diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index 25b7284a0144..b8d14a13d3a7 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -197,6 +197,8 @@
 
 - `python3Packages.pikepdf` no longer builds with mupdf support by default, which may be nice in Jupyter and iPython. Build with `withMupdf = true` if this is required.
 
+- `python3Packages.django-mdeditor` has been removed, as it was unmaintained upstream and the latest release was vulnerable to a [critical security vulnerability](https://github.com/NixOS/nixpkgs/issues/515462).
+
 - `vicinae` has been updated to v0.20. This includes, among several other breaking changes, a complete overhaul of the configuration system. For update instructions, see the [upstream configuration documentation](https://docs.vicinae.com/config#migration-from-v0-16-x-to-v0-17-x).
 
 - `percona-server_8_4` has been removed. Please update to `percona-server_8_0`, `mysql84` or `mariadb`.
diff --git a/lib/systems/default.nix b/lib/systems/default.nix
index f2be7c2c5094..4c05525c9b36 100644
--- a/lib/systems/default.nix
+++ b/lib/systems/default.nix
@@ -3,7 +3,7 @@
 let
   inherit (lib)
     any
-    foldl
+    foldl'
     hasInfix
     isAttrs
     isList
@@ -692,7 +692,7 @@ let
       };
     in
     assert final.useAndroidPrebuilt -> final.isAndroid;
-    assert foldl (pass: { assertion, message }: if assertion final then pass else throw message) true (
+    assert foldl' (pass: { assertion, message }: if assertion final then pass else throw message) true (
       final.parsed.abi.assertions or [ ]
     );
     final;
diff --git a/nixos/modules/services/mail/roundcube.nix b/nixos/modules/services/mail/roundcube.nix
index 3c15fbedfc9c..2f3a977ce923 100644
--- a/nixos/modules/services/mail/roundcube.nix
+++ b/nixos/modules/services/mail/roundcube.nix
@@ -9,7 +9,7 @@ let
   fpm = config.services.phpfpm.pools.roundcube;
   localDB = cfg.database.host == "localhost";
   user = cfg.database.username;
-  phpWithPspell = pkgs.php83.withExtensions ({ enabled, all }: [ all.pspell ] ++ enabled);
+  phpWithPspell = pkgs.php84.withExtensions ({ enabled, all }: [ all.pspell ] ++ enabled);
 
   env = {
     ASPELL_CONF = "dict-dir ${pkgs.aspellWithDicts (_: cfg.dicts)}/lib/aspell";
@@ -184,7 +184,7 @@ in
         ${cfg.hostName} = {
           forceSSL = lib.mkDefault true;
           enableACME = lib.mkDefault true;
-          root = cfg.package;
+          root = cfg.package + "/public_html";
           locations."/" = {
             index = "index.php";
             priority = 1100;
@@ -192,19 +192,6 @@ in
               add_header Cache-Control 'public, max-age=604800, must-revalidate';
             '';
           };
-          locations."~ ^/(SQL|bin|config|logs|temp|vendor)/" = {
-            priority = 3110;
-            extraConfig = ''
-              return 404;
-            '';
-          };
-          locations."~ ^/(CHANGELOG.md|INSTALL|LICENSE|README.md|SECURITY.md|UPGRADING|composer.json|composer.lock)" =
-            {
-              priority = 3120;
-              extraConfig = ''
-                return 404;
-              '';
-            };
           locations."~* \\.php(/|$)" = {
             priority = 3130;
             extraConfig = ''
diff --git a/nixos/tests/prometheus-exporters.nix b/nixos/tests/prometheus-exporters.nix
index 6383f1b54cfd..952bc1da58e4 100644
--- a/nixos/tests/prometheus-exporters.nix
+++ b/nixos/tests/prometheus-exporters.nix
@@ -1737,6 +1737,16 @@ let
           enable = true;
           tokenFile = "/tmp/faketoken";
         };
+        metricProvider = {
+          networking = {
+            # The exporter tries to access Hetzner on startup and crashes.
+            # Blocking this on the firewall level allows the exporter to start.
+            extraHosts = "127.0.0.1 api.hetzner.com";
+            firewall.extraCommands = ''
+              iptables -A OUTPUT -p tcp --dport 443 -d 127.0.0.1 -j DROP
+            '';
+          };
+        };
         exporterTest = ''
           succeed(
             'echo faketoken > /tmp/faketoken'
diff --git a/nixos/tests/roundcube.nix b/nixos/tests/roundcube.nix
index fd9c72915943..48e7fa59b4ef 100644
--- a/nixos/tests/roundcube.nix
+++ b/nixos/tests/roundcube.nix
@@ -33,6 +33,6 @@
     roundcube.wait_for_unit("postgresql.target")
     roundcube.wait_for_unit("phpfpm-roundcube.service")
     roundcube.wait_for_unit("nginx.service")
-    roundcube.succeed("curl -sSfL http://roundcube/ | grep 'Keep me logged in'")
+    t.assertIn("Keep me logged in", roundcube.succeed("curl -sSfL http://roundcube/"))
   '';
 }
diff --git a/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix b/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix
index 1851be48b328..347fa8d84d48 100644
--- a/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix
+++ b/pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-pce-fast";
-  version = "0-unstable-2026-05-01";
+  version = "0-unstable-2026-05-16";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-pce-fast-libretro";
-    rev = "9ba79648d6ec85e833aef719d7f359117498d89c";
-    hash = "sha256-VSZelshWjMxIe8sumNZZ6WHm1WTE9r2xm62og0YLGlY=";
+    rev = "82cbe149648969fa55d60b955d455f15fd125b1d";
+    hash = "sha256-odOMCxLl2fCBdalnW/ykOeVmB+G8N/lGbZqCTr2mdow=";
   };
 
   makefile = "Makefile";
diff --git a/pkgs/applications/misc/opencpn/default.nix b/pkgs/applications/misc/opencpn/default.nix
index 1ae9cdb2a8ec..6fe8c40be81f 100644
--- a/pkgs/applications/misc/opencpn/default.nix
+++ b/pkgs/applications/misc/opencpn/default.nix
@@ -50,18 +50,16 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "opencpn";
-  version = "5.12.4";
+  version = "5.14.0";
 
   src = fetchFromGitHub {
     owner = "OpenCPN";
     repo = "OpenCPN";
     rev = "Release_${finalAttrs.version}";
-    hash = "sha256-1JCb2aYyjaiUvtYkBFtEdlClmiMABN3a/Hts9V1sbgc=";
+    hash = "sha256-2yCVv1wRkmRJ2FBwg1CJ9xkXUPx0TPSkRHiNZXaMJZQ=";
   };
 
   patches = [
-    # https://github.com/OpenCPN/OpenCPN/pull/4900
-    ./fix-clang20.patch
   ];
 
   postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
diff --git a/pkgs/applications/misc/opencpn/fix-clang20.patch b/pkgs/applications/misc/opencpn/fix-clang20.patch
deleted file mode 100644
index cfc5e5c3f9f8..000000000000
--- a/pkgs/applications/misc/opencpn/fix-clang20.patch
+++ /dev/null
@@ -1,82 +0,0 @@
-From cb5d28c48c814454182a5169e852f2596ba018ae Mon Sep 17 00:00:00 2001
-From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
-Date: Thu, 13 Nov 2025 22:25:56 -0500
-Subject: [PATCH] Fix clang 20 build failure (-Wnontrivial-memcall), attempt 2
-
-The previous attempt [1] resulted in -Werror=use-after-free violation
-when built with gcc on bookworm because `*this` triggered the class
-destructor, calling `free` on an uninitialized pointer.
-
-In this new patch, we are going to use an explicit initializer list to
-initialize all class members with zero values.
-
-[1] d3eb15de1e5aa8f85890d5c83cbc025ac7a467be
----
- gui/src/IDX_entry.cpp | 52 ++++++++++++++++++++++++++++++++++++++++++-
- 1 file changed, 51 insertions(+), 1 deletion(-)
-
-diff --git a/gui/src/IDX_entry.cpp b/gui/src/IDX_entry.cpp
-index 726833ccc..46923d633 100644
---- a/gui/src/IDX_entry.cpp
-+++ b/gui/src/IDX_entry.cpp
-@@ -29,6 +29,56 @@
- 
- WX_DEFINE_OBJARRAY(ArrayOfIDXEntry);
- 
--IDX_entry::IDX_entry() { memset(this, 0, sizeof(IDX_entry)); }
-+IDX_entry::IDX_entry()
-+    : source_data_type(SOURCE_TYPE_UNKNOWN),
-+      pDataSource(nullptr),
-+      IDX_rec_num(0),
-+      IDX_type(0),
-+      IDX_lon(0.0),
-+      IDX_lat(0.0),
-+      IDX_ht_time_off(0),
-+      IDX_ht_mpy(0.0f),
-+      IDX_ht_off(0.0f),
-+      IDX_lt_time_off(0),
-+      IDX_lt_mpy(0.0f),
-+      IDX_lt_off(0.0f),
-+      IDX_sta_num(0),
-+      IDX_flood_dir(0),
-+      IDX_ebb_dir(0),
-+      IDX_Useable(0),
-+      Valid15(0),
-+      Value15(0.0f),
-+      Dir15(0.0f),
-+      Ret15(false),
-+      IDX_tzname(nullptr),
-+      IDX_ref_file_num(0),
-+      IDX_ref_dbIndex(0),
-+      max_amplitude(0.0),
-+      have_offsets(0),
-+      station_tz_offset(0),
-+      IDX_time_zone(0),
-+      pref_sta_data(nullptr),
-+      num_nodes(0),
-+      num_csts(0),
-+      num_epochs(0),
-+      m_cst_speeds(nullptr),
-+      m_cst_nodes(nullptr),
-+      m_cst_epochs(nullptr),
-+      m_work_buffer(nullptr),
-+      first_year(0),
-+      epoch(0),
-+      epoch_year(0),
-+      current_depth(0),
-+      b_skipTooDeep(false),
-+      recent_highlow_calc_time(0),
-+      recent_high_level(0.0f),
-+      recent_high_time(0),
-+      recent_low_level(0.0f),
-+      recent_low_time(0) {
-+  memset(source_ident, 0, sizeof(source_ident));
-+  memset(IDX_zone, 0, sizeof(IDX_zone));
-+  memset(IDX_station_name, 0, sizeof(IDX_station_name));
-+  memset(IDX_reference_name, 0, sizeof(IDX_reference_name));
-+}
- 
- IDX_entry::~IDX_entry() { free(IDX_tzname); }
--- 
-2.51.0
-
diff --git a/pkgs/applications/video/kodi/addons/controller-topology-project/default.nix b/pkgs/applications/video/kodi/addons/controller-topology-project/default.nix
index e25c08a7675e..d53b26671d3e 100644
--- a/pkgs/applications/video/kodi/addons/controller-topology-project/default.nix
+++ b/pkgs/applications/video/kodi/addons/controller-topology-project/default.nix
@@ -8,13 +8,13 @@
 let
   drv = stdenv.mkDerivation rec {
     pname = "controller-topology-project";
-    version = "1.0.8";
+    version = "1.0.11";
 
     src = fetchFromGitHub {
       owner = "kodi-game";
       repo = "controller-topology-project";
       rev = "v${version}";
-      sha256 = "sha256-hYakxkGAF6kh2nTLwKdnLVqtQLvEgayvexTfqvfoLuw=";
+      sha256 = "sha256-P3kfYEAK8j9GMNAujHYjeDzPrAQfSS/VKBsiJTjR5tI=";
     };
 
     postPatch = ''
diff --git a/pkgs/build-support/docker/examples.nix b/pkgs/build-support/docker/examples.nix
index 074e37b61d8c..a37cdd004c04 100644
--- a/pkgs/build-support/docker/examples.nix
+++ b/pkgs/build-support/docker/examples.nix
@@ -704,7 +704,7 @@ rec {
           finalAttrs: prevAttrs: {
             # A unique `hello` to make sure that it isn't included via another mechanism by accident.
             configureFlags = prevAttrs.configureFlags or [ ] ++ [
-              " --program-prefix=layeredImageWithFakeRootCommands-"
+              "--program-prefix=layeredImageWithFakeRootCommands-"
             ];
             doCheck = false;
             versionCheckProgram = "${placeholder "out"}/bin/${finalAttrs.meta.mainProgram}";
diff --git a/pkgs/build-support/trivial-builders/default.nix b/pkgs/build-support/trivial-builders/default.nix
index 3e9a8f15bb4a..e02b7e99d8a9 100644
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@@ -17,6 +17,7 @@ let
     warn
     map
     isList
+    foldl'
     ;
 in
 
@@ -629,7 +630,7 @@ rec {
           entries
         # We do this foldl to have last-wins semantics in case of repeated entries
         else if (lib.isList entries) then
-          lib.foldl (a: b: a // { "${b.name}" = b.path; }) { } entries
+          foldl' (a: b: a // { "${b.name}" = b.path; }) { } entries
         else
           throw "linkFarm entries must be either attrs or a list!";
 
diff --git a/pkgs/by-name/ad/adminneo/package.nix b/pkgs/by-name/ad/adminneo/package.nix
index 286d5377912d..6f4760666a89 100644
--- a/pkgs/by-name/ad/adminneo/package.nix
+++ b/pkgs/by-name/ad/adminneo/package.nix
@@ -8,13 +8,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "adminneo";
-  version = "5.2.1";
+  version = "5.3.0";
 
   src = fetchFromGitHub {
     owner = "adminneo-org";
     repo = "adminneo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NCQqjIJsAiz1At/oYsuuUejr5A7PVLyzROI5Ev3zxlM=";
+    hash = "sha256-hJwqI8zT2ZAapJMpUZ+izJo3DF5I5NlO5HhPyxoM9b0=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/an/ananicy-rules-cachyos/package.nix b/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
index 778010390840..a1206daf52c4 100644
--- a/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
+++ b/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "ananicy-rules-cachyos";
-  version = "0-unstable-2026-04-23";
+  version = "0-unstable-2026-05-12";
 
   src = fetchFromGitHub {
     owner = "CachyOS";
     repo = "ananicy-rules";
-    rev = "dcae8ac6b1213f82015135a09780c07ac54ff378";
-    hash = "sha256-rkNczo6MxmLWpSnC1SGza21Gwns1FV/ZxXBTRBZ3xM4=";
+    rev = "96d10aba6ead2862c4cc34bd6c9f1fabfeb4bee6";
+    hash = "sha256-YCt0XL+t7kMPQjWaLZrQGXDu5LjPqHye4T0t906tOXA=";
   };
 
   dontConfigure = true;
diff --git a/pkgs/by-name/bi/bigloo/package.nix b/pkgs/by-name/bi/bigloo/package.nix
index a844d11e11ff..b1b40e8d0bfb 100644
--- a/pkgs/by-name/bi/bigloo/package.nix
+++ b/pkgs/by-name/bi/bigloo/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bigloo";
-  version = "4.6a";
+  version = "4.7a";
 
   src = fetchurl {
     url = "https://www-sop.inria.fr/mimosa/fp/Bigloo/download/bigloo-${finalAttrs.version}.tar.gz";
-    hash = "sha256-lwXsPeAMwcUe52mYlIQaN3DAaodCFbRWNbiESuba8KY=";
+    hash = "sha256-RCXDf0meLfGnvjM0roUg/XYhRzPZ2f6XsvunHRxM9js=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cl/clickhouse/generic.nix b/pkgs/by-name/cl/clickhouse/generic.nix
index cac17f4fc466..4b9b9cfaded9 100644
--- a/pkgs/by-name/cl/clickhouse/generic.nix
+++ b/pkgs/by-name/cl/clickhouse/generic.nix
@@ -8,7 +8,6 @@
 {
   lib,
   stdenv,
-  llvmPackages_19,
   llvmPackages_21,
   fetchFromGitHub,
   fetchpatch,
@@ -23,6 +22,7 @@
   findutils,
   libiconv,
   removeReferencesTo,
+  zstd,
   rustSupport ? true,
   rustc,
   cargo,
@@ -31,7 +31,7 @@
   versionCheckHook,
 }:
 let
-  llvmPackages = if lib.versionAtLeast version "26" then llvmPackages_21 else llvmPackages_19;
+  llvmPackages = llvmPackages_21;
   llvmStdenv = llvmPackages.stdenv;
 in
 llvmStdenv.mkDerivation (finalAttrs: {
@@ -44,8 +44,9 @@ llvmStdenv.mkDerivation (finalAttrs: {
     repo = "ClickHouse";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    name = "clickhouse-${tag}.tar.gz";
+    name = "clickhouse-${tag}.tar.zst";
     inherit hash;
+    nativeBuildInputs = [ zstd ];
     postFetch = ''
       # Delete files that make the source too big
       rm -rf $out/contrib/arrow/docs/
@@ -80,7 +81,7 @@ llvmStdenv.mkDerivation (finalAttrs: {
       # Compress to not exceed the 2GB output limit
       echo "Creating deterministic source tarball..."
 
-      tar -I 'gzip -n' \
+      tar -I 'zstd --no-progress' \
         --sort=name \
         --mtime=1970-01-01 \
         --owner=0 --group=0 \
@@ -102,14 +103,18 @@ llvmStdenv.mkDerivation (finalAttrs: {
     python3
     perl
     llvmPackages.lld
+    # Provides llvm-ar/llvm-objcopy.
+    # Required by cmake/strip_rust_symbols.sh to match the LLVM toolchain
+    # Otherwise it corrupts .eh_frame in the Rust staticlibs
+    llvmPackages.bintools
     removeReferencesTo
+    zstd
   ]
   ++ lib.optionals stdenv.hostPlatform.isx86_64 [
     nasm
     yasm
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    llvmPackages.bintools
     findutils
     darwin.bootstrap_cmds
   ]
@@ -123,26 +128,6 @@ llvmStdenv.mkDerivation (finalAttrs: {
 
   dontCargoSetupPostUnpack = true;
 
-  patches =
-    lib.optional (lib.versions.majorMinor version == "25.8") (fetchpatch {
-      # Disable building WASM lexer
-      url = "https://github.com/ClickHouse/ClickHouse/commit/67a42b78cdf1c793e78c1adbcc34162f67044032.patch";
-      hash = "sha256-7VF+JSztqTWD+aunCS3UVNxlRdwHc2W5fNqzDyeo3Fc=";
-    })
-    ++
-
-      lib.optional (lib.versions.majorMinor version == "25.8" && stdenv.hostPlatform.isDarwin)
-        (fetchpatch {
-          # Do not intercept memalign on darwin
-          url = "https://github.com/ClickHouse/ClickHouse/commit/0cfd2dbe981727fb650f3b9935f5e7e7e843180f.patch";
-          hash = "sha256-1iNYZbugX2g2dxNR1ZiUthzPnhLUR8g118aG23yhgUo=";
-        })
-    ++ lib.optional (!lib.versionAtLeast version "25.11" && stdenv.hostPlatform.isDarwin) (fetchpatch {
-      # Remove flaky macOS SDK version detection
-      url = "https://github.com/ClickHouse/ClickHouse/commit/11e172a37bd0507d595d27007170090127273b33.patch";
-      hash = "sha256-oI7MrjMgJpIPTsci2IqEOs05dUGEMnjI/WqGp2N+rps=";
-    });
-
   postPatch = ''
     patchShebangs src/ utils/
   ''
diff --git a/pkgs/by-name/cl/clickhouse/lts.nix b/pkgs/by-name/cl/clickhouse/lts.nix
index 100c72de62fb..2dbde7ae2868 100644
--- a/pkgs/by-name/cl/clickhouse/lts.nix
+++ b/pkgs/by-name/cl/clickhouse/lts.nix
@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "25.8.20.4-lts";
-  rev = "2e1cd6354ae8898072e5dbf97aa6e5945761e3d7";
-  hash = "sha256-Xd9hLb4sXnSQby8NuKnD0b8R6iGb+M4u0L0yYASNvzw=";
+  version = "26.3.10.62-lts";
+  rev = "e1c11930c28196f954a93287e43c1aa112c8c607";
+  hash = "sha256-2vU3PRJISFqrh1KWRKub95QA0cawWGP+wzrn2Kwo5Bc=";
   lts = true;
 }
diff --git a/pkgs/by-name/cl/clickhouse/package.nix b/pkgs/by-name/cl/clickhouse/package.nix
index b67d86d9013d..6a36b81a54eb 100644
--- a/pkgs/by-name/cl/clickhouse/package.nix
+++ b/pkgs/by-name/cl/clickhouse/package.nix
@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "26.2.5.45-stable";
-  rev = "9ca62f3f68fd635f4b56171568d75588b13b6258";
-  hash = "sha256-qzY3nFbLvKVJaIfXgNliAvAmO8dzEWNKf4o8HfZYyZA=";
+  version = "26.4.2.10-stable";
+  rev = "184f682d431389803dd383668f52729cf26e23db";
+  hash = "sha256-UCRwnrIY/j0gdjFnNmR5U7VZeBRqA96mIt6AEKRJQ5Q=";
   lts = false;
 }
diff --git a/pkgs/by-name/cu/cups-kyocera-ecosys-m2x35-40-p2x35-40dnw/package.nix b/pkgs/by-name/cu/cups-kyocera-ecosys-m2x35-40-p2x35-40dnw/package.nix
deleted file mode 100644
index 5985d2efebdc..000000000000
--- a/pkgs/by-name/cu/cups-kyocera-ecosys-m2x35-40-p2x35-40dnw/package.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  stdenv,
-  lib,
-  fetchzip,
-  # can either be "EU" or "Global"; it's unclear what the difference is
-  region ? "Global",
-  # can be either "English", "French", "German", "Italian", "Portguese" or "Spanish"
-  language ? "English",
-}:
-
-stdenv.mkDerivation rec {
-  pname = "cups-kyocera-ecosys-m2x35-40-p2x35-40dnw";
-  version = "8.1606";
-
-  src =
-    let
-      urlVersion = builtins.replaceStrings [ "." ] [ "_" ] version;
-    in
-    fetchzip {
-      url = "https://www.kyoceradocumentsolutions.de/content/download-center/de/drivers/all/Linux_${urlVersion}_ECOSYS_M2x35_40_P2x35_40dnw_zip.download.zip";
-      sha256 = "10crxdfj62ini70vv471445zi6q0l9fmg2jsd74sp6fr0qa0kvr7";
-    };
-
-  installPhase = ''
-    mkdir -p $out/share/cups/model/Kyocera
-    cp ${region}/${language}/*.PPD $out/share/cups/model/Kyocera/
-  '';
-
-  meta = {
-    description = "PPD files for Kyocera ECOSYS M2040dn/M2135dn/M2540dn/M2540dw/M2635dn/M2635dw/M2640idw/M2735dw/P2040dn/M2040dw/P2235dn/P2235dw";
-    homepage = "https://www.kyoceradocumentsolutions.com";
-    license = lib.licenses.unfree;
-    maintainers = with lib.maintainers; [ hexa ];
-    platforms = lib.platforms.linux;
-  };
-}
diff --git a/pkgs/by-name/ed/edhm-ui/package.nix b/pkgs/by-name/ed/edhm-ui/package.nix
index 174f0c806dbf..b5bd92b4f4e3 100644
--- a/pkgs/by-name/ed/edhm-ui/package.nix
+++ b/pkgs/by-name/ed/edhm-ui/package.nix
@@ -28,13 +28,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "edhm-ui";
-  version = "3.0.64";
+  version = "3.0.67";
 
   strictDeps = true;
 
   src = fetchzip {
     url = "https://github.com/BlueMystical/EDHM_UI/releases/download/v${finalAttrs.version}/edhm-ui-v3-linux-x64.zip";
-    hash = "sha256-kBCaQKGO8ySpquEWh91GyqHfHCem5q1gyVdYuWdaMB8=";
+    hash = "sha256-JhWHub1YmdSJXZcyOK97/5TnBsKVN0dg7nwqg0EP7H8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/es/es/package.nix b/pkgs/by-name/es/es/package.nix
index d9a04958c8a7..bc0e1df97fad 100644
--- a/pkgs/by-name/es/es/package.nix
+++ b/pkgs/by-name/es/es/package.nix
@@ -1,8 +1,8 @@
 {
   lib,
   stdenv,
-  fetchpatch,
-  fetchurl,
+  fetchFromGitHub,
+  autoreconfHook,
   readline,
   bison,
 }:
@@ -10,31 +10,20 @@
 stdenv.mkDerivation (finalAttrs: {
 
   pname = "es";
-  version = "0.9.2";
+  version = "0.10.0";
 
-  src = fetchurl {
-    url = "https://github.com/wryun/es-shell/releases/download/v${finalAttrs.version}/es-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-ySZIK0IITpA+uHHuHrDO/Ana5vGt64QI3Z6TMDXE9d0=";
+  src = fetchFromGitHub {
+    owner = "wryun";
+    repo = "es-shell";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Rm0hG3B93p1lFb6IlnKYXtSxuRSIa2AT3SiAjMSb/oc=";
   };
 
-  # The distribution tarball does not have a single top-level directory.
-  preUnpack = ''
-    mkdir $name
-    cd $name
-    sourceRoot=.
-  '';
-
-  patches = [
-    (fetchpatch {
-      # https://github.com/wryun/es-shell/pull/101
-      name = "new-compiler-issues.patch";
-      url = "https://github.com/wryun/es-shell/commit/1eafb5fc4be735e59c9a091cc30adbca8f86fd96.patch";
-      hash = "sha256-0CV1seEiH6PsUnq0akPLiRMy+kIb9qnAK7Ta4I47i60=";
-    })
-  ];
-
   strictDeps = true;
-  nativeBuildInputs = [ bison ];
+  nativeBuildInputs = [
+    autoreconfHook
+    bison
+  ];
   buildInputs = [ readline ];
 
   configureFlags = [ "--with-readline" ];
diff --git a/pkgs/by-name/ex/exhaustive/fix-go125.patch b/pkgs/by-name/ex/exhaustive/fix-go125.patch
new file mode 100644
index 000000000000..f2cec17aa854
--- /dev/null
+++ b/pkgs/by-name/ex/exhaustive/fix-go125.patch
@@ -0,0 +1,127 @@
+diff --git a/Makefile b/Makefile
+index 868f7fc..2e4d94d 100644
+--- a/Makefile
++++ b/Makefile
+@@ -24,7 +24,6 @@ cover:
+ 
+ .PHONY: install-vet
+ install-vet:
+-	go install github.com/nishanths/exhaustive/cmd/exhaustive@latest
+ 	go install github.com/gordonklaus/ineffassign@latest
+ 	go install github.com/kisielk/errcheck@latest
+ 	go install honnef.co/go/tools/cmd/staticcheck@latest
+@@ -32,7 +31,6 @@ install-vet:
+ .PHONY: vet
+ vet:
+ 	go vet ./...
+-	exhaustive ./...
+ 	ineffassign ./...
+ 	errcheck ./...
+ 	staticcheck -checks="inherit,-S1034" ./...
+diff --git a/common.go b/common.go
+index 71bc8d5..bf30ff7 100644
+--- a/common.go
++++ b/common.go
+@@ -73,6 +73,9 @@ func fromTypeParam(pass *analysis.Pass, tp *types.TypeParam, typeparam bool) (re
+ 
+ func fromType(pass *analysis.Pass, t types.Type, typeparam bool) (result []enumTypeAndMembers, ok bool) {
+ 	switch t := t.(type) {
++	case *types.Alias:
++		return fromType(pass, types.Unalias(t), typeparam)
++
+ 	case *types.Named:
+ 		return fromNamed(pass, t, typeparam)
+ 
+diff --git a/enum.go b/enum.go
+index e95e78e..1960edd 100644
+--- a/enum.go
++++ b/enum.go
+@@ -144,7 +144,7 @@ func possibleEnumMember(constName *ast.Ident, info *types.Info) (et enumType, na
+ 		return enumType{}, "", "", false
+ 	}
+ 
+-	named := obj.Type().(*types.Named) // guaranteed by validNamedBasic
++	named := types.Unalias(obj.Type()).(*types.Named) // guaranteed by validNamedBasic
+ 	tn := named.Obj()
+ 
+ 	// By definition, enum type's scope and enum member's scope must be the
+@@ -216,8 +216,9 @@ func hasIgnoreDecl(pass *analysis.Pass, doc *ast.CommentGroup) bool {
+ //
+ // The following is guaranteed:
+ //
+-//	validNamedBasic(t) == true => t.(*types.Named)
++//	validNamedBasic(t) == true => types.Unalias(t).(*types.Named)
+ func validNamedBasic(t types.Type) bool {
++	t = types.Unalias(t)
+ 	named, ok := t.(*types.Named)
+ 	if !ok {
+ 		return false
+diff --git a/go.mod b/go.mod
+index 0a3984a..d3caaf5 100644
+--- a/go.mod
++++ b/go.mod
+@@ -1,10 +1,10 @@
+ module github.com/nishanths/exhaustive
+
+-go 1.18
++go 1.24.0
+
+-require golang.org/x/tools v0.15.0
++require golang.org/x/tools v0.38.0
+
+ require (
+-	golang.org/x/mod v0.14.0 // indirect
+-	golang.org/x/sys v0.14.0 // indirect
++	golang.org/x/mod v0.29.0 // indirect
++	golang.org/x/sync v0.17.0 // indirect
+ )
+diff --git a/go.sum b/go.sum
+index 3041532..9b34f09 100644
+--- a/go.sum
++++ b/go.sum
+@@ -1,7 +1,8 @@
+-golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
+-golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+-golang.org/x/sync v0.5.0 h1:60k92dhOjHxJkrqnwsfl8KuaHbn/5dl0lUPUklKo3qE=
+-golang.org/x/sys v0.14.0 h1:Vz7Qs629MkJkGyHxUlRHizWJRG2j8fbQKjELVSNhy7Q=
+-golang.org/x/sys v0.14.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+-golang.org/x/tools v0.15.0 h1:zdAyfUGbYmuVokhzVmghFl2ZJh5QhcfebBgmVPFYA+8=
+-golang.org/x/tools v0.15.0/go.mod h1:hpksKq4dtpQWS1uQ61JkdqWM3LscIS6Slf+VVkm+wQk=
++github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
++github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
++golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA=
++golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w=
++golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
++golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
++golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
++golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
+diff --git a/map.go b/map.go
+index aa5e9bd..4243f32 100644
+--- a/map.go
++++ b/map.go
+@@ -34,16 +34,18 @@ func mapChecker(pass *analysis.Pass, cfg mapConfig, generated boolCache, comment
+ 
+ 		lit := n.(*ast.CompositeLit)
+ 
+-		mapType, ok := pass.TypesInfo.Types[lit.Type].Type.(*types.Map)
+-		if !ok {
+-			namedType, ok2 := pass.TypesInfo.Types[lit.Type].Type.(*types.Named)
+-			if !ok2 {
+-				return true, resultNotMapLiteral
+-			}
+-			mapType, ok = namedType.Underlying().(*types.Map)
++		var mapType *types.Map
++		switch tt := types.Unalias(pass.TypesInfo.Types[lit.Type].Type).(type) {
++		case *types.Map:
++			mapType = tt
++		case *types.Named:
++			var ok bool
++			mapType, ok = tt.Underlying().(*types.Map)
+ 			if !ok {
+ 				return true, resultNotMapLiteral
+ 			}
++		default:
++			return true, resultNotMapLiteral
+ 		}
+ 
+ 		if len(lit.Elts) == 0 {
diff --git a/pkgs/by-name/ex/exhaustive/package.nix b/pkgs/by-name/ex/exhaustive/package.nix
index 7775421da45d..de929a7b6f87 100644
--- a/pkgs/by-name/ex/exhaustive/package.nix
+++ b/pkgs/by-name/ex/exhaustive/package.nix
@@ -16,7 +16,12 @@ buildGoModule (finalAttrs: {
     hash = "sha256-OLIdtKzCqnBkzdUSIl+UlENeMl3zrBE47pLWPg+6qXw=";
   };
 
-  vendorHash = "sha256-DyN2z6+lA/163k6TTQZ+ypm9s2EV93zvSo/yKQZXvCg=";
+  vendorHash = "sha256-jTKzfQnqCN15EOzAWGTHtolWFNj/0g4ay0ckgoa2E34=";
+
+  patches = [
+    # https://github.com/nishanths/exhaustive/pull/85
+    ./fix-go125.patch
+  ];
 
   ldflags = [
     "-s"
diff --git a/pkgs/by-name/fe/feishu-cli/package.nix b/pkgs/by-name/fe/feishu-cli/package.nix
index e6f66c86adc1..e399239f37d9 100644
--- a/pkgs/by-name/fe/feishu-cli/package.nix
+++ b/pkgs/by-name/fe/feishu-cli/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "feishu-cli";
-  version = "1.22.0";
+  version = "1.25.0";
 
   src = fetchFromGitHub {
     owner = "riba2534";
     repo = "feishu-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-n7CqaVpuzJg5oPI7RixvDp8xSA93292yY9K8jmzd+68=";
+    hash = "sha256-kdGSptmdBqtlgDhwSqx4kv47uNS1LcBDkfYWVR6vRwY=";
   };
 
   vendorHash = "sha256-MZv772U+3+Fcanaiuhz+OCqfIsYyCG7B4iZOnEftbi8=";
diff --git a/pkgs/by-name/go/got/package.nix b/pkgs/by-name/go/got/package.nix
index 9a2bd95358fe..bdcc557e20aa 100644
--- a/pkgs/by-name/go/got/package.nix
+++ b/pkgs/by-name/go/got/package.nix
@@ -25,11 +25,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "got";
-  version = "0.123";
+  version = "0.125";
 
   src = fetchurl {
     url = "https://gameoftrees.org/releases/portable/got-portable-${finalAttrs.version}.tar.gz";
-    hash = "sha256-U655XwPi7k9Glr+FdoqafWSkc/IGIvzIUI+iRswohSY=";
+    hash = "sha256-rdYZgBBzZDcq64Foe8WKZsDQyeCixKm7ttNxT7RSuqw=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gr/grafana-loki/package.nix b/pkgs/by-name/gr/grafana-loki/package.nix
index cbe588cfb5b4..c712c39e49eb 100644
--- a/pkgs/by-name/gr/grafana-loki/package.nix
+++ b/pkgs/by-name/gr/grafana-loki/package.nix
@@ -9,14 +9,14 @@
 }:
 
 buildGoModule (finalAttrs: {
-  version = "3.7.1";
+  version = "3.7.2";
   pname = "grafana-loki";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "loki";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-SSsTwqk6Cebk5dtSdPQzn3jrwMluoQgsd8JsV2WhaTY=";
+    hash = "sha256-2VM5/SMgjxHraP+7H+AmDor9g4r+xglhqd/cVL7mCgQ=";
   };
 
   vendorHash = null;
diff --git a/pkgs/by-name/gr/grpc-health-probe/package.nix b/pkgs/by-name/gr/grpc-health-probe/package.nix
index 58f26a4cff3c..5acbf091b81a 100644
--- a/pkgs/by-name/gr/grpc-health-probe/package.nix
+++ b/pkgs/by-name/gr/grpc-health-probe/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "grpc-health-probe";
-  version = "0.4.49";
+  version = "0.4.50";
 
   src = fetchFromGitHub {
     owner = "grpc-ecosystem";
     repo = "grpc-health-probe";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-JH4Km8nlUffkga7oKgXXwqRYm/8oG9giLCFn1BZ1eVY=";
+    hash = "sha256-gNQJeAeQTNhvtA7hP+9nS6MGnhwoayNub2o5S/oKWHU=";
   };
 
   tags = [
@@ -25,7 +25,7 @@ buildGoModule (finalAttrs: {
     "-X main.versionTag=${finalAttrs.version}"
   ];
 
-  vendorHash = "sha256-97OFqr93G/6F58nF1riGFbCOtORPojMMU4IX9ivjSxg=";
+  vendorHash = "sha256-72nRpe4FIclZDpYw56UewFJRU2NBbuQ0M8HKYwqJU34=";
 
   nativeInstallCheckInputs = [
     versionCheckHook
diff --git a/pkgs/by-name/ka/kanban/package.nix b/pkgs/by-name/ka/kanban/package.nix
index f435fcbdfb7c..e1f27b49d744 100644
--- a/pkgs/by-name/ka/kanban/package.nix
+++ b/pkgs/by-name/ka/kanban/package.nix
@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "kanban";
-  version = "0.3.5";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "fulsomenko";
     repo = "kanban";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MIj1wSCKYg7bLj9sPGU/5peZX0i3J5crUzjcuJeF6O8=";
+    hash = "sha256-6L+f4+A9mRZch7/D1koCMHrkciusKcoZhYJICEDU4b8=";
   };
 
   env.GIT_COMMIT_HASH = finalAttrs.src.rev;
 
-  cargoHash = "sha256-vCBHnYUpyyZcatAVaBVslng9EBrRkk5BzePcPZ07vtc=";
+  cargoHash = "sha256-NMFZW+LC5YYqbXCmgbmUyAx8O+M7o1TKigOC978k0/o=";
 
   passthru.updateScript = nix-update-script { };
 
diff --git a/pkgs/by-name/li/libmediainfo/package.nix b/pkgs/by-name/li/libmediainfo/package.nix
index 7dd51e377221..5597609ebe35 100644
--- a/pkgs/by-name/li/libmediainfo/package.nix
+++ b/pkgs/by-name/li/libmediainfo/package.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libmediainfo";
-  version = "26.01";
+  version = "26.05";
 
   src = fetchurl {
     url = "https://mediaarea.net/download/source/libmediainfo/${finalAttrs.version}/libmediainfo_${finalAttrs.version}.tar.xz";
-    hash = "sha256-vNPSzBLPEIyg+60HVoswMlfnKv2P9z0Fz+a3qg5mocU=";
+    hash = "sha256-wIsth7L7XttFJsKooxfrHyz/RIB+RjGgN8qfmh1FUFQ=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mi/miniflux/package.nix b/pkgs/by-name/mi/miniflux/package.nix
index 298264a8d686..97d82e14f84b 100644
--- a/pkgs/by-name/mi/miniflux/package.nix
+++ b/pkgs/by-name/mi/miniflux/package.nix
@@ -9,16 +9,16 @@
 
 buildGo126Module (finalAttrs: {
   pname = "miniflux";
-  version = "2.2.19";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     owner = "miniflux";
     repo = "v2";
     tag = finalAttrs.version;
-    hash = "sha256-/zAO6LgT4BKGaLJNgfm2c0VCtpc/9jQmM6zmfnpJtYo=";
+    hash = "sha256-AF5wiFLXtyf0ZxfVu0zdXcVExm7Zoh/wYS9FuSjfipk=";
   };
 
-  vendorHash = "sha256-zQURNCImYB66agRnorqLzvQKNNZb1o9ZVOVuETjQ0RE=";
+  vendorHash = "sha256-9qHe21/Qu2OInjcn4gQOh3LEQ1iqT6rzm8agj+YUD68=";
 
   nativeBuildInputs = [ installShellFiles ];
 
diff --git a/pkgs/by-name/mu/music-assistant/package.nix b/pkgs/by-name/mu/music-assistant/package.nix
index b83e5b43f137..23610a242dd2 100644
--- a/pkgs/by-name/mu/music-assistant/package.nix
+++ b/pkgs/by-name/mu/music-assistant/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   python3,
   fetchFromGitHub,
   ffmpeg_7-headless,
@@ -214,6 +215,7 @@ python.pkgs.buildPythonApplication rec {
   };
 
   meta = {
+    broken = stdenv.hostPlatform.isDarwin;
     changelog = "https://github.com/music-assistant/server/releases/tag/${version}";
     description = "Music Assistant is a music library manager for various music sources which can easily stream to a wide range of supported players";
     longDescription = ''
diff --git a/pkgs/by-name/nd/ndppd/package.nix b/pkgs/by-name/nd/ndppd/package.nix
index 5340b7347ec5..bcc227e4ee5a 100644
--- a/pkgs/by-name/nd/ndppd/package.nix
+++ b/pkgs/by-name/nd/ndppd/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ndppd";
-  version = "0.2.5";
+  version = "0.2.6";
 
   src = fetchFromGitHub {
     owner = "DanielAdolfsson";
     repo = "ndppd";
     rev = finalAttrs.version;
-    sha256 = "0niri5q9qyyyw5lmjpxk19pv3v4srjvmvyd5k6ks99mvqczjx9c0";
+    sha256 = "sha256-FqOoN7MxewmOxd4SKnOx4W/c3X4Jso/kFdiTzIRqHaw=";
   };
 
   nativeBuildInputs = [ gzip ];
diff --git a/pkgs/by-name/ni/nixpkgs-review/package.nix b/pkgs/by-name/ni/nixpkgs-review/package.nix
index f0aa8faf6ce9..ff037e9b7549 100644
--- a/pkgs/by-name/ni/nixpkgs-review/package.nix
+++ b/pkgs/by-name/ni/nixpkgs-review/package.nix
@@ -26,6 +26,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
   version = "3.8.0";
   pyproject = true;
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = "nixpkgs-review";
diff --git a/pkgs/by-name/no/notify-osd-customizable/package.nix b/pkgs/by-name/no/notify-osd-customizable/package.nix
deleted file mode 100644
index 38ba69f7bcc5..000000000000
--- a/pkgs/by-name/no/notify-osd-customizable/package.nix
+++ /dev/null
@@ -1,60 +0,0 @@
-{
-  lib,
-  stdenv,
-  dbus-glib,
-  fetchurl,
-  glib,
-  gnome-common,
-  libnotify,
-  libtool,
-  libwnck,
-  makeWrapper,
-  pkg-config,
-  gsettings-desktop-schemas,
-}:
-
-let
-  baseURI = "https://launchpad.net/~leolik/+archive/leolik";
-in
-stdenv.mkDerivation (finalAttrs: {
-  pname = "notify-osd";
-  version = "0.9.35+16.04.20160415";
-
-  src = fetchurl {
-    url = "${baseURI}/+files/notify-osd_${finalAttrs.version}-0ubuntu1-leolik~ppa0.tar.gz";
-    sha256 = "026dr46jh3xc4103wnslzy7pxbxkkpflh52c59j8vzwaa7bvvzkv";
-    name = "notify-osd-customizable.tar.gz";
-  };
-
-  preConfigure = "./autogen.sh --libexecdir=$(out)/bin";
-
-  nativeBuildInputs = [
-    pkg-config
-    makeWrapper
-    libtool
-  ];
-  buildInputs = [
-    glib
-    libwnck
-    libnotify
-    dbus-glib
-    gsettings-desktop-schemas
-    gnome-common
-  ];
-
-  configureFlags = [ "--libexecdir=$(out)/bin" ];
-
-  preFixup = ''
-    wrapProgram "$out/bin/notify-osd" \
-      --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH"
-  '';
-
-  meta = {
-    description = "Daemon that displays passive pop-up notifications";
-    mainProgram = "notify-osd";
-    homepage = "https://launchpad.net/notify-osd";
-    license = lib.licenses.gpl3;
-    maintainers = [ lib.maintainers.imalison ];
-    platforms = lib.platforms.linux;
-  };
-})
diff --git a/pkgs/by-name/ox/oxlint/package.nix b/pkgs/by-name/ox/oxlint/package.nix
index b0d806ba2f23..670eccf406a2 100644
--- a/pkgs/by-name/ox/oxlint/package.nix
+++ b/pkgs/by-name/ox/oxlint/package.nix
@@ -23,25 +23,25 @@
 # runs without an external linter, which leaves `jsPlugins` configs inert.
 stdenv.mkDerivation (finalAttrs: {
   pname = "oxlint";
-  version = "1.63.0";
+  version = "1.65.0";
 
   src = fetchFromGitHub {
     owner = "oxc-project";
     repo = "oxc";
     tag = "oxlint_v${finalAttrs.version}";
-    hash = "sha256-nB9Z5GACDfmP+y3bGjNB8KKlOWV+kBCq56i7FLekyss=";
+    hash = "sha256-sEc4+FQKzYcKW33AwXzl0A1gNucSbpROYrY0pzVKhE8=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-1TsKLbReN7zvH5RnbmszPbj2/40jySgFgADcFKjn87s=";
+    hash = "sha256-9YTUpr52HSnixGwmuArQVmvvVPHM2um4642FUP8h3lY=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 3;
-    hash = "sha256-ws46dHtlaVbTRlOx4xx6gcB+ySKCc+e0K8ZUmCAJ2wY=";
+    hash = "sha256-C2WEaxluYXmBl4UG4V444lWeKa7+7zcsY3B7Dz7nEqA=";
   };
 
   dontUseCmakeConfigure = true;
diff --git a/pkgs/by-name/po/powershell-editor-services/package.nix b/pkgs/by-name/po/powershell-editor-services/package.nix
index 6782f302a82c..70291f9e5b96 100644
--- a/pkgs/by-name/po/powershell-editor-services/package.nix
+++ b/pkgs/by-name/po/powershell-editor-services/package.nix
@@ -7,11 +7,11 @@
 }:
 stdenvNoCC.mkDerivation rec {
   pname = "powershell-editor-services";
-  version = "4.5.0";
+  version = "4.6.0";
 
   src = fetchzip {
     url = "https://github.com/PowerShell/PowerShellEditorServices/releases/download/v${version}/PowerShellEditorServices.zip";
-    hash = "sha256-25nKcJ0Q9Kk2LEVutqxPPQvG+/hmeHsmUG01vmOsFqg=";
+    hash = "sha256-3h5LQj63fAZ0RZJykiKOKLgJWPJXCTVL+4k7FKrmnK0=";
     stripRoot = false;
   };
 
diff --git a/pkgs/by-name/pr/proton-vpn/linux.nix b/pkgs/by-name/pr/proton-vpn/linux.nix
index a593f473279f..1423a4cfffb8 100644
--- a/pkgs/by-name/pr/proton-vpn/linux.nix
+++ b/pkgs/by-name/pr/proton-vpn/linux.nix
@@ -62,12 +62,12 @@ python3Packages.buildPythonApplication (finalAttrs: {
   '';
 
   postInstall = ''
-    mkdir -p $out/share/{applications,pixmaps}
+    mkdir -p $out/share/applications
 
     # Fix the desktop file to correctly identify the wrapped app and show the icon during runtime
     substitute ${finalAttrs.src}/rpmbuild/SOURCES/proton.vpn.app.gtk.desktop $out/share/applications/proton.vpn.app.gtk.desktop \
       --replace-fail "StartupWMClass=protonvpn-app" "StartupWMClass=.protonvpn-app-wrapped"
-    install -Dm 644 ${finalAttrs.src}/rpmbuild/SOURCES/proton-vpn-logo.svg $out/share/pixmaps
+    install -Dm444 ${finalAttrs.src}/rpmbuild/SOURCES/proton-vpn-logo.svg -t $out/share/icons/hicolor/scalable/apps
   '';
 
   preCheck = ''
diff --git a/pkgs/by-name/pv/pvz-portable-unwrapped/package.nix b/pkgs/by-name/pv/pvz-portable-unwrapped/package.nix
index 574d0119e319..d36ab6b023e2 100644
--- a/pkgs/by-name/pv/pvz-portable-unwrapped/package.nix
+++ b/pkgs/by-name/pv/pvz-portable-unwrapped/package.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pvz-portable-unwrapped";
-  version = "0.1.22";
+  version = "0.1.23";
 
   src = fetchFromGitHub {
     owner = "wszqkzqk";
     repo = "PvZ-Portable";
     tag = finalAttrs.version;
-    hash = "sha256-H+YY2jTnsbnPzRhiOBqzzkVNJsFzoT6hMZpOTnB5mtA=";
+    hash = "sha256-nVCODhjumC6R/1J5F0EvW4bwOr8Jn2Ed/AgdsUcFWr8=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/py/pyenv/package.nix b/pkgs/by-name/py/pyenv/package.nix
index 34d8a37c009a..9b192b2c87a2 100644
--- a/pkgs/by-name/py/pyenv/package.nix
+++ b/pkgs/by-name/py/pyenv/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pyenv";
-  version = "2.6.29";
+  version = "2.6.31";
 
   src = fetchFromGitHub {
     owner = "pyenv";
     repo = "pyenv";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RS/aqQWXqM2ByK4PZY8qN2I7KSsbzsGkkyqtnRUWfmE=";
+    hash = "sha256-WFQDjfSyu1DfFiLwqxH6wu6bYsxD5H66qWLCo+Xfmvo=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/re/reredirect/package.nix b/pkgs/by-name/re/reredirect/package.nix
index 90bb734e7a90..9e3555dba73a 100644
--- a/pkgs/by-name/re/reredirect/package.nix
+++ b/pkgs/by-name/re/reredirect/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -15,6 +16,14 @@ stdenv.mkDerivation (finalAttrs: {
     sha256 = "sha256-RHRamDo7afnJ4DlOVAqM8lQAC60YESGSMKa8Io2vcX0=";
   };
 
+  patches = [
+    # Fixes gcc-15 build.
+    (fetchpatch2 {
+      url = "https://github.com/jerome-pouiller/reredirect/commit/b85df395e18d09b54e1fb73dfe344f8f04224a83.patch";
+      hash = "sha256-RTzJrgiJGmUf0iVaSvXw/NLwWRTch1aLdDdLp50sAD8=";
+    })
+  ];
+
   makeFlags = [ "PREFIX=${placeholder "out"}" ];
 
   postFixup = ''
diff --git a/pkgs/by-name/re/retroarch-bare/package.nix b/pkgs/by-name/re/retroarch-bare/package.nix
index bc6c5cc4adc3..c0d8d7442a8c 100644
--- a/pkgs/by-name/re/retroarch-bare/package.nix
+++ b/pkgs/by-name/re/retroarch-bare/package.nix
@@ -138,6 +138,10 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString enableNvidiaCgToolkit ''
       wrapProgram $out/bin/retroarch-cg2glsl \
         --prefix PATH ':' ${lib.makeBinPath [ nvidia_cg_toolkit ]}
+    ''
+    + ''
+      mkdir -p $out/share/icons/hicolor/scalable
+      mv $out/share/{pixmaps,icons/hicolor/scalable/apps}
     '';
 
   preFixup = lib.optionalString (!enableNvidiaCgToolkit) ''
diff --git a/pkgs/by-name/ri/ringing-lib/package.nix b/pkgs/by-name/ri/ringing-lib/package.nix
index 9293906d1e38..1c188309ff99 100644
--- a/pkgs/by-name/ri/ringing-lib/package.nix
+++ b/pkgs/by-name/ri/ringing-lib/package.nix
@@ -2,7 +2,6 @@
   stdenv,
   fetchFromGitHub,
   lib,
-  autoreconfHook,
   pkg-config,
   readline,
   xercesc,
@@ -11,17 +10,16 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ringing-lib";
-  version = "0-unstable-2025-07-16";
+  version = "0-unstable-2026-05-12";
 
   src = fetchFromGitHub {
     owner = "ringing-lib";
     repo = "ringing-lib";
-    rev = "838d13edb3231d8c122d3222da1b465e2018757f";
-    hash = "sha256-MO5FerQMyWDV/cV2hrY/L+JyhMojtaqPQkw8efaVu1I=";
+    rev = "6d7533186fb89497ab059b91d0e7bd7911cd3f71";
+    hash = "sha256-yxf9w8USn9SVL4QW6XUWwR1rObvbj6Z69O3he3JiGT4=";
   };
 
   nativeBuildInputs = [
-    autoreconfHook
     pkg-config
   ];
   buildInputs = [
@@ -29,8 +27,12 @@ stdenv.mkDerivation (finalAttrs: {
     xercesc
   ];
 
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
   doCheck = true;
 
+  strictDeps = true;
+
   passthru.updateScript = unstableGitUpdater { hardcodeZeroVersion = true; };
   meta = {
     description = "Library of C++ classes and utilities for change ringing";
diff --git a/pkgs/by-name/ro/rosa/package.nix b/pkgs/by-name/ro/rosa/package.nix
index 1dedc60605b5..33b7316540a3 100644
--- a/pkgs/by-name/ro/rosa/package.nix
+++ b/pkgs/by-name/ro/rosa/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "rosa";
-  version = "1.2.62";
+  version = "1.2.63";
 
   src = fetchFromGitHub {
     owner = "openshift";
     repo = "rosa";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-vBIh4drMBd6BXkwmnBFzHuayLmgAX9DtXVENAGnJghY=";
+    hash = "sha256-8+4Ip9PGSIIfZ1zfkihrahh/65fBBAYWhVqdpeP0eB0=";
   };
   vendorHash = null;
 
diff --git a/pkgs/by-name/sl/slack/linux.nix b/pkgs/by-name/sl/slack/linux.nix
index dcd57b9145c3..d6b652bc19a0 100644
--- a/pkgs/by-name/sl/slack/linux.nix
+++ b/pkgs/by-name/sl/slack/linux.nix
@@ -151,6 +151,10 @@ stdenv.mkDerivation rec {
       --suffix PATH : ${lib.makeBinPath [ xdg-utils ]} \
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations,WebRTCPipeWireCapturer --enable-wayland-ime=true}}"
 
+    # Move the icon to a spec-compliant location
+    mkdir -p $out/share/icons/hicolor/512x512
+    mv $out/share/{pixmaps,icons/hicolor/512x512/apps}
+
     # Fix the desktop link
     substituteInPlace $out/share/applications/slack.desktop \
       --replace /usr/bin/ $out/bin/ \
diff --git a/pkgs/by-name/sp/spotatui/package.nix b/pkgs/by-name/sp/spotatui/package.nix
index 017f7e286be4..18492dc0b0cb 100644
--- a/pkgs/by-name/sp/spotatui/package.nix
+++ b/pkgs/by-name/sp/spotatui/package.nix
@@ -12,16 +12,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "spotatui";
-  version = "0.38.1";
+  version = "0.38.2";
 
   src = fetchFromGitHub {
     owner = "LargeModGames";
     repo = "spotatui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cHuqSnNLnR8LLYjjlrgJTEb/MJe4lBJP7GY3D7/AUqE=";
+    hash = "sha256-PX6hQUTHClZMW+XPYdSjQ5YvmW1rMXElw18tk/lMSgc=";
   };
 
-  cargoHash = "sha256-dlEsghdnNVbi086WgNImUcM+OO7vuBaNit3Wcaw5/mA=";
+  cargoHash = "sha256-yBXwtlgcfsIViiZ57yPwl2lfTS04e0gKoYzr+VHoD6o=";
 
   nativeBuildInputs = [ pkg-config ] ++ lib.optional withPipewireVisualizer rustPlatform.bindgenHook;
 
diff --git a/pkgs/by-name/ss/ssimulacra2/package.nix b/pkgs/by-name/ss/ssimulacra2/package.nix
index 9c7fb5839bdb..d7ce465793ac 100644
--- a/pkgs/by-name/ss/ssimulacra2/package.nix
+++ b/pkgs/by-name/ss/ssimulacra2/package.nix
@@ -37,6 +37,9 @@ stdenv.mkDerivation (finalAttrs: {
         hash = "sha256-v2HyyHtBydr7QiI83DW1yRv2kWjUOGxFT6mmdrN9XPo=";
       };
       patches = [ ];
+      postPatch = ''
+        substituteInPlace CMakeLists.txt --replace-fail "set(CMAKE_CXX_STANDARD 11)" "set(CMAKE_CXX_STANDARD 17)"
+      '';
     })
     lcms2
     giflib
@@ -55,5 +58,6 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = [ lib.maintainers.viraptor ];
     license = lib.licenses.bsd3;
     description = "Perceptual image comparison tool";
+    broken = stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64;
   };
 })
diff --git a/pkgs/by-name/sw/swiftformat/package.nix b/pkgs/by-name/sw/swiftformat/package.nix
index 4ff0ac0dafb8..08a57e6cdd4c 100644
--- a/pkgs/by-name/sw/swiftformat/package.nix
+++ b/pkgs/by-name/sw/swiftformat/package.nix
@@ -9,13 +9,13 @@
 
 swift.stdenv.mkDerivation rec {
   pname = "swiftformat";
-  version = "0.61.0";
+  version = "0.61.1";
 
   src = fetchFromGitHub {
     owner = "nicklockwood";
     repo = "SwiftFormat";
     rev = version;
-    sha256 = "sha256-+57Cuok7hIXaTZi699sIoqORFgFWEXfzl8P4sJkwFNE=";
+    sha256 = "sha256-h0d/vdoKZuYJkMO+TmFFgomaSVA94P+MKclSlBlIleE=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ta/tailscale/package.nix b/pkgs/by-name/ta/tailscale/package.nix
index a829a10cccfc..54aa9b3750a7 100644
--- a/pkgs/by-name/ta/tailscale/package.nix
+++ b/pkgs/by-name/ta/tailscale/package.nix
@@ -24,7 +24,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "tailscale";
-  version = "1.98.1";
+  version = "1.98.2";
 
   outputs = [
     "out"
@@ -35,7 +35,7 @@ buildGoModule (finalAttrs: {
     owner = "tailscale";
     repo = "tailscale";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bHn4AzlsTHQQPtJf724hIupW2kIFWt5blOzhe51CnvQ=";
+    hash = "sha256-y3JdVYnvfqrAlubnjrM2FD+PRXlNEzOM3yggSczb+rA=";
   };
 
   vendorHash = "sha256-mbxLXR2TBgiwyVGfLmMR5xWk+0f66mPDas95Wla70Lk=";
diff --git a/pkgs/by-name/ta/tartan/package.nix b/pkgs/by-name/ta/tartan/package.nix
index ba1bfcb20ee1..dbe20491888a 100644
--- a/pkgs/by-name/ta/tartan/package.nix
+++ b/pkgs/by-name/ta/tartan/package.nix
@@ -5,7 +5,7 @@
   meson,
   ninja,
   pkg-config,
-  llvmPackages,
+  llvmPackages_20,
   gobject-introspection,
   glib,
   unstableGitUpdater,
@@ -32,8 +32,9 @@ stdenv.mkDerivation {
   buildInputs = [
     gobject-introspection
     glib
-    llvmPackages.libclang
-    llvmPackages.libllvm
+    # https://gitlab.freedesktop.org/tartan/tartan/-/merge_requests/29
+    llvmPackages_20.libclang
+    llvmPackages_20.libllvm
   ];
 
   passthru = {
diff --git a/pkgs/by-name/td/tdns-cli/package.nix b/pkgs/by-name/td/tdns-cli/package.nix
index e16e62e323bc..406d02d3d91e 100644
--- a/pkgs/by-name/td/tdns-cli/package.nix
+++ b/pkgs/by-name/td/tdns-cli/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage {
   pname = "tdns-cli";
-  version = "unstable-2021-02-19";
+  version = "0.0.5-unstable-2026-02-23";
 
   src = fetchFromGitHub {
     owner = "rotty";
     repo = "tdns-cli";
-    rev = "9a5455fe8a52f3f14dc55ef81511b479c8cd70ea";
-    hash = "sha256-BGxkqlKg81izq4eOBEZFJ/MPb3UCSOo8ZTYTjtjierk=";
+    rev = "404ba636e031ff6101da633d3a572b1b075c0f37";
+    hash = "sha256-e1JEQQI8226Ey5b3Z02xEAfy22eLPC10ANQVHAM7hDs=";
   };
 
-  cargoHash = "sha256-KDZGTGLHLuZgFtzIp+lL0VIiQcYspvxAivp7hVE9V/A=";
+  cargoHash = "sha256-G6YVZf2TxtIvEEeUtHWDITQfUayhEjS2QtXNSsvwg2M=";
 
   meta = {
     description = "DNS tool that aims to replace dig and nsupdate";
diff --git a/pkgs/by-name/tu/turbo-unwrapped/package.nix b/pkgs/by-name/tu/turbo-unwrapped/package.nix
index 526147fe0248..c1ef21df92f4 100644
--- a/pkgs/by-name/tu/turbo-unwrapped/package.nix
+++ b/pkgs/by-name/tu/turbo-unwrapped/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   capnproto,
-  kdePackages,
   fetchFromGitHub,
   fontconfig,
   installShellFiles,
@@ -18,20 +17,19 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "turbo-unwrapped";
-  version = "2.9.6";
+  version = "2.9.14";
 
   src = fetchFromGitHub {
     owner = "vercel";
     repo = "turborepo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-baERDG5/r64Tn1Ay6ikFJfZLeR//88Fl42TPbLj6IrQ=";
+    hash = "sha256-4854TMHj6mqzWnCcSwRcbkBQQlLaevwP63gk9IXBUhA=";
   };
 
-  cargoHash = "sha256-+ptA25gdZfZwr8+6qUSzYvc66WyaBwvXFRlhUiYSNVA=";
+  cargoHash = "sha256-3iFUpt33oyMnY/NomIz0mvYqRPK1ltyr8wSd9DMfB/Q=";
 
   nativeBuildInputs = [
     capnproto
-    kdePackages.extra-cmake-modules
     installShellFiles
     pkg-config
     protobuf
diff --git a/pkgs/by-name/uh/uhexen2/package.nix b/pkgs/by-name/uh/uhexen2/package.nix
index 94532049a226..d12906454201 100644
--- a/pkgs/by-name/uh/uhexen2/package.nix
+++ b/pkgs/by-name/uh/uhexen2/package.nix
@@ -45,6 +45,8 @@ stdenv.mkDerivation {
     )
   '';
 
+  NIX_CFLAGS_COMPILE = "-std=gnu17";
+
   buildPhase = ''
     runHook preBuild
     for makefile in "''${makeFiles[@]}"; do
diff --git a/pkgs/by-name/up/upscaler/package.nix b/pkgs/by-name/up/upscaler/package.nix
index f9263e5f884e..942f1a38457a 100644
--- a/pkgs/by-name/up/upscaler/package.nix
+++ b/pkgs/by-name/up/upscaler/package.nix
@@ -18,7 +18,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "upscaler";
-  version = "1.6.2";
+  version = "1.6.3";
 
   pyproject = false; # meson instead of pyproject
 
@@ -27,7 +27,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "World";
     repo = "Upscaler";
     rev = finalAttrs.version;
-    hash = "sha256-Mt0bFPidg0/bxd3NP+1jVgWzRemaGKlU/l5orKbziB0=";
+    hash = "sha256-h+m5YOnsWFmQH0FxYrGbUzGMr38HhnkHegJl4daRXAs=";
   };
 
   passthru.updateScript = gitUpdater { };
diff --git a/pkgs/by-name/va/vale/package.nix b/pkgs/by-name/va/vale/package.nix
index c91a81ebbf76..45e1a7f9c349 100644
--- a/pkgs/by-name/va/vale/package.nix
+++ b/pkgs/by-name/va/vale/package.nix
@@ -11,7 +11,7 @@
 
 buildGoModule rec {
   pname = "vale";
-  version = "3.14.1";
+  version = "3.14.2";
 
   subPackages = [ "cmd/vale" ];
 
@@ -19,10 +19,10 @@ buildGoModule rec {
     owner = "errata-ai";
     repo = "vale";
     tag = "v${version}";
-    hash = "sha256-vzOUBqoD3zwPHDN8fWn+gEWU9+EDNO92uqI6ub2of9A=";
+    hash = "sha256-cjJ1LDTIaEJaaQigcofi+CfsSVWf3IRsUmxh/T9W7ec=";
   };
 
-  vendorHash = "sha256-jyDvC/UOqkZf8sgHl/jJ8dWPnWWmDIRJDSGgT0bWkb4=";
+  vendorHash = "sha256-Nu0Sof5Aek754dNo/jXI1cv6G2k1tNBIigIT82iGAzk=";
 
   ldflags = [
     "-s"
diff --git a/pkgs/development/compilers/ocaml/ber-metaocaml.nix b/pkgs/development/compilers/ocaml/ber-metaocaml.nix
index 778aac812808..38df7bddbacd 100644
--- a/pkgs/development/compilers/ocaml/ber-metaocaml.nix
+++ b/pkgs/development/compilers/ocaml/ber-metaocaml.nix
@@ -16,9 +16,9 @@ let
   ];
   inherit (lib) optionals;
 
-  baseOcamlBranch = "4.14";
-  baseOcamlVersion = "${baseOcamlBranch}.1";
-  metaocamlPatch = "114";
+  baseOcamlBranch = "5.3";
+  baseOcamlVersion = "${baseOcamlBranch}.0";
+  metaocamlPatch = "153";
 in
 
 stdenv.mkDerivation rec {
@@ -27,12 +27,12 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://caml.inria.fr/pub/distrib/ocaml-${baseOcamlBranch}/ocaml-${baseOcamlVersion}.tar.gz";
-    sha256 = "sha256-GDl53JwJyw9YCiMraFMaCbAlqmKLjY1ydEnxRv1vX+4=";
+    sha256 = "sha256-IsHdneIb9Dti0ZCQQftfrWSJBSJ79pVQpqa+8x5lTzg=";
   };
 
   metaocaml = fetchurl {
     url = "https://okmij.org/ftp/ML/ber-metaocaml-${metaocamlPatch}.tar.gz";
-    sha256 = "sha256-vvq3xI4jSAsrXcDk97TPbFDYgO9NcQeN/yBcUbcb/y0=";
+    sha256 = "sha256-zN4C+ZKpPyT87U9wba8D475K6NWOotSYdd67D+1LSlI=";
   };
 
   x11env = buildEnv {
diff --git a/pkgs/development/python-modules/django-mdeditor/Bump-KaTeX-and-replace-bootcdn-with-jsdelivr.patch b/pkgs/development/python-modules/django-mdeditor/Bump-KaTeX-and-replace-bootcdn-with-jsdelivr.patch
deleted file mode 100644
index 28f7b182809f..000000000000
--- a/pkgs/development/python-modules/django-mdeditor/Bump-KaTeX-and-replace-bootcdn-with-jsdelivr.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From c5af641cccf663dffb4a47d32e28404f609badce Mon Sep 17 00:00:00 2001
-From: Tomo <tomodachi94@protonmail.com>
-Date: Sat, 12 Oct 2024 03:39:12 +0000
-Subject: [PATCH 1/2] chore(KaTeX): bump to 0.7.1
-
-Many bugfixes. This KaTeX is still quite old,
-but versions beyond this have backwards-incompatibilities
-(starting in 0.8).
----
- mdeditor/static/mdeditor/js/editormd.js | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/mdeditor/static/mdeditor/js/editormd.js b/mdeditor/static/mdeditor/js/editormd.js
-index be0005d..8aacb56 100644
---- a/mdeditor/static/mdeditor/js/editormd.js
-+++ b/mdeditor/static/mdeditor/js/editormd.js
-@@ -4179,8 +4179,8 @@
-     // 使用国外的CDN，加载速度有时会很慢，或者自定义URL
-     // You can custom KaTeX load url.
-     editormd.katexURL  = {
--        css : "//cdn.bootcdn.net/ajax/libs/KaTeX/0.3.0/katex.min",
--        js  : "//cdn.bootcdn.net/ajax/libs/KaTeX/0.3.0/katex.min"
-+        css : "//cdn.bootcdn.net/ajax/libs/KaTeX/0.7.1/katex.min",
-+        js  : "//cdn.bootcdn.net/ajax/libs/KaTeX/0.7.1/katex.min"
-     };
-     
-     editormd.kaTeXLoaded = false;
--- 
-2.46.2
-
-
-From 3d082a738262b057d33b9aa8c777d50113143952 Mon Sep 17 00:00:00 2001
-From: Tomo <tomodachi94@protonmail.com>
-Date: Mon, 7 Oct 2024 17:44:39 -0700
-Subject: [PATCH 2/2] fix(KaTeX): Use jsdelivr instead of bootcdn
-
-Bootcdn was compromised by a malicious actor:
-https://sansec.io/research/polyfill-supply-chain-attack
-
-KaTeX recommends using jsdelivr, so I used that:
-https://katex.org/docs/browser
----
- mdeditor/static/mdeditor/js/editormd.js | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/mdeditor/static/mdeditor/js/editormd.js b/mdeditor/static/mdeditor/js/editormd.js
-index 8aacb56..a31e817 100644
---- a/mdeditor/static/mdeditor/js/editormd.js
-+++ b/mdeditor/static/mdeditor/js/editormd.js
-@@ -4179,8 +4179,8 @@
-     // 使用国外的CDN，加载速度有时会很慢，或者自定义URL
-     // You can custom KaTeX load url.
-     editormd.katexURL  = {
--        css : "//cdn.bootcdn.net/ajax/libs/KaTeX/0.7.1/katex.min",
--        js  : "//cdn.bootcdn.net/ajax/libs/KaTeX/0.7.1/katex.min"
-+        css : "//cdn.jsdelivr.net/npm/katex@0.7.1/dist/katex.min.css",
-+        js  : "//cdn.jsdelivr.net/npm/katex@0.7.1/dist/katex.min.js"
-     };
-     
-     editormd.kaTeXLoaded = false;
--- 
-2.46.2
-
diff --git a/pkgs/development/python-modules/django-mdeditor/default.nix b/pkgs/development/python-modules/django-mdeditor/default.nix
deleted file mode 100644
index d80f497386bd..000000000000
--- a/pkgs/development/python-modules/django-mdeditor/default.nix
+++ /dev/null
@@ -1,43 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  django,
-}:
-let
-  version = "0.1.20";
-in
-buildPythonPackage {
-  pname = "django-mdeditor";
-  inherit version;
-  format = "setuptools";
-
-  src = fetchFromGitHub {
-    owner = "pylixm";
-    repo = "django-mdeditor";
-    rev = "v${version}";
-    hash = "sha256-t57j1HhjNQtBwlbqe4mAHQ9WiNcIhMKYmrZkiqh+k5k=";
-  };
-
-  patches = [
-    ./Bump-KaTeX-and-replace-bootcdn-with-jsdelivr.patch
-  ];
-
-  propagatedBuildInputs = [ django ];
-
-  # no tests
-  doCheck = false;
-  pythonImportsCheck = [ "mdeditor" ];
-
-  meta = {
-    description = "Markdown Editor plugin application for django based on Editor.md";
-    homepage = "https://github.com/pylixm/django-mdeditor";
-    changelog = "https://github.com/pylixm/django-mdeditor/releases";
-    license = lib.licenses.gpl3;
-    maintainers = with lib.maintainers; [ augustebaum ];
-    knownVulnerabilities = [
-      # https://nvd.nist.gov/vuln/detail/CVE-2025-13030
-      "CVE-2025-13030"
-    ];
-  };
-}
diff --git a/pkgs/development/python-modules/elevenlabs/default.nix b/pkgs/development/python-modules/elevenlabs/default.nix
index 6d6ffd26c30f..72720af2b35e 100644
--- a/pkgs/development/python-modules/elevenlabs/default.nix
+++ b/pkgs/development/python-modules/elevenlabs/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "elevenlabs";
-  version = "2.46.0";
+  version = "2.47.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "elevenlabs";
     repo = "elevenlabs-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-l5+UaTT+oyiQoBpIgFGsuzB6oUZcmX2vcz8ls2MeOnc=";
+    hash = "sha256-Q3lRllyLXFkHI7Ge6HMJNvcA/DjxhpqXiqyc699hMTU=";
   };
 
   build-system = [ poetry-core ];
diff --git a/pkgs/development/python-modules/hdf5plugin/default.nix b/pkgs/development/python-modules/hdf5plugin/default.nix
index b8847f4e2746..6ebc0fee3761 100644
--- a/pkgs/development/python-modules/hdf5plugin/default.nix
+++ b/pkgs/development/python-modules/hdf5plugin/default.nix
@@ -59,6 +59,16 @@ buildPythonPackage rec {
     "zstd"
   ];
 
+  # These feature defaults can enable CPU-specific code during the build:
+  # most are detected from the build host CPU, while BMI2 defaults to enabled
+  # on Linux/Darwin. Pin them to keep the output generic and machine-independent.
+  # https://github.com/silx-kit/hdf5plugin/blob/v6.0.0/doc/install.rst#available-options
+  env.HDF5PLUGIN_NATIVE = "False";
+  env.HDF5PLUGIN_SSE2 = "False";
+  env.HDF5PLUGIN_SSSE3 = "False";
+  env.HDF5PLUGIN_AVX2 = "False";
+  env.HDF5PLUGIN_AVX512 = "False";
+
   checkPhase = ''
     python test/test.py
   '';
diff --git a/pkgs/development/python-modules/ipyniivue/default.nix b/pkgs/development/python-modules/ipyniivue/default.nix
index 846023ad6c1d..839deb86387a 100644
--- a/pkgs/development/python-modules/ipyniivue/default.nix
+++ b/pkgs/development/python-modules/ipyniivue/default.nix
@@ -7,8 +7,12 @@
   npmHooks,
   hatchling,
   hatch-vcs,
+  hatch-jupyter-builder,
   anywidget,
+  numpy,
+  requests,
   pytestCheckHook,
+  nix-update-script,
 }:
 
 buildPythonPackage rec {
@@ -26,8 +30,14 @@ buildPythonPackage rec {
   npmDeps = fetchNpmDeps {
     name = "${pname}-${version}-npm-deps";
     inherit src;
-    hash = "sha256-3IR2d4/i/e1dRlvKN21XnadUfx2lP5SuToQJ9tMhzp4=";
+    hash = "sha256-6TbwAC175mkyR8EThMalWn7qEyaIFDxtKmC/RIuy1dk=";
+    postPatch = ''
+      cp ${./package-lock.json} ./package-lock.json
+    '';
   };
+  postPatch = ''
+    cp ${./package-lock.json} ./package-lock.json
+  '';
 
   # We do not need the build hooks, because we do not need to
   # build any JS components; these are present already in the PyPI artifact.
@@ -45,13 +55,23 @@ buildPythonPackage rec {
   build-system = [
     hatchling
     hatch-vcs
+    hatch-jupyter-builder
   ];
 
-  dependencies = [ anywidget ];
+  dependencies = [
+    anywidget
+    numpy
+    requests
+  ];
 
   nativeCheckInputs = [ pytestCheckHook ];
   pythonImportsCheck = [ "ipyniivue" ];
 
+  passthru = {
+    # https://github.com/niivue/ipyniivue/pull/139
+    updateScript = nix-update-script { extraArgs = [ "--generate-lockfile" ]; };
+  };
+
   meta = {
     description = "Show a nifti image in a webgl 2.0 canvas within a jupyter notebook cell";
     homepage = "https://github.com/niivue/ipyniivue";
diff --git a/pkgs/development/python-modules/ipyniivue/package-lock.json b/pkgs/development/python-modules/ipyniivue/package-lock.json
new file mode 100644
index 000000000000..c9a36a6142e1
--- /dev/null
+++ b/pkgs/development/python-modules/ipyniivue/package-lock.json
@@ -0,0 +1,826 @@
+{
+	"name": "tmpa75fjgai",
+	"lockfileVersion": 3,
+	"requires": true,
+	"packages": {
+		"": {
+			"dependencies": {
+				"@anywidget/types": "^0.2.0",
+				"@niivue/niivue": "^0.65.0"
+			},
+			"devDependencies": {
+				"@biomejs/biome": "^1.9.4",
+				"esbuild": "^0.27.0",
+				"typescript": "^5.8.2"
+			}
+		},
+		"node_modules/@anywidget/types": {
+			"version": "0.2.0",
+			"resolved": "https://registry.npmjs.org/@anywidget/types/-/types-0.2.0.tgz",
+			"integrity": "sha512-+XtK4uwxRd4JpuevUMhirrbvC0V4yCA/i0lEjhmSAtOaxiXIg/vBKzaSonDuoZ1a9LEjUXTW2+m7w+ULgsJYvg=="
+		},
+		"node_modules/@biomejs/biome": {
+			"version": "1.9.4",
+			"resolved": "https://registry.npmjs.org/@biomejs/biome/-/biome-1.9.4.tgz",
+			"integrity": "sha512-1rkd7G70+o9KkTn5KLmDYXihGoTaIGO9PIIN2ZB7UJxFrWw04CZHPYiMRjYsaDvVV7hP1dYNRLxSANLaBFGpog==",
+			"dev": true,
+			"hasInstallScript": true,
+			"license": "MIT OR Apache-2.0",
+			"bin": {
+				"biome": "bin/biome"
+			},
+			"engines": {
+				"node": ">=14.21.3"
+			},
+			"funding": {
+				"type": "opencollective",
+				"url": "https://opencollective.com/biome"
+			},
+			"optionalDependencies": {
+				"@biomejs/cli-darwin-arm64": "1.9.4",
+				"@biomejs/cli-darwin-x64": "1.9.4",
+				"@biomejs/cli-linux-arm64": "1.9.4",
+				"@biomejs/cli-linux-arm64-musl": "1.9.4",
+				"@biomejs/cli-linux-x64": "1.9.4",
+				"@biomejs/cli-linux-x64-musl": "1.9.4",
+				"@biomejs/cli-win32-arm64": "1.9.4",
+				"@biomejs/cli-win32-x64": "1.9.4"
+			}
+		},
+		"node_modules/@biomejs/cli-darwin-arm64": {
+			"version": "1.9.4",
+			"resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-arm64/-/cli-darwin-arm64-1.9.4.tgz",
+			"integrity": "sha512-bFBsPWrNvkdKrNCYeAp+xo2HecOGPAy9WyNyB/jKnnedgzl4W4Hb9ZMzYNbf8dMCGmUdSavlYHiR01QaYR58cw==",
+			"cpu": [
+				"arm64"
+			],
+			"dev": true,
+			"license": "MIT OR Apache-2.0",
+			"optional": true,
+			"os": [
+				"darwin"
+			],
+			"engines": {
+				"node": ">=14.21.3"
+			}
+		},
+		"node_modules/@biomejs/cli-darwin-x64": {
+			"version": "1.9.4",
+			"resolved": "https://registry.npmjs.org/@biomejs/cli-darwin-x64/-/cli-darwin-x64-1.9.4.tgz",
+			"integrity": "sha512-ngYBh/+bEedqkSevPVhLP4QfVPCpb+4BBe2p7Xs32dBgs7rh9nY2AIYUL6BgLw1JVXV8GlpKmb/hNiuIxfPfZg==",
+			"cpu": [
+				"x64"
+			],
+			"dev": true,
+			"license": "MIT OR Apache-2.0",
+			"optional": true,
+			"os": [
+				"darwin"
+			],
+			"engines": {
+				"node": ">=14.21.3"
+			}
+		},
+		"node_modules/@biomejs/cli-linux-arm64": {
+			"version": "1.9.4",
+			"resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64/-/cli-linux-arm64-1.9.4.tgz",
+			"integrity": "sha512-fJIW0+LYujdjUgJJuwesP4EjIBl/N/TcOX3IvIHJQNsAqvV2CHIogsmA94BPG6jZATS4Hi+xv4SkBBQSt1N4/g==",
+			"cpu": [
+				"arm64"
+			],
+			"dev": true,
+			"license": "MIT OR Apache-2.0",
+			"optional": true,
+			"os": [
+				"linux"
+			],
+			"engines": {
+				"node": ">=14.21.3"
+			}
+		},
+		"node_modules/@biomejs/cli-linux-arm64-musl": {
+			"version": "1.9.4",
+			"resolved": "https://registry.npmjs.org/@biomejs/cli-linux-arm64-musl/-/cli-linux-arm64-musl-1.9.4.tgz",
+			"integrity": "sha512-v665Ct9WCRjGa8+kTr0CzApU0+XXtRgwmzIf1SeKSGAv+2scAlW6JR5PMFo6FzqqZ64Po79cKODKf3/AAmECqA==",
+			"cpu": [
+				"arm64"
+			],
+			"dev": true,
+			"license": "MIT OR Apache-2.0",
+			"optional": true,
+			"os": [
+				"linux"
+			],
+			"engines": {
+				"node": ">=14.21.3"
+			}
+		},
+		"node_modules/@biomejs/cli-linux-x64": {
+			"version": "1.9.4",
+			"resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64/-/cli-linux-x64-1.9.4.tgz",
+			"integrity": "sha512-lRCJv/Vi3Vlwmbd6K+oQ0KhLHMAysN8lXoCI7XeHlxaajk06u7G+UsFSO01NAs5iYuWKmVZjmiOzJ0OJmGsMwg==",
+			"cpu": [
+				"x64"
+			],
+			"dev": true,
+			"license": "MIT OR Apache-2.0",
+			"optional": true,
+			"os": [
+				"linux"
+			],
+			"engines": {
+				"node": ">=14.21.3"
+			}
+		},
+		"node_modules/@biomejs/cli-linux-x64-musl": {
+			"version": "1.9.4",
+			"resolved": "https://registry.npmjs.org/@biomejs/cli-linux-x64-musl/-/cli-linux-x64-musl-1.9.4.tgz",
+			"integrity": "sha512-gEhi/jSBhZ2m6wjV530Yy8+fNqG8PAinM3oV7CyO+6c3CEh16Eizm21uHVsyVBEB6RIM8JHIl6AGYCv6Q6Q9Tg==",
+			"cpu": [
+				"x64"
+			],
+			"dev": true,
+			"license": "MIT OR Apache-2.0",
+			"optional": true,
+			"os": [
+				"linux"
+			],
+			"engines": {
+				"node": ">=14.21.3"
+			}
+		},
+		"node_modules/@biomejs/cli-win32-arm64": {
+			"version": "1.9.4",
+			"resolved": "https://registry.npmjs.org/@biomejs/cli-win32-arm64/-/cli-win32-arm64-1.9.4.tgz",
+			"integrity": "sha512-tlbhLk+WXZmgwoIKwHIHEBZUwxml7bRJgk0X2sPyNR3S93cdRq6XulAZRQJ17FYGGzWne0fgrXBKpl7l4M87Hg==",
+			"cpu": [
+				"arm64"
+			],
+			"dev": true,
+			"license": "MIT OR Apache-2.0",
+			"optional": true,
+			"os": [
+				"win32"
+			],
+			"engines": {
+				"node": ">=14.21.3"
+			}
+		},
+		"node_modules/@biomejs/cli-win32-x64": {
+			"version": "1.9.4",
+			"resolved": "https://registry.npmjs.org/@biomejs/cli-win32-x64/-/cli-win32-x64-1.9.4.tgz",
+			"integrity": "sha512-8Y5wMhVIPaWe6jw2H+KlEm4wP/f7EW3810ZLmDlrEEy5KvBsb9ECEfu/kMWD484ijfQ8+nIi0giMgu9g1UAuuA==",
+			"cpu": [
+				"x64"
+			],
+			"dev": true,
+			"license": "MIT OR Apache-2.0",
+			"optional": true,
+			"os": [
+				"win32"
+			],
+			"engines": {
+				"node": ">=14.21.3"
+			}
+		},
+		"node_modules/@esbuild/aix-ppc64": {
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.27.7.tgz",
+			"integrity": "sha512-EKX3Qwmhz1eMdEJokhALr0YiD0lhQNwDqkPYyPhiSwKrh7/4KRjQc04sZ8db+5DVVnZ1LmbNDI1uAMPEUBnQPg==",
+			"cpu": [
+				"ppc64"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"aix"
+			],
+			"engines": {
+				"node": ">=18"
+			}
+		},
+		"node_modules/@esbuild/android-arm": {
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.27.7.tgz",
+			"integrity": "sha512-jbPXvB4Yj2yBV7HUfE2KHe4GJX51QplCN1pGbYjvsyCZbQmies29EoJbkEc+vYuU5o45AfQn37vZlyXy4YJ8RQ==",
+			"cpu": [
+				"arm"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"android"
+			],
+			"engines": {
+				"node": ">=18"
+			}
+		},
+		"node_modules/@esbuild/android-arm64": {
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.27.7.tgz",
+			"integrity": "sha512-62dPZHpIXzvChfvfLJow3q5dDtiNMkwiRzPylSCfriLvZeq0a1bWChrGx/BbUbPwOrsWKMn8idSllklzBy+dgQ==",
+			"cpu": [
+				"arm64"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"android"
+			],
+			"engines": {
+				"node": ">=18"
+			}
+		},
+		"node_modules/@esbuild/android-x64": {
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.27.7.tgz",
+			"integrity": "sha512-x5VpMODneVDb70PYV2VQOmIUUiBtY3D3mPBG8NxVk5CogneYhkR7MmM3yR/uMdITLrC1ml/NV1rj4bMJuy9MCg==",
+			"cpu": [
+				"x64"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"android"
+			],
+			"engines": {
+				"node": ">=18"
+			}
+		},
+		"node_modules/@esbuild/darwin-arm64": {
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.27.7.tgz",
+			"integrity": "sha512-5lckdqeuBPlKUwvoCXIgI2D9/ABmPq3Rdp7IfL70393YgaASt7tbju3Ac+ePVi3KDH6N2RqePfHnXkaDtY9fkw==",
+			"cpu": [
+				"arm64"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"darwin"
+			],
+			"engines": {
+				"node": ">=18"
+			}
+		},
+		"node_modules/@esbuild/darwin-x64": {
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.27.7.tgz",
+			"integrity": "sha512-rYnXrKcXuT7Z+WL5K980jVFdvVKhCHhUwid+dDYQpH+qu+TefcomiMAJpIiC2EM3Rjtq0sO3StMV/+3w3MyyqQ==",
+			"cpu": [
+				"x64"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"darwin"
+			],
+			"engines": {
+				"node": ">=18"
+			}
+		},
+		"node_modules/@esbuild/freebsd-arm64": {
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.27.7.tgz",
+			"integrity": "sha512-B48PqeCsEgOtzME2GbNM2roU29AMTuOIN91dsMO30t+Ydis3z/3Ngoj5hhnsOSSwNzS+6JppqWsuhTp6E82l2w==",
+			"cpu": [
+				"arm64"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"freebsd"
+			],
+			"engines": {
+				"node": ">=18"
+			}
+		},
+		"node_modules/@esbuild/freebsd-x64": {
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.27.7.tgz",
+			"integrity": "sha512-jOBDK5XEjA4m5IJK3bpAQF9/Lelu/Z9ZcdhTRLf4cajlB+8VEhFFRjWgfy3M1O4rO2GQ/b2dLwCUGpiF/eATNQ==",
+			"cpu": [
+				"x64"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"freebsd"
+			],
+			"engines": {
+				"node": ">=18"
+			}
+		},
+		"node_modules/@esbuild/linux-arm": {
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.27.7.tgz",
+			"integrity": "sha512-RkT/YXYBTSULo3+af8Ib0ykH8u2MBh57o7q/DAs3lTJlyVQkgQvlrPTnjIzzRPQyavxtPtfg0EopvDyIt0j1rA==",
+			"cpu": [
+				"arm"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"linux"
+			],
+			"engines": {
+				"node": ">=18"
+			}
+		},
+		"node_modules/@esbuild/linux-arm64": {
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.27.7.tgz",
+			"integrity": "sha512-RZPHBoxXuNnPQO9rvjh5jdkRmVizktkT7TCDkDmQ0W2SwHInKCAV95GRuvdSvA7w4VMwfCjUiPwDi0ZO6Nfe9A==",
+			"cpu": [
+				"arm64"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"linux"
+			],
+			"engines": {
+				"node": ">=18"
+			}
+		},
+		"node_modules/@esbuild/linux-ia32": {
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.27.7.tgz",
+			"integrity": "sha512-GA48aKNkyQDbd3KtkplYWT102C5sn/EZTY4XROkxONgruHPU72l+gW+FfF8tf2cFjeHaRbWpOYa/uRBz/Xq1Pg==",
+			"cpu": [
+				"ia32"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"linux"
+			],
+			"engines": {
+				"node": ">=18"
+			}
+		},
+		"node_modules/@esbuild/linux-loong64": {
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.27.7.tgz",
+			"integrity": "sha512-a4POruNM2oWsD4WKvBSEKGIiWQF8fZOAsycHOt6JBpZ+JN2n2JH9WAv56SOyu9X5IqAjqSIPTaJkqN8F7XOQ5Q==",
+			"cpu": [
+				"loong64"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"linux"
+			],
+			"engines": {
+				"node": ">=18"
+			}
+		},
+		"node_modules/@esbuild/linux-mips64el": {
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.27.7.tgz",
+			"integrity": "sha512-KabT5I6StirGfIz0FMgl1I+R1H73Gp0ofL9A3nG3i/cYFJzKHhouBV5VWK1CSgKvVaG4q1RNpCTR2LuTVB3fIw==",
+			"cpu": [
+				"mips64el"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"linux"
+			],
+			"engines": {
+				"node": ">=18"
+			}
+		},
+		"node_modules/@esbuild/linux-ppc64": {
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.27.7.tgz",
+			"integrity": "sha512-gRsL4x6wsGHGRqhtI+ifpN/vpOFTQtnbsupUF5R5YTAg+y/lKelYR1hXbnBdzDjGbMYjVJLJTd2OFmMewAgwlQ==",
+			"cpu": [
+				"ppc64"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"linux"
+			],
+			"engines": {
+				"node": ">=18"
+			}
+		},
+		"node_modules/@esbuild/linux-riscv64": {
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.27.7.tgz",
+			"integrity": "sha512-hL25LbxO1QOngGzu2U5xeXtxXcW+/GvMN3ejANqXkxZ/opySAZMrc+9LY/WyjAan41unrR3YrmtTsUpwT66InQ==",
+			"cpu": [
+				"riscv64"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"linux"
+			],
+			"engines": {
+				"node": ">=18"
+			}
+		},
+		"node_modules/@esbuild/linux-s390x": {
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.27.7.tgz",
+			"integrity": "sha512-2k8go8Ycu1Kb46vEelhu1vqEP+UeRVj2zY1pSuPdgvbd5ykAw82Lrro28vXUrRmzEsUV0NzCf54yARIK8r0fdw==",
+			"cpu": [
+				"s390x"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"linux"
+			],
+			"engines": {
+				"node": ">=18"
+			}
+		},
+		"node_modules/@esbuild/linux-x64": {
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.27.7.tgz",
+			"integrity": "sha512-hzznmADPt+OmsYzw1EE33ccA+HPdIqiCRq7cQeL1Jlq2gb1+OyWBkMCrYGBJ+sxVzve2ZJEVeePbLM2iEIZSxA==",
+			"cpu": [
+				"x64"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"linux"
+			],
+			"engines": {
+				"node": ">=18"
+			}
+		},
+		"node_modules/@esbuild/netbsd-arm64": {
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.27.7.tgz",
+			"integrity": "sha512-b6pqtrQdigZBwZxAn1UpazEisvwaIDvdbMbmrly7cDTMFnw/+3lVxxCTGOrkPVnsYIosJJXAsILG9XcQS+Yu6w==",
+			"cpu": [
+				"arm64"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"netbsd"
+			],
+			"engines": {
+				"node": ">=18"
+			}
+		},
+		"node_modules/@esbuild/netbsd-x64": {
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.27.7.tgz",
+			"integrity": "sha512-OfatkLojr6U+WN5EDYuoQhtM+1xco+/6FSzJJnuWiUw5eVcicbyK3dq5EeV/QHT1uy6GoDhGbFpprUiHUYggrw==",
+			"cpu": [
+				"x64"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"netbsd"
+			],
+			"engines": {
+				"node": ">=18"
+			}
+		},
+		"node_modules/@esbuild/openbsd-arm64": {
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.27.7.tgz",
+			"integrity": "sha512-AFuojMQTxAz75Fo8idVcqoQWEHIXFRbOc1TrVcFSgCZtQfSdc1RXgB3tjOn/krRHENUB4j00bfGjyl2mJrU37A==",
+			"cpu": [
+				"arm64"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"openbsd"
+			],
+			"engines": {
+				"node": ">=18"
+			}
+		},
+		"node_modules/@esbuild/openbsd-x64": {
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.27.7.tgz",
+			"integrity": "sha512-+A1NJmfM8WNDv5CLVQYJ5PshuRm/4cI6WMZRg1by1GwPIQPCTs1GLEUHwiiQGT5zDdyLiRM/l1G0Pv54gvtKIg==",
+			"cpu": [
+				"x64"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"openbsd"
+			],
+			"engines": {
+				"node": ">=18"
+			}
+		},
+		"node_modules/@esbuild/openharmony-arm64": {
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.27.7.tgz",
+			"integrity": "sha512-+KrvYb/C8zA9CU/g0sR6w2RBw7IGc5J2BPnc3dYc5VJxHCSF1yNMxTV5LQ7GuKteQXZtspjFbiuW5/dOj7H4Yw==",
+			"cpu": [
+				"arm64"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"openharmony"
+			],
+			"engines": {
+				"node": ">=18"
+			}
+		},
+		"node_modules/@esbuild/sunos-x64": {
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.27.7.tgz",
+			"integrity": "sha512-ikktIhFBzQNt/QDyOL580ti9+5mL/YZeUPKU2ivGtGjdTYoqz6jObj6nOMfhASpS4GU4Q/Clh1QtxWAvcYKamA==",
+			"cpu": [
+				"x64"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"sunos"
+			],
+			"engines": {
+				"node": ">=18"
+			}
+		},
+		"node_modules/@esbuild/win32-arm64": {
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.27.7.tgz",
+			"integrity": "sha512-7yRhbHvPqSpRUV7Q20VuDwbjW5kIMwTHpptuUzV+AA46kiPze5Z7qgt6CLCK3pWFrHeNfDd1VKgyP4O+ng17CA==",
+			"cpu": [
+				"arm64"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"win32"
+			],
+			"engines": {
+				"node": ">=18"
+			}
+		},
+		"node_modules/@esbuild/win32-ia32": {
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.27.7.tgz",
+			"integrity": "sha512-SmwKXe6VHIyZYbBLJrhOoCJRB/Z1tckzmgTLfFYOfpMAx63BJEaL9ExI8x7v0oAO3Zh6D/Oi1gVxEYr5oUCFhw==",
+			"cpu": [
+				"ia32"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"win32"
+			],
+			"engines": {
+				"node": ">=18"
+			}
+		},
+		"node_modules/@esbuild/win32-x64": {
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.27.7.tgz",
+			"integrity": "sha512-56hiAJPhwQ1R4i+21FVF7V8kSD5zZTdHcVuRFMW0hn753vVfQN8xlx4uOPT4xoGH0Z/oVATuR82AiqSTDIpaHg==",
+			"cpu": [
+				"x64"
+			],
+			"dev": true,
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"win32"
+			],
+			"engines": {
+				"node": ">=18"
+			}
+		},
+		"node_modules/@lukeed/csprng": {
+			"version": "1.1.0",
+			"resolved": "https://registry.npmjs.org/@lukeed/csprng/-/csprng-1.1.0.tgz",
+			"integrity": "sha512-Z7C/xXCiGWsg0KuKsHTKJxbWhpI3Vs5GwLfOean7MGyVFGqdRgBbAjOCh6u4bbjPc/8MJ2pZmK/0DLdCbivLDA==",
+			"license": "MIT",
+			"engines": {
+				"node": ">=8"
+			}
+		},
+		"node_modules/@lukeed/uuid": {
+			"version": "2.0.1",
+			"resolved": "https://registry.npmjs.org/@lukeed/uuid/-/uuid-2.0.1.tgz",
+			"integrity": "sha512-qC72D4+CDdjGqJvkFMMEAtancHUQ7/d/tAiHf64z8MopFDmcrtbcJuerDtFceuAfQJ2pDSfCKCtbqoGBNnwg0w==",
+			"license": "MIT",
+			"dependencies": {
+				"@lukeed/csprng": "^1.1.0"
+			},
+			"engines": {
+				"node": ">=8"
+			}
+		},
+		"node_modules/@niivue/niivue": {
+			"version": "0.65.0",
+			"resolved": "https://registry.npmjs.org/@niivue/niivue/-/niivue-0.65.0.tgz",
+			"integrity": "sha512-yu4pWI/3pQm4Q/4ga4iBfxPRwV/fmBwFEY35N1r3xVqStZYYm2+3U3Yq7UhbBd36snO1FbQuRGqekincbyh6gQ==",
+			"license": "BSD-2-Clause",
+			"dependencies": {
+				"@lukeed/uuid": "^2.0.1",
+				"@ungap/structured-clone": "^1.2.0",
+				"array-equal": "^1.0.2",
+				"fflate": "^0.8.2",
+				"gl-matrix": "^3.4.3",
+				"nifti-reader-js": "^0.8.0",
+				"zarrita": "^0.5.0"
+			},
+			"optionalDependencies": {
+				"@rollup/rollup-linux-x64-gnu": "^4.18.1"
+			}
+		},
+		"node_modules/@rollup/rollup-linux-x64-gnu": {
+			"version": "4.60.1",
+			"resolved": "https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.60.1.tgz",
+			"integrity": "sha512-77PpsFQUCOiZR9+LQEFg9GClyfkNXj1MP6wRnzYs0EeWbPcHs02AXu4xuUbM1zhwn3wqaizle3AEYg5aeoohhg==",
+			"cpu": [
+				"x64"
+			],
+			"license": "MIT",
+			"optional": true,
+			"os": [
+				"linux"
+			]
+		},
+		"node_modules/@ungap/structured-clone": {
+			"version": "1.3.0",
+			"resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.0.tgz",
+			"integrity": "sha512-WmoN8qaIAo7WTYWbAZuG8PYEhn5fkz7dZrqTBZ7dtt//lL2Gwms1IcnQ5yHqjDfX8Ft5j4YzDM23f87zBfDe9g==",
+			"license": "ISC"
+		},
+		"node_modules/@zarrita/storage": {
+			"version": "0.1.4",
+			"resolved": "https://registry.npmjs.org/@zarrita/storage/-/storage-0.1.4.tgz",
+			"integrity": "sha512-qURfJAQcQGRfDQ4J9HaCjGaj3jlJKc66bnRk6G/IeLUsM7WKyG7Bzsuf1EZurSXyc0I4LVcu6HaeQQ4d3kZ16g==",
+			"license": "MIT",
+			"dependencies": {
+				"reference-spec-reader": "^0.2.0",
+				"unzipit": "1.4.3"
+			}
+		},
+		"node_modules/array-equal": {
+			"version": "1.0.2",
+			"resolved": "https://registry.npmjs.org/array-equal/-/array-equal-1.0.2.tgz",
+			"integrity": "sha512-gUHx76KtnhEgB3HOuFYiCm3FIdEs6ocM2asHvNTkfu/Y09qQVrrVVaOKENmS2KkSaGoxgXNqC+ZVtR/n0MOkSA==",
+			"license": "MIT",
+			"funding": {
+				"url": "https://github.com/sponsors/sindresorhus"
+			}
+		},
+		"node_modules/esbuild": {
+			"version": "0.27.7",
+			"resolved": "https://registry.npmjs.org/esbuild/-/esbuild-0.27.7.tgz",
+			"integrity": "sha512-IxpibTjyVnmrIQo5aqNpCgoACA/dTKLTlhMHihVHhdkxKyPO1uBBthumT0rdHmcsk9uMonIWS0m4FljWzILh3w==",
+			"dev": true,
+			"hasInstallScript": true,
+			"license": "MIT",
+			"bin": {
+				"esbuild": "bin/esbuild"
+			},
+			"engines": {
+				"node": ">=18"
+			},
+			"optionalDependencies": {
+				"@esbuild/aix-ppc64": "0.27.7",
+				"@esbuild/android-arm": "0.27.7",
+				"@esbuild/android-arm64": "0.27.7",
+				"@esbuild/android-x64": "0.27.7",
+				"@esbuild/darwin-arm64": "0.27.7",
+				"@esbuild/darwin-x64": "0.27.7",
+				"@esbuild/freebsd-arm64": "0.27.7",
+				"@esbuild/freebsd-x64": "0.27.7",
+				"@esbuild/linux-arm": "0.27.7",
+				"@esbuild/linux-arm64": "0.27.7",
+				"@esbuild/linux-ia32": "0.27.7",
+				"@esbuild/linux-loong64": "0.27.7",
+				"@esbuild/linux-mips64el": "0.27.7",
+				"@esbuild/linux-ppc64": "0.27.7",
+				"@esbuild/linux-riscv64": "0.27.7",
+				"@esbuild/linux-s390x": "0.27.7",
+				"@esbuild/linux-x64": "0.27.7",
+				"@esbuild/netbsd-arm64": "0.27.7",
+				"@esbuild/netbsd-x64": "0.27.7",
+				"@esbuild/openbsd-arm64": "0.27.7",
+				"@esbuild/openbsd-x64": "0.27.7",
+				"@esbuild/openharmony-arm64": "0.27.7",
+				"@esbuild/sunos-x64": "0.27.7",
+				"@esbuild/win32-arm64": "0.27.7",
+				"@esbuild/win32-ia32": "0.27.7",
+				"@esbuild/win32-x64": "0.27.7"
+			}
+		},
+		"node_modules/fflate": {
+			"version": "0.8.2",
+			"resolved": "https://registry.npmjs.org/fflate/-/fflate-0.8.2.tgz",
+			"integrity": "sha512-cPJU47OaAoCbg0pBvzsgpTPhmhqI5eJjh/JIu8tPj5q+T7iLvW/JAYUqmE7KOB4R1ZyEhzBaIQpQpardBF5z8A==",
+			"license": "MIT"
+		},
+		"node_modules/gl-matrix": {
+			"version": "3.4.4",
+			"resolved": "https://registry.npmjs.org/gl-matrix/-/gl-matrix-3.4.4.tgz",
+			"integrity": "sha512-latSnyDNt/8zYUB6VIJ6PCh2jBjJX6gnDsoCZ7LyW7GkqrD51EWwa9qCoGixj8YqBtETQK/xY7OmpTF8xz1DdQ==",
+			"license": "MIT"
+		},
+		"node_modules/nifti-reader-js": {
+			"version": "0.8.0",
+			"resolved": "https://registry.npmjs.org/nifti-reader-js/-/nifti-reader-js-0.8.0.tgz",
+			"integrity": "sha512-iO1iIhQDfKniy+l/86HfOPte7So+SxBmBiMSiUB2VXU7z4hSewMTlE3h0fCgfzfXvMUa+ilzLTJ2ZHmtFw6EWw==",
+			"license": "MIT",
+			"dependencies": {
+				"fflate": "^0.8.2"
+			}
+		},
+		"node_modules/numcodecs": {
+			"version": "0.3.2",
+			"resolved": "https://registry.npmjs.org/numcodecs/-/numcodecs-0.3.2.tgz",
+			"integrity": "sha512-6YSPnmZgg0P87jnNhi3s+FVLOcIn3y+1CTIgUulA3IdASzK9fJM87sUFkpyA+be9GibGRaST2wCgkD+6U+fWKw==",
+			"license": "MIT",
+			"dependencies": {
+				"fflate": "^0.8.0"
+			}
+		},
+		"node_modules/reference-spec-reader": {
+			"version": "0.2.0",
+			"resolved": "https://registry.npmjs.org/reference-spec-reader/-/reference-spec-reader-0.2.0.tgz",
+			"integrity": "sha512-q0mfCi5yZSSHXpCyxjgQeaORq3tvDsxDyzaadA/5+AbAUwRyRuuTh0aRQuE/vAOt/qzzxidJ5iDeu1cLHaNBlQ==",
+			"license": "MIT"
+		},
+		"node_modules/typescript": {
+			"version": "5.9.3",
+			"resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
+			"integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
+			"dev": true,
+			"license": "Apache-2.0",
+			"bin": {
+				"tsc": "bin/tsc",
+				"tsserver": "bin/tsserver"
+			},
+			"engines": {
+				"node": ">=14.17"
+			}
+		},
+		"node_modules/unzipit": {
+			"version": "1.4.3",
+			"resolved": "https://registry.npmjs.org/unzipit/-/unzipit-1.4.3.tgz",
+			"integrity": "sha512-gsq2PdJIWWGhx5kcdWStvNWit9FVdTewm4SEG7gFskWs+XCVaULt9+BwuoBtJiRE8eo3L1IPAOrbByNLtLtIlg==",
+			"license": "MIT",
+			"dependencies": {
+				"uzip-module": "^1.0.2"
+			},
+			"engines": {
+				"node": ">=12"
+			}
+		},
+		"node_modules/uzip-module": {
+			"version": "1.0.3",
+			"resolved": "https://registry.npmjs.org/uzip-module/-/uzip-module-1.0.3.tgz",
+			"integrity": "sha512-AMqwWZaknLM77G+VPYNZLEruMGWGzyigPK3/Whg99B3S6vGHuqsyl5ZrOv1UUF3paGK1U6PM0cnayioaryg/fA==",
+			"license": "MIT"
+		},
+		"node_modules/zarrita": {
+			"version": "0.5.4",
+			"resolved": "https://registry.npmjs.org/zarrita/-/zarrita-0.5.4.tgz",
+			"integrity": "sha512-i88iN2+HqIQ+uiCEWLfhjbYNXAJD7IrM4h3lFwFclfqEOOhxp10amRWtqmgN5jbuy3+h0LwdyLVVzk4y9rTLgg==",
+			"license": "MIT",
+			"dependencies": {
+				"@zarrita/storage": "^0.1.3",
+				"numcodecs": "^0.3.2"
+			}
+		}
+	}
+}
diff --git a/pkgs/development/python-modules/pyfuse3/default.nix b/pkgs/development/python-modules/pyfuse3/default.nix
index 96af3308d5b0..588b353078cb 100644
--- a/pkgs/development/python-modules/pyfuse3/default.nix
+++ b/pkgs/development/python-modules/pyfuse3/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "pyfuse3";
-  version = "3.4.2";
+  version = "3.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "libfuse";
     repo = "pyfuse3";
     tag = "v${version}";
-    hash = "sha256-3mhtpXhia2w9VtdFctN+cGrvOmhRE3656fEciseY2u4=";
+    hash = "sha256-HhEtWYWdxJZOMS3dqB2VdQS7aSdpkRhq7EZCJ55n2OE=";
   };
 
   build-system = [
diff --git a/pkgs/development/python-modules/python-benedict/default.nix b/pkgs/development/python-modules/python-benedict/default.nix
index 35103677711d..4a6278f176a1 100644
--- a/pkgs/development/python-modules/python-benedict/default.nix
+++ b/pkgs/development/python-modules/python-benedict/default.nix
@@ -16,23 +16,24 @@
   python-slugify,
   pyyaml,
   requests,
+  pydantic,
   setuptools,
-  toml,
+  tomli-w,
   useful-types,
   xlrd,
   xmltodict,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "python-benedict";
-  version = "0.36.0";
+  version = "0.37.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "fabiocaccamo";
     repo = "python-benedict";
-    tag = version;
-    hash = "sha256-FIajPROnyuMhM2YzlqJm5A5eRp6v39VHb8RJZjmXqxQ=";
+    tag = finalAttrs.version;
+    hash = "sha256-iYCc8e7+7OXpHW2gGxR6ckiTi/Wi5ByqcOFx9e2Eme0=";
   };
 
   pythonRelaxDeps = [ "boto3" ];
@@ -54,9 +55,10 @@ buildPythonPackage rec {
       mailchecker
       openpyxl
       phonenumbers
+      pydantic
       python-dateutil
       pyyaml
-      toml
+      tomli-w
       xlrd
       xmltodict
     ];
@@ -68,7 +70,7 @@ buildPythonPackage rec {
       beautifulsoup4
       openpyxl
       pyyaml
-      toml
+      tomli-w
       xlrd
       xmltodict
     ];
@@ -79,7 +81,8 @@ buildPythonPackage rec {
       python-dateutil
     ];
     s3 = [ boto3 ];
-    toml = [ toml ];
+    schema = [ pydantic ];
+    toml = [ tomli-w ];
     xls = [
       openpyxl
       xlrd
@@ -93,7 +96,7 @@ buildPythonPackage rec {
     pytestCheckHook
     python-decouple
   ]
-  ++ lib.concatAttrValues optional-dependencies;
+  ++ lib.flatten (builtins.attrValues finalAttrs.passthru.optional-dependencies);
 
   disabledTests = [
     # Tests require network access
@@ -115,8 +118,8 @@ buildPythonPackage rec {
   meta = {
     description = "Module with keylist/keypath support";
     homepage = "https://github.com/fabiocaccamo/python-benedict";
-    changelog = "https://github.com/fabiocaccamo/python-benedict/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/fabiocaccamo/python-benedict/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})
diff --git a/pkgs/development/python-modules/qbusmqttapi/default.nix b/pkgs/development/python-modules/qbusmqttapi/default.nix
index 7b952bca9dd7..86ba0d58f80b 100644
--- a/pkgs/development/python-modules/qbusmqttapi/default.nix
+++ b/pkgs/development/python-modules/qbusmqttapi/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "qbusmqttapi";
-  version = "1.4.3";
+  version = "1.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Qbus-iot";
     repo = "qbusmqttapi";
     tag = "v${version}";
-    hash = "sha256-qwvgc80YIluIwb2532KBnVT8pOkn7a2T9FWX4Z5bG+A=";
+    hash = "sha256-llFrgXtECdozAgz+RHTKig9sTKYJHfO7Rt5qz+/e7c8=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/xclim/default.nix b/pkgs/development/python-modules/xclim/default.nix
index f0f88a744398..051ad531c9aa 100644
--- a/pkgs/development/python-modules/xclim/default.nix
+++ b/pkgs/development/python-modules/xclim/default.nix
@@ -35,14 +35,14 @@
 }:
 buildPythonPackage rec {
   pname = "xclim";
-  version = "0.60.0";
+  version = "0.61.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Ouranosinc";
     repo = "xclim";
     tag = "v${version}";
-    hash = "sha256-dVa4/nvMg2iBW7j3eePZFggedLJXLF/4oU0k7zIp8d0=";
+    hash = "sha256-9PCeL5r8HFv4xDnbnAxs/Fd56bfWd+8G1TgOH18v3NU=";
   };
 
   build-system = [
diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 6ba6117273f9..04fcd61b297a 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -12,13 +12,13 @@ let
   # override options if they need using lib.mkForce (that has 50 priority)
   mkKernelOverride = lib.mkOverride 90;
 
-  suffix = "zen2";
+  suffix = "zen1";
 in
 
 buildLinux (
   args
   // rec {
-    version = "7.0.7";
+    version = "7.0.8";
     pname = "linux-zen";
     modDirVersion = lib.versions.pad 3 "${version}-${suffix}";
     isZen = true;
@@ -27,7 +27,7 @@ buildLinux (
       owner = "zen-kernel";
       repo = "zen-kernel";
       rev = "v${version}-${suffix}";
-      sha256 = "0b27mh7rndbyjbqf4gfivacgda9srkjlh1hdflasl0vq4sdy3d68";
+      sha256 = "xuzWN+GvsY/EiIwKd+QgUsRVVkM7KQb3i11oyhy2KaQ=";
     };
 
     # This is based on the following source:
diff --git a/pkgs/servers/http/jetty/default.nix b/pkgs/servers/http/jetty/default.nix
index 92df2993e286..dd7bcf8cec2d 100644
--- a/pkgs/servers/http/jetty/default.nix
+++ b/pkgs/servers/http/jetty/default.nix
@@ -57,7 +57,7 @@ in
   };
 
   jetty_12 = common {
-    version = "12.1.8";
-    hash = "sha256-H9faI1a/GlKJ74HYQc3znnxWEzatACI82QMyZe5Z6gQ=";
+    version = "12.1.9";
+    hash = "sha256-pSDkG0d2ueSYyKj2HDPDkWoAtU5W3Cmd24B4/3Meyk4=";
   };
 }
diff --git a/pkgs/servers/roundcube/0001-Don-t-resolve-symlinks-when-trying-to-find-INSTALL_P.patch b/pkgs/servers/roundcube/0001-Don-t-resolve-symlinks-when-trying-to-find-INSTALL_P.patch
index 27ebd59a48d9..4d8168ed742a 100644
--- a/pkgs/servers/roundcube/0001-Don-t-resolve-symlinks-when-trying-to-find-INSTALL_P.patch
+++ b/pkgs/servers/roundcube/0001-Don-t-resolve-symlinks-when-trying-to-find-INSTALL_P.patch
@@ -1,27 +1,57 @@
-From c1832eabb99cec47f1714f696275285e1e28da34 Mon Sep 17 00:00:00 2001
+From c6b017ce9e85e7a27f65429ba41d3642bd6dc393 Mon Sep 17 00:00:00 2001
 From: Maximilian Bosch <maximilian@mbosch.me>
 Date: Tue, 2 Apr 2019 16:20:50 +0200
 Subject: [PATCH] Don't resolve symlinks when trying to find INSTALL_PATH
 
 Nix specific patch. This behavior breaks roundcube setups where plugins
 are in a store path with symlinks to the actual source.
+
+Also, __DIR__ resolves the symlink from `buildEnv`, so we do
+$_SERVER['SCRIPT_FILENAME'] instead.
 ---
- bin/update.sh | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
+ bin/update.sh          | 2 +-
+ public_html/index.php  | 1 +
+ public_html/static.php | 2 +-
+ 3 files changed, 3 insertions(+), 2 deletions(-)
 
 diff --git a/bin/update.sh b/bin/update.sh
-index 08e3bb5..b2ad498 100755
+index 4d8e829cc..3810aa2b9 100755
 --- a/bin/update.sh
 +++ b/bin/update.sh
 @@ -19,7 +19,7 @@
   +-----------------------------------------------------------------------+
  */
  
--define('INSTALL_PATH', realpath(__DIR__ . '/..') . '/' );
+-define('INSTALL_PATH', realpath(__DIR__ . '/..') . '/');
 +define('INSTALL_PATH', dirname(dirname($argv[0])).'/');
  
  require_once INSTALL_PATH . 'program/include/clisetup.php';
  
+diff --git a/public_html/index.php b/public_html/index.php
+index f8a0c4973..5fd1c57ec 100644
+--- a/public_html/index.php
++++ b/public_html/index.php
+@@ -36,6 +36,7 @@
+  +-------------------------------------------------------------------------+
+ */
+ 
++define('INSTALL_PATH', dirname($_SERVER['SCRIPT_FILENAME']) . '/../');
+ // include environment
+ require_once __DIR__ . '/../program/include/iniset.php';
+ 
+diff --git a/public_html/static.php b/public_html/static.php
+index f954ef365..a2cc3c24c 100644
+--- a/public_html/static.php
++++ b/public_html/static.php
+@@ -54,7 +54,7 @@ const ALLOWED_PATHS = [
+     'skins/',
+ ];
+ 
+-define('INSTALL_PATH', realpath(__DIR__ . '/..') . '/');
++define('INSTALL_PATH', dirname($_SERVER['SCRIPT_FILENAME']) . '/../');
+ 
+ $path = validateStaticFile($_SERVER['PATH_INFO']);
+ 
 -- 
-2.19.2
+2.51.2
 
diff --git a/pkgs/servers/roundcube/default.nix b/pkgs/servers/roundcube/default.nix
index f3ba282ef41f..6ed84bd702e4 100644
--- a/pkgs/servers/roundcube/default.nix
+++ b/pkgs/servers/roundcube/default.nix
@@ -6,15 +6,16 @@
   roundcube,
   roundcubePlugins,
   nixosTests,
+  runCommand,
 }:
 
 stdenv.mkDerivation rec {
   pname = "roundcube";
-  version = "1.6.15";
+  version = "1.7.0";
 
   src = fetchurl {
     url = "https://github.com/roundcube/roundcubemail/releases/download/${version}/roundcubemail-${version}-complete.tar.gz";
-    sha256 = "sha256-SMnyEsd0YBMkkfZwq69EC3ZcgnYmg0mmkJE3ZNJq++8=";
+    sha256 = "sha256-o0w2baK3okrUpjgrS7mmd8tYHuCL/GME0KmnIQmOepg=";
   };
 
   patches = [ ./0001-Don-t-resolve-symlinks-when-trying-to-find-INSTALL_P.patch ];
@@ -29,15 +30,18 @@ stdenv.mkDerivation rec {
     cp -r * $out/
     ln -sf /etc/roundcube/config.inc.php $out/config/config.inc.php
     rm -rf $out/installer
-    # shut up updater
-    rm $out/composer.json-dist
   '';
 
   passthru.withPlugins =
     f:
     buildEnv {
       name = "${roundcube.name}-with-plugins";
-      paths = (f roundcubePlugins) ++ [ roundcube ];
+      paths = (f roundcubePlugins) ++ [
+        roundcube
+        (runCommand "dummy" { } ''
+          mkdir -p $out/public_html/
+        '')
+      ];
     };
 
   passthru.tests = { inherit (nixosTests) roundcube; };
diff --git a/pkgs/stdenv/adapters.nix b/pkgs/stdenv/adapters.nix
index 639a383a4524..923de7168b55 100644
--- a/pkgs/stdenv/adapters.nix
+++ b/pkgs/stdenv/adapters.nix
@@ -175,7 +175,7 @@ rec {
   # Puts all the other ones together
   makeStatic =
     stdenv:
-    lib.foldl (lib.flip lib.id) stdenv (
+    lib.foldl' (lib.flip lib.id) stdenv (
       lib.optional stdenv.hostPlatform.isDarwin makeStaticDarwin
 
       ++ [
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 80bcab39b46a..30677fe10d08 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1555,6 +1555,7 @@ mapAliases {
   notary = throw "'notary' has been removed due to being archived upstream. Consider using 'notation' instead."; # Added 2025-11-13
   notepadqq = throw "'notepadqq' has been removed due to upstream stopping maintenance in 2023."; # Added 2026-02-10
   notes-up = throw "'notes-up' has been removed as it was unmaintained and depends on deprecated webkitgtk_4_0"; # Added 2025-10-09
+  notify-osd-customizable = throw "'notify-osd-customizable' has been removed as it was broken and unmaintained"; # Added 2026-04-17
   notify-sharp = throw "'notify-sharp' has been removed as it was unmaintained and depends on deprecated dbus-sharp versions"; # Added 2025-08-25
   noto-fonts-emoji = throw "'noto-fonts-emoji' has been renamed to/replaced by 'noto-fonts-color-emoji'"; # Converted to throw 2025-10-27
   noto-fonts-extra = throw "'noto-fonts-extra' has been renamed to/replaced by 'noto-fonts'"; # Converted to throw 2025-10-27
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 2129278fdef1..a7520ae5352d 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -155,6 +155,7 @@ mapAliases {
   django-crispy-bootstrap4 = crispy-bootstrap4; # added 2025-06-11
   django-crispy-bootstrap5 = crispy-bootstrap5; # added 2025-06-11
   django-cryptography = throw "'django-cryptography' has been removed as it was unmaintained upstream"; # Added 2026-03-22
+  django-mdeditor = throw "'django-mdeditor' has been removed as it was unmaintained upstream and the latest release was vulnerable"; # Added 2026-05-02
   django-modelsearch = modelsearch; # added 2026-03-02
   django_3 = throw "Django 3 has reached it's EOL in 2024-04 and has therefore been removed."; # added 2025-01-25
   django_4 = throw "Django 4 has reached it's EOL in 2026-04 and has therefore been removed."; # added 2026-03-30
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 4b6275a75fa9..fe6e846444b8 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4288,8 +4288,6 @@ self: super: with self; {
 
   django-mcp-server = callPackage ../development/python-modules/django-mcp-server { };
 
-  django-mdeditor = callPackage ../development/python-modules/django-mdeditor { };
-
   django-mfa3 = callPackage ../development/python-modules/django-mfa3 { };
 
   django-minify-html = callPackage ../development/python-modules/django-minify-html { };