diff --git a/ci/OWNERS b/ci/OWNERS
index 2583a7bd71e4..99972715f8e4 100644
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -123,10 +123,6 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 /doc/redirects.json                @GetPsyched
 /nixos/doc/manual/redirects.json   @GetPsyched
 
-# NixOS integration test driver
-/nixos/lib/test-driver  @tfc
-/nixos/lib/testing      @tfc
-
 # NixOS QEMU virtualisation
 /nixos/modules/virtualisation/qemu-vm.nix                 @raitobezarius
 /nixos/modules/services/backup/libvirtd-autosnapshot.nix  @6543
@@ -520,3 +516,9 @@ pkgs/by-name/wa/warp-terminal/  @emilytrau @imadnyc @FlameFlag @johnrtitor
 
 # Zellij plugins
 /pkgs/by-name/ze/zellij/plugins/   @PerchunPak
+
+# Test-driver
+/nixos/lib/test-driver                                      @NixOS/test-driver
+/nixos/lib/testing                                          @NixOS/test-driver
+/nixos/tests/nixos-test-driver                              @NixOS/test-driver
+/nixos/modules/virtualisation/nspawn-container/run-nspawn   @NixOS/test-driver
diff --git a/maintainers/github-teams.json b/maintainers/github-teams.json
index e61912fb3a8e..b1901f4c40ec 100644
--- a/maintainers/github-teams.json
+++ b/maintainers/github-teams.json
@@ -556,8 +556,7 @@
     "members": {
       "Ericson2314": 1055245,
       "peterwaller-arm": 52030119,
-      "rrbutani": 7833358,
-      "sternenseemann": 3154475
+      "rrbutani": 7833358
     },
     "name": "LLVM"
   },
@@ -943,6 +942,7 @@
     },
     "members": {
       "andir": 638836,
+      "leona-ya": 11006031,
       "pyrox0": 35778371
     },
     "name": "Security review"
@@ -997,6 +997,17 @@
     },
     "name": "systemd"
   },
+  "test-driver": {
+    "description": "Maintain the NixOS integration test driver.",
+    "id": 18201265,
+    "maintainers": {
+      "Ma27": 6025220,
+      "kmein": 10352507,
+      "tfc": 29044
+    },
+    "members": {},
+    "name": "test-driver"
+  },
   "xen-project": {
     "description": "Maintain the Xen Project Hypervisor and the related tooling ecosystem. Members listed as \"Maintainers\" are recipients of Xen Security Advisories sent to xsa@nixos.org.",
     "id": 11127725,
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 9d9968c5491b..0195daa350c1 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -17968,6 +17968,12 @@
     githubId = 1575834;
     name = "Michael Adler";
   };
+  michaelAllen = {
+    name = "Michael Allen";
+    email = "mcallen71398@gmail.com";
+    github = "That1LinuxGuy";
+    githubId = 207959559;
+  };
   michaelBelsanti = {
     email = "mbels03@protonmail.com";
     name = "Mike Belsanti";
@@ -19102,7 +19108,8 @@
   };
   MysteryBlokHed = {
     name = "Adam Thompson-Sharpe";
-    email = "hi@adamts.me";
+    email = "nix@adamts.me";
+    matrix = "@adam:adamts.me";
     github = "MysteryBlokHed";
     githubId = 13910387;
     keys = [ { fingerprint = "086E EF20 D54E D348 E5BA  6263 16E9 43E6 596F FB4E"; } ];
diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 043e3f6336cd..c668a0afd975 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -747,10 +747,8 @@ with lib.maintainers;
     enableFeatureFreezePing = true;
   };
 
-  tests = {
-    members = [ tfc ];
-    scope = "Maintain the NixOS VM test runner.";
-    shortName = "NixOS tests";
+  test-driver = {
+    github = "test-driver";
     enableFeatureFreezePing = true;
   };
 
diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index 9404ebbdf846..6ccf062fd0c6 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -32,6 +32,11 @@
 
 - `boot.vesa` has been removed. It was deprecated in 2020 because Xorg now works better with kernel modesetting. If you still need the legacy VESA 800x600 fallback, set `boot.kernelParams = [ "vga=0x317" "nomodeset" ];` directly.
 
+- `authentik` has been updated to 2026.5.3, which changes the default listen address from `0.0.0.0` to `[::]`.
+  IPv4-only deployments might need to adjust their listen settings.
+  Deployments running the server and worker in the same network namespace must also set at least the worker
+  `AUTHENTIK_LISTEN__HTTP` address so that the server and worker do not bind to the same address.
+
 - Support for the legacy U‐Boot image format has been removed from the initrd generators, as it is deprecated upstream and no longer used by any platform in Nixpkgs.
 
 - Rustical migrates from `settings.http.host` and `settings.http.port` to `settings.http.bind` to support UNIX domain sockets as well as TCP sockets in one setting.
diff --git a/nixos/modules/config/swap.nix b/nixos/modules/config/swap.nix
index fa09b61ddec0..c99fd3ddf162 100644
--- a/nixos/modules/config/swap.nix
+++ b/nixos/modules/config/swap.nix
@@ -106,6 +106,11 @@ let
           description = "Path of the device or swap file.";
         };
 
+        isDevice = mkOption {
+          default = lib.substring 0 5 config.device == "/dev/";
+          internal = true;
+        };
+
         label = mkOption {
           example = "swap";
           type = types.str;
@@ -329,6 +334,7 @@ in
                   )
                 } ${sw.device} ${sw.deviceName}
                 mkswap ${sw.realDevice}
+                ${lib.optionalString sw.isDevice "udevadm trigger ${sw.realDevice}"}
               ''}
             '';
             enableStrictShellChecks = true;
diff --git a/nixos/modules/services/network-filesystems/glusterfs.nix b/nixos/modules/services/network-filesystems/glusterfs.nix
index db00cdc11abb..c218d5505566 100644
--- a/nixos/modules/services/network-filesystems/glusterfs.nix
+++ b/nixos/modules/services/network-filesystems/glusterfs.nix
@@ -180,7 +180,9 @@ in
       # Excludes one hook due to missing SELinux binaries.
       + ''
         mkdir -p /var/lib/glusterd/hooks/
-        ${rsync}/bin/rsync -a --exclude="S10selinux-label-brick.sh" ${glusterfs}/var/lib/glusterd/hooks/ /var/lib/glusterd/hooks/
+        # --copy-unsafe-links: the glusterfind hook is a symlink into the package's
+        # libexec that would dangle once copied verbatim into / (#257863).
+        ${rsync}/bin/rsync -a --copy-unsafe-links --exclude="S10selinux-label-brick.sh" ${glusterfs}/var/lib/glusterd/hooks/ /var/lib/glusterd/hooks/
 
         ${tlsCmd}
       ''
@@ -189,6 +191,12 @@ in
       + ''
         mkdir -p /var/lib/glusterd/glusterfind/.keys
         mkdir -p /var/lib/glusterd/hooks/1/delete/post/
+      ''
+      # Volume option presets, installed by upstream under $out/var; copy them so
+      # `gluster volume set <vol> group <name>` works (#33159).
+      + ''
+        mkdir -p /var/lib/glusterd/groups/
+        ${rsync}/bin/rsync -a ${glusterfs}/var/lib/glusterd/groups/ /var/lib/glusterd/groups/
       '';
 
       serviceConfig = {
diff --git a/nixos/modules/services/networking/keepalived/default.nix b/nixos/modules/services/networking/keepalived/default.nix
index 61f9d0b5afd9..6c4a44ca6c72 100644
--- a/nixos/modules/services/networking/keepalived/default.nix
+++ b/nixos/modules/services/networking/keepalived/default.nix
@@ -325,18 +325,28 @@ in
 
     assertions = flatten (map vrrpInstanceAssertions vrrpInstances);
 
-    networking.firewall = lib.mkIf cfg.openFirewall {
-      extraCommands = ''
-        # Allow VRRP and AH packets
-        ip46tables -A nixos-fw -p vrrp -m comment --comment "services.keepalived.openFirewall" -j ACCEPT
-        ip46tables -A nixos-fw -p ah -m comment --comment "services.keepalived.openFirewall" -j ACCEPT
-      '';
+    networking.firewall = lib.mkIf cfg.openFirewall (
+      if config.networking.nftables.enable then
+        {
+          extraInputRules = ''
+            meta l4proto vrrp counter accept comment "services.keepalived.openFirewall"
+            meta l4proto ah counter accept comment "services.keepalived.openFirewall"
+          '';
+        }
+      else
+        {
+          extraCommands = ''
+            # Allow VRRP and AH packets
+            ip46tables -A nixos-fw -p vrrp -m comment --comment "services.keepalived.openFirewall" -j ACCEPT
+            ip46tables -A nixos-fw -p ah -m comment --comment "services.keepalived.openFirewall" -j ACCEPT
+          '';
 
-      extraStopCommands = ''
-        ip46tables -D nixos-fw -p vrrp -m comment --comment "services.keepalived.openFirewall" -j ACCEPT
-        ip46tables -D nixos-fw -p ah -m comment --comment "services.keepalived.openFirewall" -j ACCEPT
-      '';
-    };
+          extraStopCommands = ''
+            ip46tables -D nixos-fw -p vrrp -m comment --comment "services.keepalived.openFirewall" -j ACCEPT
+            ip46tables -D nixos-fw -p ah -m comment --comment "services.keepalived.openFirewall" -j ACCEPT
+          '';
+        }
+    );
 
     systemd.timers.keepalived-boot-delay = {
       description = "Keepalive Daemon delay to avoid instant transition to MASTER state";
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 53e4142a375a..ff52d7052f2b 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -866,7 +866,7 @@ in
   kbd-setfont-decompress = runTest ./kbd-setfont-decompress.nix;
   kbd-update-search-paths-patch = runTest ./kbd-update-search-paths-patch.nix;
   kea = runTest ./kea.nix;
-  keepalived = runTest ./keepalived.nix;
+  keepalived = discoverTests (import ./keepalived.nix);
   keepassxc = runTest ./keepassxc.nix;
   kerberos = handleTest ./kerberos/default.nix { };
   kernel-generic = handleTest ./kernel-generic { };
diff --git a/nixos/tests/glusterfs.nix b/nixos/tests/glusterfs.nix
index 9224797704e2..ac4c8e7024f7 100644
--- a/nixos/tests/glusterfs.nix
+++ b/nixos/tests/glusterfs.nix
@@ -49,6 +49,14 @@ in
     server1.wait_for_unit("glusterd.service")
     server2.wait_for_unit("glusterd.service")
 
+    # The glusterfind delete hook must be a real file, not the dangling
+    # symlink it used to be after being copied out of the package (#257863).
+    server1.succeed("test -f /var/lib/glusterd/hooks/1/delete/post/S57glusterfind-delete-post")
+    server1.fail("test -L /var/lib/glusterd/hooks/1/delete/post/S57glusterfind-delete-post")
+
+    # The volume option presets must be installed (#33159).
+    server1.succeed("test -f /var/lib/glusterd/groups/metadata-cache")
+
     server1.wait_until_succeeds("gluster peer status")
     server2.wait_until_succeeds("gluster peer status")
 
@@ -64,6 +72,9 @@ in
     server1.succeed("gluster volume create gv0 server1:/data/vg0 server2:/data/vg0")
     server1.succeed("gluster volume start gv0")
 
+    # Applying a group preset needs /var/lib/glusterd/groups populated (#33159).
+    server1.succeed("gluster volume set gv0 group metadata-cache")
+
     # test clients
     client1.wait_for_unit("gluster.mount")
     client2.wait_for_unit("gluster.mount")
diff --git a/nixos/tests/keepalived.nix b/nixos/tests/keepalived.nix
index d5ffa6e9838d..2bc512446693 100644
--- a/nixos/tests/keepalived.nix
+++ b/nixos/tests/keepalived.nix
@@ -1,48 +1,60 @@
-{ pkgs, lib, ... }:
+let
+  mkTest =
+    { useNftables }:
+    import ./make-test-python.nix (
+      { pkgs, lib, ... }:
+      {
+        name = "keepalived-${if useNftables then "nftables" else "iptables"}";
+        meta.maintainers = [ lib.maintainers.raitobezarius ];
+
+        nodes = {
+          node1 =
+            { pkgs, ... }:
+            {
+              networking.nftables.enable = useNftables;
+              services.keepalived.enable = true;
+              services.keepalived.openFirewall = true;
+              services.keepalived.vrrpInstances.test = {
+                interface = "eth1";
+                state = "MASTER";
+                priority = 50;
+                virtualIps = [ { addr = "192.168.1.200"; } ];
+                virtualRouterId = 1;
+              };
+              environment.systemPackages = [ pkgs.tcpdump ];
+            };
+          node2 =
+            { pkgs, ... }:
+            {
+              networking.nftables.enable = useNftables;
+              services.keepalived.enable = true;
+              services.keepalived.openFirewall = true;
+              services.keepalived.vrrpInstances.test = {
+                interface = "eth1";
+                state = "MASTER";
+                priority = 100;
+                virtualIps = [ { addr = "192.168.1.200"; } ];
+                virtualRouterId = 1;
+              };
+              environment.systemPackages = [ pkgs.tcpdump ];
+            };
+        };
+
+        testScript = ''
+          # wait for boot time delay to pass
+          for node in [node1, node2]:
+              node.wait_until_succeeds(
+                "systemctl show -p LastTriggerUSecMonotonic keepalived-boot-delay.timer | grep -vq 'LastTriggerUSecMonotonic=0'"
+              )
+              node.wait_for_unit("keepalived")
+          node2.wait_until_succeeds("ip addr show dev eth1 | grep -q 192.168.1.200")
+          node1.fail("ip addr show dev eth1 | grep -q 192.168.1.200")
+          node1.succeed("ping -c1 192.168.1.200")
+        '';
+      }
+    );
+in
 {
-  name = "keepalived";
-  meta.maintainers = [ lib.maintainers.raitobezarius ];
-
-  nodes = {
-    node1 =
-      { pkgs, ... }:
-      {
-        services.keepalived.enable = true;
-        services.keepalived.openFirewall = true;
-        services.keepalived.vrrpInstances.test = {
-          interface = "eth1";
-          state = "MASTER";
-          priority = 50;
-          virtualIps = [ { addr = "192.168.1.200"; } ];
-          virtualRouterId = 1;
-        };
-        environment.systemPackages = [ pkgs.tcpdump ];
-      };
-    node2 =
-      { pkgs, ... }:
-      {
-        services.keepalived.enable = true;
-        services.keepalived.openFirewall = true;
-        services.keepalived.vrrpInstances.test = {
-          interface = "eth1";
-          state = "MASTER";
-          priority = 100;
-          virtualIps = [ { addr = "192.168.1.200"; } ];
-          virtualRouterId = 1;
-        };
-        environment.systemPackages = [ pkgs.tcpdump ];
-      };
-  };
-
-  testScript = ''
-    # wait for boot time delay to pass
-    for node in [node1, node2]:
-        node.wait_until_succeeds(
-            "systemctl show -p LastTriggerUSecMonotonic keepalived-boot-delay.timer | grep -vq 'LastTriggerUSecMonotonic=0'"
-        )
-        node.wait_for_unit("keepalived")
-    node2.wait_until_succeeds("ip addr show dev eth1 | grep -q 192.168.1.200")
-    node1.fail("ip addr show dev eth1 | grep -q 192.168.1.200")
-    node1.succeed("ping -c1 192.168.1.200")
-  '';
+  nftables = mkTest { useNftables = true; };
+  iptables = mkTest { useNftables = false; };
 }
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 8803e9335f17..3f970303d764 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -3650,6 +3650,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  cole-nvim = buildVimPlugin {
+    pname = "cole.nvim";
+    version = "0-unstable-2026-05-29";
+    src = fetchFromGitHub {
+      owner = "thekylehuang";
+      repo = "cole.nvim";
+      rev = "1920cfa31c717e1f73a5a6e5a2c02a44b5faeb5c";
+      hash = "sha256-k153XzTkkBm1qF6iKK8fzmAHIPnoIbXEAxAOQIoAPo0=";
+    };
+    meta.homepage = "https://github.com/thekylehuang/cole.nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   colibri-vim = buildVimPlugin {
     pname = "colibri.vim";
     version = "0-unstable-2019-06-15";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index c06733b9ec40..4f9d4e52d760 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -259,6 +259,7 @@ https://github.com/mrjones2014/codesettings.nvim/,,
 https://github.com/gorbit99/codewindow.nvim/,,
 https://github.com/johnseth97/codex.nvim/,,
 https://github.com/metakirby5/codi.vim/,,
+https://github.com/thekylehuang/cole.nvim/,,
 https://github.com/archseer/colibri.vim/,,
 https://github.com/tjdevries/colorbuddy.nvim/,,
 https://github.com/xzbdmw/colorful-menu.nvim/,,
diff --git a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
index 794db4af5815..1e8c18ecb051 100644
--- a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
@@ -21,26 +21,26 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-/ns84fHAyTY7sSvhUNzq1XQYq2Xy303zs2BxJY8DBVA=";
+          hash = "sha256-bsb0OLDPKWnNnZ4tFedYFiFKmTih81oZnaV/BH4p6o4=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-U69X5lpeJaeNVL4WWzCUpI6IfbKSJXGpl30AYnx1fBQ=";
+          hash = "sha256-PZBjzxg/kQbCiosd79YFDor1MvBHAdk167PmNIA8ANw=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-DHE09NtGNOjB0HdBqTKRtDsZXpxb651kiVGhRwO1tBU=";
+          hash = "sha256-z4OekFyKQsbva5mlBPR6z8g6Is0fwL+xZg/fjKf42cI=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-5YIZVBMsoF0bWP27sVEVHAaAiqvmoSUgdbc8wsqUCLA=";
+          hash = "sha256-gLFoIhxXKunB6ftLEq5p+rfjs8QM5PTOXElu3OtbeIo=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.187";
+      version = "2.1.191";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index e6145f602e5b..b1757ac4c2f2 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -4833,8 +4833,8 @@ let
         mktplcRef = {
           name = "emacs-mcx";
           publisher = "tuttieee";
-          version = "0.110.9";
-          hash = "sha256-xHu8GvBoZKMag7BdHddXyjm2IReMujs9cggOn4h32t8=";
+          version = "0.110.11";
+          hash = "sha256-LiiZI0Ze5F5w7OtiqY7wMpzdtyof/ynUH57wRfQnxFs=";
         };
         meta = {
           changelog = "https://github.com/whitphx/vscode-emacs-mcx/blob/main/CHANGELOG.md";
diff --git a/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix b/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix
index 45b11b86e835..c86912e97cb3 100644
--- a/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix
+++ b/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "dosbox-pure";
-  version = "0-unstable-2026-06-16";
+  version = "0-unstable-2026-06-26";
 
   src = fetchFromGitHub {
     owner = "schellingb";
     repo = "dosbox-pure";
-    rev = "5ec3ccfb4313d452c3b3faccea97443ba3d9db4d";
-    hash = "sha256-GFPh2z31vnACo8EEe83YRd7SVcPsSIe/vnPivaE2JYg=";
+    rev = "424f2dfd6d08c587020857421b89a5d9acda4beb";
+    hash = "sha256-QkHgLWW+gk106wNeF5bKYsA4e6IKPiXakWb92AImRQc=";
   };
 
   hardeningDisable = [ "format" ];
diff --git a/pkgs/applications/emulators/libretro/cores/fceumm.nix b/pkgs/applications/emulators/libretro/cores/fceumm.nix
index af55857f56dc..e2c485bc5ad5 100644
--- a/pkgs/applications/emulators/libretro/cores/fceumm.nix
+++ b/pkgs/applications/emulators/libretro/cores/fceumm.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "fceumm";
-  version = "0-unstable-2026-06-15";
+  version = "0-unstable-2026-06-23";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-fceumm";
-    rev = "c0c52ad0eb36cdbfc66e9bdb72efc83103e85e22";
-    hash = "sha256-e81kpVUTz3l9wqCwN9Zf4LrnskPRW7Ewy78/1BApZlg=";
+    rev = "f87bc875bd68262211e2e01ffbaf3662626a3e4f";
+    hash = "sha256-TUrhDbRArO/RISZawu5p9FIZlFf8pPlBrD9WRrdSRPk=";
   };
 
   meta = {
diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index bf2bd624c1ea..fc3ece2ce796 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -823,7 +823,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "149.0.7827.155",
+    "version": "149.0.7827.196",
     "deps": {
       "depot_tools": {
         "rev": "45dedc4c3b87c982fd846b3dc599b233ed3aff90",
@@ -835,16 +835,16 @@
         "hash": "sha256-oFs7fZAZEs/gQ7X1A4uigo9+Y+iEN9sMMQYwAjEuD04="
       },
       "ungoogled-patches": {
-        "rev": "149.0.7827.155-1",
-        "hash": "sha256-+DviTrU7mdY3YQIIUzFh0DbFKUokQI8+lmQslUZdNSU="
+        "rev": "149.0.7827.196-1",
+        "hash": "sha256-nRcMTP+su+mFP/JkyLBIDrG+dKYhvPANFw0Y8qVWzrA="
       },
       "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "07b52360cc15066f987c910ab34dfbcd4a8778d2",
-        "hash": "sha256-D9RKH0kzEfaMsCDnFFIGCGLyfhghnGMOLA0XmOa9MtI=",
+        "rev": "43eb30368c6ca3d14d540487954abb2780aeae3a",
+        "hash": "sha256-pwSfASgR4SiQTJBERhOVyR8mANYJk67f+u2pmCCW6ko=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -914,8 +914,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "591ee1999d950f2bc54be89651eb62c8d7925314",
-        "hash": "sha256-crooDCkJ6voJyDBIUvtjmXnA4xOx7YmGltuf2ulTLIk="
+        "rev": "355cc61af2aadd8f0494800325b2bf9908138108",
+        "hash": "sha256-fgaCyO0oaz90aTaWMHH8ocySA0hXDHsPEl6vtMj4BY0="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -954,8 +954,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "5f4c5ef509c5ffa65822302341cf9b2ccad471f9",
-        "hash": "sha256-h+0Gep+RWTTEVoRrXCRDCtHdbYlSYdNK1botahtqUX0="
+        "rev": "54b4153cfef88e048f365f99b962478f0087dfe8",
+        "hash": "sha256-Bv30zz/pCNVzUl+mKCpusWc94poytv9ZFelZIcs+2B8="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1639,8 +1639,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "6511f6cfab1f24c360d0fb737d205c27da48a623",
-        "hash": "sha256-Dpe0Z/zjdPlOlqi85c9QSr7rLs7dww+a/BY68B2MTCw="
+        "rev": "933ce636c562cd54d68e7f7c93ab5cdffd685fca",
+        "hash": "sha256-zYArO6QS9nDIVWPINRVaDN1uX8X/wchBDeZHPZnwHYk="
       }
     }
   }
diff --git a/pkgs/applications/networking/cluster/helm/default.nix b/pkgs/applications/networking/cluster/helm/default.nix
index d43e65372887..485dc46f3aa5 100644
--- a/pkgs/applications/networking/cluster/helm/default.nix
+++ b/pkgs/applications/networking/cluster/helm/default.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubernetes-helm";
-  version = "4.2.1";
+  version = "4.2.2";
 
   src = fetchFromGitHub {
     owner = "helm";
     repo = "helm";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-k2lZXdWYnewNiZdLNQrC5j9A3JkvYCwMY486QxjCpaw=";
+    hash = "sha256-khyxnEeyxpgEO7rWKsEPqPLNSDZmFGqAZBrfb0TY8BU=";
   };
 
   vendorHash = "sha256-XIKQF9PWgxKJUt66wQ/mPhWVfJnra0vV9ZuyclgQ21U=";
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 7894a662cdd3..fe1ba8ef2258 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -508,13 +508,13 @@
     "vendorHash": "sha256-ikBqIxD5aTOcwNHCMN6EaOwSHCAP5n/SULuqQXPLpOc="
   },
   "hashicorp_aws": {
-    "hash": "sha256-kWA/cpYQ8MynW/vxnj7Yys6lsFdRAmfC8N6bmEIOW70=",
+    "hash": "sha256-710i6mRyieTzltcaC23OXZm8mtqjyOc5Fk9fmcqkXY4=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
     "owner": "hashicorp",
     "repo": "terraform-provider-aws",
-    "rev": "v6.50.0",
+    "rev": "v6.52.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Msl/Mn0GK3D+QyLnSFU3m9ux/ThkwDCDh85b0Yzpnjo="
+    "vendorHash": "sha256-COWHnLR6aRwcGJVo6IFvqQLwAYxFpqUGQbZVvEo/b/I="
   },
   "hashicorp_awscc": {
     "hash": "sha256-ZQaBYZTsF68IjbRYa3Z7VRqKfaHCvOtMkJHsybJn+ec=",
diff --git a/pkgs/applications/video/vdr/softhddevice/default.nix b/pkgs/applications/video/vdr/softhddevice/default.nix
index b26be178e0d4..47332670d014 100644
--- a/pkgs/applications/video/vdr/softhddevice/default.nix
+++ b/pkgs/applications/video/vdr/softhddevice/default.nix
@@ -16,12 +16,12 @@
 }:
 stdenv.mkDerivation rec {
   pname = "vdr-softhddevice";
-  version = "2.4.8";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "ua0lnj";
     repo = "vdr-plugin-softhddevice";
-    sha256 = "sha256-pQ437Du++L6KhBCqkHpiYCoT713RAB+rnoGCXr5M0S4=";
+    sha256 = "sha256-vicHneEZZHTraffUek77QDZdv/xZGzN102nbr1Bkfzo=";
     rev = "v${version}";
   };
 
diff --git a/pkgs/build-support/rust/fetch-cargo-vendor-util-v2.py b/pkgs/build-support/rust/fetch-cargo-vendor-util-v2.py
deleted file mode 100644
index 5dc789c93ad9..000000000000
--- a/pkgs/build-support/rust/fetch-cargo-vendor-util-v2.py
+++ /dev/null
@@ -1,416 +0,0 @@
-import functools
-import hashlib
-import json
-import multiprocessing as mp
-import re
-import shutil
-import subprocess
-import sys
-import tomllib
-from os.path import islink, realpath
-from pathlib import Path
-from typing import Any, TypedDict, cast
-from urllib.parse import unquote
-
-import requests
-import tomli_w
-from requests.adapters import HTTPAdapter, Retry
-
-eprint = functools.partial(print, file=sys.stderr)
-
-
-def load_toml(path: Path) -> dict[str, Any]:
-    with open(path, "rb") as f:
-        return tomllib.load(f)
-
-
-def get_lockfile_version(cargo_lock_toml: dict[str, Any]) -> int:
-    # lockfile v1 and v2 don't have the `version` key, so assume v2
-    version = cargo_lock_toml.get("version", 2)
-
-    # TODO: add logic for differentiating between v1 and v2
-
-    return version
-
-
-def create_http_session() -> requests.Session:
-    retries = Retry(
-        total=5,
-        backoff_factor=0.5,
-        status_forcelist=[500, 502, 503, 504]
-    )
-    session = requests.Session()
-    session.headers["User-Agent"] = "nixpkgs-fetchCargoVendor/2 (https://github.com/NixOS/nixpkgs)"
-    session.mount('http://', HTTPAdapter(max_retries=retries))
-    session.mount('https://', HTTPAdapter(max_retries=retries))
-    return session
-
-
-def download_file_with_checksum(session: requests.Session, url: str, destination_path: Path) -> str:
-    sha256_hash = hashlib.sha256()
-    with session.get(url, stream=True) as response:
-        if not response.ok:
-            raise Exception(f"Failed to fetch file from {url}. Status code: {response.status_code}")
-        with open(destination_path, "wb") as file:
-            for chunk in response.iter_content(1024):  # Download in chunks
-                if chunk:  # Filter out keep-alive chunks
-                    file.write(chunk)
-                    sha256_hash.update(chunk)
-
-    # Compute the final checksum
-    checksum = sha256_hash.hexdigest()
-    return checksum
-
-
-def get_download_url_for_tarball(pkg: dict[str, Any]) -> str:
-    # TODO: support other registries
-    #       maybe fetch config.json from the registry root and get the dl key
-    #       See: https://doc.rust-lang.org/cargo/reference/registry-index.html#index-configuration
-    if pkg["source"] != "registry+https://github.com/rust-lang/crates.io-index":
-        raise Exception("Only the default crates.io registry is supported.")
-
-    # Use static.crates.io (CDN) instead of crates.io/api to avoid the 1 req/sec
-    # rate limit on the API servers.
-    return f"https://static.crates.io/crates/{pkg["name"]}/{pkg["version"]}/download"
-
-
-def download_tarball(session: requests.Session, pkg: dict[str, Any], out_dir: Path) -> None:
-
-    url = get_download_url_for_tarball(pkg)
-    filename = f"{pkg["name"]}-{pkg["version"]}.tar.gz"
-
-    # TODO: allow legacy checksum specification, see importCargoLock for example
-    #       also, don't forget about the other usage of the checksum
-    expected_checksum = pkg["checksum"]
-
-    tarball_out_dir = out_dir / "tarballs" / filename
-    eprint(f"Fetching {url} -> tarballs/{filename}")
-
-    calculated_checksum = download_file_with_checksum(session, url, tarball_out_dir)
-
-    if calculated_checksum != expected_checksum:
-        raise Exception(f"Hash mismatch! File fetched from {url} had checksum {calculated_checksum}, expected {expected_checksum}.")
-
-
-def download_git_tree(url: str, git_sha_rev: str, out_dir: Path) -> None:
-
-    tree_out_dir = out_dir / "git" / git_sha_rev
-    eprint(f"Fetching {url}#{git_sha_rev} -> git/{git_sha_rev}")
-
-    cmd = ["nix-prefetch-git", "--builder", "--quiet", "--fetch-submodules", "--url", url, "--rev", git_sha_rev, "--out", str(tree_out_dir)]
-    subprocess.check_output(cmd)
-
-
-GIT_SOURCE_REGEX = re.compile("git\\+(?P<url>[^?]+)(\\?(?P<type>rev|tag|branch)=(?P<value>.*))?#(?P<git_sha_rev>.*)")
-
-
-class GitSourceInfo(TypedDict):
-    url: str
-    type: str | None
-    value: str | None
-    git_sha_rev: str
-
-
-def parse_git_source(source: str, lockfile_version: int) -> GitSourceInfo:
-    match = GIT_SOURCE_REGEX.match(source)
-    if match is None:
-        raise Exception(f"Unable to process git source: {source}.")
-
-    source_info = cast(GitSourceInfo, match.groupdict(default=None))
-
-    # the source URL is URL-encoded in lockfile_version >=4
-    # since we just used regex to parse it we have to manually decode the escaped branch/tag name
-    if lockfile_version >= 4 and source_info["value"] is not None:
-        source_info["value"] = unquote(source_info["value"])
-
-    return source_info
-
-
-def create_vendor_staging(lockfile_path: Path, out_dir: Path) -> None:
-    cargo_lock_toml = load_toml(lockfile_path)
-    lockfile_version = get_lockfile_version(cargo_lock_toml)
-
-    git_packages: list[dict[str, Any]] = []
-    registry_packages: list[dict[str, Any]] = []
-
-    for pkg in cargo_lock_toml["package"]:
-        # ignore local dependenices
-        if "source" not in pkg.keys():
-            eprint(f"Skipping local dependency: {pkg["name"]}")
-            continue
-        source = pkg["source"]
-
-        if source.startswith("git+"):
-            git_packages.append(pkg)
-        elif source.startswith("registry+"):
-            registry_packages.append(pkg)
-        else:
-            raise Exception(f"Can't process source: {source}.")
-
-    git_sha_rev_to_url: dict[str, str] = {}
-    for pkg in git_packages:
-        source_info = parse_git_source(pkg["source"], lockfile_version)
-        git_sha_rev_to_url[source_info["git_sha_rev"]] = source_info["url"]
-
-    out_dir.mkdir(exist_ok=True)
-    shutil.copy(lockfile_path, out_dir / "Cargo.lock")
-
-    # fetch git trees sequentially, since fetching concurrently leads to flaky behaviour
-    if len(git_packages) != 0:
-        (out_dir / "git").mkdir()
-        for git_sha_rev, url in git_sha_rev_to_url.items():
-            download_git_tree(url, git_sha_rev, out_dir)
-
-    # run tarball download jobs in parallel, with at most 5 concurrent download jobs
-    with mp.Pool(min(5, mp.cpu_count())) as pool:
-        if len(registry_packages) != 0:
-            (out_dir / "tarballs").mkdir()
-            session = create_http_session()
-            tarball_args_gen = ((session, pkg, out_dir) for pkg in registry_packages)
-            pool.starmap(download_tarball, tarball_args_gen)
-
-
-def get_manifest_metadata(manifest_path: Path) -> dict[str, Any]:
-    cmd = ["cargo", "metadata", "--format-version", "1", "--no-deps", "--manifest-path", str(manifest_path)]
-    output = subprocess.check_output(cmd)
-    return json.loads(output)
-
-
-def try_get_crate_manifest_path_from_manifest_path(manifest_path: Path, crate_name: str) -> Path | None:
-    try:
-        metadata = get_manifest_metadata(manifest_path)
-    except subprocess.CalledProcessError:
-        eprint(f"Warning: cargo metadata failed for {manifest_path}, skipping")
-        return None
-
-    for pkg in metadata["packages"]:
-        if pkg["name"] == crate_name:
-            return Path(pkg["manifest_path"])
-
-    return None
-
-
-def find_crate_manifest_in_tree(tree: Path, crate_name: str) -> Path:
-    # Scan all Cargo.toml files; sort by depth/path to make ordering deterministic
-    # and prefer less-nested manifests first.
-    manifest_paths = sorted(
-        tree.glob("**/Cargo.toml"),
-        key=lambda path: (len(path.parts), str(path)),
-    )
-
-    for manifest_path in manifest_paths:
-        res = try_get_crate_manifest_path_from_manifest_path(manifest_path, crate_name)
-        if res is not None:
-            return res
-
-    raise Exception(f"Couldn't find manifest for crate {crate_name} inside {tree}.")
-
-
-def copy_and_patch_git_crate_subtree(git_tree: Path, crate_name: str, crate_out_dir: Path) -> None:
-
-    # This function will get called by copytree to decide which entries of a directory should be copied
-    # We'll copy everything except symlinks that are invalid
-    def ignore_func(dir_str: str, path_strs: list[str]) -> list[str]:
-        ignorelist: list[str] = []
-
-        dir = Path(realpath(dir_str, strict=True))
-
-        for path_str in path_strs:
-            path = dir / path_str
-            if not islink(path):
-                continue
-
-            # Filter out cyclic symlinks and symlinks pointing at nonexistant files
-            try:
-                target_path = Path(realpath(path, strict=True))
-            except OSError:
-                ignorelist.append(path_str)
-                eprint(f"Failed to resolve symlink, ignoring: {path}")
-                continue
-
-            # Filter out symlinks that point outside of the current crate's base git tree
-            # This can be useful if the nix build sandbox is turned off and there is a symlink to a common absolute path
-            if not target_path.is_relative_to(git_tree):
-                ignorelist.append(path_str)
-                eprint(f"Symlink points outside of the crate's base git tree, ignoring: {path} -> {target_path}")
-                continue
-
-        return ignorelist
-
-    crate_manifest_path = find_crate_manifest_in_tree(git_tree, crate_name)
-    crate_tree = crate_manifest_path.parent
-
-    eprint(f"Copying to {crate_out_dir}")
-    shutil.copytree(crate_tree, crate_out_dir, ignore=ignore_func)
-    crate_out_dir.chmod(0o755)
-
-    with open(crate_manifest_path, "r") as f:
-        manifest_data = f.read()
-
-    if "workspace" in manifest_data:
-        crate_manifest_metadata = get_manifest_metadata(crate_manifest_path)
-        workspace_root = Path(crate_manifest_metadata["workspace_root"])
-
-        root_manifest_path = workspace_root / "Cargo.toml"
-        manifest_path = crate_out_dir / "Cargo.toml"
-
-        manifest_path.chmod(0o644)
-        eprint(f"Patching {manifest_path}")
-
-        cmd = ["replace-workspace-values", str(manifest_path), str(root_manifest_path)]
-        subprocess.check_output(cmd)
-
-
-def extract_crate_tarball_contents(tarball_path: Path, crate_out_dir: Path) -> None:
-    eprint(f"Unpacking to {crate_out_dir}")
-    crate_out_dir.mkdir()
-    cmd = ["tar", "xf", str(tarball_path), "-C", str(crate_out_dir), "--strip-components=1"]
-    subprocess.check_output(cmd)
-
-
-def make_git_source_selector(source_info: GitSourceInfo) -> dict[str, str]:
-    selector = {}
-    selector["git"] = source_info["url"]
-    if source_info["type"] is not None:
-        selector[source_info["type"]] = source_info["value"]
-    return selector
-
-
-def make_registry_source_selector(source: str) -> dict[str, str]:
-    registry = source[9:] if source.startswith("registry+") else source
-    selector = {}
-    selector["registry"] = registry
-    return selector
-
-
-def create_vendor(vendor_staging_dir: Path, out_dir: Path) -> None:
-    lockfile_path = vendor_staging_dir / "Cargo.lock"
-    out_dir.mkdir(exist_ok=True)
-    shutil.copy(lockfile_path, out_dir / "Cargo.lock")
-
-    cargo_lock_toml = load_toml(lockfile_path)
-    lockfile_version = get_lockfile_version(cargo_lock_toml)
-
-    source_to_ind: dict[str, str] = {}
-    source_config = {}
-    next_registry_ind = 0
-    next_git_ind = 0
-
-    def add_source_replacement(
-        orig_key: str,
-        orig_selector: dict[str, str],
-        vendored_key: str,
-        vendored_dir: str
-    ) -> None:
-        source_config[vendored_key] = {}
-        source_config[vendored_key]["directory"] = vendored_dir
-        source_config[orig_key] = orig_selector
-        source_config[orig_key]["replace-with"] = vendored_key
-
-    # we reserve registry index 0 for crates-io
-    source_to_ind["registry+https://github.com/rust-lang/crates.io-index"] = "registry-0"
-    source_to_ind["sparse+https://index.crates.io/"] = "registry-0"
-    add_source_replacement(
-        orig_key="crates-io",
-        orig_selector={},  # there is an internal selector defined for the `crates-io` source
-        vendored_key="vendored-source-registry-0",
-        vendored_dir="@vendor@/source-registry-0"
-    )
-    next_registry_ind += 1
-
-    for pkg in cargo_lock_toml["package"]:
-        # ignore local dependencies
-        if "source" not in pkg.keys():
-            continue
-        source: str = pkg["source"]
-        if source in source_to_ind:
-            continue
-
-        if source.startswith("git+"):
-            ind = f"git-{next_git_ind}"
-            next_git_ind += 1
-            source_info = parse_git_source(source, lockfile_version)
-            selector = make_git_source_selector(source_info)
-        elif source.startswith("registry+") or source.startswith("sparse+"):
-            ind = f"registry-{next_registry_ind}"
-            next_registry_ind += 1
-            selector = make_registry_source_selector(source)
-        else:
-            raise Exception(f"Can't process source: {source}.")
-
-        source_to_ind[source] = ind
-        add_source_replacement(
-            orig_key=f"original-source-{ind}",
-            orig_selector=selector,
-            vendored_key=f"vendored-source-{ind}",
-            vendored_dir=f"@vendor@/source-{ind}"
-        )
-
-    config_path = out_dir / ".cargo" / "config.toml"
-    config_path.parent.mkdir()
-
-    with open(config_path, "wb") as config_file:
-        tomli_w.dump({"source": source_config}, config_file)
-
-    for pkg in cargo_lock_toml["package"]:
-
-        # ignore local dependenices
-        if "source" not in pkg.keys():
-            continue
-
-        source: str = pkg["source"]
-        source_ind = source_to_ind[source]
-        crate_dir_name = f"{pkg["name"]}-{pkg["version"]}"
-        source_dir_name = f"source-{source_ind}"
-        crate_out_dir = out_dir / source_dir_name / crate_dir_name
-        crate_out_dir.parent.mkdir(exist_ok=True)
-
-        if source.startswith("git+"):
-
-            source_info = parse_git_source(source, lockfile_version)
-
-            git_sha_rev = source_info["git_sha_rev"]
-            git_tree = vendor_staging_dir / "git" / git_sha_rev
-
-            copy_and_patch_git_crate_subtree(git_tree, pkg["name"], crate_out_dir)
-
-            # git based crates allow having no checksum information
-            with open(crate_out_dir / ".cargo-checksum.json", "w") as f:
-                json.dump({"files": {}}, f)
-
-        elif source.startswith("registry+") or source.startswith("sparse+"):
-            filename = f"{pkg["name"]}-{pkg["version"]}.tar.gz"
-
-            # TODO: change this when non-crates-io registries are supported
-            dir_name = "tarballs"
-
-            tarball_path = vendor_staging_dir / dir_name / filename
-
-            extract_crate_tarball_contents(tarball_path, crate_out_dir)
-
-            # non-git based crates need the package checksum at minimum
-            with open(crate_out_dir / ".cargo-checksum.json", "w") as f:
-                json.dump({"files": {}, "package": pkg["checksum"]}, f)
-
-        else:
-            raise Exception(f"Can't process source: {source}.")
-
-
-def main() -> None:
-    subcommand = sys.argv[1]
-
-    subcommand_func_dict = {
-        "create-vendor-staging": lambda: create_vendor_staging(lockfile_path=Path(sys.argv[2]), out_dir=Path(sys.argv[3])),
-        "create-vendor": lambda: create_vendor(vendor_staging_dir=Path(sys.argv[2]), out_dir=Path(sys.argv[3]))
-    }
-
-    subcommand_func = subcommand_func_dict.get(subcommand)
-
-    if subcommand_func is None:
-        raise Exception(f"Unknown subcommand: '{subcommand}'. Must be one of {list(subcommand_func_dict.keys())}")
-
-    subcommand_func()
-
-
-if __name__ == "__main__":
-    main()
diff --git a/pkgs/build-support/rust/fetch-cargo-vendor-util.py b/pkgs/build-support/rust/fetch-cargo-vendor-util.py
index 3bee7e150c8e..825f07b175ee 100644
--- a/pkgs/build-support/rust/fetch-cargo-vendor-util.py
+++ b/pkgs/build-support/rust/fetch-cargo-vendor-util.py
@@ -40,6 +40,7 @@ def create_http_session() -> requests.Session:
         status_forcelist=[500, 502, 503, 504]
     )
     session = requests.Session()
+    session.headers["User-Agent"] = "nixpkgs-fetchCargoVendor/2 (https://github.com/NixOS/nixpkgs)"
     session.mount('http://', HTTPAdapter(max_retries=retries))
     session.mount('https://', HTTPAdapter(max_retries=retries))
     return session
@@ -68,7 +69,9 @@ def get_download_url_for_tarball(pkg: dict[str, Any]) -> str:
     if pkg["source"] != "registry+https://github.com/rust-lang/crates.io-index":
         raise Exception("Only the default crates.io registry is supported.")
 
-    return f"https://crates.io/api/v1/crates/{pkg["name"]}/{pkg["version"]}/download"
+    # Use static.crates.io (CDN) instead of crates.io/api to avoid the 1 req/sec
+    # rate limit on the API servers.
+    return f"https://static.crates.io/crates/{pkg["name"]}/{pkg["version"]}/download"
 
 
 def download_tarball(session: requests.Session, pkg: dict[str, Any], out_dir: Path) -> None:
@@ -289,6 +292,7 @@ def create_vendor(vendor_staging_dir: Path, out_dir: Path) -> None:
     lockfile_version = get_lockfile_version(cargo_lock_toml)
 
     source_to_ind: dict[str, str] = {}
+    selector_to_ind: dict[tuple, str] = {}
     source_config = {}
     next_registry_ind = 0
     next_git_ind = 0
@@ -324,24 +328,35 @@ def create_vendor(vendor_staging_dir: Path, out_dir: Path) -> None:
             continue
 
         if source.startswith("git+"):
-            ind = f"git-{next_git_ind}"
-            next_git_ind += 1
             source_info = parse_git_source(source, lockfile_version)
             selector = make_git_source_selector(source_info)
+            selector_key = (source_info["url"], source_info["type"], source_info["value"])
+            if selector_key in selector_to_ind:
+                ind = selector_to_ind[selector_key]
+            else:
+                ind = f"git-{next_git_ind}"
+                next_git_ind += 1
+                selector_to_ind[selector_key] = ind
+                add_source_replacement(
+                    orig_key=f"original-source-{ind}",
+                    orig_selector=selector,
+                    vendored_key=f"vendored-source-{ind}",
+                    vendored_dir=f"@vendor@/source-{ind}"
+                )
         elif source.startswith("registry+") or source.startswith("sparse+"):
             ind = f"registry-{next_registry_ind}"
             next_registry_ind += 1
             selector = make_registry_source_selector(source)
+            add_source_replacement(
+                orig_key=f"original-source-{ind}",
+                orig_selector=selector,
+                vendored_key=f"vendored-source-{ind}",
+                vendored_dir=f"@vendor@/source-{ind}"
+            )
         else:
             raise Exception(f"Can't process source: {source}.")
 
         source_to_ind[source] = ind
-        add_source_replacement(
-            orig_key=f"original-source-{ind}",
-            orig_selector=selector,
-            vendored_key=f"vendored-source-{ind}",
-            vendored_dir=f"@vendor@/source-{ind}"
-        )
 
     config_path = out_dir / ".cargo" / "config.toml"
     config_path.parent.mkdir()
diff --git a/pkgs/build-support/rust/fetch-cargo-vendor.nix b/pkgs/build-support/rust/fetch-cargo-vendor.nix
index 2802bf9e73f1..8d554a8dc3e2 100644
--- a/pkgs/build-support/rust/fetch-cargo-vendor.nix
+++ b/pkgs/build-support/rust/fetch-cargo-vendor.nix
@@ -37,29 +37,18 @@ let
     "hash"
   ];
 
-  mkFetchCargoVendorUtil =
-    name: src:
-    writers.writePython3Bin name {
-      libraries =
-        with python3Packages;
-        [
-          requests
-          tomli-w
-        ]
-        ++ requests.optional-dependencies.socks; # to support socks proxy envs like ALL_PROXY in requests
-      flakeIgnore = [
-        "E501"
-      ];
-    } (builtins.readFile src);
-
-  # Separate util used only by the FOD `vendorStaging` stage below. Kept
-  # distinct from fetchCargoVendorUtil so that changes to the network-facing
-  # bits (User-Agent, download URL) don't invalidate the input-addressed
-  # `-vendor` stage and force a mass rebuild of every Rust package in nixpkgs.
-  # vendorStaging is an FOD, so swapping its util is free for consumers.
-  # TODO: unify with fetchCargoVendorUtil on the next `staging` cycle.
-  fetchCargoVendorUtilV2 = mkFetchCargoVendorUtil "fetch-cargo-vendor-util-v2" ./fetch-cargo-vendor-util-v2.py;
-  fetchCargoVendorUtil = mkFetchCargoVendorUtil "fetch-cargo-vendor-util" ./fetch-cargo-vendor-util.py;
+  fetchCargoVendorUtil = writers.writePython3Bin "fetch-cargo-vendor-util" {
+    libraries =
+      with python3Packages;
+      [
+        requests
+        tomli-w
+      ]
+      ++ requests.optional-dependencies.socks; # to support socks proxy envs like ALL_PROXY in requests
+    flakeIgnore = [
+      "E501"
+    ];
+  } (builtins.readFile ./fetch-cargo-vendor-util.py);
 in
 
 {
@@ -79,7 +68,7 @@ let
       impureEnvVars = lib.fetchers.proxyImpureEnvVars;
 
       nativeBuildInputs = [
-        fetchCargoVendorUtilV2
+        fetchCargoVendorUtil
         cacert
         nix-prefetch-git'
       ]
@@ -92,7 +81,7 @@ let
           cd "$cargoRoot"
         fi
 
-        fetch-cargo-vendor-util-v2 create-vendor-staging ./Cargo.lock "$out"
+        fetch-cargo-vendor-util create-vendor-staging ./Cargo.lock "$out"
 
         runHook postBuild
       '';
diff --git a/pkgs/by-name/an/anytype-cli/package.nix b/pkgs/by-name/an/anytype-cli/package.nix
index b8eacca1f8e7..271bdc067508 100644
--- a/pkgs/by-name/an/anytype-cli/package.nix
+++ b/pkgs/by-name/an/anytype-cli/package.nix
@@ -9,16 +9,16 @@ buildGoModule (finalAttrs: {
   __structuredAttrs = true;
 
   pname = "anytype-cli";
-  version = "0.3.5";
+  version = "0.3.6";
 
   src = fetchFromGitHub {
     owner = "anyproto";
     repo = "anytype-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+GVV5HiOB/589IKRs+uJaK8X29MCg5cv0C8u6spb7Jg=";
+    hash = "sha256-T/mdF+pzApm15Cg2g1ybgU7pEHLsTC4jD7WuXzNqM2M=";
   };
 
-  vendorHash = "sha256-uxKDO55CQYn50XpnlP5tv5Rcl6+fq7nsOD7/2foRZX8=";
+  vendorHash = "sha256-S6Xb2XYAn/cTC++1WK5cmXcC6QCZpPoYMRrjk/IPKas=";
   proxyVendor = true;
 
   env.CGO_ENABLED = 1;
diff --git a/pkgs/by-name/ap/aptly/package.nix b/pkgs/by-name/ap/aptly/package.nix
index 170332fc2c95..dfbd7332551b 100644
--- a/pkgs/by-name/ap/aptly/package.nix
+++ b/pkgs/by-name/ap/aptly/package.nix
@@ -14,16 +14,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "aptly";
-  version = "1.6.2";
+  version = "1.6.3";
 
   src = fetchFromGitHub {
     owner = "aptly-dev";
     repo = "aptly";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Jkljg05C4GJ4F9l6mKAU4JCH8I0/bjzfb74X714z4UI=";
+    hash = "sha256-fjNN8EffY9G8YX/uME5ehs2zZj/YRA62y/muqigWSnE=";
   };
 
-  vendorHash = "sha256-3pFVAVvIpJut2YYxvnCQbBpdwwmUbZIyrx0WoQrU+nQ=";
+  vendorHash = "sha256-QPYKdiEiV1iS3xJ3A66ILUXAlj0TGXuGf11wzdX3Z7Y=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/as/assimp/package.nix b/pkgs/by-name/as/assimp/package.nix
index 717fd1a0746f..24769c4a231c 100644
--- a/pkgs/by-name/as/assimp/package.nix
+++ b/pkgs/by-name/as/assimp/package.nix
@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "assimp";
-  version = "6.0.4";
+  version = "6.0.5";
   outputs = [
     "out"
     "lib"
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "assimp";
     repo = "assimp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ryTgsN0z9BZBz7i9aUMKuneN5oqfxpduwJlb+Q0q3Mk=";
+    hash = "sha256-QWBi1pl5C76UtPhB6SmFipm9oEdnfhELMT3MqfV6oxg=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/at/at-spi2-core/package.nix b/pkgs/by-name/at/at-spi2-core/package.nix
index dd5e8f9e4ce1..c20443184374 100644
--- a/pkgs/by-name/at/at-spi2-core/package.nix
+++ b/pkgs/by-name/at/at-spi2-core/package.nix
@@ -29,7 +29,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "at-spi2-core";
-  version = "2.60.1";
+  version = "2.60.4";
 
   outputs = [
     "out"
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/at-spi2-core/${lib.versions.majorMinor finalAttrs.version}/at-spi2-core-${finalAttrs.version}.tar.xz";
-    hash = "sha256-+ZuH48FnT1+8QXzJwdniYcDymqsFUK1jaYBQMdEvaFI=";
+    hash = "sha256-Gh9bqYBZF/QfxqpoI9z4h6KR1gekJ+LVr7a136ZQcMc=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/au/audit/package.nix b/pkgs/by-name/au/audit/package.nix
index 197df3501597..3b2389e7843c 100644
--- a/pkgs/by-name/au/audit/package.nix
+++ b/pkgs/by-name/au/audit/package.nix
@@ -30,13 +30,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "audit";
-  version = "4.1.2-unstable-2025-09-06"; # fixes to non-static builds right after 4.1.2 release
+  version = "4.1.4";
 
   src = fetchFromGitHub {
     owner = "linux-audit";
     repo = "audit-userspace";
-    rev = "cb13fe75ee2c36d5c525ed9de22aae10dbc8caf4";
-    hash = "sha256-NX0TWA+LtcZgbM9aQfokWv2rGNAAb3ksGqAH8URAkYM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-GdJ9nzlDAdOazOHH/YWuEoELrJh+G5ZJUKwIqAKAzpo=";
   };
 
   postPatch = ''
@@ -132,10 +132,6 @@ stdenv.mkDerivation (finalAttrs: {
   # Instead, we load audit rules in a dedicated module.
   postFixup = ''
     moveToOutput bin/augenrules $scripts
-    substituteInPlace $scripts/bin/augenrules \
-      --replace-fail "/sbin/auditctl -R" "$bin/bin/auditctl -R" \
-      --replace-fail "auditctl -s" "$bin/bin/auditctl -s" \
-      --replace-fail "/bin/ls" "ls"
     wrapProgram $scripts/bin/augenrules \
       --prefix PATH : ${
         lib.makeBinPath [
diff --git a/pkgs/by-name/au/authentik/client-go-config.patch b/pkgs/by-name/au/authentik/client-go-config.patch
deleted file mode 100644
index 8398b16160c7..000000000000
--- a/pkgs/by-name/au/authentik/client-go-config.patch
+++ /dev/null
@@ -1,9 +0,0 @@
-diff --git a/config.yaml b/config.yaml
-index 2f07ea7..0f90432 100644
---- a/config.yaml
-+++ b/config.yaml
-@@ -4,3 +4,4 @@ additionalProperties:
-   packageName: api
-   enumClassPrefix: true
-   useOneOfDiscriminatorLookup: true
-+  disallowAdditionalPropertiesIfNotPresent: false
diff --git a/pkgs/by-name/au/authentik/package.nix b/pkgs/by-name/au/authentik/package.nix
index ff63e72475e2..fef159aa3c62 100644
--- a/pkgs/by-name/au/authentik/package.nix
+++ b/pkgs/by-name/au/authentik/package.nix
@@ -3,14 +3,19 @@
   stdenvNoCC,
   callPackages,
   cacert,
+  clangStdenv,
+  cmake,
   fetchFromGitHub,
   buildGoModule,
+  buildNpmPackage,
   bash,
   chromedriver,
   nodejs_24,
-  python3,
+  python314,
   makeWrapper,
   openapi-generator-cli,
+  perl,
+  rustPlatform,
   go,
   typescript,
   makeSetupHook,
@@ -20,13 +25,18 @@
 let
   nodejs = nodejs_24;
 
-  version = "2025.12.6";
+  version = "2026.5.3";
+
+  cargoPackageFlags = [
+    "--package"
+    "authentik"
+  ];
 
   src = fetchFromGitHub {
     owner = "goauthentik";
     repo = "authentik";
     tag = "version/${version}";
-    hash = "sha256-uIg47z4LaCawF/5ir4mKE6DpDnEpQ8DuObCNaq6TcYk=";
+    hash = "sha256-nmAX8nwZpdDcFAPvC9hAEp0x43RnFtGLUTAm7NcvNZo=";
   };
 
   meta = {
@@ -46,24 +56,9 @@ let
 
   client-go = stdenvNoCC.mkDerivation {
     pname = "authentik-client-go";
-    version = "3.${version}";
-    inherit meta;
+    inherit version src meta;
 
-    src = fetchFromGitHub {
-      owner = "goauthentik";
-      repo = "client-go";
-      tag = "v3.2025.12.4";
-      hash = "sha256-+/CfOE2HkBU+ZddvdXGenB/z8xNFk8cujpZpMXyh3cY=";
-    };
-
-    patches = [
-      ./client-go-config.patch
-    ];
-
-    postPatch = ''
-      substituteInPlace ./config.yaml \
-        --replace-fail '/local' "$(pwd)"
-    '';
+    sourceRoot = "${src.name}/packages/client-go";
 
     nativeBuildInputs = [
       openapi-generator-cli
@@ -86,10 +81,9 @@ let
     installPhase = ''
       runHook preInstall
 
-      cp go.mod go.sum $out
-
       cd $out
       rm -rf test
+      rm -f go.mod go.sum
       rm -f .travis.yml git_push.sh
 
       runHook postInstall
@@ -101,8 +95,8 @@ let
     inherit version src meta;
 
     postPatch = ''
-      substituteInPlace ./scripts/api/ts-config.yaml \
-        --replace-fail '/local' "$(pwd)"
+      substituteInPlace ./packages/client-ts/config.yaml \
+        --replace-fail '/local' "$(pwd)/packages/client-ts"
     '';
 
     nativeBuildInputs = [
@@ -117,7 +111,7 @@ let
       openapi-generator-cli generate \
         -i ./schema.yml -o $out \
         -g typescript-fetch \
-        -c ./scripts/api/ts-config.yaml \
+        -c ./packages/client-ts/config.yaml \
         --additional-properties=npmVersion=${version} \
         --git-repo-id authentik --git-user-id goauthentik
 
@@ -128,32 +122,19 @@ let
     '';
   };
 
-  # prefetch-npm-deps does not save all dependencies even though the lockfile is fine
-  website-deps = stdenvNoCC.mkDerivation {
+  website-deps = buildNpmPackage {
     pname = "authentik-website-deps";
     inherit src version meta;
 
     sourceRoot = "${src.name}/website";
 
-    outputHash =
-      {
-        "aarch64-linux" = "sha256-EbLneRDCyLLLBOZ2DUDpf2TbZoTL8QMXP4WlAZEzS90=";
-        "x86_64-linux" = "sha256-yDjwN/+lX2i9WYDXq4yWwf9o8nA4342iHDDQH4Jt7eQ=";
-      }
-      .${stdenvNoCC.hostPlatform.system} or (throw "authentik-website-deps: unsupported host platform");
-
-    outputHashMode = "recursive";
-
-    nativeBuildInputs = [
-      nodejs
-      cacert
-    ];
-
-    buildPhase = ''
-      npm ci --cache ./cache
-
-      rm -r ./cache node_modules/.package-lock.json
-    '';
+    inherit nodejs;
+    npmDepsHash = "sha256-SkIZF+wQPgoZOGJc0YR8Ot07KCsAdA1985SLQaoibfA=";
+    npmDepsFetcherVersion = 2;
+    makeCacheWritable = true;
+    npmInstallFlags = [ "--legacy-peer-deps" ];
+    npmRebuildFlags = [ "--ignore-scripts" ];
+    dontNpmBuild = true;
 
     # dependencies of workspace projects are installed into separate node_modules folders with
     # symlinks between them, so we have to copy all of them
@@ -208,8 +189,8 @@ let
 
     outputHash =
       {
-        "aarch64-linux" = "sha256-J9wGQe7iMfKznNk3woqi0VNVNA/dE6TGi2f44DOlG1c=";
-        "x86_64-linux" = "sha256-9Q590Rw0mk3q5osxOKGWU7+XtKwkTyA+CLC2LxAA/3g=";
+        "aarch64-linux" = "sha256-41xZEfLul92vJATZqyVnd7Pp++NzLL/u8NeJJPHpXrw=";
+        "x86_64-linux" = "sha256-FpfOl6wNCgXLg86+vbjnYkcOnpaOZBCNxJiFDRT5W3s=";
       }
       .${stdenvNoCC.hostPlatform.system} or (throw "authentik-webui-deps: unsupported host platform");
     outputHashMode = "recursive";
@@ -220,6 +201,7 @@ let
     ];
 
     buildPhase = ''
+      chmod -R +w . ../packages/client-ts
       npm ci --cache ./cache --ignore-scripts
 
       rm -r ./cache node_modules/.package-lock.json
@@ -295,7 +277,7 @@ let
     ];
   };
 
-  python = python3.override {
+  python = python314.override {
     self = python;
     packageOverrides = final: prev: {
       # https://github.com/goauthentik/authentik/pull/16324
@@ -376,62 +358,6 @@ let
         ];
       };
 
-      # Running authentik currently requires a custom version.
-      # Look in `pyproject.toml` for changes to the rev in the `[tool.uv.sources]` section.
-      # See https://github.com/goauthentik/authentik/pull/14057 for latest version bump.
-      djangorestframework = final.buildPythonPackage {
-        pname = "djangorestframework";
-        version = "3.16.0";
-        format = "setuptools";
-
-        src = fetchFromGitHub {
-          owner = "authentik-community";
-          repo = "django-rest-framework";
-          rev = "896722bab969fabc74a08b827da59409cf9f1a4e";
-          hash = "sha256-YrEDEU3qtw/iyQM3CoB8wYx57zuPNXiJx6ZjrIwnCNU=";
-        };
-
-        propagatedBuildInputs = with final; [
-          django
-          pytz
-        ];
-
-        nativeCheckInputs = with final; [
-          pytest-django
-          pytest7CheckHook
-
-          # optional tests
-          coreapi
-          django-guardian
-          inflection
-          pyyaml
-          uritemplate
-        ];
-
-        disabledTests = [
-          "test_ignore_validation_for_unchanged_fields"
-          "test_invalid_inputs"
-          "test_shell_code_example_rendering"
-          "test_unique_together_condition"
-          "test_unique_together_with_source"
-        ];
-
-        pythonImportsCheck = [ "rest_framework" ];
-      };
-
-      # authentik is currently not compatible with v1.18 and fails with the following error:
-      # > AttributeError: 'Namespace' object has no attribute 'worker_fork_timeout'. Did you mean: 'worker_shutdown_timeout'?
-      dramatiq = prev.dramatiq.overrideAttrs (_: rec {
-        version = "1.17.1";
-
-        src = fetchFromGitHub {
-          owner = "Bogdanp";
-          repo = "dramatiq";
-          tag = "v${version}";
-          hash = "sha256-NeUGhG+H6r+JGd2qnJxRUbQ61G7n+3tsuDugTin3iJ4=";
-        };
-      });
-
       authentik-django = final.buildPythonPackage {
         pname = "authentik-django";
         inherit version src meta;
@@ -548,7 +474,32 @@ let
 
   inherit (python.pkgs) authentik-django;
 
-  # Provide a setup-hook to configure the Go vendor directory with up-to-date API bindings.
+  worker = (rustPlatform.buildRustPackage.override { stdenv = clangStdenv; }) {
+    pname = "authentik-worker";
+    inherit version src meta;
+
+    cargoHash = "sha256-KExlNyT9G3R5rnt99beT2pYrWxezMLhGw+Q9T1X2kj4=";
+
+    nativeBuildInputs = [
+      cmake
+      go
+      perl
+    ];
+
+    buildInputs = [ python ];
+
+    env = {
+      PYO3_PYTHON = lib.getExe python;
+      RUSTFLAGS = "--cfg tokio_unstable";
+    };
+
+    cargoBuildFlags = cargoPackageFlags;
+
+    # Upstream currently has no Rust tests in this package.
+    doCheck = false;
+  };
+
+  # Provide a setup-hook to configure the Go source tree with up-to-date API bindings.
   # This is done to avoid the `vendorHash` depending on anything in the `client-go` build (e.g.
   # openapi-generator-cli version updates changing the produced content) and invalidating the hash.
   apiGoVendorHook =
@@ -559,9 +510,10 @@ let
       (
         writeShellScript "authentik-api-go-vendor-hook" ''
           authentikApiGoVendorHook() {
-            chmod -R +w vendor/goauthentik.io/api
-            rm -rf vendor/goauthentik.io/api/v3
-            cp -r ${client-go} vendor/goauthentik.io/api/v3
+            chmod -R +w packages/client-go
+            rm -rf packages/client-go
+            cp -r ${client-go} packages/client-go
+            chmod -R +w packages/client-go
 
             echo "Finished authentikApiGoVendorHook"
           }
@@ -593,10 +545,11 @@ let
     # calculate the vendorHash without other dependencies, so it is only based on the `go.sum` file
     overrideModAttrs.postPatch = "";
 
-    vendorHash = "sha256-pdQg02f1K4nOhsnadoplQYOhEybqZxn+yDQRN5RNygM=";
+    vendorHash = "sha256-EVDOZ4USaJoIBDB8mM4ZSBfsSc1d/NOm1Qv/hUJ+8f4=";
 
     postInstall = ''
-      mv $out/bin/server $out/bin/authentik
+      mv $out/bin/server $out/bin/authentik-server
+      ln -s authentik-server $out/bin/authentik
     '';
 
     subPackages = [ "cmd/server" ];
@@ -612,11 +565,6 @@ stdenvNoCC.mkDerivation {
   postPatch = ''
     rm Makefile
     patchShebangs lifecycle/ak
-
-    # This causes issues in systemd services
-    substituteInPlace lifecycle/ak \
-      --replace-fail 'printf' '>&2 printf' \
-      --replace-fail '>/dev/stderr' ""
   '';
 
   installPhase = ''
@@ -627,8 +575,9 @@ stdenvNoCC.mkDerivation {
     wrapProgram $out/bin/ak \
       --prefix PATH : ${
         lib.makeBinPath [
-          (python.withPackages (ps: [ ps.authentik-django ]))
+          worker
           proxy
+          (python.withPackages (ps: [ ps.authentik-django ]))
         ]
       } \
       --set TMPDIR /dev/shm \
@@ -638,7 +587,7 @@ stdenvNoCC.mkDerivation {
   '';
 
   passthru = {
-    inherit proxy apiGoVendorHook;
+    inherit proxy worker apiGoVendorHook;
     outposts = callPackages ./outposts.nix {
       inherit (proxy) vendorHash;
       inherit apiGoVendorHook;
diff --git a/pkgs/by-name/cl/claude-code/manifest.json b/pkgs/by-name/cl/claude-code/manifest.json
index d92c820fce8a..6e8719125f25 100644
--- a/pkgs/by-name/cl/claude-code/manifest.json
+++ b/pkgs/by-name/cl/claude-code/manifest.json
@@ -1,47 +1,47 @@
 {
-  "version": "2.1.187",
-  "commit": "6a53320fad5541a68d79e4b6c53677df77b98e33",
-  "buildDate": "2026-06-23T17:07:42Z",
+  "version": "2.1.191",
+  "commit": "397db5e73d569118815b8037ca9ff2483a06bbfe",
+  "buildDate": "2026-06-24T11:32:23Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude",
-      "checksum": "a59a16ba4922adab7a145728f215d042184d349f5f7e72cddb7fc114250a4ce3",
-      "size": 215994048
+      "checksum": "99fdfb552a5260e649aedd06c024d0a4105b09cefec0bf67d558e017ee66c400",
+      "size": 219856224
     },
     "darwin-x64": {
       "binary": "claude",
-      "checksum": "7f57b6935b4246d03cb7acee90dc22153083483a267da589c5c920dd04744c36",
-      "size": 224795776
+      "checksum": "6e83aad5fc4fd459fd74539cda06d2279105eac2befc603d2fba6494974cb2a4",
+      "size": 229178416
     },
     "linux-arm64": {
       "binary": "claude",
-      "checksum": "b49be8a5e565bf2d45b50d2de62017b25462131acc9425d2fdb98b8f29c9dce2",
-      "size": 232240864
+      "checksum": "1a31a7cbcfd784f8c073bfc8a0a1583fb6e93e60ef70b76d7fcf663ffed8949b",
+      "size": 236305136
     },
     "linux-x64": {
       "binary": "claude",
-      "checksum": "bb02fcb33626f8c599d10d8bee38585d4cf8d4225c3b497869dee7454e7bf361",
-      "size": 234874664
+      "checksum": "1038dba88bdf1b80941dc3e383e93b088325b00497329ac50da460c8786d5bee",
+      "size": 239438648
     },
     "linux-arm64-musl": {
       "binary": "claude",
-      "checksum": "972fc2e0bc8104edb593ce7723d4414c0ed8e4df6d90ad26ae48097b1d910478",
-      "size": 225620168
+      "checksum": "7e5d3ac86e28dbd224f84d9349372b74bed39ad6392408df63356fd8a810c96e",
+      "size": 229553336
     },
     "linux-x64-musl": {
       "binary": "claude",
-      "checksum": "c5a783d13aac71d42324f2e9dcd395c266bd5774951faf0d94855c737024bee3",
-      "size": 229858704
+      "checksum": "b80e0066fb208cbd50fe539ed9c03dadd24fcc058bb67774fd36a316bca396ad",
+      "size": 234123648
     },
     "win32-x64": {
       "binary": "claude.exe",
-      "checksum": "24964d08c5100bac6071352e5837101b333de1c1afefd2b8b0e7a60db6c0ef5c",
-      "size": 226329760
+      "checksum": "83397a6a029c7da663fb1ce27211e05174a3546d8b151e42451bf4590b8343d7",
+      "size": 230281888
     },
     "win32-arm64": {
       "binary": "claude.exe",
-      "checksum": "04124c0ba09ece85a856de652e84386094c372f002ff767a94d4a43ecf776f96",
-      "size": 220992160
+      "checksum": "ec8c342e835ee8891ef2c6d0eb9ac460f2d5e6a668788c8a03faa3451748c275",
+      "size": 224756384
     }
   }
 }
diff --git a/pkgs/by-name/co/cockpit-files/package.nix b/pkgs/by-name/co/cockpit-files/package.nix
index 8239d5dbf066..60ad181b1230 100644
--- a/pkgs/by-name/co/cockpit-files/package.nix
+++ b/pkgs/by-name/co/cockpit-files/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cockpit-files";
-  version = "41";
+  version = "42";
 
   src = fetchFromGitHub {
     owner = "cockpit-project";
     repo = "cockpit-files";
     tag = finalAttrs.version;
-    hash = "sha256-qS9L0REWN8exXiy5ogYQNbuwaxuh8CiKaCUJHdkfSqQ=";
+    hash = "sha256-NfI6y60O5ctsPbwPcXgkwxpNYuZkF/2YXZOIcRZUc5c=";
 
     fetchSubmodules = true;
     postFetch = "cp $out/node_modules/.package-lock.json $out/package-lock.json";
diff --git a/pkgs/by-name/co/cockpit-machines/package.nix b/pkgs/by-name/co/cockpit-machines/package.nix
index d16e56df2a18..b58acdbcee30 100644
--- a/pkgs/by-name/co/cockpit-machines/package.nix
+++ b/pkgs/by-name/co/cockpit-machines/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cockpit-machines";
-  version = "353";
+  version = "354";
 
   src = fetchFromGitHub {
     owner = "cockpit-project";
     repo = "cockpit-machines";
     tag = finalAttrs.version;
-    hash = "sha256-K4p2HDg1Wh1ORw3S2BeY0Kbpy+CEGyiCM623/6M4LpU=";
+    hash = "sha256-r5gvs6/clRDV0VZKU1r6fjJSwHLuf9Pnhi0c60/9qkE=";
 
     fetchSubmodules = true;
     postFetch = "cp $out/node_modules/.package-lock.json $out/package-lock.json";
diff --git a/pkgs/by-name/co/cockpit-podman/package.nix b/pkgs/by-name/co/cockpit-podman/package.nix
index e14de81eaf25..7a5278395eed 100644
--- a/pkgs/by-name/co/cockpit-podman/package.nix
+++ b/pkgs/by-name/co/cockpit-podman/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cockpit-podman";
-  version = "127";
+  version = "128";
 
   src = fetchFromGitHub {
     owner = "cockpit-project";
     repo = "cockpit-podman";
     tag = finalAttrs.version;
-    hash = "sha256-dYwiHvpyzu03ceinPeEuTpnRx4OOmA9/UuIKJNxb1eY=";
+    hash = "sha256-GlnIZGV5nk7o28EUs4H/IdZkgtHG0a9uwCTCS4rCP6c=";
 
     fetchSubmodules = true;
     postFetch = "cp $out/node_modules/.package-lock.json $out/package-lock.json";
diff --git a/pkgs/by-name/co/colmena/package.nix b/pkgs/by-name/co/colmena/package.nix
index f95c311db6e7..fdf643e76301 100644
--- a/pkgs/by-name/co/colmena/package.nix
+++ b/pkgs/by-name/co/colmena/package.nix
@@ -8,19 +8,20 @@
   makeBinaryWrapper,
   nix-eval-jobs,
   nix,
-  colmena,
-  testers,
+  versionCheckHook,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "colmena";
   version = "0.4.0";
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
-    owner = "zhaofengli";
+    owner = "nix-community";
     repo = "colmena";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-01bfuSY4gnshhtqA1EJCw2CMsKkAx+dHS+sEpQ2+EAQ=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-01bfuSY4gnshhtqA1EJCw2CMsKkAx+dHS+sEpQ2+EAQ=";
   };
 
   cargoHash = "sha256-2OLApLD/04etEeTxv03p0cx8O4O51iGiBQTIG/iOIkU=";
@@ -35,10 +36,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
   env.NIX_EVAL_JOBS = "${nix-eval-jobs}/bin/nix-eval-jobs";
 
   patches = [
-    # Fixes nix 2.24 compat: https://github.com/zhaofengli/colmena/pull/236
+    # Fixes nix 2.24 compat: https://github.com/zhaofengli/colmena/pull/233
     (fetchpatch {
-      url = "https://github.com/zhaofengli/colmena/commit/36382ee2bef95983848435065f7422500c7923a8.patch";
-      sha256 = "sha256-5cQ2u3eTzhzjPN+rc6xWIskHNtheVXXvlSeJ1G/lz+E=";
+      url = "https://github.com/nix-community/colmena/commit/00fd486d49170b1304c67381b3096e55d4cdc76f.patch";
+      hash = "sha256-uwL3u0gO708bzV2NV8sTt10WHaCL3HykJNqSZNp9EtA=";
     })
   ];
 
@@ -52,19 +53,22 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --prefix PATH ":" "${lib.makeBinPath [ nix ]}"
   '';
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
   # Recursive Nix is not stable yet
   doCheck = false;
 
   passthru = {
     # We guarantee CLI and Nix API stability for the same minor version
     apiVersion = builtins.concatStringsSep "." (lib.take 2 (lib.splitVersion finalAttrs.version));
-
-    tests.version = testers.testVersion { package = colmena; };
   };
 
   meta = {
     description = "Simple, stateless NixOS deployment tool";
     homepage = "https://colmena.cli.rs/${finalAttrs.passthru.apiVersion}";
+    downloadPage = "https://github.com/nix-community/colmena/";
+    changelog = "https://github.com/nix-community/colmena/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ zhaofengli ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
diff --git a/pkgs/by-name/co/cosmic-applets/dedup-cosmic-settings-daemon.patch b/pkgs/by-name/co/cosmic-applets/dedup-cosmic-settings-daemon.patch
new file mode 100644
index 000000000000..d800685e4c23
--- /dev/null
+++ b/pkgs/by-name/co/cosmic-applets/dedup-cosmic-settings-daemon.patch
@@ -0,0 +1,13 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index bdd37740..c1adcfad 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -1514,7 +1514,7 @@ dependencies = [
+ [[package]]
+ name = "cosmic-settings-config"
+ version = "0.1.0"
+-source = "git+https://github.com/pop-os/cosmic-settings-daemon#fa82bdf9fe7b5f5bd6008f32f393efd5e7a71c47"
++source = "git+https://github.com/pop-os/cosmic-settings-daemon#e7936f0d4f01c8c5a436908c7ee9f6ad43e6a7d8"
+ dependencies = [
+  "cosmic-config",
+  "ron 0.11.0",
diff --git a/pkgs/by-name/co/cosmic-applets/package.nix b/pkgs/by-name/co/cosmic-applets/package.nix
index 03ac8e1bb998..3bf2a2fbc3e2 100644
--- a/pkgs/by-name/co/cosmic-applets/package.nix
+++ b/pkgs/by-name/co/cosmic-applets/package.nix
@@ -20,17 +20,23 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-applets";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-applets";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-o+rEO+IA337fhpq6TsH+UZEN7kb/PqydlKo77NyCRcM=";
+    hash = "sha256-A8Qk9u3Q83Q4AjzTrdptfS9UNoyKq39YihC4d/dNBYc=";
   };
 
-  cargoHash = "sha256-tbGuyqdDTsKYpKxeAuachwbPHTPhmb9Sg3qzxHYosjo=";
+  cargoPatches = [
+    # A different reference to the `cosmic-settings-daemon` crate was added
+    # Remove this patch once upstream fixes their lockfile.
+    ./dedup-cosmic-settings-daemon.patch
+  ];
+
+  cargoHash = "sha256-81BFu13QmqOq43iN+ORQuktisEFYRrK+wd6diFfSufs=";
 
   separateDebugInfo = true;
   __structuredAttrs = true;
diff --git a/pkgs/by-name/co/cosmic-applibrary/package.nix b/pkgs/by-name/co/cosmic-applibrary/package.nix
index 19c352f99649..87e9e75cb8cb 100644
--- a/pkgs/by-name/co/cosmic-applibrary/package.nix
+++ b/pkgs/by-name/co/cosmic-applibrary/package.nix
@@ -11,14 +11,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-applibrary";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-applibrary";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-mzHSLZK6HienbPRPetSj+XbPWCnpihEvMx9W9lJWpbA=";
+    hash = "sha256-TZncRQer4lXunUwdQ2xDP3DmF5B7UmfhSQvEwVodc98=";
   };
 
   cargoHash = "sha256-qGx/3w78mgIMqRo1wJA+ULFHWdNW2LKe2Sej4f9KbVs=";
diff --git a/pkgs/by-name/co/cosmic-bg/package.nix b/pkgs/by-name/co/cosmic-bg/package.nix
index e18cef8f3a4f..6a27f2f4a9dc 100644
--- a/pkgs/by-name/co/cosmic-bg/package.nix
+++ b/pkgs/by-name/co/cosmic-bg/package.nix
@@ -13,14 +13,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-bg";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-bg";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-E4OWxoGyRNFcMl7ni7PB6PE0Yl7dE+Wd4JGDMHO94Yw=";
+    hash = "sha256-bczUWa91l52P6Q46/lkX1j9eKasM154D82fBaLFHF1M=";
   };
 
   postPatch = ''
@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       "${cosmic-wallpapers}/share/backgrounds/cosmic/orion_nebula_nasa_heic0601a.jpg"
   '';
 
-  cargoHash = "sha256-xXq8Dckg3YOf2AT9uOZqVfq00FhZp/X5UU8hLmAln1U=";
+  cargoHash = "sha256-UDhXKg4lO6op/lfi3aZ4iclzUqcf5xQI85UWAHVTWig=";
 
   separateDebugInfo = true;
   __structuredAttrs = true;
diff --git a/pkgs/by-name/co/cosmic-comp/package.nix b/pkgs/by-name/co/cosmic-comp/package.nix
index b57bf910e0ca..69552fdea6ad 100644
--- a/pkgs/by-name/co/cosmic-comp/package.nix
+++ b/pkgs/by-name/co/cosmic-comp/package.nix
@@ -20,14 +20,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-comp";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-comp";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-3WPZk/o+cfq3wwKEuYejMh+pn2o823m98OO3crFaNX4=";
+    hash = "sha256-fUuw7qwfojAmu/mkWMkWBhpcSgZNTIzdXmInjyKrZBI=";
   };
 
   cargoHash = "sha256-ki+unf58rXBCpj5PCpBcg/6FWo16+MdPQWae+w1YkJ8=";
diff --git a/pkgs/by-name/co/cosmic-edit/package.nix b/pkgs/by-name/co/cosmic-edit/package.nix
index ac6085d05627..c6148a0cf930 100644
--- a/pkgs/by-name/co/cosmic-edit/package.nix
+++ b/pkgs/by-name/co/cosmic-edit/package.nix
@@ -16,17 +16,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-edit";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-edit";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-almnWrJSV5xZoBDEuk0pfMZ/c00e0xpDNTTbcq+NCYM=";
+    hash = "sha256-5DsnhaiJgmTakn+q9o2Q7IeuakAC/j0Ck3F3pfFx/EA=";
   };
 
-  cargoHash = "sha256-/qcpAR2nvC/MYa5QuCLiZFQgos5SlYtspZsNuMLJFHk=";
+  cargoHash = "sha256-2E+98uWtahyQufoZTzdUtkwbuISsUHwlqOmMSpyi1O8=";
 
   separateDebugInfo = true;
 
diff --git a/pkgs/by-name/co/cosmic-files/package.nix b/pkgs/by-name/co/cosmic-files/package.nix
index 149956ff852f..cc0d584fd744 100644
--- a/pkgs/by-name/co/cosmic-files/package.nix
+++ b/pkgs/by-name/co/cosmic-files/package.nix
@@ -12,17 +12,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-files";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-files";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-2vrk1hYL7E/vVWiLcOYY3O0cmYZyFG4bdkNDFuyA+cA=";
+    hash = "sha256-cRwZrmm/zOIV6VCyz2dTH+qn8h6LOnaOiHU5nENTK6o=";
   };
 
-  cargoHash = "sha256-QPFGsn1J0lp5K4gLdar/Z5MmZg+VOoCZd1U8LUuLXqM=";
+  cargoHash = "sha256-+21DCCTkNrbdxgxQi0YyuAxpl1IvwUz3ccUE+E0sZ4Y=";
 
   separateDebugInfo = true;
   __structuredAttrs = true;
diff --git a/pkgs/by-name/co/cosmic-greeter/package.nix b/pkgs/by-name/co/cosmic-greeter/package.nix
index 12e59cf25258..c9f04a86339b 100644
--- a/pkgs/by-name/co/cosmic-greeter/package.nix
+++ b/pkgs/by-name/co/cosmic-greeter/package.nix
@@ -19,14 +19,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-greeter";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-greeter";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-+6VOv6z61k48hURq4yRRMIFIE8ZrjYGapO5FybWKQTE=";
+    hash = "sha256-oxXCAvBISkZu76VpvQ9AliFRJ8r5Ay7mjWf4sEwV0Xs=";
   };
 
   cargoHash = "sha256-mfY2hsMxBooRjmTB2jgUIKyKHBpGfZ9Qslwv+2aEQyg=";
diff --git a/pkgs/by-name/co/cosmic-icons/package.nix b/pkgs/by-name/co/cosmic-icons/package.nix
index 6009c0bcfc18..6e680b83e8fa 100644
--- a/pkgs/by-name/co/cosmic-icons/package.nix
+++ b/pkgs/by-name/co/cosmic-icons/package.nix
@@ -9,14 +9,14 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cosmic-icons";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-icons";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-3owl4M4vRyzjR4v74clyAxpNDu77rieSpYAVYfADHzY=";
+    hash = "sha256-QUTAYIQ6qAhjZK/9BZjJzTViECLUwO/MyaOqiRb1Ans=";
   };
 
   __structuredAttrs = true;
diff --git a/pkgs/by-name/co/cosmic-idle/package.nix b/pkgs/by-name/co/cosmic-idle/package.nix
index ca17faa2ce2b..05c0e99f8ff1 100644
--- a/pkgs/by-name/co/cosmic-idle/package.nix
+++ b/pkgs/by-name/co/cosmic-idle/package.nix
@@ -16,7 +16,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-idle";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/co/cosmic-initial-setup/package.nix b/pkgs/by-name/co/cosmic-initial-setup/package.nix
index 9006fa7e152d..cf7d5a6b55f1 100644
--- a/pkgs/by-name/co/cosmic-initial-setup/package.nix
+++ b/pkgs/by-name/co/cosmic-initial-setup/package.nix
@@ -14,14 +14,14 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-initial-setup";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-initial-setup";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-3nGPBWYDqPJN99WtzsAVERucwiVAFynuUk2gezZ/RJU=";
+    hash = "sha256-UABqbmbwW2ZBOO7mq16/h0s55VCWRF2yyf/1TaubC88=";
   };
 
   cargoHash = "sha256-DESnl5NjakU4++Ep6CHxDZzHn+o0Gi0eREpXk5BN5iY=";
diff --git a/pkgs/by-name/co/cosmic-launcher/package.nix b/pkgs/by-name/co/cosmic-launcher/package.nix
index 8b3b14881b5e..2f790b30098d 100644
--- a/pkgs/by-name/co/cosmic-launcher/package.nix
+++ b/pkgs/by-name/co/cosmic-launcher/package.nix
@@ -11,14 +11,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-launcher";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-launcher";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-ZivzjufT2UlPi/En1AjGS8TfeFNdJDfDUd9cb2Begb8=";
+    hash = "sha256-9U64nSeI47bkc8BQU9ilXBlHQRGS2zC/FcBKc7Z17RY=";
   };
 
   cargoHash = "sha256-WnZAPQR8hGGNC5S7hPmcGSMs9HrOw4/wqJR151eIgHY=";
diff --git a/pkgs/by-name/co/cosmic-monitor/package.nix b/pkgs/by-name/co/cosmic-monitor/package.nix
new file mode 100644
index 000000000000..9b1bdd228583
--- /dev/null
+++ b/pkgs/by-name/co/cosmic-monitor/package.nix
@@ -0,0 +1,73 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+  just,
+  libcosmicAppHook,
+  nixosTests,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "cosmic-monitor";
+  version = "1.1.0";
+
+  # nixpkgs-update: no auto update
+  src = fetchFromGitHub {
+    owner = "pop-os";
+    repo = "cosmic-monitor";
+    tag = "epoch-${finalAttrs.version}";
+    hash = "sha256-CiJ9LeNcdOyC8yn0c7hCz0QEecxYK95KGvs1SWr9360=";
+  };
+
+  cargoHash = "sha256-OMhLPQ3GkV/wdeb9F7lsKY1Uzzg8+UlhOeakGZo6mYk=";
+
+  separateDebugInfo = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    just
+    libcosmicAppHook
+    rustPlatform.bindgenHook
+  ];
+
+  dontUseJustBuild = true;
+  dontUseJustCheck = true;
+
+  justFlags = [
+    "--set"
+    "prefix"
+    (placeholder "out")
+    "--set"
+    "cargo-target-dir"
+    "target/${stdenv.hostPlatform.rust.cargoShortTarget}"
+  ];
+
+  passthru = {
+    tests = {
+      inherit (nixosTests)
+        cosmic
+        cosmic-autologin
+        cosmic-noxwayland
+        cosmic-autologin-noxwayland
+        ;
+    };
+
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--version-regex"
+        "epoch-(.*)"
+      ];
+    };
+  };
+
+  meta = {
+    homepage = "https://github.com/pop-os/cosmic-monitor";
+    description = "COSMIC System Monitor";
+    mainProgram = "cosmic-monitor";
+    license = lib.licenses.gpl3Only;
+    teams = [ lib.teams.cosmic ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/co/cosmic-notifications/package.nix b/pkgs/by-name/co/cosmic-notifications/package.nix
index f0ae84bd4110..401eb262ebe7 100644
--- a/pkgs/by-name/co/cosmic-notifications/package.nix
+++ b/pkgs/by-name/co/cosmic-notifications/package.nix
@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-notifications";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/co/cosmic-osd/deduplicate-cosmic-settings-crate.patch b/pkgs/by-name/co/cosmic-osd/deduplicate-cosmic-settings-crate.patch
deleted file mode 100644
index 9872e8d69f5f..000000000000
--- a/pkgs/by-name/co/cosmic-osd/deduplicate-cosmic-settings-crate.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
-index 8b6704e..64c1691 100644
---- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -1104,7 +1104,7 @@ dependencies = [
- [[package]]
- name = "cosmic-settings-airplane-mode-subscription"
- version = "1.0.7"
--source = "git+https://github.com/pop-os/cosmic-settings#78644a32e3741f8f80e9b8ce65c3550c85f9c1f8"
-+source = "git+https://github.com/pop-os/cosmic-settings#81912bed6cdebe2719e29e6bd1453e7b977acb0e"
- dependencies = [
-  "futures",
-  "iced_futures",
-@@ -1150,7 +1150,7 @@ dependencies = [
- [[package]]
- name = "cosmic-settings-pulse-subscription"
- version = "0.1.0"
--source = "git+https://github.com/pop-os/cosmic-settings#78644a32e3741f8f80e9b8ce65c3550c85f9c1f8"
-+source = "git+https://github.com/pop-os/cosmic-settings#81912bed6cdebe2719e29e6bd1453e7b977acb0e"
- dependencies = [
-  "futures",
-  "iced_futures",
-@@ -1162,7 +1162,7 @@ dependencies = [
- [[package]]
- name = "cosmic-settings-upower-subscription"
- version = "1.0.7"
--source = "git+https://github.com/pop-os/cosmic-settings#78644a32e3741f8f80e9b8ce65c3550c85f9c1f8"
-+source = "git+https://github.com/pop-os/cosmic-settings#81912bed6cdebe2719e29e6bd1453e7b977acb0e"
- dependencies = [
-  "futures",
-  "iced_futures",
diff --git a/pkgs/by-name/co/cosmic-osd/package.nix b/pkgs/by-name/co/cosmic-osd/package.nix
index 407e63972011..c3bdf6376f10 100644
--- a/pkgs/by-name/co/cosmic-osd/package.nix
+++ b/pkgs/by-name/co/cosmic-osd/package.nix
@@ -15,24 +15,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-osd";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-osd";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-jv28hxhQUcUDLnOwU3xQJwCU+s52pwDNs8Gf4I5Hp9k=";
+    hash = "sha256-veqkYF2CSwnc1nGIFeZXpfannCQ0RuacvqPVxVsiVDc=";
   };
 
-  cargoHash = "sha256-YwZXlhggrUddxour+/S1mSL3Fq1mzvFaOHArLSnfPvc=";
-
-  cargoPatches = [
-    # A different reference to the `cargo-settings` crate was added in:
-    # <https://github.com/pop-os/cosmic-osd/pull/204>
-    # Remove this patch once upstream fixes their lockfile.
-    ./deduplicate-cosmic-settings-crate.patch
-  ];
+  cargoHash = "sha256-aweq4E2bwqRpetakpR0OqTsIsoJK6h4eRzMdBhGuIoU=";
 
   separateDebugInfo = true;
   __structuredAttrs = true;
diff --git a/pkgs/by-name/co/cosmic-panel/package.nix b/pkgs/by-name/co/cosmic-panel/package.nix
index b003608effc0..08fbe6eaf82d 100644
--- a/pkgs/by-name/co/cosmic-panel/package.nix
+++ b/pkgs/by-name/co/cosmic-panel/package.nix
@@ -11,14 +11,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-panel";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-panel";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-MNOS7HMlyvU4zCZVINthgZgBsUn+LI1hUAEcwSq+zaE=";
+    hash = "sha256-DKwmZnTxsYCWAkLb9AXoHBa8m6Z5Gi1Jb7AuxZqq7RA=";
   };
 
   cargoHash = "sha256-6E+bAi1f6gOZh64wyvLMKZiZNlMexPV+ZzS3riOx9xM=";
diff --git a/pkgs/by-name/co/cosmic-player/package.nix b/pkgs/by-name/co/cosmic-player/package.nix
index 549cdb52346d..b12ec673f447 100644
--- a/pkgs/by-name/co/cosmic-player/package.nix
+++ b/pkgs/by-name/co/cosmic-player/package.nix
@@ -18,17 +18,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-player";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-player";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-iDEyR+P+iXShH0YFtqxvPbbs9kgtYvAsuKchB6plnKI=";
+    hash = "sha256-aHQbwpNr8tsfUR0Dm4WTzz6XNXjgdqZ9/2AQRPPbnog=";
   };
 
-  cargoHash = "sha256-YzT16Ej+AyLLj8uHuHxZvHWujcW8jLjVg/4MmPyorH4=";
+  cargoHash = "sha256-KVaKTMrWijResBqzH62j/YqBR4TQ77x2sK/kN40UWjw=";
 
   separateDebugInfo = true;
   __structuredAttrs = true;
diff --git a/pkgs/by-name/co/cosmic-randr/package.nix b/pkgs/by-name/co/cosmic-randr/package.nix
index 4679dec4c858..f632be043c9b 100644
--- a/pkgs/by-name/co/cosmic-randr/package.nix
+++ b/pkgs/by-name/co/cosmic-randr/package.nix
@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-randr";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/co/cosmic-screenshot/package.nix b/pkgs/by-name/co/cosmic-screenshot/package.nix
index b5aa22076ca3..a335b3e56fed 100644
--- a/pkgs/by-name/co/cosmic-screenshot/package.nix
+++ b/pkgs/by-name/co/cosmic-screenshot/package.nix
@@ -11,14 +11,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-screenshot";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-screenshot";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-DngKZDKfgVdSZLZAsPq+7p4r/go2Y6141LrCNGoxD1E=";
+    hash = "sha256-RYvc/3FoRnNkuYBVfCG75Bmfb8JWW1H4GKXyhq7CxaQ=";
   };
 
   cargoHash = "sha256-q0RJST1yeqPBjU5MseNZIrZw+brfDtQLKiw7wyViflE=";
diff --git a/pkgs/by-name/co/cosmic-session/package.nix b/pkgs/by-name/co/cosmic-session/package.nix
index b5507b5bd6af..cf4406a3cb21 100644
--- a/pkgs/by-name/co/cosmic-session/package.nix
+++ b/pkgs/by-name/co/cosmic-session/package.nix
@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-session";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/co/cosmic-settings-daemon/package.nix b/pkgs/by-name/co/cosmic-settings-daemon/package.nix
index 00c546752bc5..84aaa17fdf48 100644
--- a/pkgs/by-name/co/cosmic-settings-daemon/package.nix
+++ b/pkgs/by-name/co/cosmic-settings-daemon/package.nix
@@ -7,6 +7,7 @@
   adw-gtk3,
   pkg-config,
   libpulseaudio,
+  pipewire,
   libinput,
   udev,
   openssl,
@@ -16,14 +17,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-settings-daemon";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-settings-daemon";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-A+nOAadFWU+KRW54dP2WW6P6fabIs4z1AqC37LSZjUI=";
+    hash = "sha256-6MLZpGGvE1EnUlRv2T6+iXy8B0aqBTNNrqDtBbeABYs=";
   };
 
   postPatch = ''
@@ -33,18 +34,22 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail '/usr/share/themes/adw-gtk3' '${adw-gtk3}/share/themes/adw-gtk3'
   '';
 
-  cargoHash = "sha256-bz+JasI3WE30sKKgjofVO/42Ml4YY9Dw3JxnZmZVQk4=";
+  cargoHash = "sha256-rpyMdwmcddsrXuIOI5T6Kh9+cB28DdUxotiqpeGqvCc=";
 
   separateDebugInfo = true;
   __structuredAttrs = true;
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+  ];
 
   buildInputs = [
     libinput
     libpulseaudio
     openssl
     udev
+    pipewire
   ];
 
   makeFlags = [
diff --git a/pkgs/by-name/co/cosmic-settings/dedup-libcosmic.patch b/pkgs/by-name/co/cosmic-settings/dedup-libcosmic.patch
new file mode 100644
index 000000000000..00d00905de3b
--- /dev/null
+++ b/pkgs/by-name/co/cosmic-settings/dedup-libcosmic.patch
@@ -0,0 +1,112 @@
+diff --git a/Cargo.lock b/Cargo.lock
+index 46d491a..ea60cd9 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -1774,7 +1774,7 @@ dependencies = [
+ [[package]]
+ name = "cosmic-theme"
+ version = "1.0.0"
+-source = "git+https://github.com/pop-os/libcosmic#f0f68933f1552857e2165fc0fa953228107bddef"
++source = "git+https://github.com/pop-os/libcosmic#a991d7bb433f67016c1473e8e4a03691ededd75a"
+ dependencies = [
+  "almost",
+  "configparser",
+@@ -3158,7 +3158,7 @@ dependencies = [
+ [[package]]
+ name = "iced"
+ version = "0.14.0"
+-source = "git+https://github.com/pop-os/libcosmic#f0f68933f1552857e2165fc0fa953228107bddef"
++source = "git+https://github.com/pop-os/libcosmic#a991d7bb433f67016c1473e8e4a03691ededd75a"
+ dependencies = [
+  "dnd",
+  "iced_accessibility",
+@@ -3214,7 +3214,7 @@ dependencies = [
+ [[package]]
+ name = "iced_debug"
+ version = "0.14.0"
+-source = "git+https://github.com/pop-os/libcosmic#f0f68933f1552857e2165fc0fa953228107bddef"
++source = "git+https://github.com/pop-os/libcosmic#a991d7bb433f67016c1473e8e4a03691ededd75a"
+ dependencies = [
+  "iced_core",
+  "iced_futures",
+@@ -3238,7 +3238,7 @@ dependencies = [
+ [[package]]
+ name = "iced_graphics"
+ version = "0.14.0"
+-source = "git+https://github.com/pop-os/libcosmic#f0f68933f1552857e2165fc0fa953228107bddef"
++source = "git+https://github.com/pop-os/libcosmic#a991d7bb433f67016c1473e8e4a03691ededd75a"
+ dependencies = [
+  "bitflags 2.12.1",
+  "bytemuck",
+@@ -3259,7 +3259,7 @@ dependencies = [
+ [[package]]
+ name = "iced_program"
+ version = "0.14.0"
+-source = "git+https://github.com/pop-os/libcosmic#f0f68933f1552857e2165fc0fa953228107bddef"
++source = "git+https://github.com/pop-os/libcosmic#a991d7bb433f67016c1473e8e4a03691ededd75a"
+ dependencies = [
+  "iced_graphics",
+  "iced_runtime",
+@@ -3268,7 +3268,7 @@ dependencies = [
+ [[package]]
+ name = "iced_renderer"
+ version = "0.14.0"
+-source = "git+https://github.com/pop-os/libcosmic#f0f68933f1552857e2165fc0fa953228107bddef"
++source = "git+https://github.com/pop-os/libcosmic#a991d7bb433f67016c1473e8e4a03691ededd75a"
+ dependencies = [
+  "iced_graphics",
+  "iced_tiny_skia",
+@@ -3280,7 +3280,7 @@ dependencies = [
+ [[package]]
+ name = "iced_runtime"
+ version = "0.14.0"
+-source = "git+https://github.com/pop-os/libcosmic#f0f68933f1552857e2165fc0fa953228107bddef"
++source = "git+https://github.com/pop-os/libcosmic#a991d7bb433f67016c1473e8e4a03691ededd75a"
+ dependencies = [
+  "bytes",
+  "cosmic-client-toolkit",
+@@ -3296,7 +3296,7 @@ dependencies = [
+ [[package]]
+ name = "iced_tiny_skia"
+ version = "0.14.0"
+-source = "git+https://github.com/pop-os/libcosmic#f0f68933f1552857e2165fc0fa953228107bddef"
++source = "git+https://github.com/pop-os/libcosmic#a991d7bb433f67016c1473e8e4a03691ededd75a"
+ dependencies = [
+  "bytemuck",
+  "cosmic-text",
+@@ -3313,7 +3313,7 @@ dependencies = [
+ [[package]]
+ name = "iced_wgpu"
+ version = "0.14.0"
+-source = "git+https://github.com/pop-os/libcosmic#f0f68933f1552857e2165fc0fa953228107bddef"
++source = "git+https://github.com/pop-os/libcosmic#a991d7bb433f67016c1473e8e4a03691ededd75a"
+ dependencies = [
+  "as-raw-xcb-connection",
+  "bitflags 2.12.1",
+@@ -3344,7 +3344,7 @@ dependencies = [
+ [[package]]
+ name = "iced_widget"
+ version = "0.14.2"
+-source = "git+https://github.com/pop-os/libcosmic#f0f68933f1552857e2165fc0fa953228107bddef"
++source = "git+https://github.com/pop-os/libcosmic#a991d7bb433f67016c1473e8e4a03691ededd75a"
+ dependencies = [
+  "cosmic-client-toolkit",
+  "dnd",
+@@ -3364,7 +3364,7 @@ dependencies = [
+ [[package]]
+ name = "iced_winit"
+ version = "0.14.0"
+-source = "git+https://github.com/pop-os/libcosmic#f0f68933f1552857e2165fc0fa953228107bddef"
++source = "git+https://github.com/pop-os/libcosmic#a991d7bb433f67016c1473e8e4a03691ededd75a"
+ dependencies = [
+  "cosmic-client-toolkit",
+  "cursor-icon",
+@@ -4455,7 +4455,7 @@ checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
+ [[package]]
+ name = "libcosmic"
+ version = "1.0.0"
+-source = "git+https://github.com/pop-os/libcosmic#f0f68933f1552857e2165fc0fa953228107bddef"
++source = "git+https://github.com/pop-os/libcosmic#a991d7bb433f67016c1473e8e4a03691ededd75a"
+ dependencies = [
+  "apply",
+  "ashpd 0.12.3",
diff --git a/pkgs/by-name/co/cosmic-settings/package.nix b/pkgs/by-name/co/cosmic-settings/package.nix
index 513089a3af67..5320de71ee47 100644
--- a/pkgs/by-name/co/cosmic-settings/package.nix
+++ b/pkgs/by-name/co/cosmic-settings/package.nix
@@ -27,17 +27,23 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-settings";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-settings";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-knA3qpFeRRlUMV91+LleaWxb1fexX2IJlMRD81fl7l4=";
+    hash = "sha256-LfhFza0G85+fIuACMdwV50Okh5/46z8tLoJ9IvLqTgw=";
   };
 
-  cargoHash = "sha256-2ZHuOmtBzXQ/KSBMKus9LbojfByYzzCjIkbGY8C85bU=";
+  cargoPatches = [
+    # A different reference to the `libcosmic` crate was added
+    # Remove this patch once upstream fixes their lockfile.
+    ./dedup-libcosmic.patch
+  ];
+
+  cargoHash = "sha256-rYjizOCcLJ4aq3UB5xEwWq5+KvrSi5PCUTIwUM/wegM=";
 
   separateDebugInfo = true;
   __structuredAttrs = true;
diff --git a/pkgs/by-name/co/cosmic-store/package.nix b/pkgs/by-name/co/cosmic-store/package.nix
index 25c9ad72ac4a..d29231e0e70d 100644
--- a/pkgs/by-name/co/cosmic-store/package.nix
+++ b/pkgs/by-name/co/cosmic-store/package.nix
@@ -15,17 +15,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-store";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-store";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-JE8LcFlhG4e3QqobzUNfCw3Eg10+FrlVuQu+J+96/es=";
+    hash = "sha256-pePtfOgeQtaD15dfWzrMQmXcINf/V5ovKWAG8kOPf+c=";
   };
 
-  cargoHash = "sha256-+lOt+mSTKKsSm3UzGXq43ZjbktiCCV8dnHdvnnx2vqA=";
+  cargoHash = "sha256-jECZ/6hxaDfz2pOOqLkbq5HfF3YnCVK2geFAC+n286A=";
 
   separateDebugInfo = true;
   __structuredAttrs = true;
diff --git a/pkgs/by-name/co/cosmic-term/package.nix b/pkgs/by-name/co/cosmic-term/package.nix
index 168b9b41beeb..b99fcc991196 100644
--- a/pkgs/by-name/co/cosmic-term/package.nix
+++ b/pkgs/by-name/co/cosmic-term/package.nix
@@ -15,17 +15,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-term";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-term";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-nDTDGtaGRW0JM48/tbWO/NK1WhGkPwlsqfWrDGvFE9A=";
+    hash = "sha256-ocOPssCxm2p2HoAIHIAoAMh66cGcGXuGWDuAEtHFoPQ=";
   };
 
-  cargoHash = "sha256-0W1TU1NIcV9fx/vgKpPLqLO1fcdtbZX5Ds1uQWGJ2C8=";
+  cargoHash = "sha256-ezFCpU4ZNfANYRVTMrvPMC79j55XGUwYMMKeihekYds=";
 
   separateDebugInfo = true;
   __structuredAttrs = true;
diff --git a/pkgs/by-name/co/cosmic-wallpapers/package.nix b/pkgs/by-name/co/cosmic-wallpapers/package.nix
index e7763090dc3c..a0ddd6e66db8 100644
--- a/pkgs/by-name/co/cosmic-wallpapers/package.nix
+++ b/pkgs/by-name/co/cosmic-wallpapers/package.nix
@@ -7,7 +7,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cosmic-wallpapers";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
diff --git a/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix b/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
index 24e5785fc668..92fa4090d020 100644
--- a/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
+++ b/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
@@ -14,14 +14,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cosmic-workspaces-epoch";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "cosmic-workspaces-epoch";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-u4p22qpxZPdBogzrJXGomqGGxgkpD0hdXf+3YNg2VIo=";
+    hash = "sha256-riiveHFtRF3rtOhbbUtfYRoAlqc7TCRr8aer0dgBY7g=";
   };
 
   cargoHash = "sha256-Z5dC3W8QoDBZWBjHwRj9MC8EScDjQwUiUcOPTRDToDA=";
diff --git a/pkgs/by-name/cu/curlMinimal/fix-wakeup-consumption.patch b/pkgs/by-name/cu/curlMinimal/fix-wakeup-consumption.patch
new file mode 100644
index 000000000000..0bc04b60bb87
--- /dev/null
+++ b/pkgs/by-name/cu/curlMinimal/fix-wakeup-consumption.patch
@@ -0,0 +1,32 @@
+From 2a2104f3cff44bb28bb570a093be52bbeeed8f23 Mon Sep 17 00:00:00 2001
+From: Stefan Eissing <stefan@eissing.org>
+Date: Mon, 11 May 2026 14:56:04 +0200
+Subject: [PATCH] event: fix wakeup consumption
+
+The events on a multi wakeup socketpair were only consumed via
+curl_multi_poll()/curl_multi_wait() but not in event based processing on
+a curl_multi_socket() call. That led to busy loops as reported in
+
+Fixes #21547
+Reported-by: Earnestly on github
+Closes #21549
+---
+ lib/multi.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/lib/multi.c b/lib/multi.c
+index be32740a7097..5e84133f13fd 100644
+--- a/lib/multi.c
++++ b/lib/multi.c
+@@ -2703,6 +2703,11 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
+   Curl_uint32_bset_remove(&multi->dirty, data->mid);
+ 
+   if(data == multi->admin) {
++#ifdef ENABLE_WAKEUP
++    /* Consume any pending wakeup signals before processing.
++     * This is necessary for event based processing. See #21547 */
++    (void)Curl_wakeup_consume(multi->wakeup_pair, TRUE);
++#endif
+ #ifdef USE_RESOLV_THREADED
+     Curl_async_thrdd_multi_process(multi);
+ #endif
diff --git a/pkgs/by-name/cu/curlMinimal/package.nix b/pkgs/by-name/cu/curlMinimal/package.nix
index 28220181cba0..a25ea809c62b 100644
--- a/pkgs/by-name/cu/curlMinimal/package.nix
+++ b/pkgs/by-name/cu/curlMinimal/package.nix
@@ -96,6 +96,13 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-Y/4twUi6DOromSLvg49+XJRicsLni3xZ+rS3nTziuJY=";
   };
 
+  patches = [
+    # https://github.com/curl/curl/commit/2a2104f3cff44bb28bb570a093be52bbeeed8f23
+    # According to <https://curl.se/mail/distros-2026-05/0000.html>, this fixes
+    # a performance regression, causing high CPU usage
+    ./fix-wakeup-consumption.patch
+  ];
+
   # this could be accomplished by updateAutotoolsGnuConfigScriptsHook, but that causes infinite recursion
   # necessary for FreeBSD code path in configure
   postPatch = ''
@@ -115,6 +122,7 @@ stdenv.mkDerivation (finalAttrs: {
   enableParallelBuilding = true;
 
   strictDeps = true;
+  __structuredAttrs = true;
 
   env = {
     CXX = "${stdenv.cc.targetPrefix}c++";
diff --git a/pkgs/by-name/do/doctest/package.nix b/pkgs/by-name/do/doctest/package.nix
index f6ffd1b9e559..cbea1dcba749 100644
--- a/pkgs/by-name/do/doctest/package.nix
+++ b/pkgs/by-name/do/doctest/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "doctest";
-  version = "2.5.0";
+  version = "2.5.2";
 
   src = fetchFromGitHub {
     owner = "doctest";
     repo = "doctest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7t/eknv7VtHoBgcuJmI07x//HIyqzE9HUuH5u2y7X8A=";
+    hash = "sha256-4jW6xPFCFxk1l47EkSUVojhycrtluPhOc5Adf/25R7M=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -27,6 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = true;
 
   meta = {
+    changelog = "https://github.com/doctest/doctest/releases/tag/${finalAttrs.src.tag}";
     homepage = "https://github.com/doctest/doctest";
     description = "Fastest feature-rich C++11/14/17/20 single-header testing framework";
     platforms = lib.platforms.all;
diff --git a/pkgs/by-name/du/duplicity/package.nix b/pkgs/by-name/du/duplicity/package.nix
index 7cdb8eff47f2..8e7b8698a1a4 100644
--- a/pkgs/by-name/du/duplicity/package.nix
+++ b/pkgs/by-name/du/duplicity/package.nix
@@ -75,20 +75,17 @@ let
       glib
     ];
 
-    pythonPath =
-      with python3.pkgs;
-      [
-        b2sdk
-        boto3
-        idna
-        pygobject3
-        fasteners
-        paramiko
-        pexpect
-        # Currently marked as broken.
-        # pydrive2
-      ]
-      ++ paramiko.optional-dependencies.invoke;
+    pythonPath = with python3.pkgs; [
+      b2sdk
+      boto3
+      idna
+      pygobject3
+      fasteners
+      paramiko
+      pexpect
+      # Currently marked as broken.
+      # pydrive2
+    ];
 
     nativeCheckInputs = [
       gnupg # Add 'gpg' to PATH.
diff --git a/pkgs/by-name/e2/e2fsprogs/package.nix b/pkgs/by-name/e2/e2fsprogs/package.nix
index ceb394b1c433..970ea64682c5 100644
--- a/pkgs/by-name/e2/e2fsprogs/package.nix
+++ b/pkgs/by-name/e2/e2fsprogs/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   buildPackages,
   fetchurl,
-  fetchpatch,
   pkg-config,
   libuuid,
   gettext,
@@ -20,25 +19,15 @@
 
 stdenv.mkDerivation rec {
   pname = "e2fsprogs";
-  version = "1.47.3";
+  version = "1.47.4";
 
   __structuredAttrs = true;
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/tytso/e2fsprogs/v${version}/e2fsprogs-${version}.tar.xz";
-    hash = "sha256-hX5u+AD+qiu0V4+8gQIUvl08iLBy6lPFOEczqWVzcyk=";
+    hash = "sha256-/VvziMvb4Aaj07MY2YOylIOCRArMhah/Hn0QhlPo2ws=";
   };
 
-  patches = [
-    # Upstream patch that fixes musl build (and probably others).
-    # Should be included in next release after 1.47.3.
-    (fetchpatch {
-      name = "stdio-portability.patch";
-      url = "https://git.kernel.org/pub/scm/fs/ext2/e2fsprogs.git/patch/?id=f79abd8554e600eacc2a7c864a8332b670c9e262";
-      hash = "sha256-zZ7zmSMTwGyS3X3b/D/mVG0bV2ul5xtY5DJx9YUvQO8=";
-    })
-  ];
-
   # fuse2fs adds 14mb of dependencies
   outputs = [
     "bin"
diff --git a/pkgs/by-name/ef/efitools/cross.patch b/pkgs/by-name/ef/efitools/cross.patch
new file mode 100644
index 000000000000..e1d853800b46
--- /dev/null
+++ b/pkgs/by-name/ef/efitools/cross.patch
@@ -0,0 +1,89 @@
+--- a/Make.rules
++++ b/Make.rules
+@@ -68,35 +68,35 @@ endif
+ %.h: %.auth
+ 	./xxdi.pl $< > $@
+ 
+-%.hash: %.efi hash-to-efi-sig-list
+-	./hash-to-efi-sig-list $< $@
++%.hash: %.efi
++	hash-to-efi-sig-list $< $@
+ 
+-%-blacklist.esl: %.crt cert-to-efi-hash-list
+-	./cert-to-efi-sig-list $< $@
++%-blacklist.esl: %.crt
++	cert-to-efi-sig-list $< $@
+ 
+-%-hash-blacklist.esl: %.crt cert-to-efi-hash-list
+-	./cert-to-efi-hash-list $< $@
++%-hash-blacklist.esl: %.crt
++	cert-to-efi-hash-list $< $@
+ 
+-%.esl: %.crt cert-to-efi-sig-list
+-	./cert-to-efi-sig-list -g $(MYGUID) $< $@
++%.esl: %.crt
++	cert-to-efi-sig-list -g $(MYGUID) $< $@
+ 
+ getcert = $(shell if [ "$(1)" = "PK" -o "$(1)" = "KEK" ]; then echo "-c PK.crt -k PK.key"; else echo "-c KEK.crt -k KEK.key"; fi)
+ getvar = $(shell if [ "$(1)" = "PK" -o "$(1)" = "KEK" ]; then echo $(1); else echo db; fi)
+ 
+-%.auth: %.esl PK.crt KEK.crt sign-efi-sig-list
+-	./sign-efi-sig-list $(call getcert,$*) $(call getvar,$*) $< $@
++%.auth: %.esl PK.crt KEK.crt
++	sign-efi-sig-list $(call getcert,$*) $(call getvar,$*) $< $@
+ 
+-%-update.auth: %.esl PK.crt KEK.crt sign-efi-sig-list
+-	./sign-efi-sig-list -a $(call getcert,$*) $(call getvar,$*) $< $@
++%-update.auth: %.esl PK.crt KEK.crt
++	sign-efi-sig-list -a $(call getcert,$*) $(call getvar,$*) $< $@
+ 
+-%-pkupdate.auth: %.esl PK.crt sign-efi-sig-list
+-	./sign-efi-sig-list -a -c PK.crt -k PK.key $(call getvar,$*) $< $@
++%-pkupdate.auth: %.esl PK.crt
++	sign-efi-sig-list -a -c PK.crt -k PK.key $(call getvar,$*) $< $@
+ 
+-%-blacklist.auth: %-blacklist.esl KEK.crt sign-efi-sig-list
+-	./sign-efi-sig-list -a -c KEK.crt -k KEK.key dbx $< $@
++%-blacklist.auth: %-blacklist.esl KEK.crt
++	sign-efi-sig-list -a -c KEK.crt -k KEK.key dbx $< $@
+ 
+-%-pkblacklist.auth: %-blacklist.esl PK.crt sign-efi-sig-list
+-	./sign-efi-sig-list -a -c PK.crt -k PK.key dbx $< $@
++%-pkblacklist.auth: %-blacklist.esl PK.crt
++	sign-efi-sig-list -a -c PK.crt -k PK.key dbx $< $@
+ 
+ %.o: %.c
+ 	$(CC) $(INCDIR) $(CFLAGS) $(CPPFLAGS) -c $< -o $@
+--- a/Makefile
++++ b/Makefile
+@@ -27,13 +27,11 @@ include Make.rules
+ 
+ EFISIGNED = $(patsubst %.efi,%-signed.efi,$(EFIFILES))
+ 
+-all: $(EFISIGNED) $(BINARIES) $(MANPAGES) noPK.auth $(KEYAUTH) \
++all: $(EFISIGNED) $(BINARIES) noPK.auth $(KEYAUTH) \
+ 	$(KEYUPDATEAUTH) $(KEYBLACKLISTAUTH) $(KEYHASHBLACKLISTAUTH)
+ 
+ 
+ install: all
+-	$(INSTALL) -m 755 -d $(MANDIR)
+-	$(INSTALL) -m 644 $(MANPAGES) $(MANDIR)
+ 	$(INSTALL) -m 755 -d $(EFIDIR)
+ 	$(INSTALL) -m 755 $(EFIFILES) $(EFIDIR)
+ 	$(INSTALL) -m 755 -d $(BINDIR)
+@@ -65,11 +63,11 @@ DB.h: DB.auth
+ noPK.esl:
+ 	> noPK.esl
+ 
+-noPK.auth: noPK.esl PK.crt sign-efi-sig-list
+-	./sign-efi-sig-list -t "$(shell date --date='1 second' +'%Y-%m-%d %H:%M:%S')" -c PK.crt -k PK.key PK $< $@
++noPK.auth: noPK.esl PK.crt
++	sign-efi-sig-list -t "$(shell date --date='1 second' +'%Y-%m-%d %H:%M:%S')" -c PK.crt -k PK.key PK $< $@
+ 
+-ms-%.esl: ms-%.crt cert-to-efi-sig-list
+-	./cert-to-efi-sig-list -g $(MSGUID) $< $@
++ms-%.esl: ms-%.crt
++	cert-to-efi-sig-list -g $(MSGUID) $< $@
+ 
+ hashlist.h: HashTool.hash
+ 	cat $^ > /tmp/tmp.hash
diff --git a/pkgs/by-name/ef/efitools/package.nix b/pkgs/by-name/ef/efitools/package.nix
index 89787fdb0bee..f3cc209c7d1f 100644
--- a/pkgs/by-name/ef/efitools/package.nix
+++ b/pkgs/by-name/ef/efitools/package.nix
@@ -8,7 +8,13 @@
   perlPackages,
   help2man,
   fetchzip,
+  pkgsCross,
+  efitools,
+  buildPackages,
 }:
+let
+  isCross = !(stdenv.buildPlatform.canExecute stdenv.hostPlatform);
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "efitools";
   version = "1.9.2";
@@ -16,13 +22,17 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     gnu-efi
     openssl
-    sbsigntool
   ];
 
   nativeBuildInputs = [
     perl
     perlPackages.FileSlurp
     help2man
+    openssl
+    sbsigntool
+  ]
+  ++ lib.optionals isCross [
+    efitools
   ];
 
   src = fetchzip {
@@ -39,6 +49,10 @@ stdenv.mkDerivation (finalAttrs: {
 
     # https://bugs.debian.org/1122408
     ./objcopy-output-target.patch
+  ]
+  ++ lib.optionals isCross [
+    # Use builder's efitools to create sig lists for host
+    ./cross.patch
   ];
 
   postPatch = ''
@@ -47,9 +61,26 @@ stdenv.mkDerivation (finalAttrs: {
     sed -i -e 's#$(DESTDIR)/usr#$(out)#g' Make.rules
     sed -i '$asign-efi-sig-list.o flash-var.o: CFLAGS += -D_GNU_SOURCE' Makefile
     substituteInPlace lib/console.c --replace "EFI_WARN_UNKOWN_GLYPH" "EFI_WARN_UNKNOWN_GLYPH"
+    # Fix cross-compilation: use $(AR) and $(NM) variables instead of hardcoded commands
+    substituteInPlace Make.rules --replace-fail 'ar rcv' '$(AR) rcv'
+    substituteInPlace Make.rules --replace-fail 'nm -D' '$(NM) -D'
     patchShebangs .
   '';
 
+  makeFlags = [
+    "ARCH=${stdenv.hostPlatform.parsed.cpu.name}"
+    "AR=${stdenv.cc.targetPrefix}ar"
+    "NM=${stdenv.cc.targetPrefix}nm"
+    "OBJCOPY=${stdenv.cc.targetPrefix}objcopy"
+  ]
+  ++ lib.optionals isCross [
+    "MANPAGES="
+  ];
+
+  passthru.tests = {
+    cross-aarch64 = pkgsCross.aarch64-multiplatform.efitools;
+  };
+
   meta = {
     description = "Tools for manipulating UEFI secure boot platforms";
     homepage = "https://git.kernel.org/pub/scm/linux/kernel/git/jejb/efitools.git";
diff --git a/pkgs/by-name/es/esphome/package.nix b/pkgs/by-name/es/esphome/package.nix
index da3e2f90d51c..9a69084ffd7a 100644
--- a/pkgs/by-name/es/esphome/package.nix
+++ b/pkgs/by-name/es/esphome/package.nix
@@ -33,14 +33,14 @@ let
 in
 python.pkgs.buildPythonApplication (finalAttrs: {
   pname = "esphome";
-  version = "2026.5.3";
+  version = "2026.6.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "esphome";
     repo = "esphome";
     tag = finalAttrs.version;
-    hash = "sha256-laz+XNszkayfmEyrtFr3BHUWVV9eFhj130o4l99XElY=";
+    hash = "sha256-h7aMPSXmIUutCGMoZlE3Z1wX2xNxdmZsHfBllcFHBHc=";
   };
 
   patches = [
@@ -96,6 +96,7 @@ python.pkgs.buildPythonApplication (finalAttrs: {
     pillow
     platformio
     puremagic
+    py7zr
     pyparsing
     pyserial
     pyyaml
@@ -151,6 +152,10 @@ python.pkgs.buildPythonApplication (finalAttrs: {
   disabledTestPaths = [
     # platformio builds; requires networking for dependency resolution
     "tests/integration"
+
+    # tries to dynamically patch platformio module
+    "tests/unit_tests/test_writer.py"
+    "tests/unit_tests/test_espidf_component.py"
   ];
 
   preCheck = ''
diff --git a/pkgs/by-name/ex/expat/package.nix b/pkgs/by-name/ex/expat/package.nix
index cf55e71a2037..78ff9e9253b0 100644
--- a/pkgs/by-name/ex/expat/package.nix
+++ b/pkgs/by-name/ex/expat/package.nix
@@ -18,7 +18,7 @@
 # files.
 
 let
-  version = "2.8.0";
+  version = "2.8.1";
   tag = "R_${lib.replaceStrings [ "." ] [ "_" ] version}";
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
     url =
       with finalAttrs;
       "https://github.com/libexpat/libexpat/releases/download/${tag}/${pname}-${version}.tar.xz";
-    hash = "sha256-o3v64KqXdb2FIevYXcRW1Ibw/zETj2yR/ZAupzJiRUI=";
+    hash = "sha256-ELGV7ngWCpCDiBgKj+NgPU6aEvR1X79fOBayOp11DaA=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/fa/faas-cli/package.nix b/pkgs/by-name/fa/faas-cli/package.nix
index 490442c52191..ca41bc3ee420 100644
--- a/pkgs/by-name/fa/faas-cli/package.nix
+++ b/pkgs/by-name/fa/faas-cli/package.nix
@@ -24,13 +24,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "faas-cli";
-  version = "0.18.9";
+  version = "0.18.10";
 
   src = fetchFromGitHub {
     owner = "openfaas";
     repo = "faas-cli";
     rev = finalAttrs.version;
-    sha256 = "sha256-QiRO7oJk/zjUOWr1giW29/QJY/YiKkLzROB6OxN8kIc=";
+    sha256 = "sha256-MctMhuaXJpm25VKqlhaAPG2QzSDQ//Ei8B1lRCKdz68=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/ff/fftw/package.nix b/pkgs/by-name/ff/fftw/package.nix
index 0d9736335f68..a706799bf693 100644
--- a/pkgs/by-name/ff/fftw/package.nix
+++ b/pkgs/by-name/ff/fftw/package.nix
@@ -1,6 +1,5 @@
 {
   fetchurl,
-  fetchpatch,
   stdenv,
   lib,
   gfortran,
@@ -22,24 +21,16 @@ assert lib.elem precision [
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fftw-${precision}";
-  version = "3.3.10";
+  version = "3.3.11";
 
   src = fetchurl {
     urls = [
       "https://fftw.org/fftw-${finalAttrs.version}.tar.gz"
       "ftp://ftp.fftw.org/pub/fftw/fftw-${finalAttrs.version}.tar.gz"
     ];
-    hash = "sha256-VskyVJhSzdz6/as4ILAgDHdCZ1vpIXnlnmIVs0DiZGc=";
+    hash = "sha256-VjDCTN6zOxMWEvfrSxqZNCNHVPnziP+GF0WNC+byOaE=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "remove_missing_FFTW3LibraryDepends.patch";
-      url = "https://github.com/FFTW/fftw3/pull/338/commits/f69fef7aa546d4477a2a3fd7f13fa8b2f6c54af7.patch";
-      hash = "sha256-lzX9kAHDMY4A3Td8necXwYLcN6j8Wcegi3A7OIECKeU=";
-    })
-  ];
-
   outputs = [
     "out"
     "dev"
@@ -107,6 +98,7 @@ stdenv.mkDerivation (finalAttrs: {
   __structuredAttrs = true;
 
   meta = {
+    changelog = "https://github.com/FFTW/fftw3/blob/fftw-${finalAttrs.version}/NEWS";
     description = "Fastest Fourier Transform in the West library";
     homepage = "https://www.fftw.org/";
     license = lib.licenses.gpl2Plus;
diff --git a/pkgs/by-name/fr/freeplane/deps.json b/pkgs/by-name/fr/freeplane/deps.json
index f061ee3c311e..8d89c21c0e32 100644
--- a/pkgs/by-name/fr/freeplane/deps.json
+++ b/pkgs/by-name/fr/freeplane/deps.json
@@ -109,12 +109,18 @@
   "com/fasterxml#oss-parent/65": {
    "pom": "sha256-2wuaUmqeMDxjuptYSWicYfs4kkf6cjEFS5DgvwC0MR4="
   },
+  "com/fasterxml#oss-parent/70": {
+   "pom": "sha256-JsqO1vgsnS7XzTIpgQW7ZcD52JnbYXV6CXQVhvqTpjk="
+  },
   "com/fasterxml/jackson#jackson-base/2.18.3": {
    "pom": "sha256-1bv9PIRFIw5Ji2CS3oCa/WXPUE0BOTLat7Pf1unzpP0="
   },
   "com/fasterxml/jackson#jackson-base/2.19.0": {
    "pom": "sha256-Noz4ykJkRni737F6sUfJC8QyWaWZUJfD8cT7au9Mdcg="
   },
+  "com/fasterxml/jackson#jackson-base/2.20.1": {
+   "pom": "sha256-C3SKsMx/KH21tgGMYUz+Z+fh9NgJQc4vQdMXzMO1tcU="
+  },
   "com/fasterxml/jackson#jackson-bom/2.17.1": {
    "pom": "sha256-n0RhIo4SkQPu16MC3BABqy5Mgt086pFcKn27jMYe/SU="
   },
@@ -124,6 +130,9 @@
   "com/fasterxml/jackson#jackson-bom/2.19.0": {
    "pom": "sha256-sR/LPvM6wH5oDObYXxfELWoz2waG+6z68OQ0j8Y5cbI="
   },
+  "com/fasterxml/jackson#jackson-bom/2.20.1": {
+   "pom": "sha256-DGRn7UyMc5JSTOcDymzj7YhZbuw5DxOwwmTy+WEwilQ="
+  },
   "com/fasterxml/jackson#jackson-parent/2.17": {
    "pom": "sha256-rubeSpcoOwQOQ/Ta1XXnt0eWzZhNiSdvfsdWc4DIop0="
   },
@@ -133,6 +142,9 @@
   "com/fasterxml/jackson#jackson-parent/2.19": {
    "pom": "sha256-bNk0tNFdfz7hONl7I8y4Biqd5CJX7YelVs7k1NvvWxo="
   },
+  "com/fasterxml/jackson#jackson-parent/2.20": {
+   "pom": "sha256-tDt/XGLoaxZPrnCuF9aRHF22B5mvAQVzYK/aguSEW+U="
+  },
   "com/fasterxml/jackson/core#jackson-annotations/2.18.3": {
    "jar": "sha256-iqV0DYC1pQJVCLQbutuqH7N3ImfGKLLjBoGk9F+LiTE=",
    "module": "sha256-RkWF2yH0irFZ6O9XnNfo5tMHoEdhGZZRw+zBf05ydF0=",
@@ -143,6 +155,11 @@
    "module": "sha256-HzHOjWv4Trf0q6Hl/gGn7mshk+mw8rv4zENMRUXVGh8=",
    "pom": "sha256-MnlOx3WinmcwPfut370Jq/3nKaRPWuJ7Wew8g65vOuA="
   },
+  "com/fasterxml/jackson/core#jackson-annotations/2.20": {
+   "jar": "sha256-lZov+y1ZFDb1Hxg8alIfyJNHkS9xG/DK4AjN8EXZUxk=",
+   "module": "sha256-wHDxTsg1jQlcAurootZcsAzLoOXFqnOwASlDM/5GiXE=",
+   "pom": "sha256-TXQMRHjdCNCJ7NxtBjIopVoRp+jkl9pDOPhy+BFXlKQ="
+  },
   "com/fasterxml/jackson/core#jackson-core/2.18.3": {
    "jar": "sha256-BWvE0+XlPOghRQ+pez+eD43eElz22miENTux8JWC4dk=",
    "module": "sha256-mDbVp/Iba8VNfybeh8izBd3g5PGEsqyJUOmhsd9Hw0A=",
@@ -153,6 +170,11 @@
    "module": "sha256-WT2jX9rflNEYYvfErCjcq52J1bzd2y2jOe7WFXxVbYk=",
    "pom": "sha256-zOajQFk4YjqBCJX/b94vBMnDuTegVihx4aY0lr4Pr6s="
   },
+  "com/fasterxml/jackson/core#jackson-core/2.20.1": {
+   "jar": "sha256-/6tNlX2qJ5bPJMtm0LeKcJDxvL4Xw6RXjwmv+q8TcIk=",
+   "module": "sha256-GalAQ0Ic2ahuFUkSnDjBjgs1exQUWuT3Ns2gL4Bch8k=",
+   "pom": "sha256-FuBJqySPgqpssEjwTVLvPuH1TIDaHSY68k++UM9ueX4="
+  },
   "com/fasterxml/jackson/core#jackson-databind/2.18.3": {
    "jar": "sha256-UQvdp1p6YYbFvzO4USOUiKFFCQauV1cSHy4cxIp+EI8=",
    "module": "sha256-ZCqggPhbIAV3ifrPKsaibhR4NbUDPidSDstpe8RD/Lo=",
@@ -163,6 +185,11 @@
    "module": "sha256-Z2HeLgXl0m7GK5R/p1AJEZDz/JnM8iaM3suTz/bfbSo=",
    "pom": "sha256-f0zGn9XZuwIW0ULD2Cv/2v64bUelU8KBRbjOcOfreHY="
   },
+  "com/fasterxml/jackson/core#jackson-databind/2.20.1": {
+   "jar": "sha256-NLvrRSb/9PhWWxIQa/haavy66FiWbUibVCFKxGsuJug=",
+   "module": "sha256-S1M7Mu5wZfVaSnsNbuTYn9WDdxSr83YUyJkRT7EhWHo=",
+   "pom": "sha256-vP3yeCUyMraDq1HeLcvI+Y8g9Hc4wRHs/SyFxBsTHOw="
+  },
   "com/fasterxml/jackson/dataformat#jackson-dataformat-yaml/2.18.3": {
    "jar": "sha256-PKAOR8/LQ+eUON3PyPxzXp66w4JPt3aROGCb5r1W5IM=",
    "module": "sha256-v2AjrStgVyCsbaJ6K16Y7bGjJs0L9jfDpAtiH+jgk80=",
@@ -173,12 +200,20 @@
    "module": "sha256-PMYsM/xsilphLhhqrDn6Lagh8wZqt9Dj0O5Jh8moGtw=",
    "pom": "sha256-/vTqd2/yMf2s7avll/9DGpXe9Rjk9140ZLwr5HCj23o="
   },
+  "com/fasterxml/jackson/dataformat#jackson-dataformat-yaml/2.20.1": {
+   "jar": "sha256-Aw8dkfffJ46G4bo+Ep+1IIcawWzlMBfHNfcIgjvpcNs=",
+   "module": "sha256-At0WoElpdLY7sgrszAK2fpeuQ6Uc5H1JSbyAUiLHQxI=",
+   "pom": "sha256-JrotoAFsKiNbPccCc5xm3O6xjKBURirhVE2srfnguSU="
+  },
   "com/fasterxml/jackson/dataformat#jackson-dataformats-text/2.18.3": {
    "pom": "sha256-VnParMboVZdt7O3rRtxjOVprGsmkg+Zy8IMc9G/gbiU="
   },
   "com/fasterxml/jackson/dataformat#jackson-dataformats-text/2.19.0": {
    "pom": "sha256-wZ0UHUA3aIQ2Rq7KvAMdPPqalqeH2Cfqmj5KDCguUwI="
   },
+  "com/fasterxml/jackson/dataformat#jackson-dataformats-text/2.20.1": {
+   "pom": "sha256-bIZ3yvUcuerYfbYmiPNR3MxDrPkAqONHcuQQ0TOPaqs="
+  },
   "com/fasterxml/jackson/datatype#jackson-datatype-jsr310/2.19.0": {
    "jar": "sha256-Dul78yk2NJ1qTPbYQoUzv0pLWz5+Vf2aTxlQjOBip3U=",
    "module": "sha256-cg5M2qz3VPSlMw9EWBBhKPSGf4D7jTB1tavgx6Auam4=",
@@ -312,6 +347,11 @@
    "jar": "sha256-dVx5UBq9gG9aqDJX3Iiyylkj5pZfPL/ocxFsfJdoIQo=",
    "pom": "sha256-XPoeoCxNwZ0n3Vr8pRPynGerNE0aylU9jxbxW2mOT4U="
   },
+  "com/knuddels#jtokkit/1.1.0": {
+   "jar": "sha256-FQHOAlmriXxnRsz6+h0gis1AT7F+GsYuFXFy8meLEYM=",
+   "module": "sha256-QxxAPs80ROw72ZNJIvNpOf1vCClXmpolySdBmSzVjC8=",
+   "pom": "sha256-cfjoMOMzqx9I5NAy7FSiu4J6Zk+crtGlo8h815W+8eA="
+  },
   "com/moandjiezana/toml#toml4j/0.7.2": {
    "jar": "sha256-9UdeY+fonl22IiNImux6Vr0wNUN3IHehfCy1TBnKOiA=",
    "pom": "sha256-W3YhZzfy2pODlTrMybpY9uc500Rnh5nm1NCCz24da9M="
@@ -445,6 +485,34 @@
    "jar": "sha256-aBm3LpRQ2u5e9WMeq1pHT2BFJo2MZjugKAzQZHMtsgM=",
    "pom": "sha256-aNbsZVtGv6PXgOzwYrww3uyoxJTFrptUgJmqMfddj/8="
   },
+  "dev/langchain4j#langchain4j-core/1.10.0": {
+   "jar": "sha256-mLYaUMXnrQqgAeZzNaQiC5Oxdjb0GJjpJKlITPY6D2A=",
+   "pom": "sha256-RWtDs6sZ13bd8B5Lo4Ns3PQY+lqMY03D7RIYNfL61Us="
+  },
+  "dev/langchain4j#langchain4j-google-ai-gemini/1.10.0": {
+   "jar": "sha256-vnn3FTdhbL20H9mGx8FCGbxbSjUZinzPILPzCw+oQGM=",
+   "pom": "sha256-fl3i8dKdWFoKqrcU/7ApPsovnfghcTnsIxeztR2W+Zc="
+  },
+  "dev/langchain4j#langchain4j-http-client-jdk/1.10.0": {
+   "jar": "sha256-UvACwI95ym0tgB5pk+2qi6y80E8j9aWl2kP3LhPzc7Q=",
+   "pom": "sha256-O157qvYTpQygMo1F/uQECx87iQjmxDMdAQaFrqmWIXQ="
+  },
+  "dev/langchain4j#langchain4j-http-client/1.10.0": {
+   "jar": "sha256-2/8KUpgCqg4B7cpaw/Jge9xKpwMUfQkYYy5WiEys22M=",
+   "pom": "sha256-6pKR89smKWwyMeIhcnrhJ1PSDZd6rPPgJ5DPZz7iugs="
+  },
+  "dev/langchain4j#langchain4j-ollama/1.10.0": {
+   "jar": "sha256-gdAO/aKXlr/wfOToNukxKs0rY5KM5pl08fW/J+PuB8A=",
+   "pom": "sha256-DMFtKMuYoTb/lj/9cg5i8gtAaN7KaOQWM11w+U+W61s="
+  },
+  "dev/langchain4j#langchain4j-open-ai/1.10.0": {
+   "jar": "sha256-Gc86eMzldPSmjXH3MOd8miVgxddLqWCCFJ7TtmbEpT4=",
+   "pom": "sha256-dsuM2N519LnL0ILyPczhPN5lCnRoIJ06mdwOt7ihgg8="
+  },
+  "dev/langchain4j#langchain4j/1.10.0": {
+   "jar": "sha256-FbLb3RdPhOw9IGUgEZhp1cy3RVcO5UB/k8iSYqSrbug=",
+   "pom": "sha256-Lks6x5I/NCz4wXrmBuYheDDhrjB7Hy9/wBc/JIAmx5E="
+  },
   "info/picocli#picocli/4.7.7": {
    "jar": "sha256-+G4w//0Q0rE7jKqNSyN6fuYfL/zPWxlB3nGLdl0jW/g=",
    "pom": "sha256-GxjTYxNN9mYx0rn3R1Bo1zQiW6OJzfkIKhvYvakNV9M="
@@ -569,6 +637,9 @@
   "org/apache#apache/33": {
    "pom": "sha256-14vYUkxfg4ChkKZSVoZimpXf5RLfIRETg6bYwJI6RBU="
   },
+  "org/apache#apache/34": {
+   "pom": "sha256-NnGunU0GKuO7mFcxx2CIuy9vfXJU4tME7p9pC5dlEyg="
+  },
   "org/apache#apache/7": {
    "pom": "sha256-E5fOHbQzrcnyI9vwdJbRM2gUSHUfSuKeWPaOePtLbCU="
   },
@@ -891,6 +962,13 @@
    "jar": "sha256-RKYMYQ9OMVJLA9gaaYsezOuhFjIOpRC6v4WVdbLqcjM=",
    "pom": "sha256-NFZNRisHTeJlC4Vb5yPej1WT5ZDLkTK6402dsd/7W+c="
   },
+  "org/apache/opennlp#opennlp-tools/2.5.4": {
+   "jar": "sha256-Xv7bJtDpflNweo0vDi4o8F/PZU/OKjP4v+EcLUwqT+k=",
+   "pom": "sha256-/UVXkW5ld1lWw36M3afZrSvKd4opyY1qXG4xth+D1WA="
+  },
+  "org/apache/opennlp#opennlp/2.5.4": {
+   "pom": "sha256-Qz0Ic+wnz+Gxog6mQ3c6LymkCh/eobtdGCiy81NQwps="
+  },
   "org/apache/pdfbox#fontbox/3.0.3": {
    "jar": "sha256-ZWkMPzmwShTRLBf0mYwVGGzod9Pi7CIscIV348wCgDA=",
    "pom": "sha256-sik+UDqncEMGEVD4hGg9f2FMz1Fjvi0PBSyinzx2d+I="
@@ -1209,6 +1287,10 @@
    "module": "sha256-3nCsXZGlJlbYiQptI7ngTZm5mxoEAlMN7K1xvzGyc14=",
    "pom": "sha256-zvgP7IZFT2gGv7DfJGabXG8y4styhTnqhZ9H39ybvBc="
   },
+  "org/junit#junit-bom/5.13.4": {
+   "module": "sha256-6Vkoj94bGwUNm8CC/HhniRKNpdKFMJFGj8pQQQS99AA=",
+   "pom": "sha256-16CKmbJQLwu2jNTh+YTwv2kySqogi9D3M2bAP8NUikI="
+  },
   "org/junit#junit-bom/5.9.3": {
    "module": "sha256-tAH9JZAeWCpSSqU0PEs54ovFbiSWHBBpvytLv87ka5M=",
    "pom": "sha256-TQMpzZ5y8kIOXKFXJMv+b/puX9KIg2FRYnEZD9w0Ltc="
@@ -1366,6 +1448,7 @@
    "pom": "sha256-Udh5pZmPWCJ0Dc9VIsDtaXGtXEpeowtw9bVGCT5rQmM="
   },
   "org/slf4j#slf4j-api/2.0.17": {
+   "jar": "sha256-e3UdlSBhlU1av+1xgcH2RdM2CRtnmJFZHWMynGIuuDI=",
    "pom": "sha256-FQxAKH987NwhuTgMqsmOkoxPM8Aj22s0jfHFrJdwJr8="
   },
   "org/slf4j#slf4j-api/2.1.0-alpha1": {
diff --git a/pkgs/by-name/fr/freeplane/package.nix b/pkgs/by-name/fr/freeplane/package.nix
index b4bcec11fcec..32cf9417c51c 100644
--- a/pkgs/by-name/fr/freeplane/package.nix
+++ b/pkgs/by-name/fr/freeplane/package.nix
@@ -8,11 +8,12 @@
   gradle_9,
   which,
   copyDesktopItems,
+  fetchpatch,
 }:
 
 let
   pname = "freeplane";
-  version = "1.12.16";
+  version = "1.13.2";
 
   jdk = jdk17;
   gradle = gradle_9;
@@ -21,13 +22,21 @@ let
     owner = "freeplane";
     repo = "freeplane";
     rev = "release-${version}";
-    hash = "sha256-I7vp67UXoiBDxmIOlgCWk6sKOZSWHHI7A2Sdu6cl488=";
+    hash = "sha256-NDji6psNXESAY5NWI/Ms63MTgbxZHiIxYAgOSkWHuK0=";
   };
 
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   inherit pname version src;
 
+  patches = [
+    # Gradle 9.5 compatibility. Remove on next version bump.
+    (fetchpatch {
+      url = "https://github.com/freeplane/freeplane/commit/34189b58bbdf0027185a212e2d6bd9e289782ef2.patch";
+      hash = "sha256-gVCKXme+pB7PV0yBoDMPg6ltCaTGYh1lspEKgwVkDgc=";
+    })
+  ];
+
   nativeBuildInputs = [
     makeBinaryWrapper
     jdk
diff --git a/pkgs/by-name/fr/freetype/package.nix b/pkgs/by-name/fr/freetype/package.nix
index 76ffe6324cf2..2f5f6ccef0a8 100644
--- a/pkgs/by-name/fr/freetype/package.nix
+++ b/pkgs/by-name/fr/freetype/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
   buildPackages,
   pkgsHostHost,
   pkg-config,
@@ -39,7 +40,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "freetype";
-  version = "2.14.2";
+  version = "2.14.3";
 
   src =
     let
@@ -47,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
     in
     fetchurl {
       url = "mirror://savannah/freetype/freetype-${version}.tar.xz";
-      sha256 = "sha256-S2Lcq0ySChqGA2mTMiGBQ2LmmeJvVXklFtZx5v9VteE=";
+      sha256 = "sha256-NrxPHMQTM1No7mVsQq/KZcWjmH6HaMwozxG6d154Wl8=";
     };
 
   propagatedBuildInputs = [
@@ -69,6 +70,53 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./enable-table-validation.patch
+
+    # https://project-zero.issues.chromium.org/issues/505355061
+    # https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1419
+    # https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1420
+    (fetchpatch {
+      name = "truetype-shz-limit-heap-buffer-overflow-part1.patch";
+      url = "https://gitlab.freedesktop.org/freetype/freetype/-/commit/1803559c4ee407d0bcbf2a67dbe96690cee869d2.patch";
+      hash = "sha256-zxtJ2pJz8pNofgYrJ6c8/eZqRvxTotanF2IdU9ckpM4=";
+    })
+    (fetchpatch {
+      name = "truetype-shz-limit-heap-buffer-overflow-part2.patch";
+      url = "https://gitlab.freedesktop.org/freetype/freetype/-/commit/7d600a022e1d813e85a8c94ffd395f6135872267.patch";
+      hash = "sha256-aHE11C9Cr23D2lqNmTVUDA5E07xxUm+AcYdWJG9zLFs=";
+    })
+
+    # https://project-zero.issues.chromium.org/issues/505357209
+    # https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1421
+    (fetchpatch {
+      name = "truetype-iup-integer-overflow.patch";
+      url = "https://gitlab.freedesktop.org/freetype/freetype/-/commit/7974be74d8b5a2fbf99aa88f0461d1f80af51cee.patch";
+      hash = "sha256-b5Px0ALsnC5K1+601YioAjCLkLVXNnvTIZ1aQtCeNoQ=";
+    })
+
+    # https://project-zero.issues.chromium.org/issues/506902245
+    # https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1423
+    # https://gitlab.freedesktop.org/freetype/freetype/-/merge_requests/428
+    (fetchpatch {
+      name = "truetype-variation-handling-signednes-mismatch.patch";
+      url = "https://gitlab.freedesktop.org/freetype/freetype/-/commit/0d45c7f1911bc6db0bf072eea0c8cdccd77bc6b3.patch";
+      hash = "sha256-bw/9O86sZQa+vwdgx2MTqxWi6vjMcRTyC42ba9CaZ3I=";
+    })
+
+    # prerequisite for the below to apply, since this changes formatting of
+    # affected code.
+    (fetchpatch {
+      name = "ftobjs-formatting.patch";
+      url = "https://gitlab.freedesktop.org/freetype/freetype/-/commit/590b77014bd920d0bdf64c039fddbce89a288b83.patch";
+      hash = "sha256-govOzLBzQMAjSKABVFryDnSn2by2f/W9BgGG3o+qSuE=";
+    })
+
+    # https://project-zero.issues.chromium.org/issues/507321912
+    # https://gitlab.freedesktop.org/freetype/freetype/-/work_items/1425
+    (fetchpatch {
+      name = "sub-byte-bitmaps-heap-buffer-over-read.patch";
+      url = "https://gitlab.freedesktop.org/freetype/freetype/-/commit/cbe12767ea73d1006edc75fcd61c0b0d2a88f34e.patch";
+      hash = "sha256-jMeqY9uX7Ryfdd8icGDT4kEKl6aGRWafSN8GzOhGW7g=";
+    })
   ]
   ++ lib.optional useEncumberedCode ./enable-subpixel-rendering.patch;
 
diff --git a/pkgs/by-name/gh/ghostscript/package.nix b/pkgs/by-name/gh/ghostscript/package.nix
index 36b9ced6f56b..6cd7c4b18ed1 100644
--- a/pkgs/by-name/gh/ghostscript/package.nix
+++ b/pkgs/by-name/gh/ghostscript/package.nix
@@ -67,13 +67,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ghostscript${lib.optionalString x11Support "-with-X"}";
-  version = "10.07.0";
+  version = "10.07.1";
 
   src = fetchurl {
     url = "https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs${
       lib.replaceStrings [ "." ] [ "" ] finalAttrs.version
     }/ghostscript-${finalAttrs.version}.tar.xz";
-    hash = "sha256-3azk4XIflnpVA5uv9WSEAiXguqHU9UMiR8oczRRzt8E=";
+    hash = "sha256-HNt2bejbjx5YnIF/CcWFXqX2XfyFQORlpprBTBhBYCU=";
   };
 
   patches = [
@@ -233,6 +233,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://www.ghostscript.com/";
+    changelog = "https://ghostscript.readthedocs.io/en/gs${finalAttrs.version}/News.html";
     description = "PostScript interpreter (mainline version)";
     longDescription = ''
       Ghostscript is the name of a set of tools that provides (i) an
diff --git a/pkgs/by-name/go/gomuks-web/package.nix b/pkgs/by-name/go/gomuks-web/package.nix
index 7c85ab2f0abe..8e63af527577 100644
--- a/pkgs/by-name/go/gomuks-web/package.nix
+++ b/pkgs/by-name/go/gomuks-web/package.nix
@@ -21,7 +21,7 @@ buildGoModule (finalAttrs: {
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-UH/T3eqFy0KrG/ouEzifJeWXXwe5cUPYG7DpIO0GsYc=";
+  vendorHash = "sha256-iuSu5MvNRt+eCZ9wxUwMo6X0joos7q9WPyXBwhn/0yE=";
 
   nativeBuildInputs = [
     nodejs
@@ -42,15 +42,6 @@ buildGoModule (finalAttrs: {
   };
 
   postPatch = ''
-    # required until libheif gets bumped
-    substituteInPlace ./go.mod \
-      --replace-fail 'github.com/strukturag/libheif v1.23.0' 'github.com/strukturag/libheif v1.21.2'
-
-    substituteInPlace ./go.sum \
-      --replace-fail 'github.com/strukturag/libheif v1.23.0 h1:G9Fjf/b8dvTgLIk148tUKp7Z7rgu88FC+Mc8o92U98k=' 'github.com/strukturag/libheif v1.21.2 h1:YFD3crf+d33cFVQh3aTkkVGwJFyWpfqVT4XhzHWU6mA=' \
-      --replace-fail 'github.com/strukturag/libheif v1.23.0/go.mod h1:E/PNRlmVtrtj9j2AvBZlrO4dsBDu6KfwDZn7X1Ce8Ks=' 'github.com/strukturag/libheif v1.21.2/go.mod h1:E/PNRlmVtrtj9j2AvBZlrO4dsBDu6KfwDZn7X1Ce8Ks='
-
-
     substituteInPlace ./web/build-wasm.sh \
       --replace-fail 'go.mau.fi/gomuks/version.Tag=$(git describe --exact-match --tags 2>/dev/null)' "go.mau.fi/gomuks/version.Tag=${finalAttrs.src.tag}" \
       --replace-fail 'go.mau.fi/gomuks/version.Commit=$(git rev-parse HEAD)' "go.mau.fi/gomuks/version.Commit=unknown"
diff --git a/pkgs/by-name/go/gotosocial/package.nix b/pkgs/by-name/go/gotosocial/package.nix
index 7f674be42123..9b0d66660ca5 100644
--- a/pkgs/by-name/go/gotosocial/package.nix
+++ b/pkgs/by-name/go/gotosocial/package.nix
@@ -11,13 +11,13 @@
 }:
 buildGo125Module (finalAttrs: {
   pname = "gotosocial";
-  version = "0.21.2";
+  version = "0.21.3";
 
   src = fetchFromCodeberg {
     owner = "superseriousbusiness";
     repo = "gotosocial";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Z3j5/pXnNTHgBmPEfFgjOJuL03LsPtvAwbuoL9wb5bk=";
+    hash = "sha256-gemi9t4wTjmCHEXfdXz1X9Q4gcvj/3LMtlrO5UpQ19M=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/gr/groff/package.nix b/pkgs/by-name/gr/groff/package.nix
index a824d9a82f02..083b1493dcf6 100644
--- a/pkgs/by-name/gr/groff/package.nix
+++ b/pkgs/by-name/gr/groff/package.nix
@@ -48,8 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-dOKBl5W2r/QxrqyYPWOpyJaO6roqLrp9+LpMe0Hnz9g=";
   };
 
-  patches = lib.optionals stdenv.isLinux [
-    # TODO: apply everywhere on rebuild
+  patches = [
     # This revert a upstream refactor in continuous rendering mode, but this
     # causes a big performance regression for big manpages like
     # `man 5 configuration.nix`.
diff --git a/pkgs/by-name/gt/gtk4/package.nix b/pkgs/by-name/gt/gtk4/package.nix
index 28fd6efc8850..9b7807508a35 100644
--- a/pkgs/by-name/gt/gtk4/package.nix
+++ b/pkgs/by-name/gt/gtk4/package.nix
@@ -95,11 +95,13 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-Ub2fYMfSOmZaVWxzZMIfsuTiglZrPn4JJFXo+RAzCJM=";
   };
 
-  patches = lib.optional stdenv.hostPlatform.is32bit (fetchpatch {
-    name = "fix-32bit-VkImage-null.patch";
-    url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/10d43de8f4f942cb591ada3103474bd7213425f1.patch";
-    hash = "sha256-DJIL6M3XcsjBoMO77OxNi84d1DxAphAfot3N7Nq1QqQ=";
-  });
+  patches = [
+    (fetchpatch {
+      name = "fix-32bit-VkImage-null.patch";
+      url = "https://gitlab.gnome.org/GNOME/gtk/-/commit/10d43de8f4f942cb591ada3103474bd7213425f1.patch";
+      hash = "sha256-DJIL6M3XcsjBoMO77OxNi84d1DxAphAfot3N7Nq1QqQ=";
+    })
+  ];
 
   depsBuildBuild = [
     pkg-config
diff --git a/pkgs/by-name/hm/hmcl/package.nix b/pkgs/by-name/hm/hmcl/package.nix
index 51a6d4b2e13e..0d4a96882331 100644
--- a/pkgs/by-name/hm/hmcl/package.nix
+++ b/pkgs/by-name/hm/hmcl/package.nix
@@ -50,13 +50,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "hmcl";
-  version = "3.15.1";
+  version = "3.15.2";
 
   src = fetchurl {
     # HMCL has built-in keys, such as the Microsoft OAuth secret and the CurseForge API key.
     # See https://github.com/HMCL-dev/HMCL/blob/refs/tags/release-3.6.12/.github/workflows/gradle.yml#L26-L28
     url = "https://github.com/HMCL-dev/HMCL/releases/download/v${finalAttrs.version}/HMCL-${finalAttrs.version}.jar";
-    hash = "sha256-Uv6w3XEySoqsKCmZVmiDkGfmeretHfvpwFmYMJz0mv4=";
+    hash = "sha256-rT+RruLMz/DTlYSOMv4D6ZCOVt36iqyx42v8ea4XSdM=";
   };
 
   # - HMCL prompts users to download prebuilt Terracotta binary for
@@ -71,7 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
   terracottaBundleJava = fetchurl {
     name = "hmcl-terracotta-bundle-java-${finalAttrs.version}";
     url = "https://raw.githubusercontent.com/HMCL-dev/HMCL/v${finalAttrs.version}/${finalAttrs.terracottaBundleJavaPath}";
-    hash = "sha256-05U4/TUYECPgrzZbLiSPUwo5XtIm2w+T8gCdtqpsRVs=";
+    hash = "sha256-1o/CUDeywtDlhAxqInk77aUwGCCYeZ84VMIyouN49uU=";
   };
   macOSProviderJava = fetchurl {
     name = "hmcl-macos-provider-java-${finalAttrs.version}";
diff --git a/pkgs/by-name/im/imagemagick/package.nix b/pkgs/by-name/im/imagemagick/package.nix
index 40d518373564..ffce265c53e0 100644
--- a/pkgs/by-name/im/imagemagick/package.nix
+++ b/pkgs/by-name/im/imagemagick/package.nix
@@ -89,13 +89,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "imagemagick";
-  version = "7.1.2-23";
+  version = "7.1.2-24";
 
   src = fetchFromGitHub {
     owner = "ImageMagick";
     repo = "ImageMagick";
     tag = finalAttrs.version;
-    hash = "sha256-zYk75q+EyWq5g/AHFU6v8a7gye0aDAEe/ZZvjqR9ZTc=";
+    hash = "sha256-oSH0dsQ3cuFNYJIIr6LHbv82FbFxxcmkjQ5csTNsYCA=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/is/ispc/package.nix b/pkgs/by-name/is/ispc/package.nix
index a268f04696ed..e08668ded3f6 100644
--- a/pkgs/by-name/is/ispc/package.nix
+++ b/pkgs/by-name/is/ispc/package.nix
@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ispc";
-  version = "1.30.0";
+  version = "1.31.0";
 
   src = fetchFromGitHub {
     owner = "ispc";
     repo = "ispc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CzyK38c8fCG7QiVHE0rSzxmyTXNr4sg1WtChbi75Wmw=";
+    hash = "sha256-n1zWokIuZEDJZN/KH3jxnIhgUo8iKDfZwiQnXZdxhL8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/is/istioctl/package.nix b/pkgs/by-name/is/istioctl/package.nix
index fe374d91274a..78605d13c195 100644
--- a/pkgs/by-name/is/istioctl/package.nix
+++ b/pkgs/by-name/is/istioctl/package.nix
@@ -7,15 +7,15 @@
 
 buildGoModule (finalAttrs: {
   pname = "istioctl";
-  version = "1.30.1";
+  version = "1.30.2";
 
   src = fetchFromGitHub {
     owner = "istio";
     repo = "istio";
     rev = finalAttrs.version;
-    hash = "sha256-jW0L/86D0YgAoUYAZfwHMGes5x0P5QLelP79XuG3riU=";
+    hash = "sha256-Ejt6MjBmkWnYWHp9TiWYO6e1VV/+TN6cVZXYK3+B5Fc=";
   };
-  vendorHash = "sha256-dOPrYZxOeP1ZahSaPS6U6tJDbTx/5BbwHFcNKS+2Lqc=";
+  vendorHash = "sha256-cHW8FSYuZpl1GuWKsJLnAxCMOLvuaRwN1oL+xjwYspI=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/ja/jabref/deps.json b/pkgs/by-name/ja/jabref/deps.json
index a2a97eb36cb5..8d6f03f20126 100644
--- a/pkgs/by-name/ja/jabref/deps.json
+++ b/pkgs/by-name/ja/jabref/deps.json
@@ -868,9 +868,9 @@
    "jar": "sha256-MnesECrheq0QpVq+x1/1aWyNEJeQOWQ0tJbnUIeFQgM=",
    "pom": "sha256-V5BVJCdKAK4CiqzMJyg/a8WSWpNKBGwcxdBsjuTW1ak="
   },
-  "org/jetbrains/kotlin#kotlin-reflect/2.3.0": {
-   "jar": "sha256-cU30voGVRf9N4fNqohg+DeqUtMjN98op6ciZGbrzY2I=",
-   "pom": "sha256-89F2jvL7UxBIPb6R4w6fo2x7Pi/e5pRaCLujEBQtKcE="
+  "org/jetbrains/kotlin#kotlin-reflect/2.3.20": {
+   "jar": "sha256-40b6PD/0RR9fcHoxKIf9TIVV2kjMFfqdsrqTwz+J+BM=",
+   "pom": "sha256-iwC9L+srtVON85aVQXTZ3cDsVA00ElhjA1ObHpZVwzM="
   },
   "org/jetbrains/kotlin#kotlin-sam-with-receiver-compiler-plugin-embeddable/2.2.21": {
    "jar": "sha256-yweF5qeHDS9eqW9kcCDigS3snXAjAzMZu9sc5+XmVUg=",
@@ -924,10 +924,10 @@
    "module": "sha256-v7xlfd06jjfkyK1BeWjV6wsLFxyfzkj5YsKtMu5DTCE=",
    "pom": "sha256-zzH5IxlsY67ezQpXwkJpvTcCpOR8C/C9ZLWtpd5SInI="
   },
-  "org/jetbrains/kotlin#kotlin-stdlib/2.3.0": {
-   "jar": "sha256-iHWHyRcTJQrVL+FK2RZtBCwzg1BJiQ6UN/NV/8WhlbE=",
-   "module": "sha256-CRCoo7aWD8eSxFxWqR18Oj8mKG8DKVVUtRnP83h1baI=",
-   "pom": "sha256-TVJW0+SETmVrDKQF9jUNbyF5XCQ3WzRSUmxUZ92ZtaI="
+  "org/jetbrains/kotlin#kotlin-stdlib/2.3.20": {
+   "jar": "sha256-CuElBKUEDrrzdwOQhINCDRpWJN0dk/NXZl+Md8hIoB4=",
+   "module": "sha256-9Os0T8TR46KK4WwIbsPkL1I3O0ZtQwgYL7OG45LA76M=",
+   "pom": "sha256-yDwC2afi6VRzBJHDPC8dwDwnZi4ntWbsK0TS0Bhjm5g="
   },
   "org/jetbrains/kotlin#kotlin-tooling-core/2.2.21": {
    "jar": "sha256-dAFOxPPveM59p+Pmlk8sUmoxIdXFj++MopeeXzRFgvQ=",
@@ -1319,15 +1319,22 @@
   "com/google/code/gson#gson-parent/2.13.2": {
    "pom": "sha256-g6tSip1Q/XauuK1vcns+6ct2ZYYlV3TtFsqMTHbZ2s0="
   },
+  "com/google/code/gson#gson-parent/2.14.0": {
+   "pom": "sha256-grD2aUxXWKuLsH4FYwII1Q9YnUteBP0KBG1Zzfe6PR0="
+  },
   "com/google/code/gson#gson/2.13.2": {
    "jar": "sha256-3QzhtVo+0ggMtw+cZVhQzahsIGhiMQAJ3LXlyVJlpeA=",
    "pom": "sha256-OqBqp8D5rwkpYaQtCVeOQyS+FGNIoO5u1HhX98Jne3Y="
   },
+  "com/google/code/gson#gson/2.14.0": {
+   "jar": "sha256-LL0Rm/GWHCh4gxCWPcgLpl9Yze7B3ROci9sSQPqiw28=",
+   "pom": "sha256-H6ASLA43MxkmQoYcNr5Mb3maeVMnojvdKSJpG26bpIA="
+  },
   "com/google/code/gson/gson/maven-metadata": {
    "xml": {
     "groupId": "com.google.code.gson",
-    "lastUpdated": "20250910210152",
-    "release": "2.13.2"
+    "lastUpdated": "20260423191314",
+    "release": "2.14.0"
    }
   },
   "com/google/errorprone#error_prone_annotation/2.44.0": {
@@ -1350,6 +1357,10 @@
    "jar": "sha256-vPc4pSXlRskmojPQoWnPfq/PcD/oGsnWmU9yRO2ikFI=",
    "pom": "sha256-fmGVkFEuhKKOAjWK3qvn3kureQr2FOhAtAQTlRbeFlc="
   },
+  "com/google/errorprone#error_prone_annotations/2.48.0": {
+   "jar": "sha256-tJxclYMW7WegnGmd2pqnScr0NNUdhj3qWZ7zakm5yFU=",
+   "pom": "sha256-GJ4JrQSJwyXpDaqp1cj0BjMGAvo2Zgm8oHy82tA6udo="
+  },
   "com/google/errorprone#error_prone_check_api/2.44.0": {
    "jar": "sha256-rFRNsezoAFm1NJU93Ipa/PZUfCCrnBtQC5kHGQOQDL8=",
    "pom": "sha256-Nl9VFHNSFSwr9syl+uNdspsxDqR4A/neWuRL/k1d+jo="
@@ -1370,6 +1381,9 @@
   "com/google/errorprone#error_prone_parent/2.44.0": {
    "pom": "sha256-9v3+0f+Ubr0B9HgCSux5CBz16XbMDY6MmL+GMXOxY10="
   },
+  "com/google/errorprone#error_prone_parent/2.48.0": {
+   "pom": "sha256-sz+opFyfF5SlAIwLLYOoTrKLXQEXptFW8AP58JvnQQ8="
+  },
   "com/google/googlejavaformat#google-java-format-parent/1.27.0": {
    "pom": "sha256-rOuKJTTBnTBcBY8iq0ffOaDhm3QIWx5MWwfTukXYQlA="
   },
diff --git a/pkgs/by-name/ke/keepalived/package.nix b/pkgs/by-name/ke/keepalived/package.nix
index d08c856293f9..bb7406288ab2 100644
--- a/pkgs/by-name/ke/keepalived/package.nix
+++ b/pkgs/by-name/ke/keepalived/package.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
-  passthru.tests.keepalived = nixosTests.keepalived;
+  passthru.tests = nixosTests.keepalived;
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ke/keyguard/deps.json b/pkgs/by-name/ke/keyguard/deps.json
index d3c379b962b0..8c2afcf57043 100644
--- a/pkgs/by-name/ke/keyguard/deps.json
+++ b/pkgs/by-name/ke/keyguard/deps.json
@@ -1114,13 +1114,13 @@
   "nl/littlerobots/version-catalog-update#nl.littlerobots.version-catalog-update.gradle.plugin/1.0.1": {
    "pom": "sha256-BBNTyo5k8a+g5bFPXj+6PWRwIoFPPnomKwrgReqv2EA="
   },
-  "org/gradle/kotlin#gradle-kotlin-dsl-plugins/6.5.2": {
-   "jar": "sha256-O/9KBwDhyBXRlEifB7ugbLGQ6PKbdz03z+43rI1cdkQ=",
-   "module": "sha256-MVnFQXhFqWmTx4nULexDVwf7uEiXnP0R0LgzBZ5RIKM=",
-   "pom": "sha256-ctVO1m6jP6+UKCNRwxAZ4S59fpIOpnpRbL4ODWdBA0M="
+  "org/gradle/kotlin#gradle-kotlin-dsl-plugins/6.5.7": {
+   "jar": "sha256-zIyqQQGjXQzwQzpj6K04kRpMhIBz/MlPQ64CUfM+Ta8=",
+   "module": "sha256-ENa9ZquwiOylvjYP9yVQyWFU0mdu/t10rzHEUAF8OQk=",
+   "pom": "sha256-q+nzlg+nNZciqHUuYb/ElnYeFdFHNeTGQiB5cHYGq74="
   },
-  "org/gradle/kotlin/kotlin-dsl#org.gradle.kotlin.kotlin-dsl.gradle.plugin/6.5.2": {
-   "pom": "sha256-5aavF7WFYNdGyrQseV/jpCoevkBQ5VpPANjPVM8x8eo="
+  "org/gradle/kotlin/kotlin-dsl#org.gradle.kotlin.kotlin-dsl.gradle.plugin/6.5.7": {
+   "pom": "sha256-Ldg2zAlxLNrd/u/GgNLqZutD2NxjOGvVlSZYE0l/Ry0="
   },
   "org/gradle/toolchains#foojay-resolver/1.0.0": {
    "jar": "sha256-eLhqR9/fdpfJvRXaeJg/2A2nJH1uAvwQa98H4DiLYKg=",
@@ -1137,106 +1137,106 @@
   "org/jetbrains/compose#org.jetbrains.compose.gradle.plugin/1.11.0-alpha02": {
    "pom": "sha256-MU2vfNXg5KBkAF+cfuVA2xRoE9ywWMiBM4tHjynNKLw="
   },
-  "org/jetbrains/kotlin#abi-tools-api/2.3.0": {
-   "jar": "sha256-QBe8wfXTKFsX5rYiDRakaMhxWTDw35Y5bXZLV/Cm02U=",
-   "pom": "sha256-qJIhRAlxhudUjXFH3I3O1eYOMGnUY1ulUe8uV3WrmAk="
+  "org/jetbrains/kotlin#abi-tools-api/2.3.20": {
+   "jar": "sha256-U2hfV4OwSQaDiY11Wrrk1Bi26DugYTSFiv3ctZRYmek=",
+   "pom": "sha256-qIbJ/X8rlmlFf+wCHxnc8V8EY+DbS9rVOuGBJTZsxvk="
   },
-  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.3.0": {
-   "module": "sha256-d8IDSG/XkrWAVyBp5cRC0YDA7wVbpzRQXaKNGX7BL/c=",
-   "pom": "sha256-k8/rFUWRw3AengQ1C9AF0ZVqmuZHFH1vsqfFeD4fkJo="
+  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.3.20": {
+   "module": "sha256-bNjWSw5lN3kE8wb2qFja/ZMcQTUkD4RMk9UpTumP6Dk=",
+   "pom": "sha256-SgpFTor25QOv5ngwoYVjubaA3u67GhcGoNe0S8UHQKE="
   },
-  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.3.0/gradle813": {
-   "jar": "sha256-D+cv3G5RvisnSw5kuEQB9SUDavsgYWKkRYIU8R6614c="
+  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.3.20/gradle813": {
+   "jar": "sha256-pPEKPw6l3dH1VaT3BuCep/VSs8hSK7EAY2HdMG4152o="
   },
-  "org/jetbrains/kotlin#kotlin-assignment/2.3.0": {
-   "module": "sha256-ljRPGdjxnqpbxEHjP2UB9+c9o8el1X1EvHwW6qRXVls=",
-   "pom": "sha256-GqwiGC0snJVP/8FrV2Xq0jjiAw9HhIctRrxfOcozll0="
+  "org/jetbrains/kotlin#kotlin-assignment/2.3.20": {
+   "module": "sha256-GCp0ZM5mvM/ejjG+aPoO7DE8HZDD2POWeclyJyliFjg=",
+   "pom": "sha256-f3R8uTA9Hfqh1hJfZsFUG+o4PsuZh2ta28riSAVZZ48="
   },
-  "org/jetbrains/kotlin#kotlin-assignment/2.3.0/gradle813": {
-   "jar": "sha256-PKIayHkWchdbgnPemV8CTzWZLfAwCijCdUnPd3DMnOY="
+  "org/jetbrains/kotlin#kotlin-assignment/2.3.20/gradle813": {
+   "jar": "sha256-tYin5gfij7WAIo4SDdX/+L6nO9J3JnM6F35kRYLooB0="
   },
-  "org/jetbrains/kotlin#kotlin-build-statistics/2.3.0": {
-   "jar": "sha256-Z3hVlwDnLXZOniTZWPFuwMx152t1s4FMK83hRKYnT04=",
-   "pom": "sha256-QTkKXrIxFJOxpFubOXLDoL8dqEfoRaNKtoQKr0EmTeI="
+  "org/jetbrains/kotlin#kotlin-build-statistics/2.3.20": {
+   "jar": "sha256-ptJ7PINhdlLdBlYG+Yz1nPviY/jCDr5OvVpvJonrDU8=",
+   "pom": "sha256-nQqNf/FyPV1y00ldVVc9jTxrd3TWHYBXlxT3nCQmX48="
   },
-  "org/jetbrains/kotlin#kotlin-build-tools-api/2.3.0": {
-   "jar": "sha256-xsCc8oU0VySfcHyGOCESQJ1aVfULa4Vouk9TDdAD/tw=",
-   "pom": "sha256-FzTIvg4nFXJ3AkW01gbOW7iBbosNHA9+euEcEMLKF1s="
+  "org/jetbrains/kotlin#kotlin-build-tools-api/2.3.20": {
+   "jar": "sha256-IvGrIjhUuUkJn2slnO9UHVtYo2Q9+aScRXfGPEFuhDs=",
+   "pom": "sha256-G14LLDaQXcL1XgpLeBKuY+MSXe/PaG0sD0kPg7c9nV4="
   },
-  "org/jetbrains/kotlin#kotlin-compiler-runner/2.3.0": {
-   "jar": "sha256-hwl38pYFQ2xesiV7nI5dZPMoLyqI7e5FRNNOxF8Wpqc=",
-   "pom": "sha256-ov8zZnin9TpEOSv8bFK2gS7dxz5AghyQfyomQWeeDrs="
+  "org/jetbrains/kotlin#kotlin-compiler-runner/2.3.20": {
+   "jar": "sha256-wGnzCkA75wyBUviqnyXsy6GI7q1UJjrgKvFEIUN6Igg=",
+   "pom": "sha256-jYTqDt1gs4vOpWLeUXgVKiZxqaAFPWcPkxRSs9sBMig="
   },
-  "org/jetbrains/kotlin#kotlin-daemon-client/2.3.0": {
-   "jar": "sha256-sr5naIyvEaE41a4M4SNTga2asN25OVqwb42EagtGYBc=",
-   "pom": "sha256-teLnTuXC+I/Qi/g+7GRx9rvKeqEhWYgCtsMsVuhwYCY="
+  "org/jetbrains/kotlin#kotlin-daemon-client/2.3.20": {
+   "jar": "sha256-xxp8G+j7/wTgr0XJ7oy3ph2JU7ymuL8iWlcZxyWpC0Q=",
+   "pom": "sha256-nnyLgHJBF/cqrOZfa+SNg224/Dl1OtlR8ruQhi1+cIA="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-annotations/2.3.0": {
-   "jar": "sha256-/HKYw2tF820WUscDuraT9f6bEVmOzZrH7J/f6IptsPA=",
-   "pom": "sha256-aQhDRFhvUkNNH7tRZmlgr/uHbGQ+gIYkXrgLpeREm7U="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-annotations/2.3.20": {
+   "jar": "sha256-4WYu10cyK2P2HU+t2Zq3gQTEXq8JwRp4mGJBXoHBjcQ=",
+   "pom": "sha256-aP+Cf8E1DZPw1nM2jAZHm2K31eXDBlipWM+TBmgx6Nk="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.3.0": {
-   "module": "sha256-BQ8eECIJAOR6MIkd1c/qg3pl27sNmjyxuFKRq6MmykE=",
-   "pom": "sha256-GeTwq/tcvwEdJZP1ZRV8jr9FkvMAhhS6LtsEinhRF10="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.3.20": {
+   "module": "sha256-04UBEP9ajrcP7S1Xi0X7B+vESvaika5M88eUMMZRKLo=",
+   "pom": "sha256-AdVSITSRyFPVb4frdIEwON+e4dhekIaqN70GY7JJb4g="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.3.0/gradle813": {
-   "jar": "sha256-yh6tFJqMj0G6YKg5qDsjw6BiJ8RsYhJMUb6ZkDXerDE="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.3.20/gradle813": {
+   "jar": "sha256-ybwX32m/OZB8WXweGb7EtHnHWqx1+/1jIeNEW0lxLog="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea-proto/2.3.0": {
-   "jar": "sha256-epBQPJ14f5vNLBd25MxSfrneeRLvecbJWPEwWi0cQ7o=",
-   "pom": "sha256-2bCOHuM4pjRhSanQIY+FHuPUfYu3fWEDJg8qhyauUl4="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea-proto/2.3.20": {
+   "jar": "sha256-5Cicv5/0lAfwQd3GM24bV3pspM8r4dKjEzgnHBPu0+0=",
+   "pom": "sha256-9veHObqf4nEunwyeW8T16TcZzP6pW0fC9JslC+F2NX4="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea/2.3.0": {
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea/2.3.20": {
    "jar": "sha256-lS5zlI4qINOYwmuHprtwzPZkGPuvFSfDUVsYjqnUvWA=",
-   "module": "sha256-kRUvrqO8DJTbZtPLWKrh2+rXyGC1dk5nsgC01N9M6rk=",
-   "pom": "sha256-BLSVrgZj7a3aSEBkZKzTlDGjysez6OjAlLdplu1BSaA="
+   "module": "sha256-b7XZcwCl5Vmv1Nn/msA1bE2Wb31pS2Yvrhaf2HQhUx4=",
+   "pom": "sha256-WROHIVGNgqND99wvCRK3BJjT7vM2PJ66wiCssPyTjsw="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.3.0": {
-   "module": "sha256-vbMts6ongF80eewDPsY9PMq+sTuInYbavadCu+9TwJo=",
-   "pom": "sha256-h4cnvyGoOtrYnU5giEhN2/OfaoSpQoAiGm4cL4hBMD4="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.3.20": {
+   "module": "sha256-lVUmc7gbNXitmy86/xRUtjzoBsb9SrfGBJIx6GQKtHE=",
+   "pom": "sha256-EcMjwt2KgE6fWOBHwsAYZLKgHcDYEys2PApDEiFbwJs="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.3.0/gradle813": {
-   "jar": "sha256-Os+X1zolgbAyhz+on1Z1DTazt21A1pLZg58kZ92uTWk="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.3.20/gradle813": {
+   "jar": "sha256-RuFu4mWU9ID+y5LJbarjdTDoNQJreON+8yUelX8D9vs="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugins-bom/2.3.0": {
-   "module": "sha256-/9anNzSypS+3Yz8WOVRL43HgYpxR2X+h5fteqTQ6Fwk=",
-   "pom": "sha256-cYYJKmnzaIQyxcCsuQtKZx/Y7oANhP5YT66P1TO6v4o="
+  "org/jetbrains/kotlin#kotlin-gradle-plugins-bom/2.3.20": {
+   "module": "sha256-+CvXZF0MPv609PZVIKPGWz6MMCsIMyIDegABuHsC6ZA=",
+   "pom": "sha256-3WuRkZfhMv5x3axw9vxdj65/Und6/YN7FN6HG4wKVAA="
   },
-  "org/jetbrains/kotlin#kotlin-klib-commonizer-api/2.3.0": {
-   "jar": "sha256-m6V9kaveq5rNWIoUtfQiCbmWRMU0Ft/56X7LS/l/Ukg=",
-   "pom": "sha256-zTHw7NqCplEi/8alXehxE5S2GEtRRAK34RkZGqgJGoI="
+  "org/jetbrains/kotlin#kotlin-klib-commonizer-api/2.3.20": {
+   "jar": "sha256-vpN3SFQS0A8B54KZyzC+SAJZHCcwNCtuva/AiU91J0M=",
+   "pom": "sha256-IbFbpb1i0h1Ta7egyMtnQ1cfwPQwklSKQjWybyodIgs="
   },
-  "org/jetbrains/kotlin#kotlin-native-utils/2.3.0": {
-   "jar": "sha256-7kvygz0Q5fN90haoMSn1nzx8vvXrrBMPcGZIOXCMgLc=",
-   "pom": "sha256-Rp6PYB/b34kP+ozXSOEQcCqkUxu7KbZOXnUD8O/lDZA="
+  "org/jetbrains/kotlin#kotlin-native-utils/2.3.20": {
+   "jar": "sha256-QxnCdkeV773/K3julUVRV9evC5FVaYuqG6Uqar46vy0=",
+   "pom": "sha256-LAp+ADViCIXUN+fxJidEdbpYqiJC+1279D+R8gyvpwg="
   },
-  "org/jetbrains/kotlin#kotlin-sam-with-receiver/2.3.0": {
-   "module": "sha256-DCD2gdNvSnmRYiFYCYkpF5TmVlgvlJwGed+kNKAm9so=",
-   "pom": "sha256-DILmEXpGNhvUzF5iZV8rgC8Q9LfZJWpjaD0DSv0MDUM="
+  "org/jetbrains/kotlin#kotlin-sam-with-receiver/2.3.20": {
+   "module": "sha256-nhEhx/ZQMDvdx/BH/tMCf4FjuzZ1Gy3w+vNjfumFsh8=",
+   "pom": "sha256-Y/Gk4+TT3jrPghTwWgtW/5IM4L9ZYVSnkE8gVuP41RE="
   },
-  "org/jetbrains/kotlin#kotlin-sam-with-receiver/2.3.0/gradle813": {
-   "jar": "sha256-r8iTlKUrUu8Lp6gpakJi0NOoo850CRXYfXE7CgFhMpg="
+  "org/jetbrains/kotlin#kotlin-sam-with-receiver/2.3.20/gradle813": {
+   "jar": "sha256-oHxdPMvaP8dWTkB0RybhNz5UvSXwVGPT9D1DnXeOy90="
   },
-  "org/jetbrains/kotlin#kotlin-stdlib/2.3.0": {
-   "jar": "sha256-iHWHyRcTJQrVL+FK2RZtBCwzg1BJiQ6UN/NV/8WhlbE=",
-   "module": "sha256-CRCoo7aWD8eSxFxWqR18Oj8mKG8DKVVUtRnP83h1baI=",
-   "pom": "sha256-TVJW0+SETmVrDKQF9jUNbyF5XCQ3WzRSUmxUZ92ZtaI="
+  "org/jetbrains/kotlin#kotlin-stdlib/2.3.20": {
+   "jar": "sha256-CuElBKUEDrrzdwOQhINCDRpWJN0dk/NXZl+Md8hIoB4=",
+   "module": "sha256-9Os0T8TR46KK4WwIbsPkL1I3O0ZtQwgYL7OG45LA76M=",
+   "pom": "sha256-yDwC2afi6VRzBJHDPC8dwDwnZi4ntWbsK0TS0Bhjm5g="
   },
-  "org/jetbrains/kotlin#kotlin-tooling-core/2.3.0": {
+  "org/jetbrains/kotlin#kotlin-tooling-core/2.3.20": {
    "jar": "sha256-NnFCeBKZvA+RIMHe7A5ik0oa+ep/AaqpxaU1TcXY19k=",
-   "pom": "sha256-tQ6FtLEYwSIjge0c67K6lqfeLdrtti3aZ9SuBqGiXTc="
+   "pom": "sha256-R+Ou/SS1vmLYB7bLzXnFW4P5S1XP4Y79xuM84RvxkOQ="
   },
-  "org/jetbrains/kotlin#kotlin-util-io/2.3.0": {
-   "jar": "sha256-HJEgPyfnO5aI3f4aiAIyjTXrcPpV9eE96ttyHnj5KqQ=",
-   "pom": "sha256-hvmuNH2YfMwY2aEJ7tLlVDvjj/SMgdUtKMf6HyBarK8="
+  "org/jetbrains/kotlin#kotlin-util-io/2.3.20": {
+   "jar": "sha256-DnbnRx6RxT6mjS0k7x8p+1kqxfuw0dEPqpFkMO/z2so=",
+   "pom": "sha256-lcKKgo/B8eWeZWOCR6ZPdm2B2LWfbY3r7y0YoMwyH4k="
   },
-  "org/jetbrains/kotlin#kotlin-util-klib-metadata/2.3.0": {
-   "jar": "sha256-JZjCbDTMXGnrAEc0Y+lQrmfpuAln9DoBg8Vn7eZqlxc=",
-   "pom": "sha256-4EB9YmkdWjQWFh/YNztNt0o714bxtILghGGXUQL58+s="
+  "org/jetbrains/kotlin#kotlin-util-klib-metadata/2.3.20": {
+   "jar": "sha256-qJlOC8poRt+xn0WMTMFdexN3nKGw2fNIgLX/LCorc7M=",
+   "pom": "sha256-jxApEHGu+rvY5m/5r3dDojiB1pxqryjhNhbMDpW9F7c="
   },
-  "org/jetbrains/kotlin#kotlin-util-klib/2.3.0": {
-   "jar": "sha256-ZLugCZZqAoGG2e5waw3ID+phwK5usXJe0dfXDvIrUuE=",
-   "pom": "sha256-lzWjPLZJg7qg0S3AyOGTSw5VLmvMh2chrFWKmCKFC/4="
+  "org/jetbrains/kotlin#kotlin-util-klib/2.3.20": {
+   "jar": "sha256-lWK407egS+uisUwFZx5xOFnqVLvAohB+ZbK88nP6hEg=",
+   "pom": "sha256-WlhMPMK6O0HR5c1+eiCDV2wbjDl6ebuBY2dtjvew6hc="
   },
   "org/jetbrains/kotlin/android#org.jetbrains.kotlin.android.gradle.plugin/2.3.10-RC": {
    "pom": "sha256-p0/yoS/KLjABAqN1+7/O9sT75OaoBfyxZCxyZiIt5gw="
@@ -3117,9 +3117,9 @@
   "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.3.10-RC/gradle813": {
    "jar": "sha256-lW/RrbQXK6I9hwM12BUayFL2/DmqyAMfRptDoBNoLBg="
   },
-  "org/jetbrains/kotlin#kotlin-assignment-compiler-plugin-embeddable/2.3.0": {
-   "jar": "sha256-1D+qszfzaY6NrOZSXSzXwq66ewNZOEhYZBZP5wLnM70=",
-   "pom": "sha256-UttpIUdRA18/LYUvJDCC5x566wenFs2eCHskuYJ6Uio="
+  "org/jetbrains/kotlin#kotlin-assignment-compiler-plugin-embeddable/2.3.20": {
+   "jar": "sha256-EjVTkgnMVtLi7G+XeYaHiHK3Cgh4H2Sv/0Ubwfe9VrE=",
+   "pom": "sha256-m9zHQ84iL4oxnuYJe2Cq7unmvqe1vzKXYVp1tLpsFDM="
   },
   "org/jetbrains/kotlin#kotlin-bom/2.0.21": {
    "pom": "sha256-1Ufg3iVCLZY+IsepRPO13pQ8akmClbUtv/49KJXNm+g="
@@ -3128,66 +3128,70 @@
    "jar": "sha256-QcD+zb7B4vUdXG96lyzMaSIVNhpXSU5rI+4xOeKyIpQ=",
    "pom": "sha256-jbIqNqSFRiw9BdaOnnPwHqeDlovPlTeZWN8/zGeaSlQ="
   },
-  "org/jetbrains/kotlin#kotlin-build-tools-api/2.3.0": {
-   "jar": "sha256-xsCc8oU0VySfcHyGOCESQJ1aVfULa4Vouk9TDdAD/tw=",
-   "pom": "sha256-FzTIvg4nFXJ3AkW01gbOW7iBbosNHA9+euEcEMLKF1s="
-  },
   "org/jetbrains/kotlin#kotlin-build-tools-api/2.3.10-RC": {
    "jar": "sha256-PaKI6nHlhcPNzNdz0cDdZ/+sGrxx77cWNp5+tma1pwM=",
    "pom": "sha256-ZOHGPrbAdBbxcC3/ltSXayhERBNbsEN9rM47bWrmAFY="
   },
-  "org/jetbrains/kotlin#kotlin-build-tools-compat/2.3.0": {
-   "jar": "sha256-AJST4crwTIKF8f7RV7uraINV2wTS3q7E9aD5tjX4ZuU=",
-   "pom": "sha256-ayMWTiKBY/1j+Bf7LF3ifW6cNAO3Y8y6BoBYTyF/jjI="
+  "org/jetbrains/kotlin#kotlin-build-tools-api/2.3.20": {
+   "jar": "sha256-IvGrIjhUuUkJn2slnO9UHVtYo2Q9+aScRXfGPEFuhDs=",
+   "pom": "sha256-G14LLDaQXcL1XgpLeBKuY+MSXe/PaG0sD0kPg7c9nV4="
   },
   "org/jetbrains/kotlin#kotlin-build-tools-compat/2.3.10-RC": {
    "jar": "sha256-Cy5M/Ny64fh/Or9QicVqgwpMF5cLKOgktamabo2JFFQ=",
    "pom": "sha256-wK1VOiQf6+HyYJcUPjMiRmO2REG6/XY/6Vm2Ae5mbwI="
   },
-  "org/jetbrains/kotlin#kotlin-build-tools-impl/2.3.0": {
-   "jar": "sha256-k6Xo/7EACAHIMqhisjvZdm9ETm9sGFwysftXh3+1zqM=",
-   "pom": "sha256-AKelPNgr5ws234oCI6Wrhhoqb/txnZt3M3XId8idugQ="
+  "org/jetbrains/kotlin#kotlin-build-tools-compat/2.3.20": {
+   "jar": "sha256-RMMHtO3UysUflgqBNBEtZkyTB2cAzaXoZulNmkKWNA4=",
+   "pom": "sha256-rpC+JesEdhCNlo6+Mqjd9SXhQIhYj6BUc9sSgVoPG3Q="
+  },
+  "org/jetbrains/kotlin#kotlin-build-tools-cri-impl/2.3.20": {
+   "jar": "sha256-VOztYw8oEkzP4uRk5srMKB5SiopQqJclchVUyWk1SP4=",
+   "pom": "sha256-5zeMZYHvXw4stA46TOxR0rlj5iVkWpK2fqCVJa+XxMM="
   },
   "org/jetbrains/kotlin#kotlin-build-tools-impl/2.3.10-RC": {
    "jar": "sha256-9n02tA24gnd7Bseg/hO/aGAnu6wlxfblGNJzZWwhZrY=",
    "pom": "sha256-CMsXeW8qAa5vfqppz/F7bVzsr/tHxKBSpQWdiCJDC8w="
   },
-  "org/jetbrains/kotlin#kotlin-compiler-embeddable/2.3.0": {
-   "jar": "sha256-jb2IL6WMPRfmg6JzkCiDFfi0kPjj47G+TcPigNN+KFo=",
-   "pom": "sha256-zOmxEfIRZgxcRTk+dI30aVC2HAEUfgdzttxxnui7d6g="
+  "org/jetbrains/kotlin#kotlin-build-tools-impl/2.3.20": {
+   "jar": "sha256-loG8IWSovZ9t30wIXPSoNrktJ1BmZ9c7q59thVM2yRA=",
+   "pom": "sha256-gswavl5j0/5nV+eXKE8F25r9fq3D6D0ROcOlW2TUstU="
   },
   "org/jetbrains/kotlin#kotlin-compiler-embeddable/2.3.10-RC": {
    "jar": "sha256-r6+klWvxvWJX9wLPm5oonqviny9TDCM7pPgZptfno6I=",
    "pom": "sha256-UyU8WscTHsSThFu1RsTY+79bu5WEF8KUBlFnLcmmKWA="
   },
-  "org/jetbrains/kotlin#kotlin-compiler-runner/2.3.0": {
-   "jar": "sha256-hwl38pYFQ2xesiV7nI5dZPMoLyqI7e5FRNNOxF8Wpqc=",
-   "pom": "sha256-ov8zZnin9TpEOSv8bFK2gS7dxz5AghyQfyomQWeeDrs="
+  "org/jetbrains/kotlin#kotlin-compiler-embeddable/2.3.20": {
+   "jar": "sha256-l2+YnQtfXYDo6KitS3PaC/wn/dllufo4Nisr557MEzc=",
+   "pom": "sha256-DDWu7jcvB1FOvtN7lAe44RgdFCd1UTnlzudxnKBf5+g="
   },
   "org/jetbrains/kotlin#kotlin-compiler-runner/2.3.10-RC": {
    "jar": "sha256-QqRjDDh2gXZkUOxQfriAelausTOw4G7RcDwEXorDfrM=",
    "pom": "sha256-hynzbhVt8+C2rvQTCNJ2xDz01apFAWUW1taKrpJTeik="
   },
+  "org/jetbrains/kotlin#kotlin-compiler-runner/2.3.20": {
+   "jar": "sha256-wGnzCkA75wyBUviqnyXsy6GI7q1UJjrgKvFEIUN6Igg=",
+   "pom": "sha256-jYTqDt1gs4vOpWLeUXgVKiZxqaAFPWcPkxRSs9sBMig="
+  },
   "org/jetbrains/kotlin#kotlin-compose-compiler-plugin-embeddable/2.3.10-RC": {
    "jar": "sha256-zy8oVmxarKIn07MOOzTP9mjQh4IEYcA6nuhTJLrDDA8=",
    "pom": "sha256-REd2WqNlz5rxWBJ5kRx81qNxcwKp0fgVpeKVXZqQgS4="
   },
-  "org/jetbrains/kotlin#kotlin-daemon-client/2.3.0": {
-   "jar": "sha256-sr5naIyvEaE41a4M4SNTga2asN25OVqwb42EagtGYBc=",
-   "pom": "sha256-teLnTuXC+I/Qi/g+7GRx9rvKeqEhWYgCtsMsVuhwYCY="
-  },
   "org/jetbrains/kotlin#kotlin-daemon-client/2.3.10-RC": {
    "jar": "sha256-C+suo6o9uyYgihTqpJs022QDETlZE6fOb5GDQQnGZsQ=",
    "pom": "sha256-qG6d+5GGaQ5j/Z5ROCL2pkRT/QDvLPgG0P6+PgSUzYA="
   },
-  "org/jetbrains/kotlin#kotlin-daemon-embeddable/2.3.0": {
-   "jar": "sha256-ObywLYwpOqZ4VUyLSdf/hGVwIXCSg8YYbjpAgGr5vRA=",
-   "pom": "sha256-TI3aucQLMNAbhc/qHxd31zUlybcWQ+YlDGV2/H0fwRI="
+  "org/jetbrains/kotlin#kotlin-daemon-client/2.3.20": {
+   "jar": "sha256-xxp8G+j7/wTgr0XJ7oy3ph2JU7ymuL8iWlcZxyWpC0Q=",
+   "pom": "sha256-nnyLgHJBF/cqrOZfa+SNg224/Dl1OtlR8ruQhi1+cIA="
   },
   "org/jetbrains/kotlin#kotlin-daemon-embeddable/2.3.10-RC": {
    "jar": "sha256-QyoFSvwpRD1uVybcO3JKdrhDxR2yKEVbyogs3ANJhlk=",
    "pom": "sha256-ek+lwRozmQ8U1JE43U3kAj/v4vLgCNqDRMPCuUfAPrY="
   },
+  "org/jetbrains/kotlin#kotlin-daemon-embeddable/2.3.20": {
+   "jar": "sha256-iHC6uEC4CHyWxN3AYIi0rt9RMcQIrzZ0MGME8flq8/Q=",
+   "pom": "sha256-YVQOWzoywLEZYkSWZZJMbNdVTqmu4IVb2OT1t/YQoKs="
+  },
   "org/jetbrains/kotlin#kotlin-gradle-plugin-annotations/2.3.10-RC": {
    "jar": "sha256-LxUWxkToc3Rzi0QCsSPaeaA+KsQDXdAWXYtwFp6p6lA=",
    "pom": "sha256-EgyPnAxIjfUm9JHJ9L1laYx1+uDKnVABKNAp0smxvmA="
@@ -3238,54 +3242,54 @@
    "jar": "sha256-vNdaNspK2OBhFyFO2Af43qL+YaceB/kcoU9DNQJLhGM=",
    "pom": "sha256-7XngK/COxxXsvNHi16RTYteqfDP5LvZ15t+kpJMbzF8="
   },
-  "org/jetbrains/kotlin#kotlin-reflect/2.3.0": {
-   "jar": "sha256-cU30voGVRf9N4fNqohg+DeqUtMjN98op6ciZGbrzY2I=",
-   "pom": "sha256-89F2jvL7UxBIPb6R4w6fo2x7Pi/e5pRaCLujEBQtKcE="
+  "org/jetbrains/kotlin#kotlin-reflect/2.3.20": {
+   "jar": "sha256-40b6PD/0RR9fcHoxKIf9TIVV2kjMFfqdsrqTwz+J+BM=",
+   "pom": "sha256-iwC9L+srtVON85aVQXTZ3cDsVA00ElhjA1ObHpZVwzM="
   },
-  "org/jetbrains/kotlin#kotlin-sam-with-receiver-compiler-plugin-embeddable/2.3.0": {
-   "jar": "sha256-QOPhi7jFUjLuZSXOV9F7hl5WcosFK/DBDnvsHQhJmMo=",
-   "pom": "sha256-BnzIEOCaYeFufoe1Kk3WR+FfYLd+PaDRsVPz+A7r8wM="
-  },
-  "org/jetbrains/kotlin#kotlin-script-runtime/2.3.0": {
-   "jar": "sha256-24JpYTcdZgUxjZxOS/zb+slMOgiSzcq9VSJIcP6tV/E=",
-   "pom": "sha256-20CN5tumaQeVvFOkoPhbM8en1qzLZ94ZAmQPr1QfL1s="
+  "org/jetbrains/kotlin#kotlin-sam-with-receiver-compiler-plugin-embeddable/2.3.20": {
+   "jar": "sha256-hvch6zOswK/QbdZoDnenZLY0qb2LEbc77yv8CQnxiUA=",
+   "pom": "sha256-Vg23nSOjmud5dqVmkZRw3sQazHeqUa6qVlzAKbkXGqw="
   },
   "org/jetbrains/kotlin#kotlin-script-runtime/2.3.10-RC": {
    "jar": "sha256-vabutEYi4rlflkxb3MkPoWPNCgybtVabpd86MRwm8iA=",
    "pom": "sha256-JH2OT7fPc1Wnr/gMRAHp2wXubkb6xoZKp5ebl7ehR70="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-common/2.3.0": {
-   "jar": "sha256-QlK3gs2lP8v9lTuQrwMlDiGX/+9uVavZsKLkj5Pv8lM=",
-   "pom": "sha256-9AuKrV3x68riUJLMM7hpP6Qw5TRCC6Wup/AGsvMrQw4="
+  "org/jetbrains/kotlin#kotlin-script-runtime/2.3.20": {
+   "jar": "sha256-b8232m5lz4zEPlqrq5S9zEiCXnkzaG+KG/aU64j44A4=",
+   "pom": "sha256-ZgmWdnA6CB/ZrEMTlmWIPlwUUCC2QHWd4FOdiRb/JH8="
   },
   "org/jetbrains/kotlin#kotlin-scripting-common/2.3.10-RC": {
    "jar": "sha256-gbM3To+5LF1t82X13tIAW2Vb4rg3oNKjylND0/9tMCc=",
    "pom": "sha256-FA4i/htI2X7VHlRWnAUw9fNxhCQhGyEXMOwOrxbnLcQ="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-compiler-embeddable/2.3.0": {
-   "jar": "sha256-ZxRdvqkxlNuyJT4vNaCp/ngBfCy84+zbSx/0P/9HGNU=",
-   "pom": "sha256-FjR61xI8BuiaUu+twxjZaick9UqBx+xZTA1ALh8eZFk="
+  "org/jetbrains/kotlin#kotlin-scripting-common/2.3.20": {
+   "jar": "sha256-tMI52HsjvhgvBb9Xz16B+V1wv370qYnrmLczicbryJ8=",
+   "pom": "sha256-h+/vFa4RjxNDUmPrEJcAZGD7qDlph340uKcvDjPIOsk="
   },
   "org/jetbrains/kotlin#kotlin-scripting-compiler-embeddable/2.3.10-RC": {
    "jar": "sha256-WkVxf5DBowquk3ukcouU9cVjxp03s08671HP9OybPRg=",
    "pom": "sha256-z75mf7STjoyR9BDJWbjM+Xksc0bD8CjVmOotzRxYGX0="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-compiler-impl-embeddable/2.3.0": {
-   "jar": "sha256-MsdCfxBeYtT07/MDXaHkKAsndxvkrWFDuoZV0Yh3IM0=",
-   "pom": "sha256-TPG5v5rmnHbz6nWnhW3GbeRGeKfHQXFa6cFdtA7Nfv0="
+  "org/jetbrains/kotlin#kotlin-scripting-compiler-embeddable/2.3.20": {
+   "jar": "sha256-vVX49hvUHOxSllbC1HeEvLpawmDpT0FWwnLDFJZu71k=",
+   "pom": "sha256-1l8YaBd9zkuKkv+93bVrFzH5+66IyOcw7XvLcAy7soo="
   },
   "org/jetbrains/kotlin#kotlin-scripting-compiler-impl-embeddable/2.3.10-RC": {
    "jar": "sha256-ua86tjyjMwHLUfkBJZk5Xtjy64jjyWNQHOLriCv/12I=",
    "pom": "sha256-gWW9J1eaLKO3r8ww5Swo6QfJECUg6yL+7QzS9rgtSuA="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-jvm/2.3.0": {
-   "jar": "sha256-NpM+uDYZqKZeBB36m2ktNOB9V8b9Yv43HIu/BYgL7Ec=",
-   "pom": "sha256-qemsNTtIBUA7A3spmZpUnxvESATniVnYT/sbwzBF8kc="
+  "org/jetbrains/kotlin#kotlin-scripting-compiler-impl-embeddable/2.3.20": {
+   "jar": "sha256-gG/WOzvOxea17rGghD1qsJTVV4aoRl5HSiQ5KVocCiU=",
+   "pom": "sha256-xKkTo4XzTjKlbyBd8XoI3U4RfDBsV+XkfcXUlSPw6+E="
   },
   "org/jetbrains/kotlin#kotlin-scripting-jvm/2.3.10-RC": {
    "jar": "sha256-7N5Qd0P8WB5wabFLHhohHK7MQ9fns7uZTrqEWqzAiag=",
    "pom": "sha256-d5APHmelXOOo3SxxIPARd0N5hHIHfyywQQlN18hovqg="
   },
+  "org/jetbrains/kotlin#kotlin-scripting-jvm/2.3.20": {
+   "jar": "sha256-cEfOA1P0kSXDx0Z5LU92wyZde3L+YmlLfuwHW7oCUow=",
+   "pom": "sha256-B8Ba4tHs4K4e1mAQ7TGNnN3LNYcEbGM8GGvRTM8EYdU="
+  },
   "org/jetbrains/kotlin#kotlin-serialization-compiler-plugin-embeddable/2.3.10-RC": {
    "jar": "sha256-v3uAa0GY+/4UnjfD10j0JVA+3CxOir/JsqvFEDWOQxM=",
    "pom": "sha256-Ak0HyrVBLZHpPMmeZ5dbjC6fuWG3BpllagCE/MwBlF8="
@@ -3301,14 +3305,14 @@
    "module": "sha256-b134r2M2AKa5z7D8x2SvPVEZ83Zndne5G2rugWsdMKs=",
    "pom": "sha256-X0As+413MZW5ZwUBJMnom1+EsXJGThiUkpeJv1xMLyk="
   },
-  "org/jetbrains/kotlin#kotlin-stdlib-common/2.3.0": {
-   "module": "sha256-/pAljbcTNVWBoBZDfQbAKdBpwgu93uE02R5LiHBz108=",
-   "pom": "sha256-J+2DQuBLgcqy0aP512D06/lQmG9n7Eme1y1cw4d+6NA="
-  },
   "org/jetbrains/kotlin#kotlin-stdlib-common/2.3.10-RC": {
    "module": "sha256-T7RK7JIrF+ytx62EMPj7cc0Cs0ZPLzNoPUEnau3/vPw=",
    "pom": "sha256-aNb+8ejJzL7tNa7xZvY3SFDf690TNXpwDjKANiWDF7E="
   },
+  "org/jetbrains/kotlin#kotlin-stdlib-common/2.3.20": {
+   "module": "sha256-fV4z3nFM3ddQeGQgmMvL7pfBg5jQNLd9MrSwdLlQOTk=",
+   "pom": "sha256-/Xtj7fb31urrwWoYVgu7koszQlYepcnR92kZiw/puYg="
+  },
   "org/jetbrains/kotlin#kotlin-stdlib-jdk7/1.3.72": {
    "pom": "sha256-nVoT2avDNEXhNm0livCnfkLwGUWs73wJF7nVOYVOL84="
   },
@@ -3358,11 +3362,6 @@
    "module": "sha256-v7xlfd06jjfkyK1BeWjV6wsLFxyfzkj5YsKtMu5DTCE=",
    "pom": "sha256-zzH5IxlsY67ezQpXwkJpvTcCpOR8C/C9ZLWtpd5SInI="
   },
-  "org/jetbrains/kotlin#kotlin-stdlib/2.3.0": {
-   "jar": "sha256-iHWHyRcTJQrVL+FK2RZtBCwzg1BJiQ6UN/NV/8WhlbE=",
-   "module": "sha256-CRCoo7aWD8eSxFxWqR18Oj8mKG8DKVVUtRnP83h1baI=",
-   "pom": "sha256-TVJW0+SETmVrDKQF9jUNbyF5XCQ3WzRSUmxUZ92ZtaI="
-  },
   "org/jetbrains/kotlin#kotlin-stdlib/2.3.0-RC": {
    "jar": "sha256-zDONZbvslLcwNvfDw6X28JrocFuVwPkg7DKHtGtolNM=",
    "module": "sha256-j+uBo/Q5DDNtB8a3zz7kVQHpwF5zupBFU8UeJImo4VM=",
@@ -3376,14 +3375,19 @@
   "org/jetbrains/kotlin#kotlin-stdlib/2.3.10-RC/all": {
    "jar": "sha256-8tQNQce+hFtMQsSM0wFI9oNm6QnfgiBJo96d0VLUjAI="
   },
-  "org/jetbrains/kotlin#kotlin-tooling-core/2.3.0": {
-   "jar": "sha256-NnFCeBKZvA+RIMHe7A5ik0oa+ep/AaqpxaU1TcXY19k=",
-   "pom": "sha256-tQ6FtLEYwSIjge0c67K6lqfeLdrtti3aZ9SuBqGiXTc="
+  "org/jetbrains/kotlin#kotlin-stdlib/2.3.20": {
+   "jar": "sha256-CuElBKUEDrrzdwOQhINCDRpWJN0dk/NXZl+Md8hIoB4=",
+   "module": "sha256-9Os0T8TR46KK4WwIbsPkL1I3O0ZtQwgYL7OG45LA76M=",
+   "pom": "sha256-yDwC2afi6VRzBJHDPC8dwDwnZi4ntWbsK0TS0Bhjm5g="
   },
   "org/jetbrains/kotlin#kotlin-tooling-core/2.3.10-RC": {
    "jar": "sha256-NnFCeBKZvA+RIMHe7A5ik0oa+ep/AaqpxaU1TcXY19k=",
    "pom": "sha256-JP5o1+ZtHKA6rzslyx5nPzE0F54G3Q8K0rQyaxCREyo="
   },
+  "org/jetbrains/kotlin#kotlin-tooling-core/2.3.20": {
+   "jar": "sha256-NnFCeBKZvA+RIMHe7A5ik0oa+ep/AaqpxaU1TcXY19k=",
+   "pom": "sha256-R+Ou/SS1vmLYB7bLzXnFW4P5S1XP4Y79xuM84RvxkOQ="
+  },
   "org/jetbrains/kotlin#kotlin-util-io/2.3.10-RC": {
    "jar": "sha256-85zCXVt0ew16z7LloMQdTmhgCzwUyPnYF1dFmowN06o=",
    "pom": "sha256-dvRuzCGOmDpVggzpv19r4OQfMybphgof78Ac8TCVeqI="
diff --git a/pkgs/by-name/ki/kicad/versions.nix b/pkgs/by-name/ki/kicad/versions.nix
index 87756605ce20..8bd94642dbd5 100644
--- a/pkgs/by-name/ki/kicad/versions.nix
+++ b/pkgs/by-name/ki/kicad/versions.nix
@@ -25,14 +25,14 @@
   };
   "kicad-testing" = {
     kicadVersion = {
-      version = "10.0-2026-06-20";
+      version = "10.0-2026-06-26";
       src = {
-        rev = "ee60b9067e5da85187183afa9f86c8a829502380";
-        sha256 = "0ib4z4zxq8f49kag3ip60mxqgls1g6lz0vqb76aqcjvfpkz1als1";
+        rev = "688f1186b437515b35a0619c1d5e9df6171b80e3";
+        sha256 = "1n2qh2daz5avncwc0r65bwjdfrw7bzh11mzrwv57avl9bm2dk9mj";
       };
     };
     libVersion = {
-      version = "10.0-2026-06-20";
+      version = "10.0-2026-06-26";
       libSources = {
         symbols.rev = "5a6700bbb3f2a3b05d123a1a1af770cfbb5bc7d3";
         symbols.sha256 = "1ns0lg360h3h55w2xv5lyj0qzy6nc1cr02vll95c0vma34rc1qwa";
diff --git a/pkgs/by-name/kr/krb5/CVE-2026-40355-and-CVE-2026-40356.patch b/pkgs/by-name/kr/krb5/CVE-2026-40355-and-CVE-2026-40356.patch
new file mode 100644
index 000000000000..fe37f894fdc4
--- /dev/null
+++ b/pkgs/by-name/kr/krb5/CVE-2026-40355-and-CVE-2026-40356.patch
@@ -0,0 +1,61 @@
+From acea6182e46fff3d1d64a3172cdff307b07ca441 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Wed, 8 Apr 2026 17:57:59 -0400
+Subject: [PATCH] Fix two NegoEx parsing vulnerabilities
+
+In parse_nego_message(), check the result of the second call to
+vector_base() before dereferencing it.  In parse_message(), check for
+a short header_len to prevent an integer underflow when calculating
+the remaining message length.
+
+Reported by Cem Onat Karagun.
+
+CVE-2026-40355:
+
+In MIT krb5 release 1.18 and later, if an application calls
+gss_accept_sec_context() on a system with a NegoEx mechanism
+registered in /etc/gss/mech, an unauthenticated remote attacker can
+trigger a null pointer dereference, causing the process to terminate.
+
+CVE-2026-40356:
+
+In MIT krb5 release 1.18 and later, if an application calls
+gss_accept_sec_context() on a system with a NegoEx mechanism
+registered in /etc/gss/mech, an unauthenticated remote attacker can
+trigger a read overrun of up to 52 bytes, possibly causing the process
+to terminate.  Exfiltration of the bytes read does not appear
+possible.
+
+(cherry picked from commit 2e75f0d9362fb979f5fc92829431a590a130929f)
+
+ticket: 9205
+version_fixed: 1.22.3
+---
+ lib/gssapi/spnego/negoex_util.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/lib/gssapi/spnego/negoex_util.c b/src/lib/gssapi/spnego/negoex_util.c
+index edc5462e844..a65238e5730 100644
+--- a/lib/gssapi/spnego/negoex_util.c
++++ b/lib/gssapi/spnego/negoex_util.c
+@@ -253,6 +253,10 @@ parse_nego_message(OM_uint32 *minor, struct k5input *in,
+     offset = k5_input_get_uint32_le(in);
+     count = k5_input_get_uint16_le(in);
+     p = vector_base(offset, count, EXTENSION_LENGTH, msg_base, msg_len);
++    if (p == NULL) {
++        *minor = ERR_NEGOEX_INVALID_MESSAGE_SIZE;
++        return GSS_S_DEFECTIVE_TOKEN;
++    }
+     for (i = 0; i < count; i++) {
+         extension_type = load_32_le(p + i * EXTENSION_LENGTH);
+         if (extension_type & EXTENSION_FLAG_CRITICAL) {
+@@ -391,7 +395,8 @@ parse_message(OM_uint32 *minor, spnego_gss_ctx_id_t ctx, struct k5input *in,
+     msg_len = k5_input_get_uint32_le(in);
+     conv_id = k5_input_get_bytes(in, GUID_LENGTH);
+ 
+-    if (in->status || msg_len > token_remaining || header_len > msg_len) {
++    if (in->status || msg_len > token_remaining ||
++        header_len < (size_t)(in->ptr - msg_base) || header_len > msg_len) {
+         *minor = ERR_NEGOEX_INVALID_MESSAGE_SIZE;
+         return GSS_S_DEFECTIVE_TOKEN;
+     }
diff --git a/pkgs/by-name/kr/krb5/package.nix b/pkgs/by-name/kr/krb5/package.nix
index 0b504c6dc8a6..c4e35061d41a 100644
--- a/pkgs/by-name/kr/krb5/package.nix
+++ b/pkgs/by-name/kr/krb5/package.nix
@@ -34,16 +34,20 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "krb5";
-  version = "1.22.1";
+  version = "1.22.2";
 
   __structuredAttrs = true;
 
   src = fetchurl {
     url = "https://kerberos.org/dist/krb5/${lib.versions.majorMinor finalAttrs.version}/krb5-${finalAttrs.version}.tar.gz";
-    hash = "sha256-GogyuMrZI+u/E5T2fi789B46SfRgKFpm41reyPoAU68=";
+    hash = "sha256-MkP/vI6k1Kwi3cfdKh3FTFeHTEBki2D/lwCXY1VOrxM=";
   };
 
-  patches = lib.optionals stdenv.hostPlatform.isFreeBSD [
+  patches = [
+    # https://github.com/krb5/krb5/pull/1506
+    ./CVE-2026-40355-and-CVE-2026-40356.patch
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isFreeBSD [
     (fetchpatch {
       name = "fix-missing-ENODATA.patch";
       url = "https://cgit.freebsd.org/ports/plain/security/krb5-122/files/patch-lib_krad_packet.c?id=0501f716c4aff7880fde56e42d641ef504593b7d";
@@ -170,6 +174,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   meta = {
+    changelog = "https://web.mit.edu/Kerberos/krb5-${lib.versions.majorMinor finalAttrs.version}/";
     description = "MIT Kerberos 5";
     homepage = "http://web.mit.edu/kerberos/";
     license = lib.licenses.mit;
diff --git a/pkgs/by-name/kr/krillinai/package.nix b/pkgs/by-name/kr/krillinai/package.nix
index e4225de0c790..a9239501e989 100644
--- a/pkgs/by-name/kr/krillinai/package.nix
+++ b/pkgs/by-name/kr/krillinai/package.nix
@@ -16,16 +16,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "krillinai";
-  version = "1.4.0";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "krillinai";
     repo = "KlicStudio";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CMeF24BCJ+wbiXCl0iJm0acNoggVxeOu3Q/cXJY8aQo=";
+    hash = "sha256-k1p9v3MQklycW2FsDCyEWNwjLFSymxx1qVg5qhC8xgI=";
   };
 
-  vendorHash = "sha256-bAKLNpt0K06egScyn7ImHV0csDsMQGUm92kU1PVQK+I=";
+  vendorHash = "sha256-OdmOalac4oked7vLGMWFCjjNU5TBq1P+HudE5a+bgq4=";
 
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/la/layerx/package.nix b/pkgs/by-name/la/layerx/package.nix
new file mode 100644
index 000000000000..0de8d58b7059
--- /dev/null
+++ b/pkgs/by-name/la/layerx/package.nix
@@ -0,0 +1,57 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "layerx";
+  version = "1.5.0";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "deveshctl";
+    repo = "layerx";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Bkz0ETQEdy0GOlyGFmP8y80NdmNgRvLV0xRf/zd91ZY=";
+  };
+
+  vendorHash = "sha256-7wbyz6fKB3HMFhKJVIWrOIczLfqF4yInyszdh2Ky8WU=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=main.version=${finalAttrs.version}"
+    "-X=main.commit=${finalAttrs.src.rev}"
+    "-X=main.date=1970-01-01T00:00:00Z"
+  ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion \
+      --cmd layerx \
+      --bash <($out/bin/layerx completion bash) \
+      --fish <($out/bin/layerx completion fish) \
+      --zsh <($out/bin/layerx completion zsh)
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+  versionCheckProgramArg = [ "version" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Terminal-based Docker image layer inspector";
+    homepage = "https://github.com/deveshctl/layerx";
+    changelog = "https://github.com/deveshctl/layerx/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ kpbaks ];
+    mainProgram = "layerx";
+  };
+})
diff --git a/pkgs/by-name/la/lazyworktree/package.nix b/pkgs/by-name/la/lazyworktree/package.nix
index 847516f0e1b6..a319756abbe7 100644
--- a/pkgs/by-name/la/lazyworktree/package.nix
+++ b/pkgs/by-name/la/lazyworktree/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "lazyworktree";
-  version = "1.46.1";
+  version = "1.47.0";
 
   src = fetchFromGitHub {
     owner = "chmouel";
     repo = "lazyworktree";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-S6Tv0g8C1B47UtZkmBy+DIcLhoSFLzIJ9EiRtbojqAI=";
+    hash = "sha256-aiObEOw+osGRzvkSwo/aWbby8eb/jPiruxcGehafUvw=";
   };
 
-  vendorHash = "sha256-8zoomrS7neTvaCLRFJ4W8+mryEwHmu8VyKf81RRe4yE=";
+  vendorHash = "sha256-aQ0My2re9rCoU6EZ0VSyHYT1TMZEMAwnhmcqGBd95ks=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/li/libadwaita/package.nix b/pkgs/by-name/li/libadwaita/package.nix
index 0d1ed0da7e85..8f289c6e4977 100644
--- a/pkgs/by-name/li/libadwaita/package.nix
+++ b/pkgs/by-name/li/libadwaita/package.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libadwaita";
-  version = "1.9.0";
+  version = "1.9.1";
 
   outputs = [
     "out"
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "GNOME";
     repo = "libadwaita";
     tag = finalAttrs.version;
-    hash = "sha256-JAKP8CjLCKGZvHoB26ih/J3xAru4wiVf/ObG0L8r4pY=";
+    hash = "sha256-Oy3WcsymNbbmAacm5hEOrorI1wKXjSp063mh4jCJRAE=";
   };
 
   depsBuildBuild = [
diff --git a/pkgs/by-name/li/libaec/package.nix b/pkgs/by-name/li/libaec/package.nix
index c9824823b669..3b7b1768c93b 100644
--- a/pkgs/by-name/li/libaec/package.nix
+++ b/pkgs/by-name/li/libaec/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libaec";
-  version = "1.1.6";
+  version = "1.1.7";
 
   src = fetchFromGitHub {
     owner = "Deutsches-Klimarechenzentrum";
     repo = "libaec";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cxDP+JNwokxgzH9hO2zw+rIcz8XG7E8ujbAbWpgUEW8=";
+    hash = "sha256-aBm+CXCq7sdJb6Qq9sNuTzNj0nRwTJI20HsqUg1Qi/8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libass/package.nix b/pkgs/by-name/li/libass/package.nix
index 61b8611327f0..045b0d926bdb 100644
--- a/pkgs/by-name/li/libass/package.nix
+++ b/pkgs/by-name/li/libass/package.nix
@@ -44,9 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
     fribidi
     harfbuzz
   ]
-  ++ lib.optional fontconfigSupport fontconfig
-  # TODO: remove dep after branchoff (in darwin stdenv)
-  ++ lib.optional stdenv.hostPlatform.isDarwin libiconv.out;
+  ++ lib.optional fontconfigSupport fontconfig;
 
   meta = {
     description = "Portable ASS/SSA subtitle renderer";
diff --git a/pkgs/by-name/li/libcaca/package.nix b/pkgs/by-name/li/libcaca/package.nix
index 689257d7ff8e..d233cdabfe87 100644
--- a/pkgs/by-name/li/libcaca/package.nix
+++ b/pkgs/by-name/li/libcaca/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   autoreconfHook,
   imlib2,
   libxext,
@@ -23,6 +24,14 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-N0Lfi0d4kjxirEbIjdeearYWvStkKMyV6lgeyNKXcVw=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2026-42046.patch";
+      url = "https://github.com/cacalabs/libcaca/commit/fb77acff9ba6bb01d53940da34fb10f20b156a23.patch";
+      hash = "sha256-AdpiE5Gw/CVET//7TTYZCb0glW5HY+T8xZkYs1XCBvY=";
+    })
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
diff --git a/pkgs/by-name/li/libde265/package.nix b/pkgs/by-name/li/libde265/package.nix
index 51e24c6ed5ac..771b9e336634 100644
--- a/pkgs/by-name/li/libde265/package.nix
+++ b/pkgs/by-name/li/libde265/package.nix
@@ -15,14 +15,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.0.18";
+  version = "1.1.1";
   pname = "libde265";
 
   src = fetchFromGitHub {
     owner = "strukturag";
     repo = "libde265";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-N6K82ElrzrMSNKfPTDsc5onrxucIJ8niwFgbaEPPd2I=";
+    hash = "sha256-ZHfPC86oylqt2bwWMJRWVjdMEEmX6UOKR7XkR0HPyok=";
   };
 
   nativeBuildInputs = [
@@ -43,6 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://github.com/strukturag/libde265";
+    changelog = "https://github.com/strukturag/libde265/releases/tag/${finalAttrs.src.tag}";
     description = "Open h.265 video codec implementation";
     mainProgram = "dec265";
     license = lib.licenses.lgpl3;
diff --git a/pkgs/by-name/li/libgcrypt/package.nix b/pkgs/by-name/li/libgcrypt/package.nix
index 9317da7494fd..08fa5886de73 100644
--- a/pkgs/by-name/li/libgcrypt/package.nix
+++ b/pkgs/by-name/li/libgcrypt/package.nix
@@ -17,11 +17,11 @@ assert enableCapabilities -> stdenv.hostPlatform.isLinux;
 
 stdenv.mkDerivation rec {
   pname = "libgcrypt";
-  version = "1.11.2";
+  version = "1.12.2";
 
   src = fetchurl {
     url = "mirror://gnupg/libgcrypt/${pname}-${version}.tar.bz2";
-    hash = "sha256-a6Wd0ZInDowdIt20GgfZXc28Hw+wLQPEtUsjWBQzCqw=";
+    hash = "sha256-fOM8JJIiGgQ2+WqFACFenz49y1/SanV81BXnqEO6vV4=";
   };
 
   outputs = [
@@ -73,17 +73,6 @@ stdenv.mkDerivation rec {
   postConfigure = ''
     sed -i configure \
         -e 's/NOEXECSTACK_FLAGS=$/NOEXECSTACK_FLAGS="-Wa,--noexecstack"/'
-  ''
-  # The cipher/simd-common-riscv.h wasn't added to the release tarball, please remove this hack on next version update
-  # https://dev.gnupg.org/T7647
-  + lib.optionalString stdenv.hostPlatform.isRiscV ''
-    cp ${
-      fetchurl {
-        url = "https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgcrypt.git;a=blob_plain;f=cipher/simd-common-riscv.h;h=8381000f9ac148c60a6963a1d9ec14a3fee1c576;hb=81ce5321b1b79bde6dfdc3c164efb40c13cf656b";
-        hash = "sha256-Toe15YLAOYULnLc2fGMMv/xzs/q1t3LsyiqtL7imc+8=";
-        name = "simd-common-riscv.h";
-      }
-    } cipher/simd-common-riscv.h
   '';
 
   enableParallelBuilding = true;
diff --git a/pkgs/by-name/li/libheif/package.nix b/pkgs/by-name/li/libheif/package.nix
index 7d4912e77598..42171d469f5a 100644
--- a/pkgs/by-name/li/libheif/package.nix
+++ b/pkgs/by-name/li/libheif/package.nix
@@ -24,7 +24,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libheif";
-  version = "1.21.2";
+  version = "1.23.0";
 
   outputs = [
     "bin"
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "strukturag";
     repo = "libheif";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-odkJ0wZSGoZ7mX9fkaNREDpMvQuQA9HKaf3so1dYrbc=";
+    hash = "sha256-+LbYwDSxixy4TaraUCN2LiCnn32dkMppCA8EOFXbvtg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/li/libpng/package.nix b/pkgs/by-name/li/libpng/package.nix
index d533f3ed56bb..7d52bcffb378 100644
--- a/pkgs/by-name/li/libpng/package.nix
+++ b/pkgs/by-name/li/libpng/package.nix
@@ -11,10 +11,10 @@
 assert zlib != null;
 
 let
-  patchVersion = "1.6.56";
+  patchVersion = "1.6.58";
   patch_src = fetchurl {
     url = "mirror://sourceforge/libpng-apng/libpng-${patchVersion}-apng.patch.gz";
-    hash = "sha256-nOMtSidjoqxfJYcmui9J6QETJ8HujDCGKjLQ8wiJ++g=";
+    hash = "sha256-7ufeoi7VAoaAF5cchsY8TtHmCF3guuv9zD0zIvAPPrA=";
   };
   whenPatched = lib.optionalString apngSupport;
 
@@ -24,11 +24,11 @@ let
 in
 stdenv'.mkDerivation (finalAttrs: {
   pname = "libpng" + whenPatched "-apng";
-  version = "1.6.56";
+  version = "1.6.58";
 
   src = fetchurl {
     url = "mirror://sourceforge/libpng/libpng-${finalAttrs.version}.tar.xz";
-    hash = "sha256-99i/FgG3gE9YOiVKs0OmVJymzyfSVcMCxHry2dNqbxg=";
+    hash = "sha256-KOtAP1Hw90BSSRMs7P6C6lwO+X8bMsWmWCiBSuDTR3U=";
   };
   postPatch =
     whenPatched "gunzip < ${patch_src} | patch -Np1"
diff --git a/pkgs/by-name/li/libressl/default.nix b/pkgs/by-name/li/libressl/default.nix
index 7a266936f6c4..4bf139efc381 100644
--- a/pkgs/by-name/li/libressl/default.nix
+++ b/pkgs/by-name/li/libressl/default.nix
@@ -23,6 +23,9 @@ let
       pname = "libressl";
       inherit version;
 
+      strictDeps = true;
+      __structuredAttrs = true;
+
       src = fetchurl {
         url = "mirror://openbsd/LibreSSL/libressl-${version}.tar.gz";
         inherit hash;
@@ -60,6 +63,23 @@ let
       preCheck = ''
         export PREVIOUS_${ldLibPathEnvName}=$${ldLibPathEnvName}
         export ${ldLibPathEnvName}="$${ldLibPathEnvName}:$(realpath tls/):$(realpath ssl/):$(realpath crypto/)"
+      ''
+      + lib.optionalString stdenv.hostPlatform.isElf ''
+        # Bail if any shared object has executable stack enabled. This can
+        # happen when an object produced from an assmbly file in libcrypto is
+        # missing a .note.GNU-stack section. An executable stack is dangerous
+        # and unintentional, but without this check the derivation will build
+        # and even run if W^X is not enforced; it would fail dangerously.
+        objdump -p **/*.so | awk '
+          BEGIN { res = 0 }
+          /file format/ { file = $1 }
+          /STACK/ { stack = 1; next }
+          stack {
+            if ($0 ~ /flags.*x/) { print file " has executable stack"; res = 1 }
+            stack = 0
+          }
+          END { exit res }
+        '
       '';
       postCheck = ''
         export ${ldLibPathEnvName}=$PREVIOUS_${ldLibPathEnvName}
@@ -96,6 +116,7 @@ let
         maintainers = with lib.maintainers; [
           thoughtpolice
           fpletz
+          ruuda
         ];
         inherit knownVulnerabilities;
 
@@ -111,32 +132,17 @@ let
         identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "openbsd" version;
       };
     };
+
   # https://github.com/libressl/portable/pull/1206
+  # This got merged in February 2026 and is included as of LibreSSL 4.3.0.
   common-cmake-install-full-dirs-patch = fetchpatch {
     url = "https://github.com/libressl/portable/commit/a15ea0710398eaeed3be53cf643e80a1e80c981d.patch";
     hash = "sha256-Mlf4SrGCCqALQicbGtmVGdkdfcE8DEGYkOuVyG2CozM=";
   };
 in
 {
-  libressl_4_1 = generic {
-    version = "4.1.2";
-    hash = "sha256-+6Ti+ip/UjBt96OJlwoQ6YuX6w7bKZqf252/SZmcYeE=";
-    # Fixes build on loongarch64
-    # https://github.com/libressl/portable/pull/1184
-    postPatch = ''
-      mkdir -p include/arch/loongarch64
-      cp ${
-        fetchurl {
-          url = "https://github.com/libressl/portable/raw/refs/tags/v4.1.0/include/arch/loongarch64/opensslconf.h";
-          hash = "sha256-68dw5syUy1z6GadCMR4TR9+0UQX6Lw/CbPWvjHGAhgo=";
-        }
-      } include/arch/loongarch64/opensslconf.h
-    '';
-    patches = [
-      common-cmake-install-full-dirs-patch
-    ];
-  };
-
+  # 4.2 was released October 2025 and will become unsupported on October 22,
+  # 2026, one year after the release of OpenBSD 7.8.
   libressl_4_2 = generic {
     version = "4.2.1";
     hash = "sha256-bVwvWFg1iOp5H0yGRQBAcdAN+lVKW/eIoAbKHrWr1ws=";
@@ -144,4 +150,24 @@ in
       common-cmake-install-full-dirs-patch
     ];
   };
+
+  # 4.3 was released April 2026 and will become unsupported one year after the
+  # release of OpenBSD 7.9.
+  libressl_4_3 = generic {
+    version = "4.3.1";
+    hash = "sha256-wttCrOFOfVQZgm+rNadC7G5NEnJaBRpR0M6jwQug+lA=";
+    patches = [
+      # Fix for https://github.com/libressl/portable/issues/1278, where LibreSSL
+      # 4.3 started requiring executable stack because some objects were missing
+      # a .note.GNU-stack section; will probably be included in the next release.
+      (fetchpatch {
+        url = "https://raw.githubusercontent.com/libressl/portable/4dae91d056c6c75ba5cf2bc5e6148b8e02239119/patches/gnu-stack.patch";
+        hash = "sha256-Q1oWL4N8w5Zmjfq5QkTJR53NgZ4GqChSDaBicli5G2I=";
+        # This patch is written to be applied with -p0, with no leading path
+        # component, but Nix applies with -p1 by default, so we add it to not
+        # break compatibility with how other patches must be applied.
+        decode = "sed 's|^--- |--- a/|; s|^+++ |+++ b/|'";
+      })
+    ];
+  };
 }
diff --git a/pkgs/by-name/li/libtsm/package.nix b/pkgs/by-name/li/libtsm/package.nix
index 5cca1ae05a7b..fd960021e34b 100644
--- a/pkgs/by-name/li/libtsm/package.nix
+++ b/pkgs/by-name/li/libtsm/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libtsm";
-  version = "4.5.0";
+  version = "4.6.0";
 
   src = fetchFromGitHub {
     owner = "kmscon";
     repo = "libtsm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5Lv/Hb0FGWARk3Wv3IuAbtCDII7qOMmcZSmKTkgTEsc=";
+    hash = "sha256-CN5ktki8fbvmiGiyDvDf4ayRKakpWRI51SdhRbFqNVM=";
   };
 
   strictDeps = true;
diff --git a/pkgs/by-name/lo/lowfi/package.nix b/pkgs/by-name/lo/lowfi/package.nix
index 9a7dc2462388..d019856b6578 100644
--- a/pkgs/by-name/lo/lowfi/package.nix
+++ b/pkgs/by-name/lo/lowfi/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lowfi";
-  version = "2.0.6";
+  version = "2.0.7";
 
   src = fetchFromGitHub {
     owner = "talwat";
     repo = "lowfi";
     tag = finalAttrs.version;
-    hash = "sha256-t61R68cuAEAjyY5cR2rpTa+pSE3DDDct9G4p/aeTgsQ=";
+    hash = "sha256-/GU1e01AjeS4AVBvQUi/GZKeQ0X+hnmt+kyW3gp0jgg=";
   };
 
-  cargoHash = "sha256-ogoQWcS6htU515xjJW7jQYqpfHAQ48a8QaaBPvkGrXg=";
+  cargoHash = "sha256-iuC0YBhzK8mATJekTgBDMiXATRdThem35p5AyDXQNGo=";
 
   buildFeatures = [ "scrape" ] ++ lib.optionals stdenv.hostPlatform.isLinux [ "mpris" ];
 
diff --git a/pkgs/by-name/ma/matrix-alertmanager-receiver/package.nix b/pkgs/by-name/ma/matrix-alertmanager-receiver/package.nix
index 0b484d162cd3..ee4b554fd3a2 100644
--- a/pkgs/by-name/ma/matrix-alertmanager-receiver/package.nix
+++ b/pkgs/by-name/ma/matrix-alertmanager-receiver/package.nix
@@ -8,16 +8,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "matrix-alertmanager-receiver";
-  version = "2026.6.10";
+  version = "2026.6.17";
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "metio";
     repo = "matrix-alertmanager-receiver";
     tag = finalAttrs.version;
-    hash = "sha256-eZCFNKO3m3mm/nMMZXkfoQrsHwBekSJuKS0uQLhz4wY=";
+    hash = "sha256-vwmLSl09tzpn4hc8+d5l00D93QBsX/y0/403kuNg/SQ=";
   };
 
-  vendorHash = "sha256-ocwFtgSXiBa9e+hZyX3p/Y/Jndq1N64hKfyQtjrGaoY=";
+  vendorHash = "sha256-Umn+V+yqAUf0dmUW8p1Luh+hcVTqOTA0rmQyE0KmBZA=";
 
   env.CGO_ENABLED = "0";
 
diff --git a/pkgs/by-name/me/memtier-benchmark/package.nix b/pkgs/by-name/me/memtier-benchmark/package.nix
index f1c67bfb0d54..ce04d0ecae9c 100644
--- a/pkgs/by-name/me/memtier-benchmark/package.nix
+++ b/pkgs/by-name/me/memtier-benchmark/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "memtier-benchmark";
-  version = "2.4.2";
+  version = "2.4.3";
 
   src = fetchFromGitHub {
     owner = "redis";
     repo = "memtier_benchmark";
     tag = finalAttrs.version;
-    hash = "sha256-0whioOhzs5aLu/fjRJvybZ8UYE5Lv1VnQDmgikC3tEA=";
+    hash = "sha256-k2xhY4EsPVZIEGfdkDc/Mr3oJomNu2bhbn3MzCfOaDg=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mi/mimir/package.nix b/pkgs/by-name/mi/mimir/package.nix
index 63312e79cf25..c20fd10fea90 100644
--- a/pkgs/by-name/mi/mimir/package.nix
+++ b/pkgs/by-name/mi/mimir/package.nix
@@ -7,13 +7,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "mimir";
-  version = "3.1.1";
+  version = "3.1.2";
 
   src = fetchFromGitHub {
     rev = "mimir-${finalAttrs.version}";
     owner = "grafana";
     repo = "mimir";
-    hash = "sha256-Gp4+eVL6HUFlhtAZmDJyHYr/QP0+JQIcDXJfCk2IpCg=";
+    hash = "sha256-8GvpmCanVlsObH1mwPA/TsHzNp3f0hzF7fURIDHy/DU=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/mi/mistral-vibe/package.nix b/pkgs/by-name/mi/mistral-vibe/package.nix
index 734c46038057..7923d622bb88 100644
--- a/pkgs/by-name/mi/mistral-vibe/package.nix
+++ b/pkgs/by-name/mi/mistral-vibe/package.nix
@@ -5,6 +5,7 @@
   fetchFromGitHub,
 
   # tests
+  gitMinimal,
   uv,
   versionCheckHook,
   writableTmpDirAsHomeHook,
@@ -39,7 +40,7 @@ let
 in
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "mistral-vibe";
-  version = "2.17.1";
+  version = "2.18.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -47,7 +48,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "mistralai";
     repo = "mistral-vibe";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JrUepzbJupeyHiNz9gbX+C3kc2tJaNkxCldMELKeXcU=";
+    hash = "sha256-2eDu2Fqd6K/ZxWSl/pXSN284z7UquNb+zwkHYe9ZWBw=";
   };
 
   build-system = with python3Packages; [
@@ -159,6 +160,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
   pythonImportsCheck = [ "vibe" ];
 
   nativeCheckInputs = [
+    # vibe.core.agent_loop.TeleportError: Teleport requires git to be installed.
+    gitMinimal
     python3Packages.pytest-asyncio
     python3Packages.pytest-textual-snapshot
     python3Packages.pytest-xdist
diff --git a/pkgs/by-name/mo/mo-viewer/package.nix b/pkgs/by-name/mo/mo-viewer/package.nix
index 6538afbfad93..f4891b308b43 100644
--- a/pkgs/by-name/mo/mo-viewer/package.nix
+++ b/pkgs/by-name/mo/mo-viewer/package.nix
@@ -14,13 +14,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "mo-viewer";
-  version = "1.6.1";
+  version = "1.6.2";
 
   src = fetchFromGitHub {
     owner = "k1LoW";
     repo = "mo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/PiMYllj0l3XwIkqT/sc7U/vGXdNmTD8RowZWe9ZDR8=";
+    hash = "sha256-/dUAz55hsDYV+1rgNN52rdO798SCRyIyHXrL/ZGTwmY=";
   };
 
   frontend = stdenvNoCC.mkDerivation (finalFrontendAttrs: {
diff --git a/pkgs/by-name/mo/modrinth-app-unwrapped/deps.json b/pkgs/by-name/mo/modrinth-app-unwrapped/deps.json
index 63ca31d57eb6..f51f624430ee 100644
--- a/pkgs/by-name/mo/modrinth-app-unwrapped/deps.json
+++ b/pkgs/by-name/mo/modrinth-app-unwrapped/deps.json
@@ -126,10 +126,10 @@
    "jar": "sha256-hSTqyQ9+jg8TZog/LGyCDJO/ph3z12hXyNPoA89nMV0=",
    "pom": "sha256-e2qAtqLSZ2oEIvaWg4EyMVQlUfYbMgxochz7nh9ZCdA="
   },
-  "org/jetbrains/kotlin#kotlin-stdlib/2.3.0": {
-   "jar": "sha256-iHWHyRcTJQrVL+FK2RZtBCwzg1BJiQ6UN/NV/8WhlbE=",
-   "module": "sha256-CRCoo7aWD8eSxFxWqR18Oj8mKG8DKVVUtRnP83h1baI=",
-   "pom": "sha256-TVJW0+SETmVrDKQF9jUNbyF5XCQ3WzRSUmxUZ92ZtaI="
+  "org/jetbrains/kotlin#kotlin-stdlib/2.3.20": {
+   "jar": "sha256-CuElBKUEDrrzdwOQhINCDRpWJN0dk/NXZl+Md8hIoB4=",
+   "module": "sha256-9Os0T8TR46KK4WwIbsPkL1I3O0ZtQwgYL7OG45LA76M=",
+   "pom": "sha256-yDwC2afi6VRzBJHDPC8dwDwnZi4ntWbsK0TS0Bhjm5g="
   },
   "org/junit#junit-bom/5.11.4": {
    "module": "sha256-qaTye+lOmbnVcBYtJGqA9obSd9XTGutUgQR89R2vRuQ=",
diff --git a/pkgs/by-name/mt/mtail/package.nix b/pkgs/by-name/mt/mtail/package.nix
index 2de15aec8add..a0a788a05ca5 100644
--- a/pkgs/by-name/mt/mtail/package.nix
+++ b/pkgs/by-name/mt/mtail/package.nix
@@ -8,17 +8,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "mtail";
-  version = "3.3.2";
+  version = "3.4.0";
 
   src = fetchFromGitHub {
     owner = "jaqx0r";
     repo = "mtail";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Cn6Ssj5ik0G/MORbx+YwY7ekheXim64zUx7oKH5JXD0=";
+    hash = "sha256-iNTj8bXtJl1H0rNiFGITgIxD9oAZ7zKUAoyDaxvcR6o=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-v00wX7uz3z/ldwppQd9aJLN/bnhoN/wweY3nbO/fu2I=";
+  vendorHash = "sha256-NKNCpTCfc2U5fqdhXu30w7QlUjCwSX0l+t5ivWtEgdU=";
 
   nativeBuildInputs = [
     gotools # goyacc
diff --git a/pkgs/by-name/ne/newelle/package.nix b/pkgs/by-name/ne/newelle/package.nix
index cb118e03f15f..a63aee43c276 100644
--- a/pkgs/by-name/ne/newelle/package.nix
+++ b/pkgs/by-name/ne/newelle/package.nix
@@ -104,6 +104,8 @@ python3Packages.buildPythonApplication {
     mainProgram = "newelle";
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.linux;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      michaelAllen
+    ];
   };
 }
diff --git a/pkgs/by-name/ni/niks3/package.nix b/pkgs/by-name/ni/niks3/package.nix
index cfe54c13d76f..1f8479fdbbcf 100644
--- a/pkgs/by-name/ni/niks3/package.nix
+++ b/pkgs/by-name/ni/niks3/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "niks3";
-  version = "1.6.1";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = "niks3";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/JsYspjkvMXmtcHjZ9o4+rznCuI5RxruJ228TQN5slY=";
+    hash = "sha256-+Aj5ca1iUqbDW9MjFGoGoylnVjcMQLlT/OlH2yMrg/I=";
   };
 
-  vendorHash = "sha256-dxNk5DWBMyahl36RARCu/JfrpQ6RFATKEuDLEhea5RQ=";
+  vendorHash = "sha256-zYGAd2N3qGavAlT4MggSME7r04kAVn19N7Nh0L0DK5k=";
 
   subPackages = [
     "cmd/niks3"
diff --git a/pkgs/by-name/ni/nix-search-tv/package.nix b/pkgs/by-name/ni/nix-search-tv/package.nix
index 4535ad698c38..e6e647eed359 100644
--- a/pkgs/by-name/ni/nix-search-tv/package.nix
+++ b/pkgs/by-name/ni/nix-search-tv/package.nix
@@ -7,13 +7,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "nix-search-tv";
-  version = "2.2.7";
+  version = "2.2.8";
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "3timeslazy";
     repo = "nix-search-tv";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vWKMGj2fBUbsAvwoYjgT+L4hH0A96u4rDOaT0wnj7iw=";
+    hash = "sha256-TbNpfJOL0IM+ElXYXherSeUT+qswxH8eY/tvCZyKAZg=";
   };
 
   vendorHash = "sha256-SSKDo4A8Nhvylghrw6d7CdHpZ7jObEr5V3r0Y9cH80Y=";
@@ -33,7 +34,7 @@ buildGoModule (finalAttrs: {
   meta = {
     description = "Fuzzy search for Nix packages";
     homepage = "https://github.com/3timeslazy/nix-search-tv";
-    changelog = "https://github.com/3timeslazy/nix-search-tv/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/3timeslazy/nix-search-tv/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ GaetanLepage ];
     mainProgram = "nix-search-tv";
diff --git a/pkgs/by-name/op/openapv/package.nix b/pkgs/by-name/op/openapv/package.nix
index b153552d6f17..27d31127a004 100644
--- a/pkgs/by-name/op/openapv/package.nix
+++ b/pkgs/by-name/op/openapv/package.nix
@@ -12,13 +12,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "openapv";
-  version = "0.2.1.2";
+  version = "0.2.1.3";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "openapv";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-wxncN7j5p0GXpWhOx4Ix0oTgGK2sIrfJgQ45fFwmQBI=";
+    tag = "v${finalAttrs.version}-fix"; # Remove the `-fix` suffix after the next version
+    hash = "sha256-lc/x2dWh6T8c63siHB32ka+SPVYTTyaO4YrQ12EbGqw=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/op/openldap/package.nix b/pkgs/by-name/op/openldap/package.nix
index c87e6c2e75a5..7499f3a6fd16 100644
--- a/pkgs/by-name/op/openldap/package.nix
+++ b/pkgs/by-name/op/openldap/package.nix
@@ -122,6 +122,8 @@ stdenv.mkDerivation (finalAttrs: {
     # https://bugs.openldap.org/show_bug.cgi?id=8623
     rm -f tests/scripts/test022-ppolicy
 
+    rm -f tests/scripts/test*-sync*
+
     rm -f tests/scripts/test063-delta-multiprovider
 
     # https://bugs.openldap.org/show_bug.cgi?id=10009
diff --git a/pkgs/by-name/oy/oyui/package.nix b/pkgs/by-name/oy/oyui/package.nix
new file mode 100644
index 000000000000..1cb665f30ebc
--- /dev/null
+++ b/pkgs/by-name/oy/oyui/package.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  __structuredAttrs = true;
+
+  pname = "oyui";
+  version = "0.2.1";
+
+  src = fetchFromGitHub {
+    owner = "emilien-jegou";
+    repo = "oyui";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Z69mBOZFHqslZLC2WutvkhcydxAmO9pppapJSTeHtiA=";
+  };
+
+  cargoHash = "sha256-3XzTbrEDFzCf2rsvJu/foiDYEoO4lLMsr+4t9nDYv34=";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Modern TUI merge tool and interactive diff editor for Jujutsu (jj) and Git";
+    homepage = "https://github.com/emilien-jegou/oyui";
+    changelog = "https://github.com/emilien-jegou/oyui/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [
+      adda
+    ];
+    mainProgram = "oyui";
+  };
+})
diff --git a/pkgs/by-name/pd/pdftitle/package.nix b/pkgs/by-name/pd/pdftitle/package.nix
index d28ca7f8e281..2e402c91cb3f 100644
--- a/pkgs/by-name/pd/pdftitle/package.nix
+++ b/pkgs/by-name/pd/pdftitle/package.nix
@@ -2,7 +2,6 @@
   lib,
   fetchFromGitHub,
   python3Packages,
-  openai,
   pdfminer,
 
   withOpenai ? false,
diff --git a/pkgs/by-name/pd/pdns/package.nix b/pkgs/by-name/pd/pdns/package.nix
index 15c328fd5a3b..ca5771180a2d 100644
--- a/pkgs/by-name/pd/pdns/package.nix
+++ b/pkgs/by-name/pd/pdns/package.nix
@@ -24,11 +24,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pdns";
-  version = "5.1.1";
+  version = "5.1.2";
 
   src = fetchurl {
     url = "https://downloads.powerdns.com/releases/pdns-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-CJN5Vc5ES7sKq/32pfGNSD3ViT12FTmBG+F6m2zzO2o=";
+    hash = "sha256-aFWWelSte13on5EPBeNI4xey7YOetJj5bDjBr3oerzg=";
   };
   # redact configure flags from version output to reduce closure size
   patches = [ ./version.patch ];
diff --git a/pkgs/by-name/pi/pinchflat/package.nix b/pkgs/by-name/pi/pinchflat/package.nix
index 15d42ce350d7..832c86480641 100644
--- a/pkgs/by-name/pi/pinchflat/package.nix
+++ b/pkgs/by-name/pi/pinchflat/package.nix
@@ -58,10 +58,13 @@ beamPackages.mixRelease rec {
     patchShebangs ~/assets/node_modules
 
     # phoenixframework expects platform-specific tailwind/esbuild binaries in a specific location:
-    # https://github.com/phoenixframework/tailwind/blob/194ab0f979782e4ccf2fe796042bf8e20967df93/lib/tailwind.ex#L243-L251
-    targets="linux-x64 linux-arm64 macos-x64 macos-arm64"
-    for target in $targets; do
+    # tailwind: https://github.com/phoenixframework/tailwind/blob/194ab0f979782e4ccf2fe796042bf8e20967df93/lib/tailwind.ex#L243-L251
+    for target in linux-x64 linux-arm64 macos-x64 macos-arm64; do
       ln -s "${tailwindcss}/bin/tailwindcss" "_build/tailwind-$target"
+    done
+
+    # esbuild: https://github.com/phoenixframework/esbuild/blob/v0.10.0/lib/esbuild.ex#L270-L300
+    for target in linux-x64 linux-arm64 darwin-x64 darwin-arm64; do
       ln -s "${esbuild}/bin/esbuild" "_build/esbuild-$target"
     done
 
diff --git a/pkgs/by-name/pk/pkl-lsp/deps.json b/pkgs/by-name/pk/pkl-lsp/deps.json
index 63ee94f46fbc..6c81e37261b1 100644
--- a/pkgs/by-name/pk/pkl-lsp/deps.json
+++ b/pkgs/by-name/pk/pkl-lsp/deps.json
@@ -220,13 +220,13 @@
    "jar": "sha256-0g+JIDBZb7wsJdoArNvSdQ93zv1oE2wzo+J5uJSYZ6g=",
    "pom": "sha256-+U4i9QNmKcxz7AM41+C5wFx2g70TZ4wWa8p/fIfm+oE="
   },
-  "org/gradle/kotlin#gradle-kotlin-dsl-plugins/6.5.2": {
-   "jar": "sha256-O/9KBwDhyBXRlEifB7ugbLGQ6PKbdz03z+43rI1cdkQ=",
-   "module": "sha256-MVnFQXhFqWmTx4nULexDVwf7uEiXnP0R0LgzBZ5RIKM=",
-   "pom": "sha256-ctVO1m6jP6+UKCNRwxAZ4S59fpIOpnpRbL4ODWdBA0M="
+  "org/gradle/kotlin#gradle-kotlin-dsl-plugins/6.5.7": {
+   "jar": "sha256-zIyqQQGjXQzwQzpj6K04kRpMhIBz/MlPQ64CUfM+Ta8=",
+   "module": "sha256-ENa9ZquwiOylvjYP9yVQyWFU0mdu/t10rzHEUAF8OQk=",
+   "pom": "sha256-q+nzlg+nNZciqHUuYb/ElnYeFdFHNeTGQiB5cHYGq74="
   },
-  "org/gradle/kotlin/kotlin-dsl#org.gradle.kotlin.kotlin-dsl.gradle.plugin/6.5.2": {
-   "pom": "sha256-5aavF7WFYNdGyrQseV/jpCoevkBQ5VpPANjPVM8x8eo="
+  "org/gradle/kotlin/kotlin-dsl#org.gradle.kotlin.kotlin-dsl.gradle.plugin/6.5.7": {
+   "pom": "sha256-Ldg2zAlxLNrd/u/GgNLqZutD2NxjOGvVlSZYE0l/Ry0="
   },
   "org/gradle/toolchains#foojay-resolver/1.0.0": {
    "jar": "sha256-eLhqR9/fdpfJvRXaeJg/2A2nJH1uAvwQa98H4DiLYKg=",
@@ -328,9 +328,9 @@
   "org/jetbrains/kotlin#kotlin-serialization/2.3.21/gradle813": {
    "jar": "sha256-DhI+4919qUppjA+SqmDyRESVJKzeYu7KSjbixgcbM0U="
   },
-  "org/jetbrains/kotlin#kotlin-stdlib-common/2.3.0": {
-   "module": "sha256-/pAljbcTNVWBoBZDfQbAKdBpwgu93uE02R5LiHBz108=",
-   "pom": "sha256-J+2DQuBLgcqy0aP512D06/lQmG9n7Eme1y1cw4d+6NA="
+  "org/jetbrains/kotlin#kotlin-stdlib-common/2.3.20": {
+   "module": "sha256-fV4z3nFM3ddQeGQgmMvL7pfBg5jQNLd9MrSwdLlQOTk=",
+   "pom": "sha256-/Xtj7fb31urrwWoYVgu7koszQlYepcnR92kZiw/puYg="
   },
   "org/jetbrains/kotlin#kotlin-stdlib-jdk7/1.8.0": {
    "pom": "sha256-36lkSmrluJjuR1ux9X6DC6H3cK7mycFfgRKqOBGAGEo="
@@ -349,10 +349,10 @@
    "jar": "sha256-pMdNlNZM4avlN2D+A4ndlB9vxVjQ2rNeR8CFoR7IDyg=",
    "pom": "sha256-X0uU3TBlp3ZMN/oV3irW2B9A1Z+Msz8X0YHGOE+3py4="
   },
-  "org/jetbrains/kotlin#kotlin-stdlib/2.3.0": {
-   "jar": "sha256-iHWHyRcTJQrVL+FK2RZtBCwzg1BJiQ6UN/NV/8WhlbE=",
-   "module": "sha256-CRCoo7aWD8eSxFxWqR18Oj8mKG8DKVVUtRnP83h1baI=",
-   "pom": "sha256-TVJW0+SETmVrDKQF9jUNbyF5XCQ3WzRSUmxUZ92ZtaI="
+  "org/jetbrains/kotlin#kotlin-stdlib/2.3.20": {
+   "jar": "sha256-CuElBKUEDrrzdwOQhINCDRpWJN0dk/NXZl+Md8hIoB4=",
+   "module": "sha256-9Os0T8TR46KK4WwIbsPkL1I3O0ZtQwgYL7OG45LA76M=",
+   "pom": "sha256-yDwC2afi6VRzBJHDPC8dwDwnZi4ntWbsK0TS0Bhjm5g="
   },
   "org/jetbrains/kotlin#kotlin-tooling-core/2.3.21": {
    "jar": "sha256-NnFCeBKZvA+RIMHe7A5ik0oa+ep/AaqpxaU1TcXY19k=",
@@ -607,9 +607,9 @@
    "jar": "sha256-rOKhDcji1f00kl7KwD5JiLLA+FFlDJS4zvSbob0RFHg=",
    "pom": "sha256-llrrK+3/NpgZvd4b96CzuJuCR91pyIuGN112Fju4w5c="
   },
-  "org/jetbrains/kotlin#abi-tools-api/2.3.0": {
-   "jar": "sha256-QBe8wfXTKFsX5rYiDRakaMhxWTDw35Y5bXZLV/Cm02U=",
-   "pom": "sha256-qJIhRAlxhudUjXFH3I3O1eYOMGnUY1ulUe8uV3WrmAk="
+  "org/jetbrains/kotlin#abi-tools-api/2.3.20": {
+   "jar": "sha256-U2hfV4OwSQaDiY11Wrrk1Bi26DugYTSFiv3ctZRYmek=",
+   "pom": "sha256-qIbJ/X8rlmlFf+wCHxnc8V8EY+DbS9rVOuGBJTZsxvk="
   },
   "org/jetbrains/kotlin#abi-tools-api/2.3.21": {
    "jar": "sha256-3HIcf6qETff11utiAh3J6t/RmY4ejfkYNB8W6zw5Guo=",
@@ -619,126 +619,130 @@
    "jar": "sha256-Z2FlYgXDUUBQ9o/efDKyvrRyRnhiR9rPsnnbQypwVis=",
    "pom": "sha256-4sAPASdLb0ZFpyikxuSpCnydRjlAlqMDJvfDGvCVZ7M="
   },
-  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.3.0": {
-   "module": "sha256-d8IDSG/XkrWAVyBp5cRC0YDA7wVbpzRQXaKNGX7BL/c=",
-   "pom": "sha256-k8/rFUWRw3AengQ1C9AF0ZVqmuZHFH1vsqfFeD4fkJo="
+  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.3.20": {
+   "module": "sha256-bNjWSw5lN3kE8wb2qFja/ZMcQTUkD4RMk9UpTumP6Dk=",
+   "pom": "sha256-SgpFTor25QOv5ngwoYVjubaA3u67GhcGoNe0S8UHQKE="
   },
-  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.3.0/gradle813": {
-   "jar": "sha256-D+cv3G5RvisnSw5kuEQB9SUDavsgYWKkRYIU8R6614c="
+  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.3.20/gradle813": {
+   "jar": "sha256-pPEKPw6l3dH1VaT3BuCep/VSs8hSK7EAY2HdMG4152o="
   },
-  "org/jetbrains/kotlin#kotlin-assignment-compiler-plugin-embeddable/2.3.0": {
-   "jar": "sha256-1D+qszfzaY6NrOZSXSzXwq66ewNZOEhYZBZP5wLnM70=",
-   "pom": "sha256-UttpIUdRA18/LYUvJDCC5x566wenFs2eCHskuYJ6Uio="
+  "org/jetbrains/kotlin#kotlin-assignment-compiler-plugin-embeddable/2.3.20": {
+   "jar": "sha256-EjVTkgnMVtLi7G+XeYaHiHK3Cgh4H2Sv/0Ubwfe9VrE=",
+   "pom": "sha256-m9zHQ84iL4oxnuYJe2Cq7unmvqe1vzKXYVp1tLpsFDM="
   },
-  "org/jetbrains/kotlin#kotlin-assignment/2.3.0": {
-   "module": "sha256-ljRPGdjxnqpbxEHjP2UB9+c9o8el1X1EvHwW6qRXVls=",
-   "pom": "sha256-GqwiGC0snJVP/8FrV2Xq0jjiAw9HhIctRrxfOcozll0="
+  "org/jetbrains/kotlin#kotlin-assignment/2.3.20": {
+   "module": "sha256-GCp0ZM5mvM/ejjG+aPoO7DE8HZDD2POWeclyJyliFjg=",
+   "pom": "sha256-f3R8uTA9Hfqh1hJfZsFUG+o4PsuZh2ta28riSAVZZ48="
   },
-  "org/jetbrains/kotlin#kotlin-assignment/2.3.0/gradle813": {
-   "jar": "sha256-PKIayHkWchdbgnPemV8CTzWZLfAwCijCdUnPd3DMnOY="
+  "org/jetbrains/kotlin#kotlin-assignment/2.3.20/gradle813": {
+   "jar": "sha256-tYin5gfij7WAIo4SDdX/+L6nO9J3JnM6F35kRYLooB0="
   },
-  "org/jetbrains/kotlin#kotlin-build-statistics/2.3.0": {
-   "jar": "sha256-Z3hVlwDnLXZOniTZWPFuwMx152t1s4FMK83hRKYnT04=",
-   "pom": "sha256-QTkKXrIxFJOxpFubOXLDoL8dqEfoRaNKtoQKr0EmTeI="
+  "org/jetbrains/kotlin#kotlin-build-statistics/2.3.20": {
+   "jar": "sha256-ptJ7PINhdlLdBlYG+Yz1nPviY/jCDr5OvVpvJonrDU8=",
+   "pom": "sha256-nQqNf/FyPV1y00ldVVc9jTxrd3TWHYBXlxT3nCQmX48="
   },
-  "org/jetbrains/kotlin#kotlin-build-tools-api/2.3.0": {
-   "jar": "sha256-xsCc8oU0VySfcHyGOCESQJ1aVfULa4Vouk9TDdAD/tw=",
-   "pom": "sha256-FzTIvg4nFXJ3AkW01gbOW7iBbosNHA9+euEcEMLKF1s="
+  "org/jetbrains/kotlin#kotlin-build-tools-api/2.3.20": {
+   "jar": "sha256-IvGrIjhUuUkJn2slnO9UHVtYo2Q9+aScRXfGPEFuhDs=",
+   "pom": "sha256-G14LLDaQXcL1XgpLeBKuY+MSXe/PaG0sD0kPg7c9nV4="
   },
   "org/jetbrains/kotlin#kotlin-build-tools-api/2.3.21": {
    "jar": "sha256-suXMJmbBAAee00NhhSjrgg3PpQlQleMPLdGcYN/35GI=",
    "pom": "sha256-cfil/z5A5xkQT1Mw4oMyDhnYWINO+S0Sv6DQZtvDcdc="
   },
-  "org/jetbrains/kotlin#kotlin-build-tools-compat/2.3.0": {
-   "jar": "sha256-AJST4crwTIKF8f7RV7uraINV2wTS3q7E9aD5tjX4ZuU=",
-   "pom": "sha256-ayMWTiKBY/1j+Bf7LF3ifW6cNAO3Y8y6BoBYTyF/jjI="
+  "org/jetbrains/kotlin#kotlin-build-tools-compat/2.3.20": {
+   "jar": "sha256-RMMHtO3UysUflgqBNBEtZkyTB2cAzaXoZulNmkKWNA4=",
+   "pom": "sha256-rpC+JesEdhCNlo6+Mqjd9SXhQIhYj6BUc9sSgVoPG3Q="
   },
   "org/jetbrains/kotlin#kotlin-build-tools-compat/2.3.21": {
    "jar": "sha256-mWMrd3uKhaej+EMd70l+MfdgShR1u6PAEavjBfWF2NY=",
    "pom": "sha256-gA3wZQgt3NhJXQvNT6EF0uXYDJ1864UaR8CiRFEEeas="
   },
+  "org/jetbrains/kotlin#kotlin-build-tools-cri-impl/2.3.20": {
+   "jar": "sha256-VOztYw8oEkzP4uRk5srMKB5SiopQqJclchVUyWk1SP4=",
+   "pom": "sha256-5zeMZYHvXw4stA46TOxR0rlj5iVkWpK2fqCVJa+XxMM="
+  },
   "org/jetbrains/kotlin#kotlin-build-tools-cri-impl/2.3.21": {
    "jar": "sha256-z/CptmWFGjJcIZWFfi4aWnR5VMlDfQDeC6FVGaQpTEY=",
    "pom": "sha256-Z1U7yyHpwRZ3AOwyd6x/q5cuays2j5W/bUZ+BGTb2jM="
   },
-  "org/jetbrains/kotlin#kotlin-build-tools-impl/2.3.0": {
-   "jar": "sha256-k6Xo/7EACAHIMqhisjvZdm9ETm9sGFwysftXh3+1zqM=",
-   "pom": "sha256-AKelPNgr5ws234oCI6Wrhhoqb/txnZt3M3XId8idugQ="
+  "org/jetbrains/kotlin#kotlin-build-tools-impl/2.3.20": {
+   "jar": "sha256-loG8IWSovZ9t30wIXPSoNrktJ1BmZ9c7q59thVM2yRA=",
+   "pom": "sha256-gswavl5j0/5nV+eXKE8F25r9fq3D6D0ROcOlW2TUstU="
   },
   "org/jetbrains/kotlin#kotlin-build-tools-impl/2.3.21": {
    "jar": "sha256-LNcDlkBKDkPAWq95qLNf86j/Lilq7fdw9uWSP7+srjs=",
    "pom": "sha256-0F9jI8F/lhholWgx+dWvrTEQNbGMP1Q//S88hGaT2VI="
   },
-  "org/jetbrains/kotlin#kotlin-compiler-embeddable/2.3.0": {
-   "jar": "sha256-jb2IL6WMPRfmg6JzkCiDFfi0kPjj47G+TcPigNN+KFo=",
-   "pom": "sha256-zOmxEfIRZgxcRTk+dI30aVC2HAEUfgdzttxxnui7d6g="
+  "org/jetbrains/kotlin#kotlin-compiler-embeddable/2.3.20": {
+   "jar": "sha256-l2+YnQtfXYDo6KitS3PaC/wn/dllufo4Nisr557MEzc=",
+   "pom": "sha256-DDWu7jcvB1FOvtN7lAe44RgdFCd1UTnlzudxnKBf5+g="
   },
   "org/jetbrains/kotlin#kotlin-compiler-embeddable/2.3.21": {
    "jar": "sha256-0+cPsBFnXnfvAPGmiRjTzZHu0mBYl30ePqKjeikyM68=",
    "pom": "sha256-lSPI/q3LF/QtBP+pf+KpwI5dsY8JD225A9ylw2x65cQ="
   },
-  "org/jetbrains/kotlin#kotlin-compiler-runner/2.3.0": {
-   "jar": "sha256-hwl38pYFQ2xesiV7nI5dZPMoLyqI7e5FRNNOxF8Wpqc=",
-   "pom": "sha256-ov8zZnin9TpEOSv8bFK2gS7dxz5AghyQfyomQWeeDrs="
+  "org/jetbrains/kotlin#kotlin-compiler-runner/2.3.20": {
+   "jar": "sha256-wGnzCkA75wyBUviqnyXsy6GI7q1UJjrgKvFEIUN6Igg=",
+   "pom": "sha256-jYTqDt1gs4vOpWLeUXgVKiZxqaAFPWcPkxRSs9sBMig="
   },
   "org/jetbrains/kotlin#kotlin-compiler-runner/2.3.21": {
    "jar": "sha256-bbcIYinbidBxg6m0duCZL4YSDbwh9mCSzRJMftbXRDQ=",
    "pom": "sha256-H6VIXunMzI6TOZU0scUqB1/NRj1poinJyqYBzAkdwog="
   },
-  "org/jetbrains/kotlin#kotlin-daemon-client/2.3.0": {
-   "jar": "sha256-sr5naIyvEaE41a4M4SNTga2asN25OVqwb42EagtGYBc=",
-   "pom": "sha256-teLnTuXC+I/Qi/g+7GRx9rvKeqEhWYgCtsMsVuhwYCY="
+  "org/jetbrains/kotlin#kotlin-daemon-client/2.3.20": {
+   "jar": "sha256-xxp8G+j7/wTgr0XJ7oy3ph2JU7ymuL8iWlcZxyWpC0Q=",
+   "pom": "sha256-nnyLgHJBF/cqrOZfa+SNg224/Dl1OtlR8ruQhi1+cIA="
   },
   "org/jetbrains/kotlin#kotlin-daemon-client/2.3.21": {
    "jar": "sha256-+nZ8m0DQafFkxhem5r0wJkPHuowHkujtnkEsGPhLUL4=",
    "pom": "sha256-1wqhMeENnEDUT/s9iMhcrFSmSjBUIXn4R/gD7HGuG60="
   },
-  "org/jetbrains/kotlin#kotlin-daemon-embeddable/2.3.0": {
-   "jar": "sha256-ObywLYwpOqZ4VUyLSdf/hGVwIXCSg8YYbjpAgGr5vRA=",
-   "pom": "sha256-TI3aucQLMNAbhc/qHxd31zUlybcWQ+YlDGV2/H0fwRI="
+  "org/jetbrains/kotlin#kotlin-daemon-embeddable/2.3.20": {
+   "jar": "sha256-iHC6uEC4CHyWxN3AYIi0rt9RMcQIrzZ0MGME8flq8/Q=",
+   "pom": "sha256-YVQOWzoywLEZYkSWZZJMbNdVTqmu4IVb2OT1t/YQoKs="
   },
   "org/jetbrains/kotlin#kotlin-daemon-embeddable/2.3.21": {
    "jar": "sha256-Ii/BCjwi500wNpv4oMpsT5Ny6sfUoAgeKQwlb6TTD7I=",
    "pom": "sha256-9cV3dsXsNQSkFjZBZGALDL6F6+qPFuvvYH6trw/Wv0M="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-annotations/2.3.0": {
-   "jar": "sha256-/HKYw2tF820WUscDuraT9f6bEVmOzZrH7J/f6IptsPA=",
-   "pom": "sha256-aQhDRFhvUkNNH7tRZmlgr/uHbGQ+gIYkXrgLpeREm7U="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-annotations/2.3.20": {
+   "jar": "sha256-4WYu10cyK2P2HU+t2Zq3gQTEXq8JwRp4mGJBXoHBjcQ=",
+   "pom": "sha256-aP+Cf8E1DZPw1nM2jAZHm2K31eXDBlipWM+TBmgx6Nk="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.3.0": {
-   "module": "sha256-BQ8eECIJAOR6MIkd1c/qg3pl27sNmjyxuFKRq6MmykE=",
-   "pom": "sha256-GeTwq/tcvwEdJZP1ZRV8jr9FkvMAhhS6LtsEinhRF10="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.3.20": {
+   "module": "sha256-04UBEP9ajrcP7S1Xi0X7B+vESvaika5M88eUMMZRKLo=",
+   "pom": "sha256-AdVSITSRyFPVb4frdIEwON+e4dhekIaqN70GY7JJb4g="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.3.0/gradle813": {
-   "jar": "sha256-yh6tFJqMj0G6YKg5qDsjw6BiJ8RsYhJMUb6ZkDXerDE="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.3.20/gradle813": {
+   "jar": "sha256-ybwX32m/OZB8WXweGb7EtHnHWqx1+/1jIeNEW0lxLog="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea-proto/2.3.0": {
-   "jar": "sha256-epBQPJ14f5vNLBd25MxSfrneeRLvecbJWPEwWi0cQ7o=",
-   "pom": "sha256-2bCOHuM4pjRhSanQIY+FHuPUfYu3fWEDJg8qhyauUl4="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea-proto/2.3.20": {
+   "jar": "sha256-5Cicv5/0lAfwQd3GM24bV3pspM8r4dKjEzgnHBPu0+0=",
+   "pom": "sha256-9veHObqf4nEunwyeW8T16TcZzP6pW0fC9JslC+F2NX4="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea/2.3.0": {
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea/2.3.20": {
    "jar": "sha256-lS5zlI4qINOYwmuHprtwzPZkGPuvFSfDUVsYjqnUvWA=",
-   "module": "sha256-kRUvrqO8DJTbZtPLWKrh2+rXyGC1dk5nsgC01N9M6rk=",
-   "pom": "sha256-BLSVrgZj7a3aSEBkZKzTlDGjysez6OjAlLdplu1BSaA="
+   "module": "sha256-b7XZcwCl5Vmv1Nn/msA1bE2Wb31pS2Yvrhaf2HQhUx4=",
+   "pom": "sha256-WROHIVGNgqND99wvCRK3BJjT7vM2PJ66wiCssPyTjsw="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.3.0": {
-   "module": "sha256-vbMts6ongF80eewDPsY9PMq+sTuInYbavadCu+9TwJo=",
-   "pom": "sha256-h4cnvyGoOtrYnU5giEhN2/OfaoSpQoAiGm4cL4hBMD4="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.3.20": {
+   "module": "sha256-lVUmc7gbNXitmy86/xRUtjzoBsb9SrfGBJIx6GQKtHE=",
+   "pom": "sha256-EcMjwt2KgE6fWOBHwsAYZLKgHcDYEys2PApDEiFbwJs="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.3.0/gradle813": {
-   "jar": "sha256-Os+X1zolgbAyhz+on1Z1DTazt21A1pLZg58kZ92uTWk="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.3.20/gradle813": {
+   "jar": "sha256-RuFu4mWU9ID+y5LJbarjdTDoNQJreON+8yUelX8D9vs="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugins-bom/2.3.0": {
-   "module": "sha256-/9anNzSypS+3Yz8WOVRL43HgYpxR2X+h5fteqTQ6Fwk=",
-   "pom": "sha256-cYYJKmnzaIQyxcCsuQtKZx/Y7oANhP5YT66P1TO6v4o="
+  "org/jetbrains/kotlin#kotlin-gradle-plugins-bom/2.3.20": {
+   "module": "sha256-+CvXZF0MPv609PZVIKPGWz6MMCsIMyIDegABuHsC6ZA=",
+   "pom": "sha256-3WuRkZfhMv5x3axw9vxdj65/Und6/YN7FN6HG4wKVAA="
   },
   "org/jetbrains/kotlin#kotlin-klib-abi-reader/2.3.21": {
    "jar": "sha256-xFQbDaJUUqjqZFWv8N1ZC51WfR2mj2WyutsoH/0UzrY=",
    "pom": "sha256-bDTzpbw28/2ZIG0q4au3NP4iVIga6s8pFUHmq8qIlLc="
   },
-  "org/jetbrains/kotlin#kotlin-klib-commonizer-api/2.3.0": {
-   "jar": "sha256-m6V9kaveq5rNWIoUtfQiCbmWRMU0Ft/56X7LS/l/Ukg=",
-   "pom": "sha256-zTHw7NqCplEi/8alXehxE5S2GEtRRAK34RkZGqgJGoI="
+  "org/jetbrains/kotlin#kotlin-klib-commonizer-api/2.3.20": {
+   "jar": "sha256-vpN3SFQS0A8B54KZyzC+SAJZHCcwNCtuva/AiU91J0M=",
+   "pom": "sha256-IbFbpb1i0h1Ta7egyMtnQ1cfwPQwklSKQjWybyodIgs="
   },
   "org/jetbrains/kotlin#kotlin-klib-commonizer-embeddable/2.3.21": {
    "jar": "sha256-VBJEACe/WlffQbEgitWexffHthJHOjDiiZiCyY/gcd0=",
@@ -748,9 +752,9 @@
    "jar": "sha256-AFkPJqWnaHd/BCUsbPk8AWozYaa8k2Nt9nN1rU0ZVX0=",
    "pom": "sha256-g7erCwEj57FCij1fdNwVHpBKEMjNMgY5kaYGUIvCHoA="
   },
-  "org/jetbrains/kotlin#kotlin-native-utils/2.3.0": {
-   "jar": "sha256-7kvygz0Q5fN90haoMSn1nzx8vvXrrBMPcGZIOXCMgLc=",
-   "pom": "sha256-Rp6PYB/b34kP+ozXSOEQcCqkUxu7KbZOXnUD8O/lDZA="
+  "org/jetbrains/kotlin#kotlin-native-utils/2.3.20": {
+   "jar": "sha256-QxnCdkeV773/K3julUVRV9evC5FVaYuqG6Uqar46vy0=",
+   "pom": "sha256-LAp+ADViCIXUN+fxJidEdbpYqiJC+1279D+R8gyvpwg="
   },
   "org/jetbrains/kotlin#kotlin-power-assert-compiler-plugin-embeddable/2.3.21": {
    "jar": "sha256-hMNOLOblRNTsPPWUCtxKISeHjZVtn0cDcKsS5BdkgzU=",
@@ -760,60 +764,60 @@
    "jar": "sha256-MnesECrheq0QpVq+x1/1aWyNEJeQOWQ0tJbnUIeFQgM=",
    "pom": "sha256-V5BVJCdKAK4CiqzMJyg/a8WSWpNKBGwcxdBsjuTW1ak="
   },
-  "org/jetbrains/kotlin#kotlin-reflect/2.3.0": {
-   "jar": "sha256-cU30voGVRf9N4fNqohg+DeqUtMjN98op6ciZGbrzY2I=",
-   "pom": "sha256-89F2jvL7UxBIPb6R4w6fo2x7Pi/e5pRaCLujEBQtKcE="
+  "org/jetbrains/kotlin#kotlin-reflect/2.3.20": {
+   "jar": "sha256-40b6PD/0RR9fcHoxKIf9TIVV2kjMFfqdsrqTwz+J+BM=",
+   "pom": "sha256-iwC9L+srtVON85aVQXTZ3cDsVA00ElhjA1ObHpZVwzM="
   },
   "org/jetbrains/kotlin#kotlin-reflect/2.3.21": {
    "jar": "sha256-M+N9nfqGx6Kas06XW19KEoe0WIeGEQUfNIVlIiDBoss=",
    "pom": "sha256-fjwv5c80lKm0dSVYDDjDXEPW42guagsvVllU4Zpy1jk="
   },
-  "org/jetbrains/kotlin#kotlin-sam-with-receiver-compiler-plugin-embeddable/2.3.0": {
-   "jar": "sha256-QOPhi7jFUjLuZSXOV9F7hl5WcosFK/DBDnvsHQhJmMo=",
-   "pom": "sha256-BnzIEOCaYeFufoe1Kk3WR+FfYLd+PaDRsVPz+A7r8wM="
+  "org/jetbrains/kotlin#kotlin-sam-with-receiver-compiler-plugin-embeddable/2.3.20": {
+   "jar": "sha256-hvch6zOswK/QbdZoDnenZLY0qb2LEbc77yv8CQnxiUA=",
+   "pom": "sha256-Vg23nSOjmud5dqVmkZRw3sQazHeqUa6qVlzAKbkXGqw="
   },
-  "org/jetbrains/kotlin#kotlin-sam-with-receiver/2.3.0": {
-   "module": "sha256-DCD2gdNvSnmRYiFYCYkpF5TmVlgvlJwGed+kNKAm9so=",
-   "pom": "sha256-DILmEXpGNhvUzF5iZV8rgC8Q9LfZJWpjaD0DSv0MDUM="
+  "org/jetbrains/kotlin#kotlin-sam-with-receiver/2.3.20": {
+   "module": "sha256-nhEhx/ZQMDvdx/BH/tMCf4FjuzZ1Gy3w+vNjfumFsh8=",
+   "pom": "sha256-Y/Gk4+TT3jrPghTwWgtW/5IM4L9ZYVSnkE8gVuP41RE="
   },
-  "org/jetbrains/kotlin#kotlin-sam-with-receiver/2.3.0/gradle813": {
-   "jar": "sha256-r8iTlKUrUu8Lp6gpakJi0NOoo850CRXYfXE7CgFhMpg="
+  "org/jetbrains/kotlin#kotlin-sam-with-receiver/2.3.20/gradle813": {
+   "jar": "sha256-oHxdPMvaP8dWTkB0RybhNz5UvSXwVGPT9D1DnXeOy90="
   },
-  "org/jetbrains/kotlin#kotlin-script-runtime/2.3.0": {
-   "jar": "sha256-24JpYTcdZgUxjZxOS/zb+slMOgiSzcq9VSJIcP6tV/E=",
-   "pom": "sha256-20CN5tumaQeVvFOkoPhbM8en1qzLZ94ZAmQPr1QfL1s="
+  "org/jetbrains/kotlin#kotlin-script-runtime/2.3.20": {
+   "jar": "sha256-b8232m5lz4zEPlqrq5S9zEiCXnkzaG+KG/aU64j44A4=",
+   "pom": "sha256-ZgmWdnA6CB/ZrEMTlmWIPlwUUCC2QHWd4FOdiRb/JH8="
   },
   "org/jetbrains/kotlin#kotlin-script-runtime/2.3.21": {
    "jar": "sha256-7GG/EinIN/qfQlXzTKaYFhOLcxWOeum42WTPkspt/S4=",
    "pom": "sha256-LPXREj2KYovMXudPWwewjFWoetTpyR4T24O7Wi/2qi0="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-common/2.3.0": {
-   "jar": "sha256-QlK3gs2lP8v9lTuQrwMlDiGX/+9uVavZsKLkj5Pv8lM=",
-   "pom": "sha256-9AuKrV3x68riUJLMM7hpP6Qw5TRCC6Wup/AGsvMrQw4="
+  "org/jetbrains/kotlin#kotlin-scripting-common/2.3.20": {
+   "jar": "sha256-tMI52HsjvhgvBb9Xz16B+V1wv370qYnrmLczicbryJ8=",
+   "pom": "sha256-h+/vFa4RjxNDUmPrEJcAZGD7qDlph340uKcvDjPIOsk="
   },
   "org/jetbrains/kotlin#kotlin-scripting-common/2.3.21": {
    "jar": "sha256-aYhXUb3OfU4dG5dYuvS8D+A7JIJ6vXt2h+WnwLTQKe0=",
    "pom": "sha256-vs1qSEFg/hN/BtdtNflbZ3b6Ca5vdR5TlOaTWa7i9fY="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-compiler-embeddable/2.3.0": {
-   "jar": "sha256-ZxRdvqkxlNuyJT4vNaCp/ngBfCy84+zbSx/0P/9HGNU=",
-   "pom": "sha256-FjR61xI8BuiaUu+twxjZaick9UqBx+xZTA1ALh8eZFk="
+  "org/jetbrains/kotlin#kotlin-scripting-compiler-embeddable/2.3.20": {
+   "jar": "sha256-vVX49hvUHOxSllbC1HeEvLpawmDpT0FWwnLDFJZu71k=",
+   "pom": "sha256-1l8YaBd9zkuKkv+93bVrFzH5+66IyOcw7XvLcAy7soo="
   },
   "org/jetbrains/kotlin#kotlin-scripting-compiler-embeddable/2.3.21": {
    "jar": "sha256-oE/wbvtKWuB6ko2pT5tdBhIwyW1/69rri8dDjhqjGBE=",
    "pom": "sha256-8aTyFh2fPULJrE7Lm5zuKhmQNoE1CdW1pP85oRy7n+M="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-compiler-impl-embeddable/2.3.0": {
-   "jar": "sha256-MsdCfxBeYtT07/MDXaHkKAsndxvkrWFDuoZV0Yh3IM0=",
-   "pom": "sha256-TPG5v5rmnHbz6nWnhW3GbeRGeKfHQXFa6cFdtA7Nfv0="
+  "org/jetbrains/kotlin#kotlin-scripting-compiler-impl-embeddable/2.3.20": {
+   "jar": "sha256-gG/WOzvOxea17rGghD1qsJTVV4aoRl5HSiQ5KVocCiU=",
+   "pom": "sha256-xKkTo4XzTjKlbyBd8XoI3U4RfDBsV+XkfcXUlSPw6+E="
   },
   "org/jetbrains/kotlin#kotlin-scripting-compiler-impl-embeddable/2.3.21": {
    "jar": "sha256-ieeKMybhIFqUIKGUQaTzgvenIkHVLJZCXonlsTA4coY=",
    "pom": "sha256-L3wkrV6C4ttdtdqNwHDub8D1bCDpkGOaVMppB2vOPm0="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-jvm/2.3.0": {
-   "jar": "sha256-NpM+uDYZqKZeBB36m2ktNOB9V8b9Yv43HIu/BYgL7Ec=",
-   "pom": "sha256-qemsNTtIBUA7A3spmZpUnxvESATniVnYT/sbwzBF8kc="
+  "org/jetbrains/kotlin#kotlin-scripting-jvm/2.3.20": {
+   "jar": "sha256-cEfOA1P0kSXDx0Z5LU92wyZde3L+YmlLfuwHW7oCUow=",
+   "pom": "sha256-B8Ba4tHs4K4e1mAQ7TGNnN3LNYcEbGM8GGvRTM8EYdU="
   },
   "org/jetbrains/kotlin#kotlin-scripting-jvm/2.3.21": {
    "jar": "sha256-jLY3Ey/H+lEccA7n8rY7KCYwFn9evWmaJjoLZ7XUhqs=",
@@ -831,35 +835,35 @@
    "jar": "sha256-wxQXeTXY3C7ah5UHEX8l1t5W9sV+3plBaxTNYiu54J0=",
    "pom": "sha256-NditbBnaV6t00h7YHdxYSZt8GwAlEbXoUgANuwxYq64="
   },
-  "org/jetbrains/kotlin#kotlin-stdlib/2.3.0": {
-   "jar": "sha256-iHWHyRcTJQrVL+FK2RZtBCwzg1BJiQ6UN/NV/8WhlbE=",
-   "module": "sha256-CRCoo7aWD8eSxFxWqR18Oj8mKG8DKVVUtRnP83h1baI=",
-   "pom": "sha256-TVJW0+SETmVrDKQF9jUNbyF5XCQ3WzRSUmxUZ92ZtaI="
+  "org/jetbrains/kotlin#kotlin-stdlib/2.3.20": {
+   "jar": "sha256-CuElBKUEDrrzdwOQhINCDRpWJN0dk/NXZl+Md8hIoB4=",
+   "module": "sha256-9Os0T8TR46KK4WwIbsPkL1I3O0ZtQwgYL7OG45LA76M=",
+   "pom": "sha256-yDwC2afi6VRzBJHDPC8dwDwnZi4ntWbsK0TS0Bhjm5g="
   },
   "org/jetbrains/kotlin#kotlin-stdlib/2.3.21": {
    "jar": "sha256-b2TqxzbblDTdaSW0pRi50dFxd2UjIMN5Fs+bo859fXo=",
    "module": "sha256-e06ksiQrsXektKu2PD89hXMx1A01hl42/MPbZm7BAXQ=",
    "pom": "sha256-PgtI2qFNxz+AKdjZ4V7TKUA3fK97kVUQ+I0zIZs1AYY="
   },
-  "org/jetbrains/kotlin#kotlin-tooling-core/2.3.0": {
+  "org/jetbrains/kotlin#kotlin-tooling-core/2.3.20": {
    "jar": "sha256-NnFCeBKZvA+RIMHe7A5ik0oa+ep/AaqpxaU1TcXY19k=",
-   "pom": "sha256-tQ6FtLEYwSIjge0c67K6lqfeLdrtti3aZ9SuBqGiXTc="
+   "pom": "sha256-R+Ou/SS1vmLYB7bLzXnFW4P5S1XP4Y79xuM84RvxkOQ="
   },
   "org/jetbrains/kotlin#kotlin-tooling-core/2.3.21": {
    "jar": "sha256-NnFCeBKZvA+RIMHe7A5ik0oa+ep/AaqpxaU1TcXY19k=",
    "pom": "sha256-bUmGsDzsaBW3sTLst2rWwLcczaeQSzoRTPOXAOnKyOQ="
   },
-  "org/jetbrains/kotlin#kotlin-util-io/2.3.0": {
-   "jar": "sha256-HJEgPyfnO5aI3f4aiAIyjTXrcPpV9eE96ttyHnj5KqQ=",
-   "pom": "sha256-hvmuNH2YfMwY2aEJ7tLlVDvjj/SMgdUtKMf6HyBarK8="
+  "org/jetbrains/kotlin#kotlin-util-io/2.3.20": {
+   "jar": "sha256-DnbnRx6RxT6mjS0k7x8p+1kqxfuw0dEPqpFkMO/z2so=",
+   "pom": "sha256-lcKKgo/B8eWeZWOCR6ZPdm2B2LWfbY3r7y0YoMwyH4k="
   },
-  "org/jetbrains/kotlin#kotlin-util-klib-metadata/2.3.0": {
-   "jar": "sha256-JZjCbDTMXGnrAEc0Y+lQrmfpuAln9DoBg8Vn7eZqlxc=",
-   "pom": "sha256-4EB9YmkdWjQWFh/YNztNt0o714bxtILghGGXUQL58+s="
+  "org/jetbrains/kotlin#kotlin-util-klib-metadata/2.3.20": {
+   "jar": "sha256-qJlOC8poRt+xn0WMTMFdexN3nKGw2fNIgLX/LCorc7M=",
+   "pom": "sha256-jxApEHGu+rvY5m/5r3dDojiB1pxqryjhNhbMDpW9F7c="
   },
-  "org/jetbrains/kotlin#kotlin-util-klib/2.3.0": {
-   "jar": "sha256-ZLugCZZqAoGG2e5waw3ID+phwK5usXJe0dfXDvIrUuE=",
-   "pom": "sha256-lzWjPLZJg7qg0S3AyOGTSw5VLmvMh2chrFWKmCKFC/4="
+  "org/jetbrains/kotlin#kotlin-util-klib/2.3.20": {
+   "jar": "sha256-lWK407egS+uisUwFZx5xOFnqVLvAohB+ZbK88nP6hEg=",
+   "pom": "sha256-WlhMPMK6O0HR5c1+eiCDV2wbjDl6ebuBY2dtjvew6hc="
   },
   "org/jetbrains/kotlinx#kotlinx-coroutines-bom/1.8.0": {
    "pom": "sha256-Ejnp2+E5fNWXE0KVayURvDrOe2QYQuQ3KgiNz6i5rVU="
diff --git a/pkgs/by-name/pk/pkl/deps.json b/pkgs/by-name/pk/pkl/deps.json
index ea820e287df2..dc3654553fc8 100644
--- a/pkgs/by-name/pk/pkl/deps.json
+++ b/pkgs/by-name/pk/pkl/deps.json
@@ -29,8 +29,8 @@
   "www.jetbrains.com/intellij-repository/releases/com/jetbrains/intellij/java/java-compiler-ant-tasks/maven-metadata": {
    "xml": {
     "groupId": "com.jetbrains.intellij.java",
-    "lastUpdated": "20260326112719",
-    "release": "261.22158.291"
+    "lastUpdated": "20260622132625",
+    "release": "261.25134.203"
    }
   },
   "www.jetbrains.com/intellij-repository/releases/com/jetbrains/intellij/platform#util-jdom/252.26830.84": {
@@ -40,8 +40,8 @@
   "www.jetbrains.com/intellij-repository/snapshots/com/jetbrains/intellij/java/java-compiler-ant-tasks/maven-metadata": {
    "xml": {
     "groupId": "com.jetbrains.intellij.java",
-    "lastUpdated": "20260326193152",
-    "release": "261.22158.302"
+    "lastUpdated": "20260624081617",
+    "release": "262.8377.24"
    }
   }
  },
@@ -51,14 +51,14 @@
   }
  },
  "https://plugins.gradle.org/m2": {
-  "com/gradleup/shadow#com.gradleup.shadow.gradle.plugin/9.4.1": {
-   "pom": "sha256-AdDekM9QXN9PKgCkLFJCe9JtIN+VrPCMnrvRnWyug0c="
+  "com/gradleup/shadow#com.gradleup.shadow.gradle.plugin/9.4.2": {
+   "pom": "sha256-qu9dz6fW7rPI6/NKwngGsguf9Wze3uAQ8yVRr16JUc4="
   },
   "com/gradleup/shadow/com.gradleup.shadow.gradle.plugin/maven-metadata": {
    "xml": {
     "groupId": "com.gradleup.shadow",
-    "lastUpdated": "20260327090833",
-    "release": "9.4.1"
+    "lastUpdated": "20260528040325",
+    "release": "9.4.2"
    }
   },
   "gradle/plugin/org/gradle/crypto#checksum/1.4.0": {
@@ -88,13 +88,13 @@
   "org/gradle/crypto/checksum#org.gradle.crypto.checksum.gradle.plugin/1.4.0": {
    "pom": "sha256-HzWQYt4QGbCRu7QhGghr4U0xCMX2mXisy9AbZRUFN0w="
   },
-  "org/gradle/kotlin#gradle-kotlin-dsl-plugins/6.5.2": {
-   "jar": "sha256-O/9KBwDhyBXRlEifB7ugbLGQ6PKbdz03z+43rI1cdkQ=",
-   "module": "sha256-MVnFQXhFqWmTx4nULexDVwf7uEiXnP0R0LgzBZ5RIKM=",
-   "pom": "sha256-ctVO1m6jP6+UKCNRwxAZ4S59fpIOpnpRbL4ODWdBA0M="
+  "org/gradle/kotlin#gradle-kotlin-dsl-plugins/6.5.7": {
+   "jar": "sha256-zIyqQQGjXQzwQzpj6K04kRpMhIBz/MlPQ64CUfM+Ta8=",
+   "module": "sha256-ENa9ZquwiOylvjYP9yVQyWFU0mdu/t10rzHEUAF8OQk=",
+   "pom": "sha256-q+nzlg+nNZciqHUuYb/ElnYeFdFHNeTGQiB5cHYGq74="
   },
-  "org/gradle/kotlin/kotlin-dsl#org.gradle.kotlin.kotlin-dsl.gradle.plugin/6.5.2": {
-   "pom": "sha256-5aavF7WFYNdGyrQseV/jpCoevkBQ5VpPANjPVM8x8eo="
+  "org/gradle/kotlin/kotlin-dsl#org.gradle.kotlin.kotlin-dsl.gradle.plugin/6.5.7": {
+   "pom": "sha256-Ldg2zAlxLNrd/u/GgNLqZutD2NxjOGvVlSZYE0l/Ry0="
   },
   "org/gradle/toolchains#foojay-resolver/1.0.0": {
    "jar": "sha256-eLhqR9/fdpfJvRXaeJg/2A2nJH1uAvwQa98H4DiLYKg=",
@@ -508,19 +508,19 @@
    "jar": "sha256-1lImlJcTxMYaeE9BxRFn57Axb5N2Q5jrup5DNrPZVMI=",
    "pom": "sha256-5O1sZpYgNm+ZOSBln+CsfLyD11PbwNwOseUplzr5byM="
   },
-  "com/gradleup/shadow#com.gradleup.shadow.gradle.plugin/9.4.1": {
-   "pom": "sha256-j9YiZjf8Ytv08kmgCbN2krAj+urqiMPSNLgzB16YhhU="
+  "com/gradleup/shadow#com.gradleup.shadow.gradle.plugin/9.4.2": {
+   "pom": "sha256-xeVASrUAnkLi6EiGHO1La2vPMFR2QoHiDaNzyfry9S8="
   },
-  "com/gradleup/shadow#shadow-gradle-plugin/9.4.1": {
+  "com/gradleup/shadow#shadow-gradle-plugin/9.4.2": {
    "jar": "sha256-QiPAjWXkx+HxILSpbnMZ34/j36ZV3fJmH2C7VtrPkaw=",
-   "module": "sha256-HqvAJjuZ/SRTCqADRTyLH7AoZt4QzYni8VLwAsOrBXg=",
-   "pom": "sha256-W15e5HPddlrSOzAbdIhbRzsrI32zHkFu6/VXSpU6JNQ="
+   "module": "sha256-QLLd0qhM9ov7ur/ED8XLlNQvDTzrglMb8/eQ/xdeu9A=",
+   "pom": "sha256-TPRHwc6WyuND5uDnRPnOnD5jz+e9GQ9j/qbSdPFeKrU="
   },
   "com/gradleup/shadow/com.gradleup.shadow.gradle.plugin/maven-metadata": {
    "xml": {
     "groupId": "com.gradleup.shadow",
-    "lastUpdated": "20260327091316",
-    "release": "9.4.1"
+    "lastUpdated": "20260528061127",
+    "release": "9.4.2"
    }
   },
   "com/ibm/icu#icu4j/58.2": {
@@ -1085,22 +1085,30 @@
    "jar": "sha256-6K0gn4xY0pGjfKl1Dp6frGBZaVbJg+Sd2Cgjgd2LMkk=",
    "pom": "sha256-oKdcdtkcQh7qVtD2Bi+49j7ff6x+xyT9QgzNytcYHUM="
   },
+  "org/bouncycastle#bcprov-jdk18on/1.80.2": {
+   "jar": "sha256-szIn8H3OJk2vGqwueY7xCaSQHzGr7axTY1dG3ZNnnTs=",
+   "pom": "sha256-EqUFpxejvHZH99jt6ndzLJxty1PE32Kju1i3pUIooo8="
+  },
   "org/bouncycastle#bcutil-jdk18on/1.80": {
    "jar": "sha256-Iuymh/eVVBH0Vq8z5uqOaPxzzYDLizKqX3qLGCfXxng=",
    "pom": "sha256-Qhp95L/rnFs4sfxHxCagh9kIeJVdQQf1t6gusde3R7Y="
   },
+  "org/bouncycastle#bcutil-jdk18on/1.80.2": {
+   "jar": "sha256-vHjTLX/7FB7ifk+3ffBCWdhCyJnn6Or5EvmQ1yU707Q=",
+   "pom": "sha256-Joi+GvSZ1SUJYRTML1HHp6TKI8PScxe3HhjByWvsA9E="
+  },
   "org/bouncycastle/bcprov-jdk18on/maven-metadata": {
    "xml": {
     "groupId": "org.bouncycastle",
-    "lastUpdated": "20251126065922",
-    "release": "1.83"
+    "lastUpdated": "20260515080931",
+    "release": "1.84"
    }
   },
   "org/bouncycastle/bcutil-jdk18on/maven-metadata": {
    "xml": {
     "groupId": "org.bouncycastle",
-    "lastUpdated": "20251126070121",
-    "release": "1.83"
+    "lastUpdated": "20260515080933",
+    "release": "1.84"
    }
   },
   "org/checkerframework#checker-qual/2.10.0": {
@@ -1521,27 +1529,27 @@
    "module": "sha256-/x91VjoeC+Dv6f7u4jMAVeRGM0jqsCZvExFWOO+jafo=",
    "pom": "sha256-jcV+h39+P1+wNTin/0mxKX5seEA+4PdABuvKxyuCcl4="
   },
-  "org/jetbrains/intellij/plugins#verifier-cli/1.401": {
-   "module": "sha256-ZFlTICKFTbeSeU2lq5i7jbWnKupPs0+78HX8tMfPuSs=",
-   "pom": "sha256-Ksomg3AaxuGa+6ysOAJ8YuuTm5qACiZbqstpTFkTr/4="
+  "org/jetbrains/intellij/plugins#verifier-cli/1.407": {
+   "module": "sha256-7Z+g0+dMdxPxIKS8CsyjRWaCY48QKudZ4t7Ikg86Zhc=",
+   "pom": "sha256-aQSksjwZp7Mzc1c5lx716iyiJCQNd2EEt9a18ArjKmc="
   },
-  "org/jetbrains/intellij/plugins#verifier-cli/1.401/all": {
-   "jar": "sha256-+K/EN1A+lvVJT35HccO3h+Z4fw9HoD3X6Pm/ydYbWY8="
+  "org/jetbrains/intellij/plugins#verifier-cli/1.407/all": {
+   "jar": "sha256-EzKW9tmpxIB9zd7kLyaiKpSfDn/LShwt/NMH87gcS5o="
   },
   "org/jetbrains/intellij/plugins/verifier-cli/maven-metadata": {
    "xml": {
     "groupId": "org.jetbrains.intellij.plugins",
-    "lastUpdated": "20260312225124",
-    "release": "1.401"
+    "lastUpdated": "20260619080353",
+    "release": "1.407"
    }
   },
   "org/jetbrains/kotlin#abi-tools-api/2.2.20": {
    "jar": "sha256-8chm6sXcCI8/0IEQCENAm/TxYSu7mY+6ofaFMlyuDVU=",
    "pom": "sha256-HOL7NczYP8vJCuXFmN/bsilS0IVHgElEpbIfLEbKwL0="
   },
-  "org/jetbrains/kotlin#abi-tools-api/2.3.0": {
-   "jar": "sha256-QBe8wfXTKFsX5rYiDRakaMhxWTDw35Y5bXZLV/Cm02U=",
-   "pom": "sha256-qJIhRAlxhudUjXFH3I3O1eYOMGnUY1ulUe8uV3WrmAk="
+  "org/jetbrains/kotlin#abi-tools-api/2.3.20": {
+   "jar": "sha256-U2hfV4OwSQaDiY11Wrrk1Bi26DugYTSFiv3ctZRYmek=",
+   "pom": "sha256-qIbJ/X8rlmlFf+wCHxnc8V8EY+DbS9rVOuGBJTZsxvk="
   },
   "org/jetbrains/kotlin#abi-tools/2.2.20": {
    "jar": "sha256-paY3q4IXBJkc9wYWtk4CuaT4IMggGfk8DSbwzfsiZjM=",
@@ -1554,91 +1562,95 @@
   "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.2.20/gradle813": {
    "jar": "sha256-OmlZW2x1+/ktMgFodFxpj/cRS4YHhBBQ1ISYgjAG6HE="
   },
-  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.3.0": {
-   "module": "sha256-d8IDSG/XkrWAVyBp5cRC0YDA7wVbpzRQXaKNGX7BL/c=",
-   "pom": "sha256-k8/rFUWRw3AengQ1C9AF0ZVqmuZHFH1vsqfFeD4fkJo="
+  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.3.20": {
+   "module": "sha256-bNjWSw5lN3kE8wb2qFja/ZMcQTUkD4RMk9UpTumP6Dk=",
+   "pom": "sha256-SgpFTor25QOv5ngwoYVjubaA3u67GhcGoNe0S8UHQKE="
   },
-  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.3.0/gradle813": {
-   "jar": "sha256-D+cv3G5RvisnSw5kuEQB9SUDavsgYWKkRYIU8R6614c="
+  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.3.20/gradle813": {
+   "jar": "sha256-pPEKPw6l3dH1VaT3BuCep/VSs8hSK7EAY2HdMG4152o="
   },
-  "org/jetbrains/kotlin#kotlin-assignment-compiler-plugin-embeddable/2.3.0": {
-   "jar": "sha256-1D+qszfzaY6NrOZSXSzXwq66ewNZOEhYZBZP5wLnM70=",
-   "pom": "sha256-UttpIUdRA18/LYUvJDCC5x566wenFs2eCHskuYJ6Uio="
+  "org/jetbrains/kotlin#kotlin-assignment-compiler-plugin-embeddable/2.3.20": {
+   "jar": "sha256-EjVTkgnMVtLi7G+XeYaHiHK3Cgh4H2Sv/0Ubwfe9VrE=",
+   "pom": "sha256-m9zHQ84iL4oxnuYJe2Cq7unmvqe1vzKXYVp1tLpsFDM="
   },
-  "org/jetbrains/kotlin#kotlin-assignment/2.3.0": {
-   "module": "sha256-ljRPGdjxnqpbxEHjP2UB9+c9o8el1X1EvHwW6qRXVls=",
-   "pom": "sha256-GqwiGC0snJVP/8FrV2Xq0jjiAw9HhIctRrxfOcozll0="
+  "org/jetbrains/kotlin#kotlin-assignment/2.3.20": {
+   "module": "sha256-GCp0ZM5mvM/ejjG+aPoO7DE8HZDD2POWeclyJyliFjg=",
+   "pom": "sha256-f3R8uTA9Hfqh1hJfZsFUG+o4PsuZh2ta28riSAVZZ48="
   },
-  "org/jetbrains/kotlin#kotlin-assignment/2.3.0/gradle813": {
-   "jar": "sha256-PKIayHkWchdbgnPemV8CTzWZLfAwCijCdUnPd3DMnOY="
+  "org/jetbrains/kotlin#kotlin-assignment/2.3.20/gradle813": {
+   "jar": "sha256-tYin5gfij7WAIo4SDdX/+L6nO9J3JnM6F35kRYLooB0="
   },
   "org/jetbrains/kotlin#kotlin-build-statistics/2.2.20": {
    "jar": "sha256-+2VKT1vFY2h1kXMSnfSRB60J3FtBcrAXda+z+nJXndU=",
    "pom": "sha256-tdU2T1fSH/FBgiBei2lf1oZNnYqleApu3EIJWEBHwRU="
   },
-  "org/jetbrains/kotlin#kotlin-build-statistics/2.3.0": {
-   "jar": "sha256-Z3hVlwDnLXZOniTZWPFuwMx152t1s4FMK83hRKYnT04=",
-   "pom": "sha256-QTkKXrIxFJOxpFubOXLDoL8dqEfoRaNKtoQKr0EmTeI="
+  "org/jetbrains/kotlin#kotlin-build-statistics/2.3.20": {
+   "jar": "sha256-ptJ7PINhdlLdBlYG+Yz1nPviY/jCDr5OvVpvJonrDU8=",
+   "pom": "sha256-nQqNf/FyPV1y00ldVVc9jTxrd3TWHYBXlxT3nCQmX48="
   },
   "org/jetbrains/kotlin#kotlin-build-tools-api/2.2.20": {
    "jar": "sha256-/ZlHs6F2Iahvq9lTr4fzS9K7f4sm2uksHte+dHL0TDs=",
    "pom": "sha256-AtR9SHfsMktJbZMTMkXNTTSLZSMDzyfvpj44ry+zzyo="
   },
-  "org/jetbrains/kotlin#kotlin-build-tools-api/2.3.0": {
-   "jar": "sha256-xsCc8oU0VySfcHyGOCESQJ1aVfULa4Vouk9TDdAD/tw=",
-   "pom": "sha256-FzTIvg4nFXJ3AkW01gbOW7iBbosNHA9+euEcEMLKF1s="
+  "org/jetbrains/kotlin#kotlin-build-tools-api/2.3.20": {
+   "jar": "sha256-IvGrIjhUuUkJn2slnO9UHVtYo2Q9+aScRXfGPEFuhDs=",
+   "pom": "sha256-G14LLDaQXcL1XgpLeBKuY+MSXe/PaG0sD0kPg7c9nV4="
   },
-  "org/jetbrains/kotlin#kotlin-build-tools-compat/2.3.0": {
-   "jar": "sha256-AJST4crwTIKF8f7RV7uraINV2wTS3q7E9aD5tjX4ZuU=",
-   "pom": "sha256-ayMWTiKBY/1j+Bf7LF3ifW6cNAO3Y8y6BoBYTyF/jjI="
+  "org/jetbrains/kotlin#kotlin-build-tools-compat/2.3.20": {
+   "jar": "sha256-RMMHtO3UysUflgqBNBEtZkyTB2cAzaXoZulNmkKWNA4=",
+   "pom": "sha256-rpC+JesEdhCNlo6+Mqjd9SXhQIhYj6BUc9sSgVoPG3Q="
+  },
+  "org/jetbrains/kotlin#kotlin-build-tools-cri-impl/2.3.20": {
+   "jar": "sha256-VOztYw8oEkzP4uRk5srMKB5SiopQqJclchVUyWk1SP4=",
+   "pom": "sha256-5zeMZYHvXw4stA46TOxR0rlj5iVkWpK2fqCVJa+XxMM="
   },
   "org/jetbrains/kotlin#kotlin-build-tools-impl/2.2.20": {
    "jar": "sha256-ZHiafwBWWSfy8/LRCfIwV009kwjtXW6Gv8qEPaZIfPc=",
    "pom": "sha256-4vQ157rwHeL/kNCoc3r4+b+X/BUuWVuGp2C6ZOjmnfY="
   },
-  "org/jetbrains/kotlin#kotlin-build-tools-impl/2.3.0": {
-   "jar": "sha256-k6Xo/7EACAHIMqhisjvZdm9ETm9sGFwysftXh3+1zqM=",
-   "pom": "sha256-AKelPNgr5ws234oCI6Wrhhoqb/txnZt3M3XId8idugQ="
+  "org/jetbrains/kotlin#kotlin-build-tools-impl/2.3.20": {
+   "jar": "sha256-loG8IWSovZ9t30wIXPSoNrktJ1BmZ9c7q59thVM2yRA=",
+   "pom": "sha256-gswavl5j0/5nV+eXKE8F25r9fq3D6D0ROcOlW2TUstU="
   },
   "org/jetbrains/kotlin#kotlin-compiler-embeddable/2.2.20": {
    "jar": "sha256-HGw/gQv+akGry8NLOi72OfHj9K7tOpU6Swl07qT0GIk=",
    "pom": "sha256-Bf8CX3+wky+xH6HhzK71KPdgJ9lWaA+INdQ4VCdi4go="
   },
-  "org/jetbrains/kotlin#kotlin-compiler-embeddable/2.3.0": {
-   "jar": "sha256-jb2IL6WMPRfmg6JzkCiDFfi0kPjj47G+TcPigNN+KFo=",
-   "pom": "sha256-zOmxEfIRZgxcRTk+dI30aVC2HAEUfgdzttxxnui7d6g="
+  "org/jetbrains/kotlin#kotlin-compiler-embeddable/2.3.20": {
+   "jar": "sha256-l2+YnQtfXYDo6KitS3PaC/wn/dllufo4Nisr557MEzc=",
+   "pom": "sha256-DDWu7jcvB1FOvtN7lAe44RgdFCd1UTnlzudxnKBf5+g="
   },
   "org/jetbrains/kotlin#kotlin-compiler-runner/2.2.20": {
    "jar": "sha256-+vloNPogBNeL2ORCD1go3j1CckJ9ZHR5gCTqbpz4XN0=",
    "pom": "sha256-kbsVJI9OqUS2Mw8xA/HrVF0TvditSuxDe3R6WG57F6k="
   },
-  "org/jetbrains/kotlin#kotlin-compiler-runner/2.3.0": {
-   "jar": "sha256-hwl38pYFQ2xesiV7nI5dZPMoLyqI7e5FRNNOxF8Wpqc=",
-   "pom": "sha256-ov8zZnin9TpEOSv8bFK2gS7dxz5AghyQfyomQWeeDrs="
+  "org/jetbrains/kotlin#kotlin-compiler-runner/2.3.20": {
+   "jar": "sha256-wGnzCkA75wyBUviqnyXsy6GI7q1UJjrgKvFEIUN6Igg=",
+   "pom": "sha256-jYTqDt1gs4vOpWLeUXgVKiZxqaAFPWcPkxRSs9sBMig="
   },
   "org/jetbrains/kotlin#kotlin-daemon-client/2.2.20": {
    "jar": "sha256-cO983NwwEHe5s7ohqp6cVadq+z/73+9KtWKmd9GN+kw=",
    "pom": "sha256-ihNtDxPrmDpr40/x4WPJznmFXkuiF09Fy0KqpnVT91Q="
   },
-  "org/jetbrains/kotlin#kotlin-daemon-client/2.3.0": {
-   "jar": "sha256-sr5naIyvEaE41a4M4SNTga2asN25OVqwb42EagtGYBc=",
-   "pom": "sha256-teLnTuXC+I/Qi/g+7GRx9rvKeqEhWYgCtsMsVuhwYCY="
+  "org/jetbrains/kotlin#kotlin-daemon-client/2.3.20": {
+   "jar": "sha256-xxp8G+j7/wTgr0XJ7oy3ph2JU7ymuL8iWlcZxyWpC0Q=",
+   "pom": "sha256-nnyLgHJBF/cqrOZfa+SNg224/Dl1OtlR8ruQhi1+cIA="
   },
   "org/jetbrains/kotlin#kotlin-daemon-embeddable/2.2.20": {
    "jar": "sha256-fFyM0vi+rdMoMjm7nKIZoMr6GvAmgrQHsYHhF5cY8vc=",
    "pom": "sha256-9Yhmv7yYZ8bWR1ec/3DUKHeZctvd2N5MJXh5y0N0FIk="
   },
-  "org/jetbrains/kotlin#kotlin-daemon-embeddable/2.3.0": {
-   "jar": "sha256-ObywLYwpOqZ4VUyLSdf/hGVwIXCSg8YYbjpAgGr5vRA=",
-   "pom": "sha256-TI3aucQLMNAbhc/qHxd31zUlybcWQ+YlDGV2/H0fwRI="
+  "org/jetbrains/kotlin#kotlin-daemon-embeddable/2.3.20": {
+   "jar": "sha256-iHC6uEC4CHyWxN3AYIi0rt9RMcQIrzZ0MGME8flq8/Q=",
+   "pom": "sha256-YVQOWzoywLEZYkSWZZJMbNdVTqmu4IVb2OT1t/YQoKs="
   },
   "org/jetbrains/kotlin#kotlin-gradle-plugin-annotations/2.2.20": {
    "jar": "sha256-T8MqG+ZFynQE4hskRSCI+T6OmT6v/Sbza9Ndv3XGB1I=",
    "pom": "sha256-sbbgEXktfKkv7K+/+sSlCPdvA5yfeuijI9GJKIgl9P4="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-annotations/2.3.0": {
-   "jar": "sha256-/HKYw2tF820WUscDuraT9f6bEVmOzZrH7J/f6IptsPA=",
-   "pom": "sha256-aQhDRFhvUkNNH7tRZmlgr/uHbGQ+gIYkXrgLpeREm7U="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-annotations/2.3.20": {
+   "jar": "sha256-4WYu10cyK2P2HU+t2Zq3gQTEXq8JwRp4mGJBXoHBjcQ=",
+   "pom": "sha256-aP+Cf8E1DZPw1nM2jAZHm2K31eXDBlipWM+TBmgx6Nk="
   },
   "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.2.20": {
    "jar": "sha256-dgfuXHoMpT+lku58VA7oCJYqe62P7p7Xj+Z0hBRj2V0=",
@@ -1648,30 +1660,30 @@
   "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.2.20/gradle813": {
    "jar": "sha256-dgfuXHoMpT+lku58VA7oCJYqe62P7p7Xj+Z0hBRj2V0="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.3.0": {
-   "module": "sha256-BQ8eECIJAOR6MIkd1c/qg3pl27sNmjyxuFKRq6MmykE=",
-   "pom": "sha256-GeTwq/tcvwEdJZP1ZRV8jr9FkvMAhhS6LtsEinhRF10="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.3.20": {
+   "module": "sha256-04UBEP9ajrcP7S1Xi0X7B+vESvaika5M88eUMMZRKLo=",
+   "pom": "sha256-AdVSITSRyFPVb4frdIEwON+e4dhekIaqN70GY7JJb4g="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.3.0/gradle813": {
-   "jar": "sha256-yh6tFJqMj0G6YKg5qDsjw6BiJ8RsYhJMUb6ZkDXerDE="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.3.20/gradle813": {
+   "jar": "sha256-ybwX32m/OZB8WXweGb7EtHnHWqx1+/1jIeNEW0lxLog="
   },
   "org/jetbrains/kotlin#kotlin-gradle-plugin-idea-proto/2.2.20": {
    "jar": "sha256-dtFu5ZzeHmpwVWtdQEhu+fEcFkOodJPBnE3zMWU4N9k=",
    "pom": "sha256-xRuhScfyk1nSWk7RIS4otpNOGkdW9VLAAHvxFE0onB0="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea-proto/2.3.0": {
-   "jar": "sha256-epBQPJ14f5vNLBd25MxSfrneeRLvecbJWPEwWi0cQ7o=",
-   "pom": "sha256-2bCOHuM4pjRhSanQIY+FHuPUfYu3fWEDJg8qhyauUl4="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea-proto/2.3.20": {
+   "jar": "sha256-5Cicv5/0lAfwQd3GM24bV3pspM8r4dKjEzgnHBPu0+0=",
+   "pom": "sha256-9veHObqf4nEunwyeW8T16TcZzP6pW0fC9JslC+F2NX4="
   },
   "org/jetbrains/kotlin#kotlin-gradle-plugin-idea/2.2.20": {
    "jar": "sha256-7JacXwsJn4I4RiMiOPm9ZPPTdB5i6pBQrS5DL6150KA=",
    "module": "sha256-/IW7KUlsw/X5DHjHonejkw7xFg8IQ/iu1ke3TGejtJQ=",
    "pom": "sha256-NkQjJURfF7rCH1OGu0k4+D53K4NOWGBT1BRbGnXZ4oU="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea/2.3.0": {
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea/2.3.20": {
    "jar": "sha256-lS5zlI4qINOYwmuHprtwzPZkGPuvFSfDUVsYjqnUvWA=",
-   "module": "sha256-kRUvrqO8DJTbZtPLWKrh2+rXyGC1dk5nsgC01N9M6rk=",
-   "pom": "sha256-BLSVrgZj7a3aSEBkZKzTlDGjysez6OjAlLdplu1BSaA="
+   "module": "sha256-b7XZcwCl5Vmv1Nn/msA1bE2Wb31pS2Yvrhaf2HQhUx4=",
+   "pom": "sha256-WROHIVGNgqND99wvCRK3BJjT7vM2PJ66wiCssPyTjsw="
   },
   "org/jetbrains/kotlin#kotlin-gradle-plugin-model/2.2.20": {
    "jar": "sha256-U6MhUoJjIGAYUgSaC291OMqLtX/QnYeszRGLxo1D+OQ=",
@@ -1685,28 +1697,28 @@
   "org/jetbrains/kotlin#kotlin-gradle-plugin/2.2.20/gradle813": {
    "jar": "sha256-XTJbXCxdS8i/RBRdJOtNS+sGDRPRHr5IiYk27VzRVk4="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.3.0": {
-   "module": "sha256-vbMts6ongF80eewDPsY9PMq+sTuInYbavadCu+9TwJo=",
-   "pom": "sha256-h4cnvyGoOtrYnU5giEhN2/OfaoSpQoAiGm4cL4hBMD4="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.3.20": {
+   "module": "sha256-lVUmc7gbNXitmy86/xRUtjzoBsb9SrfGBJIx6GQKtHE=",
+   "pom": "sha256-EcMjwt2KgE6fWOBHwsAYZLKgHcDYEys2PApDEiFbwJs="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.3.0/gradle813": {
-   "jar": "sha256-Os+X1zolgbAyhz+on1Z1DTazt21A1pLZg58kZ92uTWk="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.3.20/gradle813": {
+   "jar": "sha256-RuFu4mWU9ID+y5LJbarjdTDoNQJreON+8yUelX8D9vs="
   },
   "org/jetbrains/kotlin#kotlin-gradle-plugins-bom/2.2.20": {
    "module": "sha256-P7tFda43xKd2rrhtj/k8aqEbDPLadXScUyDiWFCwIp4=",
    "pom": "sha256-PG1GnpFfuzCWrEy4wvRsedAnw8WQ5lihBoihVx61eNg="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugins-bom/2.3.0": {
-   "module": "sha256-/9anNzSypS+3Yz8WOVRL43HgYpxR2X+h5fteqTQ6Fwk=",
-   "pom": "sha256-cYYJKmnzaIQyxcCsuQtKZx/Y7oANhP5YT66P1TO6v4o="
+  "org/jetbrains/kotlin#kotlin-gradle-plugins-bom/2.3.20": {
+   "module": "sha256-+CvXZF0MPv609PZVIKPGWz6MMCsIMyIDegABuHsC6ZA=",
+   "pom": "sha256-3WuRkZfhMv5x3axw9vxdj65/Und6/YN7FN6HG4wKVAA="
   },
   "org/jetbrains/kotlin#kotlin-klib-commonizer-api/2.2.20": {
    "jar": "sha256-OYK+RbEpMOIYGbWJ2zcHyOhM4le/Ks5/xi/I3zaPWz4=",
    "pom": "sha256-CzAJtJQmv6F3qtlLSBCbjKVMck6i5sUGgmo6lc9ZEOE="
   },
-  "org/jetbrains/kotlin#kotlin-klib-commonizer-api/2.3.0": {
-   "jar": "sha256-m6V9kaveq5rNWIoUtfQiCbmWRMU0Ft/56X7LS/l/Ukg=",
-   "pom": "sha256-zTHw7NqCplEi/8alXehxE5S2GEtRRAK34RkZGqgJGoI="
+  "org/jetbrains/kotlin#kotlin-klib-commonizer-api/2.3.20": {
+   "jar": "sha256-vpN3SFQS0A8B54KZyzC+SAJZHCcwNCtuva/AiU91J0M=",
+   "pom": "sha256-IbFbpb1i0h1Ta7egyMtnQ1cfwPQwklSKQjWybyodIgs="
   },
   "org/jetbrains/kotlin#kotlin-klib-commonizer-embeddable/2.2.20": {
    "jar": "sha256-XeE7Sb8dRBCZFep1tjiWZpNpXfQM1bIebhKu62fcKSQ=",
@@ -1724,9 +1736,9 @@
    "jar": "sha256-UBd3SirqQf+HEhNxFs1NgAP+mroSAMEG5lcw/rW7dEI=",
    "pom": "sha256-U+++4FpxIhiQYPXuXspodjnOr+KfXlmW3phiopxnJyU="
   },
-  "org/jetbrains/kotlin#kotlin-native-utils/2.3.0": {
-   "jar": "sha256-7kvygz0Q5fN90haoMSn1nzx8vvXrrBMPcGZIOXCMgLc=",
-   "pom": "sha256-Rp6PYB/b34kP+ozXSOEQcCqkUxu7KbZOXnUD8O/lDZA="
+  "org/jetbrains/kotlin#kotlin-native-utils/2.3.20": {
+   "jar": "sha256-QxnCdkeV773/K3julUVRV9evC5FVaYuqG6Uqar46vy0=",
+   "pom": "sha256-LAp+ADViCIXUN+fxJidEdbpYqiJC+1279D+R8gyvpwg="
   },
   "org/jetbrains/kotlin#kotlin-reflect/1.6.10": {
    "jar": "sha256-MnesECrheq0QpVq+x1/1aWyNEJeQOWQ0tJbnUIeFQgM=",
@@ -1736,52 +1748,52 @@
    "jar": "sha256-ggkIOkp8TkdtmEKweDCPqWqW8Hpr2Z8F81hu4TKJqyY=",
    "pom": "sha256-TidHQGbbg/uixZB0KJunEr6MhRV83guQUCmkRcJ19bo="
   },
-  "org/jetbrains/kotlin#kotlin-reflect/2.3.0": {
-   "jar": "sha256-cU30voGVRf9N4fNqohg+DeqUtMjN98op6ciZGbrzY2I=",
-   "pom": "sha256-89F2jvL7UxBIPb6R4w6fo2x7Pi/e5pRaCLujEBQtKcE="
+  "org/jetbrains/kotlin#kotlin-reflect/2.3.20": {
+   "jar": "sha256-40b6PD/0RR9fcHoxKIf9TIVV2kjMFfqdsrqTwz+J+BM=",
+   "pom": "sha256-iwC9L+srtVON85aVQXTZ3cDsVA00ElhjA1ObHpZVwzM="
   },
-  "org/jetbrains/kotlin#kotlin-sam-with-receiver-compiler-plugin-embeddable/2.3.0": {
-   "jar": "sha256-QOPhi7jFUjLuZSXOV9F7hl5WcosFK/DBDnvsHQhJmMo=",
-   "pom": "sha256-BnzIEOCaYeFufoe1Kk3WR+FfYLd+PaDRsVPz+A7r8wM="
+  "org/jetbrains/kotlin#kotlin-sam-with-receiver-compiler-plugin-embeddable/2.3.20": {
+   "jar": "sha256-hvch6zOswK/QbdZoDnenZLY0qb2LEbc77yv8CQnxiUA=",
+   "pom": "sha256-Vg23nSOjmud5dqVmkZRw3sQazHeqUa6qVlzAKbkXGqw="
   },
-  "org/jetbrains/kotlin#kotlin-sam-with-receiver/2.3.0": {
-   "module": "sha256-DCD2gdNvSnmRYiFYCYkpF5TmVlgvlJwGed+kNKAm9so=",
-   "pom": "sha256-DILmEXpGNhvUzF5iZV8rgC8Q9LfZJWpjaD0DSv0MDUM="
+  "org/jetbrains/kotlin#kotlin-sam-with-receiver/2.3.20": {
+   "module": "sha256-nhEhx/ZQMDvdx/BH/tMCf4FjuzZ1Gy3w+vNjfumFsh8=",
+   "pom": "sha256-Y/Gk4+TT3jrPghTwWgtW/5IM4L9ZYVSnkE8gVuP41RE="
   },
-  "org/jetbrains/kotlin#kotlin-sam-with-receiver/2.3.0/gradle813": {
-   "jar": "sha256-r8iTlKUrUu8Lp6gpakJi0NOoo850CRXYfXE7CgFhMpg="
+  "org/jetbrains/kotlin#kotlin-sam-with-receiver/2.3.20/gradle813": {
+   "jar": "sha256-oHxdPMvaP8dWTkB0RybhNz5UvSXwVGPT9D1DnXeOy90="
   },
   "org/jetbrains/kotlin#kotlin-script-runtime/2.2.20": {
    "jar": "sha256-XIvV3Xrh6i7rJ3j9vqoZpWIYSXX2yrigu2d55BkHMa4=",
    "pom": "sha256-IpOhQenagKfpjYXtKkkuldsMAWW86rC3Klzp4tkrCAc="
   },
-  "org/jetbrains/kotlin#kotlin-script-runtime/2.3.0": {
-   "jar": "sha256-24JpYTcdZgUxjZxOS/zb+slMOgiSzcq9VSJIcP6tV/E=",
-   "pom": "sha256-20CN5tumaQeVvFOkoPhbM8en1qzLZ94ZAmQPr1QfL1s="
+  "org/jetbrains/kotlin#kotlin-script-runtime/2.3.20": {
+   "jar": "sha256-b8232m5lz4zEPlqrq5S9zEiCXnkzaG+KG/aU64j44A4=",
+   "pom": "sha256-ZgmWdnA6CB/ZrEMTlmWIPlwUUCC2QHWd4FOdiRb/JH8="
   },
   "org/jetbrains/kotlin#kotlin-scripting-common/2.2.20": {
    "jar": "sha256-+5n/fwzZUtpo1UjT89ZErlB4sLlvybrwZewUZqKTuAU=",
    "pom": "sha256-iTjGIFKXW7uW3OotqaeNS2sk2vLwnTWMGnqEHxaMtzo="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-common/2.3.0": {
-   "jar": "sha256-QlK3gs2lP8v9lTuQrwMlDiGX/+9uVavZsKLkj5Pv8lM=",
-   "pom": "sha256-9AuKrV3x68riUJLMM7hpP6Qw5TRCC6Wup/AGsvMrQw4="
+  "org/jetbrains/kotlin#kotlin-scripting-common/2.3.20": {
+   "jar": "sha256-tMI52HsjvhgvBb9Xz16B+V1wv370qYnrmLczicbryJ8=",
+   "pom": "sha256-h+/vFa4RjxNDUmPrEJcAZGD7qDlph340uKcvDjPIOsk="
   },
   "org/jetbrains/kotlin#kotlin-scripting-compiler-embeddable/2.2.20": {
    "jar": "sha256-2GJhDAAzQuUIjKIcRAQix9ijcA4ZnWA/ehAnjESIR2E=",
    "pom": "sha256-PW9vFZH6P3r14jFlxowu4BclFYZFQ09eMBdF5kfHVhE="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-compiler-embeddable/2.3.0": {
-   "jar": "sha256-ZxRdvqkxlNuyJT4vNaCp/ngBfCy84+zbSx/0P/9HGNU=",
-   "pom": "sha256-FjR61xI8BuiaUu+twxjZaick9UqBx+xZTA1ALh8eZFk="
+  "org/jetbrains/kotlin#kotlin-scripting-compiler-embeddable/2.3.20": {
+   "jar": "sha256-vVX49hvUHOxSllbC1HeEvLpawmDpT0FWwnLDFJZu71k=",
+   "pom": "sha256-1l8YaBd9zkuKkv+93bVrFzH5+66IyOcw7XvLcAy7soo="
   },
   "org/jetbrains/kotlin#kotlin-scripting-compiler-impl-embeddable/2.2.20": {
    "jar": "sha256-e3kSNZL//r81xhag/xBDMscc3mN6ZX4JrbXfbD+cA84=",
    "pom": "sha256-+l+wJ+4qSbPb/zh3VBtC+3CuzMN7oC4dOthipcZyVLc="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-compiler-impl-embeddable/2.3.0": {
-   "jar": "sha256-MsdCfxBeYtT07/MDXaHkKAsndxvkrWFDuoZV0Yh3IM0=",
-   "pom": "sha256-TPG5v5rmnHbz6nWnhW3GbeRGeKfHQXFa6cFdtA7Nfv0="
+  "org/jetbrains/kotlin#kotlin-scripting-compiler-impl-embeddable/2.3.20": {
+   "jar": "sha256-gG/WOzvOxea17rGghD1qsJTVV4aoRl5HSiQ5KVocCiU=",
+   "pom": "sha256-xKkTo4XzTjKlbyBd8XoI3U4RfDBsV+XkfcXUlSPw6+E="
   },
   "org/jetbrains/kotlin#kotlin-scripting-jsr223/2.2.20": {
    "jar": "sha256-vu1gZeZxK5p/JM72Xyd0TcopoTUmgzYN1xoPTwQZhNk=",
@@ -1795,9 +1807,9 @@
    "jar": "sha256-qR+5BJY0oyum09LpGgy5mD4KpOccDC4bKDg4qOBhYx8=",
    "pom": "sha256-0df8RWSBne6v6OvdcfbyGBf/xVjr0U9HpW6NyTaW3Rk="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-jvm/2.3.0": {
-   "jar": "sha256-NpM+uDYZqKZeBB36m2ktNOB9V8b9Yv43HIu/BYgL7Ec=",
-   "pom": "sha256-qemsNTtIBUA7A3spmZpUnxvESATniVnYT/sbwzBF8kc="
+  "org/jetbrains/kotlin#kotlin-scripting-jvm/2.3.20": {
+   "jar": "sha256-cEfOA1P0kSXDx0Z5LU92wyZde3L+YmlLfuwHW7oCUow=",
+   "pom": "sha256-B8Ba4tHs4K4e1mAQ7TGNnN3LNYcEbGM8GGvRTM8EYdU="
   },
   "org/jetbrains/kotlin#kotlin-serialization-compiler-plugin-embeddable/2.2.20": {
    "jar": "sha256-jY+TYgGErIdsuo09/aF8JdQD+Q0kacqHrNfvox2EeZ8=",
@@ -1814,10 +1826,6 @@
    "module": "sha256-+Tyemr+NUtjo/Y6FGqgC7OxVEyFhxK7ufTzZJL95QkY=",
    "pom": "sha256-10k21oh1ZK63EOhCmLVCB/U+m88jpSrSv6IsIIZ3V2c="
   },
-  "org/jetbrains/kotlin#kotlin-stdlib-common/2.3.0": {
-   "module": "sha256-/pAljbcTNVWBoBZDfQbAKdBpwgu93uE02R5LiHBz108=",
-   "pom": "sha256-J+2DQuBLgcqy0aP512D06/lQmG9n7Eme1y1cw4d+6NA="
-  },
   "org/jetbrains/kotlin#kotlin-stdlib-common/2.3.20": {
    "module": "sha256-fV4z3nFM3ddQeGQgmMvL7pfBg5jQNLd9MrSwdLlQOTk=",
    "pom": "sha256-/Xtj7fb31urrwWoYVgu7koszQlYepcnR92kZiw/puYg="
@@ -1863,11 +1871,6 @@
   "org/jetbrains/kotlin#kotlin-stdlib/2.2.20/all": {
    "jar": "sha256-VVzbTIhKWEwbXVn2lvt2zWYJF/qza4roAyvNYsdQ7+U="
   },
-  "org/jetbrains/kotlin#kotlin-stdlib/2.3.0": {
-   "jar": "sha256-iHWHyRcTJQrVL+FK2RZtBCwzg1BJiQ6UN/NV/8WhlbE=",
-   "module": "sha256-CRCoo7aWD8eSxFxWqR18Oj8mKG8DKVVUtRnP83h1baI=",
-   "pom": "sha256-TVJW0+SETmVrDKQF9jUNbyF5XCQ3WzRSUmxUZ92ZtaI="
-  },
   "org/jetbrains/kotlin#kotlin-stdlib/2.3.20": {
    "jar": "sha256-CuElBKUEDrrzdwOQhINCDRpWJN0dk/NXZl+Md8hIoB4=",
    "module": "sha256-9Os0T8TR46KK4WwIbsPkL1I3O0ZtQwgYL7OG45LA76M=",
@@ -1877,33 +1880,33 @@
    "jar": "sha256-dAFOxPPveM59p+Pmlk8sUmoxIdXFj++MopeeXzRFgvQ=",
    "pom": "sha256-jvep2QYs59w/xlVxXdAoqZRLeElhPgEYR8XWs7mSgXE="
   },
-  "org/jetbrains/kotlin#kotlin-tooling-core/2.3.0": {
+  "org/jetbrains/kotlin#kotlin-tooling-core/2.3.20": {
    "jar": "sha256-NnFCeBKZvA+RIMHe7A5ik0oa+ep/AaqpxaU1TcXY19k=",
-   "pom": "sha256-tQ6FtLEYwSIjge0c67K6lqfeLdrtti3aZ9SuBqGiXTc="
+   "pom": "sha256-R+Ou/SS1vmLYB7bLzXnFW4P5S1XP4Y79xuM84RvxkOQ="
   },
   "org/jetbrains/kotlin#kotlin-util-io/2.2.20": {
    "jar": "sha256-1DGva+puLcmInE/iawc84VfxEchgj+laGL/gi4F8/3Q=",
    "pom": "sha256-xqXQGEjNBAz8j3uuYjLXktcFwpOi2nJmrmJszbNdagM="
   },
-  "org/jetbrains/kotlin#kotlin-util-io/2.3.0": {
-   "jar": "sha256-HJEgPyfnO5aI3f4aiAIyjTXrcPpV9eE96ttyHnj5KqQ=",
-   "pom": "sha256-hvmuNH2YfMwY2aEJ7tLlVDvjj/SMgdUtKMf6HyBarK8="
+  "org/jetbrains/kotlin#kotlin-util-io/2.3.20": {
+   "jar": "sha256-DnbnRx6RxT6mjS0k7x8p+1kqxfuw0dEPqpFkMO/z2so=",
+   "pom": "sha256-lcKKgo/B8eWeZWOCR6ZPdm2B2LWfbY3r7y0YoMwyH4k="
   },
   "org/jetbrains/kotlin#kotlin-util-klib-metadata/2.2.20": {
    "jar": "sha256-vuSQHKU6WiHA22RZAdKwcK/2gkAkF91XiODjWTZFcTs=",
    "pom": "sha256-vtAGUSIGX65328DEb/xBRqaFy7GLijApq9XaO/qhECc="
   },
-  "org/jetbrains/kotlin#kotlin-util-klib-metadata/2.3.0": {
-   "jar": "sha256-JZjCbDTMXGnrAEc0Y+lQrmfpuAln9DoBg8Vn7eZqlxc=",
-   "pom": "sha256-4EB9YmkdWjQWFh/YNztNt0o714bxtILghGGXUQL58+s="
+  "org/jetbrains/kotlin#kotlin-util-klib-metadata/2.3.20": {
+   "jar": "sha256-qJlOC8poRt+xn0WMTMFdexN3nKGw2fNIgLX/LCorc7M=",
+   "pom": "sha256-jxApEHGu+rvY5m/5r3dDojiB1pxqryjhNhbMDpW9F7c="
   },
   "org/jetbrains/kotlin#kotlin-util-klib/2.2.20": {
    "jar": "sha256-7XyAlrK75HetF8MXjeuoyDr1MourNr/iEJEL1bQZI0w=",
    "pom": "sha256-2mwiR3qvQt2hbYWa2unj7Yq8khzLp/9RYTTMi9NZqpI="
   },
-  "org/jetbrains/kotlin#kotlin-util-klib/2.3.0": {
-   "jar": "sha256-ZLugCZZqAoGG2e5waw3ID+phwK5usXJe0dfXDvIrUuE=",
-   "pom": "sha256-lzWjPLZJg7qg0S3AyOGTSw5VLmvMh2chrFWKmCKFC/4="
+  "org/jetbrains/kotlin#kotlin-util-klib/2.3.20": {
+   "jar": "sha256-lWK407egS+uisUwFZx5xOFnqVLvAohB+ZbK88nP6hEg=",
+   "pom": "sha256-WlhMPMK6O0HR5c1+eiCDV2wbjDl6ebuBY2dtjvew6hc="
   },
   "org/jetbrains/kotlin#swift-export-embeddable/2.2.20": {
    "jar": "sha256-xAgKy0UComoaKdjxcbLjBIJKoiDCrtSvQEOHfy8tREg=",
@@ -2225,9 +2228,9 @@
    "jar": "sha256-IRswbPxE+Plt86Cj3a91uoxSie7XfWDXL4ibuFX1NeU=",
    "pom": "sha256-CTvhsDMxvOKTLWglw36YJy12Ieap6fuTKJoAJRi43Vo="
   },
-  "org/vafer#jdependency/2.15": {
-   "jar": "sha256-8oND1aDWjpYYeI42bfWgRDgGGVU5Fy7R0yBcYr5OQZM=",
-   "pom": "sha256-27DNFL99Z65IZrkSTINMWVCZ8aT8k7f0YRp/64yLlaM="
+  "org/vafer#jdependency/2.16": {
+   "jar": "sha256-hpgdL1CrFe6+GpD4Q6GV8o8L0e5SJV12pz7AtLfsec0=",
+   "pom": "sha256-+jUpmw0MRzE9cDZKddILmsOoh0Q8Yyx+z1C6ffiHG+U="
   },
   "org/wildfly/client#wildfly-client-config/1.0.1.Final": {
    "jar": "sha256-gKTpY86U67BD7LDywOd9Mn8j3IfYE1C4Y3Uu7fosO7M=",
diff --git a/pkgs/by-name/po/powershell-editor-services/package.nix b/pkgs/by-name/po/powershell-editor-services/package.nix
index 70291f9e5b96..a9d355811bfb 100644
--- a/pkgs/by-name/po/powershell-editor-services/package.nix
+++ b/pkgs/by-name/po/powershell-editor-services/package.nix
@@ -7,11 +7,11 @@
 }:
 stdenvNoCC.mkDerivation rec {
   pname = "powershell-editor-services";
-  version = "4.6.0";
+  version = "4.7.0";
 
   src = fetchzip {
     url = "https://github.com/PowerShell/PowerShellEditorServices/releases/download/v${version}/PowerShellEditorServices.zip";
-    hash = "sha256-3h5LQj63fAZ0RZJykiKOKLgJWPJXCTVL+4k7FKrmnK0=";
+    hash = "sha256-dODDDR42VONL3nf5Pg08yfPWHMswCCsgiUMNGSlUz9o=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/pr/pretix/package.nix b/pkgs/by-name/pr/pretix/package.nix
index 092a1e01d824..a830390a9ad2 100644
--- a/pkgs/by-name/pr/pretix/package.nix
+++ b/pkgs/by-name/pr/pretix/package.nix
@@ -54,14 +54,14 @@ let
 in
 pythonPackages.buildPythonApplication (finalAttrs: {
   pname = "pretix";
-  version = "2026.5.1";
+  version = "2026.5.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pretix";
     repo = "pretix";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-p4ZZzfoR4Wg65xeqk9JyCdZ+S7RqBVd1drWpHjj8oqc=";
+    hash = "sha256-lamvhcch/EajS8/b1tocAKjCgW0WqFD0wsm4e5o25nM=";
   };
 
   patches = [
diff --git a/pkgs/by-name/pr/pretix/plugins/mollie/package.nix b/pkgs/by-name/pr/pretix/plugins/mollie/package.nix
index a48afd06166b..b17d5d52a534 100644
--- a/pkgs/by-name/pr/pretix/plugins/mollie/package.nix
+++ b/pkgs/by-name/pr/pretix/plugins/mollie/package.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pretix-mollie";
-  version = "2.5.5";
+  version = "2.5.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pretix";
     repo = "pretix-mollie";
     tag = "v${version}";
-    hash = "sha256-EqitdAoTm6mpXp8g2HftvxRbg+6gXxR7xUsC+aYfv8U=";
+    hash = "sha256-XInwUecuC3sEcRpuS+xa7Gb2Isb18SexbZ2+CcUF7/E=";
   };
 
   build-system = [
diff --git a/pkgs/by-name/pr/pretix/plugins/pages/package.nix b/pkgs/by-name/pr/pretix/plugins/pages/package.nix
index 3b2f61e8e84e..37c32fa5b20c 100644
--- a/pkgs/by-name/pr/pretix/plugins/pages/package.nix
+++ b/pkgs/by-name/pr/pretix/plugins/pages/package.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pretix-pages";
-  version = "1.6.3";
+  version = "1.6.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pretix";
     repo = "pretix-pages";
     rev = "v${version}";
-    hash = "sha256-ZM38zHlFB5013PvoJwm7YC5/wHg2GZWmrhvreXuqNc8=";
+    hash = "sha256-whpO8aE0VUSrByf3P0JaIoruYbJi8wj4nZo/2tx+XLU=";
   };
 
   build-system = [
diff --git a/pkgs/by-name/pr/procs/package.nix b/pkgs/by-name/pr/procs/package.nix
index 5aaa3c33c8bc..8ce2bd6ea6dd 100644
--- a/pkgs/by-name/pr/procs/package.nix
+++ b/pkgs/by-name/pr/procs/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "procs";
-  version = "0.14.11";
+  version = "0.14.12";
 
   src = fetchFromGitHub {
     owner = "dalance";
     repo = "procs";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-BAWsONWDqYJfEnUwYBEhY2hJcna+komUKEaHyNYUr3w=";
+    hash = "sha256-FvBxBleOGWkjV+3uydSESYXybOYrwnBgXwacGftu7Ec=";
   };
 
-  cargoHash = "sha256-VfeQDlmUriZe9ze5L3C0yFoKiyjlZpcesHccO7T15i8=";
+  cargoHash = "sha256-e+ShskUeBIe0PWyzqxAv+XRoEbDyh45SUM4WL3CsiD4=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/pr/protonplus/package.nix b/pkgs/by-name/pr/protonplus/package.nix
index aaee329e24ef..929287eea012 100644
--- a/pkgs/by-name/pr/protonplus/package.nix
+++ b/pkgs/by-name/pr/protonplus/package.nix
@@ -20,13 +20,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "protonplus";
-  version = "0.5.20";
+  version = "0.5.21";
 
   src = fetchFromGitHub {
     owner = "Vysp3r";
     repo = "protonplus";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XLA5dEG3gshvklk1te3VF1lqJmeeclNCWn2R/35pq/E=";
+    hash = "sha256-elc2hDAiMT15bAZW4z55K9EsTRmHeU3YBccTx2GMTIE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pr/prow/package.nix b/pkgs/by-name/pr/prow/package.nix
index ddc780c80ae3..24599bb1db28 100644
--- a/pkgs/by-name/pr/prow/package.nix
+++ b/pkgs/by-name/pr/prow/package.nix
@@ -8,18 +8,18 @@
 
 buildGoModule rec {
   pname = "prow";
-  version = "0-unstable-2026-06-15";
-  rev = "351e8cfd58915657bd36a50e7e86bbe972bc0739";
+  version = "0-unstable-2026-06-24";
+  rev = "2b5fea27a177c767160452ba75dba978a88d8d63";
 
   src = fetchFromGitHub {
     inherit rev;
 
     owner = "kubernetes-sigs";
     repo = "prow";
-    hash = "sha256-TvEAgi2uj1B513o2YWuONiCmCzQvA9S7XPL7MF1VZK4=";
+    hash = "sha256-QKxalLV+UwFs+WspXgnqS3QFRTzDkh/NKHZr/+UPUNg=";
   };
 
-  vendorHash = "sha256-PmvEW80vYTHfcgMOf1AwF9Xb3U9Uj85IJzBpRDxJzhM=";
+  vendorHash = "sha256-iLJ2atYyHNMvflyuETpPnuhKD293k25vfZQU68Y7oN8=";
 
   # doCheck = false;
 
diff --git a/pkgs/by-name/pu/publicsuffix-list/package.nix b/pkgs/by-name/pu/publicsuffix-list/package.nix
index 72c500777df2..ea3f3d9fa1e4 100644
--- a/pkgs/by-name/pu/publicsuffix-list/package.nix
+++ b/pkgs/by-name/pu/publicsuffix-list/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "publicsuffix-list";
-  version = "0-unstable-2026-03-26";
+  version = "0-unstable-2026-05-13";
 
   src = fetchFromGitHub {
     owner = "publicsuffix";
     repo = "list";
-    rev = "d333b72b39575da1ce6932b01d7c421a4107c620";
-    hash = "sha256-LWnvQrIyj+iq96T1u9WEq+HGOZ5sJYN5nCintEr6sBk=";
+    rev = "e452c7058d6946bd76952b128c12f5ce87a5acb8";
+    hash = "sha256-5D4RZAyJOL4hMU32Rmp3SYmjgqEtF36mZJr4YBG0k7E=";
   };
 
   dontBuild = true;
diff --git a/pkgs/by-name/ra/rainfrog/package.nix b/pkgs/by-name/ra/rainfrog/package.nix
index 16efd1892f08..56b3eb1b04cc 100644
--- a/pkgs/by-name/ra/rainfrog/package.nix
+++ b/pkgs/by-name/ra/rainfrog/package.nix
@@ -7,7 +7,7 @@
   rainfrog,
 }:
 let
-  version = "0.3.18";
+  version = "0.3.19";
 in
 rustPlatform.buildRustPackage {
   inherit version;
@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage {
     owner = "achristmascarl";
     repo = "rainfrog";
     tag = "v${version}";
-    hash = "sha256-MraqApmj0FFGBbzG+XXjoDHPgJPG8yAMdXyoCZTMpFk=";
+    hash = "sha256-tVnz2AMcFBbeH7jv1FGJlSA6+rDmvgG1X7Xc1gUc/TQ=";
   };
 
-  cargoHash = "sha256-pPVJgemV7Esg1vYGxCPv8gv0I5DQwA1VtWhcgm5VLFE=";
+  cargoHash = "sha256-wXNuh3eJPiFb49yOFw7srihc6IiNx0rWB/waYrrKKPU=";
 
   passthru = {
     tests.version = testers.testVersion {
diff --git a/pkgs/by-name/re/redumper/package.nix b/pkgs/by-name/re/redumper/package.nix
index 82b9027435f6..5643f4910637 100644
--- a/pkgs/by-name/re/redumper/package.nix
+++ b/pkgs/by-name/re/redumper/package.nix
@@ -13,13 +13,13 @@
 # redumper is using C++ modules, this requires latest C++20 compiler and build tools
 llvmPackages.libcxxStdenv.mkDerivation (finalAttrs: {
   pname = "redumper";
-  version = "724";
+  version = "726";
 
   src = fetchFromGitHub {
     owner = "superg";
     repo = "redumper";
     tag = "b${finalAttrs.version}";
-    hash = "sha256-EOQEEQKxdAGGZr72/lfJv1KOz7bQglzxwpwblrTPtls=";
+    hash = "sha256-887r4SatrybmG4tSJRLpOQNcxwvMVF0iTZoWWNQ4m8A=";
   };
 
   patches = [
diff --git a/pkgs/by-name/re/reticulated/package.nix b/pkgs/by-name/re/reticulated/package.nix
new file mode 100644
index 000000000000..798e02fca3c6
--- /dev/null
+++ b/pkgs/by-name/re/reticulated/package.nix
@@ -0,0 +1,65 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "reticulated";
+  version = "1.0.2";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "RFnexus";
+    repo = "reticulated";
+    tag = finalAttrs.version;
+    hash = "sha256-55eK9AObUw8JLn4sNC5O8dNrfscwTwQpkVQAR+O9Lcw=";
+  };
+
+  postPatch = ''
+    substituteInPlace sim/config.py \
+      --replace-fail 'os.path.join(BASE_DIR, "web")' '"${placeholder "out"}/share/web"'
+  '';
+
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  dependencies = with python3Packages; [
+    fastapi
+    lxmf
+    rns
+    uvicorn
+    websockets
+  ];
+
+  postInstall = ''
+    mkdir -p "$out/share"
+    cp -r web "$out/share/"
+  '';
+
+  postFixup = ''
+    wrapProgram $out/bin/reticulated \
+      --set PYTHONPATH $PYTHONPATH \
+      --set SIM_DATA_DIR "/tmp"
+  '';
+
+  pythonImportsCheck = [ "sim" ];
+
+  # No --version flag and no Python tests
+  doCheck = false;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    changelog = "https://github.com/RFnexus/reticulated/releases/tag/${finalAttrs.src.tag}";
+    description = "Reticulum Network Stack Simulator";
+    homepage = "https://github.com/RFnexus/reticulated";
+    license = lib.licenses.unlicense;
+    maintainers = with lib.maintainers; [ drupol ];
+    mainProgram = "reticulated";
+    platforms = lib.platforms.all;
+  };
+})
diff --git a/pkgs/by-name/rs/rsync/fix-tests-in-darwin-sandbox.patch b/pkgs/by-name/rs/rsync/fix-tests-in-darwin-sandbox.patch
deleted file mode 100644
index d9209a97c1ed..000000000000
--- a/pkgs/by-name/rs/rsync/fix-tests-in-darwin-sandbox.patch
+++ /dev/null
@@ -1,56 +0,0 @@
-From 9b104ed9859f17b6ed4c4ad01806c75a0c197dd7 Mon Sep 17 00:00:00 2001
-From: Emily <hello@emily.moe>
-Date: Tue, 5 Aug 2025 15:55:24 +0100
-Subject: [PATCH] Allow `ls(1)` to fail in test setup
-
-This can happen when the tests are unable to `stat(2)` some files in
-`/etc`, `/bin`, or `/`, due to Unix permissions or other sandboxing. We
-still guard against serious errors, which use exit code 2.
----
- testsuite/longdir.test | 4 ++--
- testsuite/rsync.fns    | 8 ++++----
- 2 files changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/testsuite/longdir.test b/testsuite/longdir.test
-index 8d66bb5f..26747292 100644
---- a/testsuite/longdir.test
-+++ b/testsuite/longdir.test
-@@ -16,9 +16,9 @@ makepath "$longdir" || test_skipped "unable to create long directory"
- touch "$longdir/1" || test_skipped "unable to create files in long directory"
- date > "$longdir/1"
- if [ -r /etc ]; then
--    ls -la /etc >"$longdir/2"
-+    ls -la /etc >"$longdir/2" || [ $? -eq 1 ]
- else
--    ls -la / >"$longdir/2"
-+    ls -la / >"$longdir/2" || [ $? -eq 1 ]
- fi
- checkit "$RSYNC --delete -avH '$fromdir/' '$todir'" "$fromdir/" "$todir"
- 
-diff --git a/testsuite/rsync.fns b/testsuite/rsync.fns
-index 2ab97b69..f7da363f 100644
---- a/testsuite/rsync.fns
-+++ b/testsuite/rsync.fns
-@@ -195,15 +195,15 @@ hands_setup() {
-     echo some data > "$fromdir/dir/subdir/foobar.baz"
-     mkdir "$fromdir/dir/subdir/subsubdir"
-     if [ -r /etc ]; then
--	ls -ltr /etc > "$fromdir/dir/subdir/subsubdir/etc-ltr-list"
-+	ls -ltr /etc > "$fromdir/dir/subdir/subsubdir/etc-ltr-list" || [ $? -eq 1 ]
-     else
--	ls -ltr / > "$fromdir/dir/subdir/subsubdir/etc-ltr-list"
-+	ls -ltr / > "$fromdir/dir/subdir/subsubdir/etc-ltr-list" || [ $? -eq 1 ]
-     fi
-     mkdir "$fromdir/dir/subdir/subsubdir2"
-     if [ -r /bin ]; then
--	ls -lt /bin > "$fromdir/dir/subdir/subsubdir2/bin-lt-list"
-+	ls -lt /bin > "$fromdir/dir/subdir/subsubdir2/bin-lt-list" || [ $? -eq 1 ]
-     else
--	ls -lt / > "$fromdir/dir/subdir/subsubdir2/bin-lt-list"
-+	ls -lt / > "$fromdir/dir/subdir/subsubdir2/bin-lt-list" || [ $? -eq 1 ]
-     fi
- 
- #      echo testing head:
--- 
-2.50.1
-
diff --git a/pkgs/by-name/rs/rsync/package.nix b/pkgs/by-name/rs/rsync/package.nix
index 90380b486916..a102ff36cc15 100644
--- a/pkgs/by-name/rs/rsync/package.nix
+++ b/pkgs/by-name/rs/rsync/package.nix
@@ -1,12 +1,12 @@
 {
   lib,
   stdenv,
-  fetchpatch,
   fetchurl,
+  fetchpatch,
 
   updateAutotoolsGnuConfigScriptsHook,
   perl,
-
+  python3,
   libiconv,
   zlib,
   popt,
@@ -29,24 +29,29 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rsync";
-  version = "3.4.1";
+  version = "3.4.4";
 
   src = fetchurl {
     # signed with key 9FEF 112D CE19 A0DC 7E88  2CB8 1BB2 4997 A853 5F6F
     url = "mirror://samba/rsync/src/rsync-${finalAttrs.version}.tar.gz";
-    hash = "sha256-KSS8s6Hti1UfwQH3QLnw/gogKxFQJ2R89phQ1l/YjFI=";
+    hash = "sha256-vYjPgvplPaMjFPsikTZAfFyQ+A0XWNj0sJF2eHfY+pY=";
   };
 
-  patches = [
-    # See: <https://github.com/RsyncProject/rsync/pull/790>
-    ./fix-tests-in-darwin-sandbox.patch
-    # fix compilation with gcc15
+  patches = lib.optionals (stdenv.hostPlatform.isDarwin) [
+    # Fixes test failure on darwin
     (fetchpatch {
-      url = "https://github.com/RsyncProject/rsync/commit/a4b926dcdce96b0f2cc0dc7744e95747b233500a.patch";
-      hash = "sha256-UiEQJ+p2gtIDYNJqnxx4qKgItKIZzCpkHnvsgoxBmSE=";
+      url = "https://github.com/RsyncProject/rsync/commit/e1c5f0e93a75dd45f32f3b92ba221ef158ac2e5f.patch";
+      hash = "sha256-pg65K9BCTq/WvS5icK6KT28ARccFKedp2445wLYdRsE=";
+      excludes = [
+        ".github/workflows/cygwin-build.yml"
+      ];
     })
   ];
 
+  preBuild = ''
+    patchShebangs ./runtests.py
+  '';
+
   nativeBuildInputs = [
     updateAutotoolsGnuConfigScriptsHook
     perl
@@ -86,6 +91,15 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru.tests = { inherit (nixosTests) rsyncd; };
 
+  nativeCheckInputs = [
+    python3
+  ];
+
+  # Test fails when built in a chroot store
+  preCheck = ''
+    rm testsuite/chgrp.test
+  '';
+
   doCheck = true;
 
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/by-name/ru/rucola/package.nix b/pkgs/by-name/ru/rucola/package.nix
index a26e38012596..2c5a0b227266 100644
--- a/pkgs/by-name/ru/rucola/package.nix
+++ b/pkgs/by-name/ru/rucola/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rucola";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "Linus-Mussmaecher";
     repo = "rucola";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gBX7ivLiCpdVE77O+Qy2fVGjvh/qG9FxX4jNxsTL03s=";
+    hash = "sha256-dE2XlO+CwC78GblNoyv7oA5d/GezzuiuOwcQjsm7Pns=";
   };
 
-  cargoHash = "sha256-9QBZEZS1LFfjlKVTM5vAbm+8tFlZVyWDLEKvpsDIu5E=";
+  cargoHash = "sha256-yhBY/6NLn1aIRZLLpHrEsMo/yzSnKzsvrIiJFCRcYMc=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ru/rust-cbindgen/package.nix b/pkgs/by-name/ru/rust-cbindgen/package.nix
index 14374532ff52..88bb855e800b 100644
--- a/pkgs/by-name/ru/rust-cbindgen/package.nix
+++ b/pkgs/by-name/ru/rust-cbindgen/package.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rust-cbindgen";
-  version = "0.29.2";
+  version = "0.29.3";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "cbindgen";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-P2A+XSLrcuYsI48gnZSNNs5qX+EatiuEJSEJbMvMSxg=";
+    hash = "sha256-d0rY7Sk37s8HEZlQq9Sbjj1P+DgygD0Yjx8cXlFKEIA=";
   };
 
-  cargoHash = "sha256-DbmlpjiOraLWPh5RgJqCIGIYzE1h82MH2S6gpLH+CIQ=";
+  cargoHash = "sha256-UeierkQpfCiB5ES9ZW9hO+0AcI9Ip8qSJ/Nd+I1xrmQ=";
 
   nativeCheckInputs = [
     cmake
diff --git a/pkgs/by-name/ru/rusthound-ce/package.nix b/pkgs/by-name/ru/rusthound-ce/package.nix
index 840e58b5792b..621b17356718 100644
--- a/pkgs/by-name/ru/rusthound-ce/package.nix
+++ b/pkgs/by-name/ru/rusthound-ce/package.nix
@@ -10,14 +10,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rusthound-ce";
-  version = "2.4.7";
+  version = "2.4.9";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-GxkrTXlCVPEZvsu6wck1BbXinFSdnTmnWHy9LH1ymdQ=";
+    hash = "sha256-FG63LZX62MiSquI56WnQc9oRdzvQAaf/wGPDjSmhvow=";
   };
 
-  cargoHash = "sha256-mvsGi5M4Ut0BnX2204AX2nBIdZ8Gtap8wf9pWc6RlpU=";
+  cargoHash = "sha256-tN7sHqEC18NQs3PrLdY71JdbL31MBh2tuaBtTN/T9vE=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/ry/rymcast/package.nix b/pkgs/by-name/ry/rymcast/package.nix
deleted file mode 100644
index e87b73ca44ec..000000000000
--- a/pkgs/by-name/ry/rymcast/package.nix
+++ /dev/null
@@ -1,54 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchzip,
-  autoPatchelfHook,
-  makeWrapper,
-  alsa-lib,
-  curl,
-  gtk3,
-  # webkitgtk_4_0,
-  zenity,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "rymcast";
-  version = "1.0.6";
-
-  src = fetchzip {
-    url = "https://www.inphonik.com/files/rymcast/rymcast-${version}-linux-x64.tar.gz";
-    hash = "sha256:0vjjhfrwdibjjgz3awbg30qxkjrzc4cya1f4pigwjh3r0vvrq0ga";
-    stripRoot = false;
-  };
-
-  nativeBuildInputs = [
-    autoPatchelfHook
-    makeWrapper
-  ];
-
-  buildInputs = [
-    alsa-lib
-    curl
-    gtk3
-    (lib.getLib stdenv.cc.cc)
-    # webkitgtk_4_0
-    zenity
-  ];
-
-  installPhase = ''
-    mkdir -p "$out/bin"
-    cp RYMCast "$out/bin/"
-    wrapProgram "$out/bin/RYMCast" \
-      --set PATH "${lib.makeBinPath [ zenity ]}"
-  '';
-
-  meta = {
-    # webkitgtk_4_0 was removed
-    broken = true;
-    description = "Player for Mega Drive/Genesis VGM files";
-    homepage = "https://www.inphonik.com/products/rymcast-genesis-vgm-player/";
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    license = lib.licenses.unfree;
-    platforms = [ "x86_64-linux" ];
-  };
-}
diff --git a/pkgs/by-name/sb/sbom-utility/package.nix b/pkgs/by-name/sb/sbom-utility/package.nix
index 6fff931f6a49..766d1c4e5143 100644
--- a/pkgs/by-name/sb/sbom-utility/package.nix
+++ b/pkgs/by-name/sb/sbom-utility/package.nix
@@ -9,7 +9,7 @@
 }:
 
 let
-  version = "0.19.1";
+  version = "0.19.2";
 in
 buildGoModule {
   pname = "sbom-utility";
@@ -19,7 +19,7 @@ buildGoModule {
     owner = "CycloneDX";
     repo = "sbom-utility";
     tag = "v${version}";
-    hash = "sha256-AEy29ZL2KfWuHzVohUF5xWI34QgvtIDQfH6AlVfFkAY=";
+    hash = "sha256-xjANZxjPQmaBZPt+yF2UTJ1QL7QN0wSFxNMZ2oF6p7s=";
   };
 
   vendorHash = "sha256-vyYSir5u6d5nv+2ScrHpasQGER4VFSoLb1FDUDIrtDM=";
diff --git a/pkgs/by-name/sb/sbsigntool/package.nix b/pkgs/by-name/sb/sbsigntool/package.nix
index e0b8a4451fd7..4721ada70681 100644
--- a/pkgs/by-name/sb/sbsigntool/package.nix
+++ b/pkgs/by-name/sb/sbsigntool/package.nix
@@ -10,6 +10,11 @@
   libuuid,
   gnu-efi,
   libbfd,
+  util-linux,
+  buildPackages,
+  deterministic-host-uname,
+  # help2man runs host executables
+  withMan ? stdenv.buildPlatform.canExecute stdenv.hostPlatform,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -31,6 +36,8 @@ stdenv.mkDerivation (finalAttrs: {
     automake
     pkg-config
     help2man
+    util-linux # for getopt used by create-ccan-tree
+    deterministic-host-uname # build system incorrectly uses uname to determine host CPU
   ];
   buildInputs = [
     openssl
@@ -39,27 +46,25 @@ stdenv.mkDerivation (finalAttrs: {
     gnu-efi
   ];
 
-  configurePhase = ''
-    runHook preConfigure
+  preConfigure = ''
+    substituteInPlace configure.ac --replace-fail "@@NIX_GNUEFI@@" "${gnu-efi}"
 
-    substituteInPlace configure.ac --replace "@@NIX_GNUEFI@@" "${gnu-efi}"
-
-    lib/ccan.git/tools/create-ccan-tree --build-type=automake lib/ccan "talloc read_write_all build_assert array_size endian"
+    CC=${lib.getExe buildPackages.stdenv.cc} lib/ccan.git/tools/create-ccan-tree --build-type=automake lib/ccan "talloc read_write_all build_assert array_size endian"
     touch AUTHORS
     touch ChangeLog
 
-    echo "SUBDIRS = lib/ccan src docs" >> Makefile.am
+    echo "SUBDIRS = lib/ccan src ${lib.optionalString withMan "docs"}" > Makefile.am
 
     aclocal
     autoheader
     autoconf
     automake --add-missing -Wno-portability
-
-    ./configure --prefix=$out
-
-    runHook postConfigure
   '';
 
+  makeFlags = [
+    "AR=${stdenv.cc.targetPrefix}ar"
+  ];
+
   meta = {
     description = "Tools for maintaining UEFI signature databases";
     homepage = "http://jk.ozlabs.org/docs/sbkeysync-maintaing-uefi-key-databases";
diff --git a/pkgs/by-name/sc/scantpaper/package.nix b/pkgs/by-name/sc/scantpaper/package.nix
index e83ae4f39a16..563228da1232 100644
--- a/pkgs/by-name/sc/scantpaper/package.nix
+++ b/pkgs/by-name/sc/scantpaper/package.nix
@@ -33,13 +33,13 @@ let
 in
 python3.pkgs.buildPythonApplication rec {
   pname = "scantpaper";
-  version = "3.0.7";
+  version = "3.0.9";
 
   src = fetchFromGitHub {
     owner = "carygravel";
     repo = "scantpaper";
-    rev = "v${version}";
-    hash = "sha256-CKD6hggVIHNPAft+DAsF4S+uZo+u/gbUStz9VaZtDBM=";
+    tag = "v${version}";
+    hash = "sha256-4YHC77Hgvl2A15klilJx0JdP9VWSpqBSj9q//faMNM8=";
   };
 
   pyproject = true;
@@ -105,6 +105,7 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   meta = with lib; {
+    changelog = "https://github.com/carygravel/scantpaper/blob/${src.tag}/changelog.md";
     description = "GUI to produce PDFs or DjVus from scanned documents";
     homepage = "https://github.com/carygravel/scantpaper";
     license = licenses.gpl3Only;
diff --git a/pkgs/by-name/sd/sdl3/package.nix b/pkgs/by-name/sd/sdl3/package.nix
index 19ee7429320d..f5814d3f91b8 100644
--- a/pkgs/by-name/sd/sdl3/package.nix
+++ b/pkgs/by-name/sd/sdl3/package.nix
@@ -70,7 +70,7 @@ assert lib.assertMsg (ibusSupport -> dbusSupport) "SDL3 requires dbus support to
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sdl3";
-  version = "3.4.8";
+  version = "3.4.10";
 
   outputs = [
     "lib"
@@ -83,14 +83,21 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "libsdl-org";
     repo = "SDL";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-uBGyGxrUVx642Ku8qhR2sTy2JagcSioIhh/5RsXVAIM=";
+    hash = "sha256-6Dph2eLiJUmpQzPWe8EuY5LrWhrFwde2f2dwfgCcWNw=";
   };
 
   postPatch =
-    # Tests timeout on Darwin
     lib.optionalString (finalAttrs.finalPackage.doCheck) ''
+      # Tests timeout on Darwin
       substituteInPlace test/CMakeLists.txt \
         --replace-fail 'set(noninteractive_timeout 10)' 'set(noninteractive_timeout 30)'
+
+      # intermittent test failure
+      # https://github.com/libsdl-org/SDL/issues/15346
+      substituteInPlace test/CMakeLists.txt \
+        --replace-fail \
+        'add_sdl_test_executable(testrwlock SOURCES testrwlock.c NONINTERACTIVE NONINTERACTIVE_TIMEOUT 20)' \
+        'add_sdl_test_executable(testrwlock SOURCES testrwlock.c NONINTERACTIVE NONINTERACTIVE_TIMEOUT 300)'
     ''
     + lib.optionalString waylandSupport ''
       substituteInPlace src/dialog/unix/SDL_zenitymessagebox.c \
diff --git a/pkgs/by-name/se/servo/package.nix b/pkgs/by-name/se/servo/package.nix
index 1dc10fc3c775..659112af119e 100644
--- a/pkgs/by-name/se/servo/package.nix
+++ b/pkgs/by-name/se/servo/package.nix
@@ -69,13 +69,13 @@ in
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "servo";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "servo";
     repo = "servo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zZitnAiexoroKx3TMu3sB0KDvIsBcT7Krwa6lJqY4yw=";
+    hash = "sha256-DfUjByBtDcOShExuBBLSHmgP9CPMSdkovw9QeGRDYaA=";
     # Breaks reproducibility depending on whether the picked commit
     # has other ref-names or not, which may change over time, i.e. with
     # "ref-names: HEAD -> main" as long this commit is the branch HEAD
@@ -85,7 +85,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     '';
   };
 
-  cargoHash = "sha256-hZBI3Vte/FvN7qJy2VGF0LVQIFSWa931BFFbaUfN814=";
+  cargoHash = "sha256-N0MUtL0HslJHEQUCB0iMbXGdD9hA6GRqcmdSjjhsu8E=";
 
   # set `HOME` to a temp dir for write access
   # Fix invalid option errors during linking (https://github.com/mozilla/nixpkgs-mozilla/commit/c72ff151a3e25f14182569679ed4cd22ef352328)
diff --git a/pkgs/by-name/si/sideband/package.nix b/pkgs/by-name/si/sideband/package.nix
index 1311e2e4ca9b..afee2ef2c34e 100644
--- a/pkgs/by-name/si/sideband/package.nix
+++ b/pkgs/by-name/si/sideband/package.nix
@@ -7,7 +7,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "sideband";
-  version = "1.9.6";
+  version = "1.9.7";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "markqvist";
     repo = "Sideband";
     tag = finalAttrs.version;
-    hash = "sha256-Dbhi4Sz+a42OILXcSfNNM4UDqMV5gHJ5xfYUMEON3ws=";
+    hash = "sha256-YL8wqZGBrMEtm+mLVjyaZpTPj8XVM0YUjP6Kfo7QHfw=";
   };
 
   # Unable to upstream all of this
@@ -32,7 +32,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     substituteInPlace sbapp/main.py \
       --replace-fail \
         "1.9.2" \
-        "1.9.6"
+        "1.9.7"
   '';
 
   build-system = with python3Packages; [
@@ -59,8 +59,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
       sh
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
-      pycodec2
       pyaudio
+      pycodec2
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       pyobjus
diff --git a/pkgs/by-name/si/signal-cli/deps.json b/pkgs/by-name/si/signal-cli/deps.json
index 9dc2cfd39a75..135d933b7af8 100644
--- a/pkgs/by-name/si/signal-cli/deps.json
+++ b/pkgs/by-name/si/signal-cli/deps.json
@@ -45,118 +45,118 @@
   "org/graalvm/buildtools/native#org.graalvm.buildtools.native.gradle.plugin/1.1.2": {
    "pom": "sha256-lpcCHJItfukS1MnDy6Z2GsynwLWczuEJ5VVhN2kOIAM="
   },
-  "org/gradle/kotlin#gradle-kotlin-dsl-plugins/6.5.2": {
-   "jar": "sha256-O/9KBwDhyBXRlEifB7ugbLGQ6PKbdz03z+43rI1cdkQ=",
-   "module": "sha256-MVnFQXhFqWmTx4nULexDVwf7uEiXnP0R0LgzBZ5RIKM=",
-   "pom": "sha256-ctVO1m6jP6+UKCNRwxAZ4S59fpIOpnpRbL4ODWdBA0M="
+  "org/gradle/kotlin#gradle-kotlin-dsl-plugins/6.5.7": {
+   "jar": "sha256-zIyqQQGjXQzwQzpj6K04kRpMhIBz/MlPQ64CUfM+Ta8=",
+   "module": "sha256-ENa9ZquwiOylvjYP9yVQyWFU0mdu/t10rzHEUAF8OQk=",
+   "pom": "sha256-q+nzlg+nNZciqHUuYb/ElnYeFdFHNeTGQiB5cHYGq74="
   },
-  "org/gradle/kotlin/kotlin-dsl#org.gradle.kotlin.kotlin-dsl.gradle.plugin/6.5.2": {
-   "pom": "sha256-5aavF7WFYNdGyrQseV/jpCoevkBQ5VpPANjPVM8x8eo="
+  "org/gradle/kotlin/kotlin-dsl#org.gradle.kotlin.kotlin-dsl.gradle.plugin/6.5.7": {
+   "pom": "sha256-Ldg2zAlxLNrd/u/GgNLqZutD2NxjOGvVlSZYE0l/Ry0="
   },
   "org/jetbrains#annotations/13.0": {
    "jar": "sha256-rOKhDcji1f00kl7KwD5JiLLA+FFlDJS4zvSbob0RFHg=",
    "pom": "sha256-llrrK+3/NpgZvd4b96CzuJuCR91pyIuGN112Fju4w5c="
   },
-  "org/jetbrains/kotlin#abi-tools-api/2.3.0": {
-   "jar": "sha256-QBe8wfXTKFsX5rYiDRakaMhxWTDw35Y5bXZLV/Cm02U=",
-   "pom": "sha256-qJIhRAlxhudUjXFH3I3O1eYOMGnUY1ulUe8uV3WrmAk="
+  "org/jetbrains/kotlin#abi-tools-api/2.3.20": {
+   "jar": "sha256-U2hfV4OwSQaDiY11Wrrk1Bi26DugYTSFiv3ctZRYmek=",
+   "pom": "sha256-qIbJ/X8rlmlFf+wCHxnc8V8EY+DbS9rVOuGBJTZsxvk="
   },
-  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.3.0": {
-   "module": "sha256-d8IDSG/XkrWAVyBp5cRC0YDA7wVbpzRQXaKNGX7BL/c=",
-   "pom": "sha256-k8/rFUWRw3AengQ1C9AF0ZVqmuZHFH1vsqfFeD4fkJo="
+  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.3.20": {
+   "module": "sha256-bNjWSw5lN3kE8wb2qFja/ZMcQTUkD4RMk9UpTumP6Dk=",
+   "pom": "sha256-SgpFTor25QOv5ngwoYVjubaA3u67GhcGoNe0S8UHQKE="
   },
-  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.3.0/gradle813": {
-   "jar": "sha256-D+cv3G5RvisnSw5kuEQB9SUDavsgYWKkRYIU8R6614c="
+  "org/jetbrains/kotlin#fus-statistics-gradle-plugin/2.3.20/gradle813": {
+   "jar": "sha256-pPEKPw6l3dH1VaT3BuCep/VSs8hSK7EAY2HdMG4152o="
   },
-  "org/jetbrains/kotlin#kotlin-assignment/2.3.0": {
-   "module": "sha256-ljRPGdjxnqpbxEHjP2UB9+c9o8el1X1EvHwW6qRXVls=",
-   "pom": "sha256-GqwiGC0snJVP/8FrV2Xq0jjiAw9HhIctRrxfOcozll0="
+  "org/jetbrains/kotlin#kotlin-assignment/2.3.20": {
+   "module": "sha256-GCp0ZM5mvM/ejjG+aPoO7DE8HZDD2POWeclyJyliFjg=",
+   "pom": "sha256-f3R8uTA9Hfqh1hJfZsFUG+o4PsuZh2ta28riSAVZZ48="
   },
-  "org/jetbrains/kotlin#kotlin-assignment/2.3.0/gradle813": {
-   "jar": "sha256-PKIayHkWchdbgnPemV8CTzWZLfAwCijCdUnPd3DMnOY="
+  "org/jetbrains/kotlin#kotlin-assignment/2.3.20/gradle813": {
+   "jar": "sha256-tYin5gfij7WAIo4SDdX/+L6nO9J3JnM6F35kRYLooB0="
   },
-  "org/jetbrains/kotlin#kotlin-build-statistics/2.3.0": {
-   "jar": "sha256-Z3hVlwDnLXZOniTZWPFuwMx152t1s4FMK83hRKYnT04=",
-   "pom": "sha256-QTkKXrIxFJOxpFubOXLDoL8dqEfoRaNKtoQKr0EmTeI="
+  "org/jetbrains/kotlin#kotlin-build-statistics/2.3.20": {
+   "jar": "sha256-ptJ7PINhdlLdBlYG+Yz1nPviY/jCDr5OvVpvJonrDU8=",
+   "pom": "sha256-nQqNf/FyPV1y00ldVVc9jTxrd3TWHYBXlxT3nCQmX48="
   },
-  "org/jetbrains/kotlin#kotlin-build-tools-api/2.3.0": {
-   "jar": "sha256-xsCc8oU0VySfcHyGOCESQJ1aVfULa4Vouk9TDdAD/tw=",
-   "pom": "sha256-FzTIvg4nFXJ3AkW01gbOW7iBbosNHA9+euEcEMLKF1s="
+  "org/jetbrains/kotlin#kotlin-build-tools-api/2.3.20": {
+   "jar": "sha256-IvGrIjhUuUkJn2slnO9UHVtYo2Q9+aScRXfGPEFuhDs=",
+   "pom": "sha256-G14LLDaQXcL1XgpLeBKuY+MSXe/PaG0sD0kPg7c9nV4="
   },
-  "org/jetbrains/kotlin#kotlin-compiler-runner/2.3.0": {
-   "jar": "sha256-hwl38pYFQ2xesiV7nI5dZPMoLyqI7e5FRNNOxF8Wpqc=",
-   "pom": "sha256-ov8zZnin9TpEOSv8bFK2gS7dxz5AghyQfyomQWeeDrs="
+  "org/jetbrains/kotlin#kotlin-compiler-runner/2.3.20": {
+   "jar": "sha256-wGnzCkA75wyBUviqnyXsy6GI7q1UJjrgKvFEIUN6Igg=",
+   "pom": "sha256-jYTqDt1gs4vOpWLeUXgVKiZxqaAFPWcPkxRSs9sBMig="
   },
-  "org/jetbrains/kotlin#kotlin-daemon-client/2.3.0": {
-   "jar": "sha256-sr5naIyvEaE41a4M4SNTga2asN25OVqwb42EagtGYBc=",
-   "pom": "sha256-teLnTuXC+I/Qi/g+7GRx9rvKeqEhWYgCtsMsVuhwYCY="
+  "org/jetbrains/kotlin#kotlin-daemon-client/2.3.20": {
+   "jar": "sha256-xxp8G+j7/wTgr0XJ7oy3ph2JU7ymuL8iWlcZxyWpC0Q=",
+   "pom": "sha256-nnyLgHJBF/cqrOZfa+SNg224/Dl1OtlR8ruQhi1+cIA="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-annotations/2.3.0": {
-   "jar": "sha256-/HKYw2tF820WUscDuraT9f6bEVmOzZrH7J/f6IptsPA=",
-   "pom": "sha256-aQhDRFhvUkNNH7tRZmlgr/uHbGQ+gIYkXrgLpeREm7U="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-annotations/2.3.20": {
+   "jar": "sha256-4WYu10cyK2P2HU+t2Zq3gQTEXq8JwRp4mGJBXoHBjcQ=",
+   "pom": "sha256-aP+Cf8E1DZPw1nM2jAZHm2K31eXDBlipWM+TBmgx6Nk="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.3.0": {
-   "module": "sha256-BQ8eECIJAOR6MIkd1c/qg3pl27sNmjyxuFKRq6MmykE=",
-   "pom": "sha256-GeTwq/tcvwEdJZP1ZRV8jr9FkvMAhhS6LtsEinhRF10="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.3.20": {
+   "module": "sha256-04UBEP9ajrcP7S1Xi0X7B+vESvaika5M88eUMMZRKLo=",
+   "pom": "sha256-AdVSITSRyFPVb4frdIEwON+e4dhekIaqN70GY7JJb4g="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.3.0/gradle813": {
-   "jar": "sha256-yh6tFJqMj0G6YKg5qDsjw6BiJ8RsYhJMUb6ZkDXerDE="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-api/2.3.20/gradle813": {
+   "jar": "sha256-ybwX32m/OZB8WXweGb7EtHnHWqx1+/1jIeNEW0lxLog="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea-proto/2.3.0": {
-   "jar": "sha256-epBQPJ14f5vNLBd25MxSfrneeRLvecbJWPEwWi0cQ7o=",
-   "pom": "sha256-2bCOHuM4pjRhSanQIY+FHuPUfYu3fWEDJg8qhyauUl4="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea-proto/2.3.20": {
+   "jar": "sha256-5Cicv5/0lAfwQd3GM24bV3pspM8r4dKjEzgnHBPu0+0=",
+   "pom": "sha256-9veHObqf4nEunwyeW8T16TcZzP6pW0fC9JslC+F2NX4="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea/2.3.0": {
+  "org/jetbrains/kotlin#kotlin-gradle-plugin-idea/2.3.20": {
    "jar": "sha256-lS5zlI4qINOYwmuHprtwzPZkGPuvFSfDUVsYjqnUvWA=",
-   "module": "sha256-kRUvrqO8DJTbZtPLWKrh2+rXyGC1dk5nsgC01N9M6rk=",
-   "pom": "sha256-BLSVrgZj7a3aSEBkZKzTlDGjysez6OjAlLdplu1BSaA="
+   "module": "sha256-b7XZcwCl5Vmv1Nn/msA1bE2Wb31pS2Yvrhaf2HQhUx4=",
+   "pom": "sha256-WROHIVGNgqND99wvCRK3BJjT7vM2PJ66wiCssPyTjsw="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.3.0": {
-   "module": "sha256-vbMts6ongF80eewDPsY9PMq+sTuInYbavadCu+9TwJo=",
-   "pom": "sha256-h4cnvyGoOtrYnU5giEhN2/OfaoSpQoAiGm4cL4hBMD4="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.3.20": {
+   "module": "sha256-lVUmc7gbNXitmy86/xRUtjzoBsb9SrfGBJIx6GQKtHE=",
+   "pom": "sha256-EcMjwt2KgE6fWOBHwsAYZLKgHcDYEys2PApDEiFbwJs="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.3.0/gradle813": {
-   "jar": "sha256-Os+X1zolgbAyhz+on1Z1DTazt21A1pLZg58kZ92uTWk="
+  "org/jetbrains/kotlin#kotlin-gradle-plugin/2.3.20/gradle813": {
+   "jar": "sha256-RuFu4mWU9ID+y5LJbarjdTDoNQJreON+8yUelX8D9vs="
   },
-  "org/jetbrains/kotlin#kotlin-gradle-plugins-bom/2.3.0": {
-   "module": "sha256-/9anNzSypS+3Yz8WOVRL43HgYpxR2X+h5fteqTQ6Fwk=",
-   "pom": "sha256-cYYJKmnzaIQyxcCsuQtKZx/Y7oANhP5YT66P1TO6v4o="
+  "org/jetbrains/kotlin#kotlin-gradle-plugins-bom/2.3.20": {
+   "module": "sha256-+CvXZF0MPv609PZVIKPGWz6MMCsIMyIDegABuHsC6ZA=",
+   "pom": "sha256-3WuRkZfhMv5x3axw9vxdj65/Und6/YN7FN6HG4wKVAA="
   },
-  "org/jetbrains/kotlin#kotlin-klib-commonizer-api/2.3.0": {
-   "jar": "sha256-m6V9kaveq5rNWIoUtfQiCbmWRMU0Ft/56X7LS/l/Ukg=",
-   "pom": "sha256-zTHw7NqCplEi/8alXehxE5S2GEtRRAK34RkZGqgJGoI="
+  "org/jetbrains/kotlin#kotlin-klib-commonizer-api/2.3.20": {
+   "jar": "sha256-vpN3SFQS0A8B54KZyzC+SAJZHCcwNCtuva/AiU91J0M=",
+   "pom": "sha256-IbFbpb1i0h1Ta7egyMtnQ1cfwPQwklSKQjWybyodIgs="
   },
-  "org/jetbrains/kotlin#kotlin-native-utils/2.3.0": {
-   "jar": "sha256-7kvygz0Q5fN90haoMSn1nzx8vvXrrBMPcGZIOXCMgLc=",
-   "pom": "sha256-Rp6PYB/b34kP+ozXSOEQcCqkUxu7KbZOXnUD8O/lDZA="
+  "org/jetbrains/kotlin#kotlin-native-utils/2.3.20": {
+   "jar": "sha256-QxnCdkeV773/K3julUVRV9evC5FVaYuqG6Uqar46vy0=",
+   "pom": "sha256-LAp+ADViCIXUN+fxJidEdbpYqiJC+1279D+R8gyvpwg="
   },
-  "org/jetbrains/kotlin#kotlin-sam-with-receiver/2.3.0": {
-   "module": "sha256-DCD2gdNvSnmRYiFYCYkpF5TmVlgvlJwGed+kNKAm9so=",
-   "pom": "sha256-DILmEXpGNhvUzF5iZV8rgC8Q9LfZJWpjaD0DSv0MDUM="
+  "org/jetbrains/kotlin#kotlin-sam-with-receiver/2.3.20": {
+   "module": "sha256-nhEhx/ZQMDvdx/BH/tMCf4FjuzZ1Gy3w+vNjfumFsh8=",
+   "pom": "sha256-Y/Gk4+TT3jrPghTwWgtW/5IM4L9ZYVSnkE8gVuP41RE="
   },
-  "org/jetbrains/kotlin#kotlin-sam-with-receiver/2.3.0/gradle813": {
-   "jar": "sha256-r8iTlKUrUu8Lp6gpakJi0NOoo850CRXYfXE7CgFhMpg="
+  "org/jetbrains/kotlin#kotlin-sam-with-receiver/2.3.20/gradle813": {
+   "jar": "sha256-oHxdPMvaP8dWTkB0RybhNz5UvSXwVGPT9D1DnXeOy90="
   },
-  "org/jetbrains/kotlin#kotlin-stdlib/2.3.0": {
-   "jar": "sha256-iHWHyRcTJQrVL+FK2RZtBCwzg1BJiQ6UN/NV/8WhlbE=",
-   "module": "sha256-CRCoo7aWD8eSxFxWqR18Oj8mKG8DKVVUtRnP83h1baI=",
-   "pom": "sha256-TVJW0+SETmVrDKQF9jUNbyF5XCQ3WzRSUmxUZ92ZtaI="
+  "org/jetbrains/kotlin#kotlin-stdlib/2.3.20": {
+   "jar": "sha256-CuElBKUEDrrzdwOQhINCDRpWJN0dk/NXZl+Md8hIoB4=",
+   "module": "sha256-9Os0T8TR46KK4WwIbsPkL1I3O0ZtQwgYL7OG45LA76M=",
+   "pom": "sha256-yDwC2afi6VRzBJHDPC8dwDwnZi4ntWbsK0TS0Bhjm5g="
   },
-  "org/jetbrains/kotlin#kotlin-tooling-core/2.3.0": {
+  "org/jetbrains/kotlin#kotlin-tooling-core/2.3.20": {
    "jar": "sha256-NnFCeBKZvA+RIMHe7A5ik0oa+ep/AaqpxaU1TcXY19k=",
-   "pom": "sha256-tQ6FtLEYwSIjge0c67K6lqfeLdrtti3aZ9SuBqGiXTc="
+   "pom": "sha256-R+Ou/SS1vmLYB7bLzXnFW4P5S1XP4Y79xuM84RvxkOQ="
   },
-  "org/jetbrains/kotlin#kotlin-util-io/2.3.0": {
-   "jar": "sha256-HJEgPyfnO5aI3f4aiAIyjTXrcPpV9eE96ttyHnj5KqQ=",
-   "pom": "sha256-hvmuNH2YfMwY2aEJ7tLlVDvjj/SMgdUtKMf6HyBarK8="
+  "org/jetbrains/kotlin#kotlin-util-io/2.3.20": {
+   "jar": "sha256-DnbnRx6RxT6mjS0k7x8p+1kqxfuw0dEPqpFkMO/z2so=",
+   "pom": "sha256-lcKKgo/B8eWeZWOCR6ZPdm2B2LWfbY3r7y0YoMwyH4k="
   },
-  "org/jetbrains/kotlin#kotlin-util-klib-metadata/2.3.0": {
-   "jar": "sha256-JZjCbDTMXGnrAEc0Y+lQrmfpuAln9DoBg8Vn7eZqlxc=",
-   "pom": "sha256-4EB9YmkdWjQWFh/YNztNt0o714bxtILghGGXUQL58+s="
+  "org/jetbrains/kotlin#kotlin-util-klib-metadata/2.3.20": {
+   "jar": "sha256-qJlOC8poRt+xn0WMTMFdexN3nKGw2fNIgLX/LCorc7M=",
+   "pom": "sha256-jxApEHGu+rvY5m/5r3dDojiB1pxqryjhNhbMDpW9F7c="
   },
-  "org/jetbrains/kotlin#kotlin-util-klib/2.3.0": {
-   "jar": "sha256-ZLugCZZqAoGG2e5waw3ID+phwK5usXJe0dfXDvIrUuE=",
-   "pom": "sha256-lzWjPLZJg7qg0S3AyOGTSw5VLmvMh2chrFWKmCKFC/4="
+  "org/jetbrains/kotlin#kotlin-util-klib/2.3.20": {
+   "jar": "sha256-lWK407egS+uisUwFZx5xOFnqVLvAohB+ZbK88nP6hEg=",
+   "pom": "sha256-WlhMPMK6O0HR5c1+eiCDV2wbjDl6ebuBY2dtjvew6hc="
   },
   "org/jetbrains/kotlinx#kotlinx-coroutines-bom/1.8.0": {
    "pom": "sha256-Ejnp2+E5fNWXE0KVayURvDrOe2QYQuQ3KgiNz6i5rVU="
@@ -524,9 +524,9 @@
    "jar": "sha256-ew8ZckCCy/y8ZuWr6iubySzwih6hHhkZM+1DgB6zzQU=",
    "pom": "sha256-yUkPZVEyMo3yz7z990P1P8ORbWwdEENxdabKbjpndxw="
   },
-  "org/jetbrains/kotlin#kotlin-assignment-compiler-plugin-embeddable/2.3.0": {
-   "jar": "sha256-1D+qszfzaY6NrOZSXSzXwq66ewNZOEhYZBZP5wLnM70=",
-   "pom": "sha256-UttpIUdRA18/LYUvJDCC5x566wenFs2eCHskuYJ6Uio="
+  "org/jetbrains/kotlin#kotlin-assignment-compiler-plugin-embeddable/2.3.20": {
+   "jar": "sha256-EjVTkgnMVtLi7G+XeYaHiHK3Cgh4H2Sv/0Ubwfe9VrE=",
+   "pom": "sha256-m9zHQ84iL4oxnuYJe2Cq7unmvqe1vzKXYVp1tLpsFDM="
   },
   "org/jetbrains/kotlin#kotlin-bom/2.3.20": {
    "pom": "sha256-/Xh6DvTZY/qdKlGniMoyLNO3F8sDrPnZ5BlNZ21cwS8="
@@ -534,33 +534,37 @@
   "org/jetbrains/kotlin#kotlin-bom/2.3.21": {
    "pom": "sha256-lQcEutBMUUNlbPyh0sV08l/K2crDOQWrIqV+n997/Yg="
   },
-  "org/jetbrains/kotlin#kotlin-build-tools-api/2.3.0": {
-   "jar": "sha256-xsCc8oU0VySfcHyGOCESQJ1aVfULa4Vouk9TDdAD/tw=",
-   "pom": "sha256-FzTIvg4nFXJ3AkW01gbOW7iBbosNHA9+euEcEMLKF1s="
+  "org/jetbrains/kotlin#kotlin-build-tools-api/2.3.20": {
+   "jar": "sha256-IvGrIjhUuUkJn2slnO9UHVtYo2Q9+aScRXfGPEFuhDs=",
+   "pom": "sha256-G14LLDaQXcL1XgpLeBKuY+MSXe/PaG0sD0kPg7c9nV4="
   },
-  "org/jetbrains/kotlin#kotlin-build-tools-compat/2.3.0": {
-   "jar": "sha256-AJST4crwTIKF8f7RV7uraINV2wTS3q7E9aD5tjX4ZuU=",
-   "pom": "sha256-ayMWTiKBY/1j+Bf7LF3ifW6cNAO3Y8y6BoBYTyF/jjI="
+  "org/jetbrains/kotlin#kotlin-build-tools-compat/2.3.20": {
+   "jar": "sha256-RMMHtO3UysUflgqBNBEtZkyTB2cAzaXoZulNmkKWNA4=",
+   "pom": "sha256-rpC+JesEdhCNlo6+Mqjd9SXhQIhYj6BUc9sSgVoPG3Q="
   },
-  "org/jetbrains/kotlin#kotlin-build-tools-impl/2.3.0": {
-   "jar": "sha256-k6Xo/7EACAHIMqhisjvZdm9ETm9sGFwysftXh3+1zqM=",
-   "pom": "sha256-AKelPNgr5ws234oCI6Wrhhoqb/txnZt3M3XId8idugQ="
+  "org/jetbrains/kotlin#kotlin-build-tools-cri-impl/2.3.20": {
+   "jar": "sha256-VOztYw8oEkzP4uRk5srMKB5SiopQqJclchVUyWk1SP4=",
+   "pom": "sha256-5zeMZYHvXw4stA46TOxR0rlj5iVkWpK2fqCVJa+XxMM="
   },
-  "org/jetbrains/kotlin#kotlin-compiler-embeddable/2.3.0": {
-   "jar": "sha256-jb2IL6WMPRfmg6JzkCiDFfi0kPjj47G+TcPigNN+KFo=",
-   "pom": "sha256-zOmxEfIRZgxcRTk+dI30aVC2HAEUfgdzttxxnui7d6g="
+  "org/jetbrains/kotlin#kotlin-build-tools-impl/2.3.20": {
+   "jar": "sha256-loG8IWSovZ9t30wIXPSoNrktJ1BmZ9c7q59thVM2yRA=",
+   "pom": "sha256-gswavl5j0/5nV+eXKE8F25r9fq3D6D0ROcOlW2TUstU="
   },
-  "org/jetbrains/kotlin#kotlin-compiler-runner/2.3.0": {
-   "jar": "sha256-hwl38pYFQ2xesiV7nI5dZPMoLyqI7e5FRNNOxF8Wpqc=",
-   "pom": "sha256-ov8zZnin9TpEOSv8bFK2gS7dxz5AghyQfyomQWeeDrs="
+  "org/jetbrains/kotlin#kotlin-compiler-embeddable/2.3.20": {
+   "jar": "sha256-l2+YnQtfXYDo6KitS3PaC/wn/dllufo4Nisr557MEzc=",
+   "pom": "sha256-DDWu7jcvB1FOvtN7lAe44RgdFCd1UTnlzudxnKBf5+g="
   },
-  "org/jetbrains/kotlin#kotlin-daemon-client/2.3.0": {
-   "jar": "sha256-sr5naIyvEaE41a4M4SNTga2asN25OVqwb42EagtGYBc=",
-   "pom": "sha256-teLnTuXC+I/Qi/g+7GRx9rvKeqEhWYgCtsMsVuhwYCY="
+  "org/jetbrains/kotlin#kotlin-compiler-runner/2.3.20": {
+   "jar": "sha256-wGnzCkA75wyBUviqnyXsy6GI7q1UJjrgKvFEIUN6Igg=",
+   "pom": "sha256-jYTqDt1gs4vOpWLeUXgVKiZxqaAFPWcPkxRSs9sBMig="
   },
-  "org/jetbrains/kotlin#kotlin-daemon-embeddable/2.3.0": {
-   "jar": "sha256-ObywLYwpOqZ4VUyLSdf/hGVwIXCSg8YYbjpAgGr5vRA=",
-   "pom": "sha256-TI3aucQLMNAbhc/qHxd31zUlybcWQ+YlDGV2/H0fwRI="
+  "org/jetbrains/kotlin#kotlin-daemon-client/2.3.20": {
+   "jar": "sha256-xxp8G+j7/wTgr0XJ7oy3ph2JU7ymuL8iWlcZxyWpC0Q=",
+   "pom": "sha256-nnyLgHJBF/cqrOZfa+SNg224/Dl1OtlR8ruQhi1+cIA="
+  },
+  "org/jetbrains/kotlin#kotlin-daemon-embeddable/2.3.20": {
+   "jar": "sha256-iHC6uEC4CHyWxN3AYIi0rt9RMcQIrzZ0MGME8flq8/Q=",
+   "pom": "sha256-YVQOWzoywLEZYkSWZZJMbNdVTqmu4IVb2OT1t/YQoKs="
   },
   "org/jetbrains/kotlin#kotlin-reflect/1.6.10": {
    "jar": "sha256-MnesECrheq0QpVq+x1/1aWyNEJeQOWQ0tJbnUIeFQgM=",
@@ -574,37 +578,37 @@
    "jar": "sha256-ggkIOkp8TkdtmEKweDCPqWqW8Hpr2Z8F81hu4TKJqyY=",
    "pom": "sha256-TidHQGbbg/uixZB0KJunEr6MhRV83guQUCmkRcJ19bo="
   },
-  "org/jetbrains/kotlin#kotlin-reflect/2.3.0": {
-   "jar": "sha256-cU30voGVRf9N4fNqohg+DeqUtMjN98op6ciZGbrzY2I=",
-   "pom": "sha256-89F2jvL7UxBIPb6R4w6fo2x7Pi/e5pRaCLujEBQtKcE="
+  "org/jetbrains/kotlin#kotlin-reflect/2.3.20": {
+   "jar": "sha256-40b6PD/0RR9fcHoxKIf9TIVV2kjMFfqdsrqTwz+J+BM=",
+   "pom": "sha256-iwC9L+srtVON85aVQXTZ3cDsVA00ElhjA1ObHpZVwzM="
   },
   "org/jetbrains/kotlin#kotlin-reflect/2.3.21": {
    "jar": "sha256-M+N9nfqGx6Kas06XW19KEoe0WIeGEQUfNIVlIiDBoss=",
    "pom": "sha256-fjwv5c80lKm0dSVYDDjDXEPW42guagsvVllU4Zpy1jk="
   },
-  "org/jetbrains/kotlin#kotlin-sam-with-receiver-compiler-plugin-embeddable/2.3.0": {
-   "jar": "sha256-QOPhi7jFUjLuZSXOV9F7hl5WcosFK/DBDnvsHQhJmMo=",
-   "pom": "sha256-BnzIEOCaYeFufoe1Kk3WR+FfYLd+PaDRsVPz+A7r8wM="
+  "org/jetbrains/kotlin#kotlin-sam-with-receiver-compiler-plugin-embeddable/2.3.20": {
+   "jar": "sha256-hvch6zOswK/QbdZoDnenZLY0qb2LEbc77yv8CQnxiUA=",
+   "pom": "sha256-Vg23nSOjmud5dqVmkZRw3sQazHeqUa6qVlzAKbkXGqw="
   },
-  "org/jetbrains/kotlin#kotlin-script-runtime/2.3.0": {
-   "jar": "sha256-24JpYTcdZgUxjZxOS/zb+slMOgiSzcq9VSJIcP6tV/E=",
-   "pom": "sha256-20CN5tumaQeVvFOkoPhbM8en1qzLZ94ZAmQPr1QfL1s="
+  "org/jetbrains/kotlin#kotlin-script-runtime/2.3.20": {
+   "jar": "sha256-b8232m5lz4zEPlqrq5S9zEiCXnkzaG+KG/aU64j44A4=",
+   "pom": "sha256-ZgmWdnA6CB/ZrEMTlmWIPlwUUCC2QHWd4FOdiRb/JH8="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-common/2.3.0": {
-   "jar": "sha256-QlK3gs2lP8v9lTuQrwMlDiGX/+9uVavZsKLkj5Pv8lM=",
-   "pom": "sha256-9AuKrV3x68riUJLMM7hpP6Qw5TRCC6Wup/AGsvMrQw4="
+  "org/jetbrains/kotlin#kotlin-scripting-common/2.3.20": {
+   "jar": "sha256-tMI52HsjvhgvBb9Xz16B+V1wv370qYnrmLczicbryJ8=",
+   "pom": "sha256-h+/vFa4RjxNDUmPrEJcAZGD7qDlph340uKcvDjPIOsk="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-compiler-embeddable/2.3.0": {
-   "jar": "sha256-ZxRdvqkxlNuyJT4vNaCp/ngBfCy84+zbSx/0P/9HGNU=",
-   "pom": "sha256-FjR61xI8BuiaUu+twxjZaick9UqBx+xZTA1ALh8eZFk="
+  "org/jetbrains/kotlin#kotlin-scripting-compiler-embeddable/2.3.20": {
+   "jar": "sha256-vVX49hvUHOxSllbC1HeEvLpawmDpT0FWwnLDFJZu71k=",
+   "pom": "sha256-1l8YaBd9zkuKkv+93bVrFzH5+66IyOcw7XvLcAy7soo="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-compiler-impl-embeddable/2.3.0": {
-   "jar": "sha256-MsdCfxBeYtT07/MDXaHkKAsndxvkrWFDuoZV0Yh3IM0=",
-   "pom": "sha256-TPG5v5rmnHbz6nWnhW3GbeRGeKfHQXFa6cFdtA7Nfv0="
+  "org/jetbrains/kotlin#kotlin-scripting-compiler-impl-embeddable/2.3.20": {
+   "jar": "sha256-gG/WOzvOxea17rGghD1qsJTVV4aoRl5HSiQ5KVocCiU=",
+   "pom": "sha256-xKkTo4XzTjKlbyBd8XoI3U4RfDBsV+XkfcXUlSPw6+E="
   },
-  "org/jetbrains/kotlin#kotlin-scripting-jvm/2.3.0": {
-   "jar": "sha256-NpM+uDYZqKZeBB36m2ktNOB9V8b9Yv43HIu/BYgL7Ec=",
-   "pom": "sha256-qemsNTtIBUA7A3spmZpUnxvESATniVnYT/sbwzBF8kc="
+  "org/jetbrains/kotlin#kotlin-scripting-jvm/2.3.20": {
+   "jar": "sha256-cEfOA1P0kSXDx0Z5LU92wyZde3L+YmlLfuwHW7oCUow=",
+   "pom": "sha256-B8Ba4tHs4K4e1mAQ7TGNnN3LNYcEbGM8GGvRTM8EYdU="
   },
   "org/jetbrains/kotlin#kotlin-stdlib-jdk7/2.2.20": {
    "jar": "sha256-O9Juy20Sl4xcTgtB92yf9VH6wqXmJoQnqdKgzfilrZE=",
@@ -627,11 +631,6 @@
    "module": "sha256-v7xlfd06jjfkyK1BeWjV6wsLFxyfzkj5YsKtMu5DTCE=",
    "pom": "sha256-zzH5IxlsY67ezQpXwkJpvTcCpOR8C/C9ZLWtpd5SInI="
   },
-  "org/jetbrains/kotlin#kotlin-stdlib/2.3.0": {
-   "jar": "sha256-iHWHyRcTJQrVL+FK2RZtBCwzg1BJiQ6UN/NV/8WhlbE=",
-   "module": "sha256-CRCoo7aWD8eSxFxWqR18Oj8mKG8DKVVUtRnP83h1baI=",
-   "pom": "sha256-TVJW0+SETmVrDKQF9jUNbyF5XCQ3WzRSUmxUZ92ZtaI="
-  },
   "org/jetbrains/kotlin#kotlin-stdlib/2.3.20": {
    "jar": "sha256-CuElBKUEDrrzdwOQhINCDRpWJN0dk/NXZl+Md8hIoB4=",
    "module": "sha256-9Os0T8TR46KK4WwIbsPkL1I3O0ZtQwgYL7OG45LA76M=",
@@ -642,9 +641,9 @@
    "module": "sha256-e06ksiQrsXektKu2PD89hXMx1A01hl42/MPbZm7BAXQ=",
    "pom": "sha256-PgtI2qFNxz+AKdjZ4V7TKUA3fK97kVUQ+I0zIZs1AYY="
   },
-  "org/jetbrains/kotlin#kotlin-tooling-core/2.3.0": {
+  "org/jetbrains/kotlin#kotlin-tooling-core/2.3.20": {
    "jar": "sha256-NnFCeBKZvA+RIMHe7A5ik0oa+ep/AaqpxaU1TcXY19k=",
-   "pom": "sha256-tQ6FtLEYwSIjge0c67K6lqfeLdrtti3aZ9SuBqGiXTc="
+   "pom": "sha256-R+Ou/SS1vmLYB7bLzXnFW4P5S1XP4Y79xuM84RvxkOQ="
   },
   "org/jetbrains/kotlinx#kotlinx-coroutines-bom/1.10.2": {
    "pom": "sha256-+vDGU45T3cBJmmNmTY52PCFlgLLhjnIsy98bQxpq/iY="
diff --git a/pkgs/by-name/si/simdjson/package.nix b/pkgs/by-name/si/simdjson/package.nix
index 575f604ca34c..3cb507297c47 100644
--- a/pkgs/by-name/si/simdjson/package.nix
+++ b/pkgs/by-name/si/simdjson/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "simdjson";
-  version = "4.6.0";
+  version = "4.6.4";
 
   src = fetchFromGitHub {
     owner = "simdjson";
     repo = "simdjson";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VGErBWAHk63XMv8yC+Na+gXHByhYhtIEMSBySwIDlXk=";
+    hash = "sha256-8oQzsR7DSaNTN9su1uI9tRQ9HvOwXShPwSrnQj8+lGM=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/si/sing-box/package.nix b/pkgs/by-name/si/sing-box/package.nix
index 9f8d4eec4e87..30453fd03a3c 100644
--- a/pkgs/by-name/si/sing-box/package.nix
+++ b/pkgs/by-name/si/sing-box/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "sing-box";
-  version = "1.13.13";
+  version = "1.13.14";
 
   src = fetchFromGitHub {
     owner = "SagerNet";
     repo = "sing-box";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RsiBxPQOE4rE3cFRjl81x1uIG2A4/smSBUg+G0vm7uQ=";
+    hash = "sha256-ODQ1i2lOuQLb3LDq6ONqHJQ7sT7dXICCJoyW/I9zF38=";
   };
 
-  vendorHash = "sha256-FUzGQx0TIJdWWYtF6781BSXLViFrXbPEdLKjuvtuleM=";
+  vendorHash = "sha256-Znk4bsm9TUseEuCQszs9rvVx8TDu+cwEVfVOhw7exYA=";
 
   tags = [
     "with_gvisor"
diff --git a/pkgs/by-name/sk/skills/package.nix b/pkgs/by-name/sk/skills/package.nix
index 86c8e7ca336c..b95b16b079dd 100644
--- a/pkgs/by-name/sk/skills/package.nix
+++ b/pkgs/by-name/sk/skills/package.nix
@@ -14,13 +14,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "skills";
-  version = "1.5.11";
+  version = "1.5.13";
 
   src = fetchFromGitHub {
     owner = "vercel-labs";
     repo = "skills";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IAbkeN1ZP8z5xTaZafRLMhAlhXBDw+fkfTvjZBoGeqw=";
+    hash = "sha256-NfjEt37jfA/d0v6gXRjlvsUj0xf8h+NquVUZEKaMFL4=";
   };
 
   pnpmDeps = fetchPnpmDeps {
diff --git a/pkgs/by-name/sm/smtprelay/package.nix b/pkgs/by-name/sm/smtprelay/package.nix
index db4906615ad3..a3f7f7c05123 100644
--- a/pkgs/by-name/sm/smtprelay/package.nix
+++ b/pkgs/by-name/sm/smtprelay/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "smtprelay";
-  version = "1.13.3";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner = "decke";
     repo = "smtprelay";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-o4nB1j2NmqeQeTpJoY8mKUv60L8dTLQxjNtfCIZ2u0M=";
+    hash = "sha256-tvmspqXzsBTEmW8b87FtqGgF4pMWpssN0AH5OoeQR44=";
   };
 
-  vendorHash = "sha256-d+NSghVEdEiHIUGR6MIj7d3dHYGtAeLbdJ7zwhHxOPo=";
+  vendorHash = "sha256-QowoS+qQy/AhhyW8F6OWYaMQ4BubszIPom1wt3Tzdxc=";
 
   subPackages = [
     "."
diff --git a/pkgs/by-name/sp/spedread/package.nix b/pkgs/by-name/sp/spedread/package.nix
index c65b45dd863f..be956139a30c 100644
--- a/pkgs/by-name/sp/spedread/package.nix
+++ b/pkgs/by-name/sp/spedread/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "spedread";
-  version = "2.8.0";
+  version = "2.8.1";
 
   src = fetchFromGitHub {
     owner = "Darazaki";
     repo = "Spedread";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IZhvKZ4kllL6ItUn47+EnUwVPKXC0mz2Mvsg/7CT5Qw=";
+    hash = "sha256-+1fNQT3UXGPgVKvHBlU4Om70ePCKJUXg1NLic/l+Guk=";
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/sp/spirit/package.nix b/pkgs/by-name/sp/spirit/package.nix
index dde747f71462..39d184f86f18 100644
--- a/pkgs/by-name/sp/spirit/package.nix
+++ b/pkgs/by-name/sp/spirit/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "spirit";
-  version = "0.14.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "block";
     repo = "spirit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-a7URE8DViJxpgTrdmr9U84Y38GihWYCIGobeUwIb0ls=";
+    hash = "sha256-kcFNDW02ReUEbwLVos2Jth/bSAEAWZZ1Tpv3xpxY9jE=";
   };
 
-  vendorHash = "sha256-qQZOH7gIuPhScXF6Ux6jAvYe6U3UcbtvC3NdNF+zcPQ=";
+  vendorHash = "sha256-qgLmkZ1pYvnZ5lr9GCvg9mC8oW/34BjoFXY3NKzpRwA=";
 
   subPackages = [ "cmd/spirit" ];
 
diff --git a/pkgs/by-name/st/stevenblack-blocklist/package.nix b/pkgs/by-name/st/stevenblack-blocklist/package.nix
index c77cf5cc28c3..6da4571b4574 100644
--- a/pkgs/by-name/st/stevenblack-blocklist/package.nix
+++ b/pkgs/by-name/st/stevenblack-blocklist/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "stevenblack-blocklist";
-  version = "3.16.89";
+  version = "3.16.91";
 
   src = fetchFromGitHub {
     owner = "StevenBlack";
     repo = "hosts";
     tag = finalAttrs.version;
-    hash = "sha256-HRk8pd3FAj5P3KObzO91NF2BrYV8Wo7hDA8xWYsbTm4=";
+    hash = "sha256-ZW1sbLqlGv7DlbJ1BnkyGbPtCKtlmZWvxNS9NWxmle8=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/su/sumo/package.nix b/pkgs/by-name/su/sumo/package.nix
index 24ffb06f0232..631ab932a842 100644
--- a/pkgs/by-name/su/sumo/package.nix
+++ b/pkgs/by-name/su/sumo/package.nix
@@ -37,13 +37,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sumo";
-  version = "1.27.0";
+  version = "1.27.1";
 
   src = fetchFromGitHub {
     owner = "eclipse-sumo";
     repo = "sumo";
     tag = "v${lib.replaceStrings [ "." ] [ "_" ] finalAttrs.version}";
-    hash = "sha256-fi/36vgnxRezqkEEPRNxz/PBjg2hvwI9XpaN6IT7298=";
+    hash = "sha256-8yYm6HIVTmDoHrlMw5cUjxh6QtN5p8G+fGA/XTl/UnI=";
     fetchSubmodules = true;
   };
 
diff --git a/pkgs/by-name/su/sus-compiler/Cargo.lock b/pkgs/by-name/su/sus-compiler/Cargo.lock
index 198767e6994c..c1e23a94ca5c 100644
--- a/pkgs/by-name/su/sus-compiler/Cargo.lock
+++ b/pkgs/by-name/su/sus-compiler/Cargo.lock
@@ -76,12 +76,6 @@ dependencies = [
  "windows-sys",
 ]
 
-[[package]]
-name = "anyhow"
-version = "1.0.102"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
-
 [[package]]
 name = "ariadne"
 version = "0.6.0"
@@ -94,9 +88,9 @@ dependencies = [
 
 [[package]]
 name = "autocfg"
-version = "1.5.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
 [[package]]
 name = "bitflags"
@@ -106,21 +100,21 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.11.0"
+version = "2.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "843867be96c8daad0d758b57df9392b6d8d271134fce549de6ce169ff98a92af"
+checksum = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8"
 
 [[package]]
 name = "bumpalo"
-version = "3.20.2"
+version = "3.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
 
 [[package]]
 name = "cc"
-version = "1.2.58"
+version = "1.2.65"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1e928d4b69e3077709075a938a05ffbedfa53a84c8f766efbf8220bb1ff60e1"
+checksum = "e228eec9be7c17ccb640b59b36a5cd805ea2a564a4c5e162c2f659fea30d3b96"
 dependencies = [
  "find-msvc-tools",
  "shlex",
@@ -145,9 +139,9 @@ dependencies = [
 
 [[package]]
 name = "chrono"
-version = "0.4.44"
+version = "0.4.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
+checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
 dependencies = [
  "iana-time-zone",
  "js-sys",
@@ -164,9 +158,9 @@ checksum = "14c638459986b83c2b885179bd4ea6a2cbb05697b001501a56adb3a3d230803b"
 
 [[package]]
 name = "clap"
-version = "4.6.0"
+version = "4.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b193af5b67834b676abd72466a96c1024e6a6ad978a1f484bd90b85c94041351"
+checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -187,9 +181,9 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.6.0"
+version = "4.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1110bd8a634a1ab8cb04345d8d878267d57c3cf1b38d91b71af6686408bbca6a"
+checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9"
 dependencies = [
  "heck 0.5.0",
  "proc-macro2",
@@ -328,10 +322,28 @@ dependencies = [
 ]
 
 [[package]]
-name = "foldhash"
-version = "0.1.5"
+name = "futures-core"
+version = "0.3.32"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9c4f5dac5e15c24eb999c26181a6ca40b39fe946cbe4c263c7209467bc83af2"
+checksum = "7e3450815272ef58cec6d564423f6e755e25379b217b0bc688e295ba24df6b1d"
+
+[[package]]
+name = "futures-task"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
+
+[[package]]
+name = "futures-util"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "389ca41296e6190b48053de0321d02a77f32f8a5d2461dd38762c0593805c6d6"
+dependencies = [
+ "futures-core",
+ "futures-task",
+ "pin-project-lite",
+ "slab",
+]
 
 [[package]]
 name = "getrandom"
@@ -346,32 +358,21 @@ dependencies = [
 
 [[package]]
 name = "getrandom"
-version = "0.4.2"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0de51e6874e94e7bf76d726fc5d13ba782deca734ff60d5bb2fb2607c7406555"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
 dependencies = [
  "cfg-if",
  "libc",
  "r-efi",
  "rand_core",
- "wasip2",
- "wasip3",
 ]
 
 [[package]]
 name = "hashbrown"
-version = "0.15.5"
+version = "0.17.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9229cfe53dfd69f0609a49f65461bd93001ea1ef889cd5529dd176593f5338a1"
-dependencies = [
- "foldhash",
-]
-
-[[package]]
-name = "hashbrown"
-version = "0.16.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "841d1cc9bed7f9236f321df977030373f4a4163ae1a7dbfe1a51a2c1a51d9100"
+checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
 
 [[package]]
 name = "heck"
@@ -419,22 +420,14 @@ dependencies = [
  "static_assertions",
 ]
 
-[[package]]
-name = "id-arena"
-version = "2.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
-
 [[package]]
 name = "indexmap"
-version = "2.13.0"
+version = "2.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7714e70437a7dc3ac8eb7e6f8df75fd8eb422675fc7678aff7364301092b1017"
+checksum = "d466e9454f08e4a911e14806c24e16fba1b4c121d1ea474396f396069cf949d9"
 dependencies = [
  "equivalent",
- "hashbrown 0.16.1",
- "serde",
- "serde_core",
+ "hashbrown",
 ]
 
 [[package]]
@@ -451,31 +444,26 @@ checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
 [[package]]
 name = "js-sys"
-version = "0.3.92"
+version = "0.3.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cc4c90f45aa2e6eacbe8645f77fdea542ac97a494bcd117a67df9ff4d611f995"
+checksum = "03d04c30968dffe80775bd4d7fb676131cd04a1fb46d2686dbffbaec2d9dfd31"
 dependencies = [
- "once_cell",
+ "cfg-if",
+ "futures-util",
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "leb128fmt"
-version = "0.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
-
 [[package]]
 name = "libc"
-version = "0.2.183"
+version = "0.2.186"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5b646652bf6661599e1da8901b3b9522896f01e736bad5f723fe7a3a27f899d"
+checksum = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66"
 
 [[package]]
 name = "libredox"
-version = "0.1.15"
+version = "0.1.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ddbf48fd451246b1f8c2610bd3b4ac0cc6e149d89832867093ab69a17194f08"
+checksum = "f02ab6bace2054fb888a3c16f990117b579d14a3088e472d63c6011fa185c9d3"
 dependencies = [
  "libc",
 ]
@@ -488,9 +476,9 @@ checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
 
 [[package]]
 name = "log"
-version = "0.4.29"
+version = "0.4.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
 
 [[package]]
 name = "lsp-server"
@@ -520,9 +508,9 @@ dependencies = [
 
 [[package]]
 name = "memchr"
-version = "2.8.0"
+version = "2.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
+checksum = "88904434abc2901f197fe8cc55f0445e7ded921dba5911dad2e2b39b48e663c4"
 
 [[package]]
 name = "num-traits"
@@ -585,14 +573,10 @@ dependencies = [
 ]
 
 [[package]]
-name = "prettyplease"
-version = "0.2.37"
+name = "pin-project-lite"
+version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "479ca8adacdd7ce8f1fb39ce9ecccbfe93a3f1344b3d0d97f20bc0196208f62b"
-dependencies = [
- "proc-macro2",
- "syn",
-]
+checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
 [[package]]
 name = "proc-macro2"
@@ -617,10 +601,28 @@ dependencies = [
 ]
 
 [[package]]
-name = "quote"
-version = "1.0.45"
+name = "pulldown-cmark"
+version = "0.13.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
+checksum = "e9f068eba8e7071c5f9511831b44f32c740d5adf574e990f946ddb53db2f314e"
+dependencies = [
+ "bitflags 2.13.0",
+ "memchr",
+ "pulldown-cmark-escape",
+ "unicase",
+]
+
+[[package]]
+name = "pulldown-cmark-escape"
+version = "0.11.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "007d8adb5ddab6f8e3f491ac63566a7d5002cc7ed73901f72057943fa71ae1ae"
+
+[[package]]
+name = "quote"
+version = "1.0.46"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
 dependencies = [
  "proc-macro2",
 ]
@@ -633,20 +635,20 @@ checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
 
 [[package]]
 name = "rand"
-version = "0.10.0"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bc266eb313df6c5c09c1c7b1fbe2510961e5bcd3add930c1e31f7ed9da0feff8"
+checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
 dependencies = [
  "chacha20",
- "getrandom 0.4.2",
+ "getrandom 0.4.3",
  "rand_core",
 ]
 
 [[package]]
 name = "rand_core"
-version = "0.10.0"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c8d0fd677905edcbeedbf2edb6494d676f0e98d54d5cf9bda0b061cb8fb8aba"
+checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
 
 [[package]]
 name = "redox_users"
@@ -661,9 +663,9 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.12.3"
+version = "1.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e10754a14b9137dd7b1e3e5b0493cc9171fdd105e0ab477f51b72e7f3ac0e276"
+checksum = "f1292b7759ae1cb9ec195452d1390a074f0cd8541ab7a5a8c31cd6db45d4a6ba"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -684,9 +686,9 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.10"
+version = "0.8.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dc897dd8d9e8bd1ed8cdad82b5966c3e0ecae09fb1907d58efaa013543185d0a"
+checksum = "d6f6ff9a378485b298a5286656da665ba74413d36db0979633275d2e708145d4"
 
 [[package]]
 name = "replace_with"
@@ -700,7 +702,7 @@ version = "1.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
 dependencies = [
- "bitflags 2.11.0",
+ "bitflags 2.13.0",
  "errno",
  "libc",
  "linux-raw-sys",
@@ -722,12 +724,6 @@ dependencies = [
  "winapi-util",
 ]
 
-[[package]]
-name = "semver"
-version = "1.0.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d767eb0aabc880b29956c35734170f26ed551a859dbd361d140cdbeca61ab1e2"
-
 [[package]]
 name = "serde"
 version = "1.0.228"
@@ -760,9 +756,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.149"
+version = "1.0.150"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
 dependencies = [
  "indexmap",
  "itoa",
@@ -785,9 +781,15 @@ dependencies = [
 
 [[package]]
 name = "shlex"
-version = "1.3.0"
+version = "2.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"
+
+[[package]]
+name = "slab"
+version = "0.4.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0c790de23124f9ab44544d7ac05d60440adc586479ce501c1d6d7da3cd8c9cf5"
 
 [[package]]
 name = "static_assertions"
@@ -809,7 +811,7 @@ checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
 [[package]]
 name = "sus-proc-macro"
-version = "0.3.10"
+version = "0.4.0"
 dependencies = [
  "quote",
  "regex",
@@ -820,7 +822,7 @@ dependencies = [
 
 [[package]]
 name = "sus_compiler"
-version = "0.3.10"
+version = "0.4.0"
 dependencies = [
  "ariadne",
  "chrono",
@@ -837,6 +839,7 @@ dependencies = [
  "lsp-types",
  "ordered-float",
  "ouroboros",
+ "pulldown-cmark",
  "rand",
  "replace_with",
  "same-file",
@@ -851,9 +854,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.117"
+version = "2.0.118"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
+checksum = "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -892,9 +895,9 @@ dependencies = [
 
 [[package]]
 name = "tree-sitter"
-version = "0.26.7"
+version = "0.26.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7a6592b1aec0109df37b6bafea77eb4e61466e37b0a5a98bef4f89bfb81b7a2"
+checksum = "4dab76d0b724ba557954125188cf0633a1ca43199ced82d95c7b9c32cc3de1f3"
 dependencies = [
  "cc",
  "regex",
@@ -912,7 +915,7 @@ checksum = "009994f150cc0cd50ff54917d5bc8bffe8cad10ca10d81c34da2ec421ae61782"
 
 [[package]]
 name = "tree-sitter-sus"
-version = "0.3.10"
+version = "0.4.0"
 dependencies = [
  "cc",
  "tree-sitter",
@@ -930,6 +933,12 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ccb97dac3243214f8d8507998906ca3e2e0b900bf9bf4870477f125b82e68f6e"
 
+[[package]]
+name = "unicase"
+version = "2.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dbc4bc3a9f746d862c45cb89d705aa10f187bb96c76001afab07a0d35ce60142"
+
 [[package]]
 name = "unicode-ident"
 version = "1.0.24"
@@ -942,12 +951,6 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
 
-[[package]]
-name = "unicode-xid"
-version = "0.2.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ebc1c04c71510c7f702b52b7c350734c9ff1295c464a03335b00bb84fc54f853"
-
 [[package]]
 name = "utf8parse"
 version = "0.2.2"
@@ -966,29 +969,11 @@ version = "0.11.1+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"
 
-[[package]]
-name = "wasip2"
-version = "1.0.2+wasi-0.2.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9517f9239f02c069db75e65f174b3da828fe5f5b945c4dd26bd25d89c03ebcf5"
-dependencies = [
- "wit-bindgen",
-]
-
-[[package]]
-name = "wasip3"
-version = "0.4.0+wasi-0.3.0-rc-2026-01-06"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5428f8bf88ea5ddc08faddef2ac4a67e390b88186c703ce6dbd955e1c145aca5"
-dependencies = [
- "wit-bindgen",
-]
-
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.115"
+version = "0.2.125"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6523d69017b7633e396a89c5efab138161ed5aafcbc8d3e5c5a42ae38f50495a"
+checksum = "8ddb3f79143bced6de84270411622a2699cee572fc0875aeaf1e7867cf9fca1a"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -999,9 +984,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.115"
+version = "0.2.125"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e3a6c758eb2f701ed3d052ff5737f5bfe6614326ea7f3bbac7156192dc32e67"
+checksum = "4e21a184b13fb19e157296e2c46056aec9092264fab83e4ba59e68c61b323c3d"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -1009,9 +994,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.115"
+version = "0.2.125"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "921de2737904886b52bcbb237301552d05969a6f9c40d261eb0533c8b055fedf"
+checksum = "fecefd9c35bd935a20fc3fc344b5f29138961e4f47fb03297d88f2587afb5ebd"
 dependencies = [
  "bumpalo",
  "proc-macro2",
@@ -1022,47 +1007,13 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.115"
+version = "0.2.125"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a93e946af942b58934c604527337bad9ae33ba1d5c6900bbb41c2c07c2364a93"
+checksum = "23939e44bb9a5d7576fa2b563dc2e136628f1224e88a8deed09e04858b77871f"
 dependencies = [
  "unicode-ident",
 ]
 
-[[package]]
-name = "wasm-encoder"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "990065f2fe63003fe337b932cfb5e3b80e0b4d0f5ff650e6985b1048f62c8319"
-dependencies = [
- "leb128fmt",
- "wasmparser",
-]
-
-[[package]]
-name = "wasm-metadata"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb0e353e6a2fbdc176932bbaab493762eb1255a7900fe0fea1a2f96c296cc909"
-dependencies = [
- "anyhow",
- "indexmap",
- "wasm-encoder",
- "wasmparser",
-]
-
-[[package]]
-name = "wasmparser"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "47b807c72e1bac69382b3a6fb3dbe8ea4c0ed87ff5629b8685ae6b9a611028fe"
-dependencies = [
- "bitflags 2.11.0",
- "hashbrown 0.15.5",
- "indexmap",
- "semver",
-]
-
 [[package]]
 name = "winapi-util"
 version = "0.1.11"
@@ -1140,94 +1091,6 @@ dependencies = [
  "windows-link",
 ]
 
-[[package]]
-name = "wit-bindgen"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d7249219f66ced02969388cf2bb044a09756a083d0fab1e566056b04d9fbcaa5"
-dependencies = [
- "wit-bindgen-rust-macro",
-]
-
-[[package]]
-name = "wit-bindgen-core"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ea61de684c3ea68cb082b7a88508a8b27fcc8b797d738bfc99a82facf1d752dc"
-dependencies = [
- "anyhow",
- "heck 0.5.0",
- "wit-parser",
-]
-
-[[package]]
-name = "wit-bindgen-rust"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b7c566e0f4b284dd6561c786d9cb0142da491f46a9fbed79ea69cdad5db17f21"
-dependencies = [
- "anyhow",
- "heck 0.5.0",
- "indexmap",
- "prettyplease",
- "syn",
- "wasm-metadata",
- "wit-bindgen-core",
- "wit-component",
-]
-
-[[package]]
-name = "wit-bindgen-rust-macro"
-version = "0.51.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c0f9bfd77e6a48eccf51359e3ae77140a7f50b1e2ebfe62422d8afdaffab17a"
-dependencies = [
- "anyhow",
- "prettyplease",
- "proc-macro2",
- "quote",
- "syn",
- "wit-bindgen-core",
- "wit-bindgen-rust",
-]
-
-[[package]]
-name = "wit-component"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9d66ea20e9553b30172b5e831994e35fbde2d165325bec84fc43dbf6f4eb9cb2"
-dependencies = [
- "anyhow",
- "bitflags 2.11.0",
- "indexmap",
- "log",
- "serde",
- "serde_derive",
- "serde_json",
- "wasm-encoder",
- "wasm-metadata",
- "wasmparser",
- "wit-parser",
-]
-
-[[package]]
-name = "wit-parser"
-version = "0.244.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ecc8ac4bc1dc3381b7f59c34f00b67e18f910c2c0f50015669dde7def656a736"
-dependencies = [
- "anyhow",
- "id-arena",
- "indexmap",
- "log",
- "semver",
- "serde",
- "serde_derive",
- "serde_json",
- "unicode-xid",
- "wasmparser",
-]
-
 [[package]]
 name = "yansi"
 version = "1.0.1"
diff --git a/pkgs/by-name/su/sus-compiler/package.nix b/pkgs/by-name/su/sus-compiler/package.nix
index 70e4bc82bad5..d78f6187c6a3 100644
--- a/pkgs/by-name/su/sus-compiler/package.nix
+++ b/pkgs/by-name/su/sus-compiler/package.nix
@@ -9,13 +9,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sus-compiler";
-  version = "0.3.10";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "pc2";
     repo = "sus-compiler";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-gU0PiMZNMYmroNQXD0LGutsr9aYPNI2BGeKB+9Brhqg=";
+    hash = "sha256-RbZRKb5o6ojbpcLNq3v25YhRuDbVyHoEzA2Mr77LTPA=";
     fetchSubmodules = true;
     leaveDotGit = true;
 
diff --git a/pkgs/by-name/ta/tabiew/package.nix b/pkgs/by-name/ta/tabiew/package.nix
index 2ba97b627ce9..6f0fa60f1532 100644
--- a/pkgs/by-name/ta/tabiew/package.nix
+++ b/pkgs/by-name/ta/tabiew/package.nix
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tabiew";
-  version = "0.13.1";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "shshemi";
     repo = "tabiew";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bJ2XxGXnN4++9P7Tb5Vky5DGOHq+/VpFsrbLOboLpZs=";
+    hash = "sha256-gZIPeN7DSOyKf5RGo5ZP+dR4ke8NabVdT0ekQl9DvUM=";
   };
 
-  cargoHash = "sha256-cOxFyY59BOIK8ln6o0pkHpfB16ZlvkY4eX9nwbjB52w=";
+  cargoHash = "sha256-GEAKJECs98WUxJHD5FDmVafplPl7Yj7NGBL0zNRLhak=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/tm/tmux-mem-cpu-load/package.nix b/pkgs/by-name/tm/tmux-mem-cpu-load/package.nix
index a7e3338db5f9..6b271a3c69aa 100644
--- a/pkgs/by-name/tm/tmux-mem-cpu-load/package.nix
+++ b/pkgs/by-name/tm/tmux-mem-cpu-load/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tmux-mem-cpu-load";
-  version = "3.8.2";
+  version = "3.8.3";
 
   src = fetchFromGitHub {
     owner = "thewtex";
     repo = "tmux-mem-cpu-load";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-g++6n6OD9FAw8CtXArKBgNwFf+3v+SBCHmbma7RpMBA=";
+    sha256 = "sha256-nvnfhMS5XjX81ErR8iH8sieuRjRod6PXeuqUrtaKcsA=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/tu/tuicr/package.nix b/pkgs/by-name/tu/tuicr/package.nix
new file mode 100644
index 000000000000..2727432f4a1b
--- /dev/null
+++ b/pkgs/by-name/tu/tuicr/package.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  openssl,
+  git,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "tuicr";
+  version = "0.18.0";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "agavra";
+    repo = "tuicr";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-cMIUVBEtyS+AB9QqqRSu+Rd+9dyMzw+EmHSIzY2UmiQ=";
+  };
+
+  cargoHash = "sha256-ErEpUo9RPOHMHlmlPH2S6jHvnVhi4DKO7EnoMToj5t0=";
+
+  strictDeps = true;
+
+  nativeCheckInputs = [ git ];
+
+  checkFlags = [
+    # expects to be run inside the upstream git repository
+    "--skip=should_return_no_changes_for_clean_repo"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Review AI-generated diffs like a GitHub pull request, right from your terminal";
+    homepage = "https://tuicr.dev";
+    changelog = "https://github.com/agavra/tuicr/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ Br1ght0ne ];
+    mainProgram = "tuicr";
+  };
+})
diff --git a/pkgs/by-name/ty/typescript-go/package.nix b/pkgs/by-name/ty/typescript-go/package.nix
index 6021101f6a9d..6c5ff963c216 100644
--- a/pkgs/by-name/ty/typescript-go/package.nix
+++ b/pkgs/by-name/ty/typescript-go/package.nix
@@ -15,17 +15,17 @@ let
 in
 buildGoModule {
   pname = "typescript-go";
-  version = "0-unstable-2026-06-17";
+  version = "0-unstable-2026-06-25";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "typescript-go";
-    rev = "2fb5d4ce13935aef1f3c2896fad76d0ab4d43604";
-    hash = "sha256-PkMX++B5qsHAib/VHc8QS0WAo9d/jXatlF6sUPymBN4=";
+    rev = "c080da62e73c5ea066b381303c74ae00b53368ac";
+    hash = "sha256-B8CktiQg+JJKE6Lb19LgpAluXI2+ubo5dikEhQQxDs8=";
     fetchSubmodules = false;
   };
 
-  vendorHash = "sha256-EDaok/vDi7r9L3HGiUN8+Xg39cACihHxBn3BQayDs2M=";
+  vendorHash = "sha256-RKlkRodWH6DaAi1CZziBgIOfzFLm8aih+a0kHNekf5U=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/un/unbound/package.nix b/pkgs/by-name/un/unbound/package.nix
index 45cdc57ff0a8..935818521103 100644
--- a/pkgs/by-name/un/unbound/package.nix
+++ b/pkgs/by-name/un/unbound/package.nix
@@ -57,13 +57,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "unbound";
-  version = "1.25.0";
+  version = "1.25.1";
 
   src = fetchFromGitHub {
     owner = "NLnetLabs";
     repo = "unbound";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-BAqGNi5lfYYTQd7CPH0lssLc5/AkeuKSVEFcrF/cNyc=";
+    hash = "sha256-1PXnxCPxoB5IrVBQIsrxiWAq+IoH7Ma9T1TTJsoTJc4=";
   };
 
   outputs = [
diff --git a/pkgs/by-name/va/valkey/package.nix b/pkgs/by-name/va/valkey/package.nix
index 81a40f68bf21..82e625efe933 100644
--- a/pkgs/by-name/va/valkey/package.nix
+++ b/pkgs/by-name/va/valkey/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   lua,
   jemalloc,
   pkg-config,
@@ -25,13 +24,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "valkey";
-  version = "9.0.4";
+  version = "9.1.0";
 
   src = fetchFromGitHub {
     owner = "valkey-io";
     repo = "valkey";
     rev = finalAttrs.version;
-    hash = "sha256-FDm6i6G6h9WapMTj7ke4YtOjZ4rwIJZGONunQi0v7CE=";
+    hash = "sha256-RMZz83fycpOTPWB1dIXU0/hdh4ZGC+6JhCws8htAQ5E=";
   };
 
   patches = lib.optional useSystemJemalloc ./use_system_jemalloc.patch;
@@ -94,13 +93,14 @@ stdenv.mkDerivation (finalAttrs: {
     fi
 
     # Skip some more flaky tests.
-    # Skip test requiring custom jemalloc (unit/memefficiency).
+    # Skip test requiring custom jemalloc (unit/memefficiency, unit/type/string).
     ./runtest \
       --no-latency \
       --timeout 2000 \
       --clients "$CLIENTS" \
       --tags -leaks \
       --skipunit unit/memefficiency \
+      --skipunit unit/type/string \
       --skipunit integration/failover \
       --skipunit integration/aof-multi-part
 
diff --git a/pkgs/by-name/ve/vex-tui/package.nix b/pkgs/by-name/ve/vex-tui/package.nix
index 73b5f8afe0bc..fe7615b1ecd2 100644
--- a/pkgs/by-name/ve/vex-tui/package.nix
+++ b/pkgs/by-name/ve/vex-tui/package.nix
@@ -30,6 +30,7 @@ buildGoModule (finalAttrs: {
     description = "Beautiful, fast, and feature-rich terminal-based Excel and CSV viewer built with Go";
     homepage = "https://github.com/CodeOne45/vex-tui";
     license = lib.licenses.mit;
+    mainProgram = "vex";
     maintainers = with lib.maintainers; [ Inarizxc ];
     platforms = lib.platforms.linux;
   };
diff --git a/pkgs/by-name/wi/wit-bindgen/package.nix b/pkgs/by-name/wi/wit-bindgen/package.nix
index 566cac20ca83..c0a2227b5916 100644
--- a/pkgs/by-name/wi/wit-bindgen/package.nix
+++ b/pkgs/by-name/wi/wit-bindgen/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wit-bindgen";
-  version = "0.57.1";
+  version = "0.58.0";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "wit-bindgen";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-i/SjZPemfs3bxAUVVU0YDZ3Pa+oH38iRTu9/LgWArco=";
+    hash = "sha256-moyA1zlKO1TbTDhtEerypEDthLTRZhxqwW2c7qgnoko=";
   };
 
-  cargoHash = "sha256-NuWckpK7P3fKbzoGQbuamJiN30gcBy/Hygv++vUW/xY=";
+  cargoHash = "sha256-lPIzhWiUvS2K0MQgG8DoMtN+Xz14ZLq2VNPX374mpEQ=";
 
   # Some tests fail because they need network access to install the `wasm32-unknown-unknown` target.
   # However, GitHub Actions ensures a proper build.
diff --git a/pkgs/by-name/wo/worktrunk/package.nix b/pkgs/by-name/wo/worktrunk/package.nix
index 8f973b385071..5b785b4b8fc0 100644
--- a/pkgs/by-name/wo/worktrunk/package.nix
+++ b/pkgs/by-name/wo/worktrunk/package.nix
@@ -39,7 +39,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
     installShellCompletion --cmd wt \
       --bash <($out/bin/wt config shell completions bash) \
       --fish <($out/bin/wt config shell completions fish) \
-      --zsh  <($out/bin/wt config shell completions zsh)
+      --nushell <($out/bin/wt config shell completions nu) \
+      --zsh <($out/bin/wt config shell completions zsh)
   '';
 
   nativeCheckInputs = [ gitMinimal ];
diff --git a/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix b/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
index 78c5edf0a4fa..711d80f4136d 100644
--- a/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
+++ b/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
@@ -17,14 +17,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "xdg-desktop-portal-cosmic";
-  version = "1.0.16";
+  version = "1.1.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "xdg-desktop-portal-cosmic";
     tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-LwZqF3Yg4DMis21wtu1XMAoPTjJ39GPrf07K9Yc2YAg=";
+    hash = "sha256-yN7dUhB8eMW/CK9HTeuK/CAYFjvWvCLApQ7mb71VLps=";
   };
 
   cargoHash = "sha256-wSwXzaU872KqcRgAIKRuQFvG9f/q4z0OysysLyYMwdg=";
diff --git a/pkgs/by-name/xv/xvfb/package.nix b/pkgs/by-name/xv/xvfb/package.nix
index d14e35338776..934fade5a795 100644
--- a/pkgs/by-name/xv/xvfb/package.nix
+++ b/pkgs/by-name/xv/xvfb/package.nix
@@ -38,13 +38,7 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "xvfb";
 
-  # TODO: rebuild avoidance. revert on staging.
-  # inherit (xorg-server) src version;
-  version = "21.1.22";
-  src = fetchurl {
-    url = "mirror://xorg/individual/xserver/xorg-server-${finalAttrs.version}.tar.xz";
-    hash = "sha256-GiQsiRfEm6KczB9gIWE9iiuYBd0NJxpmrp0J9LC7BrM=";
-  };
+  inherit (xorg-server) src version;
 
   strictDeps = true;
 
diff --git a/pkgs/by-name/ya/yamlscript/package.nix b/pkgs/by-name/ya/yamlscript/package.nix
index 5792b1f0e712..52b9619c9ea7 100644
--- a/pkgs/by-name/ya/yamlscript/package.nix
+++ b/pkgs/by-name/ya/yamlscript/package.nix
@@ -6,11 +6,11 @@
 
 buildGraalvmNativeImage (finalAttrs: {
   pname = "yamlscript";
-  version = "0.2.20";
+  version = "0.2.23";
 
   src = fetchurl {
     url = "https://github.com/yaml/yamlscript/releases/download/${finalAttrs.version}/yamlscript.cli-${finalAttrs.version}-standalone.jar";
-    hash = "sha256-RzMIzwq7L5H40DkVJaIyoa6yK36DphfwW24x0Bbe+Xk=";
+    hash = "sha256-2r/rD521qaIOrWjyABtfeEdOkT9GcvDfRc7Taa85C5c=";
   };
 
   extraNativeImageBuildArgs = [
diff --git a/pkgs/by-name/yo/yocto-cooker/package.nix b/pkgs/by-name/yo/yocto-cooker/package.nix
new file mode 100644
index 000000000000..9f077b6665f9
--- /dev/null
+++ b/pkgs/by-name/yo/yocto-cooker/package.nix
@@ -0,0 +1,39 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "yocto-cooker";
+  version = "1.5.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "cpb-";
+    repo = "yocto-cooker";
+    tag = finalAttrs.version;
+    hash = "sha256-h4fmpYzErOiu5M7XHuqlRUvDpXUoOC0c/HGs9a5PZNg=";
+  };
+
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  dependencies = with python3Packages; [
+    jsonschema
+    urllib3
+    pyjson5
+  ];
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  meta = {
+    description = "Meta buildtool for Yocto Project based Linux embedded systems";
+    homepage = "https://github.com/cpb-/yocto-cooker";
+    license = lib.licenses.gpl2;
+    maintainers = with lib.maintainers; [ aiyion ];
+    mainProgram = "cooker";
+  };
+})
diff --git a/pkgs/by-name/za/zapret2/package.nix b/pkgs/by-name/za/zapret2/package.nix
index b9a945235b5d..722346667f8e 100644
--- a/pkgs/by-name/za/zapret2/package.nix
+++ b/pkgs/by-name/za/zapret2/package.nix
@@ -20,7 +20,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zapret2";
-  version = "1.0.1";
+  version = "1.0.2";
 
   outputs = [
     "out"
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "bol-van";
     repo = "zapret2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hV9MVkDVkGGGdHCUGRscm9rIKORDEi+xWtfITQE22mw=";
+    hash = "sha256-pcAIvB/MfFJZFl5kPZjRZZOXgamfQm8hD4UGYC3jbro=";
     leaveDotGit = true;
     postFetch = ''
       cd "$out"
diff --git a/pkgs/development/compilers/go/1.26.nix b/pkgs/development/compilers/go/1.26.nix
index 01704593ad77..242fa4c91de8 100644
--- a/pkgs/development/compilers/go/1.26.nix
+++ b/pkgs/development/compilers/go/1.26.nix
@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.26.3";
+  version = "1.26.4";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-HGRoddCqh5kTMYTtV895/yS97+jIggRwYCqdPW2Rkrg=";
+    hash = "sha256-T2aKMvv8ETLmqIH7lowvHa2mMUkqM5IRc1+7JVpCYC0=";
   };
 
   strictDeps = true;
diff --git a/pkgs/development/compilers/rust/cargo.nix b/pkgs/development/compilers/rust/cargo.nix
index a86e4a3d186d..7c3d4eb2a5e0 100644
--- a/pkgs/development/compilers/rust/cargo.nix
+++ b/pkgs/development/compilers/rust/cargo.nix
@@ -3,6 +3,7 @@
   stdenv,
   pkgsHostHost,
   pkgsBuildBuild,
+  fetchpatch,
   file,
   curl,
   pkg-config,
@@ -26,6 +27,23 @@ rustPlatform.buildRustPackage.override
     pname = "cargo";
     inherit (rustc.unwrapped) version src;
 
+    patches = [
+      (fetchpatch {
+        name = "CVE-2026-5222.patch";
+        url = "https://github.com/rust-lang/cargo/commit/c4d63a44234de22dc745231c416b80ed848d997f.patch";
+        stripLen = 1;
+        extraPrefix = "src/tools/cargo/";
+        hash = "sha256-YG7xtC308z+o1xVzrV81qqWov1121GVouyAXKflyBF8=";
+      })
+      (fetchpatch {
+        name = "CVE-2026-5223.patch";
+        url = "https://github.com/rust-lang/cargo/commit/285cebf58911eca5b7f177f5d0b1c53e1f646577.patch";
+        stripLen = 1;
+        extraPrefix = "src/tools/cargo/";
+        hash = "sha256-DbmPQ31N4AIYZEBiwwGAn59hgPsFEVTzA6PrI071LXE=";
+      })
+    ];
+
     # the rust source tarball already has all the dependencies vendored, no need to fetch them again
     cargoVendorDir = "vendor";
     buildAndTestSubdir = "src/tools/cargo";
diff --git a/pkgs/development/interpreters/perl/CVE-2026-8376.patch b/pkgs/development/interpreters/perl/CVE-2026-8376.patch
new file mode 100644
index 000000000000..c8ad72298178
--- /dev/null
+++ b/pkgs/development/interpreters/perl/CVE-2026-8376.patch
@@ -0,0 +1,20 @@
+Targeted patch for CVE-2026-8376, based on 5e7f119eb2bb1181be908701f22bf7068e722f1c but avoids changes to t/re/pat_psycho.t as they do not apply cleanly.
+
+diff --git a/regcomp_study.c b/regcomp_study.c
+index b513454a4258..1602663f4b26 100644
+--- a/regcomp_study.c
++++ b/regcomp_study.c
+@@ -2784,6 +2784,13 @@ Perl_study_chunk(pTHX_
+                                                (U8 *) SvEND(data->last_found))
+                                 - (U8*)s;
+                         l -= old;
++
++                        if (l > 0 &&
++                            (mincount >= SSize_t_MAX / (SSize_t)l
++                             || old > SSize_t_MAX - mincount * (SSize_t)l)) {
++                            FAIL("Regexp out of space");
++                        }
++
+                         /* Get the added string: */
+                         last_str = newSVpvn_utf8(s  + old, l, UTF);
+                         last_chrs = UTF ? utf8_length((U8*)(s + old),
diff --git a/pkgs/development/interpreters/perl/interpreter.nix b/pkgs/development/interpreters/perl/interpreter.nix
index fce8e1c9e0f0..cdb03912b517 100644
--- a/pkgs/development/interpreters/perl/interpreter.nix
+++ b/pkgs/development/interpreters/perl/interpreter.nix
@@ -36,6 +36,8 @@ let
   commonPatches = [
     # Do not look in /usr etc. for dependencies.
     ./no-sys-dirs.patch
+
+    ./CVE-2026-8376.patch
   ]
 
   # Fix build on Solaris on x86_64
@@ -79,6 +81,61 @@ let
   # Some more details: https://arsv.github.io/perl-cross/modules.html
   ++ lib.optional crossCompiling ./cross.patch;
 
+  # Inject fixed CPAN releases for bundled dual-life distributions until the
+  # next perl maintenance release includes them.
+  vendoredPerlDistributions = [
+    {
+      # CVE-2026-7010
+      path = "cpan/HTTP-Tiny";
+      src = fetchurl {
+        url = "mirror://cpan/authors/id/H/HA/HAARG/HTTP-Tiny-0.094.tar.gz";
+        hash = "sha256-poQemfwbVdFd6VlHzL17dnvsxRxxAhl/qPBE333cB0M=";
+      };
+    }
+    {
+      # CVE-2026-3381, CVE-2026-4176
+      path = "cpan/Compress-Raw-Zlib";
+      src = fetchurl {
+        url = "mirror://cpan/authors/id/P/PM/PMQS/Compress-Raw-Zlib-2.222.tar.gz";
+        hash = "sha256-Hf19URplVifIGBXTDTurwo+luIRV/wP4sECZ3LUShrg=";
+      };
+    }
+    {
+      # Runtime dependency of IO-Compress 2.220.
+      path = "cpan/Compress-Raw-Bzip2";
+      src = fetchurl {
+        url = "mirror://cpan/authors/id/P/PM/PMQS/Compress-Raw-Bzip2-2.218.tar.gz";
+        hash = "sha256-iRU+ai69pSNJSTsHT6S3VJ/x+QU952E8GKXgXFtBX6g=";
+      };
+    }
+    {
+      # CVE-2026-48962, CVE-2026-48961, CVE-2026-48959
+      path = "cpan/IO-Compress";
+      src = fetchurl {
+        url = "mirror://cpan/authors/id/P/PM/PMQS/IO-Compress-2.220.tar.gz";
+        hash = "sha256-nZbqKR8sVO82fHOWuFfZO6GsHEsvG84T7Yo+Xz7rtic=";
+      };
+    }
+    {
+      # CVE-2026-42496, CVE-2026-42497, CVE-2026-9538
+      path = "cpan/Archive-Tar";
+      src = fetchurl {
+        url = "mirror://cpan/authors/id/B/BI/BINGOS/Archive-Tar-3.12.tar.gz";
+        hash = "sha256-ARTvObZfSfiWgoOrR3Gdfoj5jXNg/jZJvjMcf1PVgyw=";
+      };
+    }
+  ];
+
+  replaceVendoredPerlDistributions = lib.concatMapStringsSep "\n" (d: ''
+    rm -rf ${d.path}
+    mkdir -p ${d.path}
+
+    tar --strip-components=1 -C ${d.path} -xf ${d.src}
+
+    # Remove executable bits to make t/porting/exec-bit.t happy.
+    find ${d.path} -type f -exec chmod a-x {} +
+  '') vendoredPerlDistributions;
+
   libc = if stdenv.cc.libc or null != null then stdenv.cc.libc else "/usr";
   libcInc = lib.getDev libc;
   libcLib = lib.getLib libc;
@@ -136,10 +193,10 @@ stdenv.mkDerivation (
               --replace "/bin/pwd" "$(type -P pwd)"
           ''
       )
-      +
-      # Perl's build system uses the src variable, and its value may end up in
-      # the output in some cases (when cross-compiling)
-      ''
+      + replaceVendoredPerlDistributions
+      + ''
+        # Perl's build system uses the src variable, and its value may end up in
+        # the output in some cases (when cross-compiling).
         unset src
       '';
 
diff --git a/pkgs/development/libraries/ffmpeg/default.nix b/pkgs/development/libraries/ffmpeg/default.nix
index 4735d184c030..5baddb0c34e2 100644
--- a/pkgs/development/libraries/ffmpeg/default.nix
+++ b/pkgs/development/libraries/ffmpeg/default.nix
@@ -30,8 +30,8 @@ let
     hash = "sha256-DjmW5LeI9OJmPeIh61znAns4+kolxwKguEvKawgxy8I=";
   };
   v8 = {
-    version = "8.1";
-    hash = "sha256-FdKhhCveEo5UodEoyUh3aBHABv3OT2VXmwBXE1ce3p0=";
+    version = "8.1.1";
+    hash = "sha256-WPGfjTZjsgpR5QiANRWF4g6LF2ejGzFQUrLjhzw9cfQ=";
   };
 in
 
diff --git a/pkgs/development/libraries/glibc/2.42-master.patch b/pkgs/development/libraries/glibc/2.42-master.patch
index 47ed7dd1183b..a7bdf93961db 100644
--- a/pkgs/development/libraries/glibc/2.42-master.patch
+++ b/pkgs/development/libraries/glibc/2.42-master.patch
@@ -7154,3 +7154,762 @@ index 00181cfefb..e83ea2b939 100644
    TEST_VERIFY (ret != 0);
    TEST_COMPARE (errno, EBUSY);
  }
+
+commit f13c1bb0f97fbc12a6ba1ab5669ce561ea32b80a
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Thu Apr 16 19:13:43 2026 +0200
+
+    Use pending character state in IBM1390, IBM1399 character sets (CVE-2026-4046)
+    
+    Follow the example in iso-2022-jp-3.c and use the __count state
+    variable to store the pending character.  This avoids restarting
+    the conversion if the output buffer ends between two 4-byte UCS-4
+    code points, so that the assert reported in the bug can no longer
+    happen.
+    
+    Even though the fix is applied to ibm1364.c, the change is only
+    effective for the two HAS_COMBINED codecs for IBM1390, IBM1399.
+    
+    The test case was mostly auto-generated using
+    claude-4.6-opus-high-thinking, and composer-2-fast shows up in the
+    log as well.  During review, gpt-5.4-xhigh flagged that the original
+    version of the test case was not exercising the new character
+    flush logic.
+    
+    This fixes bug 33980.
+    
+    Assisted-by: LLM
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+    (cherry picked from commit d6f08d1cf027f4eb2ba289a6cc66853722d4badc)
+
+diff --git a/iconvdata/Makefile b/iconvdata/Makefile
+index 5a2abeea24..cc689f63e9 100644
+--- a/iconvdata/Makefile
++++ b/iconvdata/Makefile
+@@ -76,7 +76,7 @@ tests = bug-iconv1 bug-iconv2 tst-loading tst-e2big tst-iconv4 bug-iconv4 \
+ 	tst-iconv6 bug-iconv5 bug-iconv6 tst-iconv7 bug-iconv8 bug-iconv9 \
+ 	bug-iconv10 bug-iconv11 bug-iconv12 tst-iconv-big5-hkscs-to-2ucs4 \
+ 	bug-iconv13 bug-iconv14 bug-iconv15 \
+-	tst-iconv-iso-2022-cn-ext
++	tst-iconv-iso-2022-cn-ext tst-bug33980
+ ifeq ($(have-thread-library),yes)
+ tests += bug-iconv3
+ endif
+@@ -333,6 +333,8 @@ $(objpfx)bug-iconv15.out: $(addprefix $(objpfx), $(gconv-modules)) \
+ 			  $(addprefix $(objpfx),$(modules.so))
+ $(objpfx)tst-iconv-iso-2022-cn-ext.out: $(addprefix $(objpfx), $(gconv-modules)) \
+ 					$(addprefix $(objpfx),$(modules.so))
++$(objpfx)tst-bug33980.out: $(addprefix $(objpfx), $(gconv-modules)) \
++			   $(addprefix $(objpfx),$(modules.so))
+ 
+ $(objpfx)iconv-test.out: run-iconv-test.sh \
+ 			 $(addprefix $(objpfx), $(gconv-modules)) \
+diff --git a/iconvdata/ibm1364.c b/iconvdata/ibm1364.c
+index 45c62acee5..244c61ad7a 100644
+--- a/iconvdata/ibm1364.c
++++ b/iconvdata/ibm1364.c
+@@ -67,12 +67,29 @@
+ 
+ /* Since this is a stateful encoding we have to provide code which resets
+    the output state to the initial state.  This has to be done during the
+-   flushing.  */
++   flushing.  For the to-internal direction (FROM_DIRECTION is true),
++   there may be a pending character that needs flushing.  */
+ #define EMIT_SHIFT_TO_INIT \
+   if ((data->__statep->__count & ~7) != sb)				      \
+     {									      \
+       if (FROM_DIRECTION)						      \
+-	data->__statep->__count &= 7;					      \
++	{								      \
++	  uint32_t ch = data->__statep->__count >> 7;			      \
++	  if (__glibc_unlikely (ch != 0))				      \
++	    {								      \
++	      if (__glibc_unlikely (outend - outbuf < 4))		      \
++		status = __GCONV_FULL_OUTPUT;				      \
++	      else							      \
++		{							      \
++		  put32 (outbuf, ch);					      \
++		  outbuf += 4;						      \
++		  /* Clear character and db bit.  */			      \
++		  data->__statep->__count &= 7;				      \
++		}							      \
++	    }								      \
++	  else								      \
++	    data->__statep->__count &= 7;				      \
++	}								      \
+       else								      \
+ 	{								      \
+ 	  /* We are not in the initial state.  To switch back we have	      \
+@@ -99,11 +116,13 @@
+     *curcsp = save_curcs
+ 
+ 
+-/* Current codeset type.  */
++/* Current codeset type.  The bit is stored in the __count variable of
++   the conversion state.  If the db bit is set, bit 7 and above store
++   a pending UCS-4 code point if non-zero.  */
+ enum
+ {
+-  sb = 0,
+-  db = 64
++  sb = 0,			/* Single byte mode.  */
++  db = 64			/* Double byte mode.  */
+ };
+ 
+ 
+@@ -119,21 +138,29 @@ enum
+       }									      \
+     else								      \
+       {									      \
+-	/* This is a combined character.  Make sure we have room.  */	      \
+-	if (__glibc_unlikely (outptr + 8 > outend))			      \
+-	  {								      \
+-	    result = __GCONV_FULL_OUTPUT;				      \
+-	    break;							      \
+-	  }								      \
+-									      \
+ 	const struct divide *cmbp					      \
+ 	  = &DB_TO_UCS4_COMB[ch - __TO_UCS4_COMBINED_MIN];		      \
+ 	assert (cmbp->res1 != 0 && cmbp->res2 != 0);			      \
+ 									      \
+ 	put32 (outptr, cmbp->res1);					      \
+ 	outptr += 4;							      \
+-	put32 (outptr, cmbp->res2);					      \
+-	outptr += 4;							      \
++									      \
++	/* See whether we have room for the second character.  */	      \
++	if (outend - outptr >= 4)					      \
++	  {								      \
++	    put32 (outptr, cmbp->res2);					      \
++	    outptr += 4;						      \
++	  }								      \
++	else								      \
++	  {								      \
++	    /* Otherwise store only the first character now, and	      \
++	       put the second one into the queue.  */			      \
++	    curcs |= cmbp->res2 << 7;					      \
++	    inptr += 2;							      \
++	    /* Tell the caller why we terminate the loop.  */		      \
++	    result = __GCONV_FULL_OUTPUT;				      \
++	    break;							      \
++	  }								      \
+       }									      \
+   }
+ #else
+@@ -153,7 +180,20 @@ enum
+ #define LOOPFCT 		FROM_LOOP
+ #define BODY \
+   {									      \
+-    uint32_t ch = *inptr;						      \
++    uint32_t ch;							      \
++									      \
++    ch = curcs >> 7;							      \
++    if (__glibc_unlikely (ch != 0))					      \
++      {									      \
++	put32 (outptr, ch);						      \
++	outptr += 4;							      \
++	/* Remove the pending character, but preserve state bits.  */	      \
++	curcs &= (1 << 7) - 1;						      \
++	continue;							      \
++      }									      \
++									      \
++    /* Otherwise read the next input byte.  */				      \
++    ch = *inptr;							      \
+ 									      \
+     if (__builtin_expect (ch, 0) == SO)					      \
+       {									      \
+diff --git a/iconvdata/tst-bug33980.c b/iconvdata/tst-bug33980.c
+new file mode 100644
+index 0000000000..c9693e0efe
+--- /dev/null
++++ b/iconvdata/tst-bug33980.c
+@@ -0,0 +1,153 @@
++/* Test for bug 33980: combining characters in IBM1390/IBM1399.
++   Copyright (C) 2026 Free Software Foundation, Inc.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include <alloc_buffer.h>
++#include <errno.h>
++#include <iconv.h>
++#include <stdbool.h>
++#include <string.h>
++
++#include <support/check.h>
++#include <support/next_to_fault.h>
++#include <support/support.h>
++
++/* Run iconv in a loop with a small output buffer of OUTBUFSIZE bytes
++   starting at OUTBUF.  OUTBUF should be right before an unmapped page
++   so that writing past the end will fault.  Skip SHIFT bytes at the
++   start of the input and output, to exercise different buffer
++   alignment.  TRUNCATE indicates skipped bytes at the end of
++   input (0 and 1 a valid).  */
++static void
++test_one (const char *encoding, unsigned int shift, unsigned int truncate,
++          char *outbuf, size_t outbufsize)
++{
++  /* In IBM1390 and IBM1399, the DBCS code 0xECB5 expands to two
++     Unicode code points when translated.  */
++  static char input[] =
++    {
++      /* 8 letters X.  */
++      0xe7, 0xe7, 0xe7, 0xe7, 0xe7, 0xe7, 0xe7, 0xe7,
++      /* SO, 0xECB5, SI: shift to DBCS, special character, shift back.  */
++      0x0e, 0xec, 0xb5, 0x0f
++    };
++
++  /* Expected output after UTF-8 conversion.  */
++  static char expected[] =
++    {
++      'X', 'X', 'X', 'X', 'X', 'X', 'X', 'X',
++      /* U+304B (HIRAGANA LETTER KA).  */
++      0xe3, 0x81, 0x8b,
++      /* U+309A (COMBINING KATAKANA-HIRAGANA SEMI-VOICED SOUND MARK).  */
++      0xe3, 0x82, 0x9a
++    };
++
++  iconv_t cd = iconv_open ("UTF-8", encoding);
++  TEST_VERIFY_EXIT (cd != (iconv_t) -1);
++
++  char result_storage[64];
++  struct alloc_buffer result_buf
++    = alloc_buffer_create (result_storage, sizeof (result_storage));
++
++  char *inptr = &input[shift];
++  size_t inleft = sizeof (input) - shift - truncate;
++
++  while (inleft > 0)
++    {
++      char *outptr = outbuf;
++      size_t outleft = outbufsize;
++      size_t inleft_before = inleft;
++
++      size_t ret = iconv (cd, &inptr, &inleft, &outptr, &outleft);
++      size_t produced = outptr - outbuf;
++      alloc_buffer_copy_bytes (&result_buf, outbuf, produced);
++
++      if (ret == (size_t) -1 && errno == E2BIG)
++        {
++          if (produced == 0 && inleft == inleft_before)
++            {
++              /* Output buffer too small to make progress.  This is
++                 expected for very small output buffer sizes.  */
++              TEST_VERIFY_EXIT (outbufsize < 3);
++              break;
++            }
++          continue;
++        }
++      if (ret == (size_t) -1)
++        FAIL_EXIT1 ("%s (outbufsize %zu): iconv: %m", encoding, outbufsize);
++      break;
++    }
++
++  /* Flush any pending state (e.g. a buffered combined character).
++     With outbufsize < 3, we could not store the first character, so
++     the second character did not become pending, and there is nothing
++     to flush.  */
++  {
++    char *outptr = outbuf;
++    size_t outleft = outbufsize;
++
++    size_t ret = iconv (cd, NULL, NULL, &outptr, &outleft);
++    TEST_VERIFY_EXIT (ret == 0);
++    size_t produced = outptr - outbuf;
++    alloc_buffer_copy_bytes (&result_buf, outbuf, produced);
++
++    /* Second flush does not provide more data.  */
++    outptr = outbuf;
++    outleft = outbufsize;
++    ret = iconv (cd, NULL, NULL, &outptr, &outleft);
++    TEST_VERIFY_EXIT (ret == 0);
++    TEST_VERIFY (outptr == outbuf);
++  }
++
++  TEST_VERIFY_EXIT (!alloc_buffer_has_failed (&result_buf));
++  size_t result_used
++    = sizeof (result_storage) - alloc_buffer_size (&result_buf);
++
++  if (outbufsize >= 3)
++    {
++      TEST_COMPARE (inleft, 0);
++      TEST_COMPARE (result_used, sizeof (expected) - shift);
++      TEST_COMPARE_BLOB (result_storage, result_used,
++                         &expected[shift], sizeof (expected) - shift);
++    }
++  else
++    /* If the buffer is too small, only the leading X could be converted.  */
++    TEST_COMPARE (result_used, 8 - shift);
++
++  TEST_VERIFY_EXIT (iconv_close (cd) == 0);
++}
++
++static int
++do_test (void)
++{
++  struct support_next_to_fault ntf
++    = support_next_to_fault_allocate (8);
++
++  for (int shift = 0; shift <= 8; ++shift)
++    for (int truncate = 0; truncate < 2; ++truncate)
++      for (size_t outbufsize = 1; outbufsize <= 8; outbufsize++)
++        {
++          char *outbuf = ntf.buffer + ntf.length - outbufsize;
++          test_one ("IBM1390", shift, truncate, outbuf, outbufsize);
++          test_one ("IBM1399", shift, truncate, outbuf, outbufsize);
++        }
++
++  support_next_to_fault_free (&ntf);
++  return 0;
++}
++
++#include <support/test-driver.c>
+
+commit 12feedaf67e11c4618dc50c6aab4dbfd1e6d9531
+Author: DJ Delorie <dj@redhat.com>
+Date:   Mon Jan 26 22:24:42 2026 -0500
+
+    include: isolate __O_CLOEXEC flag for sys/mount.h and fcntl.h
+    
+    Including sys/mount.h should not implicitly include fcntl.h
+    as that causes namespace pollution and conflicts with kernel
+    headers.  It only needs O_CLOEXEC for OPEN_TREE_CLOEXEC
+    (although it shouldn't need that, but it's defined that way)
+    so we provide that define (via a private version) separately.
+    
+    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
+    Tested-by: Florian Weimer <fweimer@redhat.com>
+    (cherry picked from commit 419245719ccbc7dad6a97f24465e7f09c090327a)
+
+diff --git a/io/fcntl.c b/io/fcntl.c
+index e88e28664c..b7dab1bb39 100644
+--- a/io/fcntl.c
++++ b/io/fcntl.c
+@@ -18,6 +18,10 @@
+ #include <errno.h>
+ #include <fcntl.h>
+ 
++#ifndef __O_CLOEXEC
++# error __O_CLOEXEC not defined by fcntl.h/cloexec.h
++#endif
++
+ /* Perform file control operations on FD.  */
+ int
+ __fcntl (int fd, int cmd, ...)
+diff --git a/sysdeps/unix/sysv/linux/Makefile b/sysdeps/unix/sysv/linux/Makefile
+index c47cbdf428..053041f256 100644
+--- a/sysdeps/unix/sysv/linux/Makefile
++++ b/sysdeps/unix/sysv/linux/Makefile
+@@ -129,6 +129,7 @@ CFLAGS-test-errno-linux.c += $(no-fortify-source)
+ 
+ sysdep_headers += \
+   bits/a.out.h \
++  bits/cloexec.h \
+   bits/epoll.h \
+   bits/eventfd.h \
+   bits/inotify.h \
+diff --git a/sysdeps/unix/sysv/linux/alpha/bits/cloexec.h b/sysdeps/unix/sysv/linux/alpha/bits/cloexec.h
+new file mode 100644
+index 0000000000..f381f28a53
+--- /dev/null
++++ b/sysdeps/unix/sysv/linux/alpha/bits/cloexec.h
+@@ -0,0 +1 @@
++#define __O_CLOEXEC 010000000
+diff --git a/sysdeps/unix/sysv/linux/bits/cloexec.h b/sysdeps/unix/sysv/linux/bits/cloexec.h
+new file mode 100644
+index 0000000000..3059fb6473
+--- /dev/null
++++ b/sysdeps/unix/sysv/linux/bits/cloexec.h
+@@ -0,0 +1 @@
++#define __O_CLOEXEC 02000000
+diff --git a/sysdeps/unix/sysv/linux/bits/fcntl-linux.h b/sysdeps/unix/sysv/linux/bits/fcntl-linux.h
+index f425a4bf22..98954feaca 100644
+--- a/sysdeps/unix/sysv/linux/bits/fcntl-linux.h
++++ b/sysdeps/unix/sysv/linux/bits/fcntl-linux.h
+@@ -81,9 +81,7 @@
+ #ifndef __O_NOFOLLOW
+ # define __O_NOFOLLOW	0400000
+ #endif
+-#ifndef __O_CLOEXEC
+-# define __O_CLOEXEC   02000000
+-#endif
++#include <bits/cloexec.h>
+ #ifndef __O_DIRECT
+ # define __O_DIRECT	 040000
+ #endif
+diff --git a/sysdeps/unix/sysv/linux/hppa/bits/cloexec.h b/sysdeps/unix/sysv/linux/hppa/bits/cloexec.h
+new file mode 100644
+index 0000000000..f381f28a53
+--- /dev/null
++++ b/sysdeps/unix/sysv/linux/hppa/bits/cloexec.h
+@@ -0,0 +1 @@
++#define __O_CLOEXEC 010000000
+diff --git a/sysdeps/unix/sysv/linux/sparc/bits/cloexec.h b/sysdeps/unix/sysv/linux/sparc/bits/cloexec.h
+new file mode 100644
+index 0000000000..6706eaa7d5
+--- /dev/null
++++ b/sysdeps/unix/sysv/linux/sparc/bits/cloexec.h
+@@ -0,0 +1 @@
++#define __O_CLOEXEC 0x400000
+diff --git a/sysdeps/unix/sysv/linux/sys/mount.h b/sysdeps/unix/sysv/linux/sys/mount.h
+index b549e75148..365da1c296 100644
+--- a/sysdeps/unix/sysv/linux/sys/mount.h
++++ b/sysdeps/unix/sysv/linux/sys/mount.h
+@@ -21,7 +21,6 @@
+ #ifndef _SYS_MOUNT_H
+ #define _SYS_MOUNT_H	1
+ 
+-#include <fcntl.h>
+ #include <features.h>
+ #include <stdint.h>
+ #include <stddef.h>
+@@ -266,6 +265,11 @@ enum fsconfig_command
+ 
+ /* open_tree flags.  */
+ #define OPEN_TREE_CLONE    1         /* Clone the target tree and attach the clone */
++#ifndef O_CLOEXEC
++# include <bits/cloexec.h>
++# define O_CLOEXEC __O_CLOEXEC
++#endif
++#undef  OPEN_TREE_CLOEXEC
+ #define OPEN_TREE_CLOEXEC  O_CLOEXEC /* Close the file on execve() */
+ 
+ 
+diff --git a/sysdeps/unix/sysv/linux/tst-mount.c b/sysdeps/unix/sysv/linux/tst-mount.c
+index 40913c7082..78a2772b2f 100644
+--- a/sysdeps/unix/sysv/linux/tst-mount.c
++++ b/sysdeps/unix/sysv/linux/tst-mount.c
+@@ -20,6 +20,7 @@
+ #include <support/check.h>
+ #include <support/xunistd.h>
+ #include <support/namespace.h>
++#include <fcntl.h> /* For AT_ constants.  */
+ #include <sys/mount.h>
+ 
+ _Static_assert (sizeof (struct mount_attr) == MOUNT_ATTR_SIZE_VER0,
+
+commit 3ecfa68561d723564a1fb565366182eb4acb3e8f
+Author: Florian Weimer <fweimer@redhat.com>
+Date:   Wed Mar 4 18:32:36 2026 +0100
+
+    Linux: Only define OPEN_TREE_* macros in <sys/mount.h> if undefined (bug 33921)
+    
+    There is a conditional inclusion of <linux/mount.h> earlier in the file.
+    If that defines the macros, do not redefine them.  This addresses build
+    problems as the token sequence used by the UAPI macro definitions
+    changes between Linux versions.
+    
+    Reviewed-by: Adhemerval Zanella  <adhemerval.zanella@linaro.org>
+    (cherry picked from commit d12b017cddfeb9fe9920ba054ae3dfcb8e9238b8)
+
+diff --git a/sysdeps/unix/sysv/linux/sys/mount.h b/sysdeps/unix/sysv/linux/sys/mount.h
+index 365da1c296..30ba56c1e8 100644
+--- a/sysdeps/unix/sysv/linux/sys/mount.h
++++ b/sysdeps/unix/sysv/linux/sys/mount.h
+@@ -264,14 +264,16 @@ enum fsconfig_command
+ #define FSOPEN_CLOEXEC          0x00000001
+ 
+ /* open_tree flags.  */
+-#define OPEN_TREE_CLONE    1         /* Clone the target tree and attach the clone */
++#ifndef OPEN_TREE_CLONE
++# define OPEN_TREE_CLONE    1 /* Clone the target tree and attach the clone */
++#endif
+ #ifndef O_CLOEXEC
+ # include <bits/cloexec.h>
+ # define O_CLOEXEC __O_CLOEXEC
+ #endif
+-#undef  OPEN_TREE_CLOEXEC
+-#define OPEN_TREE_CLOEXEC  O_CLOEXEC /* Close the file on execve() */
+-
++#ifndef OPEN_TREE_CLOEXEC
++# define OPEN_TREE_CLOEXEC  O_CLOEXEC /* Close the file on execve() */
++#endif
+ 
+ __BEGIN_DECLS
+ 
+
+commit 3e87cf9be93acf19d685e8003fc649cdb052a891
+Author: H.J. Lu <hjl.tools@gmail.com>
+Date:   Mon Apr 13 10:46:42 2026 +0800
+
+    abilist.awk: Handle weak unversioned defined symbols
+    
+    After
+    
+    commit f685e3953f9a38a41bbd0a597f9882870cee13d5
+    Author: H.J. Lu <hjl.tools@gmail.com>
+    Date:   Wed Oct 29 09:49:57 2025 +0800
+    
+        elf: Don't set its DT_VERSYM entry for unversioned symbol
+    
+    ld no longer assigns version index 1 to unversioned defined symbol.
+    For libmachuser.so, "objdump --dynamic-syms" reports:
+    
+    0000dd30  w   DF .text  000000f8              processor_start
+    
+    instead of
+    
+    0000dd30  w   DF .text  000000f8 (Base)       processor_start
+    
+    Also allow NF == 6 for weak unversioned dynamic symbols.  This fixes BZ
+    33650.
+    
+    Signed-off-by: H.J. Lu <hjl.tools@gmail.com>
+    Reviewed-by: Sam James <sam@gentoo.org>
+    (cherry picked from commit ee5d1db2a81468413fbf7c82779ffa782f429d1a)
+
+diff --git a/scripts/abilist.awk b/scripts/abilist.awk
+index 6cc7af6ac8..7ea1edf8c0 100644
+--- a/scripts/abilist.awk
++++ b/scripts/abilist.awk
+@@ -38,7 +38,7 @@ $4 == "*UND*" { next }
+ $2 == "l" { next }
+ 
+ # If the target uses ST_OTHER, it will be output before the symbol name.
+-$2 == "g" || $2 == "w" && (NF == 7 || NF == 8) {
++$2 == "g" || $2 == "w" && (NF == 6 || NF == 7 || NF == 8) {
+   type = $3;
+   size = $5;
+   sub(/^0*/, "", size);
+
+commit b4bca35ab9e76890504c4dbdd5eaf15a93514580
+Author: Rocket Ma <marocketbd@gmail.com>
+Date:   Fri May 1 20:39:07 2026 -0700
+
+    libio: Fix ungetwc operating on byte stream [BZ #33998]
+    
+    * libio/wgenops.c: When _IO_wdefault_pbackfail attempts to push back one
+    character, it accidently compare the wchar to push back with the last
+    char from byte stream, instead of wide stream. Under specific coding,
+    attacker may exploit this to leak information. This commit fix bug
+    33998, or CVE-2026-5928.
+    
+    Signed-off-by: Rocket Ma <marocketbd@gmail.com>
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+    (cherry picked from commit ef3bfb5f910011f3780cb06aa47e730035f53285)
+
+diff --git a/libio/Makefile b/libio/Makefile
+index f020f8ec4d..fa2b8ae791 100644
+--- a/libio/Makefile
++++ b/libio/Makefile
+@@ -83,6 +83,7 @@ tests = \
+   bug-ungetwc1 \
+   bug-ungetwc2 \
+   bug-wfflush \
++  bug-wgenops-bz33998 \
+   bug-wmemstream1 \
+   bug-wsetpos \
+   test-fmemopen \
+diff --git a/libio/bug-wgenops-bz33998.c b/libio/bug-wgenops-bz33998.c
+new file mode 100644
+index 0000000000..cc4067da99
+--- /dev/null
++++ b/libio/bug-wgenops-bz33998.c
+@@ -0,0 +1,54 @@
++/* Regression test for ungetwc operating on byte stream (BZ #33998)
++   Copyright (C) 2026 The GNU Toolchain Authors.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include "support/temp_file.h"
++#include "support/xstdio.h"
++#include "support/xunistd.h"
++#include <stdlib.h>
++#include <unistd.h>
++#include <sys/mman.h>
++#include <stdio.h>
++#include <wchar.h>
++#include <support/check.h>
++
++static int
++do_test (void)
++{
++  char *filename;
++  int fd = create_temp_file ("tst-bz33998-", &filename);
++  TEST_VERIFY (fd != -1);
++  xwrite (fd, "A", sizeof ("A")); // write "A\0" by design
++  xclose (fd);
++
++  FILE *fp = xfopen (filename, "r+");
++  TEST_COMPARE (getwc (fp), L'A');
++  /* If the bug is fixed, then ungetwc should not touch byte stream.
++     If the bug is not fixed, ungetwc firstly match last read char, L'A',
++     failed, then the pbackfail branch, matching last read char in byte
++     stream, that is, '\0' (initialized when setup wide stream). */
++  char *old_read_ptr = fp->_IO_read_ptr;
++  TEST_COMPARE (ungetwc (L'\0', fp), L'\0');
++  TEST_VERIFY (fp->_IO_read_ptr == old_read_ptr);
++
++  xfclose (fp);
++  free (filename);
++
++  return 0;
++}
++
++#include <support/test-driver.c>
+diff --git a/libio/wgenops.c b/libio/wgenops.c
+index 0a11d1b1de..9e0b2c00ea 100644
+--- a/libio/wgenops.c
++++ b/libio/wgenops.c
+@@ -108,8 +108,8 @@ _IO_wdefault_pbackfail (FILE *fp, wint_t c)
+ {
+   if (fp->_wide_data->_IO_read_ptr > fp->_wide_data->_IO_read_base
+       && !_IO_in_backup (fp)
+-      && (wint_t) fp->_IO_read_ptr[-1] == c)
+-    --fp->_IO_read_ptr;
++      && (wint_t) fp->_wide_data->_IO_read_ptr[-1] == c)
++    --fp->_wide_data->_IO_read_ptr;
+   else
+     {
+       /* Need to handle a filebuf in write mode (switch to read mode). FIXME!*/
+
+commit 4ebd33dd77eabe8d4c45232bed4b42a31d2f9edc
+Author: Rocket Ma <marocketbd@gmail.com>
+Date:   Fri Apr 17 23:48:41 2026 -0700
+
+    stdio-common: Fix buffer overflow in scanf %mc [BZ #34008]
+    
+    * stdio-common/vfscanf-internal.c: When enlarging allocated buffer with
+    format %mc or %mC, glibc allocates one byte less, leading to
+    user-controlled one byte overflow. This commit fixes BZ #34008, or
+    CVE-2026-5450.
+    
+    Reviewed-by: Carlos O'Donell <carlos@redhat.com>
+    Signed-off-by: Rocket Ma <marocketbd@gmail.com>
+    Reviewed-by: H.J. Lu <hjl.tools@gmail.com>
+    (cherry picked from commit 839898777226a3ed88c0859f25ffe712519b4ead)
+
+diff --git a/stdio-common/Makefile b/stdio-common/Makefile
+index 64b3575acb..e52c333808 100644
+--- a/stdio-common/Makefile
++++ b/stdio-common/Makefile
+@@ -347,6 +347,7 @@ tests := \
+   tst-vfprintf-user-type \
+   tst-vfprintf-width-i18n \
+   tst-vfprintf-width-prec-alloc \
++  tst-vfscanf-bz34008 \
+   tst-wc-printf \
+   tstdiomisc \
+   tstgetln \
+@@ -562,6 +563,9 @@ tst-printf-bz18872-ENV = MALLOC_TRACE=$(objpfx)tst-printf-bz18872.mtrace \
+ tst-vfprintf-width-prec-ENV = \
+   MALLOC_TRACE=$(objpfx)tst-vfprintf-width-prec.mtrace \
+   LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so
++tst-vfscanf-bz34008-ENV = \
++  MALLOC_CHECK_=3 \
++  LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so
+ tst-printf-bz25691-ENV = \
+   MALLOC_TRACE=$(objpfx)tst-printf-bz25691.mtrace \
+   LD_PRELOAD=$(common-objpfx)/malloc/libc_malloc_debug.so
+diff --git a/stdio-common/tst-vfscanf-bz34008.c b/stdio-common/tst-vfscanf-bz34008.c
+new file mode 100644
+index 0000000000..48371c8a3d
+--- /dev/null
++++ b/stdio-common/tst-vfscanf-bz34008.c
+@@ -0,0 +1,48 @@
++/* Regression test for vfscanf %Nmc out-of-bound write (BZ #34008)
++   Copyright (C) 2026 The GNU Toolchain Authors.
++   This file is part of the GNU C Library.
++
++   The GNU C Library is free software; you can redistribute it and/or
++   modify it under the terms of the GNU Lesser General Public
++   License as published by the Free Software Foundation; either
++   version 2.1 of the License, or (at your option) any later version.
++
++   The GNU C Library is distributed in the hope that it will be useful,
++   but WITHOUT ANY WARRANTY; without even the implied warranty of
++   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++   Lesser General Public License for more details.
++
++   You should have received a copy of the GNU Lesser General Public
++   License along with the GNU C Library; if not, see
++   <https://www.gnu.org/licenses/>.  */
++
++#include "malloc/mcheck.h"
++#include <stddef.h>
++#include <stdio.h>
++#include <string.h>
++#include <wchar.h>
++#include <stdlib.h>
++#include <malloc.h>
++#include <support/check.h>
++
++#define WIDTH 0x410
++#define SCANFSTR "%1040mc"
++static int
++do_test (void)
++{
++  mcheck_pedantic (NULL);
++  char *input = malloc (WIDTH + 1);
++  TEST_VERIFY (input != NULL);
++  memset (input, 'A', WIDTH);
++  input[WIDTH] = '\0';
++
++  char *buf = NULL;
++  TEST_VERIFY (sscanf (input, SCANFSTR, &buf) != -1);
++  TEST_VERIFY (buf != NULL);
++
++  free (buf);
++  free (input);
++  return 0;
++}
++
++#include <support/test-driver.c>
+diff --git a/stdio-common/vfscanf-internal.c b/stdio-common/vfscanf-internal.c
+index 86ae5019a6..17b5565d0f 100644
+--- a/stdio-common/vfscanf-internal.c
++++ b/stdio-common/vfscanf-internal.c
+@@ -853,8 +853,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
+ 			{
+ 			  /* Enlarge the buffer.  */
+ 			  size_t newsize
+-			    = strsize
+-			      + (strsize >= width ? width - 1 : strsize);
++			    = strsize + (strsize >= width ? width : strsize);
+ 
+ 			  str = (char *) realloc (*strptr, newsize);
+ 			  if (str == NULL)
+@@ -925,7 +924,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
+ 		      && wstr == (wchar_t *) *strptr + strsize)
+ 		    {
+ 		      size_t newsize
+-			= strsize + (strsize > width ? width - 1 : strsize);
++			= strsize + (strsize >= width ? width : strsize);
+ 		      /* Enlarge the buffer.  */
+ 		      wstr = (wchar_t *) realloc (*strptr,
+ 						  newsize * sizeof (wchar_t));
+@@ -980,7 +979,7 @@ __vfscanf_internal (FILE *s, const char *format, va_list argptr,
+ 		    && wstr == (wchar_t *) *strptr + strsize)
+ 		  {
+ 		    size_t newsize
+-		      = strsize + (strsize > width ? width - 1 : strsize);
++		      = strsize + (strsize >= width ? width : strsize);
+ 		    /* Enlarge the buffer.  */
+ 		    wstr = (wchar_t *) realloc (*strptr,
+ 						newsize * sizeof (wchar_t));
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index a013a2db2f0c..b6c6a6c86445 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -51,7 +51,7 @@
 
 let
   version = "2.42";
-  patchSuffix = "-61";
+  patchSuffix = "-67";
   sha256 = "sha256-0XdeMuRijmTvkw9DW2e7Y691may2viszW58Z8WUJ8X8=";
 in
 
@@ -68,8 +68,8 @@ stdenv.mkDerivation (
     patches = [
       /*
         No tarballs for stable upstream branch, only https://sourceware.org/git/glibc.git and using git would complicate bootstrapping.
-         $ git fetch --all -p && git checkout origin/release/2.40/master && git describe
-         glibc-2.42-61-ga56a2943d2
+         $ git fetch --all -p && git checkout origin/release/2.42/master && git describe
+         glibc-2.42-67-g4ebd33dd77
          $ git show --minimal --reverse glibc-2.42.. ':!ADVISORIES' > 2.42-master.patch
 
         To compare the archive contents zdiff can be used.
diff --git a/pkgs/development/libraries/libxml2/default.nix b/pkgs/development/libraries/libxml2/default.nix
index 52a3ab58ad61..015688e4474b 100644
--- a/pkgs/development/libraries/libxml2/default.nix
+++ b/pkgs/development/libraries/libxml2/default.nix
@@ -46,13 +46,13 @@ let
       };
     };
     libxml2 = callPackage ./common.nix {
-      version = "2.15.2";
+      version = "2.15.3";
       src = fetchFromGitLab {
         domain = "gitlab.gnome.org";
         owner = "GNOME";
         repo = "libxml2";
         tag = "v${packages.libxml2.version}";
-        hash = "sha256-k5dZ75D/BOouYAjrof9Jm2lY29XZhOqS1kudDGmGY9Q=";
+        hash = "sha256-fDntZDyITs223by8n7ueOXiO7yyzshtANoWbY0+yeqo=";
       };
       extraMeta = {
         maintainers = with lib.maintainers; [
diff --git a/pkgs/development/libraries/openexr/3.nix b/pkgs/development/libraries/openexr/3.nix
index efecd33bef35..a989e883a2b3 100644
--- a/pkgs/development/libraries/openexr/3.nix
+++ b/pkgs/development/libraries/openexr/3.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openexr";
-  version = "3.4.10";
+  version = "3.4.11";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "openexr";
     rev = "v${version}";
-    hash = "sha256-jXio+PvagKTR8NjcYIQ/j8LOMNc/0sQBuaixKk/0V3k=";
+    hash = "sha256-5dx2tag6XyuJfNfJgc68X+VWKXaHOL3M7ZJEQbQwFDA=";
   };
 
   outputs = [
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
index fd5fcefbff34..57473c4f5a29 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
+++ b/pkgs/development/libraries/qt-5/5.15/srcs-generated.json
@@ -1,202 +1,202 @@
 {
   "qt3d": {
     "url": "https://invent.kde.org/qt/qt/qt3d.git",
-    "rev": "208f5835e6c2415c9dc5cbe92bba83aa28bab7ea",
-    "sha256": "0zqvdq5y25b1w7agx5wlr16p1wrx54086r0xcdfg9wx8dayhh1md"
+    "rev": "c3892c3ee3c0a2b8a050d0a1532f34806636eade",
+    "sha256": "0y3f4pr0vr7cpwmjxqspv79p7rljgc913fl8nqpv8y2aw8i5r4ly"
   },
   "qtactiveqt": {
     "url": "https://invent.kde.org/qt/qt/qtactiveqt.git",
-    "rev": "e4c93bc7cac45bac6bccda3310947e8fe026a9ed",
-    "sha256": "1qq6jvqkl4ff7sw20pi1mawh5pypv7vxmj56d38z6p06r1azkvls"
+    "rev": "e85773764374878adc197b6a45ae8ec3ff44dafa",
+    "sha256": "1sbayayxgjj8jfi3apxw6m8qsmkba0gph2rm1wsnzjsa80zr17ia"
   },
   "qtandroidextras": {
     "url": "https://invent.kde.org/qt/qt/qtandroidextras.git",
-    "rev": "4928bd58dbc1cdcf44a7e454e3d4654c3c2016f1",
-    "sha256": "02rsh60lyl6bn2jhx0ajn43safbi904nhwvdpikanrmdbg0z6dpp"
+    "rev": "14a14b137f0d794278947e980d99c47e6929e5e2",
+    "sha256": "0nvyxjm5qfq7sk22rp9hxrf8gvs6jq4i3kww1s0i8lsr69fl9biz"
   },
   "qtbase": {
     "url": "https://invent.kde.org/qt/qt/qtbase.git",
-    "rev": "bebdfd54917e25d1c100e6bd9f5dd53c2e645fd8",
-    "sha256": "0bg36lxngkq2k11bhqdyfvbc1qyqaghwsi446zfn67vxvyxya3hx"
+    "rev": "fbed962c3195ab3952fa54d40e012ad1a4fdc42b",
+    "sha256": "1gnbgs7kh0vxjh3spv5g5zaaj1z1b0h8752pqi4lqg6jd1js2bpl"
   },
   "qtcharts": {
     "url": "https://invent.kde.org/qt/qt/qtcharts.git",
-    "rev": "1093fb53ced126100d14af30a8adffd29b7ef855",
-    "sha256": "0cnlg59l743milkki8mjbrfd4cx5ycbqw73apcrnrsag9dqdbw41"
+    "rev": "16e9aff210cd4de7192adfc6cd91cdd44ba45a3d",
+    "sha256": "02virkb7h8hhkdsqpv2qg3lly4msf648f7421z10acxhin6ypw5i"
   },
   "qtconnectivity": {
     "url": "https://invent.kde.org/qt/qt/qtconnectivity.git",
-    "rev": "f1be05c8efeb65b77a8bfd21763ab55bb5c04906",
-    "sha256": "1vl7wfw9sd8qfl8ixzl5wz4v5km5zdf9bii53q3pw4f2lplsralq"
+    "rev": "7e29434e06372efbb2127d0ef41538ff9aec1597",
+    "sha256": "1wv9bh13rq6mnnzsh6g88a2kj2j4nfv83vqpbdxmyavdf349pwdj"
   },
   "qtdatavis3d": {
     "url": "https://invent.kde.org/qt/qt/qtdatavis3d.git",
-    "rev": "d9b988d3c5f9f34b97f3a9ac1347bfb55464cd60",
-    "sha256": "09jk32kw7wgcrd117a9lsm5w7jszsdhdslk10qn631wz203zbs4i"
+    "rev": "b52063032fda9af894ca0e582774364ce8caf0f8",
+    "sha256": "1zbfx7hqh1ydi2vx8pj6dxlrrc7wf8sqcwxzx8acphdyj66zcmch"
   },
   "qtdeclarative": {
     "url": "https://invent.kde.org/qt/qt/qtdeclarative.git",
-    "rev": "1189557a50f11e7bc5716467a149cd09987a9f88",
-    "sha256": "0cd89d8i8chy1j1yanp1cq5s7467qr24b9c7cx9qw0nb0rf6f8qr"
+    "rev": "5bc1ac07b2d2c7839368084a4bb97e4c67eb8294",
+    "sha256": "0xpq0xjiscx72dcyg0lpr90ag5q7gypzcqnwbsnh401jrxn2pll1"
   },
   "qtdoc": {
     "url": "https://invent.kde.org/qt/qt/qtdoc.git",
-    "rev": "ddb2afda6f713259fc8d95fb22a1c96bb448c36a",
-    "sha256": "0nk2vwl0ppix794xzj8nqrhsc333v8v4vr1rmwddymwlrdqlqd5d"
+    "rev": "385efd460ec13a465765fc30dd11217ae46d1846",
+    "sha256": "0djflkibfgjp8gr16hiv6nipj4q4xyclgv84f3d951dj2q7779v6"
   },
   "qtgamepad": {
     "url": "https://invent.kde.org/qt/qt/qtgamepad.git",
-    "rev": "269fc0731f6838a1c02877a83c0ada23659c69fc",
-    "sha256": "06jhby671yzbj753yb0lnk4bv2r0nxxibq7fq1yljxdms0rc72iz"
+    "rev": "9b69ae558f0f9feffe30b0aa8993e270dfcc81ff",
+    "sha256": "056b39r4jsag5d7f5m04vmpydvnwpfs5mcynsdx717qdginlmiam"
   },
   "qtgraphicaleffects": {
     "url": "https://invent.kde.org/qt/qt/qtgraphicaleffects.git",
-    "rev": "dfb2e7b2c98a9b7185c300d0b92b4048f5d89ba5",
-    "sha256": "1sn46lmq0y56mw0q11sgaijr2vg1wpp6lj237finp6vr3bji2816"
+    "rev": "551732fb1d963e53af437e3982a010f69eb76253",
+    "sha256": "1pyjb66nhlhin6ysm4005ng4m2ak857ai761rqx8l2h4fscgwvhf"
   },
   "qtimageformats": {
     "url": "https://invent.kde.org/qt/qt/qtimageformats.git",
-    "rev": "c91e4c63c1eaf1e23806d9df10e3d5a9ae353c1d",
-    "sha256": "0q0vcymiqfyz8sfs9wdkhhwff55acj2rsmrb8w6yikmwcmcxp2a3"
+    "rev": "4076e38d68f05f5e1bcdedb79442d9008f18702c",
+    "sha256": "1kgvs3jgs2qysrx2kr4vn68h9gjv6ir1nd4hg0m2fbsjk644aa8w"
   },
   "qtlocation": {
     "url": "https://invent.kde.org/qt/qt/qtlocation.git",
-    "rev": "ba48a8b5cedd157d972c08d371ac2581db166bf7",
-    "sha256": "00kwv405qq9q8fcwar33s2wvs1dm10fb8plxbz1q0jqcjs2ips6x"
+    "rev": "81f560be2274958011c255efa1d2d573874bed11",
+    "sha256": "1lpxngppxkhych9pkkcvw7ypw02cd324pw0z9hd9kqcd803p2017"
   },
   "qtlottie": {
     "url": "https://invent.kde.org/qt/qt/qtlottie.git",
-    "rev": "27ed5a3c95a0810a96fac2a8661ea94d8ea3c44e",
-    "sha256": "04ivyxnn8d3pkjsbx0gwyj3f5if4m4cih6wyavm8bd2m2kkszx35"
+    "rev": "5f1be885cf4ee0f1eb5400bf0c5d138818fc01d0",
+    "sha256": "01880y8r2acnzfg09qm031kx99vp3zjv3zi38sh17shgcipx1fxp"
   },
   "qtmacextras": {
     "url": "https://invent.kde.org/qt/qt/qtmacextras.git",
-    "rev": "fc7e9f41d9cec2df05c1d38d6e55d3a0d501dd25",
-    "sha256": "07q1arvdjwmbrayp2b213b8gqm4psczhx9z1m83invwmbs8iqj07"
+    "rev": "722060e4edff268feb2dda1298a7837c90f6262f",
+    "sha256": "1fqw1p6vx3gqw1sf1yk4cz1cb3d1xrbjq0p22gi0pspll314c8x0"
   },
   "qtmultimedia": {
     "url": "https://invent.kde.org/qt/qt/qtmultimedia.git",
-    "rev": "ff83d119c75cd8406f73ccc08958fe36747e7390",
-    "sha256": "09jadnvphilcxxy85dlsr8a6x5w32r1c2hrbh93qbvvf9zlg60ld"
+    "rev": "8ddc44103baf166525d6650c842d7f08f651e7bb",
+    "sha256": "0akj2d8b6kdy125ggs9cd7pra3vm47frqpn6p756jafsxylkqwbh"
   },
   "qtnetworkauth": {
     "url": "https://invent.kde.org/qt/qt/qtnetworkauth.git",
-    "rev": "510687fa4fdee84dd3d6d166e8f080c484016199",
-    "sha256": "0a8abmql94wxpfvdj5a1rnh3xsd49c5z8x93hm311sgjkd0aajx7"
+    "rev": "d1ce24a72122c315e3d190c9ebc26ed603b90057",
+    "sha256": "1wcw26x38k619xavrwav21w0vrzb24bn6ncxllcwd9bdn7vvn1wr"
   },
   "qtpurchasing": {
     "url": "https://invent.kde.org/qt/qt/qtpurchasing.git",
-    "rev": "8e9a5ec9f68639162c85c198b28e072e7150883c",
-    "sha256": "04pmwqnw907dg0hpas0pdrh2fxcqn2mvqz82b1vkviksg8ny3saw"
+    "rev": "b471c6ca3edfa5ba459b8694622825b9e776bed6",
+    "sha256": "1plwpxasiw2sx76a294i4i92vk5g5gaigjfy284jpmaargxsyd7k"
   },
   "qtquick3d": {
     "url": "https://invent.kde.org/qt/qt/qtquick3d.git",
-    "rev": "47a325358078b72016081a86be628411df2728a9",
-    "sha256": "18h309g6ni6y4bcss930g04z8ymhl2nfm3sv5s4h2fz3dl0xsqwr"
+    "rev": "4e85bd063c726f015dc8afb05834de7a71bf6a1b",
+    "sha256": "0k6wjkr2jyc1v6xrm34dnlbbdnippiph5jxzjxawlxijzzvmgcp5"
   },
   "qtquickcontrols": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols.git",
-    "rev": "0c3c18bf8bdac1ef1afdb8aade903edb5c2bc041",
-    "sha256": "0h8bhrbgfcf7nbfppah8lxnhvygc09983qrvp935r5sw7251km4d"
+    "rev": "af7fc486c8910b51733e1c7e758d50ca1a158b36",
+    "sha256": "1nbgpnz2qi8g24cmli25a9319vgqmk9vgngb12q2j8c8k3nlhhfs"
   },
   "qtquickcontrols2": {
     "url": "https://invent.kde.org/qt/qt/qtquickcontrols2.git",
-    "rev": "e464888c53a641ee44a34ff2350cfb156c8ed59f",
-    "sha256": "08lnqz6v48j1hi6dpll7a052p6r5qfb32md16fppqzn6g5jg9ir2"
+    "rev": "5b808e0995d018c6de9f075d4a61f58d3641c11b",
+    "sha256": "1a65j06nzlxl1hmdh5li1gglcrqms0g560c2cj9vqzqm551krdj8"
   },
   "qtquicktimeline": {
     "url": "https://invent.kde.org/qt/qt/qtquicktimeline.git",
-    "rev": "43130f2681b76a8d743a04704465b716b6b2faee",
-    "sha256": "1z1avxxq9d9nzqyxy5pq5maj73cf6dvsn5k83p3sf5kq3x0y75cj"
+    "rev": "ea9d6c4d5a0a172b4778e8f37d694d02aab83f37",
+    "sha256": "0170n0mcrf8phh3nsg2f904p8vxwmw8lks48zkpnbvyrj4gzqcr2"
   },
   "qtremoteobjects": {
     "url": "https://invent.kde.org/qt/qt/qtremoteobjects.git",
-    "rev": "b2740a7c7f5b6ac810240404a947ca5cff9de5f7",
-    "sha256": "1jxlwc2y165fxdalcr4iqq55gsg5x4nxqd8wdq3dc1824yfnzm6i"
+    "rev": "48d10f341279e08c1bc4abb764c2d3ab9a259a51",
+    "sha256": "0523n172f96w474y804sanppfx2zkgsm342vwa6ailrcfkjw8v58"
   },
   "qtscxml": {
     "url": "https://invent.kde.org/qt/qt/qtscxml.git",
-    "rev": "57491f554bc53bd020978b5744437b7ac7e56a27",
-    "sha256": "00mvwgb3xr116nl7649zq7ai2074clzw760c140sy91zqgqkjsx4"
+    "rev": "edc6f0dd5e806cced1937b2b853717f588e14fd2",
+    "sha256": "1072slgrvy910mxxqsvf7fgi237mjnbd2b8amw1srqzqj2bmnsj3"
   },
   "qtsensors": {
     "url": "https://invent.kde.org/qt/qt/qtsensors.git",
-    "rev": "50a61b360877e7c1300df76b5aabf8d75554a398",
-    "sha256": "0giqwn4grg9999y31avh7ajsv9gkcfzf0xndx8bvv79si0wp59g6"
+    "rev": "8c6d11df60d4d783869c2d81568e3178f5ae75ce",
+    "sha256": "18jc5nncmpmbf758mcj9wj6dfn87hl51zp0ihqcvk6k6a8ra6l7p"
   },
   "qtserialbus": {
     "url": "https://invent.kde.org/qt/qt/qtserialbus.git",
-    "rev": "c23069351ec31563c9ea9fcdce42ccdba95ea518",
-    "sha256": "1qgxlgnl53gabrfqihxwygdbdiqjvn2hfajmwb3h44srpq0srk33"
+    "rev": "6734222bccc5541f9527281c810c6b5f8fdd092f",
+    "sha256": "0ragq01wdwqwqp9720i3xan3a4xnkkvgc8gjy1wgwmdrs0mlb49z"
   },
   "qtserialport": {
     "url": "https://invent.kde.org/qt/qt/qtserialport.git",
-    "rev": "b64a7eeda9b6a65b5ed01b1b40b07177f0aa4c0f",
-    "sha256": "134mn0njfvmzgrf325bikazkiq4xdn5wjhj56kxh1hhaz3q25hyp"
+    "rev": "ca1f2486527e7acf87d466062c035845f9774573",
+    "sha256": "0xdywglxh9sxs2s60shwf6c4m5w20h77l9d58rganqwpbrh49vkj"
   },
   "qtspeech": {
     "url": "https://invent.kde.org/qt/qt/qtspeech.git",
-    "rev": "aa2376f9b1302222edcd16b4641bbd7004318c00",
-    "sha256": "0vcxgkymzhaw01f26zlny4bka9k829rwzkwk95rr3dfq7wlyxshz"
+    "rev": "a384f0d4fb8a2d0743d5dfdf12e40f6d76f8714c",
+    "sha256": "0imn7jskjvz30xnbg1z8wxkcw82hb6v92xls327385wxxj0a5i6r"
   },
   "qtsvg": {
     "url": "https://invent.kde.org/qt/qt/qtsvg.git",
-    "rev": "b74f7291f343dcbcb487b020868f042d8fe83098",
-    "sha256": "1n0sjn8h5k2sh8p2a85cxdpqbnd63gz4rf9wwbshhd13w623f9s8"
+    "rev": "d2abfb9cb1f036446e5913fadb0f065dab9f0159",
+    "sha256": "048lbk25rbfbd2c8pbsifdxjcxb2003hi04lfsmgh7xr27x55gch"
   },
   "qttools": {
     "url": "https://invent.kde.org/qt/qt/qttools.git",
-    "rev": "fa40a2d3373b89be0cd0a43fe0c1d047e3d34058",
-    "sha256": "06kr88gmwc7xh1whdbcg84y1naak5rv99jkscjbhzyz3z91xy7hl"
+    "rev": "3e3ab58b40734a1b9bbb7e72b2969d1f752351b1",
+    "sha256": "18dmmw1r13in7h90y3637jw3sc2pvv33bfr1bs11dyp951spw8d3"
   },
   "qttranslations": {
     "url": "https://invent.kde.org/qt/qt/qttranslations.git",
-    "rev": "3cbcceb8e3e2e63a4022f1be946c7118c527a83e",
-    "sha256": "15lw5snqfkwwcsazh02lhiia39gy08nfijdpkzvll2qvg4b58zkn"
+    "rev": "388e4f32ed4b28d92bd61b917ba0e6b910e2784d",
+    "sha256": "1k76zl5c1x9q8kid3sjv4d66wy9ryl24fyiabrg32c7nbn53pbd4"
   },
   "qtvirtualkeyboard": {
     "url": "https://invent.kde.org/qt/qt/qtvirtualkeyboard.git",
-    "rev": "859d2a6ee329cc08414410b2ef8c0af77a6853d3",
-    "sha256": "06sdpcanzp1a71d99rjivrbjp780mvwssc4w1sap2gskcmmgkwbs"
+    "rev": "4fc9919ee3fad1d520d0921ba3069dca3c34ff78",
+    "sha256": "12kn69l34s1r6s9w7cw9l5524kwrx8xrxwbx4hw059jns1pqac0d"
   },
   "qtwayland": {
     "url": "https://invent.kde.org/qt/qt/qtwayland.git",
-    "rev": "df49b9f3badce793a0a9ea850cf1a02cc5bafef6",
-    "sha256": "01xm2r1pv7kxb4aj72ldfzmax6d799h6bj4h2xhpcii812wf5lda"
+    "rev": "605b8bc942ab263b9d1892af33a81b408f522ccc",
+    "sha256": "09vrd62ikxzjpv6awi7n34pswg4w5yvmac5ckc6ma6rqvps7mbip"
   },
   "qtwebchannel": {
     "url": "https://invent.kde.org/qt/qt/qtwebchannel.git",
-    "rev": "2a157921861e651f43456cb7941b250c89feb736",
-    "sha256": "1w58b602f20mppd0zfr9yvfdn1xwfkfclnjs0p5mgymq6d946dyk"
+    "rev": "6a20afaeba182ce6e3faee592e1e85a0d3ec0fc6",
+    "sha256": "18jfxpasn47qd4glkgvps7nzm07dag6w9jbkq9l7fzbkpcbnqykb"
   },
   "qtwebglplugin": {
     "url": "https://invent.kde.org/qt/qt/qtwebglplugin.git",
-    "rev": "b9aaac72d0853ba48f6bfd710a43df94d83d4701",
-    "sha256": "07zx55f52jgk31bm6c68iydknrih245ndnvz714l6kxw66fv4rjq"
+    "rev": "2a8ce0a61b4b9e892d948948182d935fa6792a1b",
+    "sha256": "10n50frndssj3vmmhghlw48dn0c9b26zgkgjvkza8x234j9dijv2"
   },
   "qtwebsockets": {
     "url": "https://invent.kde.org/qt/qt/qtwebsockets.git",
-    "rev": "0f910acb737cefc889ce1088fc60d15bc18efe9c",
-    "sha256": "1ba9ll28hznd6qpjjiqvc2z6gaz2qgq7105dd0w810xpbaiixy0a"
+    "rev": "10eb706b24aa05f4ee69c2f2fec99b21994dfe2b",
+    "sha256": "1k01s4qkpzsjy7lygb0nhniym6g7yinih3sc16l3kljkabw44rx0"
   },
   "qtwebview": {
     "url": "https://invent.kde.org/qt/qt/qtwebview.git",
-    "rev": "34342073a59f3a27ef3de02f6b21337c4f8db6cf",
-    "sha256": "1h6n7dkd6mjclxllyw2brz8wv4d68dx2ykckbwb3bkxyd6rmg1f6"
+    "rev": "043cb7c0eaf8d1bcee56a62d6a102f727a22fcbc",
+    "sha256": "0ha0ksbxm21hj37z7yk3f09ncgchw78cpcrxv56a205i2f04370d"
   },
   "qtwinextras": {
     "url": "https://invent.kde.org/qt/qt/qtwinextras.git",
-    "rev": "5e5ae2b77078dbe51fb798743de606e6f9a5e19d",
-    "sha256": "04x8ax197z0dr01nxrb6bh4q8c077ny5n812fx5mq56l54v2m1ks"
+    "rev": "0704d01ff1218c2f32a194e38005e625c579222c",
+    "sha256": "0fsfrs770cia9i9ijvx1jyh0mjiza1cn1l7fm1a877h2qbd20l9f"
   },
   "qtx11extras": {
     "url": "https://invent.kde.org/qt/qt/qtx11extras.git",
-    "rev": "c44c4fa86fa0794c25baef4ee1f6272aca8c511a",
-    "sha256": "0287cvs9wqlzz6gnj81gi8rp50s2rdnigcmld3fgddsg8f3v7hdj"
+    "rev": "6695a3df4460577b3fcb5546b45a0c5cb3addac4",
+    "sha256": "1xjdicq8kf6816hgnz4hc7ykcfngispm8xzv3bxacf98zicmy9rm"
   },
   "qtxmlpatterns": {
     "url": "https://invent.kde.org/qt/qt/qtxmlpatterns.git",
-    "rev": "0b644263abca66503db1ce8a4e126cf358a34685",
-    "sha256": "1b1zzglvcdp7wvlpgk1gj8gmyy2r21yi6p8xiyvbccq5bbjpn0hw"
+    "rev": "ed3b333aa56ac193e969725e3c34be9070441271",
+    "sha256": "0s0z9dbivrq5pva6psfcfclw4816zb1rlr9ns03lf286iy196368"
   }
 }
diff --git a/pkgs/development/libraries/qt-5/5.15/srcs.nix b/pkgs/development/libraries/qt-5/5.15/srcs.nix
index 87a7bb97707d..ec5fdc9d5646 100644
--- a/pkgs/development/libraries/qt-5/5.15/srcs.nix
+++ b/pkgs/development/libraries/qt-5/5.15/srcs.nix
@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "5.15.18";
+  version = "5.15.19";
 
   mk = name: args: {
     inherit version;
diff --git a/pkgs/development/libraries/qt-6/fetch.sh b/pkgs/development/libraries/qt-6/fetch.sh
index 73d170689480..bd94b3ae2c48 100644
--- a/pkgs/development/libraries/qt-6/fetch.sh
+++ b/pkgs/development/libraries/qt-6/fetch.sh
@@ -1 +1 @@
-WGET_ARGS=( https://download.qt.io/official_releases/qt/6.11/6.11.0/submodules/ -A '*.tar.xz' )
+WGET_ARGS=( https://download.qt.io/official_releases/qt/6.11/6.11.1/submodules/ -A '*.tar.xz' )
diff --git a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
index fa3ae210d281..df428b92f64e 100644
--- a/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtbase/default.nix
@@ -246,11 +246,6 @@ stdenv.mkDerivation {
     # don't pass qtbase's QML directory to qmlimportscanner if it's empty
     ./skip-missing-qml-directory.patch
 
-    # backport crash fix
-    (fetchpatch {
-      url = "https://github.com/qt/qtbase/commit/1466f88633b2c29a6159a0c2eacd0c0d6601aa5e.diff";
-      hash = "sha256-ubDAXF47SYagRAJ5SYyBxXl2PiHjAZo3xlYPDz1jRYM=";
-    })
     # another crash fix
     (fetchpatch {
       url = "https://github.com/qt/qtbase/commit/515cbbacfba9f4259c9c3b0714a31222c2b4c879.diff";
diff --git a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
index 786229c5651b..2f19e06a67fa 100644
--- a/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtdeclarative/default.nix
@@ -43,6 +43,12 @@ qtModule {
       hash = "sha256-ESy35OlmsvI4yFQ/rFT8oelOUBCwCmlcbQJvwcTrCig=";
       revert = true;
     })
+
+    # backport fix recommended by KDE
+    (fetchpatch {
+      url = "https://github.com/qt/qtdeclarative/commit/8a2c82be6ad90e3f2a0760d8bab1e3a8cdb2473a.diff";
+      hash = "sha256-3KbyoQPAiRyCwGnwwYV3y0yz2i6UAJcX70EPsXV0ZZM=";
+    })
   ];
 
   cmakeFlags = [
diff --git a/pkgs/development/libraries/qt-6/modules/qtmqtt.nix b/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
index effea1d03ab4..c70d2cbd1f88 100644
--- a/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
+++ b/pkgs/development/libraries/qt-6/modules/qtmqtt.nix
@@ -6,13 +6,13 @@
 
 qtModule rec {
   pname = "qtmqtt";
-  version = "6.11.0";
+  version = "6.11.1";
 
   src = fetchFromGitHub {
     owner = "qt";
     repo = "qtmqtt";
     tag = "v${version}";
-    hash = "sha256-7X+HWAftWHn40RPFQD3/f+bp00LQk8Vsb871WfxdZSE=";
+    hash = "sha256-GWaF4iCPtATL1mJkPHVY0rom8R2FMNWGahE3KWBlfV8=";
   };
 
   propagatedBuildInputs = [ qtbase ];
diff --git a/pkgs/development/libraries/qt-6/srcs.nix b/pkgs/development/libraries/qt-6/srcs.nix
index 73067dc5fd5c..93c206858d18 100644
--- a/pkgs/development/libraries/qt-6/srcs.nix
+++ b/pkgs/development/libraries/qt-6/srcs.nix
@@ -4,339 +4,339 @@
 
 {
   qt3d = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qt3d-everywhere-src-6.11.0.tar.xz";
-      sha256 = "086xpissihbil51ryl83dlcpkpv3pp3ryj0712x9k9z6756j7ks0";
-      name = "qt3d-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qt3d-everywhere-src-6.11.1.tar.xz";
+      sha256 = "01q11bs7vjz1s5wdrdjq904dgl2m6l7r8d3vd2kyf7lx0j78qvd6";
+      name = "qt3d-everywhere-src-6.11.1.tar.xz";
     };
   };
   qt5compat = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qt5compat-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0gn6sj136y8yl1c00nbm81rmhws0mgx35ny7llx74j97ddj58ag6";
-      name = "qt5compat-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qt5compat-everywhere-src-6.11.1.tar.xz";
+      sha256 = "06qndy534rzabxk9yq07dsl8fj1vd72lmck11r5xbajil3d9zjyg";
+      name = "qt5compat-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtactiveqt = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtactiveqt-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1kbqa0gx41s097281g4zym9jmjs2ffc75p3rgkbs6bvnlrvl0h89";
-      name = "qtactiveqt-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtactiveqt-everywhere-src-6.11.1.tar.xz";
+      sha256 = "05hcnhxkajry4ha7ykmqr83p16qjipspwxid8l2rxgz80wy6aadv";
+      name = "qtactiveqt-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtbase = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtbase-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0pkmrd8ypw1v21cx0890gc6z4v0xr5qip2jnr56r2kc6g5cxh6i3";
-      name = "qtbase-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtbase-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1b616gr7k8byfr2ns4vczs4kj3sznhlrlw9inpb3m8la48qllnfr";
+      name = "qtbase-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtcanvaspainter = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtcanvaspainter-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1gmgzmh81wrnj81xsmilqwhc1wv7j2avg91mww8jlrv5rplzynjl";
-      name = "qtcanvaspainter-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtcanvaspainter-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1l08zp68q3wcr9v5hh82kw6jqvc1wmnrjn7h9959psx520dwcdly";
+      name = "qtcanvaspainter-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtcharts = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtcharts-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1dcldlw24qd9swynxcdsxnk8haiv442wx323j7qgfwjp13a9nh5c";
-      name = "qtcharts-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtcharts-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0p2icmrwb6am7x2kgk9pnpa8ypi7jiscyaawgi0x31iaihqyvqrz";
+      name = "qtcharts-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtconnectivity = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtconnectivity-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0fhrqqz58h3smkksfgnax73bmsiz7q9a1w9vhwd83vs9r0jc3w60";
-      name = "qtconnectivity-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtconnectivity-everywhere-src-6.11.1.tar.xz";
+      sha256 = "14g5h0wixqy981cnn5f8gkjbji804f18gfjkzbanxd0lljg2h191";
+      name = "qtconnectivity-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtdatavis3d = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtdatavis3d-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1jr3bkvp4wj1jdafc64ziq4raxbya6jk6s0d4mq0w2kr7zpqrggf";
-      name = "qtdatavis3d-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtdatavis3d-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1b4kcqfq5q79lm70f08qiksxl36laa9dgx9ladjk2xwl1af7n6hy";
+      name = "qtdatavis3d-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtdeclarative = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtdeclarative-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1sgxxmg49flana7mylyz4c5mf5hr00kzl8nkwwj87pqx8dlybv2f";
-      name = "qtdeclarative-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtdeclarative-everywhere-src-6.11.1.tar.xz";
+      sha256 = "193ar0fcfzjjr7mi8i2622vip95qrr3qry949d9lyc5hf3v71rjj";
+      name = "qtdeclarative-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtdoc = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtdoc-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1wwl2vr1qs2lqmz45iqpkzkxqp97g0yzfmz0kb5wpi8sys7c07bx";
-      name = "qtdoc-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtdoc-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1hd5z6prx2sbr3wxzkynrn2iyjllvkids505l2xg3p272j4b5306";
+      name = "qtdoc-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtgraphs = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtgraphs-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0nxifvs5042pzyd5syhgpmxzsq07fhpbbm57ckwzsn55q14cnvyz";
-      name = "qtgraphs-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtgraphs-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0qh43qxqg4biyrrsd78nmi4dm3dnbswa95cq8db2k3lans517cc4";
+      name = "qtgraphs-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtgrpc = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtgrpc-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0yd8jjxigaynv386f3cs1i743nm7yngciw346xqfil3chd8wpvcx";
-      name = "qtgrpc-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtgrpc-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0l52w91hd2crq6zyh5a8arv07yixnwcr2pya74bxpk2hqpq08ys3";
+      name = "qtgrpc-everywhere-src-6.11.1.tar.xz";
     };
   };
   qthttpserver = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qthttpserver-everywhere-src-6.11.0.tar.xz";
-      sha256 = "16wqglm8ws63qs7i769xy94bygwbhkz7hjfw27hnps7d4yirb41b";
-      name = "qthttpserver-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qthttpserver-everywhere-src-6.11.1.tar.xz";
+      sha256 = "01p7li9fvwnz2shx3d9wj9nnnnipya2q0whchyvgjqb8yzy71gq4";
+      name = "qthttpserver-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtimageformats = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtimageformats-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1j0cjj7gxjbprszw349janl3zk38rkby1bmxil329zp2qlmb1bfk";
-      name = "qtimageformats-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtimageformats-everywhere-src-6.11.1.tar.xz";
+      sha256 = "04y4pa5krrpyiqn039d6m8bzcxj6pa1m850rz3bmw5xc8ml6rgxj";
+      name = "qtimageformats-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtlanguageserver = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtlanguageserver-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1gq5yjvk6iyg606pgpxkb136qlz9hpb7ngll81nhiyb1ym1y9j0v";
-      name = "qtlanguageserver-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtlanguageserver-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1vwavpi8swgs88pfjfddnb9cmsb4k1sjcgywp2rsnm6ay8vqa02h";
+      name = "qtlanguageserver-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtlocation = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtlocation-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1vxb6n8xf98zcg2bw29gsaqa74sg6jn9ilzs8c5b9q79i9m3if49";
-      name = "qtlocation-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtlocation-everywhere-src-6.11.1.tar.xz";
+      sha256 = "06z4hbiqki5chhmph131s71czyrjpnjvy3rxb4560vwy55vwx49p";
+      name = "qtlocation-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtlottie = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtlottie-everywhere-src-6.11.0.tar.xz";
-      sha256 = "02ndplkk4bq01b0fh9l2ykw09v0k5nbsayrs9wcjwrdwg5law8rg";
-      name = "qtlottie-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtlottie-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0y969gp64imwh49d5zbnw0wi2yva9fsp6qn58617rs9kvkdzml70";
+      name = "qtlottie-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtmultimedia = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtmultimedia-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0h30l8zflkla7rcshgs0jfjbjwvq9rqx0wq83f6vd0x9lz0cmi4h";
-      name = "qtmultimedia-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtmultimedia-everywhere-src-6.11.1.tar.xz";
+      sha256 = "02lvq1jk6m67m6z0w7vdzxhzmi441j8avvp79mfclfpfvm98w3rr";
+      name = "qtmultimedia-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtnetworkauth = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtnetworkauth-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1mqly8had79f54dlygh42jr0c0jfiv4j4w2rbr0s7qx9nk9ig342";
-      name = "qtnetworkauth-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtnetworkauth-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0gan2qjv97d1387jqaiis2gigm6lz5jbk1k10x13w0yc5kr5n7cz";
+      name = "qtnetworkauth-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtopenapi = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtopenapi-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1h2pcq6i72yic0r7ns36vj678d1xqy291jamqd6b6jkjddmj1hlg";
-      name = "qtopenapi-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtopenapi-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0nzl95w5pbfd6mfb6rzv6arz09pcm6siz1n07pgm9rrdr6z083a4";
+      name = "qtopenapi-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtpositioning = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtpositioning-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1scnnz65qyfg0nl9vjkqcss8xsw3yf91w71d9p1kwlfybscd07yn";
-      name = "qtpositioning-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtpositioning-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1xbq1xjjbhb41lfp9mli8a5rgqf5pniswv0161v6wa5f04cbkrnm";
+      name = "qtpositioning-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtquick3d = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtquick3d-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1549gdb3yxj1bpl54kgnkkhzjx0zxqi71ssp4rj6qnz56fxh085l";
-      name = "qtquick3d-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtquick3d-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0vs5bcz62r32gin0g4lb6wdmqrv0ypzar1s9wsza98la7zg8asy7";
+      name = "qtquick3d-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtquick3dphysics = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtquick3dphysics-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0dcx9913xss435cijx5bzckvsn66qfi6c39rx0gyv9iiys76qym5";
-      name = "qtquick3dphysics-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtquick3dphysics-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1bvrmjb6m0ynq00ybdghvkbmwm237vff23ng8n4njysf05pns26i";
+      name = "qtquick3dphysics-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtquickeffectmaker = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtquickeffectmaker-everywhere-src-6.11.0.tar.xz";
-      sha256 = "05fpv497rmx2lw7gx05sxyxjwx8gq8fbbnkzhnw73pk2xqzq20mc";
-      name = "qtquickeffectmaker-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtquickeffectmaker-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0sqk8hkkdibv0ayxrvpcbgj3dcwfngpd6qjp2xm15pcbx1q3xrng";
+      name = "qtquickeffectmaker-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtquicktimeline = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtquicktimeline-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1micycw7m25gw0bgbfq7bnr7cg7qrjj2r69320rglc8lak6f3nq6";
-      name = "qtquicktimeline-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtquicktimeline-everywhere-src-6.11.1.tar.xz";
+      sha256 = "09wcx83yxif8r4v81h2jfj3wlj60wnc9k4dsp7hlah4yzm1zclxg";
+      name = "qtquicktimeline-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtremoteobjects = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtremoteobjects-everywhere-src-6.11.0.tar.xz";
-      sha256 = "15yykbaxqc6v2flgjvn92w7gwfvi820dg4cxkjxcfhpix2m21571";
-      name = "qtremoteobjects-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtremoteobjects-everywhere-src-6.11.1.tar.xz";
+      sha256 = "06hiiyjpcgn8dp9jmgxj30nlrw73rqb869f0m63scccmqsarhqj0";
+      name = "qtremoteobjects-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtscxml = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtscxml-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1rylchpvzldy7hhr3icr85w8m4hf7wch17yqh368yrn3q19klf3c";
-      name = "qtscxml-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtscxml-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0gr0j09isxgii3aivfvr35x40d9n0kj0g2icc7g7bzniwm2m4jcf";
+      name = "qtscxml-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtsensors = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtsensors-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1iy33w7gjp06xi4342si979q9w84cvbbk90kxmk2gx69icjjja21";
-      name = "qtsensors-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtsensors-everywhere-src-6.11.1.tar.xz";
+      sha256 = "13ygry3lybkgci6gkrd7k081l01icavzkiyy4g82drbvv9i70q93";
+      name = "qtsensors-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtserialbus = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtserialbus-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1qfs9zqvz3hf16w8gg6nlwxcv6sz72546pds02dabhkcw47nqvmh";
-      name = "qtserialbus-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtserialbus-everywhere-src-6.11.1.tar.xz";
+      sha256 = "02pj4jnxc4afl5ymv7w8asggpg0hdj3dbnwwcqd305b8il69qv64";
+      name = "qtserialbus-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtserialport = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtserialport-everywhere-src-6.11.0.tar.xz";
-      sha256 = "111pmva70mcffhq09q2h1gcr03fivs9j2ywx4ib00pbyxfvr4ii6";
-      name = "qtserialport-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtserialport-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0x1r5l3kx7riprf0b2api0bcg0z755fq9vbgmx7px6pxiy4imwws";
+      name = "qtserialport-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtshadertools = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtshadertools-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0jp1sb9pl7y821awln7rpk0hz7d5ipwnkqhy51caich9i2pb2g74";
-      name = "qtshadertools-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtshadertools-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1z42r414jid12jmhm1yf5kw44j886w01igav0kggkg13kcphax90";
+      name = "qtshadertools-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtspeech = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtspeech-everywhere-src-6.11.0.tar.xz";
-      sha256 = "08fv8v6rvcv0pa6r52kr2na2rcpjr3yk556ksinnh6aslv8qbid9";
-      name = "qtspeech-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtspeech-everywhere-src-6.11.1.tar.xz";
+      sha256 = "051z4yf22hkqhy3pkgxq8s77x06k4cd70i9jcmd8f99004cc6df0";
+      name = "qtspeech-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtsvg = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtsvg-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1rih59jsn0wq12gq5gbs1cz9by27x2x4wjpd0ya7s207pr9xda6z";
-      name = "qtsvg-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtsvg-everywhere-src-6.11.1.tar.xz";
+      sha256 = "154adaicyy5wyz6yc95g3lm4iw9v2zdsd7l5qp107gr490pz0g3z";
+      name = "qtsvg-everywhere-src-6.11.1.tar.xz";
     };
   };
   qttasktree = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qttasktree-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0kxkm3qvzw5i5x2ads6skpz8z6shbn2msznmr614yvsdgiga4yjr";
-      name = "qttasktree-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qttasktree-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1mjdwy3i24ggn2g82z5pg3grzhnaxmq7nmvdc7ba8dsdixzvjam2";
+      name = "qttasktree-everywhere-src-6.11.1.tar.xz";
     };
   };
   qttools = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qttools-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0xpwv483zrw3jkajhv9sbr7bm95qahxg770vn1jqk10hg8yrkcfg";
-      name = "qttools-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qttools-everywhere-src-6.11.1.tar.xz";
+      sha256 = "03gmr9zpf0raqcvqk2cpw9lblw907hsl5cb5c2fgm4wwcxd86qcf";
+      name = "qttools-everywhere-src-6.11.1.tar.xz";
     };
   };
   qttranslations = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qttranslations-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0mpy3y76n1jw2prhad9rqyn48miqlmqg3581jgzr4s1iwhpqpx2l";
-      name = "qttranslations-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qttranslations-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0xsnxhiqc3ybwvyn1jbhdf1sjmcf7v4mma6w9sxwg535420jrh1p";
+      name = "qttranslations-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtvirtualkeyboard = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtvirtualkeyboard-everywhere-src-6.11.0.tar.xz";
-      sha256 = "11p6m1s7r7q2y6a2ak5lyzfd2907s2skfa630snf64x32cblp2nq";
-      name = "qtvirtualkeyboard-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtvirtualkeyboard-everywhere-src-6.11.1.tar.xz";
+      sha256 = "073y02qmpwxxdqc4pkm6k9frghsjg1zppg2hip5b4hv269xrdim1";
+      name = "qtvirtualkeyboard-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtwayland = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtwayland-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0dsdv1d4p1wf0sqd26cmj486bvwlprmqzmjddsw24agrc3kyc477";
-      name = "qtwayland-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwayland-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1cyr5frhglp2krxvpnqk9q426rgp6nr34ngnxpa42m7p0ajqly4m";
+      name = "qtwayland-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtwebchannel = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtwebchannel-everywhere-src-6.11.0.tar.xz";
-      sha256 = "097vm6pxh18bil9ld9cxg50v861nyhaha4f6bjfjqph1icx18ip9";
-      name = "qtwebchannel-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwebchannel-everywhere-src-6.11.1.tar.xz";
+      sha256 = "10ld2nh6gd1v2ssbgqlf6w0lsjlqkjdfwqv85mn5krnnf45vbyv9";
+      name = "qtwebchannel-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtwebengine = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtwebengine-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0dk72k92zp19jkph1vl88l2dyrh105v6cycsxln1anfxnb423fb3";
-      name = "qtwebengine-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwebengine-everywhere-src-6.11.1.tar.xz";
+      sha256 = "10vhcvw8j60n0mf38bi3fjcx5v1i0cbfyn4wbqhzqn61qv66d737";
+      name = "qtwebengine-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtwebsockets = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtwebsockets-everywhere-src-6.11.0.tar.xz";
-      sha256 = "0cnh67ncfh0gvpqfiqhr0cpmswq9zysza130axlmh69mzg8i17sn";
-      name = "qtwebsockets-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwebsockets-everywhere-src-6.11.1.tar.xz";
+      sha256 = "1gvgci383dfm4sljqlapdiva7jhks1i2z2ayck0wbj1436hklgi4";
+      name = "qtwebsockets-everywhere-src-6.11.1.tar.xz";
     };
   };
   qtwebview = {
-    version = "6.11.0";
+    version = "6.11.1";
     src = fetchurl {
-      url = "${mirror}/official_releases/qt/6.11/6.11.0/submodules/qtwebview-everywhere-src-6.11.0.tar.xz";
-      sha256 = "1cy4x331h0f4d5l8c18xrvdq6hwz7r16qd1xhr8gdm8j9bcsw3nb";
-      name = "qtwebview-everywhere-src-6.11.0.tar.xz";
+      url = "${mirror}/official_releases/qt/6.11/6.11.1/submodules/qtwebview-everywhere-src-6.11.1.tar.xz";
+      sha256 = "0g8k4xs7b0s474x00ds4i8q9b164icdgrdg8ngln10nmf3pwhqld";
+      name = "qtwebview-everywhere-src-6.11.1.tar.xz";
     };
   };
 }
diff --git a/pkgs/development/libraries/science/math/openblas/default.nix b/pkgs/development/libraries/science/math/openblas/default.nix
index 9d5d2b4449fd..97b7596b937c 100644
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@@ -170,7 +170,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "openblas";
-  version = "0.3.32";
+  version = "0.3.33";
 
   outputs = [
     "out"
@@ -181,7 +181,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "OpenMathLib";
     repo = "OpenBLAS";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-D0Wu5Ew72aTqSjj970yOfAwPg1T4Qm6zmpaGlQ/5Q1k=";
+    hash = "sha256-EArf0K2Gs+w8IRD5wkMOQv79e8yMoTgQfa9kzjXKn3Y=";
   };
 
   patches = [
@@ -190,13 +190,13 @@ stdenv.mkDerivation (finalAttrs: {
     # INCLUDEDIR already fixed in upstream HEAD & significant refactor
     # to config gen so not PRing changes
     ./cmake-include-fixes.patch
-    # Fix build on LoongArch (error: '_Float16' is not supported on this target)
+    # This was an attempted fix for the below commit but still leaves some scipy tests failing.
     (fetchpatch {
-      url = "https://github.com/OpenMathLib/OpenBLAS/commit/7086a1b075ca317e12cfe79d40a32ad342a30496.patch";
-      hash = "sha256-pA3HK2f2MJr/+h/uale7edIYk/KH194EscYFcsujPXY=";
+      url = "https://github.com/OpenMathLib/OpenBLAS/commit/e3ce4623c299068bbd47c35ee87aab334bac73b1.patch";
+      revert = true;
+      hash = "sha256-WrP3RCDk/EbpqVOw9XGLnFI+6/bBGJTIrt2TRYGLVQ4=";
     })
     # This commit led to miscompilation of certain ASIMD extensions code paths.
-    # There was an attempted fix in upstream but this still leaves some scipy tests failing.
     (fetchpatch {
       url = "https://github.com/OpenMathLib/OpenBLAS/commit/3f6e928d34aca977bd5d4191e6d2c2338a342.patch";
       revert = true;
@@ -271,7 +271,9 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "USE_OPENMP" false) # openblas will refuse building with both USE_OPENMP=ON and USE_THREAD=OFF
   ];
 
-  doCheck = true;
+  # FIXME: this broke some time between a0374025a863d007d98e3297f6aa46cc3141c2f0 and 34268251cf5547d39063f2c5ea9a196246f7f3a6
+  # This just serves to unbreak stable
+  doCheck = stdenv.hostPlatform.system != "i686-linux";
 
   postInstall = ''
         # Provide headers in /include directly for compat with some consumers like flint
diff --git a/pkgs/development/python-modules/acquire/default.nix b/pkgs/development/python-modules/acquire/default.nix
index bfd005e9a55d..a0d7e8ee07f7 100644
--- a/pkgs/development/python-modules/acquire/default.nix
+++ b/pkgs/development/python-modules/acquire/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage rec {
   pname = "acquire";
-  version = "3.21";
+  version = "3.22";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fox-it";
     repo = "acquire";
     tag = version;
-    hash = "sha256-CVwPMMQFGqvyxm5tK7JMEX8/dgiF25wwRNaLNfLLWto=";
+    hash = "sha256-CtzVHnQALqA5D0wJQ74lAw9HunVFZEkKvij6RQaQrBE=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/adafruit-platformdetect/default.nix b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
index 6638dade8bda..737eb12c8fd8 100644
--- a/pkgs/development/python-modules/adafruit-platformdetect/default.nix
+++ b/pkgs/development/python-modules/adafruit-platformdetect/default.nix
@@ -7,13 +7,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "adafruit-platformdetect";
-  version = "3.88.0";
+  version = "3.89.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "adafruit_platformdetect";
     inherit (finalAttrs) version;
-    hash = "sha256-3CGI3bNIv9KgKpUzJjKUzA8XYr2fazsghmVH2YggzXE=";
+    hash = "sha256-dFUtGvz3eahMpjUnoerumZXEKf9CLbFUkrrQw1mcq0s=";
   };
 
   build-system = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/afdko/default.nix b/pkgs/development/python-modules/afdko/default.nix
index c1df13372fc1..1053d44c328f 100644
--- a/pkgs/development/python-modules/afdko/default.nix
+++ b/pkgs/development/python-modules/afdko/default.nix
@@ -1,25 +1,28 @@
 {
   lib,
   stdenv,
+  addBinToPathHook,
   antlr4_13,
   booleanoperations,
   buildPythonPackage,
   cmake,
+  cython,
   defcon,
   fetchFromGitHub,
-  fetchpatch,
   fontmath,
   fonttools,
   libxml2,
   lxml,
+  mypy,
   ninja,
   pytestCheckHook,
   runAllTests ? false,
-  scikit-build,
+  scikit-build-core,
   setuptools-scm,
   tqdm,
   ufonormalizer,
   ufoprocessor,
+  uharfbuzz,
 
   # passthru
   afdko,
@@ -27,22 +30,33 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "afdko";
-  version = "4.0.2";
+  version = "5.0.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "adobe-type-tools";
     repo = "afdko";
     tag = finalAttrs.version;
-    hash = "sha256:0955dvbydifhgx9gswbf5drsmmghry7iyf6jwz6qczhj86clswcm";
+    hash = "sha256:sha256-ts7vFfbPPrdooOH0JYrn3YKs7kRju4LbZ8Ypd3ExELc=";
   };
 
-  build-system = [ setuptools-scm ];
+  postPatch = ''
+    # https://github.com/NixOS/nixpkgs/pull/510112#issuecomment-4263642029
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'cmake_minimum_required(VERSION 3.16)' "cmake_minimum_required(VERSION 3.16)
+    find_package(LibXml2 REQUIRED)"
+  '';
 
-  nativeBuildInputs = [
-    scikit-build
+  build-system = [
     cmake
+    cython
     ninja
+    scikit-build-core
+    setuptools-scm
+  ];
+
+  cmakeFlags = [
+    "-DANTLR4_INCLUDE_DIRS=${lib.getDev antlr4_13.runtime.cpp}/include/antlr4-runtime"
   ];
 
   buildInputs = [
@@ -51,37 +65,19 @@ buildPythonPackage (finalAttrs: {
   ];
 
   patches = [
-    # Don't try to install cmake and ninja using pip
-    ./no-pypi-build-tools.patch
+    ./dont-fetch-third-party-libs.patch
 
     # Use antlr4 runtime from nixpkgs and link it dynamically
     ./use-dynamic-system-antlr4-runtime.patch
-
-    # Fix tests
-    # FIXME: remove in 5.0
-    (fetchpatch {
-      url = "https://github.com/adobe-type-tools/afdko/commit/3b78bea15245e2bd2417c25ba5c2b8b15b07793c.patch";
-      excludes = [
-        "CMakeLists.txt"
-        "requirements.txt"
-      ];
-      hash = "sha256-Ao5AUVm1h4a3qidqlBFWdC7jiXyBfXQEnsT7XsXXXRU=";
-    })
   ];
 
   env = {
+    FORCE_SYSTEM_ANTLR4 = true;
     # Use system libxml2
     FORCE_SYSTEM_LIBXML2 = true;
-  }
-  // lib.optionalAttrs stdenv.cc.isClang {
-    NIX_CFLAGS_COMPILE = toString [
-      "-Wno-error=incompatible-function-pointer-types"
-      "-Wno-error=int-conversion"
-    ];
   };
 
-  # setup.py will always (re-)execute cmake in buildPhase
-  dontConfigure = true;
+  dontUseCmakeConfigure = true;
 
   dependencies = [
     booleanoperations
@@ -100,34 +96,14 @@ buildPythonPackage (finalAttrs: {
   ++ fonttools.optional-dependencies.unicode
   ++ fonttools.optional-dependencies.woff;
 
-  postInstall = ''
-    # clean up the install directory
-    # 5.0.0 release revamps the build system and hopefully makes this unnecessary
-    rm -r $out/{_skbuild,c,tests}
-  '';
-
-  nativeCheckInputs = [ pytestCheckHook ];
-
-  preCheck = ''
-    export PATH=$PATH:$out/bin
-
-    # Remove build artifacts to prevent them from messing with the tests
-    rm -r _skbuild
-  '';
+  nativeCheckInputs = [
+    addBinToPathHook
+    mypy
+    pytestCheckHook
+    uharfbuzz
+  ];
 
   disabledTests = [
-    # broke in the fontforge 4.51 -> 4.53 update
-    "test_glyphs_2_7"
-    "test_hinting_data"
-    "test_waterfallplot"
-    # broke at some point
-    "test_type1_supported_hint"
-  ]
-  ++ lib.optionals (stdenv.cc.isGNU) [
-    # broke in the gcc 13 -> 14 update
-    "test_dump"
-    "test_input_formats"
-    "test_other_input_formats"
   ]
   ++ lib.optionals (!runAllTests) [
     # Disable slow tests, reduces test time ~25 %
diff --git a/pkgs/development/python-modules/afdko/dont-fetch-third-party-libs.patch b/pkgs/development/python-modules/afdko/dont-fetch-third-party-libs.patch
new file mode 100644
index 000000000000..48e4ce99fcfe
--- /dev/null
+++ b/pkgs/development/python-modules/afdko/dont-fetch-third-party-libs.patch
@@ -0,0 +1,12 @@
+diff --git a/third_party/LibXml2/CMakeLists.txt b/third_party/LibXml2/CMakeLists.txt
+index 2549e5f0..8835658f 100644
+--- a/third_party/LibXml2/CMakeLists.txt
++++ b/third_party/LibXml2/CMakeLists.txt
+@@ -12,6 +12,7 @@ FetchContent_Declare(LibXml2
+         GIT_REPOSITORY https://gitlab.gnome.org/GNOME/libxml2.git
+         GIT_TAG ${LIBXML2_TAG}
+         EXCLUDE_FROM_ALL
++        ${fetch_content_args}
+ )
+ 
+ option(AFDKO_BUILD_LIBXML2_SHARED_LIB
diff --git a/pkgs/development/python-modules/afdko/no-pypi-build-tools.patch b/pkgs/development/python-modules/afdko/no-pypi-build-tools.patch
deleted file mode 100644
index a3ef7dd23b85..000000000000
--- a/pkgs/development/python-modules/afdko/no-pypi-build-tools.patch
+++ /dev/null
@@ -1,24 +0,0 @@
-commit a5fde72bd15e0baba008ea54270a1ffe017544a0
-Author: sternenseemann <sternenseemann@systemli.org>
-Date:   Tue Oct 5 18:17:20 2021 +0200
-
-    Don't use pypi distributions of build tools
-    
-    We want to use regular cmake and ninja and not the pypi projects which
-    somehow wrap and vendor a version of the proper tool.
-
-diff --git a/setup.py b/setup.py
-index 973e2826..dba58766 100644
---- a/setup.py
-+++ b/setup.py
-@@ -198,9 +198,7 @@ def main():
-           setup_requires=[
-               'wheel',
-               'setuptools_scm',
--              'scikit-build',
--              'cmake',
--              'ninja'
-+              'scikit-build'
-           ],
-           tests_require=[
-               'pytest',
diff --git a/pkgs/development/python-modules/afdko/use-dynamic-system-antlr4-runtime.patch b/pkgs/development/python-modules/afdko/use-dynamic-system-antlr4-runtime.patch
index d2184e8d2804..df574f96d89c 100644
--- a/pkgs/development/python-modules/afdko/use-dynamic-system-antlr4-runtime.patch
+++ b/pkgs/development/python-modules/afdko/use-dynamic-system-antlr4-runtime.patch
@@ -1,53 +1,26 @@
-commit 3560653d5d52bf30a52ce971ecfe262b1a09d7a3
-Author: sternenseemann <sternenseemann@systemli.org>
-Date:   Tue Oct 5 18:16:10 2021 +0200
-
-    Link against system antlr4 runtime, dynamically
-    
-    Instead of cloning a antlr4 version from git, use the system one. Also
-    don't link it statically, but dynamically by default (the library is
-    called antlr4-runtime, not antlr4_static).
-
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 88e9cfd0..3df902b4 100644
+index e6b30c83..ec74fd5f 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -36,11 +36,10 @@ list(APPEND CMAKE_MODULE_PATH ${CMAKE_CURRENT_SOURCE_DIR}/cmake)
- # https://www.antlr.org/download/antlr4-cpp-runtime-4.9.3-source.zip
- # set(ANTLR4_ZIP_REPOSITORY "/path_to_antlr4_archive/a4.zip")
+@@ -134,7 +134,7 @@ add_subdirectory(c/spot)
+ add_subdirectory(c/type1)
+ add_subdirectory(c/addfeatures)
  
--add_definitions(-DANTLR4CPP_STATIC)
- set(ANTLR4_WITH_STATIC_CRT OFF)
--# 4.9.3 is the latest ANTLR4 version
- set(ANTLR4_TAG tags/4.13.2)
--include(ExternalAntlr4Cpp)
-+find_path(ANTLR4_HEADER antlr4-runtime.h PATH_SUFFIXES antlr4-runtime)
-+set(ANTLR4_INCLUDE_DIRS ${ANTLR4_HEADER})
+-target_link_libraries(_internal PRIVATE afdko_version detype1 type1 addfeatures spot sfntedit sfntdiff mergefonts rotatefont shared afdko::antlr4)
++target_link_libraries(_internal PRIVATE afdko_version detype1 type1 addfeatures spot sfntedit sfntdiff mergefonts rotatefont shared antlr4-runtime)
  
+ if(CMAKE_USE_PTHREADS_INIT)
+     target_link_libraries(_internal PRIVATE Threads::Threads)
+diff --git a/c/addfeatures/hotconv/CMakeLists.txt b/c/addfeatures/hotconv/CMakeLists.txt
+index 7e281af9..f7100558 100644
+--- a/c/addfeatures/hotconv/CMakeLists.txt
++++ b/c/addfeatures/hotconv/CMakeLists.txt
+@@ -72,7 +72,7 @@ target_include_directories(hotconv BEFORE PRIVATE $<$<COMPILE_LANGUAGE:CXX>:${AN
+ target_include_directories(hotconv AFTER PRIVATE ../include ../../shared/resource)
+ # Because hotconv is an object library, all this should do is
+ # establish the build dependency
+-target_link_libraries(hotconv PUBLIC afdko::antlr4 shared)
++target_link_libraries(hotconv PUBLIC antlr4-runtime shared)
  
- if (DEFINED ENV{FORCE_BUILD_LIBXML2})
-diff --git a/c/makeotf/lib/cffread/CMakeLists.txt b/c/makeotf/lib/cffread/CMakeLists.txt
-index 2990035f..fab25a77 100644
---- a/c/makeotf/lib/cffread/CMakeLists.txt
-+++ b/c/makeotf/lib/cffread/CMakeLists.txt
-@@ -8,6 +8,6 @@ if (${NEED_LIBXML2_DEPEND})
-     add_dependencies(makeotf_cffread ${LIBXML2_TARGET})
- endif()
- 
--target_link_libraries(makeotf_cffread PUBLIC antlr4_static)
-+target_link_libraries(makeotf_cffread PUBLIC antlr4-runtime)
- 
- target_compile_definitions(makeotf_cffread PRIVATE $<$<CONFIG:Debug>:CFF_DEBUG=1> CFF_T13_SUPPORT=0)
-diff --git a/c/makeotf/lib/hotconv/CMakeLists.txt b/c/makeotf/lib/hotconv/CMakeLists.txt
-index 60e49458..ada728c0 100644
---- a/c/makeotf/lib/hotconv/CMakeLists.txt
-+++ b/c/makeotf/lib/hotconv/CMakeLists.txt
-@@ -70,7 +70,7 @@ add_library(hotconv STATIC
- set_property(TARGET hotconv PROPERTY C_STANDARD 99)
- set_property(TARGET hotconv PROPERTY CXX_STANDARD 17)
- target_include_directories(hotconv PRIVATE AFTER $<$<COMPILE_LANGUAGE:CXX>:${ANTLR4_INCLUDE_DIRS}>)
--target_link_libraries(hotconv PUBLIC antlr4_static)
-+target_link_libraries(hotconv PUBLIC antlr4-runtime)
- 
- target_link_libraries(hotconv PUBLIC ${CHOSEN_LIBXML2_LIBRARY})
- 
+ if ( CMAKE_COMPILER_IS_GNUCC )
+         set_property(TARGET hotconv APPEND PROPERTY
diff --git a/pkgs/development/python-modules/aiodns/default.nix b/pkgs/development/python-modules/aiodns/default.nix
index 54b67a88be19..21251500362e 100644
--- a/pkgs/development/python-modules/aiodns/default.nix
+++ b/pkgs/development/python-modules/aiodns/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aiodns";
-  version = "4.0.0";
+  version = "4.0.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "saghul";
     repo = "aiodns";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/iYkhzN01+NaUfMXaM39IvlEKfoKc29+f0S4y0y3GG8=";
+    hash = "sha256-TLiiSRhZaEbHeyrQPk8uvj10VEttRanYEgkBy7DxH4Y=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/alibabacloud-actiontrail20200706/default.nix b/pkgs/development/python-modules/alibabacloud-actiontrail20200706/default.nix
new file mode 100644
index 000000000000..5482393be588
--- /dev/null
+++ b/pkgs/development/python-modules/alibabacloud-actiontrail20200706/default.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  alibabacloud-tea-openapi,
+  buildPythonPackage,
+  darabonba-core,
+  fetchPypi,
+  nix-update-script,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "alibabacloud-actiontrail20200706";
+  version = "2.6.0";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    pname = "alibabacloud_actiontrail20200706";
+    inherit (finalAttrs) version;
+    hash = "sha256-+vsUsjOZPaV8+GjmSQMGu62hmuNLDRcCvJo52WFNAVc=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    alibabacloud-tea-openapi
+    darabonba-core
+  ];
+
+  pythonImportsCheck = [ "alibabacloud_actiontrail20200706" ];
+
+  # Module has no tests
+  doCheck = false;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Alibaba Cloud ActionTrail (20200706) SDK Library for Python";
+    homepage = "https://pypi.org/project/alibabacloud-actiontrail20200706/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/alibabacloud-cs20151215/default.nix b/pkgs/development/python-modules/alibabacloud-cs20151215/default.nix
new file mode 100644
index 000000000000..ab477fa8f7f5
--- /dev/null
+++ b/pkgs/development/python-modules/alibabacloud-cs20151215/default.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  alibabacloud-tea-openapi,
+  buildPythonPackage,
+  darabonba-core,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "alibabacloud-cs20151215";
+  version = "7.0.0";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    pname = "alibabacloud_cs20151215";
+    inherit (finalAttrs) version;
+    hash = "sha256-pmpUm/gLkGwtG7uSsd0YhngLe5TseF+ILrrnUhzpMJE=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    alibabacloud-tea-openapi
+    darabonba-core
+  ];
+
+  pythonImportsCheck = [ "alibabacloud_cs20151215" ];
+
+  # Module has no tests
+  doCheck = false;
+
+  meta = {
+    description = "Alibaba Cloud CS (20151215) SDK Library for Python";
+    homepage = "https://pypi.org/project/alibabacloud-cs20151215/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/alibabacloud-darabonba-array/default.nix b/pkgs/development/python-modules/alibabacloud-darabonba-array/default.nix
new file mode 100644
index 000000000000..fdef2c05d581
--- /dev/null
+++ b/pkgs/development/python-modules/alibabacloud-darabonba-array/default.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "alibabacloud-darabonba-array";
+  version = "0.1.0";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    pname = "alibabacloud_darabonba_array";
+    inherit (finalAttrs) version;
+    hash = "sha256-f5p8YyUY/08M67DU6CWkjBLnzwuQFuolBU3XNzLhVao=";
+  };
+
+  build-system = [ setuptools ];
+
+  pythonImportsCheck = [ "alibabacloud_darabonba_array" ];
+
+  # Module has no tests
+  doCheck = false;
+
+  meta = {
+    description = "Alibaba Cloud Darabonba Array SDK Library for Python";
+    homepage = "https://github.com/aliyun/darabonba-array";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/alibabacloud-darabonba-encode-util/default.nix b/pkgs/development/python-modules/alibabacloud-darabonba-encode-util/default.nix
new file mode 100644
index 000000000000..3b630f976cfb
--- /dev/null
+++ b/pkgs/development/python-modules/alibabacloud-darabonba-encode-util/default.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "alibabacloud-darabonba-encode-util";
+  version = "0.0.2";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    pname = "alibabacloud_darabonba_encode_util";
+    inherit (finalAttrs) version;
+    hash = "sha256-8cSE8nbWBFD6SbSymHGU50H8svf6rn8ofArmWryF/U0=";
+  };
+
+  build-system = [ setuptools ];
+
+  pythonImportsCheck = [ "alibabacloud_darabonba_encode_util" ];
+
+  # Module has no tests
+  doCheck = false;
+
+  meta = {
+    description = "Darabonba Encode Util Library for Alibaba Cloud Python SDK";
+    homepage = "https://github.com/aliyun/darabonba-crypto-util";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/alibabacloud-darabonba-map/default.nix b/pkgs/development/python-modules/alibabacloud-darabonba-map/default.nix
new file mode 100644
index 000000000000..9f005664d0bb
--- /dev/null
+++ b/pkgs/development/python-modules/alibabacloud-darabonba-map/default.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "alibabacloud-darabonba-map";
+  version = "0.0.1";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    pname = "alibabacloud_darabonba_map";
+    inherit (finalAttrs) version;
+    hash = "sha256-rbFzhGWKGo9yQY8YONS2pf0lZr/TkqPvBtnbsKWVoj8=";
+  };
+
+  build-system = [ setuptools ];
+
+  pythonImportsCheck = [ "alibabacloud_darabonba_map" ];
+
+  # Module has no tests
+  doCheck = false;
+
+  meta = {
+    description = "Alibaba Cloud Darabonba Map SDK Library for Python";
+    homepage = "https://github.com/aliyun/darabonba-map";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/alibabacloud-darabonba-signature-util/default.nix b/pkgs/development/python-modules/alibabacloud-darabonba-signature-util/default.nix
new file mode 100644
index 000000000000..51abf003111a
--- /dev/null
+++ b/pkgs/development/python-modules/alibabacloud-darabonba-signature-util/default.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  buildPythonPackage,
+  cryptography,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "alibabacloud-darabonba-signature-util";
+  version = "0.0.4";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    pname = "alibabacloud_darabonba_signature_util";
+    inherit (finalAttrs) version;
+    hash = "sha256-cdebKuZZV7z79pnO2JT9p4KzL5Y18WFmNVM+WpDV/rA=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ cryptography ];
+
+  pythonImportsCheck = [ "alibabacloud_darabonba_signature_util" ];
+
+  # Module has no tests
+  doCheck = false;
+
+  meta = {
+    description = "Darabonba Signature Util Library for Alibaba Cloud Python SDK";
+    homepage = "https://github.com/aliyun/darabonba-crypto-util";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/alibabacloud-darabonba-string/default.nix b/pkgs/development/python-modules/alibabacloud-darabonba-string/default.nix
new file mode 100644
index 000000000000..d23204c52fda
--- /dev/null
+++ b/pkgs/development/python-modules/alibabacloud-darabonba-string/default.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "alibabacloud-darabonba-string";
+  version = "0.0.4";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    inherit (finalAttrs) version pname;
+    hash = "sha256-7GYUwESNrcvF5GZIWDih+M/dkRE1vqc54gsUURJwxvc=";
+  };
+
+  build-system = [ setuptools ];
+
+  pythonImportsCheck = [ "alibabacloud_darabonba_string" ];
+
+  # Module has no tests
+  doCheck = false;
+
+  meta = {
+    description = "Alibaba Cloud Darabonba String Library for Python";
+    homepage = "https://github.com/aliyun/darabonba-string";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/alibabacloud-darabonba-time/default.nix b/pkgs/development/python-modules/alibabacloud-darabonba-time/default.nix
new file mode 100644
index 000000000000..6c4c0b0096cf
--- /dev/null
+++ b/pkgs/development/python-modules/alibabacloud-darabonba-time/default.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "alibabacloud-darabonba-time";
+  version = "0.0.1";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    pname = "alibabacloud_darabonba_time";
+    inherit (finalAttrs) version;
+    hash = "sha256-CtnHsGllcNGj9AEGzHd391X9krqg0dyrW333jd5bki0=";
+  };
+
+  build-system = [ setuptools ];
+
+  pythonImportsCheck = [ "alibabacloud_darabonba_time" ];
+
+  # Module has no tests
+  doCheck = false;
+
+  meta = {
+    description = "Alibaba Cloud Darabonba Time SDK Library for Python";
+    homepage = "https://github.com/aliyun/darabonba-time";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/alibabacloud-ecs20140526/default.nix b/pkgs/development/python-modules/alibabacloud-ecs20140526/default.nix
new file mode 100644
index 000000000000..cb33051d3649
--- /dev/null
+++ b/pkgs/development/python-modules/alibabacloud-ecs20140526/default.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  alibabacloud-tea-openapi,
+  buildPythonPackage,
+  darabonba-core,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "alibabacloud-ecs20140526";
+  version = "7.8.7";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    pname = "alibabacloud_ecs20140526";
+    inherit (finalAttrs) version;
+    hash = "sha256-78QeY9Qpcwf71EelPt0wP+KUg3foUUSynhCcn+ofbGc=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    alibabacloud-tea-openapi
+    darabonba-core
+  ];
+
+  pythonImportsCheck = [ "alibabacloud_ecs20140526" ];
+
+  # Module has no tests
+  doCheck = false;
+
+  meta = {
+    description = "Alibaba Cloud Elastic Compute Service (20140526) SDK Library for Python";
+    homepage = "https://pypi.org/project/alibabacloud-ecs20140526/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/alibabacloud-gateway-oss-util/default.nix b/pkgs/development/python-modules/alibabacloud-gateway-oss-util/default.nix
new file mode 100644
index 000000000000..508fa9515da4
--- /dev/null
+++ b/pkgs/development/python-modules/alibabacloud-gateway-oss-util/default.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "alibabacloud-gateway-oss-util";
+  version = "0.0.13";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    pname = "alibabacloud_gateway_oss_util";
+    inherit (finalAttrs) version;
+    hash = "sha256-RlWx2oGOieifxcs0UHhapFVZT5XYJAR3EXPJuJXtMDc=";
+  };
+
+  build-system = [ setuptools ];
+
+  pythonImportsCheck = [ "alibabacloud_gateway_oss_util" ];
+
+  # Module has no tests
+  doCheck = false;
+
+  meta = {
+    description = "Alibaba Cloud OSS Util Library for Python";
+    homepage = "https://pypi.org/project/alibabacloud-gateway-oss-util/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/alibabacloud-gateway-oss/default.nix b/pkgs/development/python-modules/alibabacloud-gateway-oss/default.nix
new file mode 100644
index 000000000000..fe70db7d78ff
--- /dev/null
+++ b/pkgs/development/python-modules/alibabacloud-gateway-oss/default.nix
@@ -0,0 +1,63 @@
+{
+  lib,
+  alibabacloud-darabonba-array,
+  alibabacloud-darabonba-encode-util,
+  alibabacloud-darabonba-map,
+  alibabacloud-darabonba-signature-util,
+  alibabacloud-darabonba-string,
+  alibabacloud-darabonba-time,
+  alibabacloud-gateway-oss-util,
+  alibabacloud-gateway-spi,
+  alibabacloud-openapi-util,
+  alibabacloud-oss-util,
+  alibabacloud-tea-util,
+  alibabacloud-tea-xml,
+  buildPythonPackage,
+  darabonba-core,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "alibabacloud-gateway-oss";
+  version = "0.0.27";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    pname = "alibabacloud_gateway_oss";
+    inherit (finalAttrs) version;
+    hash = "sha256-sUBDgkDLzieRDe08J2iVdcAwHwrhGghKqii3ST3rYFI=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    alibabacloud-gateway-spi
+    alibabacloud-tea-util
+    alibabacloud-oss-util
+    alibabacloud-openapi-util
+    alibabacloud-tea-xml
+    alibabacloud-darabonba-string
+    alibabacloud-darabonba-map
+    alibabacloud-darabonba-array
+    alibabacloud-darabonba-encode-util
+    alibabacloud-darabonba-signature-util
+    alibabacloud-darabonba-time
+    alibabacloud-gateway-oss-util
+    darabonba-core
+  ];
+
+  pythonImportsCheck = [ "alibabacloud_gateway_oss" ];
+
+  # Module has only tests in the untagged upstream repo
+  doCheck = false;
+
+  meta = {
+    description = "Aliyun Gateway OSS Library for Python";
+    homepage = "https://pypi.org/project/alibabacloud-gateway-oss/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/alibabacloud-gateway-sls-util/default.nix b/pkgs/development/python-modules/alibabacloud-gateway-sls-util/default.nix
new file mode 100644
index 000000000000..21566831604b
--- /dev/null
+++ b/pkgs/development/python-modules/alibabacloud-gateway-sls-util/default.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  aliyun-log-fastpb,
+  buildPythonPackage,
+  fetchPypi,
+  lz4,
+  setuptools,
+  zstd,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "alibabacloud-gateway-sls-util";
+  version = "0.4.1";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    pname = "alibabacloud_gateway_sls_util";
+    inherit (finalAttrs) version;
+    hash = "sha256-KJ8wLg4HRWvl+BG+m5tSZEVXauO5HxJfFYcNM1ohEjQ=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    aliyun-log-fastpb
+    lz4
+    zstd
+  ];
+
+  pythonImportsCheck = [ "alibabacloud_gateway_sls_util" ];
+
+  # Module has no tests
+  doCheck = false;
+
+  meta = {
+    description = "Alibaba Gateway SLS Util Library for Python";
+    homepage = "https://pypi.org/project/alibabacloud-gateway-sls-util/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/alibabacloud-gateway-sls/default.nix b/pkgs/development/python-modules/alibabacloud-gateway-sls/default.nix
new file mode 100644
index 000000000000..d97e0b43c31e
--- /dev/null
+++ b/pkgs/development/python-modules/alibabacloud-gateway-sls/default.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  alibabacloud-darabonba-array,
+  alibabacloud-darabonba-encode-util,
+  alibabacloud-darabonba-map,
+  alibabacloud-darabonba-signature-util,
+  alibabacloud-darabonba-string,
+  alibabacloud-gateway-sls-util,
+  alibabacloud-gateway-spi,
+  alibabacloud-openapi-util,
+  alibabacloud-tea-util,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "alibabacloud-gateway-sls";
+  version = "0.4.2";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    pname = "alibabacloud_gateway_sls";
+    inherit (finalAttrs) version;
+    hash = "sha256-EGaFojtJqy8Ggu4sPhYNqbUOpGbeUxtOklm8jAWD1h4=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    alibabacloud-darabonba-array
+    alibabacloud-darabonba-encode-util
+    alibabacloud-darabonba-map
+    alibabacloud-darabonba-signature-util
+    alibabacloud-darabonba-string
+    alibabacloud-gateway-sls-util
+    alibabacloud-gateway-spi
+    alibabacloud-openapi-util
+    alibabacloud-tea-util
+  ];
+
+  pythonImportsCheck = [ "alibabacloud_gateway_sls" ];
+
+  # Module has only tests in the untagged upstream repo
+  doCheck = false;
+
+  meta = {
+    description = "Aliyun Gateway SLS Library for Python";
+    homepage = "https://pypi.org/project/alibabacloud-gateway-sls/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/alibabacloud-gateway-spi/default.nix b/pkgs/development/python-modules/alibabacloud-gateway-spi/default.nix
index 49cec2b80802..c10f0691555b 100644
--- a/pkgs/development/python-modules/alibabacloud-gateway-spi/default.nix
+++ b/pkgs/development/python-modules/alibabacloud-gateway-spi/default.nix
@@ -6,14 +6,16 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "alibabacloud-gateway-spi";
   version = "0.0.3";
   pyproject = true;
 
+  __structuredAttrs = true;
+
   src = fetchPypi {
     pname = "alibabacloud_gateway_spi";
-    inherit version;
+    inherit (finalAttrs) version;
     hash = "sha256-ENHFOj/F+HkV+9a0mFuYM4p3bptEoCY/VmQ8UEgiO4s=";
   };
 
@@ -32,4 +34,4 @@ buildPythonPackage rec {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/alibabacloud-oss-util/default.nix b/pkgs/development/python-modules/alibabacloud-oss-util/default.nix
new file mode 100644
index 000000000000..3e792fd07dec
--- /dev/null
+++ b/pkgs/development/python-modules/alibabacloud-oss-util/default.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  alibabacloud-tea,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "alibabacloud-oss-util";
+  version = "0.0.6";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    pname = "alibabacloud_oss_util";
+    inherit (finalAttrs) version;
+    hash = "sha256-0+zsNmMkNL1QmhE+jPMn3CPoMKyNndaUmSb04zTItdY=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ alibabacloud-tea ];
+
+  pythonImportsCheck = [ "alibabacloud_oss_util" ];
+
+  # Module has no tests
+  doCheck = false;
+
+  meta = {
+    description = "Alibaba Cloud Cloud OSS Util Library for Python";
+    homepage = "https://pypi.org/project/alibabacloud-oss-util/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/alibabacloud-oss20190517/default.nix b/pkgs/development/python-modules/alibabacloud-oss20190517/default.nix
new file mode 100644
index 000000000000..d1d8f72b3e16
--- /dev/null
+++ b/pkgs/development/python-modules/alibabacloud-oss20190517/default.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  alibabacloud-gateway-oss,
+  alibabacloud-gateway-spi,
+  alibabacloud-openapi-util,
+  alibabacloud-tea-openapi,
+  alibabacloud-tea-util,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "alibabacloud-oss20190517";
+  version = "1.0.6";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    pname = "alibabacloud_oss20190517";
+    inherit (finalAttrs) version;
+    hash = "sha256-fND7Fq9hPOs40uDlKaofWAOMfPWetnyMh3WuROpxeFI=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    alibabacloud-gateway-oss
+    alibabacloud-gateway-spi
+    alibabacloud-openapi-util
+    alibabacloud-tea-openapi
+    alibabacloud-tea-util
+  ];
+
+  pythonImportsCheck = [ "alibabacloud_oss20190517" ];
+
+  # Module has no tests
+  doCheck = false;
+
+  meta = {
+    description = "Alibaba Cloud Object Storage Service (20190517) SDK Library for Python";
+    homepage = "https://pypi.org/project/alibabacloud-oss20190517/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/alibabacloud-ram20150501/default.nix b/pkgs/development/python-modules/alibabacloud-ram20150501/default.nix
new file mode 100644
index 000000000000..ffa802f1a398
--- /dev/null
+++ b/pkgs/development/python-modules/alibabacloud-ram20150501/default.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  alibabacloud-endpoint-util,
+  alibabacloud-openapi-util,
+  alibabacloud-tea-openapi,
+  alibabacloud-tea-util,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "alibabacloud-ram20150501";
+  version = "1.2.0";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    pname = "alibabacloud_ram20150501";
+    inherit (finalAttrs) version;
+    hash = "sha256-YlNRPIiAdp9P1bNv7d2zYqnKYorZrpwFwO6s9fvJW0I=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    alibabacloud-endpoint-util
+    alibabacloud-openapi-util
+    alibabacloud-tea-openapi
+    alibabacloud-tea-util
+  ];
+
+  pythonImportsCheck = [ "alibabacloud_ram20150501" ];
+
+  # Module has no tests
+  doCheck = false;
+
+  meta = {
+    description = "Alibaba Cloud Resource Access Management (20150501) SDK Library for Python";
+    homepage = "https://pypi.org/project/alibabacloud-ram20150501/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/alibabacloud-rds20140815/default.nix b/pkgs/development/python-modules/alibabacloud-rds20140815/default.nix
new file mode 100644
index 000000000000..e41abf5e0c9c
--- /dev/null
+++ b/pkgs/development/python-modules/alibabacloud-rds20140815/default.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  alibabacloud-endpoint-util,
+  alibabacloud-openapi-util,
+  alibabacloud-tea-openapi,
+  alibabacloud-tea-util,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "alibabacloud-rds20140815";
+  version = "13.0.1";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    pname = "alibabacloud_rds20140815";
+    inherit (finalAttrs) version;
+    hash = "sha256-NKXg9OpjRcPzk6T54okr1Za2hmX5m2FV3y1QoYEqS3k=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    alibabacloud-endpoint-util
+    alibabacloud-openapi-util
+    alibabacloud-tea-openapi
+    alibabacloud-tea-util
+  ];
+
+  pythonImportsCheck = [ "alibabacloud_rds20140815" ];
+
+  # Module has no tests
+  doCheck = false;
+
+  meta = {
+    description = "Alibaba Cloud rds (20140815) SDK Library for Python";
+    homepage = "https://pypi.org/project/alibabacloud-rds20140815/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/alibabacloud-sas20181203/default.nix b/pkgs/development/python-modules/alibabacloud-sas20181203/default.nix
new file mode 100644
index 000000000000..11585202a1db
--- /dev/null
+++ b/pkgs/development/python-modules/alibabacloud-sas20181203/default.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  alibabacloud-tea-openapi,
+  buildPythonPackage,
+  darabonba-core,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "alibabacloud-sas20181203";
+  version = "9.3.3";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    pname = "alibabacloud_sas20181203";
+    inherit (finalAttrs) version;
+    hash = "sha256-Y1xDWiGmjuDkcgF6c031fe5xBO4tA8xUH9DIXBN2oRw=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    alibabacloud-tea-openapi
+    darabonba-core
+  ];
+
+  pythonImportsCheck = [ "alibabacloud_sas20181203" ];
+
+  # Module has no tests
+  doCheck = false;
+
+  meta = {
+    description = "Alibaba Cloud Threat Detection (20181203) SDK Library for Python";
+    homepage = "https://pypi.org/project/alibabacloud-sas20181203/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/alibabacloud-sls20201230/default.nix b/pkgs/development/python-modules/alibabacloud-sls20201230/default.nix
new file mode 100644
index 000000000000..ae7345c28dd2
--- /dev/null
+++ b/pkgs/development/python-modules/alibabacloud-sls20201230/default.nix
@@ -0,0 +1,43 @@
+{
+  lib,
+  alibabacloud-gateway-sls,
+  alibabacloud-tea-openapi,
+  buildPythonPackage,
+  darabonba-core,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "alibabacloud-sls20201230";
+  version = "5.14.0";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    pname = "alibabacloud_sls20201230";
+    inherit (finalAttrs) version;
+    hash = "sha256-tySehsqxNdVfTHan9603srbIuwOQDx6FLAB6S3Cc1YQ=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    alibabacloud-gateway-sls
+    alibabacloud-tea-openapi
+    darabonba-core
+  ];
+
+  pythonImportsCheck = [ "alibabacloud_sls20201230" ];
+
+  # Module has no tests
+  doCheck = false;
+
+  meta = {
+    description = "Alibaba Cloud Log Service (20201230) SDK Library for Python";
+    homepage = "https://pypi.org/project/alibabacloud-sls20201230/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/alibabacloud-sts20150401/default.nix b/pkgs/development/python-modules/alibabacloud-sts20150401/default.nix
new file mode 100644
index 000000000000..553e38a09bfe
--- /dev/null
+++ b/pkgs/development/python-modules/alibabacloud-sts20150401/default.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  alibabacloud-tea-openapi,
+  buildPythonPackage,
+  darabonba-core,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "alibabacloud-sts20150401";
+  version = "1.2.0";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    pname = "alibabacloud_sts20150401";
+    inherit (finalAttrs) version;
+    hash = "sha256-uXu8bL+1zycJ3bZBqJOZofbzAj2UwYM12pqTlWl538o=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    alibabacloud-tea-openapi
+    darabonba-core
+  ];
+
+  pythonImportsCheck = [ "alibabacloud_sts20150401" ];
+
+  # Module has no tests
+  doCheck = false;
+
+  meta = {
+    description = "Alibaba Cloud Sts (20150401) SDK Library for Python";
+    homepage = "https://pypi.org/project/alibabacloud-sts20150401/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/alibabacloud-tea-openapi/default.nix b/pkgs/development/python-modules/alibabacloud-tea-openapi/default.nix
new file mode 100644
index 000000000000..2c59b457f730
--- /dev/null
+++ b/pkgs/development/python-modules/alibabacloud-tea-openapi/default.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  alibabacloud-credentials,
+  alibabacloud-gateway-spi,
+  alibabacloud-tea-util,
+  buildPythonPackage,
+  cryptography,
+  darabonba-core,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "alibabacloud-tea-openapi";
+  version = "0.4.4";
+  pyproject = true;
+
+  src = fetchPypi {
+    pname = "alibabacloud_tea_openapi";
+    inherit (finalAttrs) version;
+    hash = "sha256-GwkXvAPNSUF9pklF6ScxcW1T4uuHB7I19U5Ft0cyIc4=";
+  };
+
+  pythonRelaxDeps = [ "cryptography" ];
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    alibabacloud-credentials
+    alibabacloud-gateway-spi
+    alibabacloud-tea-util
+    cryptography
+    darabonba-core
+  ];
+
+  pythonImportsCheck = [ "Tea" ];
+
+  # Module has only tests in the untagged upstream repo
+  doCheck = false;
+
+  meta = {
+    description = "Aliyun Tea OpenAPI Library for Python";
+    homepage = "https://pypi.org/project/alibabacloud-tea-openapi/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/alibabacloud-tea-util/default.nix b/pkgs/development/python-modules/alibabacloud-tea-util/default.nix
index f8356abd01c3..9cc91a7c0d81 100644
--- a/pkgs/development/python-modules/alibabacloud-tea-util/default.nix
+++ b/pkgs/development/python-modules/alibabacloud-tea-util/default.nix
@@ -6,14 +6,16 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "alibabacloud-tea-util";
   version = "0.3.14";
   pyproject = true;
 
+  __structuredAttrs = true;
+
   src = fetchPypi {
     pname = "alibabacloud_tea_util";
-    inherit version;
+    inherit (finalAttrs) version;
     hash = "sha256-cI58n2RkGjyeDlZjZdLyNnX418Kj4pcdlALO7eBAjNs=";
   };
 
@@ -32,4 +34,4 @@ buildPythonPackage rec {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/alibabacloud-tea-xml/default.nix b/pkgs/development/python-modules/alibabacloud-tea-xml/default.nix
new file mode 100644
index 000000000000..ec8c03f87141
--- /dev/null
+++ b/pkgs/development/python-modules/alibabacloud-tea-xml/default.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  alibabacloud-tea,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "alibabacloud-tea-xml";
+  version = "0.0.3";
+  pyproject = true;
+
+  src = fetchPypi {
+    pname = "alibabacloud_tea_xml";
+    inherit (finalAttrs) version;
+    hash = "sha256-l5y1H630Ped/QcafxpwSUpcokZ+ElyPrDNJOt7BIqQw=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ alibabacloud-tea ];
+
+  pythonImportsCheck = [ "alibabacloud_tea_xml" ];
+
+  # Module has only tests in the untagged upstream repo
+  doCheck = false;
+
+  meta = {
+    description = "Aliyun Tea XML Library for Python";
+    homepage = "https://pypi.org/project/alibabacloud-tea-xml/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/alibabacloud-vpc20160428/default.nix b/pkgs/development/python-modules/alibabacloud-vpc20160428/default.nix
new file mode 100644
index 000000000000..5c1c8e800018
--- /dev/null
+++ b/pkgs/development/python-modules/alibabacloud-vpc20160428/default.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  alibabacloud-tea-openapi,
+  buildPythonPackage,
+  darabonba-core,
+  fetchPypi,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "alibabacloud-vpc20160428";
+  version = "7.1.2";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    pname = "alibabacloud_vpc20160428";
+    inherit (finalAttrs) version;
+    hash = "sha256-/9AcLNOeEmbbpZ2IeAkIxNNKVdZ4lY7OgBROhIakZIM=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    alibabacloud-tea-openapi
+    darabonba-core
+  ];
+
+  pythonImportsCheck = [ "alibabacloud_vpc20160428" ];
+
+  # Module has no tests
+  doCheck = false;
+
+  meta = {
+    description = "Alibaba Cloud Virtual Private Cloud (20160428) SDK Library for Python";
+    homepage = "https://pypi.org/project/alibabacloud-vpc20160428/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/aliyun-log-fastpb/default.nix b/pkgs/development/python-modules/aliyun-log-fastpb/default.nix
new file mode 100644
index 000000000000..f6ed9f4bdfe1
--- /dev/null
+++ b/pkgs/development/python-modules/aliyun-log-fastpb/default.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  buildPythonPackage,
+  cargo,
+  fetchPypi,
+  nix-update-script,
+  rustPlatform,
+  rustc,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "aliyun-log-fastpb";
+  version = "0.3.0";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    pname = "aliyun_log_fastpb";
+    inherit (finalAttrs) version;
+    hash = "sha256-dG4/tVx+brlxXoUqdcrFck6Zh3jAmtF+Aiso63axp0E=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-WPjJalEd/3jrx8pFP/RbHqQqMuloemTLeVjXjpOoJsQ=";
+  };
+
+  build-system = [
+    cargo
+    rustPlatform.cargoSetupHook
+    rustPlatform.maturinBuildHook
+    rustc
+  ];
+
+  # Missing dependency logs_pb2
+  doCheck = false;
+
+  pythonImportsCheck = [ "aliyun_log_fastpb" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Fast protobuf serialization for Aliyun Log using PyO3 and quick-protobuf";
+    homepage = "https://pypi.org/project/aliyun-log-fastpb";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/apiflask/default.nix b/pkgs/development/python-modules/apiflask/default.nix
index ff9d06f2fdbc..d7267c718f00 100644
--- a/pkgs/development/python-modules/apiflask/default.nix
+++ b/pkgs/development/python-modules/apiflask/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "apiflask";
-  version = "3.1.0";
+  version = "3.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "apiflask";
     repo = "apiflask";
     tag = finalAttrs.version;
-    hash = "sha256-T1U+RI49GExjCSdKANsJWV1GSv8yjq1avK+fvskSeLk=";
+    hash = "sha256-iW7OCWJlJXg9zVslYgdk13LyLHl2nLJkNZViHrJ9bOE=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/asgi-csrf/default.nix b/pkgs/development/python-modules/asgi-csrf/default.nix
index f3ec2670d6f8..9c36730fd74c 100644
--- a/pkgs/development/python-modules/asgi-csrf/default.nix
+++ b/pkgs/development/python-modules/asgi-csrf/default.nix
@@ -49,6 +49,8 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "asgi_csrf" ];
 
   meta = {
+    # https://github.com/simonw/asgi-csrf/issues/38
+    broken = lib.versionAtLeast python-multipart.version "0.0.26";
     description = "ASGI middleware for protecting against CSRF attacks";
     license = lib.licenses.asl20;
     homepage = "https://github.com/simonw/asgi-csrf";
diff --git a/pkgs/development/python-modules/atproto/default.nix b/pkgs/development/python-modules/atproto/default.nix
index 6692891b1546..e38ef268aefd 100644
--- a/pkgs/development/python-modules/atproto/default.nix
+++ b/pkgs/development/python-modules/atproto/default.nix
@@ -25,7 +25,7 @@
 
 buildPythonPackage rec {
   pname = "atproto";
-  version = "0.0.68";
+  version = "0.0.69";
   pyproject = true;
 
   # use GitHub, pypi does not include tests
@@ -33,7 +33,7 @@ buildPythonPackage rec {
     owner = "MarshalX";
     repo = "atproto";
     tag = "v${version}";
-    hash = "sha256-z5/CLC2pxp2cFNZQsnQT96g8y2CFjNmiEatu8yEmYHw=";
+    hash = "sha256-BA8gnGVR+vgfwgKHBgq+EDcmycYAVBGu/WWDVMI7gkw=";
   };
 
   env.POETRY_DYNAMIC_VERSIONING_BYPASS = version;
diff --git a/pkgs/development/python-modules/booleanoperations/default.nix b/pkgs/development/python-modules/booleanoperations/default.nix
index f0d01e3756e5..caab5892715f 100644
--- a/pkgs/development/python-modules/booleanoperations/default.nix
+++ b/pkgs/development/python-modules/booleanoperations/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   fonttools,
   pyclipper,
   defcon,
@@ -11,16 +11,16 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "booleanoperations";
-  version = "0.9.0";
+  version = "0.10.0";
   pyproject = true;
 
-  src = fetchPypi {
-    pname = "booleanOperations";
-    inherit version;
-    hash = "sha256-jPqCHDKtN0+hINay4LRE6+rFfJHmYxUoZF+hmsKigbg=";
-    extension = "zip";
+  src = fetchFromGitHub {
+    owner = "typemytype";
+    repo = "booleanOperations";
+    tag = finalAttrs.version;
+    hash = "sha256-IJyb6g2xwWj82Vm33Mtkqen1X/w0tSaP+Q/DtFc8Dd4=";
   };
 
   build-system = [
@@ -41,22 +41,11 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
-  disabledTests = [
-    # started failing with fonttools update from 4.55.3 -> 4.56.0
-    "test_QTail_reversed_difference"
-    "test_QTail_reversed_intersection"
-    "test_QTail_reversed_union"
-    "test_QTail_reversed_xor"
-    "test_Q_difference"
-    "test_Q_intersection"
-    "test_Q_union"
-    "test_Q_xor"
-  ];
-
   meta = {
+    changelog = "https://github.com/typemytype/booleanOperations/releases/tag/${finalAttrs.src.tag}";
     description = "Boolean operations on paths";
     homepage = "https://github.com/typemytype/booleanOperations";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.sternenseemann ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/captum/default.nix b/pkgs/development/python-modules/captum/default.nix
index 32889473641c..455eac5c5fc1 100644
--- a/pkgs/development/python-modules/captum/default.nix
+++ b/pkgs/development/python-modules/captum/default.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   buildPythonPackage,
   pytestCheckHook,
   setuptools,
@@ -53,6 +52,10 @@ buildPythonPackage rec {
     scikit-learn
   ];
 
+  preCheck = ''
+    export OMP_NUM_THREADS=1
+  '';
+
   disabledTestPaths =
     lib.optionals stdenv.hostPlatform.isDarwin [
       # These tests may fail if multiple builds run them at the same time due
diff --git a/pkgs/development/python-modules/cfn-lint/default.nix b/pkgs/development/python-modules/cfn-lint/default.nix
index db06eac38155..70a2968acfe8 100644
--- a/pkgs/development/python-modules/cfn-lint/default.nix
+++ b/pkgs/development/python-modules/cfn-lint/default.nix
@@ -69,6 +69,13 @@ buildPythonPackage rec {
     "test_update_docs"
   ];
 
+  disabledTestPaths = [
+    # unexpected exit code afer nodejs_24 24.16.0 update
+    "test/integration/test_quickstart_templates.py::TestQuickStartTemplates::test_templates"
+    "test/integration/test_quickstart_templates_non_strict.py::TestQuickStartTemplates::test_module_integration"
+    "test/integration/test_quickstart_templates_non_strict.py::TestQuickStartTemplates::test_templates"
+  ];
+
   pythonImportsCheck = [ "cfnlint" ];
 
   meta = {
diff --git a/pkgs/development/python-modules/checkdmarc/default.nix b/pkgs/development/python-modules/checkdmarc/default.nix
index a0fbb96a7399..de46a1951442 100644
--- a/pkgs/development/python-modules/checkdmarc/default.nix
+++ b/pkgs/development/python-modules/checkdmarc/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "checkdmarc";
-  version = "5.17.1";
+  version = "5.17.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "domainaware";
     repo = "checkdmarc";
     tag = finalAttrs.version;
-    hash = "sha256-IF+3Og67PrW3HuSnkarrjGl9RFHLrNEBo0CqmKliH1M=";
+    hash = "sha256-OI96936+4Jcx3VuPmHI2tcIssPxC7ofmLwWcvZxMw7E=";
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/development/python-modules/darabonba-core/default.nix b/pkgs/development/python-modules/darabonba-core/default.nix
new file mode 100644
index 000000000000..00b697641aca
--- /dev/null
+++ b/pkgs/development/python-modules/darabonba-core/default.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  aiohttp,
+  alibabacloud-tea,
+  buildPythonPackage,
+  fetchPypi,
+  requests,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "darabonba-core";
+  version = "1.0.7";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    pname = "darabonba_core";
+    inherit (finalAttrs) version;
+    hash = "sha256-wt4u4mBoK0wIyexneT3maivfMWNjuRZfFSuayqFrTcM=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    aiohttp
+    alibabacloud-tea
+    requests
+  ];
+
+  pythonImportsCheck = [ "Tea" ];
+
+  # Module has no tests
+  doCheck = false;
+
+  meta = {
+    description = "The darabonba module of alibabaCloud Python SDK";
+    homepage = "https://github.com/aliyun/tea-python";
+    changelog = "https://github.com/aliyun/tea-python/blob/master/ChangeLog.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/debugpy/default.nix b/pkgs/development/python-modules/debugpy/default.nix
index 27255ab899cd..74cd18a20174 100644
--- a/pkgs/development/python-modules/debugpy/default.nix
+++ b/pkgs/development/python-modules/debugpy/default.nix
@@ -25,7 +25,7 @@
 
 buildPythonPackage rec {
   pname = "debugpy";
-  version = "1.8.20";
+  version = "1.8.21";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -42,7 +42,7 @@ buildPythonPackage rec {
       sed -i 's/git_refnames = "[^"]*"/git_refnames = " (tag: ${src.tag})"/' "$out/src/debugpy/_version.py"
     '';
 
-    hash = "sha256-0h2VQU5eYb0heXSFmKnwAFW0jcWc+bYllhwxfdzkGWc=";
+    hash = "sha256-7XM476tfL6QLCHB1kwlbN/dmlgnjuTE+ulQ9yOHfgEE=";
   };
 
   patches = [
@@ -121,11 +121,7 @@ buildPythonPackage rec {
     typing-extensions
   ];
 
-  preCheck = ''
-    export DEBUGPY_PROCESS_SPAWN_TIMEOUT=0
-    export DEBUGPY_PROCESS_EXIT_TIMEOUT=0
-  ''
-  + lib.optionalString (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) ''
+  preCheck = lib.optionalString (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) ''
     # https://github.com/python/cpython/issues/74570#issuecomment-1093748531
     export no_proxy='*';
   '';
@@ -134,9 +130,6 @@ buildPythonPackage rec {
     unset no_proxy
   '';
 
-  # Override default arguments in pytest.ini
-  pytestFlags = [ "--timeout=0" ];
-
   disabledTests = [
     # hanging test (flaky)
     "test_systemexit"
diff --git a/pkgs/development/python-modules/django/5.nix b/pkgs/development/python-modules/django/5.nix
index 3a7274793a2b..273b61da19c9 100644
--- a/pkgs/development/python-modules/django/5.nix
+++ b/pkgs/development/python-modules/django/5.nix
@@ -41,14 +41,14 @@
 
 buildPythonPackage rec {
   pname = "django";
-  version = "5.2.14";
+  version = "5.2.15";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "django";
     repo = "django";
     tag = version;
-    hash = "sha256-gb/4WL2VLoqRucpXuKyPsMSwKZ6gaxy5JA7QTeeazjk=";
+    hash = "sha256-K9yFHr3IkVNMqoeumESszVlju2fW2r8hS8z6M2OdVpE=";
   };
 
   patches = [
diff --git a/pkgs/development/python-modules/fastapi/default.nix b/pkgs/development/python-modules/fastapi/default.nix
index 9d5aea8559e5..3e29f81a9da2 100644
--- a/pkgs/development/python-modules/fastapi/default.nix
+++ b/pkgs/development/python-modules/fastapi/default.nix
@@ -45,14 +45,14 @@
 
 buildPythonPackage rec {
   pname = "fastapi";
-  version = "0.135.3";
+  version = "0.136.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tiangolo";
     repo = "fastapi";
     tag = version;
-    hash = "sha256-sE5d+MgmP9L+MUosRBsR+KSJkcC9i2EOOtKHq0sXjRM=";
+    hash = "sha256-lfmk8ZveKPukEEfwWq2mKtWmOHAtVzGuE5BsOskDzh0=";
   };
 
   build-system = [ pdm-backend ];
diff --git a/pkgs/development/python-modules/fastgit/default.nix b/pkgs/development/python-modules/fastgit/default.nix
index e39471a6bba9..e14571efeb63 100644
--- a/pkgs/development/python-modules/fastgit/default.nix
+++ b/pkgs/development/python-modules/fastgit/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "fastgit";
-  version = "0.0.4";
+  version = "0.0.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "AnswerDotAI";
     repo = "fastgit";
     tag = finalAttrs.version;
-    hash = "sha256-d/CGvKe+8FqTOyDsLmEHQZCWgsFvynmxwOY1VC1DtGE=";
+    hash = "sha256-rECQZAhtD6MsDwoED7K8I3HtYdbR8DqCZqP2AqNHroY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/fasthtml/default.nix b/pkgs/development/python-modules/fasthtml/default.nix
index 3f47dd2ce5a7..12b9b77c0435 100644
--- a/pkgs/development/python-modules/fasthtml/default.nix
+++ b/pkgs/development/python-modules/fasthtml/default.nix
@@ -31,14 +31,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "fasthtml";
-  version = "0.12.48";
+  version = "0.13.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "AnswerDotAI";
     repo = "fasthtml";
     tag = finalAttrs.version;
-    hash = "sha256-lMAuIw4sMkS3XSG/0Bs0iQPSjMusbmjUKv0w4cINwas=";
+    hash = "sha256-PS5HGegC6pG/bJAGrKDsRYguBnNS9EDrZIjWvjErO4M=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/fontparts/default.nix b/pkgs/development/python-modules/fontparts/default.nix
index b48b195a423c..bc6b8c1e797a 100644
--- a/pkgs/development/python-modules/fontparts/default.nix
+++ b/pkgs/development/python-modules/fontparts/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
 
   # build-system
   setuptools,
@@ -17,17 +17,23 @@
   python,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "fontparts";
-  version = "0.13.1";
+  version = "1.0.0";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-+oifxmY7MUkQj3Sy75wjRmoVEPkgZaO3+8/sauMMxYA=";
-    extension = "zip";
+  src = fetchFromGitHub {
+    owner = "robotools";
+    repo = "fontParts";
+    tag = finalAttrs.version;
+    hash = "sha256-dBR9Lf8ECLAOAkEkEy4JCgOKmyXzwXaOXdW4cErWQcs=";
   };
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail ', "vcs-versioning"' ""
+  '';
+
   build-system = [
     setuptools
     setuptools-scm
@@ -44,6 +50,8 @@ buildPythonPackage rec {
   ++ fonttools.optional-dependencies.lxml
   ++ fonttools.optional-dependencies.unicode;
 
+  pythonImportsCheck = [ "fontParts" ];
+
   checkPhase = ''
     runHook preCheck
     ${python.interpreter} Lib/fontParts/fontshell/test.py
@@ -53,8 +61,8 @@ buildPythonPackage rec {
   meta = {
     description = "API for interacting with the parts of fonts during the font development process";
     homepage = "https://github.com/robotools/fontParts";
-    changelog = "https://github.com/robotools/fontParts/releases/tag/${version}";
+    changelog = "https://github.com/robotools/fontParts/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.sternenseemann ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/fontpens/default.nix b/pkgs/development/python-modules/fontpens/default.nix
index 0ed674c0de5a..480fd2feaca8 100644
--- a/pkgs/development/python-modules/fontpens/default.nix
+++ b/pkgs/development/python-modules/fontpens/default.nix
@@ -3,22 +3,26 @@
   buildPythonPackage,
   fetchFromGitHub,
   fonttools,
-  setuptools,
+  hatch-vcs,
+  hatchling,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "fontpens";
-  version = "0.3.0";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "robotools";
     repo = "fontpens";
-    tag = "v${version}";
-    sha256 = "13msj0s7mg45klzbnd2w4f4ljb16bp9m0s872s6hczn0j7jmyz11";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-K768vbhacnuSRlmC3QG+7p+y8QiBtvqETvCYOuO1IxM=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [
+    hatch-vcs
+    hatchling
+  ];
 
   dependencies = [ fonttools ];
 
@@ -43,9 +47,10 @@ buildPythonPackage rec {
   ]);
 
   meta = {
+    changelog = "https://github.com/robotools/fontPens/releases/tag/${finalAttrs.src.tag}";
     description = "Collection of classes implementing the pen protocol for manipulating glyphs";
     homepage = "https://github.com/robotools/fontPens";
     license = lib.licenses.bsd3;
     maintainers = [ lib.maintainers.sternenseemann ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/frictionless/default.nix b/pkgs/development/python-modules/frictionless/default.nix
index 80013e731fd4..68edce923de3 100644
--- a/pkgs/development/python-modules/frictionless/default.nix
+++ b/pkgs/development/python-modules/frictionless/default.nix
@@ -195,7 +195,8 @@ buildPythonPackage rec {
     openpyxl
     xlrd
   ]
-  ++ lib.concatAttrValues optional-dependencies;
+  # datasette is transitively broken by asgi-csrf
+  ++ lib.concatAttrValues (lib.removeAttrs optional-dependencies [ "datasette" ]);
 
   disabledTestPaths = [
     # Requires optional dependencies that have not been packaged (commented out above)
diff --git a/pkgs/development/python-modules/frida-python/default.nix b/pkgs/development/python-modules/frida-python/default.nix
index 711891bdf92f..54c58c43304f 100644
--- a/pkgs/development/python-modules/frida-python/default.nix
+++ b/pkgs/development/python-modules/frida-python/default.nix
@@ -5,7 +5,7 @@
   buildPythonPackage,
 }:
 let
-  version = "17.9.11";
+  version = "17.15.3";
   format = "wheel";
   inherit (stdenvNoCC.hostPlatform) system;
 
@@ -13,19 +13,19 @@ let
   pypiMeta =
     {
       x86_64-linux = {
-        hash = "sha256-ovITi0zxPqJECChrx8cAeIw7m7NjGHa+cl1NomYL718=";
+        hash = "sha256-q8E4uhzfFyZV7P/Bft+UviaKX78z49TkXBM7p0oQ/HY=";
         platform = "manylinux1_x86_64";
       };
       aarch64-linux = {
-        hash = "sha256-kDSBWC+G2m3pZ6YWhMjkvtXfR6HMVq5zxsxZUmBprrM=";
+        hash = "sha256-00gr7AWA0ynXmZrvNWphPWkkpeDOOqWIZMKe+jbeAFA=";
         platform = "manylinux2014_aarch64";
       };
       x86_64-darwin = {
-        hash = "sha256-op8QM6f5LKCoozKawTi8hYZRO5VJ1kzWjSk62urGJLQ=";
+        hash = "sha256-7d7jWTT5yueVBfIYSZoxCDHXcxjom9JP9nfzBJqxd8I=";
         platform = "macosx_10_13_x86_64";
       };
       aarch64-darwin = {
-        hash = "sha256-9JmPcE4CxzHiNLg6jMpSt/CC0eGk0VyKr1uzUTyQRqI=";
+        hash = "sha256-AmTFwqjE2huyFwabx6gWdRnymy+pPVqBvlJWzQQb3H4=";
         platform = "macosx_11_0_arm64";
       };
     }
diff --git a/pkgs/development/python-modules/frigidaire/default.nix b/pkgs/development/python-modules/frigidaire/default.nix
index c69c1d4dc228..bddc9bbcf35c 100644
--- a/pkgs/development/python-modules/frigidaire/default.nix
+++ b/pkgs/development/python-modules/frigidaire/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "frigidaire";
-  version = "0.18.46";
+  version = "0.18.47";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bm1549";
     repo = "frigidaire";
     tag = finalAttrs.version;
-    hash = "sha256-UyzVeJ+D9gFyru1DjwCoVTQQK26jP4rxFfiTpBdo36g=";
+    hash = "sha256-KiWMzx22YNJNkhkfSFVdCC6amTGjtwpd/a040vQh8c4=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/google-cloud-iam-logging/default.nix b/pkgs/development/python-modules/google-cloud-iam-logging/default.nix
index 3f74f8e0efce..a7d2fc90a01e 100644
--- a/pkgs/development/python-modules/google-cloud-iam-logging/default.nix
+++ b/pkgs/development/python-modules/google-cloud-iam-logging/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "google-cloud-iam-logging";
-  version = "1.7.0";
+  version = "1.8.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_iam_logging";
     inherit (finalAttrs) version;
-    hash = "sha256-p0PEXDzdq+DX88rW7mN9FBK7Nkhi01xubH+qeECr1d4=";
+    hash = "sha256-SOugq2vFHefdkFsc4haDahmOjioWSZtL4iUfQlgqwCg=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-translate/default.nix b/pkgs/development/python-modules/google-cloud-translate/default.nix
index 7e982fda738b..cacee6049bda 100644
--- a/pkgs/development/python-modules/google-cloud-translate/default.nix
+++ b/pkgs/development/python-modules/google-cloud-translate/default.nix
@@ -16,13 +16,13 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-translate";
-  version = "3.26.0";
+  version = "3.27.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_translate";
     inherit version;
-    hash = "sha256-dMTDAupwXaodfdoJUoj9c2u2FvlDSA2zQxTNDNUsyd0=";
+    hash = "sha256-KueO8aqNu17JdnoI6rzjT9p7tFoHumeubg6tjP1flfc=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-vision/default.nix b/pkgs/development/python-modules/google-cloud-vision/default.nix
index 5ec1b9321f34..b49c67e1b64a 100644
--- a/pkgs/development/python-modules/google-cloud-vision/default.nix
+++ b/pkgs/development/python-modules/google-cloud-vision/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "google-cloud-vision";
-  version = "3.14.0";
+  version = "3.15.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_vision";
     inherit (finalAttrs) version;
-    hash = "sha256-Ga9pIYkjNYdmrP1lWtY/RQ0WaxSe6O7KrrOg05DEZ0k=";
+    hash = "sha256-7St5ygWlipKewRIlmpyqaYUJ9jSHYqjs7TMQ5lcqbHA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/google-cloud-workstations/default.nix b/pkgs/development/python-modules/google-cloud-workstations/default.nix
index 68692799c173..6897c2d64d07 100644
--- a/pkgs/development/python-modules/google-cloud-workstations/default.nix
+++ b/pkgs/development/python-modules/google-cloud-workstations/default.nix
@@ -15,13 +15,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "google-cloud-workstations";
-  version = "0.8.0";
+  version = "0.8.1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_workstations";
     inherit (finalAttrs) version;
-    hash = "sha256-wuFFlOxCyTK0n39LB3XGwvoQ7FCSjUDJa3n6uElvSEQ=";
+    hash = "sha256-UqFrc09BCap+10CJximc6cymUl8diSW9gxqZbPfn0UY=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/groq/default.nix b/pkgs/development/python-modules/groq/default.nix
index 8d85fd7f72d4..8546a62c4da6 100644
--- a/pkgs/development/python-modules/groq/default.nix
+++ b/pkgs/development/python-modules/groq/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "groq";
-  version = "1.4.0";
+  version = "1.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "groq";
     repo = "groq-python";
     tag = "v${version}";
-    hash = "sha256-U6548+2dpRV2e0cnFCoGmvXiQgp7LuMUhMKZKoHJlzo=";
+    hash = "sha256-WtibHngPubo4p+xtdvqqDTvRFMk+dSBmxjoQxVPyXQM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/linearmodels/default.nix b/pkgs/development/python-modules/linearmodels/default.nix
index 9a5ae03ffe5f..d67690e48774 100644
--- a/pkgs/development/python-modules/linearmodels/default.nix
+++ b/pkgs/development/python-modules/linearmodels/default.nix
@@ -67,6 +67,8 @@ buildPythonPackage (finalAttrs: {
 
   preCheck = ''
     rm linearmodels/__init__.py
+
+    export OMP_NUM_THREADS=1
   '';
 
   disabledTestPaths = [
diff --git a/pkgs/development/python-modules/linode-api4/default.nix b/pkgs/development/python-modules/linode-api4/default.nix
new file mode 100644
index 000000000000..153d1d207cf8
--- /dev/null
+++ b/pkgs/development/python-modules/linode-api4/default.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  buildPythonPackage,
+  deprecated,
+  fetchFromGitHub,
+  httpretty,
+  mock,
+  nix-update-script,
+  polling,
+  pytestCheckHook,
+  requests,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "linode-api4";
+  version = "5.45.0";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "linode";
+    repo = "linode_api4-python";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-0FLF/LkU8SaR3itgMISbqOxmd4UZkGlTT3VDpmuv+QQ=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    deprecated
+    polling
+    requests
+  ];
+
+  nativeCheckInputs = [
+    httpretty
+    mock
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "linode_api4" ];
+
+  disabledTestPaths = [
+    # Tests require an API token
+    "test/integration/"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Official Python bindings for the Linode API";
+    homepage = "https://github.com/linode/linode_api4-python";
+    changelog = "https://github.com/linode/linode_api4-python/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/lookyloo-models/default.nix b/pkgs/development/python-modules/lookyloo-models/default.nix
index b10725b11edb..3feca2a3dfd4 100644
--- a/pkgs/development/python-modules/lookyloo-models/default.nix
+++ b/pkgs/development/python-modules/lookyloo-models/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "lookyloo-models";
-  version = "0.2.8";
+  version = "0.2.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Lookyloo";
     repo = "lookyloo-models";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LvGKzwi6zz+lvYoe3ybf8EARAXG/SX71jMl4b5hpUn8=";
+    hash = "sha256-jqbG8wYUePYnQqqJEek9zFnuuGLarJvwzri19lvRUbY=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/mace-torch/default.nix b/pkgs/development/python-modules/mace-torch/default.nix
index 3c8b486f643b..4ed39d479782 100644
--- a/pkgs/development/python-modules/mace-torch/default.nix
+++ b/pkgs/development/python-modules/mace-torch/default.nix
@@ -82,6 +82,10 @@ buildPythonPackage (finalAttrs: {
     writableTmpDirAsHomeHook
   ];
 
+  preCheck = ''
+    export OMP_NUM_THREADS=1
+  '';
+
   disabledTests = [
     # _pickle.PickleError: ScriptFunction cannot be pickled
     "test_run_eval_fail_with_wrong_model"
diff --git a/pkgs/development/python-modules/mistune/default.nix b/pkgs/development/python-modules/mistune/default.nix
index a130857e1a71..8cdfa4023ded 100644
--- a/pkgs/development/python-modules/mistune/default.nix
+++ b/pkgs/development/python-modules/mistune/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "mistune";
-  version = "3.2.0";
+  version = "3.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "lepture";
     repo = "mistune";
     tag = "v${version}";
-    hash = "sha256-rUEZNVuMT5+GsMakrkK6rshKSKtTTN72kK92AmQ8bl8=";
+    hash = "sha256-8AEEh/SWAk/Esq0jAoZGLw1FIQUw6C5Xq8CgnI2fjv0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/mlflow-skinny/default.nix b/pkgs/development/python-modules/mlflow-skinny/default.nix
index 9f5a818c7a82..1dd062ab67ac 100644
--- a/pkgs/development/python-modules/mlflow-skinny/default.nix
+++ b/pkgs/development/python-modules/mlflow-skinny/default.nix
@@ -40,7 +40,7 @@ buildPythonPackage (finalAttrs: {
     owner = "mlflow";
     repo = "mlflow";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-OxhM+KCem0sb9cwtyzrUD/MGfoiiCfgU47qipYRDaFk=";
+    hash = "sha256-e11ZncpvThb1Nt6OH+O6Do74N3dphxBiK/HIeLQMxAw=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/skinny";
diff --git a/pkgs/development/python-modules/mlflow-tracing/default.nix b/pkgs/development/python-modules/mlflow-tracing/default.nix
index 9f78d2dcaa32..f819fae05c66 100644
--- a/pkgs/development/python-modules/mlflow-tracing/default.nix
+++ b/pkgs/development/python-modules/mlflow-tracing/default.nix
@@ -27,7 +27,7 @@ buildPythonPackage (finalAttrs: {
     owner = "mlflow";
     repo = "mlflow";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-OxhM+KCem0sb9cwtyzrUD/MGfoiiCfgU47qipYRDaFk=";
+    hash = "sha256-e11ZncpvThb1Nt6OH+O6Do74N3dphxBiK/HIeLQMxAw=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/tracing";
diff --git a/pkgs/development/python-modules/mlflow/default.nix b/pkgs/development/python-modules/mlflow/default.nix
index 65baefc85c0f..45725a423f68 100644
--- a/pkgs/development/python-modules/mlflow/default.nix
+++ b/pkgs/development/python-modules/mlflow/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "mlflow";
-  version = "3.12.0";
+  version = "3.14.0";
   format = "wheel";
   __structuredAttrs = true;
 
@@ -39,7 +39,7 @@ buildPythonPackage (finalAttrs: {
     format = "wheel";
     dist = "py3";
     python = "py3";
-    hash = "sha256-4cKO1MSFV8xSx2bxfxylgmdT3fJB1D8w+ZxF9+prPOA=";
+    hash = "sha256-2/d/fNtbXA7Fm0ZxxhcwsbkUtN/3ookuJnpUfLVFT1Y=";
   };
 
   # Nix-wrapped python populates sys.path via NIX_PYTHONPATH/site hooks,
diff --git a/pkgs/development/python-modules/mlflow/subprocess-pythonpath.patch b/pkgs/development/python-modules/mlflow/subprocess-pythonpath.patch
index 9e97218fdf92..5d13a57dffa0 100644
--- a/pkgs/development/python-modules/mlflow/subprocess-pythonpath.patch
+++ b/pkgs/development/python-modules/mlflow/subprocess-pythonpath.patch
@@ -1,6 +1,6 @@
 --- a/mlflow/server/__init__.py
 +++ b/mlflow/server/__init__.py
-@@ -471,6 +471,11 @@
+@@ -474,6 +474,11 @@
              else tempfile.mkdtemp()
          )
 +    # In Nix-packaged environments sys.path is populated by wrappers but
diff --git a/pkgs/development/python-modules/mmengine/default.nix b/pkgs/development/python-modules/mmengine/default.nix
index b2dbd44709e5..375efd81d47f 100644
--- a/pkgs/development/python-modules/mmengine/default.nix
+++ b/pkgs/development/python-modules/mmengine/default.nix
@@ -109,6 +109,11 @@ buildPythonPackage (finalAttrs: {
     '';
 
   disabledTestPaths = [
+    # MlflowVisBackend uses the deprecated mlflow filesystem store, which is
+    # throws an error since mlflow 3.13. See upstream issue:
+    # https://github.com/open-mmlab/mmengine/issues/1687
+    "tests/test_visualizer/test_vis_backend.py::TestMLflowVisBackend"
+
     # Require unpackaged aim
     "tests/test_visualizer/test_vis_backend.py::TestAimVisBackend"
 
diff --git a/pkgs/development/python-modules/openai-agents/default.nix b/pkgs/development/python-modules/openai-agents/default.nix
index c09e4bb7db4f..a35a81bdad58 100644
--- a/pkgs/development/python-modules/openai-agents/default.nix
+++ b/pkgs/development/python-modules/openai-agents/default.nix
@@ -3,7 +3,7 @@
   buildPythonPackage,
   fetchPypi,
   hatchling,
-  griffe,
+  griffelib,
   mcp,
   openai,
   pydantic,
@@ -12,15 +12,15 @@
   typing-extensions,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "openai-agents";
-  version = "0.6.9";
+  version = "0.17.6";
   pyproject = true;
 
   src = fetchPypi {
-    inherit version;
+    inherit (finalAttrs) version;
     pname = "openai_agents";
-    hash = "sha256-5VYjgntKGxHWbsAIS9K56ixtYPIz4EVHgDr0M5Z+L9s=";
+    hash = "sha256-/tlPjPDrTFfGOomtSxB5MtdfKgttnolciPo8IX5jyCI=";
   };
 
   build-system = [
@@ -28,7 +28,7 @@ buildPythonPackage rec {
   ];
 
   dependencies = [
-    griffe
+    griffelib
     mcp
     openai
     pydantic
@@ -42,10 +42,10 @@ buildPythonPackage rec {
   ];
 
   meta = {
-    changelog = "https://github.com/openai/openai-agents-python/releases/tag/${version}";
+    changelog = "https://github.com/openai/openai-agents-python/releases/tag/v${finalAttrs.version}";
     homepage = "https://github.com/openai/openai-agents-python";
     description = "Lightweight, powerful framework for multi-agent workflows";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.bryanhonof ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/openai/default.nix b/pkgs/development/python-modules/openai/default.nix
index ddfa0f3b8548..41871cd05921 100644
--- a/pkgs/development/python-modules/openai/default.nix
+++ b/pkgs/development/python-modules/openai/default.nix
@@ -51,14 +51,14 @@
 
 buildPythonPackage rec {
   pname = "openai";
-  version = "2.33.0";
+  version = "2.41.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = "openai-python";
     tag = "v${version}";
-    hash = "sha256-w2ejAJ+V7e4wYSQ/9+WdhO+XaYeSq8U/V5YXHSpn+rI=";
+    hash = "sha256-jSkBxZY5POlrznhBwFMR2NcL92uGRSYI6BDDC3C7RfU=";
   };
 
   postPatch = ''substituteInPlace pyproject.toml --replace-fail "hatchling==1.26.3" "hatchling"'';
@@ -129,6 +129,5 @@ buildPythonPackage rec {
     changelog = "https://github.com/openai/openai-python/blob/${src.tag}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = [ lib.maintainers.malo ];
-    mainProgram = "openai";
   };
 }
diff --git a/pkgs/development/python-modules/paramiko/default.nix b/pkgs/development/python-modules/paramiko/default.nix
index 156fae9d96d0..6350ba2e5a8a 100644
--- a/pkgs/development/python-modules/paramiko/default.nix
+++ b/pkgs/development/python-modules/paramiko/default.nix
@@ -30,6 +30,7 @@ buildPythonPackage rec {
   dependencies = [
     bcrypt
     cryptography
+    invoke
     pynacl
   ];
 
@@ -39,7 +40,6 @@ buildPythonPackage rec {
       gssapi
     ];
     ed25519 = [ ];
-    invoke = [ invoke ];
   };
 
   nativeCheckInputs = [
diff --git a/pkgs/development/python-modules/parsedmarc/default.nix b/pkgs/development/python-modules/parsedmarc/default.nix
index 4d6b37a7baa6..ad77eb251e98 100644
--- a/pkgs/development/python-modules/parsedmarc/default.nix
+++ b/pkgs/development/python-modules/parsedmarc/default.nix
@@ -42,14 +42,14 @@ let
 in
 buildPythonPackage rec {
   pname = "parsedmarc";
-  version = "10.1.1";
+  version = "10.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "domainaware";
     repo = "parsedmarc";
     tag = version;
-    hash = "sha256-dFwlcbR8NNKrDBoKPDX9M82tTK5aCbeP3KMF/BctgMc=";
+    hash = "sha256-ed6t96CcemrUE6NtBmP1Am7l7dYmcNLGFN8slTSfgOM=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/pillow-heif/default.nix b/pkgs/development/python-modules/pillow-heif/default.nix
index eea442596817..cc00832bb662 100644
--- a/pkgs/development/python-modules/pillow-heif/default.nix
+++ b/pkgs/development/python-modules/pillow-heif/default.nix
@@ -77,6 +77,17 @@ buildPythonPackage rec {
   disabledTests = [
     # Time sensitive speed test, not reproducible
     "test_decode_threads"
+    # Tests failing with libheif 1.22.0. To be removed in the next release
+    # https://github.com/bigcat88/pillow_heif/issues/424
+    # these check what happens when the ispe is not valid
+    "test_numpy_array_invalid_ispe"
+    "test_allow_incorrect_headers"
+    "test_invalid_ispe_ok"
+    "test_invalid_ispe_allow"
+    "test_invalid_ispe_stride"
+    "test_invalid_ispe_stride_pillow"
+    # disable version check for libheif
+    "test_libheif_info"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     # https://github.com/bigcat88/pillow_heif/issues/89
diff --git a/pkgs/development/python-modules/pyairtable/default.nix b/pkgs/development/python-modules/pyairtable/default.nix
index 07c312d832e1..fcd4d58105b5 100644
--- a/pkgs/development/python-modules/pyairtable/default.nix
+++ b/pkgs/development/python-modules/pyairtable/default.nix
@@ -19,12 +19,12 @@
 
 buildPythonPackage rec {
   pname = "pyairtable";
-  version = "3.3.0";
+  version = "3.4.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-1tO3f2/regKoR3nCI103pGYF82AwzyDtmbCLq3MQiow=";
+    hash = "sha256-umABkxSJSMEACenkRJSRkJp9qLqUvIv6r4ZGsO6MA8o=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/pydrawise/default.nix b/pkgs/development/python-modules/pydrawise/default.nix
index 077fbcb14973..dc6012d54806 100644
--- a/pkgs/development/python-modules/pydrawise/default.nix
+++ b/pkgs/development/python-modules/pydrawise/default.nix
@@ -15,16 +15,16 @@
   setuptools-scm,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pydrawise";
-  version = "2026.4.0";
+  version = "2026.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dknowles2";
     repo = "pydrawise";
-    tag = version;
-    hash = "sha256-+V0x8caTqrfaNZ2tSmqzkJs8B0X405NnR3HIms1ocS8=";
+    tag = finalAttrs.version;
+    hash = "sha256-j1ovfQGi5DpDPWVwUA0mDIDztjVKkB7wFuK2HunXc3c=";
   };
 
   build-system = [
@@ -52,8 +52,8 @@ buildPythonPackage rec {
   meta = {
     description = "Library for interacting with Hydrawise sprinkler controllers through the GraphQL API";
     homepage = "https://github.com/dknowles2/pydrawise";
-    changelog = "https://github.com/dknowles2/pydrawise/releases/tag/${src.tag}";
+    changelog = "https://github.com/dknowles2/pydrawise/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/pyjwt/default.nix b/pkgs/development/python-modules/pyjwt/default.nix
index 1d18045a863c..74754630a145 100644
--- a/pkgs/development/python-modules/pyjwt/default.nix
+++ b/pkgs/development/python-modules/pyjwt/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "pyjwt";
-  version = "2.12.1";
+  version = "2.13.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jpadilla";
     repo = "pyjwt";
     tag = version;
-    hash = "sha256-wgOa5JhQT82ppoad6s8gPH7tGRNbbVWmJaaDF84d+r0=";
+    hash = "sha256-q4ynXCJVDsyZh70439dloyWgRTLVm+elDOahUVOT5vA=";
   };
 
   outputs = [
diff --git a/pkgs/development/python-modules/python-multipart/default.nix b/pkgs/development/python-modules/python-multipart/default.nix
index 4781d391f0a2..ed476d568dd8 100644
--- a/pkgs/development/python-modules/python-multipart/default.nix
+++ b/pkgs/development/python-modules/python-multipart/default.nix
@@ -2,10 +2,8 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
   hatchling,
   pytestCheckHook,
-  mock,
   pyyaml,
 
   # for passthru.tests
@@ -18,32 +16,22 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "python-multipart";
-  version = "0.0.22";
+  version = "0.0.29";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Kludex";
     repo = "python-multipart";
     tag = finalAttrs.version;
-    hash = "sha256-UegnwGxiXQalbp18t1dl2JOQH6BY975cpBa9uo3SOuk=";
+    hash = "sha256-1aV7gWLuulINesm3L8Wm3+prmeD9+OY/ihm36rtQPRs=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2026-40347-part-1.patch";
-      url = "https://github.com/Kludex/python-multipart/commit/6a7b76dd2653d99d8e5981d7ff09a4a047750b37.patch";
-      hash = "sha256-W1nyYMMoaf+lsNze3ppPeAXN+swG1dScDibazePSt+k=";
-    })
-    ./CVE-2026-40347-part-2.patch
-  ];
-
   build-system = [ hatchling ];
 
   pythonImportsCheck = [ "python_multipart" ];
 
   nativeCheckInputs = [
     pytestCheckHook
-    mock
     pyyaml
   ];
 
diff --git a/pkgs/development/python-modules/reproject/default.nix b/pkgs/development/python-modules/reproject/default.nix
index 4d5c6847dcd2..4a243013c878 100644
--- a/pkgs/development/python-modules/reproject/default.nix
+++ b/pkgs/development/python-modules/reproject/default.nix
@@ -27,14 +27,14 @@
 
 buildPythonPackage rec {
   pname = "reproject";
-  version = "0.20.0";
+  version = "0.21.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "astropy";
     repo = "reproject";
     tag = "v${version}";
-    hash = "sha256-eeMgkjYIZPGsxwRDPtTzjnlusCxu6vPSZiaDekxobs4=";
+    hash = "sha256-IuGVipAb4x63U2k9tNHhps5Gbk+3Hi/1ZkeMTZ/vaiU=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/requirements-parser/default.nix b/pkgs/development/python-modules/requirements-parser/default.nix
index 3611c1a0bd8c..bdd78cd75874 100644
--- a/pkgs/development/python-modules/requirements-parser/default.nix
+++ b/pkgs/development/python-modules/requirements-parser/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "requirements-parser";
-  version = "0.13.0";
+  version = "0.13.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "madpah";
     repo = "requirements-parser";
     tag = "v${version}";
-    hash = "sha256-AwsLcHjPfP+cYpKCQVgIcyzUhnqeIBJ92QLR48E6EtI=";
+    hash = "sha256-Hti1r/OLYHue+c7/TDDRzBgKxJazobZG+aFxK2ok70g=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/rq/default.nix b/pkgs/development/python-modules/rq/default.nix
index a53e08d86223..0efb763e3694 100644
--- a/pkgs/development/python-modules/rq/default.nix
+++ b/pkgs/development/python-modules/rq/default.nix
@@ -76,6 +76,10 @@ buildPythonPackage (finalAttrs: {
       # PermissionError: [Errno 13] Permission denied: '/tmp/rq-tests.txt'
       "test_deleted_jobs_arent_executed"
       "test_suspend_worker_execution"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      # no delay between reaping worker and checking; racy
+      "test_reap_workers"
     ];
 
   pythonImportsCheck = [ "rq" ];
diff --git a/pkgs/development/python-modules/rucio/default.nix b/pkgs/development/python-modules/rucio/default.nix
index 5d6ca8cd696e..4fefdabb3627 100644
--- a/pkgs/development/python-modules/rucio/default.nix
+++ b/pkgs/development/python-modules/rucio/default.nix
@@ -40,13 +40,13 @@
 }:
 
 let
-  version = "40.3.0";
+  version = "40.4.0";
 
   src = fetchFromGitHub {
     owner = "rucio";
     repo = "rucio";
     tag = version;
-    hash = "sha256-HJE4isk+1eOyfIzjVKg888CxW/JuKFGtTbjZNEfodt4=";
+    hash = "sha256-aeLVMcC6ca3ZgWMSZJhhD1vW9oqxUKls0yF6gQFwfqU=";
   };
 in
 buildPythonPackage {
diff --git a/pkgs/development/python-modules/scaleway-core/default.nix b/pkgs/development/python-modules/scaleway-core/default.nix
new file mode 100644
index 000000000000..ee31dc9e75a9
--- /dev/null
+++ b/pkgs/development/python-modules/scaleway-core/default.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  nix-update-script,
+  poetry-core,
+  pytestCheckHook,
+  python-dateutil,
+  pyyaml,
+  requests,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "scaleway-core";
+  version = "2.11.0";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "scaleway";
+    repo = "scaleway-sdk-python";
+    tag = finalAttrs.version;
+    hash = "sha256-v/dN0vLXr+vCobcrH9E6wXS61qMHsESHyL5BEpsJPkM=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/${finalAttrs.pname}";
+
+  build-system = [ poetry-core ];
+
+  dependencies = [
+    python-dateutil
+    pyyaml
+    requests
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "scaleway_core" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Integrate Scaleway with your Python applications";
+    homepage = "https://github.com/scaleway/scaleway-sdk-python";
+    changelog = "https://github.com/scaleway/scaleway-sdk-python/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/scaleway/default.nix b/pkgs/development/python-modules/scaleway/default.nix
new file mode 100644
index 000000000000..2d855b7ff6b9
--- /dev/null
+++ b/pkgs/development/python-modules/scaleway/default.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  nix-update-script,
+  poetry-core,
+  scaleway-core,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "scaleway";
+  version = "2.11.0";
+  pyproject = true;
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "scaleway";
+    repo = "scaleway-sdk-python";
+    tag = finalAttrs.version;
+    hash = "sha256-v/dN0vLXr+vCobcrH9E6wXS61qMHsESHyL5BEpsJPkM=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/${finalAttrs.pname}";
+
+  build-system = [ poetry-core ];
+
+  dependencies = [ scaleway-core ];
+
+  # Tests require credentials
+  doCheck = false;
+
+  pythonImportsCheck = [ "scaleway" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Integrate Scaleway with your Python applications";
+    homepage = "https://github.com/scaleway/scaleway-sdk-python";
+    changelog = "https://github.com/scaleway/scaleway-sdk-python/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+})
diff --git a/pkgs/development/python-modules/scikit-base/default.nix b/pkgs/development/python-modules/scikit-base/default.nix
index 52850d2e5785..5d3e4d6a4698 100644
--- a/pkgs/development/python-modules/scikit-base/default.nix
+++ b/pkgs/development/python-modules/scikit-base/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "scikit-base";
-  version = "1.0.1";
+  version = "1.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "sktime";
     repo = "skbase";
     tag = "v${version}";
-    hash = "sha256-XqmmKU9+QeUKVXUX6Xa3LkmZqDP3mRzxi1TA/6wRxTI=";
+    hash = "sha256-OxsaBzdT8Tv6eVGd4jyfmmdjp4+5jdfEh34rkyWgZpA=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/scikit-bio/default.nix b/pkgs/development/python-modules/scikit-bio/default.nix
index 1190d875005a..c909d8d66d08 100644
--- a/pkgs/development/python-modules/scikit-bio/default.nix
+++ b/pkgs/development/python-modules/scikit-bio/default.nix
@@ -62,6 +62,10 @@ buildPythonPackage (finalAttrs: {
     pytestCheckHook
   ];
 
+  preCheck = ''
+    export OMP_NUM_THREADS=1
+  '';
+
   # only the $out dir contains the built cython extensions, so we run the tests inside there
   enabledTestPaths = [ "${placeholder "out"}/${python.sitePackages}/skbio" ];
 
diff --git a/pkgs/development/python-modules/scikit-hep-testdata/default.nix b/pkgs/development/python-modules/scikit-hep-testdata/default.nix
index b232c95613a3..7686fe4e8e5d 100644
--- a/pkgs/development/python-modules/scikit-hep-testdata/default.nix
+++ b/pkgs/development/python-modules/scikit-hep-testdata/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "scikit-hep-testdata";
-  version = "0.6.5";
+  version = "0.6.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scikit-hep";
     repo = "scikit-hep-testdata";
     tag = "v${version}";
-    hash = "sha256-OGLb5WT/UFHZVo02hEssVVa9XiVvw4EBjUpVaBg8Yv0=";
+    hash = "sha256-rBZWD3lzJwVQkibBLScfnYL3ChRsFDeDtheqqNjepEc=";
   };
 
   build-system = [ setuptools-scm ];
diff --git a/pkgs/development/python-modules/starlette/default.nix b/pkgs/development/python-modules/starlette/default.nix
index 219ce1e8b7a7..e66a5cf7a80d 100644
--- a/pkgs/development/python-modules/starlette/default.nix
+++ b/pkgs/development/python-modules/starlette/default.nix
@@ -27,14 +27,14 @@
 
 buildPythonPackage rec {
   pname = "starlette";
-  version = "0.52.1";
+  version = "1.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "encode";
     repo = "starlette";
     tag = version;
-    hash = "sha256-XPAeRnh9a0A1/5VGZzzGQBhlBsih1VR8QmFdkxG5cQE=";
+    hash = "sha256-9iQXlpA1VDGw1c7X1zJPmJ3Dub46PwqrVIX1+fWOZ7M=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/torch-geometric/default.nix b/pkgs/development/python-modules/torch-geometric/default.nix
index 06863712e7c5..839f5c8e02e5 100644
--- a/pkgs/development/python-modules/torch-geometric/default.nix
+++ b/pkgs/development/python-modules/torch-geometric/default.nix
@@ -185,6 +185,10 @@ buildPythonPackage (finalAttrs: {
     writableTmpDirAsHomeHook
   ];
 
+  preCheck = ''
+    export OMP_NUM_THREADS=1
+  '';
+
   pytestFlags = [
     # DeprecationWarning: Failing to pass a value to the 'type_params' parameter of
     # 'typing._eval_type' is deprecated, as it leads to incorrect behaviour when calling
diff --git a/pkgs/development/python-modules/torchtune/default.nix b/pkgs/development/python-modules/torchtune/default.nix
index 75f169d0c78d..04e344e4195a 100644
--- a/pkgs/development/python-modules/torchtune/default.nix
+++ b/pkgs/development/python-modules/torchtune/default.nix
@@ -133,6 +133,10 @@ buildPythonPackage (finalAttrs: {
   ];
 
   disabledTestPaths = [
+    # MLFlowLogger uses the deprecated mlflow filesystem store, which throws an
+    # error since mlflow 3.13. See https://github.com/NixOS/nixpkgs/pull/532943
+    "tests/torchtune/training/test_metric_logging.py::TestMLFlowLogger"
+
     # TypeError: HfHubHTTPError.__init__() missing 1 required keyword-only argument: 'response'
     "tests/torchtune/_cli/test_download.py::TestTuneDownloadCommand::test_download_calls_snapshot"
     "tests/torchtune/_cli/test_download.py::TestTuneDownloadCommand::test_gated_repo_error_no_token"
diff --git a/pkgs/development/python-modules/valkey/default.nix b/pkgs/development/python-modules/valkey/default.nix
index 5674542e9016..dcccacb7d569 100644
--- a/pkgs/development/python-modules/valkey/default.nix
+++ b/pkgs/development/python-modules/valkey/default.nix
@@ -40,11 +40,20 @@ buildPythonPackage rec {
   };
 
   patches = [
+    # valkey 9.0 compat
     (fetchpatch {
-      # valkey 9.0 compat
       url = "https://github.com/valkey-io/valkey-py/commit/c01505e547f614f278b882a016557b6ed652bb9f.patch";
       hash = "sha256-rvA65inIioqdc+QV4KaaUv1I/TMZUq0TWaFJcJiy8NU=";
     })
+    # valkey 9.1 compat
+    (fetchpatch {
+      url = "https://github.com/valkey-io/valkey-py/commit/df5c44903dc8e2dda733e5576324ba0ff8c4c6a0.patch";
+      hash = "sha256-0wsWuaOYWBgf6BjlJuciZYRbugYfchTU2khQX7rtRJg=";
+    })
+    (fetchpatch {
+      url = "https://github.com/valkey-io/valkey-py/commit/046c7fb9e8260c2d69d05141b1519903c4e40efe.patch";
+      hash = "sha256-/yN1y0hbmBR6o6ab4h0qkn/qhU6jASOIeqWhxUi5w/I=";
+    })
   ];
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/x-transformers/default.nix b/pkgs/development/python-modules/x-transformers/default.nix
index 16d3dff4fd61..1496775f5eec 100644
--- a/pkgs/development/python-modules/x-transformers/default.nix
+++ b/pkgs/development/python-modules/x-transformers/default.nix
@@ -42,6 +42,10 @@ buildPythonPackage (finalAttrs: {
 
   nativeCheckInputs = [ pytestCheckHook ];
 
+  preCheck = ''
+    export OMP_NUM_THREADS=1
+  '';
+
   # RuntimeError: torch.compile is not supported on Python 3.14+
   disabledTests = lib.optionals (pythonAtLeast "3.14") [ "test_up" ];
 
diff --git a/pkgs/development/python-modules/xmltodict/default.nix b/pkgs/development/python-modules/xmltodict/default.nix
index 9d1c01842a42..bd22bc108bbe 100644
--- a/pkgs/development/python-modules/xmltodict/default.nix
+++ b/pkgs/development/python-modules/xmltodict/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "xmltodict";
-  version = "1.0.2";
+  version = "1.0.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "martinblech";
     repo = "xmltodict";
     tag = "v${version}";
-    hash = "sha256-gnTNkh0GLfRmjMsLhfvpNrewfinNOhem0i3wzIZvKpA=";
+    hash = "sha256-G7hVtS6toUJC0YY1AXBOJSc3wnAZyWilLnT/5vvFRRw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/tools/build-managers/gradle/default.nix b/pkgs/development/tools/build-managers/gradle/default.nix
index 5a9906b6cb12..05dae5e6a5d9 100644
--- a/pkgs/development/tools/build-managers/gradle/default.nix
+++ b/pkgs/development/tools/build-managers/gradle/default.nix
@@ -3,6 +3,7 @@
   jdk11,
   jdk17,
   jdk21,
+  jdk25,
   nix-update-script,
 }:
 
@@ -371,9 +372,9 @@ rec {
   # https://docs.gradle.org/current/userguide/compatibility.html
 
   gradle_9 = mkGradle {
-    version = "9.4.1";
-    hash = "sha256-KrKVjyoeURIMMmytbzhRU7sR7pOzwhbF/M6/37t+xss=";
-    defaultJava = jdk21;
+    version = "9.5.1";
+    hash = "sha256-uvwUG2Ga1jUP2XX8kDFW3VwVGZjMiwWOjBBEq197Ax8=";
+    defaultJava = jdk25;
     updateScriptMajorVersion = "9";
   };
   gradle_8 = mkGradle {
diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index 343be8e14791..5fd5eeac6919 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -47,7 +47,7 @@
   uvwasi,
   zlib,
   zstd,
-  icu,
+  icu78,
   bash,
   ninja,
   pkgconf,
@@ -274,7 +274,7 @@ let
       # that use bash wrappers, e.g. polaris-web.
       buildInputs = [
         bash
-        icu
+        icu78
       ]
       ++ builtins.attrValues sharedLibDeps;
 
diff --git a/pkgs/development/web/nodejs/v24.nix b/pkgs/development/web/nodejs/v24.nix
index 69004825bea2..914ab1479370 100644
--- a/pkgs/development/web/nodejs/v24.nix
+++ b/pkgs/development/web/nodejs/v24.nix
@@ -23,8 +23,8 @@ let
       [ ];
 in
 buildNodejs {
-  version = "24.15.0";
-  sha256 = "a4f653d79ed140aaad921e8c22a3b585ca85cfdab80d4030f6309e4663a8a1c8";
+  version = "24.16.0";
+  sha256 = "2ff84a6de70b6165290111b0fc656ded1ad207a799816fe720cc7c31232df30f";
   patches =
     (
       if (stdenv.hostPlatform.emulatorAvailable buildPackages) then
@@ -56,13 +56,6 @@ buildNodejs {
       ./use-correct-env-in-tests.patch
       ./bin-sh-node-run-v22.patch
       ./use-nix-codesign.patch
-      # https://github.com/NixOS/nixpkgs/pull/507974#issuecomment-4249433124
-      # OpenSSL reports different errors
-      # https://github.com/nodejs/node/pull/62629
-      (fetchpatch2 {
-        url = "https://github.com/nodejs/node/commit/dd25d8f29d3ddadcf5a5ebfdf98ece55f9df96c6.patch?full_index=1";
-        hash = "sha256-6cxRN7TyWmJgUZt3jp2YXbVIjrDb2BNep5LxBOtT3Q0=";
-      })
 
       # Patch for nghttp2 1.69 support
       (fetchpatch2 {
diff --git a/pkgs/misc/tmux-plugins/default.nix b/pkgs/misc/tmux-plugins/default.nix
index 53d45a00b92c..c4ae37f164e1 100644
--- a/pkgs/misc/tmux-plugins/default.nix
+++ b/pkgs/misc/tmux-plugins/default.nix
@@ -4,6 +4,7 @@
   pkgs,
   stdenv,
   config,
+  nix-update-script,
 }:
 
 let
@@ -46,6 +47,8 @@ let
             strictDeps = true;
             __structuredAttrs = true;
 
+            passthru.updateScript = nix-update-script { };
+
             inherit
               pluginName
               unpackPhase
@@ -235,12 +238,12 @@ in
 
   dracula = mkTmuxPlugin rec {
     pluginName = "dracula";
-    version = "3.2.0";
+    version = "3.3.0";
     src = fetchFromGitHub {
       owner = "dracula";
       repo = "tmux";
       tag = "v${version}";
-      hash = "sha256-emR4G1P80OqxDO4DUrAd495SGLI+avpjpOYUYuoSoNU=";
+      hash = "sha256-KHvBT8HjFZFwnpbWjW3LzXWUNOGbDgZTPncYvtIliD0=";
     };
     meta = {
       homepage = "https://draculatheme.com/tmux";
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 47dc60f1d20b..09e87bf7be83 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -201,13 +201,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname;
-  version = "260.1";
+  version = "260.2";
 
   src = fetchFromGitHub {
     owner = "systemd";
     repo = "systemd";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-FUKj3lvjz8TIsyu8NyJYtiNele+1BhdJPdw7r7nW6as=";
+    hash = "sha256-NXmmSV7/9WIW6C8wjdOwaerCy4v7Zcrd8+XDzcS8rEk=";
   };
 
   # PATCH POLICY
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 5ca1e26dfea4..8de81bf72298 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -324,6 +324,9 @@ python3Packages.buildPythonApplication rec {
     (replaceVars ./patches/ffmpeg-path.patch {
       ffmpeg = "${lib.getExe ffmpeg-headless}";
     })
+
+    # https://github.com/home-assistant/core/pull/172893
+    ./patches/pyjwt-2.13-compat.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/servers/home-assistant/patches/pyjwt-2.13-compat.patch b/pkgs/servers/home-assistant/patches/pyjwt-2.13-compat.patch
new file mode 100644
index 000000000000..4f72df241c55
--- /dev/null
+++ b/pkgs/servers/home-assistant/patches/pyjwt-2.13-compat.patch
@@ -0,0 +1,48 @@
+diff --git a/homeassistant/auth/__init__.py b/homeassistant/auth/__init__.py
+index d4b86febd1d..0edd0edd69b 100644
+--- a/homeassistant/auth/__init__.py
++++ b/homeassistant/auth/__init__.py
+@@ -656,6 +656,8 @@ class AuthManager:
+         try:
+             unverif_claims = jwt_wrapper.unverified_hs256_token_decode(token)
+         except jwt.InvalidTokenError:
++            # PyJWT 2.13 raises InvalidKeyError (not an InvalidTokenError) when
++            # the refresh token's key has been removed and is therefore empty.
+             return None
+ 
+         refresh_token = self.async_get_refresh_token(
+@@ -673,7 +675,7 @@ class AuthManager:
+             jwt_wrapper.verify_and_decode(
+                 token, jwt_key, leeway=10, issuer=issuer, algorithms=["HS256"]
+             )
+-        except jwt.InvalidTokenError:
++        except jwt.InvalidTokenError, jwt.InvalidKeyError:
+             return None
+ 
+         if refresh_token is None or not refresh_token.user.is_active:
+diff --git a/homeassistant/components/html5/notify.py b/homeassistant/components/html5/notify.py
+index 24b395748d8..3424749e86d 100644
+--- a/homeassistant/components/html5/notify.py
++++ b/homeassistant/components/html5/notify.py
+@@ -327,7 +327,7 @@ class HTML5PushCallbackView(HomeAssistantView):
+         if target_check.get(ATTR_TARGET) in self.registrations:
+             possible_target = self.registrations[target_check[ATTR_TARGET]]
+             key = possible_target["subscription"]["keys"]["auth"]
+-            with suppress(jwt.exceptions.DecodeError), warnings.catch_warnings():
++            with suppress(jwt.exceptions.DecodeError, jwt.exceptions.InvalidKeyError), warnings.catch_warnings():
+                 warnings.simplefilter("ignore", InsecureKeyLengthWarning)
+                 return jwt.decode(token, key, algorithms=["ES256", "HS256"])
+ 
+diff --git a/tests/components/elmax/conftest.py b/tests/components/elmax/conftest.py
+index 02f01036996..c9c3f13e9e3 100644
+--- a/tests/components/elmax/conftest.py
++++ b/tests/components/elmax/conftest.py
+@@ -82,7 +82,7 @@ def httpx_mock_direct_fixture(base_uri: str) -> Generator[respx.MockRouter]:
+         expiration = datetime.now() + timedelta(hours=1)
+         decoded_jwt["payload"]["exp"] = int(expiration.timestamp())
+         jws_string = jwt.encode(
+-            payload=decoded_jwt["payload"], algorithm="HS256", key=""
++            payload=decoded_jwt["payload"], algorithm="HS256", key="test"
+         )
+         login_json["token"] = f"JWT {jws_string}"
+         login_route.return_value = Response(200, json=login_json)
diff --git a/pkgs/servers/http/nginx/mainline.nix b/pkgs/servers/http/nginx/mainline.nix
index 7e6e8943428c..ffdd1b43b0f5 100644
--- a/pkgs/servers/http/nginx/mainline.nix
+++ b/pkgs/servers/http/nginx/mainline.nix
@@ -1,6 +1,6 @@
 { callPackage, ... }@args:
 
 callPackage ./generic.nix args {
-  version = "1.31.1";
-  hash = "sha256-n8quuPIlRLCaGadh80EsQRIhVCJAFjS+vdEpakA8xLw=";
+  version = "1.31.2";
+  hash = "sha256-ryqVfEHaY23cT4g+RSPG0UC0eE285CAAw2SuUJKqRzw=";
 }
diff --git a/pkgs/servers/http/nginx/stable.nix b/pkgs/servers/http/nginx/stable.nix
index 61d47dba246b..c67b76e64573 100644
--- a/pkgs/servers/http/nginx/stable.nix
+++ b/pkgs/servers/http/nginx/stable.nix
@@ -1,6 +1,6 @@
 { callPackage, ... }@args:
 
 callPackage ./generic.nix args {
-  version = "1.30.2";
-  hash = "sha256-ffMJCQf8o8wORW1twAzrIw2nTqiAJs7/Cv/CnbvZrEw=";
+  version = "1.30.3";
+  hash = "sha256-5YI9xvRWEJk975Pr9s/OaCZK9JWMd+h0t9IPNwkAG48=";
 }
diff --git a/pkgs/servers/monitoring/grafana/plugins/grafana-googlesheets-datasource/default.nix b/pkgs/servers/monitoring/grafana/plugins/grafana-googlesheets-datasource/default.nix
index 0893fad77893..757b77f9d928 100644
--- a/pkgs/servers/monitoring/grafana/plugins/grafana-googlesheets-datasource/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/grafana-googlesheets-datasource/default.nix
@@ -2,12 +2,12 @@
 
 grafanaPlugin {
   pname = "grafana-googlesheets-datasource";
-  version = "2.5.0";
+  version = "2.5.1";
   zipHash = {
-    x86_64-linux = "sha256-X4kPz/9o63giMRyVztix0OPO9Ip6sn/bH1Y2V1u/6qw=";
-    aarch64-linux = "sha256-o2OQsGX8pcKUxnJw1+6rnrXTkDYXCuVhnfFYzmGBVYU=";
-    x86_64-darwin = "sha256-n+BTCyzQo6FxeUX9VE8Kf9DNTgEYq+BaAUwo9vh7XSo=";
-    aarch64-darwin = "sha256-UKYtxzXeI547fxmTkfHxR7vEHwkPIGUd6AB4ZBa9DSY=";
+    x86_64-linux = "sha256-Y6UvMLw+bAg0HTKsc2FdpY+S4Zf7gpgIVdZDFgr+mog=";
+    aarch64-linux = "sha256-feBfv07DrKdeJbeD0gnYoOhg1LG636cghVu1x8n9rCQ=";
+    x86_64-darwin = "sha256-nVbhhlfSkJwZ1PXzhYSz9pXxbcRyO32RoOPlV7OGAOk=";
+    aarch64-darwin = "sha256-0iv1oUj6bLw7kUOwkW69rs+4NIetp+uEgJ7YULkKYLE=";
   };
   meta = {
     description = "Integrate JSON data into Grafana";
diff --git a/pkgs/shells/fish/plugins/hydro.nix b/pkgs/shells/fish/plugins/hydro.nix
index d9fbc2fec351..955fd3ce6c3c 100644
--- a/pkgs/shells/fish/plugins/hydro.nix
+++ b/pkgs/shells/fish/plugins/hydro.nix
@@ -2,6 +2,7 @@
   lib,
   buildFishPlugin,
   fetchFromGitHub,
+  unstableGitUpdater,
 }:
 
 buildFishPlugin {
@@ -15,10 +16,12 @@ buildFishPlugin {
     hash = "sha256-8ixve1ws80q5jNdKoooL25Lk7qopVitCMVTucW490fU=";
   };
 
+  passthru.updateScript = unstableGitUpdater { };
+
   meta = {
     description = "Ultra-pure, lag-free prompt with async Git status";
     homepage = "https://github.com/jorgebucaran/hydro";
     license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ higherorderlogic ];
   };
 }
diff --git a/pkgs/tools/compression/bzip2/default.nix b/pkgs/tools/compression/bzip2/default.nix
index de15b36aef1c..11d964fd2f06 100644
--- a/pkgs/tools/compression/bzip2/default.nix
+++ b/pkgs/tools/compression/bzip2/default.nix
@@ -30,6 +30,9 @@ stdenv.mkDerivation (
     patchFlags = [ "-p0" ];
 
     patches = [
+      # https://sourceware.org/cgit/bzip2/patch/?id=35d122a3df8b0cc4082a4d89fdc6ee99f375fe67
+      ./patches/CVE-2026-42250.patch
+
       ./patches/bzip2-1.0.6.2-autoconfiscated.patch
     ];
     # Fix up hardcoded version from the above patch, e.g. seen in bzip2.pc or libbz2.so.1.0.N
diff --git a/pkgs/tools/compression/bzip2/patches/CVE-2026-42250.patch b/pkgs/tools/compression/bzip2/patches/CVE-2026-42250.patch
new file mode 100644
index 000000000000..db16326cdeb7
--- /dev/null
+++ b/pkgs/tools/compression/bzip2/patches/CVE-2026-42250.patch
@@ -0,0 +1,34 @@
+From 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67 Mon Sep 17 00:00:00 2001
+From: Mark Wielaard <mark@klomp.org>
+Date: Thu, 28 May 2026 16:15:45 +0200
+Subject: bzip2recover: Make sure to not process more than
+ BZ_MAX_HANDLED_BLOCKS
+
+There is an off-by-one in the check before calling tooManyBlocks. This
+causes the scanning loop to run one more time and cause a possible
+read or write one past the global bStart, bEnd, rbStart and rbEnd
+buffers. There are no known exploits of this issue and you will need
+to compile with something like gcc -fsanitize=address (ASAN
+AddressSanitizer) to observe the faulty read/write.
+
+This has been assigned CVE-2026-42250.
+---
+ bzip2recover.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git bzip2recover.c bzip2recover.c
+index a8131e0..4b1c219 100644
+--- bzip2recover.c
++++ bzip2recover.c
+@@ -402,7 +402,7 @@ Int32 main ( Int32 argc, Char** argv )
+             rbEnd[rbCtr] = bEnd[currBlock];
+             rbCtr++;
+          }
+-         if (currBlock >= BZ_MAX_HANDLED_BLOCKS)
++         if (currBlock >= BZ_MAX_HANDLED_BLOCKS - 1)
+             tooManyBlocks(BZ_MAX_HANDLED_BLOCKS);
+          currBlock++;
+ 
+-- 
+cgit 
+
diff --git a/pkgs/tools/package-management/lix/common-lix.nix b/pkgs/tools/package-management/lix/common-lix.nix
index 9e400afd6b06..d5277055efd2 100644
--- a/pkgs/tools/package-management/lix/common-lix.nix
+++ b/pkgs/tools/package-management/lix/common-lix.nix
@@ -126,6 +126,19 @@ let
       ''
         substitute $inputPath $out --replace-fail @deps@ "$(cat ${deps})"
       '';
+
+  # https://github.com/NixOS/nixpkgs/pull/525953 backported a performance patch
+  # that /somehow/ breaks Lix unit tests.
+  # FIXME revert when the patch is gone in curl drv
+  curl-fixed = curl.overrideAttrs (
+    {
+      patches ? [ ],
+      ...
+    }:
+    {
+      patches = lib.filter (patch: !lib.strings.hasSuffix "fix-wakeup-consumption.patch" patch) patches;
+    }
+  );
 in
 # gcc miscompiles coroutines at least until 13.2, possibly longer
 # do not remove this check unless you are sure you (or your users) will not report bugs to Lix upstream about GCC miscompilations.
@@ -243,14 +256,14 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals stdenv.hostPlatform.isLinux [ util-linuxMinimal ]
   ++ lib.optionals (lib.versionAtLeast version "2.94") [ zstd ]
   ++ lib.optionals (withPlugins && finalAttrs.doInstallCheck) [
-    curl
+    curl-fixed
   ];
 
   buildInputs = [
     boost
     brotli
     bzip2
-    curl
+    curl-fixed
     capnproto
     editline
     openssl
diff --git a/pkgs/tools/text/gnupatch/default.nix b/pkgs/tools/text/gnupatch/default.nix
index 99a801c4cc8e..188ac323543f 100644
--- a/pkgs/tools/text/gnupatch/default.nix
+++ b/pkgs/tools/text/gnupatch/default.nix
@@ -15,8 +15,10 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-+Hzuae7CtPy/YKOWsDCtaqNBXxkqpffuhMrV4R9/WuM=";
   };
 
-  # This test is filesystem-dependent - observed failing on ZFS
-  postPatch = lib.optionalString stdenv.hostPlatform.isFreeBSD ''
+  # This test is filesystem-dependent - observed failing on ZFS.
+  # It is also just plain flaky: it has been observed failing about 10%
+  # of the time on btrfs and ext4 too.
+  postPatch = ''
     sed -E -i -e '/bad-filenames/d' tests/Makefile.am
   '';
 
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index f1f6a4e1db58..f8623d3b89d7 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1685,6 +1685,7 @@ mapAliases {
   open-stage-control = throw "'open-stage-control' has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-05-04
   open-timeline-io = warnAlias "'open-timeline-io' has been renamed to 'opentimelineio'" opentimelineio; # Added 2025-08-10
   openafs_1_8 = throw "'openafs_1_8' has been renamed to/replaced by 'openafs'"; # Converted to throw 2025-10-27
+  openai = throw "'openai' has been removed, since upstream removed the legacy CLI in v2.35.0; use 'python3Packages.openai' instead"; # Added 2026-06-10
   openai-triton-llvm = throw "'openai-triton-llvm' has been renamed to/replaced by 'triton-llvm'"; # Converted to throw 2025-10-27
   openai-whisper-cpp = throw "'openai-whisper-cpp' has been renamed to/replaced by 'whisper-cpp'"; # Converted to throw 2025-10-27
   openalSoft = warnAlias "'openalSoft' has been renamed to 'openal-soft'" openal-soft; # Added 2026-02-09
@@ -1993,6 +1994,7 @@ mapAliases {
   rustc-wasm32 = throw "'rustc-wasm32' has been renamed to/replaced by 'rustc'"; # Converted to throw 2025-10-27
   rustic-rs = throw "'rustic-rs' has been renamed to/replaced by 'rustic'"; # Converted to throw 2025-10-27
   rx = throw "'rx' has been dropped due to being broken since September 2025, with no complaints by any users of the package."; # Added 2026-04-05
+  rymcast = throw "'rymcast' has been removed because it depended on the removed webkitgtk_4_0 and has been marked broken since October 2025"; # Added 2026-06-26
   ryujinx = throw "'ryujinx' has been replaced by 'ryubing' as the new upstream"; # Added 2025-07-30
   ryujinx-greemdev = throw "'ryujinx-greemdev' has been renamed to/replaced by 'ryubing'"; # Converted to throw 2025-10-27
   scantailor = throw "'scantailor' has been renamed to/replaced by 'scantailor-advanced'"; # Converted to throw 2025-10-27
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0889cc3093b5..8fc736912ef5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5305,8 +5305,6 @@ with pkgs;
     sdk = true;
   };
 
-  openai = with python3Packages; toPythonApplication openai;
-
   openai-whisper = with python3.pkgs; toPythonApplication openai-whisper;
 
   oprofile = callPackage ../development/tools/profiling/oprofile {
@@ -6509,8 +6507,8 @@ with pkgs;
   zunclient = with python313Packages; toPythonApplication python-zunclient;
 
   inherit (callPackages ../by-name/li/libressl { })
-    libressl_4_1
     libressl_4_2
+    libressl_4_3
     ;
 
   openssl = openssl_3_6;
diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 5b7a40a4a6dc..3cf8a274f583 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -16662,12 +16662,12 @@ with self;
     };
   };
 
-  HTTPDaemon = buildPerlPackage {
+  HTTPDaemon = buildPerlModule {
     pname = "HTTP-Daemon";
-    version = "6.16";
+    version = "6.17";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/O/OA/OALDERS/HTTP-Daemon-6.16.tar.gz";
-      hash = "sha256-s40JJyXm+k4MTcKkfhVwcEkbr6Db4Wx4o1joBqp+Fz0=";
+      url = "mirror://cpan/authors/id/O/OA/OALDERS/HTTP-Daemon-6.17.tar.gz";
+      hash = "sha256-FigVgMQOIxCNAoQ0aYtdfVNje/kEyd+CJIHiU8vskgw=";
     };
     buildInputs = [
       ModuleBuildTiny
@@ -22106,6 +22106,12 @@ with self;
       url = "mirror://cpan/authors/id/I/IS/ISHIGAKI/Module-CPANTS-Analyse-1.02.tar.gz";
       hash = "sha256-nhFzm5zQi6LXWllzfx+yl/RYA/KJBjxcdZv8eP1Rbns=";
     };
+
+    # Fails with 'symlinks not listed in MANIFEST is not ignored for a non-local distribution'
+    postPatch = ''
+      rm -f t/analyse/manifest.t
+    '';
+
     propagatedBuildInputs = [
       ArchiveAnyLite
       ArrayDiff
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index f3cb3778fdd7..e6b1042ae8ec 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -654,28 +654,94 @@ self: super: with self; {
 
   algebraic-data-types = callPackage ../development/python-modules/algebraic-data-types { };
 
+  alibabacloud-actiontrail20200706 =
+    callPackage ../development/python-modules/alibabacloud-actiontrail20200706
+      { };
+
   alibabacloud-credentials = callPackage ../development/python-modules/alibabacloud-credentials { };
 
   alibabacloud-credentials-api =
     callPackage ../development/python-modules/alibabacloud-credentials-api
       { };
 
+  alibabacloud-cs20151215 = callPackage ../development/python-modules/alibabacloud-cs20151215 { };
+
+  alibabacloud-darabonba-array =
+    callPackage ../development/python-modules/alibabacloud-darabonba-array
+      { };
+
+  alibabacloud-darabonba-encode-util =
+    callPackage ../development/python-modules/alibabacloud-darabonba-encode-util
+      { };
+
+  alibabacloud-darabonba-map =
+    callPackage ../development/python-modules/alibabacloud-darabonba-map
+      { };
+
+  alibabacloud-darabonba-signature-util =
+    callPackage ../development/python-modules/alibabacloud-darabonba-signature-util
+      { };
+
+  alibabacloud-darabonba-string =
+    callPackage ../development/python-modules/alibabacloud-darabonba-string
+      { };
+
+  alibabacloud-darabonba-time =
+    callPackage ../development/python-modules/alibabacloud-darabonba-time
+      { };
+
+  alibabacloud-ecs20140526 = callPackage ../development/python-modules/alibabacloud-ecs20140526 { };
+
   alibabacloud-endpoint-util =
     callPackage ../development/python-modules/alibabacloud-endpoint-util
       { };
 
+  alibabacloud-gateway-oss = callPackage ../development/python-modules/alibabacloud-gateway-oss { };
+
+  alibabacloud-gateway-oss-util =
+    callPackage ../development/python-modules/alibabacloud-gateway-oss-util
+      { };
+
+  alibabacloud-gateway-sls = callPackage ../development/python-modules/alibabacloud-gateway-sls { };
+
+  alibabacloud-gateway-sls-util =
+    callPackage ../development/python-modules/alibabacloud-gateway-sls-util
+      { };
+
   alibabacloud-gateway-spi = callPackage ../development/python-modules/alibabacloud-gateway-spi { };
 
   alibabacloud-openapi-util = callPackage ../development/python-modules/alibabacloud-openapi-util { };
 
+  alibabacloud-oss-util = callPackage ../development/python-modules/alibabacloud-oss-util { };
+
+  alibabacloud-oss20190517 = callPackage ../development/python-modules/alibabacloud-oss20190517 { };
+
+  alibabacloud-ram20150501 = callPackage ../development/python-modules/alibabacloud-ram20150501 { };
+
+  alibabacloud-rds20140815 = callPackage ../development/python-modules/alibabacloud-rds20140815 { };
+
+  alibabacloud-sas20181203 = callPackage ../development/python-modules/alibabacloud-sas20181203 { };
+
+  alibabacloud-sls20201230 = callPackage ../development/python-modules/alibabacloud-sls20201230 { };
+
+  alibabacloud-sts20150401 = callPackage ../development/python-modules/alibabacloud-sts20150401 { };
+
   alibabacloud-tea = callPackage ../development/python-modules/alibabacloud-tea { };
 
+  alibabacloud-tea-openapi = callPackage ../development/python-modules/alibabacloud-tea-openapi { };
+
   alibabacloud-tea-util = callPackage ../development/python-modules/alibabacloud-tea-util { };
 
+  alibabacloud-tea-xml = callPackage ../development/python-modules/alibabacloud-tea-xml { };
+
+  alibabacloud-vpc20160428 = callPackage ../development/python-modules/alibabacloud-vpc20160428 { };
+
   aligator = callPackage ../development/python-modules/aligator { inherit (pkgs) aligator; };
 
   alive-progress = callPackage ../development/python-modules/alive-progress { };
 
+  aliyun-log-fastpb = callPackage ../development/python-modules/aliyun-log-fastpb { };
+
   aliyun-python-sdk-alimt = callPackage ../development/python-modules/aliyun-python-sdk-alimt { };
 
   aliyun-python-sdk-cdn = callPackage ../development/python-modules/aliyun-python-sdk-cdn { };
@@ -3583,6 +3649,8 @@ self: super: with self; {
 
   daqp = callPackage ../development/python-modules/daqp { };
 
+  darabonba-core = callPackage ../development/python-modules/darabonba-core { };
+
   darkdetect = callPackage ../development/python-modules/darkdetect { };
 
   dartsim = toPythonModule (
@@ -9206,6 +9274,8 @@ self: super: with self; {
 
   linode-api = callPackage ../development/python-modules/linode-api { };
 
+  linode-api4 = callPackage ../development/python-modules/linode-api4 { };
+
   linode-metadata = callPackage ../development/python-modules/linode-metadata { };
 
   linuxdoc = callPackage ../development/python-modules/linuxdoc { };
@@ -17704,6 +17774,10 @@ self: super: with self; {
 
   scales = callPackage ../development/python-modules/scales { };
 
+  scaleway = callPackage ../development/python-modules/scaleway { };
+
+  scaleway-core = callPackage ../development/python-modules/scaleway-core { };
+
   scalib = callPackage ../development/python-modules/scalib { };
 
   scancode-toolkit = callPackage ../development/python-modules/scancode-toolkit { };