diff --git a/doc/languages-frameworks/php.section.md b/doc/languages-frameworks/php.section.md
index a78bbf724206..ee6961b6ffc0 100644
--- a/doc/languages-frameworks/php.section.md
+++ b/doc/languages-frameworks/php.section.md
@@ -214,12 +214,6 @@ code, while others choose not to.
 
 In Nix, there are multiple approaches to building a Composer-based project.
 
-::: {.warning}
-`buildComposerProject2` has a [known bug](https://github.com/NixOS/nixpkgs/issues/451395)
-where the `vendorHash` changes every time a Composer release happens that changes the
-`autoload.php` or vendored composer code.
-:::
-
 One such method is the `php.buildComposerProject2` helper function, which serves
 as a wrapper around `mkDerivation`.
 
diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 23a03b8c259e..da76fb682b39 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -207,6 +207,62 @@ following are specific to `buildPythonPackage`:
 * `setupPyGlobalFlags ? []`: List of flags passed to `setup.py` command.
 * `setupPyBuildFlags ? []`: List of flags passed to `setup.py build_ext` command.
 
+##### Using fixed-point arguments {#buildpythonpackage-fixed-point-arguments}
+
+Both `buildPythonPackage` and `buildPythonApplication` support [fixed-point arguments](#chap-build-helpers-finalAttrs), similar to `stdenv.mkDerivation`.
+This allows you to reference the final attributes of the derivation.
+
+Instead of using `rec`:
+
+```nix
+buildPythonPackage rec {
+  pname = "pyspread";
+  version = "2.4";
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-...";
+  };
+}
+```
+
+You can use the `finalAttrs` pattern:
+
+```nix
+buildPythonPackage (finalAttrs: {
+  pname = "pyspread";
+  version = "2.4";
+  src = fetchPypi {
+    pname = "pyspread";
+    inherit (finalAttrs) version;
+    hash = "sha256-...";
+  };
+})
+```
+
+See the [general documentation on fixed-point arguments](#chap-build-helpers-finalAttrs) for more details on the benefits of this pattern.
+
+::: {.note}
+
+Some `buildPythonPackage`/`buildPythonApplication` arguments are passed down indirectly to `stdenv.mkDerivation` via `passthru`.
+Therefore the final state of these attributes can be accessed via `finalAttrs.passthru.${name}`.
+[`<pkg>.overrideAttrs`](#sec-pkg-overrideAttrs) can override them using the `passthru = prevAttrs.passthru // { foo = "bar"; }` pattern.
+Such arguments include:
+
+- `disabled`
+- `pyproject`
+- `format`
+- `build-system`
+- `dependencies`
+- `optional-dependencies`
+
+<!--
+TODO(@doronbehar): When `.overridePythonAttrs` will be removed, the above text might need to be revised. See:
+
+- https://github.com/NixOS/nixpkgs/pull/379637
+- https://github.com/NixOS/nixpkgs/pull/469804
+-->
+:::
+
 The [`stdenv.mkDerivation`](#sec-using-stdenv) function accepts various parameters for describing
 build inputs (see "Specifying dependencies"). The following are of special
 interest for Python packages, either because these are primarily used, or
@@ -237,29 +293,23 @@ the overrides for packages in the package set.
 ```nix
 with import <nixpkgs> { };
 
-(
-  let
-    python =
-      let
-        packageOverrides = self: super: {
-          pandas = super.pandas.overridePythonAttrs (old: rec {
-            version = "0.19.1";
-            src = fetchPypi {
-              pname = "pandas";
-              inherit version;
-              hash = "sha256-JQn+rtpy/OA2deLszSKEuxyttqBzcAil50H+JDHUdCE=";
-            };
-          });
-        };
-      in
-      pkgs.python3.override {
-        inherit packageOverrides;
-        self = python;
-      };
-
-  in
-  python.withPackages (ps: [ ps.blaze ])
-).env
+let
+  python = pkgs.python3.override {
+    packageOverrides = self: super: {
+      pandas = super.pandas.overridePythonAttrs (
+        finalAttrs: prevAttrs: {
+          version = "0.19.1";
+          src = fetchPypi {
+            pname = "pandas";
+            inherit (finalAttrs) version;
+            hash = "sha256-JQn+rtpy/OA2deLszSKEuxyttqBzcAil50H+JDHUdCE=";
+          };
+        }
+      );
+    };
+  };
+in
+(python.withPackages (ps: [ ps.blaze ])).env
 ```
 
 The next example shows a non trivial overriding of the `blas` implementation to
diff --git a/doc/redirects.json b/doc/redirects.json
index 9432997f19af..84a102769702 100644
--- a/doc/redirects.json
+++ b/doc/redirects.json
@@ -4059,6 +4059,9 @@
   "buildpythonpackage-parameters": [
     "index.html#buildpythonpackage-parameters"
   ],
+  "buildpythonpackage-fixed-point-arguments": [
+    "index.html#buildpythonpackage-fixed-point-arguments"
+  ],
   "overriding-python-build-helpers": [
     "index.html#overriding-python-build-helpers"
   ],
diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index 38e9e28f52e7..bb962fe90445 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -264,11 +264,16 @@
 
 - `python3packages.pillow-avif-plugin` has been removed as the functionality is included in `python3packages.pillow` directly since version 11.3.
 
+- `wasistlos` (previously known as `whatsapp-for-linux`) has been removed because it was unmaintained and archived upstream.
+  Multiple alternatives exist: `karere`, `whatsie` and `zapzap` among others.
+
 - `light` has been removed because it was unmaintained.
   `brightnessctl` and `acpilight` provide similar functionality.
 
 - `opensmtpd-filter-dkimsign` is now installed into `libexec/smtpd` instead of `libexec/opensmtpd` so that now it is properly linked into the environment built by `services.opensmtpd.procPackages`. If you hardcoded path to `filter-dkimsign` please consider using this option.
 
+- `shisho` has been removed because it's archived. `semgrep`, `opengrep`, and `ast-grep` provide similar functionality.
+
 - `services.openssh.settings.AcceptEnv` now explicitly defined as an option that takes a list of strings, to facilitate option merging. Setting it to a string value is no longer supported.
 
 - All Xfce packages have been moved to top level (e.g. if you previously added `pkgs.xfce.xfce4-whiskermenu-plugin` to `environment.systemPackages`, you will need to change it to `pkgs.xfce4-whiskermenu-plugin`). The `xfce` scope will be removed in NixOS 26.11.
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 653c113cecb4..0a9563a667e8 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3971,6 +3971,12 @@
     name = "Joseph Madden";
     keys = [ { fingerprint = "3CF8 E983 2219 AB4B 0E19  158E 6112 1921 C9F8 117C"; } ];
   };
+  brett = {
+    email = "brett@librum.org";
+    github = "brett";
+    githubId = 523;
+    name = "Brett Eisenberg";
+  };
   brettlyons = {
     email = "blyons@fastmail.com";
     github = "brettlyons";
@@ -13886,6 +13892,13 @@
     matrix = "@katexochen:matrix.org";
     name = "Paul Meyer";
   };
+  katok = {
+    name = "katok";
+    email = "kat.ok.timofey@gmail.com";
+    matrix = "@kat.ok:matrix.org";
+    github = "Hi-Timofey";
+    githubId = 43324422;
+  };
   katrinafyi = {
     name = "katrinafyi";
     github = "katrinafyi";
@@ -14278,6 +14291,13 @@
     githubId = 10689811;
     name = "Torben Schweren";
   };
+  kittyandrew = {
+    email = "alias.nixpkgs.maintainer@kittymail.me";
+    github = "kittyandrew";
+    githubId = 45767571;
+    matrix = "@kittyandrew:ndrew.me";
+    name = "kittyandrew";
+  };
   kittywitch = {
     email = "kat@inskip.me";
     github = "kittywitch";
@@ -26057,6 +26077,13 @@
     githubId = 26052996;
     name = "Erik Parawell";
   };
+  stealthybox = {
+    email = "leigh@null.net";
+    github = "stealthybox";
+    githubId = 2754700;
+    name = "Leigh Capili";
+    keys = [ { fingerprint = "05E7 89C9 142C DD05 8261  4EF8 5943 2144 444F B382"; } ];
+  };
   steamwalker = {
     email = "steamwalker@xs4all.nl";
     github = "steamwalker";
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index c39975840d2c..74d4753a913b 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1322,6 +1322,7 @@
   ./services/networking/nix-store-gcs-proxy.nix
   ./services/networking/nixops-dns.nix
   ./services/networking/nm-file-secret-agent.nix
+  ./services/networking/nmtrust.nix
   ./services/networking/nncp.nix
   ./services/networking/nntp-proxy.nix
   ./services/networking/nomad.nix
diff --git a/nixos/modules/programs/fish.nix b/nixos/modules/programs/fish.nix
index 979001725413..86c29477ebcc 100644
--- a/nixos/modules/programs/fish.nix
+++ b/nixos/modules/programs/fish.nix
@@ -302,7 +302,9 @@ in
                   fi
                 '';
             packages =
-              if config.documentation.nixos.enable && config.documentation.man.enable then
+              if
+                config.documentation.enable && config.documentation.nixos.enable && config.documentation.man.enable
+              then
                 builtins.filter (pkg: pkg != config.system.build.manual.nixos-configuration-reference-manpage) (
                   cfge.systemPackages ++ cfg.extraCompletionPackages
                 )
diff --git a/nixos/modules/services/monitoring/grafana-to-ntfy.nix b/nixos/modules/services/monitoring/grafana-to-ntfy.nix
index db35792363b8..e4b0bc2d09d9 100644
--- a/nixos/modules/services/monitoring/grafana-to-ntfy.nix
+++ b/nixos/modules/services/monitoring/grafana-to-ntfy.nix
@@ -9,9 +9,11 @@ let
   cfg = config.services.grafana-to-ntfy;
 in
 {
+  meta.maintainers = with lib.maintainers; [ kittyandrew ];
+
   options = {
     services.grafana-to-ntfy = {
-      enable = lib.mkEnableOption "Grafana-to-ntfy (ntfy.sh) alerts channel";
+      enable = lib.mkEnableOption "grafana-to-ntfy, a Grafana/Alertmanager to ntfy.sh bridge";
 
       package = lib.mkPackageOption pkgs "grafana-to-ntfy" { };
 
@@ -33,64 +35,127 @@ in
         };
 
         ntfyBAuthPass = lib.mkOption {
-          type = lib.types.path;
+          type = lib.types.nullOr lib.types.path;
           description = ''
             The path to the password for the specified ntfy-sh user.
             Setting this option is required when using a ntfy-sh instance with access control enabled.
           '';
           default = null;
+          example = "/run/secrets/grafana-to-ntfy-ntfy-pass";
         };
 
         bauthUser = lib.mkOption {
-          type = lib.types.str;
+          type = lib.types.nullOr lib.types.str;
           description = ''
-            The user that you will authenticate with in the Grafana webhook settings.
-            You can set this to whatever you like, as this is not the same as the ntfy-sh user.
+            The user for Basic Auth on incoming webhook requests from Grafana or Alertmanager.
+            When set together with {option}`bauthPass`, incoming requests require Basic Auth.
+            When both are null, the endpoint is open (unauthenticated).
           '';
-          default = "admin";
+          default = null;
+          example = "admin";
         };
 
         bauthPass = lib.mkOption {
-          type = lib.types.path;
-          description = "The path to the password you will use in the Grafana webhook settings.";
+          type = lib.types.nullOr lib.types.path;
+          description = ''
+            Path to the password file for Basic Auth on incoming webhook requests.
+            When set together with {option}`bauthUser`, incoming requests require Basic Auth.
+            When both are null, the endpoint is open (unauthenticated).
+          '';
+          default = null;
+          example = "/run/secrets/grafana-to-ntfy-bauth-pass";
+        };
+
+        markdown = lib.mkOption {
+          type = lib.types.bool;
+          description = "Enable Markdown formatting in ntfy notifications. Sets the X-Markdown header.";
+          default = false;
+        };
+
+        port = lib.mkOption {
+          type = lib.types.port;
+          description = "Port to listen on.";
+          default = 8080;
+        };
+
+        address = lib.mkOption {
+          type = lib.types.str;
+          description = "Address to listen on.";
+          default = "127.0.0.1";
+          example = "0.0.0.0";
         };
       };
     };
   };
 
   config = lib.mkIf cfg.enable {
-    systemd.services.grafana-to-ntfy = {
-      wantedBy = [ "multi-user.target" ];
+    assertions = [
+      {
+        assertion = (cfg.settings.bauthUser == null) == (cfg.settings.bauthPass == null);
+        message = "services.grafana-to-ntfy: bauthUser and bauthPass must both be set or both be null";
+      }
+      {
+        assertion = (cfg.settings.ntfyBAuthUser == null) == (cfg.settings.ntfyBAuthPass == null);
+        message = "services.grafana-to-ntfy: ntfyBAuthUser and ntfyBAuthPass must both be set or both be null";
+      }
+    ];
 
-      script = ''
-        export BAUTH_PASS=$(${lib.getExe' config.systemd.package "systemd-creds"} cat BAUTH_PASS_FILE)
-        ${lib.optionalString (cfg.settings.ntfyBAuthPass != null) ''
-          export NTFY_BAUTH_PASS=$(${lib.getExe' config.systemd.package "systemd-creds"} cat NTFY_BAUTH_PASS_FILE)
-        ''}
-        exec ${lib.getExe cfg.package}
-      '';
+    systemd.services.grafana-to-ntfy = {
+      description = "Grafana/Alertmanager to ntfy.sh bridge";
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+      after = [ "network-online.target" ];
+
+      script =
+        let
+          optionalCred = name: envVar: ''
+            export ${envVar}="$(${lib.getExe' config.systemd.package "systemd-creds"} cat ${name})"
+          '';
+        in
+        ''
+          ${lib.optionalString (cfg.settings.bauthPass != null) (optionalCred "BAUTH_PASS_FILE" "BAUTH_PASS")}
+          ${lib.optionalString (cfg.settings.ntfyBAuthPass != null) (
+            optionalCred "NTFY_BAUTH_PASS_FILE" "NTFY_BAUTH_PASS"
+          )}
+          exec ${lib.getExe cfg.package}
+        '';
 
       environment = {
         NTFY_URL = cfg.settings.ntfyUrl;
+        ROCKET_PORT = toString cfg.settings.port;
+        ROCKET_ADDRESS = cfg.settings.address;
+      }
+      // lib.optionalAttrs (cfg.settings.bauthUser != null) {
         BAUTH_USER = cfg.settings.bauthUser;
       }
       // lib.optionalAttrs (cfg.settings.ntfyBAuthUser != null) {
         NTFY_BAUTH_USER = cfg.settings.ntfyBAuthUser;
+      }
+      // lib.optionalAttrs cfg.settings.markdown {
+        MARKDOWN = "true";
       };
 
       serviceConfig = {
-        LoadCredential = [
-          "BAUTH_PASS_FILE:${cfg.settings.bauthPass}"
-        ]
-        ++ lib.optional (
-          cfg.settings.ntfyBAuthPass != null
-        ) "NTFY_BAUTH_PASS_FILE:${cfg.settings.ntfyBAuthPass}";
+        LoadCredential =
+          lib.optional (cfg.settings.bauthPass != null) "BAUTH_PASS_FILE:${cfg.settings.bauthPass}"
+          ++ lib.optional (
+            cfg.settings.ntfyBAuthPass != null
+          ) "NTFY_BAUTH_PASS_FILE:${cfg.settings.ntfyBAuthPass}";
 
         DynamicUser = true;
+
+        Restart = "always";
+        RestartSec = 5;
+
+        # Hardening
+        AmbientCapabilities = [ "" ];
         CapabilityBoundingSet = [ "" ];
-        DeviceAllow = "";
+        DevicePolicy = "closed";
         LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
         PrivateDevices = true;
+        PrivateTmp = true;
         PrivateUsers = true;
         ProcSubset = "pid";
         ProtectClock = true;
@@ -101,6 +166,8 @@ in
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
         ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
         RestrictAddressFamilies = [
           "AF_INET"
           "AF_INET6"
@@ -108,11 +175,12 @@ in
         ];
         RestrictNamespaces = true;
         RestrictRealtime = true;
-        MemoryDenyWriteExecute = true;
+        RestrictSUIDSGID = true;
         SystemCallArchitectures = "native";
         SystemCallFilter = [
           "@system-service"
           "~@privileged"
+          "~@resources"
         ];
         UMask = "0077";
       };
diff --git a/nixos/modules/services/networking/nmtrust.nix b/nixos/modules/services/networking/nmtrust.nix
new file mode 100644
index 000000000000..710ba0b5f58f
--- /dev/null
+++ b/nixos/modules/services/networking/nmtrust.nix
@@ -0,0 +1,389 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.nmtrust;
+
+  # Resolve trusted UUIDs from ensureProfiles + extra
+  profileUUIDs = map (
+    name: config.networking.networkmanager.ensureProfiles.profiles.${name}.connection.uuid
+  ) cfg.trustedConnections;
+
+  trustedUUIDs = profileUUIDs ++ cfg.trustedUUIDsExtra;
+
+  userNames = builtins.attrNames cfg.userUnits;
+
+  # The package reads config from /etc/nmtrust/config at runtime
+  trustHelper = pkgs.nmtrust;
+
+  # Trust target names
+  trustTargets = [
+    "nmtrust-trusted"
+    "nmtrust-untrusted"
+    "nmtrust-offline"
+  ];
+
+  # Generate Conflicts= for a target (all other trust targets)
+  conflictsFor = target: map (t: "${t}.target") (builtins.filter (t: t != target) trustTargets);
+
+  # Generate systemd unit overrides for a system unit.
+  # Uses StopWhenUnneeded instead of PartOf to avoid same-transaction
+  # issues: when transitioning between targets that both want a unit
+  # (e.g. offline -> trusted for allowOffline units), PartOf on the
+  # old target would stop the unit before WantedBy on the new target
+  # can restart it. StopWhenUnneeded only stops the unit when NO
+  # active target wants it.
+  mkSystemUnitOverrides =
+    unitName: unitCfg:
+    let
+      targets = [
+        "nmtrust-trusted.target"
+      ]
+      ++ lib.optional unitCfg.allowOffline "nmtrust-offline.target";
+    in
+    {
+      unitConfig.StopWhenUnneeded = true;
+      wantedBy = targets;
+    };
+
+  # Generate user unit overrides
+  mkUserUnitOverrides =
+    unitName: unitCfg:
+    let
+      targets = [
+        "nmtrust-trusted.target"
+      ]
+      ++ lib.optional unitCfg.allowOffline "nmtrust-offline.target";
+    in
+    {
+      unitConfig.StopWhenUnneeded = true;
+      wantedBy = targets;
+    };
+
+  # NM dispatcher script
+  dispatcherScript = pkgs.writeShellScript "nmtrust-dispatcher" ''
+    case "$2" in
+      up|down|vpn-up|vpn-down|connectivity-change)
+        ${config.systemd.package}/bin/systemd-run \
+          --no-block \
+          --on-active=1s \
+          --unit=nmtrust-apply-debounce \
+          ${config.systemd.package}/bin/systemctl start nmtrust-apply.service \
+          2>/dev/null || true
+        ;;
+    esac
+  '';
+
+in
+{
+
+  #
+  # Options
+  #
+
+  options.services.nmtrust = {
+
+    enable = lib.mkEnableOption "network trust management";
+
+    trustedConnections = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = ''
+        List of NetworkManager profile names from
+        {option}`networking.networkmanager.ensureProfiles`.
+        UUIDs are resolved at evaluation time.
+      '';
+    };
+
+    trustedUUIDsExtra = lib.mkOption {
+      type = lib.types.listOf (
+        lib.types.strMatching "[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}"
+      );
+      default = [ ];
+      description = ''
+        Additional trusted connection UUIDs not managed via
+        {option}`networking.networkmanager.ensureProfiles`.
+        Must be valid UUID format.
+      '';
+    };
+
+    excludedConnectionPatterns = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
+      default = [ ];
+      description = ''
+        Glob patterns matched against connection names at runtime using
+        fnmatch(3) with FNM_NOESCAPE. Connection names are treated as
+        literal strings (no backslash interpretation).
+        Matching connections are ignored when computing trust state.
+      '';
+    };
+
+    mixedPolicy = lib.mkOption {
+      type = lib.types.enum [
+        "trusted"
+        "untrusted"
+      ];
+      default = "untrusted";
+      description = ''
+        How to treat mixed trust state (some connections trusted,
+        some untrusted).
+      '';
+    };
+
+    evalFailurePolicy = lib.mkOption {
+      type = lib.types.enum [
+        "untrusted"
+        "offline"
+      ];
+      default = "untrusted";
+      description = ''
+        How to handle trust evaluation failures (D-Bus errors, NM
+        unavailable). `"untrusted"` (default) is fail-closed: trusted-only
+        units stop. `"offline"` allows units with
+        {option}`allowOffline` to run.
+      '';
+    };
+
+    systemUnits = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.submodule {
+          options.allowOffline = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            description = "Whether this unit should also run when offline.";
+          };
+        }
+      );
+      default = { };
+      description = ''
+        System units to bind to the trusted network target.
+        Keys are systemd unit names.
+      '';
+    };
+
+    userUnits = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.attrsOf (
+          lib.types.submodule {
+            options.allowOffline = lib.mkOption {
+              type = lib.types.bool;
+              default = false;
+              description = "Whether this unit should also run when offline.";
+            };
+          }
+        )
+      );
+      default = { };
+      example = lib.literalExpression ''
+        {
+          alice = {
+            "etesync-dav.service" = { };
+            "syncthing.service" = { allowOffline = true; };
+          };
+        }
+      '';
+      description = ''
+        Per-user units to bind to the trusted network target.
+        Outer keys are usernames, inner keys are systemd unit names.
+        Users must have linger enabled
+        ({option}`users.users.<name>.linger`).
+      '';
+    };
+  };
+
+  #
+  # Config
+  #
+
+  config = lib.mkIf cfg.enable {
+
+    # --- Assertions ---
+
+    assertions =
+      # NetworkManager is required
+      [
+        {
+          assertion = config.networking.networkmanager.enable;
+          message = "services.nmtrust requires networking.networkmanager.enable = true.";
+        }
+      ]
+      ++
+        # trustedConnections -> ensureProfiles UUID resolution
+        (map (name: {
+          assertion =
+            config.networking.networkmanager.ensureProfiles.profiles ? ${name}
+            && config.networking.networkmanager.ensureProfiles.profiles.${name}.connection ? uuid;
+          message =
+            "services.nmtrust.trustedConnections references '${name}' "
+            + "but no matching networking.networkmanager.ensureProfiles entry with a UUID exists.";
+        }) cfg.trustedConnections)
+      ++
+        # userUnits -> user existence
+        (map (username: {
+          assertion = config.users.users ? ${username};
+          message =
+            "services.nmtrust.userUnits references user '${username}' "
+            + "but no matching users.users entry exists.";
+        }) userNames)
+      ++
+        # userUnits -> linger enabled
+        (map (username: {
+          assertion =
+            let
+              l = config.users.users.${username}.linger;
+            in
+            l != null && l;
+          message =
+            "services.nmtrust.userUnits references user '${username}' but "
+            + "linger is not enabled. Set users.users.${username}.linger = true to "
+            + "ensure the user's systemd instance is running for trust-based unit management. "
+            + "Note: enabling linger causes ALL of this user's enabled user services to run "
+            + "persistently, not just trust-managed units.";
+        }) (builtins.filter (u: config.users.users ? ${u}) userNames));
+
+    # --- Helper package on PATH ---
+
+    environment.systemPackages = [ trustHelper ];
+
+    # --- Runtime config file ---
+
+    environment.etc."nmtrust/config" = {
+      text =
+        let
+          toBashArray = xs: "(" + lib.concatMapStringsSep " " (x: lib.escapeShellArg x) xs + ")";
+        in
+        ''
+          # Generated by NixOS module — do not edit
+          TRUSTED_UUIDS=${toBashArray trustedUUIDs}
+          EXCLUDED_PATTERNS=${toBashArray (cfg.excludedConnectionPatterns)}
+          MIXED_POLICY=${lib.escapeShellArg cfg.mixedPolicy}
+          EVAL_FAILURE_POLICY=${lib.escapeShellArg cfg.evalFailurePolicy}
+          MANAGED_USERS=${toBashArray userNames}
+        '';
+    };
+
+    # --- tmpfiles.d ---
+
+    systemd.tmpfiles.rules = [
+      "d /run/nmtrust 0700 root root -"
+    ];
+
+    # --- System trust targets ---
+
+    systemd.targets = lib.listToAttrs (
+      map (target: {
+        name = target;
+        value = {
+          description = "Network Trust State: ${
+            if target == "nmtrust-trusted" then
+              "Trusted"
+            else if target == "nmtrust-untrusted" then
+              "Untrusted"
+            else
+              "Offline"
+          }";
+          unitConfig.Conflicts = conflictsFor target;
+        };
+      }) trustTargets
+    );
+
+    # --- User trust targets ---
+
+    systemd.user.targets = lib.listToAttrs (
+      map (target: {
+        name = target;
+        value = {
+          description = "Network Trust State: ${
+            if target == "nmtrust-trusted" then
+              "Trusted (User)"
+            else if target == "nmtrust-untrusted" then
+              "Untrusted (User)"
+            else
+              "Offline (User)"
+          }";
+          unitConfig.Conflicts = conflictsFor target;
+        };
+      }) trustTargets
+    );
+
+    # --- System unit overrides + services ---
+
+    # Strip .service/.timer/.socket suffixes — NixOS appends them automatically
+    systemd.services =
+      lib.mapAttrs' (name: value: {
+        name = lib.removeSuffix ".service" (lib.removeSuffix ".timer" (lib.removeSuffix ".socket" name));
+        value = mkSystemUnitOverrides name value;
+      }) cfg.systemUnits
+      // {
+        nmtrust-apply = {
+          description = "Evaluate and apply network trust state";
+          after = [ "NetworkManager.service" ];
+          serviceConfig = {
+            Type = "oneshot";
+            ExecStart = "${trustHelper}/bin/nmtrust apply";
+            ProtectSystem = "strict";
+            ReadWritePaths = [ "/run/nmtrust" ];
+            ProtectHome = true;
+            NoNewPrivileges = true;
+            PrivateTmp = true;
+          };
+        };
+        nmtrust-eval = {
+          description = "Evaluate network trust state on boot";
+          wantedBy = [ "network-online.target" ];
+          wants = [ "network-online.target" ];
+          after = [
+            "NetworkManager.service"
+            "network-online.target"
+          ];
+          restartTriggers = [
+            config.environment.etc."nmtrust/config".source
+          ];
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+            ExecStart = "${trustHelper}/bin/nmtrust apply";
+            ProtectSystem = "strict";
+            ReadWritePaths = [ "/run/nmtrust" ];
+            ProtectHome = true;
+            NoNewPrivileges = true;
+            PrivateTmp = true;
+          };
+        };
+      };
+
+    # --- User unit overrides ---
+
+    systemd.user.services = lib.foldl' (
+      acc: username:
+      lib.foldl' (
+        acc': unitName:
+        let
+          strippedName = lib.removeSuffix ".service" (
+            lib.removeSuffix ".timer" (lib.removeSuffix ".socket" unitName)
+          );
+        in
+        acc'
+        // {
+          ${strippedName} = mkUserUnitOverrides unitName cfg.userUnits.${username}.${unitName};
+        }
+      ) acc (builtins.attrNames cfg.userUnits.${username})
+    ) { } userNames;
+
+    # --- NM dispatcher ---
+
+    networking.networkmanager.dispatcherScripts = [
+      {
+        source = dispatcherScript;
+        type = "basic";
+      }
+    ];
+  };
+
+  meta.maintainers = [ lib.maintainers.brett ];
+
+}
diff --git a/nixos/modules/tasks/filesystems/zfs.nix b/nixos/modules/tasks/filesystems/zfs.nix
index 9ee7a5ff86dc..7fcbde36087c 100644
--- a/nixos/modules/tasks/filesystems/zfs.nix
+++ b/nixos/modules/tasks/filesystems/zfs.nix
@@ -277,6 +277,10 @@ in
       "zfs"
       "enableUnstable"
     ] "Instead set `boot.zfs.package = pkgs.zfs_unstable;`")
+    (lib.mkRenamedOptionModule
+      [ "boot" "zfs" "allowHibernation" ]
+      [ "boot" "zfs" "unsafeAllowHibernation" ]
+    )
   ];
 
   ###### interface
@@ -305,12 +309,12 @@ in
         description = "True if ZFS filesystem support is enabled";
       };
 
-      allowHibernation = lib.mkOption {
+      unsafeAllowHibernation = lib.mkOption {
         type = lib.types.bool;
         default = false;
         description = ''
-          Allow hibernation support, this may be a unsafe option depending on your
-          setup. Make sure to NOT use Swap on ZFS.
+          Allow hibernation (suspend to disk) support. This is generally considered **UNSAFE**,
+          is not well supported by openzfs, and could lead to corruption and data loss.
         '';
       };
 
@@ -350,19 +354,18 @@ in
 
       forceImportRoot = lib.mkOption {
         type = lib.types.bool;
-        default = true;
+        default = lib.versionOlder config.system.stateVersion "26.11";
+        defaultText = lib.literalExpression ''lib.versionOlder config.system.stateVersion "26.11"'';
         description = ''
           Forcibly import the ZFS root pool(s) during early boot.
 
-          This is enabled by default for backwards compatibility purposes, but it is highly
-          recommended to disable this option, as it bypasses some of the safeguards ZFS uses
-          to protect your ZFS pools.
+          It is highly recommended to keep this option disabled as it bypasses ZFS
+          safeguard that protect your pools.
 
-          If you set this option to `false` and NixOS subsequently fails to
-          boot because it cannot import the root pool, you should boot with the
-          `zfs_force=1` option as a kernel parameter (e.g. by manually
-          editing the kernel params in grub during boot). You should only need to do this
-          once.
+          If NixOS fails to boot because it cannot import the root pool, you should boot
+          with the `zfs_force=1` option as a kernel parameter (e.g. by manually
+          editing the kernel params via your bootloader).
+          You should only need to do this after unclean shutdowns.
         '';
       };
 
@@ -372,10 +375,10 @@ in
         description = ''
           Forcibly import all ZFS pool(s).
 
-          If you set this option to `false` and NixOS subsequently fails to
-          import your non-root ZFS pool(s), you should manually import each pool with
-          "zpool import -f \<pool-name\>", and then reboot. You should only need to do
-          this once.
+          It is highly recommended to keep this option disabled as it bypasses ZFS
+          safeguard that protect your pools.
+
+          See {option}`boot.zfs.forceImportRoot` for details.
         '';
       };
 
@@ -672,12 +675,12 @@ in
           message = "ZFS requires networking.hostId to be set";
         }
         {
-          assertion = !cfgZfs.forceImportAll || cfgZfs.forceImportRoot;
+          assertion = cfgZfs.forceImportAll -> cfgZfs.forceImportRoot;
           message = "If you enable boot.zfs.forceImportAll, you must also enable boot.zfs.forceImportRoot";
         }
         {
-          assertion = cfgZfs.allowHibernation -> !cfgZfs.forceImportRoot && !cfgZfs.forceImportAll;
-          message = "boot.zfs.allowHibernation while force importing is enabled will cause data corruption";
+          assertion = cfgZfs.unsafeAllowHibernation -> !cfgZfs.forceImportRoot && !cfgZfs.forceImportAll;
+          message = "boot.zfs.unsafeAllowHibernation while force importing is enabled will cause data corruption";
         }
         {
           assertion = !(lib.elem "" allPools);
@@ -694,12 +697,25 @@ in
         }
       ];
 
+      warnings =
+        lib.optional
+          (
+            options.boot.zfs.forceImportRoot.definitionsWithLocations == [
+              {
+                inherit (__curPos) file;
+                value = true;
+              }
+            ]
+          )
+          "`boot.zfs.forceImportRoot` is using the default value of `true`. It is highly recommended to set it to `false`, the new default from 26.11 on, to reduce the risk of data loss. Alternatively, you can silence this warning by explicitly setting it to `true`.";
+
       boot = {
         kernelModules = [ "zfs" ];
-        # https://github.com/openzfs/zfs/issues/260
+        # https://github.com/openzfs/zfs/issues/260#issuecomment-982142240
         # https://github.com/openzfs/zfs/issues/12842
+        # https://github.com/openzfs/zfs/issues/14118#issuecomment-1301576647
         # https://github.com/NixOS/nixpkgs/issues/106093
-        kernelParams = lib.optionals (!config.boot.zfs.allowHibernation) [ "nohibernate" ];
+        kernelParams = lib.optionals (!config.boot.zfs.unsafeAllowHibernation) [ "nohibernate" ];
 
         extraModulePackages = [
           cfgZfs.modulePackage
diff --git a/nixos/modules/virtualisation/incus.nix b/nixos/modules/virtualisation/incus.nix
index cd49fc870e0f..a0842be7e93d 100644
--- a/nixos/modules/virtualisation/incus.nix
+++ b/nixos/modules/virtualisation/incus.nix
@@ -54,8 +54,6 @@ let
       lvm2
       lz4
       lxcfs
-      minio
-      minio-client
       nftables
       qemu-utils
       qemu_kvm
@@ -99,6 +97,10 @@ let
     ]
     ++ lib.optionals nvidiaEnabled [
       libnvidia-container
+    ]
+    ++ lib.optionals cfg.bucketSupport [
+      minio
+      minio-client
     ];
 
   # https://github.com/lxc/incus/blob/cff35a29ee3d7a2af1f937cbb6cf23776941854b/internal/server/instance/drivers/driver_qemu.go#L123
@@ -211,6 +213,13 @@ in
         description = "The incus client package to use. This package is added to PATH.";
       };
 
+      bucketSupport = lib.mkOption {
+        type = lib.types.bool;
+        description = "Enable bucket support using minio, which is an insecure and unmaintained S3 provider.";
+        default = if lib.versionAtLeast config.system.stateVersion "26.11" then false else null;
+        defaultText = lib.literalExpression ''if lib.versionAtLeast config.system.stateVersion "26.11" then false else null;'';
+      };
+
       softDaemonRestart = lib.mkOption {
         type = lib.types.bool;
         default = true;
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index afad90d18705..b276d07786bc 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -678,6 +678,7 @@ in
   gotosocial = runTest ./web-apps/gotosocial.nix;
   goupile = runTest ./web-apps/goupile;
   grafana = handleTest ./grafana { };
+  grafana-to-ntfy = runTest ./grafana-to-ntfy.nix;
   graphite = runTest ./graphite.nix;
   grav = runTest ./web-apps/grav.nix;
   graylog = runTest ./graylog.nix;
@@ -1140,6 +1141,7 @@ in
     pkgs.callPackage ../../pkgs/stdenv/generic/check-meta-test.nix
       { };
   nixseparatedebuginfod2 = runTest ./nixseparatedebuginfod2.nix;
+  nmtrust = runTest ./nmtrust.nix;
   node-red = runTest ./node-red.nix;
   nohang = runTest ./nohang.nix;
   nomad = runTest ./nomad.nix;
diff --git a/nixos/tests/grafana-to-ntfy.nix b/nixos/tests/grafana-to-ntfy.nix
new file mode 100644
index 000000000000..d7e942296e3a
--- /dev/null
+++ b/nixos/tests/grafana-to-ntfy.nix
@@ -0,0 +1,166 @@
+{ lib, ... }:
+
+let
+  ports = {
+    grafana-to-ntfy = 8080;
+    ntfy-sh = 8081;
+    grafana = 3000;
+    alertmanager = 9093;
+  };
+  ntfyTopic = "grafana-alerts";
+in
+
+{
+  name = "grafana-to-ntfy";
+  meta.maintainers = with lib.maintainers; [ kittyandrew ];
+
+  nodes.machine = {
+    services.grafana-to-ntfy = {
+      enable = true;
+      settings = {
+        ntfyUrl = "http://127.0.0.1:${toString ports.ntfy-sh}/${ntfyTopic}";
+        port = ports.grafana-to-ntfy;
+        address = "127.0.0.1";
+      };
+    };
+
+    services.ntfy-sh = {
+      enable = true;
+      settings = {
+        listen-http = "127.0.0.1:${toString ports.ntfy-sh}";
+        base-url = "http://127.0.0.1:${toString ports.ntfy-sh}";
+      };
+    };
+
+    services.grafana = {
+      enable = true;
+      settings = {
+        server.http_port = ports.grafana;
+        server.http_addr = "127.0.0.1";
+        security.admin_user = "admin";
+        security.admin_password = "admin";
+        security.secret_key = "test-only-dummy-key";
+      };
+      provision.alerting = {
+        contactPoints.settings = {
+          apiVersion = 1;
+          contactPoints = [
+            {
+              orgId = 1;
+              name = "grafana-to-ntfy";
+              receivers = [
+                {
+                  uid = "cp_webhook";
+                  type = "webhook";
+                  disableResolveMessage = false;
+                  settings = {
+                    url = "http://127.0.0.1:${toString ports.grafana-to-ntfy}";
+                    httpMethod = "POST";
+                  };
+                }
+              ];
+            }
+          ];
+        };
+        policies.settings = {
+          apiVersion = 1;
+          policies = [
+            {
+              orgId = 1;
+              receiver = "grafana-to-ntfy";
+              group_by = [ "..." ];
+              group_wait = "0s";
+              group_interval = "1s";
+              repeat_interval = "1h";
+            }
+          ];
+        };
+      };
+    };
+
+    services.prometheus.alertmanager = {
+      enable = true;
+      listenAddress = "127.0.0.1";
+      port = ports.alertmanager;
+      configuration = {
+        route = {
+          receiver = "grafana-to-ntfy";
+          group_by = [ "..." ];
+          group_wait = "0s";
+          group_interval = "1s";
+          repeat_interval = "2h";
+        };
+        receivers = [
+          {
+            name = "grafana-to-ntfy";
+            webhook_configs = [
+              { url = "http://127.0.0.1:${toString ports.grafana-to-ntfy}"; }
+            ];
+          }
+        ];
+      };
+    };
+  };
+
+  interactive.nodes.machine = {
+    services.grafana-to-ntfy.settings.address = lib.mkForce "0.0.0.0";
+    services.grafana.settings.server.http_addr = lib.mkForce "0.0.0.0";
+    services.prometheus.alertmanager.listenAddress = lib.mkForce "0.0.0.0";
+    services.ntfy-sh.settings.listen-http = lib.mkForce "0.0.0.0:${toString ports.ntfy-sh}";
+    networking.firewall.enable = false;
+    virtualisation.forwardPorts = lib.mapAttrsToList (_: port: {
+      from = "host";
+      host = { inherit port; };
+      guest = { inherit port; };
+    }) ports;
+  };
+
+  testScript = ''
+    import json
+
+    machine.wait_for_unit("grafana-to-ntfy.service")
+    machine.wait_for_unit("ntfy-sh.service")
+    machine.wait_for_unit("grafana.service")
+    machine.wait_for_unit("alertmanager.service")
+    machine.wait_for_open_port(${toString ports.grafana-to-ntfy})
+    machine.wait_for_open_port(${toString ports.ntfy-sh})
+    machine.wait_for_open_port(${toString ports.grafana})
+    machine.wait_for_open_port(${toString ports.alertmanager})
+
+    with subtest("Health endpoint returns 200"):
+      machine.succeed("curl -sf http://127.0.0.1:${toString ports.grafana-to-ntfy}/health")
+
+    with subtest("Alertmanager alert arrives at ntfy"):
+      machine.succeed(
+        "curl -sf http://127.0.0.1:${toString ports.alertmanager}/api/v2/alerts"
+        " -X POST -H 'Content-Type: application/json'"
+        " -d '[{\"labels\": {\"alertname\": \"TestAlertFromAM\"}}]'"
+      )
+      # grep makes wait_until_succeeds retry: ntfy returns 200 with empty body when no messages exist
+      resp = machine.wait_until_succeeds(
+        "curl -sf 'http://127.0.0.1:${toString ports.ntfy-sh}/${ntfyTopic}/json?poll=1'"
+        " | grep '\"title\":\"Alertmanager\"'"
+      )
+      msg = json.loads(resp.strip())
+      assert msg["title"] == "Alertmanager", f"Expected title 'Alertmanager', got '{msg['title']}'"
+      assert "warning" in msg["tags"], f"Expected 'warning' in tags, got {msg['tags']}"
+      assert "firing" in msg["tags"], f"Expected 'firing' in tags, got {msg['tags']}"
+
+    with subtest("Grafana alert arrives at ntfy"):
+      machine.succeed(
+        "curl -sf http://127.0.0.1:${toString ports.grafana}/api/alertmanager/grafana/config/api/v1/receivers/test"
+        " -u admin:admin"
+        " -X POST -H 'Content-Type: application/json'"
+        """ -d '{"receivers": [{"name": "grafana-to-ntfy", "grafana_managed_receiver_configs": [{"uid": "cp_webhook", "name": "webhook", "type": "webhook", "disableResolveMessage": false, "settings": {"url": "http://127.0.0.1:${toString ports.grafana-to-ntfy}", "httpMethod": "POST"}}]}]}'"""
+      )
+      # grep ensures we wait for the Grafana message specifically (see above)
+      resp = machine.wait_until_succeeds(
+        "curl -sf 'http://127.0.0.1:${toString ports.ntfy-sh}/${ntfyTopic}/json?poll=1'"
+        " | grep 'FIRING'"
+      )
+      msg = json.loads(resp.strip())
+      assert "[FIRING:1]" in msg["title"], f"Expected Grafana title with '[FIRING:1]', got '{msg['title']}'"
+      assert "warning" in msg["tags"], f"Expected 'warning' in tags, got {msg['tags']}"
+      assert "firing" in msg["tags"], f"Expected 'firing' in tags, got {msg['tags']}"
+  '';
+}
diff --git a/nixos/tests/incus/incus-tests.nix b/nixos/tests/incus/incus-tests.nix
index b28eb12b2ef1..34cfdc63e219 100644
--- a/nixos/tests/incus/incus-tests.nix
+++ b/nixos/tests/incus/incus-tests.nix
@@ -51,6 +51,7 @@ in
       incus = {
         enable = true;
         package = cfg.package;
+        bucketSupport = false;
 
         preseed = {
           networks = [
diff --git a/nixos/tests/nmtrust.nix b/nixos/tests/nmtrust.nix
new file mode 100644
index 000000000000..5954746b254d
--- /dev/null
+++ b/nixos/tests/nmtrust.nix
@@ -0,0 +1,92 @@
+{ lib, pkgs, ... }:
+{
+  name = "nmtrust";
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      networking.networkmanager.enable = true;
+
+      # Prevent the VM's built-in interfaces from polluting trust state.
+      networking.networkmanager.unmanaged = [
+        "eth0"
+        "eth1"
+        "lo"
+      ];
+
+      networking.networkmanager.ensureProfiles.profiles = {
+        trusted-net = {
+          connection = {
+            id = "trusted-net";
+            uuid = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee";
+            type = "dummy";
+            interface-name = "dummy-trusted";
+            autoconnect = "false";
+          };
+          ipv4.method = "manual";
+          ipv4.addresses = "10.99.1.1/24";
+        };
+        untrusted-net = {
+          connection = {
+            id = "untrusted-net";
+            uuid = "11111111-2222-3333-4444-555555555555";
+            type = "dummy";
+            interface-name = "dummy-untrusted";
+            autoconnect = "false";
+          };
+          ipv4.method = "manual";
+          ipv4.addresses = "10.99.2.1/24";
+        };
+      };
+
+      services.nmtrust = {
+        enable = true;
+        trustedConnections = [ "trusted-net" ];
+        systemUnits."trust-canary.service" = { };
+      };
+
+      # Canary service: runs only while the trusted target is active.
+      systemd.services.trust-canary = {
+        description = "nmtrust test canary";
+        serviceConfig = {
+          Type = "simple";
+          ExecStart = "${pkgs.coreutils}/bin/sleep infinity";
+        };
+      };
+    };
+
+  testScript = ''
+    import time
+
+    def apply(machine):
+        """Trigger nmtrust-apply and wait for it to finish."""
+        time.sleep(1)
+        machine.succeed("systemctl start nmtrust-apply.service")
+        machine.wait_until_succeeds(
+            "systemctl show nmtrust-apply.service -p ActiveState --value | grep -q inactive",
+            timeout=10,
+        )
+
+    machine.wait_for_unit("multi-user.target")
+
+    with subtest("offline on boot with no connections active"):
+        apply(machine)
+        machine.succeed("systemctl is-active nmtrust-offline.target")
+        machine.fail("systemctl is-active trust-canary.service")
+
+    with subtest("trusted when trusted connection is up"):
+        machine.succeed("nmcli connection up trusted-net")
+        apply(machine)
+        machine.succeed("systemctl is-active nmtrust-trusted.target")
+        machine.succeed("systemctl is-active trust-canary.service")
+
+    with subtest("untrusted when untrusted connection replaces trusted"):
+        machine.succeed("nmcli connection down trusted-net")
+        machine.succeed("nmcli connection up untrusted-net")
+        apply(machine)
+        machine.succeed("systemctl is-active nmtrust-untrusted.target")
+        machine.fail("systemctl is-active trust-canary.service")
+  '';
+
+  meta.maintainers = with lib.maintainers; [ brett ];
+}
diff --git a/nixos/tests/zfs.nix b/nixos/tests/zfs.nix
index 5a7c493e42b1..7851368075a0 100644
--- a/nixos/tests/zfs.nix
+++ b/nixos/tests/zfs.nix
@@ -23,7 +23,6 @@ let
 
       nodes.machine =
         {
-          config,
           pkgs,
           lib,
           ...
@@ -54,6 +53,8 @@ let
           # /dev/disk/by-id doesn't get populated in the NixOS test framework
           boot.zfs.devNodes = "/dev/disk/by-uuid";
 
+          boot.zfs.forceImportRoot = lib.mkDefault false;
+
           specialisation.samba.configuration = {
             services.samba = {
               enable = true;
@@ -101,6 +102,7 @@ let
             systemd.services.zfs-import-forcepool.wantedBy = lib.mkVMOverride [ "forcepool.mount" ];
             systemd.targets.zfs.wantedBy = lib.mkVMOverride [ ];
             boot.zfs.forceImportAll = true;
+            boot.zfs.forceImportRoot = true;
             virtualisation.fileSystems."/forcepool" = {
               device = "forcepool";
               fsType = "zfs";
@@ -203,7 +205,6 @@ let
 
 in
 {
-
   series_2_3 = makeZfsTest {
     zfsPackage = pkgs.zfs_2_3;
     kernelPackages = pkgs.linuxPackages;
diff --git a/pkgs/applications/editors/jetbrains/source/build.nix b/pkgs/applications/editors/jetbrains/source/build.nix
index 37d776045f6e..aac0fa6f5140 100644
--- a/pkgs/applications/editors/jetbrains/source/build.nix
+++ b/pkgs/applications/editors/jetbrains/source/build.nix
@@ -45,7 +45,7 @@ let
     };
   });
 
-  jbr = jetbrains.jdk-no-jcef;
+  jbr = jetbrains.jdk-no-jcef-21;
 
   ideaSrc = fetchFromGitHub {
     owner = "jetbrains";
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index a4866e35a4ae..e002cff784e5 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -23716,13 +23716,12 @@ final: prev: {
   vim-solarized8 = buildVimPlugin {
     pname = "vim-solarized8";
     version = "1.6.4-unstable-2026-03-11";
-    src = fetchFromGitHub {
-      owner = "lifepillar";
-      repo = "vim-solarized8";
-      rev = "4433b4411de92b2446a4d32f0d8bf1b25c476bf9";
-      hash = "sha256-Og6qmrSIfhtGgait/nwJg+uNrUtY/j83cUWZj2TwUFY=";
+    src = fetchgit {
+      url = "https://codeberg.org/lifepillar/vim-solarized8/";
+      rev = "5dfbfb00be8237619c680302fc9250e391b1686a";
+      hash = "sha256-qJLlHsXKcLC+bpirfcuBj3igK9dDk8L9oVGPzWhtkEI=";
     };
-    meta.homepage = "https://github.com/lifepillar/vim-solarized8/";
+    meta.homepage = "https://codeberg.org/lifepillar/vim-solarized8/";
     meta.license = lib.licenses.unfree;
     meta.hydraPlatforms = [ ];
   };
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 8037a06b70e3..6a9830ab6808 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -209,6 +209,12 @@ assertNoAdditions {
     dependencies = [ self.middleclass ];
   };
 
+  argtextobj-vim = super.argtextobj-vim.overrideAttrs (old: {
+    meta = old.meta // {
+      license = lib.licenses.mit;
+    };
+  });
+
   arrow-nvim = super.arrow-nvim.overrideAttrs (old: {
     meta = old.meta // {
       license = lib.licenses.gpl3Plus;
@@ -447,6 +453,12 @@ assertNoAdditions {
     };
   });
 
+  camelcasemotion = super.camelcasemotion.overrideAttrs (old: {
+    meta = old.meta // {
+      license = lib.licenses.vim;
+    };
+  });
+
   catppuccin-nvim = super.catppuccin-nvim.overrideAttrs {
     nvimSkipModules = [
       "catppuccin.groups.integrations.noice"
@@ -2219,6 +2231,12 @@ assertNoAdditions {
     dependencies = [ self.plenary-nvim ];
   };
 
+  lsp-format-nvim = super.lsp-format-nvim.overrideAttrs (old: {
+    meta = old.meta // {
+      license = lib.licenses.mit;
+    };
+  });
+
   lsp_extensions-nvim = super.lsp_extensions-nvim.overrideAttrs {
     dependencies = [ self.plenary-nvim ];
   };
@@ -4477,6 +4495,12 @@ assertNoAdditions {
     nvimSkipModules = "tsc.better-messages-test";
   };
 
+  tslime-vim = super.tslime-vim.overrideAttrs (old: {
+    meta = old.meta // {
+      license = lib.licenses.wtfpl;
+    };
+  });
+
   tsuquyomi = super.tsuquyomi.overrideAttrs (old: {
     meta = old.meta // {
       license = lib.licenses.mit;
@@ -4709,9 +4733,12 @@ assertNoAdditions {
     };
   });
 
-  vim-beancount = super.vim-beancount.overrideAttrs {
+  vim-beancount = super.vim-beancount.overrideAttrs (old: {
     passthru.python3Dependencies = ps: with ps; [ beancount ];
-  };
+    meta = old.meta // {
+      license = lib.licenses.vim;
+    };
+  });
 
   vim-bepoptimist = super.vim-bepoptimist.overrideAttrs (old: {
     meta = old.meta // {
@@ -4852,6 +4879,12 @@ assertNoAdditions {
     };
   });
 
+  vim-easymotion = super.vim-easymotion.overrideAttrs (old: {
+    meta = old.meta // {
+      license = lib.licenses.mit;
+    };
+  });
+
   vim-easytags = super.vim-easytags.overrideAttrs (old: {
     dependencies = [ self.vim-misc ];
     patches = [
@@ -5039,6 +5072,12 @@ assertNoAdditions {
     runtimeDeps = [ jq ];
   };
 
+  vim-indentwise = super.vim-indentwise.overrideAttrs (old: {
+    meta = old.meta // {
+      license = lib.licenses.gpl3Plus;
+    };
+  });
+
   vim-isort = super.vim-isort.overrideAttrs {
     postPatch = ''
       substituteInPlace autoload/vimisort.vim \
@@ -5328,6 +5367,12 @@ assertNoAdditions {
     };
   });
 
+  vim-textobj-user = super.vim-textobj-user.overrideAttrs (old: {
+    meta = old.meta // {
+      license = lib.licenses.mit;
+    };
+  });
+
   vim-tpipeline = super.vim-tpipeline.overrideAttrs {
     # Requires global variable
     nvimSkipModules = "tpipeline.main";
@@ -5506,6 +5551,12 @@ assertNoAdditions {
     nvimSkipModules = "virt-column.config.types";
   };
 
+  vis = super.vis.overrideAttrs (old: {
+    meta = old.meta // {
+      license = lib.licenses.vim;
+    };
+  });
+
   vs-tasks-nvim = super.vs-tasks-nvim.overrideAttrs {
     checkInputs = [
       # Optional telescope integration
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 201409414546..8a9309707e83 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -1691,7 +1691,7 @@ https://github.com/bohlender/vim-smt2/,,
 https://github.com/justinmk/vim-sneak/,,
 https://github.com/garbas/vim-snipmate/,,
 https://github.com/honza/vim-snippets/,,
-https://github.com/lifepillar/vim-solarized8/,,
+https://codeberg.org/lifepillar/vim-solarized8/,,
 https://github.com/tomlion/vim-solidity/,,
 https://github.com/christoomey/vim-sort-motion/,,
 https://github.com/tpope/vim-speeddating/,,
diff --git a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
index b4868742f542..a79407bb7f1b 100644
--- a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
@@ -1,39 +1,55 @@
 {
   lib,
+  stdenv,
   stdenvNoCC,
+  autoPatchelfHook,
+  alsa-lib,
+  testers,
   vscode-utils,
 }:
 
-vscode-utils.buildVscodeMarketplaceExtension {
+vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    (lib.getLib stdenv.cc.cc)
+    alsa-lib
+  ];
+
   mktplcRef =
     let
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-w4kUYNnQW4KkIlzxnTASTBFxL3m3/NBwBET7/8ealIY=";
+          hash = "sha256-J9QdRxN0NdCRfSUBUE7Ox2BG0vdnaWGq27jcR779qRw=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-ZsVR7Qajv78A0+UfR+DqaUZyV1FFRjNs2+vJInboh6U=";
+          hash = "sha256-53SJDBILWKVqz8EyXO/DF8+j+EK7iVJ47cjhlZhrIWw=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-8zvhF5cs1XOGa/l2M27K2Mv2cgusNy51glFZf1OVdWI=";
+          hash = "sha256-/82zwt92T5JYGxhnvSmqTA/7ahut6P3SAU5POxUFowM=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-Csb9F6HGWAgvPDjtsu35gjtGCuDLu0WQD1NNX/+S7F8=";
+          hash = "sha256-2ppC1sDDtDKAWpAW3RHGHeszhoKAVYnRoKw94ZOCaAs=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.119";
+      version = "2.1.121";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
 
+  passthru.tests.bundled-claude-runs = testers.testVersion {
+    package = finalAttrs.finalPackage;
+    command = "${finalAttrs.finalPackage}/share/vscode/extensions/anthropic.claude-code/resources/native-binary/claude --version";
+  };
+
   meta = {
     description = "Harness the power of Claude Code without leaving your IDE";
     homepage = "https://docs.anthropic.com/s/claude-code";
@@ -48,4 +64,4 @@ vscode-utils.buildVscodeMarketplaceExtension {
       "aarch64-darwin"
     ];
   };
-}
+})
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 8483a8ba1494..77c2a72d985e 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -85,7 +85,7 @@ let
         };
       };
 
-      "42crunch".vscode-openapi = buildVscodeMarketplaceExtension {
+      "42crunch".vscode-openapi = buildVscodeMarketplaceExtension rec {
         mktplcRef = {
           publisher = "42Crunch";
           name = "vscode-openapi";
@@ -93,7 +93,7 @@ let
           hash = "sha256-nV7RZpDd+15YmINKrFSIlFurC955bnE4A8esrKWYVnE=";
         };
         meta = {
-          changelog = "https://marketplace.visualstudio.com/items/42Crunch.vscode-openapi/changelog";
+          changelog = "https://github.com/42Crunch/vscode-openapi/blob/v${mktplcRef.version}/CHANGELOG.md";
           description = "Visual Studio Code extension with rich support for the OpenAPI Specification (OAS)";
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=42Crunch.vscode-openapi";
           homepage = "https://github.com/42Crunch/vscode-openapi";
@@ -1174,8 +1174,8 @@ let
         mktplcRef = {
           publisher = "DanielSanMedium";
           name = "dscodegpt";
-          version = "3.17.20";
-          hash = "sha256-7nJlPP1Xap0lSJz+HQmKKC9OZ5UfMCq8nf1B/bkyNXU=";
+          version = "3.17.36";
+          hash = "sha256-7+Ja5/zeGq+W1aCIzZu0x+CU1ERwZhwvOaZKaGSWK4c=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/DanielSanMedium.dscodegpt/changelog";
diff --git a/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix b/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
index 68d61c8976fe..582e54e64b17 100644
--- a/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-dev";
     publisher = "saoudrizwan";
-    version = "3.79.0";
-    hash = "sha256-BqIJNUkq7q2/WlsWqN/dHZtYqHvDm3v7CesEM4XJ1Es=";
+    version = "3.81.0";
+    hash = "sha256-gVQmKuyUH+bXpr7X2Z23U2oKFnAV2mxhckjef2uL8KQ=";
   };
 
   meta = {
diff --git a/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix b/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix
index f478d1532d4c..bf9550bb7c38 100644
--- a/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix
+++ b/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-pce-fast";
-  version = "0-unstable-2026-04-17";
+  version = "0-unstable-2026-04-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-pce-fast-libretro";
-    rev = "906b6465f1d4da2d04d8735b0d24ca0af0533590";
-    hash = "sha256-xg+irszrpUu689MyP2iJDl9a/YHR4RRqLJmRdu6/4Nw=";
+    rev = "95b5274dfeda36f7e77c70daa666a63302ad83cf";
+    hash = "sha256-BEt2g63jBOrgWk0tYp8DJVC65AbeSVRQz9rIMwjj2Sg=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/dolphin.nix b/pkgs/applications/emulators/libretro/cores/dolphin.nix
index e4fdc6899c51..cd32ce5399ef 100644
--- a/pkgs/applications/emulators/libretro/cores/dolphin.nix
+++ b/pkgs/applications/emulators/libretro/cores/dolphin.nix
@@ -26,13 +26,14 @@
 }:
 mkLibretroCore {
   core = "dolphin";
-  version = "0-unstable-2025-08-05";
+  version = "0-unstable-2026-04-08";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "dolphin";
-    rev = "83438f9b1a2c832319876a1fda130a5e33d4ef87";
-    hash = "sha256-q4y+3uJ1tQ2OvlEvi/JNyIO/RfuWNIEKfVZ6xEWKFCg=";
+    rev = "0cd3bb89c29535db9b7552fc86871867ccf5b471";
+    hash = "sha256-cSiJO/EvspNvHopo/RLfuz8ONpbXk2NrrSDhkiAm7/s=";
+    fetchSubmodules = true;
   };
 
   extraNativeBuildInputs = [
@@ -82,8 +83,6 @@ mkLibretroCore {
     (cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.5")
   ];
 
-  dontUseCmakeBuildDir = true;
-
   meta = {
     description = "Port of Dolphin to libretro";
     homepage = "https://github.com/libretro/dolphin";
diff --git a/pkgs/applications/emulators/libretro/cores/mesen-s.nix b/pkgs/applications/emulators/libretro/cores/mesen-s.nix
index ea349e193621..b79ae5541466 100644
--- a/pkgs/applications/emulators/libretro/cores/mesen-s.nix
+++ b/pkgs/applications/emulators/libretro/cores/mesen-s.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mesen-s";
-  version = "0-unstable-2024-10-21";
+  version = "0-unstable-2026-04-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mesen-s";
-    rev = "d4fca31a6004041d99b02199688f84c009c55967";
-    hash = "sha256-mGGTLBRJCsNJg57LWSFndIv/LLzEmVRnv6gNbllkV/Y=";
+    rev = "1d475abd174d16ecb1fb030961ff26076ab51ee6";
+    hash = "sha256-JSXkh6OyclYl3X/sJLRZsb5sdbSfanbJAKlhaFFjSrI=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix b/pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix
index fea158277b70..808ac6e5a3b9 100644
--- a/pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix
+++ b/pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "pcsx-rearmed";
-  version = "0-unstable-2026-04-15";
+  version = "0-unstable-2026-04-25";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "pcsx_rearmed";
-    rev = "00512d47f9d4d220efa4f2418b4a5896f9cd2e75";
-    hash = "sha256-ERllT1RkoLMafnHx2HSHdURoWdnF8fJlZ80pfiw18gQ=";
+    rev = "a97efbb0646dd7766bd66fe9e93118206edec36a";
+    hash = "sha256-2MAj/UdEg/kRZuGZcVQ+hBMe2pRlZWvEQnXeqb+444Y=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/applications/emulators/libretro/cores/prosystem.nix b/pkgs/applications/emulators/libretro/cores/prosystem.nix
index 7bf1b0f32e22..e3b8cf7453b2 100644
--- a/pkgs/applications/emulators/libretro/cores/prosystem.nix
+++ b/pkgs/applications/emulators/libretro/cores/prosystem.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "prosystem";
-  version = "0-unstable-2026-03-31";
+  version = "0-unstable-2026-04-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "prosystem-libretro";
-    rev = "980edb381b0bf9ea7992caab24039a537aeb510e";
-    hash = "sha256-uuh5YLKHW5aVe01GH12TqAlSp83s/PF/8Mlw105HIJg=";
+    rev = "3f465db9c82fc6764cd90c53fc66eb630e0b3710";
+    hash = "sha256-uamxOzJt5NbMGxDqyGk/8XJbN/fiFoB81DNeULIfL1U=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/stella.nix b/pkgs/applications/emulators/libretro/cores/stella.nix
index e58ec0b77599..8b89949cc74c 100644
--- a/pkgs/applications/emulators/libretro/cores/stella.nix
+++ b/pkgs/applications/emulators/libretro/cores/stella.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "stella";
-  version = "0-unstable-2026-04-19";
+  version = "0-unstable-2026-04-28";
 
   src = fetchFromGitHub {
     owner = "stella-emu";
     repo = "stella";
-    rev = "8b7bc991d2500cbf2e861c25f96ff81e0d13f273";
-    hash = "sha256-jeu/7hHuPfSoJg2/6UxUqHWOGMSe0vX6cgWLmVYHABQ=";
+    rev = "0c1b944387b5ac2b1bf753c2c4221db4fdc10f79";
+    hash = "sha256-mohkp6oOP8MtRs/WHw4Rxs3FrB6h4X6/ENrRdjiiXlQ=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/emulators/libretro/cores/thepowdertoy.nix b/pkgs/applications/emulators/libretro/cores/thepowdertoy.nix
index a70c7c15ba8b..bbae8f0394d2 100644
--- a/pkgs/applications/emulators/libretro/cores/thepowdertoy.nix
+++ b/pkgs/applications/emulators/libretro/cores/thepowdertoy.nix
@@ -6,13 +6,13 @@
 }:
 mkLibretroCore {
   core = "thepowdertoy";
-  version = "0-unstable-2025-09-16";
+  version = "0-unstable-2026-04-20";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "ThePowderToy";
-    rev = "cb3cd4c2e5beddb98b34e6b800fa24e8f96322d9";
-    hash = "sha256-k3XWkkSuQC3IBhhI96qkTrlGH/oJu941HaAvR28V5i0=";
+    rev = "dcb5e41f1f9800192ea07ea43459413c5a065d9f";
+    hash = "sha256-FDotG/ngmrxgyN7YQ8SK/ZQHKWkwZ5hhg0qsNNXmaNc=";
   };
 
   extraNativeBuildInputs = [ cmake ];
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index de3d3a67dcf9..0b8fb499109a 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -400,13 +400,13 @@
     "vendorHash": null
   },
   "fastly_fastly": {
-    "hash": "sha256-2QfgzzWYXPOCMAX2EBodDPVEtcIHHPT4Lbh0W1+q2to=",
+    "hash": "sha256-deph1BQ/aUgTOf4Bgaxpac4V2fmy4dSdbBRa/qvvKdk=",
     "homepage": "https://registry.terraform.io/providers/fastly/fastly",
     "owner": "fastly",
     "repo": "terraform-provider-fastly",
-    "rev": "v9.1.0",
+    "rev": "v9.1.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-E64AMHGFpAhg6UNYHJXAdRWPdWWdZineW/b+Gs2O2jk="
+    "vendorHash": "sha256-lxBvfkuvf1eoprkCuPtYqOw6P7sTzS70VXTYGToazf8="
   },
   "flexibleenginecloud_flexibleengine": {
     "hash": "sha256-yEZ9JiUSqFFbfqzOOD59ZBv4yFCeUBBKlp6aiUqDqiM=",
diff --git a/pkgs/applications/networking/cluster/terraform/default.nix b/pkgs/applications/networking/cluster/terraform/default.nix
index 23b158b40943..3b1614ecc892 100644
--- a/pkgs/applications/networking/cluster/terraform/default.nix
+++ b/pkgs/applications/networking/cluster/terraform/default.nix
@@ -200,9 +200,9 @@ rec {
   mkTerraform = attrs: pluggable (generic attrs);
 
   terraform_1 = mkTerraform {
-    version = "1.14.9";
-    hash = "sha256-OvKc+71DxbYgdOs06RkM4doF4OTkY0NI/LR0Wgpr7tA=";
-    vendorHash = "sha256-Ajjh8k2lOKf+BGIk3Vyp8H2unljeOMUN0vXwGjs7ZHc=";
+    version = "1.15.0";
+    hash = "sha256-cKgZFCPLusXXSjcff/PmKGIdSm3wRY1DpduXBRrgcDc=";
+    vendorHash = "sha256-Gv6V5aXqTuQoG1StbD/7Ln2QrLpMsW6fbUJUkyZMkvk=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = {
       inherit plugins;
diff --git a/pkgs/build-support/rust/fetch-cargo-vendor.nix b/pkgs/build-support/rust/fetch-cargo-vendor.nix
index a02bbd89c7fc..2802bf9e73f1 100644
--- a/pkgs/build-support/rust/fetch-cargo-vendor.nix
+++ b/pkgs/build-support/rust/fetch-cargo-vendor.nix
@@ -22,6 +22,21 @@ let
     ];
   } (builtins.readFile ./replace-workspace-values.py);
 
+  nix-prefetch-git' = nix-prefetch-git.override {
+    git = gitMinimal;
+    # break loop of nix-prefetch-git -> git-lfs -> asciidoctor -> ruby (yjit) -> fetchCargoVendor -> nix-prefetch-git
+    # Cargo does not currently handle git-lfs: https://github.com/rust-lang/cargo/issues/9692
+    git-lfs = null;
+  };
+
+  removedArgs = [
+    "name"
+    "pname"
+    "version"
+    "nativeBuildInputs"
+    "hash"
+  ];
+
   mkFetchCargoVendorUtil =
     name: src:
     writers.writePython3Bin name {
@@ -57,14 +72,6 @@ in
 # TODO: add asserts about pname version and name
 
 let
-  removedArgs = [
-    "name"
-    "pname"
-    "version"
-    "nativeBuildInputs"
-    "hash"
-  ];
-
   vendorStaging = stdenvNoCC.mkDerivation (
     {
       name = "${name}-vendor-staging";
@@ -74,12 +81,7 @@ let
       nativeBuildInputs = [
         fetchCargoVendorUtilV2
         cacert
-        (nix-prefetch-git.override {
-          git = gitMinimal;
-          # break loop of nix-prefetch-git -> git-lfs -> asciidoctor -> ruby (yjit) -> fetchCargoVendor -> nix-prefetch-git
-          # Cargo does not currently handle git-lfs: https://github.com/rust-lang/cargo/issues/9692
-          git-lfs = null;
-        })
+        nix-prefetch-git'
       ]
       ++ nativeBuildInputs;
 
@@ -108,7 +110,6 @@ let
     // removeAttrs args removedArgs
   );
 in
-
 runCommand "${name}-vendor"
   {
     inherit vendorStaging;
diff --git a/pkgs/by-name/al/aliyun-cli/package.nix b/pkgs/by-name/al/aliyun-cli/package.nix
index 42dbd533885a..50564e8cf69e 100644
--- a/pkgs/by-name/al/aliyun-cli/package.nix
+++ b/pkgs/by-name/al/aliyun-cli/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "aliyun-cli";
-  version = "3.3.8";
+  version = "3.3.11";
 
   src = fetchFromGitHub {
     owner = "aliyun";
     repo = "aliyun-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5RFGpfeW3nLubN920hrBVyEdJEPa/V3Dz2YdxCh9YLU=";
+    hash = "sha256-jksC63DFSbZcBjQvV7BBMSMbPMeSqUQMWN9HcIcFZSU=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/am/amdgpu_top/package.nix b/pkgs/by-name/am/amdgpu_top/package.nix
index e33216d67a70..2bc7b78f269f 100644
--- a/pkgs/by-name/am/amdgpu_top/package.nix
+++ b/pkgs/by-name/am/amdgpu_top/package.nix
@@ -16,16 +16,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "amdgpu_top";
-  version = "0.11.3";
+  version = "0.11.4";
 
   src = fetchFromGitHub {
     owner = "Umio-Yasuno";
     repo = "amdgpu_top";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-k+/y8YaEP8DJuW8n/Xq/Ea9DWG79Cux+PgZbSP4m3pQ=";
+    hash = "sha256-ap1X53Ou/eWhHvXOnHY7zGb6i+ZLs8LeSNpOJWm+IKc=";
   };
 
-  cargoHash = "sha256-+eMItSemE69UGfGF9CeKyEvUxvhiZjkJJPeZoVfa+dk=";
+  cargoHash = "sha256-b9OO//9M/LyS4ZMQzppvLHJHL3JyPVoSOIPVlrX1Wes=";
 
   buildInputs = [
     libdrm
diff --git a/pkgs/by-name/an/animeko/package.nix b/pkgs/by-name/an/animeko/package.nix
index d2c4b7729294..c449e47c09da 100644
--- a/pkgs/by-name/an/animeko/package.nix
+++ b/pkgs/by-name/an/animeko/package.nix
@@ -142,12 +142,12 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   env = {
-    JAVA_HOME = jetbrains.jdk;
+    JAVA_HOME = jetbrains.jdk-21;
     ANDROID_SDK_HOME = "$(pwd)";
   };
 
   gradleFlags = [
-    "-Dorg.gradle.java.home=${jetbrains.jdk}"
+    "-Dorg.gradle.java.home=${jetbrains.jdk-21}"
   ];
 
   nativeBuildInputs = [
@@ -282,5 +282,8 @@ stdenv.mkDerivation (finalAttrs: {
     platforms = [
       "x86_64-linux"
     ];
+    # Mark broken due to a breaking change in JetBrains JCEF
+    # https://github.com/NixOS/nixpkgs/pull/485812#issuecomment-4211365591
+    broken = true;
   };
 })
diff --git a/pkgs/by-name/ao/ao3downloader/package.nix b/pkgs/by-name/ao/ao3downloader/package.nix
index cd9fb3456d07..ea655ebb1722 100644
--- a/pkgs/by-name/ao/ao3downloader/package.nix
+++ b/pkgs/by-name/ao/ao3downloader/package.nix
@@ -8,14 +8,14 @@
 # https://github.com/nianeyna/ao3downloader/blob/f8399bb8aca276ae7359157b90afd13925c90056/pyproject.toml#L8
 python312Packages.buildPythonApplication (finalAttrs: {
   pname = "ao3downloader";
-  version = "2026.4.7";
+  version = "2026.4.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "nianeyna";
     repo = "ao3downloader";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PlMVhvUX/XeNrKfwe+/sFv8Y4k7GEzCR+xIO/zuspxM=";
+    hash = "sha256-StaF62Ho/xz8kKE5NrLo8G5PdBv493VBshR6gdK9J20=";
   };
 
   build-system = with python312Packages; [
diff --git a/pkgs/by-name/ap/apidog/package.nix b/pkgs/by-name/ap/apidog/package.nix
index b0b73272c95c..9f40de3c39b6 100644
--- a/pkgs/by-name/ap/apidog/package.nix
+++ b/pkgs/by-name/ap/apidog/package.nix
@@ -7,11 +7,11 @@
 
 let
   pname = "apidog";
-  version = "2.8.24";
+  version = "2.8.26";
 
   src = fetchurl {
     url = "https://file-assets.apidog.com/download/${version}/Apidog-${version}.AppImage";
-    hash = "sha256-gGhA++wfgURhibGF2tXAmH0orX2VSUiJsAo3wAu6t1g=";
+    hash = "sha256-u+J5OKgqOKEE35IhMpL7LUB4UgaX2XZKfnUczfLhjoU=";
   };
 
   appimageContents = appimageTools.extract {
diff --git a/pkgs/by-name/ap/apt-swarm/package.nix b/pkgs/by-name/ap/apt-swarm/package.nix
index 9725f132ca64..a6e2617b87a4 100644
--- a/pkgs/by-name/ap/apt-swarm/package.nix
+++ b/pkgs/by-name/ap/apt-swarm/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "apt-swarm";
-  version = "0.5.1";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "kpcyrd";
     repo = "apt-swarm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zb0X6vIRKeI5Ysc88sTCJBlr9r8hrsTq5YR7YCg1L30=";
+    hash = "sha256-tDIwx+Eb/5EH9p407+FfKAwU6ZjNxyKtfFe5h7eTnHg=";
   };
 
-  cargoHash = "sha256-PELTEzhsFa1nl7iqrjnuXEI0U7L8rL9XW9XqQ04rz/s=";
+  cargoHash = "sha256-43TFrddQvmzUzk2JnggKKWljBNzO+7IYF8HsTwez7a4=";
 
   meta = {
     description = "Experimental p2p gossip network for OpenPGP signature transparency";
diff --git a/pkgs/by-name/ba/badrobot/package.nix b/pkgs/by-name/ba/badrobot/package.nix
index 66ef63c07eb9..628c41978e11 100644
--- a/pkgs/by-name/ba/badrobot/package.nix
+++ b/pkgs/by-name/ba/badrobot/package.nix
@@ -13,7 +13,7 @@ buildGoModule (finalAttrs: {
   src = fetchFromGitHub {
     owner = "controlplaneio";
     repo = "badrobot";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     sha256 = "sha256-U3b5Xw+GjnAEXteivztHdcAcXx7DYtgaUbW5oax0mIk=";
   };
   vendorHash = "sha256-oYdkCEdrw1eE5tnKveeJM3upRy8hOVc24JNN1bLX+ec=";
@@ -35,7 +35,7 @@ buildGoModule (finalAttrs: {
 
   meta = {
     homepage = "https://github.com/controlplaneio/badrobot";
-    changelog = "https://github.com/controlplaneio/badrobot/blob/v${finalAttrs.version}/CHANGELOG.md";
+    changelog = "https://github.com/controlplaneio/badrobot/releases/tag/v${finalAttrs.src.tag}";
     description = "Operator Security Audit Tool";
     mainProgram = "badrobot";
     longDescription = ''
@@ -47,6 +47,8 @@ buildGoModule (finalAttrs: {
       cluster permissions.
     '';
     license = with lib.licenses; [ asl20 ];
-    maintainers = with lib.maintainers; [ jk ];
+    maintainers = with lib.maintainers; [
+      jk
+    ];
   };
 })
diff --git a/pkgs/by-name/bi/biome/package.nix b/pkgs/by-name/bi/biome/package.nix
index 723858e3de4b..de8832023e8c 100644
--- a/pkgs/by-name/bi/biome/package.nix
+++ b/pkgs/by-name/bi/biome/package.nix
@@ -11,16 +11,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "biome";
-  version = "2.4.12";
+  version = "2.4.13";
 
   src = fetchFromGitHub {
     owner = "biomejs";
     repo = "biome";
     rev = "@biomejs/biome@${finalAttrs.version}";
-    hash = "sha256-PVax57P496gDksvyGskW3MeR9YDZFE0E8yiv2zW6L/o=";
+    hash = "sha256-Pie1oc1mc6lsdmSiOu04ci67DToDYRt36hdHsU0ZGXw=";
   };
 
-  cargoHash = "sha256-638M2/qRXTZSD4/2/PWkfo5DbsLzWlhwwSBGlkUaLBc=";
+  cargoHash = "sha256-ayFCjh1gBLOJoUnDKm+kwUzshGS0utqTewfe5wEdvQ0=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/bo/boinc/package.nix b/pkgs/by-name/bo/boinc/package.nix
index 7d16cae6f317..7222362adeb4 100644
--- a/pkgs/by-name/bo/boinc/package.nix
+++ b/pkgs/by-name/bo/boinc/package.nix
@@ -28,14 +28,14 @@
 
 stdenv.mkDerivation rec {
   pname = "boinc";
-  version = "8.2.10";
+  version = "8.2.11";
 
   src = fetchFromGitHub {
     name = "${pname}-${version}-src";
     owner = "BOINC";
     repo = "boinc";
     rev = "client_release/${lib.versions.majorMinor version}/${version}";
-    hash = "sha256-+/EuGJluTXhEWZT97P60vE6e8uX3+GdCyJwf9nzsh4E=";
+    hash = "sha256-xWEAjTWEUCTTtxfCFFMcrJD0DRVmUAgi2vE0GifTX2Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/bo/boulder/package.nix b/pkgs/by-name/bo/boulder/package.nix
index 404168f329a6..7a3c851e7876 100644
--- a/pkgs/by-name/bo/boulder/package.nix
+++ b/pkgs/by-name/bo/boulder/package.nix
@@ -9,7 +9,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "boulder";
-  version = "0.20260413.0";
+  version = "0.20260428.0";
 
   src = fetchFromGitHub {
     owner = "letsencrypt";
@@ -22,7 +22,7 @@ buildGoModule (finalAttrs: {
       find $out -name .git -print0 | xargs -0 rm -rf
       popd
     '';
-    hash = "sha256-8saRz7g0KsXNr5oR4a2qd4kKDR686J0TIFMzsX/zlV0=";
+    hash = "sha256-ky6geY8pIBhnpwQ4bbzQN0+EQgOfwlo8EQ0rTZdtNIA=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/bt/btest/package.nix b/pkgs/by-name/bt/btest/package.nix
index 451e8f9c0394..48d73cd7f887 100644
--- a/pkgs/by-name/bt/btest/package.nix
+++ b/pkgs/by-name/bt/btest/package.nix
@@ -44,7 +44,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   meta = {
     description = "Bandwidth Test server and client";
     homepage = "https://github.com/manawenuz/btest-rs";
-    changelog = "https://github.com/manawenuz/btest-rs/releases/tag/v${finalAttrs.src.tag}";
+    changelog = "https://github.com/manawenuz/btest-rs/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "btest";
diff --git a/pkgs/by-name/ca/calcurse/package.nix b/pkgs/by-name/ca/calcurse/package.nix
index f94876e38594..56c6daaf6f98 100644
--- a/pkgs/by-name/ca/calcurse/package.nix
+++ b/pkgs/by-name/ca/calcurse/package.nix
@@ -44,7 +44,6 @@ stdenv.mkDerivation (finalAttrs: {
       be used to filter and format appointments, making it suitable for use in scripts.
     '';
     homepage = "https://calcurse.org/";
-    changelog = "https://git.calcurse.org/calcurse.git/plain/CHANGES.md?h=v${finalAttrs.version}";
     license = lib.licenses.bsd2;
     platforms = lib.platforms.unix;
     maintainers = [ lib.maintainers.matthiasbeyer ];
diff --git a/pkgs/by-name/ca/cantus/package.nix b/pkgs/by-name/ca/cantus/package.nix
index 1850cd0f684c..8efe5ba30b2a 100644
--- a/pkgs/by-name/ca/cantus/package.nix
+++ b/pkgs/by-name/ca/cantus/package.nix
@@ -12,16 +12,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cantus";
-  version = "0.6.5";
+  version = "0.6.6";
 
   src = fetchFromGitHub {
     owner = "CodedNil";
     repo = "cantus";
     tag = finalAttrs.version;
-    hash = "sha256-pnc/fjmi932tZQsAfvvAoZ1PXEP8gckGuauR+5btei8=";
+    hash = "sha256-4bnIYOHVOPawDg4s5mPKYXURpDSVgyTmoh1WiGj/Zl8=";
   };
 
-  cargoHash = "sha256-sDZF5cWlhsBblAe0sreGbfgXKIip5raM0r9ZeJrLrLQ=";
+  cargoHash = "sha256-TbbXZGToQTH0k6KxpCsjcG/kOFY0c4L/P8QUpDyQ+2E=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ca/cargo-info/package.nix b/pkgs/by-name/ca/cargo-info/package.nix
index 463564c1e890..f1257e14a907 100644
--- a/pkgs/by-name/ca/cargo-info/package.nix
+++ b/pkgs/by-name/ca/cargo-info/package.nix
@@ -31,7 +31,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Cargo subcommand to show crates info from crates.io";
     mainProgram = "cargo-info";
     homepage = "https://gitlab.com/imp/cargo-info";
-    changelog = "https://gitlab.com/imp/cargo-info/-/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    changelog = "https://gitlab.com/imp/cargo-info/-/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = with lib.licenses; [
       mit
       asl20
diff --git a/pkgs/by-name/ca/cargo-mobile2/package.nix b/pkgs/by-name/ca/cargo-mobile2/package.nix
index 52119f73c8d3..b1de6de9da8b 100644
--- a/pkgs/by-name/ca/cargo-mobile2/package.nix
+++ b/pkgs/by-name/ca/cargo-mobile2/package.nix
@@ -10,20 +10,20 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-mobile2";
-  version = "0.22.3";
+  version = "0.22.4";
 
   src = fetchFromGitHub {
     owner = "tauri-apps";
     repo = "cargo-mobile2";
     rev = "cargo-mobile2-v${finalAttrs.version}";
-    hash = "sha256-rPLGh7/lGsmoidtr+UNrxzUgqtiHvkqZs2/la4L6zQM=";
+    hash = "sha256-DjoWjdgfNHLZkaWUjPq4tNrmHsifKKhBaRjK25WRdiE=";
   };
 
   # Manually specify the sourceRoot since this crate depends on other crates in the workspace. Relevant info at
   # https://discourse.nixos.org/t/difficulty-using-buildrustpackage-with-a-src-containing-multiple-cargo-workspaces/10202
   # sourceRoot = "${src.name}/tooling/cli";
 
-  cargoHash = "sha256-ht9ofFa4H/Ux6a31vMNdKNhrX48yoYM1qAPoxCjude0=";
+  cargoHash = "sha256-m+9wPfheH9t7zxTsW7vHe4td/gyeC/nXFDHRGjK5XBg=";
 
   buildInputs = [ openssl ];
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ca/cargo-public-api/package.nix b/pkgs/by-name/ca/cargo-public-api/package.nix
index fb5fe7e22995..68b4db065e88 100644
--- a/pkgs/by-name/ca/cargo-public-api/package.nix
+++ b/pkgs/by-name/ca/cargo-public-api/package.nix
@@ -31,8 +31,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   meta = {
     description = "List and diff the public API of Rust library crates between releases and commits. Detect breaking API changes and semver violations";
     mainProgram = "cargo-public-api";
-    homepage = "https://github.com/Enselic/cargo-public-api";
-    changelog = "https://github.com/Enselic/cargo-public-api/releases/tag/v${finalAttrs.version}";
+    homepage = "https://github.com/cargo-public-api/cargo-public-api";
+    changelog = "https://github.com/cargo-public-api/cargo-public-api/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ matthiasbeyer ];
   };
diff --git a/pkgs/by-name/ca/cargo-udeps/package.nix b/pkgs/by-name/ca/cargo-udeps/package.nix
index 13d6617b1e16..9cf38f94b344 100644
--- a/pkgs/by-name/ca/cargo-udeps/package.nix
+++ b/pkgs/by-name/ca/cargo-udeps/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-udeps";
-  version = "0.1.60";
+  version = "0.1.61";
 
   src = fetchFromGitHub {
     owner = "est31";
     repo = "cargo-udeps";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-NW9yjFUV+o7vv5bYD8nxSWHOXOBnDEk36xze90wYuNg=";
+    sha256 = "sha256-yT/EJWGGhQapbU1o1Gus1Vk5cAhso5ALTBecB3BH46g=";
   };
 
-  cargoHash = "sha256-vQvtc/CwV1aHeREzmzO8k1FcebbEp3FKMAJb0v2aQig=";
+  cargoHash = "sha256-DGfAsBucFRFJkjmJkpTpNfQO79jaNa5NezXKf7hYYeM=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/ch/chroma/package.nix b/pkgs/by-name/ch/chroma/package.nix
index 04b828b673ef..dd31926f9880 100644
--- a/pkgs/by-name/ch/chroma/package.nix
+++ b/pkgs/by-name/ch/chroma/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "chroma";
-  version = "2.23.1";
+  version = "2.24.0";
 
   src = fetchFromGitHub {
     owner = "alecthomas";
     repo = "chroma";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Znmcds0ru9VyH/0qE7KnW7l0QeRDoh9PnUPHTYPAA6w=";
+    hash = "sha256-KfojHrRJjGT03WeBobvBO9pHsJP6I7fSxzcSlmCsaxE=";
   };
 
-  vendorHash = "sha256-3mmO5hjjIqVqKiSOrFFQH8OaQTviJVHrznMYsgHP82A=";
+  vendorHash = "sha256-Vq5k4Jz4r5iZs7Yy175Ubj92eSr4v1xCtbLYhfo3OAg=";
 
   modRoot = "./cmd/chroma";
 
diff --git a/pkgs/by-name/cl/claude-code/manifest.json b/pkgs/by-name/cl/claude-code/manifest.json
index 774b34827eca..7d9c6867f89b 100644
--- a/pkgs/by-name/cl/claude-code/manifest.json
+++ b/pkgs/by-name/cl/claude-code/manifest.json
@@ -1,47 +1,47 @@
 {
-  "version": "2.1.119",
-  "commit": "6f68554839756189e277b8285a18fe47acd9a5a1",
-  "buildDate": "2026-04-23T20:45:14Z",
+  "version": "2.1.121",
+  "commit": "16ffea721a0a39bc787a236dc19fb62307180b75",
+  "buildDate": "2026-04-27T01:51:03Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "31db3444309d5d0f8b85e8782e2dcd86f31f7e48c1a1e83d69b09268c7b4f9a2",
-      "size": 213404000
+      "checksum": "3810e55d47ed4d413de6dc037e34d58948f779a4c6bdeeacf1748d850c5daad6",
+      "size": 215417984
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "52b3b75cfe80c626982b2ffb3a6ce1c797824f257dc275cf0a3c32c202b6a3df",
-      "size": 214951760
+      "checksum": "59d817dde54eeef0d752e7bd3869586e6eb5fa2b1d785c06fb9cda8804166037",
+      "size": 216982224
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "382aa73ea4b07fd8d698e3159b5ef9e1b8739fae7505ba8ddd28b8a6a62819ce",
-      "size": 245500480
+      "checksum": "71b78e6364f97a227b17be40dfcc237461f8d2b1d109444d24b42af0fdefac31",
+      "size": 247466560
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "cca43053f062949495596b11b6fd1b59cf79102adb13bacbe66997e6fae41e4a",
-      "size": 245230208
+      "checksum": "b4b684bbcb3a88029ec419dbc08824b2f3c69656a0aa2374860f9525fc67c98f",
+      "size": 247265920
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "e09bfaedd8bfdeaebe5f1cf9bb81ebeb718312c68fffce379fb51786263143d0",
-      "size": 238225856
+      "checksum": "2f8e2a81f7d41a9cf3e9269fb3237df968194cc7bf8ba478392cd5217d55e8d1",
+      "size": 240191872
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "ef41a11653b39c14db2d343f1f5e2a3af7eb9871c63e64deb6e65919670a4e0b",
-      "size": 239495616
+      "checksum": "d5ad436e256291df5e2248d1026a971229dde43544db3267892afd5c89934eb1",
+      "size": 241531264
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "e18c7dcfad4a3f5d33d202ec2dde630b648cf5b41622154d6210e793c7cceadc",
-      "size": 254478496
+      "checksum": "0a85980a38e9d8fbb2ba51f1d27c3425c7870f75e053ae4be266d23e10edde4a",
+      "size": 253241504
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "9e0deb10c45108612484ce558fad378206d5ac23feb203067450e6c38d001241",
-      "size": 251203232
+      "checksum": "9c9e1c68d50bb80f5e8d4a91645f042d4802a4fb0f87c34a504ecbb69a54860a",
+      "size": 249304224
     }
   }
 }
diff --git a/pkgs/by-name/cl/clightning/package.nix b/pkgs/by-name/cl/clightning/package.nix
index b99d50a2d6b9..38f6c7d41000 100644
--- a/pkgs/by-name/cl/clightning/package.nix
+++ b/pkgs/by-name/cl/clightning/package.nix
@@ -29,11 +29,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "clightning";
-  version = "26.04";
+  version = "26.04.1";
 
   src = fetchurl {
     url = "https://github.com/ElementsProject/lightning/releases/download/v${finalAttrs.version}/clightning-v${finalAttrs.version}.zip";
-    hash = "sha256-6dxnhLkXIrfxqXi+UoBKsJw1YFIanOVGBYizJB0X3oU=";
+    hash = "sha256-MEsZ5GPCY6q/SNO+xcktfGiCZUVgl4p7pdMOiqIqFJM=";
   };
 
   # when building on darwin we need cctools to provide the correct libtool
diff --git a/pkgs/by-name/cl/cloudprober/package.nix b/pkgs/by-name/cl/cloudprober/package.nix
index d3c152dcaccc..7c23aaf4bf3a 100644
--- a/pkgs/by-name/cl/cloudprober/package.nix
+++ b/pkgs/by-name/cl/cloudprober/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "cloudprober";
-  version = "0.14.1";
+  version = "0.14.3";
 
   src = fetchFromGitHub {
     owner = "cloudprober";
     repo = "cloudprober";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XFMjUwsRfWAnrNsegUPqWz8Bcc/naEBhytqq/o21ras=";
+    hash = "sha256-dMogW0NQAMiSBC7//7gGmadvK5vS2H+170aW0RK58fU=";
   };
 
-  vendorHash = "sha256-+EVcYFnWPSNfxUzxuL3tAHjCCDad/7K11y3dk2CUtrU=";
+  vendorHash = "sha256-YEueI/Ms350bNkKPmLNzLljr9FDL0R7zACF4HQwHLdk=";
 
   checkFlags =
     let
diff --git a/pkgs/by-name/cl/clusterlint/package.nix b/pkgs/by-name/cl/clusterlint/package.nix
index 02e914dde2e6..21a1c84bde06 100644
--- a/pkgs/by-name/cl/clusterlint/package.nix
+++ b/pkgs/by-name/cl/clusterlint/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "clusterlint";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "digitalocean";
     repo = "clusterlint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iOd0mjVJDtALxdsmG6+ruJ8CxoNe17D9grkjRW+N34A=";
+    hash = "sha256-6QgWWSiwVZv8rYJNvfzxNsrxCqJbR/MBcCr3ESrO6Fc=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/co/coldsnap/package.nix b/pkgs/by-name/co/coldsnap/package.nix
index f1eadab25e62..7eb0fb8d38ab 100644
--- a/pkgs/by-name/co/coldsnap/package.nix
+++ b/pkgs/by-name/co/coldsnap/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "coldsnap";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "coldsnap";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-8+YPKjHi3VURzSOflIa0x4uBkoDMYGFJiFcNJ+8NJ7Q=";
+    hash = "sha256-QQWH8cWBskXOmiZygvkNDyBX4WdsgnA0/ec6/UnmwIA=";
   };
 
-  cargoHash = "sha256-4w79zZcgIulLIArY2ErOHwaWA8g/mA2cSKCzJx4X9vM=";
+  cargoHash = "sha256-U5MinzKQYTHRXM3WndkMEbvoT9tPwIIB3QxEOwWA3zE=";
 
   buildInputs = [ openssl ];
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/by-name/co/cosmic-ext-applet-weather/package.nix b/pkgs/by-name/co/cosmic-ext-applet-weather/package.nix
index 538bf77b47af..7fa5f127435c 100644
--- a/pkgs/by-name/co/cosmic-ext-applet-weather/package.nix
+++ b/pkgs/by-name/co/cosmic-ext-applet-weather/package.nix
@@ -9,13 +9,13 @@
 }:
 rustPlatform.buildRustPackage {
   pname = "cosmic-ext-applet-weather";
-  version = "0-unstable-2026-03-23";
+  version = "0-unstable-2026-04-27";
 
   src = fetchFromGitHub {
     owner = "cosmic-utils";
     repo = "cosmic-ext-applet-weather";
-    rev = "e98c57c586180df0abf6efbe3ee479fc4849f4f7";
-    hash = "sha256-8m1L98wt0uf1vnZ7z4meb/9hU+k5bqe7x7Pidf1lBGM=";
+    rev = "943041c6e1e49d4a6ae267350d7818213e197bc5";
+    hash = "sha256-ZTZ3IjEte3Knkm77i/C0Qq5lx8g3je6GsRlSSrWpFRQ=";
   };
 
   cargoHash = "sha256-DmPUA9qRgCMqVqBNVfyQg4UZkqnZXZvokoSAqPxg0Zc=";
diff --git a/pkgs/by-name/dg/dgop/package.nix b/pkgs/by-name/dg/dgop/package.nix
index 88531c7831ae..33885162ae67 100644
--- a/pkgs/by-name/dg/dgop/package.nix
+++ b/pkgs/by-name/dg/dgop/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "dgop";
-  version = "0.2.0";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "AvengeMedia";
     repo = "dgop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CxTvTx7WYKj9usa1uZDUmCqS9+W0QoIeTGDlkhHLVho=";
+    hash = "sha256-kYEFJvJApcgVgFu6QpSoNk2t0hv7AlmBARc5HPe/n+s=";
   };
 
-  vendorHash = "sha256-4GslUKwUCO8oOqylsclJmAZL/ds0plenzcTAwAXKtrc=";
+  vendorHash = "sha256-OxcSnBIDwbPbsXRHDML/Yaxcc5caoKMIDVHLFXaoSsc=";
 
   ldflags = [
     "-w"
@@ -28,8 +28,6 @@ buildGoModule (finalAttrs: {
   nativeBuildInputs = [ installShellFiles ];
 
   postInstall = ''
-    mv $out/bin/{cli,dgop}
-
     installShellCompletion --cmd dgop \
       --bash <($out/bin/dgop completion bash) \
       --fish <($out/bin/dgop completion fish) \
diff --git a/pkgs/by-name/di/di-tui/package.nix b/pkgs/by-name/di/di-tui/package.nix
index 51070f8a6b7e..18541eae9074 100644
--- a/pkgs/by-name/di/di-tui/package.nix
+++ b/pkgs/by-name/di/di-tui/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "di-tui";
-  version = "1.13.3";
+  version = "1.13.4";
 
   src = fetchFromGitHub {
     owner = "acaloiaro";
     repo = "di-tui";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-rT9iH9kkkWtg4H7YJUD2ElvWLUIzFHGSlH31A68pDDo=";
+    hash = "sha256-0PIKPprAqGbVFiGFxwzgmS4fYKTHfpdpWWUMuxK67tQ=";
   };
 
   vendorHash = "sha256-b7dG0nSjPQpjWUbOlIxWudPZWKqtq96sQaJxKvsQT9I=";
diff --git a/pkgs/by-name/di/directx-shader-compiler/package.nix b/pkgs/by-name/di/directx-shader-compiler/package.nix
index 5eff273801cb..3a1b7114816b 100644
--- a/pkgs/by-name/di/directx-shader-compiler/package.nix
+++ b/pkgs/by-name/di/directx-shader-compiler/package.nix
@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "directx-shader-compiler";
-  version = "1.9.2602";
+  version = "1.10.2605.2";
 
   # Put headers in dev, there are lot of them which aren't necessary for
   # using the compiler binary.
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "microsoft";
     repo = "DirectXShaderCompiler";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-S3ar1LTV/9fYU2B5y8x0ESB20lMnAx8XQw9n3G4z0nk=";
+    hash = "sha256-FzfXxfhAyJw7rouWJEyeVdikG5TBM81yC+9iRg5tK3c=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/dm/dms-shell/package.nix b/pkgs/by-name/dm/dms-shell/package.nix
index 0c3f7be424e6..033bf01d20c9 100644
--- a/pkgs/by-name/dm/dms-shell/package.nix
+++ b/pkgs/by-name/dm/dms-shell/package.nix
@@ -28,13 +28,13 @@ buildGoModule (
   in
   {
     pname = "dms-shell";
-    version = "1.4.5";
+    version = "1.4.6";
 
     src = fetchFromGitHub {
       owner = "AvengeMedia";
       repo = "DankMaterialShell";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-K/DtFratLxaZ4+YS9G+HZA37banWacXYznmul3XPKKM=";
+      hash = "sha256-g6r/Gx8PTDzO3jCNzzySA+Ff1lmLF9nDlMCNyyoQjoE=";
     };
 
     sourceRoot = "${finalAttrs.src.name}/core";
diff --git a/pkgs/by-name/do/dotenvx/package.nix b/pkgs/by-name/do/dotenvx/package.nix
index 5a2c7ca5a3ae..06df698995aa 100644
--- a/pkgs/by-name/do/dotenvx/package.nix
+++ b/pkgs/by-name/do/dotenvx/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "dotenvx";
-  version = "1.61.5";
+  version = "1.64.0";
 
   src = fetchFromGitHub {
     owner = "dotenvx";
     repo = "dotenvx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yyAlEgIbPQocPnZvDbmK2MIYpglESkQGMYE7PmJDdEM=";
+    hash = "sha256-Xa3xtDzvSbgba083R2g3vV8Jtv86NMEbZ/EhYxmGsKA=";
   };
 
-  npmDepsHash = "sha256-YQ3b7Fm33Mfp2l2LQ/+iYal+iBTZn5v7lUyZ2geY46A=";
+  npmDepsHash = "sha256-WeqODrueKqDFvIsXHlzWhHSdqPY/uS+VM+wCp69LN9M=";
 
   dontNpmBuild = true;
 
diff --git a/pkgs/by-name/fe/feishu-cli/package.nix b/pkgs/by-name/fe/feishu-cli/package.nix
index ef26179f3473..e6f66c86adc1 100644
--- a/pkgs/by-name/fe/feishu-cli/package.nix
+++ b/pkgs/by-name/fe/feishu-cli/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "feishu-cli";
-  version = "1.21.0";
+  version = "1.22.0";
 
   src = fetchFromGitHub {
     owner = "riba2534";
     repo = "feishu-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4+YEU0gRL3WF19a949QweVIdtXt8BWMummjK9ypBHXQ=";
+    hash = "sha256-n7CqaVpuzJg5oPI7RixvDp8xSA93292yY9K8jmzd+68=";
   };
 
   vendorHash = "sha256-MZv772U+3+Fcanaiuhz+OCqfIsYyCG7B4iZOnEftbi8=";
diff --git a/pkgs/by-name/fl/fluxcd/package.nix b/pkgs/by-name/fl/fluxcd/package.nix
index 1bcb6d082fd1..96eae97cadb1 100644
--- a/pkgs/by-name/fl/fluxcd/package.nix
+++ b/pkgs/by-name/fl/fluxcd/package.nix
@@ -9,10 +9,10 @@
 }:
 
 let
-  version = "2.8.5";
-  srcHash = "sha256-2Q6l+egcRntGjieXpXz/frGGw4GMhGXxQAUOAZfxBE4=";
-  vendorHash = "sha256-D92vOyTvlpOou/1WHS6xpb4e8igZMQhm4DP7SVSLKPI=";
-  manifestsHash = "sha256-X0Cf8UZufqUWKLxYVjblYNCz5IU/s+mI+h6TpTeks5k=";
+  version = "2.8.6";
+  srcHash = "sha256-pKP4g2pTMYtx/B/Y3ow7tvDdhCSuwbszzeLVXB0W7Bo=";
+  vendorHash = "sha256-VBafft9/AuXaHWvZymy7P9gaSuO8D6IZHfK68Ixp3mI=";
+  manifestsHash = "sha256-h/HR/rJwPWXiuoj9T+LajdsdT4Jo8/EuN+O1I7e9sjI=";
 
   manifests = fetchzip {
     url = "https://github.com/fluxcd/flux2/releases/download/v${version}/manifests.tar.gz";
@@ -82,6 +82,7 @@ buildGoModule rec {
       jlesquembre
       ryan4yin
       SchahinRohani
+      stealthybox
       superherointj
     ];
     mainProgram = "flux";
diff --git a/pkgs/by-name/fl/flyctl/package.nix b/pkgs/by-name/fl/flyctl/package.nix
index 693b37b9b691..8a35497c0404 100644
--- a/pkgs/by-name/fl/flyctl/package.nix
+++ b/pkgs/by-name/fl/flyctl/package.nix
@@ -12,7 +12,7 @@
 
 buildGoModule rec {
   pname = "flyctl";
-  version = "0.4.36";
+  version = "0.4.42";
 
   src = fetchFromGitHub {
     owner = "superfly";
@@ -22,11 +22,11 @@ buildGoModule rec {
       cd "$out"
       git rev-parse HEAD > COMMIT
     '';
-    hash = "sha256-WMENTGVwMICIrgMbl31cEaBpznyv3+XFtAhP8AajWyo=";
+    hash = "sha256-yAzd7bytBKxOBGs8ja48QPVdmJSvRfIzi8K2DoC0O+Y=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-qGG+xOBe8JLt+F4iTNMEC1XTs5H/rfLtUZO7QXYAaZg=";
+  vendorHash = "sha256-TUlOdRfexuxC2Of6ZHPYChCr3i1IGapLZz1/lAhnUxk=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/fo/forgejo/generic.nix b/pkgs/by-name/fo/forgejo/generic.nix
index 229f3483e3c9..413b070c3143 100644
--- a/pkgs/by-name/fo/forgejo/generic.nix
+++ b/pkgs/by-name/fo/forgejo/generic.nix
@@ -126,6 +126,7 @@ buildGoModule rec {
         "TestDNSUpdate" # requires network: release.forgejo.org
         "TestMigrateWhiteBlocklist" # requires network: gitlab.com (DNS)
         "TestURLAllowedSSH/Pushmirror_URL" # requires network git.gay (DNS)
+        "TestBleveDeleteIssue" # Known Flake-y https://github.com/NixOS/nixpkgs/issues/509878
       ];
     in
     [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
diff --git a/pkgs/by-name/fo/forgejo/package.nix b/pkgs/by-name/fo/forgejo/package.nix
index 78da7be18911..45dd978fd3a5 100644
--- a/pkgs/by-name/fo/forgejo/package.nix
+++ b/pkgs/by-name/fo/forgejo/package.nix
@@ -1,8 +1,8 @@
 import ./generic.nix {
-  version = "15.0.0";
-  hash = "sha256-KAGHascGFj4X6b4BpRqQ8yCedNh0nvHfQgbzJh9fxAc=";
-  npmDepsHash = "sha256-AWvLcAS7EEy796kAQfiQ8sFSh/s+6zNCJEqe4qzQL3s=";
-  vendorHash = "sha256-bP7cykWKwNQrWm9jJT4YYAHRV66HaTwGkvhBqSHgWAA=";
+  version = "15.0.1";
+  hash = "sha256-40hyQ6MPskyty/LsMVczuDpbu2q3Syoj3c00HUS+pVE=";
+  npmDepsHash = "sha256-xWbnSX11RkLjtJ62qG6rD+xQAOnUuI99r9uEHakkZPY=";
+  vendorHash = "sha256-JUBAcRYgflrvoAK0OvaU/Xr6/BakgaUtYwtvBF9vyk0=";
   lts = true;
   nixUpdateExtraArgs = [
     "--override-filename"
diff --git a/pkgs/by-name/fo/fosrl-newt/package.nix b/pkgs/by-name/fo/fosrl-newt/package.nix
index feaa90c5fab3..f860f071bfd9 100644
--- a/pkgs/by-name/fo/fosrl-newt/package.nix
+++ b/pkgs/by-name/fo/fosrl-newt/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "newt";
-  version = "1.12.0";
+  version = "1.12.2";
 
   src = fetchFromGitHub {
     owner = "fosrl";
     repo = "newt";
     tag = finalAttrs.version;
-    hash = "sha256-csD7QcSQE4/eRw3EHX0m2nI3JjglFxXlnyuS4xpCmRY=";
+    hash = "sha256-5+B1sderUwy6hJPKFRK8fV0bX2+rgHh3WmAjgQqVsR4=";
   };
 
   vendorHash = "sha256-+zMSzNbqmWm/DXL2xMUd5uPP5tSIybsRokwJ2zd0pf0=";
diff --git a/pkgs/by-name/ga/gaphor/package.nix b/pkgs/by-name/ga/gaphor/package.nix
index c7fbcfed9c7e..0718166c7761 100644
--- a/pkgs/by-name/ga/gaphor/package.nix
+++ b/pkgs/by-name/ga/gaphor/package.nix
@@ -13,14 +13,14 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "gaphor";
-  version = "3.3.0";
+  version = "3.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "gaphor";
     repo = "gaphor";
     tag = finalAttrs.version;
-    hash = "sha256-bgcri0mgFKz4jtGJSWtlStS3f4FzYH+ZPE1BsK+S1DI=";
+    hash = "sha256-oGOi1vyLOrElj/kbqHgPEyAwtVvVA3a1j9VSWMts/bM=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/by-name/ga/garmin-grafana/package.nix b/pkgs/by-name/ga/garmin-grafana/package.nix
index 262c1adaf30e..376c8584fd3c 100644
--- a/pkgs/by-name/ga/garmin-grafana/package.nix
+++ b/pkgs/by-name/ga/garmin-grafana/package.nix
@@ -5,7 +5,7 @@
 }:
 python3Packages.buildPythonPackage rec {
   pname = "garmin-grafana";
-  version = "0.3.0";
+  version = "0.5.0";
 
   pyproject = true;
 
@@ -13,7 +13,7 @@ python3Packages.buildPythonPackage rec {
     owner = "arpanghosh8453";
     repo = "garmin-grafana";
     tag = "v${version}";
-    hash = "sha256-nuVT6LK9KIs/FwUbdfI4xpKru4jfAyj1/vmk7ji43zk=";
+    hash = "sha256-NrT4erpdWwqFBUumQdd5GqpmhIayszzkPd8fUgDRwXY=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/ge/gearboy/package.nix b/pkgs/by-name/ge/gearboy/package.nix
index 07da3788b61c..831dd4ae0464 100644
--- a/pkgs/by-name/ge/gearboy/package.nix
+++ b/pkgs/by-name/ge/gearboy/package.nix
@@ -16,13 +16,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gearboy";
-  version = "3.8.2";
+  version = "3.8.3";
 
   src = fetchFromGitHub {
     owner = "drhelius";
     repo = "Gearboy";
     tag = finalAttrs.version;
-    hash = "sha256-JgvTt/nUV2CiSJNC3NnKpoa28xAMhRxEh9txqE9FPzU=";
+    hash = "sha256-3wyAwK61lusmVYbt9m10H4I4KUHAUAlC0bP9LqGB/OE=";
   };
 
   __structuredAttrs = true;
diff --git a/pkgs/by-name/ge/gefyra/package.nix b/pkgs/by-name/ge/gefyra/package.nix
index 5e18be3f7040..3d831bb775e7 100644
--- a/pkgs/by-name/ge/gefyra/package.nix
+++ b/pkgs/by-name/ge/gefyra/package.nix
@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gefyra";
-  version = "2.4.1";
+  version = "2.4.3";
 
   src = fetchzip {
     url = "https://github.com/gefyrahq/gefyra/releases/download/${finalAttrs.version}/gefyra-${finalAttrs.version}-linux-amd64.zip";
-    hash = "sha256-XS+vtwb6UIJK7f3R3QLoyX9+P4n79Fh+v7odiot7Yic=";
+    hash = "sha256-HWcW4JX8XglcB3OkJKdaKtZ6D9Mdg3jff0nqHOS4ESg=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/gh/gh-cherry-pick/package.nix b/pkgs/by-name/gh/gh-cherry-pick/package.nix
index 749b867a78b9..328f82354b60 100644
--- a/pkgs/by-name/gh/gh-cherry-pick/package.nix
+++ b/pkgs/by-name/gh/gh-cherry-pick/package.nix
@@ -5,14 +5,14 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "gh-cherry-pick";
-  version = "1.4.0";
+  version = "1.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PerchunPak";
     repo = "gh-cherry-pick";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ec9q+3nd1zJ2K3dyWqLsdTH5GBJ4B1b8D/4Wd6d8PcA=";
+    hash = "sha256-a2vhQ9upJYc+t4Juq+eukNc7dzq6MafNxDUULPZs9sQ=";
   };
 
   build-system = with python3Packages; [
@@ -25,10 +25,18 @@ python3Packages.buildPythonApplication (finalAttrs: {
     httpx
   ];
 
+  # upstream has strict dependency pins, but it doesn't break with slightly
+  # newer/older versions
+  #   (c) upstream maintainer
+  pythonRelaxDeps = true;
+
   nativeCheckInputs = with python3Packages; [
-    pytestCheckHook
+    faker
+    pytest-asyncio
     pytest-cov-stub
+    pytest-httpx
     pytest-mock
+    pytestCheckHook
   ];
 
   pythonImportsCheck = [ "gh_cherry_pick" ];
diff --git a/pkgs/by-name/gi/git-gone/package.nix b/pkgs/by-name/gi/git-gone/package.nix
index 3bdf4b29b489..bd6a6488e1ef 100644
--- a/pkgs/by-name/gi/git-gone/package.nix
+++ b/pkgs/by-name/gi/git-gone/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  fetchFromGitHub,
+  fetchFromCodeberg,
   rustPlatform,
 }:
 
@@ -8,7 +8,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pname = "git-gone";
   version = "1.3.1";
 
-  src = fetchFromGitHub {
+  src = fetchFromCodeberg {
     owner = "swsnr";
     repo = "git-gone";
     tag = "v${finalAttrs.version}";
@@ -19,8 +19,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   meta = {
     description = "Cleanup stale Git branches of merge requests";
-    homepage = "https://github.com/swsnr/git-gone";
-    changelog = "https://github.com/swsnr/git-gone/raw/v${finalAttrs.version}/CHANGELOG.md";
+    homepage = "https://codeberg.org/swsnr/git-gone";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       cafkafk
diff --git a/pkgs/by-name/gi/gitnr/package.nix b/pkgs/by-name/gi/gitnr/package.nix
index 168f56a42d7b..9319ffafcb18 100644
--- a/pkgs/by-name/gi/gitnr/package.nix
+++ b/pkgs/by-name/gi/gitnr/package.nix
@@ -40,7 +40,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
   meta = {
     description = "Create `.gitignore` files using one or more templates from TopTal, GitHub or your own collection";
     homepage = "https://github.com/reemus-dev/gitnr";
-    changelog = "https://github.com/reemus-dev/gitnr/blob/${finalAttrs.src.rev}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       matthiasbeyer
diff --git a/pkgs/by-name/gl/glab/package.nix b/pkgs/by-name/gl/glab/package.nix
index 41403e94cb77..10ed2678e89a 100644
--- a/pkgs/by-name/gl/glab/package.nix
+++ b/pkgs/by-name/gl/glab/package.nix
@@ -13,13 +13,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "glab";
-  version = "1.92.1";
+  version = "1.93.0";
 
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4DUEsh2T5rx/0u79+edMLAjTRUmXxlbA0SVH/EwoeVo=";
+    hash = "sha256-ra+cXfB5DtFXmpgxSTZuXUgRY8Uzsxc84cmmAGq06AE=";
     leaveDotGit = true;
     postFetch = ''
       cd "$out"
@@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-fnVY1WEwzuRjHXQSGLl1c7bQXxzOHFEPlb/DhntYm2U=";
+  vendorHash = "sha256-FBYTwTGQ2ma4dEeCGpvduGAPux5g7MsxBHQy8QXXVgQ=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/go/gonzo/package.nix b/pkgs/by-name/go/gonzo/package.nix
index 52d953fa9aed..499706db3437 100644
--- a/pkgs/by-name/go/gonzo/package.nix
+++ b/pkgs/by-name/go/gonzo/package.nix
@@ -38,7 +38,7 @@ buildGoModule (finalAttrs: {
     description = "TUI log analysis tool";
     homepage = "https://gonzo.controltheory.com/";
     downloadPage = "https://github.com/control-theory/gonzo";
-    changelog = "https://github.com/control-theory/gonzo/releases/tag/v${finalAttrs.src.tag}";
+    changelog = "https://github.com/control-theory/gonzo/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ kpbaks ];
     mainProgram = "gonzo";
diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix
index aaae75769c2a..d0e5d88d145d 100644
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -184,11 +184,11 @@ let
 
   linux = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "147.0.7727.116";
+    version = "147.0.7727.137";
 
     src = fetchurl {
       url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-f4lIdknIXTTv3yxvs754n6/a01h5xxWWOvnjwQcIPnw=";
+      hash = "sha256-2QKA8nk+O10cGr0gGOMSlLkxpO+WHFG1yul9a3VGq64=";
     };
 
     # With strictDeps on, some shebangs were not being patched correctly
@@ -302,11 +302,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "147.0.7727.117";
+    version = "147.0.7727.138";
 
     src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/hlfggraqploqe3bea7acbi5wei_147.0.7727.117/GoogleChrome-147.0.7727.117.dmg";
-      hash = "sha256-GCdZAiqNSDcC6qgsJGS5renRrl3kLoH4X9VHX7aLXTw=";
+      url = "http://dl.google.com/release2/chrome/ackheqvxll25dzx6s76qfgpa4oxa_147.0.7727.138/GoogleChrome-147.0.7727.138.dmg";
+      hash = "sha256-1WOkBxAs79ByJ3quXgh+ZR64ysIE2/2wMeIhl3sYh5o=";
     };
 
     dontPatch = true;
diff --git a/pkgs/by-name/gr/grafana-to-ntfy/package.nix b/pkgs/by-name/gr/grafana-to-ntfy/package.nix
index ebeb5534d5b0..498ef0b25a47 100644
--- a/pkgs/by-name/gr/grafana-to-ntfy/package.nix
+++ b/pkgs/by-name/gr/grafana-to-ntfy/package.nix
@@ -1,28 +1,39 @@
 {
   lib,
-  rustPlatform,
   fetchFromGitHub,
+  rustPlatform,
+  nixosTests,
+  nix-update-script,
 }:
 
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "grafana-to-ntfy";
-  version = "0-unstable-2025-01-25";
+  version = "2026.4.29";
 
   src = fetchFromGitHub {
     owner = "kittyandrew";
     repo = "grafana-to-ntfy";
-    rev = "64d11f553776bbf7695d9febd74da1bad659352d";
-    hash = "sha256-GO9VE9wymRk+QKGFyDpd0wS9GCY3pjpFUe37KIcnKxc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ac0T8SNCDH9kQTKIfYn9KinnrSCYIBpNByO6NQ8UntA=";
   };
 
-  cargoHash = "sha256-w4HSxdihElPz0q05vWjajQ9arZjAzd82L0kEKk1Uk8s=";
+  cargoHash = "sha256-RuWXlofcruR69sg+RO2v1DBgxaPEyu8TeZEiZP7rBV8=";
+
+  # No unit tests; all testing is NixOS VM-based integration tests
+  doCheck = false;
+
+  passthru = {
+    tests.grafana-to-ntfy = nixosTests.grafana-to-ntfy;
+    updateScript = nix-update-script { };
+  };
 
   meta = {
-    description = "Bridge to forward Grafana alerts to ntfy.sh notification service";
+    description = "Bridge to forward Grafana and Prometheus Alertmanager alerts to ntfy.sh";
     homepage = "https://github.com/kittyandrew/grafana-to-ntfy";
+    changelog = "https://github.com/kittyandrew/grafana-to-ntfy/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.agpl3Only;
     platforms = lib.platforms.linux;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ kittyandrew ];
     mainProgram = "grafana-to-ntfy";
   };
-}
+})
diff --git a/pkgs/by-name/gr/groff/package.nix b/pkgs/by-name/gr/groff/package.nix
index df39f833e3b3..98a75751f925 100644
--- a/pkgs/by-name/gr/groff/package.nix
+++ b/pkgs/by-name/gr/groff/package.nix
@@ -34,6 +34,10 @@ let
     tag = "20200910";
     hash = "sha256-YQl5IDtodcbTV3D6vtJi7CwxVtHHl58fG6qCAoSaP4U=";
   };
+  nativeGroffBinPath = lib.makeBinPath [
+    buildPackages.groff
+    (lib.getOutput "perl" buildPackages.groff)
+  ];
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "groff";
@@ -125,13 +129,18 @@ stdenv.mkDerivation (finalAttrs: {
     # Move mom docs instead of linking them to avoid dangling symlinks
     substituteInPlace Makefile \
       --replace-fail '$(LN_S) $(exampledir)' 'mv $(exampledir)'
+  ''
+  + lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
+    # pdfmom uses GROFF_COMMAND to find the groff executable internally.
+    substituteInPlace Makefile \
+      --replace-fail 'GROFF_COMMAND=test-groff \' 'GROFF_COMMAND=$(GROFFBIN) \'
   '';
 
   makeFlags = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
     # Trick to get the build system find the proper 'native' groff
     # http://www.mail-archive.com/bug-groff@gnu.org/msg01335.html
-    "GROFF_BIN_PATH=${lib.getBin buildPackages.groff}/bin"
-    "GROFFBIN=${lib.getExe buildPackages.groff}"
+    "GROFF_BIN_PATH=${nativeGroffBinPath}"
+    "GROFFBIN=${lib.getExe' buildPackages.groff "groff"}"
   ];
 
   doCheck = true;
diff --git a/pkgs/tools/misc/grub/add-hidden-menu-entries.patch b/pkgs/by-name/gr/grub2/add-hidden-menu-entries.patch
similarity index 100%
rename from pkgs/tools/misc/grub/add-hidden-menu-entries.patch
rename to pkgs/by-name/gr/grub2/add-hidden-menu-entries.patch
diff --git a/pkgs/tools/misc/grub/fix-bash-completion.patch b/pkgs/by-name/gr/grub2/fix-bash-completion.patch
similarity index 100%
rename from pkgs/tools/misc/grub/fix-bash-completion.patch
rename to pkgs/by-name/gr/grub2/fix-bash-completion.patch
diff --git a/pkgs/tools/misc/grub/default.nix b/pkgs/by-name/gr/grub2/package.nix
similarity index 100%
rename from pkgs/tools/misc/grub/default.nix
rename to pkgs/by-name/gr/grub2/package.nix
diff --git a/pkgs/by-name/gr/grub2_efi/package.nix b/pkgs/by-name/gr/grub2_efi/package.nix
new file mode 100644
index 000000000000..3e0d10fad501
--- /dev/null
+++ b/pkgs/by-name/gr/grub2_efi/package.nix
@@ -0,0 +1,11 @@
+{
+  grub2,
+  ...
+}@args:
+
+grub2.override (
+  {
+    efiSupport = true;
+  }
+  // removeAttrs args [ "grub2" ]
+)
diff --git a/pkgs/by-name/gr/grub2_ieee1275/package.nix b/pkgs/by-name/gr/grub2_ieee1275/package.nix
new file mode 100644
index 000000000000..19e5542b76e8
--- /dev/null
+++ b/pkgs/by-name/gr/grub2_ieee1275/package.nix
@@ -0,0 +1,11 @@
+{
+  grub2,
+  ...
+}@args:
+
+grub2.override (
+  {
+    ieee1275Support = true;
+  }
+  // removeAttrs args [ "grub2" ]
+)
diff --git a/pkgs/by-name/gr/grub2_light/package.nix b/pkgs/by-name/gr/grub2_light/package.nix
new file mode 100644
index 000000000000..e33c3c4f481c
--- /dev/null
+++ b/pkgs/by-name/gr/grub2_light/package.nix
@@ -0,0 +1,11 @@
+{
+  grub2,
+  ...
+}@args:
+
+grub2.override (
+  {
+    zfsSupport = false;
+  }
+  // removeAttrs args [ "grub2" ]
+)
diff --git a/pkgs/by-name/gr/grub2_pvgrub_image/package.nix b/pkgs/by-name/gr/grub2_pvgrub_image/package.nix
new file mode 100644
index 000000000000..91e6eb469745
--- /dev/null
+++ b/pkgs/by-name/gr/grub2_pvgrub_image/package.nix
@@ -0,0 +1,11 @@
+{
+  grub2_pvhgrub_image,
+  ...
+}@args:
+
+grub2_pvhgrub_image.override (
+  {
+    grubPlatform = "xen";
+  }
+  // removeAttrs args [ "grub2_pvhgrub_image" ]
+)
diff --git a/pkgs/by-name/gr/grub2_xen/package.nix b/pkgs/by-name/gr/grub2_xen/package.nix
new file mode 100644
index 000000000000..2e0989d29f79
--- /dev/null
+++ b/pkgs/by-name/gr/grub2_xen/package.nix
@@ -0,0 +1,11 @@
+{
+  grub2,
+  ...
+}@args:
+
+grub2.override (
+  {
+    xenSupport = true;
+  }
+  // removeAttrs args [ "grub2" ]
+)
diff --git a/pkgs/by-name/gr/grub2_xen_pvh/package.nix b/pkgs/by-name/gr/grub2_xen_pvh/package.nix
new file mode 100644
index 000000000000..95a60b5acb7f
--- /dev/null
+++ b/pkgs/by-name/gr/grub2_xen_pvh/package.nix
@@ -0,0 +1,11 @@
+{
+  grub2,
+  ...
+}@args:
+
+grub2.override (
+  {
+    xenPvhSupport = true;
+  }
+  // removeAttrs args [ "grub2" ]
+)
diff --git a/pkgs/by-name/ha/ha-mcp/package.nix b/pkgs/by-name/ha/ha-mcp/package.nix
index a70f3b510f09..2c956dd86d5e 100644
--- a/pkgs/by-name/ha/ha-mcp/package.nix
+++ b/pkgs/by-name/ha/ha-mcp/package.nix
@@ -7,27 +7,28 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "ha-mcp";
-  version = "6.7.1";
+  version = "7.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "homeassistant-ai";
     repo = "ha-mcp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CQbjPEtCos0Fi6aAaIWSRMCUQKmjYviYkvJZzbCZg6Y=";
+    hash = "sha256-boWqv8lSN/UiqSRhVBgbucX+RC6q14Oa4WzkJPeZzVw=";
   };
 
   build-system = with python3Packages; [
     setuptools
   ];
 
+  pythonRelaxDeps = true;
+
   dependencies =
     with python3Packages;
     [
       cryptography
       fastmcp
       httpx
-      jq
       pydantic
       python-dotenv
       truststore
@@ -39,7 +40,10 @@ python3Packages.buildPythonApplication (finalAttrs: {
   doCheck = false;
 
   passthru.updateScript = nix-update-script {
-    extraArgs = [ "--version-regex=^v([0-9]+\\.[0-9]+\\.[0-9]+)$" ];
+    extraArgs = [
+      "--use-github-releases"
+      "--version-regex=^v([0-9]+\\.[0-9]+\\.[0-9]+)$"
+    ];
   };
 
   pythonImportsCheck = [ "ha_mcp" ];
diff --git a/pkgs/by-name/ha/halo/package.nix b/pkgs/by-name/ha/halo/package.nix
index 38fc1693b4cf..f44341085fd3 100644
--- a/pkgs/by-name/ha/halo/package.nix
+++ b/pkgs/by-name/ha/halo/package.nix
@@ -8,10 +8,10 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "halo";
-  version = "2.23.1";
+  version = "2.24.0";
   src = fetchurl {
     url = "https://github.com/halo-dev/halo/releases/download/v${finalAttrs.version}/halo-${finalAttrs.version}.jar";
-    hash = "sha256-oU3MdmHnpf0TOwdEJb8UD2LIqEJ2BQ0puMIs1BBmA2M=";
+    hash = "sha256-71br2gG8vl3EyvC+AYzqJOtgHnhdEmcRAjXSXXXqI5s=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/he/hebbot/package.nix b/pkgs/by-name/he/hebbot/package.nix
index 8981a5d90c3a..bb2469185630 100644
--- a/pkgs/by-name/he/hebbot/package.nix
+++ b/pkgs/by-name/he/hebbot/package.nix
@@ -51,7 +51,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   meta = {
     description = "Matrix bot which can generate \"This Week in X\" like blog posts ";
     homepage = "https://github.com/haecker-felix/hebbot";
-    changelog = "https://github.com/haecker-felix/hebbot/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/haecker-felix/hebbot/releases/tag/v2.1";
     license = with lib.licenses; [ agpl3Only ];
     mainProgram = "hebbot";
     maintainers = with lib.maintainers; [ a-kenji ];
diff --git a/pkgs/by-name/hy/hysteria/package.nix b/pkgs/by-name/hy/hysteria/package.nix
index 8469069a1a98..36cb48b7f6b8 100644
--- a/pkgs/by-name/hy/hysteria/package.nix
+++ b/pkgs/by-name/hy/hysteria/package.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "hysteria";
-  version = "2.8.1";
+  version = "2.8.2";
 
   src = fetchFromGitHub {
     owner = "apernet";
     repo = "hysteria";
     rev = "app/v${finalAttrs.version}";
-    hash = "sha256-KxCf9btvEbwP+oWL6A6rWpQsRJPifohFLDIdr+0XwzM=";
+    hash = "sha256-HgZVwaHL5q8aOxHhVt6RaHaBxoj83ujHaqLemQkLRUM=";
   };
 
-  vendorHash = "sha256-NXBxrKptXTZzEXZ5hYHtC3wbFIYgL9avJay6DJHRMLU=";
+  vendorHash = "sha256-oHxnawchsHU/M1PZ0zXR5luopso1FptXi+PL5pNgdj0=";
   proxyVendor = true;
 
   ldflags =
diff --git a/pkgs/by-name/jj/jj-pre-push/package.nix b/pkgs/by-name/jj/jj-pre-push/package.nix
index 1ff5b8512f3a..d5c7ac94e86d 100644
--- a/pkgs/by-name/jj/jj-pre-push/package.nix
+++ b/pkgs/by-name/jj/jj-pre-push/package.nix
@@ -51,7 +51,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   meta = {
     description = "Run pre-commit.com before `jj git push`";
     homepage = "https://github.com/acarapetis/jj-pre-push";
-    changelog = "https://github.com/acarapetis/jj-pre-push/releases/tag/v${finalAttrs.src.tag}";
+    changelog = "https://github.com/acarapetis/jj-pre-push/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ xanderio ];
     mainProgram = "jj-pre-push";
diff --git a/pkgs/by-name/jx/jxscout/package.nix b/pkgs/by-name/jx/jxscout/package.nix
new file mode 100644
index 000000000000..dddfe226d890
--- /dev/null
+++ b/pkgs/by-name/jx/jxscout/package.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  makeWrapper,
+  prettier,
+  bun,
+  nodejs,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "jxscout";
+  version = "0.9.4";
+
+  src = fetchFromGitHub {
+    owner = "francisconeves97";
+    repo = "jxscout";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-DvvhcnjBHRHUEW5mWHLa7ufC+7yzYwKKOV79Syk5zME=";
+  };
+
+  subPackages = [ "cmd/jxscout" ];
+
+  vendorHash = null;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  doCheck = true;
+
+  postInstall = ''
+    wrapProgram $out/bin/jxscout --prefix PATH : ${
+      lib.makeBinPath [
+        prettier
+        bun
+        nodejs
+      ]
+    }
+  '';
+
+  meta = {
+    description = "jxscout superpowers JavaScript analysis for security researchers (free version)";
+    homepage = "https://jxscout.app/";
+    downloadPage = "https://github.com/francisconeves97/jxscout";
+    changelog = "https://github.com/francisconeves97/jxscout/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "jxscout";
+    maintainers = with lib.maintainers; [ katok ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin ++ lib.platforms.windows;
+  };
+})
diff --git a/pkgs/by-name/kn/knot-resolver_6/package.nix b/pkgs/by-name/kn/knot-resolver_6/package.nix
index 7d1edf5d7451..e515f6933a23 100644
--- a/pkgs/by-name/kn/knot-resolver_6/package.nix
+++ b/pkgs/by-name/kn/knot-resolver_6/package.nix
@@ -36,11 +36,11 @@ let
   # TODO: we could cut the `let` short here, but it would de-indent everything.
   unwrapped = stdenv.mkDerivation (finalAttrs: {
     pname = "knot-resolver_6";
-    version = "6.2.0";
+    version = "6.3.0";
 
     src = fetchurl {
       url = "https://secure.nic.cz/files/knot-resolver/knot-resolver-${finalAttrs.version}.tar.xz";
-      hash = "sha256-tEYzvIQxgMC8fHfPexX+VxJDrpkrTdt0r97kz6gDcBs=";
+      hash = "sha256-uHMGGX90NrSQecYzNkvF33GjkyNvsl6fzn0ESAvHUY4=";
     };
 
     outputs = [
diff --git a/pkgs/by-name/la/lact/package.nix b/pkgs/by-name/la/lact/package.nix
index cdeb661187f2..83831a62c835 100644
--- a/pkgs/by-name/la/lact/package.nix
+++ b/pkgs/by-name/la/lact/package.nix
@@ -9,6 +9,7 @@
   clinfo,
   gdk-pixbuf,
   gtk4,
+  libadwaita,
   libdrm,
   ocl-icd,
   vulkan-loader,
@@ -24,16 +25,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lact";
-  version = "0.8.4";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "ilya-zlobintsev";
     repo = "LACT";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5z4IAiApUjlsSL0EX1PQH6rceeQxAD8f3CKmYO2x8gQ=";
+    hash = "sha256-c5GJf8AYgaAN3O6AVSEbJybEYb6lSHf7R24/1PKYhyM=";
   };
 
-  cargoHash = "sha256-mCmAj9yLei0ZNtsBh+YeVlCmbHyT69LIHFnwbAk+Ido=";
+  cargoHash = "sha256-Y+XdCmaDXdP7x22bYm//Ov7+IzlCr8GpFOgCXGFCfbA=";
 
   nativeBuildInputs = [
     pkg-config
@@ -45,6 +46,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   buildInputs = [
     gdk-pixbuf
     gtk4
+    libadwaita
     libdrm
     ocl-icd
     vulkan-loader
diff --git a/pkgs/by-name/le/legitify/package.nix b/pkgs/by-name/le/legitify/package.nix
index b861fb50d964..6147fc470318 100644
--- a/pkgs/by-name/le/legitify/package.nix
+++ b/pkgs/by-name/le/legitify/package.nix
@@ -30,7 +30,7 @@ buildGoModule rec {
   meta = {
     description = "Tool to detect and remediate misconfigurations and security risks of GitHub assets";
     homepage = "https://github.com/Legit-Labs/legitify";
-    changelog = "https://github.com/Legit-Labs/legitify/releases/tag/v${src.tag}";
+    changelog = "https://github.com/Legit-Labs/legitify/releases/tag/${src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "legitify";
diff --git a/pkgs/by-name/li/libretro-shaders-slang/package.nix b/pkgs/by-name/li/libretro-shaders-slang/package.nix
index 8da1d491f1ef..7c5c47d9e3cd 100644
--- a/pkgs/by-name/li/libretro-shaders-slang/package.nix
+++ b/pkgs/by-name/li/libretro-shaders-slang/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "libretro-shaders-slang";
-  version = "0-unstable-2026-04-17";
+  version = "0-unstable-2026-04-26";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "slang-shaders";
-    rev = "12b0869495c1ea8238b53179ec33888205f6800f";
-    hash = "sha256-9b/c+DCmy61Wsy70MU5efNhPKQa5C03P1eZZPwJDNvA=";
+    rev = "cc71b5eff24a962bd055a92d2032f806635fdf97";
+    hash = "sha256-PeG6H5XArKdptbSicMgXPFtnrkglmkwZieGKSr0aPaQ=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/li/liteparse/package.nix b/pkgs/by-name/li/liteparse/package.nix
index 66033f300268..cb46908b048e 100644
--- a/pkgs/by-name/li/liteparse/package.nix
+++ b/pkgs/by-name/li/liteparse/package.nix
@@ -10,16 +10,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "liteparse";
-  version = "1.4.6";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "run-llama";
     repo = "liteparse";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GUtqJsmAOrbxLc/aAIre95QD6aaFsj5ClqZfo7jdwB4=";
+    hash = "sha256-e3c8ak4kww8vQDfYT8S9m7Tv7vnBiox2qaI73yUb23U=";
   };
 
-  npmDepsHash = "sha256-Wz46n7BbubC3Cq1CHOHM2q/dVOvOVNQTloHZfkAwzpg=";
+  npmDepsHash = "sha256-KhtwPl1J9ZZMT9xT5bQJjPa3fYTvi9oRnxijCm0o+2c=";
   npmBuildScript = "build";
 
   nativeBuildInputs = [ makeBinaryWrapper ];
diff --git a/pkgs/by-name/ll/llmfit/package.nix b/pkgs/by-name/ll/llmfit/package.nix
index 6fbb2aa97281..5365f91e3a1c 100644
--- a/pkgs/by-name/ll/llmfit/package.nix
+++ b/pkgs/by-name/ll/llmfit/package.nix
@@ -20,7 +20,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   meta = {
     description = "Find what runs on your hardware";
     homepage = "https://github.com/AlexsJones/llmfit";
-    changelog = "https://github.com/AlexsJones/llmfit/releases/tag/v${finalAttrs.src.rev}";
+    changelog = "https://github.com/AlexsJones/llmfit/blob/v${finalAttrs.src.rev}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       matthiasbeyer
diff --git a/pkgs/by-name/ls/lstk/package.nix b/pkgs/by-name/ls/lstk/package.nix
index 9b5a4c84e820..119965a2c322 100644
--- a/pkgs/by-name/ls/lstk/package.nix
+++ b/pkgs/by-name/ls/lstk/package.nix
@@ -6,7 +6,7 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "lstk";
-  version = "0.5.7";
+  version = "0.5.8";
 
   __structuredAttrs = true;
 
@@ -14,10 +14,10 @@ buildGoModule (finalAttrs: {
     owner = "localstack";
     repo = "lstk";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-HWkCDnbg/D2zX3rdvmFTdKrx03SO6FaiA/Pzj0f4hlA=";
+    sha256 = "sha256-sZd3hZaS6rJoAUkCfgQh/zQj4ng8nevsQFsZaxOccHs=";
   };
 
-  vendorHash = "sha256-rEcVtSFnBQ+3bbU5pjbCXEJZo89+lL/1HJG9bCn8OSE=";
+  vendorHash = "sha256-MzvWeJa9fXqek/MenT4B28XKB0srjGpqwUxAuT1zgI4=";
 
   excludedPackages = "test/integration";
 
diff --git a/pkgs/by-name/lu/luau-lsp/package.nix b/pkgs/by-name/lu/luau-lsp/package.nix
index 2dbfbd176d52..a871f30cac5d 100644
--- a/pkgs/by-name/lu/luau-lsp/package.nix
+++ b/pkgs/by-name/lu/luau-lsp/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "luau-lsp";
-  version = "1.66.0";
+  version = "1.66.1";
 
   src = fetchFromGitHub {
     owner = "JohnnyMorganz";
     repo = "luau-lsp";
     tag = finalAttrs.version;
-    hash = "sha256-llirkKL/2X4srwZzTcf0a7yX7AhOgdlsu1jr6yacWV0=";
+    hash = "sha256-Lz6tnCfkjQc7YhfCETaFLAvW6fTrRwmELxBNURavNeY=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/ma/maelstrom-clj/package.nix b/pkgs/by-name/ma/maelstrom-clj/package.nix
index 605e8566e8ed..d9dbce638242 100644
--- a/pkgs/by-name/ma/maelstrom-clj/package.nix
+++ b/pkgs/by-name/ma/maelstrom-clj/package.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Workbench for writing toy implementations of distributed systems";
     homepage = "https://github.com/jepsen-io/maelstrom";
-    changelog = "https://github.com/jepsen-io/maelstrom/releases/tag/${finalAttrs.version}";
+    changelog = "https://github.com/jepsen-io/maelstrom/releases/tag/v${finalAttrs.version}";
     mainProgram = "maelstrom";
     sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
     license = lib.licenses.epl10;
diff --git a/pkgs/by-name/ma/markitdown-mcp/package.nix b/pkgs/by-name/ma/markitdown-mcp/package.nix
index 460815412b07..d49ba08bed84 100644
--- a/pkgs/by-name/ma/markitdown-mcp/package.nix
+++ b/pkgs/by-name/ma/markitdown-mcp/package.nix
@@ -36,7 +36,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     "markitdown_mcp"
   ];
 
-  passthru.updateScripts = gitUpdater { };
+  passthru.updateScript = gitUpdater { };
 
   meta = {
     description = "MCP server for the markitdown library";
diff --git a/pkgs/by-name/mc/mcp-grafana/package.nix b/pkgs/by-name/mc/mcp-grafana/package.nix
index 246785e68cf1..db5832f5ed50 100644
--- a/pkgs/by-name/mc/mcp-grafana/package.nix
+++ b/pkgs/by-name/mc/mcp-grafana/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "mcp-grafana";
-  version = "0.11.6";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "mcp-grafana";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cJjapd2phI4NgMAPzsKrs74+sEK7ykfKHQx24FVpHoQ=";
+    hash = "sha256-JlTyTUm1gvOKsRu2dGAPWv0IyU2fVjrsO+6wHxMGFDg=";
   };
 
-  vendorHash = "sha256-a9VgfzJmbTudYSLqhBBnkpq37xghtxWTzpcd7rMlZmA=";
+  vendorHash = "sha256-dTCOD6/+o3ZHI2qAb97ZJaMyAg0dqIisrHhUkgXzw7w=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/mc/mcp-nixos/package.nix b/pkgs/by-name/mc/mcp-nixos/package.nix
index ef1053c62ccb..bdf961f8c97b 100644
--- a/pkgs/by-name/mc/mcp-nixos/package.nix
+++ b/pkgs/by-name/mc/mcp-nixos/package.nix
@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "mcp-nixos";
-  version = "2.3.1";
+  version = "2.4.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "utensils";
     repo = "mcp-nixos";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-A7KhRVOqLmtta507DPZoKbO8D1AlMMDWLMfHEBhEAxY=";
+    hash = "sha256-mWq9nnL4IGhUFkXJr8+t6BresOTDFS1caG8NuFqjrJg=";
   };
 
   build-system = [ python3Packages.hatchling ];
diff --git a/pkgs/by-name/mk/mklittlefs/package.nix b/pkgs/by-name/mk/mklittlefs/package.nix
index a1f40f0981b5..721d4d997de9 100644
--- a/pkgs/by-name/mk/mklittlefs/package.nix
+++ b/pkgs/by-name/mk/mklittlefs/package.nix
@@ -69,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Tool to build and unpack littlefs images";
     homepage = "https://github.com/earlephilhower/mklittlefs";
-    changelog = "https://github.com/earlephilhower/mklittlefs/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/earlephilhower/mklittlefs/releases/tag/${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ liberodark ];
     mainProgram = "mklittlefs";
diff --git a/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix b/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
index e34f51d94071..0a09dfcc4d3a 100644
--- a/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
+++ b/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
@@ -31,13 +31,13 @@ in
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "modrinth-app-unwrapped";
-  version = "0.13.3";
+  version = "0.13.6";
 
   src = fetchFromGitHub {
     owner = "modrinth";
     repo = "code";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vBBa2T5+JYvfO9eibJtcpq9y/GMh2PbO0ZBdkah9gms=";
+    hash = "sha256-47uokwYsEg5D0lyHdpqfvKlsuXZK0sm5YIWwNjVGsKQ=";
   };
 
   patches = [
@@ -67,7 +67,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail '1.0.0-local' '${finalAttrs.version}'
   '';
 
-  cargoHash = "sha256-dbndaNIZzGX4QjGTJbDsKOReB5OeiBmQr8XNzfWPe/o=";
+  cargoHash = "sha256-Mnb16KO+xcocUuvQN4woUlb1aFNzzwyIeRP4mIcA1Fk=";
   mitmCache = gradle.fetchDeps {
     inherit (finalAttrs) pname;
     data = ./deps.json;
@@ -77,7 +77,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_9;
     fetcherVersion = 3;
-    hash = "sha256-yF8sHG2+08JmtrKVLT0/gUPFJGgGWFMvHbi+uen2uwU=";
+    hash = "sha256-Hk32LBD20F2LRgqNs8f1j3VdUxKoTPWs3yJvOghsEbI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mo/mongodb-atlas-cli/package.nix b/pkgs/by-name/mo/mongodb-atlas-cli/package.nix
index 3cb2b84a2bdb..976fec8efdee 100644
--- a/pkgs/by-name/mo/mongodb-atlas-cli/package.nix
+++ b/pkgs/by-name/mo/mongodb-atlas-cli/package.nix
@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "mongodb-atlas-cli";
-  version = "1.53.3";
+  version = "1.54.0";
 
   src = fetchFromGitHub {
     owner = "mongodb";
     repo = "mongodb-atlas-cli";
     tag = "atlascli/v${finalAttrs.version}";
-    hash = "sha256-+/B2lr8R+6UKObm4e0jqIZ+yJEtLvxuN+21cHKNBq3E=";
+    hash = "sha256-OZiumnbWNOaH++1u7ZFkpi2xPQ8PG0TI63dXZxX4GOM=";
   };
 
-  vendorHash = "sha256-OsEGK0KqucRIDH6tmz8y1vpU2GjOR1mWpsyeb/6IN84=";
+  vendorHash = "sha256-k7hLJ4bk3IAI/m//MIqp+YVMa3bbADnDiLsuEmz1suI=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/mo/monkeys-audio/package.nix b/pkgs/by-name/mo/monkeys-audio/package.nix
index 7876de1b7ad9..cd254c40c895 100644
--- a/pkgs/by-name/mo/monkeys-audio/package.nix
+++ b/pkgs/by-name/mo/monkeys-audio/package.nix
@@ -6,12 +6,12 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "12.67";
+  version = "12.75";
   pname = "monkeys-audio";
 
   src = fetchzip {
     url = "https://monkeysaudio.com/files/MAC_${builtins.concatStringsSep "" (lib.strings.splitString "." finalAttrs.version)}_SDK.zip";
-    hash = "sha256-36iH2iIvR8CVA8uvldIGiPxL5HkNUK94PpCzvffWx6o=";
+    hash = "sha256-IH72Sjgh4ERkufo1rEHucbpOeMuNeEhfrQBpXvvAvhg=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/mx/mx-takeover/package.nix b/pkgs/by-name/mx/mx-takeover/package.nix
index 1ce106b016ea..42aeba59f09e 100644
--- a/pkgs/by-name/mx/mx-takeover/package.nix
+++ b/pkgs/by-name/mx/mx-takeover/package.nix
@@ -26,7 +26,7 @@ buildGoModule (finalAttrs: {
   meta = {
     description = "Tool to work with DNS MX records";
     homepage = "https://github.com/musana/mx-takeover";
-    changelog = "https://github.com/musana/mx-takeover/releases/tag/v${finalAttrs.src.tag}";
+    changelog = "https://github.com/musana/mx-takeover/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "mx-takeover";
diff --git a/pkgs/by-name/ni/ni/package.nix b/pkgs/by-name/ni/ni/package.nix
index b523718f290b..1b76f0ff1f84 100644
--- a/pkgs/by-name/ni/ni/package.nix
+++ b/pkgs/by-name/ni/ni/package.nix
@@ -12,13 +12,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "ni";
-  version = "30.0.0";
+  version = "30.1.0";
 
   src = fetchFromGitHub {
     owner = "antfu-collective";
     repo = "ni";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CCegG/ClJV4SsuCztUbUy6fw0nFod8FLpIXvftPA9cg=";
+    hash = "sha256-mBKSnnmvlZOwU+6MQrg8S8iCea2PGAsHa+A4lseLYyw=";
   };
 
   pnpmDeps = fetchPnpmDeps {
diff --git a/pkgs/by-name/ni/nile/package.nix b/pkgs/by-name/ni/nile/package.nix
index 7b4d5854b25c..d7c22df3f02f 100644
--- a/pkgs/by-name/ni/nile/package.nix
+++ b/pkgs/by-name/ni/nile/package.nix
@@ -47,7 +47,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   meta = {
     description = "Unofficial Amazon Games client";
     homepage = "https://github.com/imLinguin/nile";
-    changelog = "https://github.com/imLinguin/nile/releases/tag/v${finalAttrs.src.tag}";
+    changelog = "https://github.com/imLinguin/nile/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl3Only;
     mainProgram = "nile";
     maintainers = [ ];
diff --git a/pkgs/by-name/nm/nmtrust/package.nix b/pkgs/by-name/nm/nmtrust/package.nix
new file mode 100644
index 000000000000..eec88cc613e2
--- /dev/null
+++ b/pkgs/by-name/nm/nmtrust/package.nix
@@ -0,0 +1,70 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  makeWrapper,
+  shellcheck,
+  bash,
+  systemd,
+  coreutils,
+  gawk,
+  util-linux,
+}:
+
+stdenv.mkDerivation {
+  pname = "nmtrust";
+  version = "0.1.0";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "brett";
+    repo = "nmtrust-nix";
+    rev = "v0.1.0";
+    hash = "sha256-7Cs00mCzByTKe7w5pnkkgqtZyUSaPa2r/5Uv133eZy0=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+  nativeCheckInputs = [ shellcheck ];
+
+  doCheck = true;
+  checkPhase = ''
+    runHook preCheck
+    shellcheck nmtrust.sh
+    runHook postCheck
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 nmtrust.sh $out/bin/nmtrust
+    wrapProgram $out/bin/nmtrust \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          bash
+          systemd
+          coreutils
+          gawk
+          util-linux
+        ]
+      }
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Declarative network trust management for NixOS";
+    longDescription = ''
+      nmtrust evaluates the trust state of active NetworkManager connections
+      and activates corresponding systemd targets. Services bound to these
+      targets start and stop automatically as you move between trusted,
+      untrusted, and offline networks.
+
+      A NixOS-native reimplementation of nmtrust by Peter Hogg (pigmonkey).
+    '';
+    homepage = "https://github.com/brett/nmtrust-nix";
+    license = lib.licenses.unlicense;
+    maintainers = [ lib.maintainers.brett ];
+    mainProgram = "nmtrust";
+    platforms = lib.platforms.linux;
+  };
+}
diff --git a/pkgs/by-name/no/nono/package.nix b/pkgs/by-name/no/nono/package.nix
index 047da60943cc..7bfc52646cc8 100644
--- a/pkgs/by-name/no/nono/package.nix
+++ b/pkgs/by-name/no/nono/package.nix
@@ -13,15 +13,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nono";
-  version = "0.35.0";
+  version = "0.43.1";
+
+  __darwinAllowLocalNetworking = true; # required for tests
 
   src = fetchFromGitHub {
     owner = "always-further";
     repo = "nono";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/bKquUbVMM1e/YPcuSb0vW4tX/3yNDUxmaBWHKFw+Qs=";
+    hash = "sha256-a9RwEbe0x49EyBSGX0mBk2GNeWmc6NhanExqbDyTM40=";
   };
-  cargoHash = "sha256-ibGIpH6Ls9nxtF6rRl+dZBbbmVRXDQA6vpPI/jzpDqI=";
+  cargoHash = "sha256-/+CfiWbg3anUbzgGigFxWs0+KavGEa2odo5kBF9c7Wg=";
 
   nativeBuildInputs = [
     pkg-config
@@ -35,7 +37,23 @@ rustPlatform.buildRustPackage (finalAttrs: {
     writableTmpDirAsHomeHook
   ];
 
-  checkFlags = lib.optionals stdenv.hostPlatform.isDarwin [
+  checkFlags = [
+    # fails to initialize the sandbox under '/build'
+    "--skip=test_all_profiles_signal_mode_resolves"
+    # panic
+    "--skip=build_run_profile_patch_adds_override_deny_for_sensitive_file"
+    "--skip=build_run_profile_patch_merges_read_and_write_to_allow_file"
+    "--skip=prepare_profile_save_from_patch_updates_existing_user_profile"
+    "--skip=would_shadow_builtin_allows_update_of_existing_user_override"
+    "--skip=would_shadow_builtin_flags_known_builtin_names"
+    "--skip=create_audit_state_creates_session_when_enabled"
+
+    # audit_attestation
+    # needs /bin/pwd
+    "--skip=audit_verify_reports_signed_attestation_with_pinned_public_key"
+    "--skip=rollback_signed_session_verifies_from_audit_dir_bundle"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # panics with "Deny-within-allow overlap on Linux ... Landlock cannot enforce this. ..."
     # landlock is linux only
     "--skip=policy::tests::test_all_groups_no_deny_within_allow_overlap"
@@ -56,6 +74,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "--skip=env_nono_upstream_bypass_comma_separated"
     "--skip=env_nono_upstream_proxy"
     "--skip=legacy_env_nono_net_block_still_works"
+    "--skip=environment_allow_vars_bare_star"
+    "--skip=environment_allow_vars_default_allows_all"
+    "--skip=environment_allow_vars_prefix_patterns"
+    "--skip=environment_allow_vars_with_profile"
   ];
 
   meta = {
diff --git a/pkgs/by-name/nt/ntfs3g/package.nix b/pkgs/by-name/nt/ntfs3g/package.nix
index df33a3abac77..7bda93b3c434 100644
--- a/pkgs/by-name/nt/ntfs3g/package.nix
+++ b/pkgs/by-name/nt/ntfs3g/package.nix
@@ -17,7 +17,7 @@
 
 stdenv.mkDerivation rec {
   pname = "ntfs3g";
-  version = "2022.10.3";
+  version = "2026.2.25";
 
   outputs = [
     "out"
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     owner = "tuxera";
     repo = "ntfs-3g";
     rev = version;
-    sha256 = "sha256-nuFTsGkm3zmSzpwmhyY7Ke0VZfZU0jHOzEWaLBbglQk=";
+    sha256 = "sha256-uiVh87ExLXq94NVqR8MEg7Lrvamm6MrH+qP3Nosii5c=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/nu/nu_scripts/package.nix b/pkgs/by-name/nu/nu_scripts/package.nix
index 4dc9ff7a40bc..f397f6026a72 100644
--- a/pkgs/by-name/nu/nu_scripts/package.nix
+++ b/pkgs/by-name/nu/nu_scripts/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "nu_scripts";
-  version = "0-unstable-2026-04-18";
+  version = "0-unstable-2026-04-27";
 
   src = fetchFromGitHub {
     owner = "nushell";
     repo = "nu_scripts";
-    rev = "c5387bd60ca63d26885ee73ceb8a84160bc6ca6b";
-    hash = "sha256-QPKgVj5tWwgwspCQYwjPBJZLTHm2e3AuneOK+hI6qUg=";
+    rev = "32cd1d53649bc024edd65326a5b988cd7bcf4810";
+    hash = "sha256-t8OCSDI7MqA9Q9Tv4mjd/yRac2SZvhX2x8rfcbIUT9o=";
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/nu/nuget-to-json/nuget-to-json.sh b/pkgs/by-name/nu/nuget-to-json/nuget-to-json.sh
index c4c5a8d9456b..111899dac47f 100755
--- a/pkgs/by-name/nu/nuget-to-json/nuget-to-json.sh
+++ b/pkgs/by-name/nu/nuget-to-json/nuget-to-json.sh
@@ -61,9 +61,9 @@ done
                 continue
             fi
 
-            # packages in the nix store should have an empty metadata file
+            # packages in the nix store should have a metadata file without 'version' (see createNupkgMetadata)
             # packages installed with 'dotnet tool' may be missing 'source'
-            used_source="$(jq -r 'if has("source") then .source elif has("contentHash") then "__unknown" else "" end' "$version"/.nupkg.metadata)"
+            used_source="$(jq -r 'if has("source") then .source elif has("version") then "__unknown" else "" end' "$version"/.nupkg.metadata)"
             found=false
 
             if [[ -z "$used_source" || -d "$used_source" ]]; then
diff --git a/pkgs/by-name/oa/oauth2c/package.nix b/pkgs/by-name/oa/oauth2c/package.nix
index 666b24ea1828..7482bd8751e8 100644
--- a/pkgs/by-name/oa/oauth2c/package.nix
+++ b/pkgs/by-name/oa/oauth2c/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "oauth2c";
-  version = "1.19.0";
+  version = "1.20.0";
 
   src = fetchFromGitHub {
     owner = "cloudentity";
     repo = "oauth2c";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Bh4gWskmY2nWTckUT1FX7vRDz/gg670A77CQTZhz3mg=";
+    hash = "sha256-l/fXorXE4+6n7qQM2c2pJssNq3DKaxOjapdfNlXuAWg=";
   };
 
-  vendorHash = "sha256-I2pOyjKghvHHGEuVqODhysD++f2hD+BF7WJxWbrLcWA=";
+  vendorHash = "sha256-+Y8AStkbaecVdosfWlEmO53Y5aC13zfzlDOeMO91Lw0=";
 
   doCheck = false; # tests want to talk to oauth2c.us.authz.cloudentity.io
 
diff --git a/pkgs/by-name/ob/obconf/package.nix b/pkgs/by-name/ob/obconf/package.nix
index 48e02703fbc6..c98bc820b7d0 100644
--- a/pkgs/by-name/ob/obconf/package.nix
+++ b/pkgs/by-name/ob/obconf/package.nix
@@ -48,8 +48,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "GUI configuration tool for openbox";
-    homepage = "http://openbox.org/wiki/ObConf";
-    changelog = "http://openbox.org/wiki/ObConf:Changelog";
+    homepage = "https://openbox.org/obconf";
+    changelog = "https://openbox.org/obconf_changelog";
     license = lib.licenses.gpl2Plus;
     maintainers = [ lib.maintainers.sfrijters ];
     platforms = lib.platforms.linux;
diff --git a/pkgs/by-name/on/onedpl/package.nix b/pkgs/by-name/on/onedpl/package.nix
new file mode 100644
index 000000000000..fb0e606ab890
--- /dev/null
+++ b/pkgs/by-name/on/onedpl/package.nix
@@ -0,0 +1,54 @@
+{
+  lib,
+  intelLlvmStdenv,
+  fetchFromGitHub,
+  cmake,
+  onetbb,
+  nix-update-script,
+}:
+intelLlvmStdenv.mkDerivation (finalAttrs: {
+  pname = "onedpl";
+  version = "2022.11.1";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "uxlfoundation";
+    repo = "oneDPL";
+    tag = "oneDPL-${finalAttrs.version}-release";
+    hash = "sha256-NfyV34mdKfCxlU+l6ETKWcC9MwvVEgwcBedtLe6WCV4=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    onetbb
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeFeature "ONEDPL_BACKEND" "dpcpp")
+  ];
+
+  # Build times for the tests are excessive
+  # and to be truly meaningful, they'd require a GPU
+  doCheck = false;
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "'oneDPL-(.*)-release'"
+    ];
+  };
+
+  meta = {
+    description = "oneAPI DPC++ Library (oneDPL)";
+    homepage = "http://uxlfoundation.github.io/oneDPL";
+    changelog = "https://github.com/uxlfoundation/oneDPL/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ arunoruto ];
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/ox/oxlint/package.nix b/pkgs/by-name/ox/oxlint/package.nix
index 036540e23212..c89a8f2caba1 100644
--- a/pkgs/by-name/ox/oxlint/package.nix
+++ b/pkgs/by-name/ox/oxlint/package.nix
@@ -23,25 +23,25 @@
 # runs without an external linter, which leaves `jsPlugins` configs inert.
 stdenv.mkDerivation (finalAttrs: {
   pname = "oxlint";
-  version = "1.60.0";
+  version = "1.62.0";
 
   src = fetchFromGitHub {
     owner = "oxc-project";
     repo = "oxc";
     tag = "oxlint_v${finalAttrs.version}";
-    hash = "sha256-RMADw7oEf407J7/KDmIma0k3JKALMBkLqp9pyE+uRkA=";
+    hash = "sha256-BsfLVHGSyje1GAEaRfe4qmv6lcOiJjTmnd0L8/xIp24=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-Xla3mPOkBIfA4BMd+3/lO3mXy4V96DgyT+CzuhTTAd0=";
+    hash = "sha256-9DBME09qjjfypmj09Zuc8NdVTWC5/kAU83YAb+TeCPY=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-fomJmm0GXIClng63wql3hCo1Pf4CbVUiEtbvAv9DPIo=";
+    hash = "sha256-rgrwA8xZcEkxoFofHBz+AbGXLLCcihPb3435HAaphHs=";
   };
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/by-name/pb/pbgopy/package.nix b/pkgs/by-name/pb/pbgopy/package.nix
index 9b35da9d18ae..034fa2d63e57 100644
--- a/pkgs/by-name/pb/pbgopy/package.nix
+++ b/pkgs/by-name/pb/pbgopy/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "pbgopy";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "nakabonne";
     repo = "pbgopy";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-P/MFDFMsqSTVErTM9izJJSMIbiOcbQ9Ya10/w6NRcYw=";
+    sha256 = "sha256-rm4fopreiYBwcFbtuo0B6FalveFft8hrNVf7JpvyNKE=";
   };
 
-  vendorHash = "sha256-S2X74My6wyDZOsEYTDilCFaYgV2vQzU0jOAY9cEkJ6A=";
+  vendorHash = "sha256-qxdylBQiUlHOkzaxV+P9m3tnkFqUdZTdF31LD0IWyuI=";
 
   meta = {
     description = "Copy and paste between devices";
diff --git a/pkgs/by-name/po/poedit/package.nix b/pkgs/by-name/po/poedit/package.nix
index f7522b1e1495..c105a1fb63b5 100644
--- a/pkgs/by-name/po/poedit/package.nix
+++ b/pkgs/by-name/po/poedit/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  nix-update-script,
   autoconf,
   automake,
   libtool,
@@ -24,13 +25,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "poedit";
-  version = "3.6.2";
+  version = "3.9";
 
   src = fetchFromGitHub {
     owner = "vslavik";
     repo = "poedit";
     rev = "v${finalAttrs.version}-oss";
-    hash = "sha256-Lb1R7GMB0GeS2xZASR7w4ee33mMEKP9gPabRHkHlIJI=";
+    hash = "sha256-N/o57n624b+StXrT6jBxEFSGElcHdV6wrf/Y2JbA55k=";
   };
 
   nativeBuildInputs = [
@@ -77,6 +78,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "(.*)-oss"
+    ];
+  };
+
   meta = {
     description = "Cross-platform gettext catalogs (.po files) editor";
     mainProgram = "poedit";
diff --git a/pkgs/by-name/po/polarity/package.nix b/pkgs/by-name/po/polarity/package.nix
index b8eb6e18c1dd..813a847c9ece 100644
--- a/pkgs/by-name/po/polarity/package.nix
+++ b/pkgs/by-name/po/polarity/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "polarity";
-  version = "latest-unstable-2026-03-27";
+  version = "latest-unstable-2026-04-28";
 
   src = fetchFromGitHub {
     owner = "polarity-lang";
     repo = "polarity";
-    rev = "5d253a2701288573a32b58fbf592c66254b825ee";
-    hash = "sha256-jOIuBqJd5dKxEwHoaMMV4Jh9tOhQLkrIuuKsszPkpnE=";
+    rev = "dbcece0e8b572193a5605296392ef1f0d85bba74";
+    hash = "sha256-8wVsiLSTbjIZOObdiawvQy5rw+sf93cp6+wbY+XaByI=";
   };
 
-  cargoHash = "sha256-eat5XK8GZlbdPdkcrvOF99ln0a2SHZexAnqH55i8Vec=";
+  cargoHash = "sha256-9PMQQHydqgeKeB0eM49dJpL+8cstK8yUkc728ATXroQ=";
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
 
diff --git a/pkgs/by-name/pr/proftpd/package.nix b/pkgs/by-name/pr/proftpd/package.nix
index 6e3bd70b8704..8d664a8e0699 100644
--- a/pkgs/by-name/pr/proftpd/package.nix
+++ b/pkgs/by-name/pr/proftpd/package.nix
@@ -19,13 +19,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "proftpd";
-  version = "1.3.9";
+  version = "1.3.9a";
 
   src = fetchFromGitHub {
     owner = "proftpd";
     repo = "proftpd";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4Iyzk0OctTvDDkYXPDSrvaWQOjkbBXHY7ELyhkUx/X0=";
+    hash = "sha256-SNLzIwMF6XU2SAc5B9LIW2Jeh1Fa4CVumQYd2O0XxRY=";
   };
 
   patches = [ ./no-install-user.patch ];
diff --git a/pkgs/by-name/pr/prometheus-tibber-exporter/package.nix b/pkgs/by-name/pr/prometheus-tibber-exporter/package.nix
index e52f456a1fc2..174abda37cd2 100644
--- a/pkgs/by-name/pr/prometheus-tibber-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-tibber-exporter/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "prometheus-tibber-exporter";
-  version = "3.10.0";
+  version = "3.10.2";
 
   src = fetchFromGitHub {
     owner = "terjesannum";
     repo = "tibber-exporter";
     tag = "tibber-exporter-${finalAttrs.version}";
-    hash = "sha256-Ndg2BxWdL5DKa2eHjY0rIdrfJ+SJlzvOUZDtWUBSR6g=";
+    hash = "sha256-by7/c2a/8jM4ShoeQnYC+L+EVLk2NwQoRTAMiZZcMn0=";
     leaveDotGit = true;
     postFetch = ''
       cd "$out"
@@ -37,9 +37,14 @@ buildGoModule (finalAttrs: {
     "-X github.com/prometheus/common/version.BuildUser=nix@nixpkgs"
   ];
 
-  vendorHash = "sha256-JTJTapsqBj0FO2Gcx8O1eWJf9hMbeWzjtO0HYcDdzQo=";
+  vendorHash = "sha256-rjM2M9auiyFvGcq/D8N5YPoFOPeC9r1Y1JPssT7nvew=";
 
-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "tibber-exporter-(.*)"
+    ];
+  };
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/pr/prometheus/source.nix b/pkgs/by-name/pr/prometheus/source.nix
index 1090548f6e35..7a582275a2f2 100644
--- a/pkgs/by-name/pr/prometheus/source.nix
+++ b/pkgs/by-name/pr/prometheus/source.nix
@@ -1,6 +1,6 @@
 {
-  version = "3.11.2";
-  hash = "sha256-pSps9LKOOgWUA27lkgFOYliI8Skejx895EKwD88ysn8=";
-  npmDepsHash = "sha256-ZYbyWtqv7SL/SVAOuQmgb7atkrBQDumYB6Wpa39MThw=";
+  version = "3.11.3";
+  hash = "sha256-JmnVTVW6LsrdiQspKznksyhAYkmCXQcqCLK8q5nZI48=";
+  npmDepsHash = "sha256-6uE8d3+v5wobSyCl8oYlbNQZjRj/WtvVrpzo/PR2hQA=";
   vendorHash = "sha256-wR1b5jV/2B50OeKokv8Ss+tpSXNjJBsLIZrK7gOb168=";
 }
diff --git a/pkgs/by-name/pu/pure-ftpd/package.nix b/pkgs/by-name/pu/pure-ftpd/package.nix
index fab0c8d2cab7..43cf599949e9 100644
--- a/pkgs/by-name/pu/pure-ftpd/package.nix
+++ b/pkgs/by-name/pu/pure-ftpd/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pure-ftpd";
-  version = "1.0.53";
+  version = "1.0.54";
 
   src = fetchurl {
     url = "https://download.pureftpd.org/pub/pure-ftpd/releases/pure-ftpd-${finalAttrs.version}.tar.gz";
-    hash = "sha256-s/KwGUIjseiL+LDfnpH/tdG5gSNW6d1GXy+XtyshJl8=";
+    hash = "sha256-3JFAQg7ET3gpV5WR/zeKpjlrRgS5xq6uhHNo4PNb17I=";
   };
 
   buildInputs = [
diff --git a/pkgs/by-name/pv/pvz-portable-unwrapped/package.nix b/pkgs/by-name/pv/pvz-portable-unwrapped/package.nix
index 1b889af2b0f5..574d0119e319 100644
--- a/pkgs/by-name/pv/pvz-portable-unwrapped/package.nix
+++ b/pkgs/by-name/pv/pvz-portable-unwrapped/package.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pvz-portable-unwrapped";
-  version = "0.1.21";
+  version = "0.1.22";
 
   src = fetchFromGitHub {
     owner = "wszqkzqk";
     repo = "PvZ-Portable";
     tag = finalAttrs.version;
-    hash = "sha256-4CtO62cwNzQ32DE70F8kKFHy7tOsRLpDsgyrBS00C/g=";
+    hash = "sha256-H+YY2jTnsbnPzRhiOBqzzkVNJsFzoT6hMZpOTnB5mtA=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pv/pvzge/package.nix b/pkgs/by-name/pv/pvzge/package.nix
index 8fd5d34e0ea5..61bdf577cdcb 100644
--- a/pkgs/by-name/pv/pvzge/package.nix
+++ b/pkgs/by-name/pv/pvzge/package.nix
@@ -14,13 +14,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "pvzge";
-  version = "0.8.1";
+  version = "0.8.2";
 
   src = fetchFromGitHub {
     owner = "Gzh0821";
     repo = "pvzge_web";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-juo+kM7IK+e3qPHH+V+/1D0NqQiZfXYEtvX940dLarQ=";
+    hash = "sha256-lCYkkFIis6roWicsU7SN1YzHFQbAdLkkRl6JHasQa8E=";
   };
 
   iconSrc = fetchurl {
diff --git a/pkgs/by-name/py/pyenv/package.nix b/pkgs/by-name/py/pyenv/package.nix
index 7f317886c59b..a74729bebef3 100644
--- a/pkgs/by-name/py/pyenv/package.nix
+++ b/pkgs/by-name/py/pyenv/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pyenv";
-  version = "2.6.27";
+  version = "2.6.28";
 
   src = fetchFromGitHub {
     owner = "pyenv";
     repo = "pyenv";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EWpVkVTYI8Rvt7OZ3mdm/EEIcGHkD4LfHdAmhwgesLw=";
+    hash = "sha256-1jbpelEVcm+HqjsT8yaQPTaoOhEBCSq64LzTzr0X93I=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/py/pyspread/package.nix b/pkgs/by-name/py/pyspread/package.nix
index b1fb839f95df..ab6706468ad8 100644
--- a/pkgs/by-name/py/pyspread/package.nix
+++ b/pkgs/by-name/py/pyspread/package.nix
@@ -9,12 +9,12 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "pyspread";
-  version = "2.4";
+  version = "2.4.5";
 
   src = fetchPypi {
     pname = "pyspread";
     inherit (finalAttrs) version;
-    hash = "sha256-MZlR2Rap5oMRfCmswg9W//FYFkSEki7eyMNhLoGZgJM=";
+    hash = "sha256-7Nurn9OmK6LEz5TT543JUYKc/LjpkwfN/7r0ebS1PfY=";
   };
 
   pyproject = true;
diff --git a/pkgs/by-name/qa/qalculate-gtk/package.nix b/pkgs/by-name/qa/qalculate-gtk/package.nix
index cbbe1ae1cfd8..06bb06c1ae64 100644
--- a/pkgs/by-name/qa/qalculate-gtk/package.nix
+++ b/pkgs/by-name/qa/qalculate-gtk/package.nix
@@ -2,10 +2,12 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   autoreconfHook,
   pkg-config,
   libqalculate,
   gtk3,
+  gtk-mac-integration-gtk3,
   curl,
   wrapGAppsHook3,
   desktopToDarwinBundle,
@@ -22,6 +24,16 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-JZfolSRLRLtv529f25lEPYOlz+y+EdRqKA0Y5d1dK3s=";
   };
 
+  patches = [
+    # Is meaningfull only for Darwin but is better applying unconditionally.
+    # Can be removed in 5.11 probably, see:
+    # https://github.com/Qalculate/qalculate-gtk/pull/705
+    (fetchpatch {
+      url = "https://github.com/Qalculate/qalculate-gtk/commit/2f1b6a32d98f122d44d158c20f79a5b9aaf9669f.patch";
+      hash = "sha256-v9T8wWvqlI9l6BUszf/575qmoFvh88Cdj/m2XqV8Q4k=";
+    })
+  ];
+
   hardeningDisable = [ "format" ];
 
   nativeBuildInputs = [
@@ -30,11 +42,16 @@ stdenv.mkDerivation (finalAttrs: {
     wrapGAppsHook3
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ desktopToDarwinBundle ];
+
   buildInputs = [
     libqalculate
     gtk3
     curl
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    gtk-mac-integration-gtk3
   ];
+
   enableParallelBuilding = true;
 
   meta = {
diff --git a/pkgs/by-name/qg/qgroundcontrol/package.nix b/pkgs/by-name/qg/qgroundcontrol/package.nix
index f226de0c703c..8f067a131009 100644
--- a/pkgs/by-name/qg/qgroundcontrol/package.nix
+++ b/pkgs/by-name/qg/qgroundcontrol/package.nix
@@ -101,7 +101,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Provides full ground station support and configuration for the PX4 and APM Flight Stacks";
     homepage = "https://qgroundcontrol.com/";
-    changelog = "https://github.com/mavlink/qgroundcontrol/blob/master/ChangeLog.md";
+    changelog = "https://github.com/mavlink/qgroundcontrol/blob/master/CHANGELOG.md";
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [
diff --git a/pkgs/by-name/qu/questdb/package.nix b/pkgs/by-name/qu/questdb/package.nix
index e1e2ca5491d0..6ee0f8055619 100644
--- a/pkgs/by-name/qu/questdb/package.nix
+++ b/pkgs/by-name/qu/questdb/package.nix
@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "questdb";
-  version = "9.3.2";
+  version = "9.3.5";
 
   src = fetchurl {
     url = "https://github.com/questdb/questdb/releases/download/${finalAttrs.version}/questdb-${finalAttrs.version}-no-jre-bin.tar.gz";
-    hash = "sha256-64ffNDBbaPoKGOeidCnqXT8NkWIq+UAOrfRkh8sSQp4=";
+    hash = "sha256-TvymN030Q9k9qPbBvrtHcOjT9KILw0tzCle1pdI7Bj8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ra/rattler-build/package.nix b/pkgs/by-name/ra/rattler-build/package.nix
index ddee6bf15594..be212b258c60 100644
--- a/pkgs/by-name/ra/rattler-build/package.nix
+++ b/pkgs/by-name/ra/rattler-build/package.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rattler-build";
-  version = "0.62.2";
+  version = "0.63.0";
 
   src = fetchFromGitHub {
     owner = "prefix-dev";
     repo = "rattler-build";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nFXtbY2gVrS7zLTcCMOJLyL79Xi7Zw463OtoGL4zUYI=";
+    hash = "sha256-/BcVqquY0ggorzY0EJx9lwAWvx1W1I/ynn8GUx32h4o=";
   };
 
-  cargoHash = "sha256-dOXCwbasxqbcInm3YeYxDOckEDrQte9NESKUjf9zslk=";
+  cargoHash = "sha256-KiHZwGigwj1ORn5TBxYWn+FUjaZBWPauknA9ewibxdQ=";
 
   doCheck = false; # test requires network access
 
diff --git a/pkgs/by-name/re/regexploit/package.nix b/pkgs/by-name/re/regexploit/package.nix
index 00afe1b51696..bed39f091464 100644
--- a/pkgs/by-name/re/regexploit/package.nix
+++ b/pkgs/by-name/re/regexploit/package.nix
@@ -27,7 +27,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   meta = {
     description = "Tool to find regular expressions which are vulnerable to ReDoS";
     homepage = "https://github.com/doyensec/regexploit";
-    changelog = "https://github.com/doyensec/regexploit/releases/tag/v${finalAttrs.src.tag}";
+    changelog = "https://github.com/doyensec/regexploit/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
diff --git a/pkgs/by-name/re/renovate/package.nix b/pkgs/by-name/re/renovate/package.nix
index 243247907113..c71030bc00a7 100644
--- a/pkgs/by-name/re/renovate/package.nix
+++ b/pkgs/by-name/re/renovate/package.nix
@@ -20,13 +20,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "renovate";
-  version = "43.132.1";
+  version = "43.150.1";
 
   src = fetchFromGitHub {
     owner = "renovatebot";
     repo = "renovate";
     tag = finalAttrs.version;
-    hash = "sha256-vb7MIDxc1ZnjU/sBZqe0BwFzS8jlDjmW2HYkEPOQzIM=";
+    hash = "sha256-yCkwlPf6jLM906U7BdY1h5IcaOSe6aureYIKXQk+re0=";
   };
 
   postPatch = ''
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 2;
-    hash = "sha256-F7yity4PK3WYgq/DguJ4uz9QnOW9VRZuCgfUi2BryqQ=";
+    hash = "sha256-gDffEtUWqSWbwr4S0HZIPTvSrXDvl/q2Y5QuA+U6Ndk=";
   };
 
   env.COREPACK_ENABLE_STRICT = 0;
diff --git a/pkgs/by-name/ro/roc/package.nix b/pkgs/by-name/ro/roc/package.nix
index db7bd4492e71..7c4455e58447 100644
--- a/pkgs/by-name/ro/roc/package.nix
+++ b/pkgs/by-name/ro/roc/package.nix
@@ -99,7 +99,7 @@ rustPlatform.buildRustPackage {
     description = "Fast, friendly, functional programming language";
     mainProgram = "roc";
     homepage = "https://www.roc-lang.org/";
-    changelog = "https://github.com/roc-lang/roc/releases/tag/${rocVersion}";
+    changelog = "https://github.com/roc-lang/roc/releases/tag/alpha4-rolling";
     license = lib.licenses.upl;
     maintainers = [
       lib.maintainers.anton-4
diff --git a/pkgs/by-name/ro/roon-server/package.nix b/pkgs/by-name/ro/roon-server/package.nix
index 9ae93a6ad5f4..8615f6cbffbd 100644
--- a/pkgs/by-name/ro/roon-server/package.nix
+++ b/pkgs/by-name/ro/roon-server/package.nix
@@ -16,7 +16,7 @@
   stdenv,
 }:
 let
-  version = "2.64.1646";
+  version = "2.65.1653";
   urlVersion = builtins.replaceStrings [ "." ] [ "0" ] version;
 in
 stdenv.mkDerivation {
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://download.roonlabs.com/updates/production/RoonServer_linuxx64_${urlVersion}.tar.bz2";
-    hash = "sha256-tvNjz31xIo7UAB0t0seOfjiS7Qx6DPVu8VTBLK5ZjEo=";
+    hash = "sha256-t+i2s73D+N/CStIGKNZgGGRisEACxM5ug//YBBXVfpo=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix b/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
index bd56e6f2b8fd..dbf0e89c1f3e 100644
--- a/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
+++ b/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
@@ -13,15 +13,15 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rust-analyzer-unwrapped";
-  version = "2026-04-13";
+  version = "2026-04-27";
 
-  cargoHash = "sha256-qpe40NUQ9ux8fQmjcC63VP8g2NKoLkdqQIVfFFRTq5I=";
+  cargoHash = "sha256-QXEJhBzKof1UONW2FwQUeO6UAo1Xfm2nPpOo1uNiRM8=";
 
   src = fetchFromGitHub {
     owner = "rust-lang";
     repo = "rust-analyzer";
     rev = finalAttrs.version;
-    hash = "sha256-LryjOOjPsZ6Hs3RlVHla6MV8uxO2GoZolF0I/eB5zFM=";
+    hash = "sha256-f8YJfwAOsLFpIoqZuX3yF69UvMLrkx7iVzMH1pJU7cM=";
   };
 
   cargoBuildFlags = [
diff --git a/pkgs/by-name/ry/ryubing/package.nix b/pkgs/by-name/ry/ryubing/package.nix
index 1596cf56a0aa..5684f57ac98d 100644
--- a/pkgs/by-name/ry/ryubing/package.nix
+++ b/pkgs/by-name/ry/ryubing/package.nix
@@ -135,7 +135,8 @@ buildDotnetModule rec {
 
   meta = {
     homepage = "https://ryujinx.app";
-    changelog = "https://git.ryujinx.app/ryubing/ryujinx/-/wikis/changelog";
+    # historical changelog https://git.ryujinx.app/projects/Ryubing/wiki/Changelog
+    changelog = "https://git.ryujinx.app/projects/Ryubing/releases/tag/${src.tag}";
     description = "Experimental Nintendo Switch Emulator written in C# (community fork of Ryujinx)";
     longDescription = ''
       Ryujinx is an open-source Nintendo Switch emulator, created by gdkchan,
diff --git a/pkgs/by-name/sa/sail/package.nix b/pkgs/by-name/sa/sail/package.nix
index c6ea659cfde6..55d521c23026 100644
--- a/pkgs/by-name/sa/sail/package.nix
+++ b/pkgs/by-name/sa/sail/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sail";
-  version = "0.6.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "lakehq";
     repo = "sail";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ISTZwWDQ5DjNa5TC77Xea3zuhp2sSnp/NwD3ytYbjLc=";
+    hash = "sha256-QHlfK9gTTRObFJSPQFe8tQZRa8mRIA87TFZIwJV0nWs=";
   };
 
-  cargoHash = "sha256-njc4c/xN9uWvNgOvswx1fwwynFrM9eHw4LUOFVYJ4ls=";
+  cargoHash = "sha256-XMEyfLB/O7MA1dNY40UDv4OOyMKiJwgUm93XhxDyz4k=";
 
   cargoBuildFlags = [
     "-p"
diff --git a/pkgs/by-name/sb/sbomnix/package.nix b/pkgs/by-name/sb/sbomnix/package.nix
index b5144204eb48..84b15485d4b6 100644
--- a/pkgs/by-name/sb/sbomnix/package.nix
+++ b/pkgs/by-name/sb/sbomnix/package.nix
@@ -11,14 +11,14 @@
 }:
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "sbomnix";
-  version = "1.7.4";
+  version = "1.7.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tiiuae";
     repo = "sbomnix";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-s7mmtbELRcl/7ab5A3fU7f8m4rIm+mBLmXMeYHa7/n4=";
+    hash = "sha256-LApJvPeyViGJiJPLu7dFBU79SbMKieLVFKbDtFHo7f4=";
 
     # Remove documentation as it contains references to nix store
     postFetch = ''
diff --git a/pkgs/by-name/sc/scrutiny-collector/package.nix b/pkgs/by-name/sc/scrutiny-collector/package.nix
index 56f712e8f002..697f554f5684 100644
--- a/pkgs/by-name/sc/scrutiny-collector/package.nix
+++ b/pkgs/by-name/sc/scrutiny-collector/package.nix
@@ -9,14 +9,14 @@
 }:
 
 buildGoModule (finalAttrs: {
-  version = "0.9.1";
+  version = "0.9.2";
   pname = "scrutiny-collector";
 
   src = fetchFromGitHub {
     owner = "AnalogJ";
     repo = "scrutiny";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xEMHkISPBHinT6vRyrWPudvmTiX5gYxMkCEoSm2gLWA=";
+    hash = "sha256-ZQHTwJZBOYJ2De0CmyxXc4Fb2Vt+jKg+YpDDZhSt+cg=";
   };
 
   subPackages = "collector/cmd/collector-metrics";
diff --git a/pkgs/by-name/sc/scrutiny/package.nix b/pkgs/by-name/sc/scrutiny/package.nix
index f41ed84fdf7c..d0e3a4d9c2bc 100644
--- a/pkgs/by-name/sc/scrutiny/package.nix
+++ b/pkgs/by-name/sc/scrutiny/package.nix
@@ -35,13 +35,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "scrutiny";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "AnalogJ";
     repo = "scrutiny";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xEMHkISPBHinT6vRyrWPudvmTiX5gYxMkCEoSm2gLWA=";
+    hash = "sha256-ZQHTwJZBOYJ2De0CmyxXc4Fb2Vt+jKg+YpDDZhSt+cg=";
   };
 
   subPackages = "webapp/backend/cmd/scrutiny";
diff --git a/pkgs/by-name/sd/sdl3-shadercross/package.nix b/pkgs/by-name/sd/sdl3-shadercross/package.nix
index 69f1af15d0bf..878bb8af0cb3 100644
--- a/pkgs/by-name/sd/sdl3-shadercross/package.nix
+++ b/pkgs/by-name/sd/sdl3-shadercross/package.nix
@@ -13,7 +13,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sdl3-shadercross";
-  version = "0-unstable-2026-04-11";
+  version = "0-unstable-2026-04-24";
 
   outputs = [
     "out"
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "libsdl-org";
     repo = "SDL_shadercross";
-    rev = "f5c01f451e835f6b38e151e064a32999a0985563";
+    rev = "6b06e55c7c5d7e7a09a8a14f76e866dcfad5ab99";
     hash = "sha256-DvgMnE0QedInYRdcZQuVOlasri79kVl0ACGvNC1cq8o=";
   };
 
diff --git a/pkgs/by-name/se/sequoia-sop/package.nix b/pkgs/by-name/se/sequoia-sop/package.nix
index 976c2334d062..ec64a9a8a39d 100644
--- a/pkgs/by-name/se/sequoia-sop/package.nix
+++ b/pkgs/by-name/se/sequoia-sop/package.nix
@@ -54,7 +54,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   meta = {
     description = "Implementation of the Stateless OpenPGP Command Line Interface using Sequoia";
     homepage = "https://gitlab.com/sequoia-pgp/sequoia-sop";
-    changelog = "https://gitlab.com/sequoia-pgp/sequoia-sop/-/blob/v${finalAttrs.src.tag}/NEWS";
+    changelog = "https://gitlab.com/sequoia-pgp/sequoia-sop/-/blob/${finalAttrs.src.tag}/NEWS";
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ doronbehar ];
     mainProgram = "sqop";
diff --git a/pkgs/by-name/sh/shisho/package.nix b/pkgs/by-name/sh/shisho/package.nix
deleted file mode 100644
index 80a54a90f3d1..000000000000
--- a/pkgs/by-name/sh/shisho/package.nix
+++ /dev/null
@@ -1,63 +0,0 @@
-{
-  lib,
-  fetchFromGitHub,
-  rustPlatform,
-  installShellFiles,
-  rustfmt,
-  stdenv,
-}:
-
-rustPlatform.buildRustPackage (finalAttrs: {
-  pname = "shisho";
-  version = "0.5.2";
-
-  src = fetchFromGitHub {
-    owner = "flatt-security";
-    repo = "shisho";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-G7sHaDq+F5lXNaF1sSLUecdjZbCejJE79P4AQifKdFY=";
-    fetchSubmodules = true;
-  };
-
-  cargoHash = "sha256-gv3qvDzqwuuAVpbaOpMI7DuapSALMr/qzyhor3avYQI=";
-
-  nativeBuildInputs = [
-    installShellFiles
-    # required to build serde-sarif dependency
-    rustfmt
-  ];
-
-  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-    installShellCompletion --cmd shisho \
-      --bash <($out/bin/shisho completion bash) \
-      --fish <($out/bin/shisho completion fish) \
-      --zsh <($out/bin/shisho completion zsh)
-  '';
-
-  doInstallCheck = true;
-  installCheckPhase = ''
-    runHook preInstallCheck
-
-    $out/bin/shisho --help
-    $out/bin/shisho --version | grep "${finalAttrs.version}"
-
-    runHook postInstallCheck
-  '';
-
-  meta = {
-    homepage = "https://docs.shisho.dev/shisho/";
-    changelog = "https://docs.shisho.dev/changelog/";
-    description = "Lightweight static analyzer for several programming languages";
-    mainProgram = "shisho";
-    longDescription = ''
-      Shisho is a lightweight static code analyzer designed for developers and
-      is the core engine for Shisho products. It is, so to speak, like a
-      pluggable and configurable linter; it gives developers a way to codify
-      your domain knowledge over your code as rules. With powerful automation
-      and integration capabilities, the rules will help you find and fix issues
-      semiautomatically.
-    '';
-    license = lib.licenses.agpl3Only;
-    maintainers = with lib.maintainers; [ jk ];
-  };
-})
diff --git a/pkgs/by-name/si/signal-desktop/package.nix b/pkgs/by-name/si/signal-desktop/package.nix
index a64497b83c6f..9d19091a03c8 100644
--- a/pkgs/by-name/si/signal-desktop/package.nix
+++ b/pkgs/by-name/si/signal-desktop/package.nix
@@ -106,6 +106,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
   nativeBuildInputs = [
+    node-gyp
     nodejs
     pnpmConfigHook
     pnpm
@@ -241,7 +242,7 @@ stdenv.mkDerivation (finalAttrs: {
     # Build it explicitly against Electron headers ahead of packaging.
     export npm_config_nodedir=${electron.headers}
     pushd node_modules/fs-xattr
-    ${lib.getExe node-gyp} rebuild
+    node-gyp rebuild
     popd
     test -f node_modules/fs-xattr/build/Release/xattr.node
   '';
diff --git a/pkgs/by-name/sp/spacectl/package.nix b/pkgs/by-name/sp/spacectl/package.nix
index 445e0b7446c5..a12a42888ddc 100644
--- a/pkgs/by-name/sp/spacectl/package.nix
+++ b/pkgs/by-name/sp/spacectl/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "spacectl";
-  version = "1.21.0";
+  version = "1.21.1";
 
   src = fetchFromGitHub {
     owner = "spacelift-io";
     repo = "spacectl";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-GW8jeET8MBvyFbGZWblU2mj9kWSK9cfhdYj+UXxbt5s=";
+    hash = "sha256-YXPiB/RZsilteKzoOAsQ2aJ1qIlKIicToSVpS8pUWd4=";
   };
 
   vendorHash = "sha256-wc6pRnCdIL7Se98eDfyU5OMOghJ2VrR1POM7lHo3Af8=";
diff --git a/pkgs/by-name/sp/spirv-cross/package.nix b/pkgs/by-name/sp/spirv-cross/package.nix
index c97272ca8d3a..81ba6c313fa8 100644
--- a/pkgs/by-name/sp/spirv-cross/package.nix
+++ b/pkgs/by-name/sp/spirv-cross/package.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Tool designed for parsing and converting SPIR-V to other shader languages";
     homepage = "https://github.com/KhronosGroup/SPIRV-Cross";
-    changelog = "https://github.com/KhronosGroup/SPIRV-Cross/releases/tag/${finalAttrs.version}";
+    changelog = "https://github.com/KhronosGroup/SPIRV-Cross/releases/tag/vulkan-sdk-${finalAttrs.version}";
     platforms = lib.platforms.all;
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ Flakebi ];
diff --git a/pkgs/by-name/sp/spotatui/package.nix b/pkgs/by-name/sp/spotatui/package.nix
index 66aa257025cb..017f7e286be4 100644
--- a/pkgs/by-name/sp/spotatui/package.nix
+++ b/pkgs/by-name/sp/spotatui/package.nix
@@ -12,16 +12,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "spotatui";
-  version = "0.38.0";
+  version = "0.38.1";
 
   src = fetchFromGitHub {
     owner = "LargeModGames";
     repo = "spotatui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6XsKlM4KLwRZk+uJY60a0rKHIEv1ieZPZoBZpRG1sQ0=";
+    hash = "sha256-cHuqSnNLnR8LLYjjlrgJTEb/MJe4lBJP7GY3D7/AUqE=";
   };
 
-  cargoHash = "sha256-5aj35NGRFb1DiEPU1RGKkvz/wMOIjO1HzkX45GEFbPs=";
+  cargoHash = "sha256-dlEsghdnNVbi086WgNImUcM+OO7vuBaNit3Wcaw5/mA=";
 
   nativeBuildInputs = [ pkg-config ] ++ lib.optional withPipewireVisualizer rustPlatform.bindgenHook;
 
diff --git a/pkgs/by-name/sq/sqlc/package.nix b/pkgs/by-name/sq/sqlc/package.nix
index 33f43cbebdaa..eca36eae22f0 100644
--- a/pkgs/by-name/sq/sqlc/package.nix
+++ b/pkgs/by-name/sq/sqlc/package.nix
@@ -9,17 +9,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "sqlc";
-  version = "1.31.0";
+  version = "1.31.1";
 
   src = fetchFromGitHub {
     owner = "sqlc-dev";
     repo = "sqlc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1HQXj3rmfPyOw3Cex3jRByEwzXhcYpWpj8w4Z2Cylp8=";
+    hash = "sha256-/skb7p3s9TaQE699UCprk1D6S+G/T8Ek9/ADOtS/n44=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-SVc7XZERh47hhfTr9bExjZcZrNz0FO/OVEQYbPVqSWM=";
+  vendorHash = "sha256-+kSAupLQwTzJdgnhlqulEtRcDj9gqSq8uTnWNyDLZew=";
 
   subPackages = [ "cmd/sqlc" ];
 
diff --git a/pkgs/by-name/ss/ssh-agent-switcher/package.nix b/pkgs/by-name/ss/ssh-agent-switcher/package.nix
index 24507ef5306b..62b720db454c 100644
--- a/pkgs/by-name/ss/ssh-agent-switcher/package.nix
+++ b/pkgs/by-name/ss/ssh-agent-switcher/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ssh-agent-switcher";
-  version = "1.0.1";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "jmmv";
     repo = "ssh-agent-switcher";
     tag = "ssh-agent-switcher-${finalAttrs.version}";
-    hash = "sha256-p9W0H25pWDB+GCrwLwuVruX9p8b8kICpp+6I11ym1aw=";
+    hash = "sha256-XAIupGVU8D4tmZXZ3/5lKiHbvBlxgNQXL0T9Htp7Zmo=";
   };
 
-  cargoHash = "sha256-WioA/RjXOAHM9QWl/lxnb7gqzcp76rus7Rv+IfCYceg=";
+  cargoHash = "sha256-dbeUye20E2nQcJPyUCpZT68T95dopgoIlBm8rOoaZ6Y=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/st/stackit-cli/package.nix b/pkgs/by-name/st/stackit-cli/package.nix
index 592e2578a215..beee09671db1 100644
--- a/pkgs/by-name/st/stackit-cli/package.nix
+++ b/pkgs/by-name/st/stackit-cli/package.nix
@@ -12,16 +12,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "stackit-cli";
-  version = "0.60.0";
+  version = "0.61.0";
 
   src = fetchFromGitHub {
     owner = "stackitcloud";
     repo = "stackit-cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-PS5FJUA3+3gBJ7tY/Dl8HUz78GQEl3wS9BYe7MRIxoE=";
+    hash = "sha256-kuo0Fj/LgkbTLp+F6xvPUOS5vabjigwX4fVWLQVwO2I=";
   };
 
-  vendorHash = "sha256-HZ5k1AIuSsAdVIHMzo3awguw+AlctLMicLRzzGgM7xA=";
+  vendorHash = "sha256-NYvqQVDqSV5wyQGEkoAHnT0i+iNF6DKIYIwyiYY5G6M=";
 
   subPackages = [ "." ];
 
diff --git a/pkgs/by-name/st/statping-ng/package.nix b/pkgs/by-name/st/statping-ng/package.nix
index 589ed1c9f6d1..c132dcf640d8 100644
--- a/pkgs/by-name/st/statping-ng/package.nix
+++ b/pkgs/by-name/st/statping-ng/package.nix
@@ -93,7 +93,7 @@ buildGoModule rec {
   meta = {
     description = "Status Page for monitoring your websites and applications with beautiful graphs, analytics, and plugins";
     homepage = "https://github.com/statping-ng/statping-ng";
-    changelog = "https://github.com/statping-ng/statping-ng/releases/tag/v${src.tag}";
+    changelog = "https://github.com/statping-ng/statping-ng/releases/tag/${src.tag}";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [
       FKouhai
diff --git a/pkgs/by-name/te/teams-for-linux/package.nix b/pkgs/by-name/te/teams-for-linux/package.nix
index e9e2ac9dfcd5..b01f5392b4a0 100644
--- a/pkgs/by-name/te/teams-for-linux/package.nix
+++ b/pkgs/by-name/te/teams-for-linux/package.nix
@@ -16,16 +16,16 @@
 
 buildNpmPackage rec {
   pname = "teams-for-linux";
-  version = "2.8.0";
+  version = "2.8.1";
 
   src = fetchFromGitHub {
     owner = "IsmaelMartinez";
     repo = "teams-for-linux";
     tag = "v${version}";
-    hash = "sha256-ybxJCCdam5g43Ycf+Ro3ptOr+4+49Fw+y0rqG4fEzBc=";
+    hash = "sha256-kD04SMErq92k+F4/3v6bpoJf2lfaGM6bAn+bCa9ACbA=";
   };
 
-  npmDepsHash = "sha256-+VwOlzR+80m+qQS4L0IPmFTn4xuPM7aX7EtSd50D9KM=";
+  npmDepsHash = "sha256-497bL7l3OIAgkbXP3FkeFFpPz2VtRENrw6sQmJsnXBY=";
 
   nativeBuildInputs = [
     makeWrapper
diff --git a/pkgs/by-name/te/tenv/package.nix b/pkgs/by-name/te/tenv/package.nix
index c44d7a39193d..86e9916844aa 100644
--- a/pkgs/by-name/te/tenv/package.nix
+++ b/pkgs/by-name/te/tenv/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "tenv";
-  version = "4.11.1";
+  version = "4.12.0";
 
   src = fetchFromGitHub {
     owner = "tofuutils";
     repo = "tenv";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3KSJG2gKnyu0Kxhbjemw4y8OvmXUNrqzlKcU9CCIqEo=";
+    hash = "sha256-Ph44Iy/yUdtSi3zkCeDZyWeSa+0l6nr34Co1JupD2eY=";
   };
 
-  vendorHash = "sha256-9A51pB94+PQP0SaT7LW78bwndGa5gOZOFkDEz2VzHl8=";
+  vendorHash = "sha256-CBAjiUMnyA7yq08Z1fOSOAeSy/8uSCra6l63C8fn6tU=";
 
   excludedPackages = [ "tools" ];
 
diff --git a/pkgs/by-name/te/terraform-mcp-server/package.nix b/pkgs/by-name/te/terraform-mcp-server/package.nix
index f83843677771..bc23b234e95f 100644
--- a/pkgs/by-name/te/terraform-mcp-server/package.nix
+++ b/pkgs/by-name/te/terraform-mcp-server/package.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "terraform-mcp-server";
-  version = "0.5.1";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "terraform-mcp-server";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pYco93oARCqgUk99X3oxBcuNKStw0JeyVQOoEt6PYn8=";
+    hash = "sha256-4NUSMNLWn5Pmwq//M0yHn7qw9oUI4Q3MDXeQ8xBLLSI=";
   };
 
-  vendorHash = "sha256-fJ3G/kqJlnoBdBVgnl1MzYLrNhucNocWT3rHgrTpfQU=";
+  vendorHash = "sha256-FuAt2epg4wH7oNa0nvQMWZZwOL1YtpSVdEBxkeY2Heg=";
 
   ldflags = [
     "-X main.version=${finalAttrs.version}"
diff --git a/pkgs/by-name/te/textcompare/package.nix b/pkgs/by-name/te/textcompare/package.nix
index d34d1547bd1a..1aeb7b1fcd5c 100644
--- a/pkgs/by-name/te/textcompare/package.nix
+++ b/pkgs/by-name/te/textcompare/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "textcompare";
-  version = "0.1.10";
+  version = "0.1.11";
 
   src = fetchFromGitHub {
     owner = "josephmawa";
     repo = "TextCompare";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xcrw2bDRZbphYQUnCbjicYyg+9RfDlIQx8Jr+KRLAh0=";
+    hash = "sha256-aTRhe2tgP9IIlduaaAffXqRpDgSG08XosHnTxtpmSvU=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/tf/tfenv/package.nix b/pkgs/by-name/tf/tfenv/package.nix
index 416876afb871..00600179edd9 100644
--- a/pkgs/by-name/tf/tfenv/package.nix
+++ b/pkgs/by-name/tf/tfenv/package.nix
@@ -16,13 +16,13 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   __structuredAttrs = true;
 
   pname = "tfenv";
-  version = "3.0.0";
+  version = "3.2.1";
 
   src = fetchFromGitHub {
     owner = "tfutils";
     repo = "tfenv";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-2Fpaj/UQDE7PNFX9GNr4tygvKmm/X0yWVVerJ+Y6eks=";
+    hash = "sha256-bwY5QEXugogNrStT859lNOkPoQ+n3BQZGexErxl5nco=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
diff --git a/pkgs/by-name/ti/timr-tui/package.nix b/pkgs/by-name/ti/timr-tui/package.nix
index ecfaee84837a..de7e88f5bee3 100644
--- a/pkgs/by-name/ti/timr-tui/package.nix
+++ b/pkgs/by-name/ti/timr-tui/package.nix
@@ -14,16 +14,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "timr-tui";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "sectore";
     repo = "timr-tui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kxXAH8IUe1LOoS8ch9OL6sS0oeviSN6H7hBJ6ZY+oQw=";
+    hash = "sha256-9HaKBrW0MkNzDErEIINztLyGpN4mkGF5RpmXohgbK6A=";
   };
 
-  cargoHash = "sha256-zNbXxT0Z1TtqitD4P7m8TgEvg8C0AOslrVNKD/Nd9cQ=";
+  cargoHash = "sha256-J6Zi8oEAsbxMQe+oCk9T6Ic1hPdNXI9iFmn4Z0d0lFE=";
 
   # Enable upstream "sound" feature when requested
   buildFeatures = lib.optionals enableSound [ "sound" ];
diff --git a/pkgs/by-name/to/tor-browser/package.nix b/pkgs/by-name/to/tor-browser/package.nix
index bc6aea8cdb1a..2541b229cae6 100644
--- a/pkgs/by-name/to/tor-browser/package.nix
+++ b/pkgs/by-name/to/tor-browser/package.nix
@@ -102,7 +102,7 @@ let
     ++ lib.optionals mediaSupport [ ffmpeg_7 ]
   );
 
-  version = "15.0.10";
+  version = "15.0.11";
 
   sources = {
     x86_64-linux = fetchurl {
@@ -112,7 +112,7 @@ let
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
       ];
-      hash = "sha256-PlGjkyO2MoLWo7eAgoNMfd52dM7v9VKyfCxXbj3qqu4=";
+      hash = "sha256-+1ZpJcVkqqP2WE3kyAJ7Ip3CmM2JIpUos1wgvLjND24=";
     };
 
     i686-linux = fetchurl {
@@ -122,7 +122,7 @@ let
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
       ];
-      hash = "sha256-rangtzd7oee+2b7zdmKYJD8al4G3FYo+bdq8JgBn5oE=";
+      hash = "sha256-dZeTAkmvI5+mu7u9DrUj/JTvLHE4hiNVqd5AyVbZptg=";
     };
   };
 
@@ -347,7 +347,7 @@ stdenv.mkDerivation rec {
     description = "Privacy-focused browser routing traffic through the Tor network";
     mainProgram = "tor-browser";
     homepage = "https://www.torproject.org/";
-    changelog = "https://gitweb.torproject.org/builders/tor-browser-build.git/plain/projects/tor-browser/Bundle-Data/Docs/ChangeLog.txt?h=maint-${version}";
+    changelog = "https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/raw/maint-${lib.versions.majorMinor version}/projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt";
     platforms = lib.attrNames sources;
     maintainers = with lib.maintainers; [
       c4patino
diff --git a/pkgs/by-name/tr/tree/package.nix b/pkgs/by-name/tr/tree/package.nix
index da67f9a37411..51838f624080 100644
--- a/pkgs/by-name/tr/tree/package.nix
+++ b/pkgs/by-name/tr/tree/package.nix
@@ -25,13 +25,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "tree";
-  version = "2.3.1";
+  version = "2.3.2";
 
   src = fetchFromGitLab {
     owner = "OldManProgrammer";
     repo = "unix-tree";
     rev = finalAttrs.version;
-    hash = "sha256-ks3bj916tDdizywQnZKNSAfA2AzWh3np2F6QN5eOzIc=";
+    hash = "sha256-hmnBG96qQXvTulPnUYyliqidfKC+Wvky+d7xzYrCdTw=";
   };
 
   preConfigure = ''
diff --git a/pkgs/by-name/tu/tutanota-desktop/package.nix b/pkgs/by-name/tu/tutanota-desktop/package.nix
index 94fca3d54348..051fe263bb78 100644
--- a/pkgs/by-name/tu/tutanota-desktop/package.nix
+++ b/pkgs/by-name/tu/tutanota-desktop/package.nix
@@ -8,11 +8,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "tutanota-desktop";
-  version = "340.260326.1";
+  version = "345.260424.1";
 
   src = fetchurl {
     url = "https://github.com/tutao/tutanota/releases/download/tutanota-desktop-release-${version}/tutanota-desktop-linux.AppImage";
-    hash = "sha256-9QtiB4VyktUgItJkOIdeGYthFxGt8RsNlAFf9ERoAEg=";
+    hash = "sha256-B0YXpJ75b6N2UNJSOwDd0bgsM4qzJGfYX/ELQk+IQO4=";
   };
 
   extraPkgs = pkgs: [ pkgs.libsecret ];
diff --git a/pkgs/by-name/tx/txtpbfmt/package.nix b/pkgs/by-name/tx/txtpbfmt/package.nix
index 066be2f86b60..d3cf3e94eb40 100644
--- a/pkgs/by-name/tx/txtpbfmt/package.nix
+++ b/pkgs/by-name/tx/txtpbfmt/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule {
   pname = "txtpbfmt";
-  version = "0-unstable-2026-02-17";
+  version = "0-unstable-2026-04-20";
 
   src = fetchFromGitHub {
     owner = "protocolbuffers";
     repo = "txtpbfmt";
-    rev = "a481f6a22f9426d6c2cc3d4be185b28d156886e4";
-    hash = "sha256-5dX1hEq1VzzZdXaoxkyy/gCbB8u/wlwy8g9kScVmJZs=";
+    rev = "c39628bde8b5d6b6e8f67f46580b5c1dd491b1fd";
+    hash = "sha256-D3yONCvyynXKVyeRypllKNMgPgo1w1ObPcra3r7aSF0=";
   };
 
   vendorHash = "sha256-aeYa7a/oKH2dxXHRkkqyh7f04citRDGQxAaKQTJst4o=";
diff --git a/pkgs/by-name/ty/typos/package.nix b/pkgs/by-name/ty/typos/package.nix
index 629b7bda2e2e..729552c62856 100644
--- a/pkgs/by-name/ty/typos/package.nix
+++ b/pkgs/by-name/ty/typos/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "typos";
-  version = "1.45.1";
+  version = "1.45.2";
 
   src = fetchFromGitHub {
     owner = "crate-ci";
     repo = "typos";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-v051wBxAgTlsFOAlysRlUOz/VoSSxbm3rqRJBxLOPuI=";
+    hash = "sha256-bribbiFYA8YYT6ZJNVyZ2l6FrAlfSuQ/WldqmHHG5lI=";
   };
 
-  cargoHash = "sha256-S7koGmH6C8wigRD+/ldDltTziHQ3uadHGfeI+Vk/Wak=";
+  cargoHash = "sha256-cdAjIRWaMWPDJuJg9mw/8Ky8ePYCIFzmn0Ir00UO5HM=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/up/updatecli/package.nix b/pkgs/by-name/up/updatecli/package.nix
index 06da056b38c0..ccba32226c20 100644
--- a/pkgs/by-name/up/updatecli/package.nix
+++ b/pkgs/by-name/up/updatecli/package.nix
@@ -12,16 +12,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "updatecli";
-  version = "0.116.0";
+  version = "0.116.3";
 
   src = fetchFromGitHub {
     owner = "updatecli";
     repo = "updatecli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-34XXA8cBifuPC4Sls34D4kFkMOv9+1oYV3ZqPrWF1zY=";
+    hash = "sha256-5dJfbw0xoB34XuCym/TcqwdeUORZezfJNu7Plt82VPM=";
   };
 
-  vendorHash = "sha256-UK6KC/NsEy08mK2tikpAN+H4C61cyHGzqqeoz5kylEg=";
+  vendorHash = "sha256-cMXepPUJoJGRlQSRSByA2/pjsQXfyH8Va320CywxxDw=";
 
   # tests require network access
   doCheck = false;
diff --git a/pkgs/by-name/vi/victoriametrics/package.nix b/pkgs/by-name/vi/victoriametrics/package.nix
index 4a0e3ce6fe63..061cbeefe50a 100644
--- a/pkgs/by-name/vi/victoriametrics/package.nix
+++ b/pkgs/by-name/vi/victoriametrics/package.nix
@@ -13,13 +13,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "VictoriaMetrics";
-  version = "1.141.0";
+  version = "1.142.0";
 
   src = fetchFromGitHub {
     owner = "VictoriaMetrics";
     repo = "VictoriaMetrics";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eMaCChrv3/w7KNlnLdV1/YGGh4ZMGqeNAnMV1OlIQWE=";
+    hash = "sha256-PI4P0CGMcYbkrT8Rrgl5P56yTC+r3tnZudvFySzNJeY=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/vp/vpl-gpu-rt/package.nix b/pkgs/by-name/vp/vpl-gpu-rt/package.nix
index 1ba0a20c6592..83bb7cac0df3 100644
--- a/pkgs/by-name/vp/vpl-gpu-rt/package.nix
+++ b/pkgs/by-name/vp/vpl-gpu-rt/package.nix
@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vpl-gpu-rt";
-  version = "26.1.4";
+  version = "26.1.6";
 
   outputs = [
     "out"
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "intel";
     repo = "vpl-gpu-rt";
     rev = "intel-onevpl-${finalAttrs.version}";
-    hash = "sha256-DqEg7GClyWdy9Clop7nIJSllN5gLTSZujgBwN2WmBds=";
+    hash = "sha256-E8CQC2jHSo2ZHp8drXXTgcOOHru3kDJtoLNKwm++YG8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/wa/wappalyzergo/package.nix b/pkgs/by-name/wa/wappalyzergo/package.nix
index 3d7bbf2da7ff..23b15b996926 100644
--- a/pkgs/by-name/wa/wappalyzergo/package.nix
+++ b/pkgs/by-name/wa/wappalyzergo/package.nix
@@ -26,7 +26,7 @@ buildGoModule (finalAttrs: {
   meta = {
     description = "Implementation of the Wappalyzer Technology Detection Library";
     homepage = "https://github.com/projectdiscovery/wappalyzergo";
-    changelog = "https://github.com/projectdiscovery/wappalyzergo/releases/tag/v${finalAttrs.src.tag}";
+    changelog = "https://github.com/projectdiscovery/wappalyzergo/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "wappalyzergo";
diff --git a/pkgs/by-name/wa/wasistlos/package.nix b/pkgs/by-name/wa/wasistlos/package.nix
deleted file mode 100644
index f8ad1c8468b8..000000000000
--- a/pkgs/by-name/wa/wasistlos/package.nix
+++ /dev/null
@@ -1,84 +0,0 @@
-{
-  fetchFromGitHub,
-  lib,
-  stdenv,
-  cmake,
-  glib-networking,
-  gst_all_1,
-  gtkmm3,
-  libayatana-appindicator,
-  libcanberra,
-  libepoxy,
-  libpsl,
-  libdatrie,
-  libdeflate,
-  libselinux,
-  libsepol,
-  libsysprof-capture,
-  libthai,
-  libxkbcommon,
-  sqlite,
-  pcre,
-  pcre2,
-  pkg-config,
-  webkitgtk_4_1,
-  wrapGAppsHook3,
-  libxtst,
-  libxdmcp,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "wasistlos";
-  version = "1.7.0";
-
-  src = fetchFromGitHub {
-    owner = "xeco23";
-    repo = "WasIstLos";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-h07Qf34unwtyc1VDtCCkukgBDJIvYNgESwAylbsjVsQ=";
-  };
-
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-    wrapGAppsHook3
-  ];
-
-  buildInputs = [
-    glib-networking
-    gst_all_1.gst-libav
-    gst_all_1.gst-plugins-bad
-    gst_all_1.gst-plugins-base
-    gst_all_1.gst-plugins-good
-    gtkmm3
-    libayatana-appindicator
-    libcanberra
-    libdatrie
-    libdeflate
-    libepoxy
-    libpsl
-    libselinux
-    libsepol
-    libsysprof-capture
-    libthai
-    libxkbcommon
-    pcre
-    pcre2
-    sqlite
-    webkitgtk_4_1
-    libxdmcp
-    libxtst
-  ];
-
-  meta = {
-    homepage = "https://github.com/xeco23/WasIstLos";
-    description = "Unofficial WhatsApp desktop application";
-    mainProgram = "wasistlos";
-    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [ bartuka ];
-    platforms = [
-      "x86_64-linux"
-      "aarch64-linux"
-    ];
-  };
-})
diff --git a/pkgs/by-name/wa/wasm-tools/package.nix b/pkgs/by-name/wa/wasm-tools/package.nix
index bedaaf4a11b1..c292251f1bdd 100644
--- a/pkgs/by-name/wa/wasm-tools/package.nix
+++ b/pkgs/by-name/wa/wasm-tools/package.nix
@@ -6,20 +6,20 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wasm-tools";
-  version = "1.247.0";
+  version = "1.248.0";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "wasm-tools";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-whUI6nUD/ibuaqt3hEGG4tLU4U84nFWHYMZ/3HxPM7U=";
+    hash = "sha256-B0G+k5RI7j1J0G4l2lcpA6iTTNUmjQOOwi3zij0Ww+c=";
     fetchSubmodules = true;
   };
 
   # Disable cargo-auditable until https://github.com/rust-secure-code/cargo-auditable/issues/124 is solved.
   auditable = false;
 
-  cargoHash = "sha256-mERF+ls0lrBasVFdjcFJS3v7KH6B/Zm2uW0N1EHTHew=";
+  cargoHash = "sha256-yMp8AWcWfxTXq4eIekuPhgOdMbuoscck+r0O01cC+AA=";
   cargoBuildFlags = [
     "--package"
     "wasm-tools"
diff --git a/pkgs/by-name/wo/wofi-power-menu/package.nix b/pkgs/by-name/wo/wofi-power-menu/package.nix
index 869ddd5e8957..774b715dc419 100644
--- a/pkgs/by-name/wo/wofi-power-menu/package.nix
+++ b/pkgs/by-name/wo/wofi-power-menu/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wofi-power-menu";
-  version = "0.3.3";
+  version = "0.3.4";
 
   src = fetchFromGitHub {
     owner = "szaffarano";
     repo = "wofi-power-menu";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iz+iiJv5MEQ/Yh6h28uPgRrmnw7xM/X4nUW+VHCarpE=";
+    hash = "sha256-5dhwDfWL0pP28rgbS5eoOARrXDZVTF6EDNimcfcjH3Y=";
   };
 
-  cargoHash = "sha256-6CNoHxC1AMTbbx3s4eqYPfqJ3pePdN2DJw6INUQFbek=";
+  cargoHash = "sha256-Avful4JlhYrdHpzWfseCmmx5jxuOJxEA2Yl6dfkJpXs=";
 
   nativeBuildInputs = [ makeBinaryWrapper ];
 
diff --git a/pkgs/by-name/wt/wtcat/package.nix b/pkgs/by-name/wt/wtcat/package.nix
index 75f045d43e55..68806b0b40f6 100644
--- a/pkgs/by-name/wt/wtcat/package.nix
+++ b/pkgs/by-name/wt/wtcat/package.nix
@@ -39,7 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   meta = {
     description = "WebTransport CLI";
     homepage = "https://github.com/pervrosen/wtcat";
-    changelog = "https://github.com/pervrosen/wtcat/releases/tag/v${finalAttrs.src.tag}";
+    changelog = "https://github.com/pervrosen/wtcat/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "wtcat";
diff --git a/pkgs/by-name/xn/xnlinkfinder/package.nix b/pkgs/by-name/xn/xnlinkfinder/package.nix
index e2e2bcdc7d45..2ea04ee16a96 100644
--- a/pkgs/by-name/xn/xnlinkfinder/package.nix
+++ b/pkgs/by-name/xn/xnlinkfinder/package.nix
@@ -1,41 +1,43 @@
 {
   lib,
   fetchFromGitHub,
-  fetchpatch,
   python3,
+  writableTmpDirAsHomeHook,
 }:
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "xnlinkfinder";
-  version = "6.0";
+  version = "8.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "xnl-h4ck3r";
     repo = "xnLinkFinder";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UMHMWHLJOhEeR+vO4YE3aNzdsvMAXPpQHQgdFf1QeMY=";
+    hash = "sha256-xym8ruHPAseqmWLUtCPTlpr3REDrpbWor66aNvfASjA=";
   };
 
-  patches = [
-    # Clean-up setup.py
-    (fetchpatch {
-      name = "clean-up.patch";
-      url = "https://github.com/xnl-h4ck3r/xnLinkFinder/commit/8ef5e2ecf4c627b389cb7bb526f10fffe84acc13.patch";
-      hash = "sha256-14j3dFgehhPdqAe4e9FsB8sD66hKnNaPmDJRV1mQTDo=";
-    })
+  pythonRemoveDeps = [
+    # python already provides urllib.parse
+    "urlparse3"
   ];
 
   build-system = with python3.pkgs; [ setuptools ];
 
+  nativeBuildInputs = [ writableTmpDirAsHomeHook ];
+
   dependencies = with python3.pkgs; [
     beautifulsoup4
     html5lib
+    inflect
     lxml
+    playwright
     psutil
+    pypdf
     pyyaml
     requests
     termcolor
+    tldextract
     urllib3
   ];
 
@@ -47,7 +49,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   meta = {
     description = "Tool to discover endpoints, potential parameters, and a target specific wordlist for a given target";
     homepage = "https://github.com/xnl-h4ck3r/xnLinkFinder";
-    changelog = "https://github.com/xnl-h4ck3r/xnLinkFinder/blob/${finalAttrs.version}/CHANGELOG.md";
+    changelog = "https://github.com/xnl-h4ck3r/xnLinkFinder/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "xnLinkFinder";
diff --git a/pkgs/by-name/xw/xwayland/package.nix b/pkgs/by-name/xw/xwayland/package.nix
index 4a26bc6945f3..0a36d9525919 100644
--- a/pkgs/by-name/xw/xwayland/package.nix
+++ b/pkgs/by-name/xw/xwayland/package.nix
@@ -56,11 +56,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xwayland";
-  version = "24.1.10";
+  version = "24.1.11";
 
   src = fetchurl {
     url = "mirror://xorg/individual/xserver/xwayland-${finalAttrs.version}.tar.xz";
-    hash = "sha256-RZdivo6gRslDhmh9d6h63WBzhovuFPApE+r+u5RbeqA=";
+    hash = "sha256-JxFaGogZB4QJv2/s/rdyToE3vTZCbecAWls6rgohOP8=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ya/yafc-ce/package.nix b/pkgs/by-name/ya/yafc-ce/package.nix
index d2099636373b..222b29dd3b1b 100644
--- a/pkgs/by-name/ya/yafc-ce/package.nix
+++ b/pkgs/by-name/ya/yafc-ce/package.nix
@@ -12,13 +12,13 @@ let
 in
 buildDotnetModule (finalAttrs: {
   pname = "yafc-ce";
-  version = "2.16.0";
+  version = "2.18.1";
 
   src = fetchFromGitHub {
-    owner = "shpaass";
+    owner = "Yafc-CE";
     repo = "yafc-ce";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6+GGxEwn3tenmcukOZPTIZ7UZg/d9uudQP0qwU8mifY=";
+    hash = "sha256-MdaYAustOMFO2rim0o2FnEhFWINa9E1jEvIQS9SnEHY=";
   };
 
   projectFile = [
@@ -39,13 +39,6 @@ buildDotnetModule (finalAttrs: {
     SDL2_image
   ];
 
-  postPatch = ''
-    # Yafc finds the root by looking for a `.git` directory, but `.git` is
-    # removed by Nix to ensure reproducibility. `.github` is not.
-    substituteInPlace Yafc.I18n.Generator/SourceGenerator.cs \
-      --replace-fail 'rootDirectory, ".git"' 'rootDirectory, ".github"'
-  '';
-
   meta = {
     description = "Powerful Factorio calculator/analyser that works with mods, Community Edition";
     longDescription = ''
@@ -54,9 +47,9 @@ buildDotnetModule (finalAttrs: {
 
       YAFC Community Edition is an updated and actively-maintained version of the original YAFC.
     '';
-    homepage = "https://github.com/shpaass/yafc-ce";
-    downloadPage = "https://github.com/shpaass/yafc-ce/releases/tag/${finalAttrs.version}";
-    changelog = "https://github.com/shpaass/yafc-ce/releases/tag/${finalAttrs.version}";
+    homepage = "https://github.com/Yafc-CE/yafc-ce";
+    downloadPage = "https://github.com/Yafc-CE/yafc-ce/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/Yafc-CE/yafc-ce/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [
       diamond-deluxe
diff --git a/pkgs/by-name/ya/yarr/package.nix b/pkgs/by-name/ya/yarr/package.nix
index ff84ace8d72a..e659fa62f305 100644
--- a/pkgs/by-name/ya/yarr/package.nix
+++ b/pkgs/by-name/ya/yarr/package.nix
@@ -45,7 +45,7 @@ buildGoModule (finalAttrs: {
     description = "Yet another rss reader";
     mainProgram = "yarr";
     homepage = "https://github.com/nkanaev/yarr";
-    changelog = "https://github.com/nkanaev/yarr/blob/v${finalAttrs.version}/doc/changelog.txt";
+    changelog = "https://github.com/nkanaev/yarr/blob/v${finalAttrs.version}/doc/changelog.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       sikmir
diff --git a/pkgs/by-name/za/zapper/package.nix b/pkgs/by-name/za/zapper/package.nix
index fe22cfa0cae6..3284106699e2 100644
--- a/pkgs/by-name/za/zapper/package.nix
+++ b/pkgs/by-name/za/zapper/package.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Zaps arguments and environment from the process list";
     homepage = "https://github.com/hackerschoice/zapper";
-    changelog = "https://github.com/hackerschoice/zapper/releases/tag/v${finalAttrs.src.tag}";
+    changelog = "https://github.com/hackerschoice/zapper/releases/tag/${finalAttrs.src.tag}";
     # https://github.com/hackerschoice/zapper/issues/4
     license = lib.licenses.unfree;
     maintainers = with lib.maintainers; [ fab ];
diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 530b86329485..ee17f813df39 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -97,7 +97,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.233.10";
+  version = "1.0.0";
 
   outputs = [
     "out"
@@ -110,7 +110,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ftbrApKQhSn6SNs7ysgBot9XctuVtAskBTnm2hmCBaA=";
+    hash = "sha256-D5V0pvL3WCwhcC8dnNKTXRdnFq8LMZZ0/GDjw8xf95g=";
   };
 
   postPatch = ''
@@ -139,7 +139,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm -r $out/git/*/candle-book/
   '';
 
-  cargoHash = "sha256-9r0jaT+ETAkGGHYDL1KFmq3M+apaLsRpORk7OOz4s5Q=";
+  cargoHash = "sha256-xtw7r7VluCEqXWKnxpVk8BPqr+mJV5rB3Eq/PvsKPBk=";
 
   __structuredAttrs = true;
 
diff --git a/pkgs/by-name/zg/zgrab2/package.nix b/pkgs/by-name/zg/zgrab2/package.nix
index 51e0bcd47397..a7ec0bf632f2 100644
--- a/pkgs/by-name/zg/zgrab2/package.nix
+++ b/pkgs/by-name/zg/zgrab2/package.nix
@@ -24,7 +24,7 @@ buildGoModule (finalAttrs: {
   meta = {
     description = "Fast Application Layer Scanner";
     homepage = "https://github.com/zmap/zgrab2";
-    changelog = "https://github.com/zmap/zgrab2/releases/tag/vv${finalAttrs.version}";
+    changelog = "https://github.com/zmap/zgrab2/releases/tag/v${finalAttrs.version}";
     license = with lib.licenses; [
       asl20
       isc
diff --git a/pkgs/by-name/zu/zuban/package.nix b/pkgs/by-name/zu/zuban/package.nix
index e3060670c43c..08174c0cb392 100644
--- a/pkgs/by-name/zu/zuban/package.nix
+++ b/pkgs/by-name/zu/zuban/package.nix
@@ -9,13 +9,13 @@
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zuban";
 
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "zubanls";
     repo = "zuban";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PuD9go5aQJh3qOjWxRX1+43SfHfRcYEulvJ2Mc1lfus=";
+    hash = "sha256-s2u4or9qittXMt9layFEVrtYLhNgghZQd7VdupUpxqU=";
     fetchSubmodules = true;
   };
 
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   buildAndTestSubdir = "crates/zuban";
 
-  cargoHash = "sha256-96hcuvsrtFrQgP2CDLEdssvxXFg9Iy00v1DiJJxkdOU=";
+  cargoHash = "sha256-0CynAjkY1Q6IZ8yyZWL8p/MySriahql2fc3qqsNvPeI=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/development/compilers/jetbrains-jdk/21.nix b/pkgs/development/compilers/jetbrains-jdk/21.nix
new file mode 100644
index 000000000000..821202d6da21
--- /dev/null
+++ b/pkgs/development/compilers/jetbrains-jdk/21.nix
@@ -0,0 +1,26 @@
+{
+  callPackage,
+  jetbrains,
+  jdk,
+  debugBuild ? false,
+  withJcef ? true,
+}:
+
+callPackage ./common.nix
+  {
+    inherit jdk debugBuild withJcef;
+  }
+  {
+    # To get the new tag:
+    # git clone https://github.com/jetbrains/jetbrainsruntime
+    # cd jetbrainsruntime
+    # git tag --points-at [revision]
+    # Look for the line that starts with jbr-
+    javaVersion = "21.0.10";
+    build = "1163.110";
+    # run `git log -1 --pretty=%ct` in jdk repo for new value on update
+    sourceDateEpoch = 1765114563;
+    srcHash = "sha256-Qmffu7p6frBoH2Zh+EiqvEoMNNBE79qfkgLSC3+XuI0=";
+    homePath = "${jetbrains.jdk-21}/lib/openjdk";
+    jcefPackage = jetbrains.jcef-21;
+  }
diff --git a/pkgs/development/compilers/jetbrains-jdk/common.nix b/pkgs/development/compilers/jetbrains-jdk/common.nix
new file mode 100644
index 000000000000..4a685776d46a
--- /dev/null
+++ b/pkgs/development/compilers/jetbrains-jdk/common.nix
@@ -0,0 +1,236 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  jdk,
+  git,
+  autoconf,
+  unzip,
+  rsync,
+  shaderc,
+  vulkan-headers,
+  libxdamage,
+  libxxf86vm,
+  libxrandr,
+  libxi,
+  libxcursor,
+  libxrender,
+  libx11,
+  libxext,
+  libxkbcommon,
+  libxcb,
+  nss,
+  nspr,
+  libdrm,
+  libgbm,
+  wayland,
+  udev,
+  fontconfig,
+  debugBuild ? false,
+  withJcef ? true,
+}:
+
+{
+  javaVersion,
+  build,
+  sourceDateEpoch,
+  srcHash,
+  homePath,
+  jcefPackage ? null,
+  extraBuildPhase ? "",
+  vendorVersionString ? null,
+  extraConfigureFlags ? [ ],
+  extraNativeBuildInputs ? [ ],
+  extraBuildInputs ? [ ],
+}:
+
+assert debugBuild -> withJcef;
+
+let
+  arch =
+    {
+      "aarch64-linux" = "aarch64";
+      "x86_64-linux" = "x64";
+    }
+    .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
+  cpu = stdenv.hostPlatform.parsed.cpu.name;
+  version = "${javaVersion}-b${build}";
+  openjdkTag = "jbr-release-${javaVersion}b${build}";
+in
+jdk.overrideAttrs (oldAttrs: {
+  pname = "jetbrains-jdk" + lib.optionalString withJcef "-jcef";
+  inherit
+    javaVersion
+    build
+    version
+    openjdkTag
+    ;
+
+  src = fetchFromGitHub {
+    owner = "JetBrains";
+    repo = "JetBrainsRuntime";
+    rev = "jb${version}";
+    hash = srcHash;
+  };
+
+  env = (oldAttrs.env or { }) // {
+    BOOT_JDK = jdk.home;
+    # run `git log -1 --pretty=%ct` in jdk repo for new value on update
+    SOURCE_DATE_EPOCH = sourceDateEpoch;
+  };
+
+  patches = [ ];
+
+  dontConfigure = true;
+
+  buildPhase = ''
+    runHook preBuild
+
+    ${lib.optionalString withJcef "cp -r ${jcefPackage} jcef_linux_${arch}"}
+    ${extraBuildPhase}
+
+    sed \
+        -e "s/OPENJDK_TAG=.*/OPENJDK_TAG=${openjdkTag}/" \
+        -e "s/SOURCE_DATE_EPOCH=.*//" \
+        -e "s/export SOURCE_DATE_EPOCH//" \
+        -i jb/project/tools/common/scripts/common.sh
+
+    declare -a realConfigureFlags
+
+    for configureFlag in "''${configureFlags[@]}"; do
+      case "$configureFlag" in
+        --host=*)
+          # intentionally omit flag
+          ;;
+        ${lib.optionalString (vendorVersionString != null) ''
+          --with-vendor-version-string=*)
+            # Replace the flag from the JDK to include that it is JBR and the package version, so it passes the installation tests
+            realConfigureFlags+=('--with-vendor-version-string="${vendorVersionString}"')
+            ;;
+        ''}
+        *)
+          realConfigureFlags+=("$configureFlag")
+          ;;
+      esac
+    done
+
+    ${lib.concatMapStringsSep "\n" (flag: ''realConfigureFlags+=("${flag}")'') extraConfigureFlags}
+
+    echo "computed configure flags: ''${realConfigureFlags[*]}"
+    substituteInPlace jb/project/tools/linux/scripts/mkimages_${arch}.sh --replace-fail "STATIC_CONF_ARGS" "STATIC_CONF_ARGS ''${realConfigureFlags[*]}"
+
+    sed \
+        -e "s/create_image_bundle \"jb/#/" \
+        -e "s/echo Creating /exit 0 #/" \
+        -i jb/project/tools/linux/scripts/mkimages_${arch}.sh
+
+    patchShebangs .
+    ./jb/project/tools/linux/scripts/mkimages_${arch}.sh ${build} ${
+      if debugBuild then "fd" else (if withJcef then "jcef" else "nomod")
+    }
+
+    runHook postBuild
+  '';
+
+  installPhase =
+    let
+      buildType = if debugBuild then "fastdebug" else "release";
+      debugSuffix = if debugBuild then "-fastdebug" else "";
+      jcefSuffix = if debugBuild || !withJcef then "" else "_jcef";
+      jbrsdkDir = "jbrsdk${jcefSuffix}-${javaVersion}-linux-${arch}${debugSuffix}-b${build}";
+    in
+    ''
+      runHook preInstall
+
+      mv build/linux-${cpu}-server-${buildType}/images/jdk/man build/linux-${cpu}-server-${buildType}/images/${jbrsdkDir}
+      rm -rf build/linux-${cpu}-server-${buildType}/images/jdk
+      mv build/linux-${cpu}-server-${buildType}/images/${jbrsdkDir} build/linux-${cpu}-server-${buildType}/images/jdk
+    ''
+    + oldAttrs.installPhase
+    + "runHook postInstall";
+
+  postInstall = lib.optionalString withJcef ''
+    chmod +x $out/lib/openjdk/lib/chrome-sandbox
+  '';
+
+  dontStrip = debugBuild;
+
+  postFixup = ''
+    # Build the set of output library directories to rpath against
+    LIBDIRS="${
+      lib.makeLibraryPath [
+        libxdamage
+        libxxf86vm
+        libxrandr
+        libxi
+        libxcursor
+        libxrender
+        libx11
+        libxext
+        libxkbcommon
+        libxcb
+        nss
+        nspr
+        libdrm
+        libgbm
+        wayland
+        udev
+        fontconfig
+      ]
+    }"
+    for output in ${lib.concatStringsSep " " oldAttrs.outputs}; do
+      if [ "$output" = debug ]; then continue; fi
+      LIBDIRS="$(find $(eval echo \$$output) -name \*.so\* -exec dirname {} \+ | sort -u | tr '\n' ':'):$LIBDIRS"
+    done
+    # Add the local library paths to remove dependencies on the bootstrap
+    for output in ${lib.concatStringsSep " " oldAttrs.outputs}; do
+      if [ "$output" = debug ]; then continue; fi
+      OUTPUTDIR=$(eval echo \$$output)
+      BINLIBS=$(find $OUTPUTDIR/bin/ -type f; find $OUTPUTDIR -name \*.so\*)
+      echo "$BINLIBS" | while read i; do
+        patchelf --set-rpath "$LIBDIRS:$(patchelf --print-rpath "$i")" "$i" || true
+      done
+    done
+  '';
+
+  nativeBuildInputs = [
+    git
+    autoconf
+    unzip
+    rsync
+    shaderc # glslc
+  ]
+  ++ extraNativeBuildInputs
+  ++ oldAttrs.nativeBuildInputs;
+
+  buildInputs = [
+    vulkan-headers
+  ]
+  ++ extraBuildInputs
+  ++ oldAttrs.buildInputs or [ ];
+
+  meta = {
+    description = "OpenJDK fork to better support Jetbrains's products";
+    longDescription = ''
+      JetBrains Runtime is a runtime environment for running IntelliJ Platform
+      based products on Windows, Mac OS X, and Linux. JetBrains Runtime is
+      based on OpenJDK project with some modifications. These modifications
+      include: Subpixel Anti-Aliasing, enhanced font rendering on Linux, HiDPI
+      support, ligatures, some fixes for native crashes not presented in
+      official build, and other small enhancements.
+      JetBrains Runtime is not a certified build of OpenJDK. Please, use at
+      your own risk.
+    '';
+    homepage = "https://confluence.jetbrains.com/display/JBR/JetBrains+Runtime";
+    inherit (jdk.meta) license platforms mainProgram;
+    maintainers = with lib.maintainers; [
+      aoli-al
+    ];
+
+    broken = stdenv.hostPlatform.isDarwin;
+  };
+
+  passthru = oldAttrs.passthru // {
+    home = homePath;
+  };
+})
diff --git a/pkgs/development/compilers/jetbrains-jdk/default.nix b/pkgs/development/compilers/jetbrains-jdk/default.nix
index 33f6231aafbd..58b655bdf220 100644
--- a/pkgs/development/compilers/jetbrains-jdk/default.nix
+++ b/pkgs/development/compilers/jetbrains-jdk/default.nix
@@ -1,210 +1,53 @@
 {
-  lib,
-  stdenv,
-  fetchFromGitHub,
+  callPackage,
+  fetchurl,
   jetbrains,
   jdk,
-  git,
-  autoconf,
-  unzip,
-  rsync,
   debugBuild ? false,
   withJcef ? true,
-
-  libxdamage,
-  libxxf86vm,
-  libxrandr,
-  libxi,
-  libxcursor,
-  libxrender,
-  libx11,
-  libxext,
+  wayland-scanner,
+  wayland-protocols,
   libxkbcommon,
-  libxcb,
-  nss,
-  nspr,
-  libdrm,
-  libgbm,
-  wayland,
-  udev,
-  fontconfig,
-  shaderc,
-  vulkan-headers,
 }:
 
-assert debugBuild -> withJcef;
-
 let
-  arch =
-    {
-      "aarch64-linux" = "aarch64";
-      "x86_64-linux" = "x64";
-    }
-    .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-  cpu = stdenv.hostPlatform.parsed.cpu.name;
-in
-jdk.overrideAttrs (oldAttrs: rec {
-  pname = "jetbrains-jdk" + lib.optionalString withJcef "-jcef";
-  javaVersion = "21.0.9";
-  build = "1163.86";
-  # To get the new tag:
-  # git clone https://github.com/jetbrains/jetbrainsruntime
-  # cd jetbrainsruntime
-  # git tag --points-at [revision]
-  # Look for the line that starts with jbr-
-  openjdkTag = "jbr-release-21.0.9b1163.86";
-  version = "${javaVersion}-b${build}";
-
-  src = fetchFromGitHub {
-    owner = "JetBrains";
-    repo = "JetBrainsRuntime";
-    rev = "jb${version}";
-    hash = "sha256-P2boCbGB66X8LB4sZHGFO8lqHbv6F4kqGVMGBd9yKu0=";
-  };
-
-  env = (oldAttrs.env or { }) // {
-    BOOT_JDK = jdk.home;
-    # run `git log -1 --pretty=%ct` in jdk repo for new value on update
-    SOURCE_DATE_EPOCH = 1765114563;
-  };
-
-  patches = [ ];
-
-  dontConfigure = true;
-
-  buildPhase = ''
-    runHook preBuild
-
-    ${lib.optionalString withJcef "cp -r ${jetbrains.jcef} jcef_linux_${arch}"}
-
-    sed \
-        -e "s/OPENJDK_TAG=.*/OPENJDK_TAG=${openjdkTag}/" \
-        -e "s/SOURCE_DATE_EPOCH=.*//" \
-        -e "s/export SOURCE_DATE_EPOCH//" \
-        -i jb/project/tools/common/scripts/common.sh
-    declare -a realConfigureFlags
-    for configureFlag in "''${configureFlags[@]}"; do
-      case "$configureFlag" in
-        --host=*)
-          # intentionally omit flag
-          ;;
-        *)
-          realConfigureFlags+=("$configureFlag")
-          ;;
-      esac
-    done
-    echo "computed configure flags: ''${realConfigureFlags[*]}"
-    substituteInPlace jb/project/tools/linux/scripts/mkimages_${arch}.sh --replace-fail "STATIC_CONF_ARGS" "STATIC_CONF_ARGS ''${realConfigureFlags[*]}"
-    sed \
-        -e "s/create_image_bundle \"jb/#/" \
-        -e "s/echo Creating /exit 0 #/" \
-        -i jb/project/tools/linux/scripts/mkimages_${arch}.sh
-
-    patchShebangs .
-    ./jb/project/tools/linux/scripts/mkimages_${arch}.sh ${build} ${
-      if debugBuild then "fd" else (if withJcef then "jcef" else "nomod")
-    }
-
-    runHook postBuild
-  '';
-
-  installPhase =
+  gtk-protocols =
     let
-      buildType = if debugBuild then "fastdebug" else "release";
-      debugSuffix = if debugBuild then "-fastdebug" else "";
-      jcefSuffix = if debugBuild || !withJcef then "" else "_jcef";
-      jbrsdkDir = "jbrsdk${jcefSuffix}-${javaVersion}-linux-${arch}${debugSuffix}-b${build}";
+      rev = "refs/tags/4.22.1";
+      hash = "sha256-zCcXuiEYL2N4Q+WT96ouVDwdZVSohgU/QA2BkGlnZZ0=";
     in
-    ''
-      runHook preInstall
-
-      mv build/linux-${cpu}-server-${buildType}/images/jdk/man build/linux-${cpu}-server-${buildType}/images/${jbrsdkDir}
-      rm -rf build/linux-${cpu}-server-${buildType}/images/jdk
-      mv build/linux-${cpu}-server-${buildType}/images/${jbrsdkDir} build/linux-${cpu}-server-${buildType}/images/jdk
-    ''
-    + oldAttrs.installPhase
-    + "runHook postInstall";
-
-  postInstall = lib.optionalString withJcef ''
-    chmod +x $out/lib/openjdk/lib/chrome-sandbox
-  '';
-
-  dontStrip = debugBuild;
-
-  postFixup = ''
-    # Build the set of output library directories to rpath against
-    LIBDIRS="${
-      lib.makeLibraryPath [
-        libxdamage
-        libxxf86vm
-        libxrandr
-        libxi
-        libxcursor
-        libxrender
-        libx11
-        libxext
-        libxkbcommon
-        libxcb
-        nss
-        nspr
-        libdrm
-        libgbm
-        wayland
-        udev
-        fontconfig
-      ]
-    }"
-    for output in ${lib.concatStringsSep " " oldAttrs.outputs}; do
-      if [ "$output" = debug ]; then continue; fi
-      LIBDIRS="$(find $(eval echo \$$output) -name \*.so\* -exec dirname {} \+ | sort -u | tr '\n' ':'):$LIBDIRS"
-    done
-    # Add the local library paths to remove dependencies on the bootstrap
-    for output in ${lib.concatStringsSep " " oldAttrs.outputs}; do
-      if [ "$output" = debug ]; then continue; fi
-      OUTPUTDIR=$(eval echo \$$output)
-      BINLIBS=$(find $OUTPUTDIR/bin/ -type f; find $OUTPUTDIR -name \*.so\*)
-      echo "$BINLIBS" | while read i; do
-        patchelf --set-rpath "$LIBDIRS:$(patchelf --print-rpath "$i")" "$i" || true
-      done
-    done
-  '';
-
-  nativeBuildInputs = [
-    git
-    autoconf
-    unzip
-    rsync
-    shaderc # glslc
-  ]
-  ++ oldAttrs.nativeBuildInputs;
-
-  buildInputs = [
-    vulkan-headers
-  ]
-  ++ oldAttrs.buildInputs or [ ];
-
-  meta = {
-    description = "OpenJDK fork to better support Jetbrains's products";
-    longDescription = ''
-      JetBrains Runtime is a runtime environment for running IntelliJ Platform
-      based products on Windows, Mac OS X, and Linux. JetBrains Runtime is
-      based on OpenJDK project with some modifications. These modifications
-      include: Subpixel Anti-Aliasing, enhanced font rendering on Linux, HiDPI
-      support, ligatures, some fixes for native crashes not presented in
-      official build, and other small enhancements.
-      JetBrains Runtime is not a certified build of OpenJDK. Please, use at
-      your own risk.
+    fetchurl {
+      # We only need the wayland protocols file
+      url = "https://raw.githubusercontent.com/GNOME/gtk/${rev}/gdk/wayland/protocol/gtk-shell.xml";
+      hash = hash;
+    };
+in
+callPackage ./common.nix
+  {
+    inherit jdk debugBuild withJcef;
+  }
+  {
+    # To get the new tag:
+    # git clone https://github.com/jetbrains/jetbrainsruntime
+    # cd jetbrainsruntime
+    # git tag --points-at [revision]
+    # Look for the line that starts with jbr-
+    javaVersion = "25.0.2";
+    build = "329.72";
+    # run `git log -1 --pretty=%ct` in jdk repo for new value on update
+    sourceDateEpoch = 1769205294;
+    srcHash = "sha256-K4Izbij+1YO4UERHS0mwGKZX/VtIaxyNPZD068Vf99Q=";
+    homePath = "${jetbrains.jdk}/lib/openjdk";
+    jcefPackage = jetbrains.jcef;
+    extraBuildPhase = ''
+      cp -r ${gtk-protocols.out} gtk-shell.xml
     '';
-    homepage = "https://confluence.jetbrains.com/display/JBR/JetBrains+Runtime";
-    inherit (jdk.meta) license platforms mainProgram;
-    maintainers = with lib.maintainers; [
-      aoli-al
+    vendorVersionString = "nix/JBR-25.0.2-b329.72${if withJcef then "-jcef" else ""}";
+    extraConfigureFlags = [
+      "--with-wayland-protocols=${wayland-protocols.out}/share/wayland-protocols"
     ];
-
-    broken = stdenv.hostPlatform.isDarwin;
-  };
-
-  passthru = oldAttrs.passthru // {
-    home = "${jetbrains.jdk}/lib/openjdk";
-  };
-})
+    extraNativeBuildInputs = [
+      wayland-scanner
+      libxkbcommon
+    ];
+  }
diff --git a/pkgs/development/compilers/jetbrains-jdk/jcef.nix b/pkgs/development/compilers/jetbrains-jdk/jcef.nix
index 2bc5004691aa..7e9eb75e2e91 100644
--- a/pkgs/development/compilers/jetbrains-jdk/jcef.nix
+++ b/pkgs/development/compilers/jetbrains-jdk/jcef.nix
@@ -9,6 +9,7 @@
   jdk,
   git,
   rsync,
+  which,
   lib,
   ant,
   ninja,
@@ -91,11 +92,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "jcef-jetbrains";
-  rev = "6f9ab690b28a1262f82e6f869c310bdf1d0697ac";
+  rev = "a492f5c1bbe877d2f58d4b066d0a1c89ab579b84";
   # This is the commit number
-  # Currently from the branch: https://github.com/JetBrains/jcef/tree/251
+  # Currently from the branch: https://github.com/JetBrains/jcef/tree/261
   # Run `git rev-list --count HEAD`
-  version = "1086";
+  version = "1131";
 
   nativeBuildInputs = [
     cmake
@@ -103,12 +104,14 @@ stdenv.mkDerivation rec {
     jdk
     git
     rsync
+    which
     ant
     ninja
     strip-nondeterminism
     stripJavaArchivesHook
     autoPatchelfHook
   ];
+
   buildInputs = [
     boost
     libGL
@@ -123,7 +126,7 @@ stdenv.mkDerivation rec {
     owner = "jetbrains";
     repo = "jcef";
     inherit rev;
-    hash = "sha256-w5t1M66KW5cUbNTpAc4ksGd+414EJsXwbq1UP1COFsw=";
+    hash = "sha256-c1gJu6gogALx3viLi9saLvqOn+zS9jCpWizB2g1Xa/g=";
   };
 
   # Find the hash in tools/buildtools/linux64/clang-format.sha1
@@ -172,6 +175,13 @@ stdenv.mkDerivation rec {
 
   postBuild = ''
     export JCEF_ROOT_DIR=$(realpath ..)
+
+    # Apply https://github.com/JetBrains/jcef/pull/42
+    substituteInPlace ../build.xml \
+      --replace-fail \
+        '<matches pattern="17*.*" string="''${java.version}"/>' \
+        '<javaversion atLeast="17"/>'
+
     ../tools/compile.sh ${platform} Release
   '';
 
diff --git a/pkgs/development/interpreters/python/python2/mk-python-derivation.nix b/pkgs/development/interpreters/python/python2/mk-python-derivation.nix
index 817225bcc47c..e6e660d704e5 100644
--- a/pkgs/development/interpreters/python/python2/mk-python-derivation.nix
+++ b/pkgs/development/interpreters/python/python2/mk-python-derivation.nix
@@ -27,278 +27,298 @@
   eggBuildHook,
   eggInstallHook,
 }:
+lib.extendMkDerivation {
+  constructDrv = stdenv.mkDerivation;
 
-{
-  name ? "${attrs.pname}-${attrs.version}",
-
-  # Build-time dependencies for the package
-  nativeBuildInputs ? [ ],
-
-  # Run-time dependencies for the package
-  buildInputs ? [ ],
-
-  # Dependencies needed for running the checkPhase.
-  # These are added to buildInputs when doCheck = true.
-  checkInputs ? [ ],
-  nativeCheckInputs ? [ ],
-
-  # propagate build dependencies so in case we have A -> B -> C,
-  # C can import package A propagated by B
-  propagatedBuildInputs ? [ ],
-
-  # DEPRECATED: use propagatedBuildInputs
-  pythonPath ? [ ],
-
-  # Enabled to detect some (native)BuildInputs mistakes
-  strictDeps ? true,
-
-  outputs ? [ "out" ],
-
-  # used to disable derivation, useful for specific python versions
-  disabled ? false,
-
-  # Raise an error if two packages are installed with the same name
-  # TODO: For cross we probably need a different PYTHONPATH, or not
-  # add the runtime deps until after buildPhase.
-  catchConflicts ? (python.stdenv.hostPlatform == python.stdenv.buildPlatform),
-
-  # Additional arguments to pass to the makeWrapper function, which wraps
-  # generated binaries.
-  makeWrapperArgs ? [ ],
-
-  # Skip wrapping of python programs altogether
-  dontWrapPythonPrograms ? false,
-
-  # Don't use Pip to install a wheel
-  # Note this is actually a variable for the pipInstallPhase in pip's setupHook.
-  # It's included here to prevent an infinite recursion.
-  dontUsePipInstall ? false,
-
-  # Skip setting the PYTHONNOUSERSITE environment variable in wrapped programs
-  permitUserSite ? false,
-
-  # Remove bytecode from bin folder.
-  # When a Python script has the extension `.py`, bytecode is generated
-  # Typically, executables in bin have no extension, so no bytecode is generated.
-  # However, some packages do provide executables with extensions, and thus bytecode is generated.
-  removeBinBytecode ? true,
-
-  # Several package formats are supported.
-  # "setuptools" : Install a common setuptools/distutils based package. This builds a wheel.
-  # "wheel" : Install from a pre-compiled wheel.
-  # "pyproject": Install a package using a ``pyproject.toml`` file (PEP517). This builds a wheel.
-  # "egg": Install a package from an egg.
-  # "other" : Provide your own buildPhase and installPhase.
-  format ? "setuptools",
-
-  meta ? { },
-
-  passthru ? { },
-
-  doCheck ? true,
-
-  disabledTestPaths ? [ ],
-
-  ...
-}@attrs:
-
-let
-  withDistOutput = lib.elem format [
-    "pyproject"
-    "setuptools"
-    "wheel"
+  excludeDrvArgNames = [
+    "disabled"
+    "checkPhase"
+    "checkInputs"
+    "nativeCheckInputs"
+    "doCheck"
+    "doInstallCheck"
+    "dontWrapPythonPrograms"
+    "catchConflicts"
+    "format"
+    "disabledTestPaths"
   ];
 
-  name_ = name;
+  extendDrvArgs =
+    finalAttrs:
+    {
+      name ? "${attrs.pname}-${attrs.version}",
+
+      # Build-time dependencies for the package
+      nativeBuildInputs ? [ ],
+
+      # Run-time dependencies for the package
+      buildInputs ? [ ],
+
+      # Dependencies needed for running the checkPhase.
+      # These are added to buildInputs when doCheck = true.
+      checkInputs ? [ ],
+      nativeCheckInputs ? [ ],
+
+      # propagate build dependencies so in case we have A -> B -> C,
+      # C can import package A propagated by B
+      propagatedBuildInputs ? [ ],
+
+      # DEPRECATED: use propagatedBuildInputs
+      pythonPath ? [ ],
+
+      # Enabled to detect some (native)BuildInputs mistakes
+      strictDeps ? true,
+
+      outputs ? [ "out" ],
+
+      # used to disable derivation, useful for specific python versions
+      disabled ? false,
+
+      # Raise an error if two packages are installed with the same name
+      # TODO: For cross we probably need a different PYTHONPATH, or not
+      # add the runtime deps until after buildPhase.
+      catchConflicts ? (python.stdenv.hostPlatform == python.stdenv.buildPlatform),
+
+      # Additional arguments to pass to the makeWrapper function, which wraps
+      # generated binaries.
+      makeWrapperArgs ? [ ],
+
+      # Skip wrapping of python programs altogether
+      dontWrapPythonPrograms ? false,
+
+      # Don't use Pip to install a wheel
+      # Note this is actually a variable for the pipInstallPhase in pip's setupHook.
+      # It's included here to prevent an infinite recursion.
+      dontUsePipInstall ? false,
+
+      # Skip setting the PYTHONNOUSERSITE environment variable in wrapped programs
+      permitUserSite ? false,
+
+      # Remove bytecode from bin folder.
+      # When a Python script has the extension `.py`, bytecode is generated
+      # Typically, executables in bin have no extension, so no bytecode is generated.
+      # However, some packages do provide executables with extensions, and thus bytecode is generated.
+      removeBinBytecode ? true,
+
+      # Several package formats are supported.
+      # "setuptools" : Install a common setuptools/distutils based package. This builds a wheel.
+      # "wheel" : Install from a pre-compiled wheel.
+      # "pyproject": Install a package using a ``pyproject.toml`` file (PEP517). This builds a wheel.
+      # "egg": Install a package from an egg.
+      # "other" : Provide your own buildPhase and installPhase.
+      format ? "setuptools",
+
+      meta ? { },
+
+      passthru ? { },
+
+      doCheck ? true,
+
+      disabledTestPaths ? [ ],
+
+      ...
+    }@attrs:
 
-  validatePythonMatches =
-    attrName:
     let
-      isPythonModule =
-        drv:
-        # all pythonModules have the pythonModule attribute
-        (drv ? "pythonModule")
-        # Some pythonModules are turned in to a pythonApplication by setting the field to false
-        && (!builtins.isBool drv.pythonModule);
-      isMismatchedPython = drv: drv.pythonModule != python;
+      withDistOutput = lib.elem format [
+        "pyproject"
+        "setuptools"
+        "wheel"
+      ];
 
-      optionalLocation =
+      name_ = name;
+
+      validatePythonMatches =
+        attrName:
         let
-          pos = builtins.unsafeGetAttrPos (if attrs ? "pname" then "pname" else "name") attrs;
+          isPythonModule =
+            drv:
+            # all pythonModules have the pythonModule attribute
+            (drv ? "pythonModule")
+            # Some pythonModules are turned in to a pythonApplication by setting the field to false
+            && (!builtins.isBool drv.pythonModule);
+          isMismatchedPython = drv: drv.pythonModule != python;
+
+          optionalLocation =
+            let
+              pos = builtins.unsafeGetAttrPos (if attrs ? "pname" then "pname" else "name") attrs;
+            in
+            lib.optionalString (pos != null) " at ${pos.file}:${toString pos.line}:${toString pos.column}";
+
+          leftPadName =
+            name: against:
+            let
+              len = lib.max (lib.stringLength name) (lib.stringLength against);
+            in
+            lib.strings.fixedWidthString len " " name;
+
+          throwMismatch =
+            drv:
+            let
+              myName = "'${namePrefix}${name}'";
+              theirName = "'${drv.name}'";
+            in
+            throw ''
+              Python version mismatch in ${myName}:
+
+              The Python derivation ${myName} depends on a Python derivation
+              named ${theirName}, but the two derivations use different versions
+              of Python:
+
+                  ${leftPadName myName theirName} uses ${python}
+                  ${leftPadName theirName myName} uses ${toString drv.pythonModule}
+
+              Possible solutions:
+
+                * If ${theirName} is a Python library, change the reference to ${theirName}
+                  in the ${attrName} of ${myName} to use a ${theirName} built from the same
+                  version of Python
+
+                * If ${theirName} is used as a tool during the build, move the reference to
+                  ${theirName} in ${myName} from ${attrName} to nativeBuildInputs
+
+                * If ${theirName} provides executables that are called at run time, pass its
+                  bin path to makeWrapperArgs:
+
+                      makeWrapperArgs = [ "--prefix PATH : ''${lib.makeBinPath [ ${lib.getName drv} ] }" ];
+
+              ${optionalLocation}
+            '';
+
+          checkDrv = drv: if (isPythonModule drv) && (isMismatchedPython drv) then throwMismatch drv else drv;
+
         in
-        lib.optionalString (pos != null) " at ${pos.file}:${toString pos.line}:${toString pos.column}";
-
-      leftPadName =
-        name: against:
-        let
-          len = lib.max (lib.stringLength name) (lib.stringLength against);
-        in
-        lib.strings.fixedWidthString len " " name;
-
-      throwMismatch =
-        drv:
-        let
-          myName = "'${namePrefix}${name}'";
-          theirName = "'${drv.name}'";
-        in
-        throw ''
-          Python version mismatch in ${myName}:
-
-          The Python derivation ${myName} depends on a Python derivation
-          named ${theirName}, but the two derivations use different versions
-          of Python:
-
-              ${leftPadName myName theirName} uses ${python}
-              ${leftPadName theirName myName} uses ${toString drv.pythonModule}
-
-          Possible solutions:
-
-            * If ${theirName} is a Python library, change the reference to ${theirName}
-              in the ${attrName} of ${myName} to use a ${theirName} built from the same
-              version of Python
-
-            * If ${theirName} is used as a tool during the build, move the reference to
-              ${theirName} in ${myName} from ${attrName} to nativeBuildInputs
-
-            * If ${theirName} provides executables that are called at run time, pass its
-              bin path to makeWrapperArgs:
-
-                  makeWrapperArgs = [ "--prefix PATH : ''${lib.makeBinPath [ ${lib.getName drv} ] }" ];
-
-          ${optionalLocation}
-        '';
-
-      checkDrv = drv: if (isPythonModule drv) && (isMismatchedPython drv) then throwMismatch drv else drv;
+        inputs: map checkDrv inputs;
 
     in
-    inputs: map checkDrv inputs;
+    {
 
-  # Keep extra attributes from `attrs`, e.g., `patchPhase', etc.
-  self = toPythonModule (
-    stdenv.mkDerivation (
-      (removeAttrs attrs [
-        "disabled"
-        "checkPhase"
-        "checkInputs"
-        "nativeCheckInputs"
-        "doCheck"
-        "doInstallCheck"
-        "dontWrapPythonPrograms"
-        "catchConflicts"
-        "format"
-        "disabledTestPaths"
-        "outputs"
-      ])
-      // {
+      name = namePrefix + name_;
 
-        name = namePrefix + name_;
+      nativeBuildInputs = [
+        python
+        wrapPython
+        ensureNewerSourcesForZipFilesHook # move to wheel installer (pip) or builder (setuptools, ...)?
+        pythonRemoveTestsDirHook
+      ]
+      ++ lib.optionals catchConflicts [
+        pythonCatchConflictsHook
+      ]
+      ++ lib.optionals removeBinBytecode [
+        pythonRemoveBinBytecodeHook
+      ]
+      ++ lib.optionals (lib.hasSuffix "zip" (attrs.src.name or "")) [
+        unzip
+      ]
+      ++ lib.optionals (format == "setuptools") [
+        setuptoolsBuildHook
+      ]
+      ++ lib.optionals (format == "pyproject") [
+        pipBuildHook
+      ]
+      ++ lib.optionals (format == "wheel") [
+        wheelUnpackHook
+      ]
+      ++ lib.optionals (format == "egg") [
+        eggUnpackHook
+        eggBuildHook
+        eggInstallHook
+      ]
+      ++ lib.optionals (format != "other") [
+        pipInstallHook
+      ]
+      ++ lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [
+        # This is a test, however, it should be ran independent of the checkPhase and checkInputs
+        pythonImportsCheckHook
+      ]
+      ++ lib.optionals withDistOutput [
+        pythonOutputDistHook
+      ]
+      ++ nativeBuildInputs;
 
-        nativeBuildInputs = [
+      buildInputs = validatePythonMatches "buildInputs" (buildInputs ++ pythonPath);
+
+      propagatedBuildInputs = validatePythonMatches "propagatedBuildInputs" (
+        propagatedBuildInputs
+        ++ [
+          # we propagate python even for packages transformed with 'toPythonApplication'
+          # this pollutes the PATH but avoids rebuilds
+          # see https://github.com/NixOS/nixpkgs/issues/170887 for more context
           python
-          wrapPython
-          ensureNewerSourcesForZipFilesHook # move to wheel installer (pip) or builder (setuptools, ...)?
-          pythonRemoveTestsDirHook
         ]
-        ++ lib.optionals catchConflicts [
-          pythonCatchConflictsHook
-        ]
-        ++ lib.optionals removeBinBytecode [
-          pythonRemoveBinBytecodeHook
-        ]
-        ++ lib.optionals (lib.hasSuffix "zip" (attrs.src.name or "")) [
-          unzip
-        ]
-        ++ lib.optionals (format == "setuptools") [
-          setuptoolsBuildHook
-        ]
-        ++ lib.optionals (format == "pyproject") [
-          pipBuildHook
-        ]
-        ++ lib.optionals (format == "wheel") [
-          wheelUnpackHook
-        ]
-        ++ lib.optionals (format == "egg") [
-          eggUnpackHook
-          eggBuildHook
-          eggInstallHook
-        ]
-        ++ lib.optionals (format != "other") [
-          pipInstallHook
-        ]
-        ++ lib.optionals (stdenv.buildPlatform == stdenv.hostPlatform) [
-          # This is a test, however, it should be ran independent of the checkPhase and checkInputs
-          pythonImportsCheckHook
-        ]
-        ++ lib.optionals withDistOutput [
-          pythonOutputDistHook
-        ]
-        ++ nativeBuildInputs;
+      );
 
-        buildInputs = validatePythonMatches "buildInputs" (buildInputs ++ pythonPath);
+      inherit strictDeps;
 
-        propagatedBuildInputs = validatePythonMatches "propagatedBuildInputs" (
-          propagatedBuildInputs
-          ++ [
-            # we propagate python even for packages transformed with 'toPythonApplication'
-            # this pollutes the PATH but avoids rebuilds
-            # see https://github.com/NixOS/nixpkgs/issues/170887 for more context
-            python
-          ]
-        );
-
-        inherit strictDeps;
-
-        env = {
-          LANG = "${if python.stdenv.hostPlatform.isDarwin then "en_US" else "C"}.UTF-8";
-        }
-        // (attrs.env or { });
-
-        # Python packages don't have a checkPhase, only an installCheckPhase
-        doCheck = false;
-        doInstallCheck = attrs.doCheck or true;
-        nativeInstallCheckInputs = nativeCheckInputs;
-        installCheckInputs = checkInputs;
-
-        postFixup =
-          lib.optionalString (!dontWrapPythonPrograms) ''
-            wrapPythonPrograms
-          ''
-          + attrs.postFixup or "";
-
-        # Python packages built through cross-compilation are always for the host platform.
-        disallowedReferences = lib.optionals (python.stdenv.hostPlatform != python.stdenv.buildPlatform) [
-          python.pythonOnBuildForHost
-        ];
-
-        outputs = outputs ++ lib.optional withDistOutput "dist";
-
-        meta = {
-          # default to python's platforms
-          platforms = python.meta.platforms;
-          isBuildPythonPackage = python.meta.platforms;
-        }
-        // meta;
+      env = {
+        LANG = "${if python.stdenv.hostPlatform.isDarwin then "en_US" else "C"}.UTF-8";
       }
-      // lib.optionalAttrs (attrs ? checkPhase) {
-        # If given use the specified checkPhase, otherwise use the setup hook.
-        # Longer-term we should get rid of `checkPhase` and use `installCheckPhase`.
-        installCheckPhase = attrs.checkPhase;
-      }
-      // lib.optionalAttrs (disabledTestPaths != [ ]) {
-        disabledTestPaths = lib.escapeShellArgs disabledTestPaths;
-      }
-    )
-  );
+      // (attrs.env or { });
 
-  passthru.updateScript =
+      # Python packages don't have a checkPhase, only an installCheckPhase
+      doCheck = false;
+      doInstallCheck = attrs.doCheck or true;
+      nativeInstallCheckInputs = nativeCheckInputs;
+      installCheckInputs = checkInputs;
+
+      postFixup =
+        lib.optionalString (!dontWrapPythonPrograms) ''
+          wrapPythonPrograms
+        ''
+        + attrs.postFixup or "";
+
+      # Python packages built through cross-compilation are always for the host platform.
+      disallowedReferences = lib.optionals (python.stdenv.hostPlatform != python.stdenv.buildPlatform) [
+        python.pythonOnBuildForHost
+      ];
+
+      outputs = outputs ++ lib.optional withDistOutput "dist";
+
+      passthru = {
+        inherit
+          disabled
+          ;
+        updateScript =
+          let
+            filename = builtins.head (lib.splitString ":" finalAttrs.finalPackage.meta.position);
+          in
+          [
+            update-python-libraries
+            filename
+          ];
+      }
+      // passthru;
+
+      meta = {
+        # default to python's platforms
+        platforms = python.meta.platforms;
+        isBuildPythonPackage = python.meta.platforms;
+      }
+      // meta;
+    }
+    // lib.optionalAttrs (attrs ? checkPhase) {
+      # If given use the specified checkPhase, otherwise use the setup hook.
+      # Longer-term we should get rid of `checkPhase` and use `installCheckPhase`.
+      installCheckPhase = attrs.checkPhase;
+    }
+    // lib.optionalAttrs (disabledTestPaths != [ ]) {
+      disabledTestPaths = lib.escapeShellArgs disabledTestPaths;
+    };
+
+  transformDrv =
     let
-      filename = builtins.head (lib.splitString ":" self.meta.position);
+      # Workaround to make the `lib.extendDerivation`-based disabled functionality
+      # respect `<pkg>.overrideAttrs`
+      # It doesn't cover `<pkg>.<output>.overrideAttrs`.
+      disablePythonPackage =
+        drv:
+        lib.extendDerivation (
+          drv.disabled
+          -> throw "${lib.removePrefix namePrefix drv.name} not supported for interpreter ${python.executable}"
+        ) { } drv
+        // {
+          overrideAttrs = fdrv: disablePythonPackage (drv.overrideAttrs fdrv);
+        };
     in
-    attrs.passthru.updateScript or [
-      update-python-libraries
-      filename
-    ];
-in
-lib.extendDerivation (
-  disabled -> throw "${name} not supported for interpreter ${python.executable}"
-) passthru self
+    drv: disablePythonPackage (toPythonModule drv);
+}
diff --git a/pkgs/development/ocaml-modules/bos/default.nix b/pkgs/development/ocaml-modules/bos/default.nix
index 9cc68872f68a..491408108f5d 100644
--- a/pkgs/development/ocaml-modules/bos/default.nix
+++ b/pkgs/development/ocaml-modules/bos/default.nix
@@ -15,11 +15,16 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ocaml${ocaml.version}-bos";
-  version = "0.2.1";
+  version = if lib.versionAtLeast ocaml.version "4.14" then "0.3.0" else "0.2.1";
 
   src = fetchurl {
     url = "https://erratique.ch/software/bos/releases/bos-${finalAttrs.version}.tbz";
-    sha256 = "sha256-2NYueGsQ1pfgRXIFqO7eqifrzJDxhV8Y3xkMrC49jzc=";
+    hash =
+      {
+        "0.3.0" = "sha256-CJ82ntAJZ+kticxfzYSMVr2rXAJzfaTUg1UL9Wtaebw=";
+        "0.2.1" = "sha256-2NYueGsQ1pfgRXIFqO7eqifrzJDxhV8Y3xkMrC49jzc=";
+      }
+      ."${finalAttrs.version}";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/ocaml-modules/digestif/default.nix b/pkgs/development/ocaml-modules/digestif/default.nix
index f10a4bb70397..404fa325250d 100644
--- a/pkgs/development/ocaml-modules/digestif/default.nix
+++ b/pkgs/development/ocaml-modules/digestif/default.nix
@@ -5,19 +5,13 @@
   buildDunePackage,
   eqaf,
   alcotest,
-  astring,
-  bos,
   crowbar,
-  findlib,
-  fpath,
 }:
 
 buildDunePackage (finalAttrs: {
   pname = "digestif";
   version = "1.3.0";
 
-  minimalOCamlVersion = "4.08";
-
   src = fetchurl {
     url = "https://github.com/mirage/digestif/releases/download/v${finalAttrs.version}/digestif-${finalAttrs.version}.tbz";
     hash = "sha256-mmzcszJTnIf0cj/DvXNiayZ1p7EWH98P7TCRhs4Y9Cc=";
@@ -27,17 +21,10 @@ buildDunePackage (finalAttrs: {
 
   checkInputs = [
     alcotest
-    astring
-    bos
     crowbar
-    fpath
   ];
   doCheck = true;
 
-  postCheck = ''
-    ocaml -I ${findlib}/lib/ocaml/${ocaml.version}/site-lib/ test/test_runes.ml
-  '';
-
   meta = {
     description = "Simple hash algorithms in OCaml";
     homepage = "https://github.com/mirage/digestif";
diff --git a/pkgs/development/ocaml-modules/httpcats/default.nix b/pkgs/development/ocaml-modules/httpcats/default.nix
index 74b1578935d4..6c5b39077b17 100644
--- a/pkgs/development/ocaml-modules/httpcats/default.nix
+++ b/pkgs/development/ocaml-modules/httpcats/default.nix
@@ -1,4 +1,5 @@
 {
+  fetchpatch,
   fetchFromGitHub,
   buildDunePackage,
   lib,
@@ -28,6 +29,13 @@ buildDunePackage (finalAttrs: {
     hash = "sha256-I7u/n49WOnpc0EaagsjC4Ts/kz0Xj6YHZv6+QZKLrC4=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/robur-coop/httpcats/commit/d8787555d4831e0488780d42bd2c65de662d1d38.patch";
+      hash = "sha256-Mqam6Sxd2kkkHDm459u9uerifuHbvZUVy2khQffvvCE=";
+    })
+  ];
+
   propagatedBuildInputs = [
     h2
     h1
diff --git a/pkgs/development/ocaml-modules/lwt/default.nix b/pkgs/development/ocaml-modules/lwt/default.nix
index 754cbb3c5bff..065bb32e1f1f 100644
--- a/pkgs/development/ocaml-modules/lwt/default.nix
+++ b/pkgs/development/ocaml-modules/lwt/default.nix
@@ -7,7 +7,7 @@
   dune-configurator,
   ocplib-endian,
   ppxlib,
-  version ? if lib.versionAtLeast ppxlib.version "0.36" then "6.1.1" else "5.9.1",
+  version ? if lib.versionAtLeast ppxlib.version "0.36" then "6.1.2" else "5.9.1",
 }:
 
 buildDunePackage {
@@ -22,7 +22,7 @@ buildDunePackage {
       {
         "5.9.1" = "sha256-oPYLFugMTI3a+hmnwgUcoMgn5l88NP1Roq0agLhH/vI=";
         "5.9.2" = "sha256-pzowRN1wwaF2iMfMPE7RCtA2XjlaXC3xD0yznriVfu8=";
-        "6.1.1" = "sha256-EMlA+mh66bfVNqDcmuaW7GoEEu6xQhCRjZx7t7pHuGo=";
+        "6.1.2" = "sha256-9Uxo1ekB3VcvdR4FCVdVWzvPHuVwflYIdD/fWvg0/kc=";
       }
       ."${version}";
   };
diff --git a/pkgs/development/ocaml-modules/postgresql/default.nix b/pkgs/development/ocaml-modules/postgresql/default.nix
index 8c71a2321e3d..8b193e13ea90 100644
--- a/pkgs/development/ocaml-modules/postgresql/default.nix
+++ b/pkgs/development/ocaml-modules/postgresql/default.nix
@@ -25,7 +25,7 @@ buildDunePackage rec {
   meta = {
     description = "Bindings to the PostgreSQL library";
     license = lib.licenses.lgpl21Plus;
-    changelog = "https://raw.githubusercontent.com/mmottl/postgresql-ocaml/refs/tags/${version}/CHANGES.md";
+    changelog = "https://raw.githubusercontent.com/mmottl/postgresql-ocaml/refs/tags/${version}/CHANGELOG.md";
     maintainers = with lib.maintainers; [ bcc32 ];
     homepage = "https://mmottl.github.io/postgresql-ocaml";
   };
diff --git a/pkgs/development/ocaml-modules/smtml/default.nix b/pkgs/development/ocaml-modules/smtml/default.nix
index 69fba965db35..2530db31841f 100644
--- a/pkgs/development/ocaml-modules/smtml/default.nix
+++ b/pkgs/development/ocaml-modules/smtml/default.nix
@@ -21,6 +21,7 @@
   ocaml_intrinsics ? null,
   prelude,
   ppx_enumerate,
+  rresult,
   scfg,
   yojson,
   z3,
@@ -31,13 +32,13 @@
 
 buildDunePackage (finalAttrs: {
   pname = "smtml";
-  version = "0.25.0";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "formalsec";
     repo = "smtml";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dWZrN0hTxxqGC2queit91GDuw/x5fyRPwHbmKxkvc/w=";
+    hash = "sha256-7kshzfxWpOx2LyGOs/j/eaTB4b4ba4sp5n4yztGfFV4=";
   };
 
   minimalOCamlVersion = "4.14";
@@ -67,6 +68,7 @@ buildDunePackage (finalAttrs: {
     ocaml_intrinsics
     ppx_enumerate
     prelude
+    rresult
     scfg
     yojson
     z3
diff --git a/pkgs/development/ocaml-modules/yamlx/default.nix b/pkgs/development/ocaml-modules/yamlx/default.nix
index 152c879c8ac7..15eb9a8ef564 100644
--- a/pkgs/development/ocaml-modules/yamlx/default.nix
+++ b/pkgs/development/ocaml-modules/yamlx/default.nix
@@ -8,11 +8,11 @@
 
 buildDunePackage (finalAttrs: {
   pname = "yamlx";
-  version = "0.1.0";
+  version = "0.3.0";
 
   src = fetchurl {
     url = "https://github.com/mjambon/yamlx/releases/download/${finalAttrs.version}/yamlx-${finalAttrs.version}.tbz";
-    hash = "sha256-Ihar37R1dUFMXSgNGEJu5z6ysFMcrg1Hd74hNLletwE=";
+    hash = "sha256-9pGp4XSCjMEwsUqHtwoyLBKTUdPjmYccqaU3dLkgVzg=";
   };
 
   propagatedBuildInputs = [ ppx_deriving ];
diff --git a/pkgs/development/perl-modules/Plack-xsendfile-disable-by-default-CVE-2026-7381.patch b/pkgs/development/perl-modules/Plack-xsendfile-disable-by-default-CVE-2026-7381.patch
new file mode 100644
index 000000000000..32244e52ac8c
--- /dev/null
+++ b/pkgs/development/perl-modules/Plack-xsendfile-disable-by-default-CVE-2026-7381.patch
@@ -0,0 +1,31 @@
+diff --git a/lib/Plack/Middleware/XSendfile.pm b/lib/Plack/Middleware/XSendfile.pm
+index f2cd859..f96ccb5 100644
+--- a/lib/Plack/Middleware/XSendfile.pm
++++ b/lib/Plack/Middleware/XSendfile.pm
+@@ -10,7 +10,11 @@ use Plack::Util::Accessor qw( variation );
+ 
+ sub new {
+     my $class = shift;
+-    Carp::carp("Plack::Middleware::XSendfile is deprecated and will be removed in a future release");
++    unless (($ENV{PLACK_ENABLE_INSECURE_XSENDFILE} // '') eq '1') {
++        Carp::croak(
++          "CVE-2026-7381: Plack::Middleware::XSendfile is disabled by default. Set PLACK_ENABLE_INSECURE_XSENDFILE=1 to enable"
++        );
++    }
+     $class->SUPER::new(@_);
+ }
+ 
+diff --git a/t/Plack-Middleware/xsendfile.t b/t/Plack-Middleware/xsendfile.t
+index f1a02fa..248815e 100644
+--- a/t/Plack-Middleware/xsendfile.t
++++ b/t/Plack-Middleware/xsendfile.t
+@@ -6,6 +6,9 @@ use Plack::Builder;
+ use Plack::Test;
+ use Cwd;
+ 
++# CVE-2026-7381: Insecure feature disabled by default, but enable for tests
++$ENV{PLACK_ENABLE_INSECURE_XSENDFILE} = 1;
++
+ sub is_wo_case($$;$) {
+     is lc $_[0], lc $_[1], $_[2];
+ }
diff --git a/pkgs/development/python-modules/aiohttp-asgi-connector/default.nix b/pkgs/development/python-modules/aiohttp-asgi-connector/default.nix
index e5e23d75d69d..e6ebf80bfbe5 100644
--- a/pkgs/development/python-modules/aiohttp-asgi-connector/default.nix
+++ b/pkgs/development/python-modules/aiohttp-asgi-connector/default.nix
@@ -38,7 +38,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "An AIOHTTP ClientSession connector for directly interacting with ASGI applications";
     homepage = "https://github.com/thearchitector/aiohttp-asgi-connector";
-    changelog = "https://github.com/thearchitector/aiohttp-asgi-connector/releases/tag/v${finalAttrs.src.tag}";
+    changelog = "https://github.com/thearchitector/aiohttp-asgi-connector/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/aiopegelonline/default.nix b/pkgs/development/python-modules/aiopegelonline/default.nix
index 7d9fe6f35ca4..59bc8ab73f18 100644
--- a/pkgs/development/python-modules/aiopegelonline/default.nix
+++ b/pkgs/development/python-modules/aiopegelonline/default.nix
@@ -41,7 +41,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Library to retrieve data from PEGELONLINE";
     homepage = "https://github.com/mib1185/aiopegelonline";
-    changelog = "https://github.com/mib1185/aiopegelonline/releases/tag/v${finalAttrs.src.tag}";
+    changelog = "https://github.com/mib1185/aiopegelonline/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/aioshelly/default.nix b/pkgs/development/python-modules/aioshelly/default.nix
index c928da236af1..e98e68d5102f 100644
--- a/pkgs/development/python-modules/aioshelly/default.nix
+++ b/pkgs/development/python-modules/aioshelly/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "aioshelly";
-  version = "13.23.1";
+  version = "13.24.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = "aioshelly";
     tag = version;
-    hash = "sha256-vAYhOBfwDKWO0K4pHVf3qqpXTztb5Qzn8TEzk6ecbw0=";
+    hash = "sha256-yb6oZlrB3MBafKoga9vRrcixXlZeknVRsMztX4hV3PA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/aiovlc/default.nix b/pkgs/development/python-modules/aiovlc/default.nix
index 0996fc96e86e..87802bbc7856 100644
--- a/pkgs/development/python-modules/aiovlc/default.nix
+++ b/pkgs/development/python-modules/aiovlc/default.nix
@@ -41,7 +41,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Python module to control VLC";
     homepage = "https://github.com/MartinHjelmare/aiovlc";
-    changelog = "https://github.com/MartinHjelmare/aiovlc/blob/v${finalAttrs.src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/MartinHjelmare/aiovlc/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/allure-python-commons-test/default.nix b/pkgs/development/python-modules/allure-python-commons-test/default.nix
index 4b5424b6fb1f..a816e4657ce6 100644
--- a/pkgs/development/python-modules/allure-python-commons-test/default.nix
+++ b/pkgs/development/python-modules/allure-python-commons-test/default.nix
@@ -12,13 +12,13 @@
 
 buildPythonPackage rec {
   pname = "allure-python-commons-test";
-  version = "2.15.3";
+  version = "2.16.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "allure_python_commons_test";
     inherit version;
-    hash = "sha256-eRjjsxiXm/7nMyaJS5pXhpNmrjOhnd1o7+F9ZwGzI/I=";
+    hash = "sha256-otfGxWNnbMUGuQcqsroOOfiqhCQqe25c39Ur57ek2og=";
   };
 
   build-system = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/apprise/default.nix b/pkgs/development/python-modules/apprise/default.nix
index 2816e92cb6cf..ea9cd651a335 100644
--- a/pkgs/development/python-modules/apprise/default.nix
+++ b/pkgs/development/python-modules/apprise/default.nix
@@ -23,12 +23,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "apprise";
-  version = "1.9.9";
+  version = "1.10.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-/WIsDfFr3HntOFU5c1VzSIyv4kBdJXR+h+69awmyYBI=";
+    hash = "sha256-t2jzLZnkXtX0w+7x9nkD6APJf5e6YaUxpdCkXUDfkKg=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
diff --git a/pkgs/development/python-modules/asgineer/default.nix b/pkgs/development/python-modules/asgineer/default.nix
index 30f1b77fbbeb..676ebb921f71 100644
--- a/pkgs/development/python-modules/asgineer/default.nix
+++ b/pkgs/development/python-modules/asgineer/default.nix
@@ -31,7 +31,7 @@ buildPythonPackage rec {
   meta = {
     description = "Really thin ASGI web framework";
     homepage = "https://asgineer.readthedocs.io";
-    changelog = "https://github.com/almarklein/asgineer/releases/tag/v${src.tag}";
+    changelog = "https://github.com/almarklein/asgineer/releases/tag/${src.tag}";
     license = lib.licenses.bsd2;
     maintainers = with lib.maintainers; [ matthiasbeyer ];
   };
diff --git a/pkgs/development/python-modules/asyncio-dgram/default.nix b/pkgs/development/python-modules/asyncio-dgram/default.nix
index eb0ae2f6528d..e36298ef4e29 100644
--- a/pkgs/development/python-modules/asyncio-dgram/default.nix
+++ b/pkgs/development/python-modules/asyncio-dgram/default.nix
@@ -41,7 +41,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Python support for higher level Datagram";
     homepage = "https://github.com/jsbronder/asyncio-dgram";
-    changelog = "https://github.com/jsbronder/asyncio-dgram/blob/v${finalAttrs.src.tag}/ChangeLog";
+    changelog = "https://github.com/jsbronder/asyncio-dgram/blob/${finalAttrs.src.tag}/ChangeLog";
     license = with lib.licenses; [ mit ];
     maintainers = with lib.maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/bdffont/default.nix b/pkgs/development/python-modules/bdffont/default.nix
index 4daa5461fd77..7aec8f8d36c9 100644
--- a/pkgs/development/python-modules/bdffont/default.nix
+++ b/pkgs/development/python-modules/bdffont/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "bdffont";
-  version = "0.0.35";
+  version = "0.0.36";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TakWolf";
     repo = "bdffont";
     tag = finalAttrs.version;
-    hash = "sha256-a93l7iX2/Htigs36zCv1x8SAGzycGU2y/stN0j794fw=";
+    hash = "sha256-PCx1uMjCa5d8odDGRi4BRaf1E1AP0oZUv0QYr24E6Yo=";
   };
 
   build-system = [ uv-build ];
diff --git a/pkgs/development/python-modules/censys/default.nix b/pkgs/development/python-modules/censys/default.nix
index 558da207c50d..dcd92647d0fa 100644
--- a/pkgs/development/python-modules/censys/default.nix
+++ b/pkgs/development/python-modules/censys/default.nix
@@ -59,7 +59,7 @@ buildPythonPackage rec {
   meta = {
     description = "Python API wrapper for the Censys Search Engine (censys.io)";
     homepage = "https://github.com/censys/censys-python";
-    changelog = "https://github.com/censys/censys-python/releases/tag/v${src.tag}";
+    changelog = "https://github.com/censys/censys-python/releases/tag/${src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "censys";
diff --git a/pkgs/development/python-modules/cobble/default.nix b/pkgs/development/python-modules/cobble/default.nix
index 13fe8f3235d6..de4ac19ddb36 100644
--- a/pkgs/development/python-modules/cobble/default.nix
+++ b/pkgs/development/python-modules/cobble/default.nix
@@ -40,7 +40,7 @@ buildPythonPackage rec {
     "test_sub_sub_classes_are_included_in_abc"
   ];
 
-  passthru.updateScripts = gitUpdater { };
+  passthru.updateScript = gitUpdater { };
 
   meta = {
     description = "Create Python data objects";
diff --git a/pkgs/development/python-modules/container-inspector/default.nix b/pkgs/development/python-modules/container-inspector/default.nix
index da2a8d11f986..900b61320bc5 100644
--- a/pkgs/development/python-modules/container-inspector/default.nix
+++ b/pkgs/development/python-modules/container-inspector/default.nix
@@ -40,7 +40,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Suite of analysis utilities and command line tools for container images";
     homepage = "https://github.com/nexB/container-inspector";
-    changelog = "https://github.com/nexB/container-inspector/releases/tag/v${finalAttrs.src.tag}";
+    changelog = "https://github.com/nexB/container-inspector/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/crewai/default.nix b/pkgs/development/python-modules/crewai/default.nix
index 307440f10bc7..6fc1b8d17010 100644
--- a/pkgs/development/python-modules/crewai/default.nix
+++ b/pkgs/development/python-modules/crewai/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  nix-update-script,
 
   # build-system
   hatchling,
@@ -534,6 +535,9 @@ buildPythonPackage (finalAttrs: {
     "test_azure_agent_with_native_tool_calling"
     "test_azure_agent_kickoff_with_tools_mocked"
     "test_azure_streaming_emits_tool_call_events"
+
+    # Tests time dependent
+    "test_older_than"
   ];
 
   nativeCheckInputs = [
@@ -556,6 +560,13 @@ buildPythonPackage (finalAttrs: {
     "--override-ini=addopts="
   ];
 
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "^([0-9]+\\.[0-9]+\\.[0-9]+)$"
+    ];
+  };
+
   meta = {
     description = "Framework for orchestrating role-playing, autonomous AI agents";
     homepage = "https://github.com/crewAIInc/crewAI";
diff --git a/pkgs/development/python-modules/cssutils/default.nix b/pkgs/development/python-modules/cssutils/default.nix
index 9d38d4398146..2c5b04fd2c12 100644
--- a/pkgs/development/python-modules/cssutils/default.nix
+++ b/pkgs/development/python-modules/cssutils/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "cssutils";
-  version = "2.14.0";
+  version = "2.15.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jaraco";
     repo = "cssutils";
     tag = "v${version}";
-    hash = "sha256-kuqHfwJn+GT1VIC2PWu5Oj1X6SGn/bi2QPN8kfposVs=";
+    hash = "sha256-K9jbuX7AueSB3AB7PAVjpQhzb3Umn9OoHaL4RrMzKEs=";
   };
 
   postPatch = ''
@@ -54,7 +54,7 @@ buildPythonPackage rec {
   meta = {
     description = "CSS Cascading Style Sheets library for Python";
     homepage = "https://github.com/jaraco/cssutils";
-    changelog = "https://github.com/jaraco/cssutils/blob/${src.rev}/NEWS.rst";
+    changelog = "https://github.com/jaraco/cssutils/blob/${src.tag}/NEWS.rst";
     license = lib.licenses.lgpl3Plus;
     maintainers = with lib.maintainers; [ dotlambda ];
   };
diff --git a/pkgs/development/python-modules/curio/default.nix b/pkgs/development/python-modules/curio/default.nix
index e6f636dc8209..b4549e50e766 100644
--- a/pkgs/development/python-modules/curio/default.nix
+++ b/pkgs/development/python-modules/curio/default.nix
@@ -53,7 +53,7 @@ buildPythonPackage rec {
   meta = {
     description = "Library for performing concurrent I/O with coroutines in Python";
     homepage = "https://github.com/dabeaz/curio";
-    changelog = "https://github.com/dabeaz/curio/raw/${version}/CHANGES";
+    changelog = "https://github.com/dabeaz/curio/raw/${src.rev}/CHANGES";
     license = lib.licenses.bsd3;
     maintainers = [ lib.maintainers.pbsds ];
   };
diff --git a/pkgs/development/python-modules/cwl-upgrader/default.nix b/pkgs/development/python-modules/cwl-upgrader/default.nix
index bf378e69b529..9ee9927b26af 100644
--- a/pkgs/development/python-modules/cwl-upgrader/default.nix
+++ b/pkgs/development/python-modules/cwl-upgrader/default.nix
@@ -46,7 +46,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Library to upgrade CWL syntax to a newer version";
     homepage = "https://github.com/common-workflow-language/cwl-upgrader";
-    changelog = "https://github.com/common-workflow-language/cwl-upgrader/releases/tag/v${finalAttrs.src.tag}";
+    changelog = "https://github.com/common-workflow-language/cwl-upgrader/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "cwl-upgrader";
diff --git a/pkgs/development/python-modules/cwl-utils/default.nix b/pkgs/development/python-modules/cwl-utils/default.nix
index e91507d1815b..2e57faa20b74 100644
--- a/pkgs/development/python-modules/cwl-utils/default.nix
+++ b/pkgs/development/python-modules/cwl-utils/default.nix
@@ -65,7 +65,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Utilities for CWL";
     homepage = "https://github.com/common-workflow-language/cwl-utils";
-    changelog = "https://github.com/common-workflow-language/cwl-utils/releases/tag/v${finalAttrs.src.tag}";
+    changelog = "https://github.com/common-workflow-language/cwl-utils/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/databricks-sdk/default.nix b/pkgs/development/python-modules/databricks-sdk/default.nix
index d65cd09759bc..4aa1d26ad9de 100644
--- a/pkgs/development/python-modules/databricks-sdk/default.nix
+++ b/pkgs/development/python-modules/databricks-sdk/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "databricks-sdk";
-  version = "0.102.0";
+  version = "0.105.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "databricks";
     repo = "databricks-sdk-py";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WHy+JTdjgq7D+Iy7OTx5V8zLBpY4SNztL3UkPM9gIns=";
+    hash = "sha256-Xy5Yy5ZCp+9y2DqLMpzdO0KeT3KdRIMkogvou4eiyEI=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/datashader/default.nix b/pkgs/development/python-modules/datashader/default.nix
index 2a83a163c223..8c9c845391d3 100644
--- a/pkgs/development/python-modules/datashader/default.nix
+++ b/pkgs/development/python-modules/datashader/default.nix
@@ -71,7 +71,7 @@ buildPythonPackage rec {
     description = "Data visualization toolchain based on aggregating into a grid";
     mainProgram = "datashader";
     homepage = "https://datashader.org";
-    changelog = "https://github.com/holoviz/datashader/blob/${src.tag}/CHANGELOG.rst";
+    changelog = "https://github.com/holoviz/datashader/blob/${src.tag}/CHANGELOG.md";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [
       nickcao
diff --git a/pkgs/development/python-modules/django-modeltranslation/default.nix b/pkgs/development/python-modules/django-modeltranslation/default.nix
index d55eca8dede7..d41c9daaa84f 100644
--- a/pkgs/development/python-modules/django-modeltranslation/default.nix
+++ b/pkgs/development/python-modules/django-modeltranslation/default.nix
@@ -44,7 +44,7 @@ buildPythonPackage rec {
   meta = {
     description = "Translates Django models using a registration approach";
     homepage = "https://github.com/deschler/django-modeltranslation";
-    changelog = "https://github.com/deschler/django-modeltranslation/blob/v${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/deschler/django-modeltranslation/blob/${src.tag}/CHANGELOG.md";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ augustebaum ];
   };
diff --git a/pkgs/development/python-modules/dnsight/default.nix b/pkgs/development/python-modules/dnsight/default.nix
index 0da61c71b7d6..f7773a9a68d9 100644
--- a/pkgs/development/python-modules/dnsight/default.nix
+++ b/pkgs/development/python-modules/dnsight/default.nix
@@ -85,7 +85,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "SDK and CLI tool for DNS, email and web security hygiene";
     homepage = "https://github.com/dnsight/dnsight";
-    changelog = "https://github.com/dnsight/dnsight/releases/tag/v${finalAttrs.src.tag}";
+    changelog = "https://github.com/dnsight/dnsight/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "dnsight";
diff --git a/pkgs/development/python-modules/dotwiz/default.nix b/pkgs/development/python-modules/dotwiz/default.nix
index 03c135cde365..f48073117402 100644
--- a/pkgs/development/python-modules/dotwiz/default.nix
+++ b/pkgs/development/python-modules/dotwiz/default.nix
@@ -32,7 +32,7 @@ buildPythonPackage rec {
   meta = {
     description = "Dict subclass that supports dot access notation";
     homepage = "https://github.com/rnag/dotwiz";
-    changelog = "https://github.com/rnag/dotwiz/blob/v${src.tag}/HISTORY.rst";
+    changelog = "https://github.com/rnag/dotwiz/blob/${src.tag}/HISTORY.rst";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/emoji-country-flag/default.nix b/pkgs/development/python-modules/emoji-country-flag/default.nix
index 074a3a64c0c3..36161f8d16bc 100644
--- a/pkgs/development/python-modules/emoji-country-flag/default.nix
+++ b/pkgs/development/python-modules/emoji-country-flag/default.nix
@@ -35,7 +35,7 @@ buildPythonPackage rec {
   meta = {
     description = "Flag emoji from country codes for Python";
     homepage = "https://github.com/cvzi/flag";
-    changelog = "https://github.com/cvzi/flag/releases/tag/v${src.tag}";
+    changelog = "https://github.com/cvzi/flag/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       skohtv
diff --git a/pkgs/development/python-modules/fastmcp/default.nix b/pkgs/development/python-modules/fastmcp/default.nix
index 18897706e7a0..5a82e61c88cf 100644
--- a/pkgs/development/python-modules/fastmcp/default.nix
+++ b/pkgs/development/python-modules/fastmcp/default.nix
@@ -12,23 +12,32 @@
   # dependencies
   anthropic,
   authlib,
+  azure-identity,
   cyclopts,
   exceptiongroup,
   httpx,
   jsonref,
   jsonschema-path,
   mcp,
+  fakeredis,
+  google-genai,
   openai,
   openapi-pydantic,
+  opentelemetry-api,
   packaging,
   platformdirs,
   py-key-value-aio,
   pydantic,
+  pydantic-monty,
   pydocket,
+  pyjwt,
   pyperclip,
   python-dotenv,
+  pyyaml,
   rich,
+  uncalled-for,
   uvicorn,
+  watchfiles,
   websockets,
 
   # tests
@@ -37,6 +46,7 @@
   fastapi,
   inline-snapshot,
   lupa,
+  opentelemetry-sdk,
   psutil,
   pytest-asyncio,
   pytest-httpx,
@@ -45,14 +55,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "fastmcp";
-  version = "2.14.5";
+  version = "3.2.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jlowin";
     repo = "fastmcp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-j3aUvAKm0rW5X/l1VXoSBc5fCjSLxnyznwzj1D3E7Ck=";
+    hash = "sha256-YfFAJvfKLOgfGFWyQmR4FGHrRc066Y0mAYhXJqJ9vyw=";
   };
 
   build-system = [
@@ -61,6 +71,7 @@ buildPythonPackage (finalAttrs: {
   ];
 
   pythonRelaxDeps = [
+    "py-key-value-aio"
     "pydocket"
   ];
   dependencies = [
@@ -72,25 +83,39 @@ buildPythonPackage (finalAttrs: {
     jsonschema-path
     mcp
     openapi-pydantic
+    opentelemetry-api
     packaging
     platformdirs
     py-key-value-aio
     pydantic
-    pydocket
     pyperclip
     python-dotenv
+    pyyaml
     rich
+    uncalled-for
     uvicorn
+    watchfiles
     websockets
   ]
-  ++ py-key-value-aio.optional-dependencies.disk
+  ++ py-key-value-aio.optional-dependencies.filetree
   ++ py-key-value-aio.optional-dependencies.keyring
   ++ py-key-value-aio.optional-dependencies.memory
   ++ pydantic.optional-dependencies.email;
 
   optional-dependencies = {
     anthropic = [ anthropic ];
+    azure = [
+      azure-identity
+      pyjwt
+    ];
+    code-mode = [ pydantic-monty ];
+    gemini = [ google-genai ];
     openai = [ openai ];
+    tasks = [
+      pydocket
+      fakeredis
+    ]
+    ++ fakeredis.optional-dependencies.lua;
   };
 
   pythonImportsCheck = [ "fastmcp" ];
@@ -101,31 +126,21 @@ buildPythonPackage (finalAttrs: {
     fastapi
     inline-snapshot
     lupa
+    opentelemetry-sdk
     psutil
     pytest-asyncio
     pytest-httpx
     pytestCheckHook
     writableTmpDirAsHomeHook
   ]
-  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies
+  ++ finalAttrs.passthru.optional-dependencies.anthropic
+  ++ finalAttrs.passthru.optional-dependencies.azure
+  ++ finalAttrs.passthru.optional-dependencies.code-mode
+  ++ finalAttrs.passthru.optional-dependencies.gemini
+  ++ finalAttrs.passthru.optional-dependencies.openai
   ++ inline-snapshot.optional-dependencies.dirty-equals;
 
   disabledTests = [
-    # redis.exceptions.ResponseError: unknown command `evalsha`, with args beginning with:
-    "test_get_prompt_as_task_returns_prompt_task"
-    "test_prompt_task_server_generated_id"
-
-    "test_logging_middleware_with_payloads"
-    "test_structured_logging_middleware_produces_json"
-
-    # AssertionError: assert 'INFO' == 'DEBUG'
-    "test_temporary_settings"
-
-    # mcp.shared.exceptions.McpError: Connection closed
-    "test_log_file_captures_stderr_output_with_path"
-    "test_log_file_captures_stderr_output_with_textio"
-    "test_log_file_none_uses_default_behavior"
-
     # RuntimeError: Client failed to connect: Connection closed
     "test_keep_alive_maintains_session_across_multiple_calls"
     "test_keep_alive_false_starts_new_session_across_multiple_calls"
@@ -148,32 +163,55 @@ buildPythonPackage (finalAttrs: {
     "test_timeout"
     "test_timeout_tool_call_overrides_client_timeout_even_if_lower"
 
-    # assert 0 == 2
+    # Requires prefab-ui (optional dependency)
+    "test_auto_registers_renderer_resource"
+    "test_equivalent_to_app_true"
+
+    # Requires pydocket (tasks optional dependency, not in test inputs)
+    "test_mounted_server_does_not_have_docket"
+    "test_get_tasks_returns_task_eligible_tools"
+    "test_task_teardown_does_not_hang"
+    "test_background_task_can_read_snapshotted_request_headers"
+    "test_background_task_current_http_dependencies_restore_headers"
+    "test_task_execution_auto_populated_for_task_enabled_tool"
+    "test_function_tool_task_config_still_works"
+    "test_async_partial_with_task_true_does_not_raise"
+    "test_sync_partial_with_task_true_raises"
+    "test_is_docket_available"
+    "test_require_docket_passes_when_installed"
+
+    # Shared dependency caching differs in sandbox
+    "TestSharedDependencies"
+
+    # AssertionError: assert 'INFO' == 'DEBUG'
+    "test_temporary_settings"
+
+    # Subprocess-based multi-client tests fail in sandbox
     "test_multi_client"
+    "test_multi_server"
+    "test_single_server_config_include_tags_filtering"
+    "test_server_starts_without_auth"
     "test_canonical_multi_client_with_transforms"
-
-    # AssertionError: assert {'annotations...object'}, ...} == {'annotations...sers']}}, ...}
-    "test_list_tools"
-
-    # AssertionError: assert len(caplog.records) == 1
-    "test_log"
-
-    #  assert [TextContent(...e, meta=None)] == [TextContent(...e, meta=None)]
-    "test_read_resource_tool_works"
-
-    # fastmcp.exceptions.ToolError: Unknown tool
-    "test_multi_client_with_logging"
-    "test_multi_client_with_elicitation"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # RuntimeError: Server failed to start after 10 attempts
     "test_unauthorized_access"
-
-    # Failed: DID NOT RAISE <class 'fastmcp.exceptions.ToolError'>
     "test_stateless_proxy"
   ];
 
-  disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
+  disabledTestPaths = [
+    # Requires prefab-ui (optional dependency)
+    "tests/apps"
+    "tests/test_apps_prefab.py"
+    "tests/test_fastmcp_app.py"
+    # Subprocess crash recovery tests are flaky in sandbox
+    "tests/client/test_stdio.py"
+    # Requires pydocket/fakeredis (tasks optional dependency, not in test inputs)
+    "tests/server/tasks"
+    "tests/server/test_server_docket.py"
+    "tests/client/tasks"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # RuntimeError: Server failed to start after 10 attempts
     "tests/client/auth/test_oauth_client.py"
     "tests/client/test_sse.py"
diff --git a/pkgs/development/python-modules/fastremap/default.nix b/pkgs/development/python-modules/fastremap/default.nix
index 04aeb227fa5e..0849db7dd601 100644
--- a/pkgs/development/python-modules/fastremap/default.nix
+++ b/pkgs/development/python-modules/fastremap/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "fastremap";
-  version = "1.18.1";
+  version = "1.19.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "seung-lab";
     repo = "fastremap";
     tag = version;
-    hash = "sha256-nVnOdxDSVM7Qe/peALgV035OknOUm0B1dzpTIq3HEMs=";
+    hash = "sha256-fPDgCpCJrMomxr0dicM9NBqzH4s+/Ux37hTsnsGts2g=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/freebox-api/default.nix b/pkgs/development/python-modules/freebox-api/default.nix
index 01cc6cefbc04..b93de984153c 100644
--- a/pkgs/development/python-modules/freebox-api/default.nix
+++ b/pkgs/development/python-modules/freebox-api/default.nix
@@ -36,7 +36,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Python module to interact with the Freebox OS API";
     homepage = "https://github.com/hacf-fr/freebox-api";
-    changelog = "https://github.com/hacf-fr/freebox-api/releases/tag/v${finalAttrs.src.tag}";
+    changelog = "https://github.com/hacf-fr/freebox-api/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "freebox_api";
diff --git a/pkgs/development/python-modules/funk/default.nix b/pkgs/development/python-modules/funk/default.nix
index c97f432617ec..b3637b40dde8 100644
--- a/pkgs/development/python-modules/funk/default.nix
+++ b/pkgs/development/python-modules/funk/default.nix
@@ -28,7 +28,7 @@ buildPythonPackage rec {
   # Disabling tests, they rely on Nose which is outdated and not supported
   doCheck = false;
 
-  passthru.updateScripts = gitUpdater { };
+  passthru.updateScript = gitUpdater { };
 
   meta = {
     description = "Mocking framework for Python, influenced by JMock";
diff --git a/pkgs/development/python-modules/google-cloud-asset/default.nix b/pkgs/development/python-modules/google-cloud-asset/default.nix
index 363463ff49d9..f1be9e6ea0b4 100644
--- a/pkgs/development/python-modules/google-cloud-asset/default.nix
+++ b/pkgs/development/python-modules/google-cloud-asset/default.nix
@@ -83,7 +83,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Python Client for Google Cloud Asset API";
     homepage = "https://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-asset";
-    changelog = "https://github.com/googleapis/google-cloud-python/blob/google-cloud-asset-${finalAttrs.src.tag}/packages/google-cloud-asset/CHANGELOG.md";
+    changelog = "https://github.com/googleapis/google-cloud-python/blob/${finalAttrs.src.tag}/packages/google-cloud-asset/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = [ lib.maintainers.sarahec ];
   };
diff --git a/pkgs/development/python-modules/google-cloud-datacatalog/default.nix b/pkgs/development/python-modules/google-cloud-datacatalog/default.nix
index 953254199a85..f5b745956ce1 100644
--- a/pkgs/development/python-modules/google-cloud-datacatalog/default.nix
+++ b/pkgs/development/python-modules/google-cloud-datacatalog/default.nix
@@ -65,7 +65,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Google Cloud Data Catalog API API client library";
     homepage = "https://github.com/googleapis/google-cloud-python/tree/main/packages/google-cloud-datacatalog";
-    changelog = "https://github.com/googleapis/google-cloud-python/blob/google-cloud-datacatalog-${finalAttrs.src.tag}/packages/google-cloud-datacatalog/CHANGELOG.md";
+    changelog = "https://github.com/googleapis/google-cloud-python/blob/${finalAttrs.src.tag}/packages/google-cloud-datacatalog/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = [ lib.maintainers.sarahec ];
   };
diff --git a/pkgs/development/python-modules/googleapis-common-protos/default.nix b/pkgs/development/python-modules/googleapis-common-protos/default.nix
index 30d7dba4512a..84a518517da1 100644
--- a/pkgs/development/python-modules/googleapis-common-protos/default.nix
+++ b/pkgs/development/python-modules/googleapis-common-protos/default.nix
@@ -8,7 +8,7 @@
   nix-update-script,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "googleapis-common-protos";
   version = "1.73.0";
   pyproject = true;
@@ -16,11 +16,11 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "google-cloud-python";
-    tag = "googleapis-common-protos-v${version}";
+    tag = "googleapis-common-protos-v${finalAttrs.version}";
     hash = "sha256-LrsmLySAOTsECwxa1NaFuyZAjar0Jbg9DHNi6uqYaxk=";
   };
 
-  sourceRoot = "${src.name}/packages/googleapis-common-protos";
+  sourceRoot = "${finalAttrs.src.name}/packages/googleapis-common-protos";
 
   build-system = [ setuptools ];
 
@@ -53,9 +53,9 @@ buildPythonPackage rec {
 
   meta = {
     description = "Common protobufs used in Google APIs";
-    homepage = "https://github.com/googleapis/python-api-common-protos";
-    changelog = "https://github.com/googleapis/python-api-common-protos/releases/tag/${src.tag}";
+    homepage = "https://github.com/googleapis/google-cloud-python/tree/main/packages/googleapis-common-protos";
+    changelog = "https://github.com/googleapis/google-cloud-python/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = [ lib.maintainers.sarahec ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/greenback/default.nix b/pkgs/development/python-modules/greenback/default.nix
index 3cbf47a7a5a1..b287188af03f 100644
--- a/pkgs/development/python-modules/greenback/default.nix
+++ b/pkgs/development/python-modules/greenback/default.nix
@@ -40,7 +40,7 @@ buildPythonPackage rec {
   meta = {
     description = "Use anyio and asyncio from synchronous code";
     homepage = "https://github.com/oremanj/greenback";
-    changelog = "https://github.com/oremanj/greenback/blob/${src.rev}/CHANGES.rst";
+    changelog = "https://github.com/oremanj/greenback/blob/${src.tag}/docs/source/history.rst";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ taranarmo ];
   };
diff --git a/pkgs/development/python-modules/heretic-llm/default.nix b/pkgs/development/python-modules/heretic-llm/default.nix
index 749d46b9fad9..fb7a05c08439 100644
--- a/pkgs/development/python-modules/heretic-llm/default.nix
+++ b/pkgs/development/python-modules/heretic-llm/default.nix
@@ -80,7 +80,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Tool to remove censorship removal for language models";
     homepage = "https://github.com/p-e-w/heretic";
-    changelog = "https://github.com/p-e-w/heretic/releases/tag/v${finalAttrs.src.tag}";
+    changelog = "https://github.com/p-e-w/heretic/releases/tag/${finalAttrs.src.tag}";
     license = with lib.licenses; [
       agpl3Only
       agpl3Plus
diff --git a/pkgs/development/python-modules/hier-config/default.nix b/pkgs/development/python-modules/hier-config/default.nix
index 4d8c8a24e7ac..681c8a86df1e 100644
--- a/pkgs/development/python-modules/hier-config/default.nix
+++ b/pkgs/development/python-modules/hier-config/default.nix
@@ -34,7 +34,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Module to handle hierarchical configurations";
     homepage = "https://github.com/netdevops/hier_config";
-    changelog = "https://github.com/netdevops/hier_config/releases/tag/v${finalAttrs.src.tag}";
+    changelog = "https://github.com/netdevops/hier_config/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/iaqualink/default.nix b/pkgs/development/python-modules/iaqualink/default.nix
index 519712568574..259bdfcb097e 100644
--- a/pkgs/development/python-modules/iaqualink/default.nix
+++ b/pkgs/development/python-modules/iaqualink/default.nix
@@ -43,7 +43,7 @@ buildPythonPackage rec {
   meta = {
     description = "Python library for Jandy iAqualink";
     homepage = "https://github.com/flz/iaqualink-py";
-    changelog = "https://github.com/flz/iaqualink-py/releases/tag/v${src.tag}";
+    changelog = "https://github.com/flz/iaqualink-py/releases/tag/${src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/ibis-framework/default.nix b/pkgs/development/python-modules/ibis-framework/default.nix
index 8f499225e418..70d05e492e23 100644
--- a/pkgs/development/python-modules/ibis-framework/default.nix
+++ b/pkgs/development/python-modules/ibis-framework/default.nix
@@ -448,7 +448,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Productivity-centric Python Big Data Framework";
     homepage = "https://github.com/ibis-project/ibis";
-    changelog = "https://github.com/ibis-project/ibis/blob/${finalAttrs.src.tag}/docs/release_notes.md";
+    changelog = "https://github.com/ibis-project/ibis/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       cpcloud
diff --git a/pkgs/development/python-modules/irisclient/default.nix b/pkgs/development/python-modules/irisclient/default.nix
index d3250cdb1aa6..5d463edcc8b6 100644
--- a/pkgs/development/python-modules/irisclient/default.nix
+++ b/pkgs/development/python-modules/irisclient/default.nix
@@ -35,7 +35,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "Python client for Iris REST api";
-    changelog = "https://github.com/houqp/iris-python-client/blob/v${src.tag}/HISTORY.rst";
+    changelog = "https://github.com/houqp/iris-python-client/blob/${src.tag}/HISTORY.rst";
     homepage = "https://github.com/houqp/iris-python-client";
     license = lib.licenses.bsd2;
     maintainers = with lib.maintainers; [ onny ];
diff --git a/pkgs/development/python-modules/juliandate/default.nix b/pkgs/development/python-modules/juliandate/default.nix
index 68032d721d2a..667bbc231a04 100644
--- a/pkgs/development/python-modules/juliandate/default.nix
+++ b/pkgs/development/python-modules/juliandate/default.nix
@@ -27,7 +27,7 @@ buildPythonPackage rec {
   meta = {
     description = "Conversions between Julian Dates and Julian/Gregorian calendar dates";
     homepage = "https://github.com/seanredmond/juliandate";
-    changelog = "https://github.com/seanredmond/juliandate/blob/v${src.tag}/HISTORY.MD";
+    changelog = "https://github.com/seanredmond/juliandate/blob/${src.tag}/HISTORY.MD";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/llguidance/default.nix b/pkgs/development/python-modules/llguidance/default.nix
index 8e307699086d..4d0ff0db3ba0 100644
--- a/pkgs/development/python-modules/llguidance/default.nix
+++ b/pkgs/development/python-modules/llguidance/default.nix
@@ -23,19 +23,19 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "llguidance";
-  version = "1.7.2";
+  version = "1.7.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "guidance-ai";
     repo = "llguidance";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Eu+hhYCVoZWMdwrjiHyvbGwjYKnbkBETZNMQ+SOb8AU=";
+    hash = "sha256-vEF9+nlYP8LnlROgDU0HPg8H+OmZCQARoE6ngGIw7NM=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src pname version;
-    hash = "sha256-oeFm9dPqlJWPnrA7//D31E1W2St+zIRd8pzR6gUhiTg=";
+    hash = "sha256-5dJkC0Iz0IBXxSq5ZeorLta7WEd81ajagSoXt1Zsq7Q=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/logurich/default.nix b/pkgs/development/python-modules/logurich/default.nix
index 0e65d7f47acc..9006b3713c73 100644
--- a/pkgs/development/python-modules/logurich/default.nix
+++ b/pkgs/development/python-modules/logurich/default.nix
@@ -48,7 +48,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Logger that combine loguru and rich";
     homepage = "https://github.com/PakitoSec/logurich";
-    changelog = "https://github.com/PakitoSec/logurich/releases/tag/v${finalAttrs.src.tag}";
+    changelog = "https://github.com/PakitoSec/logurich/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/lupa/default.nix b/pkgs/development/python-modules/lupa/default.nix
index 2566c91af20b..3273c9ae21ab 100644
--- a/pkgs/development/python-modules/lupa/default.nix
+++ b/pkgs/development/python-modules/lupa/default.nix
@@ -7,11 +7,6 @@
   cython,
   setuptools,
 
-  # nativeBuildInputs
-  pkg-config,
-
-  # buildInputs
-  luajit,
 }:
 buildPythonPackage (finalAttrs: {
   pname = "lupa";
@@ -22,7 +17,11 @@ buildPythonPackage (finalAttrs: {
     owner = "scoder";
     repo = "lupa";
     tag = "lupa-${finalAttrs.version}";
-    hash = "sha256-JlKxisVd0sbLcmVjzyFEkbUDAornAoCWekpASl6qeY4=";
+    # Lua sources are vendored as submodules under third-party/.
+    # They are needed so that setup.py builds properly named backend
+    # modules (e.g. lua51, lua54, luajit21) expected by consumers like fakeredis.
+    fetchSubmodules = true;
+    hash = "sha256-XLBUQ1TrzWWST9RJdMTnpsceldDNzidnL82bixLhSRA=";
   };
 
   build-system = [
@@ -30,18 +29,6 @@ buildPythonPackage (finalAttrs: {
     setuptools
   ];
 
-  nativeBuildInputs = [
-    pkg-config
-  ];
-
-  env = {
-    LUPA_NO_BUNDLE = "true";
-  };
-
-  buildInputs = [
-    luajit
-  ];
-
   pythonImportsCheck = [ "lupa" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/mammoth/default.nix b/pkgs/development/python-modules/mammoth/default.nix
index ae8023b0c55e..a44ce6b34c3a 100644
--- a/pkgs/development/python-modules/mammoth/default.nix
+++ b/pkgs/development/python-modules/mammoth/default.nix
@@ -45,7 +45,7 @@ buildPythonPackage rec {
     export PATH=$out/bin:$PATH
   '';
 
-  passthru.updateScripts = gitUpdater { };
+  passthru.updateScript = gitUpdater { };
 
   meta = {
     description = "Convert Word documents (.docx files) to HTML";
diff --git a/pkgs/development/python-modules/markitdown/default.nix b/pkgs/development/python-modules/markitdown/default.nix
index 2f7313d2c79b..22ed0b7bd6f3 100644
--- a/pkgs/development/python-modules/markitdown/default.nix
+++ b/pkgs/development/python-modules/markitdown/default.nix
@@ -100,7 +100,7 @@ buildPythonPackage (finalAttrs: {
     "test_module_misc"
   ];
 
-  passthru.updateScripts = gitUpdater { };
+  passthru.updateScript = gitUpdater { };
 
   meta = {
     description = "Python tool for converting files and office documents to Markdown";
diff --git a/pkgs/development/python-modules/modelscope/default.nix b/pkgs/development/python-modules/modelscope/default.nix
index 45afcc95a203..db0cacdf3183 100644
--- a/pkgs/development/python-modules/modelscope/default.nix
+++ b/pkgs/development/python-modules/modelscope/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "modelscope";
-  version = "1.35.4";
+  version = "1.36.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "modelscope";
     repo = "modelscope";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-n33vf7GC4Oucw4/dWXeXeThRrkmSCk1rfS4BWzOxl7I=";
+    hash = "sha256-Cf6s5AujXL5kP7OPVbYSvfkvtAYH/XQJy1BKA8f3sGs=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/msoffcrypto-tool/default.nix b/pkgs/development/python-modules/msoffcrypto-tool/default.nix
index 7e3d9735e438..2c643f134bb3 100644
--- a/pkgs/development/python-modules/msoffcrypto-tool/default.nix
+++ b/pkgs/development/python-modules/msoffcrypto-tool/default.nix
@@ -41,7 +41,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Python tool and library for decrypting MS Office files with passwords or other keys";
     homepage = "https://github.com/nolze/msoffcrypto-tool";
-    changelog = "https://github.com/nolze/msoffcrypto-tool/blob/v${finalAttrs.src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/nolze/msoffcrypto-tool/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "msoffcrypto-tool";
diff --git a/pkgs/development/python-modules/pinecone-client/default.nix b/pkgs/development/python-modules/pinecone-client/default.nix
index dabbfa6bf441..cd4f3df84388 100644
--- a/pkgs/development/python-modules/pinecone-client/default.nix
+++ b/pkgs/development/python-modules/pinecone-client/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "pinecone-client";
-  version = "8.1.0";
+  version = "8.1.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pinecone-io";
     repo = "pinecone-python-client";
     tag = "v${version}";
-    hash = "sha256-rXsCaH8SbMttBQWfF8Gy6hz+PVboxkLJZCs0/o6lAEI=";
+    hash = "sha256-VfoSW17Bx/eFlnSxUiQZsfY/y210/sKIF5df/kb2kTc=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/pluginlib/default.nix b/pkgs/development/python-modules/pluginlib/default.nix
index c3e89726e999..1d723ec50068 100644
--- a/pkgs/development/python-modules/pluginlib/default.nix
+++ b/pkgs/development/python-modules/pluginlib/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "pluginlib";
-  version = "0.10.0";
+  version = "0.11.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Rockhopper-Technologies";
     repo = "pluginlib";
     tag = version;
-    hash = "sha256-mt3VE8iJPCmbws8bAdYMK9to446z8FQtsMZOlkLVUIU=";
+    hash = "sha256-KaexWmRSipwX+tg4Fh03XqhWm2XtZnmy4IEscJDRY/E=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pook/default.nix b/pkgs/development/python-modules/pook/default.nix
index 187c570c645e..5fb49bd83749 100644
--- a/pkgs/development/python-modules/pook/default.nix
+++ b/pkgs/development/python-modules/pook/default.nix
@@ -61,7 +61,7 @@ buildPythonPackage rec {
   meta = {
     description = "HTTP traffic mocking and testing";
     homepage = "https://github.com/h2non/pook";
-    changelog = "https://github.com/h2non/pook/blob/v${src.tag}/History.rst";
+    changelog = "https://github.com/h2non/pook/blob/${src.tag}/History.rst";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/postgrest/default.nix b/pkgs/development/python-modules/postgrest/default.nix
index c43e09d93f3b..8d73316e36dc 100644
--- a/pkgs/development/python-modules/postgrest/default.nix
+++ b/pkgs/development/python-modules/postgrest/default.nix
@@ -61,7 +61,7 @@ buildPythonPackage rec {
   meta = {
     description = "Client library for Supabase Functions";
     homepage = "https://github.com/supabase/supabase-py";
-    changelog = "https://github.com/supabase/supabase-py/blob/v${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/supabase/supabase-py/blob/${src.tag}/CHANGELOG.md";
     maintainers = with lib.maintainers; [ macbucheron ];
     license = lib.licenses.mit;
   };
diff --git a/pkgs/development/python-modules/ppf-datamatrix/default.nix b/pkgs/development/python-modules/ppf-datamatrix/default.nix
index 1cc755e11ac3..0ce9d5625a5a 100644
--- a/pkgs/development/python-modules/ppf-datamatrix/default.nix
+++ b/pkgs/development/python-modules/ppf-datamatrix/default.nix
@@ -30,6 +30,6 @@ buildPythonPackage (finalAttrs: {
     homepage = "https://github.com/adrianschlatter/ppf.datamatrix";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ kurogeek ];
-    changelog = "https://github.com/adrianschlatter/ppf.datamatrix/releases/tag/v${finalAttrs.src.tag}";
+    changelog = "https://github.com/adrianschlatter/ppf.datamatrix/releases/tag/${finalAttrs.src.tag}";
   };
 })
diff --git a/pkgs/development/python-modules/precisely/default.nix b/pkgs/development/python-modules/precisely/default.nix
index 0682aa4a1dff..582d173d45a4 100644
--- a/pkgs/development/python-modules/precisely/default.nix
+++ b/pkgs/development/python-modules/precisely/default.nix
@@ -26,7 +26,7 @@ buildPythonPackage rec {
   # Tests are outdated and based on Nose, which is not supported anymore.
   doCheck = false;
 
-  passthru.updateScripts = gitUpdater { };
+  passthru.updateScript = gitUpdater { };
 
   meta = {
     description = "Matcher library for Python";
diff --git a/pkgs/development/python-modules/pyahocorasick/default.nix b/pkgs/development/python-modules/pyahocorasick/default.nix
index c1b2c92fdeda..b4978fed4699 100644
--- a/pkgs/development/python-modules/pyahocorasick/default.nix
+++ b/pkgs/development/python-modules/pyahocorasick/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pyahocorasick";
-  version = "2.3.0";
+  version = "2.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "WojciechMula";
     repo = "pyahocorasick";
     tag = "v${version}";
-    hash = "sha256-ysQZOyJZ9xrNp3plVpaDtGqzjNuRDAELtAcjbC8Byis=";
+    hash = "sha256-lExpRJlRoYS45Bw9FQwa7GKELBljKA83ZhXg7e5vPwM=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pyaxencoapi/default.nix b/pkgs/development/python-modules/pyaxencoapi/default.nix
index 9053e8b558e4..eca876818da2 100644
--- a/pkgs/development/python-modules/pyaxencoapi/default.nix
+++ b/pkgs/development/python-modules/pyaxencoapi/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyaxencoapi";
-  version = "1.0.7";
+  version = "1.0.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "AXENCO-FR";
     repo = "ha-py-axenco-api";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ml58+kstIpqQUXDt/jpZeR8ueu5U3nnH7hiUcZxveAM=";
+    hash = "sha256-rqjDI8e3ZeZHsEk0EBaKlEl3w9blinlc2MsTCAKk85o=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/pydantic-ai-slim/default.nix b/pkgs/development/python-modules/pydantic-ai-slim/default.nix
index eef240e4dd49..acbd447db5cd 100644
--- a/pkgs/development/python-modules/pydantic-ai-slim/default.nix
+++ b/pkgs/development/python-modules/pydantic-ai-slim/default.nix
@@ -20,14 +20,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydantic-ai-slim";
-  version = "1.87.0";
+  version = "1.88.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "pydantic-ai";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Q5h+7XZ3SU1B9/kY2qBYraYrWFX3vcDFwQLld2oeQaA=";
+    hash = "sha256-2DyPJNbGFkbgYd2qLqhlTkmsgpLcTkkq3+7JKMocnBk=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/pydantic_ai_slim";
diff --git a/pkgs/development/python-modules/pydantic-graph/default.nix b/pkgs/development/python-modules/pydantic-graph/default.nix
index 10e216cb3bf0..82ccbaf2a39c 100644
--- a/pkgs/development/python-modules/pydantic-graph/default.nix
+++ b/pkgs/development/python-modules/pydantic-graph/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydantic-graph";
-  version = "1.87.0";
+  version = "1.88.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pydantic";
     repo = "pydantic-ai";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Q5h+7XZ3SU1B9/kY2qBYraYrWFX3vcDFwQLld2oeQaA=";
+    hash = "sha256-2DyPJNbGFkbgYd2qLqhlTkmsgpLcTkkq3+7JKMocnBk=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/pydantic_graph";
diff --git a/pkgs/development/python-modules/pydantic-monty/default.nix b/pkgs/development/python-modules/pydantic-monty/default.nix
index 35bbba47ee76..e4fc0a102225 100644
--- a/pkgs/development/python-modules/pydantic-monty/default.nix
+++ b/pkgs/development/python-modules/pydantic-monty/default.nix
@@ -15,7 +15,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pydantic-monty";
-  version = "0.0.13";
+  version = "0.0.17";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -24,12 +24,12 @@ buildPythonPackage (finalAttrs: {
     owner = "pydantic";
     repo = "monty";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0g0/NuwTuUfHVHE8YcVjUeZpSa+ANPWIXllu+qRXjZE=";
+    hash = "sha256-f+WcznnOMSc0ahgfvgVec4U0nH9j022NLnWQLdISv3M=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname src version;
-    hash = "sha256-LkTEMhz0MG6RfqejOQMdB2BZU6oxT3ZAo/N0oVlswsQ=";
+    hash = "sha256-y+vi7kZPavBNnIeLpAoKO2YcBTq2d9yeDl+eoRJV1Tk=";
   };
 
   dependencies = [ typing-extensions ];
diff --git a/pkgs/development/python-modules/pygame-ce/skip-failing-tests.patch b/pkgs/development/python-modules/pygame-ce/skip-failing-tests.patch
deleted file mode 100644
index d85b591ab13a..000000000000
--- a/pkgs/development/python-modules/pygame-ce/skip-failing-tests.patch
+++ /dev/null
@@ -1,43 +0,0 @@
-diff --git a/test/draw_test.py b/test/draw_test.py
-index ed99f0ce9..0484ef53d 100644
---- a/test/draw_test.py
-+++ b/test/draw_test.py
-@@ -7496,6 +7496,10 @@ class DrawModuleTest(unittest.TestCase):
-             with self.assertRaises(TypeError):
-                 draw.polygon(surf, col, points, 0)
- 
-+    @unittest.skipIf(
-+        True,
-+        "https://github.com/pygame-community/pygame-ce/pull/3680#issuecomment-3796052119",
-+    )
-     def test_aafunctions_depth_segfault(self):
-         """Ensure future commits don't break the segfault fixed by pull request
-         https://github.com/pygame-community/pygame-ce/pull/3008
-diff --git a/test/surface_test.py b/test/surface_test.py
-index c2c91f4f5..35b9e1aaf 100644
---- a/test/surface_test.py
-+++ b/test/surface_test.py
-@@ -286,6 +286,7 @@ class SurfaceTypeTest(unittest.TestCase):
-         for pt in test_utils.rect_outer_bounds(fill_rect):
-             self.assertNotEqual(s1.get_at(pt), color)
- 
-+    @unittest.skipIf(True, "https://github.com/libsdl-org/sdl2-compat/issues/575")
-     def test_fill_rle(self):
-         """Test RLEACCEL flag with fill()"""
-         color = (250, 25, 25, 255)
-diff --git a/test/window_test.py b/test/window_test.py
-index b8dd1f005..5b7939908 100644
---- a/test/window_test.py
-+++ b/test/window_test.py
-@@ -113,10 +113,7 @@ class WindowTypeTest(unittest.TestCase):
-         self.win.always_on_top = False
-         self.assertFalse(self.win.always_on_top)
- 
--    @unittest.skipIf(
--        SDL < (2, 0, 18),
--        "requires SDL 2.0.18+",
--    )
-+    @unittest.skipIf(True, "https://github.com/pygame-community/pygame-ce/pull/3680")
-     def test_mouse_rect(self):
-         self.win.mouse_rect = None
-         self.assertIsNone(self.win.mouse_rect)
diff --git a/pkgs/development/python-modules/pygls/1.nix b/pkgs/development/python-modules/pygls/1.nix
index b08bb2b641c8..734a09f7479f 100644
--- a/pkgs/development/python-modules/pygls/1.nix
+++ b/pkgs/development/python-modules/pygls/1.nix
@@ -11,7 +11,7 @@
   websockets,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pygls";
   version = "1.3.1";
   pyproject = true;
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "openlawlibrary";
     repo = "pygls";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-AvrGoQ0Be1xKZhFn9XXYJpt5w+ITbDbj6NFZpaDPKao=";
   };
 
@@ -62,8 +62,8 @@ buildPythonPackage rec {
     broken = lib.versionAtLeast lsprotocol.version "2024";
     description = "Pythonic generic implementation of the Language Server Protocol";
     homepage = "https://github.com/openlawlibrary/pygls";
-    changelog = "https://github.com/openlawlibrary/pygls/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/openlawlibrary/pygls/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ kira-bruneau ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/pygls/default.nix b/pkgs/development/python-modules/pygls/default.nix
index cd0501310420..a6ec8564091a 100644
--- a/pkgs/development/python-modules/pygls/default.nix
+++ b/pkgs/development/python-modules/pygls/default.nix
@@ -13,7 +13,7 @@
   nix-update-script,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pygls";
   version = "2.1.1";
   pyproject = true;
@@ -21,7 +21,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "openlawlibrary";
     repo = "pygls";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-jxc1nKxfiRenb629a2WCZOzqyIOvT5XU4NrjmKPlDHk=";
   };
 
@@ -65,8 +65,8 @@ buildPythonPackage rec {
   meta = {
     description = "Pythonic generic implementation of the Language Server Protocol";
     homepage = "https://github.com/openlawlibrary/pygls";
-    changelog = "https://github.com/openlawlibrary/pygls/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/openlawlibrary/pygls/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ kira-bruneau ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/pyjpegls/default.nix b/pkgs/development/python-modules/pyjpegls/default.nix
index 8e36ceffa59c..812be43bd35c 100644
--- a/pkgs/development/python-modules/pyjpegls/default.nix
+++ b/pkgs/development/python-modules/pyjpegls/default.nix
@@ -48,7 +48,7 @@ buildPythonPackage rec {
   meta = {
     description = "JPEG-LS for Python via CharLS C++ Library";
     homepage = "https://github.com/pydicom/pyjpegls";
-    changelog = "https://github.com/pydicom/pyjpegls/releases/tag/v${src.tag}";
+    changelog = "https://github.com/pydicom/pyjpegls/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ bcdarwin ];
   };
diff --git a/pkgs/development/python-modules/pysequoia/default.nix b/pkgs/development/python-modules/pysequoia/default.nix
index 0a42c761d278..83af787ac285 100644
--- a/pkgs/development/python-modules/pysequoia/default.nix
+++ b/pkgs/development/python-modules/pysequoia/default.nix
@@ -8,17 +8,17 @@
 
 buildPythonPackage rec {
   pname = "pysequoia";
-  version = "0.1.32";
+  version = "0.1.33";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-uqWJKz5o2/RJL81LW+sQve7YCAyl6PV3JWBqgktldT8=";
+    hash = "sha256-BNQJ8Ufggy3IfayPg+kfYwOXWuR5D3QIEJb/Zn7/xYA=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-5TGxD3XOmi5NbTkhtxzZXExHFmveKewdlkDHSt+ZTVI=";
+    hash = "sha256-M3cIgvdjyzVtFspwEfFEvey4gnyZoBLT6k2ADtrxZn4=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/python-modules/pytest-insta/default.nix b/pkgs/development/python-modules/pytest-insta/default.nix
index d13adb3aba8b..391c31925b2b 100644
--- a/pkgs/development/python-modules/pytest-insta/default.nix
+++ b/pkgs/development/python-modules/pytest-insta/default.nix
@@ -40,7 +40,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Pytest plugin for snapshot testing";
     homepage = "https://github.com/vberlier/pytest-insta";
-    changelog = "https://github.com/vberlier/pytest-insta/blob/v${finalAttrs.src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/vberlier/pytest-insta/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = [ ];
   };
diff --git a/pkgs/development/python-modules/python-obfuscator/default.nix b/pkgs/development/python-modules/python-obfuscator/default.nix
index af3c6b530e0f..ca3469b968ac 100644
--- a/pkgs/development/python-modules/python-obfuscator/default.nix
+++ b/pkgs/development/python-modules/python-obfuscator/default.nix
@@ -36,7 +36,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Module to obfuscate code";
     homepage = "https://github.com/davidteather/python-obfuscator";
-    changelog = "https://github.com/davidteather/python-obfuscator/releases/tag/v${finalAttrs.src.tag}";
+    changelog = "https://github.com/davidteather/python-obfuscator/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/python-otbr-api/default.nix b/pkgs/development/python-modules/python-otbr-api/default.nix
index f4add78507a4..5f99c0e944fe 100644
--- a/pkgs/development/python-modules/python-otbr-api/default.nix
+++ b/pkgs/development/python-modules/python-otbr-api/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "python-otbr-api";
-  version = "2.9.0";
+  version = "2.10.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = "python-otbr-api";
     tag = finalAttrs.version;
-    hash = "sha256-UhDcWw7QsKQ9t1SzdFoSf7ZrkUkKUaPwuMbrqEGA48o=";
+    hash = "sha256-WBL6R4yw/4yuF/T94NtaapGspn4L2H0glVatW6+hoRk=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/rctclient/default.nix b/pkgs/development/python-modules/rctclient/default.nix
index a1a7a581be66..488ad68e7c1b 100644
--- a/pkgs/development/python-modules/rctclient/default.nix
+++ b/pkgs/development/python-modules/rctclient/default.nix
@@ -7,16 +7,16 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "rctclient";
-  version = "0.0.4";
+  version = "0.0.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "svalouch";
     repo = "python-rctclient";
-    tag = "v${version}";
-    hash = "sha256-QPla5h8wSM9Ynj44Uwc1a2yAnu8TXbyBWzVHQeW6jnI=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-f85ETzuZpOgnWpiLipLtAjOPn63yniCffWdPLyCEC3w=";
   };
 
   build-system = [ setuptools ];
@@ -30,8 +30,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python implementation of the RCT Power GmbH Serial Communication Protocol";
     homepage = "https://github.com/svalouch/python-rctclient";
-    changelog = "https://github.com/svalouch/python-rctclient/releases/tag/${src.tag}";
-    license = with lib.licenses; [ gpl3Only ];
+    changelog = "https://github.com/svalouch/python-rctclient/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ _9R ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/realtime/default.nix b/pkgs/development/python-modules/realtime/default.nix
index 345d00f17c4b..34ac3f9bafb5 100644
--- a/pkgs/development/python-modules/realtime/default.nix
+++ b/pkgs/development/python-modules/realtime/default.nix
@@ -55,7 +55,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Client library for Supabase Functions";
     homepage = "https://github.com/supabase/supabase-py";
-    changelog = "https://github.com/supabase/supabase-py/blob/v${finalAttrs.src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/supabase/supabase-py/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ siegema ];
   };
diff --git a/pkgs/development/python-modules/requests-hardened/default.nix b/pkgs/development/python-modules/requests-hardened/default.nix
index d1078070bfc3..45d6448958e7 100644
--- a/pkgs/development/python-modules/requests-hardened/default.nix
+++ b/pkgs/development/python-modules/requests-hardened/default.nix
@@ -14,14 +14,14 @@
 }:
 buildPythonPackage rec {
   pname = "requests-hardened";
-  version = "1.2.0";
+  version = "1.2.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "saleor";
     repo = "requests-hardened";
     tag = "v${version}";
-    hash = "sha256-J4xQY2W5upJQ3hrA2hjkw8voLpxNPpekNwmyMKKAVAo=";
+    hash = "sha256-tvSS3z1fhQdcxvsj5vK//mr5xYeIrLl+6/gtnWsiETk=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/rocketchat-api/default.nix b/pkgs/development/python-modules/rocketchat-api/default.nix
index 7ff29f6201b4..f3ebbed7d38e 100644
--- a/pkgs/development/python-modules/rocketchat-api/default.nix
+++ b/pkgs/development/python-modules/rocketchat-api/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "rocketchat-api";
-  version = "3.5.0";
+  version = "3.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jadolg";
     repo = "rocketchat_API";
     tag = version;
-    hash = "sha256-IbynNQLRgVCY2I9rZ3S4annJ0ogiuRKLHJ2P9qvpj4o=";
+    hash = "sha256-GYk3ZMAothllMxFhSFc2p4nX0wQOaWtltcrXpwK6lzE=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/socid-extractor/default.nix b/pkgs/development/python-modules/socid-extractor/default.nix
index 5b650087ff1b..9a2c740ec7b9 100644
--- a/pkgs/development/python-modules/socid-extractor/default.nix
+++ b/pkgs/development/python-modules/socid-extractor/default.nix
@@ -38,7 +38,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Python module to extract details from personal pages";
     homepage = "https://github.com/soxoj/socid-extractor";
-    changelog = "https://github.com/soxoj/socid-extractor/blob/v${finalAttrs.src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/soxoj/socid-extractor/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "socid_extractor";
diff --git a/pkgs/development/python-modules/starlette-context/default.nix b/pkgs/development/python-modules/starlette-context/default.nix
index a18225be77ab..8d624e5dccb2 100644
--- a/pkgs/development/python-modules/starlette-context/default.nix
+++ b/pkgs/development/python-modules/starlette-context/default.nix
@@ -36,7 +36,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Middleware for Starlette that allows you to store and access the context data of a request";
     homepage = "https://github.com/tomwojcik/starlette-context";
-    changelog = "https://github.com/tomwojcik/starlette-context/releases/tag/v${finalAttrs.src.tag}";
+    changelog = "https://github.com/tomwojcik/starlette-context/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/storage3/default.nix b/pkgs/development/python-modules/storage3/default.nix
index dd96780cbed3..97d6ba899034 100644
--- a/pkgs/development/python-modules/storage3/default.nix
+++ b/pkgs/development/python-modules/storage3/default.nix
@@ -61,7 +61,7 @@ buildPythonPackage rec {
   meta = {
     description = "Client library for Supabase Functions";
     homepage = "https://github.com/supabase/supabase-py";
-    changelog = "https://github.com/supabase/supabase-py/blob/v${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/supabase/supabase-py/blob/${src.tag}/CHANGELOG.md";
     maintainers = with lib.maintainers; [ siegema ];
     license = lib.licenses.mit;
   };
diff --git a/pkgs/development/python-modules/supabase-auth/default.nix b/pkgs/development/python-modules/supabase-auth/default.nix
index 3e0334be50c6..9d09abc88313 100644
--- a/pkgs/development/python-modules/supabase-auth/default.nix
+++ b/pkgs/development/python-modules/supabase-auth/default.nix
@@ -59,7 +59,7 @@ buildPythonPackage rec {
   meta = {
     description = "Client library for Supabase Auth";
     homepage = "https://github.com/supabase/supabase-py/";
-    changelog = "https://github.com/supabase/supabase-py/blob/v${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/supabase/supabase-py/blob/${src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ macbucheron ];
   };
diff --git a/pkgs/development/python-modules/supabase-functions/default.nix b/pkgs/development/python-modules/supabase-functions/default.nix
index 4ce9853c9419..5b64f658a45a 100644
--- a/pkgs/development/python-modules/supabase-functions/default.nix
+++ b/pkgs/development/python-modules/supabase-functions/default.nix
@@ -53,7 +53,7 @@ buildPythonPackage rec {
   meta = {
     description = "Client library for Supabase Functions";
     homepage = "https://github.com/supabase/supabase-py";
-    changelog = "https://github.com/supabase/supabase-py/blob/v${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/supabase/supabase-py/blob/${src.tag}/CHANGELOG.md";
     maintainers = with lib.maintainers; [ macbucheron ];
     license = lib.licenses.mit;
   };
diff --git a/pkgs/development/python-modules/taskw-ng/default.nix b/pkgs/development/python-modules/taskw-ng/default.nix
index 03f4d82ab771..5174da5d5039 100644
--- a/pkgs/development/python-modules/taskw-ng/default.nix
+++ b/pkgs/development/python-modules/taskw-ng/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "taskw-ng";
-  version = "2.0.0";
+  version = "0.2.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bergercookie";
     repo = "taskw-ng";
-    tag = version;
-    hash = "sha256-hTZi6Y3jVlBI+CGQtHZ4PBU5rjEjE2l8o2rusCkEma0=";
+    tag = "v${version}";
+    hash = "sha256-KxXLSDvUclQlNbMR+Zzl6tgBrH2QxqjLVoyBK3OiKVU=";
   };
 
   pythonRelaxDeps = [
@@ -44,6 +44,7 @@ buildPythonPackage rec {
 
   # TODO: doesn't pass because `can_use` fails and `task --version` seems not to be answering.
   # pythonImportsCheck = [ "taskw_ng" ];
+  passthru.skipBulkUpdate = true;
 
   meta = {
     description = "Module to interact with the Taskwarrior API";
diff --git a/pkgs/development/python-modules/teamcity-messages/default.nix b/pkgs/development/python-modules/teamcity-messages/default.nix
index 9c61387138b5..fe38ecce0db5 100644
--- a/pkgs/development/python-modules/teamcity-messages/default.nix
+++ b/pkgs/development/python-modules/teamcity-messages/default.nix
@@ -29,7 +29,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Python unit test reporting to TeamCity";
     homepage = "https://github.com/JetBrains/teamcity-messages";
-    changelog = "https://github.com/JetBrains/teamcity-messages/releases/tag/v${finalAttrs.src.tag}";
+    changelog = "https://github.com/JetBrains/teamcity-messages/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/tempman/default.nix b/pkgs/development/python-modules/tempman/default.nix
index 1cc8ddbf9bec..3809724c37ba 100644
--- a/pkgs/development/python-modules/tempman/default.nix
+++ b/pkgs/development/python-modules/tempman/default.nix
@@ -31,7 +31,7 @@ buildPythonPackage rec {
   # Disabling tests, they rely on dependencies that are outdated and not supported
   doCheck = false;
 
-  passthru.updateScripts = gitUpdater { };
+  passthru.updateScript = gitUpdater { };
 
   meta = {
     description = "Create and clean up temporary directories";
diff --git a/pkgs/development/python-modules/thinqconnect/default.nix b/pkgs/development/python-modules/thinqconnect/default.nix
index 321217d9d271..f4c881de90aa 100644
--- a/pkgs/development/python-modules/thinqconnect/default.nix
+++ b/pkgs/development/python-modules/thinqconnect/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "thinqconnect";
-  version = "1.0.11";
+  version = "1.0.12";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "thinq-connect";
     repo = "pythinqconnect";
     tag = version;
-    hash = "sha256-ZM+CCnGJga66b68MLKkd80dHPhF4mYMIFuV1M+5K3C8=";
+    hash = "sha256-LOIqh/f9NiaBpkJqre1TejdUN0gbguSM3s8faGPcf54=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/typst/default.nix b/pkgs/development/python-modules/typst/default.nix
index e6e94fb7898a..1047d820d480 100644
--- a/pkgs/development/python-modules/typst/default.nix
+++ b/pkgs/development/python-modules/typst/default.nix
@@ -49,7 +49,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Python binding to typst";
     homepage = "https://github.com/messense/typst-py";
-    changelog = "https://github.com/messense/typst-py/releases/tag/v${finalAttrs.src.tag}";
+    changelog = "https://github.com/messense/typst-py/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/unstructured-client/default.nix b/pkgs/development/python-modules/unstructured-client/default.nix
index 7959204b7581..5c6c951288a5 100644
--- a/pkgs/development/python-modules/unstructured-client/default.nix
+++ b/pkgs/development/python-modules/unstructured-client/default.nix
@@ -1,13 +1,11 @@
 {
   aiofiles,
   buildPythonPackage,
-  cryptography,
   deepdiff,
   fetchFromGitHub,
   httpcore,
   httpx,
   lib,
-  poetry-core,
   pydantic,
   pypdf,
   pypdfium2,
@@ -15,33 +13,29 @@
   pytestCheckHook,
   python,
   requests-toolbelt,
+  setuptools,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "unstructured-client";
-  version = "0.42.12";
+  version = "0.43.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Unstructured-IO";
     repo = "unstructured-python-client";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xuaGvQEu1QpLn33AUgdWW120pVVNVPL08U/SCA7kGvc=";
+    hash = "sha256-Y/qhgm+mmKNPZhx/km02i7sc31izQH72REXYrKY++OM=";
   };
 
   preBuild = ''
     ${python.interpreter} scripts/prepare_readme.py
   '';
 
-  build-system = [ poetry-core ];
-
-  pythonRelaxDeps = [
-    "pydantic"
-  ];
+  build-system = [ setuptools ];
 
   dependencies = [
     aiofiles
-    cryptography
     httpcore
     httpx
     pydantic
diff --git a/pkgs/development/python-modules/whodap/default.nix b/pkgs/development/python-modules/whodap/default.nix
index 36c7b8a66ff9..33bdf8b427ae 100644
--- a/pkgs/development/python-modules/whodap/default.nix
+++ b/pkgs/development/python-modules/whodap/default.nix
@@ -45,7 +45,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Python RDAP utility for querying and parsing information about domain names";
     homepage = "https://github.com/pogzyb/whodap";
-    changelog = "https://github.com/pogzyb/whodap/releases/tag/v${finalAttrs.src.tag}";
+    changelog = "https://github.com/pogzyb/whodap/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
diff --git a/pkgs/development/python-modules/yaxmldiff/default.nix b/pkgs/development/python-modules/yaxmldiff/default.nix
index 5ffae301df62..a321c78e15d6 100644
--- a/pkgs/development/python-modules/yaxmldiff/default.nix
+++ b/pkgs/development/python-modules/yaxmldiff/default.nix
@@ -34,7 +34,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Yet Another XML Differ";
     homepage = "https://github.com/latk/yaxmldiff.py";
-    changelog = "https://https://github.com/latk/yaxmldiff.py/blob/v${finalAttrs.src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/latk/yaxmldiff.py/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ sigmanificient ];
   };
diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index f901e7ebc5b5..935534ec2e3b 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -15,14 +15,14 @@ let
   variants = {
     # ./update-xanmod.sh lts
     lts = {
-      version = "6.18.24";
-      hash = "sha256-BYy5AzTDQIMBJNwWIZ4uGjPKvXGgei7PAOT5gCvlp1Q=";
+      version = "6.18.25";
+      hash = "sha256-MC2hFOGC7WL0mrD4JEeCgRCNBYBYDt63jIP+HCgnTAg=";
       isLTS = true;
     };
     # ./update-xanmod.sh main
     main = {
-      version = "6.19.14";
-      hash = "sha256-xp5IBA4epb+3SCJIkbxqzymwvz4T9p7NOP9y6iy6DZk=";
+      version = "7.0.2";
+      hash = "sha256-RXdgP6jpy6GfZ70WG6k6rrryjHV2uUaqy4e+4jCgJek=";
     };
   };
 
@@ -58,7 +58,6 @@ let
 
             # Preemption
             PREEMPT = lib.mkOverride 60 yes;
-            PREEMPT_VOLUNTARY = lib.mkOverride 60 no;
 
             # Google's BBRv3 TCP congestion Control
             TCP_CONG_BBR = yes;
@@ -90,6 +89,9 @@ let
             X86_FRED = yes;
             X86_POSTED_MSI = yes;
           }
+          // lib.optionalAttrs (lib.versionOlder (lib.versions.majorMinor version) "7.0") {
+            PREEMPT_VOLUNTARY = lib.mkOverride 60 no;
+          }
           // lib.optionalAttrs (lib.versionAtLeast (lib.versions.majorMinor version) "6.13") {
             # Lazy preemption
             PREEMPT = lib.mkOverride 70 no;
diff --git a/pkgs/os-specific/linux/nvidia-x11/persistenced.nix b/pkgs/os-specific/linux/nvidia-x11/persistenced.nix
index cf9a8f0f404b..556e53f937af 100644
--- a/pkgs/os-specific/linux/nvidia-x11/persistenced.nix
+++ b/pkgs/os-specific/linux/nvidia-x11/persistenced.nix
@@ -4,10 +4,11 @@ nvidia_x11: sha256:
   stdenv,
   lib,
   fetchFromGitHub,
+  buildPackages,
   m4,
-  glibc,
-  libtirpc,
   pkg-config,
+  addDriverRunpath,
+  libtirpc,
 }:
 
 stdenv.mkDerivation {
@@ -21,23 +22,29 @@ stdenv.mkDerivation {
     inherit sha256;
   };
 
-  env = {
-    LIBRARY_PATH = "${glibc}/lib";
+  env = lib.optionalAttrs (lib.versionOlder nvidia_x11.persistencedVersion "450.51") {
     NIX_CFLAGS_COMPILE = toString [ "-I${libtirpc.dev}/include/tirpc" ];
+    NIX_LDFLAGS = toString [ "-ltirpc" ];
   };
-  NIX_LDFLAGS = [ "-ltirpc" ];
+
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
 
   nativeBuildInputs = [
     m4
     pkg-config
+    addDriverRunpath
   ];
 
   buildInputs = [
     libtirpc
-    stdenv.cc.cc.lib
   ];
 
-  makeFlags = nvidia_x11.makeFlags ++ [ "DATE=true" ];
+  makeFlags = [
+    "DATE=true"
+    "DO_STRIP="
+    "HOST_CC=\$(CC_FOR_BUILD)"
+    "HOST_LD=\$(LD_FOR_BUILD)"
+  ];
 
   installFlags = [ "PREFIX=$(out)" ];
 
@@ -47,8 +54,7 @@ stdenv.mkDerivation {
     cp $out/{bin,origBin}/nvidia-persistenced
     patchelf --set-interpreter /lib64/ld-linux-x86-64.so.2 $out/origBin/nvidia-persistenced
 
-    patchelf --set-rpath "$(patchelf --print-rpath $out/bin/nvidia-persistenced):${nvidia_x11}/lib" \
-      $out/bin/nvidia-persistenced
+    addDriverRunpath $out/bin/nvidia-persistenced
   '';
 
   meta = {
diff --git a/pkgs/servers/home-assistant/custom-components/ha_mcp_tools/package.nix b/pkgs/servers/home-assistant/custom-components/ha_mcp_tools/package.nix
index b4d17511ed30..fe84229bd446 100644
--- a/pkgs/servers/home-assistant/custom-components/ha_mcp_tools/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/ha_mcp_tools/package.nix
@@ -3,22 +3,30 @@
   buildHomeAssistantComponent,
   fetchFromGitHub,
   nix-update-script,
+  ruamel-yaml,
 }:
 
 buildHomeAssistantComponent rec {
   owner = "homeassistant-ai";
   domain = "ha_mcp_tools";
-  version = "7.2.0";
+  version = "7.3.0";
 
   src = fetchFromGitHub {
     owner = "homeassistant-ai";
     repo = "ha-mcp";
     tag = "v${version}";
-    hash = "sha256-1SiWrrUSMU/Pe3vXZIPdUwpVhZM41avmjhO+PFLWmUE=";
+    hash = "sha256-boWqv8lSN/UiqSRhVBgbucX+RC6q14Oa4WzkJPeZzVw=";
   };
 
+  dependencies = [
+    ruamel-yaml
+  ];
+
   passthru.updateScript = nix-update-script {
-    extraArgs = [ "--version-regex=^v([0-9]+\\.[0-9]+\\.[0-9]+)$" ];
+    extraArgs = [
+      "--use-github-releases"
+      "--version-regex=^v([0-9]+\\.[0-9]+\\.[0-9]+)$"
+    ];
   };
 
   meta = {
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/atomic-calendar-revive/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/atomic-calendar-revive/package.nix
index e1abe02afce2..639b3d77735c 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/atomic-calendar-revive/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/atomic-calendar-revive/package.nix
@@ -15,20 +15,20 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "atomic-calendar-revive";
-  version = "10.2.0";
+  version = "10.2.2";
 
   src = fetchFromGitHub {
     owner = "totaldebug";
     repo = "atomic-calendar-revive";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cqtXhBSFuEuh8IH/6S0qZN3+SrdCt0WXrBJlBcDUujY=";
+    hash = "sha256-FiER75oDc9fbdZlh/dLPKmuA11i/UWy2uoX/aPW2m1s=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-fhi1ysI2ygMfPTSiu40tt713fA/dy7r28Xyk0HxSvXE=";
+    hash = "sha256-DoMzpXCkK60o1YPpStCNCdpj0I+4OqXr7PcX3hjVhSg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix
index f3f7c019e09b..d321b96a1d20 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/material-you-utilities/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "material-you-utilities";
-  version = "2.1.6";
+  version = "2.1.8";
 
   src = fetchFromGitHub {
     owner = "Nerwyn";
     repo = "material-you-utilities";
     tag = version;
-    hash = "sha256-NIOPETbuEPlf7wIvDGh0580jmIkzy1DRLwgSrOC6S60=";
+    hash = "sha256-yfwZBkrfTmQRyzzajBhmuyxPkJ4fNeIner4TJV49rzo=";
   };
 
-  npmDepsHash = "sha256-S+2A098T3kRMOfznbwR2mOX9zCvYQGR+HsIjAjd55wg=";
+  npmDepsHash = "sha256-EIkEzy1UZ+EU+734LZJlU7yRrix97I2Uc+/ghtMRVv0=";
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/servers/sql/postgresql/ext/timescaledb.nix b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
index 1dcbf858aa89..9e931d62aca2 100644
--- a/pkgs/servers/sql/postgresql/ext/timescaledb.nix
+++ b/pkgs/servers/sql/postgresql/ext/timescaledb.nix
@@ -13,13 +13,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "timescaledb${lib.optionalString (!enableUnfree) "-apache"}";
-  version = "2.26.3";
+  version = "2.26.4";
 
   src = fetchFromGitHub {
     owner = "timescale";
     repo = "timescaledb";
     tag = finalAttrs.version;
-    hash = "sha256-2ZBra4GumVvbr2GQIM2BQ87X6TeX4LdSIUqpj203L/0=";
+    hash = "sha256-fCaB0LSffjmen1zDjsR/4V3FgH05gkLDHYmLqVpyTLQ=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/stdenv/generic/make-derivation.nix b/pkgs/stdenv/generic/make-derivation.nix
index c178f82aaa01..12a6dffb426f 100644
--- a/pkgs/stdenv/generic/make-derivation.nix
+++ b/pkgs/stdenv/generic/make-derivation.nix
@@ -25,7 +25,7 @@ let
     filterAttrs
     getDev
     head
-    imap1
+    foldl'
     isAttrs
     isBool
     isDerivation
@@ -44,6 +44,8 @@ let
     toFunction
     unique
     zipAttrsWith
+    isPath
+    seq
     ;
 
   inherit (import ../../build-support/lib/cmake.nix { inherit lib stdenv; }) makeCMakeFlags;
@@ -436,17 +438,17 @@ let
       checkDependencyList = checkDependencyList' [ ];
       checkDependencyList' =
         positions: name: deps:
-        imap1 (
+        seq (foldl' (
           index: dep:
-          if dep == null || isDerivation dep || isString dep || builtins.isPath dep then
-            dep
+          if dep == null || isDerivation dep || isString dep || isPath dep then
+            index + 1
           else if isList dep then
-            checkDependencyList' ([ index ] ++ positions) name dep
+            seq (checkDependencyList' ([ index ] ++ positions) name dep) (index + 1)
           else
             throw "Dependency is not of a valid type: ${
               concatMapStrings (ix: "element ${toString ix} of ") ([ index ] ++ positions)
             }${name} for ${attrs.name or attrs.pname}"
-        ) deps;
+        ) 1 deps) deps;
     in
     if erroneousHardeningFlags != [ ] then
       abort (
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 4b3439e97f38..99ff1f723fae 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1856,6 +1856,7 @@ mapAliases {
   shades-of-gray-theme = throw "'shades-of-gray-theme' has been removed because upstream is a 404"; # Added 2025-12-20
   shared_desktop_ontologies = throw "'shared_desktop_ontologies' has been removed as it had been abandoned upstream"; # Added 2025-11-09
   shipyard = throw "'shipyard' has been renamed to/replaced by 'jumppad'"; # Converted to throw 2025-10-27
+  shisho = throw "'shisho' has been removed, as it is archived upstream. Consider using 'semgrep', 'opengrep', or 'ast-grep' instead"; # Added 2026-04-28
   sic-image-cli = warnAlias "'sic-image-cli' has been renamed to 'imagineer'" imagineer; # Added 2026-03-29
   siduck76-st = throw "'siduck76-st' has been renamed to/replaced by 'st-snazzy'"; # Converted to throw 2025-10-27
   sierra-breeze-enhanced = throw "'sierra-breeze-enhanced' has been removed, as it is only compatible with Plasma 5, which is EOL"; # Added 2025-08-20
@@ -2131,6 +2132,7 @@ mapAliases {
   warmux = throw "'warmux' has been removed as it is unmaintained and broken"; # Added 2025-11-03
   warsow = throw "'warsow' has been removed as it is unmaintained and is broken"; # Added 2025-10-09
   warsow-engine = throw "'warsow-engine' has been removed as it is unmaintained and is broken"; # Added 2025-10-09
+  wasistlos = throw "'wasistlos' has been removed because it was unmaintained and archived upstream. Consider using 'karere' instead"; # Added 2026-04-13
   wasm-bindgen-cli = wasm-bindgen-cli_0_2_117;
   wasm-strip = throw "'wasm-strip' has been removed due to upstream deprecation. Use 'wabt' instead."; # Added 2025-11-06
   wavebox = throw "'wavebox' has been removed due to lack of maintenance in nixpkgs"; # Added 2025-06-24
@@ -2144,7 +2146,7 @@ mapAliases {
   webmacs = throw "webmacs has been removed as it was unmaintained upstream"; # Added 2026-02-03
   welkin = throw "welkin was removed as it is unmaintained upstream"; # Added 2026-01-01
   whalebird = throw "'whalebird' has been removed because it was using an EOL electron version"; # Added 2026-03-20
-  whatsapp-for-linux = throw "'whatsapp-for-linux' has been renamed to/replaced by 'wasistlos'"; # Converted to throw 2025-10-27
+  whatsapp-for-linux = throw "'whatsapp-for-linux' has been removed because it was unmaintained and archived upstream. Consider using 'karere' instead"; # Converted to throw 2025-10-27
   wifi-password = throw "'wifi-password' has been removed as it was unmaintained upstream"; # Added 2025-08-29
   win-pvdrivers = throw "'win-pvdrivers' has been removed as it was subject to the Xen build machine compromise (XSN-01) and has open security vulnerabilities (XSA-468)"; # Added 2025-08-29
   win-virtio = throw "'win-virtio' has been renamed to/replaced by 'virtio-win'"; # Converted to throw 2025-10-27
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2780fed25c60..3f1e58a148d1 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2471,32 +2471,6 @@ with pkgs;
     withXorg = false;
   };
 
-  grub2 = callPackage ../tools/misc/grub/default.nix { };
-
-  grub2_efi = grub2.override {
-    efiSupport = true;
-  };
-
-  grub2_ieee1275 = grub2.override {
-    ieee1275Support = true;
-  };
-
-  grub2_light = grub2.override {
-    zfsSupport = false;
-  };
-
-  grub2_xen = grub2.override {
-    xenSupport = true;
-  };
-
-  grub2_xen_pvh = grub2.override {
-    xenPvhSupport = true;
-  };
-
-  grub2_pvgrub_image = grub2_pvhgrub_image.override {
-    grubPlatform = "xen";
-  };
-
   gruut = with python3.pkgs; toPythonApplication gruut;
 
   gruut-ipa = with python3.pkgs; toPythonApplication gruut-ipa;
@@ -9457,13 +9431,23 @@ with pkgs;
     )
     // {
       jdk-no-jcef = callPackage ../development/compilers/jetbrains-jdk {
+        jdk = jdk25;
+        withJcef = false;
+      };
+      jdk-no-jcef-21 = callPackage ../development/compilers/jetbrains-jdk/21.nix {
         jdk = jdk21;
         withJcef = false;
       };
       jdk = callPackage ../development/compilers/jetbrains-jdk {
+        jdk = jdk25;
+      };
+      jdk-21 = callPackage ../development/compilers/jetbrains-jdk/21.nix {
         jdk = jdk21;
       };
       jcef = callPackage ../development/compilers/jetbrains-jdk/jcef.nix {
+        jdk = jdk25;
+      };
+      jcef-21 = callPackage ../development/compilers/jetbrains-jdk/jcef.nix {
         jdk = jdk21;
       };
     }
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 586c53211817..7a721c264822 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -28193,10 +28193,10 @@ with self;
 
   Plack = buildPerlPackage {
     pname = "Plack";
-    version = "1.0050";
+    version = "1.0053";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/M/MI/MIYAGAWA/Plack-1.0050.tar.gz";
-      hash = "sha256-0mUa3oLrv/er4KOhifyTLa3Ed5GGzolGjlbQGJ6qbtQ=";
+      url = "mirror://cpan/authors/id/M/MI/MIYAGAWA/Plack-1.0053.tar.gz";
+      hash = "sha256-QPxEA0wWTpr3DdCP++5AjCQwLsDbMQ0pAd9xdTuxZ9o=";
     };
     buildInputs = [
       AuthenSimplePasswd
@@ -28226,6 +28226,7 @@ with self;
       TryTiny
     ];
     patches = [
+      ../development/perl-modules/Plack-xsendfile-disable-by-default-CVE-2026-7381.patch
       ../development/perl-modules/Plack-test-replace-DES-hash-with-bcrypt.patch
     ];
     meta = {
@@ -31355,10 +31356,10 @@ with self;
 
   Starman = buildPerlModule {
     pname = "Starman";
-    version = "0.4017";
+    version = "0.4018";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/M/MI/MIYAGAWA/Starman-0.4017.tar.gz";
-      hash = "sha256-b/q5FfMj9gCJ4+v4Urm5cH1pFyZt+K/XNw+sBL/f7k4=";
+      url = "mirror://cpan/authors/id/M/MI/MIYAGAWA/Starman-0.4018.tar.gz";
+      hash = "sha256-bY2yl9hRFB+k/3dI3/BVG+K6j5pELtnKrGRNvMmjbt0=";
     };
     buildInputs = [
       LWP
@@ -35965,10 +35966,10 @@ with self;
 
   TextCSV_XS = buildPerlPackage {
     pname = "Text-CSV_XS";
-    version = "1.52";
+    version = "1.62";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/H/HM/HMBRAND/Text-CSV_XS-1.52.tgz";
-      hash = "sha256-5BWqcFut+Es1ncTA8MmC8b9whIHaoUdW8xNufInA5B0=";
+      url = "mirror://cpan/authors/id/H/HM/HMBRAND/Text-CSV_XS-1.62.tgz";
+      hash = "sha256-FxBpPt2u/dVudNpCuqntZ25+rtKOvTA60jyYL+8rFBU=";
     };
     meta = {
       description = "Comma-Separated Values manipulation routines";