4lhHfCU=";
+    hash = "sha256-34XXA8cBifuPC4Sls34D4kFkMOv9+1oYV3ZqPrWF1zY=";
   };
 
-  vendorHash = "sha256-z1nACmowcOerHWSI2SDRlombb8coYsrDTYaHY9eFPMQ=";
+  vendorHash = "sha256-UK6KC/NsEy08mK2tikpAN+H4C61cyHGzqqeoz5kylEg=";
 
   # tests require network access
   doCheck = false;
diff --git a/pkgs/by-name/va/vaultwarden/package.nix b/pkgs/by-name/va/vaultwarden/package.nix
index 7e6808d5fa5d..734613e0a079 100644
--- a/pkgs/by-name/va/vaultwarden/package.nix
+++ b/pkgs/by-name/va/vaultwarden/package.nix
@@ -19,16 +19,16 @@ in
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "vaultwarden";
-  version = "1.35.4";
+  version = "1.35.6";
 
   src = fetchFromGitHub {
     owner = "dani-garcia";
     repo = "vaultwarden";
     tag = finalAttrs.version;
-    hash = "sha256-NphgKTlyVsH42TEGU8unhL798jTQMkS5JyNckKhk8YM=";
+    hash = "sha256-Q5D/tDE7rC9/iIaD0WlGr2AaoCdAEJQs++8uOdYgRXo=";
   };
 
-  cargoHash = "sha256-PkFxHhFrdVB/hfSoT6j87K4IEknl+ZO1omGHrXBWEMg=";
+  cargoHash = "sha256-LSmzR3X04i2dmPwj1ivPm/YeNtxGhfwsEXG93iVvhrI=";
 
   # used for "Server Installed" version in admin panel
   env.VW_VERSION = finalAttrs.version;
diff --git a/pkgs/by-name/wa/wasmtime/package.nix b/pkgs/by-name/wa/wasmtime/package.nix
index 5200b7c99978..73ca5330e8f2 100644
--- a/pkgs/by-name/wa/wasmtime/package.nix
+++ b/pkgs/by-name/wa/wasmtime/package.nix
@@ -13,20 +13,20 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wasmtime";
-  version = "43.0.0";
+  version = "43.0.1";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "wasmtime";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zCU3CtqbqagSWQZULvTxCRwK709ZfyL9PGtjJpNAYQE=";
+    hash = "sha256-KnsnR9SJoAfKsEIwKRy+AKEdDFQMBfIwISJpEef8kFo=";
     fetchSubmodules = true;
   };
 
   # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
   auditable = false;
 
-  cargoHash = "sha256-WJz7J9FHGRqni889o2omkC1K+rwZ8iM6SarT1nd1p0Q=";
+  cargoHash = "sha256-nfO16qAYL2NXaV9S1HTPIH+pyYLjWCo2I1EONJf7W74=";
   cargoBuildFlags = [
     "--package"
     "wasmtime-cli"
diff --git a/pkgs/development/interpreters/lfe/default.nix b/pkgs/development/interpreters/lfe/default.nix
index 33ad3d90bae0..1ec1f7a31f73 100644
--- a/pkgs/development/interpreters/lfe/default.nix
+++ b/pkgs/development/interpreters/lfe/default.nix
@@ -68,18 +68,23 @@ else
 
     beamDeps = [ proper ];
 
-    makeFlags = [
-      "-e"
-      "MANDB=''"
-      "PREFIX=$$out"
-    ];
-
     # override buildRebar3's install to let the builder use make install
-    installPhase = "";
+    installPhase = ''
+      runHook preInstall
+      make -e MANDB= PREFIX=$out install
+      runHook postInstall
+    '';
 
     doCheck = true;
     checkTarget = "travis";
 
+    doInstallCheck = true;
+    installCheckPhase = ''
+      runHook preInstallCheck
+      test -e $out/bin/lfe
+      runHook postInstallCheck
+    '';
+
     postFixup = ''
       # LFE binaries are shell scripts which run erl and lfe.
       # Add some stuff to PATH so the scripts can run without problems.
diff --git a/pkgs/development/python-modules/adlfs/default.nix b/pkgs/development/python-modules/adlfs/default.nix
index 63379df0f0f3..58bc5e9164f4 100644
--- a/pkgs/development/python-modules/adlfs/default.nix
+++ b/pkgs/development/python-modules/adlfs/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "adlfs";
-  version = "2026.2.0";
+  version = "2026.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fsspec";
     repo = "adlfs";
     tag = finalAttrs.version;
-    hash = "sha256-wpj0MTpP5fBKTWA7sy4eRQo084pc+oNZgHVieC5NL2A=";
+    hash = "sha256-lqEyREVMdo59NhDZVdOb+w2bf5JVDg/nQHYhC+hKglo=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/aioopenexchangerates/default.nix b/pkgs/development/python-modules/aioopenexchangerates/default.nix
index 12ecf2f9b239..e19043d9043e 100644
--- a/pkgs/development/python-modules/aioopenexchangerates/default.nix
+++ b/pkgs/development/python-modules/aioopenexchangerates/default.nix
@@ -5,27 +5,27 @@
   buildPythonPackage,
   fetchFromGitHub,
   mashumaro,
-  poetry-core,
   pytest-aiohttp,
   pytest-cov-stub,
   pytestCheckHook,
+  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "aioopenexchangerates";
-  version = "0.6.21";
+  version = "0.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "MartinHjelmare";
     repo = "aioopenexchangerates";
-    tag = "v${version}";
-    hash = "sha256-yPi2k1ajW+X78dF3OJTdGR3h8mzNfYCsW0P8baKUjoA=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-pNjpeoXBlz2bdUeEsOlW7RJmbKTZGuBVTLHymGHwAiY=";
   };
 
   pythonRelaxDeps = [ "pydantic" ];
 
-  build-system = [ poetry-core ];
+  build-system = [ setuptools ];
 
   dependencies = [
     aiohttp
@@ -44,8 +44,8 @@ buildPythonPackage rec {
   meta = {
     description = "Library for the Openexchangerates API";
     homepage = "https://github.com/MartinHjelmare/aioopenexchangerates";
-    changelog = "https://github.com/MartinHjelmare/aioopenexchangerates/blob/v${version}/CHANGELOG.md";
-    license = with lib.licenses; [ asl20 ];
+    changelog = "https://github.com/MartinHjelmare/aioopenexchangerates/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/asyncio-dgram/default.nix b/pkgs/development/python-modules/asyncio-dgram/default.nix
index 0d8f652baf71..eb0ae2f6528d 100644
--- a/pkgs/development/python-modules/asyncio-dgram/default.nix
+++ b/pkgs/development/python-modules/asyncio-dgram/default.nix
@@ -3,24 +3,24 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
+  hatchling,
   pytest-asyncio,
   pytestCheckHook,
-  setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "asyncio-dgram";
-  version = "2.2.0";
+  version = "3.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jsbronder";
     repo = "asyncio-dgram";
-    tag = "v${version}";
-    hash = "sha256-9aO3xFmoR74uZSzxBPRVvz0QSW15TAdWEszLBX8AUR4=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-08XQHx+ArduVdkK5ZYq2lL2OWF9CvdSWcNLfc7ey2wI=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ hatchling ];
 
   nativeCheckInputs = [
     pytest-asyncio
@@ -41,8 +41,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python support for higher level Datagram";
     homepage = "https://github.com/jsbronder/asyncio-dgram";
-    changelog = "https://github.com/jsbronder/asyncio-dgram/blob/v${version}/ChangeLog";
+    changelog = "https://github.com/jsbronder/asyncio-dgram/blob/v${finalAttrs.src.tag}/ChangeLog";
     license = with lib.licenses; [ mit ];
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/beetcamp/default.nix b/pkgs/development/python-modules/beetcamp/default.nix
index b279660c821c..3b8e97d9234a 100644
--- a/pkgs/development/python-modules/beetcamp/default.nix
+++ b/pkgs/development/python-modules/beetcamp/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "beetcamp";
-  version = "0.24.1";
+  version = "0.24.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "snejus";
     repo = "beetcamp";
     tag = finalAttrs.version;
-    hash = "sha256-Oe5pZ4gYgqBHuzt9LBe4G14+RYXrNL+L5GIGMMflyMI=";
+    hash = "sha256-AMHj7rsPAxUUvVg6vri2NnkO9+5NAVwGrWLvNvOtlLs=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/beets-alternatives/default.nix b/pkgs/development/python-modules/beets-alternatives/default.nix
index 3cfc70696255..ec30ac64bade 100644
--- a/pkgs/development/python-modules/beets-alternatives/default.nix
+++ b/pkgs/development/python-modules/beets-alternatives/default.nix
@@ -32,6 +32,18 @@ buildPythonPackage rec {
     hash = "sha256-leZYXf6Oo/jAKbnJbP+rTnuRsh9P1BQXYAbthMNT60A=";
   };
 
+  patches = [
+    # Fixes a failing test, see:
+    # https://github.com/geigerzaehler/beets-alternatives/issues/212
+    (fetchpatch {
+      url = "https://github.com/geigerzaehler/beets-alternatives/commit/8b75974636897aabcf2ca75fb0987f7beb68f50f.patch";
+      hash = "sha256-lIJwuf3UklcJM4m7CO2+aNpPekHXuC5rpPVjK+kb+FQ=";
+      includes = [
+        "test/cli_test.py"
+      ];
+    })
+  ];
+
   build-system = [
     hatchling
   ];
diff --git a/pkgs/development/python-modules/beets/default.nix b/pkgs/development/python-modules/beets/default.nix
index 0206b6e48488..37f7ee3783cb 100644
--- a/pkgs/development/python-modules/beets/default.nix
+++ b/pkgs/development/python-modules/beets/default.nix
@@ -27,7 +27,6 @@
   lib,
   stdenv,
   buildPythonPackage,
-  pythonAtLeast,
   fetchFromGitHub,
 
   # build-system
@@ -113,16 +112,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "beets";
-  version = "2.8.0";
+  version = "2.9.0";
   src = fetchFromGitHub {
     owner = "beetbox";
     repo = "beets";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8sYoy11eocn7UDeTuaPqOxXZLdUqkabU4DMNLBD5Xp4=";
+    hash = "sha256-dJhWKZwhKXyFQVO9xt2v/NSa7bSg0e78zga/t9dlTyE=";
   };
   pyproject = true;
-  # Waiting for https://github.com/beetbox/beets/pull/6267
-  disabled = pythonAtLeast "3.14";
 
   patches = extraPatches;
 
@@ -181,6 +178,7 @@ buildPythonPackage (finalAttrs: {
   ];
 
   nativeCheckInputs = [
+    ffmpeg
     pytestCheckHook
     pytest-cov-stub
     pytest-flask
@@ -273,13 +271,12 @@ buildPythonPackage (finalAttrs: {
         bareasc = { };
         beatport.propagatedBuildInputs = [ requests-oauthlib ];
         bench.testPaths = [ ];
-        bpd.testPaths = [ ];
+        bpd = { };
         bpm.testPaths = [ ];
         bpsync.testPaths = [ ];
         bucket = { };
         chroma = {
           propagatedBuildInputs = [ pyacoustid ];
-          testPaths = [ ];
           wrapperBins = [
             chromaprint
           ];
diff --git a/pkgs/development/python-modules/certihound/default.nix b/pkgs/development/python-modules/certihound/default.nix
new file mode 100644
index 000000000000..a403d6a70200
--- /dev/null
+++ b/pkgs/development/python-modules/certihound/default.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  ldap3,
+  impacket,
+  cryptography,
+  pydantic,
+  click,
+  rich,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "certihound";
+  version = "0.3.0";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-ERJ5fbYikhKLwchSIBe5s4KF/1HsXZ1O00QnYXAe+ps=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    ldap3
+    impacket
+    cryptography
+    pydantic
+    click
+    rich
+  ];
+
+  # Tests are stripped in pypi
+  doCheck = false;
+
+  pythonImportsCheck = [ "certihound" ];
+
+  meta = {
+    homepage = "https://github.com/0x0Trace/Certihound";
+    description = "Active Directory Certificate Services (ADCS) enumeration library with BloodHound CE v6 export support";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ letgamer ];
+  };
+})
diff --git a/pkgs/development/python-modules/chromadb/default.nix b/pkgs/development/python-modules/chromadb/default.nix
index 25f2b15209b1..000a11787feb 100644
--- a/pkgs/development/python-modules/chromadb/default.nix
+++ b/pkgs/development/python-modules/chromadb/default.nix
@@ -68,19 +68,19 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "chromadb";
-  version = "1.5.5";
+  version = "1.5.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "chroma-core";
     repo = "chroma";
     tag = finalAttrs.version;
-    hash = "sha256-Y/M7awTi2AJTh4xRY0MIfnC9ygy62fG7X3W9QUxW2XE=";
+    hash = "sha256-JrkfLwEL7iTL9P/4UDM4hFQtRL1JYH47dgZ1d+Mphqw=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-yx5OMZSWRAP732lRypap79vr2I72aT+TWooo+5e0wDQ=";
+    hash = "sha256-Szy2mSTriMwMViVTbI+0XaizcQBKh1Ncipf84moDREI=";
   };
 
   # Can't use fetchFromGitHub as the build expects a zipfile
@@ -102,7 +102,12 @@ buildPythonPackage (finalAttrs: {
                        "anonymized_telemetry: bool = False"
     ''
     # error: queries overflow the depth limit!
+    # https://github.com/chroma-core/chroma/issues/6891
+    # https://github.com/chroma-core/chroma/issues/6892
+    # https://github.com/chroma-core/chroma/issues/6687
     + ''
+      sed -i '1i #![recursion_limit = "256"]' rust/blockstore/src/lib.rs
+      sed -i '1i #![recursion_limit = "256"]' rust/index/src/lib.rs
       sed -i '1i #![recursion_limit = "256"]' rust/segment/src/lib.rs
     '';
 
diff --git a/pkgs/development/python-modules/claude-agent-sdk/default.nix b/pkgs/development/python-modules/claude-agent-sdk/default.nix
index 1e7387e84dfe..059e74dce539 100644
--- a/pkgs/development/python-modules/claude-agent-sdk/default.nix
+++ b/pkgs/development/python-modules/claude-agent-sdk/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "claude-agent-sdk";
-  version = "0.1.56";
+  version = "0.1.58";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "anthropics";
     repo = "claude-agent-sdk-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lpgRTDaGJGFnhs60we+YqBurvMi/dmC5Y80RfJP8NS0=";
+    hash = "sha256-Xpl6/9+e1MFjCG/5fCzubAFIfLejdMPnTLmNmwglEy4=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index 1963012fec26..e3dbdda8e4a5 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202604101";
+  version = "0.1.202604131";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YA6q5BMQ+71Jn54KEqAqt7LMg+t36f56paDtMYQcHGc=";
+    hash = "sha256-NFEhmbq0vAn0mZtdVnzyU8TWz3FaYbodFz6wMKOdjTk=";
   };
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix b/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix
index dc9024c51cae..5badc3aa4ced 100644
--- a/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix
+++ b/pkgs/development/python-modules/microsoft-kiota-abstractions/default.nix
@@ -12,19 +12,19 @@
   gitUpdater,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "microsoft-kiota-abstractions";
-  version = "1.9.10";
+  version = "1.10.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "kiota-python";
-    tag = "microsoft-kiota-abstractions-v${version}";
-    hash = "sha256-J9OLxZ3vQpChhfwjXzrGF691zco/bKv51FG20VFieN0=";
+    tag = "microsoft-kiota-abstractions-v${finalAttrs.version}";
+    hash = "sha256-KBCjVNZDPMh0wxWm8UVLsrfl2AYp3rKMjAT5c8F7+64=";
   };
 
-  sourceRoot = "${src.name}/packages/abstractions/";
+  sourceRoot = "${finalAttrs.src.name}/packages/abstractions/";
 
   build-system = [ poetry-core ];
 
@@ -57,8 +57,8 @@ buildPythonPackage rec {
   meta = {
     description = "Abstractions library for Kiota generated Python clients";
     homepage = "https://github.com/microsoft/kiota-python/tree/main/packages/abstractions/";
-    changelog = "https://github.com/microsoft/kiota-python/releases/tag/${src.tag}";
+    changelog = "https://github.com/microsoft/kiota-python/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/publicsuffixlist/default.nix b/pkgs/development/python-modules/publicsuffixlist/default.nix
index c8ee8154e42f..383cdc6b6ffd 100644
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "publicsuffixlist";
-  version = "1.0.2.20260411";
+  version = "1.0.2.20260412";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-24VElVHBxL7czt72+iDuHxw8V+ivpcOTx0wNDdmcPWM=";
+    hash = "sha256-wRQDRrKd86CZZ4bVBQXZKeeb25EQ+rUHWT+P5hEItnE=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pynfsclient/default.nix b/pkgs/development/python-modules/pynfsclient/default.nix
index 11b0d47f2939..68e528c95d01 100644
--- a/pkgs/development/python-modules/pynfsclient/default.nix
+++ b/pkgs/development/python-modules/pynfsclient/default.nix
@@ -1,30 +1,22 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
-  pythonAtLeast,
+  fetchFromGitHub,
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pynfsclient";
-  version = "0.1.5";
+  version = "1.0.6";
   pyproject = true;
 
-  disabled = pythonAtLeast "3.13";
-
-  src = fetchPypi {
-    pname = "pyNfsClient";
-    inherit version;
-    hash = "sha256-xgZL08NlMCpSkALQwklh7Xq16bK2Sm2hAynbrIWsgaU=";
+  src = fetchFromGitHub {
+    owner = "Pennyw0rth";
+    repo = "NfsClient";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-9PV/RpK/rOI9jpTDy0FmkXY2Cf54vve6j1kM5dcZgV8=";
   };
 
-  postPatch = ''
-    # HISTORY.md is missing
-    substituteInPlace setup.py \
-      --replace-fail "HISTORY.md" "README.rst"
-  '';
-
   build-system = [ setuptools ];
 
   # Module has no tests
@@ -33,9 +25,13 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "pyNfsClient" ];
 
   meta = {
-    description = "Pure python NFS client";
-    homepage = "https://pypi.org/project/pyNfsClient/";
+    description = "Pure python library to simulate NFS client";
+    homepage = "https://github.com/Pennyw0rth/NfsClient";
+    changelog = "https://github.com/Pennyw0rth/NfsClient/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ fab ];
+    maintainers = with lib.maintainers; [
+      fab
+      letgamer
+    ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/reconplogger/default.nix b/pkgs/development/python-modules/reconplogger/default.nix
index 100550fea61f..a016e303bfb8 100644
--- a/pkgs/development/python-modules/reconplogger/default.nix
+++ b/pkgs/development/python-modules/reconplogger/default.nix
@@ -11,16 +11,16 @@
   testfixtures,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "reconplogger";
-  version = "4.18.1";
+  version = "5.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "omni-us";
     repo = "reconplogger";
-    tag = "v${version}";
-    hash = "sha256-kYNidF1sTC6WulX3HXMUm+TFJWvHgZj86Asmi6uIKRs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-/+nPLji8iGTBpWTCR83JRfxMltMYjP62KrB+HRTQQE8=";
   };
 
   build-system = [ setuptools ];
@@ -52,4 +52,4 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
index 57c4df9eb4d2..a15d64ebe8ee 100644
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tencentcloud-sdk-python";
-  version = "3.1.75";
+  version = "3.1.76";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = finalAttrs.version;
-    hash = "sha256-O/heoxVZybJYZF3qFcuKXgbncClfKK21WpXGqtwxw58=";
+    hash = "sha256-21BXGAPXCyRHTqPSUjvWWbrEbxAqqeSZavqIZ6sax3Q=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/unifi-discovery/default.nix b/pkgs/development/python-modules/unifi-discovery/default.nix
index a508f25d1b33..693155141219 100644
--- a/pkgs/development/python-modules/unifi-discovery/default.nix
+++ b/pkgs/development/python-modules/unifi-discovery/default.nix
@@ -11,16 +11,16 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "unifi-discovery";
-  version = "1.3.0";
+  version = "1.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bdraco";
     repo = "unifi-discovery";
-    tag = "v${version}";
-    hash = "sha256-/SsgBiCEfMYi3DccYKBZGoYX4egGW+bBIA/D73FaneE=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-pn8WRsYGbBy4EwQ1DufY2WbbVM65dM4h8ZReG+qkr6k=";
   };
 
   build-system = [ poetry-core ];
@@ -44,9 +44,9 @@ buildPythonPackage rec {
   meta = {
     description = "Module to discover Unifi devices";
     homepage = "https://github.com/bdraco/unifi-discovery";
-    changelog = "https://github.com/bdraco/unifi-discovery/releases/tag/v${version}";
-    license = with lib.licenses; [ asl20 ];
+    changelog = "https://github.com/bdraco/unifi-discovery/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
     platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/servers/home-assistant/custom-components/mitsubishi/package.nix b/pkgs/servers/home-assistant/custom-components/mitsubishi/package.nix
index 9777ef932b99..050a1b771cd3 100644
--- a/pkgs/servers/home-assistant/custom-components/mitsubishi/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/mitsubishi/package.nix
@@ -24,6 +24,8 @@ buildHomeAssistantComponent rec {
     pymitsubishi
   ];
 
+  ignoreVersionRequirement = [ "pymitsubishi" ];
+
   nativeCheckInputs = [
     pytest-cov-stub
     pytestCheckHook
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a9dd0eda53f7..9d4502297be8 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2609,6 +2609,8 @@ self: super: with self; {
 
   certifi = callPackage ../development/python-modules/certifi { };
 
+  certihound = callPackage ../development/python-modules/certihound { };
+
   certipy = callPackage ../development/python-modules/certipy { };
 
   certipy-ad = callPackage ../development/python-modules/certipy-ad { };