diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index f60ece0c8f5c..fd4ed9777b52 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -11,7 +11,6 @@ let
     isList
     mapAttrs
     optional
-    optionalAttrs
     optionalString
     removeSuffix
     replaceString
@@ -84,6 +83,29 @@ let
       # TODO: deprecate args.rustc in favour of args.rust after 23.05 is EOL.
       rust = args.rust or args.rustc or { };
 
+      selectEmulator =
+        pkgs:
+        let
+          wine = (pkgs.winePackagesFor "wine${toString final.parsed.cpu.bits}").minimal;
+        in
+        # Note: we guarantee that the return value is either `null` or a path
+        # to an emulator program. That is, if an emulator requires additional
+        # arguments, a wrapper should be used.
+        if pkgs.stdenv.hostPlatform.canExecute final then
+          lib.getExe (pkgs.writeShellScriptBin "exec" ''exec "$@"'')
+        else if final.isWindows then
+          "${wine}/bin/wine"
+        else if final.isLinux && pkgs.stdenv.hostPlatform.isLinux && final.qemuArch != null then
+          "${pkgs.qemu-user}/bin/qemu-${final.qemuArch}"
+        else if final.isWasi then
+          "${pkgs.wasmtime}/bin/wasmtime"
+        else if final.isGhcjs then
+          "${pkgs.nodejs-slim}/bin/node"
+        else if final.isMmix then
+          "${pkgs.mmixware}/bin/mmix"
+        else
+          null;
+
       final = {
         # Prefer to parse `config` as it is strictly more informative.
         parsed = parse.mkSystemFromString (args.config or allArgs.system);
@@ -178,21 +200,19 @@ let
             if final.isx86_64 || final.isMips64 || final.isPower64 then "lib64" else "lib"
           else
             null;
-        extensions =
-          optionalAttrs final.hasSharedLibraries {
-            sharedLibrary =
-              if final.isDarwin then
-                ".dylib"
-              else if (final.isWindows || final.isCygwin) then
-                ".dll"
-              else
-                ".so";
-          }
-          // {
-            staticLibrary = if final.isWindows then ".lib" else ".a";
-            library = if final.isStatic then final.extensions.staticLibrary else final.extensions.sharedLibrary;
-            executable = if (final.isWindows || final.isCygwin) then ".exe" else "";
-          };
+        extensions = {
+          staticLibrary = if final.isWindows then ".lib" else ".a";
+          library = if final.isStatic then final.extensions.staticLibrary else final.extensions.sharedLibrary;
+          executable = if (final.isWindows || final.isCygwin) then ".exe" else "";
+
+          ${if final.hasSharedLibraries then "sharedLibrary" else null} =
+            if final.isDarwin then
+              ".dylib"
+            else if (final.isWindows || final.isCygwin) then
+              ".dll"
+            else
+              ".so";
+        };
         # Misc boolean options
         useAndroidPrebuilt = false;
         useiOSPrebuilt = false;
@@ -373,48 +393,21 @@ let
         # Handle Android SDK and NDK versions.
         androidSdkVersion = args.androidSdkVersion or null;
         androidNdkVersion = args.androidNdkVersion or null;
+
+        emulatorAvailable = pkgs: selectEmulator pkgs != null;
+
+        # whether final.emulator pkgs.pkgsStatic works
+        staticEmulatorAvailable =
+          pkgs: final.emulatorAvailable pkgs && (final.isLinux || final.isWasi || final.isMmix);
+
+        emulator =
+          pkgs:
+          if (final.emulatorAvailable pkgs) then
+            selectEmulator pkgs
+          else
+            throw "Don't know how to run ${final.config} executables.";
+
       }
-      // (
-        let
-          selectEmulator =
-            pkgs:
-            let
-              wine = (pkgs.winePackagesFor "wine${toString final.parsed.cpu.bits}").minimal;
-            in
-            # Note: we guarantee that the return value is either `null` or a path
-            # to an emulator program. That is, if an emulator requires additional
-            # arguments, a wrapper should be used.
-            if pkgs.stdenv.hostPlatform.canExecute final then
-              lib.getExe (pkgs.writeShellScriptBin "exec" ''exec "$@"'')
-            else if final.isWindows then
-              "${wine}/bin/wine"
-            else if final.isLinux && pkgs.stdenv.hostPlatform.isLinux && final.qemuArch != null then
-              "${pkgs.qemu-user}/bin/qemu-${final.qemuArch}"
-            else if final.isWasi then
-              "${pkgs.wasmtime}/bin/wasmtime"
-            else if final.isGhcjs then
-              "${pkgs.nodejs-slim}/bin/node"
-            else if final.isMmix then
-              "${pkgs.mmixware}/bin/mmix"
-            else
-              null;
-        in
-        {
-          emulatorAvailable = pkgs: (selectEmulator pkgs) != null;
-
-          # whether final.emulator pkgs.pkgsStatic works
-          staticEmulatorAvailable =
-            pkgs: final.emulatorAvailable pkgs && (final.isLinux || final.isWasi || final.isMmix);
-
-          emulator =
-            pkgs:
-            if (final.emulatorAvailable pkgs) then
-              selectEmulator pkgs
-            else
-              throw "Don't know how to run ${final.config} executables.";
-
-        }
-      )
       // mapAttrs (n: v: v final.parsed) inspect.predicates
       // mapAttrs (n: v: v final.gcc.arch or "default") architectures.predicates
       // args
@@ -556,8 +549,6 @@ let
             "-uefi"
           ];
         };
-      }
-      // {
         go = {
           # See https://pkg.go.dev/internal/platform for a list of known platforms
           GOARCH =
diff --git a/lib/systems/parse.nix b/lib/systems/parse.nix
index 626b5bcb41ac..98db2595235f 100644
--- a/lib/systems/parse.nix
+++ b/lib/systems/parse.nix
@@ -24,6 +24,7 @@ let
     elem
     elemAt
     hasPrefix
+    head
     id
     length
     mapAttrs
@@ -68,7 +69,7 @@ let
     let
       found = match "(.*)e?abi.*" x;
     in
-    if found == null then x else elemAt found 0;
+    if found == null then x else head found;
 
 in
 
@@ -417,10 +418,8 @@ rec {
   gnuNetBSDDefaultExecFormat =
     cpu:
     if
-      (cpu.family == "arm" && cpu.bits == 32)
-      || (cpu.family == "sparc" && cpu.bits == 32)
-      || (cpu.family == "m68k" && cpu.bits == 32)
-      || (cpu.family == "x86" && cpu.bits == 32)
+      cpu.bits == 32
+      && (cpu.family == "arm" || cpu.family == "sparc" || cpu.family == "m68k" || cpu.family == "x86")
     then
       execFormats.aout
     else
@@ -445,7 +444,8 @@ rec {
   isCompatible =
     with cpuTypes;
     a: b:
-    any id [
+    b == a
+    || any id [
       # x86
       (b == i386 && isCompatible a i486)
       (b == i486 && isCompatible a i586)
@@ -483,9 +483,6 @@ rec {
 
       # SPARC
       (b == sparc && isCompatible a sparc64)
-
-      # identity
-      (b == a)
     ];
 
   ################################################################################
@@ -791,9 +788,9 @@ rec {
     l:
     {
       "1" =
-        if elemAt l 0 == "avr" then
+        if head l == "avr" then
           {
-            cpu = elemAt l 0;
+            cpu = head l;
             kernel = "none";
             abi = "unknown";
           }
@@ -802,7 +799,7 @@ rec {
       "2" = # We only do 2-part hacks for things Nix already supports
         if elemAt l 1 == "cygwin" then
           mkSkeletonFromList [
-            (elemAt l 0)
+            (head l)
             "pc"
             "cygwin"
           ]
@@ -812,20 +809,20 @@ rec {
         # hack-in MSVC for the non-MinGW case right here.
         else if elemAt l 1 == "windows" then
           {
-            cpu = elemAt l 0;
+            cpu = head l;
             kernel = "windows";
             abi = "msvc";
           }
         else if (elemAt l 1) == "elf" then
           {
-            cpu = elemAt l 0;
+            cpu = head l;
             vendor = "unknown";
             kernel = "none";
             abi = elemAt l 1;
           }
         else
           {
-            cpu = elemAt l 0;
+            cpu = head l;
             kernel = elemAt l 1;
           };
       "3" =
@@ -840,7 +837,7 @@ rec {
           ]
         then
           {
-            cpu = elemAt l 0;
+            cpu = head l;
             kernel = elemAt l 1;
             abi = elemAt l 2;
             vendor = "unknown";
@@ -862,7 +859,7 @@ rec {
           || hasPrefix "wasm32" (elemAt l 0)
         then
           {
-            cpu = elemAt l 0;
+            cpu = head l;
             vendor = elemAt l 1;
             kernel =
               if elemAt l 2 == "mingw32" then
@@ -873,14 +870,14 @@ rec {
         # lots of tools expect a triplet for Cygwin, even though the vendor is just "pc"
         else if elemAt l 2 == "cygwin" then
           {
-            cpu = elemAt l 0;
+            cpu = head l;
             vendor = elemAt l 1;
             kernel = "cygwin";
           }
         else
           throw "system string '${lib.concatStringsSep "-" l}' with 3 components is ambiguous";
       "4" = {
-        cpu = elemAt l 0;
+        cpu = head l;
         vendor = elemAt l 1;
         kernel = elemAt l 2;
         abi = elemAt l 3;
diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index b771a590c9dd..16595996a747 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -923,6 +923,12 @@
     githubId = 4717906;
     name = "Jakub Skokan";
   };
+  aiwao = {
+    email = "aiwao@140.lol";
+    github = "aiwao";
+    githubId = 233898056;
+    name = "aiwao";
+  };
   aiyion = {
     email = "git@aiyionpri.me";
     github = "AiyionPrime";
diff --git a/nixos/modules/services/networking/3proxy.nix b/nixos/modules/services/networking/3proxy.nix
index dca17e8194ef..8531b41553bc 100644
--- a/nixos/modules/services/networking/3proxy.nix
+++ b/nixos/modules/services/networking/3proxy.nix
@@ -59,6 +59,7 @@ in
                 "dnspr"
                 "tcppm"
                 "udppm"
+                "auto"
               ];
               example = "proxy";
               description = ''
@@ -72,6 +73,7 @@ in
                 - `"dnspr"`: Caching DNS proxy (default port 53).
                 - `"tcppm"`: TCP portmapper.
                 - `"udppm"`: UDP portmapper.
+                - `"auto"`: Proxy with protocol autoselection between proxy / socks / tlspr.
               '';
             };
             bindAddress = lib.mkOption {
diff --git a/nixos/modules/services/networking/tetrd.nix b/nixos/modules/services/networking/tetrd.nix
index 7b7b050bb0d7..77cf6722e404 100644
--- a/nixos/modules/services/networking/tetrd.nix
+++ b/nixos/modules/services/networking/tetrd.nix
@@ -89,17 +89,14 @@
 
           BindPaths = [
             "/etc/tetrd/resolv.conf:/etc/resolv.conf"
-            "/run"
-            "/var/log"
+            "/run/tetrd:/run"
           ];
 
           CapabilityBoundingSet = [
-            "CAP_DAC_OVERRIDE"
             "CAP_NET_ADMIN"
           ];
 
           AmbientCapabilities = [
-            "CAP_DAC_OVERRIDE"
             "CAP_NET_ADMIN"
           ];
         };
diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 60342ce15359..b19049f2e798 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -25829,6 +25829,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  zig-vim = buildVimPlugin {
+    pname = "zig.vim";
+    version = "0-unstable-2026-05-02";
+    src = fetchgit {
+      url = "https://codeberg.org/ziglang/zig.vim/";
+      rev = "73f6856496aee1d94884f072dfad18df7977d4e3";
+      hash = "sha256-I+nPSItC/0M8QTs1mVX7F+KjtezYpq9GFpUdsFl6bTE=";
+    };
+    meta.homepage = "https://codeberg.org/ziglang/zig.vim/";
+    meta.license = lib.licenses.unfree;
+    meta.hydraPlatforms = [ ];
+  };
+
   zk-nvim = buildVimPlugin {
     pname = "zk-nvim";
     version = "0.4.7-unstable-2026-03-13";
diff --git a/pkgs/applications/editors/vim/plugins/non-generated/zig-vim/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/zig-vim/default.nix
deleted file mode 100644
index bc2b9148b1a3..000000000000
--- a/pkgs/applications/editors/vim/plugins/non-generated/zig-vim/default.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-{
-  lib,
-  vimUtils,
-  fetchFromCodeberg,
-  nix-update-script,
-}:
-vimUtils.buildVimPlugin {
-  pname = "zig.vim";
-  version = "0-unstable-2026-04-13";
-
-  src = fetchFromCodeberg {
-    owner = "ziglang";
-    repo = "zig.vim";
-    rev = "30a1634b3a4193290dc3aad8f84c53b353b1d80f";
-    hash = "sha256-2nr6csxVNDI/fRf0bsYcFKHWhvJe0vMkOT/J+4+EJaU=";
-  };
-
-  passthru.updateScript = nix-update-script {
-    extraArgs = [ "--version=branch" ];
-  };
-
-  meta = {
-    description = "Vim configuration for Zig";
-    homepage = "https://codeberg.org/ziglang/zig.vim/";
-    license = lib.licenses.mit;
-    platforms = lib.platforms.all;
-  };
-}
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 08984e2ccbb2..84d5eac84a7e 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -3898,7 +3898,7 @@ assertNoAdditions {
     ];
 
     checkInputs = [
-      # Transitive depedency of telescope.nvim
+      # Transitive dependency of telescope.nvim
       # Issue: https://github.com/NixOS/nixpkgs/issues/394939
       self.plenary-nvim
     ];
@@ -5722,6 +5722,12 @@ assertNoAdditions {
     ];
   };
 
+  zig-vim = super.zig-vim.overrideAttrs (old: {
+    meta = old.meta // {
+      license = lib.licenses.mit;
+    };
+  });
+
   zk-nvim = super.zk-nvim.overrideAttrs {
     checkInputs = with self; [
       # Optional pickers
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 0b7c2e4cbb56..33926878370a 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -1842,6 +1842,7 @@ https://github.com/sand4rt/zen.nvim/,,
 https://github.com/zenbones-theme/zenbones.nvim/,,
 https://github.com/jnurmine/zenburn/,,
 https://github.com/nvimdev/zephyr-nvim/,,
+https://codeberg.org/ziglang/zig.vim/,,
 https://github.com/zk-org/zk-nvim/,,
 https://github.com/troydm/zoomwintab.vim/,,
 https://github.com/jalvesaq/zotcite/,,
diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index ffd6d4b25789..79ae78e1a38d 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1418,13 +1418,13 @@
     "vendorHash": null
   },
   "vancluever_acme": {
-    "hash": "sha256-8uMCtwldGlGqwyZXV4Q1g+9lHQqa952Sd+mywkt0weo=",
+    "hash": "sha256-AlT7Qe4YGdPUhM1N4OiMyjbmupgqXcQ/6SLz/v+W8lI=",
     "homepage": "https://registry.terraform.io/providers/vancluever/acme",
     "owner": "vancluever",
     "repo": "terraform-provider-acme",
-    "rev": "v2.48.0",
+    "rev": "v2.48.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-i6Hw1hCr/LRhGjemGAzhZQYr/LsjBrT5aFVXAHDE85M="
+    "vendorHash": "sha256-lWBMihP6oX7qPpTuPQQwQS3IDwdyb/rEYqtBsTozb7Q="
   },
   "venafi_venafi": {
     "hash": "sha256-wpAckNRqZjSDt7KpCRpLSYkn6Gm+QPzn5sIJ90wRXjI=",
diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index 0b839ab9d9fb..6ea375646a63 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -73,8 +73,8 @@ rec {
   thunderbird = thunderbird-latest;
 
   thunderbird-latest = common {
-    version = "150.0";
-    sha512 = "6e0770de0aeabdd9372b491ae0a6d20238ff154b70982de21c73b903003398f36d8f56c679ca893a1e5646a25add9e9e126ae1b6ee1f836290104b61eb09dac1";
+    version = "150.0.1";
+    sha512 = "bf3d33357965cd144decef7c8865b6c18043502aea8d090d93fe29555379b924e3925d58276411f38fdcdc87b54ab3ae7d6aa6619feec9b856f8f227225cb375";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-latest";
diff --git a/pkgs/by-name/al/alcarin-tengwar/package.nix b/pkgs/by-name/al/alcarin-tengwar/package.nix
index d792aaf678a4..6abb297caf20 100644
--- a/pkgs/by-name/al/alcarin-tengwar/package.nix
+++ b/pkgs/by-name/al/alcarin-tengwar/package.nix
@@ -9,6 +9,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "alcarin-tengwar";
   version = "0.83";
 
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
   src = fetchFromGitHub {
     owner = "Tosche";
     repo = "Alcarin-Tengwar";
diff --git a/pkgs/by-name/al/aleo-fonts/package.nix b/pkgs/by-name/al/aleo-fonts/package.nix
index d5bfadced1fa..2f2b4143567c 100644
--- a/pkgs/by-name/al/aleo-fonts/package.nix
+++ b/pkgs/by-name/al/aleo-fonts/package.nix
@@ -16,8 +16,15 @@ stdenvNoCC.mkDerivation {
     hash = "sha256-HSxP5/sLHQTujBVt1u93625EXEc42lxpt8W1//6ngWM=";
   };
 
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
   nativeBuildInputs = [ installFonts ];
 
+  preInstall = "rm -r fonts/old";
+
   meta = {
     description = "Slab serif typeface designed by Alessio Laiso";
     homepage = "https://github.com/AlessioLaiso/aleo";
diff --git a/pkgs/by-name/al/alfis/package.nix b/pkgs/by-name/al/alfis/package.nix
index 7f8352c146be..dcfa98d8843d 100644
--- a/pkgs/by-name/al/alfis/package.nix
+++ b/pkgs/by-name/al/alfis/package.nix
@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "alfis";
-  version = "0.8.9";
+  version = "0.8.10";
 
   src = fetchFromGitHub {
     owner = "Revertron";
     repo = "Alfis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-r3QIj9/Qv6y7qWltIjh1WCAZyFKMK2aN4vCsAUJB6PQ=";
+    hash = "sha256-gYy4Jyq4tkAPPfi2GGUf0ucVPlTgr0PkZYdOmqUMBvU=";
   };
 
-  cargoHash = "sha256-lOSGZIGztZumt/cymMNyBoBl6objrS8F5Nkk1e7T9NE=";
+  cargoHash = "sha256-yRJSgFIheWLWK0gN9VNmgMhQGdv902zx2T3X6CA8YEQ=";
 
   nativeBuildInputs = [
     pkg-config
diff --git a/pkgs/by-name/an/anilibria-winmaclinux/package.nix b/pkgs/by-name/an/anilibria-winmaclinux/package.nix
index bb11f1fe635f..86d515120c9c 100644
--- a/pkgs/by-name/an/anilibria-winmaclinux/package.nix
+++ b/pkgs/by-name/an/anilibria-winmaclinux/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "anilibria-winmaclinux";
-  version = "2.2.34";
+  version = "2.2.35";
 
   src = fetchFromGitHub {
     owner = "anilibria";
     repo = "anilibria-winmaclinux";
     tag = finalAttrs.version;
-    hash = "sha256-58NFlB6viWXG13J+RBzMj6LlYFClpWpGQ/aCNxJ5wKQ=";
+    hash = "sha256-3tiCfL6j2yhhL16mG1LYD41G6nbomwmqZOwgm4bEHTs=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/src";
diff --git a/pkgs/by-name/at/atkinson-hyperlegible-mono/package.nix b/pkgs/by-name/at/atkinson-hyperlegible-mono/package.nix
index e8992b04834e..6ff13cca2427 100644
--- a/pkgs/by-name/at/atkinson-hyperlegible-mono/package.nix
+++ b/pkgs/by-name/at/atkinson-hyperlegible-mono/package.nix
@@ -9,6 +9,11 @@ stdenvNoCC.mkDerivation {
   pname = "atkinson-hyperlegible-mono";
   version = "2.001-unstable-2024-11-20";
 
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
   src = fetchFromGitHub {
     owner = "googlefonts";
     repo = "atkinson-hyperlegible-next-mono";
diff --git a/pkgs/by-name/at/atkinson-hyperlegible-next/package.nix b/pkgs/by-name/at/atkinson-hyperlegible-next/package.nix
index 008735231ebc..f1fd44c17506 100644
--- a/pkgs/by-name/at/atkinson-hyperlegible-next/package.nix
+++ b/pkgs/by-name/at/atkinson-hyperlegible-next/package.nix
@@ -9,6 +9,11 @@ stdenvNoCC.mkDerivation {
   pname = "atkinson-hyperlegible-next";
   version = "2.001-unstable-2025-02-21";
 
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
   src = fetchFromGitHub {
     owner = "googlefonts";
     repo = "atkinson-hyperlegible-next";
diff --git a/pkgs/by-name/au/autobrr/package.nix b/pkgs/by-name/au/autobrr/package.nix
index da87e3dcd880..a4b34536ea71 100644
--- a/pkgs/by-name/au/autobrr/package.nix
+++ b/pkgs/by-name/au/autobrr/package.nix
@@ -16,12 +16,12 @@
 
 let
   pname = "autobrr";
-  version = "1.76.0";
+  version = "1.77.0";
   src = fetchFromGitHub {
     owner = "autobrr";
     repo = "autobrr";
     tag = "v${version}";
-    hash = "sha256-MGqsRRN73L6i/lhdhnoi3ehnDIRDQpgFYluO6ZeOPT0=";
+    hash = "sha256-Rz2rPV1IigaaSwk18vldNQ1RRK9cUJPy4yYkL1KTURw=";
   };
 
   autobrr-web = stdenvNoCC.mkDerivation {
@@ -60,7 +60,6 @@ let
 in
 buildGoModule (finalAttrs: {
   inherit
-    autobrr-web
     pname
     version
     src
@@ -69,7 +68,7 @@ buildGoModule (finalAttrs: {
   vendorHash = "sha256-HjHRT/PAZdMM/2JWmNMK/I9Gc0ThTAFDSxWW/ATYxW8=";
 
   preBuild = ''
-    cp -r ${autobrr-web}/* web/dist
+    cp -r ${finalAttrs.passthru.autobrr-web}/* web/dist
   '';
 
   ldflags = [
@@ -88,6 +87,7 @@ buildGoModule (finalAttrs: {
   versionCheckProgramArg = "version";
 
   passthru = {
+    inherit autobrr-web;
     updateScript = nix-update-script {
       extraArgs = [
         "--subpackage"
diff --git a/pkgs/by-name/be/beedii/package.nix b/pkgs/by-name/be/beedii/package.nix
index 406a21e9abc1..53a441916b46 100644
--- a/pkgs/by-name/be/beedii/package.nix
+++ b/pkgs/by-name/be/beedii/package.nix
@@ -10,6 +10,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "beedii";
   version = "1.0.0";
 
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
   src = fetchzip {
     url = "https://github.com/webkul/beedii/releases/download/v${finalAttrs.version}/beedii.zip";
     hash = "sha256-MefkmWl7LdhQiePpixKcatoIeOTlrRaO3QA9xWAxJ4Q=";
diff --git a/pkgs/by-name/be/behdad-fonts/package.nix b/pkgs/by-name/be/behdad-fonts/package.nix
index 0d910fe516e0..d3285f4c9670 100644
--- a/pkgs/by-name/be/behdad-fonts/package.nix
+++ b/pkgs/by-name/be/behdad-fonts/package.nix
@@ -9,6 +9,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "behdad-fonts";
   version = "0.0.3";
 
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
   src = fetchFromGitHub {
     owner = "font-store";
     repo = "BehdadFont";
diff --git a/pkgs/by-name/be/besley/package.nix b/pkgs/by-name/be/besley/package.nix
index aed509d05c28..bd286ee12d71 100644
--- a/pkgs/by-name/be/besley/package.nix
+++ b/pkgs/by-name/be/besley/package.nix
@@ -8,6 +8,11 @@ stdenvNoCC.mkDerivation {
   pname = "besley";
   version = "4.0-unstable-2023-01-09";
 
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
   src = fetchFromGitHub {
     owner = "indestructible-type";
     repo = "Besley";
diff --git a/pkgs/by-name/bl/blackout/package.nix b/pkgs/by-name/bl/blackout/package.nix
index cc353081a0b1..02651463bb0e 100644
--- a/pkgs/by-name/bl/blackout/package.nix
+++ b/pkgs/by-name/bl/blackout/package.nix
@@ -9,6 +9,11 @@ stdenvNoCC.mkDerivation {
   pname = "blackout";
   version = "2014-07-29";
 
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
   src = fetchFromGitHub {
     owner = "theleagueof";
     repo = "blackout";
diff --git a/pkgs/by-name/bo/bodoni-moda/package.nix b/pkgs/by-name/bo/bodoni-moda/package.nix
index c2c1de12fe28..722ad5097d85 100644
--- a/pkgs/by-name/bo/bodoni-moda/package.nix
+++ b/pkgs/by-name/bo/bodoni-moda/package.nix
@@ -8,6 +8,11 @@ stdenvNoCC.mkDerivation {
   pname = "bodoni-moda";
   version = "2.4-unstable-2024-02-18";
 
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
   src = fetchFromGitHub {
     owner = "indestructible-type";
     repo = "Bodoni";
diff --git a/pkgs/by-name/cl/claude-agent-acp/package.nix b/pkgs/by-name/cl/claude-agent-acp/package.nix
index d8633b21a70a..3724448171e6 100644
--- a/pkgs/by-name/cl/claude-agent-acp/package.nix
+++ b/pkgs/by-name/cl/claude-agent-acp/package.nix
@@ -2,26 +2,38 @@
   lib,
   buildNpmPackage,
   fetchFromGitHub,
+  makeWrapper,
+  claude-code,
 }:
 
 buildNpmPackage (finalAttrs: {
   pname = "claude-agent-acp";
-  version = "0.21.0";
+  version = "0.32.0";
 
   src = fetchFromGitHub {
-    owner = "zed-industries";
+    owner = "agentclientprotocol";
     repo = "claude-agent-acp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6c6bHuso3diW5ZfHiM2xcxGDTNG0LIL0TZd0MFVpW/E=";
+    hash = "sha256-egYGwkN8iexw42EIhUgKb+QuAKfH4lKts0lftzfHAiY=";
   };
 
-  npmDepsHash = "sha256-UtiIcjgNCYMFrRpO5AlUbOyutJ3ipwIbcpMi2BqawEk=";
+  npmDepsHash = "sha256-sUB/S3EycM3FGibAaZMA1T7tCyDu2XfkSg86qcABmYk=";
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  postInstall = ''
+    wrapProgram $out/bin/claude-agent-acp \
+      --prefix CLAUDE_CODE_EXECUTABLE ${lib.getExe claude-code}
+  '';
 
   meta = {
     description = "ACP-compatible coding agent powered by the Claude Agent SDK";
-    homepage = "https://github.com/zed-industries/claude-agent-acp";
+    homepage = "https://github.com/agentclientprotocol/claude-agent-acp";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ storopoli ];
+    maintainers = with lib.maintainers; [
+      amadejkastelic
+      storopoli
+    ];
     mainProgram = "claude-agent-acp";
   };
 })
diff --git a/pkgs/by-name/co/cog/package.nix b/pkgs/by-name/co/cog/package.nix
index 772f501586ef..b53772303623 100644
--- a/pkgs/by-name/co/cog/package.nix
+++ b/pkgs/by-name/co/cog/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "cog";
-  version = "0.1.9";
+  version = "0.1.11";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "cog";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AFR9D776MRXmSR/hvXJd7xorHEl1VAio/crEvUU8kuY=";
+    hash = "sha256-ruJxlpem++V7Q39QenvGG7LUuyn3Oqlb3v10H8rdAxA=";
   };
 
-  vendorHash = "sha256-UVcsstCSY3OZkvaujrlnGHKI3BTMcb3UN3lwOMPKLdw=";
+  vendorHash = "sha256-WR/dfwNBduRokPGAljnXNgA2ZKoYRGtZ3+tKBzCuXI4=";
 
   subPackages = [ "cmd/cli" ];
 
diff --git a/pkgs/by-name/co/cooper/package.nix b/pkgs/by-name/co/cooper/package.nix
index 612072f08f83..fefbb01d7155 100644
--- a/pkgs/by-name/co/cooper/package.nix
+++ b/pkgs/by-name/co/cooper/package.nix
@@ -8,6 +8,11 @@ stdenvNoCC.mkDerivation {
   pname = "cooper";
   version = "1.01-unstable-2025-05-25";
 
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
   src = fetchFromGitHub {
     owner = "indestructible-type";
     repo = "Cooper";
diff --git a/pkgs/by-name/cs/css-variables-language-server/package.nix b/pkgs/by-name/cs/css-variables-language-server/package.nix
new file mode 100644
index 000000000000..681b1ee3dfae
--- /dev/null
+++ b/pkgs/by-name/cs/css-variables-language-server/package.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  pkg-config,
+  makeWrapper,
+  libsecret,
+  nodejs,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "css-variables-language-server";
+  version = "2.8.4";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "vunguyentuan";
+    repo = "vscode-css-variables";
+    tag = "css-variables-language-server@${finalAttrs.version}";
+    hash = "sha256-NdacBF8sUOij6k4AkMim93LrBJi8JL43q/N8GryTXHA=";
+  };
+
+  npmDepsHash = "sha256-cgX/M05UGsx87QO/Ge0VCD2hQ9MkfJarJVNCj/IcnM0=";
+
+  nativeBuildInputs = [
+    pkg-config
+    makeWrapper
+  ];
+
+  buildInputs = [
+    libsecret
+  ];
+
+  preBuild = ''
+    patchShebangs .
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib $out/bin
+    cp -r node_modules $out/lib
+    cp -r packages $out/lib
+
+    makeWrapper ${nodejs}/bin/node $out/bin/index.js --add-flags "$out/lib/packages/css-variables-language-server/dist/index.js"
+
+    mv $out/bin/index.js $out/bin/css-variables-language-server
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "CSS Variables Language Server in node";
+    changelog = "https://github.com/vunguyentuan/vscode-css-variables/releases/tag/css-variables-language-server@${finalAttrs.version}";
+    homepage = "https://github.com/vunguyentuan/vscode-css-variables";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ aiwao ];
+    mainProgram = "css-variables-language-server";
+  };
+})
diff --git a/pkgs/by-name/do/dosbox-x/package.nix b/pkgs/by-name/do/dosbox-x/package.nix
index 1732654337e2..2eccc69103a0 100644
--- a/pkgs/by-name/do/dosbox-x/package.nix
+++ b/pkgs/by-name/do/dosbox-x/package.nix
@@ -9,6 +9,7 @@
   fluidsynth,
   freetype,
   glib,
+  libGL,
   libicns,
   libpcap,
   libpng,
@@ -79,6 +80,7 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     alsa-lib
+    libGL
     libxkbfile
     libxrandr
   ];
diff --git a/pkgs/by-name/ef/efitools/objcopy-output-target.patch b/pkgs/by-name/ef/efitools/objcopy-output-target.patch
new file mode 100644
index 000000000000..66b36d64ef15
--- /dev/null
+++ b/pkgs/by-name/ef/efitools/objcopy-output-target.patch
@@ -0,0 +1,15 @@
+Use --output-target instead of --target in objcopy invocation.
+Newer binutils dropped support for --target as an output format specifier.
+
+Bug-Debian: https://bugs.debian.org/1122408
+--- a/Make.rules
++++ b/Make.rules
+@@ -26,7 +26,7 @@
+ LDSCRIPT	= elf_$(ARCH)_efi.lds
+ LDFLAGS		+= -shared -Bsymbolic $(CRTOBJS) -L $(CRTPATH) -L /usr/lib -L /usr/lib64 -T $(LDSCRIPT)
+ LOADLIBES	= -lefi -lgnuefi $(shell $(CC) $(ARCH3264) -print-libgcc-file-name)
+-FORMAT		= --target=efi-app-$(ARCH)
++FORMAT		= --output-target=efi-app-$(ARCH)
+ OBJCOPY		= objcopy
+ MYGUID		= 11111111-2222-3333-4444-123456789abc
+ INSTALL		= install
diff --git a/pkgs/by-name/ef/efitools/package.nix b/pkgs/by-name/ef/efitools/package.nix
index 89c451277b8e..89787fdb0bee 100644
--- a/pkgs/by-name/ef/efitools/package.nix
+++ b/pkgs/by-name/ef/efitools/package.nix
@@ -36,6 +36,9 @@ stdenv.mkDerivation (finalAttrs: {
 
     # Fix build with gcc15
     ./remove-redundant-bool.patch
+
+    # https://bugs.debian.org/1122408
+    ./objcopy-output-target.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/by-name/fe/fence/package.nix b/pkgs/by-name/fe/fence/package.nix
index 9b1166db7305..23b53ff68c27 100644
--- a/pkgs/by-name/fe/fence/package.nix
+++ b/pkgs/by-name/fe/fence/package.nix
@@ -14,16 +14,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "fence";
-  version = "0.1.49";
+  version = "0.1.54";
 
   src = fetchFromGitHub {
     owner = "Use-Tusk";
     repo = "fence";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-G3zrm6XzQPZgHky/O32cXmzQX8tLbwqgSm5xQ3xn33A=";
+    hash = "sha256-Um9nIg+lXNfp8vBeLlCUYlJNtPIemnyenz7+L9dfcjg=";
   };
 
-  vendorHash = "sha256-JIkEe+wscowc1IT8gtm5C4ZnChsOhy5wTy7R//DLFTU=";
+  vendorHash = "sha256-Qct/M0zuggYzlN0gyO8nF58M5Av3HcYyMjrPab5Crr0=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/fe/fetchtastic/package.nix b/pkgs/by-name/fe/fetchtastic/package.nix
index b9bbc9d83576..fc7e867ec9c8 100644
--- a/pkgs/by-name/fe/fetchtastic/package.nix
+++ b/pkgs/by-name/fe/fetchtastic/package.nix
@@ -1,19 +1,20 @@
 {
   lib,
+  stdenv,
   fetchFromGitHub,
   python3,
 }:
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "fetchtastic";
-  version = "0.10.2";
+  version = "0.10.9";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jeremiah-k";
     repo = "fetchtastic";
     tag = finalAttrs.version;
-    hash = "sha256-E8f0je4w4sTmf/EX9I8dZ4Ge4bsEvr8E6S5i02n5k+E=";
+    hash = "sha256-eFDj3qv3cYt/7tf+v93QwqoVLEEfpt21g4l0MrLTaLc=";
   };
 
   pythonRelaxDeps = [ "platformdirs" ];
@@ -21,6 +22,8 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   build-system = with python3.pkgs; [ setuptools ];
 
   dependencies = with python3.pkgs; [
+    aiofiles
+    aiohttp
     packaging
     pick
     platformdirs
@@ -31,6 +34,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
   ];
 
   nativeCheckInputs = with python3.pkgs; [
+    pytest-asyncio
     pytest-cov-stub
     pytest-mock
     pytestCheckHook
@@ -38,6 +42,12 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
 
   pythonImportsCheck = [ "fetchtastic" ];
 
+  disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
+    "test_download_firmware_success"
+    "test_get_target_path_for_release"
+    "test_platform_functions"
+  ];
+
   meta = {
     description = "Utility for downloading and managing the latest Meshtastic firmware releases";
     homepage = "https://github.com/jeremiah-k/fetchtastic";
diff --git a/pkgs/by-name/fl/floorp-bin-unwrapped/sources.json b/pkgs/by-name/fl/floorp-bin-unwrapped/sources.json
index 15cfe38a6392..d320fbd08ad2 100644
--- a/pkgs/by-name/fl/floorp-bin-unwrapped/sources.json
+++ b/pkgs/by-name/fl/floorp-bin-unwrapped/sources.json
@@ -1,21 +1,21 @@
 {
-  "version": "12.12.2",
+  "version": "12.13.0",
   "sources": {
     "aarch64-linux": {
-      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.12.2/floorp-linux-aarch64.tar.xz",
-      "sha256": "c9dfdb6abaafb700d3ea8291ecb4b03913db7ee1753c4ae77f595c8653416dc4"
+      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.13.0/floorp-linux-aarch64.tar.xz",
+      "sha256": "bd5b59386fc3957f065bc13813c1b392055f629012c303c6fbc264e29ffe5b09"
     },
     "x86_64-linux": {
-      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.12.2/floorp-linux-x86_64.tar.xz",
-      "sha256": "c2157e29b3b9e41fb125ed0c607fb79da3f07b9dfcb37671b7bdf0bf6d818058"
+      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.13.0/floorp-linux-x86_64.tar.xz",
+      "sha256": "d6a360d900bcd754e8c14cc382aaa7c00147a2e2692c62e924dcff1d64f20638"
     },
     "aarch64-darwin": {
-      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.12.2/floorp-macOS-universal.dmg",
-      "sha256": "9e41880693c58cbbf694684e4c24d6db69581de9caa06b374e9d7bee65997205"
+      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.13.0/floorp-macOS-universal.dmg",
+      "sha256": "0c848d1a65fbabf94e226cdfd9fae4915aa6357e9262608b30140ff221d43ad1"
     },
     "x86_64-darwin": {
-      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.12.2/floorp-macOS-universal.dmg",
-      "sha256": "9e41880693c58cbbf694684e4c24d6db69581de9caa06b374e9d7bee65997205"
+      "url": "https://github.com/Floorp-Projects/Floorp/releases/download/v12.13.0/floorp-macOS-universal.dmg",
+      "sha256": "0c848d1a65fbabf94e226cdfd9fae4915aa6357e9262608b30140ff221d43ad1"
     }
   }
 }
diff --git a/pkgs/by-name/fo/fosrl-gerbil/package.nix b/pkgs/by-name/fo/fosrl-gerbil/package.nix
index ef889f08cf18..6795a2c62b3e 100644
--- a/pkgs/by-name/fo/fosrl-gerbil/package.nix
+++ b/pkgs/by-name/fo/fosrl-gerbil/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gerbil";
-  version = "1.3.1";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "fosrl";
     repo = "gerbil";
     tag = finalAttrs.version;
-    hash = "sha256-liz1v0vMYH9AbGmKHZV7IBYBAT8fkjUsGzNqRXYDmpU=";
+    hash = "sha256-SKpXWlpMkmo5Qwdi/MylqNIBvP4jEHSZfP5BjQD1nVs=";
   };
 
-  vendorHash = "sha256-NtyU/zKysl9h0wqOtwizrOAJK5ODIc8ZvVtbkogBhm8=";
+  vendorHash = "sha256-k5G8mkqrezRYY2lH1kbMMcW8GsUkyDaPglLEAzJIxYo=";
 
   # patch out the /usr/sbin/iptables
   postPatch = ''
diff --git a/pkgs/by-name/ft/ft2-clone/package.nix b/pkgs/by-name/ft/ft2-clone/package.nix
index 8f0f7fe7f004..8edaf3a8c53e 100644
--- a/pkgs/by-name/ft/ft2-clone/package.nix
+++ b/pkgs/by-name/ft/ft2-clone/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ft2-clone";
-  version = "2.17";
+  version = "2.18";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "ft2-clone";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ebyFMZV2LBtEbf7yjO9o9mp3UEoECHAHUQm4lwUS/Ws=";
+    hash = "sha256-K2E6y8pbNmfb0l+qtsVSWSwkQPii+jAzIDYDsYplOBo=";
   };
 
   nativeBuildInputs = [ cmake ];
diff --git a/pkgs/by-name/ga/gamepad-mirror/package.nix b/pkgs/by-name/ga/gamepad-mirror/package.nix
new file mode 100644
index 000000000000..a21f41375c82
--- /dev/null
+++ b/pkgs/by-name/ga/gamepad-mirror/package.nix
@@ -0,0 +1,105 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitea,
+  appstream,
+  cmake,
+  desktop-file-utils,
+  gettext,
+  gjs,
+  glib,
+  gtk4,
+  graphene,
+  gobject-introspection,
+  pango,
+  harfbuzz,
+  gdk-pixbuf,
+  libadwaita,
+  libmanette,
+  libgudev,
+  meson,
+  ninja,
+  pkg-config,
+  wrapGAppsHook4,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gamepad-mirror";
+  version = "0.3-unstable-2025-10-18";
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "vendillah";
+    repo = "GamepadMirror";
+    rev = "aa86d55f21b4d206eab61d0bf7cd9ccafc8aa607";
+    hash = "sha256-ZpBsJRQWRoAwp2G6CzVMtb+j71F0BbJuQ8vUnoZfEgc=";
+  };
+
+  __structuredAttrs = true;
+
+  strictDeps = true;
+  nativeBuildInputs = [
+    meson
+    wrapGAppsHook4
+    pkg-config
+    cmake
+    ninja
+    gettext # msgfmt
+    appstream
+    gjs
+    desktop-file-utils # desktop-file-validate
+  ];
+
+  buildInputs = [
+    gjs
+    glib
+    gtk4
+  ];
+
+  passthru.giTypelibInputs = [
+    glib
+    gtk4
+    graphene
+    gobject-introspection
+    pango
+    harfbuzz
+    gdk-pixbuf
+    libadwaita
+    libmanette
+    libgudev
+  ];
+
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix GI_TYPELIB_PATH : ${
+        lib.makeSearchPathOutput "out" "lib/girepository-1.0" finalAttrs.passthru.giTypelibInputs
+      }
+    )
+  '';
+
+  # tries to look for .foobar-wrapped.{data,src}.gresource, switch to the hardcoded one
+  # TODO: why doesn't --inherit-argv0 work?
+  postFixup = ''
+    mv -v $out/share/gamepad-mirror/{page.codeberg.vendillah.GamepadMirror,gamepad-mirror}.data.gresource
+    mv -v $out/share/gamepad-mirror/{page.codeberg.vendillah.GamepadMirror,gamepad-mirror}.src.gresource
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+    (
+      set -x
+      env -i $out/bin/${finalAttrs.meta.mainProgram} --help
+    )
+    runHook postInstallCheck
+  '';
+
+  meta = {
+    description = "Small Adwaita application to show game pad inputs using libmanette";
+    homepage = "https://codeberg.org/vendillah/GamepadMirror";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ pbsds ];
+    mainProgram = "page.codeberg.vendillah.GamepadMirror";
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/gr/grafana-alloy/package.nix b/pkgs/by-name/gr/grafana-alloy/package.nix
index dde2ea8226ba..2a23cc8f3600 100644
--- a/pkgs/by-name/gr/grafana-alloy/package.nix
+++ b/pkgs/by-name/gr/grafana-alloy/package.nix
@@ -15,23 +15,23 @@
 }:
 
 let
-  beylaVersion = "v3.6.0";
+  beylaVersion = "v3.9.5";
 in
 
 buildGoModule (finalAttrs: {
   pname = "grafana-alloy";
-  version = "1.15.1";
+  version = "1.16.0";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "alloy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dAWBmvrthnsji6WuM2itRdfV4ONKDjsCzUJkUSmb1XI=";
+    hash = "sha256-q5R2noxBZ3OPyZqmB+bx3iJKWFxC2WIprcgh9RwjLzk=";
   };
 
   npmDeps = fetchNpmDeps {
     src = "${finalAttrs.src}/internal/web/ui";
-    hash = "sha256-YUCft67WskKubZu8qEIUoH5NHwSfD5o0tWzyply90Zg=";
+    hash = "sha256-vResNUT4auDsK9ngnJYfMUUOYr/ikPhrvakqCjGq2Q8=";
   };
 
   frontend = buildNpmPackage {
@@ -65,7 +65,7 @@ buildGoModule (finalAttrs: {
   modRoot = "collector";
 
   proxyVendor = true;
-  vendorHash = "sha256-PbaqxDJHXB1MT5KtiEIkl+gP0DolzlC5JRItGC5VCpQ=";
+  vendorHash = "sha256-uTIdurwLfxh27fb1CPCHbHmENk3S6VYNBaGT/5yh3Sc=";
 
   subPackages = [ "." ];
 
@@ -82,6 +82,7 @@ buildGoModule (finalAttrs: {
 
   tags = [
     "embedalloyui"
+    "gore2regex"
     "netgo"
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
diff --git a/pkgs/by-name/hu/hubot-sans/package.nix b/pkgs/by-name/hu/hubot-sans/package.nix
index 8364556015b9..28d9c5eabfc1 100644
--- a/pkgs/by-name/hu/hubot-sans/package.nix
+++ b/pkgs/by-name/hu/hubot-sans/package.nix
@@ -9,6 +9,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "hubot-sans";
   version = "1.0.1";
 
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
   src = fetchzip {
     url = "https://github.com/github/hubot-sans/releases/download/v${finalAttrs.version}/Hubot-Sans.zip";
     hash = "sha256-EWTyoGNqyZcqlF1H1Tdcodc8muHIo8C9gbSPAjiogRk=";
diff --git a/pkgs/by-name/io/ior/package.nix b/pkgs/by-name/io/ior/package.nix
index 78a197edf480..9175f4017add 100644
--- a/pkgs/by-name/io/ior/package.nix
+++ b/pkgs/by-name/io/ior/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   mpi,
   perl,
   autoreconfHook,
@@ -19,6 +20,16 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-WsfJWHHfkiHZ+rPk6ck6mDErTXwt6Dhgm+yqOtw4Fvo=";
   };
 
+  patches = [
+    # Fix gcc-15 build:
+    #   https://github.com/hpc/ior/pull/525
+    (fetchpatch {
+      name = "gcc-15.patch";
+      url = "https://github.com/hpc/ior/commit/526c5ad06695a91a27163c520ce3305109f50bef.patch";
+      hash = "sha256-HvbRMt2EcuO7kxLL9qKpozpNKEOmWuHkKQTSUhfU7/w=";
+    })
+  ];
+
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
diff --git a/pkgs/by-name/ja/jackett/package.nix b/pkgs/by-name/ja/jackett/package.nix
index ee26bb1d1a6b..afd5826b9167 100644
--- a/pkgs/by-name/ja/jackett/package.nix
+++ b/pkgs/by-name/ja/jackett/package.nix
@@ -12,13 +12,13 @@
 
 buildDotnetModule (finalAttrs: {
   pname = "jackett";
-  version = "0.24.1591";
+  version = "0.24.1807";
 
   src = fetchFromGitHub {
     owner = "jackett";
     repo = "jackett";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HMf88nXx8FZBsVKttCziHARwlckTTMia4gK3BpQQ5Do=";
+    hash = "sha256-HkhjHIMZCTzbxaZNb4wFRDAaDJVD9WPS+lNMnM34rEM=";
   };
 
   projectFile = "src/Jackett.Server/Jackett.Server.csproj";
diff --git a/pkgs/by-name/ki/kin-openapi/package.nix b/pkgs/by-name/ki/kin-openapi/package.nix
index 6df72bc15fd1..b930e49fe48e 100644
--- a/pkgs/by-name/ki/kin-openapi/package.nix
+++ b/pkgs/by-name/ki/kin-openapi/package.nix
@@ -5,14 +5,14 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "kin-openapi";
-  version = "0.136.0";
+  version = "0.137.0";
   vendorHash = "sha256-6pvpmETeNAbzzuOlZqTyr6udazEElLW8E+HK6eAL8X4=";
 
   src = fetchFromGitHub {
     owner = "getkin";
     repo = "kin-openapi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-buCxEDo9T4omjB63BC7iJab/8xJndEouorwWAi6v93c=";
+    hash = "sha256-rkaFpzOzh2YMGsaflKBr2+HiKbgCYl5Q9DnXnbXfmmA=";
   };
 
   checkFlags =
diff --git a/pkgs/by-name/ko/korrect/package.nix b/pkgs/by-name/ko/korrect/package.nix
index 6f8926cde753..c668af48d837 100644
--- a/pkgs/by-name/ko/korrect/package.nix
+++ b/pkgs/by-name/ko/korrect/package.nix
@@ -9,13 +9,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "korrect";
-  version = "0.3.7";
+  version = "0.3.8";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-qpjpdP0KeuwF5XhnlkrKcXJ4puHNpt/7SrIFOnFjGNA=";
+    hash = "sha256-iNM8annxL48uDAvrtYw/LhaK2lCirJsmQy/QWbDpczA=";
   };
-  cargoHash = "sha256-1k2I8R5H4UGYf7rc9r2SwMwrA2F7PlECbsCco731beQ=";
+  cargoHash = "sha256-2MsrqsgvYc+XKgWKIVhoA+Opg8e7ybWFxKQ/SuVUfto=";
 
   # Tests create a local http server to check the download functionality
   __darwinAllowLocalNetworking = true;
diff --git a/pkgs/by-name/li/librelane/package.nix b/pkgs/by-name/li/librelane/package.nix
index b69a4611da90..e44d637654c6 100644
--- a/pkgs/by-name/li/librelane/package.nix
+++ b/pkgs/by-name/li/librelane/package.nix
@@ -23,14 +23,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "librelane";
-  version = "3.0.2";
+  version = "3.0.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "librelane";
     repo = "librelane";
     tag = finalAttrs.version;
-    hash = "sha256-JxWuaOBhkjjw4sp7l++QF+0EzGIhPAOaJcKwwmdTg+w=";
+    hash = "sha256-SA0y5ooqfDaoVlXzsHStG3uhBuyu9t9T2ej+49csizw=";
   };
 
   build-system = [
@@ -93,7 +93,12 @@ python3Packages.buildPythonApplication (finalAttrs: {
   '';
 
   passthru = {
-    updateScript = nix-update-script { };
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--version-regex"
+        "^([0-9.]+)$"
+      ];
+    };
   };
 
   meta = {
diff --git a/pkgs/by-name/li/libwebm/package.nix b/pkgs/by-name/li/libwebm/package.nix
index c2660df0aa0e..0ba8f021897d 100644
--- a/pkgs/by-name/li/libwebm/package.nix
+++ b/pkgs/by-name/li/libwebm/package.nix
@@ -4,6 +4,8 @@
   fetchFromGitHub,
   cmake,
   nix-update-script,
+
+  isStatic ? stdenv.hostPlatform.isStatic,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -34,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   cmakeFlags = [
-    "-DBUILD_SHARED_LIBS=ON"
+    (lib.cmakeBool "BUILD_SHARED_LIBS" (!isStatic))
   ];
 
   passthru.updateScript = nix-update-script {
diff --git a/pkgs/by-name/li/linden-hill/package.nix b/pkgs/by-name/li/linden-hill/package.nix
index 658d755dedbd..94024487822a 100644
--- a/pkgs/by-name/li/linden-hill/package.nix
+++ b/pkgs/by-name/li/linden-hill/package.nix
@@ -9,6 +9,11 @@ stdenvNoCC.mkDerivation {
   pname = "linden-hill";
   version = "2011-05-25";
 
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
   src = fetchFromGitHub {
     owner = "theleagueof";
     repo = "linden-hill";
diff --git a/pkgs/by-name/li/literata/package.nix b/pkgs/by-name/li/literata/package.nix
index 456ef1c3d8ae..f79a56da0385 100644
--- a/pkgs/by-name/li/literata/package.nix
+++ b/pkgs/by-name/li/literata/package.nix
@@ -8,6 +8,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "literata";
   version = "3.103";
 
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
   src = fetchzip {
     url = "https://github.com/googlefonts/literata/releases/download/${finalAttrs.version}/${finalAttrs.version}.zip";
     hash = "sha256-XwwvyzwO2uhi1Bay9HtB75j1QfAJR4TMETgy/zyvwZ0=";
diff --git a/pkgs/by-name/lo/lora/package.nix b/pkgs/by-name/lo/lora/package.nix
index 7e1a849c5080..8947b828a6b2 100644
--- a/pkgs/by-name/lo/lora/package.nix
+++ b/pkgs/by-name/lo/lora/package.nix
@@ -10,6 +10,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "lora";
   version = "3.021";
 
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
   src = fetchFromGitHub {
     owner = "cyrealtype";
     repo = "lora";
diff --git a/pkgs/by-name/mo/mona-sans/package.nix b/pkgs/by-name/mo/mona-sans/package.nix
index 98ad86ae9169..d8cd9f825040 100644
--- a/pkgs/by-name/mo/mona-sans/package.nix
+++ b/pkgs/by-name/mo/mona-sans/package.nix
@@ -9,6 +9,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "mona-sans";
   version = "2.0.23";
 
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
   src = fetchFromGitHub {
     rev = finalAttrs.version;
     owner = "github";
diff --git a/pkgs/by-name/mo/moshi/package.nix b/pkgs/by-name/mo/moshi/package.nix
index 90adc5a25dbd..9b4b90df7da5 100644
--- a/pkgs/by-name/mo/moshi/package.nix
+++ b/pkgs/by-name/mo/moshi/package.nix
@@ -12,6 +12,7 @@
 
   # buildInputs
   libopus,
+  oniguruma,
   openssl,
   sentencepiece,
   alsa-lib,
@@ -74,6 +75,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   buildInputs = [
     libopus
+    oniguruma
     openssl
     sentencepiece
   ]
@@ -92,7 +94,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     lib.optionals stdenv.hostPlatform.isDarwin [ "metal" ]
     ++ lib.optionals config.cudaSupport [ "cuda" ];
 
-  env = lib.optionalAttrs config.cudaSupport {
+  env = {
+    # use system oniguruma
+    RUSTONIG_SYSTEM_LIBONIG = true;
+  }
+  // lib.optionalAttrs config.cudaSupport {
     CUDA_COMPUTE_CAP = cudaCapability';
 
     # We already list CUDA dependencies in buildInputs
diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index d7b84a5b06f9..1db120bacb9e 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -16,13 +16,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencode";
-  version = "1.14.33";
+  version = "1.14.31";
 
   src = fetchFromGitHub {
     owner = "anomalyco";
     repo = "opencode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bnAV1ApOYZngG59fxFKrGN0jmBKWKnjktsbKJiEOaSo=";
+    hash = "sha256-VHznPS2OuJ8urQqGK3K0ysQLCk+O8JV7/UCDdFyqafQ=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {
@@ -75,7 +75,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     # NOTE: Required else we get errors that our fixed-output derivation references store paths
     dontFixup = true;
 
-    outputHash = "sha256-dbpqhVcjWr+puZhV0x7pR38iMjjZdbrJydKJ/qJfDeY=";
+    outputHash = "sha256-f/cWCr6Oqnq21u9+UyhwE5PGqE9X5K+NtjEGbZ4ORPg=";
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
   };
diff --git a/pkgs/by-name/ou/outline/missing-hashes.json b/pkgs/by-name/ou/outline/missing-hashes.json
index e0b25e3da342..8e2ff54576aa 100644
--- a/pkgs/by-name/ou/outline/missing-hashes.json
+++ b/pkgs/by-name/ou/outline/missing-hashes.json
@@ -28,26 +28,51 @@
   "@msgpackr-extract/msgpackr-extract-linux-arm@npm:3.0.3": "115f627bcd7c290ddfa1d16405cc1ce388be0b295a26adb1ee2d774133a77809aa0bae83775d3c11f220544e77d34c01d607037bf9dfc6aaac67329cb5fe2818",
   "@msgpackr-extract/msgpackr-extract-linux-x64@npm:3.0.3": "ab74755aa2afd27ad8f5277c7cb7a0c721028ba63c3e3109458689340d76ed4c901aa2c71ae5950f3a2149ae9e835e711a12842db219864107cc0c5c1fbdc0da",
   "@msgpackr-extract/msgpackr-extract-win32-x64@npm:3.0.3": "edfea4f5455f71f608c15163467b98245d46fbd6078019347418e193968431afe632a11e8729ec39755a54563d86940899e2fe8f3d124393f91855956bd1d745",
-  "@oxlint-tsgolint/darwin-arm64@npm:0.1.6": "baef70546bf78b06700eeb7fc94a829d608c241b2980b53f709646255b24c90737b3da023a94c3f594fe9d6efc3f3abd4ca5664d465a9cc639941a287f6bb565",
-  "@oxlint-tsgolint/darwin-arm64@npm:0.8.6": "e10fe702dbbd7d824f1c2f993263ad448c351e34e87401e72994b68294df16c2b9f6cb4c0b77020937f68531b030168d302e811beb95475ec4b4296a3eda89f7",
-  "@oxlint-tsgolint/darwin-x64@npm:0.1.6": "9a10a02d8dd9183d3faf6735189b82e233f3fa5afe101ea62e710416fd47e5c134e9e6e4bc16d5f8a8baa1b15d49af25817ad1df5cfaea6a4819c721f3e30850",
-  "@oxlint-tsgolint/darwin-x64@npm:0.8.6": "9d56880e90b77727d2af88cf3724cb5109d029fff3a180b2d5dac563ac5f551cf0ee8adb3967392318a463aaec59059d499cabb3ee81a5fcd8e9084e974b1663",
-  "@oxlint-tsgolint/linux-arm64@npm:0.1.6": "57db59c580bde2340c0f5c5fd11179fda1627488779b579cecef18d5412ea2d5c26b1dde3f9e819dc3cfbdeaa680b66dfed81be78384f9cc273078539fc4de51",
-  "@oxlint-tsgolint/linux-arm64@npm:0.8.6": "ce9bf5f8656ba6a0b1d5ed9c57fd8401b0a66b21a8230ec6dc89c011ba81c1708c1f2d6a7850ec677617e52d4daa48603a5edd2f48def10aaf6234091817e311",
-  "@oxlint-tsgolint/linux-x64@npm:0.1.6": "fe5cf69f9da0337885891e6d7453c24187d2932f5177ef1e6a6fcd71b795f75ab3ce21d8c4ca15bd8119cd624726d67071195a21a5070c1878251fcd8da9aedc",
-  "@oxlint-tsgolint/linux-x64@npm:0.8.6": "231f59da81c55afaca4805012bfc8a83cf3f049e6bde2e0adbe133ebae6396b95b868a31a6c0c2840a98aa79eb2f7be2cadb7e7b50fdbdd2f8f301ef84d228e3",
-  "@oxlint-tsgolint/win32-arm64@npm:0.1.6": "bcad14cc57a0f063d67896e3e3b29700a8006d3dcb1c209f6ff27c7d711a0dcd7b4a19ccd95e57af453b89eaae4d7840991cffa8f24d12d876c9d50e432da122",
-  "@oxlint-tsgolint/win32-arm64@npm:0.8.6": "3f0b79f370d3cac3a5350d0528eb09c7adec77b077decf97e6bb703f73052e5bc797134b4b7e54309a7aeff203e71e9141e54f6176f7d6a0f7ce15a730dd0d99",
-  "@oxlint-tsgolint/win32-x64@npm:0.1.6": "3d757d4c2ab2815df173184f59d7d362832dc0e083a981c370337d1564e2212d1ff9306cc0d01437ddc17780cc8dfb637ab7de3f3a1897bf844b801c7c62f9b5",
-  "@oxlint-tsgolint/win32-x64@npm:0.8.6": "d383722598d5b70d0ce0a15200c032d2a7fff11db931240efe2230dbe76f62da4d75def233eec3d4bb2ee9628b0add844b697ab0a802a30375ae2a22bbe07516",
-  "@oxlint/darwin-arm64@npm:1.11.2": "9ed5adb21c132a41540c88dd1038934f9d830138fb14c118e875b2c41a9b19c0af30517924869d946c0f60e3d93d28b3329038c55142151433dc73a455c2a7c8",
-  "@oxlint/darwin-x64@npm:1.11.2": "17bace87db090deab84ba39ea73b1b51eb5248c0397ac6cace0c8e4daaf2ab52beebf900ecf6ba748508ea18ed003d5a0b58aba44a6ee6c65455826730812f82",
-  "@oxlint/linux-arm64-gnu@npm:1.11.2": "d271c27904c7765daad00f09a4b5350ef6ffa2edf5b07c7adecbf039e9f90dc2f3eafa9bc7e6c58458176d46345eec0aa41144aa92ac4fc7b0fe45e0763ee389",
-  "@oxlint/linux-arm64-musl@npm:1.11.2": "495d1cd094528925a72137e5480d09be3620e6e9f822a069a181ec30b96fc19f34613ab71fafbe92a8344b4c50acc6131439b8d97e3e084e4829241c81a5e883",
-  "@oxlint/linux-x64-gnu@npm:1.11.2": "f836220fa4cf46ac24c414088832a6fd389150a4e7a4390133d228487df48bd172a68e575d5da15c0171ac02db7f1ded0ec145944ca0012fc15c6fa3c003b6ae",
-  "@oxlint/linux-x64-musl@npm:1.11.2": "edef64a92e0fe0ff67f6dfc406430a36ed0d7ca2cc2c9dcac1fba5b129c0ea875920fbe8c3ef667fe8d899898a318a65442338fdf4d9ea861e8b98faa9d9af28",
-  "@oxlint/win32-arm64@npm:1.11.2": "ed08d845112afa85ed3eada6a3acc63d74f50670f3dd4547499ad2e375dc7212a103d4a6a83141257a3d48739604f419797cec039f689e47c18f0584a2acc24e",
-  "@oxlint/win32-x64@npm:1.11.2": "6ca1f364346f7ff8238ac0f874d1311d1a70bfd7f5094699600f875e03d783351f8ded0f2c451a59fcece8080c5370877fca6af037078ae8e8bf824bbef36529",
+  "@oxc-parser/binding-android-arm-eabi@npm:0.121.0": "bca1043494dacc0b7b5de15ae18605faaf7bcc35bdebb3d7de3b6ca092b7b0813148a487e80910541f3f6dc8c95e833beff653b6cff2503f45f78982711fd69c",
+  "@oxc-parser/binding-android-arm64@npm:0.121.0": "ceceedd4695fed202d87c9b2b09107ac1fac6b64ac6f7299e78827920ce915ae6684434c730d95d07cd05d998a862477f6d21d2f3ee5a68e80b4000a890a6e1c",
+  "@oxc-parser/binding-darwin-arm64@npm:0.121.0": "6bc756fe6874ea0c9f2e4a717b32f3297a3368330ea9a41774a0ebd4b9ad95e021d393d556fd1f7f8dac9c3093c373f4a495dc3249e4de4e5ef05f788cd4c304",
+  "@oxc-parser/binding-darwin-x64@npm:0.121.0": "7733902e1cab1a17b79c52dc1d934900438343e3eed0357fbd088f39a52ab6ddf25d31b3214134ba0e0e0e486ff1735da0bbc5142cc91d1aca69d073dc43c290",
+  "@oxc-parser/binding-freebsd-x64@npm:0.121.0": "019c17c3a5bd4d419a5e378d3c401735e9f9c5f0d34b3f31f3c18cf37b7a5004e15c39326b47b8e5bd74bf74355709d524747f3b16252898759f20c2d0d2ceba",
+  "@oxc-parser/binding-linux-arm-gnueabihf@npm:0.121.0": "5562174d8fa0a5665934bcd8d65f5895b9d03a79e502ed823bb47b14edd57c6f997da22cfbf7caa122a02a3c527b09947ad06d39ad1f3b9f30a23f4edae3432b",
+  "@oxc-parser/binding-linux-arm-musleabihf@npm:0.121.0": "1ca1d1ba6897cd67c33561199805dfe8cf709eac9ccfa9fd7a9127daf6b57157a1141c88c5c5c822800b57d2abc8bc9344408fc5d6890c1e6d78d820aa011e81",
+  "@oxc-parser/binding-linux-arm64-gnu@npm:0.121.0": "5aea47f9b977d5004ce697a0b13b519183198cc63c074a4ec932e61398851639bcaa3b44a98226e8b644c89114654b70a70356c199badfa0491c04c4460ac925",
+  "@oxc-parser/binding-linux-arm64-musl@npm:0.121.0": "4212fdfb73d16be3c60feaf2548060e85f17b807933bb81426578fd0bc5a89ac1e7b77b594b5c9a3b60daf0ee3ad9594a61554f3f9aac35e219cec7cece07f2e",
+  "@oxc-parser/binding-linux-ppc64-gnu@npm:0.121.0": "6c4ad09387ee66b0ead91f5632bcecd78297d4be50f3e17e2b16f460c877552d1943c8fd6648e3ac1d9806870c91c2bffd088fa9b368119b8d4b1dc2cbc08d95",
+  "@oxc-parser/binding-linux-riscv64-gnu@npm:0.121.0": "d41cdce188365392bd52852a3309d92daa203f240da0e5e7217aa9805fcb0db5ac8a10a26ab48570e16af9daa46622b19a89410e8cbec1d064c931f785225d22",
+  "@oxc-parser/binding-linux-riscv64-musl@npm:0.121.0": "6ae9ade15ea6ff648569d2f83e857c92873e90eb5649f62e0cf000213873b549a2dd4bb4547358f20776aa2f912fd9495721bcce429ad4c02742fffae2d92d47",
+  "@oxc-parser/binding-linux-s390x-gnu@npm:0.121.0": "14ba521e885676eb8e05cb6173d5071505e9a3798f9cb19f45fb3383eefb6def2c0e7cccea43a62eab8d73e22bb3f66143d82355e0e5ef3b8a388e4301b4d9a4",
+  "@oxc-parser/binding-linux-x64-gnu@npm:0.121.0": "0e56d93be40652b0916aa6505de2978b17949665dc4d98e2420d667f6aa8c26437b0137c909124d6adfbfc1e2ff0eb3f31cf93c7ec6e5580dd3b88cfdcb75367",
+  "@oxc-parser/binding-linux-x64-musl@npm:0.121.0": "b1c30cded47edc8ce76dc5c80e5dc70c3bbdbc09505a0f70a4f16b6f55fad7eb3e67b381556d92b883272cbf530dfb8b69cafee06e380a5a47c0debd378b1494",
+  "@oxc-parser/binding-openharmony-arm64@npm:0.121.0": "b4cc609840cc2bd914ab142ebf2404d24452a54d6673469289c100bf1af40dbd1cdfebba1b8c7804a7b285a8f2293ab748da6ebc059ab2043216af069e9ecd2f",
+  "@oxc-parser/binding-wasm32-wasi@npm:0.121.0": "20d260df5bda2e225d7253049890d99ac2a3ce8ad5df8d0f6cec9f23cda9dfd2ddbfc87457fde3e8613109868d4f885beee9df6fcb8f267adb08ed2ab5303bc0",
+  "@oxc-parser/binding-win32-arm64-msvc@npm:0.121.0": "ffb3ae5443b87baa932316bc4bf2fe92d3d67299ec16e06270047fdb6d8c5d33b19f76e486ad6dc5f7cdc3e038bde8c8cdcc3e316007f1bfdac393136f372170",
+  "@oxc-parser/binding-win32-ia32-msvc@npm:0.121.0": "768d242e04f4809101d00a383d05e47a8e90852b65f342861266910e0912eee814e6f5b2b92fa82d7712c15424f63c6a877005c2375083aa5734d7a55d83ab8b",
+  "@oxc-parser/binding-win32-x64-msvc@npm:0.121.0": "03daa39843f83f963eae2a1151029887e9c5449cf3da8dd32588c45045be53ce1d8f1b0699abfff05fc1a49911b4eafbdac1b76696ad23dd3f67bfe685acc8f9",
+  "@oxlint-tsgolint/darwin-arm64@npm:0.14.2": "8f09dcdbc6c7462cb50e3cc4817829d5ff80fc90fa249ddd0811eaf72c20cc190238ec5c3ed172a09e74ee6a7dfb078bd6b4fba7d594dfac53006dd22cc8b84b",
+  "@oxlint-tsgolint/darwin-x64@npm:0.14.2": "f8892878f7cf6a77efb945b8be6cf5adf17c1bd244a51f919c36faeed3dd250548ae18faca202de8e4fadd47af345242e78bbbd388ff1610573b6efa8a1177d6",
+  "@oxlint-tsgolint/linux-arm64@npm:0.14.2": "d2d0678fdcf6ff623d868a114f25e1300f44ee3f7e0d4d1b42d6a3eab3824249dd50f31d9e894880cb3af03f29ea860bdee85d16de27b06b2fca2e5081665860",
+  "@oxlint-tsgolint/linux-x64@npm:0.14.2": "2965b0f6db9ed4e1990e6fae481ec625dfe6aab140908628efd22ec5da422c4b97c672d7f4ab5849a0fd735f385d9055377a3804e527f544227438ee48af6dae",
+  "@oxlint-tsgolint/win32-arm64@npm:0.14.2": "7d70ee261f4d0ad6f6ac40adcb4773fa9411bd243b8296a54d67dfbfa875e7599ddbdcda5d415e1f12e68bd629828bd6d2f3aa9fb389b881bccf37e785fdacd9",
+  "@oxlint-tsgolint/win32-x64@npm:0.14.2": "eda55fbcabc80d4e7da808432f53860d54efa338e6f28afea0ad8b305f21d6690808874ee7b839137c10a4968199f1e72dd156697dbc5e514e0c712aa3e59d5e",
+  "@oxlint/binding-android-arm-eabi@npm:1.50.0": "795d4559ecc64cef89a08a9b8c1be862e3184dabfa2409ffd9ae2e260382579e5d66f9f1c78fb5611692615f8ea1ec5d2ea640ee6f96c412a767b0d1268d537b",
+  "@oxlint/binding-android-arm64@npm:1.50.0": "2245d8d9d237ba63cf2df99f4b475598d9c1ce9a36fdc48dfb7cb363e72f23e4bf5afdf07142e4aeeff17c839bdd2a0c10187e268d1ed95ae20a139c6892392c",
+  "@oxlint/binding-darwin-arm64@npm:1.50.0": "2c2d38ed27b6422adfff66cd0b78d55d483e21746cea2eac4cd49d9ad69995142942c9670d2d62118ea005e63343e8e7915a1eaf3f30861c25724512373debf9",
+  "@oxlint/binding-darwin-x64@npm:1.50.0": "25b092e7b5d43230bd7bb853996dc173926dcf911874f878d9ee9e1410c029967e540409d6d23a38b2e3a2d51c6f98014089334227ab42b6d0c19a8673cb5470",
+  "@oxlint/binding-freebsd-x64@npm:1.50.0": "5c11b12d7bd286386ff94a9f7b179e989d895485bee92e3002b8b548d1db126e5d0c980e07dd89d3c134fe26c72c787c1680e15b270ffdedeefbb302393ba2ce",
+  "@oxlint/binding-linux-arm-gnueabihf@npm:1.50.0": "7589a1460a6b9ddf1764aedc30862cb5f52f10e688d96d482715924988b21ffea5e037f7a3b4467e5301ab11acb05ba4ca11efacaf2c013f2b7c9462bb58d3a3",
+  "@oxlint/binding-linux-arm-musleabihf@npm:1.50.0": "1e4de85dc7af5457f9ff974b70628e52ba4ee34027bf1791c65debd9643332ecc7a364317f02b1736cbd7490b8aeb59528fea0fa1296c53bc05e290e7fc7d967",
+  "@oxlint/binding-linux-arm64-gnu@npm:1.50.0": "2eed83af8530789dc5e83c14b5eb09269dceafc35c2ae534e01ac9346c5f4eb9f2af8c16581bcdb7c0b11a72edcfe4dd46077b50f401b0e6849c696fb6cc5a5c",
+  "@oxlint/binding-linux-arm64-musl@npm:1.50.0": "167a3efaba4c0c1ea17f1252523dc358c58a4553836e5bbc3ef505731e0163b56b171de924251b24acbf1d969995b774cac8720d052aa73197309735e303b1b9",
+  "@oxlint/binding-linux-ppc64-gnu@npm:1.50.0": "be8c0d2dbc61b3317a3fb637a786c0362a08a858cda06bd9385c7ab6512200b197968bdb825ff89a89ebc959a3948dba5051803c9ef85e662986fc865fcc2651",
+  "@oxlint/binding-linux-riscv64-gnu@npm:1.50.0": "bcd24461731e6a27cedde9fb41928530bf0389d1dc2f0df0d5323a21edeac08a1d2fe56fcd504012e274985441b18e62844ac6598c39c880b87af922b9f136ee",
+  "@oxlint/binding-linux-riscv64-musl@npm:1.50.0": "0b3ce0f73074b20830b0ee24471cd3ece7b05397e9615106bf00ed76f241d1c13e60e5544db5c08214690682cf6d7553c76926900e62de03d08ccfc47f0fa9d8",
+  "@oxlint/binding-linux-s390x-gnu@npm:1.50.0": "76fbc961912cd53e43565f088ba93ca389fe397d6bd1940a86e3c4ea28e39f4cd0717d1c0c9914d60c87b9b2e46ab27818fb400deb201309377742fcb7053e59",
+  "@oxlint/binding-linux-x64-gnu@npm:1.50.0": "af5f3b80c507b44f8980629ff1ed7985a3a5332afb524b1a5027ff760545be3fecd13ecea1e872effdb2a74b71f359936b692c6942a9ca0e50719513335f5600",
+  "@oxlint/binding-linux-x64-musl@npm:1.50.0": "c7ac34b5db86508cbbb734f7184a31a160383d093225b67641e88c6cf58ab6bcbaffc9d71f011ec1924de4f2880d9a0a2bc5391fa36c7580192e01f6cdef3a60",
+  "@oxlint/binding-openharmony-arm64@npm:1.50.0": "0a1004953c4b12332582bc216ad22794c02f9116e077d5936d953d06503db10869affb7e4c21e534a7f84f357f0a4c56d3c9d596c1847c1665859785e631fe6c",
+  "@oxlint/binding-win32-arm64-msvc@npm:1.50.0": "f1754ae392a03e80fa8370c2e3080abc849c12d74e5236a390ae145b52902f04968d4a0fe7f8a12dbf1d70c3f0474e6e4aceb20778da2e3484a6fbfcdc9d48be",
+  "@oxlint/binding-win32-ia32-msvc@npm:1.50.0": "13095a42e6a3dd7f9d13b2b34c45c40691b49d79b65ca767d6fe7aed961de559c4b6ecc286d8434559ce25233cb7f99f70a4d5cc46272087e60d521457b030fe",
+  "@oxlint/binding-win32-x64-msvc@npm:1.50.0": "42e69ba506fe9655506e37d2012dfced819faac90a4af0234dfcf52af4513c1f09ad3ed8f243425dcf568c611247b6c055785d6341fef2fd0c4a1ccf712e2cee",
   "@rolldown/binding-android-arm64@npm:1.0.0-beta.53": "e2972fe9399066bb418f659c24e7589e87d8373a3b4ec7dd01c06f516c90cd04ea2dc801f2739f05e714f002bd4ef8d505dabbb9ab55437ed3d5f8395db91df5",
   "@rolldown/binding-darwin-arm64@npm:1.0.0-beta.53": "79587c0686dc0ee54368e4eeb0b8e8cc6f5786c3d55c3b0acd2ccea067b6ba21faffe82140268e7de7126192c3e54fa33742346d82ceaebf5d4c33a94c3575fc",
   "@rolldown/binding-darwin-x64@npm:1.0.0-beta.53": "4b855c7208400453f29aac138c8c050fee3e3f08ff7d36afb3efd705abfc67b11e55bb12ead5d845ae9c464b9855c02380772592ed09e43434ade8dd4e32f703",
diff --git a/pkgs/by-name/ou/outline/package.nix b/pkgs/by-name/ou/outline/package.nix
index ec6bc3802090..592ec0065733 100644
--- a/pkgs/by-name/ou/outline/package.nix
+++ b/pkgs/by-name/ou/outline/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "outline";
-  version = "1.7.0";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "outline";
     repo = "outline";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-QFzLHWmU2DrmKAR5ZKAtnHXZdBfgUfGpTJ6c1zi7//k=";
+    hash = "sha256-LHU3OQglvxLVemDKoDxeI7cGyuSnIUYoPV3aj/LR9XA=";
   };
 
   missingHashes = ./missing-hashes.json;
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   offlineCache = yarn-berry_4.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes;
-    hash = "sha256-07/cWCIAsT+zZR6BKEirGfRFw3UaImMMJPSYvmN4g7E=";
+    hash = "sha256-j1MGkIJGjXsoT9aOADRtdywRNI2k5hKeD3O20iUh0sA=";
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/pa/padthv1/package.nix b/pkgs/by-name/pa/padthv1/package.nix
index 587a0e455d88..d5dddbacf7cd 100644
--- a/pkgs/by-name/pa/padthv1/package.nix
+++ b/pkgs/by-name/pa/padthv1/package.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "padthv1";
-  version = "1.4.1";
+  version = "1.4.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/padthv1/padthv1-${finalAttrs.version}.tar.gz";
-    hash = "sha256-Vn1VgzpWgeHxhE+BiVeXrHdkMq5BXMcnS1dG3b33noY=";
+    hash = "sha256-Cuq1I18Nc6VCOgwnYzCj13lKjHGzQadWvJCGY4cJQWI=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pa/palemoon-bin/package.nix b/pkgs/by-name/pa/palemoon-bin/package.nix
index 799e16b1c5b2..a64a54e92602 100644
--- a/pkgs/by-name/pa/palemoon-bin/package.nix
+++ b/pkgs/by-name/pa/palemoon-bin/package.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "palemoon-bin";
-  version = "34.2.0";
+  version = "34.2.2";
 
   src = finalAttrs.passthru.sources."gtk${if withGTK3 then "3" else "2"}";
 
@@ -173,11 +173,11 @@ stdenv.mkDerivation (finalAttrs: {
       {
         gtk3 = fetchzip {
           urls = urlRegionVariants "gtk3";
-          hash = "sha256-FZSPpU1L2vIJ4nn7IFBJZTxz/grjBosKgA0IivnqWxU=";
+          hash = "sha256-KUlok5T+gf1qgRdivCx2uLijyO0bfurLHfrIgELK//A=";
         };
         gtk2 = fetchzip {
           urls = urlRegionVariants "gtk2";
-          hash = "sha256-ESdPzyEinGv1LKO/6TF8s7IumxhOwUrgdnl4JnA8/PY=";
+          hash = "sha256-iSQDrlLkTxHNFFZC5X/OKMem2Zk213it1Ki7ADw+Opg=";
         };
       };
 
diff --git a/pkgs/by-name/pa/parallel-launcher/package.nix b/pkgs/by-name/pa/parallel-launcher/package.nix
index c573e2906ee6..fb6487531852 100644
--- a/pkgs/by-name/pa/parallel-launcher/package.nix
+++ b/pkgs/by-name/pa/parallel-launcher/package.nix
@@ -55,13 +55,13 @@ stdenv.mkDerivation (
   in
   {
     pname = "parallel-launcher";
-    version = "9.0.2"; # Check ./parallel-n64-next.nix for updates when updating, too
+    version = "9.0.4"; # Check ./parallel-n64-next.nix for updates when updating, too
 
     src = fetchFromGitLab {
       owner = "parallel-launcher";
       repo = "parallel-launcher";
       tag = reformatVersion finalAttrs.version;
-      hash = "sha256-JrZy60xWgrUlFcyGNVBUfHg/diM5TG5mIbbOXpee/2U=";
+      hash = "sha256-j+fblgE891Ji+aCl3CcX0QjAAKdGiSivOVWa+KDrDoY=";
     };
 
     patches =
diff --git a/pkgs/by-name/ph/phpunit/package.nix b/pkgs/by-name/ph/phpunit/package.nix
index 2e0c2e99c83c..9c6f0bbd2726 100644
--- a/pkgs/by-name/ph/phpunit/package.nix
+++ b/pkgs/by-name/ph/phpunit/package.nix
@@ -8,16 +8,16 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "phpunit";
-  version = "13.1.7";
+  version = "13.1.8";
 
   src = fetchFromGitHub {
     owner = "sebastianbergmann";
     repo = "phpunit";
     tag = finalAttrs.version;
-    hash = "sha256-MIHBxs4mRZp74fxEB0pMN/c/wIM3hFD6s1X2Tg2OalY=";
+    hash = "sha256-+PQ/Xt0Y84QCbgparutNAKShHk+5eQspkZn9khpzfwY=";
   };
 
-  vendorHash = "sha256-nHO+wjK+AXvxHLp0CNHzpa3By8J5pn+HoZQ5UUHGwYk=";
+  vendorHash = "sha256-9s2D3qMs1w+vLlOdge2noQc8rVj75Ya/WU1GEwRSG5w=";
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/by-name/pi/picard/package.nix b/pkgs/by-name/pi/picard/package.nix
index 625ede2d9228..db9009ebaedf 100644
--- a/pkgs/by-name/pi/picard/package.nix
+++ b/pkgs/by-name/pi/picard/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   python312Packages,
   fetchFromGitHub,
 
@@ -9,6 +10,8 @@
 
   enablePlayback ? true,
   gst_all_1,
+
+  writableTmpDirAsHomeHook,
 }:
 
 let
@@ -19,7 +22,9 @@ pythonPackages.buildPythonApplication (finalAttrs: {
   pname = "picard";
   # nix-update --commit picard --version-regex 'release-(.*)'
   version = "2.13.3";
-  format = "setuptools";
+  pyproject = true;
+  strictDeps = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "metabrainz";
@@ -31,34 +36,60 @@ pythonPackages.buildPythonApplication (finalAttrs: {
   nativeBuildInputs = [
     gettext
     qt5.wrapQtAppsHook
-    pythonPackages.pytestCheckHook
-  ]
-  ++ lib.optionals (pyqt5.multimediaEnabled) [
-    gst_all_1.gst-libav
-    gst_all_1.gst-plugins-base
-    gst_all_1.gst-plugins-good
-    gst_all_1.gst-vaapi
-    gst_all_1.gstreamer
+    pythonPackages.setuptools
   ];
 
   buildInputs = [
     qt5.qtbase
+  ]
+  ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform qt5.qtwayland) [
     qt5.qtwayland
   ]
-  ++ lib.optionals (pyqt5.multimediaEnabled) [
-    qt5.qtmultimedia.bin
+  ++ lib.optionals (pyqt5.multimediaEnabled) (
+    [
+      qt5.qtmultimedia.bin
+      gst_all_1.gst-libav
+      gst_all_1.gst-plugins-base
+      gst_all_1.gst-plugins-good
+    ]
+    ++ lib.optionals (lib.meta.availableOn stdenv.hostPlatform gst_all_1.gst-vaapi) [
+      gst_all_1.gst-vaapi
+    ]
+  );
+
+  pythonRelaxDeps = lib.optionals stdenv.hostPlatform.isDarwin [
+    # Should be resolved in the next version
+    "pyobjc-core"
+    "pyobjc-framework-Cocoa"
   ];
 
-  propagatedBuildInputs = with pythonPackages; [
-    chromaprint
-    discid
-    fasteners
-    markdown
-    mutagen
-    pyjwt
-    pyqt5
-    python-dateutil
-    pyyaml
+  propagatedBuildInputs =
+    with pythonPackages;
+    [
+      charset-normalizer
+      chromaprint
+      discid
+      fasteners
+      markdown
+      mutagen
+      pyjwt
+      pyqt5
+      python-dateutil
+      pyyaml
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      pyobjc-core
+      pyobjc-framework-Cocoa
+    ];
+
+  # Not reporting any of these issues because the next upstream version will
+  # include many breaking changes and this might not be relevant.
+  disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
+    "test/test_const_appdirs.py::AppPathsTest::test_cache_folder_macos" # - AssertionError: '/nix/var/nix/builds/nix-54642-966088698/.h[33 chars]card' ...
+    "test/test_const_appdirs.py::AppPathsTest::test_config_folder_macos" # - AssertionError: '/nix/var/nix/builds/nix-54642-966088698/.h[38 chars]card' ...
+    "test/test_const_appdirs.py::AppPathsTest::test_plugin_folder_macos" # - AssertionError: '/nix/var/nix/builds/nix-54642-966088698/.h[46 chars]gins' ...
+    "test/test_plugins.py" # Various PermissionError for /var/empty/Library - hopefully will be resolved in the next release.
+    "test/test_utils.py::HiddenFileTest::test_macos" # - FileNotFoundError: [Errno 2] No such file or directory: 'SetFile'
   ];
 
   setupPyGlobalFlags = [
@@ -67,9 +98,10 @@ pythonPackages.buildPythonApplication (finalAttrs: {
     "--localedir=${placeholder "out"}/share/locale"
   ];
 
-  preCheck = ''
-    export HOME=$(mktemp -d)
-  '';
+  nativeCheckInputs = [
+    pythonPackages.pytestCheckHook
+    writableTmpDirAsHomeHook
+  ];
   doCheck = true;
 
   # In order to spare double wrapping, we use:
diff --git a/pkgs/by-name/pr/prek/package.nix b/pkgs/by-name/pr/prek/package.nix
index a9343a1cb203..32b40a198cfd 100644
--- a/pkgs/by-name/pr/prek/package.nix
+++ b/pkgs/by-name/pr/prek/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "prek";
-  version = "0.3.10";
+  version = "0.3.11";
 
   src = fetchFromGitHub {
     owner = "j178";
     repo = "prek";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-boyeL8JIEahDh7veCb/h0YZj7IwVrraXjQZul459sMM=";
+    hash = "sha256-Vd4XmO+Z0Zs5kE/PMesnr6q+JUz+DGXWKVoHsPZPKwM=";
   };
 
-  cargoHash = "sha256-hmaZP6tZpBH1MsgO/WIt75/98E4cHfdpLTfhEgP8Rvw=";
+  cargoHash = "sha256-AggCANaSMeKftOlan8TpgLgpYgaLCpYBBbBOeLKCCVo=";
 
   nativeBuildInputs = [
     installShellFiles
diff --git a/pkgs/by-name/py/pyrra/package.nix b/pkgs/by-name/py/pyrra/package.nix
index 728929cf9963..ddc2279cfbef 100644
--- a/pkgs/by-name/py/pyrra/package.nix
+++ b/pkgs/by-name/py/pyrra/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "pyrra";
-  version = "0.9.5";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "pyrra-dev";
     repo = "pyrra";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Xy+obHLxu8qQSKtZXSIO/JP8C7w548WeTYa2f1W99kw=";
+    hash = "sha256-2tRl5pQ2fo9FGoSHqTK0P7o3t9GU/ygKXTkVw+ijPz4=";
   };
 
-  vendorHash = "sha256-E2/OrAC2Wkv7OYPjs9ROE1RL4UUXYTByJZRY1qZB3gE=";
+  vendorHash = "sha256-SHv7M6BMwgVVMtCADoqzfAnamAInPIjOC/kylULzX7M=";
 
   ui = buildNpmPackage {
     inherit (finalAttrs) version;
@@ -25,7 +25,7 @@ buildGoModule (finalAttrs: {
     pname = "${finalAttrs.pname}-ui";
     src = "${finalAttrs.src}/ui";
 
-    npmDepsHash = "sha256-gbVKnz1F1qfyD0/FAYn0YkIkejv3bvoxyzRsZhqw7Ws=";
+    npmDepsHash = "sha256-jQez9MWqt+NK4Ot6/sA3ROlPe6Jq6Z63DXXzRP+ymxs=";
 
     installPhase = ''
       runHook preInstall
diff --git a/pkgs/by-name/ql/qlever-control/package.nix b/pkgs/by-name/ql/qlever-control/package.nix
index 8477626654ac..ed6aeef694e1 100644
--- a/pkgs/by-name/ql/qlever-control/package.nix
+++ b/pkgs/by-name/ql/qlever-control/package.nix
@@ -5,14 +5,14 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "qlever-control";
-  version = "0.5.46";
+  version = "0.5.47";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "qlever-dev";
     repo = "qlever-control";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vXSVrNfz4gRBCrTi0D+sXtfsAZwv7HO67zs7wh98cOY=";
+    hash = "sha256-sNTI8H7dzK4rDhLzRrf3nWSkn3Z5xHG1rU77+59CwHY=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/by-name/ra/radioboat/package.nix b/pkgs/by-name/ra/radioboat/package.nix
index 69b42d18d40b..1d971fac0254 100644
--- a/pkgs/by-name/ra/radioboat/package.nix
+++ b/pkgs/by-name/ra/radioboat/package.nix
@@ -12,23 +12,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "radioboat";
-  version = "0.6.0";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "slashformotion";
     repo = "radioboat";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1fTXXT0HxGOoy+oNK1ixzgFgjapreQEOoVlQlJwqbrA=";
+    hash = "sha256-mjmrUWnc2oBuUiKnyKGULILI9mp5JZjXSwkp1WgqcHA=";
   };
 
-  postPatch = ''
-    substituteInPlace Cargo.toml \
-      --replace-fail 'version = "0.4.0"' 'version = "${finalAttrs.version}"'
-  '';
-
   __structuredAttrs = true;
 
-  cargoHash = "sha256-ibDOUgprr5VziIvTpvDFISGVpVH5ZyQ1ZZ5tIQirPP8=";
+  cargoHash = "sha256-YvifggF8XZTzFBUs6u5IzdtPsxehjSNlwIT3Gb6wjW4=";
 
   nativeBuildInputs = [
     makeWrapper
@@ -59,6 +54,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ zendo ];
     mainProgram = "radioboat";
-    platforms = lib.platforms.linux;
+    platforms = with lib.platforms; linux ++ darwin;
   };
 })
diff --git a/pkgs/by-name/re/renode-dts2repl/package.nix b/pkgs/by-name/re/renode-dts2repl/package.nix
index 8053ab37ace1..965e88e98b92 100644
--- a/pkgs/by-name/re/renode-dts2repl/package.nix
+++ b/pkgs/by-name/re/renode-dts2repl/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication {
   pname = "renode-dts2repl";
-  version = "0-unstable-2026-04-15";
+  version = "0-unstable-2026-04-30";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "antmicro";
     repo = "dts2repl";
-    rev = "92936115afd0a696399cc9b2b79145ac03d4a92c";
-    hash = "sha256-YTdkEKm4C0bgAGnNOcnAxWaGFpOx43Jx8jTBe2YToto=";
+    rev = "6a1339b59a0ba5823c812f96d8fcc44c7691660f";
+    hash = "sha256-bMPdMJbxzk+/DYgU4lminLjuWEB5nhvxFU9FlO3UcqE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/re/repath-studio/hardcode-git-paths.patch b/pkgs/by-name/re/repath-studio/hardcode-git-paths.patch
index f4cdff945c95..9e486ed36f2b 100644
--- a/pkgs/by-name/re/repath-studio/hardcode-git-paths.patch
+++ b/pkgs/by-name/re/repath-studio/hardcode-git-paths.patch
@@ -1,5 +1,5 @@
 diff --git a/deps.edn b/deps.edn
-index f33f54f..5e448d3 100644
+index 158801e..9456964 100644
 --- a/deps.edn
 +++ b/deps.edn
 @@ -1,8 +1,7 @@
diff --git a/pkgs/by-name/re/repath-studio/package.nix b/pkgs/by-name/re/repath-studio/package.nix
index a9e19ab77b1d..f4560fed21e6 100644
--- a/pkgs/by-name/re/repath-studio/package.nix
+++ b/pkgs/by-name/re/repath-studio/package.nix
@@ -22,13 +22,13 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "repath-studio";
-  version = "0.4.13";
+  version = "0.4.14";
 
   src = fetchFromGitHub {
     owner = "repath-studio";
     repo = "repath-studio";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YqBbhx5WDAElfNpPpSf1qXddK3kZhqGnHhXu/qVl1BA=";
+    hash = "sha256-El3gXpfNofHev84tpa0v16y2Sjdo6kmlm44hgHcinCk=";
   };
 
   patches = [
@@ -47,7 +47,7 @@ buildNpmPackage (finalAttrs: {
 
   makeCacheWritable = true;
 
-  npmDepsHash = "sha256-uTcHerTZwzeTFhjNs5ExgJU6u2fjDT5YlZemo3qNQOg=";
+  npmDepsHash = "sha256-gOk/hHWGLwAxPIBqasoUzfszPv911afb/VLn7w7g5KE=";
 
   nativeBuildInputs = [
     finalAttrs.passthru.clojureWithCache
@@ -181,7 +181,7 @@ buildNpmPackage (finalAttrs: {
 
       dontFixup = true;
 
-      outputHash = "sha256-rh9dcgk4qZkBDguUGFCE6ZcPnqBG/v4jlT8py1PUHYM=";
+      outputHash = "sha256-fwKeKfOIAWj9HQdXpEafZuJz5jwXNKpkS0JmuP3FXo0=";
       outputHashMode = "recursive";
       outputHashAlgo = "sha256";
     };
diff --git a/pkgs/by-name/re/repath-studio/pin-clojure.patch b/pkgs/by-name/re/repath-studio/pin-clojure.patch
index 9bda0cc4326b..a49fccbf0bf9 100644
--- a/pkgs/by-name/re/repath-studio/pin-clojure.patch
+++ b/pkgs/by-name/re/repath-studio/pin-clojure.patch
@@ -1,5 +1,5 @@
 diff --git a/deps.edn b/deps.edn
-index f33f54f..66fbfc4 100644
+index 158801e..91ea375 100644
 --- a/deps.edn
 +++ b/deps.edn
 @@ -1,5 +1,6 @@
diff --git a/pkgs/by-name/ro/route159/package.nix b/pkgs/by-name/ro/route159/package.nix
index d9cfe49a31cc..3e4f7b38b5ff 100644
--- a/pkgs/by-name/ro/route159/package.nix
+++ b/pkgs/by-name/ro/route159/package.nix
@@ -13,6 +13,11 @@ stdenvNoCC.mkDerivation {
   pname = "route159";
   version = "${majorVersion}.${minorVersion}";
 
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
   src = fetchzip {
     url = "https://dotcolon.net/files/fonts/route159_${majorVersion}${minorVersion}.zip";
     hash = "sha256-1InyBW1LGbp/IU/ql9mvT14W3MTxJdWThFwRH6VHpTU=";
diff --git a/pkgs/by-name/sd/sd-switch/package.nix b/pkgs/by-name/sd/sd-switch/package.nix
index 85ae7e1c0e35..488775b3ad23 100644
--- a/pkgs/by-name/sd/sd-switch/package.nix
+++ b/pkgs/by-name/sd/sd-switch/package.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "0.6.2";
+  version = "0.6.3";
 in
 rustPlatform.buildRustPackage {
   pname = "sd-switch";
@@ -16,10 +16,10 @@ rustPlatform.buildRustPackage {
     owner = "~rycee";
     repo = "sd-switch";
     rev = version;
-    hash = "sha256-3+FGARca3xcCYKEAxtrhnSnpOP2JZurOPzKvNhAYjkg=";
+    hash = "sha256-0cK5Gt/+M7IfPPthmx6Z11FymnsXagyT/PZtboQY72k=";
   };
 
-  cargoHash = "sha256-jclRF05eUAW/ggCmfZfWE6c4q25d/WGX0dad4rsP8vk=";
+  cargoHash = "sha256-ZIvq+SnnuXr8j6ae5WEf9aZZm20wB4HWQOmOrn08KIc=";
 
   passthru = {
     updateScript = nix-update-script { };
diff --git a/pkgs/by-name/sp/spruce/package.nix b/pkgs/by-name/sp/spruce/package.nix
index 178e5edea914..8a8da9f3b799 100644
--- a/pkgs/by-name/sp/spruce/package.nix
+++ b/pkgs/by-name/sp/spruce/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "spruce";
-  version = "1.35.0";
+  version = "1.35.1";
 
   src = fetchFromGitHub {
     owner = "geofffranks";
     repo = "spruce";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-+vWevbRp6SyyCxj/EzzyLkqNsF/E4Zyk7qwI5oCDvdk=";
+    hash = "sha256-vfgbmQ5cR1825r0uPQlpeOyhJjWwsTPsO6bFIcPwisc=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/st/stix-two/package.nix b/pkgs/by-name/st/stix-two/package.nix
index b21a7b98ceff..0cc8be8d4923 100644
--- a/pkgs/by-name/st/stix-two/package.nix
+++ b/pkgs/by-name/st/stix-two/package.nix
@@ -9,6 +9,13 @@ stdenvNoCC.mkDerivation rec {
   pname = "stix-two";
   version = "2.13";
 
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
+  preInstall = "rm -r static_ttf_woff2/";
+
   src = fetchzip {
     url = "https://github.com/stipub/stixfonts/raw/v${version}/zipfiles/STIX${
       builtins.replaceStrings [ "." ] [ "_" ] version
diff --git a/pkgs/by-name/su/sudo-font/package.nix b/pkgs/by-name/su/sudo-font/package.nix
index 1e9a37a05894..c9fe099f0f41 100644
--- a/pkgs/by-name/su/sudo-font/package.nix
+++ b/pkgs/by-name/su/sudo-font/package.nix
@@ -9,6 +9,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "sudo-font";
   version = "3.4";
 
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
   src = fetchzip {
     url = "https://github.com/jenskutilek/sudo-font/releases/download/v${finalAttrs.version}/sudo.zip";
     hash = "sha256-sSLY94wY9+AYAqWDq+Xy+KctUfJVS0jeS3baF8mLO9I=";
diff --git a/pkgs/by-name/su/surrealdb-surrealkv/package.nix b/pkgs/by-name/su/surrealdb-surrealkv/package.nix
new file mode 100644
index 000000000000..fcbd76ec604d
--- /dev/null
+++ b/pkgs/by-name/su/surrealdb-surrealkv/package.nix
@@ -0,0 +1,7 @@
+{
+  _surrealdbPackage,
+  callPackage,
+}:
+callPackage _surrealdbPackage {
+  backend = "surrealkv";
+}
diff --git a/pkgs/by-name/su/surrealdb/package.nix b/pkgs/by-name/su/surrealdb/package.nix
index a489c71374fd..2b72bd39f5d6 100644
--- a/pkgs/by-name/su/surrealdb/package.nix
+++ b/pkgs/by-name/su/surrealdb/package.nix
@@ -7,11 +7,21 @@
   rocksdb,
   testers,
   protobuf,
+  backend ? "rocksdb",
 }:
+let
+  hasRocksDB = backend == "rocksdb";
+in
+assert lib.assertMsg (builtins.elem backend [
+  "rocksdb"
+  "surrealkv"
+]) "surrealdb: backend must be one of [ \"rocksdb\" \"surrealkv\" ]";
 rustPlatform.buildRustPackage (finalAttrs: {
-  pname = "surrealdb";
+  pname = if hasRocksDB then "surrealdb" else "surrealdb-surrealkv";
   version = "2.6.1";
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "surrealdb";
     repo = "surrealdb";
@@ -21,19 +31,34 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-lebSQPGnxW+3a7vWw3R7QYtHx04/DsRK/n8c/UT3FZo=";
 
-  # error: linker `aarch64-linux-gnu-gcc` not found
+  # Upstream hard-codes `aarch64-linux-gnu-gcc` in `.cargo/config.toml`.
+  # Remove it so Cargo uses nixpkgs' wrapped C toolchain instead.
   postPatch = ''
     rm .cargo/config.toml
   '';
 
+  buildNoDefaultFeatures = true;
+  buildFeatures = [
+    "allocator"
+    "allocation-tracking"
+    "http"
+    "scripting"
+    "storage-mem"
+    "storage-surrealcs"
+    # Keep this enabled for the default RocksDB build to preserve upstream's
+    # default storage feature set. It can be dropped if `pkgs.surrealdb` is
+    # intentionally slimmed to RocksDB-only in a later change.
+    "storage-surrealkv"
+  ]
+  ++ lib.optional hasRocksDB "storage-rocksdb";
+
   env = {
     PROTOC = "${protobuf}/bin/protoc";
     PROTOC_INCLUDE = "${protobuf}/include";
-
+  }
+  // lib.optionalAttrs hasRocksDB {
     ROCKSDB_INCLUDE_DIR = "${rocksdb}/include";
     ROCKSDB_LIB_DIR = "${rocksdb}/lib";
-
-    RUSTFLAGS = "--cfg surrealdb_unstable";
   };
 
   nativeBuildInputs = [
@@ -60,7 +85,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
   };
 
   meta = {
-    description = "Scalable, distributed, collaborative, document-graph database, for the realtime web";
+    description =
+      if hasRocksDB then
+        "Scalable, distributed, collaborative, document-graph database, for the realtime web"
+      else
+        "SurrealDB with the SurrealKV storage backend";
     homepage = "https://surrealdb.com/";
     mainProgram = "surreal";
     license = lib.licenses.bsl11;
diff --git a/pkgs/by-name/ta/tacacsplus/package.nix b/pkgs/by-name/ta/tacacsplus/package.nix
index 0d977c193829..354febbd8fd2 100644
--- a/pkgs/by-name/ta/tacacsplus/package.nix
+++ b/pkgs/by-name/ta/tacacsplus/package.nix
@@ -6,18 +6,17 @@
   bison,
   perl,
   libnsl,
-  # --with-libwrap=yes is currently broken, TODO unbreak
-  withLibWrap ? false,
+  withLibWrap ? true,
   tcp_wrappers,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tacacsplus";
-  version = "4.0.4.28";
+  version = "4.0.4.31";
 
   src = fetchurl {
     url = "ftp://ftp.shrubbery.net/pub/tac_plus/tacacs-F${finalAttrs.version}.tar.gz";
-    hash = "sha256-FH8tyY0m0vk/Crp2yYjO0Zb/4cAB3C6R94ihosdHIZ4=";
+    hash = "sha256-MKad/Ax1vbz7GPV23l79cq6qBwnDGMBPFTcjn0UeyA8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ta/taler-wallet-core/package.nix b/pkgs/by-name/ta/taler-wallet-core/package.nix
index 6572819dde8a..57e39c2b9e0a 100644
--- a/pkgs/by-name/ta/taler-wallet-core/package.nix
+++ b/pkgs/by-name/ta/taler-wallet-core/package.nix
@@ -7,7 +7,7 @@
   fetchgit,
   srcOnly,
   removeReferencesTo,
-  nodejs_20,
+  nodejs_24,
   pnpm_9,
   fetchPnpmDeps,
   pnpmConfigHook,
@@ -17,8 +17,8 @@
   zip,
 }:
 let
-  nodeSources = srcOnly nodejs_20;
-  pnpm' = pnpm_9.override { nodejs = nodejs_20; };
+  nodeSources = srcOnly nodejs_24;
+  pnpm' = pnpm_9.override { nodejs = nodejs_24; };
   esbuild' = esbuild.override {
     buildGoModule =
       args:
@@ -40,17 +40,28 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "taler-wallet-core";
-  version = "1.3.1";
+  version = "1.5.10";
 
+  # NOTE: we have to use the tag's commit, else:
+  # > fatal: Not a valid object name
+  # > Unrecognized git object type:
+  # > Unable to checkout refs/tags/v1.5.10 from https://git-www.taler.net/taler-typescript-core.git.
   src = fetchgit {
-    url = "https://git.taler.net/taler-typescript-core.git";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-YTFS4s8GuC3SQ/b4JJ5DbEbzc8hrywYaf6rtSKGiSpE=";
+    url = "https://git-www.taler.net/taler-typescript-core.git";
+    rev = "3816d089724c513299b62b20bdb88d94d5be67f5";
+    hash = "sha256-/KxB4uBbJbnFUPAc6a++bfTwl2CM1ZYjxPTDYwRh21Q=";
+  };
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs) pname version src;
+    pnpm = pnpm';
+    fetcherVersion = 3;
+    hash = "sha256-W5C2JVFbEccf4b+ppeEJ68au/2Tqfsry7ri6Qi1M50k=";
   };
 
   nativeBuildInputs = [
     customPython
-    nodejs_20
+    nodejs_24
     pnpmConfigHook
     pnpm'
     gitMinimal
@@ -58,14 +69,9 @@ stdenv.mkDerivation (finalAttrs: {
     zip
   ];
 
-  pnpmDeps = fetchPnpmDeps {
-    inherit (finalAttrs) pname version src;
-    pnpm = pnpm';
-    fetcherVersion = 3;
-    hash = "sha256-a1ym/UpUufUPTGL3dozZ9Jb0eX1XVB7Hahek25eLvc4=";
-  };
-
-  buildInputs = [ nodejs_20 ];
+  buildInputs = [
+    nodejs_24
+  ];
 
   # Make a fake git repo with a commit.
   # Without this, the package does not build.
@@ -108,7 +114,7 @@ stdenv.mkDerivation (finalAttrs: {
   env.ESBUILD_BINARY_PATH = lib.getExe esbuild';
 
   meta = {
-    homepage = "https://git.taler.net/wallet-core.git/";
+    homepage = "https://git-www.taler.net/taler-typescript-core.git";
     description = "CLI wallet for GNU Taler written in TypeScript and Anastasis Web UI";
     license = lib.licenses.gpl3Plus;
     teams = [ lib.teams.ngi ];
diff --git a/pkgs/by-name/va/vacuum-go/package.nix b/pkgs/by-name/va/vacuum-go/package.nix
index 86d0298d9ea1..ee015b75a1ce 100644
--- a/pkgs/by-name/va/vacuum-go/package.nix
+++ b/pkgs/by-name/va/vacuum-go/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "vacuum-go";
-  version = "0.26.1";
+  version = "0.26.4";
 
   src = fetchFromGitHub {
     owner = "daveshanley";
     repo = "vacuum";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UUHOlZuMnL4fAcocmi6rdOQvxl3oNrZMgnad/0z2+oA=";
+    hash = "sha256-shJblJz5+DhVUju8L/KJ3rFixq3CpvV5o0fC9hx7ivk=";
   };
 
-  vendorHash = "sha256-zPlhjHfwFrhpYAKcgVi1II0hR3fOFItegt9SZoei1SQ=";
+  vendorHash = "sha256-kyKPWbDFPWmIJmn3Np8Geogen3+OxePcSulWBeJFrD4=";
 
   env.CGO_ENABLED = 0;
   ldflags = [
diff --git a/pkgs/by-name/xr/xremap/package.nix b/pkgs/by-name/xr/xremap/package.nix
index 3ee0e4d02b91..cf54185a3ac1 100644
--- a/pkgs/by-name/xr/xremap/package.nix
+++ b/pkgs/by-name/xr/xremap/package.nix
@@ -58,13 +58,13 @@ assert (
 );
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "xremap${variant.suffix or ""}";
-  version = "0.15.2";
+  version = "0.15.5";
 
   src = fetchFromGitHub {
     owner = "xremap";
     repo = "xremap";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-J07iDGltzJg/2r+bUlBaOpZxAhg020J1giqbTZNSDRY=";
+    hash = "sha256-DwI0y344MLsbz1V2yok2vrFF774xybUrD/g+euF13Nk=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -72,7 +72,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   buildNoDefaultFeatures = true;
   buildFeatures = variant.features;
 
-  cargoHash = "sha256-iBlX0ikkzZu2VTKXF9UEe9qA+i9OjEOwWSpwvsqGPFQ=";
+  cargoHash = "sha256-Q+riJ7fbbSj0Dspm4cNp0uYlDa0bmj4wsYVm8uzWKu0=";
 
   passthru = lib.mapAttrs (name: lib.const (xremap.override { withVariant = name; })) variants;
 
diff --git a/pkgs/by-name/zk/zk/package.nix b/pkgs/by-name/zk/zk/package.nix
index 53ce874a157a..c484828347f7 100644
--- a/pkgs/by-name/zk/zk/package.nix
+++ b/pkgs/by-name/zk/zk/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "zk";
-  version = "0.15.1";
+  version = "0.15.3";
 
   src = fetchFromGitHub {
     owner = "zk-org";
     repo = "zk";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-h4q3GG4DPPEJk2G5JDbUhnHpqEdMAkGYSMs9TS5Goco=";
+    sha256 = "sha256-9lqXlu9RM3AM3Y0GMBUSrRqXx+kd9yDP2Zk0CtLbBq0=";
   };
 
-  vendorHash = "sha256-2PlaIw7NaW4pAVIituSVWhssSBKjowLOLuBV/wz829I=";
+  vendorHash = "sha256-YX+voBRKC/2LN7ByS8XWgJkm6dAip8L0kHpt754wHck=";
 
   doCheck = false;
 
diff --git a/pkgs/by-name/zo/zotero/package.nix b/pkgs/by-name/zo/zotero/package.nix
index 95d6ef19dc1c..ec1954aabc99 100644
--- a/pkgs/by-name/zo/zotero/package.nix
+++ b/pkgs/by-name/zo/zotero/package.nix
@@ -28,14 +28,14 @@ let
   nodejs = nodejs_22;
 
   pname = "zotero";
-  version = "9.0.1";
+  version = "9.0.2";
 
   src = fetchFromGitHub {
     owner = "zotero";
     repo = "zotero";
     tag = version;
     fetchSubmodules = true;
-    hash = "sha256-51JSDrvvrwnmuxn7YZd8e0by4CJODvflHi4M4GAt2Lw=";
+    hash = "sha256-OAPgJBSBHCyuy/VPlIeNwAM87cnyuHBuaMn6QKisTcA=";
   };
 
   pdf-js = buildNpmPackage {
diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index 650a4f3b7251..e75e834bab87 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -28,9 +28,9 @@ let
     "21.1.8".officialRelease.sha256 = "sha256-pgd8g9Yfvp7abjCCKSmIn1smAROjqtfZaJkaUkBSKW0=";
     "22.1.2".officialRelease.sha256 = "sha256-z6YcxgDd3F3JwfU5Y/wMw5MK+ZPISI3KLwHwUaraTuw=";
     "23.0.0-git".gitRelease = {
-      rev = "1b2ccf9c6c79d6e57ba6f0a4cf8a3bd1075edebb";
-      rev-version = "23.0.0-unstable-2026-04-19";
-      sha256 = "sha256-GLGH/FIwyEf48tRcEAnbs7SZceOexYbZH8hHA34hPIE=";
+      rev = "cd6119c00b461c36139f1f4a0ca1653a6ab2a32b";
+      rev-version = "23.0.0-unstable-2026-05-03";
+      sha256 = "sha256-sK6G7GFetfHpu2QcYWfEo/PEwQ0pKxKp63E87X8zjiw=";
     };
   }
   // llvmVersions;
diff --git a/pkgs/development/coq-modules/compcert/default.nix b/pkgs/development/coq-modules/compcert/default.nix
index 8bfca13c6837..d1c39ed6abd4 100644
--- a/pkgs/development/coq-modules/compcert/default.nix
+++ b/pkgs/development/coq-modules/compcert/default.nix
@@ -98,8 +98,8 @@ let
       -toolprefix ${tools}/bin/ \
       -use-external-Flocq \
       -use-external-MenhirLib \
-      ${target}
-    '';
+      ${target} \
+    ''; # do NOT remove the above "\", this must NOT end with a newline (c.f. below)
 
     installTargets = "documentation install";
     installFlags = [ ]; # trust ./configure
diff --git a/pkgs/development/python-modules/certihound/default.nix b/pkgs/development/python-modules/certihound/default.nix
index a403d6a70200..2d9d7c3e1787 100644
--- a/pkgs/development/python-modules/certihound/default.nix
+++ b/pkgs/development/python-modules/certihound/default.nix
@@ -13,12 +13,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "certihound";
-  version = "0.3.0";
+  version = "0.3.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-ERJ5fbYikhKLwchSIBe5s4KF/1HsXZ1O00QnYXAe+ps=";
+    hash = "sha256-uSoI4bz5h3Guy8TtfHjsk0zo9LNL2BJ5ZRFMFPk2Up0=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/development/python-modules/certipy/default.nix b/pkgs/development/python-modules/certipy/default.nix
index 9ca910cb9115..37ff90a82f2f 100644
--- a/pkgs/development/python-modules/certipy/default.nix
+++ b/pkgs/development/python-modules/certipy/default.nix
@@ -9,14 +9,14 @@
   setuptools-scm,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "certipy";
-  version = "0.2.2";
+  version = "0.2.3";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-/vHz2IGe4pxMZ3GRccmIMCgj3+C2z7tH0knzdICboF4=";
+    inherit (finalAttrs) pname version;
+    hash = "sha256-TocB5qLygeehVMLzaM/07fN0AJCE0peIy+jDg4iXeE8=";
   };
 
   build-system = [ setuptools-scm ];
@@ -38,4 +38,4 @@ buildPythonPackage rec {
     maintainers = with lib.maintainers; [ isgy ];
     mainProgram = "certipy";
   };
-}
+})
diff --git a/pkgs/development/python-modules/django-lasuite/default.nix b/pkgs/development/python-modules/django-lasuite/default.nix
index 32979f2632f0..6df392cf2864 100644
--- a/pkgs/development/python-modules/django-lasuite/default.nix
+++ b/pkgs/development/python-modules/django-lasuite/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "django-lasuite";
-  version = "0.0.23";
+  version = "0.0.26";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "django-lasuite";
     tag = "v${version}";
-    hash = "sha256-H0sa/JaYsOqUdyAdlTzxRwY4WtCmZS+zorhERpCksDs=";
+    hash = "sha256-wTxM4dVCqfDjMouk/bdLjD/Yv0WuTSOJYFhYMsD4JjQ=";
   };
 
   build-system = [ hatchling ];
diff --git a/pkgs/development/python-modules/hypchat/default.nix b/pkgs/development/python-modules/hypchat/default.nix
index a1e3a703955d..3842d10d8dca 100644
--- a/pkgs/development/python-modules/hypchat/default.nix
+++ b/pkgs/development/python-modules/hypchat/default.nix
@@ -1,4 +1,5 @@
 {
+  lib,
   buildPythonPackage,
   pythonAtLeast,
   fetchPypi,
@@ -24,4 +25,8 @@ buildPythonPackage rec {
     six
     python-dateutil
   ];
+
+  meta = {
+    license = lib.licenses.mit;
+  };
 }
diff --git a/pkgs/development/python-modules/iowait/default.nix b/pkgs/development/python-modules/iowait/default.nix
index fe0a6a5f709a..d5be45de2e26 100644
--- a/pkgs/development/python-modules/iowait/default.nix
+++ b/pkgs/development/python-modules/iowait/default.nix
@@ -1,4 +1,8 @@
-{ buildPythonPackage, fetchPypi }:
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+}:
 
 buildPythonPackage rec {
   pname = "iowait";
@@ -13,5 +17,6 @@ buildPythonPackage rec {
   meta = {
     description = "Platform-independent module for I/O completion events";
     homepage = "https://launchpad.net/python-iowait";
+    license = lib.licenses.lgpl3Only;
   };
 }
diff --git a/pkgs/development/python-modules/obfsproxy/default.nix b/pkgs/development/python-modules/obfsproxy/default.nix
index 523f625c44a8..3f262cb7ddd2 100644
--- a/pkgs/development/python-modules/obfsproxy/default.nix
+++ b/pkgs/development/python-modules/obfsproxy/default.nix
@@ -38,5 +38,6 @@ buildPythonPackage rec {
     description = "Pluggable transport proxy";
     homepage = "https://www.torproject.org/projects/obfsproxy";
     maintainers = with lib.maintainers; [ thoughtpolice ];
+    license = lib.licenses.bsd3;
   };
 }
diff --git a/pkgs/development/python-modules/pbkdf2/default.nix b/pkgs/development/python-modules/pbkdf2/default.nix
index d663be3337cd..f08ecedebfaf 100644
--- a/pkgs/development/python-modules/pbkdf2/default.nix
+++ b/pkgs/development/python-modules/pbkdf2/default.nix
@@ -19,5 +19,6 @@ buildPythonPackage rec {
 
   meta = {
     maintainers = [ ];
+    license = lib.licenses.mit;
   };
 }
diff --git a/pkgs/development/python-modules/sphinxcontrib-bibtex/default.nix b/pkgs/development/python-modules/sphinxcontrib-bibtex/default.nix
index 97d6939c7185..726a34052653 100644
--- a/pkgs/development/python-modules/sphinxcontrib-bibtex/default.nix
+++ b/pkgs/development/python-modules/sphinxcontrib-bibtex/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch2,
   setuptools,
   docutils,
   oset,
@@ -24,6 +25,14 @@ buildPythonPackage rec {
     hash = "sha256-sT23DkIfJcb3cFBFdL31RRzlDoJRcCUYIdpUVuYjGuo=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      name = "fix-tests-docutils-0.22.diff";
+      url = "https://github.com/mcmtroffaes/sphinxcontrib-bibtex/commit/20781600dad48fdfee91353c821597690bfe5f54.diff?full_index=1";
+      hash = "sha256-Ia/ng3yUfhLueEB/n+CW51w/UWfzRhrv/5//Mq2OJ0M=";
+    })
+  ];
+
   build-system = [ setuptools ];
 
   dependencies = [
diff --git a/pkgs/development/python-modules/svgdigitizer/default.nix b/pkgs/development/python-modules/svgdigitizer/default.nix
index 1e44d9a5f7d7..e644640864a0 100644
--- a/pkgs/development/python-modules/svgdigitizer/default.nix
+++ b/pkgs/development/python-modules/svgdigitizer/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "svgdigitizer";
-  version = "0.14.2";
+  version = "0.14.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "echemdb";
     repo = "svgdigitizer";
     tag = version;
-    hash = "sha256-7F1q0AvkeqLIoWDNNBUc/91caiQ7kdIcKOkvdAajsLI=";
+    hash = "sha256-Wba1I80wi2YGbHqpbXfCoHw0zkNovX3PRPkdqhm05Ys=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/types-aiobotocore/default.nix b/pkgs/development/python-modules/types-aiobotocore/default.nix
index a0ecd6f88927..d87354bbb00f 100644
--- a/pkgs/development/python-modules/types-aiobotocore/default.nix
+++ b/pkgs/development/python-modules/types-aiobotocore/default.nix
@@ -371,13 +371,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "types-aiobotocore";
-  version = "3.5.0";
+  version = "3.6.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "types_aiobotocore";
     inherit (finalAttrs) version;
-    hash = "sha256-hjbJ5amDfUHkUmRXA0nZjAza1R/nlh7hlmShEJS7ImI=";
+    hash = "sha256-6ZAFbOnRkJSp2bNgCMoLKk1plI/1j1CGjdFZqB9q1pw=";
   };
 
   build-system = [ setuptools ];
diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index b97d9936bff9..404191d92372 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -115,14 +115,12 @@ let
         ]
         ++ extraMakeFlags;
 
-        passAsFile = [ "extraConfig" ];
-
         configurePhase = ''
           runHook preConfigure
 
           make -j$NIX_BUILD_CORES ${defconfig}
 
-          cat $extraConfigPath >> .config
+          printf "%s" "$extraConfig" >> .config
 
           runHook postConfigure
         '';
@@ -145,17 +143,17 @@ let
 
         dontStrip = true;
 
-        meta =
+        __structuredAttrs = true;
 
-          {
-            homepage = "https://www.denx.de/wiki/U-Boot/";
-            description = "Boot loader for embedded systems";
-            license = lib.licenses.gpl2Plus;
-            maintainers = with lib.maintainers; [
-              lopsided98
-            ];
-          }
-          // extraMeta;
+        meta = {
+          homepage = "https://www.denx.de/wiki/U-Boot/";
+          description = "Boot loader for embedded systems";
+          license = lib.licenses.gpl2Plus;
+          maintainers = with lib.maintainers; [
+            lopsided98
+          ];
+        }
+        // extraMeta;
       }
       // removeAttrs args [
         "extraMeta"
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1a8ee13882e8..9b4018f7b1a9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7947,6 +7947,8 @@ with pkgs;
 
   home-assistant-cli = callPackage ../servers/home-assistant/cli.nix { };
 
+  _surrealdbPackage = ../by-name/su/surrealdb/package.nix;
+
   icingaweb2-ipl = callPackage ../servers/icingaweb2/ipl.nix { };
   icingaweb2-thirdparty = callPackage ../servers/icingaweb2/thirdparty.nix { };
   icingaweb2 = callPackage ../servers/icingaweb2 { };